如何列出一个可执行档里输出的函数
2008-01-24 10:13
232 查看
很久以前的东西，不小心翻了出来
#include <windows.h>
#include <winbase.h>
#include <stdio.h>
#include <tchar.h>
#include <imagehlp.h>
void PrintUsage(char * msg)
{
printf("|---------------------------------------------------------|/n");
printf("| CreateDate: 2000-02-15 |/n");
printf("| Usage: <Path>//GetFunction[.exe] <Exe file|DLL file> |/n");
printf("|---------------------------------------------------------|/n");
return;
}
BOOL CheckFunction(PCHAR pf)
{
int iCount=strlen(pf);
for(int i=0;i<iCount;i++)
{
if ((pf[i]<'0')||(pf[i]>'z')) return FALSE;
}
return TRUE;
}
int main(int argc,char **argv)
{
PIMAGE_NT_HEADERS nt_headers;
PIMAGE_EXPORT_DIRECTORY export_data;
DWORD export_data_size;
PDWORD FunctionsNames,FunctionsPtrs;
PWORD NameOrdinals;
HANDLE hFile,hFileMap;
DWORD file_attributes;
PVOID mod_base,func_ptr=0,image_base;
char file_path[MAX_PATH];
char * func_name;
LPWIN32_FIND_DATA lpwfd_first=new WIN32_FIND_DATA;
DWORD i,dwretcode;
char * lpTmp=new char[MAX_PATH];
BOOLEAN bcp=FALSE;
if (argc<2)
{
PrintUsage (argv[0]);
return 0;
}
// GetFullPathName (argv[1],MAX_PATH,file_path ,NULL);
sprintf(file_path,argv[1]);
if (FindFirstFile (file_path,lpwfd_first)==NULL)
{
//file_attributes=0;
PrintUsage(argv[0]);
return 0;
}
else
{
file_attributes=lpwfd_first->dwFileAttributes ;
}
goto_continue:
hFile=CreateFile(file_path,GENERIC_READ,
0,0,OPEN_EXISTING,
file_attributes,0);
if (hFile==INVALID_HANDLE_VALUE)
{
dwretcode=GetLastError();
if (dwretcode==32)
{
bcp =TRUE;
sprintf(lpTmp,argv[0]);
lpTmp[(strrchr(argv[0],92) - argv[0])+1]=NULL;
sprintf(lpTmp+strlen(lpTmp),lpwfd_first->cFileName) ;
CopyFile(argv[1],lpTmp,TRUE);
sprintf(file_path,lpTmp);
delete lpTmp;
goto goto_continue;
}
else return 0;
}
delete lpwfd_first;
hFileMap=CreateFileMapping(hFile,0,PAGE_READONLY,0,0,0);
if (hFileMap==NULL)
{
printf("Create File Map Error!/n");
CloseHandle(hFile);
return 0;
}
mod_base =MapViewOfFile(hFileMap,FILE_MAP_READ,0,0,0);
if (mod_base==NULL)
{
printf("Create MapView of file error!/n");
CloseHandle(hFileMap);
CloseHandle(hFile);
return 0;
}
nt_headers =ImageNtHeader (mod_base);
image_base=(PVOID)nt_headers->OptionalHeader .ImageBase ;
export_data =(PIMAGE_EXPORT_DIRECTORY )ImageDirectoryEntryToData (mod_base,
FALSE,IMAGE_DIRECTORY_ENTRY_EXPORT,&export_data_size);
if (export_data==NULL)
{
DWORD dwError = GetLastError();
printf("ImageDirectoryEntryToData Error!(Errorcode:%d)/n",dwError);
return 0;
}
FunctionsNames =(PDWORD)ImageRvaToVa (nt_headers,mod_base,
(DWORD)export_data->AddressOfNames ,0);
FunctionsPtrs = (PDWORD)ImageRvaToVa(nt_headers,mod_base,
(DWORD)export_data->AddressOfFunctions ,0);
NameOrdinals =(PWORD)ImageRvaToVa(nt_headers,mod_base,
(DWORD)export_data->AddressOfNameOrdinals ,0);
printf("Order FunctionName FunctionAddress/n");
for (i=0;i<export_data->NumberOfFunctions ;i++)
{
func_name = (PCHAR)ImageRvaToVa(nt_headers,mod_base,(DWORD)FunctionsNames[i],0);
if (IsBadReadPtr (func_name,1)) continue;
if ((!IsCharAlpha (func_name[0]))&&(!IsCharAlphaNumeric (func_name[0]))) continue;
if (IsBadCodePtr ((FARPROC)func_name)) continue;
if (!CheckFunction (func_name)) continue;
if (strlen(func_name)>32) continue;
// func_ptr=NULL;
// if (IsBadReadPtr(&FunctionsPtrs[NameOrdinals[i]],1)) continue;
// if (NameOrdinals[i]>10000) continue;
func_ptr = (PVOID) FunctionsPtrs [NameOrdinals [i]];
printf("%d",i);
char * temp=new char[10];
sprintf(temp,"%d",i);
for(int w=0;w<(18 - (int)strlen(temp));w++)
printf(" ");
printf("%s",func_name);
for (int j=0;j<(50 - (int)strlen(func_name));j++)
printf(" ");
printf("%d/n",func_ptr);
}
UnmapViewOfFile (mod_base);
CloseHandle(hFileMap);
CloseHandle(hFile);
if (bcp )
DeleteFile(file_path);
return 0;
}
例如运行：
GetFunction.exe c:/windows/system32/ntdll.dll
则输出如下结果：
Order FunctionName FunctionAddress
0 CsrAllocateCaptureBuffer 125863
1 CsrAllocateMessagePointer 125960
2 CsrCaptureMessageBuffer 160625
4 CsrCaptureMessageString 132870
5 CsrCaptureTimeout 329170
6 CsrClientCallServer 78497
7 CsrClientConnectToServer 137105
8 CsrFreeCaptureBuffer 125775
9 CsrGetProcessId 329159
10 CsrIdentifyAlertableThread 329026
11 CsrNewThread 102010
12 CsrProbeForRead 329299
13 CsrProbeForWrite 329221
14 CsrSetPriorityClass 329086
15 DbgBreakPoint 4656
16 DbgPrint 197616
17 DbgPrintEx 125733
18 DbgPrintReturnControlC 362522
19 DbgPrompt 362761
20 DbgQueryDebugFilterState 362831
21 DbgSetDebugFilterState 362847
22 DbgUiConnectToDbg 329353
23 DbgUiContinue 329524
24 DbgUiConvertStateChangeStructure 329820
25 DbgUiDebugActiveProcess 329754
26 DbgUiGetThreadDebugObject 329438
27 DbgUiIssueRemoteBreakin 329689
28 DbgUiRemoteBreakin 329595
29 DbgUiSetThreadDebugObject 329456
30 DbgUiStopDebugging 329561
31 DbgUiWaitStateChange 329485
32 DbgUserBreakPoint 4665
33 KiFastSystemCall 60299
34 KiFastSystemCallRet 60308
35 KiIntSystemCall 60325
36 KiRaiseUserExceptionDispatcher 60221
37 KiUserApcDispatcher 60096
38 KiUserCallbackDispatcher 60112
39 KiUserExceptionDispatcher 60140
40 LdrAccessOutOfProcessResource 133777
41 LdrAccessResource 76962
42 LdrAddRefDll 226841
43 LdrAlternateResourcesEnabled 77141
44 LdrCreateOutOfProcessImage 131419
45 LdrDestroyOutOfProcessImage 131701
46 LdrDisableThreadCalloutsForDll 122283
47 LdrEnumResources 363012
48 LdrEnumerateLoadedModules 137615
49 LdrFindCreateProcessManifest 130645
50 LdrFindEntryForAddress 362863
51 LdrFindResourceDirectory_U 117045
52 LdrFindResourceEx_U 366390
53 LdrFindResource_U 76929
54 LdrFlushAlternateResourceModules 193997
55 LdrGetDllHandle 91526
56 LdrGetDllHandleEx 91559
57 LdrGetProcedureAddress 105352
58 LdrHotPatchRoutine 330566
59 LdrInitShimEngineDynamic 333354
60 LdrInitializeThunk 4478
61 LdrLoadAlternateResourceModule 77013
62 LdrLoadDll 90570
63 LdrLockLoaderLock 78193
64 LdrProcessRelocationBlock 368195
66 LdrQueryProcessModuleInformation 332697
68 LdrSetDllManifestProber 141131
69 LdrShutdownProcess 146927
70 LdrShutdownThread 102694
71 LdrUnloadAlternateResourceModule 106537
72 LdrUnloadDll 94603
73 LdrUnlockLoaderLock 78377
74 LdrVerifyImageMatchesChecksum 202534
75 NlsAnsiCodePage 507912
76 NlsMbCodePageTag 507920
77 NlsMbOemCodePageTag 507928
78 NtAcceptConnectPort 54137
79 NtAccessCheck 54158
80 NtAccessCheckAndAuditAlarm 54179
81 NtAccessCheckByType 54200
82 NtAccessCheckByTypeAndAuditAlarm 54221
83 NtAccessCheckByTypeResultList 54242
86 NtAddAtom 54305
87 NtAddBootEntry 54326
88 NtAdjustGroupsToken 54347
89 NtAdjustPrivilegesToken 54368
90 NtAlertResumeThread 54389
91 NtAlertThread 54410
92 NtAllocateLocallyUniqueId 54431
93 NtAllocateUserPhysicalPages 54452
94 NtAllocateUuids 54473
95 NtAllocateVirtualMemory 54494
96 NtAreMappedFilesTheSame 54515
97 NtAssignProcessToJobObject 54536
98 NtCallbackReturn 54557
99 NtCancelDeviceWakeupRequest 54578
100 NtCancelIoFile 54599
101 NtCancelTimer 54620
102 NtClearEvent 54641
103 NtClose 54662
104 NtCloseObjectAuditAlarm 54683
105 NtCompactKeys 54704
106 NtCompareTokens 54725
107 NtCompleteConnectPort 54746
108 NtCompressKey 54767
109 NtConnectPort 54788
110 NtContinue 54809
111 NtCreateDebugObject 54830
112 NtCreateDirectoryObject 54851
113 NtCreateEvent 54872
114 NtCreateEventPair 54893
115 NtCreateFile 54914
116 NtCreateIoCompletion 54935
117 NtCreateJobObject 54956
118 NtCreateJobSet 54977
119 NtCreateKey 54998
120 NtCreateKeyedEvent 59996
121 NtCreateMailslotFile 55019
122 NtCreateMutant 55040
123 NtCreateNamedPipeFile 55061
124 NtCreatePagingFile 55082
125 NtCreatePort 55103
126 NtCreateProcess 55124
127 NtCreateProcessEx 55145
128 NtCreateProfile 55166
129 NtCreateSection 55187
130 NtCreateSemaphore 55208
131 NtCreateSymbolicLinkObject 55229
132 NtCreateThread 55250
133 NtCreateTimer 55271
134 NtCreateToken 55292
135 NtCreateWaitablePort 55313
136 NtCurrentTeb 4688
137 NtDebugActiveProcess 55334
138 NtDebugContinue 55355
139 NtDelayExecution 55376
140 NtDeleteAtom 55397
141 NtDeleteBootEntry 55418
142 NtDeleteFile 55439
143 NtDeleteKey 55460
144 NtDeleteObjectAuditAlarm 55481
145 NtDeleteValueKey 55502
146 NtDeviceIoControlFile 55523
147 NtDisplayString 55544
148 NtDuplicateObject 55565
149 NtDuplicateToken 55586
150 NtEnumerateBootEntries 55607
151 NtEnumerateKey 55628
153 NtEnumerateValueKey 55670
154 NtExtendSection 55691
155 NtFilterToken 55712
156 NtFindAtom 55733
157 NtFlushBuffersFile 55754
158 NtFlushInstructionCache 55775
159 NtFlushKey 55796
160 NtFlushVirtualMemory 55817
161 NtFlushWriteBuffer 55838
162 NtFreeUserPhysicalPages 55859
163 NtFreeVirtualMemory 55880
164 NtFsControlFile 55901
165 NtGetContextThread 55922
166 NtGetDevicePowerState 55943
167 NtGetPlugPlayEvent 55964
168 NtGetWriteWatch 55985
169 NtImpersonateAnonymousToken 56006
170 NtImpersonateClientOfPort 56027
171 NtImpersonateThread 56048
172 NtInitializeRegistry 56069
173 NtInitiatePowerAction 56090
174 NtIsProcessInJob 56111
175 NtIsSystemResumeAutomatic 56132
176 NtListenPort 56153
177 NtLoadDriver 56174
178 NtLoadKey 56195
179 NtLoadKey2 56216
180 NtLockFile 56237
181 NtLockProductActivationKeys 56258
182 NtLockRegistryKey 56279
183 NtLockVirtualMemory 56300
184 NtMakePermanentObject 56321
185 NtMakeTemporaryObject 56342
186 NtMapUserPhysicalPages 56363
187 NtMapUserPhysicalPagesScatter 56384
188 NtMapViewOfSection 56405
189 NtModifyBootEntry 56426
190 NtNotifyChangeDirectoryFile 56447
191 NtNotifyChangeKey 56468
192 NtNotifyChangeMultipleKeys 56489
193 NtOpenDirectoryObject 56510
194 NtOpenEvent 56531
195 NtOpenEventPair 56552
196 NtOpenFile 56573
197 NtOpenIoCompletion 56594
198 NtOpenJobObject 56615
199 NtOpenKey 56636
200 NtOpenKeyedEvent 60017
201 NtOpenMutant 56657
202 NtOpenObjectAuditAlarm 56678
203 NtOpenProcess 56699
204 NtOpenProcessToken 56720
205 NtOpenProcessTokenEx 56741
206 NtOpenSection 56762
207 NtOpenSemaphore 56783
208 NtOpenSymbolicLinkObject 56804
209 NtOpenThread 56825
210 NtOpenThreadToken 56846
211 NtOpenThreadTokenEx 56867
212 NtOpenTimer 56888
213 NtPlugPlayControl 56909
214 NtPowerInformation 56930
215 NtPrivilegeCheck 56951
216 NtPrivilegeObjectAuditAlarm 56972
217 NtPrivilegedServiceAuditAlarm 56993
218 NtProtectVirtualMemory 57014
219 NtPulseEvent 57035
220 NtQueryAttributesFile 57056
221 NtQueryBootEntryOrder 57077
222 NtQueryBootOptions 57098
223 NtQueryDebugFilterState 57119
224 NtQueryDefaultLocale 57140
225 NtQueryDefaultUILanguage 57161
226 NtQueryDirectoryFile 57182
227 NtQueryDirectoryObject 57203
228 NtQueryEaFile 57224
229 NtQueryEvent 57245
230 NtQueryFullAttributesFile 57266
231 NtQueryInformationAtom 57287
232 NtQueryInformationFile 57308
233 NtQueryInformationJobObject 57329
234 NtQueryInformationPort 57350
235 NtQueryInformationProcess 57371
236 NtQueryInformationThread 57392
237 NtQueryInformationToken 57413
238 NtQueryInstallUILanguage 57434
239 NtQueryIntervalProfile 57455
240 NtQueryIoCompletion 57476
241 NtQueryKey 57497
242 NtQueryMultipleValueKey 57518
243 NtQueryMutant 57539
244 NtQueryObject 57560
245 NtQueryOpenSubKeys 57581
246 NtQueryPerformanceCounter 57602
247 NtQueryPortInformationProcess 60080
248 NtQueryQuotaInformationFile 57623
249 NtQuerySection 57644
250 NtQuerySecurityObject 57665
251 NtQuerySemaphore 57686
252 NtQuerySymbolicLinkObject 57707
253 NtQuerySystemEnvironmentValue 57728
254 NtQuerySystemEnvironmentValueEx 57749
255 NtQuerySystemInformation 57770
256 NtQuerySystemTime 57791
257 NtQueryTimer 57812
258 NtQueryTimerResolution 57833
259 NtQueryValueKey 57854
260 NtQueryVirtualMemory 57875
261 NtQueryVolumeInformationFile 57896
262 NtQueueApcThread 57917
263 NtRaiseException 57938
264 NtRaiseHardError 57959
265 NtReadFile 57980
266 NtReadFileScatter 58001
267 NtReadRequestData 58022
268 NtReadVirtualMemory 58043
269 NtRegisterThreadTerminatePort 58064
270 NtReleaseKeyedEvent 60038
271 NtReleaseMutant 58085
272 NtReleaseSemaphore 58106
273 NtRemoveIoCompletion 58127
274 NtRemoveProcessDebug 58148
275 NtRenameKey 58169
276 NtReplaceKey 58190
277 NtReplyPort 58211
278 NtReplyWaitReceivePort 58232
279 NtReplyWaitReceivePortEx 58253
280 NtReplyWaitReplyPort 58274
281 NtRequestDeviceWakeup 58295
282 NtRequestPort 58316
283 NtRequestWaitReplyPort 58337
284 NtRequestWakeupLatency 58358
285 NtResetEvent 58379
286 NtResetWriteWatch 58400
287 NtRestoreKey 58421
288 NtResumeProcess 58442
289 NtResumeThread 58463
290 NtSaveKey 58484
291 NtSaveKeyEx 58505
292 NtSaveMergedKeys 58526
293 NtSecureConnectPort 58547
294 NtSetBootEntryOrder 58568
295 NtSetBootOptions 58589
296 NtSetContextThread 58610
297 NtSetDebugFilterState 58631
298 NtSetDefaultHardErrorPort 58652
299 NtSetDefaultLocale 58673
300 NtSetDefaultUILanguage 58694
301 NtSetEaFile 58715
302 NtSetEvent 58736
303 NtSetEventBoostPriority 58757
304 NtSetHighEventPair 58778
305 NtSetHighWaitLowEventPair 58799
306 NtSetInformationDebugObject 58820
307 NtSetInformationFile 58841
308 NtSetInformationJobObject 58862
309 NtSetInformationKey 58883
310 NtSetInformationObject 58904
311 NtSetInformationProcess 58925
312 NtSetInformationThread 58946
313 NtSetInformationToken 58967
314 NtSetIntervalProfile 58988
315 NtSetIoCompletion 59009
316 NtSetLdtEntries 59030
317 NtSetLowEventPair 59051
318 NtSetLowWaitHighEventPair 59072
319 NtSetQuotaInformationFile 59093
320 NtSetSecurityObject 59114
321 NtSetSystemEnvironmentValue 59135
322 NtSetSystemEnvironmentValueEx 59156
323 NtSetSystemInformation 59177
324 NtSetSystemPowerState 59198
325 NtSetSystemTime 59219
326 NtSetThreadExecutionState 59240
327 NtSetTimer 59261
328 NtSetTimerResolution 59282
329 NtSetUuidSeed 59303
330 NtSetValueKey 59324
331 NtSetVolumeInformationFile 59345
332 NtShutdownSystem 59366
333 NtSignalAndWaitForSingleObject 59387
334 NtStartProfile 59408
335 NtStopProfile 59429
336 NtSuspendProcess 59450
337 NtSuspendThread 59471
338 NtSystemDebugControl 59492
339 NtTerminateJobObject 59513
340 NtTerminateProcess 59534
341 NtTerminateThread 59555
342 NtTestAlert 59576
343 NtTraceEvent 59597
344 NtTranslateFilePath 59618
345 NtUnloadDriver 59639
346 NtUnloadKey 59660
347 NtUnloadKeyEx 59681
348 NtUnlockFile 59702
349 NtUnlockVirtualMemory 59723
350 NtUnmapViewOfSection 59744
351 NtVdmControl 59765
352 NtWaitForDebugEvent 59786
353 NtWaitForKeyedEvent 60059
354 NtWaitForMultipleObjects 59807
355 NtWaitForSingleObject 59828
356 NtWaitHighEventPair 59849
357 NtWaitLowEventPair 59870
358 NtWriteFile 59891
359 NtWriteFileGather 59912
360 NtWriteRequestData 59933
361 NtWriteVirtualMemory 59954
362 NtYieldExecution 59975
363 PfxFindPrefix 372145
364 PfxInitialize 371305
365 PfxInsertPrefix 371918
366 PfxRemovePrefix 371335
367 PropertyLengthAsVariant 362131
368 RtlAbortRXact 226777
369 RtlAbsoluteToSelfRelativeSD 171576
370 RtlAcquirePebLock 67869
371 RtlAcquireResourceExclusive 103164
372 RtlAcquireResourceShared 103102
373 RtlActivateActivationContext 95757
374 RtlActivateActivationContextEx 95367
376 RtlAddAccessAllowedAce 109155
377 RtlAddAccessAllowedAceEx 171624
378 RtlAddAccessAllowedObjectAce 373179
379 RtlAddAccessDeniedAce 191712
380 RtlAddAccessDeniedAceEx 373087
381 RtlAddAccessDeniedObjectAce 373256
382 RtlAddAce 229413
383 RtlAddActionToRXact 209035
384 RtlAddAtomToAtomTable 179714
385 RtlAddAttributeActionToRXact 208428
386 RtlAddAuditAccessAce 199945
387 RtlAddAuditAccessAceEx 373123
388 RtlAddAuditAccessObjectAce 373334
389 RtlAddCompoundAce 372507
390 RtlAddRange 377262
391 RtlAddRefActivationContext 65762
392 RtlAddRefMemoryStream 132505
393 RtlAddVectoredExceptionHandler 209387
394 RtlAddressInSectionTable 77234
395 RtlAdjustPrivilege 171660
396 RtlAllocateAndInitializeSid 109235
397 RtlAllocateHandle 112396
398 RtlAllocateHeap 67028
399 RtlAnsiCharToUnicodeChar 107457
400 RtlAnsiStringToUnicodeSize 384216
401 RtlAnsiStringToUnicodeString 61516
402 RtlAppendAsciizToString 385090
403 RtlAppendPathElement 121741
404 RtlAppendStringToString 385181
405 RtlAppendUnicodeStringToString 85431
406 RtlAppendUnicodeToString 85314
407 RtlApplicationVerifierStop 348237
408 RtlApplyRXact 208903
409 RtlApplyRXactNoFlush 194159
410 RtlAreAllAccessesGranted 164420
411 RtlAreAnyAccessesGranted 224557
412 RtlAreBitsClear 386759
413 RtlAreBitsSet 155567
414 RtlAssert 388265
415 RtlAssert2 387739
416 RtlCancelTimer 388849
417 RtlCaptureContext 14405
418 RtlCaptureStackBackTrace 389553
419 RtlCaptureStackContext 389297
420 RtlCharToInteger 177793
422 RtlCheckProcessParameters 200355
423 RtlCheckRegistryKey 197428
424 RtlClearAllBits 183995
425 RtlClearBits 155497
426 RtlCloneMemoryStream 335974
427 RtlCommitMemoryStream 335974
428 RtlCompactHeap 181409
429 RtlCompareMemory 12278
430 RtlCompareMemoryUlong 12363
431 RtlCompareString 384870
432 RtlCompareUnicodeString 96178
433 RtlCompressBuffer 397997
434 RtlComputeCrc32 398577
435 RtlComputeImportTableHash 360503
436 RtlComputePrivatizedDllName_U 334947
437 RtlConsoleMultiByteToUnicodeN 152097
438 RtlConvertExclusiveToShared 226599
439 RtlConvertLongToLargeInteger 14136
440 RtlConvertPropertyToVariant 361979
441 RtlConvertSharedToExclusive 226533
442 RtlConvertSidToUnicodeString 84573
444 RtlConvertUiListToApiList 338231
445 RtlConvertUlongToLargeInteger 14149
446 RtlConvertVariantToProperty 361821
447 RtlCopyLuid 79460
448 RtlCopyLuidAndAttributesArray 378327
449 RtlCopyMemoryStreamTo 335858
451 RtlCopyRangeList 375237
452 RtlCopySecurityDescriptor 184532
453 RtlCopySid 79490
454 RtlCopySidAndAttributesArray 378138
455 RtlCopyString 190087
456 RtlCopyUnicodeString 85217
457 RtlCreateAcl 109073
458 RtlCreateActivationContext 133835
459 RtlCreateAndSetSD 194408
460 RtlCreateAtomTable 180210
461 RtlCreateBootStatusDataFile 399661
462 RtlCreateEnvironment 226428
463 RtlCreateHeap 152874
464 RtlCreateProcessParameters 144321
465 RtlCreateQueryDebugBuffer 339671
466 RtlCreateRegistryKey 390912
467 RtlCreateSecurityDescriptor 108665
469 RtlCreateTagHeap 141184
470 RtlCreateTimer 188332
471 RtlCreateTimerQueue 191480
472 RtlCreateUnicodeString 80202
473 RtlCreateUnicodeStringFromAsciiz 79249
474 RtlCreateUserProcess 201349
475 RtlCreateUserSecurityObject 194288
476 RtlCreateUserThread 212802
477 RtlCustomCPToUnicodeN 368229
478 RtlCutoverTimeToSystemTime 222504
479 RtlDeNormalizeProcessParams 144147
480 RtlDeactivateActivationContext 95977
482 RtlDebugPrintTimes 388364
483 RtlDecodePointer 80189
484 RtlDecodeSystemPointer 110536
485 RtlDecompressBuffer 398121
486 RtlDecompressFragment 398229
487 RtlDefaultNpAcl 337461
488 RtlDelete 151648
489 RtlDeleteAce 209808
490 RtlDeleteAtomFromAtomTable 177373
491 RtlDeleteCriticalSection 71818
492 RtlDeleteElementGenericTable 151551
493 RtlDeleteElementGenericTableAvl 404038
494 RtlDeleteNoSplay 402526
495 RtlDeleteOwnersRanges 377719
496 RtlDeleteRange 377401
497 RtlDeleteRegistryValue 212384
498 RtlDeleteResource 147577
499 RtlDeleteSecurityObject 228632
500 RtlDeleteTimer 186119
501 RtlDeleteTimerQueue 388809
502 RtlDeleteTimerQueueEx 388545
503 RtlDeregisterWait 187555
504 RtlDeregisterWaitEx 186747
505 RtlDestroyAtomTable 373482
506 RtlDestroyEnvironment 136026
507 RtlDestroyHandleTable 147356
508 RtlDestroyHeap 155030
509 RtlDestroyProcessParameters 144108
510 RtlDestroyQueryDebugBuffer 339903
511 RtlDetermineDosPathNameType_U 80287
512 RtlDllShutdownInProgress 163600
513 RtlDnsHostNameToComputerName 212087
514 RtlDoesFileExists_U 106672
516 RtlDosPathNameToNtPathName_U 82173
517 RtlDosSearchPath_U 93689
518 RtlDosSearchPath_Ustr 109583
519 RtlDowncaseUnicodeChar 384086
520 RtlDowncaseUnicodeString 171833
521 RtlDumpResource 336010
522 RtlDuplicateUnicodeString 136389
523 RtlEmptyAtomTable 373697
525 RtlEncodePointer 80151
526 RtlEncodeSystemPointer 110536
527 RtlEnlargedIntegerMultiply 13534
528 RtlEnlargedUnsignedDivide 13568
529 RtlEnlargedUnsignedMultiply 13551
530 RtlEnterCriticalSection 4101
531 RtlEnumProcessHeaps 393369
532 RtlEnumerateGenericTable 402791
533 RtlEnumerateGenericTableAvl 200000
537 RtlEqualComputerName 384854
538 RtlEqualDomainName 229131
539 RtlEqualLuid 378286
540 RtlEqualPrefixSid 218505
541 RtlEqualSid 107636
542 RtlEqualString 163999
543 RtlEqualUnicodeString 78798
544 RtlEraseUnicodeString 194221
545 RtlExitUserThread 400355
546 RtlExpandEnvironmentStrings_U 83154
547 RtlExtendHeap 392665
548 RtlExtendedIntegerMultiply 13853
549 RtlExtendedLargeIntegerDivide 13605
550 RtlExtendedMagicDivide 13703
551 RtlFillMemory 12416
552 RtlFillMemoryUlong 12533
556 RtlFindCharInUnicodeString 88937
557 RtlFindClearBits 154629
558 RtlFindClearBitsAndSet 154829
559 RtlFindClearRuns 385954
560 RtlFindLastBackwardRunClear 387140
561 RtlFindLeastSignificantBit 387519
562 RtlFindLongestRunClear 386537
563 RtlFindMessage 224085
564 RtlFindMostSignificantBit 387348
565 RtlFindNextForwardRunClear 386890
566 RtlFindRange 375576
567 RtlFindSetBits 385265
568 RtlFindSetBitsAndClear 387688
569 RtlFirstEntrySList 12162
570 RtlFirstFreeAce 108802
571 RtlFlushSecureMemoryCache 404476
572 RtlFormatCurrentUserKeyPath 85537
573 RtlFormatMessage 169984
574 RtlFreeAnsiString 67958
575 RtlFreeHandle 79959
576 RtlFreeHeap 66621
577 RtlFreeOemString 229224
578 RtlFreeRangeList 374620
579 RtlFreeSid 109190
581 RtlFreeUnicodeString 67958
582 RtlFreeUserThreadStack 400397
583 RtlGUIDFromString 158471
584 RtlGenerate8dot3Name 405610
585 RtlGetAce 232809
586 RtlGetActiveActivationContext 117884
587 RtlGetCallersAddress 389738
588 RtlGetCompressionWorkSpaceSize 397889
589 RtlGetControlSecurityDescriptor 228586
590 RtlGetCurrentDirectory_U 82703
591 RtlGetCurrentPeb 390897
592 RtlGetDaclSecurityDescriptor 164153
593 RtlGetElementGenericTable 402654
594 RtlGetElementGenericTableAvl 403665
595 RtlGetFirstRange 374689
596 RtlGetFrame 132274
597 RtlGetFullPathName_U 82353
598 RtlGetGroupSecurityDescriptor 228836
599 RtlGetLastNtStatus 406615
600 RtlGetLastWin32Error 66353
603 RtlGetLongestNtPathLength 83935
604 RtlGetNativeSystemInformation 57770
605 RtlGetNextRange 374873
606 RtlGetNtGlobalFlags 66603
607 RtlGetNtProductType 106022
608 RtlGetNtVersionNumbers 137401
609 RtlGetOwnerSecurityDescriptor 228770
610 RtlGetProcessHeaps 393185
611 RtlGetSaclSecurityDescriptor 378374
613 RtlGetSetBootStatusData 200987
614 RtlGetUnloadEventTrace 331315
615 RtlGetUserInfoHeap 103608
616 RtlGetVersion 105785
617 RtlHashUnicodeString 87141
618 RtlIdentifierAuthoritySid 174564
619 RtlImageDirectoryEntryToData 67670
620 RtlImageNtHeader 67657
621 RtlImageRvaToSection 77284
622 RtlImageRvaToVa 202842
623 RtlImpersonateSelf 174717
624 RtlInitAnsiString 4761
625 RtlInitCodePageTable 142238
626 RtlInitMemoryStream 131913
627 RtlInitNlsTables 142189
628 RtlInitOutOfProcessMemoryStream 131815
629 RtlInitString 4700
630 RtlInitUnicodeString 4822
631 RtlInitUnicodeStringEx 66469
632 RtlInitializeAtomPackage 141160
633 RtlInitializeBitMap 110508
634 RtlInitializeContext 213121
635 RtlInitializeCriticalSection 72493
637 RtlInitializeGenericTable 137785
638 RtlInitializeGenericTableAvl 200301
639 RtlInitializeHandleTable 160131
640 RtlInitializeRXact 199462
641 RtlInitializeRangeList 374081
642 RtlInitializeResource 135579
643 RtlInitializeSListHead 233488
644 RtlInitializeSid 107709
645 RtlInitializeStackTraceDataBase 407257
646 RtlInsertElementGenericTable 150974
647 RtlInsertElementGenericTableAvl 403987
648 RtlInt64ToUnicodeString 390785
649 RtlIntegerToChar 101080
650 RtlIntegerToUnicodeString 101374
651 RtlInterlockedFlushSList 407031
652 RtlInterlockedPopEntrySList 231140
653 RtlInterlockedPushEntrySList 231074
654 RtlInterlockedPushListSList 12117
655 RtlInvertRangeList 377896
656 RtlIpv4AddressToStringA 408509
657 RtlIpv4AddressToStringExA 408587
658 RtlIpv4AddressToStringExW 192808
659 RtlIpv4AddressToStringW 192928
660 RtlIpv4StringToAddressA 226148
661 RtlIpv4StringToAddressExA 410986
662 RtlIpv4StringToAddressExW 209323
663 RtlIpv4StringToAddressW 232143
664 RtlIpv6AddressToStringA 407723
665 RtlIpv6AddressToStringExA 408279
666 RtlIpv6AddressToStringExW 409369
667 RtlIpv6AddressToStringW 408753
668 RtlIpv6StringToAddressA 409613
669 RtlIpv6StringToAddressExA 410413
670 RtlIpv6StringToAddressExW 412161
671 RtlIpv6StringToAddressW 411395
672 RtlIsActivationContextActive 354910
673 RtlIsDosDeviceName_U 79296
674 RtlIsGenericTableEmpty 160089
675 RtlIsGenericTableEmptyAvl 403640
676 RtlIsNameLegalDOS8Dot3 405225
677 RtlIsRangeAvailable 376475
678 RtlIsTextUnicode 169060
679 RtlIsThreadWithinLoaderCallout 332841
680 RtlIsValidHandle 79861
681 RtlIsValidIndexHandle 80102
682 RtlLargeIntegerAdd 13509
683 RtlLargeIntegerArithmeticShift 14037
684 RtlLargeIntegerDivide 412772
685 RtlLargeIntegerNegate 14086
686 RtlLargeIntegerShiftLeft 13947
687 RtlLargeIntegerShiftRight 13992
688 RtlLargeIntegerSubtract 14111
689 RtlLargeIntegerToChar 389812
690 RtlLeaveCriticalSection 4333
691 RtlLengthRequiredSid 174540
692 RtlLengthSecurityDescriptor 228392
693 RtlLengthSid 79542
694 RtlLocalTimeToSystemTime 402370
695 RtlLockBootStatusData 200637
696 RtlLockHeap 79651
697 RtlLockMemoryStreamRegion 335845
698 RtlLogStackBackTrace 72420
699 RtlLookupAtomInAtomTable 164918
700 RtlLookupElementGenericTable 136633
701 RtlLookupElementGenericTableAvl 404383
702 RtlMakeSelfRelativeSD 171374
703 RtlMapGenericMask 164342
704 RtlMapSecurityErrorToNtStatus 379118
705 RtlMergeRangeLists 377038
706 RtlMoveMemory 12625
708 RtlMultiByteToUnicodeN 61899
709 RtlMultiByteToUnicodeSize 169876
710 RtlNewInstanceSecurityObject 336978
711 RtlNewSecurityGrantedAccess 337096
712 RtlNewSecurityObject 193021
713 RtlNewSecurityObjectEx 216341
715 RtlNormalizeProcessParams 141406
716 RtlNtPathNameToDosPathName 149402
717 RtlNtStatusToDosError 64317
718 RtlNtStatusToDosErrorNoTeb 64393
719 RtlNumberGenericTableElements 147408
720 RtlNumberGenericTableElementsAvl 403878
721 RtlNumberOfClearBits 386592
722 RtlNumberOfSetBits 386672
723 RtlOemStringToUnicodeSize 384216
724 RtlOemStringToUnicodeString 156761
725 RtlOemToUnicodeN 156464
726 RtlOpenCurrentUser 110601
727 RtlPcToFileHeader 230732
728 RtlPinAtomInAtomTable 373897
729 RtlPopFrame 106944
730 RtlPrefixString 191817
731 RtlPrefixUnicodeString 82448
732 RtlProtectHeap 391618
733 RtlPushFrame 106976
734 RtlQueryAtomInAtomTable 180373
735 RtlQueryDepthSList 231248
736 RtlQueryEnvironmentVariable_U 82849
737 RtlQueryHeapInformation 395691
738 RtlQueryInformationAcl 188705
741 RtlQueryInterfaceMemoryStream 132533
743 RtlQueryProcessDebugInformation 342251
744 RtlQueryProcessHeapInformation 340553
745 RtlQueryProcessLockInformation 341877
746 RtlQueryRegistryValues 195713
747 RtlQuerySecurityObject 336464
748 RtlQueryTagHeap 392309
749 RtlQueryTimeZoneInformation 391041
750 RtlQueueApcWow64Thread 354813
751 RtlQueueWorkItem 161496
752 RtlRaiseException 60332
753 RtlRaiseStatus 413355
754 RtlRandom 413402
755 RtlRandomEx 207367
756 RtlReAllocateHeap 96765
757 RtlReadMemoryStream 137847
758 RtlReadOutOfProcessMemoryStream 133471
759 RtlRealPredecessor 402465
760 RtlRealSuccessor 160035
762 RtlRegisterWait 219635
763 RtlReleaseActivationContext 68183
764 RtlReleaseMemoryStream 132005
765 RtlReleasePebLock 67937
766 RtlReleaseResource 103043
767 RtlRemoteCall 406666
769 RtlResetRtlTranslations 141859
770 RtlRestoreLastWin32Error 66368
771 RtlRevertMemoryStream 335987
772 RtlRunDecodeUnicodeString 192395
773 RtlRunEncodeUnicodeString 192317
774 RtlSecondsSince1970ToTime 402315
775 RtlSecondsSince1980ToTime 402260
776 RtlSeekMemoryStream 335734
777 RtlSelfRelativeToAbsoluteSD 188948
778 RtlSelfRelativeToAbsoluteSD2 372304
779 RtlSetAllBits 184044
781 RtlSetBits 154880
782 RtlSetControlSecurityDescriptor 197473
783 RtlSetCriticalSectionSpinCount 164448
784 RtlSetCurrentDirectory_U 134862
785 RtlSetCurrentEnvironment 400133
786 RtlSetDaclSecurityDescriptor 108711
787 RtlSetEnvironmentVariable 159413
788 RtlSetGroupSecurityDescriptor 110434
789 RtlSetHeapInformation 207942
790 RtlSetInformationAcl 372431
791 RtlSetIoCompletionCallback 192141
792 RtlSetLastWin32Error 66368
794 RtlSetMemoryStreamSize 335832
795 RtlSetOwnerSecurityDescriptor 110360
796 RtlSetProcessIsCritical 193602
797 RtlSetSaclSecurityDescriptor 188818
799 RtlSetSecurityObject 184716
800 RtlSetSecurityObjectEx 336423
801 RtlSetThreadIsCritical 193686
802 RtlSetThreadPoolStartFunc 141249
803 RtlSetTimeZoneInformation 391337
804 RtlSetTimer 388833
805 RtlSetUnicodeCallouts 362281
806 RtlSetUserFlagsHeap 391973
807 RtlSetUserValueHeap 112481
808 RtlSizeHeap 68077
809 RtlSplay 136290
810 RtlStartRXact 226694
811 RtlStatMemoryStream 133650
812 RtlStringFromGUID 168852
813 RtlSubAuthorityCountSid 163616
814 RtlSubAuthoritySid 107680
815 RtlSubtreePredecessor 151516
816 RtlSubtreeSuccessor 402430
817 RtlSystemTimeToLocalTime 232083
818 RtlTimeFieldsToTime 100617
819 RtlTimeToElapsedTimeFields 402157
820 RtlTimeToSecondsSince1970 185935
821 RtlTimeToSecondsSince1980 176531
822 RtlTimeToTimeFields 74765
823 RtlTraceDatabaseAdd 415067
824 RtlTraceDatabaseCreate 414093
825 RtlTraceDatabaseDestroy 414335
826 RtlTraceDatabaseEnumerate 413957
827 RtlTraceDatabaseFind 414567
828 RtlTraceDatabaseLock 415035
829 RtlTraceDatabaseUnlock 415051
830 RtlTraceDatabaseValidate 414493
831 RtlTryEnterCriticalSection 4395
832 RtlUlongByteSwap 12233
833 RtlUlonglongByteSwap 12254
834 RtlUnhandledExceptionFilter 418031
835 RtlUnhandledExceptionFilter2 415597
836 RtlUnicodeStringToAnsiSize 384179
837 RtlUnicodeStringToAnsiString 78022
839 RtlUnicodeStringToInteger 101473
840 RtlUnicodeStringToOemSize 384179
841 RtlUnicodeStringToOemString 156126
842 RtlUnicodeToCustomCPN 368713
843 RtlUnicodeToMultiByteN 77723
844 RtlUnicodeToMultiByteSize 79570
845 RtlUnicodeToOemN 155836
846 RtlUniform 224040
847 RtlUnlockBootStatusData 200917
848 RtlUnlockHeap 79755
849 RtlUnlockMemoryStreamRegion 335845
850 RtlUnwind 227904
851 RtlUpcaseUnicodeChar 67824
852 RtlUpcaseUnicodeString 160748
856 RtlUpcaseUnicodeToCustomCPN 369145
857 RtlUpcaseUnicodeToMultiByteN 148827
858 RtlUpcaseUnicodeToOemN 182933
859 RtlUpdateTimer 230349
860 RtlUpperChar 169916
861 RtlUpperString 385017
862 RtlUsageHeap 396520
863 RtlUshortByteSwap 12212
864 RtlValidAcl 108533
866 RtlValidSecurityDescriptor 232597
867 RtlValidSid 78999
868 RtlValidateHeap 395800
869 RtlValidateProcessHeaps 396347
870 RtlValidateUnicodeString 89202
871 RtlVerifyVersionInfo 176861
872 RtlWalkFrameChain 388922
873 RtlWalkHeap 393505
874 RtlWriteMemoryStream 335721
875 RtlWriteRegistryValue 212292
876 RtlZeroHeap 383399
877 RtlZeroMemory 12571
878 RtlZombifyActivationContext 354829
879 RtlpApplyLengthFunction 132400
880 RtlpEnsureBufferSize 125239
881 RtlpNotOwnerCriticalSection 336214
882 RtlpNtCreateKey 418227
883 RtlpNtEnumerateSubKey 223753
884 RtlpNtMakeTemporaryKey 418316
885 RtlpNtOpenKey 171143
886 RtlpNtQueryValueKey 170950
887 RtlpNtSetValueKey 418272
888 RtlpUnWaitCriticalSection 102487
889 RtlpWaitForCriticalSection 102287
890 RtlxAnsiStringToUnicodeSize 384216
891 RtlxOemStringToUnicodeSize 384216
892 RtlxUnicodeStringToAnsiSize 384179
893 RtlxUnicodeStringToOemSize 384179
894 VerSetConditionMask 176799
895 ZwAcceptConnectPort 54137
896 ZwAccessCheck 54158
897 ZwAccessCheckAndAuditAlarm 54179
898 ZwAccessCheckByType 54200
899 ZwAccessCheckByTypeAndAuditAlarm 54221
900 ZwAccessCheckByTypeResultList 54242
903 ZwAddAtom 54305
904 ZwAddBootEntry 54326
905 ZwAdjustGroupsToken 54347
906 ZwAdjustPrivilegesToken 54368
907 ZwAlertResumeThread 54389
908 ZwAlertThread 54410
909 ZwAllocateLocallyUniqueId 54431
910 ZwAllocateUserPhysicalPages 54452
911 ZwAllocateUuids 54473
912 ZwAllocateVirtualMemory 54494
913 ZwAreMappedFilesTheSame 54515
914 ZwAssignProcessToJobObject 54536
915 ZwCallbackReturn 54557
916 ZwCancelDeviceWakeupRequest 54578
917 ZwCancelIoFile 54599
918 ZwCancelTimer 54620
919 ZwClearEvent 54641
920 ZwClose 54662
921 ZwCloseObjectAuditAlarm 54683
922 ZwCompactKeys 54704
923 ZwCompareTokens 54725
924 ZwCompleteConnectPort 54746
925 ZwCompressKey 54767
926 ZwConnectPort 54788
927 ZwContinue 54809
928 ZwCreateDebugObject 54830
929 ZwCreateDirectoryObject 54851
930 ZwCreateEvent 54872
931 ZwCreateEventPair 54893
932 ZwCreateFile 54914
933 ZwCreateIoCompletion 54935
934 ZwCreateJobObject 54956
935 ZwCreateJobSet 54977
936 ZwCreateKey 54998
937 ZwCreateKeyedEvent 59996
938 ZwCreateMailslotFile 55019
939 ZwCreateMutant 55040
940 ZwCreateNamedPipeFile 55061
941 ZwCreatePagingFile 55082
942 ZwCreatePort 55103
943 ZwCreateProcess 55124
944 ZwCreateProcessEx 55145
945 ZwCreateProfile 55166
946 ZwCreateSection 55187
947 ZwCreateSemaphore 55208
948 ZwCreateSymbolicLinkObject 55229
949 ZwCreateThread 55250
950 ZwCreateTimer 55271
951 ZwCreateToken 55292
952 ZwCreateWaitablePort 55313
953 ZwDebugActiveProcess 55334
954 ZwDebugContinue 55355
955 ZwDelayExecution 55376
956 ZwDeleteAtom 55397
957 ZwDeleteBootEntry 55418
958 ZwDeleteFile 55439
959 ZwDeleteKey 55460
960 ZwDeleteObjectAuditAlarm 55481
961 ZwDeleteValueKey 55502
962 ZwDeviceIoControlFile 55523
963 ZwDisplayString 55544
964 ZwDuplicateObject 55565
965 ZwDuplicateToken 55586
966 ZwEnumerateBootEntries 55607
967 ZwEnumerateKey 55628
969 ZwEnumerateValueKey 55670
970 ZwExtendSection 55691
971 ZwFilterToken 55712
972 ZwFindAtom 55733
973 ZwFlushBuffersFile 55754
974 ZwFlushInstructionCache 55775
975 ZwFlushKey 55796
976 ZwFlushVirtualMemory 55817
977 ZwFlushWriteBuffer 55838
978 ZwFreeUserPhysicalPages 55859
979 ZwFreeVirtualMemory 55880
980 ZwFsControlFile 55901
981 ZwGetContextThread 55922
982 ZwGetDevicePowerState 55943
983 ZwGetPlugPlayEvent 55964
984 ZwGetWriteWatch 55985
985 ZwImpersonateAnonymousToken 56006
986 ZwImpersonateClientOfPort 56027
987 ZwImpersonateThread 56048
988 ZwInitializeRegistry 56069
989 ZwInitiatePowerAction 56090
990 ZwIsProcessInJob 56111
991 ZwIsSystemResumeAutomatic 56132
992 ZwListenPort 56153
993 ZwLoadDriver 56174
994 ZwLoadKey 56195
995 ZwLoadKey2 56216
996 ZwLockFile 56237
997 ZwLockProductActivationKeys 56258
998 ZwLockRegistryKey 56279
999 ZwLockVirtualMemory 56300
1000 ZwMakePermanentObject 56321
1001 ZwMakeTemporaryObject 56342
1002 ZwMapUserPhysicalPages 56363
1003 ZwMapUserPhysicalPagesScatter 56384
1004 ZwMapViewOfSection 56405
1005 ZwModifyBootEntry 56426
1006 ZwNotifyChangeDirectoryFile 56447
1007 ZwNotifyChangeKey 56468
1008 ZwNotifyChangeMultipleKeys 56489
1009 ZwOpenDirectoryObject 56510
1010 ZwOpenEvent 56531
1011 ZwOpenEventPair 56552
1012 ZwOpenFile 56573
1013 ZwOpenIoCompletion 56594
1014 ZwOpenJobObject 56615
1015 ZwOpenKey 56636
1016 ZwOpenKeyedEvent 60017
1017 ZwOpenMutant 56657
1018 ZwOpenObjectAuditAlarm 56678
1019 ZwOpenProcess 56699
1020 ZwOpenProcessToken 56720
1021 ZwOpenProcessTokenEx 56741
1022 ZwOpenSection 56762
1023 ZwOpenSemaphore 56783
1024 ZwOpenSymbolicLinkObject 56804
1025 ZwOpenThread 56825
1026 ZwOpenThreadToken 56846
1027 ZwOpenThreadTokenEx 56867
1028 ZwOpenTimer 56888
1029 ZwPlugPlayControl 56909
1030 ZwPowerInformation 56930
1031 ZwPrivilegeCheck 56951
1032 ZwPrivilegeObjectAuditAlarm 56972
1033 ZwPrivilegedServiceAuditAlarm 56993
1034 ZwProtectVirtualMemory 57014
1035 ZwPulseEvent 57035
1036 ZwQueryAttributesFile 57056
1037 ZwQueryBootEntryOrder 57077
1038 ZwQueryBootOptions 57098
1039 ZwQueryDebugFilterState 57119
1040 ZwQueryDefaultLocale 57140
1041 ZwQueryDefaultUILanguage 57161
1042 ZwQueryDirectoryFile 57182
1043 ZwQueryDirectoryObject 57203
1044 ZwQueryEaFile 57224
1045 ZwQueryEvent 57245
1046 ZwQueryFullAttributesFile 57266
1047 ZwQueryInformationAtom 57287
1048 ZwQueryInformationFile 57308
1049 ZwQueryInformationJobObject 57329
1050 ZwQueryInformationPort 57350
1051 ZwQueryInformationProcess 57371
1052 ZwQueryInformationThread 57392
1053 ZwQueryInformationToken 57413
1054 ZwQueryInstallUILanguage 57434
1055 ZwQueryIntervalProfile 57455
1056 ZwQueryIoCompletion 57476
1057 ZwQueryKey 57497
1058 ZwQueryMultipleValueKey 57518
1059 ZwQueryMutant 57539
1060 ZwQueryObject 57560
1061 ZwQueryOpenSubKeys 57581
1062 ZwQueryPerformanceCounter 57602
1063 ZwQueryPortInformationProcess 60080
1064 ZwQueryQuotaInformationFile 57623
1065 ZwQuerySection 57644
1066 ZwQuerySecurityObject 57665
1067 ZwQuerySemaphore 57686
1068 ZwQuerySymbolicLinkObject 57707
1069 ZwQuerySystemEnvironmentValue 57728
1070 ZwQuerySystemEnvironmentValueEx 57749
1071 ZwQuerySystemInformation 57770
1072 ZwQuerySystemTime 57791
1073 ZwQueryTimer 57812
1074 ZwQueryTimerResolution 57833
1075 ZwQueryValueKey 57854
1076 ZwQueryVirtualMemory 57875
1077 ZwQueryVolumeInformationFile 57896
1078 ZwQueueApcThread 57917
1079 ZwRaiseException 57938
1080 ZwRaiseHardError 57959
1081 ZwReadFile 57980
1082 ZwReadFileScatter 58001
1083 ZwReadRequestData 58022
1084 ZwReadVirtualMemory 58043
1085 ZwRegisterThreadTerminatePort 58064
1086 ZwReleaseKeyedEvent 60038
1087 ZwReleaseMutant 58085
1088 ZwReleaseSemaphore 58106
1089 ZwRemoveIoCompletion 58127
1090 ZwRemoveProcessDebug 58148
1091 ZwRenameKey 58169
1092 ZwReplaceKey 58190
1093 ZwReplyPort 58211
1094 ZwReplyWaitReceivePort 58232
1095 ZwReplyWaitReceivePortEx 58253
1096 ZwReplyWaitReplyPort 58274
1097 ZwRequestDeviceWakeup 58295
1098 ZwRequestPort 58316
1099 ZwRequestWaitReplyPort 58337
1100 ZwRequestWakeupLatency 58358
1101 ZwResetEvent 58379
1102 ZwResetWriteWatch 58400
1103 ZwRestoreKey 58421
1104 ZwResumeProcess 58442
1105 ZwResumeThread 58463
1106 ZwSaveKey 58484
1107 ZwSaveKeyEx 58505
1108 ZwSaveMergedKeys 58526
1109 ZwSecureConnectPort 58547
1110 ZwSetBootEntryOrder 58568
1111 ZwSetBootOptions 58589
1112 ZwSetContextThread 58610
1113 ZwSetDebugFilterState 58631
1114 ZwSetDefaultHardErrorPort 58652
1115 ZwSetDefaultLocale 58673
1116 ZwSetDefaultUILanguage 58694
1117 ZwSetEaFile 58715
1118 ZwSetEvent 58736
1119 ZwSetEventBoostPriority 58757
1120 ZwSetHighEventPair 58778
1121 ZwSetHighWaitLowEventPair 58799
1122 ZwSetInformationDebugObject 58820
1123 ZwSetInformationFile 58841
1124 ZwSetInformationJobObject 58862
1125 ZwSetInformationKey 58883
1126 ZwSetInformationObject 58904
1127 ZwSetInformationProcess 58925
1128 ZwSetInformationThread 58946
1129 ZwSetInformationToken 58967
1130 ZwSetIntervalProfile 58988
1131 ZwSetIoCompletion 59009
1132 ZwSetLdtEntries 59030
1133 ZwSetLowEventPair 59051
1134 ZwSetLowWaitHighEventPair 59072
1135 ZwSetQuotaInformationFile 59093
1136 ZwSetSecurityObject 59114
1137 ZwSetSystemEnvironmentValue 59135
1138 ZwSetSystemEnvironmentValueEx 59156
1139 ZwSetSystemInformation 59177
1140 ZwSetSystemPowerState 59198
1141 ZwSetSystemTime 59219
1142 ZwSetThreadExecutionState 59240
1143 ZwSetTimer 59261
1144 ZwSetTimerResolution 59282
1145 ZwSetUuidSeed 59303
1146 ZwSetValueKey 59324
1147 ZwSetVolumeInformationFile 59345
1148 ZwShutdownSystem 59366
1149 ZwSignalAndWaitForSingleObject 59387
1150 ZwStartProfile 59408
1151 ZwStopProfile 59429
1152 ZwSuspendProcess 59450
1153 ZwSuspendThread 59471
1154 ZwSystemDebugControl 59492
1155 ZwTerminateJobObject 59513
1156 ZwTerminateProcess 59534
1157 ZwTerminateThread 59555
1158 ZwTestAlert 59576
1159 ZwTraceEvent 59597
1160 ZwTranslateFilePath 59618
1161 ZwUnloadDriver 59639
1162 ZwUnloadKey 59660
1163 ZwUnloadKeyEx 59681
1164 ZwUnlockFile 59702
1165 ZwUnlockVirtualMemory 59723
1166 ZwUnmapViewOfSection 59744
1167 ZwVdmControl 59765
1168 ZwWaitForDebugEvent 59786
1169 ZwWaitForKeyedEvent 60059
1170 ZwWaitForMultipleObjects 59807
1171 ZwWaitForSingleObject 59828
1172 ZwWaitHighEventPair 59849
1173 ZwWaitLowEventPair 59870
1174 ZwWriteFile 59891
1175 ZwWriteFileGather 59912
1176 ZwWriteRequestData 59933
1177 ZwWriteVirtualMemory 59954
1178 ZwYieldExecution 59975
1235 abs 460268
1236 atan 7541
1237 atoi 150569
1238 atol 150580
1239 bsearch 86011
1240 ceil 7710
1241 cos 4907
1242 fabs 459982
1243 floor 8029
1244 isalnum 457820
1245 isalpha 457504
1246 iscntrl 457988
1247 isdigit 225932
1248 isgraph 457932
1249 islower 457611
1250 isprint 457876
1251 ispunct 457769
1252 isspace 457718
1253 isupper 457560
1254 iswalpha 460166
1255 iswctype 157409
1256 iswdigit 157573
1257 iswlower 460193
1258 iswspace 460244
1259 iswxdigit 460217
1260 isxdigit 457662
1261 labs 460268
1262 log 5066
1263 mbstowcs 150698
1264 memchr 8357
1265 memcmp 8527
1266 memcpy 8704
1267 memmove 9530
1268 memset 10362
1269 pow 5293
1270 qsort 132073
1271 sin 5855
1272 sprintf 168238
1273 sqrt 6034
1274 sscanf 460289
1275 strcat 10476
1276 strchr 60673
1277 strcmp 10705
1278 strcpy 10455
1279 strcspn 10843
1280 strlen 10909
1281 strncat 11035
1282 strncmp 11331
1283 strncpy 11392
1284 strpbrk 11651
1285 strrchr 11713
1286 strspn 11757
1287 strstr 60527
1288 strtol 460790
1289 strtoul 460821
1290 swprintf 108291
1291 tan 11838
1292 tolower 459560
1293 toupper 147633
1294 towlower 104300
1295 towupper 460852
1296 vDbgPrintEx 131772
1297 vDbgPrintExWithPrefix 125611
1298 vsprintf 460872
1299 wcscat 107353
1300 wcschr 83850
1301 wcscmp 233319
1302 wcscpy 78963
1303 wcscspn 175742
1304 wcslen 66394
1305 wcsncat 110708
1306 wcsncmp 160688
1307 wcsncpy 68239
1308 wcspbrk 460966
1309 wcsrchr 83097
1310 wcsspn 461039
1311 wcsstr 135754
1312 wcstol 233171
1313 wcstombs 461117
1314 wcstoul 219472
#include <windows.h>
#include <winbase.h>
#include <stdio.h>
#include <tchar.h>
#include <imagehlp.h>
void PrintUsage(char * msg)
{
printf("|---------------------------------------------------------|/n");
printf("| CreateDate: 2000-02-15 |/n");
printf("| Usage: <Path>//GetFunction[.exe] <Exe file|DLL file> |/n");
printf("|---------------------------------------------------------|/n");
return;
}
BOOL CheckFunction(PCHAR pf)
{
int iCount=strlen(pf);
for(int i=0;i<iCount;i++)
{
if ((pf[i]<'0')||(pf[i]>'z')) return FALSE;
}
return TRUE;
}
int main(int argc,char **argv)
{
PIMAGE_NT_HEADERS nt_headers;
PIMAGE_EXPORT_DIRECTORY export_data;
DWORD export_data_size;
PDWORD FunctionsNames,FunctionsPtrs;
PWORD NameOrdinals;
HANDLE hFile,hFileMap;
DWORD file_attributes;
PVOID mod_base,func_ptr=0,image_base;
char file_path[MAX_PATH];
char * func_name;
LPWIN32_FIND_DATA lpwfd_first=new WIN32_FIND_DATA;
DWORD i,dwretcode;
char * lpTmp=new char[MAX_PATH];
BOOLEAN bcp=FALSE;
if (argc<2)
{
PrintUsage (argv[0]);
return 0;
}
// GetFullPathName (argv[1],MAX_PATH,file_path ,NULL);
sprintf(file_path,argv[1]);
if (FindFirstFile (file_path,lpwfd_first)==NULL)
{
//file_attributes=0;
PrintUsage(argv[0]);
return 0;
}
else
{
file_attributes=lpwfd_first->dwFileAttributes ;
}
goto_continue:
hFile=CreateFile(file_path,GENERIC_READ,
0,0,OPEN_EXISTING,
file_attributes,0);
if (hFile==INVALID_HANDLE_VALUE)
{
dwretcode=GetLastError();
if (dwretcode==32)
{
bcp =TRUE;
sprintf(lpTmp,argv[0]);
lpTmp[(strrchr(argv[0],92) - argv[0])+1]=NULL;
sprintf(lpTmp+strlen(lpTmp),lpwfd_first->cFileName) ;
CopyFile(argv[1],lpTmp,TRUE);
sprintf(file_path,lpTmp);
delete lpTmp;
goto goto_continue;
}
else return 0;
}
delete lpwfd_first;
hFileMap=CreateFileMapping(hFile,0,PAGE_READONLY,0,0,0);
if (hFileMap==NULL)
{
printf("Create File Map Error!/n");
CloseHandle(hFile);
return 0;
}
mod_base =MapViewOfFile(hFileMap,FILE_MAP_READ,0,0,0);
if (mod_base==NULL)
{
printf("Create MapView of file error!/n");
CloseHandle(hFileMap);
CloseHandle(hFile);
return 0;
}
nt_headers =ImageNtHeader (mod_base);
image_base=(PVOID)nt_headers->OptionalHeader .ImageBase ;
export_data =(PIMAGE_EXPORT_DIRECTORY )ImageDirectoryEntryToData (mod_base,
FALSE,IMAGE_DIRECTORY_ENTRY_EXPORT,&export_data_size);
if (export_data==NULL)
{
DWORD dwError = GetLastError();
printf("ImageDirectoryEntryToData Error!(Errorcode:%d)/n",dwError);
return 0;
}
FunctionsNames =(PDWORD)ImageRvaToVa (nt_headers,mod_base,
(DWORD)export_data->AddressOfNames ,0);
FunctionsPtrs = (PDWORD)ImageRvaToVa(nt_headers,mod_base,
(DWORD)export_data->AddressOfFunctions ,0);
NameOrdinals =(PWORD)ImageRvaToVa(nt_headers,mod_base,
(DWORD)export_data->AddressOfNameOrdinals ,0);
printf("Order FunctionName FunctionAddress/n");
for (i=0;i<export_data->NumberOfFunctions ;i++)
{
func_name = (PCHAR)ImageRvaToVa(nt_headers,mod_base,(DWORD)FunctionsNames[i],0);
if (IsBadReadPtr (func_name,1)) continue;
if ((!IsCharAlpha (func_name[0]))&&(!IsCharAlphaNumeric (func_name[0]))) continue;
if (IsBadCodePtr ((FARPROC)func_name)) continue;
if (!CheckFunction (func_name)) continue;
if (strlen(func_name)>32) continue;
// func_ptr=NULL;
// if (IsBadReadPtr(&FunctionsPtrs[NameOrdinals[i]],1)) continue;
// if (NameOrdinals[i]>10000) continue;
func_ptr = (PVOID) FunctionsPtrs [NameOrdinals [i]];
printf("%d",i);
char * temp=new char[10];
sprintf(temp,"%d",i);
for(int w=0;w<(18 - (int)strlen(temp));w++)
printf(" ");
printf("%s",func_name);
for (int j=0;j<(50 - (int)strlen(func_name));j++)
printf(" ");
printf("%d/n",func_ptr);
}
UnmapViewOfFile (mod_base);
CloseHandle(hFileMap);
CloseHandle(hFile);
if (bcp )
DeleteFile(file_path);
return 0;
}
例如运行：
GetFunction.exe c:/windows/system32/ntdll.dll
则输出如下结果：
Order FunctionName FunctionAddress
0 CsrAllocateCaptureBuffer 125863
1 CsrAllocateMessagePointer 125960
2 CsrCaptureMessageBuffer 160625
4 CsrCaptureMessageString 132870
5 CsrCaptureTimeout 329170
6 CsrClientCallServer 78497
7 CsrClientConnectToServer 137105
8 CsrFreeCaptureBuffer 125775
9 CsrGetProcessId 329159
10 CsrIdentifyAlertableThread 329026
11 CsrNewThread 102010
12 CsrProbeForRead 329299
13 CsrProbeForWrite 329221
14 CsrSetPriorityClass 329086
15 DbgBreakPoint 4656
16 DbgPrint 197616
17 DbgPrintEx 125733
18 DbgPrintReturnControlC 362522
19 DbgPrompt 362761
20 DbgQueryDebugFilterState 362831
21 DbgSetDebugFilterState 362847
22 DbgUiConnectToDbg 329353
23 DbgUiContinue 329524
24 DbgUiConvertStateChangeStructure 329820
25 DbgUiDebugActiveProcess 329754
26 DbgUiGetThreadDebugObject 329438
27 DbgUiIssueRemoteBreakin 329689
28 DbgUiRemoteBreakin 329595
29 DbgUiSetThreadDebugObject 329456
30 DbgUiStopDebugging 329561
31 DbgUiWaitStateChange 329485
32 DbgUserBreakPoint 4665
33 KiFastSystemCall 60299
34 KiFastSystemCallRet 60308
35 KiIntSystemCall 60325
36 KiRaiseUserExceptionDispatcher 60221
37 KiUserApcDispatcher 60096
38 KiUserCallbackDispatcher 60112
39 KiUserExceptionDispatcher 60140
40 LdrAccessOutOfProcessResource 133777
41 LdrAccessResource 76962
42 LdrAddRefDll 226841
43 LdrAlternateResourcesEnabled 77141
44 LdrCreateOutOfProcessImage 131419
45 LdrDestroyOutOfProcessImage 131701
46 LdrDisableThreadCalloutsForDll 122283
47 LdrEnumResources 363012
48 LdrEnumerateLoadedModules 137615
49 LdrFindCreateProcessManifest 130645
50 LdrFindEntryForAddress 362863
51 LdrFindResourceDirectory_U 117045
52 LdrFindResourceEx_U 366390
53 LdrFindResource_U 76929
54 LdrFlushAlternateResourceModules 193997
55 LdrGetDllHandle 91526
56 LdrGetDllHandleEx 91559
57 LdrGetProcedureAddress 105352
58 LdrHotPatchRoutine 330566
59 LdrInitShimEngineDynamic 333354
60 LdrInitializeThunk 4478
61 LdrLoadAlternateResourceModule 77013
62 LdrLoadDll 90570
63 LdrLockLoaderLock 78193
64 LdrProcessRelocationBlock 368195
66 LdrQueryProcessModuleInformation 332697
68 LdrSetDllManifestProber 141131
69 LdrShutdownProcess 146927
70 LdrShutdownThread 102694
71 LdrUnloadAlternateResourceModule 106537
72 LdrUnloadDll 94603
73 LdrUnlockLoaderLock 78377
74 LdrVerifyImageMatchesChecksum 202534
75 NlsAnsiCodePage 507912
76 NlsMbCodePageTag 507920
77 NlsMbOemCodePageTag 507928
78 NtAcceptConnectPort 54137
79 NtAccessCheck 54158
80 NtAccessCheckAndAuditAlarm 54179
81 NtAccessCheckByType 54200
82 NtAccessCheckByTypeAndAuditAlarm 54221
83 NtAccessCheckByTypeResultList 54242
86 NtAddAtom 54305
87 NtAddBootEntry 54326
88 NtAdjustGroupsToken 54347
89 NtAdjustPrivilegesToken 54368
90 NtAlertResumeThread 54389
91 NtAlertThread 54410
92 NtAllocateLocallyUniqueId 54431
93 NtAllocateUserPhysicalPages 54452
94 NtAllocateUuids 54473
95 NtAllocateVirtualMemory 54494
96 NtAreMappedFilesTheSame 54515
97 NtAssignProcessToJobObject 54536
98 NtCallbackReturn 54557
99 NtCancelDeviceWakeupRequest 54578
100 NtCancelIoFile 54599
101 NtCancelTimer 54620
102 NtClearEvent 54641
103 NtClose 54662
104 NtCloseObjectAuditAlarm 54683
105 NtCompactKeys 54704
106 NtCompareTokens 54725
107 NtCompleteConnectPort 54746
108 NtCompressKey 54767
109 NtConnectPort 54788
110 NtContinue 54809
111 NtCreateDebugObject 54830
112 NtCreateDirectoryObject 54851
113 NtCreateEvent 54872
114 NtCreateEventPair 54893
115 NtCreateFile 54914
116 NtCreateIoCompletion 54935
117 NtCreateJobObject 54956
118 NtCreateJobSet 54977
119 NtCreateKey 54998
120 NtCreateKeyedEvent 59996
121 NtCreateMailslotFile 55019
122 NtCreateMutant 55040
123 NtCreateNamedPipeFile 55061
124 NtCreatePagingFile 55082
125 NtCreatePort 55103
126 NtCreateProcess 55124
127 NtCreateProcessEx 55145
128 NtCreateProfile 55166
129 NtCreateSection 55187
130 NtCreateSemaphore 55208
131 NtCreateSymbolicLinkObject 55229
132 NtCreateThread 55250
133 NtCreateTimer 55271
134 NtCreateToken 55292
135 NtCreateWaitablePort 55313
136 NtCurrentTeb 4688
137 NtDebugActiveProcess 55334
138 NtDebugContinue 55355
139 NtDelayExecution 55376
140 NtDeleteAtom 55397
141 NtDeleteBootEntry 55418
142 NtDeleteFile 55439
143 NtDeleteKey 55460
144 NtDeleteObjectAuditAlarm 55481
145 NtDeleteValueKey 55502
146 NtDeviceIoControlFile 55523
147 NtDisplayString 55544
148 NtDuplicateObject 55565
149 NtDuplicateToken 55586
150 NtEnumerateBootEntries 55607
151 NtEnumerateKey 55628
153 NtEnumerateValueKey 55670
154 NtExtendSection 55691
155 NtFilterToken 55712
156 NtFindAtom 55733
157 NtFlushBuffersFile 55754
158 NtFlushInstructionCache 55775
159 NtFlushKey 55796
160 NtFlushVirtualMemory 55817
161 NtFlushWriteBuffer 55838
162 NtFreeUserPhysicalPages 55859
163 NtFreeVirtualMemory 55880
164 NtFsControlFile 55901
165 NtGetContextThread 55922
166 NtGetDevicePowerState 55943
167 NtGetPlugPlayEvent 55964
168 NtGetWriteWatch 55985
169 NtImpersonateAnonymousToken 56006
170 NtImpersonateClientOfPort 56027
171 NtImpersonateThread 56048
172 NtInitializeRegistry 56069
173 NtInitiatePowerAction 56090
174 NtIsProcessInJob 56111
175 NtIsSystemResumeAutomatic 56132
176 NtListenPort 56153
177 NtLoadDriver 56174
178 NtLoadKey 56195
179 NtLoadKey2 56216
180 NtLockFile 56237
181 NtLockProductActivationKeys 56258
182 NtLockRegistryKey 56279
183 NtLockVirtualMemory 56300
184 NtMakePermanentObject 56321
185 NtMakeTemporaryObject 56342
186 NtMapUserPhysicalPages 56363
187 NtMapUserPhysicalPagesScatter 56384
188 NtMapViewOfSection 56405
189 NtModifyBootEntry 56426
190 NtNotifyChangeDirectoryFile 56447
191 NtNotifyChangeKey 56468
192 NtNotifyChangeMultipleKeys 56489
193 NtOpenDirectoryObject 56510
194 NtOpenEvent 56531
195 NtOpenEventPair 56552
196 NtOpenFile 56573
197 NtOpenIoCompletion 56594
198 NtOpenJobObject 56615
199 NtOpenKey 56636
200 NtOpenKeyedEvent 60017
201 NtOpenMutant 56657
202 NtOpenObjectAuditAlarm 56678
203 NtOpenProcess 56699
204 NtOpenProcessToken 56720
205 NtOpenProcessTokenEx 56741
206 NtOpenSection 56762
207 NtOpenSemaphore 56783
208 NtOpenSymbolicLinkObject 56804
209 NtOpenThread 56825
210 NtOpenThreadToken 56846
211 NtOpenThreadTokenEx 56867
212 NtOpenTimer 56888
213 NtPlugPlayControl 56909
214 NtPowerInformation 56930
215 NtPrivilegeCheck 56951
216 NtPrivilegeObjectAuditAlarm 56972
217 NtPrivilegedServiceAuditAlarm 56993
218 NtProtectVirtualMemory 57014
219 NtPulseEvent 57035
220 NtQueryAttributesFile 57056
221 NtQueryBootEntryOrder 57077
222 NtQueryBootOptions 57098
223 NtQueryDebugFilterState 57119
224 NtQueryDefaultLocale 57140
225 NtQueryDefaultUILanguage 57161
226 NtQueryDirectoryFile 57182
227 NtQueryDirectoryObject 57203
228 NtQueryEaFile 57224
229 NtQueryEvent 57245
230 NtQueryFullAttributesFile 57266
231 NtQueryInformationAtom 57287
232 NtQueryInformationFile 57308
233 NtQueryInformationJobObject 57329
234 NtQueryInformationPort 57350
235 NtQueryInformationProcess 57371
236 NtQueryInformationThread 57392
237 NtQueryInformationToken 57413
238 NtQueryInstallUILanguage 57434
239 NtQueryIntervalProfile 57455
240 NtQueryIoCompletion 57476
241 NtQueryKey 57497
242 NtQueryMultipleValueKey 57518
243 NtQueryMutant 57539
244 NtQueryObject 57560
245 NtQueryOpenSubKeys 57581
246 NtQueryPerformanceCounter 57602
247 NtQueryPortInformationProcess 60080
248 NtQueryQuotaInformationFile 57623
249 NtQuerySection 57644
250 NtQuerySecurityObject 57665
251 NtQuerySemaphore 57686
252 NtQuerySymbolicLinkObject 57707
253 NtQuerySystemEnvironmentValue 57728
254 NtQuerySystemEnvironmentValueEx 57749
255 NtQuerySystemInformation 57770
256 NtQuerySystemTime 57791
257 NtQueryTimer 57812
258 NtQueryTimerResolution 57833
259 NtQueryValueKey 57854
260 NtQueryVirtualMemory 57875
261 NtQueryVolumeInformationFile 57896
262 NtQueueApcThread 57917
263 NtRaiseException 57938
264 NtRaiseHardError 57959
265 NtReadFile 57980
266 NtReadFileScatter 58001
267 NtReadRequestData 58022
268 NtReadVirtualMemory 58043
269 NtRegisterThreadTerminatePort 58064
270 NtReleaseKeyedEvent 60038
271 NtReleaseMutant 58085
272 NtReleaseSemaphore 58106
273 NtRemoveIoCompletion 58127
274 NtRemoveProcessDebug 58148
275 NtRenameKey 58169
276 NtReplaceKey 58190
277 NtReplyPort 58211
278 NtReplyWaitReceivePort 58232
279 NtReplyWaitReceivePortEx 58253
280 NtReplyWaitReplyPort 58274
281 NtRequestDeviceWakeup 58295
282 NtRequestPort 58316
283 NtRequestWaitReplyPort 58337
284 NtRequestWakeupLatency 58358
285 NtResetEvent 58379
286 NtResetWriteWatch 58400
287 NtRestoreKey 58421
288 NtResumeProcess 58442
289 NtResumeThread 58463
290 NtSaveKey 58484
291 NtSaveKeyEx 58505
292 NtSaveMergedKeys 58526
293 NtSecureConnectPort 58547
294 NtSetBootEntryOrder 58568
295 NtSetBootOptions 58589
296 NtSetContextThread 58610
297 NtSetDebugFilterState 58631
298 NtSetDefaultHardErrorPort 58652
299 NtSetDefaultLocale 58673
300 NtSetDefaultUILanguage 58694
301 NtSetEaFile 58715
302 NtSetEvent 58736
303 NtSetEventBoostPriority 58757
304 NtSetHighEventPair 58778
305 NtSetHighWaitLowEventPair 58799
306 NtSetInformationDebugObject 58820
307 NtSetInformationFile 58841
308 NtSetInformationJobObject 58862
309 NtSetInformationKey 58883
310 NtSetInformationObject 58904
311 NtSetInformationProcess 58925
312 NtSetInformationThread 58946
313 NtSetInformationToken 58967
314 NtSetIntervalProfile 58988
315 NtSetIoCompletion 59009
316 NtSetLdtEntries 59030
317 NtSetLowEventPair 59051
318 NtSetLowWaitHighEventPair 59072
319 NtSetQuotaInformationFile 59093
320 NtSetSecurityObject 59114
321 NtSetSystemEnvironmentValue 59135
322 NtSetSystemEnvironmentValueEx 59156
323 NtSetSystemInformation 59177
324 NtSetSystemPowerState 59198
325 NtSetSystemTime 59219
326 NtSetThreadExecutionState 59240
327 NtSetTimer 59261
328 NtSetTimerResolution 59282
329 NtSetUuidSeed 59303
330 NtSetValueKey 59324
331 NtSetVolumeInformationFile 59345
332 NtShutdownSystem 59366
333 NtSignalAndWaitForSingleObject 59387
334 NtStartProfile 59408
335 NtStopProfile 59429
336 NtSuspendProcess 59450
337 NtSuspendThread 59471
338 NtSystemDebugControl 59492
339 NtTerminateJobObject 59513
340 NtTerminateProcess 59534
341 NtTerminateThread 59555
342 NtTestAlert 59576
343 NtTraceEvent 59597
344 NtTranslateFilePath 59618
345 NtUnloadDriver 59639
346 NtUnloadKey 59660
347 NtUnloadKeyEx 59681
348 NtUnlockFile 59702
349 NtUnlockVirtualMemory 59723
350 NtUnmapViewOfSection 59744
351 NtVdmControl 59765
352 NtWaitForDebugEvent 59786
353 NtWaitForKeyedEvent 60059
354 NtWaitForMultipleObjects 59807
355 NtWaitForSingleObject 59828
356 NtWaitHighEventPair 59849
357 NtWaitLowEventPair 59870
358 NtWriteFile 59891
359 NtWriteFileGather 59912
360 NtWriteRequestData 59933
361 NtWriteVirtualMemory 59954
362 NtYieldExecution 59975
363 PfxFindPrefix 372145
364 PfxInitialize 371305
365 PfxInsertPrefix 371918
366 PfxRemovePrefix 371335
367 PropertyLengthAsVariant 362131
368 RtlAbortRXact 226777
369 RtlAbsoluteToSelfRelativeSD 171576
370 RtlAcquirePebLock 67869
371 RtlAcquireResourceExclusive 103164
372 RtlAcquireResourceShared 103102
373 RtlActivateActivationContext 95757
374 RtlActivateActivationContextEx 95367
376 RtlAddAccessAllowedAce 109155
377 RtlAddAccessAllowedAceEx 171624
378 RtlAddAccessAllowedObjectAce 373179
379 RtlAddAccessDeniedAce 191712
380 RtlAddAccessDeniedAceEx 373087
381 RtlAddAccessDeniedObjectAce 373256
382 RtlAddAce 229413
383 RtlAddActionToRXact 209035
384 RtlAddAtomToAtomTable 179714
385 RtlAddAttributeActionToRXact 208428
386 RtlAddAuditAccessAce 199945
387 RtlAddAuditAccessAceEx 373123
388 RtlAddAuditAccessObjectAce 373334
389 RtlAddCompoundAce 372507
390 RtlAddRange 377262
391 RtlAddRefActivationContext 65762
392 RtlAddRefMemoryStream 132505
393 RtlAddVectoredExceptionHandler 209387
394 RtlAddressInSectionTable 77234
395 RtlAdjustPrivilege 171660
396 RtlAllocateAndInitializeSid 109235
397 RtlAllocateHandle 112396
398 RtlAllocateHeap 67028
399 RtlAnsiCharToUnicodeChar 107457
400 RtlAnsiStringToUnicodeSize 384216
401 RtlAnsiStringToUnicodeString 61516
402 RtlAppendAsciizToString 385090
403 RtlAppendPathElement 121741
404 RtlAppendStringToString 385181
405 RtlAppendUnicodeStringToString 85431
406 RtlAppendUnicodeToString 85314
407 RtlApplicationVerifierStop 348237
408 RtlApplyRXact 208903
409 RtlApplyRXactNoFlush 194159
410 RtlAreAllAccessesGranted 164420
411 RtlAreAnyAccessesGranted 224557
412 RtlAreBitsClear 386759
413 RtlAreBitsSet 155567
414 RtlAssert 388265
415 RtlAssert2 387739
416 RtlCancelTimer 388849
417 RtlCaptureContext 14405
418 RtlCaptureStackBackTrace 389553
419 RtlCaptureStackContext 389297
420 RtlCharToInteger 177793
422 RtlCheckProcessParameters 200355
423 RtlCheckRegistryKey 197428
424 RtlClearAllBits 183995
425 RtlClearBits 155497
426 RtlCloneMemoryStream 335974
427 RtlCommitMemoryStream 335974
428 RtlCompactHeap 181409
429 RtlCompareMemory 12278
430 RtlCompareMemoryUlong 12363
431 RtlCompareString 384870
432 RtlCompareUnicodeString 96178
433 RtlCompressBuffer 397997
434 RtlComputeCrc32 398577
435 RtlComputeImportTableHash 360503
436 RtlComputePrivatizedDllName_U 334947
437 RtlConsoleMultiByteToUnicodeN 152097
438 RtlConvertExclusiveToShared 226599
439 RtlConvertLongToLargeInteger 14136
440 RtlConvertPropertyToVariant 361979
441 RtlConvertSharedToExclusive 226533
442 RtlConvertSidToUnicodeString 84573
444 RtlConvertUiListToApiList 338231
445 RtlConvertUlongToLargeInteger 14149
446 RtlConvertVariantToProperty 361821
447 RtlCopyLuid 79460
448 RtlCopyLuidAndAttributesArray 378327
449 RtlCopyMemoryStreamTo 335858
451 RtlCopyRangeList 375237
452 RtlCopySecurityDescriptor 184532
453 RtlCopySid 79490
454 RtlCopySidAndAttributesArray 378138
455 RtlCopyString 190087
456 RtlCopyUnicodeString 85217
457 RtlCreateAcl 109073
458 RtlCreateActivationContext 133835
459 RtlCreateAndSetSD 194408
460 RtlCreateAtomTable 180210
461 RtlCreateBootStatusDataFile 399661
462 RtlCreateEnvironment 226428
463 RtlCreateHeap 152874
464 RtlCreateProcessParameters 144321
465 RtlCreateQueryDebugBuffer 339671
466 RtlCreateRegistryKey 390912
467 RtlCreateSecurityDescriptor 108665
469 RtlCreateTagHeap 141184
470 RtlCreateTimer 188332
471 RtlCreateTimerQueue 191480
472 RtlCreateUnicodeString 80202
473 RtlCreateUnicodeStringFromAsciiz 79249
474 RtlCreateUserProcess 201349
475 RtlCreateUserSecurityObject 194288
476 RtlCreateUserThread 212802
477 RtlCustomCPToUnicodeN 368229
478 RtlCutoverTimeToSystemTime 222504
479 RtlDeNormalizeProcessParams 144147
480 RtlDeactivateActivationContext 95977
482 RtlDebugPrintTimes 388364
483 RtlDecodePointer 80189
484 RtlDecodeSystemPointer 110536
485 RtlDecompressBuffer 398121
486 RtlDecompressFragment 398229
487 RtlDefaultNpAcl 337461
488 RtlDelete 151648
489 RtlDeleteAce 209808
490 RtlDeleteAtomFromAtomTable 177373
491 RtlDeleteCriticalSection 71818
492 RtlDeleteElementGenericTable 151551
493 RtlDeleteElementGenericTableAvl 404038
494 RtlDeleteNoSplay 402526
495 RtlDeleteOwnersRanges 377719
496 RtlDeleteRange 377401
497 RtlDeleteRegistryValue 212384
498 RtlDeleteResource 147577
499 RtlDeleteSecurityObject 228632
500 RtlDeleteTimer 186119
501 RtlDeleteTimerQueue 388809
502 RtlDeleteTimerQueueEx 388545
503 RtlDeregisterWait 187555
504 RtlDeregisterWaitEx 186747
505 RtlDestroyAtomTable 373482
506 RtlDestroyEnvironment 136026
507 RtlDestroyHandleTable 147356
508 RtlDestroyHeap 155030
509 RtlDestroyProcessParameters 144108
510 RtlDestroyQueryDebugBuffer 339903
511 RtlDetermineDosPathNameType_U 80287
512 RtlDllShutdownInProgress 163600
513 RtlDnsHostNameToComputerName 212087
514 RtlDoesFileExists_U 106672
516 RtlDosPathNameToNtPathName_U 82173
517 RtlDosSearchPath_U 93689
518 RtlDosSearchPath_Ustr 109583
519 RtlDowncaseUnicodeChar 384086
520 RtlDowncaseUnicodeString 171833
521 RtlDumpResource 336010
522 RtlDuplicateUnicodeString 136389
523 RtlEmptyAtomTable 373697
525 RtlEncodePointer 80151
526 RtlEncodeSystemPointer 110536
527 RtlEnlargedIntegerMultiply 13534
528 RtlEnlargedUnsignedDivide 13568
529 RtlEnlargedUnsignedMultiply 13551
530 RtlEnterCriticalSection 4101
531 RtlEnumProcessHeaps 393369
532 RtlEnumerateGenericTable 402791
533 RtlEnumerateGenericTableAvl 200000
537 RtlEqualComputerName 384854
538 RtlEqualDomainName 229131
539 RtlEqualLuid 378286
540 RtlEqualPrefixSid 218505
541 RtlEqualSid 107636
542 RtlEqualString 163999
543 RtlEqualUnicodeString 78798
544 RtlEraseUnicodeString 194221
545 RtlExitUserThread 400355
546 RtlExpandEnvironmentStrings_U 83154
547 RtlExtendHeap 392665
548 RtlExtendedIntegerMultiply 13853
549 RtlExtendedLargeIntegerDivide 13605
550 RtlExtendedMagicDivide 13703
551 RtlFillMemory 12416
552 RtlFillMemoryUlong 12533
556 RtlFindCharInUnicodeString 88937
557 RtlFindClearBits 154629
558 RtlFindClearBitsAndSet 154829
559 RtlFindClearRuns 385954
560 RtlFindLastBackwardRunClear 387140
561 RtlFindLeastSignificantBit 387519
562 RtlFindLongestRunClear 386537
563 RtlFindMessage 224085
564 RtlFindMostSignificantBit 387348
565 RtlFindNextForwardRunClear 386890
566 RtlFindRange 375576
567 RtlFindSetBits 385265
568 RtlFindSetBitsAndClear 387688
569 RtlFirstEntrySList 12162
570 RtlFirstFreeAce 108802
571 RtlFlushSecureMemoryCache 404476
572 RtlFormatCurrentUserKeyPath 85537
573 RtlFormatMessage 169984
574 RtlFreeAnsiString 67958
575 RtlFreeHandle 79959
576 RtlFreeHeap 66621
577 RtlFreeOemString 229224
578 RtlFreeRangeList 374620
579 RtlFreeSid 109190
581 RtlFreeUnicodeString 67958
582 RtlFreeUserThreadStack 400397
583 RtlGUIDFromString 158471
584 RtlGenerate8dot3Name 405610
585 RtlGetAce 232809
586 RtlGetActiveActivationContext 117884
587 RtlGetCallersAddress 389738
588 RtlGetCompressionWorkSpaceSize 397889
589 RtlGetControlSecurityDescriptor 228586
590 RtlGetCurrentDirectory_U 82703
591 RtlGetCurrentPeb 390897
592 RtlGetDaclSecurityDescriptor 164153
593 RtlGetElementGenericTable 402654
594 RtlGetElementGenericTableAvl 403665
595 RtlGetFirstRange 374689
596 RtlGetFrame 132274
597 RtlGetFullPathName_U 82353
598 RtlGetGroupSecurityDescriptor 228836
599 RtlGetLastNtStatus 406615
600 RtlGetLastWin32Error 66353
603 RtlGetLongestNtPathLength 83935
604 RtlGetNativeSystemInformation 57770
605 RtlGetNextRange 374873
606 RtlGetNtGlobalFlags 66603
607 RtlGetNtProductType 106022
608 RtlGetNtVersionNumbers 137401
609 RtlGetOwnerSecurityDescriptor 228770
610 RtlGetProcessHeaps 393185
611 RtlGetSaclSecurityDescriptor 378374
613 RtlGetSetBootStatusData 200987
614 RtlGetUnloadEventTrace 331315
615 RtlGetUserInfoHeap 103608
616 RtlGetVersion 105785
617 RtlHashUnicodeString 87141
618 RtlIdentifierAuthoritySid 174564
619 RtlImageDirectoryEntryToData 67670
620 RtlImageNtHeader 67657
621 RtlImageRvaToSection 77284
622 RtlImageRvaToVa 202842
623 RtlImpersonateSelf 174717
624 RtlInitAnsiString 4761
625 RtlInitCodePageTable 142238
626 RtlInitMemoryStream 131913
627 RtlInitNlsTables 142189
628 RtlInitOutOfProcessMemoryStream 131815
629 RtlInitString 4700
630 RtlInitUnicodeString 4822
631 RtlInitUnicodeStringEx 66469
632 RtlInitializeAtomPackage 141160
633 RtlInitializeBitMap 110508
634 RtlInitializeContext 213121
635 RtlInitializeCriticalSection 72493
637 RtlInitializeGenericTable 137785
638 RtlInitializeGenericTableAvl 200301
639 RtlInitializeHandleTable 160131
640 RtlInitializeRXact 199462
641 RtlInitializeRangeList 374081
642 RtlInitializeResource 135579
643 RtlInitializeSListHead 233488
644 RtlInitializeSid 107709
645 RtlInitializeStackTraceDataBase 407257
646 RtlInsertElementGenericTable 150974
647 RtlInsertElementGenericTableAvl 403987
648 RtlInt64ToUnicodeString 390785
649 RtlIntegerToChar 101080
650 RtlIntegerToUnicodeString 101374
651 RtlInterlockedFlushSList 407031
652 RtlInterlockedPopEntrySList 231140
653 RtlInterlockedPushEntrySList 231074
654 RtlInterlockedPushListSList 12117
655 RtlInvertRangeList 377896
656 RtlIpv4AddressToStringA 408509
657 RtlIpv4AddressToStringExA 408587
658 RtlIpv4AddressToStringExW 192808
659 RtlIpv4AddressToStringW 192928
660 RtlIpv4StringToAddressA 226148
661 RtlIpv4StringToAddressExA 410986
662 RtlIpv4StringToAddressExW 209323
663 RtlIpv4StringToAddressW 232143
664 RtlIpv6AddressToStringA 407723
665 RtlIpv6AddressToStringExA 408279
666 RtlIpv6AddressToStringExW 409369
667 RtlIpv6AddressToStringW 408753
668 RtlIpv6StringToAddressA 409613
669 RtlIpv6StringToAddressExA 410413
670 RtlIpv6StringToAddressExW 412161
671 RtlIpv6StringToAddressW 411395
672 RtlIsActivationContextActive 354910
673 RtlIsDosDeviceName_U 79296
674 RtlIsGenericTableEmpty 160089
675 RtlIsGenericTableEmptyAvl 403640
676 RtlIsNameLegalDOS8Dot3 405225
677 RtlIsRangeAvailable 376475
678 RtlIsTextUnicode 169060
679 RtlIsThreadWithinLoaderCallout 332841
680 RtlIsValidHandle 79861
681 RtlIsValidIndexHandle 80102
682 RtlLargeIntegerAdd 13509
683 RtlLargeIntegerArithmeticShift 14037
684 RtlLargeIntegerDivide 412772
685 RtlLargeIntegerNegate 14086
686 RtlLargeIntegerShiftLeft 13947
687 RtlLargeIntegerShiftRight 13992
688 RtlLargeIntegerSubtract 14111
689 RtlLargeIntegerToChar 389812
690 RtlLeaveCriticalSection 4333
691 RtlLengthRequiredSid 174540
692 RtlLengthSecurityDescriptor 228392
693 RtlLengthSid 79542
694 RtlLocalTimeToSystemTime 402370
695 RtlLockBootStatusData 200637
696 RtlLockHeap 79651
697 RtlLockMemoryStreamRegion 335845
698 RtlLogStackBackTrace 72420
699 RtlLookupAtomInAtomTable 164918
700 RtlLookupElementGenericTable 136633
701 RtlLookupElementGenericTableAvl 404383
702 RtlMakeSelfRelativeSD 171374
703 RtlMapGenericMask 164342
704 RtlMapSecurityErrorToNtStatus 379118
705 RtlMergeRangeLists 377038
706 RtlMoveMemory 12625
708 RtlMultiByteToUnicodeN 61899
709 RtlMultiByteToUnicodeSize 169876
710 RtlNewInstanceSecurityObject 336978
711 RtlNewSecurityGrantedAccess 337096
712 RtlNewSecurityObject 193021
713 RtlNewSecurityObjectEx 216341
715 RtlNormalizeProcessParams 141406
716 RtlNtPathNameToDosPathName 149402
717 RtlNtStatusToDosError 64317
718 RtlNtStatusToDosErrorNoTeb 64393
719 RtlNumberGenericTableElements 147408
720 RtlNumberGenericTableElementsAvl 403878
721 RtlNumberOfClearBits 386592
722 RtlNumberOfSetBits 386672
723 RtlOemStringToUnicodeSize 384216
724 RtlOemStringToUnicodeString 156761
725 RtlOemToUnicodeN 156464
726 RtlOpenCurrentUser 110601
727 RtlPcToFileHeader 230732
728 RtlPinAtomInAtomTable 373897
729 RtlPopFrame 106944
730 RtlPrefixString 191817
731 RtlPrefixUnicodeString 82448
732 RtlProtectHeap 391618
733 RtlPushFrame 106976
734 RtlQueryAtomInAtomTable 180373
735 RtlQueryDepthSList 231248
736 RtlQueryEnvironmentVariable_U 82849
737 RtlQueryHeapInformation 395691
738 RtlQueryInformationAcl 188705
741 RtlQueryInterfaceMemoryStream 132533
743 RtlQueryProcessDebugInformation 342251
744 RtlQueryProcessHeapInformation 340553
745 RtlQueryProcessLockInformation 341877
746 RtlQueryRegistryValues 195713
747 RtlQuerySecurityObject 336464
748 RtlQueryTagHeap 392309
749 RtlQueryTimeZoneInformation 391041
750 RtlQueueApcWow64Thread 354813
751 RtlQueueWorkItem 161496
752 RtlRaiseException 60332
753 RtlRaiseStatus 413355
754 RtlRandom 413402
755 RtlRandomEx 207367
756 RtlReAllocateHeap 96765
757 RtlReadMemoryStream 137847
758 RtlReadOutOfProcessMemoryStream 133471
759 RtlRealPredecessor 402465
760 RtlRealSuccessor 160035
762 RtlRegisterWait 219635
763 RtlReleaseActivationContext 68183
764 RtlReleaseMemoryStream 132005
765 RtlReleasePebLock 67937
766 RtlReleaseResource 103043
767 RtlRemoteCall 406666
769 RtlResetRtlTranslations 141859
770 RtlRestoreLastWin32Error 66368
771 RtlRevertMemoryStream 335987
772 RtlRunDecodeUnicodeString 192395
773 RtlRunEncodeUnicodeString 192317
774 RtlSecondsSince1970ToTime 402315
775 RtlSecondsSince1980ToTime 402260
776 RtlSeekMemoryStream 335734
777 RtlSelfRelativeToAbsoluteSD 188948
778 RtlSelfRelativeToAbsoluteSD2 372304
779 RtlSetAllBits 184044
781 RtlSetBits 154880
782 RtlSetControlSecurityDescriptor 197473
783 RtlSetCriticalSectionSpinCount 164448
784 RtlSetCurrentDirectory_U 134862
785 RtlSetCurrentEnvironment 400133
786 RtlSetDaclSecurityDescriptor 108711
787 RtlSetEnvironmentVariable 159413
788 RtlSetGroupSecurityDescriptor 110434
789 RtlSetHeapInformation 207942
790 RtlSetInformationAcl 372431
791 RtlSetIoCompletionCallback 192141
792 RtlSetLastWin32Error 66368
794 RtlSetMemoryStreamSize 335832
795 RtlSetOwnerSecurityDescriptor 110360
796 RtlSetProcessIsCritical 193602
797 RtlSetSaclSecurityDescriptor 188818
799 RtlSetSecurityObject 184716
800 RtlSetSecurityObjectEx 336423
801 RtlSetThreadIsCritical 193686
802 RtlSetThreadPoolStartFunc 141249
803 RtlSetTimeZoneInformation 391337
804 RtlSetTimer 388833
805 RtlSetUnicodeCallouts 362281
806 RtlSetUserFlagsHeap 391973
807 RtlSetUserValueHeap 112481
808 RtlSizeHeap 68077
809 RtlSplay 136290
810 RtlStartRXact 226694
811 RtlStatMemoryStream 133650
812 RtlStringFromGUID 168852
813 RtlSubAuthorityCountSid 163616
814 RtlSubAuthoritySid 107680
815 RtlSubtreePredecessor 151516
816 RtlSubtreeSuccessor 402430
817 RtlSystemTimeToLocalTime 232083
818 RtlTimeFieldsToTime 100617
819 RtlTimeToElapsedTimeFields 402157
820 RtlTimeToSecondsSince1970 185935
821 RtlTimeToSecondsSince1980 176531
822 RtlTimeToTimeFields 74765
823 RtlTraceDatabaseAdd 415067
824 RtlTraceDatabaseCreate 414093
825 RtlTraceDatabaseDestroy 414335
826 RtlTraceDatabaseEnumerate 413957
827 RtlTraceDatabaseFind 414567
828 RtlTraceDatabaseLock 415035
829 RtlTraceDatabaseUnlock 415051
830 RtlTraceDatabaseValidate 414493
831 RtlTryEnterCriticalSection 4395
832 RtlUlongByteSwap 12233
833 RtlUlonglongByteSwap 12254
834 RtlUnhandledExceptionFilter 418031
835 RtlUnhandledExceptionFilter2 415597
836 RtlUnicodeStringToAnsiSize 384179
837 RtlUnicodeStringToAnsiString 78022
839 RtlUnicodeStringToInteger 101473
840 RtlUnicodeStringToOemSize 384179
841 RtlUnicodeStringToOemString 156126
842 RtlUnicodeToCustomCPN 368713
843 RtlUnicodeToMultiByteN 77723
844 RtlUnicodeToMultiByteSize 79570
845 RtlUnicodeToOemN 155836
846 RtlUniform 224040
847 RtlUnlockBootStatusData 200917
848 RtlUnlockHeap 79755
849 RtlUnlockMemoryStreamRegion 335845
850 RtlUnwind 227904
851 RtlUpcaseUnicodeChar 67824
852 RtlUpcaseUnicodeString 160748
856 RtlUpcaseUnicodeToCustomCPN 369145
857 RtlUpcaseUnicodeToMultiByteN 148827
858 RtlUpcaseUnicodeToOemN 182933
859 RtlUpdateTimer 230349
860 RtlUpperChar 169916
861 RtlUpperString 385017
862 RtlUsageHeap 396520
863 RtlUshortByteSwap 12212
864 RtlValidAcl 108533
866 RtlValidSecurityDescriptor 232597
867 RtlValidSid 78999
868 RtlValidateHeap 395800
869 RtlValidateProcessHeaps 396347
870 RtlValidateUnicodeString 89202
871 RtlVerifyVersionInfo 176861
872 RtlWalkFrameChain 388922
873 RtlWalkHeap 393505
874 RtlWriteMemoryStream 335721
875 RtlWriteRegistryValue 212292
876 RtlZeroHeap 383399
877 RtlZeroMemory 12571
878 RtlZombifyActivationContext 354829
879 RtlpApplyLengthFunction 132400
880 RtlpEnsureBufferSize 125239
881 RtlpNotOwnerCriticalSection 336214
882 RtlpNtCreateKey 418227
883 RtlpNtEnumerateSubKey 223753
884 RtlpNtMakeTemporaryKey 418316
885 RtlpNtOpenKey 171143
886 RtlpNtQueryValueKey 170950
887 RtlpNtSetValueKey 418272
888 RtlpUnWaitCriticalSection 102487
889 RtlpWaitForCriticalSection 102287
890 RtlxAnsiStringToUnicodeSize 384216
891 RtlxOemStringToUnicodeSize 384216
892 RtlxUnicodeStringToAnsiSize 384179
893 RtlxUnicodeStringToOemSize 384179
894 VerSetConditionMask 176799
895 ZwAcceptConnectPort 54137
896 ZwAccessCheck 54158
897 ZwAccessCheckAndAuditAlarm 54179
898 ZwAccessCheckByType 54200
899 ZwAccessCheckByTypeAndAuditAlarm 54221
900 ZwAccessCheckByTypeResultList 54242
903 ZwAddAtom 54305
904 ZwAddBootEntry 54326
905 ZwAdjustGroupsToken 54347
906 ZwAdjustPrivilegesToken 54368
907 ZwAlertResumeThread 54389
908 ZwAlertThread 54410
909 ZwAllocateLocallyUniqueId 54431
910 ZwAllocateUserPhysicalPages 54452
911 ZwAllocateUuids 54473
912 ZwAllocateVirtualMemory 54494
913 ZwAreMappedFilesTheSame 54515
914 ZwAssignProcessToJobObject 54536
915 ZwCallbackReturn 54557
916 ZwCancelDeviceWakeupRequest 54578
917 ZwCancelIoFile 54599
918 ZwCancelTimer 54620
919 ZwClearEvent 54641
920 ZwClose 54662
921 ZwCloseObjectAuditAlarm 54683
922 ZwCompactKeys 54704
923 ZwCompareTokens 54725
924 ZwCompleteConnectPort 54746
925 ZwCompressKey 54767
926 ZwConnectPort 54788
927 ZwContinue 54809
928 ZwCreateDebugObject 54830
929 ZwCreateDirectoryObject 54851
930 ZwCreateEvent 54872
931 ZwCreateEventPair 54893
932 ZwCreateFile 54914
933 ZwCreateIoCompletion 54935
934 ZwCreateJobObject 54956
935 ZwCreateJobSet 54977
936 ZwCreateKey 54998
937 ZwCreateKeyedEvent 59996
938 ZwCreateMailslotFile 55019
939 ZwCreateMutant 55040
940 ZwCreateNamedPipeFile 55061
941 ZwCreatePagingFile 55082
942 ZwCreatePort 55103
943 ZwCreateProcess 55124
944 ZwCreateProcessEx 55145
945 ZwCreateProfile 55166
946 ZwCreateSection 55187
947 ZwCreateSemaphore 55208
948 ZwCreateSymbolicLinkObject 55229
949 ZwCreateThread 55250
950 ZwCreateTimer 55271
951 ZwCreateToken 55292
952 ZwCreateWaitablePort 55313
953 ZwDebugActiveProcess 55334
954 ZwDebugContinue 55355
955 ZwDelayExecution 55376
956 ZwDeleteAtom 55397
957 ZwDeleteBootEntry 55418
958 ZwDeleteFile 55439
959 ZwDeleteKey 55460
960 ZwDeleteObjectAuditAlarm 55481
961 ZwDeleteValueKey 55502
962 ZwDeviceIoControlFile 55523
963 ZwDisplayString 55544
964 ZwDuplicateObject 55565
965 ZwDuplicateToken 55586
966 ZwEnumerateBootEntries 55607
967 ZwEnumerateKey 55628
969 ZwEnumerateValueKey 55670
970 ZwExtendSection 55691
971 ZwFilterToken 55712
972 ZwFindAtom 55733
973 ZwFlushBuffersFile 55754
974 ZwFlushInstructionCache 55775
975 ZwFlushKey 55796
976 ZwFlushVirtualMemory 55817
977 ZwFlushWriteBuffer 55838
978 ZwFreeUserPhysicalPages 55859
979 ZwFreeVirtualMemory 55880
980 ZwFsControlFile 55901
981 ZwGetContextThread 55922
982 ZwGetDevicePowerState 55943
983 ZwGetPlugPlayEvent 55964
984 ZwGetWriteWatch 55985
985 ZwImpersonateAnonymousToken 56006
986 ZwImpersonateClientOfPort 56027
987 ZwImpersonateThread 56048
988 ZwInitializeRegistry 56069
989 ZwInitiatePowerAction 56090
990 ZwIsProcessInJob 56111
991 ZwIsSystemResumeAutomatic 56132
992 ZwListenPort 56153
993 ZwLoadDriver 56174
994 ZwLoadKey 56195
995 ZwLoadKey2 56216
996 ZwLockFile 56237
997 ZwLockProductActivationKeys 56258
998 ZwLockRegistryKey 56279
999 ZwLockVirtualMemory 56300
1000 ZwMakePermanentObject 56321
1001 ZwMakeTemporaryObject 56342
1002 ZwMapUserPhysicalPages 56363
1003 ZwMapUserPhysicalPagesScatter 56384
1004 ZwMapViewOfSection 56405
1005 ZwModifyBootEntry 56426
1006 ZwNotifyChangeDirectoryFile 56447
1007 ZwNotifyChangeKey 56468
1008 ZwNotifyChangeMultipleKeys 56489
1009 ZwOpenDirectoryObject 56510
1010 ZwOpenEvent 56531
1011 ZwOpenEventPair 56552
1012 ZwOpenFile 56573
1013 ZwOpenIoCompletion 56594
1014 ZwOpenJobObject 56615
1015 ZwOpenKey 56636
1016 ZwOpenKeyedEvent 60017
1017 ZwOpenMutant 56657
1018 ZwOpenObjectAuditAlarm 56678
1019 ZwOpenProcess 56699
1020 ZwOpenProcessToken 56720
1021 ZwOpenProcessTokenEx 56741
1022 ZwOpenSection 56762
1023 ZwOpenSemaphore 56783
1024 ZwOpenSymbolicLinkObject 56804
1025 ZwOpenThread 56825
1026 ZwOpenThreadToken 56846
1027 ZwOpenThreadTokenEx 56867
1028 ZwOpenTimer 56888
1029 ZwPlugPlayControl 56909
1030 ZwPowerInformation 56930
1031 ZwPrivilegeCheck 56951
1032 ZwPrivilegeObjectAuditAlarm 56972
1033 ZwPrivilegedServiceAuditAlarm 56993
1034 ZwProtectVirtualMemory 57014
1035 ZwPulseEvent 57035
1036 ZwQueryAttributesFile 57056
1037 ZwQueryBootEntryOrder 57077
1038 ZwQueryBootOptions 57098
1039 ZwQueryDebugFilterState 57119
1040 ZwQueryDefaultLocale 57140
1041 ZwQueryDefaultUILanguage 57161
1042 ZwQueryDirectoryFile 57182
1043 ZwQueryDirectoryObject 57203
1044 ZwQueryEaFile 57224
1045 ZwQueryEvent 57245
1046 ZwQueryFullAttributesFile 57266
1047 ZwQueryInformationAtom 57287
1048 ZwQueryInformationFile 57308
1049 ZwQueryInformationJobObject 57329
1050 ZwQueryInformationPort 57350
1051 ZwQueryInformationProcess 57371
1052 ZwQueryInformationThread 57392
1053 ZwQueryInformationToken 57413
1054 ZwQueryInstallUILanguage 57434
1055 ZwQueryIntervalProfile 57455
1056 ZwQueryIoCompletion 57476
1057 ZwQueryKey 57497
1058 ZwQueryMultipleValueKey 57518
1059 ZwQueryMutant 57539
1060 ZwQueryObject 57560
1061 ZwQueryOpenSubKeys 57581
1062 ZwQueryPerformanceCounter 57602
1063 ZwQueryPortInformationProcess 60080
1064 ZwQueryQuotaInformationFile 57623
1065 ZwQuerySection 57644
1066 ZwQuerySecurityObject 57665
1067 ZwQuerySemaphore 57686
1068 ZwQuerySymbolicLinkObject 57707
1069 ZwQuerySystemEnvironmentValue 57728
1070 ZwQuerySystemEnvironmentValueEx 57749
1071 ZwQuerySystemInformation 57770
1072 ZwQuerySystemTime 57791
1073 ZwQueryTimer 57812
1074 ZwQueryTimerResolution 57833
1075 ZwQueryValueKey 57854
1076 ZwQueryVirtualMemory 57875
1077 ZwQueryVolumeInformationFile 57896
1078 ZwQueueApcThread 57917
1079 ZwRaiseException 57938
1080 ZwRaiseHardError 57959
1081 ZwReadFile 57980
1082 ZwReadFileScatter 58001
1083 ZwReadRequestData 58022
1084 ZwReadVirtualMemory 58043
1085 ZwRegisterThreadTerminatePort 58064
1086 ZwReleaseKeyedEvent 60038
1087 ZwReleaseMutant 58085
1088 ZwReleaseSemaphore 58106
1089 ZwRemoveIoCompletion 58127
1090 ZwRemoveProcessDebug 58148
1091 ZwRenameKey 58169
1092 ZwReplaceKey 58190
1093 ZwReplyPort 58211
1094 ZwReplyWaitReceivePort 58232
1095 ZwReplyWaitReceivePortEx 58253
1096 ZwReplyWaitReplyPort 58274
1097 ZwRequestDeviceWakeup 58295
1098 ZwRequestPort 58316
1099 ZwRequestWaitReplyPort 58337
1100 ZwRequestWakeupLatency 58358
1101 ZwResetEvent 58379
1102 ZwResetWriteWatch 58400
1103 ZwRestoreKey 58421
1104 ZwResumeProcess 58442
1105 ZwResumeThread 58463
1106 ZwSaveKey 58484
1107 ZwSaveKeyEx 58505
1108 ZwSaveMergedKeys 58526
1109 ZwSecureConnectPort 58547
1110 ZwSetBootEntryOrder 58568
1111 ZwSetBootOptions 58589
1112 ZwSetContextThread 58610
1113 ZwSetDebugFilterState 58631
1114 ZwSetDefaultHardErrorPort 58652
1115 ZwSetDefaultLocale 58673
1116 ZwSetDefaultUILanguage 58694
1117 ZwSetEaFile 58715
1118 ZwSetEvent 58736
1119 ZwSetEventBoostPriority 58757
1120 ZwSetHighEventPair 58778
1121 ZwSetHighWaitLowEventPair 58799
1122 ZwSetInformationDebugObject 58820
1123 ZwSetInformationFile 58841
1124 ZwSetInformationJobObject 58862
1125 ZwSetInformationKey 58883
1126 ZwSetInformationObject 58904
1127 ZwSetInformationProcess 58925
1128 ZwSetInformationThread 58946
1129 ZwSetInformationToken 58967
1130 ZwSetIntervalProfile 58988
1131 ZwSetIoCompletion 59009
1132 ZwSetLdtEntries 59030
1133 ZwSetLowEventPair 59051
1134 ZwSetLowWaitHighEventPair 59072
1135 ZwSetQuotaInformationFile 59093
1136 ZwSetSecurityObject 59114
1137 ZwSetSystemEnvironmentValue 59135
1138 ZwSetSystemEnvironmentValueEx 59156
1139 ZwSetSystemInformation 59177
1140 ZwSetSystemPowerState 59198
1141 ZwSetSystemTime 59219
1142 ZwSetThreadExecutionState 59240
1143 ZwSetTimer 59261
1144 ZwSetTimerResolution 59282
1145 ZwSetUuidSeed 59303
1146 ZwSetValueKey 59324
1147 ZwSetVolumeInformationFile 59345
1148 ZwShutdownSystem 59366
1149 ZwSignalAndWaitForSingleObject 59387
1150 ZwStartProfile 59408
1151 ZwStopProfile 59429
1152 ZwSuspendProcess 59450
1153 ZwSuspendThread 59471
1154 ZwSystemDebugControl 59492
1155 ZwTerminateJobObject 59513
1156 ZwTerminateProcess 59534
1157 ZwTerminateThread 59555
1158 ZwTestAlert 59576
1159 ZwTraceEvent 59597
1160 ZwTranslateFilePath 59618
1161 ZwUnloadDriver 59639
1162 ZwUnloadKey 59660
1163 ZwUnloadKeyEx 59681
1164 ZwUnlockFile 59702
1165 ZwUnlockVirtualMemory 59723
1166 ZwUnmapViewOfSection 59744
1167 ZwVdmControl 59765
1168 ZwWaitForDebugEvent 59786
1169 ZwWaitForKeyedEvent 60059
1170 ZwWaitForMultipleObjects 59807
1171 ZwWaitForSingleObject 59828
1172 ZwWaitHighEventPair 59849
1173 ZwWaitLowEventPair 59870
1174 ZwWriteFile 59891
1175 ZwWriteFileGather 59912
1176 ZwWriteRequestData 59933
1177 ZwWriteVirtualMemory 59954
1178 ZwYieldExecution 59975
1235 abs 460268
1236 atan 7541
1237 atoi 150569
1238 atol 150580
1239 bsearch 86011
1240 ceil 7710
1241 cos 4907
1242 fabs 459982
1243 floor 8029
1244 isalnum 457820
1245 isalpha 457504
1246 iscntrl 457988
1247 isdigit 225932
1248 isgraph 457932
1249 islower 457611
1250 isprint 457876
1251 ispunct 457769
1252 isspace 457718
1253 isupper 457560
1254 iswalpha 460166
1255 iswctype 157409
1256 iswdigit 157573
1257 iswlower 460193
1258 iswspace 460244
1259 iswxdigit 460217
1260 isxdigit 457662
1261 labs 460268
1262 log 5066
1263 mbstowcs 150698
1264 memchr 8357
1265 memcmp 8527
1266 memcpy 8704
1267 memmove 9530
1268 memset 10362
1269 pow 5293
1270 qsort 132073
1271 sin 5855
1272 sprintf 168238
1273 sqrt 6034
1274 sscanf 460289
1275 strcat 10476
1276 strchr 60673
1277 strcmp 10705
1278 strcpy 10455
1279 strcspn 10843
1280 strlen 10909
1281 strncat 11035
1282 strncmp 11331
1283 strncpy 11392
1284 strpbrk 11651
1285 strrchr 11713
1286 strspn 11757
1287 strstr 60527
1288 strtol 460790
1289 strtoul 460821
1290 swprintf 108291
1291 tan 11838
1292 tolower 459560
1293 toupper 147633
1294 towlower 104300
1295 towupper 460852
1296 vDbgPrintEx 131772
1297 vDbgPrintExWithPrefix 125611
1298 vsprintf 460872
1299 wcscat 107353
1300 wcschr 83850
1301 wcscmp 233319
1302 wcscpy 78963
1303 wcscspn 175742
1304 wcslen 66394
1305 wcsncat 110708
1306 wcsncmp 160688
1307 wcsncpy 68239
1308 wcspbrk 460966
1309 wcsrchr 83097
1310 wcsspn 461039
1311 wcsstr 135754
1312 wcstol 233171
1313 wcstombs 461117
1314 wcstoul 219472
内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理 
相关文章推荐
- [收藏]如何构造一个main以外执行的函数
- javascript笔记——点击按钮（或超链接）如何跳转到另外一个页面并执行目标页面的js函数
- . 有一个一维数组，里面存储整形数据，请写一个函数，将他们按从大到小的顺序排列，要求执行效率高，并说明如何改善执行效率（该函数必须自己实现，不能使用php函数）。
- js如何实现一定时间后去执行一个函数
- Cocos2d-x 3.0 JNI BUG 修复。（Android 如何创建一个线程 延迟执行函数 创建一个随机数）
- 点击按钮（或超链接）如何跳转到另外一个页面并执行目标页面的js函数
- vuejs中，如何使一个自定义函数在vue渲染完之后再自动执行
- 如何控制一个函数的执行时间
- 练习1-2 做个实验，当printf函数的参数字符串中包含\c（其中c是上面的转义字符未曾列出的某一个字符）时，观察一下输出
- vuejs -- 如何使一个自定义函数在加载时自动执行
- js如何查看一个函数的执行时间
- javaScript学习笔记——如何在加载完某个标签之后执行一个函数
- 如何用javascript 的eval动态执行一个需要传对象参数的函数
- vuejs中，如何使一个自定义函数在vue渲染完之后再自动执行
- Android如何执行一个不确定当前处于在子线程还是主线程中的UI操作
- qt#2 多个实例信号版定一个槽函数如何识别信号源
- 编写一个函数将数组中的数字前后颠倒，并输出到屏幕上来。
- iOS 如何巧妙解决“一个任务需要等待另外一个任务完成后才可以执行”的问题
- 如何让APP一运行就执行某个函数？
- 如何实现在任意一个目录下都可以执行想要执行的文件