diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..b4c1fa1
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,28 @@
+# Directories
+bin/
+obj/
+ipch/
+Win32/
+x86/
+x64/
+Debug/
+Release/
+.svn/
+.hg/
+.vs/
+
+# File types
+*.dll
+*.exe
+*.sys
+*.lib
+*.exp
+*.pdb
+*.aps
+*.sdf
+*.user
+*.obj
+*.opensdf
+*.suo
+*.VC.db
+*.VC.opendb
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..9cecc1d
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,674 @@
+ GNU GENERAL PUBLIC LICENSE
+ Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc.
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+ Preamble
+
+ The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+ The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works. By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users. We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors. You can apply it to
+your programs, too.
+
+ When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+ To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights. Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+ For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received. You must make sure that they, too, receive
+or can get the source code. And you must show them these terms so they
+know their rights.
+
+ Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+ For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software. For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+ Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so. This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software. The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable. Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products. If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+ Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary. To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+ The precise terms and conditions for copying, distribution and
+modification follow.
+
+ TERMS AND CONDITIONS
+
+ 0. Definitions.
+
+ "This License" refers to version 3 of the GNU General Public License.
+
+ "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+ "The Program" refers to any copyrightable work licensed under this
+License. Each licensee is addressed as "you". "Licensees" and
+"recipients" may be individuals or organizations.
+
+ To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy. The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+ A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+ To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+ To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+ An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License. If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+ 1. Source Code.
+
+ The "source code" for a work means the preferred form of the work
+for making modifications to it. "Object code" means any non-source
+form of a work.
+
+ A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+ The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form. A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+ The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities. However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+ The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+ The Corresponding Source for a work in source code form is that
+same work.
+
+ 2. Basic Permissions.
+
+ All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met. This License explicitly affirms your unlimited
+permission to run the unmodified Program. The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work. This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+ You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force. You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright. Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+ Conveying under any other circumstances is permitted solely under
+the conditions stated below. Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+ 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+ No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+ When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+ 4. Conveying Verbatim Copies.
+
+ You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+ You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+ 5. Conveying Modified Source Versions.
+
+ You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+ a) The work must carry prominent notices stating that you modified
+ it, and giving a relevant date.
+
+ b) The work must carry prominent notices stating that it is
+ released under this License and any conditions added under section
+ 7. This requirement modifies the requirement in section 4 to
+ "keep intact all notices".
+
+ c) You must license the entire work, as a whole, under this
+ License to anyone who comes into possession of a copy. This
+ License will therefore apply, along with any applicable section 7
+ additional terms, to the whole of the work, and all its parts,
+ regardless of how they are packaged. This License gives no
+ permission to license the work in any other way, but it does not
+ invalidate such permission if you have separately received it.
+
+ d) If the work has interactive user interfaces, each must display
+ Appropriate Legal Notices; however, if the Program has interactive
+ interfaces that do not display Appropriate Legal Notices, your
+ work need not make them do so.
+
+ A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+ 6. Conveying Non-Source Forms.
+
+ You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+ a) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by the
+ Corresponding Source fixed on a durable physical medium
+ customarily used for software interchange.
+
+ b) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by a
+ written offer, valid for at least three years and valid for as
+ long as you offer spare parts or customer support for that product
+ model, to give anyone who possesses the object code either (1) a
+ copy of the Corresponding Source for all the software in the
+ product that is covered by this License, on a durable physical
+ medium customarily used for software interchange, for a price no
+ more than your reasonable cost of physically performing this
+ conveying of source, or (2) access to copy the
+ Corresponding Source from a network server at no charge.
+
+ c) Convey individual copies of the object code with a copy of the
+ written offer to provide the Corresponding Source. This
+ alternative is allowed only occasionally and noncommercially, and
+ only if you received the object code with such an offer, in accord
+ with subsection 6b.
+
+ d) Convey the object code by offering access from a designated
+ place (gratis or for a charge), and offer equivalent access to the
+ Corresponding Source in the same way through the same place at no
+ further charge. You need not require recipients to copy the
+ Corresponding Source along with the object code. If the place to
+ copy the object code is a network server, the Corresponding Source
+ may be on a different server (operated by you or a third party)
+ that supports equivalent copying facilities, provided you maintain
+ clear directions next to the object code saying where to find the
+ Corresponding Source. Regardless of what server hosts the
+ Corresponding Source, you remain obligated to ensure that it is
+ available for as long as needed to satisfy these requirements.
+
+ e) Convey the object code using peer-to-peer transmission, provided
+ you inform other peers where the object code and Corresponding
+ Source of the work are being offered to the general public at no
+ charge under subsection 6d.
+
+ A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+ A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling. In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage. For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product. A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+ "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source. The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+ If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information. But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+ The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed. Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+ Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+ 7. Additional Terms.
+
+ "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law. If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+ When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it. (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.) You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+ Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+ a) Disclaiming warranty or limiting liability differently from the
+ terms of sections 15 and 16 of this License; or
+
+ b) Requiring preservation of specified reasonable legal notices or
+ author attributions in that material or in the Appropriate Legal
+ Notices displayed by works containing it; or
+
+ c) Prohibiting misrepresentation of the origin of that material, or
+ requiring that modified versions of such material be marked in
+ reasonable ways as different from the original version; or
+
+ d) Limiting the use for publicity purposes of names of licensors or
+ authors of the material; or
+
+ e) Declining to grant rights under trademark law for use of some
+ trade names, trademarks, or service marks; or
+
+ f) Requiring indemnification of licensors and authors of that
+ material by anyone who conveys the material (or modified versions of
+ it) with contractual assumptions of liability to the recipient, for
+ any liability that these contractual assumptions directly impose on
+ those licensors and authors.
+
+ All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10. If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term. If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+ If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+ Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+ 8. Termination.
+
+ You may not propagate or modify a covered work except as expressly
+provided under this License. Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+ However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+ Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+ Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License. If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+ 9. Acceptance Not Required for Having Copies.
+
+ You are not required to accept this License in order to receive or
+run a copy of the Program. Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance. However,
+nothing other than this License grants you permission to propagate or
+modify any covered work. These actions infringe copyright if you do
+not accept this License. Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+ 10. Automatic Licensing of Downstream Recipients.
+
+ Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License. You are not responsible
+for enforcing compliance by third parties with this License.
+
+ An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations. If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+ You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License. For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+ 11. Patents.
+
+ A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The
+work thus licensed is called the contributor's "contributor version".
+
+ A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version. For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+ Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+ In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement). To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+ If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+ If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+ A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License. You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+ Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+ 12. No Surrender of Others' Freedom.
+
+ If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all. For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+ 13. Use with the GNU Affero General Public License.
+
+ Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work. The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+ 14. Revised Versions of this License.
+
+ The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time. Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+ Each version is given a distinguishing version number. If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation. If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+ If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+ Later license versions may give you additional or different
+permissions. However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+ 15. Disclaimer of Warranty.
+
+ THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+ 16. Limitation of Liability.
+
+ IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+ 17. Interpretation of Sections 15 and 16.
+
+ If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+ END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Programs
+
+ If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+ To do so, attach the following notices to the program. It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+ {one line to give the program's name and a brief idea of what it does.}
+ Copyright (C) {year} {name of author}
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see .
+
+Also add information on how to contact you by electronic and paper mail.
+
+ If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+ {project} Copyright (C) {year} {fullname}
+ This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+ This is free software, and you are welcome to redistribute it
+ under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License. Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+ You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+.
+
+ The GNU General Public License does not permit incorporating your program
+into proprietary programs. If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library. If this is what you want to do, use the GNU Lesser General
+Public License instead of this License. But first, please read
+.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..206698f
--- /dev/null
+++ b/README.md
@@ -0,0 +1,40 @@
+# Overview
+Dumplib is a helper tool to create import libraries (.lib files) with correct `extern "C"` name decorations for **x86** PE files compiled by MSVC. (This means not x64 because x64 files do not have decorated export names; for x64, see Remarks below.) Its main use is to allow creating import libraries for DLLs for which no import library is available, and to customize existing import libraries, e.g. to remove unwanted exports that cause linker collisions.
+
+Dumplib mostly just applies a bunch of regexes and hacks. Most of the actual work is done by `dumpbin.exe` which generates the export listing dumplib parses. Executing dumplib generates three files:
+- A **.cpp** file containing dummy function definitions;
+- A **.def** file containing the names and ordinals of functions to be exported;
+- A **.bat** file to invoke the compiler and linker to produce a (useless) DLL file and the import library for it, which will be compatible with the original DLL and can be linked against.
+
+# Usage
+1. Create an export listing of the target file using the **x86** version of `dumpbin`. To do so, open a 'VS2017 **x86** Native Tools Command Prompt' (or similar depending on your version). Note the part that says **x86**, this is important because each tool invoked from this prompt will generate a different (wrong) output in x64 mode. Assuming you want to create an import library for `ucrtbase.dll`, execute `dumpbin /EXPORTS ucrtbase.dll > ucrtbase-exports.txt`.
+2. Execute `dumplib ucrtbase-exports.txt ucrtbase.dll`. The second argument supplies the name of the executable to be generated, which will usually be the same as the original, but can be changed if desired.
+3. Depending on the size and complexity of your file, you may see a number of warnings scroll by. If you missed the part that said to open an **x86** prompt, this number will be large. Otherwise, take note of what, if anything, was not parsed correctly so you can make manual fixups later if needed.
+4. The aforementioned three files (.cpp, .def, .bat) should now be present in the directory. You can edit these to remove any declarations you don't want. Removing the declaration from the .def file is sufficient for this.
+5. Once you are done, open the .bat file in notepad to modify the first path to point to the same batch file you used to open the VS command prompt. The other filenames and paths should already be correct.
+6. Run the .bat file.
+7. There should now be an `output` directory (to prevent accidental overwriting of the input files) containing your import library and DLL.
+
+# Remarks
+- Dumplib does not and will not ever parse C++ exports. It is intended for Windows system files, which tend to use `extern "C"` exports. `Dumpbin` on the other hand **does** undecorate C++ function names, so if your DLL has a small number of C++ functions it is still possible to do this with some added manual copy and paste work (this is why dumpbin generates .cpp files, not .c). I am not interested in adding support for this however.
+- The 'x64 version' of dumplib is significantly more ghetto and fits in this README, because `extern "C"` declarations are not decorated by MSVC on x64. The following batch file will suffice in most cases:
+ ```Batch
+ @echo off
+ call "C:\Program Files (x86)\Microsoft Visual Studio\2017\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
+
+ dumpbin /EXPORTS "%1" > %2-exports.txt
+
+ echo LIBRARY %2 > %2-exports.def
+ echo EXPORTS >> %2-exports.def
+ for /f "skip=19 tokens=4" %%a in (%2-exports.txt) do (
+ if "%%a" NEQ "" echo %%a>> %2-exports.def
+ )
+
+ lib /nologo /DEF:%2-exports.def /OUT:%2.lib /MACHINE:X64
+
+ del %2.exp 1>nul
+ pause
+ ```
+ Example usage: `dumplib.bat C:\Windows\System32\ntdll.dll ntdll.dll`. It should hopefully be clear that the first path should in fact point to the **x64** version of your VS vars batch file this time.
+
+ One limitation of this method compared to dumplib is that it does not understand forward exports. I may add some minimal amount of x64 support in the future to correct this.
diff --git a/dumplib.sln b/dumplib.sln
new file mode 100644
index 0000000..d25f91f
--- /dev/null
+++ b/dumplib.sln
@@ -0,0 +1,27 @@
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 15
+VisualStudioVersion = 15.0.26430.12
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "dumplib", "src\dumplib.vcxproj", "{1AB1CEE9-8C5D-4923-BF2F-661A01894EF1}"
+EndProject
+Global
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
+ Debug|Win32 = Debug|Win32
+ Debug|x64 = Debug|x64
+ Release|Win32 = Release|Win32
+ Release|x64 = Release|x64
+ EndGlobalSection
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
+ {1AB1CEE9-8C5D-4923-BF2F-661A01894EF1}.Debug|Win32.ActiveCfg = Debug|Win32
+ {1AB1CEE9-8C5D-4923-BF2F-661A01894EF1}.Debug|Win32.Build.0 = Debug|Win32
+ {1AB1CEE9-8C5D-4923-BF2F-661A01894EF1}.Debug|x64.ActiveCfg = Debug|x64
+ {1AB1CEE9-8C5D-4923-BF2F-661A01894EF1}.Debug|x64.Build.0 = Debug|x64
+ {1AB1CEE9-8C5D-4923-BF2F-661A01894EF1}.Release|Win32.ActiveCfg = Release|Win32
+ {1AB1CEE9-8C5D-4923-BF2F-661A01894EF1}.Release|Win32.Build.0 = Release|Win32
+ {1AB1CEE9-8C5D-4923-BF2F-661A01894EF1}.Release|x64.ActiveCfg = Release|x64
+ {1AB1CEE9-8C5D-4923-BF2F-661A01894EF1}.Release|x64.Build.0 = Release|x64
+ EndGlobalSection
+ GlobalSection(SolutionProperties) = preSolution
+ HideSolutionNode = FALSE
+ EndGlobalSection
+EndGlobal
diff --git a/src/dumplib.exe.manifest b/src/dumplib.exe.manifest
new file mode 100644
index 0000000..48bb952
--- /dev/null
+++ b/src/dumplib.exe.manifest
@@ -0,0 +1,29 @@
+
+
+
+ Import library generator for x86
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/src/dumplib.vcxproj b/src/dumplib.vcxproj
new file mode 100644
index 0000000..39d8d3a
--- /dev/null
+++ b/src/dumplib.vcxproj
@@ -0,0 +1,229 @@
+
+
+
+
+ Debug
+ Win32
+
+
+ Release
+ Win32
+
+
+ Debug
+ x64
+
+
+ Release
+ x64
+
+
+
+ {1AB1CEE9-8C5D-4923-BF2F-661A01894EF1}
+ Win32Proj
+ NtCreateUserProcess
+ 10.0.15063.0
+
+
+
+ Application
+ true
+ v141_xp
+
+
+
+ Application
+ false
+ v141_xp
+ true
+
+
+
+ Application
+ true
+ v141_xp
+
+
+
+ Application
+ false
+ v141_xp
+ true
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ false
+ $(SolutionDir)bin\
+ obj\$(Platform)-$(Configuration)\
+ false
+
+
+ false
+ $(SolutionDir)bin\
+ obj\$(Platform)-$(Configuration)\
+ false
+
+
+ false
+ $(SolutionDir)bin\
+ obj\$(Platform)-$(Configuration)\
+ false
+
+
+ false
+ $(SolutionDir)bin\
+ obj\$(Platform)-$(Configuration)\
+ false
+
+
+
+ NotUsing
+ Disabled
+ WINVER=0x0501;_WIN32_WINNT=0x0501;NTDDI_VERSION=0x05010000;WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ ProgramDatabase
+ true
+ false
+ false
+ stdcpplatest
+ /permissive- /Gw %(AdditionalOptions)
+ Caret
+ MultiThreadedDebug
+ false
+ true
+ Level3
+
+
+ Console
+ true
+
+ true
+ 5.01
+ 5.01
+ true
+ true
+
+
+
+
+ NotUsing
+ Disabled
+ WINVER=0x0502;_WIN32_WINNT=0x0502;NTDDI_VERSION=0x05020000;_WIN64;_AMD64_;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ ProgramDatabase
+ true
+ false
+ false
+ stdcpplatest
+ /permissive- /Gw %(AdditionalOptions)
+ Caret
+ MultiThreadedDebug
+ false
+ true
+ Level3
+
+
+ Console
+ true
+
+ true
+ 5.02
+ 5.02
+ true
+ true
+
+
+
+
+ NotUsing
+ true
+ true
+ WINVER=0x0501;_WIN32_WINNT=0x0501;NTDDI_VERSION=0x05010000;WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+ false
+ false
+ ProgramDatabase
+ stdcpplatest
+ /permissive- /Gw %(AdditionalOptions)
+ Caret
+ MultiThreaded
+ false
+ Level3
+
+
+ Console
+ true
+ true
+ true
+ UseLinkTimeCodeGeneration
+
+
+
+ true
+ 5.01
+ 5.01
+ .rdata=.text
+
+
+
+
+ NotUsing
+ true
+ true
+ WINVER=0x0502;_WIN32_WINNT=0x0502;NTDDI_VERSION=0x05020000;_WIN64;_AMD64_;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
+ true
+ false
+ false
+ true
+ ProgramDatabase
+ stdcpplatest
+ /permissive- /Gw %(AdditionalOptions)
+ Caret
+ MultiThreaded
+ false
+ Level3
+
+
+ Console
+ true
+ true
+ true
+ UseLinkTimeCodeGeneration
+
+
+
+ true
+ 5.02
+ 5.02
+ .rdata=.text
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/src/dumplib.vcxproj.filters b/src/dumplib.vcxproj.filters
new file mode 100644
index 0000000..24bfa37
--- /dev/null
+++ b/src/dumplib.vcxproj.filters
@@ -0,0 +1,28 @@
+
+
+
+
+ {93BA8950-095D-4405-ADC6-8B3AEFCE752C}
+ cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
+
+
+ {0963FE89-D375-413D-A0DB-F8B58AFB7ED6}
+ rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
+
+
+
+
+ Source Files
+
+
+
+
+ Resource Files
+
+
+
+
+ Resource Files
+
+
+
\ No newline at end of file
diff --git a/src/main.cpp b/src/main.cpp
new file mode 100644
index 0000000..beed81e
--- /dev/null
+++ b/src/main.cpp
@@ -0,0 +1,402 @@
+#include
+#include
+#include
+#include
+#include
+
+enum class CallingConvention
+{
+ Cdecl, // _Name
+ Stdcall, // _Name@4
+ Fastcall // @Name@4
+};
+
+struct Export
+{
+ bool ExternC; // Normally true, but compiling as .cpp allows manually adding C++ exports
+ CallingConvention CallingConvention; // Cdecl for data exports
+ std::string Name; // Undecorated function name
+ unsigned int NumberOfParameters;
+ unsigned int Ordinal;
+ bool NoName;
+ bool IsIntrinsic;
+ bool IsForwardExport;
+ std::string ForwardDllName;
+ std::string ForwardFunctionName;
+
+ explicit Export(unsigned int ordinal)
+ : ExternC(true),
+ CallingConvention(CallingConvention::Cdecl),
+ NumberOfParameters(0),
+ Ordinal(ordinal),
+ NoName(false),
+ IsIntrinsic(false),
+ IsForwardExport(false)
+ {}
+};
+
+static const std::unordered_set Intrinsics // Known disallowed function names in MSVC
+{
+ "_abnormal_termination",
+ "_setjmp",
+ "_setjmpex",
+ "atexit"
+};
+
+static std::unordered_set ForwardLibs;
+
+// MS says PathRemoveFileSpec is unsafe and that I should upgrade to Windows 8/10 for PathCchRemoveFileSpec. Hmmm
+static std::string BaseDir(const std::string& absolutePath)
+{
+ for (size_t i = absolutePath.length() - 1; i >= 1; --i)
+ {
+ if (absolutePath[i] == '\\')
+ return std::string(absolutePath, 0, i);
+ }
+ return "";
+}
+
+static bool ReadDumpbinOutput(const std::string& filename, const std::string& libraryFilename, std::vector& exports)
+{
+ std::ifstream file(filename);
+ if (!file.is_open())
+ {
+ fprintf(stderr, "Failed to open %s for reading\n", filename.c_str());
+ return false;
+ }
+
+ const std::regex exportRegex("([0-9]+) (.+) ([0-9A-F]*) (.+)");
+ // ord hint (RVA) decorated name
+
+ const std::regex stdcallOrFastcallRegex("(.+) = (_|@)(.+)@([0-9]+)"); // AlpcGetHeaderSize = _AlpcGetHeaderSize@4
+ const std::regex cdeclOrDataRegex("(.+) = (_|@)(.+)"); // wcstoul = _wcstoul
+ const std::regex noNameRegex("\\[NONAME\\] (_|@)(.+)@([0-9]+)"); // [NONAME] _ZwCreateUserProcess@44
+
+ std::string line;
+ int i = 0;
+ while (std::getline(file, line))
+ {
+ i++;
+ if (i < 20) // dumpbin /EXPORT always generates 20 header lines
+ continue;
+
+ std::smatch exportMatches;
+ if (!std::regex_search(line, exportMatches, exportRegex))
+ break; // End of export listing
+
+ // We have the ordinal and something resembling a name
+ Export e(atoi(exportMatches[1].str().c_str()));
+ std::string decoratedName = exportMatches[4].str();
+
+ // Handle forwards first
+ if (decoratedName.find(" (forwarded to") != std::string::npos)
+ {
+ e.IsForwardExport = true;
+
+ // We have a forward export. This means we have to link against the .lib
+ // of the DLL that exports the function. Possibilities from best to worst:
+ const std::regex forwardedToDllRegex("(.+) \\(forwarded to (\\w+)\\.(.+)\\)");
+ const std::regex forwardedToNonsense1Regex("(.+) \\(forwarded to api-ms-win-\\w+(.+)\\.(.+)\\)",
+ std::regex_constants::icase);
+ const std::regex forwardedToNonsense2Regex("(.+) \\(forwarded to api-ms-win-crt(.+)\\.(.+)\\)",
+ std::regex_constants::icase);
+
+ std::smatch forwardNameMatches;
+ if (std::regex_search(decoratedName, forwardNameMatches, forwardedToDllRegex))
+ {
+ // Forward to a proper DLL. Usually this is either ntdll or KernelBase
+ e.Name = forwardNameMatches[1].str();
+ e.ForwardDllName = forwardNameMatches[2].str();
+ e.ForwardFunctionName = forwardNameMatches[3].str();
+ printf("%s forwards to %s.%s\n", e.Name.c_str(),
+ e.ForwardDllName.c_str(), e.ForwardFunctionName.c_str());
+ }
+ else if (!std::regex_search(decoratedName, forwardNameMatches, forwardedToNonsense2Regex) &&
+ std::regex_search(decoratedName, forwardNameMatches, forwardedToNonsense1Regex))
+ {
+ // Forward to a DLL that forwards to another DLL. This is why Unix people laugh at us
+ e.Name = forwardNameMatches[1].str();
+ e.ForwardDllName = forwardNameMatches[2].str();
+ e.ForwardFunctionName = forwardNameMatches[3].str();
+ if (e.ForwardDllName.find("rtlsupport-") != std::string::npos) // This one is easy
+ e.ForwardDllName = "NTDLL";
+ else
+ {
+ // Try kernel32.dll by default, unless that's what we're creating the .lib of.
+ // Note: if you're creating kernel32.lib, you need to make kernelbase.lib first, and that's
+ // actually probably only mostly correct since the api-ms crap points to kernel32.
+ e.ForwardDllName = libraryFilename == "kernel32.dll" ? "kernelbase" : "kernel32";
+ }
+ printf("%s forwards to api-ms-win-core%s.%s\n", e.Name.c_str(),
+ forwardNameMatches[2].str().c_str(), e.ForwardFunctionName.c_str());
+ }
+ else if (std::regex_search(decoratedName, forwardNameMatches, forwardedToNonsense2Regex))
+ {
+ // Forward to an MSVC or UCRT runtime DLL that forwards to (probably) ucrtbase.dll,
+ // which itself only has forward imports of the previous kind. Good luck
+ // Leaving the BS DLL name in the .def and linking against ucrt.lib and/or removing /NODEFAULTLIB may work.
+ // Linking in "ucrtbase.lib" will fail for sure since it doesn't exist, but you could make it with dumplib...
+ e.Name = forwardNameMatches[1].str();
+ e.ForwardDllName = forwardNameMatches[2].str();
+ e.ForwardFunctionName = forwardNameMatches[3].str();
+ e.ForwardDllName = "ucrtbase";
+ printf("!!! ACHTUNG !!! %s forwards to api-ms-win-crt%s.%s !!!\n", e.Name.c_str(),
+ forwardNameMatches[2].str().c_str(), e.ForwardFunctionName.c_str());
+ }
+ else
+ {
+ fprintf(stderr, "Failed to parse forward export name \"%s\".\n", decoratedName.c_str());
+ continue;
+ }
+
+ std::string libName = e.ForwardDllName == "ucrtbase" ? "ucrt" : e.ForwardDllName;
+ std::transform(libName.begin(), libName.end(), libName.begin(), ::tolower);
+ if (ForwardLibs.insert(libName).second)
+ printf("Added %s.lib to the linker input files.\n", libName.c_str());
+ }
+ else
+ {
+ // Non-forward export. Figure out by regex what kind of calling convention and name we have
+ std::smatch nameMatches;
+ if (std::regex_search(decoratedName, nameMatches, stdcallOrFastcallRegex))
+ {
+ // Named stdcall/fastcall export
+ e.Name = nameMatches[1].str();
+ e.CallingConvention = nameMatches[2].str().c_str()[0] == '@'
+ ? CallingConvention::Fastcall : CallingConvention::Stdcall;
+ e.NumberOfParameters = atoi(nameMatches[4].str().c_str()) / 4;
+ }
+ else if (std::regex_search(decoratedName, nameMatches, cdeclOrDataRegex))
+ {
+ // Named data or cdecl export
+ e.Name = nameMatches[1].str();
+ e.CallingConvention = CallingConvention::Cdecl;
+
+ }
+ else if (std::regex_search(decoratedName, nameMatches, noNameRegex))
+ {
+ // NONAME export. Fix up the name and find the calling convention
+ e.CallingConvention = nameMatches[1].str().c_str()[0] == '@'
+ ? CallingConvention::Fastcall : CallingConvention::Stdcall;
+ e.Name = nameMatches[2].str();
+ e.NumberOfParameters = atoi(nameMatches[3].str().c_str()) / 4;
+ e.NoName = true;
+ }
+ else
+ {
+ // This can happen if the decorated name *doesn't* have a prefix. Examples:
+ // 'ExFetchLicenseData' and 'Kei386EoiHelper = Kei386EoiHelper@0' in ntoskrnl.exe
+ // If you really need the export you can probably declare its public name using [M|N]ASM.
+ // C++ declarations are another example but easy to do (dumpbin already undecorates them)
+ fprintf(stderr, "Failed to parse export name \"%s\".\n", decoratedName.c_str());
+ continue;
+ }
+ }
+
+ if (Intrinsics.find(e.Name) != Intrinsics.end())
+ e.IsIntrinsic = true;
+
+ exports.push_back(e);
+ }
+ return true;
+}
+
+static bool CreateCppFile(const char *filename, const std::vector& exports)
+{
+ std::ofstream file(filename);
+ if (!file.is_open())
+ {
+ fprintf(stderr, "Failed to open %s for writing\n", filename);
+ return false;
+ }
+
+ for (auto const& e : exports)
+ {
+ if (e.IsForwardExport)
+ continue;
+
+ std::string declaration = e.ExternC ? "extern \"C\" " : "";
+ declaration += "int ";
+
+ // MSVC doesn't allow certain names. Hack pt. 1
+ std::string name = e.IsIntrinsic ? "_INTRINSIC_" + e.Name : e.Name;
+
+ if (e.CallingConvention == CallingConvention::Cdecl)
+ {
+ // Cdecl function or data export. The name decoration will be a leading underscore only
+ declaration += " __cdecl " + name + "(";
+ }
+ else
+ {
+ // Fastcall or stdcall function
+ declaration += (e.CallingConvention == CallingConvention::Fastcall
+ ? "__fastcall "
+ : "__stdcall ") +
+ name + "(";
+
+ // Add some number of parameters to match the decorated name:
+ // _AlpcGetMessageAttribute@8 -> AlpcGetMessageAttribute(int, int)
+ std::string params;
+ for (unsigned int i = 0; i < e.NumberOfParameters; ++i)
+ {
+ params += "int";
+ if (i != e.NumberOfParameters - 1)
+ params += ", ";
+ }
+ declaration += params;
+ }
+
+ // Make the return value the export ordinal, to prevent the compiler
+ // from optimizing all exports to have the same RVA
+ declaration += ") { return " + std::to_string(e.Ordinal) + "; }";
+
+ file << declaration << std::endl;
+ }
+ return true;
+}
+
+static bool CreateDefFile(const char *filename, const char* libraryName, const std::vector& exports)
+{
+ std::ofstream file(filename);
+ if (!file.is_open())
+ {
+ fprintf(stderr, "Failed to open %s for writing\n", filename);
+ return false;
+ }
+
+ // Reference: https://msdn.microsoft.com/en-us/library/hyx1zcd3.aspx
+ file << "LIBRARY " << libraryName << std::endl;
+ file << "EXPORTS" << std::endl;
+
+ for (auto const& e : exports)
+ {
+ // It's tempting to add the ordinal here to get correct import hints for the speedup (literally microseconds!)
+ // Unfortunately MS decided that declaring the ordinal number also removes the name from the export table
+ std::string declaration = "\t" + e.Name;
+
+ if (e.IsForwardExport)
+ declaration += " = " + e.ForwardDllName + "." + e.ForwardFunctionName;
+ else if (e.IsIntrinsic)
+ declaration += " = _INTRINSIC_" + e.Name; // Hack pt. 2
+
+ if (e.NoName)
+ {
+ // If this is specified the ordinal *has* to be added and correct because it's the only way to
+ // import the function (or GetProcAddress the ordinal - either way requires it to be correct)
+ declaration += " @" + std::to_string(e.Ordinal) + " NONAME";
+ }
+ file << declaration << std::endl;
+ }
+ return true;
+}
+
+static bool CreateBatFile(const char *filename, const char *dumpbinInputFilename, const char* libraryName)
+{
+ std::ofstream file(filename);
+ if (!file.is_open())
+ {
+ fprintf(stderr, "Failed to open %s for writing\n", filename);
+ return false;
+ }
+
+ std::string libs;
+ for (auto const& lib : ForwardLibs)
+ libs += "\"" + lib + ".lib\" ";
+
+ file << "@echo off" << std::endl << std::endl;
+ file << ":: Set your *32 bit* VS vars path here. The rest should already be correct" << std::endl;
+ file << "set VCVARSFILE=C:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\"
+ "Enterprise\\VC\\Auxiliary\\Build\\vcvars32.bat" << std::endl;
+ file << "set WORKDIR=" << BaseDir(filename) << std::endl;
+ file << "set CFILE=" << dumpbinInputFilename << ".cpp" << std::endl;
+ file << "set DEFFILE=" << dumpbinInputFilename << ".def" << std::endl;
+ file << "set LIBS=" << libs << std::endl;
+ file << "set OUTPUTFILE=" << libraryName << std::endl << std::endl;
+
+ file << "call \"%VCVARSFILE%\"" << std::endl;
+ file << "rd /S /Q output 1>nul 2>&1" << std::endl;
+ file << "mkdir output" << std::endl << std::endl;
+
+ // Most flags below don't affect the .lib and are only meant to make the PE file as simple as possible
+ // and make it easier to inspect. /NOCOFFGRPINFO kills the debug directory (needed for >= VS2015)
+ file << "cl /nologo /c /MT /W4 /O1 /Os /GS- /guard:cf- \"%CFILE%\" /Fo\"%WORKDIR%\\output\\main.obj\"" << std::endl;
+ file << "link /nologo /OUT:\"%WORKDIR%\\output\\%OUTPUTFILE%\" %LIBS% " <<
+ "/IMPLIB:\"%WORKDIR%\\output\\%OUTPUTFILE%.lib\" /DLL /NOCOFFGRPINFO " <<
+ "/MACHINE:X86 /SAFESEH /INCREMENTAL:NO /DEF:\"%WORKDIR%\\%DEFFILE%\" " <<
+ "\"%WORKDIR%\\output\\main.obj\" /NODEFAULTLIB /NOENTRY /MERGE:.rdata=.text" << std::endl;
+ file << "if %ERRORLEVEL% NEQ 0 goto drats" << std::endl << std::endl;
+
+ file << "del output\\*.exp 1>nul" << std::endl;
+ file << "del output\\main.obj 1>nul" << std::endl;
+ file << "echo." << std::endl;
+ file << "echo Your .lib file is ready sir/madam. It can be found at output\\%OUTPUTFILE%.lib." << std::endl;
+ file << "goto end" << std::endl << std::endl;
+
+ file << ":drats" << std::endl;
+ file << "echo." << std::endl;
+ file << "echo The compiler failed to do its job! Disgusting, sad!" << std::endl << std::endl;
+
+ file << ":end" << std::endl;
+ file << "echo." << std::endl;
+ file << "pause" << std::endl;
+
+ return true;
+}
+
+int main(int argc, char **argv)
+{
+ if (argc != 3)
+ {
+ printf("Usage: dumplib \n\n");
+ printf("Where was created with the x86 version of dumpbin using:\n");
+ printf("dumpbin /EXPORTS file.dll > \n\n");
+ printf("Example: dumplib ntdll-exports.txt ntdll.dll\n");
+ return 0;
+ }
+
+ const char *libraryFilename = argv[2];
+ char absDumpbinPath[4096];
+ if (GetFullPathNameA(argv[1], 4096, absDumpbinPath, nullptr) == 0)
+ {
+ fprintf(stderr, "GetFullPathName(\"%s\"): error %d\n", argv[1], GetLastError());
+ return -1;
+ }
+
+ char drive[_MAX_DRIVE], dir[_MAX_DIR], dumpbinFilename[_MAX_FNAME], ext[_MAX_EXT];
+ auto err = _splitpath_s(absDumpbinPath, drive, dir, dumpbinFilename, ext);
+ if (err != 0)
+ {
+ fprintf(stderr, "_splitpath_s(\"%s\"): error %d\n", absDumpbinPath, err);
+ return err;
+ }
+
+ printf("Reading dumpbin output from %s%s...\n", dumpbinFilename, ext);
+ std::vector exports;
+ if (!ReadDumpbinOutput(absDumpbinPath, libraryFilename, exports))
+ return -1;
+ if (exports.size() == 0)
+ {
+ fprintf(stderr, "No exports found. Did you use the x86 version of dumpbin?");
+ return -1;
+ }
+ printf("Parsed %zu exports.\n", exports.size());
+
+ char cPath[MAX_PATH], defPath[MAX_PATH], batPath[MAX_PATH];
+ _makepath_s(cPath, drive, dir, dumpbinFilename, ".cpp");
+ _makepath_s(defPath, drive, dir, dumpbinFilename, ".def");
+ _makepath_s(batPath, drive, dir, dumpbinFilename, ".bat");
+
+ printf("\nCreating C++ file %s.cpp...\n", dumpbinFilename);
+ if (!CreateCppFile(cPath, exports))
+ return -1;
+ printf("Creating exports file %s.def...\n", dumpbinFilename);
+ if (!CreateDefFile(defPath, libraryFilename, exports))
+ return -1;
+ printf("Creating .bat compilation file %s.bat...\n", dumpbinFilename);
+ if (!CreateBatFile(batPath, dumpbinFilename, libraryFilename))
+ return -1;
+
+ printf("\nGreat success! You can modify the .cpp/.def files now to remove unwanted exports if needed.\n");
+ printf("When finished, edit and run the .bat file to generate the import library.\n");
+ return 0;
+}
diff --git a/src/resource.rc b/src/resource.rc
new file mode 100644
index 0000000..f8e0aff
--- /dev/null
+++ b/src/resource.rc
@@ -0,0 +1,58 @@
+// Microsoft Visual C++ generated resource script.
+//
+#define ISOLATION_AWARE_ENABLED 1
+#include "winres.h"
+
+/////////////////////////////////////////////////////////////////////////////
+// English (United States) resources
+
+#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_NEU)
+LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
+
+/////////////////////////////////////////////////////////////////////////////
+//
+// Manifest
+//
+1 RT_MANIFEST "dumplib.exe.manifest"
+
+
+/////////////////////////////////////////////////////////////////////////////
+//
+// Version
+//
+
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION 1,0,0,0
+ PRODUCTVERSION 1,0,0,0
+ FILEFLAGSMASK 0x3fL
+#ifdef _DEBUG
+ FILEFLAGS 0x1L
+#else
+ FILEFLAGS 0x0L
+#endif
+ FILEOS 0x40004L
+ FILETYPE 0x1L
+ FILESUBTYPE 0x0L
+BEGIN
+ BLOCK "StringFileInfo"
+ BEGIN
+ BLOCK "040904B0"
+ BEGIN
+ VALUE "CompanyName", ""
+ VALUE "FileDescription", "dumplib"
+ VALUE "FileVersion", "1.0.0.0"
+ VALUE "InternalName", "dumplib"
+ VALUE "LegalCopyright", "Mattiwatti"
+ VALUE "OriginalFilename", "dumplib.exe"
+ VALUE "ProductName", "Import library generator for x86"
+ VALUE "ProductVersion", "1.0.0.0"
+ END
+ END
+ BLOCK "VarFileInfo"
+ BEGIN
+ VALUE "Translation", 0x409, 1200
+ END
+END
+
+#endif // English (United States) resources
+/////////////////////////////////////////////////////////////////////////////
diff --git a/test/ntdll-exports.txt b/test/ntdll-exports.txt
new file mode 100644
index 0000000..165879a
--- /dev/null
+++ b/test/ntdll-exports.txt
@@ -0,0 +1,2317 @@
+Microsoft (R) COFF/PE Dumper Version 14.10.25019.0
+Copyright (C) Microsoft Corporation. All rights reserved.
+
+
+Dump of file ntdll.dll
+
+File Type: DLL
+
+ Section contains the following exports for ntdll.dll
+
+ 00000000 characteristics
+ FAC1B314 time date stamp
+ 0.00 version
+ 8 ordinal base
+ 2288 number of functions
+ 2288 number of names
+
+ ordinal hint RVA name
+
+ 18 0 0006F5E0 A_SHAFinal = _A_SHAFinal@8
+ 19 1 000A63D0 A_SHAInit = _A_SHAInit@4
+ 20 2 00070270 A_SHAUpdate = _A_SHAUpdate@12
+ 21 3 000D7240 AlpcAdjustCompletionListConcurrencyCount = _AlpcAdjustCompletionListConcurrencyCount@8
+ 22 4 00072DA0 AlpcFreeCompletionListMessage = _AlpcFreeCompletionListMessage@8
+ 23 5 000D7270 AlpcGetCompletionListLastMessageInformation = _AlpcGetCompletionListLastMessageInformation@12
+ 24 6 000D72A0 AlpcGetCompletionListMessageAttributes = _AlpcGetCompletionListMessageAttributes@8
+ 25 7 00076EE0 AlpcGetHeaderSize = _AlpcGetHeaderSize@4
+ 26 8 00076EA0 AlpcGetMessageAttribute = _AlpcGetMessageAttribute@8
+ 27 9 0003C420 AlpcGetMessageFromCompletionList = _AlpcGetMessageFromCompletionList@8
+ 28 A 00082EC0 AlpcGetOutstandingCompletionListMessageCount = _AlpcGetOutstandingCompletionListMessageCount@4
+ 29 B 00076E60 AlpcInitializeMessageAttribute = _AlpcInitializeMessageAttribute@16
+ 30 C 00087110 AlpcMaxAllowedMessageLength = _AlpcMaxAllowedMessageLength@0
+ 31 D 00087AF0 AlpcRegisterCompletionList = _AlpcRegisterCompletionList@20
+ 32 E 00074160 AlpcRegisterCompletionListWorkerThread = _AlpcRegisterCompletionListWorkerThread@4
+ 33 F 00088430 AlpcRundownCompletionList = _AlpcRundownCompletionList@4
+ 34 10 00088470 AlpcUnregisterCompletionList = _AlpcUnregisterCompletionList@4
+ 35 11 00073580 AlpcUnregisterCompletionListWorkerThread = _AlpcUnregisterCompletionListWorkerThread@4
+ 36 12 0007B530 ApiSetQueryApiSetPresence = _ApiSetQueryApiSetPresence@8
+ 37 13 000562E0 CsrAllocateCaptureBuffer = _CsrAllocateCaptureBuffer@8
+ 38 14 00056290 CsrAllocateMessagePointer = _CsrAllocateMessagePointer@12
+ 39 15 000560E0 CsrCaptureMessageBuffer = _CsrCaptureMessageBuffer@16
+ 40 16 00056130 CsrCaptureMessageMultiUnicodeStringsInPlace = _CsrCaptureMessageMultiUnicodeStringsInPlace@12
+ 41 17 00056200 CsrCaptureMessageString = _CsrCaptureMessageString@20
+ 42 18 000CBDE0 CsrCaptureTimeout = _CsrCaptureTimeout@8
+ 43 19 00055F70 CsrClientCallServer = _CsrClientCallServer@16
+ 44 1A 00054990 CsrClientConnectToServer = _CsrClientConnectToServer@20
+ 45 1B 00083B90 CsrFreeCaptureBuffer = _CsrFreeCaptureBuffer@4
+ 46 1C 000CBE10 CsrGetProcessId = _CsrGetProcessId@0
+ 47 1D 0004F490 CsrIdentifyAlertableThread = _CsrIdentifyAlertableThread@0
+ 48 1E 000CFE00 CsrSetPriorityClass = _CsrSetPriorityClass@8
+ 49 1F 000CBE30 CsrVerifyRegion = _CsrVerifyRegion@8
+ 50 20 00094160 DbgBreakPoint = _DbgBreakPoint@0
+ 51 21 00066FF0 DbgPrint = _DbgPrint
+ 52 22 00066FC0 DbgPrintEx = _DbgPrintEx
+ 53 23 000D72E0 DbgPrintReturnControlC = _DbgPrintReturnControlC
+ 54 24 000D7310 DbgPrompt = _DbgPrompt@12
+ 55 25 000D7360 DbgQueryDebugFilterState = _DbgQueryDebugFilterState@8
+ 56 26 000D7370 DbgSetDebugFilterState = _DbgSetDebugFilterState@12
+ 57 27 000CCD80 DbgUiConnectToDbg = _DbgUiConnectToDbg@0
+ 58 28 000CCDE0 DbgUiContinue = _DbgUiContinue@8
+ 59 29 000CCE10 DbgUiConvertStateChangeStructure = _DbgUiConvertStateChangeStructure@8
+ 60 2A 000CCE30 DbgUiConvertStateChangeStructureEx = _DbgUiConvertStateChangeStructureEx@8
+ 61 2B 000CD030 DbgUiDebugActiveProcess = _DbgUiDebugActiveProcess@4
+ 62 2C 000CD080 DbgUiGetThreadDebugObject = _DbgUiGetThreadDebugObject@0
+ 63 2D 000CD0A0 DbgUiIssueRemoteBreakin = _DbgUiIssueRemoteBreakin@4
+ 64 2E 000CD0F0 DbgUiRemoteBreakin = _DbgUiRemoteBreakin@4
+ 65 2F 000CD150 DbgUiSetThreadDebugObject = _DbgUiSetThreadDebugObject@4
+ 66 30 000CD170 DbgUiStopDebugging = _DbgUiStopDebugging@4
+ 67 31 000CD1A0 DbgUiWaitStateChange = _DbgUiWaitStateChange@8
+ 68 32 00094150 DbgUserBreakPoint = _DbgUserBreakPoint@0
+ 69 33 000F7BD0 EtwCreateTraceInstanceId = _EtwCreateTraceInstanceId@8
+ 70 34 00067920 EtwDeliverDataBlock = _EtwDeliverDataBlock@4
+ 71 35 000F7C20 EtwEnumerateProcessRegGuids = _EtwEnumerateProcessRegGuids@12
+ 72 36 000718A0 EtwEventActivityIdControl = _EtwEventActivityIdControl@8
+ 73 37 0006E860 EtwEventEnabled = _EtwEventEnabled@12
+ 74 38 00086560 EtwEventProviderEnabled = _EtwEventProviderEnabled@20
+ 75 39 00049B90 EtwEventRegister = _EtwEventRegister@16
+ 76 3A 00078C80 EtwEventSetInformation = _EtwEventSetInformation@20
+ 77 3B 00066CC0 EtwEventUnregister = _EtwEventUnregister@8
+ 78 3C 00065BF0 EtwEventWrite = _EtwEventWrite@20
+ 79 3D 0006E750 EtwEventWriteEndScenario = _EtwEventWriteEndScenario@20
+ 80 3E 00065BB0 EtwEventWriteEx = _EtwEventWriteEx@40
+ 81 3F 000671A0 EtwEventWriteFull = _EtwEventWriteFull@32
+ 82 40 000858C0 EtwEventWriteNoRegistration = _EtwEventWriteNoRegistration@16
+ 83 41 0008BBC0 EtwEventWriteStartScenario = _EtwEventWriteStartScenario@20
+ 84 42 000F7D20 EtwEventWriteString = _EtwEventWriteString@24
+ 85 43 00065560 EtwEventWriteTransfer = _EtwEventWriteTransfer@28
+ 86 44 00085DC0 EtwGetTraceEnableFlags = _EtwGetTraceEnableFlags@8
+ 87 45 00085DF0 EtwGetTraceEnableLevel = _EtwGetTraceEnableLevel@8
+ 88 46 00084AC0 EtwGetTraceLoggerHandle = _EtwGetTraceLoggerHandle@4
+ 89 47 000664F0 EtwLogTraceEvent = _EtwLogTraceEvent@12
+ 90 48 00048730 EtwNotificationRegister = _EtwNotificationRegister@20
+ 91 49 00066CE0 EtwNotificationUnregister = _EtwNotificationUnregister@12
+ 92 4A 000671E0 EtwProcessPrivateLoggerRequest = _EtwProcessPrivateLoggerRequest@4
+ 93 4B 0008CEB0 EtwRegisterSecurityProvider = _EtwRegisterSecurityProvider@0
+ 94 4C 0006B730 EtwRegisterTraceGuidsA = _EtwRegisterTraceGuidsA@32
+ 95 4D 0006B760 EtwRegisterTraceGuidsW = _EtwRegisterTraceGuidsW@32
+ 96 4E 00067ED0 EtwReplyNotification = _EtwReplyNotification@4
+ 97 4F 00061F50 EtwSendNotification = _EtwSendNotification@20
+ 98 50 000F8030 EtwSetMark = _EtwSetMark@16
+ 99 51 000F8060 EtwTraceEventInstance = _EtwTraceEventInstance@20
+ 100 52 00065850 EtwTraceMessage = _EtwTraceMessage
+ 101 53 00065880 EtwTraceMessageVa = _EtwTraceMessageVa@24
+ 102 54 00066C70 EtwUnregisterTraceGuids = _EtwUnregisterTraceGuids@8
+ 103 55 00083C70 EtwWriteUMSecurityEvent = _EtwWriteUMSecurityEvent@16
+ 104 56 000680E0 EtwpCreateEtwThread = _EtwpCreateEtwThread@8
+ 105 57 000696B0 EtwpGetCpuSpeed = _EtwpGetCpuSpeed@4
+ 106 58 000F88E0 EvtIntReportAuthzEventAndSourceAsync = _EvtIntReportAuthzEventAndSourceAsync@44
+ 107 59 00085970 EvtIntReportEventAndSourceAsync = _EvtIntReportEventAndSourceAsync@44
+ 15 5A 000A5867 ExpInterlockedPopEntrySListEnd = ExpInterlockedPopEntrySListEnd
+ 16 5B 000A5865 ExpInterlockedPopEntrySListFault = ExpInterlockedPopEntrySListFault
+ 17 5C 000A583C ExpInterlockedPopEntrySListResume = ExpInterlockedPopEntrySListResume
+ 108 5D 00094390 KiFastSystemCall = _KiFastSystemCall@0
+ 109 5E 000943A0 KiFastSystemCallRet = _KiFastSystemCallRet@0
+ 110 5F 000943B0 KiIntSystemCall = _KiIntSystemCall@0
+ 111 60 00094300 KiRaiseUserExceptionDispatcher = _KiRaiseUserExceptionDispatcher@0
+ 112 61 00094190 KiUserApcDispatcher = _KiUserApcDispatcher@16
+ 113 62 00094220 KiUserCallbackDispatcher = _KiUserCallbackDispatcher@12
+ 114 63 00094290 KiUserExceptionDispatcher = _KiUserExceptionDispatcher@8
+ 115 64 000A6490 LdrAccessResource = _LdrAccessResource@16
+ 116 65 0008C7D0 LdrAddDllDirectory = _LdrAddDllDirectory@8
+ 117 66 00079CF0 LdrAddLoadAsDataTable = _LdrAddLoadAsDataTable@20
+ 118 67 00060210 LdrAddRefDll = _LdrAddRefDll@8
+ 119 68 000CBE80 LdrAppxHandleIntegrityFailure = _LdrAppxHandleIntegrityFailure@4
+ 120 69 0007BCF0 LdrDisableThreadCalloutsForDll = _LdrDisableThreadCalloutsForDll@4
+ 121 6A 000D73E0 LdrEnumResources = _LdrEnumResources@20
+ 122 6B 00084920 LdrEnumerateLoadedModules = _LdrEnumerateLoadedModules@12
+ 123 6C 00086EB0 LdrFastFailInLoaderCallout = _LdrFastFailInLoaderCallout@0
+ 124 6D 00065280 LdrFindEntryForAddress = _LdrFindEntryForAddress@8
+ 125 6E 000D7620 LdrFindResourceDirectory_U = _LdrFindResourceDirectory_U@16
+ 126 6F 00083AA0 LdrFindResourceEx_U = _LdrFindResourceEx_U@20
+ 127 70 0007BDC0 LdrFindResource_U = _LdrFindResource_U@16
+ 128 71 0008B680 LdrFlushAlternateResourceModules = _LdrFlushAlternateResourceModules@0
+ 129 72 00080720 LdrGetDllDirectory = _LdrGetDllDirectory@4
+ 130 73 0006BAC0 LdrGetDllFullName = _LdrGetDllFullName@8
+ 131 74 00049290 LdrGetDllHandle = _LdrGetDllHandle@16
+ 132 75 0007A360 LdrGetDllHandleByMapping = _LdrGetDllHandleByMapping@8
+ 133 76 0007BD40 LdrGetDllHandleByName = _LdrGetDllHandleByName@12
+ 134 77 000492C0 LdrGetDllHandleEx = _LdrGetDllHandleEx@20
+ 135 78 00050670 LdrGetDllPath = _LdrGetDllPath@16
+ 136 79 000CD520 LdrGetFailureData = _LdrGetFailureData@0
+ 137 7A 000D7650 LdrGetFileNameFromLoadAsDataTable = _LdrGetFileNameFromLoadAsDataTable@8
+ 138 7B 00087090 LdrGetProcedureAddress = _LdrGetProcedureAddress@16
+ 139 7C 0005F490 LdrGetProcedureAddressEx = _LdrGetProcedureAddressEx@20
+ 140 7D 0003D6C0 LdrGetProcedureAddressForCaller = _LdrGetProcedureAddressForCaller@24
+ 141 7E 000CE710 LdrInitShimEngineDynamic = _LdrInitShimEngineDynamic@8
+ 142 7F 00088600 LdrInitializeThunk = _LdrInitializeThunk@8
+ 143 80 00081A50 LdrLoadAlternateResourceModule = _LdrLoadAlternateResourceModule@16
+ 144 81 0002E320 LdrLoadAlternateResourceModuleEx = _LdrLoadAlternateResourceModuleEx@20
+ 145 82 00049090 LdrLoadDll = _LdrLoadDll@16
+ 146 83 00082250 LdrLockLoaderLock = _LdrLockLoaderLock@12
+ 147 84 000D7E00 LdrOpenImageFileOptionsKey = _RtlOpenImageFileOptionsKey@12
+ 148 85 001196E4 LdrParentInterlockedPopEntrySList = _LdrParentInterlockedPopEntrySList
+ 149 86 00119734 LdrParentRtlInitializeNtUserPfn = _LdrParentRtlInitializeNtUserPfn
+ 150 87 00119750 LdrParentRtlResetNtUserPfn = _LdrParentRtlResetNtUserPfn
+ 151 88 00119748 LdrParentRtlRetrieveNtUserPfn = _LdrParentRtlRetrieveNtUserPfn
+ 152 89 000D7F00 LdrProcessRelocationBlock = _LdrProcessRelocationBlock@16
+ 153 8A 000D7F30 LdrProcessRelocationBlockEx = _LdrProcessRelocationBlockEx@20
+ 154 8B 0007B160 LdrQueryImageFileExecutionOptions = _LdrQueryImageFileExecutionOptions@24
+ 155 8C 0007B1A0 LdrQueryImageFileExecutionOptionsEx = _RtlQueryImageFileExecutionOptions@28
+ 156 8D 0007B3D0 LdrQueryImageFileKeyOption = _RtlQueryImageFileKeyOption@24
+ 157 8E 000CD530 LdrQueryModuleServiceTags = _LdrQueryModuleServiceTags@12
+ 158 8F 000CDA10 LdrQueryOptionalDelayLoadedAPI = _LdrQueryOptionalDelayLoadedAPI@16
+ 159 90 00022470 LdrQueryProcessModuleInformation = _LdrQueryProcessModuleInformation@12
+ 160 91 0005D080 LdrRegisterDllNotification = _LdrRegisterDllNotification@16
+ 161 92 0008CD50 LdrRemoveDllDirectory = _LdrRemoveDllDirectory@4
+ 162 93 0007A130 LdrRemoveLoadAsDataTable = _LdrRemoveLoadAsDataTable@16
+ 163 94 000D8340 LdrResFindResource = _LdrResFindResource@36
+ 164 95 00062280 LdrResFindResourceDirectory = _LdrResFindResourceDirectory@28
+ 165 96 00064140 LdrResGetRCConfig = _LdrResGetRCConfig@20
+ 166 97 0008A9C0 LdrResRelease = _LdrResRelease@12
+ 167 98 000622E0 LdrResSearchResource = _LdrResSearchResource@32
+ 168 99 00044230 LdrResolveDelayLoadedAPI = _LdrResolveDelayLoadedAPI@24
+ 169 9A 000CDAF0 LdrResolveDelayLoadsFromDll = _LdrResolveDelayLoadsFromDll@12
+ 170 9B 0002DD40 LdrRscIsTypeExist = _LdrRscIsTypeExist@16
+ 171 9C 000891D0 LdrSetAppCompatDllRedirectionCallback = _CsrpHeapCommitRoutine@12
+ 172 9D 00082560 LdrSetDefaultDllDirectories = _LdrSetDefaultDllDirectories@4
+ 173 9E 000825A0 LdrSetDllDirectory = _LdrSetDllDirectory@4
+ 174 9F 00083F30 LdrSetDllManifestProber = _LdrSetDllManifestProber@12
+ 175 A0 000CD840 LdrSetImplicitPathOptions = _LdrSetImplicitPathOptions@8
+ 176 A1 0008CE50 LdrSetMUICacheType = _LdrSetMUICacheType@4
+ 177 A2 0005DE20 LdrShutdownProcess = _LdrShutdownProcess@0
+ 178 A3 0003CFD0 LdrShutdownThread = _LdrShutdownThread@0
+ 179 A4 0008AAA0 LdrStandardizeSystemPath = _LdrStandardizeSystemPath@4
+ 180 A5 0011A140 LdrSystemDllInitBlock = _LdrSystemDllInitBlock
+ 181 A6 000519A0 LdrUnloadAlternateResourceModule = _LdrUnloadAlternateResourceModule@4
+ 182 A7 000519C0 LdrUnloadAlternateResourceModuleEx = _LdrUnloadAlternateResourceModuleEx@8
+ 183 A8 0004F7E0 LdrUnloadDll = _LdrUnloadDll@4
+ 184 A9 00083640 LdrUnlockLoaderLock = _LdrUnlockLoaderLock@8
+ 185 AA 000CD8A0 LdrUnregisterDllNotification = _LdrUnregisterDllNotification@4
+ 186 AB 000D5E60 LdrUpdatePackageSearchPath = _LdrUpdatePackageSearchPath@4
+ 187 AC 000CD920 LdrVerifyImageMatchesChecksum = _LdrVerifyImageMatchesChecksum@16
+ 188 AD 0008C000 LdrVerifyImageMatchesChecksumEx = _LdrVerifyImageMatchesChecksumEx@8
+ 189 AE 00119754 LdrpChildNtdll = _LdrpChildNtdll
+ 190 AF 00063B40 LdrpResGetMappingSize = _LdrpResGetMappingSize@16
+ 191 B0 00062D00 LdrpResGetResourceDirectory = _LdrpResGetResourceDirectory@20
+ 192 B1 000F79E0 MD4Final = _MD4Final@4
+ 193 B2 000F7A80 MD4Init = _MD4Init@4
+ 194 B3 000F7AC0 MD4Update = _MD4Update@12
+ 195 B4 00072380 MD5Final = _MD5Final@4
+ 196 B5 000832B0 MD5Init = _MD5Init@4
+ 197 B6 00072420 MD5Update = _MD5Update@12
+ 198 B7 00117D00 NlsAnsiCodePage = _NlsAnsiCodePage
+ 199 B8 001178C4 NlsMbCodePageTag = _NlsMbCodePageTag
+ 200 B9 00117D18 NlsMbOemCodePageTag = _NlsMbOemCodePageTag
+ 201 BA 000904D0 NtAcceptConnectPort = _NtAcceptConnectPort@24
+ 202 BB 00090490 NtAccessCheck = _NtAccessCheck@32
+ 203 BC 00093BF0 NtAccessCheckAndAuditAlarm = _NtAccessCheckAndAuditAlarm@44
+ 204 BD 00093BD0 NtAccessCheckByType = _NtAccessCheckByType@44
+ 205 BE 00093BB0 NtAccessCheckByTypeAndAuditAlarm = _NtAccessCheckByTypeAndAuditAlarm@64
+ 206 BF 00093B90 NtAccessCheckByTypeResultList = _NtAccessCheckByTypeResultList@44
+ 207 C0 00093B70 NtAccessCheckByTypeResultListAndAuditAlarm = _NtAccessCheckByTypeResultListAndAuditAlarm@64
+ 208 C1 00093B50 NtAccessCheckByTypeResultListAndAuditAlarmByHandle = _NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
+ 209 C2 00093B30 NtAcquireProcessActivityReference = _NtAcquireProcessActivityReference@12
+ 210 C3 00093AF0 NtAddAtom = _NtAddAtom@12
+ 211 C4 00093B10 NtAddAtomEx = _NtAddAtomEx@16
+ 212 C5 00093AD0 NtAddBootEntry = _NtAddBootEntry@8
+ 213 C6 00093AB0 NtAddDriverEntry = _NtAddDriverEntry@8
+ 214 C7 00093A70 NtAdjustGroupsToken = _NtAdjustGroupsToken@24
+ 215 C8 00093A50 NtAdjustPrivilegesToken = _NtAdjustPrivilegesToken@24
+ 216 C9 00093A90 NtAdjustTokenClaimsAndDeviceGroups = _NtAdjustTokenClaimsAndDeviceGroups@64
+ 217 CA 00093A30 NtAlertResumeThread = _NtAlertResumeThread@8
+ 218 CB 00093A10 NtAlertThread = _NtAlertThread@4
+ 219 CC 000939F0 NtAlertThreadByThreadId = _NtAlertThreadByThreadId@4
+ 220 CD 000939D0 NtAllocateLocallyUniqueId = _NtAllocateLocallyUniqueId@4
+ 221 CE 000939B0 NtAllocateReserveObject = _NtAllocateReserveObject@12
+ 222 CF 00093990 NtAllocateUserPhysicalPages = _NtAllocateUserPhysicalPages@12
+ 223 D0 00093970 NtAllocateUuids = _NtAllocateUuids@16
+ 224 D1 00093950 NtAllocateVirtualMemory = _NtAllocateVirtualMemory@24
+ 225 D2 00093930 NtAlpcAcceptConnectPort = _NtAlpcAcceptConnectPort@36
+ 226 D3 00093910 NtAlpcCancelMessage = _NtAlpcCancelMessage@12
+ 227 D4 000938D0 NtAlpcConnectPort = _NtAlpcConnectPort@44
+ 228 D5 000938F0 NtAlpcConnectPortEx = _NtAlpcConnectPortEx@44
+ 229 D6 000938B0 NtAlpcCreatePort = _NtAlpcCreatePort@12
+ 230 D7 00093890 NtAlpcCreatePortSection = _NtAlpcCreatePortSection@24
+ 231 D8 00093870 NtAlpcCreateResourceReserve = _NtAlpcCreateResourceReserve@16
+ 232 D9 00093850 NtAlpcCreateSectionView = _NtAlpcCreateSectionView@12
+ 233 DA 00093830 NtAlpcCreateSecurityContext = _NtAlpcCreateSecurityContext@12
+ 234 DB 00093810 NtAlpcDeletePortSection = _NtAlpcDeletePortSection@12
+ 235 DC 000937F0 NtAlpcDeleteResourceReserve = _NtAlpcDeleteResourceReserve@12
+ 236 DD 000937D0 NtAlpcDeleteSectionView = _NtAlpcDeleteSectionView@12
+ 237 DE 000937B0 NtAlpcDeleteSecurityContext = _NtAlpcDeleteSecurityContext@12
+ 238 DF 00093790 NtAlpcDisconnectPort = _NtAlpcDisconnectPort@8
+ 239 E0 00093770 NtAlpcImpersonateClientContainerOfPort = _NtAlpcImpersonateClientContainerOfPort@12
+ 240 E1 00093750 NtAlpcImpersonateClientOfPort = _NtAlpcImpersonateClientOfPort@12
+ 241 E2 00093730 NtAlpcOpenSenderProcess = _NtAlpcOpenSenderProcess@24
+ 242 E3 00093710 NtAlpcOpenSenderThread = _NtAlpcOpenSenderThread@24
+ 243 E4 000936F0 NtAlpcQueryInformation = _NtAlpcQueryInformation@20
+ 244 E5 000936D0 NtAlpcQueryInformationMessage = _NtAlpcQueryInformationMessage@24
+ 245 E6 000936B0 NtAlpcRevokeSecurityContext = _NtAlpcRevokeSecurityContext@12
+ 246 E7 00093690 NtAlpcSendWaitReceivePort = _NtAlpcSendWaitReceivePort@32
+ 247 E8 00093670 NtAlpcSetInformation = _NtAlpcSetInformation@16
+ 248 E9 00093650 NtApphelpCacheControl = _NtApphelpCacheControl@8
+ 249 EA 00093630 NtAreMappedFilesTheSame = _NtAreMappedFilesTheSame@8
+ 250 EB 00093610 NtAssignProcessToJobObject = _NtAssignProcessToJobObject@8
+ 251 EC 000935F0 NtAssociateWaitCompletionPacket = _NtAssociateWaitCompletionPacket@32
+ 252 ED 000935D0 NtCallbackReturn = _NtCallbackReturn@12
+ 253 EE 000935B0 NtCancelIoFile = _NtCancelIoFile@8
+ 254 EF 00093590 NtCancelIoFileEx = _NtCancelIoFileEx@12
+ 255 F0 00093570 NtCancelSynchronousIoFile = _NtCancelSynchronousIoFile@12
+ 257 F1 00093550 NtCancelTimer = _NtCancelTimer@8
+ 256 F2 00090CD0 NtCancelTimer2 = _NtCancelTimer2@8
+ 258 F3 00093530 NtCancelWaitCompletionPacket = _NtCancelWaitCompletionPacket@8
+ 259 F4 00093510 NtClearEvent = _NtClearEvent@4
+ 260 F5 000934F0 NtClose = _NtClose@4
+ 261 F6 000934D0 NtCloseObjectAuditAlarm = _NtCloseObjectAuditAlarm@12
+ 262 F7 000934B0 NtCommitComplete = _NtCommitComplete@8
+ 263 F8 00093490 NtCommitEnlistment = _NtCommitEnlistment@8
+ 264 F9 00093C70 NtCommitRegistryTransaction = _NtCommitRegistryTransaction@8
+ 265 FA 00093470 NtCommitTransaction = _NtCommitTransaction@8
+ 266 FB 00093450 NtCompactKeys = _NtCompactKeys@8
+ 267 FC 00093430 NtCompareObjects = _NtCompareObjects@8
+ 268 FD 00093410 NtCompareSigningLevels = _NtCompareSigningLevels@8
+ 269 FE 000933F0 NtCompareTokens = _NtCompareTokens@12
+ 270 FF 000933D0 NtCompleteConnectPort = _NtCompleteConnectPort@4
+ 271 100 000933B0 NtCompressKey = _NtCompressKey@4
+ 272 101 00093390 NtConnectPort = _NtConnectPort@32
+ 273 102 00093370 NtContinue = _NtContinue@8
+ 274 103 00093350 NtConvertBetweenAuxiliaryCounterAndPerformanceCounter = _NtConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
+ 275 104 00093330 NtCreateDebugObject = _NtCreateDebugObject@16
+ 276 105 00093310 NtCreateDirectoryObject = _NtCreateDirectoryObject@12
+ 277 106 000932F0 NtCreateDirectoryObjectEx = _NtCreateDirectoryObjectEx@20
+ 278 107 000932D0 NtCreateEnclave = _NtCreateEnclave@36
+ 279 108 000932B0 NtCreateEnlistment = _NtCreateEnlistment@32
+ 280 109 00093290 NtCreateEvent = _NtCreateEvent@20
+ 281 10A 00093270 NtCreateEventPair = _NtCreateEventPair@12
+ 282 10B 00093250 NtCreateFile = _NtCreateFile@44
+ 283 10C 000931F0 NtCreateIRTimer = _NtCreateIRTimer@12
+ 284 10D 00093230 NtCreateIoCompletion = _NtCreateIoCompletion@16
+ 285 10E 000931D0 NtCreateJobObject = _NtCreateJobObject@12
+ 286 10F 000931B0 NtCreateJobSet = _NtCreateJobSet@12
+ 287 110 00093190 NtCreateKey = _NtCreateKey@28
+ 288 111 00093150 NtCreateKeyTransacted = _NtCreateKeyTransacted@32
+ 289 112 00093170 NtCreateKeyedEvent = _NtCreateKeyedEvent@16
+ 290 113 00092EF0 NtCreateLowBoxToken = _NtCreateLowBoxToken@36
+ 291 114 00093130 NtCreateMailslotFile = _NtCreateMailslotFile@32
+ 292 115 00093110 NtCreateMutant = _NtCreateMutant@16
+ 293 116 000930F0 NtCreateNamedPipeFile = _NtCreateNamedPipeFile@56
+ 294 117 000930D0 NtCreatePagingFile = _NtCreatePagingFile@16
+ 295 118 00092DD0 NtCreatePartition = _NtCreatePartition@16
+ 296 119 000930B0 NtCreatePort = _NtCreatePort@20
+ 297 11A 00093090 NtCreatePrivateNamespace = _NtCreatePrivateNamespace@16
+ 298 11B 00093070 NtCreateProcess = _NtCreateProcess@32
+ 299 11C 00093050 NtCreateProcessEx = _NtCreateProcessEx@36
+ 300 11D 00093030 NtCreateProfile = _NtCreateProfile@36
+ 301 11E 00093010 NtCreateProfileEx = _NtCreateProfileEx@40
+ 302 11F 00093C30 NtCreateRegistryTransaction = _NtCreateRegistryTransaction@16
+ 303 120 00092FF0 NtCreateResourceManager = _NtCreateResourceManager@28
+ 304 121 00092FD0 NtCreateSection = _NtCreateSection@28
+ 305 122 00092FB0 NtCreateSemaphore = _NtCreateSemaphore@20
+ 306 123 00092F90 NtCreateSymbolicLinkObject = _NtCreateSymbolicLinkObject@16
+ 307 124 00092F70 NtCreateThread = _NtCreateThread@32
+ 308 125 00092F50 NtCreateThreadEx = _NtCreateThreadEx@44
+ 310 126 00092F30 NtCreateTimer = _NtCreateTimer@16
+ 309 127 00093210 NtCreateTimer2 = _NtCreateTimer2@20
+ 311 128 00092ED0 NtCreateToken = _NtCreateToken@52
+ 312 129 00092F10 NtCreateTokenEx = _NtCreateTokenEx@68
+ 313 12A 00092EB0 NtCreateTransaction = _NtCreateTransaction@40
+ 314 12B 00092E90 NtCreateTransactionManager = _NtCreateTransactionManager@24
+ 315 12C 00092E70 NtCreateUserProcess = _NtCreateUserProcess@44
+ 316 12D 00092E30 NtCreateWaitCompletionPacket = _NtCreateWaitCompletionPacket@12
+ 317 12E 00092E50 NtCreateWaitablePort = _NtCreateWaitablePort@20
+ 318 12F 00092E10 NtCreateWnfStateName = _NtCreateWnfStateName@28
+ 319 130 00092DF0 NtCreateWorkerFactory = _NtCreateWorkerFactory@40
+ 320 131 000CFBC0 NtCurrentTeb = _NtdllNtCurrentTeb@0
+ 321 132 00092DB0 NtDebugActiveProcess = _NtDebugActiveProcess@8
+ 322 133 00092D90 NtDebugContinue = _NtDebugContinue@12
+ 323 134 00092D70 NtDelayExecution = _NtDelayExecution@8
+ 324 135 00092D50 NtDeleteAtom = _NtDeleteAtom@4
+ 325 136 00092D30 NtDeleteBootEntry = _NtDeleteBootEntry@4
+ 326 137 00092D10 NtDeleteDriverEntry = _NtDeleteDriverEntry@4
+ 327 138 00092CF0 NtDeleteFile = _NtDeleteFile@4
+ 328 139 00092CD0 NtDeleteKey = _NtDeleteKey@4
+ 329 13A 00092CB0 NtDeleteObjectAuditAlarm = _NtDeleteObjectAuditAlarm@12
+ 330 13B 00092C90 NtDeletePrivateNamespace = _NtDeletePrivateNamespace@4
+ 331 13C 00092C70 NtDeleteValueKey = _NtDeleteValueKey@8
+ 332 13D 00092C50 NtDeleteWnfStateData = _NtDeleteWnfStateData@8
+ 333 13E 00092C30 NtDeleteWnfStateName = _NtDeleteWnfStateName@4
+ 334 13F 00092C10 NtDeviceIoControlFile = _NtDeviceIoControlFile@40
+ 335 140 00092C00 NtDisableLastKnownGood = _NtDisableLastKnownGood@0
+ 336 141 00092BE0 NtDisplayString = _NtDisplayString@4
+ 337 142 00092BC0 NtDrawText = _NtDrawText@4
+ 338 143 00092BA0 NtDuplicateObject = _NtDuplicateObject@28
+ 339 144 00092B80 NtDuplicateToken = _NtDuplicateToken@24
+ 340 145 00092B70 NtEnableLastKnownGood = _NtEnableLastKnownGood@0
+ 341 146 00092B50 NtEnumerateBootEntries = _NtEnumerateBootEntries@8
+ 342 147 00092B30 NtEnumerateDriverEntries = _NtEnumerateDriverEntries@8
+ 343 148 00092B10 NtEnumerateKey = _NtEnumerateKey@24
+ 344 149 00092AF0 NtEnumerateSystemEnvironmentValuesEx = _NtEnumerateSystemEnvironmentValuesEx@12
+ 345 14A 00092AD0 NtEnumerateTransactionObject = _NtEnumerateTransactionObject@20
+ 346 14B 00092AB0 NtEnumerateValueKey = _NtEnumerateValueKey@24
+ 347 14C 00092A90 NtExtendSection = _NtExtendSection@8
+ 348 14D 00092A70 NtFilterBootOption = _NtFilterBootOption@20
+ 349 14E 00092A30 NtFilterToken = _NtFilterToken@24
+ 350 14F 00092A50 NtFilterTokenEx = _NtFilterTokenEx@56
+ 351 150 00092A10 NtFindAtom = _NtFindAtom@12
+ 352 151 000929D0 NtFlushBuffersFile = _NtFlushBuffersFile@8
+ 353 152 000929F0 NtFlushBuffersFileEx = _NtFlushBuffersFileEx@20
+ 354 153 000929B0 NtFlushInstallUILanguage = _NtFlushInstallUILanguage@8
+ 355 154 00092990 NtFlushInstructionCache = _NtFlushInstructionCache@12
+ 356 155 00092970 NtFlushKey = _NtFlushKey@4
+ 357 156 00092960 NtFlushProcessWriteBuffers = _NtFlushProcessWriteBuffers@0
+ 358 157 00092940 NtFlushVirtualMemory = _NtFlushVirtualMemory@16
+ 359 158 00092930 NtFlushWriteBuffer = _NtFlushWriteBuffer@0
+ 360 159 00092910 NtFreeUserPhysicalPages = _NtFreeUserPhysicalPages@12
+ 361 15A 000928F0 NtFreeVirtualMemory = _NtFreeVirtualMemory@16
+ 362 15B 000928D0 NtFreezeRegistry = _NtFreezeRegistry@4
+ 363 15C 000928B0 NtFreezeTransactions = _NtFreezeTransactions@8
+ 364 15D 00092890 NtFsControlFile = _NtFsControlFile@40
+ 365 15E 00092870 NtGetCachedSigningLevel = _NtGetCachedSigningLevel@24
+ 366 15F 00092850 NtGetCompleteWnfStateSubscription = _NtGetCompleteWnfStateSubscription@24
+ 367 160 00092830 NtGetContextThread = _NtGetContextThread@8
+ 368 161 00092820 NtGetCurrentProcessorNumber = _NtGetCurrentProcessorNumber@0
+ 369 162 00092800 NtGetCurrentProcessorNumberEx = _NtGetCurrentProcessorNumberEx@4
+ 370 163 000927E0 NtGetDevicePowerState = _NtGetDevicePowerState@8
+ 371 164 000927C0 NtGetMUIRegistryInfo = _NtGetMUIRegistryInfo@12
+ 372 165 000927A0 NtGetNextProcess = _NtGetNextProcess@20
+ 373 166 00092780 NtGetNextThread = _NtGetNextThread@24
+ 374 167 00092760 NtGetNlsSectionPtr = _NtGetNlsSectionPtr@20
+ 375 168 00092740 NtGetNotificationResourceManager = _NtGetNotificationResourceManager@28
+ 376 169 000DA4D0 NtGetTickCount = _RtlGetTickCount@0
+ 377 16A 00092720 NtGetWriteWatch = _NtGetWriteWatch@28
+ 378 16B 00092700 NtImpersonateAnonymousToken = _NtImpersonateAnonymousToken@4
+ 379 16C 000926E0 NtImpersonateClientOfPort = _NtImpersonateClientOfPort@8
+ 380 16D 000926C0 NtImpersonateThread = _NtImpersonateThread@12
+ 381 16E 000926A0 NtInitializeEnclave = _NtInitializeEnclave@20
+ 382 16F 00092680 NtInitializeNlsFiles = _NtInitializeNlsFiles@12
+ 383 170 00092660 NtInitializeRegistry = _NtInitializeRegistry@4
+ 384 171 00092640 NtInitiatePowerAction = _NtInitiatePowerAction@16
+ 385 172 00092620 NtIsProcessInJob = _NtIsProcessInJob@8
+ 386 173 00092610 NtIsSystemResumeAutomatic = _NtIsSystemResumeAutomatic@0
+ 387 174 00092600 NtIsUILanguageComitted = _NtIsUILanguageComitted@0
+ 388 175 000925E0 NtListenPort = _NtListenPort@8
+ 389 176 000925C0 NtLoadDriver = _NtLoadDriver@4
+ 390 177 000925A0 NtLoadEnclaveData = _NtLoadEnclaveData@36
+ 391 178 00092580 NtLoadHotPatch = _NtLoadHotPatch@8
+ 393 179 00092560 NtLoadKey = _NtLoadKey@8
+ 392 17A 00092540 NtLoadKey2 = _NtLoadKey2@12
+ 394 17B 00092520 NtLoadKeyEx = _NtLoadKeyEx@32
+ 395 17C 00092500 NtLockFile = _NtLockFile@40
+ 396 17D 000924E0 NtLockProductActivationKeys = _NtLockProductActivationKeys@8
+ 397 17E 000924C0 NtLockRegistryKey = _NtLockRegistryKey@4
+ 398 17F 000924A0 NtLockVirtualMemory = _NtLockVirtualMemory@16
+ 399 180 00092480 NtMakePermanentObject = _NtMakePermanentObject@4
+ 400 181 00092460 NtMakeTemporaryObject = _NtMakeTemporaryObject@4
+ 401 182 00092380 NtManagePartition = _NtManagePartition@20
+ 402 183 00092440 NtMapCMFModule = _NtMapCMFModule@24
+ 403 184 00092420 NtMapUserPhysicalPages = _NtMapUserPhysicalPages@12
+ 404 185 00092400 NtMapUserPhysicalPagesScatter = _NtMapUserPhysicalPagesScatter@12
+ 405 186 000923E0 NtMapViewOfSection = _NtMapViewOfSection@40
+ 406 187 000923C0 NtModifyBootEntry = _NtModifyBootEntry@4
+ 407 188 000923A0 NtModifyDriverEntry = _NtModifyDriverEntry@4
+ 408 189 00092360 NtNotifyChangeDirectoryFile = _NtNotifyChangeDirectoryFile@36
+ 409 18A 00092340 NtNotifyChangeKey = _NtNotifyChangeKey@40
+ 410 18B 00092320 NtNotifyChangeMultipleKeys = _NtNotifyChangeMultipleKeys@48
+ 411 18C 00092300 NtNotifyChangeSession = _NtNotifyChangeSession@32
+ 412 18D 000922E0 NtOpenDirectoryObject = _NtOpenDirectoryObject@12
+ 413 18E 000922C0 NtOpenEnlistment = _NtOpenEnlistment@20
+ 414 18F 000922A0 NtOpenEvent = _NtOpenEvent@12
+ 415 190 00092280 NtOpenEventPair = _NtOpenEventPair@12
+ 416 191 00092260 NtOpenFile = _NtOpenFile@24
+ 417 192 00092240 NtOpenIoCompletion = _NtOpenIoCompletion@12
+ 418 193 00092220 NtOpenJobObject = _NtOpenJobObject@12
+ 419 194 00092200 NtOpenKey = _NtOpenKey@12
+ 420 195 000921C0 NtOpenKeyEx = _NtOpenKeyEx@16
+ 421 196 000921A0 NtOpenKeyTransacted = _NtOpenKeyTransacted@16
+ 422 197 00092180 NtOpenKeyTransactedEx = _NtOpenKeyTransactedEx@20
+ 423 198 000921E0 NtOpenKeyedEvent = _NtOpenKeyedEvent@12
+ 424 199 00092160 NtOpenMutant = _NtOpenMutant@12
+ 425 19A 00092140 NtOpenObjectAuditAlarm = _NtOpenObjectAuditAlarm@48
+ 426 19B 000920A0 NtOpenPartition = _NtOpenPartition@12
+ 427 19C 00092120 NtOpenPrivateNamespace = _NtOpenPrivateNamespace@16
+ 428 19D 00092100 NtOpenProcess = _NtOpenProcess@16
+ 429 19E 000920E0 NtOpenProcessToken = _NtOpenProcessToken@12
+ 430 19F 000920C0 NtOpenProcessTokenEx = _NtOpenProcessTokenEx@16
+ 431 1A0 00093C50 NtOpenRegistryTransaction = _NtOpenRegistryTransaction@12
+ 432 1A1 00092080 NtOpenResourceManager = _NtOpenResourceManager@20
+ 433 1A2 00092060 NtOpenSection = _NtOpenSection@12
+ 434 1A3 00092040 NtOpenSemaphore = _NtOpenSemaphore@12
+ 435 1A4 00092020 NtOpenSession = _NtOpenSession@12
+ 436 1A5 00092000 NtOpenSymbolicLinkObject = _NtOpenSymbolicLinkObject@12
+ 437 1A6 00091FE0 NtOpenThread = _NtOpenThread@16
+ 438 1A7 00091FC0 NtOpenThreadToken = _NtOpenThreadToken@16
+ 439 1A8 00091FA0 NtOpenThreadTokenEx = _NtOpenThreadTokenEx@20
+ 440 1A9 00091F80 NtOpenTimer = _NtOpenTimer@12
+ 441 1AA 00091F60 NtOpenTransaction = _NtOpenTransaction@20
+ 442 1AB 00091F40 NtOpenTransactionManager = _NtOpenTransactionManager@24
+ 443 1AC 00091F20 NtPlugPlayControl = _NtPlugPlayControl@12
+ 444 1AD 00091F00 NtPowerInformation = _NtPowerInformation@20
+ 445 1AE 00091EA0 NtPrePrepareComplete = _NtPrePrepareComplete@8
+ 446 1AF 00091E80 NtPrePrepareEnlistment = _NtPrePrepareEnlistment@8
+ 447 1B0 00091EE0 NtPrepareComplete = _NtPrepareComplete@8
+ 448 1B1 00091EC0 NtPrepareEnlistment = _NtPrepareEnlistment@8
+ 449 1B2 00091E40 NtPrivilegeCheck = _NtPrivilegeCheck@12
+ 450 1B3 00091E00 NtPrivilegeObjectAuditAlarm = _NtPrivilegeObjectAuditAlarm@24
+ 451 1B4 00091E20 NtPrivilegedServiceAuditAlarm = _NtPrivilegedServiceAuditAlarm@20
+ 452 1B5 00091DE0 NtPropagationComplete = _NtPropagationComplete@16
+ 453 1B6 00091DC0 NtPropagationFailed = _NtPropagationFailed@12
+ 454 1B7 00091DA0 NtProtectVirtualMemory = _NtProtectVirtualMemory@20
+ 455 1B8 00091D80 NtPulseEvent = _NtPulseEvent@8
+ 456 1B9 00091D60 NtQueryAttributesFile = _NtQueryAttributesFile@8
+ 457 1BA 00091670 NtQueryAuxiliaryCounterFrequency = _NtQueryAuxiliaryCounterFrequency@4
+ 458 1BB 00091D40 NtQueryBootEntryOrder = _NtQueryBootEntryOrder@8
+ 459 1BC 00091D20 NtQueryBootOptions = _NtQueryBootOptions@8
+ 460 1BD 00091D00 NtQueryDebugFilterState = _NtQueryDebugFilterState@8
+ 461 1BE 00091CE0 NtQueryDefaultLocale = _NtQueryDefaultLocale@8
+ 462 1BF 00091CC0 NtQueryDefaultUILanguage = _NtQueryDefaultUILanguage@4
+ 463 1C0 00091CA0 NtQueryDirectoryFile = _NtQueryDirectoryFile@44
+ 464 1C1 00091C80 NtQueryDirectoryObject = _NtQueryDirectoryObject@28
+ 465 1C2 00091C60 NtQueryDriverEntryOrder = _NtQueryDriverEntryOrder@8
+ 466 1C3 00091C40 NtQueryEaFile = _NtQueryEaFile@36
+ 467 1C4 00091C20 NtQueryEvent = _NtQueryEvent@20
+ 468 1C5 00091C00 NtQueryFullAttributesFile = _NtQueryFullAttributesFile@8
+ 469 1C6 00091BE0 NtQueryInformationAtom = _NtQueryInformationAtom@20
+ 470 1C7 00091BC0 NtQueryInformationByName = _NtQueryInformationByName@20
+ 471 1C8 00091BA0 NtQueryInformationEnlistment = _NtQueryInformationEnlistment@20
+ 472 1C9 00091B80 NtQueryInformationFile = _NtQueryInformationFile@20
+ 473 1CA 00091B60 NtQueryInformationJobObject = _NtQueryInformationJobObject@20
+ 474 1CB 00091B40 NtQueryInformationPort = _NtQueryInformationPort@20
+ 475 1CC 00091B20 NtQueryInformationProcess = _NtQueryInformationProcess@20
+ 476 1CD 00091B00 NtQueryInformationResourceManager = _NtQueryInformationResourceManager@20
+ 477 1CE 00091AE0 NtQueryInformationThread = _NtQueryInformationThread@20
+ 478 1CF 00091AC0 NtQueryInformationToken = _NtQueryInformationToken@20
+ 479 1D0 00091AA0 NtQueryInformationTransaction = _NtQueryInformationTransaction@20
+ 480 1D1 00091A80 NtQueryInformationTransactionManager = _NtQueryInformationTransactionManager@20
+ 481 1D2 00091A60 NtQueryInformationWorkerFactory = _NtQueryInformationWorkerFactory@20
+ 482 1D3 00091A40 NtQueryInstallUILanguage = _NtQueryInstallUILanguage@4
+ 483 1D4 00091A20 NtQueryIntervalProfile = _NtQueryIntervalProfile@8
+ 484 1D5 00091A00 NtQueryIoCompletion = _NtQueryIoCompletion@20
+ 485 1D6 000919E0 NtQueryKey = _NtQueryKey@20
+ 486 1D7 000919C0 NtQueryLicenseValue = _NtQueryLicenseValue@20
+ 487 1D8 000919A0 NtQueryMultipleValueKey = _NtQueryMultipleValueKey@24
+ 488 1D9 00091980 NtQueryMutant = _NtQueryMutant@20
+ 489 1DA 00091960 NtQueryObject = _NtQueryObject@20
+ 490 1DB 00091940 NtQueryOpenSubKeys = _NtQueryOpenSubKeys@8
+ 491 1DC 00091920 NtQueryOpenSubKeysEx = _NtQueryOpenSubKeysEx@16
+ 492 1DD 00091900 NtQueryPerformanceCounter = _NtQueryPerformanceCounter@8
+ 493 1DE 000918F0 NtQueryPortInformationProcess = _NtQueryPortInformationProcess@0
+ 494 1DF 000918D0 NtQueryQuotaInformationFile = _NtQueryQuotaInformationFile@36
+ 495 1E0 000918B0 NtQuerySection = _NtQuerySection@20
+ 496 1E1 00091890 NtQuerySecurityAttributesToken = _NtQuerySecurityAttributesToken@24
+ 497 1E2 00091870 NtQuerySecurityObject = _NtQuerySecurityObject@20
+ 498 1E3 00091850 NtQuerySecurityPolicy = _NtQuerySecurityPolicy@24
+ 499 1E4 00091830 NtQuerySemaphore = _NtQuerySemaphore@20
+ 500 1E5 00091810 NtQuerySymbolicLinkObject = _NtQuerySymbolicLinkObject@12
+ 501 1E6 000917F0 NtQuerySystemEnvironmentValue = _NtQuerySystemEnvironmentValue@16
+ 502 1E7 000917D0 NtQuerySystemEnvironmentValueEx = _NtQuerySystemEnvironmentValueEx@20
+ 503 1E8 000917B0 NtQuerySystemInformation = _NtQuerySystemInformation@16
+ 504 1E9 00091790 NtQuerySystemInformationEx = _NtQuerySystemInformationEx@24
+ 505 1EA 00091770 NtQuerySystemTime = _NtQuerySystemTime@4
+ 506 1EB 00091750 NtQueryTimer = _NtQueryTimer@20
+ 507 1EC 00091730 NtQueryTimerResolution = _NtQueryTimerResolution@12
+ 508 1ED 00091710 NtQueryValueKey = _NtQueryValueKey@24
+ 509 1EE 000916F0 NtQueryVirtualMemory = _NtQueryVirtualMemory@24
+ 510 1EF 000916D0 NtQueryVolumeInformationFile = _NtQueryVolumeInformationFile@20
+ 511 1F0 00091690 NtQueryWnfStateData = _NtQueryWnfStateData@24
+ 512 1F1 000916B0 NtQueryWnfStateNameInformation = _NtQueryWnfStateNameInformation@20
+ 513 1F2 00091650 NtQueueApcThread = _NtQueueApcThread@20
+ 514 1F3 00091630 NtQueueApcThreadEx = _NtQueueApcThreadEx@24
+ 515 1F4 00091610 NtRaiseException = _NtRaiseException@12
+ 516 1F5 000915F0 NtRaiseHardError = _NtRaiseHardError@24
+ 517 1F6 000915D0 NtReadFile = _NtReadFile@36
+ 518 1F7 000915B0 NtReadFileScatter = _NtReadFileScatter@36
+ 519 1F8 00091590 NtReadOnlyEnlistment = _NtReadOnlyEnlistment@8
+ 520 1F9 00091570 NtReadRequestData = _NtReadRequestData@24
+ 521 1FA 00091550 NtReadVirtualMemory = _NtReadVirtualMemory@20
+ 522 1FB 00091530 NtRecoverEnlistment = _NtRecoverEnlistment@8
+ 523 1FC 00091510 NtRecoverResourceManager = _NtRecoverResourceManager@4
+ 524 1FD 000914F0 NtRecoverTransactionManager = _NtRecoverTransactionManager@4
+ 525 1FE 000914D0 NtRegisterProtocolAddressInformation = _NtRegisterProtocolAddressInformation@20
+ 526 1FF 000914B0 NtRegisterThreadTerminatePort = _NtRegisterThreadTerminatePort@4
+ 527 200 00091490 NtReleaseKeyedEvent = _NtReleaseKeyedEvent@16
+ 528 201 00091470 NtReleaseMutant = _NtReleaseMutant@8
+ 529 202 00091450 NtReleaseSemaphore = _NtReleaseSemaphore@12
+ 530 203 00091430 NtReleaseWorkerFactoryWorker = _NtReleaseWorkerFactoryWorker@4
+ 531 204 00091410 NtRemoveIoCompletion = _NtRemoveIoCompletion@20
+ 532 205 000913F0 NtRemoveIoCompletionEx = _NtRemoveIoCompletionEx@24
+ 533 206 000913D0 NtRemoveProcessDebug = _NtRemoveProcessDebug@8
+ 534 207 000913B0 NtRenameKey = _NtRenameKey@8
+ 535 208 00091390 NtRenameTransactionManager = _NtRenameTransactionManager@8
+ 536 209 00091370 NtReplaceKey = _NtReplaceKey@12
+ 537 20A 00091350 NtReplacePartitionUnit = _NtReplacePartitionUnit@12
+ 538 20B 00091330 NtReplyPort = _NtReplyPort@8
+ 539 20C 00091310 NtReplyWaitReceivePort = _NtReplyWaitReceivePort@16
+ 540 20D 000912F0 NtReplyWaitReceivePortEx = _NtReplyWaitReceivePortEx@20
+ 541 20E 000912D0 NtReplyWaitReplyPort = _NtReplyWaitReplyPort@8
+ 542 20F 000912B0 NtRequestPort = _NtRequestPort@8
+ 543 210 00091290 NtRequestWaitReplyPort = _NtRequestWaitReplyPort@12
+ 544 211 00091270 NtResetEvent = _NtResetEvent@8
+ 545 212 00091250 NtResetWriteWatch = _NtResetWriteWatch@12
+ 546 213 00091230 NtRestoreKey = _NtRestoreKey@12
+ 547 214 00091210 NtResumeProcess = _NtResumeProcess@4
+ 548 215 000911F0 NtResumeThread = _NtResumeThread@8
+ 549 216 000911E0 NtRevertContainerImpersonation = _NtRevertContainerImpersonation@0
+ 550 217 000911C0 NtRollbackComplete = _NtRollbackComplete@8
+ 551 218 000911A0 NtRollbackEnlistment = _NtRollbackEnlistment@8
+ 552 219 00093C90 NtRollbackRegistryTransaction = _NtRollbackRegistryTransaction@8
+ 553 21A 00091180 NtRollbackTransaction = _NtRollbackTransaction@8
+ 554 21B 00091160 NtRollforwardTransactionManager = _NtRollforwardTransactionManager@8
+ 555 21C 00091140 NtSaveKey = _NtSaveKey@8
+ 556 21D 00091120 NtSaveKeyEx = _NtSaveKeyEx@12
+ 557 21E 00091100 NtSaveMergedKeys = _NtSaveMergedKeys@12
+ 558 21F 000910E0 NtSecureConnectPort = _NtSecureConnectPort@36
+ 559 220 000910D0 NtSerializeBoot = _NtSerializeBoot@0
+ 560 221 000910B0 NtSetBootEntryOrder = _NtSetBootEntryOrder@8
+ 561 222 00091090 NtSetBootOptions = _NtSetBootOptions@8
+ 563 223 00091070 NtSetCachedSigningLevel = _NtSetCachedSigningLevel@20
+ 562 224 00091050 NtSetCachedSigningLevel2 = _NtSetCachedSigningLevel2@24
+ 564 225 00091030 NtSetContextThread = _NtSetContextThread@8
+ 565 226 00091010 NtSetDebugFilterState = _NtSetDebugFilterState@12
+ 566 227 00090FF0 NtSetDefaultHardErrorPort = _NtSetDefaultHardErrorPort@4
+ 567 228 00090FD0 NtSetDefaultLocale = _NtSetDefaultLocale@8
+ 568 229 00090FB0 NtSetDefaultUILanguage = _NtSetDefaultUILanguage@4
+ 569 22A 00090F90 NtSetDriverEntryOrder = _NtSetDriverEntryOrder@8
+ 570 22B 00090F70 NtSetEaFile = _NtSetEaFile@16
+ 571 22C 00090F50 NtSetEvent = _NtSetEvent@8
+ 572 22D 00090F30 NtSetEventBoostPriority = _NtSetEventBoostPriority@4
+ 573 22E 00090F10 NtSetHighEventPair = _NtSetHighEventPair@4
+ 574 22F 00090EF0 NtSetHighWaitLowEventPair = _NtSetHighWaitLowEventPair@4
+ 575 230 00090C90 NtSetIRTimer = _NtSetIRTimer@8
+ 576 231 00090ED0 NtSetInformationDebugObject = _NtSetInformationDebugObject@20
+ 577 232 00090EB0 NtSetInformationEnlistment = _NtSetInformationEnlistment@16
+ 578 233 00090E90 NtSetInformationFile = _NtSetInformationFile@20
+ 579 234 00090E70 NtSetInformationJobObject = _NtSetInformationJobObject@16
+ 580 235 00090E50 NtSetInformationKey = _NtSetInformationKey@16
+ 581 236 00090E30 NtSetInformationObject = _NtSetInformationObject@16
+ 582 237 00090E10 NtSetInformationProcess = _NtSetInformationProcess@16
+ 583 238 00090DF0 NtSetInformationResourceManager = _NtSetInformationResourceManager@16
+ 584 239 00093C10 NtSetInformationSymbolicLink = _NtSetInformationSymbolicLink@16
+ 585 23A 00090DD0 NtSetInformationThread = _NtSetInformationThread@16
+ 586 23B 00090DB0 NtSetInformationToken = _NtSetInformationToken@16
+ 587 23C 00090D90 NtSetInformationTransaction = _NtSetInformationTransaction@16
+ 588 23D 00090D70 NtSetInformationTransactionManager = _NtSetInformationTransactionManager@16
+ 589 23E 00091E60 NtSetInformationVirtualMemory = _NtSetInformationVirtualMemory@24
+ 590 23F 00090D50 NtSetInformationWorkerFactory = _NtSetInformationWorkerFactory@16
+ 591 240 00090D30 NtSetIntervalProfile = _NtSetIntervalProfile@8
+ 592 241 00090D10 NtSetIoCompletion = _NtSetIoCompletion@20
+ 593 242 00090CF0 NtSetIoCompletionEx = _NtSetIoCompletionEx@24
+ 594 243 00090C70 NtSetLdtEntries = _NtSetLdtEntries@24
+ 595 244 00090C50 NtSetLowEventPair = _NtSetLowEventPair@4
+ 596 245 00090C30 NtSetLowWaitHighEventPair = _NtSetLowWaitHighEventPair@4
+ 597 246 00090C10 NtSetQuotaInformationFile = _NtSetQuotaInformationFile@16
+ 598 247 00090BF0 NtSetSecurityObject = _NtSetSecurityObject@12
+ 599 248 00090BD0 NtSetSystemEnvironmentValue = _NtSetSystemEnvironmentValue@8
+ 600 249 00090BB0 NtSetSystemEnvironmentValueEx = _NtSetSystemEnvironmentValueEx@20
+ 601 24A 00090B90 NtSetSystemInformation = _NtSetSystemInformation@12
+ 602 24B 00090B70 NtSetSystemPowerState = _NtSetSystemPowerState@12
+ 603 24C 00090B50 NtSetSystemTime = _NtSetSystemTime@8
+ 604 24D 00090B30 NtSetThreadExecutionState = _NtSetThreadExecutionState@8
+ 606 24E 00090B10 NtSetTimer = _NtSetTimer@28
+ 605 24F 00090CB0 NtSetTimer2 = _NtSetTimer2@16
+ 607 250 00090AF0 NtSetTimerEx = _NtSetTimerEx@16
+ 608 251 00090AD0 NtSetTimerResolution = _NtSetTimerResolution@12
+ 609 252 00090AB0 NtSetUuidSeed = _NtSetUuidSeed@4
+ 610 253 00090A90 NtSetValueKey = _NtSetValueKey@24
+ 611 254 00090A70 NtSetVolumeInformationFile = _NtSetVolumeInformationFile@20
+ 612 255 00090A50 NtSetWnfProcessNotificationEvent = _NtSetWnfProcessNotificationEvent@4
+ 613 256 00090A30 NtShutdownSystem = _NtShutdownSystem@4
+ 614 257 00090A10 NtShutdownWorkerFactory = _NtShutdownWorkerFactory@8
+ 615 258 000909F0 NtSignalAndWaitForSingleObject = _NtSignalAndWaitForSingleObject@16
+ 616 259 000909D0 NtSinglePhaseReject = _NtSinglePhaseReject@8
+ 617 25A 000909B0 NtStartProfile = _NtStartProfile@4
+ 618 25B 00090990 NtStopProfile = _NtStopProfile@4
+ 619 25C 00090970 NtSubscribeWnfStateChange = _NtSubscribeWnfStateChange@16
+ 620 25D 00090950 NtSuspendProcess = _NtSuspendProcess@4
+ 621 25E 00090930 NtSuspendThread = _NtSuspendThread@8
+ 622 25F 00090910 NtSystemDebugControl = _NtSystemDebugControl@24
+ 623 260 000908F0 NtTerminateJobObject = _NtTerminateJobObject@8
+ 624 261 000908D0 NtTerminateProcess = _NtTerminateProcess@8
+ 625 262 000908B0 NtTerminateThread = _NtTerminateThread@8
+ 626 263 000908A0 NtTestAlert = _NtTestAlert@0
+ 627 264 00090890 NtThawRegistry = _NtThawRegistry@0
+ 628 265 00090880 NtThawTransactions = _NtThawTransactions@0
+ 629 266 00090860 NtTraceControl = _NtTraceControl@24
+ 630 267 00090840 NtTraceEvent = _NtTraceEvent@16
+ 631 268 00090820 NtTranslateFilePath = _NtTranslateFilePath@16
+ 632 269 00090800 NtUmsThreadYield = _NtUmsThreadYield@4
+ 633 26A 000907E0 NtUnloadDriver = _NtUnloadDriver@4
+ 635 26B 000907C0 NtUnloadKey = _NtUnloadKey@4
+ 634 26C 000907A0 NtUnloadKey2 = _NtUnloadKey2@8
+ 636 26D 00090780 NtUnloadKeyEx = _NtUnloadKeyEx@8
+ 637 26E 00090760 NtUnlockFile = _NtUnlockFile@20
+ 638 26F 00090740 NtUnlockVirtualMemory = _NtUnlockVirtualMemory@16
+ 639 270 00090700 NtUnmapViewOfSection = _NtUnmapViewOfSection@8
+ 640 271 00090720 NtUnmapViewOfSectionEx = _NtUnmapViewOfSectionEx@12
+ 641 272 000906C0 NtUnsubscribeWnfStateChange = _NtUnsubscribeWnfStateChange@4
+ 642 273 000906E0 NtUpdateWnfStateData = _NtUpdateWnfStateData@28
+ 643 274 000906A0 NtVdmControl = _NtVdmControl@8
+ 644 275 00090680 NtWaitForAlertByThreadId = _NtWaitForAlertByThreadId@8
+ 645 276 00090660 NtWaitForDebugEvent = _NtWaitForDebugEvent@16
+ 646 277 00090640 NtWaitForKeyedEvent = _NtWaitForKeyedEvent@16
+ 648 278 00090620 NtWaitForMultipleObjects = _NtWaitForMultipleObjects@20
+ 647 279 00090600 NtWaitForMultipleObjects32 = _NtWaitForMultipleObjects32@20
+ 649 27A 000905E0 NtWaitForSingleObject = _NtWaitForSingleObject@12
+ 650 27B 000905C0 NtWaitForWorkViaWorkerFactory = _NtWaitForWorkViaWorkerFactory@20
+ 651 27C 000905A0 NtWaitHighEventPair = _NtWaitHighEventPair@4
+ 652 27D 00090580 NtWaitLowEventPair = _NtWaitLowEventPair@4
+ 653 27E 000904B0 NtWorkerFactoryWorkerReady = _NtWorkerFactoryWorkerReady@4
+ 654 27F 00090560 NtWriteFile = _NtWriteFile@36
+ 655 280 00090540 NtWriteFileGather = _NtWriteFileGather@36
+ 656 281 00090520 NtWriteRequestData = _NtWriteRequestData@24
+ 657 282 00090500 NtWriteVirtualMemory = _NtWriteVirtualMemory@20
+ 658 283 000904F0 NtYieldExecution = _NtYieldExecution@0
+ 659 284 000A5500 NtdllDefWindowProc_A = _NtdllDefWindowProc_A@0
+ 660 285 000A5510 NtdllDefWindowProc_W = _NtdllDefWindowProc_W@0
+ 661 286 000A55C0 NtdllDialogWndProc_A = _NtdllDialogWndProc_A@0
+ 662 287 000A55D0 NtdllDialogWndProc_W = _NtdllDialogWndProc_W@0
+ 663 288 000DA780 PfxFindPrefix = _PfxFindPrefix@8
+ 664 289 000DA820 PfxInitialize = _PfxInitialize@4
+ 665 28A 000DA840 PfxInsertPrefix = _PfxInsertPrefix@12
+ 666 28B 000DA930 PfxRemovePrefix = _PfxRemovePrefix@8
+ 667 28C 00020790 PssNtCaptureSnapshot = _PssNtCaptureSnapshot@16
+ 668 28D 000F9D40 PssNtDuplicateSnapshot = _PssNtDuplicateSnapshot@20
+ 669 28E 000F9DB0 PssNtFreeRemoteSnapshot = _PssNtFreeRemoteSnapshot@8
+ 670 28F 00020AB0 PssNtFreeSnapshot = _PssNtFreeSnapshot@4
+ 671 290 000F9F40 PssNtFreeWalkMarker = _PssNtFreeWalkMarker@4
+ 672 291 000F9F70 PssNtQuerySnapshot = _PssNtQuerySnapshot@16
+ 673 292 00020B90 PssNtValidateDescriptor = _PssNtValidateDescriptor@8
+ 674 293 00090310 PssNtWalkSnapshot = _PssNtWalkSnapshot@20
+ 675 294 000863F0 RtlAbortRXact = _RtlAbortRXact@4
+ 676 295 00077360 RtlAbsoluteToSelfRelativeSD = _RtlAbsoluteToSelfRelativeSD@12
+ 677 296 0007E840 RtlAcquirePebLock = _RtlAcquirePebLock@0
+ 678 297 0007D5A0 RtlAcquirePrivilege = _RtlAcquirePrivilege@16
+ 679 298 00072930 RtlAcquireReleaseSRWLockExclusive = _RtlAcquireReleaseSRWLockExclusive@4
+ 680 299 00075480 RtlAcquireResourceExclusive = _RtlAcquireResourceExclusive@8
+ 681 29A 000753C0 RtlAcquireResourceShared = _RtlAcquireResourceShared@8
+ 682 29B 0003B080 RtlAcquireSRWLockExclusive = _RtlAcquireSRWLockExclusive@4
+ 683 29C 00040EC0 RtlAcquireSRWLockShared = _RtlAcquireSRWLockShared@4
+ 684 29D 0005EA00 RtlActivateActivationContext = _RtlActivateActivationContext@12
+ 685 29E 0005EA50 RtlActivateActivationContextEx = _RtlActivateActivationContextEx@16
+ 9 29F 0003D5F0 RtlActivateActivationContextUnsafeFast = @RtlActivateActivationContextUnsafeFast@8
+ 686 2A0 0007E060 RtlAddAccessAllowedAce = _RtlAddAccessAllowedAce@16
+ 687 2A1 0007F6E0 RtlAddAccessAllowedAceEx = _RtlAddAccessAllowedAceEx@20
+ 688 2A2 000DCE90 RtlAddAccessAllowedObjectAce = _RtlAddAccessAllowedObjectAce@28
+ 689 2A3 00087F00 RtlAddAccessDeniedAce = _RtlAddAccessDeniedAce@16
+ 690 2A4 00087610 RtlAddAccessDeniedAceEx = _RtlAddAccessDeniedAceEx@20
+ 691 2A5 000DCEE0 RtlAddAccessDeniedObjectAce = _RtlAddAccessDeniedObjectAce@28
+ 692 2A6 000DCF30 RtlAddAccessFilterAce = _RtlAddAccessFilterAce@32
+ 693 2A7 00023650 RtlAddAce = _RtlAddAce@20
+ 694 2A8 00022400 RtlAddActionToRXact = _RtlAddActionToRXact@24
+ 695 2A9 00073940 RtlAddAtomToAtomTable = _RtlAddAtomToAtomTable@12
+ 696 2AA 00086D50 RtlAddAttributeActionToRXact = _RtlAddAttributeActionToRXact@32
+ 697 2AB 0008C380 RtlAddAuditAccessAce = _RtlAddAuditAccessAce@24
+ 698 2AC 0008CEE0 RtlAddAuditAccessAceEx = _RtlAddAuditAccessAceEx@28
+ 699 2AD 000DD110 RtlAddAuditAccessObjectAce = _RtlAddAuditAccessObjectAce@36
+ 700 2AE 000DD180 RtlAddCompoundAce = _RtlAddCompoundAce@24
+ 701 2AF 000DED40 RtlAddIntegrityLabelToBoundaryDescriptor = _RtlAddIntegrityLabelToBoundaryDescriptor@8
+ 702 2B0 00025C50 RtlAddMandatoryAce = _RtlAddMandatoryAce@24
+ 703 2B1 0008BA20 RtlAddProcessTrustLabelAce = _RtlAddProcessTrustLabelAce@24
+ 704 2B2 00045290 RtlAddRefActivationContext = _RtlAddRefActivationContext@4
+ 705 2B3 00022880 RtlAddRefMemoryStream = _RtlAddRefMemoryStream@4
+ 706 2B4 000DD2B0 RtlAddResourceAttributeAce = _RtlAddResourceAttributeAce@28
+ 707 2B5 00083730 RtlAddSIDToBoundaryDescriptor = _RtlAddSIDToBoundaryDescriptor@8
+ 708 2B6 000DD600 RtlAddScopedPolicyIDAce = _RtlAddScopedPolicyIDAce@20
+ 709 2B7 000D1EE0 RtlAddVectoredContinueHandler = _RtlAddVectoredContinueHandler@8
+ 710 2B8 00077D60 RtlAddVectoredExceptionHandler = _RtlAddVectoredExceptionHandler@8
+ 711 2B9 0007F4A0 RtlAddressInSectionTable = _RtlAddressInSectionTable@12
+ 712 2BA 0007FBC0 RtlAdjustPrivilege = _RtlAdjustPrivilege@16
+ 713 2BB 00078360 RtlAllocateActivationContextStack = _RtlAllocateActivationContextStack@4
+ 714 2BC 00022F80 RtlAllocateAndInitializeSid = _RtlAllocateAndInitializeSid@44
+ 715 2BD 0008C260 RtlAllocateAndInitializeSidEx = _RtlAllocateAndInitializeSidEx@16
+ 716 2BE 00073E50 RtlAllocateHandle = _RtlAllocateHandle@8
+ 717 2BF 00037F20 RtlAllocateHeap = _RtlAllocateHeap@12
+ 718 2C0 00115010 RtlAllocateMemoryBlockLookaside = _RtlAllocateMemoryBlockLookaside@12
+ 719 2C1 001150C0 RtlAllocateMemoryZone = _RtlAllocateMemoryZone@12
+ 720 2C2 00085250 RtlAllocateWnfSerializationGroup = _RtlAllocateWnfSerializationGroup@0
+ 721 2C3 0003D9C0 RtlAnsiCharToUnicodeChar = _RtlAnsiCharToUnicodeChar@4
+ 722 2C4 000851F0 RtlAnsiStringToUnicodeSize = _RtlxAnsiStringToUnicodeSize@4
+ 723 2C5 0003E2F0 RtlAnsiStringToUnicodeString = _RtlAnsiStringToUnicodeString@12
+ 724 2C6 000DF6A0 RtlAppendAsciizToString = _RtlAppendAsciizToString@8
+ 725 2C7 000CCAA0 RtlAppendPathElement = _RtlAppendPathElement@12
+ 726 2C8 000DF700 RtlAppendStringToString = _RtlAppendStringToString@8
+ 727 2C9 00044570 RtlAppendUnicodeStringToString = _RtlAppendUnicodeStringToString@8
+ 728 2CA 000410F0 RtlAppendUnicodeToString = _RtlAppendUnicodeToString@8
+ 729 2CB 000D3AB0 RtlApplicationVerifierStop = _RtlApplicationVerifierStop@40
+ 730 2CC 000DA9C0 RtlApplyRXact = _RtlApplyRXact@4
+ 731 2CD 000863D0 RtlApplyRXactNoFlush = _RtlApplyRXactNoFlush@4
+ 732 2CE 000CC3E0 RtlAppxIsFileOwnedByTrustedInstaller = _RtlAppxIsFileOwnedByTrustedInstaller@8
+ 733 2CF 0007FC90 RtlAreAllAccessesGranted = _RtlAreAllAccessesGranted@8
+ 734 2D0 000DAA50 RtlAreAnyAccessesGranted = _RtlAreAnyAccessesGranted@8
+ 735 2D1 0007F840 RtlAreBitsClear = _RtlAreBitsClear@12
+ 736 2D2 0007AA60 RtlAreBitsSet = _RtlAreBitsSet@12
+ 737 2D3 0007B720 RtlAreLongPathsEnabled = _RtlAreLongPathsEnabled@0
+ 738 2D4 000E0650 RtlAssert = _RtlAssert@16
+ 739 2D5 000865D0 RtlAvlInsertNodeEx = _RtlAvlInsertNodeEx@16
+ 740 2D6 00086080 RtlAvlRemoveNode = _RtlAvlRemoveNode@8
+ 741 2D7 000E0760 RtlBarrier = _RtlBarrier@8
+ 742 2D8 000E0780 RtlBarrierForDelete = _RtlBarrierForDelete@8
+ 743 2D9 000F9760 RtlCancelTimer = _RtlCancelTimer@8
+ 744 2DA 00026D40 RtlCanonicalizeDomainName = _RtlCanonicalizeDomainName@12
+ 745 2DB 00028610 RtlCapabilityCheck = _RtlCapabilityCheck@12
+ 746 2DC 000A61B0 RtlCaptureContext = _RtlCaptureContext@4
+ 747 2DD 0006E540 RtlCaptureStackBackTrace = _RtlCaptureStackBackTrace@16
+ 748 2DE 000A64B0 RtlCaptureStackContext = _RtlCaptureStackContext@12
+ 749 2DF 0007ACC0 RtlCharToInteger = _RtlCharToInteger@12
+ 750 2E0 0008B3D0 RtlCheckBootStatusIntegrity = _RtlCheckBootStatusIntegrity@8
+ 751 2E1 0007F7D0 RtlCheckForOrphanedCriticalSections = _RtlCheckForOrphanedCriticalSections@4
+ 752 2E2 0006B150 RtlCheckPortableOperatingSystem = _RtlCheckPortableOperatingSystem@4
+ 753 2E3 00069CE0 RtlCheckRegistryKey = _RtlCheckRegistryKey@8
+ 754 2E4 00022CD0 RtlCheckSandboxedToken = _RtlCheckSandboxedToken@8
+ 755 2E5 0002A080 RtlCheckTokenCapability = _RtlCheckTokenCapability@12
+ 756 2E6 00087F90 RtlCheckTokenMembership = _RtlCheckTokenMembership@12
+ 757 2E7 0002EB10 RtlCheckTokenMembershipEx = _RtlCheckTokenMembershipEx@16
+ 758 2E8 0007F4D0 RtlCleanUpTEBLangLists = _RtlCleanUpTEBLangLists@0
+ 759 2E9 0005C740 RtlClearAllBits = _RtlClearAllBits@4
+ 760 2EA 000DF7C0 RtlClearBit = _RtlClearBit@8
+ 761 2EB 0005A4C0 RtlClearBits = _RtlClearBits@12
+ 762 2EC 00079FA0 RtlClearThreadWorkOnBehalfTicket = _RtlClearThreadWorkOnBehalfTicket@0
+ 763 2ED 000CFF70 RtlCloneMemoryStream = _RtlCloneMemoryStream@8
+ 764 2EE 000D07A0 RtlCloneUserProcess = _RtlCloneUserProcess@20
+ 765 2EF 000E3FE0 RtlCmDecodeMemIoResource = _RtlCmDecodeMemIoResource@8
+ 766 2F0 000E4060 RtlCmEncodeMemIoResource = _RtlCmEncodeMemIoResource@24
+ 767 2F1 000D1060 RtlCommitDebugInfo = _RtlCommitDebugInfo@8
+ 768 2F2 000CFF70 RtlCommitMemoryStream = _RtlCloneMemoryStream@8
+ 769 2F3 00087B40 RtlCompactHeap = _RtlCompactHeap@8
+ 770 2F4 000E5D90 RtlCompareAltitudes = _RtlCompareAltitudes@8
+ 771 2F5 000A5930 RtlCompareMemory = _RtlCompareMemory@12
+ 772 2F6 000A5980 RtlCompareMemoryUlong = _RtlCompareMemoryUlong@12
+ 773 2F7 0008C2F0 RtlCompareString = _RtlCompareString@12
+ 774 2F8 0004A890 RtlCompareUnicodeString = _RtlCompareUnicodeString@12
+ 775 2F9 0004A8C0 RtlCompareUnicodeStrings = _RtlCompareUnicodeStrings@20
+ 776 2FA 0006C7F0 RtlCompressBuffer = _RtlCompressBuffer@32
+ 777 2FB 0006E710 RtlComputeCrc32 = _RtlComputeCrc32@12
+ 778 2FC 000D7080 RtlComputeImportTableHash = _RtlComputeImportTableHash@12
+ 779 2FD 00022990 RtlComputePrivatizedDllName_U = _RtlComputePrivatizedDllName_U@12
+ 780 2FE 0008B8B0 RtlConnectToSm = _RtlConnectToSm@16
+ 781 2FF 000D9100 RtlConsoleMultiByteToUnicodeN = _RtlConsoleMultiByteToUnicodeN@24
+ 782 300 00083A20 RtlContractHashTable = _RtlContractHashTable@4
+ 783 301 00079600 RtlConvertDeviceFamilyInfoToString = _RtlConvertDeviceFamilyInfoToString@16
+ 784 302 0008BD10 RtlConvertExclusiveToShared = _RtlConvertExclusiveToShared@4
+ 785 303 000E1060 RtlConvertLCIDToString = _RtlConvertLCIDToString@20
+ 786 304 000A5F80 RtlConvertLongToLargeInteger = ___RtlConvertLongToLargeInteger@4
+ 787 305 000DC9C0 RtlConvertSRWLockExclusiveToShared = _RtlConvertSRWLockExclusiveToShared@4
+ 788 306 00075360 RtlConvertSharedToExclusive = _RtlConvertSharedToExclusive@4
+ 789 307 0002EDB0 RtlConvertSidToUnicodeString = _RtlConvertSidToUnicodeString@12
+ 790 308 000D0B50 RtlConvertToAutoInheritSecurityObject = _RtlConvertToAutoInheritSecurityObject@24
+ 791 309 000A5F90 RtlConvertUlongToLargeInteger = ___RtlConvertUlongToLargeInteger@4
+ 792 30A 000DF7F0 RtlCopyBitMap = _RtlCopyBitMap@12
+ 793 30B 000E6240 RtlCopyContext = _RtlCopyContext@12
+ 794 30C 000E63B0 RtlCopyExtendedContext = _RtlCopyExtendedContext@12
+ 795 30D 00079960 RtlCopyLuid = _RtlCopyLuid@8
+ 796 30E 000DAA70 RtlCopyLuidAndAttributesArray = _RtlCopyLuidAndAttributesArray@12
+ 797 30F 00086370 RtlCopyMappedMemory = _RtlCopyMappedMemory@12
+ 798 310 000CFFC0 RtlCopyMemoryStreamTo = _RtlCopyMemoryStreamTo@24
+ 799 311 000CFFC0 RtlCopyOutOfProcessMemoryStreamTo = _RtlCopyMemoryStreamTo@24
+ 800 312 00077150 RtlCopySecurityDescriptor = _RtlCopySecurityDescriptor@8
+ 801 313 00025D90 RtlCopySid = _RtlCopySid@12
+ 802 314 000DAAB0 RtlCopySidAndAttributesArray = _RtlCopySidAndAttributesArray@28
+ 803 315 00087390 RtlCopyString = _RtlCopyString@8
+ 804 316 0002CDA0 RtlCopyUnicodeString = _RtlCopyUnicodeString@8
+ 805 317 00080A10 RtlCrc32 = _RtlCrc32@12
+ 806 318 000E6D70 RtlCrc64 = _RtlCrc64@16
+ 807 319 00029FD0 RtlCreateAcl = _RtlCreateAcl@12
+ 808 31A 00060680 RtlCreateActivationContext = _RtlCreateActivationContext@24
+ 809 31B 00023350 RtlCreateAndSetSD = _RtlCreateAndSetSD@20
+ 810 31C 00073600 RtlCreateAtomTable = _RtlCreateAtomTable@8
+ 811 31D 000E0B40 RtlCreateBootStatusDataFile = _RtlCreateBootStatusDataFile@4
+ 812 31E 000842D0 RtlCreateBoundaryDescriptor = _RtlCreateBoundaryDescriptor@8
+ 813 31F 00058220 RtlCreateEnvironment = _RtlCreateEnvironment@8
+ 814 320 00058850 RtlCreateEnvironmentEx = _RtlCreateEnvironmentEx@12
+ 815 321 00080790 RtlCreateHashTable = _RtlCreateHashTable@12
+ 816 322 000E6140 RtlCreateHashTableEx = _RtlCreateHashTableEx@16
+ 817 323 00052900 RtlCreateHeap = _RtlCreateHeap@24
+ 818 324 0008A620 RtlCreateMemoryBlockLookaside = _RtlCreateMemoryBlockLookaside@20
+ 819 325 0008A7A0 RtlCreateMemoryZone = _RtlCreateMemoryZone@12
+ 820 326 000D09C0 RtlCreateProcessParameters = _RtlCreateProcessParameters@40
+ 821 327 00058310 RtlCreateProcessParametersEx = _RtlCreateProcessParametersEx@44
+ 822 328 000D00A0 RtlCreateProcessReflection = _RtlCreateProcessReflection@24
+ 823 329 000826C0 RtlCreateQueryDebugBuffer = _RtlCreateQueryDebugBuffer@8
+ 824 32A 000E0D40 RtlCreateRegistryKey = _RtlCreateRegistryKey@8
+ 825 32B 0002B090 RtlCreateSecurityDescriptor = _RtlCreateSecurityDescriptor@8
+ 826 32C 0006F510 RtlCreateServiceSid = _RtlCreateServiceSid@12
+ 827 32D 0008AAB0 RtlCreateSystemVolumeInformationFolder = _RtlCreateSystemVolumeInformationFolder@4
+ 828 32E 0007F790 RtlCreateTagHeap = _RtlCreateTagHeap@16
+ 829 32F 0005FDA0 RtlCreateTimer = _RtlCreateTimer@28
+ 830 330 0005F810 RtlCreateTimerQueue = _RtlCreateTimerQueue@4
+ 831 331 0002AFF0 RtlCreateUnicodeString = _RtlCreateUnicodeString@8
+ 832 332 00076530 RtlCreateUnicodeStringFromAsciiz = _RtlCreateUnicodeStringFromAsciiz@8
+ 833 333 000D7D90 RtlCreateUserProcess = _RtlCreateUserProcess@40
+ 834 334 0008B0A0 RtlCreateUserProcessEx = _RtlCreateUserProcessEx@20
+ 835 335 000D0B80 RtlCreateUserSecurityObject = _RtlCreateUserSecurityObject@28
+ 836 336 00083420 RtlCreateUserStack = _RtlCreateUserStack@24
+ 837 337 00068130 RtlCreateUserThread = _RtlCreateUserThread@40
+ 838 338 0006F430 RtlCreateVirtualAccountSid = _RtlCreateVirtualAccountSid@16
+ 839 339 0002C500 RtlCultureNameToLCID = _RtlCultureNameToLCID@8
+ 840 33A 000D9550 RtlCustomCPToUnicodeN = _RtlCustomCPToUnicodeN@24
+ 841 33B 00070490 RtlCutoverTimeToSystemTime = _RtlCutoverTimeToSystemTime@16
+ 842 33C 000D1080 RtlDeCommitDebugInfo = _RtlDeCommitDebugInfo@12
+ 843 33D 000D0A00 RtlDeNormalizeProcessParams = _RtlDeNormalizeProcessParams@4
+ 844 33E 00078510 RtlDeactivateActivationContext = _RtlDeactivateActivationContext@8
+ 10 33F 0003E670 RtlDeactivateActivationContextUnsafeFast = @RtlDeactivateActivationContextUnsafeFast@4
+ 845 340 00089240 RtlDebugPrintTimes = @_guard_check_icall_nop@4
+ 846 341 0006BB60 RtlDecodePointer = _RtlDecodePointer@4
+ 847 342 000D3CC0 RtlDecodeRemotePointer = _RtlDecodeRemotePointer@12
+ 848 343 000851A0 RtlDecodeSystemPointer = _RtlDecodeSystemPointer@4
+ 849 344 000903B0 RtlDecompressBuffer = _RtlDecompressBuffer@24
+ 850 345 0006BBA0 RtlDecompressBufferEx = _RtlDecompressBufferEx@28
+ 851 346 000E6000 RtlDecompressFragment = _RtlDecompressFragment@32
+ 852 347 00086730 RtlDefaultNpAcl = _RtlDefaultNpAcl@4
+ 853 348 0005D830 RtlDelete = _RtlDelete@4
+ 854 349 0007E600 RtlDeleteAce = _RtlDeleteAce@8
+ 855 34A 00073880 RtlDeleteAtomFromAtomTable = _RtlDeleteAtomFromAtomTable@8
+ 856 34B 000E07A0 RtlDeleteBarrier = _RtlDeleteBarrier@4
+ 857 34C 000342B0 RtlDeleteBoundaryDescriptor = _NtdllpFreeStringRoutine@4
+ 858 34D 00057370 RtlDeleteCriticalSection = _RtlDeleteCriticalSection@4
+ 859 34E 0005D3E0 RtlDeleteElementGenericTable = _RtlDeleteElementGenericTable@8
+ 860 34F 00071BD0 RtlDeleteElementGenericTableAvl = _RtlDeleteElementGenericTableAvl@8
+ 861 350 00071DD0 RtlDeleteElementGenericTableAvlEx = _RtlDeleteElementGenericTableAvlEx@8
+ 862 351 000870C0 RtlDeleteHashTable = _RtlDeleteHashTable@4
+ 863 352 0005D8B0 RtlDeleteNoSplay = _RtlDeleteNoSplay@8
+ 864 353 0008CDF0 RtlDeleteRegistryValue = _RtlDeleteRegistryValue@12
+ 865 354 00057330 RtlDeleteResource = _RtlDeleteResource@4
+ 866 355 0007FE20 RtlDeleteSecurityObject = _RtlDeleteSecurityObject@4
+ 867 356 0005FC60 RtlDeleteTimer = _RtlDeleteTimer@12
+ 868 357 000F9780 RtlDeleteTimerQueue = _RtlDeleteTimerQueue@4
+ 869 358 0005F590 RtlDeleteTimerQueueEx = _RtlDeleteTimerQueueEx@8
+ 870 359 000E77A0 RtlDeregisterSecureMemoryCacheCallback = _RtlDeregisterSecureMemoryCacheCallback@4
+ 871 35A 0005F570 RtlDeregisterWait = _RtlDeregisterWait@4
+ 872 35B 0005F900 RtlDeregisterWaitEx = _RtlDeregisterWaitEx@8
+ 873 35C 000439C0 RtlDeriveCapabilitySidsFromName = _RtlDeriveCapabilitySidsFromName@12
+ 874 35D 000DEB30 RtlDestroyAtomTable = _RtlDestroyAtomTable@4
+ 875 35E 000836C0 RtlDestroyEnvironment = _RtlDestroyEnvironment@4
+ 876 35F 00087F60 RtlDestroyHandleTable = _RtlDestroyHandleTable@4
+ 877 360 00056470 RtlDestroyHeap = _RtlDestroyHeap@4
+ 878 361 00087140 RtlDestroyMemoryBlockLookaside = _RtlDestroyMemoryBlockLookaside@4
+ 879 362 00087190 RtlDestroyMemoryZone = _RtlDestroyMemoryZone@4
+ 880 363 000836C0 RtlDestroyProcessParameters = _RtlDestroyEnvironment@4
+ 881 364 000750B0 RtlDestroyQueryDebugBuffer = _RtlDestroyQueryDebugBuffer@4
+ 882 365 0005E600 RtlDetectHeapLeaks = _RtlDetectHeapLeaks@0
+ 883 366 00052340 RtlDetermineDosPathNameType_U = _RtlDetermineDosPathNameType_U@4
+ 884 367 000CC7D0 RtlDisableThreadProfiling = _RtlDisableThreadProfiling@4
+ 8 368 00084890 RtlDispatchAPC = _RtlDispatchAPC@12
+ 885 369 00055E80 RtlDllShutdownInProgress = _RtlDllShutdownInProgress@0
+ 886 36A 0007BF20 RtlDnsHostNameToComputerName = _RtlDnsHostNameToComputerName@12
+ 887 36B 0005DCB0 RtlDoesFileExists_U = _RtlDoesFileExists_U@4
+ 888 36C 00041410 RtlDosApplyFileIsolationRedirection_Ustr = _RtlDosApplyFileIsolationRedirection_Ustr@36
+ 889 36D 00045B00 RtlDosPathNameToNtPathName_U = _RtlDosPathNameToNtPathName_U@16
+ 890 36E 0007BC20 RtlDosPathNameToNtPathName_U_WithStatus = _RtlDosPathNameToNtPathName_U_WithStatus@16
+ 891 36F 00065090 RtlDosPathNameToRelativeNtPathName_U = _RtlDosPathNameToRelativeNtPathName_U@16
+ 892 370 00041920 RtlDosPathNameToRelativeNtPathName_U_WithStatus = _RtlDosPathNameToRelativeNtPathName_U_WithStatus@16
+ 893 371 0008B4C0 RtlDosSearchPath_U = _RtlDosSearchPath_U@24
+ 894 372 000455B0 RtlDosSearchPath_Ustr = _RtlDosSearchPath_Ustr@36
+ 895 373 000DF080 RtlDowncaseUnicodeChar = _RtlDowncaseUnicodeChar@4
+ 896 374 0007AE00 RtlDowncaseUnicodeString = _RtlDowncaseUnicodeString@12
+ 897 375 000DCA90 RtlDumpResource = _RtlDumpResource@4
+ 898 376 0007B5D0 RtlDuplicateUnicodeString = _RtlDuplicateUnicodeString@12
+ 899 377 000DEBF0 RtlEmptyAtomTable = _RtlEmptyAtomTable@8
+ 900 378 000DCAE0 RtlEnableEarlyCriticalSectionEventCreation = _RtlEnableEarlyCriticalSectionEventCreation@0
+ 901 379 000CC820 RtlEnableThreadProfiling = _RtlEnableThreadProfiling@20
+ 902 37A 00077EA0 RtlEncodePointer = _RtlEncodePointer@4
+ 903 37B 000D3D10 RtlEncodeRemotePointer = _RtlEncodeRemotePointer@12
+ 904 37C 00087210 RtlEncodeSystemPointer = _RtlEncodeSystemPointer@4
+ 905 37D 00083D30 RtlEndEnumerationHashTable = _RtlEndEnumerationHashTable@8
+ 906 37E 000E6160 RtlEndStrongEnumerationHashTable = _RtlEndStrongEnumerationHashTable@8
+ 907 37F 000E6170 RtlEndWeakEnumerationHashTable = _RtlEndWeakEnumerationHashTable@8
+ 908 380 000A5D20 RtlEnlargedIntegerMultiply = __RtlEnlargedIntegerMultiply@8
+ 909 381 000A5D30 RtlEnlargedUnsignedMultiply = __RtlEnlargedUnsignedMultiply@8
+ 910 382 0003C980 RtlEnterCriticalSection = _RtlEnterCriticalSection@4
+ 911 383 000E45F0 RtlEnumProcessHeaps = _RtlEnumProcessHeaps@8
+ 912 384 00076280 RtlEnumerateEntryHashTable = _RtlEnumerateEntryHashTable@8
+ 913 385 0005D390 RtlEnumerateGenericTable = _RtlEnumerateGenericTable@8
+ 914 386 00072B80 RtlEnumerateGenericTableAvl = _RtlEnumerateGenericTableAvl@8
+ 915 387 000E7510 RtlEnumerateGenericTableLikeADirectory = _RtlEnumerateGenericTableLikeADirectory@28
+ 916 388 00072AE0 RtlEnumerateGenericTableWithoutSplaying = _RtlEnumerateGenericTableWithoutSplaying@8
+ 917 389 00072BB0 RtlEnumerateGenericTableWithoutSplayingAvl = _RtlEnumerateGenericTableWithoutSplayingAvl@8
+ 918 38A 000DF0E0 RtlEqualComputerName = _RtlEqualComputerName@8
+ 919 38B 000264F0 RtlEqualDomainName = _RtlEqualDomainName@8
+ 920 38C 000DAB50 RtlEqualLuid = _RtlEqualLuid@8
+ 921 38D 000278A0 RtlEqualPrefixSid = _RtlEqualPrefixSid@8
+ 922 38E 00027160 RtlEqualSid = _RtlEqualSid@8
+ 923 38F 00080900 RtlEqualString = _RtlEqualString@12
+ 924 390 00043B20 RtlEqualUnicodeString = _RtlEqualUnicodeString@12
+ 925 391 00088410 RtlEqualWnfChangeStamps = _RtlEqualWnfChangeStamps@8
+ 926 392 000DAB80 RtlEraseUnicodeString = _RtlEraseUnicodeString@4
+ 927 393 000E8280 RtlEthernetAddressToStringA = _RtlEthernetAddressToStringA@8
+ 928 394 000E8470 RtlEthernetAddressToStringW = _RtlEthernetAddressToStringW@8
+ 929 395 000E84C0 RtlEthernetStringToAddressA = _RtlEthernetStringToAddressA@12
+ 930 396 000E85F0 RtlEthernetStringToAddressW = _RtlEthernetStringToAddressW@12
+ 931 397 0005DD60 RtlExitUserProcess = _RtlExitUserProcess@4
+ 932 398 0006AD50 RtlExitUserThread = _RtlExitUserThread@4
+ 933 399 0004A4E0 RtlExpandEnvironmentStrings = _RtlExpandEnvironmentStrings@24
+ 934 39A 00064E30 RtlExpandEnvironmentStrings_U = _RtlExpandEnvironmentStrings_U@16
+ 935 39B 00075F60 RtlExpandHashTable = _RtlExpandHashTable@4
+ 936 39C 000DEED0 RtlExtendMemoryBlockLookaside = _RtlExtendMemoryBlockLookaside@8
+ 937 39D 000DEF40 RtlExtendMemoryZone = _RtlExtendMemoryZone@8
+ 938 39E 000A5E50 RtlExtendedIntegerMultiply = _RtlExtendedIntegerMultiply@12
+ 939 39F 000A5D60 RtlExtendedLargeIntegerDivide = _RtlExtendedLargeIntegerDivide@16
+ 940 3A0 000A5DC0 RtlExtendedMagicDivide = _RtlExtendedMagicDivide@20
+ 941 3A1 000DF9A0 RtlExtractBitMap = _RtlExtractBitMap@16
+ 942 3A2 000A59B0 RtlFillMemory = _RtlFillMemory@12
+ 943 3A3 000A5A20 RtlFillMemoryUlong = _RtlFillMemoryUlong@12
+ 944 3A4 000A59F0 RtlFillMemoryUlonglong = _RtlFillMemoryUlonglong@16
+ 945 3A5 0008AAA0 RtlFinalReleaseOutOfProcessMemoryStream = _LdrStandardizeSystemPath@4
+ 946 3A6 0002A020 RtlFindAceByType = _RtlFindAceByType@12
+ 947 3A7 00041180 RtlFindActivationContextSectionGuid = _RtlFindActivationContextSectionGuid@20
+ 948 3A8 00042CD0 RtlFindActivationContextSectionString = _RtlFindActivationContextSectionString@20
+ 949 3A9 000437B0 RtlFindCharInUnicodeString = _RtlFindCharInUnicodeString@16
+ 950 3AA 00020140 RtlFindClearBits = _RtlFindClearBits@12
+ 951 3AB 0005A010 RtlFindClearBitsAndSet = _RtlFindClearBitsAndSet@12
+ 952 3AC 000DFB00 RtlFindClearRuns = _RtlFindClearRuns@16
+ 953 3AD 000E41A0 RtlFindClosestEncodableLength = _RtlFindClosestEncodableLength@12
+ 954 3AE 000DED60 RtlFindExportedRoutineByName = _RtlFindExportedRoutineByName@8
+ 955 3AF 0007E2E0 RtlFindLastBackwardRunClear = _RtlFindLastBackwardRunClear@12
+ 956 3B0 000856E0 RtlFindLeastSignificantBit = _RtlFindLeastSignificantBit@8
+ 957 3B1 000DFD40 RtlFindLongestRunClear = _RtlFindLongestRunClear@8
+ 958 3B2 0002AF70 RtlFindMessage = _RtlFindMessage@20
+ 959 3B3 00085FB0 RtlFindMostSignificantBit = _RtlFindMostSignificantBit@8
+ 960 3B4 0001FFF0 RtlFindNextForwardRunClear = _RtlFindNextForwardRunClear@12
+ 961 3B5 0008BD40 RtlFindSetBits = _RtlFindSetBits@12
+ 962 3B6 000DFD80 RtlFindSetBitsAndClear = _RtlFindSetBitsAndClear@12
+ 963 3B7 000DF0F0 RtlFindUnicodeSubstring = _RtlFindUnicodeSubstring@12
+ 964 3B8 000A58E0 RtlFirstEntrySList = _FirstEntrySList@4
+ 965 3B9 0002F500 RtlFirstFreeAce = _RtlFirstFreeAce@8
+ 966 3BA 00059E80 RtlFlsAlloc = _RtlFlsAlloc@8
+ 967 3BB 0005A390 RtlFlsFree = _RtlFlsFree@4
+ 968 3BC 0005A7C0 RtlFlushHeaps = _RtlFlushHeaps@0
+ 969 3BD 000E7830 RtlFlushSecureMemoryCache = _RtlFlushSecureMemoryCache@8
+ 970 3BE 0002B240 RtlFormatCurrentUserKeyPath = _RtlFormatCurrentUserKeyPath@4
+ 971 3BF 000E8710 RtlFormatMessage = _RtlFormatMessage@36
+ 972 3C0 00070F60 RtlFormatMessageEx = _RtlFormatMessageEx@40
+ 973 3C1 00078460 RtlFreeActivationContextStack = _RtlFreeActivationContextStack@4
+ 974 3C2 00031940 RtlFreeAnsiString = _RtlFreeAnsiString@4
+ 975 3C3 00073850 RtlFreeHandle = _RtlFreeHandle@8
+ 976 3C4 00035A20 RtlFreeHeap = _RtlFreeHeap@12
+ 977 3C5 00115130 RtlFreeMemoryBlockLookaside = _RtlFreeMemoryBlockLookaside@8
+ 978 3C6 0008CF20 RtlFreeOemString = _RtlFreeOemString@4
+ 979 3C7 00022F50 RtlFreeSid = _RtlFreeSid@4
+ 980 3C8 000783B0 RtlFreeThreadActivationContextStack = _RtlFreeThreadActivationContextStack@0
+ 981 3C9 00031940 RtlFreeUnicodeString = _RtlFreeAnsiString@4
+ 982 3CA 00086940 RtlFreeUserStack = _RtlFreeUserStack@4
+ 983 3CB 00075AE0 RtlGUIDFromString = _RtlGUIDFromString@8
+ 984 3CC 000E8900 RtlGenerate8dot3Name = _RtlGenerate8dot3Name@16
+ 985 3CD 00079980 RtlGetAce = _RtlGetAce@12
+ 986 3CE 0004F4A0 RtlGetActiveActivationContext = _RtlGetActiveActivationContext@4
+ 987 3CF 00083400 RtlGetActiveConsoleId = _RtlGetActiveConsoleId@0
+ 988 3D0 000766E0 RtlGetAppContainerNamedObjectPath = _RtlGetAppContainerNamedObjectPath@16
+ 989 3D1 00021480 RtlGetAppContainerParent = _RtlGetAppContainerParent@8
+ 990 3D2 00076D00 RtlGetAppContainerSidType = _RtlGetAppContainerSidType@8
+ 991 3D3 000E08D0 RtlGetCallersAddress = _RtlGetCallersAddress@8
+ 992 3D4 000830F0 RtlGetCompressionWorkSpaceSize = _RtlGetCompressionWorkSpaceSize@12
+ 993 3D5 000E8FE0 RtlGetConsoleSessionForegroundProcessId = _RtlGetConsoleSessionForegroundProcessId@0
+ 994 3D6 0007DAA0 RtlGetControlSecurityDescriptor = _RtlGetControlSecurityDescriptor@12
+ 995 3D7 000DCB00 RtlGetCriticalSectionRecursionCount = _RtlGetCriticalSectionRecursionCount@4
+ 996 3D8 0007A600 RtlGetCurrentDirectory_U = _RtlGetCurrentDirectory_U@8
+ 997 3D9 000E9010 RtlGetCurrentPeb = _RtlGetCurrentPeb@0
+ 998 3DA 00072E90 RtlGetCurrentProcessorNumber = _RtlGetCurrentProcessorNumber@0
+ 999 3DB 00075F30 RtlGetCurrentProcessorNumberEx = _RtlGetCurrentProcessorNumberEx@4
+ 1000 3DC 00036020 RtlGetCurrentServiceSessionId = _RtlGetCurrentServiceSessionId@0
+ 1001 3DD 00077BD0 RtlGetCurrentTransaction = _RtlGetCurrentTransaction@0
+ 1002 3DE 00077CF0 RtlGetDaclSecurityDescriptor = _RtlGetDaclSecurityDescriptor@16
+ 1003 3DF 000796D0 RtlGetDeviceFamilyInfoEnum = _RtlGetDeviceFamilyInfoEnum@12
+ 1004 3E0 0007AB60 RtlGetElementGenericTable = _RtlGetElementGenericTable@8
+ 1005 3E1 000E7600 RtlGetElementGenericTableAvl = _RtlGetElementGenericTableAvl@8
+ 1006 3E2 00084F90 RtlGetEnabledExtendedFeatures = _RtlGetEnabledExtendedFeatures@8
+ 1007 3E3 00085070 RtlGetExePath = _RtlGetExePath@8
+ 1008 3E4 000217D0 RtlGetExtendedContextLength = _RtlGetExtendedContextLength@8
+ 1009 3E5 00021E60 RtlGetExtendedFeaturesMask = _RtlGetExtendedFeaturesMask@4
+ 1010 3E6 00060AB0 RtlGetFileMUIPath = _RtlGetFileMUIPath@28
+ 1011 3E7 000CD1D0 RtlGetFrame = _RtlGetFrame@0
+ 1012 3E8 00061110 RtlGetFullPathName_U = _RtlGetFullPathName_U@16
+ 1013 3E9 00061150 RtlGetFullPathName_UEx = _RtlGetFullPathName_UEx@20
+ 1014 3EA 00045300 RtlGetFullPathName_UstrEx = _RtlGetFullPathName_UstrEx@32
+ 1015 3EB 0007D9E0 RtlGetGroupSecurityDescriptor = _RtlGetGroupSecurityDescriptor@12
+ 1016 3EC 00073C90 RtlGetIntegerAtom = _RtlGetIntegerAtom@8
+ 1017 3ED 000DA3B0 RtlGetInterruptTimePrecise = _RtlGetInterruptTimePrecise@4
+ 1018 3EE 00087870 RtlGetLastNtStatus = _RtlGetLastNtStatus@0
+ 1019 3EF 0008CF40 RtlGetLastWin32Error = _RtlGetLastWin32Error@0
+ 1020 3F0 00077FE0 RtlGetLengthWithoutLastFullDosOrNtPathElement = _RtlGetLengthWithoutLastFullDosOrNtPathElement@12
+ 1021 3F1 0008BCB0 RtlGetLengthWithoutTrailingPathSeperators = _RtlGetLengthWithoutTrailingPathSeperators@12
+ 1022 3F2 0007EB30 RtlGetLocaleFileMappingAddress = _RtlGetLocaleFileMappingAddress@12
+ 1023 3F3 00087640 RtlGetLongestNtPathLength = _RtlGetLongestNtPathLength@0
+ 1024 3F4 000917B0 RtlGetNativeSystemInformation = _NtQuerySystemInformation@16
+ 1025 3F5 0007FCB0 RtlGetNextEntryHashTable = _RtlGetNextEntryHashTable@8
+ 1026 3F6 000E0D80 RtlGetNtGlobalFlags = _RtlGetNtGlobalFlags@0
+ 1027 3F7 0004F430 RtlGetNtProductType = _RtlGetNtProductType@4
+ 1028 3F8 000608F0 RtlGetNtSystemRoot = _RtlGetNtSystemRoot@0
+ 1029 3F9 000836F0 RtlGetNtVersionNumbers = _RtlGetNtVersionNumbers@12
+ 1030 3FA 0007C7F0 RtlGetOwnerSecurityDescriptor = _RtlGetOwnerSecurityDescriptor@12
+ 1031 3FB 0002ABA0 RtlGetParentLocaleName = _RtlGetParentLocaleName@16
+ 1032 3FC 000E4610 RtlGetProcessHeaps = _RtlGetProcessHeaps@8
+ 1033 3FD 000E1130 RtlGetProcessPreferredUILanguages = _RtlGetProcessPreferredUILanguages@16
+ 1034 3FE 00083860 RtlGetProductInfo = _RtlGetProductInfo@20
+ 1035 3FF 0007A010 RtlGetSaclSecurityDescriptor = _RtlGetSaclSecurityDescriptor@16
+ 1036 400 00050630 RtlGetSearchPath = _RtlGetSearchPath@4
+ 1037 401 000878C0 RtlGetSecurityDescriptorRMControl = _RtlGetSecurityDescriptorRMControl@8
+ 1038 402 000DABC0 RtlGetSessionProperties = _RtlGetSessionProperties@8
+ 1039 403 00085270 RtlGetSetBootStatusData = _RtlGetSetBootStatusData@24
+ 1040 404 0004F470 RtlGetSuiteMask = _RtlGetSuiteMask@0
+ 1041 405 00024F10 RtlGetSystemPreferredUILanguages = _RtlGetSystemPreferredUILanguages@20
+ 1042 406 00066AD0 RtlGetSystemTimePrecise = _RtlGetSystemTimePrecise@0
+ 1043 407 000839C0 RtlGetThreadErrorMode = _RtlGetThreadErrorMode@0
+ 1044 408 000E1200 RtlGetThreadLangIdByIndex = _RtlGetThreadLangIdByIndex@16
+ 1045 409 00030460 RtlGetThreadPreferredUILanguages = _RtlGetThreadPreferredUILanguages@16
+ 1046 40A 0003C780 RtlGetThreadWorkOnBehalfTicket = _RtlGetThreadWorkOnBehalfTicket@8
+ 1047 40B 000766B0 RtlGetTokenNamedObjectPath = _RtlGetTokenNamedObjectPath@12
+ 1048 40C 000E12D0 RtlGetUILanguageInfo = _RtlGetUILanguageInfo@20
+ 1049 40D 000CDA00 RtlGetUnloadEventTrace = _RtlGetUnloadEventTrace@0
+ 1050 40E 000223D0 RtlGetUnloadEventTraceEx = _RtlGetUnloadEventTraceEx@12
+ 1051 40F 0005CB20 RtlGetUserInfoHeap = _RtlGetUserInfoHeap@20
+ 1052 410 000249A0 RtlGetUserPreferredUILanguages = _RtlGetUserPreferredUILanguages@20
+ 1053 411 0004EAF0 RtlGetVersion = _RtlGetVersion@4
+ 1054 412 0007D200 RtlGuardCheckLongJumpTarget = _RtlGuardCheckLongJumpTarget@12
+ 1055 413 000435A0 RtlHashUnicodeString = _RtlHashUnicodeString@16
+ 1056 414 000E9A30 RtlHeapTrkInitialize = _RtlHeapTrkInitialize@4
+ 1057 415 0007FAA0 RtlIdentifierAuthoritySid = _RtlIdentifierAuthoritySid@4
+ 1058 416 000279C0 RtlIdnToAscii = _RtlIdnToAscii@20
+ 1059 417 000EAB50 RtlIdnToNameprepUnicode = _RtlIdnToNameprepUnicode@20
+ 1060 418 00025ED0 RtlIdnToUnicode = _RtlIdnToUnicode@20
+ 1061 419 00049CC0 RtlImageDirectoryEntryToData = _RtlImageDirectoryEntryToData@16
+ 1062 41A 0004EDE0 RtlImageNtHeader = _RtlImageNtHeader@4
+ 1063 41B 0003FC20 RtlImageNtHeaderEx = _RtlImageNtHeaderEx@20
+ 1064 41C 0007FD40 RtlImageRvaToSection = _RtlImageRvaToSection@12
+ 1065 41D 0007FCF0 RtlImageRvaToVa = _RtlImageRvaToVa@16
+ 1066 41E 0007D750 RtlImpersonateSelf = _RtlImpersonateSelf@4
+ 1067 41F 0007D770 RtlImpersonateSelfEx = _RtlImpersonateSelfEx@12
+ 1068 420 00094400 RtlInitAnsiString = _RtlInitAnsiString@8
+ 1069 421 00076570 RtlInitAnsiStringEx = _RtlInitAnsiStringEx@8
+ 1070 422 000E07D0 RtlInitBarrier = _RtlInitBarrier@12
+ 1071 423 000D9760 RtlInitCodePageTable = _RtlInitCodePageTable@8
+ 1072 424 00076100 RtlInitEnumerationHashTable = _RtlInitEnumerationHashTable@8
+ 1073 425 0008AAA0 RtlInitMemoryStream = _LdrStandardizeSystemPath@4
+ 1074 426 000D9810 RtlInitNlsTables = _RtlInitNlsTables@16
+ 1075 427 0008AAA0 RtlInitOutOfProcessMemoryStream = _LdrStandardizeSystemPath@4
+ 1076 428 000943C0 RtlInitString = _RtlInitString@8
+ 1077 429 000DF760 RtlInitStringEx = _RtlInitStringEx@8
+ 1078 42A 000E6180 RtlInitStrongEnumerationHashTable = _RtlInitStrongEnumerationHashTable@8
+ 1079 42B 00094440 RtlInitUnicodeString = _RtlInitUnicodeString@8
+ 1080 42C 000428F0 RtlInitUnicodeStringEx = _RtlInitUnicodeStringEx@8
+ 1081 42D 000E61C0 RtlInitWeakEnumerationHashTable = _RtlInitWeakEnumerationHashTable@8
+ 1082 42E 00022880 RtlInitializeAtomPackage = _RtlAddRefMemoryStream@4
+ 1083 42F 0007CA20 RtlInitializeBitMap = _RtlInitializeBitMap@12
+ 1084 430 000763A0 RtlInitializeConditionVariable = _RtlInitializeConditionVariable@4
+ 1085 431 000EABC0 RtlInitializeContext = _RtlInitializeContext@20
+ 1086 432 00071880 RtlInitializeCriticalSection = _RtlInitializeCriticalSection@4
+ 1087 433 00071A20 RtlInitializeCriticalSectionAndSpinCount = _RtlInitializeCriticalSectionAndSpinCount@8
+ 1088 434 000540C0 RtlInitializeCriticalSectionEx = _RtlInitializeCriticalSectionEx@12
+ 1089 435 0006AD10 RtlInitializeExceptionChain = _RtlInitializeExceptionChain@4
+ 1090 436 00021700 RtlInitializeExtendedContext = _RtlInitializeExtendedContext@12
+ 1091 437 0007D560 RtlInitializeGenericTable = _RtlInitializeGenericTable@20
+ 1092 438 00083DF0 RtlInitializeGenericTableAvl = _RtlInitializeGenericTableAvl@20
+ 1093 439 00082110 RtlInitializeHandleTable = _RtlInitializeHandleTable@12
+ 1094 43A 00093CE0 RtlInitializeNtUserPfn = _RtlInitializeNtUserPfn@24
+ 1095 43B 0008C3C0 RtlInitializeRXact = _RtlInitializeRXact@12
+ 1096 43C 00053F10 RtlInitializeResource = _RtlInitializeResource@4
+ 1097 43D 0007AC40 RtlInitializeSListHead = _RtlInitializeSListHead@4
+ 1098 43E 000763A0 RtlInitializeSRWLock = _RtlInitializeConditionVariable@4
+ 1099 43F 0002AED0 RtlInitializeSid = _RtlInitializeSid@12
+ 1100 440 0002AE80 RtlInitializeSidEx = _RtlInitializeSidEx
+ 1101 441 0005D470 RtlInsertElementGenericTable = _RtlInsertElementGenericTable@16
+ 1102 442 00071C10 RtlInsertElementGenericTableAvl = _RtlInsertElementGenericTableAvl@16
+ 1103 443 0005D4B0 RtlInsertElementGenericTableFull = _RtlInsertElementGenericTableFull@24
+ 1104 444 00071C50 RtlInsertElementGenericTableFullAvl = _RtlInsertElementGenericTableFullAvl@24
+ 1105 445 00076160 RtlInsertEntryHashTable = _RtlInsertEntryHashTable@16
+ 1106 446 000E0A10 RtlInt64ToUnicodeString = _RtlInt64ToUnicodeString@16
+ 1107 447 0002A890 RtlIntegerToChar = _RtlIntegerToChar@16
+ 1108 448 0002A820 RtlIntegerToUnicodeString = _RtlIntegerToUnicodeString@12
+ 1109 449 0007EC30 RtlInterlockedClearBitRun = _RtlInterlockedClearBitRun@12
+ 1110 44A 000A5910 RtlInterlockedCompareExchange64 = _InterlockedCompareExchange64@20
+ 1111 44B 000795E0 RtlInterlockedFlushSList = _RtlInterlockedFlushSList@4
+ 1112 44C 00048B30 RtlInterlockedPopEntrySList = _RtlInterlockedPopEntrySList@4
+ 1113 44D 00074430 RtlInterlockedPushEntrySList = _RtlInterlockedPushEntrySList@8
+ 11 44E 000A58B0 RtlInterlockedPushListSList = @InterlockedPushListSList@16
+ 1114 44F 000EAF30 RtlInterlockedPushListSListEx = _RtlInterlockedPushListSListEx@16
+ 1115 450 000E0060 RtlInterlockedSetBitRun = _RtlInterlockedSetBitRun@12
+ 1116 451 000E4290 RtlIoDecodeMemIoResource = _RtlIoDecodeMemIoResource@16
+ 1117 452 000E4350 RtlIoEncodeMemIoResource = _RtlIoEncodeMemIoResource@40
+ 1118 453 000855A0 RtlIpv4AddressToStringA = _RtlIpv4AddressToStringA@8
+ 1119 454 000E82D0 RtlIpv4AddressToStringExA = _RtlIpv4AddressToStringExA@16
+ 1120 455 00081690 RtlIpv4AddressToStringExW = _RtlIpv4AddressToStringExW@16
+ 1121 456 00081750 RtlIpv4AddressToStringW = _RtlIpv4AddressToStringW@8
+ 1122 457 0007D390 RtlIpv4StringToAddressA = _RtlIpv4StringToAddressA@16
+ 1123 458 0007D340 RtlIpv4StringToAddressExA = _RtlIpv4StringToAddressExA@16
+ 1124 459 00026A30 RtlIpv4StringToAddressExW = _RtlIpv4StringToAddressExW@16
+ 1125 45A 00026B40 RtlIpv4StringToAddressW = _RtlIpv4StringToAddressW@16
+ 1126 45B 00070CD0 RtlIpv6AddressToStringA = _RtlIpv6AddressToStringA@8
+ 1127 45C 000E8380 RtlIpv6AddressToStringExA = _RtlIpv6AddressToStringExA@20
+ 1128 45D 000709C0 RtlIpv6AddressToStringExW = _RtlIpv6AddressToStringExW@20
+ 1129 45E 00070AE0 RtlIpv6AddressToStringW = _RtlIpv6AddressToStringW@8
+ 1130 45F 0007CF10 RtlIpv6StringToAddressA = _RtlIpv6StringToAddressA@12
+ 1131 460 0007CEA0 RtlIpv6StringToAddressExA = _RtlIpv6StringToAddressExA@16
+ 1132 461 00026560 RtlIpv6StringToAddressExW = _RtlIpv6StringToAddressExW@16
+ 1133 462 000266B0 RtlIpv6StringToAddressW = _RtlIpv6StringToAddressW@12
+ 1134 463 000D66F0 RtlIsActivationContextActive = _RtlIsActivationContextActive@4
+ 1135 464 00028A90 RtlIsCapabilitySid = _RtlIsCapabilitySid@4
+ 1136 465 000DCB30 RtlIsCriticalSectionLocked = _RtlIsCriticalSectionLocked@4
+ 1137 466 0004AC00 RtlIsCriticalSectionLockedByThread = _RtlIsCriticalSectionLockedByThread@4
+ 1138 467 000D0A90 RtlIsCurrentThreadAttachExempt = _RtlIsCurrentThreadAttachExempt@0
+ 1139 468 00045B30 RtlIsDosDeviceName_U = _RtlIsDosDeviceName_U@4
+ 1140 469 00084F00 RtlIsElevatedRid = _RtlIsElevatedRid@4
+ 1141 46A 0007B4E0 RtlIsGenericTableEmpty = _RtlIsGenericTableEmpty@4
+ 1142 46B 000E76F0 RtlIsGenericTableEmptyAvl = _RtlIsGenericTableEmptyAvl@4
+ 1143 46C 000285F0 RtlIsMultiSessionSku = _RtlIsMultiSessionSku@0
+ 1144 46D 000875F0 RtlIsMultiUsersInSessionSku = _RtlIsMultiUsersInSessionSku@0
+ 1145 46E 000EAFA0 RtlIsNameInExpression = _RtlIsNameInExpression@16
+ 1146 46F 000E8D40 RtlIsNameLegalDOS8Dot3 = _RtlIsNameLegalDOS8Dot3@12
+ 1147 470 000EB5C0 RtlIsNonEmptyDirectoryReparsePointAllowed = _RtlIsNonEmptyDirectoryReparsePointAllowed@4
+ 1148 471 00021520 RtlIsNormalizedString = _RtlIsNormalizedString@16
+ 1149 472 00084790 RtlIsPackageSid = _RtlIsPackageSid@4
+ 1150 473 00076640 RtlIsParentOfChildAppContainer = _RtlIsParentOfChildAppContainer@8
+ 1151 474 000EC250 RtlIsPlaceholderFileHandle = _RtlIsPlaceholderFileHandle@8
+ 1152 475 000EC290 RtlIsPlaceholderFileInfo = _RtlIsPlaceholderFileInfo@12
+ 1153 476 0007F5F0 RtlIsProcessorFeaturePresent = _RtlIsProcessorFeaturePresent@4
+ 1154 477 0006DB80 RtlIsTextUnicode = _RtlIsTextUnicode@12
+ 1155 478 00084EE0 RtlIsThreadWithinLoaderCallout = _RtlIsThreadWithinLoaderCallout@0
+ 1156 479 000DAC50 RtlIsUntrustedObject = _RtlIsUntrustedObject@12
+ 1157 47A 00073DB0 RtlIsValidHandle = _RtlIsValidHandle@8
+ 1158 47B 00073D70 RtlIsValidIndexHandle = _RtlIsValidIndexHandle@12
+ 1159 47C 000E9050 RtlIsValidLocaleName = _RtlIsValidLocaleName@8
+ 1160 47D 00082B70 RtlIsValidProcessTrustLabelSid = _RtlIsValidProcessTrustLabelSid@4
+ 1161 47E 000225C0 RtlKnownExceptionFilter = _RtlKnownExceptionFilter@4
+ 1162 47F 0002C0F0 RtlLCIDToCultureName = _RtlLCIDToCultureName@8
+ 1163 480 000A5D00 RtlLargeIntegerAdd = _RtlLargeIntegerAdd@16
+ 1164 481 000A5F10 RtlLargeIntegerArithmeticShift = _RtlLargeIntegerArithmeticShift@12
+ 1165 482 000EC840 RtlLargeIntegerDivide = _RtlLargeIntegerDivide@20
+ 1166 483 000A5F40 RtlLargeIntegerNegate = _RtlLargeIntegerNegate@8
+ 1167 484 000A5EB0 RtlLargeIntegerShiftLeft = _RtlLargeIntegerShiftLeft@12
+ 1168 485 000A5EE0 RtlLargeIntegerShiftRight = _RtlLargeIntegerShiftRight@12
+ 1169 486 000A5F60 RtlLargeIntegerSubtract = _RtlLargeIntegerSubtract@16
+ 1170 487 00021630 RtlLargeIntegerToChar = _RtlLargeIntegerToChar@16
+ 1171 488 0002C6F0 RtlLcidToLocaleName = _RtlLcidToLocaleName@16
+ 1172 489 0003CC50 RtlLeaveCriticalSection = _RtlLeaveCriticalSection@4
+ 1173 48A 000809C0 RtlLengthRequiredSid = _RtlLengthRequiredSid@4
+ 1174 48B 00079370 RtlLengthSecurityDescriptor = _RtlLengthSecurityDescriptor@4
+ 1175 48C 000775D0 RtlLengthSid = _RtlLengthSid@4
+ 1176 48D 0002B1F0 RtlLengthSidAsUnicodeString = _RtlLengthSidAsUnicodeString@8
+ 1177 48E 00028910 RtlLoadString = _RtlLoadString@32
+ 1178 48F 000DA540 RtlLocalTimeToSystemTime = _RtlLocalTimeToSystemTime@8
+ 1179 490 0002C970 RtlLocaleNameToLcid = _RtlLocaleNameToLcid@12
+ 1181 491 000E6510 RtlLocateExtendedFeature = _RtlLocateExtendedFeature@12
+ 1180 492 000E63D0 RtlLocateExtendedFeature2 = _RtlLocateExtendedFeature2@16
+ 1182 493 00022000 RtlLocateLegacyContext = _RtlLocateLegacyContext@8
+ 1183 494 000878F0 RtlLockBootStatusData = _RtlLockBootStatusData@4
+ 1184 495 0008A2A0 RtlLockCurrentThread = _RtlLockCurrentThread@0
+ 1185 496 0003C8D0 RtlLockHeap = _RtlLockHeap@4
+ 1186 497 00089CA0 RtlLockMemoryBlockLookaside = _RtlLockMemoryBlockLookaside@4
+ 1187 498 000CFFC0 RtlLockMemoryStreamRegion = _RtlCopyMemoryStreamTo@24
+ 1188 499 00089D10 RtlLockMemoryZone = _RtlLockMemoryZone@4
+ 1189 49A 00089F80 RtlLockModuleSection = _RtlLockModuleSection@4
+ 1190 49B 000EC930 RtlLogStackBackTrace = _RtlLogStackBackTrace@0
+ 1191 49C 00073AD0 RtlLookupAtomInAtomTable = _RtlLookupAtomInAtomTable@12
+ 1192 49D 0005D590 RtlLookupElementGenericTable = _RtlLookupElementGenericTable@8
+ 1193 49E 00071990 RtlLookupElementGenericTableAvl = _RtlLookupElementGenericTableAvl@8
+ 1194 49F 000E7490 RtlLookupElementGenericTableFull = _RtlLookupElementGenericTableFull@16
+ 1195 4A0 00071B90 RtlLookupElementGenericTableFullAvl = _RtlLookupElementGenericTableFullAvl@16
+ 1196 4A1 000761E0 RtlLookupEntryHashTable = _RtlLookupEntryHashTable@12
+ 1197 4A2 000E7710 RtlLookupFirstMatchingElementGenericTableAvl = _RtlLookupFirstMatchingElementGenericTableAvl@12
+ 1198 4A3 00077390 RtlMakeSelfRelativeSD = _RtlMakeSelfRelativeSD@12
+ 1199 4A4 00027960 RtlMapGenericMask = _RtlMapGenericMask@8
+ 1200 4A5 000DAD90 RtlMapSecurityErrorToNtStatus = _RtlMapSecurityErrorToNtStatus@4
+ 1201 4A6 000A5A70 RtlMoveMemory = _RtlMoveMemory@12
+ 1202 4A7 00076F50 RtlMultiAppendUnicodeStringBuffer = _RtlMultiAppendUnicodeStringBuffer@12
+ 1203 4A8 0003E3E0 RtlMultiByteToUnicodeN = _RtlMultiByteToUnicodeN@20
+ 1204 4A9 00085220 RtlMultiByteToUnicodeSize = _RtlMultiByteToUnicodeSize@12
+ 1205 4AA 000E47C0 RtlMultipleAllocateHeap = _RtlMultipleAllocateHeap@20
+ 1206 4AB 000E4800 RtlMultipleFreeHeap = _RtlMultipleFreeHeap@16
+ 1207 4AC 000D0BF0 RtlNewInstanceSecurityObject = _RtlNewInstanceSecurityObject@40
+ 1208 4AD 000D0CB0 RtlNewSecurityGrantedAccess = _RtlNewSecurityGrantedAccess@24
+ 1209 4AE 00085640 RtlNewSecurityObject = _RtlNewSecurityObject@24
+ 1210 4AF 000271A0 RtlNewSecurityObjectEx = _RtlNewSecurityObjectEx@32
+ 1211 4B0 000D0DB0 RtlNewSecurityObjectWithMultipleInheritance = _RtlNewSecurityObjectWithMultipleInheritance@36
+ 1212 4B1 0008B3A0 RtlNormalizeProcessParams = _RtlNormalizeProcessParams@4
+ 1213 4B2 0007ECC0 RtlNormalizeString = _RtlNormalizeString@20
+ 1214 4B3 0008A150 RtlNtPathNameToDosPathName = _RtlNtPathNameToDosPathName@16
+ 1215 4B4 00064810 RtlNtStatusToDosError = _RtlNtStatusToDosError@4
+ 1216 4B5 00077B10 RtlNtStatusToDosErrorNoTeb = _RtlNtStatusToDosErrorNoTeb@4
+ 1217 4B6 00082340 RtlNumberGenericTableElements = _RtlNumberGenericTableElements@4
+ 1218 4B7 00083D80 RtlNumberGenericTableElementsAvl = _RtlNumberGenericTableElementsAvl@4
+ 1219 4B8 000E0100 RtlNumberOfClearBits = _RtlNumberOfClearBits@4
+ 1220 4B9 000E0120 RtlNumberOfClearBitsInRange = _RtlNumberOfClearBitsInRange@12
+ 1221 4BA 000E0150 RtlNumberOfSetBits = _RtlNumberOfSetBits@4
+ 1222 4BB 000E02A0 RtlNumberOfSetBitsInRange = _RtlNumberOfSetBitsInRange@12
+ 1223 4BC 00087230 RtlNumberOfSetBitsUlongPtr = _RtlNumberOfSetBitsUlongPtr@4
+ 1224 4BD 000851F0 RtlOemStringToUnicodeSize = _RtlxAnsiStringToUnicodeSize@4
+ 1225 4BE 0007BFF0 RtlOemStringToUnicodeString = _RtlOemStringToUnicodeString@12
+ 1226 4BF 0007C0E0 RtlOemToUnicodeN = _RtlOemToUnicodeN@20
+ 1227 4C0 00028860 RtlOpenCurrentUser = _RtlOpenCurrentUser@8
+ 1228 4C1 000ED0F0 RtlOsDeploymentState = _RtlOsDeploymentState@4
+ 1229 4C2 000DAE80 RtlOwnerAcesPresent = _RtlOwnerAcesPresent@4
+ 1230 4C3 0007E510 RtlPcToFileHeader = _RtlPcToFileHeader@8
+ 1231 4C4 000DEC90 RtlPinAtomInAtomTable = _RtlPinAtomInAtomTable@8
+ 1232 4C5 000CD1F0 RtlPopFrame = _RtlPopFrame@4
+ 1233 4C6 00080880 RtlPrefixString = _RtlPrefixString@12
+ 1234 4C7 00078240 RtlPrefixUnicodeString = _RtlPrefixUnicodeString@12
+ 1235 4C8 0005E350 RtlProcessFlsData = _RtlProcessFlsData@4
+ 1236 4C9 00054B00 RtlProtectHeap = _RtlProtectHeap@8
+ 1237 4CA 0007FE90 RtlPublishWnfStateData = _RtlPublishWnfStateData@24
+ 1238 4CB 000CD220 RtlPushFrame = _RtlPushFrame@4
+ 1239 4CC 0007E6C0 RtlQueryActivationContextApplicationSettings = _RtlQueryActivationContextApplicationSettings@28
+ 1240 4CD 000736D0 RtlQueryAtomInAtomTable = _RtlQueryAtomInAtomTable@24
+ 1241 4CE 000DCB50 RtlQueryCriticalSectionOwner = _RtlQueryCriticalSectionOwner@8
+ 1242 4CF 000763C0 RtlQueryDepthSList = _RtlQueryDepthSList@4
+ 1243 4D0 000E0D90 RtlQueryDynamicTimeZoneInformation = _RtlQueryDynamicTimeZoneInformation@4
+ 1244 4D1 000831E0 RtlQueryElevationFlags = _RtlQueryElevationFlags@4
+ 1245 4D2 0004A630 RtlQueryEnvironmentVariable = _RtlQueryEnvironmentVariable@24
+ 1246 4D3 0005BE90 RtlQueryEnvironmentVariable_U = _RtlQueryEnvironmentVariable_U@12
+ 1247 4D4 00081C80 RtlQueryHeapInformation = _RtlQueryHeapInformation@20
+ 1248 4D5 0007E570 RtlQueryInformationAcl = _RtlQueryInformationAcl@16
+ 1249 4D6 00044EF0 RtlQueryInformationActivationContext = _RtlQueryInformationActivationContext@28
+ 1250 4D7 00082D50 RtlQueryInformationActiveActivationContext = _RtlQueryInformationActiveActivationContext@16
+ 1251 4D8 000CFFB0 RtlQueryInterfaceMemoryStream = _RtlQueryInterfaceMemoryStream@12
+ 1252 4D9 000D8150 RtlQueryModuleInformation = _RtlQueryModuleInformation@12
+ 1253 4DA 00075770 RtlQueryPackageClaims = _RtlQueryPackageClaims@32
+ 1254 4DB 000756C0 RtlQueryPackageIdentity = _RtlQueryPackageIdentity@24
+ 1255 4DC 00075710 RtlQueryPackageIdentityEx = _RtlQueryPackageIdentityEx@28
+ 1256 4DD 00066BE0 RtlQueryPerformanceCounter = _RtlQueryPerformanceCounter@4
+ 1257 4DE 00076DC0 RtlQueryPerformanceFrequency = _RtlQueryPerformanceFrequency@4
+ 1258 4DF 000D10A0 RtlQueryProcessBackTraceInformation = _RtlQueryProcessBackTraceInformation@4
+ 1259 4E0 000748A0 RtlQueryProcessDebugInformation = _RtlQueryProcessDebugInformation@12
+ 1260 4E1 000D11E0 RtlQueryProcessHeapInformation = _RtlQueryProcessHeapInformation@4
+ 1261 4E2 000D14D0 RtlQueryProcessLockInformation = _RtlQueryProcessLockInformation@4
+ 1262 4E3 00077EE0 RtlQueryProtectedPolicy = _RtlQueryProtectedPolicy@8
+ 1263 4E4 000E0DB0 RtlQueryRegistryValues = _RtlQueryRegistryValues@20
+ 1264 4E5 00069A70 RtlQueryRegistryValuesEx = _RtlQueryRegistryValuesEx@20
+ 1265 4E6 000522A0 RtlQueryResourcePolicy = _RtlQueryResourcePolicy@16
+ 1266 4E7 000D0DE0 RtlQuerySecurityObject = _RtlQuerySecurityObject@20
+ 1267 4E8 000E4840 RtlQueryTagHeap = _RtlQueryTagHeap@20
+ 1268 4E9 000CC900 RtlQueryThreadProfiling = _RtlQueryThreadProfiling@8
+ 1269 4EA 00069870 RtlQueryTimeZoneInformation = _RtlQueryTimeZoneInformation@4
+ 1270 4EB 000752A0 RtlQueryUnbiasedInterruptTime = _RtlQueryUnbiasedInterruptTime@4
+ 1271 4EC 000ED1C0 RtlQueryValidationRunlevel = _RtlQueryValidationRunlevel@4
+ 1272 4ED 00085F60 RtlQueryWnfMetaNotification = _RtlQueryWnfMetaNotification@20
+ 1273 4EE 0007E8B0 RtlQueryWnfStateData = _RtlQueryWnfStateData@24
+ 1274 4EF 00084B50 RtlQueryWnfStateDataWithExplicitScope = _RtlQueryWnfStateDataWithExplicitScope@28
+ 1275 4F0 000D3BC0 RtlQueueApcWow64Thread = _RtlQueueApcWow64Thread@20
+ 1276 4F1 0005FF90 RtlQueueWorkItem = _RtlQueueWorkItem@12
+ 1277 4F2 000A62D0 RtlRaiseException = _RtlRaiseException@4
+ 1278 4F3 000A6310 RtlRaiseStatus = _RtlRaiseStatus@4
+ 1279 4F4 0007C840 RtlRandom = _RtlRandomEx@4
+ 1280 4F5 0007C840 RtlRandomEx = _RtlRandomEx@4
+ 1281 4F6 000477C0 RtlRbInsertNodeEx = _RtlRbInsertNodeEx@16
+ 1282 4F7 00046CC0 RtlRbRemoveNode = _RtlRbRemoveNode@8
+ 1283 4F8 00034570 RtlReAllocateHeap = _RtlReAllocateHeap@16
+ 1284 4F9 000CFF80 RtlReadMemoryStream = _RtlReadMemoryStream@16
+ 1285 4FA 000CFF80 RtlReadOutOfProcessMemoryStream = _RtlReadMemoryStream@16
+ 1286 4FB 000CC920 RtlReadThreadProfilingData = _RtlReadThreadProfilingData@12
+ 1287 4FC 000E7420 RtlRealPredecessor = _RtlRealPredecessor@4
+ 1288 4FD 0005DA50 RtlRealSuccessor = _RtlRealSuccessor@4
+ 1289 4FE 00073000 RtlRegisterForWnfMetaNotification = _RtlRegisterForWnfMetaNotification@24
+ 1290 4FF 000E7890 RtlRegisterSecureMemoryCacheCallback = _RtlRegisterSecureMemoryCacheCallback@4
+ 1291 500 00082AC0 RtlRegisterThreadWithCsrss = _RtlRegisterThreadWithCsrss@0
+ 1292 501 0005FA60 RtlRegisterWait = _RtlRegisterWait@24
+ 1293 502 0004B710 RtlReleaseActivationContext = _RtlReleaseActivationContext@4
+ 1294 503 00022880 RtlReleaseMemoryStream = _RtlAddRefMemoryStream@4
+ 1295 504 0005E7E0 RtlReleasePath = _RtlReleasePath@4
+ 1296 505 0007DAE0 RtlReleasePebLock = _RtlReleasePebLock@0
+ 1297 506 00084A40 RtlReleasePrivilege = _RtlReleasePrivilege@4
+ 1298 507 00077CB0 RtlReleaseRelativeName = _RtlReleaseRelativeName@4
+ 1299 508 00075550 RtlReleaseResource = _RtlReleaseResource@4
+ 1300 509 0003B210 RtlReleaseSRWLockExclusive = _RtlReleaseSRWLockExclusive@4
+ 1301 50A 00040DF0 RtlReleaseSRWLockShared = _RtlReleaseSRWLockShared@4
+ 1302 50B 000EAC80 RtlRemoteCall = _RtlRemoteCall@28
+ 1303 50C 0007E860 RtlRemoveEntryHashTable = _RtlRemoveEntryHashTable@12
+ 1304 50D 0008AF70 RtlRemovePrivileges = _RtlRemovePrivileges@12
+ 1305 50E 000D1F00 RtlRemoveVectoredContinueHandler = _RtlRemoveVectoredContinueHandler@4
+ 1306 50F 00084360 RtlRemoveVectoredExceptionHandler = _RtlRemoveVectoredExceptionHandler@4
+ 1307 510 000DAEA0 RtlReplaceSidInSd = _RtlReplaceSidInSd@16
+ 1308 511 000DF260 RtlReplaceSystemDirectoryInPath = _RtlReplaceSystemDirectoryInPath@16
+ 1309 512 000D3D60 RtlReportException = _RtlReportException@12
+ 1310 513 000D3DF0 RtlReportExceptionEx = _RtlReportExceptionEx@20
+ 1311 514 0005E4A0 RtlReportSilentProcessExit = _RtlReportSilentProcessExit@8
+ 1312 515 000D45F0 RtlReportSqmEscalation = _RtlReportSqmEscalation@24
+ 1313 516 000DEEF0 RtlResetMemoryBlockLookaside = _RtlResetMemoryBlockLookaside@4
+ 1314 517 000DF010 RtlResetMemoryZone = _RtlResetMemoryZone@4
+ 1315 518 00093DE0 RtlResetNtUserPfn = _RtlResetNtUserPfn@0
+ 1316 519 000D9860 RtlResetRtlTranslations = _RtlResetRtlTranslations@4
+ 1317 51A 000E0C50 RtlRestoreBootStatusDefaults = _RtlRestoreBootStatusDefaults@4
+ 1318 51B 000647A0 RtlRestoreLastWin32Error = _RtlSetLastWin32Error@4
+ 1319 51C 00093E80 RtlRetrieveNtUserPfn = _RtlRetrieveNtUserPfn@12
+ 1320 51D 000CFF90 RtlRevertMemoryStream = _RtlRevertMemoryStream@4
+ 1321 51E 000DB190 RtlRunDecodeUnicodeString = _RtlRunDecodeUnicodeString@8
+ 1322 51F 000DB1E0 RtlRunEncodeUnicodeString = _RtlRunEncodeUnicodeString@8
+ 1323 520 00040D30 RtlRunOnceBeginInitialize = _RtlRunOnceBeginInitialize@12
+ 1324 521 00079EB0 RtlRunOnceComplete = _RtlRunOnceComplete@12
+ 1325 522 00048970 RtlRunOnceExecuteOnce = _RtlRunOnceExecuteOnce@16
+ 1326 523 000763A0 RtlRunOnceInitialize = _RtlInitializeConditionVariable@4
+ 1327 524 00081330 RtlSecondsSince1970ToTime = _RtlSecondsSince1970ToTime@8
+ 1328 525 000DA5A0 RtlSecondsSince1980ToTime = _RtlSecondsSince1980ToTime@8
+ 1329 526 000CFFA0 RtlSeekMemoryStream = _RtlSeekMemoryStream@20
+ 1331 527 000771E0 RtlSelfRelativeToAbsoluteSD = _RtlSelfRelativeToAbsoluteSD@44
+ 1330 528 000770B0 RtlSelfRelativeToAbsoluteSD2 = _RtlSelfRelativeToAbsoluteSD2@8
+ 1332 529 0008BB30 RtlSendMsgToSm = _RtlSendMsgToSm@8
+ 1333 52A 000812B0 RtlSetAllBits = _RtlSetAllBits@4
+ 1334 52B 000DB260 RtlSetAttributesSecurityDescriptor = _RtlSetAttributesSecurityDescriptor@12
+ 1335 52C 0007B500 RtlSetBit = _RtlSetBit@8
+ 1336 52D 0005A310 RtlSetBits = _RtlSetBits@12
+ 1337 52E 00086A30 RtlSetControlSecurityDescriptor = _RtlSetControlSecurityDescriptor@12
+ 1338 52F 0007A080 RtlSetCriticalSectionSpinCount = _RtlSetCriticalSectionSpinCount@8
+ 1339 530 0007A420 RtlSetCurrentDirectory_U = _RtlSetCurrentDirectory_U@4
+ 1340 531 0008C520 RtlSetCurrentEnvironment = _RtlSetCurrentEnvironment@8
+ 1341 532 00072D70 RtlSetCurrentTransaction = _RtlSetCurrentTransaction@4
+ 1342 533 0002B180 RtlSetDaclSecurityDescriptor = _RtlSetDaclSecurityDescriptor@16
+ 1343 534 000E0DE0 RtlSetDynamicTimeZoneInformation = _RtlSetDynamicTimeZoneInformation@4
+ 1344 535 00058250 RtlSetEnvironmentStrings = _RtlSetEnvironmentStrings@8
+ 1345 536 00058A30 RtlSetEnvironmentVar = _RtlSetEnvironmentVar@20
+ 1346 537 000589F0 RtlSetEnvironmentVariable = _RtlSetEnvironmentVariable@12
+ 1347 538 00021E30 RtlSetExtendedFeaturesMask = _RtlSetExtendedFeaturesMask@12
+ 1348 539 0002B120 RtlSetGroupSecurityDescriptor = _RtlSetGroupSecurityDescriptor@12
+ 1349 53A 00083F60 RtlSetHeapInformation = _RtlSetHeapInformation@16
+ 1350 53B 000DD820 RtlSetInformationAcl = _RtlSetInformationAcl@16
+ 1351 53C 0005DB80 RtlSetIoCompletionCallback = _RtlSetIoCompletionCallback@12
+ 1352 53D 000647A0 RtlSetLastWin32Error = _RtlSetLastWin32Error@4
+ 1353 53E 00064780 RtlSetLastWin32ErrorAndNtStatusFromNtStatus = _RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
+ 1354 53F 000CFFB0 RtlSetMemoryStreamSize = _RtlQueryInterfaceMemoryStream@12
+ 1355 540 0002B0C0 RtlSetOwnerSecurityDescriptor = _RtlSetOwnerSecurityDescriptor@12
+ 1356 541 000E0D00 RtlSetPortableOperatingSystem = _RtlSetPortableOperatingSystem@4
+ 1357 542 000D16C0 RtlSetProcessDebugInformation = _RtlSetProcessDebugInformation@12
+ 1358 543 0008CCF0 RtlSetProcessIsCritical = _RtlSetProcessIsCritical
+ 1359 544 00086EE0 RtlSetProcessPreferredUILanguages = _RtlSetProcessPreferredUILanguages@12
+ 1360 545 00082EE0 RtlSetProtectedPolicy = _RtlSetProtectedPolicy@12
+ 1361 546 00023060 RtlSetSaclSecurityDescriptor = _RtlSetSaclSecurityDescriptor@16
+ 1362 547 00082360 RtlSetSearchPathMode = _RtlSetSearchPathMode@4
+ 1363 548 00087890 RtlSetSecurityDescriptorRMControl = _RtlSetSecurityDescriptorRMControl@8
+ 1364 549 00023A20 RtlSetSecurityObject = _RtlSetSecurityObject@20
+ 1365 54A 000D1030 RtlSetSecurityObjectEx = _RtlSetSecurityObjectEx@24
+ 1366 54B 0005BE20 RtlSetThreadErrorMode = _RtlSetThreadErrorMode@8
+ 1367 54C 0008B770 RtlSetThreadIsCritical = _RtlSetThreadIsCritical
+ 1368 54D 00086550 RtlSetThreadPoolStartFunc = _RtlSetThreadPoolStartFunc@8
+ 1369 54E 0002CE00 RtlSetThreadPreferredUILanguages = _RtlSetThreadPreferredUILanguages@12
+ 1370 54F 000318D0 RtlSetThreadSubProcessTag = _RtlSetThreadSubProcessTag@4
+ 1371 550 00030D40 RtlSetThreadWorkOnBehalfTicket = _RtlSetThreadWorkOnBehalfTicket@4
+ 1372 551 000E0E00 RtlSetTimeZoneInformation = _RtlSetTimeZoneInformation@4
+ 1373 552 000F97A0 RtlSetTimer = _RtlSetTimer@28
+ 1374 553 00077E80 RtlSetUnhandledExceptionFilter = _RtlSetUnhandledExceptionFilter@4
+ 1375 554 000E4A30 RtlSetUserFlagsHeap = _RtlSetUserFlagsHeap@20
+ 1376 555 0005CE20 RtlSetUserValueHeap = _RtlSetUserValueHeap@16
+ 1377 556 00024BC0 RtlSidDominates = _RtlSidDominates@12
+ 1378 557 00027EB0 RtlSidDominatesForTrust = _RtlSidDominatesForTrust@12
+ 1379 558 000DB2A0 RtlSidEqualLevel = _RtlSidEqualLevel@12
+ 1380 559 00083B10 RtlSidHashInitialize = _RtlSidHashInitialize@12
+ 1381 55A 000829B0 RtlSidHashLookup = _RtlSidHashLookup@8
+ 1382 55B 000DB330 RtlSidIsHigherLevel = _RtlSidIsHigherLevel@12
+ 1383 55C 00059120 RtlSizeHeap = _RtlSizeHeap@12
+ 1384 55D 00088F90 RtlSleepConditionVariableCS = _RtlSleepConditionVariableCS@12
+ 1385 55E 00088DD0 RtlSleepConditionVariableSRW = _RtlSleepConditionVariableSRW@16
+ 1386 55F 0005D600 RtlSplay = _RtlSplay@4
+ 1387 560 00086020 RtlStartRXact = _RtlStartRXact@4
+ 1388 561 000CFFB0 RtlStatMemoryStream = _RtlQueryInterfaceMemoryStream@12
+ 1389 562 00075B80 RtlStringFromGUID = _RtlStringFromGUID@8
+ 1390 563 00075BA0 RtlStringFromGUIDEx = _RtlStringFromGUIDEx@12
+ 1391 564 000E61D0 RtlStronglyEnumerateEntryHashTable = _RtlStronglyEnumerateEntryHashTable@8
+ 1392 565 0007B700 RtlSubAuthorityCountSid = _RtlSubAuthorityCountSid@4
+ 1393 566 00079F80 RtlSubAuthoritySid = _RtlSubAuthoritySid@8
+ 1394 567 00073050 RtlSubscribeWnfStateChangeNotification = _RtlSubscribeWnfStateChangeNotification@36
+ 1395 568 0005DA20 RtlSubtreePredecessor = _RtlSubtreePredecessor@4
+ 1396 569 000E7460 RtlSubtreeSuccessor = _RtlSubtreeSuccessor@4
+ 1397 56A 0004EE10 RtlSwitchedVVI = _RtlSwitchedVVI@16
+ 1398 56B 000849E0 RtlSystemTimeToLocalTime = _RtlSystemTimeToLocalTime@8
+ 1399 56C 00085840 RtlTestAndPublishWnfStateData = _RtlTestAndPublishWnfStateData@28
+ 1400 56D 000E0490 RtlTestBit = _RtlTestBit@8
+ 1401 56E 0008CCA0 RtlTestProtectedAccess = _RtlTestProtectedAccess@8
+ 1402 56F 00070630 RtlTimeFieldsToTime = _RtlTimeFieldsToTime@8
+ 1403 570 000703D0 RtlTimeToElapsedTimeFields = _RtlTimeToElapsedTimeFields@8
+ 1404 571 00081370 RtlTimeToSecondsSince1970 = _RtlTimeToSecondsSince1970@8
+ 1405 572 000812E0 RtlTimeToSecondsSince1980 = _RtlTimeToSecondsSince1980@8
+ 1406 573 000707E0 RtlTimeToTimeFields = _RtlTimeToTimeFields@8
+ 1407 574 000ED290 RtlTraceDatabaseAdd = _RtlTraceDatabaseAdd@16
+ 1408 575 000ED2E0 RtlTraceDatabaseCreate = _RtlTraceDatabaseCreate@20
+ 1409 576 000ED3E0 RtlTraceDatabaseDestroy = _RtlTraceDatabaseDestroy@4
+ 1410 577 000ED440 RtlTraceDatabaseEnumerate = _RtlTraceDatabaseEnumerate@12
+ 1411 578 000ED4E0 RtlTraceDatabaseFind = _RtlTraceDatabaseFind@16
+ 1412 579 000ED530 RtlTraceDatabaseLock = _RtlTraceDatabaseLock@4
+ 1413 57A 000ED550 RtlTraceDatabaseUnlock = _RtlTraceDatabaseUnlock@4
+ 1414 57B 000ED570 RtlTraceDatabaseValidate = _RtlTraceDatabaseValidate@4
+ 1415 57C 000809F0 RtlTryAcquirePebLock = _RtlTryAcquirePebLock@0
+ 1416 57D 00086A10 RtlTryAcquireSRWLockExclusive = _RtlTryAcquireSRWLockExclusive@4
+ 1417 57E 0006E900 RtlTryAcquireSRWLockShared = _RtlTryAcquireSRWLockShared@4
+ 1418 57F 000DCA10 RtlTryConvertSRWLockSharedToExclusiveOrRelease = _RtlTryConvertSRWLockSharedToExclusiveOrRelease@4
+ 1419 580 00030B00 RtlTryEnterCriticalSection = _RtlTryEnterCriticalSection@4
+ 1420 581 0006E9E0 RtlUTF8ToUnicodeN = _RtlUTF8ToUnicodeN@20
+ 12 582 00090440 RtlUlongByteSwap = @RtlUlongByteSwap@4
+ 13 583 00090420 RtlUlonglongByteSwap = @RtlUlonglongByteSwap@8
+ 1422 584 000EC6B0 RtlUnhandledExceptionFilter = _RtlUnhandledExceptionFilter@4
+ 1421 585 000EC390 RtlUnhandledExceptionFilter2 = _RtlUnhandledExceptionFilter2@8
+ 1423 586 0007DB00 RtlUnicodeStringToAnsiSize = _RtlxUnicodeStringToAnsiSize@4
+ 1424 587 00031970 RtlUnicodeStringToAnsiString = _RtlUnicodeStringToAnsiString@12
+ 1425 588 000DF2C0 RtlUnicodeStringToCountedOemString = _RtlUnicodeStringToCountedOemString@12
+ 1426 589 00074000 RtlUnicodeStringToInteger = _RtlUnicodeStringToInteger@12
+ 1427 58A 0007DB00 RtlUnicodeStringToOemSize = _RtlxUnicodeStringToAnsiSize@4
+ 1428 58B 000741D0 RtlUnicodeStringToOemString = _RtlUnicodeStringToOemString@12
+ 1429 58C 000D9950 RtlUnicodeToCustomCPN = _RtlUnicodeToCustomCPN@24
+ 1430 58D 00031A50 RtlUnicodeToMultiByteN = _RtlUnicodeToMultiByteN@20
+ 1431 58E 0007DB30 RtlUnicodeToMultiByteSize = _RtlUnicodeToMultiByteSize@12
+ 1432 58F 000742A0 RtlUnicodeToOemN = _RtlUnicodeToOemN@20
+ 1433 590 0006E030 RtlUnicodeToUTF8N = _RtlUnicodeToUTF8N@20
+ 1434 591 0007A0C0 RtlUniform = _RtlUniform@4
+ 1435 592 00087EB0 RtlUnlockBootStatusData = _RtlUnlockBootStatusData@4
+ 1436 593 0008A380 RtlUnlockCurrentThread = _RtlUnlockCurrentThread@0
+ 1437 594 0003CBA0 RtlUnlockHeap = _RtlUnlockHeap@4
+ 1438 595 00089E40 RtlUnlockMemoryBlockLookaside = _RtlUnlockMemoryBlockLookaside@4
+ 1439 596 000CFFC0 RtlUnlockMemoryStreamRegion = _RtlCopyMemoryStreamTo@24
+ 1440 597 00089E90 RtlUnlockMemoryZone = _RtlUnlockMemoryZone@4
+ 1441 598 0008A050 RtlUnlockModuleSection = _RtlUnlockModuleSection@4
+ 1442 599 00055300 RtlUnsubscribeWnfNotificationWaitForCompletion = _RtlUnsubscribeWnfNotificationWaitForCompletion@4
+ 1443 59A 00057170 RtlUnsubscribeWnfNotificationWithCompletionCallback = _RtlUnsubscribeWnfNotificationWithCompletionCallback@12
+ 1444 59B 00056450 RtlUnsubscribeWnfStateChangeNotification = _RtlUnsubscribeWnfStateChangeNotification@4
+ 1445 59C 0003FD50 RtlUnwind = _RtlUnwind@16
+ 1446 59D 0002A7C0 RtlUpcaseUnicodeChar = _RtlUpcaseUnicodeChar@4
+ 1447 59E 0002A980 RtlUpcaseUnicodeString = _RtlUpcaseUnicodeString@12
+ 1448 59F 000DF3E0 RtlUpcaseUnicodeStringToAnsiString = _RtlUpcaseUnicodeStringToAnsiString@12
+ 1449 5A0 000DF4D0 RtlUpcaseUnicodeStringToCountedOemString = _RtlUpcaseUnicodeStringToCountedOemString@12
+ 1450 5A1 0007BE30 RtlUpcaseUnicodeStringToOemString = _RtlUpcaseUnicodeStringToOemString@12
+ 1451 5A2 000D9B30 RtlUpcaseUnicodeToCustomCPN = _RtlUpcaseUnicodeToCustomCPN@24
+ 1452 5A3 0007A930 RtlUpcaseUnicodeToMultiByteN = _RtlUpcaseUnicodeToMultiByteN@20
+ 1453 5A4 0007C2D0 RtlUpcaseUnicodeToOemN = _RtlUpcaseUnicodeToOemN@20
+ 1454 5A5 000DCC50 RtlUpdateClonedCriticalSection = _RtlUpdateClonedCriticalSection@4
+ 1455 5A6 00087F40 RtlUpdateClonedSRWLock = _RtlUpdateClonedSRWLock@8
+ 1456 5A7 0005F6E0 RtlUpdateTimer = _RtlUpdateTimer@16
+ 1457 5A8 00080990 RtlUpperChar = _RtlUpperChar@4
+ 1458 5A9 000DF770 RtlUpperString = _RtlUpperString@8
+ 1459 5AA 00094360 RtlUserThreadStart = _RtlUserThreadStart@8
+ 14 5AB 00090450 RtlUshortByteSwap = @RtlUshortByteSwap@4
+ 1460 5AC 0002F560 RtlValidAcl = _RtlValidAcl@4
+ 1461 5AD 000D7EA0 RtlValidProcessProtection = _RtlValidProcessProtection@4
+ 1462 5AE 0007D850 RtlValidRelativeSecurityDescriptor = _RtlValidRelativeSecurityDescriptor@12
+ 1463 5AF 000786D0 RtlValidSecurityDescriptor = _RtlValidSecurityDescriptor@4
+ 1464 5B0 0002F680 RtlValidSid = _RtlValidSid@4
+ 1465 5B1 0005C780 RtlValidateHeap = _RtlValidateHeap@12
+ 1466 5B2 000E4DF0 RtlValidateProcessHeaps = _RtlValidateProcessHeaps@0
+ 1467 5B3 00086970 RtlValidateUnicodeString = _RtlValidateUnicodeString@8
+ 1468 5B4 00084520 RtlVerifyVersionInfo = _RtlVerifyVersionInfo@16
+ 1469 5B5 00072EA0 RtlWaitForWnfMetaNotification = _RtlWaitForWnfMetaNotification@24
+ 1470 5B6 000873D0 RtlWaitOnAddress = _RtlWaitOnAddress@16
+ 1471 5B7 00055C60 RtlWakeAddressAll = _RtlWakeAddressAll@4
+ 1472 5B8 000ED820 RtlWakeAddressAllNoFence = _RtlWakeAddressAllNoFence@4
+ 1473 5B9 000ED840 RtlWakeAddressSingle = _RtlWakeAddressSingle@4
+ 1474 5BA 000ED870 RtlWakeAddressSingleNoFence = _RtlWakeAddressSingleNoFence@4
+ 1475 5BB 00068630 RtlWakeAllConditionVariable = _RtlWakeAllConditionVariable@4
+ 1476 5BC 00078880 RtlWakeConditionVariable = _RtlWakeConditionVariable@4
+ 1477 5BD 0006E5E0 RtlWalkFrameChain = _RtlWalkFrameChain@12
+ 1478 5BE 000E4ED0 RtlWalkHeap = _RtlWalkHeap@8
+ 1479 5BF 000E6230 RtlWeaklyEnumerateEntryHashTable = _RtlWeaklyEnumerateEntryHashTable@8
+ 1480 5C0 000219B0 RtlWerpReportException = _RtlWerpReportException@24
+ 1481 5C1 000D5700 RtlWnfCompareChangeStamp = _RtlWnfCompareChangeStamp@8
+ 1482 5C2 00087F30 RtlWnfDllUnloadCallback = _RtlWnfDllUnloadCallback@4
+ 1483 5C3 000D3BD0 RtlWow64CallFunction64 = _RtlWow64CallFunction64@28
+ 1484 5C4 00088160 RtlWow64EnableFsRedirection = _RtlWow64EnableFsRedirection@4
+ 1485 5C5 00087FB0 RtlWow64EnableFsRedirectionEx = _RtlWow64EnableFsRedirectionEx@8
+ 1486 5C6 000E6540 RtlWow64GetCurrentMachine = _RtlWow64GetCurrentMachine@0
+ 1487 5C7 000218D0 RtlWow64GetProcessMachines = _RtlWow64GetProcessMachines@12
+ 1488 5C8 000D3BE0 RtlWow64IsWowGuestMachineSupported = _RtlWow64IsWowGuestMachineSupported@8
+ 1489 5C9 000CFF80 RtlWriteMemoryStream = _RtlReadMemoryStream@16
+ 1490 5CA 0008C970 RtlWriteRegistryValue = _RtlWriteRegistryValue@24
+ 1491 5CB 000E6DA0 RtlZeroHeap = _RtlZeroHeap@8
+ 1492 5CC 000A5A40 RtlZeroMemory = _RtlZeroMemory@8
+ 1493 5CD 000D6670 RtlZombifyActivationContext = _RtlZombifyActivationContext@4
+ 1494 5CE 00077F40 RtlpApplyLengthFunction = _RtlpApplyLengthFunction@16
+ 1495 5CF 00069AA0 RtlpCheckDynamicTimeZoneInformation = _RtlpCheckDynamicTimeZoneInformation@8
+ 1496 5D0 000E1C10 RtlpCleanupRegistryKeys = _RtlpCleanupRegistryKeys@0
+ 1497 5D1 000DD9A0 RtlpConvertAbsoluteToRelativeSecurityAttribute = _RtlpConvertAbsoluteToRelativeSecurityAttribute@12
+ 1498 5D2 000E2090 RtlpConvertCultureNamesToLCIDs = _RtlpConvertCultureNamesToLCIDs@8
+ 1499 5D3 000E2280 RtlpConvertLCIDsToCultureNames = _RtlpConvertLCIDsToCultureNames@8
+ 1500 5D4 000DDD80 RtlpConvertRelativeToAbsoluteSecurityAttribute = _RtlpConvertRelativeToAbsoluteSecurityAttribute@16
+ 1501 5D5 0002FA80 RtlpCreateProcessRegistryInfo = _RtlpCreateProcessRegistryInfo@4
+ 1502 5D6 00077020 RtlpEnsureBufferSize = _RtlpEnsureBufferSize@12
+ 1503 5D7 001195E0 RtlpFreezeTimeBias = _RtlpFreezeTimeBias
+ 1504 5D8 000796E0 RtlpGetDeviceFamilyInfoEnum = _RtlpGetDeviceFamilyInfoEnum@12
+ 1505 5D9 00083DA0 RtlpGetLCIDFromLangInfoNode = _RtlpGetLCIDFromLangInfoNode@12
+ 1506 5DA 00083370 RtlpGetNameFromLangInfoNode = _RtlpGetNameFromLangInfoNode@12
+ 1507 5DB 0002CB20 RtlpGetSystemDefaultUILanguage = _RtlpGetSystemDefaultUILanguage@8
+ 1508 5DC 000ED890 RtlpGetUserOrMachineUILanguage4NLS = _RtlpGetUserOrMachineUILanguage4NLS@12
+ 1509 5DD 00023A50 RtlpInitializeLangRegistryInfo = _RtlpInitializeLangRegistryInfo@4
+ 1510 5DE 00060910 RtlpIsQualifiedLanguage = _RtlpIsQualifiedLanguage@12
+ 1511 5DF 00023960 RtlpLoadMachineUIByPolicy = _RtlpLoadMachineUIByPolicy@12
+ 1512 5E0 00024850 RtlpLoadUserUIByPolicy = _RtlpLoadUserUIByPolicy@12
+ 1513 5E1 00086A90 RtlpMergeSecurityAttributeInformation = _RtlpMergeSecurityAttributeInformation@16
+ 1514 5E2 00023910 RtlpMuiFreeLangRegistryInfo = _RtlpMuiFreeLangRegistryInfo@4
+ 1515 5E3 000EE460 RtlpMuiRegCreateRegistryInfo = _RtlpMuiRegCreateRegistryInfo@0
+ 1516 5E4 00024D40 RtlpMuiRegFreeRegistryInfo = _RtlpMuiRegFreeRegistryInfo@8
+ 1517 5E5 00024C80 RtlpMuiRegLoadRegistryInfo = _RtlpMuiRegLoadRegistryInfo@8
+ 1518 5E6 000DCD60 RtlpNotOwnerCriticalSection = _RtlpNotOwnerCriticalSection@4
+ 1519 5E7 000F1350 RtlpNtCreateKey = _RtlpNtCreateKey@24
+ 1520 5E8 000828F0 RtlpNtEnumerateSubKey = _RtlpNtEnumerateSubKey@16
+ 1521 5E9 000F1380 RtlpNtMakeTemporaryKey = _RtlpNtMakeTemporaryKey@4
+ 1522 5EA 0007F5C0 RtlpNtOpenKey = _RtlpNtOpenKey@16
+ 1523 5EB 0007FAF0 RtlpNtQueryValueKey = _RtlpNtQueryValueKey@20
+ 1524 5EC 000F1390 RtlpNtSetValueKey = _RtlpNtSetValueKey@16
+ 1525 5ED 000250C0 RtlpQueryDefaultUILanguage = _RtlpQueryDefaultUILanguage@8
+ 1526 5EE 000D1920 RtlpQueryProcessDebugInformationRemote = _RtlpQueryProcessDebugInformationRemote@4
+ 1527 5EF 000EF850 RtlpRefreshCachedUILanguage = _RtlpRefreshCachedUILanguage@8
+ 1528 5F0 000E2BA0 RtlpSetInstallLanguage = _RtlpSetInstallLanguage@8
+ 1529 5F1 000E3240 RtlpSetPreferredUILanguages = _RtlpSetPreferredUILanguages@12
+ 1530 5F2 000E3240 RtlpSetUserPreferredUILanguages = _RtlpSetPreferredUILanguages@12
+ 1531 5F3 00055C10 RtlpUnWaitCriticalSection = _RtlpUnWaitCriticalSection@4
+ 1532 5F4 0008C5B0 RtlpVerifyAndCommitUILanguageSettings = _RtlpVerifyAndCommitUILanguageSettings@4
+ 1533 5F5 0008AAA0 RtlpWaitForCriticalSection = _LdrStandardizeSystemPath@4
+ 1534 5F6 000851F0 RtlxAnsiStringToUnicodeSize = _RtlxAnsiStringToUnicodeSize@4
+ 1535 5F7 000851F0 RtlxOemStringToUnicodeSize = _RtlxAnsiStringToUnicodeSize@4
+ 1536 5F8 0007DB00 RtlxUnicodeStringToAnsiSize = _RtlxUnicodeStringToAnsiSize@4
+ 1537 5F9 0007DB00 RtlxUnicodeStringToOemSize = _RtlxUnicodeStringToAnsiSize@4
+ 1538 5FA 000F9A80 SbExecuteProcedure = _SbExecuteProcedure@20
+ 1539 5FB 0004E690 SbSelectProcedure = _SbSelectProcedure@16
+ 1540 5FC 000D4DA0 ShipAssert = _ShipAssert@8
+ 1541 5FD 000D4E80 ShipAssertGetBufferInfo = _ShipAssertGetBufferInfo@8
+ 1542 5FE 000D4EB0 ShipAssertMsgA = _ShipAssertMsgA@12
+ 1543 5FF 000D4EB0 ShipAssertMsgW = _ShipAssertMsgA@12
+ 1544 600 0007DCC0 TpAllocAlpcCompletion = _TpAllocAlpcCompletion@20
+ 1545 601 0007DE10 TpAllocAlpcCompletionEx = _TpAllocAlpcCompletionEx@20
+ 1546 602 00082BE0 TpAllocCleanupGroup = _TpAllocCleanupGroup@4
+ 1547 603 00056D10 TpAllocIoCompletion = _TpAllocIoCompletion@20
+ 1548 604 00080310 TpAllocJobNotification = _TpAllocJobNotification@20
+ 1549 605 000523D0 TpAllocPool = _TpAllocPool@8
+ 1550 606 0004B060 TpAllocTimer = _TpAllocTimer@16
+ 1551 607 0004B110 TpAllocWait = _TpAllocWait@16
+ 1552 608 000543C0 TpAllocWork = _TpAllocWork@16
+ 1553 609 0007DBA0 TpAlpcRegisterCompletionList = _TpAlpcRegisterCompletionList@4
+ 1554 60A 0007DB60 TpAlpcUnregisterCompletionList = _TpAlpcUnregisterCompletionList@4
+ 1555 60B 000F8CD0 TpCallbackDetectedUnrecoverableError = _TpCallbackDetectedUnrecoverableError@4
+ 1556 60C 00071750 TpCallbackIndependent = _TpCallbackIndependent@4
+ 1557 60D 000220D0 TpCallbackLeaveCriticalSectionOnCompletion = _TpCallbackLeaveCriticalSectionOnCompletion@8
+ 1558 60E 000763E0 TpCallbackMayRunLong = _TpCallbackMayRunLong@4
+ 1559 60F 000F8D00 TpCallbackReleaseMutexOnCompletion = _TpCallbackReleaseMutexOnCompletion@8
+ 1560 610 000F8D40 TpCallbackReleaseSemaphoreOnCompletion = _TpCallbackReleaseSemaphoreOnCompletion@12
+ 1561 611 00072A20 TpCallbackSendAlpcMessageOnCompletion = _TpCallbackSendAlpcMessageOnCompletion@16
+ 1562 612 0007F990 TpCallbackSendPendingAlpcMessage = _TpCallbackSendPendingAlpcMessage@4
+ 1563 613 00087400 TpCallbackSetEventOnCompletion = _TpCallbackSetEventOnCompletion@8
+ 1564 614 00082CB0 TpCallbackUnloadDllOnCompletion = _TpCallbackUnloadDllOnCompletion@8
+ 1565 615 00056EF0 TpCancelAsyncIoOperation = _TpCancelAsyncIoOperation@4
+ 1566 616 0007FF70 TpCaptureCaller = _TpCaptureCaller@4
+ 1567 617 0006ADA0 TpCheckTerminateWorker = _TpCheckTerminateWorker@4
+ 1568 618 000F8D80 TpDbgDumpHeapUsage = _TpDbgDumpHeapUsage@12
+ 1569 619 0008AAA0 TpDbgSetLogRoutine = _LdrStandardizeSystemPath@4
+ 1570 61A 00086D10 TpDisablePoolCallbackChecks = _TpDisablePoolCallbackChecks@4
+ 1571 61B 000835E0 TpDisassociateCallback = _TpDisassociateCallback@4
+ 1572 61C 0004C510 TpIsTimerSet = _TpIsTimerSet@4
+ 1573 61D 0003C640 TpPostWork = _TpPostWork@4
+ 1574 61E 000F89B0 TpQueryPoolStackInformation = _TpQueryPoolStackInformation@8
+ 1575 61F 0007DCF0 TpReleaseAlpcCompletion = _TpReleaseAlpcCompletion@4
+ 1576 620 00084270 TpReleaseCleanupGroup = _TpReleaseCleanupGroup@4
+ 1577 621 0006EF30 TpReleaseCleanupGroupMembers = _TpReleaseCleanupGroupMembers@12
+ 1578 622 00056CA0 TpReleaseIoCompletion = _TpReleaseIoCompletion@4
+ 1579 623 000804F0 TpReleaseJobNotification = _TpReleaseJobNotification@4
+ 1580 624 00081430 TpReleasePool = _TpReleasePool@4
+ 1581 625 0004B830 TpReleaseTimer = _TpReleaseTimer@4
+ 1582 626 0004C550 TpReleaseWait = _TpReleaseWait@4
+ 1583 627 0004C410 TpReleaseWork = _TpReleaseWork@4
+ 1584 628 000F8A00 TpSetDefaultPoolMaxThreads = _TpSetDefaultPoolMaxThreads@4
+ 1585 629 000840E0 TpSetDefaultPoolStackInformation = _TpSetDefaultPoolStackInformation@4
+ 1586 62A 00054540 TpSetPoolMaxThreads = _TpSetPoolMaxThreads@8
+ 1587 62B 00083320 TpSetPoolMaxThreadsSoftLimit = _TpSetPoolMaxThreadsSoftLimit@8
+ 1588 62C 00084BF0 TpSetPoolMinThreads = _TpSetPoolMinThreads@8
+ 1589 62D 000841E0 TpSetPoolStackInformation = _TpSetPoolStackInformation@8
+ 1590 62E 00087650 TpSetPoolThreadBasePriority = _TpSetPoolThreadBasePriority@8
+ 1591 62F 000545B0 TpSetPoolWorkerThreadIdleTimeout = _TpSetPoolWorkerThreadIdleTimeout@12
+ 1592 630 0004BCD0 TpSetTimer = _TpSetTimer@16
+ 1593 631 0004BCE0 TpSetTimerEx = _TpSetTimerEx@16
+ 1594 632 0004B230 TpSetWait = _TpSetWait@12
+ 1595 633 0004B250 TpSetWaitEx = _TpSetWaitEx@16
+ 1596 634 000571C0 TpSimpleTryPost = _TpSimpleTryPost@12
+ 1597 635 00056F70 TpStartAsyncIoOperation = _TpStartAsyncIoOperation@4
+ 1598 636 00060380 TpTimerOutstandingCallbackCount = _TpTimerOutstandingCallbackCount@4
+ 1599 637 00088AB0 TpTrimPools = _TpTrimPools@0
+ 1600 638 0007DC60 TpWaitForAlpcCompletion = _TpWaitForAlpcCompletion@4
+ 1601 639 00057120 TpWaitForIoCompletion = _TpWaitForIoCompletion@8
+ 1602 63A 000804B0 TpWaitForJobNotification = _TpWaitForJobNotification@4
+ 1603 63B 0004BBD0 TpWaitForTimer = _TpWaitForTimer@8
+ 1604 63C 0004DA60 TpWaitForWait = _TpWaitForWait@8
+ 1605 63D 0004FC50 TpWaitForWork = _TpWaitForWork@8
+ 1606 63E 00075D80 VerSetConditionMask = _VerSetConditionMask@16
+ 1607 63F 000D4890 WerReportExceptionWorker = _WerReportExceptionWorker@4
+ 1608 640 000D5380 WerReportSQMEvent = _WerReportSQMEvent@16
+ 1609 641 00022BF0 WinSqmAddToAverageDWORD = _WinSqmAddToAverageDWORD@12
+ 1610 642 000891F0 WinSqmAddToStream = _WinSqmAddToStream@16
+ 1611 643 00089200 WinSqmAddToStreamEx = _WinSqmAddToStreamEx@20
+ 1612 644 000D5660 WinSqmCheckEscalationAddToStreamEx = _WinSqmCheckEscalationAddToStreamEx@20
+ 1614 645 000D5670 WinSqmCheckEscalationSetDWORD = _WinSqmCheckEscalationSetDWORD@16
+ 1613 646 000D5660 WinSqmCheckEscalationSetDWORD64 = _WinSqmCheckEscalationAddToStreamEx@20
+ 1615 647 000D5670 WinSqmCheckEscalationSetString = _WinSqmCheckEscalationSetDWORD@16
+ 1616 648 000D5680 WinSqmCommonDatapointDelete = _WinSqmCommonDatapointDelete@4
+ 1618 649 000D56A0 WinSqmCommonDatapointSetDWORD = _WinSqmCommonDatapointSetDWORD@12
+ 1617 64A 000D56E0 WinSqmCommonDatapointSetDWORD64 = _WinSqmCommonDatapointSetDWORD64@16
+ 1619 64B 000D5690 WinSqmCommonDatapointSetStreamEx = _WinSqmCommonDatapointSetStreamEx@20
+ 1620 64C 000D56A0 WinSqmCommonDatapointSetString = _WinSqmCommonDatapointSetDWORD@12
+ 1621 64D 0008AAA0 WinSqmEndSession = _LdrStandardizeSystemPath@4
+ 1622 64E 00086550 WinSqmEventEnabled = _RtlSetThreadPoolStartFunc@8
+ 1623 64F 000891D0 WinSqmEventWrite = _CsrpHeapCommitRoutine@12
+ 1624 650 00086550 WinSqmGetEscalationRuleStatus = _RtlSetThreadPoolStartFunc@8
+ 1625 651 000D56B0 WinSqmGetInstrumentationProperty = _WinSqmGetInstrumentationProperty@16
+ 1626 652 00022BF0 WinSqmIncrementDWORD = _WinSqmAddToAverageDWORD@12
+ 1627 653 0004F490 WinSqmIsOptedIn = _CsrIdentifyAlertableThread@0
+ 1628 654 00022880 WinSqmIsOptedInEx = _RtlAddRefMemoryStream@4
+ 1629 655 000D5680 WinSqmIsSessionDisabled = _WinSqmCommonDatapointDelete@4
+ 1631 656 00022BF0 WinSqmSetDWORD = _WinSqmAddToAverageDWORD@12
+ 1630 657 000891F0 WinSqmSetDWORD64 = _WinSqmAddToStream@16
+ 1632 658 000D56E0 WinSqmSetEscalationInfo = _WinSqmCommonDatapointSetDWORD64@16
+ 1633 659 00022BF0 WinSqmSetIfMaxDWORD = _WinSqmAddToAverageDWORD@12
+ 1634 65A 00022BF0 WinSqmSetIfMinDWORD = _WinSqmAddToAverageDWORD@12
+ 1635 65B 00022BF0 WinSqmSetString = _WinSqmAddToAverageDWORD@12
+ 1636 65C 000885B0 WinSqmStartSession = _WinSqmStartSession@12
+ 1637 65D 000D56F0 WinSqmStartSessionForPartner = _WinSqmStartSessionForPartner@16
+ 1638 65E 0004F490 WinSqmStartSqmOptinListener = _CsrIdentifyAlertableThread@0
+ 1639 65F 000904D0 ZwAcceptConnectPort = _NtAcceptConnectPort@24
+ 1640 660 00090490 ZwAccessCheck = _NtAccessCheck@32
+ 1641 661 00093BF0 ZwAccessCheckAndAuditAlarm = _NtAccessCheckAndAuditAlarm@44
+ 1642 662 00093BD0 ZwAccessCheckByType = _NtAccessCheckByType@44
+ 1643 663 00093BB0 ZwAccessCheckByTypeAndAuditAlarm = _NtAccessCheckByTypeAndAuditAlarm@64
+ 1644 664 00093B90 ZwAccessCheckByTypeResultList = _NtAccessCheckByTypeResultList@44
+ 1645 665 00093B70 ZwAccessCheckByTypeResultListAndAuditAlarm = _NtAccessCheckByTypeResultListAndAuditAlarm@64
+ 1646 666 00093B50 ZwAccessCheckByTypeResultListAndAuditAlarmByHandle = _NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
+ 1647 667 00093B30 ZwAcquireProcessActivityReference = _NtAcquireProcessActivityReference@12
+ 1648 668 00093AF0 ZwAddAtom = _NtAddAtom@12
+ 1649 669 00093B10 ZwAddAtomEx = _NtAddAtomEx@16
+ 1650 66A 00093AD0 ZwAddBootEntry = _NtAddBootEntry@8
+ 1651 66B 00093AB0 ZwAddDriverEntry = _NtAddDriverEntry@8
+ 1652 66C 00093A70 ZwAdjustGroupsToken = _NtAdjustGroupsToken@24
+ 1653 66D 00093A50 ZwAdjustPrivilegesToken = _NtAdjustPrivilegesToken@24
+ 1654 66E 00093A90 ZwAdjustTokenClaimsAndDeviceGroups = _NtAdjustTokenClaimsAndDeviceGroups@64
+ 1655 66F 00093A30 ZwAlertResumeThread = _NtAlertResumeThread@8
+ 1656 670 00093A10 ZwAlertThread = _NtAlertThread@4
+ 1657 671 000939F0 ZwAlertThreadByThreadId = _NtAlertThreadByThreadId@4
+ 1658 672 000939D0 ZwAllocateLocallyUniqueId = _NtAllocateLocallyUniqueId@4
+ 1659 673 000939B0 ZwAllocateReserveObject = _NtAllocateReserveObject@12
+ 1660 674 00093990 ZwAllocateUserPhysicalPages = _NtAllocateUserPhysicalPages@12
+ 1661 675 00093970 ZwAllocateUuids = _NtAllocateUuids@16
+ 1662 676 00093950 ZwAllocateVirtualMemory = _NtAllocateVirtualMemory@24
+ 1663 677 00093930 ZwAlpcAcceptConnectPort = _NtAlpcAcceptConnectPort@36
+ 1664 678 00093910 ZwAlpcCancelMessage = _NtAlpcCancelMessage@12
+ 1665 679 000938D0 ZwAlpcConnectPort = _NtAlpcConnectPort@44
+ 1666 67A 000938F0 ZwAlpcConnectPortEx = _NtAlpcConnectPortEx@44
+ 1667 67B 000938B0 ZwAlpcCreatePort = _NtAlpcCreatePort@12
+ 1668 67C 00093890 ZwAlpcCreatePortSection = _NtAlpcCreatePortSection@24
+ 1669 67D 00093870 ZwAlpcCreateResourceReserve = _NtAlpcCreateResourceReserve@16
+ 1670 67E 00093850 ZwAlpcCreateSectionView = _NtAlpcCreateSectionView@12
+ 1671 67F 00093830 ZwAlpcCreateSecurityContext = _NtAlpcCreateSecurityContext@12
+ 1672 680 00093810 ZwAlpcDeletePortSection = _NtAlpcDeletePortSection@12
+ 1673 681 000937F0 ZwAlpcDeleteResourceReserve = _NtAlpcDeleteResourceReserve@12
+ 1674 682 000937D0 ZwAlpcDeleteSectionView = _NtAlpcDeleteSectionView@12
+ 1675 683 000937B0 ZwAlpcDeleteSecurityContext = _NtAlpcDeleteSecurityContext@12
+ 1676 684 00093790 ZwAlpcDisconnectPort = _NtAlpcDisconnectPort@8
+ 1677 685 00093770 ZwAlpcImpersonateClientContainerOfPort = _NtAlpcImpersonateClientContainerOfPort@12
+ 1678 686 00093750 ZwAlpcImpersonateClientOfPort = _NtAlpcImpersonateClientOfPort@12
+ 1679 687 00093730 ZwAlpcOpenSenderProcess = _NtAlpcOpenSenderProcess@24
+ 1680 688 00093710 ZwAlpcOpenSenderThread = _NtAlpcOpenSenderThread@24
+ 1681 689 000936F0 ZwAlpcQueryInformation = _NtAlpcQueryInformation@20
+ 1682 68A 000936D0 ZwAlpcQueryInformationMessage = _NtAlpcQueryInformationMessage@24
+ 1683 68B 000936B0 ZwAlpcRevokeSecurityContext = _NtAlpcRevokeSecurityContext@12
+ 1684 68C 00093690 ZwAlpcSendWaitReceivePort = _NtAlpcSendWaitReceivePort@32
+ 1685 68D 00093670 ZwAlpcSetInformation = _NtAlpcSetInformation@16
+ 1686 68E 00093650 ZwApphelpCacheControl = _NtApphelpCacheControl@8
+ 1687 68F 00093630 ZwAreMappedFilesTheSame = _NtAreMappedFilesTheSame@8
+ 1688 690 00093610 ZwAssignProcessToJobObject = _NtAssignProcessToJobObject@8
+ 1689 691 000935F0 ZwAssociateWaitCompletionPacket = _NtAssociateWaitCompletionPacket@32
+ 1690 692 000935D0 ZwCallbackReturn = _NtCallbackReturn@12
+ 1691 693 000935B0 ZwCancelIoFile = _NtCancelIoFile@8
+ 1692 694 00093590 ZwCancelIoFileEx = _NtCancelIoFileEx@12
+ 1693 695 00093570 ZwCancelSynchronousIoFile = _NtCancelSynchronousIoFile@12
+ 1695 696 00093550 ZwCancelTimer = _NtCancelTimer@8
+ 1694 697 00090CD0 ZwCancelTimer2 = _NtCancelTimer2@8
+ 1696 698 00093530 ZwCancelWaitCompletionPacket = _NtCancelWaitCompletionPacket@8
+ 1697 699 00093510 ZwClearEvent = _NtClearEvent@4
+ 1698 69A 000934F0 ZwClose = _NtClose@4
+ 1699 69B 000934D0 ZwCloseObjectAuditAlarm = _NtCloseObjectAuditAlarm@12
+ 1700 69C 000934B0 ZwCommitComplete = _NtCommitComplete@8
+ 1701 69D 00093490 ZwCommitEnlistment = _NtCommitEnlistment@8
+ 1702 69E 00093C70 ZwCommitRegistryTransaction = _NtCommitRegistryTransaction@8
+ 1703 69F 00093470 ZwCommitTransaction = _NtCommitTransaction@8
+ 1704 6A0 00093450 ZwCompactKeys = _NtCompactKeys@8
+ 1705 6A1 00093430 ZwCompareObjects = _NtCompareObjects@8
+ 1706 6A2 00093410 ZwCompareSigningLevels = _NtCompareSigningLevels@8
+ 1707 6A3 000933F0 ZwCompareTokens = _NtCompareTokens@12
+ 1708 6A4 000933D0 ZwCompleteConnectPort = _NtCompleteConnectPort@4
+ 1709 6A5 000933B0 ZwCompressKey = _NtCompressKey@4
+ 1710 6A6 00093390 ZwConnectPort = _NtConnectPort@32
+ 1711 6A7 00093370 ZwContinue = _NtContinue@8
+ 1712 6A8 00093350 ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter = _NtConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
+ 1713 6A9 00093330 ZwCreateDebugObject = _NtCreateDebugObject@16
+ 1714 6AA 00093310 ZwCreateDirectoryObject = _NtCreateDirectoryObject@12
+ 1715 6AB 000932F0 ZwCreateDirectoryObjectEx = _NtCreateDirectoryObjectEx@20
+ 1716 6AC 000932D0 ZwCreateEnclave = _NtCreateEnclave@36
+ 1717 6AD 000932B0 ZwCreateEnlistment = _NtCreateEnlistment@32
+ 1718 6AE 00093290 ZwCreateEvent = _NtCreateEvent@20
+ 1719 6AF 00093270 ZwCreateEventPair = _NtCreateEventPair@12
+ 1720 6B0 00093250 ZwCreateFile = _NtCreateFile@44
+ 1721 6B1 000931F0 ZwCreateIRTimer = _NtCreateIRTimer@12
+ 1722 6B2 00093230 ZwCreateIoCompletion = _NtCreateIoCompletion@16
+ 1723 6B3 000931D0 ZwCreateJobObject = _NtCreateJobObject@12
+ 1724 6B4 000931B0 ZwCreateJobSet = _NtCreateJobSet@12
+ 1725 6B5 00093190 ZwCreateKey = _NtCreateKey@28
+ 1726 6B6 00093150 ZwCreateKeyTransacted = _NtCreateKeyTransacted@32
+ 1727 6B7 00093170 ZwCreateKeyedEvent = _NtCreateKeyedEvent@16
+ 1728 6B8 00092EF0 ZwCreateLowBoxToken = _NtCreateLowBoxToken@36
+ 1729 6B9 00093130 ZwCreateMailslotFile = _NtCreateMailslotFile@32
+ 1730 6BA 00093110 ZwCreateMutant = _NtCreateMutant@16
+ 1731 6BB 000930F0 ZwCreateNamedPipeFile = _NtCreateNamedPipeFile@56
+ 1732 6BC 000930D0 ZwCreatePagingFile = _NtCreatePagingFile@16
+ 1733 6BD 00092DD0 ZwCreatePartition = _NtCreatePartition@16
+ 1734 6BE 000930B0 ZwCreatePort = _NtCreatePort@20
+ 1735 6BF 00093090 ZwCreatePrivateNamespace = _NtCreatePrivateNamespace@16
+ 1736 6C0 00093070 ZwCreateProcess = _NtCreateProcess@32
+ 1737 6C1 00093050 ZwCreateProcessEx = _NtCreateProcessEx@36
+ 1738 6C2 00093030 ZwCreateProfile = _NtCreateProfile@36
+ 1739 6C3 00093010 ZwCreateProfileEx = _NtCreateProfileEx@40
+ 1740 6C4 00093C30 ZwCreateRegistryTransaction = _NtCreateRegistryTransaction@16
+ 1741 6C5 00092FF0 ZwCreateResourceManager = _NtCreateResourceManager@28
+ 1742 6C6 00092FD0 ZwCreateSection = _NtCreateSection@28
+ 1743 6C7 00092FB0 ZwCreateSemaphore = _NtCreateSemaphore@20
+ 1744 6C8 00092F90 ZwCreateSymbolicLinkObject = _NtCreateSymbolicLinkObject@16
+ 1745 6C9 00092F70 ZwCreateThread = _NtCreateThread@32
+ 1746 6CA 00092F50 ZwCreateThreadEx = _NtCreateThreadEx@44
+ 1748 6CB 00092F30 ZwCreateTimer = _NtCreateTimer@16
+ 1747 6CC 00093210 ZwCreateTimer2 = _NtCreateTimer2@20
+ 1749 6CD 00092ED0 ZwCreateToken = _NtCreateToken@52
+ 1750 6CE 00092F10 ZwCreateTokenEx = _NtCreateTokenEx@68
+ 1751 6CF 00092EB0 ZwCreateTransaction = _NtCreateTransaction@40
+ 1752 6D0 00092E90 ZwCreateTransactionManager = _NtCreateTransactionManager@24
+ 1753 6D1 00092E70 ZwCreateUserProcess = _NtCreateUserProcess@44
+ 1754 6D2 00092E30 ZwCreateWaitCompletionPacket = _NtCreateWaitCompletionPacket@12
+ 1755 6D3 00092E50 ZwCreateWaitablePort = _NtCreateWaitablePort@20
+ 1756 6D4 00092E10 ZwCreateWnfStateName = _NtCreateWnfStateName@28
+ 1757 6D5 00092DF0 ZwCreateWorkerFactory = _NtCreateWorkerFactory@40
+ 1758 6D6 00092DB0 ZwDebugActiveProcess = _NtDebugActiveProcess@8
+ 1759 6D7 00092D90 ZwDebugContinue = _NtDebugContinue@12
+ 1760 6D8 00092D70 ZwDelayExecution = _NtDelayExecution@8
+ 1761 6D9 00092D50 ZwDeleteAtom = _NtDeleteAtom@4
+ 1762 6DA 00092D30 ZwDeleteBootEntry = _NtDeleteBootEntry@4
+ 1763 6DB 00092D10 ZwDeleteDriverEntry = _NtDeleteDriverEntry@4
+ 1764 6DC 00092CF0 ZwDeleteFile = _NtDeleteFile@4
+ 1765 6DD 00092CD0 ZwDeleteKey = _NtDeleteKey@4
+ 1766 6DE 00092CB0 ZwDeleteObjectAuditAlarm = _NtDeleteObjectAuditAlarm@12
+ 1767 6DF 00092C90 ZwDeletePrivateNamespace = _NtDeletePrivateNamespace@4
+ 1768 6E0 00092C70 ZwDeleteValueKey = _NtDeleteValueKey@8
+ 1769 6E1 00092C50 ZwDeleteWnfStateData = _NtDeleteWnfStateData@8
+ 1770 6E2 00092C30 ZwDeleteWnfStateName = _NtDeleteWnfStateName@4
+ 1771 6E3 00092C10 ZwDeviceIoControlFile = _NtDeviceIoControlFile@40
+ 1772 6E4 00092C00 ZwDisableLastKnownGood = _NtDisableLastKnownGood@0
+ 1773 6E5 00092BE0 ZwDisplayString = _NtDisplayString@4
+ 1774 6E6 00092BC0 ZwDrawText = _NtDrawText@4
+ 1775 6E7 00092BA0 ZwDuplicateObject = _NtDuplicateObject@28
+ 1776 6E8 00092B80 ZwDuplicateToken = _NtDuplicateToken@24
+ 1777 6E9 00092B70 ZwEnableLastKnownGood = _NtEnableLastKnownGood@0
+ 1778 6EA 00092B50 ZwEnumerateBootEntries = _NtEnumerateBootEntries@8
+ 1779 6EB 00092B30 ZwEnumerateDriverEntries = _NtEnumerateDriverEntries@8
+ 1780 6EC 00092B10 ZwEnumerateKey = _NtEnumerateKey@24
+ 1781 6ED 00092AF0 ZwEnumerateSystemEnvironmentValuesEx = _NtEnumerateSystemEnvironmentValuesEx@12
+ 1782 6EE 00092AD0 ZwEnumerateTransactionObject = _NtEnumerateTransactionObject@20
+ 1783 6EF 00092AB0 ZwEnumerateValueKey = _NtEnumerateValueKey@24
+ 1784 6F0 00092A90 ZwExtendSection = _NtExtendSection@8
+ 1785 6F1 00092A70 ZwFilterBootOption = _NtFilterBootOption@20
+ 1786 6F2 00092A30 ZwFilterToken = _NtFilterToken@24
+ 1787 6F3 00092A50 ZwFilterTokenEx = _NtFilterTokenEx@56
+ 1788 6F4 00092A10 ZwFindAtom = _NtFindAtom@12
+ 1789 6F5 000929D0 ZwFlushBuffersFile = _NtFlushBuffersFile@8
+ 1790 6F6 000929F0 ZwFlushBuffersFileEx = _NtFlushBuffersFileEx@20
+ 1791 6F7 000929B0 ZwFlushInstallUILanguage = _NtFlushInstallUILanguage@8
+ 1792 6F8 00092990 ZwFlushInstructionCache = _NtFlushInstructionCache@12
+ 1793 6F9 00092970 ZwFlushKey = _NtFlushKey@4
+ 1794 6FA 00092960 ZwFlushProcessWriteBuffers = _NtFlushProcessWriteBuffers@0
+ 1795 6FB 00092940 ZwFlushVirtualMemory = _NtFlushVirtualMemory@16
+ 1796 6FC 00092930 ZwFlushWriteBuffer = _NtFlushWriteBuffer@0
+ 1797 6FD 00092910 ZwFreeUserPhysicalPages = _NtFreeUserPhysicalPages@12
+ 1798 6FE 000928F0 ZwFreeVirtualMemory = _NtFreeVirtualMemory@16
+ 1799 6FF 000928D0 ZwFreezeRegistry = _NtFreezeRegistry@4
+ 1800 700 000928B0 ZwFreezeTransactions = _NtFreezeTransactions@8
+ 1801 701 00092890 ZwFsControlFile = _NtFsControlFile@40
+ 1802 702 00092870 ZwGetCachedSigningLevel = _NtGetCachedSigningLevel@24
+ 1803 703 00092850 ZwGetCompleteWnfStateSubscription = _NtGetCompleteWnfStateSubscription@24
+ 1804 704 00092830 ZwGetContextThread = _NtGetContextThread@8
+ 1805 705 00092820 ZwGetCurrentProcessorNumber = _NtGetCurrentProcessorNumber@0
+ 1806 706 00092800 ZwGetCurrentProcessorNumberEx = _NtGetCurrentProcessorNumberEx@4
+ 1807 707 000927E0 ZwGetDevicePowerState = _NtGetDevicePowerState@8
+ 1808 708 000927C0 ZwGetMUIRegistryInfo = _NtGetMUIRegistryInfo@12
+ 1809 709 000927A0 ZwGetNextProcess = _NtGetNextProcess@20
+ 1810 70A 00092780 ZwGetNextThread = _NtGetNextThread@24
+ 1811 70B 00092760 ZwGetNlsSectionPtr = _NtGetNlsSectionPtr@20
+ 1812 70C 00092740 ZwGetNotificationResourceManager = _NtGetNotificationResourceManager@28
+ 1813 70D 00092720 ZwGetWriteWatch = _NtGetWriteWatch@28
+ 1814 70E 00092700 ZwImpersonateAnonymousToken = _NtImpersonateAnonymousToken@4
+ 1815 70F 000926E0 ZwImpersonateClientOfPort = _NtImpersonateClientOfPort@8
+ 1816 710 000926C0 ZwImpersonateThread = _NtImpersonateThread@12
+ 1817 711 000926A0 ZwInitializeEnclave = _NtInitializeEnclave@20
+ 1818 712 00092680 ZwInitializeNlsFiles = _NtInitializeNlsFiles@12
+ 1819 713 00092660 ZwInitializeRegistry = _NtInitializeRegistry@4
+ 1820 714 00092640 ZwInitiatePowerAction = _NtInitiatePowerAction@16
+ 1821 715 00092620 ZwIsProcessInJob = _NtIsProcessInJob@8
+ 1822 716 00092610 ZwIsSystemResumeAutomatic = _NtIsSystemResumeAutomatic@0
+ 1823 717 00092600 ZwIsUILanguageComitted = _NtIsUILanguageComitted@0
+ 1824 718 000925E0 ZwListenPort = _NtListenPort@8
+ 1825 719 000925C0 ZwLoadDriver = _NtLoadDriver@4
+ 1826 71A 000925A0 ZwLoadEnclaveData = _NtLoadEnclaveData@36
+ 1827 71B 00092580 ZwLoadHotPatch = _NtLoadHotPatch@8
+ 1829 71C 00092560 ZwLoadKey = _NtLoadKey@8
+ 1828 71D 00092540 ZwLoadKey2 = _NtLoadKey2@12
+ 1830 71E 00092520 ZwLoadKeyEx = _NtLoadKeyEx@32
+ 1831 71F 00092500 ZwLockFile = _NtLockFile@40
+ 1832 720 000924E0 ZwLockProductActivationKeys = _NtLockProductActivationKeys@8
+ 1833 721 000924C0 ZwLockRegistryKey = _NtLockRegistryKey@4
+ 1834 722 000924A0 ZwLockVirtualMemory = _NtLockVirtualMemory@16
+ 1835 723 00092480 ZwMakePermanentObject = _NtMakePermanentObject@4
+ 1836 724 00092460 ZwMakeTemporaryObject = _NtMakeTemporaryObject@4
+ 1837 725 00092380 ZwManagePartition = _NtManagePartition@20
+ 1838 726 00092440 ZwMapCMFModule = _NtMapCMFModule@24
+ 1839 727 00092420 ZwMapUserPhysicalPages = _NtMapUserPhysicalPages@12
+ 1840 728 00092400 ZwMapUserPhysicalPagesScatter = _NtMapUserPhysicalPagesScatter@12
+ 1841 729 000923E0 ZwMapViewOfSection = _NtMapViewOfSection@40
+ 1842 72A 000923C0 ZwModifyBootEntry = _NtModifyBootEntry@4
+ 1843 72B 000923A0 ZwModifyDriverEntry = _NtModifyDriverEntry@4
+ 1844 72C 00092360 ZwNotifyChangeDirectoryFile = _NtNotifyChangeDirectoryFile@36
+ 1845 72D 00092340 ZwNotifyChangeKey = _NtNotifyChangeKey@40
+ 1846 72E 00092320 ZwNotifyChangeMultipleKeys = _NtNotifyChangeMultipleKeys@48
+ 1847 72F 00092300 ZwNotifyChangeSession = _NtNotifyChangeSession@32
+ 1848 730 000922E0 ZwOpenDirectoryObject = _NtOpenDirectoryObject@12
+ 1849 731 000922C0 ZwOpenEnlistment = _NtOpenEnlistment@20
+ 1850 732 000922A0 ZwOpenEvent = _NtOpenEvent@12
+ 1851 733 00092280 ZwOpenEventPair = _NtOpenEventPair@12
+ 1852 734 00092260 ZwOpenFile = _NtOpenFile@24
+ 1853 735 00092240 ZwOpenIoCompletion = _NtOpenIoCompletion@12
+ 1854 736 00092220 ZwOpenJobObject = _NtOpenJobObject@12
+ 1855 737 00092200 ZwOpenKey = _NtOpenKey@12
+ 1856 738 000921C0 ZwOpenKeyEx = _NtOpenKeyEx@16
+ 1857 739 000921A0 ZwOpenKeyTransacted = _NtOpenKeyTransacted@16
+ 1858 73A 00092180 ZwOpenKeyTransactedEx = _NtOpenKeyTransactedEx@20
+ 1859 73B 000921E0 ZwOpenKeyedEvent = _NtOpenKeyedEvent@12
+ 1860 73C 00092160 ZwOpenMutant = _NtOpenMutant@12
+ 1861 73D 00092140 ZwOpenObjectAuditAlarm = _NtOpenObjectAuditAlarm@48
+ 1862 73E 000920A0 ZwOpenPartition = _NtOpenPartition@12
+ 1863 73F 00092120 ZwOpenPrivateNamespace = _NtOpenPrivateNamespace@16
+ 1864 740 00092100 ZwOpenProcess = _NtOpenProcess@16
+ 1865 741 000920E0 ZwOpenProcessToken = _NtOpenProcessToken@12
+ 1866 742 000920C0 ZwOpenProcessTokenEx = _NtOpenProcessTokenEx@16
+ 1867 743 00093C50 ZwOpenRegistryTransaction = _NtOpenRegistryTransaction@12
+ 1868 744 00092080 ZwOpenResourceManager = _NtOpenResourceManager@20
+ 1869 745 00092060 ZwOpenSection = _NtOpenSection@12
+ 1870 746 00092040 ZwOpenSemaphore = _NtOpenSemaphore@12
+ 1871 747 00092020 ZwOpenSession = _NtOpenSession@12
+ 1872 748 00092000 ZwOpenSymbolicLinkObject = _NtOpenSymbolicLinkObject@12
+ 1873 749 00091FE0 ZwOpenThread = _NtOpenThread@16
+ 1874 74A 00091FC0 ZwOpenThreadToken = _NtOpenThreadToken@16
+ 1875 74B 00091FA0 ZwOpenThreadTokenEx = _NtOpenThreadTokenEx@20
+ 1876 74C 00091F80 ZwOpenTimer = _NtOpenTimer@12
+ 1877 74D 00091F60 ZwOpenTransaction = _NtOpenTransaction@20
+ 1878 74E 00091F40 ZwOpenTransactionManager = _NtOpenTransactionManager@24
+ 1879 74F 00091F20 ZwPlugPlayControl = _NtPlugPlayControl@12
+ 1880 750 00091F00 ZwPowerInformation = _NtPowerInformation@20
+ 1881 751 00091EA0 ZwPrePrepareComplete = _NtPrePrepareComplete@8
+ 1882 752 00091E80 ZwPrePrepareEnlistment = _NtPrePrepareEnlistment@8
+ 1883 753 00091EE0 ZwPrepareComplete = _NtPrepareComplete@8
+ 1884 754 00091EC0 ZwPrepareEnlistment = _NtPrepareEnlistment@8
+ 1885 755 00091E40 ZwPrivilegeCheck = _NtPrivilegeCheck@12
+ 1886 756 00091E00 ZwPrivilegeObjectAuditAlarm = _NtPrivilegeObjectAuditAlarm@24
+ 1887 757 00091E20 ZwPrivilegedServiceAuditAlarm = _NtPrivilegedServiceAuditAlarm@20
+ 1888 758 00091DE0 ZwPropagationComplete = _NtPropagationComplete@16
+ 1889 759 00091DC0 ZwPropagationFailed = _NtPropagationFailed@12
+ 1890 75A 00091DA0 ZwProtectVirtualMemory = _NtProtectVirtualMemory@20
+ 1891 75B 00091D80 ZwPulseEvent = _NtPulseEvent@8
+ 1892 75C 00091D60 ZwQueryAttributesFile = _NtQueryAttributesFile@8
+ 1893 75D 00091670 ZwQueryAuxiliaryCounterFrequency = _NtQueryAuxiliaryCounterFrequency@4
+ 1894 75E 00091D40 ZwQueryBootEntryOrder = _NtQueryBootEntryOrder@8
+ 1895 75F 00091D20 ZwQueryBootOptions = _NtQueryBootOptions@8
+ 1896 760 00091D00 ZwQueryDebugFilterState = _NtQueryDebugFilterState@8
+ 1897 761 00091CE0 ZwQueryDefaultLocale = _NtQueryDefaultLocale@8
+ 1898 762 00091CC0 ZwQueryDefaultUILanguage = _NtQueryDefaultUILanguage@4
+ 1899 763 00091CA0 ZwQueryDirectoryFile = _NtQueryDirectoryFile@44
+ 1900 764 00091C80 ZwQueryDirectoryObject = _NtQueryDirectoryObject@28
+ 1901 765 00091C60 ZwQueryDriverEntryOrder = _NtQueryDriverEntryOrder@8
+ 1902 766 00091C40 ZwQueryEaFile = _NtQueryEaFile@36
+ 1903 767 00091C20 ZwQueryEvent = _NtQueryEvent@20
+ 1904 768 00091C00 ZwQueryFullAttributesFile = _NtQueryFullAttributesFile@8
+ 1905 769 00091BE0 ZwQueryInformationAtom = _NtQueryInformationAtom@20
+ 1906 76A 00091BC0 ZwQueryInformationByName = _NtQueryInformationByName@20
+ 1907 76B 00091BA0 ZwQueryInformationEnlistment = _NtQueryInformationEnlistment@20
+ 1908 76C 00091B80 ZwQueryInformationFile = _NtQueryInformationFile@20
+ 1909 76D 00091B60 ZwQueryInformationJobObject = _NtQueryInformationJobObject@20
+ 1910 76E 00091B40 ZwQueryInformationPort = _NtQueryInformationPort@20
+ 1911 76F 00091B20 ZwQueryInformationProcess = _NtQueryInformationProcess@20
+ 1912 770 00091B00 ZwQueryInformationResourceManager = _NtQueryInformationResourceManager@20
+ 1913 771 00091AE0 ZwQueryInformationThread = _NtQueryInformationThread@20
+ 1914 772 00091AC0 ZwQueryInformationToken = _NtQueryInformationToken@20
+ 1915 773 00091AA0 ZwQueryInformationTransaction = _NtQueryInformationTransaction@20
+ 1916 774 00091A80 ZwQueryInformationTransactionManager = _NtQueryInformationTransactionManager@20
+ 1917 775 00091A60 ZwQueryInformationWorkerFactory = _NtQueryInformationWorkerFactory@20
+ 1918 776 00091A40 ZwQueryInstallUILanguage = _NtQueryInstallUILanguage@4
+ 1919 777 00091A20 ZwQueryIntervalProfile = _NtQueryIntervalProfile@8
+ 1920 778 00091A00 ZwQueryIoCompletion = _NtQueryIoCompletion@20
+ 1921 779 000919E0 ZwQueryKey = _NtQueryKey@20
+ 1922 77A 000919C0 ZwQueryLicenseValue = _NtQueryLicenseValue@20
+ 1923 77B 000919A0 ZwQueryMultipleValueKey = _NtQueryMultipleValueKey@24
+ 1924 77C 00091980 ZwQueryMutant = _NtQueryMutant@20
+ 1925 77D 00091960 ZwQueryObject = _NtQueryObject@20
+ 1926 77E 00091940 ZwQueryOpenSubKeys = _NtQueryOpenSubKeys@8
+ 1927 77F 00091920 ZwQueryOpenSubKeysEx = _NtQueryOpenSubKeysEx@16
+ 1928 780 00091900 ZwQueryPerformanceCounter = _NtQueryPerformanceCounter@8
+ 1929 781 000918F0 ZwQueryPortInformationProcess = _NtQueryPortInformationProcess@0
+ 1930 782 000918D0 ZwQueryQuotaInformationFile = _NtQueryQuotaInformationFile@36
+ 1931 783 000918B0 ZwQuerySection = _NtQuerySection@20
+ 1932 784 00091890 ZwQuerySecurityAttributesToken = _NtQuerySecurityAttributesToken@24
+ 1933 785 00091870 ZwQuerySecurityObject = _NtQuerySecurityObject@20
+ 1934 786 00091850 ZwQuerySecurityPolicy = _NtQuerySecurityPolicy@24
+ 1935 787 00091830 ZwQuerySemaphore = _NtQuerySemaphore@20
+ 1936 788 00091810 ZwQuerySymbolicLinkObject = _NtQuerySymbolicLinkObject@12
+ 1937 789 000917F0 ZwQuerySystemEnvironmentValue = _NtQuerySystemEnvironmentValue@16
+ 1938 78A 000917D0 ZwQuerySystemEnvironmentValueEx = _NtQuerySystemEnvironmentValueEx@20
+ 1939 78B 000917B0 ZwQuerySystemInformation = _NtQuerySystemInformation@16
+ 1940 78C 00091790 ZwQuerySystemInformationEx = _NtQuerySystemInformationEx@24
+ 1941 78D 00091770 ZwQuerySystemTime = _NtQuerySystemTime@4
+ 1942 78E 00091750 ZwQueryTimer = _NtQueryTimer@20
+ 1943 78F 00091730 ZwQueryTimerResolution = _NtQueryTimerResolution@12
+ 1944 790 00091710 ZwQueryValueKey = _NtQueryValueKey@24
+ 1945 791 000916F0 ZwQueryVirtualMemory = _NtQueryVirtualMemory@24
+ 1946 792 000916D0 ZwQueryVolumeInformationFile = _NtQueryVolumeInformationFile@20
+ 1947 793 00091690 ZwQueryWnfStateData = _NtQueryWnfStateData@24
+ 1948 794 000916B0 ZwQueryWnfStateNameInformation = _NtQueryWnfStateNameInformation@20
+ 1949 795 00091650 ZwQueueApcThread = _NtQueueApcThread@20
+ 1950 796 00091630 ZwQueueApcThreadEx = _NtQueueApcThreadEx@24
+ 1951 797 00091610 ZwRaiseException = _NtRaiseException@12
+ 1952 798 000915F0 ZwRaiseHardError = _NtRaiseHardError@24
+ 1953 799 000915D0 ZwReadFile = _NtReadFile@36
+ 1954 79A 000915B0 ZwReadFileScatter = _NtReadFileScatter@36
+ 1955 79B 00091590 ZwReadOnlyEnlistment = _NtReadOnlyEnlistment@8
+ 1956 79C 00091570 ZwReadRequestData = _NtReadRequestData@24
+ 1957 79D 00091550 ZwReadVirtualMemory = _NtReadVirtualMemory@20
+ 1958 79E 00091530 ZwRecoverEnlistment = _NtRecoverEnlistment@8
+ 1959 79F 00091510 ZwRecoverResourceManager = _NtRecoverResourceManager@4
+ 1960 7A0 000914F0 ZwRecoverTransactionManager = _NtRecoverTransactionManager@4
+ 1961 7A1 000914D0 ZwRegisterProtocolAddressInformation = _NtRegisterProtocolAddressInformation@20
+ 1962 7A2 000914B0 ZwRegisterThreadTerminatePort = _NtRegisterThreadTerminatePort@4
+ 1963 7A3 00091490 ZwReleaseKeyedEvent = _NtReleaseKeyedEvent@16
+ 1964 7A4 00091470 ZwReleaseMutant = _NtReleaseMutant@8
+ 1965 7A5 00091450 ZwReleaseSemaphore = _NtReleaseSemaphore@12
+ 1966 7A6 00091430 ZwReleaseWorkerFactoryWorker = _NtReleaseWorkerFactoryWorker@4
+ 1967 7A7 00091410 ZwRemoveIoCompletion = _NtRemoveIoCompletion@20
+ 1968 7A8 000913F0 ZwRemoveIoCompletionEx = _NtRemoveIoCompletionEx@24
+ 1969 7A9 000913D0 ZwRemoveProcessDebug = _NtRemoveProcessDebug@8
+ 1970 7AA 000913B0 ZwRenameKey = _NtRenameKey@8
+ 1971 7AB 00091390 ZwRenameTransactionManager = _NtRenameTransactionManager@8
+ 1972 7AC 00091370 ZwReplaceKey = _NtReplaceKey@12
+ 1973 7AD 00091350 ZwReplacePartitionUnit = _NtReplacePartitionUnit@12
+ 1974 7AE 00091330 ZwReplyPort = _NtReplyPort@8
+ 1975 7AF 00091310 ZwReplyWaitReceivePort = _NtReplyWaitReceivePort@16
+ 1976 7B0 000912F0 ZwReplyWaitReceivePortEx = _NtReplyWaitReceivePortEx@20
+ 1977 7B1 000912D0 ZwReplyWaitReplyPort = _NtReplyWaitReplyPort@8
+ 1978 7B2 000912B0 ZwRequestPort = _NtRequestPort@8
+ 1979 7B3 00091290 ZwRequestWaitReplyPort = _NtRequestWaitReplyPort@12
+ 1980 7B4 00091270 ZwResetEvent = _NtResetEvent@8
+ 1981 7B5 00091250 ZwResetWriteWatch = _NtResetWriteWatch@12
+ 1982 7B6 00091230 ZwRestoreKey = _NtRestoreKey@12
+ 1983 7B7 00091210 ZwResumeProcess = _NtResumeProcess@4
+ 1984 7B8 000911F0 ZwResumeThread = _NtResumeThread@8
+ 1985 7B9 000911E0 ZwRevertContainerImpersonation = _NtRevertContainerImpersonation@0
+ 1986 7BA 000911C0 ZwRollbackComplete = _NtRollbackComplete@8
+ 1987 7BB 000911A0 ZwRollbackEnlistment = _NtRollbackEnlistment@8
+ 1988 7BC 00093C90 ZwRollbackRegistryTransaction = _NtRollbackRegistryTransaction@8
+ 1989 7BD 00091180 ZwRollbackTransaction = _NtRollbackTransaction@8
+ 1990 7BE 00091160 ZwRollforwardTransactionManager = _NtRollforwardTransactionManager@8
+ 1991 7BF 00091140 ZwSaveKey = _NtSaveKey@8
+ 1992 7C0 00091120 ZwSaveKeyEx = _NtSaveKeyEx@12
+ 1993 7C1 00091100 ZwSaveMergedKeys = _NtSaveMergedKeys@12
+ 1994 7C2 000910E0 ZwSecureConnectPort = _NtSecureConnectPort@36
+ 1995 7C3 000910D0 ZwSerializeBoot = _NtSerializeBoot@0
+ 1996 7C4 000910B0 ZwSetBootEntryOrder = _NtSetBootEntryOrder@8
+ 1997 7C5 00091090 ZwSetBootOptions = _NtSetBootOptions@8
+ 1999 7C6 00091070 ZwSetCachedSigningLevel = _NtSetCachedSigningLevel@20
+ 1998 7C7 00091050 ZwSetCachedSigningLevel2 = _NtSetCachedSigningLevel2@24
+ 2000 7C8 00091030 ZwSetContextThread = _NtSetContextThread@8
+ 2001 7C9 00091010 ZwSetDebugFilterState = _NtSetDebugFilterState@12
+ 2002 7CA 00090FF0 ZwSetDefaultHardErrorPort = _NtSetDefaultHardErrorPort@4
+ 2003 7CB 00090FD0 ZwSetDefaultLocale = _NtSetDefaultLocale@8
+ 2004 7CC 00090FB0 ZwSetDefaultUILanguage = _NtSetDefaultUILanguage@4
+ 2005 7CD 00090F90 ZwSetDriverEntryOrder = _NtSetDriverEntryOrder@8
+ 2006 7CE 00090F70 ZwSetEaFile = _NtSetEaFile@16
+ 2007 7CF 00090F50 ZwSetEvent = _NtSetEvent@8
+ 2008 7D0 00090F30 ZwSetEventBoostPriority = _NtSetEventBoostPriority@4
+ 2009 7D1 00090F10 ZwSetHighEventPair = _NtSetHighEventPair@4
+ 2010 7D2 00090EF0 ZwSetHighWaitLowEventPair = _NtSetHighWaitLowEventPair@4
+ 2011 7D3 00090C90 ZwSetIRTimer = _NtSetIRTimer@8
+ 2012 7D4 00090ED0 ZwSetInformationDebugObject = _NtSetInformationDebugObject@20
+ 2013 7D5 00090EB0 ZwSetInformationEnlistment = _NtSetInformationEnlistment@16
+ 2014 7D6 00090E90 ZwSetInformationFile = _NtSetInformationFile@20
+ 2015 7D7 00090E70 ZwSetInformationJobObject = _NtSetInformationJobObject@16
+ 2016 7D8 00090E50 ZwSetInformationKey = _NtSetInformationKey@16
+ 2017 7D9 00090E30 ZwSetInformationObject = _NtSetInformationObject@16
+ 2018 7DA 00090E10 ZwSetInformationProcess = _NtSetInformationProcess@16
+ 2019 7DB 00090DF0 ZwSetInformationResourceManager = _NtSetInformationResourceManager@16
+ 2020 7DC 00093C10 ZwSetInformationSymbolicLink = _NtSetInformationSymbolicLink@16
+ 2021 7DD 00090DD0 ZwSetInformationThread = _NtSetInformationThread@16
+ 2022 7DE 00090DB0 ZwSetInformationToken = _NtSetInformationToken@16
+ 2023 7DF 00090D90 ZwSetInformationTransaction = _NtSetInformationTransaction@16
+ 2024 7E0 00090D70 ZwSetInformationTransactionManager = _NtSetInformationTransactionManager@16
+ 2025 7E1 00091E60 ZwSetInformationVirtualMemory = _NtSetInformationVirtualMemory@24
+ 2026 7E2 00090D50 ZwSetInformationWorkerFactory = _NtSetInformationWorkerFactory@16
+ 2027 7E3 00090D30 ZwSetIntervalProfile = _NtSetIntervalProfile@8
+ 2028 7E4 00090D10 ZwSetIoCompletion = _NtSetIoCompletion@20
+ 2029 7E5 00090CF0 ZwSetIoCompletionEx = _NtSetIoCompletionEx@24
+ 2030 7E6 00090C70 ZwSetLdtEntries = _NtSetLdtEntries@24
+ 2031 7E7 00090C50 ZwSetLowEventPair = _NtSetLowEventPair@4
+ 2032 7E8 00090C30 ZwSetLowWaitHighEventPair = _NtSetLowWaitHighEventPair@4
+ 2033 7E9 00090C10 ZwSetQuotaInformationFile = _NtSetQuotaInformationFile@16
+ 2034 7EA 00090BF0 ZwSetSecurityObject = _NtSetSecurityObject@12
+ 2035 7EB 00090BD0 ZwSetSystemEnvironmentValue = _NtSetSystemEnvironmentValue@8
+ 2036 7EC 00090BB0 ZwSetSystemEnvironmentValueEx = _NtSetSystemEnvironmentValueEx@20
+ 2037 7ED 00090B90 ZwSetSystemInformation = _NtSetSystemInformation@12
+ 2038 7EE 00090B70 ZwSetSystemPowerState = _NtSetSystemPowerState@12
+ 2039 7EF 00090B50 ZwSetSystemTime = _NtSetSystemTime@8
+ 2040 7F0 00090B30 ZwSetThreadExecutionState = _NtSetThreadExecutionState@8
+ 2042 7F1 00090B10 ZwSetTimer = _NtSetTimer@28
+ 2041 7F2 00090CB0 ZwSetTimer2 = _NtSetTimer2@16
+ 2043 7F3 00090AF0 ZwSetTimerEx = _NtSetTimerEx@16
+ 2044 7F4 00090AD0 ZwSetTimerResolution = _NtSetTimerResolution@12
+ 2045 7F5 00090AB0 ZwSetUuidSeed = _NtSetUuidSeed@4
+ 2046 7F6 00090A90 ZwSetValueKey = _NtSetValueKey@24
+ 2047 7F7 00090A70 ZwSetVolumeInformationFile = _NtSetVolumeInformationFile@20
+ 2048 7F8 00090A50 ZwSetWnfProcessNotificationEvent = _NtSetWnfProcessNotificationEvent@4
+ 2049 7F9 00090A30 ZwShutdownSystem = _NtShutdownSystem@4
+ 2050 7FA 00090A10 ZwShutdownWorkerFactory = _NtShutdownWorkerFactory@8
+ 2051 7FB 000909F0 ZwSignalAndWaitForSingleObject = _NtSignalAndWaitForSingleObject@16
+ 2052 7FC 000909D0 ZwSinglePhaseReject = _NtSinglePhaseReject@8
+ 2053 7FD 000909B0 ZwStartProfile = _NtStartProfile@4
+ 2054 7FE 00090990 ZwStopProfile = _NtStopProfile@4
+ 2055 7FF 00090970 ZwSubscribeWnfStateChange = _NtSubscribeWnfStateChange@16
+ 2056 800 00090950 ZwSuspendProcess = _NtSuspendProcess@4
+ 2057 801 00090930 ZwSuspendThread = _NtSuspendThread@8
+ 2058 802 00090910 ZwSystemDebugControl = _NtSystemDebugControl@24
+ 2059 803 000908F0 ZwTerminateJobObject = _NtTerminateJobObject@8
+ 2060 804 000908D0 ZwTerminateProcess = _NtTerminateProcess@8
+ 2061 805 000908B0 ZwTerminateThread = _NtTerminateThread@8
+ 2062 806 000908A0 ZwTestAlert = _NtTestAlert@0
+ 2063 807 00090890 ZwThawRegistry = _NtThawRegistry@0
+ 2064 808 00090880 ZwThawTransactions = _NtThawTransactions@0
+ 2065 809 00090860 ZwTraceControl = _NtTraceControl@24
+ 2066 80A 00090840 ZwTraceEvent = _NtTraceEvent@16
+ 2067 80B 00090820 ZwTranslateFilePath = _NtTranslateFilePath@16
+ 2068 80C 00090800 ZwUmsThreadYield = _NtUmsThreadYield@4
+ 2069 80D 000907E0 ZwUnloadDriver = _NtUnloadDriver@4
+ 2071 80E 000907C0 ZwUnloadKey = _NtUnloadKey@4
+ 2070 80F 000907A0 ZwUnloadKey2 = _NtUnloadKey2@8
+ 2072 810 00090780 ZwUnloadKeyEx = _NtUnloadKeyEx@8
+ 2073 811 00090760 ZwUnlockFile = _NtUnlockFile@20
+ 2074 812 00090740 ZwUnlockVirtualMemory = _NtUnlockVirtualMemory@16
+ 2075 813 00090700 ZwUnmapViewOfSection = _NtUnmapViewOfSection@8
+ 2076 814 00090720 ZwUnmapViewOfSectionEx = _NtUnmapViewOfSectionEx@12
+ 2077 815 000906C0 ZwUnsubscribeWnfStateChange = _NtUnsubscribeWnfStateChange@4
+ 2078 816 000906E0 ZwUpdateWnfStateData = _NtUpdateWnfStateData@28
+ 2079 817 000906A0 ZwVdmControl = _NtVdmControl@8
+ 2080 818 00090680 ZwWaitForAlertByThreadId = _NtWaitForAlertByThreadId@8
+ 2081 819 00090660 ZwWaitForDebugEvent = _NtWaitForDebugEvent@16
+ 2082 81A 00090640 ZwWaitForKeyedEvent = _NtWaitForKeyedEvent@16
+ 2084 81B 00090620 ZwWaitForMultipleObjects = _NtWaitForMultipleObjects@20
+ 2083 81C 00090600 ZwWaitForMultipleObjects32 = _NtWaitForMultipleObjects32@20
+ 2085 81D 000905E0 ZwWaitForSingleObject = _NtWaitForSingleObject@12
+ 2086 81E 000905C0 ZwWaitForWorkViaWorkerFactory = _NtWaitForWorkViaWorkerFactory@20
+ 2087 81F 000905A0 ZwWaitHighEventPair = _NtWaitHighEventPair@4
+ 2088 820 00090580 ZwWaitLowEventPair = _NtWaitLowEventPair@4
+ 2089 821 000904B0 ZwWorkerFactoryWorkerReady = _NtWorkerFactoryWorkerReady@4
+ 2090 822 00090560 ZwWriteFile = _NtWriteFile@36
+ 2091 823 00090540 ZwWriteFileGather = _NtWriteFileGather@36
+ 2092 824 00090520 ZwWriteRequestData = _NtWriteRequestData@24
+ 2093 825 00090500 ZwWriteVirtualMemory = _NtWriteVirtualMemory@20
+ 2094 826 000904F0 ZwYieldExecution = _NtYieldExecution@0
+ 2095 827 00094EE0 _CIcos = __CIcos
+ 2096 828 00094FA0 _CIlog = __CIlog
+ 2097 829 00095090 _CIpow = __CIpow
+ 2098 82A 000952C0 _CIsin = __CIsin
+ 2099 82B 00095370 _CIsqrt = __CIsqrt
+ 2100 82C 00095430 __isascii = ___isascii
+ 2101 82D 00095450 __iscsym = ___iscsym
+ 2102 82E 00095490 __iscsymf = ___iscsymf
+ 2103 82F 000954D0 __toascii = ___toascii
+ 2104 830 00095700 _alldiv = __alldiv
+ 2105 831 000957B0 _alldvrm = __alldvrm
+ 2106 832 00095890 _allmul = __allmul
+ 2107 833 000958D0 _alloca_probe = __alloca_probe
+ 2108 834 00095900 _alloca_probe_16 = __alloca_probe_16
+ 2109 835 00095916 _alloca_probe_8 = __alloca_probe_8
+ 2110 836 00095930 _allrem = __allrem
+ 2111 837 000959F0 _allshl = __allshl
+ 2112 838 00095A10 _allshr = __allshr
+ 2113 839 00095A40 _atoi64 = __atoi64
+ 2114 83A 00095AB0 _aulldiv = __aulldiv
+ 2115 83B 00095B20 _aulldvrm = __aulldvrm
+ 2116 83C 00095BC0 _aullrem = __aullrem
+ 2117 83D 00095C40 _aullshr = __aullshr
+ 2118 83E 000958D0 _chkstk = __alloca_probe
+ 2119 83F 000871F0 _errno = __errno
+ 2120 840 00095CB0 _except_handler4_common = __except_handler4_common
+ 2121 841 001167B0 _fltused = __fltused
+ 2122 842 00095DE0 _ftol = __ftol
+ 2123 843 00095E20 _ftol2 = __ftol2
+ 2124 844 00095E10 _ftol2_sse = __ftol2_sse
+ 2125 845 00095F10 _i64toa = __i64toa
+ 2126 846 0009E3B0 _i64toa_s = __i64toa_s
+ 2127 847 00096100 _i64tow = __i64tow
+ 2128 848 0009E6B0 _i64tow_s = __i64tow_s
+ 2129 849 00095F50 _itoa = __itoa
+ 2130 84A 0009E3F0 _itoa_s = __itoa_s
+ 2131 84B 00096140 _itow = __itow
+ 2132 84C 0009E6F0 _itow_s = __itow_s
+ 2133 84D 00096280 _lfind = __lfind
+ 2134 84E 00096310 _local_unwind4 = __local_unwind4
+ 2135 84F 00095F90 _ltoa = __ltoa
+ 2136 850 0009E420 _ltoa_s = __ltoa_s
+ 2137 851 00096180 _ltow = __ltow
+ 2138 852 0009E720 _ltow_s = __ltow_s
+ 2139 853 0009E8B0 _makepath_s = __makepath_s
+ 2140 854 00096480 _memccpy = __memccpy
+ 2141 855 000964E0 _memicmp = __memicmp
+ 2142 856 000964F0 _snprintf = __snprintf
+ 2143 857 0009E9A0 _snprintf_s = __snprintf_s
+ 2144 858 0009EA80 _snscanf_s = __snscanf_s
+ 2145 859 000965A0 _snwprintf = __snwprintf
+ 2146 85A 0009EAC0 _snwprintf_s = __snwprintf_s
+ 2147 85B 0009EB90 _snwscanf_s = __snwscanf_s
+ 2148 85C 00096670 _splitpath = __splitpath
+ 2149 85D 0009EBD0 _splitpath_s = __splitpath_s
+ 2150 85E 000968A0 _strcmpi = __stricmp
+ 2151 85F 000968A0 _stricmp = __stricmp
+ 2152 860 000968B0 _strlwr = __strlwr
+ 2153 861 000968E0 _strlwr_s = __strlwr_s
+ 2154 862 00096940 _strnicmp = __strnicmp
+ 2155 863 0009EDB0 _strnset_s = __strnset_s
+ 2156 864 0009EE30 _strset_s = __strset_s
+ 2157 865 00096950 _strupr = __strupr
+ 2158 866 000969A0 _strupr_s = __strupr_s
+ 2159 867 00099740 _swprintf = __swprintf
+ 2160 868 00095FD0 _ui64toa = __ui64toa
+ 2161 869 0009E460 _ui64toa_s = __ui64toa_s
+ 2162 86A 000961C0 _ui64tow = __ui64tow
+ 2163 86B 0009E760 _ui64tow_s = __ui64tow_s
+ 2164 86C 00096000 _ultoa = __ultoa
+ 2165 86D 0009E490 _ultoa_s = __ultoa_s
+ 2166 86E 000961F0 _ultow = __ultow
+ 2167 86F 0009E790 _ultow_s = __ultow_s
+ 2168 870 00096A00 _vscwprintf = __vscwprintf
+ 2169 871 00096B50 _vsnprintf = __vsnprintf
+ 2170 872 0009E9D0 _vsnprintf_s = __vsnprintf_s
+ 2171 873 00096C20 _vsnwprintf = __vsnwprintf
+ 2172 874 0009EAF0 _vsnwprintf_s = __vsnwprintf_s
+ 2173 875 00096A90 _vswprintf = __vswprintf
+ 2174 876 00096D10 _wcsicmp = __wcsicmp
+ 2175 877 00096D70 _wcslwr = __wcslwr
+ 2176 878 00096DD0 _wcslwr_s = __wcslwr_s
+ 2177 879 00096E40 _wcsnicmp = __wcsnicmp
+ 2178 87A 00096EC0 _wcsnset_s = __wcsnset_s
+ 2179 87B 00096F50 _wcsset_s = __wcsset_s
+ 2180 87C 00096FB0 _wcstoi64 = __wcstoi64
+ 2181 87D 00096FE0 _wcstoui64 = __wcstoui64
+ 2182 87E 000972D0 _wcsupr = __wcsupr
+ 2183 87F 00097310 _wcsupr_s = __wcsupr_s
+ 2184 880 0009EE90 _wmakepath_s = __wmakepath_s
+ 2185 881 0009EFC0 _wsplitpath_s = __wsplitpath_s
+ 2186 882 00097380 _wtoi = __wtoi
+ 2187 883 00097390 _wtoi64 = __wtoi64
+ 2188 884 000973C0 _wtol = __wtol
+ 2189 885 00097A90 abs = _abs
+ 2190 886 000973F0 atan = _atan
+ 2191 887 000974B0 atan2 = _atan2
+ 2192 888 00095A70 atoi = _atoi
+ 2193 889 00095A80 atol = _atol
+ 2194 88A 000974D0 bsearch = _bsearch
+ 2195 88B 00097590 bsearch_s = _bsearch_s
+ 2196 88C 00097650 ceil = _ceil
+ 2197 88D 00094ED0 cos = _cos
+ 2198 88E 00097750 fabs = _fabs
+ 2199 88F 00097820 floor = _floor
+ 2200 890 000954F0 isalnum = _isalnum
+ 2201 891 00095520 isalpha = _isalpha
+ 2202 892 00095550 iscntrl = _iscntrl
+ 2203 893 00095580 isdigit = _isdigit
+ 2204 894 000955B0 isgraph = _isgraph
+ 2205 895 000955E0 islower = _islower
+ 2206 896 00095610 isprint = _isprint
+ 2207 897 00095640 ispunct = _ispunct
+ 2208 898 00095670 isspace = _isspace
+ 2209 899 000956A0 isupper = _isupper
+ 2210 89A 00097930 iswalnum = _iswalnum
+ 2211 89B 00097950 iswalpha = _iswalpha
+ 2212 89C 00097970 iswascii = _iswascii
+ 2213 89D 00097A60 iswctype = _iswctype
+ 2214 89E 00097990 iswdigit = _iswdigit
+ 2215 89F 000979B0 iswgraph = _iswgraph
+ 2216 8A0 000979D0 iswlower = _iswlower
+ 2217 8A1 000979F0 iswprint = _iswprint
+ 2218 8A2 00097A10 iswspace = _iswspace
+ 2219 8A3 00097A30 iswxdigit = _iswxdigit
+ 2220 8A4 000956D0 isxdigit = _isxdigit
+ 2221 8A5 00097A90 labs = _abs
+ 2222 8A6 00094F90 log = _log
+ 2223 8A7 00097AB0 mbstowcs = _mbstowcs
+ 2224 8A8 00097B30 memchr = _memchr
+ 2225 8A9 00097BF0 memcmp = _memcmp
+ 2226 8AA 00097C50 memcpy = _memcpy
+ 2227 8AB 0009F1D0 memcpy_s = _memcpy_s
+ 2228 8AC 00097F90 memmove = _memmove
+ 2229 8AD 0009F260 memmove_s = _memmove_s
+ 2230 8AE 000982D0 memset = _memset
+ 2231 8AF 00095080 pow = _pow
+ 2232 8B0 00098340 qsort = _qsort
+ 2233 8B1 00098770 qsort_s = _qsort_s
+ 2234 8B2 000952B0 sin = _sin
+ 2235 8B3 00098BB0 sprintf = _sprintf
+ 2236 8B4 0009F2D0 sprintf_s = _sprintf_s
+ 2237 8B5 00095384 sqrt = _sqrt
+ 2238 8B6 00098C30 sscanf = _sscanf
+ 2239 8B7 0009F360 sscanf_s = _sscanf_s
+ 2240 8B8 00098CF0 strcat = _strcat
+ 2241 8B9 0009F3B0 strcat_s = _strcat_s
+ 2242 8BA 00098DF0 strchr = _strchr
+ 2243 8BB 00098EB0 strcmp = _strcmp
+ 2244 8BC 00098CE0 strcpy = _strcpy
+ 2245 8BD 0009F440 strcpy_s = _strcpy_s
+ 2246 8BE 00098F40 strcspn = _strcspn
+ 2247 8BF 00098F90 strlen = _strlen
+ 2248 8C0 00099020 strncat = _strncat
+ 2249 8C1 0009F4B0 strncat_s = _strncat_s
+ 2250 8C2 00099160 strncmp = _strncmp
+ 2251 8C3 00099220 strncpy = _strncpy
+ 2252 8C4 0009F5B0 strncpy_s = _strncpy_s
+ 2253 8C5 00099350 strnlen = _strnlen
+ 2254 8C6 00099370 strpbrk = _strpbrk
+ 2255 8C7 000993B0 strrchr = _strrchr
+ 2256 8C8 000993E0 strspn = _strspn
+ 2257 8C9 00099430 strstr = _strstr
+ 2258 8CA 0009F6A0 strtok_s = _strtok_s
+ 2259 8CB 000996C0 strtol = _strtol
+ 2260 8CC 00099710 strtoul = _strtoul
+ 2261 8CD 00099740 swprintf = __swprintf
+ 2262 8CE 0009F7A0 swprintf_s = _swprintf_s
+ 2263 8CF 0009F830 swscanf_s = _swscanf_s
+ 2264 8D0 000997E0 tan = _tan
+ 2265 8D1 000998B0 tolower = _tolower
+ 2266 8D2 000998E0 toupper = _toupper
+ 2267 8D3 00099940 towlower = _towlower
+ 2268 8D4 00099970 towupper = _towupper
+ 2269 8D5 000D7380 vDbgPrintEx = _vDbgPrintEx@16
+ 2270 8D6 000D73B0 vDbgPrintExWithPrefix = _vDbgPrintExWithPrefix@20
+ 2271 8D7 00099A00 vsprintf = _vsprintf
+ 2272 8D8 0009F300 vsprintf_s = _vsprintf_s
+ 2273 8D9 0009F7D0 vswprintf_s = _vswprintf_s
+ 2274 8DA 00099A20 wcscat = _wcscat
+ 2275 8DB 0009F880 wcscat_s = _wcscat_s
+ 2276 8DC 00099A90 wcschr = _wcschr
+ 2277 8DD 00099AC0 wcscmp = _wcscmp
+ 2278 8DE 00099A60 wcscpy = _wcscpy
+ 2279 8DF 0009F910 wcscpy_s = _wcscpy_s
+ 2280 8E0 00099B10 wcscspn = _wcscspn
+ 2281 8E1 00099B70 wcslen = _wcslen
+ 2282 8E2 00099B90 wcsncat = _wcsncat
+ 2283 8E3 0009F990 wcsncat_s = _wcsncat_s
+ 2284 8E4 00099BE0 wcsncmp = _wcsncmp
+ 2285 8E5 00099C20 wcsncpy = _wcsncpy
+ 2286 8E6 0009FA90 wcsncpy_s = _wcsncpy_s
+ 2287 8E7 00099C70 wcsnlen = _wcsnlen
+ 2288 8E8 00099CA0 wcspbrk = _wcspbrk
+ 2289 8E9 00099CF0 wcsrchr = _wcsrchr
+ 2290 8EA 00099D30 wcsspn = _wcsspn
+ 2291 8EB 00099D90 wcsstr = _wcsstr
+ 2292 8EC 0009FB80 wcstok_s = _wcstok_s
+ 2293 8ED 0009A000 wcstol = _wcstol
+ 2294 8EE 0009A080 wcstombs = _wcstombs
+ 2295 8EF 0009A050 wcstoul = _wcstoul
+
+ Summary
+
+ 1000 .00cfg
+ 4000 .data
+ 3000 .mrdata
+ 5000 .reloc
+ 6A000 .rsrc
+ 114000 .text
+ 1000 RT
diff --git a/test/ntoskrnl-exports.txt b/test/ntoskrnl-exports.txt
new file mode 100644
index 0000000..95bd5c4
--- /dev/null
+++ b/test/ntoskrnl-exports.txt
@@ -0,0 +1,2897 @@
+Microsoft (R) COFF/PE Dumper Version 14.10.25019.0
+Copyright (C) Microsoft Corporation. All rights reserved.
+
+
+Dump of file ntoskrnl.exe
+
+File Type: EXECUTABLE IMAGE
+
+ Section contains the following exports for ntoskrnl.exe
+
+ 00000000 characteristics
+ 58CCA928 time date stamp Sat Mar 18 04:27:36 2017
+ 0.00 version
+ 1 ordinal base
+ 2853 number of functions
+ 2849 number of names
+
+ ordinal hint RVA name
+
+ 155 0 000DDAB2 AlpcGetHeaderSize = _AlpcGetHeaderSize@4
+ 156 1 000DD98E AlpcGetMessageAttribute = _AlpcGetMessageAttribute@8
+ 157 2 000DDA78 AlpcInitializeMessageAttribute = _AlpcInitializeMessageAttribute@16
+ 158 3 00518A00 BgkDisplayCharacter = _BgkDisplayCharacter@20
+ 159 4 00518A81 BgkGetConsoleState = _BgkGetConsoleState@4
+ 160 5 00518AB5 BgkGetCursorState = _BgkGetCursorState@12
+ 161 6 00518AEF BgkSetCursor = _BgkSetCursor@12
+ 162 7 0016E120 CcAddDirtyPagesToExternalCache = _CcAddDirtyPagesToExternalCache@8
+ 163 8 00085FB8 CcAsyncCopyRead = _CcAsyncCopyRead@32
+ 164 9 00080DC0 CcCanIWrite = _CcCanIWrite@16
+ 165 A 0006A6E4 CcCoherencyFlushAndPurgeCache = _CcCoherencyFlushAndPurgeCache@20
+ 166 B 00306BDA CcCopyRead = _CcCopyRead@24
+ 167 C 00040056 CcCopyReadEx = _CcCopyReadEx@28
+ 168 D 0016E87D CcCopyWrite = _CcCopyWrite@20
+ 169 E 00039C94 CcCopyWriteEx = _CcCopyWriteEx@24
+ 170 F 000C1942 CcCopyWriteWontFlush = _CcCopyWriteWontFlush@12
+ 171 10 0016E250 CcDeductDirtyPagesFromExternalCache = _CcDeductDirtyPagesFromExternalCache@8
+ 172 11 0016E8A1 CcDeferWrite = _CcDeferWrite@24
+ 173 12 00406E9A CcFastCopyRead = _CcFastCopyRead@24
+ 174 13 0016E9AD CcFastCopyWrite = _CcFastCopyWrite@16
+ 175 14 00204DA8 CcFastMdlReadWait = _CcFastMdlReadWait
+ 176 15 000D0F28 CcFlushCache = _CcFlushCache@16
+ 177 16 000E5204 CcFlushCacheToLsn = _CcFlushCacheToLsn@12
+ 178 17 0016EE30 CcGetCachedDirtyPageCountForFile = _CcGetCachedDirtyPageCountForFile@4
+ 179 18 00087014 CcGetDirtyPages = _CcGetDirtyPages@16
+ 180 19 0016E02D CcGetFileObjectFromBcb = _CcGetFileObjectFromBcb@4
+ 181 1A 0016E047 CcGetFileObjectFromSectionPtrs = _CcGetFileObjectFromSectionPtrs@4
+ 182 1B 000EF282 CcGetFileObjectFromSectionPtrsRef = _CcGetFileObjectFromSectionPtrsRef@4
+ 183 1C 0006CAFC CcGetFlushedValidData = _CcGetFlushedValidData@8
+ 184 1D 0016EE52 CcGetLsnForFileObject = _CcGetLsnForFileObject@8
+ 185 1E 000D4C28 CcInitializeCacheMap = _CcInitializeCacheMap@20
+ 186 1F 000880CC CcInitializeCacheMapEx = _CcInitializeCacheMapEx@24
+ 187 20 0016EF22 CcIsThereDirtyData = _CcIsThereDirtyData@4
+ 188 21 0016F0AB CcIsThereDirtyDataEx = _CcIsThereDirtyDataEx@8
+ 189 22 000C7DD4 CcIsThereDirtyLoggedPages = _CcIsThereDirtyLoggedPages@8
+ 190 23 00285398 CcMapData = _CcMapData@24
+ 191 24 002D20A8 CcMdlRead = _CcMdlRead@20
+ 192 25 002FEE9E CcMdlReadComplete = _CcMdlReadComplete@8
+ 193 26 0016F34D CcMdlWriteAbort = _CcMdlWriteAbort@8
+ 194 27 00306B5A CcMdlWriteComplete = _CcMdlWriteComplete@12
+ 195 28 002B7368 CcPinMappedData = _CcPinMappedData@20
+ 196 29 002B7254 CcPinRead = _CcPinRead@24
+ 197 2A 000A1CA6 CcPrepareMdlWrite = _CcPrepareMdlWrite@20
+ 198 2B 002EEFF0 CcPreparePinWrite = _CcPreparePinWrite@28
+ 199 2C 0007EF48 CcPurgeCacheSection = _CcPurgeCacheSection@16
+ 200 2D 0016E73F CcRegisterExternalCache = _CcRegisterExternalCache@8
+ 201 2E 000401D8 CcRemapBcb = _CcRemapBcb@4
+ 202 2F 0016EB4A CcRepinBcb = _CcRepinBcb@4
+ 203 30 0016EB9B CcScheduleReadAhead = _CcScheduleReadAhead@12
+ 204 31 0007FDCE CcScheduleReadAheadEx = _CcScheduleReadAheadEx@16
+ 205 32 000BDB64 CcSetAdditionalCacheAttributes = _CcSetAdditionalCacheAttributes@12
+ 206 33 000BDA54 CcSetAdditionalCacheAttributesEx = _CcSetAdditionalCacheAttributesEx@8
+ 207 34 00406F49 CcSetBcbOwnerPointer = _CcSetBcbOwnerPointer@8
+ 208 35 0016E0ED CcSetDirtyPageThreshold = _CcSetDirtyPageThreshold@8
+ 209 36 00082B5E CcSetDirtyPinnedData = _CcSetDirtyPinnedData@8
+ 210 37 000D535A CcSetFileSizes = _CcSetFileSizes@8
+ 211 38 000809E6 CcSetFileSizesEx = _CcSetFileSizesEx@8
+ 212 39 0016F16C CcSetLogHandleForFile = _CcSetLogHandleForFile@12
+ 213 3A 000C8596 CcSetLogHandleForFileEx = _CcSetLogHandleForFileEx@20
+ 214 3B 000E6F34 CcSetLoggedDataThreshold = _CcSetLoggedDataThreshold@8
+ 215 3C 000C2410 CcSetParallelFlushFile = _CcSetParallelFlushFile@8
+ 216 3D 000C809C CcSetReadAheadGranularity = _CcSetReadAheadGranularity@8
+ 217 3E 0016EBB9 CcSetReadAheadGranularityEx = _CcSetReadAheadGranularityEx@8
+ 218 3F 000E3C74 CcTestControl = _CcTestControl@12
+ 219 40 0008531A CcUninitializeCacheMap = _CcUninitializeCacheMap@12
+ 220 41 000CDCDA CcUnmapFileOffsetFromSystemCache = _CcUnmapFileOffsetFromSystemCache@16
+ 221 42 002B6F5A CcUnpinData = _CcUnpinData@4
+ 222 43 00406F8E CcUnpinDataForThread = _CcUnpinDataForThread@8
+ 223 44 0016EC0B CcUnpinRepinnedBcb = _CcUnpinRepinnedBcb@12
+ 224 45 0016E831 CcUnregisterExternalCache = _CcUnregisterExternalCache@4
+ 225 46 000E4F18 CcWaitForCurrentLazyWriterActivity = _CcWaitForCurrentLazyWriterActivity@0
+ 226 47 002C2990 CcZeroData = _CcZeroData@16
+ 227 48 000A1FA8 CcZeroDataOnDisk = _CcZeroDataOnDisk@16
+ 228 49 00408E50 CmCallbackGetKeyObjectID = _CmCallbackGetKeyObjectID@16
+ 229 4A 0027C9DA CmCallbackGetKeyObjectIDEx = _CmCallbackGetKeyObjectIDEx@20
+ 230 4B 0027C9BE CmCallbackReleaseKeyObjectIDEx = _CmCallbackReleaseKeyObjectIDEx@4
+ 231 4C 00305482 CmGetBoundTransaction = _CmGetBoundTransaction@8
+ 232 4D 00408F09 CmGetCallbackVersion = _CmGetCallbackVersion@8
+ 233 4E 00219BD0 CmKeyObjectType = _CmKeyObjectType
+ 234 4F 0037577E CmRegisterCallback = _CmRegisterCallback@12
+ 235 50 00408F2C CmRegisterCallbackEx = _CmRegisterCallbackEx@24
+ 236 51 00408F92 CmSetCallbackObjectContext = _CmSetCallbackObjectContext@16
+ 237 52 00409177 CmUnRegisterCallback = _CmUnRegisterCallback@8
+ 238 53 0010BF4C DbgBreakPoint = _DbgBreakPoint@0
+ 239 54 0010BF40 DbgBreakPointWithStatus = _DbgBreakPointWithStatus@4
+ 240 55 001B6540 DbgCommandString = _DbgCommandString@8
+ 241 56 000A0326 DbgLoadImageSymbols = _DbgLoadImageSymbols@12
+ 242 57 000A072E DbgPrint = _DbgPrint
+ 243 58 000A0708 DbgPrintEx = _DbgPrintEx
+ 244 59 001B6599 DbgPrintReturnControlC = _DbgPrintReturnControlC
+ 245 5A 001B65BD DbgPrompt = _DbgPrompt@12
+ 246 5B 001B6603 DbgQueryDebugFilterState = _DbgQueryDebugFilterState@8
+ 247 5C 000FA82A DbgSetDebugFilterState = _DbgSetDebugFilterState@12
+ 248 5D 001B6613 DbgSetDebugPrintCallback = _DbgSetDebugPrintCallback@8
+ 249 5E 0036957A DbgkLkmdRegisterCallback = _DbgkLkmdRegisterCallback@12
+ 250 5F 004233A4 DbgkLkmdUnregisterCallback = _DbgkLkmdUnregisterCallback@4
+ 251 60 00423B22 DbgkWerCaptureLiveKernelDump = _DbgkWerCaptureLiveKernelDump@36
+ 252 61 0022F446 EmClientQueryRuleState = _EmClientQueryRuleState@8
+ 253 62 004246F8 EmClientRuleDeregisterNotification = _EmClientRuleDeregisterNotification@4
+ 254 63 0022F4F4 EmClientRuleEvaluate = _EmClientRuleEvaluate@16
+ 255 64 004247A0 EmClientRuleRegisterNotification = _EmClientRuleRegisterNotification@16
+ 256 65 004249D1 EmProviderDeregister = _EmProviderDeregister@4
+ 257 66 00424B46 EmProviderDeregisterEntry = _EmProviderDeregisterEntry@4
+ 258 67 003557D2 EmProviderRegister = _EmProviderRegister@24
+ 259 68 00424B87 EmProviderRegisterEntry = _EmProviderRegisterEntry@16
+ 260 69 00355818 EmpProviderRegister = _EmpProviderRegister@24
+ 261 6A 0006C9B8 EtwActivityIdControl = _EtwActivityIdControl@8
+ 262 6B 0024AE18 EtwEnableTrace = _EtwEnableTrace@44
+ 263 6C 00055BA0 EtwEventEnabled = _EtwEventEnabled@12
+ 264 6D 000A2FC6 EtwProviderEnabled = _EtwProviderEnabled@20
+ 265 6E 0024B14A EtwRegister = _EtwRegister@16
+ 266 6F 0024AE64 EtwRegisterClassicProvider = _EtwRegisterClassicProvider@20
+ 267 70 001C9030 EtwSendTraceBuffer = _EtwSendTraceBuffer@24
+ 268 71 003486AE EtwSetInformation = _EtwSetInformation@20
+ 269 72 0034856E EtwUnregister = _EtwUnregister@8
+ 270 73 0002C148 EtwWrite = _EtwWrite@24
+ 271 74 0034818A EtwWriteEndScenario = _EtwWriteEndScenario@24
+ 272 75 0002C174 EtwWriteEx = _EtwWriteEx@40
+ 273 76 00347D58 EtwWriteStartScenario = _EtwWriteStartScenario@24
+ 274 77 001C97E1 EtwWriteString = _EtwWriteString@28
+ 275 78 000CFC20 EtwWriteTransfer = _EtwWriteTransfer@28
+ 5 79 000C46F6 ExAcquireAutoExpandPushLockExclusive = @ExAcquireAutoExpandPushLockExclusive@8
+ 6 7A 0002841E ExAcquireAutoExpandPushLockShared = @ExAcquireAutoExpandPushLockShared@8
+ 276 7B 00028258 ExAcquireCacheAwarePushLockExclusive = _ExAcquireCacheAwarePushLockExclusive@4
+ 7 7C 001D0612 ExAcquireCacheAwarePushLockExclusiveEx = @ExAcquireCacheAwarePushLockExclusiveEx@8
+ 8 7D 0005E0EC ExAcquireCacheAwarePushLockSharedEx = @ExAcquireCacheAwarePushLockSharedEx@8
+ 9 7E 0005DFE2 ExAcquireFastMutex = @ExAcquireFastMutex@4
+ 10 7F 0002E592 ExAcquireFastMutexUnsafe = @ExAcquireFastMutexUnsafe@4
+ 277 80 001D0DE4 ExAcquireFastResourceExclusive = _ExAcquireFastResourceExclusive@12
+ 278 81 001D1197 ExAcquireFastResourceShared = _ExAcquireFastResourceShared@12
+ 279 82 001D151D ExAcquireFastResourceSharedStarveExclusive = _ExAcquireFastResourceSharedStarveExclusive@12
+ 11 83 0005E182 ExAcquirePushLockExclusiveEx = @ExAcquirePushLockExclusiveEx@8
+ 12 84 0005E224 ExAcquirePushLockSharedEx = @ExAcquirePushLockSharedEx@8
+ 280 85 0005CD38 ExAcquireResourceExclusiveLite = _ExAcquireResourceExclusiveLite@8
+ 281 86 0005CD8A ExAcquireResourceSharedLite = _ExAcquireResourceSharedLite@8
+ 13 87 000B55E2 ExAcquireRundownProtection = @ExfAcquireRundownProtection@4
+ 14 88 000BE938 ExAcquireRundownProtectionCacheAware = @ExAcquireRundownProtectionCacheAware@4
+ 15 89 000D779A ExAcquireRundownProtectionCacheAwareEx = @ExAcquireRundownProtectionCacheAwareEx@8
+ 16 8A 000D77C4 ExAcquireRundownProtectionEx = @ExAcquireRundownProtectionEx@8
+ 282 8B 00088FA2 ExAcquireSharedStarveExclusive = _ExAcquireSharedStarveExclusive@8
+ 283 8C 000EECB4 ExAcquireSharedWaitForExclusive = _ExAcquireSharedWaitForExclusive@8
+ 284 8D 000585C6 ExAcquireSpinLockExclusive = _ExAcquireSpinLockExclusive@4
+ 285 8E 0005859C ExAcquireSpinLockExclusiveAtDpcLevel = _ExAcquireSpinLockExclusiveAtDpcLevel@4
+ 286 8F 0003FECA ExAcquireSpinLockShared = _ExAcquireSpinLockShared@4
+ 287 90 0003FE98 ExAcquireSpinLockSharedAtDpcLevel = _ExAcquireSpinLockSharedAtDpcLevel@4
+ 288 91 001D049D ExAllocateAutoExpandPushLock = _ExAllocateAutoExpandPushLock@4
+ 289 92 00105414 ExAllocateCacheAwarePushLock = _ExAllocateCacheAwarePushLock@4
+ 290 93 0030C14C ExAllocateCacheAwareRundownProtection = _ExAllocateCacheAwareRundownProtection@8
+ 291 94 00057F9A ExAllocateFromPagedLookasideList = _ExAllocateFromPagedLookasideList@4
+ 292 95 000D4FD0 ExAllocatePool = _ExAllocatePool@8
+ 293 96 001CFEC2 ExAllocatePoolWithQuota = _ExAllocatePoolWithQuota@8
+ 294 97 0005A5DA ExAllocatePoolWithQuotaTag = _ExAllocatePoolWithQuotaTag@12
+ 295 98 001EC01E ExAllocatePoolWithTag = _ExAllocatePoolWithTag@12
+ 296 99 000A2832 ExAllocatePoolWithTagPriority = _ExAllocatePoolWithTagPriority@16
+ 297 9A 000F648A ExAllocateTimer = _ExAllocateTimer@12
+ 17 9B 000B20A6 ExBlockOnAddressPushLock = @ExBlockOnAddressPushLock@20
+ 18 9C 000B2146 ExBlockPushLock = @ExBlockPushLock@8
+ 298 9D 000D54BE ExCancelTimer = _ExCancelTimer@8
+ 299 9E 000C7460 ExCleanupAutoExpandPushLock = _ExCleanupAutoExpandPushLock@4
+ 300 9F 000E3D82 ExCleanupRundownProtectionCacheAware = _ExCleanupRundownProtectionCacheAware@4
+ 301 A0 00219B68 ExCompositionObjectType = _ExCompositionObjectType
+ 302 A1 000C5CEA ExConvertExclusiveToSharedLite = _ExConvertExclusiveToSharedLite@4
+ 303 A2 001D18A3 ExConvertFastResourceExclusiveToShared = _ExConvertFastResourceExclusiveToShared@8
+ 304 A3 001CF0F6 ExConvertPushLockExclusiveToShared = _ExConvertPushLockExclusiveToShared@4
+ 305 A4 00219B60 ExCoreMessagingObjectType = _ExCoreMessagingObjectType
+ 306 A5 003038AC ExCreateCallback = _ExCreateCallback@16
+ 307 A6 001D196A ExDeleteFastResource = _ExDeleteFastResource@4
+ 308 A7 000CA38E ExDeleteLookasideListEx = _ExDeleteLookasideListEx@4
+ 309 A8 00107010 ExDeleteNPagedLookasideList = _ExDeleteNPagedLookasideList@4
+ 310 A9 000CA340 ExDeletePagedLookasideList = _ExDeletePagedLookasideList@4
+ 311 AA 0002CCAE ExDeleteResourceLite = _ExDeleteResourceLite@4
+ 312 AB 000F8128 ExDeleteTimer = _ExDeleteTimer@16
+ 313 AC 00219B64 ExDesktopObjectType = _ExDesktopObjectType
+ 314 AD 000E6B22 ExDisableResourceBoostLite = _ExDisableResourceBoostLite@4
+ 315 AE 001D19C6 ExDisownFastResource = _ExDisownFastResource@8
+ 19 AF 0002E57A ExEnterCriticalRegionAndAcquireFastMutexUnsafe = @ExEnterCriticalRegionAndAcquireFastMutexUnsafe@4
+ 316 B0 0005C96A ExEnterCriticalRegionAndAcquireResourceExclusive = _ExEnterCriticalRegionAndAcquireResourceExclusive@4
+ 317 B1 000BCF10 ExEnterCriticalRegionAndAcquireResourceShared = _ExEnterCriticalRegionAndAcquireResourceShared@4
+ 318 B2 001D0984 ExEnterCriticalRegionAndAcquireSharedWaitForExclusive = _ExEnterCriticalRegionAndAcquireSharedWaitForExclusive@4
+ 319 B3 001D09B5 ExEnterPriorityRegionAndAcquireResourceExclusive = _ExEnterPriorityRegionAndAcquireResourceExclusive@4
+ 320 B4 000BCD50 ExEnterPriorityRegionAndAcquireResourceShared = _ExEnterPriorityRegionAndAcquireResourceShared@4
+ 321 B5 002DB2D2 ExEnumHandleTable = _ExEnumHandleTable@16
+ 322 B6 004AEF74 ExEnumerateSystemFirmwareTables = _ExEnumerateSystemFirmwareTables@16
+ 323 B7 00219B70 ExEventObjectType = _ExEventObjectType
+ 324 B8 001D40D8 ExExtendZone = _ExExtendZone@12
+ 325 B9 004B16D0 ExFetchLicenseData
+ 326 BA 000CA3BE ExFlushLookasideListEx = _ExFlushLookasideListEx@4
+ 327 BB 001D04DA ExFreeAutoExpandPushLock = _ExFreeAutoExpandPushLock@4
+ 328 BC 001D0822 ExFreeCacheAwarePushLock = _ExFreeCacheAwarePushLock@4
+ 329 BD 000D60EA ExFreeCacheAwareRundownProtection = _ExFreeCacheAwareRundownProtection@4
+ 330 BE 001EC006 ExFreePool = _ExFreePool@4
+ 331 BF 001ECA9E ExFreePoolWithTag = _ExFreePoolWithTag@8
+ 332 C0 00057F68 ExFreeToPagedLookasideList = _ExFreeToPagedLookasideList@8
+ 333 C1 000CCD8C ExGetCurrentProcessorCounts = _ExGetCurrentProcessorCounts@12
+ 334 C2 001CF111 ExGetCurrentProcessorCpuUsage = _ExGetCurrentProcessorCpuUsage@4
+ 335 C3 001D09F0 ExGetExclusiveWaiterCount = _ExGetExclusiveWaiterCount@4
+ 336 C4 00378AC4 ExGetFirmwareEnvironmentVariable = _ExGetFirmwareEnvironmentVariable@20
+ 337 C5 004B17B7 ExGetLicenseTamperState = _ExGetLicenseTamperState@4
+ 338 C6 0005A160 ExGetPreviousMode = _ExGetPreviousMode@0
+ 339 C7 001D0A1B ExGetSharedWaiterCount = _ExGetSharedWaiterCount@4
+ 340 C8 00376030 ExGetSystemFirmwareTable = _ExGetSystemFirmwareTable@20
+ 341 C9 000C4166 ExInitializeAutoExpandPushLock = _ExInitializeAutoExpandPushLock@8
+ 342 CA 001D1F2B ExInitializeFastOwnerEntry = _ExInitializeFastOwnerEntry@4
+ 343 CB 001D1F6E ExInitializeFastResource = _ExInitializeFastResource@8
+ 344 CC 000C8FA6 ExInitializeLookasideListEx = _ExInitializeLookasideListEx@32
+ 345 CD 000E6A0A ExInitializeNPagedLookasideList = _ExInitializeNPagedLookasideList@28
+ 346 CE 002FED24 ExInitializePagedLookasideList = _ExInitializePagedLookasideList@28
+ 347 CF 000D60CA ExInitializePushLock = _ExInitializePushLock@4
+ 348 D0 0002C97A ExInitializeResourceLite = _ExInitializeResourceLite@4
+ 20 D1 0003282C ExInitializeRundownProtection = @ExInitializeRundownProtection@4
+ 349 D2 0030C214 ExInitializeRundownProtectionCacheAware = _ExInitializeRundownProtectionCacheAware@8
+ 350 D3 000E3D6C ExInitializeRundownProtectionCacheAwareEx = _ExInitializeRundownProtectionCacheAwareEx@8
+ 351 D4 00105DC4 ExInitializeZone = _ExInitializeZone@16
+ 352 D5 001D0D5D ExInterlockedAddLargeInteger = _ExInterlockedAddLargeInteger@16
+ 21 D6 00120234 ExInterlockedAddLargeStatistic = @ExInterlockedAddLargeStatistic@8
+ 22 D7 001D08B9 ExInterlockedAddUlong = @ExInterlockedAddUlong@12
+ 23 D8 00120280 ExInterlockedCompareExchange64 = @ExInterlockedCompareExchange64@16
+ 353 D9 001D0DA2 ExInterlockedDecrementLong = _ExInterlockedDecrementLong@8
+ 354 DA 001D0DB8 ExInterlockedExchangeUlong = _ExInterlockedExchangeUlong@12
+ 355 DB 001D413A ExInterlockedExtendZone = _ExInterlockedExtendZone@16
+ 24 DC 0011FAF0 ExInterlockedFlushSList = @ExInterlockedFlushSList@4
+ 356 DD 001D0DCE ExInterlockedIncrementLong = _ExInterlockedIncrementLong@8
+ 25 DE 001D08C9 ExInterlockedInsertHeadList = @ExInterlockedInsertHeadList@12
+ 26 DF 001D08D9 ExInterlockedInsertTailList = @ExInterlockedInsertTailList@12
+ 27 E0 001D08E9 ExInterlockedPopEntryList = @ExInterlockedPopEntryList@8
+ 28 E1 0011FB0C ExInterlockedPopEntrySList = @ExInterlockedPopEntrySList@8
+ 29 E2 001D08F3 ExInterlockedPushEntryList = @ExInterlockedPushEntryList@12
+ 30 E3 0011FB64 ExInterlockedPushEntrySList = @ExInterlockedPushEntrySList@12
+ 31 E4 001D0903 ExInterlockedRemoveHeadList = @ExInterlockedRemoveHeadList@8
+ 357 E5 001D1FE1 ExIsFastResourceContended = _ExIsFastResourceContended@4
+ 358 E6 001D2033 ExIsFastResourceHeld = _ExIsFastResourceHeld@4
+ 359 E7 001D20A5 ExIsFastResourceHeldExclusive = _ExIsFastResourceHeldExclusive@4
+ 360 E8 0035F5DC ExIsManufacturingModeEnabled = _ExIsManufacturingModeEnabled@0
+ 361 E9 000EFB52 ExIsProcessorFeaturePresent = _ExIsProcessorFeaturePresent@4
+ 362 EA 000B0AF2 ExIsResourceAcquiredExclusiveLite = _ExIsResourceAcquiredExclusiveLite@4
+ 363 EB 0005CBB6 ExIsResourceAcquiredSharedLite = _ExIsResourceAcquiredSharedLite@4
+ 364 EC 000F90E0 ExLocalTimeToSystemTime = _ExLocalTimeToSystemTime@8
+ 365 ED 001CFAF4 ExNotifyBootDeviceRemoval = _ExNotifyBootDeviceRemoval@4
+ 366 EE 000DD84A ExNotifyCallback = _ExNotifyCallback@12
+ 367 EF 002FF2E6 ExQueryFastCacheDevLicense
+ 368 F0 001D015E ExQueryPoolBlockSize = _ExQueryPoolBlockSize@8
+ 369 F1 001CF6C6 ExQueryTimerResolution = _ExQueryTimerResolution@12
+ 370 F2 00301CD8 ExQueryWnfStateData = _ExQueryWnfStateData@16
+ 371 F3 0007608A ExQueueWorkItem = _ExQueueWorkItem@8
+ 372 F4 004B7620 ExRaiseAccessViolation = _ExRaiseAccessViolation@0
+ 373 F5 004B7630 ExRaiseDatatypeMisalignment = _ExRaiseDatatypeMisalignment@0
+ 374 F6 001202B0 ExRaiseException = _RtlRaiseException@4
+ 375 F7 004B7640 ExRaiseHardError = _ExRaiseHardError@24
+ 376 F8 00120304 ExRaiseStatus = _RtlRaiseStatus@4
+ 377 F9 00219B5C ExRawInputManagerObjectType = _ExRawInputManagerObjectType
+ 32 FA 000D54D6 ExReInitializeRundownProtection = @ExReInitializeRundownProtection@4
+ 33 FB 00026CA4 ExReInitializeRundownProtectionCacheAware = @ExReInitializeRundownProtectionCacheAware@4
+ 378 FC 000F9490 ExRealTimeIsUniversal = _ExRealTimeIsUniversal@0
+ 379 FD 001CFB3D ExRegisterBootDevice = _ExRegisterBootDevice@8
+ 380 FE 000F74EE ExRegisterCallback = _ExRegisterCallback@12
+ 381 FF 0036AF8A ExRegisterExtension = _ExRegisterExtension@12
+ 382 100 001D211A ExReinitializeFastResource = _ExReinitializeFastResource@4
+ 383 101 000BECB0 ExReinitializeResourceLite = _ExReinitializeResourceLite@4
+ 34 102 000C419A ExReleaseAutoExpandPushLockExclusive = @ExReleaseAutoExpandPushLockExclusive@8
+ 35 103 000B63EC ExReleaseAutoExpandPushLockShared = @ExReleaseAutoExpandPushLockShared@8
+ 384 104 000C67F2 ExReleaseCacheAwarePushLockExclusive = _ExReleaseCacheAwarePushLockExclusive@4
+ 36 105 001D0646 ExReleaseCacheAwarePushLockExclusiveEx = @ExReleaseCacheAwarePushLockExclusiveEx@8
+ 37 106 0005E0AA ExReleaseCacheAwarePushLockSharedEx = @ExReleaseCacheAwarePushLockSharedEx@8
+ 385 107 001D2194 ExReleaseDisownedFastResource = _ExReleaseDisownedFastResource@8
+ 386 108 001D2229 ExReleaseDisownedFastResourceExclusive = _ExReleaseDisownedFastResourceExclusive@8
+ 387 109 001D22CB ExReleaseDisownedFastResourceShared = _ExReleaseDisownedFastResourceShared@8
+ 38 10A 0005E030 ExReleaseFastMutex = @ExReleaseFastMutex@4
+ 39 10B 0002E54E ExReleaseFastMutexUnsafe = @ExReleaseFastMutexUnsafe@4
+ 40 10C 0002E538 ExReleaseFastMutexUnsafeAndLeaveCriticalRegion = @ExReleaseFastMutexUnsafeAndLeaveCriticalRegion@4
+ 388 10D 001D2377 ExReleaseFastResource = _ExReleaseFastResource@8
+ 389 10E 001D241C ExReleaseFastResourceExclusive = _ExReleaseFastResourceExclusive@8
+ 390 10F 001D24CF ExReleaseFastResourceShared = _ExReleaseFastResourceShared@8
+ 41 110 0005E1CC ExReleasePushLockEx = @ExReleasePushLockEx@8
+ 42 111 0005E06C ExReleasePushLockExclusiveEx = @ExReleasePushLockExclusiveEx@8
+ 43 112 00033B6A ExReleasePushLockSharedEx = @ExReleasePushLockSharedEx@8
+ 44 113 0005DF4C ExReleaseResourceAndLeaveCriticalRegion = @ExReleaseResourceAndLeaveCriticalRegion@4
+ 45 114 001D095B ExReleaseResourceAndLeavePriorityRegion = @ExReleaseResourceAndLeavePriorityRegion@4
+ 391 115 000C6DB8 ExReleaseResourceForThreadLite = _ExReleaseResourceForThreadLite@8
+ 46 116 0005E792 ExReleaseResourceLite = @ExReleaseResourceLite@4
+ 47 117 000B7048 ExReleaseRundownProtection = @ExfReleaseRundownProtection@4
+ 48 118 000B9ABE ExReleaseRundownProtectionCacheAware = @ExReleaseRundownProtectionCacheAware@4
+ 49 119 000D666E ExReleaseRundownProtectionCacheAwareEx = @ExReleaseRundownProtectionCacheAwareEx@8
+ 50 11A 001D0863 ExReleaseRundownProtectionEx = @ExReleaseRundownProtectionEx@8
+ 392 11B 000C34A2 ExReleaseSpinLockExclusive = _ExReleaseSpinLockExclusive@8
+ 393 11C 0004D56A ExReleaseSpinLockExclusiveFromDpcLevel = _ExReleaseSpinLockExclusiveFromDpcLevel@4
+ 394 11D 0008D15C ExReleaseSpinLockShared = _ExReleaseSpinLockShared@8
+ 395 11E 00042DF2 ExReleaseSpinLockSharedFromDpcLevel = _ExReleaseSpinLockSharedFromDpcLevel@4
+ 51 11F 000D8772 ExRundownCompleted = @ExRundownCompleted@4
+ 52 120 00026CDA ExRundownCompletedCacheAware = @ExRundownCompletedCacheAware@4
+ 396 121 00219B74 ExSemaphoreObjectType = _ExSemaphoreObjectType
+ 397 122 004B24E7 ExSetFirmwareEnvironmentVariable = _ExSetFirmwareEnvironmentVariable@20
+ 398 123 004B18FE ExSetLicenseTamperState = _ExSetLicenseTamperState@4
+ 399 124 000EF6E2 ExSetResourceOwnerPointer = _ExSetResourceOwnerPointer@8
+ 400 125 000C2F8C ExSetResourceOwnerPointerEx = _ExSetResourceOwnerPointerEx@12
+ 401 126 00078B30 ExSetTimer = _ExSetTimer@24
+ 402 127 001CF6F2 ExSetTimerResolution = _ExSetTimerResolution@8
+ 403 128 001D4402 ExShareAddressSpaceWithDevice = _ExShareAddressSpaceWithDevice@8
+ 404 129 001D0505 ExSizeOfAutoExpandPushLock = _ExSizeOfAutoExpandPushLock@4
+ 405 12A 003746AC ExSizeOfRundownProtectionCacheAware = _ExSizeOfRundownProtectionCacheAware@0
+ 406 12B 00306F0E ExSubscribeWnfStateChange = _ExSubscribeWnfStateChange@24
+ 407 12C 001D4829 ExSvmBeginDeviceReset = _ExSvmBeginDeviceReset@8
+ 408 12D 001D48F4 ExSvmFinalizeDeviceReset = _ExSvmFinalizeDeviceReset@4
+ 409 12E 002FFC70 ExSystemExceptionFilter = _ExSystemExceptionFilter@0
+ 410 12F 000D543A ExSystemTimeToLocalTime = _ExSystemTimeToLocalTime@8
+ 53 130 000B2188 ExTimedWaitForUnblockPushLock = @ExTimedWaitForUnblockPushLock@12
+ 411 131 00219B58 ExTimerObjectType = _ExTimerObjectType
+ 54 132 001D0210 ExTryAcquireAutoExpandPushLockExclusive = @ExTryAcquireAutoExpandPushLockExclusive@8
+ 55 133 001D02B9 ExTryAcquireAutoExpandPushLockShared = @ExTryAcquireAutoExpandPushLockShared@8
+ 56 134 001D06B6 ExTryAcquireCacheAwarePushLockExclusiveEx = @ExTryAcquireCacheAwarePushLockExclusiveEx@8
+ 57 135 001D074C ExTryAcquireCacheAwarePushLockSharedEx = @ExTryAcquireCacheAwarePushLockSharedEx@8
+ 58 136 00028BCA ExTryAcquirePushLockExclusiveEx = @ExTryAcquirePushLockExclusiveEx@8
+ 59 137 000282E4 ExTryAcquirePushLockSharedEx = @ExTryAcquirePushLockSharedEx@8
+ 412 138 000E3A04 ExTryAcquireSpinLockExclusiveAtDpcLevel = _ExTryAcquireSpinLockExclusiveAtDpcLevel@4
+ 413 139 001D3780 ExTryAcquireSpinLockSharedAtDpcLevel = _ExTryAcquireSpinLockSharedAtDpcLevel@4
+ 60 13A 000D4E4E ExTryConvertPushLockSharedToExclusiveEx = @ExTryConvertPushLockSharedToExclusiveEx@8
+ 414 13B 000C1412 ExTryConvertSharedSpinLockExclusive = _ExTryConvertSharedSpinLockExclusive@4
+ 415 13C 0007386C ExTryQueueWorkItem = _ExTryQueueWorkItem@8
+ 61 13D 000283C0 ExTryToAcquireFastMutex = @ExTryToAcquireFastMutex@4
+ 416 13E 001D0A46 ExTryToAcquireResourceExclusiveLite = _ExTryToAcquireResourceExclusiveLite@4
+ 417 13F 001D258C ExTryToConvertFastResourceSharedToExclusive = _ExTryToConvertFastResourceSharedToExclusive@8
+ 62 140 001D07DC ExUnblockOnAddressPushLockEx = @ExUnblockOnAddressPushLockEx@8
+ 63 141 000C2D3C ExUnblockPushLockEx = @ExUnblockPushLockEx@8
+ 418 142 000F938C ExUnregisterCallback = _ExUnregisterCallback@4
+ 419 143 004B77D3 ExUnregisterExtension = _ExUnregisterExtension@4
+ 420 144 0025716A ExUnsubscribeWnfStateChange = _ExUnsubscribeWnfStateChange@4
+ 421 145 004B1AAA ExUpdateLicenseData = _ExUpdateLicenseData@8
+ 422 146 00322490 ExUuidCreate = _ExUuidCreate@4
+ 423 147 00103E54 ExVerifySuite = _ExVerifySuite@4
+ 64 148 00032E3C ExWaitForRundownProtectionRelease = @ExWaitForRundownProtectionRelease@4
+ 65 149 00026B44 ExWaitForRundownProtectionReleaseCacheAware = @ExWaitForRundownProtectionReleaseCacheAware@4
+ 66 14A 001D0815 ExWaitForUnblockPushLock = @ExWaitForUnblockPushLock@8
+ 424 14B 00219B6C ExWindowStationObjectType = _ExWindowStationObjectType
+ 67 14C 00028ED8 ExfAcquirePushLockExclusive = @ExfAcquirePushLockExclusive@4
+ 68 14D 00028D2C ExfAcquirePushLockShared = @ExfAcquirePushLockShared@4
+ 69 14E 000EF2EE ExfInterlockedAddUlong = @ExfInterlockedAddUlong@12
+ 70 14F 00120264 ExfInterlockedCompareExchange64 = @ExfInterlockedCompareExchange64@12
+ 71 150 000C4304 ExfInterlockedInsertHeadList = @ExfInterlockedInsertHeadList@12
+ 72 151 000C4354 ExfInterlockedInsertTailList = @ExfInterlockedInsertTailList@12
+ 73 152 001D0CFC ExfInterlockedPopEntryList = @ExfInterlockedPopEntryList@8
+ 74 153 001D0D29 ExfInterlockedPushEntryList = @ExfInterlockedPushEntryList@12
+ 75 154 000C43A4 ExfInterlockedRemoveHeadList = @ExfInterlockedRemoveHeadList@8
+ 76 155 00033BAC ExfReleasePushLock = @ExfReleasePushLock@4
+ 77 156 00033C60 ExfReleasePushLockExclusive = @ExfReleasePushLockExclusive@4
+ 78 157 00033BC6 ExfReleasePushLockShared = @ExfReleasePushLockShared@4
+ 79 158 00028346 ExfTryAcquirePushLockShared = @ExfTryAcquirePushLockShared@4
+ 80 159 00033D90 ExfTryToWakePushLock = @ExfTryToWakePushLock@4
+ 81 15A 00119EC6 ExfUnblockPushLock = @ExfUnblockPushLock@8
+ 82 15B 001D090D Exfi386InterlockedDecrementLong = @Exfi386InterlockedDecrementLong@4
+ 83 15C 001D092F Exfi386InterlockedExchangeUlong = @Exfi386InterlockedExchangeUlong@8
+ 84 15D 001D0939 Exfi386InterlockedIncrementLong = @Exfi386InterlockedIncrementLong@4
+ 425 15E 001D0DA2 Exi386InterlockedDecrementLong = _ExInterlockedDecrementLong@8
+ 426 15F 001D0DB8 Exi386InterlockedExchangeUlong = _ExInterlockedExchangeUlong@12
+ 427 160 001D0DCE Exi386InterlockedIncrementLong = _ExInterlockedIncrementLong@8
+ 85 161 0005DFE2 ExiAcquireFastMutex = @ExAcquireFastMutex@4
+ 86 162 0005E030 ExiReleaseFastMutex = @ExReleaseFastMutex@4
+ 87 163 000283C0 ExiTryToAcquireFastMutex = @ExTryToAcquireFastMutex@4
+ 428 164 0011FBAC FirstEntrySList = _FirstEntrySList@4
+ 429 165 003077A8 FsRtlAcknowledgeEcp = _FsRtlAcknowledgeEcp@4
+ 430 166 000B5B98 FsRtlAcquireEofLock = _FsRtlAcquireEofLock@8
+ 431 167 002A4A82 FsRtlAcquireFileExclusive = _FsRtlAcquireFileExclusive@4
+ 432 168 0005C91A FsRtlAcquireHeaderMutex = _FsRtlAcquireHeaderMutex@8
+ 433 169 000B479A FsRtlAddBaseMcbEntry = _FsRtlAddBaseMcbEntry@28
+ 434 16A 000B47C8 FsRtlAddBaseMcbEntryEx = _FsRtlAddBaseMcbEntryEx@28
+ 435 16B 000B426A FsRtlAddLargeMcbEntry = _FsRtlAddLargeMcbEntry@28
+ 436 16C 001737B6 FsRtlAddMcbEntry = _FsRtlAddMcbEntry@16
+ 437 16D 0026D666 FsRtlAddToTunnelCache = _FsRtlAddToTunnelCache@32
+ 438 16E 00281718 FsRtlAllocateExtraCreateParameter = _FsRtlAllocateExtraCreateParameter@24
+ 439 16F 0028ADDE FsRtlAllocateExtraCreateParameterFromLookasideList = _FsRtlAllocateExtraCreateParameterFromLookasideList@24
+ 440 170 0028AD88 FsRtlAllocateExtraCreateParameterList = _FsRtlAllocateExtraCreateParameterList@8
+ 441 171 000D4930 FsRtlAllocateFileLock = _FsRtlAllocateFileLock@8
+ 442 172 001742F9 FsRtlAllocatePool = _FsRtlAllocatePool@8
+ 443 173 00174325 FsRtlAllocatePoolWithQuota = _FsRtlAllocatePoolWithQuota@8
+ 444 174 00174351 FsRtlAllocatePoolWithQuotaTag = _FsRtlAllocatePoolWithQuotaTag@12
+ 445 175 0017437B FsRtlAllocatePoolWithTag = _FsRtlAllocatePoolWithTag@12
+ 446 176 00424E0F FsRtlAllocateResource = _FsRtlAllocateResource@0
+ 447 177 000AE14C FsRtlAreNamesEqual = _RtlAreNamesEqual@16
+ 448 178 00173CCB FsRtlAreThereCurrentOrInProgressFileLocks = _FsRtlAreThereCurrentOrInProgressFileLocks@4
+ 449 179 00173CF6 FsRtlAreThereWaitingFileLocks = _FsRtlAreThereWaitingFileLocks@4
+ 450 17A 003077BE FsRtlAreVolumeStartupApplicationsComplete = _FsRtlAreVolumeStartupApplicationsComplete@0
+ 451 17B 003329CC FsRtlBalanceReads = _FsRtlBalanceReads@4
+ 452 17C 0025072C FsRtlCancellableWaitForMultipleObjects = _FsRtlCancellableWaitForMultipleObjects@24
+ 453 17D 0024FF04 FsRtlCancellableWaitForSingleObject = _FsRtlCancellableWaitForSingleObject@12
+ 454 17E 000CD594 FsRtlChangeBackingFileObject = _FsRtlChangeBackingFileObject@16
+ 455 17F 000D28AC FsRtlCheckLockForOplockRequest = _FsRtlCheckLockForOplockRequest@8
+ 456 180 000BA982 FsRtlCheckLockForReadAccess = _FsRtlCheckLockForReadAccess@8
+ 457 181 000BA6FA FsRtlCheckLockForWriteAccess = _FsRtlCheckLockForWriteAccess@8
+ 458 182 000578A0 FsRtlCheckOplock = _FsRtlCheckOplock@20
+ 459 183 0005790E FsRtlCheckOplockEx = _FsRtlCheckOplockEx@24
+ 460 184 00307A3C FsRtlCheckUpperOplock = _FsRtlCheckUpperOplock@24
+ 461 185 00424E68 FsRtlCopyRead = _FsRtlCopyRead@32
+ 462 186 0042508A FsRtlCopyWrite = _FsRtlCopyWrite@32
+ 463 187 000C482E FsRtlCreateSectionForDataScan = _FsRtlCreateSectionForDataScan@40
+ 464 188 002EACEA FsRtlCurrentBatchOplock = _FsRtlCurrentBatchOplock@4
+ 465 189 001743A5 FsRtlCurrentOplock = _FsRtlCurrentOplock@4
+ 466 18A 00425F2E FsRtlCurrentOplockH = _FsRtlCurrentOplockH@4
+ 467 18B 00424E30 FsRtlDeleteExtraCreateParameterLookasideList = _FsRtlDeleteExtraCreateParameterLookasideList@8
+ 468 18C 002E3016 FsRtlDeleteKeyFromTunnelCache = _FsRtlDeleteKeyFromTunnelCache@12
+ 469 18D 0032F710 FsRtlDeleteTunnelCache = _FsRtlDeleteTunnelCache@4
+ 470 18E 00425E22 FsRtlDeregisterUncProvider = _FsRtlDeregisterUncProvider@4
+ 471 18F 00330614 FsRtlDismountComplete = _FsRtlDismountComplete@8
+ 472 190 004264EA FsRtlDissectDbcs = _FsRtlDissectDbcs@16
+ 473 191 000AEE7A FsRtlDissectName = _RtlDissectName@16
+ 474 192 0042658B FsRtlDoesDbcsContainWildCards = _FsRtlDoesDbcsContainWildCards@4
+ 475 193 000AD75A FsRtlDoesNameContainWildCards = _RtlDoesNameContainWildCards@4
+ 476 194 000BAA0C FsRtlFastCheckLockForRead = _FsRtlFastCheckLockForRead@24
+ 477 195 000BA78A FsRtlFastCheckLockForWrite = _FsRtlFastCheckLockForWrite@24
+ 478 196 000BC78C FsRtlFastUnlockAll = _FsRtlFastUnlockAll@16
+ 479 197 00173E1A FsRtlFastUnlockAllByKey = _FsRtlFastUnlockAllByKey@20
+ 480 198 0007D7F6 FsRtlFastUnlockSingle = _FsRtlFastUnlockSingle@32
+ 481 199 00288740 FsRtlFindExtraCreateParameter = _FsRtlFindExtraCreateParameter@16
+ 482 19A 0026B8AC FsRtlFindInTunnelCache = _FsRtlFindInTunnelCache@32
+ 483 19B 00288F48 FsRtlFreeExtraCreateParameter = _FsRtlFreeExtraCreateParameter@4
+ 484 19C 00288EEC FsRtlFreeExtraCreateParameterList = _FsRtlFreeExtraCreateParameterList@4
+ 485 19D 000D40F2 FsRtlFreeFileLock = _FsRtlFreeFileLock@4
+ 486 19E 00287B5C FsRtlGetEcpListFromIrp = _FsRtlGetEcpListFromIrp@8
+ 487 19F 00301E9E FsRtlGetFileNameInformation = _FsRtlGetFileNameInformation@16
+ 488 1A0 002A548E FsRtlGetFileSize = _FsRtlGetFileSize@8
+ 489 1A1 000B5B28 FsRtlGetIoAtEof = _FsRtlGetIoAtEof@32
+ 490 1A2 000C083A FsRtlGetNextBaseMcbEntry = _FsRtlGetNextBaseMcbEntry@20
+ 491 1A3 00301AF8 FsRtlGetNextExtraCreateParameter = _FsRtlGetNextExtraCreateParameter@20
+ 492 1A4 00173EB1 FsRtlGetNextFileLock = _FsRtlGetNextFileLock@8
+ 493 1A5 001737DA FsRtlGetNextLargeMcbEntry = _FsRtlGetNextLargeMcbEntry@20
+ 494 1A6 00173816 FsRtlGetNextMcbEntry = _FsRtlGetNextMcbEntry@20
+ 495 1A7 00331A84 FsRtlGetSectorSizeInformation = _FsRtlGetSectorSizeInformation@8
+ 496 1A8 000D51DE FsRtlGetSupportedFeatures = _FsRtlGetSupportedFeatures@8
+ 497 1A9 000E6CAA FsRtlGetVirtualDiskNestingLevel = _FsRtlGetVirtualDiskNestingLevel@12
+ 498 1AA 00426C7B FsRtlHeatInit = _FsRtlHeatInit@12
+ 499 1AB 00426DA7 FsRtlHeatLogIo = _FsRtlHeatLogIo@20
+ 500 1AC 00426E6B FsRtlHeatLogTierMove = _FsRtlHeatLogTierMove@32
+ 501 1AD 00426EB0 FsRtlHeatUninit = _FsRtlHeatUninit@8
+ 502 1AE 00173728 FsRtlIncrementCcFastMdlReadWait = _FsRtlIncrementCcFastMdlReadWait@0
+ 503 1AF 00173735 FsRtlIncrementCcFastReadNoWait = _FsRtlIncrementCcFastReadNoWait@0
+ 504 1B0 0030156E FsRtlIncrementCcFastReadNotPossible = _FsRtlIncrementCcFastReadNotPossible@0
+ 505 1B1 00173742 FsRtlIncrementCcFastReadResourceMiss = _FsRtlIncrementCcFastReadResourceMiss@0
+ 506 1B2 002EE8F8 FsRtlIncrementCcFastReadWait = _FsRtlIncrementCcFastReadWait@0
+ 507 1B3 00374634 FsRtlInitExtraCreateParameterLookasideList = _FsRtlInitExtraCreateParameterLookasideList@16
+ 508 1B4 000C9202 FsRtlInitializeBaseMcb = _FsRtlInitializeBaseMcb@8
+ 509 1B5 000C921E FsRtlInitializeBaseMcbEx = _FsRtlInitializeBaseMcbEx@12
+ 510 1B6 000C47B8 FsRtlInitializeEofLock = _FsRtlInitializeEofLock@8
+ 511 1B7 00330400 FsRtlInitializeExtraCreateParameter = _FsRtlInitializeExtraCreateParameter@24
+ 512 1B8 0033058A FsRtlInitializeExtraCreateParameterList = _FsRtlInitializeExtraCreateParameterList@4
+ 513 1B9 000D57BA FsRtlInitializeFileLock = _FsRtlInitializeFileLock@12
+ 514 1BA 000C91B4 FsRtlInitializeLargeMcb = _FsRtlInitializeLargeMcb@8
+ 515 1BB 00425E0E FsRtlInitializeMcb = _FsRtlInitializeMcb@8
+ 516 1BC 0032D3A2 FsRtlInitializeOplock = _AlpcConnectionDeleteProcedure@4
+ 517 1BD 003327E6 FsRtlInitializeTunnelCache = _FsRtlInitializeTunnelCache@4
+ 518 1BE 002886EA FsRtlInsertExtraCreateParameter = _FsRtlInsertExtraCreateParameter@8
+ 519 1BF 001753C9 FsRtlInsertPerFileContext = _FsRtlInsertPerFileContext@8
+ 520 1C0 000BE9E0 FsRtlInsertPerFileObjectContext = _FsRtlInsertPerFileObjectContext@8
+ 521 1C1 001753E4 FsRtlInsertPerStreamContext = _FsRtlInsertPerStreamContext@8
+ 522 1C2 000CF2CA FsRtlInsertReservedPerFileContext = _FsRtlInsertReservedPerFileContext@8
+ 523 1C3 000C886A FsRtlInsertReservedPerStreamContext = _FsRtlInsertReservedPerStreamContext@8
+ 524 1C4 0017374F FsRtlIsDaxVolume = _FsRtlIsDaxVolume@4
+ 525 1C5 004265FB FsRtlIsDbcsInExpression = _FsRtlIsDbcsInExpression@8
+ 526 1C6 002EF952 FsRtlIsEcpAcknowledged = _FsRtlIsEcpAcknowledged@4
+ 527 1C7 002EEFD6 FsRtlIsEcpFromUserMode = _FsRtlIsEcpFromUserMode@4
+ 528 1C8 00426362 FsRtlIsExtentDangling = _FsRtlIsExtentDangling@12
+ 529 1C9 002F339E FsRtlIsFatDbcsLegal = _FsRtlIsFatDbcsLegal@20
+ 530 1CA 00426AF4 FsRtlIsHpfsDbcsLegal = _FsRtlIsHpfsDbcsLegal@20
+ 531 1CB 00332B4C FsRtlIsMobileOS = _FsRtlIsMobileOS@0
+ 532 1CC 000AD326 FsRtlIsNameInExpression = _RtlIsNameInExpression@16
+ 533 1CD 000D3820 FsRtlIsNonEmptyDirectoryReparsePointAllowed = _FsRtlIsNonEmptyDirectoryReparsePointAllowed@4
+ 534 1CE 000CEC84 FsRtlIsNtstatusExpected = _FsRtlIsNtstatusExpected@4
+ 535 1CF 000BE958 FsRtlIsPagingFile = _FsRtlIsPagingFile@4
+ 536 1D0 000E4328 FsRtlIsSystemPagingFile = _FsRtlIsSystemPagingFile@4
+ 537 1D1 000C774E FsRtlIsTotalDeviceFailure = _FsRtlIsTotalDeviceFailure@4
+ 538 1D2 00331DD8 FsRtlIssueDeviceIoControl = _FsRtlIssueDeviceIoControl@32
+ 539 1D3 002510DC FsRtlKernelFsControlFile = _FsRtlKernelFsControlFile@28
+ 540 1D4 00004480 FsRtlLegalAnsiCharacterArray = _FsRtlLegalAnsiCharacterArray
+ 541 1D5 00425588 FsRtlLogCcFlushError = _FsRtlLogCcFlushError@20
+ 542 1D6 000B4BAE FsRtlLookupBaseMcbEntry = _FsRtlLookupBaseMcbEntry@32
+ 543 1D7 0017386A FsRtlLookupLargeMcbEntry = _FsRtlLookupLargeMcbEntry@32
+ 544 1D8 000C3A50 FsRtlLookupLastBaseMcbEntry = _FsRtlLookupLastBaseMcbEntry@12
+ 545 1D9 000CF1F8 FsRtlLookupLastBaseMcbEntryAndIndex = _FsRtlLookupLastBaseMcbEntryAndIndex@16
+ 546 1DA 001738D4 FsRtlLookupLastLargeMcbEntry = _FsRtlLookupLastLargeMcbEntry@12
+ 547 1DB 0017392F FsRtlLookupLastLargeMcbEntryAndIndex = _FsRtlLookupLastLargeMcbEntryAndIndex@16
+ 548 1DC 0017398D FsRtlLookupLastMcbEntry = _FsRtlLookupLastMcbEntry@12
+ 549 1DD 001739D2 FsRtlLookupMcbEntry = _FsRtlLookupMcbEntry@20
+ 550 1DE 00175479 FsRtlLookupPerFileContext = _FsRtlLookupPerFileContext@12
+ 551 1DF 00057E9C FsRtlLookupPerFileObjectContext = _FsRtlLookupPerFileObjectContext@12
+ 552 1E0 0017550C FsRtlLookupPerStreamContextInternal = _FsRtlLookupPerStreamContextInternal@12
+ 553 1E1 000BBEAA FsRtlLookupReservedPerFileContext = _FsRtlLookupReservedPerFileContext@12
+ 554 1E2 000AF386 FsRtlLookupReservedPerStreamContext = _FsRtlLookupReservedPerStreamContext@12
+ 555 1E3 00305F1A FsRtlMdlRead = _FsRtlMdlRead@24
+ 556 1E4 0017377D FsRtlMdlReadComplete = _FsRtlMdlReadComplete@8
+ 557 1E5 00086A00 FsRtlMdlReadCompleteDev = _FsRtlMdlReadCompleteDev@12
+ 558 1E6 004257B1 FsRtlMdlReadDev = _FsRtlMdlReadDev@28
+ 559 1E7 00305EE0 FsRtlMdlReadEx = _FsRtlMdlReadEx@24
+ 560 1E8 00425932 FsRtlMdlWriteComplete = _FsRtlMdlWriteComplete@12
+ 561 1E9 00304028 FsRtlMdlWriteCompleteDev = _FsRtlMdlWriteCompleteDev@16
+ 562 1EA 00425E6B FsRtlMupGetProviderIdFromName = _FsRtlMupGetProviderIdFromName@8
+ 563 1EB 00425E8B FsRtlMupGetProviderInfoFromFileObject = _FsRtlMupGetProviderInfoFromFileObject@16
+ 564 1EC 000E5510 FsRtlNormalizeNtstatus = _FsRtlNormalizeNtstatus@8
+ 565 1ED 0042738B FsRtlNotifyChangeDirectory = _FsRtlNotifyChangeDirectory@28
+ 566 1EE 002EAE34 FsRtlNotifyCleanup = _FsRtlNotifyCleanup@12
+ 567 1EF 004273BA FsRtlNotifyCleanupAll = _FsRtlNotifyCleanupAll@8
+ 568 1F0 0033487A FsRtlNotifyFilterChangeDirectory = _FsRtlNotifyFilterChangeDirectory@44
+ 569 1F1 002EB27E FsRtlNotifyFilterChangeDirectoryLite = _FsRtlNotifyFilterChangeDirectoryLite@36
+ 570 1F2 0033449E FsRtlNotifyFilterReportChange = _FsRtlNotifyFilterReportChange@40
+ 571 1F3 002EAEB4 FsRtlNotifyFilterReportChangeLite = _FsRtlNotifyFilterReportChangeLite@36
+ 572 1F4 00427448 FsRtlNotifyFullChangeDirectory = _FsRtlNotifyFullChangeDirectory@40
+ 573 1F5 0042747B FsRtlNotifyFullReportChange = _FsRtlNotifyFullReportChange@36
+ 574 1F6 002EB546 FsRtlNotifyInitializeSync = _FsRtlNotifyInitializeSync@4
+ 575 1F7 004274AB FsRtlNotifyReportChange = _FsRtlNotifyReportChange@20
+ 576 1F8 00306B36 FsRtlNotifyUninitializeSync = _FsRtlNotifyUninitializeSync@4
+ 577 1F9 0032F6B8 FsRtlNotifyVolumeEvent = _FsRtlNotifyVolumeEvent@8
+ 578 1FA 0030BD6C FsRtlNotifyVolumeEventEx = _FsRtlNotifyVolumeEventEx@12
+ 579 1FB 000CBF44 FsRtlNumberOfRunsInBaseMcb = _FsRtlNumberOfRunsInBaseMcb@4
+ 580 1FC 00173A31 FsRtlNumberOfRunsInLargeMcb = _FsRtlNumberOfRunsInLargeMcb@4
+ 581 1FD 00173A59 FsRtlNumberOfRunsInMcb = _FsRtlNumberOfRunsInMcb@4
+ 582 1FE 002ED656 FsRtlOplockBreakH = _FsRtlOplockBreakH@24
+ 583 1FF 001743CB FsRtlOplockBreakToNone = _FsRtlOplockBreakToNone@24
+ 584 200 00174416 FsRtlOplockBreakToNoneEx = _FsRtlOplockBreakToNoneEx@24
+ 585 201 0027F6A4 FsRtlOplockFsctrl = _FsRtlOplockFsctrl@12
+ 586 202 0027F1C8 FsRtlOplockFsctrlEx = _FsRtlOplockFsctrlEx@16
+ 587 203 002E57F2 FsRtlOplockIsFastIoPossible = _FsRtlOplockIsFastIoPossible@4
+ 588 204 002F11F2 FsRtlOplockIsSharedRequest = _FsRtlOplockIsSharedRequest@4
+ 589 205 000C52D8 FsRtlOplockKeysEqual = _FsRtlOplockKeysEqual@8
+ 590 206 001757C8 FsRtlPostPagingFileStackOverflow = _FsRtlPostPagingFileStackOverflow@12
+ 591 207 001757E6 FsRtlPostStackOverflow = _FsRtlPostStackOverflow@12
+ 592 208 00305E9A FsRtlPrepareMdlWrite = _FsRtlPrepareMdlWrite@24
+ 593 209 0042596E FsRtlPrepareMdlWriteDev = _FsRtlPrepareMdlWriteDev@28
+ 594 20A 00305E60 FsRtlPrepareMdlWriteEx = _FsRtlPrepareMdlWriteEx@24
+ 595 20B 00424E53 FsRtlPrepareToReuseEcp = _FsRtlPrepareToReuseEcp@4
+ 596 20C 0007DD78 FsRtlPrivateLock = _FsRtlPrivateLock@48
+ 597 20D 000BA8B2 FsRtlProcessFileLock = _FsRtlProcessFileLock@12
+ 598 20E 0032EFBC FsRtlQueryCachedVdl = _FsRtlQueryCachedVdl@8
+ 599 20F 00426380 FsRtlQueryInformationFile = _FsRtlQueryInformationFile@20
+ 600 210 00250600 FsRtlQueryKernelEaFile = _FsRtlQueryKernelEaFile@36
+ 601 211 001075EE FsRtlQueryMaximumVirtualDiskNestingLevel = _FsRtlQueryMaximumVirtualDiskNestingLevel@0
+ 602 212 00106D00 FsRtlRegisterFileSystemFilterCallbacks = _FsRtlRegisterFileSystemFilterCallbacks@8
+ 603 213 00378CD6 FsRtlRegisterFltMgrCalls = _FsRtlRegisterFltMgrCalls@4
+ 604 214 00378CBE FsRtlRegisterMupCalls = _FsRtlRegisterMupCalls@4
+ 605 215 00425EAA FsRtlRegisterUncProvider = _FsRtlRegisterUncProvider@12
+ 607 216 00425EF0 FsRtlRegisterUncProviderEx = _FsRtlRegisterUncProviderEx@16
+ 606 217 003716A2 FsRtlRegisterUncProviderEx2 = _FsRtlRegisterUncProviderEx2@16
+ 608 218 000B0EA4 FsRtlReleaseEofLock = _FsRtlReleaseEofLock@8
+ 609 219 002A4C38 FsRtlReleaseFile = _FsRtlReleaseFile@4
+ 610 21A 00304B74 FsRtlReleaseFileNameInformation = _FsRtlReleaseFileNameInformation@4
+ 611 21B 0005C942 FsRtlReleaseHeaderMutex = _FsRtlReleaseHeaderMutex@8
+ 612 21C 000B43C6 FsRtlRemoveBaseMcbEntry = _FsRtlRemoveBaseMcbEntry@20
+ 613 21D 00427175 FsRtlRemoveDotsFromPath = _FsRtlRemoveDotsFromPath@12
+ 614 21E 00288668 FsRtlRemoveExtraCreateParameter = _FsRtlRemoveExtraCreateParameter@16
+ 615 21F 00173A69 FsRtlRemoveLargeMcbEntry = _FsRtlRemoveLargeMcbEntry@20
+ 616 220 00173AB9 FsRtlRemoveMcbEntry = _FsRtlRemoveMcbEntry@12
+ 617 221 001755C9 FsRtlRemovePerFileContext = _FsRtlRemovePerFileContext@12
+ 618 222 000C04C0 FsRtlRemovePerFileObjectContext = _FsRtlRemovePerFileObjectContext@12
+ 619 223 00175680 FsRtlRemovePerStreamContext = _FsRtlRemovePerStreamContext@12
+ 620 224 0017576F FsRtlRemoveReservedPerFileContext = _FsRtlRemoveReservedPerFileContext@12
+ 621 225 00175795 FsRtlRemoveReservedPerStreamContext = _FsRtlRemoveReservedPerStreamContext@12
+ 622 226 000D4AF0 FsRtlResetBaseMcb = _FsRtlResetBaseMcb@4
+ 623 227 00173AD9 FsRtlResetLargeMcb = _FsRtlResetLargeMcb@8
+ 624 228 000D3FDE FsRtlSendModernAppTermination = _FsRtlSendModernAppTermination@12
+ 625 229 0036075C FsRtlSetDriverBacking = _FsRtlSetDriverBacking@8
+ 626 22A 002E3F8C FsRtlSetEcpListIntoIrp = _FsRtlSetEcpListIntoIrp@8
+ 627 22B 0024FF28 FsRtlSetKernelEaFile = _FsRtlSetKernelEaFile@12
+ 628 22C 00173B0D FsRtlSplitBaseMcb = _FsRtlSplitBaseMcb@20
+ 629 22D 00173C4F FsRtlSplitLargeMcb = _FsRtlSplitLargeMcb@20
+ 630 22E 002FEF56 FsRtlSyncVolumes = _FsRtlSyncVolumes@12
+ 631 22F 002EF96C FsRtlTeardownPerFileContexts = _FsRtlTeardownPerFileContexts@4
+ 632 230 0030C2FE FsRtlTeardownPerStreamContexts = _FsRtlTeardownPerStreamContexts@4
+ 633 231 000B42FC FsRtlTruncateBaseMcb = _FsRtlTruncateBaseMcb@12
+ 634 232 000B42CC FsRtlTruncateLargeMcb = _FsRtlTruncateLargeMcb@12
+ 635 233 00173CB0 FsRtlTruncateMcb = _FsRtlTruncateMcb@8
+ 636 234 0002838A FsRtlTryToAcquireHeaderMutex = _FsRtlTryToAcquireHeaderMutex@8
+ 637 235 000BF386 FsRtlUninitializeBaseMcb = _FsRtlUninitializeBaseMcb@4
+ 638 236 000D4116 FsRtlUninitializeFileLock = _FsRtlUninitializeFileLock@4
+ 639 237 000BF356 FsRtlUninitializeLargeMcb = _FsRtlUninitializeLargeMcb@4
+ 640 238 00425E18 FsRtlUninitializeMcb = _FsRtlUninitializeMcb@4
+ 641 239 000C6946 FsRtlUninitializeOplock = _FsRtlUninitializeOplock@4
+ 642 23A 000C137E FsRtlUpdateDiskCounters = _FsRtlUpdateDiskCounters@16
+ 643 23B 00425F54 FsRtlUpperOplockFsctrl = _FsRtlUpperOplockFsctrl@20
+ 644 23C 000D5AC4 FsRtlValidateReparsePointBuffer = _FsRtlValidateReparsePointBuffer@8
+ 645 23D 00331A20 FsRtlVolumeDeviceToCorrelationId = _FsRtlVolumeDeviceToCorrelationId@8
+ 646 23E 001EEFD0 HalDispatchTable = _HalDispatchTable
+ 88 23F 00378CFE HalExamineMBR = @HalExamineMBR@16
+ 647 240 001EF508 HalPrivateDispatchTable = _HalPrivateDispatchTable
+ 648 241 000FCB96 HeadlessDispatch = _HeadlessDispatch@20
+ 649 242 001D7816 HviGetDebugDeviceOptions = _HviGetDebugDeviceOptions@4
+ 650 243 001D7848 HviGetEnlightenmentInformation = _HviGetEnlightenmentInformation@4
+ 651 244 001D7890 HviGetHardwareFeatures = _HviGetHardwareFeatures@4
+ 652 245 00107B2A HviGetHypervisorFeatures = _HviGetHypervisorFeatures@4
+ 653 246 00107B90 HviGetHypervisorInterface = _HviGetHypervisorInterface@4
+ 654 247 001D78F5 HviGetHypervisorVendorAndMaxFunction = _HviGetHypervisorVendorAndMaxFunction@4
+ 655 248 001D793D HviGetHypervisorVersion = _HviGetHypervisorVersion@4
+ 656 249 001D7985 HviGetImplementationLimits = _HviGetImplementationLimits@4
+ 657 24A 000F803C HviIsAnyHypervisorPresent = _HviIsAnyHypervisorPresent@0
+ 658 24B 00107B56 HviIsHypervisorMicrosoftCompatible = _HviIsHypervisorMicrosoftCompatible@0
+ 659 24C 001D79CD HviIsHypervisorVendorMicrosoft = _HviIsHypervisorVendorMicrosoft@0
+ 660 24D 001D7A3D HviIsIommuInUse = _HviIsIommuInUse@0
+ 661 24E 00175B0E HvlGetLpIndexFromApicId = _HvlGetLpIndexFromApicId@4
+ 662 24F 0011775C HvlInvokeHypercall = _HvcallInitiateHypercall@24
+ 663 250 00175B60 HvlQueryActiveHypervisorProcessorCount = _HvlQueryActiveHypervisorProcessorCount@4
+ 664 251 00175B8A HvlQueryActiveProcessors = _HvlQueryActiveProcessors@8
+ 665 252 000D58BC HvlQueryConnection = _HvlQueryConnection@4
+ 666 253 00175BF8 HvlQueryHypervisorProcessorNodeNumber = _HvlQueryHypervisorProcessorNodeNumber@8
+ 667 254 00175C36 HvlQueryNumaDistance = _HvlQueryNumaDistance@12
+ 668 255 00175D08 HvlQueryProcessorTopology = _HvlQueryProcessorTopology@16
+ 669 256 00175D29 HvlQueryProcessorTopologyCount = _HvlQueryProcessorTopologyCount@8
+ 670 257 00175D65 HvlQueryProcessorTopologyEx = _HvlQueryProcessorTopologyEx@20
+ 671 258 00175DDE HvlQueryProcessorTopologyHighestId = _HvlQueryProcessorTopologyHighestId@8
+ 672 259 001772E3 HvlReadPerformanceStateCounters = _HvlReadPerformanceStateCounters@16
+ 673 25A 001759EB HvlRegisterInterruptCallback = _HvlRegisterInterruptCallback@12
+ 674 25B 00427B3E HvlRegisterWheaErrorNotification = _HvlRegisterWheaErrorNotification@4
+ 675 25C 00175A49 HvlUnregisterInterruptCallback = _HvlUnregisterInterruptCallback@8
+ 676 25D 00427B98 HvlUnregisterWheaErrorNotification = _HvlUnregisterWheaErrorNotification@4
+ 677 25E 001793B2 InbvAcquireDisplayOwnership = _InbvAcquireDisplayOwnership@0
+ 678 25F 001793FD InbvCheckDisplayOwnership = _InbvCheckDisplayOwnership@0
+ 679 260 000FC87A InbvDisplayString = _InbvDisplayString@4
+ 680 261 00179417 InbvEnableBootDriver = _InbvEnableBootDriver@4
+ 681 262 001088E2 InbvEnableDisplayString = _InbvEnableDisplayString@4
+ 682 263 001088FE InbvInstallDisplayStringFilter = _InbvInstallDisplayStringFilter@4
+ 683 264 000FC1F4 InbvIsBootDriverInstalled = _InbvIsBootDriverInstalled@0
+ 684 265 000EFB7E InbvNotifyDisplayOwnershipChange = _InbvNotifyDisplayOwnershipChange@8
+ 685 266 00179465 InbvNotifyDisplayOwnershipLost = _InbvNotifyDisplayOwnershipLost@4
+ 686 267 00179498 InbvResetDisplay = _InbvResetDisplay@0
+ 687 268 001794B2 InbvSetScrollRegion = _InbvSetScrollRegion@16
+ 688 269 001794D3 InbvSetTextColor = _InbvSetTextColor@4
+ 689 26A 001072BE InbvSetVirtualFrameBuffer = _InbvSetVirtualFrameBuffer@8
+ 690 26B 001794F7 InbvSolidColorFill = _InbvSolidColorFill@20
+ 691 26C 00204EA8 InitSafeBootMode = _InitSafeBootMode
+ 89 26D 00120258 InterlockedCompareExchange = @__InterlockedCompareExchange@12
+ 90 26E 0012024C InterlockedDecrement = @__InterlockedDecrement@4
+ 91 26F 001D092F InterlockedExchange = @Exfi386InterlockedExchangeUlong@8
+ 92 270 0012029C InterlockedExchangeAdd = @__InterlockedExchangeAdd@8
+ 93 271 00120240 InterlockedIncrement = @__InterlockedIncrement@4
+ 94 272 0011FB0C InterlockedPopEntrySList = @ExInterlockedPopEntrySList@8
+ 95 273 0011FB68 InterlockedPushEntrySList = @InterlockedPushEntrySList@8
+ 96 274 0011FB84 InterlockedPushListSList = @InterlockedPushListSList@16
+ 692 275 0002F9DC IoAcquireCancelSpinLock = _IoAcquireCancelSpinLock@4
+ 693 276 000E2682 IoAcquireRemoveLockEx = _IoAcquireRemoveLockEx@20
+ 694 277 000D659E IoAcquireVpbSpinLock = _IoAcquireVpbSpinLock@4
+ 695 278 00225EA0 IoAdapterObjectType = _IoAdapterObjectType
+ 696 279 00179F67 IoAdjustStackSizeForRedirection = _IoAdjustStackSizeForRedirection@12
+ 697 27A 0017A040 IoAllocateAdapterChannel = _IoAllocateAdapterChannel@20
+ 698 27B 000F88A0 IoAllocateController = _IoAllocateController@16
+ 699 27C 000D4962 IoAllocateDriverObjectExtension = _IoAllocateDriverObjectExtension@16
+ 700 27D 000F816E IoAllocateErrorLogEntry = _IoAllocateErrorLogEntry@8
+ 701 27E 0006CC54 IoAllocateIrp = _IoAllocateIrp@8
+ 702 27F 00057516 IoAllocateIrpEx = _IoAllocateIrpEx@12
+ 703 280 000A1B04 IoAllocateMdl = _IoAllocateMdl@20
+ 704 281 002D38EE IoAllocateMiniCompletionPacket = _IoAllocateMiniCompletionPacket@8
+ 705 282 0017A082 IoAllocateSfioStreamIdentifier = _IoAllocateSfioStreamIdentifier@16
+ 706 283 000C66DE IoAllocateWorkItem = _IoAllocateWorkItem@4
+ 707 284 000CC872 IoApplyPriorityInfoThread = _IoApplyPriorityInfoThread@12
+ 708 285 0042EDCA IoAssignResources = _IoAssignResources@24
+ 709 286 00427DEF IoAttachDevice = _IoAttachDevice@12
+ 710 287 0017A0CB IoAttachDeviceByPointer = _IoAttachDeviceByPointer@8
+ 711 288 000E6F18 IoAttachDeviceToDeviceStack = _IoAttachDeviceToDeviceStack@8
+ 712 289 000D4D56 IoAttachDeviceToDeviceStackSafe = _IoAttachDeviceToDeviceStackSafe@12
+ 713 28A 000B5898 IoBoostThreadIo = _IoBoostThreadIo@16
+ 714 28B 0008A1C2 IoBuildAsynchronousFsdRequest = _IoBuildAsynchronousFsdRequest@24
+ 715 28C 000701FA IoBuildDeviceIoControlRequest = _IoBuildDeviceIoControlRequest@36
+ 716 28D 00033CB4 IoBuildPartialMdl = _IoBuildPartialMdl@16
+ 717 28E 002BD6C2 IoBuildSynchronousFsdRequest = _IoBuildSynchronousFsdRequest@28
+ 718 28F 000F7D6E IoCallDriver = _IoCallDriver@8
+ 719 290 00427EB1 IoCancelFileOpen = _IoCancelFileOpen@8
+ 720 291 000C4E16 IoCancelIrp = _IoCancelIrp@4
+ 721 292 00427FA1 IoCheckDesiredAccess = _IoCheckDesiredAccess@8
+ 722 293 002F31FA IoCheckEaBufferValidity = _IoCheckEaBufferValidity@12
+ 723 294 00427FD3 IoCheckFunctionAccess = _IoCheckFunctionAccess@24
+ 724 295 00428150 IoCheckQuerySetFileInformation = _IoCheckQuerySetFileInformation@12
+ 725 296 00428191 IoCheckQuerySetVolumeInformation = _IoCheckQuerySetVolumeInformation@12
+ 726 297 004281D2 IoCheckQuotaBufferValidity = _IoCheckQuotaBufferValidity@12
+ 727 298 0030C4CA IoCheckShareAccess = _IoCheckShareAccess@20
+ 728 299 0030C4EE IoCheckShareAccessEx = _IoCheckShareAccessEx@24
+ 729 29A 0005FC66 IoCleanupIrp = _IoCleanupIrp@4
+ 730 29B 000DC1B4 IoClearActivityIdThread = _IoClearActivityIdThread@4
+ 731 29C 0017F553 IoClearFsTrackOffsetState = _IoClearFsTrackOffsetState@4
+ 732 29D 0017A0F4 IoClearIrpExtraCreateParameter = _IoClearIrpExtraCreateParameter@4
+ 733 29E 0017A10F IoCompleteRequest = _IoCompleteRequest@8
+ 734 29F 00225E90 IoCompletionObjectType = _IoCompletionObjectType
+ 735 2A0 00372CCA IoConnectInterrupt = _IoConnectInterrupt@44
+ 736 2A1 00340294 IoConnectInterruptEx = _IoConnectInterruptEx@4
+ 737 2A2 00246158 IoConvertFileHandleToKernelHandle = _IoConvertFileHandleToKernelHandle@20
+ 738 2A3 0042825F IoCopyDeviceObjectHint = _IoCopyDeviceObjectHint@8
+ 739 2A4 0035F5EC IoCreateArcName = _IoCreateArcName@4
+ 740 2A5 003765B8 IoCreateController = _IoCreateController@4
+ 741 2A6 0032270C IoCreateDevice = _IoCreateDevice@28
+ 742 2A7 00427790 IoCreateDisk = _IoCreateDisk@8
+ 743 2A8 0035C714 IoCreateDriver = _IoCreateDriver@8
+ 744 2A9 002FF28E IoCreateFile = _IoCreateFile@56
+ 745 2AA 00282408 IoCreateFileEx = _IoCreateFileEx@60
+ 746 2AB 003020C2 IoCreateFileSpecifyDeviceObjectHint = _IoCreateFileSpecifyDeviceObjectHint@60
+ 747 2AC 003474BE IoCreateNotificationEvent = _IoCreateNotificationEvent@8
+ 748 2AD 004282C5 IoCreateStreamFileObject = _IoCreateStreamFileObject@8
+ 750 2AE 00332B0C IoCreateStreamFileObjectEx = _IoCreateStreamFileObjectEx@12
+ 749 2AF 0030BEA6 IoCreateStreamFileObjectEx2 = _IoCreateStreamFileObjectEx2@20
+ 751 2B0 0030BE64 IoCreateStreamFileObjectLite = _IoCreateStreamFileObjectLite@8
+ 752 2B1 00305E02 IoCreateSymbolicLink = _IoCreateSymbolicLink@8
+ 753 2B2 00428306 IoCreateSynchronizationEvent = _IoCreateSynchronizationEvent@8
+ 754 2B3 0037000C IoCreateSystemThread = _IoCreateSystemThread@32
+ 755 2B4 00428390 IoCreateUnprotectedSymbolicLink = _IoCreateUnprotectedSymbolicLink@8
+ 756 2B5 000CDD26 IoCsqInitialize = _IoCsqInitialize@28
+ 757 2B6 000D4E76 IoCsqInitializeEx = _IoCsqInitializeEx@28
+ 758 2B7 000C1F6C IoCsqInsertIrp = _IoCsqInsertIrp@12
+ 759 2B8 000C1F8A IoCsqInsertIrpEx = _IoCsqInsertIrpEx@16
+ 760 2B9 000F7476 IoCsqRemoveIrp = _IoCsqRemoveIrp@8
+ 761 2BA 000C24A0 IoCsqRemoveNextIrp = _IoCsqRemoveNextIrp@8
+ 762 2BB 0017ECB6 IoDecrementKeepAliveCount = _IoDecrementKeepAliveCount@8
+ 763 2BC 002FB2FC IoDeleteController = _IoDeleteController@4
+ 764 2BD 000D6110 IoDeleteDevice = _IoDeleteDevice@4
+ 765 2BE 002FB2FC IoDeleteDriver = _IoDeleteController@4
+ 766 2BF 003748AA IoDeleteSymbolicLink = _IoDeleteSymbolicLink@4
+ 767 2C0 000D35D6 IoDetachDevice = _IoDetachDevice@4
+ 768 2C1 00225EB4 IoDeviceHandlerObjectSize = _IoDeviceHandlerObjectSize
+ 769 2C2 00225EB8 IoDeviceHandlerObjectType = _IoDeviceHandlerObjectType
+ 770 2C3 00225E98 IoDeviceObjectType = _IoDeviceObjectType
+ 771 2C4 0033A160 IoDisconnectInterrupt = _IoDisconnectInterrupt@4
+ 772 2C5 0033A0EC IoDisconnectInterruptEx = _IoDisconnectInterruptEx@4
+ 773 2C6 00225E94 IoDriverObjectType = _IoDriverObjectType
+ 774 2C7 0042F33E IoDuplicateDependency = _IoDuplicateDependency@8
+ 775 2C8 004283E9 IoEnqueueIrp = _IoEnqueueIrp@4
+ 776 2C9 00105358 IoEnumerateDeviceObjectList = _IoEnumerateDeviceObjectList@16
+ 777 2CA 0037725C IoEnumerateRegisteredFiltersList = _IoEnumerateRegisteredFiltersList@12
+ 778 2CB 004283FF IoFastQueryNetworkAttributes = _IoFastQueryNetworkAttributes@20
+ 779 2CC 00225E88 IoFileObjectType = _IoFileObjectType
+ 780 2CD 002F8824 IoForwardAndCatchIrp = _IoForwardIrpSynchronously@8
+ 781 2CE 002F8824 IoForwardIrpSynchronously = _IoForwardIrpSynchronously@8
+ 782 2CF 000F9096 IoFreeController = _IoFreeController@4
+ 783 2D0 0017A13C IoFreeErrorLogEntry = _IoFreeErrorLogEntry@4
+ 784 2D1 0005FB40 IoFreeIrp = _IoFreeIrp@4
+ 785 2D2 00086A40 IoFreeMdl = _IoFreeMdl@4
+ 786 2D3 002825D8 IoFreeMiniCompletionPacket = _IoFreeMiniCompletionPacket@4
+ 787 2D4 0017A191 IoFreeSfioStreamIdentifier = _IoFreeSfioStreamIdentifier@8
+ 788 2D5 000CA788 IoFreeWorkItem = _IoFreeWorkItem@4
+ 789 2D6 000AED5C IoGetActivityIdIrp = _IoGetActivityIdIrp@8
+ 790 2D7 000C03D2 IoGetActivityIdThread = _IoGetActivityIdThread@0
+ 791 2D8 0017F586 IoGetAdapterCryptoEngineExtension = _IoGetAdapterCryptoEngineExtension@8
+ 792 2D9 001081C8 IoGetAffinityInterrupt = _IoGetAffinityInterrupt@8
+ 793 2DA 000574FA IoGetAttachedDevice = _IoGetAttachedDevice@4
+ 794 2DB 00089C3A IoGetAttachedDeviceReference = _IoGetAttachedDeviceReference@4
+ 795 2DC 0006801E IoGetBaseFileSystemDeviceObject = _IoGetBaseFileSystemDeviceObject@4
+ 796 2DD 00428439 IoGetBootDiskInformation = _IoGetBootDiskInformation@8
+ 797 2DE 003557F2 IoGetBootDiskInformationLite = _IoGetBootDiskInformationLite@4
+ 798 2DF 00348562 IoGetConfigurationInformation = _IoGetConfigurationInformation@0
+ 799 2E0 0042AABF IoGetContainerInformation = _IoGetContainerInformation@16
+ 800 2E1 0005AC36 IoGetCurrentProcess = _PsGetCurrentProcess@0
+ 801 2E2 000DC03E IoGetDeviceAttachmentBaseRef = _IoGetDeviceAttachmentBaseRef@4
+ 802 2E3 0032DEEA IoGetDeviceInterfaceAlias = _IoGetDeviceInterfaceAlias@12
+ 803 2E4 0042FF67 IoGetDeviceInterfacePropertyData = _IoGetDeviceInterfacePropertyData@32
+ 804 2E5 002633F2 IoGetDeviceInterfaces = _IoGetDeviceInterfaces@16
+ 805 2E6 00378112 IoGetDeviceNumaNode = _IoGetDeviceNumaNode@8
+ 806 2E7 002AFA0C IoGetDeviceObjectPointer = _IoGetDeviceObjectPointer@16
+ 807 2E8 00264B22 IoGetDeviceProperty = _IoGetDeviceProperty@20
+ 808 2E9 0026303E IoGetDevicePropertyData = _IoGetDevicePropertyData@32
+ 809 2EA 000E70E6 IoGetDeviceToVerify = _IoGetDeviceToVerify@4
+ 810 2EB 0017A22F IoGetDiskDeviceObject = _IoGetDiskDeviceObject@8
+ 811 2EC 003702BE IoGetDmaAdapter = _IoGetDmaAdapter@12
+ 812 2ED 000D2958 IoGetDriverObjectExtension = _IoGetDriverObjectExtension@8
+ 813 2EE 002EFD80 IoGetFileObjectGenericMapping = _IoGetFileObjectGenericMapping@0
+ 814 2EF 000AEAA0 IoGetFsTrackOffsetState = _IoGetFsTrackOffsetState@12
+ 815 2F0 0017F5BB IoGetFsZeroingOffset = _IoGetFsZeroingOffset@8
+ 816 2F1 000E631A IoGetGenericIrpExtension = _IoGetGenericIrpExtension@12
+ 817 2F2 00428462 IoGetInitialStack = _IoGetInitialStack@0
+ 818 2F3 000E8846 IoGetInitiatorProcess = _IoGetInitiatorProcess@4
+ 819 2F4 000AEC60 IoGetIoAttributionHandle = _IoGetIoAttributionHandle@8
+ 820 2F5 00056BA2 IoGetIoPriorityHint = _IoGetIoPriorityHint@4
+ 821 2F6 00287B6C IoGetIrpExtraCreateParameter = _IoGetIrpExtraCreateParameter@8
+ 822 2F7 000D2C74 IoGetLowerDeviceObject = _IoGetLowerDeviceObject@4
+ 823 2F8 0017A379 IoGetOplockKeyContext = _IoGetOplockKeyContext@4
+ 824 2F9 00057E02 IoGetOplockKeyContextEx = _IoGetOplockKeyContextEx@4
+ 97 2FA 000C31D8 IoGetPagingIoPriority = @IoGetPagingIoPriority@4
+ 825 2FB 00054AA2 IoGetRelatedDeviceObject = _IoGetRelatedDeviceObject@4
+ 826 2FC 000BAB38 IoGetRequestorProcess = _IoGetRequestorProcess@4
+ 827 2FD 000BAB14 IoGetRequestorProcessId = _IoGetRequestorProcessId@4
+ 828 2FE 000E83FE IoGetRequestorSessionId = _IoGetRequestorSessionId@8
+ 829 2FF 0017A3A6 IoGetSfioStreamIdentifier = _IoGetSfioStreamIdentifier@8
+ 830 300 000C7480 IoGetSilo = _IoGetSilo@4
+ 831 301 00057E2C IoGetSiloParameters = _IoGetSiloParameters@4
+ 832 302 0003257A IoGetStackLimits = _IoGetStackLimits@8
+ 833 303 0042ABA3 IoGetSymlinkSupportInformation = _IoGetSymlinkSupportInformation@8
+ 834 304 00067D40 IoGetTopLevelIrp = _IoGetTopLevelIrp@0
+ 835 305 00057E48 IoGetTransactionParameterBlock = _IoGetTransactionParameterBlock@4
+ 836 306 0017EDA4 IoIncrementKeepAliveCount = _IoIncrementKeepAliveCount@8
+ 837 307 000CA468 IoInitializeIrp = _IoInitializeIrp@12
+ 838 308 0017A3D8 IoInitializeIrpEx = _IoInitializeIrpEx@16
+ 839 309 0042A7D7 IoInitializeMiniCompletionPacket = _IoInitializeMiniCompletionPacket@12
+ 840 30A 000D4570 IoInitializeRemoveLockEx = _IoInitializeRemoveLockEx@20
+ 841 30B 00376F20 IoInitializeTimer = _IoInitializeTimer@12
+ 842 30C 000CC0E4 IoInitializeWorkItem = _IoInitializeWorkItem@8
+ 843 30D 000D5CFE IoInvalidateDeviceRelations = _IoInvalidateDeviceRelations@8
+ 844 30E 000F7D0C IoInvalidateDeviceState = _IoInvalidateDeviceState@4
+ 845 30F 0017F5F0 IoIrpHasFsTrackOffsetExtensionType = _IoIrpHasFsTrackOffsetExtensionType@4
+ 846 310 000CCA10 IoIsActivityTracingEnabled = _IoIsActivityTracingEnabled@0
+ 847 311 003069E6 IoIsFileObjectIgnoringSharing = _IoIsFileObjectIgnoringSharing@4
+ 848 312 0017A412 IoIsFileOriginRemote = _IoIsFileOriginRemote@4
+ 849 313 0002F704 IoIsOperationSynchronous = _IoIsOperationSynchronous@4
+ 850 314 000C894C IoIsSystemThread = _IoIsSystemThread@4
+ 851 315 004FB1CA IoIsValidIrpStatus = _IoIsValidIrpStatus@4
+ 852 316 0042ABF4 IoIsValidNameGraftingBuffer = _IoIsValidNameGraftingBuffer@8
+ 853 317 0042FF90 IoIsWdmVersionAvailable = _IoIsWdmVersionAvailable@8
+ 854 318 0017A428 IoMakeAssociatedIrp = _IoMakeAssociatedIrp@8
+ 855 319 000AE830 IoMakeAssociatedIrpEx = _IoMakeAssociatedIrpEx@12
+ 856 31A 003326F6 IoOpenDeviceInterfaceRegistryKey = _IoOpenDeviceInterfaceRegistryKey@12
+ 857 31B 002F3A12 IoOpenDeviceRegistryKey = _IoOpenDeviceRegistryKey@16
+ 858 31C 000E4E4A IoPageRead = _IoPageRead@20
+ 859 31D 000AEA7A IoPropagateActivityIdToThread = _IoPropagateActivityIdToThread@12
+ 860 31E 000AEACA IoPropagateIrpExtension = _IoPropagateIrpExtension@12
+ 861 31F 000AEC96 IoPropagateIrpExtensionEx = _IoPropagateIrpExtensionEx@20
+ 862 320 00341F38 IoQueryDeviceDescription = _IoQueryDeviceDescription@32
+ 863 321 002AF65A IoQueryFileDosDeviceName = _IoQueryFileDosDeviceName@8
+ 864 322 002C5BEC IoQueryFileInformation = _IoQueryFileInformation@20
+ 865 323 0017EE9D IoQueryFullDriverPath = _IoQueryFullDriverPath@8
+ 866 324 00428471 IoQueryInformationByName = _IoQueryInformationByName@24
+ 867 325 00370464 IoQueryInterface = _IoQueryInterface@28
+ 868 326 00304B88 IoQueryVolumeInformation = _IoQueryVolumeInformation@20
+ 869 327 000F9034 IoQueueThreadIrp = _IoQueueThreadIrp@4
+ 870 328 000CDCA6 IoQueueWorkItem = _IoQueueWorkItem@16
+ 871 329 00073BE0 IoQueueWorkItemEx = _IoQueueWorkItemEx@16
+ 872 32A 0017EEDD IoQueueWorkItemToNode = _IoQueueWorkItemToNode@20
+ 873 32B 0017A443 IoRaiseHardError = _IoRaiseHardError@12
+ 874 32C 0017A5F9 IoRaiseInformationalHardError = _IoRaiseInformationalHardError@12
+ 875 32D 0036EEEA IoReadDiskSignature = _IoReadDiskSignature@12
+ 876 32E 002035C0 IoReadOperationCount = _IoReadOperationCount
+ 98 32F 00427542 IoReadPartitionTable = @IoReadPartitionTable@16
+ 877 330 004277A9 IoReadPartitionTableEx = _IoReadPartitionTableEx@8
+ 878 331 002035D0 IoReadTransferCount = _IoReadTransferCount
+ 879 332 000BFB84 IoRecordIoAttribution = _IoRecordIoAttribution@8
+ 880 333 00378280 IoRegisterBootDriverCallback = _IoRegisterBootDriverCallback@8
+ 881 334 0037008C IoRegisterBootDriverReinitialization = _IoRegisterBootDriverReinitialization@12
+ 882 335 00376876 IoRegisterContainerNotification = _IoRegisterContainerNotification@20
+ 883 336 0036A008 IoRegisterDeviceInterface = _IoRegisterDeviceInterface@16
+ 884 337 003700EC IoRegisterDriverReinitialization = _IoRegisterDriverReinitialization@12
+ 885 338 00360606 IoRegisterFileSystem = _IoRegisterFileSystem@4
+ 886 339 00428703 IoRegisterFsRegistrationChange = _IoRegisterFsRegistrationChange@8
+ 887 33A 00360472 IoRegisterFsRegistrationChangeMountAware = _IoRegisterFsRegistrationChangeMountAware@12
+ 888 33B 0042B36E IoRegisterIoTracking = _IoRegisterIoTracking@8
+ 889 33C 0035CB02 IoRegisterLastChanceShutdownNotification = _IoRegisterLastChanceShutdownNotification@4
+ 890 33D 003353BE IoRegisterPlugPlayNotification = _IoRegisterPlugPlayNotification@28
+ 891 33E 001027D6 IoRegisterPriorityCallback = _IoRegisterPriorityCallback@8
+ 892 33F 0035CB62 IoRegisterShutdownNotification = _IoRegisterShutdownNotification@4
+ 893 340 0002F97C IoReleaseCancelSpinLock = _IoReleaseCancelSpinLock@4
+ 894 341 00181A3C IoReleaseRemoveLockAndWaitEx = _IoReleaseRemoveLockAndWaitEx@12
+ 895 342 000C4784 IoReleaseRemoveLockEx = _IoReleaseRemoveLockEx@12
+ 896 343 000D654E IoReleaseVpbSpinLock = _IoReleaseVpbSpinLock@4
+ 897 344 0030C64C IoRemoveShareAccess = _IoRemoveShareAccess@8
+ 898 345 0042871E IoReplaceFileObjectName = _IoReplaceFileObjectName@12
+ 899 346 0042FFB4 IoReplacePartitionUnit = _IoReplacePartitionUnit@12
+ 900 347 0034F0BC IoReportDetectedDevice = _IoReportDetectedDevice@32
+ 901 348 005538CC IoReportHalResourceUsage = _IoReportHalResourceUsage@16
+ 902 349 000EEEEE IoReportInterruptActive = _IoReportInterruptActive@4
+ 903 34A 000EDC56 IoReportInterruptInactive = _IoReportInterruptInactive@4
+ 904 34B 004308C5 IoReportResourceForDetection = _IoReportResourceForDetection@28
+ 905 34C 00430A40 IoReportResourceUsage = _IoReportResourceUsage@36
+ 906 34D 0037188A IoReportRootDevice = _IoReportRootDevice@4
+ 907 34E 0032EEAC IoReportTargetDeviceChange = _IoReportTargetDeviceChange@8
+ 908 34F 000DBD44 IoReportTargetDeviceChangeAsynchronous = _IoReportTargetDeviceChangeAsynchronous@16
+ 909 350 00181D90 IoRequestDeviceEject = _IoRequestDeviceEject@4
+ 910 351 00181DAD IoRequestDeviceEjectEx = _IoRequestDeviceEjectEx@16
+ 911 352 00430DFF IoRequestDeviceRemovalForReset = _IoRequestDeviceRemovalForReset@8
+ 912 353 0042F409 IoReserveDependency = _IoReserveDependency@12
+ 913 354 001002E2 IoResolveDependency = _IoResolveDependency@8
+ 914 355 00057350 IoRetrievePriorityInfo = _IoRetrievePriorityInfo@16
+ 915 356 000AEAEA IoReuseIrp = _IoReuseIrp@8
+ 916 357 0017A8AA IoSetActivityIdIrp = _IoSetActivityIdIrp@8
+ 917 358 000DC1D2 IoSetActivityIdThread = _IoSetActivityIdThread@4
+ 918 359 0017F609 IoSetAdapterCryptoEngineExtension = _IoSetAdapterCryptoEngineExtension@8
+ 919 35A 000E7DFE IoSetCompletionRoutineEx = _IoSetCompletionRoutineEx@28
+ 920 35B 0042F490 IoSetDependency = _IoSetDependency@12
+ 921 35C 0036B868 IoSetDeviceInterfacePropertyData = _IoSetDeviceInterfacePropertyData@28
+ 922 35D 00309D56 IoSetDeviceInterfaceState = _IoSetDeviceInterfaceState@8
+ 923 35E 0034D2EA IoSetDevicePropertyData = _IoSetDevicePropertyData@28
+ 924 35F 0017A91A IoSetDeviceToVerify = _IoSetDeviceToVerify@8
+ 925 360 004287BA IoSetFileObjectIgnoreSharing = _IoSetFileObjectIgnoreSharing@4
+ 926 361 0017A934 IoSetFileOrigin = _IoSetFileOrigin@8
+ 927 362 0017F653 IoSetFsTrackOffsetState = _IoSetFsTrackOffsetState@16
+ 928 363 0017F6A3 IoSetFsZeroingOffset = _IoSetFsZeroingOffset@8
+ 929 364 0017F6DA IoSetFsZeroingOffsetRequired = _IoSetFsZeroingOffsetRequired@4
+ 930 365 000E620E IoSetGenericIrpExtension = _IoSetGenericIrpExtension@16
+ 931 366 0017A975 IoSetHardErrorOrVerifyDevice = _IoSetHardErrorOrVerifyDevice@8
+ 932 367 0033A816 IoSetInformation = _IoSetInformation@16
+ 933 368 0017A996 IoSetIoAttributionIrp = _IoSetIoAttributionIrp@12
+ 934 369 0030239A IoSetIoCompletion = _IoSetIoCompletion@24
+ 935 36A 00077CAE IoSetIoCompletionEx = _IoSetIoCompletionEx@28
+ 936 36B 000BE808 IoSetIoPriorityHint = _IoSetIoPriorityHint@8
+ 937 36C 0017A9D9 IoSetIoPriorityHintIntoFileObject = _IoSetIoPriorityHintIntoFileObject@8
+ 938 36D 000D0CF8 IoSetIoPriorityHintIntoThread = _IoSetIoPriorityHintIntoThread@8
+ 939 36E 002E3F9C IoSetIrpExtraCreateParameter = _IoSetIrpExtraCreateParameter@8
+ 940 36F 000C1754 IoSetMasterIrpStatus = _IoSetMasterIrpStatus@8
+ 99 370 00427685 IoSetPartitionInformation = @IoSetPartitionInformation@16
+ 941 371 004277C2 IoSetPartitionInformationEx = _IoSetPartitionInformationEx@12
+ 942 372 0030BBBE IoSetShareAccess = _IoSetShareAccess@16
+ 943 373 000D622C IoSetShareAccessEx = _IoSetShareAccessEx@20
+ 944 374 001085EA IoSetStartIoAttributes = _IoSetStartIoAttributes@12
+ 945 375 004287E2 IoSetSystemPartition = _IoSetSystemPartition@4
+ 946 376 000D8702 IoSetThreadHardErrorMode = _IoSetThreadHardErrorMode@4
+ 947 377 00067D22 IoSetTopLevelIrp = _IoSetTopLevelIrp@4
+ 948 378 0017AAF7 IoSizeOfIrpEx = _IoSizeOfIrpEx@8
+ 949 379 0017F730 IoSizeofGenericIrpExtension = _IoSizeofGenericIrpExtension@0
+ 950 37A 000CDCD0 IoSizeofWorkItem = _IoSizeofWorkItem@0
+ 951 37B 000F7E3C IoStartNextPacket = _IoStartNextPacket@8
+ 952 37C 0017AB30 IoStartNextPacketByKey = _IoStartNextPacketByKey@12
+ 953 37D 000F8828 IoStartPacket = _IoStartPacket@16
+ 954 37E 0017AB78 IoStartTimer = _IoStartTimer@4
+ 955 37F 0022D3C0 IoStatisticsLock = _IoStatisticsLock
+ 956 380 0042F082 IoSteerInterrupt = _IoSteerInterrupt@8
+ 957 381 0017AB9D IoStopTimer = _IoStopTimer@4
+ 958 382 000CDEB8 IoSynchronousCallDriver = _IoSynchronousCallDriver@8
+ 959 383 000AE69E IoSynchronousPageWrite = _IoSynchronousPageWrite@20
+ 960 384 000EDAD2 IoTestDependency = _IoTestDependency@16
+ 961 385 0005827E IoThreadToProcess = _IoThreadToProcess@4
+ 962 386 000E55AC IoTransferActivityId = _IoTransferActivityId@8
+ 963 387 001822D8 IoTranslateBusAddress = _IoTranslateBusAddress@24
+ 964 388 000E40D2 IoTryQueueWorkItem = _IoTryQueueWorkItem@16
+ 965 389 000CF2B0 IoUninitializeWorkItem = _IoUninitializeWorkItem@4
+ 966 38A 00570BB4 IoUnregisterBootDriverCallback = _IoUnregisterBootDriverCallback@4
+ 967 38B 0042AB11 IoUnregisterContainerNotification = _IoUnregisterContainerNotification@4
+ 968 38C 004289A6 IoUnregisterFileSystem = _IoUnregisterFileSystem@4
+ 969 38D 00428A36 IoUnregisterFsRegistrationChange = _IoUnregisterFsRegistrationChange@8
+ 970 38E 0042B432 IoUnregisterIoTracking = _IoUnregisterIoTracking@4
+ 971 38F 00334E14 IoUnregisterPlugPlayNotification = _IoUnregisterPlugPlayNotification@4
+ 972 390 003484A6 IoUnregisterPlugPlayNotificationEx = _IoUnregisterPlugPlayNotificationEx@4
+ 973 391 0017ABB6 IoUnregisterPriorityCallback = _IoUnregisterPriorityCallback@4
+ 974 392 0023F3EA IoUnregisterShutdownNotification = _IoUnregisterShutdownNotification@4
+ 975 393 002EB592 IoUpdateShareAccess = _IoUpdateShareAccess@8
+ 976 394 000D1932 IoValidateDeviceIoControlAccess = _IoValidateDeviceIoControlAccess@8
+ 977 395 004277DE IoVerifyPartitionTable = _IoVerifyPartitionTable@8
+ 978 396 00428AC2 IoVerifyVolume = _IoVerifyVolume@8
+ 979 397 0042B4BE IoVolumeDeviceNameToGuid = _IoVolumeDeviceNameToGuid@8
+ 980 398 00331FCC IoVolumeDeviceNameToGuidPath = _IoVolumeDeviceNameToGuidPath@8
+ 981 399 002AF6CE IoVolumeDeviceToDosName = _IoVolumeDeviceToDosName@8
+ 982 39A 00331E64 IoVolumeDeviceToGuid = _IoVolumeDeviceToGuid@8
+ 983 39B 00331ECE IoVolumeDeviceToGuidPath = _IoVolumeDeviceToGuidPath@8
+ 984 39C 004A1710 IoWMIAllocateInstanceIds = _IoWMIAllocateInstanceIds@12
+ 985 39D 00346896 IoWMIDeviceObjectToInstanceName = _IoWMIDeviceObjectToInstanceName@12
+ 986 39E 004A180D IoWMIExecuteMethod = _IoWMIExecuteMethod@24
+ 987 39F 00346848 IoWMIHandleToInstanceName = _IoWMIHandleToInstanceName@12
+ 988 3A0 00345AD0 IoWMIOpenBlock = _IoWMIOpenBlock@12
+ 989 3A1 00374FCA IoWMIQueryAllData = _IoWMIQueryAllData@12
+ 990 3A2 004A1925 IoWMIQueryAllDataMultiple = _IoWMIQueryAllDataMultiple@16
+ 991 3A3 00347552 IoWMIQuerySingleInstance = _IoWMIQuerySingleInstance@16
+ 992 3A4 004A19C1 IoWMIQuerySingleInstanceMultiple = _IoWMIQuerySingleInstanceMultiple@20
+ 993 3A5 0035CCFA IoWMIRegistrationControl = _IoWMIRegistrationControl@8
+ 994 3A6 003744F0 IoWMISetNotificationCallback = _IoWMISetNotificationCallback@12
+ 995 3A7 004A1A69 IoWMISetSingleInstance = _IoWMISetSingleInstance@20
+ 996 3A8 004A1B24 IoWMISetSingleItem = _IoWMISetSingleItem@24
+ 997 3A9 004A1BE9 IoWMISuggestInstanceName = _IoWMISuggestInstanceName@16
+ 998 3AA 000F77E6 IoWMIWriteEvent = _IoWMIWriteEvent@4
+ 999 3AB 000326EA IoWithinStackLimits = _IoWithinStackLimits@8
+ 1000 3AC 000F83FA IoWriteErrorLogEntry = _IoWriteErrorLogEntry@4
+ 1001 3AD 002035C4 IoWriteOperationCount = _IoWriteOperationCount
+ 100 3AE 004276CB IoWritePartitionTable = @IoWritePartitionTable@20
+ 1002 3AF 004277F7 IoWritePartitionTableEx = _IoWritePartitionTableEx@8
+ 1003 3B0 002035D8 IoWriteTransferCount = _IoWriteTransferCount
+ 101 3B1 00056B30 IofCallDriver = @IofCallDriver@8
+ 102 3B2 00054526 IofCompleteRequest = @IofCompleteRequest@8
+ 1004 3B3 00186580 KdAcquireDebuggerLock = _KdAcquireDebuggerLock@4
+ 1005 3B4 00186622 KdChangeOption = _KdChangeOption@24
+ 1006 3B5 002020E1 KdDebuggerEnabled = _KdDebuggerEnabled
+ 1007 3B6 002020E2 KdDebuggerNotPresent = _KdDebuggerNotPresent
+ 1008 3B7 001863F5 KdDeregisterPowerHandler = _KdDeregisterPowerHandler@4
+ 1009 3B8 0018668C KdDisableDebugger = _KdDisableDebugger@0
+ 1010 3B9 0018677C KdEnableDebugger = _KdEnableDebugger@0
+ 1011 3BA 0020203C KdEnteredDebugger = _KdEnteredDebugger
+ 1012 3BB 00202029 KdEventLoggingEnabled = _KdEventLoggingEnabled
+ 1013 3BC 00108914 KdGetDebugDevice = _KdGetDebugDevice@0
+ 1014 3BD 004EDEEE KdLogDbgPrint = _KdLogDbgPrint@4
+ 1015 3BE 001087DA KdPollBreakIn = _KdPollBreakIn@0
+ 1016 3BF 001868BE KdPowerTransition = _KdPowerTransition@4
+ 1017 3C0 001868D6 KdPowerTransitionEx = _KdPowerTransitionEx@8
+ 1018 3C1 001088B0 KdRefreshDebuggerNotPresent = _KdRefreshDebuggerNotPresent@0
+ 1019 3C2 0018649B KdRegisterPowerHandler = _KdRegisterPowerHandler@12
+ 1020 3C3 001869F2 KdReleaseDebuggerLock = _KdReleaseDebuggerLock@4
+ 1021 3C4 004EBF01 KdSetEventLoggingPresent = _KdSetEventLoggingPresent@4
+ 1022 3C5 004528A0 KdSystemDebugControl = _KdSystemDebugControl@28
+ 1023 3C6 00189C3F Ke386IoSetAccessProcess = _Ke386IoSetAccessProcess@8
+ 1024 3C7 00189C92 Ke386QueryIoAccessMap = _Ke386QueryIoAccessMap@8
+ 1025 3C8 00189D08 Ke386SetIoAccessMap = _Ke386SetIoAccessMap@8
+ 103 3C9 000DBE54 KeAcquireGuardedMutex = @KeAcquireGuardedMutex@4
+ 104 3CA 00187320 KeAcquireGuardedMutexUnsafe = @KeAcquireGuardedMutexUnsafe@4
+ 105 3CB 000590B0 KeAcquireInStackQueuedSpinLock = @KeAcquireInStackQueuedSpinLock@8
+ 106 3CC 000B53F4 KeAcquireInStackQueuedSpinLockAtDpcLevel = @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
+ 107 3CD 00188D36 KeAcquireInStackQueuedSpinLockForDpc = @KeAcquireInStackQueuedSpinLockForDpc@8
+ 108 3CE 00188A88 KeAcquireInStackQueuedSpinLockRaiseToSynch = @KeAcquireInStackQueuedSpinLockRaiseToSynch@8
+ 1026 3CF 000D4688 KeAcquireInterruptSpinLock = _KeAcquireInterruptSpinLock@4
+ 109 3D0 0005715C KeAcquireQueuedSpinLock = @KeAcquireQueuedSpinLock@4
+ 110 3D1 00188ACB KeAcquireQueuedSpinLockRaiseToSynch = @KeAcquireQueuedSpinLockRaiseToSynch@4
+ 1027 3D2 00188FCC KeAcquireSpinLock = _KeAcquireSpinLock@8
+ 1028 3D3 00188FF1 KeAcquireSpinLockAtDpcLevel = _KeAcquireSpinLockAtDpcLevel@4
+ 111 3D4 00188D78 KeAcquireSpinLockForDpc = @KeAcquireSpinLockForDpc@4
+ 112 3D5 00188E97 KeAcquireSpinLockRaiseToSynch = @KeAcquireSpinLockRaiseToSynch@4
+ 1029 3D6 00189DE7 KeAddGroupAffinityEx = _KeAddGroupAffinityEx@12
+ 1030 3D7 000B7842 KeAddProcessorAffinityEx = _KeAddProcessorAffinityEx@8
+ 1031 3D8 00189DFE KeAddProcessorGroupAffinity = _KeAddProcessorGroupAffinity@8
+ 1032 3D9 00377C7E KeAddSystemServiceTable = _KeAddSystemServiceTable@20
+ 1033 3DA 00030EE2 KeAlertThread = _KeAlertThread@8
+ 1034 3DB 0036B75E KeAllocateCalloutStack = _KeAllocateCalloutStack@4
+ 1035 3DC 0036B790 KeAllocateCalloutStackEx = _KeAllocateCalloutStackEx@16
+ 1036 3DD 0007ADA6 KeAndAffinityEx = _KeAndAffinityEx@12
+ 1037 3DE 000269EC KeAndGroupAffinityEx = _KeAndGroupAffinityEx@12
+ 1038 3DF 000DC646 KeAreAllApcsDisabled = _KeAreAllApcsDisabled@0
+ 1039 3E0 000DD4D8 KeAreApcsDisabled = _KeAreApcsDisabled@0
+ 1040 3E1 000CFFB0 KeAttachProcess = _KeAttachProcess@4
+ 1041 3E2 0010ACC0 KeBugCheck = _KeBugCheck@4
+ 1042 3E3 0010ACD8 KeBugCheckEx = _KeBugCheckEx@20
+ 1044 3E4 000764BA KeCancelTimer = _KeCancelTimer@4
+ 1043 3E5 0007D6AE KeCancelTimer2 = _KeCancelTimer2@8
+ 1045 3E6 0017E6F7 KeCapturePersistentThreadState = _KeCapturePersistentThreadState@32
+ 1046 3E7 0010824A KeCheckProcessorAffinityEx = _KeCheckProcessorAffinityEx@8
+ 1047 3E8 00189E19 KeCheckProcessorGroupAffinity = _KeCheckProcessorGroupAffinity@8
+ 1048 3E9 00056FE2 KeClearEvent = _KeResetEvent@4
+ 113 3EA 00054C24 KeClockInterruptNotify = @KeClockInterruptNotify@8
+ 1049 3EB 00187580 KeClockTimerPowerChange = _KeClockTimerPowerChange@4
+ 1050 3EC 0007ADE0 KeComplementAffinityEx = _KeComplementAffinityEx@8
+ 1051 3ED 00187741 KeConvertAuxiliaryCounterToPerformanceCounter = _KeConvertAuxiliaryCounterToPerformanceCounter@16
+ 1052 3EE 00187761 KeConvertPerformanceCounterToAuxiliaryCounter = _KeConvertPerformanceCounterToAuxiliaryCounter@16
+ 1053 3EF 00189E34 KeCopyAffinityEx = _KeCopyAffinityEx@8
+ 1054 3F0 00189E4F KeCountSetBitsAffinityEx = _KeCountSetBitsAffinityEx@4
+ 1055 3F1 00189FDB KeCountSetBitsGroupAffinity = _KeCountSetBitsGroupAffinity@4
+ 1056 3F2 00081734 KeDelayExecutionThread = _KeDelayExecutionThread@12
+ 1057 3F3 00187781 KeDeregisterBoundCallback = _KeDeregisterBoundCallback@4
+ 1058 3F4 0018AAFD KeDeregisterBugCheckCallback = _KeDeregisterBugCheckCallback@4
+ 1059 3F5 000F84B0 KeDeregisterBugCheckReasonCallback = _KeDeregisterBugCheckReasonCallback@4
+ 1060 3F6 00187823 KeDeregisterNmiCallback = _KeDeregisterNmiCallback@4
+ 1061 3F7 004544A6 KeDeregisterProcessorChangeCallback = _KeDeregisterProcessorChangeCallback@4
+ 1062 3F8 000D336E KeDetachProcess = _KeDetachProcess@0
+ 1063 3F9 0018B63D KeDispatchSecondaryInterrupt = _KeDispatchSecondaryInterrupt@12
+ 1064 3FA 0005A0E2 KeEnterCriticalRegion = _KeEnterCriticalRegion@0
+ 1065 3FB 000AEE66 KeEnterGuardedRegion = _KeEnterGuardedRegion@0
+ 1066 3FC 0018AB76 KeEnterKernelDebugger = _KeEnterKernelDebugger@0
+ 1067 3FD 00051A52 KeEnumerateNextProcessor = _KeEnumerateNextProcessor@8
+ 1068 3FE 000D541A KeExpandKernelStackAndCallout = _KeExpandKernelStackAndCallout@12
+ 1069 3FF 00031C34 KeExpandKernelStackAndCalloutEx = _KeExpandKernelStackAndCalloutEx@20
+ 1070 400 0056E5FC KeFindConfigurationEntry = _KeFindConfigurationEntry@16
+ 1071 401 0056E626 KeFindConfigurationNextEntry = _KeFindConfigurationNextEntry@20
+ 1072 402 00189E98 KeFindFirstSetLeftAffinityEx = _KeFindFirstSetLeftAffinityEx@4
+ 1073 403 000C8848 KeFindFirstSetLeftGroupAffinity = _KeFindFirstSetLeftGroupAffinity@4
+ 1074 404 00189EBB KeFindFirstSetRightAffinityEx = _KeFindFirstSetRightAffinityEx@4
+ 1075 405 0006D3CA KeFindFirstSetRightGroupAffinity = _KeFindFirstSetRightGroupAffinity@4
+ 1076 406 000CE2D6 KeFirstGroupAffinityEx = _KeFirstGroupAffinityEx@8
+ 1077 407 0018BC6A KeFlushEntireTb = _KeFlushEntireTb@8
+ 1078 408 000C6904 KeFlushIoBuffers = _KeFlushIoBuffers@12
+ 1079 409 0009F596 KeFlushQueuedDpcs = _KeFlushQueuedDpcs@0
+ 1080 40A 002383F8 KeForceEnableNx = _KeForceEnableNx@0
+ 1081 40B 0045444B KeFreeCalloutStack = _KeFreeCalloutStack@4
+ 1082 40C 0009FD74 KeGenericCallDpc = _KeGenericCallDpc@8
+ 1083 40D 000D56AA KeGetClockOwner = _KeGetClockOwner@0
+ 1084 40E 0018758E KeGetClockTimerResolution = _KeGetClockTimerResolution@8
+ 1085 40F 000C3F40 KeGetCurrentNodeNumber = _KeGetCurrentNodeNumber@0
+ 1086 410 0007D468 KeGetCurrentProcessorNumberEx = _KeGetCurrentProcessorNumberEx@4
+ 1087 411 0002A3CC KeGetCurrentThread = _KeGetCurrentThread@0
+ 1088 412 00187932 KeGetEffectiveIrql = _KeGetEffectiveIrql@0
+ 1089 413 001875B0 KeGetNextClockTickDuration = _KeGetNextClockTickDuration@0
+ 1090 414 0005A160 KeGetPreviousMode = _ExGetPreviousMode@0
+ 1091 415 0006CF4E KeGetProcessorIndexFromNumber = _KeGetProcessorIndexFromNumber@4
+ 1092 416 0006D44C KeGetProcessorNumberFromIndex = _KeGetProcessorNumberFromIndex@8
+ 1093 417 000D60DE KeGetRecommendedSharedDataAlignment = _KeGetRecommendedSharedDataAlignment@0
+ 1094 418 0018BF38 KeGetXSaveFeatureFlags = _KeGetXSaveFeatureFlags@0
+ 1095 419 0056641E KeHwPolicyLocateResource = _KeHwPolicyLocateResource@20
+ 1096 41A 00209778 KeI386MachineType = _KeI386MachineType
+ 1097 41B 000DB8DA KeInitializeAffinityEx = _KeInitializeAffinityEx@4
+ 1098 41C 0003187E KeInitializeApc = _KeInitializeApc@32
+ 1099 41D 0017EC21 KeInitializeCrashDumpHeader = _KeInitializeCrashDumpHeader@20
+ 1100 41E 000DBCA2 KeInitializeDeviceQueue = _KeInitializeDeviceQueue@4
+ 1101 41F 00031060 KeInitializeDpc = _KeInitializeDpc@12
+ 1102 420 000AF3B6 KeInitializeEnumerationContext = _KeInitializeEnumerationContext@8
+ 1103 421 0018A023 KeInitializeEnumerationContextFromAffinity = _KeInitializeEnumerationContextFromAffinity@12
+ 1104 422 000F88F0 KeInitializeEnumerationContextFromGroup = _KeInitializeEnumerationContextFromGroup@8
+ 1105 423 00057306 KeInitializeEvent = _KeInitializeEvent@12
+ 114 424 000DBD26 KeInitializeGuardedMutex = @KeInitializeGuardedMutex@4
+ 1106 425 0018C513 KeInitializeInterrupt = _KeInitializeInterrupt@52
+ 1107 426 00026D6A KeInitializeMutant = _KeInitializeMutant@8
+ 1108 427 00026D50 KeInitializeMutex = _KeInitializeMutex@8
+ 1109 428 000C5C14 KeInitializeQueue = _KeInitializeQueue@8
+ 1110 429 00454536 KeInitializeSecondaryInterruptServices = _KeInitializeSecondaryInterruptServices@4
+ 1111 42A 00032800 KeInitializeSemaphore = _KeInitializeSemaphore@12
+ 1112 42B 000D60CA KeInitializeSpinLock = _ExInitializePushLock@4
+ 1113 42C 000FD362 KeInitializeThreadedDpc = _KeInitializeThreadedDpc@12
+ 1115 42D 0003108C KeInitializeTimer = _KeInitializeTimer@4
+ 1114 42E 000A279C KeInitializeTimer2 = _KeInitializeTimer2@16
+ 1116 42F 000314FA KeInitializeTimerEx = _KeInitializeTimerEx@8
+ 1117 430 0018C09F KeInsertByKeyDeviceQueue = _KeInsertByKeyDeviceQueue@12
+ 1118 431 000BB9F2 KeInsertDeviceQueue = _KeInsertDeviceQueue@8
+ 1119 432 0018C57A KeInsertHeadQueue = _KeInsertHeadQueue@8
+ 1120 433 00027CC4 KeInsertQueue = _KeInsertQueue@8
+ 1121 434 00077CDA KeInsertQueueApc = _KeInsertQueueApc@16
+ 1122 435 00086590 KeInsertQueueDpc = _KeInsertQueueDpc@12
+ 1123 436 00189EDE KeInterlockedClearProcessorAffinityEx = _KeInterlockedClearProcessorAffinityEx@8
+ 1124 437 000FC9E6 KeInterlockedSetProcessorAffinityEx = _KeInterlockedSetProcessorAffinityEx@8
+ 1125 438 000F4406 KeInvalidateAllCaches = _KeInvalidateAllCaches@0
+ 115 439 00189068 KeInvalidateRangeAllCaches = @KeInvalidateRangeAllCaches@8
+ 1126 43A 000F6AF0 KeIpiGenericCall = _KeIpiGenericCall@8
+ 1127 43B 000775F6 KeIsAttachedProcess = _KeIsAttachedProcess@0
+ 1128 43C 000B7096 KeIsEmptyAffinityEx = _KeIsEmptyAffinityEx@4
+ 1129 43D 0007AD86 KeIsEqualAffinityEx = _KeIsEqualAffinityEx@8
+ 1130 43E 000D0E18 KeIsExecutingDpc = _KeIsExecutingDpc@0
+ 1131 43F 000DA6B8 KeIsSingleGroupAffinityEx = _KeIsSingleGroupAffinityEx@8
+ 1132 440 00189F1A KeIsSubsetAffinityEx = _KeIsSubsetAffinityEx@8
+ 1133 441 00452DED KeIsWaitListEmpty = _KeIsWaitListEmpty@4
+ 1134 442 0005E62C KeLeaveCriticalRegion = _KeLeaveCriticalRegion@0
+ 1135 443 0005E170 KeLeaveGuardedRegion = _KeLeaveGuardedRegion@0
+ 1136 444 00237984 KeLoadMTRR = _KeLoadMTRR@4
+ 1137 445 0022613C KeLoaderBlock = _KeLoaderBlockExported
+ 1138 446 000E3CEC KeNotifyProcessorFreezeSupported = @SymCryptFatalIntercept@4
+ 1139 447 00225EFF KeNumberProcessors = _KeNumberProcessorsGroup0
+ 1140 448 0007AC26 KeOrAffinityEx = _KeOrAffinityEx@12
+ 1141 449 000EA02C KePollFreezeExecution = _KePollFreezeExecution@0
+ 1142 44A 00026A1E KeProcessorGroupAffinity = _KeProcessorGroupAffinity@8
+ 1143 44B 0018D0A8 KeProfileInterruptWithSource = _KeProfileInterruptWithSource@8
+ 1144 44C 0008B748 KePulseEvent = _KePulseEvent@12
+ 1145 44D 000A3ACC KeQueryActiveGroupCount = _KeQueryActiveGroupCount@0
+ 1146 44E 00101620 KeQueryActiveProcessorAffinity = _KeQueryActiveProcessorAffinity@4
+ 1147 44F 0018891E KeQueryActiveProcessorCount = _KeQueryActiveProcessorCount@4
+ 1148 450 00052D18 KeQueryActiveProcessorCountEx = _KeQueryActiveProcessorCountEx@4
+ 1149 451 00188979 KeQueryActiveProcessors = _KeQueryActiveProcessors@0
+ 1150 452 00187A49 KeQueryAuxiliaryCounterFrequency = _KeQueryAuxiliaryCounterFrequency@4
+ 1151 453 000BEC4C KeQueryDpcWatchdogInformation = _KeQueryDpcWatchdogInformation@4
+ 1152 454 000E78A6 KeQueryEffectivePriorityThread = _KeQueryEffectivePriorityThread@4
+ 1153 455 000D799C KeQueryGroupAffinity = _KeQueryGroupAffinity@4
+ 1154 456 00189F3D KeQueryGroupAffinityEx = _KeQueryGroupAffinityEx@8
+ 1155 457 0045473F KeQueryHardwareCounterConfiguration = _KeQueryHardwareCounterConfiguration@12
+ 116 458 00188598 KeQueryHeteroCpuPolicyThread = @KeQueryHeteroCpuPolicyThread@8
+ 1156 459 000A2C6C KeQueryHighestNodeNumber = _KeQueryHighestNodeNumber@0
+ 1157 45A 0007AD20 KeQueryInterruptTime = _KeQueryInterruptTime@0
+ 1158 45B 000F5BB4 KeQueryInterruptTimePrecise = _KeQueryInterruptTimePrecise@4
+ 1159 45C 000260F6 KeQueryLogicalProcessorRelationship = _KeQueryLogicalProcessorRelationship@16
+ 1160 45D 00032836 KeQueryMaximumGroupCount = _KeQueryMaximumGroupCount@0
+ 1161 45E 00188984 KeQueryMaximumProcessorCount = _KeQueryMaximumProcessorCount@0
+ 1162 45F 00026B26 KeQueryMaximumProcessorCountEx = _KeQueryMaximumProcessorCountEx@4
+ 1163 460 000A2C78 KeQueryNodeActiveAffinity = _KeQueryNodeActiveAffinity@12
+ 1164 461 001080B6 KeQueryNodeMaximumProcessorCount = _KeQueryNodeMaximumProcessorCount@4
+ 1165 462 0008AB34 KeQueryPriorityThread = _KeQueryPriorityThread@4
+ 1166 463 000D5588 KeQueryRuntimeThread = _KeQueryRuntimeThread@8
+ 1167 464 0002EEE8 KeQuerySystemTime = _KeQuerySystemTime@4
+ 1168 465 00032842 KeQuerySystemTimePrecise = _KeQuerySystemTimePrecise@4
+ 1169 466 0003E72A KeQueryTickCount = _KeQueryTickCount@4
+ 1170 467 0002805C KeQueryTimeIncrement = _KeQueryTimeIncrement@0
+ 1171 468 000CFEB2 KeQueryTotalCycleTimeThread = _KeQueryTotalCycleTimeThread@8
+ 1172 469 0003A422 KeQueryUnbiasedInterruptTime = _KeQueryUnbiasedInterruptTime@0
+ 1173 46A 000BC29A KeQueryUnbiasedInterruptTimePrecise = _KeQueryUnbiasedInterruptTimePrecise@4
+ 1174 46B 0018D629 KeRaiseUserException = _KeRaiseUserException@4
+ 1175 46C 000CBF44 KeReadStateEvent = _FsRtlNumberOfRunsInBaseMcb@4
+ 1176 46D 000CBF44 KeReadStateMutant = _FsRtlNumberOfRunsInBaseMcb@4
+ 1177 46E 000CBF44 KeReadStateMutex = _FsRtlNumberOfRunsInBaseMcb@4
+ 1178 46F 000CBF44 KeReadStateQueue = _FsRtlNumberOfRunsInBaseMcb@4
+ 1179 470 000CBF44 KeReadStateSemaphore = _FsRtlNumberOfRunsInBaseMcb@4
+ 1180 471 000734E0 KeReadStateTimer = _KeReadStateTimer@4
+ 1181 472 00187A8D KeRegisterBoundCallback = _KeRegisterBoundCallback@4
+ 1182 473 001070D4 KeRegisterBugCheckCallback = _KeRegisterBugCheckCallback@20
+ 1183 474 000F4CBE KeRegisterBugCheckReasonCallback = _KeRegisterBugCheckReasonCallback@16
+ 1184 475 00187ADC KeRegisterNmiCallback = _KeRegisterNmiCallback@8
+ 1185 476 003714F0 KeRegisterProcessorChangeCallback = _KeRegisterProcessorChangeCallback@12
+ 117 477 000DBE44 KeReleaseGuardedMutex = @KeReleaseGuardedMutex@4
+ 118 478 0018732A KeReleaseGuardedMutexUnsafe = @KeReleaseGuardedMutexUnsafe@4
+ 119 479 000590F4 KeReleaseInStackQueuedSpinLock = @KeReleaseInStackQueuedSpinLock@4
+ 120 47A 00188DA4 KeReleaseInStackQueuedSpinLockForDpc = @KeReleaseInStackQueuedSpinLockForDpc@4
+ 121 47B 00089E1A KeReleaseInStackQueuedSpinLockFromDpcLevel = @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
+ 1186 47C 000D464E KeReleaseInterruptSpinLock = _KeReleaseInterruptSpinLock@8
+ 1187 47D 000331D2 KeReleaseMutant = _KeReleaseMutant@16
+ 1188 47E 000331B4 KeReleaseMutex = _KeReleaseMutex@8
+ 122 47F 000DBBAA KeReleaseQueuedSpinLock = @KeReleaseQueuedSpinLock@8
+ 1189 480 00077C88 KeReleaseSemaphore = _KeReleaseSemaphore@16
+ 1190 481 00189007 KeReleaseSpinLock = _KeReleaseSpinLock@8
+ 123 482 00188E44 KeReleaseSpinLockForDpc = @KeReleaseSpinLockForDpc@8
+ 1191 483 0018903C KeReleaseSpinLockFromDpcLevel = _KeReleaseSpinLockFromDpcLevel@4
+ 1192 484 0018C1EC KeRemoveByKeyDeviceQueue = _KeRemoveByKeyDeviceQueue@8
+ 1193 485 0018C32F KeRemoveByKeyDeviceQueueIfBusy = _KeRemoveByKeyDeviceQueueIfBusy@8
+ 1194 486 000BBACA KeRemoveDeviceQueue = _KeRemoveDeviceQueue@4
+ 1195 487 0018C479 KeRemoveEntryDeviceQueue = _KeRemoveEntryDeviceQueue@8
+ 1196 488 00189F5C KeRemoveGroupAffinityEx = _KeRemoveGroupAffinityEx@12
+ 1197 489 00189F75 KeRemoveProcessorAffinityEx = _KeRemoveProcessorAffinityEx@8
+ 1198 48A 00189F92 KeRemoveProcessorGroupAffinity = _KeRemoveProcessorGroupAffinity@8
+ 1199 48B 000CCD26 KeRemoveQueue = _KeRemoveQueue@12
+ 1200 48C 00026C1A KeRemoveQueueDpc = _KeRemoveQueueDpc@4
+ 1201 48D 00026C32 KeRemoveQueueDpcEx = _KeRemoveQueueDpcEx@8
+ 1202 48E 000592CC KeRemoveQueueEx = _KeRemoveQueueEx@24
+ 1203 48F 00452E28 KeRemoveSystemServiceTable = _KeRemoveSystemServiceTable@4
+ 1204 490 0018BD58 KeReportCacheIncoherentDevice = _KeReportCacheIncoherentDevice@0
+ 1205 491 00056FE2 KeResetEvent = _KeResetEvent@4
+ 1206 492 000BBBA6 KeRestoreExtendedProcessorState = _KeRestoreExtendedProcessorState@4
+ 1207 493 000BBBBC KeRestoreFloatingPointState = _KeRestoreFloatingPointState@4
+ 1208 494 001887BC KeRevertToUserAffinityThread = _KeRevertToUserAffinityThread@0
+ 1209 495 001887F4 KeRevertToUserAffinityThreadEx = _KeRevertToUserAffinityThreadEx@4
+ 1210 496 0009F614 KeRevertToUserGroupAffinityThread = _KeRevertToUserGroupAffinityThread@4
+ 1211 497 000BBEFE KeRundownQueue = _KeRundownQueue@4
+ 1212 498 00074DF4 KeSaveExtendedProcessorState = _KeSaveExtendedProcessorState@12
+ 1213 499 00074DDA KeSaveFloatingPointState = _KeSaveFloatingPointState@4
+ 1214 49A 0010AE7F KeSaveStateForHibernate = _KeSaveStateForHibernate
+ 1215 49B 00226180 KeServiceDescriptorTable = _KeServiceDescriptorTable
+ 1216 49C 0007457A KeSetActualBasePriorityThread = _KeSetActualBasePriorityThread@8
+ 1217 49D 0007F9BA KeSetAffinityThread = _KeSetLegacyAffinityThread@8
+ 1218 49E 000C3F5A KeSetBasePriorityThread = _KeSetBasePriorityThread@8
+ 1219 49F 00076264 KeSetCoalescableTimer = _KeSetCoalescableTimer@24
+ 1220 4A0 000E3D82 KeSetDmaIoCoherency = _ExCleanupRundownProtectionCacheAware@4
+ 1221 4A1 0004F7B2 KeSetEvent = _KeSetEvent@12
+ 1222 4A2 00189FB6 KeSetEventBoostPriority = _KeSetEventBoostPriority@8
+ 1223 4A3 00454790 KeSetHardwareCounterConfiguration = _KeSetHardwareCounterConfiguration@8
+ 1224 4A4 0018884B KeSetHeteroCpuPolicyThread = _KeSetHeteroCpuPolicyThread@12
+ 1225 4A5 0006D4CA KeSetIdealProcessorThread = _KeSetIdealProcessorThread@8
+ 1226 4A6 000F8D3E KeSetImportanceDpc = _KeSetImportanceDpc@8
+ 1227 4A7 000C5966 KeSetKernelStackSwapEnable = _KeSetKernelStackSwapEnable@4
+ 1228 4A8 00074438 KeSetPriorityThread = _KeSetPriorityThread@8
+ 1229 4A9 00570BBE KeSetProfileIrql = _KeSetProfileIrql@4
+ 1230 4AA 0018DA9E KeSetSelectedCpuSetsThread = _KeSetSelectedCpuSetsThread@12
+ 1231 4AB 00188869 KeSetSystemAffinityThread = _KeSetSystemAffinityThread@4
+ 1232 4AC 00188873 KeSetSystemAffinityThreadEx = _KeSetSystemAffinityThreadEx@4
+ 1233 4AD 0009F828 KeSetSystemGroupAffinityThread = _KeSetSystemGroupAffinityThread@8
+ 1234 4AE 0018BE7E KeSetTargetProcessorDpc = _KeSetTargetProcessorDpc@8
+ 1235 4AF 000D4718 KeSetTargetProcessorDpcEx = _KeSetTargetProcessorDpcEx@8
+ 1237 4B0 000751B8 KeSetTimer = _KeSetTimer@16
+ 1236 4B1 00079106 KeSetTimer2 = _KeSetTimer2@24
+ 1238 4B2 000749EC KeSetTimerEx = _KeSetTimerEx@20
+ 1239 4B3 000A0940 KeShouldYieldProcessor = _KeShouldYieldProcessor@0
+ 1240 4B4 000D46E2 KeSignalCallDpcDone = _KeSignalCallDpcDone@4
+ 1241 4B5 0018BEDA KeSignalCallDpcSynchronize = _KeSignalCallDpcSynchronize@4
+ 1242 4B6 000D88AC KeStackAttachProcess = _KeStackAttachProcess@8
+ 1243 4B7 0018C9AF KeStallWhileFrozen = _KeStallWhileFrozen@4
+ 1244 4B8 004544B0 KeStartDynamicProcessor = _KeStartDynamicProcessor@16
+ 1245 4B9 000C16EC KeSubtractAffinityEx = _KeSubtractAffinityEx@12
+ 1246 4BA 000E8A46 KeSweepLocalCaches = _KeSweepLocalCaches@0
+ 1247 4BB 0011F020 KeSynchronizeExecution = _KeSynchronizeExecution@12
+ 1248 4BC 000EFA6C KeSynchronizeTimeToQpc = _KeSynchronizeTimeToQpc@8
+ 1249 4BD 0018BD68 KeSystemFullyCacheCoherent = _KeSystemFullyCacheCoherent@0
+ 1250 4BE 000C3ABC KeTestAlertThread = _KeTestAlertThread@4
+ 124 4BF 00027BEC KeTestSpinLock = @KeTestSpinLock@4
+ 1251 4C0 0022DE00 KeTickCount = _KeTickCount
+ 125 4C1 000283B6 KeTryToAcquireGuardedMutex = @KeTryToAcquireGuardedMutex@4
+ 126 4C2 00188B5E KeTryToAcquireQueuedSpinLock = @KeTryToAcquireQueuedSpinLock@8
+ 127 4C3 00188BB0 KeTryToAcquireQueuedSpinLockRaiseToSynch = @KeTryToAcquireQueuedSpinLockRaiseToSynch@8
+ 128 4C4 000D46F6 KeTryToAcquireSpinLockAtDpcLevel = @KeTryToAcquireSpinLockAtDpcLevel@4
+ 1252 4C5 000D8894 KeUnstackDetachProcess = _KeUnstackDetachProcess@4
+ 1253 4C6 000E41EA KeUpdateThreadTag = _KeUpdateThreadTag@8
+ 1254 4C7 002847BC KeUserModeCallback = _KeUserModeCallback@20
+ 1255 4C8 0004C8AE KeWaitForMultipleObjects = _KeWaitForMultipleObjects@32
+ 1256 4C9 0004C586 KeWaitForMutexObject = _KeWaitForSingleObject@20
+ 1257 4CA 0004C586 KeWaitForSingleObject = _KeWaitForSingleObject@20
+ 1258 4CB 00241F24 KeWriteProtectPAT = _KeWriteProtectPAT@4
+ 129 4CC 00073862 KefAcquireSpinLockAtDpcLevel = @KefAcquireSpinLockAtDpcLevel@4
+ 130 4CD 0007383E KefReleaseSpinLockFromDpcLevel = @KefReleaseSpinLockFromDpcLevel@4
+ 154 4CE 0011BBEC Kei386EoiHelper = Kei386EoiHelper@0
+ 131 4CF 00053FAA KfAcquireSpinLock = @KfAcquireSpinLock@4
+ 132 4D0 0007DF94 KfReleaseSpinLock = @KfReleaseSpinLock@8
+ 133 4D1 00108822 KiAccumulateCycleStats = @KiAccumulateCycleStats@16
+ 134 4D2 00073862 KiAcquireSpinLock = @KefAcquireSpinLockAtDpcLevel@4
+ 135 4D3 00082408 KiBeginThreadAccountingPeriod = @KiBeginThreadAccountingPeriod@16
+ 1259 4D4 002014A0 KiBugCheckData = _KiBugCheckData
+ 1260 4D5 000C4AF8 KiCheckForKernelApcDelivery = _KiCheckForKernelApcDelivery@0
+ 136 4D6 000AE002 KiCheckForSListAddress = @KiCheckForSListAddress@4
+ 1261 4D7 0005FF5C KiDeliverApc = _KiDeliverApc@12
+ 1262 4D8 0011F2D0 KiDispatchInterrupt = _KiDispatchInterrupt@4
+ 137 4D9 000AE040 KiEndThreadAccountingPeriod = @KiEndThreadAccountingPeriod@16
+ 138 4DA 000CF022 KiEntropyQueueDpc = @KiEntropyQueueDpc@4
+ 1263 4DB 00061748 KiIpiServiceRoutine = _KiIpiServiceRoutine@8
+ 139 4DC 0007383E KiReleaseSpinLock = @KefReleaseSpinLockFromDpcLevel@4
+ 1264 4DD 0011F269 KiUnexpectedInterrupt = _KiUnexpectedInterrupt
+ 1265 4DE 001D520A KitLogFeatureUsage = _KitLogFeatureUsage@12
+ 1266 4DF 00349282 KseQueryDeviceData = _KseQueryDeviceData@20
+ 1267 4E0 00454A49 KseQueryDeviceDataList = _KseQueryDeviceDataList@16
+ 1268 4E1 0034953A KseQueryDeviceFlags = _KseQueryDeviceFlags@12
+ 1269 4E2 0035C19E KseRegisterShim = _KseRegisterShim@12
+ 1270 4E3 0035C1BC KseRegisterShimEx = _KseRegisterShimEx@16
+ 1271 4E4 00454BC0 KseSetDeviceFlags = _KseSetDeviceFlags@16
+ 1272 4E5 00455298 KseUnregisterShim = _KseUnregisterShim@12
+ 1273 4E6 0036527C LdrAccessResource = _LdrAccessResource@16
+ 1274 4E7 004837E0 LdrEnumResources = _LdrEnumResources@20
+ 1275 4E8 00483A15 LdrFindResourceDirectory_U = _LdrFindResourceDirectory_U@16
+ 1276 4E9 00483A36 LdrFindResourceEx_U = _LdrFindResourceEx_U@20
+ 1277 4EA 0036529C LdrFindResource_U = _LdrFindResource_U@16
+ 1278 4EB 00344E04 LdrResFindResource = _LdrResFindResource@36
+ 1279 4EC 003477EC LdrResFindResourceDirectory = _LdrResFindResourceDirectory@28
+ 1280 4ED 0030F824 LdrResSearchResource = _LdrResSearchResource@32
+ 1281 4EE 00219144 LpcPortObjectType = _LpcPortObjectType
+ 1282 4EF 004568A4 LpcReplyWaitReplyPort = _LpcReplyWaitReplyPort@12
+ 1283 4F0 00285238 LpcRequestPort = _LpcRequestPort@8
+ 1284 4F1 0034836C LpcRequestWaitReplyPort = _LpcRequestWaitReplyPort@12
+ 1285 4F2 002EF9DA LpcRequestWaitReplyPortEx = _LpcRequestWaitReplyPortEx@12
+ 1286 4F3 004568C2 LpcSendWaitReceivePort = _LpcSendWaitReceivePort@28
+ 1287 4F4 0048C308 LsaCallAuthenticationPackage = _LsaCallAuthenticationPackage@28
+ 1288 4F5 0048C352 LsaDeregisterLogonProcess = _LsaDeregisterLogonProcess@4
+ 1289 4F6 00307814 LsaFreeReturnBuffer = _LsaFreeReturnBuffer@4
+ 1290 4F7 0048C38B LsaLogonUser = _LsaLogonUser@56
+ 1291 4F8 00378444 LsaLookupAuthenticationPackage = _LsaLookupAuthenticationPackage@12
+ 1292 4F9 00378404 LsaRegisterLogonProcess = _LsaRegisterLogonProcess@12
+ 1293 4FA 00226127 Mm64BitPhysicalAddress = _Mm64BitPhysicalAddress
+ 1294 4FB 00459CCB MmAddPhysicalMemory = _MmAddPhysicalMemory@8
+ 1295 4FC 00459DB7 MmAddVerifierSpecialThunks = _MmAddVerifierSpecialThunks@12
+ 1296 4FD 00459E83 MmAddVerifierThunks = _MmAddVerifierThunks@8
+ 1297 4FE 00194704 MmAdjustWorkingSetSize = _MmAdjustWorkingSetSize@16
+ 1298 4FF 00194C2A MmAdvanceMdl = _MmAdvanceMdl@8
+ 1299 500 00195091 MmAllocateContiguousMemory = _MmAllocateContiguousMemory@12
+ 1300 501 000F8690 MmAllocateContiguousMemorySpecifyCache = _MmAllocateContiguousMemorySpecifyCache@32
+ 1301 502 000F86C0 MmAllocateContiguousMemorySpecifyCacheNode = _MmAllocateContiguousMemorySpecifyCacheNode@36
+ 1302 503 000DF984 MmAllocateContiguousNodeMemory = _MmAllocateContiguousNodeMemory@36
+ 1303 504 00331524 MmAllocateMappingAddress = _MmAllocateMappingAddress@8
+ 1304 505 0019568A MmAllocateMdlForIoSpace = _MmAllocateMdlForIoSpace@12
+ 1305 506 00195C41 MmAllocateNodePagesForMdlEx = _MmAllocateNodePagesForMdlEx@40
+ 1306 507 00459F60 MmAllocateNonCachedMemory = _MmAllocateNonCachedMemory@4
+ 1307 508 00106730 MmAllocatePagesForMdl = _MmAllocatePagesForMdl@28
+ 1308 509 000BDC0A MmAllocatePagesForMdlEx = _MmAllocatePagesForMdlEx@36
+ 1309 50A 000BDC60 MmAllocatePartitionNodePagesForMdlEx = _MmAllocatePartitionNodePagesForMdlEx@44
+ 1310 50B 000C2D68 MmAreMdlPagesCached = _MmAreMdlPagesCached@4
+ 1311 50C 002261F0 MmBadPointer = _MmBadPointer
+ 1312 50D 000353D6 MmBuildMdlForNonPagedPool = _MmBuildMdlForNonPagedPool@4
+ 1313 50E 00082B00 MmCanFileBeTruncated = _MmCanFileBeTruncated@8
+ 1314 50F 002C6FCC MmChangeImageProtection = _MmChangeImageProtection@16
+ 1315 510 002FDB46 MmCommitSessionMappedView = _MmCommitSessionMappedView@8
+ 1316 511 00196331 MmCopyMemory = _MmCopyMemory@24
+ 1317 512 00290C1C MmCopyVirtualMemory = _MmCopyVirtualMemory@28
+ 1318 513 000C9672 MmCreateMdl = _MmCreateMdl@12
+ 1319 514 0045A5EB MmCreateMirror = _MmCreateMirror@0
+ 1320 515 002A35F8 MmCreateSection = _MmCreateSection@32
+ 1321 516 000896F0 MmDisableModifiedWriteOfSection = _MmDisableModifiedWriteOfSection@4
+ 1322 517 000688CC MmDoesFileHaveUserWritableReferences = _MmDoesFileHaveUserWritableReferences@4
+ 1323 518 000B7860 MmFlushImageSection = _MmFlushImageSection@8
+ 1324 519 000B7948 MmForceSectionClosed = _MmForceSectionClosed@8
+ 1325 51A 000DF560 MmFreeContiguousMemory = _MmFreeContiguousMemory@4
+ 1326 51B 000E8A4E MmFreeContiguousMemorySpecifyCache = _MmFreeContiguousMemorySpecifyCache@12
+ 1327 51C 0033146E MmFreeMappingAddress = _MmFreeMappingAddress@8
+ 1328 51D 0045A05A MmFreeNonCachedMemory = _MmFreeNonCachedMemory@8
+ 1329 51E 000B1B86 MmFreePagesFromMdl = _MmFreePagesFromMdl@4
+ 1330 51F 00195C79 MmFreePagesFromMdlEx = _MmFreePagesFromMdlEx@8
+ 1331 520 0019576F MmGetCacheAttribute = _MmGetCacheAttribute@12
+ 1332 521 004586B8 MmGetMaximumFileSectionSize = _MmGetMaximumFileSectionSize@0
+ 1333 522 00034A40 MmGetPhysicalAddress = _MmGetPhysicalAddress@4
+ 1334 523 00301DC0 MmGetPhysicalMemoryRanges = _MmGetPhysicalMemoryRanges@0
+ 1335 524 00301DCE MmGetPhysicalMemoryRangesEx = _MmGetPhysicalMemoryRangesEx@4
+ 1336 525 002CAC7A MmGetSystemRoutineAddress = _MmGetSystemRoutineAddress@4
+ 1337 526 001957EF MmGetVirtualForPhysical = _MmGetVirtualForPhysical@8
+ 1338 527 0019721A MmGrowKernelStack = _MmGrowKernelStack@4
+ 1339 528 002261E8 MmHighestUserAddress = _MmHighestUserAddress
+ 1340 529 00197235 MmIsAddressValid = _MmIsAddressValid@4
+ 1341 52A 004F68FE MmIsDriverSuspectForVerifier = _MmIsDriverSuspectForVerifier@4
+ 1342 52B 00029DC4 MmIsDriverVerifying = _MmIsDriverVerifying@4
+ 1343 52C 00374850 MmIsDriverVerifyingByAddress = _MmIsDriverVerifyingByAddress@4
+ 1344 52D 00197600 MmIsIoSpaceActive = _MmIsIoSpaceActive@12
+ 1345 52E 0019724B MmIsNonPagedSystemAddressValid = _MmIsNonPagedSystemAddressValid@4
+ 1346 52F 0008F736 MmIsRecursiveIoFault = _MmIsRecursiveIoFault@0
+ 1347 530 00085B6E MmIsThisAnNtAsSystem = _MmIsThisAnNtAsSystem@0
+ 1348 531 004F67B0 MmIsVerifierEnabled = _MmIsVerifierEnabled@4
+ 1349 532 0025C7E4 MmLoadSystemImage = _MmLoadSystemImage@24
+ 1350 533 002C7848 MmLockPagableDataSection = _MmLockPagableDataSection@4
+ 1351 534 002C7848 MmLockPagableImageSection = _MmLockPagableDataSection@4
+ 1352 535 002C6E80 MmLockPagableSectionByHandle = _MmLockPagableSectionByHandle@4
+ 1353 536 000DFD1E MmMapIoSpace = _MmMapIoSpace@16
+ 1354 537 000E0272 MmMapIoSpaceEx = _MmMapIoSpaceEx@16
+ 1355 538 0019542F MmMapLockedPages = _MmMapLockedPages@8
+ 1356 539 0004E16A MmMapLockedPagesSpecifyCache = _MmMapLockedPagesSpecifyCache@24
+ 1357 53A 00195450 MmMapLockedPagesWithReservedMapping = _MmMapLockedPagesWithReservedMapping@16
+ 1358 53B 000E95D2 MmMapMemoryDumpMdl = _MmMapMemoryDumpMdl@4
+ 1359 53C 00241F9D MmMapUserAddressesToPage = _MmMapUserAddressesToPage@12
+ 1360 53D 000DFD1E MmMapVideoDisplay = _MmMapIoSpace@16
+ 1361 53E 002FCA0C MmMapViewInSessionSpace = _MmMapViewInSessionSpace@12
+ 1362 53F 002FCA3A MmMapViewInSessionSpaceEx = _MmMapViewInSessionSpaceEx@20
+ 1363 540 002CCDBC MmMapViewInSystemSpace = _MmMapViewInSystemSpace@12
+ 1364 541 00302978 MmMapViewInSystemSpaceEx = _MmMapViewInSystemSpaceEx@20
+ 1365 542 002A32A2 MmMapViewOfSection = _MmMapViewOfSection@40
+ 1366 543 001942A9 MmMarkPhysicalMemoryAsBad = _MmMarkPhysicalMemoryAsBad@8
+ 1367 544 00194551 MmMarkPhysicalMemoryAsGood = _MmMarkPhysicalMemoryAsGood@8
+ 1368 545 000C9512 MmMdlPageContentsState = _MmMdlPageContentsState@8
+ 1369 546 000D0B60 MmMdlPagesAreZero = _MmMdlPagesAreZero@4
+ 1370 547 002C7BA8 MmPageEntireDriver = _MmPageEntireDriver@4
+ 1371 548 001FD850 MmPartitionObjectType = _MmPartitionObjectType
+ 1372 549 002C6172 MmPrefetchPages = _MmPrefetchPages@8
+ 1373 54A 002D6C1C MmPrefetchVirtualAddresses = _MmPrefetchVirtualAddresses@4
+ 1374 54B 00042A02 MmProbeAndLockPages = _MmProbeAndLockPages@12
+ 1375 54C 002E563C MmProbeAndLockProcessPages = _MmProbeAndLockProcessPages@16
+ 1376 54D 000A2280 MmProbeAndLockSelectedPages = _MmProbeAndLockSelectedPages@16
+ 1377 54E 00195823 MmProtectMdlSystemAddress = _MmProtectMdlSystemAddress@8
+ 1378 54F 000F94E4 MmQuerySystemSize = _MmQuerySystemSize@0
+ 1379 550 00459D1E MmRemovePhysicalMemory = _MmRemovePhysicalMemory@8
+ 1380 551 002C7740 MmResetDriverPaging = _MmResetDriverPaging@4
+ 1381 552 0032C92E MmRotatePhysicalView = _MmRotatePhysicalView@24
+ 1382 553 002261E4 MmSectionObjectType = _MmSectionObjectType
+ 1383 554 002B4876 MmSecureVirtualMemory = _MmSecureVirtualMemory@12
+ 1384 555 000867E4 MmSetAddressRangeModified = _MmSetAddressRangeModified@8
+ 1385 556 001177D2 MmSetBankedSection = _MmSetBankedSection@24
+ 1386 557 0045ADFE MmSetPermanentCacheAttribute = _MmSetPermanentCacheAttribute@24
+ 1387 558 000DF234 MmSizeOfMdl = _MmSizeOfMdl@8
+ 1388 559 002261EC MmSystemRangeStart = _MmSystemRangeStart
+ 1389 55A 00199EF3 MmTrimAllSystemPagableMemory = _MmTrimAllSystemPagableMemory@4
+ 1390 55B 00347B04 MmUnloadSystemImage = _MmUnloadSystemImage@4
+ 1391 55C 0009DBC4 MmUnlockPagableImageSection = _MmUnlockPagableImageSection@4
+ 1392 55D 00043000 MmUnlockPages = _MmUnlockPages@4
+ 1393 55E 000E001E MmUnmapIoSpace = _MmUnmapIoSpace@8
+ 1394 55F 0004241C MmUnmapLockedPages = _MmUnmapLockedPages@8
+ 1395 560 00195545 MmUnmapReservedMapping = _MmUnmapReservedMapping@12
+ 1396 561 000E001E MmUnmapVideoDisplay = _MmUnmapIoSpace@8
+ 1397 562 002C2630 MmUnmapViewInSessionSpace = _MmUnmapViewInSessionSpace@4
+ 1398 563 002C41FE MmUnmapViewInSystemSpace = _MmUnmapViewInSystemSpace@4
+ 1399 564 002F6F40 MmUnmapViewOfSection = _MmUnmapViewOfSection@8
+ 1400 565 002B25B4 MmUnsecureVirtualMemory = _MmUnsecureVirtualMemory@4
+ 1401 566 002261F4 MmUserProbeAddress = _MmUserProbeAddress
+ 1402 567 00535010 NlsAnsiCodePage = _NlsAnsiCodePage
+ 1403 568 004E2CAC NlsLeadByteInfo = _NlsLeadByteInfo
+ 1404 569 00534D7F NlsMbCodePageTag = _NlsMbCodePageTag
+ 1405 56A 00534D7E NlsMbOemCodePageTag = _NlsMbOemCodePageTag
+ 1406 56B 00535024 NlsOemCodePage = _NlsOemCodePage
+ 1407 56C 004E2AB4 NlsOemLeadByteInfo = _NlsOemLeadByteInfo
+ 1408 56D 004B7A34 NtAddAtom = _NtAddAtom@12
+ 1409 56E 0031721A NtAdjustPrivilegesToken = _NtAdjustPrivilegesToken@24
+ 1410 56F 002E4A24 NtAllocateLocallyUniqueId = _NtAllocateLocallyUniqueId@4
+ 1411 570 002FBCAE NtAllocateUuids = _NtAllocateUuids@16
+ 1412 571 0029E1B6 NtAllocateVirtualMemory = _NtAllocateVirtualMemory@24
+ 1413 572 004E1A70 NtBuildGUID = _NtBuildGUID
+ 1414 573 00204FC0 NtBuildLab = _NtBuildLab
+ 1415 574 004E1A68 NtBuildNumber = _NtBuildNumber
+ 1416 575 00293F64 NtClose = _NtClose@4
+ 1417 576 00024422 NtCommitComplete = _NtCommitComplete@8
+ 1418 577 0002442E NtCommitEnlistment = _NtCommitEnlistment@8
+ 1419 578 0002443A NtCommitTransaction = _NtCommitTransaction@8
+ 1420 579 002452EC NtCompareSigningLevels = _NtCompareSigningLevels@8
+ 1421 57A 002AE13A NtConnectPort = _NtConnectPort@32
+ 1422 57B 00024446 NtCreateEnlistment = _NtCreateEnlistment@32
+ 1423 57C 00277E1C NtCreateEvent = _NtCreateEvent@20
+ 1424 57D 00262518 NtCreateFile = _NtCreateFile@44
+ 1425 57E 00024452 NtCreateResourceManager = _NtCreateResourceManager@28
+ 1426 57F 002A341E NtCreateSection = _NtCreateSection@28
+ 1427 580 0002445E NtCreateTransaction = _NtCreateTransaction@40
+ 1428 581 0002446A NtCreateTransactionManager = _NtCreateTransactionManager@24
+ 1429 582 002FEAE6 NtDeleteAtom = _NtDeleteAtom@4
+ 1430 583 0037547C NtDeleteFile = _NtDeleteFile@4
+ 1431 584 00285FB0 NtDeviceIoControlFile = _NtDeviceIoControlFile@40
+ 1432 585 002A368A NtDuplicateObject = _NtDuplicateObject@28
+ 1433 586 0031E70C NtDuplicateToken = _NtDuplicateToken@24
+ 1434 587 00024476 NtEnumerateTransactionObject = _NtEnumerateTransactionObject@20
+ 1435 588 002B280E NtFindAtom = _NtFindAtom@12
+ 1436 589 002A07C6 NtFreeVirtualMemory = _NtFreeVirtualMemory@16
+ 1437 58A 00024482 NtFreezeTransactions = _NtFreezeTransactions@8
+ 1438 58B 002EAAE8 NtFsControlFile = _NtFsControlFile@40
+ 1439 58C 004B5F34 NtGetEnvironmentVariableEx = _NtGetEnvironmentVariableEx@20
+ 1440 58D 0002448E NtGetNotificationResourceManager = _NtGetNotificationResourceManager@28
+ 1441 58E 00204FA0 NtGlobalFlag = _NtGlobalFlag
+ 1442 58F 004E1A4C NtImageInfo = _NtImageInfo
+ 1443 590 0027F6C8 NtLockFile = _NtLockFile@40
+ 1444 591 00246A82 NtMakePermanentObject = _NtMakePermanentObject@4
+ 1445 592 002A2EF0 NtMapViewOfSection = _NtMapViewOfSection@40
+ 1446 593 002F8624 NtNotifyChangeDirectoryFile = _NtNotifyChangeDirectoryFile@36
+ 1447 594 0002449A NtOpenEnlistment = _NtOpenEnlistment@20
+ 1448 595 0030EF4A NtOpenFile = _NtOpenFile@24
+ 1449 596 002758CC NtOpenProcess = _NtOpenProcess@16
+ 1450 597 00272112 NtOpenProcessToken = _NtOpenProcessToken@12
+ 1451 598 0027581A NtOpenProcessTokenEx = _NtOpenProcessTokenEx@16
+ 1452 599 000244A6 NtOpenResourceManager = _NtOpenResourceManager@20
+ 1453 59A 002E4BC6 NtOpenThread = _NtOpenThread@16
+ 1454 59B 00275DB4 NtOpenThreadToken = _NtOpenThreadToken@16
+ 1455 59C 00275DD6 NtOpenThreadTokenEx = _NtOpenThreadTokenEx@20
+ 1456 59D 000244B2 NtOpenTransaction = _NtOpenTransaction@20
+ 1457 59E 000244BE NtOpenTransactionManager = _NtOpenTransactionManager@24
+ 1458 59F 000244CA NtPrePrepareComplete = _NtPrePrepareComplete@8
+ 1459 5A0 000244D6 NtPrePrepareEnlistment = _NtPrePrepareEnlistment@8
+ 1460 5A1 000244E2 NtPrepareComplete = _NtPrepareComplete@8
+ 1461 5A2 000244EE NtPrepareEnlistment = _NtPrepareEnlistment@8
+ 1462 5A3 000244FA NtPropagationComplete = _NtPropagationComplete@16
+ 1463 5A4 00024506 NtPropagationFailed = _NtPropagationFailed@12
+ 1464 5A5 002DE358 NtQueryDirectoryFile = _NtQueryDirectoryFile@44
+ 1465 5A6 002EB676 NtQueryEaFile = _NtQueryEaFile@36
+ 1466 5A7 004B661C NtQueryEnvironmentVariableInfoEx = _NtQueryEnvironmentVariableInfoEx@16
+ 1467 5A8 002AF142 NtQueryInformationAtom = _NtQueryInformationAtom@20
+ 1468 5A9 00024512 NtQueryInformationEnlistment = _NtQueryInformationEnlistment@20
+ 1469 5AA 002940F2 NtQueryInformationFile = _NtQueryInformationFile@20
+ 1470 5AB 0028CBB0 NtQueryInformationProcess = _NtQueryInformationProcess@20
+ 1471 5AC 0002451E NtQueryInformationResourceManager = _NtQueryInformationResourceManager@20
+ 1472 5AD 00292DE4 NtQueryInformationThread = _NtQueryInformationThread@20
+ 1473 5AE 0028EC00 NtQueryInformationToken = _NtQueryInformationToken@20
+ 1474 5AF 0002452A NtQueryInformationTransaction = _NtQueryInformationTransaction@20
+ 1475 5B0 00024536 NtQueryInformationTransactionManager = _NtQueryInformationTransactionManager@20
+ 1476 5B1 0042BA74 NtQueryQuotaInformationFile = _NtQueryQuotaInformationFile@36
+ 1477 5B2 0027AB18 NtQuerySecurityAttributesToken = _NtQuerySecurityAttributesToken@24
+ 1478 5B3 00318936 NtQuerySecurityObject = _NtQuerySecurityObject@20
+ 1479 5B4 00273C26 NtQuerySystemInformation = _NtQuerySystemInformation@16
+ 1480 5B5 002F1DF2 NtQuerySystemInformationEx = _NtQuerySystemInformationEx@24
+ 1481 5B6 00285FE4 NtQueryVolumeInformationFile = _NtQueryVolumeInformationFile@20
+ 1482 5B7 0028644C NtReadFile = _NtReadFile@36
+ 1483 5B8 00024542 NtReadOnlyEnlistment = _NtReadOnlyEnlistment@8
+ 1484 5B9 0002454E NtRecoverEnlistment = _NtRecoverEnlistment@8
+ 1485 5BA 0002455A NtRecoverResourceManager = _NtRecoverResourceManager@4
+ 1486 5BB 00024566 NtRecoverTransactionManager = _NtRecoverTransactionManager@4
+ 1487 5BC 00305054 NtRequestPort = _NtRequestPort@8
+ 1488 5BD 002EFA10 NtRequestWaitReplyPort = _NtRequestWaitReplyPort@12
+ 1489 5BE 00024572 NtRollbackComplete = _NtRollbackComplete@8
+ 1490 5BF 0002457E NtRollbackEnlistment = _NtRollbackEnlistment@8
+ 1491 5C0 0002458A NtRollbackTransaction = _NtRollbackTransaction@8
+ 1492 5C1 002F9380 NtSetCachedSigningLevel = _NtSetCachedSigningLevel@20
+ 1493 5C2 0042B528 NtSetEaFile = _NtSetEaFile@16
+ 1494 5C3 002DE6A2 NtSetEvent = _NtSetEvent@8
+ 1495 5C4 00024596 NtSetInformationEnlistment = _NtSetInformationEnlistment@16
+ 1496 5C5 0005D746 NtSetInformationFile = _NtSetInformationFile@20
+ 1497 5C6 002E02A0 NtSetInformationProcess = _NtSetInformationProcess@16
+ 1498 5C7 000245A2 NtSetInformationResourceManager = _NtSetInformationResourceManager@16
+ 1499 5C8 00276B8A NtSetInformationThread = _NtSetInformationThread@16
+ 1500 5C9 0031ED74 NtSetInformationToken = _NtSetInformationToken@16
+ 1501 5CA 000245AE NtSetInformationTransaction = _NtSetInformationTransaction@16
+ 1502 5CB 002AFDF0 NtSetInformationVirtualMemory = _NtSetInformationVirtualMemory@24
+ 1503 5CC 0042BF7D NtSetQuotaInformationFile = _NtSetQuotaInformationFile@16
+ 1504 5CD 002ED77A NtSetSecurityObject = _NtSetSecurityObject@12
+ 1505 5CE 0032EC70 NtSetVolumeInformationFile = _NtSetVolumeInformationFile@20
+ 1506 5CF 004B0E2D NtShutdownSystem = _NtShutdownSystem@4
+ 1507 5D0 000245BA NtThawTransactions = _NtThawTransactions@0
+ 1508 5D1 002A6668 NtTraceControl = _NtTraceControl@24
+ 1509 5D2 00072DFE NtTraceEvent = _NtTraceEvent@16
+ 1510 5D3 002EC70E NtUnlockFile = _NtUnlockFile@20
+ 1511 5D4 0049DDC2 NtVdmControl = _NtVdmControl@8
+ 1512 5D5 0029044A NtWaitForSingleObject = _NtWaitForSingleObject@12
+ 1513 5D6 002D227A NtWriteFile = _NtWriteFile@36
+ 1514 5D7 003079EC ObAssignSecurity = _ObAssignSecurity@16
+ 1515 5D8 002EE57A ObCheckCreateObjectAccess = _ObCheckCreateObjectAccess@28
+ 1516 5D9 0029F0B8 ObCheckObjectAccess = _ObCheckObjectAccess@20
+ 1517 5DA 002825A8 ObCloseHandle = _ObCloseHandle@8
+ 1518 5DB 002A465C ObCreateObject = _ObCreateObject@36
+ 1519 5DC 0035AF64 ObCreateObjectType = _ObCreateObjectType@16
+ 1520 5DD 002B712A ObDeleteCapturedInsertInfo = _ObDeleteCapturedInsertInfo@4
+ 1521 5DE 000CD96C ObDereferenceObject = _ObDereferenceObject@4
+ 1522 5DF 000C2D1E ObDereferenceObjectDeferDelete = _ObDereferenceObjectDeferDelete@4
+ 1523 5E0 0005CA1C ObDereferenceObjectDeferDeleteWithTag = _ObDereferenceObjectDeferDeleteWithTag@8
+ 1524 5E1 0029F20C ObDereferenceSecurityDescriptor = _ObDereferenceSecurityDescriptor@8
+ 1525 5E2 002A39D4 ObDuplicateObject = _ObDuplicateObject@32
+ 1526 5E3 002DB266 ObFindHandleForObject = _ObFindHandleForObject@20
+ 1527 5E4 0046442A ObGetFilterVersion = _ObGetFilterVersion@0
+ 1528 5E5 002FE534 ObGetObjectSecurity = _ObGetObjectSecurity@12
+ 1529 5E6 002FB312 ObGetObjectType = _ObGetObjectType@4
+ 1530 5E7 00277DF4 ObInsertObject = _ObInsertObject@24
+ 1531 5E8 00374F60 ObIsDosDeviceLocallyMapped = _ObIsDosDeviceLocallyMapped@8
+ 1532 5E9 000E892E ObIsKernelHandle = _ObIsKernelHandle@4
+ 1533 5EA 002784F2 ObLogSecurityDescriptor = _ObLogSecurityDescriptor@12
+ 1534 5EB 00306D0C ObMakeTemporaryObject = _ObMakeTemporaryObject@4
+ 1535 5EC 002C0C2C ObOpenObjectByName = _ObOpenObjectByName@28
+ 1536 5ED 0029214C ObOpenObjectByNameEx = _ObOpenObjectByNameEx@32
+ 1537 5EE 002760BC ObOpenObjectByPointer = _ObOpenObjectByPointer@28
+ 1538 5EF 00463654 ObOpenObjectByPointerWithTag = _ObOpenObjectByPointerWithTag@32
+ 1539 5F0 002F47D0 ObQueryNameInfo = _ObQueryNameInfo@4
+ 1540 5F1 002AF06E ObQueryNameString = _ObQueryNameString@16
+ 1541 5F2 002F3ACC ObQueryObjectAuditingByHandle = _ObQueryObjectAuditingByHandle@8
+ 1542 5F3 002964E6 ObReferenceObjectByHandle = _ObReferenceObjectByHandle@24
+ 1543 5F4 00295F20 ObReferenceObjectByHandleWithTag = _ObReferenceObjectByHandleWithTag@28
+ 1544 5F5 002A7BCC ObReferenceObjectByName = _ObReferenceObjectByName@32
+ 1545 5F6 0002C2B0 ObReferenceObjectByPointer = _ObReferenceObjectByPointer@16
+ 1546 5F7 0002C2D4 ObReferenceObjectByPointerWithTag = _ObReferenceObjectByPointerWithTag@20
+ 140 5F8 000C2040 ObReferenceObjectSafe = @ObReferenceObjectSafe@4
+ 141 5F9 0005DF62 ObReferenceObjectSafeWithTag = @ObReferenceObjectSafeWithTag@8
+ 1547 5FA 002FD966 ObReferenceSecurityDescriptor = _ObReferenceSecurityDescriptor@8
+ 1548 5FB 00372F72 ObRegisterCallbacks = _ObRegisterCallbacks@8
+ 1549 5FC 0029F1DE ObReleaseObjectSecurity = _ObReleaseObjectSecurity@8
+ 1550 5FD 002DEBA8 ObSetHandleAttributes = _ObSetHandleAttributes@12
+ 1551 5FE 0026F482 ObSetSecurityDescriptorInfo = _ObSetSecurityDescriptorInfo@24
+ 1552 5FF 0026F200 ObSetSecurityObjectByPointer = _ObSetSecurityObjectByPointer@12
+ 1553 600 00464435 ObUnRegisterCallbacks = _ObUnRegisterCallbacks@4
+ 1554 601 002900A6 ObWaitForMultipleObjects = _ObWaitForMultipleObjects@28
+ 1555 602 0033B7A6 ObWaitForSingleObject = _ObWaitForSingleObject@20
+ 142 603 0005DEA6 ObfDereferenceObject = @ObfDereferenceObject@4
+ 143 604 0005DEC2 ObfDereferenceObjectWithTag = @ObfDereferenceObjectWithTag@8
+ 144 605 0005E5CC ObfReferenceObject = @ObfReferenceObject@4
+ 145 606 0005E5E0 ObfReferenceObjectWithTag = @ObfReferenceObjectWithTag@8
+ 1556 607 00211CA4 POGOBuffer = _POGOBuffer
+ 1557 608 00319B92 PcwAddInstance = _PcwAddInstance@20
+ 1558 609 004B7AE0 PcwCloseInstance = _PcwCloseInstance@4
+ 1559 60A 00375900 PcwCreateInstance = _PcwCreateInstance@20
+ 1560 60B 0036B4F2 PcwRegister = _PcwRegister@8
+ 1561 60C 004B7B0E PcwUnregister = _PcwUnregister@4
+ 1562 60D 0003DEE2 PfFileInfoNotify = _PfFileInfoNotify@4
+ 1563 60E 004854AF PfxFindPrefix = _PfxFindPrefix@8
+ 1564 60F 0048554B PfxInitialize = _PfxInitialize@4
+ 1565 610 00485565 PfxInsertPrefix = _PfxInsertPrefix@12
+ 1566 611 0048564B PfxRemovePrefix = _PfxRemovePrefix@8
+ 1567 612 000F7D6E PoCallDriver = _IoCallDriver@8
+ 1568 613 000E3C46 PoCancelDeviceNotify = _PoCancelDeviceNotify@4
+ 1569 614 000B338E PoClearPowerRequest = _PoClearPowerRequest@8
+ 1570 615 000BBD70 PoCpuIdledSinceLastCallImprecise = _PoCpuIdledSinceLastCallImprecise@8
+ 1571 616 002DC458 PoCreatePowerRequest = _PoCreatePowerRequest@12
+ 1572 617 0034CC4E PoCreateThermalRequest = _PoCreateThermalRequest@20
+ 1573 618 0030784E PoDeletePowerRequest = _PoDeletePowerRequest@4
+ 1574 619 00469B5B PoDeleteThermalRequest = _PoDeleteThermalRequest@4
+ 1575 61A 0046A2B4 PoDisableSleepStates = _PoDisableSleepStates@12
+ 1576 61B 001AB515 PoEndDeviceBusy = _PoEndDeviceBusy@4
+ 1577 61C 00058296 PoEnergyEstimationEnabled = _PoEnergyEstimationEnabled@0
+ 1578 61D 000E24FA PoFxActivateComponent = _PoFxActivateComponent@12
+ 1579 61E 000F94B8 PoFxCompleteDevicePowerNotRequired = _PoFxCompleteDevicePowerNotRequired@4
+ 1580 61F 000CFA60 PoFxCompleteIdleCondition = _PoFxCompleteIdleCondition@8
+ 1581 620 000F8C5A PoFxCompleteIdleState = _PoFxCompleteIdleState@8
+ 1582 621 00467186 PoFxEnableDStateReporting = _PoFxEnableDStateReporting@4
+ 1583 622 000E29F2 PoFxIdleComponent = _PoFxIdleComponent@12
+ 1584 623 001A6824 PoFxIssueComponentPerfStateChange = _PoFxIssueComponentPerfStateChange@20
+ 1585 624 001A6848 PoFxIssueComponentPerfStateChangeMultiple = _PoFxIssueComponentPerfStateChangeMultiple@24
+ 1586 625 000EEE6E PoFxNotifySurprisePowerOn = _PoFxNotifySurprisePowerOn@4
+ 1587 626 000EF402 PoFxPowerControl = _PoFxPowerControl@28
+ 1588 627 001A68B1 PoFxPowerOnCrashdumpDevice = _PoFxPowerOnCrashdumpDevice@8
+ 1589 628 00107ACE PoFxProcessorNotification = _PoFxProcessorNotification@12
+ 1590 629 001A68FC PoFxQueryCurrentComponentPerfState = _PoFxQueryCurrentComponentPerfState@20
+ 1591 62A 00467232 PoFxRegisterComponentPerfStates = _PoFxRegisterComponentPerfStates@28
+ 1592 62B 003549E0 PoFxRegisterCoreDevice = _PoFxRegisterCoreDevice@12
+ 1593 62C 003484C0 PoFxRegisterCrashdumpDevice = _PoFxRegisterCrashdumpDevice@4
+ 1594 62D 00354AAC PoFxRegisterDevice = _PoFxRegisterDevice@12
+ 1595 62E 001084D4 PoFxRegisterDripsWatchdogCallback = _PoFxRegisterDripsWatchdogCallback@16
+ 1596 62F 00467294 PoFxRegisterPlugin = _PoFxRegisterPlugin@8
+ 1597 630 001A6947 PoFxRegisterPluginEx = _PoFxRegisterPluginEx@16
+ 1598 631 004672B1 PoFxRegisterPrimaryDevice = _PoFxRegisterPrimaryDevice@12
+ 1599 632 000EE528 PoFxReportDevicePoweredOn = _PoFxReportDevicePoweredOn@4
+ 1600 633 000FB2CA PoFxSetComponentLatency = _PoFxSetComponentLatency@16
+ 1601 634 00107D18 PoFxSetComponentResidency = _PoFxSetComponentResidency@16
+ 1602 635 001A6966 PoFxSetComponentWake = _PoFxSetComponentWake@12
+ 1603 636 0010508A PoFxSetDeviceIdleTimeout = _PoFxSetDeviceIdleTimeout@12
+ 1604 637 00103C1C PoFxStartDevicePowerManagement = _PoFxStartDevicePowerManagement@4
+ 1605 638 00467368 PoFxUnregisterDevice = _PoFxUnregisterDevice@4
+ 1606 639 001A8E6D PoGetProcessorIdleAccounting = _PoGetProcessorIdleAccounting@4
+ 1607 63A 000EF97E PoGetSystemWake = _PoGetSystemWake@4
+ 1608 63B 00375246 PoGetThermalRequestSupport = _PoGetThermalRequestSupport@8
+ 1609 63C 001A8EAB PoInitiateProcessorWake = _PoInitiateProcessorWake@4
+ 1610 63D 000E4C5A PoLatencySensitivityHint = _PoLatencySensitivityHint@4
+ 146 63E 000E4852 PoNotifyMediaBuffering = @PoNotifyMediaBuffering@4
+ 147 63F 000DDDDA PoNotifyVSyncChange = @PoNotifyVSyncChange@4
+ 1611 640 000C9CC2 PoQueryWatchdogTime = _PoQueryWatchdogTime@8
+ 1612 641 0046A7B3 PoQueueShutdownWorkItem = _PoQueueShutdownWorkItem@4
+ 1613 642 0046A331 PoReenableSleepStates = _PoReenableSleepStates@4
+ 1614 643 003697C2 PoRegisterCoalescingCallback = _PoRegisterCoalescingCallback@16
+ 1615 644 000D61BA PoRegisterDeviceForIdleDetection = _PoRegisterDeviceForIdleDetection@16
+ 1616 645 001177D2 PoRegisterDeviceNotify = _MmSetBankedSection@24
+ 1617 646 00327E16 PoRegisterPowerSettingCallback = _PoRegisterPowerSettingCallback@20
+ 1618 647 001AB8C5 PoRegisterSystemState = _PoRegisterSystemState@8
+ 1619 648 000F2D76 PoRequestPowerIrp = _PoRequestPowerIrp@24
+ 1620 649 0036AB02 PoRequestShutdownEvent = _PoRequestShutdownEvent@4
+ 1621 64A 001AB52A PoSetDeviceBusyEx = _PoSetDeviceBusyEx@4
+ 1622 64B 0023796C PoSetFixedWakeSource = _PoSetFixedWakeSource@4
+ 1623 64C 000EB20C PoSetHiberRange = _PoSetHiberRange@20
+ 1624 64D 001AB323 PoSetPowerButtonHoldState = _PoSetPowerButtonHoldState@4
+ 1625 64E 000B2E10 PoSetPowerRequest = _PoSetPowerRequest@8
+ 1626 64F 000F5BCA PoSetPowerState = _PoSetPowerState@12
+ 1627 650 001AB963 PoSetSystemState = _PoSetSystemState@4
+ 1628 651 001A8D24 PoSetSystemWake = _PoSetSystemWake@4
+ 1629 652 001A8D4F PoSetSystemWakeDevice = _PoSetSystemWakeDevice@4
+ 1630 653 00469B88 PoSetThermalActiveCooling = _PoSetThermalActiveCooling@8
+ 1631 654 00469C21 PoSetThermalPassiveCooling = _PoSetThermalPassiveCooling@8
+ 1632 655 000F8D9C PoSetUserPresent = _PoSetUserPresent@4
+ 1633 656 0046B207 PoShutdownBugCheck = _PoShutdownBugCheck@24
+ 1634 657 001AB53F PoStartDeviceBusy = _PoStartDeviceBusy@4
+ 1635 658 000E3D82 PoStartNextPowerIrp = _ExCleanupRundownProtectionCacheAware@4
+ 1636 659 0046A80F PoUnregisterCoalescingCallback = _PoUnregisterCoalescingCallback@4
+ 1637 65A 00330392 PoUnregisterPowerSettingCallback = _PoUnregisterPowerSettingCallback@4
+ 1638 65B 001AB99A PoUnregisterSystemState = _PoUnregisterSystemState@4
+ 1639 65C 00337B2C PoUserShutdownCancelled = _PoUserShutdownCancelled@0
+ 1640 65D 00337A64 PoUserShutdownInitiated = _PoUserShutdownInitiated@0
+ 1641 65E 002E5602 ProbeForRead = _ProbeForRead@12
+ 1642 65F 00291DB6 ProbeForWrite = _ProbeForWrite@12
+ 1643 660 002EC4EC PsAcquireProcessExitSynchronization = _PsAcquireProcessExitSynchronization@4
+ 1644 661 001B4C6F PsAcquireSiloHardReference = _PsAcquireSiloHardReference@4
+ 1645 662 0035AC30 PsAllocSiloContextSlot = _PsAllocSiloContextSlot@8
+ 1646 663 002774D2 PsAssignImpersonationToken = _PsAssignImpersonationToken@8
+ 1647 664 003212CE PsAssignProcessToJobObject = _PsAssignProcessToJobObject@12
+ 1648 665 00029CA4 PsAttachSiloToCurrentThread = _PsAttachSiloToCurrentThread@4
+ 1649 666 000C39FC PsChargePoolQuota = _PsChargePoolQuota@12
+ 1650 667 000627AC PsChargeProcessNonPagedPoolQuota = _PsChargeProcessNonPagedPoolQuota@8
+ 1651 668 00319748 PsChargeProcessPagedPoolQuota = _PsChargeProcessPagedPoolQuota@8
+ 1652 669 0005F5C6 PsChargeProcessPoolQuota = _PsChargeProcessPoolQuota@12
+ 1653 66A 0028AF22 PsChargeProcessWakeCounter = _PsChargeProcessWakeCounter@16
+ 1654 66B 00359306 PsCreateSiloContext = _PsCreateSiloContext@20
+ 1655 66C 002D7694 PsCreateSystemThread = _PsCreateSystemThread@28
+ 1656 66D 002D76C6 PsCreateSystemThreadEx = _PsCreateSystemThreadEx@36
+ 1657 66E 002FD6BA PsDereferenceImpersonationToken = _PsDereferenceImpersonationToken@4
+ 1658 66F 00306A26 PsDereferenceKernelStack = _PsDereferenceKernelStack@4
+ 1659 670 002FB2FC PsDereferencePrimaryToken = _IoDeleteController@4
+ 1660 671 000D574E PsDereferenceSiloContext = _PsDereferenceSiloContext@4
+ 1661 672 00029C86 PsDetachSiloFromCurrentThread = _PsDetachSiloFromCurrentThread@4
+ 1662 673 00276412 PsDisableImpersonation = _PsDisableImpersonation@8
+ 1663 674 000BBEC6 PsEnterPriorityRegion = _PsEnterPriorityRegion@0
+ 1664 675 003695FC PsEstablishWin32Callouts = _PsEstablishWin32Callouts@4
+ 1665 676 0047C787 PsFreeSiloContextSlot = _PsFreeSiloContextSlot@4
+ 1666 677 0048024B PsGetContextThread = _PsGetContextThread@12
+ 1667 678 0005AC36 PsGetCurrentProcess = _PsGetCurrentProcess@0
+ 1668 679 0005FF32 PsGetCurrentProcessId = _PsGetCurrentProcessId@0
+ 1669 67A 0005F0FC PsGetCurrentProcessSessionId = _PsGetCurrentProcessSessionId@0
+ 1670 67B 000BBE38 PsGetCurrentProcessWin32Process = _PsGetCurrentProcessWin32Process@0
+ 1671 67C 0005F586 PsGetCurrentServerSilo = _PsGetCurrentServerSilo@0
+ 1672 67D 0047C7F2 PsGetCurrentServerSiloName = _PsGetCurrentServerSiloName@0
+ 1673 67E 0005A766 PsGetCurrentSilo = _PsGetCurrentSilo@0
+ 1674 67F 0002A3CC PsGetCurrentThread = _KeGetCurrentThread@0
+ 1675 680 000C3584 PsGetCurrentThreadId = _PsGetCurrentThreadId@0
+ 1676 681 0005A160 PsGetCurrentThreadPreviousMode = _ExGetPreviousMode@0
+ 1677 682 001081B6 PsGetCurrentThreadProcess = _PsGetCurrentThreadProcess@0
+ 1678 683 0005FF32 PsGetCurrentThreadProcessId = _PsGetCurrentProcessId@0
+ 1679 684 001B5095 PsGetCurrentThreadStackBase = _PsGetCurrentThreadStackBase@0
+ 1680 685 001B50A4 PsGetCurrentThreadStackLimit = _PsGetCurrentThreadStackLimit@0
+ 1681 686 000C8C7E PsGetCurrentThreadTeb = _PsGetCurrentThreadTeb@0
+ 1682 687 000B7D98 PsGetCurrentThreadWin32Thread = _PsGetCurrentThreadWin32Thread@0
+ 1683 688 000B2B5E PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion = _PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion@4
+ 1684 689 000CCDCC PsGetEffectiveContainerId = _PsGetEffectiveContainerId@12
+ 1685 68A 000DAD02 PsGetEffectiveServerSilo = _PsGetEffectiveServerSilo@4
+ 1686 68B 00030430 PsGetHostSilo = @SymCryptCpuFeaturesNeverPresentEnvWindowsKernelmodeWin8_1nLater@0
+ 1687 68C 000D56B6 PsGetJobLock = _PsGetJobLock@4
+ 1688 68D 000C21DC PsGetJobProperty = _PsGetJobProperty@8
+ 1689 68E 001B56DD PsGetJobServerSilo = _PsGetJobServerSilo@8
+ 1690 68F 001B50BA PsGetJobSessionId = _PsGetJobSessionId@4
+ 1691 690 001B570D PsGetJobSilo = _PsGetJobSilo@8
+ 1692 691 000D3A52 PsGetJobUIRestrictionsClass = _PsGetJobUIRestrictionsClass@4
+ 1693 692 00070BC6 PsGetPermanentSiloContext = _PsGetPermanentSiloContext@12
+ 1694 693 001B50D9 PsGetProcessCommonJob = _PsGetProcessCommonJob@8
+ 1695 694 000C3566 PsGetProcessCreateTimeQuadPart = _PsGetProcessCreateTimeQuadPart@4
+ 1696 695 000CFCF0 PsGetProcessDebugPort = _PsGetProcessDebugPort@4
+ 1697 696 002E6096 PsGetProcessDxgProcess = _PsGetProcessDxgProcess@4
+ 1698 697 000D1C68 PsGetProcessExitProcessCalled = _PsGetProcessExitProcessCalled@4
+ 1699 698 0047D9F5 PsGetProcessExitStatus = _PsGetProcessExitStatus@4
+ 1700 699 002FD9BE PsGetProcessExitTime = _PsGetProcessExitTime@0
+ 1701 69A 00026E1A PsGetProcessId = _PsGetProcessId@4
+ 1702 69B 000CA772 PsGetProcessImageFileName = _PsGetProcessImageFileName@4
+ 1703 69C 00057FDC PsGetProcessInheritedFromUniqueProcessId = _PsGetProcessInheritedFromUniqueProcessId@4
+ 1704 69D 000CAFD8 PsGetProcessJob = _PsGetProcessJob@4
+ 1705 69E 000C6DFC PsGetProcessPeb = _PsGetProcessPeb@4
+ 1706 69F 001B5119 PsGetProcessPriorityClass = _PsGetProcessPriorityClass@4
+ 1707 6A0 000A29F0 PsGetProcessProtection = _PsGetProcessProtection@4
+ 1708 6A1 000D875A PsGetProcessSectionBaseAddress = _PsGetProcessSectionBaseAddress@4
+ 1709 6A2 00306B1E PsGetProcessSecurityPort = _PsGetProcessSecurityPort@4
+ 1710 6A3 000D1D22 PsGetProcessSequenceNumber = _PsGetProcessSequenceNumber@4
+ 1711 6A4 0005FF44 PsGetProcessServerSilo = _PsGetProcessServerSilo@4
+ 1712 6A5 0006D5CE PsGetProcessSessionId = _PsGetProcessSessionId@4
+ 1713 6A6 000DE942 PsGetProcessSessionIdEx = _PsGetProcessSessionIdEx@4
+ 1714 6A7 000686BA PsGetProcessSignatureLevel = _PsGetProcessSignatureLevel@8
+ 1715 6A8 001B5130 PsGetProcessStartKey = _PsGetProcessStartKey@4
+ 1716 6A9 000B742A PsGetProcessWin32Process = _PsGetProcessWin32Process@4
+ 1717 6AA 000CAFC0 PsGetProcessWin32WindowStation = _PsGetProcessWin32WindowStation@4
+ 1718 6AB 000B2E98 PsGetServerSiloServiceSessionId = _PsGetServerSiloServiceSessionId@4
+ 1719 6AC 001B4CCE PsGetSiloContext = _PsGetSiloContext@12
+ 1720 6AD 00378940 PsGetSiloIdentifier = _PsGetSiloIdentifier@4
+ 1721 6AE 00307AAA PsGetSiloMonitorContextSlot = _PsGetSiloMonitorContextSlot@4
+ 1722 6AF 001B5158 PsGetThreadCreateTime = _PsGetThreadCreateTime@4
+ 1723 6B0 00304B44 PsGetThreadExitStatus = _PsGetThreadExitStatus@4
+ 1724 6B1 000D3028 PsGetThreadFreezeCount = _PsGetThreadFreezeCount@4
+ 1725 6B2 0010839A PsGetThreadHardErrorsAreDisabled = _PsGetThreadHardErrorsAreDisabled@4
+ 1726 6B3 000CA1D0 PsGetThreadId = _PsGetThreadId@4
+ 1727 6B4 0005827E PsGetThreadProcess = _IoThreadToProcess@4
+ 1728 6B5 000CA1E8 PsGetThreadProcessId = _PsGetThreadProcessId@4
+ 1729 6B6 000C2292 PsGetThreadProperty = _PsGetThreadProperty@12
+ 1730 6B7 00299558 PsGetThreadSessionId = _PsGetThreadSessionId@4
+ 1731 6B8 000D57A2 PsGetThreadTeb = _PsGetThreadTeb@4
+ 1732 6B9 000B742A PsGetThreadWin32Thread = _PsGetProcessWin32Process@4
+ 1733 6BA 000D4D12 PsGetVersion = _PsGetVersion@16
+ 1734 6BB 000C5B6E PsGetWin32KFilterSet = _PsGetWin32KFilterSet@0
+ 1735 6BC 00277556 PsImpersonateClient = _PsImpersonateClient@20
+ 1736 6BD 002266DC PsInitialSystemProcess = _PsInitialSystemProcess
+ 1737 6BE 0035911A PsInsertPermanentSiloContext = _PsInsertPermanentSiloContext@12
+ 1738 6BF 0047C81F PsInsertSiloContext = _PsInsertSiloContext@12
+ 1739 6C0 0005F574 PsIsCurrentThreadInServerSilo = _PsIsCurrentThreadInServerSilo@0
+ 1740 6C1 000C04A8 PsIsCurrentThreadPrefetching = _PsIsCurrentThreadPrefetching@0
+ 1741 6C2 00102B38 PsIsDiskCountersEnabled = _PsIsDiskCountersEnabled@0
+ 1742 6C3 0002F7E0 PsIsHostSilo = _PsIsHostSilo@4
+ 1743 6C4 0047DA0C PsIsProcessBeingDebugged = _PsIsProcessBeingDebugged@4
+ 1744 6C5 0047DA27 PsIsProcessCommitRelinquished = _PsIsProcessCommitRelinquished@4
+ 1745 6C6 003062E2 PsIsProcessInAppSilo = _PsIsProcessInAppSilo@4
+ 1746 6C7 000D8738 PsIsProtectedProcess = _PsIsProtectedProcess@4
+ 1747 6C8 000D877E PsIsProtectedProcessLight = _PsIsProtectedProcessLight@4
+ 1748 6C9 0006D49A PsIsSystemProcess = _PsIsSystemProcess@4
+ 1749 6CA 000C894C PsIsSystemThread = _IoIsSystemThread@4
+ 1750 6CB 0047DA43 PsIsThreadImpersonating = _PsIsThreadImpersonating@4
+ 1751 6CC 000CDD0C PsIsThreadTerminating = _PsIsThreadTerminating@4
+ 1752 6CD 000CEF58 PsIsWin32KFilterAuditEnabled = _PsIsWin32KFilterAuditEnabled@0
+ 1753 6CE 000C590C PsIsWin32KFilterEnabled = _PsIsWin32KFilterEnabled@0
+ 1754 6CF 002266F0 PsJobType = _PsJobType
+ 1755 6D0 000B9AA6 PsLeavePriorityRegion = _PsLeavePriorityRegion@0
+ 1756 6D1 001FD8D8 PsLoadedModuleList = _PsLoadedModuleList
+ 1757 6D2 001FD8A0 PsLoadedModuleResource = _PsLoadedModuleResource
+ 1758 6D3 00276200 PsLookupProcessByProcessId = _PsLookupProcessByProcessId@8
+ 1759 6D4 002E4EF2 PsLookupProcessThreadByCid = _PsLookupProcessThreadByCid@12
+ 1760 6D5 00273BB2 PsLookupThreadByThreadId = _PsLookupThreadByThreadId@8
+ 1761 6D6 0047C88C PsMakeSiloContextPermanent = _PsMakeSiloContextPermanent@8
+ 1762 6D7 002266F8 PsProcessType = _PsProcessType
+ 1763 6D8 0027AADA PsQueryProcessAttributesByToken = _PsQueryProcessAttributesByToken@12
+ 1764 6D9 000D3DDA PsQueryProcessCommandLine = _PsQueryProcessCommandLine@20
+ 1765 6DA 0047DA5F PsQueryProcessExceptionFlags = _PsQueryProcessExceptionFlags@12
+ 1766 6DB 002FD2A6 PsQueryTotalCycleTimeProcess = _PsQueryTotalCycleTimeProcess@8
+ 1767 6DC 002EA8F0 PsReferenceImpersonationToken = _PsReferenceImpersonationToken@16
+ 1768 6DD 00307446 PsReferenceKernelStack = _PsReferenceKernelStack@4
+ 1769 6DE 002928EA PsReferencePrimaryToken = _PsReferencePrimaryToken@4
+ 1770 6DF 00318DB6 PsReferenceProcessFilePointer = _PsReferenceProcessFilePointer@8
+ 1771 6E0 000D55AA PsReferenceSiloContext = _PsReferenceSiloContext@4
+ 1772 6E1 00480709 PsRegisterPicoProvider = _PsRegisterPicoProvider@8
+ 1773 6E2 0035AC46 PsRegisterSiloMonitor = _PsRegisterSiloMonitor@8
+ 1774 6E3 002EF52E PsReleaseProcessExitSynchronization = _PsReleaseProcessExitSynchronization@4
+ 1775 6E4 002D5F3E PsReleaseProcessWakeCounter = _PsReleaseProcessWakeCounter@8
+ 1776 6E5 001B4CFE PsReleaseSiloHardReference = _PsReleaseSiloHardReference@4
+ 1777 6E6 00480C2B PsRemoveCreateThreadNotifyRoutine = _PsRemoveCreateThreadNotifyRoutine@4
+ 1778 6E7 00480CE3 PsRemoveLoadImageNotifyRoutine = _PsRemoveLoadImageNotifyRoutine@4
+ 1779 6E8 0047C8B5 PsRemoveSiloContext = _PsRemoveSiloContext@12
+ 1780 6E9 0047C8E5 PsReplaceSiloContext = _PsReplaceSiloContext@16
+ 1781 6EA 002764D6 PsRestoreImpersonation = _PsRestoreImpersonation@8
+ 1782 6EB 002F0208 PsResumeProcess = _PsResumeProcess@4
+ 1783 6EC 0005F5F8 PsReturnPoolQuota = _PsReturnPoolQuota@12
+ 1784 6ED 00063800 PsReturnProcessNonPagedPoolQuota = _PsReturnProcessNonPagedPoolQuota@8
+ 1785 6EE 00065102 PsReturnProcessPagedPoolQuota = _PsReturnProcessPagedPoolQuota@8
+ 1786 6EF 0047E78D PsRevertThreadToSelf = _PsRevertThreadToSelf@4
+ 1787 6F0 0047E7AA PsRevertToSelf = _PsRevertToSelf@0
+ 1788 6F1 0048026C PsSetContextThread = _PsSetContextThread@12
+ 1789 6F2 0036972A PsSetCreateProcessNotifyRoutine = _PsSetCreateProcessNotifyRoutine@8
+ 1791 6F3 00369668 PsSetCreateProcessNotifyRoutineEx = _PsSetCreateProcessNotifyRoutineEx@8
+ 1790 6F4 0036963A PsSetCreateProcessNotifyRoutineEx2 = _PsSetCreateProcessNotifyRoutineEx2@12
+ 1792 6F5 0036968A PsSetCreateThreadNotifyRoutine = _PsSetCreateThreadNotifyRoutine@4
+ 1793 6F6 00480D87 PsSetCreateThreadNotifyRoutineEx = _PsSetCreateThreadNotifyRoutineEx@8
+ 1794 6F7 002C558E PsSetCurrentThreadPrefetching = _PsSetCurrentThreadPrefetching@4
+ 1795 6F8 001B51AD PsSetJobProperty = _PsSetJobProperty@12
+ 1796 6F9 0047FCB3 PsSetLegoNotifyRoutine = _PsSetLegoNotifyRoutine@4
+ 1797 6FA 003696A2 PsSetLoadImageNotifyRoutine = _PsSetLoadImageNotifyRoutine@4
+ 1798 6FB 002FFFB6 PsSetProcessDxgProcess = _PsSetProcessDxgProcess@8
+ 1799 6FC 002E1C2C PsSetProcessPriorityByClass = _PsSetProcessPriorityByClass@8
+ 1800 6FD 001B5218 PsSetProcessPriorityClass = _PsSetProcessPriorityClass@8
+ 1801 6FE 0047DBAC PsSetProcessSecurityPort = _PsSetProcessSecurityPort@8
+ 1802 6FF 002F27C2 PsSetProcessWin32Process = _PsSetProcessWin32Process@12
+ 1803 700 003023C4 PsSetProcessWindowStation = _PsSetProcessWindowStation@8
+ 1804 701 001070AA PsSetThreadHardErrorsAreDisabled = _PsSetThreadHardErrorsAreDisabled@8
+ 1805 702 000C219E PsSetThreadProperty = _PsSetThreadProperty@12
+ 1806 703 002F8E38 PsSetThreadWin32Thread = _PsSetThreadWin32Thread@12
+ 1807 704 001F9D58 PsSiloContextNonPagedType = _PsSiloContextNonPagedType
+ 1808 705 001F9D5C PsSiloContextPagedType = _PsSiloContextPagedType
+ 1809 706 0036FA64 PsStartSiloMonitor = _PsStartSiloMonitor@4
+ 1810 707 00480FE8 PsSuspendProcess = _PsSuspendProcess@4
+ 1811 708 0047CA41 PsTerminateServerSilo = _PsTerminateServerSilo@8
+ 1812 709 0024F0AA PsTerminateSystemThread = _PsTerminateSystemThread@4
+ 1813 70A 002266F4 PsThreadType = _PsThreadType
+ 1814 70B 00534D64 PsUILanguageComitted = _PsUILanguageComitted
+ 1815 70C 004802DC PsUnregisterSiloMonitor = _PsUnregisterSiloMonitor@4
+ 1816 70D 000DA1BE PsUpdateComponentPower = _PsUpdateComponentPower@16
+ 1817 70E 00082E14 PsUpdateDiskCounters = _PsUpdateDiskCounters@32
+ 1818 70F 000D87A0 PsWow64GetProcessMachine = _PsWow64GetProcessMachine@4
+ 1819 710 000E3DC4 PsWrapApcWow64Thread = _KeReservePrivilegedPages@16
+ 1820 711 0010BF74 READ_REGISTER_BUFFER_UCHAR = _READ_REGISTER_BUFFER_UCHAR@12
+ 1821 712 0010BFAC READ_REGISTER_BUFFER_ULONG = _READ_REGISTER_BUFFER_ULONG@12
+ 1822 713 0010BF90 READ_REGISTER_BUFFER_USHORT = _READ_REGISTER_BUFFER_USHORT@12
+ 1823 714 0010BF50 READ_REGISTER_UCHAR = _READ_REGISTER_UCHAR@4
+ 1824 715 0010BF68 READ_REGISTER_ULONG = _READ_REGISTER_ULONG@4
+ 1825 716 0010BF5C READ_REGISTER_USHORT = _READ_REGISTER_USHORT@4
+ 1826 717 00333EE4 RtlAbsoluteToSelfRelativeSD = _RtlAbsoluteToSelfRelativeSD@12
+ 1827 718 00320074 RtlAddAccessAllowedAce = _RtlAddAccessAllowedAce@16
+ 1828 719 0036C7C2 RtlAddAccessAllowedAceEx = _RtlAddAccessAllowedAceEx@20
+ 1829 71A 00485772 RtlAddAccessAllowedObjectAce = _RtlAddAccessAllowedObjectAce@28
+ 1830 71B 0036C850 RtlAddAccessDeniedAceEx = _RtlAddAccessDeniedAceEx@20
+ 1831 71C 004857C0 RtlAddAccessDeniedObjectAce = _RtlAddAccessDeniedObjectAce@28
+ 1832 71D 0048580E RtlAddAccessFilterAce = _RtlAddAccessFilterAce@32
+ 1833 71E 0026F65A RtlAddAce = _RtlAddAce@20
+ 1834 71F 00303C38 RtlAddAtomToAtomTable = _RtlAddAtomToAtomTable@12
+ 1835 720 00070422 RtlAddAtomToAtomTableEx = _RtlAddAtomToAtomTableEx@16
+ 1836 721 00485A03 RtlAddAuditAccessAceEx = _RtlAddAuditAccessAceEx@28
+ 1837 722 00485A3C RtlAddAuditAccessObjectAce = _RtlAddAuditAccessObjectAce@36
+ 1838 723 0036B62A RtlAddProcessTrustLabelAce = _RtlAddProcessTrustLabelAce@24
+ 1839 724 0035355C RtlAddRange = _RtlAddRange@36
+ 1840 725 00485A9D RtlAddResourceAttributeAce = _RtlAddResourceAttributeAce@28
+ 1841 726 000B8BA4 RtlAllocateHeap = _RtlAllocateHeap@12
+ 1842 727 0025A8BA RtlAnsiCharToUnicodeChar = _RtlAnsiCharToUnicodeChar@4
+ 1843 728 004831DA RtlAnsiStringToUnicodeSize = _RtlxAnsiStringToUnicodeSize@4
+ 1844 729 0025A7CE RtlAnsiStringToUnicodeString = _RtlAnsiStringToUnicodeString@12
+ 1845 72A 00484700 RtlAppendAsciizToString = _RtlAppendAsciizToString@8
+ 1846 72B 00344F56 RtlAppendStringToString = _RtlAppendStringToString@8
+ 1847 72C 0002BFF8 RtlAppendUnicodeStringToString = _RtlAppendUnicodeStringToString@8
+ 1848 72D 0002C06C RtlAppendUnicodeToString = _RtlAppendUnicodeToString@8
+ 1849 72E 002EC51A RtlAreAllAccessesGranted = _RtlAreAllAccessesGranted@8
+ 1850 72F 00306BC2 RtlAreAnyAccessesGranted = _RtlAreAnyAccessesGranted@8
+ 1851 730 0008AA82 RtlAreBitsClear = _RtlAreBitsClear@12
+ 1852 731 000C7F30 RtlAreBitsSet = _RtlAreBitsSet@12
+ 1853 732 001B7D3F RtlAssert = _RtlAssert@16
+ 1854 733 00063218 RtlAvlInsertNodeEx = _RtlAvlInsertNodeEx@16
+ 1855 734 000633B8 RtlAvlRemoveNode = _RtlAvlRemoveNode@8
+ 1856 735 00486741 RtlCapabilityCheck = _RtlCapabilityCheck@12
+ 1857 736 00120434 RtlCaptureContext = _RtlCaptureContext@4
+ 1858 737 0008ABAC RtlCaptureStackBackTrace = _RtlCaptureStackBackTrace@16
+ 1859 738 00355AA8 RtlCharToInteger = _RtlCharToInteger@12
+ 1860 739 000D3D38 RtlCheckPortableOperatingSystem = _RtlCheckPortableOperatingSystem@4
+ 1861 73A 0030484E RtlCheckRegistryKey = _RtlCheckRegistryKey@8
+ 1862 73B 001B6F5F RtlCheckTokenCapability = _RtlCheckTokenCapability@12
+ 1863 73C 000DAA14 RtlCheckTokenMembership = _RtlCheckTokenMembership@12
+ 1864 73D 000DAA32 RtlCheckTokenMembershipEx = _RtlCheckTokenMembershipEx@16
+ 1865 73E 000700E2 RtlClearAllBits = _RtlClearAllBits@4
+ 1866 73F 000CC84A RtlClearBit = _RtlClearBit@8
+ 1867 740 0005F6CC RtlClearBits = _RtlClearBits@12
+ 1868 741 000D13F4 RtlCmDecodeMemIoResource = _RtlCmDecodeMemIoResource@8
+ 1869 742 000FB1D4 RtlCmEncodeMemIoResource = _RtlCmEncodeMemIoResource@24
+ 1870 743 000C972A RtlCompareAltitudes = _RtlCompareAltitudes@8
+ 1871 744 0011FC00 RtlCompareMemory = _RtlCompareMemory@12
+ 1872 745 0011FC50 RtlCompareMemoryUlong = _RtlCompareMemoryUlong@12
+ 1873 746 0025C1A0 RtlCompareString = _RtlCompareString@12
+ 1874 747 0026D93E RtlCompareUnicodeString = _RtlCompareUnicodeString@12
+ 1875 748 0026D96C RtlCompareUnicodeStrings = _RtlCompareUnicodeStrings@20
+ 1876 749 0003555C RtlCompressBuffer = _RtlCompressBuffer@32
+ 1877 74A 00483437 RtlCompressChunks = _RtlCompressChunks@28
+ 1878 74B 000E786A RtlComputeCrc32 = _RtlComputeCrc32@12
+ 1879 74C 000C3596 RtlContractHashTable = _RtlContractHashTable@4
+ 1880 74D 00120214 RtlConvertLongToLargeInteger = ___RtlConvertLongToLargeInteger@4
+ 1881 74E 00270F28 RtlConvertSidToUnicodeString = _RtlConvertSidToUnicodeString@12
+ 1882 74F 0012021C RtlConvertUlongToLargeInteger = ___RtlConvertUlongToLargeInteger@4
+ 1883 750 000DA6D6 RtlCopyBitMap = _RtlCopyBitMap@12
+ 1884 751 002F8806 RtlCopyLuid = _RtlCopyLuid@8
+ 1885 752 002F0908 RtlCopyLuidAndAttributesArray = _RtlCopyLuidAndAttributesArray@12
+ 1886 753 00353B84 RtlCopyRangeList = _RtlCopyRangeList@8
+ 1887 754 00272F3A RtlCopySid = _RtlCopySid@12
+ 1888 755 00272EA2 RtlCopySidAndAttributesArray = _RtlCopySidAndAttributesArray@28
+ 1889 756 001B67F1 RtlCopyString = _RtlCopyString@8
+ 1890 757 000572A4 RtlCopyUnicodeString = _RtlCopyUnicodeString@8
+ 1891 758 001B816C RtlCrc32 = _RtlCrc32@12
+ 1892 759 000E564A RtlCrc64 = _RtlCrc64@16
+ 1893 75A 00273ACE RtlCreateAcl = _RtlCreateAcl@12
+ 1894 75B 002FD6D4 RtlCreateAtomTable = _RtlCreateAtomTable@8
+ 1895 75C 000D068A RtlCreateAtomTableEx = _RtlCreateAtomTableEx@12
+ 1896 75D 000C45F2 RtlCreateHashTable = _RtlCreateHashTable@12
+ 1897 75E 00108096 RtlCreateHashTableEx = _RtlCreateHashTableEx@16
+ 1898 75F 002DF8C0 RtlCreateHeap = _RtlCreateHeap@24
+ 1899 760 0037896A RtlCreateRegistryKey = _RtlCreateRegistryKey@8
+ 1900 761 00273B1E RtlCreateSecurityDescriptor = _RtlCreateSecurityDescriptor@8
+ 1901 762 0032F74A RtlCreateSystemVolumeInformationFolder = _RtlCreateSystemVolumeInformationFolder@4
+ 1902 763 00270CF6 RtlCreateUnicodeString = _RtlCreateUnicodeString@8
+ 1903 764 0048330F RtlCreateUserThread = _RtlCreateUserThread@40
+ 1904 765 00361D50 RtlCultureNameToLCID = _RtlCultureNameToLCID@8
+ 1905 766 00483A58 RtlCustomCPToUnicodeN = _RtlCustomCPToUnicodeN@24
+ 1906 767 001B64DA RtlDecompressBuffer = _RtlDecompressBuffer@24
+ 1908 768 000A6CC2 RtlDecompressBufferEx = _RtlDecompressBufferEx@28
+ 1907 769 000D225A RtlDecompressBufferEx2 = _RtlDecompressBufferEx2@32
+ 1909 76A 00483526 RtlDecompressChunks = _RtlDecompressChunks@28
+ 1910 76B 0048370F RtlDecompressFragment = _RtlDecompressFragment@32
+ 1911 76C 000CB26A RtlDecompressFragmentEx = _RtlDecompressFragmentEx@36
+ 1912 76D 0007E4F4 RtlDelete = _RtlDelete@4
+ 1913 76E 002FD60C RtlDeleteAce = _RtlDeleteAce@8
+ 1914 76F 002AEFB4 RtlDeleteAtomFromAtomTable = _RtlDeleteAtomFromAtomTable@8
+ 1915 770 0007D788 RtlDeleteElementGenericTable = _RtlDeleteElementGenericTable@8
+ 1916 771 0002B802 RtlDeleteElementGenericTableAvl = _RtlDeleteElementGenericTableAvl@8
+ 1917 772 0002B838 RtlDeleteElementGenericTableAvlEx = _RtlDeleteElementGenericTableAvlEx@8
+ 1918 773 000D5764 RtlDeleteHashTable = _RtlDeleteHashTable@4
+ 1919 774 000BCB5A RtlDeleteNoSplay = _RtlDeleteNoSplay@8
+ 1920 775 00352C1E RtlDeleteOwnersRanges = _RtlDeleteOwnersRanges@8
+ 1921 776 00352AA6 RtlDeleteRange = _RtlDeleteRange@24
+ 1922 777 003746D4 RtlDeleteRegistryValue = _RtlDeleteRegistryValue@12
+ 1923 778 000DB97A RtlDeriveCapabilitySidsFromName = _RtlDeriveCapabilitySidsFromName@12
+ 1924 779 0048375C RtlDescribeChunk = _RtlDescribeChunk@20
+ 1925 77A 002EBC8E RtlDestroyAtomTable = _RtlDestroyAtomTable@4
+ 1926 77B 00307640 RtlDestroyHeap = _RtlDestroyHeap@4
+ 1927 77C 00482CF0 RtlDowncaseUnicodeChar = _RtlDowncaseUnicodeChar@4
+ 1928 77D 002E5824 RtlDowncaseUnicodeString = _RtlDowncaseUnicodeString@12
+ 1929 77E 00257D5A RtlDuplicateUnicodeString = _RtlDuplicateUnicodeString@12
+ 1930 77F 0048658B RtlEmptyAtomTable = _RtlEmptyAtomTable@8
+ 1931 780 000CD026 RtlEndEnumerationHashTable = _RtlEndEnumerationHashTable@8
+ 1932 781 000E3D6C RtlEndStrongEnumerationHashTable = _ExInitializeRundownProtectionCacheAwareEx@8
+ 1933 782 000CD01C RtlEndWeakEnumerationHashTable = _RtlEndWeakEnumerationHashTable@8
+ 1934 783 0011FFF4 RtlEnlargedIntegerMultiply = __RtlEnlargedIntegerMultiply@8
+ 1935 784 0012000C RtlEnlargedUnsignedDivide = __RtlEnlargedUnsignedDivide@16
+ 1936 785 00120000 RtlEnlargedUnsignedMultiply = __RtlEnlargedUnsignedMultiply@8
+ 1937 786 000D9CF0 RtlEnumerateEntryHashTable = _RtlEnumerateEntryHashTable@8
+ 1938 787 000EF828 RtlEnumerateGenericTable = _RtlEnumerateGenericTable@8
+ 1939 788 0002B65E RtlEnumerateGenericTableAvl = _RtlEnumerateGenericTableAvl@8
+ 1940 789 0002B5A8 RtlEnumerateGenericTableLikeADirectory = _RtlEnumerateGenericTableLikeADirectory@28
+ 1941 78A 000D0038 RtlEnumerateGenericTableWithoutSplaying = _RtlEnumerateGenericTableWithoutSplaying@8
+ 1942 78B 0002B686 RtlEnumerateGenericTableWithoutSplayingAvl = _RtlEnumerateGenericTableWithoutSplayingAvl@8
+ 1943 78C 004869B3 RtlEqualLuid = _RtlEqualLuid@8
+ 1944 78D 0005B7B2 RtlEqualSid = _RtlEqualSid@8
+ 1945 78E 00029CC8 RtlEqualString = _RtlEqualString@12
+ 1946 78F 002945D8 RtlEqualUnicodeString = _RtlEqualUnicodeString@12
+ 1947 790 004881F5 RtlEqualWnfChangeStamps = _RtlEqualWnfChangeStamps@8
+ 1948 791 001B8685 RtlEthernetAddressToStringA = _RtlEthernetAddressToStringA@8
+ 1949 792 001B8A9D RtlEthernetAddressToStringW = _RtlEthernetAddressToStringW@8
+ 1950 793 001B8C9E RtlEthernetStringToAddressA = _RtlEthernetStringToAddressA@12
+ 1951 794 001B9470 RtlEthernetStringToAddressW = _RtlEthernetStringToAddressW@12
+ 1952 795 001B7F5F RtlExpandHashTable = _RtlExpandHashTable@4
+ 1953 796 00120118 RtlExtendedIntegerMultiply = _RtlExtendedIntegerMultiply@12
+ 1954 797 0012002C RtlExtendedLargeIntegerDivide = _RtlExtendedLargeIntegerDivide@16
+ 1955 798 00120088 RtlExtendedMagicDivide = _RtlExtendedMagicDivide@20
+ 1956 799 001B7421 RtlExtractBitMap = _RtlExtractBitMap@16
+ 1957 79A 0011FC80 RtlFillMemory = _RtlFillMemory@12
+ 1958 79B 0011FCF0 RtlFillMemoryUlong = _RtlFillMemoryUlong@12
+ 1959 79C 0011FCC0 RtlFillMemoryUlonglong = _RtlFillMemoryUlonglong@16
+ 1960 79D 0005C09C RtlFindAceByType = _RtlFindAceByType@12
+ 1961 79E 0006385E RtlFindClearBits = _RtlFindClearBits@12
+ 1962 79F 00063B2E RtlFindClearBitsAndSet = _RtlFindClearBitsAndSet@12
+ 1963 7A0 000ADDAC RtlFindClearRuns = _RtlFindClearRuns@16
+ 1964 7A1 001B7E71 RtlFindClosestEncodableLength = _RtlFindClosestEncodableLength@12
+ 1965 7A2 002CACDE RtlFindExportedRoutineByName = _RtlFindExportedRoutineByName@8
+ 1966 7A3 001B757F RtlFindFirstRunClear = _RtlFindFirstRunClear@8
+ 1967 7A4 000CCE7E RtlFindLastBackwardRunClear = _RtlFindLastBackwardRunClear@12
+ 1968 7A5 00039858 RtlFindLeastSignificantBit = _RtlFindLeastSignificantBit@8
+ 1969 7A6 001B759C RtlFindLongestRunClear = _RtlFindLongestRunClear@8
+ 1970 7A7 0030C880 RtlFindMessage = _RtlFindMessage@20
+ 1971 7A8 000B37E2 RtlFindMostSignificantBit = _RtlFindMostSignificantBit@8
+ 1972 7A9 000686E0 RtlFindNextForwardRunClear = _RtlFindNextForwardRunClear@12
+ 1973 7AA 00066798 RtlFindNextForwardRunClearCapped = _RtlFindNextForwardRunClearCapped@16
+ 1974 7AB 00353DA6 RtlFindRange = _RtlFindRange@56
+ 1975 7AC 0002EC0A RtlFindSetBits = _RtlFindSetBits@12
+ 1976 7AD 001B77C4 RtlFindSetBitsAndClear = _RtlFindSetBitsAndClear@12
+ 1977 7AE 002E5A2C RtlFindUnicodePrefix = _RtlFindUnicodePrefix@12
+ 1978 7AF 00482D4E RtlFindUnicodeSubstring = _RtlFindUnicodeSubstring@12
+ 1979 7B0 00272F72 RtlFirstFreeAce = _RtlFirstFreeAce@8
+ 1980 7B1 002F4BE8 RtlFormatCurrentUserKeyPath = _RtlFormatCurrentUserKeyPath@4
+ 1981 7B2 0048475E RtlFormatMessage = _RtlFormatMessage@36
+ 1982 7B3 003141B0 RtlFreeAnsiString = _RtlFreeAnsiString@4
+ 1983 7B4 000B861E RtlFreeHeap = _RtlFreeHeap@12
+ 1984 7B5 0034826C RtlFreeOemString = _RtlFreeOemString@4
+ 1985 7B6 00353A6A RtlFreeRangeList = _RtlFreeRangeList@4
+ 1986 7B7 002709F8 RtlFreeUnicodeString = _RtlFreeUnicodeString@4
+ 1987 7B8 00269E7E RtlGUIDFromString = _RtlGUIDFromString@8
+ 1988 7B9 002E513C RtlGenerate8dot3Name = _RtlGenerate8dot3Name@16
+ 1989 7BA 0035FE64 RtlGenerateClass5Guid = _RtlGenerateClass5Guid@16
+ 1990 7BB 0002BE06 RtlGetAce = _RtlGetAce@12
+ 1991 7BC 000DE2FC RtlGetActiveConsoleId = _RtlGetActiveConsoleId@0
+ 1992 7BD 001B726B RtlGetAppContainerNamedObjectPath = _RtlGetAppContainerNamedObjectPath@16
+ 1993 7BE 004869DC RtlGetAppContainerParent = _RtlGetAppContainerParent@8
+ 1994 7BF 0031F74C RtlGetAppContainerSidType = _RtlGetAppContainerSidType@8
+ 1995 7C0 0008AB5E RtlGetCallersAddress = _RtlGetCallersAddress@8
+ 1996 7C1 000A4CE0 RtlGetCompressionWorkSpaceSize = _RtlGetCompressionWorkSpaceSize@12
+ 1997 7C2 00483353 RtlGetConsoleSessionForegroundProcessId = _RtlGetConsoleSessionForegroundProcessId@0
+ 1998 7C3 0025B06C RtlGetControlSecurityDescriptor = _RtlGetControlSecurityDescriptor@12
+ 1999 7C4 000D03D8 RtlGetCurrentServiceSessionId = _RtlGetCurrentServiceSessionId@0
+ 2000 7C5 00029B00 RtlGetDaclSecurityDescriptor = _RtlGetDaclSecurityDescriptor@16
+ 2001 7C6 00347E8C RtlGetDefaultCodePage = _RtlGetDefaultCodePage@8
+ 2002 7C7 000C689A RtlGetElementGenericTable = _RtlGetElementGenericTable@8
+ 2003 7C8 001B853B RtlGetElementGenericTableAvl = _RtlGetElementGenericTableAvl@8
+ 2004 7C9 000F9418 RtlGetEnabledExtendedFeatures = _RtlGetEnabledExtendedFeatures@8
+ 2005 7CA 00354130 RtlGetFirstRange = _RtlGetFirstRange@12
+ 2006 7CB 0036DDDE RtlGetGroupSecurityDescriptor = _RtlGetGroupSecurityDescriptor@12
+ 2007 7CC 002B2A4A RtlGetIntegerAtom = _RtlGetIntegerAtom@8
+ 2008 7CD 0035418E RtlGetLastRange = _RtlGetLastRange@12
+ 2009 7CE 000C34C2 RtlGetNextEntryHashTable = _RtlGetNextEntryHashTable@8
+ 2010 7CF 0035407C RtlGetNextRange = _RtlGetNextRange@12
+ 2011 7D0 00487AF8 RtlGetNtGlobalFlags = _RtlGetNtGlobalFlags@0
+ 2012 7D1 000CD342 RtlGetNtProductType = _RtlGetNtProductType@4
+ 2013 7D2 002CC87C RtlGetNtSystemRoot = _RtlGetNtSystemRoot@0
+ 2014 7D3 002F1274 RtlGetOwnerSecurityDescriptor = _RtlGetOwnerSecurityDescriptor@12
+ 2015 7D4 00104C62 RtlGetProductInfo = _RtlGetProductInfo@20
+ 2016 7D5 0025B482 RtlGetSaclSecurityDescriptor = _RtlGetSaclSecurityDescriptor@16
+ 2017 7D6 00486A80 RtlGetSessionProperties = _RtlGetSessionProperties@8
+ 2018 7D7 00343558 RtlGetSetBootStatusData = _RtlGetSetBootStatusData@24
+ 2019 7D8 002F4E6C RtlGetSuiteMask = _RtlGetSuiteMask@0
+ 2020 7D9 000D351C RtlGetThreadLangIdByIndex = _RtlGetThreadLangIdByIndex@16
+ 2021 7DA 00486AC5 RtlGetTokenNamedObjectPath = _RtlGetTokenNamedObjectPath@12
+ 2022 7DB 002F4DC2 RtlGetVersion = _RtlGetVersion@4
+ 2023 7DC 0026CF54 RtlHashUnicodeString = _RtlHashUnicodeString@16
+ 2024 7DD 0048849A RtlIdnToAscii = _RtlIdnToAscii@20
+ 2025 7DE 004884BE RtlIdnToNameprepUnicode = _RtlIdnToNameprepUnicode@20
+ 2026 7DF 004884E2 RtlIdnToUnicode = _RtlIdnToUnicode@20
+ 2027 7E0 00071D1C RtlImageDirectoryEntryToData = _RtlImageDirectoryEntryToData@16
+ 2028 7E1 00071124 RtlImageNtHeader = _RtlImageNtHeader@4
+ 2029 7E2 0007114E RtlImageNtHeaderEx = _RtlImageNtHeaderEx@20
+ 2030 7E3 0010BEC8 RtlInitAnsiString = _RtlInitAnsiString@8
+ 2031 7E4 000FBFF2 RtlInitAnsiStringEx = _RtlInitAnsiStringEx@8
+ 2032 7E5 00373AAE RtlInitCodePageTable = _RtlInitCodePageTable@8
+ 2033 7E6 000D9B12 RtlInitEnumerationHashTable = _RtlInitEnumerationHashTable@8
+ 2034 7E7 0010BE90 RtlInitString = _RtlInitString@8
+ 2035 7E8 001B682F RtlInitStringEx = _RtlInitStringEx@8
+ 2036 7E9 001B80DE RtlInitStrongEnumerationHashTable = _RtlInitStrongEnumerationHashTable@8
+ 2037 7EA 0010BF00 RtlInitUnicodeString = _RtlInitUnicodeString@8
+ 2038 7EB 0002C0EC RtlInitUnicodeStringEx = _RtlInitUnicodeStringEx@8
+ 2039 7EC 000D35C6 RtlInitWeakEnumerationHashTable = _RtlInitWeakEnumerationHashTable@8
+ 2040 7ED 000D8C26 RtlInitializeBitMap = _RtlInitializeBitMap@12
+ 2041 7EE 000CFE74 RtlInitializeGenericTable = _RtlInitializeGenericTable@20
+ 2042 7EF 0002B1AA RtlInitializeGenericTableAvl = _RtlInitializeGenericTableAvl@20
+ 2043 7F0 00371A6E RtlInitializeRangeList = _RtlInitializeRangeList@4
+ 2044 7F1 0027156A RtlInitializeSid = _RtlInitializeSid@12
+ 2045 7F2 001B73DF RtlInitializeSidEx = _RtlInitializeSidEx
+ 2046 7F3 003776EE RtlInitializeUnicodePrefix = _RtlInitializeUnicodePrefix@4
+ 2047 7F4 0007E408 RtlInsertElementGenericTable = _RtlInsertElementGenericTable@16
+ 2048 7F5 0002B174 RtlInsertElementGenericTableAvl = _RtlInsertElementGenericTableAvl@16
+ 2049 7F6 0007E43E RtlInsertElementGenericTableFull = _RtlInsertElementGenericTableFull@24
+ 2050 7F7 0002B1FE RtlInsertElementGenericTableFullAvl = _RtlInsertElementGenericTableFullAvl@24
+ 2051 7F8 000D9BF4 RtlInsertEntryHashTable = _RtlInsertEntryHashTable@16
+ 2052 7F9 002E5918 RtlInsertUnicodePrefix = _RtlInsertUnicodePrefix@12
+ 2053 7FA 0025A754 RtlInt64ToUnicodeString = _RtlInt64ToUnicodeString@16
+ 2054 7FB 0025BA40 RtlIntegerToChar = _RtlIntegerToChar@16
+ 2055 7FC 002710D0 RtlIntegerToUnicode = _RtlIntegerToUnicode@16
+ 2056 7FD 0025A426 RtlIntegerToUnicodeString = _RtlIntegerToUnicodeString@12
+ 2057 7FE 000EB0CE RtlInterlockedClearBitRun = _RtlInterlockedClearBitRun@12
+ 2058 7FF 001B7A92 RtlInterlockedSetBitRun = _RtlInterlockedSetBitRun@12
+ 2059 800 000279D8 RtlInterlockedSetClearRun = _RtlInterlockedSetClearRun@12
+ 2060 801 00351978 RtlInvertRangeList = _RtlInvertRangeList@8
+ 2061 802 00352B4E RtlInvertRangeListEx = _RtlInvertRangeListEx@20
+ 2062 803 000FB262 RtlIoDecodeMemIoResource = _RtlIoDecodeMemIoResource@16
+ 2063 804 00103E7C RtlIoEncodeMemIoResource = _RtlIoEncodeMemIoResource@40
+ 2064 805 001B86C8 RtlIpv4AddressToStringA = _RtlIpv4AddressToStringA@8
+ 2065 806 001B8701 RtlIpv4AddressToStringExA = _RtlIpv4AddressToStringExA@16
+ 2066 807 001B8AE3 RtlIpv4AddressToStringExW = _RtlIpv4AddressToStringExW@16
+ 2067 808 000EF708 RtlIpv4AddressToStringW = _RtlIpv4AddressToStringW@8
+ 2068 809 001B8DC3 RtlIpv4StringToAddressA = _RtlIpv4StringToAddressA@16
+ 2069 80A 001B9021 RtlIpv4StringToAddressExA = _RtlIpv4StringToAddressExA@16
+ 2070 80B 000D2526 RtlIpv4StringToAddressExW = _RtlIpv4StringToAddressExW@16
+ 2071 80C 000D256C RtlIpv4StringToAddressW = _RtlIpv4StringToAddressW@16
+ 2072 80D 001B87A4 RtlIpv6AddressToStringA = _RtlIpv6AddressToStringA@8
+ 2073 80E 001B89B6 RtlIpv6AddressToStringExA = _RtlIpv6AddressToStringExA@20
+ 2074 80F 001B8B8E RtlIpv6AddressToStringExW = _RtlIpv6AddressToStringExW@20
+ 2075 810 000F7BA2 RtlIpv6AddressToStringW = _RtlIpv6AddressToStringW@8
+ 2076 811 00101792 RtlIpv6StringToAddressA = _RtlIpv6StringToAddressA@12
+ 2077 812 001B91E1 RtlIpv6StringToAddressExA = _RtlIpv6StringToAddressExA@16
+ 2078 813 000D1F1E RtlIpv6StringToAddressExW = _RtlIpv6StringToAddressExW@16
+ 2079 814 000D1F82 RtlIpv6StringToAddressW = _RtlIpv6StringToAddressW@12
+ 2080 815 0031FDCE RtlIsElevatedRid = _RtlIsElevatedRid@4
+ 2081 816 000EF9DA RtlIsGenericTableEmpty = _RtlIsGenericTableEmpty@4
+ 2082 817 0002B1E4 RtlIsGenericTableEmptyAvl = _RtlIsGenericTableEmptyAvl@4
+ 2083 818 0031E6EE RtlIsMultiSessionSku = _RtlIsMultiSessionSku@0
+ 2084 819 00486AF6 RtlIsMultiUsersInSessionSku = _RtlIsMultiUsersInSessionSku@0
+ 2085 81A 002E2656 RtlIsNameLegalDOS8Dot3 = _RtlIsNameLegalDOS8Dot3@12
+ 2086 81B 000D3830 RtlIsNonEmptyDirectoryReparsePointAllowed = _RtlIsNonEmptyDirectoryReparsePointAllowed@4
+ 2087 81C 0048AAB7 RtlIsNormalizedString = _RtlIsNormalizedString@16
+ 2088 81D 0010790E RtlIsNtDdiVersionAvailable = _RtlIsNtDdiVersionAvailable@4
+ 2089 81E 0048ABEE RtlIsPlaceholderFileHandle = _RtlIsPlaceholderFileHandle@8
+ 2090 81F 0048AC2B RtlIsPlaceholderFileInfo = _RtlIsPlaceholderFileInfo@12
+ 2091 820 00353F36 RtlIsRangeAvailable = _RtlIsRangeAvailable@40
+ 2092 821 0029404C RtlIsSandboxedToken = _RtlIsSandboxedToken@8
+ 2093 822 001B9622 RtlIsServicePackVersionInstalled = _RtlIsServicePackVersionInstalled@4
+ 2094 823 000A0C20 RtlIsUntrustedObject = _RtlIsUntrustedObject@12
+ 2095 824 0048820C RtlIsValidOemCharacter = _RtlIsValidOemCharacter@4
+ 2096 825 0048819F RtlLCIDToCultureName = _RtlLCIDToCultureName@8
+ 2097 826 0011FFE0 RtlLargeIntegerAdd = _RtlLargeIntegerAdd@16
+ 2098 827 001201C0 RtlLargeIntegerArithmeticShift = _RtlLargeIntegerArithmeticShift@12
+ 2099 828 001B9FB5 RtlLargeIntegerDivide = _RtlLargeIntegerDivide@20
+ 2100 829 001201EC RtlLargeIntegerNegate = _RtlLargeIntegerNegate@8
+ 2101 82A 00120170 RtlLargeIntegerShiftLeft = _RtlLargeIntegerShiftLeft@12
+ 2102 82B 00120198 RtlLargeIntegerShiftRight = _RtlLargeIntegerShiftRight@12
+ 2103 82C 00120200 RtlLargeIntegerSubtract = _RtlLargeIntegerSubtract@16
+ 2104 82D 0025AB9C RtlLargeIntegerToChar = _RtlLargeIntegerToChar@16
+ 2105 82E 002DA7D8 RtlLengthRequiredSid = _RtlLengthRequiredSid@4
+ 2106 82F 0027867E RtlLengthSecurityDescriptor = _RtlLengthSecurityDescriptor@4
+ 2107 830 0002BDEA RtlLengthSid = _RtlLengthSid@4
+ 2108 831 00484FEF RtlLoadString = _RtlLoadString@32
+ 2109 832 0048337F RtlLocalTimeToSystemTime = _RtlLocalTimeToSystemTime@8
+ 2110 833 00346C9E RtlLockBootStatusData = _RtlLockBootStatusData@4
+ 2111 834 002B2956 RtlLookupAtomInAtomTable = _RtlLookupAtomInAtomTable@12
+ 2112 835 0007E574 RtlLookupElementGenericTable = _RtlLookupElementGenericTable@8
+ 2113 836 0002B996 RtlLookupElementGenericTableAvl = _RtlLookupElementGenericTableAvl@8
+ 2114 837 0007E59A RtlLookupElementGenericTableFull = _RtlLookupElementGenericTableFull@16
+ 2115 838 0002B9BC RtlLookupElementGenericTableFullAvl = _RtlLookupElementGenericTableFullAvl@16
+ 2116 839 000D9C60 RtlLookupEntryHashTable = _RtlLookupEntryHashTable@12
+ 2117 83A 001B8624 RtlLookupFirstMatchingElementGenericTableAvl = _RtlLookupFirstMatchingElementGenericTableAvl@12
+ 2118 83B 00287AF8 RtlMapGenericMask = _RtlMapGenericMask@8
+ 2119 83C 000D50D0 RtlMapSecurityErrorToNtStatus = _RtlMapSecurityErrorToNtStatus@4
+ 2120 83D 00483226 RtlMergeRangeLists = _RtlMergeRangeLists@16
+ 2121 83E 0011FD40 RtlMoveMemory = _RtlMoveMemory@12
+ 2122 83F 0025A90A RtlMultiByteToUnicodeN = _RtlMultiByteToUnicodeN@20
+ 2123 840 00483C59 RtlMultiByteToUnicodeSize = _RtlMultiByteToUnicodeSize@12
+ 2124 841 00348220 RtlNextUnicodePrefix = _RtlNextUnicodePrefix@8
+ 2125 842 0048AB21 RtlNormalizeString = _RtlNormalizeString@20
+ 2126 843 002B61EE RtlNtStatusToDosError = _RtlNtStatusToDosError@4
+ 2127 844 00076AEA RtlNtStatusToDosErrorNoTeb = _RtlNtStatusToDosErrorNoTeb@4
+ 2128 845 000CD6BE RtlNumberGenericTableElements = _RtlNumberGenericTableElements@4
+ 2129 846 000A013C RtlNumberGenericTableElementsAvl = _RtlNumberGenericTableElementsAvl@4
+ 2130 847 000DA3E0 RtlNumberOfClearBits = _RtlNumberOfClearBits@4
+ 2131 848 001B7B27 RtlNumberOfClearBitsInRange = _RtlNumberOfClearBitsInRange@12
+ 2132 849 000DA464 RtlNumberOfSetBits = _RtlNumberOfSetBits@4
+ 2133 84A 001B7B53 RtlNumberOfSetBitsInRange = _RtlNumberOfSetBitsInRange@12
+ 2134 84B 001BA045 RtlNumberOfSetBitsUlongPtr = _RtlNumberOfSetBitsUlongPtr@4
+ 2135 84C 00482EBA RtlOemStringToCountedUnicodeString = _RtlOemStringToCountedUnicodeString@12
+ 2136 84D 004831DA RtlOemStringToUnicodeSize = _RtlxAnsiStringToUnicodeSize@4
+ 2137 84E 003451DE RtlOemStringToUnicodeString = _RtlOemStringToUnicodeString@12
+ 2138 84F 003452CA RtlOemToUnicodeN = _RtlOemToUnicodeN@20
+ 2139 850 00342D82 RtlOpenCurrentUser = _RtlOpenCurrentUser@8
+ 2140 851 0037763A RtlOsDeploymentState = _RtlOsDeploymentState@4
+ 2141 852 000B534C RtlOwnerAcesPresent = _RtlOwnerAcesPresent@4
+ 2142 853 00104DC2 RtlPcToFileHeader = _RtlPcToFileHeader@8
+ 2143 854 002FC132 RtlPinAtomInAtomTable = _RtlPinAtomInAtomTable@8
+ 148 855 0011FFC8 RtlPrefetchMemoryNonTemporal = @RtlPrefetchMemoryNonTemporal@8
+ 2144 856 0025C11C RtlPrefixString = _RtlPrefixString@12
+ 2145 857 0026E46A RtlPrefixUnicodeString = _RtlPrefixUnicodeString@12
+ 2146 858 002AFC0A RtlQueryAtomInAtomTable = _RtlQueryAtomInAtomTable@24
+ 2147 859 00487B03 RtlQueryDynamicTimeZoneInformation = _RtlQueryDynamicTimeZoneInformation@4
+ 2148 85A 002F400C RtlQueryElevationFlags = _RtlQueryElevationFlags@4
+ 2149 85B 0026F3F8 RtlQueryInformationAcl = _RtlQueryInformationAcl@16
+ 2150 85C 0033FF2A RtlQueryModuleInformation = _RtlQueryModuleInformation@12
+ 2151 85D 0002EF28 RtlQueryPackageClaims = _RtlQueryPackageClaims@32
+ 2152 85E 000300A4 RtlQueryPackageIdentity = _RtlQueryPackageIdentity@24
+ 2153 85F 002BDDCC RtlQueryRegistryValues = _RtlQueryRegistryValues@20
+ 2154 860 002BDDAA RtlQueryRegistryValuesEx = _RtlQueryRegistryValuesEx@20
+ 2155 861 00487B1E RtlQueryTimeZoneInformation = _RtlQueryTimeZoneInformation@4
+ 2156 862 001BA27E RtlQueryValidationRunlevel = _RtlQueryValidationRunlevel@4
+ 2157 863 001202B0 RtlRaiseException = _RtlRaiseException@4
+ 2158 864 00120304 RtlRaiseStatus = _RtlRaiseStatus@4
+ 2159 865 00301E7E RtlRandom = _RtlRandom@4
+ 2160 866 00301E7E RtlRandomEx = _RtlRandom@4
+ 2161 867 00079F3A RtlRbInsertNodeEx = _RtlRbInsertNodeEx@16
+ 2162 868 0007B638 RtlRbRemoveNode = _RtlRbRemoveNode@8
+ 2163 869 0007D0E6 RtlRbReplaceNode = _RtlRbReplaceNode@12
+ 2164 86A 001B84DB RtlRealPredecessor = _RtlRealPredecessor@4
+ 2165 86B 000BCA52 RtlRealSuccessor = _RtlRealSuccessor@4
+ 2166 86C 000DA0D2 RtlRemoveEntryHashTable = _RtlRemoveEntryHashTable@12
+ 2167 86D 002FFD32 RtlRemoveUnicodePrefix = _RtlRemoveUnicodePrefix@8
+ 2168 86E 00486B07 RtlReplaceSidInSd = _RtlReplaceSidInSd@16
+ 2169 86F 0048379E RtlReserveChunk = _RtlReserveChunk@20
+ 2170 870 002815BE RtlRunOnceBeginInitialize = _RtlRunOnceBeginInitialize@12
+ 2171 871 0030218C RtlRunOnceComplete = _RtlRunOnceComplete@12
+ 2172 872 00281524 RtlRunOnceExecuteOnce = _RtlRunOnceExecuteOnce@16
+ 2173 873 00378A56 RtlRunOnceInitialize = _RtlRunOnceInitialize@4
+ 2174 874 00107418 RtlSecondsSince1970ToTime = _RtlSecondsSince1970ToTime@8
+ 2175 875 001B641F RtlSecondsSince1980ToTime = _RtlSecondsSince1980ToTime@8
+ 2177 876 0033230A RtlSelfRelativeToAbsoluteSD = _RtlSelfRelativeToAbsoluteSD@44
+ 2176 877 004856D3 RtlSelfRelativeToAbsoluteSD2 = _RtlSelfRelativeToAbsoluteSD2@8
+ 2178 878 003483E6 RtlSetActiveConsoleId = _RtlSetActiveConsoleId@4
+ 2179 879 000A3FDE RtlSetAllBits = _RtlSetAllBits@4
+ 2180 87A 000CAF98 RtlSetBit = _RtlSetBit@8
+ 2181 87B 000626EA RtlSetBits = _RtlSetBits@12
+ 2182 87C 0030440E RtlSetConsoleSessionForegroundProcessId = _RtlSetConsoleSessionForegroundProcessId@8
+ 2183 87D 00332B74 RtlSetControlSecurityDescriptor = _RtlSetControlSecurityDescriptor@12
+ 2184 87E 00273B4C RtlSetDaclSecurityDescriptor = _RtlSetDaclSecurityDescriptor@16
+ 2185 87F 00487B39 RtlSetDynamicTimeZoneInformation = _RtlSetDynamicTimeZoneInformation@4
+ 2186 880 00320098 RtlSetGroupSecurityDescriptor = _RtlSetGroupSecurityDescriptor@12
+ 2187 881 003200F0 RtlSetOwnerSecurityDescriptor = _RtlSetOwnerSecurityDescriptor@12
+ 2188 882 001B7E42 RtlSetPortableOperatingSystem = _RtlSetPortableOperatingSystem@4
+ 2189 883 003220C6 RtlSetSaclSecurityDescriptor = _RtlSetSaclSecurityDescriptor@16
+ 2190 884 00487B56 RtlSetTimeZoneInformation = _RtlSetTimeZoneInformation@4
+ 2191 885 0002C8AA RtlSidHashInitialize = _RtlSidHashInitialize@12
+ 2192 886 0005C1D0 RtlSidHashLookup = _RtlSidHashLookup@8
+ 2193 887 001B6E4F RtlSizeHeap = _RtlSizeHeap@12
+ 2194 888 0007E638 RtlSplay = _RtlSplay@4
+ 2195 889 00328418 RtlStringFromGUID = _RtlStringFromGUID@8
+ 2196 88A 001B8116 RtlStronglyEnumerateEntryHashTable = _RtlStronglyEnumerateEntryHashTable@8
+ 2197 88B 000DACD6 RtlSubAuthorityCountSid = _RtlSubAuthorityCountSid@4
+ 2198 88C 000DACE8 RtlSubAuthoritySid = _RtlSubAuthoritySid@8
+ 2199 88D 0007E8BA RtlSubtreePredecessor = _RtlSubtreePredecessor@4
+ 2200 88E 001B8518 RtlSubtreeSuccessor = _RtlSubtreeSuccessor@4
+ 2201 88F 00482FB4 RtlSuffixUnicodeString = _RtlSuffixUnicodeString@12
+ 2202 890 00374CB4 RtlSystemTimeToLocalTime = _RtlSystemTimeToLocalTime@8
+ 2203 891 000C3A24 RtlTestBit = _RtlTestBit@8
+ 2204 892 000CD17C RtlTimeFieldsToTime = _RtlTimeFieldsToTime@8
+ 2205 893 004833D3 RtlTimeToElapsedTimeFields = _RtlTimeToElapsedTimeFields@8
+ 2206 894 001B6452 RtlTimeToSecondsSince1970 = _RtlTimeToSecondsSince1970@8
+ 2207 895 001B6496 RtlTimeToSecondsSince1980 = _RtlTimeToSecondsSince1980@8
+ 2208 896 000D1D40 RtlTimeToTimeFields = _RtlTimeToTimeFields@8
+ 2209 897 001BA33D RtlTraceDatabaseAdd = _RtlTraceDatabaseAdd@16
+ 2210 898 001BA372 RtlTraceDatabaseCreate = _RtlTraceDatabaseCreate@20
+ 2211 899 001BA476 RtlTraceDatabaseDestroy = _RtlTraceDatabaseDestroy@4
+ 2212 89A 001BA4AF RtlTraceDatabaseEnumerate = _RtlTraceDatabaseEnumerate@12
+ 2213 89B 001BA542 RtlTraceDatabaseFind = _RtlTraceDatabaseFind@16
+ 2214 89C 001BA580 RtlTraceDatabaseLock = _RtlTraceDatabaseLock@4
+ 2215 89D 001BA596 RtlTraceDatabaseUnlock = _RtlTraceDatabaseUnlock@4
+ 2216 89E 001BA5AC RtlTraceDatabaseValidate = _RtlTraceDatabaseValidate@4
+ 2217 89F 002FE940 RtlUTF8ToUnicodeN = _RtlUTF8ToUnicodeN@20
+ 149 8A0 001B6E04 RtlUlongByteSwap = @RtlUlongByteSwap@4
+ 150 8A1 001B6E0E RtlUlonglongByteSwap = @RtlUlonglongByteSwap@8
+ 2218 8A2 00483201 RtlUnicodeStringToAnsiSize = _RtlxUnicodeStringToAnsiSize@4
+ 2219 8A3 002CAEF4 RtlUnicodeStringToAnsiString = _RtlUnicodeStringToAnsiString@12
+ 2220 8A4 002E2586 RtlUnicodeStringToCountedOemString = _RtlUnicodeStringToCountedOemString@12
+ 2221 8A5 004879E9 RtlUnicodeStringToInt64 = _RtlUnicodeStringToInt64@16
+ 2222 8A6 002DEF2C RtlUnicodeStringToInteger = _RtlUnicodeStringToInteger@12
+ 2223 8A7 00483201 RtlUnicodeStringToOemSize = _RtlxUnicodeStringToAnsiSize@4
+ 2224 8A8 002E23C4 RtlUnicodeStringToOemString = _RtlUnicodeStringToOemString@12
+ 2225 8A9 00483CB6 RtlUnicodeToCustomCPN = _RtlUnicodeToCustomCPN@24
+ 2226 8AA 002CAFD0 RtlUnicodeToMultiByteN = _RtlUnicodeToMultiByteN@20
+ 2227 8AB 00300494 RtlUnicodeToMultiByteSize = _RtlUnicodeToMultiByteSize@12
+ 2228 8AC 002E2E94 RtlUnicodeToOemN = _RtlUnicodeToOemN@20
+ 2229 8AD 0036FE32 RtlUnicodeToUTF8N = _RtlUnicodeToUTF8N@20
+ 2230 8AE 0034784C RtlUnlockBootStatusData = _RtlUnlockBootStatusData@4
+ 2231 8AF 000318DE RtlUnwind = _RtlUnwind@16
+ 2232 8B0 0027A8EE RtlUpcaseUnicodeChar = _RtlUpcaseUnicodeChar@4
+ 2233 8B1 003129DA RtlUpcaseUnicodeString = _RtlUpcaseUnicodeString@12
+ 2234 8B2 004830EA RtlUpcaseUnicodeStringToAnsiString = _RtlUpcaseUnicodeStringToAnsiString@12
+ 2235 8B3 002E27B4 RtlUpcaseUnicodeStringToCountedOemString = _RtlUpcaseUnicodeStringToCountedOemString@12
+ 2236 8B4 002E2498 RtlUpcaseUnicodeStringToOemString = _RtlUpcaseUnicodeStringToOemString@12
+ 2237 8B5 00483E8B RtlUpcaseUnicodeToCustomCPN = _RtlUpcaseUnicodeToCustomCPN@24
+ 2238 8B6 002DD190 RtlUpcaseUnicodeToMultiByteN = _RtlUpcaseUnicodeToMultiByteN@20
+ 2239 8B7 002E28FE RtlUpcaseUnicodeToOemN = _RtlUpcaseUnicodeToOemN@20
+ 2240 8B8 0025C274 RtlUpperChar = _RtlUpperChar@4
+ 2241 8B9 0025C22A RtlUpperString = _RtlUpperString@8
+ 151 8BA 001B6E26 RtlUshortByteSwap = @RtlUshortByteSwap@4
+ 2242 8BB 00272FCA RtlValidAcl = _RtlValidAcl@4
+ 2243 8BC 0025B8CE RtlValidRelativeSecurityDescriptor = _RtlValidRelativeSecurityDescriptor@12
+ 2244 8BD 00272130 RtlValidSecurityDescriptor = _RtlValidSecurityDescriptor@4
+ 2245 8BE 002737E8 RtlValidSid = _RtlValidSid@4
+ 2246 8BF 0002995E RtlValidateUnicodeString = _RtlValidateUnicodeString@8
+ 2247 8C0 000F6020 RtlVerifyVersionInfo = _RtlVerifyVersionInfo@16
+ 2248 8C1 002AF6CE RtlVolumeDeviceToDosName = _IoVolumeDeviceToDosName@8
+ 2249 8C2 0008AC10 RtlWalkFrameChain = _RtlWalkFrameChain@12
+ 2250 8C3 000D23A4 RtlWeaklyEnumerateEntryHashTable = _RtlWeaklyEnumerateEntryHashTable@8
+ 2251 8C4 002BDD40 RtlWriteRegistryValue = _RtlWriteRegistryValue@24
+ 2252 8C5 00487D4B RtlZeroHeap = _RtlZeroHeap@8
+ 2253 8C6 0011FD10 RtlZeroMemory = _RtlZeroMemory@8
+ 2254 8C7 004831DA RtlxAnsiStringToUnicodeSize = _RtlxAnsiStringToUnicodeSize@4
+ 2255 8C8 004831DA RtlxOemStringToUnicodeSize = _RtlxAnsiStringToUnicodeSize@4
+ 2256 8C9 00483201 RtlxUnicodeStringToAnsiSize = _RtlxUnicodeStringToAnsiSize@4
+ 2257 8CA 00483201 RtlxUnicodeStringToOemSize = _RtlxUnicodeStringToAnsiSize@4
+ 2258 8CB 0005B824 SeAccessCheck = _SeAccessCheck@40
+ 2259 8CC 00103308 SeAccessCheckEx = _SeAccessCheckEx@24
+ 2260 8CD 0006C49C SeAccessCheckFromState = _SeAccessCheckFromState@40
+ 2261 8CE 0006C562 SeAccessCheckFromStateEx = _SeAccessCheckFromStateEx@40
+ 2262 8CF 0005B85C SeAccessCheckWithHint = _SeAccessCheckWithHint@44
+ 2263 8D0 002DB730 SeAdjustAccessStateForAccessConstraints = _SeAdjustAccessStateForAccessConstraints@12
+ 2264 8D1 0048C7C1 SeAdjustAccessStateForTrustLabel = _SeAdjustAccessStateForTrustLabel@12
+ 2265 8D2 002E4922 SeAppendPrivileges = _SeAppendPrivileges@8
+ 2266 8D3 002BB984 SeAssignSecurity = _SeAssignSecurity@28
+ 2267 8D4 002F8FB4 SeAssignSecurityEx = _SeAssignSecurityEx@36
+ 2268 8D5 0048CE8C SeAuditFipsCryptoSelftests = _SeAuditFipsCryptoSelftests@8
+ 2269 8D6 0048D1F9 SeAuditHardLinkCreation = _SeAuditHardLinkCreation@12
+ 2270 8D7 0048D217 SeAuditHardLinkCreationWithTransaction = _SeAuditHardLinkCreationWithTransaction@16
+ 2271 8D8 0048DADB SeAuditTransactionStateChange = _SeAuditTransactionStateChange@12
+ 2272 8D9 0048BEDF SeAuditingAnyFileEventsWithContext = _SeAuditingAnyFileEventsWithContext@8
+ 2273 8DA 0005A086 SeAuditingAnyFileEventsWithContextEx = _SeAuditingAnyFileEventsWithContextEx@12
+ 2274 8DB 0048BEFA SeAuditingFileEvents = _SeAuditingFileEvents@8
+ 2275 8DC 0048BF46 SeAuditingFileEventsWithContext = _SeAuditingFileEventsWithContext@12
+ 2276 8DD 001BE8DE SeAuditingFileEventsWithContextEx = _SeAuditingFileEventsWithContextEx@16
+ 2277 8DE 0048BF64 SeAuditingFileOrGlobalEvents = _SeAuditingFileOrGlobalEvents@12
+ 2278 8DF 0048C07C SeAuditingHardLinkEvents = _SeAuditingHardLinkEvents@8
+ 2279 8E0 002FEDD8 SeAuditingHardLinkEventsWithContext = _SeAuditingHardLinkEventsWithContext@12
+ 152 8E1 00317BB4 SeAuditingWithTokenForSubcategory = @SeAuditingWithTokenForSubcategory@8
+ 2280 8E2 0027311A SeCaptureSecurityDescriptor = _SeCaptureSecurityDescriptor@20
+ 2281 8E3 0031E5B4 SeCaptureSubjectContext = _SeCaptureSubjectContext@4
+ 2282 8E4 0029288E SeCaptureSubjectContextEx = _SeCaptureSubjectContextEx@12
+ 2283 8E5 00490206 SeCloseObjectAuditAlarm = _SeCloseObjectAuditAlarm@12
+ 2284 8E6 0049025D SeCloseObjectAuditAlarmForNonObObject = _SeCloseObjectAuditAlarmForNonObObject@16
+ 2285 8E7 002F0D58 SeCompareSigningLevels = _SeCompareSigningLevels@8
+ 2286 8E8 000CF284 SeComputeAutoInheritByObjectType = _SeComputeAutoInheritByObjectType@12
+ 2287 8E9 001C0D7E SeConvertSecurityDescriptorToStringSecurityDescriptor = _SeConvertSecurityDescriptorToStringSecurityDescriptor@20
+ 2288 8EA 001C0E01 SeConvertSidToStringSid = _SeConvertSidToStringSid@8
+ 2289 8EB 000F45BC SeConvertStringSecurityDescriptorToSecurityDescriptor = _SeConvertStringSecurityDescriptorToSecurityDescriptor@16
+ 2290 8EC 00102912 SeConvertStringSidToSid = _SeConvertStringSidToSid@8
+ 2291 8ED 00275D80 SeCreateAccessState = _SeCreateAccessState@16
+ 2292 8EE 002FC9AA SeCreateAccessStateEx = _SeCreateAccessStateEx@24
+ 2293 8EF 00276848 SeCreateClientSecurity = _SeCreateClientSecurity@16
+ 2294 8F0 002765C6 SeCreateClientSecurityEx = _SeCreateClientSecurityEx@16
+ 2295 8F1 00304F5A SeCreateClientSecurityFromSubjectContext = _SeCreateClientSecurityFromSubjectContext@16
+ 2296 8F2 001BFE22 SeCreateClientSecurityFromSubjectContextEx = _SeCreateClientSecurityFromSubjectContextEx@16
+ 2297 8F3 002F66A2 SeDeassignSecurity = _SeDeassignSecurity@4
+ 2298 8F4 00275C20 SeDeleteAccessState = _SeDeleteAccessState@4
+ 2299 8F5 00490283 SeDeleteObjectAuditAlarm = _SeDeleteObjectAuditAlarm@8
+ 2300 8F6 0049029E SeDeleteObjectAuditAlarmWithTransaction = _SeDeleteObjectAuditAlarmWithTransaction@12
+ 2301 8F7 001CB8EB SeEtwWriteKMCveEvent = _SeEtwWriteKMCveEvent@8
+ 2302 8F8 004902F2 SeExamineSacl = _SeExamineSacl@28
+ 2303 8F9 0053567C SeExports = _SeExports
+ 2304 8FA 0048C3FB SeFilterToken = _SeFilterToken@24
+ 2305 8FB 000D2A2E SeFreePrivileges = _SeFreePrivileges@4
+ 2306 8FC 002F2CA2 SeGetCachedSigningLevel = _SeGetCachedSigningLevel@24
+ 2307 8FD 00491255 SeGetLinkedToken = _SeGetLinkedToken@12
+ 2308 8FE 00491318 SeGetLogonSessionToken = _SeGetLogonSessionToken@12
+ 2309 8FF 001EFAF0 SeILSigningPolicyPtr = _SeILSigningPolicyPtr
+ 2310 900 00490FA4 SeImpersonateClient = _SeImpersonateClient@8
+ 2311 901 00276B4A SeImpersonateClientEx = _SeImpersonateClientEx@8
+ 2312 902 00246222 SeIsParentOfChildAppContainer = _SeIsParentOfChildAppContainer@12
+ 2313 903 00312B1E SeLocateProcessImageName = _SeLocateProcessImageName@8
+ 2314 904 00295558 SeLockSubjectContext = _SeLockSubjectContext@4
+ 2315 905 00306C02 SeMarkLogonSessionForTerminationNotification = _SeMarkLogonSessionForTerminationNotification@4
+ 2316 906 00306C1A SeMarkLogonSessionForTerminationNotificationEx = _SeMarkLogonSessionForTerminationNotificationEx@8
+ 2317 907 002F01D2 SeOpenObjectAuditAlarm = _SeOpenObjectAuditAlarm@36
+ 2318 908 00377910 SeOpenObjectAuditAlarmForNonObObject = _SeOpenObjectAuditAlarmForNonObObject@44
+ 2319 909 0029C366 SeOpenObjectAuditAlarmWithTransaction = _SeOpenObjectAuditAlarmWithTransaction@40
+ 2320 90A 004905C4 SeOpenObjectForDeleteAuditAlarm = _SeOpenObjectForDeleteAuditAlarm@36
+ 2321 90B 004905FA SeOpenObjectForDeleteAuditAlarmWithTransaction = _SeOpenObjectForDeleteAuditAlarmWithTransaction@40
+ 2322 90C 00288032 SePrivilegeCheck = _SePrivilegeCheck@12
+ 2323 90D 002DE256 SePrivilegeObjectAuditAlarm = _SePrivilegeObjectAuditAlarm@24
+ 2324 90E 00535674 SePublicDefaultDacl = _SePublicDefaultDacl
+ 2325 90F 002F5428 SeQueryAuthenticationIdToken = _SeQueryAuthenticationIdToken@8
+ 2326 910 002936AE SeQueryInformationToken = _SeQueryInformationToken@12
+ 2327 911 00492209 SeQuerySecureBootPlatformManifest = _SeQuerySecureBootPlatformManifest@8
+ 2328 912 00378B52 SeQuerySecureBootPolicyValue = _SeQuerySecureBootPolicyValue@24
+ 2329 913 0027CDC2 SeQuerySecurityAttributesToken = _SeQuerySecurityAttributesToken@24
+ 2330 914 000D14DC SeQuerySecurityAttributesTokenAccessInformation = _SeQuerySecurityAttributesTokenAccessInformation@24
+ 2331 915 0026F980 SeQuerySecurityDescriptorInfo = _SeQuerySecurityDescriptorInfo@16
+ 2332 916 002F34A8 SeQueryServerSiloToken = _SeQueryServerSiloToken@8
+ 2333 917 002EA8AC SeQuerySessionIdToken = _SeQuerySessionIdToken@8
+ 2334 918 002699A8 SeQuerySessionIdTokenEx = _SeQuerySessionIdTokenEx@12
+ 2335 919 00378832 SeRegisterImageVerificationCallback = _SeRegisterImageVerificationCallback@24
+ 2336 91A 0049195F SeRegisterLogonSessionTerminatedRoutine = _SeRegisterLogonSessionTerminatedRoutine@4
+ 2337 91B 003767F4 SeRegisterLogonSessionTerminatedRoutineEx = _SeRegisterLogonSessionTerminatedRoutineEx@8
+ 2338 91C 002782C2 SeReleaseSecurityDescriptor = _SeReleaseSecurityDescriptor@12
+ 2339 91D 00292840 SeReleaseSubjectContext = _SeReleaseSubjectContext@4
+ 2340 91E 001BFC2B SeReportSecurityEvent = _SeReportSecurityEvent@16
+ 2341 91F 000B4FD0 SeReportSecurityEventWithSubCategory = _SeReportSecurityEventWithSubCategory@20
+ 2342 920 0002D3A6 SeSecurityAttributePresent = _SeSecurityAttributePresent@8
+ 2343 921 00287CE8 SeSetAccessStateGenericMapping = _SeSetAccessStateGenericMapping@8
+ 2344 922 000C2BDA SeSetAuditParameter = _SeSetAuditParameter@16
+ 2345 923 0048C5A7 SeSetSecurityAttributesToken = _SeSetSecurityAttributesToken@16
+ 2346 924 001C015B SeSetSecurityAttributesTokenEx = _SeSetSecurityAttributesTokenEx@28
+ 2347 925 0026F74E SeSetSecurityDescriptorInfo = _SeSetSecurityDescriptorInfo@24
+ 2348 926 004929F7 SeSetSecurityDescriptorInfoEx = _SeSetSecurityDescriptorInfoEx@28
+ 2349 927 002DB6A4 SeShouldCheckForAccessRightsFromParent = _SeShouldCheckForAccessRightsFromParent@12
+ 2350 928 00275C44 SeSinglePrivilegeCheck = _SeSinglePrivilegeCheck@12
+ 2351 929 001BEDC6 SeSrpAccessCheck = _SeSrpAccessCheck@24
+ 2352 92A 00535668 SeSystemDefaultDacl = _SeSystemDefaultDacl
+ 2353 92B 0053554C SeSystemDefaultSd = _SeSystemDefaultSd
+ 2354 92C 000D1580 SeTokenFromAccessInformation = _SeTokenFromAccessInformation@16
+ 2355 92D 0030516E SeTokenImpersonationLevel = _SeTokenImpersonationLevel@4
+ 2356 92E 0031E5E0 SeTokenIsAdmin = _SeTokenIsAdmin@4
+ 2357 92F 000DA9DA SeTokenIsRestricted = _SeTokenIsRestricted@4
+ 2358 930 000DA9F6 SeTokenIsWriteRestricted = _SeTokenIsWriteRestricted@4
+ 2359 931 005344EC SeTokenObjectType = _SeTokenObjectType
+ 2360 932 00278EB2 SeTokenType = _SeTokenType@4
+ 2361 933 00295F4A SeUnlockSubjectContext = _SeUnlockSubjectContext@4
+ 2362 934 0048BCE5 SeUnregisterImageVerificationCallback = _SeUnregisterImageVerificationCallback@4
+ 2363 935 004919DA SeUnregisterLogonSessionTerminatedRoutine = _SeUnregisterLogonSessionTerminatedRoutine@4
+ 2364 936 00491A71 SeUnregisterLogonSessionTerminatedRoutineEx = _SeUnregisterLogonSessionTerminatedRoutineEx@8
+ 2365 937 002BEC94 SeValidSecurityDescriptor = _SeValidSecurityDescriptor@8
+ 2366 938 001B5FE4 SkAcquirePushLockExclusive = _NtosSecureKernelImportBugcheck@0
+ 2367 939 001B5FE4 SkAllocatePool = _NtosSecureKernelImportBugcheck@0
+ 2368 93A 001B5FE4 SkFreePool = _NtosSecureKernelImportBugcheck@0
+ 2369 93B 001B5FE4 SkInitializePushLock = _NtosSecureKernelImportBugcheck@0
+ 2370 93C 001B5FFA SkIsSecureKernel = _SkIsSecureKernel@0
+ 2371 93D 001B5FE4 SkQuerySecureKernelInformation = _NtosSecureKernelImportBugcheck@0
+ 2372 93E 001B5FE4 SkReleasePushLockExclusive = _NtosSecureKernelImportBugcheck@0
+ 2373 93F 000245C6 TmCancelPropagationRequest = _TmCancelPropagationRequest@4
+ 2374 940 000245D2 TmCommitComplete = _TmCommitComplete@8
+ 2375 941 000245DE TmCommitEnlistment = _TmCommitEnlistment@8
+ 2376 942 000245EA TmCommitTransaction = _TmCommitTransaction@8
+ 2377 943 000245F6 TmCreateEnlistment = _TmCreateEnlistment@36
+ 2378 944 00024602 TmCurrentTransaction = _TmCurrentTransaction@4
+ 2379 945 0002460E TmDereferenceEnlistmentKey = _TmDereferenceEnlistmentKey@8
+ 2380 946 0002461A TmEnableCallbacks = _TmEnableCallbacks@12
+ 2381 947 00024626 TmEndPropagationRequest = _TmEndPropagationRequest@4
+ 2382 948 00219BC8 TmEnlistmentObjectType = _TmEnlistmentObjectType
+ 2383 949 00024632 TmFreezeTransactions = _TmFreezeTransactions@12
+ 2384 94A 0002463E TmGetTransactionId = _TmGetTransactionId@8
+ 2385 94B 00024416 TmInitSystem = _TmInitSystem@16
+ 2386 94C 0002440A TmInitSystemPhase2 = _TmInitSystemPhase2@0
+ 2387 94D 0002464A TmInitializeTransactionManager = _TmInitializeTransactionManager@16
+ 2388 94E 00024656 TmIsKTMCommitCoordinator = _TmIsKTMCommitCoordinator@4
+ 2389 94F 00024662 TmIsTransactionActive = _TmIsTransactionActive@4
+ 2390 950 0002466E TmPrePrepareComplete = _TmPrePrepareComplete@8
+ 2391 951 0002467A TmPrePrepareEnlistment = _TmPrePrepareEnlistment@8
+ 2392 952 00024686 TmPrepareComplete = _TmPrepareComplete@8
+ 2393 953 00024692 TmPrepareEnlistment = _TmPrepareEnlistment@8
+ 2394 954 0002469E TmPropagationComplete = _TmPropagationComplete@16
+ 2395 955 000246AA TmPropagationFailed = _TmPropagationFailed@12
+ 2396 956 000246B6 TmReadOnlyEnlistment = _TmReadOnlyEnlistment@8
+ 2397 957 000246C2 TmRecoverEnlistment = _TmRecoverEnlistment@8
+ 2398 958 000246CE TmRecoverResourceManager = _TmRecoverResourceManager@4
+ 2399 959 000246DA TmRecoverTransactionManager = _TmRecoverTransactionManager@8
+ 2400 95A 000246E6 TmReferenceEnlistmentKey = _TmReferenceEnlistmentKey@8
+ 2401 95B 000246F2 TmRenameTransactionManager = _TmRenameTransactionManager@8
+ 2402 95C 000246FE TmRequestOutcomeEnlistment = _TmRequestOutcomeEnlistment@8
+ 2403 95D 00219BC4 TmResourceManagerObjectType = _TmResourceManagerObjectType
+ 2404 95E 0002470A TmRollbackComplete = _TmRollbackComplete@8
+ 2405 95F 00024716 TmRollbackEnlistment = _TmRollbackEnlistment@8
+ 2406 960 00024722 TmRollbackTransaction = _TmRollbackTransaction@8
+ 2407 961 0002472E TmSetCurrentTransaction = _TmSetCurrentTransaction@4
+ 2408 962 0002473A TmSinglePhaseReject = _TmSinglePhaseReject@8
+ 2409 963 00024746 TmThawTransactions = _TmThawTransactions@0
+ 2410 964 00219BCC TmTransactionManagerObjectType = _TmTransactionManagerObjectType
+ 2411 965 00219BC0 TmTransactionObjectType = _TmTransactionObjectType
+ 2412 966 00347174 TtmNotifyDeviceArrival = _TtmNotifyDeviceArrival@24
+ 2413 967 00476BE8 TtmNotifyDeviceDeparture = _TtmNotifyDeviceDeparture@12
+ 2414 968 00476C88 TtmNotifyDeviceInput = _TtmNotifyDeviceInput@16
+ 2415 969 000F77A6 VerSetConditionMask = _VerSetConditionMask@16
+ 2416 96A 001C6E5B VfCheckNxPagePriority = _VfCheckNxPagePriority@8
+ 2417 96B 001C6E7D VfCheckNxPageProtection = _VfCheckNxPageProtection@8
+ 2418 96C 001C6E9F VfCheckNxPoolType = _VfCheckNxPoolType@12
+ 2419 96D 000F91A6 VfFailDeviceNode = _VfFailDeviceNode
+ 2420 96E 001C6EC4 VfFailDriver = _VfFailDriver
+ 2421 96F 001C6EE9 VfFailSystemBIOS = _VfFailSystemBIOS
+ 2422 970 001C6F1A VfInsertContext = _VfInsertContext@4
+ 2423 971 000F91C4 VfIsVerificationEnabled = _VfIsVerificationEnabled@8
+ 2424 972 001C6FCF VfQueryDeviceContext = _VfQueryDeviceContext@8
+ 2425 973 001C7169 VfQueryDispatchTable = _VfQueryDispatchTable@8
+ 2426 974 001C7003 VfQueryDriverContext = _VfQueryDriverContext@8
+ 2427 975 001C7039 VfQueryIrpContext = _VfQueryIrpContext@8
+ 2428 976 001C706F VfQueryThreadContext = _VfQueryThreadContext@8
+ 2429 977 001C70A5 VfRemoveContext = _VfRemoveContext@4
+ 2430 978 001C8337 VmAccessFault = _VmAccessFault@20
+ 2431 979 001C8442 VmColdPagesHint = _VmColdPagesHint@16
+ 2432 97A 004A045F VmCreateMemoryRange = _VmCreateMemoryRange@20
+ 2433 97B 004A057A VmDeleteMemoryRange = _VmDeleteMemoryRange@20
+ 2434 97C 004A0616 VmPauseResumeNotify = _VmPauseResumeNotify@4
+ 2435 97D 00179377 VslCreateSecureSection = _VslCreateSecureSection@20
+ 2436 97E 00179398 VslDeleteSecureSection = _VslDeleteSecureSection@4
+ 2437 97F 00179398 VslExchangeEntropy = _VslDeleteSecureSection@4
+ 2438 980 00108682 VslQuerySecureDevice = _VslQuerySecureDevice@8
+ 2439 981 001793A5 VslRetrieveMailbox = _VslRetrieveMailbox@24
+ 2440 982 0010C004 WRITE_REGISTER_BUFFER_UCHAR = _WRITE_REGISTER_BUFFER_UCHAR@12
+ 2441 983 0010C044 WRITE_REGISTER_BUFFER_ULONG = _WRITE_REGISTER_BUFFER_ULONG@12
+ 2442 984 0010C024 WRITE_REGISTER_BUFFER_USHORT = _WRITE_REGISTER_BUFFER_USHORT@12
+ 2443 985 0010BFC8 WRITE_REGISTER_UCHAR = _WRITE_REGISTER_UCHAR@8
+ 2444 986 0010BFF0 WRITE_REGISTER_ULONG = _WRITE_REGISTER_ULONG@8
+ 2445 987 0010BFDC WRITE_REGISTER_USHORT = _WRITE_REGISTER_USHORT@8
+ 2446 988 004BB359 WheaAddErrorSource = _WheaAddErrorSource@8
+ 2447 989 004BB422 WheaAttemptPhysicalPageOffline = _WheaAttemptPhysicalPageOffline@12
+ 2448 98A 0023B2AE WheaConfigureErrorSource = _WheaConfigureErrorSource@8
+ 2449 98B 00025EC6 WheaGetErrorSource = _WheaGetErrorSource@4
+ 2450 98C 00025956 WheaInitializeRecordHeader = _WheaInitializeRecordHeader@4
+ 2451 98D 00025B60 WheaReportHwError = _WheaReportHwError@4
+ 153 98E 001C8FEE WmiGetClock = @WmiGetClock@8
+ 2452 98F 002470F0 WmiQueryTraceInformation = _WmiQueryTraceInformation@20
+ 2453 990 000C2594 WmiTraceMessage = _WmiTraceMessage
+ 2454 991 001C97BA WmiTraceMessageVa = _WmiTraceMessageVa@24
+ 2455 992 001D53DB XIPDispatch = _XIPDispatch@12
+ 2456 993 0010AC48 ZwAccessCheckAndAuditAlarm = _ZwAccessCheckAndAuditAlarm@44
+ 2457 994 0010AB94 ZwAddBootEntry = _ZwAddBootEntry@8
+ 2458 995 0010AB80 ZwAddDriverEntry = _ZwAddDriverEntry@8
+ 2459 996 0010AB44 ZwAdjustPrivilegesToken = _ZwAdjustPrivilegesToken@24
+ 2460 997 0010AB1C ZwAlertThread = _ZwAlertThread@4
+ 2461 998 0010AAF4 ZwAllocateLocallyUniqueId = _ZwAllocateLocallyUniqueId@4
+ 2462 999 0010AAE0 ZwAllocateReserveObject = _ZwAllocateReserveObject@12
+ 2463 99A 0010AAA4 ZwAllocateVirtualMemory = _ZwAllocateVirtualMemory@24
+ 2464 99B 0010AA90 ZwAlpcAcceptConnectPort = _ZwAlpcAcceptConnectPort@36
+ 2465 99C 0010AA7C ZwAlpcCancelMessage = _ZwAlpcCancelMessage@12
+ 2466 99D 0010AA54 ZwAlpcConnectPort = _ZwAlpcConnectPort@44
+ 2467 99E 0010AA68 ZwAlpcConnectPortEx = _ZwAlpcConnectPortEx@44
+ 2468 99F 0010AA40 ZwAlpcCreatePort = _ZwAlpcCreatePort@12
+ 2469 9A0 0010AA2C ZwAlpcCreatePortSection = _ZwAlpcCreatePortSection@24
+ 2470 9A1 0010AA18 ZwAlpcCreateResourceReserve = _ZwAlpcCreateResourceReserve@16
+ 2471 9A2 0010AA04 ZwAlpcCreateSectionView = _ZwAlpcCreateSectionView@12
+ 2472 9A3 0010A9F0 ZwAlpcCreateSecurityContext = _ZwAlpcCreateSecurityContext@12
+ 2473 9A4 0010A9DC ZwAlpcDeletePortSection = _ZwAlpcDeletePortSection@12
+ 2474 9A5 0010A9C8 ZwAlpcDeleteResourceReserve = _ZwAlpcDeleteResourceReserve@12
+ 2475 9A6 0010A9B4 ZwAlpcDeleteSectionView = _ZwAlpcDeleteSectionView@12
+ 2476 9A7 0010A9A0 ZwAlpcDeleteSecurityContext = _ZwAlpcDeleteSecurityContext@12
+ 2477 9A8 0010A98C ZwAlpcDisconnectPort = _ZwAlpcDisconnectPort@8
+ 2478 9A9 0010A93C ZwAlpcOpenSenderThread = _ZwAlpcOpenSenderThread@24
+ 2479 9AA 0010A928 ZwAlpcQueryInformation = _ZwAlpcQueryInformation@20
+ 2480 9AB 0010A914 ZwAlpcQueryInformationMessage = _ZwAlpcQueryInformationMessage@24
+ 2481 9AC 0010A8EC ZwAlpcSendWaitReceivePort = _ZwAlpcSendWaitReceivePort@32
+ 2482 9AD 0010A8D8 ZwAlpcSetInformation = _ZwAlpcSetInformation@16
+ 2483 9AE 0010A89C ZwAssignProcessToJobObject = _ZwAssignProcessToJobObject@8
+ 2484 9AF 0010A888 ZwAssociateWaitCompletionPacket = _ZwAssociateWaitCompletionPacket@32
+ 2485 9B0 0010A860 ZwCancelIoFile = _ZwCancelIoFile@8
+ 2486 9B1 0010A84C ZwCancelIoFileEx = _ZwCancelIoFileEx@12
+ 2487 9B2 0010A824 ZwCancelTimer = _ZwCancelTimer@8
+ 2488 9B3 0010A810 ZwCancelWaitCompletionPacket = _ZwCancelWaitCompletionPacket@8
+ 2489 9B4 0010A7FC ZwClearEvent = _ZwClearEvent@4
+ 2490 9B5 0010A7E8 ZwClose = _ZwClose@4
+ 2491 9B6 0010A7D4 ZwCloseObjectAuditAlarm = _ZwCloseObjectAuditAlarm@12
+ 2492 9B7 0010A7C0 ZwCommitComplete = _ZwCommitComplete@8
+ 2493 9B8 0010A7AC ZwCommitEnlistment = _ZwCommitEnlistment@8
+ 2494 9B9 0010AC98 ZwCommitRegistryTransaction = _ZwCommitRegistryTransaction@8
+ 2495 9BA 0010A798 ZwCommitTransaction = _ZwCommitTransaction@8
+ 2496 9BB 0010A748 ZwCompareTokens = _ZwCompareTokens@12
+ 2497 9BC 0010A70C ZwConnectPort = _ZwConnectPort@32
+ 2498 9BD 0010A6BC ZwCreateDirectoryObject = _ZwCreateDirectoryObject@12
+ 2499 9BE 0010A680 ZwCreateEnlistment = _ZwCreateEnlistment@32
+ 2500 9BF 0010A66C ZwCreateEvent = _ZwCreateEvent@20
+ 2501 9C0 0010A644 ZwCreateFile = _ZwCreateFile@44
+ 2502 9C1 0010A630 ZwCreateIoCompletion = _ZwCreateIoCompletion@16
+ 2503 9C2 0010A5F4 ZwCreateJobObject = _ZwCreateJobObject@12
+ 2504 9C3 0010A5CC ZwCreateKey = _ZwCreateKey@28
+ 2505 9C4 0010A5A4 ZwCreateKeyTransacted = _ZwCreateKeyTransacted@32
+ 2506 9C5 0010A374 ZwCreatePartition = _ZwCreatePartition@16
+ 2507 9C6 0010A504 ZwCreateProcessEx = _ZwCreateProcessEx@36
+ 2508 9C7 0010A4DC ZwCreateProfileEx = _ZwCreateProfileEx@40
+ 2509 9C8 0010AC70 ZwCreateRegistryTransaction = _ZwCreateRegistryTransaction@16
+ 2510 9C9 0010A4C8 ZwCreateResourceManager = _ZwCreateResourceManager@28
+ 2511 9CA 0010A4B4 ZwCreateSection = _ZwCreateSection@28
+ 2512 9CB 0010A48C ZwCreateSymbolicLinkObject = _ZwCreateSymbolicLinkObject@16
+ 2513 9CC 0010A450 ZwCreateTimer = _ZwCreateTimer@16
+ 2514 9CD 0010A400 ZwCreateTransaction = _ZwCreateTransaction@40
+ 2515 9CE 0010A3EC ZwCreateTransactionManager = _ZwCreateTransactionManager@24
+ 2516 9CF 0010A3B0 ZwCreateWaitCompletionPacket = _ZwCreateWaitCompletionPacket@12
+ 2517 9D0 0010A39C ZwCreateWnfStateName = _ZwCreateWnfStateName@28
+ 2518 9D1 0010A310 ZwDeleteBootEntry = _ZwDeleteBootEntry@4
+ 2519 9D2 0010A2FC ZwDeleteDriverEntry = _ZwDeleteDriverEntry@4
+ 2520 9D3 0010A2E8 ZwDeleteFile = _ZwDeleteFile@4
+ 2521 9D4 0010A2D4 ZwDeleteKey = _ZwDeleteKey@4
+ 2522 9D5 0010A298 ZwDeleteValueKey = _ZwDeleteValueKey@8
+ 2523 9D6 0010A284 ZwDeleteWnfStateData = _ZwDeleteWnfStateData@8
+ 2524 9D7 0010A270 ZwDeleteWnfStateName = _ZwDeleteWnfStateName@4
+ 2525 9D8 0010A25C ZwDeviceIoControlFile = _ZwDeviceIoControlFile@40
+ 2526 9D9 0010A234 ZwDisplayString = _ZwDisplayString@4
+ 2527 9DA 0010A20C ZwDuplicateObject = _ZwDuplicateObject@28
+ 2528 9DB 0010A1F8 ZwDuplicateToken = _ZwDuplicateToken@24
+ 2529 9DC 0010A1D0 ZwEnumerateBootEntries = _ZwEnumerateBootEntries@8
+ 2530 9DD 0010A1BC ZwEnumerateDriverEntries = _ZwEnumerateDriverEntries@8
+ 2531 9DE 0010A1A8 ZwEnumerateKey = _ZwEnumerateKey@24
+ 2532 9DF 0010A180 ZwEnumerateTransactionObject = _ZwEnumerateTransactionObject@20
+ 2533 9E0 0010A16C ZwEnumerateValueKey = _ZwEnumerateValueKey@24
+ 2534 9E1 0010A0E0 ZwFlushBuffersFile = _ZwFlushBuffersFile@8
+ 2535 9E2 0010A0F4 ZwFlushBuffersFileEx = _ZwFlushBuffersFileEx@20
+ 2536 9E3 0010A0B8 ZwFlushInstructionCache = _ZwFlushInstructionCache@12
+ 2537 9E4 0010A0A4 ZwFlushKey = _ZwFlushKey@4
+ 2538 9E5 0010A07C ZwFlushVirtualMemory = _ZwFlushVirtualMemory@16
+ 2539 9E6 0010A040 ZwFreeVirtualMemory = _ZwFreeVirtualMemory@16
+ 2540 9E7 0010A004 ZwFsControlFile = _ZwFsControlFile@40
+ 2541 9E8 00109FF0 ZwGetCachedSigningLevel = _ZwGetCachedSigningLevel@24
+ 2542 9E9 00109F64 ZwGetNextProcess = _ZwGetNextProcess@20
+ 2543 9EA 00109F28 ZwGetNotificationResourceManager = _ZwGetNotificationResourceManager@28
+ 2544 9EB 00109F00 ZwImpersonateAnonymousToken = _ZwImpersonateAnonymousToken@4
+ 2545 9EC 00109E88 ZwInitiatePowerAction = _ZwInitiatePowerAction@16
+ 2546 9ED 00109E74 ZwIsProcessInJob = _ZwIsProcessInJob@8
+ 2547 9EE 00109E24 ZwLoadDriver = _ZwLoadDriver@4
+ 2548 9EF 00109DE8 ZwLoadKey = _ZwLoadKey@8
+ 2549 9F0 00109DC0 ZwLoadKeyEx = _ZwLoadKeyEx@32
+ 2550 9F1 00109DAC ZwLockFile = _ZwLockFile@40
+ 2551 9F2 00109D98 ZwLockProductActivationKeys = _ZwLockProductActivationKeys@8
+ 2552 9F3 00109D70 ZwLockVirtualMemory = _ZwLockVirtualMemory@16
+ 2553 9F4 00109D48 ZwMakeTemporaryObject = _ZwMakeTemporaryObject@4
+ 2554 9F5 00109CBC ZwManagePartition = _ZwManagePartition@20
+ 2555 9F6 00109CF8 ZwMapViewOfSection = _ZwMapViewOfSection@40
+ 2556 9F7 00109CE4 ZwModifyBootEntry = _ZwModifyBootEntry@4
+ 2557 9F8 00109CD0 ZwModifyDriverEntry = _ZwModifyDriverEntry@4
+ 2558 9F9 00109CA8 ZwNotifyChangeDirectoryFile = _ZwNotifyChangeDirectoryFile@36
+ 2559 9FA 00109C94 ZwNotifyChangeKey = _ZwNotifyChangeKey@40
+ 2560 9FB 00109C6C ZwNotifyChangeSession = _ZwNotifyChangeSession@32
+ 2561 9FC 00109C58 ZwOpenDirectoryObject = _ZwOpenDirectoryObject@12
+ 2562 9FD 00109C44 ZwOpenEnlistment = _ZwOpenEnlistment@20
+ 2563 9FE 00109C30 ZwOpenEvent = _ZwOpenEvent@12
+ 2564 9FF 00109C08 ZwOpenFile = _ZwOpenFile@24
+ 2565 A00 00109BE0 ZwOpenJobObject = _ZwOpenJobObject@12
+ 2566 A01 00109BCC ZwOpenKey = _ZwOpenKey@12
+ 2567 A02 00109BA4 ZwOpenKeyEx = _ZwOpenKeyEx@16
+ 2568 A03 00109B90 ZwOpenKeyTransacted = _ZwOpenKeyTransacted@16
+ 2569 A04 00109B7C ZwOpenKeyTransactedEx = _ZwOpenKeyTransactedEx@20
+ 2570 A05 00109AF0 ZwOpenPartition = _ZwOpenPartition@12
+ 2571 A06 00109B2C ZwOpenProcess = _ZwOpenProcess@16
+ 2572 A07 00109B18 ZwOpenProcessToken = _ZwOpenProcessToken@12
+ 2573 A08 00109B04 ZwOpenProcessTokenEx = _ZwOpenProcessTokenEx@16
+ 2574 A09 0010AC84 ZwOpenRegistryTransaction = _ZwOpenRegistryTransaction@12
+ 2575 A0A 00109ADC ZwOpenResourceManager = _ZwOpenResourceManager@20
+ 2576 A0B 00109AC8 ZwOpenSection = _ZwOpenSection@12
+ 2577 A0C 00109AA0 ZwOpenSession = _ZwOpenSession@12
+ 2578 A0D 00109A8C ZwOpenSymbolicLinkObject = _ZwOpenSymbolicLinkObject@12
+ 2579 A0E 00109A78 ZwOpenThread = _ZwOpenThread@16
+ 2580 A0F 00109A64 ZwOpenThreadToken = _ZwOpenThreadToken@16
+ 2581 A10 00109A50 ZwOpenThreadTokenEx = _ZwOpenThreadTokenEx@20
+ 2582 A11 00109A3C ZwOpenTimer = _ZwOpenTimer@12
+ 2583 A12 00109A28 ZwOpenTransaction = _ZwOpenTransaction@20
+ 2584 A13 00109A14 ZwOpenTransactionManager = _ZwOpenTransactionManager@24
+ 2585 A14 001099EC ZwPowerInformation = _ZwPowerInformation@20
+ 2586 A15 001099B0 ZwPrePrepareComplete = _ZwPrePrepareComplete@8
+ 2587 A16 0010999C ZwPrePrepareEnlistment = _ZwPrePrepareEnlistment@8
+ 2588 A17 001099D8 ZwPrepareComplete = _ZwPrepareComplete@8
+ 2589 A18 001099C4 ZwPrepareEnlistment = _ZwPrepareEnlistment@8
+ 2590 A19 00109938 ZwPropagationComplete = _ZwPropagationComplete@16
+ 2591 A1A 00109924 ZwPropagationFailed = _ZwPropagationFailed@12
+ 2592 A1B 00109910 ZwProtectVirtualMemory = _ZwProtectVirtualMemory@20
+ 2593 A1C 001098FC ZwPulseEvent = _ZwPulseEvent@8
+ 2594 A1D 001098D4 ZwQueryBootEntryOrder = _ZwQueryBootEntryOrder@8
+ 2595 A1E 001098C0 ZwQueryBootOptions = _ZwQueryBootOptions@8
+ 2596 A1F 00109898 ZwQueryDefaultLocale = _ZwQueryDefaultLocale@8
+ 2597 A20 00109884 ZwQueryDefaultUILanguage = _ZwQueryDefaultUILanguage@4
+ 2598 A21 00109870 ZwQueryDirectoryFile = _ZwQueryDirectoryFile@44
+ 2599 A22 0010985C ZwQueryDirectoryObject = _ZwQueryDirectoryObject@28
+ 2600 A23 00109848 ZwQueryDriverEntryOrder = _ZwQueryDriverEntryOrder@8
+ 2601 A24 00109834 ZwQueryEaFile = _ZwQueryEaFile@36
+ 2602 A25 0010980C ZwQueryFullAttributesFile = _ZwQueryFullAttributesFile@8
+ 2603 A26 001097E4 ZwQueryInformationByName = _ZwQueryInformationByName@20
+ 2604 A27 001097D0 ZwQueryInformationEnlistment = _ZwQueryInformationEnlistment@20
+ 2605 A28 001097BC ZwQueryInformationFile = _ZwQueryInformationFile@20
+ 2606 A29 001097A8 ZwQueryInformationJobObject = _ZwQueryInformationJobObject@20
+ 2607 A2A 00109780 ZwQueryInformationProcess = _ZwQueryInformationProcess@20
+ 2608 A2B 0010976C ZwQueryInformationResourceManager = _ZwQueryInformationResourceManager@20
+ 2609 A2C 00109758 ZwQueryInformationThread = _ZwQueryInformationThread@20
+ 2610 A2D 00109744 ZwQueryInformationToken = _ZwQueryInformationToken@20
+ 2611 A2E 00109730 ZwQueryInformationTransaction = _ZwQueryInformationTransaction@20
+ 2612 A2F 0010971C ZwQueryInformationTransactionManager = _ZwQueryInformationTransactionManager@20
+ 2613 A30 001096F4 ZwQueryInstallUILanguage = _ZwQueryInstallUILanguage@4
+ 2614 A31 001096E0 ZwQueryIntervalProfile = _ZwQueryIntervalProfile@8
+ 2615 A32 001096B8 ZwQueryKey = _ZwQueryKey@20
+ 2616 A33 001096A4 ZwQueryLicenseValue = _ZwQueryLicenseValue@20
+ 2617 A34 00109668 ZwQueryObject = _ZwQueryObject@20
+ 2618 A35 00109604 ZwQueryQuotaInformationFile = _ZwQueryQuotaInformationFile@36
+ 2619 A36 001095F0 ZwQuerySection = _ZwQuerySection@20
+ 2620 A37 001095DC ZwQuerySecurityAttributesToken = _ZwQuerySecurityAttributesToken@24
+ 2621 A38 001095C8 ZwQuerySecurityObject = _ZwQuerySecurityObject@20
+ 2622 A39 0010958C ZwQuerySymbolicLinkObject = _ZwQuerySymbolicLinkObject@12
+ 2623 A3A 00109564 ZwQuerySystemEnvironmentValueEx = _ZwQuerySystemEnvironmentValueEx@20
+ 2624 A3B 00109550 ZwQuerySystemInformation = _ZwQuerySystemInformation@16
+ 2625 A3C 0010953C ZwQuerySystemInformationEx = _ZwQuerySystemInformationEx@24
+ 2626 A3D 00109500 ZwQueryTimerResolution = _ZwQueryTimerResolution@12
+ 2627 A3E 001094EC ZwQueryValueKey = _ZwQueryValueKey@24
+ 2628 A3F 001094D8 ZwQueryVirtualMemory = _ZwQueryVirtualMemory@24
+ 2629 A40 001094C4 ZwQueryVolumeInformationFile = _ZwQueryVolumeInformationFile@20
+ 2630 A41 0010949C ZwQueryWnfStateData = _ZwQueryWnfStateData@24
+ 2631 A42 001094B0 ZwQueryWnfStateNameInformation = _ZwQueryWnfStateNameInformation@20
+ 2632 A43 00109424 ZwReadFile = _ZwReadFile@36
+ 2633 A44 001093FC ZwReadOnlyEnlistment = _ZwReadOnlyEnlistment@8
+ 2634 A45 001093C0 ZwRecoverEnlistment = _ZwRecoverEnlistment@8
+ 2635 A46 001093AC ZwRecoverResourceManager = _ZwRecoverResourceManager@4
+ 2636 A47 00109398 ZwRecoverTransactionManager = _ZwRecoverTransactionManager@4
+ 2637 A48 0010930C ZwRemoveIoCompletion = _ZwRemoveIoCompletion@20
+ 2638 A49 001092F8 ZwRemoveIoCompletionEx = _ZwRemoveIoCompletionEx@24
+ 2639 A4A 001092D0 ZwRenameKey = _ZwRenameKey@8
+ 2640 A4B 001092A8 ZwReplaceKey = _ZwReplaceKey@12
+ 2641 A4C 00109230 ZwRequestPort = _ZwRequestPort@8
+ 2642 A4D 0010921C ZwRequestWaitReplyPort = _ZwRequestWaitReplyPort@12
+ 2643 A4E 00109208 ZwResetEvent = _ZwResetEvent@8
+ 2644 A4F 001091E0 ZwRestoreKey = _ZwRestoreKey@12
+ 2645 A50 00109190 ZwRollbackComplete = _ZwRollbackComplete@8
+ 2646 A51 0010917C ZwRollbackEnlistment = _ZwRollbackEnlistment@8
+ 2647 A52 0010ACAC ZwRollbackRegistryTransaction = _ZwRollbackRegistryTransaction@8
+ 2648 A53 00109168 ZwRollbackTransaction = _ZwRollbackTransaction@8
+ 2649 A54 00109140 ZwSaveKey = _ZwSaveKey@8
+ 2650 A55 0010912C ZwSaveKeyEx = _ZwSaveKeyEx@12
+ 2651 A56 00109104 ZwSecureConnectPort = _ZwSecureConnectPort@36
+ 2652 A57 001090DC ZwSetBootEntryOrder = _ZwSetBootEntryOrder@8
+ 2653 A58 001090C8 ZwSetBootOptions = _ZwSetBootOptions@8
+ 2654 A59 001090B4 ZwSetCachedSigningLevel = _ZwSetCachedSigningLevel@20
+ 2655 A5A 00109050 ZwSetDefaultLocale = _ZwSetDefaultLocale@8
+ 2656 A5B 0010903C ZwSetDefaultUILanguage = _ZwSetDefaultUILanguage@4
+ 2657 A5C 00109028 ZwSetDriverEntryOrder = _ZwSetDriverEntryOrder@8
+ 2658 A5D 00109014 ZwSetEaFile = _ZwSetEaFile@16
+ 2659 A5E 00109000 ZwSetEvent = _ZwSetEvent@8
+ 2660 A5F 00108F9C ZwSetInformationEnlistment = _ZwSetInformationEnlistment@16
+ 2661 A60 00108F88 ZwSetInformationFile = _ZwSetInformationFile@20
+ 2662 A61 00108F74 ZwSetInformationJobObject = _ZwSetInformationJobObject@16
+ 2663 A62 00108F60 ZwSetInformationKey = _ZwSetInformationKey@16
+ 2664 A63 00108F4C ZwSetInformationObject = _ZwSetInformationObject@16
+ 2665 A64 00108F38 ZwSetInformationProcess = _ZwSetInformationProcess@16
+ 2666 A65 00108F24 ZwSetInformationResourceManager = _ZwSetInformationResourceManager@16
+ 2667 A66 00108F10 ZwSetInformationThread = _ZwSetInformationThread@16
+ 2668 A67 00108EFC ZwSetInformationToken = _ZwSetInformationToken@16
+ 2669 A68 00108EE8 ZwSetInformationTransaction = _ZwSetInformationTransaction@16
+ 2670 A69 00109988 ZwSetInformationVirtualMemory = _ZwSetInformationVirtualMemory@24
+ 2671 A6A 00108EAC ZwSetIntervalProfile = _ZwSetIntervalProfile@8
+ 2672 A6B 00108E98 ZwSetIoCompletion = _ZwSetIoCompletion@20
+ 2673 A6C 00108E84 ZwSetIoCompletionEx = _ZwSetIoCompletionEx@24
+ 2674 A6D 00108DF8 ZwSetQuotaInformationFile = _ZwSetQuotaInformationFile@16
+ 2675 A6E 00108DE4 ZwSetSecurityObject = _ZwSetSecurityObject@12
+ 2676 A6F 00108DBC ZwSetSystemEnvironmentValueEx = _ZwSetSystemEnvironmentValueEx@20
+ 2677 A70 00108DA8 ZwSetSystemInformation = _ZwSetSystemInformation@12
+ 2678 A71 00108D80 ZwSetSystemTime = _ZwSetSystemTime@8
+ 2679 A72 00108D58 ZwSetTimer = _ZwSetTimer@28
+ 2680 A73 00108D44 ZwSetTimerEx = _ZwSetTimerEx@16
+ 2681 A74 00108D30 ZwSetTimerResolution = _ZwSetTimerResolution@12
+ 2682 A75 00108D08 ZwSetValueKey = _ZwSetValueKey@24
+ 2683 A76 00108CF4 ZwSetVolumeInformationFile = _ZwSetVolumeInformationFile@20
+ 2684 A77 00108C7C ZwStartProfile = _ZwStartProfile@4
+ 2685 A78 00108C68 ZwStopProfile = _ZwStopProfile@4
+ 2686 A79 00108C04 ZwTerminateJobObject = _ZwTerminateJobObject@8
+ 2687 A7A 00108BF0 ZwTerminateProcess = _ZwTerminateProcess@8
+ 2688 A7B 00108B8C ZwTraceControl = _ZwTraceControl@24
+ 2689 A7C 00108B78 ZwTraceEvent = _ZwTraceEvent@16
+ 2690 A7D 00108B64 ZwTranslateFilePath = _ZwTranslateFilePath@16
+ 2691 A7E 00108B3C ZwUnloadDriver = _ZwUnloadDriver@4
+ 2693 A7F 00108B28 ZwUnloadKey = _ZwUnloadKey@4
+ 2692 A80 00108B14 ZwUnloadKey2 = _ZwUnloadKey2@8
+ 2694 A81 00108B00 ZwUnloadKeyEx = _ZwUnloadKeyEx@8
+ 2695 A82 00108AEC ZwUnlockFile = _ZwUnlockFile@20
+ 2696 A83 00108AD8 ZwUnlockVirtualMemory = _ZwUnlockVirtualMemory@16
+ 2697 A84 00108AB0 ZwUnmapViewOfSection = _ZwUnmapViewOfSection@8
+ 2698 A85 00108A9C ZwUpdateWnfStateData = _ZwUpdateWnfStateData@28
+ 2699 A86 00108A24 ZwWaitForMultipleObjects = _ZwWaitForMultipleObjects@20
+ 2700 A87 001089FC ZwWaitForSingleObject = _ZwWaitForSingleObject@12
+ 2701 A88 001089AC ZwWriteFile = _ZwWriteFile@36
+ 2702 A89 0010895C ZwYieldExecution = _ZwYieldExecution@0
+ 2703 A8A 0010CE60 _CIcos = __CIcos
+ 2704 A8B 0010CF20 _CIsin = __CIsin
+ 2705 A8C 0010CFD0 _CIsqrt = __CIsqrt
+ 2706 A8D 0010D175 _abnormal_termination = __abnormal_termination
+ 2707 A8E 0010D1D0 _alldiv = __alldiv
+ 2708 A8F 0010D280 _alldvrm = __alldvrm
+ 2709 A90 0010D360 _allmul = __allmul
+ 2710 A91 0010D394 _alloca_probe = __alloca_probe
+ 2711 A92 0010D3C0 _alloca_probe_16 = __alloca_probe_16
+ 2712 A93 0010D3D6 _alloca_probe_8 = __alloca_probe_8
+ 2713 A94 0010D3F0 _allrem = __allrem
+ 2714 A95 0010D4B0 _allshl = __allshl
+ 2715 A96 0010D4D0 _allshr = __allshr
+ 2716 A97 0010D500 _aulldiv = __aulldiv
+ 2717 A98 0010D570 _aulldvrm = __aulldvrm
+ 2718 A99 0010D610 _aullrem = __aullrem
+ 2719 A9A 0010D690 _aullshr = __aullshr
+ 2720 A9B 0010D394 _chkstk = __alloca_probe
+ 2721 A9C 0010D6B8 _except_handler2 = __except_handler2
+ 2722 A9D 0010D770 _except_handler3 = __except_handler3
+ 2723 A9E 0010D876 _finite = __finite
+ 2724 A9F 0010D08C _global_unwind2 = __global_unwind2
+ 2725 AA0 00113286 _i64toa_s = __i64toa_s
+ 2726 AA1 0011355C _i64tow_s = __i64tow_s
+ 2727 AA2 0010D896 _itoa = __itoa
+ 2728 AA3 001132BE _itoa_s = __itoa_s
+ 2729 AA4 0010D914 _itow = __itow
+ 2730 AA5 00113594 _itow_s = __itow_s
+ 2731 AA6 0010D0F1 _local_unwind2 = __local_unwind2
+ 2732 AA7 001132EE _ltoa_s = __ltoa_s
+ 2733 AA8 001135C4 _ltow_s = __ltow_s
+ 2734 AA9 00113732 _makepath_s = __makepath_s
+ 2735 AAA 001D43B0 _purecall = __purecall
+ 2736 AAB 0010D9C6 _snprintf = __snprintf
+ 2737 AAC 0011381E _snprintf_s = __snprintf_s
+ 2738 AAD 001138E6 _snscanf_s = __snscanf_s
+ 2739 AAE 0010DA6C _snwprintf = __snwprintf
+ 2740 AAF 00113922 _snwprintf_s = __snwprintf_s
+ 2741 AB0 001139E2 _snwscanf_s = __snwscanf_s
+ 2742 AB1 00113A1E _splitpath_s = __splitpath_s
+ 2743 AB2 0010DB3C _stricmp = __stricmp
+ 2744 AB3 0010DB4C _strlwr = __strlwr
+ 2745 AB4 0010DB7A _strnicmp = __strnicmp
+ 2746 AB5 0010DB90 _strnset = __strnset
+ 2747 AB6 00113BFC _strnset_s = __strnset_s
+ 2748 AB7 0010DBC0 _strrev = __strrev
+ 2749 AB8 0010DC00 _strset = __strset
+ 2750 AB9 00113C78 _strset_s = __strset_s
+ 2751 ABA 0010DE82 _strtoui64 = __strtoui64
+ 2752 ABB 0010CABC _strupr = __strupr
+ 2753 ABC 0010DEA6 _swprintf = __swprintf
+ 2754 ABD 00113320 _ui64toa_s = __ui64toa_s
+ 2755 ABE 001135F6 _ui64tow_s = __ui64tow_s
+ 2756 ABF 00113342 _ultoa_s = __ultoa_s
+ 2757 AC0 00113618 _ultow_s = __ultow_s
+ 2758 AC1 0010CBEE _vsnprintf = __vsnprintf
+ 2759 AC2 00113842 _vsnprintf_s = __vsnprintf_s
+ 2760 AC3 0010CAFE _vsnwprintf = __vsnwprintf
+ 2761 AC4 00113946 _vsnwprintf_s = __vsnwprintf_s
+ 2762 AC5 0010DF40 _vswprintf = __vswprintf
+ 2763 AC6 0010DFFA _wcsicmp = __wcsicmp
+ 2764 AC7 0010E05A _wcslwr = __wcslwr
+ 2765 AC8 0010E0AC _wcslwr_s = __wcslwr_s
+ 2766 AC9 0010E10E _wcsnicmp = __wcsnicmp
+ 2767 ACA 0010E186 _wcsnset = __wcsnset
+ 2768 ACB 0010E1B6 _wcsnset_s = __wcsnset_s
+ 2769 ACC 0010E23C _wcsrev = __wcsrev
+ 2770 ACD 0010E27E _wcsset_s = __wcsset_s
+ 2771 ACE 0010E2D8 _wcsupr = __wcsupr
+ 2772 ACF 00113CCA _wmakepath_s = __wmakepath_s
+ 2773 AD0 00113DF0 _wsplitpath_s = __wsplitpath_s
+ 2774 AD1 0010E312 _wtoi = __wtoi
+ 2775 AD2 0010E322 _wtol = __wtol
+ 2776 AD3 0010CE1E atoi = _atoi
+ 2777 AD4 0010CE2E atol = _atol
+ 2778 AD5 0010E34A bsearch = _bsearch
+ 2779 AD6 0010E3F4 bsearch_s = _bsearch_s
+ 2780 AD7 0010E4BA isdigit = _isdigit
+ 2781 AD8 0010E4E0 islower = _islower
+ 2782 AD9 0010E506 isprint = _isprint
+ 2783 ADA 0010E52E isspace = _isspace
+ 2784 ADB 0010E554 isupper = _isupper
+ 2785 ADC 0010E5A2 iswalnum = _iswalnum
+ 2786 ADD 0010E5BE iswdigit = _iswdigit
+ 2787 ADE 0010E5D6 iswspace = _iswspace
+ 2788 ADF 0010E57A isxdigit = _isxdigit
+ 2789 AE0 0010E5EE mbstowcs = _mbstowcs
+ 2790 AE1 00115228 mbtowc = __safecrt_mbtowc
+ 2791 AE2 0010E670 memchr = _memchr
+ 2792 AE3 0010E722 memcmp = _memcmp
+ 2793 AE4 0010E780 memcpy = _memcpy
+ 2794 AE5 00113FFA memcpy_s = _memcpy_s
+ 2795 AE6 0010EAC0 memmove = _memmove
+ 2796 AE7 00114080 memmove_s = _memmove_s
+ 2797 AE8 0010EE00 memset = _memset
+ 2798 AE9 00534D90 psMUITest = _psMUITest
+ 2799 AEA 0010EE70 qsort = _qsort
+ 2800 AEB 0010F27E rand = _rand
+ 2801 AEC 0010F2B4 sprintf = _sprintf
+ 2802 AED 001140E8 sprintf_s = _sprintf_s
+ 2803 AEE 0010F2A0 srand = _srand
+ 2804 AEF 00114160 sscanf_s = _sscanf_s
+ 2805 AF0 0010F340 strcat = _strcat
+ 2806 AF1 001141A8 strcat_s = _strcat_s
+ 2807 AF2 0010F440 strchr = _strchr
+ 2808 AF3 0010F500 strcmp = _strcmp
+ 2809 AF4 0010F330 strcpy = _strcpy
+ 2810 AF5 0011422C strcpy_s = _strcpy_s
+ 2811 AF6 0010F590 strlen = _strlen
+ 2812 AF7 0010F620 strncat = _strncat
+ 2813 AF8 0011429A strncat_s = _strncat_s
+ 2814 AF9 0010CCB2 strncmp = _strncmp
+ 2815 AFA 0010F760 strncpy = _strncpy
+ 2816 AFB 00114394 strncpy_s = _strncpy_s
+ 2817 AFC 0010F88A strnlen = _strnlen
+ 2818 AFD 0010F8B0 strrchr = _strrchr
+ 2819 AFE 0010F8E0 strspn = _strspn
+ 2820 AFF 0010CD70 strstr = _strstr
+ 2821 B00 0011447E strtok_s = _strtok_s
+ 2822 B01 0010DEA6 swprintf = __swprintf
+ 2823 B02 0011310A swprintf_s = _swprintf_s
+ 2824 B03 00114578 swscanf_s = _swscanf_s
+ 2825 B04 0010F92C tolower = _tolower
+ 2826 B05 0010F95A toupper = _toupper
+ 2827 B06 0010F9BA towlower = _towlower
+ 2828 B07 0010F9E0 towupper = _towupper
+ 2829 B08 000A0752 vDbgPrintEx = _vDbgPrintEx@16
+ 2830 B09 001B67CD vDbgPrintExWithPrefix = _vDbgPrintExWithPrefix@20
+ 2831 B0A 0010FA6C vsprintf = _vsprintf
+ 2832 B0B 0011410A vsprintf_s = _vsprintf_s
+ 2833 B0C 0011312C vswprintf_s = _vswprintf_s
+ 2834 B0D 0010FA8C wcscat = _wcscat
+ 2835 B0E 001145C8 wcscat_s = _wcscat_s
+ 2836 B0F 0010FAEA wcschr = _wcschr
+ 2837 B10 0010FB16 wcscmp = _wcscmp
+ 2838 B11 0010FAC2 wcscpy = _wcscpy
+ 2839 B12 00114658 wcscpy_s = _wcscpy_s
+ 2840 B13 0010FB5C wcscspn = _wcscspn
+ 2841 B14 0010FBAE wcslen = _wcslen
+ 2842 B15 0010FBCE wcsncat = _wcsncat
+ 2843 B16 001146CE wcsncat_s = _wcsncat_s
+ 2844 B17 0010FC18 wcsncmp = _wcsncmp
+ 2845 B18 0010FC58 wcsncpy = _wcsncpy
+ 2846 B19 001147CA wcsncpy_s = _wcsncpy_s
+ 2847 B1A 0010FCA4 wcsnlen = _wcsnlen
+ 2848 B1B 0010FCCA wcsrchr = _wcsrchr
+ 2849 B1C 0010FD02 wcsspn = _wcsspn
+ 2850 B1D 0010FD5A wcsstr = _wcsstr
+ 2851 B1E 0010FDC8 wcstombs = _wcstombs
+ 2852 B1F 00110090 wcstoul = _wcstoul
+ 2853 B20 0011013A wctomb = _wctomb
+ 1 003074E2 [NONAME] _PsCaptureUserProcessParameters@8
+ 2 0010A3D8 [NONAME] _ZwCreateUserProcess@44
+ 3 001D388A [NONAME] _ExAllocateTimerInternal@12
+ 4 000F64B4 [NONAME] _ExAllocateTimerInternal2@16
+
+ Summary
+
+ 28000 .data
+ 17000 .edata
+ 3000 .idata
+ 26000 .reloc
+ 33000 .rsrc
+ 1EB000 .text
+ E000 ALMOSTRO
+ 7000 CACHEALI
+ 40000 INIT
+ 16000 INITDATA
+ 2A6000 PAGE
+ 6000 PAGEBGFX
+ 7000 PAGEDATA
+ 2000 PAGEHDLS
+ 5000 PAGEKD
+ D000 PAGEKDD
+ 16000 PAGELK
+ 3000 PAGEVRFB
+ 5000 PAGEVRFD
+ 22000 PAGEVRFY
+ 2000 POOLCODE
+ 1000 PROTDATA