ntdll.dll API hash lookup table
This post contains the hashes of the APIs that ntdll.dll (MD5: 9A03DD73B5539B788AD243AF07E7305B, SHA-1: 7053e1012e46206bb9625d620bfb8cadd046779b, SHA-256: 5b58f50147a78ab76127030d8ad745ac2ec1bde2487bf379430a6e8a79a20cc2) exports. The version of the DLL is 10.0.17763.194 (WinBuild.160101.0800).
The page is in essence an effort to document the exported APIs of important Windows libraries. Additional work has been documented in:
- iphlpapi.dll API hash lookup table
- kernel32.dll API hash lookup table
- ntoskrnl.exe API hash lookup table
Look up table
API name | hash |
---|---|
A_SHAFinal | 0x869ec636 |
A_SHAInit | 0x543689a1 |
A_SHAUpdate | 0xf243c835 |
AlpcAdjustCompletionListConcurrencyCount | 0x5a30ac92 |
AlpcFreeCompletionListMessage | 0x25c64408 |
AlpcGetCompletionListLastMessageInformation | 0x57603637 |
AlpcGetCompletionListMessageAttributes | 0x4a4c7a79 |
AlpcGetHeaderSize | 0x75e91891 |
AlpcGetMessageAttribute | 0xf6136902 |
AlpcGetMessageFromCompletionList | 0x5eb730c6 |
AlpcGetOutstandingCompletionListMessageCount | 0xef1b1edd |
AlpcInitializeMessageAttribute | 0x92821bad |
AlpcMaxAllowedMessageLength | 0x14024bfb |
AlpcRegisterCompletionList | 0xfc64b2a |
AlpcRegisterCompletionListWorkerThread | 0xfd01b37b |
AlpcRundownCompletionList | 0xd6c53af8 |
AlpcUnregisterCompletionList | 0xe5f16d5f |
AlpcUnregisterCompletionListWorkerThread | 0x5a64659f |
ApiSetQueryApiSetPresence | 0x1ee0f6b7 |
ApiSetQueryApiSetPresenceEx | 0x83dae593 |
CsrAllocateCaptureBuffer | 0xee4f6bd1 |
CsrAllocateMessagePointer | 0x7f9b2a27 |
CsrCaptureMessageBuffer | 0xe268dbf5 |
CsrCaptureMessageMultiUnicodeStringsInPlace | 0xd37d3b25 |
CsrCaptureMessageString | 0x45ee90b |
CsrCaptureTimeout | 0x232a155e |
CsrClientCallServer | 0x5037dd67 |
CsrClientConnectToServer | 0x387315db |
CsrFreeCaptureBuffer | 0x885d47ed |
CsrGetProcessId | 0xd1ae3add |
CsrIdentifyAlertableThread | 0x2dc40dae |
CsrSetPriorityClass | 0x4bee9a67 |
CsrVerifyRegion | 0x3727f04a |
DbgBreakPoint | 0x8ddde779 |
DbgPrint | 0x533ab46d |
DbgPrintEx | 0xead1be64 |
DbgPrintReturnControlC | 0xfe0a95f6 |
DbgPrompt | 0x6759899e |
DbgQueryDebugFilterState | 0xd305aff6 |
DbgSetDebugFilterState | 0x8727eaff |
DbgUiConnectToDbg | 0x6109f859 |
DbgUiContinue | 0x161d523e |
DbgUiConvertStateChangeStructure | 0xa0c9c400 |
DbgUiConvertStateChangeStructureEx | 0x27100b9b |
DbgUiDebugActiveProcess | 0x5b7ab4be |
DbgUiGetThreadDebugObject | 0x1175749c |
DbgUiIssueRemoteBreakin | 0xec6d1172 |
DbgUiRemoteBreakin | 0xc7a9dede |
DbgUiSetThreadDebugObject | 0x117574a2 |
DbgUiStopDebugging | 0xe554c77f |
DbgUiWaitStateChange | 0x2d4588ab |
DbgUserBreakPoint | 0x7fd111e6 |
EtwCheckCoverage | 0x182da46c |
EtwCreateTraceInstanceId | 0xaf0ddf8e |
EtwDeliverDataBlock | 0xb5f38a10 |
EtwEnumerateProcessRegGuids | 0x83aab5af |
EtwEventActivityIdControl | 0xcafdc9eb |
EtwEventEnabled | 0xb6a7e0e5 |
EtwEventProviderEnabled | 0xb4178a25 |
EtwEventRegister | 0xa16fd9ae |
EtwEventSetInformation | 0x8ea6fb0c |
EtwEventUnregister | 0xa6be38ee |
EtwEventWrite | 0xf98fcc2d |
EtwEventWriteEndScenario | 0xa9314426 |
EtwEventWriteEx | 0x3f30c0fe |
EtwEventWriteFull | 0xc3047ae8 |
EtwEventWriteNoRegistration | 0x68e00b25 |
EtwEventWriteStartScenario | 0xefc4a4a1 |
EtwEventWriteString | 0x2bdea533 |
EtwEventWriteTransfer | 0xd8e755c8 |
EtwGetTraceEnableFlags | 0xdb510443 |
EtwGetTraceEnableLevel | 0xdbadd7fc |
EtwGetTraceLoggerHandle | 0xb0fbc0cb |
EtwLogTraceEvent | 0x87b5dd48 |
EtwNotificationRegister | 0x2b7c2861 |
EtwNotificationUnregister | 0xd7f90316 |
EtwProcessPrivateLoggerRequest | 0xd2d23b70 |
EtwRegisterSecurityProvider | 0x4707e0ab |
EtwRegisterTraceGuidsA | 0x34efb9fe |
EtwRegisterTraceGuidsW | 0x34efba14 |
EtwReplyNotification | 0x244be39d |
EtwSendNotification | 0x981050bc |
EtwSetMark | 0x91712a78 |
EtwTraceEventInstance | 0xe109a143 |
EtwTraceMessage | 0xad3fa9b0 |
EtwTraceMessageVa | 0xfea6cdd5 |
EtwUnregisterTraceGuids | 0x49b9a8de |
EtwWriteUMSecurityEvent | 0xb0512516 |
EtwpCreateEtwThread | 0x14121aee |
EtwpGetCpuSpeed | 0x9892c968 |
EvtIntReportAuthzEventAndSourceAsync | 0x8c377ab |
EvtIntReportEventAndSourceAsync | 0xac46a3f7 |
ExpInterlockedPopEntrySListEnd | 0xd32792c9 |
ExpInterlockedPopEntrySListFault | 0x9e54f940 |
ExpInterlockedPopEntrySListResume | 0xe2de4b98 |
KiRaiseUserExceptionDispatcher | 0x4cf545d1 |
KiUserApcDispatcher | 0x4c80cbf0 |
KiUserCallbackDispatcher | 0x5fdf86f5 |
KiUserExceptionDispatcher | 0x4788b40 |
KiUserInvertedFunctionTable | 0x9b7ed158 |
LdrAccessResource | 0x909e6777 |
LdrAddDllDirectory | 0xbe11332c |
LdrAddLoadAsDataTable | 0xdb0bf5e2 |
LdrAddRefDll | 0xd222a225 |
LdrAppxHandleIntegrityFailure | 0xffa86906 |
LdrCallEnclave | 0x9c802335 |
LdrControlFlowGuardEnforced | 0xbd3b60b2 |
LdrCreateEnclave | 0x8d0aa447 |
LdrDeleteEnclave | 0x96a72447 |
LdrDisableThreadCalloutsForDll | 0xe05070ce |
LdrEnumResources | 0x2e6f0841 |
LdrEnumerateLoadedModules | 0xaddf5c32 |
LdrFastFailInLoaderCallout | 0x8e37704b |
LdrFindEntryForAddress | 0xaef9a611 |
LdrFindResourceDirectory_U | 0x4f8174be |
LdrFindResourceEx_U | 0xf40b8a1d |
LdrFindResource_U | 0x7a3d05fc |
LdrFlushAlternateResourceModules | 0x9682a710 |
LdrGetDllDirectory | 0xbe1134af |
LdrGetDllFullName | 0xaa55bd67 |
LdrGetDllHandle | 0xdb6b792f |
LdrGetDllHandleByMapping | 0x785ff370 |
LdrGetDllHandleByName | 0x82937051 |
LdrGetDllHandleEx | 0xade4c885 |
LdrGetDllPath | 0xd2badb9e |
LdrGetFailureData | 0xb5e75c73 |
LdrGetFileNameFromLoadAsDataTable | 0x7d880d67 |
LdrGetKnownDllSectionHandle | 0x3a05f47c |
LdrGetProcedureAddress | 0x9bb0f3ea |
LdrGetProcedureAddressEx | 0xc3cfb386 |
LdrGetProcedureAddressForCaller | 0x2ac55a1d |
LdrInitShimEngineDynamic | 0x370c16a4 |
LdrInitializeEnclave | 0x8331bbb5 |
LdrInitializeThunk | 0x250e14b5 |
LdrIsModuleSxsRedirected | 0x5d1bb1d9 |
LdrLoadAlternateResourceModule | 0x7634ab4 |
LdrLoadAlternateResourceModuleEx | 0x8d2ad935 |
LdrLoadDll | 0xe44d058f |
LdrLoadEnclaveModule | 0x84d57e3 |
LdrLockLoaderLock | 0xf4ccf80b |
LdrOpenImageFileOptionsKey | 0x6620539 |
LdrProcessInitializationComplete | 0x8d0d0235 |
LdrProcessRelocationBlock | 0x1c434da |
LdrProcessRelocationBlockEx | 0x10d3711f |
LdrQueryImageFileExecutionOptions | 0x6f65bca3 |
LdrQueryImageFileExecutionOptionsEx | 0x96f296d5 |
LdrQueryImageFileKeyOption | 0x50adf3b8 |
LdrQueryModuleServiceTags | 0xa7026293 |
LdrQueryOptionalDelayLoadedAPI | 0x51b500f7 |
LdrQueryProcessModuleInformation | 0xe4351e5d |
LdrRegisterDllNotification | 0x37a49128 |
LdrRemoveDllDirectory | 0x96d21bc4 |
LdrRemoveLoadAsDataTable | 0x4f57e243 |
LdrResFindResource | 0x8bc620c0 |
LdrResFindResourceDirectory | 0x14842397 |
LdrResGetRCConfig | 0xd820f952 |
LdrResRelease | 0x44c6bb77 |
LdrResSearchResource | 0x4e166503 |
LdrResolveDelayLoadedAPI | 0xf2e030fc |
LdrResolveDelayLoadsFromDll | 0xfc8197c4 |
LdrRscIsTypeExist | 0x318fa7e4 |
LdrSetAppCompatDllRedirectionCallback | 0xa8eccb56 |
LdrSetDefaultDllDirectories | 0xbf92f194 |
LdrSetDllDirectory | 0xbe1137af |
LdrSetDllManifestProber | 0x12e588b3 |
LdrSetImplicitPathOptions | 0xf413891f |
LdrSetMUICacheType | 0x840fe18 |
LdrShutdownProcess | 0x80a922ef |
LdrShutdownThread | 0xeb66d084 |
LdrStandardizeSystemPath | 0x34397e58 |
LdrSystemDllInitBlock | 0xf2f2501a |
LdrUnloadAlternateResourceModule | 0x80ae5936 |
LdrUnloadAlternateResourceModuleEx | 0xb964e31a |
LdrUnloadDll | 0xbe1b678 |
LdrUnlockLoaderLock | 0x31727f4d |
LdrUnregisterDllNotification | 0xe88cb8bc |
LdrUpdatePackageSearchPath | 0xd661a325 |
LdrVerifyImageMatchesChecksum | 0xacceb3d2 |
LdrVerifyImageMatchesChecksumEx | 0x3acf53cb |
LdrpResGetMappingSize | 0x84311188 |
LdrpResGetResourceDirectory | 0xf36f4a55 |
MD4Final | 0x6c964705 |
MD4Init | 0xcb6645a7 |
MD4Update | 0xb133e212 |
MD5Final | 0x6e964705 |
MD5Init | 0xcb7645a7 |
MD5Update | 0xf133e212 |
NlsAnsiCodePage | 0xe0c070d8 |
NlsMbCodePageTag | 0xcac0afae |
NlsMbOemCodePageTag | 0x9633a4e9 |
NtAcceptConnectPort | 0x8f484dd0 |
NtAccessCheck | 0xc5766715 |
NtAccessCheckAndAuditAlarm | 0xffccf917 |
NtAccessCheckByType | 0xfd198c2a |
NtAccessCheckByTypeAndAuditAlarm | 0x6f134342 |
NtAccessCheckByTypeResultList | 0x501e4ff0 |
NtAccessCheckByTypeResultListAndAuditAlarm | 0x151ccacd |
NtAccessCheckByTypeResultListAndAuditAlarmByHandle | 0xf3136d28 |
NtAcquireProcessActivityReference | 0x9b02a0c9 |
NtAddAtom | 0xe62affe |
NtAddAtomEx | 0x8ac00151 |
NtAddBootEntry | 0xea5a4f1 |
NtAddDriverEntry | 0x9baa190b |
NtAdjustGroupsToken | 0x9d682745 |
NtAdjustPrivilegesToken | 0xaf56428e |
NtAdjustTokenClaimsAndDeviceGroups | 0xdedaedbf |
NtAlertResumeThread | 0xa021f332 |
NtAlertThread | 0xc9cc8936 |
NtAlertThreadByThreadId | 0xf65fc71 |
NtAllocateLocallyUniqueId | 0x25d27426 |
NtAllocateReserveObject | 0xf70a48b4 |
NtAllocateUserPhysicalPages | 0x74998d16 |
NtAllocateUuids | 0x174a8b85 |
NtAllocateVirtualMemory | 0xf539d4f3 |
NtAllocateVirtualMemoryEx | 0xe753d8ec |
NtAlpcAcceptConnectPort | 0x153cba17 |
NtAlpcCancelMessage | 0xba745684 |
NtAlpcConnectPort | 0x4055cd5d |
NtAlpcConnectPortEx | 0x57357e19 |
NtAlpcCreatePort | 0x28112d7e |
NtAlpcCreatePortSection | 0xd0f51e54 |
NtAlpcCreateResourceReserve | 0x1fdb0665 |
NtAlpcCreateSectionView | 0x65a0ce23 |
NtAlpcCreateSecurityContext | 0x7685448f |
NtAlpcDeletePortSection | 0xd0f5b81c |
NtAlpcDeleteResourceReserve | 0xbc5b066e |
NtAlpcDeleteSectionView | 0x65a167eb |
NtAlpcDeleteSecurityContext | 0x13054499 |
NtAlpcDisconnectPort | 0xb113b5b5 |
NtAlpcImpersonateClientContainerOfPort | 0x49dba546 |
NtAlpcImpersonateClientOfPort | 0x61ca18b6 |
NtAlpcOpenSenderProcess | 0x1c2f11e1 |
NtAlpcOpenSenderThread | 0x7842fffc |
NtAlpcQueryInformation | 0xfc642556 |
NtAlpcQueryInformationMessage | 0xf48c3c10 |
NtAlpcRevokeSecurityContext | 0x3c3c4579 |
NtAlpcSendWaitReceivePort | 0x289126b3 |
NtAlpcSetInformation | 0xc40d7578 |
NtApphelpCacheControl | 0xdaa000bf |
NtAreMappedFilesTheSame | 0xd94603cd |
NtAssignProcessToJobObject | 0x7d00cc6 |
NtAssociateWaitCompletionPacket | 0xca49d420 |
NtCallEnclave | 0x3d80229c |
NtCallbackReturn | 0xb24b146d |
NtCancelIoFile | 0xfc26d8cb |
NtCancelIoFileEx | 0x9b633908 |
NtCancelSynchronousIoFile | 0x8767520a |
NtCancelTimer | 0x388ed249 |
NtCancelTimer2 | 0x11da4959 |
NtCancelWaitCompletionPacket | 0x3406140f |
NtClearEvent | 0x51657175 |
NtClose | 0x6c67cad9 |
NtCloseObjectAuditAlarm | 0x7a7c28aa |
NtCommitComplete | 0xc97bc6a6 |
NtCommitEnlistment | 0x3e076850 |
NtCommitRegistryTransaction | 0x1e8de9d |
NtCommitTransaction | 0x9a90eafd |
NtCompactKeys | 0x28817431 |
NtCompareObjects | 0xb3233dbc |
NtCompareSigningLevels | 0xeca9730 |
NtCompareTokens | 0x58699b49 |
NtCompleteConnectPort | 0x9b54bd2a |
NtCompressKey | 0x6c8509bb |
NtConnectPort | 0x28841c43 |
NtContinue | 0xa3807d39 |
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter | 0xa82ac05c |
NtCreateCrossVmEvent | 0xaab83a39 |
NtCreateDebugObject | 0x1eba50a1 |
NtCreateDirectoryObject | 0xd91d39c6 |
NtCreateDirectoryObjectEx | 0x74e7247c |
NtCreateEnclave | 0x8d083ecb |
NtCreateEnlistment | 0x834b68ff |
NtCreateEvent | 0xe9a74a5e |
NtCreateEventPair | 0xa6182c06 |
NtCreateFile | 0x574d8726 |
NtCreateIRTimer | 0x5416ecb9 |
NtCreateIoCompletion | 0x2da5c62a |
NtCreateJobObject | 0xa705400f |
NtCreateJobSet | 0x3e775e71 |
NtCreateKey | 0xaba7fc3 |
NtCreateKeyTransacted | 0x6b5a7d12 |
NtCreateKeyedEvent | 0x6260a066 |
NtCreateLowBoxToken | 0x6ffe3c45 |
NtCreateMailslotFile | 0x364b82f0 |
NtCreateMutant | 0x44e09791 |
NtCreateNamedPipeFile | 0x535de36a |
NtCreatePagingFile | 0x78694b88 |
NtCreatePartition | 0xf17a571d |
NtCreatePort | 0x57529ff5 |
NtCreatePrivateNamespace | 0xb93bac96 |
NtCreateProcess | 0x55c3ce7c |
NtCreateProcessEx | 0xf39fa6f |
NtCreateProfile | 0x55c55d8e |
NtCreateProfileEx | 0x1576426f |
NtCreateRegistryTransaction | 0x81fec745 |
NtCreateResourceManager | 0x1320790a |
NtCreateSection | 0xfb0c5df7 |
NtCreateSectionEx | 0x3177e904 |
NtCreateSemaphore | 0x8be47293 |
NtCreateSymbolicLinkObject | 0x2f7e5f1a |
NtCreateThread | 0x520fa5e1 |
NtCreateThreadEx | 0x3e978e60 |
NtCreateTimer | 0xea90e93c |
NtCreateTimer2 | 0x521d27cf |
NtCreateToken | 0xea93e138 |
NtCreateTokenEx | 0x4f84ecc2 |
NtCreateTransaction | 0x431100e6 |
NtCreateTransactionManager | 0x219a3058 |
NtCreateUserProcess | 0xa5cc9582 |
NtCreateWaitCompletionPacket | 0x44bdb19f |
NtCreateWaitablePort | 0xb460a32c |
NtCreateWnfStateName | 0x8492ea15 |
NtCreateWorkerFactory | 0xc69be46 |
NtDebugActiveProcess | 0x768ea4b |
NtDebugContinue | 0x178d64a6 |
NtDelayExecution | 0x9521a8b6 |
NtDeleteAtom | 0x574b46c7 |
NtDeleteBootEntry | 0xa137761e |
NtDeleteDriverEntry | 0xe2eecf55 |
NtDeleteFile | 0x574d9a5f |
NtDeleteKey | 0xd2ba805c |
NtDeleteObjectAuditAlarm | 0x55154aca |
NtDeletePrivateNamespace | 0x493badca |
NtDeleteValueKey | 0xa7292e70 |
NtDeleteWnfStateData | 0x84a123f1 |
NtDeleteWnfStateName | 0x84a62315 |
NtDeviceIoControlFile | 0x4a986a4c |
NtDisableLastKnownGood | 0x5a24e803 |
NtDisplayString | 0x63d535ba |
NtDrawText | 0x49a5d9b1 |
NtDuplicateObject | 0x1c59177f |
NtDuplicateToken | 0x59394cc3 |
NtEnableLastKnownGood | 0xc98449ba |
NtEnumerateBootEntries | 0xde21ec72 |
NtEnumerateDriverEntries | 0xe1d0909f |
NtEnumerateKey | 0xadbaca01 |
NtEnumerateSystemEnvironmentValuesEx | 0x94ffcb3c |
NtEnumerateTransactionObject | 0xf52d70b6 |
NtEnumerateValueKey | 0xf0df2f03 |
NtExtendSection | 0x1e48d7f0 |
NtFilterBootOption | 0x23c2b003 |
NtFilterToken | 0x449ec8cd |
NtFilterTokenEx | 0x7b233e2a |
NtFindAtom | 0x226c9498 |
NtFlushBuffersFile | 0x9aa20720 |
NtFlushBuffersFileEx | 0x881c8b82 |
NtFlushInstallUILanguage | 0xc6411d68 |
NtFlushInstructionCache | 0xfe21c1ce |
NtFlushKey | 0xf16f6f64 |
NtFlushProcessWriteBuffers | 0x52e85d89 |
NtFlushVirtualMemory | 0x100f089b |
NtFlushWriteBuffer | 0x3b259dbd |
NtFreeUserPhysicalPages | 0xf4321407 |
NtFreeVirtualMemory | 0x7da8eced |
NtFreezeRegistry | 0x68f193f6 |
NtFreezeTransactions | 0x62801e47 |
NtFsControlFile | 0xff7f180e |
NtGetCachedSigningLevel | 0x16fe55e5 |
NtGetCompleteWnfStateSubscription | 0xdfbeb3ca |
NtGetContextThread | 0x2237db8e |
NtGetCurrentProcessorNumber | 0xe6022f63 |
NtGetCurrentProcessorNumberEx | 0x8bd98b0 |
NtGetDevicePowerState | 0x15a04505 |
NtGetMUIRegistryInfo | 0x7fa045fc |
NtGetNextProcess | 0x766acc1c |
NtGetNextThread | 0x5314ddce |
NtGetNlsSectionPtr | 0xfb356954 |
NtGetNotificationResourceManager | 0xb4fe384a |
NtGetTickCount | 0xff8c3a38 |
NtGetWriteWatch | 0x73fdc69a |
NtImpersonateAnonymousToken | 0x5b6a560f |
NtImpersonateClientOfPort | 0xc04cfda4 |
NtImpersonateThread | 0x90d14a10 |
NtInitializeEnclave | 0x2b71bb8f |
NtInitializeNlsFiles | 0xbdb4aa0 |
NtInitializeRegistry | 0x36106c64 |
NtInitiatePowerAction | 0xae66ccb7 |
NtIsProcessInJob | 0x4a10a21 |
NtIsSystemResumeAutomatic | 0xfddeeb08 |
NtIsUILanguageComitted | 0xa3c940c1 |
NtListenPort | 0xf9e3b769 |
NtLoadDriver | 0xb8305733 |
NtLoadEnclaveData | 0x75e76d3e |
NtLoadKey | 0xe4438acc |
NtLoadKey2 | 0x887159ce |
NtLoadKey3 | 0x887159cf |
NtLoadKeyEx | 0xe2b3ca9 |
NtLockFile | 0x8cdee861 |
NtLockProductActivationKeys | 0x29441a58 |
NtLockRegistryKey | 0x16847763 |
NtLockVirtualMemory | 0x7daed479 |
NtMakePermanentObject | 0x3cf70b4e |
NtMakeTemporaryObject | 0x2eaf886f |
NtManageHotPatch | 0xf5c631c4 |
NtManagePartition | 0x8146597c |
NtMapCMFModule | 0x89362802 |
NtMapUserPhysicalPages | 0x657e4ad5 |
NtMapUserPhysicalPagesScatter | 0xb83e33d2 |
NtMapViewOfSection | 0x30c565b9 |
NtMapViewOfSectionEx | 0x1596eddb |
NtModifyBootEntry | 0x2301f872 |
NtModifyDriverEntry | 0xcf81d5d |
NtNotifyChangeDirectoryFile | 0x8d041d14 |
NtNotifyChangeDirectoryFileEx | 0x10745b4c |
NtNotifyChangeKey | 0x991cd3d7 |
NtNotifyChangeMultipleKeys | 0x7a30ee1b |
NtNotifyChangeSession | 0x3d54c41d |
NtOpenDirectoryObject | 0x82da1a77 |
NtOpenEnlistment | 0x61bbc154 |
NtOpenEvent | 0x21d374ce |
NtOpenEventPair | 0x4d0baec9 |
NtOpenFile | 0xd10ee879 |
NtOpenIoCompletion | 0xef0719a3 |
NtOpenJobObject | 0x4df8c2d2 |
NtOpenKey | 0xa6888acd |
NtOpenKeyEx | 0x222b3fb2 |
NtOpenKeyTransacted | 0x9784ec4a |
NtOpenKeyTransactedEx | 0x13b13376 |
NtOpenKeyedEvent | 0x40d0f8bb |
NtOpenMutant | 0x4a65e578 |
NtOpenObjectAuditAlarm | 0xfcb15fab |
NtOpenPartition | 0x986dd9e0 |
NtOpenPrivateNamespace | 0xf0d7c2ab |
NtOpenProcess | 0x66d8b5d |
NtOpenProcessToken | 0xbf861424 |
NtOpenProcessTokenEx | 0x18509c16 |
NtOpenRegistryTransaction | 0x8d096313 |
NtOpenResourceManager | 0xbcdd59ba |
NtOpenSection | 0xabb61ad8 |
NtOpenSemaphore | 0x32d7f556 |
NtOpenSession | 0xacb59ad8 |
NtOpenSymbolicLinkObject | 0x9fd6b3f8 |
NtOpenThread | 0x5794f3c8 |
NtOpenThreadToken | 0x962862f5 |
NtOpenThreadTokenEx | 0xa18bdf70 |
NtOpenTimer | 0x22bd13ac |
NtOpenTransaction | 0x111c0b82 |
NtOpenTransactionManager | 0x91f28536 |
NtPlugPlayControl | 0x2a3b7005 |
NtPowerInformation | 0xf4b47897 |
NtPrePrepareComplete | 0x53f872d |
NtPrePrepareEnlistment | 0x4d09813f |
NtPrepareComplete | 0x2b1bff04 |
NtPrepareEnlistment | 0xbee8ddd6 |
NtPrivilegeCheck | 0xe4cdbdb4 |
NtPrivilegeObjectAuditAlarm | 0x2492f051 |
NtPrivilegedServiceAuditAlarm | 0xbd0aaa2e |
NtPropagationComplete | 0x3b9c9149 |
NtPropagationFailed | 0x9e2cd63f |
NtProtectVirtualMemory | 0xd3727f4 |
NtPulseEvent | 0xb7671ab1 |
NtQueryAttributesFile | 0xa032eb8f |
NtQueryAuxiliaryCounterFrequency | 0x4a526084 |
NtQueryBootEntryOrder | 0xf38c62b5 |
NtQueryBootOptions | 0xf4342f9 |
NtQueryDebugFilterState | 0xd0e0c9f6 |
NtQueryDefaultLocale | 0xeddff001 |
NtQueryDefaultUILanguage | 0x47be88c |
NtQueryDirectoryFile | 0xfca1fe40 |
NtQueryDirectoryFileEx | 0x87f90d0a |
NtQueryDirectoryObject | 0x998810c6 |
NtQueryDriverEntryOrder | 0x2e4b5975 |
NtQueryEaFile | 0xeb87ba98 |
NtQueryEvent | 0x9f673a79 |
NtQueryFullAttributesFile | 0x8c17e3bf |
NtQueryInformationAtom | 0x1f6ee195 |
NtQueryInformationByName | 0xbdc5b282 |
NtQueryInformationEnlistment | 0x35545481 |
NtQueryInformationFile | 0x1f71352d |
NtQueryInformationJobObject | 0xb495876b |
NtQueryInformationPort | 0x1f764dfc |
NtQueryInformationProcess | 0x2cc7328e |
NtQueryInformationResourceManager | 0x16848ae1 |
NtQueryInformationThread | 0xe0c7c101 |
NtQueryInformationToken | 0xef09a211 |
NtQueryInformationTransaction | 0x842e711c |
NtQueryInformationTransactionManager | 0x2a85b20a |
NtQueryInformationWorkerFactory | 0x822a974a |
NtQueryInstallUILanguage | 0xc46133f0 |
NtQueryIntervalProfile | 0xc09254e7 |
NtQueryIoCompletion | 0xdba546ff |
NtQueryKey | 0x1167efbf |
NtQueryLicenseValue | 0x8e17c9bf |
NtQueryMultipleValueKey | 0xb8a1944d |
NtQueryMutant | 0xfcde9ae7 |
NtQueryObject | 0xffa9a987 |
NtQueryOpenSubKeys | 0x1848322a |
NtQueryOpenSubKeysEx | 0x20c8b179 |
NtQueryPerformanceCounter | 0x3db8de3c |
NtQueryPortInformationProcess | 0xcfc60480 |
NtQueryQuotaInformationFile | 0xf573fec3 |
NtQuerySection | 0xfaccc8ce |
NtQuerySecurityAttributesToken | 0x1242c5c5 |
NtQuerySecurityObject | 0xbac2019a |
NtQuerySecurityPolicy | 0xbd93119f |
NtQuerySemaphore | 0x8d8fce92 |
NtQuerySymbolicLinkObject | 0x9afe3f4f |
NtQuerySystemEnvironmentValue | 0x9e1fbcda |
NtQuerySystemEnvironmentValueEx | 0x7ef37390 |
NtQuerySystemInformation | 0x42026b16 |
NtQuerySystemInformationEx | 0x9ac6220 |
NtQuerySystemTime | 0x5c3c43eb |
NtQueryTimer | 0xa050d957 |
NtQueryTimerResolution | 0x4f4dc46 |
NtQueryValueKey | 0x6ba6894f |
NtQueryVirtualMemory | 0x1177887d |
NtQueryVolumeInformationFile | 0x95b09236 |
NtQueryWnfStateData | 0x328d6bc7 |
NtQueryWnfStateNameInformation | 0xd7172518 |
NtQueueApcThread | 0xf31e12c6 |
NtQueueApcThreadEx | 0x784b24e4 |
NtRaiseException | 0xd79728d1 |
NtRaiseHardError | 0x92e64f21 |
NtReadFile | 0x86ee88f |
NtReadFileScatter | 0xcfc3219f |
NtReadOnlyEnlistment | 0x200d557d |
NtReadRequestData | 0x710a5cf3 |
NtReadVirtualMemory | 0x7db483eb |
NtRecoverEnlistment | 0x89e7556 |
NtRecoverResourceManager | 0xc02b1f22 |
NtRecoverTransactionManager | 0x74a686dd |
NtRegisterProtocolAddressInformation | 0xcc714c98 |
NtRegisterThreadTerminatePort | 0xaafe22a |
NtReleaseKeyedEvent | 0x9e7faee7 |
NtReleaseMutant | 0x35c8ab53 |
NtReleaseSemaphore | 0x95c56b07 |
NtReleaseWorkerFactoryWorker | 0x1a155028 |
NtRemoveIoCompletion | 0x2f7909ae |
NtRemoveIoCompletionEx | 0xe426c1d5 |
NtRemoveProcessDebug | 0xfef2e227 |
NtRenameKey | 0x4a4a8e5d |
NtRenameTransactionManager | 0xa20f0254 |
NtReplaceKey | 0xf13e61b4 |
NtReplacePartitionUnit | 0xf9d2f748 |
NtReplyPort | 0xe1009ff8 |
NtReplyWaitReceivePort | 0xa03f52ea |
NtReplyWaitReceivePortEx | 0xfd4bb398 |
NtReplyWaitReplyPort | 0x5c953c19 |
NtRequestPort | 0x48bedf7b |
NtRequestWaitReplyPort | 0x24858911 |
NtResetEvent | 0x55674ae6 |
NtResetWriteWatch | 0x344f677f |
NtRestoreKey | 0xe2e61cf |
NtResumeProcess | 0x3f7e477d |
NtResumeThread | 0x595d79a9 |
NtRevertContainerImpersonation | 0x707649f7 |
NtRollbackComplete | 0x9dff1cb8 |
NtRollbackEnlistment | 0x4b5fafa2 |
NtRollbackRegistryTransaction | 0xad32048 |
NtRollbackTransaction | 0x4599d53f |
NtRollforwardTransactionManager | 0xe567ad8a |
NtSaveKey | 0x89940ace |
NtSaveKeyEx | 0x502b433e |
NtSaveMergedKeys | 0xdd07b9e9 |
NtSecureConnectPort | 0xa7da5df0 |
NtSerializeBoot | 0x9ec8633c |
NtSetBootEntryOrder | 0xe759f45b |
NtSetBootOptions | 0x328f2a94 |
NtSetCachedSigningLevel | 0x16fe56a5 |
NtSetCachedSigningLevel2 | 0xdfcad4d4 |
NtSetContextThread | 0x22383b8e |
NtSetDebugFilterState | 0x72761c6 |
NtSetDefaultHardErrorPort | 0xa78e8b2 |
NtSetDefaultLocale | 0x1d7e5c8f |
NtSetDefaultUILanguage | 0xcd4ee272 |
NtSetDriverEntryOrder | 0x6491f144 |
NtSetEaFile | 0x917b882a |
NtSetEvent | 0x2c96d8e6 |
NtSetEventBoostPriority | 0xba33b67 |
NtSetHighEventPair | 0xe3c98c88 |
NtSetHighWaitLowEventPair | 0x8e351cdb |
NtSetIRTimer | 0x125109c5 |
NtSetInformationDebugObject | 0x2d6966cb |
NtSetInformationEnlistment | 0xd3c0e1b0 |
NtSetInformationFile | 0x992369eb |
NtSetInformationJobObject | 0x3188ebd5 |
NtSetInformationKey | 0x34c92ed9 |
NtSetInformationObject | 0x9f36bb38 |
NtSetInformationProcess | 0x47266f67 |
NtSetInformationResourceManager | 0x75c163fb |
NtSetInformationSymbolicLink | 0x281be58 |
NtSetInformationThread | 0xa99abae8 |
NtSetInformationToken | 0x255039e1 |
NtSetInformationTransaction | 0x51c01710 |
NtSetInformationTransactionManager | 0x9712e1a8 |
NtSetInformationVirtualMemory | 0xde01602 |
NtSetInformationWorkerFactory | 0xc8c26680 |
NtSetIntervalProfile | 0x3a4489a6 |
NtSetIoCompletion | 0x45223a64 |
NtSetIoCompletionEx | 0x88e99a2c |
NtSetLdtEntries | 0x87d4ad32 |
NtSetLowEventPair | 0x8b866fed |
NtSetLowWaitHighEventPair | 0xf6828ef0 |
NtSetQuotaInformationFile | 0x7267632d |
NtSetSecurityObject | 0xae8f9340 |
NtSetSystemEnvironmentValue | 0x6bb162ce |
NtSetSystemEnvironmentValueEx | 0xc58b42c6 |
NtSetSystemInformation | 0xad564fd |
NtSetSystemPowerState | 0xf6c0c1ff |
NtSetSystemTime | 0x3556a328 |
NtSetThreadExecutionState | 0x55e45d47 |
NtSetTimer | 0x2d8077c4 |
NtSetTimer2 | 0xb00ef8b7 |
NtSetTimerEx | 0x1df19ce |
NtSetTimerResolution | 0x7ea71104 |
NtSetUuidSeed | 0x33c437cf |
NtSetValueKey | 0x3adccfe7 |
NtSetVolumeInformationFile | 0x341d1f66 |
NtSetWnfProcessNotificationEvent | 0x47a0bf42 |
NtShutdownSystem | 0xea2add8d |
NtShutdownWorkerFactory | 0xd4bd9762 |
NtSignalAndWaitForSingleObject | 0xe9dc71f7 |
NtSinglePhaseReject | 0x252a69dc |
NtStartProfile | 0x5681483d |
NtStopProfile | 0x67fa47f |
NtSubscribeWnfStateChange | 0x4d6f044f |
NtSuspendProcess | 0x7672c1b5 |
NtSuspendThread | 0x1b151d7b |
NtSystemDebugControl | 0x7399448f |
NtTerminateEnclave | 0x32e2e48a |
NtTerminateJobObject | 0x119c3aa7 |
NtTerminateProcess | 0xfb9e743a |
NtTerminateThread | 0x473e7b0f |
NtTestAlert | 0xad8e79f9 |
NtThawRegistry | 0x8077f906 |
NtThawTransactions | 0xb38196ad |
NtTraceControl | 0x10f05d29 |
NtTraceEvent | 0xb7679755 |
NtTranslateFilePath | 0xcce42357 |
NtUmsThreadYield | 0x18a624d6 |
NtUnloadDriver | 0xfb9c57d6 |
NtUnloadKey | 0xe58a11a4 |
NtUnloadKey2 | 0xb14234ce |
NtUnloadKeyEx | 0x28469cae |
NtUnlockFile | 0xb5afc361 |
NtUnlockVirtualMemory | 0x990ed993 |
NtUnmapViewOfSection | 0x1a065e2 |
NtUnmapViewOfSectionEx | 0x8197911e |
NtUnsubscribeWnfStateChange | 0xd4470595 |
NtUpdateWnfStateData | 0x86cbe2f1 |
NtVdmControl | 0xcdf6fdc5 |
NtWaitForAlertByThreadId | 0xd11b2aa3 |
NtWaitForDebugEvent | 0xf2b7ad8f |
NtWaitForKeyedEvent | 0xecb88e43 |
NtWaitForMultipleObjects | 0xe246e2a6 |
NtWaitForMultipleObjects32 | 0x1b8aa21b |
NtWaitForSingleObject | 0x981582ce |
NtWaitForWorkViaWorkerFactory | 0xc926df18 |
NtWaitHighEventPair | 0x206cfd8a |
NtWaitLowEventPair | 0x956b8b75 |
NtWorkerFactoryWorkerReady | 0xf37473f |
NtWriteFile | 0x2fbb8c90 |
NtWriteFileGather | 0xa03a9036 |
NtWriteRequestData | 0xab6f7cfc |
NtWriteVirtualMemory | 0x1234a8d5 |
NtYieldExecution | 0xd1cb08e0 |
NtdllDefWindowProc_A | 0xd17ab1b0 |
NtdllDefWindowProc_W | 0xd17ab1c6 |
NtdllDialogWndProc_A | 0xcc11c4ab |
NtdllDialogWndProc_W | 0xcc11c4c1 |
PfxFindPrefix | 0xdc3d5226 |
PfxInitialize | 0xd314510 |
PfxInsertPrefix | 0x4d9b0319 |
PfxRemovePrefix | 0x91f64d35 |
PssNtCaptureSnapshot | 0x5fcf87bb |
PssNtDuplicateSnapshot | 0xd3168251 |
PssNtFreeRemoteSnapshot | 0xaad0454b |
PssNtFreeSnapshot | 0xae63eb6b |
PssNtFreeWalkMarker | 0x33f8b22 |
PssNtQuerySnapshot | 0x9fd49675 |
PssNtValidateDescriptor | 0xd1a02f6a |
PssNtWalkSnapshot | 0xb6a0d16b |
RtlAbortRXact | 0xc906166e |
RtlAbsoluteToSelfRelativeSD | 0x87787208 |
RtlAcquirePebLock | 0x3aff1990 |
RtlAcquirePrivilege | 0x100ab69b |
RtlAcquireReleaseSRWLockExclusive | 0xfc3244dc |
RtlAcquireResourceExclusive | 0x6d3b0c81 |
RtlAcquireResourceShared | 0xcdb7f063 |
RtlAcquireSRWLockExclusive | 0x82bd9688 |
RtlAcquireSRWLockShared | 0xe1c61b68 |
RtlActivateActivationContext | 0x5893703f |
RtlActivateActivationContextEx | 0x4dc1067a |
RtlActivateActivationContextUnsafeFast | 0xd37d06d2 |
RtlAddAccessAllowedAce | 0x50be6d45 |
RtlAddAccessAllowedAceEx | 0xf9b51e5a |
RtlAddAccessAllowedObjectAce | 0x649aba10 |
RtlAddAccessDeniedAce | 0x7564ee71 |
RtlAddAccessDeniedAceEx | 0x93b9ceed |
RtlAddAccessDeniedObjectAce | 0x6dc45a5b |
RtlAddAccessFilterAce | 0xb6bf091 |
RtlAddAce | 0x88736680 |
RtlAddActionToRXact | 0x7d994527 |
RtlAddAtomToAtomTable | 0x7fd7712c |
RtlAddAttributeActionToRXact | 0xc06a9d81 |
RtlAddAuditAccessAce | 0xf2e18eaa |
RtlAddAuditAccessAceEx | 0x863ab4e3 |
RtlAddAuditAccessObjectAce | 0xcd238269 |
RtlAddCompoundAce | 0x24831cea |
RtlAddFunctionTable | 0x94a50f17 |
RtlAddGrowableFunctionTable | 0xf71ce719 |
RtlAddIntegrityLabelToBoundaryDescriptor | 0xbfe3cedc |
RtlAddMandatoryAce | 0x582728f9 |
RtlAddProcessTrustLabelAce | 0x13213b5e |
RtlAddRefActivationContext | 0x8fee7a44 |
RtlAddRefMemoryStream | 0x2e23ede8 |
RtlAddResourceAttributeAce | 0x3e1659e8 |
RtlAddSIDToBoundaryDescriptor | 0x41a43d76 |
RtlAddScopedPolicyIDAce | 0x56ed03af |
RtlAddVectoredContinueHandler | 0x36a9d316 |
RtlAddVectoredExceptionHandler | 0x8f6d1aeb |
RtlAddressInSectionTable | 0x4de97ee6 |
RtlAdjustPrivilege | 0x19d9e5ff |
RtlAllocateActivationContextStack | 0x241d43c1 |
RtlAllocateAndInitializeSid | 0xa391ca6e |
RtlAllocateAndInitializeSidEx | 0x4729c3a6 |
RtlAllocateHandle | 0xce671e27 |
RtlAllocateHeap | 0x10b3a830 |
RtlAllocateMemoryBlockLookaside | 0xbf179ffa |
RtlAllocateMemoryZone | 0xafec5491 |
RtlAllocateWnfSerializationGroup | 0x2dea24e7 |
RtlAnsiCharToUnicodeChar | 0xe3698e38 |
RtlAnsiStringToUnicodeSize | 0x99c3e79d |
RtlAnsiStringToUnicodeString | 0x104a948e |
RtlAppendAsciizToString | 0x1f2a474f |
RtlAppendPathElement | 0xf995682 |
RtlAppendStringToString | 0x36aad473 |
RtlAppendUnicodeStringToString | 0xceeda6c |
RtlAppendUnicodeToString | 0x82ac50 |
RtlApplicationVerifierStop | 0x8623ed02 |
RtlApplyRXact | 0x53062475 |
RtlApplyRXactNoFlush | 0xfac90686 |
RtlAppxIsFileOwnedByTrustedInstaller | 0x5f00a48f |
RtlAreAllAccessesGranted | 0xade0f305 |
RtlAreAnyAccessesGranted | 0xade35b05 |
RtlAreBitsClear | 0xccbc9b66 |
RtlAreBitsSet | 0xb5336e52 |
RtlAreLongPathsEnabled | 0xce7dd0c7 |
RtlAssert | 0x896b786f |
RtlAvlInsertNodeEx | 0x9421d6f8 |
RtlAvlRemoveNode | 0xff361f45 |
RtlBarrier | 0x49656883 |
RtlBarrierForDelete | 0xbb9855a6 |
RtlCallEnclaveReturn | 0x50ebeb7f |
RtlCancelTimer | 0x948ed2ef |
RtlCanonicalizeDomainName | 0x78d41ee |
RtlCapabilityCheck | 0x3332a1ba |
RtlCapabilityCheckForSingleSessionSku | 0x80b5268b |
RtlCaptureContext | 0xef507439 |
RtlCaptureStackBackTrace | 0x5f3abc36 |
RtlCharToInteger | 0x89096e79 |
RtlCheckBootStatusIntegrity | 0xa112e6f2 |
RtlCheckForOrphanedCriticalSections | 0x4ffc3285 |
RtlCheckPortableOperatingSystem | 0xa4e94ec6 |
RtlCheckRegistryKey | 0x6d20f650 |
RtlCheckSandboxedToken | 0x6f7ecacb |
RtlCheckSystemBootStatusIntegrity | 0x2552782c |
RtlCheckTokenCapability | 0x1c24545a |
RtlCheckTokenMembership | 0x62b912d9 |
RtlCheckTokenMembershipEx | 0xe44b6ea2 |
RtlCleanUpTEBLangLists | 0x97fbb9bf |
RtlClearAllBits | 0x21fcd03 |
RtlClearBit | 0xd1a103c7 |
RtlClearBits | 0x3420796d |
RtlClearThreadWorkOnBehalfTicket | 0x8f4e9b18 |
RtlCloneMemoryStream | 0x43633009 |
RtlCloneUserProcess | 0x55f41f5e |
RtlCmDecodeMemIoResource | 0xd11e54a5 |
RtlCmEncodeMemIoResource | 0xd63e54a5 |
RtlCommitDebugInfo | 0x83807e15 |
RtlCommitMemoryStream | 0xe6f3cb1 |
RtlCompactHeap | 0x847ff1d4 |
RtlCompareAltitudes | 0x62bf3633 |
RtlCompareMemory | 0x49cd5d3f |
RtlCompareMemoryUlong | 0x841b64e1 |
RtlCompareString | 0x56bfc4ad |
RtlCompareUnicodeString | 0xc0541893 |
RtlCompareUnicodeStrings | 0xa8312eb |
RtlCompleteProcessCloning | 0x9be60fe0 |
RtlCompressBuffer | 0x74290954 |
RtlComputeCrc32 | 0xb1b4bbc6 |
RtlComputeImportTableHash | 0x3c9f3233 |
RtlComputePrivatizedDllName_U | 0x121ffe0c |
RtlConnectToSm | 0x84861902 |
RtlConsoleMultiByteToUnicodeN | 0xb9aaca2a |
RtlConstructCrossVmEventPath | 0x35ba4970 |
RtlContractHashTable | 0xc55375a4 |
RtlConvertDeviceFamilyInfoToString | 0x68c3c120 |
RtlConvertExclusiveToShared | 0x3ce2fb4b |
RtlConvertLCIDToString | 0xeee28e85 |
RtlConvertSRWLockExclusiveToShared | 0x39e0b0b3 |
RtlConvertSharedToExclusive | 0x67f45a14 |
RtlConvertSidToUnicodeString | 0x178c57ad |
RtlConvertToAutoInheritSecurityObject | 0xcd41aa38 |
RtlCopyBitMap | 0x26841334 |
RtlCopyContext | 0x1c35f7f9 |
RtlCopyExtendedContext | 0x33b51154 |
RtlCopyLuid | 0xa90ecfb8 |
RtlCopyLuidAndAttributesArray | 0x9030f9c1 |
RtlCopyMappedMemory | 0xaf88f2a3 |
RtlCopyMemory | 0x3c411d5d |
RtlCopyMemoryNonTemporal | 0xd11dc5d4 |
RtlCopyMemoryStreamTo | 0x2b9f9ee1 |
RtlCopyOutOfProcessMemoryStreamTo | 0x4fd76b84 |
RtlCopySecurityDescriptor | 0xbb3a8a58 |
RtlCopySid | 0xa54890f5 |
RtlCopySidAndAttributesArray | 0x8421e0c6 |
RtlCopyString | 0x493384cb |
RtlCopyUnicodeString | 0x53f21983 |
RtlCrc32 | 0xdc6a953f |
RtlCrc64 | 0xdc6a95a1 |
RtlCreateAcl | 0x34515776 |
RtlCreateActivationContext | 0x4bcf165c |
RtlCreateAndSetSD | 0xa1ccfd55 |
RtlCreateAtomTable | 0x2c866c4c |
RtlCreateBootStatusDataFile | 0x2b7bae6e |
RtlCreateBoundaryDescriptor | 0x809edcf4 |
RtlCreateEnvironment | 0xb68105cd |
RtlCreateEnvironmentEx | 0x4173ff2 |
RtlCreateHashTable | 0x228672b5 |
RtlCreateHashTableEx | 0x19cadda2 |
RtlCreateHeap | 0x8a2e75d6 |
RtlCreateMemoryBlockLookaside | 0x8cbe1975 |
RtlCreateMemoryZone | 0x4e4b07fb |
RtlCreateProcessParameters | 0xc0475e75 |
RtlCreateProcessParametersEx | 0x1d79e019 |
RtlCreateProcessParametersWithTemplate | 0xaa6ef386 |
RtlCreateProcessReflection | 0x7027b1b3 |
RtlCreateQueryDebugBuffer | 0x11c4de3a |
RtlCreateRegistryKey | 0xf96db3 |
RtlCreateSecurityDescriptor | 0x3b44ed1 |
RtlCreateServiceSid | 0xfaf0d783 |
RtlCreateSystemVolumeInformationFolder | 0x65ec020b |
RtlCreateTagHeap | 0x3338e5aa |
RtlCreateTimer | 0x4690e9e3 |
RtlCreateTimerQueue | 0xcbd944d8 |
RtlCreateUmsCompletionList | 0x61bfcb69 |
RtlCreateUmsThreadContext | 0x8393f925 |
RtlCreateUnicodeString | 0x90d455a7 |
RtlCreateUnicodeStringFromAsciiz | 0x200aaa7f |
RtlCreateUserFiberShadowStack | 0x6c1fca47 |
RtlCreateUserProcess | 0x3ccc95ac |
RtlCreateUserProcessEx | 0x3256ba0b |
RtlCreateUserSecurityObject | 0xf504e461 |
RtlCreateUserStack | 0xb67ffb27 |
RtlCreateUserThread | 0xd147ec1a |
RtlCreateVirtualAccountSid | 0x47beefb5 |
RtlCultureNameToLCID | 0x577bfe00 |
RtlCustomCPToUnicodeN | 0x40cc9f3 |
RtlCutoverTimeToSystemTime | 0x6948fb5f |
RtlDeCommitDebugInfo | 0x56904640 |
RtlDeNormalizeProcessParams | 0x4fdca699 |
RtlDeactivateActivationContext | 0x993ebc7e |
RtlDeactivateActivationContextUnsafeFast | 0x47a0980 |
RtlDebugPrintTimes | 0xd4542847 |
RtlDecodePointer | 0x58e5d22b |
RtlDecodeRemotePointer | 0x56127195 |
RtlDecodeSystemPointer | 0x702b02d5 |
RtlDecompressBuffer | 0xcac187d5 |
RtlDecompressBufferEx | 0x61f6043 |
RtlDecompressFragment | 0x3c33317e |
RtlDefaultNpAcl | 0xd0ba4afe |
RtlDelete | 0x8e87f8a0 |
RtlDeleteAce | 0xfc515808 |
RtlDeleteAtomFromAtomTable | 0x4e92883f |
RtlDeleteBarrier | 0xbd9a7627 |
RtlDeleteBoundaryDescriptor | 0x80a3ab34 |
RtlDeleteCriticalSection | 0x9be18ce2 |
RtlDeleteElementGenericTable | 0xd9c0bd04 |
RtlDeleteElementGenericTableAvl | 0x5e83800c |
RtlDeleteElementGenericTableAvlEx | 0xe003a92 |
RtlDeleteFunctionTable | 0x5ac6de8f |
RtlDeleteGrowableFunctionTable | 0x18ec5ee0 |
RtlDeleteHashTable | 0x948672db |
RtlDeleteNoSplay | 0xd7a981b1 |
RtlDeleteRegistryValue | 0xe8cbc708 |
RtlDeleteResource | 0xb524f7fd |
RtlDeleteSecurityObject | 0x9b77663 |
RtlDeleteTimer | 0x46935103 |
RtlDeleteTimerQueue | 0xbd949a7 |
RtlDeleteTimerQueueEx | 0x6526a547 |
RtlDeleteUmsCompletionList | 0x61bff1db |
RtlDeleteUmsThreadContext | 0x1393fa59 |
RtlDequeueUmsCompletionListItems | 0x7404b2aa |
RtlDeregisterSecureMemoryCacheCallback | 0xc66ec77e |
RtlDeregisterWait | 0x5c4419d8 |
RtlDeregisterWaitEx | 0x10676a89 |
RtlDeriveCapabilitySidsFromName | 0x730eb26e |
RtlDestroyAtomTable | 0x712bb4d0 |
RtlDestroyEnvironment | 0x4ba316e0 |
RtlDestroyHandleTable | 0xb6076267 |
RtlDestroyHeap | 0xdcd2b7f8 |
RtlDestroyMemoryBlockLookaside | 0xcee06c19 |
RtlDestroyMemoryZone | 0xe2f41883 |
RtlDestroyProcessParameters | 0x658fe2ba |
RtlDestroyQueryDebugBuffer | 0x36ef225c |
RtlDetectHeapLeaks | 0xa3c64ee5 |
RtlDetermineDosPathNameType_U | 0x691ae0dc |
RtlDisableThreadProfiling | 0x4d435276 |
RtlDllShutdownInProgress | 0x4f65d5b7 |
RtlDnsHostNameToComputerName | 0x644a9c3 |
RtlDoesFileExists_U | 0x850bfc0e |
RtlDoesNameContainWildCards | 0xbed836a9 |
RtlDosApplyFileIsolationRedirection_Ustr | 0x8432682f |
RtlDosLongPathNameToNtPathName_U_WithStatus | 0xf07c82c0 |
RtlDosLongPathNameToRelativeNtPathName_U_WithStatus | 0x729de037 |
RtlDosPathNameToNtPathName_U | 0x2cdc9808 |
RtlDosPathNameToNtPathName_U_WithStatus | 0xb3101a19 |
RtlDosPathNameToRelativeNtPathName_U | 0x771a58ae |
RtlDosPathNameToRelativeNtPathName_U_WithStatus | 0x63538fa |
RtlDosSearchPath_U | 0xc23b34d |
RtlDosSearchPath_Ustr | 0xd9a86103 |
RtlDowncaseUnicodeChar | 0x10b08dc7 |
RtlDowncaseUnicodeString | 0xe2ff8669 |
RtlDrainNonVolatileFlush | 0xfc12e347 |
RtlDumpResource | 0x110e7cde |
RtlDuplicateUnicodeString | 0x896d39ba |
RtlEmptyAtomTable | 0xa9a73632 |
RtlEnableEarlyCriticalSectionEventCreation | 0xdcd3fdbe |
RtlEnableThreadProfiling | 0x7a35a033 |
RtlEnclaveCallDispatch | 0xc26b6fac |
RtlEnclaveCallDispatchReturn | 0xdb26be99 |
RtlEncodePointer | 0x6d65d22b |
RtlEncodeRemotePointer | 0x5b327195 |
RtlEncodeSystemPointer | 0x754b02d5 |
RtlEndEnumerationHashTable | 0xa3e88c3 |
RtlEndStrongEnumerationHashTable | 0xd8559185 |
RtlEndWeakEnumerationHashTable | 0x7a49e64a |
RtlEnterCriticalSection | 0xa31a8752 |
RtlEnterUmsSchedulingMode | 0x808d57e8 |
RtlEnumProcessHeaps | 0xfb789d2a |
RtlEnumerateEntryHashTable | 0x8b605e6e |
RtlEnumerateGenericTable | 0x654ac447 |
RtlEnumerateGenericTableAvl | 0x6224c5d1 |
RtlEnumerateGenericTableLikeADirectory | 0x6a394496 |
RtlEnumerateGenericTableWithoutSplaying | 0xaa3b9a9f |
RtlEnumerateGenericTableWithoutSplayingAvl | 0xcd50e849 |
RtlEqualComputerName | 0x925b4bfe |
RtlEqualDomainName | 0xa5f8f6af |
RtlEqualLuid | 0x33c5aa2a |
RtlEqualPrefixSid | 0x5f34e8bf |
RtlEqualSid | 0x319e47c9 |
RtlEqualString | 0x249d4af6 |
RtlEqualUnicodeString | 0x2f404ada |
RtlEqualWnfChangeStamps | 0xc3b8b94b |
RtlEraseUnicodeString | 0x2f40af4c |
RtlEthernetAddressToStringA | 0xb70cf65f |
RtlEthernetAddressToStringW | 0xb70cf675 |
RtlEthernetStringToAddressA | 0x4b57d98f |
RtlEthernetStringToAddressW | 0x4b57d9a5 |
RtlExecuteUmsThread | 0x3205dfdb |
RtlExitUserProcess | 0xc13d5dae |
RtlExitUserThread | 0xe56b725a |
RtlExpandEnvironmentStrings | 0x5f7009d3 |
RtlExpandEnvironmentStrings_U | 0xc02759b2 |
RtlExpandHashTable | 0xd26e5341 |
RtlExtendCorrelationVector | 0xb64f17cf |
RtlExtendMemoryBlockLookaside | 0xd3370d65 |
RtlExtendMemoryZone | 0x8b471999 |
RtlExtractBitMap | 0x18ac92a2 |
RtlFillMemory | 0xfc417739 |
RtlFillMemoryNonTemporal | 0xbf7dc601 |
RtlFillNonVolatileMemory | 0x489aa7fc |
RtlFinalReleaseOutOfProcessMemoryStream | 0x401ab8da |
RtlFindAceByType | 0x62036473 |
RtlFindActivationContextSectionGuid | 0x591ddde3 |
RtlFindActivationContextSectionString | 0x8f6c2f8b |
RtlFindCharInUnicodeString | 0x470280a0 |
RtlFindClearBits | 0x9f8a2749 |
RtlFindClearBitsAndSet | 0xf0f5e2e6 |
RtlFindClearRuns | 0x9f925689 |
RtlFindClosestEncodableLength | 0xcd4acb36 |
RtlFindExportedRoutineByName | 0xbcd5b007 |
RtlFindLastBackwardRunClear | 0x8e9b940b |
RtlFindLeastSignificantBit | 0x42d7adc0 |
RtlFindLongestRunClear | 0x5b1c569c |
RtlFindMessage | 0x8890a324 |
RtlFindMostSignificantBit | 0x3e2ee76b |
RtlFindNextForwardRunClear | 0x7a0852c3 |
RtlFindSetBits | 0x88844d4 |
RtlFindSetBitsAndClear | 0xd4ac76be |
RtlFindUnicodeSubstring | 0x88d3dc25 |
RtlFirstEntrySList | 0xdd6836ea |
RtlFirstFreeAce | 0x4f365ce6 |
RtlFlsAlloc | 0xeb9eac8e |
RtlFlsFree | 0x5f5f8c77 |
RtlFlsGetValue | 0xa4b83502 |
RtlFlsSetValue | 0xa4b83562 |
RtlFlushHeaps | 0xf06d423d |
RtlFlushNonVolatileMemory | 0xb7285e62 |
RtlFlushNonVolatileMemoryRanges | 0x5812c0ac |
RtlFlushSecureMemoryCache | 0x7934fea8 |
RtlFormatCurrentUserKeyPath | 0xf441b535 |
RtlFormatMessage | 0xaac3c3d5 |
RtlFormatMessageEx | 0xf0f5fc3 |
RtlFreeActivationContextStack | 0xd921a75b |
RtlFreeAnsiString | 0x41ecff6d |
RtlFreeHandle | 0x3201d32c |
RtlFreeHeap | 0x51cc8edd |
RtlFreeMemoryBlockLookaside | 0xa5c4e113 |
RtlFreeNonVolatileToken | 0x3dd2cbf8 |
RtlFreeOemString | 0x881e5247 |
RtlFreeSid | 0x6a8e90f6 |
RtlFreeThreadActivationContextStack | 0x994dde3f |
RtlFreeUnicodeString | 0x53f52e9b |
RtlFreeUserFiberShadowStack | 0x852691e5 |
RtlFreeUserStack | 0xc40f3759 |
RtlGUIDFromString | 0x6369a34e |
RtlGenerate8dot3Name | 0xdb7fb1bd |
RtlGetAce | 0x948b6680 |
RtlGetActiveActivationContext | 0xe513d4fe |
RtlGetActiveConsoleId | 0x9cd53a81 |
RtlGetAppContainerNamedObjectPath | 0x7175ab75 |
RtlGetAppContainerParent | 0x9d1da1c2 |
RtlGetAppContainerSidType | 0x72cbe439 |
RtlGetCallersAddress | 0x3401fe33 |
RtlGetCompressionWorkSpaceSize | 0x6f876743 |
RtlGetConsoleSessionForegroundProcessId | 0xab2d4f7e |
RtlGetControlSecurityDescriptor | 0x8d8251aa |
RtlGetCriticalSectionRecursionCount | 0x7d178bc8 |
RtlGetCurrentDirectory_U | 0x25cf0f6c |
RtlGetCurrentPeb | 0xf576d38b |
RtlGetCurrentProcessorNumber | 0xe60258fa |
RtlGetCurrentProcessorNumberEx | 0x963f4b0 |
RtlGetCurrentServiceSessionId | 0x2dcff709 |
RtlGetCurrentTransaction | 0xff50e0d0 |
RtlGetCurrentUmsThread | 0xec185aab |
RtlGetDaclSecurityDescriptor | 0x7bc4b64f |
RtlGetDeviceFamilyInfoEnum | 0xf5e505b1 |
RtlGetElementGenericTable | 0xe838553e |
RtlGetElementGenericTableAvl | 0x2aa08748 |
RtlGetEnabledExtendedFeatures | 0x97d72047 |
RtlGetExePath | 0x9232db9f |
RtlGetExtendedContextLength | 0xd332fbb6 |
RtlGetExtendedContextLength2 | 0x665f770c |
RtlGetExtendedFeaturesMask | 0xdc53c5cf |
RtlGetFileMUIPath | 0x7a34ddb8 |
RtlGetFrame | 0x2df18057 |
RtlGetFullPathName_U | 0x7cccaae |
RtlGetFullPathName_UEx | 0x332ac137 |
RtlGetFullPathName_UstrEx | 0x637b6aad |
RtlGetFunctionTableListHead | 0xd2a51a93 |
RtlGetGroupSecurityDescriptor | 0xa370414 |
RtlGetIntegerAtom | 0x1cca5124 |
RtlGetInterruptTimePrecise | 0x243c01e4 |
RtlGetLastNtStatus | 0x1fbca832 |
RtlGetLastWin32Error | 0x51b06898 |
RtlGetLengthWithoutLastFullDosOrNtPathElement | 0x6a22cc24 |
RtlGetLengthWithoutTrailingPathSeperators | 0x50a0630 |
RtlGetLocaleFileMappingAddress | 0xc9cb16d |
RtlGetLongestNtPathLength | 0x9b6ff65b |
RtlGetMultiTimePrecise | 0x8977f498 |
RtlGetNativeSystemInformation | 0x95ae66c1 |
RtlGetNextEntryHashTable | 0xe203b40 |
RtlGetNextUmsListItem | 0xa2112c35 |
RtlGetNonVolatileToken | 0x91cd088a |
RtlGetNtGlobalFlags | 0x8eafd5aa |
RtlGetNtProductType | 0x7fa8f6d1 |
RtlGetNtSystemRoot | 0x448d199b |
RtlGetNtVersionNumbers | 0x24f36e61 |
RtlGetOwnerSecurityDescriptor | 0x12390dfc |
RtlGetParentLocaleName | 0xd069c8d7 |
RtlGetPersistedStateLocation | 0x9bbb2540 |
RtlGetProcessHeaps | 0x1f41cb4a |
RtlGetProcessPreferredUILanguages | 0x1baf96a0 |
RtlGetProductInfo | 0x990ab301 |
RtlGetSaclSecurityDescriptor | 0x7bc4d44f |
RtlGetSearchPath | 0xf10708e9 |
RtlGetSecurityDescriptorRMControl | 0x4056854b |
RtlGetSessionProperties | 0xbd89db39 |
RtlGetSetBootStatusData | 0x3d9a1e77 |
RtlGetSuiteMask | 0x139afefd |
RtlGetSystemBootStatus | 0x4ac6744d |
RtlGetSystemBootStatusEx | 0x19d13e43 |
RtlGetSystemPreferredUILanguages | 0x387b52f9 |
RtlGetSystemTimePrecise | 0x954d1795 |
RtlGetThreadErrorMode | 0x72a1ccc5 |
RtlGetThreadLangIdByIndex | 0x1c3e9ee2 |
RtlGetThreadPreferredUILanguages | 0x476f8a69 |
RtlGetThreadWorkOnBehalfTicket | 0x641daa9e |
RtlGetTokenNamedObjectPath | 0x92beee11 |
RtlGetUILanguageInfo | 0xa9d2b5c9 |
RtlGetUmsCompletionListEvent | 0x876d2953 |
RtlGetUnloadEventTrace | 0xb8ab19df |
RtlGetUnloadEventTraceEx | 0xac6787fa |
RtlGetUserInfoHeap | 0xca262785 |
RtlGetUserPreferredUILanguages | 0xc559e614 |
RtlGetVersion | 0xad147b09 |
RtlGrowFunctionTable | 0x1b819a27 |
RtlGuardCheckLongJumpTarget | 0xdeae9fa1 |
RtlHashUnicodeString | 0x53f6aa21 |
RtlHeapTrkInitialize | 0x30c8865b |
RtlIdentifierAuthoritySid | 0x3888a89f |
RtlIdnToAscii | 0x3e04a114 |
RtlIdnToNameprepUnicode | 0x453eecaa |
RtlIdnToUnicode | 0x8e175e2 |
RtlImageDirectoryEntryToData | 0xcbdf3fc6 |
RtlImageNtHeader | 0x5e96127c |
RtlImageNtHeaderEx | 0x5849fa92 |
RtlImageRvaToSection | 0xe91cab1a |
RtlImageRvaToVa | 0x587c66cd |
RtlImpersonateSelf | 0x6d896790 |
RtlImpersonateSelfEx | 0x259e4ace |
RtlIncrementCorrelationVector | 0x92178d0e |
RtlInitAnsiString | 0x428ff73 |
RtlInitAnsiStringEx | 0xa3fdd528 |
RtlInitBarrier | 0xc08cde6e |
RtlInitCodePageTable | 0xd65b945e |
RtlInitEnumerationHashTable | 0x4130c10f |
RtlInitMemoryStream | 0xac8b1796 |
RtlInitNlsTables | 0x36f83c6d |
RtlInitOutOfProcessMemoryStream | 0x4053f8d3 |
RtlInitString | 0x9344392 |
RtlInitStringEx | 0xd10e513c |
RtlInitStrongEnumerationHashTable | 0xe6121f98 |
RtlInitUnicodeString | 0x53f80fb9 |
RtlInitUnicodeStringEx | 0xe03eee67 |
RtlInitWeakEnumerationHashTable | 0xff0d556d |
RtlInitializeAtomPackage | 0x51940464 |
RtlInitializeBitMap | 0x97cb91d4 |
RtlInitializeBitMapEx | 0x2e475b77 |
RtlInitializeConditionVariable | 0x98c17b25 |
RtlInitializeContext | 0x4525cc07 |
RtlInitializeCorrelationVector | 0x5c636079 |
RtlInitializeCriticalSection | 0x66450a0e |
RtlInitializeCriticalSectionAndSpinCount | 0x29128970 |
RtlInitializeCriticalSectionEx | 0x142842b1 |
RtlInitializeExtendedContext | 0x23891f7d |
RtlInitializeExtendedContext2 | 0x7123efd6 |
RtlInitializeGenericTable | 0x33d452e1 |
RtlInitializeGenericTableAvl | 0x2971ad16 |
RtlInitializeHandleTable | 0x58b8a7c3 |
RtlInitializeNtUserPfn | 0x552ca564 |
RtlInitializeRXact | 0x25b5935e |
RtlInitializeResource | 0x2e7167a3 |
RtlInitializeSListHead | 0x5607fc7f |
RtlInitializeSRWLock | 0x9a1f162 |
RtlInitializeSid | 0xa2897384 |
RtlInitializeSidEx | 0x25ce1ba2 |
RtlInsertElementGenericTable | 0x5f0a7cec |
RtlInsertElementGenericTableAvl | 0x3e7742b1 |
RtlInsertElementGenericTableFull | 0xceead293 |
RtlInsertElementGenericTableFullAvl | 0x694afaa1 |
RtlInsertEntryHashTable | 0xf8279d81 |
RtlInstallFunctionTableCallback | 0xc2729f80 |
RtlInt64ToUnicodeString | 0xbcf8a92a |
RtlIntegerToChar | 0xf7f2e4b3 |
RtlIntegerToUnicodeString | 0x6d2fc360 |
RtlInterlockedClearBitRun | 0x865069eb |
RtlInterlockedFlushSList | 0x59343bef |
RtlInterlockedPopEntrySList | 0x5d4ba680 |
RtlInterlockedPushEntrySList | 0x97dd026e |
RtlInterlockedPushListSList | 0x965be428 |
RtlInterlockedPushListSListEx | 0x6f90ab71 |
RtlInterlockedSetBitRun | 0x38ea481e |
RtlIoDecodeMemIoResource | 0xd11e5506 |
RtlIoEncodeMemIoResource | 0xd63e5506 |
RtlIpv4AddressToStringA | 0x52bc8d64 |
RtlIpv4AddressToStringExA | 0xf235b08b |
RtlIpv4AddressToStringExW | 0xf235b0a1 |
RtlIpv4AddressToStringW | 0x52bc8d7a |
RtlIpv4StringToAddressA | 0xe7077093 |
RtlIpv4StringToAddressExA | 0x1dc26edd |
RtlIpv4StringToAddressExW | 0x1dc26ef3 |
RtlIpv4StringToAddressW | 0xe70770a9 |
RtlIpv6AddressToStringA | 0x52be8d64 |
RtlIpv6AddressToStringExA | 0xfa35b08b |
RtlIpv6AddressToStringExW | 0xfa35b0a1 |
RtlIpv6AddressToStringW | 0x52be8d7a |
RtlIpv6StringToAddressA | 0xe7097093 |
RtlIpv6StringToAddressExA | 0x25c26edd |
RtlIpv6StringToAddressExW | 0x25c26ef3 |
RtlIpv6StringToAddressW | 0xe70970a9 |
RtlIsActivationContextActive | 0x22f338f7 |
RtlIsCapabilitySid | 0x4681d212 |
RtlIsCloudFilesPlaceholder | 0x246ef6d5 |
RtlIsCriticalSectionLocked | 0xed9d812a |
RtlIsCriticalSectionLockedByThread | 0x8c3bcda0 |
RtlIsCurrentProcess | 0xcce699d6 |
RtlIsCurrentThread | 0x25c8bc3c |
RtlIsCurrentThreadAttachExempt | 0x766fb26a |
RtlIsDosDeviceName_U | 0x13b7f677 |
RtlIsElevatedRid | 0xf927ec29 |
RtlIsGenericTableEmpty | 0x574a22ed |
RtlIsGenericTableEmptyAvl | 0x1177bed1 |
RtlIsMultiSessionSku | 0x72a3cee6 |
RtlIsMultiUsersInSessionSku | 0xbb493794 |
RtlIsNameInExpression | 0x8141dc67 |
RtlIsNameInUnUpcasedExpression | 0xc96c6d6f |
RtlIsNameLegalDOS8Dot3 | 0x907e286d |
RtlIsNonEmptyDirectoryReparsePointAllowed | 0x3454d8f6 |
RtlIsNormalizedString | 0x694de16f |
RtlIsPackageSid | 0x6efa5326 |
RtlIsParentOfChildAppContainer | 0xcd6baf12 |
RtlIsPartialPlaceholder | 0xb4ef9e02 |
RtlIsPartialPlaceholderFileHandle | 0x4e5c9e1d |
RtlIsPartialPlaceholderFileInfo | 0xe144a2f |
RtlIsProcessorFeaturePresent | 0x5c6de284 |
RtlIsStateSeparationEnabled | 0xbffc0318 |
RtlIsTextUnicode | 0xeda31277 |
RtlIsThreadWithinLoaderCallout | 0xa3a8d64c |
RtlIsUntrustedObject | 0xfd062663 |
RtlIsValidHandle | 0x612fdb23 |
RtlIsValidIndexHandle | 0x131093a6 |
RtlIsValidLocaleName | 0xf25f32a9 |
RtlIsValidProcessTrustLabelSid | 0x157fc545 |
RtlKnownExceptionFilter | 0xbd86bac3 |
RtlLCIDToCultureName | 0x80e1ccbb |
RtlLargeIntegerToChar | 0xb1d4e6c1 |
RtlLcidToLocaleName | 0xe12cfdcf |
RtlLeaveCriticalSection | 0xfccb1f55 |
RtlLengthRequiredSid | 0x7da7b2c7 |
RtlLengthSecurityDescriptor | 0xff92131 |
RtlLengthSid | 0x805328c8 |
RtlLengthSidAsUnicodeString | 0xf71d98f |
RtlLoadString | 0x934a44e |
RtlLocalTimeToSystemTime | 0x67ff26d4 |
RtlLocaleNameToLcid | 0x8da43a93 |
RtlLocateExtendedFeature | 0xdfd5e207 |
RtlLocateExtendedFeature2 | 0xfabc412d |
RtlLocateLegacyContext | 0xd78afb93 |
RtlLockBootStatusData | 0xd4a0a2ad |
RtlLockCurrentThread | 0xf8e0dad6 |
RtlLockHeap | 0x8e2c8f0c |
RtlLockMemoryBlockLookaside | 0xa5f41d73 |
RtlLockMemoryStreamRegion | 0x31a7fe41 |
RtlLockMemoryZone | 0xcf4a8e48 |
RtlLockModuleSection | 0x775a5351 |
RtlLogStackBackTrace | 0xeb63c87e |
RtlLookupAtomInAtomTable | 0x13aa88ca |
RtlLookupElementGenericTable | 0x6211891a |
RtlLookupElementGenericTableAvl | 0xc48e4434 |
RtlLookupElementGenericTableFull | 0x91cb0304 |
RtlLookupElementGenericTableFullAvl | 0x81835c11 |
RtlLookupEntryHashTable | 0x7badb483 |
RtlLookupFirstMatchingElementGenericTableAvl | 0x4aec5d2e |
RtlLookupFunctionEntry | 0x7b20d7b9 |
RtlLookupFunctionTable | 0x7c0a0ee5 |
RtlMakeSelfRelativeSD | 0x7073be65 |
RtlMapGenericMask | 0xa1d6dfb0 |
RtlMapSecurityErrorToNtStatus | 0x60f816f2 |
RtlMoveMemory | 0x3c425d88 |
RtlMultiAppendUnicodeStringBuffer | 0x494ddf71 |
RtlMultiByteToUnicodeN | 0x671874f5 |
RtlMultiByteToUnicodeSize | 0x3a7ee731 |
RtlMultipleAllocateHeap | 0x2c06688 |
RtlMultipleFreeHeap | 0x1db20dfe |
RtlNewInstanceSecurityObject | 0x95910378 |
RtlNewSecurityGrantedAccess | 0x3c94f4c6 |
RtlNewSecurityObject | 0x458a942a |
RtlNewSecurityObjectEx | 0x2a50b22e |
RtlNewSecurityObjectWithMultipleInheritance | 0x319cf0fb |
RtlNormalizeProcessParams | 0xb75e6542 |
RtlNormalizeString | 0x50441376 |
RtlNtPathNameToDosPathName | 0xbc0c78ea |
RtlNtStatusToDosError | 0xe11882b3 |
RtlNtStatusToDosErrorNoTeb | 0x6cdb0e07 |
RtlNtdllName | 0x9c663bf |
RtlNumberGenericTableElements | 0x9dc98641 |
RtlNumberGenericTableElementsAvl | 0xc321e210 |
RtlNumberOfClearBits | 0x715d7da2 |
RtlNumberOfClearBitsInRange | 0xac3e326b |
RtlNumberOfSetBits | 0x9ebcb9a9 |
RtlNumberOfSetBitsInRange | 0x173812a5 |
RtlNumberOfSetBitsUlongPtr | 0xa1ce7b54 |
RtlOemStringToUnicodeSize | 0x380e68b5 |
RtlOemStringToUnicodeString | 0x3a4ef307 |
RtlOemToUnicodeN | 0x7caabc8f |
RtlOpenCurrentUser | 0xb63ee362 |
RtlOsDeploymentState | 0x8309cd25 |
RtlOwnerAcesPresent | 0xcb8a8184 |
RtlPcToFileHeader | 0x329d0532 |
RtlPinAtomInAtomTable | 0x8190a12c |
RtlPopFrame | 0xa5f180a1 |
RtlPrefixString | 0x974fd0fc |
RtlPrefixUnicodeString | 0xc4d47b0d |
RtlPrepareForProcessCloning | 0x3bc8b081 |
RtlProcessFlsData | 0xb8c26532 |
RtlProtectHeap | 0x84b453f5 |
RtlPublishWnfStateData | 0x2abed03e |
RtlPushFrame | 0xbf7865ca |
RtlQueryActivationContextApplicationSettings | 0x7fe89bbc |
RtlQueryAtomInAtomTable | 0x284f62bb |
RtlQueryCriticalSectionOwner | 0xb6a7d490 |
RtlQueryDepthSList | 0x6afc10a2 |
RtlQueryDynamicTimeZoneInformation | 0xc347d1af |
RtlQueryElevationFlags | 0xe80582ff |
RtlQueryEnvironmentVariable | 0xd3c3c4c7 |
RtlQueryEnvironmentVariable_U | 0xf132b84 |
RtlQueryHeapInformation | 0xaa9259e |
RtlQueryImageMitigationPolicy | 0x95ccf31e |
RtlQueryInformationAcl | 0x40fc1b42 |
RtlQueryInformationActivationContext | 0x7680095f |
RtlQueryInformationActiveActivationContext | 0xac1f20a9 |
RtlQueryInterfaceMemoryStream | 0xdafccecb |
RtlQueryModuleInformation | 0x12a1759 |
RtlQueryPackageClaims | 0xb9a44137 |
RtlQueryPackageIdentity | 0x9958460d |
RtlQueryPackageIdentityEx | 0x61183f7d |
RtlQueryPerformanceCounter | 0xa378de46 |
RtlQueryPerformanceFrequency | 0xe9891a7a |
RtlQueryProcessBackTraceInformation | 0xad107b3b |
RtlQueryProcessDebugInformation | 0x331eeb73 |
RtlQueryProcessHeapInformation | 0xcbeee55f |
RtlQueryProcessLockInformation | 0xe96ee673 |
RtlQueryProcessPlaceholderCompatibilityMode | 0xe914858e |
RtlQueryProtectedPolicy | 0x33f3d3f0 |
RtlQueryRegistryValueWithFallback | 0xa48abd1d |
RtlQueryRegistryValues | 0xca841323 |
RtlQueryRegistryValuesEx | 0x104c9842 |
RtlQueryResourcePolicy | 0xc57c206c |
RtlQuerySecurityObject | 0xbac2a7f6 |
RtlQueryTagHeap | 0xb2f6cbdc |
RtlQueryThreadPlaceholderCompatibilityMode | 0x7ed07e97 |
RtlQueryThreadProfiling | 0x4803d295 |
RtlQueryTimeZoneInformation | 0x40342dfd |
RtlQueryTokenHostIdAsUlong64 | 0x28e44121 |
RtlQueryUmsThreadInformation | 0xbaf78fcd |
RtlQueryUnbiasedInterruptTime | 0x1e184d03 |
RtlQueryValidationRunlevel | 0x1540615e |
RtlQueryWnfMetaNotification | 0x1de5337c |
RtlQueryWnfStateData | 0xc98d6bf0 |
RtlQueryWnfStateDataWithExplicitScope | 0x39a4ce1a |
RtlQueueApcWow64Thread | 0x34ae6682 |
RtlQueueWorkItem | 0xf6fc12be |
RtlRaiseCustomSystemEventTrigger | 0x931a7047 |
RtlRaiseException | 0xd7ea56d1 |
RtlRaiseStatus | 0x64c6ec70 |
RtlRandom | 0xaa48f408 |
RtlRandomEx | 0x23d02bc1 |
RtlRbInsertNodeEx | 0xe9c0216f |
RtlRbRemoveNode | 0x9d0b86d8 |
RtlReAllocateHeap | 0xa1094e6b |
RtlReadMemoryStream | 0xac8b5d45 |
RtlReadOutOfProcessMemoryStream | 0x3053fd2e |
RtlReadThreadProfilingData | 0x724750b7 |
RtlRealPredecessor | 0x5e9177dc |
RtlRealSuccessor | 0xe09fdef0 |
RtlRegisterForWnfMetaNotification | 0x422eb97a |
RtlRegisterSecureMemoryCacheCallback | 0x1b22883e |
RtlRegisterThreadWithCsrss | 0x3ada27c1 |
RtlRegisterWait | 0xbbee73b8 |
RtlReleaseActivationContext | 0x7f078ba8 |
RtlReleaseMemoryStream | 0xbaac9fdf |
RtlReleasePath | 0xa3cea2d4 |
RtlReleasePebLock | 0x583e1ab2 |
RtlReleasePrivilege | 0xc0f3f10 |
RtlReleaseRelativeName | 0x22a6364 |
RtlReleaseResource | 0x2bf691c0 |
RtlReleaseSRWLockExclusive | 0x62e1da30 |
RtlReleaseSRWLockShared | 0x6915dbb1 |
RtlRemoteCall | 0xa2dba76 |
RtlRemoveEntryHashTable | 0x5371b9c6 |
RtlRemovePrivileges | 0xdc81489b |
RtlRemoveVectoredContinueHandler | 0xb689cba2 |
RtlRemoveVectoredExceptionHandler | 0x8b6c2c7b |
RtlReplaceSidInSd | 0x227884ac |
RtlReplaceSystemDirectoryInPath | 0xc9d7981 |
RtlReportException | 0xd549f078 |
RtlReportExceptionEx | 0x27c1ec6d |
RtlReportSilentProcessExit | 0x56eed4db |
RtlReportSqmEscalation | 0xdd9d0963 |
RtlResetMemoryBlockLookaside | 0x8cbd4b8a |
RtlResetMemoryZone | 0x1ad047fb |
RtlResetNtUserPfn | 0xb802da8e |
RtlResetRtlTranslations | 0x58290040 |
RtlRestoreBootStatusDefaults | 0xf6a3c3e2 |
RtlRestoreContext | 0x30cfb458 |
RtlRestoreLastWin32Error | 0xd186aa01 |
RtlRestoreSystemBootStatusDefaults | 0xde668dd0 |
RtlRetrieveNtUserPfn | 0xcec484f9 |
RtlRevertMemoryStream | 0x104582c3 |
RtlRunDecodeUnicodeString | 0xe8edc1b8 |
RtlRunEncodeUnicodeString | 0xee0dc1b8 |
RtlRunOnceBeginInitialize | 0x1e6b29e4 |
RtlRunOnceComplete | 0xb533df8a |
RtlRunOnceExecuteOnce | 0x4cd536f9 |
RtlRunOnceInitialize | 0xc93b095a |
RtlSecondsSince1970ToTime | 0x621966e6 |
RtlSecondsSince1980ToTime | 0x621966ee |
RtlSeekMemoryStream | 0x1c8b654e |
RtlSelfRelativeToAbsoluteSD | 0xabe6ff6c |
RtlSelfRelativeToAbsoluteSD2 | 0x7cdfedc7 |
RtlSendMsgToSm | 0xa3f4d8ac |
RtlSetAllBits | 0x7a9d7ba9 |
RtlSetAttributesSecurityDescriptor | 0x3871dbb9 |
RtlSetBit | 0xac8b6b4f |
RtlSetBits | 0x916d6a68 |
RtlSetControlSecurityDescriptor | 0x8d8257aa |
RtlSetCriticalSectionSpinCount | 0xc622fbab |
RtlSetCurrentDirectory_U | 0x25cf102c |
RtlSetCurrentEnvironment | 0xdbc0e64e |
RtlSetCurrentTransaction | 0xff50e190 |
RtlSetDaclSecurityDescriptor | 0x87c4b64f |
RtlSetDynamicTimeZoneInformation | 0xfbf4a066 |
RtlSetEnvironmentStrings | 0x33d6ff98 |
RtlSetEnvironmentVar | 0xba45cda |
RtlSetEnvironmentVariable | 0xbad95e9e |
RtlSetExtendedFeaturesMask | 0xdc56c5cf |
RtlSetGroupSecurityDescriptor | 0x8a370415 |
RtlSetHeapInformation | 0x6446940f |
RtlSetImageMitigationPolicy | 0xec344eba |
RtlSetInformationAcl | 0xcbc906b5 |
RtlSetIoCompletionCallback | 0xa6ecf74b |
RtlSetLastWin32Error | 0x51bc6898 |
RtlSetLastWin32ErrorAndNtStatusFromNtStatus | 0x21f384de |
RtlSetMemoryStreamSize | 0x8d0138e7 |
RtlSetOwnerSecurityDescriptor | 0x92390dfd |
RtlSetPortableOperatingSystem | 0x51c7c754 |
RtlSetProcessDebugInformation | 0xd08d5ccc |
RtlSetProcessIsCritical | 0x7b4c939 |
RtlSetProcessPlaceholderCompatibilityMode | 0x82eb6ca4 |
RtlSetProcessPreferredUILanguages | 0x1bc796a0 |
RtlSetProtectedPolicy | 0x8d914261 |
RtlSetProxiedProcessId | 0x9bc3720d |
RtlSetSaclSecurityDescriptor | 0x87c4d44f |
RtlSetSearchPathMode | 0x8ed35955 |
RtlSetSecurityDescriptorRMControl | 0x406e854b |
RtlSetSecurityObject | 0x458f936a |
RtlSetSecurityObjectEx | 0x3e4db22e |
RtlSetSystemBootStatus | 0x7ac6744d |
RtlSetSystemBootStatusEx | 0x19d13f03 |
RtlSetThreadErrorMode | 0x7421ccc5 |
RtlSetThreadIsCritical | 0x34a71423 |
RtlSetThreadPlaceholderCompatibilityMode | 0x2b9f35d0 |
RtlSetThreadPoolStartFunc | 0x17dfa675 |
RtlSetThreadPreferredUILanguages | 0x47704a69 |
RtlSetThreadSubProcessTag | 0xb0ae3fb1 |
RtlSetThreadWorkOnBehalfTicket | 0x641daace |
RtlSetTimeZoneInformation | 0x2749c7d4 |
RtlSetTimer | 0x2ecd2fc4 |
RtlSetUmsThreadInformation | 0x9daacaaa |
RtlSetUnhandledExceptionFilter | 0x2c6ec97e |
RtlSetUserFlagsHeap | 0xf766dc37 |
RtlSetUserValueHeap | 0xd286ebe2 |
RtlSidDominates | 0x4433a16 |
RtlSidDominatesForTrust | 0xecb4fb24 |
RtlSidEqualLevel | 0x831027aa |
RtlSidHashInitialize | 0x147a6cc |
RtlSidHashLookup | 0x5454da0 |
RtlSidIsHigherLevel | 0x4a90a274 |
RtlSizeHeap | 0x3bcc8f43 |
RtlSleepConditionVariableCS | 0xda9fce6c |
RtlSleepConditionVariableSRW | 0x53fa0dd2 |
RtlSplay | 0xdd69bf46 |
RtlStartRXact | 0xc90867fe |
RtlStatMemoryStream | 0xac8b6906 |
RtlStringFromGUID | 0xdffcc25e |
RtlStringFromGUIDEx | 0xf3098497 |
RtlStronglyEnumerateEntryHashTable | 0x9977c260 |
RtlSubAuthorityCountSid | 0x3c68897b |
RtlSubAuthoritySid | 0xa6983ac9 |
RtlSubscribeWnfStateChangeNotification | 0xd0498ede |
RtlSubtreePredecessor | 0x4b3235d2 |
RtlSubtreeSuccessor | 0x5e1b0720 |
RtlSwitchedVVI | 0xddeb06e |
RtlSystemTimeToLocalTime | 0xea603cdd |
RtlTestAndPublishWnfStateData | 0x13790995 |
RtlTestBit | 0xd175cd09 |
RtlTestBitEx | 0xd734305d |
RtlTestProtectedAccess | 0x111b5a77 |
RtlTimeFieldsToTime | 0x3abb7c64 |
RtlTimeToElapsedTimeFields | 0xcc7d7baa |
RtlTimeToSecondsSince1970 | 0xe9b58249 |
RtlTimeToSecondsSince1980 | 0xe9b58269 |
RtlTimeToTimeFields | 0xa579e496 |
RtlTraceDatabaseAdd | 0x3eee54f |
RtlTraceDatabaseCreate | 0x778994dc |
RtlTraceDatabaseDestroy | 0x181c1548 |
RtlTraceDatabaseEnumerate | 0xe186508d |
RtlTraceDatabaseFind | 0x7ddf3f84 |
RtlTraceDatabaseLock | 0x7de2562b |
RtlTraceDatabaseUnlock | 0x9b4d4ac2 |
RtlTraceDatabaseValidate | 0xf4cb7156 |
RtlTryAcquirePebLock | 0x18810cfb |
RtlTryAcquireSRWLockExclusive | 0xc12af238 |
RtlTryAcquireSRWLockShared | 0x99269843 |
RtlTryConvertSRWLockSharedToExclusiveOrRelease | 0x8ebbfb4 |
RtlTryEnterCriticalSection | 0x5a7b042d |
RtlUTF8ToUnicodeN | 0xbca9ca61 |
RtlUdiv128 | 0xed681ee |
RtlUmsThreadYield | 0x18f952d6 |
RtlUnhandledExceptionFilter | 0x3c3537c |
RtlUnhandledExceptionFilter2 | 0x786a6fb2 |
RtlUnicodeStringToAnsiSize | 0x35bffd82 |
RtlUnicodeStringToAnsiString | 0xa226fe |
RtlUnicodeStringToCountedOemString | 0xde571e5 |
RtlUnicodeStringToInteger | 0xe9bc4f62 |
RtlUnicodeStringToOemSize | 0x574359f7 |
RtlUnicodeStringToOemString | 0xe13fb84 |
RtlUnicodeToCustomCPN | 0xde172413 |
RtlUnicodeToMultiByteN | 0xb4515571 |
RtlUnicodeToMultiByteSize | 0xaabd0dcd |
RtlUnicodeToOemN | 0x77cca205 |
RtlUnicodeToUTF8N | 0xf9eb223c |
RtlUniform | 0x22cf8223 |
RtlUnlockBootStatusData | 0x60b60c3e |
RtlUnlockCurrentThread | 0x7d418623 |
RtlUnlockHeap | 0xe890b211 |
RtlUnlockMemoryBlockLookaside | 0xc8f977d7 |
RtlUnlockMemoryStreamRegion | 0xcab0bf97 |
RtlUnlockMemoryZone | 0x25e3970a |
RtlUnlockModuleSection | 0xfbbafe9d |
RtlUnsubscribeWnfNotificationWaitForCompletion | 0x37632e8 |
RtlUnsubscribeWnfNotificationWithCompletionCallback | 0x248e99bc |
RtlUnsubscribeWnfStateChangeNotification | 0x25b118c |
RtlUnwind | 0xb11d87df |
RtlUnwindEx | 0x761f87dc |
RtlUpcaseUnicodeChar | 0xd02df27a |
RtlUpcaseUnicodeString | 0xd8925567 |
RtlUpcaseUnicodeStringToAnsiString | 0x96c86930 |
RtlUpcaseUnicodeStringToCountedOemString | 0xb36f0271 |
RtlUpcaseUnicodeStringToOemString | 0xa2c52d95 |
RtlUpcaseUnicodeToCustomCPN | 0x30dbec5a |
RtlUpcaseUnicodeToMultiByteN | 0xcea5e3c |
RtlUpcaseUnicodeToOemN | 0xda30c52e |
RtlUpdateClonedCriticalSection | 0x8e15ee38 |
RtlUpdateClonedSRWLock | 0x33c9c246 |
RtlUpdateTimer | 0x46d8a8e3 |
RtlUpperChar | 0xfc21052e |
RtlUpperString | 0xa4dd2617 |
RtlUserFiberStart | 0x8e127a8f |
RtlUserThreadStart | 0xa2807e21 |
RtlValidAcl | 0x2019ff95 |
RtlValidProcessProtection | 0x625186b8 |
RtlValidRelativeSecurityDescriptor | 0x34412ccd |
RtlValidSecurityDescriptor | 0x48f5462f |
RtlValidSid | 0x201a484d |
RtlValidateCorrelationVector | 0xf020e3a0 |
RtlValidateHeap | 0x1b07a238 |
RtlValidateProcessHeaps | 0xb68c00d3 |
RtlValidateUnicodeString | 0xb66087c2 |
RtlVerifyVersionInfo | 0xa0c4a065 |
RtlVirtualUnwind | 0x4776d825 |
RtlWaitForWnfMetaNotification | 0xf3aa0fac |
RtlWaitOnAddress | 0xb0b02331 |
RtlWakeAddressAll | 0x98dcd4dd |
RtlWakeAddressAllNoFence | 0x297aebc6 |
RtlWakeAddressSingle | 0x8e417653 |
RtlWakeAddressSingleNoFence | 0xd49ff775 |
RtlWakeAllConditionVariable | 0x230c18c6 |
RtlWakeConditionVariable | 0x3208d89f |
RtlWalkFrameChain | 0x56708266 |
RtlWalkHeap | 0x202c8f61 |
RtlWeaklyEnumerateEntryHashTable | 0x51a60278 |
RtlWerpReportException | 0x33a8bbf0 |
RtlWnfCompareChangeStamp | 0x8685590c |
RtlWnfDllUnloadCallback | 0x7bd8019a |
RtlWow64CallFunction64 | 0x60dbe081 |
RtlWow64EnableFsRedirection | 0xfc399853 |
RtlWow64EnableFsRedirectionEx | 0xe6615908 |
RtlWow64GetCpuAreaInfo | 0x45aa2560 |
RtlWow64GetCurrentCpuArea | 0xe6cd616c |
RtlWow64GetCurrentMachine | 0x47c0be93 |
RtlWow64GetEquivalentMachineCHPE | 0x437c2a61 |
RtlWow64GetProcessMachines | 0xc0987515 |
RtlWow64GetSharedInfoProcess | 0x6bc1ffcd |
RtlWow64GetThreadContext | 0x8094d77c |
RtlWow64GetThreadSelectorEntry | 0xc3a43278 |
RtlWow64IsWowGuestMachineSupported | 0xccc09e12 |
RtlWow64LogMessageInEventLogger | 0xb7414611 |
RtlWow64PopAllCrossProcessWorkFromWorkList | 0x2fe637b6 |
RtlWow64PopCrossProcessWorkFromFreeList | 0xc2a33072 |
RtlWow64PushCrossProcessWorkOntoFreeList | 0x1f176cea |
RtlWow64PushCrossProcessWorkOntoWorkList | 0x79776d71 |
RtlWow64RequestCrossProcessHeavyFlush | 0x309f947a |
RtlWow64SetThreadContext | 0x8095377c |
RtlWow64SuspendProcess | 0xe0c99d2c |
RtlWow64SuspendThread | 0xd667d456 |
RtlWriteMemoryStream | 0x43775e95 |
RtlWriteNonVolatileMemory | 0xbac880bc |
RtlWriteRegistryValue | 0x871140ed |
RtlZeroHeap | 0x2c6c8f7a |
RtlZeroMemory | 0xbc43f36a |
RtlZombifyActivationContext | 0x4dca0d7c |
RtlpApplyLengthFunction | 0xbd9f8a73 |
RtlpCheckDynamicTimeZoneInformation | 0xdfaf162f |
RtlpCleanupRegistryKeys | 0x305603b3 |
RtlpConvertAbsoluteToRelativeSecurityAttribute | 0x3871aa99 |
RtlpConvertCultureNamesToLCIDs | 0x49be3cef |
RtlpConvertLCIDsToCultureNames | 0x6e593f6b |
RtlpConvertRelativeToAbsoluteSecurityAttribute | 0xb143ea77 |
RtlpCreateProcessRegistryInfo | 0x5bb92944 |
RtlpEnsureBufferSize | 0xb9da3087 |
RtlpExecuteUmsThread | 0xb909e004 |
RtlpFreezeTimeBias | 0x7f4dd4e1 |
RtlpGetDeviceFamilyInfoEnum | 0x2e0506fe |
RtlpGetLCIDFromLangInfoNode | 0x4fa3d26c |
RtlpGetNameFromLangInfoNode | 0xcc44d26d |
RtlpGetSystemDefaultUILanguage | 0x95cf703c |
RtlpGetUserOrMachineUILanguage4NLS | 0x2aa3359f |
RtlpInitializeLangRegistryInfo | 0xcc105b18 |
RtlpIsQualifiedLanguage | 0x1a2747d6 |
RtlpLoadMachineUIByPolicy | 0x1652a298 |
RtlpLoadUserUIByPolicy | 0x156d6931 |
RtlpMergeSecurityAttributeInformation | 0x564ea678 |
RtlpMuiFreeLangRegistryInfo | 0x4af33d13 |
RtlpMuiRegCreateRegistryInfo | 0x7db31545 |
RtlpMuiRegFreeRegistryInfo | 0xf2dd80c5 |
RtlpMuiRegLoadRegistryInfo | 0xe2ddaffd |
RtlpNotOwnerCriticalSection | 0xb5d97f2e |
RtlpNtCreateKey | 0x2ba9532 |
RtlpNtEnumerateSubKey | 0x33f69552 |
RtlpNtMakeTemporaryKey | 0x8f36f942 |
RtlpNtOpenKey | 0x2468ad3 |
RtlpNtQueryValueKey | 0xc2960950 |
RtlpNtSetValueKey | 0x3b328bc7 |
RtlpQueryDefaultUILanguage | 0xb96ae896 |
RtlpQueryProcessDebugInformationFromWow64 | 0x85186612 |
RtlpQueryProcessDebugInformationRemote | 0x1d6c15c3 |
RtlpRefreshCachedUILanguage | 0x69267fbc |
RtlpSetInstallLanguage | 0x59075e59 |
RtlpSetPreferredUILanguages | 0x9d7e7062 |
RtlpSetUserPreferredUILanguages | 0xda1d6844 |
RtlpTimeFieldsToTime | 0xc1bf7c8d |
RtlpTimeToTimeFields | 0x2c7de4c0 |
RtlpUmsExecuteYieldThreadEnd | 0xa81d08e5 |
RtlpUmsThreadYield | 0x235b13d6 |
RtlpUnWaitCriticalSection | 0x1a650df7 |
RtlpVerifyAndCommitUILanguageSettings | 0xa75c0319 |
RtlpWaitForCriticalSection | 0x6ccbccbf |
RtlpWow64CtxFromAmd64 | 0xc001fc2b |
RtlpWow64GetContextOnAmd64 | 0xdf6c2d6c |
RtlpWow64SetContextOnAmd64 | 0xdf782d6c |
RtlxAnsiStringToUnicodeSize | 0xd223e8e9 |
RtlxOemStringToUnicodeSize | 0x99d168bf |
RtlxUnicodeStringToAnsiSize | 0x6e1ffece |
RtlxUnicodeStringToOemSize | 0xb9065a01 |
SbExecuteProcedure | 0x3a51d22 |
SbSelectProcedure | 0x80f4dbe2 |
ShipAssert | 0x8975ee18 |
ShipAssertGetBufferInfo | 0x88ad9af |
ShipAssertMsgA | 0xe1b0f07f |
ShipAssertMsgW | 0xe1b0f095 |
TpAllocAlpcCompletion | 0xea101b94 |
TpAllocAlpcCompletionEx | 0x406e5cc0 |
TpAllocCleanupGroup | 0xd62c4b83 |
TpAllocIoCompletion | 0x931500b8 |
TpAllocJobNotification | 0x9309791f |
TpAllocPool | 0xe5b80ec7 |
TpAllocTimer | 0xb73ed08e |
TpAllocWait | 0xe5bb560f |
TpAllocWork | 0xe5bb8f26 |
TpAlpcRegisterCompletionList | 0xfc676ea |
TpAlpcUnregisterCompletionList | 0xe6a06d5f |
TpCallbackDetectedUnrecoverableError | 0x7aef3df8 |
TpCallbackIndependent | 0x5055483a |
TpCallbackLeaveCriticalSectionOnCompletion | 0x869562d8 |
TpCallbackMayRunLong | 0x7d024afa |
TpCallbackReleaseMutexOnCompletion | 0xdf8666a9 |
TpCallbackReleaseSemaphoreOnCompletion | 0x58b55d73 |
TpCallbackSendAlpcMessageOnCompletion | 0xa8d5d482 |
TpCallbackSendPendingAlpcMessage | 0x21254292 |
TpCallbackSetEventOnCompletion | 0x5a6d7ee3 |
TpCallbackUnloadDllOnCompletion | 0x8116b478 |
TpCancelAsyncIoOperation | 0xd8c896e9 |
TpCaptureCaller | 0x2e96cba0 |
TpCheckTerminateWorker | 0x7a63fac0 |
TpDbgDumpHeapUsage | 0xacbf95d8 |
TpDbgSetLogRoutine | 0xd4d7ddc5 |
TpDisablePoolCallbackChecks | 0x7a48db48 |
TpDisassociateCallback | 0x37cadcc4 |
TpIsTimerSet | 0x4c53eecf |
TpPostWork | 0xad783d47 |
TpQueryPoolStackInformation | 0xe60ebec3 |
TpReleaseAlpcCompletion | 0x153b1bf0 |
TpReleaseCleanupGroup | 0xecf71643 |
TpReleaseCleanupGroupMembers | 0x78bb54e6 |
TpReleaseIoCompletion | 0xa9dfcb78 |
TpReleaseJobNotification | 0xf8698484 |
TpReleasePool | 0xa5ced992 |
TpReleaseTimer | 0xba1829e6 |
TpReleaseWait | 0xa5d220da |
TpReleaseWork | 0xa5d259f1 |
TpSetDefaultPoolMaxThreads | 0x17d8bfef |
TpSetDefaultPoolStackInformation | 0x571f3c35 |
TpSetPoolMaxThreads | 0x5ee45b71 |
TpSetPoolMaxThreadsSoftLimit | 0xf864c402 |
TpSetPoolMinThreads | 0x5ee46321 |
TpSetPoolStackInformation | 0xe8e22315 |
TpSetPoolThreadBasePriority | 0x4ceecd26 |
TpSetPoolThreadCpuSets | 0x40246aed |
TpSetPoolWorkerThreadIdleTimeout | 0x4defc84a |
TpSetTimer | 0x2d8133c4 |
TpSetTimerEx | 0x4cf19ce |
TpSetWait | 0x916d6929 |
TpSetWaitEx | 0xb5a4af5d |
TpSimpleTryPost | 0x51fc4ff7 |
TpStartAsyncIoOperation | 0xcfc9f00c |
TpTimerOutstandingCallbackCount | 0xb94a5154 |
TpTrimPools | 0x2097a19e |
TpWaitForAlpcCompletion | 0xaffff7e |
TpWaitForIoCompletion | 0x8d5d3cb1 |
TpWaitForJobNotification | 0xb105f643 |
TpWaitForTimer | 0xd687d80d |
TpWaitForWait | 0xdeb59e4b |
TpWaitForWork | 0xdeb5d762 |
VerSetConditionMask | 0xf361b1b3 |
WerReportExceptionWorker | 0xeaa18130 |
WerReportSQMEvent | 0x68b19e0b |
WinSqmAddToAverageDWORD | 0xf2ccae60 |
WinSqmAddToStream | 0xb565eb76 |
WinSqmAddToStreamEx | 0x97ade3ed |
WinSqmCheckEscalationAddToStreamEx | 0xf6c7be49 |
WinSqmCheckEscalationSetDWORD | 0x81b4851a |
WinSqmCheckEscalationSetDWORD64 | 0xd21470fa |
WinSqmCheckEscalationSetString | 0x567284f7 |
WinSqmCommonDatapointDelete | 0xd39d910e |
WinSqmCommonDatapointSetDWORD | 0x84256e4a |
WinSqmCommonDatapointSetDWORD64 | 0x95b93104 |
WinSqmCommonDatapointSetStreamEx | 0x3e657faa |
WinSqmCommonDatapointSetString | 0xa48faaf7 |
WinSqmEndSession | 0xfbab16a4 |
WinSqmEventEnabled | 0x21f4545f |
WinSqmEventWrite | 0xd7ea9f4a |
WinSqmGetEscalationRuleStatus | 0xe3f9c862 |
WinSqmGetInstrumentationProperty | 0xa3cb79b0 |
WinSqmIncrementDWORD | 0xb1d87ace |
WinSqmIsOptedIn | 0xb2c61cd3 |
WinSqmIsOptedInEx | 0x187357e3 |
WinSqmIsSessionDisabled | 0xe97853db |
WinSqmSetDWORD | 0xf4c756ea |
WinSqmSetDWORD64 | 0x1d5bb2c7 |
WinSqmSetEscalationInfo | 0xda250886 |
WinSqmSetIfMaxDWORD | 0x2570426 |
WinSqmSetIfMinDWORD | 0xee570427 |
WinSqmSetString | 0xb8ccbf05 |
WinSqmStartSession | 0x98144dac |
WinSqmStartSessionForPartner | 0x175808 |
WinSqmStartSqmOptinListener | 0x7abdab81 |
ZwAcceptConnectPort | 0xbfa84dd0 |
ZwAccessCheck | 0x86f66716 |
ZwAccessCheckAndAuditAlarm | 0x82ccf919 |
ZwAccessCheckByType | 0x2d798c2b |
ZwAccessCheckByTypeAndAuditAlarm | 0xcfd34342 |
ZwAccessCheckByTypeResultList | 0x501f1170 |
ZwAccessCheckByTypeResultListAndAuditAlarm | 0x151e4dcd |
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle | 0xf4966d28 |
ZwAcquireProcessActivityReference | 0xb302a0d5 |
ZwAddAtom | 0xe62bc16 |
ZwAddAtomEx | 0x8af06151 |
ZwAddBootEntry | 0x3ea5a509 |
ZwAddDriverEntry | 0x9baa79cb |
ZwAdjustGroupsToken | 0xcdc82745 |
ZwAdjustPrivilegesToken | 0xaf59488e |
ZwAdjustTokenClaimsAndDeviceGroups | 0xdedaef42 |
ZwAlertResumeThread | 0xd081f332 |
ZwAlertThread | 0x8b4c8937 |
ZwAlertThreadByThreadId | 0xf690271 |
ZwAllocateLocallyUniqueId | 0x31ea7426 |
ZwAllocateReserveObject | 0xf70d4eb4 |
ZwAllocateUserPhysicalPages | 0xd4998d46 |
ZwAllocateUuids | 0x174a8e8b |
ZwAllocateVirtualMemory | 0xf53cdaf3 |
ZwAllocateVirtualMemoryEx | 0xf36bd8ec |
ZwAlpcAcceptConnectPort | 0x153fc017 |
ZwAlpcCancelMessage | 0xead45684 |
ZwAlpcConnectPort | 0x4061e55d |
ZwAlpcConnectPortEx | 0x87957e19 |
ZwAlpcCreatePort | 0x28118e3e |
ZwAlpcCreatePortSection | 0xd0f82454 |
ZwAlpcCreateResourceReserve | 0x7fdb0695 |
ZwAlpcCreateSectionView | 0x65a3d423 |
ZwAlpcCreateSecurityContext | 0xd68544bf |
ZwAlpcDeletePortSection | 0xd0f8be1c |
ZwAlpcDeleteResourceReserve | 0x1c5b069f |
ZwAlpcDeleteSectionView | 0x65a46deb |
ZwAlpcDeleteSecurityContext | 0x730544c9 |
ZwAlpcDisconnectPort | 0xbd13b5bb |
ZwAlpcImpersonateClientContainerOfPort | 0x620ba546 |
ZwAlpcImpersonateClientOfPort | 0x61cada36 |
ZwAlpcOpenSenderProcess | 0x1c3217e1 |
ZwAlpcOpenSenderThread | 0x7843182c |
ZwAlpcQueryInformation | 0xfc643d86 |
ZwAlpcQueryInformationMessage | 0xf48cfd90 |
ZwAlpcRevokeSecurityContext | 0x9c3c45a9 |
ZwAlpcSendWaitReceivePort | 0x34a926b3 |
ZwAlpcSetInformation | 0xd00d757e |
ZwApphelpCacheControl | 0x5aa00181 |
ZwAreMappedFilesTheSame | 0xd94909cd |
ZwAssignProcessToJobObject | 0x8ad00cc7 |
ZwAssociateWaitCompletionPacket | 0xcd4fd420 |
ZwCallEnclave | 0xff00229c |
ZwCallbackReturn | 0xb24b752d |
ZwCancelIoFile | 0x2c26d8e4 |
ZwCancelIoFileEx | 0x9b6399c8 |
ZwCancelSynchronousIoFile | 0x937f520a |
ZwCancelTimer | 0xfa0ed249 |
ZwCancelTimer2 | 0x41da4971 |
ZwCancelWaitCompletionPacket | 0x34061a1b |
ZwClearEvent | 0x57717175 |
ZwClose | 0x7267cadc |
ZwCloseObjectAuditAlarm | 0x7a7f2eaa |
ZwCommitComplete | 0xc97c2766 |
ZwCommitEnlistment | 0x3f8a6850 |
ZwCommitRegistryTransaction | 0x61e8decd |
ZwCommitTransaction | 0xcaf0eafd |
ZwCompactKeys | 0xea017431 |
ZwCompareObjects | 0xb3239e7c |
ZwCompareSigningLevels | 0xecaaf60 |
ZwCompareTokens | 0x58699e4f |
ZwCompleteConnectPort | 0x1b54bdec |
ZwCompressKey | 0x2e0509bc |
ZwConnectPort | 0xea041c43 |
ZwContinue | 0xa3820039 |
ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter | 0x282ac11e |
ZwCreateCrossVmEvent | 0xb6b83a3f |
ZwCreateDebugObject | 0x4f1a50a1 |
ZwCreateDirectoryObject | 0xd9203fc6 |
ZwCreateDirectoryObjectEx | 0x80ff247c |
ZwCreateEnclave | 0x8d0841d1 |
ZwCreateEnlistment | 0x84ce68ff |
ZwCreateEvent | 0xab274a5f |
ZwCreateEventPair | 0xa6244406 |
ZwCreateFile | 0x5d598726 |
ZwCreateIRTimer | 0x5416efbf |
ZwCreateIoCompletion | 0x39a5c630 |
ZwCreateJobObject | 0xa711580f |
ZwCreateJobSet | 0x6e775e89 |
ZwCreateKey | 0xaeadfc3 |
ZwCreateKeyTransacted | 0xeb5a7dd3 |
ZwCreateKeyedEvent | 0x63e3a066 |
ZwCreateLowBoxToken | 0xa05e3c45 |
ZwCreateMailslotFile | 0x424b82f6 |
ZwCreateMutant | 0x74e097a9 |
ZwCreateNamedPipeFile | 0xd35de42b |
ZwCreatePagingFile | 0x79ec4b88 |
ZwCreatePartition | 0xf1866f1d |
ZwCreatePort | 0x5d5e9ff5 |
ZwCreatePrivateNamespace | 0xb99c6c96 |
ZwCreateProcess | 0x55c3d182 |
ZwCreateProcessEx | 0xf46126f |
ZwCreateProfile | 0x55c56094 |
ZwCreateProfileEx | 0x15825a6f |
ZwCreateRegistryTransaction | 0xe1fec775 |
ZwCreateResourceManager | 0x13237f0a |
ZwCreateSection | 0xfb0c60fd |
ZwCreateSectionEx | 0x31840104 |
ZwCreateSemaphore | 0x8bf08a93 |
ZwCreateSymbolicLinkObject | 0xb27e5f1b |
ZwCreateThread | 0x820fa5f9 |
ZwCreateThreadEx | 0x3e97ef20 |
ZwCreateTimer | 0xac10e93d |
ZwCreateTimer2 | 0x821d27e7 |
ZwCreateToken | 0xac13e139 |
ZwCreateTokenEx | 0x4f84efc8 |
ZwCreateTransaction | 0x737100e6 |
ZwCreateTransactionManager | 0xa49a3059 |
ZwCreateUserProcess | 0xd62c9582 |
ZwCreateWaitCompletionPacket | 0x44bdb7ab |
ZwCreateWaitablePort | 0xc060a332 |
ZwCreateWnfStateName | 0x9092ea1b |
ZwCreateWorkerFactory | 0x8c69bf07 |
ZwDebugActiveProcess | 0x1368ea51 |
ZwDebugContinue | 0x178d67ac |
ZwDelayExecution | 0x95220976 |
ZwDeleteAtom | 0x5d5746c7 |
ZwDeleteBootEntry | 0xa1438e1e |
ZwDeleteDriverEntry | 0x134ecf56 |
ZwDeleteFile | 0x5d599a5f |
ZwDeleteKey | 0xd2eae05c |
ZwDeleteObjectAuditAlarm | 0x55760aca |
ZwDeletePrivateNamespace | 0x499c6dca |
ZwDeleteValueKey | 0xa7298f30 |
ZwDeleteWnfStateData | 0x90a123f7 |
ZwDeleteWnfStateName | 0x90a6231b |
ZwDeviceIoControlFile | 0xca986b0d |
ZwDisableLastKnownGood | 0x5a250033 |
ZwDisplayString | 0x63d538c0 |
ZwDrawText | 0x49a75cb1 |
ZwDuplicateObject | 0x1c652f7f |
ZwDuplicateToken | 0x5939ad83 |
ZwEnableLastKnownGood | 0x49844a7c |
ZwEnumerateBootEntries | 0xde2204a2 |
ZwEnumerateDriverEntries | 0xe231509f |
ZwEnumerateKey | 0xddbaca19 |
ZwEnumerateSystemEnvironmentValuesEx | 0x9505d73c |
ZwEnumerateTransactionObject | 0xf52d76c2 |
ZwEnumerateValueKey | 0x213f2f04 |
ZwExtendSection | 0x1e48daf6 |
ZwFilterBootOption | 0x2545b003 |
ZwFilterToken | 0x61ec8ce |
ZwFilterTokenEx | 0x7b234130 |
ZwFindAtom | 0x226e1798 |
ZwFlushBuffersFile | 0x9c250720 |
ZwFlushBuffersFileEx | 0x941c8b88 |
ZwFlushInstallUILanguage | 0xc6a1dd68 |
ZwFlushInstructionCache | 0xfe24c7ce |
ZwFlushKey | 0xf170f264 |
ZwFlushProcessWriteBuffers | 0xd5e85d8a |
ZwFlushVirtualMemory | 0x1c0f08a1 |
ZwFlushWriteBuffer | 0x3ca89dbd |
ZwFreeUserPhysicalPages | 0xf4351a07 |
ZwFreeVirtualMemory | 0xae08eced |
ZwFreezeRegistry | 0x68f1f4b6 |
ZwFreezeTransactions | 0x6e801e4d |
ZwFsControlFile | 0xff7f1b14 |
ZwGetCachedSigningLevel | 0x17015be5 |
ZwGetCompleteWnfStateSubscription | 0xf7beb3d6 |
ZwGetContextThread | 0x23badb8e |
ZwGetCurrentProcessorNumber | 0x46022f94 |
ZwGetCurrentProcessorNumberEx | 0x8be5a30 |
ZwGetDevicePowerState | 0x95a045c6 |
ZwGetMUIRegistryInfo | 0x8ba04602 |
ZwGetNextProcess | 0x766b2cdc |
ZwGetNextThread | 0x5314e0d4 |
ZwGetNlsSectionPtr | 0xfcb86954 |
ZwGetNotificationResourceManager | 0x15be384b |
ZwGetWriteWatch | 0x73fdc9a0 |
ZwImpersonateAnonymousToken | 0xbb6a563f |
ZwImpersonateClientOfPort | 0xcc64fda4 |
ZwImpersonateThread | 0xc1314a10 |
ZwInitializeEnclave | 0x5bd1bb8f |
ZwInitializeNlsFiles | 0x17db4aa6 |
ZwInitializeRegistry | 0x42106c6a |
ZwInitiatePowerAction | 0x2e66cd79 |
ZwIsProcessInJob | 0x4a16ae1 |
ZwIsSystemResumeAutomatic | 0x9f6eb09 |
ZwIsUILanguageComitted | 0xa3c958f1 |
ZwListenPort | 0xffefb769 |
ZwLoadDriver | 0xbe3c5733 |
ZwLoadEnclaveData | 0x75f3853e |
ZwLoadKey | 0xe44396e4 |
ZwLoadKey2 | 0x8872dcce |
ZwLoadKey3 | 0x8872dccf |
ZwLoadKeyEx | 0xe5b9ca9 |
ZwLockFile | 0x8ce06b61 |
ZwLockProductActivationKeys | 0x89441a88 |
ZwLockRegistryKey | 0x16908f63 |
ZwLockVirtualMemory | 0xae0ed479 |
ZwMakePermanentObject | 0xbcf70c0f |
ZwMakeTemporaryObject | 0xaeaf8930 |
ZwManageHotPatch | 0xf5c69284 |
ZwManagePartition | 0x8152717c |
ZwMapCMFModule | 0xb936281a |
ZwMapUserPhysicalPages | 0x657e6305 |
ZwMapUserPhysicalPagesScatter | 0xb83ef552 |
ZwMapViewOfSection | 0x324865b9 |
ZwMapViewOfSectionEx | 0x2196ede1 |
ZwModifyBootEntry | 0x230e1072 |
ZwModifyDriverEntry | 0x3d581d5d |
ZwNotifyChangeDirectoryFile | 0xed041d44 |
ZwNotifyChangeDirectoryFileEx | 0x10751ccc |
ZwNotifyChangeKey | 0x9928ebd7 |
ZwNotifyChangeMultipleKeys | 0xfd30ee1c |
ZwNotifyChangeSession | 0xbd54c4de |
ZwOpenDirectoryObject | 0x2da1b39 |
ZwOpenEnlistment | 0x61bc2214 |
ZwOpenEvent | 0x2203d4ce |
ZwOpenEventPair | 0x4d0bb1cf |
ZwOpenFile | 0xd1106b79 |
ZwOpenIoCompletion | 0xf08a19a3 |
ZwOpenJobObject | 0x4df8c5d8 |
ZwOpenKey | 0xa68896e5 |
ZwOpenKeyEx | 0x225b9fb2 |
ZwOpenKeyTransacted | 0xc7e4ec4a |
ZwOpenKeyTransactedEx | 0x93b13437 |
ZwOpenKeyedEvent | 0x40d1597b |
ZwOpenMutant | 0x5071e578 |
ZwOpenObjectAuditAlarm | 0xfcb177db |
ZwOpenPartition | 0x986ddce6 |
ZwOpenPrivateNamespace | 0xf0d7dadb |
ZwOpenProcess | 0xc7ed8b5d |
ZwOpenProcessToken | 0xc1091424 |
ZwOpenProcessTokenEx | 0x24509c1c |
ZwOpenRegistryTransaction | 0x99216313 |
ZwOpenResourceManager | 0x3cdd5a7c |
ZwOpenSection | 0x6d361ad9 |
ZwOpenSemaphore | 0x32d7f85c |
ZwOpenSession | 0x6e359ad9 |
ZwOpenSymbolicLinkObject | 0xa03773f8 |
ZwOpenThread | 0x5da0f3c8 |
ZwOpenThreadToken | 0x96347af5 |
ZwOpenThreadTokenEx | 0xd1ebdf70 |
ZwOpenTimer | 0x22ed73ac |
ZwOpenTransaction | 0x11282382 |
ZwOpenTransactionManager | 0x92534536 |
ZwPlugPlayControl | 0x2a478805 |
ZwPowerInformation | 0xf6377897 |
ZwPrePrepareComplete | 0x113f8733 |
ZwPrePrepareEnlistment | 0x4d09996f |
ZwPrepareComplete | 0x2b281704 |
ZwPrepareEnlistment | 0xef48ddd6 |
ZwPrivilegeCheck | 0xe4ce1e74 |
ZwPrivilegeObjectAuditAlarm | 0x8492f081 |
ZwPrivilegedServiceAuditAlarm | 0xbd0b6bae |
ZwPropagationComplete | 0xbb9c920a |
ZwPropagationFailed | 0xce8cd63f |
ZwProtectVirtualMemory | 0xd374024 |
ZwPulseEvent | 0xbd731ab1 |
ZwQueryAttributesFile | 0x2032ec51 |
ZwQueryAuxiliaryCounterFrequency | 0xab126084 |
ZwQueryBootEntryOrder | 0x738c6377 |
ZwQueryBootOptions | 0x10c642f9 |
ZwQueryDebugFilterState | 0xd0e3cff6 |
ZwQueryDefaultLocale | 0xf9dff007 |
ZwQueryDefaultUILanguage | 0x4dca88c |
ZwQueryDirectoryFile | 0x8a1fe47 |
ZwQueryDirectoryFileEx | 0x87f9253a |
ZwQueryDirectoryObject | 0x998828f6 |
ZwQueryDriverEntryOrder | 0x2e4e5f75 |
ZwQueryEaFile | 0xad07ba99 |
ZwQueryEvent | 0xa5733a79 |
ZwQueryFullAttributesFile | 0x982fe3bf |
ZwQueryInformationAtom | 0x1f6ef9c5 |
ZwQueryInformationByName | 0xbe267282 |
ZwQueryInformationEnlistment | 0x35545a8d |
ZwQueryInformationFile | 0x1f714d5d |
ZwQueryInformationJobObject | 0x1495879c |
ZwQueryInformationPort | 0x1f76662c |
ZwQueryInformationProcess | 0x38df328e |
ZwQueryInformationResourceManager | 0x2e848aed |
ZwQueryInformationThread | 0xe1288101 |
ZwQueryInformationToken | 0xef0ca811 |
ZwQueryInformationTransaction | 0x842f329c |
ZwQueryInformationTransactionManager | 0x2a8bbe0a |
ZwQueryInformationWorkerFactory | 0x8530974a |
ZwQueryInstallUILanguage | 0xc4c1f3f0 |
ZwQueryIntervalProfile | 0xc0926d17 |
ZwQueryIoCompletion | 0xc054700 |
ZwQueryKey | 0x116972bf |
ZwQueryLicenseValue | 0xbe77c9bf |
ZwQueryMultipleValueKey | 0xb8a49a4d |
ZwQueryMutant | 0xbe5e9ae8 |
ZwQueryObject | 0xc129a988 |
ZwQueryOpenSubKeys | 0x19cb322a |
ZwQueryOpenSubKeysEx | 0x2cc8b17f |
ZwQueryPerformanceCounter | 0x49d0de3c |
ZwQueryPortInformationProcess | 0xcfc6c600 |
ZwQueryQuotaInformationFile | 0x5573fef4 |
ZwQuerySection | 0x2accc8e7 |
ZwQuerySecurityAttributesToken | 0x125af5c5 |
ZwQuerySecurityObject | 0x3ac2025c |
ZwQuerySecurityPolicy | 0x3d931261 |
ZwQuerySemaphore | 0x8d902f52 |
ZwQuerySymbolicLinkObject | 0xa7163f4f |
ZwQuerySystemEnvironmentValue | 0x9e207e5a |
ZwQuerySystemEnvironmentValueEx | 0x81f97390 |
ZwQuerySystemInformation | 0x42632b16 |
ZwQuerySystemInformationEx | 0x8cac6221 |
ZwQuerySystemTime | 0x5c485beb |
ZwQueryTimer | 0xa65cd957 |
ZwQueryTimerResolution | 0x4f4f476 |
ZwQueryValueKey | 0x6ba68c55 |
ZwQueryVirtualMemory | 0x1d778883 |
ZwQueryVolumeInformationFile | 0x95b09842 |
ZwQueryWnfStateData | 0x62ed6bc7 |
ZwQueryWnfStateNameInformation | 0xd72f5518 |
ZwQueueApcThread | 0xf31e7386 |
ZwQueueApcThreadEx | 0x79ce24e4 |
ZwRaiseException | 0xd7978991 |
ZwRaiseHardError | 0x92e6afe1 |
ZwReadFile | 0x8706b8f |
ZwReadFileScatter | 0xcfcf399f |
ZwReadOnlyEnlistment | 0x2c0d5583 |
ZwReadRequestData | 0x711674f3 |
ZwReadVirtualMemory | 0xae1483eb |
ZwRecoverEnlistment | 0x38fe7556 |
ZwRecoverResourceManager | 0xc08bdf22 |
ZwRecoverTransactionManager | 0xd4a6870d |
ZwRegisterProtocolAddressInformation | 0xcc775898 |
ZwRegisterThreadTerminatePort | 0xab0a3aa |
ZwReleaseKeyedEvent | 0xcedfaee7 |
ZwReleaseMutant | 0x35c8ae59 |
ZwReleaseSemaphore | 0x97486b07 |
ZwReleaseWorkerFactoryWorker | 0x1a155634 |
ZwRemoveIoCompletion | 0x3b7909b4 |
ZwRemoveIoCompletionEx | 0xe426da05 |
ZwRemoveProcessDebug | 0xaf2e22e |
ZwRenameKey | 0x4a7aee5d |
ZwRenameTransactionManager | 0x250f0256 |
ZwReplaceKey | 0xf74a61b4 |
ZwReplacePartitionUnit | 0xf9d30f78 |
ZwReplyPort | 0xe130fff8 |
ZwReplyWaitReceivePort | 0xa03f6b1a |
ZwReplyWaitReceivePortEx | 0xfdac7398 |
ZwReplyWaitReplyPort | 0x68953c1f |
ZwRequestPort | 0xa3edf7c |
ZwRequestWaitReplyPort | 0x2485a141 |
ZwResetEvent | 0x5b734ae6 |
ZwResetWriteWatch | 0x345b7f7f |
ZwRestoreKey | 0x143a61cf |
ZwResumeProcess | 0x3f7e4a83 |
ZwResumeThread | 0x895d79c1 |
ZwRevertContainerImpersonation | 0x708e79f7 |
ZwRollbackComplete | 0x9f821cb8 |
ZwRollbackEnlistment | 0x575fafa8 |
ZwRollbackRegistryTransaction | 0xad3e1c8 |
ZwRollbackTransaction | 0xc599d600 |
ZwRollforwardTransactionManager | 0xe86dad8a |
ZwSaveKey | 0x899416e6 |
ZwSaveKeyEx | 0x505ba33e |
ZwSaveMergedKeys | 0xdd081aa9 |
ZwSecureConnectPort | 0xd83a5df0 |
ZwSerializeBoot | 0x9ec86642 |
ZwSetBootEntryOrder | 0x17b9f45c |
ZwSetBootOptions | 0x328f8b54 |
ZwSetCachedSigningLevel | 0x17015ca5 |
ZwSetCachedSigningLevel2 | 0xe02b94d4 |
ZwSetContextThread | 0x23bb3b8e |
ZwSetDebugFilterState | 0x87276287 |
ZwSetDefaultHardErrorPort | 0x1690e8b2 |
ZwSetDefaultLocale | 0x1f015c8f |
ZwSetDefaultUILanguage | 0xcd4efaa2 |
ZwSetDriverEntryOrder | 0xe491f205 |
ZwSetEaFile | 0x91abe82a |
ZwSetEvent | 0x2c985be6 |
ZwSetEventBoostPriority | 0xba64167 |
ZwSetHighEventPair | 0xe54c8c88 |
ZwSetHighWaitLowEventPair | 0x9a4d1cdb |
ZwSetIRTimer | 0x185d09c5 |
ZwSetInformationDebugObject | 0x8d6966fb |
ZwSetInformationEnlistment | 0x56c0e1b2 |
ZwSetInformationFile | 0xa52369f1 |
ZwSetInformationJobObject | 0x3da0ebd5 |
ZwSetInformationKey | 0x65292ed9 |
ZwSetInformationObject | 0x9f36d368 |
ZwSetInformationProcess | 0x47297567 |
ZwSetInformationResourceManager | 0x78c763fb |
ZwSetInformationSymbolicLink | 0x281c464 |
ZwSetInformationThread | 0xa99ad318 |
ZwSetInformationToken | 0xa5503aa2 |
ZwSetInformationTransaction | 0xb1c01740 |
ZwSetInformationTransactionManager | 0x9712e32b |
ZwSetInformationVirtualMemory | 0xde0d782 |
ZwSetInformationWorkerFactory | 0xc8c32800 |
ZwSetIntervalProfile | 0x464489ac |
ZwSetIoCompletion | 0x452e5264 |
ZwSetIoCompletionEx | 0xb9499a2c |
ZwSetLdtEntries | 0x87d4b038 |
ZwSetLowEventPair | 0x8b9287ed |
ZwSetLowWaitHighEventPair | 0x29a8ef1 |
ZwSetQuotaInformationFile | 0x7e7f632d |
ZwSetSecurityObject | 0xdeef9340 |
ZwSetSystemEnvironmentValue | 0xcbb162fe |
ZwSetSystemEnvironmentValueEx | 0xc58c0446 |
ZwSetSystemInformation | 0xad57d2d |
ZwSetSystemPowerState | 0x76c0c2c1 |
ZwSetSystemTime | 0x3556a62e |
ZwSetThreadExecutionState | 0x61fc5d47 |
ZwSetTimer | 0x2d81fac4 |
ZwSetTimer2 | 0xb03f58b7 |
ZwSetTimerEx | 0x7eb19ce |
ZwSetTimerResolution | 0x8aa7110a |
ZwSetUuidSeed | 0xf54437cf |
ZwSetValueKey | 0xfc5ccfe7 |
ZwSetVolumeInformationFile | 0xb71d1f67 |
ZwSetWnfProcessNotificationEvent | 0xa860bf42 |
ZwShutdownSystem | 0xea2b3e4d |
ZwShutdownWorkerFactory | 0xd4c09d62 |
ZwSignalAndWaitForSingleObject | 0xe9f4a1f7 |
ZwSinglePhaseReject | 0x558a69dc |
ZwStartProfile | 0x86814855 |
ZwStopProfile | 0xc7ffa47f |
ZwSubscribeWnfStateChange | 0x5987044f |
ZwSuspendProcess | 0x76732275 |
ZwSuspendThread | 0x1b152081 |
ZwSystemDebugControl | 0x7f994495 |
ZwTerminateEnclave | 0x3465e48a |
ZwTerminateJobObject | 0x1d9c3aad |
ZwTerminateProcess | 0xfd21743a |
ZwTerminateThread | 0x474a930f |
ZwTestAlert | 0xadbed9f9 |
ZwThawRegistry | 0xb077f91e |
ZwThawTransactions | 0xb50496ad |
ZwTraceControl | 0x40f05d41 |
ZwTraceEvent | 0xbd739755 |
ZwTranslateFilePath | 0xfd442357 |
ZwUmsThreadYield | 0x18a68596 |
ZwUnloadDriver | 0x2b9c57ef |
ZwUnloadKey | 0xe5ba71a4 |
ZwUnloadKey2 | 0xb74e34ce |
ZwUnloadKeyEx | 0xe9c69cae |
ZwUnlockFile | 0xbbbbc361 |
ZwUnlockVirtualMemory | 0x190eda55 |
ZwUnmapViewOfSection | 0xda065e8 |
ZwUnmapViewOfSectionEx | 0x8197a94e |
ZwUnsubscribeWnfStateChange | 0x344705c6 |
ZwUpdateWnfStateData | 0x92cbe2f7 |
ZwVdmControl | 0xd402fdc5 |
ZwWaitForAlertByThreadId | 0xd17beaa3 |
ZwWaitForDebugEvent | 0x2317ad90 |
ZwWaitForKeyedEvent | 0x1d188e44 |
ZwWaitForMultipleObjects | 0xe2a7a2a6 |
ZwWaitForMultipleObjects32 | 0x9e8aa21c |
ZwWaitForSingleObject | 0x18158390 |
ZwWaitForWorkViaWorkerFactory | 0xc927a098 |
ZwWaitHighEventPair | 0x50ccfd8a |
ZwWaitLowEventPair | 0x96ee8b75 |
ZwWorkerFactoryWorkerReady | 0x92374740 |
ZwWriteFile | 0x2febec90 |
ZwWriteFileGather | 0xa046a836 |
ZwWriteRequestData | 0xacf27cfc |
ZwWriteVirtualMemory | 0x1e34a8db |
ZwYieldExecution | 0xd1cb69a0 |
__C_specific_handler | 0x33fbf826 |
__chkstk | 0x8cb75dfb |
__isascii | 0x2c4b7b9c |
__iscsym | 0x99635e9d |
__iscsymf | 0x2c6bd419 |
__misaligned_access | 0x6ddb096 |
__toascii | 0xe44b7b9e |
_atoi64 | 0x89792b0c |
_errno | 0xc48ad62f |
_fltused | 0x5f7c5c16 |
_i64toa | 0x957bde59 |
_i64toa_s | 0xef7972a8 |
_i64tow | 0x957bde6f |
_i64tow_s | 0xef79caa8 |
_itoa | 0x6265e41 |
_itoa_s | 0x9979106b |
_itow | 0x6265e57 |
_itow_s | 0x9979686b |
_lfind | 0xc4f4b224 |
_local_unwind | 0xd8e5f6a2 |
_ltoa | 0x627de41 |
_ltoa_s | 0x9f79106b |
_ltow | 0x627de57 |
_ltow_s | 0x9f79686b |
_makepath_s | 0x27d5b0c5 |
_memccpy | 0x11031d8d |
_memicmp | 0x11061d24 |
_setjmp | 0xac8bb628 |
_setjmpex | 0x2ed8afca |
_snprintf | 0x6756a99a |
_snprintf_s | 0x5aa675f0 |
_snscanf_s | 0x8c54fae0 |
_snwprintf | 0xa7629d74 |
_snwprintf_s | 0x8a75def0 |
_snwscanf_s | 0x8dd37628 |
_splitpath | 0xd985e983 |
_splitpath_s | 0x17a61bb9 |
_strcmpi | 0xaf53457e |
_stricmp | 0xaf561d25 |
_strlwr | 0xad7abf6a |
_strlwr_s | 0xeafdb708 |
_strnicmp | 0xeb167cc5 |
_strnset_s | 0x6370b310 |
_strset_s | 0xeb64bf08 |
_strupr | 0xad7ae28a |
_strupr_s | 0xeb8a3708 |
_swprintf | 0xa756a99c |
_ui64toa | 0x157be157 |
_ui64toa_s | 0xef8568a8 |
_ui64tow | 0x157be16d |
_ui64tow_s | 0xef85c0a8 |
_ultoa | 0xc587de41 |
_ultoa_s | 0x1f791369 |
_ultow | 0xc587de57 |
_ultow_s | 0x1f796b69 |
_vscprintf | 0xa762a097 |
_vscwprintf | 0xa8e17d1c |
_vsnprintf | 0x6762a09a |
_vsnprintf_s | 0x8a8275f0 |
_vsnwprintf | 0xa8e17d74 |
_vsnwprintf_s | 0x85f5def6 |
_vswprintf | 0xa762a09c |
_wcsicmp | 0x8d661d26 |
_wcslwr | 0xb46b3f6a |
_wcslwr_s | 0xacfdb724 |
_wcsnicmp | 0xad167ce1 |
_wcsnset_s | 0xa370b688 |
_wcsset_s | 0xad64bf24 |
_wcstoi64 | 0xad798dc5 |
_wcstoui64 | 0xaf388529 |
_wcsupr | 0xb46b628a |
_wcsupr_s | 0xad8a3724 |
_wmakepath_s | 0x57b5b0c5 |
_wsplitpath_s | 0x13a61bbf |
_wtoi | 0x62d5e49 |
_wtoi64 | 0xb5792b0c |
_wtol | 0x62d5e4c |
abs | 0x190b3 |
atan | 0x325c8e |
atan2 | 0x64b91f2 |
atoi | 0x325e49 |
atol | 0x325e4c |
bsearch | 0x6c8254e1 |
bsearch_s | 0x9539205 |
ceil | 0x33218c |
cos | 0x19a53 |
fabs | 0x3490b3 |
floor | 0x697ca52 |
isalnum | 0x2c47c728 |
isalpha | 0x2c47cd7c |
iscntrl | 0x2c68dec7 |
isdigit | 0x2c7629af |
isgraph | 0x2caa9283 |
islower | 0x2cf9692d |
isprint | 0x2d3ab24f |
ispunct | 0x2d3c44ef |
isspace | 0x2d6990e0 |
isupper | 0x2d89cd2d |
iswalnum | 0xb447ca72 |
iswalpha | 0xb447d0c6 |
iswascii | 0xb44b1cee |
iswctype | 0xb46bf5ca |
iswdigit | 0xb4762cf9 |
iswgraph | 0xb4aa95cd |
iswlower | 0xb4f96c77 |
iswprint | 0xb53ab599 |
iswspace | 0xb569942a |
iswxdigit | 0xb676964a |
isxdigit | 0xb6762cf9 |
labs | 0x3790b3 |
log | 0x1be47 |
longjmp | 0xe515362b |
mbstowcs | 0x6d796c54 |
memchr | 0xe0881972 |
memcmp | 0xe0881a10 |
memcpy | 0xe0881a79 |
memcpy_s | 0x2069f3d5 |
memmove | 0x11084b41 |
memmove_s | 0x212d1097 |
memset | 0xe0885914 |
pow | 0x1ce57 |
qsort | 0x74b4ab4 |
qsort_s | 0x2d2adc70 |
sin | 0x1d98e |
sprintf | 0xa7564703 |
sprintf_s | 0x591c1af0 |
sqrt | 0x3b52b4 |
sscanf | 0xed631226 |
sscanf_s | 0x8c48a808 |
strcat | 0xed7a9894 |
strcat_s | 0xea626008 |
strchr | 0xed7a9972 |
strcmp | 0xed7a9a10 |
strcpy | 0xed7a9a79 |
strcpy_s | 0xea69f408 |
strcspn | 0xaf535a8b |
strlen | 0xed7abd0e |
strncat | 0xaf5898b1 |
strncat_s | 0x6262d310 |
strncmp | 0xaf589a2d |
strncpy | 0xaf589a96 |
strncpy_s | 0x626a6710 |
strnlen | 0xaf58bd2b |
strpbrk | 0xaf5996c8 |
strrchr | 0xaf5a998f |
strspn | 0xed7ada6e |
strstr | 0xed7adaf2 |
strtok_s | 0xeb793c08 |
strtol | 0xed7ade4c |
strtoul | 0xaf5bcb29 |
swprintf | 0xa7564a9c |
swprintf_s | 0x592a7ef0 |
swscanf_s | 0x8c491b28 |
tan | 0x1dc8e |
tolower | 0xe4f9692f |
toupper | 0xe589cd2f |
towlower | 0xb4f96cce |
towupper | 0xb589d0ce |
vDbgPrintEx | 0xeca9be64 |
vDbgPrintExWithPrefix | 0xa0f324f9 |
vsprintf | 0xa7564ab3 |
vsprintf_s | 0x592adaf0 |
vswprintf_s | 0x5b027ef0 |
wcscat | 0xf46b1894 |
wcscat_s | 0xac626024 |
wcschr | 0xf46b1972 |
wcscmp | 0xf46b1a10 |
wcscpy | 0xf46b1a79 |
wcscpy_s | 0xac69f424 |
wcscspn | 0x8d635a8c |
wcslen | 0xf46b3d0e |
wcsncat | 0x8d6898b2 |
wcsncat_s | 0xa262d688 |
wcsncmp | 0x8d689a2e |
wcsncpy | 0x8d689a97 |
wcsncpy_s | 0xa26a6a88 |
wcsnlen | 0x8d68bd2c |
wcspbrk | 0x8d6996c9 |
wcsrchr | 0x8d6a9990 |
wcsspn | 0xf46b5a6e |
wcsstr | 0xf46b5af2 |
wcstok_s | 0xad793c24 |
wcstol | 0xf46b5e4c |
wcstombs | 0xad794484 |
wcstoul | 0x8d6bcb2a |