;note that the Zw... functions are alternate names for the ;Nt... functions. (see www.sysinternals.com for details) ;if you change a Nt.. function DON'T FORGET to change the ;Zw one too. LIBRARY ntdll.dll EXPORTS DbgBreakPoint@0 DbgPrint DbgUiConnectToDbg@0 DbgUiContinue@8 DbgUiWaitStateChange@8 DbgUserBreakPoint@0 LdrGetProcedureAddress@16 LdrProcessRelocationBlock@16 NlsAnsiCodePage NlsMbCodePageTag NlsMbOemCodePageTag NtAllocateVirtualMemory@24 NtClose@4 NtCreateFile@44 NtCurrentTeb@0 NtDisplayString@4 NtFlushVirtualMemory@16 NtFreeVirtualMemory@16 NtLockVirtualMemory@16 NtOpenFile@24 NtProtectVirtualMemory@20 NtQueryVirtualMemory@24 NtReadFile@36 NtReadVirtualMemory@20 NtShutdownSystem@4 NtUnlockVirtualMemory@16 NtWriteFile@36 NtWriteVirtualMemory@20 RtlAcquirePebLock@0 RtlAllocateAndInitializeSid@44 RtlAllocateHandle@8 RtlAllocateHeap@12 RtlAnsiCharToUnicodeChar@4 RtlAnsiStringToUnicodeSize@4 RtlAnsiStringToUnicodeString@12 RtlAppendAsciizToString@8 RtlAppendStringToString@8 RtlAppendUnicodeStringToString@8 RtlAppendUnicodeToString@8 RtlAreBitsClear@12 RtlAreBitsSet@12 RtlCharToInteger@12 RtlClearAllBits@4 RtlClearBits@12 RtlCompareMemory@12 RtlCompareMemoryUlong@12 RtlCompareString@12 RtlCompareUnicodeString@12 RtlConvertSidToUnicodeString@12 RtlCopySid@12 RtlCopyString@8 RtlCopyUnicodeString@8 RtlCreateEnvironment@8 RtlCreateHeap@24 RtlCreateProcessParameters@40 RtlCreateUnicodeString@8 RtlDeNormalizeProcessParams@4 RtlDestroyEnvironment@4 RtlDestroyHandleTable@4 RtlDestroyHeap@4 RtlDestroyProcessParameters@4 RtlDetermineDosPathNameType_U@4 RtlDoesFileExists_U@4 RtlDosPathNameToNtPathName_U@16 RtlDosSearchPath_U@24 RtlDowncaseUnicodeString@12 RtlEnumProcessHeaps@8 RtlEqualComputerName@8 RtlEqualDomainName@8 RtlEqualPrefixSid@8 RtlEqualSid@8 RtlEqualString@12 RtlEqualUnicodeString@12 RtlEraseUnicodeString@4 RtlExpandEnvironmentStrings_U@16 RtlFillMemory@12 RtlFillMemoryUlong@12 RtlFindClearBits@12 RtlFindClearBitsAndSet@12 RtlFindLongestRunClear@8 RtlFindLongestRunSet@8 RtlFindSetBits@12 RtlFindSetBitsAndClear@12 RtlFreeAnsiString@4 RtlFreeHandle@8 RtlFreeHeap@12 RtlFreeOemString@4 RtlFreeSid@4 RtlFreeUnicodeString@4 RtlGetCurrentDirectory_U@8 RtlGetFullPathName_U@16 RtlGetLongestNtPathLength@0 RtlGetNtGlobalFlags@0 RtlGetProcessHeaps@8 RtlIdentifierAuthoritySid@4 RtlImageDirectoryEntryToData@16 RtlImageNtHeader@4 RtlImageRvaToSection@12 RtlImageRvaToVa@16 RtlInitAnsiString@8 RtlInitCodePageTable@8 RtlInitNlsTables@16 RtlInitString@8 RtlInitUnicodeString@8 RtlInitializeBitMap@12 RtlInitializeHandleTable@12 RtlInitializeSid@12 RtlIntegerToChar@16 RtlIntegerToUnicodeString@12 RtlIsDosDeviceName_U@4 RtlIsNameLegalDOS8Dot3@12 RtlIsValidHandle@8 RtlIsValidIndexHandle@12 RtlLengthRequiredSid@4 RtlLengthSid@4 RtlLockHeap@4 RtlMoveMemory@12 RtlNormalizeProcessParams@4 RtlNtStatusToDosError@4 RtlNumberOfClearBits@4 RtlNumberOfSetBits@4 RtlOemStringToUnicodeSize@4 RtlOemStringToUnicodeString@12 RtlOemToUnicodeN@12 RtlPrefixString@12 RtlPrefixUnicodeString@12 RtlQueryEnvironmentVariable_U@12 RtlReAllocateHeap@16 RtlReleasePebLock@0 RtlResetRtlTranslations@4 RtlSetAllBits@4 RtlSetBits@12 RtlSetCurrentDirectory_U@4 RtlSetCurrentEnvironment@8 RtlSetEnvironmentVariable@12 RtlSizeHeap@12 RtlSubAuthorityCountSid@4 RtlSubAuthoritySid@8 RtlUnicodeStringToAnsiSize@4 RtlUnicodeStringToAnsiString@12 RtlUnicodeStringToCountedOemString@12 RtlUnicodeStringToOemSize@4 RtlUnicodeStringToOemString@12 RtlUnicodeToMultiByteN@20 RtlUnicodeToMultiByteSize@12 RtlUnicodeToOemN@20 RtlUnlockHeap@4 RtlUpcaseUnicodeChar@4 RtlUpcaseUnicodeString@12 RtlUpcaseUnicodeStringToAnsiString@12 RtlUpcaseUnicodeStringToCountedOemString@12 RtlUpcaseUnicodeStringToOemString@12 RtlUpcaseUnicodeToMultiByteN@20 RtlUpcaseUnicodeToOemN@20 RtlUpperChar@4 RtlUpperString@12 RtlValidSid@4 RtlValidateHeap@12 RtlValidateProcessHeaps@0 RtlZeroMemory@8 RtlxAnsiStringToUnicodeSize@4 RtlxOemStringToUnicodeSize@4 RtlxUnicodeStringToAnsiSize@4 RtlxUnicodeStringToOemSize@4 ZwAllocateVirtualMemory@24 ZwClose@4 ZwCreateFile@44 ZwFlushVirtualMemory@16 ZwFreeVirtualMemory@16 ZwLockVirtualMemory@16 ZwOpenFile@24 ZwProtectVirtualMemory@20 ZwQueryVirtualMemory@24 ZwReadFile@36 ZwReadVirtualMemory@20 ZwUnlockVirtualMemory@16 ZwWriteFile@36 ZwWriteVirtualMemory@20 __isascii __iscsym __iscsymf __toascii _itoa _itow _ltoa _ltow _snprintf _snwprintf _strcmpi _stricmp _strlwr _strnicmp _strupr _tolower _toupper _ultoa _ultow _vsnprintf _wcsicmp _wcslwr _wcsnicmp _wcsupr _wtoi _wtol abs atan atoi atol ceil cos fabs floor isalnum isalpha iscntrl isdigit isgraph islower isprint ispunct isspace isupper iswalpha iswctype isxdigit labs log mbstowcs memchr memcmp memcpy memmove memset pow sin sprintf sqrt strcat strchr strcmp strcpy strcspn strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtol strtoul swprintf tan tolower toupper towlower towupper vsprintf wcscat wcschr wcscmp wcscpy wcscspn wcslen wcsncat wcsncmp wcsncpy wcspbrk wcsrchr wcsspn wcsstr wcstol wcstombs wcstoul