RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
_vsnwprintf
memset
RtlFreeAnsiString
RtlFreeHeap
RtlDeleteCriticalSection
RtlInitializeCriticalSection
RtlAllocateHeap
CsrVerifyRegion
CsrClientConnectToServer
RtlCreateTagHeap
NtQueryInformationProcess
NtSetInformationProcess
NtClose
NtSetInformationFile
NtCreateIoCompletion
NtSetIoCompletion
RtlSetLastWin32Error
SbSelectProcedure
NtRemoveIoCompletion
RtlDeactivateActivationContextUnsafeFast
NtRemoveIoCompletionEx
RtlActivateActivationContextUnsafeFast
NtCreateNamedPipeFile
NtOpenFile
NtWaitForSingleObject
NtFsControlFile
NtCreateEvent
NtQueryInformationFile
_allmul
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlDefaultNpAcl
RtlDosPathNameToNtPathName_U
RtlAppendUnicodeStringToString
_wcsnicmp
RtlPrefixString
RtlInitUnicodeString
RtlFreeUnicodeString
RtlDetermineDosPathNameType_U
RtlCreateUnicodeString
memcpy
NtDeviceIoControlFile
NtCreateFile
RtlTimeToTimeFields
RtlTimeFieldsToTime
NtQuerySystemInformation
RtlAcquirePrivilege
RtlInitializeSRWLock
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlCutoverTimeToSystemTime
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleasePrivilege
NtSetSystemTime
RtlUnicodeStringToInteger
wcschr
wcscpy_s
RtlpCheckDynamicTimeZoneInformation
_stricmp
_wcsicmp
RtlDeregisterWaitEx
RtlCreateTimerQueue
NtDelayExecution
RtlCreateTimer
RtlUpdateTimer
RtlDeleteTimer
RtlDeleteTimerQueueEx
RtlRegisterWait
wcsrchr
NtQueryValueKey
NtOpenKey
RtlxAnsiStringToUnicodeSize
NlsMbCodePageTag
RtlxOemStringToUnicodeSize
NlsMbOemCodePageTag
RtlxUnicodeStringToOemSize
RtlxUnicodeStringToAnsiSize
LdrEnumerateLoadedModules
NtAllocateVirtualMemory
_alloca_probe
RtlReleasePebLock
RtlQueryEnvironmentVariable
RtlAcquirePebLock
RtlLeaveCriticalSection
RtlEnterCriticalSection
wcsncmp
RtlUnicodeStringToOemString
RtlOemStringToUnicodeString
RtlRaiseException
NtDuplicateObject
NtQueryObject
NtSetInformationObject
NtQueryVolumeInformationFile
NtLockFile
NtUnlockFile
RtlNtStatusToDosError
NtReadFile
NtWriteFile
NtCancelIoFileEx
NtReadFileScatter
NtWriteFileGather
RtlWow64EnableFsRedirectionEx
memmove
NtFlushBuffersFile
NtCreateSection
NtOpenSection
NtMapViewOfSection
NtFlushVirtualMemory
RtlFlushSecureMemoryCache
NtUnmapViewOfSection
NtReadVirtualMemory
NtFlushInstructionCache
NtWriteVirtualMemory
NtProtectVirtualMemory
NtFreeVirtualMemory
NtQueryVirtualMemory
NtQuerySystemInformationEx
RtlGetCurrentProcessorNumberEx
NtOpenProcess
RtlExitUserProcess
NtTerminateProcess
RtlReportSilentProcessExit
NtRaiseHardError
RtlRaiseStatus
RtlInitUnicodeStringEx
CsrClientCallServer
RtlQueryEnvironmentVariable_U
strchr
RtlInitAnsiStringEx
RtlUpcaseUnicodeChar
CsrFreeCaptureBuffer
RtlCopyUnicodeString
RtlUpcaseUnicodeString
CsrAllocateMessagePointer
CsrAllocateCaptureBuffer
RtlEqualUnicodeString
RtlCompareMemory
NtQueryDirectoryObject
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
NtOpenDirectoryObject
RtlSetEnvironmentStrings
RtlSetEnvironmentVariable
RtlSetEnvironmentVar
RtlExpandEnvironmentStrings
RtlUnicodeToOemN
RtlUnicodeToMultiByteSize
RtlExpandEnvironmentStrings_U
RtlInitializeCriticalSectionAndSpinCount
RtlInitializeCriticalSectionEx
NtSetEvent
NtClearEvent
NtPulseEvent
NtCreateSemaphore
NtReleaseSemaphore
NtCreateMutant
NtReleaseMutant
NtCreateTimer
NtSetTimerEx
NtCancelTimer
NtOpenEvent
NtOpenSemaphore
NtOpenMutant
NtWaitForMultipleObjects
NtOpenTimer
LdrDisableThreadCalloutsForDll
LdrUnlockLoaderLock
LdrLockLoaderLock
LdrGetDllHandle
LdrAddRefDll
RtlComputePrivatizedDllName_U
RtlPcToFileHeader
LdrGetProcedureAddress
RtlInitString
RtlGetVersion
LdrAccessResource
RtlReAllocateHeap
LdrAddLoadAsDataTable
RtlGetActiveActivationContext
LdrGetDllHandleByMapping
RtlImageNtHeaderEx
RtlDosSearchPath_Ustr
LdrGetDllHandleByName
RtlDosApplyFileIsolationRedirection_Ustr
LdrLoadDll
LdrUnloadAlternateResourceModule
LdrRemoveLoadAsDataTable
RtlImageNtHeader
LdrUnloadDll
RtlExitUserThread
LdrFindResource_U
RtlFreeSid
RtlSetSaclSecurityDescriptor
RtlAddMandatoryAce
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
RtlAllocateAndInitializeSid
DbgPrint
NtOpenThread
NtSetInformationThread
NtQueryInformationThread
NtTerminateThread
TpCheckTerminateWorker
RtlCaptureStackBackTrace
NtSuspendThread
NtResumeThread
RtlClearBits
RtlAreBitsSet
NtQueueApcThread
ord8
RtlQueryInformationActivationContext
RtlFlsAlloc
RtlProcessFlsData
RtlFlsFree
NtYieldExecution
RtlFreeActivationContextStack
RtlReleaseActivationContext
RtlActivateActivationContextEx
RtlAllocateActivationContextStack
NtCreateThreadEx
TpCaptureCaller
RtlFindClearBitsAndSet
RtlFormatMessageEx
RtlInitAnsiString
RtlFindMessage
RtlLoadString
RtlUnicodeToMultiByteN
RtlUnlockHeap
RtlFreeHandle
RtlIsValidHandle
RtlLockHeap
RtlSetUserValueHeap
RtlAllocateHandle
RtlCreateHeap
RtlDestroyHeap
RtlQueryHeapInformation
RtlValidateHeap
RtlGetProcessHeaps
RtlCompactHeap
RtlWalkHeap
RtlSetHeapInformation
RtlInitializeHandleTable
RtlIsDosDeviceName_U
RtlAnsiCharToUnicodeChar
RtlIntegerToChar
wcsncpy_s
RtlGetCurrentDirectory_U
RtlSetThreadErrorMode
toupper
RtlReleaseRelativeName
RtlDosPathNameToRelativeNtPathName_U
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtQueryAttributesFile
RtlDosPathNameToNtPathName_U_WithStatus
NtQueryFullAttributesFile
NtNotifyChangeDirectoryFile
NtQueryDirectoryFile
RtlGetFullPathName_UEx
RtlSetCurrentDirectory_U
ord1
NtQueryEaFile
NtIsProcessInJob
NtDuplicateToken
NtAllocateLocallyUniqueId
NtAccessCheck
NtAccessCheckByType
NtAccessCheckByTypeResultList
NtOpenProcessToken
NtOpenThreadToken
NtQueryInformationToken
NtSetInformationToken
NtAdjustPrivilegesToken
NtAdjustGroupsToken
NtPrivilegeCheck
NtAccessCheckAndAuditAlarm
NtAccessCheckByTypeAndAuditAlarm
NtAccessCheckByTypeResultListAndAuditAlarm
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
NtOpenObjectAuditAlarm
NtPrivilegeObjectAuditAlarm
NtCloseObjectAuditAlarm
NtDeleteObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
RtlValidSid
RtlEqualSid
RtlEqualPrefixSid
RtlLengthRequiredSid
RtlInitializeSid
RtlIdentifierAuthoritySid
RtlSubAuthoritySid
RtlSubAuthorityCountSid
RtlCopySid
RtlAreAllAccessesGranted
RtlAreAnyAccessesGranted
RtlMapGenericMask
RtlValidAcl
RtlQueryInformationAcl
RtlSetInformationAcl
RtlAddAce
RtlDeleteAce
RtlGetAce
RtlAddAccessAllowedAceEx
RtlAddAccessDeniedAce
RtlAddAccessDeniedAceEx
RtlAddAuditAccessAce
RtlAddAuditAccessAceEx
RtlAddAccessAllowedObjectAce
RtlAddAccessDeniedObjectAce
RtlAddAuditAccessObjectAce
RtlFirstFreeAce
RtlValidSecurityDescriptor
RtlValidRelativeSecurityDescriptor
RtlLengthSecurityDescriptor
RtlGetControlSecurityDescriptor
RtlSetControlSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlNewSecurityObject
RtlConvertToAutoInheritSecurityObject
RtlNewSecurityObjectEx
RtlNewSecurityObjectWithMultipleInheritance
RtlSetSecurityObject
RtlSetSecurityObjectEx
RtlQuerySecurityObject
RtlDeleteSecurityObject
RtlAbsoluteToSelfRelativeSD
RtlSelfRelativeToAbsoluteSD
NtSetSecurityObject
NtQuerySecurityObject
RtlImpersonateSelf
NtImpersonateAnonymousToken
NtFilterToken
RtlSelfRelativeToAbsoluteSD2
RtlGetSecurityDescriptorRMControl
RtlSetSecurityDescriptorRMControl
RtlUnhandledExceptionFilter
RtlGetLocaleFileMappingAddress
NtGetNlsSectionPtr
RtlNormalizeString
wcspbrk
RtlLcidToLocaleName
EtwEventUnregister
EtwEventEnabled
EtwEventRegister
NtSetDefaultLocale
RtlLocaleNameToLcid
NtEnumerateValueKey
RtlpMuiFreeLangRegistryInfo
RtlCultureNameToLCID
qsort
RtlpIsQualifiedLanguage
RtlpGetLCIDFromLangInfoNode
RtlpGetNameFromLangInfoNode
NtQueryInstallUILanguage
RtlLCIDToCultureName
RtlpLoadUserUIByPolicy
RtlpLoadMachineUIByPolicy
RtlpCreateProcessRegistryInfo
RtlpInitializeLangRegistryInfo
LdrFindResourceEx_U
RtlGetFileMUIPath
RtlGetUILanguageInfo
RtlpGetSystemDefaultUILanguage
RtlGetThreadPreferredUILanguages
RtlGetProcessPreferredUILanguages
RtlpQueryDefaultUILanguage
RtlGetSystemPreferredUILanguages
RtlGetUserPreferredUILanguages
NtCreateKey
NtSetValueKey
NtDeleteKey
NtEnumerateKey
RtlIntegerToUnicodeString
RtlAppendUnicodeToString
EtwEventWrite
RtlOpenCurrentUser
NtQueryDefaultLocale
NtNotifyChangeKey
swprintf_s
CsrCaptureMessageBuffer
RtlUTF8ToUnicodeN
RtlUnicodeToUTF8N
NtDeleteValueKey
RtlUnwind
DbgPrintEx
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
TpAllocPool
TpSetPoolMinThreads
TpSetPoolStackInformation
TpQueryPoolStackInformation
TpAllocCleanupGroup
TpSimpleTryPost
TpAllocWork
TpAllocTimer
TpAllocWait
TpAllocIoCompletion
TpCallbackMayRunLong
NtQueryMultipleValueKey