NtQueryInformationProcess
NtSetInformationFile
LdrFindResource_U
RtlMultiByteToUnicodeN
RtlGetFullPathName_U
RtlAppendUnicodeToString
RtlCopySid
RtlCaptureStackBackTrace
NtAllocateVirtualMemory
NtDeleteValueKey
NtCreateFile
NtProtectVirtualMemory
RtlInitializeCriticalSectionAndSpinCount
NtOpenKey
NtWriteFile
RtlInitString
RtlQueryEnvironmentVariable_U
strtol
memset
RtlDosPathNameToNtPathName_U
NtSetInformationThread
RtlUnicodeStringToInteger
NtOpenThreadToken
NtQuerySystemTime
NtUnmapViewOfSection
wcsrchr
RtlDoesFileExists_U
ZwAllocateVirtualMemory
strchr
wcsstr
RtlFormatCurrentUserKeyPath
atoi
RtlExpandEnvironmentStrings_U
_itow
RtlAllocateHeap
NtQueryAttributesFile
NtReadFile
RtlImageNtHeader
RtlFreeUnicodeString
NtQuerySystemInformation
RtlAnsiStringToUnicodeString
wcschr
RtlUnicodeStringToAnsiString
_wcslwr
RtlInitAnsiString
RtlxAnsiStringToUnicodeSize
RtlInitUnicodeString
RtlCreateSecurityDescriptor
memcpy
RtlDeleteResource
RtlIntegerToChar
NtQueryKey
RtlUpcaseUnicodeString
NtDelayExecution
NtMapViewOfSection
RtlAppendAsciizToString
RtlGetVersion
RtlUpcaseUnicodeChar
RtlInitializeResource
NtQueryVirtualMemory
RtlIntegerToUnicodeString
RtlSetDaclSecurityDescriptor
RtlEnterCriticalSection
RtlLengthRequiredSid
NtCreateSection
RtlTryEnterCriticalSection
_stricmp
NtAllocateUuids
RtlUnwind
wcstombs
NtQueryInformationFile
RtlLeaveCriticalSection
NtQueryValueKey
RtlGUIDFromString
RtlAcquireResourceExclusive
wcstol
_wcsicmp
_itoa
RtlAcquireResourceShared
RtlGetNtProductType
wcstoul
RtlAppendUnicodeStringToString
RtlFreeAnsiString
DbgPrint
DbgBreakPoint
RtlUpcaseUnicodeToMultiByteN
LdrAccessResource
NtClose
NtQueryInformationThread
RtlUnicodeToMultiByteSize
_wcsnicmp
_strcmpi
RtlSubAuthorityCountSid
RtlDeleteCriticalSection
RtlNtStatusToDosError
NlsMbCodePageTag
RtlReleaseResource
RtlUnicodeToMultiByteN
RtlSetEnvironmentVariable
_strnicmp
RtlSubAuthoritySid
RtlDestroyEnvironment
NtQueryObject
NtAlertThread
NtOpenFile
NtEnumerateValueKey
NtDeleteKey
NtQueryDirectoryFile
NtQueryVolumeInformationFile
RtlCopyUnicodeString
RtlCreateEnvironment
NtFreeVirtualMemory
RtlFreeHeap
memmove