From 828c1b5961b085688b2e4ab976192cf49c04585c Mon Sep 17 00:00:00 2001 From: Amine Khaldi Date: Sun, 13 Sep 2015 16:38:17 +0000 Subject: [PATCH] [NTDLL] Order the exports and make sure the list matches our target (Windows Server 2003 Sp2). CORE-8174 svn path=/trunk/; revision=69217 --- reactos/dll/ntdll/def/ntdll.spec | 2754 +++++++++++++++--------------- 1 file changed, 1377 insertions(+), 1377 deletions(-) diff --git a/reactos/dll/ntdll/def/ntdll.spec b/reactos/dll/ntdll/def/ntdll.spec index 26fc1f69dfd..4ddede23893 100644 --- a/reactos/dll/ntdll/def/ntdll.spec +++ b/reactos/dll/ntdll/def/ntdll.spec @@ -1,1416 +1,1416 @@ -;@ stdcall PropertyLengthAsVariant(ptr long long long) -;@ stdcall RtlConvertPropertyToVariant(ptr long ptr ptr) -;@ stdcall RtlConvertVariantToProperty(ptr long ptr ptr ptr long ptr) -@ fastcall RtlActivateActivationContextUnsafeFast(ptr ptr) -@ fastcall RtlDeactivateActivationContextUnsafeFast(ptr) -@ fastcall RtlInterlockedPushListSList(ptr ptr ptr long) -@ fastcall -arch=i386 RtlUlongByteSwap(long) -@ fastcall -ret64 RtlUlonglongByteSwap(double) -@ fastcall -arch=i386 RtlUshortByteSwap(long) -@ stdcall -arch=i386,x86_64 ExpInterlockedPopEntrySListEnd() -@ stdcall -arch=i386,x86_64 ExpInterlockedPopEntrySListFault() -@ stdcall -arch=i386,x86_64 ExpInterlockedPopEntrySListResume() -@ stdcall CsrAllocateCaptureBuffer(long long) -@ stdcall CsrAllocateMessagePointer(ptr long ptr) -@ stdcall CsrCaptureMessageBuffer(ptr ptr long ptr) -@ stdcall CsrCaptureMessageMultiUnicodeStringsInPlace(ptr long ptr) -@ stdcall CsrCaptureMessageString(ptr str long long ptr) -@ stdcall CsrCaptureTimeout(long ptr) -@ stdcall CsrClientCallServer(ptr ptr long long) -@ stdcall CsrClientConnectToServer(str long ptr ptr ptr) -@ stdcall CsrFreeCaptureBuffer(ptr) -@ stdcall CsrGetProcessId() -@ stdcall CsrIdentifyAlertableThread() -@ stdcall CsrNewThread() -@ stdcall CsrProbeForRead(ptr long long) -@ stdcall CsrProbeForWrite(ptr long long) -@ stdcall CsrSetPriorityClass(ptr ptr) -@ stdcall DbgBreakPoint() -@ varargs DbgPrint(str) -@ varargs DbgPrintEx(long long str) -@ varargs DbgPrintReturnControlC(str) -@ stdcall DbgPrompt(ptr ptr long) -@ stdcall DbgQueryDebugFilterState(long long) -@ stdcall DbgSetDebugFilterState(long long long) -@ stdcall DbgUiConnectToDbg() -@ stdcall DbgUiContinue(ptr long) -@ stdcall DbgUiConvertStateChangeStructure(ptr ptr) -@ stdcall DbgUiDebugActiveProcess(ptr) -@ stdcall DbgUiGetThreadDebugObject() -@ stdcall DbgUiIssueRemoteBreakin(ptr) -@ stdcall DbgUiRemoteBreakin() -@ stdcall DbgUiSetThreadDebugObject(ptr) -@ stdcall DbgUiStopDebugging(ptr) -@ stdcall DbgUiWaitStateChange(ptr ptr) -@ stdcall DbgUserBreakPoint() -@ stdcall EtwControlTraceA(double str ptr long) -@ stdcall EtwControlTraceW(double wstr ptr long) -@ stdcall -stub EtwCreateTraceInstanceId(ptr ptr) -@ stdcall EtwEnableTrace(long long long ptr double) -@ stdcall -stub EtwEnumerateTraceGuids(ptr long ptr) -@ stdcall -stub EtwFlushTraceA(double str ptr) -@ stdcall -stub EtwFlushTraceW(double wstr ptr) -@ stdcall EtwGetTraceEnableFlags(double) -@ stdcall EtwGetTraceEnableLevel(double) -@ stdcall EtwGetTraceLoggerHandle(ptr) -@ stdcall -stub EtwNotificationRegistrationA(ptr long ptr long long) -@ stdcall -stub EtwNotificationRegistrationW(ptr long ptr long long) -@ stdcall EtwQueryAllTracesA(ptr long ptr) -@ stdcall EtwQueryAllTracesW(ptr long ptr) -@ stdcall -stub EtwQueryTraceA(double str ptr) -@ stdcall -stub EtwQueryTraceW(double wstr ptr) -@ stdcall -stub EtwReceiveNotificationsA() # FIXME prototype -@ stdcall -stub EtwReceiveNotificationsW() # FIXME prototype -@ stdcall EtwRegisterTraceGuidsA(ptr ptr ptr long ptr str str ptr) -@ stdcall EtwRegisterTraceGuidsW(ptr ptr ptr long ptr wstr wstr ptr) -@ stdcall EtwStartTraceA(ptr str ptr) -@ stdcall EtwStartTraceW(ptr wstr ptr) -@ stdcall -stub EtwStopTraceA(double str ptr) -@ stdcall -stub EtwStopTraceW(double wstr ptr) -@ stdcall EtwTraceEvent(double ptr) -@ stdcall -stub EtwTraceEventInstance(double ptr ptr ptr) -@ varargs EtwTraceMessage(ptr long ptr long) -@ stdcall -stub EtwTraceMessageVa(double long ptr long ptr) -@ stdcall EtwUnregisterTraceGuids(double) -@ stdcall -stub EtwUpdateTraceA(double str ptr) -@ stdcall -stub EtwUpdateTraceW(double wstr ptr) +# 1 stdcall PropertyLengthAsVariant(ptr long long long) +# 2 stdcall RtlConvertPropertyToVariant(ptr long ptr ptr) +# 3 stdcall RtlConvertVariantToProperty(ptr long ptr ptr ptr long ptr) +4 fastcall RtlActivateActivationContextUnsafeFast(ptr ptr) +5 fastcall RtlDeactivateActivationContextUnsafeFast(ptr) +6 fastcall RtlInterlockedPushListSList(ptr ptr ptr long) +7 fastcall -arch=i386 RtlUlongByteSwap(long) +8 fastcall -ret64 RtlUlonglongByteSwap(double) +9 fastcall -arch=i386 RtlUshortByteSwap(long) +10 stdcall -arch=i386,x86_64 ExpInterlockedPopEntrySListEnd() +11 stdcall -arch=i386,x86_64 ExpInterlockedPopEntrySListFault() +12 stdcall -arch=i386,x86_64 ExpInterlockedPopEntrySListResume() +13 stdcall CsrAllocateCaptureBuffer(long long) +14 stdcall CsrAllocateMessagePointer(ptr long ptr) +15 stdcall CsrCaptureMessageBuffer(ptr ptr long ptr) +16 stdcall CsrCaptureMessageMultiUnicodeStringsInPlace(ptr long ptr) +17 stdcall CsrCaptureMessageString(ptr str long long ptr) +18 stdcall CsrCaptureTimeout(long ptr) +19 stdcall CsrClientCallServer(ptr ptr long long) +20 stdcall CsrClientConnectToServer(str long ptr ptr ptr) +21 stdcall CsrFreeCaptureBuffer(ptr) +22 stdcall CsrGetProcessId() +23 stdcall CsrIdentifyAlertableThread() +24 stdcall CsrNewThread() +25 stdcall CsrProbeForRead(ptr long long) +26 stdcall CsrProbeForWrite(ptr long long) +27 stdcall CsrSetPriorityClass(ptr ptr) +28 stdcall DbgBreakPoint() +29 varargs DbgPrint(str) +30 varargs DbgPrintEx(long long str) +31 varargs DbgPrintReturnControlC(str) +32 stdcall DbgPrompt(ptr ptr long) +33 stdcall DbgQueryDebugFilterState(long long) +34 stdcall DbgSetDebugFilterState(long long long) +35 stdcall DbgUiConnectToDbg() +36 stdcall DbgUiContinue(ptr long) +37 stdcall DbgUiConvertStateChangeStructure(ptr ptr) +38 stdcall DbgUiDebugActiveProcess(ptr) +39 stdcall DbgUiGetThreadDebugObject() +40 stdcall DbgUiIssueRemoteBreakin(ptr) +41 stdcall DbgUiRemoteBreakin() +42 stdcall DbgUiSetThreadDebugObject(ptr) +43 stdcall DbgUiStopDebugging(ptr) +44 stdcall DbgUiWaitStateChange(ptr ptr) +45 stdcall DbgUserBreakPoint() +46 stdcall EtwControlTraceA(double str ptr long) +47 stdcall EtwControlTraceW(double wstr ptr long) +48 stdcall -stub EtwCreateTraceInstanceId(ptr ptr) +49 stdcall EtwEnableTrace(long long long ptr double) +50 stdcall -stub EtwEnumerateTraceGuids(ptr long ptr) +51 stdcall -stub EtwFlushTraceA(double str ptr) +52 stdcall -stub EtwFlushTraceW(double wstr ptr) +53 stdcall EtwGetTraceEnableFlags(double) +54 stdcall EtwGetTraceEnableLevel(double) +55 stdcall EtwGetTraceLoggerHandle(ptr) +56 stdcall -stub EtwNotificationRegistrationA(ptr long ptr long long) +57 stdcall -stub EtwNotificationRegistrationW(ptr long ptr long long) +58 stdcall EtwQueryAllTracesA(ptr long ptr) +59 stdcall EtwQueryAllTracesW(ptr long ptr) +60 stdcall -stub EtwQueryTraceA(double str ptr) +61 stdcall -stub EtwQueryTraceW(double wstr ptr) +62 stdcall -stub EtwReceiveNotificationsA() # FIXME prototype +63 stdcall -stub EtwReceiveNotificationsW() # FIXME prototype +64 stdcall EtwRegisterTraceGuidsA(ptr ptr ptr long ptr str str ptr) +65 stdcall EtwRegisterTraceGuidsW(ptr ptr ptr long ptr wstr wstr ptr) +66 stdcall EtwStartTraceA(ptr str ptr) +67 stdcall EtwStartTraceW(ptr wstr ptr) +68 stdcall -stub EtwStopTraceA(double str ptr) +69 stdcall -stub EtwStopTraceW(double wstr ptr) +70 stdcall EtwTraceEvent(double ptr) +71 stdcall -stub EtwTraceEventInstance(double ptr ptr ptr) +72 varargs EtwTraceMessage(ptr long ptr long) +73 stdcall -stub EtwTraceMessageVa(double long ptr long ptr) +74 stdcall EtwUnregisterTraceGuids(double) +75 stdcall -stub EtwUpdateTraceA(double str ptr) +76 stdcall -stub EtwUpdateTraceW(double wstr ptr) # EtwpGetTraceBuffer # EtwpSetHWConfigFunction -@ stdcall -arch=i386 KiFastSystemCall() -@ stdcall -arch=i386 KiFastSystemCallRet() -@ stdcall -arch=i386 KiIntSystemCall() -@ stdcall KiRaiseUserExceptionDispatcher() -@ stdcall KiUserApcDispatcher(ptr ptr ptr ptr) -@ stdcall KiUserCallbackDispatcher(ptr ptr long) ; CHECKME -@ stdcall KiUserExceptionDispatcher(ptr ptr) -@ stdcall LdrAccessOutOfProcessResource(ptr ptr ptr ptr ptr) -@ stdcall LdrAccessResource(long ptr ptr ptr) -@ stdcall LdrAddRefDll(long ptr) -;@ stdcall LdrAlternateResourcesEnabled -@ stdcall LdrCreateOutOfProcessImage(long ptr ptr ptr) -@ stdcall LdrDestroyOutOfProcessImage(ptr) -@ stdcall LdrDisableThreadCalloutsForDll(long) -@ stdcall LdrEnumResources(ptr ptr long ptr ptr) -@ stdcall LdrEnumerateLoadedModules(long ptr long) -@ stdcall LdrFindCreateProcessManifest(long ptr ptr long ptr) ; 5.1 and 5.2 only -@ stdcall LdrFindEntryForAddress(ptr ptr) -@ stdcall LdrFindResourceDirectory_U(long ptr long ptr) -;@ stdcall LdrFindResourceEx_U ; 5.1 and higher -@ stdcall LdrFindResource_U(long ptr long ptr) -@ stdcall LdrFlushAlternateResourceModules() -@ stdcall LdrGetDllHandle(wstr long ptr ptr) -@ stdcall LdrGetDllHandleEx(long wstr long ptr ptr) -@ stdcall LdrGetProcedureAddress(ptr ptr long ptr) -;@ stdcall LdrHotPatchRoutine -;@ stdcall LdrInitShimEngineDynamic -@ stdcall LdrInitializeThunk(long long long long) -@ stdcall LdrLoadAlternateResourceModule(ptr ptr) -@ stdcall LdrLoadDll(wstr long ptr ptr) -@ stdcall LdrLockLoaderLock(long ptr ptr) -@ stdcall LdrOpenImageFileOptionsKey(ptr long ptr) ; 5.2 SP1 and higher -@ stdcall LdrProcessRelocationBlock(ptr long ptr long) -@ stdcall LdrQueryImageFileExecutionOptions(ptr str long ptr long ptr) -;@ stdcall LdrQueryImageFileExecutionOptionsEx(ptr ptr long ptr long ptr long) -@ stdcall LdrQueryImageFileKeyOption(ptr ptr long ptr long ptr) -@ stdcall LdrQueryProcessModuleInformation(ptr long ptr) -;@ stdcall LdrSetAppCompatDllRedirectionCallback -@ stdcall LdrSetDllManifestProber(ptr) -@ stdcall LdrShutdownProcess() -@ stdcall LdrShutdownThread() -@ stdcall LdrUnloadAlternateResourceModule(ptr) -@ stdcall LdrUnloadDll(ptr) -@ stdcall LdrUnlockLoaderLock(long long) -@ stdcall LdrVerifyImageMatchesChecksum(ptr long long long) -@ extern NlsAnsiCodePage -@ extern NlsMbCodePageTag -@ extern NlsMbOemCodePageTag -@ stdcall NtAcceptConnectPort(ptr long ptr long long ptr) -@ stdcall NtAccessCheck(ptr long long ptr ptr ptr ptr ptr) -@ stdcall NtAccessCheckAndAuditAlarm(ptr long ptr ptr ptr long ptr long ptr ptr ptr) -@ stdcall NtAccessCheckByType(ptr ptr ptr long ptr long ptr ptr long ptr ptr) -@ stdcall NtAccessCheckByTypeAndAuditAlarm(ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) -@ stdcall NtAccessCheckByTypeResultList(ptr ptr ptr long ptr long ptr ptr long ptr ptr) -@ stdcall NtAccessCheckByTypeResultListAndAuditAlarm(ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) -@ stdcall NtAccessCheckByTypeResultListAndAuditAlarmByHandle(ptr ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) -@ stdcall NtAddAtom(ptr long ptr) -@ stdcall NtAddBootEntry(ptr long) -@ stdcall NtAddDriverEntry(ptr long) ; 5.2 and higher -@ stdcall NtAdjustGroupsToken(long long ptr long ptr ptr) -@ stdcall NtAdjustPrivilegesToken(long long long long long long) -@ stdcall NtAlertResumeThread(long ptr) -@ stdcall NtAlertThread(long) -@ stdcall NtAllocateLocallyUniqueId(ptr) -@ stdcall NtAllocateUserPhysicalPages(ptr ptr ptr) -@ stdcall NtAllocateUuids(ptr ptr ptr ptr) -@ stdcall NtAllocateVirtualMemory(long ptr ptr ptr long long) -@ stdcall NtApphelpCacheControl(long ptr) -@ stdcall NtAreMappedFilesTheSame(ptr ptr) -@ stdcall NtAssignProcessToJobObject(long long) -@ stdcall NtCallbackReturn(ptr long long) -@ stdcall NtCancelDeviceWakeupRequest(ptr) -@ stdcall NtCancelIoFile(long ptr) -@ stdcall NtCancelTimer(long ptr) -@ stdcall NtClearEvent(long) -@ stdcall NtClose(long) -@ stdcall NtCloseObjectAuditAlarm(ptr ptr long) -@ stdcall NtCompactKeys(long ptr) -@ stdcall NtCompareTokens(ptr ptr ptr) -@ stdcall NtCompleteConnectPort(ptr) -@ stdcall NtCompressKey(ptr) -@ stdcall NtConnectPort(ptr ptr ptr ptr ptr ptr ptr ptr) -@ stdcall NtContinue(ptr long) -@ stdcall NtCreateDebugObject(ptr long ptr long) -@ stdcall NtCreateDirectoryObject(long long long) -@ stdcall NtCreateEvent(long long long long long) -@ stdcall NtCreateEventPair(ptr long ptr) -@ stdcall NtCreateFile(ptr long ptr ptr long long long ptr long long ptr) -@ stdcall NtCreateIoCompletion(ptr long ptr long) -@ stdcall NtCreateJobObject(ptr long ptr) -@ stdcall NtCreateJobSet(long ptr long) -@ stdcall NtCreateKey(ptr long ptr long ptr long long) -@ stdcall NtCreateKeyedEvent(ptr long ptr long) -@ stdcall NtCreateMailslotFile(long long long long long long long long) -@ stdcall NtCreateMutant(ptr long ptr long) -@ stdcall NtCreateNamedPipeFile(ptr long ptr ptr long long long long long long long long long ptr) -@ stdcall NtCreatePagingFile(long long long long) -@ stdcall NtCreatePort(ptr ptr long long ptr) -@ stdcall NtCreateProcess(ptr long ptr ptr long ptr ptr ptr) -@ stdcall NtCreateProcessEx(ptr long ptr ptr long ptr ptr ptr long) -@ stdcall NtCreateProfile(ptr ptr ptr long long ptr long long long) ; CHECKME -@ stdcall NtCreateSection(ptr long ptr ptr long long long) -@ stdcall NtCreateSemaphore(ptr long ptr long long) -@ stdcall NtCreateSymbolicLinkObject(ptr long ptr ptr) -@ stdcall NtCreateThread(ptr long ptr ptr ptr ptr ptr long) -@ stdcall NtCreateTimer(ptr long ptr long) -@ stdcall NtCreateToken(ptr long ptr long ptr ptr ptr ptr ptr ptr ptr ptr ptr) -@ stdcall NtCreateWaitablePort(ptr ptr long long long) -@ stdcall -arch=win32 NtCurrentTeb() _NtCurrentTeb -@ stdcall NtDebugActiveProcess(ptr ptr) -@ stdcall NtDebugContinue(ptr ptr long) -@ stdcall NtDelayExecution(long ptr) -@ stdcall NtDeleteAtom(long) -@ stdcall NtDeleteBootEntry(long) +79 stdcall -arch=i386 KiFastSystemCall() +80 stdcall -arch=i386 KiFastSystemCallRet() +81 stdcall -arch=i386 KiIntSystemCall() +82 stdcall KiRaiseUserExceptionDispatcher() +83 stdcall KiUserApcDispatcher(ptr ptr ptr ptr) +84 stdcall KiUserCallbackDispatcher(ptr ptr long) ; CHECKME +85 stdcall KiUserExceptionDispatcher(ptr ptr) +86 stdcall LdrAccessOutOfProcessResource(ptr ptr ptr ptr ptr) +87 stdcall LdrAccessResource(long ptr ptr ptr) +88 stdcall LdrAddRefDll(long ptr) +# 89 stdcall LdrAlternateResourcesEnabled +90 stdcall LdrCreateOutOfProcessImage(long ptr ptr ptr) +91 stdcall LdrDestroyOutOfProcessImage(ptr) +92 stdcall LdrDisableThreadCalloutsForDll(long) +93 stdcall LdrEnumResources(ptr ptr long ptr ptr) +94 stdcall LdrEnumerateLoadedModules(long ptr long) +95 stdcall LdrFindCreateProcessManifest(long ptr ptr long ptr) ; 5.1 and 5.2 only +96 stdcall LdrFindEntryForAddress(ptr ptr) +97 stdcall LdrFindResourceDirectory_U(long ptr long ptr) +# stdcall LdrFindResourceEx_U ; 5.1 and higher +99 stdcall LdrFindResource_U(long ptr long ptr) +100 stdcall LdrFlushAlternateResourceModules() +101 stdcall LdrGetDllHandle(wstr long ptr ptr) +102 stdcall LdrGetDllHandleEx(long wstr long ptr ptr) +103 stdcall LdrGetProcedureAddress(ptr ptr long ptr) +# stdcall LdrHotPatchRoutine +# stdcall LdrInitShimEngineDynamic +106 stdcall LdrInitializeThunk(long long long long) +107 stdcall LdrLoadAlternateResourceModule(ptr ptr) +108 stdcall LdrLoadDll(wstr long ptr ptr) +109 stdcall LdrLockLoaderLock(long ptr ptr) +110 stdcall LdrOpenImageFileOptionsKey(ptr long ptr) ; 5.2 SP1 and higher +111 stdcall LdrProcessRelocationBlock(ptr long ptr long) +112 stdcall LdrQueryImageFileExecutionOptions(ptr str long ptr long ptr) +# stdcall LdrQueryImageFileExecutionOptionsEx(ptr ptr long ptr long ptr long) +114 stdcall LdrQueryImageFileKeyOption(ptr ptr long ptr long ptr) +115 stdcall LdrQueryProcessModuleInformation(ptr long ptr) +# stdcall LdrSetAppCompatDllRedirectionCallback +117 stdcall LdrSetDllManifestProber(ptr) +118 stdcall LdrShutdownProcess() +119 stdcall LdrShutdownThread() +120 stdcall LdrUnloadAlternateResourceModule(ptr) +121 stdcall LdrUnloadDll(ptr) +122 stdcall LdrUnlockLoaderLock(long long) +123 stdcall LdrVerifyImageMatchesChecksum(ptr long long long) +124 extern NlsAnsiCodePage +125 extern NlsMbCodePageTag +126 extern NlsMbOemCodePageTag +127 stdcall NtAcceptConnectPort(ptr long ptr long long ptr) +128 stdcall NtAccessCheck(ptr long long ptr ptr ptr ptr ptr) +129 stdcall NtAccessCheckAndAuditAlarm(ptr long ptr ptr ptr long ptr long ptr ptr ptr) +130 stdcall NtAccessCheckByType(ptr ptr ptr long ptr long ptr ptr long ptr ptr) +131 stdcall NtAccessCheckByTypeAndAuditAlarm(ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) +132 stdcall NtAccessCheckByTypeResultList(ptr ptr ptr long ptr long ptr ptr long ptr ptr) +133 stdcall NtAccessCheckByTypeResultListAndAuditAlarm(ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) +134 stdcall NtAccessCheckByTypeResultListAndAuditAlarmByHandle(ptr ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) +135 stdcall NtAddAtom(ptr long ptr) +136 stdcall NtAddBootEntry(ptr long) +137 stdcall NtAddDriverEntry(ptr long) ; 5.2 and higher +138 stdcall NtAdjustGroupsToken(long long ptr long ptr ptr) +139 stdcall NtAdjustPrivilegesToken(long long long long long long) +140 stdcall NtAlertResumeThread(long ptr) +141 stdcall NtAlertThread(long) +142 stdcall NtAllocateLocallyUniqueId(ptr) +143 stdcall NtAllocateUserPhysicalPages(ptr ptr ptr) +144 stdcall NtAllocateUuids(ptr ptr ptr ptr) +145 stdcall NtAllocateVirtualMemory(long ptr ptr ptr long long) +146 stdcall NtApphelpCacheControl(long ptr) +147 stdcall NtAreMappedFilesTheSame(ptr ptr) +148 stdcall NtAssignProcessToJobObject(long long) +149 stdcall NtCallbackReturn(ptr long long) +150 stdcall NtCancelDeviceWakeupRequest(ptr) +151 stdcall NtCancelIoFile(long ptr) +152 stdcall NtCancelTimer(long ptr) +153 stdcall NtClearEvent(long) +154 stdcall NtClose(long) +155 stdcall NtCloseObjectAuditAlarm(ptr ptr long) +156 stdcall NtCompactKeys(long ptr) +157 stdcall NtCompareTokens(ptr ptr ptr) +158 stdcall NtCompleteConnectPort(ptr) +159 stdcall NtCompressKey(ptr) +160 stdcall NtConnectPort(ptr ptr ptr ptr ptr ptr ptr ptr) +161 stdcall NtContinue(ptr long) +162 stdcall NtCreateDebugObject(ptr long ptr long) +163 stdcall NtCreateDirectoryObject(long long long) +164 stdcall NtCreateEvent(long long long long long) +165 stdcall NtCreateEventPair(ptr long ptr) +166 stdcall NtCreateFile(ptr long ptr ptr long long long ptr long long ptr) +167 stdcall NtCreateIoCompletion(ptr long ptr long) +168 stdcall NtCreateJobObject(ptr long ptr) +169 stdcall NtCreateJobSet(long ptr long) +170 stdcall NtCreateKey(ptr long ptr long ptr long long) +171 stdcall NtCreateKeyedEvent(ptr long ptr long) +172 stdcall NtCreateMailslotFile(long long long long long long long long) +173 stdcall NtCreateMutant(ptr long ptr long) +174 stdcall NtCreateNamedPipeFile(ptr long ptr ptr long long long long long long long long long ptr) +175 stdcall NtCreatePagingFile(long long long long) +176 stdcall NtCreatePort(ptr ptr long long ptr) +177 stdcall NtCreateProcess(ptr long ptr ptr long ptr ptr ptr) +178 stdcall NtCreateProcessEx(ptr long ptr ptr long ptr ptr ptr long) +179 stdcall NtCreateProfile(ptr ptr ptr long long ptr long long long) ; CHECKME +180 stdcall NtCreateSection(ptr long ptr ptr long long long) +181 stdcall NtCreateSemaphore(ptr long ptr long long) +182 stdcall NtCreateSymbolicLinkObject(ptr long ptr ptr) +183 stdcall NtCreateThread(ptr long ptr ptr ptr ptr ptr long) +184 stdcall NtCreateTimer(ptr long ptr long) +185 stdcall NtCreateToken(ptr long ptr long ptr ptr ptr ptr ptr ptr ptr ptr ptr) +186 stdcall NtCreateWaitablePort(ptr ptr long long long) +187 stdcall -arch=win32 NtCurrentTeb() _NtCurrentTeb +188 stdcall NtDebugActiveProcess(ptr ptr) +189 stdcall NtDebugContinue(ptr ptr long) +190 stdcall NtDelayExecution(long ptr) +191 stdcall NtDeleteAtom(long) +192 stdcall NtDeleteBootEntry(long) # NtDeleteDriverEntry -@ stdcall NtDeleteFile(ptr) -@ stdcall NtDeleteKey(long) -@ stdcall NtDeleteObjectAuditAlarm(ptr ptr long) -@ stdcall NtDeleteValueKey(long ptr) -@ stdcall NtDeviceIoControlFile(long long long long long long long long long long) -@ stdcall NtDisplayString(ptr) -@ stdcall NtDuplicateObject(long long long ptr long long long) -@ stdcall NtDuplicateToken(long long long long long long) -@ stdcall NtEnumerateBootEntries(ptr ptr) -;@ stdcall NtEnumerateDriverEntries(ptr ptr) -@ stdcall NtEnumerateKey (long long long long long long) -@ stdcall NtEnumerateSystemEnvironmentValuesEx(long ptr long) -@ stdcall NtEnumerateValueKey(long long long long long long) -@ stdcall NtExtendSection(ptr ptr) -@ stdcall NtFilterToken(ptr long ptr ptr ptr ptr) -@ stdcall NtFindAtom(ptr long ptr) -@ stdcall NtFlushBuffersFile(long ptr) -@ stdcall NtFlushInstructionCache(long ptr long) -@ stdcall NtFlushKey(long) -@ stdcall NtFlushVirtualMemory(long ptr ptr long) -@ stdcall NtFlushWriteBuffer() -@ stdcall NtFreeUserPhysicalPages(ptr ptr ptr) -@ stdcall NtFreeVirtualMemory(long ptr ptr long) -@ stdcall NtFsControlFile(long long long long long long long long long long) -@ stdcall NtGetContextThread(long ptr) -@ stdcall NtGetCurrentProcessorNumber() ; 5.2 and higher -@ stdcall NtGetDevicePowerState(ptr ptr) -@ stdcall NtGetPlugPlayEvent(long long ptr long) -@ stdcall NtGetTickCount() RtlGetTickCount -@ stdcall NtGetWriteWatch(long long ptr long ptr ptr ptr) -@ stdcall NtImpersonateAnonymousToken(ptr) -@ stdcall NtImpersonateClientOfPort(ptr ptr) -@ stdcall NtImpersonateThread(ptr ptr ptr) -@ stdcall NtInitializeRegistry(long) -@ stdcall NtInitiatePowerAction (long long long long) -@ stdcall NtIsProcessInJob(long long) -@ stdcall NtIsSystemResumeAutomatic() -@ stdcall NtListenPort(ptr ptr) -@ stdcall NtLoadDriver(ptr) -@ stdcall NtLoadKey2(ptr ptr long) -@ stdcall NtLoadKey(ptr ptr) -;@ stdcall NtLoadKeyEx(ptr ptr long ptr) -@ stdcall NtLockFile(long long ptr ptr ptr ptr ptr ptr long long) -@ stdcall NtLockProductActivationKeys(ptr ptr) -@ stdcall NtLockRegistryKey(ptr) -@ stdcall NtLockVirtualMemory(long ptr ptr long) -@ stdcall NtMakePermanentObject(ptr) -@ stdcall NtMakeTemporaryObject(long) -@ stdcall NtMapUserPhysicalPages(ptr ptr ptr) -@ stdcall NtMapUserPhysicalPagesScatter(ptr ptr ptr) -@ stdcall NtMapViewOfSection(long long ptr long long ptr ptr long long long) -@ stdcall NtModifyBootEntry(ptr) +194 stdcall NtDeleteFile(ptr) +195 stdcall NtDeleteKey(long) +196 stdcall NtDeleteObjectAuditAlarm(ptr ptr long) +197 stdcall NtDeleteValueKey(long ptr) +198 stdcall NtDeviceIoControlFile(long long long long long long long long long long) +199 stdcall NtDisplayString(ptr) +200 stdcall NtDuplicateObject(long long long ptr long long long) +201 stdcall NtDuplicateToken(long long long long long long) +202 stdcall NtEnumerateBootEntries(ptr ptr) +# stdcall NtEnumerateDriverEntries(ptr ptr) +204 stdcall NtEnumerateKey (long long long long long long) +205 stdcall NtEnumerateSystemEnvironmentValuesEx(long ptr long) +206 stdcall NtEnumerateValueKey(long long long long long long) +207 stdcall NtExtendSection(ptr ptr) +208 stdcall NtFilterToken(ptr long ptr ptr ptr ptr) +209 stdcall NtFindAtom(ptr long ptr) +210 stdcall NtFlushBuffersFile(long ptr) +211 stdcall NtFlushInstructionCache(long ptr long) +212 stdcall NtFlushKey(long) +213 stdcall NtFlushVirtualMemory(long ptr ptr long) +214 stdcall NtFlushWriteBuffer() +215 stdcall NtFreeUserPhysicalPages(ptr ptr ptr) +216 stdcall NtFreeVirtualMemory(long ptr ptr long) +217 stdcall NtFsControlFile(long long long long long long long long long long) +218 stdcall NtGetContextThread(long ptr) +219 stdcall NtGetCurrentProcessorNumber() ; 5.2 and higher +220 stdcall NtGetDevicePowerState(ptr ptr) +221 stdcall NtGetPlugPlayEvent(long long ptr long) +222 stdcall NtGetTickCount() RtlGetTickCount +223 stdcall NtGetWriteWatch(long long ptr long ptr ptr ptr) +224 stdcall NtImpersonateAnonymousToken(ptr) +225 stdcall NtImpersonateClientOfPort(ptr ptr) +226 stdcall NtImpersonateThread(ptr ptr ptr) +227 stdcall NtInitializeRegistry(long) +228 stdcall NtInitiatePowerAction (long long long long) +229 stdcall NtIsProcessInJob(long long) +230 stdcall NtIsSystemResumeAutomatic() +231 stdcall NtListenPort(ptr ptr) +232 stdcall NtLoadDriver(ptr) +233 stdcall NtLoadKey2(ptr ptr long) +234 stdcall NtLoadKey(ptr ptr) +# stdcall NtLoadKeyEx(ptr ptr long ptr) +236 stdcall NtLockFile(long long ptr ptr ptr ptr ptr ptr long long) +237 stdcall NtLockProductActivationKeys(ptr ptr) +238 stdcall NtLockRegistryKey(ptr) +239 stdcall NtLockVirtualMemory(long ptr ptr long) +240 stdcall NtMakePermanentObject(ptr) +241 stdcall NtMakeTemporaryObject(long) +242 stdcall NtMapUserPhysicalPages(ptr ptr ptr) +243 stdcall NtMapUserPhysicalPagesScatter(ptr ptr ptr) +244 stdcall NtMapViewOfSection(long long ptr long long ptr ptr long long long) +245 stdcall NtModifyBootEntry(ptr) # NtModifyDriverEntry -@ stdcall NtNotifyChangeDirectoryFile(long long ptr ptr ptr ptr long long long) -@ stdcall NtNotifyChangeKey(long long ptr ptr ptr long long ptr long long) -@ stdcall NtNotifyChangeMultipleKeys(ptr long ptr ptr ptr ptr ptr long long ptr long long) -@ stdcall NtOpenDirectoryObject(long long long) -@ stdcall NtOpenEvent(long long long) -@ stdcall NtOpenEventPair(ptr long ptr) -@ stdcall NtOpenFile(ptr long ptr ptr long long) -@ stdcall NtOpenIoCompletion(ptr long ptr) -@ stdcall NtOpenJobObject(ptr long ptr) -@ stdcall NtOpenKey(ptr long ptr) -@ stdcall NtOpenKeyedEvent(ptr long ptr) -@ stdcall NtOpenMutant(ptr long ptr) -@ stdcall NtOpenObjectAuditAlarm(ptr ptr ptr ptr ptr ptr long long ptr long long ptr) -@ stdcall NtOpenProcess(ptr long ptr ptr) -@ stdcall NtOpenProcessToken(long long ptr) -@ stdcall NtOpenProcessTokenEx(long long long ptr) -@ stdcall NtOpenSection(ptr long ptr) -@ stdcall NtOpenSemaphore(long long ptr) -@ stdcall NtOpenSymbolicLinkObject (ptr long ptr) -@ stdcall NtOpenThread(ptr long ptr ptr) -@ stdcall NtOpenThreadToken(long long long ptr) -@ stdcall NtOpenThreadTokenEx(long long long long ptr) -@ stdcall NtOpenTimer(ptr long ptr) -@ stdcall NtPlugPlayControl(ptr ptr long) -@ stdcall NtPowerInformation(long ptr long ptr long) -@ stdcall NtPrivilegeCheck(ptr ptr ptr) -@ stdcall NtPrivilegeObjectAuditAlarm(ptr ptr ptr long ptr long) -@ stdcall NtPrivilegedServiceAuditAlarm(ptr ptr ptr ptr long) -@ stdcall NtProtectVirtualMemory(long ptr ptr long ptr) -@ stdcall NtPulseEvent(long ptr) -@ stdcall NtQueryAttributesFile(ptr ptr) -@ stdcall NtQueryBootEntryOrder(ptr ptr) -@ stdcall NtQueryBootOptions(ptr ptr) -@ stdcall NtQueryDebugFilterState(long long) -@ stdcall NtQueryDefaultLocale(long ptr) -@ stdcall NtQueryDefaultUILanguage(ptr) -@ stdcall NtQueryDirectoryFile(long long ptr ptr ptr ptr long long long ptr long) -@ stdcall NtQueryDirectoryObject(long ptr long long long ptr ptr) -;@ stdcall NtQueryDriverEntryOrder(ptr ptr) -@ stdcall NtQueryEaFile(long ptr ptr long long ptr long ptr long) -@ stdcall NtQueryEvent(long long ptr long ptr) -@ stdcall NtQueryFullAttributesFile(ptr ptr) -@ stdcall NtQueryInformationAtom(long long ptr long ptr) -@ stdcall NtQueryInformationFile(long ptr ptr long long) -@ stdcall NtQueryInformationJobObject(long long ptr long ptr) -@ stdcall NtQueryInformationPort(ptr long ptr long ptr) -@ stdcall NtQueryInformationProcess(long long ptr long ptr) -@ stdcall NtQueryInformationThread(long long ptr long ptr) -@ stdcall NtQueryInformationToken(long long ptr long ptr) -@ stdcall NtQueryInstallUILanguage(ptr) -@ stdcall NtQueryIntervalProfile(long ptr) -@ stdcall NtQueryIoCompletion(long long ptr long ptr) -@ stdcall NtQueryKey (long long ptr long ptr) -@ stdcall NtQueryMultipleValueKey(long ptr long ptr long ptr) -@ stdcall NtQueryMutant(long long ptr long ptr) -@ stdcall NtQueryObject(long long long long long) -@ stdcall NtQueryOpenSubKeys(ptr ptr) -;@ stdcall NtQueryOpenSubKeysEx(ptr long ptr ptr) -@ stdcall NtQueryPerformanceCounter(ptr ptr) -@ stdcall NtQueryPortInformationProcess() -@ stdcall NtQueryQuotaInformationFile(ptr ptr ptr long long ptr long ptr long) -@ stdcall NtQuerySection (long long long long long) -@ stdcall NtQuerySecurityObject (long long long long long) -@ stdcall NtQuerySemaphore (long long ptr long ptr) -@ stdcall NtQuerySymbolicLinkObject(long ptr ptr) -@ stdcall NtQuerySystemEnvironmentValue(ptr ptr long ptr) -@ stdcall NtQuerySystemEnvironmentValueEx(ptr ptr ptr ptr ptr) -@ stdcall NtQuerySystemInformation(long long long long) -@ stdcall NtQuerySystemTime(ptr) -@ stdcall NtQueryTimer(ptr long ptr long ptr) -@ stdcall NtQueryTimerResolution(long long long) -@ stdcall NtQueryValueKey(long long long long long long) -@ stdcall NtQueryVirtualMemory(long ptr long ptr long ptr) -@ stdcall NtQueryVolumeInformationFile(long ptr ptr long long) -@ stdcall NtQueueApcThread(long ptr long long long) -@ stdcall NtRaiseException(ptr ptr long) -@ stdcall NtRaiseHardError(long long long ptr long ptr) -@ stdcall NtReadFile(long long ptr ptr ptr ptr long ptr ptr) -@ stdcall NtReadFileScatter(long long ptr ptr ptr ptr long ptr ptr) -@ stdcall NtReadRequestData(ptr ptr long ptr long ptr) -@ stdcall NtReadVirtualMemory(long ptr ptr long ptr) -@ stdcall NtRegisterThreadTerminatePort(ptr) -@ stdcall NtReleaseKeyedEvent(ptr ptr long ptr) -@ stdcall NtReleaseMutant(long ptr) -@ stdcall NtReleaseSemaphore(long long ptr) -@ stdcall NtRemoveIoCompletion(ptr ptr ptr ptr ptr) -@ stdcall NtRemoveProcessDebug(ptr ptr) -@ stdcall NtRenameKey(ptr ptr) -@ stdcall NtReplaceKey(ptr long ptr) -@ stdcall NtReplyPort(ptr ptr) -@ stdcall NtReplyWaitReceivePort(ptr ptr ptr ptr) -@ stdcall NtReplyWaitReceivePortEx(ptr ptr ptr ptr ptr) -@ stdcall NtReplyWaitReplyPort(ptr ptr) -@ stdcall NtRequestDeviceWakeup(ptr) -@ stdcall NtRequestPort(ptr ptr) -@ stdcall NtRequestWaitReplyPort(ptr ptr ptr) -@ stdcall NtRequestWakeupLatency(long) -@ stdcall NtResetEvent(long ptr) -@ stdcall NtResetWriteWatch(long ptr long) -@ stdcall NtRestoreKey(long long long) -@ stdcall NtResumeProcess(ptr) -@ stdcall NtResumeThread(long long) -@ stdcall NtSaveKey(long long) -@ stdcall NtSaveKeyEx(ptr ptr long) -@ stdcall NtSaveMergedKeys(ptr ptr ptr) -@ stdcall NtSecureConnectPort(ptr ptr ptr ptr ptr ptr ptr ptr ptr) -@ stdcall NtSetBootEntryOrder(ptr ptr) -@ stdcall NtSetBootOptions(ptr long) -@ stdcall NtSetContextThread(long ptr) -@ stdcall NtSetDebugFilterState(long long long) -@ stdcall NtSetDefaultHardErrorPort(ptr) -@ stdcall NtSetDefaultLocale(long long) -@ stdcall NtSetDefaultUILanguage(long) -;@ stdcall NtSetDriverEntryOrder(ptr ptr) -@ stdcall NtSetEaFile(long ptr ptr long) -@ stdcall NtSetEvent(long long) -@ stdcall NtSetEventBoostPriority(ptr) -@ stdcall NtSetHighEventPair(ptr) -@ stdcall NtSetHighWaitLowEventPair(ptr) -@ stdcall NtSetInformationDebugObject(ptr long ptr long ptr) -@ stdcall NtSetInformationFile(long long long long long) -@ stdcall NtSetInformationJobObject(long long ptr long) -@ stdcall NtSetInformationKey(long long ptr long) -@ stdcall NtSetInformationObject(long long ptr long) -@ stdcall NtSetInformationProcess(long long long long) -@ stdcall NtSetInformationThread(long long ptr long) -@ stdcall NtSetInformationToken(long long ptr long) -@ stdcall NtSetIntervalProfile(long long) -@ stdcall NtSetIoCompletion(ptr long ptr long long) -@ stdcall NtSetLdtEntries(long int64 long int64) -@ stdcall NtSetLowEventPair(ptr) -@ stdcall NtSetLowWaitHighEventPair(ptr) -@ stdcall NtSetQuotaInformationFile(ptr ptr ptr long) -@ stdcall NtSetSecurityObject(long long ptr) -@ stdcall NtSetSystemEnvironmentValue(ptr ptr) -@ stdcall NtSetSystemEnvironmentValueEx(ptr ptr ptr ptr ptr) -@ stdcall NtSetSystemInformation(long ptr long) -@ stdcall NtSetSystemPowerState(long long long) -@ stdcall NtSetSystemTime(ptr ptr) -@ stdcall NtSetThreadExecutionState(long ptr) -@ stdcall NtSetTimer(long ptr ptr ptr long long ptr) -@ stdcall NtSetTimerResolution(long long ptr) -@ stdcall NtSetUuidSeed(ptr) -@ stdcall NtSetValueKey(long long long long long long) -@ stdcall NtSetVolumeInformationFile(long ptr ptr long long) -@ stdcall NtShutdownSystem(long) -@ stdcall NtSignalAndWaitForSingleObject(long long long ptr) -@ stdcall NtStartProfile(ptr) -@ stdcall NtStopProfile(ptr) -@ stdcall NtSuspendProcess(ptr) -@ stdcall NtSuspendThread(long ptr) -@ stdcall NtSystemDebugControl(long ptr long ptr long ptr) -@ stdcall NtTerminateJobObject(long long) -@ stdcall NtTerminateProcess(long long) -@ stdcall NtTerminateThread(long long) -@ stdcall NtTestAlert() -@ stdcall NtTraceEvent(long long long ptr) -@ stdcall NtTranslateFilePath(ptr long ptr long) -@ stdcall NtUnloadDriver(ptr) -;@ stdcall NtUnloadKey2(ptr long) -@ stdcall NtUnloadKey(long) -@ stdcall NtUnloadKeyEx(ptr ptr) -@ stdcall NtUnlockFile(long ptr ptr ptr ptr) -@ stdcall NtUnlockVirtualMemory(long ptr ptr long) -@ stdcall NtUnmapViewOfSection(long ptr) -@ stdcall NtVdmControl(long ptr) -@ stdcall NtWaitForDebugEvent(ptr long ptr ptr) -@ stdcall NtWaitForKeyedEvent(ptr ptr long ptr) -;@ stdcall NtWaitForMultipleObjects32(long ptr long long ptr) -@ stdcall NtWaitForMultipleObjects(long ptr long long ptr) -@ stdcall NtWaitForSingleObject(long long long) -@ stdcall NtWaitHighEventPair(ptr) -@ stdcall NtWaitLowEventPair(ptr) -@ stdcall NtWriteFile(long long ptr ptr ptr ptr long ptr ptr) -@ stdcall NtWriteFileGather(long long ptr ptr ptr ptr long ptr ptr) -@ stdcall NtWriteRequestData(ptr ptr long ptr long ptr) -@ stdcall NtWriteVirtualMemory(long ptr ptr long ptr) -@ stdcall NtYieldExecution() -;@ stdcall PfxFindPrefix -;@ stdcall PfxInitialize -;@ stdcall PfxInsertPrefix -;@ stdcall PfxRemovePrefix -@ stdcall RtlAbortRXact(ptr) -@ stdcall RtlAbsoluteToSelfRelativeSD(ptr ptr ptr) -@ stdcall RtlAcquirePebLock() -@ stdcall RtlAcquirePrivilege(ptr long long ptr) -@ stdcall RtlAcquireResourceExclusive(ptr long) -@ stdcall RtlAcquireResourceShared(ptr long) -@ stdcall RtlActivateActivationContext(long ptr ptr) -@ stdcall RtlActivateActivationContextEx(long ptr ptr ptr) -@ stdcall RtlAddAccessAllowedAce(ptr long long ptr) -@ stdcall RtlAddAccessAllowedAceEx(ptr long long long ptr) -@ stdcall RtlAddAccessAllowedObjectAce(ptr long long long ptr ptr ptr) -@ stdcall RtlAddAccessDeniedAce(ptr long long ptr) -@ stdcall RtlAddAccessDeniedAceEx(ptr long long long ptr) -@ stdcall RtlAddAccessDeniedObjectAce(ptr long long long ptr ptr ptr) -@ stdcall RtlAddAce(ptr long long ptr long) -@ stdcall RtlAddActionToRXact(ptr long ptr long ptr long) -@ stdcall RtlAddAtomToAtomTable(ptr wstr ptr) -@ stdcall RtlAddAttributeActionToRXact(ptr long ptr ptr ptr long ptr long) -@ stdcall RtlAddAuditAccessAce(ptr long long ptr long long) -@ stdcall RtlAddAuditAccessAceEx(ptr long long long ptr long long) -@ stdcall RtlAddAuditAccessObjectAce(ptr long long long ptr ptr ptr long long) -;@ stdcall RtlAddCompoundAce +247 stdcall NtNotifyChangeDirectoryFile(long long ptr ptr ptr ptr long long long) +248 stdcall NtNotifyChangeKey(long long ptr ptr ptr long long ptr long long) +249 stdcall NtNotifyChangeMultipleKeys(ptr long ptr ptr ptr ptr ptr long long ptr long long) +250 stdcall NtOpenDirectoryObject(long long long) +251 stdcall NtOpenEvent(long long long) +252 stdcall NtOpenEventPair(ptr long ptr) +253 stdcall NtOpenFile(ptr long ptr ptr long long) +254 stdcall NtOpenIoCompletion(ptr long ptr) +255 stdcall NtOpenJobObject(ptr long ptr) +256 stdcall NtOpenKey(ptr long ptr) +257 stdcall NtOpenKeyedEvent(ptr long ptr) +258 stdcall NtOpenMutant(ptr long ptr) +259 stdcall NtOpenObjectAuditAlarm(ptr ptr ptr ptr ptr ptr long long ptr long long ptr) +260 stdcall NtOpenProcess(ptr long ptr ptr) +261 stdcall NtOpenProcessToken(long long ptr) +262 stdcall NtOpenProcessTokenEx(long long long ptr) +263 stdcall NtOpenSection(ptr long ptr) +264 stdcall NtOpenSemaphore(long long ptr) +265 stdcall NtOpenSymbolicLinkObject (ptr long ptr) +266 stdcall NtOpenThread(ptr long ptr ptr) +267 stdcall NtOpenThreadToken(long long long ptr) +268 stdcall NtOpenThreadTokenEx(long long long long ptr) +269 stdcall NtOpenTimer(ptr long ptr) +270 stdcall NtPlugPlayControl(ptr ptr long) +271 stdcall NtPowerInformation(long ptr long ptr long) +272 stdcall NtPrivilegeCheck(ptr ptr ptr) +273 stdcall NtPrivilegeObjectAuditAlarm(ptr ptr ptr long ptr long) +274 stdcall NtPrivilegedServiceAuditAlarm(ptr ptr ptr ptr long) +275 stdcall NtProtectVirtualMemory(long ptr ptr long ptr) +276 stdcall NtPulseEvent(long ptr) +277 stdcall NtQueryAttributesFile(ptr ptr) +278 stdcall NtQueryBootEntryOrder(ptr ptr) +279 stdcall NtQueryBootOptions(ptr ptr) +280 stdcall NtQueryDebugFilterState(long long) +281 stdcall NtQueryDefaultLocale(long ptr) +282 stdcall NtQueryDefaultUILanguage(ptr) +283 stdcall NtQueryDirectoryFile(long long ptr ptr ptr ptr long long long ptr long) +284 stdcall NtQueryDirectoryObject(long ptr long long long ptr ptr) +# stdcall NtQueryDriverEntryOrder(ptr ptr) +286 stdcall NtQueryEaFile(long ptr ptr long long ptr long ptr long) +287 stdcall NtQueryEvent(long long ptr long ptr) +288 stdcall NtQueryFullAttributesFile(ptr ptr) +289 stdcall NtQueryInformationAtom(long long ptr long ptr) +290 stdcall NtQueryInformationFile(long ptr ptr long long) +291 stdcall NtQueryInformationJobObject(long long ptr long ptr) +292 stdcall NtQueryInformationPort(ptr long ptr long ptr) +293 stdcall NtQueryInformationProcess(long long ptr long ptr) +294 stdcall NtQueryInformationThread(long long ptr long ptr) +295 stdcall NtQueryInformationToken(long long ptr long ptr) +296 stdcall NtQueryInstallUILanguage(ptr) +297 stdcall NtQueryIntervalProfile(long ptr) +298 stdcall NtQueryIoCompletion(long long ptr long ptr) +299 stdcall NtQueryKey (long long ptr long ptr) +300 stdcall NtQueryMultipleValueKey(long ptr long ptr long ptr) +301 stdcall NtQueryMutant(long long ptr long ptr) +302 stdcall NtQueryObject(long long long long long) +303 stdcall NtQueryOpenSubKeys(ptr ptr) +# stdcall NtQueryOpenSubKeysEx(ptr long ptr ptr) +305 stdcall NtQueryPerformanceCounter(ptr ptr) +306 stdcall NtQueryPortInformationProcess() +307 stdcall NtQueryQuotaInformationFile(ptr ptr ptr long long ptr long ptr long) +308 stdcall NtQuerySection (long long long long long) +309 stdcall NtQuerySecurityObject (long long long long long) +310 stdcall NtQuerySemaphore (long long ptr long ptr) +311 stdcall NtQuerySymbolicLinkObject(long ptr ptr) +312 stdcall NtQuerySystemEnvironmentValue(ptr ptr long ptr) +313 stdcall NtQuerySystemEnvironmentValueEx(ptr ptr ptr ptr ptr) +314 stdcall NtQuerySystemInformation(long long long long) +315 stdcall NtQuerySystemTime(ptr) +316 stdcall NtQueryTimer(ptr long ptr long ptr) +317 stdcall NtQueryTimerResolution(long long long) +318 stdcall NtQueryValueKey(long long long long long long) +319 stdcall NtQueryVirtualMemory(long ptr long ptr long ptr) +320 stdcall NtQueryVolumeInformationFile(long ptr ptr long long) +321 stdcall NtQueueApcThread(long ptr long long long) +322 stdcall NtRaiseException(ptr ptr long) +323 stdcall NtRaiseHardError(long long long ptr long ptr) +324 stdcall NtReadFile(long long ptr ptr ptr ptr long ptr ptr) +325 stdcall NtReadFileScatter(long long ptr ptr ptr ptr long ptr ptr) +326 stdcall NtReadRequestData(ptr ptr long ptr long ptr) +327 stdcall NtReadVirtualMemory(long ptr ptr long ptr) +328 stdcall NtRegisterThreadTerminatePort(ptr) +329 stdcall NtReleaseKeyedEvent(ptr ptr long ptr) +330 stdcall NtReleaseMutant(long ptr) +331 stdcall NtReleaseSemaphore(long long ptr) +332 stdcall NtRemoveIoCompletion(ptr ptr ptr ptr ptr) +333 stdcall NtRemoveProcessDebug(ptr ptr) +334 stdcall NtRenameKey(ptr ptr) +335 stdcall NtReplaceKey(ptr long ptr) +336 stdcall NtReplyPort(ptr ptr) +337 stdcall NtReplyWaitReceivePort(ptr ptr ptr ptr) +338 stdcall NtReplyWaitReceivePortEx(ptr ptr ptr ptr ptr) +339 stdcall NtReplyWaitReplyPort(ptr ptr) +340 stdcall NtRequestDeviceWakeup(ptr) +341 stdcall NtRequestPort(ptr ptr) +342 stdcall NtRequestWaitReplyPort(ptr ptr ptr) +343 stdcall NtRequestWakeupLatency(long) +344 stdcall NtResetEvent(long ptr) +345 stdcall NtResetWriteWatch(long ptr long) +346 stdcall NtRestoreKey(long long long) +347 stdcall NtResumeProcess(ptr) +348 stdcall NtResumeThread(long long) +349 stdcall NtSaveKey(long long) +350 stdcall NtSaveKeyEx(ptr ptr long) +351 stdcall NtSaveMergedKeys(ptr ptr ptr) +352 stdcall NtSecureConnectPort(ptr ptr ptr ptr ptr ptr ptr ptr ptr) +353 stdcall NtSetBootEntryOrder(ptr ptr) +354 stdcall NtSetBootOptions(ptr long) +355 stdcall NtSetContextThread(long ptr) +356 stdcall NtSetDebugFilterState(long long long) +357 stdcall NtSetDefaultHardErrorPort(ptr) +358 stdcall NtSetDefaultLocale(long long) +359 stdcall NtSetDefaultUILanguage(long) +# stdcall NtSetDriverEntryOrder(ptr ptr) +361 stdcall NtSetEaFile(long ptr ptr long) +362 stdcall NtSetEvent(long long) +363 stdcall NtSetEventBoostPriority(ptr) +364 stdcall NtSetHighEventPair(ptr) +365 stdcall NtSetHighWaitLowEventPair(ptr) +366 stdcall NtSetInformationDebugObject(ptr long ptr long ptr) +367 stdcall NtSetInformationFile(long long long long long) +368 stdcall NtSetInformationJobObject(long long ptr long) +369 stdcall NtSetInformationKey(long long ptr long) +370 stdcall NtSetInformationObject(long long ptr long) +371 stdcall NtSetInformationProcess(long long long long) +372 stdcall NtSetInformationThread(long long ptr long) +373 stdcall NtSetInformationToken(long long ptr long) +374 stdcall NtSetIntervalProfile(long long) +375 stdcall NtSetIoCompletion(ptr long ptr long long) +376 stdcall NtSetLdtEntries(long int64 long int64) +377 stdcall NtSetLowEventPair(ptr) +378 stdcall NtSetLowWaitHighEventPair(ptr) +379 stdcall NtSetQuotaInformationFile(ptr ptr ptr long) +380 stdcall NtSetSecurityObject(long long ptr) +381 stdcall NtSetSystemEnvironmentValue(ptr ptr) +382 stdcall NtSetSystemEnvironmentValueEx(ptr ptr ptr ptr ptr) +383 stdcall NtSetSystemInformation(long ptr long) +384 stdcall NtSetSystemPowerState(long long long) +385 stdcall NtSetSystemTime(ptr ptr) +386 stdcall NtSetThreadExecutionState(long ptr) +387 stdcall NtSetTimer(long ptr ptr ptr long long ptr) +388 stdcall NtSetTimerResolution(long long ptr) +389 stdcall NtSetUuidSeed(ptr) +390 stdcall NtSetValueKey(long long long long long long) +391 stdcall NtSetVolumeInformationFile(long ptr ptr long long) +392 stdcall NtShutdownSystem(long) +393 stdcall NtSignalAndWaitForSingleObject(long long long ptr) +394 stdcall NtStartProfile(ptr) +395 stdcall NtStopProfile(ptr) +396 stdcall NtSuspendProcess(ptr) +397 stdcall NtSuspendThread(long ptr) +398 stdcall NtSystemDebugControl(long ptr long ptr long ptr) +399 stdcall NtTerminateJobObject(long long) +400 stdcall NtTerminateProcess(long long) +401 stdcall NtTerminateThread(long long) +402 stdcall NtTestAlert() +403 stdcall NtTraceEvent(long long long ptr) +404 stdcall NtTranslateFilePath(ptr long ptr long) +405 stdcall NtUnloadDriver(ptr) +# stdcall NtUnloadKey2(ptr long) +407 stdcall NtUnloadKey(long) +408 stdcall NtUnloadKeyEx(ptr ptr) +409 stdcall NtUnlockFile(long ptr ptr ptr ptr) +410 stdcall NtUnlockVirtualMemory(long ptr ptr long) +411 stdcall NtUnmapViewOfSection(long ptr) +412 stdcall NtVdmControl(long ptr) +413 stdcall NtWaitForDebugEvent(ptr long ptr ptr) +414 stdcall NtWaitForKeyedEvent(ptr ptr long ptr) +# stdcall NtWaitForMultipleObjects32(long ptr long long ptr) +416 stdcall NtWaitForMultipleObjects(long ptr long long ptr) +417 stdcall NtWaitForSingleObject(long long long) +418 stdcall NtWaitHighEventPair(ptr) +419 stdcall NtWaitLowEventPair(ptr) +420 stdcall NtWriteFile(long long ptr ptr ptr ptr long ptr ptr) +421 stdcall NtWriteFileGather(long long ptr ptr ptr ptr long ptr ptr) +422 stdcall NtWriteRequestData(ptr ptr long ptr long ptr) +423 stdcall NtWriteVirtualMemory(long ptr ptr long ptr) +424 stdcall NtYieldExecution() +# stdcall PfxFindPrefix +# stdcall PfxInitialize +# stdcall PfxInsertPrefix +# stdcall PfxRemovePrefix +429 stdcall RtlAbortRXact(ptr) +430 stdcall RtlAbsoluteToSelfRelativeSD(ptr ptr ptr) +431 stdcall RtlAcquirePebLock() +432 stdcall RtlAcquirePrivilege(ptr long long ptr) +433 stdcall RtlAcquireResourceExclusive(ptr long) +434 stdcall RtlAcquireResourceShared(ptr long) +435 stdcall RtlActivateActivationContext(long ptr ptr) +436 stdcall RtlActivateActivationContextEx(long ptr ptr ptr) +437 stdcall RtlAddAccessAllowedAce(ptr long long ptr) +438 stdcall RtlAddAccessAllowedAceEx(ptr long long long ptr) +439 stdcall RtlAddAccessAllowedObjectAce(ptr long long long ptr ptr ptr) +440 stdcall RtlAddAccessDeniedAce(ptr long long ptr) +441 stdcall RtlAddAccessDeniedAceEx(ptr long long long ptr) +442 stdcall RtlAddAccessDeniedObjectAce(ptr long long long ptr ptr ptr) +443 stdcall RtlAddAce(ptr long long ptr long) +444 stdcall RtlAddActionToRXact(ptr long ptr long ptr long) +445 stdcall RtlAddAtomToAtomTable(ptr wstr ptr) +446 stdcall RtlAddAttributeActionToRXact(ptr long ptr ptr ptr long ptr long) +447 stdcall RtlAddAuditAccessAce(ptr long long ptr long long) +448 stdcall RtlAddAuditAccessAceEx(ptr long long long ptr long long) +449 stdcall RtlAddAuditAccessObjectAce(ptr long long long ptr ptr ptr long long) +# stdcall RtlAddCompoundAce @ stdcall -arch=x86_64 RtlAddFunctionTable(ptr long long) -@ stdcall RtlAddRefActivationContext(ptr) -@ stdcall RtlAddRefMemoryStream(ptr) -@ stdcall RtlAddVectoredContinueHandler(long ptr) -@ stdcall RtlAddVectoredExceptionHandler(long ptr) -;@ stdcall RtlAddressInSectionTable -@ stdcall RtlAdjustPrivilege(long long long ptr) -@ stdcall RtlAllocateActivationContextStack(ptr) ; CHECKME -@ stdcall RtlAllocateAndInitializeSid(ptr long long long long long long long long long ptr) -@ stdcall RtlAllocateHandle(ptr ptr) -@ stdcall RtlAllocateHeap(ptr long ptr) -@ stdcall RtlAnsiCharToUnicodeChar(ptr) -@ stdcall RtlAnsiStringToUnicodeSize(ptr) RtlxAnsiStringToUnicodeSize -@ stdcall RtlAnsiStringToUnicodeString(ptr ptr long) -@ stdcall RtlAppendAsciizToString(ptr str) -;@ stdcall RtlAppendPathElement -@ stdcall RtlAppendStringToString(ptr ptr) -@ stdcall RtlAppendUnicodeStringToString(ptr ptr) -@ stdcall RtlAppendUnicodeToString(ptr wstr) -@ stdcall RtlApplicationVerifierStop(ptr str ptr str ptr str ptr str ptr str) -@ stdcall RtlApplyRXact(ptr) -@ stdcall RtlApplyRXactNoFlush(ptr) -@ stdcall RtlAreAllAccessesGranted(long long) -@ stdcall RtlAreAnyAccessesGranted(long long) -@ stdcall RtlAreBitsClear(ptr long long) -@ stdcall RtlAreBitsSet(ptr long long) -@ stdcall RtlAssert(ptr ptr long ptr) -;@ stdcall RtlCancelTimer -@ stdcall -register RtlCaptureContext(ptr) -@ stdcall RtlCaptureStackBackTrace(long long ptr ptr) -;@ stdcall RtlCaptureStackContext -@ stdcall RtlCharToInteger(ptr long ptr) -@ stdcall RtlCheckForOrphanedCriticalSections(ptr) -;@ stdcall RtlCheckProcessParameters -@ stdcall RtlCheckRegistryKey(long ptr) -@ stdcall RtlClearAllBits(ptr) -@ stdcall RtlClearBits(ptr long long) -@ stdcall RtlCloneMemoryStream(ptr ptr) -@ stdcall RtlCommitMemoryStream(ptr long) -@ stdcall RtlCompactHeap(long long) -@ stdcall RtlCompareMemory(ptr ptr long) -@ stdcall RtlCompareMemoryUlong(ptr long long) -@ stdcall RtlCompareString(ptr ptr long) -@ stdcall RtlCompareUnicodeString (ptr ptr long) -@ stdcall RtlCompressBuffer(long ptr long ptr long long ptr ptr) -@ stdcall RtlComputeCrc32(long ptr long) -@ stdcall RtlComputeImportTableHash(ptr ptr long) -@ stdcall RtlComputePrivatizedDllName_U(ptr ptr ptr) -@ stdcall RtlConsoleMultiByteToUnicodeN(ptr long ptr ptr long ptr) -@ stdcall RtlConvertExclusiveToShared(ptr) -@ stdcall -arch=win32 -ret64 RtlConvertLongToLargeInteger(long) -@ stdcall RtlConvertSharedToExclusive(ptr) -@ stdcall RtlConvertSidToUnicodeString(ptr ptr long) -@ stdcall RtlConvertToAutoInheritSecurityObject(ptr ptr ptr ptr long ptr) -;@ stdcall RtlConvertUiListToApiList -@ stdcall -arch=win32 -ret64 RtlConvertUlongToLargeInteger(long) -@ stdcall RtlCopyLuid(ptr ptr) -@ stdcall RtlCopyLuidAndAttributesArray(long ptr ptr) -@ stdcall RtlCopyMappedMemory(ptr ptr long) -@ stdcall RtlCopyMemoryStreamTo(ptr ptr int64 ptr ptr) -@ stdcall RtlCopyOutOfProcessMemoryStreamTo(ptr ptr int64 ptr ptr) RtlCopyMemoryStreamTo -@ stdcall RtlCopySecurityDescriptor(ptr ptr) -@ stdcall RtlCopySid(long ptr ptr) -@ stdcall RtlCopySidAndAttributesArray(long ptr long ptr ptr ptr ptr) -@ stdcall RtlCopyString(ptr ptr) -@ stdcall RtlCopyUnicodeString(ptr ptr) -@ stdcall RtlCreateAcl(ptr long long) -@ stdcall RtlCreateActivationContext(long ptr long ptr ptr ptr) -@ stdcall RtlCreateAndSetSD(ptr long ptr ptr ptr) -@ stdcall RtlCreateAtomTable(long ptr) -@ stdcall RtlCreateBootStatusDataFile() -@ stdcall RtlCreateEnvironment(long ptr) -@ stdcall RtlCreateHeap(long ptr long long ptr ptr) -@ stdcall RtlCreateProcessParameters(ptr ptr ptr ptr ptr ptr ptr ptr ptr ptr) -@ stdcall RtlCreateQueryDebugBuffer(long long) -@ stdcall RtlCreateRegistryKey(long wstr) -@ stdcall RtlCreateSecurityDescriptor(ptr long) -@ stdcall RtlCreateSystemVolumeInformationFolder(ptr) -@ stdcall RtlCreateTagHeap(ptr long str str) -@ stdcall RtlCreateTimer(ptr ptr ptr ptr long long long) -@ stdcall RtlCreateTimerQueue(ptr) -@ stdcall RtlCreateUnicodeString(ptr wstr) -@ stdcall RtlCreateUnicodeStringFromAsciiz(ptr str) -@ stdcall RtlCreateUserProcess(ptr long ptr ptr ptr ptr long ptr ptr ptr) -@ stdcall RtlCreateUserSecurityObject(ptr long ptr ptr long ptr ptr) -@ stdcall RtlCreateUserThread(long ptr long ptr long long ptr ptr ptr ptr) -@ stdcall RtlCustomCPToUnicodeN(ptr wstr long ptr str long) -@ stdcall RtlCutoverTimeToSystemTime(ptr ptr ptr long) -@ stdcall RtlDeNormalizeProcessParams(ptr) -@ stdcall RtlDeactivateActivationContext(long long) +451 stdcall RtlAddRefActivationContext(ptr) +452 stdcall RtlAddRefMemoryStream(ptr) +453 stdcall RtlAddVectoredContinueHandler(long ptr) +454 stdcall RtlAddVectoredExceptionHandler(long ptr) +# stdcall RtlAddressInSectionTable +456 stdcall RtlAdjustPrivilege(long long long ptr) +457 stdcall RtlAllocateActivationContextStack(ptr) ; CHECKME +458 stdcall RtlAllocateAndInitializeSid(ptr long long long long long long long long long ptr) +459 stdcall RtlAllocateHandle(ptr ptr) +460 stdcall RtlAllocateHeap(ptr long ptr) +461 stdcall RtlAnsiCharToUnicodeChar(ptr) +462 stdcall RtlAnsiStringToUnicodeSize(ptr) RtlxAnsiStringToUnicodeSize +463 stdcall RtlAnsiStringToUnicodeString(ptr ptr long) +464 stdcall RtlAppendAsciizToString(ptr str) +# stdcall RtlAppendPathElement +466 stdcall RtlAppendStringToString(ptr ptr) +467 stdcall RtlAppendUnicodeStringToString(ptr ptr) +468 stdcall RtlAppendUnicodeToString(ptr wstr) +469 stdcall RtlApplicationVerifierStop(ptr str ptr str ptr str ptr str ptr str) +470 stdcall RtlApplyRXact(ptr) +471 stdcall RtlApplyRXactNoFlush(ptr) +472 stdcall RtlAreAllAccessesGranted(long long) +473 stdcall RtlAreAnyAccessesGranted(long long) +474 stdcall RtlAreBitsClear(ptr long long) +475 stdcall RtlAreBitsSet(ptr long long) +476 stdcall RtlAssert(ptr ptr long ptr) +# stdcall RtlCancelTimer +478 stdcall -register RtlCaptureContext(ptr) +479 stdcall RtlCaptureStackBackTrace(long long ptr ptr) +# stdcall RtlCaptureStackContext +481 stdcall RtlCharToInteger(ptr long ptr) +482 stdcall RtlCheckForOrphanedCriticalSections(ptr) +# stdcall RtlCheckProcessParameters +484 stdcall RtlCheckRegistryKey(long ptr) +485 stdcall RtlClearAllBits(ptr) +486 stdcall RtlClearBits(ptr long long) +487 stdcall RtlCloneMemoryStream(ptr ptr) +488 stdcall RtlCommitMemoryStream(ptr long) +489 stdcall RtlCompactHeap(long long) +490 stdcall RtlCompareMemory(ptr ptr long) +491 stdcall RtlCompareMemoryUlong(ptr long long) +492 stdcall RtlCompareString(ptr ptr long) +493 stdcall RtlCompareUnicodeString (ptr ptr long) +494 stdcall RtlCompressBuffer(long ptr long ptr long long ptr ptr) +495 stdcall RtlComputeCrc32(long ptr long) +496 stdcall RtlComputeImportTableHash(ptr ptr long) +497 stdcall RtlComputePrivatizedDllName_U(ptr ptr ptr) +498 stdcall RtlConsoleMultiByteToUnicodeN(ptr long ptr ptr long ptr) +499 stdcall RtlConvertExclusiveToShared(ptr) +500 stdcall -arch=win32 -ret64 RtlConvertLongToLargeInteger(long) +501 stdcall RtlConvertSharedToExclusive(ptr) +502 stdcall RtlConvertSidToUnicodeString(ptr ptr long) +503 stdcall RtlConvertToAutoInheritSecurityObject(ptr ptr ptr ptr long ptr) +# stdcall RtlConvertUiListToApiList +505 stdcall -arch=win32 -ret64 RtlConvertUlongToLargeInteger(long) +506 stdcall RtlCopyLuid(ptr ptr) +507 stdcall RtlCopyLuidAndAttributesArray(long ptr ptr) +508 stdcall RtlCopyMappedMemory(ptr ptr long) +509 stdcall RtlCopyMemoryStreamTo(ptr ptr int64 ptr ptr) +510 stdcall RtlCopyOutOfProcessMemoryStreamTo(ptr ptr int64 ptr ptr) RtlCopyMemoryStreamTo +511 stdcall RtlCopySecurityDescriptor(ptr ptr) +512 stdcall RtlCopySid(long ptr ptr) +513 stdcall RtlCopySidAndAttributesArray(long ptr long ptr ptr ptr ptr) +514 stdcall RtlCopyString(ptr ptr) +515 stdcall RtlCopyUnicodeString(ptr ptr) +516 stdcall RtlCreateAcl(ptr long long) +517 stdcall RtlCreateActivationContext(long ptr long ptr ptr ptr) +518 stdcall RtlCreateAndSetSD(ptr long ptr ptr ptr) +519 stdcall RtlCreateAtomTable(long ptr) +520 stdcall RtlCreateBootStatusDataFile() +521 stdcall RtlCreateEnvironment(long ptr) +522 stdcall RtlCreateHeap(long ptr long long ptr ptr) +523 stdcall RtlCreateProcessParameters(ptr ptr ptr ptr ptr ptr ptr ptr ptr ptr) +524 stdcall RtlCreateQueryDebugBuffer(long long) +525 stdcall RtlCreateRegistryKey(long wstr) +526 stdcall RtlCreateSecurityDescriptor(ptr long) +527 stdcall RtlCreateSystemVolumeInformationFolder(ptr) +528 stdcall RtlCreateTagHeap(ptr long str str) +529 stdcall RtlCreateTimer(ptr ptr ptr ptr long long long) +530 stdcall RtlCreateTimerQueue(ptr) +531 stdcall RtlCreateUnicodeString(ptr wstr) +532 stdcall RtlCreateUnicodeStringFromAsciiz(ptr str) +533 stdcall RtlCreateUserProcess(ptr long ptr ptr ptr ptr long ptr ptr ptr) +534 stdcall RtlCreateUserSecurityObject(ptr long ptr ptr long ptr ptr) +535 stdcall RtlCreateUserThread(long ptr long ptr long long ptr ptr ptr ptr) +536 stdcall RtlCustomCPToUnicodeN(ptr wstr long ptr str long) +537 stdcall RtlCutoverTimeToSystemTime(ptr ptr ptr long) +538 stdcall RtlDeNormalizeProcessParams(ptr) +539 stdcall RtlDeactivateActivationContext(long long) # RtlDebugPrintTimes -@ stdcall RtlDecodePointer(ptr) -@ stdcall RtlDecodeSystemPointer(ptr) RtlEncodeSystemPointer -@ stdcall RtlDecompressBuffer(long ptr long ptr long ptr) -@ stdcall RtlDecompressFragment(long ptr long ptr long long ptr ptr) -@ stdcall RtlDefaultNpAcl(ptr) -@ stdcall RtlDelete(ptr) -@ stdcall RtlDeleteAce(ptr long) -@ stdcall RtlDeleteAtomFromAtomTable(ptr long) -@ stdcall RtlDeleteCriticalSection(ptr) -@ stdcall RtlDeleteElementGenericTable(ptr ptr) -@ stdcall RtlDeleteElementGenericTableAvl(ptr ptr) +541 stdcall RtlDecodePointer(ptr) +542 stdcall RtlDecodeSystemPointer(ptr) RtlEncodeSystemPointer +543 stdcall RtlDecompressBuffer(long ptr long ptr long ptr) +544 stdcall RtlDecompressFragment(long ptr long ptr long long ptr ptr) +545 stdcall RtlDefaultNpAcl(ptr) +546 stdcall RtlDelete(ptr) +547 stdcall RtlDeleteAce(ptr long) +548 stdcall RtlDeleteAtomFromAtomTable(ptr long) +549 stdcall RtlDeleteCriticalSection(ptr) +550 stdcall RtlDeleteElementGenericTable(ptr ptr) +551 stdcall RtlDeleteElementGenericTableAvl(ptr ptr) @ cdecl -arch=x86_64 RtlDeleteFunctionTable(ptr) -@ stdcall RtlDeleteNoSplay(ptr ptr) -@ stdcall RtlDeleteRegistryValue(long ptr ptr) -@ stdcall RtlDeleteResource(ptr) -@ stdcall RtlDeleteSecurityObject(ptr) -@ stdcall RtlDeleteTimer(ptr ptr ptr) -@ stdcall RtlDeleteTimerQueue(ptr) -@ stdcall RtlDeleteTimerQueueEx(ptr ptr) -@ stdcall RtlDeregisterWait(ptr) -@ stdcall RtlDeregisterWaitEx(ptr ptr) -@ stdcall RtlDestroyAtomTable(ptr) -@ stdcall RtlDestroyEnvironment(ptr) -@ stdcall RtlDestroyHandleTable(ptr) -@ stdcall RtlDestroyHeap(long) -@ stdcall RtlDestroyProcessParameters(ptr) -@ stdcall RtlDestroyQueryDebugBuffer(ptr) -@ stdcall RtlDetermineDosPathNameType_U(wstr) -@ stdcall RtlDllShutdownInProgress() -@ stdcall RtlDnsHostNameToComputerName(ptr ptr long) -@ stdcall RtlDoesFileExists_U(wstr) -@ stdcall RtlDosApplyFileIsolationRedirection_Ustr(long ptr ptr ptr ptr ptr ptr ptr ptr) -@ stdcall RtlDosPathNameToNtPathName_U(wstr ptr ptr ptr) -@ stdcall RtlDosPathNameToNtPathName_U_WithStatus(wstr ptr ptr ptr) ; 5.2 SP1, and higher -@ stdcall RtlDosPathNameToRelativeNtPathName_U(ptr ptr ptr ptr) -@ stdcall RtlDosPathNameToRelativeNtPathName_U_WithStatus(wstr ptr ptr ptr) -@ stdcall RtlDosSearchPath_U(wstr wstr wstr long ptr ptr) -@ stdcall RtlDosSearchPath_Ustr(long ptr ptr ptr ptr ptr ptr ptr ptr) -@ stdcall RtlDowncaseUnicodeChar(long) -@ stdcall RtlDowncaseUnicodeString(ptr ptr long) -@ stdcall RtlDumpResource(ptr) -@ stdcall RtlDuplicateUnicodeString(long ptr ptr) -@ stdcall RtlEmptyAtomTable(ptr long) -;@ stdcall RtlEnableEarlyCriticalSectionEventCreation -@ stdcall RtlEncodePointer(ptr) -@ stdcall RtlEncodeSystemPointer(ptr) -@ stdcall -arch=win32 -ret64 RtlEnlargedIntegerMultiply(long long) -@ stdcall -arch=win32 RtlEnlargedUnsignedDivide(double long ptr) -@ stdcall -arch=win32 -ret64 RtlEnlargedUnsignedMultiply(long long) -@ stdcall RtlEnterCriticalSection(ptr) -@ stdcall RtlEnumProcessHeaps(ptr ptr) -@ stdcall RtlEnumerateGenericTable(ptr long) -@ stdcall RtlEnumerateGenericTableAvl(ptr long) -@ stdcall RtlEnumerateGenericTableLikeADirectory(ptr ptr ptr long ptr ptr ptr) -@ stdcall RtlEnumerateGenericTableWithoutSplaying(ptr ptr) -@ stdcall RtlEnumerateGenericTableWithoutSplayingAvl(ptr ptr) -@ stdcall RtlEqualComputerName(ptr ptr) -@ stdcall RtlEqualDomainName(ptr ptr) -@ stdcall RtlEqualLuid(ptr ptr) -@ stdcall RtlEqualPrefixSid(ptr ptr) -@ stdcall RtlEqualSid(long long) -@ stdcall RtlEqualString(ptr ptr long) -@ stdcall RtlEqualUnicodeString(ptr ptr long) -@ stdcall RtlEraseUnicodeString(ptr) -@ stdcall RtlExitUserThread(long) -@ stdcall RtlExpandEnvironmentStrings_U(ptr ptr ptr ptr) -@ stdcall RtlExtendHeap(ptr long ptr ptr) -@ stdcall -arch=win32 -ret64 RtlExtendedIntegerMultiply(double long) -@ stdcall -arch=win32 -ret64 RtlExtendedLargeIntegerDivide(double long ptr) -@ stdcall -arch=win32 -ret64 RtlExtendedMagicDivide(double double long) -@ stdcall RtlFillMemory(ptr long long) -@ stdcall RtlFillMemoryUlong(ptr long long) -@ stdcall RtlFinalReleaseOutOfProcessMemoryStream(ptr) -@ stdcall RtlFindActivationContextSectionGuid(long ptr long ptr ptr) -@ stdcall RtlFindActivationContextSectionString(long ptr long ptr ptr) -@ stdcall RtlFindCharInUnicodeString(long ptr ptr ptr) -@ stdcall RtlFindClearBits(ptr long long) -@ stdcall RtlFindClearBitsAndSet(ptr long long) -@ stdcall RtlFindClearRuns(ptr ptr long long) -@ stdcall RtlFindLastBackwardRunClear(ptr long ptr) -@ stdcall RtlFindLeastSignificantBit(double) -@ stdcall RtlFindLongestRunClear(ptr long) -@ stdcall RtlFindMessage(long long long long ptr) -@ stdcall RtlFindMostSignificantBit(double) -@ stdcall RtlFindNextForwardRunClear(ptr long ptr) -@ stdcall RtlFindSetBits(ptr long long) -@ stdcall RtlFindSetBitsAndClear(ptr long long) -@ stdcall RtlFirstEntrySList(ptr) -@ stdcall RtlFirstFreeAce(ptr ptr) -@ stdcall RtlFlushSecureMemoryCache(ptr ptr) -@ stdcall RtlFormatCurrentUserKeyPath(ptr) -@ stdcall RtlFormatMessage(ptr long long long long ptr ptr long ptr) -@ stdcall RtlFormatMessageEx(ptr long long long long ptr ptr long ptr long) -@ stdcall RtlFreeActivationContextStack(ptr) -@ stdcall RtlFreeAnsiString(long) -@ stdcall RtlFreeHandle(ptr ptr) -@ stdcall RtlFreeHeap(long long long) -@ stdcall RtlFreeOemString(ptr) -@ stdcall RtlFreeSid(long) -@ stdcall RtlFreeThreadActivationContextStack() -@ stdcall RtlFreeUnicodeString(ptr) -@ stdcall RtlFreeUserThreadStack(ptr ptr) ; 4.0 to 5.2 only -@ stdcall RtlGUIDFromString(ptr ptr) -@ stdcall RtlGenerate8dot3Name(ptr ptr long ptr) -@ stdcall RtlGetAce(ptr long ptr) -@ stdcall RtlGetActiveActivationContext(ptr) -@ stdcall RtlGetCallersAddress(ptr ptr) -@ stdcall RtlGetCompressionWorkSpaceSize(long ptr ptr) -@ stdcall RtlGetControlSecurityDescriptor(ptr ptr ptr) -@ stdcall RtlGetCriticalSectionRecursionCount(ptr) -@ stdcall RtlGetCurrentDirectory_U(long ptr) -@ stdcall RtlGetCurrentPeb() -@ stdcall RtlGetCurrentProcessorNumber() ; 5.2 SP1 and higher -@ stdcall RtlGetDaclSecurityDescriptor(ptr ptr ptr ptr) -@ stdcall RtlGetElementGenericTable(ptr long) -@ stdcall RtlGetElementGenericTableAvl(ptr long) -;@ stdcall RtlGetFrame -@ stdcall RtlGetFullPathName_U(wstr long ptr ptr) -@ stdcall RtlGetFullPathName_UstrEx(ptr ptr ptr ptr ptr ptr ptr ptr) -@ stdcall RtlGetGroupSecurityDescriptor(ptr ptr ptr) -@ stdcall RtlGetLastNtStatus() -@ stdcall RtlGetLastWin32Error() -@ stdcall RtlGetLengthWithoutLastFullDosOrNtPathElement(long ptr ptr) +552 stdcall RtlDeleteNoSplay(ptr ptr) +553 stdcall RtlDeleteRegistryValue(long ptr ptr) +554 stdcall RtlDeleteResource(ptr) +555 stdcall RtlDeleteSecurityObject(ptr) +556 stdcall RtlDeleteTimer(ptr ptr ptr) +557 stdcall RtlDeleteTimerQueue(ptr) +558 stdcall RtlDeleteTimerQueueEx(ptr ptr) +559 stdcall RtlDeregisterWait(ptr) +560 stdcall RtlDeregisterWaitEx(ptr ptr) +561 stdcall RtlDestroyAtomTable(ptr) +562 stdcall RtlDestroyEnvironment(ptr) +563 stdcall RtlDestroyHandleTable(ptr) +564 stdcall RtlDestroyHeap(long) +565 stdcall RtlDestroyProcessParameters(ptr) +566 stdcall RtlDestroyQueryDebugBuffer(ptr) +567 stdcall RtlDetermineDosPathNameType_U(wstr) +568 stdcall RtlDllShutdownInProgress() +569 stdcall RtlDnsHostNameToComputerName(ptr ptr long) +570 stdcall RtlDoesFileExists_U(wstr) +571 stdcall RtlDosApplyFileIsolationRedirection_Ustr(long ptr ptr ptr ptr ptr ptr ptr ptr) +572 stdcall RtlDosPathNameToNtPathName_U(wstr ptr ptr ptr) +573 stdcall RtlDosPathNameToNtPathName_U_WithStatus(wstr ptr ptr ptr) ; 5.2 SP1, and higher +574 stdcall RtlDosPathNameToRelativeNtPathName_U(ptr ptr ptr ptr) +575 stdcall RtlDosPathNameToRelativeNtPathName_U_WithStatus(wstr ptr ptr ptr) +576 stdcall RtlDosSearchPath_U(wstr wstr wstr long ptr ptr) +577 stdcall RtlDosSearchPath_Ustr(long ptr ptr ptr ptr ptr ptr ptr ptr) +578 stdcall RtlDowncaseUnicodeChar(long) +579 stdcall RtlDowncaseUnicodeString(ptr ptr long) +580 stdcall RtlDumpResource(ptr) +581 stdcall RtlDuplicateUnicodeString(long ptr ptr) +582 stdcall RtlEmptyAtomTable(ptr long) +# stdcall RtlEnableEarlyCriticalSectionEventCreation +584 stdcall RtlEncodePointer(ptr) +585 stdcall RtlEncodeSystemPointer(ptr) +586 stdcall -arch=win32 -ret64 RtlEnlargedIntegerMultiply(long long) +587 stdcall -arch=win32 RtlEnlargedUnsignedDivide(double long ptr) +588 stdcall -arch=win32 -ret64 RtlEnlargedUnsignedMultiply(long long) +589 stdcall RtlEnterCriticalSection(ptr) +590 stdcall RtlEnumProcessHeaps(ptr ptr) +591 stdcall RtlEnumerateGenericTable(ptr long) +592 stdcall RtlEnumerateGenericTableAvl(ptr long) +593 stdcall RtlEnumerateGenericTableLikeADirectory(ptr ptr ptr long ptr ptr ptr) +594 stdcall RtlEnumerateGenericTableWithoutSplaying(ptr ptr) +595 stdcall RtlEnumerateGenericTableWithoutSplayingAvl(ptr ptr) +596 stdcall RtlEqualComputerName(ptr ptr) +597 stdcall RtlEqualDomainName(ptr ptr) +598 stdcall RtlEqualLuid(ptr ptr) +599 stdcall RtlEqualPrefixSid(ptr ptr) +600 stdcall RtlEqualSid(long long) +601 stdcall RtlEqualString(ptr ptr long) +602 stdcall RtlEqualUnicodeString(ptr ptr long) +603 stdcall RtlEraseUnicodeString(ptr) +604 stdcall RtlExitUserThread(long) +605 stdcall RtlExpandEnvironmentStrings_U(ptr ptr ptr ptr) +606 stdcall RtlExtendHeap(ptr long ptr ptr) +607 stdcall -arch=win32 -ret64 RtlExtendedIntegerMultiply(double long) +608 stdcall -arch=win32 -ret64 RtlExtendedLargeIntegerDivide(double long ptr) +609 stdcall -arch=win32 -ret64 RtlExtendedMagicDivide(double double long) +610 stdcall RtlFillMemory(ptr long long) +611 stdcall RtlFillMemoryUlong(ptr long long) +612 stdcall RtlFinalReleaseOutOfProcessMemoryStream(ptr) +613 stdcall RtlFindActivationContextSectionGuid(long ptr long ptr ptr) +614 stdcall RtlFindActivationContextSectionString(long ptr long ptr ptr) +615 stdcall RtlFindCharInUnicodeString(long ptr ptr ptr) +616 stdcall RtlFindClearBits(ptr long long) +617 stdcall RtlFindClearBitsAndSet(ptr long long) +618 stdcall RtlFindClearRuns(ptr ptr long long) +619 stdcall RtlFindLastBackwardRunClear(ptr long ptr) +620 stdcall RtlFindLeastSignificantBit(double) +621 stdcall RtlFindLongestRunClear(ptr long) +622 stdcall RtlFindMessage(long long long long ptr) +623 stdcall RtlFindMostSignificantBit(double) +624 stdcall RtlFindNextForwardRunClear(ptr long ptr) +625 stdcall RtlFindSetBits(ptr long long) +626 stdcall RtlFindSetBitsAndClear(ptr long long) +627 stdcall RtlFirstEntrySList(ptr) +628 stdcall RtlFirstFreeAce(ptr ptr) +629 stdcall RtlFlushSecureMemoryCache(ptr ptr) +630 stdcall RtlFormatCurrentUserKeyPath(ptr) +631 stdcall RtlFormatMessage(ptr long long long long ptr ptr long ptr) +632 stdcall RtlFormatMessageEx(ptr long long long long ptr ptr long ptr long) +633 stdcall RtlFreeActivationContextStack(ptr) +634 stdcall RtlFreeAnsiString(long) +635 stdcall RtlFreeHandle(ptr ptr) +636 stdcall RtlFreeHeap(long long long) +637 stdcall RtlFreeOemString(ptr) +638 stdcall RtlFreeSid(long) +639 stdcall RtlFreeThreadActivationContextStack() +640 stdcall RtlFreeUnicodeString(ptr) +641 stdcall RtlFreeUserThreadStack(ptr ptr) ; 4.0 to 5.2 only +642 stdcall RtlGUIDFromString(ptr ptr) +643 stdcall RtlGenerate8dot3Name(ptr ptr long ptr) +644 stdcall RtlGetAce(ptr long ptr) +645 stdcall RtlGetActiveActivationContext(ptr) +646 stdcall RtlGetCallersAddress(ptr ptr) +647 stdcall RtlGetCompressionWorkSpaceSize(long ptr ptr) +648 stdcall RtlGetControlSecurityDescriptor(ptr ptr ptr) +649 stdcall RtlGetCriticalSectionRecursionCount(ptr) +650 stdcall RtlGetCurrentDirectory_U(long ptr) +651 stdcall RtlGetCurrentPeb() +652 stdcall RtlGetCurrentProcessorNumber() ; 5.2 SP1 and higher +653 stdcall RtlGetDaclSecurityDescriptor(ptr ptr ptr ptr) +654 stdcall RtlGetElementGenericTable(ptr long) +655 stdcall RtlGetElementGenericTableAvl(ptr long) +# stdcall RtlGetFrame +657 stdcall RtlGetFullPathName_U(wstr long ptr ptr) +658 stdcall RtlGetFullPathName_UstrEx(ptr ptr ptr ptr ptr ptr ptr ptr) +659 stdcall RtlGetGroupSecurityDescriptor(ptr ptr ptr) +660 stdcall RtlGetLastNtStatus() +661 stdcall RtlGetLastWin32Error() +662 stdcall RtlGetLengthWithoutLastFullDosOrNtPathElement(long ptr ptr) ; Yes, Microsoft really misspelled this one! -@ stdcall RtlGetLengthWithoutTrailingPathSeperators(long ptr ptr) RtlGetLengthWithoutTrailingPathSeparators -@ stdcall RtlGetLongestNtPathLength() -@ stdcall RtlGetNativeSystemInformation(long long long long) NtQuerySystemInformation -@ stdcall RtlGetNtGlobalFlags() -@ stdcall RtlGetNtProductType(ptr) -@ stdcall RtlGetNtVersionNumbers(ptr ptr ptr) -@ stdcall RtlGetOwnerSecurityDescriptor(ptr ptr ptr) -@ stdcall RtlGetProcessHeaps(long ptr) -@ stdcall RtlGetSaclSecurityDescriptor(ptr ptr ptr ptr) -@ stdcall RtlGetSecurityDescriptorRMControl(ptr ptr) -@ stdcall RtlGetSetBootStatusData(ptr long long ptr long long) -@ stdcall RtlGetThreadErrorMode() -;@ stdcall RtlGetUnloadEventTrace -@ stdcall RtlGetUserInfoHeap(ptr long ptr ptr ptr) -@ stdcall RtlGetVersion(ptr) -@ stdcall RtlHashUnicodeString(ptr long long ptr) -@ stdcall RtlIdentifierAuthoritySid(ptr) -@ stdcall RtlImageDirectoryEntryToData(long long long ptr) -@ stdcall RtlImageNtHeader(long) -@ stdcall RtlImageNtHeaderEx(long ptr double ptr) -@ stdcall RtlImageRvaToSection(ptr long long) -@ stdcall RtlImageRvaToVa(ptr long long ptr) -@ stdcall RtlImpersonateSelf(long) -@ stdcall RtlInitAnsiString(ptr str) -@ stdcall RtlInitAnsiStringEx(ptr str) -@ stdcall RtlInitCodePageTable(ptr ptr) -@ stdcall RtlInitMemoryStream(ptr) -@ stdcall RtlInitNlsTables(ptr ptr ptr ptr) -@ stdcall RtlInitOutOfProcessMemoryStream(ptr) -@ stdcall RtlInitString(ptr str) -@ stdcall RtlInitUnicodeString(ptr wstr) -@ stdcall RtlInitUnicodeStringEx(ptr wstr) -;@ stdcall RtlInitializeAtomPackage -@ stdcall RtlInitializeBitMap(ptr long long) -@ stdcall RtlInitializeContext(ptr ptr ptr ptr ptr) -@ stdcall RtlInitializeCriticalSection(ptr) -@ stdcall RtlInitializeCriticalSectionAndSpinCount(ptr long) -@ stdcall RtlInitializeGenericTable(ptr ptr ptr ptr ptr) -@ stdcall RtlInitializeGenericTableAvl(ptr ptr ptr ptr ptr) -@ stdcall RtlInitializeHandleTable(long long ptr) -@ stdcall RtlInitializeRXact(ptr long ptr) -@ stdcall RtlInitializeResource(ptr) -@ stdcall RtlInitializeSListHead(ptr) -@ stdcall RtlInitializeSid(ptr ptr long) -@ stdcall RtlInsertElementGenericTable(ptr ptr long ptr) -@ stdcall RtlInsertElementGenericTableAvl(ptr ptr long ptr) +663 stdcall RtlGetLengthWithoutTrailingPathSeperators(long ptr ptr) RtlGetLengthWithoutTrailingPathSeparators +664 stdcall RtlGetLongestNtPathLength() +665 stdcall RtlGetNativeSystemInformation(long long long long) NtQuerySystemInformation +666 stdcall RtlGetNtGlobalFlags() +667 stdcall RtlGetNtProductType(ptr) +668 stdcall RtlGetNtVersionNumbers(ptr ptr ptr) +669 stdcall RtlGetOwnerSecurityDescriptor(ptr ptr ptr) +670 stdcall RtlGetProcessHeaps(long ptr) +671 stdcall RtlGetSaclSecurityDescriptor(ptr ptr ptr ptr) +672 stdcall RtlGetSecurityDescriptorRMControl(ptr ptr) +673 stdcall RtlGetSetBootStatusData(ptr long long ptr long long) +674 stdcall RtlGetThreadErrorMode() +# stdcall RtlGetUnloadEventTrace +676 stdcall RtlGetUserInfoHeap(ptr long ptr ptr ptr) +677 stdcall RtlGetVersion(ptr) +678 stdcall RtlHashUnicodeString(ptr long long ptr) +679 stdcall RtlIdentifierAuthoritySid(ptr) +680 stdcall RtlImageDirectoryEntryToData(long long long ptr) +681 stdcall RtlImageNtHeader(long) +682 stdcall RtlImageNtHeaderEx(long ptr double ptr) +683 stdcall RtlImageRvaToSection(ptr long long) +684 stdcall RtlImageRvaToVa(ptr long long ptr) +685 stdcall RtlImpersonateSelf(long) +686 stdcall RtlInitAnsiString(ptr str) +687 stdcall RtlInitAnsiStringEx(ptr str) +688 stdcall RtlInitCodePageTable(ptr ptr) +689 stdcall RtlInitMemoryStream(ptr) +690 stdcall RtlInitNlsTables(ptr ptr ptr ptr) +691 stdcall RtlInitOutOfProcessMemoryStream(ptr) +692 stdcall RtlInitString(ptr str) +693 stdcall RtlInitUnicodeString(ptr wstr) +694 stdcall RtlInitUnicodeStringEx(ptr wstr) +# stdcall RtlInitializeAtomPackage +696 stdcall RtlInitializeBitMap(ptr long long) +697 stdcall RtlInitializeContext(ptr ptr ptr ptr ptr) +698 stdcall RtlInitializeCriticalSection(ptr) +699 stdcall RtlInitializeCriticalSectionAndSpinCount(ptr long) +700 stdcall RtlInitializeGenericTable(ptr ptr ptr ptr ptr) +701 stdcall RtlInitializeGenericTableAvl(ptr ptr ptr ptr ptr) +702 stdcall RtlInitializeHandleTable(long long ptr) +703 stdcall RtlInitializeRXact(ptr long ptr) +704 stdcall RtlInitializeResource(ptr) +705 stdcall RtlInitializeSListHead(ptr) +706 stdcall RtlInitializeSid(ptr ptr long) +707 stdcall RtlInsertElementGenericTable(ptr ptr long ptr) +708 stdcall RtlInsertElementGenericTableAvl(ptr ptr long ptr) # RtlInsertElementGenericTableFull -;@ stdcall RtlInsertElementGenericTableFullAvl(ptr ptr long ptr ptr long) +# stdcall RtlInsertElementGenericTableFullAvl(ptr ptr long ptr ptr long) @ stdcall -arch=x86_64 RtlInstallFunctionTableCallback(double double long ptr ptr ptr) -@ stdcall RtlInt64ToUnicodeString(double long ptr) -@ stdcall RtlIntegerToChar(long long long ptr) -@ stdcall RtlIntegerToUnicodeString(long long ptr) -@ stdcall -arch=win32 -ret64 RtlInterlockedCompareExchange64(ptr double double) -@ stdcall RtlInterlockedFlushSList(ptr) -@ stdcall RtlInterlockedPopEntrySList(ptr) -@ stdcall RtlInterlockedPushEntrySList(ptr ptr) -@ stdcall RtlIpv4AddressToStringA(ptr ptr) -@ stdcall RtlIpv4AddressToStringExA(ptr long ptr ptr) -@ stdcall RtlIpv4AddressToStringExW(ptr long ptr ptr) -@ stdcall RtlIpv4AddressToStringW(ptr ptr) -@ stdcall RtlIpv4StringToAddressA(str long ptr ptr) -@ stdcall RtlIpv4StringToAddressExA(str long ptr ptr) -@ stdcall RtlIpv4StringToAddressExW(wstr long ptr ptr) -@ stdcall RtlIpv4StringToAddressW(wstr long ptr ptr) -@ stdcall RtlIpv6AddressToStringA(ptr ptr) -@ stdcall RtlIpv6AddressToStringExA(ptr long long ptr ptr) -@ stdcall RtlIpv6AddressToStringExW(ptr long long ptr ptr) -@ stdcall RtlIpv6AddressToStringW(ptr ptr) -@ stdcall RtlIpv6StringToAddressA(str ptr ptr) -@ stdcall RtlIpv6StringToAddressExA(str ptr ptr ptr) -@ stdcall RtlIpv6StringToAddressExW(wstr ptr ptr ptr) -@ stdcall RtlIpv6StringToAddressW(wstr ptr ptr) -@ stdcall RtlIsActivationContextActive(ptr) -;@ stdcall RtlIsCriticalSectionLocked -;@ stdcall RtlIsCriticalSectionLockedByThread -@ stdcall RtlIsDosDeviceName_U(wstr) -@ stdcall RtlIsGenericTableEmpty(ptr) -@ stdcall RtlIsGenericTableEmptyAvl(ptr) -@ stdcall RtlIsNameLegalDOS8Dot3(ptr ptr ptr) -@ stdcall RtlIsTextUnicode(ptr long ptr) -@ stdcall RtlIsThreadWithinLoaderCallout() -@ stdcall RtlIsValidHandle(ptr ptr) -@ stdcall RtlIsValidIndexHandle(ptr long ptr) -@ stdcall -arch=win32 -ret64 RtlLargeIntegerAdd(double double) -@ stdcall -arch=win32 -ret64 RtlLargeIntegerArithmeticShift(double long) -@ stdcall -arch=win32 -ret64 RtlLargeIntegerDivide(double double ptr) -@ stdcall -arch=win32 -ret64 RtlLargeIntegerNegate(double) -@ stdcall -arch=win32 -ret64 RtlLargeIntegerShiftLeft(double long) -@ stdcall -arch=win32 -ret64 RtlLargeIntegerShiftRight(double long) -@ stdcall -arch=win32 -ret64 RtlLargeIntegerSubtract(double double) -@ stdcall RtlLargeIntegerToChar(ptr long long ptr) -@ stdcall RtlLeaveCriticalSection(ptr) -@ stdcall RtlLengthRequiredSid(long) -@ stdcall RtlLengthSecurityDescriptor(ptr) -@ stdcall RtlLengthSid(ptr) -@ stdcall RtlLocalTimeToSystemTime(ptr ptr) -@ stdcall RtlLockBootStatusData(ptr) -@ stdcall RtlLockHeap(long) -@ stdcall RtlLockMemoryStreamRegion(ptr int64 int64 long) -;@ stdcall RtlLogStackBackTrace -@ stdcall RtlLookupAtomInAtomTable(ptr wstr ptr) -@ stdcall RtlLookupElementGenericTable(ptr ptr) -@ stdcall RtlLookupElementGenericTableAvl(ptr ptr) +711 stdcall RtlInt64ToUnicodeString(double long ptr) +712 stdcall RtlIntegerToChar(long long long ptr) +713 stdcall RtlIntegerToUnicodeString(long long ptr) +714 stdcall -arch=win32 -ret64 RtlInterlockedCompareExchange64(ptr double double) +715 stdcall RtlInterlockedFlushSList(ptr) +716 stdcall RtlInterlockedPopEntrySList(ptr) +717 stdcall RtlInterlockedPushEntrySList(ptr ptr) +718 stdcall RtlIpv4AddressToStringA(ptr ptr) +719 stdcall RtlIpv4AddressToStringExA(ptr long ptr ptr) +720 stdcall RtlIpv4AddressToStringExW(ptr long ptr ptr) +721 stdcall RtlIpv4AddressToStringW(ptr ptr) +722 stdcall RtlIpv4StringToAddressA(str long ptr ptr) +723 stdcall RtlIpv4StringToAddressExA(str long ptr ptr) +724 stdcall RtlIpv4StringToAddressExW(wstr long ptr ptr) +725 stdcall RtlIpv4StringToAddressW(wstr long ptr ptr) +726 stdcall RtlIpv6AddressToStringA(ptr ptr) +727 stdcall RtlIpv6AddressToStringExA(ptr long long ptr ptr) +728 stdcall RtlIpv6AddressToStringExW(ptr long long ptr ptr) +729 stdcall RtlIpv6AddressToStringW(ptr ptr) +730 stdcall RtlIpv6StringToAddressA(str ptr ptr) +731 stdcall RtlIpv6StringToAddressExA(str ptr ptr ptr) +732 stdcall RtlIpv6StringToAddressExW(wstr ptr ptr ptr) +733 stdcall RtlIpv6StringToAddressW(wstr ptr ptr) +734 stdcall RtlIsActivationContextActive(ptr) +# stdcall RtlIsCriticalSectionLocked +# stdcall RtlIsCriticalSectionLockedByThread +737 stdcall RtlIsDosDeviceName_U(wstr) +738 stdcall RtlIsGenericTableEmpty(ptr) +739 stdcall RtlIsGenericTableEmptyAvl(ptr) +740 stdcall RtlIsNameLegalDOS8Dot3(ptr ptr ptr) +741 stdcall RtlIsTextUnicode(ptr long ptr) +742 stdcall RtlIsThreadWithinLoaderCallout() +743 stdcall RtlIsValidHandle(ptr ptr) +744 stdcall RtlIsValidIndexHandle(ptr long ptr) +745 stdcall -arch=win32 -ret64 RtlLargeIntegerAdd(double double) +746 stdcall -arch=win32 -ret64 RtlLargeIntegerArithmeticShift(double long) +747 stdcall -arch=win32 -ret64 RtlLargeIntegerDivide(double double ptr) +748 stdcall -arch=win32 -ret64 RtlLargeIntegerNegate(double) +749 stdcall -arch=win32 -ret64 RtlLargeIntegerShiftLeft(double long) +750 stdcall -arch=win32 -ret64 RtlLargeIntegerShiftRight(double long) +751 stdcall -arch=win32 -ret64 RtlLargeIntegerSubtract(double double) +752 stdcall RtlLargeIntegerToChar(ptr long long ptr) +753 stdcall RtlLeaveCriticalSection(ptr) +754 stdcall RtlLengthRequiredSid(long) +755 stdcall RtlLengthSecurityDescriptor(ptr) +756 stdcall RtlLengthSid(ptr) +757 stdcall RtlLocalTimeToSystemTime(ptr ptr) +758 stdcall RtlLockBootStatusData(ptr) +759 stdcall RtlLockHeap(long) +760 stdcall RtlLockMemoryStreamRegion(ptr int64 int64 long) +# stdcall RtlLogStackBackTrace +762 stdcall RtlLookupAtomInAtomTable(ptr wstr ptr) +763 stdcall RtlLookupElementGenericTable(ptr ptr) +764 stdcall RtlLookupElementGenericTableAvl(ptr ptr) # RtlLookupElementGenericTableFull # RtlLookupElementGenericTableFullAvl @ stdcall -arch=x86_64 RtlLookupFunctionEntry(long ptr ptr) -@ stdcall RtlMakeSelfRelativeSD(ptr ptr ptr) -@ stdcall RtlMapGenericMask(long ptr) -;@ stdcall RtlMapSecurityErrorToNtStatus -@ stdcall RtlMoveMemory(ptr ptr long) -@ stdcall RtlMultiAppendUnicodeStringBuffer(ptr long ptr) -@ stdcall RtlMultiByteToUnicodeN(ptr long ptr ptr long) -@ stdcall RtlMultiByteToUnicodeSize(ptr str long) +767 stdcall RtlMakeSelfRelativeSD(ptr ptr ptr) +768 stdcall RtlMapGenericMask(long ptr) +# stdcall RtlMapSecurityErrorToNtStatus +770 stdcall RtlMoveMemory(ptr ptr long) +771 stdcall RtlMultiAppendUnicodeStringBuffer(ptr long ptr) +772 stdcall RtlMultiByteToUnicodeN(ptr long ptr ptr long) +773 stdcall RtlMultiByteToUnicodeSize(ptr str long) # RtlMultipleAllocateHeap # RtlMultipleFreeHeap -@ stdcall RtlNewInstanceSecurityObject(long long ptr ptr ptr ptr ptr long ptr ptr) -@ stdcall RtlNewSecurityGrantedAccess(long ptr ptr ptr ptr ptr) -@ stdcall RtlNewSecurityObject(ptr ptr ptr long ptr ptr) -@ stdcall RtlNewSecurityObjectEx(ptr ptr ptr ptr long long ptr ptr) -@ stdcall RtlNewSecurityObjectWithMultipleInheritance(ptr ptr ptr ptr long long long ptr ptr) -@ stdcall RtlNormalizeProcessParams(ptr) -@ stdcall RtlNtPathNameToDosPathName(ptr ptr ptr ptr) ; CHECKME -@ stdcall RtlNtStatusToDosError(long) -@ stdcall RtlNtStatusToDosErrorNoTeb(long) -@ stdcall RtlNumberGenericTableElements(ptr) -@ stdcall RtlNumberGenericTableElementsAvl(ptr) -@ stdcall RtlNumberOfClearBits(ptr) -@ stdcall RtlNumberOfSetBits(ptr) -;@ stdcall RtlOemStringToUnicodeSize(ptr) -@ stdcall RtlOemStringToUnicodeString(ptr ptr long) -@ stdcall RtlOemToUnicodeN(ptr long ptr ptr long) -@ stdcall RtlOpenCurrentUser(long ptr) -@ stdcall RtlPcToFileHeader(ptr ptr) -@ stdcall RtlPinAtomInAtomTable(ptr long) -;@ stdcall RtlPopFrame -@ stdcall RtlPrefixString(ptr ptr long) -@ stdcall RtlPrefixUnicodeString(ptr ptr long) -@ stdcall RtlProtectHeap(ptr long) -;@ stdcall RtlPushFrame -@ stdcall RtlQueryAtomInAtomTable(ptr long ptr ptr ptr ptr) -@ stdcall RtlQueryDepthSList(ptr) -@ stdcall RtlQueryEnvironmentVariable_U(ptr ptr ptr) -@ stdcall RtlQueryHeapInformation(long long ptr long ptr) -@ stdcall RtlQueryInformationAcl(ptr ptr long long) -@ stdcall RtlQueryInformationActivationContext(long long ptr long ptr long ptr) -@ stdcall RtlQueryInformationActiveActivationContext(long ptr long ptr) -@ stdcall RtlQueryInterfaceMemoryStream(ptr ptr ptr) -;@ stdcall RtlQueryProcessBackTraceInformation -@ stdcall RtlQueryProcessDebugInformation(long long ptr) -;@ stdcall RtlQueryProcessHeapInformation -;@ stdcall RtlQueryProcessLockInformation -@ stdcall RtlQueryRegistryValues(long ptr ptr ptr ptr) -@ stdcall RtlQuerySecurityObject(ptr long ptr long ptr) -@ stdcall RtlQueryTagHeap(ptr long long long ptr) -@ stdcall RtlQueryTimeZoneInformation(ptr) -;@ stdcall RtlQueueApcWow64Thread -@ stdcall RtlQueueWorkItem(ptr ptr long) -@ stdcall -register RtlRaiseException(ptr) -@ stdcall RtlRaiseStatus(long) -@ stdcall RtlRandom(ptr) -@ stdcall RtlRandomEx(ptr) -@ stdcall RtlReAllocateHeap(long long ptr long) -@ stdcall RtlReadMemoryStream(ptr ptr long ptr) -@ stdcall RtlReadOutOfProcessMemoryStream(ptr ptr long ptr) -@ stdcall RtlRealPredecessor(ptr) -@ stdcall RtlRealSuccessor(ptr) -@ stdcall RtlRegisterSecureMemoryCacheCallback(ptr) -@ stdcall RtlRegisterWait(ptr ptr ptr ptr long long) -@ stdcall RtlReleaseActivationContext(ptr) -@ stdcall RtlReleaseMemoryStream(ptr) -@ stdcall RtlReleasePebLock() -@ stdcall RtlReleasePrivilege(ptr) -@ stdcall RtlReleaseRelativeName(ptr) -@ stdcall RtlReleaseResource(ptr) -@ stdcall RtlRemoteCall(ptr ptr ptr long ptr long long) -@ stdcall RtlRemoveVectoredContinueHandler(ptr) -@ stdcall RtlRemoveVectoredExceptionHandler(ptr) -@ stdcall RtlResetRtlTranslations(ptr) +776 stdcall RtlNewInstanceSecurityObject(long long ptr ptr ptr ptr ptr long ptr ptr) +777 stdcall RtlNewSecurityGrantedAccess(long ptr ptr ptr ptr ptr) +778 stdcall RtlNewSecurityObject(ptr ptr ptr long ptr ptr) +779 stdcall RtlNewSecurityObjectEx(ptr ptr ptr ptr long long ptr ptr) +780 stdcall RtlNewSecurityObjectWithMultipleInheritance(ptr ptr ptr ptr long long long ptr ptr) +781 stdcall RtlNormalizeProcessParams(ptr) +782 stdcall RtlNtPathNameToDosPathName(ptr ptr ptr ptr) ; CHECKME +783 stdcall RtlNtStatusToDosError(long) +784 stdcall RtlNtStatusToDosErrorNoTeb(long) +785 stdcall RtlNumberGenericTableElements(ptr) +786 stdcall RtlNumberGenericTableElementsAvl(ptr) +787 stdcall RtlNumberOfClearBits(ptr) +788 stdcall RtlNumberOfSetBits(ptr) +# stdcall RtlOemStringToUnicodeSize(ptr) +790 stdcall RtlOemStringToUnicodeString(ptr ptr long) +791 stdcall RtlOemToUnicodeN(ptr long ptr ptr long) +792 stdcall RtlOpenCurrentUser(long ptr) +793 stdcall RtlPcToFileHeader(ptr ptr) +794 stdcall RtlPinAtomInAtomTable(ptr long) +# stdcall RtlPopFrame +796 stdcall RtlPrefixString(ptr ptr long) +797 stdcall RtlPrefixUnicodeString(ptr ptr long) +798 stdcall RtlProtectHeap(ptr long) +# stdcall RtlPushFrame +800 stdcall RtlQueryAtomInAtomTable(ptr long ptr ptr ptr ptr) +801 stdcall RtlQueryDepthSList(ptr) +802 stdcall RtlQueryEnvironmentVariable_U(ptr ptr ptr) +803 stdcall RtlQueryHeapInformation(long long ptr long ptr) +804 stdcall RtlQueryInformationAcl(ptr ptr long long) +805 stdcall RtlQueryInformationActivationContext(long long ptr long ptr long ptr) +806 stdcall RtlQueryInformationActiveActivationContext(long ptr long ptr) +807 stdcall RtlQueryInterfaceMemoryStream(ptr ptr ptr) +# stdcall RtlQueryProcessBackTraceInformation +809 stdcall RtlQueryProcessDebugInformation(long long ptr) +# stdcall RtlQueryProcessHeapInformation +# stdcall RtlQueryProcessLockInformation +812 stdcall RtlQueryRegistryValues(long ptr ptr ptr ptr) +813 stdcall RtlQuerySecurityObject(ptr long ptr long ptr) +814 stdcall RtlQueryTagHeap(ptr long long long ptr) +815 stdcall RtlQueryTimeZoneInformation(ptr) +# stdcall RtlQueueApcWow64Thread +817 stdcall RtlQueueWorkItem(ptr ptr long) +818 stdcall -register RtlRaiseException(ptr) +819 stdcall RtlRaiseStatus(long) +820 stdcall RtlRandom(ptr) +821 stdcall RtlRandomEx(ptr) +822 stdcall RtlReAllocateHeap(long long ptr long) +823 stdcall RtlReadMemoryStream(ptr ptr long ptr) +824 stdcall RtlReadOutOfProcessMemoryStream(ptr ptr long ptr) +825 stdcall RtlRealPredecessor(ptr) +826 stdcall RtlRealSuccessor(ptr) +827 stdcall RtlRegisterSecureMemoryCacheCallback(ptr) +828 stdcall RtlRegisterWait(ptr ptr ptr ptr long long) +829 stdcall RtlReleaseActivationContext(ptr) +830 stdcall RtlReleaseMemoryStream(ptr) +831 stdcall RtlReleasePebLock() +832 stdcall RtlReleasePrivilege(ptr) +833 stdcall RtlReleaseRelativeName(ptr) +834 stdcall RtlReleaseResource(ptr) +835 stdcall RtlRemoteCall(ptr ptr ptr long ptr long long) +836 stdcall RtlRemoveVectoredContinueHandler(ptr) +837 stdcall RtlRemoveVectoredExceptionHandler(ptr) +838 stdcall RtlResetRtlTranslations(ptr) @ stdcall -arch=x86_64 RtlRestoreContext(ptr ptr) -@ stdcall RtlRestoreLastWin32Error(long) RtlSetLastWin32Error -@ stdcall RtlRevertMemoryStream(ptr) -@ stdcall RtlRunDecodeUnicodeString(long ptr) -@ stdcall RtlRunEncodeUnicodeString(long ptr) -@ stdcall RtlSecondsSince1970ToTime(long ptr) -@ stdcall RtlSecondsSince1980ToTime(long ptr) -@ stdcall RtlSeekMemoryStream(ptr int64 long ptr) -@ stdcall RtlSelfRelativeToAbsoluteSD2(ptr ptr) -@ stdcall RtlSelfRelativeToAbsoluteSD(ptr ptr ptr ptr ptr ptr ptr ptr ptr ptr ptr) -@ stdcall RtlSetAllBits(ptr) -@ stdcall RtlSetAttributesSecurityDescriptor(ptr long ptr) -@ stdcall RtlSetBits(ptr long long) -@ stdcall RtlSetControlSecurityDescriptor(ptr long long) -@ stdcall RtlSetCriticalSectionSpinCount(ptr long) -@ stdcall RtlSetCurrentDirectory_U(ptr) -@ stdcall RtlSetCurrentEnvironment(wstr ptr) -@ stdcall RtlSetDaclSecurityDescriptor(ptr long ptr long) -@ stdcall RtlSetEnvironmentStrings(wstr long) -@ stdcall RtlSetEnvironmentVariable(ptr ptr ptr) -@ stdcall RtlSetGroupSecurityDescriptor(ptr ptr long) -@ stdcall RtlSetHeapInformation(ptr long ptr ptr) -@ stdcall RtlSetInformationAcl(ptr ptr long long) -@ stdcall RtlSetIoCompletionCallback(long ptr long) -@ stdcall RtlSetLastWin32Error(long) -@ stdcall RtlSetLastWin32ErrorAndNtStatusFromNtStatus(long) -@ stdcall RtlSetMemoryStreamSize(ptr int64) -@ stdcall RtlSetOwnerSecurityDescriptor(ptr ptr long) -@ cdecl RtlSetProcessIsCritical(long ptr long) -@ stdcall RtlSetSaclSecurityDescriptor(ptr long ptr long) -@ stdcall RtlSetSecurityDescriptorRMControl(ptr ptr) -@ stdcall RtlSetSecurityObject(long ptr ptr ptr ptr) -@ stdcall RtlSetSecurityObjectEx(long ptr ptr long ptr ptr) -@ stdcall RtlSetThreadErrorMode(long ptr) -@ cdecl RtlSetThreadIsCritical(long ptr long) -@ stdcall RtlSetThreadPoolStartFunc(ptr ptr) -@ stdcall RtlSetTimeZoneInformation(ptr) -;@ stdcall RtlSetTimer -@ stdcall RtlSetUnhandledExceptionFilter(ptr) -;@ stdcall RtlSetUnicodeCallouts -@ stdcall RtlSetUserFlagsHeap(ptr long ptr long long) -@ stdcall RtlSetUserValueHeap(ptr long ptr ptr) -@ stdcall RtlSizeHeap(long long ptr) -@ stdcall RtlSplay(ptr) -@ stdcall RtlStartRXact(ptr) -@ stdcall RtlStatMemoryStream(ptr ptr long) -@ stdcall RtlStringFromGUID(ptr ptr) -@ stdcall RtlSubAuthorityCountSid(ptr) -@ stdcall RtlSubAuthoritySid(ptr long) -@ stdcall RtlSubtreePredecessor(ptr) -@ stdcall RtlSubtreeSuccessor(ptr) -@ stdcall RtlSystemTimeToLocalTime(ptr ptr) -@ stdcall RtlTimeFieldsToTime(ptr ptr) -@ stdcall RtlTimeToElapsedTimeFields(long long) -@ stdcall RtlTimeToSecondsSince1970(ptr ptr) -@ stdcall RtlTimeToSecondsSince1980(ptr ptr) -@ stdcall RtlTimeToTimeFields (long long) -;@ stdcall RtlTraceDatabaseAdd -;@ stdcall RtlTraceDatabaseCreate -;@ stdcall RtlTraceDatabaseDestroy -;@ stdcall RtlTraceDatabaseEnumerate -;@ stdcall RtlTraceDatabaseFind -;@ stdcall RtlTraceDatabaseLock -;@ stdcall RtlTraceDatabaseUnlock -;@ stdcall RtlTraceDatabaseValidate -@ stdcall RtlTryEnterCriticalSection(ptr) -;@ stdcall RtlUnhandledExceptionFilter2 -@ stdcall RtlUnhandledExceptionFilter(ptr) -;@ stdcall RtlUnicodeStringToAnsiSize(ptr) -@ stdcall RtlUnicodeStringToAnsiString(ptr ptr long) -@ stdcall RtlUnicodeStringToCountedOemString(ptr ptr long) -@ stdcall RtlUnicodeStringToInteger(ptr long ptr) -;@ stdcall RtlUnicodeStringToOemSize(ptr) -@ stdcall RtlUnicodeStringToOemString(ptr ptr long) -@ stdcall RtlUnicodeToCustomCPN(ptr ptr long ptr wstr long) -@ stdcall RtlUnicodeToMultiByteN(ptr long ptr ptr long) -@ stdcall RtlUnicodeToMultiByteSize(ptr ptr long) -@ stdcall RtlUnicodeToOemN(ptr long ptr ptr long) -@ stdcall RtlUniform(ptr) -@ stdcall RtlUnlockBootStatusData(ptr) -@ stdcall RtlUnlockHeap(long) -@ stdcall RtlUnlockMemoryStreamRegion(ptr int64 int64 long) -@ stdcall -register RtlUnwind(ptr ptr ptr ptr) +839 stdcall RtlRestoreLastWin32Error(long) RtlSetLastWin32Error +840 stdcall RtlRevertMemoryStream(ptr) +841 stdcall RtlRunDecodeUnicodeString(long ptr) +842 stdcall RtlRunEncodeUnicodeString(long ptr) +843 stdcall RtlSecondsSince1970ToTime(long ptr) +844 stdcall RtlSecondsSince1980ToTime(long ptr) +845 stdcall RtlSeekMemoryStream(ptr int64 long ptr) +846 stdcall RtlSelfRelativeToAbsoluteSD2(ptr ptr) +847 stdcall RtlSelfRelativeToAbsoluteSD(ptr ptr ptr ptr ptr ptr ptr ptr ptr ptr ptr) +848 stdcall RtlSetAllBits(ptr) +849 stdcall RtlSetAttributesSecurityDescriptor(ptr long ptr) +850 stdcall RtlSetBits(ptr long long) +851 stdcall RtlSetControlSecurityDescriptor(ptr long long) +852 stdcall RtlSetCriticalSectionSpinCount(ptr long) +853 stdcall RtlSetCurrentDirectory_U(ptr) +854 stdcall RtlSetCurrentEnvironment(wstr ptr) +855 stdcall RtlSetDaclSecurityDescriptor(ptr long ptr long) +856 stdcall RtlSetEnvironmentStrings(wstr long) +857 stdcall RtlSetEnvironmentVariable(ptr ptr ptr) +858 stdcall RtlSetGroupSecurityDescriptor(ptr ptr long) +859 stdcall RtlSetHeapInformation(ptr long ptr ptr) +860 stdcall RtlSetInformationAcl(ptr ptr long long) +861 stdcall RtlSetIoCompletionCallback(long ptr long) +862 stdcall RtlSetLastWin32Error(long) +863 stdcall RtlSetLastWin32ErrorAndNtStatusFromNtStatus(long) +864 stdcall RtlSetMemoryStreamSize(ptr int64) +865 stdcall RtlSetOwnerSecurityDescriptor(ptr ptr long) +866 cdecl RtlSetProcessIsCritical(long ptr long) +867 stdcall RtlSetSaclSecurityDescriptor(ptr long ptr long) +868 stdcall RtlSetSecurityDescriptorRMControl(ptr ptr) +869 stdcall RtlSetSecurityObject(long ptr ptr ptr ptr) +870 stdcall RtlSetSecurityObjectEx(long ptr ptr long ptr ptr) +871 stdcall RtlSetThreadErrorMode(long ptr) +872 cdecl RtlSetThreadIsCritical(long ptr long) +873 stdcall RtlSetThreadPoolStartFunc(ptr ptr) +874 stdcall RtlSetTimeZoneInformation(ptr) +# stdcall RtlSetTimer +876 stdcall RtlSetUnhandledExceptionFilter(ptr) +# stdcall RtlSetUnicodeCallouts +878 stdcall RtlSetUserFlagsHeap(ptr long ptr long long) +879 stdcall RtlSetUserValueHeap(ptr long ptr ptr) +880 stdcall RtlSizeHeap(long long ptr) +881 stdcall RtlSplay(ptr) +882 stdcall RtlStartRXact(ptr) +883 stdcall RtlStatMemoryStream(ptr ptr long) +884 stdcall RtlStringFromGUID(ptr ptr) +885 stdcall RtlSubAuthorityCountSid(ptr) +886 stdcall RtlSubAuthoritySid(ptr long) +887 stdcall RtlSubtreePredecessor(ptr) +888 stdcall RtlSubtreeSuccessor(ptr) +889 stdcall RtlSystemTimeToLocalTime(ptr ptr) +890 stdcall RtlTimeFieldsToTime(ptr ptr) +891 stdcall RtlTimeToElapsedTimeFields(long long) +892 stdcall RtlTimeToSecondsSince1970(ptr ptr) +893 stdcall RtlTimeToSecondsSince1980(ptr ptr) +894 stdcall RtlTimeToTimeFields (long long) +# stdcall RtlTraceDatabaseAdd +# stdcall RtlTraceDatabaseCreate +# stdcall RtlTraceDatabaseDestroy +# stdcall RtlTraceDatabaseEnumerate +# stdcall RtlTraceDatabaseFind +# stdcall RtlTraceDatabaseLock +# stdcall RtlTraceDatabaseUnlock +# stdcall RtlTraceDatabaseValidate +903 stdcall RtlTryEnterCriticalSection(ptr) +# stdcall RtlUnhandledExceptionFilter2 +905 stdcall RtlUnhandledExceptionFilter(ptr) +# stdcall RtlUnicodeStringToAnsiSize(ptr) +907 stdcall RtlUnicodeStringToAnsiString(ptr ptr long) +908 stdcall RtlUnicodeStringToCountedOemString(ptr ptr long) +909 stdcall RtlUnicodeStringToInteger(ptr long ptr) +# stdcall RtlUnicodeStringToOemSize(ptr) +911 stdcall RtlUnicodeStringToOemString(ptr ptr long) +912 stdcall RtlUnicodeToCustomCPN(ptr ptr long ptr wstr long) +913 stdcall RtlUnicodeToMultiByteN(ptr long ptr ptr long) +914 stdcall RtlUnicodeToMultiByteSize(ptr ptr long) +915 stdcall RtlUnicodeToOemN(ptr long ptr ptr long) +916 stdcall RtlUniform(ptr) +917 stdcall RtlUnlockBootStatusData(ptr) +918 stdcall RtlUnlockHeap(long) +919 stdcall RtlUnlockMemoryStreamRegion(ptr int64 int64 long) +920 stdcall -register RtlUnwind(ptr ptr ptr ptr) @ stdcall -arch=x86_64 RtlUnwindEx(long long ptr long ptr) -@ stdcall RtlUpcaseUnicodeChar(long) -@ stdcall RtlUpcaseUnicodeString(ptr ptr long) -@ stdcall RtlUpcaseUnicodeStringToAnsiString(ptr ptr long) -@ stdcall RtlUpcaseUnicodeStringToCountedOemString(ptr ptr long) -@ stdcall RtlUpcaseUnicodeStringToOemString(ptr ptr long) -@ stdcall RtlUpcaseUnicodeToCustomCPN(ptr ptr long ptr wstr long) -@ stdcall RtlUpcaseUnicodeToMultiByteN(ptr long ptr ptr long) -@ stdcall RtlUpcaseUnicodeToOemN(ptr long ptr ptr long) -@ stdcall RtlUpdateTimer(ptr ptr long long) -@ stdcall RtlUpperChar(long) -@ stdcall RtlUpperString(ptr ptr) -@ stdcall RtlUsageHeap(ptr long ptr) -@ stdcall RtlValidAcl(ptr) -@ stdcall RtlValidRelativeSecurityDescriptor(ptr long long) -@ stdcall RtlValidSecurityDescriptor(ptr) -@ stdcall RtlValidSid(ptr) -@ stdcall RtlValidateHeap(long long ptr) -@ stdcall RtlValidateProcessHeaps() -@ stdcall RtlValidateUnicodeString(long ptr) -@ stdcall RtlVerifyVersionInfo(ptr long double) +921 stdcall RtlUpcaseUnicodeChar(long) +922 stdcall RtlUpcaseUnicodeString(ptr ptr long) +923 stdcall RtlUpcaseUnicodeStringToAnsiString(ptr ptr long) +924 stdcall RtlUpcaseUnicodeStringToCountedOemString(ptr ptr long) +925 stdcall RtlUpcaseUnicodeStringToOemString(ptr ptr long) +926 stdcall RtlUpcaseUnicodeToCustomCPN(ptr ptr long ptr wstr long) +927 stdcall RtlUpcaseUnicodeToMultiByteN(ptr long ptr ptr long) +928 stdcall RtlUpcaseUnicodeToOemN(ptr long ptr ptr long) +929 stdcall RtlUpdateTimer(ptr ptr long long) +930 stdcall RtlUpperChar(long) +931 stdcall RtlUpperString(ptr ptr) +932 stdcall RtlUsageHeap(ptr long ptr) +933 stdcall RtlValidAcl(ptr) +934 stdcall RtlValidRelativeSecurityDescriptor(ptr long long) +935 stdcall RtlValidSecurityDescriptor(ptr) +936 stdcall RtlValidSid(ptr) +937 stdcall RtlValidateHeap(long long ptr) +938 stdcall RtlValidateProcessHeaps() +939 stdcall RtlValidateUnicodeString(long ptr) +940 stdcall RtlVerifyVersionInfo(ptr long double) @ stdcall -arch=x86_64 RtlVirtualUnwind(long long long ptr ptr ptr ptr ptr) -@ stdcall RtlWalkFrameChain(ptr long long) -@ stdcall RtlWalkHeap(long ptr) -@ stdcall RtlWow64EnableFsRedirection(long) -@ stdcall RtlWow64EnableFsRedirectionEx(long ptr) -@ stdcall RtlWriteMemoryStream(ptr ptr long ptr) -@ stdcall RtlWriteRegistryValue(long ptr ptr long ptr long) -@ stdcall RtlZeroHeap(ptr long) -@ stdcall RtlZeroMemory(ptr long) -@ stdcall RtlZombifyActivationContext(ptr) -@ stdcall RtlpApplyLengthFunction(long long ptr ptr) -@ stdcall RtlpEnsureBufferSize(ptr ptr ptr) ; CHECKME -;@ stdcall RtlpNotOwnerCriticalSection -@ stdcall RtlpNtCreateKey(ptr long ptr long ptr ptr) -@ stdcall RtlpNtEnumerateSubKey(ptr ptr long long) -@ stdcall RtlpNtMakeTemporaryKey(ptr) -@ stdcall RtlpNtOpenKey(ptr long ptr long) -@ stdcall RtlpNtQueryValueKey(ptr ptr ptr ptr long) -@ stdcall RtlpNtSetValueKey(ptr long ptr long) -@ stdcall RtlpUnWaitCriticalSection(ptr) -@ stdcall RtlpWaitForCriticalSection(ptr) -@ stdcall RtlxAnsiStringToUnicodeSize(ptr) -@ stdcall RtlxOemStringToUnicodeSize(ptr) -@ stdcall RtlxUnicodeStringToAnsiSize(ptr) -@ stdcall RtlxUnicodeStringToOemSize(ptr) ; RtlUnicodeStringToOemSize -@ stdcall -ret64 VerSetConditionMask(double long long) -@ stdcall ZwAcceptConnectPort(ptr long ptr long long ptr) NtAcceptConnectPort -@ stdcall ZwAccessCheck(ptr long long ptr ptr ptr ptr ptr) NtAccessCheck -@ stdcall ZwAccessCheckAndAuditAlarm(ptr long ptr ptr ptr long ptr long ptr ptr ptr) NtAccessCheckAndAuditAlarm -@ stdcall ZwAccessCheckByType(ptr ptr ptr long ptr long ptr ptr long ptr ptr) NtAccessCheckByType -@ stdcall ZwAccessCheckByTypeAndAuditAlarm(ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) NtAccessCheckByTypeAndAuditAlarm -@ stdcall ZwAccessCheckByTypeResultList(ptr ptr ptr long ptr long ptr ptr long ptr ptr) NtAccessCheckByTypeResultList -@ stdcall ZwAccessCheckByTypeResultListAndAuditAlarm(ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) NtAccessCheckByTypeResultListAndAuditAlarm -@ stdcall ZwAccessCheckByTypeResultListAndAuditAlarmByHandle(ptr ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) NtAccessCheckByTypeResultListAndAuditAlarmByHandle -@ stdcall ZwAddAtom(ptr long ptr) NtAddAtom -@ stdcall ZwAddBootEntry(ptr long) +941 stdcall RtlWalkFrameChain(ptr long long) +942 stdcall RtlWalkHeap(long ptr) +943 stdcall RtlWow64EnableFsRedirection(long) +944 stdcall RtlWow64EnableFsRedirectionEx(long ptr) +945 stdcall RtlWriteMemoryStream(ptr ptr long ptr) +946 stdcall RtlWriteRegistryValue(long ptr ptr long ptr long) +947 stdcall RtlZeroHeap(ptr long) +948 stdcall RtlZeroMemory(ptr long) +949 stdcall RtlZombifyActivationContext(ptr) +950 stdcall RtlpApplyLengthFunction(long long ptr ptr) +951 stdcall RtlpEnsureBufferSize(ptr ptr ptr) ; CHECKME +# stdcall RtlpNotOwnerCriticalSection +953 stdcall RtlpNtCreateKey(ptr long ptr long ptr ptr) +954 stdcall RtlpNtEnumerateSubKey(ptr ptr long long) +955 stdcall RtlpNtMakeTemporaryKey(ptr) +956 stdcall RtlpNtOpenKey(ptr long ptr long) +957 stdcall RtlpNtQueryValueKey(ptr ptr ptr ptr long) +958 stdcall RtlpNtSetValueKey(ptr long ptr long) +959 stdcall RtlpUnWaitCriticalSection(ptr) +960 stdcall RtlpWaitForCriticalSection(ptr) +961 stdcall RtlxAnsiStringToUnicodeSize(ptr) +962 stdcall RtlxOemStringToUnicodeSize(ptr) +963 stdcall RtlxUnicodeStringToAnsiSize(ptr) +964 stdcall RtlxUnicodeStringToOemSize(ptr) ; RtlUnicodeStringToOemSize +965 stdcall -ret64 VerSetConditionMask(double long long) +966 stdcall ZwAcceptConnectPort(ptr long ptr long long ptr) NtAcceptConnectPort +967 stdcall ZwAccessCheck(ptr long long ptr ptr ptr ptr ptr) NtAccessCheck +968 stdcall ZwAccessCheckAndAuditAlarm(ptr long ptr ptr ptr long ptr long ptr ptr ptr) NtAccessCheckAndAuditAlarm +969 stdcall ZwAccessCheckByType(ptr ptr ptr long ptr long ptr ptr long ptr ptr) NtAccessCheckByType +970 stdcall ZwAccessCheckByTypeAndAuditAlarm(ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) NtAccessCheckByTypeAndAuditAlarm +971 stdcall ZwAccessCheckByTypeResultList(ptr ptr ptr long ptr long ptr ptr long ptr ptr) NtAccessCheckByTypeResultList +972 stdcall ZwAccessCheckByTypeResultListAndAuditAlarm(ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) NtAccessCheckByTypeResultListAndAuditAlarm +973 stdcall ZwAccessCheckByTypeResultListAndAuditAlarmByHandle(ptr ptr ptr ptr ptr ptr ptr long long long ptr long ptr long ptr ptr ptr) NtAccessCheckByTypeResultListAndAuditAlarmByHandle +974 stdcall ZwAddAtom(ptr long ptr) NtAddAtom +975 stdcall ZwAddBootEntry(ptr long) # ZwAddDriverEntry -@ stdcall ZwAdjustGroupsToken(long long long long long long) NtAdjustGroupsToken -@ stdcall ZwAdjustPrivilegesToken(long long long long long long) NtAdjustPrivilegesToken -@ stdcall ZwAlertResumeThread(long ptr) NtAlertResumeThread -@ stdcall ZwAlertThread(long) NtAlertThread -@ stdcall ZwAllocateLocallyUniqueId(ptr) NtAllocateLocallyUniqueId -@ stdcall ZwAllocateUserPhysicalPages(ptr ptr ptr) -@ stdcall ZwAllocateUuids(ptr ptr ptr ptr) NtAllocateUuids -@ stdcall ZwAllocateVirtualMemory(long ptr ptr ptr long long) NtAllocateVirtualMemory +977 stdcall ZwAdjustGroupsToken(long long long long long long) NtAdjustGroupsToken +978 stdcall ZwAdjustPrivilegesToken(long long long long long long) NtAdjustPrivilegesToken +979 stdcall ZwAlertResumeThread(long ptr) NtAlertResumeThread +980 stdcall ZwAlertThread(long) NtAlertThread +981 stdcall ZwAllocateLocallyUniqueId(ptr) NtAllocateLocallyUniqueId +982 stdcall ZwAllocateUserPhysicalPages(ptr ptr ptr) +983 stdcall ZwAllocateUuids(ptr ptr ptr ptr) NtAllocateUuids +984 stdcall ZwAllocateVirtualMemory(long ptr ptr ptr long long) NtAllocateVirtualMemory # ZwApphelpCacheControl -@ stdcall ZwAreMappedFilesTheSame(ptr ptr) NtAreMappedFilesTheSame -@ stdcall ZwAssignProcessToJobObject(long long) NtAssignProcessToJobObject -@ stdcall ZwCallbackReturn(ptr long long) -@ stdcall ZwCancelDeviceWakeupRequest(ptr) -@ stdcall ZwCancelIoFile(long ptr) NtCancelIoFile -@ stdcall ZwCancelTimer(long ptr) NtCancelTimer -@ stdcall ZwClearEvent(long) NtClearEvent -@ stdcall ZwClose(long) NtClose -@ stdcall ZwCloseObjectAuditAlarm(ptr ptr long) -@ stdcall ZwCompactKeys(long ptr) NtCompactKeys -@ stdcall ZwCompareTokens(ptr ptr ptr) NtCompareTokens -@ stdcall ZwCompleteConnectPort(ptr) NtCompleteConnectPort -@ stdcall ZwCompressKey(ptr) NtCompressKey -@ stdcall ZwConnectPort(ptr ptr ptr ptr ptr ptr ptr ptr) NtConnectPort -@ stdcall ZwContinue(ptr long) NtContinue -@ stdcall ZwCreateDebugObject(ptr long ptr long) NtCreateDebugObject -@ stdcall ZwCreateDirectoryObject(long long long) NtCreateDirectoryObject -@ stdcall ZwCreateEvent(long long long long long) NtCreateEvent -@ stdcall ZwCreateEventPair(ptr long ptr) NtCreateEventPair -@ stdcall ZwCreateFile(ptr long ptr ptr long long long ptr long long ptr) NtCreateFile -@ stdcall ZwCreateIoCompletion(ptr long ptr long) NtCreateIoCompletion -@ stdcall ZwCreateJobObject(ptr long ptr) NtCreateJobObject -@ stdcall ZwCreateJobSet(long ptr long) NtCreateJobSet -@ stdcall ZwCreateKey(ptr long ptr long ptr long long) NtCreateKey -@ stdcall ZwCreateKeyedEvent(ptr long ptr long) NtCreateKeyedEvent -@ stdcall ZwCreateMailslotFile(long long long long long long long long) NtCreateMailslotFile -@ stdcall ZwCreateMutant(ptr long ptr long) NtCreateMutant -@ stdcall ZwCreateNamedPipeFile(ptr long ptr ptr long long long long long long long long long ptr) NtCreateNamedPipeFile -@ stdcall ZwCreatePagingFile(long long long long) NtCreatePagingFile -@ stdcall ZwCreatePort(ptr ptr long long long) NtCreatePort -@ stdcall ZwCreateProcess(ptr long ptr ptr long ptr ptr ptr) -@ stdcall ZwCreateProcessEx(ptr long ptr ptr long ptr ptr ptr long) NtCreateProcessEx -@ stdcall ZwCreateProfile(ptr ptr ptr long long ptr long long long) NtCreateProfile ; CHECKME -@ stdcall ZwCreateSection(ptr long ptr ptr long long long) NtCreateSection -@ stdcall ZwCreateSemaphore(ptr long ptr long long) NtCreateSemaphore -@ stdcall ZwCreateSymbolicLinkObject(ptr long ptr ptr) NtCreateSymbolicLinkObject -@ stdcall ZwCreateThread(ptr long ptr ptr ptr ptr ptr long) -@ stdcall ZwCreateTimer(ptr long ptr long) NtCreateTimer -@ stdcall ZwCreateToken(ptr long ptr long ptr ptr ptr ptr ptr ptr ptr ptr ptr) -@ stdcall ZwCreateWaitablePort(ptr ptr long long long) NtCreateWaitablePort -@ stdcall ZwDebugActiveProcess(ptr ptr) NtDebugActiveProcess -@ stdcall ZwDebugContinue(ptr ptr long) NtDebugContinue -@ stdcall ZwDelayExecution(long ptr) NtDelayExecution -@ stdcall ZwDeleteAtom(long) NtDeleteAtom -@ stdcall ZwDeleteBootEntry(long) NtDeleteBootEntry +986 stdcall ZwAreMappedFilesTheSame(ptr ptr) NtAreMappedFilesTheSame +987 stdcall ZwAssignProcessToJobObject(long long) NtAssignProcessToJobObject +988 stdcall ZwCallbackReturn(ptr long long) +989 stdcall ZwCancelDeviceWakeupRequest(ptr) +990 stdcall ZwCancelIoFile(long ptr) NtCancelIoFile +991 stdcall ZwCancelTimer(long ptr) NtCancelTimer +992 stdcall ZwClearEvent(long) NtClearEvent +993 stdcall ZwClose(long) NtClose +994 stdcall ZwCloseObjectAuditAlarm(ptr ptr long) +995 stdcall ZwCompactKeys(long ptr) NtCompactKeys +996 stdcall ZwCompareTokens(ptr ptr ptr) NtCompareTokens +997 stdcall ZwCompleteConnectPort(ptr) NtCompleteConnectPort +998 stdcall ZwCompressKey(ptr) NtCompressKey +999 stdcall ZwConnectPort(ptr ptr ptr ptr ptr ptr ptr ptr) NtConnectPort +1000 stdcall ZwContinue(ptr long) NtContinue +1001 stdcall ZwCreateDebugObject(ptr long ptr long) NtCreateDebugObject +1002 stdcall ZwCreateDirectoryObject(long long long) NtCreateDirectoryObject +1003 stdcall ZwCreateEvent(long long long long long) NtCreateEvent +1004 stdcall ZwCreateEventPair(ptr long ptr) NtCreateEventPair +1005 stdcall ZwCreateFile(ptr long ptr ptr long long long ptr long long ptr) NtCreateFile +1006 stdcall ZwCreateIoCompletion(ptr long ptr long) NtCreateIoCompletion +1007 stdcall ZwCreateJobObject(ptr long ptr) NtCreateJobObject +1008 stdcall ZwCreateJobSet(long ptr long) NtCreateJobSet +1009 stdcall ZwCreateKey(ptr long ptr long ptr long long) NtCreateKey +1010 stdcall ZwCreateKeyedEvent(ptr long ptr long) NtCreateKeyedEvent +1011 stdcall ZwCreateMailslotFile(long long long long long long long long) NtCreateMailslotFile +1012 stdcall ZwCreateMutant(ptr long ptr long) NtCreateMutant +1013 stdcall ZwCreateNamedPipeFile(ptr long ptr ptr long long long long long long long long long ptr) NtCreateNamedPipeFile +1014 stdcall ZwCreatePagingFile(long long long long) NtCreatePagingFile +1015 stdcall ZwCreatePort(ptr ptr long long long) NtCreatePort +1016 stdcall ZwCreateProcess(ptr long ptr ptr long ptr ptr ptr) +1017 stdcall ZwCreateProcessEx(ptr long ptr ptr long ptr ptr ptr long) NtCreateProcessEx +1018 stdcall ZwCreateProfile(ptr ptr ptr long long ptr long long long) NtCreateProfile ; CHECKME +1019 stdcall ZwCreateSection(ptr long ptr ptr long long long) NtCreateSection +1020 stdcall ZwCreateSemaphore(ptr long ptr long long) NtCreateSemaphore +1021 stdcall ZwCreateSymbolicLinkObject(ptr long ptr ptr) NtCreateSymbolicLinkObject +1022 stdcall ZwCreateThread(ptr long ptr ptr ptr ptr ptr long) +1023 stdcall ZwCreateTimer(ptr long ptr long) NtCreateTimer +1024 stdcall ZwCreateToken(ptr long ptr long ptr ptr ptr ptr ptr ptr ptr ptr ptr) +1025 stdcall ZwCreateWaitablePort(ptr ptr long long long) NtCreateWaitablePort +1026 stdcall ZwDebugActiveProcess(ptr ptr) NtDebugActiveProcess +1027 stdcall ZwDebugContinue(ptr ptr long) NtDebugContinue +1028 stdcall ZwDelayExecution(long ptr) NtDelayExecution +1029 stdcall ZwDeleteAtom(long) NtDeleteAtom +1030 stdcall ZwDeleteBootEntry(long) NtDeleteBootEntry # ZwDeleteDriverEntry -@ stdcall ZwDeleteFile(ptr) NtDeleteFile -@ stdcall ZwDeleteKey(long) NtDeleteKey -@ stdcall ZwDeleteObjectAuditAlarm(ptr ptr long) -@ stdcall ZwDeleteValueKey(long ptr) NtDeleteValueKey -@ stdcall ZwDeviceIoControlFile(long long long long long long long long long long) NtDeviceIoControlFile -@ stdcall ZwDisplayString(ptr) NtDisplayString -@ stdcall ZwDuplicateObject(long long long ptr long long long) NtDuplicateObject -@ stdcall ZwDuplicateToken(long long long long long long) NtDuplicateToken -@ stdcall ZwEnumerateBootEntries(ptr ptr) +1032 stdcall ZwDeleteFile(ptr) NtDeleteFile +1033 stdcall ZwDeleteKey(long) NtDeleteKey +1034 stdcall ZwDeleteObjectAuditAlarm(ptr ptr long) +1035 stdcall ZwDeleteValueKey(long ptr) NtDeleteValueKey +1036 stdcall ZwDeviceIoControlFile(long long long long long long long long long long) NtDeviceIoControlFile +1037 stdcall ZwDisplayString(ptr) NtDisplayString +1038 stdcall ZwDuplicateObject(long long long ptr long long long) NtDuplicateObject +1039 stdcall ZwDuplicateToken(long long long long long long) NtDuplicateToken +1040 stdcall ZwEnumerateBootEntries(ptr ptr) # ZwEnumerateDriverEntries -@ stdcall ZwEnumerateKey(long long long ptr long ptr) NtEnumerateKey -@ stdcall ZwEnumerateSystemEnvironmentValuesEx(long ptr long) NtEnumerateSystemEnvironmentValuesEx -@ stdcall ZwEnumerateValueKey(long long long ptr long ptr) NtEnumerateValueKey -@ stdcall ZwExtendSection(ptr ptr) NtExtendSection -@ stdcall ZwFilterToken(ptr long ptr ptr ptr ptr) NtFilterToken -@ stdcall ZwFindAtom(ptr long ptr) NtFindAtom -@ stdcall ZwFlushBuffersFile(long ptr) NtFlushBuffersFile -@ stdcall ZwFlushInstructionCache(long ptr long) NtFlushInstructionCache -@ stdcall ZwFlushKey(long) NtFlushKey -@ stdcall ZwFlushVirtualMemory(long ptr ptr long) NtFlushVirtualMemory -@ stdcall ZwFlushWriteBuffer() -@ stdcall ZwFreeUserPhysicalPages(ptr ptr ptr) -@ stdcall ZwFreeVirtualMemory(long ptr ptr long) NtFreeVirtualMemory -@ stdcall ZwFsControlFile(long long long long long long long long long long) NtFsControlFile -@ stdcall ZwGetContextThread(long ptr) NtGetContextThread -@ stdcall ZwGetCurrentProcessorNumber() -@ stdcall ZwGetDevicePowerState(ptr ptr) -@ stdcall ZwGetPlugPlayEvent(long long ptr long) -@ stdcall ZwGetWriteWatch(long long ptr long ptr ptr ptr) NtGetWriteWatch -@ stdcall ZwImpersonateAnonymousToken(ptr) -@ stdcall ZwImpersonateClientOfPort(ptr ptr) NtImpersonateClientOfPort -@ stdcall ZwImpersonateThread(ptr ptr ptr) NtImpersonateThread -@ stdcall ZwInitializeRegistry(long) -@ stdcall ZwInitiatePowerAction(long long long long) NtInitiatePowerAction -@ stdcall ZwIsProcessInJob(long long) NtIsProcessInJob -@ stdcall ZwIsSystemResumeAutomatic() -@ stdcall ZwListenPort(ptr ptr) NtListenPort -@ stdcall ZwLoadDriver(ptr) NtLoadDriver -@ stdcall ZwLoadKey2(ptr ptr long) NtLoadKey2 -@ stdcall ZwLoadKey(ptr ptr) NtLoadKey +1042 stdcall ZwEnumerateKey(long long long ptr long ptr) NtEnumerateKey +1043 stdcall ZwEnumerateSystemEnvironmentValuesEx(long ptr long) NtEnumerateSystemEnvironmentValuesEx +1044 stdcall ZwEnumerateValueKey(long long long ptr long ptr) NtEnumerateValueKey +1045 stdcall ZwExtendSection(ptr ptr) NtExtendSection +1046 stdcall ZwFilterToken(ptr long ptr ptr ptr ptr) NtFilterToken +1047 stdcall ZwFindAtom(ptr long ptr) NtFindAtom +1048 stdcall ZwFlushBuffersFile(long ptr) NtFlushBuffersFile +1049 stdcall ZwFlushInstructionCache(long ptr long) NtFlushInstructionCache +1050 stdcall ZwFlushKey(long) NtFlushKey +1051 stdcall ZwFlushVirtualMemory(long ptr ptr long) NtFlushVirtualMemory +1052 stdcall ZwFlushWriteBuffer() +1053 stdcall ZwFreeUserPhysicalPages(ptr ptr ptr) +1054 stdcall ZwFreeVirtualMemory(long ptr ptr long) NtFreeVirtualMemory +1055 stdcall ZwFsControlFile(long long long long long long long long long long) NtFsControlFile +1056 stdcall ZwGetContextThread(long ptr) NtGetContextThread +1057 stdcall ZwGetCurrentProcessorNumber() +1058 stdcall ZwGetDevicePowerState(ptr ptr) +1059 stdcall ZwGetPlugPlayEvent(long long ptr long) +1060 stdcall ZwGetWriteWatch(long long ptr long ptr ptr ptr) NtGetWriteWatch +1061 stdcall ZwImpersonateAnonymousToken(ptr) +1062 stdcall ZwImpersonateClientOfPort(ptr ptr) NtImpersonateClientOfPort +1063 stdcall ZwImpersonateThread(ptr ptr ptr) NtImpersonateThread +1064 stdcall ZwInitializeRegistry(long) +1065 stdcall ZwInitiatePowerAction(long long long long) NtInitiatePowerAction +1066 stdcall ZwIsProcessInJob(long long) NtIsProcessInJob +1067 stdcall ZwIsSystemResumeAutomatic() +1068 stdcall ZwListenPort(ptr ptr) NtListenPort +1069 stdcall ZwLoadDriver(ptr) NtLoadDriver +1070 stdcall ZwLoadKey2(ptr ptr long) NtLoadKey2 +1071 stdcall ZwLoadKey(ptr ptr) NtLoadKey # ZwLoadKeyEx -@ stdcall ZwLockFile(long long ptr ptr ptr ptr ptr ptr long long) NtLockFile -@ stdcall ZwLockProductActivationKeys(ptr ptr) NtLockProductActivationKeys -@ stdcall ZwLockRegistryKey(ptr) NtLockRegistryKey -@ stdcall ZwLockVirtualMemory(long ptr ptr long) NtLockVirtualMemory -@ stdcall ZwMakePermanentObject(ptr) NtMakePermanentObject -@ stdcall ZwMakeTemporaryObject(long) NtMakeTemporaryObject -@ stdcall ZwMapUserPhysicalPages(ptr ptr ptr) -@ stdcall ZwMapUserPhysicalPagesScatter(ptr ptr ptr) -@ stdcall ZwMapViewOfSection(long long ptr long long ptr ptr long long long) NtMapViewOfSection -@ stdcall ZwModifyBootEntry(ptr) NtModifyBootEntry +1073 stdcall ZwLockFile(long long ptr ptr ptr ptr ptr ptr long long) NtLockFile +1074 stdcall ZwLockProductActivationKeys(ptr ptr) NtLockProductActivationKeys +1075 stdcall ZwLockRegistryKey(ptr) NtLockRegistryKey +1076 stdcall ZwLockVirtualMemory(long ptr ptr long) NtLockVirtualMemory +1077 stdcall ZwMakePermanentObject(ptr) NtMakePermanentObject +1078 stdcall ZwMakeTemporaryObject(long) NtMakeTemporaryObject +1079 stdcall ZwMapUserPhysicalPages(ptr ptr ptr) +1080 stdcall ZwMapUserPhysicalPagesScatter(ptr ptr ptr) +1081 stdcall ZwMapViewOfSection(long long ptr long long ptr ptr long long long) NtMapViewOfSection +1082 stdcall ZwModifyBootEntry(ptr) NtModifyBootEntry # ZwModifyDriverEntry -@ stdcall ZwNotifyChangeDirectoryFile(long long ptr ptr ptr ptr long long long) NtNotifyChangeDirectoryFile -@ stdcall ZwNotifyChangeKey(long long ptr ptr ptr long long ptr long long) NtNotifyChangeKey -@ stdcall ZwNotifyChangeMultipleKeys(ptr long ptr ptr ptr ptr ptr long long ptr long long) NtNotifyChangeMultipleKeys -@ stdcall ZwOpenDirectoryObject(long long long) NtOpenDirectoryObject -@ stdcall ZwOpenEvent(long long long) NtOpenEvent -@ stdcall ZwOpenEventPair(ptr long ptr) NtOpenEventPair -@ stdcall ZwOpenFile(ptr long ptr ptr long long) NtOpenFile -@ stdcall ZwOpenIoCompletion(ptr long ptr) NtOpenIoCompletion -@ stdcall ZwOpenJobObject(ptr long ptr) NtOpenJobObject -@ stdcall ZwOpenKey(ptr long ptr) NtOpenKey -@ stdcall ZwOpenKeyedEvent(ptr long ptr) NtOpenKeyedEvent -@ stdcall ZwOpenMutant(ptr long ptr) NtOpenMutant -@ stdcall ZwOpenObjectAuditAlarm(ptr ptr ptr ptr ptr ptr long long ptr long long ptr) -@ stdcall ZwOpenProcess(ptr long ptr ptr) NtOpenProcess -@ stdcall ZwOpenProcessToken(long long ptr) NtOpenProcessToken -@ stdcall ZwOpenProcessTokenEx(long long long ptr) NtOpenProcessTokenEx -@ stdcall ZwOpenSection(ptr long ptr) NtOpenSection -@ stdcall ZwOpenSemaphore(long long ptr) NtOpenSemaphore -@ stdcall ZwOpenSymbolicLinkObject (ptr long ptr) NtOpenSymbolicLinkObject -@ stdcall ZwOpenThread(ptr long ptr ptr) NtOpenThread -@ stdcall ZwOpenThreadToken(long long long ptr) NtOpenThreadToken -@ stdcall ZwOpenThreadTokenEx(long long long long ptr) NtOpenThreadTokenEx -@ stdcall ZwOpenTimer(ptr long ptr) NtOpenTimer -@ stdcall ZwPlugPlayControl(ptr ptr long) -@ stdcall ZwPowerInformation(long ptr long ptr long) NtPowerInformation -@ stdcall ZwPrivilegeCheck(ptr ptr ptr) NtPrivilegeCheck -@ stdcall ZwPrivilegeObjectAuditAlarm(ptr ptr ptr long ptr long) -@ stdcall ZwPrivilegedServiceAuditAlarm(ptr ptr ptr ptr long) -@ stdcall ZwProtectVirtualMemory(long ptr ptr long ptr) NtProtectVirtualMemory -@ stdcall ZwPulseEvent(long ptr) NtPulseEvent -@ stdcall ZwQueryAttributesFile(ptr ptr) NtQueryAttributesFile -@ stdcall ZwQueryBootEntryOrder(ptr ptr) NtQueryBootEntryOrder -@ stdcall ZwQueryBootOptions(ptr ptr) NtQueryBootOptions -@ stdcall ZwQueryDebugFilterState(long long) NtQueryDebugFilterState -@ stdcall ZwQueryDefaultLocale(long ptr) NtQueryDefaultLocale -@ stdcall ZwQueryDefaultUILanguage(ptr) NtQueryDefaultUILanguage -@ stdcall ZwQueryDirectoryFile(long long ptr ptr ptr ptr long long long ptr long) NtQueryDirectoryFile -@ stdcall ZwQueryDirectoryObject(long ptr long long long ptr ptr) NtQueryDirectoryObject +1084 stdcall ZwNotifyChangeDirectoryFile(long long ptr ptr ptr ptr long long long) NtNotifyChangeDirectoryFile +1085 stdcall ZwNotifyChangeKey(long long ptr ptr ptr long long ptr long long) NtNotifyChangeKey +1086 stdcall ZwNotifyChangeMultipleKeys(ptr long ptr ptr ptr ptr ptr long long ptr long long) NtNotifyChangeMultipleKeys +1087 stdcall ZwOpenDirectoryObject(long long long) NtOpenDirectoryObject +1088 stdcall ZwOpenEvent(long long long) NtOpenEvent +1089 stdcall ZwOpenEventPair(ptr long ptr) NtOpenEventPair +1090 stdcall ZwOpenFile(ptr long ptr ptr long long) NtOpenFile +1091 stdcall ZwOpenIoCompletion(ptr long ptr) NtOpenIoCompletion +1092 stdcall ZwOpenJobObject(ptr long ptr) NtOpenJobObject +1093 stdcall ZwOpenKey(ptr long ptr) NtOpenKey +1094 stdcall ZwOpenKeyedEvent(ptr long ptr) NtOpenKeyedEvent +1095 stdcall ZwOpenMutant(ptr long ptr) NtOpenMutant +1096 stdcall ZwOpenObjectAuditAlarm(ptr ptr ptr ptr ptr ptr long long ptr long long ptr) +1097 stdcall ZwOpenProcess(ptr long ptr ptr) NtOpenProcess +1098 stdcall ZwOpenProcessToken(long long ptr) NtOpenProcessToken +1099 stdcall ZwOpenProcessTokenEx(long long long ptr) NtOpenProcessTokenEx +1100 stdcall ZwOpenSection(ptr long ptr) NtOpenSection +1101 stdcall ZwOpenSemaphore(long long ptr) NtOpenSemaphore +1102 stdcall ZwOpenSymbolicLinkObject (ptr long ptr) NtOpenSymbolicLinkObject +1103 stdcall ZwOpenThread(ptr long ptr ptr) NtOpenThread +1104 stdcall ZwOpenThreadToken(long long long ptr) NtOpenThreadToken +1105 stdcall ZwOpenThreadTokenEx(long long long long ptr) NtOpenThreadTokenEx +1106 stdcall ZwOpenTimer(ptr long ptr) NtOpenTimer +1107 stdcall ZwPlugPlayControl(ptr ptr long) +1108 stdcall ZwPowerInformation(long ptr long ptr long) NtPowerInformation +1109 stdcall ZwPrivilegeCheck(ptr ptr ptr) NtPrivilegeCheck +1110 stdcall ZwPrivilegeObjectAuditAlarm(ptr ptr ptr long ptr long) +1111 stdcall ZwPrivilegedServiceAuditAlarm(ptr ptr ptr ptr long) +1112 stdcall ZwProtectVirtualMemory(long ptr ptr long ptr) NtProtectVirtualMemory +1113 stdcall ZwPulseEvent(long ptr) NtPulseEvent +1114 stdcall ZwQueryAttributesFile(ptr ptr) NtQueryAttributesFile +1115 stdcall ZwQueryBootEntryOrder(ptr ptr) NtQueryBootEntryOrder +1116 stdcall ZwQueryBootOptions(ptr ptr) NtQueryBootOptions +1117 stdcall ZwQueryDebugFilterState(long long) NtQueryDebugFilterState +1118 stdcall ZwQueryDefaultLocale(long ptr) NtQueryDefaultLocale +1119 stdcall ZwQueryDefaultUILanguage(ptr) NtQueryDefaultUILanguage +1120 stdcall ZwQueryDirectoryFile(long long ptr ptr ptr ptr long long long ptr long) NtQueryDirectoryFile +1121 stdcall ZwQueryDirectoryObject(long ptr long long long ptr ptr) NtQueryDirectoryObject # ZwQueryDriverEntryOrder -@ stdcall ZwQueryEaFile(long ptr ptr long long ptr long ptr long) NtQueryEaFile -@ stdcall ZwQueryEvent(long long ptr long ptr) NtQueryEvent -@ stdcall ZwQueryFullAttributesFile(ptr ptr) NtQueryFullAttributesFile -@ stdcall ZwQueryInformationAtom(long long ptr long ptr) NtQueryInformationAtom -@ stdcall ZwQueryInformationFile(long ptr ptr long long) NtQueryInformationFile -@ stdcall ZwQueryInformationJobObject(long long ptr long ptr) NtQueryInformationJobObject -@ stdcall ZwQueryInformationPort(ptr long ptr long ptr) NtQueryInformationPort -@ stdcall ZwQueryInformationProcess(long long ptr long ptr) NtQueryInformationProcess -@ stdcall ZwQueryInformationThread(long long ptr long ptr) NtQueryInformationThread -@ stdcall ZwQueryInformationToken(long long ptr long ptr) NtQueryInformationToken -@ stdcall ZwQueryInstallUILanguage(ptr) NtQueryInstallUILanguage -@ stdcall ZwQueryIntervalProfile(long ptr) NtQueryIntervalProfile -@ stdcall ZwQueryIoCompletion(long long ptr long ptr) NtQueryIoCompletion -@ stdcall ZwQueryKey(long long ptr long ptr) NtQueryKey -@ stdcall ZwQueryMultipleValueKey(long ptr long ptr long ptr) NtQueryMultipleValueKey -@ stdcall ZwQueryMutant(long long ptr long ptr) NtQueryMutant -@ stdcall ZwQueryObject(long long long long long) NtQueryObject -@ stdcall ZwQueryOpenSubKeys(ptr ptr) NtQueryOpenSubKeys +1123 stdcall ZwQueryEaFile(long ptr ptr long long ptr long ptr long) NtQueryEaFile +1124 stdcall ZwQueryEvent(long long ptr long ptr) NtQueryEvent +1125 stdcall ZwQueryFullAttributesFile(ptr ptr) NtQueryFullAttributesFile +1126 stdcall ZwQueryInformationAtom(long long ptr long ptr) NtQueryInformationAtom +1127 stdcall ZwQueryInformationFile(long ptr ptr long long) NtQueryInformationFile +1128 stdcall ZwQueryInformationJobObject(long long ptr long ptr) NtQueryInformationJobObject +1129 stdcall ZwQueryInformationPort(ptr long ptr long ptr) NtQueryInformationPort +1130 stdcall ZwQueryInformationProcess(long long ptr long ptr) NtQueryInformationProcess +1131 stdcall ZwQueryInformationThread(long long ptr long ptr) NtQueryInformationThread +1132 stdcall ZwQueryInformationToken(long long ptr long ptr) NtQueryInformationToken +1133 stdcall ZwQueryInstallUILanguage(ptr) NtQueryInstallUILanguage +1134 stdcall ZwQueryIntervalProfile(long ptr) NtQueryIntervalProfile +1135 stdcall ZwQueryIoCompletion(long long ptr long ptr) NtQueryIoCompletion +1136 stdcall ZwQueryKey(long long ptr long ptr) NtQueryKey +1137 stdcall ZwQueryMultipleValueKey(long ptr long ptr long ptr) NtQueryMultipleValueKey +1138 stdcall ZwQueryMutant(long long ptr long ptr) NtQueryMutant +1139 stdcall ZwQueryObject(long long long long long) NtQueryObject +1140 stdcall ZwQueryOpenSubKeys(ptr ptr) NtQueryOpenSubKeys # ZwQueryOpenSubKeysEx -@ stdcall ZwQueryPerformanceCounter (long long) NtQueryPerformanceCounter -@ stdcall ZwQueryPortInformationProcess() NtQueryPortInformationProcess -@ stdcall ZwQueryQuotaInformationFile(ptr ptr ptr long long ptr long ptr long) NtQueryQuotaInformationFile -@ stdcall ZwQuerySection (long long long long long) NtQuerySection -@ stdcall ZwQuerySecurityObject (long long long long long) NtQuerySecurityObject -@ stdcall ZwQuerySemaphore (long long long long long) NtQuerySemaphore -@ stdcall ZwQuerySymbolicLinkObject(long ptr ptr) NtQuerySymbolicLinkObject -@ stdcall ZwQuerySystemEnvironmentValue(ptr ptr long ptr) NtQuerySystemEnvironmentValue -@ stdcall ZwQuerySystemEnvironmentValueEx(ptr ptr ptr ptr ptr) NtQuerySystemEnvironmentValueEx -@ stdcall ZwQuerySystemInformation(long long long long) NtQuerySystemInformation -@ stdcall ZwQuerySystemTime(ptr) NtQuerySystemTime -@ stdcall ZwQueryTimer(ptr long ptr long ptr) NtQueryTimer -@ stdcall ZwQueryTimerResolution(long long long) NtQueryTimerResolution -@ stdcall ZwQueryValueKey(long ptr long ptr long ptr) NtQueryValueKey -@ stdcall ZwQueryVirtualMemory(long ptr long ptr long ptr) NtQueryVirtualMemory -@ stdcall ZwQueryVolumeInformationFile(long ptr ptr long long) NtQueryVolumeInformationFile -@ stdcall ZwQueueApcThread(long ptr long long long) NtQueueApcThread -@ stdcall ZwRaiseException(ptr ptr long) NtRaiseException -@ stdcall ZwRaiseHardError(long long long ptr long ptr) NtRaiseHardError -@ stdcall ZwReadFile(long long ptr ptr ptr ptr long ptr ptr) NtReadFile -@ stdcall ZwReadFileScatter(long long ptr ptr ptr ptr long ptr ptr) NtReadFileScatter -@ stdcall ZwReadRequestData(ptr ptr long ptr long ptr) NtReadRequestData -@ stdcall ZwReadVirtualMemory(long ptr ptr long ptr) NtReadVirtualMemory -@ stdcall ZwRegisterThreadTerminatePort(ptr) NtRegisterThreadTerminatePort -@ stdcall ZwReleaseKeyedEvent(ptr ptr long ptr) NtReleaseKeyedEvent -@ stdcall ZwReleaseMutant(long ptr) NtReleaseMutant -@ stdcall ZwReleaseSemaphore(long long ptr) NtReleaseSemaphore -@ stdcall ZwRemoveIoCompletion(ptr ptr ptr ptr ptr) NtRemoveIoCompletion -@ stdcall ZwRemoveProcessDebug(ptr ptr) NtRemoveProcessDebug -@ stdcall ZwRenameKey(ptr ptr) NtRenameKey -@ stdcall ZwReplaceKey(ptr long ptr) NtReplaceKey -@ stdcall ZwReplyPort(ptr ptr) NtReplyPort -@ stdcall ZwReplyWaitReceivePort(ptr ptr ptr ptr) NtReplyWaitReceivePort -@ stdcall ZwReplyWaitReceivePortEx(ptr ptr ptr ptr ptr) -@ stdcall ZwReplyWaitReplyPort(ptr ptr) -@ stdcall ZwRequestDeviceWakeup(ptr) -@ stdcall ZwRequestPort(ptr ptr) -@ stdcall ZwRequestWaitReplyPort(ptr ptr ptr) -@ stdcall ZwRequestWakeupLatency(long) -@ stdcall ZwResetEvent(long ptr) -@ stdcall ZwResetWriteWatch(long ptr long) -@ stdcall ZwRestoreKey(long long long) -@ stdcall ZwResumeProcess(ptr) -@ stdcall ZwResumeThread(long long) -@ stdcall ZwSaveKey(long long) -@ stdcall ZwSaveKeyEx(ptr ptr long) -@ stdcall ZwSaveMergedKeys(ptr ptr ptr) -@ stdcall ZwSecureConnectPort(ptr ptr ptr ptr ptr ptr ptr ptr ptr) -@ stdcall ZwSetBootEntryOrder(ptr ptr) -@ stdcall ZwSetBootOptions(ptr long) -@ stdcall ZwSetContextThread(long ptr) -@ stdcall ZwSetDebugFilterState(long long long) -@ stdcall ZwSetDefaultHardErrorPort(ptr) -@ stdcall ZwSetDefaultLocale(long long) -@ stdcall ZwSetDefaultUILanguage(long) +1142 stdcall ZwQueryPerformanceCounter (long long) NtQueryPerformanceCounter +1143 stdcall ZwQueryPortInformationProcess() NtQueryPortInformationProcess +1144 stdcall ZwQueryQuotaInformationFile(ptr ptr ptr long long ptr long ptr long) NtQueryQuotaInformationFile +1145 stdcall ZwQuerySection (long long long long long) NtQuerySection +1146 stdcall ZwQuerySecurityObject (long long long long long) NtQuerySecurityObject +1147 stdcall ZwQuerySemaphore (long long long long long) NtQuerySemaphore +1148 stdcall ZwQuerySymbolicLinkObject(long ptr ptr) NtQuerySymbolicLinkObject +1149 stdcall ZwQuerySystemEnvironmentValue(ptr ptr long ptr) NtQuerySystemEnvironmentValue +1150 stdcall ZwQuerySystemEnvironmentValueEx(ptr ptr ptr ptr ptr) NtQuerySystemEnvironmentValueEx +1151 stdcall ZwQuerySystemInformation(long long long long) NtQuerySystemInformation +1152 stdcall ZwQuerySystemTime(ptr) NtQuerySystemTime +1153 stdcall ZwQueryTimer(ptr long ptr long ptr) NtQueryTimer +1154 stdcall ZwQueryTimerResolution(long long long) NtQueryTimerResolution +1155 stdcall ZwQueryValueKey(long ptr long ptr long ptr) NtQueryValueKey +1156 stdcall ZwQueryVirtualMemory(long ptr long ptr long ptr) NtQueryVirtualMemory +1157 stdcall ZwQueryVolumeInformationFile(long ptr ptr long long) NtQueryVolumeInformationFile +1158 stdcall ZwQueueApcThread(long ptr long long long) NtQueueApcThread +1159 stdcall ZwRaiseException(ptr ptr long) NtRaiseException +1160 stdcall ZwRaiseHardError(long long long ptr long ptr) NtRaiseHardError +1161 stdcall ZwReadFile(long long ptr ptr ptr ptr long ptr ptr) NtReadFile +1162 stdcall ZwReadFileScatter(long long ptr ptr ptr ptr long ptr ptr) NtReadFileScatter +1163 stdcall ZwReadRequestData(ptr ptr long ptr long ptr) NtReadRequestData +1164 stdcall ZwReadVirtualMemory(long ptr ptr long ptr) NtReadVirtualMemory +1165 stdcall ZwRegisterThreadTerminatePort(ptr) NtRegisterThreadTerminatePort +1166 stdcall ZwReleaseKeyedEvent(ptr ptr long ptr) NtReleaseKeyedEvent +1167 stdcall ZwReleaseMutant(long ptr) NtReleaseMutant +1168 stdcall ZwReleaseSemaphore(long long ptr) NtReleaseSemaphore +1169 stdcall ZwRemoveIoCompletion(ptr ptr ptr ptr ptr) NtRemoveIoCompletion +1170 stdcall ZwRemoveProcessDebug(ptr ptr) NtRemoveProcessDebug +1171 stdcall ZwRenameKey(ptr ptr) NtRenameKey +1172 stdcall ZwReplaceKey(ptr long ptr) NtReplaceKey +1173 stdcall ZwReplyPort(ptr ptr) NtReplyPort +1174 stdcall ZwReplyWaitReceivePort(ptr ptr ptr ptr) NtReplyWaitReceivePort +1175 stdcall ZwReplyWaitReceivePortEx(ptr ptr ptr ptr ptr) +1176 stdcall ZwReplyWaitReplyPort(ptr ptr) +1177 stdcall ZwRequestDeviceWakeup(ptr) +1178 stdcall ZwRequestPort(ptr ptr) +1179 stdcall ZwRequestWaitReplyPort(ptr ptr ptr) +1180 stdcall ZwRequestWakeupLatency(long) +1181 stdcall ZwResetEvent(long ptr) +1182 stdcall ZwResetWriteWatch(long ptr long) +1183 stdcall ZwRestoreKey(long long long) +1184 stdcall ZwResumeProcess(ptr) +1185 stdcall ZwResumeThread(long long) +1186 stdcall ZwSaveKey(long long) +1187 stdcall ZwSaveKeyEx(ptr ptr long) +1188 stdcall ZwSaveMergedKeys(ptr ptr ptr) +1189 stdcall ZwSecureConnectPort(ptr ptr ptr ptr ptr ptr ptr ptr ptr) +1190 stdcall ZwSetBootEntryOrder(ptr ptr) +1191 stdcall ZwSetBootOptions(ptr long) +1192 stdcall ZwSetContextThread(long ptr) +1193 stdcall ZwSetDebugFilterState(long long long) +1194 stdcall ZwSetDefaultHardErrorPort(ptr) +1195 stdcall ZwSetDefaultLocale(long long) +1196 stdcall ZwSetDefaultUILanguage(long) # ZwSetDriverEntryOrder -@ stdcall ZwSetEaFile(long ptr ptr long) -@ stdcall ZwSetEvent(long long) -@ stdcall ZwSetEventBoostPriority(ptr) -@ stdcall ZwSetHighEventPair(ptr) -@ stdcall ZwSetHighWaitLowEventPair(ptr) -@ stdcall ZwSetInformationDebugObject(ptr long ptr long ptr) -@ stdcall ZwSetInformationFile(long long long long long) -@ stdcall ZwSetInformationJobObject(long long ptr long) -@ stdcall ZwSetInformationKey(long long ptr long) -@ stdcall ZwSetInformationObject(long long ptr long) -@ stdcall ZwSetInformationProcess(long long long long) -@ stdcall ZwSetInformationThread(long long ptr long) -@ stdcall ZwSetInformationToken(long long ptr long) -@ stdcall ZwSetIntervalProfile(long long) -@ stdcall ZwSetIoCompletion(ptr long ptr long long) -@ stdcall ZwSetLdtEntries(long int64 long int64) -@ stdcall ZwSetLowEventPair(ptr) -@ stdcall ZwSetLowWaitHighEventPair(ptr) -@ stdcall ZwSetQuotaInformationFile(ptr ptr ptr long) -@ stdcall ZwSetSecurityObject(long long ptr) -@ stdcall ZwSetSystemEnvironmentValue(ptr ptr) -@ stdcall ZwSetSystemEnvironmentValueEx(ptr ptr ptr ptr ptr) NtSetSystemEnvironmentValueEx -@ stdcall ZwSetSystemInformation(long ptr long) -@ stdcall ZwSetSystemPowerState(long long long) -@ stdcall ZwSetSystemTime(ptr ptr) -@ stdcall ZwSetThreadExecutionState(long ptr) -@ stdcall ZwSetTimer(long ptr ptr ptr long long ptr) -@ stdcall ZwSetTimerResolution(long long ptr) -@ stdcall ZwSetUuidSeed(ptr) -@ stdcall ZwSetValueKey(long long long long long long) -@ stdcall ZwSetVolumeInformationFile(long ptr ptr long long) -@ stdcall ZwShutdownSystem(long) -@ stdcall ZwSignalAndWaitForSingleObject(long long long ptr) -@ stdcall ZwStartProfile(ptr) -@ stdcall ZwStopProfile(ptr) -@ stdcall ZwSuspendProcess(ptr) -@ stdcall ZwSuspendThread(long ptr) -@ stdcall ZwSystemDebugControl(long ptr long ptr long ptr) -@ stdcall ZwTerminateJobObject(long long) -@ stdcall ZwTerminateProcess(long long) -@ stdcall ZwTerminateThread(long long) -@ stdcall ZwTestAlert() -@ stdcall ZwTraceEvent(long long long ptr) -@ stdcall ZwTranslateFilePath(ptr long ptr long) -@ stdcall ZwUnloadDriver(ptr) +1198 stdcall ZwSetEaFile(long ptr ptr long) +1199 stdcall ZwSetEvent(long long) +1200 stdcall ZwSetEventBoostPriority(ptr) +1201 stdcall ZwSetHighEventPair(ptr) +1202 stdcall ZwSetHighWaitLowEventPair(ptr) +1203 stdcall ZwSetInformationDebugObject(ptr long ptr long ptr) +1204 stdcall ZwSetInformationFile(long long long long long) +1205 stdcall ZwSetInformationJobObject(long long ptr long) +1206 stdcall ZwSetInformationKey(long long ptr long) +1207 stdcall ZwSetInformationObject(long long ptr long) +1208 stdcall ZwSetInformationProcess(long long long long) +1209 stdcall ZwSetInformationThread(long long ptr long) +1210 stdcall ZwSetInformationToken(long long ptr long) +1211 stdcall ZwSetIntervalProfile(long long) +1212 stdcall ZwSetIoCompletion(ptr long ptr long long) +1213 stdcall ZwSetLdtEntries(long int64 long int64) +1214 stdcall ZwSetLowEventPair(ptr) +1215 stdcall ZwSetLowWaitHighEventPair(ptr) +1216 stdcall ZwSetQuotaInformationFile(ptr ptr ptr long) +1217 stdcall ZwSetSecurityObject(long long ptr) +1218 stdcall ZwSetSystemEnvironmentValue(ptr ptr) +1219 stdcall ZwSetSystemEnvironmentValueEx(ptr ptr ptr ptr ptr) NtSetSystemEnvironmentValueEx +1220 stdcall ZwSetSystemInformation(long ptr long) +1221 stdcall ZwSetSystemPowerState(long long long) +1222 stdcall ZwSetSystemTime(ptr ptr) +1223 stdcall ZwSetThreadExecutionState(long ptr) +1224 stdcall ZwSetTimer(long ptr ptr ptr long long ptr) +1225 stdcall ZwSetTimerResolution(long long ptr) +1226 stdcall ZwSetUuidSeed(ptr) +1227 stdcall ZwSetValueKey(long long long long long long) +1228 stdcall ZwSetVolumeInformationFile(long ptr ptr long long) +1229 stdcall ZwShutdownSystem(long) +1230 stdcall ZwSignalAndWaitForSingleObject(long long long ptr) +1231 stdcall ZwStartProfile(ptr) +1232 stdcall ZwStopProfile(ptr) +1233 stdcall ZwSuspendProcess(ptr) +1234 stdcall ZwSuspendThread(long ptr) +1235 stdcall ZwSystemDebugControl(long ptr long ptr long ptr) +1236 stdcall ZwTerminateJobObject(long long) +1237 stdcall ZwTerminateProcess(long long) +1238 stdcall ZwTerminateThread(long long) +1239 stdcall ZwTestAlert() +1240 stdcall ZwTraceEvent(long long long ptr) +1241 stdcall ZwTranslateFilePath(ptr long ptr long) +1242 stdcall ZwUnloadDriver(ptr) # ZwUnloadKey2 -@ stdcall ZwUnloadKey(long) -@ stdcall ZwUnloadKeyEx(ptr ptr) -@ stdcall ZwUnlockFile(long ptr ptr ptr ptr) -@ stdcall ZwUnlockVirtualMemory(long ptr ptr long) -@ stdcall ZwUnmapViewOfSection(long ptr) -@ stdcall ZwVdmControl(long ptr) -@ stdcall ZwWaitForDebugEvent(ptr long ptr ptr) -@ stdcall ZwWaitForKeyedEvent(ptr ptr long ptr) +1244 stdcall ZwUnloadKey(long) +1245 stdcall ZwUnloadKeyEx(ptr ptr) +1246 stdcall ZwUnlockFile(long ptr ptr ptr ptr) +1247 stdcall ZwUnlockVirtualMemory(long ptr ptr long) +1248 stdcall ZwUnmapViewOfSection(long ptr) +1249 stdcall ZwVdmControl(long ptr) +1250 stdcall ZwWaitForDebugEvent(ptr long ptr ptr) +1251 stdcall ZwWaitForKeyedEvent(ptr ptr long ptr) # ZwWaitForMultipleObjects32 -@ stdcall ZwWaitForMultipleObjects(long ptr long long ptr) -@ stdcall ZwWaitForSingleObject(long long long) -@ stdcall ZwWaitHighEventPair(ptr) -@ stdcall ZwWaitLowEventPair(ptr) -@ stdcall ZwWriteFile(long long ptr ptr ptr ptr long ptr ptr) -@ stdcall ZwWriteFileGather(long long ptr ptr ptr ptr long ptr ptr) -@ stdcall ZwWriteRequestData(ptr ptr long ptr long ptr) -@ stdcall ZwWriteVirtualMemory(long ptr ptr long ptr) -@ stdcall ZwYieldExecution() -@ cdecl -arch=i386 _CIcos() -@ cdecl -arch=i386 _CIlog() -@ cdecl -arch=i386 _CIpow() -@ cdecl -arch=i386 _CIsin() -@ cdecl -arch=i386 _CIsqrt() +1253 stdcall ZwWaitForMultipleObjects(long ptr long long ptr) +1254 stdcall ZwWaitForSingleObject(long long long) +1255 stdcall ZwWaitHighEventPair(ptr) +1256 stdcall ZwWaitLowEventPair(ptr) +1257 stdcall ZwWriteFile(long long ptr ptr ptr ptr long ptr ptr) +1258 stdcall ZwWriteFileGather(long long ptr ptr ptr ptr long ptr ptr) +1259 stdcall ZwWriteRequestData(ptr ptr long ptr long ptr) +1260 stdcall ZwWriteVirtualMemory(long ptr ptr long ptr) +1261 stdcall ZwYieldExecution() +1262 cdecl -arch=i386 _CIcos() +1263 cdecl -arch=i386 _CIlog() +1264 cdecl -arch=i386 _CIpow() +1265 cdecl -arch=i386 _CIsin() +1266 cdecl -arch=i386 _CIsqrt() @ cdecl -arch=x86_64,arm __C_specific_handler(ptr long ptr ptr) @ cdecl -arch=arm __jump_unwind() -@ cdecl __isascii(long) -@ cdecl __iscsym(long) -@ cdecl __iscsymf(long) -@ cdecl __toascii(long) -@ cdecl -arch=i386 -ret64 _alldiv(double double) -@ cdecl -arch=i386 _alldvrm() -@ cdecl -arch=i386 -ret64 _allmul(double double) -@ cdecl -arch=i386 -norelay _alloca_probe() -@ cdecl -arch=i386 -ret64 _allrem(double double) -@ cdecl -arch=i386 _allshl() -@ cdecl -arch=i386 _allshr() -@ cdecl -ret64 _atoi64(str) -@ cdecl -arch=i386 -ret64 _aulldiv(double double) -@ cdecl -arch=i386 _aulldvrm() -@ cdecl -arch=i386 -ret64 _aullrem(double double) -@ cdecl -arch=i386 _aullshr() -@ extern -arch=i386 _chkstk -@ cdecl -arch=i386,x86_64,arm _fltused() -@ cdecl -arch=i386 -ret64 _ftol() -@ cdecl _i64toa(double ptr long) -@ cdecl _i64tow(double ptr long) -@ cdecl _itoa(long ptr long) -@ cdecl _itow(long ptr long) -@ cdecl _lfind(ptr ptr ptr long ptr) +1267 cdecl __isascii(long) +1268 cdecl __iscsym(long) +1269 cdecl __iscsymf(long) +1270 cdecl __toascii(long) +1271 cdecl -arch=i386 -ret64 _alldiv(double double) +1272 cdecl -arch=i386 _alldvrm() +1273 cdecl -arch=i386 -ret64 _allmul(double double) +1274 cdecl -arch=i386 -norelay _alloca_probe() +1275 cdecl -arch=i386 -ret64 _allrem(double double) +1276 cdecl -arch=i386 _allshl() +1277 cdecl -arch=i386 _allshr() +1278 cdecl -ret64 _atoi64(str) +1279 cdecl -arch=i386 -ret64 _aulldiv(double double) +1280 cdecl -arch=i386 _aulldvrm() +1281 cdecl -arch=i386 -ret64 _aullrem(double double) +1282 cdecl -arch=i386 _aullshr() +1283 extern -arch=i386 _chkstk +1284 cdecl -arch=i386,x86_64,arm _fltused() +1285 cdecl -arch=i386 -ret64 _ftol() +1286 cdecl _i64toa(double ptr long) +1287 cdecl _i64tow(double ptr long) +1288 cdecl _itoa(long ptr long) +1289 cdecl _itow(long ptr long) +1290 cdecl _lfind(ptr ptr ptr long ptr) @ cdecl -arch=x86_64 _local_unwind() -@ cdecl _ltoa(long ptr long) -@ cdecl _ltow(long ptr long) -@ cdecl _memccpy(ptr ptr long long) -@ cdecl _memicmp(str str long) +1291 cdecl _ltoa(long ptr long) +1292 cdecl _ltow(long ptr long) +1293 cdecl _memccpy(ptr ptr long long) +1294 cdecl _memicmp(str str long) @ cdecl -arch=x86_64 _setjmp(ptr ptr) @ cdecl -arch=x86_64 _setjmpex(ptr ptr) -@ varargs _snprintf(ptr long str) -@ varargs _snwprintf(ptr long wstr) -@ cdecl _splitpath(str ptr ptr ptr ptr) -@ cdecl _strcmpi(str str) _stricmp -@ cdecl _stricmp(str str) -@ cdecl _strlwr(str) -@ cdecl _strnicmp(str str long) -@ cdecl _strupr(str) -@ cdecl _tolower(long) -@ cdecl _toupper(long) -@ cdecl _ui64toa(double ptr long) -@ cdecl _ui64tow(double ptr long) -@ cdecl _ultoa(long ptr long) -@ cdecl _ultow(long ptr long) -@ cdecl _vscwprintf(wstr ptr) -@ cdecl _vsnprintf(ptr long str ptr) -@ cdecl _vsnwprintf(ptr long wstr ptr) -@ cdecl _wcsicmp(wstr wstr) -@ cdecl _wcslwr(wstr) -@ cdecl _wcsnicmp(wstr wstr long) +1295 varargs _snprintf(ptr long str) +1296 varargs _snwprintf(ptr long wstr) +1297 cdecl _splitpath(str ptr ptr ptr ptr) +1298 cdecl _strcmpi(str str) _stricmp +1299 cdecl _stricmp(str str) +1300 cdecl _strlwr(str) +1301 cdecl _strnicmp(str str long) +1302 cdecl _strupr(str) +1303 cdecl _tolower(long) +1304 cdecl _toupper(long) +1305 cdecl _ui64toa(double ptr long) +1306 cdecl _ui64tow(double ptr long) +1307 cdecl _ultoa(long ptr long) +1308 cdecl _ultow(long ptr long) +1309 cdecl _vscwprintf(wstr ptr) +1310 cdecl _vsnprintf(ptr long str ptr) +1311 cdecl _vsnwprintf(ptr long wstr ptr) +1312 cdecl _wcsicmp(wstr wstr) +1313 cdecl _wcslwr(wstr) +1314 cdecl _wcsnicmp(wstr wstr long) # _wcstoui64 -@ cdecl _wcsupr(wstr) -@ cdecl _wtoi(wstr) -@ cdecl _wtoi64(wstr) -@ cdecl _wtol(wstr) -@ cdecl abs(long) -@ cdecl -arch=i386,x86_64 atan(double) -@ cdecl atoi(str) -@ cdecl atol(str) -@ cdecl bsearch(ptr ptr long long ptr) -@ cdecl ceil(double) -@ cdecl cos(double) -@ cdecl fabs(double) -@ cdecl floor(double) -@ cdecl isalnum(long) -@ cdecl isalpha(long) -@ cdecl iscntrl(long) -@ cdecl isdigit(long) -@ cdecl isgraph(long) -@ cdecl islower(long) -@ cdecl isprint(long) -@ cdecl ispunct(long) -@ cdecl isspace(long) -@ cdecl isupper(long) -@ cdecl iswalpha(long) -@ cdecl iswctype(long long) -@ cdecl iswdigit(long) -@ cdecl iswlower(long) -@ cdecl iswspace(long) -@ cdecl iswxdigit(long) -@ cdecl isxdigit(long) -@ cdecl labs(long) -@ cdecl -arch=i386,x86_64 log(double) +1316 cdecl _wcsupr(wstr) +1317 cdecl _wtoi(wstr) +1318 cdecl _wtoi64(wstr) +1319 cdecl _wtol(wstr) +1320 cdecl abs(long) +1321 cdecl -arch=i386,x86_64 atan(double) +1322 cdecl atoi(str) +1323 cdecl atol(str) +1324 cdecl bsearch(ptr ptr long long ptr) +1325 cdecl ceil(double) +1326 cdecl cos(double) +1327 cdecl fabs(double) +1328 cdecl floor(double) +1329 cdecl isalnum(long) +1330 cdecl isalpha(long) +1331 cdecl iscntrl(long) +1332 cdecl isdigit(long) +1333 cdecl isgraph(long) +1334 cdecl islower(long) +1335 cdecl isprint(long) +1336 cdecl ispunct(long) +1337 cdecl isspace(long) +1338 cdecl isupper(long) +1339 cdecl iswalpha(long) +1340 cdecl iswctype(long long) +1341 cdecl iswdigit(long) +1342 cdecl iswlower(long) +1343 cdecl iswspace(long) +1344 cdecl iswxdigit(long) +1345 cdecl isxdigit(long) +1346 cdecl labs(long) +1347 cdecl -arch=i386,x86_64 log(double) @ cdecl -arch=x86_64 longjmp(ptr) -@ cdecl mbstowcs(ptr str long) -@ cdecl memchr(ptr long long) -@ cdecl memcmp(ptr ptr long) -@ cdecl memcpy(ptr ptr long) memmove -@ cdecl memmove(ptr ptr long) -@ cdecl memset(ptr long long) -@ cdecl -arch=i386,x86_64 pow(double double) -@ cdecl qsort(ptr long long ptr) -@ cdecl sin(double) -@ varargs sprintf(ptr str) -@ cdecl -arch=i386,x86_64 sqrt(double) -@ varargs sscanf(str str) -@ cdecl strcat(str str) -@ cdecl strchr(str long) -@ cdecl strcmp(str str) -@ cdecl strcpy(ptr str) -@ cdecl strcspn(str str) -@ cdecl strlen(str) -@ cdecl strncat(str str long) -@ cdecl strncmp(str str long) -@ cdecl strncpy(ptr str long) -@ cdecl strpbrk(str str) -@ cdecl strrchr(str long) -@ cdecl strspn(str str) -@ cdecl strstr(str str) -@ cdecl strtol(str ptr long) -@ cdecl strtoul(str ptr long) -@ varargs swprintf(ptr wstr) -@ cdecl -arch=i386,x86_64 tan(double) -@ cdecl tolower(long) -@ cdecl toupper(long) -@ cdecl towlower(long) -@ cdecl towupper(long) -@ stdcall vDbgPrintEx(long long str ptr) -@ stdcall vDbgPrintExWithPrefix(str long long str ptr) -@ cdecl vsprintf(ptr str ptr) -@ cdecl wcscat(wstr wstr) -@ cdecl wcschr(wstr long) -@ cdecl wcscmp(wstr wstr) -@ cdecl wcscpy(ptr wstr) -@ cdecl wcscspn(wstr wstr) -@ cdecl wcslen(wstr) -@ cdecl wcsncat(wstr wstr long) -@ cdecl wcsncmp(wstr wstr long) -@ cdecl wcsncpy(ptr wstr long) -@ cdecl wcspbrk(wstr wstr) -@ cdecl wcsrchr(wstr long) -@ cdecl wcsspn(wstr wstr) -@ cdecl wcsstr(wstr wstr) -@ cdecl wcstol(wstr ptr long) -@ cdecl wcstombs(ptr ptr long) -@ cdecl wcstoul(wstr ptr long) +1348 cdecl mbstowcs(ptr str long) +1349 cdecl memchr(ptr long long) +1350 cdecl memcmp(ptr ptr long) +1351 cdecl memcpy(ptr ptr long) memmove +1352 cdecl memmove(ptr ptr long) +1353 cdecl memset(ptr long long) +1354 cdecl -arch=i386,x86_64 pow(double double) +1355 cdecl qsort(ptr long long ptr) +1356 cdecl sin(double) +1357 varargs sprintf(ptr str) +1358 cdecl -arch=i386,x86_64 sqrt(double) +1359 varargs sscanf(str str) +1360 cdecl strcat(str str) +1361 cdecl strchr(str long) +1362 cdecl strcmp(str str) +1363 cdecl strcpy(ptr str) +1364 cdecl strcspn(str str) +1365 cdecl strlen(str) +1366 cdecl strncat(str str long) +1367 cdecl strncmp(str str long) +1368 cdecl strncpy(ptr str long) +1369 cdecl strpbrk(str str) +1370 cdecl strrchr(str long) +1371 cdecl strspn(str str) +1372 cdecl strstr(str str) +1373 cdecl strtol(str ptr long) +1374 cdecl strtoul(str ptr long) +1375 varargs swprintf(ptr wstr) +1376 cdecl -arch=i386,x86_64 tan(double) +1377 cdecl tolower(long) +1378 cdecl toupper(long) +1379 cdecl towlower(long) +1380 cdecl towupper(long) +1381 stdcall vDbgPrintEx(long long str ptr) +1382 stdcall vDbgPrintExWithPrefix(str long long str ptr) +1383 cdecl vsprintf(ptr str ptr) +1384 cdecl wcscat(wstr wstr) +1385 cdecl wcschr(wstr long) +1386 cdecl wcscmp(wstr wstr) +1387 cdecl wcscpy(ptr wstr) +1388 cdecl wcscspn(wstr wstr) +1389 cdecl wcslen(wstr) +1390 cdecl wcsncat(wstr wstr long) +1391 cdecl wcsncmp(wstr wstr long) +1392 cdecl wcsncpy(ptr wstr long) +1393 cdecl wcspbrk(wstr wstr) +1394 cdecl wcsrchr(wstr long) +1395 cdecl wcsspn(wstr wstr) +1396 cdecl wcsstr(wstr wstr) +1397 cdecl wcstol(wstr ptr long) +1398 cdecl wcstombs(ptr ptr long) +1399 cdecl wcstoul(wstr ptr long) # FIXME: check if this is correct @ stdcall -arch=arm __dtoi64()