;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;
;             Thanks to Tomasz Nowak tnowak@ntinternals.net and Antek Sawicki tenox@tenox.tc
;                For their great website http://undocumented.ntinternals.net/
;                They gives lot's of function description that M$ doesn't document
;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;


;DbgUserBreakPoint() can't be hooked. It's size is less than 5 bytes
;RtlDebugPrintTimes() can't be hooked. It's size is less than 5 bytes.If you try to hook it, call to function TrlDeleteTimerQueueEx will make your process crash
;DbgBreakPoint() can't be hooked: It's size is less than 5 bytes.If you try to hook it, call to function DbgUserBreakPoint will make your process crash
;RtlImageNtHeader() can't be hooked: It's size is less than 5 bytes.If you try to hook it, call to function RtlFreeHeap will make your process crash
;RtlSetUnicodeCallouts() can't be hooked: It's size is less than 5 bytes.If you try to hook it, call to function DbgPrintReturnControlC will make your process crash
;__eFADDreg() can't be hooked: It's size is less than 5 bytes.If you try to hook it, call to function __eFADDtop will make your process crash
;__eFDIVRreg() can't be hooked: It's size is less than 5 bytes.If you try to hook it, call to function __eFDIVRtop will make your process crash
;__eFDIVreg() can't be hooked: It's size is less than 5 bytes.If you try to hook it, call to function __eFDIVtop will make your process crash
;__eFMULreg() can't be hooked: It's size is less than 5 bytes.If you try to hook it, call to function __eFMULtop will make your process crash
;__eFSUBRreg() can't be hooked: It's size is less than 5 bytes.If you try to hook it, call to function __eFSUBRtop will make your process crash
;__eFSUBreg() can't be hooked: It's size is less than 5 bytes.If you try to hook it, call to function __eFSUBtop will make your process crash

ntdll.dll|CsrAllocateCaptureBuffer(UNKNOWN,UNKNOWN)
ntdll.dll|CsrAllocateMessagePointer(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|CsrCaptureMessageBuffer(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|CsrCaptureMessageMultiUnicodeStringsInPlace(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|CsrCaptureMessageString(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|CsrCaptureTimeout(UNKNOWN,UNKNOWN)
;lots of call
!ntdll.dll|CsrClientCallServer(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|CsrClientConnectToServer(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|CsrFreeCaptureBuffer(UNKNOWN)
ntdll.dll|CsrGetProcessId()
ntdll.dll|CsrIdentifyAlertableThread()
ntdll.dll|CsrNewThread()
ntdll.dll|CsrProbeForRead(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|CsrProbeForWrite(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|CsrSetPriorityClass(UNKNOWN,UNKNOWN)
ntdll.dll|DbgPrint(UNKNOWN,UNKNOWN)
ntdll.dll|DbgPrintEx(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|DbgPrintReturnControlC()
ntdll.dll|DbgPrompt(UNKNOWN,UNKNOWN)
ntdll.dll|DbgQueryDebugFilterState(UNKNOWN,UNKNOWN)
ntdll.dll|DbgSetDebugFilterState(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|DbgUiConnectToDbg()
ntdll.dll|DbgUiContinue(UNKNOWN,UNKNOWN)
ntdll.dll|DbgUiConvertStateChangeStructure(UNKNOWN,UNKNOWN)
ntdll.dll|DbgUiDebugActiveProcess(UNKNOWN)
ntdll.dll|DbgUiGetThreadDebugObject()
ntdll.dll|DbgUiIssueRemoteBreakin(UNKNOWN)
ntdll.dll|DbgUiRemoteBreakin(UNKNOWN)
ntdll.dll|DbgUiSetThreadDebugObject(UNKNOWN)
ntdll.dll|DbgUiStopDebugging(UNKNOWN)
ntdll.dll|DbgUiWaitStateChange(UNKNOWN,UNKNOWN)
ntdll.dll|KiRaiseUserExceptionDispatcher()
; fail
;ntdll.dll|KiUserApcDispatcher(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
;ntdll.dll|KiUserCallbackDispatcher()
; fail
;ntdll.dll|KiUserExceptionDispatcher(UNKNOWN)
ntdll.dll|LdrAccessOutOfProcessResource(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrAccessResource(HMODULE,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrAddRefDll(UNKNOWN,UNKNOWN)
ntdll.dll|LdrAlternateResourcesEnabled()
ntdll.dll|LdrCreateOutOfProcessImage(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrDestroyOutOfProcessImage(UNKNOWN)
ntdll.dll|LdrDisableThreadCalloutsForDll(UNKNOWN)
ntdll.dll|LdrEnumResources(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrFindCreateProcessManifest(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrFindEntryForAddress(UNKNOWN,UNKNOWN)
ntdll.dll|LdrFindResourceDirectory_U(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrFindResourceEx_U(HMODULE,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrFindResource_U(HMODULE,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrFlushAlternateResourceModules()
ntdll.dll|LdrInitShimEngineDynamic(UNKNOWN)
; fail
;ntdll.dll|LdrInitializeThunk(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrLoadAlternateResourceModule(HMODULE,UNKNOWN)
ntdll.dll|NTSTATUS NTAPI LdrLoadDll(PWCHAR PathToFile,ULONG Flags,PUNICODE_STRING ModuleFileName,PHANDLE ModuleHandle);|Out|FailureIfNotNullRet
; lots of call
!ntdll.dll|LdrLockLoaderLock(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrProcessRelocationBlock(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrQueryImageFileExecutionOptions(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrQueryProcessModuleInformation(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrSetAppCompatDllRedirectionCallback(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|LdrSetDllManifestProber(UNKNOWN)
;LdrShutdownProcess called on process shutdown no more func will be called after it.
;Cause "deadlock" for on target process shutdown for unload (reply No on the "Do you want to wait more time msg")
!ntdll.dll|LdrShutdownProcess()|InNoRet
ntdll.dll|LdrShutdownThread()
ntdll.dll|LdrUnloadAlternateResourceModule(UNKNOWN)
ntdll.dll|NTSTATUS NTAPI LdrUnloadDll(HANDLE ModuleHandle);|FailureIfNotNullRet
; lots of call
!ntdll.dll|LdrUnlockLoaderLock(UNKNOWN,UNKNOWN)
ntdll.dll|LdrVerifyImageMatchesChecksum(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)

;ntdll.dll|NlsAnsiCodePage()
;ntdll.dll|NlsMbCodePageTag()
;ntdll.dll|NlsMbOemCodePageTag()

ntdll.dll|NtAcceptConnectPort(PHANDLE ServerPortHandle,HANDLE AlternativeReceivePortHandle ,PLPC_MESSAGE ConnectionReply,BOOLEAN AcceptConnection,PLPC_SECTION_OWNER_MEMORY ServerSharedMemory ,PLPC_SECTION_MEMORY ClientSharedMemory )|Out|FailureIfNotNullRet
;ZwAcceptConnectPort() has the same entry point as NtAcceptConnectPort
!ntdll.dll|ZwAcceptConnectPort(PHANDLE ServerPortHandle,HANDLE AlternativeReceivePortHandle ,PLPC_MESSAGE ConnectionReply,BOOLEAN AcceptConnection,PLPC_SECTION_OWNER_MEMORY ServerSharedMemory ,PLPC_SECTION_MEMORY ClientSharedMemory )|Out|FailureIfNotNullRet
ntdll.dll|NtAccessCheck(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwAccessCheck() has the same entry point as NtAccessCheck
!ntdll.dll|ZwAccessCheck(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtAccessCheckAndAuditAlarm(PUNICODE_STRING SubsystemName ,HANDLE ObjectHandle ,PUNICODE_STRING ObjectTypeName ,PUNICODE_STRING ObjectName ,PSECURITY_DESCRIPTOR SecurityDescriptor,ACCESS_MASK DesiredAccess,PGENERIC_MAPPING GenericMapping,BOOLEAN ObjectCreation,PULONG GrantedAccess,PULONG AccessStatus,PBOOLEAN GenerateOnClose)|Out|FailureIfNotNullRet
;ZwAccessCheckAndAuditAlarm() has the same entry point as NtAccessCheckAndAuditAlarm
!ntdll.dll|ZwAccessCheckAndAuditAlarm(PUNICODE_STRING SubsystemName ,HANDLE ObjectHandle ,PUNICODE_STRING ObjectTypeName ,PUNICODE_STRING ObjectName ,PSECURITY_DESCRIPTOR SecurityDescriptor,ACCESS_MASK DesiredAccess,PGENERIC_MAPPING GenericMapping,BOOLEAN ObjectCreation,PULONG GrantedAccess,PULONG AccessStatus,PBOOLEAN GenerateOnClose)|Out|FailureIfNotNullRet
ntdll.dll|NtAccessCheckByType(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwAccessCheckByType() has the same entry point as NtAccessCheckByType
!ntdll.dll|ZwAccessCheckByType(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtAccessCheckByTypeAndAuditAlarm(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwAccessCheckByTypeAndAuditAlarm() has the same entry point as NtAccessCheckByTypeAndAuditAlarm
!ntdll.dll|ZwAccessCheckByTypeAndAuditAlarm(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtAccessCheckByTypeResultList(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwAccessCheckByTypeResultList() has the same entry point as NtAccessCheckByTypeResultList
!ntdll.dll|ZwAccessCheckByTypeResultList(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtAccessCheckByTypeResultListAndAuditAlarm(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwAccessCheckByTypeResultListAndAuditAlarm() has the same entry point as NtAccessCheckByTypeResultListAndAuditAlarm
!ntdll.dll|ZwAccessCheckByTypeResultListAndAuditAlarm(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtAccessCheckByTypeResultListAndAuditAlarmByHandle(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwAccessCheckByTypeResultListAndAuditAlarmByHandle() has the same entry point as NtAccessCheckByTypeResultListAndAuditAlarmByHandle
!ntdll.dll|ZwAccessCheckByTypeResultListAndAuditAlarmByHandle(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtAddAtom(PWCHAR AtomName, PRTL_ATOM Atom,UNKNOWN )|Out|FailureIfNotNullRet
;ZwAddAtom() has the same entry point as NtAddAtom
!ntdll.dll|ZwAddAtom(PWCHAR AtomName, PRTL_ATOM Atom,UNKNOWN )|Out|FailureIfNotNullRet
ntdll.dll|NtAddBootEntry(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwAddBootEntry() has the same entry point as NtAddBootEntry
!ntdll.dll|ZwAddBootEntry(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtAdjustGroupsToken(HANDLE TokenHandle,BOOLEAN ResetToDefault,PTOKEN_GROUPS TokenGroups,ULONG PreviousGroupsLength,PTOKEN_GROUPS PreviousGroups ,PULONG RequiredLength )|Out|FailureIfNotNullRet
;ZwAdjustGroupsToken() has the same entry point as NtAdjustGroupsToken
!ntdll.dll|ZwAdjustGroupsToken(HANDLE TokenHandle,BOOLEAN ResetToDefault,PTOKEN_GROUPS TokenGroups,ULONG PreviousGroupsLength,PTOKEN_GROUPS PreviousGroups ,PULONG RequiredLength )|Out|FailureIfNotNullRet
ntdll.dll|NtAdjustPrivilegesToken(HANDLE TokenHandle, BOOLEAN DisableAllPrivileges, PTOKEN_PRIVILEGES TokenPrivileges, ULONG PreviousPrivilegesLength, PTOKEN_PRIVILEGES PreviousPrivileges , PULONG RequiredLength )|Out|FailureIfNotNullRet
;ZwAdjustPrivilegesToken() has the same entry point as NtAdjustPrivilegesToken
!ntdll.dll|ZwAdjustPrivilegesToken(HANDLE TokenHandle, BOOLEAN DisableAllPrivileges, PTOKEN_PRIVILEGES TokenPrivileges, ULONG PreviousPrivilegesLength, PTOKEN_PRIVILEGES PreviousPrivileges , PULONG RequiredLength )|Out|FailureIfNotNullRet
ntdll.dll|NtAlertResumeThread(HANDLE ThreadHandle,PULONG SuspendCount)|Out|FailureIfNotNullRet
;ZwAlertResumeThread() has the same entry point as NtAlertResumeThread
!ntdll.dll|ZwAlertResumeThread(HANDLE ThreadHandle,PULONG SuspendCount)|Out|FailureIfNotNullRet
ntdll.dll|NtAlertThread(HANDLE ThreadHandle)|FailureIfNotNullRet
;ZwAlertThread() has the same entry point as NtAlertThread
!ntdll.dll|ZwAlertThread(HANDLE ThreadHandle)|FailureIfNotNullRet
ntdll.dll|NtAllocateLocallyUniqueId(PLUID LocallyUniqueId )|FailureIfNotNullRet
;ZwAllocateLocallyUniqueId() has the same entry point as NtAllocateLocallyUniqueId
!ntdll.dll|ZwAllocateLocallyUniqueId(PLUID LocallyUniqueId )|FailureIfNotNullRet
ntdll.dll|NtAllocateUserPhysicalPages(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwAllocateUserPhysicalPages() has the same entry point as NtAllocateUserPhysicalPages
!ntdll.dll|ZwAllocateUserPhysicalPages(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtAllocateUuids(PLARGE_INTEGER Time,PULONG Range,PULONG Sequence,UNKNOWN )|Out|FailureIfNotNullRet
;ZwAllocateUuids() has the same entry point as NtAllocateUuids
!ntdll.dll|ZwAllocateUuids(PLARGE_INTEGER Time,PULONG Range,PULONG Sequence,UNKNOWN )|Out|FailureIfNotNullRet
; lots of call
!ntdll.dll|NtAllocateVirtualMemory(HANDLE ProcessHandle,PVOID *BaseAddress,ULONG ZeroBits,PULONG RegionSize,ULONG AllocationType,ULONG Protect )|Out|FailureIfNotNullRet
;ZwAllocateVirtualMemory() has the same entry point as NtAllocateVirtualMemory
!ntdll.dll|ZwAllocateVirtualMemory(HANDLE ProcessHandle,PVOID *BaseAddress,ULONG ZeroBits,PULONG RegionSize,ULONG AllocationType,ULONG Protect )|Out|FailureIfNotNullRet
ntdll.dll|NtAreMappedFilesTheSame(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwAreMappedFilesTheSame() has the same entry point as NtAreMappedFilesTheSame
!ntdll.dll|ZwAreMappedFilesTheSame(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtAssignProcessToJobObject(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwAssignProcessToJobObject() has the same entry point as NtAssignProcessToJobObject
!ntdll.dll|ZwAssignProcessToJobObject(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
!ntdll.dll|NtCallbackReturn(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwCallbackReturn() has the same entry point as NtCallbackReturn
!ntdll.dll|ZwCallbackReturn(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtCancelDeviceWakeupRequest(UNKNOWN)|FailureIfNotNullRet
;ZwCancelDeviceWakeupRequest() has the same entry point as NtCancelDeviceWakeupRequest
!ntdll.dll|ZwCancelDeviceWakeupRequest(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtCancelIoFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock)|Out|FailureIfNotNullRet
;ZwCancelIoFile() has the same entry point as NtCancelIoFile
!ntdll.dll|ZwCancelIoFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock)|Out|FailureIfNotNullRet
ntdll.dll|NtCancelTimer(HANDLE TimerHandle,PBOOLEAN CurrentState)|Out|FailureIfNotNullRet
;ZwCancelTimer() has the same entry point as NtCancelTimer
!ntdll.dll|ZwCancelTimer(HANDLE TimerHandle,PBOOLEAN CurrentState)|Out|FailureIfNotNullRet
; lots of call
!ntdll.dll|NtClearEvent(HANDLE EventHandle)|FailureIfNotNullRet
;ZwClearEvent() has the same entry point as NtClearEvent
!ntdll.dll|ZwClearEvent(HANDLE EventHandle)|FailureIfNotNullRet
; lots of call
!ntdll.dll|NtClose(HANDLE ObjectHandle)|FailureIfNotNullRet
;ZwClose() has the same entry point as NtClose
!ntdll.dll|ZwClose(HANDLE ObjectHandle)|FailureIfNotNullRet
ntdll.dll|NtCloseObjectAuditAlarm(PUNICODE_STRING SubsystemName,HANDLE ObjectHandle ,BOOLEAN GenerateOnClose )|FailureIfNotNullRet
;ZwCloseObjectAuditAlarm() has the same entry point as NtCloseObjectAuditAlarm
!ntdll.dll|ZwCloseObjectAuditAlarm(PUNICODE_STRING SubsystemName,HANDLE ObjectHandle ,BOOLEAN GenerateOnClose )|FailureIfNotNullRet
ntdll.dll|NtCompactKeys(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwCompactKeys() has the same entry point as NtCompactKeys
!ntdll.dll|ZwCompactKeys(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NTSTATUS NTAPI NtCompareTokens( Handle FirstTokenHandle, Handle SecondTokenHandle, PBOOLEAN Equal)|Out|FailureIfNotNullRet
;ZwCompareTokens() has the same entry point as NtCompareTokens
!ntdll.dll|NTSTATUS NTAPI ZwCompareTokens( Handle FirstTokenHandle, Handle SecondTokenHandle, PBOOLEAN Equal)|Out|FailureIfNotNullRet
ntdll.dll|NtCompleteConnectPort(HANDLE PortHandle )|FailureIfNotNullRet
;ZwCompleteConnectPort() has the same entry point as NtCompleteConnectPort
!ntdll.dll|ZwCompleteConnectPort(HANDLE PortHandle )|FailureIfNotNullRet
ntdll.dll|NtCompressKey(UNKNOWN)|FailureIfNotNullRet
;ZwCompressKey() has the same entry point as NtCompressKey
!ntdll.dll|ZwCompressKey(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtConnectPort(PHANDLE ClientPortHandle,PUNICODE_STRING ServerPortName,PSECURITY_QUALITY_OF_SERVICE SecurityQos,PLPC_SECTION_OWNER_MEMORY ClientSharedMemory ,PLPC_SECTION_MEMORY ServerSharedMemory ,PULONG MaximumMessageLength ,PVOID ConnectionInfo ,PULONG ConnectionInfoLength )|Out|FailureIfNotNullRet
;ZwConnectPort() has the same entry point as NtConnectPort
!ntdll.dll|ZwConnectPort(PHANDLE ClientPortHandle,PUNICODE_STRING ServerPortName,PSECURITY_QUALITY_OF_SERVICE SecurityQos,PLPC_SECTION_OWNER_MEMORY ClientSharedMemory ,PLPC_SECTION_MEMORY ServerSharedMemory ,PULONG MaximumMessageLength ,PVOID ConnectionInfo ,PULONG ConnectionInfoLength )|Out|FailureIfNotNullRet
!ntdll.dll|NtContinue(PCONTEXT ThreadContext,BOOLEAN RaiseAlert )|FailureIfNotNullRet
;ZwContinue() has the same entry point as NtContinue
!ntdll.dll|ZwContinue(PCONTEXT ThreadContext,BOOLEAN RaiseAlert )|FailureIfNotNullRet
ntdll.dll|NtCreateDebugObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwCreateDebugObject() has the same entry point as NtCreateDebugObject
!ntdll.dll|ZwCreateDebugObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtCreateDirectoryObject(PHANDLE DirectoryHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwCreateDirectoryObject() has the same entry point as NtCreateDirectoryObject
!ntdll.dll|ZwCreateDirectoryObject(PHANDLE DirectoryHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
; Lots of call
!ntdll.dll|NtCreateEvent(PHANDLE EventHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,EVENT_TYPE EventType,BOOLEAN InitialState )|Out|FailureIfNotNullRet
;ZwCreateEvent() has the same entry point as NtCreateEvent
!ntdll.dll|ZwCreateEvent(PHANDLE EventHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,EVENT_TYPE EventType,BOOLEAN InitialState )|Out|FailureIfNotNullRet
ntdll.dll|NtCreateEventPair(PHANDLE EventPairHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwCreateEventPair() has the same entry point as NtCreateEventPair
!ntdll.dll|ZwCreateEventPair(PHANDLE EventPairHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
ntdll.dll|NTSTATUS NtCreateFile( PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength)|Out|FailureIfNotNullRet
;ZwCreateFile() has the same entry point as NtCreateFile
!ntdll.dll|NTSTATUS ZwCreateFile( PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength)|Out|FailureIfNotNullRet
ntdll.dll|NtCreateIoCompletion(PHANDLE IoCompletionHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,ULONG NumberOfConcurrentThreads)|Out|FailureIfNotNullRet
;ZwCreateIoCompletion() has the same entry point as NtCreateIoCompletion
!ntdll.dll|ZwCreateIoCompletion(PHANDLE IoCompletionHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,ULONG NumberOfConcurrentThreads)|Out|FailureIfNotNullRet
ntdll.dll|NtCreateJobObject(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwCreateJobObject() has the same entry point as NtCreateJobObject
!ntdll.dll|ZwCreateJobObject(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtCreateJobSet(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwCreateJobSet() has the same entry point as NtCreateJobSet
!ntdll.dll|ZwCreateJobSet(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtCreateKey(PHANDLE pKeyHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes,ULONG TitleIndex,PUNICODE_STRING Class ,ULONG CreateOptions,PULONG Disposition )|Out|FailureIfNotNullRet
;ZwCreateKey() has the same entry point as NtCreateKey
!ntdll.dll|ZwCreateKey(PHANDLE pKeyHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes,ULONG TitleIndex,PUNICODE_STRING Class ,ULONG CreateOptions,PULONG Disposition )|Out|FailureIfNotNullRet
ntdll.dll|NtCreateKeyedEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwCreateKeyedEvent() has the same entry point as NtCreateKeyedEvent
!ntdll.dll|ZwCreateKeyedEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtCreateMailslotFile(PHANDLE MailslotFileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, ULONG CreateOptions, ULONG MailslotQuota, ULONG MaxMessageSize, PLARGE_INTEGER ReadTimeOut )|Out|FailureIfNotNullRet
;ZwCreateMailslotFile() has the same entry point as NtCreateMailslotFile
!ntdll.dll|ZwCreateMailslotFile(PHANDLE MailslotFileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, ULONG CreateOptions, ULONG MailslotQuota, ULONG MaxMessageSize, PLARGE_INTEGER ReadTimeOut )|Out|FailureIfNotNullRet
ntdll.dll|NtCreateMutant(PHANDLE MutantHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,BOOLEAN InitialOwner )|Out|FailureIfNotNullRet
;ZwCreateMutant() has the same entry point as NtCreateMutant
!ntdll.dll|ZwCreateMutant(PHANDLE MutantHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,BOOLEAN InitialOwner )|Out|FailureIfNotNullRet
ntdll.dll|NtCreateNamedPipeFile(PHANDLE NamedPipeFileHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes,PIO_STATUS_BLOCK IoStatusBlock,ULONG ShareAccess,ULONG CreateDisposition,ULONG CreateOptions,BOOLEAN WriteModeMessage,BOOLEAN ReadModeMessage,BOOLEAN NonBlocking,ULONG MaxInstances,ULONG InBufferSize,ULONG OutBufferSize,PLARGE_INTEGER DefaultTimeOut )|Out|FailureIfNotNullRet
;ZwCreateNamedPipeFile() has the same entry point as NtCreateNamedPipeFile
!ntdll.dll|ZwCreateNamedPipeFile(PHANDLE NamedPipeFileHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes,PIO_STATUS_BLOCK IoStatusBlock,ULONG ShareAccess,ULONG CreateDisposition,ULONG CreateOptions,BOOLEAN WriteModeMessage,BOOLEAN ReadModeMessage,BOOLEAN NonBlocking,ULONG MaxInstances,ULONG InBufferSize,ULONG OutBufferSize,PLARGE_INTEGER DefaultTimeOut )|Out|FailureIfNotNullRet
ntdll.dll|NtCreatePagingFile(PUNICODE_STRING PageFileName,PLARGE_INTEGER MiniumSize,PLARGE_INTEGER MaxiumSize,PLARGE_INTEGER ActualSize)|Out|FailureIfNotNullRet
;ZwCreatePagingFile() has the same entry point as NtCreatePagingFile
!ntdll.dll|ZwCreatePagingFile(PUNICODE_STRING PageFileName,PLARGE_INTEGER MiniumSize,PLARGE_INTEGER MaxiumSize,PLARGE_INTEGER ActualSize)|Out|FailureIfNotNullRet
ntdll.dll|NtCreatePort(PHANDLE PortHandle,POBJECT_ATTRIBUTES ObjectAttributes,ULONG MaxConnectInfoLength,ULONG MaxDataLength,PULONG Reserved )|Out|FailureIfNotNullRet
;ZwCreatePort() has the same entry point as NtCreatePort
!ntdll.dll|ZwCreatePort(PHANDLE PortHandle,POBJECT_ATTRIBUTES ObjectAttributes,ULONG MaxConnectInfoLength,ULONG MaxDataLength,PULONG Reserved )|Out|FailureIfNotNullRet
ntdll.dll|NtCreateProcess(PHANDLE ProcessHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,HANDLE ParentProcess,BOOLEAN InheritObjectTable,HANDLE SectionHandle ,HANDLE DebugPort ,HANDLE ExceptionPort)|Out|FailureIfNotNullRet
;ZwCreateProcess() has the same entry point as NtCreateProcess
!ntdll.dll|ZwCreateProcess(PHANDLE ProcessHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,HANDLE ParentProcess,BOOLEAN InheritObjectTable,HANDLE SectionHandle ,HANDLE DebugPort ,HANDLE ExceptionPort)|Out|FailureIfNotNullRet
ntdll.dll|NtCreateProcessEx(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwCreateProcessEx() has the same entry point as NtCreateProcessEx
!ntdll.dll|ZwCreateProcessEx(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtCreateProfile(PHANDLE ProfileHandle,HANDLE Process ,PVOID ImageBase,ULONG ImageSize,ULONG BucketSize,PVOID Buffer,ULONG BufferSize,KPROFILE_SOURCE ProfileSource,KAFFINITY Affinity)|Out|FailureIfNotNullRet
;ZwCreateProfile() has the same entry point as NtCreateProfile
!ntdll.dll|ZwCreateProfile(PHANDLE ProfileHandle,HANDLE Process ,PVOID ImageBase,ULONG ImageSize,ULONG BucketSize,PVOID Buffer,ULONG BufferSize,KPROFILE_SOURCE ProfileSource,KAFFINITY Affinity)|Out|FailureIfNotNullRet
ntdll.dll|NtCreateSection(PHANDLE SectionHandle,ULONG DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,PLARGE_INTEGER MaximumSize ,ULONG PageAttributess,ULONG SectionAttributes,HANDLE FileHandle )|Out|FailureIfNotNullRet
;ZwCreateSection() has the same entry point as NtCreateSection
!ntdll.dll|ZwCreateSection(PHANDLE SectionHandle,ULONG DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,PLARGE_INTEGER MaximumSize ,ULONG PageAttributess,ULONG SectionAttributes,HANDLE FileHandle )|Out|FailureIfNotNullRet
ntdll.dll|NtCreateSemaphore(PHANDLE SemaphoreHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,ULONG InitialCount,ULONG MaximumCount )|Out|FailureIfNotNullRet
;ZwCreateSemaphore() has the same entry point as NtCreateSemaphore
!ntdll.dll|ZwCreateSemaphore(PHANDLE SemaphoreHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,ULONG InitialCount,ULONG MaximumCount )|Out|FailureIfNotNullRet
ntdll.dll|NtCreateSymbolicLinkObject(PHANDLE pHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PUNICODE_STRING DestinationName )|Out|FailureIfNotNullRet
;ZwCreateSymbolicLinkObject() has the same entry point as NtCreateSymbolicLinkObject
!ntdll.dll|ZwCreateSymbolicLinkObject(PHANDLE pHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PUNICODE_STRING DestinationName )|Out|FailureIfNotNullRet
ntdll.dll|NtCreateThread(PHANDLE ThreadHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,HANDLE ProcessHandle,PCLIENT_ID ClientId,PCONTEXT ThreadContext,PINITIAL_TEB InitialTeb,BOOLEAN CreateSuspended )|Out|FailureIfNotNullRet
;ZwCreateThread() has the same entry point as NtCreateThread
!ntdll.dll|ZwCreateThread(PHANDLE ThreadHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,HANDLE ProcessHandle,PCLIENT_ID ClientId,PCONTEXT ThreadContext,PINITIAL_TEB InitialTeb,BOOLEAN CreateSuspended )|Out|FailureIfNotNullRet
ntdll.dll|NtCreateTimer(PHANDLE TimerHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,TIMER_TYPE TimerType )|Out|FailureIfNotNullRet
;ZwCreateTimer() has the same entry point as NtCreateTimer
!ntdll.dll|ZwCreateTimer(PHANDLE TimerHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,TIMER_TYPE TimerType )|Out|FailureIfNotNullRet
ntdll.dll|NtCreateToken(PHANDLE TokenHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes,TOKEN_TYPE TokenType,PLUID AuthenticationId,PLARGE_INTEGER  ExpirationTime,PTOKEN_USER TokenUser,PTOKEN_GROUPS TokenGroups,PTOKEN_PRIVILEGES TokenPrivileges,PTOKEN_OWNER TokenOwner,PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,PTOKEN_DEFAULT_DACL TokenDefaultDacl,PTOKEN_SOURCE TokenSource )|Out|FailureIfNotNullRet
;ZwCreateToken() has the same entry point as NtCreateToken
!ntdll.dll|ZwCreateToken(PHANDLE TokenHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes,TOKEN_TYPE TokenType,PLUID AuthenticationId,PLARGE_INTEGER  ExpirationTime,PTOKEN_USER TokenUser,PTOKEN_GROUPS TokenGroups,PTOKEN_PRIVILEGES TokenPrivileges,PTOKEN_OWNER TokenOwner,PTOKEN_PRIMARY_GROUP TokenPrimaryGroup,PTOKEN_DEFAULT_DACL TokenDefaultDacl,PTOKEN_SOURCE TokenSource )|Out|FailureIfNotNullRet
ntdll.dll|NtCreateWaitablePort(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwCreateWaitablePort() has the same entry point as NtCreateWaitablePort
!ntdll.dll|ZwCreateWaitablePort(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtCurrentTeb()|FailureIfNotNullRet
ntdll.dll|NtDebugActiveProcess(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwDebugActiveProcess() has the same entry point as NtDebugActiveProcess
!ntdll.dll|ZwDebugActiveProcess(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtDebugContinue(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwDebugContinue() has the same entry point as NtDebugContinue
!ntdll.dll|ZwDebugContinue(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
; lots of call
!ntdll.dll|NtDelayExecution(BOOLEAN Alertable,PLARGE_INTEGER DelayInterval)|FailureIfNotNullRet
;ZwDelayExecution() has the same entry point as NtDelayExecution
!ntdll.dll|ZwDelayExecution(BOOLEAN Alertable,PLARGE_INTEGER DelayInterval)|FailureIfNotNullRet
ntdll.dll|NtDeleteAtom(RTL_ATOM Atom)|FailureIfNotNullRet
;ZwDeleteAtom() has the same entry point as NtDeleteAtom
!ntdll.dll|ZwDeleteAtom(RTL_ATOM Atom)|FailureIfNotNullRet
ntdll.dll|NtDeleteBootEntry(UNKNOWN)|FailureIfNotNullRet
;ZwDeleteBootEntry() has the same entry point as NtDeleteBootEntry
!ntdll.dll|ZwDeleteBootEntry(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtDeleteFile(POBJECT_ATTRIBUTES ObjectAttributes )|FailureIfNotNullRet
;ZwDeleteFile() has the same entry point as NtDeleteFile
!ntdll.dll|ZwDeleteFile(POBJECT_ATTRIBUTES ObjectAttributes )|FailureIfNotNullRet
ntdll.dll|NtDeleteKey(HANDLE KeyHandle )|FailureIfNotNullRet
;ZwDeleteKey() has the same entry point as NtDeleteKey
!ntdll.dll|ZwDeleteKey(HANDLE KeyHandle )|FailureIfNotNullRet
ntdll.dll|NtDeleteObjectAuditAlarm(PUNICODE_STRING SubsystemName,HANDLE ObjectHandle ,BOOLEAN GenerateOnClose )|FailureIfNotNullRet
;ZwDeleteObjectAuditAlarm() has the same entry point as NtDeleteObjectAuditAlarm
!ntdll.dll|ZwDeleteObjectAuditAlarm(PUNICODE_STRING SubsystemName,HANDLE ObjectHandle ,BOOLEAN GenerateOnClose )|FailureIfNotNullRet
ntdll.dll|NtDeleteValueKey(HANDLE KeyHandle,PUNICODE_STRING ValueName )|FailureIfNotNullRet
;ZwDeleteValueKey() has the same entry point as NtDeleteValueKey
!ntdll.dll|ZwDeleteValueKey(HANDLE KeyHandle,PUNICODE_STRING ValueName )|FailureIfNotNullRet
ntdll.dll|NTSTATUS NtDeviceIoControlFile( HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, ULONG IoControlCode, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength)|Out|FailureIfNotNullRet
;ZwDeviceIoControlFile() has the same entry point as NtDeviceIoControlFile
!ntdll.dll|NTSTATUS ZwDeviceIoControlFile( HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, ULONG IoControlCode, PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer, ULONG OutputBufferLength)|Out|FailureIfNotNullRet
ntdll.dll|NtDisplayString(PUNICODE_STRING String)|FailureIfNotNullRet
;ZwDisplayString() has the same entry point as NtDisplayString
!ntdll.dll|ZwDisplayString(PUNICODE_STRING String )|FailureIfNotNullRet
ntdll.dll|NtDuplicateObject(HANDLE SourceProcessHandle,PHANDLE SourceHandle,HANDLE TargetProcessHandle,PHANDLE TargetHandle,ACCESS_MASK DesiredAccess ,BOOLEAN InheritHandle,ULONG Options )|Out|FailureIfNotNullRet
;ZwDuplicateObject() has the same entry point as NtDuplicateObject
!ntdll.dll|ZwDuplicateObject(HANDLE SourceProcessHandle,PHANDLE SourceHandle,HANDLE TargetProcessHandle,PHANDLE TargetHandle,ACCESS_MASK DesiredAccess ,BOOLEAN InheritHandle,ULONG Options )|Out|FailureIfNotNullRet
ntdll.dll|NtDuplicateToken(HANDLE ExistingToken,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,TOKEN_TYPE TokenType,PHANDLE NewToken )|Out|FailureIfNotNullRet
;ZwDuplicateToken() has the same entry point as NtDuplicateToken
!ntdll.dll|ZwDuplicateToken(HANDLE ExistingToken,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes ,SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,TOKEN_TYPE TokenType,PHANDLE NewToken )|Out|FailureIfNotNullRet
ntdll.dll|NtEnumerateBootEntries(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwEnumerateBootEntries() has the same entry point as NtEnumerateBootEntries
!ntdll.dll|ZwEnumerateBootEntries(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtEnumerateKey(HANDLE KeyHandle,ULONG Index,KEY_INFORMATION_CLASS KeyInformationClass,PVOID KeyInformation,ULONG Length,PULONG ResultLength )|Out|FailureIfNotNullRet
;ZwEnumerateKey() has the same entry point as NtEnumerateKey
!ntdll.dll|ZwEnumerateKey(HANDLE KeyHandle,ULONG Index,KEY_INFORMATION_CLASS KeyInformationClass,PVOID KeyInformation,ULONG Length,PULONG ResultLength )|Out|FailureIfNotNullRet
ntdll.dll|NtEnumerateSystemEnvironmentValuesEx(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwEnumerateSystemEnvironmentValuesEx() has the same entry point as NtEnumerateSystemEnvironmentValuesEx
!ntdll.dll|ZwEnumerateSystemEnvironmentValuesEx(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtEnumerateValueKey(HANDLE KeyHandle,ULONG Index,KEY_VALUE_INFORMATION_CLASS KeyValueInformation,PVOID KeyValueInformation,ULONG Length,PULONG ResultLength )|Out|FailureIfNotNullRet
;ZwEnumerateValueKey() has the same entry point as NtEnumerateValueKey
!ntdll.dll|ZwEnumerateValueKey(HANDLE KeyHandle,ULONG Index,KEY_VALUE_INFORMATION_CLASS KeyValueInformation,PVOID KeyValueInformation,ULONG Length,PULONG ResultLength )|Out|FailureIfNotNullRet
ntdll.dll|NtExtendSection(HANDLE SectionHandle,PLARGE_INTEGER NewSectionSize )|FailureIfNotNullRet
;ZwExtendSection() has the same entry point as NtExtendSection
!ntdll.dll|ZwExtendSection(HANDLE SectionHandle,PLARGE_INTEGER NewSectionSize )|FailureIfNotNullRet
ntdll.dll|NtFilterToken(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwFilterToken() has the same entry point as NtFilterToken
!ntdll.dll|ZwFilterToken(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtFindAtom(PWCHAR AtomName,PRTL_ATOM Atom,UNKNOWN)|FailureIfNotNullRet
;ZwFindAtom() has the same entry point as NtFindAtom
!ntdll.dll|ZwFindAtom(PWCHAR AtomName,PRTL_ATOM Atom,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtFlushBuffersFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock )|Out|FailureIfNotNullRet
;ZwFlushBuffersFile() has the same entry point as NtFlushBuffersFile
!ntdll.dll|ZwFlushBuffersFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock )|Out|FailureIfNotNullRet
ntdll.dll|NtFlushInstructionCache(HANDLE ProcessHandle,PVOID BaseAddress,ULONG NumberOfBytesToFlush )|FailureIfNotNullRet
;ZwFlushInstructionCache() has the same entry point as NtFlushInstructionCache
!ntdll.dll|ZwFlushInstructionCache(HANDLE ProcessHandle,PVOID BaseAddress,ULONG NumberOfBytesToFlush )|FailureIfNotNullRet
ntdll.dll|NtFlushKey(HANDLE KeyHandle)|FailureIfNotNullRet
;ZwFlushKey() has the same entry point as NtFlushKey
!ntdll.dll|ZwFlushKey(HANDLE KeyHandle )|FailureIfNotNullRet
ntdll.dll|NtFlushVirtualMemory(HANDLE ProcessHandle,PVOID BaseAddress,PULONG NumberOfBytesToFlush,PULONG NumberOfBytesFlushed )|Out|FailureIfNotNullRet
;ZwFlushVirtualMemory() has the same entry point as NtFlushVirtualMemory
!ntdll.dll|ZwFlushVirtualMemory(HANDLE ProcessHandle,PVOID BaseAddress,PULONG NumberOfBytesToFlush,PULONG NumberOfBytesFlushed )|Out|FailureIfNotNullRet
ntdll.dll|NtFlushWriteBuffer()|FailureIfNotNullRet
;ZwFlushWriteBuffer() has the same entry point as NtFlushWriteBuffer
!ntdll.dll|ZwFlushWriteBuffer()|FailureIfNotNullRet
ntdll.dll|NtFreeUserPhysicalPages(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwFreeUserPhysicalPages() has the same entry point as NtFreeUserPhysicalPages
!ntdll.dll|ZwFreeUserPhysicalPages(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtFreeVirtualMemory(HANDLE ProcessHandle,PVOID *BaseAddress,PULONG RegionSize,ULONG FreeType)|FailureIfNotNullRet
;ZwFreeVirtualMemory() has the same entry point as NtFreeVirtualMemory
!ntdll.dll|ZwFreeVirtualMemory(HANDLE ProcessHandle,PVOID *BaseAddress,PULONG RegionSize,ULONG FreeType)|FailureIfNotNullRet
ntdll.dll|NtFsControlFile(HANDLE FileHandle,HANDLE Event ,PIO_APC_ROUTINE ApcRoutine ,PVOID ApcContext ,PIO_STATUS_BLOCK IoStatusBlock,ULONG FsControlCode,PVOID InputBuffer ,ULONG InputBufferLength,PVOID OutputBuffer ,ULONG OutputBufferLength)|Out|FailureIfNotNullRet
;ZwFsControlFile() has the same entry point as NtFsControlFile
!ntdll.dll|ZwFsControlFile(HANDLE FileHandle,HANDLE Event ,PIO_APC_ROUTINE ApcRoutine ,PVOID ApcContext ,PIO_STATUS_BLOCK IoStatusBlock,ULONG FsControlCode,PVOID InputBuffer ,ULONG InputBufferLength,PVOID OutputBuffer ,ULONG OutputBufferLength)|Out|FailureIfNotNullRet
ntdll.dll|NtGetContextThread(HANDLE ThreadHandle,PCONTEXT pContext)|Out|FailureIfNotNullRet
;ZwGetContextThread() has the same entry point as NtGetContextThread
!ntdll.dll|ZwGetContextThread(HANDLE ThreadHandle,PCONTEXT pContext)|Out|FailureIfNotNullRet
ntdll.dll|NtGetDevicePowerState(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwGetDevicePowerState() has the same entry point as NtGetDevicePowerState
!ntdll.dll|ZwGetDevicePowerState(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtGetPlugPlayEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwGetPlugPlayEvent() has the same entry point as NtGetPlugPlayEvent
!ntdll.dll|ZwGetPlugPlayEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtGetWriteWatch(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwGetWriteWatch() has the same entry point as NtGetWriteWatch
!ntdll.dll|ZwGetWriteWatch(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtImpersonateAnonymousToken(UNKNOWN)|FailureIfNotNullRet
;ZwImpersonateAnonymousToken() has the same entry point as NtImpersonateAnonymousToken
!ntdll.dll|ZwImpersonateAnonymousToken(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtImpersonateClientOfPort(HANDLE PortHandle,PLPC_MESSAGE Request )|FailureIfNotNullRet
;ZwImpersonateClientOfPort() has the same entry point as NtImpersonateClientOfPort
!ntdll.dll|ZwImpersonateClientOfPort(HANDLE PortHandle,PLPC_MESSAGE Request )|FailureIfNotNullRet
ntdll.dll|NtImpersonateThread(HANDLE ThreadHandle,HANDLE ThreadToImpersonate,PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService )|FailureIfNotNullRet
;ZwImpersonateThread() has the same entry point as NtImpersonateThread
!ntdll.dll|ZwImpersonateThread(HANDLE ThreadHandle,HANDLE ThreadToImpersonate,PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService )|FailureIfNotNullRet
ntdll.dll|NtInitializeRegistry(UNKNOWN)|FailureIfNotNullRet
;ZwInitializeRegistry() has the same entry point as NtInitializeRegistry
!ntdll.dll|ZwInitializeRegistry(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtInitiatePowerAction(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwInitiatePowerAction() has the same entry point as NtInitiatePowerAction
!ntdll.dll|ZwInitiatePowerAction(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtIsProcessInJob(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwIsProcessInJob() has the same entry point as NtIsProcessInJob
!ntdll.dll|ZwIsProcessInJob(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtIsSystemResumeAutomatic()|FailureIfNotNullRet
;ZwIsSystemResumeAutomatic() has the same entry point as NtIsSystemResumeAutomatic
!ntdll.dll|ZwIsSystemResumeAutomatic()|FailureIfNotNullRet
ntdll.dll|NtListenPort(HANDLE PortHandle,PLPC_MESSAGE ConnectionRequest)|Out|FailureIfNotNullRet
;ZwListenPort() has the same entry point as NtListenPort
!ntdll.dll|ZwListenPort(HANDLE PortHandle,PLPC_MESSAGE ConnectionRequest)|Out|FailureIfNotNullRet
ntdll.dll|NtLoadDriver(PUNICODE_STRING DriverServiceName)|FailureIfNotNullRet
;ZwLoadDriver() has the same entry point as NtLoadDriver
!ntdll.dll|ZwLoadDriver(PUNICODE_STRING DriverServiceName)|FailureIfNotNullRet
ntdll.dll|NtLoadKey(POBJECT_ATTRIBUTES DestinationKeyName,POBJECT_ATTRIBUTES HiveFileName)|FailureIfNotNullRet
;ZwLoadKey() has the same entry point as NtLoadKey
!ntdll.dll|ZwLoadKey(POBJECT_ATTRIBUTES DestinationKeyName,POBJECT_ATTRIBUTES HiveFileName)|FailureIfNotNullRet
ntdll.dll|NtLoadKey2(POBJECT_ATTRIBUTES DestinationKeyName,POBJECT_ATTRIBUTES HiveFileName,ULONG Flags )|FailureIfNotNullRet
;ZwLoadKey2() has the same entry point as NtLoadKey2
!ntdll.dll|ZwLoadKey2(POBJECT_ATTRIBUTES DestinationKeyName,POBJECT_ATTRIBUTES HiveFileName,ULONG Flags )|FailureIfNotNullRet
ntdll.dll|NtLockFile(HANDLE FileHandle,HANDLE LockGrantedEvent ,PIO_APC_ROUTINE ApcRoutine ,PVOID ApcContext ,PIO_STATUS_BLOCK IoStatusBlock,PLARGE_INTEGER ByteOffset,PLARGE_INTEGER Length,PULONG Key,BOOLEAN ReturnImmediately,BOOLEAN ExclusiveLock)|Out|FailureIfNotNullRet
;ZwLockFile() has the same entry point as NtLockFile
!ntdll.dll|ZwLockFile(HANDLE FileHandle,HANDLE LockGrantedEvent ,PIO_APC_ROUTINE ApcRoutine ,PVOID ApcContext ,PIO_STATUS_BLOCK IoStatusBlock,PLARGE_INTEGER ByteOffset,PLARGE_INTEGER Length,PULONG Key,BOOLEAN ReturnImmediately,BOOLEAN ExclusiveLock)|Out|FailureIfNotNullRet
ntdll.dll|NtLockProductActivationKeys(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwLockProductActivationKeys() has the same entry point as NtLockProductActivationKeys
!ntdll.dll|ZwLockProductActivationKeys(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtLockRegistryKey(UNKNOWN)|FailureIfNotNullRet
;ZwLockRegistryKey() has the same entry point as NtLockRegistryKey
!ntdll.dll|ZwLockRegistryKey(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtLockVirtualMemory(HANDLE ProcessHandle,PVOID *BaseAddress,PULONG NumberOfBytesToLock,ULONG LockOption )|Out|FailureIfNotNullRet
;ZwLockVirtualMemory() has the same entry point as NtLockVirtualMemory
!ntdll.dll|ZwLockVirtualMemory(HANDLE ProcessHandle,PVOID *BaseAddress,PULONG NumberOfBytesToLock,ULONG LockOption )|Out|FailureIfNotNullRet
ntdll.dll|NtMakePermanentObject(HANDLE ObjectHandle)|FailureIfNotNullRet
;ZwMakePermanentObject() has the same entry point as NtMakePermanentObject
!ntdll.dll|ZwMakePermanentObject(HANDLE ObjectHandle)|FailureIfNotNullRet
ntdll.dll|NtMakeTemporaryObject(HANDLE ObjectHandle )|FailureIfNotNullRet
;ZwMakeTemporaryObject() has the same entry point as NtMakeTemporaryObject
!ntdll.dll|ZwMakeTemporaryObject(HANDLE ObjectHandle)|FailureIfNotNullRet
ntdll.dll|NtMapUserPhysicalPages(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwMapUserPhysicalPages() has the same entry point as NtMapUserPhysicalPages
!ntdll.dll|ZwMapUserPhysicalPages(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtMapUserPhysicalPagesScatter(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwMapUserPhysicalPagesScatter() has the same entry point as NtMapUserPhysicalPagesScatter
!ntdll.dll|ZwMapUserPhysicalPagesScatter(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtMapViewOfSection(HANDLE SectionHandle,HANDLE ProcessHandle,PVOID *BaseAddress ,ULONG ZeroBits ,ULONG CommitSize,PLARGE_INTEGER SectionOffset ,PULONG ViewSize,SECTION_INHERIT InheritDisposition,ULONG AllocationType ,ULONG Protect)|FailureIfNotNullRet
;ZwMapViewOfSection() has the same entry point as NtMapViewOfSection
!ntdll.dll|ZwMapViewOfSection(HANDLE SectionHandle,HANDLE ProcessHandle,PVOID *BaseAddress ,ULONG ZeroBits ,ULONG CommitSize,PLARGE_INTEGER SectionOffset ,PULONG ViewSize,SECTION_INHERIT InheritDisposition,ULONG AllocationType ,ULONG Protect)|FailureIfNotNullRet
ntdll.dll|NtModifyBootEntry(UNKNOWN)|FailureIfNotNullRet
;ZwModifyBootEntry() has the same entry point as NtModifyBootEntry
!ntdll.dll|ZwModifyBootEntry(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtNotifyChangeDirectoryFile(HANDLE FileHandle,HANDLE Event ,PIO_APC_ROUTINE ApcRoutine ,PVOID ApcContext ,PIO_STATUS_BLOCK IoStatusBlock,PVOID Buffer,ULONG BufferSize,ULONG CompletionFilter,BOOLEAN WatchTree )|Out|FailureIfNotNullRet
;ZwNotifyChangeDirectoryFile() has the same entry point as NtNotifyChangeDirectoryFile
!ntdll.dll|ZwNotifyChangeDirectoryFile(HANDLE FileHandle,HANDLE Event ,PIO_APC_ROUTINE ApcRoutine ,PVOID ApcContext ,PIO_STATUS_BLOCK IoStatusBlock,PVOID Buffer,ULONG BufferSize,ULONG CompletionFilter,BOOLEAN WatchTree )|Out|FailureIfNotNullRet
ntdll.dll|NtNotifyChangeKey(HANDLE KeyHandle,HANDLE EventHandle,PIO_APC_ROUTINE ApcRoutine,PVOID ApcRoutineContext,PIO_STATUS_BLOCK IoStatusBlock,ULONG NotifyFilter,BOOLEAN WatchSubtree,PVOID RegChangesDataBuffer,ULONG RegChangesDataBufferLength,BOOLEAN Asynchronous )|Out|FailureIfNotNullRet
;ZwNotifyChangeKey() has the same entry point as NtNotifyChangeKey
!ntdll.dll|ZwNotifyChangeKey(HANDLE KeyHandle,HANDLE EventHandle,PIO_APC_ROUTINE ApcRoutine,PVOID ApcRoutineContext,PIO_STATUS_BLOCK IoStatusBlock,ULONG NotifyFilter,BOOLEAN WatchSubtree,PVOID RegChangesDataBuffer,ULONG RegChangesDataBufferLength,BOOLEAN Asynchronous )|Out|FailureIfNotNullRet
ntdll.dll|NtNotifyChangeMultipleKeys(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwNotifyChangeMultipleKeys() has the same entry point as NtNotifyChangeMultipleKeys
!ntdll.dll|ZwNotifyChangeMultipleKeys(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtOpenDirectoryObject(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwOpenDirectoryObject() has the same entry point as NtOpenDirectoryObject
!ntdll.dll|ZwOpenDirectoryObject(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
ntdll.dll|NtOpenEvent(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwOpenEvent() has the same entry point as NtOpenEvent
!ntdll.dll|ZwOpenEvent(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
ntdll.dll|NtOpenEventPair(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwOpenEventPair() has the same entry point as NtOpenEventPair
!ntdll.dll|ZwOpenEventPair(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
ntdll.dll|NTSTATUS NtOpenFile( PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, ULONG ShareAccess, ULONG OpenOptions)|Out|FailureIfNotNullRet
;ZwOpenFile() has the same entry point as NtOpenFile
!ntdll.dll|NTSTATUS ZwOpenFile( PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PIO_STATUS_BLOCK IoStatusBlock, ULONG ShareAccess, ULONG OpenOptions)|Out|FailureIfNotNullRet
ntdll.dll|NtOpenIoCompletion(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwOpenIoCompletion() has the same entry point as NtOpenIoCompletion
!ntdll.dll|ZwOpenIoCompletion(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
ntdll.dll|NtOpenJobObject(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwOpenJobObject() has the same entry point as NtOpenJobObject
!ntdll.dll|ZwOpenJobObject(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
; lots of call
!ntdll.dll|NtOpenKey(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwOpenKey() has the same entry point as NtOpenKey
!ntdll.dll|ZwOpenKey(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
ntdll.dll|NtOpenKeyedEvent(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwOpenKeyedEvent() has the same entry point as NtOpenKeyedEvent
!ntdll.dll|ZwOpenKeyedEvent(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
ntdll.dll|NtOpenMutant(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwOpenMutant() has the same entry point as NtOpenMutant
!ntdll.dll|ZwOpenMutant(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
ntdll.dll|NtOpenObjectAuditAlarm(PUNICODE_STRING SubsystemName ,PHANDLE ObjectHandle ,PUNICODE_STRING ObjectTypeName ,PUNICODE_STRING ObjectName ,PSECURITY_DESCRIPTOR SecurityDescriptor ,HANDLE ClientToken,ACCESS_MASK DesiredAccess,ACCESS_MASK GrantedAccess,PPRIVILEGE_SET Privileges ,BOOLEAN ObjectCreation,BOOLEAN AccessGranted,PBOOLEAN GenerateOnClose )|Out|FailureIfNotNullRet
;ZwOpenObjectAuditAlarm() has the same entry point as NtOpenObjectAuditAlarm
!ntdll.dll|ZwOpenObjectAuditAlarm(PUNICODE_STRING SubsystemName ,PHANDLE ObjectHandle ,PUNICODE_STRING ObjectTypeName ,PUNICODE_STRING ObjectName ,PSECURITY_DESCRIPTOR SecurityDescriptor ,HANDLE ClientToken,ACCESS_MASK DesiredAccess,ACCESS_MASK GrantedAccess,PPRIVILEGE_SET Privileges ,BOOLEAN ObjectCreation,BOOLEAN AccessGranted,PBOOLEAN GenerateOnClose )|Out|FailureIfNotNullRet
ntdll.dll|NtOpenProcess(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes,PCLIENT_ID ClientId)|Out|FailureIfNotNullRet
;ZwOpenProcess() has the same entry point as NtOpenProcess
!ntdll.dll|ZwOpenProcess(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes,PCLIENT_ID ClientId)|Out|FailureIfNotNullRet
ntdll.dll|NtOpenProcessToken(HANDLE ProcessHandle,ACCESS_MASK DesiredAccess,PHANDLE TokenHandle )|Out|FailureIfNotNullRet
;ZwOpenProcessToken() has the same entry point as NtOpenProcessToken
!ntdll.dll|ZwOpenProcessToken(HANDLE ProcessHandle,ACCESS_MASK DesiredAccess,PHANDLE TokenHandle )|Out|FailureIfNotNullRet
ntdll.dll|NtOpenProcessTokenEx(HANDLE ProcessHandle,ACCESS_MASK DesiredAccess,PHANDLE TokenHandle,UNKNOWN )|Out|FailureIfNotNullRet
;ZwOpenProcessTokenEx() has the same entry point as NtOpenProcessTokenEx
!ntdll.dll|ZwOpenProcessTokenEx(HANDLE ProcessHandle,ACCESS_MASK DesiredAccess,PHANDLE TokenHandle,UNKNOWN )|Out|FailureIfNotNullRet
ntdll.dll|NtOpenSection(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwOpenSection() has the same entry point as NtOpenSection
!ntdll.dll|ZwOpenSection(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
ntdll.dll|NtOpenSemaphore(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwOpenSemaphore() has the same entry point as NtOpenSemaphore
!ntdll.dll|ZwOpenSemaphore(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
ntdll.dll|NtOpenSymbolicLinkObject(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
;ZwOpenSymbolicLinkObject() has the same entry point as NtOpenSymbolicLinkObject
!ntdll.dll|ZwOpenSymbolicLinkObject(PHANDLE pHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes)|Out|FailureIfNotNullRet
ntdll.dll|NTSTATUS NtOpenThread( PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)|Out|FailureIfNotNullRet
;ZwOpenThread() has the same entry point as NtOpenThread
!ntdll.dll|NTSTATUS ZwOpenThread( PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)|Out|FailureIfNotNullRet
ntdll.dll|NtOpenThreadToken(HANDLE ThreadHandle,ACCESS_MASK DesiredAccess,BOOLEAN OpenAsSelf,PHANDLE TokenHandle )|Out
;ZwOpenThreadToken() has the same entry point as NtOpenThreadToken
!ntdll.dll|ZwOpenThreadToken(HANDLE ThreadHandle,ACCESS_MASK DesiredAccess,BOOLEAN OpenAsSelf,PHANDLE TokenHandle )|Out
ntdll.dll|NtOpenThreadTokenEx(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
;ZwOpenThreadTokenEx() has the same entry point as NtOpenThreadTokenEx
!ntdll.dll|ZwOpenThreadTokenEx(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|NtOpenTimer(PHANDLE TimerHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes )|FailureIfNotNullRet
;ZwOpenTimer() has the same entry point as NtOpenTimer
!ntdll.dll|ZwOpenTimer(PHANDLE TimerHandle,ACCESS_MASK DesiredAccess,POBJECT_ATTRIBUTES ObjectAttributes )|FailureIfNotNullRet
ntdll.dll|NtPlugPlayControl(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwPlugPlayControl() has the same entry point as NtPlugPlayControl
!ntdll.dll|ZwPlugPlayControl(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtPowerInformation(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwPowerInformation() has the same entry point as NtPowerInformation
!ntdll.dll|ZwPowerInformation(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtPrivilegeCheck(HANDLE TokenHandle,PPRIVILEGE_SETRequiredPrivileges,PBOOLEAN Result )|FailureIfNotNullRet
;ZwPrivilegeCheck() has the same entry point as NtPrivilegeCheck
!ntdll.dll|ZwPrivilegeCheck(HANDLE TokenHandle,PPRIVILEGE_SETRequiredPrivileges,PBOOLEAN Result )|FailureIfNotNullRet
ntdll.dll|NtPrivilegeObjectAuditAlarm(PUNICODE_STRING SubsystemName,HANDLE ObjectHandle,HANDLE ClientToken,ULONG DesiredAccess,PPRIVILEGE_SET ClientPrivileges,BOOLEAN AccessGranted)|FailureIfNotNullRet
;ZwPrivilegeObjectAuditAlarm() has the same entry point as NtPrivilegeObjectAuditAlarm
!ntdll.dll|ZwPrivilegeObjectAuditAlarm(PUNICODE_STRING SubsystemName,HANDLE ObjectHandle,HANDLE ClientToken,ULONG DesiredAccess,PPRIVILEGE_SET ClientPrivileges,BOOLEAN AccessGranted)|FailureIfNotNullRet
ntdll.dll|NtPrivilegedServiceAuditAlarm(PUNICODE_STRING SubsystemName ,PUNICODE_STRING ServiceName ,HANDLE ClientToken,PPRIVILEGE_SET ClientPrivileges,BOOLEAN AccessGranted)|FailureIfNotNullRet
;ZwPrivilegedServiceAuditAlarm() has the same entry point as NtPrivilegedServiceAuditAlarm
!ntdll.dll|ZwPrivilegedServiceAuditAlarm(PUNICODE_STRING SubsystemName ,PUNICODE_STRING ServiceName ,HANDLE ClientToken,PPRIVILEGE_SET ClientPrivileges,BOOLEAN AccessGranted)|FailureIfNotNullRet
; lots of call
!ntdll.dll|NtProtectVirtualMemory(HANDLE ProcessHandle,PVOID *BaseAddress,PULONG NumberOfBytesToProtect,ULONG NewAccessProtection,PULONG OldAccessProtection)|Out|FailureIfNotNullRet
;ZwProtectVirtualMemory() has the same entry point as NtProtectVirtualMemory
!ntdll.dll|ZwProtectVirtualMemory(HANDLE ProcessHandle,PVOID *BaseAddress,PULONG NumberOfBytesToProtect,ULONG NewAccessProtection,PULONG OldAccessProtection)|Out|FailureIfNotNullRet
ntdll.dll|NtPulseEvent(HANDLE EventHandle,PLONG PreviousState)|Out|FailureIfNotNullRet
;ZwPulseEvent() has the same entry point as NtPulseEvent
!ntdll.dll|ZwPulseEvent(HANDLE EventHandle,PLONG PreviousState)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryAttributesFile(POBJECT_ATTRIBUTES ObjectAttributes,PFILE_BASIC_INFORMATION FileAttributes )|Out|FailureIfNotNullRet
;ZwQueryAttributesFile() has the same entry point as NtQueryAttributesFile
!ntdll.dll|ZwQueryAttributesFile(POBJECT_ATTRIBUTES ObjectAttributes,PFILE_BASIC_INFORMATION FileAttributes )|Out|FailureIfNotNullRet
ntdll.dll|NtQueryBootEntryOrder(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwQueryBootEntryOrder() has the same entry point as NtQueryBootEntryOrder
!ntdll.dll|ZwQueryBootEntryOrder(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtQueryBootOptions(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwQueryBootOptions() has the same entry point as NtQueryBootOptions
!ntdll.dll|ZwQueryBootOptions(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtQueryDebugFilterState(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwQueryDebugFilterState() has the same entry point as NtQueryDebugFilterState
!ntdll.dll|ZwQueryDebugFilterState(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtQueryDefaultLocale(BOOLEAN UserProfile,PLCID DefaultLocaleId )|Out|FailureIfNotNullRet
;ZwQueryDefaultLocale() has the same entry point as NtQueryDefaultLocale
!ntdll.dll|ZwQueryDefaultLocale(BOOLEAN UserProfile,PLCID DefaultLocaleId )|Out|FailureIfNotNullRet
ntdll.dll|NtQueryDefaultUILanguage(UNKNOWN)|FailureIfNotNullRet
;ZwQueryDefaultUILanguage() has the same entry point as NtQueryDefaultUILanguage
!ntdll.dll|ZwQueryDefaultUILanguage(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtQueryDirectoryFile(HANDLE FileHandle,HANDLE Event ,PIO_APC_ROUTINE ApcRoutine ,PVOID ApcContext ,PIO_STATUS_BLOCK IoStatusBlock,PVOID FileInformation,ULONG Length,FILE_INFORMATION_CLASS FileInformationClass,BOOLEAN ReturnSingleEntry,PUNICODE_STRING FileMask ,BOOLEAN RestartScan )|Out|FailureIfNotNullRet
;ZwQueryDirectoryFile() has the same entry point as NtQueryDirectoryFile
!ntdll.dll|ZwQueryDirectoryFile(HANDLE FileHandle,HANDLE Event ,PIO_APC_ROUTINE ApcRoutine ,PVOID ApcContext ,PIO_STATUS_BLOCK IoStatusBlock,PVOID FileInformation,ULONG Length,FILE_INFORMATION_CLASS FileInformationClass,BOOLEAN ReturnSingleEntry,PUNICODE_STRING FileMask ,BOOLEAN RestartScan )|Out|FailureIfNotNullRet
ntdll.dll|NtQueryDirectoryObject(HANDLE DirectoryObjectHandle,POBJDIR_INFORMATION DirObjInformation,ULONG BufferLength,BOOLEAN GetNextIndex,BOOLEAN IgnoreInputIndex,PULONG ObjectIndex,PULONG DataWritten)|Out|FailureIfNotNullRet
;ZwQueryDirectoryObject() has the same entry point as NtQueryDirectoryObject
!ntdll.dll|ZwQueryDirectoryObject(HANDLE DirectoryObjectHandle,POBJDIR_INFORMATION DirObjInformation,ULONG BufferLength,BOOLEAN GetNextIndex,BOOLEAN IgnoreInputIndex,PULONG ObjectIndex,PULONG DataWritten)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryEaFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PVOID Buffer,ULONG Length,BOOLEAN ReturnSingleEntry,PVOID EaList,ULONG EaListLength,PULONG EaIndex,BOOLEAN RestartScan)|Out|FailureIfNotNullRet
;ZwQueryEaFile() has the same entry point as NtQueryEaFile
!ntdll.dll|ZwQueryEaFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PVOID Buffer,ULONG Length,BOOLEAN ReturnSingleEntry,PVOID EaList,ULONG EaListLength,PULONG EaIndex,BOOLEAN RestartScan)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryEvent(HANDLE EventHandle,EVENT_INFORMATION_CLASS EventInformationClass,PVOID EventInformation,ULONG EventInformationLength,PULONG ReturnLength)|Out|FailureIfNotNullRet
;ZwQueryEvent() has the same entry point as NtQueryEvent
!ntdll.dll|ZwQueryEvent(HANDLE EventHandle,EVENT_INFORMATION_CLASS EventInformationClass,PVOID EventInformation,ULONG EventInformationLength,PULONG ReturnLength)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryFullAttributesFile(POBJECT_ATTRIBUTES ObjectAttributes,PVOID Attributes )|Out|FailureIfNotNullRet
;ZwQueryFullAttributesFile() has the same entry point as NtQueryFullAttributesFile
!ntdll.dll|ZwQueryFullAttributesFile(POBJECT_ATTRIBUTES ObjectAttributes,PVOID Attributes )|Out|FailureIfNotNullRet
ntdll.dll|NtQueryInformationAtom(RTL_ATOM Atom,ATOM_INFORMATION_CLASS AtomInformationClass,PVOID AtomInformation,ULONG AtomInformationLength,PULONG ReturnLength)|Out|FailureIfNotNullRet
;ZwQueryInformationAtom() has the same entry point as NtQueryInformationAtom
!ntdll.dll|ZwQueryInformationAtom(RTL_ATOM Atom,ATOM_INFORMATION_CLASS AtomInformationClass,PVOID AtomInformation,ULONG AtomInformationLength,PULONG ReturnLength)|Out|FailureIfNotNullRet
; lots of call
!ntdll.dll|NtQueryInformationFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PVOID FileInformation,ULONG Length,FILE_INFORMATION_CLASS FileInformationClass)|Out|FailureIfNotNullRet
;ZwQueryInformationFile() has the same entry point as NtQueryInformationFile
!ntdll.dll|ZwQueryInformationFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PVOID FileInformation,ULONG Length,FILE_INFORMATION_CLASS FileInformationClass)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryInformationJobObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwQueryInformationJobObject() has the same entry point as NtQueryInformationJobObject
!ntdll.dll|ZwQueryInformationJobObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtQueryInformationPort(HANDLE PortHandle,PORT_INFORMATION_CLASS PortInformationClass,PVOID PortInformation,ULONG Length,PULONG ResultLength )|Out|FailureIfNotNullRet
;ZwQueryInformationPort() has the same entry point as NtQueryInformationPort
!ntdll.dll|ZwQueryInformationPort(HANDLE PortHandle,PORT_INFORMATION_CLASS PortInformationClass,PVOID PortInformation,ULONG Length,PULONG ResultLength )|Out|FailureIfNotNullRet
ntdll.dll|NTSTATUS NtQueryInformationProcess( HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength)|Out|FailureIfNotNullRet
;ZwQueryInformationProcess() has the same entry point as NtQueryInformationProcess
!ntdll.dll|NTSTATUS ZwQueryInformationProcess( HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength)|Out|FailureIfNotNullRet
;lots of call
!ntdll.dll|NTSTATUS NtQueryInformationThread( HANDLE ThreadHandle, THREADINFOCLASS ThreadInformationClass, PVOID ThreadInformation, ULONG ThreadInformationLength, PULONG ReturnLength)|Out|FailureIfNotNullRet
;ZwQueryInformationThread() has the same entry point as NtQueryInformationThread
!ntdll.dll|NTSTATUS ZwQueryInformationThread( HANDLE ThreadHandle, THREADINFOCLASS ThreadInformationClass, PVOID ThreadInformation, ULONG ThreadInformationLength, PULONG ReturnLength)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryInformationToken(HANDLE TokenHandle,TOKEN_INFORMATION_CLASS TokenInformationClass,PVOID TokenInformation,ULONG TokenInformationLength,PULONG ReturnLength )|Out|FailureIfNotNullRet
;ZwQueryInformationToken() has the same entry point as NtQueryInformationToken
!ntdll.dll|ZwQueryInformationToken(HANDLE TokenHandle,TOKEN_INFORMATION_CLASS TokenInformationClass,PVOID TokenInformation,ULONG TokenInformationLength,PULONG ReturnLength )|Out|FailureIfNotNullRet
ntdll.dll|NtQueryInstallUILanguage(UNKNOWN)|FailureIfNotNullRet
;ZwQueryInstallUILanguage() has the same entry point as NtQueryInstallUILanguage
!ntdll.dll|ZwQueryInstallUILanguage(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtQueryIntervalProfile(KPROFILE_SOURCE ProfileSource,PULONG Interval )|Out|FailureIfNotNullRet
;ZwQueryIntervalProfile() has the same entry point as NtQueryIntervalProfile
!ntdll.dll|ZwQueryIntervalProfile(KPROFILE_SOURCE ProfileSource,PULONG Interval )|Out|FailureIfNotNullRet
ntdll.dll|NtQueryIoCompletion(HANDLE IoCompletionHandle,IO_COMPLETION_INFORMATION_CLASS InformationClass,PVOID IoCompletionInformation,ULONG InformationBufferLength,PULONG RequiredLength)|Out|FailureIfNotNullRet
;ZwQueryIoCompletion() has the same entry point as NtQueryIoCompletion
!ntdll.dll|ZwQueryIoCompletion(HANDLE IoCompletionHandle,IO_COMPLETION_INFORMATION_CLASS InformationClass,PVOID IoCompletionInformation,ULONG InformationBufferLength,PULONG RequiredLength)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryKey(HANDLE KeyHandle,KEY_INFORMATION_CLASS KeyInformationClass,PVOID KeyInformation,ULONG Length,PULONG ResultLength)|Out|FailureIfNotNullRet
;ZwQueryKey() has the same entry point as NtQueryKey
!ntdll.dll|ZwQueryKey(HANDLE KeyHandle,KEY_INFORMATION_CLASS KeyInformationClass,PVOID KeyInformation,ULONG Length,PULONG ResultLength)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryMultipleValueKey(HANDLE KeyHandle,PKEY_MULTIPLE_VALUE_INFORMATION ValuesList,ULONG NumberOfValues,PVOID DataBuffer,ULONG BufferLength,PULONG RequiredLength)|Out|FailureIfNotNullRet
;ZwQueryMultipleValueKey() has the same entry point as NtQueryMultipleValueKey
!ntdll.dll|ZwQueryMultipleValueKey(HANDLE KeyHandle,PKEY_MULTIPLE_VALUE_INFORMATION ValuesList,ULONG NumberOfValues,PVOID DataBuffer,ULONG BufferLength,PULONG RequiredLength)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryMutant(HANDLE MutantHandle,MUTANT_INFORMATION_CLASS MutantInformationClass,PVOID MutantInformation,ULONG MutantInformationLength,PULONG ResultLength)|Out|FailureIfNotNullRet
;ZwQueryMutant() has the same entry point as NtQueryMutant
!ntdll.dll|ZwQueryMutant(HANDLE MutantHandle,MUTANT_INFORMATION_CLASS MutantInformationClass,PVOID MutantInformation,ULONG MutantInformationLength,PULONG ResultLength)|Out|FailureIfNotNullRet
ntdll.dll|NTSTATUS NtQueryObject( HANDLE Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass, PVOID ObjectInformation, ULONG ObjectInformationLength, PULONG ReturnLength)|Out|FailureIfNotNullRet
;ZwQueryObject() has the same entry point as NtQueryObject
!ntdll.dll|NTSTATUS ZwQueryObject( HANDLE Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass, PVOID ObjectInformation, ULONG ObjectInformationLength, PULONG ReturnLength)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryOpenSubKeys(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwQueryOpenSubKeys() has the same entry point as NtQueryOpenSubKeys
!ntdll.dll|ZwQueryOpenSubKeys(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
; lots of call
!ntdll.dll|NTSTATUS NtQueryPerformanceCounter( PLARGE_INTEGER PerformanceCounter, PLARGE_INTEGER PerformanceFrequency)|Out|FailureIfNotNullRet
;ZwQueryPerformanceCounter() has the same entry point as NtQueryPerformanceCounter
!ntdll.dll|NTSTATUS ZwQueryPerformanceCounter( PLARGE_INTEGER PerformanceCounter, PLARGE_INTEGER PerformanceFrequency)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryPortInformationProcess()|FailureIfNotNullRet
;ZwQueryPortInformationProcess() has the same entry point as NtQueryPortInformationProcess
!ntdll.dll|ZwQueryPortInformationProcess()|FailureIfNotNullRet
ntdll.dll|NtQueryQuotaInformationFile(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwQueryQuotaInformationFile() has the same entry point as NtQueryQuotaInformationFile
!ntdll.dll|ZwQueryQuotaInformationFile(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtQuerySection(HANDLE SectionHandle,SECTION_INFORMATION_CLASS InformationClass,PVOID InformationBuffer,ULONG InformationBufferSize,PULONG ResultLength )|Out|FailureIfNotNullRet
;ZwQuerySection() has the same entry point as NtQuerySection
!ntdll.dll|ZwQuerySection(HANDLE SectionHandle,SECTION_INFORMATION_CLASS InformationClass,PVOID InformationBuffer,ULONG InformationBufferSize,PULONG ResultLength )|Out|FailureIfNotNullRet
ntdll.dll|NtQuerySecurityObject(HANDLE ObjectHandle,SECURITY_INFORMATION SecurityInformationClass,PSECURITY_DESCRIPTOR DescriptorBuffer,ULONG DescriptorBufferLength,PULONG RequiredLength )|Out|FailureIfNotNullRet
;ZwQuerySecurityObject() has the same entry point as NtQuerySecurityObject
!ntdll.dll|ZwQuerySecurityObject(HANDLE ObjectHandle,SECURITY_INFORMATION SecurityInformationClass,PSECURITY_DESCRIPTOR DescriptorBuffer,ULONG DescriptorBufferLength,PULONG RequiredLength )|Out|FailureIfNotNullRet
ntdll.dll|NtQuerySemaphore(HANDLE SemaphoreHandle,SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,PVOID SemaphoreInformation,ULONG SemaphoreInformationLength,PULONG ReturnLength )|Out|FailureIfNotNullRet
;ZwQuerySemaphore() has the same entry point as NtQuerySemaphore
!ntdll.dll|ZwQuerySemaphore(HANDLE SemaphoreHandle,SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass,PVOID SemaphoreInformation,ULONG SemaphoreInformationLength,PULONG ReturnLength )|Out|FailureIfNotNullRet
ntdll.dll|NtQuerySymbolicLinkObject(HANDLE SymbolicLinkHandle,PUNICODE_STRING pLinkName,PULONG pDataWritten )|Out|FailureIfNotNullRet
;ZwQuerySymbolicLinkObject() has the same entry point as NtQuerySymbolicLinkObject
!ntdll.dll|ZwQuerySymbolicLinkObject(HANDLE SymbolicLinkHandle,PUNICODE_STRING pLinkName,PULONG pDataWritten )|Out|FailureIfNotNullRet
ntdll.dll|NtQuerySystemEnvironmentValue(PUNICODE_STRING VariableName,PWCHAR Value,ULONG ValueBufferLength,PULONG RequiredLength )|Out|FailureIfNotNullRet
;ZwQuerySystemEnvironmentValue() has the same entry point as NtQuerySystemEnvironmentValue
!ntdll.dll|ZwQuerySystemEnvironmentValue(PUNICODE_STRING VariableName,PWCHAR Value,ULONG ValueBufferLength,PULONG RequiredLength )|Out|FailureIfNotNullRet
ntdll.dll|NtQuerySystemEnvironmentValueEx(PUNICODE_STRING VariableName,PWCHAR Value,ULONG ValueBufferLength,PULONG RequiredLength ,UNKNOWN)|Out|FailureIfNotNullRet
;ZwQuerySystemEnvironmentValueEx() has the same entry point as NtQuerySystemEnvironmentValueEx
!ntdll.dll|ZwQuerySystemEnvironmentValueEx(PUNICODE_STRING VariableName,PWCHAR Value,ULONG ValueBufferLength,PULONG RequiredLength ,UNKNOWN)|Out|FailureIfNotNullRet
ntdll.dll|NTSTATUS NtQuerySystemInformation( SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)|Out|FailureIfNotNullRet
;ZwQuerySystemInformation() has the same entry point as NtQuerySystemInformation
!ntdll.dll|NTSTATUS ZwQuerySystemInformation( SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)|Out|FailureIfNotNullRet
ntdll.dll|NTSTATUS NtQuerySystemTime( PLARGE_INTEGER SystemTime)|Out|FailureIfNotNullRet
;ZwQuerySystemTime() has the same entry point as NtQuerySystemTime
!ntdll.dll|NTSTATUS ZwQuerySystemTime( PLARGE_INTEGER SystemTime)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryTimer(HANDLE TimerHandle,TIMER_INFORMATION_CLASS TimerInformationClass,PVOID TimerInformation,ULONG TimerInformationLength,PULONG ReturnLength )|Out|FailureIfNotNullRet
;ZwQueryTimer() has the same entry point as NtQueryTimer
!ntdll.dll|ZwQueryTimer(HANDLE TimerHandle,TIMER_INFORMATION_CLASS TimerInformationClass,PVOID TimerInformation,ULONG TimerInformationLength,PULONG ReturnLength )|Out|FailureIfNotNullRet
ntdll.dll|NtQueryTimerResolution(PULONG MinimumResolution,PULONG MaximumResolution,PULONG CurrentResolution)|Out|FailureIfNotNullRet
;ZwQueryTimerResolution() has the same entry point as NtQueryTimerResolution)
!ntdll.dll|ZwQueryTimerResolution(PULONG MinimumResolution,PULONG MaximumResolution,PULONG CurrentResolution)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryValueKey(HANDLE KeyHandle,PUNICODE_STRING ValueName,KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,PVOID KeyValueInformation,ULONG Length,PULONG ResultLength)|Out|FailureIfNotNullRet
;ZwQueryValueKey() has the same entry point as NtQueryValueKey
!ntdll.dll|ZwQueryValueKey(HANDLE KeyHandle,PUNICODE_STRING ValueName,KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass,PVOID KeyValueInformation,ULONG Length,PULONG ResultLength)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryVirtualMemory(HANDLE ProcessHandle,PVOID BaseAddress,MEMORY_INFORMATION_CLASS MemoryInformationClass,PVOID Buffer,ULONG Length,PULONG ResultLength)|Out|FailureIfNotNullRet
;ZwQueryVirtualMemory() has the same entry point as NtQueryVirtualMemory
!ntdll.dll|ZwQueryVirtualMemory(HANDLE ProcessHandle,PVOID BaseAddress,MEMORY_INFORMATION_CLASS MemoryInformationClass,PVOID Buffer,ULONG Length,PULONG ResultLength)|Out|FailureIfNotNullRet
ntdll.dll|NtQueryVolumeInformationFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PVOID FileSystemInformation,ULONG Length,FS_INFORMATION_CLASS FileSystemInformationClass)|Out|FailureIfNotNullRet
;ZwQueryVolumeInformationFile() has the same entry point as NtQueryVolumeInformationFile
!ntdll.dll|ZwQueryVolumeInformationFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PVOID FileSystemInformation,ULONG Length,FS_INFORMATION_CLASS FileSystemInformationClass)|Out|FailureIfNotNullRet
ntdll.dll|NtQueueApcThread(HANDLE ThreadHandle,PIO_APC_ROUTINE ApcRoutine,PVOID ApcRoutineContext ,PIO_STATUS_BLOCK ApcStatusBlock,ULONG ApcReserved)|FailureIfNotNullRet
;ZwQueueApcThread() has the same entry point as NtQueueApcThread
!ntdll.dll|ZwQueueApcThread(HANDLE ThreadHandle,PIO_APC_ROUTINE ApcRoutine,PVOID ApcRoutineContext ,PIO_STATUS_BLOCK ApcStatusBlock,ULONG ApcReserved)|FailureIfNotNullRet
!ntdll.dll|NtRaiseException(PEXCEPTION_RECORD ExceptionRecord,PCONTEXT ThreadContext,BOOLEAN HandleException)|FailureIfNotNullRet
;ZwRaiseException() has the same entry point as NtRaiseException
!ntdll.dll|ZwRaiseException(PEXCEPTION_RECORD ExceptionRecord,PCONTEXT ThreadContext,BOOLEAN HandleException)|FailureIfNotNullRet
ntdll.dll|NtRaiseHardError(NTSTATUS ErrorStatus,ULONG NumberOfParameters,PUNICODE_STRING UnicodeStringParameterMask ,PVOID *Parameters,HARDERROR_RESPONSE_OPTION ResponseOption,PHARDERROR_RESPONSE Response )|Out|FailureIfNotNullRet
;ZwRaiseHardError() has the same entry point as NtRaiseHardError
!ntdll.dll|ZwRaiseHardError(NTSTATUS ErrorStatus,ULONG NumberOfParameters,PUNICODE_STRING UnicodeStringParameterMask ,PVOID *Parameters,HARDERROR_RESPONSE_OPTION ResponseOption,PHARDERROR_RESPONSE Response )|Out|FailureIfNotNullRet
;lots of call
!ntdll.dll|NtReadFile( HANDLE FileHandle,HANDLE Event,PIO_APC_ROUTINE ApcRoutine,PVOID ApcContext,PIO_STATUS_BLOCK IoStatusBlock,PVOID Buffer:PointedDataSize=Arg7,ULONG Length,PLARGE_INTEGER ByteOffset,PULONG Key )|Out|FailureIfNotNullRet
;ZwReadFile() has the same entry point as NtReadFile
!ntdll.dll|ZwReadFile( HANDLE FileHandle,HANDLE Event,PIO_APC_ROUTINE ApcRoutine,PVOID ApcContext,PIO_STATUS_BLOCK IoStatusBlock,PVOID Buffer:PointedDataSize=Arg7,ULONG Length,PLARGE_INTEGER ByteOffset,PULONG Key )|Out|FailureIfNotNullRet
ntdll.dll|NtReadFileScatter(HANDLE FileHandle,HANDLE Event,PIO_APC_ROUTINE ApcRoutine,PVOID ApcContext ,PIO_STATUS_BLOCK IoStatusBlock,FILE_SEGMENT_ELEMENT SegmentArray,ULONG Length,PLARGE_INTEGER ByteOffset,PULONG Key)|Out|FailureIfNotNullRet
;ZwReadFileScatter() has the same entry point as NtReadFileScatter
!ntdll.dll|ZwReadFileScatter(HANDLE FileHandle,HANDLE Event,PIO_APC_ROUTINE ApcRoutine,PVOID ApcContext ,PIO_STATUS_BLOCK IoStatusBlock,FILE_SEGMENT_ELEMENT SegmentArray,ULONG Length,PLARGE_INTEGER ByteOffset,PULONG Key)|Out|FailureIfNotNullRet
ntdll.dll|NtReadRequestData(HANDLE PortHandle,PLPC_MESSAGE Request,ULONG DataIndex,PVOID Buffer,ULONG Length,PULONG ResultLength )|Out|FailureIfNotNullRet
;ZwReadRequestData() has the same entry point as NtReadRequestData
!ntdll.dll|ZwReadRequestData(HANDLE PortHandle,PLPC_MESSAGE Request,ULONG DataIndex,PVOID Buffer,ULONG Length,PULONG ResultLength )|Out|FailureIfNotNullRet
ntdll.dll|NtReadVirtualMemory(HANDLE ProcessHandle,PVOID BaseAddress,PVOID Buffer:PointedDataSize=Arg5,ULONG NumberOfBytesToRead,PULONG NumberOfBytesReaded)|Out|FailureIfNotNullRet
;ZwReadVirtualMemory() has the same entry point as NtReadVirtualMemory
!ntdll.dll|ZwReadVirtualMemory(HANDLE ProcessHandle,PVOID BaseAddress,PVOID Buffer:PointedDataSize=Arg5,ULONG NumberOfBytesToRead,PULONG NumberOfBytesReaded)|Out|FailureIfNotNullRet
ntdll.dll|NtRegisterThreadTerminatePort(HANDLE PortHandle)|FailureIfNotNullRet
;ZwRegisterThreadTerminatePort() has the same entry point as NtRegisterThreadTerminatePort
!ntdll.dll|ZwRegisterThreadTerminatePort(HANDLE PortHandle)|FailureIfNotNullRet
ntdll.dll|NtReleaseKeyedEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwReleaseKeyedEvent() has the same entry point as NtReleaseKeyedEvent
!ntdll.dll|ZwReleaseKeyedEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtReleaseMutant(HANDLE MutantHandle,PLONG PreviousCount)|Out|FailureIfNotNullRet
;ZwReleaseMutant() has the same entry point as NtReleaseMutant
!ntdll.dll|ZwReleaseMutant(HANDLE MutantHandle,PLONG PreviousCount)|Out|FailureIfNotNullRet
ntdll.dll|NtReleaseSemaphore(HANDLE SemaphoreHandle,ULONG ReleaseCount,PULONG PreviousCount )|Out|FailureIfNotNullRet
;ZwReleaseSemaphore() has the same entry point as NtReleaseSemaphore
!ntdll.dll|ZwReleaseSemaphore(HANDLE SemaphoreHandle,ULONG ReleaseCount,PULONG PreviousCount )|Out|FailureIfNotNullRet
!ntdll.dll|NtRemoveIoCompletion(HANDLE IoCompletionHandle,PULONG CompletionKey,PIO_STATUS_BLOCK IoStatusBlock,PULONG OperationStatus,PLARGE_INTEGER WaitTime)|Out|FailureIfNotNullRet
;ZwRemoveIoCompletion() has the same entry point as NtRemoveIoCompletion
!ntdll.dll|ZwRemoveIoCompletion(HANDLE IoCompletionHandle,PULONG CompletionKey,PIO_STATUS_BLOCK IoStatusBlock,PULONG OperationStatus,PLARGE_INTEGER WaitTime)|Out|FailureIfNotNullRet
ntdll.dll|NtRemoveProcessDebug(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwRemoveProcessDebug() has the same entry point as NtRemoveProcessDebug
!ntdll.dll|ZwRemoveProcessDebug(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtRenameKey(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwRenameKey() has the same entry point as NtRenameKey
!ntdll.dll|ZwRenameKey(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtReplaceKey(POBJECT_ATTRIBUTES NewHiveFileName,HANDLE KeyHandle,POBJECT_ATTRIBUTES BackupHiveFileName)|FailureIfNotNullRet
;ZwReplaceKey() has the same entry point as NtReplaceKey
!ntdll.dll|ZwReplaceKey(POBJECT_ATTRIBUTES NewHiveFileName,HANDLE KeyHandle,POBJECT_ATTRIBUTES BackupHiveFileName)|FailureIfNotNullRet
ntdll.dll|NtReplyPort(HANDLE PortHandle,PLPC_MESSAGE Reply)|FailureIfNotNullRet
;ZwReplyPort() has the same entry point as NtReplyPort
!ntdll.dll|ZwReplyPort(HANDLE PortHandle,PLPC_MESSAGE Reply)|FailureIfNotNullRet
!ntdll.dll|NtReplyWaitReceivePort(HANDLE PortHandle,PHANDLE ReceivePortHandle,PLPC_MESSAGE Reply,PLPC_MESSAGE IncomingRequest)|Out|FailureIfNotNullRet
;ZwReplyWaitReceivePort() has the same entry point as NtReplyWaitReceivePort
!ntdll.dll|ZwReplyWaitReceivePort(HANDLE PortHandle,PHANDLE ReceivePortHandle,PLPC_MESSAGE Reply,PLPC_MESSAGE IncomingRequest)|Out|FailureIfNotNullRet
!ntdll.dll|NtReplyWaitReceivePortEx(HANDLE PortHandle,PHANDLE ReceivePortHandle,PLPC_MESSAGE Reply,PLPC_MESSAGE IncomingRequest,UNKNOWN)|Out
;ZwReplyWaitReceivePortEx() has the same entry point as NtReplyWaitReceivePortEx
!ntdll.dll|ZwReplyWaitReceivePortEx(HANDLE PortHandle,PHANDLE ReceivePortHandle,PLPC_MESSAGE Reply,PLPC_MESSAGE IncomingRequest,UNKNOWN)|Out|FailureIfNotNullRet
!ntdll.dll|NtReplyWaitReplyPort(HANDLE PortHandle,PLPC_MESSAGE Request)|Out|FailureIfNotNullRet
;ZwReplyWaitReplyPort() has the same entry point as NtReplyWaitReplyPort
!ntdll.dll|ZwReplyWaitReplyPort(HANDLE PortHandle,PLPC_MESSAGE Request)|Out|FailureIfNotNullRet
ntdll.dll|NtRequestDeviceWakeup(UNKNOWN)|FailureIfNotNullRet
;ZwRequestDeviceWakeup() has the same entry point as NtRequestDeviceWakeup
!ntdll.dll|ZwRequestDeviceWakeup(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtRequestPort(HANDLE PortHandle,PLPC_MESSAGE Request)|FailureIfNotNullRet
;ZwRequestPort() has the same entry point as NtRequestPort
!ntdll.dll|ZwRequestPort(HANDLE PortHandle,PLPC_MESSAGE Request)|FailureIfNotNullRet
ntdll.dll|NtRequestWaitReplyPort(HANDLE PortHandle,PLPC_MESSAGE  Request,PLPC_MESSAGE IncomingReply )|Out|FailureIfNotNullRet
;ZwRequestWaitReplyPort() has the same entry point as NtRequestWaitReplyPort
!ntdll.dll|ZwRequestWaitReplyPort(HANDLE PortHandle,PLPC_MESSAGE  Request,PLPC_MESSAGE IncomingReply )|Out|FailureIfNotNullRet
ntdll.dll|NtRequestWakeupLatency(UNKNOWN)|FailureIfNotNullRet
;ZwRequestWakeupLatency() has the same entry point as NtRequestWakeupLatency
!ntdll.dll|ZwRequestWakeupLatency(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtResetEvent(HANDLE EventHandle,PLONG PreviousState )|Out|FailureIfNotNullRet
;ZwResetEvent() has the same entry point as NtResetEvent
!ntdll.dll|ZwResetEvent(HANDLE EventHandle,PLONG PreviousState )|Out|FailureIfNotNullRet
ntdll.dll|NtResetWriteWatch(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwResetWriteWatch() has the same entry point as NtResetWriteWatch
!ntdll.dll|ZwResetWriteWatch(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtRestoreKey(HANDLE KeyHandle,HANDLE FileHandle,ULONG  RestoreOption)|FailureIfNotNullRet
;ZwRestoreKey() has the same entry point as NtRestoreKey
!ntdll.dll|ZwRestoreKey(HANDLE KeyHandle,HANDLE FileHandle,ULONG  RestoreOption)|FailureIfNotNullRet
ntdll.dll|NtResumeProcess(HANDLE ProcessHandle)|FailureIfNotNullRet
;ZwResumeProcess() has the same entry point as NtResumeProcess
!ntdll.dll|ZwResumeProcess(HANDLE ProcessHandle)|FailureIfNotNullRet
ntdll.dll|NtResumeThread(HANDLE ThreadHandle,PULONG SuspendCount)|Out|FailureIfNotNullRet
;ZwResumeThread() has the same entry point as NtResumeThread
!ntdll.dll|ZwResumeThread(HANDLE ThreadHandle,PULONG SuspendCount)|Out|FailureIfNotNullRet
ntdll.dll|NtSaveKey(HANDLE KeyHandle,HANDLE FileHandle)|FailureIfNotNullRet
;ZwSaveKey() has the same entry point as NtSaveKey
!ntdll.dll|ZwSaveKey(HANDLE KeyHandle,HANDLE FileHandle)|FailureIfNotNullRet
ntdll.dll|NtSaveKeyEx(HANDLE KeyHandle,HANDLE FileHandle,UNKNOWN)|FailureIfNotNullRet
;ZwSaveKeyEx() has the same entry point as NtSaveKeyEx
!ntdll.dll|ZwSaveKeyEx(HANDLE KeyHandle,HANDLE FileHandle,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSaveMergedKeys(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwSaveMergedKeys() has the same entry point as NtSaveMergedKeys
!ntdll.dll|ZwSaveMergedKeys(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSecureConnectPort(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwSecureConnectPort() has the same entry point as NtSecureConnectPort
!ntdll.dll|ZwSecureConnectPort(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSetBootEntryOrder(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwSetBootEntryOrder() has the same entry point as NtSetBootEntryOrder
!ntdll.dll|ZwSetBootEntryOrder(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSetBootOptions(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwSetBootOptions() has the same entry point as NtSetBootOptions
!ntdll.dll|ZwSetBootOptions(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSetContextThread(HANDLE ThreadHandle,PCONTEXT Context)|FailureIfNotNullRet
;ZwSetContextThread() has the same entry point as NtSetContextThread
!ntdll.dll|ZwSetContextThread(HANDLE ThreadHandle,PCONTEXT Context)|FailureIfNotNullRet
ntdll.dll|NtSetDebugFilterState(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwSetDebugFilterState() has the same entry point as NtSetDebugFilterState
!ntdll.dll|ZwSetDebugFilterState(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSetDefaultHardErrorPort(HANDLE PortHandle)|FailureIfNotNullRet
;ZwSetDefaultHardErrorPort() has the same entry point as NtSetDefaultHardErrorPort
!ntdll.dll|ZwSetDefaultHardErrorPort(HANDLE PortHandle)|FailureIfNotNullRet
ntdll.dll|NtSetDefaultLocale(BOOLEAN UserProfile,LCID DefaultLocaleId)|FailureIfNotNullRet
;ZwSetDefaultLocale() has the same entry point as NtSetDefaultLocale
!ntdll.dll|ZwSetDefaultLocale(BOOLEAN UserProfile,LCID DefaultLocaleId)|FailureIfNotNullRet
ntdll.dll|NtSetDefaultUILanguage(UNKNOWN)|FailureIfNotNullRet
;ZwSetDefaultUILanguage() has the same entry point as NtSetDefaultUILanguage
!ntdll.dll|ZwSetDefaultUILanguage(UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSetEaFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PVOID EaBuffer,ULONG EaBufferSize)|Out|FailureIfNotNullRet
;ZwSetEaFile() has the same entry point as NtSetEaFile
!ntdll.dll|ZwSetEaFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PVOID EaBuffer,ULONG EaBufferSize)|Out|FailureIfNotNullRet
;lots of call
!ntdll.dll|NtSetEvent(HANDLE EventHandle,PLONG PreviousState )|Out|FailureIfNotNullRet
;ZwSetEvent() has the same entry point as NtSetEvent
!ntdll.dll|ZwSetEvent(HANDLE EventHandle,PLONG PreviousState )|Out|FailureIfNotNullRet
ntdll.dll|NtSetEventBoostPriority(HANDLE EventHandle)|FailureIfNotNullRet
;ZwSetEventBoostPriority() has the same entry point as NtSetEventBoostPriority
!ntdll.dll|ZwSetEventBoostPriority(HANDLE EventHandle)|FailureIfNotNullRet
ntdll.dll|NtSetHighEventPair(HANDLE EventPairHandle)|FailureIfNotNullRet
;ZwSetHighEventPair() has the same entry point as NtSetHighEventPair
!ntdll.dll|ZwSetHighEventPair(HANDLE EventPairHandle)|FailureIfNotNullRet
ntdll.dll|NtSetHighWaitLowEventPair(HANDLE EventPairHandle)|FailureIfNotNullRet
;ZwSetHighWaitLowEventPair() has the same entry point as NtSetHighWaitLowEventPair
!ntdll.dll|ZwSetHighWaitLowEventPair(HANDLE EventPairHandle)|FailureIfNotNullRet
ntdll.dll|NtSetInformationDebugObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwSetInformationDebugObject() has the same entry point as NtSetInformationDebugObject
!ntdll.dll|ZwSetInformationDebugObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSetInformationFile( HANDLE FileHandle, PIO_STATUS_BLOCK    IoStatusBlock, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass)|Out|FailureIfNotNullRet
;ZwSetInformationFile() has the same entry point as NtSetInformationFile
!ntdll.dll|ZwSetInformationFile( HANDLE FileHandle, PIO_STATUS_BLOCK    IoStatusBlock, PVOID FileInformation, ULONG Length, FILE_INFORMATION_CLASS FileInformationClass)|Out|FailureIfNotNullRet
ntdll.dll|NtSetInformationJobObject(HANDLE JobHandle,JOB_INFORMATION_CLASS JobInformationClass,PVOID JobInformation,ULONG Length)|FailureIfNotNullRet
;ZwSetInformationJobObject() has the same entry point as NtSetInformationJobObject
!ntdll.dll|ZwSetInformationJobObject(HANDLE JobHandle,JOB_INFORMATION_CLASS JobInformationClass,PVOID JobInformation,ULONG Length)|FailureIfNotNullRet
ntdll.dll|NtSetInformationKey(HANDLE KeyHandle,KEY_SET_INFORMATION_CLASS InformationClass,PVOID KeyInformationData,ULONG DataLength)|FailureIfNotNullRet
;ZwSetInformationKey() has the same entry point as NtSetInformationKey
!ntdll.dll|ZwSetInformationKey(HANDLE KeyHandle,KEY_SET_INFORMATION_CLASS InformationClass,PVOID KeyInformationData,ULONG DataLength)|FailureIfNotNullRet
ntdll.dll|NtSetInformationObject(HANDLE ObjectHandle,OBJECT_INFORMATION_CLASS ObjectInformationClass,PVOID ObjectInformation,ULONG Length )|FailureIfNotNullRet
;ZwSetInformationObject() has the same entry point as NtSetInformationObject
!ntdll.dll|ZwSetInformationObject(HANDLE ObjectHandle,OBJECT_INFORMATION_CLASS ObjectInformationClass,PVOID ObjectInformation,ULONG Length )|FailureIfNotNullRet
ntdll.dll|NtSetInformationProcess(HANDLE ProcessHandle,PROCESS_INFORMATION_CLASS ProcessInformationClass,PVOID ProcessInformation,ULONG ProcessInformationLength)|FailureIfNotNullRet
;ZwSetInformationProcess() has the same entry point as NtSetInformationProcess
!ntdll.dll|ZwSetInformationProcess(HANDLE ProcessHandle,PROCESS_INFORMATION_CLASS ProcessInformationClass,PVOID ProcessInformation,ULONG ProcessInformationLength)|FailureIfNotNullRet
;lots of call
!ntdll.dll|NtSetInformationThread(HANDLE ThreadHandle,THREAD_INFORMATION_CLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength)|FailureIfNotNullRet
;ZwSetInformationThread() has the same entry point as NtSetInformationThread
!ntdll.dll|ZwSetInformationThread(HANDLE ThreadHandle,THREAD_INFORMATION_CLASS ThreadInformationClass,PVOID ThreadInformation,ULONG ThreadInformationLength)|FailureIfNotNullRet
ntdll.dll|NtSetInformationToken(HANDLE TokenHandle,TOKEN_INFORMATION_CLASS TokenInformationClass,PVOID TokenInformation,ULONG TokenInformationLength )|Out|FailureIfNotNullRet
;ZwSetInformationToken() has the same entry point as NtSetInformationToken
!ntdll.dll|ZwSetInformationToken(HANDLE TokenHandle,TOKEN_INFORMATION_CLASS TokenInformationClass,PVOID TokenInformation,ULONG TokenInformationLength )|Out|FailureIfNotNullRet
ntdll.dll|NtSetIntervalProfile(ULONG Interval,KPROFILE_SOURCE Source)|FailureIfNotNullRet
;ZwSetIntervalProfile() has the same entry point as NtSetIntervalProfile
!ntdll.dll|ZwSetIntervalProfile(ULONG Interval,KPROFILE_SOURCE Source)|FailureIfNotNullRet
ntdll.dll|NtSetIoCompletion(HANDLE IoCompletionHandle,ULONG CompletionKey,PIO_STATUS_BLOCK IoStatusBlock,NTSTATUS CompletionStatus,ULONG  NumberOfBytesTransfered)|Out|FailureIfNotNullRet
;ZwSetIoCompletion() has the same entry point as NtSetIoCompletion
!ntdll.dll|ZwSetIoCompletion(HANDLE IoCompletionHandle,ULONG CompletionKey,PIO_STATUS_BLOCK IoStatusBlock,NTSTATUS CompletionStatus,ULONG  NumberOfBytesTransfered)|Out|FailureIfNotNullRet
ntdll.dll|NtSetLdtEntries(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwSetLdtEntries() has the same entry point as NtSetLdtEntries
!ntdll.dll|ZwSetLdtEntries(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSetLowEventPair(HANDLE EventPairHandle)|FailureIfNotNullRet
;ZwSetLowEventPair() has the same entry point as NtSetLowEventPair
!ntdll.dll|ZwSetLowEventPair(HANDLE EventPairHandle)|FailureIfNotNullRet
ntdll.dll|NtSetLowWaitHighEventPair(HANDLE EventPairHandle )|FailureIfNotNullRet
;ZwSetLowWaitHighEventPair() has the same entry point as NtSetLowWaitHighEventPair
!ntdll.dll|ZwSetLowWaitHighEventPair(HANDLE EventPairHandle)|FailureIfNotNullRet
ntdll.dll|NtSetQuotaInformationFile(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwSetQuotaInformationFile() has the same entry point as NtSetQuotaInformationFile
!ntdll.dll|ZwSetQuotaInformationFile(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSetSecurityObject(HANDLE ObjectHandle,SECURITY_INFORMATION SecurityInformationClass,PSECURITY_DESCRIPTOR DescriptorBuffer)|FailureIfNotNullRet
;ZwSetSecurityObject() has the same entry point as NtSetSecurityObject
!ntdll.dll|ZwSetSecurityObject(HANDLE ObjectHandle,SECURITY_INFORMATION SecurityInformationClass,PSECURITY_DESCRIPTOR DescriptorBuffer)|FailureIfNotNullRet
ntdll.dll|NtSetSystemEnvironmentValue(PUNICODE_STRING  VariableName,PUNICODE_STRING Value)|FailureIfNotNullRet
;ZwSetSystemEnvironmentValue() has the same entry point as NtSetSystemEnvironmentValue
!ntdll.dll|ZwSetSystemEnvironmentValue(PUNICODE_STRING  VariableName,PUNICODE_STRING Value)|FailureIfNotNullRet
ntdll.dll|NtSetSystemEnvironmentValueEx(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwSetSystemEnvironmentValueEx() has the same entry point as NtSetSystemEnvironmentValueEx
!ntdll.dll|ZwSetSystemEnvironmentValueEx(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSetSystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength)|FailureIfNotNullRet
;ZwSetSystemInformation() has the same entry point as NtSetSystemInformation
!ntdll.dll|ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,PVOID SystemInformation,ULONG SystemInformationLength)|FailureIfNotNullRet
ntdll.dll|NtSetSystemPowerState(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwSetSystemPowerState() has the same entry point as NtSetSystemPowerState
!ntdll.dll|ZwSetSystemPowerState(UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtSetSystemTime(PLARGE_INTEGER SystemTime,PLARGE_INTEGER PreviousTime )|FailureIfNotNullRet
;ZwSetSystemTime() has the same entry point as NtSetSystemTime
!ntdll.dll|ZwSetSystemTime(PLARGE_INTEGER SystemTime,PLARGE_INTEGER PreviousTime )|Out|FailureIfNotNullRet
ntdll.dll|NtSetThreadExecutionState(HANDLE ThreadHandle,UNKNOWN State)|FailureIfNotNullRet
;ZwSetThreadExecutionState() has the same entry point as NtSetThreadExecutionState
!ntdll.dll|ZwSetThreadExecutionState(HANDLE ThreadHandle,UNKNOWN State)|FailureIfNotNullRet
ntdll.dll|NtSetTimer(HANDLE TimerHandle,PLARGE_INTEGER DueTime,PTIMER_APC_ROUTINE TimerApcRoutine ,PVOID TimerContext,BOOLEAN ResumeTimer,LONG Period,PBOOLEAN PreviousState )|Out|FailureIfNotNullRet
;ZwSetTimer() has the same entry point as NtSetTimer
!ntdll.dll|ZwSetTimer(HANDLE TimerHandle,PLARGE_INTEGER DueTime,PTIMER_APC_ROUTINE TimerApcRoutine ,PVOID TimerContext,BOOLEAN ResumeTimer,LONG Period,PBOOLEAN PreviousState )|Out|FailureIfNotNullRet
ntdll.dll|NtSetTimerResolution(ULONG DesiredResolution,BOOLEAN SetResolution,PULONG CurrentResolution)|Out|FailureIfNotNullRet
;ZwSetTimerResolution() has the same entry point as NtSetTimerResolution
!ntdll.dll|ZwSetTimerResolution(ULONG DesiredResolution,BOOLEAN SetResolution,PULONG CurrentResolution)|Out|FailureIfNotNullRet
ntdll.dll|NtSetUuidSeed(PGUID)|FailureIfNotNullRet
;ZwSetUuidSeed() has the same entry point as NtSetUuidSeed
!ntdll.dll|ZwSetUuidSeed(PGUID)|FailureIfNotNullRet
ntdll.dll|NtSetValueKey(HANDLE Hkey,PUNICODE_STRING ValueName,ULONG TitleIndex,ULONG Type,PVOID Data,ULONG DataSize)|FailureIfNotNullRet
;ZwSetValueKey() has the same entry point as NtSetValueKey
!ntdll.dll|ZwSetValueKey(HANDLE Hkey,PUNICODE_STRING ValueName,ULONG TitleIndex,ULONG Type,PVOID Data,ULONG DataSize)|FailureIfNotNullRet
ntdll.dll|NtSetVolumeInformationFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PVOID FileSystemInformation,ULONG Length,FS_INFORMATION_CLASS FileSystemInformationClass)|FailureIfNotNullRet
;ZwSetVolumeInformationFile() has the same entry point as NtSetVolumeInformationFile
!ntdll.dll|ZwSetVolumeInformationFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PVOID FileSystemInformation,ULONG Length,FS_INFORMATION_CLASS FileSystemInformationClass)|FailureIfNotNullRet
ntdll.dll|NtShutdownSystem(UINT Action)|FailureIfNotNullRet
;ZwShutdownSystem() has the same entry point as NtShutdownSystem
!ntdll.dll|ZwShutdownSystem(UINT Action)|FailureIfNotNullRet
ntdll.dll|NtSignalAndWaitForSingleObject(HANDLE ObjectToSignal,HANDLE WaitableObject,BOOLEAN Alertable,PLARGE_INTEGER Time)|FailureIfNotNullRet
;ZwSignalAndWaitForSingleObject() has the same entry point as NtSignalAndWaitForSingleObject
!ntdll.dll|ZwSignalAndWaitForSingleObject(HANDLE ObjectToSignal,HANDLE WaitableObject,BOOLEAN Alertable,PLARGE_INTEGER Time)|FailureIfNotNullRet
ntdll.dll|NtStartProfile(HANDLE ProfileHandle)|FailureIfNotNullRet
;ZwStartProfile() has the same entry point as NtStartProfile
!ntdll.dll|ZwStartProfile(HANDLE ProfileHandle)|FailureIfNotNullRet
ntdll.dll|NtStopProfile(HANDLE ProfileHandle)|FailureIfNotNullRet
;ZwStopProfile() has the same entry point as NtStopProfile
!ntdll.dll|ZwStopProfile(HANDLE ProfileHandle )|FailureIfNotNullRet
ntdll.dll|NtSuspendProcess(HANDLE ProcessHandle)|FailureIfNotNullRet
;ZwSuspendProcess() has the same entry point as NtSuspendProcess
!ntdll.dll|ZwSuspendProcess(HANDLE ProcessHandle)|FailureIfNotNullRet
ntdll.dll|NtSuspendThread(HANDLE ThreadHandle,PULONG PreviousSuspendCount)|Out|FailureIfNotNullRet
;ZwSuspendThread() has the same entry point as NtSuspendThread
!ntdll.dll|ZwSuspendThread(HANDLE ThreadHandle,PULONG PreviousSuspendCount)|Out|FailureIfNotNullRet
ntdll.dll|NtSystemDebugControl(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwSystemDebugControl() has the same entry point as NtSystemDebugControl
!ntdll.dll|ZwSystemDebugControl(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtTerminateJobObject(HANDLE JobHandle,NTSTATUS ExitStatus)|FailureIfNotNullRet
;ZwTerminateJobObject() has the same entry point as NtTerminateJobObject
!ntdll.dll|ZwTerminateJobObject(HANDLE JobHandle,NTSTATUS ExitStatus)|FailureIfNotNullRet
ntdll.dll|NtTerminateProcess(HANDLE ProcessHandle,NTSTATUS ExitStatus)|FailureIfNotNullRet
;ZwTerminateProcess() has the same entry point as NtTerminateProcess
!ntdll.dll|ZwTerminateProcess(HANDLE ProcessHandle,NTSTATUS ExitStatus)|FailureIfNotNullRet
!ntdll.dll|NtTerminateThread(HANDLE ThreadHandle,NTSTATUS ExitStatus)|FailureIfNotNullRet
;ZwTerminateThread() has the same entry point as NtTerminateThread
!ntdll.dll|ZwTerminateThread(HANDLE ThreadHandle,NTSTATUS ExitStatus)|FailureIfNotNullRet
ntdll.dll|NtTestAlert()|FailureIfNotNullRet
;ZwTestAlert() has the same entry point as NtTestAlert
!ntdll.dll|ZwTestAlert()|FailureIfNotNullRet
ntdll.dll|NtTraceEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwTraceEvent() has the same entry point as NtTraceEvent
!ntdll.dll|ZwTraceEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtTranslateFilePath(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwTranslateFilePath() has the same entry point as NtTranslateFilePath
!ntdll.dll|ZwTranslateFilePath(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtUnloadDriver(PUNICODE_STRING DriverServiceName)|FailureIfNotNullRet
;ZwUnloadDriver() has the same entry point as NtUnloadDriver
!ntdll.dll|ZwUnloadDriver(PUNICODE_STRING DriverServiceName)|FailureIfNotNullRet
ntdll.dll|NtUnloadKey(POBJECT_ATTRIBUTES DestinationKeyName)|FailureIfNotNullRet
;ZwUnloadKey() has the same entry point as NtUnloadKey
!ntdll.dll|ZwUnloadKey(POBJECT_ATTRIBUTES DestinationKeyName)|FailureIfNotNullRet
ntdll.dll|NtUnloadKeyEx(POBJECT_ATTRIBUTES DestinationKeyName,UNKNOWN)|FailureIfNotNullRet
;ZwUnloadKeyEx() has the same entry point as NtUnloadKeyEx
!ntdll.dll|ZwUnloadKeyEx(POBJECT_ATTRIBUTES DestinationKeyName,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtUnlockFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PLARGE_INTEGER ByteOffset,PLARGE_INTEGER Length,PULONG Key )|FailureIfNotNullRet
;ZwUnlockFile() has the same entry point as NtUnlockFile
!ntdll.dll|ZwUnlockFile(HANDLE FileHandle,PIO_STATUS_BLOCK IoStatusBlock,PLARGE_INTEGER ByteOffset,PLARGE_INTEGER Length,PULONG Key )|FailureIfNotNullRet
ntdll.dll|NtUnlockVirtualMemory(HANDLE ProcessHandle,PVOID *BaseAddress,PULONG NumberOfBytesToUnlock,ULONG LockType )|FailureIfNotNullRet
;ZwUnlockVirtualMemory() has the same entry point as NtUnlockVirtualMemory
!ntdll.dll|ZwUnlockVirtualMemory(HANDLE ProcessHandle,PVOID *BaseAddress,PULONG NumberOfBytesToUnlock,ULONG LockType)|FailureIfNotNullRet
ntdll.dll|NtUnmapViewOfSection(HANDLE ProcessHandle,PVOID BaseAddress)|FailureIfNotNullRet
;ZwUnmapViewOfSection() has the same entry point as NtUnmapViewOfSection
!ntdll.dll|ZwUnmapViewOfSection(HANDLE ProcessHandle,PVOID BaseAddress)|FailureIfNotNullRet
ntdll.dll|NtVdmControl(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwVdmControl() has the same entry point as NtVdmControl
!ntdll.dll|ZwVdmControl(UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtWaitForDebugEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwWaitForDebugEvent() has the same entry point as NtWaitForDebugEvent
!ntdll.dll|ZwWaitForDebugEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
ntdll.dll|NtWaitForKeyedEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
;ZwWaitForKeyedEvent() has the same entry point as NtWaitForKeyedEvent
!ntdll.dll|ZwWaitForKeyedEvent(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)|FailureIfNotNullRet
!ntdll.dll|NtWaitForMultipleObjects(ULONG ObjectCount,PHANDLE ObjectsArray,OBJECT_WAIT_TYPE WaitType,BOOLEAN Alertable,PLARGE_INTEGER TimeOut)|FailureIfNotNullRet
;ZwWaitForMultipleObjects() has the same entry point as NtWaitForMultipleObjects
!ntdll.dll|ZwWaitForMultipleObjects(ULONG ObjectCount,PHANDLE ObjectsArray,OBJECT_WAIT_TYPE WaitType,BOOLEAN Alertable,PLARGE_INTEGER TimeOut)|FailureIfNotNullRet
; lots of call
!ntdll.dll|NTSTATUS NtWaitForSingleObject( HANDLE Handle, BOOLEAN Alertable, PLARGE_INTEGER Timeout)|FailureIfNotNullRet
;ZwWaitForSingleObject() has the same entry point as NtWaitForSingleObject
!ntdll.dll|NTSTATUS ZwWaitForSingleObject( HANDLE Handle, BOOLEAN Alertable, PLARGE_INTEGER Timeout)|FailureIfNotNullRet
ntdll.dll|NtWaitHighEventPair(HANDLE EventPairHandle)|FailureIfNotNullRet
;ZwWaitHighEventPair() has the same entry point as NtWaitHighEventPair
!ntdll.dll|ZwWaitHighEventPair(HANDLE EventPairHandle)|FailureIfNotNullRet
ntdll.dll|NTSTATUS NtWaitLowEventPair(HANDLE EventPairHandle )|FailureIfNotNullRet
;ZwWaitLowEventPair() has the same entry point as NtWaitLowEventPair
!ntdll.dll|NTSTATUS ZwWaitLowEventPair(HANDLE EventPairHandle)|FailureIfNotNullRet
; lots of call
!ntdll.dll|NtWriteFile( HANDLE FileHandle,HANDLE Event,PIO_APC_ROUTINE ApcRoutine,PVOID ApcContext,PIO_STATUS_BLOCK IoStatusBlock,PVOID Buffer:PointedDataSize=Arg7,ULONG Length,PLARGE_INTEGER ByteOffset,PULONG Key )|Out|FailureIfNotNullRet
;ZwWriteFile() has the same entry point as NtWriteFile
!ntdll.dll|ZwWriteFile( HANDLE FileHandle,HANDLE Event,PIO_APC_ROUTINE ApcRoutine,PVOID ApcContext,PIO_STATUS_BLOCK IoStatusBlock,PVOID Buffer:PointedDataSize=Arg7,ULONG Length,PLARGE_INTEGER ByteOffset,PULONG Key )|Out|FailureIfNotNullRet
ntdll.dll|NTSTATUS NtWriteFileGather(HANDLE FileHandle,HANDLE Event,PIO_APC_ROUTINE ApcRoutine ,PVOID ApcContext,PIO_STATUS_BLOCK IoStatusBlock,FILE_SEGMENT_ELEMENT SegmentArray,ULONG Length,PLARGE_INTEGER ByteOffset,PULONG Key)|Out|FailureIfNotNullRet
;ZwWriteFileGather() has the same entry point as NtWriteFileGather
!ntdll.dll|NTSTATUS ZwWriteFileGather(HANDLE FileHandle,HANDLE Event,PIO_APC_ROUTINE ApcRoutine ,PVOID ApcContext,PIO_STATUS_BLOCK IoStatusBlock,FILE_SEGMENT_ELEMENT SegmentArray,ULONG Length,PLARGE_INTEGER ByteOffset,PULONG Key)|Out|FailureIfNotNullRet
ntdll.dll|NtWriteRequestData(HANDLE,PLPC_MESSAGE,ULONG,PVOID,ULONG,PULONG)|Out|FailureIfNotNullRet
;ZwWriteRequestData() has the same entry point as NtWriteRequestData
!ntdll.dll|ZwWriteRequestData(HANDLE,PLPC_MESSAGE,ULONG,PVOID,ULONG,PULONG)|Out|FailureIfNotNullRet
ntdll.dll|NtWriteVirtualMemory(HANDLE ProcessHandle,PVOID BaseAddress,PVOID Buffer:PointedDataSize=Arg4,ULONG BytesToWrite,PULONG WrittenBytes)|Out|FailureIfNotNullRet
;ZwWriteVirtualMemory() has the same entry point as NtWriteVirtualMemory
!ntdll.dll|ZwWriteVirtualMemory(HANDLE ProcessHandle,PVOID BaseAddress,PVOID Buffer:PointedDataSize=Arg4,ULONG BytesToWrite,PULONG WrittenBytes)|Out|FailureIfNotNullRet
ntdll.dll|NtYieldExecution()|FailureIfNotNullRet
;ZwYieldExecution() has the same entry point as NtYieldExecution
!ntdll.dll|ZwYieldExecution()|FailureIfNotNullRet
ntdll.dll|PfxFindPrefix(UNKNOWN,UNKNOWN)
ntdll.dll|PfxInitialize(UNKNOWN)
ntdll.dll|PfxInsertPrefix(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|PfxRemovePrefix(UNKNOWN)
ntdll.dll|PropertyLengthAsVariant()
;not on all systems
!ntdll.dll|RestoreEm87Context(UNKNOWN)
ntdll.dll|RtlAbortRXact(UNKNOWN)
ntdll.dll|RtlAbsoluteToSelfRelativeSD(UNKNOWN,UNKNOWN,UNKNOWN)
; lots of call
!ntdll.dll|RtlAcquirePebLock()
ntdll.dll|RtlAcquireResourceExclusive(PVOID ResourceHandle,BOOL bExclusive)
ntdll.dll|RtlAcquireResourceShared(PVOID ResourceHandle,BOOL bShared)
; lots of call
!ntdll.dll|RtlActivateActivationContext(UNKNOWN,UNKNOWN,UNKNOWN)
; lots of call
!ntdll.dll|RtlActivateActivationContextEx(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
; lots of call
!ntdll.dll|RtlActivateActivationContextUnsafeFast(UNKNOWN,UNKNOWN)
ntdll.dll|RtlAddAccessAllowedAce(PACL pAcl, DWORD dwAceRevision, DWORD AccessMask, PSID pSid)|Out|FailureIfNullRet
ntdll.dll|RtlAddAccessAllowedAceEx(PACL pAcl,  DWORD dwAceRevision,  DWORD AceFlags,  DWORD AccessMask,  PSID pSid)|Out|FailureIfNullRet
ntdll.dll|RtlAddAccessAllowedObjectAce(PACL pAcl,  DWORD dwAceRevision,  DWORD AceFlags,  DWORD AccessMask,  GUID* ObjectTypeGuid,  GUID* InheritedObjectTypeGuid,  PSID pSid)|Out|FailureIfNotNullRet
ntdll.dll|RtlAddAccessDeniedAce(PACL pAcl, DWORD dwAceRevision, DWORD AccessMask, PSID pSid)|Out|FailureIfNullRet
ntdll.dll|RtlAddAccessDeniedAceEx(PACL pAcl,  DWORD dwAceRevision,  DWORD AceFlags,  DWORD AccessMask,  PSID pSid)|Out|FailureIfNullRet
ntdll.dll|RtlAddAccessDeniedObjectAce(PACL pAcl,  DWORD dwAceRevision,  DWORD AceFlags,  DWORD AccessMask,  GUID* ObjectTypeGuid,  GUID* InheritedObjectTypeGuid,  PSID pSid)|Out|FailureIfNotNullRet
ntdll.dll|RtlAddAce(PACL pAcl,  DWORD dwAceRevision,  DWORD dwStartingAceIndex,  LPVOID pAceList,  DWORD nAceListLength)|FailureIfNullRet
ntdll.dll|RtlAddActionToRXact(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlAddAtomToAtomTable(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlAddAttributeActionToRXact(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlAddAuditAccessAce(PACL pAcl, DWORD dwAceRevision, DWORD dwAccessMask, PSID pSid, BOOL bAuditSuccess, BOOL bAuditFailure)|FailureIfNullRet
ntdll.dll|RtlAddAuditAccessAceEx(PACL pAcl, DWORD dwAceRevision, DWORD AceFlags, DWORD dwAccessMask, PSID pSid, BOOL bAuditSuccess, BOOL bAuditFailure)|FailureIfNullRet
ntdll.dll|RtlAddAuditAccessObjectAce( PACL pAcl, DWORD dwAceRevision, DWORD AceFlags, DWORD AccessMask, GUID* ObjectTypeGuid, GUID* InheritedObjectTypeGuid, PSID pSid, BOOL bAuditSuccess, BOOL bAuditFailure)|FailureIfNullRet
ntdll.dll|RtlAddCompoundAce(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlAddRange(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
;lots of call
!ntdll.dll|RtlAddRefActivationContext(UNKNOWN)
ntdll.dll|RtlAddRefMemoryStream(UNKNOWN)
ntdll.dll|RtlAddVectoredExceptionHandler(ULONG FirstHandler, PVECTORED_EXCEPTION_HANDLER VectoredHandler)|Out
ntdll.dll|RtlAddressInSectionTable(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlAdjustPrivilege(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlAllocateAndInitializeSid(PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority, BYTE nSubAuthorityCount, DWORD dwSubAuthority0, DWORD dwSubAuthority1, DWORD dwSubAuthority2, DWORD dwSubAuthority3, DWORD dwSubAuthority4, DWORD dwSubAuthority5, DWORD dwSubAuthority6, DWORD dwSubAuthority7, PSID* pSid)|FailureIfNullRet
ntdll.dll|RtlAllocateHandle(HANDLE hHandle,SIZE_T dwBytes)|FailureIfNullRet
;lots of call
!ntdll.dll|RtlAllocateHeap(HANDLE hHeap,DWORD dwFlags,SIZE_T dwBytes)|FailureIfNullRet
ntdll.dll|RtlAnsiCharToUnicodeChar(CHAR)
;lots of call
!ntdll.dll|RtlAnsiStringToUnicodeSize(PANSI_STRING  AnsiString)
;lots of call
!ntdll.dll|NTSTATUS RtlAnsiStringToUnicodeString( PUNICODE_STRING DestinationString, PCANSI_STRING SourceString, BOOLEAN AllocateDestinationString)|Out
ntdll.dll|RtlAppendAsciizToString(UNKNOWN,UNKNOWN)
ntdll.dll|RtlAppendPathElement(UNKNOWN,UNKNOWN,UNKNOWN)
; lots of call
!ntdll.dll|RtlAppendStringToString(PANSI_STRING Destination,PANSI_STRING Source)|Out
; lots of call
!ntdll.dll|RtlAppendUnicodeStringToString(PUNICODE_STRING Destination,PUNICODE_STRING Source)|Out
; lots of call
!ntdll.dll|RtlAppendUnicodeToString(PUNICODE_STRING Destination,PCWSTR  Source)|Out
ntdll.dll|RtlApplicationVerifierStop(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlApplyRXact(UNKNOWN)
ntdll.dll|RtlApplyRXactNoFlush(UNKNOWN)
ntdll.dll|RtlAreAllAccessesGranted(DWORD GrantedAccess, DWORD DesiredAccess)|FailureIfNullRet
ntdll.dll|RtlAreAnyAccessesGranted(DWORD GrantedAccess, DWORD DesiredAccess)|FailureIfNullRet
ntdll.dll|RtlAreBitsClear(PRTL_BITMAP BitMapHeader,ULONG StartingIndex,ULONG Length)
ntdll.dll|RtlAreBitsSet(PRTL_BITMAP BitMapHeader,ULONG StartingIndex,ULONG Length)
ntdll.dll|RtlAssert(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlAssert2(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCancelTimer(UNKNOWN,UNKNOWN)
ntdll.dll|VOID RtlCaptureContext( PCONTEXT ContextRecord)
ntdll.dll|RtlCaptureStackBackTrace(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCaptureStackContext(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|NTSTATUS RtlCharToInteger( PCSZ String, ULONG Base, PULONG Value)|Out
ntdll.dll|RtlCheckForOrphanedCriticalSections(UNKNOWN)
ntdll.dll|RtlCheckProcessParameters(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCheckRegistryKey(UNKNOWN,UNKNOWN)
ntdll.dll|RtlClearAllBits(PRTL_BITMAP  BitMapHeader)
ntdll.dll|RtlClearBits(PRTL_BITMAP BitMapHeader,ULONG StartingIndex,ULONG Length)
ntdll.dll|RtlCloneMemoryStream(UNKNOWN,UNKNOWN)
;RtlCommitMemoryStream has the same entry point as RtlCloneMemoryStream
!ntdll.dll|RtlCommitMemoryStream(UNKNOWN,UNKNOWN)
ntdll.dll|RtlCompactHeap(HANDLE HeapHandle,ULONG Flags)
; lots of call
!ntdll.dll|RtlCompareMemory(PVOID,PVOID,DWORD)
; fail
;ntdll.dll|RtlCompareMemoryUlong(PVOID,PVOID,DWORD)
ntdll.dll|RtlCompareString(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCompareUnicodeString(PUNICODE_STRING Str1,PUNICODE_STRING Str2,ULONG Flags)
ntdll.dll|RtlCompressBuffer(ULONG,PVOID,ULONG,PVOID,ULONG,ULONG,PULONG,PVOID)
ntdll.dll|RtlComputeCrc32(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlComputeImportTableHash(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlComputePrivatizedDllName_U(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlConsoleMultiByteToUnicodeN(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlConvertExclusiveToShared(UNKNOWN)
ntdll.dll|RtlConvertLongToLargeInteger(UNKNOWN)
ntdll.dll|RtlConvertPropertyToVariant()
ntdll.dll|RtlConvertSharedToExclusive(UNKNOWN)
; lots of call
!ntdll.dll|NTSTATUS RtlConvertSidToUnicodeString( PUNICODE_STRING UnicodeString, PSID pSid, BOOLEAN AllocateDestinationString)|Out
ntdll.dll|RtlConvertToAutoInheritSecurityObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlConvertUiListToApiList(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlConvertUlongToLargeInteger(ULONG ulong)
ntdll.dll|RtlConvertVariantToProperty()
ntdll.dll|RtlCopyLuid(PLUID pDestLuid,PLUID pSrcLuid)|Out|FailureIfNullRet
ntdll.dll|RtlCopyLuidAndAttributesArray(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCopyMemoryStreamTo(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCopyOutOfProcessMemoryStreamTo(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCopyRangeList(UNKNOWN,UNKNOWN)
ntdll.dll|RtlCopySecurityDescriptor(UNKNOWN,UNKNOWN)
ntdll.dll|RtlCopySid(DWORD nDestinationSidLength,  PSID pDestinationSid,  PSID pSourceSid)|FailureIfNullRet
ntdll.dll|RtlCopySidAndAttributesArray(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
; lots of call
!ntdll.dll|RtlCopyString(PANSI_STRING DestStr,PANSI_STRING SrcStr)
; lots of call
!ntdll.dll|RtlCopyUnicodeString(PUNICODE_STRING DestStr,PUNICODE_STRING SrcStr)|Out
ntdll.dll|RtlCreateAcl(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCreateActivationContext(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCreateAndSetSD(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCreateAtomTable(UNKNOWN,UNKNOWN)
ntdll.dll|RtlCreateBootStatusDataFile()
ntdll.dll|RtlCreateEnvironment(BOOLEAN Inherit,PVOID pEnv)|Out
ntdll.dll|RtlCreateHeap(ULONG Flags,PVOID Base,ULONG Reserved,ULONG Commit,BOOLEAN Lock,PRTL_HEAP_DEFINITION)
ntdll.dll|RtlCreateProcessParameters(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCreateQueryDebugBuffer(UNKNOWN,UNKNOWN)
ntdll.dll|RtlCreateRegistryKey(UNKNOWN,UNKNOWN)
ntdll.dll|RtlCreateSecurityDescriptor(UNKNOWN,UNKNOWN)
ntdll.dll|RtlCreateSystemVolumeInformationFolder(UNKNOWN)
ntdll.dll|RtlCreateTagHeap(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCreateTimer(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCreateTimerQueue(UNKNOWN)
ntdll.dll|RtlCreateUnicodeString(PUNICODE_STRING UnicodeString,PWCHAR pwStr)|FailureIfNullRet
ntdll.dll|RtlCreateUnicodeStringFromAsciiz(PUNICODE_STRING UnicodeString,PCHAR pStr)|FailureIfNullRet
ntdll.dll|RtlCreateUserProcess(PUNICODE_STRING ImagePath,ULONG objAttr,PRTL_USER_PROCESS_PARAMETERS,PSECURITY_DESCRIPTOR ProcessSec,PSECURITY_DESCRIPTOR ThreadSec,HANDLE ParentProcess,BOOLEAN InheritHandles,HANDLE DebugPort,HANDLE ExceptionPort,PRTL_USER_PROCESS_INFORMATION ProcessInfo)|Out
ntdll.dll|RtlCreateUserSecurityObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCreateUserThread(HANDLE ProcessHandle,PSECURITY_DESCRIPTOR,BOOLEAN CreateSuspended,ULONG StackZeroBits,PULONG StackReserved,PULONG StackCommit,PVOID startAddr,PVOID StartParam,PHANDLE ThreadHandle,PCLIENT_ID)|Out
ntdll.dll|RtlCustomCPToUnicodeN(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlCutoverTimeToSystemTime(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlDeNormalizeProcessParams(UNKNOWN)
;lots of call
!ntdll.dll|RtlDeactivateActivationContext(UNKNOWN,UNKNOWN)
;lots of call
!ntdll.dll|RtlDeactivateActivationContextUnsafeFast(UNKNOWN)
ntdll.dll|RtlDecompressBuffer(ULONG Format,PVOID DstBuf,ULONG DstBufSize,PVOID SrcBuf,SrcBufSize,PULONG DstSize)|Out
ntdll.dll|RtlDecompressFragment(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlDefaultNpAcl(UNKNOWN)
ntdll.dll|RtlDelete(UNKNOWN)
ntdll.dll|RtlDeleteAce(PACL pAcl,DWORD dwAceIndex)|FailureIfNullRet
ntdll.dll|RtlDeleteAtomFromAtomTable(UNKNOWN,UNKNOWN)
ntdll.dll|RtlDeleteCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
ntdll.dll|RtlDeleteElementGenericTable(UNKNOWN,UNKNOWN)
ntdll.dll|RtlDeleteElementGenericTableAvl(UNKNOWN,UNKNOWN)
ntdll.dll|RtlDeleteNoSplay(UNKNOWN,UNKNOWN)
ntdll.dll|RtlDeleteOwnersRanges(UNKNOWN,UNKNOWN)
ntdll.dll|RtlDeleteRange(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlDeleteRegistryValue(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlDeleteResource(PVOID ResourceHandle)
ntdll.dll|RtlDeleteSecurityObject(UNKNOWN)
ntdll.dll|RtlDeleteTimer(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlDeleteTimerQueue(HANDLE TimerQueue)|FailureIfNullRet
ntdll.dll|RtlDeleteTimerQueueEx(HANDLE TimerQueue, HANDLE CompletionEvent)|FailureIfNullRet
ntdll.dll|RtlDeregisterWait(UNKNOWN)
ntdll.dll|RtlDeregisterWaitEx(UNKNOWN,UNKNOWN)
ntdll.dll|RtlDestroyAtomTable(UNKNOWN)
ntdll.dll|RtlDestroyEnvironment(PVOID Env)
ntdll.dll|RtlDestroyHandleTable(UNKNOWN)
ntdll.dll|RtlDestroyHeap(PVOID HeapHandle)
ntdll.dll|RtlDestroyProcessParameters(UNKNOWN)
ntdll.dll|RtlDestroyQueryDebugBuffer(UNKNOWN)
; lots of call
!ntdll.dll|RtlDetermineDosPathNameType_U(wchar_t*)
ntdll.dll|RtlDllShutdownInProgress()
ntdll.dll|RtlDnsHostNameToComputerName(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlDoesFileExists_U(wchar_t*)
; lots of call
!ntdll.dll|RtlDosApplyFileIsolationRedirection_Ustr(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
; lots of call
!ntdll.dll|RtlDosPathNameToNtPathName_U(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlDosSearchPath_U(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlDosSearchPath_Ustr(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlDowncaseUnicodeChar(WCHAR)
ntdll.dll|RtlDowncaseUnicodeString(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlDumpResource(PVOID ResourceHandle)
ntdll.dll|RtlDuplicateUnicodeString(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlEmptyAtomTable(UNKNOWN,UNKNOWN)
ntdll.dll|RtlEnableEarlyCriticalSectionEventCreation()
ntdll.dll|RtlEnlargedIntegerMultiply(UNKNOWN,UNKNOWN)
ntdll.dll|RtlEnlargedUnsignedDivide(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlEnlargedUnsignedMultiply(UNKNOWN,UNKNOWN)
;lots of call
!ntdll.dll|RtlEnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
ntdll.dll|RtlEnumProcessHeaps(PVOID EnumRoutine,PVOID param)
ntdll.dll|RtlEnumerateGenericTable(UNKNOWN,UNKNOWN)
ntdll.dll|RtlEnumerateGenericTableAvl(UNKNOWN,UNKNOWN)
ntdll.dll|RtlEnumerateGenericTableLikeADirectory(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlEnumerateGenericTableWithoutSplaying(UNKNOWN,UNKNOWN)
ntdll.dll|RtlEnumerateGenericTableWithoutSplayingAvl(UNKNOWN,UNKNOWN)
ntdll.dll|RtlEqualComputerName(UNKNWON,UNKNOWN)
ntdll.dll|RtlEqualDomainName(UNKNOWN,UNKNOWN)
ntdll.dll|RtlEqualLuid(LUID,LUID)
ntdll.dll|RtlEqualPrefixSid(PSID pSid1, PSID pSid2)
ntdll.dll|RtlEqualSid(PSID pSid1, PSID pSid2)
ntdll.dll|RtlEqualString(PANSI_STRING Str1,PANSI_STRING Str2,BOOLEAN CaseInSensitive)
;lots of call
!ntdll.dll|RtlEqualUnicodeString(PUNICODE_STRING String1,PUNICODE_STRING String2,BOOLEAN CaseInSensitive)
ntdll.dll|RtlEraseUnicodeString(PUNICODE_STRING UnicodeString)
ntdll.dll|RtlExitUserThread(UNKNOWN)
ntdll.dll|RtlExpandEnvironmentStrings_U(PVOID Env,PUNICODE_STRING Src,PUNICODE_STRING Dst,PULONG DstBufferSize)|Out
ntdll.dll|RtlExtendHeap()
ntdll.dll|LARGE_INTEGER RtlExtendedIntegerMultiply(LARGE_INTEGER  Multiplicand, LONG Multiplier)
ntdll.dll|LARGE_INTEGER RtlExtendedLargeIntegerDivide(LARGE_INTEGER  Dividend, ULONG Divisor, PULONG Remainder)|Out
;lots of call
!ntdll.dll|RtlExtendedMagicDivide(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlFillMemory(PVOID Destination,SIZE_T Length,BYTE Fill)
; fail
;ntdll.dll|RtlFillMemoryUlong(PVOID Destination,SIZE_T Length,ULONG Fill)
ntdll.dll|RtlFinalReleaseOutOfProcessMemoryStream(UNKNOWN)
;lots of call
!ntdll.dll|RtlFindActivationContextSectionGuid(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
;lots of call
!ntdll.dll|RtlFindActivationContextSectionString(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlFindCharInUnicodeString(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlFindClearBits(PRTL_BITMAP BitMapHeader,ULONG NumberToFind,ULONG HintIndex)
ntdll.dll|RtlFindClearBitsAndSet(PRTL_BITMAP BitMapHeader,ULONG NumberToFind,ULONG HintIndex)
ntdll.dll|RtlFindClearRuns(PRTL_BITMAP BitMapHeader,PRTL_BITMAP_RUN RunArray,ULONG SizeOfRunArray,BOOLEAN LocateLongestRuns)|Out
ntdll.dll|RtlFindLastBackwardRunClear(PRTL_BITMAP BitMapHeader,ULONG FromIndex,PULONG StartingRunIndex)|Out
ntdll.dll|RtlFindLeastSignificantBit(ULONLONG Set)
ntdll.dll|RtlFindLongestRunClear(PRTL_BITMAP BitMapHeader,PULONG StartingRunIndex)|Out
ntdll.dll|RtlFindMessage(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlFindMostSignificantBit(ULONGLONG Set)
ntdll.dll|RtlFindNextForwardRunClear(PRTL_BITMAP BitMapHeader,ULONG FromIndex,PULONG StartingRunIndex)|Out
ntdll.dll|RtlFindRange(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlFindSetBits(PRTL_BITMAP BitMapHeader,ULONG NumberToFind,ULONG HintIndex)
ntdll.dll|RtlFindSetBitsAndClear(PRTL_BITMAP BitMapHeader,ULONG NumberToFind,ULONG HintIndex)
ntdll.dll|RtlFirstEntrySList(UNKNOWN)
ntdll.dll|RtlFirstFreeAce(UNKNOWN,UNKNOWN)
ntdll.dll|RtlFlushSecureMemoryCache(UNKNOWN,UNKNOWN)
ntdll.dll|RtlFormatCurrentUserKeyPath(PUNICODE_STRING RegistryPath)|Out
ntdll.dll|RtlFormatMessage(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|void RtlFreeAnsiString( PANSI_STRING AnsiString)
ntdll.dll|RtlFreeHandle(UNKNOWN,UNKNOWN)
;lots of call
!ntdll.dll|RtlFreeHeap(HANDLE hHeap,DWORD dwFlags, LPVOID lpMem)
ntdll.dll|void RtlFreeOemString( POEM_STRING OemString)|Out
ntdll.dll|RtlFreeRangeList(UNKNOWN)
ntdll.dll|RtlFreeSid(PSID pSid)
ntdll.dll|RtlFreeThreadActivationContextStack()
;RtlFreeUnicodeString() has the same entry point as RtlFreeAnsiString
!ntdll.dll|RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
ntdll.dll|RtlFreeUserThreadStack(UNKNOWN,UNKNOWN)
ntdll.dll|RtlGUIDFromString(PUNICODE_STRING GuidString,PGUID Guid)|Out
ntdll.dll|RtlGenerate8dot3Name(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetAce(PACL pAcl, DWORD dwAceIndex, LPVOID* pAce)
ntdll.dll|RtlGetActiveActivationContext(UNKNOWN)
ntdll.dll|RtlGetCallersAddress(UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetCompressionWorkSpaceSize(ULONG Format,PULONG NeededBufSize,PULONG)|Out
ntdll.dll|RtlGetControlSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetCurrentDirectory_U(DWORD BufferLength,wchar_t* lpBuffer)|Out|FailureIfNullRet
ntdll.dll|RtlGetCurrentPeb()
ntdll.dll|RtlGetDaclSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetElementGenericTable(UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetElementGenericTableAvl(UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetFirstRange(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetFrame()
ntdll.dll|RtlGetFullPathName_U(LPCWSTR lpFileName,DWORD nBufferLength,LPWSTR lpBuffer, LPWSTR* lpFilePart)|Out|FailureIfNullRet
ntdll.dll|RtlGetGroupSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetLastNtStatus()
;lots of call
!ntdll.dll|RtlGetLastWin32Error()
ntdll.dll|RtlGetLengthWithoutLastFullDosOrNtPathElement(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetLengthWithoutTrailingPathSeperators(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetLongestNtPathLength()
;RtlGetNativeSystemInformation() has the same entry point as NtQuerySystemInformation
!ntdll.dll|RtlGetNativeSystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
ntdll.dll|RtlGetNextRange(UNKNOWN,UNKNOWN,UNKNOWN)
;lots of call
!ntdll.dll|RtlGetNtGlobalFlags()
ntdll.dll|RtlGetNtProductType(UNKNOWN)
ntdll.dll|RtlGetNtVersionNumbers(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetOwnerSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetProcessHeaps(ULONG MaxNbHeap,PVOID HeapArray)|Out
ntdll.dll|RtlGetSaclSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetSecurityDescriptorRMControl(UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetSetBootStatusData(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetUserInfoHeap(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlGetVersion(PRTL_OSVERSIONINFOW lpVersionInformation)
;lots of call
!ntdll.dll|RtlHashUnicodeString(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlIdentifierAuthoritySid(UNKNOWN)
; lots of call
!ntdll.dll|RtlImageDirectoryEntryToData(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlImageRvaToSection(PIMAGE_NT_HEADERS NtHeaders,PVOID Base,ULONG Rva)
ntdll.dll|RtlImageRvaToVa(PIMAGE_NT_HEADERS NtHeaders,PVOID Base,ULONG Rva,PIMAGE_SECTION_HEADER* LastRvaSection)
ntdll.dll|RtlImpersonateSelf(UNKNOWN)
;lots of call
!ntdll.dll|RtlInitAnsiString(PANSI_STRING DestinationString,PCSZ SourceString)
ntdll.dll|RtlInitCodePageTable(UNKNOWN,UNKNOWN)
ntdll.dll|RtlInitMemoryStream(UNKNOWN)
ntdll.dll|RtlInitNlsTables(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlInitOutOfProcessMemoryStream(UNKNOWN)
;lots of call
!ntdll.dll|void RtlInitString(PSTRING DestinationString,PCSZ SourceString)|Out
;lots of call
!ntdll.dll|VOID RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)|Out
ntdll.dll|RtlInitUnicodeStringEx(PUNICODE_STRING DestinationString, PCWSTR SourceString)|Out
ntdll.dll|RtlInitializeAtomPackage(UNKNOWN)
ntdll.dll|RtlInitializeBitMap(PRTL_BITMAP BitMapHeader,PULONG BitMapBuffer,ULONG SizeOfBitMap)|Out
ntdll.dll|RtlInitializeContext(HANDLE ProcessHandle,PCONTEXT ThreadContext,PVOID StartParam,PVOID StartAddress,PINITIAL_TEB)
ntdll.dll|RtlInitializeCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
ntdll.dll|RtlInitializeCriticalSectionAndSpinCount(LPCRITICAL_SECTION lpCriticalSection,DWORD dwSpinCount)
ntdll.dll|RtlInitializeGenericTable(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlInitializeGenericTableAvl(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlInitializeHandleTable(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlInitializeRXact(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlInitializeRangeList(UNKNOWN)
ntdll.dll|RtlInitializeResource(PVOID ResourceHandle)
ntdll.dll|RtlInitializeSListHead(UNKNOWN)
ntdll.dll|RtlInitializeSid(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlInsertElementGenericTable(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlInsertElementGenericTableAvl(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlInt64ToUnicodeString(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlIntegerToChar(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlIntegerToUnicodeString(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlInterlockedFlushSList(UNKNOWN)
ntdll.dll|RtlInterlockedPopEntrySList(UNKNOWN)
ntdll.dll|RtlInterlockedPushEntrySList(UNKNOWN,UNKNOWN)
ntdll.dll|RtlInterlockedPushListSList(UNKNOWN,UNKNOWN)
ntdll.dll|RtlInvertRangeList(UNKNOWN,UNKNOWN)
ntdll.dll|RtlIpv4AddressToStringA(ULONG,LPSTR)|Out
ntdll.dll|RtlIpv4AddressToStringW(ULONG,LPWSTR)|Out
ntdll.dll|RtlIpv4StringToAddressA(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlIpv4StringToAddressW(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlIpv6AddressToStringA(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlIpv6AddressToStringW(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlIpv6StringToAddressA(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlIpv6StringToAddressW(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlIsActivationContextActive(UNKNOWN)
ntdll.dll|RtlIsDosDeviceName_U(LPCWSTR lpDeviceName)
ntdll.dll|RtlIsGenericTableEmpty(UNKNOWN)
ntdll.dll|RtlIsGenericTableEmptyAvl(UNKNOWN)
ntdll.dll|BOOLEAN RtlIsNameLegalDOS8Dot3( PUNICODE_STRING Name, POEM_STRING OemName, PBOOLEAN NameContainsSpaces)|Out
ntdll.dll|RtlIsRangeAvailable(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlIsTextUnicode(UNKNOWN,UNKNOWN,UNKNOWN)
!ntdll.dll|RtlIsThreadWithinLoaderCallout()
ntdll.dll|RtlIsValidHandle(const PRTL_HANDLE_TABLE HandleTable,const PRTL_HANDLE Handle)
ntdll.dll|RtlIsValidIndexHandle(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlLargeIntegerAdd(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlLargeIntegerArithmeticShift(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlLargeIntegerDivide(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlLargeIntegerNegate(UNKNOWN,UNKNOWN)
ntdll.dll|RtlLargeIntegerShiftLeft(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlLargeIntegerShiftRight(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlLargeIntegerSubtract(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlLargeIntegerToChar(UNKNWON,UNKNWON,UNKNWON,UNKNWON)
;lots of call
!ntdll.dll|RtlLeaveCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
ntdll.dll|RtlLengthRequiredSid(PSID pSid)
ntdll.dll|RtlLengthSecurityDescriptor(UNKNOWN)
ntdll.dll|RtlLengthSid(PSID pSid)
ntdll.dll|NTSTATUS RtlLocalTimeToSystemTime( PLARGE_INTEGER LocalTime, PLARGE_INTEGER SystemTime)|Out
ntdll.dll|RtlLockBootStatusData(UNKNOWN)
ntdll.dll|RtlLockHeap(HANDLE HeapHandle)
;RtlLockMemoryStreamRegion() has the same entry point as RtlCopyOutOfProcessMemoryStreamTo
!ntdll.dll|RtlLockMemoryStreamRegion(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlLogStackBackTrace()
ntdll.dll|RtlLookupAtomInAtomTable(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlLookupElementGenericTable(UNKNOWN,UNKNOWN)
ntdll.dll|RtlLookupElementGenericTableAvl(UNKNOWN,UNKNOWN)
ntdll.dll|RtlMakeSelfRelativeSD(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlMapGenericMask(UNKNOWN,UNKNOWN)
ntdll.dll|RtlMapSecurityErrorToNtStatus(UNKNOWN)
ntdll.dll|RtlMergeRangeLists(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlMoveMemory(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlMultiAppendUnicodeStringBuffer(UNKNOWN,UNKNOWN,UNKNOWN)
;lots of call
!ntdll.dll|RtlMultiByteToUnicodeN(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
;lots of call
!ntdll.dll|RtlMultiByteToUnicodeSize(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlNewInstanceSecurityObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlNewSecurityGrantedAccess(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlNewSecurityObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlNewSecurityObjectEx(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlNewSecurityObjectWithMultipleInheritance(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlNormalizeProcessParams(UNKNOWN)
ntdll.dll|RtlNtPathNameToDosPathName(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
;lots of call
!ntdll.dll|RtlNtStatusToDosError(UNKNOWN)
;lots of call
!ntdll.dll|RtlNtStatusToDosErrorNoTeb(UNKNOWN)
ntdll.dll|RtlNumberGenericTableElements(UNKNOWN)
ntdll.dll|RtlNumberGenericTableElementsAvl(UNKNOWN)
ntdll.dll|RtlNumberOfClearBits(UNKNOWN)
ntdll.dll|RtlNumberOfSetBits(UNKNOWN)
;RtlOemStringToUnicodeSize() has the same entry point as RtlAnsiStringToUnicodeSize
!ntdll.dll|RtlOemStringToUnicodeSize(PANSI_STRING  AnsiString)
ntdll.dll|RtlOemStringToUnicodeString(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlOemToUnicodeN(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlOpenCurrentUser(UNKNOWN,UNKNOWN)
ntdll.dll|PVOID RtlPcToFileHeader( PVOID PcValue, PVOID* BaseOfImage)|Out
ntdll.dll|RtlPinAtomInAtomTable(UNKNOWN,UNKNOWN)
ntdll.dll|RtlPopFrame(UNKNOWN)
ntdll.dll|RtlPrefixString(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlPrefixUnicodeString(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlProtectHeap(PVOID HeapHandle,BOOLEAN Protect)
ntdll.dll|RtlPushFrame(UNKNOWN)
ntdll.dll|RtlQueryAtomInAtomTable(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlQueryDepthSList(UNKNOWN)
ntdll.dll|RtlQueryEnvironmentVariable_U(PVOID Env,PUNICODE_STRING VarName,PUNICODE_STRING VarValue)|Out
ntdll.dll|RtlQueryHeapInformation(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlQueryInformationAcl(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlQueryInformationActivationContext(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlQueryInformationActiveActivationContext(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlQueryInterfaceMemoryStream(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlQueryProcessBackTraceInformation(UNKNOWN)
ntdll.dll|RtlQueryProcessDebugInformation(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlQueryProcessHeapInformation(UNKNWON)
ntdll.dll|RtlQueryProcessLockInformation(UNKNWON)
ntdll.dll|RtlQueryRegistryValues(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlQuerySecurityObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlQueryTagHeap(UNKNWON,UNKNWON,UNKNWON,UNKNWON,UNKNWON)
ntdll.dll|RtlQueryTimeZoneInformation(UNKNOWN)
ntdll.dll|RtlQueueApcWow64Thread(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlQueueWorkItem(UNKNOWN,UNKNOWN,UNKNOWN)
!ntdll.dll|RtlRaiseException(UNKNOWN,UNKNOWN)
ntdll.dll|RtlRaiseStatus(UNKNOWN)
ntdll.dll|RtlRandom(UNKNOWN)
ntdll.dll|RtlRandomEx(UNKNOWN)
ntdll.dll|RtlReAllocateHeap(PVOID HeapHandle,ULONG Flages,PVOID MemoryPointer,ULONG Size)|Out
ntdll.dll|RtlReadMemoryStream(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlReadOutOfProcessMemoryStream(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlRealPredecessor(UNKNOWN)
ntdll.dll|RtlRealSuccessor(UNKNOWN)
ntdll.dll|RtlRegisterSecureMemoryCacheCallback(UNKNOWN)
ntdll.dll|RtlRegisterWait(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlReleaseActivationContext(UNKNOWN)
ntdll.dll|RtlReleaseMemoryStream(UNKNOWN)
ntdll.dll|RtlReleasePebLock()
ntdll.dll|RtlReleaseResource(PVOID ResourceHandle)
ntdll.dll|RtlRemoteCall(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlRemoveVectoredExceptionHandler(UNKNOWN)
ntdll.dll|RtlResetRtlTranslations(UNKNOWN)
;lots of call
!ntdll.dll|RtlRestoreLastWin32Error(UNKNOWN)
ntdll.dll|RtlRevertMemoryStream(UNKNOWN)
ntdll.dll|RtlRunDecodeUnicodeString(UNKNOWN,UNKNOWN)
ntdll.dll|RtlRunEncodeUnicodeString(UNKNOWN,UNKNOWN)
ntdll.dll|RtlSecondsSince1970ToTime(UNKNOWN,UNKNOWN)
ntdll.dll|RtlSecondsSince1980ToTime(UNKNOWN,UNKNOWN)
ntdll.dll|RtlSeekMemoryStream(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSelfRelativeToAbsoluteSD(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSelfRelativeToAbsoluteSD2(UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetAllBits(UNKNOWN)
ntdll.dll|RtlSetAttributesSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetBits(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetControlSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetCriticalSectionSpinCount(LPCRITICAL_SECTION lpCriticalSection,DWORD dwSpinCount)
ntdll.dll|RtlSetCurrentDirectory_U(LPWSTR lpPathName)|FailureIfNullRet
ntdll.dll|RtlSetCurrentEnvironment(PVOID NewEnv,PVOID OldEnv)|Out
ntdll.dll|RtlSetDaclSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetEnvironmentVariable(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetGroupSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetHeapInformation(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetInformationAcl(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetIoCompletionCallback(UNKNOWN,UNKNOWN,UNKNOWN)
;RtlSetLastWin32Error() has the same entry point as RtlRestoreLastWin32Error
!ntdll.dll|RtlSetLastWin32Error(UNKNOWN) has the same entry point as RtlRestoreLastWin32Error
ntdll.dll|RtlSetLastWin32ErrorAndNtStatusFromNtStatus(UNKNOWN)
ntdll.dll|RtlSetMemoryStreamSize(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetOwnerSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetProcessIsCritical()
ntdll.dll|RtlSetSaclSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetSecurityDescriptorRMControl(UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetSecurityObject(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetSecurityObjectEx(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetThreadIsCritical()
ntdll.dll|RtlSetThreadPoolStartFunc(UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetTimeZoneInformation(UNKNOWN)
ntdll.dll|RtlSetTimer(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetUserFlagsHeap(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSetUserValueHeap(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlSizeHeap(PVOID HeapHandle,ULONG Flags,PVOID MemoryPointer)
ntdll.dll|RtlSplay(UNKNOWN)
ntdll.dll|RtlStartRXact(UNKNOWN)
ntdll.dll|RtlStatMemoryStream(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlStringFromGUID(REFGUID Guid,PUNICODE_STRING GuidString)|Out
ntdll.dll|RtlSubAuthorityCountSid(UNKNOWN)
ntdll.dll|RtlSubAuthoritySid(UNKNOWN,UNKNOWN)
ntdll.dll|RtlSubtreePredecessor(UNKNOWN)
ntdll.dll|RtlSubtreeSuccessor(UNKNOWN)
ntdll.dll|RtlSystemTimeToLocalTime(UNKNOWN,UNKNOWN)|Out
ntdll.dll|RtlTimeFieldsToTime(UNKNOWN,UNKNOWN)|Out
ntdll.dll|RtlTimeToElapsedTimeFields(UNKNOWN,UNKNOWN)|Out
ntdll.dll|BOOLEAN RtlTimeToSecondsSince1970( PLARGE_INTEGER Time, PULONG ElapsedSeconds)|Out
ntdll.dll|RtlTimeToSecondsSince1980(PLARGE_INTEGER Time, PULONG ElapsedSeconds)|Out
;lots of call
!ntdll.dll|RtlTimeToTimeFields(PLARGE_INTEGER,PTIME_FIELDS)|Out
ntdll.dll|RtlTraceDatabaseAdd(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlTraceDatabaseCreate(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlTraceDatabaseDestroy(UNKNOWN)
ntdll.dll|RtlTraceDatabaseEnumerate(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlTraceDatabaseFind(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlTraceDatabaseLock(UNKNOWN)
ntdll.dll|RtlTraceDatabaseUnlock(UNKNOWN)
ntdll.dll|RtlTraceDatabaseValidate(UNKNOWN)
; incompatible with RtlpWaitForCriticalSection on some systems
;RtlTryEnterCriticalSection hooking seems to crash sometimes
!ntdll.dll|RtlTryEnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
ntdll.dll|RtlUlongByteSwap()
ntdll.dll|RtlUlonglongByteSwap()
ntdll.dll|RtlUnhandledExceptionFilter(UNKNWON)
ntdll.dll|RtlUnhandledExceptionFilter2(UNKNWON,UNKNWON)
ntdll.dll|RtlUnicodeStringToAnsiSize(PUNICODE_STRING)
ntdll.dll|NTSTATUS RtlUnicodeStringToAnsiString( PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)|Out
ntdll.dll|RtlUnicodeStringToCountedOemString(UNKNWON,UNKNWON,UNKNWON)
ntdll.dll|RtlUnicodeStringToInteger(UNKNWON,UNKNWON,UNKNWON)
;RtlUnicodeStringToOemSize() has the same entry point as RtlUnicodeStringToAnsiSize
;ntdll.dll|RtlUnicodeStringToOemSize(PUNICODE_STRING)
ntdll.dll|NTSTATUS RtlUnicodeStringToOemString( POEM_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)|Out
ntdll.dll|RtlUnicodeToCustomCPN(UNKNWON,UNKNWON,UNKNWON,UNKNWON,UNKNWON,UNKNWON)
ntdll.dll|RtlUnicodeToMultiByteN(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|NTSTATUS RtlUnicodeToMultiByteSize( PULONG BytesInMultiByteString, PWCH UnicodeString, ULONG BytesInUnicodeString)|Out
ntdll.dll|RtlUnicodeToOemN(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|ULONG RtlUniform( PULONG Seed)|Out
ntdll.dll|RtlUnlockBootStatusData(UNKNOWN)
ntdll.dll|RtlUnlockHeap(HANDLE HeapHandle)
;RtlUnlockMemoryStreamRegion() has the same entry point as RtlCopyOutOfProcessMemoryStreamTo
!ntdll.dll|RtlUnlockMemoryStreamRegion(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|void RtlUnwind( PVOID TargetFrame, PVOID TargetIp, PEXCEPTION_RECORD ExceptionRecord, PVOID ReturnValue)|Out
ntdll.dll|RtlUpcaseUnicodeChar(WCHAR)
ntdll.dll|RtlUpcaseUnicodeString(UNKNWON,UNKNWON,UNKNWON)
ntdll.dll|RtlUpcaseUnicodeStringToAnsiString(UNKNWON,UNKNWON,UNKNWON)
ntdll.dll|RtlUpcaseUnicodeStringToCountedOemString(UNKNWON,UNKNWON,UNKNWON)
ntdll.dll|RtlUpcaseUnicodeStringToOemString(UNKNWON,UNKNWON,UNKNWON)
ntdll.dll|RtlUpcaseUnicodeToCustomCPN(UNKNWON,UNKNWON,UNKNWON,UNKNWON,UNKNWON,UNKNWON)
ntdll.dll|RtlUpcaseUnicodeToMultiByteN(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlUpcaseUnicodeToOemN(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlUpdateTimer(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlUpperChar(UNKNOWN)
ntdll.dll|RtlUpperString(UNKNWON,UNKNWON)
ntdll.dll|RtlUsageHeap(UNKNWON,UNKNWON,UNKNWON)
ntdll.dll|RtlUshortByteSwap()
ntdll.dll|RtlValidAcl(PACL pAcl)
ntdll.dll|RtlValidRelativeSecurityDescriptor(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlValidSecurityDescriptor(PSECURITY_DESCRIPTOR pSecDesc)
ntdll.dll|RtlValidSid(PSID pSid)
; lots of call
!ntdll.dll|RtlValidateHeap(PVOID HeapHandle,ULONG Flags,PVOID AddressToValidate)
ntdll.dll|RtlValidateProcessHeaps()
;lots of call
!ntdll.dll|RtlValidateUnicodeString(UNKNOWN,UNKNOWN)
ntdll.dll|RtlVerifyVersionInfo(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlWalkFrameChain(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlWalkHeap(PVOID HeapHandle,LPPROCESS_HEAP_ENTRY)
ntdll.dll|RtlWriteMemoryStream(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlWriteRegistryValue(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlZeroHeap(PVOID HeapHandle,SIZE_T Length)
ntdll.dll|RtlZeroMemory(PVOID Destination,SIZE_T Length)
ntdll.dll|RtlZombifyActivationContext(UNKNOWN)
ntdll.dll|RtlpApplyLengthFunction(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlpEnsureBufferSize(UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlpNotOwnerCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
ntdll.dll|RtlpNtCreateKey(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlpNtEnumerateSubKey(UNKNWON,UNKNWON,UNKNWON)
ntdll.dll|RtlpNtMakeTemporaryKey(UNKNOWN)
ntdll.dll|RtlpNtOpenKey(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlpNtQueryValueKey(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlpNtSetValueKey(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|RtlpUnWaitCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
;incompatible with RtlTryEnterCriticalSection on some system
!ntdll.dll|RtlpWaitForCriticalSection(LPCRITICAL_SECTION lpCriticalSection)

;RtlxAnsiStringToUnicodeSize() has the same entry point as RtlAnsiStringToUnicodeSize
!ntdll.dll|RtlxAnsiStringToUnicodeSize(PANSI_STRING)
;RtlxOemStringToUnicodeSize() has the same entry point as RtlAnsiStringToUnicodeSize
!ntdll.dll|RtlxOemStringToUnicodeSize(PANSI_STRING)
;RtlxUnicodeStringToAnsiSize() has the same entry point as RtlUnicodeStringToAnsiSize
!ntdll.dll|RtlxUnicodeStringToAnsiSize(PUNICODE_STRING)
;RtlxUnicodeStringToOemSize() has the same entry point as RtlUnicodeStringToAnsiSize
!ntdll.dll|RtlxUnicodeStringToOemSize(PUNICODE_STRING)

; not on all systems
!ntdll.dll|SaveEm87Context(UNKNWON)
ntdll.dll|ULONGLONG VerSetConditionMask( ULONGLONG dwlConditionMask, DWORD dwTypeBitMask, BYTE dwConditionMask)

ntdll.dll|_CIcos()
ntdll.dll|_CIlog()
ntdll.dll|_CIpow()
ntdll.dll|_CIsin()
ntdll.dll|_CIsqrt()

ntdll.dll|int __isascii( int c )
ntdll.dll|int __iscsym( int c )
ntdll.dll|__iscsymf( int c )
ntdll.dll|int __toascii( int c )
ntdll.dll|_alldiv(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|_alldvrm(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|_allmul(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
;fail
!ntdll.dll|_alloca_probe(UNKNOWN)
;_chkstk() has the same entry point as _alloca_probe
!ntdll.dll|_chkstk()
ntdll.dll|_allrem(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|_allshl()
ntdll.dll|_allshr()
ntdll.dll|_atoi64( const char *string )|Out
ntdll.dll|_aulldiv(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|_aulldvrm(DWORD,UNKNOWN,DWORD,UNKNOWN)
ntdll.dll|_aullrem(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|_aullshr()

;ntdll.dll|_fltused()
ntdll.dll|_ftol()
ntdll.dll|_i64toa( int value, char *string, int radix )|Out
ntdll.dll|_i64tow( int value, char *string, int radix )|Out
ntdll.dll|char * _itoa( int value, char *string, int radix )|Out
ntdll.dll|_itow( int value, char *string, int radix )|Out
ntdll.dll|void * _lfind( const void *key, const void *base, unsigned int *num, unsigned int width, FARPROC)|Out
ntdll.dll|char * _ltoa( long value, char *string, int radix )|Out
ntdll.dll|_ltow( long value, char *string, int radix )|Out
ntdll.dll|void * _memccpy( void *dest:PointedDataSize=Arg4, const void *src:PointedDataSize=Arg4, int c, unsigned int count )|Out
ntdll.dll|int _memicmp( const void *buf1:PointedDataSize=Arg3, const void *buf2:PointedDataSize=Arg3, size_t count )|Out
ntdll.dll|int _snprintf( char *buffer, size_t count, const char *format)|Out
ntdll.dll|_snwprintf( char *buffer, size_t count, const char *format)|Out
ntdll.dll|void _splitpath( const char *path, char *drive, char *dir, char *fname, char *ext )|Out
ntdll.dll|_strcmpi(char*,char*)
;_stricmp()
!ntdll.dll|_stricmp(char*,char*)
ntdll.dll|char * _strlwr( char *string )|Out
ntdll.dll|int _strnicmp( const char *string1, const char *string2, size_t count )|Out
ntdll.dll|char * _strupr( char *string )|Out
ntdll.dll|int _tolower( int c )
ntdll.dll|int _toupper( int c )
ntdll.dll|_ui64toa( int value, char *string, int radix )|Out
ntdll.dll|_ui64tow( int value, wchar_t *string, int radix )|Out
ntdll.dll|char * _ultoa( unsigned long value, char *string, int radix )|Out
ntdll.dll|_ultow( unsigned long value, wchar_t *string, int radix )|Out
ntdll.dll|int _vsnprintf( char *buffer, size_t count, const char *format, va_list argptr )|Out
ntdll.dll|_vsnwprintf( char *buffer, size_t count, const char *format, va_list argptr )|Out
ntdll.dll|int _wcsicmp( const wchar_t *string1, const wchar_t *string2 )|Out
ntdll.dll|wchar_t * _wcslwr( wchar_t *string )|Out
ntdll.dll|int _wcsnicmp( const wchar_t *string1, const wchar_t *string2, size_t count )|Out
ntdll.dll|wchar_t * _wcsupr( wchar_t *string )|Out
ntdll.dll|_wtoi( const char *string )|Out
ntdll.dll|__int64 _wtoi64( wchar_t *string )|Out
ntdll.dll|_wtol( const char *string )|Out
ntdll.dll|abs(int)
;labs() has the same entry point as abs
!ntdll.dll|labs(int)
!ntdll.dll|atan(double)
ntdll.dll|atoi( const char *string )
; same as atoi
!ntdll.dll|atol( const char *string )
;lots of call
!ntdll.dll|void * bsearch( const void *key, const void *base, size_t num, size_t width, FARPROC )
ntdll.dll|ceil(double)
ntdll.dll|double cos( double x )
ntdll.dll|double fabs( double x )
ntdll.dll|floor(double)
ntdll.dll|int isalnum( int c )
ntdll.dll|int isalpha( int c )
ntdll.dll|int iscntrl( int c )
ntdll.dll|int isdigit( int c )
ntdll.dll|int isgraph( int c )
ntdll.dll|islower(int)
ntdll.dll|int isprint( int c )
ntdll.dll|int ispunct( int c )
ntdll.dll|int isspace( int c )
ntdll.dll|int isupper( int c )
ntdll.dll|iswalpha( int c )
ntdll.dll|int iswctype( wint_t c, wctype_t desc )
ntdll.dll|iswdigit( int c )
ntdll.dll|iswlower( int c )
ntdll.dll|iswspace( int c )
ntdll.dll|iswxdigit( int c )
ntdll.dll|int isxdigit( int c )
!ntdll.dll|log(double)
ntdll.dll|size_t mbstowcs( wchar_t *wcstr, const char *mbstr, size_t count )|Out
ntdll.dll|void * memchr( const void *buf:PointedDataSize=Arg3, int c, size_t count )|Out
ntdll.dll|int memcmp( const void *buf1:PointedDataSize=Arg3, const void *buf2:PointedDataSize=Arg3, size_t count )|Out
ntdll.dll|void * memcpy( void *dest:PointedDataSize=Arg3, const void *src:PointedDataSize=Arg3, size_t count )|Out
ntdll.dll|void * memmove( void *dest:PointedDataSize=Arg3, const void *src:PointedDataSize=Arg3, size_t count )|Out
ntdll.dll|void * memset( void *dest:PointedDataSize=Arg3, int c, size_t count )|Out
!ntdll.dll|pow(double)
ntdll.dll|void qsort( void *base, size_t num, size_t width, FARPROC)|Out
ntdll.dll|double sin( double x )
ntdll.dll|int sprintf( char *buffer, const char *format)|Out
ntdll.dll|double sqrt( double x )
ntdll.dll|int sscanf( const char *buffer, const char *format)|Out
ntdll.dll|char * strcat( char *strDestination, const char *strSource )|Out
ntdll.dll|char * strchr( const char *string, int c )|Out
ntdll.dll|int strcmp( const char *string1, const char *string2 )|Out
ntdll.dll|char * strcpy( char *strDestination, const char *strSource )|Out
ntdll.dll|size_t strcspn( const char *string, const char *strCharSet )|Out
ntdll.dll|size_t strlen( const char *string )|Out
ntdll.dll|char * strncat( char *strDest, const char *strSource, size_t count )|Out
ntdll.dll|int strncmp( const char *string1, const char *string2, size_t count )|Out
ntdll.dll|char * strncpy( char *strDest, const char *strSource, size_t count )|Out
ntdll.dll|char * strpbrk( const char *string, const char *strCharSet )|Out
ntdll.dll|strrchr( LPCSTR  lpStart, LPCSTR  lpEnd, T HAR wMatch)
ntdll.dll|size_t strspn( const char *string, const char *strCharSet )|Out
ntdll.dll|char * strstr( const char *string, const char *strCharSet )|Out
ntdll.dll|long strtol( const char *nptr, char **endptr, int base )|Out
ntdll.dll|unsigned long strtoul( const char *nptr, char **endptr, int base )|Out
ntdll.dll|swprintf( char *buffer, const char *format)|Out
ntdll.dll|tan(double d)
ntdll.dll|tolower(int c)
ntdll.dll|toupper(int c)
ntdll.dll|int towlower( int c )
ntdll.dll|int towupper( int c )
ntdll.dll|vDbgPrintEx(ULONG ComponentId,ULONG Level,PCHAR Format,UNKNOWN)
ntdll.dll|vDbgPrintExWithPrefix(UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN,UNKNOWN)
ntdll.dll|int vsprintf( char *buffer, const char *format, va_list argptr )|Out
ntdll.dll|wchar_t * wcscat( wchar_t *strDestination, const wchar_t *strSource )|Out
ntdll.dll|wchar_t * wcschr( const wchar_t *string, wint_t c )|Out
ntdll.dll|int wcscmp( const wchar_t *string1, const wchar_t *string2 )|Out
ntdll.dll|wchar_t * wcscpy( wchar_t *strDestination, const wchar_t *strSource )|Out
ntdll.dll|size_t wcscspn( const wchar_t *string, const wchar_t *strCharSet )|Out
ntdll.dll|size_t wcslen( const wchar_t *string )|Out
ntdll.dll|wchar_t * wcsncat( wchar_t *strDest, const wchar_t *strSource, size_t count )|Out
ntdll.dll|int wcsncmp( const wchar_t *string1, const wchar_t *string2, size_t count )|Out
ntdll.dll|wchar_t * wcsncpy( wchar_t *strDest, const wchar_t *strSource, size_t count )|Out
ntdll.dll|wchar_t * wcspbrk( const wchar_t *string, const wchar_t *strCharSet )|Out
ntdll.dll|char * wcsrchr( const wchar_t *string, int c )|Out
ntdll.dll|size_t wcsspn( const wchar_t *string, const wchar_t *strCharSet )|Out
ntdll.dll|wchar_t * wcsstr( const wchar_t *string, const wchar_t *strCharSet )|Out
ntdll.dll|long wcstol( const wchar_t *nptr, wchar_t **endptr, int base )|Out
ntdll.dll|wcstombs(char *mbstr, const wchar_t *wcstr, size_t count)|Out
ntdll.dll|unsigned long wcstoul( const wchar_t *nptr, wchar_t **endptr, int base )|Out


; put in last to avoid to hook our own call
ntdll.dll|NTSTATUS NTAPI LdrGetDllHandle(PWORD pwPath,PVOID,PUNICODE_STRING ModuleFileName,PHANDLE pHModule)|Out|FailureIfNotNullRet
ntdll.dll|NTSTATUS NTAPI LdrGetDllHandleEx(UNKNOWN,PWORD pwPath,PVOID,PUNICODE_STRING ModuleFileName,PHANDLE pHModule)|Out|FailureIfNotNullRet
ntdll.dll|NTSTATUS NTAPI LdrGetProcedureAddress(HMODULE ModuleHandle,PANSI_STRING FunctionName,WORD Ordinal,PVOID FunAddr)|Out|FailureIfNotNullRet