ntdll.dll API hash lookup table
This post contains the hashes of the APIs that ntdll.dll (MD5: 9A03DD73B5539B788AD243AF07E7305B, SHA-1: 7053e1012e46206bb9625d620bfb8cadd046779b, SHA-256: 5b58f50147a78ab76127030d8ad745ac2ec1bde2487bf379430a6e8a79a20cc2) exports. The version of the DLL is 10.0.17763.194 (WinBuild.160101.0800).
The page is in essence an effort to document the exported APIs of important Windows libraries. Additional work has been documented in:
- iphlpapi.dll API hash lookup table
- kernel32.dll API hash lookup table
- ntoskrnl.exe API hash lookup table
Look up table
| API name | hash |
|---|---|
| A_SHAFinal | 0x869ec636 |
| A_SHAInit | 0x543689a1 |
| A_SHAUpdate | 0xf243c835 |
| AlpcAdjustCompletionListConcurrencyCount | 0x5a30ac92 |
| AlpcFreeCompletionListMessage | 0x25c64408 |
| AlpcGetCompletionListLastMessageInformation | 0x57603637 |
| AlpcGetCompletionListMessageAttributes | 0x4a4c7a79 |
| AlpcGetHeaderSize | 0x75e91891 |
| AlpcGetMessageAttribute | 0xf6136902 |
| AlpcGetMessageFromCompletionList | 0x5eb730c6 |
| AlpcGetOutstandingCompletionListMessageCount | 0xef1b1edd |
| AlpcInitializeMessageAttribute | 0x92821bad |
| AlpcMaxAllowedMessageLength | 0x14024bfb |
| AlpcRegisterCompletionList | 0xfc64b2a |
| AlpcRegisterCompletionListWorkerThread | 0xfd01b37b |
| AlpcRundownCompletionList | 0xd6c53af8 |
| AlpcUnregisterCompletionList | 0xe5f16d5f |
| AlpcUnregisterCompletionListWorkerThread | 0x5a64659f |
| ApiSetQueryApiSetPresence | 0x1ee0f6b7 |
| ApiSetQueryApiSetPresenceEx | 0x83dae593 |
| CsrAllocateCaptureBuffer | 0xee4f6bd1 |
| CsrAllocateMessagePointer | 0x7f9b2a27 |
| CsrCaptureMessageBuffer | 0xe268dbf5 |
| CsrCaptureMessageMultiUnicodeStringsInPlace | 0xd37d3b25 |
| CsrCaptureMessageString | 0x45ee90b |
| CsrCaptureTimeout | 0x232a155e |
| CsrClientCallServer | 0x5037dd67 |
| CsrClientConnectToServer | 0x387315db |
| CsrFreeCaptureBuffer | 0x885d47ed |
| CsrGetProcessId | 0xd1ae3add |
| CsrIdentifyAlertableThread | 0x2dc40dae |
| CsrSetPriorityClass | 0x4bee9a67 |
| CsrVerifyRegion | 0x3727f04a |
| DbgBreakPoint | 0x8ddde779 |
| DbgPrint | 0x533ab46d |
| DbgPrintEx | 0xead1be64 |
| DbgPrintReturnControlC | 0xfe0a95f6 |
| DbgPrompt | 0x6759899e |
| DbgQueryDebugFilterState | 0xd305aff6 |
| DbgSetDebugFilterState | 0x8727eaff |
| DbgUiConnectToDbg | 0x6109f859 |
| DbgUiContinue | 0x161d523e |
| DbgUiConvertStateChangeStructure | 0xa0c9c400 |
| DbgUiConvertStateChangeStructureEx | 0x27100b9b |
| DbgUiDebugActiveProcess | 0x5b7ab4be |
| DbgUiGetThreadDebugObject | 0x1175749c |
| DbgUiIssueRemoteBreakin | 0xec6d1172 |
| DbgUiRemoteBreakin | 0xc7a9dede |
| DbgUiSetThreadDebugObject | 0x117574a2 |
| DbgUiStopDebugging | 0xe554c77f |
| DbgUiWaitStateChange | 0x2d4588ab |
| DbgUserBreakPoint | 0x7fd111e6 |
| EtwCheckCoverage | 0x182da46c |
| EtwCreateTraceInstanceId | 0xaf0ddf8e |
| EtwDeliverDataBlock | 0xb5f38a10 |
| EtwEnumerateProcessRegGuids | 0x83aab5af |
| EtwEventActivityIdControl | 0xcafdc9eb |
| EtwEventEnabled | 0xb6a7e0e5 |
| EtwEventProviderEnabled | 0xb4178a25 |
| EtwEventRegister | 0xa16fd9ae |
| EtwEventSetInformation | 0x8ea6fb0c |
| EtwEventUnregister | 0xa6be38ee |
| EtwEventWrite | 0xf98fcc2d |
| EtwEventWriteEndScenario | 0xa9314426 |
| EtwEventWriteEx | 0x3f30c0fe |
| EtwEventWriteFull | 0xc3047ae8 |
| EtwEventWriteNoRegistration | 0x68e00b25 |
| EtwEventWriteStartScenario | 0xefc4a4a1 |
| EtwEventWriteString | 0x2bdea533 |
| EtwEventWriteTransfer | 0xd8e755c8 |
| EtwGetTraceEnableFlags | 0xdb510443 |
| EtwGetTraceEnableLevel | 0xdbadd7fc |
| EtwGetTraceLoggerHandle | 0xb0fbc0cb |
| EtwLogTraceEvent | 0x87b5dd48 |
| EtwNotificationRegister | 0x2b7c2861 |
| EtwNotificationUnregister | 0xd7f90316 |
| EtwProcessPrivateLoggerRequest | 0xd2d23b70 |
| EtwRegisterSecurityProvider | 0x4707e0ab |
| EtwRegisterTraceGuidsA | 0x34efb9fe |
| EtwRegisterTraceGuidsW | 0x34efba14 |
| EtwReplyNotification | 0x244be39d |
| EtwSendNotification | 0x981050bc |
| EtwSetMark | 0x91712a78 |
| EtwTraceEventInstance | 0xe109a143 |
| EtwTraceMessage | 0xad3fa9b0 |
| EtwTraceMessageVa | 0xfea6cdd5 |
| EtwUnregisterTraceGuids | 0x49b9a8de |
| EtwWriteUMSecurityEvent | 0xb0512516 |
| EtwpCreateEtwThread | 0x14121aee |
| EtwpGetCpuSpeed | 0x9892c968 |
| EvtIntReportAuthzEventAndSourceAsync | 0x8c377ab |
| EvtIntReportEventAndSourceAsync | 0xac46a3f7 |
| ExpInterlockedPopEntrySListEnd | 0xd32792c9 |
| ExpInterlockedPopEntrySListFault | 0x9e54f940 |
| ExpInterlockedPopEntrySListResume | 0xe2de4b98 |
| KiRaiseUserExceptionDispatcher | 0x4cf545d1 |
| KiUserApcDispatcher | 0x4c80cbf0 |
| KiUserCallbackDispatcher | 0x5fdf86f5 |
| KiUserExceptionDispatcher | 0x4788b40 |
| KiUserInvertedFunctionTable | 0x9b7ed158 |
| LdrAccessResource | 0x909e6777 |
| LdrAddDllDirectory | 0xbe11332c |
| LdrAddLoadAsDataTable | 0xdb0bf5e2 |
| LdrAddRefDll | 0xd222a225 |
| LdrAppxHandleIntegrityFailure | 0xffa86906 |
| LdrCallEnclave | 0x9c802335 |
| LdrControlFlowGuardEnforced | 0xbd3b60b2 |
| LdrCreateEnclave | 0x8d0aa447 |
| LdrDeleteEnclave | 0x96a72447 |
| LdrDisableThreadCalloutsForDll | 0xe05070ce |
| LdrEnumResources | 0x2e6f0841 |
| LdrEnumerateLoadedModules | 0xaddf5c32 |
| LdrFastFailInLoaderCallout | 0x8e37704b |
| LdrFindEntryForAddress | 0xaef9a611 |
| LdrFindResourceDirectory_U | 0x4f8174be |
| LdrFindResourceEx_U | 0xf40b8a1d |
| LdrFindResource_U | 0x7a3d05fc |
| LdrFlushAlternateResourceModules | 0x9682a710 |
| LdrGetDllDirectory | 0xbe1134af |
| LdrGetDllFullName | 0xaa55bd67 |
| LdrGetDllHandle | 0xdb6b792f |
| LdrGetDllHandleByMapping | 0x785ff370 |
| LdrGetDllHandleByName | 0x82937051 |
| LdrGetDllHandleEx | 0xade4c885 |
| LdrGetDllPath | 0xd2badb9e |
| LdrGetFailureData | 0xb5e75c73 |
| LdrGetFileNameFromLoadAsDataTable | 0x7d880d67 |
| LdrGetKnownDllSectionHandle | 0x3a05f47c |
| LdrGetProcedureAddress | 0x9bb0f3ea |
| LdrGetProcedureAddressEx | 0xc3cfb386 |
| LdrGetProcedureAddressForCaller | 0x2ac55a1d |
| LdrInitShimEngineDynamic | 0x370c16a4 |
| LdrInitializeEnclave | 0x8331bbb5 |
| LdrInitializeThunk | 0x250e14b5 |
| LdrIsModuleSxsRedirected | 0x5d1bb1d9 |
| LdrLoadAlternateResourceModule | 0x7634ab4 |
| LdrLoadAlternateResourceModuleEx | 0x8d2ad935 |
| LdrLoadDll | 0xe44d058f |
| LdrLoadEnclaveModule | 0x84d57e3 |
| LdrLockLoaderLock | 0xf4ccf80b |
| LdrOpenImageFileOptionsKey | 0x6620539 |
| LdrProcessInitializationComplete | 0x8d0d0235 |
| LdrProcessRelocationBlock | 0x1c434da |
| LdrProcessRelocationBlockEx | 0x10d3711f |
| LdrQueryImageFileExecutionOptions | 0x6f65bca3 |
| LdrQueryImageFileExecutionOptionsEx | 0x96f296d5 |
| LdrQueryImageFileKeyOption | 0x50adf3b8 |
| LdrQueryModuleServiceTags | 0xa7026293 |
| LdrQueryOptionalDelayLoadedAPI | 0x51b500f7 |
| LdrQueryProcessModuleInformation | 0xe4351e5d |
| LdrRegisterDllNotification | 0x37a49128 |
| LdrRemoveDllDirectory | 0x96d21bc4 |
| LdrRemoveLoadAsDataTable | 0x4f57e243 |
| LdrResFindResource | 0x8bc620c0 |
| LdrResFindResourceDirectory | 0x14842397 |
| LdrResGetRCConfig | 0xd820f952 |
| LdrResRelease | 0x44c6bb77 |
| LdrResSearchResource | 0x4e166503 |
| LdrResolveDelayLoadedAPI | 0xf2e030fc |
| LdrResolveDelayLoadsFromDll | 0xfc8197c4 |
| LdrRscIsTypeExist | 0x318fa7e4 |
| LdrSetAppCompatDllRedirectionCallback | 0xa8eccb56 |
| LdrSetDefaultDllDirectories | 0xbf92f194 |
| LdrSetDllDirectory | 0xbe1137af |
| LdrSetDllManifestProber | 0x12e588b3 |
| LdrSetImplicitPathOptions | 0xf413891f |
| LdrSetMUICacheType | 0x840fe18 |
| LdrShutdownProcess | 0x80a922ef |
| LdrShutdownThread | 0xeb66d084 |
| LdrStandardizeSystemPath | 0x34397e58 |
| LdrSystemDllInitBlock | 0xf2f2501a |
| LdrUnloadAlternateResourceModule | 0x80ae5936 |
| LdrUnloadAlternateResourceModuleEx | 0xb964e31a |
| LdrUnloadDll | 0xbe1b678 |
| LdrUnlockLoaderLock | 0x31727f4d |
| LdrUnregisterDllNotification | 0xe88cb8bc |
| LdrUpdatePackageSearchPath | 0xd661a325 |
| LdrVerifyImageMatchesChecksum | 0xacceb3d2 |
| LdrVerifyImageMatchesChecksumEx | 0x3acf53cb |
| LdrpResGetMappingSize | 0x84311188 |
| LdrpResGetResourceDirectory | 0xf36f4a55 |
| MD4Final | 0x6c964705 |
| MD4Init | 0xcb6645a7 |
| MD4Update | 0xb133e212 |
| MD5Final | 0x6e964705 |
| MD5Init | 0xcb7645a7 |
| MD5Update | 0xf133e212 |
| NlsAnsiCodePage | 0xe0c070d8 |
| NlsMbCodePageTag | 0xcac0afae |
| NlsMbOemCodePageTag | 0x9633a4e9 |
| NtAcceptConnectPort | 0x8f484dd0 |
| NtAccessCheck | 0xc5766715 |
| NtAccessCheckAndAuditAlarm | 0xffccf917 |
| NtAccessCheckByType | 0xfd198c2a |
| NtAccessCheckByTypeAndAuditAlarm | 0x6f134342 |
| NtAccessCheckByTypeResultList | 0x501e4ff0 |
| NtAccessCheckByTypeResultListAndAuditAlarm | 0x151ccacd |
| NtAccessCheckByTypeResultListAndAuditAlarmByHandle | 0xf3136d28 |
| NtAcquireProcessActivityReference | 0x9b02a0c9 |
| NtAddAtom | 0xe62affe |
| NtAddAtomEx | 0x8ac00151 |
| NtAddBootEntry | 0xea5a4f1 |
| NtAddDriverEntry | 0x9baa190b |
| NtAdjustGroupsToken | 0x9d682745 |
| NtAdjustPrivilegesToken | 0xaf56428e |
| NtAdjustTokenClaimsAndDeviceGroups | 0xdedaedbf |
| NtAlertResumeThread | 0xa021f332 |
| NtAlertThread | 0xc9cc8936 |
| NtAlertThreadByThreadId | 0xf65fc71 |
| NtAllocateLocallyUniqueId | 0x25d27426 |
| NtAllocateReserveObject | 0xf70a48b4 |
| NtAllocateUserPhysicalPages | 0x74998d16 |
| NtAllocateUuids | 0x174a8b85 |
| NtAllocateVirtualMemory | 0xf539d4f3 |
| NtAllocateVirtualMemoryEx | 0xe753d8ec |
| NtAlpcAcceptConnectPort | 0x153cba17 |
| NtAlpcCancelMessage | 0xba745684 |
| NtAlpcConnectPort | 0x4055cd5d |
| NtAlpcConnectPortEx | 0x57357e19 |
| NtAlpcCreatePort | 0x28112d7e |
| NtAlpcCreatePortSection | 0xd0f51e54 |
| NtAlpcCreateResourceReserve | 0x1fdb0665 |
| NtAlpcCreateSectionView | 0x65a0ce23 |
| NtAlpcCreateSecurityContext | 0x7685448f |
| NtAlpcDeletePortSection | 0xd0f5b81c |
| NtAlpcDeleteResourceReserve | 0xbc5b066e |
| NtAlpcDeleteSectionView | 0x65a167eb |
| NtAlpcDeleteSecurityContext | 0x13054499 |
| NtAlpcDisconnectPort | 0xb113b5b5 |
| NtAlpcImpersonateClientContainerOfPort | 0x49dba546 |
| NtAlpcImpersonateClientOfPort | 0x61ca18b6 |
| NtAlpcOpenSenderProcess | 0x1c2f11e1 |
| NtAlpcOpenSenderThread | 0x7842fffc |
| NtAlpcQueryInformation | 0xfc642556 |
| NtAlpcQueryInformationMessage | 0xf48c3c10 |
| NtAlpcRevokeSecurityContext | 0x3c3c4579 |
| NtAlpcSendWaitReceivePort | 0x289126b3 |
| NtAlpcSetInformation | 0xc40d7578 |
| NtApphelpCacheControl | 0xdaa000bf |
| NtAreMappedFilesTheSame | 0xd94603cd |
| NtAssignProcessToJobObject | 0x7d00cc6 |
| NtAssociateWaitCompletionPacket | 0xca49d420 |
| NtCallEnclave | 0x3d80229c |
| NtCallbackReturn | 0xb24b146d |
| NtCancelIoFile | 0xfc26d8cb |
| NtCancelIoFileEx | 0x9b633908 |
| NtCancelSynchronousIoFile | 0x8767520a |
| NtCancelTimer | 0x388ed249 |
| NtCancelTimer2 | 0x11da4959 |
| NtCancelWaitCompletionPacket | 0x3406140f |
| NtClearEvent | 0x51657175 |
| NtClose | 0x6c67cad9 |
| NtCloseObjectAuditAlarm | 0x7a7c28aa |
| NtCommitComplete | 0xc97bc6a6 |
| NtCommitEnlistment | 0x3e076850 |
| NtCommitRegistryTransaction | 0x1e8de9d |
| NtCommitTransaction | 0x9a90eafd |
| NtCompactKeys | 0x28817431 |
| NtCompareObjects | 0xb3233dbc |
| NtCompareSigningLevels | 0xeca9730 |
| NtCompareTokens | 0x58699b49 |
| NtCompleteConnectPort | 0x9b54bd2a |
| NtCompressKey | 0x6c8509bb |
| NtConnectPort | 0x28841c43 |
| NtContinue | 0xa3807d39 |
| NtConvertBetweenAuxiliaryCounterAndPerformanceCounter | 0xa82ac05c |
| NtCreateCrossVmEvent | 0xaab83a39 |
| NtCreateDebugObject | 0x1eba50a1 |
| NtCreateDirectoryObject | 0xd91d39c6 |
| NtCreateDirectoryObjectEx | 0x74e7247c |
| NtCreateEnclave | 0x8d083ecb |
| NtCreateEnlistment | 0x834b68ff |
| NtCreateEvent | 0xe9a74a5e |
| NtCreateEventPair | 0xa6182c06 |
| NtCreateFile | 0x574d8726 |
| NtCreateIRTimer | 0x5416ecb9 |
| NtCreateIoCompletion | 0x2da5c62a |
| NtCreateJobObject | 0xa705400f |
| NtCreateJobSet | 0x3e775e71 |
| NtCreateKey | 0xaba7fc3 |
| NtCreateKeyTransacted | 0x6b5a7d12 |
| NtCreateKeyedEvent | 0x6260a066 |
| NtCreateLowBoxToken | 0x6ffe3c45 |
| NtCreateMailslotFile | 0x364b82f0 |
| NtCreateMutant | 0x44e09791 |
| NtCreateNamedPipeFile | 0x535de36a |
| NtCreatePagingFile | 0x78694b88 |
| NtCreatePartition | 0xf17a571d |
| NtCreatePort | 0x57529ff5 |
| NtCreatePrivateNamespace | 0xb93bac96 |
| NtCreateProcess | 0x55c3ce7c |
| NtCreateProcessEx | 0xf39fa6f |
| NtCreateProfile | 0x55c55d8e |
| NtCreateProfileEx | 0x1576426f |
| NtCreateRegistryTransaction | 0x81fec745 |
| NtCreateResourceManager | 0x1320790a |
| NtCreateSection | 0xfb0c5df7 |
| NtCreateSectionEx | 0x3177e904 |
| NtCreateSemaphore | 0x8be47293 |
| NtCreateSymbolicLinkObject | 0x2f7e5f1a |
| NtCreateThread | 0x520fa5e1 |
| NtCreateThreadEx | 0x3e978e60 |
| NtCreateTimer | 0xea90e93c |
| NtCreateTimer2 | 0x521d27cf |
| NtCreateToken | 0xea93e138 |
| NtCreateTokenEx | 0x4f84ecc2 |
| NtCreateTransaction | 0x431100e6 |
| NtCreateTransactionManager | 0x219a3058 |
| NtCreateUserProcess | 0xa5cc9582 |
| NtCreateWaitCompletionPacket | 0x44bdb19f |
| NtCreateWaitablePort | 0xb460a32c |
| NtCreateWnfStateName | 0x8492ea15 |
| NtCreateWorkerFactory | 0xc69be46 |
| NtDebugActiveProcess | 0x768ea4b |
| NtDebugContinue | 0x178d64a6 |
| NtDelayExecution | 0x9521a8b6 |
| NtDeleteAtom | 0x574b46c7 |
| NtDeleteBootEntry | 0xa137761e |
| NtDeleteDriverEntry | 0xe2eecf55 |
| NtDeleteFile | 0x574d9a5f |
| NtDeleteKey | 0xd2ba805c |
| NtDeleteObjectAuditAlarm | 0x55154aca |
| NtDeletePrivateNamespace | 0x493badca |
| NtDeleteValueKey | 0xa7292e70 |
| NtDeleteWnfStateData | 0x84a123f1 |
| NtDeleteWnfStateName | 0x84a62315 |
| NtDeviceIoControlFile | 0x4a986a4c |
| NtDisableLastKnownGood | 0x5a24e803 |
| NtDisplayString | 0x63d535ba |
| NtDrawText | 0x49a5d9b1 |
| NtDuplicateObject | 0x1c59177f |
| NtDuplicateToken | 0x59394cc3 |
| NtEnableLastKnownGood | 0xc98449ba |
| NtEnumerateBootEntries | 0xde21ec72 |
| NtEnumerateDriverEntries | 0xe1d0909f |
| NtEnumerateKey | 0xadbaca01 |
| NtEnumerateSystemEnvironmentValuesEx | 0x94ffcb3c |
| NtEnumerateTransactionObject | 0xf52d70b6 |
| NtEnumerateValueKey | 0xf0df2f03 |
| NtExtendSection | 0x1e48d7f0 |
| NtFilterBootOption | 0x23c2b003 |
| NtFilterToken | 0x449ec8cd |
| NtFilterTokenEx | 0x7b233e2a |
| NtFindAtom | 0x226c9498 |
| NtFlushBuffersFile | 0x9aa20720 |
| NtFlushBuffersFileEx | 0x881c8b82 |
| NtFlushInstallUILanguage | 0xc6411d68 |
| NtFlushInstructionCache | 0xfe21c1ce |
| NtFlushKey | 0xf16f6f64 |
| NtFlushProcessWriteBuffers | 0x52e85d89 |
| NtFlushVirtualMemory | 0x100f089b |
| NtFlushWriteBuffer | 0x3b259dbd |
| NtFreeUserPhysicalPages | 0xf4321407 |
| NtFreeVirtualMemory | 0x7da8eced |
| NtFreezeRegistry | 0x68f193f6 |
| NtFreezeTransactions | 0x62801e47 |
| NtFsControlFile | 0xff7f180e |
| NtGetCachedSigningLevel | 0x16fe55e5 |
| NtGetCompleteWnfStateSubscription | 0xdfbeb3ca |
| NtGetContextThread | 0x2237db8e |
| NtGetCurrentProcessorNumber | 0xe6022f63 |
| NtGetCurrentProcessorNumberEx | 0x8bd98b0 |
| NtGetDevicePowerState | 0x15a04505 |
| NtGetMUIRegistryInfo | 0x7fa045fc |
| NtGetNextProcess | 0x766acc1c |
| NtGetNextThread | 0x5314ddce |
| NtGetNlsSectionPtr | 0xfb356954 |
| NtGetNotificationResourceManager | 0xb4fe384a |
| NtGetTickCount | 0xff8c3a38 |
| NtGetWriteWatch | 0x73fdc69a |
| NtImpersonateAnonymousToken | 0x5b6a560f |
| NtImpersonateClientOfPort | 0xc04cfda4 |
| NtImpersonateThread | 0x90d14a10 |
| NtInitializeEnclave | 0x2b71bb8f |
| NtInitializeNlsFiles | 0xbdb4aa0 |
| NtInitializeRegistry | 0x36106c64 |
| NtInitiatePowerAction | 0xae66ccb7 |
| NtIsProcessInJob | 0x4a10a21 |
| NtIsSystemResumeAutomatic | 0xfddeeb08 |
| NtIsUILanguageComitted | 0xa3c940c1 |
| NtListenPort | 0xf9e3b769 |
| NtLoadDriver | 0xb8305733 |
| NtLoadEnclaveData | 0x75e76d3e |
| NtLoadKey | 0xe4438acc |
| NtLoadKey2 | 0x887159ce |
| NtLoadKey3 | 0x887159cf |
| NtLoadKeyEx | 0xe2b3ca9 |
| NtLockFile | 0x8cdee861 |
| NtLockProductActivationKeys | 0x29441a58 |
| NtLockRegistryKey | 0x16847763 |
| NtLockVirtualMemory | 0x7daed479 |
| NtMakePermanentObject | 0x3cf70b4e |
| NtMakeTemporaryObject | 0x2eaf886f |
| NtManageHotPatch | 0xf5c631c4 |
| NtManagePartition | 0x8146597c |
| NtMapCMFModule | 0x89362802 |
| NtMapUserPhysicalPages | 0x657e4ad5 |
| NtMapUserPhysicalPagesScatter | 0xb83e33d2 |
| NtMapViewOfSection | 0x30c565b9 |
| NtMapViewOfSectionEx | 0x1596eddb |
| NtModifyBootEntry | 0x2301f872 |
| NtModifyDriverEntry | 0xcf81d5d |
| NtNotifyChangeDirectoryFile | 0x8d041d14 |
| NtNotifyChangeDirectoryFileEx | 0x10745b4c |
| NtNotifyChangeKey | 0x991cd3d7 |
| NtNotifyChangeMultipleKeys | 0x7a30ee1b |
| NtNotifyChangeSession | 0x3d54c41d |
| NtOpenDirectoryObject | 0x82da1a77 |
| NtOpenEnlistment | 0x61bbc154 |
| NtOpenEvent | 0x21d374ce |
| NtOpenEventPair | 0x4d0baec9 |
| NtOpenFile | 0xd10ee879 |
| NtOpenIoCompletion | 0xef0719a3 |
| NtOpenJobObject | 0x4df8c2d2 |
| NtOpenKey | 0xa6888acd |
| NtOpenKeyEx | 0x222b3fb2 |
| NtOpenKeyTransacted | 0x9784ec4a |
| NtOpenKeyTransactedEx | 0x13b13376 |
| NtOpenKeyedEvent | 0x40d0f8bb |
| NtOpenMutant | 0x4a65e578 |
| NtOpenObjectAuditAlarm | 0xfcb15fab |
| NtOpenPartition | 0x986dd9e0 |
| NtOpenPrivateNamespace | 0xf0d7c2ab |
| NtOpenProcess | 0x66d8b5d |
| NtOpenProcessToken | 0xbf861424 |
| NtOpenProcessTokenEx | 0x18509c16 |
| NtOpenRegistryTransaction | 0x8d096313 |
| NtOpenResourceManager | 0xbcdd59ba |
| NtOpenSection | 0xabb61ad8 |
| NtOpenSemaphore | 0x32d7f556 |
| NtOpenSession | 0xacb59ad8 |
| NtOpenSymbolicLinkObject | 0x9fd6b3f8 |
| NtOpenThread | 0x5794f3c8 |
| NtOpenThreadToken | 0x962862f5 |
| NtOpenThreadTokenEx | 0xa18bdf70 |
| NtOpenTimer | 0x22bd13ac |
| NtOpenTransaction | 0x111c0b82 |
| NtOpenTransactionManager | 0x91f28536 |
| NtPlugPlayControl | 0x2a3b7005 |
| NtPowerInformation | 0xf4b47897 |
| NtPrePrepareComplete | 0x53f872d |
| NtPrePrepareEnlistment | 0x4d09813f |
| NtPrepareComplete | 0x2b1bff04 |
| NtPrepareEnlistment | 0xbee8ddd6 |
| NtPrivilegeCheck | 0xe4cdbdb4 |
| NtPrivilegeObjectAuditAlarm | 0x2492f051 |
| NtPrivilegedServiceAuditAlarm | 0xbd0aaa2e |
| NtPropagationComplete | 0x3b9c9149 |
| NtPropagationFailed | 0x9e2cd63f |
| NtProtectVirtualMemory | 0xd3727f4 |
| NtPulseEvent | 0xb7671ab1 |
| NtQueryAttributesFile | 0xa032eb8f |
| NtQueryAuxiliaryCounterFrequency | 0x4a526084 |
| NtQueryBootEntryOrder | 0xf38c62b5 |
| NtQueryBootOptions | 0xf4342f9 |
| NtQueryDebugFilterState | 0xd0e0c9f6 |
| NtQueryDefaultLocale | 0xeddff001 |
| NtQueryDefaultUILanguage | 0x47be88c |
| NtQueryDirectoryFile | 0xfca1fe40 |
| NtQueryDirectoryFileEx | 0x87f90d0a |
| NtQueryDirectoryObject | 0x998810c6 |
| NtQueryDriverEntryOrder | 0x2e4b5975 |
| NtQueryEaFile | 0xeb87ba98 |
| NtQueryEvent | 0x9f673a79 |
| NtQueryFullAttributesFile | 0x8c17e3bf |
| NtQueryInformationAtom | 0x1f6ee195 |
| NtQueryInformationByName | 0xbdc5b282 |
| NtQueryInformationEnlistment | 0x35545481 |
| NtQueryInformationFile | 0x1f71352d |
| NtQueryInformationJobObject | 0xb495876b |
| NtQueryInformationPort | 0x1f764dfc |
| NtQueryInformationProcess | 0x2cc7328e |
| NtQueryInformationResourceManager | 0x16848ae1 |
| NtQueryInformationThread | 0xe0c7c101 |
| NtQueryInformationToken | 0xef09a211 |
| NtQueryInformationTransaction | 0x842e711c |
| NtQueryInformationTransactionManager | 0x2a85b20a |
| NtQueryInformationWorkerFactory | 0x822a974a |
| NtQueryInstallUILanguage | 0xc46133f0 |
| NtQueryIntervalProfile | 0xc09254e7 |
| NtQueryIoCompletion | 0xdba546ff |
| NtQueryKey | 0x1167efbf |
| NtQueryLicenseValue | 0x8e17c9bf |
| NtQueryMultipleValueKey | 0xb8a1944d |
| NtQueryMutant | 0xfcde9ae7 |
| NtQueryObject | 0xffa9a987 |
| NtQueryOpenSubKeys | 0x1848322a |
| NtQueryOpenSubKeysEx | 0x20c8b179 |
| NtQueryPerformanceCounter | 0x3db8de3c |
| NtQueryPortInformationProcess | 0xcfc60480 |
| NtQueryQuotaInformationFile | 0xf573fec3 |
| NtQuerySection | 0xfaccc8ce |
| NtQuerySecurityAttributesToken | 0x1242c5c5 |
| NtQuerySecurityObject | 0xbac2019a |
| NtQuerySecurityPolicy | 0xbd93119f |
| NtQuerySemaphore | 0x8d8fce92 |
| NtQuerySymbolicLinkObject | 0x9afe3f4f |
| NtQuerySystemEnvironmentValue | 0x9e1fbcda |
| NtQuerySystemEnvironmentValueEx | 0x7ef37390 |
| NtQuerySystemInformation | 0x42026b16 |
| NtQuerySystemInformationEx | 0x9ac6220 |
| NtQuerySystemTime | 0x5c3c43eb |
| NtQueryTimer | 0xa050d957 |
| NtQueryTimerResolution | 0x4f4dc46 |
| NtQueryValueKey | 0x6ba6894f |
| NtQueryVirtualMemory | 0x1177887d |
| NtQueryVolumeInformationFile | 0x95b09236 |
| NtQueryWnfStateData | 0x328d6bc7 |
| NtQueryWnfStateNameInformation | 0xd7172518 |
| NtQueueApcThread | 0xf31e12c6 |
| NtQueueApcThreadEx | 0x784b24e4 |
| NtRaiseException | 0xd79728d1 |
| NtRaiseHardError | 0x92e64f21 |
| NtReadFile | 0x86ee88f |
| NtReadFileScatter | 0xcfc3219f |
| NtReadOnlyEnlistment | 0x200d557d |
| NtReadRequestData | 0x710a5cf3 |
| NtReadVirtualMemory | 0x7db483eb |
| NtRecoverEnlistment | 0x89e7556 |
| NtRecoverResourceManager | 0xc02b1f22 |
| NtRecoverTransactionManager | 0x74a686dd |
| NtRegisterProtocolAddressInformation | 0xcc714c98 |
| NtRegisterThreadTerminatePort | 0xaafe22a |
| NtReleaseKeyedEvent | 0x9e7faee7 |
| NtReleaseMutant | 0x35c8ab53 |
| NtReleaseSemaphore | 0x95c56b07 |
| NtReleaseWorkerFactoryWorker | 0x1a155028 |
| NtRemoveIoCompletion | 0x2f7909ae |
| NtRemoveIoCompletionEx | 0xe426c1d5 |
| NtRemoveProcessDebug | 0xfef2e227 |
| NtRenameKey | 0x4a4a8e5d |
| NtRenameTransactionManager | 0xa20f0254 |
| NtReplaceKey | 0xf13e61b4 |
| NtReplacePartitionUnit | 0xf9d2f748 |
| NtReplyPort | 0xe1009ff8 |
| NtReplyWaitReceivePort | 0xa03f52ea |
| NtReplyWaitReceivePortEx | 0xfd4bb398 |
| NtReplyWaitReplyPort | 0x5c953c19 |
| NtRequestPort | 0x48bedf7b |
| NtRequestWaitReplyPort | 0x24858911 |
| NtResetEvent | 0x55674ae6 |
| NtResetWriteWatch | 0x344f677f |
| NtRestoreKey | 0xe2e61cf |
| NtResumeProcess | 0x3f7e477d |
| NtResumeThread | 0x595d79a9 |
| NtRevertContainerImpersonation | 0x707649f7 |
| NtRollbackComplete | 0x9dff1cb8 |
| NtRollbackEnlistment | 0x4b5fafa2 |
| NtRollbackRegistryTransaction | 0xad32048 |
| NtRollbackTransaction | 0x4599d53f |
| NtRollforwardTransactionManager | 0xe567ad8a |
| NtSaveKey | 0x89940ace |
| NtSaveKeyEx | 0x502b433e |
| NtSaveMergedKeys | 0xdd07b9e9 |
| NtSecureConnectPort | 0xa7da5df0 |
| NtSerializeBoot | 0x9ec8633c |
| NtSetBootEntryOrder | 0xe759f45b |
| NtSetBootOptions | 0x328f2a94 |
| NtSetCachedSigningLevel | 0x16fe56a5 |
| NtSetCachedSigningLevel2 | 0xdfcad4d4 |
| NtSetContextThread | 0x22383b8e |
| NtSetDebugFilterState | 0x72761c6 |
| NtSetDefaultHardErrorPort | 0xa78e8b2 |
| NtSetDefaultLocale | 0x1d7e5c8f |
| NtSetDefaultUILanguage | 0xcd4ee272 |
| NtSetDriverEntryOrder | 0x6491f144 |
| NtSetEaFile | 0x917b882a |
| NtSetEvent | 0x2c96d8e6 |
| NtSetEventBoostPriority | 0xba33b67 |
| NtSetHighEventPair | 0xe3c98c88 |
| NtSetHighWaitLowEventPair | 0x8e351cdb |
| NtSetIRTimer | 0x125109c5 |
| NtSetInformationDebugObject | 0x2d6966cb |
| NtSetInformationEnlistment | 0xd3c0e1b0 |
| NtSetInformationFile | 0x992369eb |
| NtSetInformationJobObject | 0x3188ebd5 |
| NtSetInformationKey | 0x34c92ed9 |
| NtSetInformationObject | 0x9f36bb38 |
| NtSetInformationProcess | 0x47266f67 |
| NtSetInformationResourceManager | 0x75c163fb |
| NtSetInformationSymbolicLink | 0x281be58 |
| NtSetInformationThread | 0xa99abae8 |
| NtSetInformationToken | 0x255039e1 |
| NtSetInformationTransaction | 0x51c01710 |
| NtSetInformationTransactionManager | 0x9712e1a8 |
| NtSetInformationVirtualMemory | 0xde01602 |
| NtSetInformationWorkerFactory | 0xc8c26680 |
| NtSetIntervalProfile | 0x3a4489a6 |
| NtSetIoCompletion | 0x45223a64 |
| NtSetIoCompletionEx | 0x88e99a2c |
| NtSetLdtEntries | 0x87d4ad32 |
| NtSetLowEventPair | 0x8b866fed |
| NtSetLowWaitHighEventPair | 0xf6828ef0 |
| NtSetQuotaInformationFile | 0x7267632d |
| NtSetSecurityObject | 0xae8f9340 |
| NtSetSystemEnvironmentValue | 0x6bb162ce |
| NtSetSystemEnvironmentValueEx | 0xc58b42c6 |
| NtSetSystemInformation | 0xad564fd |
| NtSetSystemPowerState | 0xf6c0c1ff |
| NtSetSystemTime | 0x3556a328 |
| NtSetThreadExecutionState | 0x55e45d47 |
| NtSetTimer | 0x2d8077c4 |
| NtSetTimer2 | 0xb00ef8b7 |
| NtSetTimerEx | 0x1df19ce |
| NtSetTimerResolution | 0x7ea71104 |
| NtSetUuidSeed | 0x33c437cf |
| NtSetValueKey | 0x3adccfe7 |
| NtSetVolumeInformationFile | 0x341d1f66 |
| NtSetWnfProcessNotificationEvent | 0x47a0bf42 |
| NtShutdownSystem | 0xea2add8d |
| NtShutdownWorkerFactory | 0xd4bd9762 |
| NtSignalAndWaitForSingleObject | 0xe9dc71f7 |
| NtSinglePhaseReject | 0x252a69dc |
| NtStartProfile | 0x5681483d |
| NtStopProfile | 0x67fa47f |
| NtSubscribeWnfStateChange | 0x4d6f044f |
| NtSuspendProcess | 0x7672c1b5 |
| NtSuspendThread | 0x1b151d7b |
| NtSystemDebugControl | 0x7399448f |
| NtTerminateEnclave | 0x32e2e48a |
| NtTerminateJobObject | 0x119c3aa7 |
| NtTerminateProcess | 0xfb9e743a |
| NtTerminateThread | 0x473e7b0f |
| NtTestAlert | 0xad8e79f9 |
| NtThawRegistry | 0x8077f906 |
| NtThawTransactions | 0xb38196ad |
| NtTraceControl | 0x10f05d29 |
| NtTraceEvent | 0xb7679755 |
| NtTranslateFilePath | 0xcce42357 |
| NtUmsThreadYield | 0x18a624d6 |
| NtUnloadDriver | 0xfb9c57d6 |
| NtUnloadKey | 0xe58a11a4 |
| NtUnloadKey2 | 0xb14234ce |
| NtUnloadKeyEx | 0x28469cae |
| NtUnlockFile | 0xb5afc361 |
| NtUnlockVirtualMemory | 0x990ed993 |
| NtUnmapViewOfSection | 0x1a065e2 |
| NtUnmapViewOfSectionEx | 0x8197911e |
| NtUnsubscribeWnfStateChange | 0xd4470595 |
| NtUpdateWnfStateData | 0x86cbe2f1 |
| NtVdmControl | 0xcdf6fdc5 |
| NtWaitForAlertByThreadId | 0xd11b2aa3 |
| NtWaitForDebugEvent | 0xf2b7ad8f |
| NtWaitForKeyedEvent | 0xecb88e43 |
| NtWaitForMultipleObjects | 0xe246e2a6 |
| NtWaitForMultipleObjects32 | 0x1b8aa21b |
| NtWaitForSingleObject | 0x981582ce |
| NtWaitForWorkViaWorkerFactory | 0xc926df18 |
| NtWaitHighEventPair | 0x206cfd8a |
| NtWaitLowEventPair | 0x956b8b75 |
| NtWorkerFactoryWorkerReady | 0xf37473f |
| NtWriteFile | 0x2fbb8c90 |
| NtWriteFileGather | 0xa03a9036 |
| NtWriteRequestData | 0xab6f7cfc |
| NtWriteVirtualMemory | 0x1234a8d5 |
| NtYieldExecution | 0xd1cb08e0 |
| NtdllDefWindowProc_A | 0xd17ab1b0 |
| NtdllDefWindowProc_W | 0xd17ab1c6 |
| NtdllDialogWndProc_A | 0xcc11c4ab |
| NtdllDialogWndProc_W | 0xcc11c4c1 |
| PfxFindPrefix | 0xdc3d5226 |
| PfxInitialize | 0xd314510 |
| PfxInsertPrefix | 0x4d9b0319 |
| PfxRemovePrefix | 0x91f64d35 |
| PssNtCaptureSnapshot | 0x5fcf87bb |
| PssNtDuplicateSnapshot | 0xd3168251 |
| PssNtFreeRemoteSnapshot | 0xaad0454b |
| PssNtFreeSnapshot | 0xae63eb6b |
| PssNtFreeWalkMarker | 0x33f8b22 |
| PssNtQuerySnapshot | 0x9fd49675 |
| PssNtValidateDescriptor | 0xd1a02f6a |
| PssNtWalkSnapshot | 0xb6a0d16b |
| RtlAbortRXact | 0xc906166e |
| RtlAbsoluteToSelfRelativeSD | 0x87787208 |
| RtlAcquirePebLock | 0x3aff1990 |
| RtlAcquirePrivilege | 0x100ab69b |
| RtlAcquireReleaseSRWLockExclusive | 0xfc3244dc |
| RtlAcquireResourceExclusive | 0x6d3b0c81 |
| RtlAcquireResourceShared | 0xcdb7f063 |
| RtlAcquireSRWLockExclusive | 0x82bd9688 |
| RtlAcquireSRWLockShared | 0xe1c61b68 |
| RtlActivateActivationContext | 0x5893703f |
| RtlActivateActivationContextEx | 0x4dc1067a |
| RtlActivateActivationContextUnsafeFast | 0xd37d06d2 |
| RtlAddAccessAllowedAce | 0x50be6d45 |
| RtlAddAccessAllowedAceEx | 0xf9b51e5a |
| RtlAddAccessAllowedObjectAce | 0x649aba10 |
| RtlAddAccessDeniedAce | 0x7564ee71 |
| RtlAddAccessDeniedAceEx | 0x93b9ceed |
| RtlAddAccessDeniedObjectAce | 0x6dc45a5b |
| RtlAddAccessFilterAce | 0xb6bf091 |
| RtlAddAce | 0x88736680 |
| RtlAddActionToRXact | 0x7d994527 |
| RtlAddAtomToAtomTable | 0x7fd7712c |
| RtlAddAttributeActionToRXact | 0xc06a9d81 |
| RtlAddAuditAccessAce | 0xf2e18eaa |
| RtlAddAuditAccessAceEx | 0x863ab4e3 |
| RtlAddAuditAccessObjectAce | 0xcd238269 |
| RtlAddCompoundAce | 0x24831cea |
| RtlAddFunctionTable | 0x94a50f17 |
| RtlAddGrowableFunctionTable | 0xf71ce719 |
| RtlAddIntegrityLabelToBoundaryDescriptor | 0xbfe3cedc |
| RtlAddMandatoryAce | 0x582728f9 |
| RtlAddProcessTrustLabelAce | 0x13213b5e |
| RtlAddRefActivationContext | 0x8fee7a44 |
| RtlAddRefMemoryStream | 0x2e23ede8 |
| RtlAddResourceAttributeAce | 0x3e1659e8 |
| RtlAddSIDToBoundaryDescriptor | 0x41a43d76 |
| RtlAddScopedPolicyIDAce | 0x56ed03af |
| RtlAddVectoredContinueHandler | 0x36a9d316 |
| RtlAddVectoredExceptionHandler | 0x8f6d1aeb |
| RtlAddressInSectionTable | 0x4de97ee6 |
| RtlAdjustPrivilege | 0x19d9e5ff |
| RtlAllocateActivationContextStack | 0x241d43c1 |
| RtlAllocateAndInitializeSid | 0xa391ca6e |
| RtlAllocateAndInitializeSidEx | 0x4729c3a6 |
| RtlAllocateHandle | 0xce671e27 |
| RtlAllocateHeap | 0x10b3a830 |
| RtlAllocateMemoryBlockLookaside | 0xbf179ffa |
| RtlAllocateMemoryZone | 0xafec5491 |
| RtlAllocateWnfSerializationGroup | 0x2dea24e7 |
| RtlAnsiCharToUnicodeChar | 0xe3698e38 |
| RtlAnsiStringToUnicodeSize | 0x99c3e79d |
| RtlAnsiStringToUnicodeString | 0x104a948e |
| RtlAppendAsciizToString | 0x1f2a474f |
| RtlAppendPathElement | 0xf995682 |
| RtlAppendStringToString | 0x36aad473 |
| RtlAppendUnicodeStringToString | 0xceeda6c |
| RtlAppendUnicodeToString | 0x82ac50 |
| RtlApplicationVerifierStop | 0x8623ed02 |
| RtlApplyRXact | 0x53062475 |
| RtlApplyRXactNoFlush | 0xfac90686 |
| RtlAppxIsFileOwnedByTrustedInstaller | 0x5f00a48f |
| RtlAreAllAccessesGranted | 0xade0f305 |
| RtlAreAnyAccessesGranted | 0xade35b05 |
| RtlAreBitsClear | 0xccbc9b66 |
| RtlAreBitsSet | 0xb5336e52 |
| RtlAreLongPathsEnabled | 0xce7dd0c7 |
| RtlAssert | 0x896b786f |
| RtlAvlInsertNodeEx | 0x9421d6f8 |
| RtlAvlRemoveNode | 0xff361f45 |
| RtlBarrier | 0x49656883 |
| RtlBarrierForDelete | 0xbb9855a6 |
| RtlCallEnclaveReturn | 0x50ebeb7f |
| RtlCancelTimer | 0x948ed2ef |
| RtlCanonicalizeDomainName | 0x78d41ee |
| RtlCapabilityCheck | 0x3332a1ba |
| RtlCapabilityCheckForSingleSessionSku | 0x80b5268b |
| RtlCaptureContext | 0xef507439 |
| RtlCaptureStackBackTrace | 0x5f3abc36 |
| RtlCharToInteger | 0x89096e79 |
| RtlCheckBootStatusIntegrity | 0xa112e6f2 |
| RtlCheckForOrphanedCriticalSections | 0x4ffc3285 |
| RtlCheckPortableOperatingSystem | 0xa4e94ec6 |
| RtlCheckRegistryKey | 0x6d20f650 |
| RtlCheckSandboxedToken | 0x6f7ecacb |
| RtlCheckSystemBootStatusIntegrity | 0x2552782c |
| RtlCheckTokenCapability | 0x1c24545a |
| RtlCheckTokenMembership | 0x62b912d9 |
| RtlCheckTokenMembershipEx | 0xe44b6ea2 |
| RtlCleanUpTEBLangLists | 0x97fbb9bf |
| RtlClearAllBits | 0x21fcd03 |
| RtlClearBit | 0xd1a103c7 |
| RtlClearBits | 0x3420796d |
| RtlClearThreadWorkOnBehalfTicket | 0x8f4e9b18 |
| RtlCloneMemoryStream | 0x43633009 |
| RtlCloneUserProcess | 0x55f41f5e |
| RtlCmDecodeMemIoResource | 0xd11e54a5 |
| RtlCmEncodeMemIoResource | 0xd63e54a5 |
| RtlCommitDebugInfo | 0x83807e15 |
| RtlCommitMemoryStream | 0xe6f3cb1 |
| RtlCompactHeap | 0x847ff1d4 |
| RtlCompareAltitudes | 0x62bf3633 |
| RtlCompareMemory | 0x49cd5d3f |
| RtlCompareMemoryUlong | 0x841b64e1 |
| RtlCompareString | 0x56bfc4ad |
| RtlCompareUnicodeString | 0xc0541893 |
| RtlCompareUnicodeStrings | 0xa8312eb |
| RtlCompleteProcessCloning | 0x9be60fe0 |
| RtlCompressBuffer | 0x74290954 |
| RtlComputeCrc32 | 0xb1b4bbc6 |
| RtlComputeImportTableHash | 0x3c9f3233 |
| RtlComputePrivatizedDllName_U | 0x121ffe0c |
| RtlConnectToSm | 0x84861902 |
| RtlConsoleMultiByteToUnicodeN | 0xb9aaca2a |
| RtlConstructCrossVmEventPath | 0x35ba4970 |
| RtlContractHashTable | 0xc55375a4 |
| RtlConvertDeviceFamilyInfoToString | 0x68c3c120 |
| RtlConvertExclusiveToShared | 0x3ce2fb4b |
| RtlConvertLCIDToString | 0xeee28e85 |
| RtlConvertSRWLockExclusiveToShared | 0x39e0b0b3 |
| RtlConvertSharedToExclusive | 0x67f45a14 |
| RtlConvertSidToUnicodeString | 0x178c57ad |
| RtlConvertToAutoInheritSecurityObject | 0xcd41aa38 |
| RtlCopyBitMap | 0x26841334 |
| RtlCopyContext | 0x1c35f7f9 |
| RtlCopyExtendedContext | 0x33b51154 |
| RtlCopyLuid | 0xa90ecfb8 |
| RtlCopyLuidAndAttributesArray | 0x9030f9c1 |
| RtlCopyMappedMemory | 0xaf88f2a3 |
| RtlCopyMemory | 0x3c411d5d |
| RtlCopyMemoryNonTemporal | 0xd11dc5d4 |
| RtlCopyMemoryStreamTo | 0x2b9f9ee1 |
| RtlCopyOutOfProcessMemoryStreamTo | 0x4fd76b84 |
| RtlCopySecurityDescriptor | 0xbb3a8a58 |
| RtlCopySid | 0xa54890f5 |
| RtlCopySidAndAttributesArray | 0x8421e0c6 |
| RtlCopyString | 0x493384cb |
| RtlCopyUnicodeString | 0x53f21983 |
| RtlCrc32 | 0xdc6a953f |
| RtlCrc64 | 0xdc6a95a1 |
| RtlCreateAcl | 0x34515776 |
| RtlCreateActivationContext | 0x4bcf165c |
| RtlCreateAndSetSD | 0xa1ccfd55 |
| RtlCreateAtomTable | 0x2c866c4c |
| RtlCreateBootStatusDataFile | 0x2b7bae6e |
| RtlCreateBoundaryDescriptor | 0x809edcf4 |
| RtlCreateEnvironment | 0xb68105cd |
| RtlCreateEnvironmentEx | 0x4173ff2 |
| RtlCreateHashTable | 0x228672b5 |
| RtlCreateHashTableEx | 0x19cadda2 |
| RtlCreateHeap | 0x8a2e75d6 |
| RtlCreateMemoryBlockLookaside | 0x8cbe1975 |
| RtlCreateMemoryZone | 0x4e4b07fb |
| RtlCreateProcessParameters | 0xc0475e75 |
| RtlCreateProcessParametersEx | 0x1d79e019 |
| RtlCreateProcessParametersWithTemplate | 0xaa6ef386 |
| RtlCreateProcessReflection | 0x7027b1b3 |
| RtlCreateQueryDebugBuffer | 0x11c4de3a |
| RtlCreateRegistryKey | 0xf96db3 |
| RtlCreateSecurityDescriptor | 0x3b44ed1 |
| RtlCreateServiceSid | 0xfaf0d783 |
| RtlCreateSystemVolumeInformationFolder | 0x65ec020b |
| RtlCreateTagHeap | 0x3338e5aa |
| RtlCreateTimer | 0x4690e9e3 |
| RtlCreateTimerQueue | 0xcbd944d8 |
| RtlCreateUmsCompletionList | 0x61bfcb69 |
| RtlCreateUmsThreadContext | 0x8393f925 |
| RtlCreateUnicodeString | 0x90d455a7 |
| RtlCreateUnicodeStringFromAsciiz | 0x200aaa7f |
| RtlCreateUserFiberShadowStack | 0x6c1fca47 |
| RtlCreateUserProcess | 0x3ccc95ac |
| RtlCreateUserProcessEx | 0x3256ba0b |
| RtlCreateUserSecurityObject | 0xf504e461 |
| RtlCreateUserStack | 0xb67ffb27 |
| RtlCreateUserThread | 0xd147ec1a |
| RtlCreateVirtualAccountSid | 0x47beefb5 |
| RtlCultureNameToLCID | 0x577bfe00 |
| RtlCustomCPToUnicodeN | 0x40cc9f3 |
| RtlCutoverTimeToSystemTime | 0x6948fb5f |
| RtlDeCommitDebugInfo | 0x56904640 |
| RtlDeNormalizeProcessParams | 0x4fdca699 |
| RtlDeactivateActivationContext | 0x993ebc7e |
| RtlDeactivateActivationContextUnsafeFast | 0x47a0980 |
| RtlDebugPrintTimes | 0xd4542847 |
| RtlDecodePointer | 0x58e5d22b |
| RtlDecodeRemotePointer | 0x56127195 |
| RtlDecodeSystemPointer | 0x702b02d5 |
| RtlDecompressBuffer | 0xcac187d5 |
| RtlDecompressBufferEx | 0x61f6043 |
| RtlDecompressFragment | 0x3c33317e |
| RtlDefaultNpAcl | 0xd0ba4afe |
| RtlDelete | 0x8e87f8a0 |
| RtlDeleteAce | 0xfc515808 |
| RtlDeleteAtomFromAtomTable | 0x4e92883f |
| RtlDeleteBarrier | 0xbd9a7627 |
| RtlDeleteBoundaryDescriptor | 0x80a3ab34 |
| RtlDeleteCriticalSection | 0x9be18ce2 |
| RtlDeleteElementGenericTable | 0xd9c0bd04 |
| RtlDeleteElementGenericTableAvl | 0x5e83800c |
| RtlDeleteElementGenericTableAvlEx | 0xe003a92 |
| RtlDeleteFunctionTable | 0x5ac6de8f |
| RtlDeleteGrowableFunctionTable | 0x18ec5ee0 |
| RtlDeleteHashTable | 0x948672db |
| RtlDeleteNoSplay | 0xd7a981b1 |
| RtlDeleteRegistryValue | 0xe8cbc708 |
| RtlDeleteResource | 0xb524f7fd |
| RtlDeleteSecurityObject | 0x9b77663 |
| RtlDeleteTimer | 0x46935103 |
| RtlDeleteTimerQueue | 0xbd949a7 |
| RtlDeleteTimerQueueEx | 0x6526a547 |
| RtlDeleteUmsCompletionList | 0x61bff1db |
| RtlDeleteUmsThreadContext | 0x1393fa59 |
| RtlDequeueUmsCompletionListItems | 0x7404b2aa |
| RtlDeregisterSecureMemoryCacheCallback | 0xc66ec77e |
| RtlDeregisterWait | 0x5c4419d8 |
| RtlDeregisterWaitEx | 0x10676a89 |
| RtlDeriveCapabilitySidsFromName | 0x730eb26e |
| RtlDestroyAtomTable | 0x712bb4d0 |
| RtlDestroyEnvironment | 0x4ba316e0 |
| RtlDestroyHandleTable | 0xb6076267 |
| RtlDestroyHeap | 0xdcd2b7f8 |
| RtlDestroyMemoryBlockLookaside | 0xcee06c19 |
| RtlDestroyMemoryZone | 0xe2f41883 |
| RtlDestroyProcessParameters | 0x658fe2ba |
| RtlDestroyQueryDebugBuffer | 0x36ef225c |
| RtlDetectHeapLeaks | 0xa3c64ee5 |
| RtlDetermineDosPathNameType_U | 0x691ae0dc |
| RtlDisableThreadProfiling | 0x4d435276 |
| RtlDllShutdownInProgress | 0x4f65d5b7 |
| RtlDnsHostNameToComputerName | 0x644a9c3 |
| RtlDoesFileExists_U | 0x850bfc0e |
| RtlDoesNameContainWildCards | 0xbed836a9 |
| RtlDosApplyFileIsolationRedirection_Ustr | 0x8432682f |
| RtlDosLongPathNameToNtPathName_U_WithStatus | 0xf07c82c0 |
| RtlDosLongPathNameToRelativeNtPathName_U_WithStatus | 0x729de037 |
| RtlDosPathNameToNtPathName_U | 0x2cdc9808 |
| RtlDosPathNameToNtPathName_U_WithStatus | 0xb3101a19 |
| RtlDosPathNameToRelativeNtPathName_U | 0x771a58ae |
| RtlDosPathNameToRelativeNtPathName_U_WithStatus | 0x63538fa |
| RtlDosSearchPath_U | 0xc23b34d |
| RtlDosSearchPath_Ustr | 0xd9a86103 |
| RtlDowncaseUnicodeChar | 0x10b08dc7 |
| RtlDowncaseUnicodeString | 0xe2ff8669 |
| RtlDrainNonVolatileFlush | 0xfc12e347 |
| RtlDumpResource | 0x110e7cde |
| RtlDuplicateUnicodeString | 0x896d39ba |
| RtlEmptyAtomTable | 0xa9a73632 |
| RtlEnableEarlyCriticalSectionEventCreation | 0xdcd3fdbe |
| RtlEnableThreadProfiling | 0x7a35a033 |
| RtlEnclaveCallDispatch | 0xc26b6fac |
| RtlEnclaveCallDispatchReturn | 0xdb26be99 |
| RtlEncodePointer | 0x6d65d22b |
| RtlEncodeRemotePointer | 0x5b327195 |
| RtlEncodeSystemPointer | 0x754b02d5 |
| RtlEndEnumerationHashTable | 0xa3e88c3 |
| RtlEndStrongEnumerationHashTable | 0xd8559185 |
| RtlEndWeakEnumerationHashTable | 0x7a49e64a |
| RtlEnterCriticalSection | 0xa31a8752 |
| RtlEnterUmsSchedulingMode | 0x808d57e8 |
| RtlEnumProcessHeaps | 0xfb789d2a |
| RtlEnumerateEntryHashTable | 0x8b605e6e |
| RtlEnumerateGenericTable | 0x654ac447 |
| RtlEnumerateGenericTableAvl | 0x6224c5d1 |
| RtlEnumerateGenericTableLikeADirectory | 0x6a394496 |
| RtlEnumerateGenericTableWithoutSplaying | 0xaa3b9a9f |
| RtlEnumerateGenericTableWithoutSplayingAvl | 0xcd50e849 |
| RtlEqualComputerName | 0x925b4bfe |
| RtlEqualDomainName | 0xa5f8f6af |
| RtlEqualLuid | 0x33c5aa2a |
| RtlEqualPrefixSid | 0x5f34e8bf |
| RtlEqualSid | 0x319e47c9 |
| RtlEqualString | 0x249d4af6 |
| RtlEqualUnicodeString | 0x2f404ada |
| RtlEqualWnfChangeStamps | 0xc3b8b94b |
| RtlEraseUnicodeString | 0x2f40af4c |
| RtlEthernetAddressToStringA | 0xb70cf65f |
| RtlEthernetAddressToStringW | 0xb70cf675 |
| RtlEthernetStringToAddressA | 0x4b57d98f |
| RtlEthernetStringToAddressW | 0x4b57d9a5 |
| RtlExecuteUmsThread | 0x3205dfdb |
| RtlExitUserProcess | 0xc13d5dae |
| RtlExitUserThread | 0xe56b725a |
| RtlExpandEnvironmentStrings | 0x5f7009d3 |
| RtlExpandEnvironmentStrings_U | 0xc02759b2 |
| RtlExpandHashTable | 0xd26e5341 |
| RtlExtendCorrelationVector | 0xb64f17cf |
| RtlExtendMemoryBlockLookaside | 0xd3370d65 |
| RtlExtendMemoryZone | 0x8b471999 |
| RtlExtractBitMap | 0x18ac92a2 |
| RtlFillMemory | 0xfc417739 |
| RtlFillMemoryNonTemporal | 0xbf7dc601 |
| RtlFillNonVolatileMemory | 0x489aa7fc |
| RtlFinalReleaseOutOfProcessMemoryStream | 0x401ab8da |
| RtlFindAceByType | 0x62036473 |
| RtlFindActivationContextSectionGuid | 0x591ddde3 |
| RtlFindActivationContextSectionString | 0x8f6c2f8b |
| RtlFindCharInUnicodeString | 0x470280a0 |
| RtlFindClearBits | 0x9f8a2749 |
| RtlFindClearBitsAndSet | 0xf0f5e2e6 |
| RtlFindClearRuns | 0x9f925689 |
| RtlFindClosestEncodableLength | 0xcd4acb36 |
| RtlFindExportedRoutineByName | 0xbcd5b007 |
| RtlFindLastBackwardRunClear | 0x8e9b940b |
| RtlFindLeastSignificantBit | 0x42d7adc0 |
| RtlFindLongestRunClear | 0x5b1c569c |
| RtlFindMessage | 0x8890a324 |
| RtlFindMostSignificantBit | 0x3e2ee76b |
| RtlFindNextForwardRunClear | 0x7a0852c3 |
| RtlFindSetBits | 0x88844d4 |
| RtlFindSetBitsAndClear | 0xd4ac76be |
| RtlFindUnicodeSubstring | 0x88d3dc25 |
| RtlFirstEntrySList | 0xdd6836ea |
| RtlFirstFreeAce | 0x4f365ce6 |
| RtlFlsAlloc | 0xeb9eac8e |
| RtlFlsFree | 0x5f5f8c77 |
| RtlFlsGetValue | 0xa4b83502 |
| RtlFlsSetValue | 0xa4b83562 |
| RtlFlushHeaps | 0xf06d423d |
| RtlFlushNonVolatileMemory | 0xb7285e62 |
| RtlFlushNonVolatileMemoryRanges | 0x5812c0ac |
| RtlFlushSecureMemoryCache | 0x7934fea8 |
| RtlFormatCurrentUserKeyPath | 0xf441b535 |
| RtlFormatMessage | 0xaac3c3d5 |
| RtlFormatMessageEx | 0xf0f5fc3 |
| RtlFreeActivationContextStack | 0xd921a75b |
| RtlFreeAnsiString | 0x41ecff6d |
| RtlFreeHandle | 0x3201d32c |
| RtlFreeHeap | 0x51cc8edd |
| RtlFreeMemoryBlockLookaside | 0xa5c4e113 |
| RtlFreeNonVolatileToken | 0x3dd2cbf8 |
| RtlFreeOemString | 0x881e5247 |
| RtlFreeSid | 0x6a8e90f6 |
| RtlFreeThreadActivationContextStack | 0x994dde3f |
| RtlFreeUnicodeString | 0x53f52e9b |
| RtlFreeUserFiberShadowStack | 0x852691e5 |
| RtlFreeUserStack | 0xc40f3759 |
| RtlGUIDFromString | 0x6369a34e |
| RtlGenerate8dot3Name | 0xdb7fb1bd |
| RtlGetAce | 0x948b6680 |
| RtlGetActiveActivationContext | 0xe513d4fe |
| RtlGetActiveConsoleId | 0x9cd53a81 |
| RtlGetAppContainerNamedObjectPath | 0x7175ab75 |
| RtlGetAppContainerParent | 0x9d1da1c2 |
| RtlGetAppContainerSidType | 0x72cbe439 |
| RtlGetCallersAddress | 0x3401fe33 |
| RtlGetCompressionWorkSpaceSize | 0x6f876743 |
| RtlGetConsoleSessionForegroundProcessId | 0xab2d4f7e |
| RtlGetControlSecurityDescriptor | 0x8d8251aa |
| RtlGetCriticalSectionRecursionCount | 0x7d178bc8 |
| RtlGetCurrentDirectory_U | 0x25cf0f6c |
| RtlGetCurrentPeb | 0xf576d38b |
| RtlGetCurrentProcessorNumber | 0xe60258fa |
| RtlGetCurrentProcessorNumberEx | 0x963f4b0 |
| RtlGetCurrentServiceSessionId | 0x2dcff709 |
| RtlGetCurrentTransaction | 0xff50e0d0 |
| RtlGetCurrentUmsThread | 0xec185aab |
| RtlGetDaclSecurityDescriptor | 0x7bc4b64f |
| RtlGetDeviceFamilyInfoEnum | 0xf5e505b1 |
| RtlGetElementGenericTable | 0xe838553e |
| RtlGetElementGenericTableAvl | 0x2aa08748 |
| RtlGetEnabledExtendedFeatures | 0x97d72047 |
| RtlGetExePath | 0x9232db9f |
| RtlGetExtendedContextLength | 0xd332fbb6 |
| RtlGetExtendedContextLength2 | 0x665f770c |
| RtlGetExtendedFeaturesMask | 0xdc53c5cf |
| RtlGetFileMUIPath | 0x7a34ddb8 |
| RtlGetFrame | 0x2df18057 |
| RtlGetFullPathName_U | 0x7cccaae |
| RtlGetFullPathName_UEx | 0x332ac137 |
| RtlGetFullPathName_UstrEx | 0x637b6aad |
| RtlGetFunctionTableListHead | 0xd2a51a93 |
| RtlGetGroupSecurityDescriptor | 0xa370414 |
| RtlGetIntegerAtom | 0x1cca5124 |
| RtlGetInterruptTimePrecise | 0x243c01e4 |
| RtlGetLastNtStatus | 0x1fbca832 |
| RtlGetLastWin32Error | 0x51b06898 |
| RtlGetLengthWithoutLastFullDosOrNtPathElement | 0x6a22cc24 |
| RtlGetLengthWithoutTrailingPathSeperators | 0x50a0630 |
| RtlGetLocaleFileMappingAddress | 0xc9cb16d |
| RtlGetLongestNtPathLength | 0x9b6ff65b |
| RtlGetMultiTimePrecise | 0x8977f498 |
| RtlGetNativeSystemInformation | 0x95ae66c1 |
| RtlGetNextEntryHashTable | 0xe203b40 |
| RtlGetNextUmsListItem | 0xa2112c35 |
| RtlGetNonVolatileToken | 0x91cd088a |
| RtlGetNtGlobalFlags | 0x8eafd5aa |
| RtlGetNtProductType | 0x7fa8f6d1 |
| RtlGetNtSystemRoot | 0x448d199b |
| RtlGetNtVersionNumbers | 0x24f36e61 |
| RtlGetOwnerSecurityDescriptor | 0x12390dfc |
| RtlGetParentLocaleName | 0xd069c8d7 |
| RtlGetPersistedStateLocation | 0x9bbb2540 |
| RtlGetProcessHeaps | 0x1f41cb4a |
| RtlGetProcessPreferredUILanguages | 0x1baf96a0 |
| RtlGetProductInfo | 0x990ab301 |
| RtlGetSaclSecurityDescriptor | 0x7bc4d44f |
| RtlGetSearchPath | 0xf10708e9 |
| RtlGetSecurityDescriptorRMControl | 0x4056854b |
| RtlGetSessionProperties | 0xbd89db39 |
| RtlGetSetBootStatusData | 0x3d9a1e77 |
| RtlGetSuiteMask | 0x139afefd |
| RtlGetSystemBootStatus | 0x4ac6744d |
| RtlGetSystemBootStatusEx | 0x19d13e43 |
| RtlGetSystemPreferredUILanguages | 0x387b52f9 |
| RtlGetSystemTimePrecise | 0x954d1795 |
| RtlGetThreadErrorMode | 0x72a1ccc5 |
| RtlGetThreadLangIdByIndex | 0x1c3e9ee2 |
| RtlGetThreadPreferredUILanguages | 0x476f8a69 |
| RtlGetThreadWorkOnBehalfTicket | 0x641daa9e |
| RtlGetTokenNamedObjectPath | 0x92beee11 |
| RtlGetUILanguageInfo | 0xa9d2b5c9 |
| RtlGetUmsCompletionListEvent | 0x876d2953 |
| RtlGetUnloadEventTrace | 0xb8ab19df |
| RtlGetUnloadEventTraceEx | 0xac6787fa |
| RtlGetUserInfoHeap | 0xca262785 |
| RtlGetUserPreferredUILanguages | 0xc559e614 |
| RtlGetVersion | 0xad147b09 |
| RtlGrowFunctionTable | 0x1b819a27 |
| RtlGuardCheckLongJumpTarget | 0xdeae9fa1 |
| RtlHashUnicodeString | 0x53f6aa21 |
| RtlHeapTrkInitialize | 0x30c8865b |
| RtlIdentifierAuthoritySid | 0x3888a89f |
| RtlIdnToAscii | 0x3e04a114 |
| RtlIdnToNameprepUnicode | 0x453eecaa |
| RtlIdnToUnicode | 0x8e175e2 |
| RtlImageDirectoryEntryToData | 0xcbdf3fc6 |
| RtlImageNtHeader | 0x5e96127c |
| RtlImageNtHeaderEx | 0x5849fa92 |
| RtlImageRvaToSection | 0xe91cab1a |
| RtlImageRvaToVa | 0x587c66cd |
| RtlImpersonateSelf | 0x6d896790 |
| RtlImpersonateSelfEx | 0x259e4ace |
| RtlIncrementCorrelationVector | 0x92178d0e |
| RtlInitAnsiString | 0x428ff73 |
| RtlInitAnsiStringEx | 0xa3fdd528 |
| RtlInitBarrier | 0xc08cde6e |
| RtlInitCodePageTable | 0xd65b945e |
| RtlInitEnumerationHashTable | 0x4130c10f |
| RtlInitMemoryStream | 0xac8b1796 |
| RtlInitNlsTables | 0x36f83c6d |
| RtlInitOutOfProcessMemoryStream | 0x4053f8d3 |
| RtlInitString | 0x9344392 |
| RtlInitStringEx | 0xd10e513c |
| RtlInitStrongEnumerationHashTable | 0xe6121f98 |
| RtlInitUnicodeString | 0x53f80fb9 |
| RtlInitUnicodeStringEx | 0xe03eee67 |
| RtlInitWeakEnumerationHashTable | 0xff0d556d |
| RtlInitializeAtomPackage | 0x51940464 |
| RtlInitializeBitMap | 0x97cb91d4 |
| RtlInitializeBitMapEx | 0x2e475b77 |
| RtlInitializeConditionVariable | 0x98c17b25 |
| RtlInitializeContext | 0x4525cc07 |
| RtlInitializeCorrelationVector | 0x5c636079 |
| RtlInitializeCriticalSection | 0x66450a0e |
| RtlInitializeCriticalSectionAndSpinCount | 0x29128970 |
| RtlInitializeCriticalSectionEx | 0x142842b1 |
| RtlInitializeExtendedContext | 0x23891f7d |
| RtlInitializeExtendedContext2 | 0x7123efd6 |
| RtlInitializeGenericTable | 0x33d452e1 |
| RtlInitializeGenericTableAvl | 0x2971ad16 |
| RtlInitializeHandleTable | 0x58b8a7c3 |
| RtlInitializeNtUserPfn | 0x552ca564 |
| RtlInitializeRXact | 0x25b5935e |
| RtlInitializeResource | 0x2e7167a3 |
| RtlInitializeSListHead | 0x5607fc7f |
| RtlInitializeSRWLock | 0x9a1f162 |
| RtlInitializeSid | 0xa2897384 |
| RtlInitializeSidEx | 0x25ce1ba2 |
| RtlInsertElementGenericTable | 0x5f0a7cec |
| RtlInsertElementGenericTableAvl | 0x3e7742b1 |
| RtlInsertElementGenericTableFull | 0xceead293 |
| RtlInsertElementGenericTableFullAvl | 0x694afaa1 |
| RtlInsertEntryHashTable | 0xf8279d81 |
| RtlInstallFunctionTableCallback | 0xc2729f80 |
| RtlInt64ToUnicodeString | 0xbcf8a92a |
| RtlIntegerToChar | 0xf7f2e4b3 |
| RtlIntegerToUnicodeString | 0x6d2fc360 |
| RtlInterlockedClearBitRun | 0x865069eb |
| RtlInterlockedFlushSList | 0x59343bef |
| RtlInterlockedPopEntrySList | 0x5d4ba680 |
| RtlInterlockedPushEntrySList | 0x97dd026e |
| RtlInterlockedPushListSList | 0x965be428 |
| RtlInterlockedPushListSListEx | 0x6f90ab71 |
| RtlInterlockedSetBitRun | 0x38ea481e |
| RtlIoDecodeMemIoResource | 0xd11e5506 |
| RtlIoEncodeMemIoResource | 0xd63e5506 |
| RtlIpv4AddressToStringA | 0x52bc8d64 |
| RtlIpv4AddressToStringExA | 0xf235b08b |
| RtlIpv4AddressToStringExW | 0xf235b0a1 |
| RtlIpv4AddressToStringW | 0x52bc8d7a |
| RtlIpv4StringToAddressA | 0xe7077093 |
| RtlIpv4StringToAddressExA | 0x1dc26edd |
| RtlIpv4StringToAddressExW | 0x1dc26ef3 |
| RtlIpv4StringToAddressW | 0xe70770a9 |
| RtlIpv6AddressToStringA | 0x52be8d64 |
| RtlIpv6AddressToStringExA | 0xfa35b08b |
| RtlIpv6AddressToStringExW | 0xfa35b0a1 |
| RtlIpv6AddressToStringW | 0x52be8d7a |
| RtlIpv6StringToAddressA | 0xe7097093 |
| RtlIpv6StringToAddressExA | 0x25c26edd |
| RtlIpv6StringToAddressExW | 0x25c26ef3 |
| RtlIpv6StringToAddressW | 0xe70970a9 |
| RtlIsActivationContextActive | 0x22f338f7 |
| RtlIsCapabilitySid | 0x4681d212 |
| RtlIsCloudFilesPlaceholder | 0x246ef6d5 |
| RtlIsCriticalSectionLocked | 0xed9d812a |
| RtlIsCriticalSectionLockedByThread | 0x8c3bcda0 |
| RtlIsCurrentProcess | 0xcce699d6 |
| RtlIsCurrentThread | 0x25c8bc3c |
| RtlIsCurrentThreadAttachExempt | 0x766fb26a |
| RtlIsDosDeviceName_U | 0x13b7f677 |
| RtlIsElevatedRid | 0xf927ec29 |
| RtlIsGenericTableEmpty | 0x574a22ed |
| RtlIsGenericTableEmptyAvl | 0x1177bed1 |
| RtlIsMultiSessionSku | 0x72a3cee6 |
| RtlIsMultiUsersInSessionSku | 0xbb493794 |
| RtlIsNameInExpression | 0x8141dc67 |
| RtlIsNameInUnUpcasedExpression | 0xc96c6d6f |
| RtlIsNameLegalDOS8Dot3 | 0x907e286d |
| RtlIsNonEmptyDirectoryReparsePointAllowed | 0x3454d8f6 |
| RtlIsNormalizedString | 0x694de16f |
| RtlIsPackageSid | 0x6efa5326 |
| RtlIsParentOfChildAppContainer | 0xcd6baf12 |
| RtlIsPartialPlaceholder | 0xb4ef9e02 |
| RtlIsPartialPlaceholderFileHandle | 0x4e5c9e1d |
| RtlIsPartialPlaceholderFileInfo | 0xe144a2f |
| RtlIsProcessorFeaturePresent | 0x5c6de284 |
| RtlIsStateSeparationEnabled | 0xbffc0318 |
| RtlIsTextUnicode | 0xeda31277 |
| RtlIsThreadWithinLoaderCallout | 0xa3a8d64c |
| RtlIsUntrustedObject | 0xfd062663 |
| RtlIsValidHandle | 0x612fdb23 |
| RtlIsValidIndexHandle | 0x131093a6 |
| RtlIsValidLocaleName | 0xf25f32a9 |
| RtlIsValidProcessTrustLabelSid | 0x157fc545 |
| RtlKnownExceptionFilter | 0xbd86bac3 |
| RtlLCIDToCultureName | 0x80e1ccbb |
| RtlLargeIntegerToChar | 0xb1d4e6c1 |
| RtlLcidToLocaleName | 0xe12cfdcf |
| RtlLeaveCriticalSection | 0xfccb1f55 |
| RtlLengthRequiredSid | 0x7da7b2c7 |
| RtlLengthSecurityDescriptor | 0xff92131 |
| RtlLengthSid | 0x805328c8 |
| RtlLengthSidAsUnicodeString | 0xf71d98f |
| RtlLoadString | 0x934a44e |
| RtlLocalTimeToSystemTime | 0x67ff26d4 |
| RtlLocaleNameToLcid | 0x8da43a93 |
| RtlLocateExtendedFeature | 0xdfd5e207 |
| RtlLocateExtendedFeature2 | 0xfabc412d |
| RtlLocateLegacyContext | 0xd78afb93 |
| RtlLockBootStatusData | 0xd4a0a2ad |
| RtlLockCurrentThread | 0xf8e0dad6 |
| RtlLockHeap | 0x8e2c8f0c |
| RtlLockMemoryBlockLookaside | 0xa5f41d73 |
| RtlLockMemoryStreamRegion | 0x31a7fe41 |
| RtlLockMemoryZone | 0xcf4a8e48 |
| RtlLockModuleSection | 0x775a5351 |
| RtlLogStackBackTrace | 0xeb63c87e |
| RtlLookupAtomInAtomTable | 0x13aa88ca |
| RtlLookupElementGenericTable | 0x6211891a |
| RtlLookupElementGenericTableAvl | 0xc48e4434 |
| RtlLookupElementGenericTableFull | 0x91cb0304 |
| RtlLookupElementGenericTableFullAvl | 0x81835c11 |
| RtlLookupEntryHashTable | 0x7badb483 |
| RtlLookupFirstMatchingElementGenericTableAvl | 0x4aec5d2e |
| RtlLookupFunctionEntry | 0x7b20d7b9 |
| RtlLookupFunctionTable | 0x7c0a0ee5 |
| RtlMakeSelfRelativeSD | 0x7073be65 |
| RtlMapGenericMask | 0xa1d6dfb0 |
| RtlMapSecurityErrorToNtStatus | 0x60f816f2 |
| RtlMoveMemory | 0x3c425d88 |
| RtlMultiAppendUnicodeStringBuffer | 0x494ddf71 |
| RtlMultiByteToUnicodeN | 0x671874f5 |
| RtlMultiByteToUnicodeSize | 0x3a7ee731 |
| RtlMultipleAllocateHeap | 0x2c06688 |
| RtlMultipleFreeHeap | 0x1db20dfe |
| RtlNewInstanceSecurityObject | 0x95910378 |
| RtlNewSecurityGrantedAccess | 0x3c94f4c6 |
| RtlNewSecurityObject | 0x458a942a |
| RtlNewSecurityObjectEx | 0x2a50b22e |
| RtlNewSecurityObjectWithMultipleInheritance | 0x319cf0fb |
| RtlNormalizeProcessParams | 0xb75e6542 |
| RtlNormalizeString | 0x50441376 |
| RtlNtPathNameToDosPathName | 0xbc0c78ea |
| RtlNtStatusToDosError | 0xe11882b3 |
| RtlNtStatusToDosErrorNoTeb | 0x6cdb0e07 |
| RtlNtdllName | 0x9c663bf |
| RtlNumberGenericTableElements | 0x9dc98641 |
| RtlNumberGenericTableElementsAvl | 0xc321e210 |
| RtlNumberOfClearBits | 0x715d7da2 |
| RtlNumberOfClearBitsInRange | 0xac3e326b |
| RtlNumberOfSetBits | 0x9ebcb9a9 |
| RtlNumberOfSetBitsInRange | 0x173812a5 |
| RtlNumberOfSetBitsUlongPtr | 0xa1ce7b54 |
| RtlOemStringToUnicodeSize | 0x380e68b5 |
| RtlOemStringToUnicodeString | 0x3a4ef307 |
| RtlOemToUnicodeN | 0x7caabc8f |
| RtlOpenCurrentUser | 0xb63ee362 |
| RtlOsDeploymentState | 0x8309cd25 |
| RtlOwnerAcesPresent | 0xcb8a8184 |
| RtlPcToFileHeader | 0x329d0532 |
| RtlPinAtomInAtomTable | 0x8190a12c |
| RtlPopFrame | 0xa5f180a1 |
| RtlPrefixString | 0x974fd0fc |
| RtlPrefixUnicodeString | 0xc4d47b0d |
| RtlPrepareForProcessCloning | 0x3bc8b081 |
| RtlProcessFlsData | 0xb8c26532 |
| RtlProtectHeap | 0x84b453f5 |
| RtlPublishWnfStateData | 0x2abed03e |
| RtlPushFrame | 0xbf7865ca |
| RtlQueryActivationContextApplicationSettings | 0x7fe89bbc |
| RtlQueryAtomInAtomTable | 0x284f62bb |
| RtlQueryCriticalSectionOwner | 0xb6a7d490 |
| RtlQueryDepthSList | 0x6afc10a2 |
| RtlQueryDynamicTimeZoneInformation | 0xc347d1af |
| RtlQueryElevationFlags | 0xe80582ff |
| RtlQueryEnvironmentVariable | 0xd3c3c4c7 |
| RtlQueryEnvironmentVariable_U | 0xf132b84 |
| RtlQueryHeapInformation | 0xaa9259e |
| RtlQueryImageMitigationPolicy | 0x95ccf31e |
| RtlQueryInformationAcl | 0x40fc1b42 |
| RtlQueryInformationActivationContext | 0x7680095f |
| RtlQueryInformationActiveActivationContext | 0xac1f20a9 |
| RtlQueryInterfaceMemoryStream | 0xdafccecb |
| RtlQueryModuleInformation | 0x12a1759 |
| RtlQueryPackageClaims | 0xb9a44137 |
| RtlQueryPackageIdentity | 0x9958460d |
| RtlQueryPackageIdentityEx | 0x61183f7d |
| RtlQueryPerformanceCounter | 0xa378de46 |
| RtlQueryPerformanceFrequency | 0xe9891a7a |
| RtlQueryProcessBackTraceInformation | 0xad107b3b |
| RtlQueryProcessDebugInformation | 0x331eeb73 |
| RtlQueryProcessHeapInformation | 0xcbeee55f |
| RtlQueryProcessLockInformation | 0xe96ee673 |
| RtlQueryProcessPlaceholderCompatibilityMode | 0xe914858e |
| RtlQueryProtectedPolicy | 0x33f3d3f0 |
| RtlQueryRegistryValueWithFallback | 0xa48abd1d |
| RtlQueryRegistryValues | 0xca841323 |
| RtlQueryRegistryValuesEx | 0x104c9842 |
| RtlQueryResourcePolicy | 0xc57c206c |
| RtlQuerySecurityObject | 0xbac2a7f6 |
| RtlQueryTagHeap | 0xb2f6cbdc |
| RtlQueryThreadPlaceholderCompatibilityMode | 0x7ed07e97 |
| RtlQueryThreadProfiling | 0x4803d295 |
| RtlQueryTimeZoneInformation | 0x40342dfd |
| RtlQueryTokenHostIdAsUlong64 | 0x28e44121 |
| RtlQueryUmsThreadInformation | 0xbaf78fcd |
| RtlQueryUnbiasedInterruptTime | 0x1e184d03 |
| RtlQueryValidationRunlevel | 0x1540615e |
| RtlQueryWnfMetaNotification | 0x1de5337c |
| RtlQueryWnfStateData | 0xc98d6bf0 |
| RtlQueryWnfStateDataWithExplicitScope | 0x39a4ce1a |
| RtlQueueApcWow64Thread | 0x34ae6682 |
| RtlQueueWorkItem | 0xf6fc12be |
| RtlRaiseCustomSystemEventTrigger | 0x931a7047 |
| RtlRaiseException | 0xd7ea56d1 |
| RtlRaiseStatus | 0x64c6ec70 |
| RtlRandom | 0xaa48f408 |
| RtlRandomEx | 0x23d02bc1 |
| RtlRbInsertNodeEx | 0xe9c0216f |
| RtlRbRemoveNode | 0x9d0b86d8 |
| RtlReAllocateHeap | 0xa1094e6b |
| RtlReadMemoryStream | 0xac8b5d45 |
| RtlReadOutOfProcessMemoryStream | 0x3053fd2e |
| RtlReadThreadProfilingData | 0x724750b7 |
| RtlRealPredecessor | 0x5e9177dc |
| RtlRealSuccessor | 0xe09fdef0 |
| RtlRegisterForWnfMetaNotification | 0x422eb97a |
| RtlRegisterSecureMemoryCacheCallback | 0x1b22883e |
| RtlRegisterThreadWithCsrss | 0x3ada27c1 |
| RtlRegisterWait | 0xbbee73b8 |
| RtlReleaseActivationContext | 0x7f078ba8 |
| RtlReleaseMemoryStream | 0xbaac9fdf |
| RtlReleasePath | 0xa3cea2d4 |
| RtlReleasePebLock | 0x583e1ab2 |
| RtlReleasePrivilege | 0xc0f3f10 |
| RtlReleaseRelativeName | 0x22a6364 |
| RtlReleaseResource | 0x2bf691c0 |
| RtlReleaseSRWLockExclusive | 0x62e1da30 |
| RtlReleaseSRWLockShared | 0x6915dbb1 |
| RtlRemoteCall | 0xa2dba76 |
| RtlRemoveEntryHashTable | 0x5371b9c6 |
| RtlRemovePrivileges | 0xdc81489b |
| RtlRemoveVectoredContinueHandler | 0xb689cba2 |
| RtlRemoveVectoredExceptionHandler | 0x8b6c2c7b |
| RtlReplaceSidInSd | 0x227884ac |
| RtlReplaceSystemDirectoryInPath | 0xc9d7981 |
| RtlReportException | 0xd549f078 |
| RtlReportExceptionEx | 0x27c1ec6d |
| RtlReportSilentProcessExit | 0x56eed4db |
| RtlReportSqmEscalation | 0xdd9d0963 |
| RtlResetMemoryBlockLookaside | 0x8cbd4b8a |
| RtlResetMemoryZone | 0x1ad047fb |
| RtlResetNtUserPfn | 0xb802da8e |
| RtlResetRtlTranslations | 0x58290040 |
| RtlRestoreBootStatusDefaults | 0xf6a3c3e2 |
| RtlRestoreContext | 0x30cfb458 |
| RtlRestoreLastWin32Error | 0xd186aa01 |
| RtlRestoreSystemBootStatusDefaults | 0xde668dd0 |
| RtlRetrieveNtUserPfn | 0xcec484f9 |
| RtlRevertMemoryStream | 0x104582c3 |
| RtlRunDecodeUnicodeString | 0xe8edc1b8 |
| RtlRunEncodeUnicodeString | 0xee0dc1b8 |
| RtlRunOnceBeginInitialize | 0x1e6b29e4 |
| RtlRunOnceComplete | 0xb533df8a |
| RtlRunOnceExecuteOnce | 0x4cd536f9 |
| RtlRunOnceInitialize | 0xc93b095a |
| RtlSecondsSince1970ToTime | 0x621966e6 |
| RtlSecondsSince1980ToTime | 0x621966ee |
| RtlSeekMemoryStream | 0x1c8b654e |
| RtlSelfRelativeToAbsoluteSD | 0xabe6ff6c |
| RtlSelfRelativeToAbsoluteSD2 | 0x7cdfedc7 |
| RtlSendMsgToSm | 0xa3f4d8ac |
| RtlSetAllBits | 0x7a9d7ba9 |
| RtlSetAttributesSecurityDescriptor | 0x3871dbb9 |
| RtlSetBit | 0xac8b6b4f |
| RtlSetBits | 0x916d6a68 |
| RtlSetControlSecurityDescriptor | 0x8d8257aa |
| RtlSetCriticalSectionSpinCount | 0xc622fbab |
| RtlSetCurrentDirectory_U | 0x25cf102c |
| RtlSetCurrentEnvironment | 0xdbc0e64e |
| RtlSetCurrentTransaction | 0xff50e190 |
| RtlSetDaclSecurityDescriptor | 0x87c4b64f |
| RtlSetDynamicTimeZoneInformation | 0xfbf4a066 |
| RtlSetEnvironmentStrings | 0x33d6ff98 |
| RtlSetEnvironmentVar | 0xba45cda |
| RtlSetEnvironmentVariable | 0xbad95e9e |
| RtlSetExtendedFeaturesMask | 0xdc56c5cf |
| RtlSetGroupSecurityDescriptor | 0x8a370415 |
| RtlSetHeapInformation | 0x6446940f |
| RtlSetImageMitigationPolicy | 0xec344eba |
| RtlSetInformationAcl | 0xcbc906b5 |
| RtlSetIoCompletionCallback | 0xa6ecf74b |
| RtlSetLastWin32Error | 0x51bc6898 |
| RtlSetLastWin32ErrorAndNtStatusFromNtStatus | 0x21f384de |
| RtlSetMemoryStreamSize | 0x8d0138e7 |
| RtlSetOwnerSecurityDescriptor | 0x92390dfd |
| RtlSetPortableOperatingSystem | 0x51c7c754 |
| RtlSetProcessDebugInformation | 0xd08d5ccc |
| RtlSetProcessIsCritical | 0x7b4c939 |
| RtlSetProcessPlaceholderCompatibilityMode | 0x82eb6ca4 |
| RtlSetProcessPreferredUILanguages | 0x1bc796a0 |
| RtlSetProtectedPolicy | 0x8d914261 |
| RtlSetProxiedProcessId | 0x9bc3720d |
| RtlSetSaclSecurityDescriptor | 0x87c4d44f |
| RtlSetSearchPathMode | 0x8ed35955 |
| RtlSetSecurityDescriptorRMControl | 0x406e854b |
| RtlSetSecurityObject | 0x458f936a |
| RtlSetSecurityObjectEx | 0x3e4db22e |
| RtlSetSystemBootStatus | 0x7ac6744d |
| RtlSetSystemBootStatusEx | 0x19d13f03 |
| RtlSetThreadErrorMode | 0x7421ccc5 |
| RtlSetThreadIsCritical | 0x34a71423 |
| RtlSetThreadPlaceholderCompatibilityMode | 0x2b9f35d0 |
| RtlSetThreadPoolStartFunc | 0x17dfa675 |
| RtlSetThreadPreferredUILanguages | 0x47704a69 |
| RtlSetThreadSubProcessTag | 0xb0ae3fb1 |
| RtlSetThreadWorkOnBehalfTicket | 0x641daace |
| RtlSetTimeZoneInformation | 0x2749c7d4 |
| RtlSetTimer | 0x2ecd2fc4 |
| RtlSetUmsThreadInformation | 0x9daacaaa |
| RtlSetUnhandledExceptionFilter | 0x2c6ec97e |
| RtlSetUserFlagsHeap | 0xf766dc37 |
| RtlSetUserValueHeap | 0xd286ebe2 |
| RtlSidDominates | 0x4433a16 |
| RtlSidDominatesForTrust | 0xecb4fb24 |
| RtlSidEqualLevel | 0x831027aa |
| RtlSidHashInitialize | 0x147a6cc |
| RtlSidHashLookup | 0x5454da0 |
| RtlSidIsHigherLevel | 0x4a90a274 |
| RtlSizeHeap | 0x3bcc8f43 |
| RtlSleepConditionVariableCS | 0xda9fce6c |
| RtlSleepConditionVariableSRW | 0x53fa0dd2 |
| RtlSplay | 0xdd69bf46 |
| RtlStartRXact | 0xc90867fe |
| RtlStatMemoryStream | 0xac8b6906 |
| RtlStringFromGUID | 0xdffcc25e |
| RtlStringFromGUIDEx | 0xf3098497 |
| RtlStronglyEnumerateEntryHashTable | 0x9977c260 |
| RtlSubAuthorityCountSid | 0x3c68897b |
| RtlSubAuthoritySid | 0xa6983ac9 |
| RtlSubscribeWnfStateChangeNotification | 0xd0498ede |
| RtlSubtreePredecessor | 0x4b3235d2 |
| RtlSubtreeSuccessor | 0x5e1b0720 |
| RtlSwitchedVVI | 0xddeb06e |
| RtlSystemTimeToLocalTime | 0xea603cdd |
| RtlTestAndPublishWnfStateData | 0x13790995 |
| RtlTestBit | 0xd175cd09 |
| RtlTestBitEx | 0xd734305d |
| RtlTestProtectedAccess | 0x111b5a77 |
| RtlTimeFieldsToTime | 0x3abb7c64 |
| RtlTimeToElapsedTimeFields | 0xcc7d7baa |
| RtlTimeToSecondsSince1970 | 0xe9b58249 |
| RtlTimeToSecondsSince1980 | 0xe9b58269 |
| RtlTimeToTimeFields | 0xa579e496 |
| RtlTraceDatabaseAdd | 0x3eee54f |
| RtlTraceDatabaseCreate | 0x778994dc |
| RtlTraceDatabaseDestroy | 0x181c1548 |
| RtlTraceDatabaseEnumerate | 0xe186508d |
| RtlTraceDatabaseFind | 0x7ddf3f84 |
| RtlTraceDatabaseLock | 0x7de2562b |
| RtlTraceDatabaseUnlock | 0x9b4d4ac2 |
| RtlTraceDatabaseValidate | 0xf4cb7156 |
| RtlTryAcquirePebLock | 0x18810cfb |
| RtlTryAcquireSRWLockExclusive | 0xc12af238 |
| RtlTryAcquireSRWLockShared | 0x99269843 |
| RtlTryConvertSRWLockSharedToExclusiveOrRelease | 0x8ebbfb4 |
| RtlTryEnterCriticalSection | 0x5a7b042d |
| RtlUTF8ToUnicodeN | 0xbca9ca61 |
| RtlUdiv128 | 0xed681ee |
| RtlUmsThreadYield | 0x18f952d6 |
| RtlUnhandledExceptionFilter | 0x3c3537c |
| RtlUnhandledExceptionFilter2 | 0x786a6fb2 |
| RtlUnicodeStringToAnsiSize | 0x35bffd82 |
| RtlUnicodeStringToAnsiString | 0xa226fe |
| RtlUnicodeStringToCountedOemString | 0xde571e5 |
| RtlUnicodeStringToInteger | 0xe9bc4f62 |
| RtlUnicodeStringToOemSize | 0x574359f7 |
| RtlUnicodeStringToOemString | 0xe13fb84 |
| RtlUnicodeToCustomCPN | 0xde172413 |
| RtlUnicodeToMultiByteN | 0xb4515571 |
| RtlUnicodeToMultiByteSize | 0xaabd0dcd |
| RtlUnicodeToOemN | 0x77cca205 |
| RtlUnicodeToUTF8N | 0xf9eb223c |
| RtlUniform | 0x22cf8223 |
| RtlUnlockBootStatusData | 0x60b60c3e |
| RtlUnlockCurrentThread | 0x7d418623 |
| RtlUnlockHeap | 0xe890b211 |
| RtlUnlockMemoryBlockLookaside | 0xc8f977d7 |
| RtlUnlockMemoryStreamRegion | 0xcab0bf97 |
| RtlUnlockMemoryZone | 0x25e3970a |
| RtlUnlockModuleSection | 0xfbbafe9d |
| RtlUnsubscribeWnfNotificationWaitForCompletion | 0x37632e8 |
| RtlUnsubscribeWnfNotificationWithCompletionCallback | 0x248e99bc |
| RtlUnsubscribeWnfStateChangeNotification | 0x25b118c |
| RtlUnwind | 0xb11d87df |
| RtlUnwindEx | 0x761f87dc |
| RtlUpcaseUnicodeChar | 0xd02df27a |
| RtlUpcaseUnicodeString | 0xd8925567 |
| RtlUpcaseUnicodeStringToAnsiString | 0x96c86930 |
| RtlUpcaseUnicodeStringToCountedOemString | 0xb36f0271 |
| RtlUpcaseUnicodeStringToOemString | 0xa2c52d95 |
| RtlUpcaseUnicodeToCustomCPN | 0x30dbec5a |
| RtlUpcaseUnicodeToMultiByteN | 0xcea5e3c |
| RtlUpcaseUnicodeToOemN | 0xda30c52e |
| RtlUpdateClonedCriticalSection | 0x8e15ee38 |
| RtlUpdateClonedSRWLock | 0x33c9c246 |
| RtlUpdateTimer | 0x46d8a8e3 |
| RtlUpperChar | 0xfc21052e |
| RtlUpperString | 0xa4dd2617 |
| RtlUserFiberStart | 0x8e127a8f |
| RtlUserThreadStart | 0xa2807e21 |
| RtlValidAcl | 0x2019ff95 |
| RtlValidProcessProtection | 0x625186b8 |
| RtlValidRelativeSecurityDescriptor | 0x34412ccd |
| RtlValidSecurityDescriptor | 0x48f5462f |
| RtlValidSid | 0x201a484d |
| RtlValidateCorrelationVector | 0xf020e3a0 |
| RtlValidateHeap | 0x1b07a238 |
| RtlValidateProcessHeaps | 0xb68c00d3 |
| RtlValidateUnicodeString | 0xb66087c2 |
| RtlVerifyVersionInfo | 0xa0c4a065 |
| RtlVirtualUnwind | 0x4776d825 |
| RtlWaitForWnfMetaNotification | 0xf3aa0fac |
| RtlWaitOnAddress | 0xb0b02331 |
| RtlWakeAddressAll | 0x98dcd4dd |
| RtlWakeAddressAllNoFence | 0x297aebc6 |
| RtlWakeAddressSingle | 0x8e417653 |
| RtlWakeAddressSingleNoFence | 0xd49ff775 |
| RtlWakeAllConditionVariable | 0x230c18c6 |
| RtlWakeConditionVariable | 0x3208d89f |
| RtlWalkFrameChain | 0x56708266 |
| RtlWalkHeap | 0x202c8f61 |
| RtlWeaklyEnumerateEntryHashTable | 0x51a60278 |
| RtlWerpReportException | 0x33a8bbf0 |
| RtlWnfCompareChangeStamp | 0x8685590c |
| RtlWnfDllUnloadCallback | 0x7bd8019a |
| RtlWow64CallFunction64 | 0x60dbe081 |
| RtlWow64EnableFsRedirection | 0xfc399853 |
| RtlWow64EnableFsRedirectionEx | 0xe6615908 |
| RtlWow64GetCpuAreaInfo | 0x45aa2560 |
| RtlWow64GetCurrentCpuArea | 0xe6cd616c |
| RtlWow64GetCurrentMachine | 0x47c0be93 |
| RtlWow64GetEquivalentMachineCHPE | 0x437c2a61 |
| RtlWow64GetProcessMachines | 0xc0987515 |
| RtlWow64GetSharedInfoProcess | 0x6bc1ffcd |
| RtlWow64GetThreadContext | 0x8094d77c |
| RtlWow64GetThreadSelectorEntry | 0xc3a43278 |
| RtlWow64IsWowGuestMachineSupported | 0xccc09e12 |
| RtlWow64LogMessageInEventLogger | 0xb7414611 |
| RtlWow64PopAllCrossProcessWorkFromWorkList | 0x2fe637b6 |
| RtlWow64PopCrossProcessWorkFromFreeList | 0xc2a33072 |
| RtlWow64PushCrossProcessWorkOntoFreeList | 0x1f176cea |
| RtlWow64PushCrossProcessWorkOntoWorkList | 0x79776d71 |
| RtlWow64RequestCrossProcessHeavyFlush | 0x309f947a |
| RtlWow64SetThreadContext | 0x8095377c |
| RtlWow64SuspendProcess | 0xe0c99d2c |
| RtlWow64SuspendThread | 0xd667d456 |
| RtlWriteMemoryStream | 0x43775e95 |
| RtlWriteNonVolatileMemory | 0xbac880bc |
| RtlWriteRegistryValue | 0x871140ed |
| RtlZeroHeap | 0x2c6c8f7a |
| RtlZeroMemory | 0xbc43f36a |
| RtlZombifyActivationContext | 0x4dca0d7c |
| RtlpApplyLengthFunction | 0xbd9f8a73 |
| RtlpCheckDynamicTimeZoneInformation | 0xdfaf162f |
| RtlpCleanupRegistryKeys | 0x305603b3 |
| RtlpConvertAbsoluteToRelativeSecurityAttribute | 0x3871aa99 |
| RtlpConvertCultureNamesToLCIDs | 0x49be3cef |
| RtlpConvertLCIDsToCultureNames | 0x6e593f6b |
| RtlpConvertRelativeToAbsoluteSecurityAttribute | 0xb143ea77 |
| RtlpCreateProcessRegistryInfo | 0x5bb92944 |
| RtlpEnsureBufferSize | 0xb9da3087 |
| RtlpExecuteUmsThread | 0xb909e004 |
| RtlpFreezeTimeBias | 0x7f4dd4e1 |
| RtlpGetDeviceFamilyInfoEnum | 0x2e0506fe |
| RtlpGetLCIDFromLangInfoNode | 0x4fa3d26c |
| RtlpGetNameFromLangInfoNode | 0xcc44d26d |
| RtlpGetSystemDefaultUILanguage | 0x95cf703c |
| RtlpGetUserOrMachineUILanguage4NLS | 0x2aa3359f |
| RtlpInitializeLangRegistryInfo | 0xcc105b18 |
| RtlpIsQualifiedLanguage | 0x1a2747d6 |
| RtlpLoadMachineUIByPolicy | 0x1652a298 |
| RtlpLoadUserUIByPolicy | 0x156d6931 |
| RtlpMergeSecurityAttributeInformation | 0x564ea678 |
| RtlpMuiFreeLangRegistryInfo | 0x4af33d13 |
| RtlpMuiRegCreateRegistryInfo | 0x7db31545 |
| RtlpMuiRegFreeRegistryInfo | 0xf2dd80c5 |
| RtlpMuiRegLoadRegistryInfo | 0xe2ddaffd |
| RtlpNotOwnerCriticalSection | 0xb5d97f2e |
| RtlpNtCreateKey | 0x2ba9532 |
| RtlpNtEnumerateSubKey | 0x33f69552 |
| RtlpNtMakeTemporaryKey | 0x8f36f942 |
| RtlpNtOpenKey | 0x2468ad3 |
| RtlpNtQueryValueKey | 0xc2960950 |
| RtlpNtSetValueKey | 0x3b328bc7 |
| RtlpQueryDefaultUILanguage | 0xb96ae896 |
| RtlpQueryProcessDebugInformationFromWow64 | 0x85186612 |
| RtlpQueryProcessDebugInformationRemote | 0x1d6c15c3 |
| RtlpRefreshCachedUILanguage | 0x69267fbc |
| RtlpSetInstallLanguage | 0x59075e59 |
| RtlpSetPreferredUILanguages | 0x9d7e7062 |
| RtlpSetUserPreferredUILanguages | 0xda1d6844 |
| RtlpTimeFieldsToTime | 0xc1bf7c8d |
| RtlpTimeToTimeFields | 0x2c7de4c0 |
| RtlpUmsExecuteYieldThreadEnd | 0xa81d08e5 |
| RtlpUmsThreadYield | 0x235b13d6 |
| RtlpUnWaitCriticalSection | 0x1a650df7 |
| RtlpVerifyAndCommitUILanguageSettings | 0xa75c0319 |
| RtlpWaitForCriticalSection | 0x6ccbccbf |
| RtlpWow64CtxFromAmd64 | 0xc001fc2b |
| RtlpWow64GetContextOnAmd64 | 0xdf6c2d6c |
| RtlpWow64SetContextOnAmd64 | 0xdf782d6c |
| RtlxAnsiStringToUnicodeSize | 0xd223e8e9 |
| RtlxOemStringToUnicodeSize | 0x99d168bf |
| RtlxUnicodeStringToAnsiSize | 0x6e1ffece |
| RtlxUnicodeStringToOemSize | 0xb9065a01 |
| SbExecuteProcedure | 0x3a51d22 |
| SbSelectProcedure | 0x80f4dbe2 |
| ShipAssert | 0x8975ee18 |
| ShipAssertGetBufferInfo | 0x88ad9af |
| ShipAssertMsgA | 0xe1b0f07f |
| ShipAssertMsgW | 0xe1b0f095 |
| TpAllocAlpcCompletion | 0xea101b94 |
| TpAllocAlpcCompletionEx | 0x406e5cc0 |
| TpAllocCleanupGroup | 0xd62c4b83 |
| TpAllocIoCompletion | 0x931500b8 |
| TpAllocJobNotification | 0x9309791f |
| TpAllocPool | 0xe5b80ec7 |
| TpAllocTimer | 0xb73ed08e |
| TpAllocWait | 0xe5bb560f |
| TpAllocWork | 0xe5bb8f26 |
| TpAlpcRegisterCompletionList | 0xfc676ea |
| TpAlpcUnregisterCompletionList | 0xe6a06d5f |
| TpCallbackDetectedUnrecoverableError | 0x7aef3df8 |
| TpCallbackIndependent | 0x5055483a |
| TpCallbackLeaveCriticalSectionOnCompletion | 0x869562d8 |
| TpCallbackMayRunLong | 0x7d024afa |
| TpCallbackReleaseMutexOnCompletion | 0xdf8666a9 |
| TpCallbackReleaseSemaphoreOnCompletion | 0x58b55d73 |
| TpCallbackSendAlpcMessageOnCompletion | 0xa8d5d482 |
| TpCallbackSendPendingAlpcMessage | 0x21254292 |
| TpCallbackSetEventOnCompletion | 0x5a6d7ee3 |
| TpCallbackUnloadDllOnCompletion | 0x8116b478 |
| TpCancelAsyncIoOperation | 0xd8c896e9 |
| TpCaptureCaller | 0x2e96cba0 |
| TpCheckTerminateWorker | 0x7a63fac0 |
| TpDbgDumpHeapUsage | 0xacbf95d8 |
| TpDbgSetLogRoutine | 0xd4d7ddc5 |
| TpDisablePoolCallbackChecks | 0x7a48db48 |
| TpDisassociateCallback | 0x37cadcc4 |
| TpIsTimerSet | 0x4c53eecf |
| TpPostWork | 0xad783d47 |
| TpQueryPoolStackInformation | 0xe60ebec3 |
| TpReleaseAlpcCompletion | 0x153b1bf0 |
| TpReleaseCleanupGroup | 0xecf71643 |
| TpReleaseCleanupGroupMembers | 0x78bb54e6 |
| TpReleaseIoCompletion | 0xa9dfcb78 |
| TpReleaseJobNotification | 0xf8698484 |
| TpReleasePool | 0xa5ced992 |
| TpReleaseTimer | 0xba1829e6 |
| TpReleaseWait | 0xa5d220da |
| TpReleaseWork | 0xa5d259f1 |
| TpSetDefaultPoolMaxThreads | 0x17d8bfef |
| TpSetDefaultPoolStackInformation | 0x571f3c35 |
| TpSetPoolMaxThreads | 0x5ee45b71 |
| TpSetPoolMaxThreadsSoftLimit | 0xf864c402 |
| TpSetPoolMinThreads | 0x5ee46321 |
| TpSetPoolStackInformation | 0xe8e22315 |
| TpSetPoolThreadBasePriority | 0x4ceecd26 |
| TpSetPoolThreadCpuSets | 0x40246aed |
| TpSetPoolWorkerThreadIdleTimeout | 0x4defc84a |
| TpSetTimer | 0x2d8133c4 |
| TpSetTimerEx | 0x4cf19ce |
| TpSetWait | 0x916d6929 |
| TpSetWaitEx | 0xb5a4af5d |
| TpSimpleTryPost | 0x51fc4ff7 |
| TpStartAsyncIoOperation | 0xcfc9f00c |
| TpTimerOutstandingCallbackCount | 0xb94a5154 |
| TpTrimPools | 0x2097a19e |
| TpWaitForAlpcCompletion | 0xaffff7e |
| TpWaitForIoCompletion | 0x8d5d3cb1 |
| TpWaitForJobNotification | 0xb105f643 |
| TpWaitForTimer | 0xd687d80d |
| TpWaitForWait | 0xdeb59e4b |
| TpWaitForWork | 0xdeb5d762 |
| VerSetConditionMask | 0xf361b1b3 |
| WerReportExceptionWorker | 0xeaa18130 |
| WerReportSQMEvent | 0x68b19e0b |
| WinSqmAddToAverageDWORD | 0xf2ccae60 |
| WinSqmAddToStream | 0xb565eb76 |
| WinSqmAddToStreamEx | 0x97ade3ed |
| WinSqmCheckEscalationAddToStreamEx | 0xf6c7be49 |
| WinSqmCheckEscalationSetDWORD | 0x81b4851a |
| WinSqmCheckEscalationSetDWORD64 | 0xd21470fa |
| WinSqmCheckEscalationSetString | 0x567284f7 |
| WinSqmCommonDatapointDelete | 0xd39d910e |
| WinSqmCommonDatapointSetDWORD | 0x84256e4a |
| WinSqmCommonDatapointSetDWORD64 | 0x95b93104 |
| WinSqmCommonDatapointSetStreamEx | 0x3e657faa |
| WinSqmCommonDatapointSetString | 0xa48faaf7 |
| WinSqmEndSession | 0xfbab16a4 |
| WinSqmEventEnabled | 0x21f4545f |
| WinSqmEventWrite | 0xd7ea9f4a |
| WinSqmGetEscalationRuleStatus | 0xe3f9c862 |
| WinSqmGetInstrumentationProperty | 0xa3cb79b0 |
| WinSqmIncrementDWORD | 0xb1d87ace |
| WinSqmIsOptedIn | 0xb2c61cd3 |
| WinSqmIsOptedInEx | 0x187357e3 |
| WinSqmIsSessionDisabled | 0xe97853db |
| WinSqmSetDWORD | 0xf4c756ea |
| WinSqmSetDWORD64 | 0x1d5bb2c7 |
| WinSqmSetEscalationInfo | 0xda250886 |
| WinSqmSetIfMaxDWORD | 0x2570426 |
| WinSqmSetIfMinDWORD | 0xee570427 |
| WinSqmSetString | 0xb8ccbf05 |
| WinSqmStartSession | 0x98144dac |
| WinSqmStartSessionForPartner | 0x175808 |
| WinSqmStartSqmOptinListener | 0x7abdab81 |
| ZwAcceptConnectPort | 0xbfa84dd0 |
| ZwAccessCheck | 0x86f66716 |
| ZwAccessCheckAndAuditAlarm | 0x82ccf919 |
| ZwAccessCheckByType | 0x2d798c2b |
| ZwAccessCheckByTypeAndAuditAlarm | 0xcfd34342 |
| ZwAccessCheckByTypeResultList | 0x501f1170 |
| ZwAccessCheckByTypeResultListAndAuditAlarm | 0x151e4dcd |
| ZwAccessCheckByTypeResultListAndAuditAlarmByHandle | 0xf4966d28 |
| ZwAcquireProcessActivityReference | 0xb302a0d5 |
| ZwAddAtom | 0xe62bc16 |
| ZwAddAtomEx | 0x8af06151 |
| ZwAddBootEntry | 0x3ea5a509 |
| ZwAddDriverEntry | 0x9baa79cb |
| ZwAdjustGroupsToken | 0xcdc82745 |
| ZwAdjustPrivilegesToken | 0xaf59488e |
| ZwAdjustTokenClaimsAndDeviceGroups | 0xdedaef42 |
| ZwAlertResumeThread | 0xd081f332 |
| ZwAlertThread | 0x8b4c8937 |
| ZwAlertThreadByThreadId | 0xf690271 |
| ZwAllocateLocallyUniqueId | 0x31ea7426 |
| ZwAllocateReserveObject | 0xf70d4eb4 |
| ZwAllocateUserPhysicalPages | 0xd4998d46 |
| ZwAllocateUuids | 0x174a8e8b |
| ZwAllocateVirtualMemory | 0xf53cdaf3 |
| ZwAllocateVirtualMemoryEx | 0xf36bd8ec |
| ZwAlpcAcceptConnectPort | 0x153fc017 |
| ZwAlpcCancelMessage | 0xead45684 |
| ZwAlpcConnectPort | 0x4061e55d |
| ZwAlpcConnectPortEx | 0x87957e19 |
| ZwAlpcCreatePort | 0x28118e3e |
| ZwAlpcCreatePortSection | 0xd0f82454 |
| ZwAlpcCreateResourceReserve | 0x7fdb0695 |
| ZwAlpcCreateSectionView | 0x65a3d423 |
| ZwAlpcCreateSecurityContext | 0xd68544bf |
| ZwAlpcDeletePortSection | 0xd0f8be1c |
| ZwAlpcDeleteResourceReserve | 0x1c5b069f |
| ZwAlpcDeleteSectionView | 0x65a46deb |
| ZwAlpcDeleteSecurityContext | 0x730544c9 |
| ZwAlpcDisconnectPort | 0xbd13b5bb |
| ZwAlpcImpersonateClientContainerOfPort | 0x620ba546 |
| ZwAlpcImpersonateClientOfPort | 0x61cada36 |
| ZwAlpcOpenSenderProcess | 0x1c3217e1 |
| ZwAlpcOpenSenderThread | 0x7843182c |
| ZwAlpcQueryInformation | 0xfc643d86 |
| ZwAlpcQueryInformationMessage | 0xf48cfd90 |
| ZwAlpcRevokeSecurityContext | 0x9c3c45a9 |
| ZwAlpcSendWaitReceivePort | 0x34a926b3 |
| ZwAlpcSetInformation | 0xd00d757e |
| ZwApphelpCacheControl | 0x5aa00181 |
| ZwAreMappedFilesTheSame | 0xd94909cd |
| ZwAssignProcessToJobObject | 0x8ad00cc7 |
| ZwAssociateWaitCompletionPacket | 0xcd4fd420 |
| ZwCallEnclave | 0xff00229c |
| ZwCallbackReturn | 0xb24b752d |
| ZwCancelIoFile | 0x2c26d8e4 |
| ZwCancelIoFileEx | 0x9b6399c8 |
| ZwCancelSynchronousIoFile | 0x937f520a |
| ZwCancelTimer | 0xfa0ed249 |
| ZwCancelTimer2 | 0x41da4971 |
| ZwCancelWaitCompletionPacket | 0x34061a1b |
| ZwClearEvent | 0x57717175 |
| ZwClose | 0x7267cadc |
| ZwCloseObjectAuditAlarm | 0x7a7f2eaa |
| ZwCommitComplete | 0xc97c2766 |
| ZwCommitEnlistment | 0x3f8a6850 |
| ZwCommitRegistryTransaction | 0x61e8decd |
| ZwCommitTransaction | 0xcaf0eafd |
| ZwCompactKeys | 0xea017431 |
| ZwCompareObjects | 0xb3239e7c |
| ZwCompareSigningLevels | 0xecaaf60 |
| ZwCompareTokens | 0x58699e4f |
| ZwCompleteConnectPort | 0x1b54bdec |
| ZwCompressKey | 0x2e0509bc |
| ZwConnectPort | 0xea041c43 |
| ZwContinue | 0xa3820039 |
| ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter | 0x282ac11e |
| ZwCreateCrossVmEvent | 0xb6b83a3f |
| ZwCreateDebugObject | 0x4f1a50a1 |
| ZwCreateDirectoryObject | 0xd9203fc6 |
| ZwCreateDirectoryObjectEx | 0x80ff247c |
| ZwCreateEnclave | 0x8d0841d1 |
| ZwCreateEnlistment | 0x84ce68ff |
| ZwCreateEvent | 0xab274a5f |
| ZwCreateEventPair | 0xa6244406 |
| ZwCreateFile | 0x5d598726 |
| ZwCreateIRTimer | 0x5416efbf |
| ZwCreateIoCompletion | 0x39a5c630 |
| ZwCreateJobObject | 0xa711580f |
| ZwCreateJobSet | 0x6e775e89 |
| ZwCreateKey | 0xaeadfc3 |
| ZwCreateKeyTransacted | 0xeb5a7dd3 |
| ZwCreateKeyedEvent | 0x63e3a066 |
| ZwCreateLowBoxToken | 0xa05e3c45 |
| ZwCreateMailslotFile | 0x424b82f6 |
| ZwCreateMutant | 0x74e097a9 |
| ZwCreateNamedPipeFile | 0xd35de42b |
| ZwCreatePagingFile | 0x79ec4b88 |
| ZwCreatePartition | 0xf1866f1d |
| ZwCreatePort | 0x5d5e9ff5 |
| ZwCreatePrivateNamespace | 0xb99c6c96 |
| ZwCreateProcess | 0x55c3d182 |
| ZwCreateProcessEx | 0xf46126f |
| ZwCreateProfile | 0x55c56094 |
| ZwCreateProfileEx | 0x15825a6f |
| ZwCreateRegistryTransaction | 0xe1fec775 |
| ZwCreateResourceManager | 0x13237f0a |
| ZwCreateSection | 0xfb0c60fd |
| ZwCreateSectionEx | 0x31840104 |
| ZwCreateSemaphore | 0x8bf08a93 |
| ZwCreateSymbolicLinkObject | 0xb27e5f1b |
| ZwCreateThread | 0x820fa5f9 |
| ZwCreateThreadEx | 0x3e97ef20 |
| ZwCreateTimer | 0xac10e93d |
| ZwCreateTimer2 | 0x821d27e7 |
| ZwCreateToken | 0xac13e139 |
| ZwCreateTokenEx | 0x4f84efc8 |
| ZwCreateTransaction | 0x737100e6 |
| ZwCreateTransactionManager | 0xa49a3059 |
| ZwCreateUserProcess | 0xd62c9582 |
| ZwCreateWaitCompletionPacket | 0x44bdb7ab |
| ZwCreateWaitablePort | 0xc060a332 |
| ZwCreateWnfStateName | 0x9092ea1b |
| ZwCreateWorkerFactory | 0x8c69bf07 |
| ZwDebugActiveProcess | 0x1368ea51 |
| ZwDebugContinue | 0x178d67ac |
| ZwDelayExecution | 0x95220976 |
| ZwDeleteAtom | 0x5d5746c7 |
| ZwDeleteBootEntry | 0xa1438e1e |
| ZwDeleteDriverEntry | 0x134ecf56 |
| ZwDeleteFile | 0x5d599a5f |
| ZwDeleteKey | 0xd2eae05c |
| ZwDeleteObjectAuditAlarm | 0x55760aca |
| ZwDeletePrivateNamespace | 0x499c6dca |
| ZwDeleteValueKey | 0xa7298f30 |
| ZwDeleteWnfStateData | 0x90a123f7 |
| ZwDeleteWnfStateName | 0x90a6231b |
| ZwDeviceIoControlFile | 0xca986b0d |
| ZwDisableLastKnownGood | 0x5a250033 |
| ZwDisplayString | 0x63d538c0 |
| ZwDrawText | 0x49a75cb1 |
| ZwDuplicateObject | 0x1c652f7f |
| ZwDuplicateToken | 0x5939ad83 |
| ZwEnableLastKnownGood | 0x49844a7c |
| ZwEnumerateBootEntries | 0xde2204a2 |
| ZwEnumerateDriverEntries | 0xe231509f |
| ZwEnumerateKey | 0xddbaca19 |
| ZwEnumerateSystemEnvironmentValuesEx | 0x9505d73c |
| ZwEnumerateTransactionObject | 0xf52d76c2 |
| ZwEnumerateValueKey | 0x213f2f04 |
| ZwExtendSection | 0x1e48daf6 |
| ZwFilterBootOption | 0x2545b003 |
| ZwFilterToken | 0x61ec8ce |
| ZwFilterTokenEx | 0x7b234130 |
| ZwFindAtom | 0x226e1798 |
| ZwFlushBuffersFile | 0x9c250720 |
| ZwFlushBuffersFileEx | 0x941c8b88 |
| ZwFlushInstallUILanguage | 0xc6a1dd68 |
| ZwFlushInstructionCache | 0xfe24c7ce |
| ZwFlushKey | 0xf170f264 |
| ZwFlushProcessWriteBuffers | 0xd5e85d8a |
| ZwFlushVirtualMemory | 0x1c0f08a1 |
| ZwFlushWriteBuffer | 0x3ca89dbd |
| ZwFreeUserPhysicalPages | 0xf4351a07 |
| ZwFreeVirtualMemory | 0xae08eced |
| ZwFreezeRegistry | 0x68f1f4b6 |
| ZwFreezeTransactions | 0x6e801e4d |
| ZwFsControlFile | 0xff7f1b14 |
| ZwGetCachedSigningLevel | 0x17015be5 |
| ZwGetCompleteWnfStateSubscription | 0xf7beb3d6 |
| ZwGetContextThread | 0x23badb8e |
| ZwGetCurrentProcessorNumber | 0x46022f94 |
| ZwGetCurrentProcessorNumberEx | 0x8be5a30 |
| ZwGetDevicePowerState | 0x95a045c6 |
| ZwGetMUIRegistryInfo | 0x8ba04602 |
| ZwGetNextProcess | 0x766b2cdc |
| ZwGetNextThread | 0x5314e0d4 |
| ZwGetNlsSectionPtr | 0xfcb86954 |
| ZwGetNotificationResourceManager | 0x15be384b |
| ZwGetWriteWatch | 0x73fdc9a0 |
| ZwImpersonateAnonymousToken | 0xbb6a563f |
| ZwImpersonateClientOfPort | 0xcc64fda4 |
| ZwImpersonateThread | 0xc1314a10 |
| ZwInitializeEnclave | 0x5bd1bb8f |
| ZwInitializeNlsFiles | 0x17db4aa6 |
| ZwInitializeRegistry | 0x42106c6a |
| ZwInitiatePowerAction | 0x2e66cd79 |
| ZwIsProcessInJob | 0x4a16ae1 |
| ZwIsSystemResumeAutomatic | 0x9f6eb09 |
| ZwIsUILanguageComitted | 0xa3c958f1 |
| ZwListenPort | 0xffefb769 |
| ZwLoadDriver | 0xbe3c5733 |
| ZwLoadEnclaveData | 0x75f3853e |
| ZwLoadKey | 0xe44396e4 |
| ZwLoadKey2 | 0x8872dcce |
| ZwLoadKey3 | 0x8872dccf |
| ZwLoadKeyEx | 0xe5b9ca9 |
| ZwLockFile | 0x8ce06b61 |
| ZwLockProductActivationKeys | 0x89441a88 |
| ZwLockRegistryKey | 0x16908f63 |
| ZwLockVirtualMemory | 0xae0ed479 |
| ZwMakePermanentObject | 0xbcf70c0f |
| ZwMakeTemporaryObject | 0xaeaf8930 |
| ZwManageHotPatch | 0xf5c69284 |
| ZwManagePartition | 0x8152717c |
| ZwMapCMFModule | 0xb936281a |
| ZwMapUserPhysicalPages | 0x657e6305 |
| ZwMapUserPhysicalPagesScatter | 0xb83ef552 |
| ZwMapViewOfSection | 0x324865b9 |
| ZwMapViewOfSectionEx | 0x2196ede1 |
| ZwModifyBootEntry | 0x230e1072 |
| ZwModifyDriverEntry | 0x3d581d5d |
| ZwNotifyChangeDirectoryFile | 0xed041d44 |
| ZwNotifyChangeDirectoryFileEx | 0x10751ccc |
| ZwNotifyChangeKey | 0x9928ebd7 |
| ZwNotifyChangeMultipleKeys | 0xfd30ee1c |
| ZwNotifyChangeSession | 0xbd54c4de |
| ZwOpenDirectoryObject | 0x2da1b39 |
| ZwOpenEnlistment | 0x61bc2214 |
| ZwOpenEvent | 0x2203d4ce |
| ZwOpenEventPair | 0x4d0bb1cf |
| ZwOpenFile | 0xd1106b79 |
| ZwOpenIoCompletion | 0xf08a19a3 |
| ZwOpenJobObject | 0x4df8c5d8 |
| ZwOpenKey | 0xa68896e5 |
| ZwOpenKeyEx | 0x225b9fb2 |
| ZwOpenKeyTransacted | 0xc7e4ec4a |
| ZwOpenKeyTransactedEx | 0x93b13437 |
| ZwOpenKeyedEvent | 0x40d1597b |
| ZwOpenMutant | 0x5071e578 |
| ZwOpenObjectAuditAlarm | 0xfcb177db |
| ZwOpenPartition | 0x986ddce6 |
| ZwOpenPrivateNamespace | 0xf0d7dadb |
| ZwOpenProcess | 0xc7ed8b5d |
| ZwOpenProcessToken | 0xc1091424 |
| ZwOpenProcessTokenEx | 0x24509c1c |
| ZwOpenRegistryTransaction | 0x99216313 |
| ZwOpenResourceManager | 0x3cdd5a7c |
| ZwOpenSection | 0x6d361ad9 |
| ZwOpenSemaphore | 0x32d7f85c |
| ZwOpenSession | 0x6e359ad9 |
| ZwOpenSymbolicLinkObject | 0xa03773f8 |
| ZwOpenThread | 0x5da0f3c8 |
| ZwOpenThreadToken | 0x96347af5 |
| ZwOpenThreadTokenEx | 0xd1ebdf70 |
| ZwOpenTimer | 0x22ed73ac |
| ZwOpenTransaction | 0x11282382 |
| ZwOpenTransactionManager | 0x92534536 |
| ZwPlugPlayControl | 0x2a478805 |
| ZwPowerInformation | 0xf6377897 |
| ZwPrePrepareComplete | 0x113f8733 |
| ZwPrePrepareEnlistment | 0x4d09996f |
| ZwPrepareComplete | 0x2b281704 |
| ZwPrepareEnlistment | 0xef48ddd6 |
| ZwPrivilegeCheck | 0xe4ce1e74 |
| ZwPrivilegeObjectAuditAlarm | 0x8492f081 |
| ZwPrivilegedServiceAuditAlarm | 0xbd0b6bae |
| ZwPropagationComplete | 0xbb9c920a |
| ZwPropagationFailed | 0xce8cd63f |
| ZwProtectVirtualMemory | 0xd374024 |
| ZwPulseEvent | 0xbd731ab1 |
| ZwQueryAttributesFile | 0x2032ec51 |
| ZwQueryAuxiliaryCounterFrequency | 0xab126084 |
| ZwQueryBootEntryOrder | 0x738c6377 |
| ZwQueryBootOptions | 0x10c642f9 |
| ZwQueryDebugFilterState | 0xd0e3cff6 |
| ZwQueryDefaultLocale | 0xf9dff007 |
| ZwQueryDefaultUILanguage | 0x4dca88c |
| ZwQueryDirectoryFile | 0x8a1fe47 |
| ZwQueryDirectoryFileEx | 0x87f9253a |
| ZwQueryDirectoryObject | 0x998828f6 |
| ZwQueryDriverEntryOrder | 0x2e4e5f75 |
| ZwQueryEaFile | 0xad07ba99 |
| ZwQueryEvent | 0xa5733a79 |
| ZwQueryFullAttributesFile | 0x982fe3bf |
| ZwQueryInformationAtom | 0x1f6ef9c5 |
| ZwQueryInformationByName | 0xbe267282 |
| ZwQueryInformationEnlistment | 0x35545a8d |
| ZwQueryInformationFile | 0x1f714d5d |
| ZwQueryInformationJobObject | 0x1495879c |
| ZwQueryInformationPort | 0x1f76662c |
| ZwQueryInformationProcess | 0x38df328e |
| ZwQueryInformationResourceManager | 0x2e848aed |
| ZwQueryInformationThread | 0xe1288101 |
| ZwQueryInformationToken | 0xef0ca811 |
| ZwQueryInformationTransaction | 0x842f329c |
| ZwQueryInformationTransactionManager | 0x2a8bbe0a |
| ZwQueryInformationWorkerFactory | 0x8530974a |
| ZwQueryInstallUILanguage | 0xc4c1f3f0 |
| ZwQueryIntervalProfile | 0xc0926d17 |
| ZwQueryIoCompletion | 0xc054700 |
| ZwQueryKey | 0x116972bf |
| ZwQueryLicenseValue | 0xbe77c9bf |
| ZwQueryMultipleValueKey | 0xb8a49a4d |
| ZwQueryMutant | 0xbe5e9ae8 |
| ZwQueryObject | 0xc129a988 |
| ZwQueryOpenSubKeys | 0x19cb322a |
| ZwQueryOpenSubKeysEx | 0x2cc8b17f |
| ZwQueryPerformanceCounter | 0x49d0de3c |
| ZwQueryPortInformationProcess | 0xcfc6c600 |
| ZwQueryQuotaInformationFile | 0x5573fef4 |
| ZwQuerySection | 0x2accc8e7 |
| ZwQuerySecurityAttributesToken | 0x125af5c5 |
| ZwQuerySecurityObject | 0x3ac2025c |
| ZwQuerySecurityPolicy | 0x3d931261 |
| ZwQuerySemaphore | 0x8d902f52 |
| ZwQuerySymbolicLinkObject | 0xa7163f4f |
| ZwQuerySystemEnvironmentValue | 0x9e207e5a |
| ZwQuerySystemEnvironmentValueEx | 0x81f97390 |
| ZwQuerySystemInformation | 0x42632b16 |
| ZwQuerySystemInformationEx | 0x8cac6221 |
| ZwQuerySystemTime | 0x5c485beb |
| ZwQueryTimer | 0xa65cd957 |
| ZwQueryTimerResolution | 0x4f4f476 |
| ZwQueryValueKey | 0x6ba68c55 |
| ZwQueryVirtualMemory | 0x1d778883 |
| ZwQueryVolumeInformationFile | 0x95b09842 |
| ZwQueryWnfStateData | 0x62ed6bc7 |
| ZwQueryWnfStateNameInformation | 0xd72f5518 |
| ZwQueueApcThread | 0xf31e7386 |
| ZwQueueApcThreadEx | 0x79ce24e4 |
| ZwRaiseException | 0xd7978991 |
| ZwRaiseHardError | 0x92e6afe1 |
| ZwReadFile | 0x8706b8f |
| ZwReadFileScatter | 0xcfcf399f |
| ZwReadOnlyEnlistment | 0x2c0d5583 |
| ZwReadRequestData | 0x711674f3 |
| ZwReadVirtualMemory | 0xae1483eb |
| ZwRecoverEnlistment | 0x38fe7556 |
| ZwRecoverResourceManager | 0xc08bdf22 |
| ZwRecoverTransactionManager | 0xd4a6870d |
| ZwRegisterProtocolAddressInformation | 0xcc775898 |
| ZwRegisterThreadTerminatePort | 0xab0a3aa |
| ZwReleaseKeyedEvent | 0xcedfaee7 |
| ZwReleaseMutant | 0x35c8ae59 |
| ZwReleaseSemaphore | 0x97486b07 |
| ZwReleaseWorkerFactoryWorker | 0x1a155634 |
| ZwRemoveIoCompletion | 0x3b7909b4 |
| ZwRemoveIoCompletionEx | 0xe426da05 |
| ZwRemoveProcessDebug | 0xaf2e22e |
| ZwRenameKey | 0x4a7aee5d |
| ZwRenameTransactionManager | 0x250f0256 |
| ZwReplaceKey | 0xf74a61b4 |
| ZwReplacePartitionUnit | 0xf9d30f78 |
| ZwReplyPort | 0xe130fff8 |
| ZwReplyWaitReceivePort | 0xa03f6b1a |
| ZwReplyWaitReceivePortEx | 0xfdac7398 |
| ZwReplyWaitReplyPort | 0x68953c1f |
| ZwRequestPort | 0xa3edf7c |
| ZwRequestWaitReplyPort | 0x2485a141 |
| ZwResetEvent | 0x5b734ae6 |
| ZwResetWriteWatch | 0x345b7f7f |
| ZwRestoreKey | 0x143a61cf |
| ZwResumeProcess | 0x3f7e4a83 |
| ZwResumeThread | 0x895d79c1 |
| ZwRevertContainerImpersonation | 0x708e79f7 |
| ZwRollbackComplete | 0x9f821cb8 |
| ZwRollbackEnlistment | 0x575fafa8 |
| ZwRollbackRegistryTransaction | 0xad3e1c8 |
| ZwRollbackTransaction | 0xc599d600 |
| ZwRollforwardTransactionManager | 0xe86dad8a |
| ZwSaveKey | 0x899416e6 |
| ZwSaveKeyEx | 0x505ba33e |
| ZwSaveMergedKeys | 0xdd081aa9 |
| ZwSecureConnectPort | 0xd83a5df0 |
| ZwSerializeBoot | 0x9ec86642 |
| ZwSetBootEntryOrder | 0x17b9f45c |
| ZwSetBootOptions | 0x328f8b54 |
| ZwSetCachedSigningLevel | 0x17015ca5 |
| ZwSetCachedSigningLevel2 | 0xe02b94d4 |
| ZwSetContextThread | 0x23bb3b8e |
| ZwSetDebugFilterState | 0x87276287 |
| ZwSetDefaultHardErrorPort | 0x1690e8b2 |
| ZwSetDefaultLocale | 0x1f015c8f |
| ZwSetDefaultUILanguage | 0xcd4efaa2 |
| ZwSetDriverEntryOrder | 0xe491f205 |
| ZwSetEaFile | 0x91abe82a |
| ZwSetEvent | 0x2c985be6 |
| ZwSetEventBoostPriority | 0xba64167 |
| ZwSetHighEventPair | 0xe54c8c88 |
| ZwSetHighWaitLowEventPair | 0x9a4d1cdb |
| ZwSetIRTimer | 0x185d09c5 |
| ZwSetInformationDebugObject | 0x8d6966fb |
| ZwSetInformationEnlistment | 0x56c0e1b2 |
| ZwSetInformationFile | 0xa52369f1 |
| ZwSetInformationJobObject | 0x3da0ebd5 |
| ZwSetInformationKey | 0x65292ed9 |
| ZwSetInformationObject | 0x9f36d368 |
| ZwSetInformationProcess | 0x47297567 |
| ZwSetInformationResourceManager | 0x78c763fb |
| ZwSetInformationSymbolicLink | 0x281c464 |
| ZwSetInformationThread | 0xa99ad318 |
| ZwSetInformationToken | 0xa5503aa2 |
| ZwSetInformationTransaction | 0xb1c01740 |
| ZwSetInformationTransactionManager | 0x9712e32b |
| ZwSetInformationVirtualMemory | 0xde0d782 |
| ZwSetInformationWorkerFactory | 0xc8c32800 |
| ZwSetIntervalProfile | 0x464489ac |
| ZwSetIoCompletion | 0x452e5264 |
| ZwSetIoCompletionEx | 0xb9499a2c |
| ZwSetLdtEntries | 0x87d4b038 |
| ZwSetLowEventPair | 0x8b9287ed |
| ZwSetLowWaitHighEventPair | 0x29a8ef1 |
| ZwSetQuotaInformationFile | 0x7e7f632d |
| ZwSetSecurityObject | 0xdeef9340 |
| ZwSetSystemEnvironmentValue | 0xcbb162fe |
| ZwSetSystemEnvironmentValueEx | 0xc58c0446 |
| ZwSetSystemInformation | 0xad57d2d |
| ZwSetSystemPowerState | 0x76c0c2c1 |
| ZwSetSystemTime | 0x3556a62e |
| ZwSetThreadExecutionState | 0x61fc5d47 |
| ZwSetTimer | 0x2d81fac4 |
| ZwSetTimer2 | 0xb03f58b7 |
| ZwSetTimerEx | 0x7eb19ce |
| ZwSetTimerResolution | 0x8aa7110a |
| ZwSetUuidSeed | 0xf54437cf |
| ZwSetValueKey | 0xfc5ccfe7 |
| ZwSetVolumeInformationFile | 0xb71d1f67 |
| ZwSetWnfProcessNotificationEvent | 0xa860bf42 |
| ZwShutdownSystem | 0xea2b3e4d |
| ZwShutdownWorkerFactory | 0xd4c09d62 |
| ZwSignalAndWaitForSingleObject | 0xe9f4a1f7 |
| ZwSinglePhaseReject | 0x558a69dc |
| ZwStartProfile | 0x86814855 |
| ZwStopProfile | 0xc7ffa47f |
| ZwSubscribeWnfStateChange | 0x5987044f |
| ZwSuspendProcess | 0x76732275 |
| ZwSuspendThread | 0x1b152081 |
| ZwSystemDebugControl | 0x7f994495 |
| ZwTerminateEnclave | 0x3465e48a |
| ZwTerminateJobObject | 0x1d9c3aad |
| ZwTerminateProcess | 0xfd21743a |
| ZwTerminateThread | 0x474a930f |
| ZwTestAlert | 0xadbed9f9 |
| ZwThawRegistry | 0xb077f91e |
| ZwThawTransactions | 0xb50496ad |
| ZwTraceControl | 0x40f05d41 |
| ZwTraceEvent | 0xbd739755 |
| ZwTranslateFilePath | 0xfd442357 |
| ZwUmsThreadYield | 0x18a68596 |
| ZwUnloadDriver | 0x2b9c57ef |
| ZwUnloadKey | 0xe5ba71a4 |
| ZwUnloadKey2 | 0xb74e34ce |
| ZwUnloadKeyEx | 0xe9c69cae |
| ZwUnlockFile | 0xbbbbc361 |
| ZwUnlockVirtualMemory | 0x190eda55 |
| ZwUnmapViewOfSection | 0xda065e8 |
| ZwUnmapViewOfSectionEx | 0x8197a94e |
| ZwUnsubscribeWnfStateChange | 0x344705c6 |
| ZwUpdateWnfStateData | 0x92cbe2f7 |
| ZwVdmControl | 0xd402fdc5 |
| ZwWaitForAlertByThreadId | 0xd17beaa3 |
| ZwWaitForDebugEvent | 0x2317ad90 |
| ZwWaitForKeyedEvent | 0x1d188e44 |
| ZwWaitForMultipleObjects | 0xe2a7a2a6 |
| ZwWaitForMultipleObjects32 | 0x9e8aa21c |
| ZwWaitForSingleObject | 0x18158390 |
| ZwWaitForWorkViaWorkerFactory | 0xc927a098 |
| ZwWaitHighEventPair | 0x50ccfd8a |
| ZwWaitLowEventPair | 0x96ee8b75 |
| ZwWorkerFactoryWorkerReady | 0x92374740 |
| ZwWriteFile | 0x2febec90 |
| ZwWriteFileGather | 0xa046a836 |
| ZwWriteRequestData | 0xacf27cfc |
| ZwWriteVirtualMemory | 0x1e34a8db |
| ZwYieldExecution | 0xd1cb69a0 |
| __C_specific_handler | 0x33fbf826 |
| __chkstk | 0x8cb75dfb |
| __isascii | 0x2c4b7b9c |
| __iscsym | 0x99635e9d |
| __iscsymf | 0x2c6bd419 |
| __misaligned_access | 0x6ddb096 |
| __toascii | 0xe44b7b9e |
| _atoi64 | 0x89792b0c |
| _errno | 0xc48ad62f |
| _fltused | 0x5f7c5c16 |
| _i64toa | 0x957bde59 |
| _i64toa_s | 0xef7972a8 |
| _i64tow | 0x957bde6f |
| _i64tow_s | 0xef79caa8 |
| _itoa | 0x6265e41 |
| _itoa_s | 0x9979106b |
| _itow | 0x6265e57 |
| _itow_s | 0x9979686b |
| _lfind | 0xc4f4b224 |
| _local_unwind | 0xd8e5f6a2 |
| _ltoa | 0x627de41 |
| _ltoa_s | 0x9f79106b |
| _ltow | 0x627de57 |
| _ltow_s | 0x9f79686b |
| _makepath_s | 0x27d5b0c5 |
| _memccpy | 0x11031d8d |
| _memicmp | 0x11061d24 |
| _setjmp | 0xac8bb628 |
| _setjmpex | 0x2ed8afca |
| _snprintf | 0x6756a99a |
| _snprintf_s | 0x5aa675f0 |
| _snscanf_s | 0x8c54fae0 |
| _snwprintf | 0xa7629d74 |
| _snwprintf_s | 0x8a75def0 |
| _snwscanf_s | 0x8dd37628 |
| _splitpath | 0xd985e983 |
| _splitpath_s | 0x17a61bb9 |
| _strcmpi | 0xaf53457e |
| _stricmp | 0xaf561d25 |
| _strlwr | 0xad7abf6a |
| _strlwr_s | 0xeafdb708 |
| _strnicmp | 0xeb167cc5 |
| _strnset_s | 0x6370b310 |
| _strset_s | 0xeb64bf08 |
| _strupr | 0xad7ae28a |
| _strupr_s | 0xeb8a3708 |
| _swprintf | 0xa756a99c |
| _ui64toa | 0x157be157 |
| _ui64toa_s | 0xef8568a8 |
| _ui64tow | 0x157be16d |
| _ui64tow_s | 0xef85c0a8 |
| _ultoa | 0xc587de41 |
| _ultoa_s | 0x1f791369 |
| _ultow | 0xc587de57 |
| _ultow_s | 0x1f796b69 |
| _vscprintf | 0xa762a097 |
| _vscwprintf | 0xa8e17d1c |
| _vsnprintf | 0x6762a09a |
| _vsnprintf_s | 0x8a8275f0 |
| _vsnwprintf | 0xa8e17d74 |
| _vsnwprintf_s | 0x85f5def6 |
| _vswprintf | 0xa762a09c |
| _wcsicmp | 0x8d661d26 |
| _wcslwr | 0xb46b3f6a |
| _wcslwr_s | 0xacfdb724 |
| _wcsnicmp | 0xad167ce1 |
| _wcsnset_s | 0xa370b688 |
| _wcsset_s | 0xad64bf24 |
| _wcstoi64 | 0xad798dc5 |
| _wcstoui64 | 0xaf388529 |
| _wcsupr | 0xb46b628a |
| _wcsupr_s | 0xad8a3724 |
| _wmakepath_s | 0x57b5b0c5 |
| _wsplitpath_s | 0x13a61bbf |
| _wtoi | 0x62d5e49 |
| _wtoi64 | 0xb5792b0c |
| _wtol | 0x62d5e4c |
| abs | 0x190b3 |
| atan | 0x325c8e |
| atan2 | 0x64b91f2 |
| atoi | 0x325e49 |
| atol | 0x325e4c |
| bsearch | 0x6c8254e1 |
| bsearch_s | 0x9539205 |
| ceil | 0x33218c |
| cos | 0x19a53 |
| fabs | 0x3490b3 |
| floor | 0x697ca52 |
| isalnum | 0x2c47c728 |
| isalpha | 0x2c47cd7c |
| iscntrl | 0x2c68dec7 |
| isdigit | 0x2c7629af |
| isgraph | 0x2caa9283 |
| islower | 0x2cf9692d |
| isprint | 0x2d3ab24f |
| ispunct | 0x2d3c44ef |
| isspace | 0x2d6990e0 |
| isupper | 0x2d89cd2d |
| iswalnum | 0xb447ca72 |
| iswalpha | 0xb447d0c6 |
| iswascii | 0xb44b1cee |
| iswctype | 0xb46bf5ca |
| iswdigit | 0xb4762cf9 |
| iswgraph | 0xb4aa95cd |
| iswlower | 0xb4f96c77 |
| iswprint | 0xb53ab599 |
| iswspace | 0xb569942a |
| iswxdigit | 0xb676964a |
| isxdigit | 0xb6762cf9 |
| labs | 0x3790b3 |
| log | 0x1be47 |
| longjmp | 0xe515362b |
| mbstowcs | 0x6d796c54 |
| memchr | 0xe0881972 |
| memcmp | 0xe0881a10 |
| memcpy | 0xe0881a79 |
| memcpy_s | 0x2069f3d5 |
| memmove | 0x11084b41 |
| memmove_s | 0x212d1097 |
| memset | 0xe0885914 |
| pow | 0x1ce57 |
| qsort | 0x74b4ab4 |
| qsort_s | 0x2d2adc70 |
| sin | 0x1d98e |
| sprintf | 0xa7564703 |
| sprintf_s | 0x591c1af0 |
| sqrt | 0x3b52b4 |
| sscanf | 0xed631226 |
| sscanf_s | 0x8c48a808 |
| strcat | 0xed7a9894 |
| strcat_s | 0xea626008 |
| strchr | 0xed7a9972 |
| strcmp | 0xed7a9a10 |
| strcpy | 0xed7a9a79 |
| strcpy_s | 0xea69f408 |
| strcspn | 0xaf535a8b |
| strlen | 0xed7abd0e |
| strncat | 0xaf5898b1 |
| strncat_s | 0x6262d310 |
| strncmp | 0xaf589a2d |
| strncpy | 0xaf589a96 |
| strncpy_s | 0x626a6710 |
| strnlen | 0xaf58bd2b |
| strpbrk | 0xaf5996c8 |
| strrchr | 0xaf5a998f |
| strspn | 0xed7ada6e |
| strstr | 0xed7adaf2 |
| strtok_s | 0xeb793c08 |
| strtol | 0xed7ade4c |
| strtoul | 0xaf5bcb29 |
| swprintf | 0xa7564a9c |
| swprintf_s | 0x592a7ef0 |
| swscanf_s | 0x8c491b28 |
| tan | 0x1dc8e |
| tolower | 0xe4f9692f |
| toupper | 0xe589cd2f |
| towlower | 0xb4f96cce |
| towupper | 0xb589d0ce |
| vDbgPrintEx | 0xeca9be64 |
| vDbgPrintExWithPrefix | 0xa0f324f9 |
| vsprintf | 0xa7564ab3 |
| vsprintf_s | 0x592adaf0 |
| vswprintf_s | 0x5b027ef0 |
| wcscat | 0xf46b1894 |
| wcscat_s | 0xac626024 |
| wcschr | 0xf46b1972 |
| wcscmp | 0xf46b1a10 |
| wcscpy | 0xf46b1a79 |
| wcscpy_s | 0xac69f424 |
| wcscspn | 0x8d635a8c |
| wcslen | 0xf46b3d0e |
| wcsncat | 0x8d6898b2 |
| wcsncat_s | 0xa262d688 |
| wcsncmp | 0x8d689a2e |
| wcsncpy | 0x8d689a97 |
| wcsncpy_s | 0xa26a6a88 |
| wcsnlen | 0x8d68bd2c |
| wcspbrk | 0x8d6996c9 |
| wcsrchr | 0x8d6a9990 |
| wcsspn | 0xf46b5a6e |
| wcsstr | 0xf46b5af2 |
| wcstok_s | 0xad793c24 |
| wcstol | 0xf46b5e4c |
| wcstombs | 0xad794484 |
| wcstoul | 0x8d6bcb2a |
tags: #API lookup