2010-08-04 08:17:04 +00:00
|
|
|
LIBRARY ntdll.dll
|
|
|
|
|
|
|
|
|
|
EXPORTS
|
|
|
|
|
CsrAllocateCaptureBuffer
|
|
|
|
|
CsrAllocateMessagePointer
|
|
|
|
|
CsrCaptureMessageBuffer
|
|
|
|
|
CsrCaptureMessageMultiUnicodeStringsInPlace
|
|
|
|
|
CsrCaptureMessageString
|
|
|
|
|
CsrCaptureTimeout
|
|
|
|
|
CsrClientCallServer
|
|
|
|
|
CsrClientConnectToServer
|
|
|
|
|
CsrFreeCaptureBuffer
|
|
|
|
|
CsrGetProcessId
|
|
|
|
|
CsrIdentifyAlertableThread
|
|
|
|
|
CsrNewThread
|
|
|
|
|
CsrProbeForRead
|
|
|
|
|
CsrProbeForWrite
|
|
|
|
|
CsrSetPriorityClass
|
|
|
|
|
DbgBreakPoint
|
|
|
|
|
DbgPrint
|
|
|
|
|
DbgPrintEx
|
|
|
|
|
DbgPrintReturnControlC
|
|
|
|
|
DbgPrompt
|
|
|
|
|
DbgQueryDebugFilterState
|
|
|
|
|
DbgSetDebugFilterState
|
|
|
|
|
DbgUiConnectToDbg
|
|
|
|
|
DbgUiContinue
|
|
|
|
|
DbgUiConvertStateChangeStructure
|
|
|
|
|
DbgUiDebugActiveProcess
|
|
|
|
|
DbgUiGetThreadDebugObject
|
|
|
|
|
DbgUiIssueRemoteBreakin
|
|
|
|
|
DbgUiRemoteBreakin
|
|
|
|
|
DbgUiSetThreadDebugObject
|
|
|
|
|
DbgUiStopDebugging
|
|
|
|
|
DbgUiWaitStateChange
|
|
|
|
|
DbgUserBreakPoint
|
|
|
|
|
KiFastSystemCall
|
|
|
|
|
KiFastSystemCallRet
|
|
|
|
|
KiIntSystemCall
|
|
|
|
|
KiRaiseUserExceptionDispatcher
|
|
|
|
|
KiUserApcDispatcher
|
|
|
|
|
KiUserCallbackDispatcher
|
|
|
|
|
KiUserExceptionDispatcher
|
|
|
|
|
LdrAccessResource
|
|
|
|
|
LdrAddRefDll
|
|
|
|
|
LdrDisableThreadCalloutsForDll
|
|
|
|
|
LdrEnumResources
|
|
|
|
|
LdrFindEntryForAddress
|
|
|
|
|
LdrFindResourceDirectory_U
|
|
|
|
|
LdrFindResource_U
|
|
|
|
|
LdrGetDllHandle
|
|
|
|
|
LdrGetProcedureAddress
|
|
|
|
|
LdrInitializeThunk
|
|
|
|
|
LdrLoadDll
|
|
|
|
|
LdrLockLoaderLock
|
|
|
|
|
LdrProcessRelocationBlock
|
|
|
|
|
LdrQueryImageFileExecutionOptions
|
|
|
|
|
LdrQueryProcessModuleInformation
|
|
|
|
|
LdrShutdownProcess
|
|
|
|
|
LdrShutdownThread
|
|
|
|
|
LdrUnloadAlternateResourceModule
|
|
|
|
|
LdrUnloadDll
|
|
|
|
|
LdrUnlockLoaderLock
|
|
|
|
|
LdrVerifyImageMatchesChecksum
|
|
|
|
|
NlsAnsiCodePage
|
|
|
|
|
NlsMbCodePageTag
|
|
|
|
|
NlsMbOemCodePageTag
|
|
|
|
|
NtAcceptConnectPort
|
|
|
|
|
NtAccessCheck
|
|
|
|
|
NtAccessCheckAndAuditAlarm
|
|
|
|
|
NtAccessCheckByType
|
|
|
|
|
NtAccessCheckByTypeAndAuditAlarm
|
|
|
|
|
NtAccessCheckByTypeResultList
|
|
|
|
|
NtAccessCheckByTypeResultListAndAuditAlarm
|
|
|
|
|
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
|
|
|
|
|
NtAddAtom
|
|
|
|
|
NtAddBootEntry
|
|
|
|
|
NtAddDriverEntry
|
|
|
|
|
NtAdjustGroupsToken
|
|
|
|
|
NtAdjustPrivilegesToken
|
|
|
|
|
NtAlertResumeThread
|
|
|
|
|
NtAlertThread
|
|
|
|
|
NtAllocateLocallyUniqueId
|
|
|
|
|
NtAllocateUserPhysicalPages
|
|
|
|
|
NtAllocateUuids
|
|
|
|
|
NtAllocateVirtualMemory
|
|
|
|
|
NtApphelpCacheControl
|
|
|
|
|
NtAreMappedFilesTheSame
|
|
|
|
|
NtAssignProcessToJobObject
|
|
|
|
|
NtCallbackReturn
|
|
|
|
|
NtCancelDeviceWakeupRequest
|
|
|
|
|
NtCancelIoFile
|
|
|
|
|
NtCancelTimer
|
|
|
|
|
NtClearEvent
|
|
|
|
|
NtClose
|
|
|
|
|
NtCloseObjectAuditAlarm
|
|
|
|
|
NtCompactKeys
|
|
|
|
|
NtCompareTokens
|
|
|
|
|
NtCompleteConnectPort
|
|
|
|
|
NtCompressKey
|
|
|
|
|
NtConnectPort
|
|
|
|
|
NtContinue
|
|
|
|
|
NtCreateDebugObject
|
|
|
|
|
NtCreateDirectoryObject
|
|
|
|
|
NtCreateEvent
|
|
|
|
|
NtCreateEventPair
|
|
|
|
|
NtCreateFile
|
|
|
|
|
NtCreateIoCompletion
|
|
|
|
|
NtCreateJobObject
|
|
|
|
|
NtCreateJobSet
|
|
|
|
|
NtCreateKey
|
|
|
|
|
NtCreateKeyedEvent
|
|
|
|
|
NtCreateMailslotFile
|
|
|
|
|
NtCreateMutant
|
|
|
|
|
NtCreateNamedPipeFile
|
|
|
|
|
NtCreatePagingFile
|
|
|
|
|
NtCreatePort
|
|
|
|
|
NtCreateProcess
|
|
|
|
|
NtCreateProcessEx
|
|
|
|
|
NtCreateProfile
|
|
|
|
|
NtCreateSection
|
|
|
|
|
NtCreateSemaphore
|
|
|
|
|
NtCreateSymbolicLinkObject
|
|
|
|
|
NtCreateThread
|
|
|
|
|
NtCreateTimer
|
|
|
|
|
NtCreateToken
|
|
|
|
|
NtCreateWaitablePort
|
|
|
|
|
NtCurrentTeb=_NtCurrentTeb
|
|
|
|
|
NtDebugActiveProcess
|
|
|
|
|
NtDebugContinue
|
|
|
|
|
NtDelayExecution
|
|
|
|
|
NtDeleteAtom
|
|
|
|
|
NtDeleteBootEntry
|
|
|
|
|
NtDeleteFile
|
|
|
|
|
NtDeleteKey
|
|
|
|
|
NtDeleteObjectAuditAlarm
|
|
|
|
|
NtDeleteValueKey
|
|
|
|
|
NtDeviceIoControlFile
|
|
|
|
|
NtDisplayString
|
|
|
|
|
NtDuplicateObject
|
|
|
|
|
NtDuplicateToken
|
|
|
|
|
NtEnumerateBootEntries
|
|
|
|
|
NtEnumerateKey
|
|
|
|
|
NtEnumerateSystemEnvironmentValuesEx
|
|
|
|
|
NtEnumerateValueKey
|
|
|
|
|
NtExtendSection
|
|
|
|
|
NtFilterToken
|
|
|
|
|
NtFindAtom
|
|
|
|
|
NtFlushBuffersFile
|
|
|
|
|
NtFlushInstructionCache
|
|
|
|
|
NtFlushKey
|
|
|
|
|
NtFlushVirtualMemory
|
|
|
|
|
NtFlushWriteBuffer
|
|
|
|
|
NtFreeUserPhysicalPages
|
|
|
|
|
NtFreeVirtualMemory
|
|
|
|
|
NtFsControlFile
|
|
|
|
|
NtGetContextThread
|
|
|
|
|
NtGetCurrentProcessorNumber
|
|
|
|
|
NtGetDevicePowerState
|
|
|
|
|
NtGetPlugPlayEvent
|
|
|
|
|
NtGetWriteWatch
|
|
|
|
|
NtImpersonateAnonymousToken
|
|
|
|
|
NtImpersonateClientOfPort
|
|
|
|
|
NtImpersonateThread
|
|
|
|
|
NtInitializeRegistry
|
|
|
|
|
NtInitiatePowerAction
|
|
|
|
|
NtIsProcessInJob
|
|
|
|
|
NtIsSystemResumeAutomatic
|
|
|
|
|
NtListenPort
|
|
|
|
|
NtLoadDriver
|
|
|
|
|
NtLoadKey2
|
|
|
|
|
NtLoadKey
|
|
|
|
|
NtLockFile
|
|
|
|
|
NtLockProductActivationKeys
|
|
|
|
|
NtLockRegistryKey
|
|
|
|
|
NtLockVirtualMemory
|
|
|
|
|
NtMakePermanentObject
|
|
|
|
|
NtMakeTemporaryObject
|
|
|
|
|
NtMapUserPhysicalPages
|
|
|
|
|
NtMapUserPhysicalPagesScatter
|
|
|
|
|
NtMapViewOfSection
|
|
|
|
|
NtModifyBootEntry
|
|
|
|
|
NtNotifyChangeDirectoryFile
|
|
|
|
|
NtNotifyChangeKey
|
|
|
|
|
NtNotifyChangeMultipleKeys
|
|
|
|
|
NtOpenDirectoryObject
|
|
|
|
|
NtOpenEvent
|
|
|
|
|
NtOpenEventPair
|
|
|
|
|
NtOpenFile
|
|
|
|
|
NtOpenIoCompletion
|
|
|
|
|
NtOpenJobObject
|
|
|
|
|
NtOpenKey
|
|
|
|
|
NtOpenKeyedEvent
|
|
|
|
|
NtOpenMutant
|
|
|
|
|
NtOpenObjectAuditAlarm
|
|
|
|
|
NtOpenProcess
|
|
|
|
|
NtOpenProcessToken
|
|
|
|
|
NtOpenProcessTokenEx
|
|
|
|
|
NtOpenSection
|
|
|
|
|
NtOpenSemaphore
|
|
|
|
|
NtOpenSymbolicLinkObject
|
|
|
|
|
NtOpenThread
|
|
|
|
|
NtOpenThreadToken
|
|
|
|
|
NtOpenThreadTokenEx
|
|
|
|
|
NtOpenTimer
|
|
|
|
|
NtPlugPlayControl
|
|
|
|
|
NtPowerInformation
|
|
|
|
|
NtPrivilegeCheck
|
|
|
|
|
NtPrivilegeObjectAuditAlarm
|
|
|
|
|
NtPrivilegedServiceAuditAlarm
|
|
|
|
|
NtProtectVirtualMemory
|
|
|
|
|
NtPulseEvent
|
|
|
|
|
NtQueryAttributesFile
|
|
|
|
|
NtQueryBootEntryOrder
|
|
|
|
|
NtQueryBootOptions
|
|
|
|
|
NtQueryDebugFilterState
|
|
|
|
|
NtQueryDefaultLocale
|
|
|
|
|
NtQueryDefaultUILanguage
|
|
|
|
|
NtQueryDirectoryFile
|
|
|
|
|
NtQueryDirectoryObject
|
|
|
|
|
NtQueryEaFile
|
|
|
|
|
NtQueryEvent
|
|
|
|
|
NtQueryFullAttributesFile
|
|
|
|
|
NtQueryInformationAtom
|
|
|
|
|
NtQueryInformationFile
|
|
|
|
|
NtQueryInformationJobObject
|
|
|
|
|
NtQueryInformationPort
|
|
|
|
|
NtQueryInformationProcess
|
|
|
|
|
NtQueryInformationThread
|
|
|
|
|
NtQueryInformationToken
|
|
|
|
|
NtQueryInstallUILanguage
|
|
|
|
|
NtQueryIntervalProfile
|
|
|
|
|
NtQueryIoCompletion
|
|
|
|
|
NtQueryKey
|
|
|
|
|
NtQueryMultipleValueKey
|
|
|
|
|
NtQueryMutant
|
|
|
|
|
NtQueryObject
|
|
|
|
|
NtQueryOpenSubKeys
|
|
|
|
|
NtQueryPerformanceCounter
|
|
|
|
|
NtQueryPortInformationProcess
|
|
|
|
|
NtQueryQuotaInformationFile
|
|
|
|
|
NtQuerySection
|
|
|
|
|
NtQuerySecurityObject
|
|
|
|
|
NtQuerySemaphore
|
|
|
|
|
NtQuerySymbolicLinkObject
|
|
|
|
|
NtQuerySystemEnvironmentValue
|
|
|
|
|
NtQuerySystemEnvironmentValueEx
|
|
|
|
|
NtQuerySystemInformation
|
|
|
|
|
NtQuerySystemTime
|
|
|
|
|
NtQueryTimer
|
|
|
|
|
NtQueryTimerResolution
|
|
|
|
|
NtQueryValueKey
|
|
|
|
|
NtQueryVirtualMemory
|
|
|
|
|
NtQueryVolumeInformationFile
|
|
|
|
|
NtQueueApcThread
|
|
|
|
|
NtRaiseException
|
|
|
|
|
NtRaiseHardError
|
|
|
|
|
NtReadFile
|
|
|
|
|
NtReadFileScatter
|
|
|
|
|
NtReadRequestData
|
|
|
|
|
NtReadVirtualMemory
|
|
|
|
|
NtRegisterThreadTerminatePort
|
|
|
|
|
NtReleaseKeyedEvent
|
|
|
|
|
NtReleaseMutant
|
|
|
|
|
NtReleaseSemaphore
|
|
|
|
|
NtRemoveIoCompletion
|
|
|
|
|
NtRemoveProcessDebug
|
|
|
|
|
NtRenameKey
|
|
|
|
|
NtReplaceKey
|
|
|
|
|
NtReplyPort
|
|
|
|
|
NtReplyWaitReceivePort
|
|
|
|
|
NtReplyWaitReceivePortEx
|
|
|
|
|
NtReplyWaitReplyPort
|
|
|
|
|
NtRequestDeviceWakeup
|
|
|
|
|
NtRequestPort
|
|
|
|
|
NtRequestWaitReplyPort
|
|
|
|
|
NtRequestWakeupLatency
|
|
|
|
|
NtResetEvent
|
|
|
|
|
NtResetWriteWatch
|
|
|
|
|
NtRestoreKey
|
|
|
|
|
NtResumeProcess
|
|
|
|
|
NtResumeThread
|
|
|
|
|
NtSaveKey
|
|
|
|
|
NtSaveKeyEx
|
|
|
|
|
NtSaveMergedKeys
|
|
|
|
|
NtSecureConnectPort
|
|
|
|
|
NtSetBootEntryOrder
|
|
|
|
|
NtSetBootOptions
|
|
|
|
|
NtSetContextThread
|
|
|
|
|
NtSetDebugFilterState
|
|
|
|
|
NtSetDefaultHardErrorPort
|
|
|
|
|
NtSetDefaultLocale
|
|
|
|
|
NtSetDefaultUILanguage
|
|
|
|
|
NtSetEaFile
|
|
|
|
|
NtSetEvent
|
|
|
|
|
NtSetEventBoostPriority
|
|
|
|
|
NtSetHighEventPair
|
|
|
|
|
NtSetHighWaitLowEventPair
|
|
|
|
|
NtSetInformationDebugObject
|
|
|
|
|
NtSetInformationFile
|
|
|
|
|
NtSetInformationJobObject
|
|
|
|
|
NtSetInformationKey
|
|
|
|
|
NtSetInformationObject
|
|
|
|
|
NtSetInformationProcess
|
|
|
|
|
NtSetInformationThread
|
|
|
|
|
NtSetInformationToken
|
|
|
|
|
NtSetIntervalProfile
|
|
|
|
|
NtSetIoCompletion
|
|
|
|
|
NtSetLdtEntries
|
|
|
|
|
NtSetLowEventPair
|
|
|
|
|
NtSetLowWaitHighEventPair
|
|
|
|
|
NtSetQuotaInformationFile
|
|
|
|
|
NtSetSecurityObject
|
|
|
|
|
NtSetSystemEnvironmentValue
|
|
|
|
|
NtSetSystemEnvironmentValueEx
|
|
|
|
|
NtSetSystemInformation
|
|
|
|
|
NtSetSystemPowerState
|
|
|
|
|
NtSetSystemTime
|
|
|
|
|
NtSetThreadExecutionState
|
|
|
|
|
NtSetTimer
|
|
|
|
|
NtSetTimerResolution
|
|
|
|
|
NtSetUuidSeed
|
|
|
|
|
NtSetValueKey
|
|
|
|
|
NtSetVolumeInformationFile
|
|
|
|
|
NtShutdownSystem
|
|
|
|
|
NtSignalAndWaitForSingleObject
|
|
|
|
|
NtStartProfile
|
|
|
|
|
NtStopProfile
|
|
|
|
|
NtSuspendProcess
|
|
|
|
|
NtSuspendThread
|
|
|
|
|
NtSystemDebugControl
|
|
|
|
|
NtTerminateJobObject
|
|
|
|
|
NtTerminateProcess
|
|
|
|
|
NtTerminateThread
|
|
|
|
|
NtTestAlert
|
|
|
|
|
NtTraceEvent
|
|
|
|
|
NtTranslateFilePath
|
|
|
|
|
NtUnloadDriver
|
|
|
|
|
NtUnloadKey
|
|
|
|
|
NtUnloadKeyEx
|
|
|
|
|
NtUnlockFile
|
|
|
|
|
NtUnlockVirtualMemory
|
|
|
|
|
NtUnmapViewOfSection
|
|
|
|
|
NtVdmControl
|
|
|
|
|
NtWaitForDebugEvent
|
|
|
|
|
NtWaitForKeyedEvent
|
|
|
|
|
NtWaitForMultipleObjects
|
|
|
|
|
NtWaitForSingleObject
|
|
|
|
|
NtWaitHighEventPair
|
|
|
|
|
NtWaitLowEventPair
|
|
|
|
|
NtWriteFile
|
|
|
|
|
NtWriteFileGather
|
|
|
|
|
NtWriteRequestData
|
|
|
|
|
NtWriteVirtualMemory
|
|
|
|
|
NtYieldExecution
|
2010-08-13 14:12:45 +00:00
|
|
|
RtlAbsoluteToSelfRelativeSD
|
|
|
|
|
RtlAcquirePebLock
|
|
|
|
|
RtlAcquireResourceExclusive
|
|
|
|
|
RtlAcquireResourceShared
|
|
|
|
|
RtlAcquireSRWLockExclusive
|
|
|
|
|
RtlAcquireSRWLockShared
|
|
|
|
|
RtlActivateActivationContext
|
|
|
|
|
RtlActivateActivationContextUnsafeFast
|
|
|
|
|
RtlAddAccessAllowedAce
|
|
|
|
|
RtlAddAccessAllowedAceEx
|
|
|
|
|
RtlAddAccessAllowedObjectAce
|
|
|
|
|
RtlAddAccessDeniedAce
|
|
|
|
|
RtlAddAccessDeniedAceEx
|
|
|
|
|
RtlAddAccessDeniedObjectAce
|
|
|
|
|
RtlAddAce
|
|
|
|
|
RtlAddAtomToAtomTable
|
|
|
|
|
RtlAddAuditAccessAce
|
|
|
|
|
RtlAddAuditAccessAceEx
|
|
|
|
|
RtlAddAuditAccessObjectAce
|
|
|
|
|
RtlAddMandatoryAce
|
|
|
|
|
RtlAddRefActivationContext
|
|
|
|
|
RtlAddVectoredExceptionHandler
|
|
|
|
|
RtlAdjustPrivilege
|
|
|
|
|
RtlAllocateActivationContextStack
|
|
|
|
|
RtlAllocateAndInitializeSid
|
|
|
|
|
RtlAllocateHandle
|
|
|
|
|
RtlAllocateHeap
|
|
|
|
|
RtlAnsiCharToUnicodeChar
|
|
|
|
|
RtlAnsiStringToUnicodeSize=RtlxAnsiStringToUnicodeSize
|
|
|
|
|
RtlAnsiStringToUnicodeString
|
|
|
|
|
RtlAppendAsciizToString
|
|
|
|
|
RtlAppendStringToString
|
|
|
|
|
RtlAppendUnicodeStringToString
|
|
|
|
|
RtlAppendUnicodeToString
|
|
|
|
|
RtlAreAllAccessesGranted
|
|
|
|
|
RtlAreAnyAccessesGranted
|
|
|
|
|
RtlAreBitsClear
|
|
|
|
|
RtlAreBitsSet
|
|
|
|
|
RtlAssert
|
|
|
|
|
RtlCaptureContext
|
|
|
|
|
RtlCaptureStackBackTrace
|
|
|
|
|
RtlCharToInteger
|
|
|
|
|
RtlCheckRegistryKey
|
|
|
|
|
RtlClearAllBits
|
|
|
|
|
RtlClearBits
|
|
|
|
|
RtlCompactHeap
|
|
|
|
|
RtlCompareMemory
|
|
|
|
|
RtlCompareMemoryUlong
|
|
|
|
|
RtlCompareString
|
|
|
|
|
RtlCompareUnicodeString
|
|
|
|
|
RtlCompressBuffer
|
|
|
|
|
RtlComputeCrc32
|
|
|
|
|
RtlConvertExclusiveToShared
|
|
|
|
|
RtlConvertLongToLargeInteger
|
|
|
|
|
RtlConvertSharedToExclusive
|
|
|
|
|
RtlConvertSidToUnicodeString
|
|
|
|
|
RtlConvertUlongToLargeInteger
|
|
|
|
|
RtlCopyLuid
|
|
|
|
|
RtlCopyLuidAndAttributesArray
|
|
|
|
|
RtlCopySecurityDescriptor
|
|
|
|
|
RtlCopySid
|
|
|
|
|
RtlCopySidAndAttributesArray
|
|
|
|
|
RtlCopyString
|
|
|
|
|
RtlCopyUnicodeString
|
|
|
|
|
RtlCreateAcl
|
|
|
|
|
RtlCreateActivationContext
|
|
|
|
|
RtlCreateAtomTable
|
|
|
|
|
RtlCreateBootStatusDataFile
|
|
|
|
|
RtlCreateEnvironment
|
|
|
|
|
RtlCreateHeap
|
|
|
|
|
RtlCreateProcessParameters
|
|
|
|
|
RtlCreateQueryDebugBuffer
|
|
|
|
|
RtlCreateRegistryKey
|
|
|
|
|
RtlCreateSecurityDescriptor
|
|
|
|
|
RtlCreateSystemVolumeInformationFolder
|
|
|
|
|
RtlCreateTagHeap
|
|
|
|
|
RtlCreateTimer
|
|
|
|
|
RtlCreateTimerQueue
|
|
|
|
|
RtlCreateUnicodeString
|
|
|
|
|
RtlCreateUnicodeStringFromAsciiz
|
|
|
|
|
RtlCreateUserProcess
|
|
|
|
|
RtlCreateUserThread
|
|
|
|
|
RtlCustomCPToUnicodeN
|
|
|
|
|
RtlCutoverTimeToSystemTime
|
|
|
|
|
RtlDeNormalizeProcessParams
|
|
|
|
|
RtlDeactivateActivationContext
|
|
|
|
|
RtlDeactivateActivationContextUnsafeFast
|
|
|
|
|
RtlDecodePointer
|
|
|
|
|
RtlDecodeSystemPointer=RtlEncodeSystemPointer
|
|
|
|
|
RtlDecompressBuffer
|
|
|
|
|
RtlDecompressFragment
|
|
|
|
|
RtlDelete
|
|
|
|
|
RtlDeleteAce
|
|
|
|
|
RtlDeleteAtomFromAtomTable
|
|
|
|
|
RtlDeleteCriticalSection
|
|
|
|
|
RtlDeleteElementGenericTable
|
|
|
|
|
RtlDeleteElementGenericTableAvl
|
|
|
|
|
RtlDeleteNoSplay
|
|
|
|
|
RtlDeleteOwnersRanges
|
|
|
|
|
RtlDeleteRange
|
|
|
|
|
RtlDeleteRegistryValue
|
|
|
|
|
RtlDeleteResource
|
|
|
|
|
RtlDeleteSecurityObject
|
|
|
|
|
RtlDeleteTimer
|
|
|
|
|
RtlDeleteTimerQueue
|
|
|
|
|
RtlDeleteTimerQueueEx
|
|
|
|
|
RtlDeregisterWait
|
|
|
|
|
RtlDeregisterWaitEx
|
|
|
|
|
RtlDestroyAtomTable
|
|
|
|
|
RtlDestroyEnvironment
|
|
|
|
|
RtlDestroyHandleTable
|
|
|
|
|
RtlDestroyHeap
|
|
|
|
|
RtlDestroyProcessParameters
|
|
|
|
|
RtlDestroyQueryDebugBuffer
|
|
|
|
|
RtlDetermineDosPathNameType_U
|
|
|
|
|
RtlDllShutdownInProgress
|
|
|
|
|
RtlDnsHostNameToComputerName
|
|
|
|
|
RtlDoesFileExists_U
|
|
|
|
|
RtlDosPathNameToNtPathName_U
|
|
|
|
|
RtlDosPathNameToRelativeNtPathName_U
|
|
|
|
|
RtlDosSearchPath_U
|
|
|
|
|
RtlDowncaseUnicodeChar
|
|
|
|
|
RtlDowncaseUnicodeString
|
|
|
|
|
RtlDumpResource
|
|
|
|
|
RtlDuplicateUnicodeString
|
|
|
|
|
RtlEmptyAtomTable
|
|
|
|
|
RtlEncodePointer
|
|
|
|
|
RtlEncodeSystemPointer
|
|
|
|
|
RtlEnlargedIntegerMultiply
|
|
|
|
|
RtlEnlargedUnsignedDivide
|
|
|
|
|
RtlEnlargedUnsignedMultiply
|
|
|
|
|
RtlEnterCriticalSection
|
|
|
|
|
RtlEnumProcessHeaps
|
|
|
|
|
RtlEnumerateGenericTable
|
|
|
|
|
RtlEnumerateGenericTableAvl
|
|
|
|
|
RtlEnumerateGenericTableLikeADirectory
|
|
|
|
|
RtlEnumerateGenericTableWithoutSplaying
|
|
|
|
|
RtlEnumerateGenericTableWithoutSplayingAvl
|
|
|
|
|
RtlEqualComputerName
|
|
|
|
|
RtlEqualDomainName
|
|
|
|
|
RtlEqualLuid
|
|
|
|
|
RtlEqualPrefixSid
|
|
|
|
|
RtlEqualSid
|
|
|
|
|
RtlEqualString
|
|
|
|
|
RtlEqualUnicodeString
|
|
|
|
|
RtlEraseUnicodeString
|
|
|
|
|
RtlExitUserThread
|
|
|
|
|
RtlExpandEnvironmentStrings_U
|
|
|
|
|
RtlExtendHeap
|
|
|
|
|
RtlExtendedIntegerMultiply
|
|
|
|
|
RtlExtendedLargeIntegerDivide
|
|
|
|
|
RtlExtendedMagicDivide
|
|
|
|
|
RtlFillMemory
|
|
|
|
|
RtlFillMemoryUlong
|
|
|
|
|
RtlFindActivationContextSectionString
|
|
|
|
|
RtlFindCharInUnicodeString
|
|
|
|
|
RtlFindClearBits
|
|
|
|
|
RtlFindClearBitsAndSet
|
|
|
|
|
RtlFindClearRuns
|
|
|
|
|
RtlFindLastBackwardRunClear
|
|
|
|
|
RtlFindLeastSignificantBit
|
|
|
|
|
RtlFindLongestRunClear
|
|
|
|
|
RtlFindLongestRunSet
|
|
|
|
|
RtlFindMessage
|
|
|
|
|
RtlFindMostSignificantBit
|
|
|
|
|
RtlFindNextForwardRunClear
|
|
|
|
|
RtlFindRange
|
|
|
|
|
RtlFindSetBits
|
|
|
|
|
RtlFindSetBitsAndClear
|
|
|
|
|
RtlFirstEntrySList
|
|
|
|
|
RtlFirstFreeAce
|
|
|
|
|
RtlFlushSecureMemoryCache
|
|
|
|
|
RtlFormatCurrentUserKeyPath
|
|
|
|
|
RtlFormatMessage
|
|
|
|
|
RtlFreeAnsiString
|
|
|
|
|
RtlFreeHandle
|
|
|
|
|
RtlFreeHeap
|
|
|
|
|
RtlFreeOemString
|
|
|
|
|
RtlFreeRangeList
|
|
|
|
|
RtlFreeSid
|
|
|
|
|
RtlFreeThreadActivationContextStack
|
|
|
|
|
RtlFreeUnicodeString
|
|
|
|
|
RtlFreeUserThreadStack
|
|
|
|
|
RtlGUIDFromString
|
|
|
|
|
RtlGenerate8dot3Name
|
|
|
|
|
RtlGetAce
|
|
|
|
|
RtlGetActiveActivationContext
|
|
|
|
|
RtlGetCallersAddress
|
|
|
|
|
RtlGetCompressionWorkSpaceSize
|
|
|
|
|
RtlGetControlSecurityDescriptor
|
|
|
|
|
RtlGetCurrentDirectory_U
|
|
|
|
|
RtlGetCurrentPeb
|
|
|
|
|
RtlGetCurrentProcessorNumber
|
|
|
|
|
RtlGetDaclSecurityDescriptor
|
|
|
|
|
RtlGetElementGenericTable
|
|
|
|
|
RtlGetElementGenericTableAvl
|
|
|
|
|
RtlGetFirstRange
|
|
|
|
|
RtlGetFullPathName_U
|
|
|
|
|
RtlGetGroupSecurityDescriptor
|
|
|
|
|
RtlGetLastNtStatus
|
|
|
|
|
RtlGetLastWin32Error
|
|
|
|
|
RtlGetLongestNtPathLength
|
|
|
|
|
RtlGetNextRange
|
|
|
|
|
RtlGetNtGlobalFlags
|
|
|
|
|
RtlGetNtProductType
|
|
|
|
|
RtlGetNtVersionNumbers
|
|
|
|
|
RtlGetOwnerSecurityDescriptor
|
|
|
|
|
RtlGetProcessHeaps
|
|
|
|
|
RtlGetSaclSecurityDescriptor
|
|
|
|
|
RtlGetSecurityDescriptorRMControl
|
|
|
|
|
RtlGetSetBootStatusData
|
|
|
|
|
RtlGetUserInfoHeap
|
|
|
|
|
RtlGetVersion
|
|
|
|
|
RtlHashUnicodeString
|
|
|
|
|
RtlIdentifierAuthoritySid
|
|
|
|
|
RtlImageDirectoryEntryToData
|
|
|
|
|
RtlImageNtHeader
|
|
|
|
|
RtlImageRvaToSection
|
|
|
|
|
RtlImageRvaToVa
|
|
|
|
|
RtlImpersonateSelf
|
|
|
|
|
RtlInitAnsiString
|
|
|
|
|
RtlInitAnsiStringEx
|
|
|
|
|
RtlInitCodePageTable
|
|
|
|
|
RtlInitNlsTables
|
|
|
|
|
RtlInitString
|
|
|
|
|
RtlInitUnicodeString
|
|
|
|
|
RtlInitUnicodeStringEx
|
|
|
|
|
RtlInitializeBitMap
|
|
|
|
|
RtlInitializeContext
|
|
|
|
|
RtlInitializeCriticalSection
|
|
|
|
|
RtlInitializeCriticalSectionAndSpinCount
|
|
|
|
|
RtlInitializeGenericTable
|
|
|
|
|
RtlInitializeGenericTableAvl
|
|
|
|
|
RtlInitializeHandleTable
|
|
|
|
|
RtlInitializeRangeList
|
|
|
|
|
RtlInitializeResource
|
|
|
|
|
RtlInitializeSListHead
|
|
|
|
|
RtlInitializeSid
|
|
|
|
|
RtlInitializeSRWLock
|
|
|
|
|
RtlInsertElementGenericTable
|
|
|
|
|
RtlInsertElementGenericTableAvl
|
|
|
|
|
RtlInt64ToUnicodeString
|
|
|
|
|
RtlIntegerToChar
|
|
|
|
|
RtlIntegerToUnicodeString
|
|
|
|
|
RtlInterlockedFlushSList
|
|
|
|
|
RtlInterlockedPopEntrySList
|
|
|
|
|
RtlInterlockedPushEntrySList
|
|
|
|
|
RtlInterlockedPushListSList
|
|
|
|
|
RtlInvertRangeList
|
|
|
|
|
RtlIpv4AddressToStringA
|
|
|
|
|
RtlIpv4AddressToStringExA
|
|
|
|
|
RtlIpv4AddressToStringExW
|
|
|
|
|
RtlIpv4AddressToStringW
|
|
|
|
|
RtlIpv4StringToAddressA
|
|
|
|
|
RtlIpv4StringToAddressExA
|
|
|
|
|
RtlIpv4StringToAddressExW
|
|
|
|
|
RtlIpv4StringToAddressW
|
|
|
|
|
RtlIpv6AddressToStringA
|
|
|
|
|
RtlIpv6AddressToStringExA
|
|
|
|
|
RtlIpv6AddressToStringExW
|
|
|
|
|
RtlIpv6AddressToStringW
|
|
|
|
|
RtlIpv6StringToAddressA
|
|
|
|
|
RtlIpv6StringToAddressExA
|
|
|
|
|
RtlIpv6StringToAddressExW
|
|
|
|
|
RtlIpv6StringToAddressW
|
|
|
|
|
RtlIsActivationContextActive
|
|
|
|
|
RtlIsDosDeviceName_U
|
|
|
|
|
RtlIsGenericTableEmpty
|
|
|
|
|
RtlIsGenericTableEmptyAvl
|
|
|
|
|
RtlIsNameLegalDOS8Dot3
|
|
|
|
|
RtlIsRangeAvailable
|
|
|
|
|
RtlIsTextUnicode
|
|
|
|
|
RtlIsThreadWithinLoaderCallout
|
|
|
|
|
RtlIsValidHandle
|
|
|
|
|
RtlIsValidIndexHandle
|
|
|
|
|
RtlLargeIntegerAdd
|
|
|
|
|
RtlLargeIntegerArithmeticShift
|
|
|
|
|
RtlLargeIntegerDivide
|
|
|
|
|
RtlLargeIntegerNegate
|
|
|
|
|
RtlLargeIntegerShiftLeft
|
|
|
|
|
RtlLargeIntegerShiftRight
|
|
|
|
|
RtlLargeIntegerSubtract
|
|
|
|
|
RtlLargeIntegerToChar
|
|
|
|
|
RtlLeaveCriticalSection
|
|
|
|
|
RtlLengthRequiredSid
|
|
|
|
|
RtlLengthSecurityDescriptor
|
|
|
|
|
RtlLengthSid
|
|
|
|
|
RtlLocalTimeToSystemTime
|
|
|
|
|
RtlLockBootStatusData
|
|
|
|
|
RtlLockHeap
|
|
|
|
|
RtlLookupAtomInAtomTable
|
|
|
|
|
RtlLookupElementGenericTable
|
|
|
|
|
RtlLookupElementGenericTableAvl
|
|
|
|
|
RtlMakeSelfRelativeSD
|
|
|
|
|
RtlMapGenericMask
|
|
|
|
|
RtlMergeRangeLists
|
|
|
|
|
RtlMoveMemory
|
|
|
|
|
RtlMultiByteToUnicodeN
|
|
|
|
|
RtlMultiByteToUnicodeSize
|
|
|
|
|
RtlNewSecurityObject
|
|
|
|
|
RtlNormalizeProcessParams
|
|
|
|
|
RtlNtPathNameToDosPathName
|
|
|
|
|
RtlNtStatusToDosError
|
|
|
|
|
RtlNtStatusToDosErrorNoTeb
|
|
|
|
|
RtlNumberGenericTableElements
|
|
|
|
|
RtlNumberGenericTableElementsAvl
|
|
|
|
|
RtlNumberOfClearBits
|
|
|
|
|
RtlNumberOfSetBits
|
|
|
|
|
RtlOemStringToUnicodeString
|
|
|
|
|
RtlOemToUnicodeN
|
|
|
|
|
RtlOpenCurrentUser
|
|
|
|
|
RtlPcToFileHeader
|
|
|
|
|
RtlPinAtomInAtomTable
|
|
|
|
|
RtlPrefixString
|
|
|
|
|
RtlPrefixUnicodeString
|
|
|
|
|
RtlProtectHeap
|
|
|
|
|
RtlQueryAtomInAtomTable
|
|
|
|
|
RtlQueryDepthSList
|
|
|
|
|
RtlQueryEnvironmentVariable_U
|
|
|
|
|
RtlQueryHeapInformation
|
|
|
|
|
RtlQueryInformationAcl
|
|
|
|
|
RtlQueryInformationActivationContext
|
|
|
|
|
RtlQueryProcessDebugInformation
|
|
|
|
|
RtlQueryRegistryValues
|
|
|
|
|
RtlQuerySecurityObject
|
|
|
|
|
RtlQueryTagHeap
|
|
|
|
|
RtlQueryTimeZoneInformation
|
|
|
|
|
RtlQueueWorkItem
|
|
|
|
|
RtlRaiseException
|
|
|
|
|
RtlRaiseStatus
|
|
|
|
|
RtlRandom
|
|
|
|
|
RtlRandomEx
|
|
|
|
|
RtlReAllocateHeap
|
|
|
|
|
RtlRealPredecessor
|
|
|
|
|
RtlRealSuccessor
|
|
|
|
|
RtlRegisterSecureMemoryCacheCallback
|
|
|
|
|
RtlRegisterWait
|
|
|
|
|
RtlReleaseActivationContext
|
|
|
|
|
RtlReleasePebLock
|
|
|
|
|
RtlReleaseResource
|
|
|
|
|
RtlReleaseSRWLockExclusive
|
|
|
|
|
RtlReleaseSRWLockShared
|
|
|
|
|
RtlRemoteCall
|
|
|
|
|
RtlRemoveVectoredExceptionHandler
|
|
|
|
|
RtlResetRtlTranslations
|
|
|
|
|
RtlRestoreLastWin32Error=RtlSetLastWin32Error
|
|
|
|
|
RtlRunDecodeUnicodeString
|
|
|
|
|
RtlRunEncodeUnicodeString
|
|
|
|
|
RtlSecondsSince1970ToTime
|
|
|
|
|
RtlSecondsSince1980ToTime
|
|
|
|
|
RtlSelfRelativeToAbsoluteSD2
|
|
|
|
|
RtlSelfRelativeToAbsoluteSD
|
|
|
|
|
RtlSetAllBits
|
|
|
|
|
RtlSetAttributesSecurityDescriptor
|
|
|
|
|
RtlSetBits
|
|
|
|
|
RtlSetControlSecurityDescriptor
|
|
|
|
|
RtlSetCriticalSectionSpinCount
|
|
|
|
|
RtlSetCurrentDirectory_U
|
|
|
|
|
RtlSetCurrentEnvironment
|
|
|
|
|
RtlSetDaclSecurityDescriptor
|
|
|
|
|
RtlSetEnvironmentVariable
|
|
|
|
|
RtlSetGroupSecurityDescriptor
|
|
|
|
|
RtlSetHeapInformation
|
|
|
|
|
RtlSetInformationAcl
|
|
|
|
|
RtlSetIoCompletionCallback
|
|
|
|
|
RtlSetLastWin32Error
|
|
|
|
|
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
|
|
|
|
|
RtlSetOwnerSecurityDescriptor
|
|
|
|
|
RtlSetProcessIsCritical
|
|
|
|
|
RtlSetSaclSecurityDescriptor
|
|
|
|
|
RtlSetSecurityDescriptorRMControl
|
|
|
|
|
RtlSetSecurityObject
|
|
|
|
|
RtlSetTimeZoneInformation
|
|
|
|
|
RtlSetUnhandledExceptionFilter
|
|
|
|
|
RtlSetUserFlagsHeap
|
|
|
|
|
RtlSetUserValueHeap
|
|
|
|
|
RtlSizeHeap
|
|
|
|
|
RtlSleepConditionVariableCS
|
|
|
|
|
RtlSleepConditionVariableSRW
|
|
|
|
|
RtlSplay
|
|
|
|
|
RtlStringFromGUID
|
|
|
|
|
RtlSubAuthorityCountSid
|
|
|
|
|
RtlSubAuthoritySid
|
|
|
|
|
RtlSubtreePredecessor
|
|
|
|
|
RtlSubtreeSuccessor
|
|
|
|
|
RtlSystemTimeToLocalTime
|
|
|
|
|
RtlTimeFieldsToTime
|
|
|
|
|
RtlTimeToElapsedTimeFields
|
|
|
|
|
RtlTimeToSecondsSince1970
|
|
|
|
|
RtlTimeToSecondsSince1980
|
|
|
|
|
RtlTimeToTimeFields
|
|
|
|
|
RtlTryEnterCriticalSection
|
|
|
|
|
RtlUlongByteSwap
|
|
|
|
|
RtlUlonglongByteSwap
|
|
|
|
|
RtlUnhandledExceptionFilter
|
|
|
|
|
RtlUnicodeStringToAnsiString
|
|
|
|
|
RtlUnicodeStringToCountedOemString
|
|
|
|
|
RtlUnicodeStringToInteger
|
|
|
|
|
RtlUnicodeStringToOemString
|
|
|
|
|
RtlUnicodeToCustomCPN
|
|
|
|
|
RtlUnicodeToMultiByteN
|
|
|
|
|
RtlUnicodeToMultiByteSize
|
|
|
|
|
RtlUnicodeToOemN
|
|
|
|
|
RtlUniform
|
|
|
|
|
RtlUnlockBootStatusData
|
|
|
|
|
RtlUnlockHeap
|
|
|
|
|
RtlUnwind
|
|
|
|
|
RtlUpcaseUnicodeChar
|
|
|
|
|
RtlUpcaseUnicodeString
|
|
|
|
|
RtlUpcaseUnicodeStringToAnsiString
|
|
|
|
|
RtlUpcaseUnicodeStringToCountedOemString
|
|
|
|
|
RtlUpcaseUnicodeStringToOemString
|
|
|
|
|
RtlUpcaseUnicodeToCustomCPN
|
|
|
|
|
RtlUpcaseUnicodeToMultiByteN
|
|
|
|
|
RtlUpcaseUnicodeToOemN
|
|
|
|
|
RtlUpdateTimer
|
|
|
|
|
RtlUpperChar
|
|
|
|
|
RtlUpperString
|
|
|
|
|
RtlUsageHeap
|
|
|
|
|
RtlUshortByteSwap
|
|
|
|
|
RtlValidAcl
|
|
|
|
|
RtlValidRelativeSecurityDescriptor
|
|
|
|
|
RtlValidSecurityDescriptor
|
|
|
|
|
RtlValidSid
|
|
|
|
|
RtlValidateHeap
|
|
|
|
|
RtlValidateProcessHeaps
|
|
|
|
|
RtlValidateUnicodeString
|
|
|
|
|
RtlVerifyVersionInfo
|
|
|
|
|
RtlWalkFrameChain
|
|
|
|
|
RtlWalkHeap
|
|
|
|
|
RtlWakeAllConditionVariable
|
|
|
|
|
RtlWakeConditionVariable
|
|
|
|
|
RtlWriteRegistryValue
|
|
|
|
|
RtlZeroHeap
|
|
|
|
|
RtlZeroMemory
|
|
|
|
|
RtlZombifyActivationContext
|
|
|
|
|
RtlpEnsureBufferSize
|
|
|
|
|
RtlpNtCreateKey
|
|
|
|
|
RtlpNtEnumerateSubKey
|
|
|
|
|
RtlpNtMakeTemporaryKey
|
|
|
|
|
RtlpNtOpenKey
|
|
|
|
|
RtlpNtQueryValueKey
|
|
|
|
|
RtlpNtSetValueKey
|
|
|
|
|
RtlpUnWaitCriticalSection
|
|
|
|
|
RtlpWaitForCriticalSection
|
|
|
|
|
RtlxAnsiStringToUnicodeSize
|
|
|
|
|
RtlxOemStringToUnicodeSize
|
|
|
|
|
RtlxUnicodeStringToAnsiSize
|
|
|
|
|
RtlxUnicodeStringToOemSize
|
2010-08-04 08:17:04 +00:00
|
|
|
VerSetConditionMask
|
|
|
|
|
ZwAcceptConnectPort=NtAcceptConnectPort
|
|
|
|
|
ZwAccessCheck=NtAccessCheck
|
|
|
|
|
ZwAccessCheckAndAuditAlarm=NtAccessCheckAndAuditAlarm
|
|
|
|
|
ZwAccessCheckByType=NtAccessCheckByType
|
|
|
|
|
ZwAccessCheckByTypeAndAuditAlarm=NtAccessCheckByTypeAndAuditAlarm
|
|
|
|
|
ZwAccessCheckByTypeResultList=NtAccessCheckByTypeResultList
|
|
|
|
|
ZwAccessCheckByTypeResultListAndAuditAlarm=NtAccessCheckByTypeResultListAndAuditAlarm
|
|
|
|
|
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle=NtAccessCheckByTypeResultListAndAuditAlarmByHandle
|
|
|
|
|
ZwAddAtom=NtAddAtom
|
|
|
|
|
ZwAddBootEntry
|
|
|
|
|
ZwAdjustGroupsToken=NtAdjustGroupsToken
|
|
|
|
|
ZwAdjustPrivilegesToken=NtAdjustPrivilegesToken
|
|
|
|
|
ZwAlertResumeThread=NtAlertResumeThread
|
|
|
|
|
ZwAlertThread=NtAlertThread
|
|
|
|
|
ZwAllocateLocallyUniqueId=NtAllocateLocallyUniqueId
|
|
|
|
|
ZwAllocateUserPhysicalPages
|
|
|
|
|
ZwAllocateUuids=NtAllocateUuids
|
|
|
|
|
ZwAllocateVirtualMemory=NtAllocateVirtualMemory
|
|
|
|
|
ZwAreMappedFilesTheSame=NtAreMappedFilesTheSame
|
|
|
|
|
ZwAssignProcessToJobObject=NtAssignProcessToJobObject
|
|
|
|
|
ZwCallbackReturn
|
|
|
|
|
ZwCancelDeviceWakeupRequest
|
|
|
|
|
ZwCancelIoFile=NtCancelIoFile
|
|
|
|
|
ZwCancelTimer=NtCancelTimer
|
|
|
|
|
ZwClearEvent=NtClearEvent
|
|
|
|
|
ZwClose=NtClose
|
|
|
|
|
ZwCloseObjectAuditAlarm
|
|
|
|
|
ZwCompactKeys=NtCompactKeys
|
|
|
|
|
ZwCompareTokens=NtCompareTokens
|
|
|
|
|
ZwCompleteConnectPort=NtCompleteConnectPort
|
|
|
|
|
ZwCompressKey=NtCompressKey
|
|
|
|
|
ZwConnectPort=NtConnectPort
|
|
|
|
|
ZwContinue=NtContinue
|
|
|
|
|
ZwCreateDebugObject=NtCreateDebugObject
|
|
|
|
|
ZwCreateDirectoryObject=NtCreateDirectoryObject
|
|
|
|
|
ZwCreateEvent=NtCreateEvent
|
|
|
|
|
ZwCreateEventPair=NtCreateEventPair
|
|
|
|
|
ZwCreateFile=NtCreateFile
|
|
|
|
|
ZwCreateIoCompletion=NtCreateIoCompletion
|
|
|
|
|
ZwCreateJobObject=NtCreateJobObject
|
|
|
|
|
ZwCreateJobSet=NtCreateJobSet
|
|
|
|
|
ZwCreateKey=NtCreateKey
|
|
|
|
|
ZwCreateKeyedEvent=NtCreateKeyedEvent
|
|
|
|
|
ZwCreateMailslotFile=NtCreateMailslotFile
|
|
|
|
|
ZwCreateMutant=NtCreateMutant
|
|
|
|
|
ZwCreateNamedPipeFile=NtCreateNamedPipeFile
|
|
|
|
|
ZwCreatePagingFile=NtCreatePagingFile
|
|
|
|
|
ZwCreatePort=NtCreatePort
|
|
|
|
|
ZwCreateProcess
|
|
|
|
|
ZwCreateProcessEx=NtCreateProcessEx
|
|
|
|
|
ZwCreateProfile=NtCreateProfile
|
|
|
|
|
ZwCreateSection=NtCreateSection
|
|
|
|
|
ZwCreateSemaphore=NtCreateSemaphore
|
|
|
|
|
ZwCreateSymbolicLinkObject=NtCreateSymbolicLinkObject
|
|
|
|
|
ZwCreateThread
|
|
|
|
|
ZwCreateTimer=NtCreateTimer
|
|
|
|
|
ZwCreateToken
|
|
|
|
|
ZwCreateWaitablePort=NtCreateWaitablePort
|
|
|
|
|
ZwDebugActiveProcess=NtDebugActiveProcess
|
|
|
|
|
ZwDebugContinue=NtDebugContinue
|
|
|
|
|
ZwDelayExecution=NtDelayExecution
|
|
|
|
|
ZwDeleteAtom=NtDeleteAtom
|
|
|
|
|
ZwDeleteBootEntry=NtDeleteBootEntry
|
|
|
|
|
ZwDeleteFile=NtDeleteFile
|
|
|
|
|
ZwDeleteKey=NtDeleteKey
|
|
|
|
|
ZwDeleteObjectAuditAlarm
|
|
|
|
|
ZwDeleteValueKey=NtDeleteValueKey
|
|
|
|
|
ZwDeviceIoControlFile=NtDeviceIoControlFile
|
|
|
|
|
ZwDisplayString=NtDisplayString
|
|
|
|
|
ZwDuplicateObject=NtDuplicateObject
|
|
|
|
|
ZwDuplicateToken=NtDuplicateToken
|
|
|
|
|
ZwEnumerateBootEntries
|
|
|
|
|
ZwEnumerateKey=NtEnumerateKey
|
|
|
|
|
ZwEnumerateSystemEnvironmentValuesEx=NtEnumerateSystemEnvironmentValuesEx
|
|
|
|
|
ZwEnumerateValueKey=NtEnumerateValueKey
|
|
|
|
|
ZwExtendSection=NtExtendSection
|
|
|
|
|
ZwFilterToken=NtFilterToken
|
|
|
|
|
ZwFindAtom=NtFindAtom
|
|
|
|
|
ZwFlushBuffersFile=NtFlushBuffersFile
|
|
|
|
|
ZwFlushInstructionCache=NtFlushInstructionCache
|
|
|
|
|
ZwFlushKey=NtFlushKey
|
|
|
|
|
ZwFlushVirtualMemory=NtFlushVirtualMemory
|
|
|
|
|
ZwFlushWriteBuffer
|
|
|
|
|
ZwFreeUserPhysicalPages
|
|
|
|
|
ZwFreeVirtualMemory=NtFreeVirtualMemory
|
|
|
|
|
ZwFsControlFile=NtFsControlFile
|
|
|
|
|
ZwGetContextThread=NtGetContextThread
|
|
|
|
|
ZwGetCurrentProcessorNumber
|
|
|
|
|
ZwGetDevicePowerState
|
|
|
|
|
ZwGetPlugPlayEvent
|
|
|
|
|
ZwGetWriteWatch=NtGetWriteWatch
|
|
|
|
|
ZwImpersonateAnonymousToken
|
|
|
|
|
ZwImpersonateClientOfPort=NtImpersonateClientOfPort
|
|
|
|
|
ZwImpersonateThread=NtImpersonateThread
|
|
|
|
|
ZwInitializeRegistry
|
|
|
|
|
ZwInitiatePowerAction=NtInitiatePowerAction
|
|
|
|
|
ZwIsProcessInJob=NtIsProcessInJob
|
|
|
|
|
ZwIsSystemResumeAutomatic
|
|
|
|
|
ZwListenPort=NtListenPort
|
|
|
|
|
ZwLoadDriver=NtLoadDriver
|
|
|
|
|
ZwLoadKey2=NtLoadKey2
|
|
|
|
|
ZwLoadKey=NtLoadKey
|
|
|
|
|
ZwLockFile=NtLockFile
|
|
|
|
|
ZwLockProductActivationKeys=NtLockProductActivationKeys
|
|
|
|
|
ZwLockRegistryKey=NtLockRegistryKey
|
|
|
|
|
ZwLockVirtualMemory=NtLockVirtualMemory
|
|
|
|
|
ZwMakePermanentObject=NtMakePermanentObject
|
|
|
|
|
ZwMakeTemporaryObject=NtMakeTemporaryObject
|
|
|
|
|
ZwMapUserPhysicalPages
|
|
|
|
|
ZwMapUserPhysicalPagesScatter
|
|
|
|
|
ZwMapViewOfSection=NtMapViewOfSection
|
|
|
|
|
ZwModifyBootEntry=NtModifyBootEntry
|
|
|
|
|
ZwNotifyChangeDirectoryFile=NtNotifyChangeDirectoryFile
|
|
|
|
|
ZwNotifyChangeKey=NtNotifyChangeKey
|
|
|
|
|
ZwNotifyChangeMultipleKeys=NtNotifyChangeMultipleKeys
|
|
|
|
|
ZwOpenDirectoryObject=NtOpenDirectoryObject
|
|
|
|
|
ZwOpenEvent=NtOpenEvent
|
|
|
|
|
ZwOpenEventPair=NtOpenEventPair
|
|
|
|
|
ZwOpenFile=NtOpenFile
|
|
|
|
|
ZwOpenIoCompletion=NtOpenIoCompletion
|
|
|
|
|
ZwOpenJobObject=NtOpenJobObject
|
|
|
|
|
ZwOpenKey=NtOpenKey
|
|
|
|
|
ZwOpenKeyedEvent=NtOpenKeyedEvent
|
|
|
|
|
ZwOpenMutant=NtOpenMutant
|
|
|
|
|
ZwOpenObjectAuditAlarm
|
|
|
|
|
ZwOpenProcess=NtOpenProcess
|
|
|
|
|
ZwOpenProcessToken=NtOpenProcessToken
|
|
|
|
|
ZwOpenProcessTokenEx=NtOpenProcessTokenEx
|
|
|
|
|
ZwOpenSection=NtOpenSection
|
|
|
|
|
ZwOpenSemaphore=NtOpenSemaphore
|
|
|
|
|
ZwOpenSymbolicLinkObject=NtOpenSymbolicLinkObject
|
|
|
|
|
ZwOpenThread=NtOpenThread
|
|
|
|
|
ZwOpenThreadToken=NtOpenThreadToken
|
|
|
|
|
ZwOpenThreadTokenEx=NtOpenThreadTokenEx
|
|
|
|
|
ZwOpenTimer=NtOpenTimer
|
|
|
|
|
ZwPlugPlayControl
|
|
|
|
|
ZwPowerInformation=NtPowerInformation
|
|
|
|
|
ZwPrivilegeCheck=NtPrivilegeCheck
|
|
|
|
|
ZwPrivilegeObjectAuditAlarm
|
|
|
|
|
ZwPrivilegedServiceAuditAlarm
|
|
|
|
|
ZwProtectVirtualMemory=NtProtectVirtualMemory
|
|
|
|
|
ZwPulseEvent=NtPulseEvent
|
|
|
|
|
ZwQueryAttributesFile=NtQueryAttributesFile
|
|
|
|
|
ZwQueryBootEntryOrder=NtQueryBootEntryOrder
|
|
|
|
|
ZwQueryBootOptions=NtQueryBootOptions
|
|
|
|
|
ZwQueryDebugFilterState=NtQueryDebugFilterState
|
|
|
|
|
ZwQueryDefaultLocale=NtQueryDefaultLocale
|
|
|
|
|
ZwQueryDefaultUILanguage=NtQueryDefaultUILanguage
|
|
|
|
|
ZwQueryDirectoryFile=NtQueryDirectoryFile
|
|
|
|
|
ZwQueryDirectoryObject=NtQueryDirectoryObject
|
|
|
|
|
ZwQueryEaFile=NtQueryEaFile
|
|
|
|
|
ZwQueryEvent=NtQueryEvent
|
|
|
|
|
ZwQueryFullAttributesFile=NtQueryFullAttributesFile
|
|
|
|
|
ZwQueryInformationAtom=NtQueryInformationAtom
|
|
|
|
|
ZwQueryInformationFile=NtQueryInformationFile
|
|
|
|
|
ZwQueryInformationJobObject=NtQueryInformationJobObject
|
|
|
|
|
ZwQueryInformationPort=NtQueryInformationPort
|
|
|
|
|
ZwQueryInformationProcess=NtQueryInformationProcess
|
|
|
|
|
ZwQueryInformationThread=NtQueryInformationThread
|
|
|
|
|
ZwQueryInformationToken=NtQueryInformationToken
|
|
|
|
|
ZwQueryInstallUILanguage=NtQueryInstallUILanguage
|
|
|
|
|
ZwQueryIntervalProfile=NtQueryIntervalProfile
|
|
|
|
|
ZwQueryIoCompletion=NtQueryIoCompletion
|
|
|
|
|
ZwQueryKey=NtQueryKey
|
|
|
|
|
ZwQueryMultipleValueKey=NtQueryMultipleValueKey
|
|
|
|
|
ZwQueryMutant=NtQueryMutant
|
|
|
|
|
ZwQueryObject=NtQueryObject
|
|
|
|
|
ZwQueryOpenSubKeys=NtQueryOpenSubKeys
|
|
|
|
|
ZwQueryPerformanceCounter=NtQueryPerformanceCounter
|
|
|
|
|
ZwQueryPortInformationProcess=NtQueryPortInformationProcess
|
|
|
|
|
ZwQueryQuotaInformationFile=NtQueryQuotaInformationFile
|
|
|
|
|
ZwQuerySection=NtQuerySection
|
|
|
|
|
ZwQuerySecurityObject=NtQuerySecurityObject
|
|
|
|
|
ZwQuerySemaphore=NtQuerySemaphore
|
|
|
|
|
ZwQuerySymbolicLinkObject=NtQuerySymbolicLinkObject
|
|
|
|
|
ZwQuerySystemEnvironmentValue=NtQuerySystemEnvironmentValue
|
|
|
|
|
ZwQuerySystemEnvironmentValueEx=NtQuerySystemEnvironmentValueEx
|
|
|
|
|
ZwQuerySystemInformation=NtQuerySystemInformation
|
|
|
|
|
ZwQuerySystemTime=NtQuerySystemTime
|
|
|
|
|
ZwQueryTimer=NtQueryTimer
|
|
|
|
|
ZwQueryTimerResolution=NtQueryTimerResolution
|
|
|
|
|
ZwQueryValueKey=NtQueryValueKey
|
|
|
|
|
ZwQueryVirtualMemory=NtQueryVirtualMemory
|
|
|
|
|
ZwQueryVolumeInformationFile=NtQueryVolumeInformationFile
|
|
|
|
|
ZwQueueApcThread=NtQueueApcThread
|
|
|
|
|
ZwRaiseException=NtRaiseException
|
|
|
|
|
ZwRaiseHardError=NtRaiseHardError
|
|
|
|
|
ZwReadFile=NtReadFile
|
|
|
|
|
ZwReadFileScatter=NtReadFileScatter
|
|
|
|
|
ZwReadRequestData=NtReadRequestData
|
|
|
|
|
ZwReadVirtualMemory=NtReadVirtualMemory
|
|
|
|
|
ZwRegisterThreadTerminatePort=NtRegisterThreadTerminatePort
|
|
|
|
|
ZwReleaseKeyedEvent=NtReleaseKeyedEvent
|
|
|
|
|
ZwReleaseMutant=NtReleaseMutant
|
|
|
|
|
ZwReleaseSemaphore=NtReleaseSemaphore
|
|
|
|
|
ZwRemoveIoCompletion=NtRemoveIoCompletion
|
|
|
|
|
ZwRemoveProcessDebug=NtRemoveProcessDebug
|
|
|
|
|
ZwRenameKey=NtRenameKey
|
|
|
|
|
ZwReplaceKey=NtReplaceKey
|
|
|
|
|
ZwReplyPort=NtReplyPort
|
|
|
|
|
ZwReplyWaitReceivePort=NtReplyWaitReceivePort
|
|
|
|
|
ZwReplyWaitReceivePortEx
|
|
|
|
|
ZwReplyWaitReplyPort
|
|
|
|
|
ZwRequestDeviceWakeup
|
|
|
|
|
ZwRequestPort
|
|
|
|
|
ZwRequestWaitReplyPort
|
|
|
|
|
ZwRequestWakeupLatency
|
|
|
|
|
ZwResetEvent
|
|
|
|
|
ZwResetWriteWatch
|
|
|
|
|
ZwRestoreKey
|
|
|
|
|
ZwResumeProcess
|
|
|
|
|
ZwResumeThread
|
|
|
|
|
ZwSaveKey
|
|
|
|
|
ZwSaveKeyEx
|
|
|
|
|
ZwSaveMergedKeys
|
|
|
|
|
ZwSecureConnectPort
|
|
|
|
|
ZwSetBootEntryOrder
|
|
|
|
|
ZwSetBootOptions
|
|
|
|
|
ZwSetContextThread
|
|
|
|
|
ZwSetDebugFilterState
|
|
|
|
|
ZwSetDefaultHardErrorPort
|
|
|
|
|
ZwSetDefaultLocale
|
|
|
|
|
ZwSetDefaultUILanguage
|
|
|
|
|
ZwSetEaFile
|
|
|
|
|
ZwSetEvent
|
|
|
|
|
ZwSetEventBoostPriority
|
|
|
|
|
ZwSetHighEventPair
|
|
|
|
|
ZwSetHighWaitLowEventPair
|
|
|
|
|
ZwSetInformationDebugObject
|
|
|
|
|
ZwSetInformationFile
|
|
|
|
|
ZwSetInformationJobObject
|
|
|
|
|
ZwSetInformationKey
|
|
|
|
|
ZwSetInformationObject
|
|
|
|
|
ZwSetInformationProcess
|
|
|
|
|
ZwSetInformationThread
|
|
|
|
|
ZwSetInformationToken
|
|
|
|
|
ZwSetIntervalProfile
|
|
|
|
|
ZwSetIoCompletion
|
|
|
|
|
ZwSetLdtEntries
|
|
|
|
|
ZwSetLowEventPair
|
|
|
|
|
ZwSetLowWaitHighEventPair
|
|
|
|
|
ZwSetQuotaInformationFile
|
|
|
|
|
ZwSetSecurityObject
|
|
|
|
|
ZwSetSystemEnvironmentValue
|
|
|
|
|
ZwSetSystemEnvironmentValueEx
|
|
|
|
|
ZwSetSystemInformation
|
|
|
|
|
ZwSetSystemPowerState
|
|
|
|
|
ZwSetSystemTime
|
|
|
|
|
ZwSetThreadExecutionState
|
|
|
|
|
ZwSetTimer
|
|
|
|
|
ZwSetTimerResolution
|
|
|
|
|
ZwSetUuidSeed
|
|
|
|
|
ZwSetValueKey
|
|
|
|
|
ZwSetVolumeInformationFile
|
|
|
|
|
ZwShutdownSystem
|
|
|
|
|
ZwSignalAndWaitForSingleObject
|
|
|
|
|
ZwStartProfile
|
|
|
|
|
ZwStopProfile
|
|
|
|
|
ZwSuspendProcess
|
|
|
|
|
ZwSuspendThread
|
|
|
|
|
ZwSystemDebugControl
|
|
|
|
|
ZwTerminateJobObject
|
|
|
|
|
ZwTerminateProcess
|
|
|
|
|
ZwTerminateThread
|
|
|
|
|
ZwTestAlert
|
|
|
|
|
ZwTraceEvent
|
|
|
|
|
ZwTranslateFilePath
|
|
|
|
|
ZwUnloadDriver
|
|
|
|
|
ZwUnloadKey
|
|
|
|
|
ZwUnloadKeyEx
|
|
|
|
|
ZwUnlockFile
|
|
|
|
|
ZwUnlockVirtualMemory
|
|
|
|
|
ZwUnmapViewOfSection
|
|
|
|
|
ZwVdmControl
|
|
|
|
|
ZwWaitForDebugEvent
|
|
|
|
|
ZwWaitForKeyedEvent
|
|
|
|
|
ZwWaitForMultipleObjects
|
|
|
|
|
ZwWaitForSingleObject
|
|
|
|
|
ZwWaitHighEventPair
|
|
|
|
|
ZwWaitLowEventPair
|
|
|
|
|
ZwWriteFile
|
|
|
|
|
ZwWriteFileGather
|
|
|
|
|
ZwWriteRequestData
|
|
|
|
|
ZwWriteVirtualMemory
|
|
|
|
|
ZwYieldExecution
|
|
|
|
|
__isascii
|
|
|
|
|
__iscsym
|
|
|
|
|
__iscsymf
|
|
|
|
|
__toascii
|
|
|
|
|
_alldiv
|
|
|
|
|
_alldvrm
|
|
|
|
|
_allmul
|
|
|
|
|
_alloca_probe
|
|
|
|
|
_allrem
|
|
|
|
|
_allshl
|
|
|
|
|
_allshr
|
|
|
|
|
_atoi64
|
|
|
|
|
_aulldiv
|
|
|
|
|
_aulldvrm
|
|
|
|
|
_aullrem
|
|
|
|
|
_aullshr
|
|
|
|
|
_chkstk
|
|
|
|
|
_fltused
|
|
|
|
|
_ftol
|
|
|
|
|
_i64toa
|
|
|
|
|
_i64tow
|
|
|
|
|
_itoa
|
|
|
|
|
_itow
|
|
|
|
|
_lfind
|
|
|
|
|
_ltoa
|
|
|
|
|
_ltow
|
|
|
|
|
_memccpy
|
|
|
|
|
_memicmp
|
|
|
|
|
_snprintf
|
|
|
|
|
_snwprintf
|
|
|
|
|
_splitpath
|
|
|
|
|
_strcmpi=_stricmp
|
|
|
|
|
_stricmp
|
|
|
|
|
_strlwr
|
|
|
|
|
_strnicmp
|
|
|
|
|
_strupr
|
|
|
|
|
_tolower
|
|
|
|
|
_toupper
|
|
|
|
|
_ui64toa
|
|
|
|
|
_ui64tow
|
|
|
|
|
_ultoa
|
|
|
|
|
_ultow
|
|
|
|
|
_vsnprintf
|
|
|
|
|
_vsnwprintf
|
|
|
|
|
_wcsicmp
|
|
|
|
|
_wcslwr
|
|
|
|
|
_wcsnicmp
|
|
|
|
|
_wcsupr
|
|
|
|
|
_wtoi
|
|
|
|
|
_wtoi64
|
|
|
|
|
_wtol
|
|
|
|
|
abs
|
|
|
|
|
atan
|
|
|
|
|
atoi
|
|
|
|
|
atol
|
|
|
|
|
bsearch
|
|
|
|
|
ceil
|
|
|
|
|
cos
|
|
|
|
|
fabs
|
|
|
|
|
floor
|
|
|
|
|
isalnum
|
|
|
|
|
isalpha
|
|
|
|
|
iscntrl
|
|
|
|
|
isdigit
|
|
|
|
|
isgraph
|
|
|
|
|
islower
|
|
|
|
|
isprint
|
|
|
|
|
ispunct
|
|
|
|
|
isspace
|
|
|
|
|
isupper
|
|
|
|
|
iswalpha
|
|
|
|
|
iswctype
|
|
|
|
|
iswdigit
|
|
|
|
|
iswlower
|
|
|
|
|
iswspace
|
|
|
|
|
iswxdigit
|
|
|
|
|
isxdigit
|
|
|
|
|
labs
|
|
|
|
|
log
|
|
|
|
|
mbstowcs
|
|
|
|
|
memchr
|
|
|
|
|
memcmp
|
|
|
|
|
memcpy=memmove
|
|
|
|
|
memmove
|
|
|
|
|
memset
|
|
|
|
|
pow
|
|
|
|
|
qsort
|
|
|
|
|
sin
|
|
|
|
|
sprintf
|
|
|
|
|
sqrt
|
|
|
|
|
sscanf
|
|
|
|
|
strcat
|
|
|
|
|
strchr
|
|
|
|
|
strcmp
|
|
|
|
|
strcpy
|
|
|
|
|
strcspn
|
|
|
|
|
strlen
|
|
|
|
|
strncat
|
|
|
|
|
strncmp
|
|
|
|
|
strncpy
|
|
|
|
|
strpbrk
|
|
|
|
|
strrchr
|
|
|
|
|
strspn
|
|
|
|
|
strstr
|
|
|
|
|
strtol
|
|
|
|
|
strtoul
|
|
|
|
|
swprintf
|
|
|
|
|
tan
|
|
|
|
|
tolower
|
|
|
|
|
toupper
|
|
|
|
|
towlower
|
|
|
|
|
towupper
|
|
|
|
|
vDbgPrintEx
|
|
|
|
|
vDbgPrintExWithPrefix
|
|
|
|
|
vsprintf
|
|
|
|
|
wcscat
|
|
|
|
|
wcschr
|
|
|
|
|
wcscmp
|
|
|
|
|
wcscpy
|
|
|
|
|
wcscspn
|
|
|
|
|
wcslen
|
|
|
|
|
wcsncat
|
|
|
|
|
wcsncmp
|
|
|
|
|
wcsncpy
|
|
|
|
|
wcspbrk
|
|
|
|
|
wcsrchr
|
|
|
|
|
wcsspn
|
|
|
|
|
wcsstr
|
|
|
|
|
wcstol
|
|
|
|
|
wcstombs
|
|
|
|
|
wcstoul
|
