-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathntdll.def
2490 lines (2490 loc) · 76.5 KB
/
ntdll.def
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
LIBRARY "ntdll"
EXPORTS
A_SHAFinal = fn0
A_SHAInit = fn1
A_SHAUpdate = fn2
AlpcAdjustCompletionListConcurrencyCount = fn3
AlpcFreeCompletionListMessage = fn4
AlpcGetCompletionListLastMessageInformation = fn5
AlpcGetCompletionListMessageAttributes = fn6
AlpcGetHeaderSize = fn7
AlpcGetMessageAttribute = fn8
AlpcGetMessageFromCompletionList = fn9
AlpcGetOutstandingCompletionListMessageCount = fn10
AlpcInitializeMessageAttribute = fn11
AlpcMaxAllowedMessageLength = fn12
AlpcRegisterCompletionList = fn13
AlpcRegisterCompletionListWorkerThread = fn14
AlpcRundownCompletionList = fn15
AlpcUnregisterCompletionList = fn16
AlpcUnregisterCompletionListWorkerThread = fn17
ApiSetQueryApiSetPresence = fn18
ApiSetQueryApiSetPresenceEx = fn19
CsrAllocateCaptureBuffer = fn20
CsrAllocateMessagePointer = fn21
CsrCaptureMessageBuffer = fn22
CsrCaptureMessageMultiUnicodeStringsInPlace = fn23
CsrCaptureMessageString = fn24
CsrCaptureTimeout = fn25
CsrClientCallServer = fn26
CsrClientConnectToServer = fn27
CsrFreeCaptureBuffer = fn28
CsrGetProcessId = fn29
CsrIdentifyAlertableThread = fn30
CsrSetPriorityClass = fn31
CsrVerifyRegion = fn32
DbgBreakPoint = fn33
DbgPrint = fn34
DbgPrintEx = fn35
DbgPrintReturnControlC = fn36
DbgPrompt = fn37
DbgQueryDebugFilterState = fn38
DbgSetDebugFilterState = fn39
DbgUiConnectToDbg = fn40
DbgUiContinue = fn41
DbgUiConvertStateChangeStructure = fn42
DbgUiConvertStateChangeStructureEx = fn43
DbgUiDebugActiveProcess = fn44
DbgUiGetThreadDebugObject = fn45
DbgUiIssueRemoteBreakin = fn46
DbgUiRemoteBreakin = fn47
DbgUiSetThreadDebugObject = fn48
DbgUiStopDebugging = fn49
DbgUiWaitStateChange = fn50
DbgUserBreakPoint = fn51
EtwCheckCoverage = fn52
EtwCreateTraceInstanceId = fn53
EtwDeliverDataBlock = fn54
EtwEnumerateProcessRegGuids = fn55
EtwEventActivityIdControl = fn56
EtwEventEnabled = fn57
EtwEventProviderEnabled = fn58
EtwEventRegister = fn59
EtwEventSetInformation = fn60
EtwEventUnregister = fn61
EtwEventWrite = fn62
EtwEventWriteEndScenario = fn63
EtwEventWriteEx = fn64
EtwEventWriteFull = fn65
EtwEventWriteNoRegistration = fn66
EtwEventWriteStartScenario = fn67
EtwEventWriteString = fn68
EtwEventWriteTransfer = fn69
EtwGetTraceEnableFlags = fn70
EtwGetTraceEnableLevel = fn71
EtwGetTraceLoggerHandle = fn72
EtwLogTraceEvent = fn73
EtwNotificationRegister = fn74
EtwNotificationUnregister = fn75
EtwProcessPrivateLoggerRequest = fn76
EtwRegisterSecurityProvider = fn77
EtwRegisterTraceGuidsA = fn78
EtwRegisterTraceGuidsW = fn79
EtwReplyNotification = fn80
EtwSendNotification = fn81
EtwSetMark = fn82
EtwTraceEventInstance = fn83
EtwTraceMessage = fn84
EtwTraceMessageVa = fn85
EtwUnregisterTraceGuids = fn86
EtwWriteUMSecurityEvent = fn87
EtwpCreateEtwThread = fn88
EtwpGetCpuSpeed = fn89
EvtIntReportAuthzEventAndSourceAsync = fn90
EvtIntReportEventAndSourceAsync = fn91
ExpInterlockedPopEntrySListEnd = fn92
ExpInterlockedPopEntrySListFault = fn93
ExpInterlockedPopEntrySListResume = fn94
KiRaiseUserExceptionDispatcher = fn95
KiUserApcDispatcher = fn96
KiUserCallbackDispatcher = fn97
KiUserExceptionDispatcher = fn98
KiUserInvertedFunctionTable = fn99
LdrAccessResource = fn100
LdrAddDllDirectory = fn101
LdrAddLoadAsDataTable = fn102
LdrAddRefDll = fn103
LdrAppxHandleIntegrityFailure = fn104
LdrCallEnclave = fn105
LdrControlFlowGuardEnforced = fn106
LdrCreateEnclave = fn107
LdrDeleteEnclave = fn108
LdrDisableThreadCalloutsForDll = fn109
LdrEnumResources = fn110
LdrEnumerateLoadedModules = fn111
LdrFastFailInLoaderCallout = fn112
LdrFindEntryForAddress = fn113
LdrFindResourceDirectory_U = fn114
LdrFindResourceEx_U = fn115
LdrFindResource_U = fn116
LdrFlushAlternateResourceModules = fn117
LdrGetDllDirectory = fn118
LdrGetDllFullName = fn119
LdrGetDllHandle = fn120
LdrGetDllHandleByMapping = fn121
LdrGetDllHandleByName = fn122
LdrGetDllHandleEx = fn123
LdrGetDllPath = fn124
LdrGetFailureData = fn125
LdrGetFileNameFromLoadAsDataTable = fn126
LdrGetKnownDllSectionHandle = fn127
LdrGetProcedureAddress = fn128
LdrGetProcedureAddressEx = fn129
LdrGetProcedureAddressForCaller = fn130
LdrHotPatchNotify = fn131
LdrInitShimEngineDynamic = fn132
LdrInitializeEnclave = fn133
LdrInitializeThunk = fn134
LdrIsModuleSxsRedirected = fn135
LdrLoadAlternateResourceModule = fn136
LdrLoadAlternateResourceModuleEx = fn137
LdrLoadDll = fn138
LdrLoadEnclaveModule = fn139
LdrLockLoaderLock = fn140
LdrOpenImageFileOptionsKey = fn141
LdrProcessInitializationComplete = fn142
LdrProcessRelocationBlock = fn143
LdrProcessRelocationBlockEx = fn144
LdrQueryImageFileExecutionOptions = fn145
LdrQueryImageFileExecutionOptionsEx = fn146
LdrQueryImageFileKeyOption = fn147
LdrQueryModuleServiceTags = fn148
LdrQueryOptionalDelayLoadedAPI = fn149
LdrQueryProcessModuleInformation = fn150
LdrRegisterDllNotification = fn151
LdrRemoveDllDirectory = fn152
LdrRemoveLoadAsDataTable = fn153
LdrResFindResource = fn154
LdrResFindResourceDirectory = fn155
LdrResGetRCConfig = fn156
LdrResRelease = fn157
LdrResSearchResource = fn158
LdrResolveDelayLoadedAPI = fn159
LdrResolveDelayLoadsFromDll = fn160
LdrRscIsTypeExist = fn161
LdrSetAppCompatDllRedirectionCallback = fn162
LdrSetDefaultDllDirectories = fn163
LdrSetDllDirectory = fn164
LdrSetDllManifestProber = fn165
LdrSetImplicitPathOptions = fn166
LdrSetMUICacheType = fn167
LdrShutdownProcess = fn168
LdrShutdownThread = fn169
LdrStandardizeSystemPath = fn170
LdrSystemDllInitBlock = fn171
LdrUnloadAlternateResourceModule = fn172
LdrUnloadAlternateResourceModuleEx = fn173
LdrUnloadDll = fn174
LdrUnlockLoaderLock = fn175
LdrUnregisterDllNotification = fn176
LdrUpdatePackageSearchPath = fn177
LdrVerifyImageMatchesChecksum = fn178
LdrVerifyImageMatchesChecksumEx = fn179
LdrpResGetMappingSize = fn180
LdrpResGetResourceDirectory = fn181
MD4Final = fn182
MD4Init = fn183
MD4Update = fn184
MD5Final = fn185
MD5Init = fn186
MD5Update = fn187
MicrosoftTelemetryAssertTriggeredUM = fn188
NlsAnsiCodePage = fn189
NlsMbCodePageTag = fn190
NlsMbOemCodePageTag = fn191
NtAcceptConnectPort = fn192
NtAccessCheck = fn193
NtAccessCheckAndAuditAlarm = fn194
NtAccessCheckByType = fn195
NtAccessCheckByTypeAndAuditAlarm = fn196
NtAccessCheckByTypeResultList = fn197
NtAccessCheckByTypeResultListAndAuditAlarm = fn198
NtAccessCheckByTypeResultListAndAuditAlarmByHandle = fn199
NtAcquireCrossVmMutant = fn200
NtAcquireProcessActivityReference = fn201
NtAddAtom = fn202
NtAddAtomEx = fn203
NtAddBootEntry = fn204
NtAddDriverEntry = fn205
NtAdjustGroupsToken = fn206
NtAdjustPrivilegesToken = fn207
NtAdjustTokenClaimsAndDeviceGroups = fn208
NtAlertResumeThread = fn209
NtAlertThread = fn210
NtAlertThreadByThreadId = fn211
NtAllocateLocallyUniqueId = fn212
NtAllocateReserveObject = fn213
NtAllocateUserPhysicalPages = fn214
NtAllocateUserPhysicalPagesEx = fn215
NtAllocateUuids = fn216
NtAllocateVirtualMemory = fn217
NtAllocateVirtualMemoryEx = fn218
NtAlpcAcceptConnectPort = fn219
NtAlpcCancelMessage = fn220
NtAlpcConnectPort = fn221
NtAlpcConnectPortEx = fn222
NtAlpcCreatePort = fn223
NtAlpcCreatePortSection = fn224
NtAlpcCreateResourceReserve = fn225
NtAlpcCreateSectionView = fn226
NtAlpcCreateSecurityContext = fn227
NtAlpcDeletePortSection = fn228
NtAlpcDeleteResourceReserve = fn229
NtAlpcDeleteSectionView = fn230
NtAlpcDeleteSecurityContext = fn231
NtAlpcDisconnectPort = fn232
NtAlpcImpersonateClientContainerOfPort = fn233
NtAlpcImpersonateClientOfPort = fn234
NtAlpcOpenSenderProcess = fn235
NtAlpcOpenSenderThread = fn236
NtAlpcQueryInformation = fn237
NtAlpcQueryInformationMessage = fn238
NtAlpcRevokeSecurityContext = fn239
NtAlpcSendWaitReceivePort = fn240
NtAlpcSetInformation = fn241
NtApphelpCacheControl = fn242
NtAreMappedFilesTheSame = fn243
NtAssignProcessToJobObject = fn244
NtAssociateWaitCompletionPacket = fn245
NtCallEnclave = fn246
NtCallbackReturn = fn247
NtCancelIoFile = fn248
NtCancelIoFileEx = fn249
NtCancelSynchronousIoFile = fn250
NtCancelTimer = fn251
NtCancelTimer2 = fn252
NtCancelWaitCompletionPacket = fn253
NtChangeProcessState = fn254
NtChangeThreadState = fn255
NtClearEvent = fn256
NtClose = fn257
NtCloseObjectAuditAlarm = fn258
NtCommitComplete = fn259
NtCommitEnlistment = fn260
NtCommitRegistryTransaction = fn261
NtCommitTransaction = fn262
NtCompactKeys = fn263
NtCompareObjects = fn264
NtCompareSigningLevels = fn265
NtCompareTokens = fn266
NtCompleteConnectPort = fn267
NtCompressKey = fn268
NtConnectPort = fn269
NtContinue = fn270
NtContinueEx = fn271
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter = fn272
NtCopyFileChunk = fn273
NtCreateCpuPartition = fn274
NtCreateCrossVmEvent = fn275
NtCreateCrossVmMutant = fn276
NtCreateDebugObject = fn277
NtCreateDirectoryObject = fn278
NtCreateDirectoryObjectEx = fn279
NtCreateEnclave = fn280
NtCreateEnlistment = fn281
NtCreateEvent = fn282
NtCreateEventPair = fn283
NtCreateFile = fn284
NtCreateIRTimer = fn285
NtCreateIoCompletion = fn286
NtCreateIoRing = fn287
NtCreateJobObject = fn288
NtCreateJobSet = fn289
NtCreateKey = fn290
NtCreateKeyTransacted = fn291
NtCreateKeyedEvent = fn292
NtCreateLowBoxToken = fn293
NtCreateMailslotFile = fn294
NtCreateMutant = fn295
NtCreateNamedPipeFile = fn296
NtCreatePagingFile = fn297
NtCreatePartition = fn298
NtCreatePort = fn299
NtCreatePrivateNamespace = fn300
NtCreateProcess = fn301
NtCreateProcessEx = fn302
NtCreateProcessStateChange = fn303
NtCreateProfile = fn304
NtCreateProfileEx = fn305
NtCreateRegistryTransaction = fn306
NtCreateResourceManager = fn307
NtCreateSection = fn308
NtCreateSectionEx = fn309
NtCreateSemaphore = fn310
NtCreateSymbolicLinkObject = fn311
NtCreateThread = fn312
NtCreateThreadEx = fn313
NtCreateThreadStateChange = fn314
NtCreateTimer = fn315
NtCreateTimer2 = fn316
NtCreateToken = fn317
NtCreateTokenEx = fn318
NtCreateTransaction = fn319
NtCreateTransactionManager = fn320
NtCreateUserProcess = fn321
NtCreateWaitCompletionPacket = fn322
NtCreateWaitablePort = fn323
NtCreateWnfStateName = fn324
NtCreateWorkerFactory = fn325
NtDebugActiveProcess = fn326
NtDebugContinue = fn327
NtDelayExecution = fn328
NtDeleteAtom = fn329
NtDeleteBootEntry = fn330
NtDeleteDriverEntry = fn331
NtDeleteFile = fn332
NtDeleteKey = fn333
NtDeleteObjectAuditAlarm = fn334
NtDeletePrivateNamespace = fn335
NtDeleteValueKey = fn336
NtDeleteWnfStateData = fn337
NtDeleteWnfStateName = fn338
NtDeviceIoControlFile = fn339
NtDirectGraphicsCall = fn340
NtDisableLastKnownGood = fn341
NtDisplayString = fn342
NtDrawText = fn343
NtDuplicateObject = fn344
NtDuplicateToken = fn345
NtEnableLastKnownGood = fn346
NtEnumerateBootEntries = fn347
NtEnumerateDriverEntries = fn348
NtEnumerateKey = fn349
NtEnumerateSystemEnvironmentValuesEx = fn350
NtEnumerateTransactionObject = fn351
NtEnumerateValueKey = fn352
NtExtendSection = fn353
NtFilterBootOption = fn354
NtFilterToken = fn355
NtFilterTokenEx = fn356
NtFindAtom = fn357
NtFlushBuffersFile = fn358
NtFlushBuffersFileEx = fn359
NtFlushInstallUILanguage = fn360
NtFlushInstructionCache = fn361
NtFlushKey = fn362
NtFlushProcessWriteBuffers = fn363
NtFlushVirtualMemory = fn364
NtFlushWriteBuffer = fn365
NtFreeUserPhysicalPages = fn366
NtFreeVirtualMemory = fn367
NtFreezeRegistry = fn368
NtFreezeTransactions = fn369
NtFsControlFile = fn370
NtGetCachedSigningLevel = fn371
NtGetCompleteWnfStateSubscription = fn372
NtGetContextThread = fn373
NtGetCurrentProcessorNumber = fn374
NtGetCurrentProcessorNumberEx = fn375
NtGetDevicePowerState = fn376
NtGetMUIRegistryInfo = fn377
NtGetNextProcess = fn378
NtGetNextThread = fn379
NtGetNlsSectionPtr = fn380
NtGetNotificationResourceManager = fn381
NtGetTickCount = fn382
NtGetWriteWatch = fn383
NtImpersonateAnonymousToken = fn384
NtImpersonateClientOfPort = fn385
NtImpersonateThread = fn386
NtInitializeEnclave = fn387
NtInitializeNlsFiles = fn388
NtInitializeRegistry = fn389
NtInitiatePowerAction = fn390
NtIsProcessInJob = fn391
NtIsSystemResumeAutomatic = fn392
NtIsUILanguageComitted = fn393
NtListenPort = fn394
NtLoadDriver = fn395
NtLoadEnclaveData = fn396
NtLoadKey = fn397
NtLoadKey2 = fn398
NtLoadKey3 = fn399
NtLoadKeyEx = fn400
NtLockFile = fn401
NtLockProductActivationKeys = fn402
NtLockRegistryKey = fn403
NtLockVirtualMemory = fn404
NtMakePermanentObject = fn405
NtMakeTemporaryObject = fn406
NtManageHotPatch = fn407
NtManagePartition = fn408
NtMapCMFModule = fn409
NtMapUserPhysicalPages = fn410
NtMapUserPhysicalPagesScatter = fn411
NtMapViewOfSection = fn412
NtMapViewOfSectionEx = fn413
NtModifyBootEntry = fn414
NtModifyDriverEntry = fn415
NtNotifyChangeDirectoryFile = fn416
NtNotifyChangeDirectoryFileEx = fn417
NtNotifyChangeKey = fn418
NtNotifyChangeMultipleKeys = fn419
NtNotifyChangeSession = fn420
NtOpenCpuPartition = fn421
NtOpenDirectoryObject = fn422
NtOpenEnlistment = fn423
NtOpenEvent = fn424
NtOpenEventPair = fn425
NtOpenFile = fn426
NtOpenIoCompletion = fn427
NtOpenJobObject = fn428
NtOpenKey = fn429
NtOpenKeyEx = fn430
NtOpenKeyTransacted = fn431
NtOpenKeyTransactedEx = fn432
NtOpenKeyedEvent = fn433
NtOpenMutant = fn434
NtOpenObjectAuditAlarm = fn435
NtOpenPartition = fn436
NtOpenPrivateNamespace = fn437
NtOpenProcess = fn438
NtOpenProcessToken = fn439
NtOpenProcessTokenEx = fn440
NtOpenRegistryTransaction = fn441
NtOpenResourceManager = fn442
NtOpenSection = fn443
NtOpenSemaphore = fn444
NtOpenSession = fn445
NtOpenSymbolicLinkObject = fn446
NtOpenThread = fn447
NtOpenThreadToken = fn448
NtOpenThreadTokenEx = fn449
NtOpenTimer = fn450
NtOpenTransaction = fn451
NtOpenTransactionManager = fn452
NtPlugPlayControl = fn453
NtPowerInformation = fn454
NtPrePrepareComplete = fn455
NtPrePrepareEnlistment = fn456
NtPrepareComplete = fn457
NtPrepareEnlistment = fn458
NtPrivilegeCheck = fn459
NtPrivilegeObjectAuditAlarm = fn460
NtPrivilegedServiceAuditAlarm = fn461
NtPropagationComplete = fn462
NtPropagationFailed = fn463
NtProtectVirtualMemory = fn464
NtPssCaptureVaSpaceBulk = fn465
NtPulseEvent = fn466
NtQueryAttributesFile = fn467
NtQueryAuxiliaryCounterFrequency = fn468
NtQueryBootEntryOrder = fn469
NtQueryBootOptions = fn470
NtQueryDebugFilterState = fn471
NtQueryDefaultLocale = fn472
NtQueryDefaultUILanguage = fn473
NtQueryDirectoryFile = fn474
NtQueryDirectoryFileEx = fn475
NtQueryDirectoryObject = fn476
NtQueryDriverEntryOrder = fn477
NtQueryEaFile = fn478
NtQueryEvent = fn479
NtQueryFullAttributesFile = fn480
NtQueryInformationAtom = fn481
NtQueryInformationByName = fn482
NtQueryInformationCpuPartition = fn483
NtQueryInformationEnlistment = fn484
NtQueryInformationFile = fn485
NtQueryInformationJobObject = fn486
NtQueryInformationPort = fn487
NtQueryInformationProcess = fn488
NtQueryInformationResourceManager = fn489
NtQueryInformationThread = fn490
NtQueryInformationToken = fn491
NtQueryInformationTransaction = fn492
NtQueryInformationTransactionManager = fn493
NtQueryInformationWorkerFactory = fn494
NtQueryInstallUILanguage = fn495
NtQueryIntervalProfile = fn496
NtQueryIoCompletion = fn497
NtQueryIoRingCapabilities = fn498
NtQueryKey = fn499
NtQueryLicenseValue = fn500
NtQueryMultipleValueKey = fn501
NtQueryMutant = fn502
NtQueryObject = fn503
NtQueryOpenSubKeys = fn504
NtQueryOpenSubKeysEx = fn505
NtQueryPerformanceCounter = fn506
NtQueryPortInformationProcess = fn507
NtQueryQuotaInformationFile = fn508
NtQuerySection = fn509
NtQuerySecurityAttributesToken = fn510
NtQuerySecurityObject = fn511
NtQuerySecurityPolicy = fn512
NtQuerySemaphore = fn513
NtQuerySymbolicLinkObject = fn514
NtQuerySystemEnvironmentValue = fn515
NtQuerySystemEnvironmentValueEx = fn516
NtQuerySystemInformation = fn517
NtQuerySystemInformationEx = fn518
NtQuerySystemTime = fn519
NtQueryTimer = fn520
NtQueryTimerResolution = fn521
NtQueryValueKey = fn522
NtQueryVirtualMemory = fn523
NtQueryVolumeInformationFile = fn524
NtQueryWnfStateData = fn525
NtQueryWnfStateNameInformation = fn526
NtQueueApcThread = fn527
NtQueueApcThreadEx = fn528
NtQueueApcThreadEx2 = fn529
NtRaiseException = fn530
NtRaiseHardError = fn531
NtReadFile = fn532
NtReadFileScatter = fn533
NtReadOnlyEnlistment = fn534
NtReadRequestData = fn535
NtReadVirtualMemory = fn536
NtReadVirtualMemoryEx = fn537
NtRecoverEnlistment = fn538
NtRecoverResourceManager = fn539
NtRecoverTransactionManager = fn540
NtRegisterProtocolAddressInformation = fn541
NtRegisterThreadTerminatePort = fn542
NtReleaseKeyedEvent = fn543
NtReleaseMutant = fn544
NtReleaseSemaphore = fn545
NtReleaseWorkerFactoryWorker = fn546
NtRemoveIoCompletion = fn547
NtRemoveIoCompletionEx = fn548
NtRemoveProcessDebug = fn549
NtRenameKey = fn550
NtRenameTransactionManager = fn551
NtReplaceKey = fn552
NtReplacePartitionUnit = fn553
NtReplyPort = fn554
NtReplyWaitReceivePort = fn555
NtReplyWaitReceivePortEx = fn556
NtReplyWaitReplyPort = fn557
NtRequestPort = fn558
NtRequestWaitReplyPort = fn559
NtResetEvent = fn560
NtResetWriteWatch = fn561
NtRestoreKey = fn562
NtResumeProcess = fn563
NtResumeThread = fn564
NtRevertContainerImpersonation = fn565
NtRollbackComplete = fn566
NtRollbackEnlistment = fn567
NtRollbackRegistryTransaction = fn568
NtRollbackTransaction = fn569
NtRollforwardTransactionManager = fn570
NtSaveKey = fn571
NtSaveKeyEx = fn572
NtSaveMergedKeys = fn573
NtSecureConnectPort = fn574
NtSerializeBoot = fn575
NtSetBootEntryOrder = fn576
NtSetBootOptions = fn577
NtSetCachedSigningLevel = fn578
NtSetCachedSigningLevel2 = fn579
NtSetContextThread = fn580
NtSetDebugFilterState = fn581
NtSetDefaultHardErrorPort = fn582
NtSetDefaultLocale = fn583
NtSetDefaultUILanguage = fn584
NtSetDriverEntryOrder = fn585
NtSetEaFile = fn586
NtSetEvent = fn587
NtSetEventBoostPriority = fn588
NtSetHighEventPair = fn589
NtSetHighWaitLowEventPair = fn590
NtSetIRTimer = fn591
NtSetInformationCpuPartition = fn592
NtSetInformationDebugObject = fn593
NtSetInformationEnlistment = fn594
NtSetInformationFile = fn595
NtSetInformationIoRing = fn596
NtSetInformationJobObject = fn597
NtSetInformationKey = fn598
NtSetInformationObject = fn599
NtSetInformationProcess = fn600
NtSetInformationResourceManager = fn601
NtSetInformationSymbolicLink = fn602
NtSetInformationThread = fn603
NtSetInformationToken = fn604
NtSetInformationTransaction = fn605
NtSetInformationTransactionManager = fn606
NtSetInformationVirtualMemory = fn607
NtSetInformationWorkerFactory = fn608
NtSetIntervalProfile = fn609
NtSetIoCompletion = fn610
NtSetIoCompletionEx = fn611
NtSetLdtEntries = fn612
NtSetLowEventPair = fn613
NtSetLowWaitHighEventPair = fn614
NtSetQuotaInformationFile = fn615
NtSetSecurityObject = fn616
NtSetSystemEnvironmentValue = fn617
NtSetSystemEnvironmentValueEx = fn618
NtSetSystemInformation = fn619
NtSetSystemPowerState = fn620
NtSetSystemTime = fn621
NtSetThreadExecutionState = fn622
NtSetTimer = fn623
NtSetTimer2 = fn624
NtSetTimerEx = fn625
NtSetTimerResolution = fn626
NtSetUuidSeed = fn627
NtSetValueKey = fn628
NtSetVolumeInformationFile = fn629
NtSetWnfProcessNotificationEvent = fn630
NtShutdownSystem = fn631
NtShutdownWorkerFactory = fn632
NtSignalAndWaitForSingleObject = fn633
NtSinglePhaseReject = fn634
NtStartProfile = fn635
NtStopProfile = fn636
NtSubmitIoRing = fn637
NtSubscribeWnfStateChange = fn638
NtSuspendProcess = fn639
NtSuspendThread = fn640
NtSystemDebugControl = fn641
NtTerminateEnclave = fn642
NtTerminateJobObject = fn643
NtTerminateProcess = fn644
NtTerminateThread = fn645
NtTestAlert = fn646
NtThawRegistry = fn647
NtThawTransactions = fn648
NtTraceControl = fn649
NtTraceEvent = fn650
NtTranslateFilePath = fn651
NtUmsThreadYield = fn652
NtUnloadDriver = fn653
NtUnloadKey = fn654
NtUnloadKey2 = fn655
NtUnloadKeyEx = fn656
NtUnlockFile = fn657
NtUnlockVirtualMemory = fn658
NtUnmapViewOfSection = fn659
NtUnmapViewOfSectionEx = fn660
NtUnsubscribeWnfStateChange = fn661
NtUpdateWnfStateData = fn662
NtVdmControl = fn663
NtWaitForAlertByThreadId = fn664
NtWaitForDebugEvent = fn665
NtWaitForKeyedEvent = fn666
NtWaitForMultipleObjects = fn667
NtWaitForMultipleObjects32 = fn668
NtWaitForSingleObject = fn669
NtWaitForWorkViaWorkerFactory = fn670
NtWaitHighEventPair = fn671
NtWaitLowEventPair = fn672
NtWorkerFactoryWorkerReady = fn673
NtWriteFile = fn674
NtWriteFileGather = fn675
NtWriteRequestData = fn676
NtWriteVirtualMemory = fn677
NtYieldExecution = fn678
NtdllDefWindowProc_A = fn679
NtdllDefWindowProc_W = fn680
NtdllDialogWndProc_A = fn681
NtdllDialogWndProc_W = fn682
PfxFindPrefix = fn683
PfxInitialize = fn684
PfxInsertPrefix = fn685
PfxRemovePrefix = fn686
PssNtCaptureSnapshot = fn687
PssNtDuplicateSnapshot = fn688
PssNtFreeRemoteSnapshot = fn689
PssNtFreeSnapshot = fn690
PssNtFreeWalkMarker = fn691
PssNtQuerySnapshot = fn692
PssNtValidateDescriptor = fn693
PssNtWalkSnapshot = fn694
RtlAbortRXact = fn695
RtlAbsoluteToSelfRelativeSD = fn696
RtlAcquirePebLock = fn697
RtlAcquirePrivilege = fn698
RtlAcquireReleaseSRWLockExclusive = fn699
RtlAcquireResourceExclusive = fn700
RtlAcquireResourceShared = fn701
RtlAcquireSRWLockExclusive = fn702
RtlAcquireSRWLockShared = fn703
RtlActivateActivationContext = fn704
RtlActivateActivationContextEx = fn705
RtlActivateActivationContextUnsafeFast = fn706
RtlAddAccessAllowedAce = fn707
RtlAddAccessAllowedAceEx = fn708
RtlAddAccessAllowedObjectAce = fn709
RtlAddAccessDeniedAce = fn710
RtlAddAccessDeniedAceEx = fn711
RtlAddAccessDeniedObjectAce = fn712
RtlAddAccessFilterAce = fn713
RtlAddAce = fn714
RtlAddActionToRXact = fn715
RtlAddAtomToAtomTable = fn716
RtlAddAttributeActionToRXact = fn717
RtlAddAuditAccessAce = fn718
RtlAddAuditAccessAceEx = fn719
RtlAddAuditAccessObjectAce = fn720
RtlAddCompoundAce = fn721
RtlAddFunctionTable = fn722
RtlAddGrowableFunctionTable = fn723
RtlAddIntegrityLabelToBoundaryDescriptor = fn724
RtlAddMandatoryAce = fn725
RtlAddProcessTrustLabelAce = fn726
RtlAddRefActivationContext = fn727
RtlAddRefMemoryStream = fn728
RtlAddResourceAttributeAce = fn729
RtlAddSIDToBoundaryDescriptor = fn730
RtlAddScopedPolicyIDAce = fn731
RtlAddVectoredContinueHandler = fn732
RtlAddVectoredExceptionHandler = fn733
RtlAddressInSectionTable = fn734
RtlAdjustPrivilege = fn735
RtlAllocateActivationContextStack = fn736
RtlAllocateAndInitializeSid = fn737
RtlAllocateAndInitializeSidEx = fn738
RtlAllocateHandle = fn739
RtlAllocateHeap = fn740
RtlAllocateMemoryBlockLookaside = fn741
RtlAllocateMemoryZone = fn742
RtlAllocateWnfSerializationGroup = fn743
RtlAnsiCharToUnicodeChar = fn744
RtlAnsiStringToUnicodeSize = fn745
RtlAnsiStringToUnicodeString = fn746
RtlAppendAsciizToString = fn747
RtlAppendPathElement = fn748
RtlAppendStringToString = fn749
RtlAppendUnicodeStringToString = fn750
RtlAppendUnicodeToString = fn751
RtlApplicationVerifierStop = fn752
RtlApplyRXact = fn753
RtlApplyRXactNoFlush = fn754
RtlAppxIsFileOwnedByTrustedInstaller = fn755
RtlAreAllAccessesGranted = fn756
RtlAreAnyAccessesGranted = fn757
RtlAreBitsClear = fn758
RtlAreBitsClearEx = fn759
RtlAreBitsSet = fn760
RtlAreLongPathsEnabled = fn761
RtlAssert = fn762
RtlAvlInsertNodeEx = fn763
RtlAvlRemoveNode = fn764
RtlBarrier = fn765
RtlBarrierForDelete = fn766
RtlCallEnclave = fn767
RtlCallEnclaveReturn = fn768
RtlCancelTimer = fn769
RtlCanonicalizeDomainName = fn770
RtlCapabilityCheck = fn771
RtlCapabilityCheckForSingleSessionSku = fn772
RtlCaptureContext = fn773
RtlCaptureContext2 = fn774
RtlCaptureStackBackTrace = fn775
RtlCharToInteger = fn776
RtlCheckBootStatusIntegrity = fn777
RtlCheckForOrphanedCriticalSections = fn778
RtlCheckPortableOperatingSystem = fn779
RtlCheckRegistryKey = fn780
RtlCheckSandboxedToken = fn781
RtlCheckSystemBootStatusIntegrity = fn782
RtlCheckTokenCapability = fn783
RtlCheckTokenMembership = fn784
RtlCheckTokenMembershipEx = fn785
RtlCleanUpTEBLangLists = fn786
RtlClearAllBits = fn787
RtlClearAllBitsEx = fn788
RtlClearBit = fn789
RtlClearBitEx = fn790
RtlClearBits = fn791
RtlClearBitsEx = fn792
RtlClearThreadWorkOnBehalfTicket = fn793
RtlCloneMemoryStream = fn794
RtlCloneUserProcess = fn795
RtlCmDecodeMemIoResource = fn796
RtlCmEncodeMemIoResource = fn797
RtlCommitDebugInfo = fn798
RtlCommitMemoryStream = fn799
RtlCompactHeap = fn800
RtlCompareAltitudes = fn801
RtlCompareExchangePointerMapping = fn802
RtlCompareExchangePropertyStore = fn803
RtlCompareMemory = fn804
RtlCompareMemoryUlong = fn805
RtlCompareString = fn806
RtlCompareUnicodeString = fn807
RtlCompareUnicodeStrings = fn808
RtlCompleteProcessCloning = fn809
RtlCompressBuffer = fn810
RtlComputeCrc32 = fn811
RtlComputeImportTableHash = fn812
RtlComputePrivatizedDllName_U = fn813
RtlConnectToSm = fn814
RtlConsoleMultiByteToUnicodeN = fn815
RtlConstructCrossVmEventPath = fn816
RtlConstructCrossVmMutexPath = fn817
RtlContractHashTable = fn818
RtlConvertDeviceFamilyInfoToString = fn819
RtlConvertExclusiveToShared = fn820
RtlConvertHostPerfCounterToPerfCounter = fn821
RtlConvertLCIDToString = fn822
RtlConvertSRWLockExclusiveToShared = fn823
RtlConvertSharedToExclusive = fn824
RtlConvertSidToUnicodeString = fn825
RtlConvertToAutoInheritSecurityObject = fn826
RtlCopyBitMap = fn827
RtlCopyContext = fn828
RtlCopyExtendedContext = fn829
RtlCopyLuid = fn830
RtlCopyLuidAndAttributesArray = fn831
RtlCopyMappedMemory = fn832
RtlCopyMemory = fn833
RtlCopyMemoryNonTemporal = fn834
RtlCopyMemoryStreamTo = fn835
RtlCopyOutOfProcessMemoryStreamTo = fn836
RtlCopySecurityDescriptor = fn837
RtlCopySid = fn838
RtlCopySidAndAttributesArray = fn839
RtlCopyString = fn840
RtlCopyUnicodeString = fn841
RtlCrc32 = fn842
RtlCrc64 = fn843
RtlCreateAcl = fn844
RtlCreateActivationContext = fn845
RtlCreateAndSetSD = fn846
RtlCreateAtomTable = fn847
RtlCreateBootStatusDataFile = fn848
RtlCreateBoundaryDescriptor = fn849
RtlCreateEnvironment = fn850
RtlCreateEnvironmentEx = fn851
RtlCreateHashTable = fn852
RtlCreateHashTableEx = fn853
RtlCreateHeap = fn854
RtlCreateMemoryBlockLookaside = fn855
RtlCreateMemoryZone = fn856
RtlCreateProcessParameters = fn857
RtlCreateProcessParametersEx = fn858
RtlCreateProcessParametersWithTemplate = fn859
RtlCreateProcessReflection = fn860
RtlCreateQueryDebugBuffer = fn861
RtlCreateRegistryKey = fn862
RtlCreateSecurityDescriptor = fn863
RtlCreateServiceSid = fn864
RtlCreateSystemVolumeInformationFolder = fn865
RtlCreateTagHeap = fn866
RtlCreateTimer = fn867
RtlCreateTimerQueue = fn868
RtlCreateUmsCompletionList = fn869
RtlCreateUmsThreadContext = fn870
RtlCreateUnicodeString = fn871
RtlCreateUnicodeStringFromAsciiz = fn872
RtlCreateUserFiberShadowStack = fn873
RtlCreateUserProcess = fn874
RtlCreateUserProcessEx = fn875
RtlCreateUserSecurityObject = fn876
RtlCreateUserStack = fn877
RtlCreateUserThread = fn878
RtlCreateVirtualAccountSid = fn879
RtlCultureNameToLCID = fn880
RtlCustomCPToUnicodeN = fn881
RtlCutoverTimeToSystemTime = fn882
RtlDeCommitDebugInfo = fn883
RtlDeNormalizeProcessParams = fn884
RtlDeactivateActivationContext = fn885
RtlDeactivateActivationContextUnsafeFast = fn886
RtlDebugPrintTimes = fn887
RtlDecodePointer = fn888
RtlDecodeRemotePointer = fn889
RtlDecodeSystemPointer = fn890
RtlDecompressBuffer = fn891
RtlDecompressBufferEx = fn892
RtlDecompressFragment = fn893
RtlDefaultNpAcl = fn894
RtlDelayExecution = fn895
RtlDelete = fn896
RtlDeleteAce = fn897
RtlDeleteAtomFromAtomTable = fn898
RtlDeleteBarrier = fn899
RtlDeleteBoundaryDescriptor = fn900
RtlDeleteCriticalSection = fn901
RtlDeleteElementGenericTable = fn902
RtlDeleteElementGenericTableAvl = fn903
RtlDeleteElementGenericTableAvlEx = fn904
RtlDeleteFunctionTable = fn905
RtlDeleteGrowableFunctionTable = fn906
RtlDeleteHashTable = fn907
RtlDeleteNoSplay = fn908
RtlDeleteRegistryValue = fn909
RtlDeleteResource = fn910
RtlDeleteSecurityObject = fn911
RtlDeleteTimer = fn912
RtlDeleteTimerQueue = fn913
RtlDeleteTimerQueueEx = fn914
RtlDeleteUmsCompletionList = fn915
RtlDeleteUmsThreadContext = fn916
RtlDequeueUmsCompletionListItems = fn917
RtlDeregisterSecureMemoryCacheCallback = fn918
RtlDeregisterWait = fn919
RtlDeregisterWaitEx = fn920
RtlDeriveCapabilitySidsFromName = fn921
RtlDestroyAtomTable = fn922
RtlDestroyEnvironment = fn923
RtlDestroyHandleTable = fn924
RtlDestroyHeap = fn925
RtlDestroyMemoryBlockLookaside = fn926
RtlDestroyMemoryZone = fn927
RtlDestroyProcessParameters = fn928
RtlDestroyQueryDebugBuffer = fn929
RtlDetectHeapLeaks = fn930
RtlDetermineDosPathNameType_U = fn931
RtlDisableThreadProfiling = fn932
RtlDisownModuleHeapAllocation = fn933
RtlDllShutdownInProgress = fn934
RtlDnsHostNameToComputerName = fn935
RtlDoesFileExists_U = fn936
RtlDoesNameContainWildCards = fn937
RtlDosApplyFileIsolationRedirection_Ustr = fn938
RtlDosLongPathNameToNtPathName_U_WithStatus = fn939
RtlDosLongPathNameToRelativeNtPathName_U_WithStatus = fn940
RtlDosPathNameToNtPathName_U = fn941
RtlDosPathNameToNtPathName_U_WithStatus = fn942
RtlDosPathNameToRelativeNtPathName_U = fn943
RtlDosPathNameToRelativeNtPathName_U_WithStatus = fn944
RtlDosSearchPath_U = fn945
RtlDosSearchPath_Ustr = fn946
RtlDowncaseUnicodeChar = fn947
RtlDowncaseUnicodeString = fn948
RtlDrainNonVolatileFlush = fn949
RtlDumpResource = fn950
RtlDuplicateUnicodeString = fn951
RtlEmptyAtomTable = fn952
RtlEnableEarlyCriticalSectionEventCreation = fn953
RtlEnableThreadProfiling = fn954
RtlEnclaveCallDispatch = fn955
RtlEnclaveCallDispatchReturn = fn956
RtlEncodePointer = fn957
RtlEncodeRemotePointer = fn958
RtlEncodeSystemPointer = fn959
RtlEndEnumerationHashTable = fn960
RtlEndStrongEnumerationHashTable = fn961
RtlEndWeakEnumerationHashTable = fn962
RtlEnterCriticalSection = fn963
RtlEnterUmsSchedulingMode = fn964
RtlEnumProcessHeaps = fn965
RtlEnumerateEntryHashTable = fn966
RtlEnumerateGenericTable = fn967
RtlEnumerateGenericTableAvl = fn968
RtlEnumerateGenericTableLikeADirectory = fn969
RtlEnumerateGenericTableWithoutSplaying = fn970
RtlEnumerateGenericTableWithoutSplayingAvl = fn971
RtlEqualComputerName = fn972
RtlEqualDomainName = fn973
RtlEqualLuid = fn974
RtlEqualPrefixSid = fn975
RtlEqualSid = fn976
RtlEqualString = fn977
RtlEqualUnicodeString = fn978
RtlEqualWnfChangeStamps = fn979
RtlEraseUnicodeString = fn980
RtlEthernetAddressToStringA = fn981
RtlEthernetAddressToStringW = fn982
RtlEthernetStringToAddressA = fn983
RtlEthernetStringToAddressW = fn984
RtlExecuteUmsThread = fn985
RtlExitUserProcess = fn986
RtlExitUserThread = fn987
RtlExpandEnvironmentStrings = fn988
RtlExpandEnvironmentStrings_U = fn989
RtlExpandHashTable = fn990
RtlExtendCorrelationVector = fn991
RtlExtendMemoryBlockLookaside = fn992
RtlExtendMemoryZone = fn993
RtlExtractBitMap = fn994
RtlFillMemory = fn995
RtlFillMemoryNonTemporal = fn996
RtlFillNonVolatileMemory = fn997