ntdll.dll - NT Layer DLL

filename	ntdll.dll
size	2183152 (0x214ff0)
md5	437b8a73f8244efe5e49919f24c899b7

type	PE32+ executable (DLL) (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
0	0	1
256	30795	1
259	30795	44
260	30795	131
269	30795	304
261	30795	27
255	30795	1
258	30795	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	0xb
TimeDateStamp	0xeae8eecc
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	14.30
SizeOfCode	0x130000
SizeOfInitializedData	0xe5000
SizeOfUninitializedData	0
AddressOfEntryPoint	0
BaseOfCode	0x1000
ImageBase	0x180000000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x216000
SizeOfHeaders	0x1000
CheckSum	0x21eed5
Subsystem	3
DllCharacteristics	0x4160
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x12cbee	0x12d000	R-X CODE
PAGE	0x12e000	0x5bf	0x1000	R-X CODE
RT	0x12f000	0x1cf	0x1000	R-X CODE
fothk	0x130000	0x1000	0x1000	R-X CODE
.rdata	0x131000	0x4d185	0x4e000	R-- IDATA
.data	0x17f000	0xb318	0x4000	RW- IDATA
.pdata	0x18b000	0xecdc	0xf000	R-- IDATA
.mrdata	0x19a000	0x3540	0x4000	RW- IDATA
.00cfg	0x19e000	0x28	0x1000	R-- IDATA
.rsrc	0x19f000	0x759a8	0x76000	R-- IDATA
.reloc	0x215000	0x620	0x1000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x16abb0	0x135d5
IMPORT	0	0
RESOURCE	0x19f000	0x759a8
EXCEPTION	0x18b000	0xecdc
SECURITY	0x20e000	0x6ff0
BASERELOC	0x215000	0x558
DEBUG	0x13bae0	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x131e10	0x140
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
MUI	#1	200
MESSAGETABLE	#1	480368
VERSION	#1	896

ord	entry_va	function_name
8	0x7f640
9	0xe6f0	A_SHAFinal
10	0xe820	A_SHAInit
11	0xe860	A_SHAUpdate
12	0xeae30	AlpcAdjustCompletionListConcurrencyCount
13	0x7e270	AlpcFreeCompletionListMessage
14	0xeae60	AlpcGetCompletionListLastMessageInformation
15	0xeae80	AlpcGetCompletionListMessageAttributes
16	0x727b0	AlpcGetHeaderSize
17	0x72770	AlpcGetMessageAttribute
18	0x7d5c0	AlpcGetMessageFromCompletionList
19	0x891d0	AlpcGetOutstandingCompletionListMessageCount
20	0x72710	AlpcInitializeMessageAttribute
21	0x87ce0	AlpcMaxAllowedMessageLength
22	0x89150	AlpcRegisterCompletionList
23	0x80970	AlpcRegisterCompletionListWorkerThread
24	0x89260	AlpcRundownCompletionList
25	0x89240	AlpcUnregisterCompletionList
26	0x80580	AlpcUnregisterCompletionListWorkerThread
27	0x77070	ApiSetQueryApiSetPresence
28	0x885e0	ApiSetQueryApiSetPresenceEx
29	0x74660	CsrAllocateCaptureBuffer
30	0x74610	CsrAllocateMessagePointer
31	0x74340	CsrCaptureMessageBuffer
32	0x74460	CsrCaptureMessageMultiUnicodeStringsInPlace
33	0x74560	CsrCaptureMessageString
34	0xd4a80	CsrCaptureTimeout
35	0x74730	CsrClientCallServer
36	0x4af10	CsrClientConnectToServer
37	0x748f0	CsrFreeCaptureBuffer
38	0xd4ab0	CsrGetProcessId
39	0x8e580	CsrIdentifyAlertableThread
40	0xe0380	CsrSetPriorityClass
41	0xd4ad0	CsrVerifyRegion
42	0xa3050	DbgBreakPoint
43	0x533a0	DbgPrint
44	0x53360	DbgPrintEx
45	0xeaec0	DbgPrintReturnControlC
46	0xeaf10	DbgPrompt
47	0xeaf60	DbgQueryDebugFilterState
48	0xeaf70	DbgSetDebugFilterState
49	0xd64c0	DbgUiConnectToDbg
50	0xd6530	DbgUiContinue
51	0xd6560	DbgUiConvertStateChangeStructure
52	0xd6570	DbgUiConvertStateChangeStructureEx
53	0xd6820	DbgUiDebugActiveProcess
54	0xd6890	DbgUiGetThreadDebugObject
55	0xd68b0	DbgUiIssueRemoteBreakin
56	0xd6920	DbgUiRemoteBreakin
57	0xd6980	DbgUiSetThreadDebugObject
58	0xd69a0	DbgUiStopDebugging
59	0xd69c0	DbgUiWaitStateChange
60	0xa3060	DbgUserBreakPoint
61	0x88b60	EtwCheckCoverage
62	0x123c20	EtwCreateTraceInstanceId
63	0x5e270	EtwDeliverDataBlock
64	0x123800	EtwEnumerateProcessRegGuids
65	0x616a0	EtwEventActivityIdControl
66	0x52240	EtwEventEnabled
67	0x2fa10	EtwEventProviderEnabled
68	0x314c0	EtwEventRegister
69	0x2f600	EtwEventSetInformation
70	0x2f590	EtwEventUnregister
71	0x2fbd0	EtwEventWrite
72	0x52150	EtwEventWriteEndScenario
73	0x7c8a0	EtwEventWriteEx
74	0x868e0	EtwEventWriteFull
75	0x870d0	EtwEventWriteNoRegistration
76	0x52050	EtwEventWriteStartScenario
77	0x123900	EtwEventWriteString
78	0x2fdb0	EtwEventWriteTransfer
79	0x816b0	EtwGetTraceEnableFlags
80	0x81670	EtwGetTraceEnableLevel
81	0x81630	EtwGetTraceLoggerHandle
82	0xb01d0	EtwLogTraceEvent
83	0x32110	EtwNotificationRegister
84	0x2faa0	EtwNotificationUnregister
85	0x5b4b0	EtwProcessPrivateLoggerRequest
86	0x8e3e0	EtwRegisterSecurityProvider
87	0x5d600	EtwRegisterTraceGuidsA
88	0x5d640	EtwRegisterTraceGuidsW
89	0x5eb10	EtwReplyNotification
90	0x52560	EtwSendNotification
91	0x8c4d0	EtwSetMark
92	0x123c80	EtwTraceEventInstance
93	0x53020	EtwTraceMessage
94	0x53050	EtwTraceMessageVa
95	0x7d090	EtwUnregisterTraceGuids
96	0x7b200	EtwWriteUMSecurityEvent
97	0x5b950	EtwpCreateEtwThread
98	0x5d0e0	EtwpGetCpuSpeed
99	0x124e50	EvtIntReportAuthzEventAndSourceAsync
100	0x52bf0	EvtIntReportEventAndSourceAsync
101	0xa3100	ExpInterlockedPopEntrySListEnd
102	0xa30f7	ExpInterlockedPopEntrySListFault
103	0xa30e7	ExpInterlockedPopEntrySListResume
104	0xa3440	KiRaiseUserExceptionDispatcher
105	0xa3260	KiUserApcDispatcher
106	0xa3380	KiUserCallbackDispatcher
107	0xa33d0	KiUserExceptionDispatcher
108	0x19a520	KiUserInvertedFunctionTable
109	0x21510	LdrAccessResource
110	0x783b0	LdrAddDllDirectory
111	0x703d0	LdrAddLoadAsDataTable
112	0x2ccd0	LdrAddRefDll
113	0xd4b20	LdrAppxHandleIntegrityFailure
114	0xad750	LdrCallEnclave
115	0x2be30	LdrControlFlowGuardEnforced
116	0xd69f0	LdrCreateEnclave
117	0xd6b00	LdrDeleteEnclave
118	0x2d720	LdrDisableThreadCalloutsForDll
119	0xeb400	LdrEnumResources
120	0x51610	LdrEnumerateLoadedModules
121	0x87bf0	LdrFastFailInLoaderCallout
122	0x8630	LdrFindEntryForAddress
123	0xeb6d0	LdrFindResourceDirectory_U
124	0x82350	LdrFindResourceEx_U
125	0x29380	LdrFindResource_U
126	0x87e10	LdrFlushAlternateResourceModules
127	0x81f40	LdrGetDllDirectory
128	0x2d070	LdrGetDllFullName
129	0x2ab50	LdrGetDllHandle
130	0x2d780	LdrGetDllHandleByMapping
131	0x77140	LdrGetDllHandleByName
132	0x29cb0	LdrGetDllHandleEx
133	0x315d0	LdrGetDllPath
134	0xd7ef0	LdrGetFailureData
135	0xeb700	LdrGetFileNameFromLoadAsDataTable
136	0x86a20	LdrGetKnownDllSectionHandle
137	0x84400	LdrGetProcedureAddress
138	0x79730	LdrGetProcedureAddressEx
139	0x21b10	LdrGetProcedureAddressForCaller
140	0xd7f10	LdrHotPatchNotify
141	0xdb400	LdrInitShimEngineDynamic
142	0xd6b90	LdrInitializeEnclave
143	0x73dc0	LdrInitializeThunk
144	0xd8080	LdrIsModuleSxsRedirected
145	0x84170	LdrLoadAlternateResourceModule
146	0x1f2b0	LdrLoadAlternateResourceModuleEx
147	0x2a160	LdrLoadDll
148	0xd6d40	LdrLoadEnclaveModule
149	0x50ac0	LdrLockLoaderLock
150	0xec1b0	LdrOpenImageFileOptionsKey
151	0x73d90	LdrProcessInitializationComplete
152	0xee410	LdrProcessRelocationBlock
153	0xee440	LdrProcessRelocationBlockEx
154	0x7d790	LdrQueryImageFileExecutionOptions
155	0x7d7d0	LdrQueryImageFileExecutionOptionsEx
156	0x7d870	LdrQueryImageFileKeyOption
157	0xd81c0	LdrQueryModuleServiceTags
158	0xd8de0	LdrQueryOptionalDelayLoadedAPI
159	0xd82b0	LdrQueryProcessModuleInformation
160	0x1f00	LdrRegisterDllNotification
161	0x785c0	LdrRemoveDllDirectory
162	0x718e0	LdrRemoveLoadAsDataTable
163	0xeeba0	LdrResFindResource
164	0x51a0	LdrResFindResourceDirectory
165	0x77e0	LdrResGetRCConfig
166	0xeec20	LdrResRelease
167	0x5230	LdrResSearchResource
168	0x2b920	LdrResolveDelayLoadedAPI
169	0xd8ea0	LdrResolveDelayLoadsFromDll
170	0x28b10	LdrRscIsTypeExist
171	0xd8700	LdrSetAppCompatDllRedirectionCallback
172	0x78960	LdrSetDefaultDllDirectories
173	0x78830	LdrSetDllDirectory
174	0x86460	LdrSetDllManifestProber
175	0xd8710	LdrSetImplicitPathOptions
176	0x8e420	LdrSetMUICacheType
177	0x50f30	LdrShutdownProcess
178	0x28d70	LdrShutdownThread
179	0x9e0d0	LdrStandardizeSystemPath
180	0x19a310	LdrSystemDllInitBlock
181	0x6b170	LdrUnloadAlternateResourceModule
182	0x6b180	LdrUnloadAlternateResourceModuleEx
183	0x2ce70	LdrUnloadDll
184	0x509c0	LdrUnlockLoaderLock
185	0xd8780	LdrUnregisterDllNotification
186	0x83f80	LdrUpdatePackageSearchPath
187	0xd8830	LdrVerifyImageMatchesChecksum
188	0x8d1a0	LdrVerifyImageMatchesChecksumEx
189	0x22190	LdrpResGetMappingSize
190	0x5c30	LdrpResGetResourceDirectory
191	0x123040	MD4Final
192	0x123110	MD4Init
193	0x1236d0	MD4Update
194	0x617a0	MD5Final
195	0x7f870	MD5Init
196	0x61870	MD5Update
197	0x7bf00	MicrosoftTelemetryAssertTriggeredUM
198	0x182878	NlsAnsiCodePage
199	0x186900	NlsMbCodePageTag
200	0x1866f0	NlsMbOemCodePageTag
201	0x9f390	NtAcceptConnectPort
202	0x9f350	NtAccessCheck
203	0x9f870	NtAccessCheckAndAuditAlarm
204	0x9ffa0	NtAccessCheckByType
205	0x9fe70	NtAccessCheckByTypeAndAuditAlarm
206	0x9ffc0	NtAccessCheckByTypeResultList
207	0x9ffe0	NtAccessCheckByTypeResultListAndAuditAlarm
208	0xa0000	NtAccessCheckByTypeResultListAndAuditAlarmByHandle
209	0xa0020	NtAcquireCrossVmMutant
210	0xa0040	NtAcquireProcessActivityReference
211	0x9fc30	NtAddAtom
212	0xa0060	NtAddAtomEx
213	0xa0080	NtAddBootEntry
214	0xa00a0	NtAddDriverEntry
215	0xa00c0	NtAdjustGroupsToken
216	0x9fb70	NtAdjustPrivilegesToken
217	0xa00e0	NtAdjustTokenClaimsAndDeviceGroups
218	0xa0100	NtAlertResumeThread
219	0xa0120	NtAlertThread
220	0xa0140	NtAlertThreadByThreadId
221	0xa0160	NtAllocateLocallyUniqueId
222	0xa0180	NtAllocateReserveObject
223	0xa01a0	NtAllocateUserPhysicalPages
224	0xa01c0	NtAllocateUserPhysicalPagesEx
225	0xa01e0	NtAllocateUuids
226	0x9f650	NtAllocateVirtualMemory
227	0xa0200	NtAllocateVirtualMemoryEx
228	0xa0220	NtAlpcAcceptConnectPort
229	0xa0240	NtAlpcCancelMessage
230	0xa0260	NtAlpcConnectPort
231	0xa0280	NtAlpcConnectPortEx
232	0xa02a0	NtAlpcCreatePort
233	0xa02c0	NtAlpcCreatePortSection
234	0xa02e0	NtAlpcCreateResourceReserve
235	0xa0300	NtAlpcCreateSectionView
236	0xa0320	NtAlpcCreateSecurityContext
237	0xa0340	NtAlpcDeletePortSection
238	0xa0360	NtAlpcDeleteResourceReserve
239	0xa0380	NtAlpcDeleteSectionView
240	0xa03a0	NtAlpcDeleteSecurityContext
241	0xa03c0	NtAlpcDisconnectPort
242	0xa03e0	NtAlpcImpersonateClientContainerOfPort
243	0xa0400	NtAlpcImpersonateClientOfPort
244	0xa0420	NtAlpcOpenSenderProcess
245	0xa0440	NtAlpcOpenSenderThread
246	0xa0460	NtAlpcQueryInformation
247	0xa0480	NtAlpcQueryInformationMessage
248	0xa04a0	NtAlpcRevokeSecurityContext
249	0xa04c0	NtAlpcSendWaitReceivePort
250	0xa04e0	NtAlpcSetInformation
251	0x9fcd0	NtApphelpCacheControl
252	0xa0500	NtAreMappedFilesTheSame
253	0xa0520	NtAssignProcessToJobObject
254	0xa0540	NtAssociateWaitCompletionPacket
255	0xa0560	NtCallEnclave
256	0x9f3f0	NtCallbackReturn
257	0x9fee0	NtCancelIoFile
258	0xa0580	NtCancelIoFileEx
259	0xa05a0	NtCancelSynchronousIoFile
260	0x9ff60	NtCancelTimer
261	0xa05c0	NtCancelTimer2
262	0xa05e0	NtCancelWaitCompletionPacket
263	0xa0600	NtChangeProcessState
264	0xa0620	NtChangeThreadState
265	0x9fb10	NtClearEvent
266	0x9f530	NtClose
267	0x9fab0	NtCloseObjectAuditAlarm
268	0xa0640	NtCommitComplete
269	0xa0660	NtCommitEnlistment
270	0xa0680	NtCommitRegistryTransaction
271	0xa06a0	NtCommitTransaction
272	0xa06c0	NtCompactKeys
273	0xa06e0	NtCompareObjects
274	0xa0700	NtCompareSigningLevels
275	0xa0720	NtCompareTokens
276	0xa0740	NtCompleteConnectPort
277	0xa0760	NtCompressKey
278	0xa0780	NtConnectPort
279	0x9fbb0	NtContinue
280	0xa07a0	NtContinueEx
281	0xa07c0	NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
282	0xa07e0	NtCopyFileChunk
283	0xa0800	NtCreateCpuPartition
284	0xa0820	NtCreateCrossVmEvent
285	0xa0840	NtCreateCrossVmMutant
286	0xa0860	NtCreateDebugObject
287	0xa0880	NtCreateDirectoryObject
288	0xa08a0	NtCreateDirectoryObjectEx
289	0xa08c0	NtCreateEnclave
290	0xa08e0	NtCreateEnlistment
291	0x9fc50	NtCreateEvent
292	0xa0900	NtCreateEventPair
293	0x9fdf0	NtCreateFile
294	0xa0920	NtCreateIRTimer
295	0xa0940	NtCreateIoCompletion
296	0xa0960	NtCreateIoRing
297	0xa0980	NtCreateJobObject
298	0xa09a0	NtCreateJobSet
299	0x9f6f0	NtCreateKey
300	0xa09c0	NtCreateKeyTransacted
301	0xa09e0	NtCreateKeyedEvent
302	0xa0a00	NtCreateLowBoxToken
303	0xa0a20	NtCreateMailslotFile
304	0xa0a40	NtCreateMutant
305	0xa0a60	NtCreateNamedPipeFile
306	0xa0a80	NtCreatePagingFile
307	0xa0aa0	NtCreatePartition
308	0xa0ac0	NtCreatePort
309	0xa0ae0	NtCreatePrivateNamespace
310	0xa0b00	NtCreateProcess
311	0x9fcf0	NtCreateProcessEx
312	0xa0b20	NtCreateProcessStateChange
313	0xa0b40	NtCreateProfile
314	0xa0b60	NtCreateProfileEx
315	0xa0b80	NtCreateRegistryTransaction
316	0xa0ba0	NtCreateResourceManager
317	0x9fc90	NtCreateSection
318	0xa0bc0	NtCreateSectionEx
319	0xa0be0	NtCreateSemaphore
320	0xa0c00	NtCreateSymbolicLinkObject
321	0x9fd10	NtCreateThread
322	0xa0c20	NtCreateThreadEx
323	0xa0c40	NtCreateThreadStateChange
324	0xa0c60	NtCreateTimer
325	0xa0c80	NtCreateTimer2
326	0xa0ca0	NtCreateToken
327	0xa0cc0	NtCreateTokenEx
328	0xa0ce0	NtCreateTransaction
329	0xa0d00	NtCreateTransactionManager
330	0xa0d20	NtCreateUserProcess
331	0xa0d40	NtCreateWaitCompletionPacket
332	0xa0d60	NtCreateWaitablePort
333	0xa0d80	NtCreateWnfStateName
334	0xa0da0	NtCreateWorkerFactory
335	0xa0dc0	NtDebugActiveProcess
336	0xa0de0	NtDebugContinue
337	0x9f9d0	NtDelayExecution
338	0xa0e00	NtDeleteAtom
339	0xa0e20	NtDeleteBootEntry
340	0xa0e40	NtDeleteDriverEntry
341	0xa0e60	NtDeleteFile
342	0xa0e80	NtDeleteKey
343	0xa0ea0	NtDeleteObjectAuditAlarm
344	0xa0ec0	NtDeletePrivateNamespace
345	0xa0ee0	NtDeleteValueKey
346	0xa0f00	NtDeleteWnfStateData
347	0xa0f20	NtDeleteWnfStateName
348	0x9f430	NtDeviceIoControlFile
349	0xa0f40	NtDirectGraphicsCall
350	0xa0f60	NtDisableLastKnownGood
351	0xa0f80	NtDisplayString
352	0xa0fa0	NtDrawText
353	0x9fad0	NtDuplicateObject
354	0x9fb90	NtDuplicateToken
355	0xa0fc0	NtEnableLastKnownGood
356	0xa0fe0	NtEnumerateBootEntries
357	0xa1000	NtEnumerateDriverEntries
358	0x9f990	NtEnumerateKey
359	0xa1020	NtEnumerateSystemEnvironmentValuesEx
360	0xa1040	NtEnumerateTransactionObject
361	0x9f5b0	NtEnumerateValueKey
362	0xa1060	NtExtendSection
363	0xa1080	NtFilterBootOption
364	0xa10a0	NtFilterToken
365	0xa10c0	NtFilterTokenEx
366	0x9f5d0	NtFindAtom
367	0x9fcb0	NtFlushBuffersFile
368	0xa10e0	NtFlushBuffersFileEx
369	0xa1100	NtFlushInstallUILanguage
370	0xa1120	NtFlushInstructionCache
371	0xa1140	NtFlushKey
372	0xa1160	NtFlushProcessWriteBuffers
373	0xa1180	NtFlushVirtualMemory
374	0xa11a0	NtFlushWriteBuffer
375	0xa11c0	NtFreeUserPhysicalPages
376	0x9f710	NtFreeVirtualMemory
377	0xa11e0	NtFreezeRegistry
378	0xa1200	NtFreezeTransactions
379	0x9fa70	NtFsControlFile
380	0xa1220	NtGetCachedSigningLevel
381	0xa1240	NtGetCompleteWnfStateSubscription
382	0xa1260	NtGetContextThread
383	0xa1280	NtGetCurrentProcessorNumber
384	0xa12a0	NtGetCurrentProcessorNumberEx
385	0xa12c0	NtGetDevicePowerState
386	0xa12e0	NtGetMUIRegistryInfo
387	0xa1300	NtGetNextProcess
388	0xa1320	NtGetNextThread
389	0xa1340	NtGetNlsSectionPtr
390	0xa1360	NtGetNotificationResourceManager
391	0xf0340	NtGetTickCount
392	0xa1380	NtGetWriteWatch
393	0xa13a0	NtImpersonateAnonymousToken
394	0x9f730	NtImpersonateClientOfPort
395	0xa13c0	NtImpersonateThread
396	0xa13e0	NtInitializeEnclave
397	0xa1400	NtInitializeNlsFiles
398	0xa1420	NtInitializeRegistry
399	0xa1440	NtInitiatePowerAction
400	0x9fd30	NtIsProcessInJob
401	0xa1460	NtIsSystemResumeAutomatic
402	0xa1480	NtIsUILanguageComitted
403	0xa14a0	NtListenPort
404	0xa14c0	NtLoadDriver
405	0xa14e0	NtLoadEnclaveData
406	0xa1500	NtLoadKey
407	0xa1520	NtLoadKey2
408	0xa1540	NtLoadKey3
409	0xa1560	NtLoadKeyEx
410	0xa1580	NtLockFile
411	0xa15a0	NtLockProductActivationKeys
412	0xa15c0	NtLockRegistryKey
413	0xa15e0	NtLockVirtualMemory
414	0xa1600	NtMakePermanentObject
415	0xa1620	NtMakeTemporaryObject
416	0xa1640	NtManageHotPatch
417	0xa1660	NtManagePartition
418	0xa1680	NtMapCMFModule
419	0xa16a0	NtMapUserPhysicalPages
420	0x9f3b0	NtMapUserPhysicalPagesScatter
421	0x9f850	NtMapViewOfSection
422	0xa16c0	NtMapViewOfSectionEx
423	0xa16e0	NtModifyBootEntry
424	0xa1700	NtModifyDriverEntry
425	0xa1720	NtNotifyChangeDirectoryFile
426	0xa1740	NtNotifyChangeDirectoryFileEx
427	0xa1760	NtNotifyChangeKey
428	0xa1780	NtNotifyChangeMultipleKeys
429	0xa17a0	NtNotifyChangeSession
430	0xa17c0	NtOpenCpuPartition
431	0x9fe50	NtOpenDirectoryObject
432	0xa17e0	NtOpenEnlistment
433	0x9fb50	NtOpenEvent
434	0xa1800	NtOpenEventPair
435	0x9f9b0	NtOpenFile
436	0xa1820	NtOpenIoCompletion
437	0xa1840	NtOpenJobObject
438	0x9f590	NtOpenKey
439	0xa1860	NtOpenKeyEx
440	0xa1880	NtOpenKeyTransacted
441	0xa18a0	NtOpenKeyTransactedEx
442	0xa18c0	NtOpenKeyedEvent
443	0xa18e0	NtOpenMutant
444	0xa1900	NtOpenObjectAuditAlarm
445	0xa1920	NtOpenPartition
446	0xa1940	NtOpenPrivateNamespace
447	0x9f810	NtOpenProcess
448	0xa1960	NtOpenProcessToken
449	0x9f950	NtOpenProcessTokenEx
450	0xa1980	NtOpenRegistryTransaction
451	0xa19a0	NtOpenResourceManager
452	0x9fa30	NtOpenSection
453	0xa19c0	NtOpenSemaphore
454	0xa19e0	NtOpenSession
455	0xa1a00	NtOpenSymbolicLinkObject
456	0xa1a20	NtOpenThread
457	0x9f7d0	NtOpenThreadToken
458	0x9f930	NtOpenThreadTokenEx
459	0xa1a40	NtOpenTimer
460	0xa1a60	NtOpenTransaction
461	0xa1a80	NtOpenTransactionManager
462	0xa1aa0	NtPlugPlayControl
463	0x9ff20	NtPowerInformation
464	0xa1ac0	NtPrePrepareComplete
465	0xa1ae0	NtPrePrepareEnlistment
466	0xa1b00	NtPrepareComplete
467	0xa1b20	NtPrepareEnlistment
468	0xa1b40	NtPrivilegeCheck
469	0xa1b60	NtPrivilegeObjectAuditAlarm
470	0xa1b80	NtPrivilegedServiceAuditAlarm
471	0xa1ba0	NtPropagationComplete
472	0xa1bc0	NtPropagationFailed
473	0x9fd50	NtProtectVirtualMemory
474	0xa1be0	NtPssCaptureVaSpaceBulk
475	0xa1c00	NtPulseEvent
476	0x9faf0	NtQueryAttributesFile
477	0xa1c20	NtQueryAuxiliaryCounterFrequency
478	0xa1c40	NtQueryBootEntryOrder
479	0xa1c60	NtQueryBootOptions
480	0xa1c80	NtQueryDebugFilterState
481	0x9f5f0	NtQueryDefaultLocale
482	0x9fbd0	NtQueryDefaultUILanguage
483	0x9f9f0	NtQueryDirectoryFile
484	0xa1ca0	NtQueryDirectoryFileEx
485	0xa1cc0	NtQueryDirectoryObject
486	0xa1ce0	NtQueryDriverEntryOrder
487	0xa1d00	NtQueryEaFile
488	0x9fe10	NtQueryEvent
489	0xa1d20	NtQueryFullAttributesFile
490	0xa1d40	NtQueryInformationAtom
491	0xa1d60	NtQueryInformationByName
492	0xa1d80	NtQueryInformationCpuPartition
493	0xa1da0	NtQueryInformationEnlistment
494	0x9f570	NtQueryInformationFile
495	0xa1dc0	NtQueryInformationJobObject
496	0xa1de0	NtQueryInformationPort
497	0x9f670	NtQueryInformationProcess
498	0xa1e00	NtQueryInformationResourceManager
499	0x9f7f0	NtQueryInformationThread
500	0x9f770	NtQueryInformationToken
501	0xa1e20	NtQueryInformationTransaction
502	0xa1e40	NtQueryInformationTransactionManager
503	0xa1e60	NtQueryInformationWorkerFactory
504	0xa1e80	NtQueryInstallUILanguage
505	0xa1ea0	NtQueryIntervalProfile
506	0xa1ec0	NtQueryIoCompletion
507	0xa1ee0	NtQueryIoRingCapabilities
508	0x9f610	NtQueryKey
509	0xa1f00	NtQueryLicenseValue
510	0xa1f20	NtQueryMultipleValueKey
511	0xa1f40	NtQueryMutant
512	0x9f550	NtQueryObject
513	0xa1f60	NtQueryOpenSubKeys
514	0xa1f80	NtQueryOpenSubKeysEx
515	0x9f970	NtQueryPerformanceCounter
516	0xa1fa0	NtQueryPortInformationProcess
517	0xa1fc0	NtQueryQuotaInformationFile
518	0x9fd70	NtQuerySection
519	0xa1fe0	NtQuerySecurityAttributesToken
520	0xa2000	NtQuerySecurityObject
521	0xa2020	NtQuerySecurityPolicy
522	0xa2040	NtQuerySemaphore
523	0xa2060	NtQuerySymbolicLinkObject
524	0xa2080	NtQuerySystemEnvironmentValue
525	0xa20a0	NtQuerySystemEnvironmentValueEx
526	0x9fa10	NtQuerySystemInformation
527	0xa20c0	NtQuerySystemInformationEx
528	0x9fe90	NtQuerySystemTime
529	0x9fa50	NtQueryTimer
530	0xa20e0	NtQueryTimerResolution
531	0x9f630	NtQueryValueKey
532	0x9f7b0	NtQueryVirtualMemory
533	0x9fc70	NtQueryVolumeInformationFile
534	0xa2100	NtQueryWnfStateData
535	0xa2120	NtQueryWnfStateNameInformation
536	0x9fbf0	NtQueueApcThread
537	0xa2140	NtQueueApcThreadEx
538	0xa2160	NtQueueApcThreadEx2
539	0xa2180	NtRaiseException
540	0xa21a0	NtRaiseHardError
541	0x9f410	NtReadFile
542	0x9f910	NtReadFileScatter
543	0xa21c0	NtReadOnlyEnlistment
544	0x9fdd0	NtReadRequestData
545	0x9fb30	NtReadVirtualMemory
546	0xa21e0	NtReadVirtualMemoryEx
547	0xa2200	NtRecoverEnlistment
548	0xa2220	NtRecoverResourceManager
549	0xa2240	NtRecoverTransactionManager
550	0xa2260	NtRegisterProtocolAddressInformation
551	0xa2280	NtRegisterThreadTerminatePort
552	0xa22a0	NtReleaseKeyedEvent
553	0x9f750	NtReleaseMutant
554	0x9f490	NtReleaseSemaphore
555	0xa22c0	NtReleaseWorkerFactoryWorker
556	0x9f470	NtRemoveIoCompletion
557	0xa22e0	NtRemoveIoCompletionEx
558	0xa2300	NtRemoveProcessDebug
559	0xa2320	NtRenameKey
560	0xa2340	NtRenameTransactionManager
561	0xa2360	NtReplaceKey
562	0xa2380	NtReplacePartitionUnit
563	0x9f4d0	NtReplyPort
564	0x9f4b0	NtReplyWaitReceivePort
565	0x9f8b0	NtReplyWaitReceivePortEx
566	0xa23a0	NtReplyWaitReplyPort
567	0xa23c0	NtRequestPort
568	0x9f790	NtRequestWaitReplyPort
569	0xa23e0	NtResetEvent
570	0xa2400	NtResetWriteWatch
571	0xa2420	NtRestoreKey
572	0xa2440	NtResumeProcess
573	0x9fd90	NtResumeThread
574	0xa2460	NtRevertContainerImpersonation
575	0xa2480	NtRollbackComplete
576	0xa24a0	NtRollbackEnlistment
577	0xa24c0	NtRollbackRegistryTransaction
578	0xa24e0	NtRollbackTransaction
579	0xa2500	NtRollforwardTransactionManager
580	0xa2520	NtSaveKey
581	0xa2540	NtSaveKeyEx
582	0xa2560	NtSaveMergedKeys
583	0xa2580	NtSecureConnectPort
584	0xa25a0	NtSerializeBoot
585	0xa25c0	NtSetBootEntryOrder
586	0xa25e0	NtSetBootOptions
587	0xa2600	NtSetCachedSigningLevel
588	0xa2620	NtSetCachedSigningLevel2
589	0xa2640	NtSetContextThread
590	0xa2660	NtSetDebugFilterState
591	0xa2680	NtSetDefaultHardErrorPort
592	0xa26a0	NtSetDefaultLocale
593	0xa26c0	NtSetDefaultUILanguage
594	0xa26e0	NtSetDriverEntryOrder
595	0xa2700	NtSetEaFile
596	0x9f510	NtSetEvent
597	0x9f8f0	NtSetEventBoostPriority
598	0xa2720	NtSetHighEventPair
599	0xa2740	NtSetHighWaitLowEventPair
600	0xa2760	NtSetIRTimer
601	0xa2780	NtSetInformationCpuPartition
602	0xa27a0	NtSetInformationDebugObject
603	0xa27c0	NtSetInformationEnlistment
604	0x9f830	NtSetInformationFile
605	0xa27e0	NtSetInformationIoRing
606	0xa2800	NtSetInformationJobObject
607	0xa2820	NtSetInformationKey
608	0x9fec0	NtSetInformationObject
609	0x9f6d0	NtSetInformationProcess
610	0xa2840	NtSetInformationResourceManager
611	0xa2860	NtSetInformationSymbolicLink
612	0x9f4f0	NtSetInformationThread
613	0xa2880	NtSetInformationToken
614	0xa28a0	NtSetInformationTransaction
615	0xa28c0	NtSetInformationTransactionManager
616	0xa28e0	NtSetInformationVirtualMemory
617	0xa2900	NtSetInformationWorkerFactory
618	0xa2920	NtSetIntervalProfile
619	0xa2940	NtSetIoCompletion
620	0xa2960	NtSetIoCompletionEx
621	0xa2980	NtSetLdtEntries
622	0xa29a0	NtSetLowEventPair
623	0xa29c0	NtSetLowWaitHighEventPair
624	0xa29e0	NtSetQuotaInformationFile
625	0xa2a00	NtSetSecurityObject
626	0xa2a20	NtSetSystemEnvironmentValue
627	0xa2a40	NtSetSystemEnvironmentValueEx
628	0xa2a60	NtSetSystemInformation
629	0xa2a80	NtSetSystemPowerState
630	0xa2aa0	NtSetSystemTime
631	0xa2ac0	NtSetThreadExecutionState
632	0x9ff80	NtSetTimer
633	0xa2ae0	NtSetTimer2
634	0xa2b00	NtSetTimerEx
635	0xa2b20	NtSetTimerResolution
636	0xa2b40	NtSetUuidSeed
637	0x9ff40	NtSetValueKey
638	0xa2b60	NtSetVolumeInformationFile
639	0xa2b80	NtSetWnfProcessNotificationEvent
640	0xa2ba0	NtShutdownSystem
641	0xa2bc0	NtShutdownWorkerFactory
642	0xa2be0	NtSignalAndWaitForSingleObject
643	0xa2c00	NtSinglePhaseReject
644	0xa2c20	NtStartProfile
645	0xa2c40	NtStopProfile
646	0xa2c60	NtSubmitIoRing
647	0xa2c80	NtSubscribeWnfStateChange
648	0xa2ca0	NtSuspendProcess
649	0xa2cc0	NtSuspendThread
650	0xa2ce0	NtSystemDebugControl
651	0xa2d00	NtTerminateEnclave
652	0xa2d20	NtTerminateJobObject
653	0x9f8d0	NtTerminateProcess
654	0x9fdb0	NtTerminateThread
655	0xa2d40	NtTestAlert
656	0xa2d60	NtThawRegistry
657	0xa2d80	NtThawTransactions
658	0xa2da0	NtTraceControl
659	0x9ff00	NtTraceEvent
660	0xa2dc0	NtTranslateFilePath
661	0xa2de0	NtUmsThreadYield
662	0xa2e00	NtUnloadDriver
663	0xa2e20	NtUnloadKey
664	0xa2e40	NtUnloadKey2
665	0xa2e60	NtUnloadKeyEx
666	0xa2e80	NtUnlockFile
667	0xa2ea0	NtUnlockVirtualMemory
668	0x9f890	NtUnmapViewOfSection
669	0xa2ec0	NtUnmapViewOfSectionEx
670	0xa2ee0	NtUnsubscribeWnfStateChange
671	0xa2f00	NtUpdateWnfStateData
672	0xa2f20	NtVdmControl
673	0xa2f40	NtWaitForAlertByThreadId
674	0xa2f60	NtWaitForDebugEvent
675	0xa2f80	NtWaitForKeyedEvent
676	0x9fea0	NtWaitForMultipleObjects
677	0x9f690	NtWaitForMultipleObjects32
678	0x9f3d0	NtWaitForSingleObject
679	0xa2fa0	NtWaitForWorkViaWorkerFactory
680	0xa2fc0	NtWaitHighEventPair
681	0xa2fe0	NtWaitLowEventPair
682	0x9f370	NtWorkerFactoryWorkerReady
683	0x9f450	NtWriteFile
684	0x9f6b0	NtWriteFileGather
685	0x9fe30	NtWriteRequestData
686	0x9fa90	NtWriteVirtualMemory
687	0x9fc10	NtYieldExecution
688	0x9f020	NtdllDefWindowProc_A
689	0x9f030	NtdllDefWindowProc_W
690	0x9f0e0	NtdllDialogWndProc_A
691	0x9f0f0	NtdllDialogWndProc_W
692	0xf0950	PfxFindPrefix
693	0xf0a30	PfxInitialize
694	0xf0a50	PfxInsertPrefix
695	0xf0b70	PfxRemovePrefix
696	0x127290	PssNtCaptureSnapshot
697	0x127760	PssNtDuplicateSnapshot
698	0x1277e0	PssNtFreeRemoteSnapshot
699	0x1279f0	PssNtFreeSnapshot
700	0x127b80	PssNtFreeWalkMarker
701	0x127bc0	PssNtQuerySnapshot
702	0x127e70	PssNtValidateDescriptor
703	0x128000	PssNtWalkSnapshot
704	0x7fae0	RtlAbortRXact
705	0x6c7a0	RtlAbsoluteToSelfRelativeSD
706	0x7fa90	RtlAcquirePebLock
707	0x78d30	RtlAcquirePrivilege
708	0x80c70	RtlAcquireReleaseSRWLockExclusive
709	0x5fd50	RtlAcquireResourceExclusive
710	0x5fc30	RtlAcquireResourceShared
711	0x37810	RtlAcquireSRWLockExclusive
712	0x26840	RtlAcquireSRWLockShared
713	0x74e60	RtlActivateActivationContext
714	0x74eb0	RtlActivateActivationContextEx
715	0x28570	RtlActivateActivationContextUnsafeFast
716	0x7ace0	RtlAddAccessAllowedAce
717	0x7d590	RtlAddAccessAllowedAceEx
718	0xf3be0	RtlAddAccessAllowedObjectAce
719	0x8d100	RtlAddAccessDeniedAce
720	0x880b0	RtlAddAccessDeniedAceEx
721	0xf3c50	RtlAddAccessDeniedObjectAce
722	0xf3cc0	RtlAddAccessFilterAce
723	0x683e0	RtlAddAce
724	0x8be10	RtlAddActionToRXact
725	0x36e0	RtlAddAtomToAtomTable
726	0x80670	RtlAddAttributeActionToRXact
727	0x8d840	RtlAddAuditAccessAce
728	0x8cf60	RtlAddAuditAccessAceEx
729	0xf3ed0	RtlAddAuditAccessObjectAce
730	0xf3f40	RtlAddCompoundAce
731	0xeafe0	RtlAddFunctionTable
732	0x72180	RtlAddGrowableFunctionTable
733	0xf5990	RtlAddIntegrityLabelToBoundaryDescriptor
734	0x689f0	RtlAddMandatoryAce
735	0x67f60	RtlAddProcessTrustLabelAce
736	0x33690	RtlAddRefActivationContext
737	0xe0960	RtlAddRefMemoryStream
738	0xf40b0	RtlAddResourceAttributeAce
739	0x83a50	RtlAddSIDToBoundaryDescriptor
740	0xf4400	RtlAddScopedPolicyIDAce
741	0xae250	RtlAddVectoredContinueHandler
742	0x84500	RtlAddVectoredExceptionHandler
743	0x2ab80	RtlAddressInSectionTable
744	0x7db00	RtlAdjustPrivilege
745	0x73760	RtlAllocateActivationContextStack
746	0x6d8a0	RtlAllocateAndInitializeSid
747	0x8d780	RtlAllocateAndInitializeSidEx
748	0x3d90	RtlAllocateHandle
749	0x3c610	RtlAllocateHeap
750	0x12f010	RtlAllocateMemoryBlockLookaside
751	0x12f0f0	RtlAllocateMemoryZone
752	0x86440	RtlAllocateWnfSerializationGroup
753	0x5f460	RtlAnsiCharToUnicodeChar
754	0x186a0	RtlAnsiStringToUnicodeSize
755	0x24980	RtlAnsiStringToUnicodeString
756	0xf5ff0	RtlAppendAsciizToString
757	0xd5670	RtlAppendPathElement
758	0xf6060	RtlAppendStringToString
759	0x18e80	RtlAppendUnicodeStringToString
760	0xaf70	RtlAppendUnicodeToString
761	0xe6240	RtlApplicationVerifierStop
762	0xf0c40	RtlApplyRXact
763	0x7fab0	RtlApplyRXactNoFlush
764	0xd51f0	RtlAppxIsFileOwnedByTrustedInstaller
765	0x80140	RtlAreAllAccessesGranted
766	0xf0cf0	RtlAreAnyAccessesGranted
767	0xf6130	RtlAreBitsClear
768	0xf6210	RtlAreBitsClearEx
769	0x7f6e0	RtlAreBitsSet
770	0x7b050	RtlAreLongPathsEnabled
771	0xf8aa0	RtlAssert
772	0x72400	RtlAvlInsertNodeEx
773	0x71db0	RtlAvlRemoveNode
774	0xf8bd0	RtlBarrier
775	0xf8be0	RtlBarrierForDelete
776	0xa3510	RtlCallEnclave
777	0xa357b	RtlCallEnclaveReturn
778	0x126810	RtlCancelTimer
779	0xcf20	RtlCanonicalizeDomainName
780	0x112f0	RtlCapabilityCheck
781	0x89340	RtlCapabilityCheckForSingleSessionSku
782	0xa3670	RtlCaptureContext
783	0xa37b0	RtlCaptureContext2
784	0x79cc0	RtlCaptureStackBackTrace
785	0x729b0	RtlCharToInteger
786	0xf9110	RtlCheckBootStatusIntegrity
787	0x81080	RtlCheckForOrphanedCriticalSections
788	0x884b0	RtlCheckPortableOperatingSystem
789	0x8790	RtlCheckRegistryKey
790	0x88d60	RtlCheckSandboxedToken
791	0xf9270	RtlCheckSystemBootStatusIntegrity
792	0x180c0	RtlCheckTokenCapability
793	0xf0d00	RtlCheckTokenMembership
794	0x13ee0	RtlCheckTokenMembershipEx
795	0x11220	RtlCleanUpTEBLangLists
796	0x79bc0	RtlClearAllBits
797	0xf62f0	RtlClearAllBitsEx
798	0x89d60	RtlClearBit
799	0xf6320	RtlClearBitEx
800	0x7e90	RtlClearBits
801	0xf6340	RtlClearBitsEx
802	0x35020	RtlClearThreadWorkOnBehalfTicket
803	0xe0970	RtlCloneMemoryStream
804	0xe1400	RtlCloneUserProcess
805	0xfcd70	RtlCmDecodeMemIoResource
806	0xfcde0	RtlCmEncodeMemIoResource
807	0xe1fc0	RtlCommitDebugInfo
808	0xe0980	RtlCommitMemoryStream
809	0xfd1e0	RtlCompactHeap
810	0x100990	RtlCompareAltitudes
811	0x100b90	RtlCompareExchangePointerMapping
812	0x100ce0	RtlCompareExchangePropertyStore
813	0xa3ed0	RtlCompareMemory
814	0xa3f50	RtlCompareMemoryUlong
815	0x8d500	RtlCompareString
816	0x14600	RtlCompareUnicodeString
817	0x144e0	RtlCompareUnicodeStrings
818	0x9e0e0	RtlCompleteProcessCloning
819	0x84080	RtlCompressBuffer
820	0x52510	RtlComputeCrc32
821	0xeabd0	RtlComputeImportTableHash
822	0xe05e0	RtlComputePrivatizedDllName_U
823	0x88860	RtlConnectToSm
824	0xefda0	RtlConsoleMultiByteToUnicodeN
825	0x101490	RtlConstructCrossVmEventPath
826	0x101490	RtlConstructCrossVmMutexPath
827	0x849d0	RtlContractHashTable
828	0x77f10	RtlConvertDeviceFamilyInfoToString
829	0x87dc0	RtlConvertExclusiveToShared
830	0x89d90	RtlConvertHostPerfCounterToPerfCounter
831	0xf9fd0	RtlConvertLCIDToString
832	0x882a0	RtlConvertSRWLockExclusiveToShared
833	0x7f530	RtlConvertSharedToExclusive
834	0x1a8d0	RtlConvertSidToUnicodeString
835	0xe1960	RtlConvertToAutoInheritSecurityObject
836	0xf6400	RtlCopyBitMap
837	0x53fa0	RtlCopyContext
838	0x101640	RtlCopyExtendedContext
839	0x7da80	RtlCopyLuid
840	0xf0d20	RtlCopyLuidAndAttributesArray
841	0x86230	RtlCopyMappedMemory
842	0xa5ec0	RtlCopyMemory
843	0xa3f80	RtlCopyMemoryNonTemporal
844	0xe0990	RtlCopyMemoryStreamTo
845	0xe0990	RtlCopyOutOfProcessMemoryStreamTo
846	0x6c520	RtlCopySecurityDescriptor
847	0x68b70	RtlCopySid
848	0xf0d60	RtlCopySidAndAttributesArray
849	0x88430	RtlCopyString
850	0x2d120	RtlCopyUnicodeString
851	0x85fb0	RtlCrc32
852	0x101e00	RtlCrc64
853	0x18070	RtlCreateAcl
854	0x75980	RtlCreateActivationContext
855	0x680f0	RtlCreateAndSetSD
856	0x3260	RtlCreateAtomTable
857	0xf92d0	RtlCreateBootStatusDataFile
858	0x85770	RtlCreateBoundaryDescriptor
859	0x57e90	RtlCreateEnvironment
860	0x57eb0	RtlCreateEnvironmentEx
861	0x76630	RtlCreateHashTable
862	0x8c800	RtlCreateHashTableEx
863	0x47a60	RtlCreateHeap
864	0x80190	RtlCreateMemoryBlockLookaside
865	0x80360	RtlCreateMemoryZone
866	0xe1690	RtlCreateProcessParameters
867	0x576f0	RtlCreateProcessParametersEx
868	0x57770	RtlCreateProcessParametersWithTemplate
869	0xe0ae0	RtlCreateProcessReflection
870	0x2480	RtlCreateQueryDebugBuffer
871	0xf9ba0	RtlCreateRegistryKey
872	0x141c0	RtlCreateSecurityDescriptor
873	0xfc50	RtlCreateServiceSid
874	0x6bd00	RtlCreateSystemVolumeInformationFolder
875	0x7f960	RtlCreateTagHeap
876	0x4ce40	RtlCreateTimer
877	0x500e0	RtlCreateTimerQueue
878	0x102b10	RtlCreateUmsCompletionList
879	0x102b20	RtlCreateUmsThreadContext
880	0xe530	RtlCreateUnicodeString
881	0x6ae20	RtlCreateUnicodeStringFromAsciiz
882	0xec070	RtlCreateUserFiberShadowStack
883	0xec0f0	RtlCreateUserProcess
884	0x874c0	RtlCreateUserProcessEx
885	0xe1970	RtlCreateUserSecurityObject
886	0x82100	RtlCreateUserStack
887	0x5bd10	RtlCreateUserThread
888	0x85c70	RtlCreateVirtualAccountSid
889	0x160d0	RtlCultureNameToLCID
890	0x58b30	RtlCustomCPToUnicodeN
891	0x58c60	RtlCutoverTimeToSystemTime
892	0xe1fd0	RtlDeCommitDebugInfo
893	0xe1700	RtlDeNormalizeProcessParams
894	0x73960	RtlDeactivateActivationContext
895	0x26570	RtlDeactivateActivationContextUnsafeFast
896	0x892a0	RtlDebugPrintTimes
897	0x6d860	RtlDecodePointer
898	0xe6900	RtlDecodeRemotePointer
899	0x86b40	RtlDecodeSystemPointer
900	0x101240	RtlDecompressBuffer
901	0x81e60	RtlDecompressBufferEx
902	0x1012e0	RtlDecompressFragment
903	0x19a0	RtlDefaultNpAcl
904	0x55160	RtlDelayExecution
905	0x62a90	RtlDelete
906	0x7be20	RtlDeleteAce
907	0x3630	RtlDeleteAtomFromAtomTable
908	0xf8c00	RtlDeleteBarrier
909	0x390d0	RtlDeleteBoundaryDescriptor
910	0x5a760	RtlDeleteCriticalSection
911	0x62580	RtlDeleteElementGenericTable
912	0x6a6f0	RtlDeleteElementGenericTableAvl
913	0x6a990	RtlDeleteElementGenericTableAvlEx
914	0x8c590	RtlDeleteFunctionTable
915	0x71c30	RtlDeleteGrowableFunctionTable
916	0x7b330	RtlDeleteHashTable
917	0x624d0	RtlDeleteNoSplay
918	0x8d130	RtlDeleteRegistryValue
919	0x5a6d0	RtlDeleteResource
920	0x805e0	RtlDeleteSecurityObject
921	0x4cca0	RtlDeleteTimer
922	0x126820	RtlDeleteTimerQueue
923	0x51750	RtlDeleteTimerQueueEx
924	0x102b30	RtlDeleteUmsCompletionList
925	0x102b40	RtlDeleteUmsThreadContext
926	0x102b50	RtlDequeueUmsCompletionListItems
927	0x102f10	RtlDeregisterSecureMemoryCacheCallback
928	0x88cf0	RtlDeregisterWait
929	0x4c300	RtlDeregisterWaitEx
930	0x2a770	RtlDeriveCapabilitySidsFromName
931	0x8bcd0	RtlDestroyAtomTable
932	0x82a60	RtlDestroyEnvironment
933	0x88cc0	RtlDestroyHandleTable
934	0x48fe0	RtlDestroyHeap
935	0x88bf0	RtlDestroyMemoryBlockLookaside
936	0x88c50	RtlDestroyMemoryZone
937	0x858c0	RtlDestroyProcessParameters
938	0x26d0	RtlDestroyQueryDebugBuffer
939	0x513c0	RtlDetectHeapLeaks
940	0x78bd0	RtlDetermineDosPathNameType_U
941	0xd5370	RtlDisableThreadProfiling
942	0x811b0	RtlDisownModuleHeapAllocation
943	0x4f740	RtlDllShutdownInProgress
944	0x8c240	RtlDnsHostNameToComputerName
945	0x891a0	RtlDoesFileExists_U
946	0x107820	RtlDoesNameContainWildCards
947	0x1b110	RtlDosApplyFileIsolationRedirection_Ustr
948	0xad720	RtlDosLongPathNameToNtPathName_U_WithStatus
949	0xd58d0	RtlDosLongPathNameToRelativeNtPathName_U_WithStatus
950	0x77cc0	RtlDosPathNameToNtPathName_U
951	0x77b10	RtlDosPathNameToNtPathName_U_WithStatus
952	0x83c0	RtlDosPathNameToRelativeNtPathName_U
953	0x1b6c0	RtlDosPathNameToRelativeNtPathName_U_WithStatus
954	0x789a0	RtlDosSearchPath_U
955	0x19f30	RtlDosSearchPath_Ustr
956	0xae700	RtlDowncaseUnicodeChar
957	0x73c40	RtlDowncaseUnicodeString
958	0x108080	RtlDrainNonVolatileFlush
959	0xf3530	RtlDumpResource
960	0x7e360	RtlDuplicateUnicodeString
961	0x8bd90	RtlEmptyAtomTable
962	0xf3590	RtlEnableEarlyCriticalSectionEventCreation
963	0xd53e0	RtlEnableThreadProfiling
964	0xa34a0	RtlEnclaveCallDispatch
965	0xa34d1	RtlEnclaveCallDispatchReturn
966	0x73720	RtlEncodePointer
967	0xe6970	RtlEncodeRemotePointer
968	0x86b80	RtlEncodeSystemPointer
969	0x83f10	RtlEndEnumerationHashTable
970	0x8c810	RtlEndStrongEnumerationHashTable
971	0x101610	RtlEndWeakEnumerationHashTable
972	0x21690	RtlEnterCriticalSection
973	0x102b60	RtlEnterUmsSchedulingMode
974	0xfd500	RtlEnumProcessHeaps
975	0x6cc80	RtlEnumerateEntryHashTable
976	0x62460	RtlEnumerateGenericTable
977	0x62f80	RtlEnumerateGenericTableAvl
978	0x102cb0	RtlEnumerateGenericTableLikeADirectory
979	0x62c90	RtlEnumerateGenericTableWithoutSplaying
980	0x62fa0	RtlEnumerateGenericTableWithoutSplayingAvl
981	0xf5c10	RtlEqualComputerName
982	0xcea0	RtlEqualDomainName
983	0xf0e20	RtlEqualLuid
984	0x166d0	RtlEqualPrefixSid
985	0x103c0	RtlEqualSid
986	0x82e70	RtlEqualString
987	0x29700	RtlEqualUnicodeString
988	0x890c0	RtlEqualWnfChangeStamps
989	0x891f0	RtlEraseUnicodeString
990	0x108140	RtlEthernetAddressToStringA
991	0x1081b0	RtlEthernetAddressToStringW
992	0x108220	RtlEthernetStringToAddressA
993	0x108360	RtlEthernetStringToAddressW
994	0x102b40	RtlExecuteUmsThread
995	0x50bf0	RtlExitUserProcess
996	0x5aa80	RtlExitUserThread
997	0x594c0	RtlExpandEnvironmentStrings
998	0x59440	RtlExpandEnvironmentStrings_U
999	0x893b0	RtlExpandHashTable
1000	0x1084b0	RtlExtendCorrelationVector
1001	0xf5a20	RtlExtendMemoryBlockLookaside
1002	0xf5aa0	RtlExtendMemoryZone
1003	0xf6610	RtlExtractBitMap
1004	0x108980	RtlFillMemory
1005	0xa40c0	RtlFillMemoryNonTemporal
1006	0x1089a0	RtlFillNonVolatileMemory
1007	0xe09a0	RtlFinalReleaseOutOfProcessMemoryStream
1008	0x150a0	RtlFindAceByType
1009	0x1af20	RtlFindActivationContextSectionGuid
1010	0x1cf80	RtlFindActivationContextSectionString
1011	0x1d9d0	RtlFindCharInUnicodeString
1012	0xf67b0	RtlFindClearBits
1013	0x4d60	RtlFindClearBitsAndSet
1014	0xf6b00	RtlFindClearBitsAndSetEx
1015	0xf6e50	RtlFindClearBitsEx
1016	0xf7170	RtlFindClearRuns
1017	0xfcec0	RtlFindClosestEncodableLength
1018	0x7b070	RtlFindExportedRoutineByName
1019	0x7dd60	RtlFindLastBackwardRunClear
1020	0x87cc0	RtlFindLeastSignificantBit
1021	0xf7450	RtlFindLongestRunClear
1022	0x2a650	RtlFindMessage
1023	0x880e0	RtlFindMostSignificantBit
1024	0xf74a0	RtlFindNextForwardRunClear
1025	0x2d80	RtlFindSetBits
1026	0xf75a0	RtlFindSetBitsAndClear
1027	0xf7940	RtlFindSetBitsAndClearEx
1028	0xf7cd0	RtlFindSetBitsEx
1029	0x86160	RtlFindUnicodeSubstring
1030	0xa30d0	RtlFirstEntrySList
1031	0x1acd0	RtlFirstFreeAce
1032	0x74110	RtlFlsAlloc
1033	0x71280	RtlFlsFree
1034	0x571d0	RtlFlsGetValue
1035	0x52330	RtlFlsSetValue
1036	0x772f0	RtlFlushHeaps
1037	0x1080b0	RtlFlushNonVolatileMemory
1038	0x108a50	RtlFlushNonVolatileMemoryRanges
1039	0x102fd0	RtlFlushSecureMemoryCache
1040	0x1a6b0	RtlFormatCurrentUserKeyPath
1041	0x8e520	RtlFormatMessage
1042	0x53650	RtlFormatMessageEx
1043	0x73880	RtlFreeActivationContextStack
1044	0x80160	RtlFreeAnsiString
1045	0x3fa0	RtlFreeHandle
1046	0x3aac0	RtlFreeHeap
1047	0x12f150	RtlFreeMemoryBlockLookaside
1048	0x108ae0	RtlFreeNonVolatileToken
1049	0x8d0e0	RtlFreeOemString
1050	0x765f0	RtlFreeSid
1051	0x737e0	RtlFreeThreadActivationContextStack
1052	0xf5c20	RtlFreeUTF8String
1053	0xe500	RtlFreeUnicodeString
1054	0xec180	RtlFreeUserFiberShadowStack
1055	0x87480	RtlFreeUserStack
1056	0x6e530	RtlGUIDFromString
1057	0x108d90	RtlGenerate8dot3Name
1058	0x6c4c0	RtlGetAce
1059	0x76d30	RtlGetActiveActivationContext
1060	0x858f0	RtlGetActiveConsoleId
1061	0xa580	RtlGetAppContainerNamedObjectPath
1062	0xf0e40	RtlGetAppContainerParent
1063	0xa820	RtlGetAppContainerSidType
1064	0xf8d60	RtlGetCallersAddress
1065	0x843a0	RtlGetCompressionWorkSpaceSize
1066	0x1094e0	RtlGetConsoleSessionForegroundProcessId
1067	0x7e240	RtlGetControlSecurityDescriptor
1068	0xf35c0	RtlGetCriticalSectionRecursionCount
1069	0x7b630	RtlGetCurrentDirectory_U
1070	0x2d30	RtlGetCurrentPeb
1071	0xa41c0	RtlGetCurrentProcessorNumber
1072	0xa4210	RtlGetCurrentProcessorNumberEx
1073	0x3abb0	RtlGetCurrentServiceSessionId
1074	0x708d0	RtlGetCurrentTransaction
1075	0x102b70	RtlGetCurrentUmsThread
1076	0x6c460	RtlGetDaclSecurityDescriptor
1077	0x77ff0	RtlGetDeviceFamilyInfoEnum
1078	0x81330	RtlGetElementGenericTable
1079	0x102de0	RtlGetElementGenericTableAvl
1080	0x84dc0	RtlGetEnabledExtendedFeatures
1081	0x838e0	RtlGetExePath
1082	0x54280	RtlGetExtendedContextLength
1083	0x54630	RtlGetExtendedContextLength2
1084	0x101670	RtlGetExtendedFeaturesMask
1085	0x9100	RtlGetFileMUIPath
1086	0x88200	RtlGetFrame
1087	0x83970	RtlGetFullPathName_U
1088	0x18f20	RtlGetFullPathName_UEx
1089	0x18fb0	RtlGetFullPathName_UstrEx
1090	0xeb2e0	RtlGetFunctionTableListHead
1091	0x7f410	RtlGetGroupSecurityDescriptor
1092	0x82f70	RtlGetImageFileMachines
1093	0x3bc0	RtlGetIntegerAtom
1094	0x7e0b0	RtlGetInterruptTimePrecise
1095	0x804d0	RtlGetLastNtStatus
1096	0xaefb0	RtlGetLastWin32Error
1097	0x776a0	RtlGetLengthWithoutLastFullDosOrNtPathElement
1098	0x883a0	RtlGetLengthWithoutTrailingPathSeperators
1099	0x7f7f0	RtlGetLocaleFileMappingAddress
1100	0x88610	RtlGetLongestNtPathLength
1101	0x7df30	RtlGetMultiTimePrecise
1102	0x9fa10	RtlGetNativeSystemInformation
1103	0x7cf90	RtlGetNextEntryHashTable
1104	0x102b90	RtlGetNextUmsListItem
1105	0x108b00	RtlGetNonVolatileToken
1106	0x9e500	RtlGetNtGlobalFlags
1107	0x49ec0	RtlGetNtProductType
1108	0x183a0	RtlGetNtSystemRoot
1109	0xdf1e0	RtlGetNtVersionNumbers
1110	0x6c3d0	RtlGetOwnerSecurityDescriptor
1111	0x137b0	RtlGetParentLocaleName
1112	0xb020	RtlGetPersistedStateLocation
1113	0xfd510	RtlGetProcessHeaps
1114	0x8ba20	RtlGetProcessPreferredUILanguages
1115	0x77b40	RtlGetProductInfo
1116	0x10a280	RtlGetReturnAddressHijackTarget
1117	0x79c60	RtlGetSaclSecurityDescriptor
1118	0x86350	RtlGetSearchPath
1119	0x88570	RtlGetSecurityDescriptorRMControl
1120	0xf0f30	RtlGetSessionProperties
1121	0xf9470	RtlGetSetBootStatusData
1122	0x49e90	RtlGetSuiteMask
1123	0x882d0	RtlGetSystemBootStatus
1124	0xf95e0	RtlGetSystemBootStatusEx
1125	0x6d770	RtlGetSystemGlobalData
1126	0x81b50	RtlGetSystemPreferredUILanguages
1127	0x7d110	RtlGetSystemTimeAndBias
1128	0x10400	RtlGetSystemTimePrecise
1129	0xd7b10	RtlGetThreadErrorMode
1130	0xfa0e0	RtlGetThreadLangIdByIndex
1131	0x116d0	RtlGetThreadPreferredUILanguages
1132	0x7e1c0	RtlGetThreadWorkOnBehalfTicket
1133	0x87cf0	RtlGetTokenNamedObjectPath
1134	0x89ff0	RtlGetUILanguageInfo
1135	0x102ba0	RtlGetUmsCompletionListEvent
1136	0xd8c00	RtlGetUnloadEventTrace
1137	0xd8c20	RtlGetUnloadEventTraceEx
1138	0x75e10	RtlGetUserInfoHeap
1139	0x809e0	RtlGetUserPreferredUILanguages
1140	0x2f0b0	RtlGetVersion
1141	0xeb300	RtlGrowFunctionTable
1142	0x6d540	RtlGuardCheckLongJumpTarget
1143	0x621a0	RtlHashUnicodeString
1144	0x10a870	RtlHeapTrkInitialize
1145	0x7f580	RtlIdentifierAuthoritySid
1146	0xc260	RtlIdnToAscii
1147	0x10bba0	RtlIdnToNameprepUnicode
1148	0xdf40	RtlIdnToUnicode
1149	0x839a0	RtlImageDirectoryEntryToData
1150	0x2e770	RtlImageNtHeader
1151	0x243e0	RtlImageNtHeaderEx
1152	0x286f0	RtlImageRvaToSection
1153	0xf59a0	RtlImageRvaToVa
1154	0x78f90	RtlImpersonateSelf
1155	0x78fb0	RtlImpersonateSelfEx
1156	0x108500	RtlIncrementCorrelationVector
1157	0xbdd0	RtlInitAnsiString
1158	0x6ae60	RtlInitAnsiStringEx
1159	0xf8c40	RtlInitBarrier
1160	0xae270	RtlInitCodePageTable
1161	0x6ca80	RtlInitEnumerationHashTable
1162	0xe09a0	RtlInitMemoryStream
1163	0xeff20	RtlInitNlsTables
1164	0xe09a0	RtlInitOutOfProcessMemoryStream
1165	0xbdd0	RtlInitString
1166	0xf60c0	RtlInitStringEx
1167	0x8c480	RtlInitStrongEnumerationHashTable
1168	0x15be0	RtlInitUTF8String
1169	0xf60c0	RtlInitUTF8StringEx
1170	0x18350	RtlInitUnicodeString
1171	0x1a820	RtlInitUnicodeStringEx
1172	0x101620	RtlInitWeakEnumerationHashTable
1173	0x9e490	RtlInitializeAtomPackage
1174	0x7e720	RtlInitializeBitMap
1175	0x9e4a0	RtlInitializeBitMapEx
1176	0x7f520	RtlInitializeConditionVariable
1177	0x10bc60	RtlInitializeContext
1178	0x1085f0	RtlInitializeCorrelationVector
1179	0x5c250	RtlInitializeCriticalSection
1180	0x5c300	RtlInitializeCriticalSectionAndSpinCount
1181	0x5c880	RtlInitializeCriticalSectionEx
1182	0x54210	RtlInitializeExtendedContext
1183	0x54720	RtlInitializeExtendedContext2
1184	0x7fc30	RtlInitializeGenericTable
1185	0x839e0	RtlInitializeGenericTableAvl
1186	0x81940	RtlInitializeHandleTable
1187	0x8e5e0	RtlInitializeNtUserPfn
1188	0x8d9c0	RtlInitializeRXact
1189	0x5c460	RtlInitializeResource
1190	0x70910	RtlInitializeSListHead
1191	0x6d9e0	RtlInitializeSRWLock
1192	0x129d0	RtlInitializeSid
1193	0x12970	RtlInitializeSidEx
1194	0x62620	RtlInsertElementGenericTable
1195	0x6a730	RtlInsertElementGenericTableAvl
1196	0x62690	RtlInsertElementGenericTableFull
1197	0x6a7a0	RtlInsertElementGenericTableFullAvl
1198	0x6caf0	RtlInsertEntryHashTable
1199	0x8c940	RtlInstallFunctionTableCallback
1200	0xf8dd0	RtlInt64ToUnicodeString
1201	0x6f310	RtlIntegerToChar
1202	0x6f280	RtlIntegerToUnicodeString
1203	0x7bc90	RtlInterlockedClearBitRun
1204	0xf8020	RtlInterlockedClearBitRunEx
1205	0x72c00	RtlInterlockedFlushSList
1206	0xa30e0	RtlInterlockedPopEntrySList
1207	0x6e350	RtlInterlockedPushEntrySList
1208	0xa3190	RtlInterlockedPushListSList
1209	0xaf170	RtlInterlockedPushListSListEx
1210	0xf80e0	RtlInterlockedSetBitRun
1211	0xfcf70	RtlIoDecodeMemIoResource
1212	0xfd020	RtlIoEncodeMemIoResource
1213	0x82c70	RtlIpv4AddressToStringA
1214	0x82bd0	RtlIpv4AddressToStringExA
1215	0x7ad90	RtlIpv4AddressToStringExW
1216	0x7ae60	RtlIpv4AddressToStringW
1217	0x7f240	RtlIpv4StringToAddressA
1218	0x7f1d0	RtlIpv4StringToAddressExA
1219	0xd580	RtlIpv4StringToAddressExW
1220	0xd6b0	RtlIpv4StringToAddressW
1221	0x80ec0	RtlIpv6AddressToStringA
1222	0x8a3b0	RtlIpv6AddressToStringExA
1223	0x52850	RtlIpv6AddressToStringExW
1224	0x529a0	RtlIpv6AddressToStringW
1225	0x83c10	RtlIpv6StringToAddressA
1226	0x83b80	RtlIpv6StringToAddressExA
1227	0xd8d0	RtlIpv6StringToAddressExW
1228	0xdb00	RtlIpv6StringToAddressW
1229	0xe9fd0	RtlIsActivationContextActive
1230	0xbe10	RtlIsApiSetImplemented
1231	0x13e90	RtlIsCapabilitySid
1232	0x87df0	RtlIsCloudFilesPlaceholder
1233	0xae6e0	RtlIsCriticalSectionLocked
1234	0x2c7a0	RtlIsCriticalSectionLockedByThread
1235	0x6bbd0	RtlIsCurrentProcess
1236	0x1fd0	RtlIsCurrentThread
1237	0x9e1e0	RtlIsCurrentThreadAttachExempt
1238	0x7b180	RtlIsDosDeviceName_U
1239	0xd4a70	RtlIsEcCode
1240	0x85530	RtlIsElevatedRid
1241	0x88ff0	RtlIsEnclaveFeaturePresent
1242	0x9e560	RtlIsFeatureEnabledForEnterprise
1243	0x80610	RtlIsGenericTableEmpty
1244	0xaef00	RtlIsGenericTableEmptyAvl
1245	0x9700	RtlIsMultiSessionSku
1246	0x80d60	RtlIsMultiUsersInSessionSku
1247	0x107880	RtlIsNameInExpression
1248	0x107930	RtlIsNameInUnUpcasedExpression
1249	0x109220	RtlIsNameLegalDOS8Dot3
1250	0xaf180	RtlIsNonEmptyDirectoryReparsePointAllowed
1251	0x10d4d0	RtlIsNormalizedString
1252	0x85d90	RtlIsPackageSid
1253	0x88a30	RtlIsParentOfChildAppContainer
1254	0x85330	RtlIsPartialPlaceholder
1255	0x10bf20	RtlIsPartialPlaceholderFileHandle
1256	0x10bf80	RtlIsPartialPlaceholderFileInfo
1257	0x2bbc0	RtlIsProcessorFeaturePresent
1258	0x6f420	RtlIsStateSeparationEnabled
1259	0x5ff70	RtlIsTextUnicode
1260	0x85c40	RtlIsThreadWithinLoaderCallout
1261	0xf0ff0	RtlIsUntrustedObject
1262	0x3c70	RtlIsValidHandle
1263	0x3c30	RtlIsValidIndexHandle
1264	0x109720	RtlIsValidLocaleName
1265	0x68970	RtlIsValidProcessTrustLabelSid
1266	0x10c050	RtlIsZeroMemory
1267	0x10d5b0	RtlKnownExceptionFilter
1268	0x15640	RtlLCIDToCultureName
1269	0xf8e80	RtlLargeIntegerToChar
1270	0x15920	RtlLcidToLocaleName
1271	0x26ab0	RtlLeaveCriticalSection
1272	0xf81a0	RtlLengthCurrentClearRunBackwardEx
1273	0xf8250	RtlLengthCurrentClearRunForwardEx
1274	0x7d3d0	RtlLengthRequiredSid
1275	0x73250	RtlLengthSecurityDescriptor
1276	0x708f0	RtlLengthSid
1277	0x1a870	RtlLengthSidAsUnicodeString
1278	0x3040	RtlLoadString
1279	0xf0370	RtlLocalTimeToSystemTime
1280	0x15100	RtlLocaleNameToLcid
1281	0x101690	RtlLocateExtendedFeature
1282	0x76530	RtlLocateExtendedFeature2
1283	0x85f70	RtlLocateLegacyContext
1284	0xf9600	RtlLockBootStatusData
1285	0x87180	RtlLockCurrentThread
1286	0x29950	RtlLockHeap
1287	0x51c60	RtlLockMemoryBlockLookaside
1288	0xe09b0	RtlLockMemoryStreamRegion
1289	0x51ce0	RtlLockMemoryZone
1290	0x51a30	RtlLockModuleSection
1291	0x10dd80	RtlLogStackBackTrace
1292	0x3910	RtlLookupAtomInAtomTable
1293	0x627a0	RtlLookupElementGenericTable
1294	0x62e00	RtlLookupElementGenericTableAvl
1295	0x102c10	RtlLookupElementGenericTableFull
1296	0x67380	RtlLookupElementGenericTableFullAvl
1297	0x6cb80	RtlLookupEntryHashTable
1298	0x8a710	RtlLookupFirstMatchingElementGenericTableAvl
1299	0x202e0	RtlLookupFunctionEntry
1300	0x9e390	RtlLookupFunctionTable
1301	0x6c7c0	RtlMakeSelfRelativeSD
1302	0x76f80	RtlMapGenericMask
1303	0xf1180	RtlMapSecurityErrorToNtStatus
1304	0xa5ec0	RtlMoveMemory
1305	0x6e360	RtlMultiAppendUnicodeStringBuffer
1306	0x58aa0	RtlMultiByteToUnicodeN
1307	0x186d0	RtlMultiByteToUnicodeSize
1308	0xfd7f0	RtlMultipleAllocateHeap
1309	0xfd870	RtlMultipleFreeHeap
1310	0xe1a10	RtlNewInstanceSecurityObject
1311	0xe1b40	RtlNewSecurityGrantedAccess
1312	0x863a0	RtlNewSecurityObject
1313	0x7da90	RtlNewSecurityObjectEx
1314	0xe1c90	RtlNewSecurityObjectWithMultipleInheritance
1315	0x87580	RtlNormalizeProcessParams
1316	0xf1290	RtlNormalizeSecurityDescriptor
1317	0x89590	RtlNormalizeString
1318	0xaf210	RtlNotifyFeatureUsage
1319	0xd5900	RtlNtPathNameToDosPathName
1320	0x53140	RtlNtStatusToDosError
1321	0x77200	RtlNtStatusToDosErrorNoTeb
1322	0x1326a0	RtlNtdllName
1323	0x853d0	RtlNumberGenericTableElements
1324	0x85a50	RtlNumberGenericTableElementsAvl
1325	0x8c560	RtlNumberOfClearBits
1326	0xf8340	RtlNumberOfClearBitsEx
1327	0xf8370	RtlNumberOfClearBitsInRange
1328	0x7fc70	RtlNumberOfSetBits
1329	0xf83a0	RtlNumberOfSetBitsEx
1330	0xf8540	RtlNumberOfSetBitsInRange
1331	0x8cfb0	RtlNumberOfSetBitsUlongPtr
1332	0x589d0	RtlOemStringToUnicodeSize
1333	0x58900	RtlOemStringToUnicodeString
1334	0x58a50	RtlOemToUnicodeN
1335	0x6bb60	RtlOpenCrossProcessEmulatorWorkConnection
1336	0xe420	RtlOpenCurrentUser
1337	0x10eb30	RtlOsDeploymentState
1338	0x10e7a0	RtlOverwriteFeatureConfigurationBuffer
1339	0x8c7e0	RtlOwnerAcesPresent
1340	0x76590	RtlPcToFileHeader
1341	0xf58d0	RtlPinAtomInAtomTable
1342	0x67bf0	RtlPopFrame
1343	0x82dd0	RtlPrefixString
1344	0x14440	RtlPrefixUnicodeString
1345	0x9e220	RtlPrepareForProcessCloning
1346	0x511a0	RtlProcessFlsData
1347	0x48bb0	RtlProtectHeap
1348	0x804f0	RtlPublishWnfStateData
1349	0x67b40	RtlPushFrame
1350	0x7d1e0	RtlQueryActivationContextApplicationSettings
1351	0x709c0	RtlQueryAllFeatureConfigurations
1352	0x3360	RtlQueryAtomInAtomTable
1353	0xf35f0	RtlQueryCriticalSectionOwner
1354	0x6e520	RtlQueryDepthSList
1355	0xf9be0	RtlQueryDynamicTimeZoneInformation
1356	0x838a0	RtlQueryElevationFlags
1357	0x1e6f0	RtlQueryEnvironmentVariable
1358	0x58850	RtlQueryEnvironmentVariable_U
1359	0x70a70	RtlQueryFeatureConfiguration
1360	0x891b0	RtlQueryFeatureConfigurationChangeStamp
1361	0x70940	RtlQueryFeatureUsageNotificationSubscriptions
1362	0x8ae00	RtlQueryHeapInformation
1363	0xec260	RtlQueryImageMitigationPolicy
1364	0x77e70	RtlQueryInformationAcl
1365	0x32fb0	RtlQueryInformationActivationContext
1366	0x82b90	RtlQueryInformationActiveActivationContext
1367	0xe09c0	RtlQueryInterfaceMemoryStream
1368	0xee910	RtlQueryModuleInformation
1369	0x6ded0	RtlQueryPackageClaims
1370	0x6de00	RtlQueryPackageIdentity
1371	0x6de60	RtlQueryPackageIdentityEx
1372	0x104c0	RtlQueryPerformanceCounter
1373	0x771e0	RtlQueryPerformanceFrequency
1374	0x100f10	RtlQueryPointerMapping
1375	0xe1fe0	RtlQueryProcessBackTraceInformation
1376	0x1320	RtlQueryProcessDebugInformation
1377	0xe2170	RtlQueryProcessHeapInformation
1378	0xe2700	RtlQueryProcessLockInformation
1379	0x10c000	RtlQueryProcessPlaceholderCompatibilityMode
1380	0x100fd0	RtlQueryPropertyStore
1381	0x84750	RtlQueryProtectedPolicy
1382	0x8d890	RtlQueryRegistryValueWithFallback
1383	0xf9c00	RtlQueryRegistryValues
1384	0x87bb0	RtlQueryRegistryValuesEx
1385	0x49760	RtlQueryResourcePolicy
1386	0xe1cf0	RtlQuerySecurityObject
1387	0xfd8e0	RtlQueryTagHeap
1388	0x84140	RtlQueryThreadPlaceholderCompatibilityMode
1389	0xd54e0	RtlQueryThreadProfiling
1390	0x5db90	RtlQueryTimeZoneInformation
1391	0x86850	RtlQueryTokenHostIdAsUlong64
1392	0x102bb0	RtlQueryUmsThreadInformation
1393	0x67450	RtlQueryUnbiasedInterruptTime
1394	0x10ec70	RtlQueryValidationRunlevel
1395	0x863f0	RtlQueryWnfMetaNotification
1396	0x60d70	RtlQueryWnfStateData
1397	0x873a0	RtlQueryWnfStateDataWithExplicitScope
1398	0xe6430	RtlQueueApcWow64Thread
1399	0x4c4a0	RtlQueueWorkItem
1400	0x10ed30	RtlRaiseCustomSystemEventTrigger
1401	0x542d0	RtlRaiseException
1402	0xa4280	RtlRaiseExceptionForReturnAddressHijack
1403	0xa3e40	RtlRaiseNoncontinuableException
1404	0x10f140	RtlRaiseStatus
1405	0x7cfd0	RtlRandom
1406	0x7cfd0	RtlRandomEx
1407	0x38ca0	RtlRbInsertNodeEx
1408	0x383a0	RtlRbRemoveNode
1409	0x41c50	RtlReAllocateHeap
1410	0xe09d0	RtlReadMemoryStream
1411	0xe09d0	RtlReadOutOfProcessMemoryStream
1412	0xd5510	RtlReadThreadProfilingData
1413	0xaeeb0	RtlRealPredecessor
1414	0x62cf0	RtlRealSuccessor
1415	0x607b0	RtlRegisterFeatureConfigurationChangeNotification
1416	0x60750	RtlRegisterForWnfMetaNotification
1417	0x103040	RtlRegisterSecureMemoryCacheCallback
1418	0x80410	RtlRegisterThreadWithCsrss
1419	0x4d0b0	RtlRegisterWait
1420	0x33820	RtlReleaseActivationContext
1421	0xe0960	RtlReleaseMemoryStream
1422	0x327f0	RtlReleasePath
1423	0x7d960	RtlReleasePebLock
1424	0x81a90	RtlReleasePrivilege
1425	0x2e240	RtlReleaseRelativeName
1426	0x5fe90	RtlReleaseResource
1427	0x336d0	RtlReleaseSRWLockExclusive
1428	0x26780	RtlReleaseSRWLockShared
1429	0x10bd90	RtlRemoteCall
1430	0x7d980	RtlRemoveEntryHashTable
1431	0x101060	RtlRemovePointerMapping
1432	0x87a50	RtlRemovePrivileges
1433	0x101140	RtlRemovePropertyStore
1434	0xe3a10	RtlRemoveVectoredContinueHandler
1435	0x85590	RtlRemoveVectoredExceptionHandler
1436	0xf1570	RtlReplaceSidInSd
1437	0x86040	RtlReplaceSystemDirectoryInPath
1438	0xe6b10	RtlReportException
1439	0xe6be0	RtlReportExceptionEx
1440	0x50d30	RtlReportSilentProcessExit
1441	0xe7540	RtlReportSqmEscalation
1442	0xf5a40	RtlResetMemoryBlockLookaside
1443	0xf5bb0	RtlResetMemoryZone
1444	0x8e700	RtlResetNtUserPfn
1445	0xeff30	RtlResetRtlTranslations
1446	0xf9620	RtlRestoreBootStatusDefaults
1447	0x6d3d0	RtlRestoreContext
1448	0x532e0	RtlRestoreLastWin32Error
1449	0xf9750	RtlRestoreSystemBootStatusDefaults
1450	0x8a270	RtlRestoreThreadPreferredUILanguages
1451	0x8e780	RtlRetrieveNtUserPfn
1452	0xe09e0	RtlRevertMemoryStream
1453	0xf1880	RtlRunDecodeUnicodeString
1454	0xf18e0	RtlRunEncodeUnicodeString
1455	0x60920	RtlRunOnceBeginInitialize
1456	0x60ca0	RtlRunOnceComplete
1457	0x32360	RtlRunOnceExecuteOnce
1458	0x844f0	RtlRunOnceInitialize
1459	0xf03e0	RtlSecondsSince1970ToTime
1460	0xf0410	RtlSecondsSince1980ToTime
1461	0xe09f0	RtlSeekMemoryStream
1462	0x6c5e0	RtlSelfRelativeToAbsoluteSD
1463	0x89aa0	RtlSelfRelativeToAbsoluteSD2
1464	0x887b0	RtlSendMsgToSm
1465	0x7caa0	RtlSetAllBits
1466	0xf87c0	RtlSetAllBitsEx
1467	0xf1990	RtlSetAttributesSecurityDescriptor
1468	0x82f40	RtlSetBit
1469	0x9e4c0	RtlSetBitEx
1470	0x5020	RtlSetBits
1471	0xf8830	RtlSetBitsEx
1472	0x6c410	RtlSetControlSecurityDescriptor
1473	0x74920	RtlSetCriticalSectionSpinCount
1474	0x7b3e0	RtlSetCurrentDirectory_U
1475	0x8e050	RtlSetCurrentEnvironment
1476	0x6ad00	RtlSetCurrentTransaction
1477	0x14250	RtlSetDaclSecurityDescriptor
1478	0xf9c30	RtlSetDynamicTimeZoneInformation
1479	0xd7810	RtlSetEnvironmentStrings
1480	0x147a0	RtlSetEnvironmentVar
1481	0x588c0	RtlSetEnvironmentVariable
1482	0x1016b0	RtlSetExtendedFeaturesMask
1483	0x10e840	RtlSetFeatureConfigurations
1484	0x142c0	RtlSetGroupSecurityDescriptor
1485	0x7cb00	RtlSetHeapInformation
1486	0xecd80	RtlSetImageMitigationPolicy
1487	0xf4680	RtlSetInformationAcl
1488	0x126840	RtlSetIoCompletionCallback
1489	0x532e0	RtlSetLastWin32Error
1490	0x53120	RtlSetLastWin32ErrorAndNtStatusFromNtStatus
1491	0xe0a00	RtlSetMemoryStreamSize
1492	0x141f0	RtlSetOwnerSecurityDescriptor
1493	0xf9b50	RtlSetPortableOperatingSystem
1494	0xe29a0	RtlSetProcessDebugInformation
1495	0x8de80	RtlSetProcessIsCritical
1496	0x89070	RtlSetProcessPlaceholderCompatibilityMode
1497	0x6f560	RtlSetProcessPreferredUILanguages
1498	0x827d0	RtlSetProtectedPolicy
1499	0x88a00	RtlSetProxiedProcessId
1500	0x68bb0	RtlSetSaclSecurityDescriptor
1501	0x2000	RtlSetSearchPathMode
1502	0x88400	RtlSetSecurityDescriptorRMControl
1503	0x79db0	RtlSetSecurityObject
1504	0x8c7a0	RtlSetSecurityObjectEx
1505	0x88310	RtlSetSystemBootStatus
1506	0xf9790	RtlSetSystemBootStatusEx
1507	0x573d0	RtlSetThreadErrorMode
1508	0x88220	RtlSetThreadIsCritical
1509	0x80800	RtlSetThreadPlaceholderCompatibilityMode
1510	0x87be0	RtlSetThreadPoolStartFunc
1511	0x6f870	RtlSetThreadPreferredUILanguages
1512	0x6f700	RtlSetThreadPreferredUILanguages2
1513	0x4e8f0	RtlSetThreadSubProcessTag
1514	0x4e880	RtlSetThreadWorkOnBehalfTicket
1515	0xf9c50	RtlSetTimeZoneInformation
1516	0x126830	RtlSetTimer
1517	0x102bc0	RtlSetUmsThreadInformation
1518	0x81f00	RtlSetUnhandledExceptionFilter
1519	0xfddc0	RtlSetUserFlagsHeap
1520	0x76240	RtlSetUserValueHeap
1521	0x7fdf0	RtlSidDominates
1522	0x688e0	RtlSidDominatesForTrust
1523	0xf19c0	RtlSidEqualLevel
1524	0x78c50	RtlSidHashInitialize
1525	0x74970	RtlSidHashLookup
1526	0xf1a50	RtlSidIsHigherLevel
1527	0x3a4e0	RtlSizeHeap
1528	0x68c20	RtlSleepConditionVariableCS
1529	0x690a0	RtlSleepConditionVariableSRW
1530	0x62890	RtlSplay
1531	0x80ca0	RtlStartRXact
1532	0xe0a10	RtlStatMemoryStream
1533	0x6e610	RtlStringFromGUID
1534	0x6e620	RtlStringFromGUIDEx
1535	0x8a820	RtlStronglyEnumerateEntryHashTable
1536	0x77b00	RtlSubAuthorityCountSid
1537	0x740f0	RtlSubAuthoritySid
1538	0x10e950	RtlSubscribeForFeatureUsageNotification
1539	0x60e40	RtlSubscribeWnfStateChangeNotification
1540	0x62b30	RtlSubtreePredecessor
1541	0x102be0	RtlSubtreeSuccessor
1542	0x49850	RtlSwitchedVVI
1543	0x7de20	RtlSystemTimeToLocalTime
1544	0x865e0	RtlTestAndPublishWnfStateData
1545	0x89040	RtlTestBit
1546	0x9e4e0	RtlTestBitEx
1547	0x86ba0	RtlTestProtectedAccess
1548	0x58e10	RtlTimeFieldsToTime
1549	0xf0440	RtlTimeToElapsedTimeFields
1550	0x7bda0	RtlTimeToSecondsSince1970
1551	0x7bd50	RtlTimeToSecondsSince1980
1552	0x59140	RtlTimeToTimeFields
1553	0x10f200	RtlTraceDatabaseAdd
1554	0x10f280	RtlTraceDatabaseCreate
1555	0x10f3c0	RtlTraceDatabaseDestroy
1556	0x10f440	RtlTraceDatabaseEnumerate
1557	0x10f520	RtlTraceDatabaseFind
1558	0x10f5a0	RtlTraceDatabaseLock
1559	0x10f5d0	RtlTraceDatabaseUnlock
1560	0x10f5f0	RtlTraceDatabaseValidate
1561	0x472f0	RtlTryAcquirePebLock
1562	0x75c70	RtlTryAcquireSRWLockExclusive
1563	0x79bf0	RtlTryAcquireSRWLockShared
1564	0xf34b0	RtlTryConvertSRWLockSharedToExclusiveOrRelease
1565	0x43960	RtlTryEnterCriticalSection
1566	0x551e0	RtlUTF8StringToUnicodeString
1567	0x552c0	RtlUTF8ToUnicodeN
1568	0x10fa40	RtlUdiv128
1569	0x102bd0	RtlUmsThreadYield
1570	0x9ea50	RtlUnhandledExceptionFilter
1571	0x10d5d0	RtlUnhandledExceptionFilter2
1572	0x575b0	RtlUnicodeStringToAnsiSize
1573	0x18720	RtlUnicodeStringToAnsiString
1574	0xf5c50	RtlUnicodeStringToCountedOemString
1575	0x76e00	RtlUnicodeStringToInteger
1576	0x575b0	RtlUnicodeStringToOemSize
1577	0x574e0	RtlUnicodeStringToOemString
1578	0x10f920	RtlUnicodeStringToUTF8String
1579	0x188b0	RtlUnicodeToCustomCPN
1580	0x183d0	RtlUnicodeToMultiByteN
1581	0x18840	RtlUnicodeToMultiByteSize
1582	0x58a00	RtlUnicodeToOemN
1583	0x596a0	RtlUnicodeToUTF8N
1584	0x8e490	RtlUniform
1585	0xf97b0	RtlUnlockBootStatusData
1586	0x872b0	RtlUnlockCurrentThread
1587	0x297d0	RtlUnlockHeap
1588	0x51e20	RtlUnlockMemoryBlockLookaside
1589	0xe09b0	RtlUnlockMemoryStreamRegion
1590	0x51e80	RtlUnlockMemoryZone
1591	0x51980	RtlUnlockModuleSection
1592	0x4feb0	RtlUnregisterFeatureConfigurationChangeNotification
1593	0x10e960	RtlUnsubscribeFromFeatureUsageNotifications
1594	0x4bfa0	RtlUnsubscribeWnfNotificationWaitForCompletion
1595	0x88dc0	RtlUnsubscribeWnfNotificationWithCompletionCallback
1596	0x881d0	RtlUnsubscribeWnfStateChangeNotification
1597	0x54110	RtlUnwind
1598	0x1fae0	RtlUnwindEx
1599	0x59660	RtlUpcaseUnicodeChar
1600	0xfae0	RtlUpcaseUnicodeString
1601	0xf5d90	RtlUpcaseUnicodeStringToAnsiString
1602	0xf5eb0	RtlUpcaseUnicodeStringToCountedOemString
1603	0x89e00	RtlUpcaseUnicodeStringToOemString
1604	0xeff40	RtlUpcaseUnicodeToCustomCPN
1605	0x7e570	RtlUpcaseUnicodeToMultiByteN
1606	0x89ee0	RtlUpcaseUnicodeToOemN
1607	0x50e80	RtlUpdateClonedCriticalSection
1608	0x9e470	RtlUpdateClonedSRWLock
1609	0x4fff0	RtlUpdateTimer
1610	0x82f10	RtlUpperChar
1611	0xf60d0	RtlUpperString
1612	0x87c20	RtlUserFiberStart
1613	0x5aa20	RtlUserThreadStart
1614	0x1ad30	RtlValidAcl
1615	0xeded0	RtlValidProcessProtection
1616	0x7aec0	RtlValidRelativeSecurityDescriptor
1617	0x71180	RtlValidSecurityDescriptor
1618	0x1ac90	RtlValidSid
1619	0x108680	RtlValidateCorrelationVector
1620	0x86cf0	RtlValidateHeap
1621	0xfe430	RtlValidateProcessHeaps
1622	0x7e4a0	RtlValidateUnicodeString
1623	0x84bd0	RtlVerifyVersionInfo
1624	0x207a0	RtlVirtualUnwind
1625	0x10fab0	RtlVirtualUnwind2
1626	0x605e0	RtlWaitForWnfMetaNotification
1627	0x4ba80	RtlWaitOnAddress
1628	0x29a80	RtlWakeAddressAll
1629	0x10ff30	RtlWakeAddressAllNoFence
1630	0x86b20	RtlWakeAddressSingle
1631	0x10ff40	RtlWakeAddressSingleNoFence
1632	0x5b170	RtlWakeAllConditionVariable
1633	0x69520	RtlWakeConditionVariable
1634	0x79d60	RtlWalkFrameChain
1635	0xaecd0	RtlWalkHeap
1636	0x101630	RtlWeaklyEnumerateEntryHashTable
1637	0xe7550	RtlWerpReportException
1638	0xe8ae0	RtlWnfCompareChangeStamp
1639	0x88e60	RtlWnfDllUnloadCallback
1640	0x9e300	RtlWow64CallFunction64
1641	0xe6450	RtlWow64ChangeProcessState
1642	0xe6470	RtlWow64ChangeThreadState
1643	0xe64a0	RtlWow64EnableFsRedirection
1644	0x88e50	RtlWow64EnableFsRedirectionEx
1645	0x54510	RtlWow64GetCpuAreaInfo
1646	0x54490	RtlWow64GetCurrentCpuArea
1647	0x53f50	RtlWow64GetCurrentMachine
1648	0x85510	RtlWow64GetEquivalentMachineCHPE
1649	0x7e8f0	RtlWow64GetProcessMachines
1650	0x1da0	RtlWow64GetSharedInfoProcess
1651	0xe64b0	RtlWow64GetThreadContext
1652	0xe64e0	RtlWow64GetThreadSelectorEntry
1653	0x811d0	RtlWow64IsWowGuestMachineSupported
1654	0xe17e0	RtlWow64LogMessageInEventLogger
1655	0x10ff50	RtlWow64PopAllCrossProcessWorkFromWorkList
1656	0x110030	RtlWow64PopCrossProcessWorkFromFreeList
1657	0x1100f0	RtlWow64PushCrossProcessWorkOntoFreeList
1658	0x1101c0	RtlWow64PushCrossProcessWorkOntoWorkList
1659	0x110450	RtlWow64RequestCrossProcessHeavyFlush
1660	0xe6680	RtlWow64SetThreadContext
1661	0xe66a0	RtlWow64SuspendProcess
1662	0x1c60	RtlWow64SuspendThread
1663	0xe0a20	RtlWriteMemoryStream
1664	0x108b80	RtlWriteNonVolatileMemory
1665	0x8d020	RtlWriteRegistryValue
1666	0x101e20	RtlZeroHeap
1667	0x8d0c0	RtlZeroMemory
1668	0xe9ce0	RtlZombifyActivationContext
1669	0x808c0	RtlpApplyLengthFunction
1670	0x7ea00	RtlpCheckDynamicTimeZoneInformation
1671	0xfa7c0	RtlpCleanupRegistryKeys
1672	0xf4870	RtlpConvertAbsoluteToRelativeSecurityAttribute
1673	0xfacb0	RtlpConvertCultureNamesToLCIDs
1674	0xfaec0	RtlpConvertLCIDsToCultureNames
1675	0xf4be0	RtlpConvertRelativeToAbsoluteSecurityAttribute
1676	0x1ecf0	RtlpCreateProcessRegistryInfo
1677	0x6e470	RtlpEnsureBufferSize
1678	0x186110	RtlpFreezeTimeBias
1679	0x78000	RtlpGetDeviceFamilyInfoEnum
1680	0x86800	RtlpGetLCIDFromLangInfoNode
1681	0x85ad0	RtlpGetNameFromLangInfoNode
1682	0x128c0	RtlpGetSystemDefaultUILanguage
1683	0x1108a0	RtlpGetUserOrMachineUILanguage4NLS
1684	0x8a520	RtlpInitializeLangRegistryInfo
1685	0x40a0	RtlpIsQualifiedLanguage
1686	0x87980	RtlpLoadMachineUIByPolicy
1687	0xa230	RtlpLoadUserUIByPolicy
1688	0x2880	RtlpMergeSecurityAttributeInformation
1689	0x8a4a0	RtlpMuiFreeLangRegistryInfo
1690	0x111440	RtlpMuiRegCreateRegistryInfo
1691	0x9ec0	RtlpMuiRegFreeRegistryInfo
1692	0x9dd0	RtlpMuiRegLoadRegistryInfo
1693	0xf3810	RtlpNotOwnerCriticalSection
1694	0x114d10	RtlpNtCreateKey
1695	0x847e0	RtlpNtEnumerateSubKey
1696	0x114d50	RtlpNtMakeTemporaryKey
1697	0x80650	RtlpNtOpenKey
1698	0x80010	RtlpNtQueryValueKey
1699	0x114d60	RtlpNtSetValueKey
1700	0x6ffc0	RtlpQueryDefaultUILanguage
1701	0xe3070	RtlpQueryProcessDebugInformationFromWow64
1702	0xe3110	RtlpQueryProcessDebugInformationRemote
1703	0x113220	RtlpRefreshCachedUILanguage
1704	0xfb970	RtlpSetInstallLanguage
1705	0xfc030	RtlpSetPreferredUILanguages
1706	0xfc030	RtlpSetUserPreferredUILanguages
1707	0x58e20	RtlpTimeFieldsToTime
1708	0x59150	RtlpTimeToTimeFields
1709	0xf3b70	RtlpUnWaitCriticalSection
1710	0x8dd20	RtlpVerifyAndCommitUILanguageSettings
1711	0xf3bd0	RtlpWaitForCriticalSection
1712	0x1104b0	RtlpWow64CtxFromAmd64
1713	0x79a70	RtlpWow64GetContextOnAmd64
1714	0x77cf0	RtlpWow64SetContextOnAmd64
1715	0x186a0	RtlxAnsiStringToUnicodeSize
1716	0x589d0	RtlxOemStringToUnicodeSize
1717	0x575b0	RtlxUnicodeStringToAnsiSize
1718	0x575b0	RtlxUnicodeStringToOemSize
1719	0x126f80	SbExecuteProcedure
1720	0x2ec50	SbSelectProcedure
1721	0xe7ff0	ShipAssert
1722	0xe8130	ShipAssertGetBufferInfo
1723	0xe8160	ShipAssertMsgA
1724	0xe8170	ShipAssertMsgW
1725	0x88a90	TpAllocAlpcCompletion
1726	0x4b2e0	TpAllocAlpcCompletionEx
1727	0x813b0	TpAllocCleanupGroup
1728	0x4b790	TpAllocIoCompletion
1729	0x505d0	TpAllocJobNotification
1730	0x4b6c0	TpAllocPool
1731	0x2e130	TpAllocTimer
1732	0x4d410	TpAllocWait
1733	0x609f0	TpAllocWork
1734	0x51ff0	TpAlpcRegisterCompletionList
1735	0x51fb0	TpAlpcUnregisterCompletionList
1736	0x125a20	TpCallbackDetectedUnrecoverableError
1737	0x4ec30	TpCallbackIndependent
1738	0x8c760	TpCallbackLeaveCriticalSectionOnCompletion
1739	0x4f170	TpCallbackMayRunLong
1740	0x125a50	TpCallbackReleaseMutexOnCompletion
1741	0x125a90	TpCallbackReleaseSemaphoreOnCompletion
1742	0x6ad30	TpCallbackSendAlpcMessageOnCompletion
1743	0x825d0	TpCallbackSendPendingAlpcMessage
1744	0x885a0	TpCallbackSetEventOnCompletion
1745	0x812f0	TpCallbackUnloadDllOnCompletion
1746	0x4b590	TpCancelAsyncIoOperation
1747	0x782c0	TpCaptureCaller
1748	0x5aae0	TpCheckTerminateWorker
1749	0x125ad0	TpDbgDumpHeapUsage
1750	0x125b90	TpDbgSetLogRoutine
1751	0x88e70	TpDisablePoolCallbackChecks
1752	0x84b50	TpDisassociateCallback
1753	0x31580	TpIsTimerSet
1754	0x346b0	TpPostWork
1755	0x125520	TpQueryPoolStackInformation
1756	0x50210	TpReleaseAlpcCompletion
1757	0x85850	TpReleaseCleanupGroup
1758	0x67690	TpReleaseCleanupGroupMembers
1759	0x4b650	TpReleaseIoCompletion
1760	0x50810	TpReleaseJobNotification
1761	0x84f80	TpReleasePool
1762	0x4ddf0	TpReleaseTimer
1763	0x4d5f0	TpReleaseWait
1764	0x4e040	TpReleaseWork
1765	0x1255e0	TpSetDefaultPoolMaxThreads
1766	0x50480	TpSetDefaultPoolStackInformation
1767	0x80840	TpSetPoolMaxThreads
1768	0x83840	TpSetPoolMaxThreadsSoftLimit
1769	0x85480	TpSetPoolMinThreads
1770	0x505a0	TpSetPoolStackInformation
1771	0x88f40	TpSetPoolThreadBasePriority
1772	0x125730	TpSetPoolThreadCpuSets
1773	0x4b1d0	TpSetPoolWorkerThreadIdleTimeout
1774	0x315c0	TpSetTimer
1775	0x326e0	TpSetTimerEx
1776	0x82a50	TpSetWait
1777	0x301d0	TpSetWaitEx
1778	0x32990	TpSimpleTryPost
1779	0x34610	TpStartAsyncIoOperation
1780	0x4cdf0	TpTimerOutstandingCallbackCount
1781	0x68d80	TpTrimPools
1782	0x516e0	TpWaitForAlpcCompletion
1783	0x87b50	TpWaitForIoCompletion
1784	0x50980	TpWaitForJobNotification
1785	0x2f430	TpWaitForTimer
1786	0x4f650	TpWaitForWait
1787	0x4c2c0	TpWaitForWork
1788	0x33940	TpWorkOnBehalfClearTicket
1789	0x4e580	TpWorkOnBehalfSetTicket
1790	0x7b1c0	VerSetConditionMask
1791	0xe78d0	WerReportExceptionWorker
1792	0xe8640	WerReportSQMEvent
1793	0x84430	WinSqmAddToAverageDWORD
1794	0x892b0	WinSqmAddToStream
1795	0x88e40	WinSqmAddToStreamEx
1796	0xe89d0	WinSqmCheckEscalationAddToStreamEx
1797	0xe89e0	WinSqmCheckEscalationSetDWORD
1798	0xe89f0	WinSqmCheckEscalationSetDWORD64
1799	0xe8a00	WinSqmCheckEscalationSetString
1800	0xe8a10	WinSqmCommonDatapointDelete
1801	0xe8a20	WinSqmCommonDatapointSetDWORD
1802	0xe8a30	WinSqmCommonDatapointSetDWORD64
1803	0xe8a40	WinSqmCommonDatapointSetStreamEx
1804	0xe8a50	WinSqmCommonDatapointSetString
1805	0x89280	WinSqmEndSession
1806	0xe8a60	WinSqmEventEnabled
1807	0xe8a70	WinSqmEventWrite
1808	0xe8a80	WinSqmGetEscalationRuleStatus
1809	0xe8a90	WinSqmGetInstrumentationProperty
1810	0x84430	WinSqmIncrementDWORD
1811	0x86b70	WinSqmIsOptedIn
1812	0xe8ab0	WinSqmIsOptedInEx
1813	0xe8a10	WinSqmIsSessionDisabled
1814	0x84430	WinSqmSetDWORD
1815	0xe8ac0	WinSqmSetDWORD64
1816	0x9e310	WinSqmSetEscalationInfo
1817	0x84430	WinSqmSetIfMaxDWORD
1818	0x84430	WinSqmSetIfMinDWORD
1819	0x88fa0	WinSqmSetString
1820	0x890b0	WinSqmStartSession
1821	0xe8ad0	WinSqmStartSessionForPartner
1822	0x8e580	WinSqmStartSqmOptinListener
1823	0x9f390	ZwAcceptConnectPort
1824	0x9f350	ZwAccessCheck
1825	0x9f870	ZwAccessCheckAndAuditAlarm
1826	0x9ffa0	ZwAccessCheckByType
1827	0x9fe70	ZwAccessCheckByTypeAndAuditAlarm
1828	0x9ffc0	ZwAccessCheckByTypeResultList
1829	0x9ffe0	ZwAccessCheckByTypeResultListAndAuditAlarm
1830	0xa0000	ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
1831	0xa0020	ZwAcquireCrossVmMutant
1832	0xa0040	ZwAcquireProcessActivityReference
1833	0x9fc30	ZwAddAtom
1834	0xa0060	ZwAddAtomEx
1835	0xa0080	ZwAddBootEntry
1836	0xa00a0	ZwAddDriverEntry
1837	0xa00c0	ZwAdjustGroupsToken
1838	0x9fb70	ZwAdjustPrivilegesToken
1839	0xa00e0	ZwAdjustTokenClaimsAndDeviceGroups
1840	0xa0100	ZwAlertResumeThread
1841	0xa0120	ZwAlertThread
1842	0xa0140	ZwAlertThreadByThreadId
1843	0xa0160	ZwAllocateLocallyUniqueId
1844	0xa0180	ZwAllocateReserveObject
1845	0xa01a0	ZwAllocateUserPhysicalPages
1846	0xa01c0	ZwAllocateUserPhysicalPagesEx
1847	0xa01e0	ZwAllocateUuids
1848	0x9f650	ZwAllocateVirtualMemory
1849	0xa0200	ZwAllocateVirtualMemoryEx
1850	0xa0220	ZwAlpcAcceptConnectPort
1851	0xa0240	ZwAlpcCancelMessage
1852	0xa0260	ZwAlpcConnectPort
1853	0xa0280	ZwAlpcConnectPortEx
1854	0xa02a0	ZwAlpcCreatePort
1855	0xa02c0	ZwAlpcCreatePortSection
1856	0xa02e0	ZwAlpcCreateResourceReserve
1857	0xa0300	ZwAlpcCreateSectionView
1858	0xa0320	ZwAlpcCreateSecurityContext
1859	0xa0340	ZwAlpcDeletePortSection
1860	0xa0360	ZwAlpcDeleteResourceReserve
1861	0xa0380	ZwAlpcDeleteSectionView
1862	0xa03a0	ZwAlpcDeleteSecurityContext
1863	0xa03c0	ZwAlpcDisconnectPort
1864	0xa03e0	ZwAlpcImpersonateClientContainerOfPort
1865	0xa0400	ZwAlpcImpersonateClientOfPort
1866	0xa0420	ZwAlpcOpenSenderProcess
1867	0xa0440	ZwAlpcOpenSenderThread
1868	0xa0460	ZwAlpcQueryInformation
1869	0xa0480	ZwAlpcQueryInformationMessage
1870	0xa04a0	ZwAlpcRevokeSecurityContext
1871	0xa04c0	ZwAlpcSendWaitReceivePort
1872	0xa04e0	ZwAlpcSetInformation
1873	0x9fcd0	ZwApphelpCacheControl
1874	0xa0500	ZwAreMappedFilesTheSame
1875	0xa0520	ZwAssignProcessToJobObject
1876	0xa0540	ZwAssociateWaitCompletionPacket
1877	0xa0560	ZwCallEnclave
1878	0x9f3f0	ZwCallbackReturn
1879	0x9fee0	ZwCancelIoFile
1880	0xa0580	ZwCancelIoFileEx
1881	0xa05a0	ZwCancelSynchronousIoFile
1882	0x9ff60	ZwCancelTimer
1883	0xa05c0	ZwCancelTimer2
1884	0xa05e0	ZwCancelWaitCompletionPacket
1885	0xa0600	ZwChangeProcessState
1886	0xa0620	ZwChangeThreadState
1887	0x9fb10	ZwClearEvent
1888	0x9f530	ZwClose
1889	0x9fab0	ZwCloseObjectAuditAlarm
1890	0xa0640	ZwCommitComplete
1891	0xa0660	ZwCommitEnlistment
1892	0xa0680	ZwCommitRegistryTransaction
1893	0xa06a0	ZwCommitTransaction
1894	0xa06c0	ZwCompactKeys
1895	0xa06e0	ZwCompareObjects
1896	0xa0700	ZwCompareSigningLevels
1897	0xa0720	ZwCompareTokens
1898	0xa0740	ZwCompleteConnectPort
1899	0xa0760	ZwCompressKey
1900	0xa0780	ZwConnectPort
1901	0x9fbb0	ZwContinue
1902	0xa07a0	ZwContinueEx
1903	0xa07c0	ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter
1904	0xa07e0	ZwCopyFileChunk
1905	0xa0800	ZwCreateCpuPartition
1906	0xa0820	ZwCreateCrossVmEvent
1907	0xa0840	ZwCreateCrossVmMutant
1908	0xa0860	ZwCreateDebugObject
1909	0xa0880	ZwCreateDirectoryObject
1910	0xa08a0	ZwCreateDirectoryObjectEx
1911	0xa08c0	ZwCreateEnclave
1912	0xa08e0	ZwCreateEnlistment
1913	0x9fc50	ZwCreateEvent
1914	0xa0900	ZwCreateEventPair
1915	0x9fdf0	ZwCreateFile
1916	0xa0920	ZwCreateIRTimer
1917	0xa0940	ZwCreateIoCompletion
1918	0xa0960	ZwCreateIoRing
1919	0xa0980	ZwCreateJobObject
1920	0xa09a0	ZwCreateJobSet
1921	0x9f6f0	ZwCreateKey
1922	0xa09c0	ZwCreateKeyTransacted
1923	0xa09e0	ZwCreateKeyedEvent
1924	0xa0a00	ZwCreateLowBoxToken
1925	0xa0a20	ZwCreateMailslotFile
1926	0xa0a40	ZwCreateMutant
1927	0xa0a60	ZwCreateNamedPipeFile
1928	0xa0a80	ZwCreatePagingFile
1929	0xa0aa0	ZwCreatePartition
1930	0xa0ac0	ZwCreatePort
1931	0xa0ae0	ZwCreatePrivateNamespace
1932	0xa0b00	ZwCreateProcess
1933	0x9fcf0	ZwCreateProcessEx
1934	0xa0b20	ZwCreateProcessStateChange
1935	0xa0b40	ZwCreateProfile
1936	0xa0b60	ZwCreateProfileEx
1937	0xa0b80	ZwCreateRegistryTransaction
1938	0xa0ba0	ZwCreateResourceManager
1939	0x9fc90	ZwCreateSection
1940	0xa0bc0	ZwCreateSectionEx
1941	0xa0be0	ZwCreateSemaphore
1942	0xa0c00	ZwCreateSymbolicLinkObject
1943	0x9fd10	ZwCreateThread
1944	0xa0c20	ZwCreateThreadEx
1945	0xa0c40	ZwCreateThreadStateChange
1946	0xa0c60	ZwCreateTimer
1947	0xa0c80	ZwCreateTimer2
1948	0xa0ca0	ZwCreateToken
1949	0xa0cc0	ZwCreateTokenEx
1950	0xa0ce0	ZwCreateTransaction
1951	0xa0d00	ZwCreateTransactionManager
1952	0xa0d20	ZwCreateUserProcess
1953	0xa0d40	ZwCreateWaitCompletionPacket
1954	0xa0d60	ZwCreateWaitablePort
1955	0xa0d80	ZwCreateWnfStateName
1956	0xa0da0	ZwCreateWorkerFactory
1957	0xa0dc0	ZwDebugActiveProcess
1958	0xa0de0	ZwDebugContinue
1959	0x9f9d0	ZwDelayExecution
1960	0xa0e00	ZwDeleteAtom
1961	0xa0e20	ZwDeleteBootEntry
1962	0xa0e40	ZwDeleteDriverEntry
1963	0xa0e60	ZwDeleteFile
1964	0xa0e80	ZwDeleteKey
1965	0xa0ea0	ZwDeleteObjectAuditAlarm
1966	0xa0ec0	ZwDeletePrivateNamespace
1967	0xa0ee0	ZwDeleteValueKey
1968	0xa0f00	ZwDeleteWnfStateData
1969	0xa0f20	ZwDeleteWnfStateName
1970	0x9f430	ZwDeviceIoControlFile
1971	0xa0f40	ZwDirectGraphicsCall
1972	0xa0f60	ZwDisableLastKnownGood
1973	0xa0f80	ZwDisplayString
1974	0xa0fa0	ZwDrawText
1975	0x9fad0	ZwDuplicateObject
1976	0x9fb90	ZwDuplicateToken
1977	0xa0fc0	ZwEnableLastKnownGood
1978	0xa0fe0	ZwEnumerateBootEntries
1979	0xa1000	ZwEnumerateDriverEntries
1980	0x9f990	ZwEnumerateKey
1981	0xa1020	ZwEnumerateSystemEnvironmentValuesEx
1982	0xa1040	ZwEnumerateTransactionObject
1983	0x9f5b0	ZwEnumerateValueKey
1984	0xa1060	ZwExtendSection
1985	0xa1080	ZwFilterBootOption
1986	0xa10a0	ZwFilterToken
1987	0xa10c0	ZwFilterTokenEx
1988	0x9f5d0	ZwFindAtom
1989	0x9fcb0	ZwFlushBuffersFile
1990	0xa10e0	ZwFlushBuffersFileEx
1991	0xa1100	ZwFlushInstallUILanguage
1992	0xa1120	ZwFlushInstructionCache
1993	0xa1140	ZwFlushKey
1994	0xa1160	ZwFlushProcessWriteBuffers
1995	0xa1180	ZwFlushVirtualMemory
1996	0xa11a0	ZwFlushWriteBuffer
1997	0xa11c0	ZwFreeUserPhysicalPages
1998	0x9f710	ZwFreeVirtualMemory
1999	0xa11e0	ZwFreezeRegistry
2000	0xa1200	ZwFreezeTransactions
2001	0x9fa70	ZwFsControlFile
2002	0xa1220	ZwGetCachedSigningLevel
2003	0xa1240	ZwGetCompleteWnfStateSubscription
2004	0xa1260	ZwGetContextThread
2005	0xa1280	ZwGetCurrentProcessorNumber
2006	0xa12a0	ZwGetCurrentProcessorNumberEx
2007	0xa12c0	ZwGetDevicePowerState
2008	0xa12e0	ZwGetMUIRegistryInfo
2009	0xa1300	ZwGetNextProcess
2010	0xa1320	ZwGetNextThread
2011	0xa1340	ZwGetNlsSectionPtr
2012	0xa1360	ZwGetNotificationResourceManager
2013	0xa1380	ZwGetWriteWatch
2014	0xa13a0	ZwImpersonateAnonymousToken
2015	0x9f730	ZwImpersonateClientOfPort
2016	0xa13c0	ZwImpersonateThread
2017	0xa13e0	ZwInitializeEnclave
2018	0xa1400	ZwInitializeNlsFiles
2019	0xa1420	ZwInitializeRegistry
2020	0xa1440	ZwInitiatePowerAction
2021	0x9fd30	ZwIsProcessInJob
2022	0xa1460	ZwIsSystemResumeAutomatic
2023	0xa1480	ZwIsUILanguageComitted
2024	0xa14a0	ZwListenPort
2025	0xa14c0	ZwLoadDriver
2026	0xa14e0	ZwLoadEnclaveData
2027	0xa1500	ZwLoadKey
2028	0xa1520	ZwLoadKey2
2029	0xa1540	ZwLoadKey3
2030	0xa1560	ZwLoadKeyEx
2031	0xa1580	ZwLockFile
2032	0xa15a0	ZwLockProductActivationKeys
2033	0xa15c0	ZwLockRegistryKey
2034	0xa15e0	ZwLockVirtualMemory
2035	0xa1600	ZwMakePermanentObject
2036	0xa1620	ZwMakeTemporaryObject
2037	0xa1640	ZwManageHotPatch
2038	0xa1660	ZwManagePartition
2039	0xa1680	ZwMapCMFModule
2040	0xa16a0	ZwMapUserPhysicalPages
2041	0x9f3b0	ZwMapUserPhysicalPagesScatter
2042	0x9f850	ZwMapViewOfSection
2043	0xa16c0	ZwMapViewOfSectionEx
2044	0xa16e0	ZwModifyBootEntry
2045	0xa1700	ZwModifyDriverEntry
2046	0xa1720	ZwNotifyChangeDirectoryFile
2047	0xa1740	ZwNotifyChangeDirectoryFileEx
2048	0xa1760	ZwNotifyChangeKey
2049	0xa1780	ZwNotifyChangeMultipleKeys
2050	0xa17a0	ZwNotifyChangeSession
2051	0xa17c0	ZwOpenCpuPartition
2052	0x9fe50	ZwOpenDirectoryObject
2053	0xa17e0	ZwOpenEnlistment
2054	0x9fb50	ZwOpenEvent
2055	0xa1800	ZwOpenEventPair
2056	0x9f9b0	ZwOpenFile
2057	0xa1820	ZwOpenIoCompletion
2058	0xa1840	ZwOpenJobObject
2059	0x9f590	ZwOpenKey
2060	0xa1860	ZwOpenKeyEx
2061	0xa1880	ZwOpenKeyTransacted
2062	0xa18a0	ZwOpenKeyTransactedEx
2063	0xa18c0	ZwOpenKeyedEvent
2064	0xa18e0	ZwOpenMutant
2065	0xa1900	ZwOpenObjectAuditAlarm
2066	0xa1920	ZwOpenPartition
2067	0xa1940	ZwOpenPrivateNamespace
2068	0x9f810	ZwOpenProcess
2069	0xa1960	ZwOpenProcessToken
2070	0x9f950	ZwOpenProcessTokenEx
2071	0xa1980	ZwOpenRegistryTransaction
2072	0xa19a0	ZwOpenResourceManager
2073	0x9fa30	ZwOpenSection
2074	0xa19c0	ZwOpenSemaphore
2075	0xa19e0	ZwOpenSession
2076	0xa1a00	ZwOpenSymbolicLinkObject
2077	0xa1a20	ZwOpenThread
2078	0x9f7d0	ZwOpenThreadToken
2079	0x9f930	ZwOpenThreadTokenEx
2080	0xa1a40	ZwOpenTimer
2081	0xa1a60	ZwOpenTransaction
2082	0xa1a80	ZwOpenTransactionManager
2083	0xa1aa0	ZwPlugPlayControl
2084	0x9ff20	ZwPowerInformation
2085	0xa1ac0	ZwPrePrepareComplete
2086	0xa1ae0	ZwPrePrepareEnlistment
2087	0xa1b00	ZwPrepareComplete
2088	0xa1b20	ZwPrepareEnlistment
2089	0xa1b40	ZwPrivilegeCheck
2090	0xa1b60	ZwPrivilegeObjectAuditAlarm
2091	0xa1b80	ZwPrivilegedServiceAuditAlarm
2092	0xa1ba0	ZwPropagationComplete
2093	0xa1bc0	ZwPropagationFailed
2094	0x9fd50	ZwProtectVirtualMemory
2095	0xa1be0	ZwPssCaptureVaSpaceBulk
2096	0xa1c00	ZwPulseEvent
2097	0x9faf0	ZwQueryAttributesFile
2098	0xa1c20	ZwQueryAuxiliaryCounterFrequency
2099	0xa1c40	ZwQueryBootEntryOrder
2100	0xa1c60	ZwQueryBootOptions
2101	0xa1c80	ZwQueryDebugFilterState
2102	0x9f5f0	ZwQueryDefaultLocale
2103	0x9fbd0	ZwQueryDefaultUILanguage
2104	0x9f9f0	ZwQueryDirectoryFile
2105	0xa1ca0	ZwQueryDirectoryFileEx
2106	0xa1cc0	ZwQueryDirectoryObject
2107	0xa1ce0	ZwQueryDriverEntryOrder
2108	0xa1d00	ZwQueryEaFile
2109	0x9fe10	ZwQueryEvent
2110	0xa1d20	ZwQueryFullAttributesFile
2111	0xa1d40	ZwQueryInformationAtom
2112	0xa1d60	ZwQueryInformationByName
2113	0xa1d80	ZwQueryInformationCpuPartition
2114	0xa1da0	ZwQueryInformationEnlistment
2115	0x9f570	ZwQueryInformationFile
2116	0xa1dc0	ZwQueryInformationJobObject
2117	0xa1de0	ZwQueryInformationPort
2118	0x9f670	ZwQueryInformationProcess
2119	0xa1e00	ZwQueryInformationResourceManager
2120	0x9f7f0	ZwQueryInformationThread
2121	0x9f770	ZwQueryInformationToken
2122	0xa1e20	ZwQueryInformationTransaction
2123	0xa1e40	ZwQueryInformationTransactionManager
2124	0xa1e60	ZwQueryInformationWorkerFactory
2125	0xa1e80	ZwQueryInstallUILanguage
2126	0xa1ea0	ZwQueryIntervalProfile
2127	0xa1ec0	ZwQueryIoCompletion
2128	0xa1ee0	ZwQueryIoRingCapabilities
2129	0x9f610	ZwQueryKey
2130	0xa1f00	ZwQueryLicenseValue
2131	0xa1f20	ZwQueryMultipleValueKey
2132	0xa1f40	ZwQueryMutant
2133	0x9f550	ZwQueryObject
2134	0xa1f60	ZwQueryOpenSubKeys
2135	0xa1f80	ZwQueryOpenSubKeysEx
2136	0x9f970	ZwQueryPerformanceCounter
2137	0xa1fa0	ZwQueryPortInformationProcess
2138	0xa1fc0	ZwQueryQuotaInformationFile
2139	0x9fd70	ZwQuerySection
2140	0xa1fe0	ZwQuerySecurityAttributesToken
2141	0xa2000	ZwQuerySecurityObject
2142	0xa2020	ZwQuerySecurityPolicy
2143	0xa2040	ZwQuerySemaphore
2144	0xa2060	ZwQuerySymbolicLinkObject
2145	0xa2080	ZwQuerySystemEnvironmentValue
2146	0xa20a0	ZwQuerySystemEnvironmentValueEx
2147	0x9fa10	ZwQuerySystemInformation
2148	0xa20c0	ZwQuerySystemInformationEx
2149	0x9fe90	ZwQuerySystemTime
2150	0x9fa50	ZwQueryTimer
2151	0xa20e0	ZwQueryTimerResolution
2152	0x9f630	ZwQueryValueKey
2153	0x9f7b0	ZwQueryVirtualMemory
2154	0x9fc70	ZwQueryVolumeInformationFile
2155	0xa2100	ZwQueryWnfStateData
2156	0xa2120	ZwQueryWnfStateNameInformation
2157	0x9fbf0	ZwQueueApcThread
2158	0xa2140	ZwQueueApcThreadEx
2159	0xa2160	ZwQueueApcThreadEx2
2160	0xa2180	ZwRaiseException
2161	0xa21a0	ZwRaiseHardError
2162	0x9f410	ZwReadFile
2163	0x9f910	ZwReadFileScatter
2164	0xa21c0	ZwReadOnlyEnlistment
2165	0x9fdd0	ZwReadRequestData
2166	0x9fb30	ZwReadVirtualMemory
2167	0xa21e0	ZwReadVirtualMemoryEx
2168	0xa2200	ZwRecoverEnlistment
2169	0xa2220	ZwRecoverResourceManager
2170	0xa2240	ZwRecoverTransactionManager
2171	0xa2260	ZwRegisterProtocolAddressInformation
2172	0xa2280	ZwRegisterThreadTerminatePort
2173	0xa22a0	ZwReleaseKeyedEvent
2174	0x9f750	ZwReleaseMutant
2175	0x9f490	ZwReleaseSemaphore
2176	0xa22c0	ZwReleaseWorkerFactoryWorker
2177	0x9f470	ZwRemoveIoCompletion
2178	0xa22e0	ZwRemoveIoCompletionEx
2179	0xa2300	ZwRemoveProcessDebug
2180	0xa2320	ZwRenameKey
2181	0xa2340	ZwRenameTransactionManager
2182	0xa2360	ZwReplaceKey
2183	0xa2380	ZwReplacePartitionUnit
2184	0x9f4d0	ZwReplyPort
2185	0x9f4b0	ZwReplyWaitReceivePort
2186	0x9f8b0	ZwReplyWaitReceivePortEx
2187	0xa23a0	ZwReplyWaitReplyPort
2188	0xa23c0	ZwRequestPort
2189	0x9f790	ZwRequestWaitReplyPort
2190	0xa23e0	ZwResetEvent
2191	0xa2400	ZwResetWriteWatch
2192	0xa2420	ZwRestoreKey
2193	0xa2440	ZwResumeProcess
2194	0x9fd90	ZwResumeThread
2195	0xa2460	ZwRevertContainerImpersonation
2196	0xa2480	ZwRollbackComplete
2197	0xa24a0	ZwRollbackEnlistment
2198	0xa24c0	ZwRollbackRegistryTransaction
2199	0xa24e0	ZwRollbackTransaction
2200	0xa2500	ZwRollforwardTransactionManager
2201	0xa2520	ZwSaveKey
2202	0xa2540	ZwSaveKeyEx
2203	0xa2560	ZwSaveMergedKeys
2204	0xa2580	ZwSecureConnectPort
2205	0xa25a0	ZwSerializeBoot
2206	0xa25c0	ZwSetBootEntryOrder
2207	0xa25e0	ZwSetBootOptions
2208	0xa2600	ZwSetCachedSigningLevel
2209	0xa2620	ZwSetCachedSigningLevel2
2210	0xa2640	ZwSetContextThread
2211	0xa2660	ZwSetDebugFilterState
2212	0xa2680	ZwSetDefaultHardErrorPort
2213	0xa26a0	ZwSetDefaultLocale
2214	0xa26c0	ZwSetDefaultUILanguage
2215	0xa26e0	ZwSetDriverEntryOrder
2216	0xa2700	ZwSetEaFile
2217	0x9f510	ZwSetEvent
2218	0x9f8f0	ZwSetEventBoostPriority
2219	0xa2720	ZwSetHighEventPair
2220	0xa2740	ZwSetHighWaitLowEventPair
2221	0xa2760	ZwSetIRTimer
2222	0xa2780	ZwSetInformationCpuPartition
2223	0xa27a0	ZwSetInformationDebugObject
2224	0xa27c0	ZwSetInformationEnlistment
2225	0x9f830	ZwSetInformationFile
2226	0xa27e0	ZwSetInformationIoRing
2227	0xa2800	ZwSetInformationJobObject
2228	0xa2820	ZwSetInformationKey
2229	0x9fec0	ZwSetInformationObject
2230	0x9f6d0	ZwSetInformationProcess
2231	0xa2840	ZwSetInformationResourceManager
2232	0xa2860	ZwSetInformationSymbolicLink
2233	0x9f4f0	ZwSetInformationThread
2234	0xa2880	ZwSetInformationToken
2235	0xa28a0	ZwSetInformationTransaction
2236	0xa28c0	ZwSetInformationTransactionManager
2237	0xa28e0	ZwSetInformationVirtualMemory
2238	0xa2900	ZwSetInformationWorkerFactory
2239	0xa2920	ZwSetIntervalProfile
2240	0xa2940	ZwSetIoCompletion
2241	0xa2960	ZwSetIoCompletionEx
2242	0xa2980	ZwSetLdtEntries
2243	0xa29a0	ZwSetLowEventPair
2244	0xa29c0	ZwSetLowWaitHighEventPair
2245	0xa29e0	ZwSetQuotaInformationFile
2246	0xa2a00	ZwSetSecurityObject
2247	0xa2a20	ZwSetSystemEnvironmentValue
2248	0xa2a40	ZwSetSystemEnvironmentValueEx
2249	0xa2a60	ZwSetSystemInformation
2250	0xa2a80	ZwSetSystemPowerState
2251	0xa2aa0	ZwSetSystemTime
2252	0xa2ac0	ZwSetThreadExecutionState
2253	0x9ff80	ZwSetTimer
2254	0xa2ae0	ZwSetTimer2
2255	0xa2b00	ZwSetTimerEx
2256	0xa2b20	ZwSetTimerResolution
2257	0xa2b40	ZwSetUuidSeed
2258	0x9ff40	ZwSetValueKey
2259	0xa2b60	ZwSetVolumeInformationFile
2260	0xa2b80	ZwSetWnfProcessNotificationEvent
2261	0xa2ba0	ZwShutdownSystem
2262	0xa2bc0	ZwShutdownWorkerFactory
2263	0xa2be0	ZwSignalAndWaitForSingleObject
2264	0xa2c00	ZwSinglePhaseReject
2265	0xa2c20	ZwStartProfile
2266	0xa2c40	ZwStopProfile
2267	0xa2c60	ZwSubmitIoRing
2268	0xa2c80	ZwSubscribeWnfStateChange
2269	0xa2ca0	ZwSuspendProcess
2270	0xa2cc0	ZwSuspendThread
2271	0xa2ce0	ZwSystemDebugControl
2272	0xa2d00	ZwTerminateEnclave
2273	0xa2d20	ZwTerminateJobObject
2274	0x9f8d0	ZwTerminateProcess
2275	0x9fdb0	ZwTerminateThread
2276	0xa2d40	ZwTestAlert
2277	0xa2d60	ZwThawRegistry
2278	0xa2d80	ZwThawTransactions
2279	0xa2da0	ZwTraceControl
2280	0x9ff00	ZwTraceEvent
2281	0xa2dc0	ZwTranslateFilePath
2282	0xa2de0	ZwUmsThreadYield
2283	0xa2e00	ZwUnloadDriver
2284	0xa2e20	ZwUnloadKey
2285	0xa2e40	ZwUnloadKey2
2286	0xa2e60	ZwUnloadKeyEx
2287	0xa2e80	ZwUnlockFile
2288	0xa2ea0	ZwUnlockVirtualMemory
2289	0x9f890	ZwUnmapViewOfSection
2290	0xa2ec0	ZwUnmapViewOfSectionEx
2291	0xa2ee0	ZwUnsubscribeWnfStateChange
2292	0xa2f00	ZwUpdateWnfStateData
2293	0xa2f20	ZwVdmControl
2294	0xa2f40	ZwWaitForAlertByThreadId
2295	0xa2f60	ZwWaitForDebugEvent
2296	0xa2f80	ZwWaitForKeyedEvent
2297	0x9fea0	ZwWaitForMultipleObjects
2298	0x9f690	ZwWaitForMultipleObjects32
2299	0x9f3d0	ZwWaitForSingleObject
2300	0xa2fa0	ZwWaitForWorkViaWorkerFactory
2301	0xa2fc0	ZwWaitHighEventPair
2302	0xa2fe0	ZwWaitLowEventPair
2303	0x9f370	ZwWorkerFactoryWorkerReady
2304	0x9f450	ZwWriteFile
2305	0x9f6b0	ZwWriteFileGather
2306	0x9fe30	ZwWriteRequestData
2307	0x9fa90	ZwWriteVirtualMemory
2308	0x9fc10	ZwYieldExecution
2309	0x8f0f0	__C_specific_handler
2310	0xa42e0	__chkstk
2311	0x8f2b0	__isascii
2312	0x8f2d0	__iscsym
2313	0x8f310	__iscsymf
2314	0x114da0	__misaligned_access
2315	0x8f360	__toascii
2316	0x8f580	_atoi64
2317	0x886f0	_errno
2318	0x138788	_fltused
2319	0x8f5f0	_i64toa
2320	0x99050	_i64toa_s
2321	0x8f800	_i64tow
2322	0x99370	_i64tow_s
2323	0x8f630	_itoa
2324	0x99080	_itoa_s
2325	0x8f840	_itow
2326	0x993a0	_itow_s
2327	0x8fa40	_lfind
2328	0x8faf0	_local_unwind
2329	0x8f660	_ltoa
2330	0x99080	_ltoa_s
2331	0x8f870	_ltow
2332	0x993a0	_ltow_s
2333	0x996b0	_makepath_s
2334	0x8fb20	_memccpy
2335	0x8fbc0	_memicmp
2336	0xa5030	_setjmp
2337	0xa50f0	_setjmpex
2338	0x8fbe0	_snprintf
2339	0x99810	_snprintf_s
2340	0x998e0	_snscanf_s
2341	0x8fc90	_snwprintf
2342	0x99920	_snwprintf_s
2343	0x99a00	_snwscanf_s
2344	0x8fd70	_splitpath
2345	0x99a40	_splitpath_s
2346	0x900d0	_strcmpi
2347	0x900d0	_stricmp
2348	0x900e0	_strlwr
2349	0x90110	_strlwr_s
2350	0x901e0	_strnicmp
2351	0x99ce0	_strnset_s
2352	0x99d70	_strset_s
2353	0x901f0	_strupr
2354	0x90240	_strupr_s
2355	0x902b0	_swprintf
2356	0x8f690	_ui64toa
2357	0x990b0	_ui64toa_s
2358	0x8f8a0	_ui64tow
2359	0x993d0	_ui64tow_s
2360	0x8f6c0	_ultoa
2361	0x990d0	_ultoa_s
2362	0x8f8d0	_ultow
2363	0x993f0	_ultow_s
2364	0x90370	_vscprintf
2365	0x90490	_vscwprintf
2366	0x905d0	_vsnprintf
2367	0x99840	_vsnprintf_s
2368	0x906a0	_vsnwprintf
2369	0x99950	_vsnwprintf_s
2370	0x90510	_vswprintf
2371	0x907b0	_wcsicmp
2372	0x90810	_wcslwr
2373	0x90870	_wcslwr_s
2374	0x908f0	_wcsnicmp
2375	0x90960	_wcsnset_s
2376	0x90a00	_wcsset_s
2377	0x90a60	_wcstoi64
2378	0x90aa0	_wcstoui64
2379	0x90d30	_wcsupr
2380	0x90d70	_wcsupr_s
2381	0x99dd0	_wmakepath_s
2382	0x99f60	_wsplitpath_s
2383	0x90df0	_wtoi
2384	0x90e20	_wtoi64
2385	0x90e40	_wtol
2386	0x90e60	abs
2387	0x90e70	atan
2388	0x910d0	atan2
2389	0x8f5a0	atoi
2390	0x8f5d0	atol
2391	0x91830	bsearch
2392	0x91930	bsearch_s
2393	0x91a40	ceil
2394	0x91b60	cos
2395	0x92450	fabs
2396	0x92540	floor
2397	0x8f370	isalnum
2398	0x8f3a0	isalpha
2399	0x8f3d0	iscntrl
2400	0x8f400	isdigit
2401	0x8f430	isgraph
2402	0x8f460	islower
2403	0x8f490	isprint
2404	0x8f4c0	ispunct
2405	0x8f4f0	isspace
2406	0x8f520	isupper
2407	0x92670	iswalnum
2408	0x92690	iswalpha
2409	0x926b0	iswascii
2410	0x927b0	iswctype
2411	0x926d0	iswdigit
2412	0x926f0	iswgraph
2413	0x92710	iswlower
2414	0x92730	iswprint
2415	0x92750	iswspace
2416	0x92770	iswxdigit
2417	0x8f550	isxdigit
2418	0x927e0	labs
2419	0x927f0	log
2420	0x92ad0	longjmp
2421	0x92b00	mbstowcs
2422	0x92bd0	memchr
2423	0x92c10	memcmp
2424	0xa5ec0	memcpy
2425	0x9a220	memcpy_s
2426	0xa5ec0	memmove
2427	0x9a2c0	memmove_s
2428	0x130010	memset
2429	0xa5190	pow
2430	0x92cf0	qsort
2431	0x93090	qsort_s
2432	0x91f80	sin
2433	0x93460	sprintf
2434	0x9a320	sprintf_s
2435	0x934f0	sqrt
2436	0x93600	sscanf
2437	0x9a3a0	sscanf_s
2438	0x93710	strcat
2439	0x9a400	strcat_s
2440	0x93890	strchr
2441	0x938e0	strcmp
2442	0x937d0	strcpy
2443	0x9a490	strcpy_s
2444	0x939a0	strcspn
2445	0x93a60	strlen
2446	0x93b30	strncat
2447	0x9a520	strncat_s
2448	0x93cf0	strncmp
2449	0x93dd0	strncpy
2450	0x9a620	strncpy_s
2451	0x93f50	strnlen
2452	0x93f70	strpbrk
2453	0x94020	strrchr
2454	0x94060	strspn
2455	0x94130	strstr
2456	0x9a720	strtok_s
2457	0x943c0	strtol
2458	0x94420	strtoul
2459	0x902b0	swprintf
2460	0x9a890	swprintf_s
2461	0x9a920	swscanf_s
2462	0x94460	tan
2463	0x94900	tolower
2464	0x94940	toupper
2465	0x949b0	towlower
2466	0x949e0	towupper
2467	0xeaf80	vDbgPrintEx
2468	0xeafb0	vDbgPrintExWithPrefix
2469	0x90470	vsprintf
2470	0x9a350	vsprintf_s
2471	0x9a8c0	vswprintf_s
2472	0x949f0	wcscat
2473	0x9a980	wcscat_s
2474	0x94a60	wcschr
2475	0x94aa0	wcscmp
2476	0x94a30	wcscpy
2477	0x9aa20	wcscpy_s
2478	0x94ae0	wcscspn
2479	0x94b30	wcslen
2480	0x94b60	wcsncat
2481	0x9aab0	wcsncat_s
2482	0x94bb0	wcsncmp
2483	0x94bf0	wcsncpy
2484	0x9abc0	wcsncpy_s
2485	0x94c40	wcsnlen
2486	0x94c70	wcspbrk
2487	0x94cb0	wcsrchr
2488	0x94cf0	wcsspn
2489	0x94d40	wcsstr
2490	0x9acd0	wcstok_s
2491	0x94fd0	wcstol
2492	0x95070	wcstombs
2493	0x95030	wcstoul

module_name	ntdll.dll
flags	0
timestamp	2094-11-20 23:27:08
version	0.0
ordinal_base	8
nFunctions	2486
nNames	2485
Names(2485)	0x16d2b0
Functions(2486)	0x16abd8
NameOrdinals(2485)	0x16f984

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	NT Layer DLL
FileVersion	10.0.22621.3374 (WinBuild.160101.0800)
InternalName	ntdll.dll
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	ntdll.dll
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.22621.3374

VS_FIXEDFILEINFO

FileVersion	10.0.22621.3374
ProductVersion	10.0.22621.3374
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Production PCA 2011

serial: 330000045BF631BC00F4FC374500000000045B

Certificates (2)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:04:5b:f6:31:bc:00:f4:fc:37:45:00:00:00:00:04:5b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011
        Validity
            Not Before: Sep 14 18:20:38 2023 GMT
            Not After : Sep  4 18:20:38 2024 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:9c:81:18:c6:36:1b:e7:d4:d8:d2:0f:4d:2b:0e:
                    5b:95:d8:97:10:0e:30:f6:ef:e3:b2:2a:a6:f9:5c:
                    34:cd:c6:7d:3e:ac:c4:53:8b:26:54:8b:3e:48:07:
                    80:a4:a0:8e:a6:30:32:ec:06:67:bb:7f:e4:10:51:
                    01:a6:9f:2d:bf:ce:21:90:16:fe:25:b9:1f:d8:4f:
                    68:c7:57:3a:96:ca:c1:32:17:20:1b:85:b4:c9:fd:
                    ed:02:07:e8:1c:43:72:f4:c9:ca:ca:0c:91:2c:57:
                    ae:0c:91:0a:a3:26:7f:10:b7:8b:20:8c:7e:55:c1:
                    2e:60:12:b1:19:46:66:26:ef:b5:13:dc:b1:8d:05:
                    88:9e:53:b1:2e:d3:70:ca:f2:38:e1:db:54:3b:0d:
                    8f:b8:4d:b2:d7:ae:db:57:94:29:aa:df:e3:b6:c3:
                    72:91:58:56:0c:d7:c3:d0:ad:aa:69:e1:54:0e:59:
                    0f:02:b2:96:80:e8:09:2b:1b:3a:48:8d:89:bc:7f:
                    59:04:54:71:c3:4b:92:1b:cd:71:b7:b2:ef:58:cd:
                    9c:9e:0a:bc:a9:89:ae:94:8f:a2:00:5e:9b:78:3f:
                    51:a3:ef:5f:bf:38:ab:07:1f:6e:e7:e3:cf:5d:f2:
                    a1:80:95:27:59:b1:9e:cc:e9:69:2a:28:7f:4f:b4:
                    76:9f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                1.3.6.1.4.1.311.10.3.24, 1.3.6.1.4.1.311.10.3.37, 1.3.6.1.4.1.311.10.3.6, Code Signing
            X509v3 Subject Key Identifier: 
                3F:32:9D:D0:B0:02:2D:96:10:27:7A:2F:E1:A9:9D:AD:F9:36:73:47
            X509v3 Subject Alternative Name: 
                DirName:/OU=Microsoft Ireland Operations Limited/serialNumber=232770\+501529
            X509v3 Authority Key Identifier: 
                A9:29:02:39:8E:16:C4:97:78:CD:90:F9:9E:4F:9A:E1:7C:55:AF:53
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt
            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        dc:50:41:f1:a0:3d:94:39:ef:42:9f:c8:65:42:5a:b7:41:c8:
        53:ca:05:2d:3b:92:37:45:93:63:5f:d7:96:34:17:1c:97:c1:
        3c:7f:ae:ac:00:44:9c:5f:8f:ed:cc:d4:83:0a:7e:3a:21:b1:
        94:48:00:b7:b7:af:8c:3f:83:29:c4:56:f3:e0:f0:74:c8:8c:
        5c:6f:4a:b8:4a:94:f9:be:e8:d9:d6:9e:bf:22:0f:e5:2e:59:
        65:d0:34:b3:05:a4:72:30:75:d0:5d:ae:80:6b:35:da:41:ad:
        0e:80:87:bd:e0:85:22:5e:6d:d8:57:8c:19:ce:9e:0b:c1:c0:
        fe:bf:18:02:e5:c9:2e:3e:c9:18:66:d7:36:68:9b:31:14:19:
        d7:72:16:ca:ab:11:a0:b9:95:b6:5b:60:f5:c3:59:03:e1:69:
        0d:18:44:d2:4a:5a:1e:bf:85:bd:3e:b6:96:47:26:4d:63:2d:
        4c:74:77:37:39:f1:18:2d:79:c5:1f:da:bc:07:e7:87:ac:64:
        b7:4e:dd:a7:c1:6c:47:ed:1d:c2:a3:df:e4:54:8d:6f:a3:4b:
        25:7e:d3:a2:cf:68:23:0f:2b:24:fa:7e:01:bf:4a:70:69:dc:
        f8:f3:3c:5f:bc:38:21:84:f9:15:24:e4:84:93:25:25:8b:aa:
        08:61:c4:61

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:07:76:56:00:00:00:00:00:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
        Validity
            Not Before: Oct 19 18:41:42 2011 GMT
            Not After : Oct 19 18:51:42 2026 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:dd:0c:bb:a2:e4:2e:09:e3:e7:c5:f7:96:69:bc:
                    00:21:bd:69:33:33:ef:ad:04:cb:54:80:ee:06:83:
                    bb:c5:20:84:d9:f7:d2:8b:f3:38:b0:ab:a4:ad:2d:
                    7c:62:79:05:ff:e3:4a:3f:04:35:20:70:e3:c4:e7:
                    6b:e0:9c:c0:36:75:e9:8a:31:dd:8d:70:e5:dc:37:
                    b5:74:46:96:28:5b:87:60:23:2c:bf:dc:47:a5:67:
                    f7:51:27:9e:72:eb:07:a6:c9:b9:1e:3b:53:35:7c:
                    e5:d3:ec:27:b9:87:1c:fe:b9:c9:23:09:6f:a8:46:
                    91:c1:6e:96:3c:41:d3:cb:a3:3f:5d:02:6a:4d:ec:
                    69:1f:25:28:5c:36:ff:fd:43:15:0a:94:e0:19:b4:
                    cf:df:c2:12:e2:c2:5b:27:ee:27:78:30:8b:5b:2a:
                    09:6b:22:89:53:60:16:2c:c0:68:1d:53:ba:ec:49:
                    f3:9d:61:8c:85:68:09:73:44:5d:7d:a2:54:2b:dd:
                    79:f7:15:cf:35:5d:6c:1c:2b:5c:ce:bc:9c:23:8b:
                    6f:6e:b5:26:d9:36:13:c3:4f:d6:27:ae:b9:32:3b:
                    41:92:2c:e1:c7:cd:77:e8:aa:54:4e:f7:5c:0b:04:
                    87:65:b4:43:18:a8:b2:e0:6d:19:77:ec:5a:24:fa:
                    48:03
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Subject Key Identifier: 
                A9:29:02:39:8E:16:C4:97:78:CD:90:F9:9E:4F:9A:E1:7C:55:AF:53
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                D5:F6:56:CB:8F:E8:A2:5C:62:68:D1:3D:94:90:5B:D7:CE:9A:18:C4
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        14:fc:7c:71:51:a5:79:c2:6e:b2:ef:39:3e:bc:3c:52:0f:6e:
        2b:3f:10:13:73:fe:a8:68:d0:48:a6:34:4d:8a:96:05:26:ee:
        31:46:90:61:79:d6:ff:38:2e:45:6b:f4:c0:e5:28:b8:da:1d:
        8f:8a:db:09:d7:1a:c7:4c:0a:36:66:6a:8c:ec:1b:d7:04:90:
        a8:18:17:a4:9b:b9:e2:40:32:36:76:c4:c1:5a:c6:bf:e4:04:
        c0:ea:16:d3:ac:c3:68:ef:62:ac:dd:54:6c:50:30:58:a6:eb:
        7c:fe:94:a7:4e:8e:f4:ec:7c:86:73:57:c2:52:21:73:34:5a:
        f3:a3:8a:56:c8:04:da:07:09:ed:f8:8b:e3:ce:f4:7e:8e:ae:
        f0:f6:0b:8a:08:fb:3f:c9:1d:72:7f:53:b8:eb:be:63:e0:e3:
        3d:31:65:b0:81:e5:f2:ac:cd:16:a4:9f:3d:a8:b1:9b:c2:42:
        d0:90:84:5f:54:1d:ff:89:ea:ba:1d:47:90:6f:b0:73:4e:41:
        9f:40:9f:5f:e5:a1:2a:b2:11:91:73:8a:21:28:f0:ce:de:73:
        39:5f:3e:ab:5c:60:ec:df:03:10:a8:d3:09:e9:f4:f6:96:85:
        b6:7f:51:88:66:47:19:8d:a2:b0:12:3d:81:2a:68:05:77:bb:
        91:4c:62:7b:b6:c1:07:c7:ba:7a:87:34:03:0e:4b:62:7a:99:
        e9:ca:fc:ce:4a:37:c9:2d:a4:57:7c:1c:fe:3d:dc:b8:0f:5a:
        fa:d6:c4:b3:02:85:02:3a:ea:b3:d9:6e:e4:69:21:37:de:81:
        d1:f6:75:19:05:67:d3:93:57:5e:29:1b:39:c8:ee:2d:e1:cd:
        e4:45:73:5b:d0:d2:ce:7a:ab:16:19:82:46:58:d0:5e:9d:81:
        b3:67:af:6c:35:f2:bc:e5:3f:24:e2:35:a2:0a:75:06:f6:18:
        56:99:d4:78:2c:d1:05:1b:eb:d0:88:01:9d:aa:10:f1:05:df:
        ba:7e:2c:63:b7:06:9b:23:21:c4:f9:78:6c:e2:58:17:06:36:
        2b:91:12:03:cc:a4:d9:f2:2d:ba:f9:94:9d:40:ed:18:45:f1:
        ce:8a:5c:6b:3e:ab:03:d3:70:18:2a:0a:6a:e0:5f:47:d1:d5:
        63:0a:32:f2:af:d7:36:1f:2a:70:5a:e5:42:59:08:71:4b:57:
        ba:7e:83:81:f0:21:3c:f4:1c:c1:c5:b9:90:93:0e:88:45:93:
        86:e9:b1:20:99:be:98:cb:c5:95:a4:5d:62:d6:a0:63:08:20:
        bd:75:10:77:7d:3d:f3:45:b9:9f:97:9f:cb:57:80:6f:33:a9:
        04:cf:77:a4:62:1c:59:7e

undefined method `first' for #

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	2177568	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi	Support Me on Ko-fi
Yandex.Money
Thank you!

everything is OK

ntdll.dll-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

Signers (1)

Certificates (2)

ntdll.dll
-