Manalyze report for 183bebf0d0007b34a4c8d9ecaebcb94f

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	1989-Sep-10 06:58:46
Detected languages	English - United States
Debug artifacts	kernel32.pdb
CompanyName	Microsoft Corporation
FileDescription	Windows NT BASE API Client DLL
FileVersion	`10.0.17763.475 (WinBuild.160101.0800)`
InternalName	kernel32
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	kernel32
ProductName	Microsoft® Windows® Operating System
ProductVersion	`10.0.17763.475`

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`May have dropper capabilities: CurrentControlSet\Services`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: LdrLoadDll GetProcAddress LoadLibraryExA LoadLibraryExW LoadLibraryW LoadLibraryA` `Functions which can be used for anti-debugging purposes: NtQueryInformationProcess DbgPrint ZwQuerySystemInformation NtQuerySystemInformation SwitchToThread CheckRemoteDebuggerPresent` `Code injection capabilities: CreateRemoteThreadEx CreateRemoteThread OpenProcess VirtualAlloc WriteProcessMemory VirtualAllocEx VirtualAllocExNuma` `Code injection capabilities (process hollowing): ResumeThread SetThreadContext WriteProcessMemory` `Code injection capabilities (mapping injection): CreateRemoteThreadEx CreateRemoteThread CreateFileMappingNumaW MapViewOfFileEx MapViewOfFile CreateFileMappingW` Can access the registry: RegLoadAppKeyW RegUnLoadKeyW RegUnLoadKeyA RegSetValueExA RegSetKeySecurity RegSaveKeyExW RegSaveKeyExA RegRestoreKeyW RegRestoreKeyA RegQueryValueExW RegQueryValueExA RegQueryInfoKeyW RegQueryInfoKeyA RegOpenKeyExA RegNotifyChangeKeyValue RegOpenKeyExW RegGetValueW RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyExA RegDeleteKeyExW RegDeleteValueA RegDeleteValueW RegEnumKeyExA RegEnumKeyExW RegEnumValueA RegEnumValueW RegFlushKey RegGetKeySecurity RegGetValueA RegLoadKeyW RegSetValueExW RegLoadKeyA `Possibly launches other programs: CreateProcessInternalA CreateProcessInternalW CreateProcessAsUserW CreateProcessAsUserA CreateProcessA CreateProcessW` Uses Windows's Native API: NtEnumerateKey NtTerminateProcess NtMapUserPhysicalPagesScatter NtMapViewOfSection NtCreateSection NtDeleteValueKey NtSetValueKey NtQueryInstallUILanguage NtUnmapViewOfSection NtQueryInformationThread NtQueryEvent NtRaiseHardError NtQueryVolumeInformationFile NtReplacePartitionUnit NtQueryValueKey NtQueryInformationToken NtOpenProcessToken NtSetInformationThread NtOpenThreadToken NtOpenKey NtIsSystemResumeAutomatic NtInitiatePowerAction NtWaitForSingleObject NtCreateEvent NtFsControlFile NtOpenFile NtClose NtQueryInformationFile NtSetInformationFile NtSetInformationDebugObject NtSetSystemInformation NtQueryInformationProcess NtAddAtomEx NtFindAtom NtDeleteAtom NtQueryInformationAtom NtCreateKey NtFlushKey NtCreateFile NtQueryInformationJobObject NtCreateJobObject NtOpenJobObject NtAssignProcessToJobObject NtTerminateJobObject NtSetInformationJobObject NtCreateJobSet NtQueryEaFile NtQuerySecurityObject NtSetEaFile NtSetSecurityObject NtSetInformationProcess NtQuerySection NtEnumerateValueKey NtLockFile NtUnlockFile NtAllocateVirtualMemory NtReadFile NtWriteFile NtFreeVirtualMemory NtQueryVirtualMemory NtProtectVirtualMemory NtCreateMailslotFile NtQueryDirectoryFile NtGetDevicePowerState NtPowerInformation NtQueryWnfStateData NtSetThreadExecutionState NtQuerySystemEnvironmentValueEx NtSetSystemEnvironmentValueEx NtSetVolumeInformationFile NtDeviceIoControlFile NtQueryFullAttributesFile NtQueryAttributesFile NtQueryTimerResolution NtSetTimerResolution NtReadVirtualMemory NtWaitForMultipleObjects NtClearEvent NtApphelpCacheControl ZwClose ZwOpenFile ZwOpenKey ZwEnumerateKey ZwQueryValueKey ZwCreateFile ZwQueryInformationFile ZwCreateSection ZwQueryDirectoryFile ZwQuerySystemInformation ZwUnmapViewOfSection ZwMapViewOfSection NtQuerySystemInformation `Can create temporary files: CreateFileA CreateFileW GetTempPathW GetTempPathA` `Memory manipulation functions often used by packers: VirtualProtect VirtualAlloc VirtualProtectEx VirtualAllocEx` `Functions related to the privilege level: OpenProcessToken DuplicateToken` `Enumerates local disk drives: GetVolumeInformationW GetVolumeInformationByHandleW GetLogicalDriveStringsW GetDriveTypeW GetDriveTypeA GetVolumeInformationA` `Manipulates other processes: OpenProcess WriteProcessMemory ReadProcessMemory`
Info	The PE is digitally signed.	`Signer: Microsoft Windows` `Issuer: Microsoft Windows Production PCA 2011`
Safe	VirusTotal score: 0/69 (Scanned on 2019-10-04 11:04:04)	`All the AVs think this file is safe.`

Hashes

MD5	`183bebf0d0007b34a4c8d9ecaebcb94f`
SHA1	`8de080d3295fb21475715d4051ec9dbc3df972ba`
SHA256	`ec1426109420445df8e9799ac21a4c13364dc12229fb16197e428803bece1140`
SHA3	`8b1e5aaef9d830a9a8bc7b90b21f2683ff6cb99aff54cfece95431c6c84c722c`
SSDeep	`12288:nF8X3YIDFrfar9H2G4iBPM212lEfAF7ZOruJm6rH82/Sa/V:nOYID9farB0iyDkAFESVrH82/Sa/V`
Imports Hash	`5a2debb2344b5d6d1e742b407695a348`

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xe8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`6`
TimeDateStamp	1989-Sep-10 06:58:46
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x75200`
SizeOfInitializedData	`0x38e00`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x0000000000017A10 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x180000000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`A.0`
ImageVersion	`A.0`
SubsystemVersion	`A.0`
Win32VersionValue	`0`
SizeOfImage	`0xb3000`
SizeOfHeaders	`0x400`
Checksum	`0xb8f88`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_GUARD_CF` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x40000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`f3ea4d807b3643b0fd2d002606b80c11`
SHA1	`67e06ee6739cc6944ea73332e5beb61b0a9d7fa1`
SHA256	`cea8252f42daa23140d50c8508c7225992090093096203506415fbc7a4a17eaf`
SHA3	`30f60dd80780b02a1d729f38061e13fc555421a70272755a7c46f2681433e759`
VirtualSize	`0x7518c`
VirtualAddress	`0x1000`
SizeOfRawData	`0x75200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.41067`

.rdata

MD5	`35b6a66a5eabf3e1258d4a4d05bf6023`
SHA1	`eaf3e7048adb732198c3bc4dfba85803b583a76d`
SHA256	`4d927e4fb9f95f117cd935b9d97078ac1f6f057d9f490425298113dd32771792`
SHA3	`ecd030135ca3dbcec1f78bd8ce7921c3c891bb3602562f2fc1cf021b70ce24e9`
VirtualSize	`0x31be6`
VirtualAddress	`0x77000`
SizeOfRawData	`0x31c00`
PointerToRawData	`0x75600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.68065`

.data

MD5	`b723b1d36bc84f3ab776355622258ae1`
SHA1	`3d51dc28ced2d9c0d8aa567847eb645405107809`
SHA256	`12076f0a435c76ff84ff99f0b1c61175f9edf32a01ff8cdb2acb1cf4af3f0698`
SHA3	`fae306d8c77aa0dddc83ef7abe83c4a99137da64f15507789fc11f2d8a357df8`
VirtualSize	`0x10fc`
VirtualAddress	`0xa9000`
SizeOfRawData	`0x600`
PointerToRawData	`0xa7200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`2.62119`

.pdata

MD5	`3b59b791daad0d2464db645104d149e1`
SHA1	`ed7f90e079cde19b8a8a6a7bd341ed7fd81895e3`
SHA256	`0cb4e70f35dc986101a33aedbf2335dabeb962000b3bd191580f309153a83264`
SHA3	`c677169496b0f03b7888a872a86e6a8439a522c7ff603b3c390b2bd3cdf83a32`
VirtualSize	`0x5454`
VirtualAddress	`0xab000`
SizeOfRawData	`0x5600`
PointerToRawData	`0xa7800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.80805`

.rsrc

MD5	`95a3d235010cbcfd3d15f9e8597f75bc`
SHA1	`b6f23084eaa15a263e176432e21555854e46ecaa`
SHA256	`a5deea12cbe0a997a72c9a9f5765d0bff82b23629badf76e3a2de9020fe21d6b`
SHA3	`a2248b61909b123dfaa3e900322ca8a133e1beca00da9b8eaa3ea4fe75c82b08`
VirtualSize	`0x520`
VirtualAddress	`0xb1000`
SizeOfRawData	`0x600`
PointerToRawData	`0xace00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`2.99838`

.reloc

MD5	`60385b7df05850ab2401eb268b63921d`
SHA1	`ee303f226c5775f4253fbc0344522f2c2dfbf350`
SHA256	`0c2a3588a446006b6a929a8420d052e146d43efe4b0cb36c8237a2a7b133d321`
SHA3	`7b7dac2bd34c7b3fae8ab77b62b4f53392a7874a8bee8e78878979d35f6ba247`
VirtualSize	`0x24c`
VirtualAddress	`0xb2000`
SizeOfRawData	`0x400`
PointerToRawData	`0xad400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`3.89605`

Imports

api-ms-win-core-rtlsupport-l1-1-0.dll	`RtlPcToFileHeader` `RtlCaptureContext` `RtlRaiseException` `RtlVirtualUnwind` `RtlUnwindEx` `RtlRestoreContext` `RtlLookupFunctionEntry` `RtlInstallFunctionTableCallback` `RtlCompareMemory` `RtlDeleteFunctionTable` `RtlAddFunctionTable` `RtlCaptureStackBackTrace` `RtlUnwind`
ntdll.dll	`RtlSizeHeap` `RtlLCIDToCultureName` `RtlUnicodeStringToInteger` `_wcslwr` `RtlGetUILanguageInfo` `EtwEventEnabled` `RtlpConvertLCIDsToCultureNames` `NtEnumerateKey` `RtlIntegerToUnicodeString` `RtlTimeToTimeFields` `RtlTimeFieldsToTime` `RtlUnhandledExceptionFilter` `NtTerminateProcess` `wcsncmp` `wcsncpy` `LdrFindResourceEx_U` `RtlReadThreadProfilingData` `RtlQueryThreadProfiling` `RtlDisableThreadProfiling` `RtlNtStatusToDosErrorNoTeb` `RtlEnableThreadProfiling` `NtMapUserPhysicalPagesScatter` `RtlDecodeSystemPointer` `bsearch` `RtlComputeImportTableHash` `RtlFindActivationContextSectionGuid` `RtlQueryActivationContextApplicationSettings` `RtlSubAuthorityCountSid` `LdrResFindResourceDirectory` `RtlQueryInformationActivationContext` `RtlSetThreadPreferredUILanguages` `RtlMultiAppendUnicodeStringBuffer` `swprintf_s` `RtlImageNtHeaderEx` `NtMapViewOfSection` `NtCreateSection` `RtlDosPathNameToNtPathName_U_WithStatus` `RtlGetActiveActivationContext` `RtlDeactivateActivationContext` `TpAllocPool` `TpSetPoolMinThreads` `TpSetPoolStackInformation` `TpAllocWait` `NtDeleteValueKey` `NtSetValueKey` `towlower` `memmove_s` `RtlGUIDFromString` `sin` `TpAllocTimer` `RtlpConvertCultureNamesToLCIDs` `NtQueryInstallUILanguage` `EtwEventUnregister` `EtwEventWrite` `EtwEventRegister` `RtlExpandEnvironmentStrings_U` `RtlPublishWnfStateData` `TpAllocIoCompletion` `RtlActivateActivationContext` `RtlZombifyActivationContext` `RtlReleaseActivationContext` `RtlAddRefActivationContext` `RtlCreateActivationContext` `RtlGetLengthWithoutLastFullDosOrNtPathElement` `RtlpApplyLengthFunction` `RtlGetFullPathName_U` `RtlDoesFileExists_U` `RtlDetermineDosPathNameType_U` `RtlpEnsureBufferSize` `DbgPrintEx` `NtUnmapViewOfSection` `RtlQueryPackageClaims` `tolower` `atol` `toupper` `isdigit` `NtQueryInformationThread` `RtlEnterUmsSchedulingMode` `RtlCreateUmsThreadContext` `RtlDeleteUmsThreadContext` `RtlSetUmsThreadInformation` `RtlQueryUmsThreadInformation` `RtlGetNextUmsListItem` `RtlGetCurrentUmsThread` `RtlDeleteUmsCompletionList` `RtlUmsThreadYield` `TpQueryPoolStackInformation` `RtlGetUmsCompletionListEvent` `RtlDequeueUmsCompletionListItems` `RtlCreateUmsCompletionList` `RtlDestroyEnvironment` `RtlCreateEnvironmentEx` `RtlCreateEnvironment` `NtQueryEvent` `RtlCreateUnicodeString` `NtRaiseHardError` `RtlFreeAnsiString` `RtlFreeOemString` `RtlGetCurrentDirectory_U` `wcsrchr` `_wcsnicmp` `RtlUnicodeStringToOemString` `NtQueryVolumeInformationFile` `CsrFreeCaptureBuffer` `CsrAllocateMessagePointer` `CsrAllocateCaptureBuffer` `RtlEqualUnicodeString` `RtlUnicodeStringToAnsiString` `RtlWow64SuspendThread` `RtlWow64SetThreadContext` `RtlWow64GetThreadContext` `RtlExitUserThread` `RtlAddIntegrityLabelToBoundaryDescriptor` `RtlQueryProtectedPolicy` `NtReplacePartitionUnit` `RtlCompareUnicodeString` `RtlExitUserProcess` `RtlInitUnicodeStringEx` `RtlQueryPackageIdentity` `EtwEventWriteNoRegistration` `RtlWow64LogMessageInEventLogger` `LdrUnloadDll` `LdrGetProcedureAddress` `LdrLoadDll` `RtlAppendUnicodeToString` `RtlAppendUnicodeStringToString` `RtlFormatCurrentUserKeyPath` `NtQueryValueKey` `RtlEqualSid` `RtlSubAuthoritySid` `RtlInitializeSid` `NtQueryInformationToken` `NtOpenProcessToken` `NtSetInformationThread` `NtOpenThreadToken` `RtlReleaseSRWLockExclusive` `RtlQueryRegistryValuesEx` `NtOpenKey` `RtlAcquireSRWLockExclusive` `RtlAnsiStringToUnicodeString` `RtlxAnsiStringToUnicodeSize` `RtlInitAnsiStringEx` `NtIsSystemResumeAutomatic` `NtInitiatePowerAction` `RtlIsNameLegalDOS8Dot3` `RtlGetCurrentProcessorNumberEx` `NtWaitForSingleObject` `NtCreateEvent` `RtlSetSearchPathMode` `LdrGetDllDirectory` `RtlUnlockHeap` `RtlGetUserInfoHeap` `RtlLockHeap` `RtlDeregisterSecureMemoryCacheCallback` `RtlRegisterSecureMemoryCacheCallback` `RtlCompactHeap` `NtFsControlFile` `NtOpenFile` `NtClose` `LdrAddRefDll` `NtQueryInformationFile` `NtSetInformationFile` `wcscpy_s` `RtlGetActiveConsoleId` `RtlDeactivateActivationContextUnsafeFast` `RtlActivateActivationContextUnsafeFast` `RtlNtStatusToDosError` `RtlFreeUnicodeString` `RtlWow64GetThreadSelectorEntry` `NtSetInformationDebugObject` `DbgUiGetThreadDebugObject` `DbgUiIssueRemoteBreakin` `NtSetSystemInformation` `NtQueryInformationProcess` `RtlSetCurrentTransaction` `RtlGetCurrentTransaction` `RtlSetLastWin32Error` `CsrClientCallServer` `LdrDisableThreadCalloutsForDll` `RtlGetSuiteMask` `LdrQueryImageFileExecutionOptions` `RtlInitUnicodeString` `_vsnwprintf` `RtlSetProtectedPolicy` `LdrSetDllManifestProber` `TpSimpleTryPost` `TpAllocCleanupGroup` `RtlSetLastWin32ErrorAndNtStatusFromNtStatus` `_wtol` `TpCallbackMayRunLong` `RtlExecuteUmsThread` `TpAllocWork` `CsrVerifyRegion` `RtlCharToInteger` `RtlInitAnsiString` `RtlUpcaseUnicodeChar` `RtlUnicodeToMultiByteSize` `RtlCreateAtomTable` `RtlDestroyAtomTable` `RtlAddAtomToAtomTable` `NtAddAtomEx` `RtlLookupAtomInAtomTable` `NtFindAtom` `RtlDeleteAtomFromAtomTable` `NtDeleteAtom` `RtlQueryAtomInAtomTable` `NtQueryInformationAtom` `NtCreateKey` `NtFlushKey` `_memicmp` `wcscspn` `wcsncpy_s` `RtlEnterCriticalSection` `RtlLeaveCriticalSection` `RtlxUnicodeStringToAnsiSize` `RtlDnsHostNameToComputerName` `RtlCreateUnicodeStringFromAsciiz` `RtlPrefixString` `wcsstr` `wcschr` `NtCreateFile` `NtQueryInformationJobObject` `NtCreateJobObject` `NtOpenJobObject` `NtAssignProcessToJobObject` `NtTerminateJobObject` `RtlAcquirePrivilege` `NtSetInformationJobObject` `RtlReleasePrivilege` `NtCreateJobSet` `NtQueryEaFile` `NtQuerySecurityObject` `RtlLengthSecurityDescriptor` `NtSetEaFile` `NtSetSecurityObject` `NtSetInformationProcess` `RtlQueryElevationFlags` `NtQuerySection` `LdrOpenImageFileOptionsKey` `LdrQueryImageFileKeyOption` `RtlRaiseStatus` `strncpy_s` `CsrCaptureMessageString` `RtlGetLongestNtPathLength` `RtlUnicodeToMultiByteN` `RtlMultiByteToUnicodeN` `RtlMultiByteToUnicodeSize` `RtlPrefixUnicodeString` `NtEnumerateValueKey` `RtlCopyUnicodeString` `RtlDosPathNameToNtPathName_U` `NtLockFile` `NtUnlockFile` `NtAllocateVirtualMemory` `NtReadFile` `RtlIsTextUnicode` `NtWriteFile` `NtFreeVirtualMemory` `RtlEqualString` `RtlDosPathNameToRelativeNtPathName_U` `RtlReleaseRelativeName` `RtlRegisterWait` `RtlDeregisterWait` `RtlSetIoCompletionCallback` `NtQueryVirtualMemory` `RtlImageDirectoryEntryToData` `NtProtectVirtualMemory` `RtlCreateBoundaryDescriptor` `RtlGetThreadErrorMode` `NtCreateMailslotFile` `RtlDestroyQueryDebugBuffer` `RtlCreateQueryDebugBuffer` `RtlQueryProcessDebugInformation` `NtQueryDirectoryFile` `strcpy_s` `RtlFindActivationContextSectionString` `LdrSetDllDirectory` `RtlSwitchedVVI` `LdrFindResource_U` `NtGetDevicePowerState` `NtPowerInformation` `NtQueryWnfStateData` `NtSetThreadExecutionState` `RtlInitString` `NtQuerySystemEnvironmentValueEx` `NtSetSystemEnvironmentValueEx` `NtSetVolumeInformationFile` `NtDeviceIoControlFile` `RtlIsValidHandle` `RtlSetUserValueHeap` `RtlReAllocateHeap` `RtlAllocateHandle` `RtlFreeHandle` `RtlQueryWnfStateData` `RtlSubscribeWnfStateChangeNotification` `RtlUnsubscribeWnfStateChangeNotification` `strchr` `RtlOemStringToUnicodeString` `RtlSetEnvironmentStrings` `RtlAllocateAndInitializeSid` `RtlFreeSid` `NtQueryFullAttributesFile` `NtQueryAttributesFile` `strrchr` `RtlQueryEnvironmentVariable_U` `wcscat_s` `TpCaptureCaller` `RtlWow64EnableFsRedirection` `_stricmp` `NtQueryTimerResolution` `NtSetTimerResolution` `RtlConvertSidToUnicodeString` `RtlGetAppContainerSidType` `RtlQueryEnvironmentVariable` `RtlGetAppContainerParent` `RtlSetEnvironmentVariable` `CsrCaptureMessageMultiUnicodeStringsInPlace` `wcsnlen` `strcat_s` `strnlen` `NlsMbCodePageTag` `RtlRunOnceExecuteOnce` `RtlInitializeCriticalSection` `RtlGetThreadPreferredUILanguages` `NtReadVirtualMemory` `LdrResSearchResource` `_strnicmp` `strncmp` `RtlTryAcquirePebLock` `RtlReleasePebLock` `RtlEncodeSystemPointer` `RtlGetNtSystemRoot` `NtWaitForMultipleObjects` `NtClearEvent` `RtlWerpReportException` `DbgPrint` `RtlGetDeviceFamilyInfoEnum` `RtlHashUnicodeString` `NtApphelpCacheControl` `RtlGetFullPathName_UEx` `ZwClose` `ZwOpenFile` `ZwOpenKey` `ZwEnumerateKey` `ZwQueryValueKey` `ZwCreateFile` `ZwQueryInformationFile` `ZwCreateSection` `ZwQueryDirectoryFile` `RtlNtPathNameToDosPathName` `RtlGetNativeSystemInformation` `ZwQuerySystemInformation` `ZwUnmapViewOfSection` `ZwMapViewOfSection` `VerSetConditionMask` `RtlVerifyVersionInfo` `RtlGetVersion` `RtlGetCurrentServiceSessionId` `RtlSetThreadPoolStartFunc` `RtlImageNtHeader` `NtQuerySystemInformation` `RtlFreeHeap` `RtlSetDaclSecurityDescriptor` `RtlSetGroupSecurityDescriptor` `RtlSetOwnerSecurityDescriptor` `RtlCreateSecurityDescriptor` `RtlAddAccessAllowedAce` `RtlCreateAcl` `RtlAllocateHeap` `_wcsicmp` `__C_specific_handler` `memmove` `_local_unwind` `cos` `floor` `memcmp` `memcpy` `memset` `wcscmp`
KERNELBASE.dll	`PrivCopyFileExW` `AppXReleaseAppXContext` `AreFileApisANSI` `CreateProcessInternalA` `CreateProcessInternalW` `CreateProcessAsUserW` `CreateProcessAsUserA` `EnumLanguageGroupLocalesW` `BaseFormatObjectAttributes` `GetVolumeNameForVolumeMountPointW` `lstrcmpW` `lstrcmpiW` `GetRegistryExtensionFlags` `KernelBaseGetGlobalData` `GlobalFree` `LoadStringBaseExW` `GetUnicodeStringToEightBitStringRoutine` `GetUnicodeStringToEightBitSizeRoutine` `CompareStringA` `GetNamedPipeAttribute` `PackageIdFromFullName` `GetPackageFullName` `GetCurrentPackageFullName` `ClosePackageInfo` `AppXGetOSMaxVersionTested` `GetPackageTargetPlatformProperty` `GetTargetPlatformContext` `OpenPackageInfoByFullNameForUser` `AppXPreCreationExtension` `EnumSystemLanguageGroupsW` `AppContainerFreeMemory` `AppContainerLookupMoniker` `BasepNotifyTrackingService` `MoveFileWithProgressTransactedW` `BasepAdjustObjectAttributesForPrivateNamespace` `GetEightBitStringToUnicodeStringRoutine` `GetStringTableEntry` `CheckGroupPolicyEnabled` `OpenRegKey` `InternalLcidToName` `NlsIsUserDefaultLocale` `GetPtrCalDataArray` `GetUserOverrideString` `GetPtrCalData` `Internal_EnumCalendarInfo` `Internal_EnumLanguageGroupLocales` `Internal_EnumSystemCodePages` `Internal_EnumDateFormats` `Internal_EnumUILanguages` `Internal_EnumSystemLanguageGroups` `NlsValidateLocale` `Internal_EnumTimeFormats` `GetNamedLocaleHashNode` `GetUserOverrideWord` `GetLocaleInfoHelper` `GetCalendar` `BaseDllFreeResourceId` `BaseDllMapResourceIdW` `CheckAllowDecryptedRemoteDestinationPolicy` `EnumSystemLocalesEx` `NotifyMountMgr` `LCIDToLocaleName` `GetUserDefaultLocaleName` `GetSystemDefaultLocaleName` `GetEraNameCountedString` `FatalAppExitW` `FatalAppExitA` `lstrlenW` `lstrlenA` `lstrcpynW` `lstrcpynA` `Sleep` `SetFileApisToOEM` `SetFileApisToANSI` `PulseEvent` `MapViewOfFileExNuma` `LocalUnlock` `LocalReAlloc` `LocalLock` `LocalAlloc` `HeapSummary` `GlobalAlloc` `GetUserDefaultUILanguage` `GetSystemDefaultUILanguage` `GetStringTypeA` `GetProcAddressForCaller` `BaseGetNamedObjectDirectory` `EnumUILanguagesW` `AppXPostSuccessExtension`
api-ms-win-core-processthreads-l1-1-0.dll	`ResumeThread` `QueueUserAPC` `ProcessIdToSessionId` `OpenThread` `GetStartupInfoW` `SetPriorityClass` `SetProcessShutdownParameters` `GetProcessTimes` `GetCurrentProcess` `GetCurrentProcessId` `GetThreadPriorityBoost` `GetThreadPriority` `GetProcessId` `SetThreadPriority` `GetProcessIdOfThread` `OpenProcessToken` `GetExitCodeProcess` `GetPriorityClass` `CreateProcessA` `CreateProcessW` `CreateRemoteThreadEx` `GetExitCodeThread` `SetThreadPriorityBoost` `SetThreadStackGuarantee` `SuspendThread` `SwitchToThread` `TlsFree` `DeleteProcThreadAttributeList` `UpdateProcThreadAttribute` `InitializeProcThreadAttributeList` `CreateRemoteThread` `TerminateProcess` `TerminateThread` `TlsAlloc` `GetProcessVersion` `QueryProcessAffinityUpdateMode` `SetProcessAffinityUpdateMode` `TlsSetValue` `GetThreadId`
api-ms-win-core-processthreads-l1-1-3.dll	`SetThreadIdealProcessor` `GetProcessInformation` `SetProcessInformation` `GetProcessShutdownParameters`
api-ms-win-core-processthreads-l1-1-2.dll	`SetThreadInformation` `GetProcessPriorityBoost` `SetProcessPriorityBoost` `GetThreadIOPendingFlag` `GetSystemTimes` `GetThreadInformation`
api-ms-win-core-processthreads-l1-1-1.dll	`FlushInstructionCache` `SetProcessMitigationPolicy` `GetProcessHandleCount` `GetProcessMitigationPolicy` `SetThreadIdealProcessorEx` `IsProcessorFeaturePresent` `OpenProcess` `GetThreadTimes` `GetThreadContext` `SetThreadContext` `GetThreadIdealProcessorEx`
api-ms-win-core-registry-l1-1-0.dll	`RegLoadAppKeyW` `RegUnLoadKeyW` `RegUnLoadKeyA` `RegSetValueExA` `RegSetKeySecurity` `RegSaveKeyExW` `RegSaveKeyExA` `RegRestoreKeyW` `RegRestoreKeyA` `RegQueryValueExW` `RegQueryValueExA` `RegQueryInfoKeyW` `RegQueryInfoKeyA` `RegOpenUserClassesRoot` `RegOpenKeyExA` `RegOpenCurrentUser` `RegNotifyChangeKeyValue` `RegOpenKeyExW` `RegGetValueW` `RegCloseKey` `RegCopyTreeW` `RegCreateKeyExA` `RegCreateKeyExW` `RegDeleteKeyExA` `RegDeleteKeyExW` `RegDeleteTreeA` `RegDeleteTreeW` `RegDeleteValueA` `RegDeleteValueW` `RegDisablePredefinedCacheEx` `RegEnumKeyExA` `RegEnumKeyExW` `RegEnumValueA` `RegEnumValueW` `RegFlushKey` `RegGetKeySecurity` `RegGetValueA` `RegLoadMUIStringW` `RegLoadMUIStringA` `RegLoadKeyW` `RegSetValueExW` `RegLoadKeyA`
api-ms-win-core-heap-l1-1-0.dll	`HeapUnlock` `GetProcessHeaps` `HeapCreate` `GetProcessHeap` `HeapAlloc` `HeapDestroy` `HeapLock` `HeapQueryInformation` `HeapFree` `HeapValidate` `HeapSetInformation` `HeapWalk` `HeapCompact` `HeapReAlloc`
api-ms-win-core-heap-l2-1-0.dll	`LocalFree`
api-ms-win-core-memory-l1-1-1.dll	`QueryMemoryResourceNotification` `VirtualLock` `VirtualUnlock` `GetWriteWatch` `SetSystemFileCacheSize` `GetProcessWorkingSetSizeEx` `GetLargePageMinimum` `ResetWriteWatch` `CreateMemoryResourceNotification` `GetSystemFileCacheSize` `CreateFileMappingNumaW` `SetProcessWorkingSetSizeEx`
api-ms-win-core-memory-l1-1-0.dll	`VirtualQuery` `VirtualProtect` `OpenFileMappingW` `VirtualFreeEx` `VirtualFree` `VirtualAlloc` `UnmapViewOfFile` `VirtualQueryEx` `MapViewOfFileEx` `WriteProcessMemory` `MapViewOfFile` `FlushViewOfFile` `ReadProcessMemory` `CreateFileMappingW` `VirtualProtectEx` `VirtualAllocEx`
api-ms-win-core-memory-l1-1-2.dll	`RegisterBadMemoryNotification` `AllocateUserPhysicalPagesNuma` `GetMemoryErrorHandlingCapabilities` `FreeUserPhysicalPages` `VirtualAllocExNuma` `UnregisterBadMemoryNotification` `AllocateUserPhysicalPages` `MapUserPhysicalPages`
api-ms-win-core-handle-l1-1-0.dll	`GetHandleInformation` `DuplicateHandle` `CloseHandle` `SetHandleInformation`
api-ms-win-core-synch-l1-1-0.dll	`CreateMutexExW` `CreateMutexW` `CreateSemaphoreExW` `CreateWaitableTimerExW` `InitializeCriticalSectionAndSpinCount` `InitializeCriticalSectionEx` `OpenEventA` `OpenEventW` `OpenMutexW` `OpenSemaphoreW` `OpenWaitableTimerW` `ReleaseMutex` `CreateMutexA` `CreateEventW` `CreateEventExW` `CreateEventExA` `CreateEventA` `CancelWaitableTimer` `DeleteCriticalSection` `LeaveCriticalSection` `CreateMutexExA` `ReleaseSemaphore` `ResetEvent` `SetEvent` `SetWaitableTimer` `SleepEx` `WaitForMultipleObjectsEx` `WaitForSingleObject` `WaitForSingleObjectEx` `EnterCriticalSection` `InitializeCriticalSection`
api-ms-win-core-synch-l1-2-1.dll	`WaitForMultipleObjects` `CreateSemaphoreW`
api-ms-win-core-synch-l1-2-0.dll	`InitOnceExecuteOnce` `SignalObjectAndWait` `EnterSynchronizationBarrier` `InitializeSynchronizationBarrier` `DeleteSynchronizationBarrier`
api-ms-win-core-file-l1-1-0.dll	`FindNextChangeNotification` `FindFirstVolumeW` `FindFirstFileW` `FindFirstFileExW` `FindFirstFileExA` `FindFirstFileA` `LockFile` `LockFileEx` `QueryDosDeviceW` `FindFirstChangeNotificationW` `FindFirstChangeNotificationA` `LocalFileTimeToFileTime` `GetVolumePathNameW` `GetVolumeInformationW` `GetVolumeInformationByHandleW` `GetTempFileNameW` `GetLogicalDriveStringsW` `GetFullPathNameW` `GetFullPathNameA` `GetFinalPathNameByHandleW` `GetFinalPathNameByHandleA` `GetFileType` `GetFileTime` `GetFileSizeEx` `GetFileSize` `GetFileInformationByHandle` `GetFileAttributesW` `GetFileAttributesExW` `GetFileAttributesExA` `CompareFileTime` `FindNextFileA` `CreateDirectoryW` `CreateFileA` `CreateFileW` `DefineDosDeviceW` `DeleteFileA` `ReadFile` `ReadFileEx` `ReadFileScatter` `RemoveDirectoryA` `RemoveDirectoryW` `SetEndOfFile` `SetFileAttributesA` `SetFileAttributesW` `SetFileInformationByHandle` `SetFilePointer` `SetFilePointerEx` `SetFileTime` `SetFileValidData` `UnlockFile` `UnlockFileEx` `WriteFile` `WriteFileEx` `WriteFileGather` `DeleteFileW` `DeleteVolumeMountPointW` `FileTimeToLocalFileTime` `FindClose` `FindCloseChangeNotification` `FindNextFileW` `FindNextVolumeW` `FindVolumeClose` `FlushFileBuffers` `GetDiskFreeSpaceA` `GetDiskFreeSpaceExA` `GetFileAttributesA` `GetDiskFreeSpaceExW` `GetDriveTypeW` `GetDiskFreeSpaceW` `CreateDirectoryA` `GetDriveTypeA`
api-ms-win-core-file-l1-2-0.dll	`CreateFile2` `GetTempPathW` `GetVolumePathNamesForVolumeNameW`
api-ms-win-core-file-l1-2-2.dll	`FindFirstFileNameW` `FindNextFileNameW` `GetVolumeInformationA` `GetTempFileNameA` `GetTempPathA` `FindFirstStreamW`
api-ms-win-core-file-l1-2-1.dll	`GetCompressedFileSizeA` `GetCompressedFileSizeW` `SetFileIoOverlappedRange`
api-ms-win-core-delayload-l1-1-0.dll	`DelayLoadFailureHook`
api-ms-win-core-io-l1-1-0.dll	`DeviceIoControl` `CancelIoEx` `CreateIoCompletionPort` `PostQueuedCompletionStatus` `GetQueuedCompletionStatusEx` `GetOverlappedResult` `GetQueuedCompletionStatus`
api-ms-win-core-io-l1-1-1.dll	`CancelIo` `CancelSynchronousIo`
api-ms-win-core-job-l1-1-0.dll	`IsProcessInJob`
api-ms-win-core-threadpool-legacy-l1-1-0.dll	`UnregisterWaitEx` `DeleteTimerQueueEx` `QueueUserWorkItem` `DeleteTimerQueueTimer` `CreateTimerQueue` `CreateTimerQueueTimer` `ChangeTimerQueueTimer`
api-ms-win-core-threadpool-private-l1-1-0.dll	`RegisterWaitForSingleObjectEx`
api-ms-win-core-largeinteger-l1-1-0.dll	`MulDiv`
api-ms-win-core-libraryloader-l1-2-2.dll	`EnumResourceNamesW`
api-ms-win-core-libraryloader-l1-2-0.dll	`GetProcAddress` `FreeLibrary` `EnumResourceTypesExW` `EnumResourceTypesExA` `EnumResourceNamesExA` `EnumResourceLanguagesExW` `EnumResourceLanguagesExA` `FreeLibraryAndExitThread` `DisableThreadLibraryCalls` `EnumResourceNamesExW` `FindResourceExW` `GetModuleFileNameA` `FindStringOrdinal` `FreeResource` `SizeofResource` `LockResource` `LoadResource` `LoadLibraryExA` `LoadLibraryExW` `GetModuleHandleExW` `GetModuleHandleExA` `GetModuleHandleW` `GetModuleHandleA` `GetModuleFileNameW`
api-ms-win-core-libraryloader-l1-2-1.dll	`LoadLibraryW` `FindResourceW` `LoadLibraryA`
api-ms-win-core-libraryloader-l2-1-0.dll	`LoadPackagedLibrary`
api-ms-win-core-namedpipe-l1-2-2.dll	`CallNamedPipeW`
api-ms-win-core-namedpipe-l1-1-0.dll	`WaitNamedPipeW` `DisconnectNamedPipe` `CreatePipe` `CreateNamedPipeW` `ConnectNamedPipe` `PeekNamedPipe` `TransactNamedPipe` `GetNamedPipeClientComputerNameW` `SetNamedPipeHandleState`
api-ms-win-core-namedpipe-l1-2-1.dll	`GetNamedPipeHandleStateW`
api-ms-win-core-datetime-l1-1-0.dll	`GetTimeFormatW` `GetDateFormatW` `GetTimeFormatA` `GetDateFormatA`
api-ms-win-core-datetime-l1-1-1.dll	`GetDateFormatEx` `GetTimeFormatEx`
api-ms-win-core-datetime-l1-1-2.dll	`GetDurationFormatEx`
api-ms-win-core-sysinfo-l1-2-0.dll	`EnumSystemFirmwareTables` `GetSystemTimePreciseAsFileTime` `GetProductInfo` `SetComputerNameExW` `SetSystemTime` `GetSystemFirmwareTable` `GetNativeSystemInfo`
api-ms-win-core-sysinfo-l1-1-0.dll	`SetLocalTime` `GetLogicalProcessorInformation` `GetTickCount` `GlobalMemoryStatusEx` `GetWindowsDirectoryW` `GetWindowsDirectoryA` `GetVersionExW` `GetVersionExA` `GetVersion` `GetSystemTimeAsFileTime` `GetSystemTimeAdjustment` `GetLogicalProcessorInformationEx` `GetSystemInfo` `GetSystemTime` `GetComputerNameExA` `GetLocalTime` `GetComputerNameExW`
api-ms-win-core-sysinfo-l1-2-3.dll	`SetComputerNameExA` `SetComputerNameW` `SetComputerNameA`
api-ms-win-core-sysinfo-l1-2-1.dll	`DnsHostnameToComputerNameExW` `GetPhysicallyInstalledSystemMemory` `SetComputerNameEx2W`
api-ms-win-core-timezone-l1-1-0.dll	`GetDynamicTimeZoneInformation` `TzSpecificLocalTimeToSystemTime` `SetDynamicTimeZoneInformation` `SystemTimeToFileTime` `GetTimeZoneInformationForYear` `GetTimeZoneInformation` `FileTimeToSystemTime` `SetTimeZoneInformation` `SystemTimeToTzSpecificLocalTime`
api-ms-win-core-localization-l1-2-0.dll	`GetSystemPreferredUILanguages` `GetThreadPreferredUILanguages` `SetThreadLocale` `ConvertDefaultLocale` `VerLanguageNameW` `SetProcessPreferredUILanguages` `GetThreadUILanguage` `GetUILanguageInfo` `FindNLSString` `IdnToAscii` `IdnToUnicode` `IsValidLocaleName` `LCMapStringEx` `GetFileMUIInfo` `GetLocaleInfoA` `GetFileMUIPath` `GetLocaleInfoW` `GetNLSVersionEx` `GetOEMCP` `GetProcessPreferredUILanguages` `GetUserPreferredUILanguages` `GetSystemDefaultLangID` `GetLocaleInfoEx` `SetThreadUILanguage` `SetThreadPreferredUILanguages` `IsValidNLSVersion` `GetNLSVersion` `GetSystemDefaultLCID` `GetThreadLocale` `GetUserDefaultLangID` `GetUserDefaultLCID` `IsDBCSLeadByte` `IsDBCSLeadByteEx` `IsNLSDefinedString` `IsValidCodePage` `IsValidLanguageGroup` `IsValidLocale` `LCMapStringA` `LCMapStringW` `SetCalendarInfoW` `SetLocaleInfoW` `VerLanguageNameA` `GetCPInfoExW` `ResolveLocaleName` `LocaleNameToLCID` `GetCPInfo` `GetACP` `FormatMessageW` `FormatMessageA` `EnumSystemLocalesW` `EnumSystemLocalesA` `GetCalendarInfoW` `GetCalendarInfoEx` `FindNLSStringEx`
api-ms-win-core-processsnapshot-l1-1-0.dll	`PssWalkMarkerSeekToBeginning` `PssWalkMarkerSetPosition` `PssQuerySnapshot` `PssWalkMarkerFree` `PssWalkMarkerCreate` `PssDuplicateSnapshot` `PssWalkSnapshot` `PssCaptureSnapshot` `PssFreeSnapshot` `PssWalkMarkerGetPosition`
api-ms-win-core-processenvironment-l1-1-0.dll	`GetEnvironmentStringsW` `GetCurrentDirectoryW` `GetCurrentDirectoryA` `GetCommandLineW` `SetCurrentDirectoryA` `SetCurrentDirectoryW` `SetEnvironmentVariableA` `GetEnvironmentVariableA` `SetStdHandle` `SetStdHandleEx` `ExpandEnvironmentStringsW` `ExpandEnvironmentStringsA` `FreeEnvironmentStringsA` `GetStdHandle` `GetEnvironmentVariableW` `SearchPathW` `GetEnvironmentStrings` `FreeEnvironmentStringsW` `GetCommandLineA` `SetEnvironmentVariableW` `SetEnvironmentStringsW`
api-ms-win-core-processenvironment-l1-2-0.dll	`NeedCurrentDirectoryForExePathA` `NeedCurrentDirectoryForExePathW` `SearchPathA`
api-ms-win-core-string-l1-1-0.dll	`CompareStringOrdinal` `WideCharToMultiByte` `MultiByteToWideChar` `GetStringTypeW` `GetStringTypeExW` `FoldStringW` `CompareStringW` `CompareStringEx`
api-ms-win-core-debug-l1-1-1.dll	`DebugActiveProcess` `WaitForDebugEvent` `ContinueDebugEvent` `CheckRemoteDebuggerPresent` `DebugActiveProcessStop`
api-ms-win-core-debug-l1-1-0.dll	`OutputDebugStringA` `OutputDebugStringW` `IsDebuggerPresent` `DebugBreak`
api-ms-win-core-errorhandling-l1-1-0.dll	`SetLastError` `GetLastError` `GetErrorMode` `UnhandledExceptionFilter` `SetUnhandledExceptionFilter` `SetErrorMode` `RaiseException`
api-ms-win-core-errorhandling-l1-1-3.dll	`SetThreadErrorMode` `GetThreadErrorMode`
api-ms-win-core-fibers-l1-1-0.dll	`FlsAlloc` `FlsSetValue` `FlsGetValue` `FlsFree`
api-ms-win-core-util-l1-1-0.dll	`Beep`
api-ms-win-core-profile-l1-1-0.dll	`QueryPerformanceFrequency` `QueryPerformanceCounter`
api-ms-win-security-base-l1-1-0.dll	`EqualSid` `AccessCheck` `AllocateAndInitializeSid` `FreeSid` `DuplicateToken`
api-ms-win-security-base-l1-2-0.dll	`CheckTokenMembershipEx` `AddScopedPolicyIDAce` `AddResourceAttributeAce` `SetCachedSigningLevel` `GetCachedSigningLevel` `GetAppContainerAce` `CheckTokenCapability`
api-ms-win-security-appcontainer-l1-1-0.dll	`GetAppContainerNamedObjectPath`
api-ms-win-core-comm-l1-1-0.dll	`WaitCommEvent` `TransmitCommChar` `SetupComm` `SetCommTimeouts` `SetCommState` `SetCommMask` `SetCommConfig` `SetCommBreak` `PurgeComm` `GetCommTimeouts` `GetCommState` `GetCommProperties` `GetCommModemStatus` `GetCommMask` `GetCommConfig` `EscapeCommFunction` `ClearCommError` `ClearCommBreak`
api-ms-win-core-realtime-l1-1-0.dll	`QueryProcessCycleTime` `QueryIdleProcessorCycleTime` `QueryIdleProcessorCycleTimeEx` `QueryUnbiasedInterruptTime` `QueryThreadCycleTime`
api-ms-win-core-wow64-l1-1-1.dll	`GetSystemWow64Directory2W` `IsWow64Process2` `GetSystemWow64DirectoryW` `GetSystemWow64DirectoryA`
api-ms-win-core-wow64-l1-1-0.dll	`Wow64DisableWow64FsRedirection` `IsWow64Process` `Wow64RevertWow64FsRedirection`
api-ms-win-core-systemtopology-l1-1-1.dll	`GetNumaProximityNodeEx`
api-ms-win-core-systemtopology-l1-1-0.dll	`GetNumaHighestNodeNumber` `GetNumaNodeProcessorMaskEx`
api-ms-win-core-processtopology-l1-1-0.dll	`GetThreadGroupAffinity` `SetThreadGroupAffinity` `GetProcessGroupAffinity`
api-ms-win-core-namespace-l1-1-0.dll	`DeleteBoundaryDescriptor` `ClosePrivateNamespace` `CreateBoundaryDescriptorW` `OpenPrivateNamespaceW` `CreatePrivateNamespaceW` `AddSIDToBoundaryDescriptor`
api-ms-win-core-file-l2-1-2.dll	`CopyFileW` `CreateHardLinkA`
api-ms-win-core-file-l2-1-0.dll	`ReadDirectoryChangesW` `CreateDirectoryExW` `MoveFileExW` `CopyFile2` `GetFileInformationByHandleEx` `CopyFileExW` `CreateHardLinkW` `CreateSymbolicLinkW` `MoveFileWithProgressW` `ReOpenFile` `ReplaceFileW`
api-ms-win-core-file-l2-1-3.dll	`ReadDirectoryChangesExW`
api-ms-win-core-file-l2-1-1.dll	`OpenFileById`
api-ms-win-core-xstate-l2-1-0.dll	`CopyContext` `InitializeContext` `LocateXStateFeature` `GetXStateFeaturesMask` `GetEnabledXStateFeatures` `SetXStateFeaturesMask`
api-ms-win-core-xstate-l2-1-1.dll	`InitializeContext2`
api-ms-win-core-localization-l2-1-0.dll	`GetCurrencyFormatEx` `EnumTimeFormatsEx` `EnumDateFormatsExEx` `EnumCalendarInfoExEx` `EnumTimeFormatsW` `EnumSystemCodePagesW` `EnumDateFormatsW` `EnumCalendarInfoExW` `EnumCalendarInfoW` `EnumDateFormatsExW` `GetNumberFormatEx`
api-ms-win-core-normalization-l1-1-0.dll	`IsNormalizedString` `NormalizeString` `IdnToNameprepUnicode` `GetStringScripts` `VerifyScripts`
api-ms-win-core-fibers-l2-1-0.dll	`SwitchToFiber` `DeleteFiber` `ConvertThreadToFiber` `CreateFiber` `ConvertFiberToThread`
api-ms-win-core-fibers-l2-1-1.dll	`CreateFiberEx` `ConvertThreadToFiberEx`
api-ms-win-core-localization-private-l1-1-0.dll	`NlsUpdateLocale` `NlsCheckPolicy` `NlsEventDataDescCreate` `NlsUpdateSystemLocale` `NlsWriteEtwEvent` `NlsGetCacheUpdateCount`
api-ms-win-core-sidebyside-l1-1-0.dll	`QueryActCtxSettingsW` `QueryActCtxW` `GetCurrentActCtx` `FindActCtxSectionStringW` `FindActCtxSectionGuid` `DeactivateActCtx` `CreateActCtxW` `ZombifyActCtx` `AddRefActCtx` `ReleaseActCtx` `ActivateActCtx`
api-ms-win-core-appcompat-l1-1-0.dll	`BaseCheckAppcompatCache` `BaseCheckAppcompatCacheEx` `BaseCleanupAppcompatCacheSupport` `BaseInitAppcompatCacheSupport` `BaseDumpAppcompatCache` `BaseFlushAppcompatCache` `BaseUpdateAppcompatCache`
api-ms-win-core-windowserrorreporting-l1-1-0.dll	`GetApplicationRestartSettings` `WerUnregisterMemoryBlock` `GetApplicationRecoveryCallback` `WerRegisterMemoryBlock` `WerUnregisterRuntimeExceptionModule` `WerRegisterRuntimeExceptionModule` `WerUnregisterFile` `WerRegisterFile`
api-ms-win-core-windowserrorreporting-l1-1-1.dll	`WerUnregisterAdditionalProcess` `WerRegisterAdditionalProcess` `WerUnregisterExcludedMemoryBlock` `WerRegisterExcludedMemoryBlock` `WerRegisterCustomMetadata` `WerUnregisterCustomMetadata`
api-ms-win-core-windowserrorreporting-l1-1-2.dll	`WerRegisterAppLocalDump` `WerUnregisterAppLocalDump`
api-ms-win-core-console-l1-1-0.dll	`AllocConsole` `GetConsoleCP` `GetConsoleMode` `GetConsoleOutputCP` `GetNumberOfConsoleInputEvents` `ReadConsoleA` `ReadConsoleInputA` `ReadConsoleInputW` `ReadConsoleW` `SetConsoleCtrlHandler` `SetConsoleMode` `WriteConsoleA` `WriteConsoleW`
api-ms-win-core-console-l1-2-0.dll	`PeekConsoleInputA` `FreeConsole` `AttachConsole` `PeekConsoleInputW`
api-ms-win-core-console-l1-2-1.dll	`ResizePseudoConsole` `CreatePseudoConsole` `ClosePseudoConsole`
api-ms-win-core-console-l2-1-0.dll	`GetConsoleCursorInfo` `SetConsoleScreenBufferInfoEx` `GenerateConsoleCtrlEvent` `FlushConsoleInputBuffer` `SetConsoleOutputCP` `GetConsoleScreenBufferInfo` `FillConsoleOutputCharacterW` `SetConsoleCursorPosition` `GetLargestConsoleWindowSize` `FillConsoleOutputCharacterA` `FillConsoleOutputAttribute` `CreateConsoleScreenBuffer` `SetConsoleCursorInfo` `ReadConsoleOutputA` `ReadConsoleOutputAttribute` `ReadConsoleOutputCharacterA` `ReadConsoleOutputCharacterW` `ReadConsoleOutputW` `ScrollConsoleScreenBufferA` `ScrollConsoleScreenBufferW` `SetConsoleActiveScreenBuffer` `GetConsoleScreenBufferInfoEx` `SetConsoleScreenBufferSize` `WriteConsoleOutputW` `WriteConsoleOutputCharacterW` `WriteConsoleOutputCharacterA` `WriteConsoleOutputAttribute` `WriteConsoleOutputA` `WriteConsoleInputW` `WriteConsoleInputA` `SetConsoleWindowInfo` `SetConsoleTextAttribute` `SetConsoleCP`
api-ms-win-core-console-l2-2-0.dll	`GetConsoleOriginalTitleA` `GetConsoleOriginalTitleW` `GetConsoleTitleA` `GetConsoleTitleW` `SetConsoleTitleW` `SetConsoleTitleA`
api-ms-win-core-console-l3-2-0.dll	`GetConsoleCommandHistoryLengthA` `GetConsoleCommandHistoryA` `GetConsoleAliasesW` `GetConsoleAliasesLengthW` `GetConsoleAliasesLengthA` `GetConsoleAliasesA` `GetConsoleAliasW` `GetConsoleAliasExesW` `GetConsoleAliasExesLengthW` `GetConsoleAliasExesLengthA` `GetConsoleAliasExesA` `GetConsoleAliasA` `ExpungeConsoleCommandHistoryW` `ExpungeConsoleCommandHistoryA` `AddConsoleAliasW` `AddConsoleAliasA` `GetConsoleHistoryInfo` `GetConsoleCommandHistoryW` `GetConsoleDisplayMode` `GetConsoleFontSize` `GetConsoleProcessList` `GetConsoleSelectionInfo` `GetConsoleWindow` `GetCurrentConsoleFont` `GetCurrentConsoleFontEx` `GetNumberOfConsoleMouseButtons` `SetConsoleDisplayMode` `SetConsoleHistoryInfo` `SetConsoleNumberOfCommandsA` `SetConsoleNumberOfCommandsW` `SetCurrentConsoleFontEx` `GetConsoleCommandHistoryLengthW`
api-ms-win-core-psapi-l1-1-0.dll	`K32EnumProcessModules` `K32GetModuleFileNameExW` `K32EnumDeviceDrivers` `K32EnumProcesses` `K32GetWsChanges` `K32GetDeviceDriverBaseNameW` `K32GetProcessMemoryInfo` `K32GetModuleInformation` `K32GetPerformanceInfo` `K32EnumProcessModulesEx` `K32GetModuleBaseNameW` `K32GetProcessImageFileNameW` `QueryFullProcessImageNameW` `K32EnumPageFilesW` `K32GetDeviceDriverFileNameW` `K32EmptyWorkingSet` `K32QueryWorkingSet` `K32GetMappedFileNameW` `K32QueryWorkingSetEx` `K32InitializeProcessForWsWatch` `K32GetWsChangesEx`
api-ms-win-core-psapi-ansi-l1-1-0.dll	`K32GetMappedFileNameA` `K32GetModuleBaseNameA` `K32GetDeviceDriverBaseNameA` `K32GetDeviceDriverFileNameA` `K32EnumPageFilesA` `K32GetProcessImageFileNameA` `QueryFullProcessImageNameA` `K32GetModuleFileNameExA`
api-ms-win-eventing-provider-l1-1-0.dll	`EventWriteTransfer` `EventUnregister` `EventSetInformation` `EventRegister`
api-ms-win-core-appcompat-l1-1-1.dll	`BaseFreeAppCompatDataForProcess` `BaseReadAppCompatDataForProcess`

Delayed Imports

AcquireSRWLockExclusive

Ordinal	`1`
Address	`0x9417f`
ForwardName	`NTDLL.RtlAcquireSRWLockExclusive`

AcquireSRWLockShared

Ordinal	`2`
Address	`0x941b5`
ForwardName	`NTDLL.RtlAcquireSRWLockShared`

ActivateActCtx

Ordinal	`3`
Address	`0x1e860`

ActivateActCtxWorker

Ordinal	`4`
Address	`0x1a570`

AddAtomA

Ordinal	`5`
Address	`0x21a70`

AddAtomW

Ordinal	`6`
Address	`0xfe30`

AddConsoleAliasA

Ordinal	`7`
Address	`0x22de0`

AddConsoleAliasW

Ordinal	`8`
Address	`0x22df0`

AddDllDirectory

Ordinal	`9`
Address	`0x9423b`
ForwardName	`api-ms-win-core-libraryloader-l1-1-0.AddDllDirectory`

AddIntegrityLabelToBoundaryDescriptor

Ordinal	`10`
Address	`0x375a0`

AddLocalAlternateComputerNameA

Ordinal	`11`
Address	`0x53150`

AddLocalAlternateComputerNameW

Ordinal	`12`
Address	`0x531b0`

AddRefActCtx

Ordinal	`13`
Address	`0x20570`

AddRefActCtxWorker

Ordinal	`14`
Address	`0x1e3c0`

AddResourceAttributeAce

Ordinal	`15`
Address	`0x35fb0`

AddSIDToBoundaryDescriptor

Ordinal	`16`
Address	`0x1f3c0`

AddScopedPolicyIDAce

Ordinal	`17`
Address	`0x35fc0`

AddSecureMemoryCacheCallback

Ordinal	`18`
Address	`0x34600`

AddVectoredContinueHandler

Ordinal	`19`
Address	`0x94374`
ForwardName	`NTDLL.RtlAddVectoredContinueHandler`

AddVectoredExceptionHandler

Ordinal	`20`
Address	`0x943b4`
ForwardName	`NTDLL.RtlAddVectoredExceptionHandler`

AdjustCalendarDate

Ordinal	`21`
Address	`0x1a6b0`

AllocConsole

Ordinal	`22`
Address	`0x22a30`

AllocateUserPhysicalPages

Ordinal	`23`
Address	`0x35fe0`

AllocateUserPhysicalPagesNuma

Ordinal	`24`
Address	`0x35fd0`

AppPolicyGetClrCompat

Ordinal	`25`
Address	`0x94447`
ForwardName	`kernelbase.AppPolicyGetClrCompat`

AppPolicyGetCreateFileAccess

Ordinal	`26`
Address	`0x94485`
ForwardName	`kernelbase.AppPolicyGetCreateFileAccess`

AppPolicyGetLifecycleManagement

Ordinal	`27`
Address	`0x944cd`
ForwardName	`kernelbase.AppPolicyGetLifecycleManagement`

AppPolicyGetMediaFoundationCodecLoading

Ordinal	`28`
Address	`0x94520`
ForwardName	`kernelbase.AppPolicyGetMediaFoundationCodecLoading`

AppPolicyGetProcessTerminationMethod

Ordinal	`29`
Address	`0x94578`
ForwardName	`kernelbase.AppPolicyGetProcessTerminationMethod`

AppPolicyGetShowDeveloperDiagnostic

Ordinal	`30`
Address	`0x945cc`
ForwardName	`kernelbase.AppPolicyGetShowDeveloperDiagnostic`

AppPolicyGetThreadInitializationType

Ordinal	`31`
Address	`0x94620`
ForwardName	`kernelbase.AppPolicyGetThreadInitializationType`

AppPolicyGetWindowingModel

Ordinal	`32`
Address	`0x9466b`
ForwardName	`kernelbase.AppPolicyGetWindowingModel`

AppXGetOSMaxVersionTested

Ordinal	`33`
Address	`0x946ab`
ForwardName	`kernelbase.AppXGetOSMaxVersionTested`

ApplicationRecoveryFinished

Ordinal	`34`
Address	`0x3de90`

ApplicationRecoveryInProgress

Ordinal	`35`
Address	`0x3dea0`

AreFileApisANSI

Ordinal	`36`
Address	`0x1f970`

AssignProcessToJobObject

Ordinal	`37`
Address	`0x1e4f0`

AttachConsole

Ordinal	`38`
Address	`0x22a40`

BackupRead

Ordinal	`39`
Address	`0x55970`

BackupSeek

Ordinal	`40`
Address	`0x569f0`

BackupWrite

Ordinal	`41`
Address	`0x56cc0`

BaseCheckAppcompatCache

Ordinal	`42`
Address	`0x36050`

BaseCheckAppcompatCacheEx

Ordinal	`43`
Address	`0x35ff0`

BaseCheckAppcompatCacheExWorker

Ordinal	`44`
Address	`0x1fa30`

BaseCheckAppcompatCacheWorker

Ordinal	`45`
Address	`0x1fa30`

BaseCheckElevation

Ordinal	`46`
Address	`0x1e30`

BaseCleanupAppcompatCacheSupport

Ordinal	`47`
Address	`0x36060`

BaseCleanupAppcompatCacheSupportWorker

Ordinal	`48`
Address	`0x1fd40`

BaseDestroyVDMEnvironment

Ordinal	`49`
Address	`0x3ab40`

BaseDllReadWriteIniFile

Ordinal	`50`
Address	`0x7c00`

BaseDumpAppcompatCache

Ordinal	`51`
Address	`0x36070`

BaseDumpAppcompatCacheWorker

Ordinal	`52`
Address	`0x234c0`

BaseElevationPostProcessing

Ordinal	`53`
Address	`0x1c9d0`

BaseFlushAppcompatCache

Ordinal	`54`
Address	`0x36080`

BaseFlushAppcompatCacheWorker

Ordinal	`55`
Address	`0x67cc0`

BaseFormatObjectAttributes

Ordinal	`56`
Address	`0x22000`

BaseFormatTimeOut

Ordinal	`57`
Address	`0x52990`

BaseFreeAppCompatDataForProcessWorker

Ordinal	`58`
Address	`0x1ec30`

BaseGenerateAppCompatData

Ordinal	`59`
Address	`0x175d0`

BaseGetNamedObjectDirectory

Ordinal	`60`
Address	`0x36090`

BaseInitAppcompatCacheSupport

Ordinal	`61`
Address	`0x360a0`

BaseInitAppcompatCacheSupportWorker

Ordinal	`62`
Address	`0x1fd40`

BaseIsAppcompatInfrastructureDisabled

Ordinal	`63`
Address	`0x1fa30`

BaseIsAppcompatInfrastructureDisabledWorker

Ordinal	`64`
Address	`0x1fa30`

BaseIsDosApplication

Ordinal	`65`
Address	`0x59590`

BaseQueryModuleData

Ordinal	`66`
Address	`0x680c0`

BaseReadAppCompatDataForProcessWorker

Ordinal	`67`
Address	`0x1e9a0`

BaseSetLastNTError

Ordinal	`68`
Address	`0x10570`

BaseThreadInitThunk

Ordinal	`69`
Address	`0x17960`

BaseUpdateAppcompatCache

Ordinal	`70`
Address	`0x360b0`

BaseUpdateAppcompatCacheWorker

Ordinal	`71`
Address	`0x67d20`

BaseUpdateVDMEntry

Ordinal	`72`
Address	`0x3ae50`

BaseVerifyUnicodeString

Ordinal	`73`
Address	`0x52a20`

BaseWriteErrorElevationRequiredEvent

Ordinal	`74`
Address	`0x57e80`

Basep8BitStringToDynamicUnicodeString

Ordinal	`75`
Address	`0x1b610`

BasepAllocateActivationContextActivationBlock

Ordinal	`76`
Address	`0x52a80`

BasepAnsiStringToDynamicUnicodeString

Ordinal	`77`
Address	`0x529c0`

BasepAppContainerEnvironmentExtension

Ordinal	`78`
Address	`0x18660`

BasepAppXExtension

Ordinal	`79`
Address	`0x1ee80`

BasepCheckAppCompat

Ordinal	`80`
Address	`0x23c0`

BasepCheckWebBladeHashes

Ordinal	`81`
Address	`0x1c600`

BasepCheckWinSaferRestrictions

Ordinal	`82`
Address	`0xc790`

BasepConstructSxsCreateProcessMessage

Ordinal	`83`
Address	`0x9f20`

BasepCopyEncryption

Ordinal	`84`
Address	`0x34150`

BasepFreeActivationContextActivationBlock

Ordinal	`85`
Address	`0x52bf0`

BasepFreeAppCompatData

Ordinal	`86`
Address	`0x1b6c0`

BasepGetAppCompatData

Ordinal	`87`
Address	`0x16c50`

BasepGetComputerNameFromNtPath

Ordinal	`88`
Address	`0x1d940`

BasepGetExeArchType

Ordinal	`89`
Address	`0x2c10`

BasepInitAppCompatData

Ordinal	`90`
Address	`0x67df0`

BasepIsProcessAllowed

Ordinal	`91`
Address	`0x1b7f0`

BasepMapModuleHandle

Ordinal	`92`
Address	`0xf480`

BasepNotifyLoadStringResource

Ordinal	`93`
Address	`0x1a5e0`

BasepPostSuccessAppXExtension

Ordinal	`94`
Address	`0x1fa10`

BasepProcessInvalidImage

Ordinal	`95`
Address	`0x350d0`

BasepQueryAppCompat

Ordinal	`96`
Address	`0x90c0`

BasepQueryModuleChpeSettings

Ordinal	`97`
Address	`0x67e80`

BasepReleaseAppXContext

Ordinal	`98`
Address	`0x1fa00`

BasepReleaseSxsCreateProcessUtilityStruct

Ordinal	`99`
Address	`0xe3e0`

BasepReportFault

Ordinal	`100`
Address	`0x3e150`

BasepSetFileEncryptionCompression

Ordinal	`101`
Address	`0x1ddf0`

Beep

Ordinal	`102`
Address	`0x33640`

BeginUpdateResourceA

Ordinal	`103`
Address	`0x439d0`

BeginUpdateResourceW

Ordinal	`104`
Address	`0x43a30`

BindIoCompletionCallback

Ordinal	`105`
Address	`0x219e0`

BuildCommDCBA

Ordinal	`106`
Address	`0x3c7f0`

BuildCommDCBAndTimeoutsA

Ordinal	`107`
Address	`0x3c820`

BuildCommDCBAndTimeoutsW

Ordinal	`108`
Address	`0x3c850`

BuildCommDCBW

Ordinal	`109`
Address	`0x3c8c0`

CallNamedPipeA

Ordinal	`110`
Address	`0x59d10`

CallNamedPipeW

Ordinal	`111`
Address	`0x227d0`

CallbackMayRunLong

Ordinal	`112`
Address	`0x360c0`

CancelDeviceWakeupRequest

Ordinal	`113`
Address	`0x35020`

CancelIo

Ordinal	`114`
Address	`0x1fd30`

CancelIoEx

Ordinal	`115`
Address	`0x1e810`

CancelSynchronousIo

Ordinal	`116`
Address	`0x360f0`

CancelThreadpoolIo

Ordinal	`117`
Address	`0x94f1d`
ForwardName	`NTDLL.TpCancelAsyncIoOperation`

CancelTimerQueueTimer

Ordinal	`118`
Address	`0x3e0d0`

CancelWaitableTimer

Ordinal	`119`
Address	`0x220c0`

CeipIsOptedIn

Ordinal	`120`
Address	`0x94f74`
ForwardName	`kernelbase.CeipIsOptedIn`

ChangeTimerQueueTimer

Ordinal	`121`
Address	`0x1fc90`

CheckAllowDecryptedRemoteDestinationPolicy

Ordinal	`122`
Address	`0x36100`

CheckElevation

Ordinal	`123`
Address	`0x1d00`

CheckElevationEnabled

Ordinal	`124`
Address	`0x1ef60`

CheckForReadOnlyResource

Ordinal	`125`
Address	`0x5a1a0`

CheckForReadOnlyResourceFilter

Ordinal	`126`
Address	`0x375d0`

CheckNameLegalDOS8Dot3A

Ordinal	`127`
Address	`0x34e50`

CheckNameLegalDOS8Dot3W

Ordinal	`128`
Address	`0x34ef0`

CheckRemoteDebuggerPresent

Ordinal	`129`
Address	`0x1390`

CheckTokenCapability

Ordinal	`130`
Address	`0x36110`

CheckTokenMembershipEx

Ordinal	`131`
Address	`0x36120`

ClearCommBreak

Ordinal	`132`
Address	`0x22830`

ClearCommError

Ordinal	`133`
Address	`0x22840`

CloseConsoleHandle

Ordinal	`134`
Address	`0x615d0`

CloseHandle

Ordinal	`135`
Address	`0x22080`

ClosePackageInfo

Ordinal	`136`
Address	`0x950f0`
ForwardName	`kernelbase.ClosePackageInfo`

ClosePrivateNamespace

Ordinal	`137`
Address	`0x20510`

CloseProfileUserMapping

Ordinal	`138`
Address	`0x1fd40`

ClosePseudoConsole

Ordinal	`139`
Address	`0x22a50`

CloseState

Ordinal	`140`
Address	`0x95158`
ForwardName	`kernelbase.CloseState`

CloseThreadpool

Ordinal	`141`
Address	`0x9517e`
ForwardName	`NTDLL.TpReleasePool`

CloseThreadpoolCleanupGroup

Ordinal	`142`
Address	`0x951ae`
ForwardName	`NTDLL.TpReleaseCleanupGroup`

CloseThreadpoolCleanupGroupMembers

Ordinal	`143`
Address	`0x951ed`
ForwardName	`NTDLL.TpReleaseCleanupGroupMembers`

CloseThreadpoolIo

Ordinal	`144`
Address	`0x95222`
ForwardName	`NTDLL.TpReleaseIoCompletion`

CloseThreadpoolTimer

Ordinal	`145`
Address	`0x95253`
ForwardName	`NTDLL.TpReleaseTimer`

CloseThreadpoolWait

Ordinal	`146`
Address	`0x9527c`
ForwardName	`NTDLL.TpReleaseWait`

CloseThreadpoolWork

Ordinal	`147`
Address	`0x952a4`
ForwardName	`NTDLL.TpReleaseWork`

CmdBatNotification

Ordinal	`148`
Address	`0x1ed50`

CommConfigDialogA

Ordinal	`149`
Address	`0x38330`

CommConfigDialogW

Ordinal	`150`
Address	`0x383c0`

CompareCalendarDates

Ordinal	`151`
Address	`0x442e0`

CompareFileTime

Ordinal	`152`
Address	`0x222b0`

CompareStringA

Ordinal	`153`
Address	`0x1d420`

CompareStringEx

Ordinal	`154`
Address	`0x15820`

CompareStringOrdinal

Ordinal	`155`
Address	`0x16c40`

CompareStringW

Ordinal	`156`
Address	`0x1a520`

ConnectNamedPipe

Ordinal	`157`
Address	`0x1f9b0`

ConsoleMenuControl

Ordinal	`158`
Address	`0x616e0`

ContinueDebugEvent

Ordinal	`159`
Address	`0x36130`

ConvertCalDateTimeToSystemTime

Ordinal	`160`
Address	`0x44390`

ConvertDefaultLocale

Ordinal	`161`
Address	`0x36140`

ConvertFiberToThread

Ordinal	`162`
Address	`0x22980`

ConvertNLSDayOfWeekToWin32DayOfWeek

Ordinal	`163`
Address	`0x44480`

ConvertSystemTimeToCalDateTime

Ordinal	`164`
Address	`0x1a940`

ConvertThreadToFiber

Ordinal	`165`
Address	`0x22990`

ConvertThreadToFiberEx

Ordinal	`166`
Address	`0x229a0`

CopyContext

Ordinal	`167`
Address	`0x36150`

CopyFile2

Ordinal	`168`
Address	`0x36160`

CopyFileA

Ordinal	`169`
Address	`0x5a4b0`

CopyFileExA

Ordinal	`170`
Address	`0x5a540`

CopyFileExW

Ordinal	`171`
Address	`0x1f1c0`

CopyFileTransactedA

Ordinal	`172`
Address	`0x5a5f0`

CopyFileTransactedW

Ordinal	`173`
Address	`0x5a6c0`

CopyFileW

Ordinal	`174`
Address	`0x22970`

CopyLZFile

Ordinal	`175`
Address	`0x337c0`

CreateActCtxA

Ordinal	`176`
Address	`0x20140`

CreateActCtxW

Ordinal	`177`
Address	`0x1fb70`

CreateActCtxWWorker

Ordinal	`178`
Address	`0xcde0`

CreateBoundaryDescriptorA

Ordinal	`179`
Address	`0x5a350`

CreateBoundaryDescriptorW

Ordinal	`180`
Address	`0x1f390`

CreateConsoleScreenBuffer

Ordinal	`181`
Address	`0x22b70`

CreateDirectoryA

Ordinal	`182`
Address	`0x222c0`

CreateDirectoryExA

Ordinal	`183`
Address	`0x5b000`

CreateDirectoryExW

Ordinal	`184`
Address	`0x36170`

CreateDirectoryTransactedA

Ordinal	`185`
Address	`0x33ae0`

CreateDirectoryTransactedW

Ordinal	`186`
Address	`0x5b080`

CreateDirectoryW

Ordinal	`187`
Address	`0x222d0`

CreateEnclave

Ordinal	`188`
Address	`0x955c5`
ForwardName	`api-ms-win-core-enclave-l1-1-0.CreateEnclave`

CreateEventA

Ordinal	`189`
Address	`0x220d0`

CreateEventExA

Ordinal	`190`
Address	`0x220e0`

CreateEventExW

Ordinal	`191`
Address	`0x220f0`

CreateEventW

Ordinal	`192`
Address	`0x22100`

CreateFiber

Ordinal	`193`
Address	`0x229b0`

CreateFiberEx

Ordinal	`194`
Address	`0x229c0`

CreateFile2

Ordinal	`195`
Address	`0x222e0`

CreateFileA

Ordinal	`196`
Address	`0x222f0`

CreateFileMappingA

Ordinal	`197`
Address	`0x1b280`

CreateFileMappingFromApp

Ordinal	`198`
Address	`0x95688`
ForwardName	`api-ms-win-core-memory-l1-1-1.CreateFileMappingFromApp`

CreateFileMappingNumaA

Ordinal	`199`
Address	`0x5b1f0`

CreateFileMappingNumaW

Ordinal	`200`
Address	`0x36180`

CreateFileMappingW

Ordinal	`201`
Address	`0x1c0c0`

CreateFileTransactedA

Ordinal	`202`
Address	`0x5a7a0`

CreateFileTransactedW

Ordinal	`203`
Address	`0x5a860`

CreateFileW

Ordinal	`204`
Address	`0x22300`

CreateHardLinkA

Ordinal	`205`
Address	`0x36190`

CreateHardLinkTransactedA

Ordinal	`206`
Address	`0x3d8e0`

CreateHardLinkTransactedW

Ordinal	`207`
Address	`0x5b2b0`

CreateHardLinkW

Ordinal	`208`
Address	`0x21a20`

CreateIoCompletionPort

Ordinal	`209`
Address	`0x1ce30`

CreateJobObjectA

Ordinal	`210`
Address	`0x54e30`

CreateJobObjectW

Ordinal	`211`
Address	`0x1ca80`

CreateJobSet

Ordinal	`212`
Address	`0x54ea0`

CreateMailslotA

Ordinal	`213`
Address	`0x1b410`

CreateMailslotW

Ordinal	`214`
Address	`0x1b480`

CreateMemoryResourceNotification

Ordinal	`215`
Address	`0x1f3e0`

CreateMutexA

Ordinal	`216`
Address	`0x22110`

CreateMutexExA

Ordinal	`217`
Address	`0x22120`

CreateMutexExW

Ordinal	`218`
Address	`0x22130`

CreateMutexW

Ordinal	`219`
Address	`0x22140`

CreateNamedPipeA

Ordinal	`220`
Address	`0x59da0`

CreateNamedPipeW

Ordinal	`221`
Address	`0x1ec00`

CreatePipe

Ordinal	`222`
Address	`0x1f210`

CreatePrivateNamespaceA

Ordinal	`223`
Address	`0x5a3b0`

CreatePrivateNamespaceW

Ordinal	`224`
Address	`0x1f370`

CreateProcessA

Ordinal	`225`
Address	`0x1c100`

CreateProcessAsUserA

Ordinal	`226`
Address	`0x361a0`

CreateProcessAsUserW

Ordinal	`227`
Address	`0x1cd40`

CreateProcessInternalA

Ordinal	`228`
Address	`0x36210`

CreateProcessInternalW

Ordinal	`229`
Address	`0x36290`

CreateProcessW

Ordinal	`230`
Address	`0x1c290`

CreatePseudoConsole

Ordinal	`231`
Address	`0x22a60`

CreateRemoteThread

Ordinal	`232`
Address	`0x36310`

CreateRemoteThreadEx

Ordinal	`233`
Address	`0x9595a`
ForwardName	`api-ms-win-core-processthreads-l1-1-0.CreateRemoteThreadEx`

CreateSemaphoreA

Ordinal	`234`
Address	`0x1b340`

CreateSemaphoreExA

Ordinal	`235`
Address	`0x1b370`

CreateSemaphoreExW

Ordinal	`236`
Address	`0x22150`

CreateSemaphoreW

Ordinal	`237`
Address	`0x22160`

CreateSymbolicLinkA

Ordinal	`238`
Address	`0x5b820`

CreateSymbolicLinkTransactedA

Ordinal	`239`
Address	`0x5b8c0`

CreateSymbolicLinkTransactedW

Ordinal	`240`
Address	`0x5b970`

CreateSymbolicLinkW

Ordinal	`241`
Address	`0x21a60`

CreateTapePartition

Ordinal	`242`
Address	`0x3d620`

CreateThread

Ordinal	`243`
Address	`0x1a4b0`

CreateThreadpool

Ordinal	`244`
Address	`0x1e3d0`

CreateThreadpoolCleanupGroup

Ordinal	`245`
Address	`0x1fb40`

CreateThreadpoolIo

Ordinal	`246`
Address	`0x1f4a0`

CreateThreadpoolTimer

Ordinal	`247`
Address	`0x1b8f0`

CreateThreadpoolWait

Ordinal	`248`
Address	`0x1f1d0`

CreateThreadpoolWork

Ordinal	`249`
Address	`0x1ca40`

CreateTimerQueue

Ordinal	`250`
Address	`0x1fbd0`

CreateTimerQueueTimer

Ordinal	`251`
Address	`0x1d390`

CreateToolhelp32Snapshot

Ordinal	`252`
Address	`0x236f0`

CreateUmsCompletionList

Ordinal	`253`
Address	`0x3c4c0`

CreateUmsThreadContext

Ordinal	`254`
Address	`0x3c4f0`

CreateWaitableTimerA

Ordinal	`255`
Address	`0x5b4d0`

CreateWaitableTimerExA

Ordinal	`256`
Address	`0x5b4f0`

CreateWaitableTimerExW

Ordinal	`257`
Address	`0x22170`

CreateWaitableTimerW

Ordinal	`258`
Address	`0x12b0`

CtrlRoutine

Ordinal	`259`
Address	`0x95bb6`
ForwardName	`kernelbase.CtrlRoutine`

DeactivateActCtx

Ordinal	`260`
Address	`0x1e870`

DeactivateActCtxWorker

Ordinal	`261`
Address	`0x1b1e0`

DebugActiveProcess

Ordinal	`262`
Address	`0x36370`

DebugActiveProcessStop

Ordinal	`263`
Address	`0x36360`

DebugBreak

Ordinal	`264`
Address	`0x36380`

DebugBreakProcess

Ordinal	`265`
Address	`0x339d0`

DebugSetProcessKillOnExit

Ordinal	`266`
Address	`0x33a00`

DecodePointer

Ordinal	`267`
Address	`0x95c64`
ForwardName	`NTDLL.RtlDecodePointer`

DecodeSystemPointer

Ordinal	`268`
Address	`0x95c8f`
ForwardName	`NTDLL.RtlDecodeSystemPointer`

DefineDosDeviceA

Ordinal	`269`
Address	`0x5d0e0`

DefineDosDeviceW

Ordinal	`270`
Address	`0x22310`

DelayLoadFailureHook

Ordinal	`271`
Address	`0x21a40`

DeleteAtom

Ordinal	`272`
Address	`0xfd90`

DeleteBoundaryDescriptor

Ordinal	`273`
Address	`0x1f380`

DeleteCriticalSection

Ordinal	`274`
Address	`0x95d1d`
ForwardName	`NTDLL.RtlDeleteCriticalSection`

DeleteFiber

Ordinal	`275`
Address	`0x229d0`

DeleteFileA

Ordinal	`276`
Address	`0x22320`

DeleteFileTransactedA

Ordinal	`277`
Address	`0x5ba20`

DeleteFileTransactedW

Ordinal	`278`
Address	`0x218f0`

DeleteFileW

Ordinal	`279`
Address	`0x22330`

DeleteProcThreadAttributeList

Ordinal	`280`
Address	`0x95daa`
ForwardName	`api-ms-win-core-processthreads-l1-1-0.DeleteProcThreadAttributeList`

DeleteSynchronizationBarrier

Ordinal	`281`
Address	`0x36390`

DeleteTimerQueue

Ordinal	`282`
Address	`0x1fba0`

DeleteTimerQueueEx

Ordinal	`283`
Address	`0x1fbf0`

DeleteTimerQueueTimer

Ordinal	`284`
Address	`0x1ee70`

DeleteUmsCompletionList

Ordinal	`285`
Address	`0x3c520`

DeleteUmsThreadContext

Ordinal	`286`
Address	`0x3c550`

DeleteVolumeMountPointA

Ordinal	`287`
Address	`0x5d350`

DeleteVolumeMountPointW

Ordinal	`288`
Address	`0x22340`

DequeueUmsCompletionListItems

Ordinal	`289`
Address	`0x3c580`

DeviceIoControl

Ordinal	`290`
Address	`0x15290`

DisableThreadLibraryCalls

Ordinal	`291`
Address	`0x1ec60`

DisableThreadProfiling

Ordinal	`292`
Address	`0x3e180`

DisassociateCurrentThreadFromCallback

Ordinal	`293`
Address	`0x95f29`
ForwardName	`NTDLL.TpDisassociateCallback`

DiscardVirtualMemory

Ordinal	`294`
Address	`0x95f5b`
ForwardName	`api-ms-win-core-memory-l1-1-2.DiscardVirtualMemory`

DisconnectNamedPipe

Ordinal	`295`
Address	`0x20a50`

DnsHostnameToComputerNameA

Ordinal	`296`
Address	`0x53ef0`

DnsHostnameToComputerNameExW

Ordinal	`297`
Address	`0x363a0`

DnsHostnameToComputerNameW

Ordinal	`298`
Address	`0x1d540`

DosDateTimeToFileTime

Ordinal	`299`
Address	`0xffb0`

DosPathToSessionPathA

Ordinal	`300`
Address	`0x5e4d0`

DosPathToSessionPathW

Ordinal	`301`
Address	`0x5e680`

DuplicateConsoleHandle

Ordinal	`302`
Address	`0x615e0`

DuplicateEncryptionInfoFileExt

Ordinal	`303`
Address	`0x34440`

DuplicateHandle

Ordinal	`304`
Address	`0x22090`

EnableThreadProfiling

Ordinal	`305`
Address	`0x3e1b0`

EncodePointer

Ordinal	`306`
Address	`0x960a1`
ForwardName	`NTDLL.RtlEncodePointer`

EncodeSystemPointer

Ordinal	`307`
Address	`0x960cc`
ForwardName	`NTDLL.RtlEncodeSystemPointer`

EndUpdateResourceA

Ordinal	`308`
Address	`0x43c40`

EndUpdateResourceW

Ordinal	`309`
Address	`0x43c50`

EnterCriticalSection

Ordinal	`310`
Address	`0x96124`
ForwardName	`NTDLL.RtlEnterCriticalSection`

EnterSynchronizationBarrier

Ordinal	`311`
Address	`0x363b0`

EnterUmsSchedulingMode

Ordinal	`312`
Address	`0x3c5d0`

EnumCalendarInfoA

Ordinal	`313`
Address	`0x44f20`

EnumCalendarInfoExA

Ordinal	`314`
Address	`0x44fb0`

EnumCalendarInfoExEx

Ordinal	`315`
Address	`0x1b740`

EnumCalendarInfoExW

Ordinal	`316`
Address	`0x363c0`

EnumCalendarInfoW

Ordinal	`317`
Address	`0x363d0`

EnumDateFormatsA

Ordinal	`318`
Address	`0x45040`

EnumDateFormatsExA

Ordinal	`319`
Address	`0x450a0`

EnumDateFormatsExEx

Ordinal	`320`
Address	`0x363e0`

EnumDateFormatsExW

Ordinal	`321`
Address	`0x363f0`

EnumDateFormatsW

Ordinal	`322`
Address	`0x36400`

EnumLanguageGroupLocalesA

Ordinal	`323`
Address	`0x45100`

EnumLanguageGroupLocalesW

Ordinal	`324`
Address	`0x36410`

EnumResourceLanguagesA

Ordinal	`325`
Address	`0x347f0`

EnumResourceLanguagesExA

Ordinal	`326`
Address	`0x36420`

EnumResourceLanguagesExW

Ordinal	`327`
Address	`0x36440`

EnumResourceLanguagesW

Ordinal	`328`
Address	`0x34820`

EnumResourceNamesA

Ordinal	`329`
Address	`0x34850`

EnumResourceNamesExA

Ordinal	`330`
Address	`0x36460`

EnumResourceNamesExW

Ordinal	`331`
Address	`0x36480`

EnumResourceNamesW

Ordinal	`332`
Address	`0x227b0`

EnumResourceTypesA

Ordinal	`333`
Address	`0x34880`

EnumResourceTypesExA

Ordinal	`334`
Address	`0x364a0`

EnumResourceTypesExW

Ordinal	`335`
Address	`0x364c0`

EnumResourceTypesW

Ordinal	`336`
Address	`0x348a0`

EnumSystemCodePagesA

Ordinal	`337`
Address	`0x45120`

EnumSystemCodePagesW

Ordinal	`338`
Address	`0x364e0`

EnumSystemFirmwareTables

Ordinal	`339`
Address	`0x34630`

EnumSystemGeoID

Ordinal	`340`
Address	`0x4d910`

EnumSystemGeoNames

Ordinal	`341`
Address	`0x4d9f0`

EnumSystemLanguageGroupsA

Ordinal	`342`
Address	`0x45130`

EnumSystemLanguageGroupsW

Ordinal	`343`
Address	`0x364f0`

EnumSystemLocalesA

Ordinal	`344`
Address	`0x36500`

EnumSystemLocalesEx

Ordinal	`345`
Address	`0x36510`

EnumSystemLocalesW

Ordinal	`346`
Address	`0x36520`

EnumTimeFormatsA

Ordinal	`347`
Address	`0x45140`

EnumTimeFormatsEx

Ordinal	`348`
Address	`0x1ee40`

EnumTimeFormatsW

Ordinal	`349`
Address	`0x36530`

EnumUILanguagesA

Ordinal	`350`
Address	`0x451b0`

EnumUILanguagesW

Ordinal	`351`
Address	`0x36540`

EnumerateLocalComputerNamesA

Ordinal	`352`
Address	`0x53fd0`

EnumerateLocalComputerNamesW

Ordinal	`353`
Address	`0x540e0`

EraseTape

Ordinal	`354`
Address	`0x3d680`

EscapeCommFunction

Ordinal	`355`
Address	`0x22850`

ExecuteUmsThread

Ordinal	`356`
Address	`0x3c600`

ExitProcess

Ordinal	`357`
Address	`0x1d620`

ExitThread

Ordinal	`358`
Address	`0x9650f`
ForwardName	`NTDLL.RtlExitUserThread`

ExitVDM

Ordinal	`359`
Address	`0x3b0c0`

ExpandEnvironmentStringsA

Ordinal	`360`
Address	`0x20530`

ExpandEnvironmentStringsW

Ordinal	`361`
Address	`0x1b750`

ExpungeConsoleCommandHistoryA

Ordinal	`362`
Address	`0x22e00`

ExpungeConsoleCommandHistoryW

Ordinal	`363`
Address	`0x22e10`

FatalAppExitA

Ordinal	`364`
Address	`0x36550`

FatalAppExitW

Ordinal	`365`
Address	`0x36560`

FatalExit

Ordinal	`366`
Address	`0x1d620`

FileTimeToDosDateTime

Ordinal	`367`
Address	`0x10210`

FileTimeToLocalFileTime

Ordinal	`368`
Address	`0x22350`

FileTimeToSystemTime

Ordinal	`369`
Address	`0x227f0`

FillConsoleOutputAttribute

Ordinal	`370`
Address	`0x22b80`

FillConsoleOutputCharacterA

Ordinal	`371`
Address	`0x22b90`

FillConsoleOutputCharacterW

Ordinal	`372`
Address	`0x22ba0`

FindActCtxSectionGuid

Ordinal	`373`
Address	`0x1c650`

FindActCtxSectionGuidWorker

Ordinal	`374`
Address	`0x10430`

FindActCtxSectionStringA

Ordinal	`375`
Address	`0x5e7f0`

FindActCtxSectionStringW

Ordinal	`376`
Address	`0x1faf0`

FindActCtxSectionStringWWorker

Ordinal	`377`
Address	`0xf4e0`

FindAtomA

Ordinal	`378`
Address	`0xfe10`

FindAtomW

Ordinal	`379`
Address	`0x101f0`

FindClose

Ordinal	`380`
Address	`0x22360`

FindCloseChangeNotification

Ordinal	`381`
Address	`0x22370`

FindFirstChangeNotificationA

Ordinal	`382`
Address	`0x22380`

FindFirstChangeNotificationW

Ordinal	`383`
Address	`0x22390`

FindFirstFileA

Ordinal	`384`
Address	`0x223a0`

FindFirstFileExA

Ordinal	`385`
Address	`0x223b0`

FindFirstFileExW

Ordinal	`386`
Address	`0x223c0`

FindFirstFileNameTransactedW

Ordinal	`387`
Address	`0x33bd0`

FindFirstFileNameW

Ordinal	`388`
Address	`0x223d0`

FindFirstFileTransactedA

Ordinal	`389`
Address	`0x33c90`

FindFirstFileTransactedW

Ordinal	`390`
Address	`0x5e890`

FindFirstFileW

Ordinal	`391`
Address	`0x223e0`

FindFirstStreamTransactedW

Ordinal	`392`
Address	`0x33d60`

FindFirstStreamW

Ordinal	`393`
Address	`0x96820`
ForwardName	`api-ms-win-core-file-l1-2-2.FindFirstStreamW`

FindFirstVolumeA

Ordinal	`394`
Address	`0x5d390`

FindFirstVolumeMountPointA

Ordinal	`395`
Address	`0x5d500`

FindFirstVolumeMountPointW

Ordinal	`396`
Address	`0x5d6b0`

FindFirstVolumeW

Ordinal	`397`
Address	`0x223f0`

FindNLSString

Ordinal	`398`
Address	`0x36570`

FindNLSStringEx

Ordinal	`399`
Address	`0x15750`

FindNextChangeNotification

Ordinal	`400`
Address	`0x22400`

FindNextFileA

Ordinal	`401`
Address	`0x22410`

FindNextFileNameW

Ordinal	`402`
Address	`0x22420`

FindNextFileW

Ordinal	`403`
Address	`0x22430`

FindNextStreamW

Ordinal	`404`
Address	`0x9691c`
ForwardName	`api-ms-win-core-file-l1-2-2.FindNextStreamW`

FindNextVolumeA

Ordinal	`405`
Address	`0x5d8e0`

FindNextVolumeMountPointA

Ordinal	`406`
Address	`0x5da50`

FindNextVolumeMountPointW

Ordinal	`407`
Address	`0x5e080`

FindNextVolumeW

Ordinal	`408`
Address	`0x22440`

FindPackagesByPackageFamily

Ordinal	`409`
Address	`0x969b8`
ForwardName	`kernelbase.FindPackagesByPackageFamily`

FindResourceA

Ordinal	`410`
Address	`0xf2a0`

FindResourceExA

Ordinal	`411`
Address	`0xf2c0`

FindResourceExW

Ordinal	`412`
Address	`0x1b1d0`

FindResourceW

Ordinal	`413`
Address	`0x1cd10`

FindStringOrdinal

Ordinal	`414`
Address	`0x36580`

FindVolumeClose

Ordinal	`415`
Address	`0x22450`

FindVolumeMountPointClose

Ordinal	`416`
Address	`0x5e090`

FlsAlloc

Ordinal	`417`
Address	`0x1e440`

FlsFree

Ordinal	`418`
Address	`0x1e770`

FlsGetValue

Ordinal	`419`
Address	`0x16ba0`

FlsSetValue

Ordinal	`420`
Address	`0x1b690`

FlushConsoleInputBuffer

Ordinal	`421`
Address	`0x22bb0`

FlushFileBuffers

Ordinal	`422`
Address	`0x22460`

FlushInstructionCache

Ordinal	`423`
Address	`0x184e0`

FlushProcessWriteBuffers

Ordinal	`424`
Address	`0x96ad8`
ForwardName	`NTDLL.NtFlushProcessWriteBuffers`

FlushViewOfFile

Ordinal	`425`
Address	`0x36590`

FoldStringA

Ordinal	`426`
Address	`0x451c0`

FoldStringW

Ordinal	`427`
Address	`0x365a0`

FormatApplicationUserModelId

Ordinal	`428`
Address	`0x96b3e`
ForwardName	`kernelbase.FormatApplicationUserModelId`

FormatMessageA

Ordinal	`429`
Address	`0x209e0`

FormatMessageW

Ordinal	`430`
Address	`0x1c030`

FreeConsole

Ordinal	`431`
Address	`0x22a70`

FreeEnvironmentStringsA

Ordinal	`432`
Address	`0x1ee20`

FreeEnvironmentStringsW

Ordinal	`433`
Address	`0x1d930`

FreeLibrary

Ordinal	`434`
Address	`0x1c270`

FreeLibraryAndExitThread

Ordinal	`435`
Address	`0x1fa60`

FreeLibraryWhenCallbackReturns

Ordinal	`436`
Address	`0x96c04`
ForwardName	`NTDLL.TpCallbackUnloadDllOnCompletion`

FreeMemoryJobObject

Ordinal	`437`
Address	`0x54ed0`

FreeResource

Ordinal	`438`
Address	`0x20450`

FreeUserPhysicalPages

Ordinal	`439`
Address	`0x365b0`

GenerateConsoleCtrlEvent

Ordinal	`440`
Address	`0x22bc0`

GetACP

Ordinal	`441`
Address	`0x1cee0`

GetActiveProcessorCount

Ordinal	`442`
Address	`0x1cbb0`

GetActiveProcessorGroupCount

Ordinal	`443`
Address	`0x5ea00`

GetAppContainerAce

Ordinal	`444`
Address	`0x365c0`

GetAppContainerNamedObjectPath

Ordinal	`445`
Address	`0x365d0`

GetApplicationRecoveryCallback

Ordinal	`446`
Address	`0x365e0`

GetApplicationRecoveryCallbackWorker

Ordinal	`447`
Address	`0x3deb0`

GetApplicationRestartSettings

Ordinal	`448`
Address	`0x365f0`

GetApplicationRestartSettingsWorker

Ordinal	`449`
Address	`0x3df60`

GetApplicationUserModelId

Ordinal	`450`
Address	`0x96d88`
ForwardName	`kernelbase.GetApplicationUserModelId`

GetAtomNameA

Ordinal	`451`
Address	`0x530b0`

GetAtomNameW

Ordinal	`452`
Address	`0xfb80`

GetBinaryType

Ordinal	`453`
Address	`0x59680`

GetBinaryTypeA

Ordinal	`454`
Address	`0x59680`

GetBinaryTypeW

Ordinal	`455`
Address	`0x596d0`

GetCPInfo

Ordinal	`456`
Address	`0x1cef0`

GetCPInfoExA

Ordinal	`457`
Address	`0x45420`

GetCPInfoExW

Ordinal	`458`
Address	`0x36600`

GetCachedSigningLevel

Ordinal	`459`
Address	`0x36610`

GetCalendarDateFormat

Ordinal	`460`
Address	`0x444b0`

GetCalendarDateFormatEx

Ordinal	`461`
Address	`0x1aa80`

GetCalendarDaysInMonth

Ordinal	`462`
Address	`0x1a860`

GetCalendarDifferenceInDays

Ordinal	`463`
Address	`0x44780`

GetCalendarInfoA

Ordinal	`464`
Address	`0x454e0`

GetCalendarInfoEx

Ordinal	`465`
Address	`0x22800`

GetCalendarInfoW

Ordinal	`466`
Address	`0x22810`

GetCalendarMonthsInYear

Ordinal	`467`
Address	`0x448d0`

GetCalendarSupportedDateRange

Ordinal	`468`
Address	`0x1a5f0`

GetCalendarWeekNumber

Ordinal	`469`
Address	`0x449a0`

GetComPlusPackageInstallStatus

Ordinal	`470`
Address	`0x3ddf0`

GetCommConfig

Ordinal	`471`
Address	`0x22860`

GetCommMask

Ordinal	`472`
Address	`0x22870`

GetCommModemStatus

Ordinal	`473`
Address	`0x22880`

GetCommProperties

Ordinal	`474`
Address	`0x22890`

GetCommState

Ordinal	`475`
Address	`0x228a0`

GetCommTimeouts

Ordinal	`476`
Address	`0x228b0`

GetCommandLineA

Ordinal	`477`
Address	`0x1e460`

GetCommandLineW

Ordinal	`478`
Address	`0x1e420`

GetCompressedFileSizeA

Ordinal	`479`
Address	`0x36620`

GetCompressedFileSizeTransactedA

Ordinal	`480`
Address	`0x5ba70`

GetCompressedFileSizeTransactedW

Ordinal	`481`
Address	`0x5bad0`

GetCompressedFileSizeW

Ordinal	`482`
Address	`0x36630`

GetComputerNameA

Ordinal	`483`
Address	`0x5500`

GetComputerNameExA

Ordinal	`484`
Address	`0x21a10`

GetComputerNameExW

Ordinal	`485`
Address	`0x1f890`

GetComputerNameW

Ordinal	`486`
Address	`0x8ce0`

GetConsoleAliasA

Ordinal	`487`
Address	`0x22e20`

GetConsoleAliasExesA

Ordinal	`488`
Address	`0x22e30`

GetConsoleAliasExesLengthA

Ordinal	`489`
Address	`0x22e40`

GetConsoleAliasExesLengthW

Ordinal	`490`
Address	`0x22e50`

GetConsoleAliasExesW

Ordinal	`491`
Address	`0x22e60`

GetConsoleAliasW

Ordinal	`492`
Address	`0x22e70`

GetConsoleAliasesA

Ordinal	`493`
Address	`0x22e80`

GetConsoleAliasesLengthA

Ordinal	`494`
Address	`0x22e90`

GetConsoleAliasesLengthW

Ordinal	`495`
Address	`0x22ea0`

GetConsoleAliasesW

Ordinal	`496`
Address	`0x22eb0`

GetConsoleCP

Ordinal	`497`
Address	`0x22a80`

GetConsoleCharType

Ordinal	`498`
Address	`0x61b90`

GetConsoleCommandHistoryA

Ordinal	`499`
Address	`0x22ec0`

GetConsoleCommandHistoryLengthA

Ordinal	`500`
Address	`0x22ed0`

GetConsoleCommandHistoryLengthW

Ordinal	`501`
Address	`0x22ee0`

GetConsoleCommandHistoryW

Ordinal	`502`
Address	`0x22ef0`

GetConsoleCursorInfo

Ordinal	`503`
Address	`0x22bd0`

GetConsoleCursorMode

Ordinal	`504`
Address	`0x61bf0`

GetConsoleDisplayMode

Ordinal	`505`
Address	`0x22f00`

GetConsoleFontInfo

Ordinal	`506`
Address	`0x61f10`

GetConsoleFontSize

Ordinal	`507`
Address	`0x22f10`

GetConsoleHardwareState

Ordinal	`508`
Address	`0x61740`

GetConsoleHistoryInfo

Ordinal	`509`
Address	`0x22f20`

GetConsoleInputExeNameA

Ordinal	`510`
Address	`0x9727b`
ForwardName	`kernelbase.GetConsoleInputExeNameA`

GetConsoleInputExeNameW

Ordinal	`511`
Address	`0x972b6`
ForwardName	`kernelbase.GetConsoleInputExeNameW`

GetConsoleInputWaitHandle

Ordinal	`512`
Address	`0x61670`

GetConsoleKeyboardLayoutNameA

Ordinal	`513`
Address	`0x61fb0`

GetConsoleKeyboardLayoutNameW

Ordinal	`514`
Address	`0x61fd0`

GetConsoleMode

Ordinal	`515`
Address	`0x22a90`

GetConsoleNlsMode

Ordinal	`516`
Address	`0x61c60`

GetConsoleOriginalTitleA

Ordinal	`517`
Address	`0x22be0`

GetConsoleOriginalTitleW

Ordinal	`518`
Address	`0x22bf0`

GetConsoleOutputCP

Ordinal	`519`
Address	`0x22aa0`

GetConsoleProcessList

Ordinal	`520`
Address	`0x22f30`

GetConsoleScreenBufferInfo

Ordinal	`521`
Address	`0x22c00`

GetConsoleScreenBufferInfoEx

Ordinal	`522`
Address	`0x22c10`

GetConsoleSelectionInfo

Ordinal	`523`
Address	`0x22f40`

GetConsoleTitleA

Ordinal	`524`
Address	`0x22c20`

GetConsoleTitleW

Ordinal	`525`
Address	`0x22c30`

GetConsoleWindow

Ordinal	`526`
Address	`0x22f50`

GetCurrencyFormatA

Ordinal	`527`
Address	`0x45710`

GetCurrencyFormatEx

Ordinal	`528`
Address	`0x36640`

GetCurrencyFormatW

Ordinal	`529`
Address	`0x36650`

GetCurrentActCtx

Ordinal	`530`
Address	`0x20430`

GetCurrentActCtxWorker

Ordinal	`531`
Address	`0x1c070`

GetCurrentApplicationUserModelId

Ordinal	`532`
Address	`0x974b1`
ForwardName	`kernelbase.GetCurrentApplicationUserModelId`

GetCurrentConsoleFont

Ordinal	`533`
Address	`0x22f60`

GetCurrentConsoleFontEx

Ordinal	`534`
Address	`0x22f70`

GetCurrentDirectoryA

Ordinal	`535`
Address	`0x1fb00`

GetCurrentDirectoryW

Ordinal	`536`
Address	`0x1ee30`

GetCurrentPackageFamilyName

Ordinal	`537`
Address	`0x97551`
ForwardName	`kernelbase.GetCurrentPackageFamilyName`

GetCurrentPackageFullName

Ordinal	`538`
Address	`0x97592`
ForwardName	`kernelbase.GetCurrentPackageFullName`

GetCurrentPackageId

Ordinal	`539`
Address	`0x975cb`
ForwardName	`kernelbase.GetCurrentPackageId`

GetCurrentPackageInfo

Ordinal	`540`
Address	`0x97600`
ForwardName	`kernelbase.GetCurrentPackageInfo`

GetCurrentPackagePath

Ordinal	`541`
Address	`0x97637`
ForwardName	`kernelbase.GetCurrentPackagePath`

GetCurrentProcess

Ordinal	`542`
Address	`0x22020`

GetCurrentProcessId

Ordinal	`543`
Address	`0x22030`

GetCurrentProcessorNumber

Ordinal	`544`
Address	`0x97698`
ForwardName	`NTDLL.RtlGetCurrentProcessorNumber`

GetCurrentProcessorNumberEx

Ordinal	`545`
Address	`0x976d7`
ForwardName	`NTDLL.RtlGetCurrentProcessorNumberEx`

GetCurrentThread

Ordinal	`546`
Address	`0x157f0`

GetCurrentThreadId

Ordinal	`547`
Address	`0x15260`

GetCurrentThreadStackLimits

Ordinal	`548`
Address	`0x9773c`
ForwardName	`api-ms-win-core-processthreads-l1-1-0.GetCurrentThreadStackLimits`

GetCurrentUmsThread

Ordinal	`549`
Address	`0x3c630`

GetDateFormatA

Ordinal	`550`
Address	`0x36660`

GetDateFormatAWorker

Ordinal	`551`
Address	`0x206d0`

GetDateFormatEx

Ordinal	`552`
Address	`0x36670`

GetDateFormatW

Ordinal	`553`
Address	`0x1ee50`

GetDateFormatWWorker

Ordinal	`554`
Address	`0x6560`

GetDefaultCommConfigA

Ordinal	`555`
Address	`0x385e0`

GetDefaultCommConfigW

Ordinal	`556`
Address	`0x38670`

GetDevicePowerState

Ordinal	`557`
Address	`0x5f240`

GetDiskFreeSpaceA

Ordinal	`558`
Address	`0x22470`

GetDiskFreeSpaceExA

Ordinal	`559`
Address	`0x22480`

GetDiskFreeSpaceExW

Ordinal	`560`
Address	`0x22490`

GetDiskFreeSpaceW

Ordinal	`561`
Address	`0x224a0`

GetDiskSpaceInformationA

Ordinal	`562`
Address	`0x9788f`
ForwardName	`api-ms-win-core-file-l1-2-3.GetDiskSpaceInformationA`

GetDiskSpaceInformationW

Ordinal	`563`
Address	`0x978dd`
ForwardName	`api-ms-win-core-file-l1-2-3.GetDiskSpaceInformationW`

GetDllDirectoryA

Ordinal	`564`
Address	`0x348c0`

GetDllDirectoryW

Ordinal	`565`
Address	`0x203a0`

GetDriveTypeA

Ordinal	`566`
Address	`0x224b0`

GetDriveTypeW

Ordinal	`567`
Address	`0x224c0`

GetDurationFormat

Ordinal	`568`
Address	`0x462a0`

GetDurationFormatEx

Ordinal	`569`
Address	`0x36680`

GetDynamicTimeZoneInformation

Ordinal	`570`
Address	`0x1f990`

GetEnabledXStateFeatures

Ordinal	`571`
Address	`0x1f1b0`

GetEncryptedFileVersionExt

Ordinal	`572`
Address	`0x34520`

GetEnvironmentStrings

Ordinal	`573`
Address	`0x1ee10`

GetEnvironmentStringsA

Ordinal	`574`
Address	`0x22820`

GetEnvironmentStringsW

Ordinal	`575`
Address	`0x1d920`

GetEnvironmentVariableA

Ordinal	`576`
Address	`0x1e450`

GetEnvironmentVariableW

Ordinal	`577`
Address	`0x1b250`

GetEraNameCountedString

Ordinal	`578`
Address	`0x36690`

GetErrorMode

Ordinal	`579`
Address	`0x20550`

GetExitCodeProcess

Ordinal	`580`
Address	`0x1c790`

GetExitCodeThread

Ordinal	`581`
Address	`0x1e660`

GetExpandedNameA

Ordinal	`582`
Address	`0x377c0`

GetExpandedNameW

Ordinal	`583`
Address	`0x378b0`

GetFileAttributesA

Ordinal	`584`
Address	`0x224d0`

GetFileAttributesExA

Ordinal	`585`
Address	`0x224e0`

GetFileAttributesExW

Ordinal	`586`
Address	`0x224f0`

GetFileAttributesTransactedA

Ordinal	`587`
Address	`0x5bb70`

GetFileAttributesTransactedW

Ordinal	`588`
Address	`0x5bbd0`

GetFileAttributesW

Ordinal	`589`
Address	`0x22500`

GetFileBandwidthReservation

Ordinal	`590`
Address	`0x33e20`

GetFileInformationByHandle

Ordinal	`591`
Address	`0x22510`

GetFileInformationByHandleEx

Ordinal	`592`
Address	`0x1b7e0`

GetFileMUIInfo

Ordinal	`593`
Address	`0x366a0`

GetFileMUIPath

Ordinal	`594`
Address	`0x1e410`

GetFileSize

Ordinal	`595`
Address	`0x22520`

GetFileSizeEx

Ordinal	`596`
Address	`0x22530`

GetFileTime

Ordinal	`597`
Address	`0x22540`

GetFileType

Ordinal	`598`
Address	`0x22550`

GetFinalPathNameByHandleA

Ordinal	`599`
Address	`0x22560`

GetFinalPathNameByHandleW

Ordinal	`600`
Address	`0x22570`

GetFirmwareEnvironmentVariableA

Ordinal	`601`
Address	`0x5f290`

GetFirmwareEnvironmentVariableExA

Ordinal	`602`
Address	`0x5f2b0`

GetFirmwareEnvironmentVariableExW

Ordinal	`603`
Address	`0x10820`

GetFirmwareEnvironmentVariableW

Ordinal	`604`
Address	`0x5f3b0`

GetFirmwareType

Ordinal	`605`
Address	`0x20a70`

GetFullPathNameA

Ordinal	`606`
Address	`0x22580`

GetFullPathNameTransactedA

Ordinal	`607`
Address	`0x338d0`

GetFullPathNameTransactedW

Ordinal	`608`
Address	`0x5f5c0`

GetFullPathNameW

Ordinal	`609`
Address	`0x22590`

GetGeoInfoA

Ordinal	`610`
Address	`0x45ab0`

GetGeoInfoEx

Ordinal	`611`
Address	`0x4dad0`

GetGeoInfoW

Ordinal	`612`
Address	`0x1060`

GetHandleInformation

Ordinal	`613`
Address	`0x220a0`

GetLargePageMinimum

Ordinal	`614`
Address	`0x366b0`

GetLargestConsoleWindowSize

Ordinal	`615`
Address	`0x22c40`

GetLastError

Ordinal	`616`
Address	`0x157e0`

GetLocalTime

Ordinal	`617`
Address	`0x1d230`

GetLocaleInfoA

Ordinal	`618`
Address	`0x1fb90`

GetLocaleInfoEx

Ordinal	`619`
Address	`0x1c000`

GetLocaleInfoW

Ordinal	`620`
Address	`0x1ec70`

GetLogicalDriveStringsA

Ordinal	`621`
Address	`0x183b0`

GetLogicalDriveStringsW

Ordinal	`622`
Address	`0x225a0`

GetLogicalDrives

Ordinal	`623`
Address	`0x18470`

GetLogicalProcessorInformation

Ordinal	`624`
Address	`0x1fad0`

GetLogicalProcessorInformationEx

Ordinal	`625`
Address	`0x97e29`
ForwardName	`api-ms-win-core-sysinfo-l1-1-0.GetLogicalProcessorInformationEx`

GetLongPathNameA

Ordinal	`626`
Address	`0x52c40`

GetLongPathNameTransactedA

Ordinal	`627`
Address	`0x3b150`

GetLongPathNameTransactedW

Ordinal	`628`
Address	`0x59a00`

GetLongPathNameW

Ordinal	`629`
Address	`0x15d30`

GetMailslotInfo

Ordinal	`630`
Address	`0x5b370`

GetMaximumProcessorCount

Ordinal	`631`
Address	`0x5ea60`

GetMaximumProcessorGroupCount

Ordinal	`632`
Address	`0x209f0`

GetMemoryErrorHandlingCapabilities

Ordinal	`633`
Address	`0x366c0`

GetModuleFileNameA

Ordinal	`634`
Address	`0x1d380`

GetModuleFileNameW

Ordinal	`635`
Address	`0x1ce50`

GetModuleHandleA

Ordinal	`636`
Address	`0x1d370`

GetModuleHandleExA

Ordinal	`637`
Address	`0x1fa50`

GetModuleHandleExW

Ordinal	`638`
Address	`0x1e680`

GetModuleHandleW

Ordinal	`639`
Address	`0x1c160`

GetNLSVersion

Ordinal	`640`
Address	`0x20500`

GetNLSVersionEx

Ordinal	`641`
Address	`0x366d0`

GetNamedPipeAttribute

Ordinal	`642`
Address	`0x366e0`

GetNamedPipeClientComputerNameA

Ordinal	`643`
Address	`0x59e40`

GetNamedPipeClientComputerNameW

Ordinal	`644`
Address	`0x366f0`

GetNamedPipeClientProcessId

Ordinal	`645`
Address	`0x59f70`

GetNamedPipeClientSessionId

Ordinal	`646`
Address	`0x34af0`

GetNamedPipeHandleStateA

Ordinal	`647`
Address	`0x59fb0`

GetNamedPipeHandleStateW

Ordinal	`648`
Address	`0x36700`

GetNamedPipeInfo

Ordinal	`649`
Address	`0x98088`
ForwardName	`api-ms-win-core-namedpipe-l1-2-1.GetNamedPipeInfo`

GetNamedPipeServerProcessId

Ordinal	`650`
Address	`0x5a110`

GetNamedPipeServerSessionId

Ordinal	`651`
Address	`0x34b40`

GetNativeSystemInfo

Ordinal	`652`
Address	`0x1f310`

GetNextUmsListItem

Ordinal	`653`
Address	`0x3c660`

GetNextVDMCommand

Ordinal	`654`
Address	`0x3b200`

GetNumaAvailableMemoryNode

Ordinal	`655`
Address	`0x34d60`

GetNumaAvailableMemoryNodeEx

Ordinal	`656`
Address	`0x5fab0`

GetNumaHighestNodeNumber

Ordinal	`657`
Address	`0x1f3a0`

GetNumaNodeNumberFromHandle

Ordinal	`658`
Address	`0x34d70`

GetNumaNodeProcessorMask

Ordinal	`659`
Address	`0x5fb30`

GetNumaNodeProcessorMaskEx

Ordinal	`660`
Address	`0x36710`

GetNumaProcessorNode

Ordinal	`661`
Address	`0x34dc0`

GetNumaProcessorNodeEx

Ordinal	`662`
Address	`0x5fbb0`

GetNumaProximityNode

Ordinal	`663`
Address	`0x34e20`

GetNumaProximityNodeEx

Ordinal	`664`
Address	`0x36720`

GetNumberFormatA

Ordinal	`665`
Address	`0x1a060`

GetNumberFormatEx

Ordinal	`666`
Address	`0x36730`

GetNumberFormatW

Ordinal	`667`
Address	`0x1290`

GetNumberOfConsoleFonts

Ordinal	`668`
Address	`0x62070`

GetNumberOfConsoleInputEvents

Ordinal	`669`
Address	`0x22ab0`

GetNumberOfConsoleMouseButtons

Ordinal	`670`
Address	`0x22f80`

GetOEMCP

Ordinal	`671`
Address	`0x1fd50`

GetOverlappedResult

Ordinal	`672`
Address	`0x19e10`

GetOverlappedResultEx

Ordinal	`673`
Address	`0x982e0`
ForwardName	`api-ms-win-core-io-l1-1-1.GetOverlappedResultEx`

GetPackageApplicationIds

Ordinal	`674`
Address	`0x98329`
ForwardName	`kernelbase.GetPackageApplicationIds`

GetPackageFamilyName

Ordinal	`675`
Address	`0x98362`
ForwardName	`kernelbase.GetPackageFamilyName`

GetPackageFullName

Ordinal	`676`
Address	`0x98395`
ForwardName	`kernelbase.GetPackageFullName`

GetPackageId

Ordinal	`677`
Address	`0x983c0`
ForwardName	`kernelbase.GetPackageId`

GetPackageInfo

Ordinal	`678`
Address	`0x983e7`
ForwardName	`kernelbase.GetPackageInfo`

GetPackagePath

Ordinal	`679`
Address	`0x98410`
ForwardName	`kernelbase.GetPackagePath`

GetPackagePathByFullName

Ordinal	`680`
Address	`0x98443`
ForwardName	`kernelbase.GetPackagePathByFullName`

GetPackagesByPackageFamily

Ordinal	`681`
Address	`0x98482`
ForwardName	`kernelbase.GetPackagesByPackageFamily`

GetPhysicallyInstalledSystemMemory

Ordinal	`682`
Address	`0x1fd20`

GetPriorityClass

Ordinal	`683`
Address	`0x1fae0`

GetPrivateProfileIntA

Ordinal	`684`
Address	`0x107a0`

GetPrivateProfileIntW

Ordinal	`685`
Address	`0xf7e0`

GetPrivateProfileSectionA

Ordinal	`686`
Address	`0x20ae0`

GetPrivateProfileSectionNamesA

Ordinal	`687`
Address	`0x58de0`

GetPrivateProfileSectionNamesW

Ordinal	`688`
Address	`0x58e10`

GetPrivateProfileSectionW

Ordinal	`689`
Address	`0x1f8c0`

GetPrivateProfileStringA

Ordinal	`690`
Address	`0x106a0`

GetPrivateProfileStringW

Ordinal	`691`
Address	`0xf8c0`

GetPrivateProfileStructA

Ordinal	`692`
Address	`0x58e40`

GetPrivateProfileStructW

Ordinal	`693`
Address	`0x58fc0`

GetProcAddress

Ordinal	`694`
Address	`0x19d60`

GetProcessAffinityMask

Ordinal	`695`
Address	`0x1b760`

GetProcessDEPPolicy

Ordinal	`696`
Address	`0x359a0`

GetProcessDefaultCpuSets

Ordinal	`697`
Address	`0x98631`
ForwardName	`api-ms-win-core-processthreads-l1-1-3.GetProcessDefaultCpuSets`

GetProcessGroupAffinity

Ordinal	`698`
Address	`0x36740`

GetProcessHandleCount

Ordinal	`699`
Address	`0x36750`

GetProcessHeap

Ordinal	`700`
Address	`0x15880`

GetProcessHeaps

Ordinal	`701`
Address	`0x36760`

GetProcessId

Ordinal	`702`
Address	`0x1c5f0`

GetProcessIdOfThread

Ordinal	`703`
Address	`0x1f360`

GetProcessInformation

Ordinal	`704`
Address	`0x22040`

GetProcessIoCounters

Ordinal	`705`
Address	`0x1e820`

GetProcessMitigationPolicy

Ordinal	`706`
Address	`0x98725`
ForwardName	`api-ms-win-core-processthreads-l1-1-1.GetProcessMitigationPolicy`

GetProcessPreferredUILanguages

Ordinal	`707`
Address	`0x219d0`

GetProcessPriorityBoost

Ordinal	`708`
Address	`0x36770`

GetProcessShutdownParameters

Ordinal	`709`
Address	`0x36780`

GetProcessTimes

Ordinal	`710`
Address	`0x19d90`

GetProcessVersion

Ordinal	`711`
Address	`0x20460`

GetProcessWorkingSetSize

Ordinal	`712`
Address	`0x3e070`

GetProcessWorkingSetSizeEx

Ordinal	`713`
Address	`0x36790`

GetProcessorSystemCycleTime

Ordinal	`714`
Address	`0x9882c`
ForwardName	`api-ms-win-core-sysinfo-l1-2-2.GetProcessorSystemCycleTime`

GetProductInfo

Ordinal	`715`
Address	`0x1fb30`

GetProfileIntA

Ordinal	`716`
Address	`0x10810`

GetProfileIntW

Ordinal	`717`
Address	`0xf7d0`

GetProfileSectionA

Ordinal	`718`
Address	`0x59150`

GetProfileSectionW

Ordinal	`719`
Address	`0x59160`

GetProfileStringA

Ordinal	`720`
Address	`0x59170`

GetProfileStringW

Ordinal	`721`
Address	`0x591a0`

GetQueuedCompletionStatus

Ordinal	`722`
Address	`0x16b90`

GetQueuedCompletionStatusEx

Ordinal	`723`
Address	`0x367a0`

GetShortPathNameA

Ordinal	`724`
Address	`0x59ab0`

GetShortPathNameW

Ordinal	`725`
Address	`0x158b0`

GetStagedPackagePathByFullName

Ordinal	`726`
Address	`0x98957`
ForwardName	`kernelbase.GetStagedPackagePathByFullName`

GetStartupInfoA

Ordinal	`727`
Address	`0x1f670`

GetStartupInfoW

Ordinal	`728`
Address	`0x1cd30`

GetStateFolder

Ordinal	`729`
Address	`0x989b0`
ForwardName	`kernelbase.GetStateFolder`

GetStdHandle

Ordinal	`730`
Address	`0x1c890`

GetStringScripts

Ordinal	`731`
Address	`0x367b0`

GetStringTypeA

Ordinal	`732`
Address	`0x367c0`

GetStringTypeExA

Ordinal	`733`
Address	`0x367c0`

GetStringTypeExW

Ordinal	`734`
Address	`0x209d0`

GetStringTypeW

Ordinal	`735`
Address	`0x1d3d0`

GetSystemAppDataKey

Ordinal	`736`
Address	`0x98a3c`
ForwardName	`kernelbase.GetSystemAppDataKey`

GetSystemCpuSetInformation

Ordinal	`737`
Address	`0x98a76`
ForwardName	`api-ms-win-core-processthreads-l1-1-3.GetSystemCpuSetInformation`

GetSystemDEPPolicy

Ordinal	`738`
Address	`0x359f0`

GetSystemDefaultLCID

Ordinal	`739`
Address	`0x1f960`

GetSystemDefaultLangID

Ordinal	`740`
Address	`0x1fa20`

GetSystemDefaultLocaleName

Ordinal	`741`
Address	`0x1380`

GetSystemDefaultUILanguage

Ordinal	`742`
Address	`0x1f2d0`

GetSystemDirectoryA

Ordinal	`743`
Address	`0x1cb10`

GetSystemDirectoryW

Ordinal	`744`
Address	`0x19cd0`

GetSystemFileCacheSize

Ordinal	`745`
Address	`0x367d0`

GetSystemFirmwareTable

Ordinal	`746`
Address	`0x13a0`

GetSystemInfo

Ordinal	`747`
Address	`0x1b930`

GetSystemPowerStatus

Ordinal	`748`
Address	`0x19f80`

GetSystemPreferredUILanguages

Ordinal	`749`
Address	`0x1fcd0`

GetSystemRegistryQuota

Ordinal	`750`
Address	`0x35a30`

GetSystemTime

Ordinal	`751`
Address	`0x184d0`

GetSystemTimeAdjustment

Ordinal	`752`
Address	`0x1f3f0`

GetSystemTimeAsFileTime

Ordinal	`753`
Address	`0x18500`

GetSystemTimePreciseAsFileTime

Ordinal	`754`
Address	`0x227e0`

GetSystemTimes

Ordinal	`755`
Address	`0x1e960`

GetSystemWindowsDirectoryA

Ordinal	`756`
Address	`0x367e0`

GetSystemWindowsDirectoryW

Ordinal	`757`
Address	`0x1f2e0`

GetSystemWow64DirectoryA

Ordinal	`758`
Address	`0x22950`

GetSystemWow64DirectoryW

Ordinal	`759`
Address	`0x22960`

GetTapeParameters

Ordinal	`760`
Address	`0x5fd50`

GetTapePosition

Ordinal	`761`
Address	`0x3d6c0`

GetTapeStatus

Ordinal	`762`
Address	`0x3d750`

GetTempFileNameA

Ordinal	`763`
Address	`0x225b0`

GetTempFileNameW

Ordinal	`764`
Address	`0x225c0`

GetTempPathA

Ordinal	`765`
Address	`0x225d0`

GetTempPathW

Ordinal	`766`
Address	`0x225e0`

GetThreadContext

Ordinal	`767`
Address	`0x1f170`

GetThreadDescription

Ordinal	`768`
Address	`0x98d40`
ForwardName	`api-ms-win-core-processthreads-l1-1-3.GetThreadDescription`

GetThreadErrorMode

Ordinal	`769`
Address	`0x367f0`

GetThreadGroupAffinity

Ordinal	`770`
Address	`0x36800`

GetThreadIOPendingFlag

Ordinal	`771`
Address	`0x36810`

GetThreadId

Ordinal	`772`
Address	`0x1bfd0`

GetThreadIdealProcessorEx

Ordinal	`773`
Address	`0x36820`

GetThreadInformation

Ordinal	`774`
Address	`0x22050`

GetThreadLocale

Ordinal	`775`
Address	`0x19e20`

GetThreadPreferredUILanguages

Ordinal	`776`
Address	`0x1c7f0`

GetThreadPriority

Ordinal	`777`
Address	`0x1b240`

GetThreadPriorityBoost

Ordinal	`778`
Address	`0x36830`

GetThreadSelectedCpuSets

Ordinal	`779`
Address	`0x98e67`
ForwardName	`api-ms-win-core-processthreads-l1-1-3.GetThreadSelectedCpuSets`

GetThreadSelectorEntry

Ordinal	`780`
Address	`0x5fdb0`

GetThreadTimes

Ordinal	`781`
Address	`0x19a80`

GetThreadUILanguage

Ordinal	`782`
Address	`0x21a50`

GetTickCount

Ordinal	`783`
Address	`0x15330`

GetTickCount64

Ordinal	`784`
Address	`0x16b60`

GetTimeFormatA

Ordinal	`785`
Address	`0x36840`

GetTimeFormatAWorker

Ordinal	`786`
Address	`0x21640`

GetTimeFormatEx

Ordinal	`787`
Address	`0x36850`

GetTimeFormatW

Ordinal	`788`
Address	`0x1ee60`

GetTimeFormatWWorker

Ordinal	`789`
Address	`0x3ae0`

GetTimeZoneInformation

Ordinal	`790`
Address	`0x1f350`

GetTimeZoneInformationForYear

Ordinal	`791`
Address	`0x12a0`

GetUILanguageInfo

Ordinal	`792`
Address	`0x36860`

GetUmsCompletionListEvent

Ordinal	`793`
Address	`0x3c690`

GetUmsSystemThreadInformation

Ordinal	`794`
Address	`0x3c6c0`

GetUserDefaultGeoName

Ordinal	`795`
Address	`0x4dc10`

GetUserDefaultLCID

Ordinal	`796`
Address	`0x1e6a0`

GetUserDefaultLangID

Ordinal	`797`
Address	`0x36870`

GetUserDefaultLocaleName

Ordinal	`798`
Address	`0x1d3b0`

GetUserDefaultUILanguage

Ordinal	`799`
Address	`0x1fa40`

GetUserGeoID

Ordinal	`800`
Address	`0x1efb0`

GetUserPreferredUILanguages

Ordinal	`801`
Address	`0x1efa0`

GetVDMCurrentDirectories

Ordinal	`802`
Address	`0x3bb50`

GetVersion

Ordinal	`803`
Address	`0x1fb10`

GetVersionExA

Ordinal	`804`
Address	`0x1eec0`

GetVersionExW

Ordinal	`805`
Address	`0x1e4b0`

GetVolumeInformationA

Ordinal	`806`
Address	`0x225f0`

GetVolumeInformationByHandleW

Ordinal	`807`
Address	`0x22600`

GetVolumeInformationW

Ordinal	`808`
Address	`0x22610`

GetVolumeNameForVolumeMountPointA

Ordinal	`809`
Address	`0x21780`

GetVolumeNameForVolumeMountPointW

Ordinal	`810`
Address	`0x22010`

GetVolumePathNameA

Ordinal	`811`
Address	`0x5e0f0`

GetVolumePathNameW

Ordinal	`812`
Address	`0x22620`

GetVolumePathNamesForVolumeNameA

Ordinal	`813`
Address	`0x5e290`

GetVolumePathNamesForVolumeNameW

Ordinal	`814`
Address	`0x22630`

GetWindowsDirectoryA

Ordinal	`815`
Address	`0x20540`

GetWindowsDirectoryW

Ordinal	`816`
Address	`0x1fbe0`

GetWriteWatch

Ordinal	`817`
Address	`0x15890`

GetXStateFeaturesMask

Ordinal	`818`
Address	`0x36880`

GlobalAddAtomA

Ordinal	`819`
Address	`0xfbb0`

GlobalAddAtomExA

Ordinal	`820`
Address	`0x530e0`

GlobalAddAtomExW

Ordinal	`821`
Address	`0xfa10`

GlobalAddAtomW

Ordinal	`822`
Address	`0xfe50`

GlobalAlloc

Ordinal	`823`
Address	`0x184c0`

GlobalCompact

Ordinal	`824`
Address	`0x34640`

GlobalDeleteAtom

Ordinal	`825`
Address	`0xfd80`

GlobalFindAtomA

Ordinal	`826`
Address	`0x53100`

GlobalFindAtomW

Ordinal	`827`
Address	`0x102d0`

GlobalFix

Ordinal	`828`
Address	`0x34660`

GlobalFlags

Ordinal	`829`
Address	`0x1e520`

GlobalFree

Ordinal	`830`
Address	`0x157b0`

GlobalGetAtomNameA

Ordinal	`831`
Address	`0x53120`

GlobalGetAtomNameW

Ordinal	`832`
Address	`0xfbd0`

GlobalHandle

Ordinal	`833`
Address	`0x1eca0`

GlobalLock

Ordinal	`834`
Address	`0x155d0`

GlobalMemoryStatus

Ordinal	`835`
Address	`0x1c170`

GlobalMemoryStatusEx

Ordinal	`836`
Address	`0x1ef20`

GlobalReAlloc

Ordinal	`837`
Address	`0x16790`

GlobalSize

Ordinal	`838`
Address	`0x19550`

GlobalUnWire

Ordinal	`839`
Address	`0x34680`

GlobalUnfix

Ordinal	`840`
Address	`0x34690`

GlobalUnlock

Ordinal	`841`
Address	`0x15510`

GlobalWire

Ordinal	`842`
Address	`0x346b0`

Heap32First

Ordinal	`843`
Address	`0x5c3f0`

Heap32ListFirst

Ordinal	`844`
Address	`0x5c660`

Heap32ListNext

Ordinal	`845`
Address	`0x5c750`

Heap32Next

Ordinal	`846`
Address	`0x5c830`

HeapAlloc

Ordinal	`847`
Address	`0x9938c`
ForwardName	`NTDLL.RtlAllocateHeap`

HeapCompact

Ordinal	`848`
Address	`0x36890`

HeapCreate

Ordinal	`849`
Address	`0x1ec80`

HeapDestroy

Ordinal	`850`
Address	`0x1fb80`

HeapFree

Ordinal	`851`
Address	`0x15280`

HeapLock

Ordinal	`852`
Address	`0x368a0`

HeapQueryInformation

Ordinal	`853`
Address	`0x368b0`

HeapReAlloc

Ordinal	`854`
Address	`0x993f8`
ForwardName	`NTDLL.RtlReAllocateHeap`

HeapSetInformation

Ordinal	`855`
Address	`0x1eeb0`

HeapSize

Ordinal	`856`
Address	`0x9942c`
ForwardName	`NTDLL.RtlSizeHeap`

HeapSummary

Ordinal	`857`
Address	`0x368c0`

HeapUnlock

Ordinal	`858`
Address	`0x368d0`

HeapValidate

Ordinal	`859`
Address	`0x1c260`

HeapWalk

Ordinal	`860`
Address	`0x368e0`

IdnToAscii

Ordinal	`861`
Address	`0x368f0`

IdnToNameprepUnicode

Ordinal	`862`
Address	`0x36900`

IdnToUnicode

Ordinal	`863`
Address	`0x36910`

InitAtomTable

Ordinal	`864`
Address	`0x21a90`

InitOnceBeginInitialize

Ordinal	`865`
Address	`0x994be`
ForwardName	`api-ms-win-core-synch-l1-2-0.InitOnceBeginInitialize`

InitOnceComplete

Ordinal	`866`
Address	`0x99504`
ForwardName	`api-ms-win-core-synch-l1-2-0.InitOnceComplete`

InitOnceExecuteOnce

Ordinal	`867`
Address	`0x99546`
ForwardName	`api-ms-win-core-synch-l1-2-0.InitOnceExecuteOnce`

InitOnceInitialize

Ordinal	`868`
Address	`0x9958a`
ForwardName	`NTDLL.RtlRunOnceInitialize`

InitializeConditionVariable

Ordinal	`869`
Address	`0x995c1`
ForwardName	`NTDLL.RtlInitializeConditionVariable`

InitializeContext

Ordinal	`870`
Address	`0x36930`

InitializeContext2

Ordinal	`871`
Address	`0x36920`

InitializeCriticalSection

Ordinal	`872`
Address	`0x99625`
ForwardName	`NTDLL.RtlInitializeCriticalSection`

InitializeCriticalSectionAndSpinCount

Ordinal	`873`
Address	`0x22180`

InitializeCriticalSectionEx

Ordinal	`874`
Address	`0x22190`

InitializeEnclave

Ordinal	`875`
Address	`0x9969c`
ForwardName	`api-ms-win-core-enclave-l1-1-0.InitializeEnclave`

InitializeProcThreadAttributeList

Ordinal	`876`
Address	`0x996ef`
ForwardName	`api-ms-win-core-processthreads-l1-1-0.InitializeProcThreadAttributeList`

InitializeSListHead

Ordinal	`877`
Address	`0x9974b`
ForwardName	`NTDLL.RtlInitializeSListHead`

InitializeSRWLock

Ordinal	`878`
Address	`0x9977a`
ForwardName	`NTDLL.RtlInitializeSRWLock`

InitializeSynchronizationBarrier

Ordinal	`879`
Address	`0x36940`

InstallELAMCertificateInfo

Ordinal	`880`
Address	`0x997d1`
ForwardName	`api-ms-win-core-sysinfo-l1-2-1.InstallELAMCertificateInfo`

InterlockedFlushSList

Ordinal	`881`
Address	`0x99821`
ForwardName	`NTDLL.RtlInterlockedFlushSList`

InterlockedPopEntrySList

Ordinal	`882`
Address	`0x99859`
ForwardName	`NTDLL.RtlInterlockedPopEntrySList`

InterlockedPushEntrySList

Ordinal	`883`
Address	`0x99895`
ForwardName	`NTDLL.RtlInterlockedPushEntrySList`

InterlockedPushListSList

Ordinal	`884`
Address	`0x998d1`
ForwardName	`NTDLL.RtlInterlockedPushListSList`

InterlockedPushListSListEx

Ordinal	`885`
Address	`0x9990e`
ForwardName	`NTDLL.RtlInterlockedPushListSListEx`

InvalidateConsoleDIBits

Ordinal	`886`
Address	`0x62160`

IsBadCodePtr

Ordinal	`887`
Address	`0x35ab0`

IsBadHugeReadPtr

Ordinal	`888`
Address	`0x35ac0`

IsBadHugeWritePtr

Ordinal	`889`
Address	`0x35ad0`

IsBadReadPtr

Ordinal	`890`
Address	`0x156c0`

IsBadStringPtrA

Ordinal	`891`
Address	`0x35ae0`

IsBadStringPtrW

Ordinal	`892`
Address	`0x35b30`

IsBadWritePtr

Ordinal	`893`
Address	`0x5eb10`

IsCalendarLeapDay

Ordinal	`894`
Address	`0x44ca0`

IsCalendarLeapMonth

Ordinal	`895`
Address	`0x44d80`

IsCalendarLeapYear

Ordinal	`896`
Address	`0x44e60`

IsDBCSLeadByte

Ordinal	`897`
Address	`0x20350`

IsDBCSLeadByteEx

Ordinal	`898`
Address	`0x36950`

IsDebuggerPresent

Ordinal	`899`
Address	`0x1ed40`

IsEnclaveTypeSupported

Ordinal	`900`
Address	`0x99a37`
ForwardName	`api-ms-win-core-enclave-l1-1-0.IsEnclaveTypeSupported`

IsNLSDefinedString

Ordinal	`901`
Address	`0x36960`

IsNativeVhdBoot

Ordinal	`902`
Address	`0x336d0`

IsNormalizedString

Ordinal	`903`
Address	`0x36970`

IsProcessCritical

Ordinal	`904`
Address	`0x99ab5`
ForwardName	`api-ms-win-core-processthreads-l1-1-2.IsProcessCritical`

IsProcessInJob

Ordinal	`905`
Address	`0x1f3d0`

IsProcessorFeaturePresent

Ordinal	`906`
Address	`0x1cd20`

IsSystemResumeAutomatic

Ordinal	`907`
Address	`0x35040`

IsThreadAFiber

Ordinal	`908`
Address	`0x1ca20`

IsThreadpoolTimerSet

Ordinal	`909`
Address	`0x99b52`
ForwardName	`NTDLL.TpIsTimerSet`

IsValidCalDateTime

Ordinal	`910`
Address	`0x1ad40`

IsValidCodePage

Ordinal	`911`
Address	`0x1e430`

IsValidLanguageGroup

Ordinal	`912`
Address	`0x36980`

IsValidLocale

Ordinal	`913`
Address	`0x1ec20`

IsValidLocaleName

Ordinal	`914`
Address	`0x36990`

IsValidNLSVersion

Ordinal	`915`
Address	`0x369a0`

IsWow64GuestMachineSupported

Ordinal	`916`
Address	`0x99bec`
ForwardName	`api-ms-win-core-wow64-l1-1-2.IsWow64GuestMachineSupported`

IsWow64Process

Ordinal	`917`
Address	`0x1e4a0`

IsWow64Process2

Ordinal	`918`
Address	`0x99c45`
ForwardName	`api-ms-win-core-wow64-l1-1-1.IsWow64Process2`

K32EmptyWorkingSet

Ordinal	`919`
Address	`0x369b0`

K32EnumDeviceDrivers

Ordinal	`920`
Address	`0x369c0`

K32EnumPageFilesA

Ordinal	`921`
Address	`0x369d0`

K32EnumPageFilesW

Ordinal	`922`
Address	`0x369e0`

K32EnumProcessModules

Ordinal	`923`
Address	`0x1f9f0`

K32EnumProcessModulesEx

Ordinal	`924`
Address	`0x369f0`

K32EnumProcesses

Ordinal	`925`
Address	`0x1370`

K32GetDeviceDriverBaseNameA

Ordinal	`926`
Address	`0x36a00`

K32GetDeviceDriverBaseNameW

Ordinal	`927`
Address	`0x36a10`

K32GetDeviceDriverFileNameA

Ordinal	`928`
Address	`0x36a20`

K32GetDeviceDriverFileNameW

Ordinal	`929`
Address	`0x36a30`

K32GetMappedFileNameA

Ordinal	`930`
Address	`0x36a40`

K32GetMappedFileNameW

Ordinal	`931`
Address	`0x36a50`

K32GetModuleBaseNameA

Ordinal	`932`
Address	`0x36a60`

K32GetModuleBaseNameW

Ordinal	`933`
Address	`0x36a70`

K32GetModuleFileNameExA

Ordinal	`934`
Address	`0x36a80`

K32GetModuleFileNameExW

Ordinal	`935`
Address	`0x21a30`

K32GetModuleInformation

Ordinal	`936`
Address	`0x1d410`

K32GetPerformanceInfo

Ordinal	`937`
Address	`0x36a90`

K32GetProcessImageFileNameA

Ordinal	`938`
Address	`0x36aa0`

K32GetProcessImageFileNameW

Ordinal	`939`
Address	`0x1bfe0`

K32GetProcessMemoryInfo

Ordinal	`940`
Address	`0x36ab0`

K32GetWsChanges

Ordinal	`941`
Address	`0x36ad0`

K32GetWsChangesEx

Ordinal	`942`
Address	`0x36ac0`

K32InitializeProcessForWsWatch

Ordinal	`943`
Address	`0x36ae0`

K32QueryWorkingSet

Ordinal	`944`
Address	`0x36af0`

K32QueryWorkingSetEx

Ordinal	`945`
Address	`0x1c020`

LCIDToLocaleName

Ordinal	`946`
Address	`0x1f180`

LCMapStringA

Ordinal	`947`
Address	`0x36b00`

LCMapStringEx

Ordinal	`948`
Address	`0x166b0`

LCMapStringW

Ordinal	`949`
Address	`0x183a0`

LZClose

Ordinal	`950`
Address	`0x379d0`

LZCloseFile

Ordinal	`951`
Address	`0x37a80`

LZCopy

Ordinal	`952`
Address	`0x337d0`

LZCreateFileW

Ordinal	`953`
Address	`0x37b30`

LZDone

Ordinal	`954`
Address	`0x234c0`

LZInit

Ordinal	`955`
Address	`0x37c50`

LZOpenFileA

Ordinal	`956`
Address	`0x37df0`

LZOpenFileW

Ordinal	`957`
Address	`0x37ee0`

LZRead

Ordinal	`958`
Address	`0x37f90`

LZSeek

Ordinal	`959`
Address	`0x38200`

LZStart

Ordinal	`960`
Address	`0x1fd40`

LeaveCriticalSection

Ordinal	`961`
Address	`0x99f8f`
ForwardName	`NTDLL.RtlLeaveCriticalSection`

LeaveCriticalSectionWhenCallbackReturns

Ordinal	`962`
Address	`0x99fd5`
ForwardName	`NTDLL.TpCallbackLeaveCriticalSectionOnCompletion`

LoadAppInitDlls

Ordinal	`963`
Address	`0x19680`

LoadEnclaveData

Ordinal	`964`
Address	`0x9a026`
ForwardName	`api-ms-win-core-enclave-l1-1-0.LoadEnclaveData`

LoadLibraryA

Ordinal	`965`
Address	`0x1f220`

LoadLibraryExA

Ordinal	`966`
Address	`0x1d610`

LoadLibraryExW

Ordinal	`967`
Address	`0x1a050`

LoadLibraryW

Ordinal	`968`
Address	`0x1e950`

LoadModule

Ordinal	`969`
Address	`0x5eba0`

LoadPackagedLibrary

Ordinal	`970`
Address	`0x227c0`

LoadResource

Ordinal	`971`
Address	`0x1a5b0`

LoadStringBaseExW

Ordinal	`972`
Address	`0x36b10`

LoadStringBaseW

Ordinal	`973`
Address	`0x347d0`

LocalAlloc

Ordinal	`974`
Address	`0x18650`

LocalCompact

Ordinal	`975`
Address	`0x34640`

LocalFileTimeToFileTime

Ordinal	`976`
Address	`0x22640`

LocalFileTimeToLocalSystemTime

Ordinal	`977`
Address	`0x9a12a`
ForwardName	`api-ms-win-core-timezone-l1-1-1.LocalFileTimeToLocalSystemTime`

LocalFlags

Ordinal	`978`
Address	`0x5fdd0`

LocalFree

Ordinal	`979`
Address	`0x184f0`

LocalHandle

Ordinal	`980`
Address	`0x346f0`

LocalLock

Ordinal	`981`
Address	`0x1ce80`

LocalReAlloc

Ordinal	`982`
Address	`0x1e780`

LocalShrink

Ordinal	`983`
Address	`0x34640`

LocalSize

Ordinal	`984`
Address	`0x19e50`

LocalSystemTimeToLocalFileTime

Ordinal	`985`
Address	`0x9a1d6`
ForwardName	`api-ms-win-core-timezone-l1-1-1.LocalSystemTimeToLocalFileTime`

LocalUnlock

Ordinal	`986`
Address	`0x1ce70`

LocaleNameToLCID

Ordinal	`987`
Address	`0x1ce60`

LocateXStateFeature

Ordinal	`988`
Address	`0x36b30`

LockFile

Ordinal	`989`
Address	`0x22650`

LockFileEx

Ordinal	`990`
Address	`0x22660`

LockResource

Ordinal	`991`
Address	`0x1a5c0`

MapUserPhysicalPages

Ordinal	`992`
Address	`0x36b40`

MapUserPhysicalPagesScatter

Ordinal	`993`
Address	`0x3e090`

MapViewOfFile

Ordinal	`994`
Address	`0x1cd00`

MapViewOfFileEx

Ordinal	`995`
Address	`0x1c280`

MapViewOfFileExNuma

Ordinal	`996`
Address	`0x36b50`

MapViewOfFileFromApp

Ordinal	`997`
Address	`0x9a2df`
ForwardName	`api-ms-win-core-memory-l1-1-1.MapViewOfFileFromApp`

Module32First

Ordinal	`998`
Address	`0x5cac0`

Module32FirstW

Ordinal	`999`
Address	`0x1c660`

Module32Next

Ordinal	`1000`
Address	`0x5cbf0`

Module32NextW

Ordinal	`1001`
Address	`0x18510`

MoveFileA

Ordinal	`1002`
Address	`0x5bc90`

MoveFileExA

Ordinal	`1003`
Address	`0x5bcc0`

MoveFileExW

Ordinal	`1004`
Address	`0x20a60`

MoveFileTransactedA

Ordinal	`1005`
Address	`0x5bcf0`

MoveFileTransactedW

Ordinal	`1006`
Address	`0x215a0`

MoveFileW

Ordinal	`1007`
Address	`0x1e740`

MoveFileWithProgressA

Ordinal	`1008`
Address	`0x5bdc0`

MoveFileWithProgressW

Ordinal	`1009`
Address	`0x36b60`

MulDiv

Ordinal	`1010`
Address	`0x227a0`

MultiByteToWideChar

Ordinal	`1011`
Address	`0x15810`

NeedCurrentDirectoryForExePathA

Ordinal	`1012`
Address	`0x36b70`

NeedCurrentDirectoryForExePathW

Ordinal	`1013`
Address	`0x36b80`

NlsCheckPolicy

Ordinal	`1014`
Address	`0x229f0`

NlsEventDataDescCreate

Ordinal	`1015`
Address	`0x36b90`

NlsGetCacheUpdateCount

Ordinal	`1016`
Address	`0x22a00`

NlsUpdateLocale

Ordinal	`1017`
Address	`0x22a10`

NlsUpdateSystemLocale

Ordinal	`1018`
Address	`0x22a20`

NlsWriteEtwEvent

Ordinal	`1019`
Address	`0x36ba0`

NormalizeString

Ordinal	`1020`
Address	`0x36bb0`

NotifyMountMgr

Ordinal	`1021`
Address	`0x36bc0`

NotifyUILanguageChange

Ordinal	`1022`
Address	`0x47bb0`

NtVdm64CreateProcessInternalW

Ordinal	`1023`
Address	`0x35b90`

OOBEComplete

Ordinal	`1024`
Address	`0x1db70`

OfferVirtualMemory

Ordinal	`1025`
Address	`0x9a50d`
ForwardName	`api-ms-win-core-memory-l1-1-2.OfferVirtualMemory`

OpenConsoleW

Ordinal	`1026`
Address	`0x61690`

OpenConsoleWStub

Ordinal	`1027`
Address	`0x36bd0`

OpenEventA

Ordinal	`1028`
Address	`0x221a0`

OpenEventW

Ordinal	`1029`
Address	`0x221b0`

OpenFile

Ordinal	`1030`
Address	`0x5a9e0`

OpenFileById

Ordinal	`1031`
Address	`0x36be0`

OpenFileMappingA

Ordinal	`1032`
Address	`0x200d0`

OpenFileMappingW

Ordinal	`1033`
Address	`0x1f320`

OpenJobObjectA

Ordinal	`1034`
Address	`0x54ee0`

OpenJobObjectW

Ordinal	`1035`
Address	`0x54f60`

OpenMutexA

Ordinal	`1036`
Address	`0x1b5b0`

OpenMutexW

Ordinal	`1037`
Address	`0x221c0`

OpenPackageInfoByFullName

Ordinal	`1038`
Address	`0x9a5f8`
ForwardName	`kernelbase.OpenPackageInfoByFullName`

OpenPrivateNamespaceA

Ordinal	`1039`
Address	`0x5a420`

OpenPrivateNamespaceW

Ordinal	`1040`
Address	`0x20580`

OpenProcess

Ordinal	`1041`
Address	`0x1a040`

OpenProcessToken

Ordinal	`1042`
Address	`0x9a666`
ForwardName	`api-ms-win-core-processthreads-l1-1-0.OpenProcessToken`

OpenProfileUserMapping

Ordinal	`1043`
Address	`0x1fd40`

OpenSemaphoreA

Ordinal	`1044`
Address	`0x5b580`

OpenSemaphoreW

Ordinal	`1045`
Address	`0x221d0`

OpenState

Ordinal	`1046`
Address	`0x9a6dc`
ForwardName	`kernelbase.OpenState`

OpenStateExplicit

Ordinal	`1047`
Address	`0x9a703`
ForwardName	`kernelbase.OpenStateExplicit`

OpenThread

Ordinal	`1048`
Address	`0x1c0b0`

OpenThreadToken

Ordinal	`1049`
Address	`0x9a73b`
ForwardName	`api-ms-win-core-processthreads-l1-1-0.OpenThreadToken`

OpenWaitableTimerA

Ordinal	`1050`
Address	`0x5b5f0`

OpenWaitableTimerW

Ordinal	`1051`
Address	`0x221e0`

OutputDebugStringA

Ordinal	`1052`
Address	`0x1fd70`

OutputDebugStringW

Ordinal	`1053`
Address	`0x19d50`

PackageFamilyNameFromFullName

Ordinal	`1054`
Address	`0x9a7db`
ForwardName	`kernelbase.PackageFamilyNameFromFullName`

PackageFamilyNameFromId

Ordinal	`1055`
Address	`0x9a81c`
ForwardName	`kernelbase.PackageFamilyNameFromId`

PackageFullNameFromId

Ordinal	`1056`
Address	`0x9a855`
ForwardName	`kernelbase.PackageFullNameFromId`

PackageIdFromFullName

Ordinal	`1057`
Address	`0x9a88c`
ForwardName	`kernelbase.PackageIdFromFullName`

PackageNameAndPublisherIdFromFamilyName

Ordinal	`1058`
Address	`0x9a8d5`
ForwardName	`kernelbase.PackageNameAndPublisherIdFromFamilyName`

ParseApplicationUserModelId

Ordinal	`1059`
Address	`0x9a924`
ForwardName	`kernelbase.ParseApplicationUserModelId`

PeekConsoleInputA

Ordinal	`1060`
Address	`0x22ac0`

PeekConsoleInputW

Ordinal	`1061`
Address	`0x22ad0`

PeekNamedPipe

Ordinal	`1062`
Address	`0x21970`

PostQueuedCompletionStatus

Ordinal	`1063`
Address	`0x1b8d0`

PowerClearRequest

Ordinal	`1064`
Address	`0x1e790`

PowerCreateRequest

Ordinal	`1065`
Address	`0x1d640`

PowerSetRequest

Ordinal	`1066`
Address	`0x1e6b0`

PrefetchVirtualMemory

Ordinal	`1067`
Address	`0x9a9e3`
ForwardName	`api-ms-win-core-memory-l1-1-1.PrefetchVirtualMemory`

PrepareTape

Ordinal	`1068`
Address	`0x3d780`

PrivCopyFileExW

Ordinal	`1069`
Address	`0x1c8d0`

PrivMoveFileIdentityW

Ordinal	`1070`
Address	`0x5beb0`

Process32First

Ordinal	`1071`
Address	`0x5cd10`

Process32FirstW

Ordinal	`1072`
Address	`0x208b0`

Process32Next

Ordinal	`1073`
Address	`0x5ce00`

Process32NextW

Ordinal	`1074`
Address	`0x205a0`

ProcessIdToSessionId

Ordinal	`1075`
Address	`0x1bff0`

PssCaptureSnapshot

Ordinal	`1076`
Address	`0x36bf0`

PssDuplicateSnapshot

Ordinal	`1077`
Address	`0x36c00`

PssFreeSnapshot

Ordinal	`1078`
Address	`0x36c10`

PssQuerySnapshot

Ordinal	`1079`
Address	`0x36c20`

PssWalkMarkerCreate

Ordinal	`1080`
Address	`0x36c30`

PssWalkMarkerFree

Ordinal	`1081`
Address	`0x36c40`

PssWalkMarkerGetPosition

Ordinal	`1082`
Address	`0x36c50`

PssWalkMarkerRewind

Ordinal	`1083`
Address	`0x36c60`

PssWalkMarkerSeek

Ordinal	`1084`
Address	`0x36c70`

PssWalkMarkerSeekToBeginning

Ordinal	`1085`
Address	`0x36c60`

PssWalkMarkerSetPosition

Ordinal	`1086`
Address	`0x36c70`

PssWalkMarkerTell

Ordinal	`1087`
Address	`0x36c50`

PssWalkSnapshot

Ordinal	`1088`
Address	`0x36c80`

PulseEvent

Ordinal	`1089`
Address	`0x1b6b0`

PurgeComm

Ordinal	`1090`
Address	`0x228c0`

QueryActCtxSettingsW

Ordinal	`1091`
Address	`0x36c90`

QueryActCtxSettingsWWorker

Ordinal	`1092`
Address	`0x10080`

QueryActCtxW

Ordinal	`1093`
Address	`0x1ce40`

QueryActCtxWWorker

Ordinal	`1094`
Address	`0xfa30`

QueryDepthSList

Ordinal	`1095`
Address	`0x9ac15`
ForwardName	`NTDLL.RtlQueryDepthSList`

QueryDosDeviceA

Ordinal	`1096`
Address	`0x5d170`

QueryDosDeviceW

Ordinal	`1097`
Address	`0x22670`

QueryFullProcessImageNameA

Ordinal	`1098`
Address	`0x36ca0`

QueryFullProcessImageNameW

Ordinal	`1099`
Address	`0x1d8f0`

QueryIdleProcessorCycleTime

Ordinal	`1100`
Address	`0x20410`

QueryIdleProcessorCycleTimeEx

Ordinal	`1101`
Address	`0x36cb0`

QueryInformationJobObject

Ordinal	`1102`
Address	`0xf6c0`

QueryIoRateControlInformationJobObject

Ordinal	`1103`
Address	`0x55010`

QueryMemoryResourceNotification

Ordinal	`1104`
Address	`0x36cc0`

QueryPerformanceCounter

Ordinal	`1105`
Address	`0x16580`

QueryPerformanceFrequency

Ordinal	`1106`
Address	`0x1a530`

QueryProcessAffinityUpdateMode

Ordinal	`1107`
Address	`0x36cd0`

QueryProcessCycleTime

Ordinal	`1108`
Address	`0x20420`

QueryProtectedPolicy

Ordinal	`1109`
Address	`0x9ad9b`
ForwardName	`api-ms-win-core-processthreads-l1-1-2.QueryProtectedPolicy`

QueryThreadCycleTime

Ordinal	`1110`
Address	`0x1360`

QueryThreadProfiling

Ordinal	`1111`
Address	`0x3e1e0`

QueryThreadpoolStackInformation

Ordinal	`1112`
Address	`0x36ce0`

QueryUmsThreadInformation

Ordinal	`1113`
Address	`0x3c730`

QueryUnbiasedInterruptTime

Ordinal	`1114`
Address	`0x1c880`

QueueUserAPC

Ordinal	`1115`
Address	`0x1d520`

QueueUserWorkItem

Ordinal	`1116`
Address	`0x1fb20`

QuirkGetData2Worker

Ordinal	`1117`
Address	`0x68170`

QuirkGetDataWorker

Ordinal	`1118`
Address	`0x68240`

QuirkIsEnabled2Worker

Ordinal	`1119`
Address	`0x68300`

QuirkIsEnabled3Worker

Ordinal	`1120`
Address	`0x16bd0`

QuirkIsEnabledForPackage2Worker

Ordinal	`1121`
Address	`0x68440`

QuirkIsEnabledForPackage3Worker

Ordinal	`1122`
Address	`0x5990`

QuirkIsEnabledForPackage4Worker

Ordinal	`1123`
Address	`0x5ae0`

QuirkIsEnabledForPackageWorker

Ordinal	`1124`
Address	`0x3570`

QuirkIsEnabledForProcessWorker

Ordinal	`1125`
Address	`0x68470`

QuirkIsEnabledWorker

Ordinal	`1126`
Address	`0x3620`

RaiseException

Ordinal	`1127`
Address	`0x1e490`

RaiseFailFastException

Ordinal	`1128`
Address	`0x9afa0`
ForwardName	`kernelbase.RaiseFailFastException`

RaiseInvalid16BitExeError

Ordinal	`1129`
Address	`0x35d80`

ReOpenFile

Ordinal	`1130`
Address	`0x36d10`

ReadConsoleA

Ordinal	`1131`
Address	`0x22ae0`

ReadConsoleInputA

Ordinal	`1132`
Address	`0x22af0`

ReadConsoleInputExA

Ordinal	`1133`
Address	`0x9b01a`
ForwardName	`kernelbase.ReadConsoleInputExA`

ReadConsoleInputExW

Ordinal	`1134`
Address	`0x9b04d`
ForwardName	`kernelbase.ReadConsoleInputExW`

ReadConsoleInputW

Ordinal	`1135`
Address	`0x22b00`

ReadConsoleOutputA

Ordinal	`1136`
Address	`0x22c50`

ReadConsoleOutputAttribute

Ordinal	`1137`
Address	`0x22c60`

ReadConsoleOutputCharacterA

Ordinal	`1138`
Address	`0x22c70`

ReadConsoleOutputCharacterW

Ordinal	`1139`
Address	`0x22c80`

ReadConsoleOutputW

Ordinal	`1140`
Address	`0x22c90`

ReadConsoleW

Ordinal	`1141`
Address	`0x22b10`

ReadDirectoryChangesExW

Ordinal	`1142`
Address	`0x36d20`

ReadDirectoryChangesW

Ordinal	`1143`
Address	`0x219b0`

ReadFile

Ordinal	`1144`
Address	`0x22680`

ReadFileEx

Ordinal	`1145`
Address	`0x22690`

ReadFileScatter

Ordinal	`1146`
Address	`0x226a0`

ReadProcessMemory

Ordinal	`1147`
Address	`0x1b1c0`

ReadThreadProfilingData

Ordinal	`1148`
Address	`0x3e210`

ReclaimVirtualMemory

Ordinal	`1149`
Address	`0x9b195`
ForwardName	`api-ms-win-core-memory-l1-1-2.ReclaimVirtualMemory`

RegCloseKey

Ordinal	`1150`
Address	`0x219c0`

RegCopyTreeW

Ordinal	`1151`
Address	`0x36d30`

RegCreateKeyExA

Ordinal	`1152`
Address	`0x36d40`

RegCreateKeyExW

Ordinal	`1153`
Address	`0x36d50`

RegDeleteKeyExA

Ordinal	`1154`
Address	`0x36d60`

RegDeleteKeyExW

Ordinal	`1155`
Address	`0x36d70`

RegDeleteTreeA

Ordinal	`1156`
Address	`0x36d80`

RegDeleteTreeW

Ordinal	`1157`
Address	`0x36d90`

RegDeleteValueA

Ordinal	`1158`
Address	`0x36da0`

RegDeleteValueW

Ordinal	`1159`
Address	`0x36db0`

RegDisablePredefinedCacheEx

Ordinal	`1160`
Address	`0x36dc0`

RegEnumKeyExA

Ordinal	`1161`
Address	`0x36dd0`

RegEnumKeyExW

Ordinal	`1162`
Address	`0x36e20`

RegEnumValueA

Ordinal	`1163`
Address	`0x36e70`

RegEnumValueW

Ordinal	`1164`
Address	`0x36ec0`

RegFlushKey

Ordinal	`1165`
Address	`0x36f10`

RegGetKeySecurity

Ordinal	`1166`
Address	`0x36f20`

RegGetValueA

Ordinal	`1167`
Address	`0x36f30`

RegGetValueW

Ordinal	`1168`
Address	`0x36f40`

RegLoadKeyA

Ordinal	`1169`
Address	`0x36f50`

RegLoadKeyW

Ordinal	`1170`
Address	`0x36f60`

RegLoadMUIStringA

Ordinal	`1171`
Address	`0x36f70`

RegLoadMUIStringW

Ordinal	`1172`
Address	`0x36f80`

RegNotifyChangeKeyValue

Ordinal	`1173`
Address	`0x36f90`

RegOpenCurrentUser

Ordinal	`1174`
Address	`0x20590`

RegOpenKeyExA

Ordinal	`1175`
Address	`0x36fa0`

RegOpenKeyExW

Ordinal	`1176`
Address	`0x1fc70`

RegOpenUserClassesRoot

Ordinal	`1177`
Address	`0x20560`

RegQueryInfoKeyA

Ordinal	`1178`
Address	`0x36fb0`

RegQueryInfoKeyW

Ordinal	`1179`
Address	`0x37030`

RegQueryValueExA

Ordinal	`1180`
Address	`0x370b0`

RegQueryValueExW

Ordinal	`1181`
Address	`0x370c0`

RegRestoreKeyA

Ordinal	`1182`
Address	`0x370d0`

RegRestoreKeyW

Ordinal	`1183`
Address	`0x370e0`

RegSaveKeyExA

Ordinal	`1184`
Address	`0x370f0`

RegSaveKeyExW

Ordinal	`1185`
Address	`0x37100`

RegSetKeySecurity

Ordinal	`1186`
Address	`0x37110`

RegSetValueExA

Ordinal	`1187`
Address	`0x37120`

RegSetValueExW

Ordinal	`1188`
Address	`0x37130`

RegUnLoadKeyA

Ordinal	`1189`
Address	`0x37140`

RegUnLoadKeyW

Ordinal	`1190`
Address	`0x37150`

RegisterApplicationRecoveryCallback

Ordinal	`1191`
Address	`0x1fe50`

RegisterApplicationRestart

Ordinal	`1192`
Address	`0x1bb40`

RegisterBadMemoryNotification

Ordinal	`1193`
Address	`0x37160`

RegisterConsoleIME

Ordinal	`1194`
Address	`0x61cc0`

RegisterConsoleOS2

Ordinal	`1195`
Address	`0x61ce0`

RegisterConsoleVDM

Ordinal	`1196`
Address	`0x617b0`

RegisterWaitForInputIdle

Ordinal	`1197`
Address	`0x1e690`

RegisterWaitForSingleObject

Ordinal	`1198`
Address	`0x108e0`

RegisterWaitForSingleObjectEx

Ordinal	`1199`
Address	`0x21af0`

RegisterWaitUntilOOBECompleted

Ordinal	`1200`
Address	`0x1dac0`

RegisterWowBaseHandlers

Ordinal	`1201`
Address	`0x346c0`

RegisterWowExec

Ordinal	`1202`
Address	`0x3c080`

ReleaseActCtx

Ordinal	`1203`
Address	`0x1fc00`

ReleaseActCtxWorker

Ordinal	`1204`
Address	`0x1d090`

ReleaseMutex

Ordinal	`1205`
Address	`0x221f0`

ReleaseMutexWhenCallbackReturns

Ordinal	`1206`
Address	`0x9b5ce`
ForwardName	`NTDLL.TpCallbackReleaseMutexOnCompletion`

ReleaseSRWLockExclusive

Ordinal	`1207`
Address	`0x9b60f`
ForwardName	`NTDLL.RtlReleaseSRWLockExclusive`

ReleaseSRWLockShared

Ordinal	`1208`
Address	`0x9b645`
ForwardName	`NTDLL.RtlReleaseSRWLockShared`

ReleaseSemaphore

Ordinal	`1209`
Address	`0x22200`

ReleaseSemaphoreWhenCallbackReturns

Ordinal	`1210`
Address	`0x9b698`
ForwardName	`NTDLL.TpCallbackReleaseSemaphoreOnCompletion`

RemoveDirectoryA

Ordinal	`1211`
Address	`0x226b0`

RemoveDirectoryTransactedA

Ordinal	`1212`
Address	`0x33b80`

RemoveDirectoryTransactedW

Ordinal	`1213`
Address	`0x5b150`

RemoveDirectoryW

Ordinal	`1214`
Address	`0x226c0`

RemoveDllDirectory

Ordinal	`1215`
Address	`0x9b730`
ForwardName	`api-ms-win-core-libraryloader-l1-1-0.RemoveDllDirectory`

RemoveLocalAlternateComputerNameA

Ordinal	`1216`
Address	`0x542d0`

RemoveLocalAlternateComputerNameW

Ordinal	`1217`
Address	`0x54330`

RemoveSecureMemoryCacheCallback

Ordinal	`1218`
Address	`0x346d0`

RemoveVectoredContinueHandler

Ordinal	`1219`
Address	`0x9b7ea`
ForwardName	`NTDLL.RtlRemoveVectoredContinueHandler`

RemoveVectoredExceptionHandler

Ordinal	`1220`
Address	`0x9b830`
ForwardName	`NTDLL.RtlRemoveVectoredExceptionHandler`

ReplaceFile

Ordinal	`1221`
Address	`0x37170`

ReplaceFileA

Ordinal	`1222`
Address	`0x5aee0`

ReplaceFileW

Ordinal	`1223`
Address	`0x37170`

ReplacePartitionUnit

Ordinal	`1224`
Address	`0x35f40`

RequestDeviceWakeup

Ordinal	`1225`
Address	`0x35020`

RequestWakeupLatency

Ordinal	`1226`
Address	`0x35020`

ResetEvent

Ordinal	`1227`
Address	`0x22210`

ResetWriteWatch

Ordinal	`1228`
Address	`0x18390`

ResizePseudoConsole

Ordinal	`1229`
Address	`0x22b20`

ResolveDelayLoadedAPI

Ordinal	`1230`
Address	`0x9b901`
ForwardName	`NTDLL.LdrResolveDelayLoadedAPI`

ResolveDelayLoadsFromDll

Ordinal	`1231`
Address	`0x9b939`
ForwardName	`NTDLL.LdrResolveDelayLoadsFromDll`

ResolveLocaleName

Ordinal	`1232`
Address	`0x1f330`

RestoreLastError

Ordinal	`1233`
Address	`0x9b97e`
ForwardName	`NTDLL.RtlRestoreLastWin32Error`

ResumeThread

Ordinal	`1234`
Address	`0x1d360`

RtlAddFunctionTable

Ordinal	`1235`
Address	`0x1fd10`

RtlCaptureContext

Ordinal	`1236`
Address	`0x21e60`

RtlCaptureStackBackTrace

Ordinal	`1237`
Address	`0x20360`

RtlCompareMemory

Ordinal	`1238`
Address	`0x37180`

RtlCopyMemory

Ordinal	`1239`
Address	`0x37190`

RtlDeleteFunctionTable

Ordinal	`1240`
Address	`0x371b0`

RtlFillMemory

Ordinal	`1241`
Address	`0x371c0`

RtlInstallFunctionTableCallback

Ordinal	`1242`
Address	`0x371f0`

RtlLookupFunctionEntry

Ordinal	`1243`
Address	`0x1c8a0`

RtlMoveMemory

Ordinal	`1244`
Address	`0x21e90`

RtlPcToFileHeader

Ordinal	`1245`
Address	`0x1c9c0`

RtlRaiseException

Ordinal	`1246`
Address	`0x37200`

RtlRestoreContext

Ordinal	`1247`
Address	`0x37210`

RtlUnwind

Ordinal	`1248`
Address	`0x37220`

RtlUnwindEx

Ordinal	`1249`
Address	`0x1e670`

RtlVirtualUnwind

Ordinal	`1250`
Address	`0x1010`

RtlZeroMemory

Ordinal	`1251`
Address	`0x9badd`
ForwardName	`NTDLL.RtlZeroMemory`

ScrollConsoleScreenBufferA

Ordinal	`1252`
Address	`0x22ca0`

ScrollConsoleScreenBufferW

Ordinal	`1253`
Address	`0x22cb0`

SearchPathA

Ordinal	`1254`
Address	`0x37230`

SearchPathW

Ordinal	`1255`
Address	`0x204f0`

SetCachedSigningLevel

Ordinal	`1256`
Address	`0x37240`

SetCalendarInfoA

Ordinal	`1257`
Address	`0x45b70`

SetCalendarInfoW

Ordinal	`1258`
Address	`0x37250`

SetComPlusPackageInstallStatus

Ordinal	`1259`
Address	`0x3de40`

SetCommBreak

Ordinal	`1260`
Address	`0x228d0`

SetCommConfig

Ordinal	`1261`
Address	`0x228e0`

SetCommMask

Ordinal	`1262`
Address	`0x228f0`

SetCommState

Ordinal	`1263`
Address	`0x22900`

SetCommTimeouts

Ordinal	`1264`
Address	`0x22910`

SetComputerNameA

Ordinal	`1265`
Address	`0x37260`

SetComputerNameEx2W

Ordinal	`1266`
Address	`0x37270`

SetComputerNameExA

Ordinal	`1267`
Address	`0x37280`

SetComputerNameExW

Ordinal	`1268`
Address	`0x37290`

SetComputerNameW

Ordinal	`1269`
Address	`0x372a0`

SetConsoleActiveScreenBuffer

Ordinal	`1270`
Address	`0x22cc0`

SetConsoleCP

Ordinal	`1271`
Address	`0x22cd0`

SetConsoleCtrlHandler

Ordinal	`1272`
Address	`0x22b30`

SetConsoleCursor

Ordinal	`1273`
Address	`0x61850`

SetConsoleCursorInfo

Ordinal	`1274`
Address	`0x22ce0`

SetConsoleCursorMode

Ordinal	`1275`
Address	`0x61d40`

SetConsoleCursorPosition

Ordinal	`1276`
Address	`0x22cf0`

SetConsoleDisplayMode

Ordinal	`1277`
Address	`0x22f90`

SetConsoleFont

Ordinal	`1278`
Address	`0x620c0`

SetConsoleHardwareState

Ordinal	`1279`
Address	`0x618a0`

SetConsoleHistoryInfo

Ordinal	`1280`
Address	`0x22fa0`

SetConsoleIcon

Ordinal	`1281`
Address	`0x62110`

SetConsoleInputExeNameA

Ordinal	`1282`
Address	`0x9bd44`
ForwardName	`kernelbase.SetConsoleInputExeNameA`

SetConsoleInputExeNameW

Ordinal	`1283`
Address	`0x9bd7f`
ForwardName	`kernelbase.SetConsoleInputExeNameW`

SetConsoleKeyShortcuts

Ordinal	`1284`
Address	`0x61900`

SetConsoleLocalEUDC

Ordinal	`1285`
Address	`0x61da0`

SetConsoleMaximumWindowSize

Ordinal	`1286`
Address	`0x1fd40`

SetConsoleMenuClose

Ordinal	`1287`
Address	`0x61990`

SetConsoleMode

Ordinal	`1288`
Address	`0x22b40`

SetConsoleNlsMode

Ordinal	`1289`
Address	`0x61e60`

SetConsoleNumberOfCommandsA

Ordinal	`1290`
Address	`0x22fb0`

SetConsoleNumberOfCommandsW

Ordinal	`1291`
Address	`0x22fc0`

SetConsoleOS2OemFormat

Ordinal	`1292`
Address	`0x61eb0`

SetConsoleOutputCP

Ordinal	`1293`
Address	`0x22d00`

SetConsolePalette

Ordinal	`1294`
Address	`0x619f0`

SetConsoleScreenBufferInfoEx

Ordinal	`1295`
Address	`0x22d10`

SetConsoleScreenBufferSize

Ordinal	`1296`
Address	`0x22d20`

SetConsoleTextAttribute

Ordinal	`1297`
Address	`0x22d30`

SetConsoleTitleA

Ordinal	`1298`
Address	`0x22d40`

SetConsoleTitleW

Ordinal	`1299`
Address	`0x22d50`

SetConsoleWindowInfo

Ordinal	`1300`
Address	`0x22d60`

SetCriticalSectionSpinCount

Ordinal	`1301`
Address	`0x9bf35`
ForwardName	`NTDLL.RtlSetCriticalSectionSpinCount`

SetCurrentConsoleFontEx

Ordinal	`1302`
Address	`0x22fd0`

SetCurrentDirectoryA

Ordinal	`1303`
Address	`0x372b0`

SetCurrentDirectoryW

Ordinal	`1304`
Address	`0x1fce0`

SetDefaultCommConfigA

Ordinal	`1305`
Address	`0x38cb0`

SetDefaultCommConfigW

Ordinal	`1306`
Address	`0x38d40`

SetDefaultDllDirectories

Ordinal	`1307`
Address	`0x9bfe1`
ForwardName	`api-ms-win-core-libraryloader-l1-1-0.SetDefaultDllDirectories`

SetDllDirectoryA

Ordinal	`1308`
Address	`0x5e960`

SetDllDirectoryW

Ordinal	`1309`
Address	`0x1f230`

SetDynamicTimeZoneInformation

Ordinal	`1310`
Address	`0x372c0`

SetEndOfFile

Ordinal	`1311`
Address	`0x226d0`

SetEnvironmentStringsA

Ordinal	`1312`
Address	`0x5ffa0`

SetEnvironmentStringsW

Ordinal	`1313`
Address	`0x372d0`

SetEnvironmentVariableA

Ordinal	`1314`
Address	`0x1d3c0`

SetEnvironmentVariableW

Ordinal	`1315`
Address	`0x1d900`

SetErrorMode

Ordinal	`1316`
Address	`0x1b730`

SetEvent

Ordinal	`1317`
Address	`0x22220`

SetEventWhenCallbackReturns

Ordinal	`1318`
Address	`0x9c0fc`
ForwardName	`NTDLL.TpCallbackSetEventOnCompletion`

SetFileApisToANSI

Ordinal	`1319`
Address	`0x372e0`

SetFileApisToOEM

Ordinal	`1320`
Address	`0x372f0`

SetFileAttributesA

Ordinal	`1321`
Address	`0x226e0`

SetFileAttributesTransactedA

Ordinal	`1322`
Address	`0x5c300`

SetFileAttributesTransactedW

Ordinal	`1323`
Address	`0x5c350`

SetFileAttributesW

Ordinal	`1324`
Address	`0x226f0`

SetFileBandwidthReservation

Ordinal	`1325`
Address	`0x33ed0`

SetFileCompletionNotificationModes

Ordinal	`1326`
Address	`0x1cdd0`

SetFileInformationByHandle

Ordinal	`1327`
Address	`0x22700`

SetFileIoOverlappedRange

Ordinal	`1328`
Address	`0x37300`

SetFilePointer

Ordinal	`1329`
Address	`0x22710`

SetFilePointerEx

Ordinal	`1330`
Address	`0x22720`

SetFileShortNameA

Ordinal	`1331`
Address	`0x33ff0`

SetFileShortNameW

Ordinal	`1332`
Address	`0x34030`

SetFileTime

Ordinal	`1333`
Address	`0x22730`

SetFileValidData

Ordinal	`1334`
Address	`0x22740`

SetFirmwareEnvironmentVariableA

Ordinal	`1335`
Address	`0x5f3d0`

SetFirmwareEnvironmentVariableExA

Ordinal	`1336`
Address	`0x5f3f0`

SetFirmwareEnvironmentVariableExW

Ordinal	`1337`
Address	`0x5f4e0`

SetFirmwareEnvironmentVariableW

Ordinal	`1338`
Address	`0x5f5a0`

SetHandleCount

Ordinal	`1339`
Address	`0x1fc80`

SetHandleInformation

Ordinal	`1340`
Address	`0x220b0`

SetInformationJobObject

Ordinal	`1341`
Address	`0x1c8e0`

SetIoRateControlInformationJobObject

Ordinal	`1342`
Address	`0x55380`

SetLastConsoleEventActive

Ordinal	`1343`
Address	`0x9c377`
ForwardName	`kernelbase.SetLastConsoleEventActive`

SetLastError

Ordinal	`1344`
Address	`0x158a0`

SetLocalPrimaryComputerNameA

Ordinal	`1345`
Address	`0x54550`

SetLocalPrimaryComputerNameW

Ordinal	`1346`
Address	`0x545b0`

SetLocalTime

Ordinal	`1347`
Address	`0x37310`

SetLocaleInfoA

Ordinal	`1348`
Address	`0x45c40`

SetLocaleInfoW

Ordinal	`1349`
Address	`0x37320`

SetMailslotInfo

Ordinal	`1350`
Address	`0x5b450`

SetMessageWaitingIndicator

Ordinal	`1351`
Address	`0x35020`

SetNamedPipeAttribute

Ordinal	`1352`
Address	`0x34b80`

SetNamedPipeHandleState

Ordinal	`1353`
Address	`0x20440`

SetPriorityClass

Ordinal	`1354`
Address	`0x1f9a0`

SetProcessAffinityMask

Ordinal	`1355`
Address	`0x5f050`

SetProcessAffinityUpdateMode

Ordinal	`1356`
Address	`0x21960`

SetProcessDEPPolicy

Ordinal	`1357`
Address	`0x35f00`

SetProcessDefaultCpuSets

Ordinal	`1358`
Address	`0x9c4d9`
ForwardName	`api-ms-win-core-processthreads-l1-1-3.SetProcessDefaultCpuSets`

SetProcessInformation

Ordinal	`1359`
Address	`0x22060`

SetProcessMitigationPolicy

Ordinal	`1360`
Address	`0x9c549`
ForwardName	`api-ms-win-core-processthreads-l1-1-1.SetProcessMitigationPolicy`

SetProcessPreferredUILanguages

Ordinal	`1361`
Address	`0x37330`

SetProcessPriorityBoost

Ordinal	`1362`
Address	`0x1fcf0`

SetProcessShutdownParameters

Ordinal	`1363`
Address	`0x1f660`

SetProcessWorkingSetSize

Ordinal	`1364`
Address	`0x3e0c0`

SetProcessWorkingSetSizeEx

Ordinal	`1365`
Address	`0x37340`

SetProtectedPolicy

Ordinal	`1366`
Address	`0x9c625`
ForwardName	`api-ms-win-core-processthreads-l1-1-2.SetProtectedPolicy`

SetSearchPathMode

Ordinal	`1367`
Address	`0x34a40`

SetStdHandle

Ordinal	`1368`
Address	`0x1ef10`

SetStdHandleEx

Ordinal	`1369`
Address	`0x37350`

SetSystemFileCacheSize

Ordinal	`1370`
Address	`0x37360`

SetSystemPowerState

Ordinal	`1371`
Address	`0x35060`

SetSystemTime

Ordinal	`1372`
Address	`0x37370`

SetSystemTimeAdjustment

Ordinal	`1373`
Address	`0x33990`

SetTapeParameters

Ordinal	`1374`
Address	`0x3d7c0`

SetTapePosition

Ordinal	`1375`
Address	`0x3d810`

SetTermsrvAppInstallMode

Ordinal	`1376`
Address	`0x604d0`

SetThreadAffinityMask

Ordinal	`1377`
Address	`0x1e8b0`

SetThreadContext

Ordinal	`1378`
Address	`0x37380`

SetThreadDescription

Ordinal	`1379`
Address	`0x9c754`
ForwardName	`api-ms-win-core-processthreads-l1-1-3.SetThreadDescription`

SetThreadErrorMode

Ordinal	`1380`
Address	`0x1b210`

SetThreadExecutionState

Ordinal	`1381`
Address	`0x1f9c0`

SetThreadGroupAffinity

Ordinal	`1382`
Address	`0x1fac0`

SetThreadIdealProcessor

Ordinal	`1383`
Address	`0x1fa80`

SetThreadIdealProcessorEx

Ordinal	`1384`
Address	`0x37390`

SetThreadInformation

Ordinal	`1385`
Address	`0x22070`

SetThreadLocale

Ordinal	`1386`
Address	`0x19e30`

SetThreadPreferredUILanguages

Ordinal	`1387`
Address	`0x1d080`

SetThreadPriority

Ordinal	`1388`
Address	`0x1a500`

SetThreadPriorityBoost

Ordinal	`1389`
Address	`0x1fd60`

SetThreadSelectedCpuSets

Ordinal	`1390`
Address	`0x9c888`
ForwardName	`api-ms-win-core-processthreads-l1-1-3.SetThreadSelectedCpuSets`

SetThreadStackGuarantee

Ordinal	`1391`
Address	`0x1d530`

SetThreadToken

Ordinal	`1392`
Address	`0x9c8ee`
ForwardName	`api-ms-win-core-processthreads-l1-1-0.SetThreadToken`

SetThreadUILanguage

Ordinal	`1393`
Address	`0x1b8e0`

SetThreadpoolStackInformation

Ordinal	`1394`
Address	`0x373a0`

SetThreadpoolThreadMaximum

Ordinal	`1395`
Address	`0x9c970`
ForwardName	`NTDLL.TpSetPoolMaxThreads`

SetThreadpoolThreadMinimum

Ordinal	`1396`
Address	`0x1e4c0`

SetThreadpoolTimer

Ordinal	`1397`
Address	`0x9c9b8`
ForwardName	`NTDLL.TpSetTimer`

SetThreadpoolTimerEx

Ordinal	`1398`
Address	`0x9c9de`
ForwardName	`NTDLL.TpSetTimerEx`

SetThreadpoolWait

Ordinal	`1399`
Address	`0x9ca03`
ForwardName	`NTDLL.TpSetWait`

SetThreadpoolWaitEx

Ordinal	`1400`
Address	`0x9ca27`
ForwardName	`NTDLL.TpSetWaitEx`

SetTimeZoneInformation

Ordinal	`1401`
Address	`0x373d0`

SetTimerQueueTimer

Ordinal	`1402`
Address	`0x3e100`

SetUmsThreadInformation

Ordinal	`1403`
Address	`0x3c770`

SetUnhandledExceptionFilter

Ordinal	`1404`
Address	`0x1ec10`

SetUserGeoID

Ordinal	`1405`
Address	`0x4ddd0`

SetUserGeoName

Ordinal	`1406`
Address	`0x4ddf0`

SetVDMCurrentDirectories

Ordinal	`1407`
Address	`0x3c0e0`

SetVolumeLabelA

Ordinal	`1408`
Address	`0x5f680`

SetVolumeLabelW

Ordinal	`1409`
Address	`0x5f720`

SetVolumeMountPointA

Ordinal	`1410`
Address	`0x5e460`

SetVolumeMountPointW

Ordinal	`1411`
Address	`0x20dc0`

SetVolumeMountPointWStub

Ordinal	`1412`
Address	`0x373e0`

SetWaitableTimer

Ordinal	`1413`
Address	`0x22230`

SetWaitableTimerEx

Ordinal	`1414`
Address	`0x9cb53`
ForwardName	`api-ms-win-core-synch-l1-1-0.SetWaitableTimerEx`

SetXStateFeaturesMask

Ordinal	`1415`
Address	`0x373f0`

SetupComm

Ordinal	`1416`
Address	`0x22920`

ShowConsoleCursor

Ordinal	`1417`
Address	`0x61a50`

SignalObjectAndWait

Ordinal	`1418`
Address	`0x37400`

SizeofResource

Ordinal	`1419`
Address	`0x1a5d0`

Sleep

Ordinal	`1420`
Address	`0x1b660`

SleepConditionVariableCS

Ordinal	`1421`
Address	`0x9cbf7`
ForwardName	`api-ms-win-core-synch-l1-2-0.SleepConditionVariableCS`

SleepConditionVariableSRW

Ordinal	`1422`
Address	`0x9cc47`
ForwardName	`api-ms-win-core-synch-l1-2-0.SleepConditionVariableSRW`

SleepEx

Ordinal	`1423`
Address	`0x22240`

SortCloseHandle

Ordinal	`1424`
Address	`0x1ec30`

SortGetHandle

Ordinal	`1425`
Address	`0x5f90`

StartThreadpoolIo

Ordinal	`1426`
Address	`0x9ccb6`
ForwardName	`NTDLL.TpStartAsyncIoOperation`

SubmitThreadpoolWork

Ordinal	`1427`
Address	`0x9cce9`
ForwardName	`NTDLL.TpPostWork`

SuspendThread

Ordinal	`1428`
Address	`0x1f340`

SwitchToFiber

Ordinal	`1429`
Address	`0x229e0`

SwitchToThread

Ordinal	`1430`
Address	`0x17940`

SystemTimeToFileTime

Ordinal	`1431`
Address	`0x1d910`

SystemTimeToTzSpecificLocalTime

Ordinal	`1432`
Address	`0x20520`

SystemTimeToTzSpecificLocalTimeEx

Ordinal	`1433`
Address	`0x9cd7c`
ForwardName	`api-ms-win-core-timezone-l1-1-0.SystemTimeToTzSpecificLocalTimeEx`

TerminateJobObject

Ordinal	`1434`
Address	`0x1fa90`

TerminateProcess

Ordinal	`1435`
Address	`0x1f8a0`

TerminateThread

Ordinal	`1436`
Address	`0x37410`

TermsrvAppInstallMode

Ordinal	`1437`
Address	`0x18320`

TermsrvConvertSysRootToUserDir

Ordinal	`1438`
Address	`0x60860`

TermsrvCreateRegEntry

Ordinal	`1439`
Address	`0x1cdb0`

TermsrvDeleteKey

Ordinal	`1440`
Address	`0x1e470`

TermsrvDeleteValue

Ordinal	`1441`
Address	`0x1d8d0`

TermsrvGetPreSetValue

Ordinal	`1442`
Address	`0x1a540`

TermsrvGetWindowsDirectoryA

Ordinal	`1443`
Address	`0x204d0`

TermsrvGetWindowsDirectoryW

Ordinal	`1444`
Address	`0x1c050`

TermsrvOpenRegEntry

Ordinal	`1445`
Address	`0x16bb0`

TermsrvOpenUserClasses

Ordinal	`1446`
Address	`0x1c7d0`

TermsrvRestoreKey

Ordinal	`1447`
Address	`0x613e0`

TermsrvSetKeySecurity

Ordinal	`1448`
Address	`0x1b260`

TermsrvSetValueKey

Ordinal	`1449`
Address	`0x1b220`

TermsrvSyncUserIniFileExt

Ordinal	`1450`
Address	`0x61400`

Thread32First

Ordinal	`1451`
Address	`0x5cef0`

Thread32Next

Ordinal	`1452`
Address	`0x5cff0`

TlsAlloc

Ordinal	`1453`
Address	`0x1c010`

TlsFree

Ordinal	`1454`
Address	`0x1c870`

TlsGetValue

Ordinal	`1455`
Address	`0x15250`

TlsSetValue

Ordinal	`1456`
Address	`0x15800`

Toolhelp32ReadProcessMemory

Ordinal	`1457`
Address	`0x376b0`

TransactNamedPipe

Ordinal	`1458`
Address	`0x37420`

TransmitCommChar

Ordinal	`1459`
Address	`0x22930`

TryAcquireSRWLockExclusive

Ordinal	`1460`
Address	`0x9cfcd`
ForwardName	`NTDLL.RtlTryAcquireSRWLockExclusive`

TryAcquireSRWLockShared

Ordinal	`1461`
Address	`0x9d009`
ForwardName	`NTDLL.RtlTryAcquireSRWLockShared`

TryEnterCriticalSection

Ordinal	`1462`
Address	`0x9d042`
ForwardName	`NTDLL.RtlTryEnterCriticalSection`

TrySubmitThreadpoolCallback

Ordinal	`1463`
Address	`0x1fca0`

TzSpecificLocalTimeToSystemTime

Ordinal	`1464`
Address	`0x37430`

TzSpecificLocalTimeToSystemTimeEx

Ordinal	`1465`
Address	`0x9d0c1`
ForwardName	`api-ms-win-core-timezone-l1-1-0.TzSpecificLocalTimeToSystemTimeEx`

UTRegister

Ordinal	`1466`
Address	`0x34a70`

UTUnRegister

Ordinal	`1467`
Address	`0x234c0`

UmsThreadYield

Ordinal	`1468`
Address	`0x3c7a0`

UnhandledExceptionFilter

Ordinal	`1469`
Address	`0x37440`

UnlockFile

Ordinal	`1470`
Address	`0x22750`

UnlockFileEx

Ordinal	`1471`
Address	`0x22760`

UnmapViewOfFile

Ordinal	`1472`
Address	`0x1d3a0`

UnmapViewOfFileEx

Ordinal	`1473`
Address	`0x9d17d`
ForwardName	`api-ms-win-core-memory-l1-1-1.UnmapViewOfFileEx`

UnregisterApplicationRecoveryCallback

Ordinal	`1474`
Address	`0x3df70`

UnregisterApplicationRestart

Ordinal	`1475`
Address	`0x3df90`

UnregisterBadMemoryNotification

Ordinal	`1476`
Address	`0x37450`

UnregisterConsoleIME

Ordinal	`1477`
Address	`0x61cc0`

UnregisterWait

Ordinal	`1478`
Address	`0xf4a0`

UnregisterWaitEx

Ordinal	`1479`
Address	`0x1ec90`

UnregisterWaitUntilOOBECompleted

Ordinal	`1480`
Address	`0x5ff40`

UpdateCalendarDayOfWeek

Ordinal	`1481`
Address	`0x1acc0`

UpdateProcThreadAttribute

Ordinal	`1482`
Address	`0x9d298`
ForwardName	`api-ms-win-core-processthreads-l1-1-0.UpdateProcThreadAttribute`

UpdateResourceA

Ordinal	`1483`
Address	`0x43f40`

UpdateResourceW

Ordinal	`1484`
Address	`0x440c0`

VDMConsoleOperation

Ordinal	`1485`
Address	`0x621b0`

VDMOperationStarted

Ordinal	`1486`
Address	`0x3c3a0`

VerLanguageNameA

Ordinal	`1487`
Address	`0x1fd00`

VerLanguageNameW

Ordinal	`1488`
Address	`0x1eee0`

VerSetConditionMask

Ordinal	`1489`
Address	`0x9d356`
ForwardName	`NTDLL.VerSetConditionMask`

VerifyConsoleIoHandle

Ordinal	`1490`
Address	`0x1fa30`

VerifyScripts

Ordinal	`1491`
Address	`0x37460`

VerifyVersionInfoA

Ordinal	`1492`
Address	`0x20810`

VerifyVersionInfoW

Ordinal	`1493`
Address	`0x16540`

VirtualAlloc

Ordinal	`1494`
Address	`0x19d80`

VirtualAllocEx

Ordinal	`1495`
Address	`0x37470`

VirtualAllocExNuma

Ordinal	`1496`
Address	`0x20b80`

VirtualFree

Ordinal	`1497`
Address	`0x19da0`

VirtualFreeEx

Ordinal	`1498`
Address	`0x37480`

VirtualLock

Ordinal	`1499`
Address	`0x1f2f0`

VirtualProtect

Ordinal	`1500`
Address	`0x1b680`

VirtualProtectEx

Ordinal	`1501`
Address	`0x37490`

VirtualQuery

Ordinal	`1502`
Address	`0x1b6a0`

VirtualQueryEx

Ordinal	`1503`
Address	`0x1b670`

VirtualUnlock

Ordinal	`1504`
Address	`0x1c040`

WTSGetActiveConsoleSessionId

Ordinal	`1505`
Address	`0x1eed0`

WaitCommEvent

Ordinal	`1506`
Address	`0x22940`

WaitForDebugEvent

Ordinal	`1507`
Address	`0x374a0`

WaitForDebugEventEx

Ordinal	`1508`
Address	`0x9d4aa`
ForwardName	`api-ms-win-core-debug-l1-1-2.WaitForDebugEventEx`

WaitForMultipleObjects

Ordinal	`1509`
Address	`0x22250`

WaitForMultipleObjectsEx

Ordinal	`1510`
Address	`0x22260`

WaitForSingleObject

Ordinal	`1511`
Address	`0x22270`

WaitForSingleObjectEx

Ordinal	`1512`
Address	`0x22280`

WaitForThreadpoolIoCallbacks

Ordinal	`1513`
Address	`0x9d552`
ForwardName	`NTDLL.TpWaitForIoCompletion`

WaitForThreadpoolTimerCallbacks

Ordinal	`1514`
Address	`0x9d58e`
ForwardName	`NTDLL.TpWaitForTimer`

WaitForThreadpoolWaitCallbacks

Ordinal	`1515`
Address	`0x9d5c2`
ForwardName	`NTDLL.TpWaitForWait`

WaitForThreadpoolWorkCallbacks

Ordinal	`1516`
Address	`0x9d5f5`
ForwardName	`NTDLL.TpWaitForWork`

WaitNamedPipeA

Ordinal	`1517`
Address	`0x5a150`

WaitNamedPipeW

Ordinal	`1518`
Address	`0x374b0`

WakeAllConditionVariable

Ordinal	`1519`
Address	`0x9d640`
ForwardName	`NTDLL.RtlWakeAllConditionVariable`

WakeConditionVariable

Ordinal	`1520`
Address	`0x9d678`
ForwardName	`NTDLL.RtlWakeConditionVariable`

WerGetFlags

Ordinal	`1521`
Address	`0x3dfa0`

WerGetFlagsWorker

Ordinal	`1522`
Address	`0x3dfa0`

WerRegisterAdditionalProcess

Ordinal	`1523`
Address	`0x374c0`

WerRegisterAppLocalDump

Ordinal	`1524`
Address	`0x374d0`

WerRegisterCustomMetadata

Ordinal	`1525`
Address	`0x374e0`

WerRegisterExcludedMemoryBlock

Ordinal	`1526`
Address	`0x374f0`

WerRegisterFile

Ordinal	`1527`
Address	`0x1ef00`

WerRegisterFileWorker

Ordinal	`1528`
Address	`0x3dfb0`

WerRegisterMemoryBlock

Ordinal	`1529`
Address	`0x1f300`

WerRegisterMemoryBlockWorker

Ordinal	`1530`
Address	`0x3dfc0`

WerRegisterRuntimeExceptionModule

Ordinal	`1531`
Address	`0x1f3b0`

WerRegisterRuntimeExceptionModuleWorker

Ordinal	`1532`
Address	`0x3dfd0`

WerSetFlags

Ordinal	`1533`
Address	`0x1bd10`

WerSetFlagsWorker

Ordinal	`1534`
Address	`0x1bd10`

WerUnregisterAdditionalProcess

Ordinal	`1535`
Address	`0x37500`

WerUnregisterAppLocalDump

Ordinal	`1536`
Address	`0x37510`

WerUnregisterCustomMetadata

Ordinal	`1537`
Address	`0x37520`

WerUnregisterExcludedMemoryBlock

Ordinal	`1538`
Address	`0x37530`

WerUnregisterFile

Ordinal	`1539`
Address	`0x1eef0`

WerUnregisterFileWorker

Ordinal	`1540`
Address	`0x3dfe0`

WerUnregisterMemoryBlock

Ordinal	`1541`
Address	`0x1f8b0`

WerUnregisterMemoryBlockWorker

Ordinal	`1542`
Address	`0x3dff0`

WerUnregisterRuntimeExceptionModule

Ordinal	`1543`
Address	`0x37540`

WerUnregisterRuntimeExceptionModuleWorker

Ordinal	`1544`
Address	`0x3e000`

WerpGetDebugger

Ordinal	`1545`
Address	`0x64930`

WerpInitiateRemoteRecovery

Ordinal	`1546`
Address	`0x3e010`

WerpLaunchAeDebug

Ordinal	`1547`
Address	`0x65270`

WerpNotifyLoadStringResourceWorker

Ordinal	`1548`
Address	`0x1a5e0`

WerpNotifyUseStringResourceWorker

Ordinal	`1549`
Address	`0x1a5e0`

WideCharToMultiByte

Ordinal	`1550`
Address	`0x15500`

WinExec

Ordinal	`1551`
Address	`0x5f090`

Wow64DisableWow64FsRedirection

Ordinal	`1552`
Address	`0x37550`

Wow64EnableWow64FsRedirection

Ordinal	`1553`
Address	`0x1fe20`

Wow64GetThreadContext

Ordinal	`1554`
Address	`0x37620`

Wow64GetThreadSelectorEntry

Ordinal	`1555`
Address	`0x33a70`

Wow64RevertWow64FsRedirection

Ordinal	`1556`
Address	`0x37560`

Wow64SetThreadContext

Ordinal	`1557`
Address	`0x37650`

Wow64SuspendThread

Ordinal	`1558`
Address	`0x37680`

WriteConsoleA

Ordinal	`1559`
Address	`0x22b50`

WriteConsoleInputA

Ordinal	`1560`
Address	`0x22d70`

WriteConsoleInputVDMA

Ordinal	`1561`
Address	`0x61a90`

WriteConsoleInputVDMW

Ordinal	`1562`
Address	`0x61b10`

WriteConsoleInputW

Ordinal	`1563`
Address	`0x22d80`

WriteConsoleOutputA

Ordinal	`1564`
Address	`0x22d90`

WriteConsoleOutputAttribute

Ordinal	`1565`
Address	`0x22da0`

WriteConsoleOutputCharacterA

Ordinal	`1566`
Address	`0x22db0`

WriteConsoleOutputCharacterW

Ordinal	`1567`
Address	`0x22dc0`

WriteConsoleOutputW

Ordinal	`1568`
Address	`0x22dd0`

WriteConsoleW

Ordinal	`1569`
Address	`0x22b60`

WriteFile

Ordinal	`1570`
Address	`0x22770`

WriteFileEx

Ordinal	`1571`
Address	`0x22780`

WriteFileGather

Ordinal	`1572`
Address	`0x22790`

WritePrivateProfileSectionA

Ordinal	`1573`
Address	`0x591d0`

WritePrivateProfileSectionW

Ordinal	`1574`
Address	`0x21550`

WritePrivateProfileStringA

Ordinal	`1575`
Address	`0x59230`

WritePrivateProfileStringW

Ordinal	`1576`
Address	`0x18340`

WritePrivateProfileStructA

Ordinal	`1577`
Address	`0x592a0`

WritePrivateProfileStructW

Ordinal	`1578`
Address	`0x593f0`

WriteProcessMemory

Ordinal	`1579`
Address	`0x37570`

WriteProfileSectionA

Ordinal	`1580`
Address	`0x59550`

WriteProfileSectionW

Ordinal	`1581`
Address	`0x59560`

WriteProfileStringA

Ordinal	`1582`
Address	`0x59570`

WriteProfileStringW

Ordinal	`1583`
Address	`0x59580`

WriteTapemark

Ordinal	`1584`
Address	`0x3d880`

ZombifyActCtx

Ordinal	`1585`
Address	`0x37580`

ZombifyActCtxWorker

Ordinal	`1586`
Address	`0x3ddc0`

__C_specific_handler

Ordinal	`1587`
Address	`0x9dcbf`
ForwardName	`NTDLL.__C_specific_handler`

__chkstk

Ordinal	`1588`
Address	`0x9dce3`
ForwardName	`NTDLL.__chkstk`

__misaligned_access

Ordinal	`1589`
Address	`0x9dd06`
ForwardName	`NTDLL.__misaligned_access`

_hread

Ordinal	`1590`
Address	`0x19db0`

_hwrite

Ordinal	`1591`
Address	`0x614f0`

_lclose

Ordinal	`1592`
Address	`0x1c8b0`

_lcreat

Ordinal	`1593`
Address	`0x61420`

_llseek

Ordinal	`1594`
Address	`0x19de0`

_local_unwind

Ordinal	`1595`
Address	`0x9dd55`
ForwardName	`NTDLL._local_unwind`

_lopen

Ordinal	`1596`
Address	`0x61480`

_lread

Ordinal	`1597`
Address	`0x19db0`

_lwrite

Ordinal	`1598`
Address	`0x614f0`

lstrcat

Ordinal	`1599`
Address	`0x1e970`

lstrcatA

Ordinal	`1600`
Address	`0x1e970`

lstrcatW

Ordinal	`1601`
Address	`0x61540`

lstrcmp

Ordinal	`1602`
Address	`0x1c800`

lstrcmpA

Ordinal	`1603`
Address	`0x1c800`

lstrcmpW

Ordinal	`1604`
Address	`0x1a510`

lstrcmpi

Ordinal	`1605`
Address	`0x1a450`

lstrcmpiA

Ordinal	`1606`
Address	`0x1a450`

lstrcmpiW

Ordinal	`1607`
Address	`0x17950`

lstrcpy

Ordinal	`1608`
Address	`0x1d200`

lstrcpyA

Ordinal	`1609`
Address	`0x1d200`

lstrcpyW

Ordinal	`1610`
Address	`0x20370`

lstrcpyn

Ordinal	`1611`
Address	`0x37590`

lstrcpynA

Ordinal	`1612`
Address	`0x37590`

lstrcpynW

Ordinal	`1613`
Address	`0x1f980`

lstrlen

Ordinal	`1614`
Address	`0x19e40`

lstrlenA

Ordinal	`1615`
Address	`0x19e40`

lstrlenW

Ordinal	`1616`
Address	`0x17930`

timeBeginPeriod

Ordinal	`1617`
Address	`0x1d240`

timeEndPeriod

Ordinal	`1618`
Address	`0x1c2f0`

timeGetDevCaps

Ordinal	`1619`
Address	`0x20470`

timeGetSystemTime

Ordinal	`1620`
Address	`0x61590`

timeGetTime

Ordinal	`1621`
Address	`0x1cfe0`

uaw_lstrcmpW

Ordinal	`1622`
Address	`0x1a510`

uaw_lstrcmpiW

Ordinal	`1623`
Address	`0x17950`

uaw_lstrlenW

Ordinal	`1624`
Address	`0x33380`

uaw_wcschr

Ordinal	`1625`
Address	`0x333d0`

uaw_wcscpy

Ordinal	`1626`
Address	`0x333f0`

uaw_wcsicmp

Ordinal	`1627`
Address	`0x33420`

uaw_wcslen

Ordinal	`1628`
Address	`0x33430`

uaw_wcsrchr

Ordinal	`1629`
Address	`0x33450`

1

Type	`MUI`
Language	English - United States
Codepage	UNKNOWN
Size	`0xc8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.71683`
MD5	`45ef4aa0a7628fb7cd20ca9556ebab86`
SHA1	`f4f63afbc64d8098e9ff9f77ed447355b3c11852`
SHA256	`a7e81ed9463ae6af2b6baefae02e9dcaf347bff5049d785187a65ff178fed254`
SHA3	`65f159df3d5072d591efefc56c8d7487dd4ec8a11fb8a9541cb0353a8cef87ba`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x3a4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.51715`
MD5	`d3d0fa40dd0b47870a6eb5792c7806a6`
SHA1	`31d7d6a361862d7bc7ae57ba4c4509980441ab44`
SHA256	`9257f6c1904648dc2894246890b6aa41c1bf8d0a3765264b4fcdeb1f8e85ac5a`
SHA3	`a4b8b691f985ede812461ca744223f13de9b470967d49837f40bda53b03742b8`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	10.0.17763.475
ProductVersion	10.0.17763.475
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_DLL`
Language	English - United States
CompanyName	Microsoft Corporation
FileDescription	Windows NT BASE API Client DLL
FileVersion (#2)	10.0.17763.475 (WinBuild.160101.0800)
InternalName	kernel32
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	kernel32
ProductName	Microsoft® Windows® Operating System
ProductVersion (#2)	10.0.17763.475

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	1989-Sep-10 06:58:46
Version	`0.0`
SizeofData	`37`
AddressOfRawData	`0x896f0`
PointerToRawData	`0x87cf0`
Referenced File	kernel32.pdb

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	1989-Sep-10 06:58:46
Version	`0.0`
SizeofData	`1232`
AddressOfRawData	`0x89718`
PointerToRawData	`0x87d18`

UNKNOWN

Characteristics	`0`
TimeDateStamp	1989-Sep-10 06:58:46
Version	`0.0`
SizeofData	`0`
AddressOfRawData	`0`
PointerToRawData	`0`

TLS Callbacks

Load Configuration

Size	`0x108`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x1800a91e0`
GuardCFCheckFunctionPointer	`6442953568`
GuardCFDispatchFunctionPointer	`0`
GuardCFFunctionTable	`0`
GuardCFFunctionCount	`0`
GuardFlags	`(EMPTY)`
CodeIntegrity.Flags	`0`
CodeIntegrity.Catalog	`0`
CodeIntegrity.CatalogOffset	`0`
CodeIntegrity.Reserved	`0`
GuardAddressTakenIatEntryTable	`0`
GuardAddressTakenIatEntryCount	`0`
GuardLongJumpTargetTable	`0`
GuardLongJumpTargetCount	`0`

RICH Header

XOR Key	`0xee2c0ded`
Unmarked objects	`0`
Imports (26213)	`4`
Imports (VS2008 SP1 build 30729)	`185`
Total imports	`1286`
C objects (26213)	`7`
ASM objects (26213)	`3`
Exports (26213)	`1`
269 (26213)	`207`
Resource objects (26213)	`1`
Linker (26213)	`1`