随着对JNA的深入，需要用到​​GetProcAddress(HMODULE hmodule, int ordinal)​​方法，在C语言中第二个参数是一个字符串（通过传入函数的名称得到函数回调地址），但是在JNA中却没提供传字符串的方法，个人看了一下源码仓库社区谈到的issue，似乎也只有这个传int方法。

麻烦的是社区以及源码中没有相关资料对这个ordinal做过多解释。一方面这个值与​​dll​​​文件相关(例如：​​Kernel32.dll​​​、​​NTdll.dll​​等文件)，这个ordinal只是用来获取对应的dll文件中的函数序号，那么这个序号该如何获取呢？

获取ordinal

在安装完Visual Studio 以及SDK后会有一个​​dumpbin.exe​​可以帮助我们获取这个ordinal。

这个文件所在位置如下，注意路径不一定会和我一致哦，版本号换成自己的，然后往里面找就会找到这个文件

​​D:\Program Files\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30133\bin\Hostx64\x64\dumpbin.exe​​

最好将这个文件所在的路径加入到环境变量PATH中。

然后可以唤出powershell (快捷键win+x+a，或者按住shift + 鼠标右键 有一个powershell选项 )或者 cmd

通过下面命令格式得到这个ordinal

下面的dll文件换成想要查询的dll

dumpbin.exe -exports .\kernel32.dll

如果内部函数太多建议使用下面这条命令过滤一下

​​LoadLibrary 是我想要查找的函数名称​​

dumpbin.exe -exports .\kernel32.dll | findstr LoadLibrary

如下会匹配到下面这些函数，第一列就是我们想要的​​ordinal​​ 建议dll文件不要直接执行系统盘文件，将其copy出来最好

JNA 中 GetProcAddress(HMODULE hmodule, int ordinal) 的正确使用方式。LoadLibrary_windows-api

HMODULE k32module = kernel32.GetModuleHandle("Kernel32.dll");
/** ordinal序号
 * 969   LoadLibraryA
 * 970   LoadLibraryExA
 * 971   LoadLibraryExW
 * 972   LoadLibraryW
 * 示例代码：仅供参考
 */
Pointer loadLibraryAddress = kernel32.GetProcAddress(k32module, 969);
HANDLE handle = kernel32.CreateRemoteThread(process, null, 0, loadLibraryAddress, virtualAllocEx, 0, null);
if (handle==null){
    System.out.println("注入失败");
    return;
}

Kernel32.dll 中函数的ordinal ( ctrl + f 搜索 )

PS D:\工作> dumpbin.exe -exports .\kernel32.dll
Microsoft (R) COFF/PE Dumper Version 14.29.30140.0
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file .\kernel32.dll

File Type: DLL

  Section contains the following exports for KERNEL32.dll

    00000000 characteristics
    1A965747 time date stamp
        0.00 version
           1 ordinal base
        1633 number of functions
        1633 number of names

    ordinal hint RVA      name

          1    0          AcquireSRWLockExclusive (forwarded to NTDLL.RtlAcquireSRWLockExclusive)
          2    1          AcquireSRWLockShared (forwarded to NTDLL.RtlAcquireSRWLockShared)
          3    2 00020080 ActivateActCtx
          4    3 0001B700 ActivateActCtxWorker
          5    4 0005A140 AddAtomA
          6    5 000128F0 AddAtomW
          7    6 00025640 AddConsoleAliasA
          8    7 00025650 AddConsoleAliasW
          9    8          AddDllDirectory (forwarded to api-ms-win-core-libraryloader-l1-1-0.AddDllDirectory)
         10    9 0003CCE0 AddIntegrityLabelToBoundaryDescriptor
         11    A 0005A280 AddLocalAlternateComputerNameA
         12    B 0005A2E0 AddLocalAlternateComputerNameW
         13    C 00022270 AddRefActCtx
         14    D 0001E2C0 AddRefActCtxWorker
         15    E 0003A620 AddResourceAttributeAce
         16    F 000208A0 AddSIDToBoundaryDescriptor
         17   10 0003A640 AddScopedPolicyIDAce
         18   11 00038A40 AddSecureMemoryCacheCallback
         19   12          AddVectoredContinueHandler (forwarded to NTDLL.RtlAddVectoredContinueHandler)
         20   13          AddVectoredExceptionHandler (forwarded to NTDLL.RtlAddVectoredExceptionHandler)
         21   14 00007200 AdjustCalendarDate
         22   15 00025290 AllocConsole
         23   16 0003A680 AllocateUserPhysicalPages
         24   17 0003A660 AllocateUserPhysicalPagesNuma
         25   18          AppPolicyGetClrCompat (forwarded to kernelbase.AppPolicyGetClrCompat)
         26   19          AppPolicyGetCreateFileAccess (forwarded to kernelbase.AppPolicyGetCreateFileAccess)
         27   1A          AppPolicyGetLifecycleManagement (forwarded to kernelbase.AppPolicyGetLifecycleManagement)
         28   1B          AppPolicyGetMediaFoundationCodecLoading (forwarded to kernelbase.AppPolicyGetMediaFoundationCodecLoading)
         29   1C          AppPolicyGetProcessTerminationMethod (forwarded to kernelbase.AppPolicyGetProcessTerminationMethod)
         30   1D          AppPolicyGetShowDeveloperDiagnostic (forwarded to kernelbase.AppPolicyGetShowDeveloperDiagnostic)
         31   1E          AppPolicyGetThreadInitializationType (forwarded to kernelbase.AppPolicyGetThreadInitializationType)
         32   1F          AppPolicyGetWindowingModel (forwarded to kernelbase.AppPolicyGetWindowingModel)
         33   20          AppXGetOSMaxVersionTested (forwarded to kernelbase.AppXGetOSMaxVersionTested)
         34   21 00043E30 ApplicationRecoveryFinished
         35   22 00043E40 ApplicationRecoveryInProgress
         36   23 00020BF0 AreFileApisANSI
         37   24 0001FF00 AssignProcessToJobObject
         38   25 000252A0 AttachConsole
         39   26 0005CD10 BackupRead
         40   27 0005DF70 BackupSeek
         41   28 0005E250 BackupWrite
         42   29 0003A700 BaseCheckAppcompatCache
         43   2A 0003A6A0 BaseCheckAppcompatCacheEx
         44   2B 00020F60 BaseCheckAppcompatCacheExWorker
         45   2C 00020F60 BaseCheckAppcompatCacheWorker
         46   2D 00018750 BaseCheckElevation
         47   2E 0003A720 BaseCleanupAppcompatCacheSupport
         48   2F 000213E0 BaseCleanupAppcompatCacheSupportWorker
         49   30 00040630 BaseDestroyVDMEnvironment
         50   31 0000C500 BaseDllReadWriteIniFile
         51   32 0003A740 BaseDumpAppcompatCache
         52   33 00037B60 BaseDumpAppcompatCacheWorker
         53   34 0001D310 BaseElevationPostProcessing
         54   35 0003A760 BaseFlushAppcompatCache
         55   36 00070B90 BaseFlushAppcompatCacheWorker
         56   37 00024860 BaseFormatObjectAttributes
         57   38 00059960 BaseFormatTimeOut
         58   39 0001FE60 BaseFreeAppCompatDataForProcessWorker
         59   3A 000167B0 BaseGenerateAppCompatData
         60   3B 0003A780 BaseGetNamedObjectDirectory
         61   3C 0003A7A0 BaseInitAppcompatCacheSupport
         62   3D 000213E0 BaseInitAppcompatCacheSupportWorker
         63   3E 00020F60 BaseIsAppcompatInfrastructureDisabled
         64   3F 00020F60 BaseIsAppcompatInfrastructureDisabledWorker
         65   40 00060F10 BaseIsDosApplication
         66   41 00071000 BaseQueryModuleData
         67   42 0001F6F0 BaseReadAppCompatDataForProcessWorker
         68   43 000130E0 BaseSetLastNTError
         69   44 00017020 BaseThreadInitThunk
         70   45 0003A7C0 BaseUpdateAppcompatCache
         71   46 00070BF0 BaseUpdateAppcompatCacheWorker
         72   47 00040990 BaseUpdateVDMEntry
         73   48 00059A00 BaseVerifyUnicodeString
         74   49 0005F6E0 BaseWriteErrorElevationRequiredEvent
         75   4A 0001C090 Basep8BitStringToDynamicUnicodeString
         76   4B 00059A60 BasepAllocateActivationContextActivationBlock
         77   4C 00059990 BasepAnsiStringToDynamicUnicodeString
         78   4D 00007600 BasepAppContainerEnvironmentExtension
         79   4E 000203A0 BasepAppXExtension
         80   4F 00018D00 BasepCheckAppCompat
         81   50 0001D010 BasepCheckWebBladeHashes
         82   51 00011DF0 BasepCheckWinSaferRestrictions
         83   52 0000DD40 BasepConstructSxsCreateProcessMessage
         84   53 000384F0 BasepCopyEncryption
         85   54 00025AF0 BasepFinishPackageActivationForSxS
         86   55 00059BF0 BasepFreeActivationContextActivationBlock
         87   56 0001BB90 BasepFreeAppCompatData
         88   57 00015E10 BasepGetAppCompatData
         89   58 0001A150 BasepGetComputerNameFromNtPath
         90   59 000194E0 BasepGetExeArchType
         91   5A 00025B30 BasepGetPackageActivationTokenForSxS
         92   5B 00070D20 BasepInitAppCompatData
         93   5C 0001C1C0 BasepIsProcessAllowed
         94   5D 00013740 BasepMapModuleHandle
         95   5E 0001B610 BasepNotifyLoadStringResource
         96   5F 00020BB0 BasepPostSuccessAppXExtension
         97   60 00039690 BasepProcessInvalidImage
         98   61 0000CEE0 BasepQueryAppCompat
         99   62 00070DB0 BasepQueryModuleChpeSettings
        100   63 00020B90 BasepReleaseAppXContext
        101   64 00014B90 BasepReleaseSxsCreateProcessUtilityStruct
        102   65 000440F0 BasepReportFault
        103   66 0001E3B0 BasepSetFileEncryptionCompression
        104   67 00037890 Beep
        105   68 00049C30 BeginUpdateResourceA
        106   69 00049CA0 BeginUpdateResourceW
        107   6A 00024260 BindIoCompletionCallback
        108   6B 000425E0 BuildCommDCBA
        109   6C 00042640 BuildCommDCBAndTimeoutsA
        110   6D 00042680 BuildCommDCBAndTimeoutsW
        111   6E 00042710 BuildCommDCBW
        112   6F 00061760 CallNamedPipeA
        113   70 00025030 CallNamedPipeW
        114   71 0003A7E0 CallbackMayRunLong
        115   72 000395E0 CancelDeviceWakeupRequest
        116   73 00020C70 CancelIo
        117   74 00020040 CancelIoEx
        118   75 0003A820 CancelSynchronousIo
        119   76          CancelThreadpoolIo (forwarded to NTDLL.TpCancelAsyncIoOperation)
        120   77 00044050 CancelTimerQueueTimer
        121   78 00024920 CancelWaitableTimer
        122   79          CeipIsOptedIn (forwarded to kernelbase.CeipIsOptedIn)
        123   7A 00021280 ChangeTimerQueueTimer
        124   7B 0003A840 CheckAllowDecryptedRemoteDestinationPolicy
        125   7C 00018610 CheckElevation
        126   7D 000205F0 CheckElevationEnabled
        127   7E 00061C60 CheckForReadOnlyResource
        128   7F 0003CD10 CheckForReadOnlyResourceFilter
        129   80          CheckIsMSIXPackage (forwarded to kernelbase.CheckIsMSIXPackage)
        130   81 000393F0 CheckNameLegalDOS8Dot3A
        131   82 000394A0 CheckNameLegalDOS8Dot3W
        132   83 00001250 CheckRemoteDebuggerPresent
        133   84 0003A860 CheckTokenCapability
        134   85 0003A880 CheckTokenMembershipEx
        135   86 00025090 ClearCommBreak
        136   87 000250A0 ClearCommError
        137   88 00069B00 CloseConsoleHandle
        138   89 000248E0 CloseHandle
        139   8A          ClosePackageInfo (forwarded to kernelbase.ClosePackageInfo)
        140   8B 00022210 ClosePrivateNamespace
        141   8C 000213E0 CloseProfileUserMapping
        142   8D 000252B0 ClosePseudoConsole
        143   8E          CloseState (forwarded to kernelbase.CloseState)
        144   8F          CloseThreadpool (forwarded to NTDLL.TpReleasePool)
        145   90          CloseThreadpoolCleanupGroup (forwarded to NTDLL.TpReleaseCleanupGroup)
        146   91          CloseThreadpoolCleanupGroupMembers (forwarded to NTDLL.TpReleaseCleanupGroupMembers)
        147   92          CloseThreadpoolIo (forwarded to NTDLL.TpReleaseIoCompletion)
        148   93          CloseThreadpoolTimer (forwarded to NTDLL.TpReleaseTimer)
        149   94          CloseThreadpoolWait (forwarded to NTDLL.TpReleaseWait)
        150   95          CloseThreadpoolWork (forwarded to NTDLL.TpReleaseWork)
        151   96 0001FF70 CmdBatNotification
        152   97 0003DAA0 CommConfigDialogA
        153   98 0003DB50 CommConfigDialogW
        154   99 0004A640 CompareCalendarDates
        155   9A 00024B10 CompareFileTime
        156   9B 0001D620 CompareStringA
        157   9C 00015C50 CompareStringEx
        158   9D 00015DF0 CompareStringOrdinal
        159   9E 0001C6A0 CompareStringW
        160   9F 00020FD0 ConnectNamedPipe
        161   A0 00069C40 ConsoleMenuControl
        162   A1 0003A8A0 ContinueDebugEvent
        163   A2 0004A6F0 ConvertCalDateTimeToSystemTime
        164   A3 0003A8C0 ConvertDefaultLocale
        165   A4 000251E0 ConvertFiberToThread
        166   A5 0004A7F0 ConvertNLSDayOfWeekToWin32DayOfWeek
        167   A6 000074B0 ConvertSystemTimeToCalDateTime
        168   A7 000251F0 ConvertThreadToFiber
        169   A8 00025200 ConvertThreadToFiberEx
        170   A9 0003A8E0 CopyContext
        171   AA 0003A900 CopyFile2
        172   AB 00061FB0 CopyFileA
        173   AC 00062060 CopyFileExA
        174   AD 000206C0 CopyFileExW
        175   AE 00062120 CopyFileTransactedA
        176   AF 00062210 CopyFileTransactedW
        177   B0 000251D0 CopyFileW
        178   B1 00037A50 CopyLZFile
        179   B2 00021BC0 CreateActCtxA
        180   B3 00021190 CreateActCtxW
        181   B4 000137B0 CreateActCtxWWorker
        182   B5 00061E20 CreateBoundaryDescriptorA
        183   B6 00020840 CreateBoundaryDescriptorW
        184   B7 000253D0 CreateConsoleScreenBuffer
        185   B8 00024B20 CreateDirectoryA
        186   B9 00062C40 CreateDirectoryExA
        187   BA 0003A920 CreateDirectoryExW
        188   BB 00037DB0 CreateDirectoryTransactedA
        189   BC 00062CD0 CreateDirectoryTransactedW
        190   BD 00024B30 CreateDirectoryW
        191   BE          CreateEnclave (forwarded to api-ms-win-core-enclave-l1-1-0.CreateEnclave)
        192   BF 00024930 CreateEventA
        193   C0 00024940 CreateEventExA
        194   C1 00024950 CreateEventExW
        195   C2 00024960 CreateEventW
        196   C3 00025210 CreateFiber
        197   C4 00025220 CreateFiberEx
        198   C5 00024B40 CreateFile2
        199   C6 00024B50 CreateFileA
        200   C7 0001BCB0 CreateFileMappingA
        201   C8          CreateFileMappingFromApp (forwarded to api-ms-win-core-memory-l1-1-1.CreateFileMappingFromApp)
        202   C9 00062E80 CreateFileMappingNumaA
        203   CA 0003A940 CreateFileMappingNumaW
        204   CB 0001C8E0 CreateFileMappingW
        205   CC 00062310 CreateFileTransactedA
        206   CD 000623D0 CreateFileTransactedW
        207   CE 00024B60 CreateFileW
        208   CF 0003A960 CreateHardLinkA
        209   D0 00043810 CreateHardLinkTransactedA
        210   D1 00062F50 CreateHardLinkTransactedW
        211   D2 0003A980 CreateHardLinkW
        212   D3 0001D950 CreateIoCompletionPort
        213   D4 0005C270 CreateJobObjectA
        214   D5 0001E1F0 CreateJobObjectW
        215   D6 0005C2E0 CreateJobSet
        216   D7 0001BE60 CreateMailslotA
        217   D8 0001BED0 CreateMailslotW
        218   D9 000208E0 CreateMemoryResourceNotification
        219   DA 00024970 CreateMutexA
        220   DB 00024980 CreateMutexExA
        221   DC 00024990 CreateMutexExW
        222   DD 000249A0 CreateMutexW
        223   DE 00061800 CreateNamedPipeA
        224   DF 00020270 CreateNamedPipeW
        225   E0 00020250 CreatePipe
        226   E1 00061E90 CreatePrivateNamespaceA
        227   E2 00020800 CreatePrivateNamespaceW
        228   E3 0001C760 CreateProcessA
        229   E4 0003A9A0 CreateProcessAsUserA
        230   E5 0001DAC0 CreateProcessAsUserW
        231   E6 0003AA20 CreateProcessInternalA
        232   E7 0003AAA0 CreateProcessInternalW
        233   E8 0001CB60 CreateProcessW
        234   E9 000252C0 CreatePseudoConsole
        235   EA 0003AB20 CreateRemoteThread
        236   EB          CreateRemoteThreadEx (forwarded to api-ms-win-core-processthreads-l1-1-0.CreateRemoteThreadEx)
        237   EC 0001BD80 CreateSemaphoreA
        238   ED 0001BDB0 CreateSemaphoreExA
        239   EE 000249B0 CreateSemaphoreExW
        240   EF 000249C0 CreateSemaphoreW
        241   F0 00063520 CreateSymbolicLinkA
        242   F1 000635E0 CreateSymbolicLinkTransactedA
        243   F2 000636A0 CreateSymbolicLinkTransactedW
        244   F3 0003AB70 CreateSymbolicLinkW
        245   F4 00043550 CreateTapePartition
        246   F5 0001B5A0 CreateThread
        247   F6 00020C30 CreateThreadpool
        248   F7 000211B0 CreateThreadpoolCleanupGroup
        249   F8 00020D60 CreateThreadpoolIo
        250   F9 0001C660 CreateThreadpoolTimer
        251   FA 000207A0 CreateThreadpoolWait
        252   FB 000205B0 CreateThreadpoolWork
        253   FC 00021240 CreateTimerQueue
        254   FD 0001E2A0 CreateTimerQueueTimer
        255   FE 00027420 CreateToolhelp32Snapshot
        256   FF 00042160 CreateUmsCompletionList
        257  100 000421A0 CreateUmsThreadContext
        258  101 000631A0 CreateWaitableTimerA
        259  102 000631C0 CreateWaitableTimerExA
        260  103 000249D0 CreateWaitableTimerExW
        261  104 000010B0 CreateWaitableTimerW
        262  105          CtrlRoutine (forwarded to kernelbase.CtrlRoutine)
        263  106 000200A0 DeactivateActCtx
        264  107 0001B850 DeactivateActCtxWorker
        265  108 0003ABB0 DebugActiveProcess
        266  109 0003AB90 DebugActiveProcessStop
        267  10A 0003ABD0 DebugBreak
        268  10B 00037CA0 DebugBreakProcess
        269  10C 00037CD0 DebugSetProcessKillOnExit
        270  10D          DecodePointer (forwarded to NTDLL.RtlDecodePointer)
        271  10E          DecodeSystemPointer (forwarded to NTDLL.RtlDecodeSystemPointer)
        272  10F 00064E50 DefineDosDeviceA
        273  110 00024B70 DefineDosDeviceW
        274  111 00024310 DelayLoadFailureHook
        275  112 00012860 DeleteAtom
        276  113 00020820 DeleteBoundaryDescriptor
        277  114          DeleteCriticalSection (forwarded to NTDLL.RtlDeleteCriticalSection)
        278  115 00025230 DeleteFiber
        279  116 00024B80 DeleteFileA
        280  117 00063780 DeleteFileTransactedA
        281  118 00024170 DeleteFileTransactedW
        282  119 00024B90 DeleteFileW
        283  11A          DeleteProcThreadAttributeList (forwarded to api-ms-win-core-processthreads-l1-1-0.DeleteProcThreadAttributeList)
        284  11B 0003ABF0 DeleteSynchronizationBarrier
        285  11C 000211F0 DeleteTimerQueue
        286  11D 00021260 DeleteTimerQueueEx
        287  11E 00020420 DeleteTimerQueueTimer
        288  11F 000421E0 DeleteUmsCompletionList
        289  120 00042220 DeleteUmsThreadContext
        290  121 000650F0 DeleteVolumeMountPointA
        291  122 00024BA0 DeleteVolumeMountPointW
        292  123 00042260 DequeueUmsCompletionListItems
        293  124 00015590 DeviceIoControl
        294  125 0001FEC0 DisableThreadLibraryCalls
        295  126 00044130 DisableThreadProfiling
        296  127          DisassociateCurrentThreadFromCallback (forwarded to NTDLL.TpDisassociateCallback)
        297  128          DiscardVirtualMemory (forwarded to api-ms-win-core-memory-l1-1-2.DiscardVirtualMemory)
        298  129 00021F60 DisconnectNamedPipe
        299  12A 0005B210 DnsHostnameToComputerNameA
        300  12B 0003AC10 DnsHostnameToComputerNameExW
        301  12C 0001C510 DnsHostnameToComputerNameW
        302  12D 00012A90 DosDateTimeToFileTime
        303  12E 000664F0 DosPathToSessionPathA
        304  12F 000666F0 DosPathToSessionPathW
        305  130 00069B20 DuplicateConsoleHandle
        306  131 00038840 DuplicateEncryptionInfoFileExt
        307  132 000248F0 DuplicateHandle
        308  133 00044170 EnableThreadProfiling
        309  134          EncodePointer (forwarded to NTDLL.RtlEncodePointer)
        310  135          EncodeSystemPointer (forwarded to NTDLL.RtlEncodeSystemPointer)
        311  136 00049EF0 EndUpdateResourceA
        312  137 00049F00 EndUpdateResourceW
        313  138          EnterCriticalSection (forwarded to NTDLL.RtlEnterCriticalSection)
        314  139 0003AC30 EnterSynchronizationBarrier
        315  13A 000422C0 EnterUmsSchedulingMode
        316  13B 0004B2E0 EnumCalendarInfoA
        317  13C 0004B380 EnumCalendarInfoExA
        318  13D 0001C740 EnumCalendarInfoExEx
        319  13E 0003AC50 EnumCalendarInfoExW
        320  13F 0003AC70 EnumCalendarInfoW
        321  140 0004B420 EnumDateFormatsA
        322  141 0004B480 EnumDateFormatsExA
        323  142 0003AC90 EnumDateFormatsExEx
        324  143 0003ACB0 EnumDateFormatsExW
        325  144 0003ACD0 EnumDateFormatsW
        326  145 0004B4F0 EnumLanguageGroupLocalesA
        327  146 0003ACF0 EnumLanguageGroupLocalesW
        328  147 00038C90 EnumResourceLanguagesA
        329  148 0003AD10 EnumResourceLanguagesExA
        330  149 0003AD30 EnumResourceLanguagesExW
        331  14A 00038CD0 EnumResourceLanguagesW
        332  14B 00038D10 EnumResourceNamesA
        333  14C 0003AD50 EnumResourceNamesExA
        334  14D 0003AD70 EnumResourceNamesExW
        335  14E 00025010 EnumResourceNamesW
        336  14F 00038D40 EnumResourceTypesA
        337  150 0003AD90 EnumResourceTypesExA
        338  151 0003ADB0 EnumResourceTypesExW
        339  152 00038D70 EnumResourceTypesW
        340  153 0004B520 EnumSystemCodePagesA
        341  154 0003ADD0 EnumSystemCodePagesW
        342  155 00038A70 EnumSystemFirmwareTables
        343  156 00054520 EnumSystemGeoID
        344  157 00054610 EnumSystemGeoNames
        345  158 0004B540 EnumSystemLanguageGroupsA
        346  159 0003ADF0 EnumSystemLanguageGroupsW
        347  15A 0003AE10 EnumSystemLocalesA
        348  15B 0003AE30 EnumSystemLocalesEx
        349  15C 0003AE50 EnumSystemLocalesW
        350  15D 0004B560 EnumTimeFormatsA
        351  15E 00020440 EnumTimeFormatsEx
        352  15F 0003AE70 EnumTimeFormatsW
        353  160 0004B5E0 EnumUILanguagesA
        354  161 0003AE90 EnumUILanguagesW
        355  162 0005B300 EnumerateLocalComputerNamesA
        356  163 0005B430 EnumerateLocalComputerNamesW
        357  164 000435B0 EraseTape
        358  165 000250B0 EscapeCommFunction
        359  166 00042370 ExecuteUmsThread
        360  167 0001E0A0 ExitProcess
        361  168          ExitThread (forwarded to NTDLL.RtlExitUserThread)
        362  169 00040C30 ExitVDM
        363  16A 00022250 ExpandEnvironmentStringsA
        364  16B 0001B790 ExpandEnvironmentStringsW
        365  16C 00025660 ExpungeConsoleCommandHistoryA
        366  16D 00025670 ExpungeConsoleCommandHistoryW
        367  16E 0003AEB0 FatalAppExitA
        368  16F 0003AED0 FatalAppExitW
        369  170 0001E0A0 FatalExit
        370  171 00012D30 FileTimeToDosDateTime
        371  172 00024BB0 FileTimeToLocalFileTime
        372  173 00025050 FileTimeToSystemTime
        373  174 000253E0 FillConsoleOutputAttribute
        374  175 000253F0 FillConsoleOutputCharacterA
        375  176 00025400 FillConsoleOutputCharacterW
        376  177 0001BC90 FindActCtxSectionGuid
        377  178 00012F90 FindActCtxSectionGuidWorker
        378  179 00066880 FindActCtxSectionStringA
        379  17A 00021100 FindActCtxSectionStringW
        380  17B 000132B0 FindActCtxSectionStringWWorker
        381  17C 00015240 FindAtomA
        382  17D 00012D10 FindAtomW
        383  17E 00024BC0 FindClose
        384  17F 00024BD0 FindCloseChangeNotification
        385  180 00024BE0 FindFirstChangeNotificationA
        386  181 00024BF0 FindFirstChangeNotificationW
        387  182 00024C00 FindFirstFileA
        388  183 00024C10 FindFirstFileExA
        389  184 00024C20 FindFirstFileExW
        390  185 00037EB0 FindFirstFileNameTransactedW
        391  186 00024C30 FindFirstFileNameW
        392  187 00037F90 FindFirstFileTransactedA
        393  188 00066920 FindFirstFileTransactedW
        394  189 00024C40 FindFirstFileW
        395  18A 00038080 FindFirstStreamTransactedW
        396  18B          FindFirstStreamW (forwarded to api-ms-win-core-file-l1-2-2.FindFirstStreamW)
        397  18C 00065140 FindFirstVolumeA
        398  18D 000652E0 FindFirstVolumeMountPointA
        399  18E 000654D0 FindFirstVolumeMountPointW
        400  18F 00024C50 FindFirstVolumeW
        401  190 0003AEF0 FindNLSString
        402  191 00015830 FindNLSStringEx
        403  192 00024C60 FindNextChangeNotification
        404  193 00024C70 FindNextFileA
        405  194 00024C80 FindNextFileNameW
        406  195 00024C90 FindNextFileW
        407  196          FindNextStreamW (forwarded to api-ms-win-core-file-l1-2-2.FindNextStreamW)
        408  197 00065760 FindNextVolumeA
        409  198 00065900 FindNextVolumeMountPointA
        410  199 00065FF0 FindNextVolumeMountPointW
        411  19A 00024CA0 FindNextVolumeW
        412  19B          FindPackagesByPackageFamily (forwarded to kernelbase.FindPackagesByPackageFamily)
        413  19C 00013530 FindResourceA
        414  19D 00013550 FindResourceExA
        415  19E 0001B380 FindResourceExW
        416  19F 00020230 FindResourceW
        417  1A0 0003AF10 FindStringOrdinal
        418  1A1 00024CB0 FindVolumeClose
        419  1A2 00066000 FindVolumeMountPointClose
        420  1A3 000201D0 FlsAlloc
        421  1A4 00020B10 FlsFree
        422  1A5 000184E0 FlsGetValue
        423  1A6 0001C2D0 FlsSetValue
        424  1A7 00025410 FlushConsoleInputBuffer
        425  1A8 00024CC0 FlushFileBuffers
        426  1A9 0001AE80 FlushInstructionCache
        427  1AA          FlushProcessWriteBuffers (forwarded to NTDLL.NtFlushProcessWriteBuffers)
        428  1AB 0003AF30 FlushViewOfFile
        429  1AC 0004B600 FoldStringA
        430  1AD 0003AF50 FoldStringW
        431  1AE          FormatApplicationUserModelId (forwarded to kernelbase.FormatApplicationUserModelId)
        432  1AF 00022080 FormatMessageA
        433  1B0 0001C890 FormatMessageW
        434  1B1 000252D0 FreeConsole
        435  1B2 0001FDA0 FreeEnvironmentStringsA
        436  1B3 0001F6B0 FreeEnvironmentStringsW
        437  1B4 0001C7D0 FreeLibrary
        438  1B5 00021030 FreeLibraryAndExitThread
        439  1B6          FreeLibraryWhenCallbackReturns (forwarded to NTDLL.TpCallbackUnloadDllOnCompletion)
        440  1B7 0005C310 FreeMemoryJobObject
        441  1B8 00021E10 FreeResource
        442  1B9 0003AF70 FreeUserPhysicalPages
        443  1BA 00025420 GenerateConsoleCtrlEvent
        444  1BB 0001E060 GetACP
        445  1BC 0001D4B0 GetActiveProcessorCount
        446  1BD 00066AC0 GetActiveProcessorGroupCount
        447  1BE 0003AF90 GetAppContainerAce
        448  1BF 0003AFB0 GetAppContainerNamedObjectPath
        449  1C0 0003AFD0 GetApplicationRecoveryCallback
        450  1C1 00043E50 GetApplicationRecoveryCallbackWorker
        451  1C2 0003AFF0 GetApplicationRestartSettings
        452  1C3 00043F10 GetApplicationRestartSettingsWorker
        453  1C4          GetApplicationUserModelId (forwarded to kernelbase.GetApplicationUserModelId)
        454  1C5 0005A160 GetAtomNameA
        455  1C6 00012630 GetAtomNameW
        456  1C7 00061020 GetBinaryType
        457  1C8 00061020 GetBinaryTypeA
        458  1C9 00061070 GetBinaryTypeW
        459  1CA 0001E2E0 GetCPInfo
        460  1CB 0004B8B0 GetCPInfoExA
        461  1CC 0003B010 GetCPInfoExW
        462  1CD 0003B030 GetCachedSigningLevel
        463  1CE 0004A830 GetCalendarDateFormat
        464  1CF 000086B0 GetCalendarDateFormatEx
        465  1D0 000073B0 GetCalendarDaysInMonth
        466  1D1 0004AB10 GetCalendarDifferenceInDays
        467  1D2 0004B990 GetCalendarInfoA
        468  1D3 00025060 GetCalendarInfoEx
        469  1D4 00025070 GetCalendarInfoW
        470  1D5 0004AC70 GetCalendarMonthsInYear
        471  1D6 00007130 GetCalendarSupportedDateRange
        472  1D7 0004AD40 GetCalendarWeekNumber
        473  1D8 00043D80 GetComPlusPackageInstallStatus
        474  1D9 000250C0 GetCommConfig
        475  1DA 000250D0 GetCommMask
        476  1DB 000250E0 GetCommModemStatus
        477  1DC 000250F0 GetCommProperties
        478  1DD 00025100 GetCommState
        479  1DE 00025110 GetCommTimeouts
        480  1DF 0001FE40 GetCommandLineA
        481  1E0 0001F3C0 GetCommandLineW
        482  1E1 0003B050 GetCompressedFileSizeA
        483  1E2 000637D0 GetCompressedFileSizeTransactedA
        484  1E3 00063830 GetCompressedFileSizeTransactedW
        485  1E4 0003B070 GetCompressedFileSizeW
        486  1E5 0001A300 GetComputerNameA
        487  1E6 00024290 GetComputerNameExA
        488  1E7 000201F0 GetComputerNameExW
        489  1E8 0001A460 GetComputerNameW
        490  1E9 00025680 GetConsoleAliasA
        491  1EA 00025690 GetConsoleAliasExesA
        492  1EB 000256A0 GetConsoleAliasExesLengthA
        493  1EC 000256B0 GetConsoleAliasExesLengthW
        494  1ED 000256C0 GetConsoleAliasExesW
        495  1EE 000256D0 GetConsoleAliasW
        496  1EF 000256E0 GetConsoleAliasesA
        497  1F0 000256F0 GetConsoleAliasesLengthA
        498  1F1 00025700 GetConsoleAliasesLengthW
        499  1F2 00025710 GetConsoleAliasesW
        500  1F3 000252E0 GetConsoleCP
        501  1F4 0006A150 GetConsoleCharType
        502  1F5 00025720 GetConsoleCommandHistoryA
        503  1F6 00025730 GetConsoleCommandHistoryLengthA
        504  1F7 00025740 GetConsoleCommandHistoryLengthW
        505  1F8 00025750 GetConsoleCommandHistoryW
        506  1F9 00025430 GetConsoleCursorInfo
        507  1FA 0006A1C0 GetConsoleCursorMode
        508  1FB 00025760 GetConsoleDisplayMode
        509  1FC 0006A530 GetConsoleFontInfo
        510  1FD 00025770 GetConsoleFontSize
        511  1FE 00069CA0 GetConsoleHardwareState
        512  1FF 00025780 GetConsoleHistoryInfo
        513  200          GetConsoleInputExeNameA (forwarded to kernelbase.GetConsoleInputExeNameA)
        514  201          GetConsoleInputExeNameW (forwarded to kernelbase.GetConsoleInputExeNameW)
        515  202 00069BC0 GetConsoleInputWaitHandle
        516  203 0006A5E0 GetConsoleKeyboardLayoutNameA
        517  204 0006A600 GetConsoleKeyboardLayoutNameW
        518  205 000252F0 GetConsoleMode
        519  206 0006A240 GetConsoleNlsMode
        520  207 00025440 GetConsoleOriginalTitleA
        521  208 00025450 GetConsoleOriginalTitleW
        522  209 00025300 GetConsoleOutputCP
        523  20A 00025790 GetConsoleProcessList
        524  20B 00025460 GetConsoleScreenBufferInfo
        525  20C 00025470 GetConsoleScreenBufferInfoEx
        526  20D 000257A0 GetConsoleSelectionInfo
        527  20E 00025480 GetConsoleTitleA
        528  20F 00025490 GetConsoleTitleW
        529  210 000257B0 GetConsoleWindow
        530  211 0004BBF0 GetCurrencyFormatA
        531  212 0003B090 GetCurrencyFormatEx
        532  213 0003B0B0 GetCurrencyFormatW
        533  214 00021F80 GetCurrentActCtx
        534  215 0001C6E0 GetCurrentActCtxWorker
        535  216          GetCurrentApplicationUserModelId (forwarded to kernelbase.GetCurrentApplicationUserModelId)
        536  217 000257C0 GetCurrentConsoleFont
        537  218 000257D0 GetCurrentConsoleFontEx
        538  219 00021050 GetCurrentDirectoryA
        539  21A 0001FF30 GetCurrentDirectoryW
        540  21B          GetCurrentPackageFamilyName (forwarded to kernelbase.GetCurrentPackageFamilyName)
        541  21C          GetCurrentPackageFullName (forwarded to kernelbase.GetCurrentPackageFullName)
        542  21D          GetCurrentPackageId (forwarded to kernelbase.GetCurrentPackageId)
        543  21E          GetCurrentPackageInfo (forwarded to kernelbase.GetCurrentPackageInfo)
        544  21F          GetCurrentPackagePath (forwarded to kernelbase.GetCurrentPackagePath)
        545  220 00024880 GetCurrentProcess
        546  221 00024890 GetCurrentProcessId
        547  222          GetCurrentProcessorNumber (forwarded to NTDLL.RtlGetCurrentProcessorNumber)
        548  223          GetCurrentProcessorNumberEx (forwarded to NTDLL.RtlGetCurrentProcessorNumberEx)
        549  224 000158A0 GetCurrentThread
        550  225 00015550 GetCurrentThreadId
        551  226          GetCurrentThreadStackLimits (forwarded to api-ms-win-core-processthreads-l1-1-0.GetCurrentThreadStackLimits)
        552  227 000423B0 GetCurrentUmsThread
        553  228 0003B0C0 GetDateFormatA
        554  229 000222F0 GetDateFormatAWorker
        555  22A 0003B0E0 GetDateFormatEx
        556  22B 000206A0 GetDateFormatW
        557  22C 0000A790 GetDateFormatWWorker
        558  22D 0003DDB0 GetDefaultCommConfigA
        559  22E 0003DE60 GetDefaultCommConfigW
        560  22F 000673E0 GetDevicePowerState
        561  230 00024CD0 GetDiskFreeSpaceA
        562  231 00024CE0 GetDiskFreeSpaceExA
        563  232 00024CF0 GetDiskFreeSpaceExW
        564  233 00024D00 GetDiskFreeSpaceW
        565  234          GetDiskSpaceInformationA (forwarded to api-ms-win-core-file-l1-2-3.GetDiskSpaceInformationA)
        566  235          GetDiskSpaceInformationW (forwarded to api-ms-win-core-file-l1-2-3.GetDiskSpaceInformationW)
        567  236 00038DA0 GetDllDirectoryA
        568  237 00021E80 GetDllDirectoryW
        569  238 00024D10 GetDriveTypeA
        570  239 00024D20 GetDriveTypeW
        571  23A 0004C8B0 GetDurationFormat
        572  23B 0003B100 GetDurationFormatEx
        573  23C 00020F40 GetDynamicTimeZoneInformation
        574  23D 0003B120 GetEnabledXStateFeatures
        575  23E 00038940 GetEncryptedFileVersionExt
        576  23F 0001FD80 GetEnvironmentStrings
        577  240 00025080 GetEnvironmentStringsA
        578  241 0001F690 GetEnvironmentStringsW
        579  242 0001E350 GetEnvironmentVariableA
        580  243 0001B620 GetEnvironmentVariableW
        581  244 0003B140 GetEraNameCountedString
        582  245 000221F0 GetErrorMode
        583  246 0001D060 GetExitCodeProcess
        584  247 0001F9C0 GetExitCodeThread
        585  248 0003CEA0 GetExpandedNameA
        586  249 0003CF90 GetExpandedNameW
        587  24A 00024D30 GetFileAttributesA
        588  24B 00024D40 GetFileAttributesExA
        589  24C 00024D50 GetFileAttributesExW
        590  24D 00063900 GetFileAttributesTransactedA
        591  24E 00063970 GetFileAttributesTransactedW
        592  24F 00024D60 GetFileAttributesW
        593  250 00038160 GetFileBandwidthReservation
        594  251 00024D70 GetFileInformationByHandle
        595  252 0001F650 GetFileInformationByHandleEx
        596  253 0003B160 GetFileMUIInfo
        597  254 0001F9A0 GetFileMUIPath
        598  255 00024D80 GetFileSize
        599  256 00024D90 GetFileSizeEx
        600  257 00024DA0 GetFileTime
        601  258 00024DB0 GetFileType
        602  259 00024DC0 GetFinalPathNameByHandleA
        603  25A 00024DD0 GetFinalPathNameByHandleW
        604  25B 00067440 GetFirmwareEnvironmentVariableA
        605  25C 00067460 GetFirmwareEnvironmentVariableExA
        606  25D 000153F0 GetFirmwareEnvironmentVariableExW
        607  25E 00067590 GetFirmwareEnvironmentVariableW
        608  25F 00022820 GetFirmwareType
        609  260 00024DE0 GetFullPathNameA
        610  261 00037B70 GetFullPathNameTransactedA
        611  262 00067800 GetFullPathNameTransactedW
        612  263 00024DF0 GetFullPathNameW
        613  264 0004BFF0 GetGeoInfoA
        614  265 00054740 GetGeoInfoEx
        615  266 00006020 GetGeoInfoW
        616  267 00024900 GetHandleInformation
        617  268 0003B180 GetLargePageMinimum
        618  269 000254A0 GetLargestConsoleWindowSize
        619  26A 00015BF0 GetLastError
        620  26B 0001E020 GetLocalTime
        621  26C 00020BD0 GetLocaleInfoA
        622  26D 0001CB40 GetLocaleInfoEx
        623  26E 0001FE20 GetLocaleInfoW
        624  26F 00017D00 GetLogicalDriveStringsA
        625  270 00024E00 GetLogicalDriveStringsW
        626  271 00017DC0 GetLogicalDrives
        627  272 00021070 GetLogicalProcessorInformation
        628  273          GetLogicalProcessorInformationEx (forwarded to api-ms-win-core-sysinfo-l1-1-0.GetLogicalProcessorInformationEx)
        629  274 00059C50 GetLongPathNameA
        630  275 00040CD0 GetLongPathNameTransactedA
        631  276 000613F0 GetLongPathNameTransactedW
        632  277 000068C0 GetLongPathNameW
        633  278 00063030 GetMailslotInfo
        634  279 00066B20 GetMaximumProcessorCount
        635  27A 000227C0 GetMaximumProcessorGroupCount
        636  27B 0003B1A0 GetMemoryErrorHandlingCapabilities
        637  27C 0001F1A0 GetModuleFileNameA
        638  27D 0001DF20 GetModuleFileNameW
        639  27E 0001F0B0 GetModuleHandleA
        640  27F 00020F90 GetModuleHandleExA
        641  280 0001F630 GetModuleHandleExW
        642  281 0001D130 GetModuleHandleW
        643  282 00022190 GetNLSVersion
        644  283 0003B1C0 GetNLSVersionEx
        645  284 0003B1E0 GetNamedPipeAttribute
        646  285 000618B0 GetNamedPipeClientComputerNameA
        647  286 0003B200 GetNamedPipeClientComputerNameW
        648  287 00061A00 GetNamedPipeClientProcessId
        649  288 00039020 GetNamedPipeClientSessionId
        650  289 00061A40 GetNamedPipeHandleStateA
        651  28A 0003B220 GetNamedPipeHandleStateW
        652  28B          GetNamedPipeInfo (forwarded to api-ms-win-core-namedpipe-l1-2-1.GetNamedPipeInfo)
        653  28C 00061BD0 GetNamedPipeServerProcessId
        654  28D 00039080 GetNamedPipeServerSessionId
        655  28E 00020680 GetNativeSystemInfo
        656  28F 000423F0 GetNextUmsListItem
        657  290 00040DA0 GetNextVDMCommand
        658  291 000392D0 GetNumaAvailableMemoryNode
        659  292 00067DA0 GetNumaAvailableMemoryNodeEx
        660  293 00020860 GetNumaHighestNodeNumber
        661  294 000392E0 GetNumaNodeNumberFromHandle
        662  295 00067E30 GetNumaNodeProcessorMask
        663  296 0003B240 GetNumaNodeProcessorMaskEx
        664  297 00039340 GetNumaProcessorNode
        665  298 00067EB0 GetNumaProcessorNodeEx
        666  299 000393B0 GetNumaProximityNode
        667  29A 0003B260 GetNumaProximityNodeEx
        668  29B 0001AEE0 GetNumberFormatA
        669  29C 000215C0 GetNumberFormatEx
        670  29D 00001060 GetNumberFormatW
        671  29E 0006A6B0 GetNumberOfConsoleFonts
        672  29F 00025310 GetNumberOfConsoleInputEvents
        673  2A0 000257E0 GetNumberOfConsoleMouseButtons
        674  2A1 000212C0 GetOEMCP
        675  2A2 0001C6C0 GetOverlappedResult
        676  2A3          GetOverlappedResultEx (forwarded to api-ms-win-core-io-l1-1-1.GetOverlappedResultEx)
        677  2A4          GetPackageApplicationIds (forwarded to kernelbase.GetPackageApplicationIds)
        678  2A5          GetPackageFamilyName (forwarded to kernelbase.GetPackageFamilyName)
        679  2A6          GetPackageFullName (forwarded to kernelbase.GetPackageFullName)
        680  2A7          GetPackageId (forwarded to kernelbase.GetPackageId)
        681  2A8          GetPackageInfo (forwarded to kernelbase.GetPackageInfo)
        682  2A9          GetPackagePath (forwarded to kernelbase.GetPackagePath)
        683  2AA          GetPackagePathByFullName (forwarded to kernelbase.GetPackagePathByFullName)
        684  2AB          GetPackagesByPackageFamily (forwarded to kernelbase.GetPackagesByPackageFamily)
        685  2AC 00001270 GetPhysicallyInstalledSystemMemory
        686  2AD 000210C0 GetPriorityClass
        687  2AE 00015370 GetPrivateProfileIntA
        688  2AF 000131B0 GetPrivateProfileIntW
        689  2B0 00023180 GetPrivateProfileSectionA
        690  2B1 000606E0 GetPrivateProfileSectionNamesA
        691  2B2 00060710 GetPrivateProfileSectionNamesW
        692  2B3 00020CD0 GetPrivateProfileSectionW
        693  2B4 00015260 GetPrivateProfileStringA
        694  2B5 00012360 GetPrivateProfileStringW
        695  2B6 00060740 GetPrivateProfileStructA
        696  2B7 000608E0 GetPrivateProfileStructW
        697  2B8 0001AEC0 GetProcAddress
        698  2B9 0001C110 GetProcessAffinityMask
        699  2BA 00039FE0 GetProcessDEPPolicy
        700  2BB          GetProcessDefaultCpuSets (forwarded to api-ms-win-core-processthreads-l1-1-3.GetProcessDefaultCpuSets)
        701  2BC 0003B280 GetProcessGroupAffinity
        702  2BD 0003B2A0 GetProcessHandleCount
        703  2BE 00015BB0 GetProcessHeap
        704  2BF 0003B2C0 GetProcessHeaps
        705  2C0 0001CFD0 GetProcessId
        706  2C1 000207E0 GetProcessIdOfThread
        707  2C2 000248A0 GetProcessInformation
        708  2C3 0001FDC0 GetProcessIoCounters
        709  2C4          GetProcessMitigationPolicy (forwarded to api-ms-win-core-processthreads-l1-1-1.GetProcessMitigationPolicy)
        710  2C5 00023E70 GetProcessPreferredUILanguages
        711  2C6 0003B2E0 GetProcessPriorityBoost
        712  2C7 0003B300 GetProcessShutdownParameters
        713  2C8 0001AAD0 GetProcessTimes
        714  2C9 000220A0 GetProcessVersion
        715  2CA 00043FD0 GetProcessWorkingSetSize
        716  2CB 0003B320 GetProcessWorkingSetSizeEx
        717  2CC          GetProcessorSystemCycleTime (forwarded to api-ms-win-core-sysinfo-l1-2-2.GetProcessorSystemCycleTime)
        718  2CD 00021150 GetProductInfo
        719  2CE 000153E0 GetProfileIntA
        720  2CF 00013520 GetProfileIntW
        721  2D0 00060A90 GetProfileSectionA
        722  2D1 00060AA0 GetProfileSectionW
        723  2D2 00060AB0 GetProfileStringA
        724  2D3 00060AE0 GetProfileStringW
        725  2D4 00015DD0 GetQueuedCompletionStatus
        726  2D5 0003B340 GetQueuedCompletionStatusEx
        727  2D6 000614C0 GetShortPathNameA
        728  2D7 00006400 GetShortPathNameW
        729  2D8          GetStagedPackagePathByFullName (forwarded to kernelbase.GetStagedPackagePathByFullName)
        730  2D9 00021960 GetStartupInfoA
        731  2DA 0001D830 GetStartupInfoW
        732  2DB          GetStateFolder (forwarded to kernelbase.GetStateFolder)
        733  2DC 0001D490 GetStdHandle
        734  2DD 0003B360 GetStringScripts
        735  2DE 0003B380 GetStringTypeA
        736  2DF 0003B380 GetStringTypeExA
        737  2E0 00022670 GetStringTypeExW
        738  2E1 0001E330 GetStringTypeW
        739  2E2          GetSystemAppDataKey (forwarded to kernelbase.GetSystemAppDataKey)
        740  2E3          GetSystemCpuSetInformation (forwarded to api-ms-win-core-processthreads-l1-1-3.GetSystemCpuSetInformation)
        741  2E4 0003A030 GetSystemDEPPolicy
        742  2E5 00020CB0 GetSystemDefaultLCID
        743  2E6 00020FF0 GetSystemDefaultLangID
        744  2E7 00001100 GetSystemDefaultLocaleName
        745  2E8 00020660 GetSystemDefaultUILanguage
        746  2E9 0001D3E0 GetSystemDirectoryA
        747  2EA 0001AE00 GetSystemDirectoryW
        748  2EB 0003B3A0 GetSystemFileCacheSize
        749  2EC 00038A90 GetSystemFirmwareTable
        750  2ED 0001DBB0 GetSystemInfo
        751  2EE 00017BC0 GetSystemPowerStatus
        752  2EF 00021340 GetSystemPreferredUILanguages
        753  2F0 0003A070 GetSystemRegistryQuota
        754  2F1 0001B580 GetSystemTime
        755  2F2 00020740 GetSystemTimeAdjustment
        756  2F3 00017B80 GetSystemTimeAsFileTime
        757  2F4 00025040 GetSystemTimePreciseAsFileTime
        758  2F5 0001FC90 GetSystemTimes
        759  2F6 0003B3C0 GetSystemWindowsDirectoryA
        760  2F7 00009110 GetSystemWindowsDirectoryW
        761  2F8 000251B0 GetSystemWow64DirectoryA
        762  2F9 000251C0 GetSystemWow64DirectoryW
        763  2FA 00068080 GetTapeParameters
        764  2FB 000435F0 GetTapePosition
        765  2FC 00043680 GetTapeStatus
        766  2FD 00024E10 GetTempFileNameA
        767  2FE 00024E20 GetTempFileNameW
        768  2FF 00024E30 GetTempPathA
        769  300 00024E40 GetTempPathW
        770  301 00020570 GetThreadContext
        771  302          GetThreadDescription (forwarded to api-ms-win-core-processthreads-l1-1-3.GetThreadDescription)
        772  303 0003B3D0 GetThreadErrorMode
        773  304 0003B3F0 GetThreadGroupAffinity
        774  305 0003B410 GetThreadIOPendingFlag
        775  306 00020C10 GetThreadId
        776  307 0003B430 GetThreadIdealProcessorEx
        777  308 000248B0 GetThreadInformation
        778  309 0001A0F0 GetThreadLocale
        779  30A 0001D0B0 GetThreadPreferredUILanguages
        780  30B 0001B880 GetThreadPriority
        781  30C 0003B450 GetThreadPriorityBoost
        782  30D          GetThreadSelectedCpuSets (forwarded to api-ms-win-core-processthreads-l1-1-3.GetThreadSelectedCpuSets)
        783  30E 000680E0 GetThreadSelectorEntry
        784  30F 00015C30 GetThreadTimes
        785  310 00024330 GetThreadUILanguage
        786  311 00015640 GetTickCount
        787  312 00015D30 GetTickCount64
        788  313 0003B470 GetTimeFormatA
        789  314 00023E90 GetTimeFormatAWorker
        790  315 0003B490 GetTimeFormatEx
        791  316 0001F1C0 GetTimeFormatW
        792  317 00009A80 GetTimeFormatWWorker
        793  318 00020900 GetTimeZoneInformation
        794  319 00001070 GetTimeZoneInformationForYear
        795  31A 0003B4B0 GetUILanguageInfo
        796  31B 00042430 GetUmsCompletionListEvent
        797  31C 00042470 GetUmsSystemThreadInformation
        798  31D 000548A0 GetUserDefaultGeoName
        799  31E 0001FBA0 GetUserDefaultLCID
        800  31F 0003B4D0 GetUserDefaultLangID
        801  320 0001E370 GetUserDefaultLocaleName
        802  321 00020B30 GetUserDefaultUILanguage
        803  322 0001F1E0 GetUserGeoID
        804  323 00020590 GetUserPreferredUILanguages
        805  324 00041760 GetVDMCurrentDirectories
        806  325 00021010 GetVersion
        807  326 00020400 GetVersionExA
        808  327 0001F980 GetVersionExW
        809  328 00024E50 GetVolumeInformationA
        810  329 00024E60 GetVolumeInformationByHandleW
        811  32A 00024E70 GetVolumeInformationW
        812  32B 00023FD0 GetVolumeNameForVolumeMountPointA
        813  32C 00024870 GetVolumeNameForVolumeMountPointW
        814  32D 00066080 GetVolumePathNameA
        815  32E 00024E80 GetVolumePathNameW
        816  32F 00066260 GetVolumePathNamesForVolumeNameA
        817  330 00024E90 GetVolumePathNamesForVolumeNameW
        818  331 00022230 GetWindowsDirectoryA
        819  332 000228C0 GetWindowsDirectoryW
        820  333 00015BD0 GetWriteWatch
        821  334 0003B4F0 GetXStateFeaturesMask
        822  335 00012660 GlobalAddAtomA
        823  336 0005A190 GlobalAddAtomExA
        824  337 00013190 GlobalAddAtomExW
        825  338 00012910 GlobalAddAtomW
        826  339 00017E10 GlobalAlloc
        827  33A 00038AB0 GlobalCompact
        828  33B 00012850 GlobalDeleteAtom
        829  33C 0005A1B0 GlobalFindAtomA
        830  33D 00012E00 GlobalFindAtomW
        831  33E 00038AD0 GlobalFix
        832  33F 0001FA10 GlobalFlags
        833  340 00015B50 GlobalFree
        834  341 0005A1D0 GlobalGetAtomNameA
        835  342 00012680 GlobalGetAtomNameW
        836  343 000200F0 GlobalHandle
        837  344 00015990 GlobalLock
        838  345 0001C900 GlobalMemoryStatus
        839  346 00020530 GlobalMemoryStatusEx
        840  347 00016BB0 GlobalReAlloc
        841  348 00017E30 GlobalSize
        842  349 00038AF0 GlobalUnWire
        843  34A 00038B00 GlobalUnfix
        844  34B 000158B0 GlobalUnlock
        845  34C 00038B20 GlobalWire
        846  34D 00064290 Heap32First
        847  34E 00064530 Heap32ListFirst
        848  34F 00064630 Heap32ListNext
        849  350 00064730 Heap32Next
        850  351          HeapAlloc (forwarded to NTDLL.RtlAllocateHeap)
        851  352 0003B510 HeapCompact
        852  353 0001FF50 HeapCreate
        853  354 000212A0 HeapDestroy
        854  355 00015570 HeapFree
        855  356 0003B530 HeapLock
        856  357 0003B550 HeapQueryInformation
        857  358          HeapReAlloc (forwarded to NTDLL.RtlReAllocateHeap)
        858  359 000203E0 HeapSetInformation
        859  35A          HeapSize (forwarded to NTDLL.RtlSizeHeap)
        860  35B 0003B570 HeapSummary
        861  35C 0003B590 HeapUnlock
        862  35D 0001C0F0 HeapValidate
        863  35E 0003B5B0 HeapWalk
        864  35F 00001090 IdnToAscii
        865  360 0003B5D0 IdnToNameprepUnicode
        866  361 0003B5F0 IdnToUnicode
        867  362 0005A200 InitAtomTable
        868  363          InitOnceBeginInitialize (forwarded to api-ms-win-core-synch-l1-2-0.InitOnceBeginInitialize)
        869  364          InitOnceComplete (forwarded to api-ms-win-core-synch-l1-2-0.InitOnceComplete)
        870  365          InitOnceExecuteOnce (forwarded to api-ms-win-core-synch-l1-2-0.InitOnceExecuteOnce)
        871  366          InitOnceInitialize (forwarded to NTDLL.RtlRunOnceInitialize)
        872  367          InitializeConditionVariable (forwarded to NTDLL.RtlInitializeConditionVariable)
        873  368 0003B630 InitializeContext
        874  369 0003B610 InitializeContext2
        875  36A          InitializeCriticalSection (forwarded to NTDLL.RtlInitializeCriticalSection)
        876  36B 000249E0 InitializeCriticalSectionAndSpinCount
        877  36C 000249F0 InitializeCriticalSectionEx
        878  36D          InitializeEnclave (forwarded to api-ms-win-core-enclave-l1-1-0.InitializeEnclave)
        879  36E          InitializeProcThreadAttributeList (forwarded to api-ms-win-core-processthreads-l1-1-0.InitializeProcThreadAttributeList)
        880  36F          InitializeSListHead (forwarded to NTDLL.RtlInitializeSListHead)
        881  370          InitializeSRWLock (forwarded to NTDLL.RtlInitializeSRWLock)
        882  371 0003B650 InitializeSynchronizationBarrier
        883  372          InstallELAMCertificateInfo (forwarded to api-ms-win-core-sysinfo-l1-2-1.InstallELAMCertificateInfo)
        884  373          InterlockedFlushSList (forwarded to NTDLL.RtlInterlockedFlushSList)
        885  374          InterlockedPopEntrySList (forwarded to NTDLL.RtlInterlockedPopEntrySList)
        886  375          InterlockedPushEntrySList (forwarded to NTDLL.RtlInterlockedPushEntrySList)
        887  376          InterlockedPushListSList (forwarded to NTDLL.RtlInterlockedPushListSList)
        888  377          InterlockedPushListSListEx (forwarded to NTDLL.RtlInterlockedPushListSListEx)
        889  378 0006A7D0 InvalidateConsoleDIBits
        890  379 0003A100 IsBadCodePtr
        891  37A 0003A110 IsBadHugeReadPtr
        892  37B 0003A120 IsBadHugeWritePtr
        893  37C 00015AA0 IsBadReadPtr
        894  37D 0003A130 IsBadStringPtrA
        895  37E 0003A180 IsBadStringPtrW
        896  37F 00066BE0 IsBadWritePtr
        897  380 0004B040 IsCalendarLeapDay
        898  381 0004B120 IsCalendarLeapMonth
        899  382 0004B210 IsCalendarLeapYear
        900  383 00021940 IsDBCSLeadByte
        901  384 0003B670 IsDBCSLeadByteEx
        902  385 000201B0 IsDebuggerPresent
        903  386          IsEnclaveTypeSupported (forwarded to api-ms-win-core-enclave-l1-1-0.IsEnclaveTypeSupported)
        904  387 0003B690 IsNLSDefinedString
        905  388 00037930 IsNativeVhdBoot
        906  389 0003B6B0 IsNormalizedString
        907  38A          IsProcessCritical (forwarded to api-ms-win-core-processthreads-l1-1-2.IsProcessCritical)
        908  38B 000208C0 IsProcessInJob
        909  38C 0001DB40 IsProcessorFeaturePresent
        910  38D 00039600 IsSystemResumeAutomatic
        911  38E 0001D0F0 IsThreadAFiber
        912  38F          IsThreadpoolTimerSet (forwarded to NTDLL.TpIsTimerSet)
        913  390          IsUserCetAvailableInEnvironment (forwarded to api-ms-win-core-sysinfo-l1-2-6.IsUserCetAvailableInEnvironment)
        914  391 000082B0 IsValidCalDateTime
        915  392 0001FC70 IsValidCodePage
        916  393 0003B6D0 IsValidLanguageGroup
        917  394 0001FEA0 IsValidLocale
        918  395 0003B6F0 IsValidLocaleName
        919  396 0003B710 IsValidNLSVersion
        920  397          IsWow64GuestMachineSupported (forwarded to api-ms-win-core-wow64-l1-1-2.IsWow64GuestMachineSupported)
        921  398 0001F670 IsWow64Process
        922  399          IsWow64Process2 (forwarded to api-ms-win-core-wow64-l1-1-1.IsWow64Process2)
        923  39A 0003B730 K32EmptyWorkingSet
        924  39B 0003B750 K32EnumDeviceDrivers
        925  39C 0003B770 K32EnumPageFilesA
        926  39D 0003B790 K32EnumPageFilesW
        927  39E 000210E0 K32EnumProcessModules
        928  39F 0003B7B0 K32EnumProcessModulesEx
        929  3A0 0003B7D0 K32EnumProcesses
        930  3A1 0003B7F0 K32GetDeviceDriverBaseNameA
        931  3A2 0003B810 K32GetDeviceDriverBaseNameW
        932  3A3 0003B830 K32GetDeviceDriverFileNameA
        933  3A4 0003B850 K32GetDeviceDriverFileNameW
        934  3A5 0003B870 K32GetMappedFileNameA
        935  3A6 0003B890 K32GetMappedFileNameW
        936  3A7 0003B8B0 K32GetModuleBaseNameA
        937  3A8 0003B8D0 K32GetModuleBaseNameW
        938  3A9 0003B8F0 K32GetModuleFileNameExA
        939  3AA 000242F0 K32GetModuleFileNameExW
        940  3AB 0001F0D0 K32GetModuleInformation
        941  3AC 0003B910 K32GetPerformanceInfo
        942  3AD 0003B930 K32GetProcessImageFileNameA
        943  3AE 00020060 K32GetProcessImageFileNameW
        944  3AF 0003B950 K32GetProcessMemoryInfo
        945  3B0 0003B990 K32GetWsChanges
        946  3B1 0003B970 K32GetWsChangesEx
        947  3B2 0003B9B0 K32InitializeProcessForWsWatch
        948  3B3 0003B9F0 K32QueryWorkingSet
        949  3B4 0003B9D0 K32QueryWorkingSetEx
        950  3B5 00020640 LCIDToLocaleName
        951  3B6 0003BA10 LCMapStringA
        952  3B7 00015CD0 LCMapStringEx
        953  3B8 000184A0 LCMapStringW
        954  3B9 0003D0C0 LZClose
        955  3BA 0003D180 LZCloseFile
        956  3BB 00037A60 LZCopy
        957  3BC 0003D250 LZCreateFileW
        958  3BD 00037B60 LZDone
        959  3BE 0003D390 LZInit
        960  3BF 0003D540 LZOpenFileA
        961  3C0 0003D630 LZOpenFileW
        962  3C1 0003D6F0 LZRead
        963  3C2 0003D960 LZSeek
        964  3C3 000213E0 LZStart
        965  3C4          LeaveCriticalSection (forwarded to NTDLL.RtlLeaveCriticalSection)
        966  3C5          LeaveCriticalSectionWhenCallbackReturns (forwarded to NTDLL.TpCallbackLeaveCriticalSectionOnCompletion)
        967  3C6 00017F90 LoadAppInitDlls
        968  3C7          LoadEnclaveData (forwarded to api-ms-win-core-enclave-l1-1-0.LoadEnclaveData)
        969  3C8 000204F0 LoadLibraryA
        970  3C9 0001FBC0 LoadLibraryExA
        971  3CA 0001ADC0 LoadLibraryExW
        972  3CB 0001FEE0 LoadLibraryW
        973  3CC 00066C70 LoadModule
        974  3CD 00025020 LoadPackagedLibrary
        975  3CE 0001B360 LoadResource
        976  3CF 0003BA30 LoadStringBaseExW
        977  3D0 00038C60 LoadStringBaseW
        978  3D1 000184C0 LocalAlloc
        979  3D2 00038AB0 LocalCompact
        980  3D3 00024EA0 LocalFileTimeToFileTime
        981  3D4          LocalFileTimeToLocalSystemTime (forwarded to api-ms-win-core-timezone-l1-1-1.LocalFileTimeToLocalSystemTime)
        982  3D5 00068100 LocalFlags
        983  3D6 00017B60 LocalFree
        984  3D7 00038B60 LocalHandle
        985  3D8 0003BA50 LocalLock
        986  3D9 0001FD60 LocalReAlloc
        987  3DA 00038AB0 LocalShrink
        988  3DB 0001B420 LocalSize
        989  3DC          LocalSystemTimeToLocalFileTime (forwarded to api-ms-win-core-timezone-l1-1-1.LocalSystemTimeToLocalFileTime)
        990  3DD 0003BA70 LocalUnlock
        991  3DE 0001E080 LocaleNameToLCID
        992  3DF 0003BA90 LocateXStateFeature
        993  3E0 00024EB0 LockFile
        994  3E1 00024EC0 LockFileEx
        995  3E2 0001B3C0 LockResource
        996  3E3 0003BAB0 MapUserPhysicalPages
        997  3E4 00044000 MapUserPhysicalPagesScatter
        998  3E5 0001D7F0 MapViewOfFile
        999  3E6 0001C9F0 MapViewOfFileEx
       1000  3E7 0003BAD0 MapViewOfFileExNuma
       1001  3E8          MapViewOfFileFromApp (forwarded to api-ms-win-core-memory-l1-1-1.MapViewOfFileFromApp)
       1002  3E9 000649E0 Module32First
       1003  3EA 0001DBD0 Module32FirstW
       1004  3EB 00064B20 Module32Next
       1005  3EC 00019FA0 Module32NextW
       1006  3ED 00063A50 MoveFileA
       1007  3EE 00063A80 MoveFileExA
       1008  3EF 00020C90 MoveFileExW
       1009  3F0 00063AB0 MoveFileTransactedA
       1010  3F1 00023DB0 MoveFileTransactedW
       1011  3F2 00022890 MoveFileW
       1012  3F3 00063B90 MoveFileWithProgressA
       1013  3F4 0003BAF0 MoveFileWithProgressW
       1014  3F5 00025000 MulDiv
       1015  3F6 00015810 MultiByteToWideChar
       1016  3F7 0003BB10 NeedCurrentDirectoryForExePathA
       1017  3F8 0003BB30 NeedCurrentDirectoryForExePathW
       1018  3F9 00025250 NlsCheckPolicy
       1019  3FA 00025260 NlsGetCacheUpdateCount
       1020  3FB 00025270 NlsUpdateLocale
       1021  3FC 00025280 NlsUpdateSystemLocale
       1022  3FD 0003BB50 NormalizeString
       1023  3FE 0003BB70 NotifyMountMgr
       1024  3FF 0004E3F0 NotifyUILanguageChange
       1025  400 0003A1E0 NtVdm64CreateProcessInternalW
       1026  401 0001EA80 OOBEComplete
       1027  402          OfferVirtualMemory (forwarded to api-ms-win-core-memory-l1-1-2.OfferVirtualMemory)
       1028  403 00069BE0 OpenConsoleW
       1029  404 0003BB90 OpenConsoleWStub
       1030  405 00024A00 OpenEventA
       1031  406 00024A10 OpenEventW
       1032  407 00062580 OpenFile
       1033  408 0003BBA0 OpenFileById
       1034  409 00021610 OpenFileMappingA
       1035  40A 00020720 OpenFileMappingW
       1036  40B 0005C320 OpenJobObjectA
       1037  40C 0005C3A0 OpenJobObjectW
       1038  40D 0001C020 OpenMutexA
       1039  40E 00024A20 OpenMutexW
       1040  40F          OpenPackageInfoByFullName (forwarded to kernelbase.OpenPackageInfoByFullName)
       1041  410 00061F10 OpenPrivateNamespaceA
       1042  411 00022290 OpenPrivateNamespaceW
       1043  412 0001ADE0 OpenProcess
       1044  413          OpenProcessToken (forwarded to api-ms-win-core-processthreads-l1-1-0.OpenProcessToken)
       1045  414 000213E0 OpenProfileUserMapping
       1046  415 00063250 OpenSemaphoreA
       1047  416 00024A30 OpenSemaphoreW
       1048  417          OpenState (forwarded to kernelbase.OpenState)
       1049  418          OpenStateExplicit (forwarded to kernelbase.OpenStateExplicit)
       1050  419 0001C850 OpenThread
       1051  41A          OpenThreadToken (forwarded to api-ms-win-core-processthreads-l1-1-0.OpenThreadToken)
       1052  41B 000632C0 OpenWaitableTimerA
       1053  41C 00024A40 OpenWaitableTimerW
       1054  41D 000242D0 OutputDebugStringA
       1055  41E 0001D110 OutputDebugStringW
       1056  41F          PackageFamilyNameFromFullName (forwarded to kernelbase.PackageFamilyNameFromFullName)
       1057  420          PackageFamilyNameFromId (forwarded to kernelbase.PackageFamilyNameFromId)
       1058  421          PackageFullNameFromId (forwarded to kernelbase.PackageFullNameFromId)
       1059  422          PackageIdFromFullName (forwarded to kernelbase.PackageIdFromFullName)
       1060  423          PackageNameAndPublisherIdFromFamilyName (forwarded to kernelbase.PackageNameAndPublisherIdFromFamilyName)
       1061  424          ParseApplicationUserModelId (forwarded to kernelbase.ParseApplicationUserModelId)
       1062  425 00025320 PeekConsoleInputA
       1063  426 00025330 PeekConsoleInputW
       1064  427 0003BBC0 PeekNamedPipe
       1065  428 0001B3A0 PostQueuedCompletionStatus
       1066  429 0001FCD0 PowerClearRequest
       1067  42A 0001EE00 PowerCreateRequest
       1068  42B 0001FBE0 PowerSetRequest
       1069  42C          PrefetchVirtualMemory (forwarded to api-ms-win-core-memory-l1-1-1.PrefetchVirtualMemory)
       1070  42D 000436B0 PrepareTape
       1071  42E 00022630 PrivCopyFileExW
       1072  42F 00063CA0 PrivMoveFileIdentityW
       1073  430 00064C50 Process32First
       1074  431 00022690 Process32FirstW
       1075  432 00064D50 Process32Next
       1076  433 00022430 Process32NextW
       1077  434 0001C7F0 ProcessIdToSessionId
       1078  435 0003BBE0 PssCaptureSnapshot
       1079  436 0003BC00 PssDuplicateSnapshot
       1080  437 0003BC20 PssFreeSnapshot
       1081  438 0003BC40 PssQuerySnapshot
       1082  439 0003BC60 PssWalkMarkerCreate
       1083  43A 0003BC80 PssWalkMarkerFree
       1084  43B 0003BCA0 PssWalkMarkerGetPosition
       1085  43C 0003BCC0 PssWalkMarkerRewind
       1086  43D 0003BCE0 PssWalkMarkerSeek
       1087  43E 0003BCC0 PssWalkMarkerSeekToBeginning
       1088  43F 0003BCE0 PssWalkMarkerSetPosition
       1089  440 0003BCA0 PssWalkMarkerTell
       1090  441 0003BD00 PssWalkSnapshot
       1091  442 0001C2B0 PulseEvent
       1092  443 00025120 PurgeComm
       1093  444 0003BD20 QueryActCtxSettingsW
       1094  445 00012B70 QueryActCtxSettingsWWorker
       1095  446 0001DFA0 QueryActCtxW
       1096  447 000124D0 QueryActCtxWWorker
       1097  448          QueryDepthSList (forwarded to NTDLL.RtlQueryDepthSList)
       1098  449 00064EF0 QueryDosDeviceA
       1099  44A 00024ED0 QueryDosDeviceW
       1100  44B 0003BD40 QueryFullProcessImageNameA
       1101  44C 0001C870 QueryFullProcessImageNameW
       1102  44D 00021F00 QueryIdleProcessorCycleTime
       1103  44E 0003BD60 QueryIdleProcessorCycleTimeEx
       1104  44F 0001D850 QueryInformationJobObject
       1105  450 0005C470 QueryIoRateControlInformationJobObject
       1106  451 0003BD80 QueryMemoryResourceNotification
       1107  452 00015C10 QueryPerformanceCounter
       1108  453 0001AEA0 QueryPerformanceFrequency
       1109  454 0003BDA0 QueryProcessAffinityUpdateMode
       1110  455 00021F20 QueryProcessCycleTime
       1111  456          QueryProtectedPolicy (forwarded to api-ms-win-core-processthreads-l1-1-2.QueryProtectedPolicy)
       1112  457 000010E0 QueryThreadCycleTime
       1113  458 000441B0 QueryThreadProfiling
       1114  459 0003BDC0 QueryThreadpoolStackInformation
       1115  45A 000424F0 QueryUmsThreadInformation
       1116  45B 0001D0D0 QueryUnbiasedInterruptTime
       1117  45C 0001E0E0 QueueUserAPC
       1118  45D 00020FB0 QueueUserWorkItem
       1119  45E 000710B0 QuirkGetData2Worker
       1120  45F 00071180 QuirkGetDataWorker
       1121  460 00071240 QuirkIsEnabled2Worker
       1122  461 00015D60 QuirkIsEnabled3Worker
       1123  462 00071390 QuirkIsEnabledForPackage2Worker
       1124  463 00009C60 QuirkIsEnabledForPackage3Worker
       1125  464 00009DD0 QuirkIsEnabledForPackage4Worker
       1126  465 00009060 QuirkIsEnabledForPackageWorker
       1127  466 0001F3E0 QuirkIsEnabledForProcessWorker
       1128  467 00009120 QuirkIsEnabledWorker
       1129  468 0001FCB0 RaiseException
       1130  469          RaiseFailFastException (forwarded to kernelbase.RaiseFailFastException)
       1131  46A 0003A3F0 RaiseInvalid16BitExeError
       1132  46B 0003BE00 ReOpenFile
       1133  46C 00025340 ReadConsoleA
       1134  46D 00025350 ReadConsoleInputA
       1135  46E          ReadConsoleInputExA (forwarded to kernelbase.ReadConsoleInputExA)
       1136  46F          ReadConsoleInputExW (forwarded to kernelbase.ReadConsoleInputExW)
       1137  470 00025360 ReadConsoleInputW
       1138  471 000254B0 ReadConsoleOutputA
       1139  472 000254C0 ReadConsoleOutputAttribute
       1140  473 000254D0 ReadConsoleOutputCharacterA
       1141  474 000254E0 ReadConsoleOutputCharacterW
       1142  475 000254F0 ReadConsoleOutputW
       1143  476 00025370 ReadConsoleW
       1144  477 0003BE20 ReadDirectoryChangesExW
       1145  478 000242B0 ReadDirectoryChangesW
       1146  479 00024EE0 ReadFile
       1147  47A 00024EF0 ReadFileEx
       1148  47B 00024F00 ReadFileScatter
       1149  47C 0001C4F0 ReadProcessMemory
       1150  47D 000441F0 ReadThreadProfilingData
       1151  47E          ReclaimVirtualMemory (forwarded to api-ms-win-core-memory-l1-1-2.ReclaimVirtualMemory)
       1152  47F 00024220 RegCloseKey
       1153  480 0003BE40 RegCopyTreeW
       1154  481 0003BE60 RegCreateKeyExA
       1155  482 0003BE80 RegCreateKeyExW
       1156  483 0003BEA0 RegDeleteKeyExA
       1157  484 0003BEC0 RegDeleteKeyExW
       1158  485 0003BEE0 RegDeleteTreeA
       1159  486 0003BF00 RegDeleteTreeW
       1160  487 0003BF20 RegDeleteValueA
       1161  488 0003BF40 RegDeleteValueW
       1162  489 0003BF60 RegDisablePredefinedCacheEx
       1163  48A 0003BF80 RegEnumKeyExA
       1164  48B 0003BFD0 RegEnumKeyExW
       1165  48C 0003C020 RegEnumValueA
       1166  48D 0003C070 RegEnumValueW
       1167  48E 0003C0C0 RegFlushKey
       1168  48F 0003C0E0 RegGetKeySecurity
       1169  490 0003C100 RegGetValueA
       1170  491 00021DF0 RegGetValueW
       1171  492 0003C120 RegLoadKeyA
       1172  493 0003C140 RegLoadKeyW
       1173  494 0003C160 RegLoadMUIStringA
       1174  495 0003C180 RegLoadMUIStringW
       1175  496 0003C1A0 RegNotifyChangeKeyValue
       1176  497 000222D0 RegOpenCurrentUser
       1177  498 0003C1C0 RegOpenKeyExA
       1178  499 00020A00 RegOpenKeyExW
       1179  49A 000222B0 RegOpenUserClassesRoot
       1180  49B 0003C1E0 RegQueryInfoKeyA
       1181  49C 0003C260 RegQueryInfoKeyW
       1182  49D 0003C2E0 RegQueryValueExA
       1183  49E 0003C300 RegQueryValueExW
       1184  49F 0003C320 RegRestoreKeyA
       1185  4A0 0003C340 RegRestoreKeyW
       1186  4A1 0003C360 RegSaveKeyExA
       1187  4A2 0003C380 RegSaveKeyExW
       1188  4A3 0003C3A0 RegSetKeySecurity
       1189  4A4 0003C3C0 RegSetValueExA
       1190  4A5 0003C3E0 RegSetValueExW
       1191  4A6 0003C400 RegUnLoadKeyA
       1192  4A7 0003C420 RegUnLoadKeyW
       1193  4A8 00021690 RegisterApplicationRecoveryCallback
       1194  4A9 00021320 RegisterApplicationRestart
       1195  4AA 0003C440 RegisterBadMemoryNotification
       1196  4AB 0006A2B0 RegisterConsoleIME
       1197  4AC 0006A2E0 RegisterConsoleOS2
       1198  4AD 00069D20 RegisterConsoleVDM
       1199  4AE 0001F9E0 RegisterWaitForInputIdle
       1200  4AF 000154D0 RegisterWaitForSingleObject
       1201  4B0 0003C460 RegisterWaitForSingleObjectEx
       1202  4B1 0001E9C0 RegisterWaitUntilOOBECompleted
       1203  4B2 00038B30 RegisterWowBaseHandlers
       1204  4B3 00041CF0 RegisterWowExec
       1205  4B4 00021220 ReleaseActCtx
       1206  4B5 0001D810 ReleaseActCtxWorker
       1207  4B6 00024A50 ReleaseMutex
       1208  4B7          ReleaseMutexWhenCallbackReturns (forwarded to NTDLL.TpCallbackReleaseMutexOnCompletion)
       1209  4B8          ReleaseSRWLockExclusive (forwarded to NTDLL.RtlReleaseSRWLockExclusive)
       1210  4B9          ReleaseSRWLockShared (forwarded to NTDLL.RtlReleaseSRWLockShared)
       1211  4BA 00024A60 ReleaseSemaphore
       1212  4BB          ReleaseSemaphoreWhenCallbackReturns (forwarded to NTDLL.TpCallbackReleaseSemaphoreOnCompletion)
       1213  4BC 00024F10 RemoveDirectoryA
       1214  4BD 00037E60 RemoveDirectoryTransactedA
       1215  4BE 00062DC0 RemoveDirectoryTransactedW
       1216  4BF 00024F20 RemoveDirectoryW
       1217  4C0          RemoveDllDirectory (forwarded to api-ms-win-core-libraryloader-l1-1-0.RemoveDllDirectory)
       1218  4C1 0005B650 RemoveLocalAlternateComputerNameA
       1219  4C2 0005B6B0 RemoveLocalAlternateComputerNameW
       1220  4C3 00038B40 RemoveSecureMemoryCacheCallback
       1221  4C4          RemoveVectoredContinueHandler (forwarded to NTDLL.RtlRemoveVectoredContinueHandler)
       1222  4C5          RemoveVectoredExceptionHandler (forwarded to NTDLL.RtlRemoveVectoredExceptionHandler)
       1223  4C6 0003C480 ReplaceFile
       1224  4C7 00062B00 ReplaceFileA
       1225  4C8 0003C480 ReplaceFileW
       1226  4C9 0003A5A0 ReplacePartitionUnit
       1227  4CA 000395E0 RequestDeviceWakeup
       1228  4CB 000395E0 RequestWakeupLatency
       1229  4CC 00024A70 ResetEvent
       1230  4CD 00017B40 ResetWriteWatch
       1231  4CE 00025380 ResizePseudoConsole
       1232  4CF          ResolveDelayLoadedAPI (forwarded to NTDLL.LdrResolveDelayLoadedAPI)
       1233  4D0          ResolveDelayLoadsFromDll (forwarded to NTDLL.LdrResolveDelayLoadsFromDll)
       1234  4D1 000209E0 ResolveLocaleName
       1235  4D2          RestoreLastError (forwarded to NTDLL.RtlRestoreLastWin32Error)
       1236  4D3 0001E0C0 ResumeThread
       1237  4D4 000213A0 RtlAddFunctionTable
       1238  4D5 000246C0 RtlCaptureContext
       1239  4D6 00021E30 RtlCaptureStackBackTrace
       1240  4D7 0003C4A0 RtlCompareMemory
       1241  4D8 0003C4C0 RtlCopyMemory
       1242  4D9 0003C4E0 RtlDeleteFunctionTable
       1243  4DA 0003C500 RtlFillMemory
       1244  4DB 0003C530 RtlInstallFunctionTableCallback
       1245  4DC 0001D2F0 RtlLookupFunctionEntry
       1246  4DD 000246F0 RtlMoveMemory
       1247  4DE 0001D3C0 RtlPcToFileHeader
       1248  4DF 0003C550 RtlRaiseException
       1249  4E0 0003C570 RtlRestoreContext
       1250  4E1 0003C590 RtlUnwind
       1251  4E2 0001F9F0 RtlUnwindEx
       1252  4E3 00001010 RtlVirtualUnwind
       1253  4E4          RtlZeroMemory (forwarded to NTDLL.RtlZeroMemory)
       1254  4E5 00025500 ScrollConsoleScreenBufferA
       1255  4E6 00025510 ScrollConsoleScreenBufferW
       1256  4E7 0003C5B0 SearchPathA
       1257  4E8 000221D0 SearchPathW
       1258  4E9 0003C5D0 SetCachedSigningLevel
       1259  4EA 0004C0C0 SetCalendarInfoA
       1260  4EB 0003C5F0 SetCalendarInfoW
       1261  4EC 00043DD0 SetComPlusPackageInstallStatus
       1262  4ED 00025130 SetCommBreak
       1263  4EE 00025140 SetCommConfig
       1264  4EF 00025150 SetCommMask
       1265  4F0 00025160 SetCommState
       1266  4F1 00025170 SetCommTimeouts
       1267  4F2 0003C610 SetComputerNameA
       1268  4F3 0003C630 SetComputerNameEx2W
       1269  4F4 0003C650 SetComputerNameExA
       1270  4F5 0003C670 SetComputerNameExW
       1271  4F6 0003C690 SetComputerNameW
       1272  4F7 00025520 SetConsoleActiveScreenBuffer
       1273  4F8 00025530 SetConsoleCP
       1274  4F9 00025390 SetConsoleCtrlHandler
       1275  4FA 00069DD0 SetConsoleCursor
       1276  4FB 00025540 SetConsoleCursorInfo
       1277  4FC 0006A340 SetConsoleCursorMode
       1278  4FD 00025550 SetConsoleCursorPosition
       1279  4FE 000257F0 SetConsoleDisplayMode
       1280  4FF 0006A710 SetConsoleFont
       1281  500 00069E30 SetConsoleHardwareState
       1282  501 00025800 SetConsoleHistoryInfo
       1283  502 0006A770 SetConsoleIcon
       1284  503          SetConsoleInputExeNameA (forwarded to kernelbase.SetConsoleInputExeNameA)
       1285  504          SetConsoleInputExeNameW (forwarded to kernelbase.SetConsoleInputExeNameW)
       1286  505 00069E90 SetConsoleKeyShortcuts
       1287  506 0006A3B0 SetConsoleLocalEUDC
       1288  507 000213E0 SetConsoleMaximumWindowSize
       1289  508 00069F20 SetConsoleMenuClose
       1290  509 000253A0 SetConsoleMode
       1291  50A 0006A470 SetConsoleNlsMode
       1292  50B 00025810 SetConsoleNumberOfCommandsA
       1293  50C 00025820 SetConsoleNumberOfCommandsW
       1294  50D 0006A4D0 SetConsoleOS2OemFormat
       1295  50E 00025560 SetConsoleOutputCP
       1296  50F 00069F80 SetConsolePalette
       1297  510 00025570 SetConsoleScreenBufferInfoEx
       1298  511 00025580 SetConsoleScreenBufferSize
       1299  512 00025590 SetConsoleTextAttribute
       1300  513 000255A0 SetConsoleTitleA
       1301  514 000255B0 SetConsoleTitleW
       1302  515 000255C0 SetConsoleWindowInfo
       1303  516          SetCriticalSectionSpinCount (forwarded to NTDLL.RtlSetCriticalSectionSpinCount)
       1304  517 00025830 SetCurrentConsoleFontEx
       1305  518 0003C6B0 SetCurrentDirectoryA
       1306  519 00021360 SetCurrentDirectoryW
       1307  51A 0003E550 SetDefaultCommConfigA
       1308  51B 0003E600 SetDefaultCommConfigW
       1309  51C          SetDefaultDllDirectories (forwarded to api-ms-win-core-libraryloader-l1-1-0.SetDefaultDllDirectories)
       1310  51D 00066A10 SetDllDirectoryA
       1311  51E 00020A60 SetDllDirectoryW
       1312  51F 0003C6D0 SetDynamicTimeZoneInformation
       1313  520 00024F30 SetEndOfFile
       1314  521 00068300 SetEnvironmentStringsA
       1315  522 0003C6F0 SetEnvironmentStringsW
       1316  523 0001E040 SetEnvironmentVariableA
       1317  524 000209C0 SetEnvironmentVariableW
       1318  525 0001C810 SetErrorMode
       1319  526 00024A80 SetEvent
       1320  527          SetEventWhenCallbackReturns (forwarded to NTDLL.TpCallbackSetEventOnCompletion)
       1321  528 0003C710 SetFileApisToANSI
       1322  529 0003C730 SetFileApisToOEM
       1323  52A 00024F40 SetFileAttributesA
       1324  52B 00064160 SetFileAttributesTransactedA
       1325  52C 000641C0 SetFileAttributesTransactedW
       1326  52D 00024F50 SetFileAttributesW
       1327  52E 00038210 SetFileBandwidthReservation
       1328  52F 0001DF40 SetFileCompletionNotificationModes
       1329  530 00024F60 SetFileInformationByHandle
       1330  531 0003C750 SetFileIoOverlappedRange
       1331  532 00024F70 SetFilePointer
       1332  533 00024F80 SetFilePointerEx
       1333  534 00038350 SetFileShortNameA
       1334  535 000383A0 SetFileShortNameW
       1335  536 00024F90 SetFileTime
       1336  537 00024FA0 SetFileValidData
       1337  538 000675B0 SetFirmwareEnvironmentVariableA
       1338  539 000675D0 SetFirmwareEnvironmentVariableExA
       1339  53A 00067700 SetFirmwareEnvironmentVariableExW
       1340  53B 000677E0 SetFirmwareEnvironmentVariableW
       1341  53C 000212E0 SetHandleCount
       1342  53D 00024910 SetHandleInformation
       1343  53E 0001D700 SetInformationJobObject
       1344  53F 0005C7F0 SetIoRateControlInformationJobObject
       1345  540          SetLastConsoleEventActive (forwarded to kernelbase.SetLastConsoleEventActive)
       1346  541 00015CB0 SetLastError
       1347  542 0005B900 SetLocalPrimaryComputerNameA
       1348  543 0005B960 SetLocalPrimaryComputerNameW
       1349  544 0003C770 SetLocalTime
       1350  545 0004C1B0 SetLocaleInfoA
       1351  546 0003C790 SetLocaleInfoW
       1352  547 00063120 SetMailslotInfo
       1353  548 000395E0 SetMessageWaitingIndicator
       1354  549 000390C0 SetNamedPipeAttribute
       1355  54A 00021F40 SetNamedPipeHandleState
       1356  54B 00020B50 SetPriorityClass
       1357  54C 000671B0 SetProcessAffinityMask
       1358  54D 00024200 SetProcessAffinityUpdateMode
       1359  54E 00022150 SetProcessDEPPolicy
       1360  54F          SetProcessDefaultCpuSets (forwarded to api-ms-win-core-processthreads-l1-1-3.SetProcessDefaultCpuSets)
       1361  550          SetProcessDynamicEHContinuationTargets (forwarded to api-ms-win-core-processthreads-l1-1-4.SetProcessDynamicEHContinuationTargets)
       1362  551          SetProcessDynamicEnforcedCetCompatibleRanges (forwarded to api-ms-win-core-processthreads-l1-1-4.SetProcessDynamicEnforcedCetCompatibleRanges)
       1363  552 000248C0 SetProcessInformation
       1364  553          SetProcessMitigationPolicy (forwarded to api-ms-win-core-processthreads-l1-1-1.SetProcessMitigationPolicy)
       1365  554 0003C7B0 SetProcessPreferredUILanguages
       1366  555 00021380 SetProcessPriorityBoost
       1367  556 00020700 SetProcessShutdownParameters
       1368  557 00044030 SetProcessWorkingSetSize
       1369  558 0003C7D0 SetProcessWorkingSetSizeEx
       1370  559          SetProtectedPolicy (forwarded to api-ms-win-core-processthreads-l1-1-2.SetProtectedPolicy)
       1371  55A 00038F60 SetSearchPathMode
       1372  55B 00020210 SetStdHandle
       1373  55C 0003C7F0 SetStdHandleEx
       1374  55D 0003C810 SetSystemFileCacheSize
       1375  55E 00039620 SetSystemPowerState
       1376  55F 0003C830 SetSystemTime
       1377  560 00037C50 SetSystemTimeAdjustment
       1378  561 000436F0 SetTapeParameters
       1379  562 00043740 SetTapePosition
       1380  563 000688E0 SetTermsrvAppInstallMode
       1381  564 0001F0F0 SetThreadAffinityMask
       1382  565 0003C850 SetThreadContext
       1383  566          SetThreadDescription (forwarded to api-ms-win-core-processthreads-l1-1-3.SetThreadDescription)
       1384  567 0001BAE0 SetThreadErrorMode
       1385  568 00020A20 SetThreadExecutionState
       1386  569 00020B70 SetThreadGroupAffinity
       1387  56A 00023D40 SetThreadIdealProcessor
       1388  56B 0003C870 SetThreadIdealProcessorEx
       1389  56C 000248D0 SetThreadInformation
       1390  56D 0001A110 SetThreadLocale
       1391  56E 0001D970 SetThreadPreferredUILanguages
       1392  56F 0001B5F0 SetThreadPriority
       1393  570 000213F0 SetThreadPriorityBoost
       1394  571          SetThreadSelectedCpuSets (forwarded to api-ms-win-core-processthreads-l1-1-3.SetThreadSelectedCpuSets)
       1395  572 0001E390 SetThreadStackGuarantee
       1396  573          SetThreadToken (forwarded to api-ms-win-core-processthreads-l1-1-0.SetThreadToken)
       1397  574 0001C610 SetThreadUILanguage
       1398  575 0003C890 SetThreadpoolStackInformation
       1399  576          SetThreadpoolThreadMaximum (forwarded to NTDLL.TpSetPoolMaxThreads)
       1400  577 00021120 SetThreadpoolThreadMinimum
       1401  578          SetThreadpoolTimer (forwarded to NTDLL.TpSetTimer)
       1402  579          SetThreadpoolTimerEx (forwarded to NTDLL.TpSetTimerEx)
       1403  57A          SetThreadpoolWait (forwarded to NTDLL.TpSetWait)
       1404  57B          SetThreadpoolWaitEx (forwarded to NTDLL.TpSetWaitEx)
       1405  57C 0003C8D0 SetTimeZoneInformation
       1406  57D 00044090 SetTimerQueueTimer
       1407  57E 00042540 SetUmsThreadInformation
       1408  57F 0001FE00 SetUnhandledExceptionFilter
       1409  580 00054A70 SetUserGeoID
       1410  581 00054A90 SetUserGeoName
       1411  582 00041D60 SetVDMCurrentDirectories
       1412  583 000678F0 SetVolumeLabelA
       1413  584 000679A0 SetVolumeLabelW
       1414  585 00066470 SetVolumeMountPointA
       1415  586 000233C0 SetVolumeMountPointW
       1416  587 0003C8F0 SetVolumeMountPointWStub
       1417  588 00024A90 SetWaitableTimer
       1418  589          SetWaitableTimerEx (forwarded to api-ms-win-core-synch-l1-1-0.SetWaitableTimerEx)
       1419  58A 0003C900 SetXStateFeaturesMask
       1420  58B 00025180 SetupComm
       1421  58C 00069FF0 ShowConsoleCursor
       1422  58D 0003C920 SignalObjectAndWait
       1423  58E 0001B3E0 SizeofResource
       1424  58F 0001ADA0 Sleep
       1425  590          SleepConditionVariableCS (forwarded to api-ms-win-core-synch-l1-2-0.SleepConditionVariableCS)
       1426  591          SleepConditionVariableSRW (forwarded to api-ms-win-core-synch-l1-2-0.SleepConditionVariableSRW)
       1427  592 00024AA0 SleepEx
       1428  593 0001FE60 SortCloseHandle
       1429  594 0000A190 SortGetHandle
       1430  595          StartThreadpoolIo (forwarded to NTDLL.TpStartAsyncIoOperation)
       1431  596          SubmitThreadpoolWork (forwarded to NTDLL.TpPostWork)
       1432  597 00020780 SuspendThread
       1433  598 00025240 SwitchToFiber
       1434  599 0001B400 SwitchToThread
       1435  59A 0001F6D0 SystemTimeToFileTime
       1436  59B 000221B0 SystemTimeToTzSpecificLocalTime
       1437  59C          SystemTimeToTzSpecificLocalTimeEx (forwarded to api-ms-win-core-timezone-l1-1-0.SystemTimeToTzSpecificLocalTimeEx)
       1438  59D 00021090 TerminateJobObject
       1439  59E 00020760 TerminateProcess
       1440  59F 0003C940 TerminateThread
       1441  5A0 00022650 TermsrvAppInstallMode
       1442  5A1 00068CA0 TermsrvConvertSysRootToUserDir
       1443  5A2 0001D3A0 TermsrvCreateRegEntry
       1444  5A3 0001DFE0 TermsrvDeleteKey
       1445  5A4 0001DFC0 TermsrvDeleteValue
       1446  5A5 0001B740 TermsrvGetPreSetValue
       1447  5A6 00022130 TermsrvGetWindowsDirectoryA
       1448  5A7 0001C720 TermsrvGetWindowsDirectoryW
       1449  5A8 00016B90 TermsrvOpenRegEntry
       1450  5A9 0001D360 TermsrvOpenUserClasses
       1451  5AA 000698F0 TermsrvRestoreKey
       1452  5AB 0001BB00 TermsrvSetKeySecurity
       1453  5AC 0001BAC0 TermsrvSetValueKey
       1454  5AD 00069910 TermsrvSyncUserIniFileExt
       1455  5AE 00021FA0 Thread32First
       1456  5AF 000214C0 Thread32Next
       1457  5B0 0001C830 TlsAlloc
       1458  5B1 0001D380 TlsFree
       1459  5B2 00015540 TlsGetValue
       1460  5B3 00015B90 TlsSetValue
       1461  5B4 0003CD70 Toolhelp32ReadProcessMemory
       1462  5B5 0003C960 TransactNamedPipe
       1463  5B6 00025190 TransmitCommChar
       1464  5B7          TryAcquireSRWLockExclusive (forwarded to NTDLL.RtlTryAcquireSRWLockExclusive)
       1465  5B8          TryAcquireSRWLockShared (forwarded to NTDLL.RtlTryAcquireSRWLockShared)
       1466  5B9          TryEnterCriticalSection (forwarded to NTDLL.RtlTryEnterCriticalSection)
       1467  5BA 000212F0 TrySubmitThreadpoolCallback
       1468  5BB 0003C980 TzSpecificLocalTimeToSystemTime
       1469  5BC          TzSpecificLocalTimeToSystemTimeEx (forwarded to api-ms-win-core-timezone-l1-1-0.TzSpecificLocalTimeToSystemTimeEx)
       1470  5BD 00038F90 UTRegister
       1471  5BE 00037B60 UTUnRegister
       1472  5BF 00042580 UmsThreadYield
       1473  5C0 0003C9A0 UnhandledExceptionFilter
       1474  5C1 00024FB0 UnlockFile
       1475  5C2 00024FC0 UnlockFileEx
       1476  5C3 0001E000 UnmapViewOfFile
       1477  5C4          UnmapViewOfFileEx (forwarded to api-ms-win-core-memory-l1-1-1.UnmapViewOfFileEx)
       1478  5C5 00043F20 UnregisterApplicationRecoveryCallback
       1479  5C6 0003C9C0 UnregisterApplicationRestart
       1480  5C7 0003C9E0 UnregisterBadMemoryNotification
       1481  5C8 0006A2B0 UnregisterConsoleIME
       1482  5C9 00013770 UnregisterWait
       1483  5CA 00021170 UnregisterWaitEx
       1484  5CB 00068290 UnregisterWaitUntilOOBECompleted
       1485  5CC 00008230 UpdateCalendarDayOfWeek
       1486  5CD          UpdateProcThreadAttribute (forwarded to api-ms-win-core-processthreads-l1-1-0.UpdateProcThreadAttribute)
       1487  5CE 0004A240 UpdateResourceA
       1488  5CF 0004A3F0 UpdateResourceW
       1489  5D0 0006A830 VDMConsoleOperation
       1490  5D1 00042030 VDMOperationStarted
       1491  5D2 000213C0 VerLanguageNameA
       1492  5D3 00020510 VerLanguageNameW
       1493  5D4          VerSetConditionMask (forwarded to NTDLL.VerSetConditionMask)
       1494  5D5 00020F60 VerifyConsoleIoHandle
       1495  5D6 0003CA00 VerifyScripts
       1496  5D7 00022580 VerifyVersionInfoA
       1497  5D8 00018450 VerifyVersionInfoW
       1498  5D9 00018500 VirtualAlloc
       1499  5DA 0003CA20 VirtualAllocEx
       1500  5DB 00024240 VirtualAllocExNuma
       1501  5DC 0001A130 VirtualFree
       1502  5DD 0003CA40 VirtualFreeEx
       1503  5DE 00024350 VirtualLock
       1504  5DF 0001BC70 VirtualProtect
       1505  5E0 0003CA60 VirtualProtectEx
       1506  5E1 0001C1A0 VirtualQuery
       1507  5E2 0001CFF0 VirtualQueryEx
       1508  5E3 0001C5F0 VirtualUnlock
       1509  5E4 000204A0 WTSGetActiveConsoleSessionId
       1510  5E5 000251A0 WaitCommEvent
       1511  5E6 0003CA80 WaitForDebugEvent
       1512  5E7          WaitForDebugEventEx (forwarded to api-ms-win-core-debug-l1-1-2.WaitForDebugEventEx)
       1513  5E8 00024AB0 WaitForMultipleObjects
       1514  5E9 00024AC0 WaitForMultipleObjectsEx
       1515  5EA 00024AD0 WaitForSingleObject
       1516  5EB 00024AE0 WaitForSingleObjectEx
       1517  5EC          WaitForThreadpoolIoCallbacks (forwarded to NTDLL.TpWaitForIoCompletion)
       1518  5ED          WaitForThreadpoolTimerCallbacks (forwarded to NTDLL.TpWaitForTimer)
       1519  5EE          WaitForThreadpoolWaitCallbacks (forwarded to NTDLL.TpWaitForWait)
       1520  5EF          WaitForThreadpoolWorkCallbacks (forwarded to NTDLL.TpWaitForWork)
       1521  5F0 00061C10 WaitNamedPipeA
       1522  5F1 0003CAA0 WaitNamedPipeW
       1523  5F2          WakeAllConditionVariable (forwarded to NTDLL.RtlWakeAllConditionVariable)
       1524  5F3          WakeConditionVariable (forwarded to NTDLL.RtlWakeConditionVariable)
       1525  5F4 00043F40 WerGetFlags
       1526  5F5 00043F40 WerGetFlagsWorker
       1527  5F6 0003CAC0 WerRegisterAdditionalProcess
       1528  5F7 0003CAE0 WerRegisterAppLocalDump
       1529  5F8 0003CB00 WerRegisterCustomMetadata
       1530  5F9 0003CB20 WerRegisterExcludedMemoryBlock
       1531  5FA 00020480 WerRegisterFile
       1532  5FB 00043F50 WerRegisterFileWorker
       1533  5FC 000206E0 WerRegisterMemoryBlock
       1534  5FD 00043F60 WerRegisterMemoryBlockWorker
       1535  5FE 00020880 WerRegisterRuntimeExceptionModule
       1536  5FF 00043F70 WerRegisterRuntimeExceptionModuleWorker
       1537  600 0001CBD0 WerSetFlags
       1538  601 0001CBD0 WerSetFlagsWorker
       1539  602 0003CB40 WerUnregisterAdditionalProcess
       1540  603 0003CB60 WerUnregisterAppLocalDump
       1541  604 0003CB80 WerUnregisterCustomMetadata
       1542  605 0003CBA0 WerUnregisterExcludedMemoryBlock
       1543  606 00020460 WerUnregisterFile
       1544  607 00043F80 WerUnregisterFileWorker
       1545  608 00021BA0 WerUnregisterMemoryBlock
       1546  609 00043F90 WerUnregisterMemoryBlockWorker
       1547  60A 0003CBC0 WerUnregisterRuntimeExceptionModule
       1548  60B 00043FA0 WerUnregisterRuntimeExceptionModuleWorker
       1549  60C 0006D290 WerpGetDebugger
       1550  60D 00043FB0 WerpInitiateRemoteRecovery
       1551  60E 0006DC80 WerpLaunchAeDebug
       1552  60F 0001B610 WerpNotifyLoadStringResourceWorker
       1553  610 0001B610 WerpNotifyUseStringResourceWorker
       1554  611 00015B30 WideCharToMultiByte
       1555  612 00067200 WinExec
       1556  613 0003CBE0 Wow64DisableWow64FsRedirection
       1557  614 000215E0 Wow64EnableWow64FsRedirection
       1558  615 0003CC00 Wow64GetThreadContext
       1559  616 00037D40 Wow64GetThreadSelectorEntry
       1560  617 0003CC20 Wow64RevertWow64FsRedirection
       1561  618 0003CC40 Wow64SetThreadContext
       1562  619 0003CC60 Wow64SuspendThread
       1563  61A 000253B0 WriteConsoleA
       1564  61B 000255D0 WriteConsoleInputA
       1565  61C 0006A030 WriteConsoleInputVDMA
       1566  61D 0006A0C0 WriteConsoleInputVDMW
       1567  61E 000255E0 WriteConsoleInputW
       1568  61F 000255F0 WriteConsoleOutputA
       1569  620 00025600 WriteConsoleOutputAttribute
       1570  621 00025610 WriteConsoleOutputCharacterA
       1571  622 00025620 WriteConsoleOutputCharacterW
       1572  623 00025630 WriteConsoleOutputW
       1573  624 000253C0 WriteConsoleW
       1574  625 00024FD0 WriteFile
       1575  626 00024FE0 WriteFileEx
       1576  627 00024FF0 WriteFileGather
       1577  628 00060B10 WritePrivateProfileSectionA
       1578  629 00023D60 WritePrivateProfileSectionW
       1579  62A 00060B80 WritePrivateProfileStringA
       1580  62B 00017AF0 WritePrivateProfileStringW
       1581  62C 00060BF0 WritePrivateProfileStructA
       1582  62D 00060D60 WritePrivateProfileStructW
       1583  62E 0003CC80 WriteProcessMemory
       1584  62F 00060ED0 WriteProfileSectionA
       1585  630 00060EE0 WriteProfileSectionW
       1586  631 00060EF0 WriteProfileStringA
       1587  632 00060F00 WriteProfileStringW
       1588  633 000437B0 WriteTapemark
       1589  634 0003CCA0 ZombifyActCtx
       1590  635 00043D50 ZombifyActCtxWorker
       1591  636          __C_specific_handler (forwarded to NTDLL.__C_specific_handler)
       1592  637          __chkstk (forwarded to NTDLL.__chkstk)
       1593  638          __misaligned_access (forwarded to NTDLL.__misaligned_access)
       1594  639 00017CC0 _hread
       1595  63A 00069A20 _hwrite
       1596  63B 0001C630 _lclose
       1597  63C 00069930 _lcreat
       1598  63D 00017C90 _llseek
       1599  63E          _local_unwind (forwarded to NTDLL._local_unwind)
       1600  63F 000699A0 _lopen
       1601  640 00017CC0 _lread
       1602  641 00069A20 _lwrite
       1603  642 000200C0 lstrcat
       1604  643 000200C0 lstrcatA
       1605  644 00069A70 lstrcatW
       1606  645 0001C480 lstrcmp
       1607  646 0001C480 lstrcmpA
       1608  647 0001B770 lstrcmpW
       1609  648 0001B300 lstrcmpi
       1610  649 0001B300 lstrcmpiA
       1611  64A 00017BA0 lstrcmpiW
       1612  64B 0001E300 lstrcpy
       1613  64C 0001E300 lstrcpyA
       1614  64D 00021E50 lstrcpyW
       1615  64E 0003CCC0 lstrcpyn
       1616  64F 0003CCC0 lstrcpynA
       1617  650 00020F70 lstrcpynW
       1618  651 0001AAB0 lstrlen
       1619  652 0001AAB0 lstrlenA
       1620  653 00017000 lstrlenW
       1621  654 0001D990 timeBeginPeriod
       1622  655 0001CA10 timeEndPeriod
       1623  656 000220C0 timeGetDevCaps
       1624  657 00069AC0 timeGetSystemTime
       1625  658 0001BA20 timeGetTime
       1626  659 0001B770 uaw_lstrcmpW
       1627  65A 00017BA0 uaw_lstrcmpiW
       1628  65B 00037580 uaw_lstrlenW
       1629  65C 000375D0 uaw_wcschr
       1630  65D 00037600 uaw_wcscpy
       1631  65E 00037630 uaw_wcsicmp
       1632  65F 00037650 uaw_wcslen
       1633  660 00037680 uaw_wcsrchr

ntdll.dll 的 ordinal

PS D:\工作> dumpbin.exe -exports .\ntdll.dll
Microsoft (R) COFF/PE Dumper Version 14.29.30140.0
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file .\ntdll.dll

File Type: DLL

  Section contains the following exports for ntdll.dll

    00000000 characteristics
    E2F8CA76 time date stamp
        0.00 version
           8 ordinal base
        2431 number of functions
        2430 number of names

    ordinal hint RVA      name

          9    0 00040230 A_SHAFinal
         10    1 00041060 A_SHAInit
         11    2 000410A0 A_SHAUpdate
         12    3 000E0740 AlpcAdjustCompletionListConcurrencyCount
         13    4 00070620 AlpcFreeCompletionListMessage
         14    5 000E0770 AlpcGetCompletionListLastMessageInformation
         15    6 000E0790 AlpcGetCompletionListMessageAttributes
         16    7 00070350 AlpcGetHeaderSize
         17    8 00070310 AlpcGetMessageAttribute
         18    9 00010A60 AlpcGetMessageFromCompletionList
         19    A 00085CA0 AlpcGetOutstandingCompletionListMessageCount
         20    B 000702B0 AlpcInitializeMessageAttribute
         21    C 00084900 AlpcMaxAllowedMessageLength
         22    D 00085B20 AlpcRegisterCompletionList
         23    E 00075130 AlpcRegisterCompletionListWorkerThread
         24    F 00085C60 AlpcRundownCompletionList
         25   10 00085C80 AlpcUnregisterCompletionList
         26   11 000750D0 AlpcUnregisterCompletionListWorkerThread
         27   12 00076D90 ApiSetQueryApiSetPresence
         28   13 000690A0 ApiSetQueryApiSetPresenceEx
         29   14 00008D50 CsrAllocateCaptureBuffer
         30   15 00008D00 CsrAllocateMessagePointer
         31   16 00008850 CsrCaptureMessageBuffer
         32   17 00008B40 CsrCaptureMessageMultiUnicodeStringsInPlace
         33   18 00008C50 CsrCaptureMessageString
         34   19 000CB390 CsrCaptureTimeout
         35   1A 000089A0 CsrClientCallServer
         36   1B 00008E20 CsrClientConnectToServer
         37   1C 00008970 CsrFreeCaptureBuffer
         38   1D 000CB3C0 CsrGetProcessId
         39   1E 000842D0 CsrIdentifyAlertableThread
         40   1F 000D5290 CsrSetPriorityClass
         41   20 000CB3E0 CsrVerifyRegion
         42   21 000A0860 DbgBreakPoint
         43   22 00050960 DbgPrint
         44   23 000502F0 DbgPrintEx
         45   24 000E07D0 DbgPrintReturnControlC
         46   25 000E0820 DbgPrompt
         47   26 000E0870 DbgQueryDebugFilterState
         48   27 000E0880 DbgSetDebugFilterState
         49   28 000CC4E0 DbgUiConnectToDbg
         50   29 000CC550 DbgUiContinue
         51   2A 000CC580 DbgUiConvertStateChangeStructure
         52   2B 000CC590 DbgUiConvertStateChangeStructureEx
         53   2C 000CC840 DbgUiDebugActiveProcess
         54   2D 000CC8B0 DbgUiGetThreadDebugObject
         55   2E 000CC8D0 DbgUiIssueRemoteBreakin
         56   2F 000CC940 DbgUiRemoteBreakin
         57   30 000CC9A0 DbgUiSetThreadDebugObject
         58   31 000CC9C0 DbgUiStopDebugging
         59   32 000CC9E0 DbgUiWaitStateChange
         60   33 000A0870 DbgUserBreakPoint
         61   34 00085A90 EtwCheckCoverage
         62   35 001106B0 EtwCreateTraceInstanceId
         63   36 000452A0 EtwDeliverDataBlock
         64   37 00110290 EtwEnumerateProcessRegGuids
         65   38 0005B690 EtwEventActivityIdControl
         66   39 00050D00 EtwEventEnabled
         67   3A 00074990 EtwEventProviderEnabled
         68   3B 00042E70 EtwEventRegister
         69   3C 00042AE0 EtwEventSetInformation
         70   3D 00050380 EtwEventUnregister
         71   3E 0004F1A0 EtwEventWrite
         72   3F 0004EBD0 EtwEventWriteEndScenario
         73   40 0004F150 EtwEventWriteEx
         74   41 0004F100 EtwEventWriteFull
         75   42 000608D0 EtwEventWriteNoRegistration
         76   43 00089CF0 EtwEventWriteStartScenario
         77   44 00110390 EtwEventWriteString
         78   45 0004F1E0 EtwEventWriteTransfer
         79   46 00081370 EtwGetTraceEnableFlags
         80   47 00081330 EtwGetTraceEnableLevel
         81   48 000812F0 EtwGetTraceLoggerHandle
         82   49 0004FB40 EtwLogTraceEvent
         83   4A 00043030 EtwNotificationRegister
         84   4B 00050390 EtwNotificationUnregister
         85   4C 00055950 EtwProcessPrivateLoggerRequest
         86   4D 0008BE90 EtwRegisterSecurityProvider
         87   4E 00085280 EtwRegisterTraceGuidsA
         88   4F 00042A00 EtwRegisterTraceGuidsW
         89   50 000019A0 EtwReplyNotification
         90   51 00050530 EtwSendNotification
         91   52 0008A7B0 EtwSetMark
         92   53 00110710 EtwTraceEventInstance
         93   54 00050660 EtwTraceMessage
         94   55 00050690 EtwTraceMessageVa
         95   56 00050330 EtwUnregisterTraceGuids
         96   57 0007BE40 EtwWriteUMSecurityEvent
         97   58 00055FD0 EtwpCreateEtwThread
         98   59 000573B0 EtwpGetCpuSpeed
         99   5A 00111670 EvtIntReportAuthzEventAndSourceAsync
        100   5B 0004ECC0 EvtIntReportEventAndSourceAsync
        101   5C 000A0910 ExpInterlockedPopEntrySListEnd
        102   5D 000A0907 ExpInterlockedPopEntrySListFault
        103   5E 000A08F7 ExpInterlockedPopEntrySListResume
        104   5F 000A0C40 KiRaiseUserExceptionDispatcher
        105   60 000A0A70 KiUserApcDispatcher
        106   61 000A0B80 KiUserCallbackDispatcher
        107   62 000A0BD0 KiUserExceptionDispatcher
        108   63 0017F500 KiUserInvertedFunctionTable
        109   64 000207A0 LdrAccessResource
        110   65 0008B600 LdrAddDllDirectory
        111   66 00073000 LdrAddLoadAsDataTable
        112   67 00010140 LdrAddRefDll
        113   68 000CB430 LdrAppxHandleIntegrityFailure
        114   69 000CCA10 LdrCallEnclave
        115   6A 00033520 LdrControlFlowGuardEnforced
        116   6B 000CCA20 LdrCreateEnclave
        117   6C 000CCB30 LdrDeleteEnclave
        118   6D 0000EF70 LdrDisableThreadCalloutsForDll
        119   6E 000E0AC0 LdrEnumResources
        120   6F 0005D870 LdrEnumerateLoadedModules
        121   70 00084740 LdrFastFailInLoaderCallout
        122   71 0006A240 LdrFindEntryForAddress
        123   72 000E0D90 LdrFindResourceDirectory_U
        124   73 00080ED0 LdrFindResourceEx_U
        125   74 00070580 LdrFindResource_U
        126   75 00089340 LdrFlushAlternateResourceModules
        127   76 0007EEF0 LdrGetDllDirectory
        128   77 00010240 LdrGetDllFullName
        129   78 00016870 LdrGetDllHandle
        130   79 00074600 LdrGetDllHandleByMapping
        131   7A 00076FA0 LdrGetDllHandleByName
        132   7B 000168A0 LdrGetDllHandleEx
        133   7C 00011450 LdrGetDllPath
        134   7D 000CDD70 LdrGetFailureData
        135   7E 000E0DB0 LdrGetFileNameFromLoadAsDataTable
        136   7F 000843A0 LdrGetKnownDllSectionHandle
        137   80 00081AC0 LdrGetProcedureAddress
        138   81 0006BF10 LdrGetProcedureAddressEx
        139   82 0002FDC0 LdrGetProcedureAddressForCaller
        140   83 000D0350 LdrInitShimEngineDynamic
        141   84 000CCBC0 LdrInitializeEnclave
        142   85 00074B00 LdrInitializeThunk
        143   86 000CDD80 LdrIsModuleSxsRedirected
        144   87 0007DA00 LdrLoadAlternateResourceModule
        145   88 00034EA0 LdrLoadAlternateResourceModuleEx
        146   89 00016A10 LdrLoadDll
        147   8A 000CCD60 LdrLoadEnclaveModule
        148   8B 0007D030 LdrLockLoaderLock
        149   8C 000E1840 LdrOpenImageFileOptionsKey
        150   8D 00080830 LdrProcessInitializationComplete
        151   8E 000E38A0 LdrProcessRelocationBlock
        152   8F 000E38D0 LdrProcessRelocationBlockEx
        153   90 0007A2B0 LdrQueryImageFileExecutionOptions
        154   91 0007A2F0 LdrQueryImageFileExecutionOptionsEx
        155   92 0007A390 LdrQueryImageFileKeyOption
        156   93 000CDF70 LdrQueryModuleServiceTags
        157   94 000CE770 LdrQueryOptionalDelayLoadedAPI
        158   95 00001430 LdrQueryProcessModuleInformation
        159   96 00084AE0 LdrRegisterDllNotification
        160   97 0008BD10 LdrRemoveDllDirectory
        161   98 000737C0 LdrRemoveLoadAsDataTable
        162   99 000E3DB0 LdrResFindResource
        163   9A 00048AA0 LdrResFindResourceDirectory
        164   9B 0004B320 LdrResGetRCConfig
        165   9C 00089DF0 LdrResRelease
        166   9D 00048B30 LdrResSearchResource
        167   9E 00010380 LdrResolveDelayLoadedAPI
        168   9F 000CE830 LdrResolveDelayLoadsFromDll
        169   A0 00034C60 LdrRscIsTypeExist
        170   A1 000842D0 LdrSetAppCompatDllRedirectionCallback
        171   A2 0007FBD0 LdrSetDefaultDllDirectories
        172   A3 0007FC10 LdrSetDllDirectory
        173   A4 00083D00 LdrSetDllManifestProber
        174   A5 000CE410 LdrSetImplicitPathOptions
        175   A6 0008BED0 LdrSetMUICacheType
        176   A7 0005DA50 LdrShutdownProcess
        177   A8 00017450 LdrShutdownThread
        178   A9 0007FEC0 LdrStandardizeSystemPath
        179   AA 0017F2F0 LdrSystemDllInitBlock
        180   AB 0006A6C0 LdrUnloadAlternateResourceModule
        181   AC 0006A6D0 LdrUnloadAlternateResourceModuleEx
        182   AD 0000FBF0 LdrUnloadDll
        183   AE 0007DEA0 LdrUnlockLoaderLock
        184   AF 000CE480 LdrUnregisterDllNotification
        185   B0 000DEA80 LdrUpdatePackageSearchPath
        186   B1 000CE530 LdrVerifyImageMatchesChecksum
        187   B2 0008AA80 LdrVerifyImageMatchesChecksumEx
        188   B3 0004ABF0 LdrpResGetMappingSize
        189   B4 00049620 LdrpResGetResourceDirectory
        190   B5 0010FAD0 MD4Final
        191   B6 0010FBA0 MD4Init
        192   B7 00110160 MD4Update
        193   B8 0005BDD0 MD5Final
        194   B9 0007D610 MD5Init
        195   BA 0005BEA0 MD5Update
        196   BB 001677CC NlsAnsiCodePage
        197   BC 0016B710 NlsMbCodePageTag
        198   BD 0016B6D8 NlsMbOemCodePageTag
        199   BE 0009CDA0 NtAcceptConnectPort
        200   BF 0009CD60 NtAccessCheck
        201   C0 0009D280 NtAccessCheckAndAuditAlarm
        202   C1 0009D9B0 NtAccessCheckByType
        203   C2 0009D880 NtAccessCheckByTypeAndAuditAlarm
        204   C3 0009D9D0 NtAccessCheckByTypeResultList
        205   C4 0009D9F0 NtAccessCheckByTypeResultListAndAuditAlarm
        206   C5 0009DA10 NtAccessCheckByTypeResultListAndAuditAlarmByHandle
        207   C6 0009DA30 NtAcquireCrossVmMutant
        208   C7 0009DA50 NtAcquireProcessActivityReference
        209   C8 0009D640 NtAddAtom
        210   C9 0009DA70 NtAddAtomEx
        211   CA 0009DA90 NtAddBootEntry
        212   CB 0009DAB0 NtAddDriverEntry
        213   CC 0009DAD0 NtAdjustGroupsToken
        214   CD 0009D580 NtAdjustPrivilegesToken
        215   CE 0009DAF0 NtAdjustTokenClaimsAndDeviceGroups
        216   CF 0009DB10 NtAlertResumeThread
        217   D0 0009DB30 NtAlertThread
        218   D1 0009DB50 NtAlertThreadByThreadId
        219   D2 0009DB70 NtAllocateLocallyUniqueId
        220   D3 0009DB90 NtAllocateReserveObject
        221   D4 0009DBB0 NtAllocateUserPhysicalPages
        222   D5 0009DBD0 NtAllocateUserPhysicalPagesEx
        223   D6 0009DBF0 NtAllocateUuids
        224   D7 0009D060 NtAllocateVirtualMemory
        225   D8 0009DC10 NtAllocateVirtualMemoryEx
        226   D9 0009DC30 NtAlpcAcceptConnectPort
        227   DA 0009DC50 NtAlpcCancelMessage
        228   DB 0009DC70 NtAlpcConnectPort
        229   DC 0009DC90 NtAlpcConnectPortEx
        230   DD 0009DCB0 NtAlpcCreatePort
        231   DE 0009DCD0 NtAlpcCreatePortSection
        232   DF 0009DCF0 NtAlpcCreateResourceReserve
        233   E0 0009DD10 NtAlpcCreateSectionView
        234   E1 0009DD30 NtAlpcCreateSecurityContext
        235   E2 0009DD50 NtAlpcDeletePortSection
        236   E3 0009DD70 NtAlpcDeleteResourceReserve
        237   E4 0009DD90 NtAlpcDeleteSectionView
        238   E5 0009DDB0 NtAlpcDeleteSecurityContext
        239   E6 0009DDD0 NtAlpcDisconnectPort
        240   E7 0009DDF0 NtAlpcImpersonateClientContainerOfPort
        241   E8 0009DE10 NtAlpcImpersonateClientOfPort
        242   E9 0009DE30 NtAlpcOpenSenderProcess
        243   EA 0009DE50 NtAlpcOpenSenderThread
        244   EB 0009DE70 NtAlpcQueryInformation
        245   EC 0009DE90 NtAlpcQueryInformationMessage
        246   ED 0009DEB0 NtAlpcRevokeSecurityContext
        247   EE 0009DED0 NtAlpcSendWaitReceivePort
        248   EF 0009DEF0 NtAlpcSetInformation
        249   F0 0009D6E0 NtApphelpCacheControl
        250   F1 0009DF10 NtAreMappedFilesTheSame
        251   F2 0009DF30 NtAssignProcessToJobObject
        252   F3 0009DF50 NtAssociateWaitCompletionPacket
        253   F4 0009DF70 NtCallEnclave
        254   F5 0009CE00 NtCallbackReturn
        255   F6 0009D8F0 NtCancelIoFile
        256   F7 0009DF90 NtCancelIoFileEx
        257   F8 0009DFB0 NtCancelSynchronousIoFile
        258   F9 0009D970 NtCancelTimer
        259   FA 0009DFD0 NtCancelTimer2
        260   FB 0009DFF0 NtCancelWaitCompletionPacket
        261   FC 0009D520 NtClearEvent
        262   FD 0009CF40 NtClose
        263   FE 0009D4C0 NtCloseObjectAuditAlarm
        264   FF 0009E010 NtCommitComplete
        265  100 0009E030 NtCommitEnlistment
        266  101 0009E050 NtCommitRegistryTransaction
        267  102 0009E070 NtCommitTransaction
        268  103 0009E090 NtCompactKeys
        269  104 0009E0B0 NtCompareObjects
        270  105 0009E0D0 NtCompareSigningLevels
        271  106 0009E0F0 NtCompareTokens
        272  107 0009E110 NtCompleteConnectPort
        273  108 0009E130 NtCompressKey
        274  109 0009E150 NtConnectPort
        275  10A 0009D5C0 NtContinue
        276  10B 0009E170 NtContinueEx
        277  10C 0009E190 NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
        278  10D 0009E1B0 NtCreateCrossVmEvent
        279  10E 0009E1D0 NtCreateCrossVmMutant
        280  10F 0009E1F0 NtCreateDebugObject
        281  110 0009E210 NtCreateDirectoryObject
        282  111 0009E230 NtCreateDirectoryObjectEx
        283  112 0009E250 NtCreateEnclave
        284  113 0009E270 NtCreateEnlistment
        285  114 0009D660 NtCreateEvent
        286  115 0009E290 NtCreateEventPair
        287  116 0009D800 NtCreateFile
        288  117 0009E2B0 NtCreateIRTimer
        289  118 0009E2D0 NtCreateIoCompletion
        290  119 0009E2F0 NtCreateJobObject
        291  11A 0009E310 NtCreateJobSet
        292  11B 0009D100 NtCreateKey
        293  11C 0009E330 NtCreateKeyTransacted
        294  11D 0009E350 NtCreateKeyedEvent
        295  11E 0009E370 NtCreateLowBoxToken
        296  11F 0009E390 NtCreateMailslotFile
        297  120 0009E3B0 NtCreateMutant
        298  121 0009E3D0 NtCreateNamedPipeFile
        299  122 0009E3F0 NtCreatePagingFile
        300  123 0009E410 NtCreatePartition
        301  124 0009E430 NtCreatePort
        302  125 0009E450 NtCreatePrivateNamespace
        303  126 0009E470 NtCreateProcess
        304  127 0009D700 NtCreateProcessEx
        305  128 0009E490 NtCreateProfile
        306  129 0009E4B0 NtCreateProfileEx
        307  12A 0009E4D0 NtCreateRegistryTransaction
        308  12B 0009E4F0 NtCreateResourceManager
        309  12C 0009D6A0 NtCreateSection
        310  12D 0009E510 NtCreateSectionEx
        311  12E 0009E530 NtCreateSemaphore
        312  12F 0009E550 NtCreateSymbolicLinkObject
        313  130 0009D720 NtCreateThread
        314  131 0009E570 NtCreateThreadEx
        315  132 0009E590 NtCreateTimer
        316  133 0009E5B0 NtCreateTimer2
        317  134 0009E5D0 NtCreateToken
        318  135 0009E5F0 NtCreateTokenEx
        319  136 0009E610 NtCreateTransaction
        320  137 0009E630 NtCreateTransactionManager
        321  138 0009E650 NtCreateUserProcess
        322  139 0009E670 NtCreateWaitCompletionPacket
        323  13A 0009E690 NtCreateWaitablePort
        324  13B 0009E6B0 NtCreateWnfStateName
        325  13C 0009E6D0 NtCreateWorkerFactory
        326  13D 0009E6F0 NtDebugActiveProcess
        327  13E 0009E710 NtDebugContinue
        328  13F 0009D3E0 NtDelayExecution
        329  140 0009E730 NtDeleteAtom
        330  141 0009E750 NtDeleteBootEntry
        331  142 0009E770 NtDeleteDriverEntry
        332  143 0009E790 NtDeleteFile
        333  144 0009E7B0 NtDeleteKey
        334  145 0009E7D0 NtDeleteObjectAuditAlarm
        335  146 0009E7F0 NtDeletePrivateNamespace
        336  147 0009E810 NtDeleteValueKey
        337  148 0009E830 NtDeleteWnfStateData
        338  149 0009E850 NtDeleteWnfStateName
        339  14A 0009CE40 NtDeviceIoControlFile
        340  14B 0009E870 NtDirectGraphicsCall
        341  14C 0009E890 NtDisableLastKnownGood
        342  14D 0009E8B0 NtDisplayString
        343  14E 0009E8D0 NtDrawText
        344  14F 0009D4E0 NtDuplicateObject
        345  150 0009D5A0 NtDuplicateToken
        346  151 0009E8F0 NtEnableLastKnownGood
        347  152 0009E910 NtEnumerateBootEntries
        348  153 0009E930 NtEnumerateDriverEntries
        349  154 0009D3A0 NtEnumerateKey
        350  155 0009E950 NtEnumerateSystemEnvironmentValuesEx
        351  156 0009E970 NtEnumerateTransactionObject
        352  157 0009CFC0 NtEnumerateValueKey
        353  158 0009E990 NtExtendSection
        354  159 0009E9B0 NtFilterBootOption
        355  15A 0009E9D0 NtFilterToken
        356  15B 0009E9F0 NtFilterTokenEx
        357  15C 0009CFE0 NtFindAtom
        358  15D 0009D6C0 NtFlushBuffersFile
        359  15E 0009EA10 NtFlushBuffersFileEx
        360  15F 0009EA30 NtFlushInstallUILanguage
        361  160 0009EA50 NtFlushInstructionCache
        362  161 0009EA70 NtFlushKey
        363  162 0009EA90 NtFlushProcessWriteBuffers
        364  163 0009EAB0 NtFlushVirtualMemory
        365  164 0009EAD0 NtFlushWriteBuffer
        366  165 0009EAF0 NtFreeUserPhysicalPages
        367  166 0009D120 NtFreeVirtualMemory
        368  167 0009EB10 NtFreezeRegistry
        369  168 0009EB30 NtFreezeTransactions
        370  169 0009D480 NtFsControlFile
        371  16A 0009EB50 NtGetCachedSigningLevel
        372  16B 0009EB70 NtGetCompleteWnfStateSubscription
        373  16C 0009EB90 NtGetContextThread
        374  16D 0009EBB0 NtGetCurrentProcessorNumber
        375  16E 0009EBD0 NtGetCurrentProcessorNumberEx
        376  16F 0009EBF0 NtGetDevicePowerState
        377  170 0009EC10 NtGetMUIRegistryInfo
        378  171 0009EC30 NtGetNextProcess
        379  172 0009EC50 NtGetNextThread
        380  173 0009EC70 NtGetNlsSectionPtr
        381  174 0009EC90 NtGetNotificationResourceManager
        382  175 000E5A90 NtGetTickCount
        383  176 0009ECB0 NtGetWriteWatch
        384  177 0009ECD0 NtImpersonateAnonymousToken
        385  178 0009D140 NtImpersonateClientOfPort
        386  179 0009ECF0 NtImpersonateThread
        387  17A 0009ED10 NtInitializeEnclave
        388  17B 0009ED30 NtInitializeNlsFiles
        389  17C 0009ED50 NtInitializeRegistry
        390  17D 0009ED70 NtInitiatePowerAction
        391  17E 0009D740 NtIsProcessInJob
        392  17F 0009ED90 NtIsSystemResumeAutomatic
        393  180 0009EDB0 NtIsUILanguageComitted
        394  181 0009EDD0 NtListenPort
        395  182 0009EDF0 NtLoadDriver
        396  183 0009EE10 NtLoadEnclaveData
        397  184 0009EE30 NtLoadKey
        398  185 0009EE50 NtLoadKey2
        399  186 000A0810 NtLoadKey3
        400  187 0009EE70 NtLoadKeyEx
        401  188 0009EE90 NtLockFile
        402  189 0009EEB0 NtLockProductActivationKeys
        403  18A 0009EED0 NtLockRegistryKey
        404  18B 0009EEF0 NtLockVirtualMemory
        405  18C 0009EF10 NtMakePermanentObject
        406  18D 0009EF30 NtMakeTemporaryObject
        407  18E 0009EF50 NtManageHotPatch
        408  18F 0009EF70 NtManagePartition
        409  190 0009EF90 NtMapCMFModule
        410  191 0009EFB0 NtMapUserPhysicalPages
        411  192 0009CDC0 NtMapUserPhysicalPagesScatter
        412  193 0009D260 NtMapViewOfSection
        413  194 0009EFD0 NtMapViewOfSectionEx
        414  195 0009EFF0 NtModifyBootEntry
        415  196 0009F010 NtModifyDriverEntry
        416  197 0009F030 NtNotifyChangeDirectoryFile
        417  198 0009F050 NtNotifyChangeDirectoryFileEx
        418  199 0009F070 NtNotifyChangeKey
        419  19A 0009F090 NtNotifyChangeMultipleKeys
        420  19B 0009F0B0 NtNotifyChangeSession
        421  19C 0009D860 NtOpenDirectoryObject
        422  19D 0009F0D0 NtOpenEnlistment
        423  19E 0009D560 NtOpenEvent
        424  19F 0009F0F0 NtOpenEventPair
        425  1A0 0009D3C0 NtOpenFile
        426  1A1 0009F110 NtOpenIoCompletion
        427  1A2 0009F130 NtOpenJobObject
        428  1A3 0009CFA0 NtOpenKey
        429  1A4 0009F150 NtOpenKeyEx
        430  1A5 0009F170 NtOpenKeyTransacted
        431  1A6 0009F190 NtOpenKeyTransactedEx
        432  1A7 0009F1B0 NtOpenKeyedEvent
        433  1A8 0009F1D0 NtOpenMutant
        434  1A9 0009F1F0 NtOpenObjectAuditAlarm
        435  1AA 0009F210 NtOpenPartition
        436  1AB 0009F230 NtOpenPrivateNamespace
        437  1AC 0009D220 NtOpenProcess
        438  1AD 0009F250 NtOpenProcessToken
        439  1AE 0009D360 NtOpenProcessTokenEx
        440  1AF 0009F270 NtOpenRegistryTransaction
        441  1B0 0009F290 NtOpenResourceManager
        442  1B1 0009D440 NtOpenSection
        443  1B2 0009F2B0 NtOpenSemaphore
        444  1B3 0009F2D0 NtOpenSession
        445  1B4 0009F2F0 NtOpenSymbolicLinkObject
        446  1B5 0009F310 NtOpenThread
        447  1B6 0009D1E0 NtOpenThreadToken
        448  1B7 0009D340 NtOpenThreadTokenEx
        449  1B8 0009F330 NtOpenTimer
        450  1B9 0009F350 NtOpenTransaction
        451  1BA 0009F370 NtOpenTransactionManager
        452  1BB 0009F390 NtPlugPlayControl
        453  1BC 0009D930 NtPowerInformation
        454  1BD 0009F3B0 NtPrePrepareComplete
        455  1BE 0009F3D0 NtPrePrepareEnlistment
        456  1BF 0009F3F0 NtPrepareComplete
        457  1C0 0009F410 NtPrepareEnlistment
        458  1C1 0009F430 NtPrivilegeCheck
        459  1C2 0009F450 NtPrivilegeObjectAuditAlarm
        460  1C3 0009F470 NtPrivilegedServiceAuditAlarm
        461  1C4 0009F490 NtPropagationComplete
        462  1C5 0009F4B0 NtPropagationFailed
        463  1C6 0009D760 NtProtectVirtualMemory
        464  1C7 0009F4D0 NtPssCaptureVaSpaceBulk
        465  1C8 0009F4F0 NtPulseEvent
        466  1C9 0009D500 NtQueryAttributesFile
        467  1CA 0009F510 NtQueryAuxiliaryCounterFrequency
        468  1CB 0009F530 NtQueryBootEntryOrder
        469  1CC 0009F550 NtQueryBootOptions
        470  1CD 0009F570 NtQueryDebugFilterState
        471  1CE 0009D000 NtQueryDefaultLocale
        472  1CF 0009D5E0 NtQueryDefaultUILanguage
        473  1D0 0009D400 NtQueryDirectoryFile
        474  1D1 0009F590 NtQueryDirectoryFileEx
        475  1D2 0009F5B0 NtQueryDirectoryObject
        476  1D3 0009F5D0 NtQueryDriverEntryOrder
        477  1D4 0009F5F0 NtQueryEaFile
        478  1D5 0009D820 NtQueryEvent
        479  1D6 0009F610 NtQueryFullAttributesFile
        480  1D7 0009F630 NtQueryInformationAtom
        481  1D8 0009F650 NtQueryInformationByName
        482  1D9 0009F670 NtQueryInformationEnlistment
        483  1DA 0009CF80 NtQueryInformationFile
        484  1DB 0009F690 NtQueryInformationJobObject
        485  1DC 0009F6B0 NtQueryInformationPort
        486  1DD 0009D080 NtQueryInformationProcess
        487  1DE 0009F6D0 NtQueryInformationResourceManager
        488  1DF 0009D200 NtQueryInformationThread
        489  1E0 0009D180 NtQueryInformationToken
        490  1E1 0009F6F0 NtQueryInformationTransaction
        491  1E2 0009F710 NtQueryInformationTransactionManager
        492  1E3 0009F730 NtQueryInformationWorkerFactory
        493  1E4 0009F750 NtQueryInstallUILanguage
        494  1E5 0009F770 NtQueryIntervalProfile
        495  1E6 0009F790 NtQueryIoCompletion
        496  1E7 0009D020 NtQueryKey
        497  1E8 0009F7B0 NtQueryLicenseValue
        498  1E9 0009F7D0 NtQueryMultipleValueKey
        499  1EA 0009F7F0 NtQueryMutant
        500  1EB 0009CF60 NtQueryObject
        501  1EC 0009F810 NtQueryOpenSubKeys
        502  1ED 0009F830 NtQueryOpenSubKeysEx
        503  1EE 0009D380 NtQueryPerformanceCounter
        504  1EF 0009F850 NtQueryPortInformationProcess
        505  1F0 0009F870 NtQueryQuotaInformationFile
        506  1F1 0009D780 NtQuerySection
        507  1F2 0009F890 NtQuerySecurityAttributesToken
        508  1F3 0009F8B0 NtQuerySecurityObject
        509  1F4 0009F8D0 NtQuerySecurityPolicy
        510  1F5 0009F8F0 NtQuerySemaphore
        511  1F6 0009F910 NtQuerySymbolicLinkObject
        512  1F7 0009F930 NtQuerySystemEnvironmentValue
        513  1F8 0009F950 NtQuerySystemEnvironmentValueEx
        514  1F9 0009D420 NtQuerySystemInformation
        515  1FA 0009F970 NtQuerySystemInformationEx
        516  1FB 0009D8A0 NtQuerySystemTime
        517  1FC 0009D460 NtQueryTimer
        518  1FD 0009F990 NtQueryTimerResolution
        519  1FE 0009D040 NtQueryValueKey
        520  1FF 0009D1C0 NtQueryVirtualMemory
        521  200 0009D680 NtQueryVolumeInformationFile
        522  201 0009F9B0 NtQueryWnfStateData
        523  202 0009F9D0 NtQueryWnfStateNameInformation
        524  203 0009D600 NtQueueApcThread
        525  204 0009F9F0 NtQueueApcThreadEx
        526  205 0009FA10 NtRaiseException
        527  206 0009FA30 NtRaiseHardError
        528  207 0009CE20 NtReadFile
        529  208 0009D320 NtReadFileScatter
        530  209 0009FA50 NtReadOnlyEnlistment
        531  20A 0009D7E0 NtReadRequestData
        532  20B 0009D540 NtReadVirtualMemory
        533  20C 0009FA70 NtRecoverEnlistment
        534  20D 0009FA90 NtRecoverResourceManager
        535  20E 0009FAB0 NtRecoverTransactionManager
        536  20F 0009FAD0 NtRegisterProtocolAddressInformation
        537  210 0009FAF0 NtRegisterThreadTerminatePort
        538  211 0009FB10 NtReleaseKeyedEvent
        539  212 0009D160 NtReleaseMutant
        540  213 0009CEA0 NtReleaseSemaphore
        541  214 0009FB30 NtReleaseWorkerFactoryWorker
        542  215 0009CE80 NtRemoveIoCompletion
        543  216 0009FB50 NtRemoveIoCompletionEx
        544  217 0009FB70 NtRemoveProcessDebug
        545  218 0009FB90 NtRenameKey
        546  219 0009FBB0 NtRenameTransactionManager
        547  21A 0009FBD0 NtReplaceKey
        548  21B 0009FBF0 NtReplacePartitionUnit
        549  21C 0009CEE0 NtReplyPort
        550  21D 0009CEC0 NtReplyWaitReceivePort
        551  21E 0009D2C0 NtReplyWaitReceivePortEx
        552  21F 0009FC10 NtReplyWaitReplyPort
        553  220 0009FC30 NtRequestPort
        554  221 0009D1A0 NtRequestWaitReplyPort
        555  222 0009FC50 NtResetEvent
        556  223 0009FC70 NtResetWriteWatch
        557  224 0009FC90 NtRestoreKey
        558  225 0009FCB0 NtResumeProcess
        559  226 0009D7A0 NtResumeThread
        560  227 0009FCD0 NtRevertContainerImpersonation
        561  228 0009FCF0 NtRollbackComplete
        562  229 0009FD10 NtRollbackEnlistment
        563  22A 0009FD30 NtRollbackRegistryTransaction
        564  22B 0009FD50 NtRollbackTransaction
        565  22C 0009FD70 NtRollforwardTransactionManager
        566  22D 0009FD90 NtSaveKey
        567  22E 0009FDB0 NtSaveKeyEx
        568  22F 0009FDD0 NtSaveMergedKeys
        569  230 0009FDF0 NtSecureConnectPort
        570  231 0009FE10 NtSerializeBoot
        571  232 0009FE30 NtSetBootEntryOrder
        572  233 0009FE50 NtSetBootOptions
        573  234 0009FE70 NtSetCachedSigningLevel
        574  235 0009FE90 NtSetCachedSigningLevel2
        575  236 0009FEB0 NtSetContextThread
        576  237 0009FED0 NtSetDebugFilterState
        577  238 0009FEF0 NtSetDefaultHardErrorPort
        578  239 0009FF10 NtSetDefaultLocale
        579  23A 0009FF30 NtSetDefaultUILanguage
        580  23B 0009FF50 NtSetDriverEntryOrder
        581  23C 0009FF70 NtSetEaFile
        582  23D 0009CF20 NtSetEvent
        583  23E 0009D300 NtSetEventBoostPriority
        584  23F 0009FF90 NtSetHighEventPair
        585  240 0009FFB0 NtSetHighWaitLowEventPair
        586  241 0009FFD0 NtSetIRTimer
        587  242 0009FFF0 NtSetInformationDebugObject
        588  243 000A0010 NtSetInformationEnlistment
        589  244 0009D240 NtSetInformationFile
        590  245 000A0030 NtSetInformationJobObject
        591  246 000A0050 NtSetInformationKey
        592  247 0009D8D0 NtSetInformationObject
        593  248 0009D0E0 NtSetInformationProcess
        594  249 000A0070 NtSetInformationResourceManager
        595  24A 000A0090 NtSetInformationSymbolicLink
        596  24B 0009CF00 NtSetInformationThread
        597  24C 000A00B0 NtSetInformationToken
        598  24D 000A00D0 NtSetInformationTransaction
        599  24E 000A00F0 NtSetInformationTransactionManager
        600  24F 000A0110 NtSetInformationVirtualMemory
        601  250 000A0130 NtSetInformationWorkerFactory
        602  251 000A0150 NtSetIntervalProfile
        603  252 000A0170 NtSetIoCompletion
        604  253 000A0190 NtSetIoCompletionEx
        605  254 000A01B0 NtSetLdtEntries
        606  255 000A01D0 NtSetLowEventPair
        607  256 000A01F0 NtSetLowWaitHighEventPair
        608  257 000A0210 NtSetQuotaInformationFile
        609  258 000A0230 NtSetSecurityObject
        610  259 000A0250 NtSetSystemEnvironmentValue
        611  25A 000A0270 NtSetSystemEnvironmentValueEx
        612  25B 000A0290 NtSetSystemInformation
        613  25C 000A02B0 NtSetSystemPowerState
        614  25D 000A02D0 NtSetSystemTime
        615  25E 000A02F0 NtSetThreadExecutionState
        616  25F 0009D990 NtSetTimer
        617  260 000A0310 NtSetTimer2
        618  261 000A0330 NtSetTimerEx
        619  262 000A0350 NtSetTimerResolution
        620  263 000A0370 NtSetUuidSeed
        621  264 0009D950 NtSetValueKey
        622  265 000A0390 NtSetVolumeInformationFile
        623  266 000A03B0 NtSetWnfProcessNotificationEvent
        624  267 000A03D0 NtShutdownSystem
        625  268 000A03F0 NtShutdownWorkerFactory
        626  269 000A0410 NtSignalAndWaitForSingleObject
        627  26A 000A0430 NtSinglePhaseReject
        628  26B 000A0450 NtStartProfile
        629  26C 000A0470 NtStopProfile
        630  26D 000A0490 NtSubscribeWnfStateChange
        631  26E 000A04B0 NtSuspendProcess
        632  26F 000A04D0 NtSuspendThread
        633  270 000A04F0 NtSystemDebugControl
        634  271 000A0510 NtTerminateEnclave
        635  272 000A0530 NtTerminateJobObject
        636  273 0009D2E0 NtTerminateProcess
        637  274 0009D7C0 NtTerminateThread
        638  275 000A0550 NtTestAlert
        639  276 000A0570 NtThawRegistry
        640  277 000A0590 NtThawTransactions
        641  278 000A05B0 NtTraceControl
        642  279 0009D910 NtTraceEvent
        643  27A 000A05D0 NtTranslateFilePath
        644  27B 000A05F0 NtUmsThreadYield
        645  27C 000A0610 NtUnloadDriver
        646  27D 000A0630 NtUnloadKey
        647  27E 000A0650 NtUnloadKey2
        648  27F 000A0670 NtUnloadKeyEx
        649  280 000A0690 NtUnlockFile
        650  281 000A06B0 NtUnlockVirtualMemory
        651  282 0009D2A0 NtUnmapViewOfSection
        652  283 000A06D0 NtUnmapViewOfSectionEx
        653  284 000A06F0 NtUnsubscribeWnfStateChange
        654  285 000A0710 NtUpdateWnfStateData
        655  286 000A0730 NtVdmControl
        656  287 000A0750 NtWaitForAlertByThreadId
        657  288 000A0770 NtWaitForDebugEvent
        658  289 000A0790 NtWaitForKeyedEvent
        659  28A 0009D8B0 NtWaitForMultipleObjects
        660  28B 0009D0A0 NtWaitForMultipleObjects32
        661  28C 0009CDE0 NtWaitForSingleObject
        662  28D 000A07B0 NtWaitForWorkViaWorkerFactory
        663  28E 000A07D0 NtWaitHighEventPair
        664  28F 000A07F0 NtWaitLowEventPair
        665  290 0009CD80 NtWorkerFactoryWorkerReady
        666  291 0009CE60 NtWriteFile
        667  292 0009D0C0 NtWriteFileGather
        668  293 0009D840 NtWriteRequestData
        669  294 0009D4A0 NtWriteVirtualMemory
        670  295 0009D620 NtYieldExecution
        671  296 0009CA30 NtdllDefWindowProc_A
        672  297 0009CA40 NtdllDefWindowProc_W
        673  298 0009CAF0 NtdllDialogWndProc_A
        674  299 0009CB00 NtdllDialogWndProc_W
        675  29A 000E5D50 PfxFindPrefix
        676  29B 000E5E30 PfxInitialize
        677  29C 000E5E50 PfxInsertPrefix
        678  29D 000E5F70 PfxRemovePrefix
        679  29E 00113940 PssNtCaptureSnapshot
        680  29F 00113E10 PssNtDuplicateSnapshot
        681  2A0 00113E90 PssNtFreeRemoteSnapshot
        682  2A1 001140A0 PssNtFreeSnapshot
        683  2A2 00114230 PssNtFreeWalkMarker
        684  2A3 00114260 PssNtQuerySnapshot
        685  2A4 00114510 PssNtValidateDescriptor
        686  2A5 001146A0 PssNtWalkSnapshot
        687  2A6 0007FF50 RtlAbortRXact
        688  2A7 0006D160 RtlAbsoluteToSelfRelativeSD
        689  2A8 00079980 RtlAcquirePebLock
        690  2A9 00077070 RtlAcquirePrivilege
        691  2AA 0007E780 RtlAcquireReleaseSRWLockExclusive
        692  2AB 00064AD0 RtlAcquireResourceExclusive
        693  2AC 000649B0 RtlAcquireResourceShared
        694  2AD 000290A0 RtlAcquireSRWLockExclusive
        695  2AE 00021760 RtlAcquireSRWLockShared
        696  2AF 00072250 RtlActivateActivationContext
        697  2B0 000722A0 RtlActivateActivationContextEx
        698  2B1 00019900 RtlActivateActivationContextUnsafeFast
        699  2B2 00077770 RtlAddAccessAllowedAce
        700  2B3 00078EC0 RtlAddAccessAllowedAceEx
        701  2B4 000E9100 RtlAddAccessAllowedObjectAce
        702  2B5 0008BB90 RtlAddAccessDeniedAce
        703  2B6 000857A0 RtlAddAccessDeniedAceEx
        704  2B7 000E9160 RtlAddAccessDeniedObjectAce
        705  2B8 000E91C0 RtlAddAccessFilterAce
        706  2B9 00066B60 RtlAddAce
        707  2BA 0008A760 RtlAddActionToRXact
        708  2BB 0004C420 RtlAddAtomToAtomTable
        709  2BC 00081110 RtlAddAttributeActionToRXact
        710  2BD 0008B1F0 RtlAddAuditAccessAce
        711  2BE 0008A890 RtlAddAuditAccessAceEx
        712  2BF 000E93D0 RtlAddAuditAccessObjectAce
        713  2C0 000E9440 RtlAddCompoundAce
        714  2C1 00067AC0 RtlAddFunctionTable
        715  2C2 00068610 RtlAddGrowableFunctionTable
        716  2C3 000EAEA0 RtlAddIntegrityLabelToBoundaryDescriptor
        717  2C4 00067180 RtlAddMandatoryAce
        718  2C5 000666F0 RtlAddProcessTrustLabelAce
        719  2C6 000134C0 RtlAddRefActivationContext
        720  2C7 000842D0 RtlAddRefMemoryStream
        721  2C8 000E95B0 RtlAddResourceAttributeAce
        722  2C9 0007F620 RtlAddSIDToBoundaryDescriptor
        723  2CA 000E9900 RtlAddScopedPolicyIDAce
        724  2CB 000D9560 RtlAddVectoredContinueHandler
        725  2CC 00081670 RtlAddVectoredExceptionHandler
        726  2CD 00076E60 RtlAddressInSectionTable
        727  2CE 000790D0 RtlAdjustPrivilege
        728  2CF 00070730 RtlAllocateActivationContextStack
        729  2D0 0006D810 RtlAllocateAndInitializeSid
        730  2D1 0008B130 RtlAllocateAndInitializeSidEx
        731  2D2 0004CA60 RtlAllocateHandle
        732  2D3 0002A9A0 RtlAllocateHeap
        733  2D4 0011B010 RtlAllocateMemoryBlockLookaside
        734  2D5 0011B130 RtlAllocateMemoryZone
        735  2D6 00084460 RtlAllocateWnfSerializationGroup
        736  2D7 000613A0 RtlAnsiCharToUnicodeChar
        737  2D8 00016DE0 RtlAnsiStringToUnicodeSize
        738  2D9 00019580 RtlAnsiStringToUnicodeString
        739  2DA 000EB380 RtlAppendAsciizToString
        740  2DB 000CBFB0 RtlAppendPathElement
        741  2DC 000EB3F0 RtlAppendStringToString
        742  2DD 00017270 RtlAppendUnicodeStringToString
        743  2DE 00037990 RtlAppendUnicodeToString
        744  2DF 000DBDC0 RtlApplicationVerifierStop
        745  2E0 000E6040 RtlApplyRXact
        746  2E1 0007FF20 RtlApplyRXactNoFlush
        747  2E2 000CBB40 RtlAppxIsFileOwnedByTrustedInstaller
        748  2E3 0007C230 RtlAreAllAccessesGranted
        749  2E4 000E60F0 RtlAreAnyAccessesGranted
        750  2E5 000EB4C0 RtlAreBitsClear
        751  2E6 000EB580 RtlAreBitsClearEx
        752  2E7 0007AE00 RtlAreBitsSet
        753  2E8 000751A0 RtlAreLongPathsEnabled
        754  2E9 000ED490 RtlAssert
        755  2EA 00068810 RtlAvlInsertNodeEx
        756  2EB 00067F60 RtlAvlRemoveNode
        757  2EC 000ED5C0 RtlBarrier
        758  2ED 000ED5D0 RtlBarrierForDelete
        759  2EE 000A0D7B RtlCallEnclaveReturn
        760  2EF 00112BE0 RtlCancelTimer
        761  2F0 0000CF10 RtlCanonicalizeDomainName
        762  2F1 0003FC80 RtlCapabilityCheck
        763  2F2 00088530 RtlCapabilityCheckForSingleSessionSku
        764  2F3 000A0E70 RtlCaptureContext
        765  2F4 000A0FB0 RtlCaptureContext2
        766  2F5 000515A0 RtlCaptureStackBackTrace
        767  2F6 00075A50 RtlCharToInteger
        768  2F7 000ED950 RtlCheckBootStatusIntegrity
        769  2F8 0007D550 RtlCheckForOrphanedCriticalSections
        770  2F9 000842E0 RtlCheckPortableOperatingSystem
        771  2FA 000458D0 RtlCheckRegistryKey
        772  2FB 00085890 RtlCheckSandboxedToken
        773  2FC 000EDAB0 RtlCheckSystemBootStatusIntegrity
        774  2FD 0003C650 RtlCheckTokenCapability
        775  2FE 000E6100 RtlCheckTokenMembership
        776  2FF 00036520 RtlCheckTokenMembershipEx
        777  300 0006ECB0 RtlCleanUpTEBLangLists
        778  301 00077DF0 RtlClearAllBits
        779  302 000EB640 RtlClearAllBitsEx
        780  303 0009C550 RtlClearBit
        781  304 000EB670 RtlClearBitEx
        782  305 0004B790 RtlClearBits
        783  306 000EB680 RtlClearBitsEx
        784  307 000674A0 RtlClearThreadWorkOnBehalfTicket
        785  308 000D5870 RtlCloneMemoryStream
        786  309 000D62A0 RtlCloneUserProcess
        787  30A 000F1BE0 RtlCmDecodeMemIoResource
        788  30B 000F1C50 RtlCmEncodeMemIoResource
        789  30C 000D7210 RtlCommitDebugInfo
        790  30D 000D5870 RtlCommitMemoryStream
        791  30E 000F2050 RtlCompactHeap
        792  30F 000F5420 RtlCompareAltitudes
        793  310 000A16C0 RtlCompareMemory
        794  311 000A1740 RtlCompareMemoryUlong
        795  312 0008B080 RtlCompareString
        796  313 00016090 RtlCompareUnicodeString
        797  314 00015FF0 RtlCompareUnicodeStrings
        798  315 0009B360 RtlCompleteProcessCloning
        799  316 00082790 RtlCompressBuffer
        800  317 00058940 RtlComputeCrc32
        801  318 000E04E0 RtlComputeImportTableHash
        802  319 000D54F0 RtlComputePrivatizedDllName_U
        803  31A 000894D0 RtlConnectToSm
        804  31B 000E4D70 RtlConsoleMultiByteToUnicodeN
        805  31C 000F5830 RtlConstructCrossVmEventPath
        806  31D 000F5830 RtlConstructCrossVmMutexPath
        807  31E 00087D00 RtlContractHashTable
        808  31F 0007A700 RtlConvertDeviceFamilyInfoToString
        809  320 00089F00 RtlConvertExclusiveToShared
        810  321 000EEB70 RtlConvertLCIDToString
        811  322 000852C0 RtlConvertSRWLockExclusiveToShared
        812  323 0007E300 RtlConvertSharedToExclusive
        813  324 00037250 RtlConvertSidToUnicodeString
        814  325 000D67E0 RtlConvertToAutoInheritSecurityObject
        815  326 000EB740 RtlCopyBitMap
        816  327 00050EC0 RtlCopyContext
        817  328 000F59D0 RtlCopyExtendedContext
        818  329 000790C0 RtlCopyLuid
        819  32A 000E6120 RtlCopyLuidAndAttributesArray
        820  32B 00085320 RtlCopyMappedMemory
        821  32C 000A3B40 RtlCopyMemory
        822  32D 000A1770 RtlCopyMemoryNonTemporal
        823  32E 000D5870 RtlCopyMemoryStreamTo
        824  32F 000D5870 RtlCopyOutOfProcessMemoryStreamTo
        825  330 0006CEE0 RtlCopySecurityDescriptor
        826  331 00067300 RtlCopySid
        827  332 000E6150 RtlCopySidAndAttributesArray
        828  333 000853B0 RtlCopyString
        829  334 000102F0 RtlCopyUnicodeString
        830  335 0007E8F0 RtlCrc32
        831  336 000F6140 RtlCrc64
        832  337 0003A450 RtlCreateAcl
        833  338 00072D50 RtlCreateActivationContext
        834  339 00066880 RtlCreateAndSetSD
        835  33A 0004CC70 RtlCreateAtomTable
        836  33B 000EDB10 RtlCreateBootStatusDataFile
        837  33C 00081E70 RtlCreateBoundaryDescriptor
        838  33D 0004DE90 RtlCreateEnvironment
        839  33E 0004DF00 RtlCreateEnvironmentEx
        840  33F 000732A0 RtlCreateHashTable
        841  340 0008A880 RtlCreateHashTableEx
        842  341 0000A8B0 RtlCreateHeap
        843  342 0007A480 RtlCreateMemoryBlockLookaside
        844  343 0007A650 RtlCreateMemoryZone
        845  344 000D6530 RtlCreateProcessParameters
        846  345 0004D530 RtlCreateProcessParametersEx
        847  346 0004D5A0 RtlCreateProcessParametersWithTemplate
        848  347 000D59A0 RtlCreateProcessReflection
        849  348 000D7220 RtlCreateQueryDebugBuffer
        850  349 000EE380 RtlCreateRegistryKey
        851  34A 0003C950 RtlCreateSecurityDescriptor
        852  34B 0003FA70 RtlCreateServiceSid
        853  34C 00087D40 RtlCreateSystemVolumeInformationFolder
        854  34D 0007CFC0 RtlCreateTagHeap
        855  34E 00009D50 RtlCreateTimer
        856  34F 00082820 RtlCreateTimerQueue
        857  350 000F6B60 RtlCreateUmsCompletionList
        858  351 000F6C80 RtlCreateUmsThreadContext
        859  352 00038AF0 RtlCreateUnicodeString
        860  353 00016570 RtlCreateUnicodeStringFromAsciiz
        861  354 000E1700 RtlCreateUserFiberShadowStack
        862  355 000E1780 RtlCreateUserProcess
        863  356 00088860 RtlCreateUserProcessEx
        864  357 000D67F0 RtlCreateUserSecurityObject
        865  358 00076200 RtlCreateUserStack
        866  359 00056040 RtlCreateUserThread
        867  35A 00084020 RtlCreateVirtualAccountSid
        868  35B 0003B850 RtlCultureNameToLCID
        869  35C 000E4EE0 RtlCustomCPToUnicodeN
        870  35D 0005AE50 RtlCutoverTimeToSystemTime
        871  35E 000D74C0 RtlDeCommitDebugInfo
        872  35F 000D65A0 RtlDeNormalizeProcessParams
        873  360 00070930 RtlDeactivateActivationContext
        874  361 000197B0 RtlDeactivateActivationContextUnsafeFast
        875  362 0007FEC0 RtlDebugPrintTimes
        876  363 00069E10 RtlDecodePointer
        877  364 000DC680 RtlDecodeRemotePointer
        878  365 000835B0 RtlDecodeSystemPointer
        879  366 000F5620 RtlDecompressBuffer
        880  367 0007F7F0 RtlDecompressBufferEx
        881  368 000F56A0 RtlDecompressFragment
        882  369 000D6890 RtlDefaultNpAcl
        883  36A 00065500 RtlDelete
        884  36B 00078670 RtlDeleteAce
        885  36C 0004C120 RtlDeleteAtomFromAtomTable
        886  36D 000ED5E0 RtlDeleteBarrier
        887  36E 00022E70 RtlDeleteBoundaryDescriptor
        888  36F 00010FC0 RtlDeleteCriticalSection
        889  370 00065000 RtlDeleteElementGenericTable
        890  371 0005B7A0 RtlDeleteElementGenericTableAvl
        891  372 0005B7E0 RtlDeleteElementGenericTableAvlEx
        892  373 000678E0 RtlDeleteFunctionTable
        893  374 00067DB0 RtlDeleteGrowableFunctionTable
        894  375 0007AE40 RtlDeleteHashTable
        895  376 000655A0 RtlDeleteNoSplay
        896  377 0008BE20 RtlDeleteRegistryValue
        897  378 00010F30 RtlDeleteResource
        898  379 0007D640 RtlDeleteSecurityObject
        899  37A 00009C00 RtlDeleteTimer
        900  37B 00112BF0 RtlDeleteTimerQueue
        901  37C 00084910 RtlDeleteTimerQueueEx
        902  37D 000F6D90 RtlDeleteUmsCompletionList
        903  37E 000F6DF0 RtlDeleteUmsThreadContext
        904  37F 000F6E50 RtlDequeueUmsCompletionListItems
        905  380 000F7810 RtlDeregisterSecureMemoryCacheCallback
        906  381 00085850 RtlDeregisterWait
        907  382 0000B5B0 RtlDeregisterWaitEx
        908  383 0001FD40 RtlDeriveCapabilitySidsFromName
        909  384 0008A620 RtlDestroyAtomTable
        910  385 0007D690 RtlDestroyEnvironment
        911  386 000854C0 RtlDestroyHandleTable
        912  387 00009680 RtlDestroyHeap
        913  388 00084F40 RtlDestroyMemoryBlockLookaside
        914  389 00084FA0 RtlDestroyMemoryZone
        915  38A 0007D690 RtlDestroyProcessParameters
        916  38B 000D74D0 RtlDestroyQueryDebugBuffer
        917  38C 00060190 RtlDetectHeapLeaks
        918  38D 00076180 RtlDetermineDosPathNameType_U
        919  38E 000CBCB0 RtlDisableThreadProfiling
        920  38F 0007F950 RtlDisownModuleHeapAllocation
        921  390 00063330 RtlDllShutdownInProgress
        922  391 00060A20 RtlDnsHostNameToComputerName
        923  392 00085B10 RtlDoesFileExists_U
        924  393 000FB1B0 RtlDoesNameContainWildCards
        925  394 0001A9E0 RtlDosApplyFileIsolationRedirection_Ustr
        926  395 000CC200 RtlDosLongPathNameToNtPathName_U_WithStatus
        927  396 000CC230 RtlDosLongPathNameToRelativeNtPathName_U_WithStatus
        928  397 00017310 RtlDosPathNameToNtPathName_U
        929  398 00016BE0 RtlDosPathNameToNtPathName_U_WithStatus
        930  399 00016B80 RtlDosPathNameToRelativeNtPathName_U
        931  39A 0001AEE0 RtlDosPathNameToRelativeNtPathName_U_WithStatus
        932  39B 00088D90 RtlDosSearchPath_U
        933  39C 00019C40 RtlDosSearchPath_Ustr
        934  39D 000EAFF0 RtlDowncaseUnicodeChar
        935  39E 0007BC60 RtlDowncaseUnicodeString
        936  39F 000FB9D0 RtlDrainNonVolatileFlush
        937  3A0 000E8A80 RtlDumpResource
        938  3A1 00078D30 RtlDuplicateUnicodeString
        939  3A2 0008A6E0 RtlEmptyAtomTable
        940  3A3 000E8AD0 RtlEnableEarlyCriticalSectionEventCreation
        941  3A4 000CBD20 RtlEnableThreadProfiling
        942  3A5 000A0CA0 RtlEnclaveCallDispatch
        943  3A6 000A0CD1 RtlEnclaveCallDispatchReturn
        944  3A7 00071E30 RtlEncodePointer
        945  3A8 000DC6F0 RtlEncodeRemotePointer
        946  3A9 00085130 RtlEncodeSystemPointer
        947  3AA 00081000 RtlEndEnumerationHashTable
        948  3AB 0007FEC0 RtlEndStrongEnumerationHashTable
        949  3AC 000F59A0 RtlEndWeakEnumerationHashTable
        950  3AD 0002FAA0 RtlEnterCriticalSection
        951  3AE 000F6EE0 RtlEnterUmsSchedulingMode
        952  3AF 000F21E0 RtlEnumProcessHeaps
        953  3B0 00067740 RtlEnumerateEntryHashTable
        954  3B1 00064F90 RtlEnumerateGenericTable
        955  3B2 00064900 RtlEnumerateGenericTableAvl
        956  3B3 000F75C0 RtlEnumerateGenericTableLikeADirectory
        957  3B4 000657F0 RtlEnumerateGenericTableWithoutSplaying
        958  3B5 00064920 RtlEnumerateGenericTableWithoutSplayingAvl
        959  3B6 000EB000 RtlEqualComputerName
        960  3B7 0000CE90 RtlEqualDomainName
        961  3B8 000E6210 RtlEqualLuid
        962  3B9 00037DE0 RtlEqualPrefixSid
        963  3BA 00038310 RtlEqualSid
        964  3BB 00060980 RtlEqualString
        965  3BC 00020D10 RtlEqualUnicodeString
        966  3BD 00085700 RtlEqualWnfChangeStamps
        967  3BE 00085B70 RtlEraseUnicodeString
        968  3BF 000FBB20 RtlEthernetAddressToStringA
        969  3C0 000FBB90 RtlEthernetAddressToStringW
        970  3C1 000FBC00 RtlEthernetStringToAddressA
        971  3C2 000FBD40 RtlEthernetStringToAddressW
        972  3C3 000F6FC0 RtlExecuteUmsThread
        973  3C4 0005D980 RtlExitUserProcess
        974  3C5 000545F0 RtlExitUserThread
        975  3C6 00015630 RtlExpandEnvironmentStrings
        976  3C7 00076CF0 RtlExpandEnvironmentStrings_U
        977  3C8 00088590 RtlExpandHashTable
        978  3C9 00083730 RtlExtendCorrelationVector
        979  3CA 00001A60 RtlExtendMemoryBlockLookaside
        980  3CB 00001A70 RtlExtendMemoryZone
        981  3CC 000EB950 RtlExtractBitMap
        982  3CD 000FBFE0 RtlFillMemory
        983  3CE 000A18B0 RtlFillMemoryNonTemporal
        984  3CF 000FC000 RtlFillNonVolatileMemory
        985  3D0 0007FEC0 RtlFinalReleaseOutOfProcessMemoryStream
        986  3D1 0003C040 RtlFindAceByType
        987  3D2 0001CD80 RtlFindActivationContextSectionGuid
        988  3D3 0001C6C0 RtlFindActivationContextSectionString
        989  3D4 0001D390 RtlFindCharInUnicodeString
        990  3D5 00085E40 RtlFindClearBits
        991  3D6 00048660 RtlFindClearBitsAndSet
        992  3D7 000EBAF0 RtlFindClearBitsEx
        993  3D8 000EBDF0 RtlFindClearRuns
        994  3D9 000F1D40 RtlFindClosestEncodableLength
        995  3DA 00079B80 RtlFindExportedRoutineByName
        996  3DB 00052570 RtlFindLastBackwardRunClear
        997  3DC 00085390 RtlFindLeastSignificantBit
        998  3DD 000EC0D0 RtlFindLongestRunClear
        999  3DE 00068F00 RtlFindMessage
       1000  3DF 00085480 RtlFindMostSignificantBit
       1001  3E0 00085D10 RtlFindNextForwardRunClear
       1002  3E1 000899D0 RtlFindSetBits
       1003  3E2 000EC110 RtlFindSetBitsAndClear
       1004  3E3 000EC4B0 RtlFindSetBitsAndClearEx
       1005  3E4 000EC830 RtlFindSetBitsEx
       1006  3E5 00087110 RtlFindUnicodeSubstring
       1007  3E6 000A08E0 RtlFirstEntrySList
       1008  3E7 00037710 RtlFirstFreeAce
       1009  3E8 00074750 RtlFlsAlloc
       1010  3E9 00073560 RtlFlsFree
       1011  3EA 00052500 RtlFlsGetValue
       1012  3EB 0004CDA0 RtlFlsSetValue
       1013  3EC 00073E70 RtlFlushHeaps
       1014  3ED 000FBA00 RtlFlushNonVolatileMemory
       1015  3EE 000FC0B0 RtlFlushNonVolatileMemoryRanges
       1016  3EF 000F78D0 RtlFlushSecureMemoryCache
       1017  3F0 00036C40 RtlFormatCurrentUserKeyPath
       1018  3F1 000FC2A0 RtlFormatMessage
       1019  3F2 00065C30 RtlFormatMessageEx
       1020  3F3 000707F0 RtlFreeActivationContextStack
       1021  3F4 00016760 RtlFreeAnsiString
       1022  3F5 0004CCE0 RtlFreeHandle
       1023  3F6 00024760 RtlFreeHeap
       1024  3F7 0011B190 RtlFreeMemoryBlockLookaside
       1025  3F8 000FC140 RtlFreeNonVolatileToken
       1026  3F9 0008AA60 RtlFreeOemString
       1027  3FA 00075090 RtlFreeSid
       1028  3FB 000707B0 RtlFreeThreadActivationContextStack
       1029  3FC 00016760 RtlFreeUTF8String
       1030  3FD 00016760 RtlFreeUnicodeString
       1031  3FE 000E1810 RtlFreeUserFiberShadowStack
       1032  3FF 0007F5E0 RtlFreeUserStack
       1033  400 00069980 RtlGUIDFromString
       1034  401 000FC490 RtlGenerate8dot3Name
       1035  402 000710E0 RtlGetAce
       1036  403 0006B4C0 RtlGetActiveActivationContext
       1037  404 00083970 RtlGetActiveConsoleId
       1038  405 00043ED0 RtlGetAppContainerNamedObjectPath
       1039  406 00043E00 RtlGetAppContainerParent
       1040  407 00044670 RtlGetAppContainerSidType
       1041  408 000ED720 RtlGetCallersAddress
       1042  409 00080880 RtlGetCompressionWorkSpaceSize
       1043  40A 000FCBA0 RtlGetConsoleSessionForegroundProcessId
       1044  40B 00079C90 RtlGetControlSecurityDescriptor
       1045  40C 000E8B00 RtlGetCriticalSectionRecursionCount
       1046  40D 0005D240 RtlGetCurrentDirectory_U
       1047  40E 000FCBE0 RtlGetCurrentPeb
       1048  40F 000A19B0 RtlGetCurrentProcessorNumber
       1049  410 000A19F0 RtlGetCurrentProcessorNumberEx
       1050  411 00024850 RtlGetCurrentServiceSessionId
       1051  412 0006DAC0 RtlGetCurrentTransaction
       1052  413 00058990 RtlGetCurrentUmsThread
       1053  414 00070C40 RtlGetDaclSecurityDescriptor
       1054  415 0003F840 RtlGetDeviceFamilyInfoEnum
       1055  416 0007E680 RtlGetElementGenericTable
       1056  417 000F76F0 RtlGetElementGenericTableAvl
       1057  418 00081B60 RtlGetEnabledExtendedFeatures
       1058  419 000822A0 RtlGetExePath
       1059  41A 00051BB0 RtlGetExtendedContextLength
       1060  41B 00051D60 RtlGetExtendedContextLength2
       1061  41C 000F59F0 RtlGetExtendedFeaturesMask
       1062  41D 000468E0 RtlGetFileMUIPath
       1063  41E 000CD990 RtlGetFrame
       1064  41F 000812C0 RtlGetFullPathName_U
       1065  420 0001D800 RtlGetFullPathName_UEx
       1066  421 0001D890 RtlGetFullPathName_UstrEx
       1067  422 000E09B0 RtlGetFunctionTableListHead
       1068  423 00079940 RtlGetGroupSecurityDescriptor
       1069  424 0004C8C0 RtlGetIntegerAtom
       1070  425 00043D50 RtlGetInterruptTimePrecise
       1071  426 0007C570 RtlGetLastNtStatus
       1072  427 000019F0 RtlGetLastWin32Error
       1073  428 000777A0 RtlGetLengthWithoutLastFullDosOrNtPathElement
       1074  429 00085960 RtlGetLengthWithoutTrailingPathSeperators
       1075  42A 0007C780 RtlGetLocaleFileMappingAddress
       1076  42B 00085710 RtlGetLongestNtPathLength
       1077  42C 000E58A0 RtlGetMultiTimePrecise
       1078  42D 0009D420 RtlGetNativeSystemInformation
       1079  42E 00082260 RtlGetNextEntryHashTable
       1080  42F 000F71C0 RtlGetNextUmsListItem
       1081  430 000FC160 RtlGetNonVolatileToken
       1082  431 0009C5A0 RtlGetNtGlobalFlags
       1083  432 0003CBA0 RtlGetNtProductType
       1084  433 00016BB0 RtlGetNtSystemRoot
       1085  434 000D4840 RtlGetNtVersionNumbers
       1086  435 000784A0 RtlGetOwnerSecurityDescriptor
       1087  436 0003C490 RtlGetParentLocaleName
       1088  437 00057D70 RtlGetPersistedStateLocation
       1089  438 000F21F0 RtlGetProcessHeaps
       1090  439 0008A430 RtlGetProcessPreferredUILanguages
       1091  43A 0007DD20 RtlGetProductInfo
       1092  43B 000FD560 RtlGetReturnAddressHijackTarget
       1093  43C 00075B10 RtlGetSaclSecurityDescriptor
       1094  43D 00083920 RtlGetSearchPath
       1095  43E 00085910 RtlGetSecurityDescriptorRMControl
       1096  43F 000E6230 RtlGetSessionProperties
       1097  440 000EDC70 RtlGetSetBootStatusData
       1098  441 0003CC00 RtlGetSuiteMask
       1099  442 0008B800 RtlGetSystemBootStatus
       1100  443 000EDDD0 RtlGetSystemBootStatusEx
       1101  444 00075E90 RtlGetSystemPreferredUILanguages
       1102  445 0009C430 RtlGetSystemTimeAndBias
       1103  446 00040090 RtlGetSystemTimePrecise
       1104  447 00060620 RtlGetThreadErrorMode
       1105  448 000EEC70 RtlGetThreadLangIdByIndex
       1106  449 00035CA0 RtlGetThreadPreferredUILanguages
       1107  44A 0006B5B0 RtlGetThreadWorkOnBehalfTicket
       1108  44B 000458B0 RtlGetTokenNamedObjectPath
       1109  44C 000EED40 RtlGetUILanguageInfo
       1110  44D 000F71F0 RtlGetUmsCompletionListEvent
       1111  44E 000CE5A0 RtlGetUnloadEventTrace
       1112  44F 000CE5B0 RtlGetUnloadEventTraceEx
       1113  450 00001BC0 RtlGetUserInfoHeap
       1114  451 0007BFA0 RtlGetUserPreferredUILanguages
       1115  452 0003E4D0 RtlGetVersion
       1116  453 000E09C0 RtlGrowFunctionTable
       1117  454 0006DDB0 RtlGuardCheckLongJumpTarget
       1118  455 0001CCB0 RtlHashUnicodeString
       1119  456 000FD790 RtlHeapTrkInitialize
       1120  457 000793F0 RtlIdentifierAuthoritySid
       1121  458 0000D0C0 RtlIdnToAscii
       1122  459 000FEBE0 RtlIdnToNameprepUnicode
       1123  45A 0000C6F0 RtlIdnToUnicode
       1124  45B 0007D8C0 RtlImageDirectoryEntryToData
       1125  45C 00035BD0 RtlImageNtHeader
       1126  45D 00032AD0 RtlImageNtHeaderEx
       1127  45E 00033AA0 RtlImageRvaToSection
       1128  45F 00086860 RtlImageRvaToVa
       1129  460 000772E0 RtlImpersonateSelf
       1130  461 000772F0 RtlImpersonateSelfEx
       1131  462 000837C0 RtlIncrementCorrelationVector
       1132  463 000152F0 RtlInitAnsiString
       1133  464 00016530 RtlInitAnsiStringEx
       1134  465 000ED610 RtlInitBarrier
       1135  466 000E5040 RtlInitCodePageTable
       1136  467 00067510 RtlInitEnumerationHashTable
       1137  468 0007FEC0 RtlInitMemoryStream
       1138  469 000E5140 RtlInitNlsTables
       1139  46A 0007FEC0 RtlInitOutOfProcessMemoryStream
       1140  46B 000152F0 RtlInitString
       1141  46C 000EB450 RtlInitStringEx
       1142  46D 00067580 RtlInitStrongEnumerationHashTable
       1143  46E 00085950 RtlInitUTF8String
       1144  46F 000EB450 RtlInitUTF8StringEx
       1145  470 0003BA40 RtlInitUnicodeString
       1146  471 0001C270 RtlInitUnicodeStringEx
       1147  472 000F59B0 RtlInitWeakEnumerationHashTable
       1148  473 000842D0 RtlInitializeAtomPackage
       1149  474 0007B220 RtlInitializeBitMap
       1150  475 0009C560 RtlInitializeBitMapEx
       1151  476 00069E60 RtlInitializeConditionVariable
       1152  477 000FEC20 RtlInitializeContext
       1153  478 000855A0 RtlInitializeCorrelationVector
       1154  479 00061460 RtlInitializeCriticalSection
       1155  47A 00064830 RtlInitializeCriticalSectionAndSpinCount
       1156  47B 00020BC0 RtlInitializeCriticalSectionEx
       1157  47C 00051C00 RtlInitializeExtendedContext
       1158  47D 00051F90 RtlInitializeExtendedContext2
       1159  47E 0007D910 RtlInitializeGenericTable
       1160  47F 0007DCC0 RtlInitializeGenericTableAvl
       1161  480 0007F910 RtlInitializeHandleTable
       1162  481 0008BF80 RtlInitializeNtUserPfn
       1163  482 0008B460 RtlInitializeRXact
       1164  483 000112E0 RtlInitializeResource
       1165  484 0006EA90 RtlInitializeSListHead
       1166  485 00069E60 RtlInitializeSRWLock
       1167  486 00040060 RtlInitializeSid
       1168  487 00040000 RtlInitializeSidEx
       1169  488 00065090 RtlInsertElementGenericTable
       1170  489 0005B9D0 RtlInsertElementGenericTableAvl
       1171  48A 00065100 RtlInsertElementGenericTableFull
       1172  48B 0005BA40 RtlInsertElementGenericTableFullAvl
       1173  48C 000675C0 RtlInsertEntryHashTable
       1174  48D 00068300 RtlInstallFunctionTableCallback
       1175  48E 000ED780 RtlInt64ToUnicodeString
       1176  48F 000163A0 RtlIntegerToChar
       1177  490 000164A0 RtlIntegerToUnicodeString
       1178  491 00079F10 RtlInterlockedClearBitRun
       1179  492 000700A0 RtlInterlockedFlushSList
       1180  493 000A08F0 RtlInterlockedPopEntrySList
       1181  494 00069E50 RtlInterlockedPushEntrySList
       1182  495 000A09A0 RtlInterlockedPushListSList
       1183  496 000FEEE0 RtlInterlockedPushListSListEx
       1184  497 000ECB60 RtlInterlockedSetBitRun
       1185  498 000F1DF0 RtlIoDecodeMemIoResource
       1186  499 000F1E90 RtlIoEncodeMemIoResource
       1187  49A 0007D7A0 RtlIpv4AddressToStringA
       1188  49B 0007D700 RtlIpv4AddressToStringExA
       1189  49C 0007B0F0 RtlIpv4AddressToStringExW
       1190  49D 0007B1C0 RtlIpv4AddressToStringW
       1191  49E 00077C00 RtlIpv4StringToAddressA
       1192  49F 00077B70 RtlIpv4StringToAddressExA
       1193  4A0 0000D5D0 RtlIpv4StringToAddressExW
       1194  4A1 0000D720 RtlIpv4StringToAddressW
       1195  4A2 000775E0 RtlIpv6AddressToStringA
       1196  4A3 000774F0 RtlIpv6AddressToStringExA
       1197  4A4 000658A0 RtlIpv6AddressToStringExW
       1198  4A5 000659E0 RtlIpv6AddressToStringW
       1199  4A6 0007CCA0 RtlIpv6StringToAddressA
       1200  4A7 0007CC00 RtlIpv6StringToAddressExA
       1201  4A8 0000D950 RtlIpv6StringToAddressExW
       1202  4A9 0000DB60 RtlIpv6StringToAddressW
       1203  4AA 000DF970 RtlIsActivationContextActive
       1204  4AB 0003C980 RtlIsCapabilitySid
       1205  4AC 000838F0 RtlIsCloudFilesPlaceholder
       1206  4AD 000E8B30 RtlIsCriticalSectionLocked
       1207  4AE 00014890 RtlIsCriticalSectionLockedByThread
       1208  4AF 00074AD0 RtlIsCurrentProcess
       1209  4B0 000FF030 RtlIsCurrentThread
       1210  4B1 0009B460 RtlIsCurrentThreadAttachExempt
       1211  4B2 00077040 RtlIsDosDeviceName_U
       1212  4B3 00083FC0 RtlIsElevatedRid
       1213  4B4 000791E0 RtlIsGenericTableEmpty
       1214  4B5 000852F0 RtlIsGenericTableEmptyAvl
       1215  4B6 00040200 RtlIsMultiSessionSku
       1216  4B7 00082050 RtlIsMultiUsersInSessionSku
       1217  4B8 000FB200 RtlIsNameInExpression
       1218  4B9 000FB2B0 RtlIsNameInUnUpcasedExpression
       1219  4BA 000FC920 RtlIsNameLegalDOS8Dot3
       1220  4BB 000FF060 RtlIsNonEmptyDirectoryReparsePointAllowed
       1221  4BC 001004E0 RtlIsNormalizedString
       1222  4BD 00083CB0 RtlIsPackageSid
       1223  4BE 00046710 RtlIsParentOfChildAppContainer
       1224  4BF 0007D5F0 RtlIsPartialPlaceholder
       1225  4C0 000FEEF0 RtlIsPartialPlaceholderFileHandle
       1226  4C1 000FEF50 RtlIsPartialPlaceholderFileInfo
       1227  4C2 00010870 RtlIsProcessorFeaturePresent
       1228  4C3 00078480 RtlIsStateSeparationEnabled
       1229  4C4 00064350 RtlIsTextUnicode
       1230  4C5 0007D8F0 RtlIsThreadWithinLoaderCallout
       1231  4C6 000E62E0 RtlIsUntrustedObject
       1232  4C7 0004C9A0 RtlIsValidHandle
       1233  4C8 0004C960 RtlIsValidIndexHandle
       1234  4C9 000FCCC0 RtlIsValidLocaleName
       1235  4CA 00067100 RtlIsValidProcessTrustLabelSid
       1236  4CB 000FF080 RtlIsZeroMemory
       1237  4CC 001005B0 RtlKnownExceptionFilter
       1238  4CD 0003B020 RtlLCIDToCultureName
       1239  4CE 00001010 RtlLargeIntegerToChar
       1240  4CF 0003B2F0 RtlLcidToLocaleName
       1241  4D0 0002F230 RtlLeaveCriticalSection
       1242  4D1 00079FB0 RtlLengthRequiredSid
       1243  4D2 000712E0 RtlLengthSecurityDescriptor
       1244  4D3 0006E0B0 RtlLengthSid
       1245  4D4 00036D50 RtlLengthSidAsUnicodeString
       1246  4D5 00046F50 RtlLoadString
       1247  4D6 000E5AB0 RtlLocalTimeToSystemTime
       1248  4D7 0003BA90 RtlLocaleNameToLcid
       1249  4D8 000F5A10 RtlLocateExtendedFeature
       1250  4D9 00071490 RtlLocateExtendedFeature2
       1251  4DA 00081050 RtlLocateLegacyContext
       1252  4DB 000EDDF0 RtlLockBootStatusData
       1253  4DC 00083480 RtlLockCurrentThread
       1254  4DD 0005E390 RtlLockHeap
       1255  4DE 0005D430 RtlLockMemoryBlockLookaside
       1256  4DF 000D5870 RtlLockMemoryStreamRegion
       1257  4E0 0005D4A0 RtlLockMemoryZone
       1258  4E1 0005D730 RtlLockModuleSection
       1259  4E2 00100D80 RtlLogStackBackTrace
       1260  4E3 0004C640 RtlLookupAtomInAtomTable
       1261  4E4 00065210 RtlLookupElementGenericTable
       1262  4E5 0005BBB0 RtlLookupElementGenericTableAvl
       1263  4E6 000F7520 RtlLookupElementGenericTableFull
       1264  4E7 0005BB70 RtlLookupElementGenericTableFullAvl
       1265  4E8 00067650 RtlLookupEntryHashTable
       1266  4E9 00089F30 RtlLookupFirstMatchingElementGenericTableAvl
       1267  4EA 00032BE0 RtlLookupFunctionEntry
       1268  4EB 0009C2A0 RtlLookupFunctionTable
       1269  4EC 0006D180 RtlMakeSelfRelativeSD
       1270  4ED 00037EA0 RtlMapGenericMask
       1271  4EE 00001A10 RtlMapSecurityErrorToNtStatus
       1272  4EF 000A3B40 RtlMoveMemory
       1273  4F0 0006DAE0 RtlMultiAppendUnicodeStringBuffer
       1274  4F1 0004EB30 RtlMultiByteToUnicodeN
       1275  4F2 00016E10 RtlMultiByteToUnicodeSize
       1276  4F3 000F2640 RtlMultipleAllocateHeap
       1277  4F4 000F26C0 RtlMultipleFreeHeap
       1278  4F5 000D6C60 RtlNewInstanceSecurityObject
       1279  4F6 000D6D90 RtlNewSecurityGrantedAccess
       1280  4F7 00088420 RtlNewSecurityObject
       1281  4F8 00079B10 RtlNewSecurityObjectEx
       1282  4F9 00085C00 RtlNewSecurityObjectWithMultipleInheritance
       1283  4FA 00088C00 RtlNormalizeProcessParams
       1284  4FB 000E6470 RtlNormalizeSecurityDescriptor
       1285  4FC 00080120 RtlNormalizeString
       1286  4FD 00101790 RtlNotifyFeatureUsage
       1287  4FE 000CC260 RtlNtPathNameToDosPathName
       1288  4FF 000507F0 RtlNtStatusToDosError
       1289  500 000758D0 RtlNtStatusToDosErrorNoTeb
       1290  501 0011D430 RtlNtdllName
       1291  502 00083910 RtlNumberGenericTableElements
       1292  503 000819C0 RtlNumberGenericTableElementsAvl
       1293  504 000ECCF0 RtlNumberOfClearBits
       1294  505 000ECD20 RtlNumberOfClearBitsEx
       1295  506 000ECD50 RtlNumberOfClearBitsInRange
       1296  507 00076EA0 RtlNumberOfSetBits
       1297  508 000ECD80 RtlNumberOfSetBitsEx
       1298  509 000ECF20 RtlNumberOfSetBitsInRange
       1299  50A 000854F0 RtlNumberOfSetBitsUlongPtr
       1300  50B 00016DE0 RtlOemStringToUnicodeSize
       1301  50C 00060C80 RtlOemStringToUnicodeString
       1302  50D 00061000 RtlOemToUnicodeN
       1303  50E 00016790 RtlOpenCurrentUser
       1304  50F 00101D00 RtlOsDeploymentState
       1305  510 000E6940 RtlOwnerAcesPresent
       1306  511 00034A40 RtlPcToFileHeader
       1307  512 000EADE0 RtlPinAtomInAtomTable
       1308  513 0006B590 RtlPopFrame
       1309  514 00060B20 RtlPrefixString
       1310  515 00015F60 RtlPrefixUnicodeString
       1311  516 0009B4A0 RtlPrepareForProcessCloning
       1312  517 0005DCA0 RtlProcessFlsData
       1313  518 0000E0E0 RtlProtectHeap
       1314  519 0007CAA0 RtlPublishWnfStateData
       1315  51A 0006A3A0 RtlPushFrame
       1316  51B 00079CC0 RtlQueryActivationContextApplicationSettings
       1317  51C 00101820 RtlQueryAllFeatureConfigurations
       1318  51D 0004C220 RtlQueryAtomInAtomTable
       1319  51E 000E8B50 RtlQueryCriticalSectionOwner
       1320  51F 0006B630 RtlQueryDepthSList
       1321  520 000EE3C0 RtlQueryDynamicTimeZoneInformation
       1322  521 00080F70 RtlQueryElevationFlags
       1323  522 000157E0 RtlQueryEnvironmentVariable
       1324  523 0004DE20 RtlQueryEnvironmentVariable_U
       1325  524 0005CB70 RtlQueryFeatureConfiguration
       1326  525 001018D0 RtlQueryFeatureConfigurationChangeStamp
       1327  526 001018E0 RtlQueryFeatureUsageNotificationSubscriptions
       1328  527 00073E90 RtlQueryHeapInformation
       1329  528 000E18F0 RtlQueryImageMitigationPolicy
       1330  529 00078C90 RtlQueryInformationAcl
       1331  52A 00012DE0 RtlQueryInformationActivationContext
       1332  52B 0007E350 RtlQueryInformationActiveActivationContext
       1333  52C 000D5870 RtlQueryInterfaceMemoryStream
       1334  52D 000E3B30 RtlQueryModuleInformation
       1335  52E 000694E0 RtlQueryPackageClaims
       1336  52F 00069420 RtlQueryPackageIdentity
       1337  530 00069470 RtlQueryPackageIdentityEx
       1338  531 00040150 RtlQueryPerformanceCounter
       1339  532 00071140 RtlQueryPerformanceFrequency
       1340  533 000D7510 RtlQueryProcessBackTraceInformation
       1341  534 000D76A0 RtlQueryProcessDebugInformation
       1342  535 000D7B80 RtlQueryProcessHeapInformation
       1343  536 000D7F60 RtlQueryProcessLockInformation
       1344  537 000FEFB0 RtlQueryProcessPlaceholderCompatibilityMode
       1345  538 000818C0 RtlQueryProtectedPolicy
       1346  539 000EE3D0 RtlQueryRegistryValueWithFallback
       1347  53A 000EE520 RtlQueryRegistryValues
       1348  53B 00084F10 RtlQueryRegistryValuesEx
       1349  53C 000446F0 RtlQueryResourcePolicy
       1350  53D 000D6EC0 RtlQuerySecurityObject
       1351  53E 000F2730 RtlQueryTagHeap
       1352  53F 0007FED0 RtlQueryThreadPlaceholderCompatibilityMode
       1353  540 000CBE20 RtlQueryThreadProfiling
       1354  541 00057AA0 RtlQueryTimeZoneInformation
       1355  542 000832C0 RtlQueryTokenHostIdAsUlong64
       1356  543 000F7250 RtlQueryUmsThreadInformation
       1357  544 0005CDF0 RtlQueryUnbiasedInterruptTime
       1358  545 00101E40 RtlQueryValidationRunlevel
       1359  546 00082C70 RtlQueryWnfMetaNotification
       1360  547 00044F20 RtlQueryWnfStateData
       1361  548 00083BE0 RtlQueryWnfStateDataWithExplicitScope
       1362  549 000DBF50 RtlQueueApcWow64Thread
       1363  54A 0000B780 RtlQueueWorkItem
       1364  54B 00101F00 RtlRaiseCustomSystemEventTrigger
       1365  54C 00051020 RtlRaiseException
       1366  54D 000A1A60 RtlRaiseExceptionForReturnAddressHijack
       1367  54E 000A1640 RtlRaiseNoncontinuableException
       1368  54F 00102310 RtlRaiseStatus
       1369  550 00043C90 RtlRandom
       1370  551 00043C90 RtlRandomEx
       1371  552 00027DC0 RtlRbInsertNodeEx
       1372  553 0002A0A0 RtlRbRemoveNode
       1373  554 00023640 RtlReAllocateHeap
       1374  555 000D5870 RtlReadMemoryStream
       1375  556 000D5870 RtlReadOutOfProcessMemoryStream
       1376  557 000CBE50 RtlReadThreadProfilingData
       1377  558 0007F1B0 RtlRealPredecessor
       1378  559 00065850 RtlRealSuccessor
       1379  55A 000093B0 RtlRegisterFeatureConfigurationChangeNotification
       1380  55B 00063B70 RtlRegisterForWnfMetaNotification
       1381  55C 000F7940 RtlRegisterSecureMemoryCacheCallback
       1382  55D 000544C0 RtlRegisterThreadWithCsrss
       1383  55E 0000BE70 RtlRegisterWait
       1384  55F 00013570 RtlReleaseActivationContext
       1385  560 000842D0 RtlReleaseMemoryStream
       1386  561 00011F80 RtlReleasePath
       1387  562 00077410 RtlReleasePebLock
       1388  563 00080A70 RtlReleasePrivilege
       1389  564 0001A320 RtlReleaseRelativeName
       1390  565 00064C10 RtlReleaseResource
       1391  566 00012C70 RtlReleaseSRWLockExclusive
       1392  567 00021920 RtlReleaseSRWLockShared
       1393  568 000FED50 RtlRemoteCall
       1394  569 0007C240 RtlRemoveEntryHashTable
       1395  56A 00088760 RtlRemovePrivileges
       1396  56B 000D9580 RtlRemoveVectoredContinueHandler
       1397  56C 00082070 RtlRemoveVectoredExceptionHandler
       1398  56D 000E6950 RtlReplaceSidInSd
       1399  56E 00087000 RtlReplaceSystemDirectoryInPath
       1400  56F 000DC890 RtlReportException
       1401  570 000DC960 RtlReportExceptionEx
       1402  571 0005DE40 RtlReportSilentProcessExit
       1403  572 000842D0 RtlReportSqmEscalation
       1404  573 000EAF30 RtlResetMemoryBlockLookaside
       1405  574 000EAF90 RtlResetMemoryZone
       1406  575 0008C0A0 RtlResetNtUserPfn
       1407  576 000E51C0 RtlResetRtlTranslations
       1408  577 000EDE10 RtlRestoreBootStatusDefaults
       1409  578 0006DCA0 RtlRestoreContext
       1410  579 00050770 RtlRestoreLastWin32Error
       1411  57A 000EDF40 RtlRestoreSystemBootStatusDefaults
       1412  57B 000EF1C0 RtlRestoreThreadPreferredUILanguages
       1413  57C 0008C120 RtlRetrieveNtUserPfn
       1414  57D 000D5870 RtlRevertMemoryStream
       1415  57E 000E6C60 RtlRunDecodeUnicodeString
       1416  57F 000E6CC0 RtlRunEncodeUnicodeString
       1417  580 0000A530 RtlRunOnceBeginInitialize
       1418  581 00043AA0 RtlRunOnceComplete
       1419  582 00043820 RtlRunOnceExecuteOnce
       1420  583 00069E60 RtlRunOnceInitialize
       1421  584 00087CC0 RtlSecondsSince1970ToTime
       1422  585 000E5B20 RtlSecondsSince1980ToTime
       1423  586 000D5870 RtlSeekMemoryStream
       1424  587 0006CFA0 RtlSelfRelativeToAbsoluteSD
       1425  588 00088C20 RtlSelfRelativeToAbsoluteSD2
       1426  589 00089810 RtlSendMsgToSm
       1427  58A 0007B010 RtlSetAllBits
       1428  58B 000ED1A0 RtlSetAllBitsEx
       1429  58C 000E6D80 RtlSetAttributesSecurityDescriptor
       1430  58D 00081090 RtlSetBit
       1431  58E 0009C570 RtlSetBitEx
       1432  58F 00048990 RtlSetBits
       1433  590 000ED210 RtlSetBitsEx
       1434  591 0007F880 RtlSetControlSecurityDescriptor
       1435  592 00071510 RtlSetCriticalSectionSpinCount
       1436  593 0005CFE0 RtlSetCurrentDirectory_U
       1437  594 0008BAC0 RtlSetCurrentEnvironment
       1438  595 000692F0 RtlSetCurrentTransaction
       1439  596 0003C8E0 RtlSetDaclSecurityDescriptor
       1440  597 000EE550 RtlSetDynamicTimeZoneInformation
       1441  598 000829D0 RtlSetEnvironmentStrings
       1442  599 0004E110 RtlSetEnvironmentVar
       1443  59A 0004DEB0 RtlSetEnvironmentVariable
       1444  59B 000F5A30 RtlSetExtendedFeaturesMask
       1445  59C 00101960 RtlSetFeatureConfigurations
       1446  59D 00038020 RtlSetGroupSecurityDescriptor
       1447  59E 00073CA0 RtlSetHeapInformation
       1448  59F 000E2350 RtlSetImageMitigationPolicy
       1449  5A0 000E9B80 RtlSetInformationAcl
       1450  5A1 00112C10 RtlSetIoCompletionCallback
       1451  5A2 00050770 RtlSetLastWin32Error
       1452  5A3 00050750 RtlSetLastWin32ErrorAndNtStatusFromNtStatus
       1453  5A4 000D5870 RtlSetMemoryStreamSize
       1454  5A5 00038080 RtlSetOwnerSecurityDescriptor
       1455  5A6 000EE330 RtlSetPortableOperatingSystem
       1456  5A7 000D8300 RtlSetProcessDebugInformation
       1457  5A8 0008B9A0 RtlSetProcessIsCritical
       1458  5A9 000FEFD0 RtlSetProcessPlaceholderCompatibilityMode
       1459  5AA 00089670 RtlSetProcessPreferredUILanguages
       1460  5AB 00080B20 RtlSetProtectedPolicy
       1461  5AC 00085A60 RtlSetProxiedProcessId
       1462  5AD 00067340 RtlSetSaclSecurityDescriptor
       1463  5AE 0007F970 RtlSetSearchPathMode
       1464  5AF 00085860 RtlSetSecurityDescriptorRMControl
       1465  5B0 00076660 RtlSetSecurityObject
       1466  5B1 000D71D0 RtlSetSecurityObjectEx
       1467  5B2 000857D0 RtlSetSystemBootStatus
       1468  5B3 000EDF80 RtlSetSystemBootStatusEx
       1469  5B4 0004D320 RtlSetThreadErrorMode
       1470  5B5 00088FC0 RtlSetThreadIsCritical
       1471  5B6 0007CA70 RtlSetThreadPlaceholderCompatibilityMode
       1472  5B7 000842D0 RtlSetThreadPoolStartFunc
       1473  5B8 0003EC40 RtlSetThreadPreferredUILanguages
       1474  5B9 0003EBF0 RtlSetThreadPreferredUILanguages2
       1475  5BA 00020570 RtlSetThreadSubProcessTag
       1476  5BB 00020500 RtlSetThreadWorkOnBehalfTicket
       1477  5BC 000EE560 RtlSetTimeZoneInformation
       1478  5BD 00112C00 RtlSetTimer
       1479  5BE 000F72F0 RtlSetUmsThreadInformation
       1480  5BF 0007F8D0 RtlSetUnhandledExceptionFilter
       1481  5C0 000F2AD0 RtlSetUserFlagsHeap
       1482  5C1 00001F60 RtlSetUserValueHeap
       1483  5C2 0007BB30 RtlSidDominates
       1484  5C3 00067070 RtlSidDominatesForTrust
       1485  5C4 000E6DB0 RtlSidEqualLevel
       1486  5C5 0007BEF0 RtlSidHashInitialize
       1487  5C6 00077A60 RtlSidHashLookup
       1488  5C7 000E6E40 RtlSidIsHigherLevel
       1489  5C8 00024160 RtlSizeHeap
       1490  5C9 00064190 RtlSleepConditionVariableCS
       1491  5CA 00063EF0 RtlSleepConditionVariableSRW
       1492  5CB 000652F0 RtlSplay
       1493  5CC 000810A0 RtlStartRXact
       1494  5CD 000D5870 RtlStatMemoryStream
       1495  5CE 00069A60 RtlStringFromGUID
       1496  5CF 00069A70 RtlStringFromGUIDEx
       1497  5D0 00067810 RtlStronglyEnumerateEntryHashTable
       1498  5D1 000751C0 RtlSubAuthorityCountSid
       1499  5D2 000714F0 RtlSubAuthoritySid
       1500  5D3 00101A60 RtlSubscribeForFeatureUsageNotification
       1501  5D4 00042450 RtlSubscribeWnfStateChangeNotification
       1502  5D5 000657C0 RtlSubtreePredecessor
       1503  5D6 000F74F0 RtlSubtreeSuccessor
       1504  5D7 0003CC30 RtlSwitchedVVI
       1505  5D8 0007D480 RtlSystemTimeToLocalTime
       1506  5D9 00084C80 RtlTestAndPublishWnfStateData
       1507  5DA 000854A0 RtlTestBit
       1508  5DB 0009C580 RtlTestBitEx
       1509  5DC 0008BDD0 RtlTestProtectedAccess
       1510  5DD 0005B010 RtlTimeFieldsToTime
       1511  5DE 0007AB80 RtlTimeToElapsedTimeFields
       1512  5DF 0007AC70 RtlTimeToSecondsSince1970
       1513  5E0 0007AB40 RtlTimeToSecondsSince1980
       1514  5E1 0005B340 RtlTimeToTimeFields
       1515  5E2 001024A0 RtlTraceDatabaseAdd
       1516  5E3 00102520 RtlTraceDatabaseCreate
       1517  5E4 00102660 RtlTraceDatabaseDestroy
       1518  5E5 001026E0 RtlTraceDatabaseEnumerate
       1519  5E6 001027B0 RtlTraceDatabaseFind
       1520  5E7 00102830 RtlTraceDatabaseLock
       1521  5E8 00102860 RtlTraceDatabaseUnlock
       1522  5E9 00102880 RtlTraceDatabaseValidate
       1523  5EA 0007B480 RtlTryAcquirePebLock
       1524  5EB 00081E50 RtlTryAcquireSRWLockExclusive
       1525  5EC 00076C80 RtlTryAcquireSRWLockShared
       1526  5ED 000E8A00 RtlTryConvertSRWLockSharedToExclusiveOrRelease
       1527  5EE 000207E0 RtlTryEnterCriticalSection
       1528  5EF 00059390 RtlUTF8StringToUnicodeString
       1529  5F0 00059460 RtlUTF8ToUnicodeN
       1530  5F1 00102CB0 RtlUdiv128
       1531  5F2 000F7330 RtlUmsThreadYield
       1532  5F3 0009C690 RtlUnhandledExceptionFilter
       1533  5F4 001005D0 RtlUnhandledExceptionFilter2
       1534  5F5 000611D0 RtlUnicodeStringToAnsiSize
       1535  5F6 00061200 RtlUnicodeStringToAnsiString
       1536  5F7 000EB010 RtlUnicodeStringToCountedOemString
       1537  5F8 000754C0 RtlUnicodeStringToInteger
       1538  5F9 000611D0 RtlUnicodeStringToOemSize
       1539  5FA 00060BA0 RtlUnicodeStringToOemString
       1540  5FB 00102BB0 RtlUnicodeStringToUTF8String
       1541  5FC 000E53F0 RtlUnicodeToCustomCPN
       1542  5FD 00061320 RtlUnicodeToMultiByteN
       1543  5FE 000612E0 RtlUnicodeToMultiByteSize
       1544  5FF 00060F60 RtlUnicodeToOemN
       1545  600 0005A9B0 RtlUnicodeToUTF8N
       1546  601 00074A10 RtlUniform
       1547  602 000EDFA0 RtlUnlockBootStatusData
       1548  603 00086BB0 RtlUnlockCurrentThread
       1549  604 0005E430 RtlUnlockHeap
       1550  605 0005CE50 RtlUnlockMemoryBlockLookaside
       1551  606 000D5870 RtlUnlockMemoryStreamRegion
       1552  607 0005CEB0 RtlUnlockMemoryZone
       1553  608 0005D680 RtlUnlockModuleSection
       1554  609 0007EDE0 RtlUnregisterFeatureConfigurationChangeNotification
       1555  60A 00101A70 RtlUnsubscribeFromFeatureUsageNotifications
       1556  60B 00062570 RtlUnsubscribeWnfNotificationWaitForCompletion
       1557  60C 00062360 RtlUnsubscribeWnfNotificationWithCompletionCallback
       1558  60D 00062520 RtlUnsubscribeWnfStateChangeNotification
       1559  60E 00050DC0 RtlUnwind
       1560  60F 00030600 RtlUnwindEx
       1561  610 00059A60 RtlUpcaseUnicodeChar
       1562  611 00015D20 RtlUpcaseUnicodeString
       1563  612 000EB140 RtlUpcaseUnicodeStringToAnsiString
       1564  613 000EB250 RtlUpcaseUnicodeStringToCountedOemString
       1565  614 00060D70 RtlUpcaseUnicodeStringToOemString
       1566  615 000E5520 RtlUpcaseUnicodeToCustomCPN
       1567  616 000610B0 RtlUpcaseUnicodeToMultiByteN
       1568  617 00060F00 RtlUpcaseUnicodeToOemN
       1569  618 0005DFA0 RtlUpdateClonedCriticalSection
       1570  619 0009C530 RtlUpdateClonedSRWLock
       1571  61A 000819D0 RtlUpdateTimer
       1572  61B 00060C60 RtlUpperChar
       1573  61C 000EB460 RtlUpperString
       1574  61D 0007FEF0 RtlUserFiberStart
       1575  61E 00052630 RtlUserThreadStart
       1576  61F 00037760 RtlValidAcl
       1577  620 000E3350 RtlValidProcessProtection
       1578  621 00073B00 RtlValidRelativeSecurityDescriptor
       1579  622 000700B0 RtlValidSecurityDescriptor
       1580  623 00037950 RtlValidSid
       1581  624 000FBE80 RtlValidateCorrelationVector
       1582  625 0005E080 RtlValidateHeap
       1583  626 000F2FB0 RtlValidateProcessHeaps
       1584  627 00078E70 RtlValidateUnicodeString
       1585  628 00079FD0 RtlVerifyVersionInfo
       1586  629 00030DE0 RtlVirtualUnwind
       1587  62A 000623B0 RtlWaitForWnfMetaNotification
       1588  62B 00063350 RtlWaitOnAddress
       1589  62C 00063100 RtlWakeAddressAll
       1590  62D 00102F30 RtlWakeAddressAllNoFence
       1591  62E 00062550 RtlWakeAddressSingle
       1592  62F 00102F40 RtlWakeAddressSingleNoFence
       1593  630 000553D0 RtlWakeAllConditionVariable
       1594  631 00054A60 RtlWakeConditionVariable
       1595  632 00051620 RtlWalkFrameChain
       1596  633 000F30E0 RtlWalkHeap
       1597  634 000F59C0 RtlWeaklyEnumerateEntryHashTable
       1598  635 000DD2A0 RtlWerpReportException
       1599  636 000DE740 RtlWnfCompareChangeStamp
       1600  637 00085A50 RtlWnfDllUnloadCallback
       1601  638 00085940 RtlWow64CallFunction64
       1602  639 00085940 RtlWow64EnableFsRedirection
       1603  63A 00085940 RtlWow64EnableFsRedirectionEx
       1604  63B 00051E80 RtlWow64GetCpuAreaInfo
       1605  63C 00051E00 RtlWow64GetCurrentCpuArea
       1606  63D 00050D80 RtlWow64GetCurrentMachine
       1607  63E 00082CC0 RtlWow64GetEquivalentMachineCHPE
       1608  63F 0007ACF0 RtlWow64GetProcessMachines
       1609  640 00079A30 RtlWow64GetSharedInfoProcess
       1610  641 000DBF70 RtlWow64GetThreadContext
       1611  642 000DBFA0 RtlWow64GetThreadSelectorEntry
       1612  643 0007C590 RtlWow64IsWowGuestMachineSupported
       1613  644 000D6680 RtlWow64LogMessageInEventLogger
       1614  645 00102F50 RtlWow64PopAllCrossProcessWorkFromWorkList
       1615  646 00103060 RtlWow64PopCrossProcessWorkFromFreeList
       1616  647 001030F0 RtlWow64PushCrossProcessWorkOntoFreeList
       1617  648 00103190 RtlWow64PushCrossProcessWorkOntoWorkList
       1618  649 001033A0 RtlWow64RequestCrossProcessHeavyFlush
       1619  64A 000DC140 RtlWow64SetThreadContext
       1620  64B 000DC160 RtlWow64SuspendProcess
       1621  64C 000DC2D0 RtlWow64SuspendThread
       1622  64D 000D5870 RtlWriteMemoryStream
       1623  64E 000FC1E0 RtlWriteNonVolatileMemory
       1624  64F 0008A9C0 RtlWriteRegistryValue
       1625  650 000F6160 RtlZeroHeap
       1626  651 00087CF0 RtlZeroMemory
       1627  652 000DF690 RtlZombifyActivationContext
       1628  653 0007DFA0 RtlpApplyLengthFunction
       1629  654 0007B4A0 RtlpCheckDynamicTimeZoneInformation
       1630  655 000EF8D0 RtlpCleanupRegistryKeys
       1631  656 000E9D50 RtlpConvertAbsoluteToRelativeSecurityAttribute
       1632  657 000EFDC0 RtlpConvertCultureNamesToLCIDs
       1633  658 000EFFD0 RtlpConvertLCIDsToCultureNames
       1634  659 000EA0C0 RtlpConvertRelativeToAbsoluteSecurityAttribute
       1635  65A 00036490 RtlpCreateProcessRegistryInfo
       1636  65B 0006DBF0 RtlpEnsureBufferSize
       1637  65C 000A1AA1 RtlpExecuteUmsThread
       1638  65D 0016B500 RtlpFreezeTimeBias
       1639  65E 0003F850 RtlpGetDeviceFamilyInfoEnum
       1640  65F 00081540 RtlpGetLCIDFromLangInfoNode
       1641  660 0007F750 RtlpGetNameFromLangInfoNode
       1642  661 0003C5B0 RtlpGetSystemDefaultUILanguage
       1643  662 001035E0 RtlpGetUserOrMachineUILanguage4NLS
       1644  663 0006EEC0 RtlpInitializeLangRegistryInfo
       1645  664 00047170 RtlpIsQualifiedLanguage
       1646  665 00081B80 RtlpLoadMachineUIByPolicy
       1647  666 0006EDD0 RtlpLoadUserUIByPolicy
       1648  667 00083D20 RtlpMergeSecurityAttributeInformation
       1649  668 0006EEF0 RtlpMuiFreeLangRegistryInfo
       1650  669 00104290 RtlpMuiRegCreateRegistryInfo
       1651  66A 0006F190 RtlpMuiRegFreeRegistryInfo
       1652  66B 0006F0A0 RtlpMuiRegLoadRegistryInfo
       1653  66C 000E8D70 RtlpNotOwnerCriticalSection
       1654  66D 001079E0 RtlpNtCreateKey
       1655  66E 00081F50 RtlpNtEnumerateSubKey
       1656  66F 00107A20 RtlpNtMakeTemporaryKey
       1657  670 0007D670 RtlpNtOpenKey
       1658  671 0007AEF0 RtlpNtQueryValueKey
       1659  672 00107A30 RtlpNtSetValueKey
       1660  673 00075630 RtlpQueryDefaultUILanguage
       1661  674 000D8B00 RtlpQueryProcessDebugInformationFromWow64
       1662  675 000D8BA0 RtlpQueryProcessDebugInformationRemote
       1663  676 00105D80 RtlpRefreshCachedUILanguage
       1664  677 000F0820 RtlpSetInstallLanguage
       1665  678 000F0ED0 RtlpSetPreferredUILanguages
       1666  679 000F0ED0 RtlpSetUserPreferredUILanguages
       1667  67A 0005B020 RtlpTimeFieldsToTime
       1668  67B 0005B350 RtlpTimeToTimeFields
       1669  67C 000A1DC6 RtlpUmsExecuteYieldThreadEnd
       1670  67D 000A1CD3 RtlpUmsThreadYield
       1671  67E 000E90A0 RtlpUnWaitCriticalSection
       1672  67F 0008B840 RtlpVerifyAndCommitUILanguageSettings
       1673  680 0007FEC0 RtlpWaitForCriticalSection
       1674  681 000868D0 RtlpWow64CtxFromAmd64
       1675  682 0006EAB0 RtlpWow64GetContextOnAmd64
       1676  683 0006E0D0 RtlpWow64SetContextOnAmd64
       1677  684 00016DE0 RtlxAnsiStringToUnicodeSize
       1678  685 00016DE0 RtlxOemStringToUnicodeSize
       1679  686 000611D0 RtlxUnicodeStringToAnsiSize
       1680  687 000611D0 RtlxUnicodeStringToOemSize
       1681  688 00113650 SbExecuteProcedure
       1682  689 0003E0D0 SbSelectProcedure
       1683  68A 000DDD40 ShipAssert
       1684  68B 000DDE60 ShipAssertGetBufferInfo
       1685  68C 000DDE90 ShipAssertMsgA
       1686  68D 000DDE90 ShipAssertMsgW
       1687  68E 000795A0 TpAllocAlpcCompletion
       1688  68F 000796A0 TpAllocAlpcCompletionEx
       1689  690 0007E7B0 TpAllocCleanupGroup
       1690  691 00075B90 TpAllocIoCompletion
       1691  692 0007F400 TpAllocJobNotification
       1692  693 000616F0 TpAllocPool
       1693  694 0000EFD0 TpAllocTimer
       1694  695 0000DF40 TpAllocWait
       1695  696 0000F2E0 TpAllocWork
       1696  697 00079400 TpAlpcRegisterCompletionList
       1697  698 000794F0 TpAlpcUnregisterCompletionList
       1698  699 00111E40 TpCallbackDetectedUnrecoverableError
       1699  69A 000621F0 TpCallbackIndependent
       1700  69B 00088500 TpCallbackLeaveCriticalSectionOnCompletion
       1701  69C 0006FE60 TpCallbackMayRunLong
       1702  69D 00111E70 TpCallbackReleaseMutexOnCompletion
       1703  69E 00111EB0 TpCallbackReleaseSemaphoreOnCompletion
       1704  69F 000673B0 TpCallbackSendAlpcMessageOnCompletion
       1705  6A0 00111EF0 TpCallbackSendPendingAlpcMessage
       1706  6A1 00085440 TpCallbackSetEventOnCompletion
       1707  6A2 0007D6C0 TpCallbackUnloadDllOnCompletion
       1708  6A3 00078AC0 TpCancelAsyncIoOperation
       1709  6A4 000713D0 TpCaptureCaller
       1710  6A5 00054650 TpCheckTerminateWorker
       1711  6A6 00111F30 TpDbgDumpHeapUsage
       1712  6A7 0007FEC0 TpDbgSetLogRoutine
       1713  6A8 000853F0 TpDisablePoolCallbackChecks
       1714  6A9 000800A0 TpDisassociateCallback
       1715  6AA 00012000 TpIsTimerSet
       1716  6AB 000128C0 TpPostWork
       1717  6AC 00111940 TpQueryPoolStackInformation
       1718  6AD 000795D0 TpReleaseAlpcCompletion
       1719  6AE 00081950 TpReleaseCleanupGroup
       1720  6AF 00052680 TpReleaseCleanupGroupMembers
       1721  6B0 0007C2F0 TpReleaseIoCompletion
       1722  6B1 0007F240 TpReleaseJobNotification
       1723  6B2 00054C60 TpReleasePool
       1724  6B3 0000C500 TpReleaseTimer
       1725  6B4 0000C270 TpReleaseWait
       1726  6B5 0000F180 TpReleaseWork
       1727  6B6 00111A00 TpSetDefaultPoolMaxThreads
       1728  6B7 0006F900 TpSetDefaultPoolStackInformation
       1729  6B8 00061620 TpSetPoolMaxThreads
       1730  6B9 00080FB0 TpSetPoolMaxThreadsSoftLimit
       1731  6BA 00083400 TpSetPoolMinThreads
       1732  6BB 0006FA20 TpSetPoolStackInformation
       1733  6BC 00085720 TpSetPoolThreadBasePriority
       1734  6BD 00111B50 TpSetPoolThreadCpuSets
       1735  6BE 00061690 TpSetPoolWorkerThreadIdleTimeout
       1736  6BF 000122A0 TpSetTimer
       1737  6C0 000126D0 TpSetTimerEx
       1738  6C1 00010B90 TpSetWait
       1739  6C2 00011D60 TpSetWaitEx
       1740  6C3 00010BE0 TpSimpleTryPost
       1741  6C4 000127E0 TpStartAsyncIoOperation
       1742  6C5 00009BB0 TpTimerOutstandingCallbackCount
       1743  6C6 00063BD0 TpTrimPools
       1744  6C7 00079530 TpWaitForAlpcCompletion
       1745  6C8 00084D40 TpWaitForIoCompletion
       1746  6C9 0007F200 TpWaitForJobNotification
       1747  6CA 00011200 TpWaitForTimer
       1748  6CB 00009990 TpWaitForWait
       1749  6CC 0007EE60 TpWaitForWork
       1750  6CD 00070540 VerSetConditionMask
       1751  6CE 000DD620 WerReportExceptionWorker
       1752  6CF 000DE340 WerReportSQMEvent
       1753  6D0 0007FEC0 WinSqmAddToAverageDWORD
       1754  6D1 0007FEC0 WinSqmAddToStream
       1755  6D2 0007FEC0 WinSqmAddToStreamEx
       1756  6D3 000842D0 WinSqmCheckEscalationAddToStreamEx
       1757  6D4 000842D0 WinSqmCheckEscalationSetDWORD
       1758  6D5 000842D0 WinSqmCheckEscalationSetDWORD64
       1759  6D6 000842D0 WinSqmCheckEscalationSetString
       1760  6D7 00085CE0 WinSqmCommonDatapointDelete
       1761  6D8 00085CE0 WinSqmCommonDatapointSetDWORD
       1762  6D9 00085CE0 WinSqmCommonDatapointSetDWORD64
       1763  6DA 00085CE0 WinSqmCommonDatapointSetStreamEx
       1764  6DB 00085CE0 WinSqmCommonDatapointSetString
       1765  6DC 0007FEC0 WinSqmEndSession
       1766  6DD 000842D0 WinSqmEventEnabled
       1767  6DE 000842D0 WinSqmEventWrite
       1768  6DF 000842D0 WinSqmGetEscalationRuleStatus
       1769  6E0 000DE720 WinSqmGetInstrumentationProperty
       1770  6E1 0007FEC0 WinSqmIncrementDWORD
       1771  6E2 000842D0 WinSqmIsOptedIn
       1772  6E3 000842D0 WinSqmIsOptedInEx
       1773  6E4 00085CE0 WinSqmIsSessionDisabled
       1774  6E5 0007FEC0 WinSqmSetDWORD
       1775  6E6 0007FEC0 WinSqmSetDWORD64
       1776  6E7 00085CE0 WinSqmSetEscalationInfo
       1777  6E8 0007FEC0 WinSqmSetIfMaxDWORD
       1778  6E9 0007FEC0 WinSqmSetIfMinDWORD
       1779  6EA 0007FEC0 WinSqmSetString
       1780  6EB 00085BB0 WinSqmStartSession
       1781  6EC 00085BB0 WinSqmStartSessionForPartner
       1782  6ED 000842D0 WinSqmStartSqmOptinListener
       1783  6EE 0009CDA0 ZwAcceptConnectPort
       1784  6EF 0009CD60 ZwAccessCheck
       1785  6F0 0009D280 ZwAccessCheckAndAuditAlarm
       1786  6F1 0009D9B0 ZwAccessCheckByType
       1787  6F2 0009D880 ZwAccessCheckByTypeAndAuditAlarm
       1788  6F3 0009D9D0 ZwAccessCheckByTypeResultList
       1789  6F4 0009D9F0 ZwAccessCheckByTypeResultListAndAuditAlarm
       1790  6F5 0009DA10 ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
       1791  6F6 0009DA30 ZwAcquireCrossVmMutant
       1792  6F7 0009DA50 ZwAcquireProcessActivityReference
       1793  6F8 0009D640 ZwAddAtom
       1794  6F9 0009DA70 ZwAddAtomEx
       1795  6FA 0009DA90 ZwAddBootEntry
       1796  6FB 0009DAB0 ZwAddDriverEntry
       1797  6FC 0009DAD0 ZwAdjustGroupsToken
       1798  6FD 0009D580 ZwAdjustPrivilegesToken
       1799  6FE 0009DAF0 ZwAdjustTokenClaimsAndDeviceGroups
       1800  6FF 0009DB10 ZwAlertResumeThread
       1801  700 0009DB30 ZwAlertThread
       1802  701 0009DB50 ZwAlertThreadByThreadId
       1803  702 0009DB70 ZwAllocateLocallyUniqueId
       1804  703 0009DB90 ZwAllocateReserveObject
       1805  704 0009DBB0 ZwAllocateUserPhysicalPages
       1806  705 0009DBD0 ZwAllocateUserPhysicalPagesEx
       1807  706 0009DBF0 ZwAllocateUuids
       1808  707 0009D060 ZwAllocateVirtualMemory
       1809  708 0009DC10 ZwAllocateVirtualMemoryEx
       1810  709 0009DC30 ZwAlpcAcceptConnectPort
       1811  70A 0009DC50 ZwAlpcCancelMessage
       1812  70B 0009DC70 ZwAlpcConnectPort
       1813  70C 0009DC90 ZwAlpcConnectPortEx
       1814  70D 0009DCB0 ZwAlpcCreatePort
       1815  70E 0009DCD0 ZwAlpcCreatePortSection
       1816  70F 0009DCF0 ZwAlpcCreateResourceReserve
       1817  710 0009DD10 ZwAlpcCreateSectionView
       1818  711 0009DD30 ZwAlpcCreateSecurityContext
       1819  712 0009DD50 ZwAlpcDeletePortSection
       1820  713 0009DD70 ZwAlpcDeleteResourceReserve
       1821  714 0009DD90 ZwAlpcDeleteSectionView
       1822  715 0009DDB0 ZwAlpcDeleteSecurityContext
       1823  716 0009DDD0 ZwAlpcDisconnectPort
       1824  717 0009DDF0 ZwAlpcImpersonateClientContainerOfPort
       1825  718 0009DE10 ZwAlpcImpersonateClientOfPort
       1826  719 0009DE30 ZwAlpcOpenSenderProcess
       1827  71A 0009DE50 ZwAlpcOpenSenderThread
       1828  71B 0009DE70 ZwAlpcQueryInformation
       1829  71C 0009DE90 ZwAlpcQueryInformationMessage
       1830  71D 0009DEB0 ZwAlpcRevokeSecurityContext
       1831  71E 0009DED0 ZwAlpcSendWaitReceivePort
       1832  71F 0009DEF0 ZwAlpcSetInformation
       1833  720 0009D6E0 ZwApphelpCacheControl
       1834  721 0009DF10 ZwAreMappedFilesTheSame
       1835  722 0009DF30 ZwAssignProcessToJobObject
       1836  723 0009DF50 ZwAssociateWaitCompletionPacket
       1837  724 0009DF70 ZwCallEnclave
       1838  725 0009CE00 ZwCallbackReturn
       1839  726 0009D8F0 ZwCancelIoFile
       1840  727 0009DF90 ZwCancelIoFileEx
       1841  728 0009DFB0 ZwCancelSynchronousIoFile
       1842  729 0009D970 ZwCancelTimer
       1843  72A 0009DFD0 ZwCancelTimer2
       1844  72B 0009DFF0 ZwCancelWaitCompletionPacket
       1845  72C 0009D520 ZwClearEvent
       1846  72D 0009CF40 ZwClose
       1847  72E 0009D4C0 ZwCloseObjectAuditAlarm
       1848  72F 0009E010 ZwCommitComplete
       1849  730 0009E030 ZwCommitEnlistment
       1850  731 0009E050 ZwCommitRegistryTransaction
       1851  732 0009E070 ZwCommitTransaction
       1852  733 0009E090 ZwCompactKeys
       1853  734 0009E0B0 ZwCompareObjects
       1854  735 0009E0D0 ZwCompareSigningLevels
       1855  736 0009E0F0 ZwCompareTokens
       1856  737 0009E110 ZwCompleteConnectPort
       1857  738 0009E130 ZwCompressKey
       1858  739 0009E150 ZwConnectPort
       1859  73A 0009D5C0 ZwContinue
       1860  73B 0009E170 ZwContinueEx
       1861  73C 0009E190 ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter
       1862  73D 0009E1B0 ZwCreateCrossVmEvent
       1863  73E 0009E1D0 ZwCreateCrossVmMutant
       1864  73F 0009E1F0 ZwCreateDebugObject
       1865  740 0009E210 ZwCreateDirectoryObject
       1866  741 0009E230 ZwCreateDirectoryObjectEx
       1867  742 0009E250 ZwCreateEnclave
       1868  743 0009E270 ZwCreateEnlistment
       1869  744 0009D660 ZwCreateEvent
       1870  745 0009E290 ZwCreateEventPair
       1871  746 0009D800 ZwCreateFile
       1872  747 0009E2B0 ZwCreateIRTimer
       1873  748 0009E2D0 ZwCreateIoCompletion
       1874  749 0009E2F0 ZwCreateJobObject
       1875  74A 0009E310 ZwCreateJobSet
       1876  74B 0009D100 ZwCreateKey
       1877  74C 0009E330 ZwCreateKeyTransacted
       1878  74D 0009E350 ZwCreateKeyedEvent
       1879  74E 0009E370 ZwCreateLowBoxToken
       1880  74F 0009E390 ZwCreateMailslotFile
       1881  750 0009E3B0 ZwCreateMutant
       1882  751 0009E3D0 ZwCreateNamedPipeFile
       1883  752 0009E3F0 ZwCreatePagingFile
       1884  753 0009E410 ZwCreatePartition
       1885  754 0009E430 ZwCreatePort
       1886  755 0009E450 ZwCreatePrivateNamespace
       1887  756 0009E470 ZwCreateProcess
       1888  757 0009D700 ZwCreateProcessEx
       1889  758 0009E490 ZwCreateProfile
       1890  759 0009E4B0 ZwCreateProfileEx
       1891  75A 0009E4D0 ZwCreateRegistryTransaction
       1892  75B 0009E4F0 ZwCreateResourceManager
       1893  75C 0009D6A0 ZwCreateSection
       1894  75D 0009E510 ZwCreateSectionEx
       1895  75E 0009E530 ZwCreateSemaphore
       1896  75F 0009E550 ZwCreateSymbolicLinkObject
       1897  760 0009D720 ZwCreateThread
       1898  761 0009E570 ZwCreateThreadEx
       1899  762 0009E590 ZwCreateTimer
       1900  763 0009E5B0 ZwCreateTimer2
       1901  764 0009E5D0 ZwCreateToken
       1902  765 0009E5F0 ZwCreateTokenEx
       1903  766 0009E610 ZwCreateTransaction
       1904  767 0009E630 ZwCreateTransactionManager
       1905  768 0009E650 ZwCreateUserProcess
       1906  769 0009E670 ZwCreateWaitCompletionPacket
       1907  76A 0009E690 ZwCreateWaitablePort
       1908  76B 0009E6B0 ZwCreateWnfStateName
       1909  76C 0009E6D0 ZwCreateWorkerFactory
       1910  76D 0009E6F0 ZwDebugActiveProcess
       1911  76E 0009E710 ZwDebugContinue
       1912  76F 0009D3E0 ZwDelayExecution
       1913  770 0009E730 ZwDeleteAtom
       1914  771 0009E750 ZwDeleteBootEntry
       1915  772 0009E770 ZwDeleteDriverEntry
       1916  773 0009E790 ZwDeleteFile
       1917  774 0009E7B0 ZwDeleteKey
       1918  775 0009E7D0 ZwDeleteObjectAuditAlarm
       1919  776 0009E7F0 ZwDeletePrivateNamespace
       1920  777 0009E810 ZwDeleteValueKey
       1921  778 0009E830 ZwDeleteWnfStateData
       1922  779 0009E850 ZwDeleteWnfStateName
       1923  77A 0009CE40 ZwDeviceIoControlFile
       1924  77B 0009E870 ZwDirectGraphicsCall
       1925  77C 0009E890 ZwDisableLastKnownGood
       1926  77D 0009E8B0 ZwDisplayString
       1927  77E 0009E8D0 ZwDrawText
       1928  77F 0009D4E0 ZwDuplicateObject
       1929  780 0009D5A0 ZwDuplicateToken
       1930  781 0009E8F0 ZwEnableLastKnownGood
       1931  782 0009E910 ZwEnumerateBootEntries
       1932  783 0009E930 ZwEnumerateDriverEntries
       1933  784 0009D3A0 ZwEnumerateKey
       1934  785 0009E950 ZwEnumerateSystemEnvironmentValuesEx
       1935  786 0009E970 ZwEnumerateTransactionObject
       1936  787 0009CFC0 ZwEnumerateValueKey
       1937  788 0009E990 ZwExtendSection
       1938  789 0009E9B0 ZwFilterBootOption
       1939  78A 0009E9D0 ZwFilterToken
       1940  78B 0009E9F0 ZwFilterTokenEx
       1941  78C 0009CFE0 ZwFindAtom
       1942  78D 0009D6C0 ZwFlushBuffersFile
       1943  78E 0009EA10 ZwFlushBuffersFileEx
       1944  78F 0009EA30 ZwFlushInstallUILanguage
       1945  790 0009EA50 ZwFlushInstructionCache
       1946  791 0009EA70 ZwFlushKey
       1947  792 0009EA90 ZwFlushProcessWriteBuffers
       1948  793 0009EAB0 ZwFlushVirtualMemory
       1949  794 0009EAD0 ZwFlushWriteBuffer
       1950  795 0009EAF0 ZwFreeUserPhysicalPages
       1951  796 0009D120 ZwFreeVirtualMemory
       1952  797 0009EB10 ZwFreezeRegistry
       1953  798 0009EB30 ZwFreezeTransactions
       1954  799 0009D480 ZwFsControlFile
       1955  79A 0009EB50 ZwGetCachedSigningLevel
       1956  79B 0009EB70 ZwGetCompleteWnfStateSubscription
       1957  79C 0009EB90 ZwGetContextThread
       1958  79D 0009EBB0 ZwGetCurrentProcessorNumber
       1959  79E 0009EBD0 ZwGetCurrentProcessorNumberEx
       1960  79F 0009EBF0 ZwGetDevicePowerState
       1961  7A0 0009EC10 ZwGetMUIRegistryInfo
       1962  7A1 0009EC30 ZwGetNextProcess
       1963  7A2 0009EC50 ZwGetNextThread
       1964  7A3 0009EC70 ZwGetNlsSectionPtr
       1965  7A4 0009EC90 ZwGetNotificationResourceManager
       1966  7A5 0009ECB0 ZwGetWriteWatch
       1967  7A6 0009ECD0 ZwImpersonateAnonymousToken
       1968  7A7 0009D140 ZwImpersonateClientOfPort
       1969  7A8 0009ECF0 ZwImpersonateThread
       1970  7A9 0009ED10 ZwInitializeEnclave
       1971  7AA 0009ED30 ZwInitializeNlsFiles
       1972  7AB 0009ED50 ZwInitializeRegistry
       1973  7AC 0009ED70 ZwInitiatePowerAction
       1974  7AD 0009D740 ZwIsProcessInJob
       1975  7AE 0009ED90 ZwIsSystemResumeAutomatic
       1976  7AF 0009EDB0 ZwIsUILanguageComitted
       1977  7B0 0009EDD0 ZwListenPort
       1978  7B1 0009EDF0 ZwLoadDriver
       1979  7B2 0009EE10 ZwLoadEnclaveData
       1980  7B3 0009EE30 ZwLoadKey
       1981  7B4 0009EE50 ZwLoadKey2
       1982  7B5 000A0810 ZwLoadKey3
       1983  7B6 0009EE70 ZwLoadKeyEx
       1984  7B7 0009EE90 ZwLockFile
       1985  7B8 0009EEB0 ZwLockProductActivationKeys
       1986  7B9 0009EED0 ZwLockRegistryKey
       1987  7BA 0009EEF0 ZwLockVirtualMemory
       1988  7BB 0009EF10 ZwMakePermanentObject
       1989  7BC 0009EF30 ZwMakeTemporaryObject
       1990  7BD 0009EF50 ZwManageHotPatch
       1991  7BE 0009EF70 ZwManagePartition
       1992  7BF 0009EF90 ZwMapCMFModule
       1993  7C0 0009EFB0 ZwMapUserPhysicalPages
       1994  7C1 0009CDC0 ZwMapUserPhysicalPagesScatter
       1995  7C2 0009D260 ZwMapViewOfSection
       1996  7C3 0009EFD0 ZwMapViewOfSectionEx
       1997  7C4 0009EFF0 ZwModifyBootEntry
       1998  7C5 0009F010 ZwModifyDriverEntry
       1999  7C6 0009F030 ZwNotifyChangeDirectoryFile
       2000  7C7 0009F050 ZwNotifyChangeDirectoryFileEx
       2001  7C8 0009F070 ZwNotifyChangeKey
       2002  7C9 0009F090 ZwNotifyChangeMultipleKeys
       2003  7CA 0009F0B0 ZwNotifyChangeSession
       2004  7CB 0009D860 ZwOpenDirectoryObject
       2005  7CC 0009F0D0 ZwOpenEnlistment
       2006  7CD 0009D560 ZwOpenEvent
       2007  7CE 0009F0F0 ZwOpenEventPair
       2008  7CF 0009D3C0 ZwOpenFile
       2009  7D0 0009F110 ZwOpenIoCompletion
       2010  7D1 0009F130 ZwOpenJobObject
       2011  7D2 0009CFA0 ZwOpenKey
       2012  7D3 0009F150 ZwOpenKeyEx
       2013  7D4 0009F170 ZwOpenKeyTransacted
       2014  7D5 0009F190 ZwOpenKeyTransactedEx
       2015  7D6 0009F1B0 ZwOpenKeyedEvent
       2016  7D7 0009F1D0 ZwOpenMutant
       2017  7D8 0009F1F0 ZwOpenObjectAuditAlarm
       2018  7D9 0009F210 ZwOpenPartition
       2019  7DA 0009F230 ZwOpenPrivateNamespace
       2020  7DB 0009D220 ZwOpenProcess
       2021  7DC 0009F250 ZwOpenProcessToken
       2022  7DD 0009D360 ZwOpenProcessTokenEx
       2023  7DE 0009F270 ZwOpenRegistryTransaction
       2024  7DF 0009F290 ZwOpenResourceManager
       2025  7E0 0009D440 ZwOpenSection
       2026  7E1 0009F2B0 ZwOpenSemaphore
       2027  7E2 0009F2D0 ZwOpenSession
       2028  7E3 0009F2F0 ZwOpenSymbolicLinkObject
       2029  7E4 0009F310 ZwOpenThread
       2030  7E5 0009D1E0 ZwOpenThreadToken
       2031  7E6 0009D340 ZwOpenThreadTokenEx
       2032  7E7 0009F330 ZwOpenTimer
       2033  7E8 0009F350 ZwOpenTransaction
       2034  7E9 0009F370 ZwOpenTransactionManager
       2035  7EA 0009F390 ZwPlugPlayControl
       2036  7EB 0009D930 ZwPowerInformation
       2037  7EC 0009F3B0 ZwPrePrepareComplete
       2038  7ED 0009F3D0 ZwPrePrepareEnlistment
       2039  7EE 0009F3F0 ZwPrepareComplete
       2040  7EF 0009F410 ZwPrepareEnlistment
       2041  7F0 0009F430 ZwPrivilegeCheck
       2042  7F1 0009F450 ZwPrivilegeObjectAuditAlarm
       2043  7F2 0009F470 ZwPrivilegedServiceAuditAlarm
       2044  7F3 0009F490 ZwPropagationComplete
       2045  7F4 0009F4B0 ZwPropagationFailed
       2046  7F5 0009D760 ZwProtectVirtualMemory
       2047  7F6 0009F4D0 ZwPssCaptureVaSpaceBulk
       2048  7F7 0009F4F0 ZwPulseEvent
       2049  7F8 0009D500 ZwQueryAttributesFile
       2050  7F9 0009F510 ZwQueryAuxiliaryCounterFrequency
       2051  7FA 0009F530 ZwQueryBootEntryOrder
       2052  7FB 0009F550 ZwQueryBootOptions
       2053  7FC 0009F570 ZwQueryDebugFilterState
       2054  7FD 0009D000 ZwQueryDefaultLocale
       2055  7FE 0009D5E0 ZwQueryDefaultUILanguage
       2056  7FF 0009D400 ZwQueryDirectoryFile
       2057  800 0009F590 ZwQueryDirectoryFileEx
       2058  801 0009F5B0 ZwQueryDirectoryObject
       2059  802 0009F5D0 ZwQueryDriverEntryOrder
       2060  803 0009F5F0 ZwQueryEaFile
       2061  804 0009D820 ZwQueryEvent
       2062  805 0009F610 ZwQueryFullAttributesFile
       2063  806 0009F630 ZwQueryInformationAtom
       2064  807 0009F650 ZwQueryInformationByName
       2065  808 0009F670 ZwQueryInformationEnlistment
       2066  809 0009CF80 ZwQueryInformationFile
       2067  80A 0009F690 ZwQueryInformationJobObject
       2068  80B 0009F6B0 ZwQueryInformationPort
       2069  80C 0009D080 ZwQueryInformationProcess
       2070  80D 0009F6D0 ZwQueryInformationResourceManager
       2071  80E 0009D200 ZwQueryInformationThread
       2072  80F 0009D180 ZwQueryInformationToken
       2073  810 0009F6F0 ZwQueryInformationTransaction
       2074  811 0009F710 ZwQueryInformationTransactionManager
       2075  812 0009F730 ZwQueryInformationWorkerFactory
       2076  813 0009F750 ZwQueryInstallUILanguage
       2077  814 0009F770 ZwQueryIntervalProfile
       2078  815 0009F790 ZwQueryIoCompletion
       2079  816 0009D020 ZwQueryKey
       2080  817 0009F7B0 ZwQueryLicenseValue
       2081  818 0009F7D0 ZwQueryMultipleValueKey
       2082  819 0009F7F0 ZwQueryMutant
       2083  81A 0009CF60 ZwQueryObject
       2084  81B 0009F810 ZwQueryOpenSubKeys
       2085  81C 0009F830 ZwQueryOpenSubKeysEx
       2086  81D 0009D380 ZwQueryPerformanceCounter
       2087  81E 0009F850 ZwQueryPortInformationProcess
       2088  81F 0009F870 ZwQueryQuotaInformationFile
       2089  820 0009D780 ZwQuerySection
       2090  821 0009F890 ZwQuerySecurityAttributesToken
       2091  822 0009F8B0 ZwQuerySecurityObject
       2092  823 0009F8D0 ZwQuerySecurityPolicy
       2093  824 0009F8F0 ZwQuerySemaphore
       2094  825 0009F910 ZwQuerySymbolicLinkObject
       2095  826 0009F930 ZwQuerySystemEnvironmentValue
       2096  827 0009F950 ZwQuerySystemEnvironmentValueEx
       2097  828 0009D420 ZwQuerySystemInformation
       2098  829 0009F970 ZwQuerySystemInformationEx
       2099  82A 0009D8A0 ZwQuerySystemTime
       2100  82B 0009D460 ZwQueryTimer
       2101  82C 0009F990 ZwQueryTimerResolution
       2102  82D 0009D040 ZwQueryValueKey
       2103  82E 0009D1C0 ZwQueryVirtualMemory
       2104  82F 0009D680 ZwQueryVolumeInformationFile
       2105  830 0009F9B0 ZwQueryWnfStateData
       2106  831 0009F9D0 ZwQueryWnfStateNameInformation
       2107  832 0009D600 ZwQueueApcThread
       2108  833 0009F9F0 ZwQueueApcThreadEx
       2109  834 0009FA10 ZwRaiseException
       2110  835 0009FA30 ZwRaiseHardError
       2111  836 0009CE20 ZwReadFile
       2112  837 0009D320 ZwReadFileScatter
       2113  838 0009FA50 ZwReadOnlyEnlistment
       2114  839 0009D7E0 ZwReadRequestData
       2115  83A 0009D540 ZwReadVirtualMemory
       2116  83B 0009FA70 ZwRecoverEnlistment
       2117  83C 0009FA90 ZwRecoverResourceManager
       2118  83D 0009FAB0 ZwRecoverTransactionManager
       2119  83E 0009FAD0 ZwRegisterProtocolAddressInformation
       2120  83F 0009FAF0 ZwRegisterThreadTerminatePort
       2121  840 0009FB10 ZwReleaseKeyedEvent
       2122  841 0009D160 ZwReleaseMutant
       2123  842 0009CEA0 ZwReleaseSemaphore
       2124  843 0009FB30 ZwReleaseWorkerFactoryWorker
       2125  844 0009CE80 ZwRemoveIoCompletion
       2126  845 0009FB50 ZwRemoveIoCompletionEx
       2127  846 0009FB70 ZwRemoveProcessDebug
       2128  847 0009FB90 ZwRenameKey
       2129  848 0009FBB0 ZwRenameTransactionManager
       2130  849 0009FBD0 ZwReplaceKey
       2131  84A 0009FBF0 ZwReplacePartitionUnit
       2132  84B 0009CEE0 ZwReplyPort
       2133  84C 0009CEC0 ZwReplyWaitReceivePort
       2134  84D 0009D2C0 ZwReplyWaitReceivePortEx
       2135  84E 0009FC10 ZwReplyWaitReplyPort
       2136  84F 0009FC30 ZwRequestPort
       2137  850 0009D1A0 ZwRequestWaitReplyPort
       2138  851 0009FC50 ZwResetEvent
       2139  852 0009FC70 ZwResetWriteWatch
       2140  853 0009FC90 ZwRestoreKey
       2141  854 0009FCB0 ZwResumeProcess
       2142  855 0009D7A0 ZwResumeThread
       2143  856 0009FCD0 ZwRevertContainerImpersonation
       2144  857 0009FCF0 ZwRollbackComplete
       2145  858 0009FD10 ZwRollbackEnlistment
       2146  859 0009FD30 ZwRollbackRegistryTransaction
       2147  85A 0009FD50 ZwRollbackTransaction
       2148  85B 0009FD70 ZwRollforwardTransactionManager
       2149  85C 0009FD90 ZwSaveKey
       2150  85D 0009FDB0 ZwSaveKeyEx
       2151  85E 0009FDD0 ZwSaveMergedKeys
       2152  85F 0009FDF0 ZwSecureConnectPort
       2153  860 0009FE10 ZwSerializeBoot
       2154  861 0009FE30 ZwSetBootEntryOrder
       2155  862 0009FE50 ZwSetBootOptions
       2156  863 0009FE70 ZwSetCachedSigningLevel
       2157  864 0009FE90 ZwSetCachedSigningLevel2
       2158  865 0009FEB0 ZwSetContextThread
       2159  866 0009FED0 ZwSetDebugFilterState
       2160  867 0009FEF0 ZwSetDefaultHardErrorPort
       2161  868 0009FF10 ZwSetDefaultLocale
       2162  869 0009FF30 ZwSetDefaultUILanguage
       2163  86A 0009FF50 ZwSetDriverEntryOrder
       2164  86B 0009FF70 ZwSetEaFile
       2165  86C 0009CF20 ZwSetEvent
       2166  86D 0009D300 ZwSetEventBoostPriority
       2167  86E 0009FF90 ZwSetHighEventPair
       2168  86F 0009FFB0 ZwSetHighWaitLowEventPair
       2169  870 0009FFD0 ZwSetIRTimer
       2170  871 0009FFF0 ZwSetInformationDebugObject
       2171  872 000A0010 ZwSetInformationEnlistment
       2172  873 0009D240 ZwSetInformationFile
       2173  874 000A0030 ZwSetInformationJobObject
       2174  875 000A0050 ZwSetInformationKey
       2175  876 0009D8D0 ZwSetInformationObject
       2176  877 0009D0E0 ZwSetInformationProcess
       2177  878 000A0070 ZwSetInformationResourceManager
       2178  879 000A0090 ZwSetInformationSymbolicLink
       2179  87A 0009CF00 ZwSetInformationThread
       2180  87B 000A00B0 ZwSetInformationToken
       2181  87C 000A00D0 ZwSetInformationTransaction
       2182  87D 000A00F0 ZwSetInformationTransactionManager
       2183  87E 000A0110 ZwSetInformationVirtualMemory
       2184  87F 000A0130 ZwSetInformationWorkerFactory
       2185  880 000A0150 ZwSetIntervalProfile
       2186  881 000A0170 ZwSetIoCompletion
       2187  882 000A0190 ZwSetIoCompletionEx
       2188  883 000A01B0 ZwSetLdtEntries
       2189  884 000A01D0 ZwSetLowEventPair
       2190  885 000A01F0 ZwSetLowWaitHighEventPair
       2191  886 000A0210 ZwSetQuotaInformationFile
       2192  887 000A0230 ZwSetSecurityObject
       2193  888 000A0250 ZwSetSystemEnvironmentValue
       2194  889 000A0270 ZwSetSystemEnvironmentValueEx
       2195  88A 000A0290 ZwSetSystemInformation
       2196  88B 000A02B0 ZwSetSystemPowerState
       2197  88C 000A02D0 ZwSetSystemTime
       2198  88D 000A02F0 ZwSetThreadExecutionState
       2199  88E 0009D990 ZwSetTimer
       2200  88F 000A0310 ZwSetTimer2
       2201  890 000A0330 ZwSetTimerEx
       2202  891 000A0350 ZwSetTimerResolution
       2203  892 000A0370 ZwSetUuidSeed
       2204  893 0009D950 ZwSetValueKey
       2205  894 000A0390 ZwSetVolumeInformationFile
       2206  895 000A03B0 ZwSetWnfProcessNotificationEvent
       2207  896 000A03D0 ZwShutdownSystem
       2208  897 000A03F0 ZwShutdownWorkerFactory
       2209  898 000A0410 ZwSignalAndWaitForSingleObject
       2210  899 000A0430 ZwSinglePhaseReject
       2211  89A 000A0450 ZwStartProfile
       2212  89B 000A0470 ZwStopProfile
       2213  89C 000A0490 ZwSubscribeWnfStateChange
       2214  89D 000A04B0 ZwSuspendProcess
       2215  89E 000A04D0 ZwSuspendThread
       2216  89F 000A04F0 ZwSystemDebugControl
       2217  8A0 000A0510 ZwTerminateEnclave
       2218  8A1 000A0530 ZwTerminateJobObject
       2219  8A2 0009D2E0 ZwTerminateProcess
       2220  8A3 0009D7C0 ZwTerminateThread
       2221  8A4 000A0550 ZwTestAlert
       2222  8A5 000A0570 ZwThawRegistry
       2223  8A6 000A0590 ZwThawTransactions
       2224  8A7 000A05B0 ZwTraceControl
       2225  8A8 0009D910 ZwTraceEvent
       2226  8A9 000A05D0 ZwTranslateFilePath
       2227  8AA 000A05F0 ZwUmsThreadYield
       2228  8AB 000A0610 ZwUnloadDriver
       2229  8AC 000A0630 ZwUnloadKey
       2230  8AD 000A0650 ZwUnloadKey2
       2231  8AE 000A0670 ZwUnloadKeyEx
       2232  8AF 000A0690 ZwUnlockFile
       2233  8B0 000A06B0 ZwUnlockVirtualMemory
       2234  8B1 0009D2A0 ZwUnmapViewOfSection
       2235  8B2 000A06D0 ZwUnmapViewOfSectionEx
       2236  8B3 000A06F0 ZwUnsubscribeWnfStateChange
       2237  8B4 000A0710 ZwUpdateWnfStateData
       2238  8B5 000A0730 ZwVdmControl
       2239  8B6 000A0750 ZwWaitForAlertByThreadId
       2240  8B7 000A0770 ZwWaitForDebugEvent
       2241  8B8 000A0790 ZwWaitForKeyedEvent
       2242  8B9 0009D8B0 ZwWaitForMultipleObjects
       2243  8BA 0009D0A0 ZwWaitForMultipleObjects32
       2244  8BB 0009CDE0 ZwWaitForSingleObject
       2245  8BC 000A07B0 ZwWaitForWorkViaWorkerFactory
       2246  8BD 000A07D0 ZwWaitHighEventPair
       2247  8BE 000A07F0 ZwWaitLowEventPair
       2248  8BF 0009CD80 ZwWorkerFactoryWorkerReady
       2249  8C0 0009CE60 ZwWriteFile
       2250  8C1 0009D0C0 ZwWriteFileGather
       2251  8C2 0009D840 ZwWriteRequestData
       2252  8C3 0009D4A0 ZwWriteVirtualMemory
       2253  8C4 0009D620 ZwYieldExecution
       2254  8C5 0008C6D0 __C_specific_handler
       2255  8C6 000A1FB0 __chkstk
       2256  8C7 0008C8A0 __isascii
       2257  8C8 0008C8C0 __iscsym
       2258  8C9 0008C900 __iscsymf
       2259  8CA 0007FEC0 __misaligned_access
       2260  8CB 0008C940 __toascii
       2261  8CC 0008CB60 _atoi64
       2262  8CD 00085300 _errno
       2263  8CE 00164AC0 _fltused
       2264  8CF 0008CBD0 _i64toa
       2265  8D0 00096260 _i64toa_s
       2266  8D1 0008CD70 _i64tow
       2267  8D2 00096560 _i64tow_s
       2268  8D3 0008CC10 _itoa
       2269  8D4 00096290 _itoa_s
       2270  8D5 0008CDB0 _itow
       2271  8D6 00096590 _itow_s
       2272  8D7 0008CF50 _lfind
       2273  8D8 0008D000 _local_unwind
       2274  8D9 0008CC10 _ltoa
       2275  8DA 00096290 _ltoa_s
       2276  8DB 0008CDB0 _ltow
       2277  8DC 00096590 _ltow_s
       2278  8DD 00096880 _makepath_s
       2279  8DE 0008D030 _memccpy
       2280  8DF 0008D0D0 _memicmp
       2281  8E0 000A2CF0 _setjmp
       2282  8E1 000A2DB0 _setjmpex
       2283  8E2 0008D0F0 _snprintf
       2284  8E3 000969D0 _snprintf_s
       2285  8E4 00096AA0 _snscanf_s
       2286  8E5 0008D1A0 _snwprintf
       2287  8E6 00096AE0 _snwprintf_s
       2288  8E7 00096BC0 _snwscanf_s
       2289  8E8 0008D280 _splitpath
       2290  8E9 00096C00 _splitpath_s
       2291  8EA 0008D5E0 _strcmpi
       2292  8EB 0008D5E0 _stricmp
       2293  8EC 0008D600 _strlwr
       2294  8ED 0008D630 _strlwr_s
       2295  8EE 0008D700 _strnicmp
       2296  8EF 00096EA0 _strnset_s
       2297  8F0 00096F30 _strset_s
       2298  8F1 0008D720 _strupr
       2299  8F2 0008D770 _strupr_s
       2300  8F3 0008D7E0 _swprintf
       2301  8F4 0008CC40 _ui64toa
       2302  8F5 000962C0 _ui64toa_s
       2303  8F6 0008CDE0 _ui64tow
       2304  8F7 000965C0 _ui64tow_s
       2305  8F8 0008CC60 _ultoa
       2306  8F9 000962E0 _ultoa_s
       2307  8FA 0008CE00 _ultow
       2308  8FB 000965E0 _ultow_s
       2309  8FC 0008D8A0 _vscprintf
       2310  8FD 0008D9B0 _vscwprintf
       2311  8FE 0008DA90 _vsnprintf
       2312  8FF 00096A00 _vsnprintf_s
       2313  900 0008DB60 _vsnwprintf
       2314  901 00096B10 _vsnwprintf_s
       2315  902 0008D9D0 _vswprintf
       2316  903 0008DC60 _wcsicmp
       2317  904 0008DCC0 _wcslwr
       2318  905 0008DD20 _wcslwr_s
       2319  906 0008DDA0 _wcsnicmp
       2320  907 0008DE10 _wcsnset_s
       2321  908 0008DEA0 _wcsset_s
       2322  909 0008DF00 _wcstoi64
       2323  90A 0008DF30 _wcstoui64
       2324  90B 0008E1D0 _wcsupr
       2325  90C 0008E210 _wcsupr_s
       2326  90D 00096F90 _wmakepath_s
       2327  90E 00097110 _wsplitpath_s
       2328  90F 0008E290 _wtoi
       2329  910 0008E2C0 _wtoi64
       2330  911 0008E2E0 _wtol
       2331  912 0008E300 abs
       2332  913 0008E310 atan
       2333  914 0008E570 atan2
       2334  915 0008CB80 atoi
       2335  916 0008CBB0 atol
       2336  917 0008ECB0 bsearch
       2337  918 0008EDB0 bsearch_s
       2338  919 0008EEC0 ceil
       2339  91A 0008EFE0 cos
       2340  91B 0008F8C0 fabs
       2341  91C 0008F9A0 floor
       2342  91D 0008C950 isalnum
       2343  91E 0008C980 isalpha
       2344  91F 0008C9B0 iscntrl
       2345  920 0008C9E0 isdigit
       2346  921 0008CA10 isgraph
       2347  922 0008CA40 islower
       2348  923 0008CA70 isprint
       2349  924 0008CAA0 ispunct
       2350  925 0008CAD0 isspace
       2351  926 0008CB00 isupper
       2352  927 0008FAD0 iswalnum
       2353  928 0008FAE0 iswalpha
       2354  929 0008FAF0 iswascii
       2355  92A 0008FBA0 iswctype
       2356  92B 0008FB10 iswdigit
       2357  92C 0008FB20 iswgraph
       2358  92D 0008FB30 iswlower
       2359  92E 0008FB40 iswprint
       2360  92F 0008FB50 iswspace
       2361  930 0008FB60 iswxdigit
       2362  931 0008CB30 isxdigit
       2363  932 0008E300 labs
       2364  933 0008FBD0 log
       2365  934 0008FEB0 longjmp
       2366  935 0008FEE0 mbstowcs
       2367  936 0008FFC0 memchr
       2368  937 0008FFF0 memcmp
       2369  938 000A3B40 memcpy
       2370  939 000973D0 memcpy_s
       2371  93A 000A3B40 memmove
       2372  93B 00097470 memmove_s
       2373  93C 000A3E00 memset
       2374  93D 000A2E50 pow
       2375  93E 000900D0 qsort
       2376  93F 00090460 qsort_s
       2377  940 0008F400 sin
       2378  941 00090820 sprintf
       2379  942 000974D0 sprintf_s
       2380  943 000908B0 sqrt
       2381  944 000909C0 sscanf
       2382  945 00097550 sscanf_s
       2383  946 00090A90 strcat
       2384  947 000975B0 strcat_s
       2385  948 00090BF0 strchr
       2386  949 00090C30 strcmp
       2387  94A 00090B30 strcpy
       2388  94B 00097650 strcpy_s
       2389  94C 00090CF0 strcspn
       2390  94D 00090DB0 strlen
       2391  94E 00090E70 strncat
       2392  94F 000976E0 strncat_s
       2393  950 00091020 strncmp
       2394  951 000910F0 strncpy
       2395  952 000977F0 strncpy_s
       2396  953 00091260 strnlen
       2397  954 00091280 strpbrk
       2398  955 00091330 strrchr
       2399  956 00091360 strspn
       2400  957 00091430 strstr
       2401  958 000978E0 strtok_s
       2402  959 000916B0 strtol
       2403  95A 00091710 strtoul
       2404  95B 0008D7E0 swprintf
       2405  95C 00097A50 swprintf_s
       2406  95D 00097AE0 swscanf_s
       2407  95E 00091750 tan
       2408  95F 00091BF0 tolower
       2409  960 00091C30 toupper
       2410  961 00091CA0 towlower
       2411  962 00091CD0 towupper
       2412  963 000E0890 vDbgPrintEx
       2413  964 000E08C0 vDbgPrintExWithPrefix
       2414  965 0008D990 vsprintf
       2415  966 00097500 vsprintf_s
       2416  967 00097A80 vswprintf_s
       2417  968 00091CE0 wcscat
       2418  969 00097B40 wcscat_s
       2419  96A 00091D50 wcschr
       2420  96B 00091D80 wcscmp
       2421  96C 00091D20 wcscpy
       2422  96D 00097BE0 wcscpy_s
       2423  96E 00091DC0 wcscspn
       2424  96F 00091E10 wcslen
       2425  970 00091E30 wcsncat
       2426  971 00097C70 wcsncat_s
       2427  972 00091E80 wcsncmp
       2428  973 00091EC0 wcsncpy
       2429  974 00097D90 wcsncpy_s
       2430  975 00091F10 wcsnlen
       2431  976 00091F40 wcspbrk
       2432  977 00091F90 wcsrchr
       2433  978 00091FD0 wcsspn
       2434  979 00092020 wcsstr
       2435  97A 00097E90 wcstok_s
       2436  97B 000922B0 wcstol
       2437  97C 00092350 wcstombs
       2438  97D 00092310 wcstoul
          8      0007F110 [NONAME]

user32.dll 的 ordinal

PS D:\工作> dumpbin.exe -exports .\user32.dll
Microsoft (R) COFF/PE Dumper Version 14.29.30140.0
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file .\user32.dll

File Type: DLL

  Section contains the following exports for USER32.dll

    00000000 characteristics
    7DD8B857 time date stamp
        0.00 version
        1502 ordinal base
        1215 number of functions
         998 number of names

    ordinal hint RVA      name

       1505    0 00041120 ActivateKeyboardLayout
       1506    1 00041050 AddClipboardFormatListener
       1507    2 000414D0 AddVisualIdentifier
       1508    3 0002BBF0 AdjustWindowRect
       1509    4 0002DD30 AdjustWindowRectEx
       1510    5 00089290 AdjustWindowRectExForDpi
       1511    6 00096870 AlignRects
       1512    7 0008FDB0 AllowForegroundActivation
       1513    8 0008FDC0 AllowSetForegroundWindow
       1514    9 00025D60 AnimateWindow
       1515    A 000892F0 AnyPopup
       1516    B 00094740 AppendMenuA
       1517    C 000919E0 AppendMenuW
       1518    D 000267A0 AreDpiAwarenessContextsEqual
       1519    E 0008FDE0 ArrangeIconicWindows
       1520    F 000414E0 AttachThreadInput
       1521   10 00028000 BeginDeferWindowPos
       1522   11 00041500 BeginPaint
       1523   12 00041510 BlockInput
       1524   13 00029A50 BringWindowToTop
       1525   14 00094790 BroadcastSystemMessage
       1526   15 00094790 BroadcastSystemMessageA
       1527   16 000947C0 BroadcastSystemMessageExA
       1528   17 00091A30 BroadcastSystemMessageExW
       1529   18 00091A60 BroadcastSystemMessageW
       1530   19 000849F0 BuildReasonArray
       1531   1A 00041530 CalcMenuBar
       1532   1B 00041540 CalculatePopupWindowPosition
       1533   1C 0008A590 CallMsgFilter
       1534   1D 0008A590 CallMsgFilterA
       1535   1E 0003A100 CallMsgFilterW
       1536   1F 0003B680 CallNextHookEx
       1537   20 00024230 CallWindowProcA
       1538   21 000358C0 CallWindowProcW
       1539   22 000635D0 CancelShutdown
       1540   23 0008FE00 CascadeChildWindows
       1541   24 0007E7C0 CascadeWindows
       1542   25 0002C1C0 ChangeClipboardChain
       1543   26 0008A680 ChangeDisplaySettingsA
       1544   27 0008A6B0 ChangeDisplaySettingsExA
       1545   28 00094090 ChangeDisplaySettingsExW
       1546   29 000941C0 ChangeDisplaySettingsW
       1547   2A 0007EAF0 ChangeMenuA
       1548   2B 0007EBA0 ChangeMenuW
       1549   2C 000408A0 ChangeWindowMessageFilter
       1555   2D 00041560 ChangeWindowMessageFilterEx
       1556   2E 0002BB10 CharLowerA
       1557   2F 0008B740 CharLowerBuffA
       1558   30 0002C1A0 CharLowerBuffW
       1559   31 0008B760 CharLowerW
       1560   32 00023A00 CharNextA
       1561   33 0008B780 CharNextExA
       1562   34 0002ACA0 CharNextW
       1563   35 0002B3E0 CharPrevA
       1564   36 0008B7A0 CharPrevExA
       1565   37 0008B7C0 CharPrevW
       1566   38 000834F0 CharToOemA
       1567   39 0002ADA0 CharToOemBuffA
       1568   3A 00083540 CharToOemBuffW
       1569   3B 00083590 CharToOemW
       1570   3C 0002C3D0 CharUpperA
       1571   3D 0008B7E0 CharUpperBuffA
       1572   3E 0008B800 CharUpperBuffW
       1573   3F 00040000 CharUpperW
       1574   40 000942C0 CheckBannedOneCoreTransformApi
       1575   41 0003C640 CheckDBCSEnabledExt
       1576   42 0002BF30 CheckDlgButton
       1577   43 00021270 CheckMenuItem
       1578   44 0007EC50 CheckMenuRadioItem
       1579   45 00041570 CheckProcessForClipboardAccess
       1580   46 00041580 CheckProcessSession
       1581   47 00066AE0 CheckRadioButton
       1582   48 00041590 CheckWindowThreadDesktop
       1583   49 0008FE30 ChildWindowFromPoint
       1584   4A 000415A0 ChildWindowFromPointEx
       1585   4B 000578F0 CliImmSetHotKey
       1586   4C 0003F330 ClientThreadSetup
       1587   4D 000244D0 ClientToScreen
       1588   4E 000415C0 ClipCursor
       1589   4F 0002B7F0 CloseClipboard
       1590   50 000415D0 CloseDesktop
       1591   51 0005C4D0 CloseGestureInfoHandle
       1592   52 0005F000 CloseTouchInputHandle
       1593   53 0008FEC0 CloseWindow
       1594   54 000415E0 CloseWindowStation
       1595   55 00063620 ConsoleControl
       1596   56 00041640 ControlMagnification
       1597   57 0005E580 CopyAcceleratorTableA
       1598   58 00041650 CopyAcceleratorTableW
       1599   59 000275F0 CopyIcon
       1600   5A 00027EB0 CopyImage
       1601   5B 0003C660 CopyRect
       1602   5C 0002C350 CountClipboardFormats
       1603   5D 0005E5E0 CreateAcceleratorTableA
       1604   5E 00041660 CreateAcceleratorTableW
       1605   5F 0002A5B0 CreateCaret
       1606   60 0005E630 CreateCursor
       1607   61 00041690 CreateDCompositionHwndTarget
       1608   62 0008FF00 CreateDesktopA
       1609   63 0008FF40 CreateDesktopExA
       1610   64 00090040 CreateDesktopExW
       1611   65 00090090 CreateDesktopW
       1612   66 0002C2D0 CreateDialogIndirectParamA
       1613   67 0002D330 CreateDialogIndirectParamAorW
       1614   68 0002C710 CreateDialogIndirectParamW
       1615   69 0002BC60 CreateDialogParamA
       1616   6A 0002BA20 CreateDialogParamW
       1617   6B 0005E6F0 CreateIcon
       1618   6C 0005E7A0 CreateIconFromResource
       1619   6D 00024D20 CreateIconFromResourceEx
       1620   6E 00027640 CreateIconIndirect
       1621   6F 0007E7F0 CreateMDIWindowA
       1622   70 0007E830 CreateMDIWindowW
       1623   71 0002BF70 CreateMenu
       1624   72 0002C2A0 CreatePopupMenu
       1625   73 00085270 CreateSyntheticPointerDevice
       1626   74 00091BC0 CreateSystemThreads
       1627   75 00028610 CreateWindowExA
       1628   76 0002F6F0 CreateWindowExW
       1629   77 00089350 CreateWindowInBand
       1630   78 000893A0 CreateWindowInBandEx
       1631   79 000893F0 CreateWindowIndirect
       1632   7A 000900C0 CreateWindowStationA
       1633   7B 00090110 CreateWindowStationW
       1634   7C 000636B0 CsrBroadcastSystemMessageExW
       1635   7D 00075600 CtxInitUser32
       1636   7E 000897B0 DdeAbandonTransaction
       1637   7F 0006E810 DdeAccessData
       1638   80 0006E890 DdeAddData
       1639   81 00089850 DdeClientTransaction
       1640   82 0006F690 DdeCmpStringHandles
       1641   83 00062B80 DdeConnect
       1642   84 00062C30 DdeConnectList
       1643   85 0006E9D0 DdeCreateDataHandle
       1644   86 0006F6B0 DdeCreateStringHandleA
       1645   87 0006F6E0 DdeCreateStringHandleW
       1646   88 00062E50 DdeDisconnect
       1647   89 00062ED0 DdeDisconnectList
       1648   8A 0005AE10 DdeEnableCallback
       1649   8B 0006EAC0 DdeFreeDataHandle
       1650   8C 0006F710 DdeFreeStringHandle
       1651   8D 0006EB20 DdeGetData
       1652   8E 00064900 DdeGetLastError
       1653   8F 00062FA0 DdeGetQualityOfService
       1654   90 00064950 DdeImpersonateClient
       1655   91 000649B0 DdeInitializeA
       1656   92 000649E0 DdeInitializeW
       1657   93 0006F7B0 DdeKeepStringHandle
       1658   94 00064A10 DdeNameService
       1659   95 00089E00 DdePostAdvise
       1660   96 0008A040 DdeQueryConvInfo
       1661   97 00062FB0 DdeQueryNextServer
       1662   98 0006F850 DdeQueryStringA
       1663   99 0006F880 DdeQueryStringW
       1664   9A 000630B0 DdeReconnect
       1665   9B 000631F0 DdeSetQualityOfService
       1666   9C 0008A1F0 DdeSetUserHandle
       1667   9D 0006EC30 DdeUnaccessData
       1668   9E 00064C50 DdeUninitialize
       1669   9F          DefDlgProcA (forwarded to NTDLL.NtdllDialogWndProc_A)
       1670   A0          DefDlgProcW (forwarded to NTDLL.NtdllDialogWndProc_W)
       1671   A1 000229D0 DefFrameProcA
       1672   A2 0007E870 DefFrameProcW
       1673   A3 00020720 DefMDIChildProcA
       1674   A4 0007E8A0 DefMDIChildProcW
       1675   A5 00091A90 DefRawInputProc
       1676   A6          DefWindowProcA (forwarded to NTDLL.NtdllDefWindowProc_A)
       1677   A7          DefWindowProcW (forwarded to NTDLL.NtdllDefWindowProc_W)
       1678   A8 000273D0 DeferWindowPos
       1679   A9 00090140 DeferWindowPosAndBand
       2503   AA 000416D0 DelegateInput
       1680   AB 000416E0 DeleteMenu
       1681   AC 0002C3F0 DeregisterShellHookWindow
       1682   AD 00030CB0 DestroyAcceleratorTable
       1683   AE 0002B420 DestroyCaret
       1684   AF 000401E0 DestroyCursor
       1685   B0 00041720 DestroyDCompositionHwndTarget
       1686   B1 000401E0 DestroyIcon
       1687   B2 00041730 DestroyMenu
       1688   B3 00084B20 DestroyReasons
       1689   B4 00041740 DestroySyntheticPointerDevice
       1690   B5 00041750 DestroyWindow
       1691   B6 0005E7D0 DialogBoxIndirectParamA
       1692   B7 00024820 DialogBoxIndirectParamAorW
       1693   B8 000247F0 DialogBoxIndirectParamW
       1694   B9 0005E800 DialogBoxParamA
       1695   BA 0005E8B0 DialogBoxParamW
       1696   BB 00090180 DisableProcessWindowsGhosting
       1697   BC 00027F50 DispatchMessageA
       1698   BD 00035B80 DispatchMessageW
       1699   BE 000406D0 DisplayConfigGetDeviceInfo
       1700   BF 000960E0 DisplayConfigSetDeviceInfo
       1701   C0 00063730 DisplayExitWindowsWarnings
       1702   C1 0007BB30 DlgDirListA
       1703   C2 00061740 DlgDirListComboBoxA
       1704   C3 000617E0 DlgDirListComboBoxW
       1705   C4 0007BBD0 DlgDirListW
       1706   C5 00061820 DlgDirSelectComboBoxExA
       1707   C6 00061880 DlgDirSelectComboBoxExW
       1708   C7 0007BC10 DlgDirSelectExA
       1709   C8 0007BC80 DlgDirSelectExW
       1710   C9 00041770 DoSoundConnect
       1711   CA 00041780 DoSoundDisconnect
       1712   CB 000417A0 DragDetect
       1713   CC 000417B0 DragObject
       1714   CD 000417C0 DrawAnimatedRects
       1715   CE 00082E20 DrawCaption
       1716   CF 0008A880 DrawCaptionTempA
       1717   D0 000941F0 DrawCaptionTempW
       1718   D1 000225B0 DrawEdge
       1719   D2 00027400 DrawFocusRect
       1720   D3 000974E0 DrawFrame
       1721   D4 00028BE0 DrawFrameControl
       1722   D5 00025740 DrawIcon
       1723   D6 00025770 DrawIconEx
       1724   D7 0002AD30 DrawMenuBar
       1725   D8 0007EDD0 DrawMenuBarTemp
       1726   D9 0007F550 DrawStateA
       1727   DA 00023410 DrawStateW
       1728   DB 00022880 DrawTextA
       1729   DC 000228E0 DrawTextExA
       1730   DD 0002C7A0 DrawTextExW
       1731   DE 0002C740 DrawTextW
       1553   DF 00084E70 DwmGetDxRgn
       1732   E0 00084E80 DwmGetDxSharedSurface
       1733   E1 000417D0 DwmGetRemoteSessionOcclusionEvent
       1734   E2 000417E0 DwmGetRemoteSessionOcclusionState
       1735   E3 000417F0 DwmKernelShutdown
       1736   E4 00041800 DwmKernelStartup
       1737   E5 00090190 DwmLockScreenUpdates
       1738   E6 00041810 DwmValidateWindow
       1739   E7 0001D870 EditWndProc
       1740   E8 0002C2B0 EmptyClipboard
       1741   E9 00020690 EnableMenuItem
       1742   EA 00041830 EnableMouseInPointer
       1743   EB 00041860 EnableNonClientDpiScaling
       1744   EC 00041870 EnableOneCoreTransformMode
       1745   ED 00085C70 EnableScrollBar
       1746   EE 000894C0 EnableSessionForMMCSS
       1747   EF 00040020 EnableWindow
       1748   F0 00028780 EndDeferWindowPos
       1749   F1 000418E0 EndDeferWindowPosEx
       1750   F2 0002AB20 EndDialog
       1751   F3 000418F0 EndMenu
       1752   F4 00041900 EndPaint
       1753   F5 00043770 EndTask
       1754   F6 00084070 EnterReaderModeHelper
       1755   F7 00033B80 EnumChildWindows
       1756   F8 00090220 EnumClipboardFormats
       1757   F9 0005BAE0 EnumDesktopWindows
       1758   FA 0005BB10 EnumDesktopsA
       1759   FB 0005BB30 EnumDesktopsW
       1760   FC 00029A70 EnumDisplayDevicesA
       1761   FD 00040040 EnumDisplayDevicesW
       1762   FE 00041910 EnumDisplayMonitors
       1763   FF 00029450 EnumDisplaySettingsA
       1764  100 00029480 EnumDisplaySettingsExA
       1765  101 0003FDB0 EnumDisplaySettingsExW
       1766  102 0003FD80 EnumDisplaySettingsW
       1767  103 0005BB50 EnumPropsA
       1768  104 0005BB70 EnumPropsExA
       1769  105 0005BB90 EnumPropsExW
       1770  106 0005BBB0 EnumPropsW
       1771  107 00032E20 EnumThreadWindows
       1772  108 0005BBD0 EnumWindowStationsA
       1773  109 0005BBF0 EnumWindowStationsW
       1774  10A 00029A00 EnumWindows
       1775  10B 0003EC90 EqualRect
       1776  10C 000878F0 EvaluateProximityToPolygon
       1777  10D 00087EC0 EvaluateProximityToRect
       1778  10E 00041920 ExcludeUpdateRgn
       1779  10F 00063970 ExitWindowsEx
       1780  110 000233A0 FillRect
       1781  111 00028050 FindWindowA
       1782  112 0008A920 FindWindowExA
       1783  113 0002AEB0 FindWindowExW
       1784  114 0003FA50 FindWindowW
       1785  115 00090290 FlashWindow
       1786  116 00041930 FlashWindowEx
       1787  117 00027450 FrameRect
       1788  118 000660D0 FreeDDElParam
       1789  119 00041950 FrostCrashedWindow
       1790  11A 000281A0 GetActiveWindow
       1791  11B 0008A950 GetAltTabInfo
       1792  11C 0008A950 GetAltTabInfoA
       1793  11D 00094270 GetAltTabInfoW
       1794  11E 00041970 GetAncestor
       1796  11F 0003C120 GetAppCompatFlags
       1795  120 00035720 GetAppCompatFlags2
       1797  121 00025640 GetAsyncKeyState
       1798  122 00041980 GetAutoRotationState
       1799  123 000905D0 GetAwarenessFromDpiAwarenessContext
       1800  124 00041990 GetCIMSSM
       1801  125 0003F230 GetCapture
       1802  126 000419A0 GetCaretBlinkTime
       1803  127 000419B0 GetCaretPos
       1804  128 00025B50 GetClassInfoA
       1805  129 00025BA0 GetClassInfoExA
       1806  12A 0002F440 GetClassInfoExW
       1807  12B 0002E460 GetClassInfoW
       1808  12C 00027280 GetClassLongA
       1809  12D 000378B0 GetClassLongW
       1810  12E 00024170 GetClassNameA
       1811  12F 0003F530 GetClassNameW
       1812  130 0005AF70 GetClassWord
       1813  131 00035190 GetClientRect
       1814  132 000419C0 GetClipCursor
       1815  133 000419D0 GetClipboardAccessToken
       1816  134 000281D0 GetClipboardData
       1817  135 0002C450 GetClipboardFormatNameA
       1818  136 00040920 GetClipboardFormatNameW
       1819  137 0002C050 GetClipboardOwner
       1820  138 0002BD10 GetClipboardSequenceNumber
       1821  139 0008B820 GetClipboardViewer
       1822  13A 000419E0 GetComboBoxInfo
       1823  13B 000419F0 GetCurrentInputMessageSource
       1824  13C 00041A00 GetCursor
       1825  13D 00040FD0 GetCursorFrameInfo
       1826  13E 00041A10 GetCursorInfo
       1827  13F 00025830 GetCursorPos
       1828  140 0003EEC0 GetDC
       1829  141 00041A20 GetDCEx
       1830  142 00041A30 GetDesktopID
       1831  143 0003A1A0 GetDesktopWindow
       1832  144 0002BD90 GetDialogBaseUnits
       1833  145 00066B80 GetDialogControlDpiChangeBehavior
       1834  146 00066BB0 GetDialogDpiChangeBehavior
       1835  147 00041A40 GetDisplayAutoRotationPreferences
       1836  148 0002BE90 GetDisplayConfigBufferSizes
       1837  149 00039350 GetDlgCtrlID
       1838  14A 00039470 GetDlgItem
       1839  14B 0002B0C0 GetDlgItemInt
       1840  14C 000947F0 GetDlgItemTextA
       1841  14D 0002B200 GetDlgItemTextW
       1842  14E 00041A60 GetDoubleClickTime
       1843  14F 00090660 GetDpiAwarenessContextForProcess
       1844  150 00040690 GetDpiForMonitorInternal
       1845  151 00035790 GetDpiForSystem
       1846  152 00027EE0 GetDpiForWindow
       1847  153 00090680 GetDpiFromDpiAwarenessContext
       1848  154 00041A70 GetExtendedPointerDeviceProperty
       1849  155 0003EE30 GetFocus
       1850  156 00041A80 GetForegroundWindow
       1851  157 00041A90 GetGUIThreadInfo
       1852  158 00041AA0 GetGestureConfig
       1853  159 0005C550 GetGestureExtraArgs
       1854  15A 0005C570 GetGestureInfo
       1855  15B 00041AB0 GetGuiResources
       1856  15C 0003FAE0 GetIconInfo
       1857  15D 0005E930 GetIconInfoExA
       1858  15E 0005EA40 GetIconInfoExW
       1859  15F 000906D0 GetInputDesktop
       1860  160 00041AD0 GetInputLocaleInfo
       1861  161 00027210 GetInputState
       1862  162 00041B10 GetInternalWindowPos
       1863  163 000906E0 GetKBCodePage
       1864  164 0008A980 GetKeyNameTextA
       1865  165 000942A0 GetKeyNameTextW
       1866  166 0003C590 GetKeyState
       1867  167 0003F640 GetKeyboardLayout
       1868  168 00041B20 GetKeyboardLayoutList
       1869  169 0008A9F0 GetKeyboardLayoutNameA
       1870  16A 00040A10 GetKeyboardLayoutNameW
       1871  16B 00041B30 GetKeyboardState
       1872  16C 000906F0 GetKeyboardType
       1873  16D 00027DE0 GetLastActivePopup
       1874  16E 00024260 GetLastInputInfo
       1875  16F 00041B40 GetLayeredWindowAttributes
       1876  170 00041B50 GetListBoxInfo
       1877  171 0007CB00 GetMagnificationDesktopColorEffect
       1878  172 0007CB80 GetMagnificationDesktopMagnification
       1879  173 0007CC10 GetMagnificationDesktopSamplingMode
       1880  174 00041B60 GetMagnificationLensCtxInformation
       1881  175 00034920 GetMenu
       1882  176 00041B70 GetMenuBarInfo
       1883  177 0007EE20 GetMenuCheckMarkDimensions
       1884  178 0007EE60 GetMenuContextHelpId
       1885  179 0007EE80 GetMenuDefaultItem
       1886  17A 0005D320 GetMenuInfo
       1887  17B 00021F00 GetMenuItemCount
       1888  17C 00021F50 GetMenuItemID
       1889  17D 00094830 GetMenuItemInfoA
       1890  17E 000215B0 GetMenuItemInfoW
       1891  17F 00041B80 GetMenuItemRect
       1892  180 000214E0 GetMenuState
       1893  181 000948D0 GetMenuStringA
       1894  182 00020270 GetMenuStringW
       1895  183 00023C30 GetMessageA
       1896  184 000408F0 GetMessageExtraInfo
       1897  185 000406C0 GetMessagePos
       1898  186 000406F0 GetMessageTime
       1899  187 0003B850 GetMessageW
       1900  188 000246B0 GetMonitorInfoA
       1901  189 00032E50 GetMonitorInfoW
       1902  18A 00041B90 GetMouseMovePointsEx
       1903  18B 00066E30 GetNextDlgGroupItem
       1904  18C 0002C5A0 GetNextDlgTabItem
       1905  18D 00041138 GetOpenClipboardWindow
       1906  18E 000377E0 GetParent
       1907  18F 00025830 GetPhysicalCursorPos
       1908  190 00041BC0 GetPointerCursorId
       1909  191 00041BD0 GetPointerDevice
       1910  192 00041BE0 GetPointerDeviceCursors
       1911  193 00041BF0 GetPointerDeviceInputSpace
       1912  194 00041C00 GetPointerDeviceOrientation
       1913  195 00041C10 GetPointerDeviceProperties
       1914  196 00041C20 GetPointerDeviceRects
       1915  197 00041C30 GetPointerDevices
       1503  198 0005DBB0 GetPointerFrameArrivalTimes
       1916  199 0005DD00 GetPointerFrameInfo
       1917  19A 0005DD30 GetPointerFrameInfoHistory
       1918  19B 0005DD60 GetPointerFramePenInfo
       1919  19C 0005DD90 GetPointerFramePenInfoHistory
       1920  19D 00041C40 GetPointerFrameTimes
       1921  19E 0005DDC0 GetPointerFrameTouchInfo
       1922  19F 0005DE00 GetPointerFrameTouchInfoHistory
       1923  1A0 0005DE30 GetPointerInfo
       1924  1A1 0005DE70 GetPointerInfoHistory
       1925  1A2 00041C50 GetPointerInputTransform
       1926  1A3 0005DEA0 GetPointerPenInfo
       1927  1A4 0005DEE0 GetPointerPenInfoHistory
       1928  1A5 0005DF10 GetPointerTouchInfo
       1929  1A6 0005DF50 GetPointerTouchInfoHistory
       1930  1A7 00041C70 GetPointerType
       1931  1A8 0008B840 GetPriorityClipboardFormat
       1932  1A9 000907C0 GetProcessDefaultLayout
       1933  1AA 0002AD50 GetProcessDpiAwarenessInternal
       2521  1AB 00041C90 GetProcessUIContextInformation
       1934  1AC 00041CA0 GetProcessWindowStation
       1935  1AD 000907E0 GetProgmanWindow
       1936  1AE 000251D0 GetPropA
       1937  1AF 0003C2D0 GetPropW
       1938  1B0 0003B600 GetQueueStatus
       1939  1B1 0006DEB0 GetRawInputBuffer
       1940  1B2 00041CC0 GetRawInputData
       1941  1B3 00094920 GetRawInputDeviceInfoA
       1942  1B4 00091AB0 GetRawInputDeviceInfoW
       1943  1B5 00041CD0 GetRawInputDeviceList
       1944  1B6 00041CE0 GetRawPointerDeviceData
       1945  1B7 00084B80 GetReasonTitleFromReasonCode
       1946  1B8 00041CF0 GetRegisteredRawInputDevices
       1947  1B9 00041D10 GetScrollBarInfo
       1948  1BA 000255B0 GetScrollInfo
       1949  1BB 00028110 GetScrollPos
       1950  1BC 000293F0 GetScrollRange
       1951  1BD 00090840 GetSendMessageReceiver
       1952  1BE 00040A40 GetShellChangeNotifyWindow
       1953  1BF 000407C0 GetShellWindow
       1954  1C0 00021E30 GetSubMenu
       1955  1C1 0002D460 GetSysColor
       1956  1C2 0003FB90 GetSysColorBrush
       1957  1C3 00041D20 GetSystemDpiForProcess
       1958  1C4 00041D30 GetSystemMenu
       1959  1C5 00034DF0 GetSystemMetrics
       1960  1C6 00035FF0 GetSystemMetricsForDpi
       1961  1C7 00064160 GetTabbedTextExtentA
       1962  1C8 00064200 GetTabbedTextExtentW
       1963  1C9 00090860 GetTaskmanWindow
       1964  1CA 00041D40 GetThreadDesktop
       1965  1CB 0003ED10 GetThreadDpiAwarenessContext
       1966  1CC 000908C0 GetThreadDpiHostingBehavior
       1967  1CD 00041D50 GetTitleBarInfo
       1968  1CE 00041D60 GetTopLevelWindow
       1969  1CF 0001FF10 GetTopWindow
       1970  1D0 0005F060 GetTouchInputInfo
       1971  1D1 00090910 GetUnpredictedMessagePos
       1972  1D2 000271C0 GetUpdateRect
       1973  1D3 00025880 GetUpdateRgn
       1974  1D4 0008B870 GetUpdatedClipboardFormats
       1975  1D5 0002C220 GetUserObjectInformationA
       1976  1D6 00041D90 GetUserObjectInformationW
       1977  1D7 00090920 GetUserObjectSecurity
       1978  1D8 00090960 GetWinStationInfo
       1979  1D9 0003C170 GetWindow
       1980  1DA 00041DA0 GetWindowBand
       1981  1DB 00041DB0 GetWindowCompositionAttribute
       1982  1DC 00041DC0 GetWindowCompositionInfo
       1983  1DD 00090980 GetWindowContextHelpId
       1984  1DE 00041DD0 GetWindowDC
       1985  1DF 00041DE0 GetWindowDisplayAffinity
       1986  1E0 00025AB0 GetWindowDpiAwarenessContext
       1987  1E1 000909A0 GetWindowDpiHostingBehavior
       1988  1E2 00041DF0 GetWindowFeedbackSetting
       1989  1E3 00035360 GetWindowInfo
       1990  1E4 00035140 GetWindowLongA
       1991  1E5 000389E0 GetWindowLongW
       1992  1E6 00041E10 GetWindowMinimizeRect
       1993  1E7 00094A10 GetWindowModuleFileName
       1994  1E8 00094A10 GetWindowModuleFileNameA
       1995  1E9 00091AD0 GetWindowModuleFileNameW
       1996  1EA 00041E20 GetWindowPlacement
       1997  1EB 00041E30 GetWindowProcessHandle
       1998  1EC 00034F10 GetWindowRect
       1999  1ED 0002A750 GetWindowRgn
       2000  1EE 0003A760 GetWindowRgnBox
       2003  1EF 00041E40 GetWindowRgnEx
       2004  1F0 00025A30 GetWindowTextA
       2006  1F1 00029BE0 GetWindowTextLengthA
       2007  1F2 0003A980 GetWindowTextLengthW
       2008  1F3 0003A210 GetWindowTextW
       2009  1F4 0003AB20 GetWindowThreadProcessId
       2011  1F5 0002A5E0 GetWindowWord
       2012  1F6 00041E50 GhostWindowFromHungWindow
       2013  1F7 00090A20 GrayStringA
       2014  1F8 00090A50 GrayStringW
       2505  1F9 00041E60 HandleDelegatedInput
       2015  1FA 00029880 HideCaret
       2016  1FB 00041E80 HiliteMenuItem
       2017  1FC 00041E90 HungWindowFromGhostWindow
       2018  1FD 0008AE60 IMPGetIMEA
       2019  1FE 0008AE90 IMPGetIMEW
       2020  1FF 0008AEC0 IMPQueryIMEA
       2021  200 0008AEF0 IMPQueryIMEW
       2022  201 0008AF20 IMPSetIMEA
       2023  202 0008AF50 IMPSetIMEW
       2024  203 00041EA0 ImpersonateDdeClientWindow
       2025  204 0005DA20 InSendMessage
       2026  205 0003EDB0 InSendMessageEx
       2027  206 0002DF00 InflateRect
       2028  207 00041EB0 InheritWindowMonitor
       2029  208 0002A9B0 InitDManipHook
       2030  209 00041EC0 InitializeGenericHidInjection
       2031  20A 00041ED0 InitializeInputDeviceInjection
       2032  20B 0003FF90 InitializeLpkHooks
       2033  20C 00041EE0 InitializePointerDeviceInjection
       2034  20D 00041EF0 InitializePointerDeviceInjectionEx
       2035  20E 00041F00 InitializeTouchInjection
       2036  20F 00041F10 InjectDeviceInput
       2037  210 00041F20 InjectGenericHidInput
       2038  211 00041F30 InjectKeyboardInput
       2039  212 00041F40 InjectMouseInput
       2040  213 00041F50 InjectPointerInput
       2041  214 00041F50 InjectSyntheticPointerInput
       2042  215 00041F60 InjectTouchInput
       2043  216 00041F70 InputSpaceRegionFromPoint
       2044  217 00094A60 InsertMenuA
       2045  218 00094AB0 InsertMenuItemA
       2046  219 00020CC0 InsertMenuItemW
       2047  21A 00091B20 InsertMenuW
       2048  21B 00082F60 InternalGetWindowIcon
       2049  21C 00025710 InternalGetWindowText
       2050  21D 000308B0 IntersectRect
       2051  21E 00041F90 InvalidateRect
       2052  21F 00041FA0 InvalidateRgn
       2053  220 000976F0 InvertRect
       2054  221 0008B8A0 IsCharAlphaA
       2055  222 0008B8C0 IsCharAlphaNumericA
       2056  223 0008B8E0 IsCharAlphaNumericW
       2057  224 0008B900 IsCharAlphaW
       2058  225 0008B920 IsCharLowerA
       2059  226 0008B940 IsCharLowerW
       2060  227 0008B960 IsCharUpperA
       2061  228 0008B980 IsCharUpperW
       2062  229 000382F0 IsChild
       2063  22A 00028D70 IsClipboardFormatAvailable
       2064  22B 0002B360 IsDialogMessage
       2065  22C 0002B360 IsDialogMessageA
       2066  22D 00039EC0 IsDialogMessageW
       2067  22E 0002BB30 IsDlgButtonChecked
       2068  22F 00040780 IsGUIThread
       2069  230 0002C370 IsHungAppWindow
       2070  231 000387B0 IsIconic
       2071  232 00040540 IsImmersiveProcess
       2072  233 000894E0 IsInDesktopWindowBand
       2073  234 00022190 IsMenu
       2074  235 00041FC0 IsMouseInPointerEnabled
       2075  236 00041FF0 IsOneCoreTransformMode
       2076  237 0003C690 IsProcessDPIAware
       2077  238 00090B20 IsQueueAttached
       2078  239 0003E830 IsRectEmpty
       2079  23A 00084C90 IsSETEnabled
       2080  23B 00039320 IsServerSideWindow
       2081  23C 00035820 IsThreadDesktopComposited
       2528  23D 00028030 IsThreadMessageQueueAttached
       2082  23E 00088860 IsThreadTSFEventAware
       2083  23F 00042010 IsTopLevelWindow
       2084  240 00042020 IsTouchWindow
       2085  241 00090B70 IsValidDpiAwarenessContext
       2086  242 0003EB70 IsWinEventHookInstalled
       2087  243 0003A4C0 IsWindow
       2088  244 00090B90 IsWindowArranged
       2089  245 00034DA0 IsWindowEnabled
       2090  246 00038780 IsWindowInDestroy
       2091  247 00039E20 IsWindowRedirectedForPrint
       2092  248 00035F90 IsWindowUnicode
       2093  249 00035910 IsWindowVisible
       2094  24A 0005DA60 IsWow64Message
       2095  24B 00038610 IsZoomed
       2096  24C 00042050 KillTimer
       2097  24D 0002B230 LoadAcceleratorsA
       2098  24E 000311A0 LoadAcceleratorsW
       2099  24F 0002BAD0 LoadBitmapA
       2100  250 0002B430 LoadBitmapW
       2101  251 00040590 LoadCursorA
       2102  252 00058610 LoadCursorFromFileA
       2103  253 00058660 LoadCursorFromFileW
       2104  254 00032DB0 LoadCursorW
       2105  255 00029D30 LoadIconA
       2106  256 00040750 LoadIconW
       2107  257 0002AC60 LoadImageA
       2108  258 000317F0 LoadImageW
       2109  259 00090BD0 LoadKeyboardLayoutA
       2110  25A 00090C40 LoadKeyboardLayoutEx
       2111  25B 00090C70 LoadKeyboardLayoutW
       2112  25C 00090C90 LoadLocalFonts
       2113  25D 0002BDB0 LoadMenuA
       2114  25E 00030960 LoadMenuIndirectA
       2115  25F 00030960 LoadMenuIndirectW
       2116  260 00030920 LoadMenuW
       2117  261 00090D50 LoadRemoteFonts
       2118  262 00025260 LoadStringA
       2119  263 0003F0C0 LoadStringW
       2120  264 00090D70 LockSetForegroundWindow
       2121  265 00042070 LockWindowStation
       2122  266 00042080 LockWindowUpdate
       2123  267 00042090 LockWorkStation
       2124  268 000420B0 LogicalToPhysicalPoint
       2125  269 000420C0 LogicalToPhysicalPointForPerMonitorDPI
       2126  26A 0005EBB0 LookupIconIdFromDirectory
       2127  26B 00024DF0 LookupIconIdFromDirectoryEx
       2128  26C 00023760 MBToWCSEx
       2129  26D 000229A0 MBToWCSExt
       2130  26E 00080F10 MB_GetString
       2131  26F 000852A0 MITGetCursorUpdateHandle
       2132  270 000852B0 MITSetForegroundRoutingInfo
       2133  271 000852C0 MITSetInputDelegationMode
       2134  272 000852E0 MITSetLastInputRecipient
       2135  273 00085300 MITSynthesizeTouchInput
       2136  274 000888D0 MakeThreadTSFEventAware
       2137  275 000298A0 MapDialogRect
       2138  276 000420D0 MapPointsByVisualIdentifier
       2139  277 0002AC30 MapVirtualKeyA
       2140  278 0008AA40 MapVirtualKeyExA
       2141  279 0002A970 MapVirtualKeyExW
       2142  27A 0002AFD0 MapVirtualKeyW
       2143  27B 000420E0 MapVisualRelativePoints
       2144  27C 00034CE0 MapWindowPoints
       2145  27D 000420F0 MenuItemFromPoint
       2146  27E 0005DAA0 MenuWindowProcA
       2147  27F 0005DB10 MenuWindowProcW
       2148  280 00090D90 MessageBeep
       2149  281 00080F40 MessageBoxA
       2150  282 00080F90 MessageBoxExA
       2151  283 00080FC0 MessageBoxExW
       2152  284 00080FF0 MessageBoxIndirectA
       2153  285 00081130 MessageBoxIndirectW
       2154  286 000811C0 MessageBoxTimeoutA
       2155  287 000812A0 MessageBoxTimeoutW
       2156  288 00081460 MessageBoxW
       2157  289 00094AF0 ModifyMenuA
       2158  28A 00091B70 ModifyMenuW
       2159  28B 00030B00 MonitorFromPoint
       2160  28C 00029270 MonitorFromRect
       2161  28D 000395E0 MonitorFromWindow
       2162  28E 00042100 MoveWindow
       2163  28F 0003C430 MsgWaitForMultipleObjects
       2164  290 0003C460 MsgWaitForMultipleObjectsEx
       2165  291 00090DB0 NotifyOverlayWindow
       2166  292 0003EBC0 NotifyWinEvent
       2167  293 000835F0 OemKeyScan
       2168  294 00083660 OemToCharA
       2169  295 000836B0 OemToCharBuffA
       2170  296 00083700 OemToCharBuffW
       2171  297 00083740 OemToCharW
       2172  298 0003AA80 OffsetRect
       2173  299 00029790 OpenClipboard
       2174  29A 00090DD0 OpenDesktopA
       2175  29B 00090E20 OpenDesktopW
       2176  29C 00090E50 OpenIcon
       2177  29D 00042120 OpenInputDesktop
       2178  29E 00042130 OpenThreadDesktop
       2179  29F 00090E90 OpenWindowStationA
       2180  2A0 00090EE0 OpenWindowStationW
       2181  2A1 00066130 PackDDElParam
       2182  2A2 00087FF0 PackTouchHitTestingProximityEvaluation
       2183  2A3 00082F80 PaintDesktop
       2184  2A4 00042140 PaintMenuBar
       2185  2A5 00042150 PaintMonitor
       2186  2A6 00020070 PeekMessageA
       2187  2A7 0003B8C0 PeekMessageW
       2188  2A8 00042170 PhysicalToLogicalPoint
       2189  2A9 00042180 PhysicalToLogicalPointForPerMonitorDPI
       2190  2AA 00023AE0 PostMessageA
       2191  2AB 00035960 PostMessageW
       2192  2AC 00040AD0 PostQuitMessage
       2193  2AD 00023A20 PostThreadMessageA
       2194  2AE 0003B230 PostThreadMessageW
       2195  2AF 00042190 PrintWindow
       2196  2B0 0006DCF0 PrivateExtractIconExA
       2197  2B1 0006DD50 PrivateExtractIconExW
       2198  2B2 0006DE50 PrivateExtractIconsA
       2199  2B3 00020310 PrivateExtractIconsW
       2200  2B4 0002C300 PrivateRegisterICSProc
       2201  2B5 00024490 PtInRect
       2202  2B6 000421D0 QueryBSDRWindow
       2203  2B7 00029D70 QueryDisplayConfig
       2204  2B8 000421E0 QuerySendMessage
       2205  2B9 000421F0 RIMAddInputObserver
       2206  2BA 00042200 RIMAreSiblingDevices
       2207  2BB 00042210 RIMDeviceIoControl
       2208  2BC 00042220 RIMEnableMonitorMappingForDevice
       2209  2BD 00042230 RIMFreeInputBuffer
       2210  2BE 00042240 RIMGetDevicePreparsedData
       2211  2BF 00042250 RIMGetDevicePreparsedDataLockfree
       2212  2C0 00042260 RIMGetDeviceProperties
       2213  2C1 00042270 RIMGetDevicePropertiesLockfree
       2214  2C2 00042280 RIMGetPhysicalDeviceRect
       2215  2C3 00042290 RIMGetSourceProcessId
       2216  2C4 000422A0 RIMObserveNextInput
       2217  2C5 000422B0 RIMOnPnpNotification
       2218  2C6 000422C0 RIMOnTimerNotification
       2219  2C7 000422D0 RIMQueryDevicePath
       2220  2C8 000422E0 RIMReadInput
       2221  2C9 000422F0 RIMRegisterForInput
       2222  2CA 00042300 RIMRemoveInputObserver
       2223  2CB 00042310 RIMSetExtendedDeviceProperty
       2224  2CC 00042320 RIMSetTestModeStatus
       2225  2CD 00042330 RIMUnregisterForInput
       2226  2CE 00042340 RIMUpdateInputObserverRegistration
       2227  2CF 00042350 RealChildWindowFromPoint
       2228  2D0 0008AAE0 RealGetWindowClass
       2229  2D1 0008AAE0 RealGetWindowClassA
       2230  2D2 0003FBF0 RealGetWindowClassW
       2231  2D3 00084E30 ReasonCodeNeedsBugID
       2232  2D4 00084E50 ReasonCodeNeedsComment
       2233  2D5 00063A90 RecordShutdownReason
       2234  2D6 00042360 RedrawWindow
       2235  2D7 00042370 RegisterBSDRWindow
       2236  2D8 000221F0 RegisterClassA
       2237  2D9 000221C0 RegisterClassExA
       2238  2DA 0002E4B0 RegisterClassExW
       2239  2DB 0002F6A0 RegisterClassW
       2240  2DC 0003E8A0 RegisterClipboardFormatA
       2241  2DD 0003FA20 RegisterClipboardFormatW
       2242  2DE 00042380 RegisterDManipHook
       2243  2DF 00040960 RegisterDeviceNotificationA
       2244  2E0 0002BEE0 RegisterDeviceNotificationW
       2245  2E1 00042390 RegisterErrorReportingDialog
       2246  2E2 00090F50 RegisterFrostWindow
       2247  2E3 00090F70 RegisterGhostWindow
       2248  2E4 000423A0 RegisterHotKey
       2249  2E5 00091BE0 RegisterLogonProcess
       2250  2E6 0002AFF0 RegisterMessagePumpHook
       2251  2E7 000423B0 RegisterPointerDeviceNotifications
       2252  2E8 0005DFB0 RegisterPointerInputTarget
       2253  2E9 0005DFD0 RegisterPointerInputTargetEx
       2254  2EA 00040850 RegisterPowerSettingNotification
       2255  2EB 000423C0 RegisterRawInputDevices
       2256  2EC 000423D0 RegisterServicesProcess
       2257  2ED 000423E0 RegisterSessionPort
       2258  2EE 0002C330 RegisterShellHookWindow
       2259  2EF 00083100 RegisterSuspendResumeNotification
       2260  2F0 00090FB0 RegisterSystemThread
       2261  2F1 00042400 RegisterTasklist
       2262  2F2 00042410 RegisterTouchHitTestingWindow
       2263  2F3 00083160 RegisterTouchWindow
       2264  2F4 00083180 RegisterUserApiHook
       2265  2F5 0003E8A0 RegisterWindowMessageA
       2266  2F6 0003FA20 RegisterWindowMessageW
       2267  2F7 00029200 ReleaseCapture
       2268  2F8 0003E860 ReleaseDC
       2269  2F9 00042430 ReleaseDwmHitTestWaiters
       2270  2FA 00040FB0 RemoveClipboardFormatListener
       2271  2FB 00041740 RemoveInjectionDevice
       2272  2FC 00042440 RemoveMenu
       2273  2FD 000296E0 RemovePropA
       2274  2FE 0003EF90 RemovePropW
       2275  2FF 00088930 RemoveThreadTSFEventAwareness
       2276  300 00042450 RemoveVisualIdentifier
       2277  301 00091020 ReplyMessage
       2551  302 0005DFF0 ReportInertia
       2278  303 00042470 ResolveDesktopForWOW
       2279  304 000661A0 ReuseDDElParam
       2280  305 000390E0 ScreenToClient
       2281  306 0007E8D0 ScrollChildren
       2282  307 0002C1F0 ScrollDC
       2283  308 0002A570 ScrollWindow
       2284  309 00027E70 ScrollWindowEx
       2285  30A 00024340 SendDlgItemMessageA
       2286  30B 0003AF00 SendDlgItemMessageW
       2287  30C 0008AF80 SendIMEMessageExA
       2288  30D 0008AFB0 SendIMEMessageExW
       2289  30E 000424A0 SendInput
       2290  30F 00024380 SendMessageA
       2291  310 0008AB70 SendMessageCallbackA
       2292  311 00040280 SendMessageCallbackW
       2293  312 00025230 SendMessageTimeoutA
       2294  313 0003B300 SendMessageTimeoutW
       2295  314 00035A10 SendMessageW
       2296  315 0008ABF0 SendNotifyMessageA
       2297  316 00040330 SendNotifyMessageW
       2298  317 000424E0 SetActiveWindow
       2299  318 00042530 SetCapture
       2300  319 0002C180 SetCaretBlinkTime
       2301  31A 0002AD10 SetCaretPos
       2302  31B 0002BD30 SetClassLongA
       2303  31C 0002B450 SetClassLongW
       2304  31D 00042550 SetClassWord
       2305  31E 00028320 SetClipboardData
       2306  31F 0002C260 SetClipboardViewer
       2307  320 00042560 SetCoalescableTimer
       2571  321 00042570 SetCoreWindow
       2308  322 0004112C SetCursor
       2309  323 00042590 SetCursorContents
       2310  324 000425B0 SetCursorPos
       2311  325 00091040 SetDebugErrorLevel
       2312  326 00091050 SetDeskWallpaper
       2313  327 000425C0 SetDesktopColorTransform
       2314  328 000425E0 SetDialogControlDpiChangeBehavior
       2315  329 00066BF0 SetDialogDpiChangeBehavior
       2316  32A 000425F0 SetDisplayAutoRotationPreferences
       2317  32B 00096190 SetDisplayConfig
       2318  32C 0002B940 SetDlgItemInt
       2319  32D 000270E0 SetDlgItemTextA
       2320  32E 0002B9D0 SetDlgItemTextW
       2321  32F 00091070 SetDoubleClickTime
       2322  330 00042620 SetFeatureReportResponse
       2323  331 00042630 SetFocus
       2324  332 00040940 SetForegroundWindow
       2325  333 00042650 SetFullscreenMagnifierOffsetsDWMUpdated
       2326  334 00042660 SetGestureConfig
       2327  335 000426A0 SetInternalWindowPos
       2328  336 000426B0 SetKeyboardState
       2329  337 000837B0 SetLastErrorEx
       2330  338 000426C0 SetLayeredWindowAttributes
       2331  339 0007CCE0 SetMagnificationDesktopColorEffect
       2332  33A 0007CD50 SetMagnificationDesktopMagnification
       2333  33B 000426D0 SetMagnificationDesktopMagnifierOffsetsDWMUpdated
       2334  33C 0007CDA0 SetMagnificationDesktopSamplingMode
       2335  33D 000426E0 SetMagnificationLensCtxInformation
       2336  33E 0002C030 SetMenu
       2337  33F 000426F0 SetMenuContextHelpId
       2338  340 00042700 SetMenuDefaultItem
       2339  341 0007EEC0 SetMenuInfo
       2340  342 0007EEF0 SetMenuItemBitmaps
       2341  343 00094B40 SetMenuItemInfoA
       2342  344 000202C0 SetMenuItemInfoW
       2343  345 0005DB80 SetMessageExtraInfo
       2344  346 000910A0 SetMessageQueue
       2345  347 00042710 SetMirrorRendering
       2346  348 00040820 SetParent
       2347  349 000425B0 SetPhysicalCursorPos
       2348  34A 00042720 SetPointerDeviceInputSpace
       2349  34B 0002BC30 SetProcessDPIAware
       2350  34C 000910D0 SetProcessDefaultLayout
       2351  34D 0003E740 SetProcessDpiAwarenessContext
       2352  34E 0003CD20 SetProcessDpiAwarenessInternal
       2353  34F 00042760 SetProcessRestrictionExemption
       2354  350 00042770 SetProcessWindowStation
       2355  351 000910F0 SetProgmanWindow
       2356  352 000285A0 SetPropA
       2357  353 0003F0F0 SetPropW
       2358  354 0003ECD0 SetRect
       2359  355 0003F0A0 SetRectEmpty
       2360  356 0001F310 SetScrollInfo
       2361  357 0001CD80 SetScrollPos
       2362  358 0001D300 SetScrollRange
       2363  359 00091110 SetShellChangeNotifyWindow
       2364  35A 00091130 SetShellWindow
       2365  35B 00042790 SetShellWindowEx
       2366  35C 000831E0 SetSysColors
       2367  35D 000837D0 SetSysColorsTemp
       2368  35E 00083200 SetSystemCursor
       2369  35F 000427A0 SetSystemMenu
       2370  360 00091170 SetTaskmanWindow
       2371  361 00041114 SetThreadDesktop
       2372  362 0002BB60 SetThreadDpiAwarenessContext
       2373  363 00091190 SetThreadDpiHostingBehavior
       2374  364 000427C0 SetThreadInputBlocked
       2375  365 0003EE40 SetTimer
       2376  366 00091270 SetUserObjectInformationA
       2377  367 000912C0 SetUserObjectInformationW
       2378  368 000912D0 SetUserObjectSecurity
       2379  369 00040110 SetWinEventHook
       2380  36A 000427E0 SetWindowBand
       2381  36B 0003FF60 SetWindowCompositionAttribute
       2382  36C 000427F0 SetWindowCompositionTransition
       2383  36D 0002C3B0 SetWindowContextHelpId
       2384  36E 00042800 SetWindowDisplayAffinity
       2385  36F 00042810 SetWindowFeedbackSetting
       2386  370 000281B0 SetWindowLongA
       2387  371 000358F0 SetWindowLongW
       2388  372 00042830 SetWindowPlacement
       2389  373 00042840 SetWindowPos
       2390  374 00025940 SetWindowRgn
       2391  375 00083240 SetWindowRgnEx
       2392  376 00083270 SetWindowStationUser
       2393  377 00027110 SetWindowTextA
       2394  378 0003A9D0 SetWindowTextW
       2395  379 00042860 SetWindowWord
       2396  37A 0005C8E0 SetWindowsHookA
       2397  37B 0002ADF0 SetWindowsHookExA
       2398  37C 00045260 SetWindowsHookExAW
       2399  37D 000408C0 SetWindowsHookExW
       2400  37E 0005C900 SetWindowsHookW
       2401  37F 00029D10 ShowCaret
       2402  380 00042870 ShowCursor
       2403  381 0002C390 ShowOwnedPopups
       2404  382 00042880 ShowScrollBar
       2405  383 00091310 ShowStartGlass
       2406  384 00042890 ShowSystemCursor
       2407  385 000428A0 ShowWindow
       2408  386 000428B0 ShowWindowAsync
       2409  387 00091330 ShutdownBlockReasonCreate
       2410  388 000428C0 ShutdownBlockReasonDestroy
       2411  389 000428D0 ShutdownBlockReasonQuery
       2412  38A 000428E0 SignalRedirectionStartComplete
       2413  38B 000428F0 SkipPointerFrameMessages
       2414  38C 000814B0 SoftModalMessageBox
       2415  38D 00042910 SoundSentry
       2416  38E 00096B20 SubtractRect
       2417  38F 00091370 SwapMouseButton
       2418  390 00091390 SwitchDesktop
       2419  391 000913B0 SwitchDesktopWithFade
       2420  392 000913D0 SwitchToThisWindow
       2421  393 00027F70 SystemParametersInfoA
       2422  394 0003FC50 SystemParametersInfoForDpi
       2423  395 000350A0 SystemParametersInfoW
       2424  396 00064270 TabbedTextOutA
       2425  397 00064310 TabbedTextOutW
       2426  398 000913F0 TileChildWindows
       2427  399 0007E900 TileWindows
       2428  39A 0002B8B0 ToAscii
       2429  39B 00091420 ToAsciiEx
       2430  39C 0002B900 ToUnicode
       2431  39D 000299A0 ToUnicodeEx
       2432  39E 00042920 TrackMouseEvent
       2433  39F 0007EF60 TrackPopupMenu
       2434  3A0 00042930 TrackPopupMenuEx
       2435  3A1 00023A80 TranslateAccelerator
       2436  3A2 00023A80 TranslateAcceleratorA
       2437  3A3 000252D0 TranslateAcceleratorW
       2438  3A4 0007E930 TranslateMDISysAccel
       2439  3A5 0003A690 TranslateMessage
       2440  3A6 000832C0 TranslateMessageEx
       2504  3A7 00042940 UndelegateInput
       2441  3A8 00042950 UnhookWinEvent
       2442  3A9 00091510 UnhookWindowsHook
       2443  3AA 00040900 UnhookWindowsHookEx
       2444  3AB 000240A0 UnionRect
       2445  3AC 00091530 UnloadKeyboardLayout
       2446  3AD 00042960 UnlockWindowStation
       2447  3AE 00066240 UnpackDDElParam
       2448  3AF 000292C0 UnregisterClassA
       2449  3B0 0002F590 UnregisterClassW
       2450  3B1 0002C070 UnregisterDeviceNotification
       2451  3B2 00042970 UnregisterHotKey
       2452  3B3 0002B540 UnregisterMessagePumpHook
       2453  3B4 0005E040 UnregisterPointerInputTarget
       2454  3B5 0005E060 UnregisterPointerInputTargetEx
       2455  3B6 0002C160 UnregisterPowerSettingNotification
       2456  3B7 00042980 UnregisterSessionPort
       2457  3B8 00083310 UnregisterSuspendResumeNotification
       2458  3B9 00083340 UnregisterTouchWindow
       2459  3BA 00042990 UnregisterUserApiHook
       2460  3BB 000429A0 UpdateDefaultDesktopThumbnail
       2461  3BC 00029640 UpdateLayeredWindow
       2462  3BD 00025B00 UpdateLayeredWindowIndirect
       2463  3BE 00083360 UpdatePerUserSystemParameters
       2464  3BF 000349B0 UpdateWindow
       2465  3C0 000429B0 UpdateWindowInputSinkHints
       2466  3C1 0003CD70 User32InitializeImmEntryTable
       2467  3C2 0003CE50 UserClientDllInitialize
       2468  3C3 000429D0 UserHandleGrantAccess
       2469  3C4 00064340 UserLpkPSMTextOut
       2470  3C5 00064520 UserLpkTabbedTextOut
       2471  3C6 0002A6D0 UserRealizePalette
       2472  3C7 00091560 UserRegisterWowHandlers
       2473  3C8 000996B0 VRipOutput
       2474  3C9 000996C0 VTagOutput
       2475  3CA 000429E0 ValidateRect
       2476  3CB 00029BC0 ValidateRgn
       2477  3CC 0008AC60 VkKeyScanA
       2478  3CD 0008ACB0 VkKeyScanExA
       2479  3CE 0002B400 VkKeyScanExW
       2480  3CF 0002A550 VkKeyScanW
       2481  3D0 0002C4D0 WCSToMBEx
       2482  3D1 0008AFE0 WINNLSEnableIME
       2483  3D2 0008B010 WINNLSGetEnableStatus
       2484  3D3 0008B040 WINNLSGetIMEHotkey
       2485  3D4 00091720 WaitForInputIdle
       2486  3D5 00042A00 WaitForRedirectionStartComplete
       2487  3D6 00042A10 WaitMessage
       2488  3D7 0002B5E0 WinHelpA
       2489  3D8 0006F030 WinHelpW
       2490  3D9 00042A20 WindowFromDC
       2491  3DA 00042A30 WindowFromPhysicalPoint
       2492  3DB 00042A40 WindowFromPoint
       1504  3DC 000AA054 Wow64Transition
       2493  3DD 00088710 _UserTestTokenForInteractive
       2494  3DE 000A59F8 gSharedInfo
       2495  3DF 000015F8 gapfnScSendMessage
       2496  3E0 00083450 keybd_event
       2497  3E1 000834A0 mouse_event
       2498  3E2 000288D0 wsprintfA
       2499  3E3 000278B0 wsprintfW
       2500  3E4 000288F0 wvsprintfA
       2501  3E5 000278D0 wvsprintfW
       1502      0005F090 [NONAME]
       1550      00084F70 [NONAME]
       1551      00085000 [NONAME]
       1552      00084F30 [NONAME]
       1554      00084FF0 [NONAME]
       2001      0007CDD