CsrCaptureParameterBuffer@16 CsrClientCallServer@16 CsrClientConnectToServer@0 CsrReleaseParameterBuffer@4 DbgUiContinue@8 HeapAlloc@12 HeapFree@12 LdrAccessResource@16 LdrDisableThreadCalloutsForDll@4 LdrFindResource_U@16 LdrLoadDll@16 LdrShutdownProcess@0 LdrShutdownThread@0 LdrUnloadDll@4 NtAllocateVirtualMemory@24 NtClose@4 NtCreateDirectoryObject@12 NtCreateEvent@20 NtCreateFile@44 NtCreateKey@28 NtCreateProcess@32 NtCreateSection@28 NtDelayExecution@8 NtDeviceIoControlFile@40 NtDuplicateObject@28 NtFlushBuffersFile@8 NtFlushInstructionCache@12 NtFlushVirtualMemory@16 NtFreeVirtualMemory@16 NtFsControlFile@40 NtGetContextThread@8 NtLockVirtualMemory@16 NtOpenDirectoryObject@12 NtOpenEvent@12 NtOpenFile@24 NtOpenKey@12 NtOpenProcess@16 NtOpenSection@12 NtOpenThread@16 NtProtectVirtualMemory@20 NtPulseEvent@8 NtQueryDefaultLocale@8 NtQueryDefaultUILanguage@4 NtQueryDirectoryFile@44 NtQueryInformationFile@20 NtQueryInformationProcess@20 NtQueryInformationThread@20 NtQueryObject@20 NtQuerySystemInformation@16 NtQuerySystemTime@4 NtQueryValueKey@24 NtQueryVirtualMemory@24 NtQueryVolumeInformationFile@20 NtReadFile@36 NtReadVirtualMemory@20 NtResetEvent@8 NtResumeThread@8 NtSetContextThread@8 NtSetEvent@8 NtSetInformationFile@20 NtSetInformationObject@16 NtSetInformationProcess@16 NtSetInformationThread@16 NtSetSystemInformation@12 NtSetSystemTime@8 NtSignalAndWaitForSingleObject@16 NtSuspendThread@8 NtTerminateThread@8 NtUnlockVirtualMemory@16 NtUnmapViewOfSection@8 NtWaitForMultipleObjects@20 NtWaitForSingleObject@12 NtWriteFile@36 NtWriteVirtualMemory@20 NtYieldExecution@0 RtlAcquirePebLock@0 RtlAnsiStringToUnicodeSize@4 RtlBaseProcessStartRoutine RtlCompactHeap@8 RtlCopyUnicodeString@8 RtlCreateHeap@24 RtlCreateProcessParameters@40 RtlCreateUnicodeString@8 RtlCreateUnicodeStringFromAsciiz@8 RtlDeleteCriticalSection@4 RtlDestroyHeap@4 RtlDestroyProcessParameters@4 RtlDoesFileExists_U@4 RtlDosPathNameToNtPathName_U@16 RtlDosSearchPath_U@24 RtlEnterCriticalSection@4 RtlExpandEnvironmentStrings_U@16 RtlFreeHeap@12 RtlGetCurrentDirectory_U@8 RtlGetFullPathName_U@16 RtlGetProcessHeaps@8 RtlImageNtHeader@4 RtlInitCodePageTable@8 RtlInitializeCriticalSection@4 RtlInitUnicodeString@8 RtlIntegerToChar@16 RtlIntegerToUnicodeString@12 RtlIsNameLegalDOS8Dot3@12 RtlLeaveCriticalSection@4 RtlLockHeap@4 RtlNtStatusToDosError@4 RtlOemStringToUnicodeSize@4 RtlOemStringToUnicodeString@12 RtlOpenCurrentUser@8 RtlQueryEnvironmentVariable_U@12 RtlRaiseException@4 RtlReAllocateHeap@16 RtlReleasePebLock@0 RtlRosCreateUserThreadVa RtlRosExitUserThread@4 RtlSetCurrentDirectory_U@4 RtlSetEnvironmentVariable@12 RtlSetTimeZoneInformation@4 RtlTimeFieldsToTime@8 RtlTimeToTimeFields@8 RtlUnicodeStringToAnsiSize@4 RtlUnicodeStringToAnsiString@12 RtlUnicodeStringToInteger@12 RtlUnicodeStringToOemString@12 RtlUnicodeToOemN@20 RtlUnlockHeap@4 DbgPrint LdrFindResourceDirectory_U@16 LdrGetDllHandle@16 LdrGetProcedureAddress@16 RtlCharToInteger@12 RtlUpcaseUnicodeString@12 RtlCreateTimerQueue@4 ZwAllocateVirtualMemory@24 ZwProtectVirtualMemory@20 ZwWriteVirtualMemory@20 RtlGetVersion@4 RtlVerifyVersionInfo@16 RtlNormalizeProcessParams@4 RtlDestroyEnvironment@4 NtCreateJobObject@12 NtOpenJobObject@12 NtIsProcessInJob@8 NtAssignProcessToJobObject@8 NtQueryInformationJobObject@20 NtSetInformationJobObject@16 NtTerminateJobObject@8 NtTerminateProcess@8 RtlRaiseStatus@4 RtlValidateHeap@12 RtlClearBits@12 RtlAreBitsSet@12 RtlFindClearBitsAndSet@12 NtQueueApcThread@20 NtCreateThread@32 CsrNewThread@0 CsrClientConnectToServer@20 CsrCaptureMessageBuffer@16 CsrAllocateCaptureBuffer@8 CsrFreeCaptureBuffer@4 RtlAllocateHeap@12 RtlDeleteTimerQueueEx@8 RtlDeleteTimerQueue@4 RtlCreateTimer@28 RtlDeleteTimer@12 RtlUpdateTimer@16 RtlIsTextUnicode@12 RtlCompareUnicodeString@12 RtlFindMessage@20 RtlDetermineDosPathNameType_U@4 RtlQueryProcessDebugInformation@12 RtlDestroyQueryDebugBuffer@4 RtlAllocateAndInitializeSid@44 RtlLengthSid@4 RtlCreateAcl@12 RtlAddAccessAllowedAce@16 RtlCreateSecurityDescriptor@8 RtlSetDaclSecurityDescriptor@16 RtlFreeSid@4 RtlFreeAnsiString@4 NtNotifyChangeDirectoryFile@36 NtCreateSymbolicLinkObject@16 RtlEqualUnicodeString@12 NtQueryEaFile@36 NtQueryDirectoryObject@28 NlsMbCodePageTag NlsMbOemCodePageTag RtlxUnicodeStringToOemSize@4 RtlMultiByteToUnicodeN@20 NtQueryFullAttributesFile@8 NtQuerySymbolicLinkObject@12 RtlPrefixUnicodeString@12 NtCreateIoCompletion@16 NtRemoveIoCompletion@20 NtSetIoCompletion@20 NtCancelIoFile@8 NtLockFile@40 NtUnlockFile@20 NtCreateMailslotFile@32 NtSetValueKey@24 NtCreateNamedPipeFile@56 NtSetVolumeInformationFile@20 RtlSizeHeap@12 NtQueryEvent@20 NtAddAtom@12 NtDeleteAtom@4 NtQueryPerformanceCounter@8 RtlUnwind@16 RtlInitializeCriticalSectionAndSpinCount@8 NtCreateTimer@16 NtOpenTimer@12 NtCreateMutant@16 NtQueryInstallUILanguage@4 NtClearEvent@4 NtOpenMutant@12 NtReleaseMutant@8 NtCreateSemaphore@20@12 NtOpenSemaphore@12 NtReleaseSemaphore@12 NtMapViewOfSection@40 RtlCreateQueryDebugBuffer@8 RtlInitAnsiString@8 RtlAnsiStringToUnicodeString@12 RtlFreeUnicodeString@4 NtCancelTimer@8 NtSetTimer@28 ZwMapViewOfSection@40 ZwOpenSection@12 ZwQuerySection@20 ZwQuerySystemInformation@16 ZwReadFile@36 ZwTerminateProcess@8 ZwClose@4 DbgUiIssueRemoteBreakin@4 NtOpenSymbolicLinkObject@12 RtlxUnicodeStringToAnsiSize@4 RtlOemToUnicodeN@20 RtlUnicodeToMultiByteN@20 NtFindAtom@12 NtQueryInformationAtom@20 RtlCreateAtomTable@8 RtlAddAtomToAtomTable@12 RtlDeleteAtomFromAtomTable@8 RtlLookupAtomInAtomTable@12 RtlQueryAtomInAtomTable@24 ZwOpenKey@12 ZwQueryValueKey@24 RtlQueryRegistryValues@20 RtlAppendUnicodeToString@8 @RtlUshortByteSwap@4 RtlAppendUnicodeStringToString@8 NtFlushKey@4 NtEnumerateValueKey@24 RtlUpcaseUnicodeChar@4 NtCreateSemaphore@20