1021 lines
22 KiB
Modula-2
1021 lines
22 KiB
Modula-2
;note that the Zw... functions are alternate names for the
|
|
;Nt... functions. (see www.sysinternals.com for details)
|
|
;if you change a Nt.. function DON'T FORGET to change the
|
|
;Zw one too.
|
|
|
|
LIBRARY ntdll.dll
|
|
EXPORTS
|
|
CsrAllocateCaptureBuffer@8
|
|
CsrAllocateMessagePointer@12
|
|
CsrCaptureMessageBuffer@16
|
|
CsrCaptureMessageString@20
|
|
CsrCaptureTimeout@8
|
|
CsrClientCallServer@16
|
|
CsrClientConnectToServer@24
|
|
CsrFreeCaptureBuffer@4
|
|
CsrIdentifyAlertableThread@0
|
|
CsrNewThread@0
|
|
CsrProbeForRead@12
|
|
CsrProbeForWrite@12
|
|
CsrSetPriorityClass@8
|
|
DbgBreakPoint@0
|
|
DbgPrint
|
|
DbgPrintReturnControlC
|
|
DbgPrompt@12
|
|
DbgSsHandleKmApiMsg@8
|
|
DbgSsInitialize@16
|
|
DbgUiConnectToDbg@0
|
|
DbgUiContinue@8
|
|
DbgUiWaitStateChange@8
|
|
DbgUserBreakPoint@0
|
|
KiRaiseUserExceptionDispatcher@0
|
|
KiUserApcDispatcher@20
|
|
KiUserCallbackDispatcher@12
|
|
KiUserExceptionDispatcher@8
|
|
LdrAccessResource@16
|
|
LdrAlternateResourcesEnabled@0
|
|
LdrDisableThreadCalloutsForDll@4
|
|
LdrEnumResources@20
|
|
LdrFindEntryForAddress@8
|
|
LdrFindResourceDirectory_U@16
|
|
LdrFindResource_U@16
|
|
LdrFlushAlternateResourceModules@0
|
|
LdrGetDllHandle@16
|
|
LdrGetProcedureAddress@16
|
|
LdrInitializeThunk@16
|
|
LdrLoadAlternateResourceModule@8
|
|
LdrLoadDll@16
|
|
LdrProcessRelocationBlock@16
|
|
LdrQueryImageFileExecutionOptions@24
|
|
LdrQueryProcessModuleInformation@12
|
|
LdrShutdownProcess@0
|
|
LdrShutdownThread@0
|
|
LdrUnloadAlternateResourceModule@4
|
|
LdrUnloadDll@4
|
|
LdrVerifyImageMatchesChecksum@16
|
|
NlsAnsiCodePage
|
|
NlsMbCodePageTag
|
|
NlsMbOemCodePageTag
|
|
NtAcceptConnectPort@24
|
|
NtAccessCheck@32
|
|
NtAccessCheckAndAuditAlarm@44
|
|
NtAccessCheckByType@44
|
|
NtAccessCheckByTypeAndAuditAlarm@64
|
|
NtAccessCheckByTypeResultList@44
|
|
NtAccessCheckByTypeResultListAndAuditAlarm@64
|
|
NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
|
|
NtAddAtom@12
|
|
NtAdjustGroupsToken@24
|
|
NtAdjustPrivilegesToken@24
|
|
NtAlertResumeThread@8
|
|
NtAlertThread@4
|
|
NtAllocateLocallyUniqueId@4
|
|
NtAllocateUserPhysicalPages@12
|
|
NtAllocateUuids@16
|
|
NtAllocateVirtualMemory@24
|
|
NtAreMappedFilesTheSame@8
|
|
NtAssignProcessToJobObject@8
|
|
NtCallbackReturn@12
|
|
NtCancelDeviceWakeupRequest@4
|
|
NtCancelIoFile@8
|
|
NtCancelTimer@8
|
|
NtClearEvent@4
|
|
NtClose@4
|
|
NtCloseObjectAuditAlarm@12
|
|
NtCompleteConnectPort@4
|
|
NtConnectPort@32
|
|
NtContinue@8
|
|
NtCreateDirectoryObject@12
|
|
NtCreateEvent@20
|
|
NtCreateEventPair@12
|
|
NtCreateFile@44
|
|
NtCreateIoCompletion@16
|
|
NtCreateJobObject@12
|
|
NtCreateKey@28
|
|
NtCreateMailslotFile@32
|
|
NtCreateMutant@16
|
|
NtCreateNamedPipeFile@56
|
|
NtCreatePagingFile@16
|
|
NtCreatePort@20
|
|
NtCreateProcess@32
|
|
NtCreateProfile@36
|
|
NtCreateSection@28
|
|
NtCreateSemaphore@20
|
|
NtCreateSymbolicLinkObject@16
|
|
NtCreateThread@32
|
|
NtCreateTimer@16
|
|
NtCreateToken@52
|
|
NtCreateWaitablePort@20
|
|
NtDelayExecution@8
|
|
NtDeleteAtom@4
|
|
NtDeleteFile@4
|
|
NtDeleteKey@4
|
|
NtDeleteObjectAuditAlarm@12
|
|
NtDeleteValueKey@8
|
|
NtDeviceIoControlFile@40
|
|
NtDisplayString@4
|
|
NtDuplicateObject@28
|
|
NtDuplicateToken@24
|
|
NtEnumerateKey@24
|
|
NtEnumerateValueKey@24
|
|
NtExtendSection@8
|
|
NtFilterToken@24
|
|
NtFindAtom@12
|
|
NtFlushBuffersFile@8
|
|
NtFlushInstructionCache@12
|
|
NtFlushKey@4
|
|
NtFlushVirtualMemory@16
|
|
NtFlushWriteBuffer@0
|
|
NtFreeUserPhysicalPages@12
|
|
NtFreeVirtualMemory@16
|
|
NtFsControlFile@40
|
|
NtGetContextThread@8
|
|
NtGetDevicePowerState@8
|
|
NtGetPlugPlayEvent@16
|
|
NtGetTickCount@0
|
|
NtGetWriteWatch@28
|
|
NtImpersonateAnonymousToken@8
|
|
NtImpersonateClientOfPort@8
|
|
NtImpersonateThread@12
|
|
NtInitializeRegistry@4
|
|
NtInitiatePowerAction@16
|
|
NtIsSystemResumeAutomatic@0
|
|
NtListenPort@8
|
|
NtLoadDriver@4
|
|
NtLoadKey@8
|
|
NtLoadKey2@12
|
|
NtLockFile@40
|
|
NtLockVirtualMemory@16
|
|
NtMakeTemporaryObject@4
|
|
NtMapUserPhysicalPages@12
|
|
NtMapUserPhysicalPagesScatter@12
|
|
NtMapViewOfSection@40
|
|
NtNotifyChangeDirectoryFile@36
|
|
NtNotifyChangeKey@40
|
|
NtNotifyChangeMultipleKeys@48
|
|
NtOpenDirectoryObject@12
|
|
NtOpenEvent@12
|
|
NtOpenEventPair@12
|
|
NtOpenFile@24
|
|
NtOpenIoCompletion@12
|
|
NtOpenJobObject@12
|
|
NtOpenKey@12
|
|
NtOpenMutant@12
|
|
NtOpenObjectAuditAlarm@48
|
|
NtOpenProcess@16
|
|
NtOpenProcessToken@12
|
|
NtOpenSection@12
|
|
NtOpenSemaphore@12
|
|
NtOpenSymbolicLinkObject@12
|
|
NtOpenThread@16
|
|
NtOpenThreadToken@16
|
|
NtOpenTimer@12
|
|
NtPlugPlayControl@12
|
|
NtPowerInformation@20
|
|
NtPrivilegeCheck@12
|
|
NtPrivilegedServiceAuditAlarm@20
|
|
NtPrivilegeObjectAuditAlarm@24
|
|
NtProtectVirtualMemory@20
|
|
NtPulseEvent@8
|
|
NtQueryAttributesFile@8
|
|
NtQueryDefaultLocale@8
|
|
NtQueryDefaultUILanguage@4
|
|
NtQueryDirectoryFile@44
|
|
NtQueryDirectoryObject@28
|
|
NtQueryEaFile@36
|
|
NtQueryEvent@20
|
|
NtQueryFullAttributesFile@8
|
|
NtQueryInformationAtom@20
|
|
NtQueryInformationFile@20
|
|
NtQueryInformationJobObject@20
|
|
NtQueryInformationPort@20
|
|
NtQueryInformationProcess@20
|
|
NtQueryInformationThread@20
|
|
NtQueryInformationToken@20
|
|
NtQueryInstallUILanguage@4
|
|
NtQueryIntervalProfile@8
|
|
NtQueryIoCompletion@20
|
|
NtQueryKey@20
|
|
NtQueryMultipleValueKey@24
|
|
NtQueryMutant@20
|
|
NtQueryObject@20
|
|
NtQueryOpenSubKeys@8
|
|
NtQueryPerformanceCounter@8
|
|
NtQueryQuotaInformationFile@36
|
|
NtQuerySection@20
|
|
NtQuerySecurityObject@20
|
|
NtQuerySemaphore@20
|
|
NtQuerySymbolicLinkObject@12
|
|
NtQuerySystemEnvironmentValue@16
|
|
NtQuerySystemInformation@16
|
|
NtQuerySystemTime@4
|
|
NtQueryTimer@20
|
|
NtQueryTimerResolution@12
|
|
NtQueryValueKey@24
|
|
NtQueryVirtualMemory@24
|
|
NtQueryVolumeInformationFile@20
|
|
NtQueueApcThread@20
|
|
NtRaiseException@12
|
|
NtRaiseHardError@24
|
|
NtReadFile@36
|
|
NtReadFileScatter@36
|
|
NtReadRequestData@24
|
|
NtReadVirtualMemory@20
|
|
NtRegisterThreadTerminatePort@4
|
|
NtReleaseMutant@8
|
|
NtReleaseSemaphore@12
|
|
NtRemoveIoCompletion@20
|
|
NtReplaceKey@12
|
|
NtReplyPort@8
|
|
NtReplyWaitReceivePort@16
|
|
NtReplyWaitReceivePortEx@20
|
|
NtReplyWaitReplyPort@8
|
|
NtRequestDeviceWakeup@4
|
|
NtRequestPort@8
|
|
NtRequestWaitReplyPort@12
|
|
NtRequestWakeupLatency@4
|
|
NtResetEvent@8
|
|
NtResetWriteWatch@12
|
|
NtRestoreKey@12
|
|
NtResumeThread@8
|
|
NtSaveKey@8
|
|
NtSaveMergedKeys@12
|
|
NtSecureConnectPort@36
|
|
NtSetContextThread@8
|
|
NtSetDefaultHardErrorPort@4
|
|
NtSetDefaultLocale@8
|
|
NtSetDefaultUILanguage@4
|
|
NtSetEaFile@16
|
|
NtSetEvent@8
|
|
NtSetHighEventPair@4
|
|
NtSetHighWaitLowEventPair@4
|
|
NtSetInformationFile@20
|
|
NtSetInformationJobObject@16
|
|
NtSetInformationKey@16
|
|
NtSetInformationObject@16
|
|
NtSetInformationProcess@16
|
|
NtSetInformationThread@16
|
|
NtSetInformationToken@16
|
|
NtSetIntervalProfile@8
|
|
NtSetIoCompletion@20
|
|
NtSetLdtEntries@16
|
|
NtSetLowEventPair@4
|
|
NtSetLowWaitHighEventPair@4
|
|
NtSetQuotaInformationFile@16
|
|
NtSetSecurityObject@12
|
|
NtSetSystemEnvironmentValue@8
|
|
NtSetSystemInformation@12
|
|
NtSetSystemPowerState@12
|
|
NtSetSystemTime@8
|
|
NtSetThreadExecutionState@8
|
|
NtSetTimer@28
|
|
NtSetTimerResolution@12
|
|
NtSetUuidSeed@4
|
|
NtSetValueKey@24
|
|
NtSetVolumeInformationFile@20
|
|
NtShutdownSystem@4
|
|
NtSignalAndWaitForSingleObject@16
|
|
NtStartProfile@4
|
|
NtStopProfile@4
|
|
NtSuspendThread@8
|
|
NtSystemDebugControl@24
|
|
NtTerminateJobObject@8
|
|
NtTerminateProcess@8
|
|
NtTerminateThread@8
|
|
NtTestAlert@0
|
|
NtUnloadDriver@4
|
|
NtUnloadKey@4
|
|
NtUnlockFile@20
|
|
NtUnlockVirtualMemory@16
|
|
NtUnmapViewOfSection@8
|
|
NtVdmControl@8
|
|
NtWaitForMultipleObjects@20
|
|
NtWaitForSingleObject@12
|
|
NtWaitHighEventPair@4
|
|
NtWaitLowEventPair@4
|
|
NtWriteFile@36
|
|
NtWriteFileGather@36
|
|
NtWriteRequestData@24
|
|
NtWriteVirtualMemory@20
|
|
NtYieldExecution@0
|
|
RtlAbortRXact@4
|
|
RtlAbsoluteToSelfRelativeSD@12
|
|
RtlAcquirePebLock@0
|
|
RtlAcquireResourceExclusive@8
|
|
RtlAcquireResourceShared@8
|
|
RtlAddAccessAllowedAce@16
|
|
RtlAddAccessAllowedAceEx@20
|
|
RtlAddAccessAllowedObjectAce@28
|
|
RtlAddAccessDeniedAce@16
|
|
RtlAddAccessDeniedAceEx@20
|
|
RtlAddAccessDeniedObjectAce@28
|
|
RtlAddAce@20
|
|
RtlAddActionToRXact@24
|
|
RtlAddAtomToAtomTable@12
|
|
RtlAddAttributeActionToRXact@32
|
|
RtlAddAuditAccessAce@24
|
|
RtlAddAuditAccessAceEx@28
|
|
RtlAddAuditAccessObjectAce@36
|
|
RtlAddCompoundAce@24
|
|
RtlAddRange@36
|
|
RtlAdjustPrivilege@16
|
|
RtlAllocateAndInitializeSid@44
|
|
RtlAllocateHandle@8
|
|
RtlAllocateHeap@12
|
|
RtlAnsiCharToUnicodeChar@4
|
|
RtlAnsiStringToUnicodeSize@4
|
|
RtlAnsiStringToUnicodeString@12
|
|
RtlAppendAsciizToString@8
|
|
RtlAppendStringToString@8
|
|
RtlAppendUnicodeStringToString@8
|
|
RtlAppendUnicodeToString@8
|
|
RtlApplyRXact@4
|
|
RtlApplyRXactNoFlush@4
|
|
RtlAreAllAccessesGranted@8
|
|
RtlAreAnyAccessesGranted@8
|
|
RtlAreBitsClear@12
|
|
RtlAreBitsSet@12
|
|
RtlAssert@16
|
|
RtlCallbackLpcClient@12
|
|
RtlCancelTimer@8
|
|
RtlCaptureStackBackTrace@16
|
|
RtlCharToInteger@12
|
|
RtlCheckForOrphanedCriticalSections@4
|
|
RtlCheckRegistryKey@8
|
|
RtlClearAllBits@4
|
|
RtlClearBits@12
|
|
RtlCompactHeap@8
|
|
RtlCompareMemory@12
|
|
RtlCompareMemoryUlong@12
|
|
RtlCompareString@12
|
|
RtlCompareUnicodeString@12
|
|
RtlCompressBuffer@32
|
|
RtlConsoleMultiByteToUnicodeN@24
|
|
RtlConvertExclusiveToShared@4
|
|
RtlConvertSharedToExclusive@4
|
|
RtlConvertSidToUnicodeString@12
|
|
RtlConvertToAutoInheritSecurityObject@24
|
|
RtlConvertUiListToApiList@12
|
|
RtlConvertUlongToLargeInteger@4
|
|
RtlConvertVariantToProperty@28
|
|
RtlCopyLuid@8
|
|
RtlCopyLuidAndAttributesArray@12
|
|
RtlCopyRangeList@8
|
|
RtlCopySecurityDescriptor@8
|
|
RtlCopySid@12
|
|
RtlCopySidAndAttributesArray@28
|
|
RtlCopyString@8
|
|
RtlCopyUnicodeString@8
|
|
RtlCreateAcl@12
|
|
RtlCreateAndSetSD@20
|
|
RtlCreateAtomTable@8
|
|
RtlCreateEnvironment@8
|
|
RtlCreateHeap@24
|
|
RtlCreateLpcServer@24
|
|
RtlCreateProcessParameters@40
|
|
RtlCreateQueryDebugBuffer@8
|
|
RtlCreateRegistryKey@8
|
|
RtlCreateSecurityDescriptor@8
|
|
RtlCreateTagHeap@16
|
|
RtlCreateTimer@28
|
|
RtlCreateTimerQueue@4
|
|
RtlCreateUnicodeString@8
|
|
RtlCreateUnicodeStringFromAsciiz@8
|
|
RtlCreateUserProcess@40
|
|
RtlCreateUserThread@40
|
|
RtlCustomCPToUnicodeN@24
|
|
RtlCutoverTimeToSystemTime@16
|
|
RtlDebugPrintTimes@0
|
|
RtlDecompressBuffer@24
|
|
RtlDecompressFragment@32
|
|
RtlDefaultNpAcl@4
|
|
RtlDelete@4
|
|
RtlDeleteAce@8
|
|
RtlDeleteAtomFromAtomTable@8
|
|
RtlDeleteCriticalSection@4
|
|
RtlDeleteElementGenericTable@8
|
|
RtlDeleteNoSplay@8
|
|
RtlDeleteOwnersRanges@8
|
|
RtlDeleteRange@24
|
|
RtlDeleteResource@4
|
|
RtlDeleteSecurityObject@4
|
|
RtlDeleteTimer@12
|
|
RtlDeleteTimerQueue@4
|
|
RtlDeleteTimerQueueEx@8
|
|
RtlDeNormalizeProcessParams@4
|
|
RtlDeregisterWait@4
|
|
RtlDeregisterWaitEx@8
|
|
RtlDestroyAtomTable@4
|
|
RtlDestroyEnvironment@4
|
|
RtlDestroyHandleTable@4
|
|
RtlDestroyHeap@4
|
|
RtlDestroyProcessParameters@4
|
|
RtlDestroyQueryDebugBuffer@4
|
|
RtlDetermineDosPathNameType_U@4
|
|
RtlDoesFileExists_U@4
|
|
RtlDosPathNameToNtPathName_U@16
|
|
RtlDosSearchPath_U@24
|
|
RtlDowncaseUnicodeString@12
|
|
RtlEmptyAtomTable@8
|
|
RtlEnableEarlyCriticalSectionEventCreation@0
|
|
RtlEnlargedIntegerMultiply@8
|
|
RtlEnlargedUnsignedDivide@16
|
|
RtlEnlargedUnsignedMultiply@8
|
|
RtlEnterCriticalSection@4
|
|
RtlEnumerateGenericTable@8
|
|
RtlEnumerateGenericTableWithoutSplaying@8
|
|
RtlEnumProcessHeaps@8
|
|
RtlEqualComputerName@8
|
|
RtlEqualDomainName@8
|
|
RtlEqualLuid@8
|
|
RtlEqualPrefixSid@8
|
|
RtlEqualSid@8
|
|
RtlEqualString@12
|
|
RtlEqualUnicodeString@12
|
|
RtlEraseUnicodeString@4
|
|
RtlExpandEnvironmentStrings_U@16
|
|
RtlExtendedLargeIntegerDivide@16
|
|
RtlExtendedMagicDivide@20
|
|
RtlExtendHeap@16
|
|
RtlFillMemory@12
|
|
RtlFillMemoryUlong@12
|
|
RtlFindClearBits@12
|
|
RtlFindClearBitsAndSet@12
|
|
RtlFindLeastSignificantBit@8
|
|
RtlFindLongestRunClear@8
|
|
RtlFindLongestRunSet@8
|
|
RtlFindMessage@20
|
|
RtlFindMostSignificantBit@8
|
|
RtlFindNextForwardRunClear@12
|
|
RtlFindRange@48
|
|
RtlFindSetBits@12
|
|
RtlFindSetBitsAndClear@12
|
|
RtlFirstFreeAce@8
|
|
RtlFormatCurrentUserKeyPath@4
|
|
RtlFormatMessage@36
|
|
RtlFreeAnsiString@4
|
|
RtlFreeHandle@8
|
|
RtlFreeHeap@12
|
|
RtlFreeOemString@4
|
|
RtlFreeSid@4
|
|
RtlFreeUnicodeString@4
|
|
RtlFreeUserThreadStack@8
|
|
RtlGenerate8dot3Name@16
|
|
RtlGetAce@12
|
|
RtlGetCallersAddress@8
|
|
RtlGetCompressionWorkSpaceSize@12
|
|
RtlGetControlSecurityDescriptor@12
|
|
RtlGetCurrentDirectory_U@8
|
|
RtlGetDaclSecurityDescriptor@16
|
|
RtlGetElementGenericTable@8
|
|
RtlGetFirstRange@12
|
|
RtlGetFullPathName_U@16
|
|
RtlGetGroupSecurityDescriptor@12
|
|
RtlGetLongestNtPathLength@0
|
|
RtlGetNextRange@12
|
|
RtlGetNtGlobalFlags@0
|
|
RtlGetNtProductType@4
|
|
RtlGetOwnerSecurityDescriptor@12
|
|
RtlGetProcessHeaps@8
|
|
RtlGetSaclSecurityDescriptor@16
|
|
RtlGetSecurityDescriptorRMControl@8
|
|
RtlGetUserInfoHeap@20
|
|
RtlGetVersion@4
|
|
RtlGUIDFromString@8
|
|
RtlIdentifierAuthoritySid@4
|
|
RtlImageDirectoryEntryToData@16
|
|
RtlImageNtHeader@4
|
|
RtlImageRvaToSection@12
|
|
RtlImageRvaToVa@16
|
|
RtlImpersonateLpcClient@8
|
|
RtlImpersonateSelf@4
|
|
RtlInitAnsiString@8
|
|
RtlInitCodePageTable@8
|
|
RtlInitNlsTables@16
|
|
RtlInitString@8
|
|
RtlInitUnicodeString@8
|
|
RtlInitializeAtomPackage@4
|
|
RtlInitializeBitMap@12
|
|
RtlInitializeContext@20
|
|
RtlInitializeCriticalSection@4
|
|
RtlInitializeCriticalSectionAndSpinCount@8
|
|
RtlInitializeGenericTable@20
|
|
RtlInitializeHandleTable@12
|
|
RtlInitializeRXact@12
|
|
RtlInitializeRangeList@4
|
|
RtlInitializeResource@4
|
|
RtlInitializeSid@12
|
|
RtlInsertElementGenericTable@16
|
|
RtlIntegerToChar@16
|
|
RtlIntegerToUnicodeString@12
|
|
RtlInvertRangeList@8
|
|
RtlIsDosDeviceName_U@4
|
|
RtlIsNameLegalDOS8Dot3@12
|
|
RtlIsRangeAvailable@40
|
|
RtlIsTextUnicode@12
|
|
RtlIsValidHandle@8
|
|
RtlIsValidIndexHandle@12
|
|
RtlLargeIntegerAdd@16
|
|
RtlLargeIntegerArithmeticShift@12
|
|
RtlLargeIntegerDivide@20
|
|
RtlLargeIntegerNegate@8
|
|
RtlLargeIntegerShiftLeft@12
|
|
RtlLargeIntegerShiftRight@12
|
|
RtlLargeIntegerSubtract@16
|
|
RtlLargeIntegerToChar@16
|
|
RtlLeaveCriticalSection@4
|
|
RtlLengthRequiredSid@4
|
|
RtlLengthSecurityDescriptor@4
|
|
RtlLengthSid@4
|
|
RtlLocalTimeToSystemTime@8
|
|
RtlLockHeap@4
|
|
RtlLookupAtomInAtomTable@12
|
|
RtlLookupElementGenericTable@8
|
|
RtlMakeSelfRelativeSD@12
|
|
RtlMapGenericMask@8
|
|
RtlMergeRangeLists@16
|
|
RtlMoveMemory@12
|
|
RtlMultiByteToUnicodeN@20
|
|
RtlMultiByteToUnicodeSize@12
|
|
RtlNewInstanceSecurityObject@40
|
|
RtlNewSecurityGrantedAccess@24
|
|
RtlNewSecurityObject@24
|
|
RtlNewSecurityObjectEx@32
|
|
RtlNormalizeProcessParams@4
|
|
RtlNtStatusToDosError@4
|
|
RtlNumberGenericTableElements@4
|
|
RtlNumberOfClearBits@4
|
|
RtlNumberOfSetBits@4
|
|
RtlOemStringToUnicodeSize@4
|
|
RtlOemStringToUnicodeString@12
|
|
RtlOemToUnicodeN@12
|
|
RtlOpenCurrentUser@8
|
|
RtlPcToFileHeader@8
|
|
RtlPinAtomInAtomTable@8
|
|
RtlPrefixString@12
|
|
RtlPrefixUnicodeString@12
|
|
RtlProtectHeap@8
|
|
RtlQueryAtomInAtomTable@24
|
|
RtlQueryEnvironmentVariable_U@12
|
|
RtlQueryInformationAcl@16
|
|
RtlQueryProcessBackTraceInformation@4
|
|
RtlQueryProcessDebugInformation@12
|
|
RtlQueryProcessHeapInformation@4
|
|
RtlQueryProcessLockInformation@4
|
|
RtlQueryRegistryValues@20
|
|
RtlQuerySecurityObject@20
|
|
RtlQueryTagHeap@20
|
|
RtlQueryTimeZoneInformation@4
|
|
RtlQueueWorkItem@12
|
|
RtlRaiseException@4
|
|
RtlRaiseStatus@4
|
|
RtlReAllocateHeap@16
|
|
RtlRealPredecessor@4
|
|
RtlRegisterWait@24
|
|
RtlReleasePebLock@0
|
|
RtlReleaseResource@4
|
|
RtlRemoteCall@28
|
|
RtlResetRtlTranslations@4
|
|
RtlRunDecodeUnicodeString@8
|
|
RtlRunEncodeUnicodeString@8
|
|
RtlSecondsSince1970ToTime@8
|
|
RtlSecondsSince1980ToTime@8
|
|
RtlSelfRelativeToAbsoluteSD2@8
|
|
RtlSelfRelativeToAbsoluteSD@44
|
|
RtlSetAllBits@4
|
|
RtlSetAttributesSecurityDescriptor@12
|
|
RtlSetBits@12
|
|
RtlSetControlSecurityDescriptor@12
|
|
RtlSetCriticalSectionSpinCount@8
|
|
RtlSetCurrentDirectory_U@4
|
|
RtlSetCurrentEnvironment@8
|
|
RtlSetDaclSecurityDescriptor@16
|
|
RtlSetEnvironmentVariable@12
|
|
RtlSetGroupSecurityDescriptor@12
|
|
RtlSetInformationAcl@16
|
|
RtlSetIoCompletionCallback@12
|
|
RtlSetOwnerSecurityDescriptor@12
|
|
RtlSetSaclSecurityDescriptor@16
|
|
RtlSetSecurityDescriptorRMControl@8
|
|
RtlSetSecurityObject@20
|
|
RtlSetSecurityObjectEx@24
|
|
RtlSetThreadPoolStartFunc@8
|
|
RtlSetTimeZoneInformation@4
|
|
RtlSetTimer@28
|
|
RtlSetUnicodeCallouts@4
|
|
RtlSetUserFlagsHeap@20
|
|
RtlSetUserValueHeap@16
|
|
RtlShutdownLpcServer@4
|
|
RtlSizeHeap@12
|
|
RtlSplay@4
|
|
RtlStartRXact@4
|
|
RtlStringFromGUID@8
|
|
RtlSubAuthorityCountSid@4
|
|
RtlSubAuthoritySid@8
|
|
RtlSubtreePredecessor@4
|
|
RtlSubtreeSuccessor@4
|
|
RtlSystemTimeToLocalTime@8
|
|
RtlTimeFieldsToTime@8
|
|
RtlTimeToElapsedTimeFields@8
|
|
RtlTimeToSecondsSince1970@8
|
|
RtlTimeToSecondsSince1980@8
|
|
RtlTimeToTimeFields@8
|
|
RtlTraceDatabaseAdd@16
|
|
RtlTraceDatabaseCreate@20
|
|
RtlTraceDatabaseDestroy@4
|
|
RtlTraceDatabaseEnumerate@12
|
|
RtlTraceDatabaseFind@16
|
|
RtlTraceDatabaseLock@4
|
|
RtlTraceDatabaseUnlock@4
|
|
RtlTraceDatabaseValidate@4
|
|
RtlTryEnterCriticalSection@4
|
|
RtlUlongByteSwap@4
|
|
RtlUlonglongByteSwap@4
|
|
RtlUnicodeStringToAnsiSize@4
|
|
RtlUnicodeStringToAnsiString@12
|
|
RtlUnicodeStringToCountedOemString@12
|
|
RtlUnicodeStringToInteger@12
|
|
RtlUnicodeStringToOemSize@4
|
|
RtlUnicodeStringToOemString@12
|
|
RtlUnicodeToMultiByteN@20
|
|
RtlUnicodeToMultiByteSize@12
|
|
RtlUnicodeToOemN@20
|
|
RtlUniform@4
|
|
RtlUnlockHeap@4
|
|
RtlUpcaseUnicodeChar@4
|
|
RtlUpcaseUnicodeString@12
|
|
RtlUpcaseUnicodeStringToAnsiString@12
|
|
RtlUpcaseUnicodeStringToCountedOemString@12
|
|
RtlUpcaseUnicodeStringToOemString@12
|
|
RtlUpcaseUnicodeToCustomCPN@24
|
|
RtlUpcaseUnicodeToMultiByteN@20
|
|
RtlUpcaseUnicodeToOemN@20
|
|
RtlUpdateTimer@16
|
|
RtlUpperChar@4
|
|
RtlUpperString@12
|
|
RtlUsageHeap@12
|
|
RtlUshortByteSwap@4
|
|
RtlValidAcl@4
|
|
RtlValidRelativeSecurityDescriptor@12
|
|
RtlValidSecurityDescriptor@4
|
|
RtlValidSid@4
|
|
RtlValidateHeap@12
|
|
RtlValidateProcessHeaps@0
|
|
RtlVerifyVersionInfo@16
|
|
RtlWalkFrameChain@12
|
|
RtlWalkHeap@8
|
|
RtlWriteRegistryValue@24
|
|
RtlZeroHeap@8
|
|
RtlZeroMemory@8
|
|
RtlpNtCreateKey@24
|
|
RtlpNtEnumerateSubKey@16
|
|
RtlpNtMakeTemporaryKey@4
|
|
RtlpNtOpenKey@16
|
|
RtlpNtQueryValueKey@20
|
|
RtlpNtSetValueKey@16
|
|
RtlpUnWaitCriticalSection@4
|
|
RtlpWaitForCriticalSection@4
|
|
RtlxAnsiStringToUnicodeSize@4
|
|
RtlxOemStringToUnicodeSize@4
|
|
RtlxUnicodeStringToAnsiSize@4
|
|
RtlxUnicodeStringToOemSize@4
|
|
ZwAcceptConnectPort@24
|
|
ZwAccessCheck@32
|
|
ZwAccessCheckAndAuditAlarm@44
|
|
ZwAccessCheckByType@44
|
|
ZwAccessCheckByTypeAndAuditAlarm@64
|
|
ZwAccessCheckByTypeResultList@44
|
|
ZwAccessCheckByTypeResultListAndAuditAlarm@64
|
|
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
|
|
ZwAddAtom@12
|
|
ZwAdjustGroupsToken@24
|
|
ZwAdjustPrivilegesToken@24
|
|
ZwAlertResumeThread@8
|
|
ZwAlertThread@4
|
|
ZwAllocateLocallyUniqueId@4
|
|
ZwAllocateUserPhysicalPages@12
|
|
ZwAllocateUuids@16
|
|
ZwAllocateVirtualMemory@24
|
|
ZwAreMappedFilesTheSame@8
|
|
ZwAssignProcessToJobObject@8
|
|
ZwCallbackReturn@12
|
|
ZwCancelDeviceWakeupRequest@4
|
|
ZwCancelIoFile@8
|
|
ZwCancelTimer@8
|
|
ZwClearEvent@4
|
|
ZwClose@4
|
|
ZwCloseObjectAuditAlarm@12
|
|
ZwCompleteConnectPort@4
|
|
ZwConnectPort@32
|
|
ZwContinue@8
|
|
ZwCreateDirectoryObject@12
|
|
ZwCreateEvent@20
|
|
ZwCreateEventPair@12
|
|
ZwCreateFile@44
|
|
ZwCreateIoCompletion@16
|
|
ZwCreateJobObject@12
|
|
ZwCreateKey@28
|
|
ZwCreateMailslotFile@32
|
|
ZwCreateMutant@16
|
|
ZwCreateNamedPipeFile@56
|
|
ZwCreatePagingFile@16
|
|
ZwCreatePort@20
|
|
ZwCreateProcess@32
|
|
ZwCreateProfile@36
|
|
ZwCreateSection@28
|
|
ZwCreateSemaphore@20
|
|
ZwCreateSymbolicLinkObject@16
|
|
ZwCreateThread@32
|
|
ZwCreateTimer@16
|
|
ZwCreateToken@52
|
|
ZwCreateWaitablePort@20
|
|
ZwDelayExecution@8
|
|
ZwDeleteAtom@4
|
|
ZwDeleteFile@4
|
|
ZwDeleteKey@4
|
|
ZwDeleteObjectAuditAlarm@12
|
|
ZwDeleteValueKey@8
|
|
ZwDeviceIoControlFile@40
|
|
ZwDisplayString@4
|
|
ZwDuplicateObject@28
|
|
ZwDuplicateToken@24
|
|
ZwEnumerateKey@24
|
|
ZwEnumerateValueKey@24
|
|
ZwExtendSection@8
|
|
ZwFilterToken@24
|
|
ZwFindAtom@12
|
|
ZwFlushBuffersFile@8
|
|
ZwFlushInstructionCache@12
|
|
ZwFlushKey@4
|
|
ZwFlushVirtualMemory@16
|
|
ZwFlushWriteBuffer@0
|
|
ZwFreeUserPhysicalPages@12
|
|
ZwFreeVirtualMemory@16
|
|
ZwFsControlFile@40
|
|
ZwGetContextThread@8
|
|
ZwGetDevicePowerState@8
|
|
ZwGetPlugPlayEvent@16
|
|
ZwGetTickCount@0
|
|
ZwGetWriteWatch@28
|
|
ZwImpersonateAnonymousToken@8
|
|
ZwImpersonateClientOfPort@8
|
|
ZwImpersonateThread@12
|
|
ZwInitializeRegistry@4
|
|
ZwInitiatePowerAction@16
|
|
ZwIsSystemResumeAutomatic@0
|
|
ZwListenPort@8
|
|
ZwLoadDriver@4
|
|
ZwLoadKey@8
|
|
ZwLoadKey2@12
|
|
ZwLockFile@40
|
|
ZwLockVirtualMemory@16
|
|
ZwMakeTemporaryObject@4
|
|
ZwMapUserPhysicalPages@12
|
|
ZwMapUserPhysicalPagesScatter@12
|
|
ZwMapViewOfSection@40
|
|
ZwNotifyChangeDirectoryFile@36
|
|
ZwNotifyChangeKey@40
|
|
ZwNotifyChangeMultipleKeys@48
|
|
ZwOpenDirectoryObject@12
|
|
ZwOpenEvent@12
|
|
ZwOpenEventPair@12
|
|
ZwOpenFile@24
|
|
ZwOpenIoCompletion@12
|
|
ZwOpenJobObject@12
|
|
ZwOpenKey@12
|
|
ZwOpenMutant@12
|
|
ZwOpenObjectAuditAlarm@48
|
|
ZwOpenProcess@16
|
|
ZwOpenProcessToken@12
|
|
ZwOpenSection@12
|
|
ZwOpenSemaphore@12
|
|
ZwOpenSymbolicLinkObject@12
|
|
ZwOpenThread@16
|
|
ZwOpenThreadToken@16
|
|
ZwOpenTimer@12
|
|
ZwPlugPlayControl@12
|
|
ZwPowerInformation@20
|
|
ZwPrivilegeCheck@12
|
|
ZwPrivilegedServiceAuditAlarm@20
|
|
ZwPrivilegeObjectAuditAlarm@24
|
|
ZwProtectVirtualMemory@20
|
|
ZwPulseEvent@8
|
|
ZwQueryAttributesFile@8
|
|
ZwQueryDefaultLocale@8
|
|
ZwQueryDefaultUILanguage@4
|
|
ZwQueryDirectoryFile@44
|
|
ZwQueryDirectoryObject@28
|
|
ZwQueryEaFile@36
|
|
ZwQueryEvent@20
|
|
ZwQueryFullAttributesFile@8
|
|
ZwQueryInformationAtom@20
|
|
ZwQueryInformationFile@20
|
|
ZwQueryInformationJobObject@20
|
|
ZwQueryInformationPort@20
|
|
ZwQueryInformationProcess@20
|
|
ZwQueryInformationThread@20
|
|
ZwQueryInformationToken@20
|
|
ZwQueryInstallUILanguage@4
|
|
ZwQueryIntervalProfile@8
|
|
ZwQueryIoCompletion@20
|
|
ZwQueryKey@20
|
|
ZwQueryMultipleValueKey@24
|
|
ZwQueryMutant@20
|
|
ZwQueryObject@20
|
|
ZwQueryOpenSubKeys@8
|
|
ZwQueryPerformanceCounter@8
|
|
ZwQueryQuotaInformationFile@36
|
|
ZwQuerySection@20
|
|
ZwQuerySecurityObject@20
|
|
ZwQuerySemaphore@20
|
|
ZwQuerySymbolicLinkObject@12
|
|
ZwQuerySystemEnvironmentValue@16
|
|
ZwQuerySystemInformation@16
|
|
ZwQuerySystemTime@4
|
|
ZwQueryTimer@20
|
|
ZwQueryTimerResolution@12
|
|
ZwQueryValueKey@24
|
|
ZwQueryVirtualMemory@24
|
|
ZwQueryVolumeInformationFile@20
|
|
ZwQueueApcThread@20
|
|
ZwRaiseException@12
|
|
ZwRaiseHardError@24
|
|
ZwReadFile@36
|
|
ZwReadFileScatter@36
|
|
ZwReadRequestData@24
|
|
ZwReadVirtualMemory@20
|
|
ZwRegisterThreadTerminatePort@4
|
|
ZwReleaseMutant@8
|
|
ZwReleaseSemaphore@12
|
|
ZwRemoveIoCompletion@20
|
|
ZwReplaceKey@12
|
|
ZwReplyPort@8
|
|
ZwReplyWaitReceivePort@16
|
|
ZwReplyWaitReceivePortEx@20
|
|
ZwReplyWaitReplyPort@8
|
|
ZwRequestDeviceWakeup@4
|
|
ZwRequestPort@8
|
|
ZwRequestWaitReplyPort@12
|
|
ZwRequestWakeupLatency@4
|
|
ZwResetEvent@8
|
|
ZwResetWriteWatch@12
|
|
ZwRestoreKey@12
|
|
ZwResumeThread@8
|
|
ZwSaveKey@8
|
|
ZwSaveMergedKeys@12
|
|
ZwSecureConnectPort@36
|
|
ZwSetContextThread@8
|
|
ZwSetDefaultHardErrorPort@4
|
|
ZwSetDefaultLocale@8
|
|
ZwSetDefaultUILanguage@4
|
|
ZwSetEaFile@16
|
|
ZwSetEvent@8
|
|
ZwSetHighEventPair@4
|
|
ZwSetHighWaitLowEventPair@4
|
|
ZwSetInformationFile@20
|
|
ZwSetInformationJobObject@16
|
|
ZwSetInformationKey@16
|
|
ZwSetInformationObject@16
|
|
ZwSetInformationProcess@16
|
|
ZwSetInformationThread@16
|
|
ZwSetInformationToken@16
|
|
ZwSetIntervalProfile@8
|
|
ZwSetIoCompletion@20
|
|
ZwSetLdtEntries@16
|
|
ZwSetLowEventPair@4
|
|
ZwSetLowWaitHighEventPair@4
|
|
ZwSetQuotaInformationFile@16
|
|
ZwSetSecurityObject@12
|
|
ZwSetSystemEnvironmentValue@8
|
|
ZwSetSystemInformation@12
|
|
ZwSetSystemPowerState@12
|
|
ZwSetSystemTime@8
|
|
ZwSetThreadExecutionState@8
|
|
ZwSetTimer@28
|
|
ZwSetTimerResolution@12
|
|
ZwSetUuidSeed@4
|
|
ZwSetValueKey@24
|
|
ZwSetVolumeInformationFile@20
|
|
ZwShutdownSystem@4
|
|
ZwSignalAndWaitForSingleObject@16
|
|
ZwStartProfile@4
|
|
ZwStopProfile@4
|
|
ZwSuspendThread@8
|
|
ZwSystemDebugControl@24
|
|
ZwTerminateJobObject@8
|
|
ZwTerminateProcess@8
|
|
ZwTerminateThread@8
|
|
ZwTestAlert@0
|
|
ZwUnloadDriver@4
|
|
ZwUnloadKey@4
|
|
ZwUnlockFile@20
|
|
ZwUnlockVirtualMemory@16
|
|
ZwUnmapViewOfSection@8
|
|
ZwVdmControl@8
|
|
ZwWaitForMultipleObjects@20
|
|
ZwWaitForSingleObject@12
|
|
ZwWaitHighEventPair@4
|
|
ZwWaitLowEventPair@4
|
|
ZwWriteFile@36
|
|
ZwWriteFileGather@36
|
|
ZwWriteRequestData@24
|
|
ZwWriteVirtualMemory@20
|
|
ZwYieldExecution@0
|
|
__isascii
|
|
__iscsym
|
|
__iscsymf
|
|
__toascii
|
|
_itoa
|
|
_itow
|
|
_ltoa
|
|
_ltow
|
|
_snprintf
|
|
_snwprintf
|
|
_strcmpi
|
|
_stricmp
|
|
_strlwr
|
|
_strnicmp
|
|
_strupr
|
|
_tolower
|
|
_toupper
|
|
_ultoa
|
|
_ultow
|
|
_vsnprintf
|
|
_wcsicmp
|
|
_wcslwr
|
|
_wcsnicmp
|
|
_wcsupr
|
|
_wtoi
|
|
_wtol
|
|
abs
|
|
atan
|
|
atoi
|
|
atol
|
|
ceil
|
|
cos
|
|
fabs
|
|
floor
|
|
isalnum
|
|
isalpha
|
|
iscntrl
|
|
isdigit
|
|
isgraph
|
|
islower
|
|
isprint
|
|
ispunct
|
|
isspace
|
|
isupper
|
|
iswalpha
|
|
iswctype
|
|
isxdigit
|
|
labs
|
|
log
|
|
mbstowcs
|
|
memchr
|
|
memcmp
|
|
memcpy
|
|
memmove
|
|
memset
|
|
pow
|
|
sin
|
|
sprintf
|
|
sqrt
|
|
strcat
|
|
strchr
|
|
strcmp
|
|
strcpy
|
|
strcspn
|
|
strlen
|
|
strncat
|
|
strncmp
|
|
strncpy
|
|
strpbrk
|
|
strrchr
|
|
strspn
|
|
strstr
|
|
strtol
|
|
strtoul
|
|
swprintf
|
|
tan
|
|
tolower
|
|
toupper
|
|
towlower
|
|
towupper
|
|
vsprintf
|
|
wcscat
|
|
wcschr
|
|
wcscmp
|
|
wcscpy
|
|
wcscspn
|
|
wcslen
|
|
wcsncat
|
|
wcsncmp
|
|
wcsncpy
|
|
wcspbrk
|
|
wcsrchr
|
|
wcsspn
|
|
wcsstr
|
|
wcstol
|
|
wcstombs
|
|
wcstoul
|