;note that the Zw... functions are alternate names for the
;Nt... functions.  (see www.sysinternals.com for details)
;if you change a Nt.. function DON'T FORGET to change the
;Zw one too.

LIBRARY ntdll.dll
EXPORTS
CsrAllocateCaptureBuffer@8
CsrAllocateMessagePointer@12
CsrCaptureMessageBuffer@16
CsrCaptureMessageString@20
CsrCaptureTimeout@8
CsrClientCallServer@16
CsrClientConnectToServer@24
CsrFreeCaptureBuffer@4
CsrIdentifyAlertableThread@0
CsrNewThread@0
CsrProbeForRead@12
CsrProbeForWrite@12
CsrSetPriorityClass@8
DbgBreakPoint@0
DbgPrint
DbgPrintReturnControlC
DbgPrompt@12
DbgSsHandleKmApiMsg@8
DbgSsInitialize@16
DbgUiConnectToDbg@0
DbgUiContinue@8
DbgUiWaitStateChange@8
DbgUserBreakPoint@0
KiRaiseUserExceptionDispatcher@0
KiUserApcDispatcher@20
KiUserCallbackDispatcher@12
KiUserExceptionDispatcher@8
LdrAccessResource@16
LdrAlternateResourcesEnabled@0
LdrDisableThreadCalloutsForDll@4
LdrEnumResources@20
LdrFindEntryForAddress@8
LdrFindResourceDirectory_U@16
LdrFindResource_U@16
LdrFlushAlternateResourceModules@0
LdrGetDllHandle@16
LdrGetProcedureAddress@16
LdrInitializeThunk@16
LdrLoadAlternateResourceModule@8
LdrLoadDll@16
LdrProcessRelocationBlock@16
LdrQueryImageFileExecutionOptions@24
LdrQueryProcessModuleInformation@12
LdrShutdownProcess@0
LdrShutdownThread@0
LdrUnloadAlternateResourceModule@4
LdrUnloadDll@4
LdrVerifyImageMatchesChecksum@16
NlsAnsiCodePage
NlsMbCodePageTag
NlsMbOemCodePageTag
NtAcceptConnectPort@24
NtAccessCheck@32
NtAccessCheckAndAuditAlarm@44
NtAccessCheckByType@44
NtAccessCheckByTypeAndAuditAlarm@64
NtAccessCheckByTypeResultList@44
NtAccessCheckByTypeResultListAndAuditAlarm@64
NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
NtAddAtom@12
NtAdjustGroupsToken@24
NtAdjustPrivilegesToken@24
NtAlertResumeThread@8
NtAlertThread@4
NtAllocateLocallyUniqueId@4
NtAllocateUserPhysicalPages@12
NtAllocateUuids@16
NtAllocateVirtualMemory@24
NtAreMappedFilesTheSame@8
NtAssignProcessToJobObject@8
NtCallbackReturn@12
NtCancelDeviceWakeupRequest@4
NtCancelIoFile@8
NtCancelTimer@8
NtClearEvent@4
NtClose@4
NtCloseObjectAuditAlarm@12
NtCompleteConnectPort@4
NtConnectPort@32
NtContinue@8
NtCreateDirectoryObject@12
NtCreateEvent@20
NtCreateEventPair@12
NtCreateFile@44
NtCreateIoCompletion@16
NtCreateJobObject@12
NtCreateKey@28
NtCreateMailslotFile@32
NtCreateMutant@16
NtCreateNamedPipeFile@56
NtCreatePagingFile@16
NtCreatePort@20
NtCreateProcess@32
NtCreateProfile@36
NtCreateSection@28
NtCreateSemaphore@20
NtCreateSymbolicLinkObject@16
NtCreateThread@32
NtCreateTimer@16
NtCreateToken@52
NtCreateWaitablePort@20
NtDelayExecution@8
NtDeleteAtom@4
NtDeleteFile@4
NtDeleteKey@4
NtDeleteObjectAuditAlarm@12
NtDeleteValueKey@8
NtDeviceIoControlFile@40
NtDisplayString@4
NtDuplicateObject@28
NtDuplicateToken@24
NtEnumerateKey@24
NtEnumerateValueKey@24
NtExtendSection@8
NtFilterToken@24
NtFindAtom@12
NtFlushBuffersFile@8
NtFlushInstructionCache@12
NtFlushKey@4
NtFlushVirtualMemory@16
NtFlushWriteBuffer@0
NtFreeUserPhysicalPages@12
NtFreeVirtualMemory@16
NtFsControlFile@40
NtGetContextThread@8
NtGetDevicePowerState@8
NtGetPlugPlayEvent@16
NtGetTickCount@0
NtGetWriteWatch@28
NtImpersonateAnonymousToken@8
NtImpersonateClientOfPort@8
NtImpersonateThread@12
NtInitializeRegistry@4
NtInitiatePowerAction@16
NtIsSystemResumeAutomatic@0
NtListenPort@8
NtLoadDriver@4
NtLoadKey@8
NtLoadKey2@12
NtLockFile@40
NtLockVirtualMemory@16
NtMakeTemporaryObject@4
NtMapUserPhysicalPages@12
NtMapUserPhysicalPagesScatter@12
NtMapViewOfSection@40
NtNotifyChangeDirectoryFile@36
NtNotifyChangeKey@40
NtNotifyChangeMultipleKeys@48
NtOpenDirectoryObject@12
NtOpenEvent@12
NtOpenEventPair@12
NtOpenFile@24
NtOpenIoCompletion@12
NtOpenJobObject@12
NtOpenKey@12
NtOpenMutant@12
NtOpenObjectAuditAlarm@48
NtOpenProcess@16
NtOpenProcessToken@12
NtOpenSection@12
NtOpenSemaphore@12
NtOpenSymbolicLinkObject@12
NtOpenThread@16
NtOpenThreadToken@16
NtOpenTimer@12
NtPowerInformation@20
NtPrivilegeCheck@12
NtPrivilegedServiceAuditAlarm@20
NtPrivilegeObjectAuditAlarm@24
NtProtectVirtualMemory@20
NtPulseEvent@8
NtQueryAttributesFile@8
NtQueryDefaultLocale@8
NtQueryDefaultUILanguage@4
NtQueryDirectoryFile@44
NtQueryDirectoryObject@28
NtQueryEaFile@36
NtQueryEvent@20
NtQueryFullAttributesFile@8
NtQueryInformationAtom@20
NtQueryInformationFile@20
NtQueryInformationJobObject@20
NtQueryInformationPort@20
NtQueryInformationProcess@20
NtQueryInformationThread@20
NtQueryInformationToken@20
NtQueryIntervalProfile@8
NtQueryIoCompletion@20
NtQueryKey@20
NtQueryMultipleValueKey@24
NtQueryMutant@20
NtQueryObject@20
NtQueryOpenSubKeys@8
NtQueryPerformanceCounter@8
NtQueryQuotaInformationFile@36
NtQuerySection@20
NtQuerySecurityObject@20
NtQuerySemaphore@20
NtQuerySymbolicLinkObject@12
NtQuerySystemEnvironmentValue@16
NtQuerySystemInformation@16
NtQuerySystemTime@4
NtQueryTimer@20
NtQueryTimerResolution@12
NtQueryValueKey@24
NtQueryVirtualMemory@24
NtQueryVolumeInformationFile@20
NtQueueApcThread@20
NtRaiseException@12
NtRaiseHardError@24
NtReadFile@36
NtReadFileScatter@36
NtReadRequestData@24
NtReadVirtualMemory@20
NtRegisterThreadTerminatePort@4
NtReleaseMutant@8
NtReleaseSemaphore@12
NtRemoveIoCompletion@20
NtReplaceKey@12
NtReplyPort@8
NtReplyWaitReceivePort@16
NtReplyWaitReceivePortEx@20
NtReplyWaitReplyPort@8
NtRequestDeviceWakeup@4
NtRequestPort@8
NtRequestWaitReplyPort@12
NtRequestWakeupLatency@4
NtResetEvent@8
NtResetWriteWatch@12
NtRestoreKey@12
NtResumeThread@8
NtSaveKey@8
NtSaveMergedKeys@12
NtSecureConnectPort@36
NtSetContextThread@8
NtSetDefaultHardErrorPort@4
NtSetDefaultLocale@8
NtSetDefaultUILanguage@4
NtSetEaFile@16
NtSetEvent@8
NtSetHighEventPair@4
NtSetHighWaitLowEventPair@4
NtSetInformationFile@20
NtSetInformationJobObject@16
NtSetInformationKey@16
NtSetInformationObject@16
NtSetInformationProcess@16
NtSetInformationThread@16
NtSetInformationToken@16
NtSetIntervalProfile@8
NtSetIoCompletion@20
NtSetLdtEntries@16
NtSetLowEventPair@4
NtSetLowWaitHighEventPair@4
NtSetQuotaInformationFile@16
NtSetSecurityObject@12
NtSetSystemEnvironmentValue@8
NtSetSystemInformation@12
NtSetSystemPowerState@12
NtSetSystemTime@8
NtSetThreadExecutionState@8
NtSetTimer@28
NtSetTimerResolution@12
NtSetUuidSeed@4
NtSetValueKey@24
NtSetVolumeInformationFile@20
NtShutdownSystem@4
NtSignalAndWaitForSingleObject@16
NtStartProfile@4
NtStopProfile@4
NtSuspendThread@8
NtSystemDebugControl@24
NtTerminateJobObject@8
NtTerminateProcess@8
NtTerminateThread@8
NtTestAlert@0
NtUnloadDriver@4
NtUnloadKey@4
NtUnlockFile@20
NtUnlockVirtualMemory@16
NtUnmapViewOfSection@8
NtVdmControl@8
NtWaitForMultipleObjects@20
NtWaitForSingleObject@12
NtWaitHighEventPair@4
NtWaitLowEventPair@4
NtWriteFile@36
NtWriteFileGather@36
NtWriteRequestData@24
NtWriteVirtualMemory@20
NtYieldExecution@0
RtlAbortRXact@4
RtlAbsoluteToSelfRelativeSD@12
RtlAcquirePebLock@0
RtlAcquireResourceExclusive@8
RtlAcquireResourceShared@8
RtlAddAccessAllowedAce@16
RtlAddAccessAllowedAceEx@20
RtlAddAccessAllowedObjectAce@28
RtlAddAccessDeniedAce@16
RtlAddAccessDeniedAceEx@20
RtlAddAccessDeniedObjectAce@28
RtlAddAce@20
RtlAddActionToRXact@24
RtlAddAtomToAtomTable@12
RtlAddAttributeActionToRXact@32
RtlAddAuditAccessAce@24
RtlAddAuditAccessAceEx@28
RtlAddAuditAccessObjectAce@36
RtlAddCompoundAce@24
RtlAddRange@36
RtlAdjustPrivilege@16
RtlAllocateAndInitializeSid@44
RtlAllocateHandle@8
RtlAllocateHeap@12
RtlAnsiCharToUnicodeChar@4
RtlAnsiStringToUnicodeSize@4
RtlAnsiStringToUnicodeString@12
RtlAppendAsciizToString@8
RtlAppendStringToString@8
RtlAppendUnicodeStringToString@8
RtlAppendUnicodeToString@8
RtlApplyRXact@4
RtlApplyRXactNoFlush@4
RtlAreAllAccessesGranted@8
RtlAreAnyAccessesGranted@8
RtlAreBitsClear@12
RtlAreBitsSet@12
RtlAssert@16
RtlCallbackLpcClient@12
RtlCancelTimer@8
RtlCaptureStackBackTrace@16
RtlCharToInteger@12
RtlCheckForOrphanedCriticalSections@4
RtlCheckRegistryKey@8
RtlClearAllBits@4
RtlClearBits@12
RtlCompactHeap@8
RtlCompareMemory@12
RtlCompareMemoryUlong@12
RtlCompareString@12
RtlCompareUnicodeString@12
RtlCompressBuffer@32
RtlConsoleMultiByteToUnicodeN@24
RtlConvertExclusiveToShared@4
RtlConvertSharedToExclusive@4
RtlConvertSidToUnicodeString@12
RtlConvertToAutoInheritSecurityObject@24
RtlConvertUiListToApiList@12
RtlConvertUlongToLargeInteger@4
RtlConvertVariantToProperty@28
RtlCopyLuid@8
RtlCopyLuidAndAttributesArray@12
RtlCopyRangeList@8
RtlCopySecurityDescriptor@8
RtlCopySid@12
RtlCopySidAndAttributesArray@28
RtlCopyString@8
RtlCopyUnicodeString@8
RtlCreateAcl@12
RtlCreateAndSetSD@20
RtlCreateAtomTable@8
RtlCreateEnvironment@8
RtlCreateHeap@24
RtlCreateLpcServer@24
RtlCreateProcessParameters@40
RtlCreateQueryDebugBuffer@8
RtlCreateRegistryKey@8
RtlCreateSecurityDescriptor@8
RtlCreateTagHeap@16
RtlCreateTimer@28
RtlCreateTimerQueue@4
RtlCreateUnicodeString@8
RtlCreateUnicodeStringFromAsciiz@8
RtlCreateUserProcess@40
RtlCreateUserThread@40
RtlCustomCPToUnicodeN@24
RtlCutoverTimeToSystemTime@16
RtlDebugPrintTimes@0
RtlDecompressBuffer@24
RtlDecompressFragment@32
RtlDefaultNpAcl@4
RtlDelete@4
RtlDeleteAce@8
RtlDeleteAtomFromAtomTable@8
RtlDeleteCriticalSection@4
RtlDeleteElementGenericTable@8
RtlDeleteNoSplay@8
RtlDeleteOwnersRanges@8
RtlDeleteRange@24
RtlDeleteResource@4
RtlDeleteSecurityObject@4
RtlDeleteTimer@12
RtlDeleteTimerQueue@4
RtlDeleteTimerQueueEx@8
RtlDeNormalizeProcessParams@4
RtlDeregisterWait@4
RtlDeregisterWaitEx@8
RtlDestroyAtomTable@4
RtlDestroyEnvironment@4
RtlDestroyHandleTable@4
RtlDestroyHeap@4
RtlDestroyProcessParameters@4
RtlDestroyQueryDebugBuffer@4
RtlDetermineDosPathNameType_U@4
RtlDoesFileExists_U@4
RtlDosPathNameToNtPathName_U@16
RtlDosSearchPath_U@24
RtlDowncaseUnicodeString@12
RtlEmptyAtomTable@8
RtlEnableEarlyCriticalSectionEventCreation@0
RtlEnlargedIntegerMultiply@8
RtlEnlargedUnsignedDivide@16
RtlEnlargedUnsignedMultiply@8
RtlEnterCriticalSection@4
RtlEnumerateGenericTable@8
RtlEnumerateGenericTableWithoutSplaying@8
RtlEnumProcessHeaps@8
RtlEqualComputerName@8
RtlEqualDomainName@8
RtlEqualLuid@8
RtlEqualPrefixSid@8
RtlEqualSid@8
RtlEqualString@12
RtlEqualUnicodeString@12
RtlEraseUnicodeString@4
RtlExpandEnvironmentStrings_U@16
RtlExtendedLargeIntegerDivide@16
RtlExtendedMagicDivide@20
RtlExtendHeap@16
RtlFillMemory@12
RtlFillMemoryUlong@12
RtlFindClearBits@12
RtlFindClearBitsAndSet@12
RtlFindLeastSignificantBit@8
RtlFindLongestRunClear@8
RtlFindLongestRunSet@8
RtlFindMessage@20
RtlFindMostSignificantBit@8
RtlFindNextForwardRunClear@12
RtlFindRange@48
RtlFindSetBits@12
RtlFindSetBitsAndClear@12
RtlFirstFreeAce@8
RtlFormatCurrentUserKeyPath@4
RtlFormatMessage@36
RtlFreeAnsiString@4
RtlFreeHandle@8
RtlFreeHeap@12
RtlFreeOemString@4
RtlFreeSid@4
RtlFreeUnicodeString@4
RtlFreeUserThreadStack@8
RtlGenerate8dot3Name@16
RtlGetAce@12
RtlGetCallersAddress@8
RtlGetCompressionWorkSpaceSize@12
RtlGetControlSecurityDescriptor@12
RtlGetCurrentDirectory_U@8
RtlGetDaclSecurityDescriptor@16
RtlGetElementGenericTable@8
RtlGetFirstRange@12
RtlGetFullPathName_U@16
RtlGetGroupSecurityDescriptor@12
RtlGetLongestNtPathLength@0
RtlGetNextRange@12
RtlGetNtGlobalFlags@0
RtlGetNtProductType@4
RtlGetOwnerSecurityDescriptor@12
RtlGetProcessHeaps@8
RtlGetSaclSecurityDescriptor@16
RtlGetSecurityDescriptorRMControl@8
RtlGetUserInfoHeap@20
RtlGetVersion@4
RtlGUIDFromString@8
RtlIdentifierAuthoritySid@4
RtlImageDirectoryEntryToData@16
RtlImageNtHeader@4
RtlImageRvaToSection@12
RtlImageRvaToVa@16
RtlImpersonateLpcClient@8
RtlImpersonateSelf@4
RtlInitAnsiString@8
RtlInitCodePageTable@8
RtlInitNlsTables@16
RtlInitString@8
RtlInitUnicodeString@8
RtlInitializeAtomPackage@4
RtlInitializeBitMap@12
RtlInitializeContext@20
RtlInitializeCriticalSection@4
RtlInitializeCriticalSectionAndSpinCount@8
RtlInitializeGenericTable@20
RtlInitializeHandleTable@12
RtlInitializeRXact@12
RtlInitializeRangeList@4
RtlInitializeResource@4
RtlInitializeSid@12
RtlInsertElementGenericTable@16
RtlIntegerToChar@16
RtlIntegerToUnicodeString@12
RtlInvertRangeList@8
RtlIsDosDeviceName_U@4
RtlIsNameLegalDOS8Dot3@12
RtlIsRangeAvailable@40
RtlIsTextUnicode@12
RtlIsValidHandle@8
RtlIsValidIndexHandle@12
RtlLargeIntegerAdd@16
RtlLargeIntegerArithmeticShift@12
RtlLargeIntegerDivide@20
RtlLargeIntegerNegate@8
RtlLargeIntegerShiftLeft@12
RtlLargeIntegerShiftRight@12
RtlLargeIntegerSubtract@16
RtlLargeIntegerToChar@16
RtlLeaveCriticalSection@4
RtlLengthRequiredSid@4
RtlLengthSecurityDescriptor@4
RtlLengthSid@4
RtlLocalTimeToSystemTime@8
RtlLockHeap@4
RtlLookupAtomInAtomTable@12
RtlLookupElementGenericTable@8
RtlMakeSelfRelativeSD@12
RtlMapGenericMask@8
RtlMergeRangeLists@16
RtlMoveMemory@12
RtlMultiByteToUnicodeN@20
RtlMultiByteToUnicodeSize@12
RtlNewInstanceSecurityObject@40
RtlNewSecurityGrantedAccess@24
RtlNewSecurityObject@24
RtlNewSecurityObjectEx@32
RtlNormalizeProcessParams@4
RtlNtStatusToDosError@4
RtlNumberGenericTableElements@4
RtlNumberOfClearBits@4
RtlNumberOfSetBits@4
RtlOemStringToUnicodeSize@4
RtlOemStringToUnicodeString@12
RtlOemToUnicodeN@12
RtlOpenCurrentUser@8
RtlPcToFileHeader@8
RtlPinAtomInAtomTable@8
RtlPrefixString@12
RtlPrefixUnicodeString@12
RtlProtectHeap@8
RtlQueryAtomInAtomTable@24
RtlQueryEnvironmentVariable_U@12
RtlQueryInformationAcl@16
RtlQueryProcessBackTraceInformation@4
RtlQueryProcessDebugInformation@12
RtlQueryProcessHeapInformation@4
RtlQueryProcessLockInformation@4
RtlQueryRegistryValues@20
RtlQuerySecurityObject@20
RtlQueryTagHeap@20
RtlQueryTimeZoneInformation@4
RtlQueueWorkItem@12
RtlRaiseException@4
RtlRaiseStatus@4
RtlReAllocateHeap@16
RtlRealPredecessor@4
RtlRegisterWait@24
RtlReleasePebLock@0
RtlReleaseResource@4
RtlRemoteCall@28
RtlResetRtlTranslations@4
RtlRunDecodeUnicodeString@8
RtlRunEncodeUnicodeString@8
RtlSecondsSince1970ToTime@8
RtlSecondsSince1980ToTime@8
RtlSelfRelativeToAbsoluteSD2@8
RtlSelfRelativeToAbsoluteSD@44
RtlSetAllBits@4
RtlSetAttributesSecurityDescriptor@12
RtlSetBits@12
RtlSetControlSecurityDescriptor@12
RtlSetCriticalSectionSpinCount@8
RtlSetCurrentDirectory_U@4
RtlSetCurrentEnvironment@8
RtlSetDaclSecurityDescriptor@16
RtlSetEnvironmentVariable@12
RtlSetGroupSecurityDescriptor@12
RtlSetInformationAcl@16
RtlSetIoCompletionCallback@12
RtlSetOwnerSecurityDescriptor@12
RtlSetSaclSecurityDescriptor@16
RtlSetSecurityDescriptorRMControl@8
RtlSetSecurityObject@20
RtlSetSecurityObjectEx@24
RtlSetThreadPoolStartFunc@8
RtlSetTimeZoneInformation@4
RtlSetTimer@28
RtlSetUnicodeCallouts@4
RtlSetUserFlagsHeap@20
RtlSetUserValueHeap@16
RtlShutdownLpcServer@4
RtlSizeHeap@12
RtlSplay@4
RtlStartRXact@4
RtlStringFromGUID@8
RtlSubAuthorityCountSid@4
RtlSubAuthoritySid@8
RtlSubtreePredecessor@4
RtlSubtreeSuccessor@4
RtlSystemTimeToLocalTime@8
RtlTimeFieldsToTime@8
RtlTimeToElapsedTimeFields@8
RtlTimeToSecondsSince1970@8
RtlTimeToSecondsSince1980@8
RtlTimeToTimeFields@8
RtlTraceDatabaseAdd@16
RtlTraceDatabaseCreate@20
RtlTraceDatabaseDestroy@4
RtlTraceDatabaseEnumerate@12
RtlTraceDatabaseFind@16
RtlTraceDatabaseLock@4
RtlTraceDatabaseUnlock@4
RtlTraceDatabaseValidate@4
RtlTryEnterCriticalSection@4
RtlUlongByteSwap@4
RtlUlonglongByteSwap@4
RtlUnicodeStringToAnsiSize@4
RtlUnicodeStringToAnsiString@12
RtlUnicodeStringToCountedOemString@12
RtlUnicodeStringToInteger@12
RtlUnicodeStringToOemSize@4
RtlUnicodeStringToOemString@12
RtlUnicodeToMultiByteN@20
RtlUnicodeToMultiByteSize@12
RtlUnicodeToOemN@20
RtlUniform@4
RtlUnlockHeap@4
RtlUnwind@16
RtlUpcaseUnicodeChar@4
RtlUpcaseUnicodeString@12
RtlUpcaseUnicodeStringToAnsiString@12
RtlUpcaseUnicodeStringToCountedOemString@12
RtlUpcaseUnicodeStringToOemString@12
RtlUpcaseUnicodeToCustomCPN@24
RtlUpcaseUnicodeToMultiByteN@20
RtlUpcaseUnicodeToOemN@20
RtlUpdateTimer@16
RtlUpperChar@4
RtlUpperString@12
RtlUsageHeap@12
RtlUshortByteSwap@4
RtlValidAcl@4
RtlValidRelativeSecurityDescriptor@12
RtlValidSecurityDescriptor@4
RtlValidSid@4
RtlValidateHeap@12
RtlValidateProcessHeaps@0
RtlVerifyVersionInfo@16
RtlWalkFrameChain@12
RtlWalkHeap@8
RtlWriteRegistryValue@24
RtlZeroHeap@8
RtlZeroMemory@8
RtlpNtCreateKey@24
RtlpNtEnumerateSubKey@16
RtlpNtMakeTemporaryKey@4
RtlpNtOpenKey@16
RtlpNtQueryValueKey@20
RtlpNtSetValueKey@16
RtlpUnWaitCriticalSection@4
RtlpWaitForCriticalSection@4
RtlxAnsiStringToUnicodeSize@4
RtlxOemStringToUnicodeSize@4
RtlxUnicodeStringToAnsiSize@4
RtlxUnicodeStringToOemSize@4
ZwAcceptConnectPort@24
ZwAccessCheck@32
ZwAccessCheckAndAuditAlarm@44
ZwAccessCheckByType@44
ZwAccessCheckByTypeAndAuditAlarm@64
ZwAccessCheckByTypeResultList@44
ZwAccessCheckByTypeResultListAndAuditAlarm@64
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
ZwAddAtom@12
ZwAdjustGroupsToken@24
ZwAdjustPrivilegesToken@24
ZwAlertResumeThread@8
ZwAlertThread@4
ZwAllocateLocallyUniqueId@4
ZwAllocateUserPhysicalPages@12
ZwAllocateUuids@16
ZwAllocateVirtualMemory@24
ZwAreMappedFilesTheSame@8
ZwAssignProcessToJobObject@8
ZwCallbackReturn@12
ZwCancelDeviceWakeupRequest@4
ZwCancelIoFile@8
ZwCancelTimer@8
ZwClearEvent@4
ZwClose@4
ZwCloseObjectAuditAlarm@12
ZwCompleteConnectPort@4
ZwConnectPort@32
ZwContinue@8
ZwCreateDirectoryObject@12
ZwCreateEvent@20
ZwCreateEventPair@12
ZwCreateFile@44
ZwCreateIoCompletion@16
ZwCreateJobObject@12
ZwCreateKey@28
ZwCreateMailslotFile@32
ZwCreateMutant@16
ZwCreateNamedPipeFile@56
ZwCreatePagingFile@16
ZwCreatePort@20
ZwCreateProcess@32
ZwCreateProfile@36
ZwCreateSection@28
ZwCreateSemaphore@20
ZwCreateSymbolicLinkObject@16
ZwCreateThread@32
ZwCreateTimer@16
ZwCreateToken@52
ZwCreateWaitablePort@20
ZwDelayExecution@8
ZwDeleteAtom@4
ZwDeleteFile@4
ZwDeleteKey@4
ZwDeleteObjectAuditAlarm@12
ZwDeleteValueKey@8
ZwDeviceIoControlFile@40
ZwDisplayString@4
ZwDuplicateObject@28
ZwDuplicateToken@24
ZwEnumerateKey@24
ZwEnumerateValueKey@24
ZwExtendSection@8
ZwFilterToken@24
ZwFindAtom@12
ZwFlushBuffersFile@8
ZwFlushInstructionCache@12
ZwFlushKey@4
ZwFlushVirtualMemory@16
ZwFlushWriteBuffer@0
ZwFreeUserPhysicalPages@12
ZwFreeVirtualMemory@16
ZwFsControlFile@40
ZwGetContextThread@8
ZwGetDevicePowerState@8
ZwGetPlugPlayEvent@16
ZwGetTickCount@0
ZwGetWriteWatch@28
ZwImpersonateAnonymousToken@8
ZwImpersonateClientOfPort@8
ZwImpersonateThread@12
ZwInitializeRegistry@4
ZwInitiatePowerAction@16
ZwIsSystemResumeAutomatic@0
ZwListenPort@8
ZwLoadDriver@4
ZwLoadKey@8
ZwLoadKey2@12
ZwLockFile@40
ZwLockVirtualMemory@16
ZwMakeTemporaryObject@4
ZwMapUserPhysicalPages@12
ZwMapUserPhysicalPagesScatter@12
ZwMapViewOfSection@40
ZwNotifyChangeDirectoryFile@36
ZwNotifyChangeKey@40
ZwNotifyChangeMultipleKeys@48
ZwOpenDirectoryObject@12
ZwOpenEvent@12
ZwOpenEventPair@12
ZwOpenFile@24
ZwOpenIoCompletion@12
ZwOpenJobObject@12
ZwOpenKey@12
ZwOpenMutant@12
ZwOpenObjectAuditAlarm@48
ZwOpenProcess@16
ZwOpenProcessToken@12
ZwOpenSection@12
ZwOpenSemaphore@12
ZwOpenSymbolicLinkObject@12
ZwOpenThread@16
ZwOpenThreadToken@16
ZwOpenTimer@12
ZwPowerInformation@20
ZwPrivilegeCheck@12
ZwPrivilegedServiceAuditAlarm@20
ZwPrivilegeObjectAuditAlarm@24
ZwProtectVirtualMemory@20
ZwPulseEvent@8
ZwQueryAttributesFile@8
ZwQueryDefaultLocale@8
ZwQueryDefaultUILanguage@4
ZwQueryDirectoryFile@44
ZwQueryDirectoryObject@28
ZwQueryEaFile@36
ZwQueryEvent@20
ZwQueryFullAttributesFile@8
ZwQueryInformationAtom@20
ZwQueryInformationFile@20
ZwQueryInformationJobObject@20
ZwQueryInformationPort@20
ZwQueryInformationProcess@20
ZwQueryInformationThread@20
ZwQueryInformationToken@20
ZwQueryIntervalProfile@8
ZwQueryIoCompletion@20
ZwQueryKey@20
ZwQueryMultipleValueKey@24
ZwQueryMutant@20
ZwQueryObject@20
ZwQueryOpenSubKeys@8
ZwQueryPerformanceCounter@8
ZwQueryQuotaInformationFile@36
ZwQuerySection@20
ZwQuerySecurityObject@20
ZwQuerySemaphore@20
ZwQuerySymbolicLinkObject@12
ZwQuerySystemEnvironmentValue@16
ZwQuerySystemInformation@16
ZwQuerySystemTime@4
ZwQueryTimer@20
ZwQueryTimerResolution@12
ZwQueryValueKey@24
ZwQueryVirtualMemory@24
ZwQueryVolumeInformationFile@20
ZwQueueApcThread@20
ZwRaiseException@12
ZwRaiseHardError@24
ZwReadFile@36
ZwReadFileScatter@36
ZwReadRequestData@24
ZwReadVirtualMemory@20
ZwRegisterThreadTerminatePort@4
ZwReleaseMutant@8
ZwReleaseSemaphore@12
ZwRemoveIoCompletion@20
ZwReplaceKey@12
ZwReplyPort@8
ZwReplyWaitReceivePort@16
ZwReplyWaitReceivePortEx@20
ZwReplyWaitReplyPort@8
ZwRequestDeviceWakeup@4
ZwRequestPort@8
ZwRequestWaitReplyPort@12
ZwRequestWakeupLatency@4
ZwResetEvent@8
ZwResetWriteWatch@12
ZwRestoreKey@12
ZwResumeThread@8
ZwSaveKey@8
ZwSaveMergedKeys@12
ZwSecureConnectPort@36
ZwSetContextThread@8
ZwSetDefaultHardErrorPort@4
ZwSetDefaultLocale@8
ZwSetDefaultUILanguage@4
ZwSetEaFile@16
ZwSetEvent@8
ZwSetHighEventPair@4
ZwSetHighWaitLowEventPair@4
ZwSetInformationFile@20
ZwSetInformationJobObject@16
ZwSetInformationKey@16
ZwSetInformationObject@16
ZwSetInformationProcess@16
ZwSetInformationThread@16
ZwSetInformationToken@16
ZwSetIntervalProfile@8
ZwSetIoCompletion@20
ZwSetLdtEntries@16
ZwSetLowEventPair@4
ZwSetLowWaitHighEventPair@4
ZwSetQuotaInformationFile@16
ZwSetSecurityObject@12
ZwSetSystemEnvironmentValue@8
ZwSetSystemInformation@12
ZwSetSystemPowerState@12
ZwSetSystemTime@8
ZwSetThreadExecutionState@8
ZwSetTimer@28
ZwSetTimerResolution@12
ZwSetUuidSeed@4
ZwSetValueKey@24
ZwSetVolumeInformationFile@20
ZwShutdownSystem@4
ZwSignalAndWaitForSingleObject@16
ZwStartProfile@4
ZwStopProfile@4
ZwSuspendThread@8
ZwSystemDebugControl@24
ZwTerminateJobObject@8
ZwTerminateProcess@8
ZwTerminateThread@8
ZwTestAlert@0
ZwUnloadDriver@4
ZwUnloadKey@4
ZwUnlockFile@20
ZwUnlockVirtualMemory@16
ZwUnmapViewOfSection@8
ZwVdmControl@8
ZwWaitForMultipleObjects@20
ZwWaitForSingleObject@12
ZwWaitHighEventPair@4
ZwWaitLowEventPair@4
ZwWriteFile@36
ZwWriteFileGather@36
ZwWriteRequestData@24
ZwWriteVirtualMemory@20
ZwYieldExecution@0
__isascii
__iscsym
__iscsymf
__toascii
_itoa
_itow
_ltoa
_ltow
_snprintf
_snwprintf
_strcmpi
_stricmp
_strlwr
_strnicmp
_strupr
_tolower
_toupper
_ultoa
_ultow
_vsnprintf
_wcsicmp
_wcslwr
_wcsnicmp
_wcsupr
_wtoi
_wtol
abs
atan
atoi
atol
ceil
cos
fabs
floor
isalnum
isalpha
iscntrl
isdigit
isgraph
islower
isprint
ispunct
isspace
isupper
iswalpha
iswctype
isxdigit
labs
log
mbstowcs
memchr
memcmp
memcpy
memmove
memset
pow
sin
sprintf
sqrt
strcat
strchr
strcmp
strcpy
strcspn
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
swprintf
tan
tolower
toupper
towlower
towupper
vsprintf
wcscat
wcschr
wcscmp
wcscpy
wcscspn
wcslen
wcsncat
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsspn
wcsstr
wcstol
wcstombs
wcstoul