c28ca4ba56c4c291f393996d1f075bac

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2011-Nov-22 16:27:55
Detected languages Chinese - PRC
English - United States
Debug artifacts ntdll.pdb
CompanyName Microsoft Corporation
FileDescription NT Layer DLL
FileVersion 5.2.3790.4937 (srv03_sp2_gdr.111121-0236)
InternalName ntdll.dll
LegalCopyright (C) Microsoft Corporation. All rights reserved.
OriginalFilename ntdll.dll
ProductName Microsoft(R) Windows(R) Operating System
ProductVersion 5.2.3790.4937

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Tries to detect virtualized environments:
  • HARDWARE\DESCRIPTION\System
 May have dropper capabilities:
  • CurrentControlSet\Services
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Uses constants related to SHA1
Suspicious The PE is possibly packed. Unusual section name found: TEXT
The PE only has 0 import(s).
Safe VirusTotal score: 0/71 (Scanned on 2020-01-28 19:00:08) All the AVs think this file is safe.

Hashes

MD5 c28ca4ba56c4c291f393996d1f075bac
SHA1 768f6310cabfee210206b1cdf45676c3b34c1465
SHA256 b248f684f38f6e15344ce501bf95cff98cfc106eae5eb0067295eaf6679cfc3d
SHA3 a5a1b4d11d8b8d24ac3ada268d30f757125ced5637a2d6e2d35752a71d3c3eef
SSDeep 24576:wLbZDGKlLaYDchkBXUnd2oLtjesKS0XDTCWs07:wLbNGKlLnodRjesMqO
Imports Hash d41d8cd98f00b204e9800998ecf8427e

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xe0

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2011-Nov-22 16:27:55
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 8.2
SizeOfCode 0xe4e00
SizeOfInitializedData 0x60600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000000000 (Section: ?)
BaseOfCode 0x1000
ImageBase 0x78eb0000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.2
ImageVersion 5.2
SubsystemVersion 5.2
Win32VersionValue 0
SizeOfImage 0x14c000
SizeOfHeaders 0x400
Checksum 0x152bc3
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
SizeofStackReserve 0x40000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 5e7daf4d859adf3011dc224f9169884a
SHA1 ca1de5d3d6d3548e30afa2b764d719b36329a711
SHA256 eea76af94fdd6f23aeaad5188d6fb0bf6af5806104d3de3205f61d0be0d8c6ed
SHA3 7341e32cc27bfd098190cf387d689b3b543c2563640b0bd3033122c5aa4ed49c
VirtualSize 0xe3da4
VirtualAddress 0x1000
SizeOfRawData 0xe3e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.51435

TEXT

MD5 bdd8f8c3f13425ca7f29f53b2e3801cc
SHA1 e287441309a2996021413e5ab492bb13606d3c63
SHA256 019d84b90befaf2bd2318e80b63496c841800bfc6deedcac2193e8c85adb38c7
SHA3 bc26fbe71fa5c9567cb9c393c9ef5277201205a1eb2bd6e43594b33ad6fa4e74
VirtualSize 0xec7
VirtualAddress 0xe5000
SizeOfRawData 0x1000
PointerToRawData 0xe4200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.59213

.data

MD5 178021aa889014857dffc4d95a85e51d
SHA1 6d1f0d30e22e2a7ce0dec64be0812a16749c2ef8
SHA256 086ab0d32a445d430bc784da143ff494ce6587390e84441e6ac27c4c030e61b5
SHA3 e54264761362bcec50edf459f58e6482caf03be64303dfeb97ef2d06da2d923c
VirtualSize 0x8410
VirtualAddress 0xe6000
SizeOfRawData 0x5000
PointerToRawData 0xe5200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.06916

.pdata

MD5 bab9aa2c4c9058d3edaa057f995de7f0
SHA1 65eb91167d3e34d02a409a355ae36a63fb395844
SHA256 896b80d0660f84f5e222b520d1209d4c3448cdcaf9314f3bac0c228d7dd58903
SHA3 6cfedac6841f6367054cc723d78312ea20edc8e4c7b3089548389ceb13c75b5c
VirtualSize 0x1cbb4
VirtualAddress 0xef000
SizeOfRawData 0x1cc00
PointerToRawData 0xea200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.1226

.rsrc

MD5 d9c60bd4cdff41ba0e828c203f835581
SHA1 3e98cefd4296e0587bcd6f3871049afef70cc1f5
SHA256 d2d3739aef13a963d06de9b2a3bc6f1c710b1981ab5730df79ccf649c3e24c72
SHA3 dc067362d1f85dee30fbef1bd76bc2f0feb36a559176bdc1884416a6b5f3c2a0
VirtualSize 0x3e5e4
VirtualAddress 0x10c000
SizeOfRawData 0x3e600
PointerToRawData 0x106e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.43716

.reloc

MD5 3800eb482b46b455dd6ee0b82cbc14bb
SHA1 b3bc442859faab112487d5ed23b51a978969935c
SHA256 a0fdba58cdee96fc98acd82f9783f15c053c1f5c2cacb786fdd335ec23f52d96
SHA3 3d03753b4dc144b86ec9d6bcc00bba55a782291c3ab42ec241cea86804f64013
VirtualSize 0x320
VirtualAddress 0x14b000
SizeOfRawData 0x400
PointerToRawData 0x145400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.23589

Imports

Delayed Imports

PropertyLengthAsVariant

Ordinal 1
Address 0x6e540

RtlConvertPropertyToVariant

Ordinal 2
Address 0x6e460

RtlConvertVariantToProperty

Ordinal 3
Address 0x6e360

CsrAllocateCaptureBuffer

Ordinal 4
Address 0x22090

CsrAllocateMessagePointer

Ordinal 5
Address 0x22180

CsrCaptureMessageBuffer

Ordinal 6
Address 0x14d30

CsrCaptureMessageMultiUnicodeStringsInPlace

Ordinal 7
Address 0x27460

CsrCaptureMessageString

Ordinal 8
Address 0x519d0

CsrCaptureTimeout

Ordinal 9
Address 0x581c0

CsrClientCallServer

Ordinal 10
Address 0x35490

CsrClientConnectToServer

Ordinal 11
Address 0x13060

CsrFreeCaptureBuffer

Ordinal 12
Address 0x23da0

CsrGetProcessId

Ordinal 13
Address 0x580b0

CsrIdentifyAlertableThread

Ordinal 14
Address 0x63fb0

CsrNewThread

Ordinal 15
Address 0x3b6a0

CsrProbeForRead

Ordinal 16
Address 0x58220

CsrProbeForWrite

Ordinal 17
Address 0x581e0

CsrSetPriorityClass

Ordinal 18
Address 0x58090

DbgBreakPoint

Ordinal 19
Address 0x324f0

DbgPrint

Ordinal 20
Address 0x26b0

DbgPrintEx

Ordinal 21
Address 0xd7c0

DbgPrintReturnControlC

Ordinal 22
Address 0x6e620

DbgPrompt

Ordinal 23
Address 0x6e730

DbgQueryDebugFilterState

Ordinal 24
Address 0x6e790

DbgSetDebugFilterState

Ordinal 25
Address 0x6e7a0

DbgUiConnectToDbg

Ordinal 26
Address 0x58260

DbgUiContinue

Ordinal 27
Address 0x58340

DbgUiConvertStateChangeStructure

Ordinal 28
Address 0x58500

DbgUiDebugActiveProcess

Ordinal 29
Address 0x58430

DbgUiGetThreadDebugObject

Ordinal 30
Address 0x582d0

DbgUiIssueRemoteBreakin

Ordinal 31
Address 0x583d0

DbgUiRemoteBreakin

Ordinal 32
Address 0x58390

DbgUiSetThreadDebugObject

Ordinal 33
Address 0x582f0

DbgUiStopDebugging

Ordinal 34
Address 0x58370

DbgUiWaitStateChange

Ordinal 35
Address 0x58310

DbgUserBreakPoint

Ordinal 36
Address 0x32500

EtwControlTraceA

Ordinal 37
Address 0xb1ce0

EtwControlTraceW

Ordinal 38
Address 0x4f350

EtwCreateTraceInstanceId

Ordinal 39
Address 0xb2f30

EtwEnableTrace

Ordinal 40
Address 0xb2590

EtwEnumerateTraceGuids

Ordinal 41
Address 0xb2fe0

EtwFlushTraceA

Ordinal 42
Address 0xb31d0

EtwFlushTraceW

Ordinal 43
Address 0xb4aa0

EtwGetTraceEnableFlags

Ordinal 44
Address 0xb2ed0

EtwGetTraceEnableLevel

Ordinal 45
Address 0xb2e70

EtwGetTraceLoggerHandle

Ordinal 46
Address 0xb2dd0

EtwNotificationRegistrationA

Ordinal 47
Address 0xb4ac0

EtwNotificationRegistrationW

Ordinal 48
Address 0x3760

EtwQueryAllTracesA

Ordinal 49
Address 0xb4a40

EtwQueryAllTracesW

Ordinal 50
Address 0x4f9a0

EtwQueryTraceA

Ordinal 51
Address 0xb3180

EtwQueryTraceW

Ordinal 52
Address 0xb4a50

EtwReceiveNotificationsA

Ordinal 53
Address 0xb4b20

EtwReceiveNotificationsW

Ordinal 54
Address 0xb4af0

EtwRegisterTraceGuidsA

Ordinal 55
Address 0x51d80

EtwRegisterTraceGuidsW

Ordinal 56
Address 0xadd0

EtwStartTraceA

Ordinal 57
Address 0xb3750

EtwStartTraceW

Ordinal 58
Address 0xb3e20

EtwStopTraceA

Ordinal 59
Address 0xb3190

EtwStopTraceW

Ordinal 60
Address 0xb4a60

EtwTraceEvent

Ordinal 61
Address 0xb27d0

EtwTraceEventInstance

Ordinal 62
Address 0xb28d0

EtwTraceMessage

Ordinal 63
Address 0xb34c0

EtwTraceMessageVa

Ordinal 64
Address 0xb3550

EtwUnregisterTraceGuids

Ordinal 65
Address 0xcf30

EtwUpdateTraceA

Ordinal 66
Address 0xb31b0

EtwUpdateTraceW

Ordinal 67
Address 0xb4a80

EtwpGetTraceBuffer

Ordinal 68
Address 0xb4c20

EtwpSetHWConfigFunction

Ordinal 69
Address 0xc970

ExpInterlockedPopEntrySListEnd

Ordinal 70
Address 0x3173e

ExpInterlockedPopEntrySListFault

Ordinal 71
Address 0x31726

ExpInterlockedPopEntrySListResume

Ordinal 72
Address 0x31710

KiRaiseUserExceptionDispatcher

Ordinal 73
Address 0x32c70

KiUserApcDispatcher

Ordinal 74
Address 0x32ae0

KiUserCallbackDispatcher

Ordinal 75
Address 0x32bb0

KiUserExceptionDispatcher

Ordinal 76
Address 0x32c00

LdrAccessOutOfProcessResource

Ordinal 77
Address 0x12390

LdrAccessResource

Ordinal 78
Address 0x2e000

LdrAddRefDll

Ordinal 79
Address 0xf730

LdrAlternateResourcesEnabled

Ordinal 80
Address 0x6f640

LdrCreateOutOfProcessImage

Ordinal 81
Address 0x17230

LdrDestroyOutOfProcessImage

Ordinal 82
Address 0x171f0

LdrDisableThreadCalloutsForDll

Ordinal 83
Address 0x18440

LdrEnumResources

Ordinal 84
Address 0x6f140

LdrEnumerateLoadedModules

Ordinal 85
Address 0x13460

LdrFindCreateProcessManifest

Ordinal 86
Address 0x17080

LdrFindEntryForAddress

Ordinal 87
Address 0x6e890

LdrFindResourceDirectory_U

Ordinal 88
Address 0x1fa90

LdrFindResourceEx_U

Ordinal 89
Address 0x6e9d0

LdrFindResource_U

Ordinal 90
Address 0x2dfe0

LdrFlushAlternateResourceModules

Ordinal 91
Address 0x72e0

LdrGetDllHandle

Ordinal 92
Address 0x2f450

LdrGetDllHandleEx

Ordinal 93
Address 0x2f1b0

LdrGetKnownDllSectionHandle

Ordinal 94
Address 0x17a10

LdrGetProcedureAddress

Ordinal 95
Address 0x39c50

LdrHotPatchRoutine

Ordinal 96
Address 0x58c00

LdrInitShimEngineDynamic

Ordinal 97
Address 0x5b280

LdrInitializeThunk

Ordinal 98
Address 0x324b0

LdrLoadAlternateResourceModule

Ordinal 99
Address 0x2dd20

LdrLoadDll

Ordinal 100
Address 0x39820

LdrLockLoaderLock

Ordinal 101
Address 0x37690

LdrOpenImageFileOptionsKey

Ordinal 102
Address 0x16ee0

LdrProcessInitializationComplete

Ordinal 103
Address 0x144b0

LdrProcessRelocationBlock

Ordinal 104
Address 0x71d90

LdrQueryImageFileExecutionOptions

Ordinal 105
Address 0x5ac0

LdrQueryImageFileExecutionOptionsEx

Ordinal 106
Address 0x5cd10

LdrQueryImageFileKeyOption

Ordinal 107
Address 0x5ca50

LdrQueryProcessModuleInformation

Ordinal 108
Address 0x5a810

LdrSetAppCompatDllRedirectionCallback

Ordinal 109
Address 0x5ab50

LdrSetDllManifestProber

Ordinal 110
Address 0x13600

LdrShutdownProcess

Ordinal 111
Address 0x14a20

LdrShutdownThread

Ordinal 112
Address 0x28fc0

LdrUnloadAlternateResourceModule

Ordinal 113
Address 0x221c0

LdrUnloadDll

Ordinal 114
Address 0x3b890

LdrUnlockLoaderLock

Ordinal 115
Address 0x37770

LdrVerifyImageMatchesChecksum

Ordinal 116
Address 0x11f0

NlsAnsiCodePage

Ordinal 117
Address 0xe9708

NlsMbCodePageTag

Ordinal 118
Address 0xe9710

NlsMbOemCodePageTag

Ordinal 119
Address 0xe9718

NtAcceptConnectPort

Ordinal 120
Address 0x30a60

NtAccessCheck

Ordinal 121
Address 0x30a70

NtAccessCheckAndAuditAlarm

Ordinal 122
Address 0x306c0

NtAccessCheckByType

Ordinal 123
Address 0x30a80

NtAccessCheckByTypeAndAuditAlarm

Ordinal 124
Address 0x309c0

NtAccessCheckByTypeResultList

Ordinal 125
Address 0x30a90

NtAccessCheckByTypeResultListAndAuditAlarm

Ordinal 126
Address 0x30aa0

NtAccessCheckByTypeResultListAndAuditAlarmByHandle

Ordinal 127
Address 0x30ab0

NtAddAtom

Ordinal 128
Address 0x308a0

NtAddBootEntry

Ordinal 129
Address 0x30ac0

NtAddDriverEntry

Ordinal 130
Address 0x30ad0

NtAdjustGroupsToken

Ordinal 131
Address 0x30ae0

NtAdjustPrivilegesToken

Ordinal 132
Address 0x30840

NtAlertResumeThread

Ordinal 133
Address 0x30af0

NtAlertThread

Ordinal 134
Address 0x30b00

NtAllocateLocallyUniqueId

Ordinal 135
Address 0x30b10

NtAllocateUserPhysicalPages

Ordinal 136
Address 0x30b20

NtAllocateUuids

Ordinal 137
Address 0x30b30

NtAllocateVirtualMemory

Ordinal 138
Address 0x305b0

NtApphelpCacheControl

Ordinal 139
Address 0x308f0

NtAreMappedFilesTheSame

Ordinal 140
Address 0x30b40

NtAssignProcessToJobObject

Ordinal 141
Address 0x30b50

NtCallbackReturn

Ordinal 142
Address 0x30480

NtCancelDeviceWakeupRequest

Ordinal 143
Address 0x30b60

NtCancelIoFile

Ordinal 144
Address 0x30a00

NtCancelTimer

Ordinal 145
Address 0x30a40

NtClearEvent

Ordinal 146
Address 0x30810

NtClose

Ordinal 147
Address 0x30520

NtCloseObjectAuditAlarm

Ordinal 148
Address 0x307e0

NtCompactKeys

Ordinal 149
Address 0x30b70

NtCompareTokens

Ordinal 150
Address 0x30b80

NtCompleteConnectPort

Ordinal 151
Address 0x30b90

NtCompressKey

Ordinal 152
Address 0x30ba0

NtConnectPort

Ordinal 153
Address 0x30bb0

NtContinue

Ordinal 154
Address 0x30860

NtCreateDebugObject

Ordinal 155
Address 0x30bc0

NtCreateDirectoryObject

Ordinal 156
Address 0x30bd0

NtCreateEvent

Ordinal 157
Address 0x308b0

NtCreateEventPair

Ordinal 158
Address 0x30be0

NtCreateFile

Ordinal 159
Address 0x30980

NtCreateIoCompletion

Ordinal 160
Address 0x30bf0

NtCreateJobObject

Ordinal 161
Address 0x30c00

NtCreateJobSet

Ordinal 162
Address 0x30c10

NtCreateKey

Ordinal 163
Address 0x30600

NtCreateKeyedEvent

Ordinal 164
Address 0x30c20

NtCreateMailslotFile

Ordinal 165
Address 0x30c30

NtCreateMutant

Ordinal 166
Address 0x30c40

NtCreateNamedPipeFile

Ordinal 167
Address 0x30c50

NtCreatePagingFile

Ordinal 168
Address 0x30c60

NtCreatePort

Ordinal 169
Address 0x30c70

NtCreateProcess

Ordinal 170
Address 0x30c80

NtCreateProcessEx

Ordinal 171
Address 0x30900

NtCreateProfile

Ordinal 172
Address 0x30c90

NtCreateSection

Ordinal 173
Address 0x308d0

NtCreateSemaphore

Ordinal 174
Address 0x30ca0

NtCreateSymbolicLinkObject

Ordinal 175
Address 0x30cb0

NtCreateThread

Ordinal 176
Address 0x30910

NtCreateTimer

Ordinal 177
Address 0x30cc0

NtCreateToken

Ordinal 178
Address 0x30cd0

NtCreateWaitablePort

Ordinal 179
Address 0x30ce0

NtDebugActiveProcess

Ordinal 180
Address 0x30cf0

NtDebugContinue

Ordinal 181
Address 0x30d00

NtDelayExecution

Ordinal 182
Address 0x30770

NtDeleteAtom

Ordinal 183
Address 0x30d10

NtDeleteBootEntry

Ordinal 184
Address 0x30d20

NtDeleteDriverEntry

Ordinal 185
Address 0x30d30

NtDeleteFile

Ordinal 186
Address 0x30d40

NtDeleteKey

Ordinal 187
Address 0x30d50

NtDeleteObjectAuditAlarm

Ordinal 188
Address 0x30d60

NtDeleteValueKey

Ordinal 189
Address 0x30d70

NtDeviceIoControlFile

Ordinal 190
Address 0x304a0

NtDisplayString

Ordinal 191
Address 0x30d80

NtDuplicateObject

Ordinal 192
Address 0x307f0

NtDuplicateToken

Ordinal 193
Address 0x30850

NtEnumerateBootEntries

Ordinal 194
Address 0x30d90

NtEnumerateDriverEntries

Ordinal 195
Address 0x30da0

NtEnumerateKey

Ordinal 196
Address 0x30750

NtEnumerateSystemEnvironmentValuesEx

Ordinal 197
Address 0x30db0

NtEnumerateValueKey

Ordinal 198
Address 0x30560

NtExtendSection

Ordinal 199
Address 0x30dc0

NtFilterToken

Ordinal 200
Address 0x30dd0

NtFindAtom

Ordinal 201
Address 0x30570

NtFlushBuffersFile

Ordinal 202
Address 0x308e0

NtFlushInstructionCache

Ordinal 203
Address 0x30de0

NtFlushKey

Ordinal 204
Address 0x30df0

NtFlushVirtualMemory

Ordinal 205
Address 0x30e00

NtFlushWriteBuffer

Ordinal 206
Address 0x30e10

NtFreeUserPhysicalPages

Ordinal 207
Address 0x30e20

NtFreeVirtualMemory

Ordinal 208
Address 0x30610

NtFsControlFile

Ordinal 209
Address 0x307c0

NtGetContextThread

Ordinal 210
Address 0x30e30

NtGetCurrentProcessorNumber

Ordinal 211
Address 0x30e40

NtGetDevicePowerState

Ordinal 212
Address 0x30e50

NtGetPlugPlayEvent

Ordinal 213
Address 0x30e60

NtGetTickCount

Ordinal 214
Address 0x73b50

NtGetWriteWatch

Ordinal 215
Address 0x30e70

NtImpersonateAnonymousToken

Ordinal 216
Address 0x30e80

NtImpersonateClientOfPort

Ordinal 217
Address 0x30620

NtImpersonateThread

Ordinal 218
Address 0x30e90

NtInitializeRegistry

Ordinal 219
Address 0x30ea0

NtInitiatePowerAction

Ordinal 220
Address 0x30eb0

NtIsProcessInJob

Ordinal 221
Address 0x30920

NtIsSystemResumeAutomatic

Ordinal 222
Address 0x30ec0

NtListenPort

Ordinal 223
Address 0x30ed0

NtLoadDriver

Ordinal 224
Address 0x30ee0

NtLoadKey

Ordinal 225
Address 0x30ef0

NtLoadKey2

Ordinal 226
Address 0x30f00

NtLoadKeyEx

Ordinal 227
Address 0x30f10

NtLockFile

Ordinal 228
Address 0x30f20

NtLockProductActivationKeys

Ordinal 229
Address 0x30f30

NtLockRegistryKey

Ordinal 230
Address 0x30f40

NtLockVirtualMemory

Ordinal 231
Address 0x30f50

NtMakePermanentObject

Ordinal 232
Address 0x30f60

NtMakeTemporaryObject

Ordinal 233
Address 0x30f70

NtMapUserPhysicalPages

Ordinal 234
Address 0x30f80

NtMapUserPhysicalPagesScatter

Ordinal 235
Address 0x30460

NtMapViewOfSection

Ordinal 236
Address 0x306b0

NtModifyBootEntry

Ordinal 237
Address 0x30f90

NtModifyDriverEntry

Ordinal 238
Address 0x30fa0

NtNotifyChangeDirectoryFile

Ordinal 239
Address 0x30fb0

NtNotifyChangeKey

Ordinal 240
Address 0x30fc0

NtNotifyChangeMultipleKeys

Ordinal 241
Address 0x30fd0

NtOpenDirectoryObject

Ordinal 242
Address 0x309b0

NtOpenEvent

Ordinal 243
Address 0x30830

NtOpenEventPair

Ordinal 244
Address 0x30fe0

NtOpenFile

Ordinal 245
Address 0x30760

NtOpenIoCompletion

Ordinal 246
Address 0x30ff0

NtOpenJobObject

Ordinal 247
Address 0x31000

NtOpenKey

Ordinal 248
Address 0x30550

NtOpenKeyedEvent

Ordinal 249
Address 0x31010

NtOpenMutant

Ordinal 250
Address 0x31020

NtOpenObjectAuditAlarm

Ordinal 251
Address 0x31030

NtOpenProcess

Ordinal 252
Address 0x30690

NtOpenProcessToken

Ordinal 253
Address 0x31040

NtOpenProcessTokenEx

Ordinal 254
Address 0x30730

NtOpenSection

Ordinal 255
Address 0x307a0

NtOpenSemaphore

Ordinal 256
Address 0x31050

NtOpenSymbolicLinkObject

Ordinal 257
Address 0x31060

NtOpenThread

Ordinal 258
Address 0x31070

NtOpenThreadToken

Ordinal 259
Address 0x30670

NtOpenThreadTokenEx

Ordinal 260
Address 0x30720

NtOpenTimer

Ordinal 261
Address 0x31080

NtPlugPlayControl

Ordinal 262
Address 0x31090

NtPowerInformation

Ordinal 263
Address 0x30a20

NtPrivilegeCheck

Ordinal 264
Address 0x310a0

NtPrivilegeObjectAuditAlarm

Ordinal 265
Address 0x310b0

NtPrivilegedServiceAuditAlarm

Ordinal 266
Address 0x310c0

NtProtectVirtualMemory

Ordinal 267
Address 0x30930

NtPulseEvent

Ordinal 268
Address 0x310d0

NtQueryAttributesFile

Ordinal 269
Address 0x30800

NtQueryBootEntryOrder

Ordinal 270
Address 0x310e0

NtQueryBootOptions

Ordinal 271
Address 0x310f0

NtQueryDebugFilterState

Ordinal 272
Address 0x31100

NtQueryDefaultLocale

Ordinal 273
Address 0x30580

NtQueryDefaultUILanguage

Ordinal 274
Address 0x30870

NtQueryDirectoryFile

Ordinal 275
Address 0x30780

NtQueryDirectoryObject

Ordinal 276
Address 0x31110

NtQueryDriverEntryOrder

Ordinal 277
Address 0x31120

NtQueryEaFile

Ordinal 278
Address 0x31130

NtQueryEvent

Ordinal 279
Address 0x30990

NtQueryFullAttributesFile

Ordinal 280
Address 0x31140

NtQueryInformationAtom

Ordinal 281
Address 0x31150

NtQueryInformationFile

Ordinal 282
Address 0x30540

NtQueryInformationJobObject

Ordinal 283
Address 0x31160

NtQueryInformationPort

Ordinal 284
Address 0x31170

NtQueryInformationProcess

Ordinal 285
Address 0x305c0

NtQueryInformationThread

Ordinal 286
Address 0x30680

NtQueryInformationToken

Ordinal 287
Address 0x30640

NtQueryInstallUILanguage

Ordinal 288
Address 0x31180

NtQueryIntervalProfile

Ordinal 289
Address 0x31190

NtQueryIoCompletion

Ordinal 290
Address 0x311a0

NtQueryKey

Ordinal 291
Address 0x30590

NtQueryMultipleValueKey

Ordinal 292
Address 0x311b0

NtQueryMutant

Ordinal 293
Address 0x311c0

NtQueryObject

Ordinal 294
Address 0x30530

NtQueryOpenSubKeys

Ordinal 295
Address 0x311d0

NtQueryOpenSubKeysEx

Ordinal 296
Address 0x311e0

NtQueryPerformanceCounter

Ordinal 297
Address 0x30740

NtQueryPortInformationProcess

Ordinal 298
Address 0x311f0

NtQueryQuotaInformationFile

Ordinal 299
Address 0x31200

NtQuerySection

Ordinal 300
Address 0x30940

NtQuerySecurityObject

Ordinal 301
Address 0x31210

NtQuerySemaphore

Ordinal 302
Address 0x31220

NtQuerySymbolicLinkObject

Ordinal 303
Address 0x31230

NtQuerySystemEnvironmentValue

Ordinal 304
Address 0x31240

NtQuerySystemEnvironmentValueEx

Ordinal 305
Address 0x31250

NtQuerySystemInformation

Ordinal 306
Address 0x30790

NtQuerySystemTime

Ordinal 307
Address 0x309d0

NtQueryTimer

Ordinal 308
Address 0x307b0

NtQueryTimerResolution

Ordinal 309
Address 0x31260

NtQueryValueKey

Ordinal 310
Address 0x305a0

NtQueryVirtualMemory

Ordinal 311
Address 0x30660

NtQueryVolumeInformationFile

Ordinal 312
Address 0x308c0

NtQueueApcThread

Ordinal 313
Address 0x30880

NtRaiseException

Ordinal 314
Address 0x31270

NtRaiseHardError

Ordinal 315
Address 0x31280

NtReadFile

Ordinal 316
Address 0x30490

NtReadFileScatter

Ordinal 317
Address 0x30710

NtReadRequestData

Ordinal 318
Address 0x30970

NtReadVirtualMemory

Ordinal 319
Address 0x30820

NtRegisterThreadTerminatePort

Ordinal 320
Address 0x31290

NtReleaseKeyedEvent

Ordinal 321
Address 0x312a0

NtReleaseMutant

Ordinal 322
Address 0x30630

NtReleaseSemaphore

Ordinal 323
Address 0x304d0

NtRemoveIoCompletion

Ordinal 324
Address 0x304c0

NtRemoveProcessDebug

Ordinal 325
Address 0x312b0

NtRenameKey

Ordinal 326
Address 0x312c0

NtReplaceKey

Ordinal 327
Address 0x312d0

NtReplyPort

Ordinal 328
Address 0x304f0

NtReplyWaitReceivePort

Ordinal 329
Address 0x304e0

NtReplyWaitReceivePortEx

Ordinal 330
Address 0x306e0

NtReplyWaitReplyPort

Ordinal 331
Address 0x312e0

NtRequestDeviceWakeup

Ordinal 332
Address 0x312f0

NtRequestPort

Ordinal 333
Address 0x31300

NtRequestWaitReplyPort

Ordinal 334
Address 0x30650

NtRequestWakeupLatency

Ordinal 335
Address 0x31310

NtResetEvent

Ordinal 336
Address 0x31320

NtResetWriteWatch

Ordinal 337
Address 0x31330

NtRestoreKey

Ordinal 338
Address 0x31340

NtResumeProcess

Ordinal 339
Address 0x31350

NtResumeThread

Ordinal 340
Address 0x30950

NtSaveKey

Ordinal 341
Address 0x31360

NtSaveKeyEx

Ordinal 342
Address 0x31370

NtSaveMergedKeys

Ordinal 343
Address 0x31380

NtSecureConnectPort

Ordinal 344
Address 0x31390

NtSetBootEntryOrder

Ordinal 345
Address 0x313a0

NtSetBootOptions

Ordinal 346
Address 0x313b0

NtSetContextThread

Ordinal 347
Address 0x313c0

NtSetDebugFilterState

Ordinal 348
Address 0x313d0

NtSetDefaultHardErrorPort

Ordinal 349
Address 0x313e0

NtSetDefaultLocale

Ordinal 350
Address 0x313f0

NtSetDefaultUILanguage

Ordinal 351
Address 0x31400

NtSetDriverEntryOrder

Ordinal 352
Address 0x31410

NtSetEaFile

Ordinal 353
Address 0x31420

NtSetEvent

Ordinal 354
Address 0x30510

NtSetEventBoostPriority

Ordinal 355
Address 0x30700

NtSetHighEventPair

Ordinal 356
Address 0x31430

NtSetHighWaitLowEventPair

Ordinal 357
Address 0x31440

NtSetInformationDebugObject

Ordinal 358
Address 0x31450

NtSetInformationFile

Ordinal 359
Address 0x306a0

NtSetInformationJobObject

Ordinal 360
Address 0x31460

NtSetInformationKey

Ordinal 361
Address 0x31470

NtSetInformationObject

Ordinal 362
Address 0x309f0

NtSetInformationProcess

Ordinal 363
Address 0x305f0

NtSetInformationThread

Ordinal 364
Address 0x30500

NtSetInformationToken

Ordinal 365
Address 0x31480

NtSetIntervalProfile

Ordinal 366
Address 0x31490

NtSetIoCompletion

Ordinal 367
Address 0x314a0

NtSetLdtEntries

Ordinal 368
Address 0x314b0

NtSetLowEventPair

Ordinal 369
Address 0x314c0

NtSetLowWaitHighEventPair

Ordinal 370
Address 0x314d0

NtSetQuotaInformationFile

Ordinal 371
Address 0x314e0

NtSetSecurityObject

Ordinal 372
Address 0x314f0

NtSetSystemEnvironmentValue

Ordinal 373
Address 0x31500

NtSetSystemEnvironmentValueEx

Ordinal 374
Address 0x31510

NtSetSystemInformation

Ordinal 375
Address 0x31520

NtSetSystemPowerState

Ordinal 376
Address 0x31530

NtSetSystemTime

Ordinal 377
Address 0x31540

NtSetThreadExecutionState

Ordinal 378
Address 0x31550

NtSetTimer

Ordinal 379
Address 0x30a50

NtSetTimerResolution

Ordinal 380
Address 0x31560

NtSetUuidSeed

Ordinal 381
Address 0x31570

NtSetValueKey

Ordinal 382
Address 0x30a30

NtSetVolumeInformationFile

Ordinal 383
Address 0x31580

NtShutdownSystem

Ordinal 384
Address 0x31590

NtSignalAndWaitForSingleObject

Ordinal 385
Address 0x315a0

NtStartProfile

Ordinal 386
Address 0x315b0

NtStopProfile

Ordinal 387
Address 0x315c0

NtSuspendProcess

Ordinal 388
Address 0x315d0

NtSuspendThread

Ordinal 389
Address 0x315e0

NtSystemDebugControl

Ordinal 390
Address 0x315f0

NtTerminateJobObject

Ordinal 391
Address 0x31600

NtTerminateProcess

Ordinal 392
Address 0x306f0

NtTerminateThread

Ordinal 393
Address 0x30960

NtTestAlert

Ordinal 394
Address 0x31610

NtTraceEvent

Ordinal 395
Address 0x30a10

NtTranslateFilePath

Ordinal 396
Address 0x31620

NtUnloadDriver

Ordinal 397
Address 0x31630

NtUnloadKey

Ordinal 398
Address 0x31640

NtUnloadKey2

Ordinal 399
Address 0x31650

NtUnloadKeyEx

Ordinal 400
Address 0x31660

NtUnlockFile

Ordinal 401
Address 0x31670

NtUnlockVirtualMemory

Ordinal 402
Address 0x31680

NtUnmapViewOfSection

Ordinal 403
Address 0x306d0

NtVdmControl

Ordinal 404
Address 0x31690

NtWaitForDebugEvent

Ordinal 405
Address 0x316a0

NtWaitForKeyedEvent

Ordinal 406
Address 0x316b0

NtWaitForMultipleObjects

Ordinal 407
Address 0x309e0

NtWaitForMultipleObjects32

Ordinal 408
Address 0x305d0

NtWaitForSingleObject

Ordinal 409
Address 0x30470

NtWaitHighEventPair

Ordinal 410
Address 0x316c0

NtWaitLowEventPair

Ordinal 411
Address 0x316d0

NtWriteFile

Ordinal 412
Address 0x304b0

NtWriteFileGather

Ordinal 413
Address 0x305e0

NtWriteRequestData

Ordinal 414
Address 0x309a0

NtWriteVirtualMemory

Ordinal 415
Address 0x307d0

NtYieldExecution

Ordinal 416
Address 0x30890

PfxFindPrefix

Ordinal 417
Address 0x73eb0

PfxInitialize

Ordinal 418
Address 0x73b70

PfxInsertPrefix

Ordinal 419
Address 0x73b90

PfxRemovePrefix

Ordinal 420
Address 0x73d60

RtlAbortRXact

Ordinal 421
Address 0x287c0

RtlAbsoluteToSelfRelativeSD

Ordinal 422
Address 0x3cc80

RtlAcquirePebLock

Ordinal 423
Address 0x38260

RtlAcquirePrivilege

Ordinal 424
Address 0x7df0

RtlAcquireResourceExclusive

Ordinal 425
Address 0x2e440

RtlAcquireResourceShared

Ordinal 426
Address 0x2e570

RtlActivateActivationContext

Ordinal 427
Address 0x2ca70

RtlActivateActivationContextEx

Ordinal 428
Address 0x21a70

RtlActivateActivationContextUnsafeFast

Ordinal 429
Address 0x34410

RtlAddAccessAllowedAce

Ordinal 430
Address 0x3a580

RtlAddAccessAllowedAceEx

Ordinal 431
Address 0x10a40

RtlAddAccessAllowedObjectAce

Ordinal 432
Address 0x78c90

RtlAddAccessDeniedAce

Ordinal 433
Address 0x2f00

RtlAddAccessDeniedAceEx

Ordinal 434
Address 0x1f20

RtlAddAccessDeniedObjectAce

Ordinal 435
Address 0x78cf0

RtlAddAce

Ordinal 436
Address 0x19da0

RtlAddActionToRXact

Ordinal 437
Address 0x10e00

RtlAddAtomToAtomTable

Ordinal 438
Address 0x12890

RtlAddAttributeActionToRXact

Ordinal 439
Address 0x10a70

RtlAddAuditAccessAce

Ordinal 440
Address 0x1ed0

RtlAddAuditAccessAceEx

Ordinal 441
Address 0x78c50

RtlAddAuditAccessObjectAce

Ordinal 442
Address 0x78d50

RtlAddCompoundAce

Ordinal 443
Address 0x78890

RtlAddFunctionTable

Ordinal 444
Address 0x79fa0

RtlAddRefActivationContext

Ordinal 445
Address 0x2ffb0

RtlAddRefMemoryStream

Ordinal 446
Address 0x27280

RtlAddVectoredContinueHandler

Ordinal 447
Address 0x65bf0

RtlAddVectoredExceptionHandler

Ordinal 448
Address 0x4f760

RtlAddressInSectionTable

Ordinal 449
Address 0x10150

RtlAdjustPrivilege

Ordinal 450
Address 0x28b40

RtlAllocateActivationContextStack

Ordinal 451
Address 0x3aa70

RtlAllocateAndInitializeSid

Ordinal 452
Address 0x3a5b0

RtlAllocateHandle

Ordinal 453
Address 0x12620

RtlAllocateHeap

Ordinal 454
Address 0x335e0

RtlAnsiCharToUnicodeChar

Ordinal 455
Address 0x23490

RtlAnsiStringToUnicodeSize

Ordinal 456
Address 0x7e710

RtlAnsiStringToUnicodeString

Ordinal 457
Address 0x34710

RtlAppendAsciizToString

Ordinal 458
Address 0x7f380

RtlAppendPathElement

Ordinal 459
Address 0x57a60

RtlAppendStringToString

Ordinal 460
Address 0x7f410

RtlAppendUnicodeStringToString

Ordinal 461
Address 0x2cf30

RtlAppendUnicodeToString

Ordinal 462
Address 0x39cc0

RtlApplicationVerifierStop

Ordinal 463
Address 0x67f90

RtlApplyRXact

Ordinal 464
Address 0x10e60

RtlApplyRXactNoFlush

Ordinal 465
Address 0x23c0

RtlAreAllAccessesGranted

Ordinal 466
Address 0x3ca90

RtlAreAnyAccessesGranted

Ordinal 467
Address 0x50ea0

RtlAreBitsClear

Ordinal 468
Address 0x807c0

RtlAreBitsSet

Ordinal 469
Address 0xca00

RtlAssert

Ordinal 470
Address 0x80b10

RtlCancelTimer

Ordinal 471
Address 0x81eb0

RtlCaptureContext

Ordinal 472
Address 0x32d40

RtlCaptureStackBackTrace

Ordinal 473
Address 0x81f70

RtlCharToInteger

Ordinal 474
Address 0x8a50

RtlCheckForOrphanedCriticalSections

Ordinal 475
Address 0x1ba90

RtlCheckProcessParameters

Ordinal 476
Address 0x4fc0

RtlCheckRegistryKey

Ordinal 477
Address 0x28e0

RtlClearAllBits

Ordinal 478
Address 0x4610

RtlClearBits

Ordinal 479
Address 0xc990

RtlCloneMemoryStream

Ordinal 480
Address 0x612b0

RtlCommitMemoryStream

Ordinal 481
Address 0x612b0

RtlCompactHeap

Ordinal 482
Address 0x866a0

RtlCompareMemory

Ordinal 483
Address 0x32830

RtlCompareMemoryUlong

Ordinal 484
Address 0x328e0

RtlCompareString

Ordinal 485
Address 0x7f030

RtlCompareUnicodeString

Ordinal 486
Address 0x3acb0

RtlCompressBuffer

Ordinal 487
Address 0x89b50

RtlComputeCrc32

Ordinal 488
Address 0x89f80

RtlComputeImportTableHash

Ordinal 489
Address 0x6d6a0

RtlComputePrivatizedDllName_U

Ordinal 490
Address 0x60d40

RtlConsoleMultiByteToUnicodeN

Ordinal 491
Address 0x37200

RtlConvertExclusiveToShared

Ordinal 492
Address 0xe200

RtlConvertSharedToExclusive

Ordinal 493
Address 0xe1b0

RtlConvertSidToUnicodeString

Ordinal 494
Address 0x3af20

RtlConvertToAutoInheritSecurityObject

Ordinal 495
Address 0x627e0

RtlConvertUiListToApiList

Ordinal 496
Address 0x62f50

RtlCopyLuid

Ordinal 497
Address 0x286a0

RtlCopyLuidAndAttributesArray

Ordinal 498
Address 0x74bb0

RtlCopyMappedMemory

Ordinal 499
Address 0x8a510

RtlCopyMemory

Ordinal 500
Address 0x31850

RtlCopyMemoryNonTemporal

Ordinal 501
Address 0x32920

RtlCopyMemoryStreamTo

Ordinal 502
Address 0x61230

RtlCopyOutOfProcessMemoryStreamTo

Ordinal 503
Address 0x612b0

RtlCopySecurityDescriptor

Ordinal 504
Address 0x5010

RtlCopySid

Ordinal 505
Address 0x3a290

RtlCopySidAndAttributesArray

Ordinal 506
Address 0x74830

RtlCopyString

Ordinal 507
Address 0xd070

RtlCopyUnicodeString

Ordinal 508
Address 0x2cfd0

RtlCreateAcl

Ordinal 509
Address 0x3a400

RtlCreateActivationContext

Ordinal 510
Address 0xdf00

RtlCreateAndSetSD

Ordinal 511
Address 0x6ad0

RtlCreateAtomTable

Ordinal 512
Address 0xbd30

RtlCreateBootStatusDataFile

Ordinal 513
Address 0x8a570

RtlCreateEnvironment

Ordinal 514
Address 0x1a940

RtlCreateHeap

Ordinal 515
Address 0x18b80

RtlCreateProcessParameters

Ordinal 516
Address 0x15730

RtlCreateQueryDebugBuffer

Ordinal 517
Address 0x63900

RtlCreateRegistryKey

Ordinal 518
Address 0x83e80

RtlCreateSecurityDescriptor

Ordinal 519
Address 0x3a370

RtlCreateServiceSid

Ordinal 520
Address 0x749c0

RtlCreateSystemVolumeInformationFolder

Ordinal 521
Address 0x8c350

RtlCreateTagHeap

Ordinal 522
Address 0x166b0

RtlCreateTimer

Ordinal 523
Address 0x29830

RtlCreateTimerQueue

Ordinal 524
Address 0x7860

RtlCreateUnicodeString

Ordinal 525
Address 0x5ca0

RtlCreateUnicodeStringFromAsciiz

Ordinal 526
Address 0x24c60

RtlCreateUserProcess

Ordinal 527
Address 0x5d60

RtlCreateUserSecurityObject

Ordinal 528
Address 0x7170

RtlCreateUserThread

Ordinal 529
Address 0x9a60

RtlCustomCPToUnicodeN

Ordinal 530
Address 0x72ba0

RtlCutoverTimeToSystemTime

Ordinal 531
Address 0x6f50

RtlDeNormalizeProcessParams

Ordinal 532
Address 0x141f0

RtlDeactivateActivationContext

Ordinal 533
Address 0x2cca0

RtlDeactivateActivationContextUnsafeFast

Ordinal 534
Address 0x342d0

RtlDebugPrintTimes

Ordinal 535
Address 0x81e70

RtlDecodePointer

Ordinal 536
Address 0x19600

RtlDecodeSystemPointer

Ordinal 537
Address 0x69090

RtlDecompressBuffer

Ordinal 538
Address 0x89c10

RtlDecompressFragment

Ordinal 539
Address 0x89d10

RtlDefaultNpAcl

Ordinal 540
Address 0x62810

RtlDelete

Ordinal 541
Address 0x8c710

RtlDeleteAce

Ordinal 542
Address 0x51460

RtlDeleteAtomFromAtomTable

Ordinal 543
Address 0xc6a0

RtlDeleteCriticalSection

Ordinal 544
Address 0x3bc30

RtlDeleteElementGenericTable

Ordinal 545
Address 0xa190

RtlDeleteElementGenericTableAvl

Ordinal 546
Address 0x8d230

RtlDeleteFunctionTable

Ordinal 547
Address 0x7a420

RtlDeleteNoSplay

Ordinal 548
Address 0x8c7c0

RtlDeleteRegistryValue

Ordinal 549
Address 0x83ed0

RtlDeleteResource

Ordinal 550
Address 0x100b0

RtlDeleteSecurityObject

Ordinal 551
Address 0x22680

RtlDeleteTimer

Ordinal 552
Address 0x2b640

RtlDeleteTimerQueue

Ordinal 553
Address 0x81980

RtlDeleteTimerQueueEx

Ordinal 554
Address 0x81760

RtlDeregisterWait

Ordinal 555
Address 0x1da90

RtlDeregisterWaitEx

Ordinal 556
Address 0x2b3b0

RtlDestroyAtomTable

Ordinal 557
Address 0x78ee0

RtlDestroyEnvironment

Ordinal 558
Address 0x1ab50

RtlDestroyHandleTable

Ordinal 559
Address 0xcdd0

RtlDestroyHeap

Ordinal 560
Address 0xfdc0

RtlDestroyProcessParameters

Ordinal 561
Address 0x142b0

RtlDestroyQueryDebugBuffer

Ordinal 562
Address 0x63ac0

RtlDetermineDosPathNameType_U

Ordinal 563
Address 0x33f30

RtlDllShutdownInProgress

Ordinal 564
Address 0x3ca50

RtlDnsHostNameToComputerName

Ordinal 565
Address 0x1c990

RtlDoesFileExists_U

Ordinal 566
Address 0x15200

RtlDosApplyFileIsolationRedirection_Ustr

Ordinal 567
Address 0x38b80

RtlDosPathNameToNtPathName_U

Ordinal 568
Address 0x2e630

RtlDosPathNameToNtPathName_U_WithStatus

Ordinal 569
Address 0x50b30

RtlDosPathNameToRelativeNtPathName_U

Ordinal 570
Address 0x26d90

RtlDosPathNameToRelativeNtPathName_U_WithStatus

Ordinal 571
Address 0x352d0

RtlDosSearchPath_U

Ordinal 572
Address 0x74c0

RtlDosSearchPath_Ustr

Ordinal 573
Address 0x1b270

RtlDowncaseUnicodeChar

Ordinal 574
Address 0x7e650

RtlDowncaseUnicodeString

Ordinal 575
Address 0x23880

RtlDumpResource

Ordinal 576
Address 0x61830

RtlDuplicateUnicodeString

Ordinal 577
Address 0x8840

RtlEmptyAtomTable

Ordinal 578
Address 0x79020

RtlEnableEarlyCriticalSectionEventCreation

Ordinal 579
Address 0x61910

RtlEncodePointer

Ordinal 580
Address 0x19600

RtlEncodeSystemPointer

Ordinal 581
Address 0x69090

RtlEnterCriticalSection

Ordinal 582
Address 0x30420

RtlEnumProcessHeaps

Ordinal 583
Address 0x86df0

RtlEnumerateGenericTable

Ordinal 584
Address 0x8cb70

RtlEnumerateGenericTableAvl

Ordinal 585
Address 0x1b30

RtlEnumerateGenericTableLikeADirectory

Ordinal 586
Address 0x8d860

RtlEnumerateGenericTableWithoutSplaying

Ordinal 587
Address 0xf980

RtlEnumerateGenericTableWithoutSplayingAvl

Ordinal 588
Address 0x8d7d0

RtlEqualComputerName

Ordinal 589
Address 0x7e9c0

RtlEqualDomainName

Ordinal 590
Address 0x2af70

RtlEqualLuid

Ordinal 591
Address 0x74b90

RtlEqualPrefixSid

Ordinal 592
Address 0x74780

RtlEqualSid

Ordinal 593
Address 0x3b720

RtlEqualString

Ordinal 594
Address 0x23010

RtlEqualUnicodeString

Ordinal 595
Address 0x347d0

RtlEraseUnicodeString

Ordinal 596
Address 0x8c90

RtlExitUserThread

Ordinal 597
Address 0x4fe00

RtlExpandEnvironmentStrings_U

Ordinal 598
Address 0x22e30

RtlExtendHeap

Ordinal 599
Address 0x86310

RtlFillMemory

Ordinal 600
Address 0x32a60

RtlFinalReleaseOutOfProcessMemoryStream

Ordinal 601
Address 0x1bc70

RtlFindActivationContextSectionGuid

Ordinal 602
Address 0x26600

RtlFindActivationContextSectionString

Ordinal 603
Address 0x37f80

RtlFindCharInUnicodeString

Ordinal 604
Address 0x38910

RtlFindClearBits

Ordinal 605
Address 0x12e20

RtlFindClearBitsAndSet

Ordinal 606
Address 0x12c50

RtlFindClearRuns

Ordinal 607
Address 0x7fe20

RtlFindLastBackwardRunClear

Ordinal 608
Address 0x809f0

RtlFindLeastSignificantBit

Ordinal 609
Address 0x80af0

RtlFindLongestRunClear

Ordinal 610
Address 0x80350

RtlFindMessage

Ordinal 611
Address 0x16de0

RtlFindMostSignificantBit

Ordinal 612
Address 0x80ad0

RtlFindNextForwardRunClear

Ordinal 613
Address 0x808c0

RtlFindSetBits

Ordinal 614
Address 0x7f790

RtlFindSetBitsAndClear

Ordinal 615
Address 0x7fca0

RtlFirstEntrySList

Ordinal 616
Address 0x316f0

RtlFirstFreeAce

Ordinal 617
Address 0x78de0

RtlFlushSecureMemoryCache

Ordinal 618
Address 0x8e7a0

RtlFormatCurrentUserKeyPath

Ordinal 619
Address 0x3b0c0

RtlFormatMessage

Ordinal 620
Address 0x1190

RtlFormatMessageEx

Ordinal 621
Address 0x24690

RtlFreeActivationContextStack

Ordinal 622
Address 0x28d50

RtlFreeAnsiString

Ordinal 623
Address 0x34c10

RtlFreeHandle

Ordinal 624
Address 0x104b0

RtlFreeHeap

Ordinal 625
Address 0x333b0

RtlFreeOemString

Ordinal 626
Address 0x8b80

RtlFreeSid

Ordinal 627
Address 0x3a6a0

RtlFreeThreadActivationContextStack

Ordinal 628
Address 0x6a8f0

RtlFreeUnicodeString

Ordinal 629
Address 0x34c10

RtlFreeUserThreadStack

Ordinal 630
Address 0x8b940

RtlGUIDFromString

Ordinal 631
Address 0x1c6f0

RtlGenerate8dot3Name

Ordinal 632
Address 0x8e960

RtlGetAce

Ordinal 633
Address 0x1aa00

RtlGetActiveActivationContext

Ordinal 634
Address 0x29120

RtlGetCallersAddress

Ordinal 635
Address 0x82020

RtlGetCompressionWorkSpaceSize

Ordinal 636
Address 0x89ac0

RtlGetControlSecurityDescriptor

Ordinal 637
Address 0x19f20

RtlGetCriticalSectionRecursionCount

Ordinal 638
Address 0x36ff0

RtlGetCurrentDirectory_U

Ordinal 639
Address 0x147c0

RtlGetCurrentPeb

Ordinal 640
Address 0x82ba0

RtlGetCurrentProcessorNumber

Ordinal 641
Address 0x324d0

RtlGetDaclSecurityDescriptor

Ordinal 642
Address 0x3b370

RtlGetElementGenericTable

Ordinal 643
Address 0x50600

RtlGetElementGenericTableAvl

Ordinal 644
Address 0x8d550

RtlGetFrame

Ordinal 645
Address 0x58760

RtlGetFullPathName_U

Ordinal 646
Address 0x35410

RtlGetFullPathName_UstrEx

Ordinal 647
Address 0x2f5a0

RtlGetFunctionTableListHead

Ordinal 648
Address 0x79f90

RtlGetGroupSecurityDescriptor

Ordinal 649
Address 0x3ce20

RtlGetLastNtStatus

Ordinal 650
Address 0x8f760

RtlGetLastWin32Error

Ordinal 651
Address 0x347f0

RtlGetLengthWithoutLastFullDosOrNtPathElement

Ordinal 652
Address 0x11db0

RtlGetLengthWithoutTrailingPathSeperators

Ordinal 653
Address 0x9370

RtlGetLongestNtPathLength

Ordinal 654
Address 0x23000

RtlGetNativeSystemInformation

Ordinal 655
Address 0x30790

RtlGetNtGlobalFlags

Ordinal 656
Address 0x5a90

RtlGetNtProductType

Ordinal 657
Address 0x52d00

RtlGetNtVersionNumbers

Ordinal 658
Address 0x14160

RtlGetOwnerSecurityDescriptor

Ordinal 659
Address 0x3cde0

RtlGetProcessHeaps

Ordinal 660
Address 0x86b90

RtlGetSaclSecurityDescriptor

Ordinal 661
Address 0xf830

RtlGetSecurityDescriptorRMControl

Ordinal 662
Address 0x78260

RtlGetSetBootStatusData

Ordinal 663
Address 0x1720

RtlGetThreadErrorMode

Ordinal 664
Address 0x58740

RtlGetUnloadEventTrace

Ordinal 665
Address 0x598b0

RtlGetUserInfoHeap

Ordinal 666
Address 0x1afc0

RtlGetVersion

Ordinal 667
Address 0x18330

RtlHashUnicodeString

Ordinal 668
Address 0x3c0b0

RtlIdentifierAuthoritySid

Ordinal 669
Address 0x286f0

RtlImageDirectoryEntryToData

Ordinal 670
Address 0x37ee0

RtlImageNtHeader

Ordinal 671
Address 0x393c0

RtlImageNtHeaderEx

Ordinal 672
Address 0x37da0

RtlImageRvaToSection

Ordinal 673
Address 0x12330

RtlImageRvaToVa

Ordinal 674
Address 0x1410

RtlImpersonateSelf

Ordinal 675
Address 0xb590

RtlInitAnsiString

Ordinal 676
Address 0x37520

RtlInitAnsiStringEx

Ordinal 677
Address 0x35350

RtlInitCodePageTable

Ordinal 678
Address 0x8710

RtlInitMemoryStream

Ordinal 679
Address 0x274d0

RtlInitNlsTables

Ordinal 680
Address 0x15bd0

RtlInitOutOfProcessMemoryStream

Ordinal 681
Address 0x1bb10

RtlInitString

Ordinal 682
Address 0x37520

RtlInitUnicodeString

Ordinal 683
Address 0x332f0

RtlInitUnicodeStringEx

Ordinal 684
Address 0x33350

RtlInitializeAtomPackage

Ordinal 685
Address 0x78eb0

RtlInitializeBitMap

Ordinal 686
Address 0x4600

RtlInitializeContext

Ordinal 687
Address 0x9c00

RtlInitializeCriticalSection

Ordinal 688
Address 0x28180

RtlInitializeCriticalSectionAndSpinCount

Ordinal 689
Address 0x554c0

RtlInitializeGenericTable

Ordinal 690
Address 0xc510

RtlInitializeGenericTableAvl

Ordinal 691
Address 0x1a80

RtlInitializeHandleTable

Ordinal 692
Address 0x13030

RtlInitializeRXact

Ordinal 693
Address 0x1b60

RtlInitializeResource

Ordinal 694
Address 0x12180

RtlInitializeSListHead

Ordinal 695
Address 0xddc0

RtlInitializeSid

Ordinal 696
Address 0x283a0

RtlInsertElementGenericTable

Ordinal 697
Address 0x9e80

RtlInsertElementGenericTableAvl

Ordinal 698
Address 0x8d000

RtlInsertElementGenericTableFull

Ordinal 699
Address 0x9f30

RtlInsertElementGenericTableFullAvl

Ordinal 700
Address 0x8d0d0

RtlInstallFunctionTableCallback

Ordinal 701
Address 0x7a270

RtlInt64ToUnicodeString

Ordinal 702
Address 0x82a60

RtlIntegerToChar

Ordinal 703
Address 0x28190

RtlIntegerToUnicodeString

Ordinal 704
Address 0x282b0

RtlInterlockedFlushSList

Ordinal 705
Address 0x44b0

RtlInterlockedPopEntrySList

Ordinal 706
Address 0x31710

RtlInterlockedPushEntrySList

Ordinal 707
Address 0x44a0

RtlInterlockedPushListSList

Ordinal 708
Address 0x317e0

RtlIpv4AddressToStringA

Ordinal 709
Address 0x90650

RtlIpv4AddressToStringExA

Ordinal 710
Address 0x906a0

RtlIpv4AddressToStringExW

Ordinal 711
Address 0x1c5c0

RtlIpv4AddressToStringW

Ordinal 712
Address 0x90c40

RtlIpv4StringToAddressA

Ordinal 713
Address 0x26a80

RtlIpv4StringToAddressExA

Ordinal 714
Address 0x91670

RtlIpv4StringToAddressExW

Ordinal 715
Address 0x92120

RtlIpv4StringToAddressW

Ordinal 716
Address 0x27cc0

RtlIpv6AddressToStringA

Ordinal 717
Address 0x901f0

RtlIpv6AddressToStringExA

Ordinal 718
Address 0x904f0

RtlIpv6AddressToStringExW

Ordinal 719
Address 0x90ae0

RtlIpv6AddressToStringW

Ordinal 720
Address 0x907b0

RtlIpv6StringToAddressA

Ordinal 721
Address 0x90cc0

RtlIpv6StringToAddressExA

Ordinal 722
Address 0x912a0

RtlIpv6StringToAddressExW

Ordinal 723
Address 0x91d50

RtlIpv6StringToAddressW

Ordinal 724
Address 0x91870

RtlIsActivationContextActive

Ordinal 725
Address 0x6a9a0

RtlIsCriticalSectionLocked

Ordinal 726
Address 0x612f0

RtlIsCriticalSectionLockedByThread

Ordinal 727
Address 0x61310

RtlIsDosDeviceName_U

Ordinal 728
Address 0x26d20

RtlIsGenericTableEmpty

Ordinal 729
Address 0xfa00

RtlIsGenericTableEmptyAvl

Ordinal 730
Address 0x8d540

RtlIsNameLegalDOS8Dot3

Ordinal 731
Address 0x8f540

RtlIsTextUnicode

Ordinal 732
Address 0x23040

RtlIsThreadWithinLoaderCallout

Ordinal 733
Address 0x4b70

RtlIsValidHandle

Ordinal 734
Address 0x12ae0

RtlIsValidIndexHandle

Ordinal 735
Address 0x87f0

RtlLargeIntegerToChar

Ordinal 736
Address 0x827b0

RtlLeaveCriticalSection

Ordinal 737
Address 0x332a0

RtlLengthRequiredSid

Ordinal 738
Address 0x284a0

RtlLengthSecurityDescriptor

Ordinal 739
Address 0x3cd00

RtlLengthSid

Ordinal 740
Address 0x3a230

RtlLocalTimeToSystemTime

Ordinal 741
Address 0x73af0

RtlLockBootStatusData

Ordinal 742
Address 0x18b0

RtlLockHeap

Ordinal 743
Address 0x2ff10

RtlLockMemoryStreamRegion

Ordinal 744
Address 0x612b0

RtlLogStackBackTrace

Ordinal 745
Address 0x925f0

RtlLookupAtomInAtomTable

Ordinal 746
Address 0xd220

RtlLookupElementGenericTable

Ordinal 747
Address 0x8620

RtlLookupElementGenericTableAvl

Ordinal 748
Address 0x8d340

RtlLookupElementGenericTableFull

Ordinal 749
Address 0x8ca90

RtlLookupElementGenericTableFullAvl

Ordinal 750
Address 0x8d3e0

RtlLookupFunctionEntry

Ordinal 751
Address 0x25400

RtlLookupFunctionTable

Ordinal 752
Address 0x24010

RtlMakeSelfRelativeSD

Ordinal 753
Address 0x3caa0

RtlMapGenericMask

Ordinal 754
Address 0x3ca00

RtlMapSecurityErrorToNtStatus

Ordinal 755
Address 0x78460

RtlMoveMemory

Ordinal 756
Address 0x31850

RtlMultiAppendUnicodeStringBuffer

Ordinal 757
Address 0x22b90

RtlMultiByteToUnicodeN

Ordinal 758
Address 0x344b0

RtlMultiByteToUnicodeSize

Ordinal 759
Address 0x23470

RtlMultipleAllocateHeap

Ordinal 760
Address 0x89570

RtlMultipleFreeHeap

Ordinal 761
Address 0x89630

RtlNewInstanceSecurityObject

Ordinal 762
Address 0x62370

RtlNewSecurityGrantedAccess

Ordinal 763
Address 0x62480

RtlNewSecurityObject

Ordinal 764
Address 0x3dc0

RtlNewSecurityObjectEx

Ordinal 765
Address 0x21950

RtlNewSecurityObjectWithMultipleInheritance

Ordinal 766
Address 0x62020

RtlNormalizeProcessParams

Ordinal 767
Address 0x142e0

RtlNtPathNameToDosPathName

Ordinal 768
Address 0x275d0

RtlNtStatusToDosError

Ordinal 769
Address 0x37580

RtlNtStatusToDosErrorNoTeb

Ordinal 770
Address 0x375b0

RtlNumberGenericTableElements

Ordinal 771
Address 0xcdc0

RtlNumberGenericTableElementsAvl

Ordinal 772
Address 0x8d7c0

RtlNumberOfClearBits

Ordinal 773
Address 0x80790

RtlNumberOfSetBits

Ordinal 774
Address 0x803a0

RtlOemStringToUnicodeSize

Ordinal 775
Address 0x7e710

RtlOemStringToUnicodeString

Ordinal 776
Address 0x27c00

RtlOemToUnicodeN

Ordinal 777
Address 0x27980

RtlOpenCurrentUser

Ordinal 778
Address 0x3bad0

RtlPcToFileHeader

Ordinal 779
Address 0xf530

RtlPinAtomInAtomTable

Ordinal 780
Address 0x794b0

RtlPopFrame

Ordinal 781
Address 0x26f70

RtlPrefixString

Ordinal 782
Address 0x2fb0

RtlPrefixUnicodeString

Ordinal 783
Address 0x29170

RtlProtectHeap

Ordinal 784
Address 0x84660

RtlPushFrame

Ordinal 785
Address 0x26f90

RtlQueryAtomInAtomTable

Ordinal 786
Address 0xc780

RtlQueryDepthSList

Ordinal 787
Address 0x901e0

RtlQueryEnvironmentVariable_U

Ordinal 788
Address 0x37a70

RtlQueryHeapInformation

Ordinal 789
Address 0x89520

RtlQueryInformationAcl

Ordinal 790
Address 0x19f40

RtlQueryInformationActivationContext

Ordinal 791
Address 0x3a6f0

RtlQueryInformationActiveActivationContext

Ordinal 792
Address 0x1fbe0

RtlQueryInterfaceMemoryStream

Ordinal 793
Address 0x271e0

RtlQueryProcessBackTraceInformation

Ordinal 794
Address 0x63fb0

RtlQueryProcessDebugInformation

Ordinal 795
Address 0x63b20

RtlQueryProcessHeapInformation

Ordinal 796
Address 0x640f0

RtlQueryProcessLockInformation

Ordinal 797
Address 0x64a30

RtlQueryRegistryValues

Ordinal 798
Address 0x6540

RtlQuerySecurityObject

Ordinal 799
Address 0x620b0

RtlQueryTagHeap

Ordinal 800
Address 0x860d0

RtlQueryTimeZoneInformation

Ordinal 801
Address 0x83fd0

RtlQueueApcWow64Thread

Ordinal 802
Address 0x69020

RtlQueueWorkItem

Ordinal 803
Address 0x2a290

RtlRaiseException

Ordinal 804
Address 0x260d0

RtlRaiseStatus

Ordinal 805
Address 0x93af0

RtlRandom

Ordinal 806
Address 0x93bc0

RtlRandomEx

Ordinal 807
Address 0x93c40

RtlReAllocateHeap

Ordinal 808
Address 0x2ea40

RtlReadMemoryStream

Ordinal 809
Address 0x27500

RtlReadOutOfProcessMemoryStream

Ordinal 810
Address 0x1bb50

RtlRealPredecessor

Ordinal 811
Address 0x8c950

RtlRealSuccessor

Ordinal 812
Address 0x8c8f0

RtlRegisterSecureMemoryCacheCallback

Ordinal 813
Address 0x8e750

RtlRegisterWait

Ordinal 814
Address 0x29d00

RtlReleaseActivationContext

Ordinal 815
Address 0x219c0

RtlReleaseMemoryStream

Ordinal 816
Address 0x271b0

RtlReleasePebLock

Ordinal 817
Address 0x38200

RtlReleasePrivilege

Ordinal 818
Address 0x4fec0

RtlReleaseRelativeName

Ordinal 819
Address 0x35290

RtlReleaseResource

Ordinal 820
Address 0x2e400

RtlRemoteCall

Ordinal 821
Address 0x8ffe0

RtlRemoveVectoredContinueHandler

Ordinal 822
Address 0x65dd0

RtlRemoveVectoredExceptionHandler

Ordinal 823
Address 0x4f8a0

RtlResetRtlTranslations

Ordinal 824
Address 0x165a0

RtlRestoreContext

Ordinal 825
Address 0x32e90

RtlRestoreLastWin32Error

Ordinal 826
Address 0x349f0

RtlRevertMemoryStream

Ordinal 827
Address 0x612b0

RtlRunDecodeUnicodeString

Ordinal 828
Address 0x8bf0

RtlRunEncodeUnicodeString

Ordinal 829
Address 0x9db0

RtlSecondsSince1970ToTime

Ordinal 830
Address 0x73ac0

RtlSecondsSince1980ToTime

Ordinal 831
Address 0x73a70

RtlSeekMemoryStream

Ordinal 832
Address 0x611d0

RtlSelfRelativeToAbsoluteSD

Ordinal 833
Address 0x52b20

RtlSelfRelativeToAbsoluteSD2

Ordinal 834
Address 0x74560

RtlSetAllBits

Ordinal 835
Address 0x4630

RtlSetAttributesSecurityDescriptor

Ordinal 836
Address 0x74c10

RtlSetBits

Ordinal 837
Address 0x17890

RtlSetControlSecurityDescriptor

Ordinal 838
Address 0x4210

RtlSetCriticalSectionSpinCount

Ordinal 839
Address 0x3bc80

RtlSetCurrentDirectory_U

Ordinal 840
Address 0x15270

RtlSetCurrentEnvironment

Ordinal 841
Address 0x8a9b0

RtlSetDaclSecurityDescriptor

Ordinal 842
Address 0x3a3a0

RtlSetEnvironmentStrings

Ordinal 843
Address 0x30c0

RtlSetEnvironmentVariable

Ordinal 844
Address 0x1a830

RtlSetGroupSecurityDescriptor

Ordinal 845
Address 0x3c950

RtlSetHeapInformation

Ordinal 846
Address 0x19cd0

RtlSetInformationAcl

Ordinal 847
Address 0x787f0

RtlSetIoCompletionCallback

Ordinal 848
Address 0x2da0

RtlSetLastWin32Error

Ordinal 849
Address 0x349f0

RtlSetLastWin32ErrorAndNtStatusFromNtStatus

Ordinal 850
Address 0x10a10

RtlSetMemoryStreamSize

Ordinal 851
Address 0x612b0

RtlSetOwnerSecurityDescriptor

Ordinal 852
Address 0x3c9a0

RtlSetProcessIsCritical

Ordinal 853
Address 0x1650

RtlSetSaclSecurityDescriptor

Ordinal 854
Address 0x89a0

RtlSetSecurityDescriptorRMControl

Ordinal 855
Address 0x78280

RtlSetSecurityObject

Ordinal 856
Address 0x4690

RtlSetSecurityObjectEx

Ordinal 857
Address 0x62070

RtlSetThreadErrorMode

Ordinal 858
Address 0x23b30

RtlSetThreadIsCritical

Ordinal 859
Address 0x1560

RtlSetThreadPoolStartFunc

Ordinal 860
Address 0x13660

RtlSetTimeZoneInformation

Ordinal 861
Address 0x841b0

RtlSetTimer

Ordinal 862
Address 0x81e80

RtlSetUnhandledExceptionFilter

Ordinal 863
Address 0x13610

RtlSetUnicodeCallouts

Ordinal 864
Address 0x81e70

RtlSetUserFlagsHeap

Ordinal 865
Address 0x85ad0

RtlSetUserValueHeap

Ordinal 866
Address 0x129c0

RtlSizeHeap

Ordinal 867
Address 0x23e50

RtlSplay

Ordinal 868
Address 0x9e30

RtlStartRXact

Ordinal 869
Address 0x28700

RtlStatMemoryStream

Ordinal 870
Address 0x1bbe0

RtlStringFromGUID

Ordinal 871
Address 0x23b90

RtlSubAuthorityCountSid

Ordinal 872
Address 0x286b0

RtlSubAuthoritySid

Ordinal 873
Address 0x28390

RtlSubtreePredecessor

Ordinal 874
Address 0x8c8c0

RtlSubtreeSuccessor

Ordinal 875
Address 0x8c890

RtlSystemTimeToLocalTime

Ordinal 876
Address 0x28990

RtlTimeFieldsToTime

Ordinal 877
Address 0x35760

RtlTimeToElapsedTimeFields

Ordinal 878
Address 0x73980

RtlTimeToSecondsSince1970

Ordinal 879
Address 0x28770

RtlTimeToSecondsSince1980

Ordinal 880
Address 0x28650

RtlTimeToTimeFields

Ordinal 881
Address 0x35520

RtlTraceDatabaseAdd

Ordinal 882
Address 0x943a0

RtlTraceDatabaseCreate

Ordinal 883
Address 0x93fe0

RtlTraceDatabaseDestroy

Ordinal 884
Address 0x94150

RtlTraceDatabaseEnumerate

Ordinal 885
Address 0x94940

RtlTraceDatabaseFind

Ordinal 886
Address 0x94470

RtlTraceDatabaseLock

Ordinal 887
Address 0x948a0

RtlTraceDatabaseUnlock

Ordinal 888
Address 0x948d0

RtlTraceDatabaseValidate

Ordinal 889
Address 0x94250

RtlTryEnterCriticalSection

Ordinal 890
Address 0x301e0

RtlUnhandledExceptionFilter

Ordinal 891
Address 0x94a60

RtlUnhandledExceptionFilter2

Ordinal 892
Address 0x94a70

RtlUnicodeStringToAnsiSize

Ordinal 893
Address 0x7e6b0

RtlUnicodeStringToAnsiString

Ordinal 894
Address 0x34c40

RtlUnicodeStringToCountedOemString

Ordinal 895
Address 0x7e280

RtlUnicodeStringToInteger

Ordinal 896
Address 0x3b260

RtlUnicodeStringToOemSize

Ordinal 897
Address 0x7e6b0

RtlUnicodeStringToOemString

Ordinal 898
Address 0x23930

RtlUnicodeToCustomCPN

Ordinal 899
Address 0x72df0

RtlUnicodeToMultiByteN

Ordinal 900
Address 0x34a10

RtlUnicodeToMultiByteSize

Ordinal 901
Address 0x353e0

RtlUnicodeToOemN

Ordinal 902
Address 0x284b0

RtlUniform

Ordinal 903
Address 0x93b80

RtlUnlockBootStatusData

Ordinal 904
Address 0x16b0

RtlUnlockHeap

Ordinal 905
Address 0x2fe70

RtlUnlockMemoryStreamRegion

Ordinal 906
Address 0x612b0

RtlUnwind

Ordinal 907
Address 0x79ad0

RtlUnwindEx

Ordinal 908
Address 0x25ce0

RtlUpcaseUnicodeChar

Ordinal 909
Address 0x372d0

RtlUpcaseUnicodeString

Ordinal 910
Address 0x22780

RtlUpcaseUnicodeStringToAnsiString

Ordinal 911
Address 0x7dea0

RtlUpcaseUnicodeStringToCountedOemString

Ordinal 912
Address 0x7e420

RtlUpcaseUnicodeStringToOemString

Ordinal 913
Address 0x28c80

RtlUpcaseUnicodeToCustomCPN

Ordinal 914
Address 0x73010

RtlUpcaseUnicodeToMultiByteN

Ordinal 915
Address 0x10350

RtlUpcaseUnicodeToOemN

Ordinal 916
Address 0x2ac10

RtlUpdateTimer

Ordinal 917
Address 0x2c3d0

RtlUpperChar

Ordinal 918
Address 0x72c0

RtlUpperString

Ordinal 919
Address 0x7f1e0

RtlUsageHeap

Ordinal 920
Address 0x87080

RtlValidAcl

Ordinal 921
Address 0x3a2d0

RtlValidRelativeSecurityDescriptor

Ordinal 922
Address 0xbb70

RtlValidSecurityDescriptor

Ordinal 923
Address 0x1aba0

RtlValidSid

Ordinal 924
Address 0x3a250

RtlValidateHeap

Ordinal 925
Address 0x51840

RtlValidateProcessHeaps

Ordinal 926
Address 0x86a20

RtlValidateUnicodeString

Ordinal 927
Address 0x7ebb0

RtlVerifyVersionInfo

Ordinal 928
Address 0x24d40

RtlVirtualUnwind

Ordinal 929
Address 0x25210

RtlWalkFrameChain

Ordinal 930
Address 0x82550

RtlWalkHeap

Ordinal 931
Address 0x87b00

RtlWow64EnableFsRedirection

Ordinal 932
Address 0x69080

RtlWow64EnableFsRedirectionEx

Ordinal 933
Address 0x69080

RtlWriteMemoryStream

Ordinal 934
Address 0x612b0

RtlWriteRegistryValue

Ordinal 935
Address 0x83d90

RtlZeroHeap

Ordinal 936
Address 0x7cb60

RtlZeroMemory

Ordinal 937
Address 0x32a90

RtlZombifyActivationContext

Ordinal 938
Address 0x69f80

RtlpApplyLengthFunction

Ordinal 939
Address 0x11bd0

RtlpEnsureBufferSize

Ordinal 940
Address 0x277b0

RtlpNotOwnerCriticalSection

Ordinal 941
Address 0x61a60

RtlpNtCreateKey

Ordinal 942
Address 0x95790

RtlpNtEnumerateSubKey

Ordinal 943
Address 0x3c80

RtlpNtMakeTemporaryKey

Ordinal 944
Address 0x95810

RtlpNtOpenKey

Ordinal 945
Address 0x29fb0

RtlpNtQueryValueKey

Ordinal 946
Address 0x2ab40

RtlpNtSetValueKey

Ordinal 947
Address 0x957e0

RtlpUnWaitCriticalSection

Ordinal 948
Address 0x3b510

RtlpWaitForCriticalSection

Ordinal 949
Address 0x81e70

RtlxAnsiStringToUnicodeSize

Ordinal 950
Address 0x7e710

RtlxOemStringToUnicodeSize

Ordinal 951
Address 0x7e710

RtlxUnicodeStringToAnsiSize

Ordinal 952
Address 0x7e6b0

RtlxUnicodeStringToOemSize

Ordinal 953
Address 0x7e6b0

VerSetConditionMask

Ordinal 954
Address 0x24f90

ZwAcceptConnectPort

Ordinal 955
Address 0x30a60

ZwAccessCheck

Ordinal 956
Address 0x30a70

ZwAccessCheckAndAuditAlarm

Ordinal 957
Address 0x306c0

ZwAccessCheckByType

Ordinal 958
Address 0x30a80

ZwAccessCheckByTypeAndAuditAlarm

Ordinal 959
Address 0x309c0

ZwAccessCheckByTypeResultList

Ordinal 960
Address 0x30a90

ZwAccessCheckByTypeResultListAndAuditAlarm

Ordinal 961
Address 0x30aa0

ZwAccessCheckByTypeResultListAndAuditAlarmByHandle

Ordinal 962
Address 0x30ab0

ZwAddAtom

Ordinal 963
Address 0x308a0

ZwAddBootEntry

Ordinal 964
Address 0x30ac0

ZwAddDriverEntry

Ordinal 965
Address 0x30ad0

ZwAdjustGroupsToken

Ordinal 966
Address 0x30ae0

ZwAdjustPrivilegesToken

Ordinal 967
Address 0x30840

ZwAlertResumeThread

Ordinal 968
Address 0x30af0

ZwAlertThread

Ordinal 969
Address 0x30b00

ZwAllocateLocallyUniqueId

Ordinal 970
Address 0x30b10

ZwAllocateUserPhysicalPages

Ordinal 971
Address 0x30b20

ZwAllocateUuids

Ordinal 972
Address 0x30b30

ZwAllocateVirtualMemory

Ordinal 973
Address 0x305b0

ZwApphelpCacheControl

Ordinal 974
Address 0x308f0

ZwAreMappedFilesTheSame

Ordinal 975
Address 0x30b40

ZwAssignProcessToJobObject

Ordinal 976
Address 0x30b50

ZwCallbackReturn

Ordinal 977
Address 0x30480

ZwCancelDeviceWakeupRequest

Ordinal 978
Address 0x30b60

ZwCancelIoFile

Ordinal 979
Address 0x30a00

ZwCancelTimer

Ordinal 980
Address 0x30a40

ZwClearEvent

Ordinal 981
Address 0x30810

ZwClose

Ordinal 982
Address 0x30520

ZwCloseObjectAuditAlarm

Ordinal 983
Address 0x307e0

ZwCompactKeys

Ordinal 984
Address 0x30b70

ZwCompareTokens

Ordinal 985
Address 0x30b80

ZwCompleteConnectPort

Ordinal 986
Address 0x30b90

ZwCompressKey

Ordinal 987
Address 0x30ba0

ZwConnectPort

Ordinal 988
Address 0x30bb0

ZwContinue

Ordinal 989
Address 0x30860

ZwCreateDebugObject

Ordinal 990
Address 0x30bc0

ZwCreateDirectoryObject

Ordinal 991
Address 0x30bd0

ZwCreateEvent

Ordinal 992
Address 0x308b0

ZwCreateEventPair

Ordinal 993
Address 0x30be0

ZwCreateFile

Ordinal 994
Address 0x30980

ZwCreateIoCompletion

Ordinal 995
Address 0x30bf0

ZwCreateJobObject

Ordinal 996
Address 0x30c00

ZwCreateJobSet

Ordinal 997
Address 0x30c10

ZwCreateKey

Ordinal 998
Address 0x30600

ZwCreateKeyedEvent

Ordinal 999
Address 0x30c20

ZwCreateMailslotFile

Ordinal 1000
Address 0x30c30

ZwCreateMutant

Ordinal 1001
Address 0x30c40

ZwCreateNamedPipeFile

Ordinal 1002
Address 0x30c50

ZwCreatePagingFile

Ordinal 1003
Address 0x30c60

ZwCreatePort

Ordinal 1004
Address 0x30c70

ZwCreateProcess

Ordinal 1005
Address 0x30c80

ZwCreateProcessEx

Ordinal 1006
Address 0x30900

ZwCreateProfile

Ordinal 1007
Address 0x30c90

ZwCreateSection

Ordinal 1008
Address 0x308d0

ZwCreateSemaphore

Ordinal 1009
Address 0x30ca0

ZwCreateSymbolicLinkObject

Ordinal 1010
Address 0x30cb0

ZwCreateThread

Ordinal 1011
Address 0x30910

ZwCreateTimer

Ordinal 1012
Address 0x30cc0

ZwCreateToken

Ordinal 1013
Address 0x30cd0

ZwCreateWaitablePort

Ordinal 1014
Address 0x30ce0

ZwDebugActiveProcess

Ordinal 1015
Address 0x30cf0

ZwDebugContinue

Ordinal 1016
Address 0x30d00

ZwDelayExecution

Ordinal 1017
Address 0x30770

ZwDeleteAtom

Ordinal 1018
Address 0x30d10

ZwDeleteBootEntry

Ordinal 1019
Address 0x30d20

ZwDeleteDriverEntry

Ordinal 1020
Address 0x30d30

ZwDeleteFile

Ordinal 1021
Address 0x30d40

ZwDeleteKey

Ordinal 1022
Address 0x30d50

ZwDeleteObjectAuditAlarm

Ordinal 1023
Address 0x30d60

ZwDeleteValueKey

Ordinal 1024
Address 0x30d70

ZwDeviceIoControlFile

Ordinal 1025
Address 0x304a0

ZwDisplayString

Ordinal 1026
Address 0x30d80

ZwDuplicateObject

Ordinal 1027
Address 0x307f0

ZwDuplicateToken

Ordinal 1028
Address 0x30850

ZwEnumerateBootEntries

Ordinal 1029
Address 0x30d90

ZwEnumerateDriverEntries

Ordinal 1030
Address 0x30da0

ZwEnumerateKey

Ordinal 1031
Address 0x30750

ZwEnumerateSystemEnvironmentValuesEx

Ordinal 1032
Address 0x30db0

ZwEnumerateValueKey

Ordinal 1033
Address 0x30560

ZwExtendSection

Ordinal 1034
Address 0x30dc0

ZwFilterToken

Ordinal 1035
Address 0x30dd0

ZwFindAtom

Ordinal 1036
Address 0x30570

ZwFlushBuffersFile

Ordinal 1037
Address 0x308e0

ZwFlushInstructionCache

Ordinal 1038
Address 0x30de0

ZwFlushKey

Ordinal 1039
Address 0x30df0

ZwFlushVirtualMemory

Ordinal 1040
Address 0x30e00

ZwFlushWriteBuffer

Ordinal 1041
Address 0x30e10

ZwFreeUserPhysicalPages

Ordinal 1042
Address 0x30e20

ZwFreeVirtualMemory

Ordinal 1043
Address 0x30610

ZwFsControlFile

Ordinal 1044
Address 0x307c0

ZwGetContextThread

Ordinal 1045
Address 0x30e30

ZwGetCurrentProcessorNumber

Ordinal 1046
Address 0x30e40

ZwGetDevicePowerState

Ordinal 1047
Address 0x30e50

ZwGetPlugPlayEvent

Ordinal 1048
Address 0x30e60

ZwGetWriteWatch

Ordinal 1049
Address 0x30e70

ZwImpersonateAnonymousToken

Ordinal 1050
Address 0x30e80

ZwImpersonateClientOfPort

Ordinal 1051
Address 0x30620

ZwImpersonateThread

Ordinal 1052
Address 0x30e90

ZwInitializeRegistry

Ordinal 1053
Address 0x30ea0

ZwInitiatePowerAction

Ordinal 1054
Address 0x30eb0

ZwIsProcessInJob

Ordinal 1055
Address 0x30920

ZwIsSystemResumeAutomatic

Ordinal 1056
Address 0x30ec0

ZwListenPort

Ordinal 1057
Address 0x30ed0

ZwLoadDriver

Ordinal 1058
Address 0x30ee0

ZwLoadKey

Ordinal 1059
Address 0x30ef0

ZwLoadKey2

Ordinal 1060
Address 0x30f00

ZwLoadKeyEx

Ordinal 1061
Address 0x30f10

ZwLockFile

Ordinal 1062
Address 0x30f20

ZwLockProductActivationKeys

Ordinal 1063
Address 0x30f30

ZwLockRegistryKey

Ordinal 1064
Address 0x30f40

ZwLockVirtualMemory

Ordinal 1065
Address 0x30f50

ZwMakePermanentObject

Ordinal 1066
Address 0x30f60

ZwMakeTemporaryObject

Ordinal 1067
Address 0x30f70

ZwMapUserPhysicalPages

Ordinal 1068
Address 0x30f80

ZwMapUserPhysicalPagesScatter

Ordinal 1069
Address 0x30460

ZwMapViewOfSection

Ordinal 1070
Address 0x306b0

ZwModifyBootEntry

Ordinal 1071
Address 0x30f90

ZwModifyDriverEntry

Ordinal 1072
Address 0x30fa0

ZwNotifyChangeDirectoryFile

Ordinal 1073
Address 0x30fb0

ZwNotifyChangeKey

Ordinal 1074
Address 0x30fc0

ZwNotifyChangeMultipleKeys

Ordinal 1075
Address 0x30fd0

ZwOpenDirectoryObject

Ordinal 1076
Address 0x309b0

ZwOpenEvent

Ordinal 1077
Address 0x30830

ZwOpenEventPair

Ordinal 1078
Address 0x30fe0

ZwOpenFile

Ordinal 1079
Address 0x30760

ZwOpenIoCompletion

Ordinal 1080
Address 0x30ff0

ZwOpenJobObject

Ordinal 1081
Address 0x31000

ZwOpenKey

Ordinal 1082
Address 0x30550

ZwOpenKeyedEvent

Ordinal 1083
Address 0x31010

ZwOpenMutant

Ordinal 1084
Address 0x31020

ZwOpenObjectAuditAlarm

Ordinal 1085
Address 0x31030

ZwOpenProcess

Ordinal 1086
Address 0x30690

ZwOpenProcessToken

Ordinal 1087
Address 0x31040

ZwOpenProcessTokenEx

Ordinal 1088
Address 0x30730

ZwOpenSection

Ordinal 1089
Address 0x307a0

ZwOpenSemaphore

Ordinal 1090
Address 0x31050

ZwOpenSymbolicLinkObject

Ordinal 1091
Address 0x31060

ZwOpenThread

Ordinal 1092
Address 0x31070

ZwOpenThreadToken

Ordinal 1093
Address 0x30670

ZwOpenThreadTokenEx

Ordinal 1094
Address 0x30720

ZwOpenTimer

Ordinal 1095
Address 0x31080

ZwPlugPlayControl

Ordinal 1096
Address 0x31090

ZwPowerInformation

Ordinal 1097
Address 0x30a20

ZwPrivilegeCheck

Ordinal 1098
Address 0x310a0

ZwPrivilegeObjectAuditAlarm

Ordinal 1099
Address 0x310b0

ZwPrivilegedServiceAuditAlarm

Ordinal 1100
Address 0x310c0

ZwProtectVirtualMemory

Ordinal 1101
Address 0x30930

ZwPulseEvent

Ordinal 1102
Address 0x310d0

ZwQueryAttributesFile

Ordinal 1103
Address 0x30800

ZwQueryBootEntryOrder

Ordinal 1104
Address 0x310e0

ZwQueryBootOptions

Ordinal 1105
Address 0x310f0

ZwQueryDebugFilterState

Ordinal 1106
Address 0x31100

ZwQueryDefaultLocale

Ordinal 1107
Address 0x30580

ZwQueryDefaultUILanguage

Ordinal 1108
Address 0x30870

ZwQueryDirectoryFile

Ordinal 1109
Address 0x30780

ZwQueryDirectoryObject

Ordinal 1110
Address 0x31110

ZwQueryDriverEntryOrder

Ordinal 1111
Address 0x31120

ZwQueryEaFile

Ordinal 1112
Address 0x31130

ZwQueryEvent

Ordinal 1113
Address 0x30990

ZwQueryFullAttributesFile

Ordinal 1114
Address 0x31140

ZwQueryInformationAtom

Ordinal 1115
Address 0x31150

ZwQueryInformationFile

Ordinal 1116
Address 0x30540

ZwQueryInformationJobObject

Ordinal 1117
Address 0x31160

ZwQueryInformationPort

Ordinal 1118
Address 0x31170

ZwQueryInformationProcess

Ordinal 1119
Address 0x305c0

ZwQueryInformationThread

Ordinal 1120
Address 0x30680

ZwQueryInformationToken

Ordinal 1121
Address 0x30640

ZwQueryInstallUILanguage

Ordinal 1122
Address 0x31180

ZwQueryIntervalProfile

Ordinal 1123
Address 0x31190

ZwQueryIoCompletion

Ordinal 1124
Address 0x311a0

ZwQueryKey

Ordinal 1125
Address 0x30590

ZwQueryMultipleValueKey

Ordinal 1126
Address 0x311b0

ZwQueryMutant

Ordinal 1127
Address 0x311c0

ZwQueryObject

Ordinal 1128
Address 0x30530

ZwQueryOpenSubKeys

Ordinal 1129
Address 0x311d0

ZwQueryOpenSubKeysEx

Ordinal 1130
Address 0x311e0

ZwQueryPerformanceCounter

Ordinal 1131
Address 0x30740

ZwQueryPortInformationProcess

Ordinal 1132
Address 0x311f0

ZwQueryQuotaInformationFile

Ordinal 1133
Address 0x31200

ZwQuerySection

Ordinal 1134
Address 0x30940

ZwQuerySecurityObject

Ordinal 1135
Address 0x31210

ZwQuerySemaphore

Ordinal 1136
Address 0x31220

ZwQuerySymbolicLinkObject

Ordinal 1137
Address 0x31230

ZwQuerySystemEnvironmentValue

Ordinal 1138
Address 0x31240

ZwQuerySystemEnvironmentValueEx

Ordinal 1139
Address 0x31250

ZwQuerySystemInformation

Ordinal 1140
Address 0x30790

ZwQuerySystemTime

Ordinal 1141
Address 0x309d0

ZwQueryTimer

Ordinal 1142
Address 0x307b0

ZwQueryTimerResolution

Ordinal 1143
Address 0x31260

ZwQueryValueKey

Ordinal 1144
Address 0x305a0

ZwQueryVirtualMemory

Ordinal 1145
Address 0x30660

ZwQueryVolumeInformationFile

Ordinal 1146
Address 0x308c0

ZwQueueApcThread

Ordinal 1147
Address 0x30880

ZwRaiseException

Ordinal 1148
Address 0x31270

ZwRaiseHardError

Ordinal 1149
Address 0x31280

ZwReadFile

Ordinal 1150
Address 0x30490

ZwReadFileScatter

Ordinal 1151
Address 0x30710

ZwReadRequestData

Ordinal 1152
Address 0x30970

ZwReadVirtualMemory

Ordinal 1153
Address 0x30820

ZwRegisterThreadTerminatePort

Ordinal 1154
Address 0x31290

ZwReleaseKeyedEvent

Ordinal 1155
Address 0x312a0

ZwReleaseMutant

Ordinal 1156
Address 0x30630

ZwReleaseSemaphore

Ordinal 1157
Address 0x304d0

ZwRemoveIoCompletion

Ordinal 1158
Address 0x304c0

ZwRemoveProcessDebug

Ordinal 1159
Address 0x312b0

ZwRenameKey

Ordinal 1160
Address 0x312c0

ZwReplaceKey

Ordinal 1161
Address 0x312d0

ZwReplyPort

Ordinal 1162
Address 0x304f0

ZwReplyWaitReceivePort

Ordinal 1163
Address 0x304e0

ZwReplyWaitReceivePortEx

Ordinal 1164
Address 0x306e0

ZwReplyWaitReplyPort

Ordinal 1165
Address 0x312e0

ZwRequestDeviceWakeup

Ordinal 1166
Address 0x312f0

ZwRequestPort

Ordinal 1167
Address 0x31300

ZwRequestWaitReplyPort

Ordinal 1168
Address 0x30650

ZwRequestWakeupLatency

Ordinal 1169
Address 0x31310

ZwResetEvent

Ordinal 1170
Address 0x31320

ZwResetWriteWatch

Ordinal 1171
Address 0x31330

ZwRestoreKey

Ordinal 1172
Address 0x31340

ZwResumeProcess

Ordinal 1173
Address 0x31350

ZwResumeThread

Ordinal 1174
Address 0x30950

ZwSaveKey

Ordinal 1175
Address 0x31360

ZwSaveKeyEx

Ordinal 1176
Address 0x31370

ZwSaveMergedKeys

Ordinal 1177
Address 0x31380

ZwSecureConnectPort

Ordinal 1178
Address 0x31390

ZwSetBootEntryOrder

Ordinal 1179
Address 0x313a0

ZwSetBootOptions

Ordinal 1180
Address 0x313b0

ZwSetContextThread

Ordinal 1181
Address 0x313c0

ZwSetDebugFilterState

Ordinal 1182
Address 0x313d0

ZwSetDefaultHardErrorPort

Ordinal 1183
Address 0x313e0

ZwSetDefaultLocale

Ordinal 1184
Address 0x313f0

ZwSetDefaultUILanguage

Ordinal 1185
Address 0x31400

ZwSetDriverEntryOrder

Ordinal 1186
Address 0x31410

ZwSetEaFile

Ordinal 1187
Address 0x31420

ZwSetEvent

Ordinal 1188
Address 0x30510

ZwSetEventBoostPriority

Ordinal 1189
Address 0x30700

ZwSetHighEventPair

Ordinal 1190
Address 0x31430

ZwSetHighWaitLowEventPair

Ordinal 1191
Address 0x31440

ZwSetInformationDebugObject

Ordinal 1192
Address 0x31450

ZwSetInformationFile

Ordinal 1193
Address 0x306a0

ZwSetInformationJobObject

Ordinal 1194
Address 0x31460

ZwSetInformationKey

Ordinal 1195
Address 0x31470

ZwSetInformationObject

Ordinal 1196
Address 0x309f0

ZwSetInformationProcess

Ordinal 1197
Address 0x305f0

ZwSetInformationThread

Ordinal 1198
Address 0x30500

ZwSetInformationToken

Ordinal 1199
Address 0x31480

ZwSetIntervalProfile

Ordinal 1200
Address 0x31490

ZwSetIoCompletion

Ordinal 1201
Address 0x314a0

ZwSetLdtEntries

Ordinal 1202
Address 0x314b0

ZwSetLowEventPair

Ordinal 1203
Address 0x314c0

ZwSetLowWaitHighEventPair

Ordinal 1204
Address 0x314d0

ZwSetQuotaInformationFile

Ordinal 1205
Address 0x314e0

ZwSetSecurityObject

Ordinal 1206
Address 0x314f0

ZwSetSystemEnvironmentValue

Ordinal 1207
Address 0x31500

ZwSetSystemEnvironmentValueEx

Ordinal 1208
Address 0x31510

ZwSetSystemInformation

Ordinal 1209
Address 0x31520

ZwSetSystemPowerState

Ordinal 1210
Address 0x31530

ZwSetSystemTime

Ordinal 1211
Address 0x31540

ZwSetThreadExecutionState

Ordinal 1212
Address 0x31550

ZwSetTimer

Ordinal 1213
Address 0x30a50

ZwSetTimerResolution

Ordinal 1214
Address 0x31560

ZwSetUuidSeed

Ordinal 1215
Address 0x31570

ZwSetValueKey

Ordinal 1216
Address 0x30a30

ZwSetVolumeInformationFile

Ordinal 1217
Address 0x31580

ZwShutdownSystem

Ordinal 1218
Address 0x31590

ZwSignalAndWaitForSingleObject

Ordinal 1219
Address 0x315a0

ZwStartProfile

Ordinal 1220
Address 0x315b0

ZwStopProfile

Ordinal 1221
Address 0x315c0

ZwSuspendProcess

Ordinal 1222
Address 0x315d0

ZwSuspendThread

Ordinal 1223
Address 0x315e0

ZwSystemDebugControl

Ordinal 1224
Address 0x315f0

ZwTerminateJobObject

Ordinal 1225
Address 0x31600

ZwTerminateProcess

Ordinal 1226
Address 0x306f0

ZwTerminateThread

Ordinal 1227
Address 0x30960

ZwTestAlert

Ordinal 1228
Address 0x31610

ZwTraceEvent

Ordinal 1229
Address 0x30a10

ZwTranslateFilePath

Ordinal 1230
Address 0x31620

ZwUnloadDriver

Ordinal 1231
Address 0x31630

ZwUnloadKey

Ordinal 1232
Address 0x31640

ZwUnloadKey2

Ordinal 1233
Address 0x31650

ZwUnloadKeyEx

Ordinal 1234
Address 0x31660

ZwUnlockFile

Ordinal 1235
Address 0x31670

ZwUnlockVirtualMemory

Ordinal 1236
Address 0x31680

ZwUnmapViewOfSection

Ordinal 1237
Address 0x306d0

ZwVdmControl

Ordinal 1238
Address 0x31690

ZwWaitForDebugEvent

Ordinal 1239
Address 0x316a0

ZwWaitForKeyedEvent

Ordinal 1240
Address 0x316b0

ZwWaitForMultipleObjects

Ordinal 1241
Address 0x309e0

ZwWaitForMultipleObjects32

Ordinal 1242
Address 0x305d0

ZwWaitForSingleObject

Ordinal 1243
Address 0x30470

ZwWaitHighEventPair

Ordinal 1244
Address 0x316c0

ZwWaitLowEventPair

Ordinal 1245
Address 0x316d0

ZwWriteFile

Ordinal 1246
Address 0x304b0

ZwWriteFileGather

Ordinal 1247
Address 0x305e0

ZwWriteRequestData

Ordinal 1248
Address 0x309a0

ZwWriteVirtualMemory

Ordinal 1249
Address 0x307d0

ZwYieldExecution

Ordinal 1250
Address 0x30890

__C_specific_handler

Ordinal 1251
Address 0x25f90

__chkstk

Ordinal 1252
Address 0x32580

__isascii

Ordinal 1253
Address 0x26c90

__iscsym

Ordinal 1254
Address 0xa9f30

__iscsymf

Ordinal 1255
Address 0xa9ed0

__misaligned_access

Ordinal 1256
Address 0x81e70

__toascii

Ordinal 1257
Address 0xa9ec0

_atoi64

Ordinal 1258
Address 0xaa080

_fltused

Ordinal 1259
Address 0xe96f0

_i64toa

Ordinal 1260
Address 0xaa290

_i64tow

Ordinal 1261
Address 0xaa480

_itoa

Ordinal 1262
Address 0xc260

_itow

Ordinal 1263
Address 0x2f30

_lfind

Ordinal 1264
Address 0xaa580

_local_unwind

Ordinal 1265
Address 0x31ca0

_ltoa

Ordinal 1266
Address 0xaa1b0

_ltow

Ordinal 1267
Address 0xaa3f0

_memccpy

Ordinal 1268
Address 0xaa610

_memicmp

Ordinal 1269
Address 0xaa650

_setjmp

Ordinal 1270
Address 0x325e0

_setjmpex

Ordinal 1271
Address 0x32690

_snprintf

Ordinal 1272
Address 0x37070

_snwprintf

Ordinal 1273
Address 0x245d0

_splitpath

Ordinal 1274
Address 0xaa6d0

_strcmpi

Ordinal 1275
Address 0x2e6c0

_stricmp

Ordinal 1276
Address 0x2e6c0

_strlwr

Ordinal 1277
Address 0xaa890

_strnicmp

Ordinal 1278
Address 0x52120

_strupr

Ordinal 1279
Address 0xaa8c0

_tolower

Ordinal 1280
Address 0xaa8f0

_toupper

Ordinal 1281
Address 0xaa950

_ui64toa

Ordinal 1282
Address 0xaa310

_ui64tow

Ordinal 1283
Address 0xaa510

_ultoa

Ordinal 1284
Address 0xaa230

_ultow

Ordinal 1285
Address 0xfa90

_vscwprintf

Ordinal 1286
Address 0xaa980

_vsnprintf

Ordinal 1287
Address 0x36f70

_vsnwprintf

Ordinal 1288
Address 0x101c0

_wcsicmp

Ordinal 1289
Address 0x3a1e0

_wcslwr

Ordinal 1290
Address 0xaa9e0

_wcsnicmp

Ordinal 1291
Address 0x3aaf0

_wcstoui64

Ordinal 1292
Address 0xc2d0

_wcsupr

Ordinal 1293
Address 0x3b6e0

_wtoi

Ordinal 1294
Address 0xaac20

_wtoi64

Ordinal 1295
Address 0xaacf0

_wtol

Ordinal 1296
Address 0xaab60

abs

Ordinal 1297
Address 0xaadb0

atan

Ordinal 1298
Address 0xaadc0

atoi

Ordinal 1299
Address 0x12420

atol

Ordinal 1300
Address 0xa9f90

bsearch

Ordinal 1301
Address 0x3bcd0

ceil

Ordinal 1302
Address 0xab130

cos

Ordinal 1303
Address 0xab810

fabs

Ordinal 1304
Address 0xabc40

floor

Ordinal 1305
Address 0xabd60

isalnum

Ordinal 1306
Address 0xa9dc0

isalpha

Ordinal 1307
Address 0xa9c30

iscntrl

Ordinal 1308
Address 0xa9e80

isdigit

Ordinal 1309
Address 0x26c50

isgraph

Ordinal 1310
Address 0xa9e40

islower

Ordinal 1311
Address 0xa9cb0

isprint

Ordinal 1312
Address 0xa9e00

ispunct

Ordinal 1313
Address 0xa9d80

isspace

Ordinal 1314
Address 0xa9d40

isupper

Ordinal 1315
Address 0xa9c70

iswalpha

Ordinal 1316
Address 0xabe80

iswctype

Ordinal 1317
Address 0x3b830

iswdigit

Ordinal 1318
Address 0x14ca0

iswlower

Ordinal 1319
Address 0xabe90

iswspace

Ordinal 1320
Address 0xabeb0

iswxdigit

Ordinal 1321
Address 0xabea0

isxdigit

Ordinal 1322
Address 0xa9d00

labs

Ordinal 1323
Address 0xaadb0

log

Ordinal 1324
Address 0xabec0

longjmp

Ordinal 1325
Address 0x32730

mbstowcs

Ordinal 1326
Address 0xf8d0

memchr

Ordinal 1327
Address 0xac6b0

memcmp

Ordinal 1328
Address 0x31ce0

memcpy

Ordinal 1329
Address 0x31850

memmove

Ordinal 1330
Address 0x31850

memset

Ordinal 1331
Address 0x31ba0

pow

Ordinal 1332
Address 0xe5000

qsort

Ordinal 1333
Address 0x27020

sin

Ordinal 1334
Address 0xab3e0

sprintf

Ordinal 1335
Address 0x4120

sqrt

Ordinal 1336
Address 0xac6f0

sscanf

Ordinal 1337
Address 0xac810

strcat

Ordinal 1338
Address 0x31dc0

strchr

Ordinal 1339
Address 0x184e0

strcmp

Ordinal 1340
Address 0x31f30

strcpy

Ordinal 1341
Address 0x31e60

strcspn

Ordinal 1342
Address 0xac870

strlen

Ordinal 1343
Address 0x31ff0

strncat

Ordinal 1344
Address 0x320b0

strncmp

Ordinal 1345
Address 0x32260

strncpy

Ordinal 1346
Address 0x32330

strpbrk

Ordinal 1347
Address 0xac940

strrchr

Ordinal 1348
Address 0xaca00

strspn

Ordinal 1349
Address 0xaca30

strstr

Ordinal 1350
Address 0xacb10

strtol

Ordinal 1351
Address 0xacdd0

strtoul

Ordinal 1352
Address 0xacde0

swprintf

Ordinal 1353
Address 0x23690

tan

Ordinal 1354
Address 0xad080

tolower

Ordinal 1355
Address 0xaa900

toupper

Ordinal 1356
Address 0x10440

towlower

Ordinal 1357
Address 0x3c910

towupper

Ordinal 1358
Address 0xad470

vDbgPrintEx

Ordinal 1359
Address 0x27150

vDbgPrintExWithPrefix

Ordinal 1360
Address 0x6e670

vsprintf

Ordinal 1361
Address 0xad480

wcscat

Ordinal 1362
Address 0xad500

wcschr

Ordinal 1363
Address 0x39d80

wcscmp

Ordinal 1364
Address 0xad570

wcscpy

Ordinal 1365
Address 0xad540

wcscspn

Ordinal 1366
Address 0x7250

wcslen

Ordinal 1367
Address 0xad5c0

wcsncat

Ordinal 1368
Address 0x2e3b0

wcsncmp

Ordinal 1369
Address 0x2d050

wcsncpy

Ordinal 1370
Address 0x39c70

wcspbrk

Ordinal 1371
Address 0xad5f0

wcsrchr

Ordinal 1372
Address 0x39db0

wcsspn

Ordinal 1373
Address 0xad640

wcsstr

Ordinal 1374
Address 0x228f0

wcstol

Ordinal 1375
Address 0x9520

wcstombs

Ordinal 1376
Address 0xad760

wcstoul

Ordinal 1377
Address 0xc230

1

Type RT_MESSAGETABLE
Language English - United States
Codepage Latin 1 / Western European
Size 0x2de30
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.33333
MD5 6dcd12f31020d7223a9d7004b254a665
SHA1 eeab63a4d3cf542b0417699d2df41d90b58b1f17
SHA256 5ec88bf1bec89434ddfe59f78ff6431b9dc6ada697193ab57c5695000f3da486
SHA3 8c4bbdc8781aa27ee468e19b6fc0c3c5d400e4812305819982097b1fe4a12be8

1 (#2)

Type RT_MESSAGETABLE
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0xffd8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.29168
MD5 06d12e7eba9f0a2a9f8171d2dc48bd8c
SHA1 8beb13ac505770c0fdccd71768ce965a8e006159
SHA256 cd34c17b98f9b1c867da4c7c9c226fda019815757aaeb6ddfa8143a09eb55675
SHA3 8c453ab6321f86c00f4404c99f7416ca98693ad885ee1f86dd554b1a21fe2d2c

1 (#3)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x37c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.57873
MD5 c0887405d92f88bab407220ca07f0cf4
SHA1 ebb6b2a68c9b3867d815994964436b38801afe2c
SHA256 a74be45a6729397d6ae725d0fcf5cee3897ec1cf92911d93126c8357050442d4
SHA3 780f86f5944d834e554abdc129f1f43cd3b24486a65149dfdbf4dcf0d71573d2

1 (#4)

Type RT_VERSION
Language Chinese - PRC
Codepage Latin 1 / Western European
Size 0x390
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.55632
MD5 b5013fe78720eba0ad2d9ee6607aff2f
SHA1 975382c2d3309bf262d91ddd08fa36840ad82883
SHA256 e7dea0abe13611b4bc8a47f0db5c263d7eed24f5b10ecd6d455c843874c10c86
SHA3 cb1463477a21c69f0e6e17da4747bdf4df70d2c46ae222b0198c1d4d6a1967c2

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2011-Nov-21 14:10:29
Version 0.0
SizeofData 34
AddressOfRawData 0xd0a88
PointerToRawData 0xcfe88
Referenced File ntdll.pdb

IMAGE_DEBUG_TYPE_RESERVED

Characteristics 0
TimeDateStamp 2011-Nov-21 14:10:29
Version 555.4002
SizeofData 4
AddressOfRawData 0xd0a84
PointerToRawData 0xcfe84

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0xd4a5b1ec
Unmarked objects 0
C objects (40310) 117
Exports (40310) 1
ASM objects (40310) 28
113 (40310) 113
94 (VS2003 (.NET) build 4035) 1
Linker (40310) 1

Errors

[*] Warning: Multiple nodes using the name Version Info in a dictionary.
<-- -->