RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlCopyUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlxAnsiStringToUnicodeSize
NlsMbOemCodePageTag
KeReleaseMutex
KeWaitForSingleObject
RtlWriteRegistryValue
RtlInitUnicodeString
RtlQueryRegistryValues
DbgPrint
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
memmove
RtlIntegerToUnicodeString
KeDelayExecutionThread
KeGetCurrentThread
ZwCreateFile
ZwWaitForSingleObject
NtSetInformationFile
NtOpenFile
ZwWriteFile
ZwSetInformationFile
ZwClose
NtReadFile
KeSetEvent
PsTerminateSystemThread
PsCreateSystemThread
KeInitializeEvent
KeInitializeMutex
_allmul
InterlockedPopEntrySList
InterlockedPushEntrySList
ExGetPreviousMode
ExReleaseResourceForThreadLite
ExAcquireResourceSharedLite
NtUnlockFile
IoCreateFile
NtLockFile
IoSetThreadHardErrorMode
ExDeleteResourceLite
ExInitializeResourceLite
ExAcquireResourceExclusiveLite
RtlFreeAnsiString
toupper
RtlxUnicodeStringToAnsiSize
ZwDeleteKey
ZwEnumerateKey
RtlFreeUnicodeString
ZwOpenKey
RtlCompareUnicodeString
KeResetEvent
WmiQueryTraceInformation
IoWMIRegistrationControl
IofCompleteRequest
KeReleaseSemaphore
IoDeleteDevice
ObfDereferenceObject
IoDeleteSymbolicLink
ExDeleteNPagedLookasideList
ExDeletePagedLookasideList
KeLeaveCriticalRegion
KeEnterCriticalRegion
IoCreateSymbolicLink
KeWaitForMultipleObjects
RtlTimeToSecondsSince1970
MmQuerySystemSize
RtlLengthRequiredSid
IoGetCurrentProcess
ExInitializePagedLookasideList
ExInitializeNPagedLookasideList
KeInitializeSemaphore
KeInitializeSpinLock
wcsncpy
wcsrchr
RtlEqualUnicodeString
RtlCopySid
_aulldiv
IoGetRelatedDeviceObject
_except_handler3
ZwOpenFile
ObReferenceObjectByHandle
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
NtQuerySecurityObject
ExConvertExclusiveToSharedLite
RtlLengthSid
KeSetBasePriorityThread
RtlEqualSid
SeSinglePrivilegeCheck
RtlMapGenericMask
ZwQueryInformationFile
ExQueueWorkItem
KeUnstackDetachProcess
RtlFreeHeap
KeStackAttachProcess
IoGetTopLevelIrp
IoFreeWorkItem
IoQueueWorkItem
IoAllocateWorkItem
RtlUpcaseUnicodeStringToAnsiString
RtlDowncaseUnicodeString
RtlUpcaseUnicodeString
KeQuerySystemTime
ZwQueryValueKey
RtlInitCodePageTable
ZwReadFile
RtlCustomCPToUnicodeN
RtlUnicodeToCustomCPN
ZwFreeVirtualMemory
RtlDestroyHeap
RtlCreateRegistryKey
RtlCheckRegistryKey
strncmp
RtlCopyString
NtSetSecurityObject
RtlCompareMemory
NtQueryInformationToken
RtlSubAuthoritySid
RtlInitializeSid
_aulldvrm
_wcsnicmp
RtlAbsoluteToSelfRelativeSD
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
SeDeassignSecurity
SeReleaseSubjectContext
SeUnlockSubjectContext
SeAssignSecurityEx
IoGetFileObjectGenericMapping
SeLockSubjectContext
SeCaptureSubjectContext
RtlValidSid
SePrivilegeCheck
SeExports
SeAccessCheck
RtlPrefixUnicodeString
ExLocalTimeToSystemTime
RtlTimeFieldsToTime
RtlCharToInteger
RtlAddAce
RtlCreateAcl
ZwQueryVolumeInformationFile
RtlAddAccessAllowedAce
LsaDeregisterLogonProcess
LsaFreeReturnBuffer
NtFreeVirtualMemory
LsaLogonUser
NtAllocateVirtualMemory
NtSetInformationThread
NtAdjustPrivilegesToken
NtOpenProcessToken
NtDuplicateToken
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess
NtAllocateLocallyUniqueId
RtlInitString
IoFreeIrp
IoFreeMdl
IofCallDriver
MmProbeAndLockPages
IoAllocateMdl
IoAllocateIrp
MmUnlockPages
MmProbeAndLockProcessPages
MmBuildMdlForNonPagedPool
RtlAllocateHeap
ExRaiseStatus
ZwAllocateVirtualMemory
NtSetInformationProcess
NtQueryInformationProcess
NtQuerySystemInformation
NtWaitForSingleObject
NtQueryDirectoryFile
NtCreateEvent
ZwOpenEvent
ZwTerminateProcess
ObOpenObjectByPointer
RtlCreateHeap
NtFsControlFile
MmProbeAndLockSelectedPages
NtDeviceIoControlFile
_snprintf
RtlEqualString
KeTickCount
KeBugCheckEx
ExSystemTimeToLocalTime
RtlTimeToTimeFields
RtlUnicodeStringToAnsiString
NtWriteFile
ExAllocatePoolWithTag
ZwSetValueKey
ZwCreateKey
wcschr
IoIsWdmVersionAvailable
SeCaptureSecurityDescriptor
_snwprintf
RtlGetSaclSecurityDescriptor
IoCreateDevice
IoDeviceObjectType
ZwSetSecurityObject
MmGetSystemRoutineAddress
memset
memcpy
RtlRandom
ZwQueryDefaultLocale
NtQueryEaFile
ExFreePoolWithTag
NtQueryInformationFile
NtQueryVolumeInformationFile
RtlExtendedIntegerMultiply
NtClose
NtCreateFile
wcslen
wcscpy
ZwConnectPort
ZwRequestWaitReplyPort
ZwOpenProcess
NtSetEaFile
WmiTraceMessage
