183bebf0d0007b34a4c8d9ecaebcb94f

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 1989-Sep-10 06:58:46
Detected languages English - United States
Debug artifacts kernel32.pdb
CompanyName Microsoft Corporation
FileDescription Windows NT BASE API Client DLL
FileVersion 10.0.17763.475 (WinBuild.160101.0800)
InternalName kernel32
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename kernel32
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.17763.475

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • CurrentControlSet\Services
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • LdrLoadDll
  • GetProcAddress
  • LoadLibraryExA
  • LoadLibraryExW
  • LoadLibraryW
  • LoadLibraryA
Functions which can be used for anti-debugging purposes:
  • NtQueryInformationProcess
  • DbgPrint
  • ZwQuerySystemInformation
  • NtQuerySystemInformation
  • SwitchToThread
  • CheckRemoteDebuggerPresent
Code injection capabilities:
  • CreateRemoteThreadEx
  • CreateRemoteThread
  • OpenProcess
  • VirtualAlloc
  • WriteProcessMemory
  • VirtualAllocEx
  • VirtualAllocExNuma
Code injection capabilities (process hollowing):
  • ResumeThread
  • SetThreadContext
  • WriteProcessMemory
Can access the registry:
  • RegLoadAppKeyW
  • RegUnLoadKeyW
  • RegUnLoadKeyA
  • RegSetValueExA
  • RegSetKeySecurity
  • RegSaveKeyExW
  • RegSaveKeyExA
  • RegRestoreKeyW
  • RegRestoreKeyA
  • RegQueryValueExW
  • RegQueryValueExA
  • RegQueryInfoKeyW
  • RegQueryInfoKeyA
  • RegOpenKeyExA
  • RegNotifyChangeKeyValue
  • RegOpenKeyExW
  • RegGetValueW
  • RegCloseKey
  • RegCreateKeyExA
  • RegCreateKeyExW
  • RegDeleteKeyExA
  • RegDeleteKeyExW
  • RegDeleteValueA
  • RegDeleteValueW
  • RegEnumKeyExA
  • RegEnumKeyExW
  • RegEnumValueA
  • RegEnumValueW
  • RegFlushKey
  • RegGetKeySecurity
  • RegGetValueA
  • RegLoadKeyW
  • RegSetValueExW
  • RegLoadKeyA
Possibly launches other programs:
  • CreateProcessInternalA
  • CreateProcessInternalW
  • CreateProcessAsUserW
  • CreateProcessAsUserA
  • CreateProcessA
  • CreateProcessW
Uses Windows's Native API:
  • NtEnumerateKey
  • NtTerminateProcess
  • NtMapUserPhysicalPagesScatter
  • NtMapViewOfSection
  • NtCreateSection
  • NtDeleteValueKey
  • NtSetValueKey
  • NtQueryInstallUILanguage
  • NtUnmapViewOfSection
  • NtQueryInformationThread
  • NtQueryEvent
  • NtRaiseHardError
  • NtQueryVolumeInformationFile
  • NtReplacePartitionUnit
  • NtQueryValueKey
  • NtQueryInformationToken
  • NtOpenProcessToken
  • NtSetInformationThread
  • NtOpenThreadToken
  • NtOpenKey
  • NtIsSystemResumeAutomatic
  • NtInitiatePowerAction
  • NtWaitForSingleObject
  • NtCreateEvent
  • NtFsControlFile
  • NtOpenFile
  • NtClose
  • NtQueryInformationFile
  • NtSetInformationFile
  • NtSetInformationDebugObject
  • NtSetSystemInformation
  • NtQueryInformationProcess
  • NtAddAtomEx
  • NtFindAtom
  • NtDeleteAtom
  • NtQueryInformationAtom
  • NtCreateKey
  • NtFlushKey
  • NtCreateFile
  • NtQueryInformationJobObject
  • NtCreateJobObject
  • NtOpenJobObject
  • NtAssignProcessToJobObject
  • NtTerminateJobObject
  • NtSetInformationJobObject
  • NtCreateJobSet
  • NtQueryEaFile
  • NtQuerySecurityObject
  • NtSetEaFile
  • NtSetSecurityObject
  • NtSetInformationProcess
  • NtQuerySection
  • NtEnumerateValueKey
  • NtLockFile
  • NtUnlockFile
  • NtAllocateVirtualMemory
  • NtReadFile
  • NtWriteFile
  • NtFreeVirtualMemory
  • NtQueryVirtualMemory
  • NtProtectVirtualMemory
  • NtCreateMailslotFile
  • NtQueryDirectoryFile
  • NtGetDevicePowerState
  • NtPowerInformation
  • NtQueryWnfStateData
  • NtSetThreadExecutionState
  • NtQuerySystemEnvironmentValueEx
  • NtSetSystemEnvironmentValueEx
  • NtSetVolumeInformationFile
  • NtDeviceIoControlFile
  • NtQueryFullAttributesFile
  • NtQueryAttributesFile
  • NtQueryTimerResolution
  • NtSetTimerResolution
  • NtReadVirtualMemory
  • NtWaitForMultipleObjects
  • NtClearEvent
  • NtApphelpCacheControl
  • ZwClose
  • ZwOpenFile
  • ZwOpenKey
  • ZwEnumerateKey
  • ZwQueryValueKey
  • ZwCreateFile
  • ZwQueryInformationFile
  • ZwCreateSection
  • ZwQueryDirectoryFile
  • ZwQuerySystemInformation
  • ZwUnmapViewOfSection
  • ZwMapViewOfSection
  • NtQuerySystemInformation
Can create temporary files:
  • CreateFileA
  • CreateFileW
  • GetTempPathW
  • GetTempPathA
Memory manipulation functions often used by packers:
  • VirtualProtect
  • VirtualAlloc
  • VirtualProtectEx
  • VirtualAllocEx
Functions related to the privilege level:
  • OpenProcessToken
  • DuplicateToken
Enumerates local disk drives:
  • GetVolumeInformationW
  • GetVolumeInformationByHandleW
  • GetLogicalDriveStringsW
  • GetDriveTypeW
  • GetDriveTypeA
  • GetVolumeInformationA
Manipulates other processes:
  • OpenProcess
  • WriteProcessMemory
  • ReadProcessMemory
Info The PE is digitally signed. Signer: Microsoft Windows
Issuer: Microsoft Windows Production PCA 2011
Safe VirusTotal score: 0/69 (Scanned on 2019-10-04 11:04:04) All the AVs think this file is safe.

Hashes

MD5 183bebf0d0007b34a4c8d9ecaebcb94f
SHA1 8de080d3295fb21475715d4051ec9dbc3df972ba
SHA256 ec1426109420445df8e9799ac21a4c13364dc12229fb16197e428803bece1140
SHA3 8b1e5aaef9d830a9a8bc7b90b21f2683ff6cb99aff54cfece95431c6c84c722c
SSDeep 12288:nF8X3YIDFrfar9H2G4iBPM212lEfAF7ZOruJm6rH82/Sa/V:nOYID9farB0iyDkAFESVrH82/Sa/V
Imports Hash 5a2debb2344b5d6d1e742b407695a348

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 1989-Sep-10 06:58:46
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x75200
SizeOfInitializedData 0x38e00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000017A10 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion A.0
ImageVersion A.0
SubsystemVersion A.0
Win32VersionValue 0
SizeOfImage 0xb3000
SizeOfHeaders 0x400
Checksum 0xb8f88
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x40000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 f3ea4d807b3643b0fd2d002606b80c11
SHA1 67e06ee6739cc6944ea73332e5beb61b0a9d7fa1
SHA256 cea8252f42daa23140d50c8508c7225992090093096203506415fbc7a4a17eaf
SHA3 30f60dd80780b02a1d729f38061e13fc555421a70272755a7c46f2681433e759
VirtualSize 0x7518c
VirtualAddress 0x1000
SizeOfRawData 0x75200
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.41067

.rdata

MD5 35b6a66a5eabf3e1258d4a4d05bf6023
SHA1 eaf3e7048adb732198c3bc4dfba85803b583a76d
SHA256 4d927e4fb9f95f117cd935b9d97078ac1f6f057d9f490425298113dd32771792
SHA3 ecd030135ca3dbcec1f78bd8ce7921c3c891bb3602562f2fc1cf021b70ce24e9
VirtualSize 0x31be6
VirtualAddress 0x77000
SizeOfRawData 0x31c00
PointerToRawData 0x75600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.68065

.data

MD5 b723b1d36bc84f3ab776355622258ae1
SHA1 3d51dc28ced2d9c0d8aa567847eb645405107809
SHA256 12076f0a435c76ff84ff99f0b1c61175f9edf32a01ff8cdb2acb1cf4af3f0698
SHA3 fae306d8c77aa0dddc83ef7abe83c4a99137da64f15507789fc11f2d8a357df8
VirtualSize 0x10fc
VirtualAddress 0xa9000
SizeOfRawData 0x600
PointerToRawData 0xa7200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.62119

.pdata

MD5 3b59b791daad0d2464db645104d149e1
SHA1 ed7f90e079cde19b8a8a6a7bd341ed7fd81895e3
SHA256 0cb4e70f35dc986101a33aedbf2335dabeb962000b3bd191580f309153a83264
SHA3 c677169496b0f03b7888a872a86e6a8439a522c7ff603b3c390b2bd3cdf83a32
VirtualSize 0x5454
VirtualAddress 0xab000
SizeOfRawData 0x5600
PointerToRawData 0xa7800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.80805

.rsrc

MD5 95a3d235010cbcfd3d15f9e8597f75bc
SHA1 b6f23084eaa15a263e176432e21555854e46ecaa
SHA256 a5deea12cbe0a997a72c9a9f5765d0bff82b23629badf76e3a2de9020fe21d6b
SHA3 a2248b61909b123dfaa3e900322ca8a133e1beca00da9b8eaa3ea4fe75c82b08
VirtualSize 0x520
VirtualAddress 0xb1000
SizeOfRawData 0x600
PointerToRawData 0xace00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.99838

.reloc

MD5 60385b7df05850ab2401eb268b63921d
SHA1 ee303f226c5775f4253fbc0344522f2c2dfbf350
SHA256 0c2a3588a446006b6a929a8420d052e146d43efe4b0cb36c8237a2a7b133d321
SHA3 7b7dac2bd34c7b3fae8ab77b62b4f53392a7874a8bee8e78878979d35f6ba247
VirtualSize 0x24c
VirtualAddress 0xb2000
SizeOfRawData 0x400
PointerToRawData 0xad400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 3.89605

Imports

api-ms-win-core-rtlsupport-l1-1-0.dll RtlPcToFileHeader
RtlCaptureContext
RtlRaiseException
RtlVirtualUnwind
RtlUnwindEx
RtlRestoreContext
RtlLookupFunctionEntry
RtlInstallFunctionTableCallback
RtlCompareMemory
RtlDeleteFunctionTable
RtlAddFunctionTable
RtlCaptureStackBackTrace
RtlUnwind
ntdll.dll RtlSizeHeap
RtlLCIDToCultureName
RtlUnicodeStringToInteger
_wcslwr
RtlGetUILanguageInfo
EtwEventEnabled
RtlpConvertLCIDsToCultureNames
NtEnumerateKey
RtlIntegerToUnicodeString
RtlTimeToTimeFields
RtlTimeFieldsToTime
RtlUnhandledExceptionFilter
NtTerminateProcess
wcsncmp
wcsncpy
LdrFindResourceEx_U
RtlReadThreadProfilingData
RtlQueryThreadProfiling
RtlDisableThreadProfiling
RtlNtStatusToDosErrorNoTeb
RtlEnableThreadProfiling
NtMapUserPhysicalPagesScatter
RtlDecodeSystemPointer
bsearch
RtlComputeImportTableHash
RtlFindActivationContextSectionGuid
RtlQueryActivationContextApplicationSettings
RtlSubAuthorityCountSid
LdrResFindResourceDirectory
RtlQueryInformationActivationContext
RtlSetThreadPreferredUILanguages
RtlMultiAppendUnicodeStringBuffer
swprintf_s
RtlImageNtHeaderEx
NtMapViewOfSection
NtCreateSection
RtlDosPathNameToNtPathName_U_WithStatus
RtlGetActiveActivationContext
RtlDeactivateActivationContext
TpAllocPool
TpSetPoolMinThreads
TpSetPoolStackInformation
TpAllocWait
NtDeleteValueKey
NtSetValueKey
towlower
memmove_s
RtlGUIDFromString
sin
TpAllocTimer
RtlpConvertCultureNamesToLCIDs
NtQueryInstallUILanguage
EtwEventUnregister
EtwEventWrite
EtwEventRegister
RtlExpandEnvironmentStrings_U
RtlPublishWnfStateData
TpAllocIoCompletion
RtlActivateActivationContext
RtlZombifyActivationContext
RtlReleaseActivationContext
RtlAddRefActivationContext
RtlCreateActivationContext
RtlGetLengthWithoutLastFullDosOrNtPathElement
RtlpApplyLengthFunction
RtlGetFullPathName_U
RtlDoesFileExists_U
RtlDetermineDosPathNameType_U
RtlpEnsureBufferSize
DbgPrintEx
NtUnmapViewOfSection
RtlQueryPackageClaims
tolower
atol
toupper
isdigit
NtQueryInformationThread
RtlEnterUmsSchedulingMode
RtlCreateUmsThreadContext
RtlDeleteUmsThreadContext
RtlSetUmsThreadInformation
RtlQueryUmsThreadInformation
RtlGetNextUmsListItem
RtlGetCurrentUmsThread
RtlDeleteUmsCompletionList
RtlUmsThreadYield
TpQueryPoolStackInformation
RtlGetUmsCompletionListEvent
RtlDequeueUmsCompletionListItems
RtlCreateUmsCompletionList
RtlDestroyEnvironment
RtlCreateEnvironmentEx
RtlCreateEnvironment
NtQueryEvent
RtlCreateUnicodeString
NtRaiseHardError
RtlFreeAnsiString
RtlFreeOemString
RtlGetCurrentDirectory_U
wcsrchr
_wcsnicmp
RtlUnicodeStringToOemString
NtQueryVolumeInformationFile
CsrFreeCaptureBuffer
CsrAllocateMessagePointer
CsrAllocateCaptureBuffer
RtlEqualUnicodeString
RtlUnicodeStringToAnsiString
RtlWow64SuspendThread
RtlWow64SetThreadContext
RtlWow64GetThreadContext
RtlExitUserThread
RtlAddIntegrityLabelToBoundaryDescriptor
RtlQueryProtectedPolicy
NtReplacePartitionUnit
RtlCompareUnicodeString
RtlExitUserProcess
RtlInitUnicodeStringEx
RtlQueryPackageIdentity
EtwEventWriteNoRegistration
RtlWow64LogMessageInEventLogger
LdrUnloadDll
LdrGetProcedureAddress
LdrLoadDll
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlFormatCurrentUserKeyPath
NtQueryValueKey
RtlEqualSid
RtlSubAuthoritySid
RtlInitializeSid
NtQueryInformationToken
NtOpenProcessToken
NtSetInformationThread
NtOpenThreadToken
RtlReleaseSRWLockExclusive
RtlQueryRegistryValuesEx
NtOpenKey
RtlAcquireSRWLockExclusive
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
RtlInitAnsiStringEx
NtIsSystemResumeAutomatic
NtInitiatePowerAction
RtlIsNameLegalDOS8Dot3
RtlGetCurrentProcessorNumberEx
NtWaitForSingleObject
NtCreateEvent
RtlSetSearchPathMode
LdrGetDllDirectory
RtlUnlockHeap
RtlGetUserInfoHeap
RtlLockHeap
RtlDeregisterSecureMemoryCacheCallback
RtlRegisterSecureMemoryCacheCallback
RtlCompactHeap
NtFsControlFile
NtOpenFile
NtClose
LdrAddRefDll
NtQueryInformationFile
NtSetInformationFile
wcscpy_s
RtlGetActiveConsoleId
RtlDeactivateActivationContextUnsafeFast
RtlActivateActivationContextUnsafeFast
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlWow64GetThreadSelectorEntry
NtSetInformationDebugObject
DbgUiGetThreadDebugObject
DbgUiIssueRemoteBreakin
NtSetSystemInformation
NtQueryInformationProcess
RtlSetCurrentTransaction
RtlGetCurrentTransaction
RtlSetLastWin32Error
CsrClientCallServer
LdrDisableThreadCalloutsForDll
RtlGetSuiteMask
LdrQueryImageFileExecutionOptions
RtlInitUnicodeString
_vsnwprintf
RtlSetProtectedPolicy
LdrSetDllManifestProber
TpSimpleTryPost
TpAllocCleanupGroup
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
_wtol
TpCallbackMayRunLong
RtlExecuteUmsThread
TpAllocWork
CsrVerifyRegion
RtlCharToInteger
RtlInitAnsiString
RtlUpcaseUnicodeChar
RtlUnicodeToMultiByteSize
RtlCreateAtomTable
RtlDestroyAtomTable
RtlAddAtomToAtomTable
NtAddAtomEx
RtlLookupAtomInAtomTable
NtFindAtom
RtlDeleteAtomFromAtomTable
NtDeleteAtom
RtlQueryAtomInAtomTable
NtQueryInformationAtom
NtCreateKey
NtFlushKey
_memicmp
wcscspn
wcsncpy_s
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlxUnicodeStringToAnsiSize
RtlDnsHostNameToComputerName
RtlCreateUnicodeStringFromAsciiz
RtlPrefixString
wcsstr
wcschr
NtCreateFile
NtQueryInformationJobObject
NtCreateJobObject
NtOpenJobObject
NtAssignProcessToJobObject
NtTerminateJobObject
RtlAcquirePrivilege
NtSetInformationJobObject
RtlReleasePrivilege
NtCreateJobSet
NtQueryEaFile
NtQuerySecurityObject
RtlLengthSecurityDescriptor
NtSetEaFile
NtSetSecurityObject
NtSetInformationProcess
RtlQueryElevationFlags
NtQuerySection
LdrOpenImageFileOptionsKey
LdrQueryImageFileKeyOption
RtlRaiseStatus
strncpy_s
CsrCaptureMessageString
RtlGetLongestNtPathLength
RtlUnicodeToMultiByteN
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlPrefixUnicodeString
NtEnumerateValueKey
RtlCopyUnicodeString
RtlDosPathNameToNtPathName_U
NtLockFile
NtUnlockFile
NtAllocateVirtualMemory
NtReadFile
RtlIsTextUnicode
NtWriteFile
NtFreeVirtualMemory
RtlEqualString
RtlDosPathNameToRelativeNtPathName_U
RtlReleaseRelativeName
RtlRegisterWait
RtlDeregisterWait
RtlSetIoCompletionCallback
NtQueryVirtualMemory
RtlImageDirectoryEntryToData
NtProtectVirtualMemory
RtlCreateBoundaryDescriptor
RtlGetThreadErrorMode
NtCreateMailslotFile
RtlDestroyQueryDebugBuffer
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
NtQueryDirectoryFile
strcpy_s
RtlFindActivationContextSectionString
LdrSetDllDirectory
RtlSwitchedVVI
LdrFindResource_U
NtGetDevicePowerState
NtPowerInformation
NtQueryWnfStateData
NtSetThreadExecutionState
RtlInitString
NtQuerySystemEnvironmentValueEx
NtSetSystemEnvironmentValueEx
NtSetVolumeInformationFile
NtDeviceIoControlFile
RtlIsValidHandle
RtlSetUserValueHeap
RtlReAllocateHeap
RtlAllocateHandle
RtlFreeHandle
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
strchr
RtlOemStringToUnicodeString
RtlSetEnvironmentStrings
RtlAllocateAndInitializeSid
RtlFreeSid
NtQueryFullAttributesFile
NtQueryAttributesFile
strrchr
RtlQueryEnvironmentVariable_U
wcscat_s
TpCaptureCaller
RtlWow64EnableFsRedirection
_stricmp
NtQueryTimerResolution
NtSetTimerResolution
RtlConvertSidToUnicodeString
RtlGetAppContainerSidType
RtlQueryEnvironmentVariable
RtlGetAppContainerParent
RtlSetEnvironmentVariable
CsrCaptureMessageMultiUnicodeStringsInPlace
wcsnlen
strcat_s
strnlen
NlsMbCodePageTag
RtlRunOnceExecuteOnce
RtlInitializeCriticalSection
RtlGetThreadPreferredUILanguages
NtReadVirtualMemory
LdrResSearchResource
_strnicmp
strncmp
RtlTryAcquirePebLock
RtlReleasePebLock
RtlEncodeSystemPointer
RtlGetNtSystemRoot
NtWaitForMultipleObjects
NtClearEvent
RtlWerpReportException
DbgPrint
RtlGetDeviceFamilyInfoEnum
RtlHashUnicodeString
NtApphelpCacheControl
RtlGetFullPathName_UEx
ZwClose
ZwOpenFile
ZwOpenKey
ZwEnumerateKey
ZwQueryValueKey
ZwCreateFile
ZwQueryInformationFile
ZwCreateSection
ZwQueryDirectoryFile
RtlNtPathNameToDosPathName
RtlGetNativeSystemInformation
ZwQuerySystemInformation
ZwUnmapViewOfSection
ZwMapViewOfSection
VerSetConditionMask
RtlVerifyVersionInfo
RtlGetVersion
RtlGetCurrentServiceSessionId
RtlSetThreadPoolStartFunc
RtlImageNtHeader
NtQuerySystemInformation
RtlFreeHeap
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlAllocateHeap
_wcsicmp
__C_specific_handler
memmove
_local_unwind
cos
floor
memcmp
memcpy
memset
wcscmp
KERNELBASE.dll PrivCopyFileExW
AppXReleaseAppXContext
AreFileApisANSI
CreateProcessInternalA
CreateProcessInternalW
CreateProcessAsUserW
CreateProcessAsUserA
EnumLanguageGroupLocalesW
BaseFormatObjectAttributes
GetVolumeNameForVolumeMountPointW
lstrcmpW
lstrcmpiW
GetRegistryExtensionFlags
KernelBaseGetGlobalData
GlobalFree
LoadStringBaseExW
GetUnicodeStringToEightBitStringRoutine
GetUnicodeStringToEightBitSizeRoutine
CompareStringA
GetNamedPipeAttribute
PackageIdFromFullName
GetPackageFullName
GetCurrentPackageFullName
ClosePackageInfo
AppXGetOSMaxVersionTested
GetPackageTargetPlatformProperty
GetTargetPlatformContext
OpenPackageInfoByFullNameForUser
AppXPreCreationExtension
EnumSystemLanguageGroupsW
AppContainerFreeMemory
AppContainerLookupMoniker
BasepNotifyTrackingService
MoveFileWithProgressTransactedW
BasepAdjustObjectAttributesForPrivateNamespace
GetEightBitStringToUnicodeStringRoutine
GetStringTableEntry
CheckGroupPolicyEnabled
OpenRegKey
InternalLcidToName
NlsIsUserDefaultLocale
GetPtrCalDataArray
GetUserOverrideString
GetPtrCalData
Internal_EnumCalendarInfo
Internal_EnumLanguageGroupLocales
Internal_EnumSystemCodePages
Internal_EnumDateFormats
Internal_EnumUILanguages
Internal_EnumSystemLanguageGroups
NlsValidateLocale
Internal_EnumTimeFormats
GetNamedLocaleHashNode
GetUserOverrideWord
GetLocaleInfoHelper
GetCalendar
BaseDllFreeResourceId
BaseDllMapResourceIdW
CheckAllowDecryptedRemoteDestinationPolicy
EnumSystemLocalesEx
NotifyMountMgr
LCIDToLocaleName
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
GetEraNameCountedString
FatalAppExitW
FatalAppExitA
lstrlenW
lstrlenA
lstrcpynW
lstrcpynA
Sleep
SetFileApisToOEM
SetFileApisToANSI
PulseEvent
MapViewOfFileExNuma
LocalUnlock
LocalReAlloc
LocalLock
LocalAlloc
HeapSummary
GlobalAlloc
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetStringTypeA
GetProcAddressForCaller
BaseGetNamedObjectDirectory
EnumUILanguagesW
AppXPostSuccessExtension
api-ms-win-core-processthreads-l1-1-0.dll ResumeThread
QueueUserAPC
ProcessIdToSessionId
OpenThread
GetStartupInfoW
SetPriorityClass
SetProcessShutdownParameters
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
GetThreadPriorityBoost
GetThreadPriority
GetProcessId
SetThreadPriority
GetProcessIdOfThread
OpenProcessToken
GetExitCodeProcess
GetPriorityClass
CreateProcessA
CreateProcessW
CreateRemoteThreadEx
GetExitCodeThread
SetThreadPriorityBoost
SetThreadStackGuarantee
SuspendThread
SwitchToThread
TlsFree
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateRemoteThread
TerminateProcess
TerminateThread
TlsAlloc
GetProcessVersion
QueryProcessAffinityUpdateMode
SetProcessAffinityUpdateMode
TlsSetValue
GetThreadId
api-ms-win-core-processthreads-l1-1-3.dll SetThreadIdealProcessor
GetProcessInformation
SetProcessInformation
GetProcessShutdownParameters
api-ms-win-core-processthreads-l1-1-2.dll SetThreadInformation
GetProcessPriorityBoost
SetProcessPriorityBoost
GetThreadIOPendingFlag
GetSystemTimes
GetThreadInformation
api-ms-win-core-processthreads-l1-1-1.dll FlushInstructionCache
SetProcessMitigationPolicy
GetProcessHandleCount
GetProcessMitigationPolicy
SetThreadIdealProcessorEx
IsProcessorFeaturePresent
OpenProcess
GetThreadTimes
GetThreadContext
SetThreadContext
GetThreadIdealProcessorEx
api-ms-win-core-registry-l1-1-0.dll RegLoadAppKeyW
RegUnLoadKeyW
RegUnLoadKeyA
RegSetValueExA
RegSetKeySecurity
RegSaveKeyExW
RegSaveKeyExA
RegRestoreKeyW
RegRestoreKeyA
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenUserClassesRoot
RegOpenKeyExA
RegOpenCurrentUser
RegNotifyChangeKeyValue
RegOpenKeyExW
RegGetValueW
RegCloseKey
RegCopyTreeW
RegCreateKeyExA
RegCreateKeyExW
RegDeleteKeyExA
RegDeleteKeyExW
RegDeleteTreeA
RegDeleteTreeW
RegDeleteValueA
RegDeleteValueW
RegDisablePredefinedCacheEx
RegEnumKeyExA
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegFlushKey
RegGetKeySecurity
RegGetValueA
RegLoadMUIStringW
RegLoadMUIStringA
RegLoadKeyW
RegSetValueExW
RegLoadKeyA
api-ms-win-core-heap-l1-1-0.dll HeapUnlock
GetProcessHeaps
HeapCreate
GetProcessHeap
HeapAlloc
HeapDestroy
HeapLock
HeapQueryInformation
HeapFree
HeapValidate
HeapSetInformation
HeapWalk
HeapCompact
HeapReAlloc
api-ms-win-core-heap-l2-1-0.dll LocalFree
api-ms-win-core-memory-l1-1-1.dll QueryMemoryResourceNotification
VirtualLock
VirtualUnlock
GetWriteWatch
SetSystemFileCacheSize
GetProcessWorkingSetSizeEx
GetLargePageMinimum
ResetWriteWatch
CreateMemoryResourceNotification
GetSystemFileCacheSize
CreateFileMappingNumaW
SetProcessWorkingSetSizeEx
api-ms-win-core-memory-l1-1-0.dll VirtualQuery
VirtualProtect
OpenFileMappingW
VirtualFreeEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
VirtualQueryEx
MapViewOfFileEx
WriteProcessMemory
MapViewOfFile
FlushViewOfFile
ReadProcessMemory
CreateFileMappingW
VirtualProtectEx
VirtualAllocEx
api-ms-win-core-memory-l1-1-2.dll RegisterBadMemoryNotification
AllocateUserPhysicalPagesNuma
GetMemoryErrorHandlingCapabilities
FreeUserPhysicalPages
VirtualAllocExNuma
UnregisterBadMemoryNotification
AllocateUserPhysicalPages
MapUserPhysicalPages
api-ms-win-core-handle-l1-1-0.dll GetHandleInformation
DuplicateHandle
CloseHandle
SetHandleInformation
api-ms-win-core-synch-l1-1-0.dll CreateMutexExW
CreateMutexW
CreateSemaphoreExW
CreateWaitableTimerExW
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
OpenEventA
OpenEventW
OpenMutexW
OpenSemaphoreW
OpenWaitableTimerW
ReleaseMutex
CreateMutexA
CreateEventW
CreateEventExW
CreateEventExA
CreateEventA
CancelWaitableTimer
DeleteCriticalSection
LeaveCriticalSection
CreateMutexExA
ReleaseSemaphore
ResetEvent
SetEvent
SetWaitableTimer
SleepEx
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
EnterCriticalSection
InitializeCriticalSection
api-ms-win-core-synch-l1-2-1.dll WaitForMultipleObjects
CreateSemaphoreW
api-ms-win-core-synch-l1-2-0.dll InitOnceExecuteOnce
SignalObjectAndWait
EnterSynchronizationBarrier
InitializeSynchronizationBarrier
DeleteSynchronizationBarrier
api-ms-win-core-file-l1-1-0.dll FindNextChangeNotification
FindFirstVolumeW
FindFirstFileW
FindFirstFileExW
FindFirstFileExA
FindFirstFileA
LockFile
LockFileEx
QueryDosDeviceW
FindFirstChangeNotificationW
FindFirstChangeNotificationA
LocalFileTimeToFileTime
GetVolumePathNameW
GetVolumeInformationW
GetVolumeInformationByHandleW
GetTempFileNameW
GetLogicalDriveStringsW
GetFullPathNameW
GetFullPathNameA
GetFinalPathNameByHandleW
GetFinalPathNameByHandleA
GetFileType
GetFileTime
GetFileSizeEx
GetFileSize
GetFileInformationByHandle
GetFileAttributesW
GetFileAttributesExW
GetFileAttributesExA
CompareFileTime
FindNextFileA
CreateDirectoryW
CreateFileA
CreateFileW
DefineDosDeviceW
DeleteFileA
ReadFile
ReadFileEx
ReadFileScatter
RemoveDirectoryA
RemoveDirectoryW
SetEndOfFile
SetFileAttributesA
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
UnlockFile
UnlockFileEx
WriteFile
WriteFileEx
WriteFileGather
DeleteFileW
DeleteVolumeMountPointW
FileTimeToLocalFileTime
FindClose
FindCloseChangeNotification
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetFileAttributesA
GetDiskFreeSpaceExW
GetDriveTypeW
GetDiskFreeSpaceW
CreateDirectoryA
GetDriveTypeA
api-ms-win-core-file-l1-2-0.dll CreateFile2
GetTempPathW
GetVolumePathNamesForVolumeNameW
api-ms-win-core-file-l1-2-2.dll FindFirstFileNameW
FindNextFileNameW
GetVolumeInformationA
GetTempFileNameA
GetTempPathA
FindFirstStreamW
api-ms-win-core-file-l1-2-1.dll GetCompressedFileSizeA
GetCompressedFileSizeW
SetFileIoOverlappedRange
api-ms-win-core-delayload-l1-1-0.dll DelayLoadFailureHook
api-ms-win-core-io-l1-1-0.dll DeviceIoControl
CancelIoEx
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
GetOverlappedResult
GetQueuedCompletionStatus
api-ms-win-core-io-l1-1-1.dll CancelIo
CancelSynchronousIo
api-ms-win-core-job-l1-1-0.dll IsProcessInJob
api-ms-win-core-threadpool-legacy-l1-1-0.dll UnregisterWaitEx
DeleteTimerQueueEx
QueueUserWorkItem
DeleteTimerQueueTimer
CreateTimerQueue
CreateTimerQueueTimer
ChangeTimerQueueTimer
api-ms-win-core-threadpool-private-l1-1-0.dll RegisterWaitForSingleObjectEx
api-ms-win-core-largeinteger-l1-1-0.dll MulDiv
api-ms-win-core-libraryloader-l1-2-2.dll EnumResourceNamesW
api-ms-win-core-libraryloader-l1-2-0.dll GetProcAddress
FreeLibrary
EnumResourceTypesExW
EnumResourceTypesExA
EnumResourceNamesExA
EnumResourceLanguagesExW
EnumResourceLanguagesExA
FreeLibraryAndExitThread
DisableThreadLibraryCalls
EnumResourceNamesExW
FindResourceExW
GetModuleFileNameA
FindStringOrdinal
FreeResource
SizeofResource
LockResource
LoadResource
LoadLibraryExA
LoadLibraryExW
GetModuleHandleExW
GetModuleHandleExA
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
api-ms-win-core-libraryloader-l1-2-1.dll LoadLibraryW
FindResourceW
LoadLibraryA
api-ms-win-core-libraryloader-l2-1-0.dll LoadPackagedLibrary
api-ms-win-core-namedpipe-l1-2-2.dll CallNamedPipeW
api-ms-win-core-namedpipe-l1-1-0.dll WaitNamedPipeW
DisconnectNamedPipe
CreatePipe
CreateNamedPipeW
ConnectNamedPipe
PeekNamedPipe
TransactNamedPipe
GetNamedPipeClientComputerNameW
SetNamedPipeHandleState
api-ms-win-core-namedpipe-l1-2-1.dll GetNamedPipeHandleStateW
api-ms-win-core-datetime-l1-1-0.dll GetTimeFormatW
GetDateFormatW
GetTimeFormatA
GetDateFormatA
api-ms-win-core-datetime-l1-1-1.dll GetDateFormatEx
GetTimeFormatEx
api-ms-win-core-datetime-l1-1-2.dll GetDurationFormatEx
api-ms-win-core-sysinfo-l1-2-0.dll EnumSystemFirmwareTables
GetSystemTimePreciseAsFileTime
GetProductInfo
SetComputerNameExW
SetSystemTime
GetSystemFirmwareTable
GetNativeSystemInfo
api-ms-win-core-sysinfo-l1-1-0.dll SetLocalTime
GetLogicalProcessorInformation
GetTickCount
GlobalMemoryStatusEx
GetWindowsDirectoryW
GetWindowsDirectoryA
GetVersionExW
GetVersionExA
GetVersion
GetSystemTimeAsFileTime
GetSystemTimeAdjustment
GetLogicalProcessorInformationEx
GetSystemInfo
GetSystemTime
GetComputerNameExA
GetLocalTime
GetComputerNameExW
api-ms-win-core-sysinfo-l1-2-3.dll SetComputerNameExA
SetComputerNameW
SetComputerNameA
api-ms-win-core-sysinfo-l1-2-1.dll DnsHostnameToComputerNameExW
GetPhysicallyInstalledSystemMemory
SetComputerNameEx2W
api-ms-win-core-timezone-l1-1-0.dll GetDynamicTimeZoneInformation
TzSpecificLocalTimeToSystemTime
SetDynamicTimeZoneInformation
SystemTimeToFileTime
GetTimeZoneInformationForYear
GetTimeZoneInformation
FileTimeToSystemTime
SetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
api-ms-win-core-localization-l1-2-0.dll GetSystemPreferredUILanguages
GetThreadPreferredUILanguages
SetThreadLocale
ConvertDefaultLocale
VerLanguageNameW
SetProcessPreferredUILanguages
GetThreadUILanguage
GetUILanguageInfo
FindNLSString
IdnToAscii
IdnToUnicode
IsValidLocaleName
LCMapStringEx
GetFileMUIInfo
GetLocaleInfoA
GetFileMUIPath
GetLocaleInfoW
GetNLSVersionEx
GetOEMCP
GetProcessPreferredUILanguages
GetUserPreferredUILanguages
GetSystemDefaultLangID
GetLocaleInfoEx
SetThreadUILanguage
SetThreadPreferredUILanguages
IsValidNLSVersion
GetNLSVersion
GetSystemDefaultLCID
GetThreadLocale
GetUserDefaultLangID
GetUserDefaultLCID
IsDBCSLeadByte
IsDBCSLeadByteEx
IsNLSDefinedString
IsValidCodePage
IsValidLanguageGroup
IsValidLocale
LCMapStringA
LCMapStringW
SetCalendarInfoW
SetLocaleInfoW
VerLanguageNameA
GetCPInfoExW
ResolveLocaleName
LocaleNameToLCID
GetCPInfo
GetACP
FormatMessageW
FormatMessageA
EnumSystemLocalesW
EnumSystemLocalesA
GetCalendarInfoW
GetCalendarInfoEx
FindNLSStringEx
api-ms-win-core-processsnapshot-l1-1-0.dll PssWalkMarkerSeekToBeginning
PssWalkMarkerSetPosition
PssQuerySnapshot
PssWalkMarkerFree
PssWalkMarkerCreate
PssDuplicateSnapshot
PssWalkSnapshot
PssCaptureSnapshot
PssFreeSnapshot
PssWalkMarkerGetPosition
api-ms-win-core-processenvironment-l1-1-0.dll GetEnvironmentStringsW
GetCurrentDirectoryW
GetCurrentDirectoryA
GetCommandLineW
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEnvironmentVariableA
GetEnvironmentVariableA
SetStdHandle
SetStdHandleEx
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
FreeEnvironmentStringsA
GetStdHandle
GetEnvironmentVariableW
SearchPathW
GetEnvironmentStrings
FreeEnvironmentStringsW
GetCommandLineA
SetEnvironmentVariableW
SetEnvironmentStringsW
api-ms-win-core-processenvironment-l1-2-0.dll NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathW
SearchPathA
api-ms-win-core-string-l1-1-0.dll CompareStringOrdinal
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
GetStringTypeExW
FoldStringW
CompareStringW
CompareStringEx
api-ms-win-core-debug-l1-1-1.dll DebugActiveProcess
WaitForDebugEvent
ContinueDebugEvent
CheckRemoteDebuggerPresent
DebugActiveProcessStop
api-ms-win-core-debug-l1-1-0.dll OutputDebugStringA
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-errorhandling-l1-1-0.dll SetLastError
GetLastError
GetErrorMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetErrorMode
RaiseException
api-ms-win-core-errorhandling-l1-1-3.dll SetThreadErrorMode
GetThreadErrorMode
api-ms-win-core-fibers-l1-1-0.dll FlsAlloc
FlsSetValue
FlsGetValue
FlsFree
api-ms-win-core-util-l1-1-0.dll Beep
api-ms-win-core-profile-l1-1-0.dll QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-security-base-l1-1-0.dll EqualSid
AccessCheck
AllocateAndInitializeSid
FreeSid
DuplicateToken
api-ms-win-security-base-l1-2-0.dll CheckTokenMembershipEx
AddScopedPolicyIDAce
AddResourceAttributeAce
SetCachedSigningLevel
GetCachedSigningLevel
GetAppContainerAce
CheckTokenCapability
api-ms-win-security-appcontainer-l1-1-0.dll GetAppContainerNamedObjectPath
api-ms-win-core-comm-l1-1-0.dll WaitCommEvent
TransmitCommChar
SetupComm
SetCommTimeouts
SetCommState
SetCommMask
SetCommConfig
SetCommBreak
PurgeComm
GetCommTimeouts
GetCommState
GetCommProperties
GetCommModemStatus
GetCommMask
GetCommConfig
EscapeCommFunction
ClearCommError
ClearCommBreak
api-ms-win-core-realtime-l1-1-0.dll QueryProcessCycleTime
QueryIdleProcessorCycleTime
QueryIdleProcessorCycleTimeEx
QueryUnbiasedInterruptTime
QueryThreadCycleTime
api-ms-win-core-wow64-l1-1-1.dll GetSystemWow64Directory2W
IsWow64Process2
GetSystemWow64DirectoryW
GetSystemWow64DirectoryA
api-ms-win-core-wow64-l1-1-0.dll Wow64DisableWow64FsRedirection
IsWow64Process
Wow64RevertWow64FsRedirection
api-ms-win-core-systemtopology-l1-1-1.dll GetNumaProximityNodeEx
api-ms-win-core-systemtopology-l1-1-0.dll GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
api-ms-win-core-processtopology-l1-1-0.dll GetThreadGroupAffinity
SetThreadGroupAffinity
GetProcessGroupAffinity
api-ms-win-core-namespace-l1-1-0.dll DeleteBoundaryDescriptor
ClosePrivateNamespace
CreateBoundaryDescriptorW
OpenPrivateNamespaceW
CreatePrivateNamespaceW
AddSIDToBoundaryDescriptor
api-ms-win-core-file-l2-1-2.dll CopyFileW
CreateHardLinkA
api-ms-win-core-file-l2-1-0.dll ReadDirectoryChangesW
CreateDirectoryExW
MoveFileExW
CopyFile2
GetFileInformationByHandleEx
CopyFileExW
CreateHardLinkW
CreateSymbolicLinkW
MoveFileWithProgressW
ReOpenFile
ReplaceFileW
api-ms-win-core-file-l2-1-3.dll ReadDirectoryChangesExW
api-ms-win-core-file-l2-1-1.dll OpenFileById
api-ms-win-core-xstate-l2-1-0.dll CopyContext
InitializeContext
LocateXStateFeature
GetXStateFeaturesMask
GetEnabledXStateFeatures
SetXStateFeaturesMask
api-ms-win-core-xstate-l2-1-1.dll InitializeContext2
api-ms-win-core-localization-l2-1-0.dll GetCurrencyFormatEx
EnumTimeFormatsEx
EnumDateFormatsExEx
EnumCalendarInfoExEx
EnumTimeFormatsW
EnumSystemCodePagesW
EnumDateFormatsW
EnumCalendarInfoExW
EnumCalendarInfoW
EnumDateFormatsExW
GetNumberFormatEx
api-ms-win-core-normalization-l1-1-0.dll IsNormalizedString
NormalizeString
IdnToNameprepUnicode
GetStringScripts
VerifyScripts
api-ms-win-core-fibers-l2-1-0.dll SwitchToFiber
DeleteFiber
ConvertThreadToFiber
CreateFiber
ConvertFiberToThread
api-ms-win-core-fibers-l2-1-1.dll CreateFiberEx
ConvertThreadToFiberEx
api-ms-win-core-localization-private-l1-1-0.dll NlsUpdateLocale
NlsCheckPolicy
NlsEventDataDescCreate
NlsUpdateSystemLocale
NlsWriteEtwEvent
NlsGetCacheUpdateCount
api-ms-win-core-sidebyside-l1-1-0.dll QueryActCtxSettingsW
QueryActCtxW
GetCurrentActCtx
FindActCtxSectionStringW
FindActCtxSectionGuid
DeactivateActCtx
CreateActCtxW
ZombifyActCtx
AddRefActCtx
ReleaseActCtx
ActivateActCtx
api-ms-win-core-appcompat-l1-1-0.dll BaseCheckAppcompatCache
BaseCheckAppcompatCacheEx
BaseCleanupAppcompatCacheSupport
BaseInitAppcompatCacheSupport
BaseDumpAppcompatCache
BaseFlushAppcompatCache
BaseUpdateAppcompatCache
api-ms-win-core-windowserrorreporting-l1-1-0.dll GetApplicationRestartSettings
WerUnregisterMemoryBlock
GetApplicationRecoveryCallback
WerRegisterMemoryBlock
WerUnregisterRuntimeExceptionModule
WerRegisterRuntimeExceptionModule
WerUnregisterFile
WerRegisterFile
api-ms-win-core-windowserrorreporting-l1-1-1.dll WerUnregisterAdditionalProcess
WerRegisterAdditionalProcess
WerUnregisterExcludedMemoryBlock
WerRegisterExcludedMemoryBlock
WerRegisterCustomMetadata
WerUnregisterCustomMetadata
api-ms-win-core-windowserrorreporting-l1-1-2.dll WerRegisterAppLocalDump
WerUnregisterAppLocalDump
api-ms-win-core-console-l1-1-0.dll AllocConsole
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetNumberOfConsoleInputEvents
ReadConsoleA
ReadConsoleInputA
ReadConsoleInputW
ReadConsoleW
SetConsoleCtrlHandler
SetConsoleMode
WriteConsoleA
WriteConsoleW
api-ms-win-core-console-l1-2-0.dll PeekConsoleInputA
FreeConsole
AttachConsole
PeekConsoleInputW
api-ms-win-core-console-l1-2-1.dll ResizePseudoConsole
CreatePseudoConsole
ClosePseudoConsole
api-ms-win-core-console-l2-1-0.dll GetConsoleCursorInfo
SetConsoleScreenBufferInfoEx
GenerateConsoleCtrlEvent
FlushConsoleInputBuffer
SetConsoleOutputCP
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
SetConsoleCursorPosition
GetLargestConsoleWindowSize
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
CreateConsoleScreenBuffer
SetConsoleCursorInfo
ReadConsoleOutputA
ReadConsoleOutputAttribute
ReadConsoleOutputCharacterA
ReadConsoleOutputCharacterW
ReadConsoleOutputW
ScrollConsoleScreenBufferA
ScrollConsoleScreenBufferW
SetConsoleActiveScreenBuffer
GetConsoleScreenBufferInfoEx
SetConsoleScreenBufferSize
WriteConsoleOutputW
WriteConsoleOutputCharacterW
WriteConsoleOutputCharacterA
WriteConsoleOutputAttribute
WriteConsoleOutputA
WriteConsoleInputW
WriteConsoleInputA
SetConsoleWindowInfo
SetConsoleTextAttribute
SetConsoleCP
api-ms-win-core-console-l2-2-0.dll GetConsoleOriginalTitleA
GetConsoleOriginalTitleW
GetConsoleTitleA
GetConsoleTitleW
SetConsoleTitleW
SetConsoleTitleA
api-ms-win-core-console-l3-2-0.dll GetConsoleCommandHistoryLengthA
GetConsoleCommandHistoryA
GetConsoleAliasesW
GetConsoleAliasesLengthW
GetConsoleAliasesLengthA
GetConsoleAliasesA
GetConsoleAliasW
GetConsoleAliasExesW
GetConsoleAliasExesLengthW
GetConsoleAliasExesLengthA
GetConsoleAliasExesA
GetConsoleAliasA
ExpungeConsoleCommandHistoryW
ExpungeConsoleCommandHistoryA
AddConsoleAliasW
AddConsoleAliasA
GetConsoleHistoryInfo
GetConsoleCommandHistoryW
GetConsoleDisplayMode
GetConsoleFontSize
GetConsoleProcessList
GetConsoleSelectionInfo
GetConsoleWindow
GetCurrentConsoleFont
GetCurrentConsoleFontEx
GetNumberOfConsoleMouseButtons
SetConsoleDisplayMode
SetConsoleHistoryInfo
SetConsoleNumberOfCommandsA
SetConsoleNumberOfCommandsW
SetCurrentConsoleFontEx
GetConsoleCommandHistoryLengthW
api-ms-win-core-psapi-l1-1-0.dll K32EnumProcessModules
K32GetModuleFileNameExW
K32EnumDeviceDrivers
K32EnumProcesses
K32GetWsChanges
K32GetDeviceDriverBaseNameW
K32GetProcessMemoryInfo
K32GetModuleInformation
K32GetPerformanceInfo
K32EnumProcessModulesEx
K32GetModuleBaseNameW
K32GetProcessImageFileNameW
QueryFullProcessImageNameW
K32EnumPageFilesW
K32GetDeviceDriverFileNameW
K32EmptyWorkingSet
K32QueryWorkingSet
K32GetMappedFileNameW
K32QueryWorkingSetEx
K32InitializeProcessForWsWatch
K32GetWsChangesEx
api-ms-win-core-psapi-ansi-l1-1-0.dll K32GetMappedFileNameA
K32GetModuleBaseNameA
K32GetDeviceDriverBaseNameA
K32GetDeviceDriverFileNameA
K32EnumPageFilesA
K32GetProcessImageFileNameA
QueryFullProcessImageNameA
K32GetModuleFileNameExA
api-ms-win-eventing-provider-l1-1-0.dll EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
api-ms-win-core-appcompat-l1-1-1.dll BaseFreeAppCompatDataForProcess
BaseReadAppCompatDataForProcess

Delayed Imports

AcquireSRWLockExclusive

Ordinal 1
Address 0x9417f
ForwardName NTDLL.RtlAcquireSRWLockExclusive

AcquireSRWLockShared

Ordinal 2
Address 0x941b5
ForwardName NTDLL.RtlAcquireSRWLockShared

ActivateActCtx

Ordinal 3
Address 0x1e860

ActivateActCtxWorker

Ordinal 4
Address 0x1a570

AddAtomA

Ordinal 5
Address 0x21a70

AddAtomW

Ordinal 6
Address 0xfe30

AddConsoleAliasA

Ordinal 7
Address 0x22de0

AddConsoleAliasW

Ordinal 8
Address 0x22df0

AddDllDirectory

Ordinal 9
Address 0x9423b
ForwardName api-ms-win-core-libraryloader-l1-1-0.AddDllDirectory

AddIntegrityLabelToBoundaryDescriptor

Ordinal 10
Address 0x375a0

AddLocalAlternateComputerNameA

Ordinal 11
Address 0x53150

AddLocalAlternateComputerNameW

Ordinal 12
Address 0x531b0

AddRefActCtx

Ordinal 13
Address 0x20570

AddRefActCtxWorker

Ordinal 14
Address 0x1e3c0

AddResourceAttributeAce

Ordinal 15
Address 0x35fb0

AddSIDToBoundaryDescriptor

Ordinal 16
Address 0x1f3c0

AddScopedPolicyIDAce

Ordinal 17
Address 0x35fc0

AddSecureMemoryCacheCallback

Ordinal 18
Address 0x34600

AddVectoredContinueHandler

Ordinal 19
Address 0x94374
ForwardName NTDLL.RtlAddVectoredContinueHandler

AddVectoredExceptionHandler

Ordinal 20
Address 0x943b4
ForwardName NTDLL.RtlAddVectoredExceptionHandler

AdjustCalendarDate

Ordinal 21
Address 0x1a6b0

AllocConsole

Ordinal 22
Address 0x22a30

AllocateUserPhysicalPages

Ordinal 23
Address 0x35fe0

AllocateUserPhysicalPagesNuma

Ordinal 24
Address 0x35fd0

AppPolicyGetClrCompat

Ordinal 25
Address 0x94447
ForwardName kernelbase.AppPolicyGetClrCompat

AppPolicyGetCreateFileAccess

Ordinal 26
Address 0x94485
ForwardName kernelbase.AppPolicyGetCreateFileAccess

AppPolicyGetLifecycleManagement

Ordinal 27
Address 0x944cd
ForwardName kernelbase.AppPolicyGetLifecycleManagement

AppPolicyGetMediaFoundationCodecLoading

Ordinal 28
Address 0x94520
ForwardName kernelbase.AppPolicyGetMediaFoundationCodecLoading

AppPolicyGetProcessTerminationMethod

Ordinal 29
Address 0x94578
ForwardName kernelbase.AppPolicyGetProcessTerminationMethod

AppPolicyGetShowDeveloperDiagnostic

Ordinal 30
Address 0x945cc
ForwardName kernelbase.AppPolicyGetShowDeveloperDiagnostic

AppPolicyGetThreadInitializationType

Ordinal 31
Address 0x94620
ForwardName kernelbase.AppPolicyGetThreadInitializationType

AppPolicyGetWindowingModel

Ordinal 32
Address 0x9466b
ForwardName kernelbase.AppPolicyGetWindowingModel

AppXGetOSMaxVersionTested

Ordinal 33
Address 0x946ab
ForwardName kernelbase.AppXGetOSMaxVersionTested

ApplicationRecoveryFinished

Ordinal 34
Address 0x3de90

ApplicationRecoveryInProgress

Ordinal 35
Address 0x3dea0

AreFileApisANSI

Ordinal 36
Address 0x1f970

AssignProcessToJobObject

Ordinal 37
Address 0x1e4f0

AttachConsole

Ordinal 38
Address 0x22a40

BackupRead

Ordinal 39
Address 0x55970

BackupSeek

Ordinal 40
Address 0x569f0

BackupWrite

Ordinal 41
Address 0x56cc0

BaseCheckAppcompatCache

Ordinal 42
Address 0x36050

BaseCheckAppcompatCacheEx

Ordinal 43
Address 0x35ff0

BaseCheckAppcompatCacheExWorker

Ordinal 44
Address 0x1fa30

BaseCheckAppcompatCacheWorker

Ordinal 45
Address 0x1fa30

BaseCheckElevation

Ordinal 46
Address 0x1e30

BaseCleanupAppcompatCacheSupport

Ordinal 47
Address 0x36060

BaseCleanupAppcompatCacheSupportWorker

Ordinal 48
Address 0x1fd40

BaseDestroyVDMEnvironment

Ordinal 49
Address 0x3ab40

BaseDllReadWriteIniFile

Ordinal 50
Address 0x7c00

BaseDumpAppcompatCache

Ordinal 51
Address 0x36070

BaseDumpAppcompatCacheWorker

Ordinal 52
Address 0x234c0

BaseElevationPostProcessing

Ordinal 53
Address 0x1c9d0

BaseFlushAppcompatCache

Ordinal 54
Address 0x36080

BaseFlushAppcompatCacheWorker

Ordinal 55
Address 0x67cc0

BaseFormatObjectAttributes

Ordinal 56
Address 0x22000

BaseFormatTimeOut

Ordinal 57
Address 0x52990

BaseFreeAppCompatDataForProcessWorker

Ordinal 58
Address 0x1ec30

BaseGenerateAppCompatData

Ordinal 59
Address 0x175d0

BaseGetNamedObjectDirectory

Ordinal 60
Address 0x36090

BaseInitAppcompatCacheSupport

Ordinal 61
Address 0x360a0

BaseInitAppcompatCacheSupportWorker

Ordinal 62
Address 0x1fd40

BaseIsAppcompatInfrastructureDisabled

Ordinal 63
Address 0x1fa30

BaseIsAppcompatInfrastructureDisabledWorker

Ordinal 64
Address 0x1fa30

BaseIsDosApplication

Ordinal 65
Address 0x59590

BaseQueryModuleData

Ordinal 66
Address 0x680c0

BaseReadAppCompatDataForProcessWorker

Ordinal 67
Address 0x1e9a0

BaseSetLastNTError

Ordinal 68
Address 0x10570

BaseThreadInitThunk

Ordinal 69
Address 0x17960

BaseUpdateAppcompatCache

Ordinal 70
Address 0x360b0

BaseUpdateAppcompatCacheWorker

Ordinal 71
Address 0x67d20

BaseUpdateVDMEntry

Ordinal 72
Address 0x3ae50

BaseVerifyUnicodeString

Ordinal 73
Address 0x52a20

BaseWriteErrorElevationRequiredEvent

Ordinal 74
Address 0x57e80

Basep8BitStringToDynamicUnicodeString

Ordinal 75
Address 0x1b610

BasepAllocateActivationContextActivationBlock

Ordinal 76
Address 0x52a80

BasepAnsiStringToDynamicUnicodeString

Ordinal 77
Address 0x529c0

BasepAppContainerEnvironmentExtension

Ordinal 78
Address 0x18660

BasepAppXExtension

Ordinal 79
Address 0x1ee80

BasepCheckAppCompat

Ordinal 80
Address 0x23c0

BasepCheckWebBladeHashes

Ordinal 81
Address 0x1c600

BasepCheckWinSaferRestrictions

Ordinal 82
Address 0xc790

BasepConstructSxsCreateProcessMessage

Ordinal 83
Address 0x9f20

BasepCopyEncryption

Ordinal 84
Address 0x34150

BasepFreeActivationContextActivationBlock

Ordinal 85
Address 0x52bf0

BasepFreeAppCompatData

Ordinal 86
Address 0x1b6c0

BasepGetAppCompatData

Ordinal 87
Address 0x16c50

BasepGetComputerNameFromNtPath

Ordinal 88
Address 0x1d940

BasepGetExeArchType

Ordinal 89
Address 0x2c10

BasepInitAppCompatData

Ordinal 90
Address 0x67df0

BasepIsProcessAllowed

Ordinal 91
Address 0x1b7f0

BasepMapModuleHandle

Ordinal 92
Address 0xf480

BasepNotifyLoadStringResource

Ordinal 93
Address 0x1a5e0

BasepPostSuccessAppXExtension

Ordinal 94
Address 0x1fa10

BasepProcessInvalidImage

Ordinal 95
Address 0x350d0

BasepQueryAppCompat

Ordinal 96
Address 0x90c0

BasepQueryModuleChpeSettings

Ordinal 97
Address 0x67e80

BasepReleaseAppXContext

Ordinal 98
Address 0x1fa00

BasepReleaseSxsCreateProcessUtilityStruct

Ordinal 99
Address 0xe3e0

BasepReportFault

Ordinal 100
Address 0x3e150

BasepSetFileEncryptionCompression

Ordinal 101
Address 0x1ddf0

Beep

Ordinal 102
Address 0x33640

BeginUpdateResourceA

Ordinal 103
Address 0x439d0

BeginUpdateResourceW

Ordinal 104
Address 0x43a30

BindIoCompletionCallback

Ordinal 105
Address 0x219e0

BuildCommDCBA

Ordinal 106
Address 0x3c7f0

BuildCommDCBAndTimeoutsA

Ordinal 107
Address 0x3c820

BuildCommDCBAndTimeoutsW

Ordinal 108
Address 0x3c850

BuildCommDCBW

Ordinal 109
Address 0x3c8c0

CallNamedPipeA

Ordinal 110
Address 0x59d10

CallNamedPipeW

Ordinal 111
Address 0x227d0

CallbackMayRunLong

Ordinal 112
Address 0x360c0

CancelDeviceWakeupRequest

Ordinal 113
Address 0x35020

CancelIo

Ordinal 114
Address 0x1fd30

CancelIoEx

Ordinal 115
Address 0x1e810

CancelSynchronousIo

Ordinal 116
Address 0x360f0

CancelThreadpoolIo

Ordinal 117
Address 0x94f1d
ForwardName NTDLL.TpCancelAsyncIoOperation

CancelTimerQueueTimer

Ordinal 118
Address 0x3e0d0

CancelWaitableTimer

Ordinal 119
Address 0x220c0

CeipIsOptedIn

Ordinal 120
Address 0x94f74
ForwardName kernelbase.CeipIsOptedIn

ChangeTimerQueueTimer

Ordinal 121
Address 0x1fc90

CheckAllowDecryptedRemoteDestinationPolicy

Ordinal 122
Address 0x36100

CheckElevation

Ordinal 123
Address 0x1d00

CheckElevationEnabled

Ordinal 124
Address 0x1ef60

CheckForReadOnlyResource

Ordinal 125
Address 0x5a1a0

CheckForReadOnlyResourceFilter

Ordinal 126
Address 0x375d0

CheckNameLegalDOS8Dot3A

Ordinal 127
Address 0x34e50

CheckNameLegalDOS8Dot3W

Ordinal 128
Address 0x34ef0

CheckRemoteDebuggerPresent

Ordinal 129
Address 0x1390

CheckTokenCapability

Ordinal 130
Address 0x36110

CheckTokenMembershipEx

Ordinal 131
Address 0x36120

ClearCommBreak

Ordinal 132
Address 0x22830

ClearCommError

Ordinal 133
Address 0x22840

CloseConsoleHandle

Ordinal 134
Address 0x615d0

CloseHandle

Ordinal 135
Address 0x22080

ClosePackageInfo

Ordinal 136
Address 0x950f0
ForwardName kernelbase.ClosePackageInfo

ClosePrivateNamespace

Ordinal 137
Address 0x20510

CloseProfileUserMapping

Ordinal 138
Address 0x1fd40

ClosePseudoConsole

Ordinal 139
Address 0x22a50

CloseState

Ordinal 140
Address 0x95158
ForwardName kernelbase.CloseState

CloseThreadpool

Ordinal 141
Address 0x9517e
ForwardName NTDLL.TpReleasePool

CloseThreadpoolCleanupGroup

Ordinal 142
Address 0x951ae
ForwardName NTDLL.TpReleaseCleanupGroup

CloseThreadpoolCleanupGroupMembers

Ordinal 143
Address 0x951ed
ForwardName NTDLL.TpReleaseCleanupGroupMembers

CloseThreadpoolIo

Ordinal 144
Address 0x95222
ForwardName NTDLL.TpReleaseIoCompletion

CloseThreadpoolTimer

Ordinal 145
Address 0x95253
ForwardName NTDLL.TpReleaseTimer

CloseThreadpoolWait

Ordinal 146
Address 0x9527c
ForwardName NTDLL.TpReleaseWait

CloseThreadpoolWork

Ordinal 147
Address 0x952a4
ForwardName NTDLL.TpReleaseWork

CmdBatNotification

Ordinal 148
Address 0x1ed50

CommConfigDialogA

Ordinal 149
Address 0x38330

CommConfigDialogW

Ordinal 150
Address 0x383c0

CompareCalendarDates

Ordinal 151
Address 0x442e0

CompareFileTime

Ordinal 152
Address 0x222b0

CompareStringA

Ordinal 153
Address 0x1d420

CompareStringEx

Ordinal 154
Address 0x15820

CompareStringOrdinal

Ordinal 155
Address 0x16c40

CompareStringW

Ordinal 156
Address 0x1a520

ConnectNamedPipe

Ordinal 157
Address 0x1f9b0

ConsoleMenuControl

Ordinal 158
Address 0x616e0

ContinueDebugEvent

Ordinal 159
Address 0x36130

ConvertCalDateTimeToSystemTime

Ordinal 160
Address 0x44390

ConvertDefaultLocale

Ordinal 161
Address 0x36140

ConvertFiberToThread

Ordinal 162
Address 0x22980

ConvertNLSDayOfWeekToWin32DayOfWeek

Ordinal 163
Address 0x44480

ConvertSystemTimeToCalDateTime

Ordinal 164
Address 0x1a940

ConvertThreadToFiber

Ordinal 165
Address 0x22990

ConvertThreadToFiberEx

Ordinal 166
Address 0x229a0

CopyContext

Ordinal 167
Address 0x36150

CopyFile2

Ordinal 168
Address 0x36160

CopyFileA

Ordinal 169
Address 0x5a4b0

CopyFileExA

Ordinal 170
Address 0x5a540

CopyFileExW

Ordinal 171
Address 0x1f1c0

CopyFileTransactedA

Ordinal 172
Address 0x5a5f0

CopyFileTransactedW

Ordinal 173
Address 0x5a6c0

CopyFileW

Ordinal 174
Address 0x22970

CopyLZFile

Ordinal 175
Address 0x337c0

CreateActCtxA

Ordinal 176
Address 0x20140

CreateActCtxW

Ordinal 177
Address 0x1fb70

CreateActCtxWWorker

Ordinal 178
Address 0xcde0

CreateBoundaryDescriptorA

Ordinal 179
Address 0x5a350

CreateBoundaryDescriptorW

Ordinal 180
Address 0x1f390

CreateConsoleScreenBuffer

Ordinal 181
Address 0x22b70

CreateDirectoryA

Ordinal 182
Address 0x222c0

CreateDirectoryExA

Ordinal 183
Address 0x5b000

CreateDirectoryExW

Ordinal 184
Address 0x36170

CreateDirectoryTransactedA

Ordinal 185
Address 0x33ae0

CreateDirectoryTransactedW

Ordinal 186
Address 0x5b080

CreateDirectoryW

Ordinal 187
Address 0x222d0

CreateEnclave

Ordinal 188
Address 0x955c5
ForwardName api-ms-win-core-enclave-l1-1-0.CreateEnclave

CreateEventA

Ordinal 189
Address 0x220d0

CreateEventExA

Ordinal 190
Address 0x220e0

CreateEventExW

Ordinal 191
Address 0x220f0

CreateEventW

Ordinal 192
Address 0x22100

CreateFiber

Ordinal 193
Address 0x229b0

CreateFiberEx

Ordinal 194
Address 0x229c0

CreateFile2

Ordinal 195
Address 0x222e0

CreateFileA

Ordinal 196
Address 0x222f0

CreateFileMappingA

Ordinal 197
Address 0x1b280

CreateFileMappingFromApp

Ordinal 198
Address 0x95688
ForwardName api-ms-win-core-memory-l1-1-1.CreateFileMappingFromApp

CreateFileMappingNumaA

Ordinal 199
Address 0x5b1f0

CreateFileMappingNumaW

Ordinal 200
Address 0x36180

CreateFileMappingW

Ordinal 201
Address 0x1c0c0

CreateFileTransactedA

Ordinal 202
Address 0x5a7a0

CreateFileTransactedW

Ordinal 203
Address 0x5a860

CreateFileW

Ordinal 204
Address 0x22300

CreateHardLinkA

Ordinal 205
Address 0x36190

CreateHardLinkTransactedA

Ordinal 206
Address 0x3d8e0

CreateHardLinkTransactedW

Ordinal 207
Address 0x5b2b0

CreateHardLinkW

Ordinal 208
Address 0x21a20

CreateIoCompletionPort

Ordinal 209
Address 0x1ce30

CreateJobObjectA

Ordinal 210
Address 0x54e30

CreateJobObjectW

Ordinal 211
Address 0x1ca80

CreateJobSet

Ordinal 212
Address 0x54ea0

CreateMailslotA

Ordinal 213
Address 0x1b410

CreateMailslotW

Ordinal 214
Address 0x1b480

CreateMemoryResourceNotification

Ordinal 215
Address 0x1f3e0

CreateMutexA

Ordinal 216
Address 0x22110

CreateMutexExA

Ordinal 217
Address 0x22120

CreateMutexExW

Ordinal 218
Address 0x22130

CreateMutexW

Ordinal 219
Address 0x22140

CreateNamedPipeA

Ordinal 220
Address 0x59da0

CreateNamedPipeW

Ordinal 221
Address 0x1ec00

CreatePipe

Ordinal 222
Address 0x1f210

CreatePrivateNamespaceA

Ordinal 223
Address 0x5a3b0

CreatePrivateNamespaceW

Ordinal 224
Address 0x1f370

CreateProcessA

Ordinal 225
Address 0x1c100

CreateProcessAsUserA

Ordinal 226
Address 0x361a0

CreateProcessAsUserW

Ordinal 227
Address 0x1cd40

CreateProcessInternalA

Ordinal 228
Address 0x36210

CreateProcessInternalW

Ordinal 229
Address 0x36290

CreateProcessW

Ordinal 230
Address 0x1c290

CreatePseudoConsole

Ordinal 231
Address 0x22a60

CreateRemoteThread

Ordinal 232
Address 0x36310

CreateRemoteThreadEx

Ordinal 233
Address 0x9595a
ForwardName api-ms-win-core-processthreads-l1-1-0.CreateRemoteThreadEx

CreateSemaphoreA

Ordinal 234
Address 0x1b340

CreateSemaphoreExA

Ordinal 235
Address 0x1b370

CreateSemaphoreExW

Ordinal 236
Address 0x22150

CreateSemaphoreW

Ordinal 237
Address 0x22160

CreateSymbolicLinkA

Ordinal 238
Address 0x5b820

CreateSymbolicLinkTransactedA

Ordinal 239
Address 0x5b8c0

CreateSymbolicLinkTransactedW

Ordinal 240
Address 0x5b970

CreateSymbolicLinkW

Ordinal 241
Address 0x21a60

CreateTapePartition

Ordinal 242
Address 0x3d620

CreateThread

Ordinal 243
Address 0x1a4b0

CreateThreadpool

Ordinal 244
Address 0x1e3d0

CreateThreadpoolCleanupGroup

Ordinal 245
Address 0x1fb40

CreateThreadpoolIo

Ordinal 246
Address 0x1f4a0

CreateThreadpoolTimer

Ordinal 247
Address 0x1b8f0

CreateThreadpoolWait

Ordinal 248
Address 0x1f1d0

CreateThreadpoolWork

Ordinal 249
Address 0x1ca40

CreateTimerQueue

Ordinal 250
Address 0x1fbd0

CreateTimerQueueTimer

Ordinal 251
Address 0x1d390

CreateToolhelp32Snapshot

Ordinal 252
Address 0x236f0

CreateUmsCompletionList

Ordinal 253
Address 0x3c4c0

CreateUmsThreadContext

Ordinal 254
Address 0x3c4f0

CreateWaitableTimerA

Ordinal 255
Address 0x5b4d0

CreateWaitableTimerExA

Ordinal 256
Address 0x5b4f0

CreateWaitableTimerExW

Ordinal 257
Address 0x22170

CreateWaitableTimerW

Ordinal 258
Address 0x12b0

CtrlRoutine

Ordinal 259
Address 0x95bb6
ForwardName kernelbase.CtrlRoutine

DeactivateActCtx

Ordinal 260
Address 0x1e870

DeactivateActCtxWorker

Ordinal 261
Address 0x1b1e0

DebugActiveProcess

Ordinal 262
Address 0x36370

DebugActiveProcessStop

Ordinal 263
Address 0x36360

DebugBreak

Ordinal 264
Address 0x36380

DebugBreakProcess

Ordinal 265
Address 0x339d0

DebugSetProcessKillOnExit

Ordinal 266
Address 0x33a00

DecodePointer

Ordinal 267
Address 0x95c64
ForwardName NTDLL.RtlDecodePointer

DecodeSystemPointer

Ordinal 268
Address 0x95c8f
ForwardName NTDLL.RtlDecodeSystemPointer

DefineDosDeviceA

Ordinal 269
Address 0x5d0e0

DefineDosDeviceW

Ordinal 270
Address 0x22310

DelayLoadFailureHook

Ordinal 271
Address 0x21a40

DeleteAtom

Ordinal 272
Address 0xfd90

DeleteBoundaryDescriptor

Ordinal 273
Address 0x1f380

DeleteCriticalSection

Ordinal 274
Address 0x95d1d
ForwardName NTDLL.RtlDeleteCriticalSection

DeleteFiber

Ordinal 275
Address 0x229d0

DeleteFileA

Ordinal 276
Address 0x22320

DeleteFileTransactedA

Ordinal 277
Address 0x5ba20

DeleteFileTransactedW

Ordinal 278
Address 0x218f0

DeleteFileW

Ordinal 279
Address 0x22330

DeleteProcThreadAttributeList

Ordinal 280
Address 0x95daa
ForwardName api-ms-win-core-processthreads-l1-1-0.DeleteProcThreadAttributeList

DeleteSynchronizationBarrier

Ordinal 281
Address 0x36390

DeleteTimerQueue

Ordinal 282
Address 0x1fba0

DeleteTimerQueueEx

Ordinal 283
Address 0x1fbf0

DeleteTimerQueueTimer

Ordinal 284
Address 0x1ee70

DeleteUmsCompletionList

Ordinal 285
Address 0x3c520

DeleteUmsThreadContext

Ordinal 286
Address 0x3c550

DeleteVolumeMountPointA

Ordinal 287
Address 0x5d350

DeleteVolumeMountPointW

Ordinal 288
Address 0x22340

DequeueUmsCompletionListItems

Ordinal 289
Address 0x3c580

DeviceIoControl

Ordinal 290
Address 0x15290

DisableThreadLibraryCalls

Ordinal 291
Address 0x1ec60

DisableThreadProfiling

Ordinal 292
Address 0x3e180

DisassociateCurrentThreadFromCallback

Ordinal 293
Address 0x95f29
ForwardName NTDLL.TpDisassociateCallback

DiscardVirtualMemory

Ordinal 294
Address 0x95f5b
ForwardName api-ms-win-core-memory-l1-1-2.DiscardVirtualMemory

DisconnectNamedPipe

Ordinal 295
Address 0x20a50

DnsHostnameToComputerNameA

Ordinal 296
Address 0x53ef0

DnsHostnameToComputerNameExW

Ordinal 297
Address 0x363a0

DnsHostnameToComputerNameW

Ordinal 298
Address 0x1d540

DosDateTimeToFileTime

Ordinal 299
Address 0xffb0

DosPathToSessionPathA

Ordinal 300
Address 0x5e4d0

DosPathToSessionPathW

Ordinal 301
Address 0x5e680

DuplicateConsoleHandle

Ordinal 302
Address 0x615e0

DuplicateEncryptionInfoFileExt

Ordinal 303
Address 0x34440

DuplicateHandle

Ordinal 304
Address 0x22090

EnableThreadProfiling

Ordinal 305
Address 0x3e1b0

EncodePointer

Ordinal 306
Address 0x960a1
ForwardName NTDLL.RtlEncodePointer

EncodeSystemPointer

Ordinal 307
Address 0x960cc
ForwardName NTDLL.RtlEncodeSystemPointer

EndUpdateResourceA

Ordinal 308
Address 0x43c40

EndUpdateResourceW

Ordinal 309
Address 0x43c50

EnterCriticalSection

Ordinal 310
Address 0x96124
ForwardName NTDLL.RtlEnterCriticalSection

EnterSynchronizationBarrier

Ordinal 311
Address 0x363b0

EnterUmsSchedulingMode

Ordinal 312
Address 0x3c5d0

EnumCalendarInfoA

Ordinal 313
Address 0x44f20

EnumCalendarInfoExA

Ordinal 314
Address 0x44fb0

EnumCalendarInfoExEx

Ordinal 315
Address 0x1b740

EnumCalendarInfoExW

Ordinal 316
Address 0x363c0

EnumCalendarInfoW

Ordinal 317
Address 0x363d0

EnumDateFormatsA

Ordinal 318
Address 0x45040

EnumDateFormatsExA

Ordinal 319
Address 0x450a0

EnumDateFormatsExEx

Ordinal 320
Address 0x363e0

EnumDateFormatsExW

Ordinal 321
Address 0x363f0

EnumDateFormatsW

Ordinal 322
Address 0x36400

EnumLanguageGroupLocalesA

Ordinal 323
Address 0x45100

EnumLanguageGroupLocalesW

Ordinal 324
Address 0x36410

EnumResourceLanguagesA

Ordinal 325
Address 0x347f0

EnumResourceLanguagesExA

Ordinal 326
Address 0x36420

EnumResourceLanguagesExW

Ordinal 327
Address 0x36440

EnumResourceLanguagesW

Ordinal 328
Address 0x34820

EnumResourceNamesA

Ordinal 329
Address 0x34850

EnumResourceNamesExA

Ordinal 330
Address 0x36460

EnumResourceNamesExW

Ordinal 331
Address 0x36480

EnumResourceNamesW

Ordinal 332
Address 0x227b0

EnumResourceTypesA

Ordinal 333
Address 0x34880

EnumResourceTypesExA

Ordinal 334
Address 0x364a0

EnumResourceTypesExW

Ordinal 335
Address 0x364c0

EnumResourceTypesW

Ordinal 336
Address 0x348a0

EnumSystemCodePagesA

Ordinal 337
Address 0x45120

EnumSystemCodePagesW

Ordinal 338
Address 0x364e0

EnumSystemFirmwareTables

Ordinal 339
Address 0x34630

EnumSystemGeoID

Ordinal 340
Address 0x4d910

EnumSystemGeoNames

Ordinal 341
Address 0x4d9f0

EnumSystemLanguageGroupsA

Ordinal 342
Address 0x45130

EnumSystemLanguageGroupsW

Ordinal 343
Address 0x364f0

EnumSystemLocalesA

Ordinal 344
Address 0x36500

EnumSystemLocalesEx

Ordinal 345
Address 0x36510

EnumSystemLocalesW

Ordinal 346
Address 0x36520

EnumTimeFormatsA

Ordinal 347
Address 0x45140

EnumTimeFormatsEx

Ordinal 348
Address 0x1ee40

EnumTimeFormatsW

Ordinal 349
Address 0x36530

EnumUILanguagesA

Ordinal 350
Address 0x451b0

EnumUILanguagesW

Ordinal 351
Address 0x36540

EnumerateLocalComputerNamesA

Ordinal 352
Address 0x53fd0

EnumerateLocalComputerNamesW

Ordinal 353
Address 0x540e0

EraseTape

Ordinal 354
Address 0x3d680

EscapeCommFunction

Ordinal 355
Address 0x22850

ExecuteUmsThread

Ordinal 356
Address 0x3c600

ExitProcess

Ordinal 357
Address 0x1d620

ExitThread

Ordinal 358
Address 0x9650f
ForwardName NTDLL.RtlExitUserThread

ExitVDM

Ordinal 359
Address 0x3b0c0

ExpandEnvironmentStringsA

Ordinal 360
Address 0x20530

ExpandEnvironmentStringsW

Ordinal 361
Address 0x1b750

ExpungeConsoleCommandHistoryA

Ordinal 362
Address 0x22e00

ExpungeConsoleCommandHistoryW

Ordinal 363
Address 0x22e10

FatalAppExitA

Ordinal 364
Address 0x36550

FatalAppExitW

Ordinal 365
Address 0x36560

FatalExit

Ordinal 366
Address 0x1d620

FileTimeToDosDateTime

Ordinal 367
Address 0x10210

FileTimeToLocalFileTime

Ordinal 368
Address 0x22350

FileTimeToSystemTime

Ordinal 369
Address 0x227f0

FillConsoleOutputAttribute

Ordinal 370
Address 0x22b80

FillConsoleOutputCharacterA

Ordinal 371
Address 0x22b90

FillConsoleOutputCharacterW

Ordinal 372
Address 0x22ba0

FindActCtxSectionGuid

Ordinal 373
Address 0x1c650

FindActCtxSectionGuidWorker

Ordinal 374
Address 0x10430

FindActCtxSectionStringA

Ordinal 375
Address 0x5e7f0

FindActCtxSectionStringW

Ordinal 376
Address 0x1faf0

FindActCtxSectionStringWWorker

Ordinal 377
Address 0xf4e0

FindAtomA

Ordinal 378
Address 0xfe10

FindAtomW

Ordinal 379
Address 0x101f0

FindClose

Ordinal 380
Address 0x22360

FindCloseChangeNotification

Ordinal 381
Address 0x22370

FindFirstChangeNotificationA

Ordinal 382
Address 0x22380

FindFirstChangeNotificationW

Ordinal 383
Address 0x22390

FindFirstFileA

Ordinal 384
Address 0x223a0

FindFirstFileExA

Ordinal 385
Address 0x223b0

FindFirstFileExW

Ordinal 386
Address 0x223c0

FindFirstFileNameTransactedW

Ordinal 387
Address 0x33bd0

FindFirstFileNameW

Ordinal 388
Address 0x223d0

FindFirstFileTransactedA

Ordinal 389
Address 0x33c90

FindFirstFileTransactedW

Ordinal 390
Address 0x5e890

FindFirstFileW

Ordinal 391
Address 0x223e0

FindFirstStreamTransactedW

Ordinal 392
Address 0x33d60

FindFirstStreamW

Ordinal 393
Address 0x96820
ForwardName api-ms-win-core-file-l1-2-2.FindFirstStreamW

FindFirstVolumeA

Ordinal 394
Address 0x5d390

FindFirstVolumeMountPointA

Ordinal 395
Address 0x5d500

FindFirstVolumeMountPointW

Ordinal 396
Address 0x5d6b0

FindFirstVolumeW

Ordinal 397
Address 0x223f0

FindNLSString

Ordinal 398
Address 0x36570

FindNLSStringEx

Ordinal 399
Address 0x15750

FindNextChangeNotification

Ordinal 400
Address 0x22400

FindNextFileA

Ordinal 401
Address 0x22410

FindNextFileNameW

Ordinal 402
Address 0x22420

FindNextFileW

Ordinal 403
Address 0x22430

FindNextStreamW

Ordinal 404
Address 0x9691c
ForwardName api-ms-win-core-file-l1-2-2.FindNextStreamW

FindNextVolumeA

Ordinal 405
Address 0x5d8e0

FindNextVolumeMountPointA

Ordinal 406
Address 0x5da50

FindNextVolumeMountPointW

Ordinal 407
Address 0x5e080

FindNextVolumeW

Ordinal 408
Address 0x22440

FindPackagesByPackageFamily

Ordinal 409
Address 0x969b8
ForwardName kernelbase.FindPackagesByPackageFamily

FindResourceA

Ordinal 410
Address 0xf2a0

FindResourceExA

Ordinal 411
Address 0xf2c0

FindResourceExW

Ordinal 412
Address 0x1b1d0

FindResourceW

Ordinal 413
Address 0x1cd10

FindStringOrdinal

Ordinal 414
Address 0x36580

FindVolumeClose

Ordinal 415
Address 0x22450

FindVolumeMountPointClose

Ordinal 416
Address 0x5e090

FlsAlloc

Ordinal 417
Address 0x1e440

FlsFree

Ordinal 418
Address 0x1e770

FlsGetValue

Ordinal 419
Address 0x16ba0

FlsSetValue

Ordinal 420
Address 0x1b690

FlushConsoleInputBuffer

Ordinal 421
Address 0x22bb0

FlushFileBuffers

Ordinal 422
Address 0x22460

FlushInstructionCache

Ordinal 423
Address 0x184e0

FlushProcessWriteBuffers

Ordinal 424
Address 0x96ad8
ForwardName NTDLL.NtFlushProcessWriteBuffers

FlushViewOfFile

Ordinal 425
Address 0x36590

FoldStringA

Ordinal 426
Address 0x451c0

FoldStringW

Ordinal 427
Address 0x365a0

FormatApplicationUserModelId

Ordinal 428
Address 0x96b3e
ForwardName kernelbase.FormatApplicationUserModelId

FormatMessageA

Ordinal 429
Address 0x209e0

FormatMessageW

Ordinal 430
Address 0x1c030

FreeConsole

Ordinal 431
Address 0x22a70

FreeEnvironmentStringsA

Ordinal 432
Address 0x1ee20

FreeEnvironmentStringsW

Ordinal 433
Address 0x1d930

FreeLibrary

Ordinal 434
Address 0x1c270

FreeLibraryAndExitThread

Ordinal 435
Address 0x1fa60

FreeLibraryWhenCallbackReturns

Ordinal 436
Address 0x96c04
ForwardName NTDLL.TpCallbackUnloadDllOnCompletion

FreeMemoryJobObject

Ordinal 437
Address 0x54ed0

FreeResource

Ordinal 438
Address 0x20450

FreeUserPhysicalPages

Ordinal 439
Address 0x365b0

GenerateConsoleCtrlEvent

Ordinal 440
Address 0x22bc0

GetACP

Ordinal 441
Address 0x1cee0

GetActiveProcessorCount

Ordinal 442
Address 0x1cbb0

GetActiveProcessorGroupCount

Ordinal 443
Address 0x5ea00

GetAppContainerAce

Ordinal 444
Address 0x365c0

GetAppContainerNamedObjectPath

Ordinal 445
Address 0x365d0

GetApplicationRecoveryCallback

Ordinal 446
Address 0x365e0

GetApplicationRecoveryCallbackWorker

Ordinal 447
Address 0x3deb0

GetApplicationRestartSettings

Ordinal 448
Address 0x365f0

GetApplicationRestartSettingsWorker

Ordinal 449
Address 0x3df60

GetApplicationUserModelId

Ordinal 450
Address 0x96d88
ForwardName kernelbase.GetApplicationUserModelId

GetAtomNameA

Ordinal 451
Address 0x530b0

GetAtomNameW

Ordinal 452
Address 0xfb80

GetBinaryType

Ordinal 453
Address 0x59680

GetBinaryTypeA

Ordinal 454
Address 0x59680

GetBinaryTypeW

Ordinal 455
Address 0x596d0

GetCPInfo

Ordinal 456
Address 0x1cef0

GetCPInfoExA

Ordinal 457
Address 0x45420

GetCPInfoExW

Ordinal 458
Address 0x36600

GetCachedSigningLevel

Ordinal 459
Address 0x36610

GetCalendarDateFormat

Ordinal 460
Address 0x444b0

GetCalendarDateFormatEx

Ordinal 461
Address 0x1aa80

GetCalendarDaysInMonth

Ordinal 462
Address 0x1a860

GetCalendarDifferenceInDays

Ordinal 463
Address 0x44780

GetCalendarInfoA

Ordinal 464
Address 0x454e0

GetCalendarInfoEx

Ordinal 465
Address 0x22800

GetCalendarInfoW

Ordinal 466
Address 0x22810

GetCalendarMonthsInYear

Ordinal 467
Address 0x448d0

GetCalendarSupportedDateRange

Ordinal 468
Address 0x1a5f0

GetCalendarWeekNumber

Ordinal 469
Address 0x449a0

GetComPlusPackageInstallStatus

Ordinal 470
Address 0x3ddf0

GetCommConfig

Ordinal 471
Address 0x22860

GetCommMask

Ordinal 472
Address 0x22870

GetCommModemStatus

Ordinal 473
Address 0x22880

GetCommProperties

Ordinal 474
Address 0x22890

GetCommState

Ordinal 475
Address 0x228a0

GetCommTimeouts

Ordinal 476
Address 0x228b0

GetCommandLineA

Ordinal 477
Address 0x1e460

GetCommandLineW

Ordinal 478
Address 0x1e420

GetCompressedFileSizeA

Ordinal 479
Address 0x36620

GetCompressedFileSizeTransactedA

Ordinal 480
Address 0x5ba70

GetCompressedFileSizeTransactedW

Ordinal 481
Address 0x5bad0

GetCompressedFileSizeW

Ordinal 482
Address 0x36630

GetComputerNameA

Ordinal 483
Address 0x5500

GetComputerNameExA

Ordinal 484
Address 0x21a10

GetComputerNameExW

Ordinal 485
Address 0x1f890

GetComputerNameW

Ordinal 486
Address 0x8ce0

GetConsoleAliasA

Ordinal 487
Address 0x22e20

GetConsoleAliasExesA

Ordinal 488
Address 0x22e30

GetConsoleAliasExesLengthA

Ordinal 489
Address 0x22e40

GetConsoleAliasExesLengthW

Ordinal 490
Address 0x22e50

GetConsoleAliasExesW

Ordinal 491
Address 0x22e60

GetConsoleAliasW

Ordinal 492
Address 0x22e70

GetConsoleAliasesA

Ordinal 493
Address 0x22e80

GetConsoleAliasesLengthA

Ordinal 494
Address 0x22e90

GetConsoleAliasesLengthW

Ordinal 495
Address 0x22ea0

GetConsoleAliasesW

Ordinal 496
Address 0x22eb0

GetConsoleCP

Ordinal 497
Address 0x22a80

GetConsoleCharType

Ordinal 498
Address 0x61b90

GetConsoleCommandHistoryA

Ordinal 499
Address 0x22ec0

GetConsoleCommandHistoryLengthA

Ordinal 500
Address 0x22ed0

GetConsoleCommandHistoryLengthW

Ordinal 501
Address 0x22ee0

GetConsoleCommandHistoryW

Ordinal 502
Address 0x22ef0

GetConsoleCursorInfo

Ordinal 503
Address 0x22bd0

GetConsoleCursorMode

Ordinal 504
Address 0x61bf0

GetConsoleDisplayMode

Ordinal 505
Address 0x22f00

GetConsoleFontInfo

Ordinal 506
Address 0x61f10

GetConsoleFontSize

Ordinal 507
Address 0x22f10

GetConsoleHardwareState

Ordinal 508
Address 0x61740

GetConsoleHistoryInfo

Ordinal 509
Address 0x22f20

GetConsoleInputExeNameA

Ordinal 510
Address 0x9727b
ForwardName kernelbase.GetConsoleInputExeNameA

GetConsoleInputExeNameW

Ordinal 511
Address 0x972b6
ForwardName kernelbase.GetConsoleInputExeNameW

GetConsoleInputWaitHandle

Ordinal 512
Address 0x61670

GetConsoleKeyboardLayoutNameA

Ordinal 513
Address 0x61fb0

GetConsoleKeyboardLayoutNameW

Ordinal 514
Address 0x61fd0

GetConsoleMode

Ordinal 515
Address 0x22a90

GetConsoleNlsMode

Ordinal 516
Address 0x61c60

GetConsoleOriginalTitleA

Ordinal 517
Address 0x22be0

GetConsoleOriginalTitleW

Ordinal 518
Address 0x22bf0

GetConsoleOutputCP

Ordinal 519
Address 0x22aa0

GetConsoleProcessList

Ordinal 520
Address 0x22f30

GetConsoleScreenBufferInfo

Ordinal 521
Address 0x22c00

GetConsoleScreenBufferInfoEx

Ordinal 522
Address 0x22c10

GetConsoleSelectionInfo

Ordinal 523
Address 0x22f40

GetConsoleTitleA

Ordinal 524
Address 0x22c20

GetConsoleTitleW

Ordinal 525
Address 0x22c30

GetConsoleWindow

Ordinal 526
Address 0x22f50

GetCurrencyFormatA

Ordinal 527
Address 0x45710

GetCurrencyFormatEx

Ordinal 528
Address 0x36640

GetCurrencyFormatW

Ordinal 529
Address 0x36650

GetCurrentActCtx

Ordinal 530
Address 0x20430

GetCurrentActCtxWorker

Ordinal 531
Address 0x1c070

GetCurrentApplicationUserModelId

Ordinal 532
Address 0x974b1
ForwardName kernelbase.GetCurrentApplicationUserModelId

GetCurrentConsoleFont

Ordinal 533
Address 0x22f60

GetCurrentConsoleFontEx

Ordinal 534
Address 0x22f70

GetCurrentDirectoryA

Ordinal 535
Address 0x1fb00

GetCurrentDirectoryW

Ordinal 536
Address 0x1ee30

GetCurrentPackageFamilyName

Ordinal 537
Address 0x97551
ForwardName kernelbase.GetCurrentPackageFamilyName

GetCurrentPackageFullName

Ordinal 538
Address 0x97592
ForwardName kernelbase.GetCurrentPackageFullName

GetCurrentPackageId

Ordinal 539
Address 0x975cb
ForwardName kernelbase.GetCurrentPackageId

GetCurrentPackageInfo

Ordinal 540
Address 0x97600
ForwardName kernelbase.GetCurrentPackageInfo

GetCurrentPackagePath

Ordinal 541
Address 0x97637
ForwardName kernelbase.GetCurrentPackagePath

GetCurrentProcess

Ordinal 542
Address 0x22020

GetCurrentProcessId

Ordinal 543
Address 0x22030

GetCurrentProcessorNumber

Ordinal 544
Address 0x97698
ForwardName NTDLL.RtlGetCurrentProcessorNumber

GetCurrentProcessorNumberEx

Ordinal 545
Address 0x976d7
ForwardName NTDLL.RtlGetCurrentProcessorNumberEx

GetCurrentThread

Ordinal 546
Address 0x157f0

GetCurrentThreadId

Ordinal 547
Address 0x15260

GetCurrentThreadStackLimits

Ordinal 548
Address 0x9773c
ForwardName api-ms-win-core-processthreads-l1-1-0.GetCurrentThreadStackLimits

GetCurrentUmsThread

Ordinal 549
Address 0x3c630

GetDateFormatA

Ordinal 550
Address 0x36660

GetDateFormatAWorker

Ordinal 551
Address 0x206d0

GetDateFormatEx

Ordinal 552
Address 0x36670

GetDateFormatW

Ordinal 553
Address 0x1ee50

GetDateFormatWWorker

Ordinal 554
Address 0x6560

GetDefaultCommConfigA

Ordinal 555
Address 0x385e0

GetDefaultCommConfigW

Ordinal 556
Address 0x38670

GetDevicePowerState

Ordinal 557
Address 0x5f240

GetDiskFreeSpaceA

Ordinal 558
Address 0x22470

GetDiskFreeSpaceExA

Ordinal 559
Address 0x22480

GetDiskFreeSpaceExW

Ordinal 560
Address 0x22490

GetDiskFreeSpaceW

Ordinal 561
Address 0x224a0

GetDiskSpaceInformationA

Ordinal 562
Address 0x9788f
ForwardName api-ms-win-core-file-l1-2-3.GetDiskSpaceInformationA

GetDiskSpaceInformationW

Ordinal 563
Address 0x978dd
ForwardName api-ms-win-core-file-l1-2-3.GetDiskSpaceInformationW

GetDllDirectoryA

Ordinal 564
Address 0x348c0

GetDllDirectoryW

Ordinal 565
Address 0x203a0

GetDriveTypeA

Ordinal 566
Address 0x224b0

GetDriveTypeW

Ordinal 567
Address 0x224c0

GetDurationFormat

Ordinal 568
Address 0x462a0

GetDurationFormatEx

Ordinal 569
Address 0x36680

GetDynamicTimeZoneInformation

Ordinal 570
Address 0x1f990

GetEnabledXStateFeatures

Ordinal 571
Address 0x1f1b0

GetEncryptedFileVersionExt

Ordinal 572
Address 0x34520

GetEnvironmentStrings

Ordinal 573
Address 0x1ee10

GetEnvironmentStringsA

Ordinal 574
Address 0x22820

GetEnvironmentStringsW

Ordinal 575
Address 0x1d920

GetEnvironmentVariableA

Ordinal 576
Address 0x1e450

GetEnvironmentVariableW

Ordinal 577
Address 0x1b250

GetEraNameCountedString

Ordinal 578
Address 0x36690

GetErrorMode

Ordinal 579
Address 0x20550

GetExitCodeProcess

Ordinal 580
Address 0x1c790

GetExitCodeThread

Ordinal 581
Address 0x1e660

GetExpandedNameA

Ordinal 582
Address 0x377c0

GetExpandedNameW

Ordinal 583
Address 0x378b0

GetFileAttributesA

Ordinal 584
Address 0x224d0

GetFileAttributesExA

Ordinal 585
Address 0x224e0

GetFileAttributesExW

Ordinal 586
Address 0x224f0

GetFileAttributesTransactedA

Ordinal 587
Address 0x5bb70

GetFileAttributesTransactedW

Ordinal 588
Address 0x5bbd0

GetFileAttributesW

Ordinal 589
Address 0x22500

GetFileBandwidthReservation

Ordinal 590
Address 0x33e20

GetFileInformationByHandle

Ordinal 591
Address 0x22510

GetFileInformationByHandleEx

Ordinal 592
Address 0x1b7e0

GetFileMUIInfo

Ordinal 593
Address 0x366a0

GetFileMUIPath

Ordinal 594
Address 0x1e410

GetFileSize

Ordinal 595
Address 0x22520

GetFileSizeEx

Ordinal 596
Address 0x22530

GetFileTime

Ordinal 597
Address 0x22540

GetFileType

Ordinal 598
Address 0x22550

GetFinalPathNameByHandleA

Ordinal 599
Address 0x22560

GetFinalPathNameByHandleW

Ordinal 600
Address 0x22570

GetFirmwareEnvironmentVariableA

Ordinal 601
Address 0x5f290

GetFirmwareEnvironmentVariableExA

Ordinal 602
Address 0x5f2b0

GetFirmwareEnvironmentVariableExW

Ordinal 603
Address 0x10820

GetFirmwareEnvironmentVariableW

Ordinal 604
Address 0x5f3b0

GetFirmwareType

Ordinal 605
Address 0x20a70

GetFullPathNameA

Ordinal 606
Address 0x22580

GetFullPathNameTransactedA

Ordinal 607
Address 0x338d0

GetFullPathNameTransactedW

Ordinal 608
Address 0x5f5c0

GetFullPathNameW

Ordinal 609
Address 0x22590

GetGeoInfoA

Ordinal 610
Address 0x45ab0

GetGeoInfoEx

Ordinal 611
Address 0x4dad0

GetGeoInfoW

Ordinal 612
Address 0x1060

GetHandleInformation

Ordinal 613
Address 0x220a0

GetLargePageMinimum

Ordinal 614
Address 0x366b0

GetLargestConsoleWindowSize

Ordinal 615
Address 0x22c40

GetLastError

Ordinal 616
Address 0x157e0

GetLocalTime

Ordinal 617
Address 0x1d230

GetLocaleInfoA

Ordinal 618
Address 0x1fb90

GetLocaleInfoEx

Ordinal 619
Address 0x1c000

GetLocaleInfoW

Ordinal 620
Address 0x1ec70

GetLogicalDriveStringsA

Ordinal 621
Address 0x183b0

GetLogicalDriveStringsW

Ordinal 622
Address 0x225a0

GetLogicalDrives

Ordinal 623
Address 0x18470

GetLogicalProcessorInformation

Ordinal 624
Address 0x1fad0

GetLogicalProcessorInformationEx

Ordinal 625
Address 0x97e29
ForwardName api-ms-win-core-sysinfo-l1-1-0.GetLogicalProcessorInformationEx

GetLongPathNameA

Ordinal 626
Address 0x52c40

GetLongPathNameTransactedA

Ordinal 627
Address 0x3b150

GetLongPathNameTransactedW

Ordinal 628
Address 0x59a00

GetLongPathNameW

Ordinal 629
Address 0x15d30

GetMailslotInfo

Ordinal 630
Address 0x5b370

GetMaximumProcessorCount

Ordinal 631
Address 0x5ea60

GetMaximumProcessorGroupCount

Ordinal 632
Address 0x209f0

GetMemoryErrorHandlingCapabilities

Ordinal 633
Address 0x366c0

GetModuleFileNameA

Ordinal 634
Address 0x1d380

GetModuleFileNameW

Ordinal 635
Address 0x1ce50

GetModuleHandleA

Ordinal 636
Address 0x1d370

GetModuleHandleExA

Ordinal 637
Address 0x1fa50

GetModuleHandleExW

Ordinal 638
Address 0x1e680

GetModuleHandleW

Ordinal 639
Address 0x1c160

GetNLSVersion

Ordinal 640
Address 0x20500

GetNLSVersionEx

Ordinal 641
Address 0x366d0

GetNamedPipeAttribute

Ordinal 642
Address 0x366e0

GetNamedPipeClientComputerNameA

Ordinal 643
Address 0x59e40

GetNamedPipeClientComputerNameW

Ordinal 644
Address 0x366f0

GetNamedPipeClientProcessId

Ordinal 645
Address 0x59f70

GetNamedPipeClientSessionId

Ordinal 646
Address 0x34af0

GetNamedPipeHandleStateA

Ordinal 647
Address 0x59fb0

GetNamedPipeHandleStateW

Ordinal 648
Address 0x36700

GetNamedPipeInfo

Ordinal 649
Address 0x98088
ForwardName api-ms-win-core-namedpipe-l1-2-1.GetNamedPipeInfo

GetNamedPipeServerProcessId

Ordinal 650
Address 0x5a110

GetNamedPipeServerSessionId

Ordinal 651
Address 0x34b40

GetNativeSystemInfo

Ordinal 652
Address 0x1f310

GetNextUmsListItem

Ordinal 653
Address 0x3c660

GetNextVDMCommand

Ordinal 654
Address 0x3b200

GetNumaAvailableMemoryNode

Ordinal 655
Address 0x34d60

GetNumaAvailableMemoryNodeEx

Ordinal 656
Address 0x5fab0

GetNumaHighestNodeNumber

Ordinal 657
Address 0x1f3a0

GetNumaNodeNumberFromHandle

Ordinal 658
Address 0x34d70

GetNumaNodeProcessorMask

Ordinal 659
Address 0x5fb30

GetNumaNodeProcessorMaskEx

Ordinal 660
Address 0x36710

GetNumaProcessorNode

Ordinal 661
Address 0x34dc0

GetNumaProcessorNodeEx

Ordinal 662
Address 0x5fbb0

GetNumaProximityNode

Ordinal 663
Address 0x34e20

GetNumaProximityNodeEx

Ordinal 664
Address 0x36720

GetNumberFormatA

Ordinal 665
Address 0x1a060

GetNumberFormatEx

Ordinal 666
Address 0x36730

GetNumberFormatW

Ordinal 667
Address 0x1290

GetNumberOfConsoleFonts

Ordinal 668
Address 0x62070

GetNumberOfConsoleInputEvents

Ordinal 669
Address 0x22ab0

GetNumberOfConsoleMouseButtons

Ordinal 670
Address 0x22f80

GetOEMCP

Ordinal 671
Address 0x1fd50

GetOverlappedResult

Ordinal 672
Address 0x19e10

GetOverlappedResultEx

Ordinal 673
Address 0x982e0
ForwardName api-ms-win-core-io-l1-1-1.GetOverlappedResultEx

GetPackageApplicationIds

Ordinal 674
Address 0x98329
ForwardName kernelbase.GetPackageApplicationIds

GetPackageFamilyName

Ordinal 675
Address 0x98362
ForwardName kernelbase.GetPackageFamilyName

GetPackageFullName

Ordinal 676
Address 0x98395
ForwardName kernelbase.GetPackageFullName

GetPackageId

Ordinal 677
Address 0x983c0
ForwardName kernelbase.GetPackageId

GetPackageInfo

Ordinal 678
Address 0x983e7
ForwardName kernelbase.GetPackageInfo

GetPackagePath

Ordinal 679
Address 0x98410
ForwardName kernelbase.GetPackagePath

GetPackagePathByFullName

Ordinal 680
Address 0x98443
ForwardName kernelbase.GetPackagePathByFullName

GetPackagesByPackageFamily

Ordinal 681
Address 0x98482
ForwardName kernelbase.GetPackagesByPackageFamily

GetPhysicallyInstalledSystemMemory

Ordinal 682
Address 0x1fd20

GetPriorityClass

Ordinal 683
Address 0x1fae0

GetPrivateProfileIntA

Ordinal 684
Address 0x107a0

GetPrivateProfileIntW

Ordinal 685
Address 0xf7e0

GetPrivateProfileSectionA

Ordinal 686
Address 0x20ae0

GetPrivateProfileSectionNamesA

Ordinal 687
Address 0x58de0

GetPrivateProfileSectionNamesW

Ordinal 688
Address 0x58e10

GetPrivateProfileSectionW

Ordinal 689
Address 0x1f8c0

GetPrivateProfileStringA

Ordinal 690
Address 0x106a0

GetPrivateProfileStringW

Ordinal 691
Address 0xf8c0

GetPrivateProfileStructA

Ordinal 692
Address 0x58e40

GetPrivateProfileStructW

Ordinal 693
Address 0x58fc0

GetProcAddress

Ordinal 694
Address 0x19d60

GetProcessAffinityMask

Ordinal 695
Address 0x1b760

GetProcessDEPPolicy

Ordinal 696
Address 0x359a0

GetProcessDefaultCpuSets

Ordinal 697
Address 0x98631
ForwardName api-ms-win-core-processthreads-l1-1-3.GetProcessDefaultCpuSets

GetProcessGroupAffinity

Ordinal 698
Address 0x36740

GetProcessHandleCount

Ordinal 699
Address 0x36750

GetProcessHeap

Ordinal 700
Address 0x15880

GetProcessHeaps

Ordinal 701
Address 0x36760

GetProcessId

Ordinal 702
Address 0x1c5f0

GetProcessIdOfThread

Ordinal 703
Address 0x1f360

GetProcessInformation

Ordinal 704
Address 0x22040

GetProcessIoCounters

Ordinal 705
Address 0x1e820

GetProcessMitigationPolicy

Ordinal 706
Address 0x98725
ForwardName api-ms-win-core-processthreads-l1-1-1.GetProcessMitigationPolicy

GetProcessPreferredUILanguages

Ordinal 707
Address 0x219d0

GetProcessPriorityBoost

Ordinal 708
Address 0x36770

GetProcessShutdownParameters

Ordinal 709
Address 0x36780

GetProcessTimes

Ordinal 710
Address 0x19d90

GetProcessVersion

Ordinal 711
Address 0x20460

GetProcessWorkingSetSize

Ordinal 712
Address 0x3e070

GetProcessWorkingSetSizeEx

Ordinal 713
Address 0x36790

GetProcessorSystemCycleTime

Ordinal 714
Address 0x9882c
ForwardName api-ms-win-core-sysinfo-l1-2-2.GetProcessorSystemCycleTime

GetProductInfo

Ordinal 715
Address 0x1fb30

GetProfileIntA

Ordinal 716
Address 0x10810

GetProfileIntW

Ordinal 717
Address 0xf7d0

GetProfileSectionA

Ordinal 718
Address 0x59150

GetProfileSectionW

Ordinal 719
Address 0x59160

GetProfileStringA

Ordinal 720
Address 0x59170

GetProfileStringW

Ordinal 721
Address 0x591a0

GetQueuedCompletionStatus

Ordinal 722
Address 0x16b90

GetQueuedCompletionStatusEx

Ordinal 723
Address 0x367a0

GetShortPathNameA

Ordinal 724
Address 0x59ab0

GetShortPathNameW

Ordinal 725
Address 0x158b0

GetStagedPackagePathByFullName

Ordinal 726
Address 0x98957
ForwardName kernelbase.GetStagedPackagePathByFullName

GetStartupInfoA

Ordinal 727
Address 0x1f670

GetStartupInfoW

Ordinal 728
Address 0x1cd30

GetStateFolder

Ordinal 729
Address 0x989b0
ForwardName kernelbase.GetStateFolder

GetStdHandle

Ordinal 730
Address 0x1c890

GetStringScripts

Ordinal 731
Address 0x367b0

GetStringTypeA

Ordinal 732
Address 0x367c0

GetStringTypeExA

Ordinal 733
Address 0x367c0

GetStringTypeExW

Ordinal 734
Address 0x209d0

GetStringTypeW

Ordinal 735
Address 0x1d3d0

GetSystemAppDataKey

Ordinal 736
Address 0x98a3c
ForwardName kernelbase.GetSystemAppDataKey

GetSystemCpuSetInformation

Ordinal 737
Address 0x98a76
ForwardName api-ms-win-core-processthreads-l1-1-3.GetSystemCpuSetInformation

GetSystemDEPPolicy

Ordinal 738
Address 0x359f0

GetSystemDefaultLCID

Ordinal 739
Address 0x1f960

GetSystemDefaultLangID

Ordinal 740
Address 0x1fa20

GetSystemDefaultLocaleName

Ordinal 741
Address 0x1380

GetSystemDefaultUILanguage

Ordinal 742
Address 0x1f2d0

GetSystemDirectoryA

Ordinal 743
Address 0x1cb10

GetSystemDirectoryW

Ordinal 744
Address 0x19cd0

GetSystemFileCacheSize

Ordinal 745
Address 0x367d0

GetSystemFirmwareTable

Ordinal 746
Address 0x13a0

GetSystemInfo

Ordinal 747
Address 0x1b930

GetSystemPowerStatus

Ordinal 748
Address 0x19f80

GetSystemPreferredUILanguages

Ordinal 749
Address 0x1fcd0

GetSystemRegistryQuota

Ordinal 750
Address 0x35a30

GetSystemTime

Ordinal 751
Address 0x184d0

GetSystemTimeAdjustment

Ordinal 752
Address 0x1f3f0

GetSystemTimeAsFileTime

Ordinal 753
Address 0x18500

GetSystemTimePreciseAsFileTime

Ordinal 754
Address 0x227e0

GetSystemTimes

Ordinal 755
Address 0x1e960

GetSystemWindowsDirectoryA

Ordinal 756
Address 0x367e0

GetSystemWindowsDirectoryW

Ordinal 757
Address 0x1f2e0

GetSystemWow64DirectoryA

Ordinal 758
Address 0x22950

GetSystemWow64DirectoryW

Ordinal 759
Address 0x22960

GetTapeParameters

Ordinal 760
Address 0x5fd50

GetTapePosition

Ordinal 761
Address 0x3d6c0

GetTapeStatus

Ordinal 762
Address 0x3d750

GetTempFileNameA

Ordinal 763
Address 0x225b0

GetTempFileNameW

Ordinal 764
Address 0x225c0

GetTempPathA

Ordinal 765
Address 0x225d0

GetTempPathW

Ordinal 766
Address 0x225e0

GetThreadContext

Ordinal 767
Address 0x1f170

GetThreadDescription

Ordinal 768
Address 0x98d40
ForwardName api-ms-win-core-processthreads-l1-1-3.GetThreadDescription

GetThreadErrorMode

Ordinal 769
Address 0x367f0

GetThreadGroupAffinity

Ordinal 770
Address 0x36800

GetThreadIOPendingFlag

Ordinal 771
Address 0x36810

GetThreadId

Ordinal 772
Address 0x1bfd0

GetThreadIdealProcessorEx

Ordinal 773
Address 0x36820

GetThreadInformation

Ordinal 774
Address 0x22050

GetThreadLocale

Ordinal 775
Address 0x19e20

GetThreadPreferredUILanguages

Ordinal 776
Address 0x1c7f0

GetThreadPriority

Ordinal 777
Address 0x1b240

GetThreadPriorityBoost

Ordinal 778
Address 0x36830

GetThreadSelectedCpuSets

Ordinal 779
Address 0x98e67
ForwardName api-ms-win-core-processthreads-l1-1-3.GetThreadSelectedCpuSets

GetThreadSelectorEntry

Ordinal 780
Address 0x5fdb0

GetThreadTimes

Ordinal 781
Address 0x19a80

GetThreadUILanguage

Ordinal 782
Address 0x21a50

GetTickCount

Ordinal 783
Address 0x15330

GetTickCount64

Ordinal 784
Address 0x16b60

GetTimeFormatA

Ordinal 785
Address 0x36840

GetTimeFormatAWorker

Ordinal 786
Address 0x21640

GetTimeFormatEx

Ordinal 787
Address 0x36850

GetTimeFormatW

Ordinal 788
Address 0x1ee60

GetTimeFormatWWorker

Ordinal 789
Address 0x3ae0

GetTimeZoneInformation

Ordinal 790
Address 0x1f350

GetTimeZoneInformationForYear

Ordinal 791
Address 0x12a0

GetUILanguageInfo

Ordinal 792
Address 0x36860

GetUmsCompletionListEvent

Ordinal 793
Address 0x3c690

GetUmsSystemThreadInformation

Ordinal 794
Address 0x3c6c0

GetUserDefaultGeoName

Ordinal 795
Address 0x4dc10

GetUserDefaultLCID

Ordinal 796
Address 0x1e6a0

GetUserDefaultLangID

Ordinal 797
Address 0x36870

GetUserDefaultLocaleName

Ordinal 798
Address 0x1d3b0

GetUserDefaultUILanguage

Ordinal 799
Address 0x1fa40

GetUserGeoID

Ordinal 800
Address 0x1efb0

GetUserPreferredUILanguages

Ordinal 801
Address 0x1efa0

GetVDMCurrentDirectories

Ordinal 802
Address 0x3bb50

GetVersion

Ordinal 803
Address 0x1fb10

GetVersionExA

Ordinal 804
Address 0x1eec0

GetVersionExW

Ordinal 805
Address 0x1e4b0

GetVolumeInformationA

Ordinal 806
Address 0x225f0

GetVolumeInformationByHandleW

Ordinal 807
Address 0x22600

GetVolumeInformationW

Ordinal 808
Address 0x22610

GetVolumeNameForVolumeMountPointA

Ordinal 809
Address 0x21780

GetVolumeNameForVolumeMountPointW

Ordinal 810
Address 0x22010

GetVolumePathNameA

Ordinal 811
Address 0x5e0f0

GetVolumePathNameW

Ordinal 812
Address 0x22620

GetVolumePathNamesForVolumeNameA

Ordinal 813
Address 0x5e290

GetVolumePathNamesForVolumeNameW

Ordinal 814
Address 0x22630

GetWindowsDirectoryA

Ordinal 815
Address 0x20540

GetWindowsDirectoryW

Ordinal 816
Address 0x1fbe0

GetWriteWatch

Ordinal 817
Address 0x15890

GetXStateFeaturesMask

Ordinal 818
Address 0x36880

GlobalAddAtomA

Ordinal 819
Address 0xfbb0

GlobalAddAtomExA

Ordinal 820
Address 0x530e0

GlobalAddAtomExW

Ordinal 821
Address 0xfa10

GlobalAddAtomW

Ordinal 822
Address 0xfe50

GlobalAlloc

Ordinal 823
Address 0x184c0

GlobalCompact

Ordinal 824
Address 0x34640

GlobalDeleteAtom

Ordinal 825
Address 0xfd80

GlobalFindAtomA

Ordinal 826
Address 0x53100

GlobalFindAtomW

Ordinal 827
Address 0x102d0

GlobalFix

Ordinal 828
Address 0x34660

GlobalFlags

Ordinal 829
Address 0x1e520

GlobalFree

Ordinal 830
Address 0x157b0

GlobalGetAtomNameA

Ordinal 831
Address 0x53120

GlobalGetAtomNameW

Ordinal 832
Address 0xfbd0

GlobalHandle

Ordinal 833
Address 0x1eca0

GlobalLock

Ordinal 834
Address 0x155d0

GlobalMemoryStatus

Ordinal 835
Address 0x1c170

GlobalMemoryStatusEx

Ordinal 836
Address 0x1ef20

GlobalReAlloc

Ordinal 837
Address 0x16790

GlobalSize

Ordinal 838
Address 0x19550

GlobalUnWire

Ordinal 839
Address 0x34680

GlobalUnfix

Ordinal 840
Address 0x34690

GlobalUnlock

Ordinal 841
Address 0x15510

GlobalWire

Ordinal 842
Address 0x346b0

Heap32First

Ordinal 843
Address 0x5c3f0

Heap32ListFirst

Ordinal 844
Address 0x5c660

Heap32ListNext

Ordinal 845
Address 0x5c750

Heap32Next

Ordinal 846
Address 0x5c830

HeapAlloc

Ordinal 847
Address 0x9938c
ForwardName NTDLL.RtlAllocateHeap

HeapCompact

Ordinal 848
Address 0x36890

HeapCreate

Ordinal 849
Address 0x1ec80

HeapDestroy

Ordinal 850
Address 0x1fb80

HeapFree

Ordinal 851
Address 0x15280

HeapLock

Ordinal 852
Address 0x368a0

HeapQueryInformation

Ordinal 853
Address 0x368b0

HeapReAlloc

Ordinal 854
Address 0x993f8
ForwardName NTDLL.RtlReAllocateHeap

HeapSetInformation

Ordinal 855
Address 0x1eeb0

HeapSize

Ordinal 856
Address 0x9942c
ForwardName NTDLL.RtlSizeHeap

HeapSummary

Ordinal 857
Address 0x368c0

HeapUnlock

Ordinal 858
Address 0x368d0

HeapValidate

Ordinal 859
Address 0x1c260

HeapWalk

Ordinal 860
Address 0x368e0

IdnToAscii

Ordinal 861
Address 0x368f0

IdnToNameprepUnicode

Ordinal 862
Address 0x36900

IdnToUnicode

Ordinal 863
Address 0x36910

InitAtomTable

Ordinal 864
Address 0x21a90

InitOnceBeginInitialize

Ordinal 865
Address 0x994be
ForwardName api-ms-win-core-synch-l1-2-0.InitOnceBeginInitialize

InitOnceComplete

Ordinal 866
Address 0x99504
ForwardName api-ms-win-core-synch-l1-2-0.InitOnceComplete

InitOnceExecuteOnce

Ordinal 867
Address 0x99546
ForwardName api-ms-win-core-synch-l1-2-0.InitOnceExecuteOnce

InitOnceInitialize

Ordinal 868
Address 0x9958a
ForwardName NTDLL.RtlRunOnceInitialize

InitializeConditionVariable

Ordinal 869
Address 0x995c1
ForwardName NTDLL.RtlInitializeConditionVariable

InitializeContext

Ordinal 870
Address 0x36930

InitializeContext2

Ordinal 871
Address 0x36920

InitializeCriticalSection

Ordinal 872
Address 0x99625
ForwardName NTDLL.RtlInitializeCriticalSection

InitializeCriticalSectionAndSpinCount

Ordinal 873
Address 0x22180

InitializeCriticalSectionEx

Ordinal 874
Address 0x22190

InitializeEnclave

Ordinal 875
Address 0x9969c
ForwardName api-ms-win-core-enclave-l1-1-0.InitializeEnclave

InitializeProcThreadAttributeList

Ordinal 876
Address 0x996ef
ForwardName api-ms-win-core-processthreads-l1-1-0.InitializeProcThreadAttributeList

InitializeSListHead

Ordinal 877
Address 0x9974b
ForwardName NTDLL.RtlInitializeSListHead

InitializeSRWLock

Ordinal 878
Address 0x9977a
ForwardName NTDLL.RtlInitializeSRWLock

InitializeSynchronizationBarrier

Ordinal 879
Address 0x36940

InstallELAMCertificateInfo

Ordinal 880
Address 0x997d1
ForwardName api-ms-win-core-sysinfo-l1-2-1.InstallELAMCertificateInfo

InterlockedFlushSList

Ordinal 881
Address 0x99821
ForwardName NTDLL.RtlInterlockedFlushSList

InterlockedPopEntrySList

Ordinal 882
Address 0x99859
ForwardName NTDLL.RtlInterlockedPopEntrySList

InterlockedPushEntrySList

Ordinal 883
Address 0x99895
ForwardName NTDLL.RtlInterlockedPushEntrySList

InterlockedPushListSList

Ordinal 884
Address 0x998d1
ForwardName NTDLL.RtlInterlockedPushListSList

InterlockedPushListSListEx

Ordinal 885
Address 0x9990e
ForwardName NTDLL.RtlInterlockedPushListSListEx

InvalidateConsoleDIBits

Ordinal 886
Address 0x62160

IsBadCodePtr

Ordinal 887
Address 0x35ab0

IsBadHugeReadPtr

Ordinal 888
Address 0x35ac0

IsBadHugeWritePtr

Ordinal 889
Address 0x35ad0

IsBadReadPtr

Ordinal 890
Address 0x156c0

IsBadStringPtrA

Ordinal 891
Address 0x35ae0

IsBadStringPtrW

Ordinal 892
Address 0x35b30

IsBadWritePtr

Ordinal 893
Address 0x5eb10

IsCalendarLeapDay

Ordinal 894
Address 0x44ca0

IsCalendarLeapMonth

Ordinal 895
Address 0x44d80

IsCalendarLeapYear

Ordinal 896
Address 0x44e60

IsDBCSLeadByte

Ordinal 897
Address 0x20350

IsDBCSLeadByteEx

Ordinal 898
Address 0x36950

IsDebuggerPresent

Ordinal 899
Address 0x1ed40

IsEnclaveTypeSupported

Ordinal 900
Address 0x99a37
ForwardName api-ms-win-core-enclave-l1-1-0.IsEnclaveTypeSupported

IsNLSDefinedString

Ordinal 901
Address 0x36960

IsNativeVhdBoot

Ordinal 902
Address 0x336d0

IsNormalizedString

Ordinal 903
Address 0x36970

IsProcessCritical

Ordinal 904
Address 0x99ab5
ForwardName api-ms-win-core-processthreads-l1-1-2.IsProcessCritical

IsProcessInJob

Ordinal 905
Address 0x1f3d0

IsProcessorFeaturePresent

Ordinal 906
Address 0x1cd20

IsSystemResumeAutomatic

Ordinal 907
Address 0x35040

IsThreadAFiber

Ordinal 908
Address 0x1ca20

IsThreadpoolTimerSet

Ordinal 909
Address 0x99b52
ForwardName NTDLL.TpIsTimerSet

IsValidCalDateTime

Ordinal 910
Address 0x1ad40

IsValidCodePage

Ordinal 911
Address 0x1e430

IsValidLanguageGroup

Ordinal 912
Address 0x36980

IsValidLocale

Ordinal 913
Address 0x1ec20

IsValidLocaleName

Ordinal 914
Address 0x36990

IsValidNLSVersion

Ordinal 915
Address 0x369a0

IsWow64GuestMachineSupported

Ordinal 916
Address 0x99bec
ForwardName api-ms-win-core-wow64-l1-1-2.IsWow64GuestMachineSupported

IsWow64Process

Ordinal 917
Address 0x1e4a0

IsWow64Process2

Ordinal 918
Address 0x99c45
ForwardName api-ms-win-core-wow64-l1-1-1.IsWow64Process2

K32EmptyWorkingSet

Ordinal 919
Address 0x369b0

K32EnumDeviceDrivers

Ordinal 920
Address 0x369c0

K32EnumPageFilesA

Ordinal 921
Address 0x369d0

K32EnumPageFilesW

Ordinal 922
Address 0x369e0

K32EnumProcessModules

Ordinal 923
Address 0x1f9f0

K32EnumProcessModulesEx

Ordinal 924
Address 0x369f0

K32EnumProcesses

Ordinal 925
Address 0x1370

K32GetDeviceDriverBaseNameA

Ordinal 926
Address 0x36a00

K32GetDeviceDriverBaseNameW

Ordinal 927
Address 0x36a10

K32GetDeviceDriverFileNameA

Ordinal 928
Address 0x36a20

K32GetDeviceDriverFileNameW

Ordinal 929
Address 0x36a30

K32GetMappedFileNameA

Ordinal 930
Address 0x36a40

K32GetMappedFileNameW

Ordinal 931
Address 0x36a50

K32GetModuleBaseNameA

Ordinal 932
Address 0x36a60

K32GetModuleBaseNameW

Ordinal 933
Address 0x36a70

K32GetModuleFileNameExA

Ordinal 934
Address 0x36a80

K32GetModuleFileNameExW

Ordinal 935
Address 0x21a30

K32GetModuleInformation

Ordinal 936
Address 0x1d410

K32GetPerformanceInfo

Ordinal 937
Address 0x36a90

K32GetProcessImageFileNameA

Ordinal 938
Address 0x36aa0

K32GetProcessImageFileNameW

Ordinal 939
Address 0x1bfe0

K32GetProcessMemoryInfo

Ordinal 940
Address 0x36ab0

K32GetWsChanges

Ordinal 941
Address 0x36ad0

K32GetWsChangesEx

Ordinal 942
Address 0x36ac0

K32InitializeProcessForWsWatch

Ordinal 943
Address 0x36ae0

K32QueryWorkingSet

Ordinal 944
Address 0x36af0

K32QueryWorkingSetEx

Ordinal 945
Address 0x1c020

LCIDToLocaleName

Ordinal 946
Address 0x1f180

LCMapStringA

Ordinal 947
Address 0x36b00

LCMapStringEx

Ordinal 948
Address 0x166b0

LCMapStringW

Ordinal 949
Address 0x183a0

LZClose

Ordinal 950
Address 0x379d0

LZCloseFile

Ordinal 951
Address 0x37a80

LZCopy

Ordinal 952
Address 0x337d0

LZCreateFileW

Ordinal 953
Address 0x37b30

LZDone

Ordinal 954
Address 0x234c0

LZInit

Ordinal 955
Address 0x37c50

LZOpenFileA

Ordinal 956
Address 0x37df0

LZOpenFileW

Ordinal 957
Address 0x37ee0

LZRead

Ordinal 958
Address 0x37f90

LZSeek

Ordinal 959
Address 0x38200

LZStart

Ordinal 960
Address 0x1fd40

LeaveCriticalSection

Ordinal 961
Address 0x99f8f
ForwardName NTDLL.RtlLeaveCriticalSection

LeaveCriticalSectionWhenCallbackReturns

Ordinal 962
Address 0x99fd5
ForwardName NTDLL.TpCallbackLeaveCriticalSectionOnCompletion

LoadAppInitDlls

Ordinal 963
Address 0x19680

LoadEnclaveData

Ordinal 964
Address 0x9a026
ForwardName api-ms-win-core-enclave-l1-1-0.LoadEnclaveData

LoadLibraryA

Ordinal 965
Address 0x1f220

LoadLibraryExA

Ordinal 966
Address 0x1d610

LoadLibraryExW

Ordinal 967
Address 0x1a050

LoadLibraryW

Ordinal 968
Address 0x1e950

LoadModule

Ordinal 969
Address 0x5eba0

LoadPackagedLibrary

Ordinal 970
Address 0x227c0

LoadResource

Ordinal 971
Address 0x1a5b0

LoadStringBaseExW

Ordinal 972
Address 0x36b10

LoadStringBaseW

Ordinal 973
Address 0x347d0

LocalAlloc

Ordinal 974
Address 0x18650

LocalCompact

Ordinal 975
Address 0x34640

LocalFileTimeToFileTime

Ordinal 976
Address 0x22640

LocalFileTimeToLocalSystemTime

Ordinal 977
Address 0x9a12a
ForwardName api-ms-win-core-timezone-l1-1-1.LocalFileTimeToLocalSystemTime

LocalFlags

Ordinal 978
Address 0x5fdd0

LocalFree

Ordinal 979
Address 0x184f0

LocalHandle

Ordinal 980
Address 0x346f0

LocalLock

Ordinal 981
Address 0x1ce80

LocalReAlloc

Ordinal 982
Address 0x1e780

LocalShrink

Ordinal 983
Address 0x34640

LocalSize

Ordinal 984
Address 0x19e50

LocalSystemTimeToLocalFileTime

Ordinal 985
Address 0x9a1d6
ForwardName api-ms-win-core-timezone-l1-1-1.LocalSystemTimeToLocalFileTime

LocalUnlock

Ordinal 986
Address 0x1ce70

LocaleNameToLCID

Ordinal 987
Address 0x1ce60

LocateXStateFeature

Ordinal 988
Address 0x36b30

LockFile

Ordinal 989
Address 0x22650

LockFileEx

Ordinal 990
Address 0x22660

LockResource

Ordinal 991
Address 0x1a5c0

MapUserPhysicalPages

Ordinal 992
Address 0x36b40

MapUserPhysicalPagesScatter

Ordinal 993
Address 0x3e090

MapViewOfFile

Ordinal 994
Address 0x1cd00

MapViewOfFileEx

Ordinal 995
Address 0x1c280

MapViewOfFileExNuma

Ordinal 996
Address 0x36b50

MapViewOfFileFromApp

Ordinal 997
Address 0x9a2df
ForwardName api-ms-win-core-memory-l1-1-1.MapViewOfFileFromApp

Module32First

Ordinal 998
Address 0x5cac0

Module32FirstW

Ordinal 999
Address 0x1c660

Module32Next

Ordinal 1000
Address 0x5cbf0

Module32NextW

Ordinal 1001
Address 0x18510

MoveFileA

Ordinal 1002
Address 0x5bc90

MoveFileExA

Ordinal 1003
Address 0x5bcc0

MoveFileExW

Ordinal 1004
Address 0x20a60

MoveFileTransactedA

Ordinal 1005
Address 0x5bcf0

MoveFileTransactedW

Ordinal 1006
Address 0x215a0

MoveFileW

Ordinal 1007
Address 0x1e740

MoveFileWithProgressA

Ordinal 1008
Address 0x5bdc0

MoveFileWithProgressW

Ordinal 1009
Address 0x36b60

MulDiv

Ordinal 1010
Address 0x227a0

MultiByteToWideChar

Ordinal 1011
Address 0x15810

NeedCurrentDirectoryForExePathA

Ordinal 1012
Address 0x36b70

NeedCurrentDirectoryForExePathW

Ordinal 1013
Address 0x36b80

NlsCheckPolicy

Ordinal 1014
Address 0x229f0

NlsEventDataDescCreate

Ordinal 1015
Address 0x36b90

NlsGetCacheUpdateCount

Ordinal 1016
Address 0x22a00

NlsUpdateLocale

Ordinal 1017
Address 0x22a10

NlsUpdateSystemLocale

Ordinal 1018
Address 0x22a20

NlsWriteEtwEvent

Ordinal 1019
Address 0x36ba0

NormalizeString

Ordinal 1020
Address 0x36bb0

NotifyMountMgr

Ordinal 1021
Address 0x36bc0

NotifyUILanguageChange

Ordinal 1022
Address 0x47bb0

NtVdm64CreateProcessInternalW

Ordinal 1023
Address 0x35b90

OOBEComplete

Ordinal 1024
Address 0x1db70

OfferVirtualMemory

Ordinal 1025
Address 0x9a50d
ForwardName api-ms-win-core-memory-l1-1-2.OfferVirtualMemory

OpenConsoleW

Ordinal 1026
Address 0x61690

OpenConsoleWStub

Ordinal 1027
Address 0x36bd0

OpenEventA

Ordinal 1028
Address 0x221a0

OpenEventW

Ordinal 1029
Address 0x221b0

OpenFile

Ordinal 1030
Address 0x5a9e0

OpenFileById

Ordinal 1031
Address 0x36be0

OpenFileMappingA

Ordinal 1032
Address 0x200d0

OpenFileMappingW

Ordinal 1033
Address 0x1f320

OpenJobObjectA

Ordinal 1034
Address 0x54ee0

OpenJobObjectW

Ordinal 1035
Address 0x54f60

OpenMutexA

Ordinal 1036
Address 0x1b5b0

OpenMutexW

Ordinal 1037
Address 0x221c0

OpenPackageInfoByFullName

Ordinal 1038
Address 0x9a5f8
ForwardName kernelbase.OpenPackageInfoByFullName

OpenPrivateNamespaceA

Ordinal 1039
Address 0x5a420

OpenPrivateNamespaceW

Ordinal 1040
Address 0x20580

OpenProcess

Ordinal 1041
Address 0x1a040

OpenProcessToken

Ordinal 1042
Address 0x9a666
ForwardName api-ms-win-core-processthreads-l1-1-0.OpenProcessToken

OpenProfileUserMapping

Ordinal 1043
Address 0x1fd40

OpenSemaphoreA

Ordinal 1044
Address 0x5b580

OpenSemaphoreW

Ordinal 1045
Address 0x221d0

OpenState

Ordinal 1046
Address 0x9a6dc
ForwardName kernelbase.OpenState

OpenStateExplicit

Ordinal 1047
Address 0x9a703
ForwardName kernelbase.OpenStateExplicit

OpenThread

Ordinal 1048
Address 0x1c0b0

OpenThreadToken

Ordinal 1049
Address 0x9a73b
ForwardName api-ms-win-core-processthreads-l1-1-0.OpenThreadToken

OpenWaitableTimerA

Ordinal 1050
Address 0x5b5f0

OpenWaitableTimerW

Ordinal 1051
Address 0x221e0

OutputDebugStringA

Ordinal 1052
Address 0x1fd70

OutputDebugStringW

Ordinal 1053
Address 0x19d50

PackageFamilyNameFromFullName

Ordinal 1054
Address 0x9a7db
ForwardName kernelbase.PackageFamilyNameFromFullName

PackageFamilyNameFromId

Ordinal 1055
Address 0x9a81c
ForwardName kernelbase.PackageFamilyNameFromId

PackageFullNameFromId

Ordinal 1056
Address 0x9a855
ForwardName kernelbase.PackageFullNameFromId

PackageIdFromFullName

Ordinal 1057
Address 0x9a88c
ForwardName kernelbase.PackageIdFromFullName

PackageNameAndPublisherIdFromFamilyName

Ordinal 1058
Address 0x9a8d5
ForwardName kernelbase.PackageNameAndPublisherIdFromFamilyName

ParseApplicationUserModelId

Ordinal 1059
Address 0x9a924
ForwardName kernelbase.ParseApplicationUserModelId

PeekConsoleInputA

Ordinal 1060
Address 0x22ac0

PeekConsoleInputW

Ordinal 1061
Address 0x22ad0

PeekNamedPipe

Ordinal 1062
Address 0x21970

PostQueuedCompletionStatus

Ordinal 1063
Address 0x1b8d0

PowerClearRequest

Ordinal 1064
Address 0x1e790

PowerCreateRequest

Ordinal 1065
Address 0x1d640

PowerSetRequest

Ordinal 1066
Address 0x1e6b0

PrefetchVirtualMemory

Ordinal 1067
Address 0x9a9e3
ForwardName api-ms-win-core-memory-l1-1-1.PrefetchVirtualMemory

PrepareTape

Ordinal 1068
Address 0x3d780

PrivCopyFileExW

Ordinal 1069
Address 0x1c8d0

PrivMoveFileIdentityW

Ordinal 1070
Address 0x5beb0

Process32First

Ordinal 1071
Address 0x5cd10

Process32FirstW

Ordinal 1072
Address 0x208b0

Process32Next

Ordinal 1073
Address 0x5ce00

Process32NextW

Ordinal 1074
Address 0x205a0

ProcessIdToSessionId

Ordinal 1075
Address 0x1bff0

PssCaptureSnapshot

Ordinal 1076
Address 0x36bf0

PssDuplicateSnapshot

Ordinal 1077
Address 0x36c00

PssFreeSnapshot

Ordinal 1078
Address 0x36c10

PssQuerySnapshot

Ordinal 1079
Address 0x36c20

PssWalkMarkerCreate

Ordinal 1080
Address 0x36c30

PssWalkMarkerFree

Ordinal 1081
Address 0x36c40

PssWalkMarkerGetPosition

Ordinal 1082
Address 0x36c50

PssWalkMarkerRewind

Ordinal 1083
Address 0x36c60

PssWalkMarkerSeek

Ordinal 1084
Address 0x36c70

PssWalkMarkerSeekToBeginning

Ordinal 1085
Address 0x36c60

PssWalkMarkerSetPosition

Ordinal 1086
Address 0x36c70

PssWalkMarkerTell

Ordinal 1087
Address 0x36c50

PssWalkSnapshot

Ordinal 1088
Address 0x36c80

PulseEvent

Ordinal 1089
Address 0x1b6b0

PurgeComm

Ordinal 1090
Address 0x228c0

QueryActCtxSettingsW

Ordinal 1091
Address 0x36c90

QueryActCtxSettingsWWorker

Ordinal 1092
Address 0x10080

QueryActCtxW

Ordinal 1093
Address 0x1ce40

QueryActCtxWWorker

Ordinal 1094
Address 0xfa30

QueryDepthSList

Ordinal 1095
Address 0x9ac15
ForwardName NTDLL.RtlQueryDepthSList

QueryDosDeviceA

Ordinal 1096
Address 0x5d170

QueryDosDeviceW

Ordinal 1097
Address 0x22670

QueryFullProcessImageNameA

Ordinal 1098
Address 0x36ca0

QueryFullProcessImageNameW

Ordinal 1099
Address 0x1d8f0

QueryIdleProcessorCycleTime

Ordinal 1100
Address 0x20410

QueryIdleProcessorCycleTimeEx

Ordinal 1101
Address 0x36cb0

QueryInformationJobObject

Ordinal 1102
Address 0xf6c0

QueryIoRateControlInformationJobObject

Ordinal 1103
Address 0x55010

QueryMemoryResourceNotification

Ordinal 1104
Address 0x36cc0

QueryPerformanceCounter

Ordinal 1105
Address 0x16580

QueryPerformanceFrequency

Ordinal 1106
Address 0x1a530

QueryProcessAffinityUpdateMode

Ordinal 1107
Address 0x36cd0

QueryProcessCycleTime

Ordinal 1108
Address 0x20420

QueryProtectedPolicy

Ordinal 1109
Address 0x9ad9b
ForwardName api-ms-win-core-processthreads-l1-1-2.QueryProtectedPolicy

QueryThreadCycleTime

Ordinal 1110
Address 0x1360

QueryThreadProfiling

Ordinal 1111
Address 0x3e1e0

QueryThreadpoolStackInformation

Ordinal 1112
Address 0x36ce0

QueryUmsThreadInformation

Ordinal 1113
Address 0x3c730

QueryUnbiasedInterruptTime

Ordinal 1114
Address 0x1c880

QueueUserAPC

Ordinal 1115
Address 0x1d520

QueueUserWorkItem

Ordinal 1116
Address 0x1fb20

QuirkGetData2Worker

Ordinal 1117
Address 0x68170

QuirkGetDataWorker

Ordinal 1118
Address 0x68240

QuirkIsEnabled2Worker

Ordinal 1119
Address 0x68300

QuirkIsEnabled3Worker

Ordinal 1120
Address 0x16bd0

QuirkIsEnabledForPackage2Worker

Ordinal 1121
Address 0x68440

QuirkIsEnabledForPackage3Worker

Ordinal 1122
Address 0x5990

QuirkIsEnabledForPackage4Worker

Ordinal 1123
Address 0x5ae0

QuirkIsEnabledForPackageWorker

Ordinal 1124
Address 0x3570

QuirkIsEnabledForProcessWorker

Ordinal 1125
Address 0x68470

QuirkIsEnabledWorker

Ordinal 1126
Address 0x3620

RaiseException

Ordinal 1127
Address 0x1e490

RaiseFailFastException

Ordinal 1128
Address 0x9afa0
ForwardName kernelbase.RaiseFailFastException

RaiseInvalid16BitExeError

Ordinal 1129
Address 0x35d80

ReOpenFile

Ordinal 1130
Address 0x36d10

ReadConsoleA

Ordinal 1131
Address 0x22ae0

ReadConsoleInputA

Ordinal 1132
Address 0x22af0

ReadConsoleInputExA

Ordinal 1133
Address 0x9b01a
ForwardName kernelbase.ReadConsoleInputExA

ReadConsoleInputExW

Ordinal 1134
Address 0x9b04d
ForwardName kernelbase.ReadConsoleInputExW

ReadConsoleInputW

Ordinal 1135
Address 0x22b00

ReadConsoleOutputA

Ordinal 1136
Address 0x22c50

ReadConsoleOutputAttribute

Ordinal 1137
Address 0x22c60

ReadConsoleOutputCharacterA

Ordinal 1138
Address 0x22c70

ReadConsoleOutputCharacterW

Ordinal 1139
Address 0x22c80

ReadConsoleOutputW

Ordinal 1140
Address 0x22c90

ReadConsoleW

Ordinal 1141
Address 0x22b10

ReadDirectoryChangesExW

Ordinal 1142
Address 0x36d20

ReadDirectoryChangesW

Ordinal 1143
Address 0x219b0

ReadFile

Ordinal 1144
Address 0x22680

ReadFileEx

Ordinal 1145
Address 0x22690

ReadFileScatter

Ordinal 1146
Address 0x226a0

ReadProcessMemory

Ordinal 1147
Address 0x1b1c0

ReadThreadProfilingData

Ordinal 1148
Address 0x3e210

ReclaimVirtualMemory

Ordinal 1149
Address 0x9b195
ForwardName api-ms-win-core-memory-l1-1-2.ReclaimVirtualMemory

RegCloseKey

Ordinal 1150
Address 0x219c0

RegCopyTreeW

Ordinal 1151
Address 0x36d30

RegCreateKeyExA

Ordinal 1152
Address 0x36d40

RegCreateKeyExW

Ordinal 1153
Address 0x36d50

RegDeleteKeyExA

Ordinal 1154
Address 0x36d60

RegDeleteKeyExW

Ordinal 1155
Address 0x36d70

RegDeleteTreeA

Ordinal 1156
Address 0x36d80

RegDeleteTreeW

Ordinal 1157
Address 0x36d90

RegDeleteValueA

Ordinal 1158
Address 0x36da0

RegDeleteValueW

Ordinal 1159
Address 0x36db0

RegDisablePredefinedCacheEx

Ordinal 1160
Address 0x36dc0

RegEnumKeyExA

Ordinal 1161
Address 0x36dd0

RegEnumKeyExW

Ordinal 1162
Address 0x36e20

RegEnumValueA

Ordinal 1163
Address 0x36e70

RegEnumValueW

Ordinal 1164
Address 0x36ec0

RegFlushKey

Ordinal 1165
Address 0x36f10

RegGetKeySecurity

Ordinal 1166
Address 0x36f20

RegGetValueA

Ordinal 1167
Address 0x36f30

RegGetValueW

Ordinal 1168
Address 0x36f40

RegLoadKeyA

Ordinal 1169
Address 0x36f50

RegLoadKeyW

Ordinal 1170
Address 0x36f60

RegLoadMUIStringA

Ordinal 1171
Address 0x36f70

RegLoadMUIStringW

Ordinal 1172
Address 0x36f80

RegNotifyChangeKeyValue

Ordinal 1173
Address 0x36f90

RegOpenCurrentUser

Ordinal 1174
Address 0x20590

RegOpenKeyExA

Ordinal 1175
Address 0x36fa0

RegOpenKeyExW

Ordinal 1176
Address 0x1fc70

RegOpenUserClassesRoot

Ordinal 1177
Address 0x20560

RegQueryInfoKeyA

Ordinal 1178
Address 0x36fb0

RegQueryInfoKeyW

Ordinal 1179
Address 0x37030

RegQueryValueExA

Ordinal 1180
Address 0x370b0

RegQueryValueExW

Ordinal 1181
Address 0x370c0

RegRestoreKeyA

Ordinal 1182
Address 0x370d0

RegRestoreKeyW

Ordinal 1183
Address 0x370e0

RegSaveKeyExA

Ordinal 1184
Address 0x370f0

RegSaveKeyExW

Ordinal 1185
Address 0x37100

RegSetKeySecurity

Ordinal 1186
Address 0x37110

RegSetValueExA

Ordinal 1187
Address 0x37120

RegSetValueExW

Ordinal 1188
Address 0x37130

RegUnLoadKeyA

Ordinal 1189
Address 0x37140

RegUnLoadKeyW

Ordinal 1190
Address 0x37150

RegisterApplicationRecoveryCallback

Ordinal 1191
Address 0x1fe50

RegisterApplicationRestart

Ordinal 1192
Address 0x1bb40

RegisterBadMemoryNotification

Ordinal 1193
Address 0x37160

RegisterConsoleIME

Ordinal 1194
Address 0x61cc0

RegisterConsoleOS2

Ordinal 1195
Address 0x61ce0

RegisterConsoleVDM

Ordinal