NtMapViewOfSection
NtCreateSection
NtUnmapViewOfSection
NtAllocateVirtualMemory
NtFreeVirtualMemory
NtQuerySystemInformation
NtQueryVirtualMemory
_alloca_probe
NtQueryDirectoryFile
NtOpenFile
RtlxAnsiStringToUnicodeSize
NlsMbCodePageTag
RtlUnicodeStringToInteger
DbgPrint
NtQueryInformationProcess
RtlGetVersion
NtEnumerateValueKey
NtQueryKey
NtCreateKey
NtSetValueKey
NtDeleteValueKey
RtlDowncaseUnicodeString
RtlGetFullPathName_U
NtSetInformationKey
NtDeleteKey
strpbrk
strspn
_wcsupr
RtlUpcaseUnicodeChar
toupper
RtlUpcaseUnicodeString
NtWriteFile
RtlSecondsSince1970ToTime
RtlImageRvaToVa
RtlGUIDFromString
strchr
isdigit
LdrResFindResource
LdrResSearchResource
RtlUnwind
NtReadFile
qsort
NtDeleteFile
NtCreateFile
RtlDoesFileExists_U
NtOpenProcessToken
NtQueryInformationToken
RtlGetFileMUIPath
NtQueryInformationFile
RtlCreateUnicodeString
_vscwprintf
EtwEventRegister
EtwEventUnregister
EtwEventWrite
RtlAppendUnicodeStringToString
DbgPrintEx
wcsstr
strncmp
wcspbrk
wcsspn
wcschr
_vsnwprintf
ord7
RtlGetNativeSystemInformation
ord3
ord4
RtlEnterCriticalSection
LdrInitShimEngineDynamic
RtlLeaveCriticalSection
LdrLoadDll
LdrGetProcedureAddress
LdrUnloadDll
RtlTimeToTimeFields
RtlCompareUnicodeString
strrchr
LdrLockLoaderLock
LdrUnlockLoaderLock
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlInitString
LdrGetProcedureAddressEx
NtFlushInstructionCache
LdrFindEntryForAddress
RtlImageDirectoryEntryToData
_stricmp
NtSetEvent
RtlDeleteCriticalSection
RtlInitializeCriticalSection
_wcsnicmp
NtProtectVirtualMemory
RtlDosPathNameToNtPathName_U
LdrGetDllHandle
NtOpenKey
NtQueryValueKey
RtlExpandEnvironmentStrings_U
NtClose
RtlFormatCurrentUserKeyPath
RtlCopyUnicodeString
RtlAppendUnicodeToString
RtlStringFromGUID
RtlDuplicateUnicodeString
RtlQueryEnvironmentVariable_U
RtlSetEnvironmentVariable
RtlUnicodeStringToAnsiString
RtlFreeHeap
RtlFreeAnsiString
RtlDosPathNameToRelativeNtPathName_U
WinSqmIsOptedIn
RtlRandom
RtlCompareMemory
wcsnlen
RtlCaptureStackBackTrace
RtlNtStatusToDosError
RtlCreateServiceSid
RtlLengthRequiredSid
NtOpenEvent
RtlGetOwnerSecurityDescriptor
NtQuerySecurityObject
ord6
_strnicmp
RtlCreateUnicodeStringFromAsciiz
NtQueryObject
_strupr
_itoa_s
strcpy_s
LdrEnumerateLoadedModules
wcscat_s
wcscpy_s
RtlComputeCrc32
memset
NtApphelpCacheControl
wcsrchr
_wcsicmp
memcpy
RtlInitUnicodeString
RtlNtPathNameToDosPathName
RtlpEnsureBufferSize
RtlFreeUnicodeString
RtlAllocateHeap
RtlUpcaseUnicodeToMultiByteN
memmove
RtlReleaseRelativeName
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtOpenSection
