885133354d5233eb324a48168eb58a05

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2061-Sep-24 12:16:01
Detected languages English - United States
CompanyName Microsoft Corporation
FileDescription NT Layer DLL
FileVersion 10.0.16299.64 (WinBuild.160101.0800)
InternalName ntdll.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename ntdll.dll
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.64

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 6.0 - 8.0
Suspicious PEiD Signature: UPolyX V0.1 -> Delikon
Suspicious Strings found in the binary may indicate undesirable behavior: Tries to detect virtualized environments:
  • HARDWARE\DESCRIPTION\System
 May have dropper capabilities:
  • CurrentControlSet\Services
 Miscellaneous malware strings:
  • virus
 Contains domain names:
  • go.microsoft.com
  • http://go.microsoft.com
  • http://go.microsoft.com/fwlink/?LinkId
  • http://schemas.microsoft.com
  • http://schemas.microsoft.com/SMI/2005/WindowsSettings
  • https://go.microsoft.com
  • https://go.microsoft.com/fwlink/?linkid
  • microsoft.com
  • schemas.microsoft.com
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Suspicious The PE is possibly packed. Unusual section name found: RT
Unusual section name found: .mrdata
The PE only has 1 import(s).
Suspicious The file contains overlay data. 10491 bytes of data starting at offset 0x18a768.
Malicious VirusTotal score: 3/69 (Scanned on 2022-08-13 14:13:22) Malwarebytes: Malware.Heuristic.1001
F-Secure: Trojan.TR/Crypt.XPACK.Gen
Avira: TR/Crypt.XPACK.Gen

Hashes

MD5 885133354d5233eb324a48168eb58a05
SHA1 54d433e530bcd484807caf0adf5ec2df56ca0226
SHA256 228e52417e6ce927d91aa6b31e270c232717fc81cb121a779bee7a91e1d9b8a9
SHA3 b0cdd7d1c85e9ba0120c681e946b2bd798c7e8dc91553aeaeeb18c0e77ddc131
SSDeep 24576:ICa+7Oz2RCql8Kleqcydisnk4PmBlq8qIX1B4DgMYxGUYvCP0UqM3KPX:I7iRCquK1C1lq8qIX1BZxXcM
Imports Hash f481ea8169d367d8b0e94d0bf02da220

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 7
TimeDateStamp 2061-Sep-24 12:16:01
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 14.0
SizeOfCode 0x112400
SizeOfInitializedData 0x75400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000 (Section: ?)
BaseOfCode 0x1000
BaseOfData 0x115000
ImageBase 0x77220000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion A.0
ImageVersion A.0
SubsystemVersion A.0
Win32VersionValue 0
SizeOfImage 0x18d063
SizeOfHeaders 0x400
Checksum 0x18be34
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x40000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 ca74326973e1131c346786cb5ebc7a13
SHA1 4d017947a796d4b5f64780f8416343d4f6629446
SHA256 bd3ced17b8de8232823ad3840a9c01e99378a898d5a7899642c557bc1e5904e3
SHA3 46ad1cd479fd58a64954bb96fad8d5689c088d665d039f623bd242f9b965d360
VirtualSize 0x113000
VirtualAddress 0x1000
SizeOfRawData 0x113000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.82675

RT

MD5 3c7d7a9a473249d0415b7e21a0eb096a
SHA1 34df5e7c202146955aa477b0c98f0506e07a80a9
SHA256 eaa3216eca0595658d81eed17a5ec3b0c53e44e34c8a1742d868ab263bfe634b
SHA3 05bba1294d187878a50940ac8b9b5f08d2c3feab3270ac6bb7feb5cbdb710ddf
VirtualSize 0x1000
VirtualAddress 0x114000
SizeOfRawData 0x1000
PointerToRawData 0x114000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 1.01968

.data

MD5 c242016c217a67f028c94af1620d328f
SHA1 2f7bb3ead2e4f4ab404b1682bbe2865b891b34cf
SHA256 9ba11cb6060b27a2f79f8998e268e664a4720401ab64f76f52e80ab1efc8288c
SHA3 844990ba96b892e01c0b081b441268aa4e83bef7f345970e4e378e0f87f48111
VirtualSize 0x4000
VirtualAddress 0x115000
SizeOfRawData 0x4000
PointerToRawData 0x115000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.92974

.mrdata

MD5 fe7ec024dc6ef856bc1276cb47b06bcd
SHA1 d459b973fcc8999d968a6488ccf30037db371f6d
SHA256 8e11ef01dd661fb703af667322065cdf776e8906f18f1cee61f3ea3a44a9d010
SHA3 bb024f13fd43614a68a5e9791a4cd84069c8e57db666725c92189983cab9628f
VirtualSize 0x3000
VirtualAddress 0x119000
SizeOfRawData 0x3000
PointerToRawData 0x119000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.882579

.00cfg

MD5 620f0b67a91f7f74151bc5be745b7110
SHA1 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA256 ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
SHA3 a99f9ed58079237f7f0275887f0c03a0c9d7d8de4443842297fceea67e423563
VirtualSize 0x1000
VirtualAddress 0x11c000
SizeOfRawData 0x1000
PointerToRawData 0x11c000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 0

.rsrc

MD5 2224ee355c7b6be6955fb4480fd37807
SHA1 ac05558b97abb6621ff7bb4defa813d6ef5b0cfa
SHA256 62cfd869d71408c5246172126eeb3e121767e0baaa806c44af80b68293bd4eed
SHA3 f1cba668ed983606e7a0728832372151d24161a2f77b9d0ec09f382d63dff8c9
VirtualSize 0x6b000
VirtualAddress 0x11d000
SizeOfRawData 0x6b000
PointerToRawData 0x11d000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.31651

.reloc

MD5 2ec4a4ba80012a58f2f2a1d2ae62cba0
SHA1 575e8ba2215c157b7ef7870a4c1339335d06a051
SHA256 474f5509c5d985df9892c44a4b02119589a5c518399b379d6ff2981b9ec00d6f
SHA3 c278ff54e364095f90339eab048eb04a130391e9beb30f9d3e01b4cb06d9a187
VirtualSize 0x5063
VirtualAddress 0x188000
SizeOfRawData 0x5063
PointerToRawData 0x188000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.6878

Imports

KERNELBASE.dll ReleaseActCtx

Delayed Imports

RtlDispatchAPC

Ordinal 8
Address 0x28930

RtlActivateActivationContextUnsafeFast

Ordinal 9
Address 0x38790

RtlDeactivateActivationContextUnsafeFast

Ordinal 10
Address 0x3ca80

RtlInterlockedPushListSList

Ordinal 11
Address 0xb9630

RtlUlongByteSwap

Ordinal 12
Address 0xb96a0

RtlUlonglongByteSwap

Ordinal 13
Address 0xb96b0

RtlUshortByteSwap

Ordinal 14
Address 0xb96d0

A_SHAFinal

Ordinal 15
Address 0x628c0

A_SHAInit

Ordinal 16
Address 0x8a000

A_SHAUpdate

Ordinal 17
Address 0x629a0

AlpcAdjustCompletionListConcurrencyCount

Ordinal 18
Address 0xb96e0

AlpcFreeCompletionListMessage

Ordinal 19
Address 0xb9710

AlpcGetCompletionListLastMessageInformation

Ordinal 20
Address 0xb9800

AlpcGetCompletionListMessageAttributes

Ordinal 21
Address 0xb9830

AlpcGetHeaderSize

Ordinal 22
Address 0x23d90

AlpcGetMessageAttribute

Ordinal 23
Address 0x23d50

AlpcGetMessageFromCompletionList

Ordinal 24
Address 0xb9870

AlpcGetOutstandingCompletionListMessageCount

Ordinal 25
Address 0xb99c0

AlpcInitializeMessageAttribute

Ordinal 26
Address 0x23d10

AlpcMaxAllowedMessageLength

Ordinal 27
Address 0xb99e0

AlpcRegisterCompletionList

Ordinal 28
Address 0xb99f0

AlpcRegisterCompletionListWorkerThread

Ordinal 29
Address 0xb9a40

AlpcRundownCompletionList

Ordinal 30
Address 0xb9ab0

AlpcUnregisterCompletionList

Ordinal 31
Address 0xb9ad0

AlpcUnregisterCompletionListWorkerThread

Ordinal 32
Address 0xb9af0

ApiSetQueryApiSetPresence

Ordinal 33
Address 0x50610

CsrAllocateCaptureBuffer

Ordinal 34
Address 0xb94a0

CsrAllocateMessagePointer

Ordinal 35
Address 0xb94b0

CsrCaptureMessageBuffer

Ordinal 36
Address 0xb94c0

CsrCaptureMessageMultiUnicodeStringsInPlace

Ordinal 37
Address 0xb94d0

CsrCaptureMessageString

Ordinal 38
Address 0xb9560

CsrCaptureTimeout

Ordinal 39
Address 0xb95b0

CsrClientCallServer

Ordinal 40
Address 0xb95e0

CsrClientConnectToServer

Ordinal 41
Address 0x694a0

CsrFreeCaptureBuffer

Ordinal 42
Address 0xb95f0

CsrGetProcessId

Ordinal 43
Address 0xb9600

CsrIdentifyAlertableThread

Ordinal 44
Address 0xb9610

CsrSetPriorityClass

Ordinal 45
Address 0xaf1d0

CsrVerifyRegion

Ordinal 46
Address 0xb9620

DbgBreakPoint

Ordinal 47
Address 0x70a40

DbgPrint

Ordinal 48
Address 0x2c3f0

DbgPrintEx

Ordinal 49
Address 0x25ec0

DbgPrintReturnControlC

Ordinal 50
Address 0xb9b60

DbgPrompt

Ordinal 51
Address 0xb9b90

DbgQueryDebugFilterState

Ordinal 52
Address 0xb9bd0

DbgSetDebugFilterState

Ordinal 53
Address 0xb9be0

DbgUiConnectToDbg

Ordinal 54
Address 0xaa2c0

DbgUiContinue

Ordinal 55
Address 0xaa320

DbgUiConvertStateChangeStructure

Ordinal 56
Address 0xaa350

DbgUiConvertStateChangeStructureEx

Ordinal 57
Address 0xaa370

DbgUiDebugActiveProcess

Ordinal 58
Address 0xaa570

DbgUiGetThreadDebugObject

Ordinal 59
Address 0xaa5c0

DbgUiIssueRemoteBreakin

Ordinal 60
Address 0xaa5e0

DbgUiRemoteBreakin

Ordinal 61
Address 0xaa630

DbgUiSetThreadDebugObject

Ordinal 62
Address 0xaa690

DbgUiStopDebugging

Ordinal 63
Address 0xaa6b0

DbgUiWaitStateChange

Ordinal 64
Address 0xaa6e0

DbgUserBreakPoint

Ordinal 65
Address 0x70a30

EtwCheckCoverage

Ordinal 66
Address 0x88450

EtwCreateTraceInstanceId

Ordinal 67
Address 0xf06b0

EtwDeliverDataBlock

Ordinal 68
Address 0x66360

EtwEnumerateProcessRegGuids

Ordinal 69
Address 0xefea0

EtwEventActivityIdControl

Ordinal 70
Address 0x5b110

EtwEventEnabled

Ordinal 71
Address 0x5f150

EtwEventProviderEnabled

Ordinal 72
Address 0xeffa0

EtwEventRegister

Ordinal 73
Address 0x4f2d0

EtwEventSetInformation

Ordinal 74
Address 0x50190

EtwEventUnregister

Ordinal 75
Address 0x57600

EtwEventWrite

Ordinal 76
Address 0x5eb90

EtwEventWriteEndScenario

Ordinal 77
Address 0xf08c0

EtwEventWriteEx

Ordinal 78
Address 0x25a20

EtwEventWriteFull

Ordinal 79
Address 0xf0080

EtwEventWriteNoRegistration

Ordinal 80
Address 0x28770

EtwEventWriteStartScenario

Ordinal 81
Address 0xf09a0

EtwEventWriteString

Ordinal 82
Address 0xf00c0

EtwEventWriteTransfer

Ordinal 83
Address 0x5d560

EtwGetTraceEnableFlags

Ordinal 84
Address 0x6a8d0

EtwGetTraceEnableLevel

Ordinal 85
Address 0x6a910

EtwGetTraceLoggerHandle

Ordinal 86
Address 0x6a660

EtwLogTraceEvent

Ordinal 87
Address 0xf0b00

EtwNotificationRegister

Ordinal 88
Address 0x4c430

EtwNotificationUnregister

Ordinal 89
Address 0x57620

EtwProcessPrivateLoggerRequest

Ordinal 90
Address 0x6c0d0

EtwRegisterSecurityProvider

Ordinal 91
Address 0xf0330

EtwRegisterTraceGuidsA

Ordinal 92
Address 0x60100

EtwRegisterTraceGuidsW

Ordinal 93
Address 0x60130

EtwReplyNotification

Ordinal 94
Address 0xf2730

EtwSendNotification

Ordinal 95
Address 0xf2770

EtwSetMark

Ordinal 96
Address 0x27bd0

EtwTraceEventInstance

Ordinal 97
Address 0xf0b60

EtwTraceMessage

Ordinal 98
Address 0x62ba0

EtwTraceMessageVa

Ordinal 99
Address 0x62bd0

EtwUnregisterTraceGuids

Ordinal 100
Address 0x575b0

EtwWriteUMSecurityEvent

Ordinal 101
Address 0xf0370

EtwpCreateEtwThread

Ordinal 102
Address 0x6c6e0

EtwpGetCpuSpeed

Ordinal 103
Address 0xf2e90

EvtIntReportAuthzEventAndSourceAsync

Ordinal 104
Address 0xf2eb0

EvtIntReportEventAndSourceAsync

Ordinal 105
Address 0xf2ef0

KiFastSystemCall

Ordinal 106
Address 0x70cd0

KiFastSystemCallRet

Ordinal 107
Address 0x70ce0

KiIntSystemCall

Ordinal 108
Address 0x70cf0

KiRaiseUserExceptionDispatcher

Ordinal 109
Address 0x70c40

KiUserApcDispatcher

Ordinal 110
Address 0x70a70

KiUserCallbackDispatcher

Ordinal 111
Address 0x70b60

KiUserExceptionDispatcher

Ordinal 112
Address 0x70bd0

LdrAccessResource

Ordinal 113
Address 0x8a0c0

LdrAddDllDirectory

Ordinal 114
Address 0xb78f0

LdrAddLoadAsDataTable

Ordinal 115
Address 0x5a1a0

LdrAddRefDll

Ordinal 116
Address 0x4d910

LdrAppxHandleIntegrityFailure

Ordinal 117
Address 0xa8ee0

LdrCallEnclave

Ordinal 118
Address 0x82050

LdrControlFlowGuardEnforced

Ordinal 119
Address 0x4b580

LdrCreateEnclave

Ordinal 120
Address 0x82060

LdrDeleteEnclave

Ordinal 121
Address 0x28060

LdrDisableThreadCalloutsForDll

Ordinal 122
Address 0x64850

LdrEnumResources

Ordinal 123
Address 0xb9c50

LdrEnumerateLoadedModules

Ordinal 124
Address 0x26260

LdrFastFailInLoaderCallout

Ordinal 125
Address 0xab100

LdrFindEntryForAddress

Ordinal 126
Address 0x4b200

LdrFindResourceDirectory_U

Ordinal 127
Address 0xb9e80

LdrFindResourceEx_U

Ordinal 128
Address 0x695a0

LdrFindResource_U

Ordinal 129
Address 0x5fa30

LdrFlushAlternateResourceModules

Ordinal 130
Address 0xb9eb0

LdrGetDllDirectory

Ordinal 131
Address 0x279f0

LdrGetDllFullName

Ordinal 132
Address 0x37f50

LdrGetDllHandle

Ordinal 133
Address 0x38a20

LdrGetDllHandleByMapping

Ordinal 134
Address 0x63d60

LdrGetDllHandleByName

Ordinal 135
Address 0x65040

LdrGetDllHandleEx

Ordinal 136
Address 0x38a80

LdrGetDllPath

Ordinal 137
Address 0x46d00

LdrGetFailureData

Ordinal 138
Address 0xab130

LdrGetFileNameFromLoadAsDataTable

Ordinal 139
Address 0xb9fd0

LdrGetProcedureAddress

Ordinal 140
Address 0x23210

LdrGetProcedureAddressEx

Ordinal 141
Address 0x23990

LdrGetProcedureAddressForCaller

Ordinal 142
Address 0x48800

LdrInitShimEngineDynamic

Ordinal 143
Address 0xad430

LdrInitializeEnclave

Ordinal 144
Address 0x820f0

LdrInitializeThunk

Ordinal 145
Address 0x63670

LdrLoadAlternateResourceModule

Ordinal 146
Address 0xba020

LdrLoadAlternateResourceModuleEx

Ordinal 147
Address 0x4a660

LdrLoadDll

Ordinal 148
Address 0x4e860

LdrLoadEnclaveModule

Ordinal 149
Address 0x82050

LdrLockLoaderLock

Ordinal 150
Address 0x66a50

LdrOpenImageFileOptionsKey

Ordinal 151
Address 0xbaf70

LdrParentInterlockedPopEntrySList

Ordinal 152
Address 0x118818

LdrParentRtlInitializeNtUserPfn

Ordinal 153
Address 0x11881c

LdrParentRtlResetNtUserPfn

Ordinal 154
Address 0x118810

LdrParentRtlRetrieveNtUserPfn

Ordinal 155
Address 0x11880c

LdrProcessRelocationBlock

Ordinal 156
Address 0xbb3e0

LdrProcessRelocationBlockEx

Ordinal 157
Address 0xbb410

LdrQueryImageFileExecutionOptions

Ordinal 158
Address 0x64600

LdrQueryImageFileExecutionOptionsEx

Ordinal 159
Address 0x64640

LdrQueryImageFileKeyOption

Ordinal 160
Address 0x64420

LdrQueryModuleServiceTags

Ordinal 161
Address 0xab270

LdrQueryOptionalDelayLoadedAPI

Ordinal 162
Address 0xabe40

LdrQueryProcessModuleInformation

Ordinal 163
Address 0xab310

LdrRegisterDllNotification

Ordinal 164
Address 0x6a3c0

LdrRemoveDllDirectory

Ordinal 165
Address 0xb7ac0

LdrRemoveLoadAsDataTable

Ordinal 166
Address 0x5a050

LdrResFindResource

Ordinal 167
Address 0xbba30

LdrResFindResourceDirectory

Ordinal 168
Address 0x4f4c0

LdrResGetRCConfig

Ordinal 169
Address 0x557c0

LdrResRelease

Ordinal 170
Address 0xbba90

LdrResSearchResource

Ordinal 171
Address 0x4e980

LdrResolveDelayLoadedAPI

Ordinal 172
Address 0x485e0

LdrResolveDelayLoadsFromDll

Ordinal 173
Address 0xabf20

LdrRscIsTypeExist

Ordinal 174
Address 0x4ac90

LdrSetAppCompatDllRedirectionCallback

Ordinal 175
Address 0x6ab20

LdrSetDefaultDllDirectories

Ordinal 176
Address 0xb7b70

LdrSetDllDirectory

Ordinal 177
Address 0x61920

LdrSetDllManifestProber

Ordinal 178
Address 0x6a010

LdrSetImplicitPathOptions

Ordinal 179
Address 0xab7c0

LdrSetMUICacheType

Ordinal 180
Address 0xba360

LdrShutdownProcess

Ordinal 181
Address 0x37830

LdrShutdownThread

Ordinal 182
Address 0x3a170

LdrStandardizeSystemPath

Ordinal 183
Address 0x39680

LdrSystemDllInitBlock

Ordinal 184
Address 0x119238

LdrUnloadAlternateResourceModule

Ordinal 185
Address 0x57ee0

LdrUnloadAlternateResourceModuleEx

Ordinal 186
Address 0x57f00

LdrUnloadDll

Ordinal 187
Address 0x4c1e0

LdrUnlockLoaderLock

Ordinal 188
Address 0x68310

LdrUnregisterDllNotification

Ordinal 189
Address 0xab820

LdrUpdatePackageSearchPath

Ordinal 190
Address 0xb7bb0

LdrVerifyImageMatchesChecksum

Ordinal 191
Address 0xab8a0

LdrVerifyImageMatchesChecksumEx

Ordinal 192
Address 0xab910

LdrpChildNtdll

Ordinal 193
Address 0x11877c

LdrpResGetMappingSize

Ordinal 194
Address 0x4ec00

LdrpResGetResourceDirectory

Ordinal 195
Address 0x4cf50

MD4Final

Ordinal 196
Address 0xefcb0

MD4Init

Ordinal 197
Address 0xefd50

MD4Update

Ordinal 198
Address 0xefd90

MD5Final

Ordinal 199
Address 0x256e0

MD5Init

Ordinal 200
Address 0x285e0

MD5Update

Ordinal 201
Address 0x25780

NlsAnsiCodePage

Ordinal 202
Address 0x116d40

NlsMbCodePageTag

Ordinal 203
Address 0x116d59

NlsMbOemCodePageTag

Ordinal 204
Address 0x116d58

NtAcceptConnectPort

Ordinal 205
Address 0x6e760

NtAccessCheck

Ordinal 206
Address 0x6e740

NtAccessCheckAndAuditAlarm

Ordinal 207
Address 0x6e9f0

NtAccessCheckByType

Ordinal 208
Address 0x6ed90

NtAccessCheckByTypeAndAuditAlarm

Ordinal 209
Address 0x6ecf0

NtAccessCheckByTypeResultList

Ordinal 210
Address 0x6eda0

NtAccessCheckByTypeResultListAndAuditAlarm

Ordinal 211
Address 0x6edb0

NtAccessCheckByTypeResultListAndAuditAlarmByHandle

Ordinal 212
Address 0x6edc0

NtAcquireProcessActivityReference

Ordinal 213
Address 0x6edd0

NtAddAtom

Ordinal 214
Address 0x6ebd0

NtAddAtomEx

Ordinal 215
Address 0x6ede0

NtAddBootEntry

Ordinal 216
Address 0x6edf0

NtAddDriverEntry

Ordinal 217
Address 0x6ee00

NtAdjustGroupsToken

Ordinal 218
Address 0x6ee10

NtAdjustPrivilegesToken

Ordinal 219
Address 0x6eb70

NtAdjustTokenClaimsAndDeviceGroups

Ordinal 220
Address 0x6ee20

NtAlertResumeThread

Ordinal 221
Address 0x6ee30

NtAlertThread

Ordinal 222
Address 0x6ee40

NtAlertThreadByThreadId

Ordinal 223
Address 0x6ee50

NtAllocateLocallyUniqueId

Ordinal 224
Address 0x6ee60

NtAllocateReserveObject

Ordinal 225
Address 0x6ee70

NtAllocateUserPhysicalPages

Ordinal 226
Address 0x6ee80

NtAllocateUuids

Ordinal 227
Address 0x6ee90

NtAllocateVirtualMemory

Ordinal 228
Address 0x6e8c0

NtAlpcAcceptConnectPort

Ordinal 229
Address 0x6eea0

NtAlpcCancelMessage

Ordinal 230
Address 0x6eeb0

NtAlpcConnectPort

Ordinal 231
Address 0x6eec0

NtAlpcConnectPortEx

Ordinal 232
Address 0x6eed0

NtAlpcCreatePort

Ordinal 233
Address 0x6eee0

NtAlpcCreatePortSection

Ordinal 234
Address 0x6eef0

NtAlpcCreateResourceReserve

Ordinal 235
Address 0x6ef00

NtAlpcCreateSectionView

Ordinal 236
Address 0x6ef10

NtAlpcCreateSecurityContext

Ordinal 237
Address 0x6ef20

NtAlpcDeletePortSection

Ordinal 238
Address 0x6ef30

NtAlpcDeleteResourceReserve

Ordinal 239
Address 0x6ef40

NtAlpcDeleteSectionView

Ordinal 240
Address 0x6ef50

NtAlpcDeleteSecurityContext

Ordinal 241
Address 0x6ef60

NtAlpcDisconnectPort

Ordinal 242
Address 0x6ef70

NtAlpcImpersonateClientContainerOfPort

Ordinal 243
Address 0x6ef80

NtAlpcImpersonateClientOfPort

Ordinal 244
Address 0x6ef90

NtAlpcOpenSenderProcess

Ordinal 245
Address 0x6efa0

NtAlpcOpenSenderThread

Ordinal 246
Address 0x6efb0

NtAlpcQueryInformation

Ordinal 247
Address 0x6efc0

NtAlpcQueryInformationMessage

Ordinal 248
Address 0x6efd0

NtAlpcRevokeSecurityContext

Ordinal 249
Address 0x6efe0

NtAlpcSendWaitReceivePort

Ordinal 250
Address 0x6eff0

NtAlpcSetInformation

Ordinal 251
Address 0x6f000

NtApphelpCacheControl

Ordinal 252
Address 0x6ec20

NtAreMappedFilesTheSame

Ordinal 253
Address 0x6f010

NtAssignProcessToJobObject

Ordinal 254
Address 0x6f020

NtAssociateWaitCompletionPacket

Ordinal 255
Address 0x6f030

NtCallEnclave

Ordinal 256
Address 0x6f040

NtCallbackReturn

Ordinal 257
Address 0x6e790

NtCancelIoFile

Ordinal 258
Address 0x6ed30

NtCancelIoFileEx

Ordinal 259
Address 0x6f050

NtCancelSynchronousIoFile

Ordinal 260
Address 0x6f060

NtCancelTimer2

Ordinal 261
Address 0x6f070

NtCancelTimer

Ordinal 262
Address 0x6ed70

NtCancelWaitCompletionPacket

Ordinal 263
Address 0x6f080

NtClearEvent

Ordinal 264
Address 0x6eb40

NtClose

Ordinal 265
Address 0x6e830

NtCloseObjectAuditAlarm

Ordinal 266
Address 0x6eb10

NtCommitComplete

Ordinal 267
Address 0x6f090

NtCommitEnlistment

Ordinal 268
Address 0x6f0a0

NtCommitRegistryTransaction

Ordinal 269
Address 0x6f0b0

NtCommitTransaction

Ordinal 270
Address 0x6f0c0

NtCompactKeys

Ordinal 271
Address 0x6f0d0

NtCompareObjects

Ordinal 272
Address 0x6f0e0

NtCompareSigningLevels

Ordinal 273
Address 0x6f0f0

NtCompareTokens

Ordinal 274
Address 0x6f100

NtCompleteConnectPort

Ordinal 275
Address 0x6f110

NtCompressKey

Ordinal 276
Address 0x6f120

NtConnectPort

Ordinal 277
Address 0x6f130

NtContinue

Ordinal 278
Address 0x6eb90

NtConvertBetweenAuxiliaryCounterAndPerformanceCounter

Ordinal 279
Address 0x6f140

NtCreateDebugObject

Ordinal 280
Address 0x6f150

NtCreateDirectoryObject

Ordinal 281
Address 0x6f160

NtCreateDirectoryObjectEx

Ordinal 282
Address 0x6f170

NtCreateEnclave

Ordinal 283
Address 0x6f180

NtCreateEnlistment

Ordinal 284
Address 0x6f190

NtCreateEvent

Ordinal 285
Address 0x6ebe0

NtCreateEventPair

Ordinal 286
Address 0x6f1a0

NtCreateFile

Ordinal 287
Address 0x6ecb0

NtCreateIRTimer

Ordinal 288
Address 0x6f1b0

NtCreateIoCompletion

Ordinal 289
Address 0x6f1c0

NtCreateJobObject

Ordinal 290
Address 0x6f1d0

NtCreateJobSet

Ordinal 291
Address 0x6f1e0

NtCreateKey

Ordinal 292
Address 0x6e930

NtCreateKeyTransacted

Ordinal 293
Address 0x6f1f0

NtCreateKeyedEvent

Ordinal 294
Address 0x6f200

NtCreateLowBoxToken

Ordinal 295
Address 0x6f210

NtCreateMailslotFile

Ordinal 296
Address 0x6f220

NtCreateMutant

Ordinal 297
Address 0x6f230

NtCreateNamedPipeFile

Ordinal 298
Address 0x6f240

NtCreatePagingFile

Ordinal 299
Address 0x6f250

NtCreatePartition

Ordinal 300
Address 0x6f260

NtCreatePort

Ordinal 301
Address 0x6f270

NtCreatePrivateNamespace

Ordinal 302
Address 0x6f280

NtCreateProcess

Ordinal 303
Address 0x6f290

NtCreateProcessEx

Ordinal 304
Address 0x6ec30

NtCreateProfile

Ordinal 305
Address 0x6f2a0

NtCreateProfileEx

Ordinal 306
Address 0x6f2b0

NtCreateRegistryTransaction

Ordinal 307
Address 0x6f2c0

NtCreateResourceManager

Ordinal 308
Address 0x6f2d0

NtCreateSection

Ordinal 309
Address 0x6ec00

NtCreateSemaphore

Ordinal 310
Address 0x6f2e0

NtCreateSymbolicLinkObject

Ordinal 311
Address 0x6f2f0

NtCreateThread

Ordinal 312
Address 0x6ec40

NtCreateThreadEx

Ordinal 313
Address 0x6f300

NtCreateTimer2

Ordinal 314
Address 0x6f320

NtCreateTimer

Ordinal 315
Address 0x6f310

NtCreateToken

Ordinal 316
Address 0x6f330

NtCreateTokenEx

Ordinal 317
Address 0x6f340

NtCreateTransaction

Ordinal 318
Address 0x6f350

NtCreateTransactionManager

Ordinal 319
Address 0x6f360

NtCreateUserProcess

Ordinal 320
Address 0x6f370

NtCreateWaitCompletionPacket

Ordinal 321
Address 0x6f380

NtCreateWaitablePort

Ordinal 322
Address 0x6f390

NtCreateWnfStateName

Ordinal 323
Address 0x6f3a0

NtCreateWorkerFactory

Ordinal 324
Address 0x6f3b0

NtCurrentTeb

Ordinal 325
Address 0xaecc0

NtDebugActiveProcess

Ordinal 326
Address 0x6f3c0

NtDebugContinue

Ordinal 327
Address 0x6f3d0

NtDelayExecution

Ordinal 328
Address 0x6eaa0

NtDeleteAtom

Ordinal 329
Address 0x6f3e0

NtDeleteBootEntry

Ordinal 330
Address 0x6f3f0

NtDeleteDriverEntry

Ordinal 331
Address 0x6f400

NtDeleteFile

Ordinal 332
Address 0x6f410

NtDeleteKey

Ordinal 333
Address 0x6f420

NtDeleteObjectAuditAlarm

Ordinal 334
Address 0x6f430

NtDeletePrivateNamespace

Ordinal 335
Address 0x6f440

NtDeleteValueKey

Ordinal 336
Address 0x6f450

NtDeleteWnfStateData

Ordinal 337
Address 0x6f460

NtDeleteWnfStateName

Ordinal 338
Address 0x6f470

NtDeviceIoControlFile

Ordinal 339
Address 0x6e7b0

NtDisableLastKnownGood

Ordinal 340
Address 0x6f480

NtDisplayString

Ordinal 341
Address 0x6f490

NtDrawText

Ordinal 342
Address 0x6f4a0

NtDuplicateObject

Ordinal 343
Address 0x6eb20

NtDuplicateToken

Ordinal 344
Address 0x6eb80

NtEnableLastKnownGood

Ordinal 345
Address 0x6f4b0

NtEnumerateBootEntries

Ordinal 346
Address 0x6f4c0

NtEnumerateDriverEntries

Ordinal 347
Address 0x6f4d0

NtEnumerateKey

Ordinal 348
Address 0x6ea80

NtEnumerateSystemEnvironmentValuesEx

Ordinal 349
Address 0x6f4e0

NtEnumerateTransactionObject

Ordinal 350
Address 0x6f4f0

NtEnumerateValueKey

Ordinal 351
Address 0x6e870

NtExtendSection

Ordinal 352
Address 0x6f500

NtFilterBootOption

Ordinal 353
Address 0x6f510

NtFilterToken

Ordinal 354
Address 0x6f520

NtFilterTokenEx

Ordinal 355
Address 0x6f530

NtFindAtom

Ordinal 356
Address 0x6e880

NtFlushBuffersFile

Ordinal 357
Address 0x6ec10

NtFlushBuffersFileEx

Ordinal 358
Address 0x6f540

NtFlushInstallUILanguage

Ordinal 359
Address 0x6f550

NtFlushInstructionCache

Ordinal 360
Address 0x6f560

NtFlushKey

Ordinal 361
Address 0x6f570

NtFlushProcessWriteBuffers

Ordinal 362
Address 0x6f580

NtFlushVirtualMemory

Ordinal 363
Address 0x6f590

NtFlushWriteBuffer

Ordinal 364
Address 0x6f5a0

NtFreeUserPhysicalPages

Ordinal 365
Address 0x6f5b0

NtFreeVirtualMemory

Ordinal 366
Address 0x6e940

NtFreezeRegistry

Ordinal 367
Address 0x6f5c0

NtFreezeTransactions

Ordinal 368
Address 0x6f5d0

NtFsControlFile

Ordinal 369
Address 0x6eaf0

NtGetCachedSigningLevel

Ordinal 370
Address 0x6f5e0

NtGetCompleteWnfStateSubscription

Ordinal 371
Address 0x6f5f0

NtGetContextThread

Ordinal 372
Address 0x6f600

NtGetCurrentProcessorNumber

Ordinal 373
Address 0x6f610

NtGetCurrentProcessorNumberEx

Ordinal 374
Address 0x6f620

NtGetDevicePowerState

Ordinal 375
Address 0x6f630

NtGetMUIRegistryInfo

Ordinal 376
Address 0x6f640

NtGetNextProcess

Ordinal 377
Address 0x6f650

NtGetNextThread

Ordinal 378
Address 0x6f660

NtGetNlsSectionPtr

Ordinal 379
Address 0x6f670

NtGetNotificationResourceManager

Ordinal 380
Address 0x6f680

NtGetTickCount

Ordinal 381
Address 0xbd5a0

NtGetWriteWatch

Ordinal 382
Address 0x6f690

NtImpersonateAnonymousToken

Ordinal 383
Address 0x6f6a0

NtImpersonateClientOfPort

Ordinal 384
Address 0x6e950

NtImpersonateThread

Ordinal 385
Address 0x6f6b0

NtInitializeEnclave

Ordinal 386
Address 0x6f6c0

NtInitializeNlsFiles

Ordinal 387
Address 0x6f6d0

NtInitializeRegistry

Ordinal 388
Address 0x6f6e0

NtInitiatePowerAction

Ordinal 389
Address 0x6f6f0

NtIsProcessInJob

Ordinal 390
Address 0x6ec50

NtIsSystemResumeAutomatic

Ordinal 391
Address 0x6f700

NtIsUILanguageComitted

Ordinal 392
Address 0x6f710

NtListenPort

Ordinal 393
Address 0x6f720

NtLoadDriver

Ordinal 394
Address 0x6f730

NtLoadEnclaveData

Ordinal 395
Address 0x6f740

NtLoadHotPatch

Ordinal 396
Address 0x6f750

NtLoadKey2

Ordinal 397
Address 0x6f770

NtLoadKey

Ordinal 398
Address 0x6f760

NtLoadKeyEx

Ordinal 399
Address 0x6f780

NtLockFile

Ordinal 400
Address 0x6f790

NtLockProductActivationKeys

Ordinal 401
Address 0x6f7a0

NtLockRegistryKey

Ordinal 402
Address 0x6f7b0

NtLockVirtualMemory

Ordinal 403
Address 0x6f7c0

NtMakePermanentObject

Ordinal 404
Address 0x6f7d0

NtMakeTemporaryObject

Ordinal 405
Address 0x6f7e0

NtManagePartition

Ordinal 406
Address 0x6f7f0

NtMapCMFModule

Ordinal 407
Address 0x6f800

NtMapUserPhysicalPages

Ordinal 408
Address 0x6f810

NtMapUserPhysicalPagesScatter

Ordinal 409
Address 0x6e770

NtMapViewOfSection

Ordinal 410
Address 0x6e9e0

NtModifyBootEntry

Ordinal 411
Address 0x6f820

NtModifyDriverEntry

Ordinal 412
Address 0x6f830

NtNotifyChangeDirectoryFile

Ordinal 413
Address 0x6f840

NtNotifyChangeDirectoryFileEx

Ordinal 414
Address 0x6f850

NtNotifyChangeKey

Ordinal 415
Address 0x6f860

NtNotifyChangeMultipleKeys

Ordinal 416
Address 0x6f870

NtNotifyChangeSession

Ordinal 417
Address 0x6f880

NtOpenDirectoryObject

Ordinal 418
Address 0x6ece0

NtOpenEnlistment

Ordinal 419
Address 0x6f890

NtOpenEvent

Ordinal 420
Address 0x6eb60

NtOpenEventPair

Ordinal 421
Address 0x6f8a0

NtOpenFile

Ordinal 422
Address 0x6ea90

NtOpenIoCompletion

Ordinal 423
Address 0x6f8b0

NtOpenJobObject

Ordinal 424
Address 0x6f8c0

NtOpenKey

Ordinal 425
Address 0x6e860

NtOpenKeyEx

Ordinal 426
Address 0x6f8d0

NtOpenKeyTransacted

Ordinal 427
Address 0x6f8e0

NtOpenKeyTransactedEx

Ordinal 428
Address 0x6f8f0

NtOpenKeyedEvent

Ordinal 429
Address 0x6f900

NtOpenMutant

Ordinal 430
Address 0x6f910

NtOpenObjectAuditAlarm

Ordinal 431
Address 0x6f920

NtOpenPartition

Ordinal 432
Address 0x6f930

NtOpenPrivateNamespace

Ordinal 433
Address 0x6f940

NtOpenProcess

Ordinal 434
Address 0x6e9c0

NtOpenProcessToken

Ordinal 435
Address 0x6f950

NtOpenProcessTokenEx

Ordinal 436
Address 0x6ea60

NtOpenRegistryTransaction

Ordinal 437
Address 0x6f960

NtOpenResourceManager

Ordinal 438
Address 0x6f970

NtOpenSection

Ordinal 439
Address 0x6ead0

NtOpenSemaphore

Ordinal 440
Address 0x6f980

NtOpenSession

Ordinal 441
Address 0x6f990

NtOpenSymbolicLinkObject

Ordinal 442
Address 0x6f9a0

NtOpenThread

Ordinal 443
Address 0x6f9b0

NtOpenThreadToken

Ordinal 444
Address 0x6e9a0

NtOpenThreadTokenEx

Ordinal 445
Address 0x6ea50

NtOpenTimer

Ordinal 446
Address 0x6f9c0

NtOpenTransaction

Ordinal 447
Address 0x6f9d0

NtOpenTransactionManager

Ordinal 448
Address 0x6f9e0

NtPlugPlayControl

Ordinal 449
Address 0x6f9f0

NtPowerInformation

Ordinal 450
Address 0x6ed50

NtPrePrepareComplete

Ordinal 451
Address 0x6fa00

NtPrePrepareEnlistment

Ordinal 452
Address 0x6fa10

NtPrepareComplete

Ordinal 453
Address 0x6fa20

NtPrepareEnlistment

Ordinal 454
Address 0x6fa30

NtPrivilegeCheck

Ordinal 455
Address 0x6fa40

NtPrivilegeObjectAuditAlarm

Ordinal 456
Address 0x6fa50

NtPrivilegedServiceAuditAlarm

Ordinal 457
Address 0x6fa60

NtPropagationComplete

Ordinal 458
Address 0x6fa70

NtPropagationFailed

Ordinal 459
Address 0x6fa80

NtProtectVirtualMemory

Ordinal 460
Address 0x6ec60

NtPulseEvent

Ordinal 461
Address 0x6fa90

NtQueryAttributesFile

Ordinal 462
Address 0x6eb30

NtQueryAuxiliaryCounterFrequency

Ordinal 463
Address 0x6faa0

NtQueryBootEntryOrder

Ordinal 464
Address 0x6fab0

NtQueryBootOptions

Ordinal 465
Address 0x6fac0

NtQueryDebugFilterState

Ordinal 466
Address 0x6fad0

NtQueryDefaultLocale

Ordinal 467
Address 0x6e890

NtQueryDefaultUILanguage

Ordinal 468
Address 0x6eba0

NtQueryDirectoryFile

Ordinal 469
Address 0x6eab0

NtQueryDirectoryFileEx

Ordinal 470
Address 0x6fae0

NtQueryDirectoryObject

Ordinal 471
Address 0x6faf0

NtQueryDriverEntryOrder

Ordinal 472
Address 0x6fb00

NtQueryEaFile

Ordinal 473
Address 0x6fb10

NtQueryEvent

Ordinal 474
Address 0x6ecc0

NtQueryFullAttributesFile

Ordinal 475
Address 0x6fb20

NtQueryInformationAtom

Ordinal 476
Address 0x6fb30

NtQueryInformationByName

Ordinal 477
Address 0x6fb40

NtQueryInformationEnlistment

Ordinal 478
Address 0x6fb50

NtQueryInformationFile

Ordinal 479
Address 0x6e850

NtQueryInformationJobObject

Ordinal 480
Address 0x6fb60

NtQueryInformationPort

Ordinal 481
Address 0x6fb70

NtQueryInformationProcess

Ordinal 482
Address 0x6e8d0

NtQueryInformationResourceManager

Ordinal 483
Address 0x6fb80

NtQueryInformationThread

Ordinal 484
Address 0x6e9b0

NtQueryInformationToken

Ordinal 485
Address 0x6e970

NtQueryInformationTransaction

Ordinal 486
Address 0x6fb90

NtQueryInformationTransactionManager

Ordinal 487
Address 0x6fba0

NtQueryInformationWorkerFactory

Ordinal 488
Address 0x6fbb0

NtQueryInstallUILanguage

Ordinal 489
Address 0x6fbc0

NtQueryIntervalProfile

Ordinal 490
Address 0x6fbd0

NtQueryIoCompletion

Ordinal 491
Address 0x6fbe0

NtQueryKey

Ordinal 492
Address 0x6e8a0

NtQueryLicenseValue

Ordinal 493
Address 0x6fbf0

NtQueryMultipleValueKey

Ordinal 494
Address 0x6fc00

NtQueryMutant

Ordinal 495
Address 0x6fc10

NtQueryObject

Ordinal 496
Address 0x6e840

NtQueryOpenSubKeys

Ordinal 497
Address 0x6fc20

NtQueryOpenSubKeysEx

Ordinal 498
Address 0x6fc30

NtQueryPerformanceCounter

Ordinal 499
Address 0x6ea70

NtQueryPortInformationProcess

Ordinal 500
Address 0x6fc40

NtQueryQuotaInformationFile

Ordinal 501
Address 0x6fc50

NtQuerySection

Ordinal 502
Address 0x6ec70

NtQuerySecurityAttributesToken

Ordinal 503
Address 0x6fc60

NtQuerySecurityObject

Ordinal 504
Address 0x6fc70

NtQuerySecurityPolicy

Ordinal 505
Address 0x6fc80

NtQuerySemaphore

Ordinal 506
Address 0x6fc90

NtQuerySymbolicLinkObject

Ordinal 507
Address 0x6fca0

NtQuerySystemEnvironmentValue

Ordinal 508
Address 0x6fcb0

NtQuerySystemEnvironmentValueEx

Ordinal 509
Address 0x6fcc0

NtQuerySystemInformation

Ordinal 510
Address 0x6eac0

NtQuerySystemInformationEx

Ordinal 511
Address 0x6fcd0

NtQuerySystemTime

Ordinal 512
Address 0x6ed00

NtQueryTimer

Ordinal 513
Address 0x6eae0

NtQueryTimerResolution

Ordinal 514
Address 0x6fce0

NtQueryValueKey

Ordinal 515
Address 0x6e8b0

NtQueryVirtualMemory

Ordinal 516
Address 0x6e990

NtQueryVolumeInformationFile

Ordinal 517
Address 0x6ebf0

NtQueryWnfStateData

Ordinal 518
Address 0x6fcf0

NtQueryWnfStateNameInformation

Ordinal 519
Address 0x6fd00

NtQueueApcThread

Ordinal 520
Address 0x6ebb0

NtQueueApcThreadEx

Ordinal 521
Address 0x6fd10

NtRaiseException

Ordinal 522
Address 0x6fd20

NtRaiseHardError

Ordinal 523
Address 0x6fd30

NtReadFile

Ordinal 524
Address 0x6e7a0

NtReadFileScatter

Ordinal 525
Address 0x6ea40

NtReadOnlyEnlistment

Ordinal 526
Address 0x6fd40

NtReadRequestData

Ordinal 527
Address 0x6eca0

NtReadVirtualMemory

Ordinal 528
Address 0x6eb50

NtRecoverEnlistment

Ordinal 529
Address 0x6fd50

NtRecoverResourceManager

Ordinal 530
Address 0x6fd60

NtRecoverTransactionManager

Ordinal 531
Address 0x6fd70

NtRegisterProtocolAddressInformation

Ordinal 532
Address 0x6fd80

NtRegisterThreadTerminatePort

Ordinal 533
Address 0x6fd90

NtReleaseKeyedEvent

Ordinal 534
Address 0x6fda0

NtReleaseMutant

Ordinal 535
Address 0x6e960

NtReleaseSemaphore

Ordinal 536
Address 0x6e7e0

NtReleaseWorkerFactoryWorker

Ordinal 537
Address 0x6fdb0

NtRemoveIoCompletion

Ordinal 538
Address 0x6e7d0

NtRemoveIoCompletionEx

Ordinal 539
Address 0x6fdc0

NtRemoveProcessDebug

Ordinal 540
Address 0x6fdd0

NtRenameKey

Ordinal 541
Address 0x6fde0

NtRenameTransactionManager

Ordinal 542
Address 0x6fdf0

NtReplaceKey

Ordinal 543
Address 0x6fe00

NtReplacePartitionUnit

Ordinal 544
Address 0x6fe10

NtReplyPort

Ordinal 545
Address 0x6e800

NtReplyWaitReceivePort

Ordinal 546
Address 0x6e7f0

NtReplyWaitReceivePortEx

Ordinal 547
Address 0x6ea10

NtReplyWaitReplyPort

Ordinal 548
Address 0x6fe20

NtRequestPort

Ordinal 549
Address 0x6fe30

NtRequestWaitReplyPort

Ordinal 550
Address 0x6e980

NtResetEvent

Ordinal 551
Address 0x6fe40

NtResetWriteWatch

Ordinal 552
Address 0x6fe50

NtRestoreKey

Ordinal 553
Address 0x6fe60

NtResumeProcess

Ordinal 554
Address 0x6fe70

NtResumeThread

Ordinal 555
Address 0x6ec80

NtRevertContainerImpersonation

Ordinal 556
Address 0x6fe80

NtRollbackComplete

Ordinal 557
Address 0x6fe90

NtRollbackEnlistment

Ordinal 558
Address 0x6fea0

NtRollbackRegistryTransaction

Ordinal 559
Address 0x6feb0

NtRollbackTransaction

Ordinal 560
Address 0x6fec0

NtRollforwardTransactionManager

Ordinal 561
Address 0x6fed0

NtSaveKey

Ordinal 562
Address 0x6fee0

NtSaveKeyEx

Ordinal 563
Address 0x6fef0

NtSaveMergedKeys

Ordinal 564
Address 0x6ff00

NtSecureConnectPort

Ordinal 565
Address 0x6ff10

NtSerializeBoot

Ordinal 566
Address 0x6ff20

NtSetBootEntryOrder

Ordinal 567
Address 0x6ff30

NtSetBootOptions

Ordinal 568
Address 0x6ff40

NtSetCachedSigningLevel2

Ordinal 569
Address 0x6ff60

NtSetCachedSigningLevel

Ordinal 570
Address 0x6ff50

NtSetContextThread

Ordinal 571
Address 0x6ff70

NtSetDebugFilterState

Ordinal 572
Address 0x6ff80

NtSetDefaultHardErrorPort

Ordinal 573
Address 0x6ff90

NtSetDefaultLocale

Ordinal 574
Address 0x6ffa0

NtSetDefaultUILanguage

Ordinal 575
Address 0x6ffb0

NtSetDriverEntryOrder

Ordinal 576
Address 0x6ffc0

NtSetEaFile

Ordinal 577
Address 0x6ffd0

NtSetEvent

Ordinal 578
Address 0x6e820

NtSetEventBoostPriority

Ordinal 579
Address 0x6ea30

NtSetHighEventPair

Ordinal 580
Address 0x6ffe0

NtSetHighWaitLowEventPair

Ordinal 581
Address 0x6fff0

NtSetIRTimer

Ordinal 582
Address 0x70000

NtSetInformationDebugObject

Ordinal 583
Address 0x70010

NtSetInformationEnlistment

Ordinal 584
Address 0x70020

NtSetInformationFile

Ordinal 585
Address 0x6e9d0

NtSetInformationJobObject

Ordinal 586
Address 0x70030

NtSetInformationKey

Ordinal 587
Address 0x70040

NtSetInformationObject

Ordinal 588
Address 0x6ed20

NtSetInformationProcess

Ordinal 589
Address 0x6e920

NtSetInformationResourceManager

Ordinal 590
Address 0x70050

NtSetInformationSymbolicLink

Ordinal 591
Address 0x70060

NtSetInformationThread

Ordinal 592
Address 0x6e810

NtSetInformationToken

Ordinal 593
Address 0x70070

NtSetInformationTransaction

Ordinal 594
Address 0x70080

NtSetInformationTransactionManager

Ordinal 595
Address 0x70090

NtSetInformationVirtualMemory

Ordinal 596
Address 0x700a0

NtSetInformationWorkerFactory

Ordinal 597
Address 0x700b0

NtSetIntervalProfile

Ordinal 598
Address 0x700c0

NtSetIoCompletion

Ordinal 599
Address 0x700d0

NtSetIoCompletionEx

Ordinal 600
Address 0x700e0

NtSetLdtEntries

Ordinal 601
Address 0x700f0

NtSetLowEventPair

Ordinal 602
Address 0x70100

NtSetLowWaitHighEventPair

Ordinal 603
Address 0x70110

NtSetQuotaInformationFile

Ordinal 604
Address 0x70120

NtSetSecurityObject

Ordinal 605
Address 0x70130

NtSetSystemEnvironmentValue

Ordinal 606
Address 0x70140

NtSetSystemEnvironmentValueEx

Ordinal 607
Address 0x70150

NtSetSystemInformation

Ordinal 608
Address 0x70160

NtSetSystemPowerState

Ordinal 609
Address 0x70170

NtSetSystemTime

Ordinal 610
Address 0x70180

NtSetThreadExecutionState

Ordinal 611
Address 0x70190

NtSetTimer2

Ordinal 612
Address 0x701a0

NtSetTimer

Ordinal 613
Address 0x6ed80

NtSetTimerEx

Ordinal 614
Address 0x701b0

NtSetTimerResolution

Ordinal 615
Address 0x701c0

NtSetUuidSeed

Ordinal 616
Address 0x701d0

NtSetValueKey

Ordinal 617
Address 0x6ed60

NtSetVolumeInformationFile

Ordinal 618
Address 0x701e0

NtSetWnfProcessNotificationEvent

Ordinal 619
Address 0x701f0

NtShutdownSystem

Ordinal 620
Address 0x70200

NtShutdownWorkerFactory

Ordinal 621
Address 0x70210

NtSignalAndWaitForSingleObject

Ordinal 622
Address 0x70220

NtSinglePhaseReject

Ordinal 623
Address 0x70230

NtStartProfile

Ordinal 624
Address 0x70240

NtStopProfile

Ordinal 625
Address 0x70250

NtSubscribeWnfStateChange

Ordinal 626
Address 0x70260

NtSuspendProcess

Ordinal 627
Address 0x70270

NtSuspendThread

Ordinal 628
Address 0x70280

NtSystemDebugControl

Ordinal 629
Address 0x70290

NtTerminateEnclave

Ordinal 630
Address 0x702a0

NtTerminateJobObject

Ordinal 631
Address 0x702b0

NtTerminateProcess

Ordinal 632
Address 0x6ea20

NtTerminateThread

Ordinal 633
Address 0x6ec90

NtTestAlert

Ordinal 634
Address 0x702c0

NtThawRegistry

Ordinal 635
Address 0x702d0

NtThawTransactions

Ordinal 636
Address 0x702e0

NtTraceControl

Ordinal 637
Address 0x702f0

NtTraceEvent

Ordinal 638
Address 0x6ed40

NtTranslateFilePath

Ordinal 639
Address 0x70300

NtUmsThreadYield

Ordinal 640
Address 0x70310

NtUnloadDriver

Ordinal 641
Address 0x70320

NtUnloadKey2

Ordinal 642
Address 0x70340

NtUnloadKey

Ordinal 643
Address 0x70330

NtUnloadKeyEx

Ordinal 644
Address 0x70350

NtUnlockFile

Ordinal 645
Address 0x70360

NtUnlockVirtualMemory

Ordinal 646
Address 0x70370

NtUnmapViewOfSection

Ordinal 647
Address 0x6ea00

NtUnmapViewOfSectionEx

Ordinal 648
Address 0x70380

NtUnsubscribeWnfStateChange

Ordinal 649
Address 0x70390

NtUpdateWnfStateData

Ordinal 650
Address 0x703a0

NtVdmControl

Ordinal 651
Address 0x703b0

NtWaitForAlertByThreadId

Ordinal 652
Address 0x703c0

NtWaitForDebugEvent

Ordinal 653
Address 0x703d0

NtWaitForKeyedEvent

Ordinal 654
Address 0x703e0

NtWaitForMultipleObjects32

Ordinal 655
Address 0x6e900

NtWaitForMultipleObjects

Ordinal 656
Address 0x6ed10

NtWaitForSingleObject

Ordinal 657
Address 0x6e780

NtWaitForWorkViaWorkerFactory

Ordinal 658
Address 0x703f0

NtWaitHighEventPair

Ordinal 659
Address 0x70400

NtWaitLowEventPair

Ordinal 660
Address 0x70410

NtWorkerFactoryWorkerReady

Ordinal 661
Address 0x6e750

NtWow64AllocateVirtualMemory64

Ordinal 662
Address 0x70500

NtWow64CallFunction64

Ordinal 663
Address 0x70530

NtWow64CsrAllocateCaptureBuffer

Ordinal 664
Address 0x70450

NtWow64CsrAllocateMessagePointer

Ordinal 665
Address 0x70470

NtWow64CsrCaptureMessageBuffer

Ordinal 666
Address 0x70480

NtWow64CsrCaptureMessageString

Ordinal 667
Address 0x70490

NtWow64CsrClientCallServer

Ordinal 668
Address 0x70440

NtWow64CsrClientConnectToServer

Ordinal 669
Address 0x70420

NtWow64CsrFreeCaptureBuffer

Ordinal 670
Address 0x70460

NtWow64CsrGetProcessId

Ordinal 671
Address 0x704a0

NtWow64CsrIdentifyAlertableThread

Ordinal 672
Address 0x70430

NtWow64CsrVerifyRegion

Ordinal 673
Address 0x704b0

NtWow64DebuggerCall

Ordinal 674
Address 0x704c0

NtWow64GetCurrentProcessorNumberEx

Ordinal 675
Address 0x704d0

NtWow64GetNativeSystemInformation

Ordinal 676
Address 0x704e0

NtWow64IsProcessorFeaturePresent

Ordinal 677
Address 0x70540

NtWow64QueryInformationProcess64

Ordinal 678
Address 0x704f0

NtWow64ReadVirtualMemory64

Ordinal 679
Address 0x70510

NtWow64WriteVirtualMemory64

Ordinal 680
Address 0x70520

NtWriteFile

Ordinal 681
Address 0x6e7c0

NtWriteFileGather

Ordinal 682
Address 0x6e910

NtWriteRequestData

Ordinal 683
Address 0x6ecd0

NtWriteVirtualMemory

Ordinal 684
Address 0x6eb00

NtYieldExecution

Ordinal 685
Address 0x6ebc0

NtdllDefWindowProc_A

Ordinal 686
Address 0x891f0

NtdllDefWindowProc_W

Ordinal 687
Address 0x89200

NtdllDialogWndProc_A

Ordinal 688
Address 0x892b0

NtdllDialogWndProc_W

Ordinal 689
Address 0x892c0

PfxFindPrefix

Ordinal 690
Address 0xbda00

PfxInitialize

Ordinal 691
Address 0xbdaa0

PfxInsertPrefix

Ordinal 692
Address 0xbdac0

PfxRemovePrefix

Ordinal 693
Address 0xbdbb0

PssNtCaptureSnapshot

Ordinal 694
Address 0xf5cd0

PssNtDuplicateSnapshot

Ordinal 695
Address 0xf62b0

PssNtFreeRemoteSnapshot

Ordinal 696
Address 0xf6320

PssNtFreeSnapshot

Ordinal 697
Address 0xf64b0

PssNtFreeWalkMarker

Ordinal 698
Address 0xf6610

PssNtQuerySnapshot

Ordinal 699
Address 0xf6640

PssNtValidateDescriptor

Ordinal 700
Address 0xf67e0

PssNtWalkSnapshot

Ordinal 701
Address 0xf68a0

RtlAbortRXact

Ordinal 702
Address 0xbdde0

RtlAbsoluteToSelfRelativeSD

Ordinal 703
Address 0x63120

RtlAcquirePebLock

Ordinal 704
Address 0x68020

RtlAcquirePrivilege

Ordinal 705
Address 0xbe5c0

RtlAcquireReleaseSRWLockExclusive

Ordinal 706
Address 0xc2080

RtlAcquireResourceExclusive

Ordinal 707
Address 0x5ef10

RtlAcquireResourceShared

Ordinal 708
Address 0x5f1f0

RtlAcquireSRWLockExclusive

Ordinal 709
Address 0x44170

RtlAcquireSRWLockShared

Ordinal 710
Address 0x49fa0

RtlActivateActivationContext

Ordinal 711
Address 0x5da80

RtlActivateActivationContextEx

Ordinal 712
Address 0x5dad0

RtlAddAccessAllowedAce

Ordinal 713
Address 0x38130

RtlAddAccessAllowedAceEx

Ordinal 714
Address 0x69090

RtlAddAccessAllowedObjectAce

Ordinal 715
Address 0xc27f0

RtlAddAccessDeniedAce

Ordinal 716
Address 0xc2840

RtlAddAccessDeniedAceEx

Ordinal 717
Address 0xc2870

RtlAddAccessDeniedObjectAce

Ordinal 718
Address 0xc28a0

RtlAddAccessFilterAce

Ordinal 719
Address 0xc28f0

RtlAddAce

Ordinal 720
Address 0x24e00

RtlAddActionToRXact

Ordinal 721
Address 0xbde20

RtlAddAtomToAtomTable

Ordinal 722
Address 0x214a0

RtlAddAttributeActionToRXact

Ordinal 723
Address 0xbde60

RtlAddAuditAccessAce

Ordinal 724
Address 0xc2ad0

RtlAddAuditAccessAceEx

Ordinal 725
Address 0xc2b10

RtlAddAuditAccessObjectAce

Ordinal 726
Address 0xc2b50

RtlAddCompoundAce

Ordinal 727
Address 0xc2bc0

RtlAddIntegrityLabelToBoundaryDescriptor

Ordinal 728
Address 0xc4ce0

RtlAddMandatoryAce

Ordinal 729
Address 0x2b9e0

RtlAddProcessTrustLabelAce

Ordinal 730
Address 0xc2cf0

RtlAddRefActivationContext

Ordinal 731
Address 0x5e1d0

RtlAddRefMemoryStream

Ordinal 732
Address 0xaf720

RtlAddResourceAttributeAce

Ordinal 733
Address 0xc2e10

RtlAddSIDToBoundaryDescriptor

Ordinal 734
Address 0x25fb0

RtlAddScopedPolicyIDAce

Ordinal 735
Address 0xc3160

RtlAddVectoredContinueHandler

Ordinal 736
Address 0xb2eb0

RtlAddVectoredExceptionHandler

Ordinal 737
Address 0x27360

RtlAddressInSectionTable

Ordinal 738
Address 0x31590

RtlAdjustPrivilege

Ordinal 739
Address 0x64e50

RtlAllocateActivationContextStack

Ordinal 740
Address 0x27580

RtlAllocateAndInitializeSid

Ordinal 741
Address 0x60360

RtlAllocateAndInitializeSidEx

Ordinal 742
Address 0xbe820

RtlAllocateHandle

Ordinal 743
Address 0x61d00

RtlAllocateHeap

Ordinal 744
Address 0x413b0

RtlAllocateMemoryBlockLookaside

Ordinal 745
Address 0x114010

RtlAllocateMemoryZone

Ordinal 746
Address 0x1140a0

RtlAllocateWnfSerializationGroup

Ordinal 747
Address 0x6a7d0

RtlAnsiCharToUnicodeChar

Ordinal 748
Address 0x5eaa0

RtlAnsiStringToUnicodeSize

Ordinal 749
Address 0xc5bb0

RtlAnsiStringToUnicodeString

Ordinal 750
Address 0x3c840

RtlAppendAsciizToString

Ordinal 751
Address 0xc5c10

RtlAppendPathElement

Ordinal 752
Address 0xa9b50

RtlAppendStringToString

Ordinal 753
Address 0xc5c70

RtlAppendUnicodeStringToString

Ordinal 754
Address 0x411f0

RtlAppendUnicodeToString

Ordinal 755
Address 0x39750

RtlApplicationVerifierStop

Ordinal 756
Address 0xb4ac0

RtlApplyRXact

Ordinal 757
Address 0xbe000

RtlApplyRXactNoFlush

Ordinal 758
Address 0xbe090

RtlAppxIsFileOwnedByTrustedInstaller

Ordinal 759
Address 0xa9450

RtlAreAllAccessesGranted

Ordinal 760
Address 0xbe8b0

RtlAreAnyAccessesGranted

Ordinal 761
Address 0xbe8d0

RtlAreBitsClear

Ordinal 762
Address 0xc5dd0

RtlAreBitsSet

Ordinal 763
Address 0x650c0

RtlAreLongPathsEnabled

Ordinal 764
Address 0x67d70

RtlAssert

Ordinal 765
Address 0xc7740

RtlAvlInsertNodeEx

Ordinal 766
Address 0xc7850

RtlAvlRemoveNode

Ordinal 767
Address 0xc79c0

RtlBarrier

Ordinal 768
Address 0xc7dc0

RtlBarrierForDelete

Ordinal 769
Address 0xc7de0

RtlCancelTimer

Ordinal 770
Address 0xf5310

RtlCanonicalizeDomainName

Ordinal 771
Address 0xc5390

RtlCapabilityCheck

Ordinal 772
Address 0x6aca0

RtlCapabilityCheckForSingleSessionSku

Ordinal 773
Address 0x85440

RtlCaptureContext

Ordinal 774
Address 0x89de0

RtlCaptureStackBackTrace

Ordinal 775
Address 0x209f0

RtlCaptureStackContext

Ordinal 776
Address 0x8a0e0

RtlCharToInteger

Ordinal 777
Address 0x63ba0

RtlCheckBootStatusIntegrity

Ordinal 778
Address 0xc82f0

RtlCheckForOrphanedCriticalSections

Ordinal 779
Address 0x69430

RtlCheckPortableOperatingSystem

Ordinal 780
Address 0xc8810

RtlCheckRegistryKey

Ordinal 781
Address 0xc88e0

RtlCheckSandboxedToken

Ordinal 782
Address 0xb04c0

RtlCheckSystemBootStatusIntegrity

Ordinal 783
Address 0x854c0

RtlCheckTokenCapability

Ordinal 784
Address 0x6ae80

RtlCheckTokenMembership

Ordinal 785
Address 0xbe8f0

RtlCheckTokenMembershipEx

Ordinal 786
Address 0x28db0

RtlCleanUpTEBLangLists

Ordinal 787
Address 0x51220

RtlClearAllBits

Ordinal 788
Address 0xc5e80

RtlClearBit

Ordinal 789
Address 0xc5ec0

RtlClearBits

Ordinal 790
Address 0x5d2f0

RtlClearThreadWorkOnBehalfTicket

Ordinal 791
Address 0xcd7f0

RtlCloneMemoryStream

Ordinal 792
Address 0xaf730

RtlCloneUserProcess

Ordinal 793
Address 0xb0030

RtlCmDecodeMemIoResource

Ordinal 794
Address 0xcd860

RtlCmEncodeMemIoResource

Ordinal 795
Address 0xcd8e0

RtlCommitDebugInfo

Ordinal 796
Address 0xb13c0

RtlCommitMemoryStream

Ordinal 797
Address 0xaf730

RtlCompactHeap

Ordinal 798
Address 0xcde70

RtlCompareAltitudes

Ordinal 799
Address 0xd0bb0

RtlCompareMemory

Ordinal 800
Address 0x89500

RtlCompareMemoryUlong

Ordinal 801
Address 0x89550

RtlCompareString

Ordinal 802
Address 0xc5cd0

RtlCompareUnicodeString

Ordinal 803
Address 0x4bdc0

RtlCompareUnicodeStrings

Ordinal 804
Address 0x4b8b0

RtlCompressBuffer

Ordinal 805
Address 0xd0e30

RtlComputeCrc32

Ordinal 806
Address 0xd1140

RtlComputeImportTableHash

Ordinal 807
Address 0xb92e0

RtlComputePrivatizedDllName_U

Ordinal 808
Address 0xaf430

RtlConnectToSm

Ordinal 809
Address 0xd1180

RtlConsoleMultiByteToUnicodeN

Ordinal 810
Address 0xbc9d0

RtlContractHashTable

Ordinal 811
Address 0xd1530

RtlConvertDeviceFamilyInfoToString

Ordinal 812
Address 0xaf860

RtlConvertExclusiveToShared

Ordinal 813
Address 0xc22b0

RtlConvertLCIDToString

Ordinal 814
Address 0xc9020

RtlConvertLongToLargeInteger

Ordinal 815
Address 0x89b50

RtlConvertSRWLockExclusiveToShared

Ordinal 816
Address 0xc20b0

RtlConvertSharedToExclusive

Ordinal 817
Address 0xc2300

RtlConvertSidToUnicodeString

Ordinal 818
Address 0x39830

RtlConvertToAutoInheritSecurityObject

Ordinal 819
Address 0xb0770

RtlConvertUlongToLargeInteger

Ordinal 820
Address 0x89b60

RtlCopyBitMap

Ordinal 821
Address 0xc5ef0

RtlCopyContext

Ordinal 822
Address 0xd1e80

RtlCopyExtendedContext

Ordinal 823
Address 0xd1ff0

RtlCopyLuid

Ordinal 824
Address 0xbe910

RtlCopyLuidAndAttributesArray

Ordinal 825
Address 0xbe930

RtlCopyMappedMemory

Ordinal 826
Address 0xd2ca0

RtlCopyMemoryStreamTo

Ordinal 827
Address 0xaf740

RtlCopyOutOfProcessMemoryStreamTo

Ordinal 828
Address 0xaf740

RtlCopySecurityDescriptor

Ordinal 829
Address 0xb07a0

RtlCopySid

Ordinal 830
Address 0x2bb20

RtlCopySidAndAttributesArray

Ordinal 831
Address 0xbe970

RtlCopyString

Ordinal 832
Address 0x28870

RtlCopyUnicodeString

Ordinal 833
Address 0x39bc0

RtlCrc32

Ordinal 834
Address 0xd2d70

RtlCrc64

Ordinal 835
Address 0xd2da0

RtlCreateAcl

Ordinal 836
Address 0x2a8c0

RtlCreateActivationContext

Ordinal 837
Address 0x59630

RtlCreateAndSetSD

Ordinal 838
Address 0xb0830

RtlCreateAtomTable

Ordinal 839
Address 0x21280

RtlCreateBootStatusDataFile

Ordinal 840
Address 0xc83e0

RtlCreateBoundaryDescriptor

Ordinal 841
Address 0x26a20

RtlCreateEnvironment

Ordinal 842
Address 0xaa710

RtlCreateEnvironmentEx

Ordinal 843
Address 0x268c0

RtlCreateHashTable

Ordinal 844
Address 0xd1640

RtlCreateHashTableEx

Ordinal 845
Address 0xd1670

RtlCreateHeap

Ordinal 846
Address 0x2d7b0

RtlCreateMemoryBlockLookaside

Ordinal 847
Address 0x270c0

RtlCreateMemoryZone

Ordinal 848
Address 0x27220

RtlCreateProcessParameters

Ordinal 849
Address 0xb0250

RtlCreateProcessParametersEx

Ordinal 850
Address 0x24f00

RtlCreateProcessReflection

Ordinal 851
Address 0xaf930

RtlCreateQueryDebugBuffer

Ordinal 852
Address 0xb13e0

RtlCreateRegistryKey

Ordinal 853
Address 0xc8920

RtlCreateSecurityDescriptor

Ordinal 854
Address 0x2b9b0

RtlCreateServiceSid

Ordinal 855
Address 0x210b0

RtlCreateSystemVolumeInformationFolder

Ordinal 856
Address 0xd4820

RtlCreateTagHeap

Ordinal 857
Address 0x67ee0

RtlCreateTimer

Ordinal 858
Address 0x4f9d0

RtlCreateTimerQueue

Ordinal 859
Address 0x694f0

RtlCreateUnicodeString

Ordinal 860
Address 0x61a30

RtlCreateUnicodeStringFromAsciiz

Ordinal 861
Address 0x5f780

RtlCreateUserProcess

Ordinal 862
Address 0xbade0

RtlCreateUserProcessEx

Ordinal 863
Address 0xbae50

RtlCreateUserSecurityObject

Ordinal 864
Address 0xb0b20

RtlCreateUserStack

Ordinal 865
Address 0x25d10

RtlCreateUserThread

Ordinal 866
Address 0x6c730

RtlCreateVirtualAccountSid

Ordinal 867
Address 0xbea00

RtlCultureNameToLCID

Ordinal 868
Address 0x530a0

RtlCustomCPToUnicodeN

Ordinal 869
Address 0xbcb20

RtlCutoverTimeToSystemTime

Ordinal 870
Address 0x5e570

RtlDeCommitDebugInfo

Ordinal 871
Address 0xb1570

RtlDeNormalizeProcessParams

Ordinal 872
Address 0xb0290

RtlDeactivateActivationContext

Ordinal 873
Address 0x62620

RtlDebugPrintTimes

Ordinal 874
Address 0x6ab80

RtlDecodePointer

Ordinal 875
Address 0x60950

RtlDecodeRemotePointer

Ordinal 876
Address 0xb4f00

RtlDecodeSystemPointer

Ordinal 877
Address 0x27f00

RtlDecompressBuffer

Ordinal 878
Address 0xd0eb0

RtlDecompressBufferEx

Ordinal 879
Address 0xd0f20

RtlDecompressFragment

Ordinal 880
Address 0xd0f90

RtlDefaultNpAcl

Ordinal 881
Address 0xb0b90

RtlDelete

Ordinal 882
Address 0x24970

RtlDeleteAce

Ordinal 883
Address 0x25ef0

RtlDeleteAtomFromAtomTable

Ordinal 884
Address 0x213e0

RtlDeleteBarrier

Ordinal 885
Address 0xc7e00

RtlDeleteBoundaryDescriptor

Ordinal 886
Address 0x280d0

RtlDeleteCriticalSection

Ordinal 887
Address 0x2c680

RtlDeleteElementGenericTable

Ordinal 888
Address 0x247f0

RtlDeleteElementGenericTableAvl

Ordinal 889
Address 0x21a10

RtlDeleteElementGenericTableAvlEx

Ordinal 890
Address 0x21a50

RtlDeleteHashTable

Ordinal 891
Address 0xd1690

RtlDeleteNoSplay

Ordinal 892
Address 0x67ac0

RtlDeleteRegistryValue

Ordinal 893
Address 0xc8960

RtlDeleteResource

Ordinal 894
Address 0x2c640

RtlDeleteSecurityObject

Ordinal 895
Address 0x69610

RtlDeleteTimer

Ordinal 896
Address 0x4fbb0

RtlDeleteTimerQueue

Ordinal 897
Address 0xf5330

RtlDeleteTimerQueueEx

Ordinal 898
Address 0x258b0

RtlDeregisterSecureMemoryCacheCallback

Ordinal 899
Address 0xd5430

RtlDeregisterWait

Ordinal 900
Address 0xf5470

RtlDeregisterWaitEx

Ordinal 901
Address 0x23e00

RtlDeriveCapabilitySidsFromName

Ordinal 902
Address 0x6b000

RtlDestroyAtomTable

Ordinal 903
Address 0xc4ad0

RtlDestroyEnvironment

Ordinal 904
Address 0x28110

RtlDestroyHandleTable

Ordinal 905
Address 0xc4eb0

RtlDestroyHeap

Ordinal 906
Address 0x2c890

RtlDestroyMemoryBlockLookaside

Ordinal 907
Address 0x28140

RtlDestroyMemoryZone

Ordinal 908
Address 0x28190

RtlDestroyProcessParameters

Ordinal 909
Address 0x28110

RtlDestroyQueryDebugBuffer

Ordinal 910
Address 0xb1590

RtlDetectHeapLeaks

Ordinal 911
Address 0x69ae0

RtlDetermineDosPathNameType_U

Ordinal 912
Address 0x64d90

RtlDisableThreadProfiling

Ordinal 913
Address 0xa9880

RtlDllShutdownInProgress

Ordinal 914
Address 0x2cf60

RtlDnsHostNameToComputerName

Ordinal 915
Address 0xc5570

RtlDoesFileExists_U

Ordinal 916
Address 0xa9d70

RtlDosApplyFileIsolationRedirection_Ustr

Ordinal 917
Address 0x45420

RtlDosLongPathNameToNtPathName_U_WithStatus

Ordinal 918
Address 0x81bc0

RtlDosLongPathNameToRelativeNtPathName_U_WithStatus

Ordinal 919
Address 0x81bf0

RtlDosPathNameToNtPathName_U

Ordinal 920
Address 0x68110

RtlDosPathNameToNtPathName_U_WithStatus

Ordinal 921
Address 0x65480

RtlDosPathNameToRelativeNtPathName_U

Ordinal 922
Address 0x594e0

RtlDosPathNameToRelativeNtPathName_U_WithStatus

Ordinal 923
Address 0x65610

RtlDosSearchPath_U

Ordinal 924
Address 0xa9d90

RtlDosSearchPath_Ustr

Ordinal 925
Address 0x40ac0

RtlDowncaseUnicodeChar

Ordinal 926
Address 0xc5640

RtlDowncaseUnicodeString

Ordinal 927
Address 0x274d0

RtlDumpResource

Ordinal 928
Address 0xc2360

RtlDuplicateUnicodeString

Ordinal 929
Address 0x27a60

RtlEmptyAtomTable

Ordinal 930
Address 0xc4b90

RtlEnableEarlyCriticalSectionEventCreation

Ordinal 931
Address 0xc23b0

RtlEnableThreadProfiling

Ordinal 932
Address 0xa98d0

RtlEncodePointer

Ordinal 933
Address 0x60de0

RtlEncodeRemotePointer

Ordinal 934
Address 0xb4f50

RtlEncodeSystemPointer

Ordinal 935
Address 0x28390

RtlEndEnumerationHashTable

Ordinal 936
Address 0xd1720

RtlEndStrongEnumerationHashTable

Ordinal 937
Address 0xd1770

RtlEndWeakEnumerationHashTable

Ordinal 938
Address 0xd1780

RtlEnlargedIntegerMultiply

Ordinal 939
Address 0x898f0

RtlEnlargedUnsignedMultiply

Ordinal 940
Address 0x89900

RtlEnterCriticalSection

Ordinal 941
Address 0x4a210

RtlEnumProcessHeaps

Ordinal 942
Address 0xcdfc0

RtlEnumerateEntryHashTable

Ordinal 943
Address 0xd1790

RtlEnumerateGenericTable

Ordinal 944
Address 0xd5040

RtlEnumerateGenericTableAvl

Ordinal 945
Address 0x27dd0

RtlEnumerateGenericTableLikeADirectory

Ordinal 946
Address 0xd51a0

RtlEnumerateGenericTableWithoutSplaying

Ordinal 947
Address 0xd5090

RtlEnumerateGenericTableWithoutSplayingAvl

Ordinal 948
Address 0x27e00

RtlEqualComputerName

Ordinal 949
Address 0xc56a0

RtlEqualDomainName

Ordinal 950
Address 0xc56b0

RtlEqualLuid

Ordinal 951
Address 0xbeae0

RtlEqualPrefixSid

Ordinal 952
Address 0x2afa0

RtlEqualSid

Ordinal 953
Address 0x2b270

RtlEqualString

Ordinal 954
Address 0x25c90

RtlEqualUnicodeString

Ordinal 955
Address 0x39500

RtlEqualWnfChangeStamps

Ordinal 956
Address 0x28a90

RtlEraseUnicodeString

Ordinal 957
Address 0xbeb10

RtlEthernetAddressToStringA

Ordinal 958
Address 0xd5f10

RtlEthernetAddressToStringW

Ordinal 959
Address 0xd60f0

RtlEthernetStringToAddressA

Ordinal 960
Address 0xd6470

RtlEthernetStringToAddressW

Ordinal 961
Address 0xd65a0

RtlExitUserProcess

Ordinal 962
Address 0x67910

RtlExitUserThread

Ordinal 963
Address 0x65640

RtlExpandEnvironmentStrings

Ordinal 964
Address 0x5a6b0

RtlExpandEnvironmentStrings_U

Ordinal 965
Address 0x5a640

RtlExpandHashTable

Ordinal 966
Address 0xd1830

RtlExtendCorrelationVector

Ordinal 967
Address 0xd66c0

RtlExtendMemoryBlockLookaside

Ordinal 968
Address 0xc5080

RtlExtendMemoryZone

Ordinal 969
Address 0xc5250

RtlExtendedIntegerMultiply

Ordinal 970
Address 0x89a20

RtlExtendedLargeIntegerDivide

Ordinal 971
Address 0x89930

RtlExtendedMagicDivide

Ordinal 972
Address 0x89990

RtlExtractBitMap

Ordinal 973
Address 0xc60a0

RtlFillMemory

Ordinal 974
Address 0x89580

RtlFillMemoryUlong

Ordinal 975
Address 0x895f0

RtlFillMemoryUlonglong

Ordinal 976
Address 0x895c0

RtlFinalReleaseOutOfProcessMemoryStream

Ordinal 977
Address 0xc27e0

RtlFindAceByType

Ordinal 978
Address 0x2ac30

RtlFindActivationContextSectionGuid

Ordinal 979
Address 0x5dd30

RtlFindActivationContextSectionString

Ordinal 980
Address 0x45e30

RtlFindCharInUnicodeString

Ordinal 981
Address 0x467f0

RtlFindClearBits

Ordinal 982
Address 0xc6220

RtlFindClearBitsAndSet

Ordinal 983
Address 0x5cea0

RtlFindClearRuns

Ordinal 984
Address 0xc64d0

RtlFindClosestEncodableLength

Ordinal 985
Address 0xcda20

RtlFindExportedRoutineByName

Ordinal 986
Address 0xc4d00

RtlFindLastBackwardRunClear

Ordinal 987
Address 0xc6710

RtlFindLeastSignificantBit

Ordinal 988
Address 0xc67f0

RtlFindLongestRunClear

Ordinal 989
Address 0xc6890

RtlFindMessage

Ordinal 990
Address 0x64780

RtlFindMostSignificantBit

Ordinal 991
Address 0xc68d0

RtlFindNextForwardRunClear

Ordinal 992
Address 0xc6970

RtlFindSetBits

Ordinal 993
Address 0xc6ab0

RtlFindSetBitsAndClear

Ordinal 994
Address 0xc6d60

RtlFindUnicodeSubstring

Ordinal 995
Address 0x64210

RtlFirstEntrySList

Ordinal 996
Address 0xb9680

RtlFirstFreeAce

Ordinal 997
Address 0x38540

RtlFlsAlloc

Ordinal 998
Address 0x5c740

RtlFlsFree

Ordinal 999
Address 0x5d1c0

RtlFlushHeaps

Ordinal 1000
Address 0xcdfe0

RtlFlushSecureMemoryCache

Ordinal 1001
Address 0xd54c0

RtlFormatCurrentUserKeyPath

Ordinal 1002
Address 0x39c20

RtlFormatMessage

Ordinal 1003
Address 0xd6a60

RtlFormatMessageEx

Ordinal 1004
Address 0x61f00

RtlFreeActivationContextStack

Ordinal 1005
Address 0x62570

RtlFreeAnsiString

Ordinal 1006
Address 0x3d4f0

RtlFreeHandle

Ordinal 1007
Address 0x64b70

RtlFreeHeap

Ordinal 1008
Address 0x3f240

RtlFreeMemoryBlockLookaside

Ordinal 1009
Address 0x114110

RtlFreeOemString

Ordinal 1010
Address 0xc5720

RtlFreeSid

Ordinal 1011
Address 0x67d90

RtlFreeThreadActivationContextStack

Ordinal 1012
Address 0x624c0

RtlFreeUnicodeString

Ordinal 1013
Address 0x3d4f0

RtlFreeUserStack

Ordinal 1014
Address 0x28060

RtlGUIDFromString

Ordinal 1015
Address 0xd6b50

RtlGenerate8dot3Name

Ordinal 1016
Address 0xd6e10

RtlGetAce

Ordinal 1017
Address 0x669e0

RtlGetActiveActivationContext

Ordinal 1018
Address 0x50440

RtlGetActiveConsoleId

Ordinal 1019
Address 0x68240

RtlGetAppContainerNamedObjectPath

Ordinal 1020
Address 0x64910

RtlGetAppContainerParent

Ordinal 1021
Address 0xbeb50

RtlGetAppContainerSidType

Ordinal 1022
Address 0x21010

RtlGetCallersAddress

Ordinal 1023
Address 0xc7f30

RtlGetCompressionWorkSpaceSize

Ordinal 1024
Address 0xd1000

RtlGetConsoleSessionForegroundProcessId

Ordinal 1025
Address 0xd7500

RtlGetControlSecurityDescriptor

Ordinal 1026
Address 0x690c0

RtlGetCriticalSectionRecursionCount

Ordinal 1027
Address 0xc23d0

RtlGetCurrentDirectory_U

Ordinal 1028
Address 0x245b0

RtlGetCurrentPeb

Ordinal 1029
Address 0xd7530

RtlGetCurrentProcessorNumber

Ordinal 1030
Address 0x64720

RtlGetCurrentProcessorNumberEx

Ordinal 1031
Address 0x67d60

RtlGetCurrentServiceSessionId

Ordinal 1032
Address 0x3fa60

RtlGetCurrentTransaction

Ordinal 1033
Address 0x5f090

RtlGetDaclSecurityDescriptor

Ordinal 1034
Address 0x689d0

RtlGetDeviceFamilyInfoEnum

Ordinal 1035
Address 0x68e60

RtlGetElementGenericTable

Ordinal 1036
Address 0xd50e0

RtlGetElementGenericTableAvl

Ordinal 1037
Address 0xd5290

RtlGetEnabledExtendedFeatures

Ordinal 1038
Address 0x69b30

RtlGetExePath

Ordinal 1039
Address 0x28630

RtlGetExtendedContextLength

Ordinal 1040
Address 0xd2010

RtlGetExtendedFeaturesMask

Ordinal 1041
Address 0xd2080

RtlGetFileMUIPath

Ordinal 1042
Address 0xc90f0

RtlGetFrame

Ordinal 1043
Address 0xaad90

RtlGetFullPathName_U

Ordinal 1044
Address 0x69e50

RtlGetFullPathName_UEx

Ordinal 1045
Address 0x4ffd0

RtlGetFullPathName_UstrEx

Ordinal 1046
Address 0x45210

RtlGetGroupSecurityDescriptor

Ordinal 1047
Address 0x6a130

RtlGetIntegerAtom

Ordinal 1048
Address 0x63f50

RtlGetInterruptTimePrecise

Ordinal 1049
Address 0xbd460

RtlGetLastNtStatus

Ordinal 1050
Address 0xd7620

RtlGetLastWin32Error

Ordinal 1051
Address 0xd7640

RtlGetLengthWithoutLastFullDosOrNtPathElement

Ordinal 1052
Address 0x652a0

RtlGetLengthWithoutTrailingPathSeperators

Ordinal 1053
Address 0xa9f40

RtlGetLocaleFileMappingAddress

Ordinal 1054
Address 0x56300

RtlGetLongestNtPathLength

Ordinal 1055
Address 0x28100

RtlGetNativeSystemInformation

Ordinal 1056
Address 0x704e0

RtlGetNextEntryHashTable

Ordinal 1057
Address 0xd19d0

RtlGetNtGlobalFlags

Ordinal 1058
Address 0xc89c0

RtlGetNtProductType

Ordinal 1059
Address 0x30f10

RtlGetNtSystemRoot

Ordinal 1060
Address 0x38e40

RtlGetNtVersionNumbers

Ordinal 1061
Address 0x69690

RtlGetOwnerSecurityDescriptor

Ordinal 1062
Address 0x68380

RtlGetParentLocaleName

Ordinal 1063
Address 0x51c30

RtlGetProcessHeaps

Ordinal 1064
Address 0xce000

RtlGetProcessPreferredUILanguages

Ordinal 1065
Address 0xc9a30

RtlGetProductInfo

Ordinal 1066
Address 0x6a490

RtlGetSaclSecurityDescriptor

Ordinal 1067
Address 0x68960

RtlGetSearchPath

Ordinal 1068
Address 0x27f80

RtlGetSecurityDescriptorRMControl

Ordinal 1069
Address 0xbec00

RtlGetSessionProperties

Ordinal 1070
Address 0xbec30

RtlGetSetBootStatusData

Ordinal 1071
Address 0xc84f0

RtlGetSuiteMask

Ordinal 1072
Address 0x30f50

RtlGetSystemBootStatus

Ordinal 1073
Address 0x85520

RtlGetSystemBootStatusEx

Ordinal 1074
Address 0x85560

RtlGetSystemPreferredUILanguages

Ordinal 1075
Address 0xc9b00

RtlGetSystemTimePrecise

Ordinal 1076
Address 0x23fe0

RtlGetThreadErrorMode

Ordinal 1077
Address 0xaad30

RtlGetThreadLangIdByIndex

Ordinal 1078
Address 0xc9f60

RtlGetThreadPreferredUILanguages

Ordinal 1079
Address 0x51290

RtlGetThreadWorkOnBehalfTicket

Ordinal 1080
Address 0x65530

RtlGetTokenNamedObjectPath

Ordinal 1081
Address 0xbecc0

RtlGetUILanguageInfo

Ordinal 1082
Address 0xca030

RtlGetUnloadEventTrace

Ordinal 1083
Address 0xabd80

RtlGetUnloadEventTraceEx

Ordinal 1084
Address 0xabd90

RtlGetUserInfoHeap

Ordinal 1085
Address 0x5fb90

RtlGetUserPreferredUILanguages

Ordinal 1086
Address 0x254c0

RtlGetVersion

Ordinal 1087
Address 0x30870

RtlGuardCheckLongJumpTarget

Ordinal 1088
Address 0x281f0

RtlHashUnicodeString

Ordinal 1089
Address 0x39db0

RtlHeapTrkInitialize

Ordinal 1090
Address 0xd8640

RtlIdentifierAuthoritySid

Ordinal 1091
Address 0x6a370

RtlIdnToAscii

Ordinal 1092
Address 0x54190

RtlIdnToNameprepUnicode

Ordinal 1093
Address 0xd97a0

RtlIdnToUnicode

Ordinal 1094
Address 0x249c0

RtlImageDirectoryEntryToData

Ordinal 1095
Address 0x4a510

RtlImageNtHeader

Ordinal 1096
Address 0x47120

RtlImageNtHeaderEx

Ordinal 1097
Address 0x49da0

RtlImageRvaToSection

Ordinal 1098
Address 0xc4e00

RtlImageRvaToVa

Ordinal 1099
Address 0xc4e50

RtlImpersonateSelf

Ordinal 1100
Address 0x67f20

RtlImpersonateSelfEx

Ordinal 1101
Address 0x67f40

RtlIncrementCorrelationVector

Ordinal 1102
Address 0xd6710

RtlInitAnsiString

Ordinal 1103
Address 0x70d40

RtlInitAnsiStringEx

Ordinal 1104
Address 0x5f7c0

RtlInitBarrier

Ordinal 1105
Address 0xc7e30

RtlInitCodePageTable

Ordinal 1106
Address 0xbcc30

RtlInitEnumerationHashTable

Ordinal 1107
Address 0xd1a20

RtlInitMemoryStream

Ordinal 1108
Address 0xc27e0

RtlInitNlsTables

Ordinal 1109
Address 0xbcce0

RtlInitOutOfProcessMemoryStream

Ordinal 1110
Address 0xc27e0

RtlInitString

Ordinal 1111
Address 0x70d00

RtlInitStringEx

Ordinal 1112
Address 0xc5d70

RtlInitStrongEnumerationHashTable

Ordinal 1113
Address 0xd1a80

RtlInitUnicodeString

Ordinal 1114
Address 0x70d80

RtlInitUnicodeStringEx

Ordinal 1115
Address 0x4fde0

RtlInitWeakEnumerationHashTable

Ordinal 1116
Address 0xd1ac0

RtlInitializeAtomPackage

Ordinal 1117
Address 0xaf720

RtlInitializeBitMap

Ordinal 1118
Address 0x6a6d0

RtlInitializeConditionVariable

Ordinal 1119
Address 0x62af0

RtlInitializeContext

Ordinal 1120
Address 0xda290

RtlInitializeCorrelationVector

Ordinal 1121
Address 0xd67e0

RtlInitializeCriticalSection

Ordinal 1122
Address 0x5ba00

RtlInitializeCriticalSectionAndSpinCount

Ordinal 1123
Address 0x5d360

RtlInitializeCriticalSectionEx

Ordinal 1124
Address 0x305f0

RtlInitializeExceptionChain

Ordinal 1125
Address 0x64a60

RtlInitializeExtendedContext

Ordinal 1126
Address 0xd20a0

RtlInitializeGenericTable

Ordinal 1127
Address 0x68e20

RtlInitializeGenericTableAvl

Ordinal 1128
Address 0x283b0

RtlInitializeHandleTable

Ordinal 1129
Address 0x68ab0

RtlInitializeNtUserPfn

Ordinal 1130
Address 0x70580

RtlInitializeRXact

Ordinal 1131
Address 0xbe0b0

RtlInitializeResource

Ordinal 1132
Address 0x30440

RtlInitializeSListHead

Ordinal 1133
Address 0x655f0

RtlInitializeSRWLock

Ordinal 1134
Address 0x62af0

RtlInitializeSid

Ordinal 1135
Address 0x2af60

RtlInitializeSidEx

Ordinal 1136
Address 0x28ca0

RtlInsertElementGenericTable

Ordinal 1137
Address 0x246d0

RtlInsertElementGenericTableAvl

Ordinal 1138
Address 0x21b40

RtlInsertElementGenericTableFull

Ordinal 1139
Address 0x24710

RtlInsertElementGenericTableFullAvl

Ordinal 1140
Address 0x21b80

RtlInsertEntryHashTable

Ordinal 1141
Address 0xd1ad0

RtlInt64ToUnicodeString

Ordinal 1142
Address 0xc8060

RtlIntegerToChar

Ordinal 1143
Address 0x51040

RtlIntegerToUnicodeString

Ordinal 1144
Address 0x50fd0

RtlInterlockedClearBitRun

Ordinal 1145
Address 0xc7040

RtlInterlockedCompareExchange64

Ordinal 1146
Address 0x89b90

RtlInterlockedFlushSList

Ordinal 1147
Address 0x60e20

RtlInterlockedPopEntrySList

Ordinal 1148
Address 0x41310

RtlInterlockedPushEntrySList

Ordinal 1149
Address 0x41160

RtlInterlockedPushListSListEx

Ordinal 1150
Address 0xda6b0

RtlInterlockedSetBitRun

Ordinal 1151
Address 0xc70f0

RtlIoDecodeMemIoResource

Ordinal 1152
Address 0xcdb10

RtlIoEncodeMemIoResource

Ordinal 1153
Address 0xcdbd0

RtlIpv4AddressToStringA

Ordinal 1154
Address 0x27080

RtlIpv4AddressToStringExA

Ordinal 1155
Address 0xd5f60

RtlIpv4AddressToStringExW

Ordinal 1156
Address 0x677f0

RtlIpv4AddressToStringW

Ordinal 1157
Address 0x67880

RtlIpv4StringToAddressA

Ordinal 1158
Address 0x24330

RtlIpv4StringToAddressExA

Ordinal 1159
Address 0x242e0

RtlIpv4StringToAddressExW

Ordinal 1160
Address 0x5d3b0

RtlIpv4StringToAddressW

Ordinal 1161
Address 0x5d410

RtlIpv6AddressToStringA

Ordinal 1162
Address 0x685a0

RtlIpv6AddressToStringExA

Ordinal 1163
Address 0xd6010

RtlIpv6AddressToStringExW

Ordinal 1164
Address 0xd6140

RtlIpv6AddressToStringW

Ordinal 1165
Address 0xd6250

RtlIpv6StringToAddressA

Ordinal 1166
Address 0x23b80

RtlIpv6StringToAddressExA

Ordinal 1167
Address 0x23b10

RtlIpv6StringToAddressExW

Ordinal 1168
Address 0x5ba20

RtlIpv6StringToAddressW

Ordinal 1169
Address 0x5ba90

RtlIsActivationContextActive

Ordinal 1170
Address 0xb8880

RtlIsCapabilitySid

Ordinal 1171
Address 0x28c60

RtlIsCloudFilesPlaceholder

Ordinal 1172
Address 0x85a10

RtlIsCriticalSectionLocked

Ordinal 1173
Address 0xc2400

RtlIsCriticalSectionLockedByThread

Ordinal 1174
Address 0x500a0

RtlIsCurrentProcess

Ordinal 1175
Address 0x85ad0

RtlIsCurrentThread

Ordinal 1176
Address 0x85b00

RtlIsCurrentThreadAttachExempt

Ordinal 1177
Address 0xb0320

RtlIsDosDeviceName_U

Ordinal 1178
Address 0x4fdb0

RtlIsElevatedRid

Ordinal 1179
Address 0xbecf0

RtlIsGenericTableEmpty

Ordinal 1180
Address 0xd5180

RtlIsGenericTableEmptyAvl

Ordinal 1181
Address 0xd5380

RtlIsMultiSessionSku

Ordinal 1182
Address 0x56180

RtlIsMultiUsersInSessionSku

Ordinal 1183
Address 0xbed50

RtlIsNameInExpression

Ordinal 1184
Address 0xda8e0

RtlIsNameLegalDOS8Dot3

Ordinal 1185
Address 0xd7260

RtlIsNonEmptyDirectoryReparsePointAllowed

Ordinal 1186
Address 0xda7a0

RtlIsNormalizedString

Ordinal 1187
Address 0xdc980

RtlIsPackageSid

Ordinal 1188
Address 0x21070

RtlIsParentOfChildAppContainer

Ordinal 1189
Address 0xbed60

RtlIsPartialPlaceholder

Ordinal 1190
Address 0x6a770

RtlIsPartialPlaceholderFileHandle

Ordinal 1191
Address 0xda6d0

RtlIsPartialPlaceholderFileInfo

Ordinal 1192
Address 0xda710

RtlIsProcessorFeaturePresent

Ordinal 1193
Address 0x627e0

RtlIsStateSeparationEnabled

Ordinal 1194
Address 0x85480

RtlIsTextUnicode

Ordinal 1195
Address 0x5c200

RtlIsThreadWithinLoaderCallout

Ordinal 1196
Address 0x69f90

RtlIsUntrustedObject

Ordinal 1197
Address 0xbedd0

RtlIsValidHandle

Ordinal 1198
Address 0x5f110

RtlIsValidIndexHandle

Ordinal 1199
Address 0x21830

RtlIsValidLocaleName

Ordinal 1200
Address 0xd7680

RtlIsValidProcessTrustLabelSid

Ordinal 1201
Address 0xbef00

RtlKnownExceptionFilter

Ordinal 1202
Address 0xdcaf0

RtlLCIDToCultureName

Ordinal 1203
Address 0x52910

RtlLargeIntegerAdd

Ordinal 1204
Address 0x898d0

RtlLargeIntegerArithmeticShift

Ordinal 1205
Address 0x89ae0

RtlLargeIntegerDivide

Ordinal 1206
Address 0xdcfd0

RtlLargeIntegerNegate

Ordinal 1207
Address 0x89b10

RtlLargeIntegerShiftLeft

Ordinal 1208
Address 0x89a80

RtlLargeIntegerShiftRight

Ordinal 1209
Address 0x89ab0

RtlLargeIntegerSubtract

Ordinal 1210
Address 0x89b30

RtlLargeIntegerToChar

Ordinal 1211
Address 0xc80e0

RtlLcidToLocaleName

Ordinal 1212
Address 0x534b0

RtlLeaveCriticalSection

Ordinal 1213
Address 0x4a190

RtlLengthRequiredSid

Ordinal 1214
Address 0x69770

RtlLengthSecurityDescriptor

Ordinal 1215
Address 0x65710

RtlLengthSid

Ordinal 1216
Address 0x65460

RtlLengthSidAsUnicodeString

Ordinal 1217
Address 0x397e0

RtlLoadString

Ordinal 1218
Address 0x5f620

RtlLocalTimeToSystemTime

Ordinal 1219
Address 0xbd610

RtlLocaleNameToLcid

Ordinal 1220
Address 0x532f0

RtlLocateExtendedFeature2

Ordinal 1221
Address 0xd21f0

RtlLocateExtendedFeature

Ordinal 1222
Address 0xd2330

RtlLocateLegacyContext

Ordinal 1223
Address 0xd2360

RtlLockBootStatusData

Ordinal 1224
Address 0xc85f0

RtlLockCurrentThread

Ordinal 1225
Address 0xdd070

RtlLockHeap

Ordinal 1226
Address 0x3d520

RtlLockMemoryBlockLookaside

Ordinal 1227
Address 0xc50a0

RtlLockMemoryStreamRegion

Ordinal 1228
Address 0xaf740

RtlLockMemoryZone

Ordinal 1229
Address 0x260b0

RtlLockModuleSection

Ordinal 1230
Address 0x26190

RtlLogStackBackTrace

Ordinal 1231
Address 0xdd270

RtlLookupAtomInAtomTable

Ordinal 1232
Address 0x21630

RtlLookupElementGenericTable

Ordinal 1233
Address 0x24880

RtlLookupElementGenericTableAvl

Ordinal 1234
Address 0x21c80

RtlLookupElementGenericTableFull

Ordinal 1235
Address 0x248b0

RtlLookupElementGenericTableFullAvl

Ordinal 1236
Address 0x21cb0

RtlLookupEntryHashTable

Ordinal 1237
Address 0xd1b50

RtlLookupFirstMatchingElementGenericTableAvl

Ordinal 1238
Address 0xd53a0

RtlMakeSelfRelativeSD

Ordinal 1239
Address 0x63150

RtlMapGenericMask

Ordinal 1240
Address 0x2b050

RtlMapSecurityErrorToNtStatus

Ordinal 1241
Address 0xbef70

RtlMoveMemory

Ordinal 1242
Address 0x89640

RtlMultiAppendUnicodeStringBuffer

Ordinal 1243
Address 0x5f810

RtlMultiByteToUnicodeN

Ordinal 1244
Address 0x60990

RtlMultiByteToUnicodeSize

Ordinal 1245
Address 0x267c0

RtlMultipleAllocateHeap

Ordinal 1246
Address 0xce4a0

RtlMultipleFreeHeap

Ordinal 1247
Address 0xce4e0

RtlNewInstanceSecurityObject

Ordinal 1248
Address 0xb0e70

RtlNewSecurityGrantedAccess

Ordinal 1249
Address 0xb0f30

RtlNewSecurityObject

Ordinal 1250
Address 0x28a10

RtlNewSecurityObjectEx

Ordinal 1251
Address 0x290b0

RtlNewSecurityObjectWithMultipleInheritance

Ordinal 1252
Address 0xb1030

RtlNormalizeProcessParams

Ordinal 1253
Address 0xbaed0

RtlNormalizeString

Ordinal 1254
Address 0xdc9f0

RtlNtPathNameToDosPathName

Ordinal 1255
Address 0x22e40

RtlNtStatusToDosError

Ordinal 1256
Address 0x59d00

RtlNtStatusToDosErrorNoTeb

Ordinal 1257
Address 0x63e50

RtlNumberGenericTableElements

Ordinal 1258
Address 0x28020

RtlNumberGenericTableElementsAvl

Ordinal 1259
Address 0x28a70

RtlNumberOfClearBits

Ordinal 1260
Address 0xc7190

RtlNumberOfClearBitsInRange

Ordinal 1261
Address 0xc71b0

RtlNumberOfSetBits

Ordinal 1262
Address 0xc71e0

RtlNumberOfSetBitsInRange

Ordinal 1263
Address 0xc7330

RtlNumberOfSetBitsUlongPtr

Ordinal 1264
Address 0xdda20

RtlOemStringToUnicodeSize

Ordinal 1265
Address 0xc5bb0

RtlOemStringToUnicodeString

Ordinal 1266
Address 0x27690

RtlOemToUnicodeN

Ordinal 1267
Address 0x27770

RtlOpenCurrentUser

Ordinal 1268
Address 0x54cc0

RtlOsDeploymentState

Ordinal 1269
Address 0xdda70

RtlOwnerAcesPresent

Ordinal 1270
Address 0xbf060

RtlPcToFileHeader

Ordinal 1271
Address 0x49110

RtlPinAtomInAtomTable

Ordinal 1272
Address 0xc4c30

RtlPopFrame

Ordinal 1273
Address 0xaadb0

RtlPrefixString

Ordinal 1274
Address 0x684f0

RtlPrefixUnicodeString

Ordinal 1275
Address 0x38e60

RtlProcessFlsData

Ordinal 1276
Address 0x60e60

RtlProtectHeap

Ordinal 1277
Address 0x25a60

RtlPublishWnfStateData

Ordinal 1278
Address 0x6a040

RtlPushFrame

Ordinal 1279
Address 0xaade0

RtlQueryActivationContextApplicationSettings

Ordinal 1280
Address 0x64ba0

RtlQueryAtomInAtomTable

Ordinal 1281
Address 0x21180

RtlQueryCriticalSectionOwner

Ordinal 1282
Address 0xc2420

RtlQueryDepthSList

Ordinal 1283
Address 0x64700

RtlQueryDynamicTimeZoneInformation

Ordinal 1284
Address 0xc89d0

RtlQueryElevationFlags

Ordinal 1285
Address 0x69a50

RtlQueryEnvironmentVariable

Ordinal 1286
Address 0x4b6b0

RtlQueryEnvironmentVariable_U

Ordinal 1287
Address 0x5a9d0

RtlQueryHeapInformation

Ordinal 1288
Address 0xce520

RtlQueryImageMitigationPolicy

Ordinal 1289
Address 0x835a0

RtlQueryInformationAcl

Ordinal 1290
Address 0x6a1f0

RtlQueryInformationActivationContext

Ordinal 1291
Address 0x36580

RtlQueryInformationActiveActivationContext

Ordinal 1292
Address 0x32e30

RtlQueryInterfaceMemoryStream

Ordinal 1293
Address 0xaf780

RtlQueryModuleInformation

Ordinal 1294
Address 0xbb840

RtlQueryPackageClaims

Ordinal 1295
Address 0x633e0

RtlQueryPackageIdentity

Ordinal 1296
Address 0x63350

RtlQueryPackageIdentityEx

Ordinal 1297
Address 0x63390

RtlQueryPerformanceCounter

Ordinal 1298
Address 0x5bdd0

RtlQueryPerformanceFrequency

Ordinal 1299
Address 0x60330

RtlQueryProcessBackTraceInformation

Ordinal 1300
Address 0xb15d0

RtlQueryProcessDebugInformation

Ordinal 1301
Address 0xb1710

RtlQueryProcessHeapInformation

Ordinal 1302
Address 0xb1b30

RtlQueryProcessLockInformation

Ordinal 1303
Address 0xb1e20

RtlQueryProtectedPolicy

Ordinal 1304
Address 0x27470

RtlQueryRegistryValues

Ordinal 1305
Address 0xc89f0

RtlQueryRegistryValuesEx

Ordinal 1306
Address 0xc8a20

RtlQueryResourcePolicy

Ordinal 1307
Address 0x307d0

RtlQuerySecurityObject

Ordinal 1308
Address 0xb1060

RtlQueryTagHeap

Ordinal 1309
Address 0xce650

RtlQueryThreadPlaceholderCompatibilityMode

Ordinal 1310
Address 0x85a40

RtlQueryThreadProfiling

Ordinal 1311
Address 0xa99b0

RtlQueryTimeZoneInformation

Ordinal 1312
Address 0xc8a50

RtlQueryUnbiasedInterruptTime

Ordinal 1313
Address 0x6e2c0

RtlQueryValidationRunlevel

Ordinal 1314
Address 0xddb40

RtlQueryWnfMetaNotification

Ordinal 1315
Address 0xb6d40

RtlQueryWnfStateData

Ordinal 1316
Address 0x69c40

RtlQueryWnfStateDataWithExplicitScope

Ordinal 1317
Address 0xb6d90

RtlQueueApcWow64Thread

Ordinal 1318
Address 0xb4c10

RtlQueueWorkItem

Ordinal 1319
Address 0x4f5a0

RtlRaiseException

Ordinal 1320
Address 0x89f00

RtlRaiseStatus

Ordinal 1321
Address 0x89f40

RtlRandom

Ordinal 1322
Address 0x4cb00

RtlRandomEx

Ordinal 1323
Address 0x4cb00

RtlRbInsertNodeEx

Ordinal 1324
Address 0x47ec0

RtlRbRemoveNode

Ordinal 1325
Address 0x57770

RtlReAllocateHeap

Ordinal 1326
Address 0x3d9f0

RtlReadMemoryStream

Ordinal 1327
Address 0xaf750

RtlReadOutOfProcessMemoryStream

Ordinal 1328
Address 0xaf750

RtlReadThreadProfilingData

Ordinal 1329
Address 0xa99d0

RtlRealPredecessor

Ordinal 1330
Address 0xd4f90

RtlRealSuccessor

Ordinal 1331
Address 0xd4fd0

RtlRegisterForWnfMetaNotification

Ordinal 1332
Address 0xb6e60

RtlRegisterSecureMemoryCacheCallback

Ordinal 1333
Address 0xd5520

RtlRegisterThreadWithCsrss

Ordinal 1334
Address 0x32b80

RtlRegisterWait

Ordinal 1335
Address 0x31fe0

RtlReleaseActivationContext

Ordinal 1336
Address 0x46bf0

RtlReleaseMemoryStream

Ordinal 1337
Address 0xaf720

RtlReleasePath

Ordinal 1338
Address 0x46cb0

RtlReleasePebLock

Ordinal 1339
Address 0x4c1c0

RtlReleasePrivilege

Ordinal 1340
Address 0xbf080

RtlReleaseRelativeName

Ordinal 1341
Address 0x64e10

RtlReleaseResource

Ordinal 1342
Address 0x5efe0

RtlReleaseSRWLockExclusive

Ordinal 1343
Address 0x46b90

RtlReleaseSRWLockShared

Ordinal 1344
Address 0x49ed0

RtlRemoteCall

Ordinal 1345
Address 0xda350

RtlRemoveEntryHashTable

Ordinal 1346
Address 0xd1ba0

RtlRemovePrivileges

Ordinal 1347
Address 0xbf110

RtlRemoveVectoredContinueHandler

Ordinal 1348
Address 0xb2ed0

RtlRemoveVectoredExceptionHandler

Ordinal 1349
Address 0x28450

RtlReplaceSidInSd

Ordinal 1350
Address 0xbf240

RtlReplaceSystemDirectoryInPath

Ordinal 1351
Address 0x64130

RtlReportException

Ordinal 1352
Address 0xb50b0

RtlReportExceptionEx

Ordinal 1353
Address 0xb5130

RtlReportSilentProcessExit

Ordinal 1354
Address 0x679e0

RtlReportSqmEscalation

Ordinal 1355
Address 0xb5730

RtlResetMemoryBlockLookaside

Ordinal 1356
Address 0xc5110

RtlResetMemoryZone

Ordinal 1357
Address 0xc5320

RtlResetNtUserPfn

Ordinal 1358
Address 0x70690

RtlResetRtlTranslations

Ordinal 1359
Address 0xbcd30

RtlRestoreBootStatusDefaults

Ordinal 1360
Address 0xc8610

RtlRestoreLastWin32Error

Ordinal 1361
Address 0x59c90

RtlRestoreSystemBootStatusDefaults

Ordinal 1362
Address 0x85580

RtlRetrieveNtUserPfn

Ordinal 1363
Address 0x70760

RtlRevertMemoryStream

Ordinal 1364
Address 0xaf760

RtlRunDecodeUnicodeString

Ordinal 1365
Address 0xbf530

RtlRunEncodeUnicodeString

Ordinal 1366
Address 0xbf580

RtlRunOnceBeginInitialize

Ordinal 1367
Address 0x314f0

RtlRunOnceComplete

Ordinal 1368
Address 0x504e0

RtlRunOnceExecuteOnce

Ordinal 1369
Address 0x4cbd0

RtlRunOnceInitialize

Ordinal 1370
Address 0x62af0

RtlSecondsSince1970ToTime

Ordinal 1371
Address 0xbd670

RtlSecondsSince1980ToTime

Ordinal 1372
Address 0xbd6b0

RtlSeekMemoryStream

Ordinal 1373
Address 0xaf770

RtlSelfRelativeToAbsoluteSD2

Ordinal 1374
Address 0xbe3a0

RtlSelfRelativeToAbsoluteSD

Ordinal 1375
Address 0xbe440

RtlSendMsgToSm

Ordinal 1376
Address 0xd12f0

RtlSetAllBits

Ordinal 1377
Address 0xc7520

RtlSetAttributesSecurityDescriptor

Ordinal 1378
Address 0xbf600

RtlSetBit

Ordinal 1379
Address 0xc7550

RtlSetBits

Ordinal 1380
Address 0x5cfb0

RtlSetControlSecurityDescriptor

Ordinal 1381
Address 0x6a710

RtlSetCriticalSectionSpinCount

Ordinal 1382
Address 0x654b0

RtlSetCurrentDirectory_U

Ordinal 1383
Address 0x243f0

RtlSetCurrentEnvironment

Ordinal 1384
Address 0xaa740

RtlSetCurrentTransaction

Ordinal 1385
Address 0x5e310

RtlSetDaclSecurityDescriptor

Ordinal 1386
Address 0x29040

RtlSetDynamicTimeZoneInformation

Ordinal 1387
Address 0xc8a70

RtlSetEnvironmentStrings

Ordinal 1388
Address 0xaa7f0

RtlSetEnvironmentVar

Ordinal 1389
Address 0x5aa80

RtlSetEnvironmentVariable

Ordinal 1390
Address 0x5aa40

RtlSetExtendedFeaturesMask

Ordinal 1391
Address 0xd23a0

RtlSetGroupSecurityDescriptor

Ordinal 1392
Address 0x2b8f0

RtlSetHeapInformation

Ordinal 1393
Address 0x69f00

RtlSetImageMitigationPolicy

Ordinal 1394
Address 0x84050

RtlSetInformationAcl

Ordinal 1395
Address 0xc3380

RtlSetIoCompletionCallback

Ordinal 1396
Address 0x6df80

RtlSetLastWin32Error

Ordinal 1397
Address 0x59c90

RtlSetLastWin32ErrorAndNtStatusFromNtStatus

Ordinal 1398
Address 0x59c70

RtlSetMemoryStreamSize

Ordinal 1399
Address 0xaf780

RtlSetOwnerSecurityDescriptor

Ordinal 1400
Address 0x2b950

RtlSetPortableOperatingSystem

Ordinal 1401
Address 0xc88a0

RtlSetProcessDebugInformation

Ordinal 1402
Address 0xb20c0

RtlSetProcessIsCritical

Ordinal 1403
Address 0xd7540

RtlSetProcessPreferredUILanguages

Ordinal 1404
Address 0xca440

RtlSetProtectedPolicy

Ordinal 1405
Address 0x67c20

RtlSetProxiedProcessId

Ordinal 1406
Address 0x85a60

RtlSetSaclSecurityDescriptor

Ordinal 1407
Address 0x66060

RtlSetSearchPathMode

Ordinal 1408
Address 0xb7c90

RtlSetSecurityDescriptorRMControl

Ordinal 1409
Address 0xbf640

RtlSetSecurityObject

Ordinal 1410
Address 0xb12b0

RtlSetSecurityObjectEx

Ordinal 1411
Address 0xb12e0

RtlSetSystemBootStatus

Ordinal 1412
Address 0x855c0

RtlSetSystemBootStatusEx

Ordinal 1413
Address 0x85600

RtlSetThreadErrorMode

Ordinal 1414
Address 0x6a270

RtlSetThreadIsCritical

Ordinal 1415
Address 0xd75b0

RtlSetThreadPlaceholderCompatibilityMode

Ordinal 1416
Address 0x85a90

RtlSetThreadPoolStartFunc

Ordinal 1417
Address 0x6a7f0

RtlSetThreadPreferredUILanguages

Ordinal 1418
Address 0x53af0

RtlSetThreadSubProcessTag

Ordinal 1419
Address 0x31e90

RtlSetThreadWorkOnBehalfTicket

Ordinal 1420
Address 0x351e0

RtlSetTimeZoneInformation

Ordinal 1421
Address 0xc8a90

RtlSetTimer

Ordinal 1422
Address 0xf5350

RtlSetUnhandledExceptionFilter

Ordinal 1423
Address 0x60dc0

RtlSetUserCallbackExceptionFilter

Ordinal 1424
Address 0x60da0

RtlSetUserFlagsHeap

Ordinal 1425
Address 0xce840

RtlSetUserValueHeap

Ordinal 1426
Address 0x5fe70

RtlSidDominates

Ordinal 1427
Address 0x28cf0

RtlSidDominatesForTrust

Ordinal 1428
Address 0x2b8a0

RtlSidEqualLevel

Ordinal 1429
Address 0xbf680

RtlSidHashInitialize

Ordinal 1430
Address 0xbf710

RtlSidHashLookup

Ordinal 1431
Address 0xbf7a0

RtlSidIsHigherLevel

Ordinal 1432
Address 0xbf8b0

RtlSizeHeap

Ordinal 1433
Address 0x3ef40

RtlSleepConditionVariableCS

Ordinal 1434
Address 0xd9cf0

RtlSleepConditionVariableSRW

Ordinal 1435
Address 0xd9e10

RtlSplay

Ordinal 1436
Address 0x68260

RtlStartRXact

Ordinal 1437
Address 0xbe340

RtlStatMemoryStream

Ordinal 1438
Address 0xaf780

RtlStringFromGUID

Ordinal 1439
Address 0x68d50

RtlStringFromGUIDEx

Ordinal 1440
Address 0x68d70

RtlStronglyEnumerateEntryHashTable

Ordinal 1441
Address 0xd1c00

RtlSubAuthorityCountSid

Ordinal 1442
Address 0x68e00

RtlSubAuthoritySid

Ordinal 1443
Address 0x65e10

RtlSubscribeWnfStateChangeNotification

Ordinal 1444
Address 0x60430

RtlSubtreePredecessor

Ordinal 1445
Address 0x67bf0

RtlSubtreeSuccessor

Ordinal 1446
Address 0xd5010

RtlSwitchedVVI

Ordinal 1447
Address 0x30970

RtlSystemTimeToLocalTime

Ordinal 1448
Address 0xbd6f0

RtlTestAndPublishWnfStateData

Ordinal 1449
Address 0xb6eb0

RtlTestBit

Ordinal 1450
Address 0xc7580

RtlTestProtectedAccess

Ordinal 1451
Address 0xbb010

RtlTimeFieldsToTime

Ordinal 1452
Address 0x5e720

RtlTimeToElapsedTimeFields

Ordinal 1453
Address 0xbd750

RtlTimeToSecondsSince1970

Ordinal 1454
Address 0xbd7c0

RtlTimeToSecondsSince1980

Ordinal 1455
Address 0xbd810

RtlTimeToTimeFields

Ordinal 1456
Address 0x5e8d0

RtlTraceDatabaseAdd

Ordinal 1457
Address 0xddd60

RtlTraceDatabaseCreate

Ordinal 1458
Address 0xdddb0

RtlTraceDatabaseDestroy

Ordinal 1459
Address 0xddeb0

RtlTraceDatabaseEnumerate

Ordinal 1460
Address 0xddf10

RtlTraceDatabaseFind

Ordinal 1461
Address 0xddfb0

RtlTraceDatabaseLock

Ordinal 1462
Address 0xde000

RtlTraceDatabaseUnlock

Ordinal 1463
Address 0xde020

RtlTraceDatabaseValidate

Ordinal 1464
Address 0xde040

RtlTryAcquirePebLock

Ordinal 1465
Address 0x684c0

RtlTryAcquireSRWLockExclusive

Ordinal 1466
Address 0xc2100

RtlTryAcquireSRWLockShared

Ordinal 1467
Address 0x68d10

RtlTryConvertSRWLockSharedToExclusiveOrRelease

Ordinal 1468
Address 0xc2120

RtlTryEnterCriticalSection

Ordinal 1469
Address 0x44120

RtlUTF8ToUnicodeN

Ordinal 1470
Address 0x5b610

RtlUnhandledExceptionFilter2

Ordinal 1471
Address 0xdcb10

RtlUnhandledExceptionFilter

Ordinal 1472
Address 0xdce40

RtlUnicodeStringToAnsiSize

Ordinal 1473
Address 0xc5be0

RtlUnicodeStringToAnsiString

Ordinal 1474
Address 0x5e3a0

RtlUnicodeStringToCountedOemString

Ordinal 1475
Address 0xc5740

RtlUnicodeStringToInteger

Ordinal 1476
Address 0x63ff0

RtlUnicodeStringToOemSize

Ordinal 1477
Address 0xc5be0

RtlUnicodeStringToOemString

Ordinal 1478
Address 0x68780

RtlUnicodeToCustomCPN

Ordinal 1479
Address 0xbce70

RtlUnicodeToMultiByteN

Ordinal 1480
Address 0x5e480

RtlUnicodeToMultiByteSize

Ordinal 1481
Address 0x660d0

RtlUnicodeToOemN

Ordinal 1482
Address 0x68850

RtlUnicodeToUTF8N

Ordinal 1483
Address 0x5beb0

RtlUniform

Ordinal 1484
Address 0xddbd0

RtlUnlockBootStatusData

Ordinal 1485
Address 0xc86c0

RtlUnlockCurrentThread

Ordinal 1486
Address 0xdd110

RtlUnlockHeap

Ordinal 1487
Address 0x3d660

RtlUnlockMemoryBlockLookaside

Ordinal 1488
Address 0xc5160

RtlUnlockMemoryStreamRegion

Ordinal 1489
Address 0xaf740

RtlUnlockMemoryZone

Ordinal 1490
Address 0x263f0

RtlUnlockModuleSection

Ordinal 1491
Address 0x26490

RtlUnsubscribeWnfNotificationWaitForCompletion

Ordinal 1492
Address 0x2cf00

RtlUnsubscribeWnfNotificationWithCompletionCallback

Ordinal 1493
Address 0xb6f40

RtlUnsubscribeWnfStateChangeNotification

Ordinal 1494
Address 0x6a6f0

RtlUnwind

Ordinal 1495
Address 0x61010

RtlUpcaseUnicodeChar

Ordinal 1496
Address 0x50f70

RtlUpcaseUnicodeString

Ordinal 1497
Address 0x51120

RtlUpcaseUnicodeStringToAnsiString

Ordinal 1498
Address 0xc5860

RtlUpcaseUnicodeStringToCountedOemString

Ordinal 1499
Address 0xc5950

RtlUpcaseUnicodeStringToOemString

Ordinal 1500
Address 0xc5a70

RtlUpcaseUnicodeToCustomCPN

Ordinal 1501
Address 0xbcf40

RtlUpcaseUnicodeToMultiByteN

Ordinal 1502
Address 0x62b10

RtlUpcaseUnicodeToOemN

Ordinal 1503
Address 0xbd150

RtlUpdateClonedCriticalSection

Ordinal 1504
Address 0xc2510

RtlUpdateClonedSRWLock

Ordinal 1505
Address 0xc21a0

RtlUpdateTimer

Ordinal 1506
Address 0xf5360

RtlUpperChar

Ordinal 1507
Address 0x68570

RtlUpperString

Ordinal 1508
Address 0xc5d80

RtlUserThreadStart

Ordinal 1509
Address 0x70ca0

RtlValidAcl

Ordinal 1510
Address 0x385a0

RtlValidProcessProtection

Ordinal 1511
Address 0xbb060

RtlValidRelativeSecurityDescriptor

Ordinal 1512
Address 0x69180

RtlValidSecurityDescriptor

Ordinal 1513
Address 0x65140

RtlValidSid

Ordinal 1514
Address 0x39b60

RtlValidateCorrelationVector

Ordinal 1515
Address 0xd6850

RtlValidateHeap

Ordinal 1516
Address 0x22a70

RtlValidateProcessHeaps

Ordinal 1517
Address 0xcec00

RtlValidateUnicodeString

Ordinal 1518
Address 0xc5b80

RtlVerifyVersionInfo

Ordinal 1519
Address 0xd7e60

RtlWaitForWnfMetaNotification

Ordinal 1520
Address 0xb6f90

RtlWaitOnAddress

Ordinal 1521
Address 0xde2f0

RtlWakeAddressAll

Ordinal 1522
Address 0x61ad0

RtlWakeAddressAllNoFence

Ordinal 1523
Address 0xde320

RtlWakeAddressSingle

Ordinal 1524
Address 0xde340

RtlWakeAddressSingleNoFence

Ordinal 1525
Address 0xde370

RtlWakeAllConditionVariable

Ordinal 1526
Address 0x66be0

RtlWakeConditionVariable

Ordinal 1527
Address 0xd9f80

RtlWalkFrameChain

Ordinal 1528
Address 0x20a80

RtlWalkHeap

Ordinal 1529
Address 0x21e60

RtlWeaklyEnumerateEntryHashTable

Ordinal 1530
Address 0xd1c60

RtlWerpReportException

Ordinal 1531
Address 0xb59d0

RtlWnfCompareChangeStamp

Ordinal 1532
Address 0xb7140

RtlWnfDllUnloadCallback

Ordinal 1533
Address 0x28620

RtlWow64CallFunction64

Ordinal 1534
Address 0xb4c20

RtlWow64EnableFsRedirection

Ordinal 1535
Address 0xb4c30

RtlWow64EnableFsRedirectionEx

Ordinal 1536
Address 0x3c780

RtlWow64GetCurrentMachine

Ordinal 1537
Address 0xd23d0

RtlWow64GetEquivalentMachineCHPE

Ordinal 1538
Address 0x85970

RtlWow64GetProcessMachines

Ordinal 1539
Address 0xb4cd0

RtlWow64GetSharedInfoProcess

Ordinal 1540
Address 0x832f0

RtlWow64IsWowGuestMachineSupported

Ordinal 1541
Address 0xb4e30

RtlWow64LogMessageInEventLogger

Ordinal 1542
Address 0xb0350

RtlWow64PopAllCrossProcessWork

Ordinal 1543
Address 0x83350

RtlWow64PopCrossProcessWork

Ordinal 1544
Address 0x83410

RtlWow64PushCrossProcessWork

Ordinal 1545
Address 0x834a0

RtlWriteMemoryStream

Ordinal 1546
Address 0xaf750

RtlWriteRegistryValue

Ordinal 1547
Address 0xc8ab0

RtlZeroHeap

Ordinal 1548
Address 0xd37e0

RtlZeroMemory

Ordinal 1549
Address 0x89610

RtlZombifyActivationContext

Ordinal 1550
Address 0xb8800

RtlpApplyLengthFunction

Ordinal 1551
Address 0x65200

RtlpCheckDynamicTimeZoneInformation

Ordinal 1552
Address 0x66e30

RtlpCleanupRegistryKeys

Ordinal 1553
Address 0xcabf0

RtlpConvertAbsoluteToRelativeSecurityAttribute

Ordinal 1554
Address 0xc3500

RtlpConvertCultureNamesToLCIDs

Ordinal 1555
Address 0xcb070

RtlpConvertLCIDsToCultureNames

Ordinal 1556
Address 0xcb260

RtlpConvertRelativeToAbsoluteSecurityAttribute

Ordinal 1557
Address 0xc38f0

RtlpCreateProcessRegistryInfo

Ordinal 1558
Address 0x4bf60

RtlpEnsureBufferSize

Ordinal 1559
Address 0x5f8e0

RtlpFreezeTimeBias

Ordinal 1560
Address 0x118758

RtlpGetDeviceFamilyInfoEnum

Ordinal 1561
Address 0x68e70

RtlpGetLCIDFromLangInfoNode

Ordinal 1562
Address 0x28990

RtlpGetNameFromLangInfoNode

Ordinal 1563
Address 0x560f0

RtlpGetSystemDefaultUILanguage

Ordinal 1564
Address 0x536f0

RtlpGetUserOrMachineUILanguage4NLS

Ordinal 1565
Address 0xde390

RtlpInitializeLangRegistryInfo

Ordinal 1566
Address 0x57010

RtlpIsQualifiedLanguage

Ordinal 1567
Address 0x27c40

RtlpLoadMachineUIByPolicy

Ordinal 1568
Address 0x28ab0

RtlpLoadUserUIByPolicy

Ordinal 1569
Address 0x569b0

RtlpMergeSecurityAttributeInformation

Ordinal 1570
Address 0xc4140

RtlpMuiFreeLangRegistryInfo

Ordinal 1571
Address 0xde7a0

RtlpMuiRegCreateRegistryInfo

Ordinal 1572
Address 0x56fe0

RtlpMuiRegFreeRegistryInfo

Ordinal 1573
Address 0x55130

RtlpMuiRegLoadRegistryInfo

Ordinal 1574
Address 0x55030

RtlpNotOwnerCriticalSection

Ordinal 1575
Address 0xc2670

RtlpNtCreateKey

Ordinal 1576
Address 0xe0990

RtlpNtEnumerateSubKey

Ordinal 1577
Address 0xe09c0

RtlpNtMakeTemporaryKey

Ordinal 1578
Address 0xe0a80

RtlpNtOpenKey

Ordinal 1579
Address 0xe0a90

RtlpNtQueryValueKey

Ordinal 1580
Address 0xe0ac0

RtlpNtSetValueKey

Ordinal 1581
Address 0xe0b90

RtlpQueryDefaultUILanguage

Ordinal 1582
Address 0x55f70

RtlpQueryProcessDebugInformationRemote

Ordinal 1583
Address 0xb2560

RtlpRefreshCachedUILanguage

Ordinal 1584
Address 0xdf850

RtlpSetInstallLanguage

Ordinal 1585
Address 0xcbf60

RtlpSetPreferredUILanguages

Ordinal 1586
Address 0xcc860

RtlpSetUserPreferredUILanguages

Ordinal 1587
Address 0xcc860

RtlpUnWaitCriticalSection

Ordinal 1588
Address 0x61b00

RtlpVerifyAndCommitUILanguageSettings

Ordinal 1589
Address 0xcd5d0

RtlpWaitForCriticalSection

Ordinal 1590
Address 0xc27e0

RtlxAnsiStringToUnicodeSize

Ordinal 1591
Address 0xc5bb0

RtlxOemStringToUnicodeSize

Ordinal 1592
Address 0xc5bb0

RtlxUnicodeStringToAnsiSize

Ordinal 1593
Address 0xc5be0

RtlxUnicodeStringToOemSize

Ordinal 1594
Address 0xc5be0

SbExecuteProcedure

Ordinal 1595
Address 0xf5870

SbSelectProcedure

Ordinal 1596
Address 0x5b290

ShipAssert

Ordinal 1597
Address 0xb63c0

ShipAssertGetBufferInfo

Ordinal 1598
Address 0xb64a0

ShipAssertMsgA

Ordinal 1599
Address 0xb64d0

ShipAssertMsgW

Ordinal 1600
Address 0xb64d0

TpAllocAlpcCompletion

Ordinal 1601
Address 0x289e0

TpAllocAlpcCompletionEx

Ordinal 1602
Address 0x66790

TpAllocCleanupGroup

Ordinal 1603
Address 0x69850

TpAllocIoCompletion

Ordinal 1604
Address 0x657d0

TpAllocJobNotification

Ordinal 1605
Address 0xf36e0

TpAllocPool

Ordinal 1606
Address 0x31840

TpAllocTimer

Ordinal 1607
Address 0x35bf0

TpAllocWait

Ordinal 1608
Address 0x35e10

TpAllocWork

Ordinal 1609
Address 0x353c0

TpAlpcRegisterCompletionList

Ordinal 1610
Address 0xf35e0

TpAlpcUnregisterCompletionList

Ordinal 1611
Address 0xf3630

TpCallbackDetectedUnrecoverableError

Ordinal 1612
Address 0xf4780

TpCallbackIndependent

Ordinal 1613
Address 0x32f90

TpCallbackLeaveCriticalSectionOnCompletion

Ordinal 1614
Address 0xf47b0

TpCallbackMayRunLong

Ordinal 1615
Address 0x5e220

TpCallbackReleaseMutexOnCompletion

Ordinal 1616
Address 0xf47e0

TpCallbackReleaseSemaphoreOnCompletion

Ordinal 1617
Address 0xf4820

TpCallbackSendAlpcMessageOnCompletion

Ordinal 1618
Address 0x69920

TpCallbackSendPendingAlpcMessage

Ordinal 1619
Address 0xf4860

TpCallbackSetEventOnCompletion

Ordinal 1620
Address 0x28090

TpCallbackUnloadDllOnCompletion

Ordinal 1621
Address 0x68740

TpCancelAsyncIoOperation

Ordinal 1622
Address 0x35600

TpCaptureCaller

Ordinal 1623
Address 0x678c0

TpCheckTerminateWorker

Ordinal 1624
Address 0x656b0

TpDbgDumpHeapUsage

Ordinal 1625
Address 0xf4910

TpDbgSetLogRoutine

Ordinal 1626
Address 0xc27e0

TpDisablePoolCallbackChecks

Ordinal 1627
Address 0x6a960

TpDisassociateCallback

Ordinal 1628
Address 0xf48a0

TpIsTimerSet

Ordinal 1629
Address 0x32e60

TpPostWork

Ordinal 1630
Address 0x354f0

TpQueryPoolStackInformation

Ordinal 1631
Address 0xf3d60

TpReleaseAlpcCompletion

Ordinal 1632
Address 0x66670

TpReleaseCleanupGroup

Ordinal 1633
Address 0x28540

TpReleaseCleanupGroupMembers

Ordinal 1634
Address 0x282c0

TpReleaseIoCompletion

Ordinal 1635
Address 0x68b00

TpReleaseJobNotification

Ordinal 1636
Address 0xf38b0

TpReleasePool

Ordinal 1637
Address 0x26d60

TpReleaseTimer

Ordinal 1638
Address 0x35a00

TpReleaseWait

Ordinal 1639
Address 0x35d20

TpReleaseWork

Ordinal 1640
Address 0x35220

TpSetDefaultPoolMaxThreads

Ordinal 1641
Address 0xf3db0

TpSetDefaultPoolStackInformation

Ordinal 1642
Address 0xf3e80

TpSetPoolMaxThreads

Ordinal 1643
Address 0x31180

TpSetPoolMaxThreadsSoftLimit

Ordinal 1644
Address 0x69640

TpSetPoolMinThreads

Ordinal 1645
Address 0x6a180

TpSetPoolStackInformation

Ordinal 1646
Address 0x6a9a0

TpSetPoolThreadBasePriority

Ordinal 1647
Address 0x285a0

TpSetPoolWorkerThreadIdleTimeout

Ordinal 1648
Address 0x311f0

TpSetTimer

Ordinal 1649
Address 0x359f0

TpSetTimerEx

Ordinal 1650
Address 0x36ba0

TpSetWait

Ordinal 1651
Address 0x35fc0

TpSetWaitEx

Ordinal 1652
Address 0x32ea0

TpSimpleTryPost

Ordinal 1653
Address 0x32660

TpStartAsyncIoOperation

Ordinal 1654
Address 0x36f10

TpTimerOutstandingCallbackCount

Ordinal 1655
Address 0x33210

TpTrimPools

Ordinal 1656
Address 0xf3f80

TpWaitForAlpcCompletion

Ordinal 1657
Address 0x288b0

TpWaitForIoCompletion

Ordinal 1658
Address 0x28820

TpWaitForJobNotification

Ordinal 1659
Address 0xf3920

TpWaitForTimer

Ordinal 1660
Address 0x35b00

TpWaitForWait

Ordinal 1661
Address 0x352b0

TpWaitForWork

Ordinal 1662
Address 0x6a390

VerSetConditionMask

Ordinal 1663
Address 0x635d0

WerReportExceptionWorker

Ordinal 1664
Address 0xb5c80

WerReportSQMEvent

Ordinal 1665
Address 0xb69a0

WinSqmAddToAverageDWORD

Ordinal 1666
Address 0x28c50

WinSqmAddToStream

Ordinal 1667
Address 0x6e700

WinSqmAddToStreamEx

Ordinal 1668
Address 0xb6c80

WinSqmCheckEscalationAddToStreamEx

Ordinal 1669
Address 0xb6c90

WinSqmCheckEscalationSetDWORD64

Ordinal 1670
Address 0xb6c90

WinSqmCheckEscalationSetDWORD

Ordinal 1671
Address 0xb6ca0

WinSqmCheckEscalationSetString

Ordinal 1672
Address 0xb6ca0

WinSqmCommonDatapointDelete

Ordinal 1673
Address 0xb6d00

WinSqmCommonDatapointSetDWORD64

Ordinal 1674
Address 0xb6d10

WinSqmCommonDatapointSetDWORD

Ordinal 1675
Address 0xb6cc0

WinSqmCommonDatapointSetStreamEx

Ordinal 1676
Address 0xb6cb0

WinSqmCommonDatapointSetString

Ordinal 1677
Address 0xb6cc0

WinSqmEndSession

Ordinal 1678
Address 0xc27e0

WinSqmEventEnabled

Ordinal 1679
Address 0x6a7f0

WinSqmEventWrite

Ordinal 1680
Address 0x6ab20

WinSqmGetEscalationRuleStatus

Ordinal 1681
Address 0x6a7f0

WinSqmGetInstrumentationProperty

Ordinal 1682
Address 0xb6cd0

WinSqmIncrementDWORD

Ordinal 1683
Address 0x28c50

WinSqmIsOptedIn

Ordinal 1684
Address 0x30f70

WinSqmIsOptedInEx

Ordinal 1685
Address 0xaf720

WinSqmIsSessionDisabled

Ordinal 1686
Address 0xb6d00

WinSqmSetDWORD64

Ordinal 1687
Address 0x6e700

WinSqmSetDWORD

Ordinal 1688
Address 0x28c50

WinSqmSetEscalationInfo

Ordinal 1689
Address 0xb6d10

WinSqmSetIfMaxDWORD

Ordinal 1690
Address 0x28c50

WinSqmSetIfMinDWORD

Ordinal 1691
Address 0x28c50

WinSqmSetString

Ordinal 1692
Address 0x28c50

WinSqmStartSession

Ordinal 1693
Address 0xb6d20

WinSqmStartSessionForPartner

Ordinal 1694
Address 0xb6d30

WinSqmStartSqmOptinListener

Ordinal 1695
Address 0x30f70

Wow64Transition

Ordinal 1696
Address 0x119218

ZwAcceptConnectPort

Ordinal 1697
Address 0x6e760

ZwAccessCheck

Ordinal 1698
Address 0x6e740

ZwAccessCheckAndAuditAlarm

Ordinal 1699
Address 0x6e9f0

ZwAccessCheckByType

Ordinal 1700
Address 0x6ed90

ZwAccessCheckByTypeAndAuditAlarm

Ordinal 1701
Address 0x6ecf0

ZwAccessCheckByTypeResultList

Ordinal 1702
Address 0x6eda0

ZwAccessCheckByTypeResultListAndAuditAlarm

Ordinal 1703
Address 0x6edb0

ZwAccessCheckByTypeResultListAndAuditAlarmByHandle

Ordinal 1704
Address 0x6edc0

ZwAcquireProcessActivityReference

Ordinal 1705
Address 0x6edd0

ZwAddAtom

Ordinal 1706
Address 0x6ebd0

ZwAddAtomEx

Ordinal 1707
Address 0x6ede0

ZwAddBootEntry

Ordinal 1708
Address 0x6edf0

ZwAddDriverEntry

Ordinal 1709
Address 0x6ee00

ZwAdjustGroupsToken

Ordinal 1710
Address 0x6ee10

ZwAdjustPrivilegesToken

Ordinal 1711
Address 0x6eb70

ZwAdjustTokenClaimsAndDeviceGroups

Ordinal 1712
Address 0x6ee20

ZwAlertResumeThread

Ordinal 1713
Address 0x6ee30

ZwAlertThread

Ordinal 1714
Address 0x6ee40

ZwAlertThreadByThreadId

Ordinal 1715
Address 0x6ee50

ZwAllocateLocallyUniqueId

Ordinal 1716
Address 0x6ee60

ZwAllocateReserveObject

Ordinal 1717
Address 0x6ee70

ZwAllocateUserPhysicalPages

Ordinal 1718
Address 0x6ee80

ZwAllocateUuids

Ordinal 1719
Address 0x6ee90

ZwAllocateVirtualMemory

Ordinal 1720
Address 0x6e8c0

ZwAlpcAcceptConnectPort

Ordinal 1721
Address 0x6eea0

ZwAlpcCancelMessage

Ordinal 1722
Address 0x6eeb0

ZwAlpcConnectPort

Ordinal 1723
Address 0x6eec0

ZwAlpcConnectPortEx

Ordinal 1724
Address 0x6eed0

ZwAlpcCreatePort

Ordinal 1725
Address 0x6eee0

ZwAlpcCreatePortSection

Ordinal 1726
Address 0x6eef0

ZwAlpcCreateResourceReserve

Ordinal 1727
Address 0x6ef00

ZwAlpcCreateSectionView

Ordinal 1728
Address 0x6ef10

ZwAlpcCreateSecurityContext

Ordinal 1729
Address 0x6ef20

ZwAlpcDeletePortSection

Ordinal 1730
Address 0x6ef30

ZwAlpcDeleteResourceReserve

Ordinal 1731
Address 0x6ef40

ZwAlpcDeleteSectionView

Ordinal 1732
Address 0x6ef50

ZwAlpcDeleteSecurityContext

Ordinal 1733
Address 0x6ef60

ZwAlpcDisconnectPort

Ordinal 1734
Address 0x6ef70

ZwAlpcImpersonateClientContainerOfPort

Ordinal 1735
Address 0x6ef80

ZwAlpcImpersonateClientOfPort

Ordinal 1736
Address 0x6ef90

ZwAlpcOpenSenderProcess

Ordinal 1737
Address 0x6efa0

ZwAlpcOpenSenderThread

Ordinal 1738
Address 0x6efb0

ZwAlpcQueryInformation

Ordinal 1739
Address 0x6efc0

ZwAlpcQueryInformationMessage

Ordinal 1740
Address 0x6efd0

ZwAlpcRevokeSecurityContext

Ordinal 1741
Address 0x6efe0

ZwAlpcSendWaitReceivePort

Ordinal 1742
Address 0x6eff0

ZwAlpcSetInformation

Ordinal 1743
Address 0x6f000

ZwApphelpCacheControl

Ordinal 1744
Address 0x6ec20

ZwAreMappedFilesTheSame

Ordinal 1745
Address 0x6f010

ZwAssignProcessToJobObject

Ordinal 1746
Address 0x6f020

ZwAssociateWaitCompletionPacket

Ordinal 1747
Address 0x6f030

ZwCallEnclave

Ordinal 1748
Address 0x6f040

ZwCallbackReturn

Ordinal 1749
Address 0x6e790

ZwCancelIoFile

Ordinal 1750
Address 0x6ed30

ZwCancelIoFileEx

Ordinal 1751
Address 0x6f050

ZwCancelSynchronousIoFile

Ordinal 1752
Address 0x6f060

ZwCancelTimer2

Ordinal 1753
Address 0x6f070

ZwCancelTimer

Ordinal 1754
Address 0x6ed70

ZwCancelWaitCompletionPacket

Ordinal 1755
Address 0x6f080

ZwClearEvent

Ordinal 1756
Address 0x6eb40

ZwClose

Ordinal 1757
Address 0x6e830

ZwCloseObjectAuditAlarm

Ordinal 1758
Address 0x6eb10

ZwCommitComplete

Ordinal 1759
Address 0x6f090

ZwCommitEnlistment

Ordinal 1760
Address 0x6f0a0

ZwCommitRegistryTransaction

Ordinal 1761
Address 0x6f0b0

ZwCommitTransaction

Ordinal 1762
Address 0x6f0c0

ZwCompactKeys

Ordinal 1763
Address 0x6f0d0

ZwCompareObjects

Ordinal 1764
Address 0x6f0e0

ZwCompareSigningLevels

Ordinal 1765
Address 0x6f0f0

ZwCompareTokens

Ordinal 1766
Address 0x6f100

ZwCompleteConnectPort

Ordinal 1767
Address 0x6f110

ZwCompressKey

Ordinal 1768
Address 0x6f120

ZwConnectPort

Ordinal 1769
Address 0x6f130

ZwContinue

Ordinal 1770
Address 0x6eb90

ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter

Ordinal 1771
Address 0x6f140

ZwCreateDebugObject

Ordinal 1772
Address 0x6f150

ZwCreateDirectoryObject

Ordinal 1773
Address 0x6f160

ZwCreateDirectoryObjectEx

Ordinal 1774
Address 0x6f170

ZwCreateEnclave

Ordinal 1775
Address 0x6f180

ZwCreateEnlistment

Ordinal 1776
Address 0x6f190

ZwCreateEvent

Ordinal 1777
Address 0x6ebe0

ZwCreateEventPair

Ordinal 1778
Address 0x6f1a0

ZwCreateFile

Ordinal 1779
Address 0x6ecb0

ZwCreateIRTimer

Ordinal 1780
Address 0x6f1b0

ZwCreateIoCompletion

Ordinal 1781
Address 0x6f1c0

ZwCreateJobObject

Ordinal 1782
Address 0x6f1d0

ZwCreateJobSet

Ordinal 1783
Address 0x6f1e0

ZwCreateKey

Ordinal 1784
Address 0x6e930

ZwCreateKeyTransacted

Ordinal 1785
Address 0x6f1f0

ZwCreateKeyedEvent

Ordinal 1786
Address 0x6f200

ZwCreateLowBoxToken

Ordinal 1787
Address 0x6f210

ZwCreateMailslotFile

Ordinal 1788
Address 0x6f220

ZwCreateMutant

Ordinal 1789
Address 0x6f230

ZwCreateNamedPipeFile

Ordinal 1790
Address 0x6f240

ZwCreatePagingFile

Ordinal 1791
Address 0x6f250

ZwCreatePartition

Ordinal 1792
Address 0x6f260

ZwCreatePort

Ordinal 1793
Address 0x6f270

ZwCreatePrivateNamespace

Ordinal 1794
Address 0x6f280

ZwCreateProcess

Ordinal 1795
Address 0x6f290

ZwCreateProcessEx

Ordinal 1796
Address 0x6ec30

ZwCreateProfile

Ordinal 1797
Address 0x6f2a0

ZwCreateProfileEx

Ordinal 1798
Address 0x6f2b0

ZwCreateRegistryTransaction

Ordinal 1799
Address 0x6f2c0

ZwCreateResourceManager

Ordinal 1800
Address 0x6f2d0

ZwCreateSection

Ordinal 1801
Address 0x6ec00

ZwCreateSemaphore

Ordinal 1802
Address 0x6f2e0

ZwCreateSymbolicLinkObject

Ordinal 1803
Address 0x6f2f0

ZwCreateThread

Ordinal 1804
Address 0x6ec40

ZwCreateThreadEx

Ordinal 1805
Address 0x6f300

ZwCreateTimer2

Ordinal 1806
Address 0x6f320

ZwCreateTimer

Ordinal 1807
Address 0x6f310

ZwCreateToken

Ordinal 1808
Address 0x6f330

ZwCreateTokenEx

Ordinal 1809
Address 0x6f340

ZwCreateTransaction

Ordinal 1810
Address 0x6f350

ZwCreateTransactionManager

Ordinal 1811
Address 0x6f360

ZwCreateUserProcess

Ordinal 1812
Address 0x6f370

ZwCreateWaitCompletionPacket

Ordinal 1813
Address 0x6f380

ZwCreateWaitablePort

Ordinal 1814
Address 0x6f390

ZwCreateWnfStateName

Ordinal 1815
Address 0x6f3a0

ZwCreateWorkerFactory

Ordinal 1816
Address 0x6f3b0

ZwDebugActiveProcess

Ordinal 1817
Address 0x6f3c0

ZwDebugContinue

Ordinal 1818
Address 0x6f3d0

ZwDelayExecution

Ordinal 1819
Address 0x6eaa0

ZwDeleteAtom

Ordinal 1820
Address 0x6f3e0

ZwDeleteBootEntry

Ordinal 1821
Address 0x6f3f0

ZwDeleteDriverEntry

Ordinal 1822
Address 0x6f400

ZwDeleteFile

Ordinal 1823
Address 0x6f410

ZwDeleteKey

Ordinal 1824
Address 0x6f420

ZwDeleteObjectAuditAlarm

Ordinal 1825
Address 0x6f430

ZwDeletePrivateNamespace

Ordinal 1826
Address 0x6f440

ZwDeleteValueKey

Ordinal 1827
Address 0x6f450

ZwDeleteWnfStateData

Ordinal 1828
Address 0x6f460

ZwDeleteWnfStateName

Ordinal 1829
Address 0x6f470

ZwDeviceIoControlFile

Ordinal 1830
Address 0x6e7b0

ZwDisableLastKnownGood

Ordinal 1831
Address 0x6f480

ZwDisplayString

Ordinal 1832
Address 0x6f490

ZwDrawText

Ordinal 1833
Address 0x6f4a0

ZwDuplicateObject

Ordinal 1834
Address 0x6eb20

ZwDuplicateToken

Ordinal 1835
Address 0x6eb80

ZwEnableLastKnownGood

Ordinal 1836
Address 0x6f4b0

ZwEnumerateBootEntries

Ordinal 1837
Address 0x6f4c0

ZwEnumerateDriverEntries

Ordinal 1838
Address 0x6f4d0

ZwEnumerateKey

Ordinal 1839
Address 0x6ea80

ZwEnumerateSystemEnvironmentValuesEx

Ordinal 1840
Address 0x6f4e0

ZwEnumerateTransactionObject

Ordinal 1841
Address 0x6f4f0

ZwEnumerateValueKey

Ordinal 1842
Address 0x6e870

ZwExtendSection

Ordinal 1843
Address 0x6f500

ZwFilterBootOption

Ordinal 1844
Address 0x6f510

ZwFilterToken

Ordinal 1845
Address 0x6f520

ZwFilterTokenEx

Ordinal 1846
Address 0x6f530

ZwFindAtom

Ordinal 1847
Address 0x6e880

ZwFlushBuffersFile

Ordinal 1848
Address 0x6ec10

ZwFlushBuffersFileEx

Ordinal 1849
Address 0x6f540

ZwFlushInstallUILanguage

Ordinal 1850
Address 0x6f550

ZwFlushInstructionCache

Ordinal 1851
Address 0x6f560

ZwFlushKey

Ordinal 1852
Address 0x6f570

ZwFlushProcessWriteBuffers

Ordinal 1853
Address 0x6f580

ZwFlushVirtualMemory

Ordinal 1854
Address 0x6f590

ZwFlushWriteBuffer

Ordinal 1855
Address 0x6f5a0

ZwFreeUserPhysicalPages

Ordinal 1856
Address 0x6f5b0

ZwFreeVirtualMemory

Ordinal 1857
Address 0x6e940

ZwFreezeRegistry

Ordinal 1858
Address 0x6f5c0

ZwFreezeTransactions

Ordinal 1859
Address 0x6f5d0

ZwFsControlFile

Ordinal 1860
Address 0x6eaf0

ZwGetCachedSigningLevel

Ordinal 1861
Address 0x6f5e0

ZwGetCompleteWnfStateSubscription

Ordinal 1862
Address 0x6f5f0

ZwGetContextThread

Ordinal 1863
Address 0x6f600

ZwGetCurrentProcessorNumber

Ordinal 1864
Address 0x6f610

ZwGetCurrentProcessorNumberEx

Ordinal 1865
Address 0x6f620

ZwGetDevicePowerState

Ordinal 1866
Address 0x6f630

ZwGetMUIRegistryInfo

Ordinal 1867
Address 0x6f640

ZwGetNextProcess

Ordinal 1868
Address 0x6f650

ZwGetNextThread

Ordinal 1869
Address 0x6f660

ZwGetNlsSectionPtr

Ordinal 1870
Address 0x6f670

ZwGetNotificationResourceManager

Ordinal 1871
Address 0x6f680

ZwGetWriteWatch

Ordinal 1872
Address 0x6f690

ZwImpersonateAnonymousToken

Ordinal 1873
Address 0x6f6a0

ZwImpersonateClientOfPort

Ordinal 1874
Address 0x6e950

ZwImpersonateThread

Ordinal 1875
Address 0x6f6b0

ZwInitializeEnclave

Ordinal 1876
Address 0x6f6c0

ZwInitializeNlsFiles

Ordinal 1877
Address 0x6f6d0

ZwInitializeRegistry

Ordinal 1878
Address 0x6f6e0

ZwInitiatePowerAction

Ordinal 1879
Address 0x6f6f0

ZwIsProcessInJob

Ordinal 1880
Address 0x6ec50

ZwIsSystemResumeAutomatic

Ordinal 1881
Address 0x6f700

ZwIsUILanguageComitted

Ordinal 1882
Address 0x6f710

ZwListenPort

Ordinal 1883
Address 0x6f720

ZwLoadDriver

Ordinal 1884
Address 0x6f730

ZwLoadEnclaveData

Ordinal 1885
Address 0x6f740

ZwLoadHotPatch

Ordinal 1886
Address 0x6f750

ZwLoadKey2

Ordinal 1887
Address 0x6f770

ZwLoadKey

Ordinal 1888
Address 0x6f760

ZwLoadKeyEx

Ordinal 1889
Address 0x6f780

ZwLockFile

Ordinal 1890
Address 0x6f790

ZwLockProductActivationKeys

Ordinal 1891
Address 0x6f7a0

ZwLockRegistryKey

Ordinal 1892
Address 0x6f7b0

ZwLockVirtualMemory

Ordinal 1893
Address 0x6f7c0

ZwMakePermanentObject

Ordinal 1894
Address 0x6f7d0

ZwMakeTemporaryObject

Ordinal 1895
Address 0x6f7e0

ZwManagePartition

Ordinal 1896
Address 0x6f7f0

ZwMapCMFModule

Ordinal 1897
Address 0x6f800

ZwMapUserPhysicalPages

Ordinal 1898
Address 0x6f810

ZwMapUserPhysicalPagesScatter

Ordinal 1899
Address 0x6e770

ZwMapViewOfSection

Ordinal 1900
Address 0x6e9e0

ZwModifyBootEntry

Ordinal 1901
Address 0x6f820

ZwModifyDriverEntry

Ordinal 1902
Address 0x6f830

ZwNotifyChangeDirectoryFile

Ordinal 1903
Address 0x6f840

ZwNotifyChangeDirectoryFileEx

Ordinal 1904
Address 0x6f850

ZwNotifyChangeKey

Ordinal 1905
Address 0x6f860

ZwNotifyChangeMultipleKeys

Ordinal 1906
Address 0x6f870

ZwNotifyChangeSession

Ordinal 1907
Address 0x6f880

ZwOpenDirectoryObject

Ordinal 1908
Address 0x6ece0

ZwOpenEnlistment

Ordinal 1909
Address 0x6f890

ZwOpenEvent

Ordinal 1910
Address 0x6eb60

ZwOpenEventPair

Ordinal 1911
Address 0x6f8a0

ZwOpenFile

Ordinal 1912
Address 0x6ea90

ZwOpenIoCompletion

Ordinal 1913
Address 0x6f8b0

ZwOpenJobObject

Ordinal 1914
Address 0x6f8c0

ZwOpenKey

Ordinal 1915
Address 0x6e860

ZwOpenKeyEx

Ordinal 1916
Address 0x6f8d0

ZwOpenKeyTransacted

Ordinal 1917
Address 0x6f8e0

ZwOpenKeyTransactedEx

Ordinal 1918
Address 0x6f8f0

ZwOpenKeyedEvent

Ordinal 1919
Address 0x6f900

ZwOpenMutant

Ordinal 1920
Address 0x6f910

ZwOpenObjectAuditAlarm

Ordinal 1921
Address 0x6f920

ZwOpenPartition

Ordinal 1922
Address 0x6f930

ZwOpenPrivateNamespace

Ordinal 1923
Address 0x6f940

ZwOpenProcess

Ordinal 1924
Address 0x6e9c0

ZwOpenProcessToken

Ordinal 1925
Address 0x6f950

ZwOpenProcessTokenEx

Ordinal 1926
Address 0x6ea60

ZwOpenRegistryTransaction

Ordinal 1927
Address 0x6f960

ZwOpenResourceManager

Ordinal 1928
Address 0x6f970

ZwOpenSection

Ordinal 1929
Address 0x6ead0

ZwOpenSemaphore

Ordinal 1930
Address 0x6f980

ZwOpenSession

Ordinal 1931
Address 0x6f990

ZwOpenSymbolicLinkObject

Ordinal 1932
Address 0x6f9a0

ZwOpenThread

Ordinal 1933
Address 0x6f9b0

ZwOpenThreadToken

Ordinal 1934
Address 0x6e9a0

ZwOpenThreadTokenEx

Ordinal 1935
Address 0x6ea50

ZwOpenTimer

Ordinal 1936
Address 0x6f9c0

ZwOpenTransaction

Ordinal 1937
Address 0x6f9d0

ZwOpenTransactionManager

Ordinal 1938
Address 0x6f9e0

ZwPlugPlayControl

Ordinal 1939
Address 0x6f9f0

ZwPowerInformation

Ordinal 1940
Address 0x6ed50

ZwPrePrepareComplete

Ordinal 1941
Address 0x6fa00

ZwPrePrepareEnlistment

Ordinal 1942
Address 0x6fa10

ZwPrepareComplete

Ordinal 1943
Address 0x6fa20

ZwPrepareEnlistment

Ordinal 1944
Address 0x6fa30

ZwPrivilegeCheck

Ordinal 1945
Address 0x6fa40

ZwPrivilegeObjectAuditAlarm

Ordinal 1946
Address 0x6fa50

ZwPrivilegedServiceAuditAlarm

Ordinal 1947
Address 0x6fa60

ZwPropagationComplete

Ordinal 1948
Address 0x6fa70

ZwPropagationFailed

Ordinal 1949
Address 0x6fa80

ZwProtectVirtualMemory

Ordinal 1950
Address 0x6ec60

ZwPulseEvent

Ordinal 1951
Address 0x6fa90

ZwQueryAttributesFile

Ordinal 1952
Address 0x6eb30

ZwQueryAuxiliaryCounterFrequency

Ordinal 1953
Address 0x6faa0

ZwQueryBootEntryOrder

Ordinal 1954
Address 0x6fab0

ZwQueryBootOptions

Ordinal 1955
Address 0x6fac0

ZwQueryDebugFilterState

Ordinal 1956
Address 0x6fad0

ZwQueryDefaultLocale

Ordinal 1957
Address 0x6e890

ZwQueryDefaultUILanguage

Ordinal 1958
Address 0x6eba0

ZwQueryDirectoryFile

Ordinal 1959
Address 0x6eab0

ZwQueryDirectoryFileEx

Ordinal 1960
Address 0x6fae0

ZwQueryDirectoryObject

Ordinal 1961
Address 0x6faf0

ZwQueryDriverEntryOrder

Ordinal 1962
Address 0x6fb00

ZwQueryEaFile

Ordinal 1963
Address 0x6fb10

ZwQueryEvent

Ordinal 1964
Address 0x6ecc0

ZwQueryFullAttributesFile

Ordinal 1965
Address 0x6fb20

ZwQueryInformationAtom

Ordinal 1966
Address 0x6fb30

ZwQueryInformationByName

Ordinal 1967
Address 0x6fb40

ZwQueryInformationEnlistment

Ordinal 1968
Address 0x6fb50

ZwQueryInformationFile

Ordinal 1969
Address 0x6e850

ZwQueryInformationJobObject

Ordinal 1970
Address 0x6fb60

ZwQueryInformationPort

Ordinal 1971
Address 0x6fb70

ZwQueryInformationProcess

Ordinal 1972
Address 0x6e8d0

ZwQueryInformationResourceManager

Ordinal 1973
Address 0x6fb80

ZwQueryInformationThread

Ordinal 1974
Address 0x6e9b0

ZwQueryInformationToken

Ordinal 1975
Address 0x6e970

ZwQueryInformationTransaction

Ordinal 1976
Address 0x6fb90

ZwQueryInformationTransactionManager

Ordinal 1977
Address 0x6fba0

ZwQueryInformationWorkerFactory

Ordinal 1978
Address 0x6fbb0

ZwQueryInstallUILanguage

Ordinal 1979
Address 0x6fbc0

ZwQueryIntervalProfile

Ordinal 1980
Address 0x6fbd0

ZwQueryIoCompletion

Ordinal 1981
Address 0x6fbe0

ZwQueryKey

Ordinal 1982
Address 0x6e8a0

ZwQueryLicenseValue

Ordinal 1983
Address 0x6fbf0

ZwQueryMultipleValueKey

Ordinal 1984
Address 0x6fc00

ZwQueryMutant

Ordinal 1985
Address 0x6fc10

ZwQueryObject

Ordinal 1986
Address 0x6e840

ZwQueryOpenSubKeys

Ordinal 1987
Address 0x6fc20

ZwQueryOpenSubKeysEx

Ordinal 1988
Address 0x6fc30

ZwQueryPerformanceCounter

Ordinal 1989
Address 0x6ea70

ZwQueryPortInformationProcess

Ordinal 1990
Address 0x6fc40

ZwQueryQuotaInformationFile

Ordinal 1991
Address 0x6fc50

ZwQuerySection

Ordinal 1992
Address 0x6ec70

ZwQuerySecurityAttributesToken

Ordinal 1993
Address 0x6fc60

ZwQuerySecurityObject

Ordinal 1994
Address 0x6fc70

ZwQuerySecurityPolicy

Ordinal 1995
Address 0x6fc80

ZwQuerySemaphore

Ordinal 1996
Address 0x6fc90

ZwQuerySymbolicLinkObject

Ordinal 1997
Address 0x6fca0

ZwQuerySystemEnvironmentValue

Ordinal 1998
Address 0x6fcb0

ZwQuerySystemEnvironmentValueEx

Ordinal 1999
Address 0x6fcc0

ZwQuerySystemInformation

Ordinal 2000
Address 0x6eac0

ZwQuerySystemInformationEx

Ordinal 2001
Address 0x6fcd0

ZwQuerySystemTime

Ordinal 2002
Address 0x6ed00

ZwQueryTimer

Ordinal 2003
Address 0x6eae0

ZwQueryTimerResolution

Ordinal 2004
Address 0x6fce0

ZwQueryValueKey

Ordinal 2005
Address 0x6e8b0

ZwQueryVirtualMemory

Ordinal 2006
Address 0x6e990

ZwQueryVolumeInformationFile

Ordinal 2007
Address 0x6ebf0

ZwQueryWnfStateData

Ordinal 2008
Address 0x6fcf0

ZwQueryWnfStateNameInformation

Ordinal 2009
Address 0x6fd00

ZwQueueApcThread

Ordinal 2010
Address 0x6ebb0

ZwQueueApcThreadEx

Ordinal 2011
Address 0x6fd10

ZwRaiseException

Ordinal 2012
Address 0x6fd20

ZwRaiseHardError

Ordinal 2013
Address 0x6fd30

ZwReadFile

Ordinal 2014
Address 0x6e7a0

ZwReadFileScatter

Ordinal 2015
Address 0x6ea40

ZwReadOnlyEnlistment

Ordinal 2016
Address 0x6fd40

ZwReadRequestData

Ordinal 2017
Address 0x6eca0

ZwReadVirtualMemory

Ordinal 2018
Address 0x6eb50

ZwRecoverEnlistment

Ordinal 2019
Address 0x6fd50

ZwRecoverResourceManager

Ordinal 2020
Address 0x6fd60

ZwRecoverTransactionManager

Ordinal 2021
Address 0x6fd70

ZwRegisterProtocolAddressInformation

Ordinal 2022
Address 0x6fd80

ZwRegisterThreadTerminatePort

Ordinal 2023
Address 0x6fd90

ZwReleaseKeyedEvent

Ordinal 2024
Address 0x6fda0

ZwReleaseMutant

Ordinal 2025
Address 0x6e960

ZwReleaseSemaphore

Ordinal 2026
Address 0x6e7e0

ZwReleaseWorkerFactoryWorker

Ordinal 2027
Address 0x6fdb0

ZwRemoveIoCompletion

Ordinal 2028
Address 0x6e7d0

ZwRemoveIoCompletionEx

Ordinal 2029
Address 0x6fdc0

ZwRemoveProcessDebug

Ordinal 2030
Address 0x6fdd0

ZwRenameKey

Ordinal 2031
Address 0x6fde0

ZwRenameTransactionManager

Ordinal 2032
Address 0x6fdf0

ZwReplaceKey

Ordinal 2033
Address 0x6fe00

ZwReplacePartitionUnit

Ordinal 2034
Address 0x6fe10

ZwReplyPort

Ordinal 2035
Address 0x6e800

ZwReplyWaitReceivePort

Ordinal 2036
Address 0x6e7f0

ZwReplyWaitReceivePortEx

Ordinal 2037
Address 0x6ea10

ZwReplyWaitReplyPort

Ordinal 2038
Address 0x6fe20

ZwRequestPort

Ordinal 2039
Address 0x6fe30

ZwRequestWaitReplyPort

Ordinal 2040
Address 0x6e980

ZwResetEvent

Ordinal 2041
Address 0x6fe40

ZwResetWriteWatch

Ordinal 2042
Address 0x6fe50

ZwRestoreKey

Ordinal 2043
Address 0x6fe60

ZwResumeProcess

Ordinal 2044
Address 0x6fe70

ZwResumeThread

Ordinal 2045
Address 0x6ec80

ZwRevertContainerImpersonation

Ordinal 2046
Address 0x6fe80

ZwRollbackComplete

Ordinal 2047
Address 0x6fe90

ZwRollbackEnlistment

Ordinal 2048
Address 0x6fea0

ZwRollbackRegistryTransaction

Ordinal 2049
Address 0x6feb0

ZwRollbackTransaction

Ordinal 2050
Address 0x6fec0

ZwRollforwardTransactionManager

Ordinal 2051
Address 0x6fed0

ZwSaveKey

Ordinal 2052
Address 0x6fee0

ZwSaveKeyEx

Ordinal 2053
Address 0x6fef0

ZwSaveMergedKeys

Ordinal 2054
Address 0x6ff00

ZwSecureConnectPort

Ordinal 2055
Address 0x6ff10

ZwSerializeBoot

Ordinal 2056
Address 0x6ff20

ZwSetBootEntryOrder

Ordinal 2057
Address 0x6ff30

ZwSetBootOptions

Ordinal 2058
Address 0x6ff40

ZwSetCachedSigningLevel2

Ordinal 2059
Address 0x6ff60

ZwSetCachedSigningLevel

Ordinal 2060
Address 0x6ff50

ZwSetContextThread

Ordinal 2061
Address 0x6ff70

ZwSetDebugFilterState

Ordinal 2062
Address 0x6ff80

ZwSetDefaultHardErrorPort

Ordinal 2063
Address 0x6ff90

ZwSetDefaultLocale

Ordinal 2064
Address 0x6ffa0

ZwSetDefaultUILanguage

Ordinal 2065
Address 0x6ffb0

ZwSetDriverEntryOrder

Ordinal 2066
Address 0x6ffc0

ZwSetEaFile

Ordinal 2067
Address 0x6ffd0

ZwSetEvent

Ordinal 2068
Address 0x6e820

ZwSetEventBoostPriority

Ordinal 2069
Address 0x6ea30

ZwSetHighEventPair

Ordinal 2070
Address 0x6ffe0

ZwSetHighWaitLowEventPair

Ordinal 2071
Address 0x6fff0

ZwSetIRTimer

Ordinal 2072
Address 0x70000

ZwSetInformationDebugObject

Ordinal 2073
Address 0x70010

ZwSetInformationEnlistment

Ordinal 2074
Address 0x70020

ZwSetInformationFile

Ordinal 2075
Address 0x6e9d0

ZwSetInformationJobObject

Ordinal 2076
Address 0x70030

ZwSetInformationKey

Ordinal 2077
Address 0x70040

ZwSetInformationObject

Ordinal 2078
Address 0x6ed20

ZwSetInformationProcess

Ordinal 2079
Address 0x6e920

ZwSetInformationResourceManager

Ordinal 2080
Address 0x70050

ZwSetInformationSymbolicLink

Ordinal 2081
Address 0x70060

ZwSetInformationThread

Ordinal 2082
Address 0x6e810

ZwSetInformationToken

Ordinal 2083
Address 0x70070

ZwSetInformationTransaction

Ordinal 2084
Address 0x70080

ZwSetInformationTransactionManager

Ordinal 2085
Address 0x70090

ZwSetInformationVirtualMemory

Ordinal 2086
Address 0x700a0

ZwSetInformationWorkerFactory

Ordinal 2087
Address 0x700b0

ZwSetIntervalProfile

Ordinal 2088
Address 0x700c0

ZwSetIoCompletion

Ordinal 2089
Address 0x700d0

ZwSetIoCompletionEx

Ordinal 2090
Address 0x700e0

ZwSetLdtEntries

Ordinal 2091
Address 0x700f0

ZwSetLowEventPair

Ordinal 2092
Address 0x70100

ZwSetLowWaitHighEventPair

Ordinal 2093
Address 0x70110

ZwSetQuotaInformationFile

Ordinal 2094
Address 0x70120

ZwSetSecurityObject

Ordinal 2095
Address 0x70130

ZwSetSystemEnvironmentValue

Ordinal 2096
Address 0x70140

ZwSetSystemEnvironmentValueEx

Ordinal 2097
Address 0x70150

ZwSetSystemInformation

Ordinal 2098
Address 0x70160

ZwSetSystemPowerState

Ordinal 2099
Address 0x70170

ZwSetSystemTime

Ordinal 2100
Address 0x70180

ZwSetThreadExecutionState

Ordinal 2101
Address 0x70190

ZwSetTimer2

Ordinal 2102
Address 0x701a0

ZwSetTimer

Ordinal 2103
Address 0x6ed80

ZwSetTimerEx

Ordinal 2104
Address 0x701b0

ZwSetTimerResolution

Ordinal 2105
Address 0x701c0

ZwSetUuidSeed

Ordinal 2106
Address 0x701d0

ZwSetValueKey

Ordinal 2107
Address 0x6ed60

ZwSetVolumeInformationFile

Ordinal 2108
Address 0x701e0

ZwSetWnfProcessNotificationEvent

Ordinal 2109
Address 0x701f0

ZwShutdownSystem

Ordinal 2110
Address 0x70200

ZwShutdownWorkerFactory

Ordinal 2111
Address 0x70210

ZwSignalAndWaitForSingleObject

Ordinal 2112
Address 0x70220

ZwSinglePhaseReject

Ordinal 2113
Address 0x70230

ZwStartProfile

Ordinal 2114
Address 0x70240

ZwStopProfile

Ordinal 2115
Address 0x70250

ZwSubscribeWnfStateChange

Ordinal 2116
Address 0x70260

ZwSuspendProcess

Ordinal 2117
Address 0x70270

ZwSuspendThread

Ordinal 2118
Address 0x70280

ZwSystemDebugControl

Ordinal 2119
Address 0x70290

ZwTerminateEnclave

Ordinal 2120
Address 0x702a0

ZwTerminateJobObject

Ordinal 2121
Address 0x702b0

ZwTerminateProcess

Ordinal 2122
Address 0x6ea20

ZwTerminateThread

Ordinal 2123
Address 0x6ec90

ZwTestAlert

Ordinal 2124
Address 0x702c0

ZwThawRegistry

Ordinal 2125
Address 0x702d0

ZwThawTransactions

Ordinal 2126
Address 0x702e0

ZwTraceControl

Ordinal 2127
Address 0x702f0

ZwTraceEvent

Ordinal 2128
Address 0x6ed40

ZwTranslateFilePath

Ordinal 2129
Address 0x70300

ZwUmsThreadYield

Ordinal 2130
Address 0x70310

ZwUnloadDriver

Ordinal 2131
Address 0x70320

ZwUnloadKey2

Ordinal 2132
Address 0x70340

ZwUnloadKey

Ordinal 2133
Address 0x70330

ZwUnloadKeyEx

Ordinal 2134
Address 0x70350

ZwUnlockFile

Ordinal 2135
Address 0x70360

ZwUnlockVirtualMemory

Ordinal 2136
Address 0x70370

ZwUnmapViewOfSection

Ordinal 2137
Address 0x6ea00

ZwUnmapViewOfSectionEx

Ordinal 2138
Address 0x70380

ZwUnsubscribeWnfStateChange

Ordinal 2139
Address 0x70390

ZwUpdateWnfStateData

Ordinal 2140
Address 0x703a0

ZwVdmControl

Ordinal 2141
Address 0x703b0

ZwWaitForAlertByThreadId

Ordinal 2142
Address 0x703c0

ZwWaitForDebugEvent

Ordinal 2143
Address 0x703d0

ZwWaitForKeyedEvent

Ordinal 2144
Address 0x703e0

ZwWaitForMultipleObjects32

Ordinal 2145
Address 0x6e900

ZwWaitForMultipleObjects

Ordinal 2146
Address 0x6ed10

ZwWaitForSingleObject

Ordinal 2147
Address 0x6e780

ZwWaitForWorkViaWorkerFactory

Ordinal 2148
Address 0x703f0

ZwWaitHighEventPair

Ordinal 2149
Address 0x70400

ZwWaitLowEventPair

Ordinal 2150
Address 0x70410

ZwWorkerFactoryWorkerReady

Ordinal 2151
Address 0x6e750

ZwWow64AllocateVirtualMemory64

Ordinal 2152
Address 0x70500

ZwWow64CallFunction64

Ordinal 2153
Address 0x70530

ZwWow64CsrAllocateCaptureBuffer

Ordinal 2154
Address 0x70450

ZwWow64CsrAllocateMessagePointer

Ordinal 2155
Address 0x70470

ZwWow64CsrCaptureMessageBuffer

Ordinal 2156
Address 0x70480

ZwWow64CsrCaptureMessageString

Ordinal 2157
Address 0x70490

ZwWow64CsrClientCallServer

Ordinal 2158
Address 0x70440

ZwWow64CsrClientConnectToServer

Ordinal 2159
Address 0x70420

ZwWow64CsrFreeCaptureBuffer

Ordinal 2160
Address 0x70460

ZwWow64CsrGetProcessId

Ordinal 2161
Address 0x704a0

ZwWow64CsrIdentifyAlertableThread

Ordinal 2162
Address 0x70430

ZwWow64CsrVerifyRegion

Ordinal 2163
Address 0x704b0

ZwWow64DebuggerCall

Ordinal 2164
Address 0x704c0

ZwWow64GetCurrentProcessorNumberEx

Ordinal 2165
Address 0x704d0

ZwWow64GetNativeSystemInformation

Ordinal 2166
Address 0x704e0

ZwWow64IsProcessorFeaturePresent

Ordinal 2167
Address 0x70540

ZwWow64QueryInformationProcess64

Ordinal 2168
Address 0x704f0

ZwWow64ReadVirtualMemory64

Ordinal 2169
Address 0x70510

ZwWow64WriteVirtualMemory64

Ordinal 2170
Address 0x70520

ZwWriteFile

Ordinal 2171
Address 0x6e7c0

ZwWriteFileGather

Ordinal 2172
Address 0x6e910

ZwWriteRequestData

Ordinal 2173
Address 0x6ecd0

ZwWriteVirtualMemory

Ordinal 2174
Address 0x6eb00

ZwYieldExecution

Ordinal 2175
Address 0x6ebc0

_CIcos

Ordinal 2176
Address 0x71820

_CIlog

Ordinal 2177
Address 0x718e0

_CIpow

Ordinal 2178
Address 0x719d0

_CIsin

Ordinal 2179
Address 0x71c00

_CIsqrt

Ordinal 2180
Address 0x71cb0

__isascii

Ordinal 2181
Address 0x71d70

__iscsym

Ordinal 2182
Address 0x71d90

__iscsymf

Ordinal 2183
Address 0x71dd0

__toascii

Ordinal 2184
Address 0x71e10

_alldiv

Ordinal 2185
Address 0x72040

_alldvrm

Ordinal 2186
Address 0x720f0

_allmul

Ordinal 2187
Address 0x721d0

_alloca_probe

Ordinal 2188
Address 0x72210

_alloca_probe_16

Ordinal 2189
Address 0x72240

_alloca_probe_8

Ordinal 2190
Address 0x72256

_allrem

Ordinal 2191
Address 0x72270

_allshl

Ordinal 2192
Address 0x72330

_allshr

Ordinal 2193
Address 0x72350

_atoi64

Ordinal 2194
Address 0x72380

_aulldiv

Ordinal 2195
Address 0x723f0

_aulldvrm

Ordinal 2196
Address 0x72460

_aullrem

Ordinal 2197
Address 0x72500

_aullshr

Ordinal 2198
Address 0x72580

_chkstk

Ordinal 2199
Address 0x72210

_errno

Ordinal 2200
Address 0xb82d0

_except_handler4_common

Ordinal 2201
Address 0x725f0

_fltused

Ordinal 2202
Address 0x1157f0

_ftol

Ordinal 2203
Address 0x72720

_ftol2

Ordinal 2204
Address 0x72760

_ftol2_sse

Ordinal 2205
Address 0x72750

_i64toa

Ordinal 2206
Address 0x72850

_i64toa_s

Ordinal 2207
Address 0x7ad10

_i64tow

Ordinal 2208
Address 0x72a40

_i64tow_s

Ordinal 2209
Address 0x7b010

_itoa

Ordinal 2210
Address 0x72890

_itoa_s

Ordinal 2211
Address 0x7ad50

_itow

Ordinal 2212
Address 0x72a80

_itow_s

Ordinal 2213
Address 0x7b050

_lfind

Ordinal 2214
Address 0x72bc0

_local_unwind4

Ordinal 2215
Address 0x72c50

_ltoa

Ordinal 2216
Address 0x728d0

_ltoa_s

Ordinal 2217
Address 0x7ad80

_ltow

Ordinal 2218
Address 0x72ac0

_ltow_s

Ordinal 2219
Address 0x7b080

_makepath_s

Ordinal 2220
Address 0x7b210

_memccpy

Ordinal 2221
Address 0x72dc0

_memicmp

Ordinal 2222
Address 0x72e20

_snprintf

Ordinal 2223
Address 0x72e30

_snprintf_s

Ordinal 2224
Address 0x7b300

_snscanf_s

Ordinal 2225
Address 0x7b3e0

_snwprintf

Ordinal 2226
Address 0x72ee0

_snwprintf_s

Ordinal 2227
Address 0x7b420

_snwscanf_s

Ordinal 2228
Address 0x7b4f0

_splitpath

Ordinal 2229
Address 0x72fb0

_splitpath_s

Ordinal 2230
Address 0x7b530

_strcmpi

Ordinal 2231
Address 0x731e0

_stricmp

Ordinal 2232
Address 0x731e0

_strlwr

Ordinal 2233
Address 0x731f0

_strlwr_s

Ordinal 2234
Address 0x73220

_strnicmp

Ordinal 2235
Address 0x73280

_strnset_s

Ordinal 2236
Address 0x7b710

_strset_s

Ordinal 2237
Address 0x7b790

_strupr

Ordinal 2238
Address 0x73290

_strupr_s

Ordinal 2239
Address 0x732e0

_swprintf

Ordinal 2240
Address 0x760e0

_ui64toa

Ordinal 2241
Address 0x72910

_ui64toa_s

Ordinal 2242
Address 0x7adc0

_ui64tow

Ordinal 2243
Address 0x72b00

_ui64tow_s

Ordinal 2244
Address 0x7b0c0

_ultoa

Ordinal 2245
Address 0x72940

_ultoa_s

Ordinal 2246
Address 0x7adf0

_ultow

Ordinal 2247
Address 0x72b30

_ultow_s

Ordinal 2248
Address 0x7b0f0

_vscprintf

Ordinal 2249
Address 0x73340

_vscwprintf

Ordinal 2250
Address 0x73470

_vsnprintf

Ordinal 2251
Address 0x73560

_vsnprintf_s

Ordinal 2252
Address 0x7b330

_vsnwprintf

Ordinal 2253
Address 0x73630

_vsnwprintf_s

Ordinal 2254
Address 0x7b450

_vswprintf

Ordinal 2255
Address 0x734a0

_wcsicmp

Ordinal 2256
Address 0x73720

_wcslwr

Ordinal 2257
Address 0x73780

_wcslwr_s

Ordinal 2258
Address 0x737d0

_wcsnicmp

Ordinal 2259
Address 0x73830

_wcsnset_s

Ordinal 2260
Address 0x738a0

_wcsset_s

Ordinal 2261
Address 0x73930

_wcstoi64

Ordinal 2262
Address 0x73990

_wcstoui64

Ordinal 2263
Address 0x739c0

_wcsupr

Ordinal 2264
Address 0x73cb0

_wcsupr_s

Ordinal 2265
Address 0x73cf0

_wmakepath_s

Ordinal 2266
Address 0x7b7f0

_wsplitpath_s

Ordinal 2267
Address 0x7b920

_wtoi

Ordinal 2268
Address 0x73d50

_wtoi64

Ordinal 2269
Address 0x73d60

_wtol

Ordinal 2270
Address 0x73d90

abs

Ordinal 2271
Address 0x73dc0

atan

Ordinal 2272
Address 0x73dd0

atan2

Ordinal 2273
Address 0x73e90

atoi

Ordinal 2274
Address 0x723b0

atol

Ordinal 2275
Address 0x723c0

bsearch

Ordinal 2276
Address 0x73eb0

bsearch_s

Ordinal 2277
Address 0x73f70

ceil

Ordinal 2278
Address 0x74030

cos

Ordinal 2279
Address 0x71810

fabs

Ordinal 2280
Address 0x74130

floor

Ordinal 2281
Address 0x74200

isalnum

Ordinal 2282
Address 0x71e30

isalpha

Ordinal 2283
Address 0x71e60

iscntrl

Ordinal 2284
Address 0x71e90

isdigit

Ordinal 2285
Address 0x71ec0

isgraph

Ordinal 2286
Address 0x71ef0

islower

Ordinal 2287
Address 0x71f20

isprint

Ordinal 2288
Address 0x71f50

ispunct

Ordinal 2289
Address 0x71f80

isspace

Ordinal 2290
Address 0x71fb0

isupper

Ordinal 2291
Address 0x71fe0

iswalnum

Ordinal 2292
Address 0x74310

iswalpha

Ordinal 2293
Address 0x74330

iswascii

Ordinal 2294
Address 0x74350

iswctype

Ordinal 2295
Address 0x74440

iswdigit

Ordinal 2296
Address 0x74370

iswgraph

Ordinal 2297
Address 0x74390

iswlower

Ordinal 2298
Address 0x743b0

iswprint

Ordinal 2299
Address 0x743d0

iswspace

Ordinal 2300
Address 0x743f0

iswxdigit

Ordinal 2301
Address 0x74410

isxdigit

Ordinal 2302
Address 0x72010

labs

Ordinal 2303
Address 0x73dc0

log

Ordinal 2304
Address 0x718d0

mbstowcs

Ordinal 2305
Address 0x74470

memchr

Ordinal 2306
Address 0x744f0

memcmp

Ordinal 2307
Address 0x745b0

memcpy

Ordinal 2308
Address 0x74610

memcpy_s

Ordinal 2309
Address 0x7bb30

memmove

Ordinal 2310
Address 0x74950

memmove_s

Ordinal 2311
Address 0x7bbc0

memset

Ordinal 2312
Address 0x74c90

pow

Ordinal 2313
Address 0x719c0

qsort

Ordinal 2314
Address 0x74d00

qsort_s

Ordinal 2315
Address 0x75130

sin

Ordinal 2316
Address 0x71bf0

sprintf

Ordinal 2317
Address 0x75550

sprintf_s

Ordinal 2318
Address 0x7bc30

sqrt

Ordinal 2319
Address 0x71cc4

sscanf

Ordinal 2320
Address 0x755d0

sscanf_s

Ordinal 2321
Address 0x7bcc0

strcat

Ordinal 2322
Address 0x75690

strcat_s

Ordinal 2323
Address 0x7bd10

strchr

Ordinal 2324
Address 0x75790

strcmp

Ordinal 2325
Address 0x75850

strcpy

Ordinal 2326
Address 0x75680

strcpy_s

Ordinal 2327
Address 0x7bda0

strcspn

Ordinal 2328
Address 0x758e0

strlen

Ordinal 2329
Address 0x75930

strncat

Ordinal 2330
Address 0x759c0

strncat_s

Ordinal 2331
Address 0x7be10

strncmp

Ordinal 2332
Address 0x75b00

strncpy

Ordinal 2333
Address 0x75bc0

strncpy_s

Ordinal 2334
Address 0x7bf10

strnlen

Ordinal 2335
Address 0x75cf0

strpbrk

Ordinal 2336
Address 0x75d10

strrchr

Ordinal 2337
Address 0x75d50

strspn

Ordinal 2338
Address 0x75d80

strstr

Ordinal 2339
Address 0x75dd0

strtok_s

Ordinal 2340
Address 0x7c000

strtol

Ordinal 2341
Address 0x76060

strtoul

Ordinal 2342
Address 0x760b0

swprintf

Ordinal 2343
Address 0x760e0

swprintf_s

Ordinal 2344
Address 0x7c100

swscanf_s

Ordinal 2345
Address 0x7c190

tan

Ordinal 2346
Address 0x76180

tolower

Ordinal 2347
Address 0x76250

toupper

Ordinal 2348
Address 0x76280

towlower

Ordinal 2349
Address 0x762e0

towupper

Ordinal 2350
Address 0x76310

vDbgPrintEx

Ordinal 2351
Address 0xb9bf0

vDbgPrintExWithPrefix

Ordinal 2352
Address 0xb9c20

vsprintf

Ordinal 2353
Address 0x73450

vsprintf_s

Ordinal 2354
Address 0x7bc60

vswprintf_s

Ordinal 2355
Address 0x7c130

wcscat

Ordinal 2356
Address 0x76330

wcscat_s

Ordinal 2357
Address 0x7c1e0

wcschr

Ordinal 2358
Address 0x763a0

wcscmp

Ordinal 2359
Address 0x763d0

wcscpy

Ordinal 2360
Address 0x76370

wcscpy_s

Ordinal 2361
Address 0x7c270

wcscspn

Ordinal 2362
Address 0x76420

wcslen

Ordinal 2363
Address 0x76480

wcsncat

Ordinal 2364
Address 0x764a0

wcsncat_s

Ordinal 2365
Address 0x7c2f0

wcsncmp

Ordinal 2366
Address 0x764f0

wcsncpy

Ordinal 2367
Address 0x76530

wcsncpy_s

Ordinal 2368
Address 0x7c3f0

wcsnlen

Ordinal 2369
Address 0x76580

wcspbrk

Ordinal 2370
Address 0x765b0

wcsrchr

Ordinal 2371
Address 0x76600

wcsspn

Ordinal 2372
Address 0x76640

wcsstr

Ordinal 2373
Address 0x766a0

wcstok_s

Ordinal 2374
Address 0x7c4e0

wcstol

Ordinal 2375
Address 0x76910

wcstombs

Ordinal 2376
Address 0x76990

wcstoul

Ordinal 2377
Address 0x76960

1

Type MUI
Language English - United States
Codepage UNKNOWN
Size 0xc8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.68568
MD5 3bdc815d8654093fca0712d6ad03cddb
SHA1 33f1fd9884f16b7140c0e7bb8ca151059c99e970
SHA256 54fb29ec4d37cc60771184e9785e048f7264d97e8a3daaa018e2b2b2e1b7427b
SHA3 8f2af26f6cae45e018a4756706a95672ec3ed95da098f871acf961d8e6092aa1

1 (#2)

Type RT_MESSAGETABLE
Language English - United States
Codepage UNKNOWN
Size 0x69c9c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33357
MD5 aa50a7a303d306df7d070d32232c7f3f
SHA1 3ff63c497b56ca2c59a49ce4741e5f9d29d88bbf
SHA256 7d4606b76c1243377f0f6cd3c6e7b7f55e68a0760e2b4b2766f1e9bd02fff455
SHA3 4ba6030a9a01fdcbac57c18123a0b1baea9dff2ac6c45e74173b697028abae23

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x380
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.45791
MD5 40e8dd7d607bbd5c842bf6206f01a04d
SHA1 c5a88eb45b72c8d594725e993c56c86fd1a28b70
SHA256 cfea9bfac5a962757a405b9beeaf389b86e61a2edc8e7813bb890fdd4d741957
SHA3 b91122b26cba7a9b5c39e809ff9d7f9d53050fdc81a2bdeaa8657d939f51d7b4

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 10.0.16299.64
ProductVersion 10.0.16299.64
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_DLL
Language English - United States
CompanyName Microsoft Corporation
FileDescription NT Layer DLL
FileVersion (#2) 10.0.16299.64 (WinBuild.160101.0800)
InternalName ntdll.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename ntdll.dll
ProductName Microsoft® Windows® Operating System
ProductVersion (#2) 10.0.16299.64
Resource LangID English - United States

TLS Callbacks

Load Configuration

Size 0xa0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0x800
EditList 0
SecurityCookie 0x7733b354
SEHandlerTable 0x7722df20
SEHandlerCount 71
GuardCFCheckFunctionPointer 1999868368
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x329bc938
Unmarked objects 0
ASM objects (24325) 3
Exports (VS2017 v15.?.? build 25203) 1
ASM objects (VS2017 v15.?.? build 25203) 70
C++ objects (POGO O) (VS2017 v15.?.? build 25203) 274
C++ objects (VS2017 v15.?.? build 25203) 27
C objects (VS2017 v15.?.? build 25203) 119
Resource objects (VS2017 v15.?.? build 25203) 1
Linker (VS2017 v15.?.? build 25203) 1

Errors

[!] Error: Could not read PDB file information of invalid magic number. [*] Warning: The WIN_CERTIFICATE appears to be invalid.
<-- -->