Manalyze report for a44b354cfb777090022ebea8e3b4d3713693ece8b59459ed3c0d6b3d29411c3d

Summary

Architecture	`IMAGE_FILE_MACHINE_AMD64`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
Compilation Date	2043-Jun-04 23:08:35
Detected languages	English - United States
Debug artifacts	ntdll.pdb
CompanyName	Microsoft Corporation
FileDescription	NT Layer DLL
FileVersion	`10.0.19041.4522 (WinBuild.160101.0800)`
InternalName	ntdll.dll
LegalCopyright	Â© Microsoft Corporation. All rights reserved.
OriginalFilename	ntdll.dll
ProductName	MicrosoftÂ® WindowsÂ® Operating System
ProductVersion	`10.0.19041.4522`

Plugin Output

Suspicious	Strings found in the binary may indicate undesirable behavior:	`Tries to detect virtualized environments: HARDWARE\DESCRIPTION\System` `May have dropper capabilities: CurrentControlSet\Services` `Miscellaneous malware strings: virus` `Contains domain names: go.microsoft.com http://go.microsoft.com http://go.microsoft.com/fwlink/?LinkId http://schemas.microsoft.com http://schemas.microsoft.com/SMI/2005/WindowsSettings http://schemas.microsoft.com/SMI/2019/WindowsSettings http://schemas.microsoft.com/SMI/2020/WindowsSettings https://go.microsoft.com https://go.microsoft.com/fwlink/?linkid microsoft.com schemas.microsoft.com`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to MD5` `Uses constants related to SHA1` `Uses constants related to SHA256`
Suspicious	The PE is possibly packed.	`Unusual section name found: PAGE` `Unusual section name found: RT` `Unusual section name found: .mrdata` `Unusual section name found: .SCY` `Section .SCY is both writable and executable.` `The PE only has 6 import(s).`
Suspicious	The PE contains functions most legitimate programs don't use.	`Uses Windows's Native API: NtClose NtDeviceIoControlFile NtCreateFile NtOpenKey NtQueryValueKey NtQueryInformationToken`
Suspicious	The file contains overlay data.	`3048 bytes of data starting at offset 0x1ef618.`
Suspicious	No VirusTotal score.	`This file has never been scanned on VirusTotal.`

Hashes

MD5	`b1147a553d01ac1b65003b0eb7065a95` 🔍
SHA1	`82c5707ba7bdfc3064ca7ccb09875e6f5ccce5ce` 🔍
SHA256	`a44b354cfb777090022ebea8e3b4d3713693ece8b59459ed3c0d6b3d29411c3d` 🔍
SHA3	`148445619cd8c4eda846926996b90c5f78a0c85879abd071a90199585fa8b5f7` 🔍
SSDeep	`24576:NeA0kiOo0drbGnlVnBsr2Yk3m04810qe3mQMbV2eeV6uGlX+TtgoARjN7vRA:IA5f5Wrsr2YgWZEseeM3J+Ttw` 🔍
Imports Hash	`d642e005d2f56c5658035b9d66d561ea` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x90`
e_cp	`0x3`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0xffff`
e_ss	`0`
e_sp	`0xb8`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0xe8`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_AMD64`
NumberofSections	`11`
TimeDateStamp	2043-Jun-04 23:08:35
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xf0`
Characteristics	`IMAGE_FILE_DLL` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32+`
LinkerVersion	`14.0`
SizeOfCode	`0x119a00`
SizeOfInitializedData	`0xd6200`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x00000000000A0FF4 (Section: .text)`
BaseOfCode	`0x1000`
ImageBase	`0x7ffdca810000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`A.0`
ImageVersion	`A.0`
SubsystemVersion	`A.0`
Win32VersionValue	`0`
SizeOfImage	`0x1f9000`
SizeOfHeaders	`0x400`
Checksum	`0x1f4acc`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_CUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_GUARD_CF` `IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT`
SizeofStackReserve	`0x40000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`5a4bff509790bf1efb5f57a472ba4ccd 🔍`
SHA1	`dfc766b09c002f0612c9de3da81cd00eca8e2b1a 🔍`
SHA256	`be32b6418baaf988f4dedd04b568df04d968b84355018e23ebe833174d03c934 🔍`
SHA3	`37e58a94831a33998dae9456fe563ecc77168baf90ce4c63b48839e14ccbac37 🔍`
VirtualSize	`0x11a000`
VirtualAddress	`0x1000`
SizeOfRawData	`0x119200`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.50622`

PAGE

MD5	`6a0545c6c0b9604bf3823972d86a2eb9 🔍`
SHA1	`f9870f99bef30ce497687dd6131040512c92a7df 🔍`
SHA256	`1e636a0e448fb1d100c9d6363f6507c178b5902d69007481d464251ac1e852e3 🔍`
SHA3	`b9cd352ebce0b247619ea5042986e9dcadde956cebe2c8038905f2e71f3f130f 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0x11b000`
SizeOfRawData	`0x600`
PointerToRawData	`0x119600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.05147`

RT

MD5	`24eb79591f573ad0289c5a608ec03913 🔍`
SHA1	`e8490caf57aac339c3d494746d10f67dd979f8ec 🔍`
SHA256	`6e27513d73ec50cf590da6cc201f6ae8bf11479c5f357588529b98075027a756 🔍`
SHA3	`dc71c34de75a3ed3dd3f5c6e0c627c43a2c19311c2762297bedeac38b8749d87 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0x11c000`
SizeOfRawData	`0x200`
PointerToRawData	`0x119c00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`5.66292`

.rdata

MD5	`ab84c12dee6880e6b8f2d27192858e15 🔍`
SHA1	`4bf1e91126cb056efeaf04237ef57a6718f2b35a 🔍`
SHA256	`237249bfc7ac1ab85232ae7824b9bbe903dfa2c0b4aecc71746e878d0d44e296 🔍`
SHA3	`1f284007ab171faf09eca4e28cc61efba54bfe8830af472d7b9f7d8db7362bbc 🔍`
VirtualSize	`0x49000`
VirtualAddress	`0x11d000`
SizeOfRawData	`0x48200`
PointerToRawData	`0x119e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`6.20533`

.data

MD5	`a82928cb41088790a3c231ed95371d7b 🔍`
SHA1	`0e0ced04a09b76f3c47de76936fcbf594b38e6e7 🔍`
SHA256	`1fbd4f61d023136358cfe326dfae3fb64bea0f34857206be7d729f1548355b97 🔍`
SHA3	`a42d1febf0d482e90bd7a552f31f3ddb30d75aafd26fac7703b8aef63c8146d2 🔍`
VirtualSize	`0xc000`
VirtualAddress	`0x166000`
SizeOfRawData	`0xb600`
PointerToRawData	`0x162000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`2.46294`

.pdata

MD5	`4aef85f8aea6ed3e9a50fff44b986005 🔍`
SHA1	`4bf885e5249b49ca10f3b0ca140dfb8a97fdeb75 🔍`
SHA256	`a6a58d39eb5d106b41a1580fef55f4e3f20526ea62a6da0f53763da40fd0f083 🔍`
SHA3	`65c8be23e2d18ade68bb3963f68b58b65189c5b08b536360ad5d6b91eddad60a 🔍`
VirtualSize	`0xf000`
VirtualAddress	`0x172000`
SizeOfRawData	`0xe600`
PointerToRawData	`0x16d600`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`6.02723`

.mrdata

MD5	`511e353f02894ea944716d998929aa62 🔍`
SHA1	`bbd5805c0f70297c0cab570bd83e51a2b547bd51 🔍`
SHA256	`5d5e46c30c3143c1384b0374ce9827c5b128ee50d979ba2f7d9d9068f5d68447 🔍`
SHA3	`5c8c5f609c5a7c3f0cddb378f5ee5c2538c27b0438f05ea925c4da2074967fab 🔍`
VirtualSize	`0x4000`
VirtualAddress	`0x181000`
SizeOfRawData	`0x3600`
PointerToRawData	`0x17bc00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.533961`

.00cfg

MD5	`643053e0e2aa8e0808ec37b7a57330d7 🔍`
SHA1	`060150f7bb7609bfffc92c0cf18483565d3b928e 🔍`
SHA256	`6f7dc9793f661936a80c3d36b0972df24dfad98046d033f1015f0d5b0619e63c 🔍`
SHA3	`f8b013cfac978817ebfd958a1700b97fde28961698478c2d31fe8f0c4608cbc5 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0x185000`
SizeOfRawData	`0x200`
PointerToRawData	`0x17f200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`0.122276`

.rsrc

MD5	`474cdb29ef041447e27ef54bca7a9289 🔍`
SHA1	`a5def2760a458346f9a0f38b803a12ce71248c84 🔍`
SHA256	`0d042141dfb5855e5f05643f066ea7c3f57f4074e12a2694e1dba80b94f1cf61 🔍`
SHA3	`045a81337e5a4d1e822cd6ce4c3d3a1cea852964fa6896050b0d214df44ac9f4 🔍`
VirtualSize	`0x71000`
VirtualAddress	`0x186000`
SizeOfRawData	`0x70600`
PointerToRawData	`0x17f400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`3.34609`

.reloc

MD5	`b547135c5def993f7e58765d632e0217 🔍`
SHA1	`2a0786c9ce6e63887103de3c4a62113f37fea98b 🔍`
SHA256	`5d0c2e8037db8f98243f919060d645750c6ebc656eb9c3097efbee9199781234 🔍`
SHA3	`32c8c3f77fc94ae55b66fff531ca1813274d64718aed34067f2c9a9550be04d8 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0x1f7000`
SizeOfRawData	`0x600`
PointerToRawData	`0x1efa00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`5.08828`

.SCY

MD5	`af836d7d4cf4f88804727051ba05b432 🔍`
SHA1	`36947360b26f4120800e4e4357380e3ef34b71f5 🔍`
SHA256	`a03649be0778475b079fbc4e3c61a6fa49b5dc145cad8f02a9da5f4b7aad90b2 🔍`
SHA3	`654fc6a76ed210e0de76f28398dbfcf81d12972134785d966213b0703bf02c02 🔍`
VirtualSize	`0x1000`
VirtualAddress	`0x1f8000`
SizeOfRawData	`0x200`
PointerToRawData	`0x1f0000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`2.65359`

Imports

ntdll.dll	`NtClose` `NtDeviceIoControlFile` `NtCreateFile` `NtOpenKey` `NtClose` `NtQueryValueKey` `NtQueryInformationToken` `NtQueryValueKey` `NtOpenKey`

Delayed Imports

Ordinal	`8`
Address	`0x7fb20`

A_SHAFinal

Ordinal	`9`
Address	`0x40240`

A_SHAInit

Ordinal	`10`
Address	`0x41070`

A_SHAUpdate

Ordinal	`11`
Address	`0x410b0`

AlpcAdjustCompletionListConcurrencyCount

Ordinal	`12`
Address	`0xe0860`

AlpcFreeCompletionListMessage

Ordinal	`13`
Address	`0x71740`

AlpcGetCompletionListLastMessageInformation

Ordinal	`14`
Address	`0xe0890`

AlpcGetCompletionListMessageAttributes

Ordinal	`15`
Address	`0xe08b0`

AlpcGetHeaderSize

Ordinal	`16`
Address	`0x71470`

AlpcGetMessageAttribute

Ordinal	`17`
Address	`0x71430`

AlpcGetMessageFromCompletionList

Ordinal	`18`
Address	`0x10a60`

AlpcGetOutstandingCompletionListMessageCount

Ordinal	`19`
Address	`0x86390`

AlpcInitializeMessageAttribute

Ordinal	`20`
Address	`0x713d0`

AlpcMaxAllowedMessageLength

Ordinal	`21`
Address	`0x84d30`

AlpcRegisterCompletionList

Ordinal	`22`
Address	`0x86210`

AlpcRegisterCompletionListWorkerThread

Ordinal	`23`
Address	`0x76250`

AlpcRundownCompletionList

Ordinal	`24`
Address	`0x86350`

AlpcUnregisterCompletionList

Ordinal	`25`
Address	`0x86370`

AlpcUnregisterCompletionListWorkerThread

Ordinal	`26`
Address	`0x761f0`

ApiSetQueryApiSetPresence

Ordinal	`27`
Address	`0x77eb0`

ApiSetQueryApiSetPresenceEx

Ordinal	`28`
Address	`0x6a680`

CsrAllocateCaptureBuffer

Ordinal	`29`
Address	`0x8d50`

CsrAllocateMessagePointer

Ordinal	`30`
Address	`0x8d00`

CsrCaptureMessageBuffer

Ordinal	`31`
Address	`0x8850`

CsrCaptureMessageMultiUnicodeStringsInPlace

Ordinal	`32`
Address	`0x8b40`

CsrCaptureMessageString

Ordinal	`33`
Address	`0x8c50`

CsrCaptureTimeout

Ordinal	`34`
Address	`0xcb500`

CsrClientCallServer

Ordinal	`35`
Address	`0x89a0`

CsrClientConnectToServer

Ordinal	`36`
Address	`0x8e20`

CsrFreeCaptureBuffer

Ordinal	`37`
Address	`0x8970`

CsrGetProcessId

Ordinal	`38`
Address	`0xcb530`

CsrIdentifyAlertableThread

Ordinal	`39`
Address	`0x847c0`

CsrSetPriorityClass

Ordinal	`40`
Address	`0xd53b0`

CsrVerifyRegion

Ordinal	`41`
Address	`0xcb550`

DbgBreakPoint

Ordinal	`42`
Address	`0xa1090`

DbgPrint

Ordinal	`43`
Address	`0x51ac0`

DbgPrintEx

Ordinal	`44`
Address	`0x51450`

DbgPrintReturnControlC

Ordinal	`45`
Address	`0xe08f0`

DbgPrompt

Ordinal	`46`
Address	`0xe0940`

DbgQueryDebugFilterState

Ordinal	`47`
Address	`0xe0990`

DbgSetDebugFilterState

Ordinal	`48`
Address	`0xe09a0`

DbgUiConnectToDbg

Ordinal	`49`
Address	`0xcc650`

DbgUiContinue

Ordinal	`50`
Address	`0xcc6c0`

DbgUiConvertStateChangeStructure

Ordinal	`51`
Address	`0xcc6f0`

DbgUiConvertStateChangeStructureEx

Ordinal	`52`
Address	`0xcc700`

DbgUiDebugActiveProcess

Ordinal	`53`
Address	`0xcc9b0`

DbgUiGetThreadDebugObject

Ordinal	`54`
Address	`0xcca20`

DbgUiIssueRemoteBreakin

Ordinal	`55`
Address	`0xcca40`

DbgUiRemoteBreakin

Ordinal	`56`
Address	`0xccab0`

DbgUiSetThreadDebugObject

Ordinal	`57`
Address	`0xccb10`

DbgUiStopDebugging

Ordinal	`58`
Address	`0xccb30`

DbgUiWaitStateChange

Ordinal	`59`
Address	`0xccb50`

DbgUserBreakPoint

Ordinal	`60`
Address	`0xa10a0`

EtwCheckCoverage

Ordinal	`61`
Address	`0x86180`

EtwCreateTraceInstanceId

Ordinal	`62`
Address	`0x110950`

EtwDeliverDataBlock

Ordinal	`63`
Address	`0x452b0`

EtwEnumerateProcessRegGuids

Ordinal	`64`
Address	`0x110530`

EtwEventActivityIdControl

Ordinal	`65`
Address	`0x5cbf0`

EtwEventEnabled

Ordinal	`66`
Address	`0x51db0`

EtwEventProviderEnabled

Ordinal	`67`
Address	`0x75ab0`

EtwEventRegister

Ordinal	`68`
Address	`0x42e80`

EtwEventSetInformation

Ordinal	`69`
Address	`0x42af0`

EtwEventUnregister

Ordinal	`70`
Address	`0x514e0`

EtwEventWrite

Ordinal	`71`
Address	`0x50300`

EtwEventWriteEndScenario

Ordinal	`72`
Address	`0x4fd30`

EtwEventWriteEx

Ordinal	`73`
Address	`0x502b0`

EtwEventWriteFull

Ordinal	`74`
Address	`0x50260`

EtwEventWriteNoRegistration

Ordinal	`75`
Address	`0x61eb0`

EtwEventWriteStartScenario

Ordinal	`76`
Address	`0x8a3e0`

EtwEventWriteString

Ordinal	`77`
Address	`0x110630`

EtwEventWriteTransfer

Ordinal	`78`
Address	`0x50340`

EtwGetTraceEnableFlags

Ordinal	`79`
Address	`0x81d80`

EtwGetTraceEnableLevel

Ordinal	`80`
Address	`0x81d40`

EtwGetTraceLoggerHandle

Ordinal	`81`
Address	`0x81d00`

EtwLogTraceEvent

Ordinal	`82`
Address	`0x50ca0`

EtwNotificationRegister

Ordinal	`83`
Address	`0x43040`

EtwNotificationUnregister

Ordinal	`84`
Address	`0x514f0`

EtwProcessPrivateLoggerRequest

Ordinal	`85`
Address	`0x49af0`

EtwRegisterSecurityProvider

Ordinal	`86`
Address	`0x8c580`

EtwRegisterTraceGuidsA

Ordinal	`87`
Address	`0x85840`

EtwRegisterTraceGuidsW

Ordinal	`88`
Address	`0x42a10`

EtwReplyNotification

Ordinal	`89`
Address	`0x19a0`

EtwSendNotification

Ordinal	`90`
Address	`0x51690`

EtwSetMark

Ordinal	`91`
Address	`0x8aea0`

EtwTraceEventInstance

Ordinal	`92`
Address	`0x1109b0`

EtwTraceMessage

Ordinal	`93`
Address	`0x517c0`

EtwTraceMessageVa

Ordinal	`94`
Address	`0x517f0`

EtwUnregisterTraceGuids

Ordinal	`95`
Address	`0x51490`

EtwWriteUMSecurityEvent

Ordinal	`96`
Address	`0x7c8d0`

EtwpCreateEtwThread

Ordinal	`97`
Address	`0x48710`

EtwpGetCpuSpeed

Ordinal	`98`
Address	`0x49de0`

EvtIntReportAuthzEventAndSourceAsync

Ordinal	`99`
Address	`0x111910`

EvtIntReportEventAndSourceAsync

Ordinal	`100`
Address	`0x4fe20`

ExpInterlockedPopEntrySListEnd

Ordinal	`101`
Address	`0xa1140`

ExpInterlockedPopEntrySListFault

Ordinal	`102`
Address	`0xa1137`

ExpInterlockedPopEntrySListResume

Ordinal	`103`
Address	`0xa1127`

KiRaiseUserExceptionDispatcher

Ordinal	`104`
Address	`0xa1480`

KiUserApcDispatcher

Ordinal	`105`
Address	`0xa12a0`

KiUserCallbackDispatcher

Ordinal	`106`
Address	`0xa13c0`

KiUserExceptionDispatcher

Ordinal	`107`
Address	`0xa1410`

KiUserInvertedFunctionTable

Ordinal	`108`
Address	`0x181500`

LdrAccessResource

Ordinal	`109`
Address	`0x207a0`

LdrAddDllDirectory

Ordinal	`110`
Address	`0x8bcf0`

LdrAddLoadAsDataTable

Ordinal	`111`
Address	`0x74120`

LdrAddRefDll

Ordinal	`112`
Address	`0x10140`

LdrAppxHandleIntegrityFailure

Ordinal	`113`
Address	`0xcb5a0`

LdrCallEnclave

Ordinal	`114`
Address	`0xccb80`

LdrControlFlowGuardEnforced

Ordinal	`115`
Address	`0x33520`

LdrCreateEnclave

Ordinal	`116`
Address	`0xccb90`

LdrDeleteEnclave

Ordinal	`117`
Address	`0xccca0`

LdrDisableThreadCalloutsForDll

Ordinal	`118`
Address	`0xef70`

LdrEnumResources

Ordinal	`119`
Address	`0xe0be0`

LdrEnumerateLoadedModules

Ordinal	`120`
Address	`0x5edd0`

LdrFastFailInLoaderCallout

Ordinal	`121`
Address	`0x84b70`

LdrFindEntryForAddress

Ordinal	`122`
Address	`0x539e0`

LdrFindResourceDirectory_U

Ordinal	`123`
Address	`0xe0eb0`

LdrFindResourceEx_U

Ordinal	`124`
Address	`0x818e0`

LdrFindResource_U

Ordinal	`125`
Address	`0x716a0`

LdrFlushAlternateResourceModules

Ordinal	`126`
Address	`0x89a30`

LdrGetDllDirectory

Ordinal	`127`
Address	`0x7f900`

LdrGetDllFullName

Ordinal	`128`
Address	`0x10240`

LdrGetDllHandle

Ordinal	`129`
Address	`0x16870`

LdrGetDllHandleByMapping

Ordinal	`130`
Address	`0x75720`

LdrGetDllHandleByName

Ordinal	`131`
Address	`0x780c0`

LdrGetDllHandleEx

Ordinal	`132`
Address	`0x168a0`

LdrGetDllPath

Ordinal	`133`
Address	`0x11450`

LdrGetFailureData

Ordinal	`134`
Address	`0xcdee0`

LdrGetFileNameFromLoadAsDataTable

Ordinal	`135`
Address	`0xe0ed0`

LdrGetKnownDllSectionHandle

Ordinal	`136`
Address	`0x847d0`

LdrGetProcedureAddress

Ordinal	`137`
Address	`0x824d0`

LdrGetProcedureAddressEx

Ordinal	`138`
Address	`0x6d030`

LdrGetProcedureAddressForCaller

Ordinal	`139`
Address	`0x2fdc0`

LdrInitShimEngineDynamic

Ordinal	`140`
Address	`0xd04c0`

LdrInitializeEnclave

Ordinal	`141`
Address	`0xccd30`

LdrInitializeThunk

Ordinal	`142`
Address	`0x75c20`

LdrIsModuleSxsRedirected

Ordinal	`143`
Address	`0xcdef0`

LdrLoadAlternateResourceModule

Ordinal	`144`
Address	`0x7e490`

LdrLoadAlternateResourceModuleEx

Ordinal	`145`
Address	`0x34ea0`

LdrLoadDll

Ordinal	`146`
Address	`0x16a10`

LdrLoadEnclaveModule

Ordinal	`147`
Address	`0xcced0`

LdrLockLoaderLock

Ordinal	`148`
Address	`0x7dac0`

LdrOpenImageFileOptionsKey

Ordinal	`149`
Address	`0xe1960`

LdrProcessInitializationComplete

Ordinal	`150`
Address	`0x81240`

LdrProcessRelocationBlock

Ordinal	`151`
Address	`0xe3b40`

LdrProcessRelocationBlockEx

Ordinal	`152`
Address	`0xe3b70`

LdrQueryImageFileExecutionOptions

Ordinal	`153`
Address	`0x7b3d0`

LdrQueryImageFileExecutionOptionsEx

Ordinal	`154`
Address	`0x7b410`

LdrQueryImageFileKeyOption

Ordinal	`155`
Address	`0x7b4b0`

LdrQueryModuleServiceTags

Ordinal	`156`
Address	`0xce0e0`

LdrQueryOptionalDelayLoadedAPI

Ordinal	`157`
Address	`0xce8e0`

LdrQueryProcessModuleInformation

Ordinal	`158`
Address	`0x1430`

LdrRegisterDllNotification

Ordinal	`159`
Address	`0x84f10`

LdrRemoveDllDirectory

Ordinal	`160`
Address	`0x8c400`

LdrRemoveLoadAsDataTable

Ordinal	`161`
Address	`0x748e0`

LdrResFindResource

Ordinal	`162`
Address	`0xe4050`

LdrResFindResourceDirectory

Ordinal	`163`
Address	`0x55420`

LdrResGetRCConfig

Ordinal	`164`
Address	`0x580f0`

LdrResRelease

Ordinal	`165`
Address	`0x8a4e0`

LdrResSearchResource

Ordinal	`166`
Address	`0x554b0`

LdrResolveDelayLoadedAPI

Ordinal	`167`
Address	`0x10380`

LdrResolveDelayLoadsFromDll

Ordinal	`168`
Address	`0xce9a0`

LdrRscIsTypeExist

Ordinal	`169`
Address	`0x34c60`

LdrSetAppCompatDllRedirectionCallback

Ordinal	`170`
Address	`0x847c0`

LdrSetDefaultDllDirectories

Ordinal	`171`
Address	`0x805e0`

LdrSetDllDirectory

Ordinal	`172`
Address	`0x80620`

LdrSetDllManifestProber

Ordinal	`173`
Address	`0x841f0`

LdrSetImplicitPathOptions

Ordinal	`174`
Address	`0xce580`

LdrSetMUICacheType

Ordinal	`175`
Address	`0x8c5c0`

LdrShutdownProcess

Ordinal	`176`
Address	`0x5efb0`

LdrShutdownThread

Ordinal	`177`
Address	`0x17450`

LdrStandardizeSystemPath

Ordinal	`178`
Address	`0x808d0`

LdrSystemDllInitBlock

Ordinal	`179`
Address	`0x1812f0`

LdrUnloadAlternateResourceModule

Ordinal	`180`
Address	`0x6b7e0`

LdrUnloadAlternateResourceModuleEx

Ordinal	`181`
Address	`0x6b7f0`

LdrUnloadDll

Ordinal	`182`
Address	`0xfbf0`

LdrUnlockLoaderLock

Ordinal	`183`
Address	`0x7e930`

LdrUnregisterDllNotification

Ordinal	`184`
Address	`0xce5f0`

LdrUpdatePackageSearchPath

Ordinal	`185`
Address	`0xdeba0`

LdrVerifyImageMatchesChecksum

Ordinal	`186`
Address	`0xce6a0`

LdrVerifyImageMatchesChecksumEx

Ordinal	`187`
Address	`0x8b170`

LdrpResGetMappingSize

Ordinal	`188`
Address	`0x578e0`

LdrpResGetResourceDirectory

Ordinal	`189`
Address	`0x56310`

MD4Final

Ordinal	`190`
Address	`0x10fd70`

MD4Init

Ordinal	`191`
Address	`0x10fe40`

MD4Update

Ordinal	`192`
Address	`0x110400`

MD5Final

Ordinal	`193`
Address	`0x5d330`

MD5Init

Ordinal	`194`
Address	`0x7e0a0`

MD5Update

Ordinal	`195`
Address	`0x5d400`

NlsAnsiCodePage

Ordinal	`196`
Address	`0x1697cc`

NlsMbCodePageTag

Ordinal	`197`
Address	`0x16d730`

NlsMbOemCodePageTag

Ordinal	`198`
Address	`0x16d6f8`

NtAcceptConnectPort

Ordinal	`199`
Address	`0x9d590`

NtAccessCheck

Ordinal	`200`
Address	`0x9d550`

NtAccessCheckAndAuditAlarm

Ordinal	`201`
Address	`0x9da70`

NtAccessCheckByType

Ordinal	`202`
Address	`0x9e1a0`

NtAccessCheckByTypeAndAuditAlarm

Ordinal	`203`
Address	`0x9e070`

NtAccessCheckByTypeResultList

Ordinal	`204`
Address	`0x9e1c0`

NtAccessCheckByTypeResultListAndAuditAlarm

Ordinal	`205`
Address	`0x9e1e0`

NtAccessCheckByTypeResultListAndAuditAlarmByHandle

Ordinal	`206`
Address	`0x9e200`

NtAcquireCrossVmMutant

Ordinal	`207`
Address	`0x9e220`

NtAcquireProcessActivityReference

Ordinal	`208`
Address	`0x9e240`

NtAddAtom

Ordinal	`209`
Address	`0x9de30`

NtAddAtomEx

Ordinal	`210`
Address	`0x9e260`

NtAddBootEntry

Ordinal	`211`
Address	`0x9e280`

NtAddDriverEntry

Ordinal	`212`
Address	`0x9e2a0`

NtAdjustGroupsToken

Ordinal	`213`
Address	`0x9e2c0`

NtAdjustPrivilegesToken

Ordinal	`214`
Address	`0x9dd70`

NtAdjustTokenClaimsAndDeviceGroups

Ordinal	`215`
Address	`0x9e2e0`

NtAlertResumeThread

Ordinal	`216`
Address	`0x9e300`

NtAlertThread

Ordinal	`217`
Address	`0x9e320`

NtAlertThreadByThreadId

Ordinal	`218`
Address	`0x9e340`

NtAllocateLocallyUniqueId

Ordinal	`219`
Address	`0x9e360`

NtAllocateReserveObject

Ordinal	`220`
Address	`0x9e380`

NtAllocateUserPhysicalPages

Ordinal	`221`
Address	`0x9e3a0`

NtAllocateUserPhysicalPagesEx

Ordinal	`222`
Address	`0x9e3c0`

NtAllocateUuids

Ordinal	`223`
Address	`0x9e3e0`

NtAllocateVirtualMemory

Ordinal	`224`
Address	`0x9d850`

NtAllocateVirtualMemoryEx

Ordinal	`225`
Address	`0x9e400`

NtAlpcAcceptConnectPort

Ordinal	`226`
Address	`0x9e420`

NtAlpcCancelMessage

Ordinal	`227`
Address	`0x9e440`

NtAlpcConnectPort

Ordinal	`228`
Address	`0x9e460`

NtAlpcConnectPortEx

Ordinal	`229`
Address	`0x9e480`

NtAlpcCreatePort

Ordinal	`230`
Address	`0x9e4a0`

NtAlpcCreatePortSection

Ordinal	`231`
Address	`0x9e4c0`

NtAlpcCreateResourceReserve

Ordinal	`232`
Address	`0x9e4e0`

NtAlpcCreateSectionView

Ordinal	`233`
Address	`0x9e500`

NtAlpcCreateSecurityContext

Ordinal	`234`
Address	`0x9e520`

NtAlpcDeletePortSection

Ordinal	`235`
Address	`0x9e540`

NtAlpcDeleteResourceReserve

Ordinal	`236`
Address	`0x9e560`

NtAlpcDeleteSectionView

Ordinal	`237`
Address	`0x9e580`

NtAlpcDeleteSecurityContext

Ordinal	`238`
Address	`0x9e5a0`

NtAlpcDisconnectPort

Ordinal	`239`
Address	`0x9e5c0`

NtAlpcImpersonateClientContainerOfPort

Ordinal	`240`
Address	`0x9e5e0`

NtAlpcImpersonateClientOfPort

Ordinal	`241`
Address	`0x9e600`

NtAlpcOpenSenderProcess

Ordinal	`242`
Address	`0x9e620`

NtAlpcOpenSenderThread

Ordinal	`243`
Address	`0x9e640`

NtAlpcQueryInformation

Ordinal	`244`
Address	`0x9e660`

NtAlpcQueryInformationMessage

Ordinal	`245`
Address	`0x9e680`

NtAlpcRevokeSecurityContext

Ordinal	`246`
Address	`0x9e6a0`

NtAlpcSendWaitReceivePort

Ordinal	`247`
Address	`0x9e6c0`

NtAlpcSetInformation

Ordinal	`248`
Address	`0x9e6e0`

NtApphelpCacheControl

Ordinal	`249`
Address	`0x9ded0`

NtAreMappedFilesTheSame

Ordinal	`250`
Address	`0x9e700`

NtAssignProcessToJobObject

Ordinal	`251`
Address	`0x9e720`

NtAssociateWaitCompletionPacket

Ordinal	`252`
Address	`0x9e740`

NtCallEnclave

Ordinal	`253`
Address	`0x9e760`

NtCallbackReturn

Ordinal	`254`
Address	`0x9d5f0`

NtCancelIoFile

Ordinal	`255`
Address	`0x9e0e0`

NtCancelIoFileEx

Ordinal	`256`
Address	`0x9e780`

NtCancelSynchronousIoFile

Ordinal	`257`
Address	`0x9e7a0`

NtCancelTimer

Ordinal	`258`
Address	`0x9e160`

NtCancelTimer2

Ordinal	`259`
Address	`0x9e7c0`

NtCancelWaitCompletionPacket

Ordinal	`260`
Address	`0x9e7e0`

NtClearEvent

Ordinal	`261`
Address	`0x9dd10`

NtClose

Ordinal	`262`
Address	`0x9d730`

NtCloseObjectAuditAlarm

Ordinal	`263`
Address	`0x9dcb0`

NtCommitComplete

Ordinal	`264`
Address	`0x9e800`

NtCommitEnlistment

Ordinal	`265`
Address	`0x9e820`

NtCommitRegistryTransaction

Ordinal	`266`
Address	`0x9e840`

NtCommitTransaction

Ordinal	`267`
Address	`0x9e860`

NtCompactKeys

Ordinal	`268`
Address	`0x9e880`

NtCompareObjects

Ordinal	`269`
Address	`0x9e8a0`

NtCompareSigningLevels

Ordinal	`270`
Address	`0x9e8c0`

NtCompareTokens

Ordinal	`271`
Address	`0x9e8e0`

NtCompleteConnectPort

Ordinal	`272`
Address	`0x9e900`

NtCompressKey

Ordinal	`273`
Address	`0x9e920`

NtConnectPort

Ordinal	`274`
Address	`0x9e940`

NtContinue

Ordinal	`275`
Address	`0x9ddb0`

NtContinueEx

Ordinal	`276`
Address	`0x9e960`

NtConvertBetweenAuxiliaryCounterAndPerformanceCounter

Ordinal	`277`
Address	`0x9e980`

NtCopyFileChunk

Ordinal	`278`
Address	`0x9e9a0`

NtCreateCrossVmEvent

Ordinal	`279`
Address	`0x9e9c0`

NtCreateCrossVmMutant

Ordinal	`280`
Address	`0x9e9e0`

NtCreateDebugObject

Ordinal	`281`
Address	`0x9ea00`

NtCreateDirectoryObject

Ordinal	`282`
Address	`0x9ea20`

NtCreateDirectoryObjectEx

Ordinal	`283`
Address	`0x9ea40`

NtCreateEnclave

Ordinal	`284`
Address	`0x9ea60`

NtCreateEnlistment

Ordinal	`285`
Address	`0x9ea80`

NtCreateEvent

Ordinal	`286`
Address	`0x9de50`

NtCreateEventPair

Ordinal	`287`
Address	`0x9eaa0`

NtCreateFile

Ordinal	`288`
Address	`0x9dff0`

NtCreateIRTimer

Ordinal	`289`
Address	`0x9eac0`

NtCreateIoCompletion

Ordinal	`290`
Address	`0x9eae0`

NtCreateJobObject

Ordinal	`291`
Address	`0x9eb00`

NtCreateJobSet

Ordinal	`292`
Address	`0x9eb20`

NtCreateKey

Ordinal	`293`
Address	`0x9d8f0`

NtCreateKeyTransacted

Ordinal	`294`
Address	`0x9eb40`

NtCreateKeyedEvent

Ordinal	`295`
Address	`0x9eb60`

NtCreateLowBoxToken

Ordinal	`296`
Address	`0x9eb80`

NtCreateMailslotFile

Ordinal	`297`
Address	`0x9eba0`

NtCreateMutant

Ordinal	`298`
Address	`0x9ebc0`

NtCreateNamedPipeFile

Ordinal	`299`
Address	`0x9ebe0`

NtCreatePagingFile

Ordinal	`300`
Address	`0x9ec00`

NtCreatePartition

Ordinal	`301`
Address	`0x9ec20`

NtCreatePort

Ordinal	`302`
Address	`0x9ec40`

NtCreatePrivateNamespace

Ordinal	`303`
Address	`0x9ec60`

NtCreateProcess

Ordinal	`304`
Address	`0x9ec80`

NtCreateProcessEx

Ordinal	`305`
Address	`0x9def0`

NtCreateProfile

Ordinal	`306`
Address	`0x9eca0`

NtCreateProfileEx

Ordinal	`307`
Address	`0x9ecc0`

NtCreateRegistryTransaction

Ordinal	`308`
Address	`0x9ece0`

NtCreateResourceManager

Ordinal	`309`
Address	`0x9ed00`

NtCreateSection

Ordinal	`310`
Address	`0x9de90`

NtCreateSectionEx

Ordinal	`311`
Address	`0x9ed20`

NtCreateSemaphore

Ordinal	`312`
Address	`0x9ed40`

NtCreateSymbolicLinkObject

Ordinal	`313`
Address	`0x9ed60`

NtCreateThread

Ordinal	`314`
Address	`0x9df10`

NtCreateThreadEx

Ordinal	`315`
Address	`0x9ed80`

NtCreateTimer

Ordinal	`316`
Address	`0x9eda0`

NtCreateTimer2

Ordinal	`317`
Address	`0x9edc0`

NtCreateToken

Ordinal	`318`
Address	`0x9ede0`

NtCreateTokenEx

Ordinal	`319`
Address	`0x9ee00`

NtCreateTransaction

Ordinal	`320`
Address	`0x9ee20`

NtCreateTransactionManager

Ordinal	`321`
Address	`0x9ee40`

NtCreateUserProcess

Ordinal	`322`
Address	`0x9ee60`

NtCreateWaitCompletionPacket

Ordinal	`323`
Address	`0x9ee80`

NtCreateWaitablePort

Ordinal	`324`
Address	`0x9eea0`

NtCreateWnfStateName

Ordinal	`325`
Address	`0x9eec0`

NtCreateWorkerFactory

Ordinal	`326`
Address	`0x9eee0`

NtDebugActiveProcess

Ordinal	`327`
Address	`0x9ef00`

NtDebugContinue

Ordinal	`328`
Address	`0x9ef20`

NtDelayExecution

Ordinal	`329`
Address	`0x9dbd0`

NtDeleteAtom

Ordinal	`330`
Address	`0x9ef40`

NtDeleteBootEntry

Ordinal	`331`
Address	`0x9ef60`

NtDeleteDriverEntry

Ordinal	`332`
Address	`0x9ef80`

NtDeleteFile

Ordinal	`333`
Address	`0x9efa0`

NtDeleteKey

Ordinal	`334`
Address	`0x9efc0`

NtDeleteObjectAuditAlarm

Ordinal	`335`
Address	`0x9efe0`

NtDeletePrivateNamespace

Ordinal	`336`
Address	`0x9f000`

NtDeleteValueKey

Ordinal	`337`
Address	`0x9f020`

NtDeleteWnfStateData

Ordinal	`338`
Address	`0x9f040`

NtDeleteWnfStateName

Ordinal	`339`
Address	`0x9f060`

NtDeviceIoControlFile

Ordinal	`340`
Address	`0x9d630`

NtDirectGraphicsCall

Ordinal	`341`
Address	`0x9f080`

NtDisableLastKnownGood

Ordinal	`342`
Address	`0x9f0a0`

NtDisplayString

Ordinal	`343`
Address	`0x9f0c0`

NtDrawText

Ordinal	`344`
Address	`0x9f0e0`

NtDuplicateObject

Ordinal	`345`
Address	`0x9dcd0`

NtDuplicateToken

Ordinal	`346`
Address	`0x9dd90`

NtEnableLastKnownGood

Ordinal	`347`
Address	`0x9f100`

NtEnumerateBootEntries

Ordinal	`348`
Address	`0x9f120`

NtEnumerateDriverEntries

Ordinal	`349`
Address	`0x9f140`

NtEnumerateKey

Ordinal	`350`
Address	`0x9db90`

NtEnumerateSystemEnvironmentValuesEx

Ordinal	`351`
Address	`0x9f160`

NtEnumerateTransactionObject

Ordinal	`352`
Address	`0x9f180`

NtEnumerateValueKey

Ordinal	`353`
Address	`0x9d7b0`

NtExtendSection

Ordinal	`354`
Address	`0x9f1a0`

NtFilterBootOption

Ordinal	`355`
Address	`0x9f1c0`

NtFilterToken

Ordinal	`356`
Address	`0x9f1e0`

NtFilterTokenEx

Ordinal	`357`
Address	`0x9f200`

NtFindAtom

Ordinal	`358`
Address	`0x9d7d0`

NtFlushBuffersFile

Ordinal	`359`
Address	`0x9deb0`

NtFlushBuffersFileEx

Ordinal	`360`
Address	`0x9f220`

NtFlushInstallUILanguage

Ordinal	`361`
Address	`0x9f240`

NtFlushInstructionCache

Ordinal	`362`
Address	`0x9f260`

NtFlushKey

Ordinal	`363`
Address	`0x9f280`

NtFlushProcessWriteBuffers

Ordinal	`364`
Address	`0x9f2a0`

NtFlushVirtualMemory

Ordinal	`365`
Address	`0x9f2c0`

NtFlushWriteBuffer

Ordinal	`366`
Address	`0x9f2e0`

NtFreeUserPhysicalPages

Ordinal	`367`
Address	`0x9f300`

NtFreeVirtualMemory

Ordinal	`368`
Address	`0x9d910`

NtFreezeRegistry

Ordinal	`369`
Address	`0x9f320`

NtFreezeTransactions

Ordinal	`370`
Address	`0x9f340`

NtFsControlFile

Ordinal	`371`
Address	`0x9dc70`

NtGetCachedSigningLevel

Ordinal	`372`
Address	`0x9f360`

NtGetCompleteWnfStateSubscription

Ordinal	`373`
Address	`0x9f380`

NtGetContextThread

Ordinal	`374`
Address	`0x9f3a0`

NtGetCurrentProcessorNumber

Ordinal	`375`
Address	`0x9f3c0`

NtGetCurrentProcessorNumberEx

Ordinal	`376`
Address	`0x9f3e0`

NtGetDevicePowerState

Ordinal	`377`
Address	`0x9f400`

NtGetMUIRegistryInfo

Ordinal	`378`
Address	`0x9f420`

NtGetNextProcess

Ordinal	`379`
Address	`0x9f440`

NtGetNextThread

Ordinal	`380`
Address	`0x9f460`

NtGetNlsSectionPtr

Ordinal	`381`
Address	`0x9f480`

NtGetNotificationResourceManager

Ordinal	`382`
Address	`0x9f4a0`

NtGetTickCount

Ordinal	`383`
Address	`0xe5d30`

NtGetWriteWatch

Ordinal	`384`
Address	`0x9f4c0`

NtImpersonateAnonymousToken

Ordinal	`385`
Address	`0x9f4e0`

NtImpersonateClientOfPort

Ordinal	`386`
Address	`0x9d930`

NtImpersonateThread

Ordinal	`387`
Address	`0x9f500`

NtInitializeEnclave

Ordinal	`388`
Address	`0x9f520`

NtInitializeNlsFiles

Ordinal	`389`
Address	`0x9f540`

NtInitializeRegistry

Ordinal	`390`
Address	`0x9f560`

NtInitiatePowerAction

Ordinal	`391`
Address	`0x9f580`

NtIsProcessInJob

Ordinal	`392`
Address	`0x9df30`

NtIsSystemResumeAutomatic

Ordinal	`393`
Address	`0x9f5a0`

NtIsUILanguageComitted

Ordinal	`394`
Address	`0x9f5c0`

NtListenPort

Ordinal	`395`
Address	`0x9f5e0`

NtLoadDriver

Ordinal	`396`
Address	`0x9f600`

NtLoadEnclaveData

Ordinal	`397`
Address	`0x9f620`

NtLoadKey

Ordinal	`398`
Address	`0x9f640`

NtLoadKey2

Ordinal	`399`
Address	`0x9f660`

NtLoadKey3

Ordinal	`400`
Address	`0xa1020`

NtLoadKeyEx

Ordinal	`401`
Address	`0x9f680`

NtLockFile

Ordinal	`402`
Address	`0x9f6a0`

NtLockProductActivationKeys

Ordinal	`403`
Address	`0x9f6c0`

NtLockRegistryKey

Ordinal	`404`
Address	`0x9f6e0`

NtLockVirtualMemory

Ordinal	`405`
Address	`0x9f700`

NtMakePermanentObject

Ordinal	`406`
Address	`0x9f720`

NtMakeTemporaryObject

Ordinal	`407`
Address	`0x9f740`

NtManageHotPatch

Ordinal	`408`
Address	`0x9f760`

NtManagePartition

Ordinal	`409`
Address	`0x9f780`

NtMapCMFModule

Ordinal	`410`
Address	`0x9f7a0`

NtMapUserPhysicalPages

Ordinal	`411`
Address	`0x9f7c0`

NtMapUserPhysicalPagesScatter

Ordinal	`412`
Address	`0x9d5b0`

NtMapViewOfSection

Ordinal	`413`
Address	`0x9da50`

NtMapViewOfSectionEx

Ordinal	`414`
Address	`0x9f7e0`

NtModifyBootEntry

Ordinal	`415`
Address	`0x9f800`

NtModifyDriverEntry

Ordinal	`416`
Address	`0x9f820`

NtNotifyChangeDirectoryFile

Ordinal	`417`
Address	`0x9f840`

NtNotifyChangeDirectoryFileEx

Ordinal	`418`
Address	`0x9f860`

NtNotifyChangeKey

Ordinal	`419`
Address	`0x9f880`

NtNotifyChangeMultipleKeys

Ordinal	`420`
Address	`0x9f8a0`

NtNotifyChangeSession

Ordinal	`421`
Address	`0x9f8c0`

NtOpenDirectoryObject

Ordinal	`422`
Address	`0x9e050`

NtOpenEnlistment

Ordinal	`423`
Address	`0x9f8e0`

NtOpenEvent

Ordinal	`424`
Address	`0x9dd50`

NtOpenEventPair

Ordinal	`425`
Address	`0x9f900`

NtOpenFile

Ordinal	`426`
Address	`0x9dbb0`

NtOpenIoCompletion

Ordinal	`427`
Address	`0x9f920`

NtOpenJobObject

Ordinal	`428`
Address	`0x9f940`

NtOpenKey

Ordinal	`429`
Address	`0x9d790`

NtOpenKeyEx

Ordinal	`430`
Address	`0x9f960`

NtOpenKeyTransacted

Ordinal	`431`
Address	`0x9f980`

NtOpenKeyTransactedEx

Ordinal	`432`
Address	`0x9f9a0`

NtOpenKeyedEvent

Ordinal	`433`
Address	`0x9f9c0`

NtOpenMutant

Ordinal	`434`
Address	`0x9f9e0`

NtOpenObjectAuditAlarm

Ordinal	`435`
Address	`0x9fa00`

NtOpenPartition

Ordinal	`436`
Address	`0x9fa20`

NtOpenPrivateNamespace

Ordinal	`437`
Address	`0x9fa40`

NtOpenProcess

Ordinal	`438`
Address	`0x9da10`

NtOpenProcessToken

Ordinal	`439`
Address	`0x9fa60`

NtOpenProcessTokenEx

Ordinal	`440`
Address	`0x9db50`

NtOpenRegistryTransaction

Ordinal	`441`
Address	`0x9fa80`

NtOpenResourceManager

Ordinal	`442`
Address	`0x9faa0`

NtOpenSection

Ordinal	`443`
Address	`0x9dc30`

NtOpenSemaphore

Ordinal	`444`
Address	`0x9fac0`

NtOpenSession

Ordinal	`445`
Address	`0x9fae0`

NtOpenSymbolicLinkObject

Ordinal	`446`
Address	`0x9fb00`

NtOpenThread

Ordinal	`447`
Address	`0x9fb20`

NtOpenThreadToken

Ordinal	`448`
Address	`0x9d9d0`

NtOpenThreadTokenEx

Ordinal	`449`
Address	`0x9db30`

NtOpenTimer

Ordinal	`450`
Address	`0x9fb40`

NtOpenTransaction

Ordinal	`451`
Address	`0x9fb60`

NtOpenTransactionManager

Ordinal	`452`
Address	`0x9fb80`

NtPlugPlayControl

Ordinal	`453`
Address	`0x9fba0`

NtPowerInformation

Ordinal	`454`
Address	`0x9e120`

NtPrePrepareComplete

Ordinal	`455`
Address	`0x9fbc0`

NtPrePrepareEnlistment

Ordinal	`456`
Address	`0x9fbe0`

NtPrepareComplete

Ordinal	`457`
Address	`0x9fc00`

NtPrepareEnlistment

Ordinal	`458`
Address	`0x9fc20`

NtPrivilegeCheck

Ordinal	`459`
Address	`0x9fc40`

NtPrivilegeObjectAuditAlarm

Ordinal	`460`
Address	`0x9fc60`

NtPrivilegedServiceAuditAlarm

Ordinal	`461`
Address	`0x9fc80`

NtPropagationComplete

Ordinal	`462`
Address	`0x9fca0`

NtPropagationFailed

Ordinal	`463`
Address	`0x9fcc0`

NtProtectVirtualMemory

Ordinal	`464`
Address	`0x9df50`

NtPssCaptureVaSpaceBulk

Ordinal	`465`
Address	`0x9fce0`

NtPulseEvent

Ordinal	`466`
Address	`0x9fd00`

NtQueryAttributesFile

Ordinal	`467`
Address	`0x9dcf0`

NtQueryAuxiliaryCounterFrequency

Ordinal	`468`
Address	`0x9fd20`

NtQueryBootEntryOrder

Ordinal	`469`
Address	`0x9fd40`

NtQueryBootOptions

Ordinal	`470`
Address	`0x9fd60`

NtQueryDebugFilterState

Ordinal	`471`
Address	`0x9fd80`

NtQueryDefaultLocale

Ordinal	`472`
Address	`0x9d7f0`

NtQueryDefaultUILanguage

Ordinal	`473`
Address	`0x9ddd0`

NtQueryDirectoryFile

Ordinal	`474`
Address	`0x9dbf0`

NtQueryDirectoryFileEx

Ordinal	`475`
Address	`0x9fda0`

NtQueryDirectoryObject

Ordinal	`476`
Address	`0x9fdc0`

NtQueryDriverEntryOrder

Ordinal	`477`
Address	`0x9fde0`

NtQueryEaFile

Ordinal	`478`
Address	`0x9fe00`

NtQueryEvent

Ordinal	`479`
Address	`0x9e010`

NtQueryFullAttributesFile

Ordinal	`480`
Address	`0x9fe20`

NtQueryInformationAtom

Ordinal	`481`
Address	`0x9fe40`

NtQueryInformationByName

Ordinal	`482`
Address	`0x9fe60`

NtQueryInformationEnlistment

Ordinal	`483`
Address	`0x9fe80`

NtQueryInformationFile

Ordinal	`484`
Address	`0x9d770`

NtQueryInformationJobObject

Ordinal	`485`
Address	`0x9fea0`

NtQueryInformationPort

Ordinal	`486`
Address	`0x9fec0`

NtQueryInformationProcess

Ordinal	`487`
Address	`0x9d870`

NtQueryInformationResourceManager

Ordinal	`488`
Address	`0x9fee0`

NtQueryInformationThread

Ordinal	`489`
Address	`0x9d9f0`

NtQueryInformationToken

Ordinal	`490`
Address	`0x9d970`

NtQueryInformationTransaction

Ordinal	`491`
Address	`0x9ff00`

NtQueryInformationTransactionManager

Ordinal	`492`
Address	`0x9ff20`

NtQueryInformationWorkerFactory

Ordinal	`493`
Address	`0x9ff40`

NtQueryInstallUILanguage

Ordinal	`494`
Address	`0x9ff60`

NtQueryIntervalProfile

Ordinal	`495`
Address	`0x9ff80`

NtQueryIoCompletion

Ordinal	`496`
Address	`0x9ffa0`

NtQueryKey

Ordinal	`497`
Address	`0x9d810`

NtQueryLicenseValue

Ordinal	`498`
Address	`0x9ffc0`

NtQueryMultipleValueKey

Ordinal	`499`
Address	`0x9ffe0`

NtQueryMutant

Ordinal	`500`
Address	`0xa0000`

NtQueryObject

Ordinal	`501`
Address	`0x9d750`

NtQueryOpenSubKeys

Ordinal	`502`
Address	`0xa0020`

NtQueryOpenSubKeysEx

Ordinal	`503`
Address	`0xa0040`

NtQueryPerformanceCounter

Ordinal	`504`
Address	`0x9db70`

NtQueryPortInformationProcess

Ordinal	`505`
Address	`0xa0060`

NtQueryQuotaInformationFile

Ordinal	`506`
Address	`0xa0080`

NtQuerySection

Ordinal	`507`
Address	`0x9df70`

NtQuerySecurityAttributesToken

Ordinal	`508`
Address	`0xa00a0`

NtQuerySecurityObject

Ordinal	`509`
Address	`0xa00c0`

NtQuerySecurityPolicy

Ordinal	`510`
Address	`0xa00e0`

NtQuerySemaphore

Ordinal	`511`
Address	`0xa0100`

NtQuerySymbolicLinkObject

Ordinal	`512`
Address	`0xa0120`

NtQuerySystemEnvironmentValue

Ordinal	`513`
Address	`0xa0140`

NtQuerySystemEnvironmentValueEx

Ordinal	`514`
Address	`0xa0160`

NtQuerySystemInformation

Ordinal	`515`
Address	`0x9dc10`

NtQuerySystemInformationEx

Ordinal	`516`
Address	`0xa0180`

NtQuerySystemTime

Ordinal	`517`
Address	`0x9e090`

NtQueryTimer

Ordinal	`518`
Address	`0x9dc50`

NtQueryTimerResolution

Ordinal	`519`
Address	`0xa01a0`

NtQueryValueKey

Ordinal	`520`
Address	`0x9d830`

NtQueryVirtualMemory

Ordinal	`521`
Address	`0x9d9b0`

NtQueryVolumeInformationFile

Ordinal	`522`
Address	`0x9de70`

NtQueryWnfStateData

Ordinal	`523`
Address	`0xa01c0`

NtQueryWnfStateNameInformation

Ordinal	`524`
Address	`0xa01e0`

NtQueueApcThread

Ordinal	`525`
Address	`0x9ddf0`

NtQueueApcThreadEx

Ordinal	`526`
Address	`0xa0200`

NtQueueApcThreadEx2

Ordinal	`527`
Address	`0xa0220`

NtRaiseException

Ordinal	`528`
Address	`0xa0240`

NtRaiseHardError

Ordinal	`529`
Address	`0xa0260`

NtReadFile

Ordinal	`530`
Address	`0x9d610`

NtReadFileScatter

Ordinal	`531`
Address	`0x9db10`

NtReadOnlyEnlistment

Ordinal	`532`
Address	`0xa0280`

NtReadRequestData

Ordinal	`533`
Address	`0x9dfd0`

NtReadVirtualMemory

Ordinal	`534`
Address	`0x9dd30`

NtRecoverEnlistment

Ordinal	`535`
Address	`0xa02a0`

NtRecoverResourceManager

Ordinal	`536`
Address	`0xa02c0`

NtRecoverTransactionManager

Ordinal	`537`
Address	`0xa02e0`

NtRegisterProtocolAddressInformation

Ordinal	`538`
Address	`0xa0300`

NtRegisterThreadTerminatePort

Ordinal	`539`
Address	`0xa0320`

NtReleaseKeyedEvent

Ordinal	`540`
Address	`0xa0340`

NtReleaseMutant

Ordinal	`541`
Address	`0x9d950`

NtReleaseSemaphore

Ordinal	`542`
Address	`0x9d690`

NtReleaseWorkerFactoryWorker

Ordinal	`543`
Address	`0xa0360`

NtRemoveIoCompletion

Ordinal	`544`
Address	`0x9d670`

NtRemoveIoCompletionEx

Ordinal	`545`
Address	`0xa0380`

NtRemoveProcessDebug

Ordinal	`546`
Address	`0xa03a0`

NtRenameKey

Ordinal	`547`
Address	`0xa03c0`

NtRenameTransactionManager

Ordinal	`548`
Address	`0xa03e0`

NtReplaceKey

Ordinal	`549`
Address	`0xa0400`

NtReplacePartitionUnit

Ordinal	`550`
Address	`0xa0420`

NtReplyPort

Ordinal	`551`
Address	`0x9d6d0`

NtReplyWaitReceivePort

Ordinal	`552`
Address	`0x9d6b0`

NtReplyWaitReceivePortEx

Ordinal	`553`
Address	`0x9dab0`

NtReplyWaitReplyPort

Ordinal	`554`
Address	`0xa0440`

NtRequestPort

Ordinal	`555`
Address	`0xa0460`

NtRequestWaitReplyPort

Ordinal	`556`
Address	`0x9d990`

NtResetEvent

Ordinal	`557`
Address	`0xa0480`

NtResetWriteWatch

Ordinal	`558`
Address	`0xa04a0`

NtRestoreKey

Ordinal	`559`
Address	`0xa04c0`

NtResumeProcess

Ordinal	`560`
Address	`0xa04e0`

NtResumeThread

Ordinal	`561`
Address	`0x9df90`

NtRevertContainerImpersonation

Ordinal	`562`
Address	`0xa0500`

NtRollbackComplete

Ordinal	`563`
Address	`0xa0520`

NtRollbackEnlistment

Ordinal	`564`
Address	`0xa0540`

NtRollbackRegistryTransaction

Ordinal	`565`
Address	`0xa0560`

NtRollbackTransaction

Ordinal	`566`
Address	`0xa0580`

NtRollforwardTransactionManager

Ordinal	`567`
Address	`0xa05a0`

NtSaveKey

Ordinal	`568`
Address	`0xa05c0`

NtSaveKeyEx

Ordinal	`569`
Address	`0xa05e0`

NtSaveMergedKeys

Ordinal	`570`
Address	`0xa0600`

NtSecureConnectPort

Ordinal	`571`
Address	`0xa0620`

NtSerializeBoot

Ordinal	`572`
Address	`0xa0640`

NtSetBootEntryOrder

Ordinal	`573`
Address	`0xa0660`

NtSetBootOptions

Ordinal	`574`
Address	`0xa0680`

NtSetCachedSigningLevel

Ordinal	`575`
Address	`0xa06a0`

NtSetCachedSigningLevel2

Ordinal	`576`
Address	`0xa06c0`

NtSetContextThread

Ordinal	`577`
Address	`0xa06e0`

NtSetDebugFilterState

Ordinal	`578`
Address	`0xa0700`

NtSetDefaultHardErrorPort

Ordinal	`579`
Address	`0xa0720`

NtSetDefaultLocale

Ordinal	`580`
Address	`0xa0740`

NtSetDefaultUILanguage

Ordinal	`581`
Address	`0xa0760`

NtSetDriverEntryOrder

Ordinal	`582`
Address	`0xa0780`

NtSetEaFile

Ordinal	`583`
Address	`0xa07a0`

NtSetEvent

Ordinal	`584`
Address	`0x9d710`

NtSetEventBoostPriority

Ordinal	`585`
Address	`0x9daf0`

NtSetHighEventPair

Ordinal	`586`
Address	`0xa07c0`

NtSetHighWaitLowEventPair

Ordinal	`587`
Address	`0xa07e0`

NtSetIRTimer

Ordinal	`588`
Address	`0xa0800`

NtSetInformationDebugObject

Ordinal	`589`
Address	`0xa0820`

NtSetInformationEnlistment

Ordinal	`590`
Address	`0xa0840`

NtSetInformationFile

Ordinal	`591`
Address	`0x9da30`

NtSetInformationJobObject

Ordinal	`592`
Address	`0xa0860`

NtSetInformationKey

Ordinal	`593`
Address	`0xa0880`

NtSetInformationObject

Ordinal	`594`
Address	`0x9e0c0`

NtSetInformationProcess

Ordinal	`595`
Address	`0x9d8d0`

NtSetInformationResourceManager

Ordinal	`596`
Address	`0xa08a0`

NtSetInformationSymbolicLink

Ordinal	`597`
Address	`0xa08c0`

NtSetInformationThread

Ordinal	`598`
Address	`0x9d6f0`

NtSetInformationToken

Ordinal	`599`
Address	`0xa08e0`

NtSetInformationTransaction

Ordinal	`600`
Address	`0xa0900`

NtSetInformationTransactionManager

Ordinal	`601`
Address	`0xa0920`

NtSetInformationVirtualMemory

Ordinal	`602`
Address	`0xa0940`

NtSetInformationWorkerFactory

Ordinal	`603`
Address	`0xa0960`

NtSetIntervalProfile

Ordinal	`604`
Address	`0xa0980`

NtSetIoCompletion

Ordinal	`605`
Address	`0xa09a0`

NtSetIoCompletionEx

Ordinal	`606`
Address	`0xa09c0`

NtSetLdtEntries

Ordinal	`607`
Address	`0xa09e0`

NtSetLowEventPair

Ordinal	`608`
Address	`0xa0a00`

NtSetLowWaitHighEventPair

Ordinal	`609`
Address	`0xa0a20`

NtSetQuotaInformationFile

Ordinal	`610`
Address	`0xa0a40`

NtSetSecurityObject

Ordinal	`611`
Address	`0xa0a60`

NtSetSystemEnvironmentValue

Ordinal	`612`
Address	`0xa0a80`

NtSetSystemEnvironmentValueEx

Ordinal	`613`
Address	`0xa0aa0`

NtSetSystemInformation

Ordinal	`614`
Address	`0xa0ac0`

NtSetSystemPowerState

Ordinal	`615`
Address	`0xa0ae0`

NtSetSystemTime

Ordinal	`616`
Address	`0xa0b00`

NtSetThreadExecutionState

Ordinal	`617`
Address	`0xa0b20`

NtSetTimer

Ordinal	`618`
Address	`0x9e180`

NtSetTimer2

Ordinal	`619`
Address	`0xa0b40`

NtSetTimerEx

Ordinal	`620`
Address	`0xa0b60`

NtSetTimerResolution

Ordinal	`621`
Address	`0xa0b80`

NtSetUuidSeed

Ordinal	`622`
Address	`0xa0ba0`

NtSetValueKey

Ordinal	`623`
Address	`0x9e140`

NtSetVolumeInformationFile

Ordinal	`624`
Address	`0xa0bc0`

NtSetWnfProcessNotificationEvent

Ordinal	`625`
Address	`0xa0be0`

NtShutdownSystem

Ordinal	`626`
Address	`0xa0c00`

NtShutdownWorkerFactory

Ordinal	`627`
Address	`0xa0c20`

NtSignalAndWaitForSingleObject

Ordinal	`628`
Address	`0xa0c40`

NtSinglePhaseReject

Ordinal	`629`
Address	`0xa0c60`

NtStartProfile

Ordinal	`630`
Address	`0xa0c80`

NtStopProfile

Ordinal	`631`
Address	`0xa0ca0`

NtSubscribeWnfStateChange

Ordinal	`632`
Address	`0xa0cc0`

NtSuspendProcess

Ordinal	`633`
Address	`0xa0ce0`

NtSuspendThread

Ordinal	`634`
Address	`0xa0d00`

NtSystemDebugControl

Ordinal	`635`
Address	`0xa0d20`

NtTerminateEnclave

Ordinal	`636`
Address	`0xa0d40`

NtTerminateJobObject

Ordinal	`637`
Address	`0xa0d60`

NtTerminateProcess

Ordinal	`638`
Address	`0x9dad0`

NtTerminateThread

Ordinal	`639`
Address	`0x9dfb0`

NtTestAlert

Ordinal	`640`
Address	`0xa0d80`

NtThawRegistry

Ordinal	`641`
Address	`0xa0da0`

NtThawTransactions

Ordinal	`642`
Address	`0xa0dc0`

NtTraceControl

Ordinal	`643`
Address	`0xa0de0`

NtTraceEvent

Ordinal	`644`
Address	`0x9e100`

NtTranslateFilePath

Ordinal	`645`
Address	`0xa0e00`

NtUmsThreadYield

Ordinal	`646`
Address	`0xa0e20`

NtUnloadDriver

Ordinal	`647`
Address	`0xa0e40`

NtUnloadKey

Ordinal	`648`
Address	`0xa0e60`

NtUnloadKey2

Ordinal	`649`
Address	`0xa0e80`

NtUnloadKeyEx

Ordinal	`650`
Address	`0xa0ea0`

NtUnlockFile

Ordinal	`651`
Address	`0xa0ec0`

NtUnlockVirtualMemory

Ordinal	`652`
Address	`0xa0ee0`

NtUnmapViewOfSection

Ordinal	`653`
Address	`0x9da90`

NtUnmapViewOfSectionEx

Ordinal	`654`
Address	`0xa0f00`

NtUnsubscribeWnfStateChange

Ordinal	`655`
Address	`0xa0f20`

NtUpdateWnfStateData

Ordinal	`656`
Address	`0xa0f40`

NtVdmControl

Ordinal	`657`
Address	`0xa0f60`

NtWaitForAlertByThreadId

Ordinal	`658`
Address	`0xa0f80`

NtWaitForDebugEvent

Ordinal	`659`
Address	`0xa0fa0`

NtWaitForKeyedEvent

Ordinal	`660`
Address	`0xa0fc0`

NtWaitForMultipleObjects

Ordinal	`661`
Address	`0x9e0a0`

NtWaitForMultipleObjects32

Ordinal	`662`
Address	`0x9d890`

NtWaitForSingleObject

Ordinal	`663`
Address	`0x9d5d0`

NtWaitForWorkViaWorkerFactory

Ordinal	`664`
Address	`0xa0fe0`

NtWaitHighEventPair

Ordinal	`665`
Address	`0xa1000`

NtWaitLowEventPair

Ordinal	`666`
Address	`0xa1040`

NtWorkerFactoryWorkerReady

Ordinal	`667`
Address	`0x9d570`

NtWriteFile

Ordinal	`668`
Address	`0x9d650`

NtWriteFileGather

Ordinal	`669`
Address	`0x9d8b0`

NtWriteRequestData

Ordinal	`670`
Address	`0x9e030`

NtWriteVirtualMemory

Ordinal	`671`
Address	`0x9dc90`

NtYieldExecution

Ordinal	`672`
Address	`0x9de10`

NtdllDefWindowProc_A

Ordinal	`673`
Address	`0x9d220`

NtdllDefWindowProc_W

Ordinal	`674`
Address	`0x9d230`

NtdllDialogWndProc_A

Ordinal	`675`
Address	`0x9d2e0`

NtdllDialogWndProc_W

Ordinal	`676`
Address	`0x9d2f0`

PfxFindPrefix

Ordinal	`677`
Address	`0xe5ff0`

PfxInitialize

Ordinal	`678`
Address	`0xe60d0`

PfxInsertPrefix

Ordinal	`679`
Address	`0xe60f0`

PfxRemovePrefix

Ordinal	`680`
Address	`0xe6210`

PssNtCaptureSnapshot

Ordinal	`681`
Address	`0x113be0`

PssNtDuplicateSnapshot

Ordinal	`682`
Address	`0x1140b0`

PssNtFreeRemoteSnapshot

Ordinal	`683`
Address	`0x114130`

PssNtFreeSnapshot

Ordinal	`684`
Address	`0x114340`

PssNtFreeWalkMarker

Ordinal	`685`
Address	`0x1144d0`

PssNtQuerySnapshot

Ordinal	`686`
Address	`0x114500`

PssNtValidateDescriptor

Ordinal	`687`
Address	`0x1147b0`

PssNtWalkSnapshot

Ordinal	`688`
Address	`0x114940`

RtlAbortRXact

Ordinal	`689`
Address	`0x80960`

RtlAbsoluteToSelfRelativeSD

Ordinal	`690`
Address	`0x6e280`

RtlAcquirePebLock

Ordinal	`691`
Address	`0x7aaa0`

RtlAcquirePrivilege

Ordinal	`692`
Address	`0x78190`

RtlAcquireReleaseSRWLockExclusive

Ordinal	`693`
Address	`0x7f190`

RtlAcquireResourceExclusive

Ordinal	`694`
Address	`0x660b0`

RtlAcquireResourceShared

Ordinal	`695`
Address	`0x65f90`

RtlAcquireSRWLockExclusive

Ordinal	`696`
Address	`0x290a0`

RtlAcquireSRWLockShared

Ordinal	`697`
Address	`0x21760`

RtlActivateActivationContext

Ordinal	`698`
Address	`0x73370`

RtlActivateActivationContextEx

Ordinal	`699`
Address	`0x733c0`

RtlActivateActivationContextUnsafeFast

Ordinal	`700`
Address	`0x19900`

RtlAddAccessAllowedAce

Ordinal	`701`
Address	`0x78890`

RtlAddAccessAllowedAceEx

Ordinal	`702`
Address	`0x79fe0`

RtlAddAccessAllowedObjectAce

Ordinal	`703`
Address	`0xe93a0`

RtlAddAccessDeniedAce

Ordinal	`704`
Address	`0x8c280`

RtlAddAccessDeniedAceEx

Ordinal	`705`
Address	`0x85d60`

RtlAddAccessDeniedObjectAce

Ordinal	`706`
Address	`0xe9400`

RtlAddAccessFilterAce

Ordinal	`707`
Address	`0xe9460`

RtlAddAce

Ordinal	`708`
Address	`0x68140`

RtlAddActionToRXact

Ordinal	`709`
Address	`0x8ae50`

RtlAddAtomToAtomTable

Ordinal	`710`
Address	`0x59460`

RtlAddAttributeActionToRXact

Ordinal	`711`
Address	`0x81b20`

RtlAddAuditAccessAce

Ordinal	`712`
Address	`0x8b8e0`

RtlAddAuditAccessAceEx

Ordinal	`713`
Address	`0x8af80`

RtlAddAuditAccessObjectAce

Ordinal	`714`
Address	`0xe9670`

RtlAddCompoundAce

Ordinal	`715`
Address	`0xe96e0`

RtlAddFunctionTable

Ordinal	`716`
Address	`0x690a0`

RtlAddGrowableFunctionTable

Ordinal	`717`
Address	`0x69bf0`

RtlAddIntegrityLabelToBoundaryDescriptor

Ordinal	`718`
Address	`0xeb140`

RtlAddMandatoryAce

Ordinal	`719`
Address	`0x68760`

RtlAddProcessTrustLabelAce

Ordinal	`720`
Address	`0x67cd0`

RtlAddRefActivationContext

Ordinal	`721`
Address	`0x134c0`

RtlAddRefMemoryStream

Ordinal	`722`
Address	`0x847c0`

RtlAddResourceAttributeAce

Ordinal	`723`
Address	`0xe9850`

RtlAddSIDToBoundaryDescriptor

Ordinal	`724`
Address	`0x80030`

RtlAddScopedPolicyIDAce

Ordinal	`725`
Address	`0xe9ba0`

RtlAddVectoredContinueHandler

Ordinal	`726`
Address	`0xd9680`

RtlAddVectoredExceptionHandler

Ordinal	`727`
Address	`0x82080`

RtlAddressInSectionTable

Ordinal	`728`
Address	`0x77f80`

RtlAdjustPrivilege

Ordinal	`729`
Address	`0x7a1f0`

RtlAllocateActivationContextStack

Ordinal	`730`
Address	`0x71850`

RtlAllocateAndInitializeSid

Ordinal	`731`
Address	`0x6e930`

RtlAllocateAndInitializeSidEx

Ordinal	`732`
Address	`0x8b820`

RtlAllocateHandle

Ordinal	`733`
Address	`0x59aa0`

RtlAllocateHeap

Ordinal	`734`
Address	`0x2a9a0`

RtlAllocateMemoryBlockLookaside

Ordinal	`735`
Address	`0x11c010`

RtlAllocateMemoryZone

Ordinal	`736`
Address	`0x11c130`

RtlAllocateWnfSerializationGroup

Ordinal	`737`
Address	`0x84890`

RtlAnsiCharToUnicodeChar

Ordinal	`738`
Address	`0x62980`

RtlAnsiStringToUnicodeSize

Ordinal	`739`
Address	`0x16de0`

RtlAnsiStringToUnicodeString

Ordinal	`740`
Address	`0x19580`

RtlAppendAsciizToString

Ordinal	`741`
Address	`0xeb620`

RtlAppendPathElement

Ordinal	`742`
Address	`0xcc120`

RtlAppendStringToString

Ordinal	`743`
Address	`0xeb690`

RtlAppendUnicodeStringToString

Ordinal	`744`
Address	`0x17270`

RtlAppendUnicodeToString

Ordinal	`745`
Address	`0x37990`

RtlApplicationVerifierStop

Ordinal	`746`
Address	`0xdbee0`

RtlApplyRXact

Ordinal	`747`
Address	`0xe62e0`

RtlApplyRXactNoFlush

Ordinal	`748`
Address	`0x80930`

RtlAppxIsFileOwnedByTrustedInstaller

Ordinal	`749`
Address	`0xcbcb0`

RtlAreAllAccessesGranted

Ordinal	`750`
Address	`0x7ccc0`

RtlAreAnyAccessesGranted

Ordinal	`751`
Address	`0xe6390`

RtlAreBitsClear

Ordinal	`752`
Address	`0xeb760`

RtlAreBitsClearEx

Ordinal	`753`
Address	`0xeb820`

RtlAreBitsSet

Ordinal	`754`
Address	`0x7bf20`

RtlAreLongPathsEnabled

Ordinal	`755`
Address	`0x762c0`

RtlAssert

Ordinal	`756`
Address	`0xed730`

RtlAvlInsertNodeEx

Ordinal	`757`
Address	`0x69df0`

RtlAvlRemoveNode

Ordinal	`758`
Address	`0x69540`

RtlBarrier

Ordinal	`759`
Address	`0xed860`

RtlBarrierForDelete

Ordinal	`760`
Address	`0xed870`

RtlCallEnclaveReturn

Ordinal	`761`
Address	`0xa15bb`

RtlCancelTimer

Ordinal	`762`
Address	`0x112e80`

RtlCanonicalizeDomainName

Ordinal	`763`
Address	`0xcf10`

RtlCapabilityCheck

Ordinal	`764`
Address	`0x3fc90`

RtlCapabilityCheckForSingleSessionSku

Ordinal	`765`
Address	`0x88c20`

RtlCaptureContext

Ordinal	`766`
Address	`0xa16b0`

RtlCaptureContext2

Ordinal	`767`
Address	`0xa17f0`

RtlCaptureStackBackTrace

Ordinal	`768`
Address	`0x526a0`

RtlCharToInteger

Ordinal	`769`
Address	`0x76b70`

RtlCheckBootStatusIntegrity

Ordinal	`770`
Address	`0xedbf0`

RtlCheckForOrphanedCriticalSections

Ordinal	`771`
Address	`0x7dfe0`

RtlCheckPortableOperatingSystem

Ordinal	`772`
Address	`0x47c50`

RtlCheckRegistryKey

Ordinal	`773`
Address	`0x458e0`

RtlCheckSandboxedToken

Ordinal	`774`
Address	`0x85f80`

RtlCheckSystemBootStatusIntegrity

Ordinal	`775`
Address	`0xedd50`

RtlCheckTokenCapability

Ordinal	`776`
Address	`0x3c650`

RtlCheckTokenMembership

Ordinal	`777`
Address	`0xe63a0`

RtlCheckTokenMembershipEx

Ordinal	`778`
Address	`0x36520`

RtlCleanUpTEBLangLists

Ordinal	`779`
Address	`0x6fdd0`

RtlClearAllBits

Ordinal	`780`
Address	`0x78f10`

RtlClearAllBitsEx

Ordinal	`781`
Address	`0xeb8e0`

RtlClearBit

Ordinal	`782`
Address	`0x9cd40`

RtlClearBitEx

Ordinal	`783`
Address	`0xeb910`

RtlClearBits

Ordinal	`784`
Address	`0x58560`

RtlClearBitsEx

Ordinal	`785`
Address	`0xeb920`

RtlClearThreadWorkOnBehalfTicket

Ordinal	`786`
Address	`0x68a80`

RtlCloneMemoryStream

Ordinal	`787`
Address	`0xd5990`

RtlCloneUserProcess

Ordinal	`788`
Address	`0xd63c0`

RtlCmDecodeMemIoResource

Ordinal	`789`
Address	`0xf1e80`

RtlCmEncodeMemIoResource

Ordinal	`790`
Address	`0xf1ef0`

RtlCommitDebugInfo

Ordinal	`791`
Address	`0xd7330`

RtlCommitMemoryStream

Ordinal	`792`
Address	`0xd5990`

RtlCompactHeap

Ordinal	`793`
Address	`0xf22f0`

RtlCompareAltitudes

Ordinal	`794`
Address	`0xf56c0`

RtlCompareMemory

Ordinal	`795`
Address	`0xa1f00`

RtlCompareMemoryUlong

Ordinal	`796`
Address	`0xa1f80`

RtlCompareString

Ordinal	`797`
Address	`0x8b770`

RtlCompareUnicodeString

Ordinal	`798`
Address	`0x16090`

RtlCompareUnicodeStrings

Ordinal	`799`
Address	`0x15ff0`

RtlCompleteProcessCloning

Ordinal	`800`
Address	`0x9ba50`

RtlCompressBuffer

Ordinal	`801`
Address	`0x82f90`

RtlComputeCrc32

Ordinal	`802`
Address	`0x59ea0`

RtlComputeImportTableHash

Ordinal	`803`
Address	`0xe0600`

RtlComputePrivatizedDllName_U

Ordinal	`804`
Address	`0xd5610`

RtlConnectToSm

Ordinal	`805`
Address	`0x89bc0`

RtlConsoleMultiByteToUnicodeN

Ordinal	`806`
Address	`0xe5010`

RtlConstructCrossVmEventPath

Ordinal	`807`
Address	`0xf5ad0`

RtlConstructCrossVmMutexPath

Ordinal	`808`
Address	`0xf5ad0`

RtlContractHashTable

Ordinal	`809`
Address	`0x883f0`

RtlConvertDeviceFamilyInfoToString

Ordinal	`810`
Address	`0x7b820`

RtlConvertExclusiveToShared

Ordinal	`811`
Address	`0x8a5f0`

RtlConvertLCIDToString

Ordinal	`812`
Address	`0xeee10`

RtlConvertSRWLockExclusiveToShared

Ordinal	`813`
Address	`0x85880`

RtlConvertSharedToExclusive

Ordinal	`814`
Address	`0x7ed90`

RtlConvertSidToUnicodeString

Ordinal	`815`
Address	`0x37250`

RtlConvertToAutoInheritSecurityObject

Ordinal	`816`
Address	`0xd6900`

RtlCopyBitMap

Ordinal	`817`
Address	`0xeb9e0`

RtlCopyContext

Ordinal	`818`
Address	`0x51f70`

RtlCopyExtendedContext

Ordinal	`819`
Address	`0xf5c70`

RtlCopyLuid

Ordinal	`820`
Address	`0x7a1e0`

RtlCopyLuidAndAttributesArray

Ordinal	`821`
Address	`0xe63c0`

RtlCopyMappedMemory

Ordinal	`822`
Address	`0x858e0`

RtlCopyMemory

Ordinal	`823`
Address	`0xa43c0`

RtlCopyMemoryNonTemporal

Ordinal	`824`
Address	`0xa1fb0`

RtlCopyMemoryStreamTo

Ordinal	`825`
Address	`0xd5990`

RtlCopyOutOfProcessMemoryStreamTo

Ordinal	`826`
Address	`0xd5990`

RtlCopySecurityDescriptor

Ordinal	`827`
Address	`0x6e000`

RtlCopySid

Ordinal	`828`
Address	`0x688e0`

RtlCopySidAndAttributesArray

Ordinal	`829`
Address	`0xe63f0`

RtlCopyString

Ordinal	`830`
Address	`0x85970`

RtlCopyUnicodeString

Ordinal	`831`
Address	`0x102f0`

RtlCrc32

Ordinal	`832`
Address	`0x7f300`

RtlCrc64

Ordinal	`833`
Address	`0xf63e0`

RtlCreateAcl

Ordinal	`834`
Address	`0x3a450`

RtlCreateActivationContext

Ordinal	`835`
Address	`0x73e70`

RtlCreateAndSetSD

Ordinal	`836`
Address	`0x67e60`

RtlCreateAtomTable

Ordinal	`837`
Address	`0x59cb0`

RtlCreateBootStatusDataFile

Ordinal	`838`
Address	`0xeddb0`

RtlCreateBoundaryDescriptor

Ordinal	`839`
Address	`0x82670`

RtlCreateEnvironment

Ordinal	`840`
Address	`0x4b1b0`

RtlCreateEnvironmentEx

Ordinal	`841`
Address	`0x4b220`

RtlCreateHashTable

Ordinal	`842`
Address	`0x743c0`

RtlCreateHashTableEx

Ordinal	`843`
Address	`0x8af70`

RtlCreateHeap

Ordinal	`844`
Address	`0xa8b0`

RtlCreateMemoryBlockLookaside

Ordinal	`845`
Address	`0x7b5a0`

RtlCreateMemoryZone

Ordinal	`846`
Address	`0x7b770`

RtlCreateProcessParameters

Ordinal	`847`
Address	`0xd6650`

RtlCreateProcessParametersEx

Ordinal	`848`
Address	`0x4a850`

RtlCreateProcessParametersWithTemplate

Ordinal	`849`
Address	`0x4a8c0`

RtlCreateProcessReflection

Ordinal	`850`
Address	`0xd5ac0`

RtlCreateQueryDebugBuffer

Ordinal	`851`
Address	`0xd7340`

RtlCreateRegistryKey

Ordinal	`852`
Address	`0xee620`

RtlCreateSecurityDescriptor

Ordinal	`853`
Address	`0x3c950`

RtlCreateServiceSid

Ordinal	`854`
Address	`0x3fa80`

RtlCreateSystemVolumeInformationFolder

Ordinal	`855`
Address	`0x88430`

RtlCreateTagHeap

Ordinal	`856`
Address	`0x7da50`

RtlCreateTimer

Ordinal	`857`
Address	`0x9d50`

RtlCreateTimerQueue

Ordinal	`858`
Address	`0x83020`

RtlCreateUmsCompletionList

Ordinal	`859`
Address	`0xf6e00`

RtlCreateUmsThreadContext

Ordinal	`860`
Address	`0xf6f20`

RtlCreateUnicodeString

Ordinal	`861`
Address	`0x38af0`

RtlCreateUnicodeStringFromAsciiz

Ordinal	`862`
Address	`0x16570`

RtlCreateUserFiberShadowStack

Ordinal	`863`
Address	`0xe1820`

RtlCreateUserProcess

Ordinal	`864`
Address	`0xe18a0`

RtlCreateUserProcessEx

Ordinal	`865`
Address	`0x88f50`

RtlCreateUserSecurityObject

Ordinal	`866`
Address	`0xd6910`

RtlCreateUserStack

Ordinal	`867`
Address	`0x77320`

RtlCreateUserThread

Ordinal	`868`
Address	`0x48780`

RtlCreateVirtualAccountSid

Ordinal	`869`
Address	`0x84510`

RtlCultureNameToLCID

Ordinal	`870`
Address	`0x3b850`

RtlCustomCPToUnicodeN

Ordinal	`871`
Address	`0xe5180`

RtlCutoverTimeToSystemTime

Ordinal	`872`
Address	`0x5c3b0`

RtlDeCommitDebugInfo

Ordinal	`873`
Address	`0xd75e0`

RtlDeNormalizeProcessParams

Ordinal	`874`
Address	`0xd66c0`

RtlDeactivateActivationContext

Ordinal	`875`
Address	`0x71a50`

RtlDeactivateActivationContextUnsafeFast

Ordinal	`876`
Address	`0x197b0`

RtlDebugPrintTimes

Ordinal	`877`
Address	`0x808d0`

RtlDecodePointer

Ordinal	`878`
Address	`0x6b3f0`

RtlDecodeRemotePointer

Ordinal	`879`
Address	`0xdc7a0`

RtlDecodeSystemPointer

Ordinal	`880`
Address	`0x83db0`

RtlDecompressBuffer

Ordinal	`881`
Address	`0xf58c0`

RtlDecompressBufferEx

Ordinal	`882`
Address	`0x80200`

RtlDecompressFragment

Ordinal	`883`
Address	`0xf5940`

RtlDefaultNpAcl

Ordinal	`884`
Address	`0xd69b0`

RtlDelete

Ordinal	`885`
Address	`0x66ae0`

RtlDeleteAce

Ordinal	`886`
Address	`0x79790`

RtlDeleteAtomFromAtomTable

Ordinal	`887`
Address	`0x59160`

RtlDeleteBarrier

Ordinal	`888`
Address	`0xed880`

RtlDeleteBoundaryDescriptor

Ordinal	`889`
Address	`0x22e70`

RtlDeleteCriticalSection

Ordinal	`890`
Address	`0x10fc0`

RtlDeleteElementGenericTable

Ordinal	`891`
Address	`0x665e0`

RtlDeleteElementGenericTableAvl

Ordinal	`892`
Address	`0x5cd00`

RtlDeleteElementGenericTableAvlEx

Ordinal	`893`
Address	`0x5cd40`

RtlDeleteFunctionTable

Ordinal	`894`
Address	`0x68ec0`

RtlDeleteGrowableFunctionTable

Ordinal	`895`
Address	`0x69390`

RtlDeleteHashTable

Ordinal	`896`
Address	`0x7bf60`

RtlDeleteNoSplay

Ordinal	`897`
Address	`0x66b80`

RtlDeleteRegistryValue

Ordinal	`898`
Address	`0x8c510`

RtlDeleteResource

Ordinal	`899`
Address	`0x10f30`

RtlDeleteSecurityObject

Ordinal	`900`
Address	`0x7e0d0`

RtlDeleteTimer

Ordinal	`901`
Address	`0x9c00`

RtlDeleteTimerQueue

Ordinal	`902`
Address	`0x112e90`

RtlDeleteTimerQueueEx

Ordinal	`903`
Address	`0x84d40`

RtlDeleteUmsCompletionList

Ordinal	`904`
Address	`0xf7030`

RtlDeleteUmsThreadContext

Ordinal	`905`
Address	`0xf7090`

RtlDequeueUmsCompletionListItems

Ordinal	`906`
Address	`0xf70f0`

RtlDeregisterSecureMemoryCacheCallback

Ordinal	`907`
Address	`0xf7ab0`

RtlDeregisterWait

Ordinal	`908`
Address	`0x85e10`

RtlDeregisterWaitEx

Ordinal	`909`
Address	`0xb5b0`

RtlDeriveCapabilitySidsFromName

Ordinal	`910`
Address	`0x1fd40`

RtlDestroyAtomTable

Ordinal	`911`
Address	`0x8ad10`

RtlDestroyEnvironment

Ordinal	`912`
Address	`0x7e120`

RtlDestroyHandleTable

Ordinal	`913`
Address	`0x85a80`

RtlDestroyHeap

Ordinal	`914`
Address	`0x9680`

RtlDestroyMemoryBlockLookaside

Ordinal	`915`
Address	`0x85500`

RtlDestroyMemoryZone

Ordinal	`916`
Address	`0x85560`

RtlDestroyProcessParameters

Ordinal	`917`
Address	`0x7e120`

RtlDestroyQueryDebugBuffer

Ordinal	`918`
Address	`0xd75f0`

RtlDetectHeapLeaks

Ordinal	`919`
Address	`0x61770`

RtlDetermineDosPathNameType_U

Ordinal	`920`
Address	`0x772a0`

RtlDisableThreadProfiling

Ordinal	`921`
Address	`0xcbe20`

RtlDisownModuleHeapAllocation

Ordinal	`922`
Address	`0x80360`

RtlDllShutdownInProgress

Ordinal	`923`
Address	`0x64910`

RtlDnsHostNameToComputerName

Ordinal	`924`
Address	`0x62000`

RtlDoesFileExists_U

Ordinal	`925`
Address	`0x86200`

RtlDoesNameContainWildCards

Ordinal	`926`
Address	`0xfb450`

RtlDosApplyFileIsolationRedirection_Ustr

Ordinal	`927`
Address	`0x1a9e0`

RtlDosLongPathNameToNtPathName_U_WithStatus

Ordinal	`928`
Address	`0xcc370`

RtlDosLongPathNameToRelativeNtPathName_U_WithStatus

Ordinal	`929`
Address	`0xcc3a0`

RtlDosPathNameToNtPathName_U

Ordinal	`930`
Address	`0x17310`

RtlDosPathNameToNtPathName_U_WithStatus

Ordinal	`931`
Address	`0x16be0`

RtlDosPathNameToRelativeNtPathName_U

Ordinal	`932`
Address	`0x16b80`

RtlDosPathNameToRelativeNtPathName_U_WithStatus

Ordinal	`933`
Address	`0x1aee0`

RtlDosSearchPath_U

Ordinal	`934`
Address	`0x89480`

RtlDosSearchPath_Ustr

Ordinal	`935`
Address	`0x19c40`

RtlDowncaseUnicodeChar

Ordinal	`936`
Address	`0xeb290`

RtlDowncaseUnicodeString

Ordinal	`937`
Address	`0x7c6f0`

RtlDrainNonVolatileFlush

Ordinal	`938`
Address	`0xfbc70`

RtlDumpResource

Ordinal	`939`
Address	`0xe8d20`

RtlDuplicateUnicodeString

Ordinal	`940`
Address	`0x79e50`

RtlEmptyAtomTable

Ordinal	`941`
Address	`0x8add0`

RtlEnableEarlyCriticalSectionEventCreation

Ordinal	`942`
Address	`0xe8d70`

RtlEnableThreadProfiling

Ordinal	`943`
Address	`0xcbe90`

RtlEnclaveCallDispatch

Ordinal	`944`
Address	`0xa14e0`

RtlEnclaveCallDispatchReturn

Ordinal	`945`
Address	`0xa1511`

RtlEncodePointer

Ordinal	`946`
Address	`0x72f50`

RtlEncodeRemotePointer

Ordinal	`947`
Address	`0xdc810`

RtlEncodeSystemPointer

Ordinal	`948`
Address	`0x856f0`

RtlEndEnumerationHashTable

Ordinal	`949`
Address	`0x81a10`

RtlEndStrongEnumerationHashTable

Ordinal	`950`
Address	`0x808d0`

RtlEndWeakEnumerationHashTable

Ordinal	`951`
Address	`0xf5c40`

RtlEnterCriticalSection

Ordinal	`952`
Address	`0x2faa0`

RtlEnterUmsSchedulingMode

Ordinal	`953`
Address	`0xf7180`

RtlEnumProcessHeaps

Ordinal	`954`
Address	`0xf2480`

RtlEnumerateEntryHashTable

Ordinal	`955`
Address	`0x68d20`

RtlEnumerateGenericTable

Ordinal	`956`
Address	`0x66570`

RtlEnumerateGenericTableAvl

Ordinal	`957`
Address	`0x65ee0`

RtlEnumerateGenericTableLikeADirectory

Ordinal	`958`
Address	`0xf7860`

RtlEnumerateGenericTableWithoutSplaying

Ordinal	`959`
Address	`0x66dd0`

RtlEnumerateGenericTableWithoutSplayingAvl

Ordinal	`960`
Address	`0x65f00`

RtlEqualComputerName

Ordinal	`961`
Address	`0xeb2a0`

RtlEqualDomainName

Ordinal	`962`
Address	`0xce90`

RtlEqualLuid

Ordinal	`963`
Address	`0xe64b0`

RtlEqualPrefixSid

Ordinal	`964`
Address	`0x37de0`

RtlEqualSid

Ordinal	`965`
Address	`0x38310`

RtlEqualString

Ordinal	`966`
Address	`0x61f60`

RtlEqualUnicodeString

Ordinal	`967`
Address	`0x20d10`

RtlEqualWnfChangeStamps

Ordinal	`968`
Address	`0x85cc0`

RtlEraseUnicodeString

Ordinal	`969`
Address	`0x86260`

RtlEthernetAddressToStringA

Ordinal	`970`
Address	`0xfbdc0`

RtlEthernetAddressToStringW

Ordinal	`971`
Address	`0xfbe30`

RtlEthernetStringToAddressA

Ordinal	`972`
Address	`0xfbea0`

RtlEthernetStringToAddressW

Ordinal	`973`
Address	`0xfbfe0`

RtlExecuteUmsThread

Ordinal	`974`
Address	`0xf7260`

RtlExitUserProcess

Ordinal	`975`
Address	`0x5eee0`

RtlExitUserThread

Ordinal	`976`
Address	`0x4ec30`

RtlExpandEnvironmentStrings

Ordinal	`977`
Address	`0x15630`

RtlExpandEnvironmentStrings_U

Ordinal	`978`
Address	`0x77e10`

RtlExpandHashTable

Ordinal	`979`
Address	`0x88c80`

RtlExtendCorrelationVector

Ordinal	`980`
Address	`0x85140`

RtlExtendMemoryBlockLookaside

Ordinal	`981`
Address	`0x1a60`

RtlExtendMemoryZone

Ordinal	`982`
Address	`0x1a70`

RtlExtractBitMap

Ordinal	`983`
Address	`0xebbf0`

RtlFillMemory

Ordinal	`984`
Address	`0xfc280`

RtlFillMemoryNonTemporal

Ordinal	`985`
Address	`0xa20f0`

RtlFillNonVolatileMemory

Ordinal	`986`
Address	`0xfc2a0`

RtlFinalReleaseOutOfProcessMemoryStream

Ordinal	`987`
Address	`0x808d0`

RtlFindAceByType

Ordinal	`988`
Address	`0x3c040`

RtlFindActivationContextSectionGuid

Ordinal	`989`
Address	`0x1cd80`

RtlFindActivationContextSectionString

Ordinal	`990`
Address	`0x1c6c0`

RtlFindCharInUnicodeString

Ordinal	`991`
Address	`0x1d390`

RtlFindClearBits

Ordinal	`992`
Address	`0x86530`

RtlFindClearBitsAndSet

Ordinal	`993`
Address	`0x54fe0`

RtlFindClearBitsEx

Ordinal	`994`
Address	`0xebd90`

RtlFindClearRuns

Ordinal	`995`
Address	`0xec090`

RtlFindClosestEncodableLength

Ordinal	`996`
Address	`0xf1fe0`

RtlFindExportedRoutineByName

Ordinal	`997`
Address	`0x7aca0`

RtlFindLastBackwardRunClear

Ordinal	`998`
Address	`0x59de0`

RtlFindLeastSignificantBit

Ordinal	`999`
Address	`0x85950`

RtlFindLongestRunClear

Ordinal	`1000`
Address	`0xec370`

RtlFindMessage

Ordinal	`1001`
Address	`0x6a4e0`

RtlFindMostSignificantBit

Ordinal	`1002`
Address	`0x85a40`

RtlFindNextForwardRunClear

Ordinal	`1003`
Address	`0x86400`

RtlFindSetBits

Ordinal	`1004`
Address	`0x8a0c0`

RtlFindSetBitsAndClear

Ordinal	`1005`
Address	`0xec3b0`

RtlFindSetBitsAndClearEx

Ordinal	`1006`
Address	`0xec750`

RtlFindSetBitsEx

Ordinal	`1007`
Address	`0xecad0`

RtlFindUnicodeSubstring

Ordinal	`1008`
Address	`0x87800`

RtlFirstEntrySList

Ordinal	`1009`
Address	`0xa1110`

RtlFirstFreeAce

Ordinal	`1010`
Address	`0x37710`

RtlFlsAlloc

Ordinal	`1011`
Address	`0x75870`

RtlFlsFree

Ordinal	`1012`
Address	`0x74680`

RtlFlsGetValue

Ordinal	`1013`
Address	`0x53600`

RtlFlsSetValue

Ordinal	`1014`
Address	`0x4fb60`

RtlFlushHeaps

Ordinal	`1015`
Address	`0x74f90`

RtlFlushNonVolatileMemory

Ordinal	`1016`
Address	`0xfbca0`

RtlFlushNonVolatileMemoryRanges

Ordinal	`1017`
Address	`0xfc350`

RtlFlushSecureMemoryCache

Ordinal	`1018`
Address	`0xf7b70`

RtlFormatCurrentUserKeyPath

Ordinal	`1019`
Address	`0x36c40`

RtlFormatMessage

Ordinal	`1020`
Address	`0xfc540`

RtlFormatMessageEx

Ordinal	`1021`
Address	`0x67210`

RtlFreeActivationContextStack

Ordinal	`1022`
Address	`0x71910`

RtlFreeAnsiString

Ordinal	`1023`
Address	`0x16760`

RtlFreeHandle

Ordinal	`1024`
Address	`0x59d20`

RtlFreeHeap

Ordinal	`1025`
Address	`0x24760`

RtlFreeMemoryBlockLookaside

Ordinal	`1026`
Address	`0x11c190`

RtlFreeNonVolatileToken

Ordinal	`1027`
Address	`0xfc3e0`

RtlFreeOemString

Ordinal	`1028`
Address	`0x8b150`

RtlFreeSid

Ordinal	`1029`
Address	`0x761b0`

RtlFreeThreadActivationContextStack

Ordinal	`1030`
Address	`0x718d0`

RtlFreeUTF8String

Ordinal	`1031`
Address	`0x16760`

RtlFreeUnicodeString

Ordinal	`1032`
Address	`0x16760`

RtlFreeUserFiberShadowStack

Ordinal	`1033`
Address	`0xe1930`

RtlFreeUserStack

Ordinal	`1034`
Address	`0x7fff0`

RtlGUIDFromString

Ordinal	`1035`
Address	`0x6af60`

RtlGenerate8dot3Name

Ordinal	`1036`
Address	`0xfc730`

RtlGetAce

Ordinal	`1037`
Address	`0x72200`

RtlGetActiveActivationContext

Ordinal	`1038`
Address	`0x6c5e0`

RtlGetActiveConsoleId

Ordinal	`1039`
Address	`0x83e60`

RtlGetAppContainerNamedObjectPath

Ordinal	`1040`
Address	`0x43ee0`

RtlGetAppContainerParent

Ordinal	`1041`
Address	`0x43e10`

RtlGetAppContainerSidType

Ordinal	`1042`
Address	`0x44680`

RtlGetCallersAddress

Ordinal	`1043`
Address	`0xed9c0`

RtlGetCompressionWorkSpaceSize

Ordinal	`1044`
Address	`0x81290`

RtlGetConsoleSessionForegroundProcessId

Ordinal	`1045`
Address	`0xfce40`

RtlGetControlSecurityDescriptor

Ordinal	`1046`
Address	`0x7adb0`

RtlGetCriticalSectionRecursionCount

Ordinal	`1047`
Address	`0xe8da0`

RtlGetCurrentDirectory_U

Ordinal	`1048`
Address	`0x5e7a0`

RtlGetCurrentPeb

Ordinal	`1049`
Address	`0xfce80`

RtlGetCurrentProcessorNumber

Ordinal	`1050`
Address	`0xa21f0`

RtlGetCurrentProcessorNumberEx

Ordinal	`1051`
Address	`0xa2230`

RtlGetCurrentServiceSessionId

Ordinal	`1052`
Address	`0x24850`

RtlGetCurrentTransaction

Ordinal	`1053`
Address	`0x6ebe0`

RtlGetCurrentUmsThread

Ordinal	`1054`
Address	`0x59ef0`

RtlGetDaclSecurityDescriptor

Ordinal	`1055`
Address	`0x71d60`

RtlGetDeviceFamilyInfoEnum

Ordinal	`1056`
Address	`0x3f850`

RtlGetElementGenericTable

Ordinal	`1057`
Address	`0x7f110`

RtlGetElementGenericTableAvl

Ordinal	`1058`
Address	`0xf7990`

RtlGetEnabledExtendedFeatures

Ordinal	`1059`
Address	`0x82570`

RtlGetExePath

Ordinal	`1060`
Address	`0x82aa0`

RtlGetExtendedContextLength

Ordinal	`1061`
Address	`0x52cb0`

RtlGetExtendedContextLength2

Ordinal	`1062`
Address	`0x52e60`

RtlGetExtendedFeaturesMask

Ordinal	`1063`
Address	`0xf5c90`

RtlGetFileMUIPath

Ordinal	`1064`
Address	`0x468f0`

RtlGetFrame

Ordinal	`1065`
Address	`0xcdb00`

RtlGetFullPathName_U

Ordinal	`1066`
Address	`0x81cd0`

RtlGetFullPathName_UEx

Ordinal	`1067`
Address	`0x1d800`

RtlGetFullPathName_UstrEx

Ordinal	`1068`
Address	`0x1d890`

RtlGetFunctionTableListHead

Ordinal	`1069`
Address	`0xe0ad0`

RtlGetGroupSecurityDescriptor

Ordinal	`1070`
Address	`0x7aa60`

RtlGetIntegerAtom

Ordinal	`1071`
Address	`0x59900`

RtlGetInterruptTimePrecise

Ordinal	`1072`
Address	`0x43d60`

RtlGetLastNtStatus

Ordinal	`1073`
Address	`0x7d000`

RtlGetLastWin32Error

Ordinal	`1074`
Address	`0x19f0`

RtlGetLengthWithoutLastFullDosOrNtPathElement

Ordinal	`1075`
Address	`0x788c0`

RtlGetLengthWithoutTrailingPathSeperators

Ordinal	`1076`
Address	`0x86050`

RtlGetLocaleFileMappingAddress

Ordinal	`1077`
Address	`0x7d210`

RtlGetLongestNtPathLength

Ordinal	`1078`
Address	`0x85cd0`

RtlGetMultiTimePrecise

Ordinal	`1079`
Address	`0xe5b40`

RtlGetNativeSystemInformation

Ordinal	`1080`
Address	`0x9dc10`

RtlGetNextEntryHashTable

Ordinal	`1081`
Address	`0x82a60`

RtlGetNextUmsListItem

Ordinal	`1082`
Address	`0xf7460`

RtlGetNonVolatileToken

Ordinal	`1083`
Address	`0xfc400`

RtlGetNtGlobalFlags

Ordinal	`1084`
Address	`0x9cd90`

RtlGetNtProductType

Ordinal	`1085`
Address	`0x3cbb0`

RtlGetNtSystemRoot

Ordinal	`1086`
Address	`0x16bb0`

RtlGetNtVersionNumbers

Ordinal	`1087`
Address	`0xd4960`

RtlGetOwnerSecurityDescriptor

Ordinal	`1088`
Address	`0x795c0`

RtlGetParentLocaleName

Ordinal	`1089`
Address	`0x3c490`

RtlGetPersistedStateLocation

Ordinal	`1090`
Address	`0x4a370`

RtlGetProcessHeaps

Ordinal	`1091`
Address	`0xf2490`

RtlGetProcessPreferredUILanguages

Ordinal	`1092`
Address	`0x8ab20`

RtlGetProductInfo

Ordinal	`1093`
Address	`0x7e7b0`

RtlGetReturnAddressHijackTarget

Ordinal	`1094`
Address	`0xfd800`

RtlGetSaclSecurityDescriptor

Ordinal	`1095`
Address	`0x76c30`

RtlGetSearchPath

Ordinal	`1096`
Address	`0x83e10`

RtlGetSecurityDescriptorRMControl

Ordinal	`1097`
Address	`0x86000`

RtlGetSessionProperties

Ordinal	`1098`
Address	`0xe64d0`

RtlGetSetBootStatusData

Ordinal	`1099`
Address	`0xedf10`

RtlGetSuiteMask

Ordinal	`1100`
Address	`0x3cc10`

RtlGetSystemBootStatus

Ordinal	`1101`
Address	`0x8bef0`

RtlGetSystemBootStatusEx

Ordinal	`1102`
Address	`0xee070`

RtlGetSystemPreferredUILanguages

Ordinal	`1103`
Address	`0x76fb0`

RtlGetSystemTimeAndBias

Ordinal	`1104`
Address	`0x9cc20`

RtlGetSystemTimePrecise

Ordinal	`1105`
Address	`0x400a0`

RtlGetThreadErrorMode

Ordinal	`1106`
Address	`0x61c00`

RtlGetThreadLangIdByIndex

Ordinal	`1107`
Address	`0xeef10`

RtlGetThreadPreferredUILanguages

Ordinal	`1108`
Address	`0x35ca0`

RtlGetThreadWorkOnBehalfTicket

Ordinal	`1109`
Address	`0x6c6d0`

RtlGetTokenNamedObjectPath

Ordinal	`1110`
Address	`0x458c0`

RtlGetUILanguageInfo

Ordinal	`1111`
Address	`0xeefe0`

RtlGetUmsCompletionListEvent

Ordinal	`1112`
Address	`0xf7490`

RtlGetUnloadEventTrace

Ordinal	`1113`
Address	`0xce710`

RtlGetUnloadEventTraceEx

Ordinal	`1114`
Address	`0xce720`

RtlGetUserInfoHeap

Ordinal	`1115`
Address	`0x1bc0`

RtlGetUserPreferredUILanguages

Ordinal	`1116`
Address	`0x7ca30`

RtlGetVersion

Ordinal	`1117`
Address	`0x3e4e0`

RtlGrowFunctionTable

Ordinal	`1118`
Address	`0xe0ae0`

RtlGuardCheckLongJumpTarget

Ordinal	`1119`
Address	`0x6eed0`

RtlHashUnicodeString

Ordinal	`1120`
Address	`0x1ccb0`

RtlHeapTrkInitialize

Ordinal	`1121`
Address	`0xfda30`

RtlIdentifierAuthoritySid

Ordinal	`1122`
Address	`0x7a510`

RtlIdnToAscii

Ordinal	`1123`
Address	`0xd0c0`

RtlIdnToNameprepUnicode

Ordinal	`1124`
Address	`0xfee80`

RtlIdnToUnicode

Ordinal	`1125`
Address	`0xc6f0`

RtlImageDirectoryEntryToData

Ordinal	`1126`
Address	`0x7e350`

RtlImageNtHeader

Ordinal	`1127`
Address	`0x35bd0`

RtlImageNtHeaderEx

Ordinal	`1128`
Address	`0x32ad0`

RtlImageRvaToSection

Ordinal	`1129`
Address	`0x33aa0`

RtlImageRvaToVa

Ordinal	`1130`
Address	`0x86f50`

RtlImpersonateSelf

Ordinal	`1131`
Address	`0x78400`

RtlImpersonateSelfEx

Ordinal	`1132`
Address	`0x78410`

RtlIncrementCorrelationVector

Ordinal	`1133`
Address	`0x851d0`

RtlInitAnsiString

Ordinal	`1134`
Address	`0x152f0`

RtlInitAnsiStringEx

Ordinal	`1135`
Address	`0x16530`

RtlInitBarrier

Ordinal	`1136`
Address	`0xed8b0`

RtlInitCodePageTable

Ordinal	`1137`
Address	`0xe52e0`

RtlInitEnumerationHashTable

Ordinal	`1138`
Address	`0x68af0`

RtlInitMemoryStream

Ordinal	`1139`
Address	`0x808d0`

RtlInitNlsTables

Ordinal	`1140`
Address	`0xe53e0`

RtlInitOutOfProcessMemoryStream

Ordinal	`1141`
Address	`0x808d0`

RtlInitString

Ordinal	`1142`
Address	`0x152f0`

RtlInitStringEx

Ordinal	`1143`
Address	`0xeb6f0`

RtlInitStrongEnumerationHashTable

Ordinal	`1144`
Address	`0x68b60`

RtlInitUTF8String

Ordinal	`1145`
Address	`0x86040`

RtlInitUTF8StringEx

Ordinal	`1146`
Address	`0xeb6f0`

RtlInitUnicodeString

Ordinal	`1147`
Address	`0x3ba40`

RtlInitUnicodeStringEx

Ordinal	`1148`
Address	`0x1c270`

RtlInitWeakEnumerationHashTable

Ordinal	`1149`
Address	`0xf5c50`

RtlInitializeAtomPackage

Ordinal	`1150`
Address	`0x847c0`

RtlInitializeBitMap

Ordinal	`1151`
Address	`0x7c340`

RtlInitializeBitMapEx

Ordinal	`1152`
Address	`0x9cd50`

RtlInitializeConditionVariable

Ordinal	`1153`
Address	`0x6b440`

RtlInitializeContext

Ordinal	`1154`
Address	`0xfeec0`

RtlInitializeCorrelationVector

Ordinal	`1155`
Address	`0x85b60`

RtlInitializeCriticalSection

Ordinal	`1156`
Address	`0x62a40`

RtlInitializeCriticalSectionAndSpinCount

Ordinal	`1157`
Address	`0x65e10`

RtlInitializeCriticalSectionEx

Ordinal	`1158`
Address	`0x20bc0`

RtlInitializeExtendedContext

Ordinal	`1159`
Address	`0x52d00`

RtlInitializeExtendedContext2

Ordinal	`1160`
Address	`0x53090`

RtlInitializeGenericTable

Ordinal	`1161`
Address	`0x7e3a0`

RtlInitializeGenericTableAvl

Ordinal	`1162`
Address	`0x7e750`

RtlInitializeHandleTable

Ordinal	`1163`
Address	`0x80320`

RtlInitializeNtUserPfn

Ordinal	`1164`
Address	`0x8c670`

RtlInitializeRXact

Ordinal	`1165`
Address	`0x8bb50`

RtlInitializeResource

Ordinal	`1166`
Address	`0x112e0`

RtlInitializeSListHead

Ordinal	`1167`
Address	`0x6fbb0`

RtlInitializeSRWLock

Ordinal	`1168`
Address	`0x6b440`

RtlInitializeSid

Ordinal	`1169`
Address	`0x40070`

RtlInitializeSidEx

Ordinal	`1170`
Address	`0x40010`

RtlInsertElementGenericTable

Ordinal	`1171`
Address	`0x66670`

RtlInsertElementGenericTableAvl

Ordinal	`1172`
Address	`0x5cf30`

RtlInsertElementGenericTableFull

Ordinal	`1173`
Address	`0x666e0`

RtlInsertElementGenericTableFullAvl

Ordinal	`1174`
Address	`0x5cfa0`

RtlInsertEntryHashTable

Ordinal	`1175`
Address	`0x68ba0`

RtlInstallFunctionTableCallback

Ordinal	`1176`
Address	`0x698e0`

RtlInt64ToUnicodeString

Ordinal	`1177`
Address	`0xeda20`

RtlIntegerToChar

Ordinal	`1178`
Address	`0x163a0`

RtlIntegerToUnicodeString

Ordinal	`1179`
Address	`0x164a0`

RtlInterlockedClearBitRun

Ordinal	`1180`
Address	`0x7b030`

RtlInterlockedFlushSList

Ordinal	`1181`
Address	`0x711c0`

RtlInterlockedPopEntrySList

Ordinal	`1182`
Address	`0xa1120`

RtlInterlockedPushEntrySList

Ordinal	`1183`
Address	`0x6b430`

RtlInterlockedPushListSList

Ordinal	`1184`
Address	`0xa11d0`

RtlInterlockedPushListSListEx

Ordinal	`1185`
Address	`0xff180`

RtlInterlockedSetBitRun

Ordinal	`1186`
Address	`0xece00`

RtlIoDecodeMemIoResource

Ordinal	`1187`
Address	`0xf2090`

RtlIoEncodeMemIoResource

Ordinal	`1188`
Address	`0xf2130`

RtlIpv4AddressToStringA

Ordinal	`1189`
Address	`0x7e230`

RtlIpv4AddressToStringExA

Ordinal	`1190`
Address	`0x7e190`

RtlIpv4AddressToStringExW

Ordinal	`1191`
Address	`0x7c210`

RtlIpv4AddressToStringW

Ordinal	`1192`
Address	`0x7c2e0`

RtlIpv4StringToAddressA

Ordinal	`1193`
Address	`0x78d20`

RtlIpv4StringToAddressExA

Ordinal	`1194`
Address	`0x78c90`

RtlIpv4StringToAddressExW

Ordinal	`1195`
Address	`0xd5d0`

RtlIpv4StringToAddressW

Ordinal	`1196`
Address	`0xd720`

RtlIpv6AddressToStringA

Ordinal	`1197`
Address	`0x78700`

RtlIpv6AddressToStringExA

Ordinal	`1198`
Address	`0x78610`

RtlIpv6AddressToStringExW

Ordinal	`1199`
Address	`0x66e80`

RtlIpv6AddressToStringW

Ordinal	`1200`
Address	`0x66fc0`

RtlIpv6StringToAddressA

Ordinal	`1201`
Address	`0x7d730`

RtlIpv6StringToAddressExA

Ordinal	`1202`
Address	`0x7d690`

RtlIpv6StringToAddressExW

Ordinal	`1203`
Address	`0xd950`

RtlIpv6StringToAddressW

Ordinal	`1204`
Address	`0xdb60`

RtlIsActivationContextActive

Ordinal	`1205`
Address	`0xdfa90`

RtlIsCapabilitySid

Ordinal	`1206`
Address	`0x3c980`

RtlIsCloudFilesPlaceholder

Ordinal	`1207`
Address	`0x83de0`

RtlIsCriticalSectionLocked

Ordinal	`1208`
Address	`0xe8dd0`

RtlIsCriticalSectionLockedByThread

Ordinal	`1209`
Address	`0x14890`

RtlIsCurrentProcess

Ordinal	`1210`
Address	`0x75bf0`

RtlIsCurrentThread

Ordinal	`1211`
Address	`0xff2d0`

RtlIsCurrentThreadAttachExempt

Ordinal	`1212`
Address	`0x9bb50`

RtlIsDosDeviceName_U

Ordinal	`1213`
Address	`0x78160`

RtlIsElevatedRid

Ordinal	`1214`
Address	`0x844b0`

RtlIsGenericTableEmpty

Ordinal	`1215`
Address	`0x7a300`

RtlIsGenericTableEmptyAvl

Ordinal	`1216`
Address	`0x858b0`

RtlIsMultiSessionSku

Ordinal	`1217`
Address	`0x40210`

RtlIsMultiUsersInSessionSku

Ordinal	`1218`
Address	`0x82850`

RtlIsNameInExpression

Ordinal	`1219`
Address	`0xfb4a0`

RtlIsNameInUnUpcasedExpression

Ordinal	`1220`
Address	`0xfb550`

RtlIsNameLegalDOS8Dot3

Ordinal	`1221`
Address	`0xfcbc0`

RtlIsNonEmptyDirectoryReparsePointAllowed

Ordinal	`1222`
Address	`0xff300`

RtlIsNormalizedString

Ordinal	`1223`
Address	`0x100780`

RtlIsPackageSid

Ordinal	`1224`
Address	`0x841a0`

RtlIsParentOfChildAppContainer

Ordinal	`1225`
Address	`0x46720`

RtlIsPartialPlaceholder

Ordinal	`1226`
Address	`0x7e080`

RtlIsPartialPlaceholderFileHandle

Ordinal	`1227`
Address	`0xff190`

RtlIsPartialPlaceholderFileInfo

Ordinal	`1228`
Address	`0xff1f0`

RtlIsProcessorFeaturePresent

Ordinal	`1229`
Address	`0x10870`

RtlIsStateSeparationEnabled

Ordinal	`1230`
Address	`0x795a0`

RtlIsTextUnicode

Ordinal	`1231`
Address	`0x65930`

RtlIsThreadWithinLoaderCallout

Ordinal	`1232`
Address	`0x7e380`

RtlIsUntrustedObject

Ordinal	`1233`
Address	`0xe6580`

RtlIsValidHandle

Ordinal	`1234`
Address	`0x599e0`

RtlIsValidIndexHandle

Ordinal	`1235`
Address	`0x599a0`

RtlIsValidLocaleName

Ordinal	`1236`
Address	`0xfcf60`

RtlIsValidProcessTrustLabelSid

Ordinal	`1237`
Address	`0x686e0`

RtlIsZeroMemory

Ordinal	`1238`
Address	`0xff320`

RtlKnownExceptionFilter

Ordinal	`1239`
Address	`0x100850`

RtlLCIDToCultureName

Ordinal	`1240`
Address	`0x3b020`

RtlLargeIntegerToChar

Ordinal	`1241`
Address	`0x1010`

RtlLcidToLocaleName

Ordinal	`1242`
Address	`0x3b2f0`

RtlLeaveCriticalSection

Ordinal	`1243`
Address	`0x2f230`

RtlLengthRequiredSid

Ordinal	`1244`
Address	`0x7b0d0`

RtlLengthSecurityDescriptor

Ordinal	`1245`
Address	`0x72400`

RtlLengthSid

Ordinal	`1246`
Address	`0x6f1d0`

RtlLengthSidAsUnicodeString

Ordinal	`1247`
Address	`0x36d50`

RtlLoadString

Ordinal	`1248`
Address	`0x53b40`

RtlLocalTimeToSystemTime

Ordinal	`1249`
Address	`0xe5d50`

RtlLocaleNameToLcid

Ordinal	`1250`
Address	`0x3ba90`

RtlLocateExtendedFeature

Ordinal	`1251`
Address	`0xf5cb0`

RtlLocateExtendedFeature2

Ordinal	`1252`
Address	`0x725b0`

RtlLocateLegacyContext

Ordinal	`1253`
Address	`0x81a60`

RtlLockBootStatusData

Ordinal	`1254`
Address	`0xee090`

RtlLockCurrentThread

Ordinal	`1255`
Address	`0x83c80`

RtlLockHeap

Ordinal	`1256`
Address	`0x5f970`

RtlLockMemoryBlockLookaside

Ordinal	`1257`
Address	`0x5e990`

RtlLockMemoryStreamRegion

Ordinal	`1258`
Address	`0xd5990`

RtlLockMemoryZone

Ordinal	`1259`
Address	`0x5ea00`

RtlLockModuleSection

Ordinal	`1260`
Address	`0x5ec90`

RtlLogStackBackTrace

Ordinal	`1261`
Address	`0x101020`

RtlLookupAtomInAtomTable

Ordinal	`1262`
Address	`0x59680`

RtlLookupElementGenericTable

Ordinal	`1263`
Address	`0x667f0`

RtlLookupElementGenericTableAvl

Ordinal	`1264`
Address	`0x5d110`

RtlLookupElementGenericTableFull

Ordinal	`1265`
Address	`0xf77c0`

RtlLookupElementGenericTableFullAvl

Ordinal	`1266`
Address	`0x5d0d0`

RtlLookupEntryHashTable

Ordinal	`1267`
Address	`0x68c30`

RtlLookupFirstMatchingElementGenericTableAvl

Ordinal	`1268`
Address	`0x8a620`

RtlLookupFunctionEntry

Ordinal	`1269`
Address	`0x32be0`

RtlLookupFunctionTable

Ordinal	`1270`
Address	`0x9ca50`

RtlMakeSelfRelativeSD

Ordinal	`1271`
Address	`0x6e2a0`

RtlMapGenericMask

Ordinal	`1272`
Address	`0x37ea0`

RtlMapSecurityErrorToNtStatus

Ordinal	`1273`
Address	`0x1a10`

RtlMoveMemory

Ordinal	`1274`
Address	`0xa43c0`

RtlMultiAppendUnicodeStringBuffer

Ordinal	`1275`
Address	`0x6ec00`

RtlMultiByteToUnicodeN

Ordinal	`1276`
Address	`0x4be50`

RtlMultiByteToUnicodeSize

Ordinal	`1277`
Address	`0x16e10`

RtlMultipleAllocateHeap

Ordinal	`1278`
Address	`0xf28e0`

RtlMultipleFreeHeap

Ordinal	`1279`
Address	`0xf2960`

RtlNewInstanceSecurityObject

Ordinal	`1280`
Address	`0xd6d80`

RtlNewSecurityGrantedAccess

Ordinal	`1281`
Address	`0xd6eb0`

RtlNewSecurityObject

Ordinal	`1282`
Address	`0x88b10`

RtlNewSecurityObjectEx

Ordinal	`1283`
Address	`0x7ac30`

RtlNewSecurityObjectWithMultipleInheritance

Ordinal	`1284`
Address	`0x862f0`

RtlNormalizeProcessParams

Ordinal	`1285`
Address	`0x892f0`

RtlNormalizeSecurityDescriptor

Ordinal	`1286`
Address	`0xe6710`

RtlNormalizeString

Ordinal	`1287`
Address	`0x80b30`

RtlNotifyFeatureUsage

Ordinal	`1288`
Address	`0x101a30`

RtlNtPathNameToDosPathName

Ordinal	`1289`
Address	`0xcc3d0`

RtlNtStatusToDosError

Ordinal	`1290`
Address	`0x51950`

RtlNtStatusToDosErrorNoTeb

Ordinal	`1291`
Address	`0x769f0`

RtlNtdllName

Ordinal	`1292`
Address	`0x11e420`

RtlNumberGenericTableElements

Ordinal	`1293`
Address	`0x83e00`

RtlNumberGenericTableElementsAvl

Ordinal	`1294`
Address	`0x823d0`

RtlNumberOfClearBits

Ordinal	`1295`
Address	`0xecf90`

RtlNumberOfClearBitsEx

Ordinal	`1296`
Address	`0xecfc0`

RtlNumberOfClearBitsInRange

Ordinal	`1297`
Address	`0xecff0`

RtlNumberOfSetBits

Ordinal	`1298`
Address	`0x77fc0`

RtlNumberOfSetBitsEx

Ordinal	`1299`
Address	`0xed020`

RtlNumberOfSetBitsInRange

Ordinal	`1300`
Address	`0xed1c0`

RtlNumberOfSetBitsUlongPtr

Ordinal	`1301`
Address	`0x85ab0`

RtlOemStringToUnicodeSize

Ordinal	`1302`
Address	`0x16de0`

RtlOemStringToUnicodeString

Ordinal	`1303`
Address	`0x62260`

RtlOemToUnicodeN

Ordinal	`1304`
Address	`0x625e0`

RtlOpenCurrentUser

Ordinal	`1305`
Address	`0x16790`

RtlOsDeploymentState

Ordinal	`1306`
Address	`0x101fa0`

RtlOwnerAcesPresent

Ordinal	`1307`
Address	`0xe6be0`

RtlPcToFileHeader

Ordinal	`1308`
Address	`0x34a40`

RtlPinAtomInAtomTable

Ordinal	`1309`
Address	`0xeb080`

RtlPopFrame

Ordinal	`1310`
Address	`0x6c6b0`

RtlPrefixString

Ordinal	`1311`
Address	`0x62100`

RtlPrefixUnicodeString

Ordinal	`1312`
Address	`0x15f60`

RtlPrepareForProcessCloning

Ordinal	`1313`
Address	`0x9bb90`

RtlProcessFlsData

Ordinal	`1314`
Address	`0x5f280`

RtlProtectHeap

Ordinal	`1315`
Address	`0xe0e0`

RtlPublishWnfStateData

Ordinal	`1316`
Address	`0x7d530`

RtlPushFrame

Ordinal	`1317`
Address	`0x6b4c0`

RtlQueryActivationContextApplicationSettings

Ordinal	`1318`
Address	`0x7ade0`

RtlQueryAllFeatureConfigurations

Ordinal	`1319`
Address	`0x101ac0`

RtlQueryAtomInAtomTable

Ordinal	`1320`
Address	`0x59260`

RtlQueryCriticalSectionOwner

Ordinal	`1321`
Address	`0xe8df0`

RtlQueryDepthSList

Ordinal	`1322`
Address	`0x6c750`

RtlQueryDynamicTimeZoneInformation

Ordinal	`1323`
Address	`0xee660`

RtlQueryElevationFlags

Ordinal	`1324`
Address	`0x81980`

RtlQueryEnvironmentVariable

Ordinal	`1325`
Address	`0x157e0`

RtlQueryEnvironmentVariable_U

Ordinal	`1326`
Address	`0x4b140`

RtlQueryFeatureConfiguration

Ordinal	`1327`
Address	`0x5e0d0`

RtlQueryFeatureConfigurationChangeStamp

Ordinal	`1328`
Address	`0x101b70`

RtlQueryFeatureUsageNotificationSubscriptions

Ordinal	`1329`
Address	`0x101b80`

RtlQueryHeapInformation

Ordinal	`1330`
Address	`0x74fb0`

RtlQueryImageMitigationPolicy

Ordinal	`1331`
Address	`0xe1a10`

RtlQueryInformationAcl

Ordinal	`1332`
Address	`0x79db0`

RtlQueryInformationActivationContext

Ordinal	`1333`
Address	`0x12de0`

RtlQueryInformationActiveActivationContext

Ordinal	`1334`
Address	`0x7ede0`

RtlQueryInterfaceMemoryStream

Ordinal	`1335`
Address	`0xd5990`

RtlQueryModuleInformation

Ordinal	`1336`
Address	`0xe3dd0`

RtlQueryPackageClaims

Ordinal	`1337`
Address	`0x6aac0`

RtlQueryPackageIdentity

Ordinal	`1338`
Address	`0x6aa00`

RtlQueryPackageIdentityEx

Ordinal	`1339`
Address	`0x6aa50`

RtlQueryPerformanceCounter

Ordinal	`1340`
Address	`0x40160`

RtlQueryPerformanceFrequency

Ordinal	`1341`
Address	`0x72260`

RtlQueryProcessBackTraceInformation

Ordinal	`1342`
Address	`0xd7630`

RtlQueryProcessDebugInformation

Ordinal	`1343`
Address	`0xd77c0`

RtlQueryProcessHeapInformation

Ordinal	`1344`
Address	`0xd7ca0`

RtlQueryProcessLockInformation

Ordinal	`1345`
Address	`0xd8080`

RtlQueryProcessPlaceholderCompatibilityMode

Ordinal	`1346`
Address	`0xff250`

RtlQueryProtectedPolicy

Ordinal	`1347`
Address	`0x822d0`

RtlQueryRegistryValueWithFallback

Ordinal	`1348`
Address	`0xee670`

RtlQueryRegistryValues

Ordinal	`1349`
Address	`0xee7c0`

RtlQueryRegistryValuesEx

Ordinal	`1350`
Address	`0x47110`

RtlQueryResourcePolicy

Ordinal	`1351`
Address	`0x44700`

RtlQuerySecurityObject

Ordinal	`1352`
Address	`0xd6fe0`

RtlQueryTagHeap

Ordinal	`1353`
Address	`0xf29d0`

RtlQueryThreadPlaceholderCompatibilityMode

Ordinal	`1354`
Address	`0x808e0`

RtlQueryThreadProfiling

Ordinal	`1355`
Address	`0xcbf90`

RtlQueryTimeZoneInformation

Ordinal	`1356`
Address	`0x482a0`

RtlQueryTokenHostIdAsUlong64

Ordinal	`1357`
Address	`0x83ac0`

RtlQueryUmsThreadInformation

Ordinal	`1358`
Address	`0xf74f0`

RtlQueryUnbiasedInterruptTime

Ordinal	`1359`
Address	`0x5e350`

RtlQueryValidationRunlevel

Ordinal	`1360`
Address	`0x1020e0`

RtlQueryWnfMetaNotification

Ordinal	`1361`
Address	`0x83470`

RtlQueryWnfStateData

Ordinal	`1362`
Address	`0x44f30`

RtlQueryWnfStateDataWithExplicitScope

Ordinal	`1363`
Address	`0x840d0`

RtlQueueApcWow64Thread

Ordinal	`1364`
Address	`0xdc070`

RtlQueueWorkItem

Ordinal	`1365`
Address	`0xb780`

RtlRaiseCustomSystemEventTrigger

Ordinal	`1366`
Address	`0x1021a0`

RtlRaiseException

Ordinal	`1367`
Address	`0x520d0`

RtlRaiseExceptionForReturnAddressHijack

Ordinal	`1368`
Address	`0xa22a0`

RtlRaiseNoncontinuableException

Ordinal	`1369`
Address	`0xa1e80`

RtlRaiseStatus

Ordinal	`1370`
Address	`0x1025b0`

RtlRandom

Ordinal	`1371`
Address	`0x43ca0`

RtlRandomEx

Ordinal	`1372`
Address	`0x43ca0`

RtlRbInsertNodeEx

Ordinal	`1373`
Address	`0x27dc0`

RtlRbRemoveNode

Ordinal	`1374`
Address	`0x2a0a0`

RtlReAllocateHeap

Ordinal	`1375`
Address	`0x23640`

RtlReadMemoryStream

Ordinal	`1376`
Address	`0xd5990`

RtlReadOutOfProcessMemoryStream

Ordinal	`1377`
Address	`0xd5990`

RtlReadThreadProfilingData

Ordinal	`1378`
Address	`0xcbfc0`

RtlRealPredecessor

Ordinal	`1379`
Address	`0x7fbc0`

RtlRealSuccessor

Ordinal	`1380`
Address	`0x66e30`

RtlRegisterFeatureConfigurationChangeNotification

Ordinal	`1381`
Address	`0x93b0`

RtlRegisterForWnfMetaNotification

Ordinal	`1382`
Address	`0x65150`

RtlRegisterSecureMemoryCacheCallback

Ordinal	`1383`
Address	`0xf7be0`

RtlRegisterThreadWithCsrss

Ordinal	`1384`
Address	`0x4eb00`

RtlRegisterWait

Ordinal	`1385`
Address	`0xbe70`

RtlReleaseActivationContext

Ordinal	`1386`
Address	`0x13570`

RtlReleaseMemoryStream

Ordinal	`1387`
Address	`0x847c0`

RtlReleasePath

Ordinal	`1388`
Address	`0x11f80`

RtlReleasePebLock

Ordinal	`1389`
Address	`0x78530`

RtlReleasePrivilege

Ordinal	`1390`
Address	`0x81480`

RtlReleaseRelativeName

Ordinal	`1391`
Address	`0x1a320`

RtlReleaseResource

Ordinal	`1392`
Address	`0x661f0`

RtlReleaseSRWLockExclusive

Ordinal	`1393`
Address	`0x12c70`

RtlReleaseSRWLockShared

Ordinal	`1394`
Address	`0x21920`

RtlRemoteCall

Ordinal	`1395`
Address	`0xfeff0`

RtlRemoveEntryHashTable

Ordinal	`1396`
Address	`0x7ccd0`

RtlRemovePrivileges

Ordinal	`1397`
Address	`0x88e50`

RtlRemoveVectoredContinueHandler

Ordinal	`1398`
Address	`0xd96a0`

RtlRemoveVectoredExceptionHandler

Ordinal	`1399`
Address	`0x82870`

RtlReplaceSidInSd

Ordinal	`1400`
Address	`0xe6bf0`

RtlReplaceSystemDirectoryInPath

Ordinal	`1401`
Address	`0x876f0`

RtlReportException

Ordinal	`1402`
Address	`0xdc9b0`

RtlReportExceptionEx

Ordinal	`1403`
Address	`0xdca80`

RtlReportSilentProcessExit

Ordinal	`1404`
Address	`0x5f420`

RtlReportSqmEscalation

Ordinal	`1405`
Address	`0x847c0`

RtlResetMemoryBlockLookaside

Ordinal	`1406`
Address	`0xeb1d0`

RtlResetMemoryZone

Ordinal	`1407`
Address	`0xeb230`

RtlResetNtUserPfn

Ordinal	`1408`
Address	`0x8c790`

RtlResetRtlTranslations

Ordinal	`1409`
Address	`0xe5460`

RtlRestoreBootStatusDefaults

Ordinal	`1410`
Address	`0xee0b0`

RtlRestoreContext

Ordinal	`1411`
Address	`0x6edc0`

RtlRestoreLastWin32Error

Ordinal	`1412`
Address	`0x518d0`

RtlRestoreSystemBootStatusDefaults

Ordinal	`1413`
Address	`0xee1e0`

RtlRestoreThreadPreferredUILanguages

Ordinal	`1414`
Address	`0xef460`

RtlRetrieveNtUserPfn

Ordinal	`1415`
Address	`0x8c810`

RtlRevertMemoryStream

Ordinal	`1416`
Address	`0xd5990`

RtlRunDecodeUnicodeString

Ordinal	`1417`
Address	`0xe6f00`

RtlRunEncodeUnicodeString

Ordinal	`1418`
Address	`0xe6f60`

RtlRunOnceBeginInitialize

Ordinal	`1419`
Address	`0xa530`

RtlRunOnceComplete

Ordinal	`1420`
Address	`0x43ab0`

RtlRunOnceExecuteOnce

Ordinal	`1421`
Address	`0x43830`

RtlRunOnceInitialize

Ordinal	`1422`
Address	`0x6b440`

RtlSecondsSince1970ToTime

Ordinal	`1423`
Address	`0x883b0`

RtlSecondsSince1980ToTime

Ordinal	`1424`
Address	`0xe5dc0`

RtlSeekMemoryStream

Ordinal	`1425`
Address	`0xd5990`

RtlSelfRelativeToAbsoluteSD

Ordinal	`1426`
Address	`0x6e0c0`

RtlSelfRelativeToAbsoluteSD2

Ordinal	`1427`
Address	`0x89310`

RtlSendMsgToSm

Ordinal	`1428`
Address	`0x89f00`

RtlSetAllBits

Ordinal	`1429`
Address	`0x7c130`

RtlSetAllBitsEx

Ordinal	`1430`
Address	`0xed440`

RtlSetAttributesSecurityDescriptor

Ordinal	`1431`
Address	`0xe7020`

RtlSetBit

Ordinal	`1432`
Address	`0x81aa0`

RtlSetBitEx

Ordinal	`1433`
Address	`0x9cd60`

RtlSetBits

Ordinal	`1434`
Address	`0x55310`

RtlSetBitsEx

Ordinal	`1435`
Address	`0xed4b0`

RtlSetControlSecurityDescriptor

Ordinal	`1436`
Address	`0x80290`

RtlSetCriticalSectionSpinCount

Ordinal	`1437`
Address	`0x72630`

RtlSetCurrentDirectory_U

Ordinal	`1438`
Address	`0x5e540`

RtlSetCurrentEnvironment

Ordinal	`1439`
Address	`0x8c1b0`

RtlSetCurrentTransaction

Ordinal	`1440`
Address	`0x6a8d0`

RtlSetDaclSecurityDescriptor

Ordinal	`1441`
Address	`0x3c8e0`

RtlSetDynamicTimeZoneInformation

Ordinal	`1442`
Address	`0xee7f0`

RtlSetEnvironmentStrings

Ordinal	`1443`
Address	`0x831d0`

RtlSetEnvironmentVar

Ordinal	`1444`
Address	`0x4b430`

RtlSetEnvironmentVariable

Ordinal	`1445`
Address	`0x4b1d0`

RtlSetExtendedFeaturesMask

Ordinal	`1446`
Address	`0xf5cd0`

RtlSetFeatureConfigurations

Ordinal	`1447`
Address	`0x101c00`

RtlSetGroupSecurityDescriptor

Ordinal	`1448`
Address	`0x38020`

RtlSetHeapInformation

Ordinal	`1449`
Address	`0x74dc0`

RtlSetImageMitigationPolicy

Ordinal	`1450`
Address	`0xe2520`

RtlSetInformationAcl

Ordinal	`1451`
Address	`0xe9e20`

RtlSetIoCompletionCallback

Ordinal	`1452`
Address	`0x112eb0`

RtlSetLastWin32Error

Ordinal	`1453`
Address	`0x518d0`

RtlSetLastWin32ErrorAndNtStatusFromNtStatus

Ordinal	`1454`
Address	`0x518b0`

RtlSetMemoryStreamSize

Ordinal	`1455`
Address	`0xd5990`

RtlSetOwnerSecurityDescriptor

Ordinal	`1456`
Address	`0x38080`

RtlSetPortableOperatingSystem

Ordinal	`1457`
Address	`0xee5d0`

RtlSetProcessDebugInformation

Ordinal	`1458`
Address	`0xd8420`

RtlSetProcessIsCritical

Ordinal	`1459`
Address	`0x8c090`

RtlSetProcessPlaceholderCompatibilityMode

Ordinal	`1460`
Address	`0xff270`

RtlSetProcessPreferredUILanguages

Ordinal	`1461`
Address	`0x89d60`

RtlSetProtectedPolicy

Ordinal	`1462`
Address	`0x81530`

RtlSetProxiedProcessId

Ordinal	`1463`
Address	`0x86150`

RtlSetSaclSecurityDescriptor

Ordinal	`1464`
Address	`0x68920`

RtlSetSearchPathMode

Ordinal	`1465`
Address	`0x80380`

RtlSetSecurityDescriptorRMControl

Ordinal	`1466`
Address	`0x85f50`

RtlSetSecurityObject

Ordinal	`1467`
Address	`0x77780`

RtlSetSecurityObjectEx

Ordinal	`1468`
Address	`0xd72f0`

RtlSetSystemBootStatus

Ordinal	`1469`
Address	`0x85d90`

RtlSetSystemBootStatusEx

Ordinal	`1470`
Address	`0xee220`

RtlSetThreadErrorMode

Ordinal	`1471`
Address	`0x4a640`

RtlSetThreadIsCritical

Ordinal	`1472`
Address	`0x896b0`

RtlSetThreadPlaceholderCompatibilityMode

Ordinal	`1473`
Address	`0x7d500`

RtlSetThreadPoolStartFunc

Ordinal	`1474`
Address	`0x847c0`

RtlSetThreadPreferredUILanguages

Ordinal	`1475`
Address	`0x3ec50`

RtlSetThreadPreferredUILanguages2

Ordinal	`1476`
Address	`0x3ec00`

RtlSetThreadSubProcessTag

Ordinal	`1477`
Address	`0x20570`

RtlSetThreadWorkOnBehalfTicket

Ordinal	`1478`
Address	`0x20500`

RtlSetTimeZoneInformation

Ordinal	`1479`
Address	`0xee800`

RtlSetTimer

Ordinal	`1480`
Address	`0x112ea0`

RtlSetUmsThreadInformation

Ordinal	`1481`
Address	`0xf7590`

RtlSetUnhandledExceptionFilter

Ordinal	`1482`
Address	`0x802e0`

RtlSetUserFlagsHeap

Ordinal	`1483`
Address	`0xf2d70`

RtlSetUserValueHeap

Ordinal	`1484`
Address	`0x1f60`

RtlSidDominates

Ordinal	`1485`
Address	`0x7c5c0`

RtlSidDominatesForTrust

Ordinal	`1486`
Address	`0x68650`

RtlSidEqualLevel

Ordinal	`1487`
Address	`0xe7050`

RtlSidHashInitialize

Ordinal	`1488`
Address	`0x7c980`

RtlSidHashLookup

Ordinal	`1489`
Address	`0x78b80`

RtlSidIsHigherLevel

Ordinal	`1490`
Address	`0xe70e0`

RtlSizeHeap

Ordinal	`1491`
Address	`0x24160`

RtlSleepConditionVariableCS

Ordinal	`1492`
Address	`0x65770`

RtlSleepConditionVariableSRW

Ordinal	`1493`
Address	`0x654d0`

RtlSplay

Ordinal	`1494`
Address	`0x668d0`

RtlStartRXact

Ordinal	`1495`
Address	`0x81ab0`

RtlStatMemoryStream

Ordinal	`1496`
Address	`0xd5990`

RtlStringFromGUID

Ordinal	`1497`
Address	`0x6b040`

RtlStringFromGUIDEx

Ordinal	`1498`
Address	`0x6b050`

RtlStronglyEnumerateEntryHashTable

Ordinal	`1499`
Address	`0x68df0`

RtlSubAuthorityCountSid

Ordinal	`1500`
Address	`0x762e0`

RtlSubAuthoritySid

Ordinal	`1501`
Address	`0x72610`

RtlSubscribeForFeatureUsageNotification

Ordinal	`1502`
Address	`0x101d00`

RtlSubscribeWnfStateChangeNotification

Ordinal	`1503`
Address	`0x42460`

RtlSubtreePredecessor

Ordinal	`1504`
Address	`0x66da0`

RtlSubtreeSuccessor

Ordinal	`1505`
Address	`0xf7790`

RtlSwitchedVVI

Ordinal	`1506`
Address	`0x3cc40`

RtlSystemTimeToLocalTime

Ordinal	`1507`
Address	`0x7df10`

RtlTestAndPublishWnfStateData

Ordinal	`1508`
Address	`0x850b0`

RtlTestBit

Ordinal	`1509`
Address	`0x85a60`

RtlTestBitEx

Ordinal	`1510`
Address	`0x9cd70`

RtlTestProtectedAccess

Ordinal	`1511`
Address	`0x8c4c0`

RtlTimeFieldsToTime

Ordinal	`1512`
Address	`0x5c570`

RtlTimeToElapsedTimeFields

Ordinal	`1513`
Address	`0x7bca0`

RtlTimeToSecondsSince1970

Ordinal	`1514`
Address	`0x7bd90`

RtlTimeToSecondsSince1980

Ordinal	`1515`
Address	`0x7bc60`

RtlTimeToTimeFields

Ordinal	`1516`
Address	`0x5c8a0`

RtlTraceDatabaseAdd

Ordinal	`1517`
Address	`0x102740`

RtlTraceDatabaseCreate

Ordinal	`1518`
Address	`0x1027c0`

RtlTraceDatabaseDestroy

Ordinal	`1519`
Address	`0x102900`

RtlTraceDatabaseEnumerate

Ordinal	`1520`
Address	`0x102980`

RtlTraceDatabaseFind

Ordinal	`1521`
Address	`0x102a50`

RtlTraceDatabaseLock

Ordinal	`1522`
Address	`0x102ad0`

RtlTraceDatabaseUnlock

Ordinal	`1523`
Address	`0x102b00`

RtlTraceDatabaseValidate

Ordinal	`1524`
Address	`0x102b20`

RtlTryAcquirePebLock

Ordinal	`1525`
Address	`0x7c5a0`

RtlTryAcquireSRWLockExclusive

Ordinal	`1526`
Address	`0x82650`

RtlTryAcquireSRWLockShared

Ordinal	`1527`
Address	`0x77da0`

RtlTryConvertSRWLockSharedToExclusiveOrRelease

Ordinal	`1528`
Address	`0xe8ca0`

RtlTryEnterCriticalSection

Ordinal	`1529`
Address	`0x207e0`

RtlUTF8StringToUnicodeString

Ordinal	`1530`
Address	`0x5a8f0`

RtlUTF8ToUnicodeN

Ordinal	`1531`
Address	`0x5a9c0`

RtlUdiv128

Ordinal	`1532`
Address	`0x102f50`

RtlUmsThreadYield

Ordinal	`1533`
Address	`0xf75d0`

RtlUnhandledExceptionFilter

Ordinal	`1534`
Address	`0x9ce80`

RtlUnhandledExceptionFilter2

Ordinal	`1535`
Address	`0x100870`

RtlUnicodeStringToAnsiSize

Ordinal	`1536`
Address	`0x627b0`

RtlUnicodeStringToAnsiString

Ordinal	`1537`
Address	`0x627e0`

RtlUnicodeStringToCountedOemString

Ordinal	`1538`
Address	`0xeb2b0`

RtlUnicodeStringToInteger

Ordinal	`1539`
Address	`0x765e0`

RtlUnicodeStringToOemSize

Ordinal	`1540`
Address	`0x627b0`

RtlUnicodeStringToOemString

Ordinal	`1541`
Address	`0x62180`

RtlUnicodeStringToUTF8String

Ordinal	`1542`
Address	`0x102e50`

RtlUnicodeToCustomCPN

Ordinal	`1543`
Address	`0xe5690`

RtlUnicodeToMultiByteN

Ordinal	`1544`
Address	`0x62900`

RtlUnicodeToMultiByteSize

Ordinal	`1545`
Address	`0x628c0`

RtlUnicodeToOemN

Ordinal	`1546`
Address	`0x62540`

RtlUnicodeToUTF8N

Ordinal	`1547`
Address	`0x5bf10`

RtlUniform

Ordinal	`1548`
Address	`0x75b30`

RtlUnlockBootStatusData

Ordinal	`1549`
Address	`0xee240`

RtlUnlockCurrentThread

Ordinal	`1550`
Address	`0x872a0`

RtlUnlockHeap

Ordinal	`1551`
Address	`0x5fa10`

RtlUnlockMemoryBlockLookaside

Ordinal	`1552`
Address	`0x5e3b0`

RtlUnlockMemoryStreamRegion

Ordinal	`1553`
Address	`0xd5990`

RtlUnlockMemoryZone

Ordinal	`1554`
Address	`0x5e410`

RtlUnlockModuleSection

Ordinal	`1555`
Address	`0x5ebe0`

RtlUnregisterFeatureConfigurationChangeNotification

Ordinal	`1556`
Address	`0x7f7f0`

RtlUnsubscribeFromFeatureUsageNotifications

Ordinal	`1557`
Address	`0x101d10`

RtlUnsubscribeWnfNotificationWaitForCompletion

Ordinal	`1558`
Address	`0x63b50`

RtlUnsubscribeWnfNotificationWithCompletionCallback

Ordinal	`1559`
Address	`0x63940`

RtlUnsubscribeWnfStateChangeNotification

Ordinal	`1560`
Address	`0x63b00`

RtlUnwind

Ordinal	`1561`
Address	`0x51e70`

RtlUnwindEx

Ordinal	`1562`
Address	`0x30600`

RtlUpcaseUnicodeChar

Ordinal	`1563`
Address	`0x5afc0`

RtlUpcaseUnicodeString

Ordinal	`1564`
Address	`0x15d20`

RtlUpcaseUnicodeStringToAnsiString

Ordinal	`1565`
Address	`0xeb3e0`

RtlUpcaseUnicodeStringToCountedOemString

Ordinal	`1566`
Address	`0xeb4f0`

RtlUpcaseUnicodeStringToOemString

Ordinal	`1567`
Address	`0x62350`

RtlUpcaseUnicodeToCustomCPN

Ordinal	`1568`
Address	`0xe57c0`

RtlUpcaseUnicodeToMultiByteN

Ordinal	`1569`
Address	`0x62690`

RtlUpcaseUnicodeToOemN

Ordinal	`1570`
Address	`0x624e0`

RtlUpdateClonedCriticalSection

Ordinal	`1571`
Address	`0x5f580`

RtlUpdateClonedSRWLock

Ordinal	`1572`
Address	`0x9cd20`

RtlUpdateTimer

Ordinal	`1573`
Address	`0x823e0`

RtlUpperChar

Ordinal	`1574`
Address	`0x62240`

RtlUpperString

Ordinal	`1575`
Address	`0xeb700`

RtlUserFiberStart

Ordinal	`1576`
Address	`0x80900`

RtlUserThreadStart

Ordinal	`1577`
Address	`0x4cc70`

RtlValidAcl

Ordinal	`1578`
Address	`0x37760`

RtlValidProcessProtection

Ordinal	`1579`
Address	`0xe35f0`

RtlValidRelativeSecurityDescriptor

Ordinal	`1580`
Address	`0x74c20`

RtlValidSecurityDescriptor

Ordinal	`1581`
Address	`0x711d0`

RtlValidSid

Ordinal	`1582`
Address	`0x37950`

RtlValidateCorrelationVector

Ordinal	`1583`
Address	`0xfc120`

RtlValidateHeap

Ordinal	`1584`
Address	`0x5f660`

RtlValidateProcessHeaps

Ordinal	`1585`
Address	`0xf3250`

RtlValidateUnicodeString

Ordinal	`1586`
Address	`0x79f90`

RtlVerifyVersionInfo

Ordinal	`1587`
Address	`0x7b0f0`

RtlVirtualUnwind

Ordinal	`1588`
Address	`0x30de0`

RtlWaitForWnfMetaNotification

Ordinal	`1589`
Address	`0x63990`

RtlWaitOnAddress

Ordinal	`1590`
Address	`0x64930`

RtlWakeAddressAll

Ordinal	`1591`
Address	`0x646e0`

RtlWakeAddressAllNoFence

Ordinal	`1592`
Address	`0x1031d0`

RtlWakeAddressSingle

Ordinal	`1593`
Address	`0x63b30`

RtlWakeAddressSingleNoFence

Ordinal	`1594`
Address	`0x1031e0`

RtlWakeAllConditionVariable

Ordinal	`1595`
Address	`0x4c9d0`

RtlWakeConditionVariable

Ordinal	`1596`
Address	`0x4f0a0`

RtlWalkFrameChain

Ordinal	`1597`
Address	`0x52720`

RtlWalkHeap

Ordinal	`1598`
Address	`0xf3380`

RtlWeaklyEnumerateEntryHashTable

Ordinal	`1599`
Address	`0xf5c60`

RtlWerpReportException

Ordinal	`1600`
Address	`0xdd3c0`

RtlWnfCompareChangeStamp

Ordinal	`1601`
Address	`0xde860`

RtlWnfDllUnloadCallback

Ordinal	`1602`
Address	`0x86140`

RtlWow64CallFunction64

Ordinal	`1603`
Address	`0x86030`

RtlWow64EnableFsRedirection

Ordinal	`1604`
Address	`0x86030`

RtlWow64EnableFsRedirectionEx

Ordinal	`1605`
Address	`0x86030`

RtlWow64GetCpuAreaInfo

Ordinal	`1606`
Address	`0x52f80`

RtlWow64GetCurrentCpuArea

Ordinal	`1607`
Address	`0x52f00`

RtlWow64GetCurrentMachine

Ordinal	`1608`
Address	`0x51e30`

RtlWow64GetEquivalentMachineCHPE

Ordinal	`1609`
Address	`0x834c0`

RtlWow64GetProcessMachines

Ordinal	`1610`
Address	`0x7be10`

RtlWow64GetSharedInfoProcess

Ordinal	`1611`
Address	`0x7ab50`

RtlWow64GetThreadContext

Ordinal	`1612`
Address	`0xdc090`

RtlWow64GetThreadSelectorEntry

Ordinal	`1613`
Address	`0xdc0c0`

RtlWow64IsWowGuestMachineSupported

Ordinal	`1614`
Address	`0x7d020`

RtlWow64LogMessageInEventLogger

Ordinal	`1615`
Address	`0xd67a0`

RtlWow64PopAllCrossProcessWorkFromWorkList

Ordinal	`1616`
Address	`0x1031f0`

RtlWow64PopCrossProcessWorkFromFreeList

Ordinal	`1617`
Address	`0x103300`

RtlWow64PushCrossProcessWorkOntoFreeList

Ordinal	`1618`
Address	`0x103390`

RtlWow64PushCrossProcessWorkOntoWorkList

Ordinal	`1619`
Address	`0x103430`

RtlWow64RequestCrossProcessHeavyFlush

Ordinal	`1620`
Address	`0x103640`

RtlWow64SetThreadContext

Ordinal	`1621`
Address	`0xdc260`

RtlWow64SuspendProcess

Ordinal	`1622`
Address	`0xdc280`

RtlWow64SuspendThread

Ordinal	`1623`
Address	`0xdc3f0`

RtlWriteMemoryStream

Ordinal	`1624`
Address	`0xd5990`

RtlWriteNonVolatileMemory

Ordinal	`1625`
Address	`0xfc480`

RtlWriteRegistryValue

Ordinal	`1626`
Address	`0x8b0b0`

RtlZeroHeap

Ordinal	`1627`
Address	`0xf6400`

RtlZeroMemory

Ordinal	`1628`
Address	`0x883e0`

RtlZombifyActivationContext

Ordinal	`1629`
Address	`0xdf7b0`

RtlpApplyLengthFunction

Ordinal	`1630`
Address	`0x7ea30`

RtlpCheckDynamicTimeZoneInformation

Ordinal	`1631`
Address	`0x47440`

RtlpCleanupRegistryKeys

Ordinal	`1632`
Address	`0xefb70`

RtlpConvertAbsoluteToRelativeSecurityAttribute

Ordinal	`1633`
Address	`0xe9ff0`

RtlpConvertCultureNamesToLCIDs

Ordinal	`1634`
Address	`0xf0060`

RtlpConvertLCIDsToCultureNames

Ordinal	`1635`
Address	`0xf0270`

RtlpConvertRelativeToAbsoluteSecurityAttribute

Ordinal	`1636`
Address	`0xea360`

RtlpCreateProcessRegistryInfo

Ordinal	`1637`
Address	`0x36490`

RtlpEnsureBufferSize

Ordinal	`1638`
Address	`0x6ed10`

RtlpExecuteUmsThread

Ordinal	`1639`
Address	`0xa2301`

RtlpFreezeTimeBias

Ordinal	`1640`
Address	`0x16d510`

RtlpGetDeviceFamilyInfoEnum

Ordinal	`1641`
Address	`0x3f860`

RtlpGetLCIDFromLangInfoNode

Ordinal	`1642`
Address	`0x81f50`

RtlpGetNameFromLangInfoNode

Ordinal	`1643`
Address	`0x80160`

RtlpGetSystemDefaultUILanguage

Ordinal	`1644`
Address	`0x3c5b0`

RtlpGetUserOrMachineUILanguage4NLS

Ordinal	`1645`
Address	`0x103880`

RtlpInitializeLangRegistryInfo

Ordinal	`1646`
Address	`0x6ffe0`

RtlpIsQualifiedLanguage

Ordinal	`1647`
Address	`0x58740`

RtlpLoadMachineUIByPolicy

Ordinal	`1648`
Address	`0x82590`

RtlpLoadUserUIByPolicy

Ordinal	`1649`
Address	`0x6fef0`

RtlpMergeSecurityAttributeInformation

Ordinal	`1650`
Address	`0x84210`

RtlpMuiFreeLangRegistryInfo

Ordinal	`1651`
Address	`0x70010`

RtlpMuiRegCreateRegistryInfo

Ordinal	`1652`
Address	`0x104530`

RtlpMuiRegFreeRegistryInfo

Ordinal	`1653`
Address	`0x702b0`

RtlpMuiRegLoadRegistryInfo

Ordinal	`1654`
Address	`0x701c0`

RtlpNotOwnerCriticalSection

Ordinal	`1655`
Address	`0xe9010`

RtlpNtCreateKey

Ordinal	`1656`
Address	`0x107c80`

RtlpNtEnumerateSubKey

Ordinal	`1657`
Address	`0x82750`

RtlpNtMakeTemporaryKey

Ordinal	`1658`
Address	`0x107cc0`

RtlpNtOpenKey

Ordinal	`1659`
Address	`0x7e100`

RtlpNtQueryValueKey

Ordinal	`1660`
Address	`0x7c010`

RtlpNtSetValueKey

Ordinal	`1661`
Address	`0x107cd0`

RtlpQueryDefaultUILanguage

Ordinal	`1662`
Address	`0x76750`

RtlpQueryProcessDebugInformationFromWow64

Ordinal	`1663`
Address	`0xd8c20`

RtlpQueryProcessDebugInformationRemote

Ordinal	`1664`
Address	`0xd8cc0`

RtlpRefreshCachedUILanguage

Ordinal	`1665`
Address	`0x106020`

RtlpSetInstallLanguage

Ordinal	`1666`
Address	`0xf0ac0`

RtlpSetPreferredUILanguages

Ordinal	`1667`
Address	`0xf1170`

RtlpSetUserPreferredUILanguages

Ordinal	`1668`
Address	`0xf1170`

RtlpTimeFieldsToTime

Ordinal	`1669`
Address	`0x5c580`

RtlpTimeToTimeFields

Ordinal	`1670`
Address	`0x5c8b0`

RtlpUmsExecuteYieldThreadEnd

Ordinal	`1671`
Address	`0xa2626`

RtlpUmsThreadYield

Ordinal	`1672`
Address	`0xa2533`

RtlpUnWaitCriticalSection

Ordinal	`1673`
Address	`0xe9340`

RtlpVerifyAndCommitUILanguageSettings

Ordinal	`1674`
Address	`0x8bf30`

RtlpWaitForCriticalSection

Ordinal	`1675`
Address	`0x808d0`

RtlpWow64CtxFromAmd64

Ordinal	`1676`
Address	`0x86fc0`

RtlpWow64GetContextOnAmd64

Ordinal	`1677`
Address	`0x6fbd0`

RtlpWow64SetContextOnAmd64

Ordinal	`1678`
Address	`0x6f1f0`

RtlxAnsiStringToUnicodeSize

Ordinal	`1679`
Address	`0x16de0`

RtlxOemStringToUnicodeSize

Ordinal	`1680`
Address	`0x16de0`

RtlxUnicodeStringToAnsiSize

Ordinal	`1681`
Address	`0x627b0`

RtlxUnicodeStringToOemSize

Ordinal	`1682`
Address	`0x627b0`

SbExecuteProcedure

Ordinal	`1683`
Address	`0x1138f0`

SbSelectProcedure

Ordinal	`1684`
Address	`0x3e0e0`

ShipAssert

Ordinal	`1685`
Address	`0xdde60`

ShipAssertGetBufferInfo

Ordinal	`1686`
Address	`0xddf80`

ShipAssertMsgA

Ordinal	`1687`
Address	`0xddfb0`

ShipAssertMsgW

Ordinal	`1688`
Address	`0xddfb0`

TpAllocAlpcCompletion

Ordinal	`1689`
Address	`0x7a6c0`

TpAllocAlpcCompletionEx

Ordinal	`1690`
Address	`0x7a7c0`

TpAllocCleanupGroup

Ordinal	`1691`
Address	`0x7f1c0`

TpAllocIoCompletion

Ordinal	`1692`
Address	`0x76cb0`

TpAllocJobNotification

Ordinal	`1693`
Address	`0x7fe10`

TpAllocPool

Ordinal	`1694`
Address	`0x62cd0`

TpAllocTimer

Ordinal	`1695`
Address	`0xefd0`

TpAllocWait

Ordinal	`1696`
Address	`0xdf40`

TpAllocWork

Ordinal	`1697`
Address	`0xf2e0`

TpAlpcRegisterCompletionList

Ordinal	`1698`
Address	`0x7a520`

TpAlpcUnregisterCompletionList

Ordinal	`1699`
Address	`0x7a610`

TpCallbackDetectedUnrecoverableError

Ordinal	`1700`
Address	`0x1120e0`

TpCallbackIndependent

Ordinal	`1701`
Address	`0x637d0`

TpCallbackLeaveCriticalSectionOnCompletion

Ordinal	`1702`
Address	`0x88bf0`

TpCallbackMayRunLong

Ordinal	`1703`
Address	`0x70f80`

TpCallbackReleaseMutexOnCompletion

Ordinal	`1704`
Address	`0x112110`

TpCallbackReleaseSemaphoreOnCompletion

Ordinal	`1705`
Address	`0x112150`

TpCallbackSendAlpcMessageOnCompletion

Ordinal	`1706`
Address	`0x68990`

TpCallbackSendPendingAlpcMessage

Ordinal	`1707`
Address	`0x112190`

TpCallbackSetEventOnCompletion

Ordinal	`1708`
Address	`0x85a00`

TpCallbackUnloadDllOnCompletion

Ordinal	`1709`
Address	`0x7e150`

TpCancelAsyncIoOperation

Ordinal	`1710`
Address	`0x79be0`

TpCaptureCaller

Ordinal	`1711`
Address	`0x724f0`

TpCheckTerminateWorker

Ordinal	`1712`
Address	`0x4ec90`

TpDbgDumpHeapUsage

Ordinal	`1713`
Address	`0x1121d0`

TpDbgSetLogRoutine

Ordinal	`1714`
Address	`0x808d0`

TpDisablePoolCallbackChecks

Ordinal	`1715`
Address	`0x859b0`

TpDisassociateCallback

Ordinal	`1716`
Address	`0x80ab0`

TpIsTimerSet

Ordinal	`1717`
Address	`0x12000`

TpPostWork

Ordinal	`1718`
Address	`0x128c0`

TpQueryPoolStackInformation

Ordinal	`1719`
Address	`0x111be0`

TpReleaseAlpcCompletion

Ordinal	`1720`
Address	`0x7a6f0`

TpReleaseCleanupGroup

Ordinal	`1721`
Address	`0x82360`

TpReleaseCleanupGroupMembers

Ordinal	`1722`
Address	`0x4ccc0`

TpReleaseIoCompletion

Ordinal	`1723`
Address	`0x7cd80`

TpReleaseJobNotification

Ordinal	`1724`
Address	`0x7fc50`

TpReleasePool

Ordinal	`1725`
Address	`0x4f2a0`

TpReleaseTimer

Ordinal	`1726`
Address	`0xc500`

TpReleaseWait

Ordinal	`1727`
Address	`0xc270`

TpReleaseWork

Ordinal	`1728`
Address	`0xf180`

TpSetDefaultPoolMaxThreads

Ordinal	`1729`
Address	`0x111ca0`

TpSetDefaultPoolStackInformation

Ordinal	`1730`
Address	`0x70a20`

TpSetPoolMaxThreads

Ordinal	`1731`
Address	`0x62c00`

TpSetPoolMaxThreadsSoftLimit

Ordinal	`1732`
Address	`0x819c0`

TpSetPoolMinThreads

Ordinal	`1733`
Address	`0x83c00`

TpSetPoolStackInformation

Ordinal	`1734`
Address	`0x70b40`

TpSetPoolThreadBasePriority

Ordinal	`1735`
Address	`0x85ce0`

TpSetPoolThreadCpuSets

Ordinal	`1736`
Address	`0x111df0`

TpSetPoolWorkerThreadIdleTimeout

Ordinal	`1737`
Address	`0x62c70`

TpSetTimer

Ordinal	`1738`
Address	`0x122a0`

TpSetTimerEx

Ordinal	`1739`
Address	`0x126d0`

TpSetWait

Ordinal	`1740`
Address	`0x10b90`

TpSetWaitEx

Ordinal	`1741`
Address	`0x11d60`

TpSimpleTryPost

Ordinal	`1742`
Address	`0x10be0`

TpStartAsyncIoOperation

Ordinal	`1743`
Address	`0x127e0`

TpTimerOutstandingCallbackCount

Ordinal	`1744`
Address	`0x9bb0`

TpTrimPools

Ordinal	`1745`
Address	`0x651b0`

TpWaitForAlpcCompletion

Ordinal	`1746`
Address	`0x7a650`

TpWaitForIoCompletion

Ordinal	`1747`
Address	`0x85330`

TpWaitForJobNotification

Ordinal	`1748`
Address	`0x7fc10`

TpWaitForTimer

Ordinal	`1749`
Address	`0x11200`

TpWaitForWait

Ordinal	`1750`
Address	`0x9990`

TpWaitForWork

Ordinal	`1751`
Address	`0x7f870`

VerSetConditionMask

Ordinal	`1752`
Address	`0x71660`

WerReportExceptionWorker

Ordinal	`1753`
Address	`0xdd740`

WerReportSQMEvent

Ordinal	`1754`
Address	`0xde460`

WinSqmAddToAverageDWORD

Ordinal	`1755`
Address	`0x808d0`

WinSqmAddToStream

Ordinal	`1756`
Address	`0x808d0`

WinSqmAddToStreamEx

Ordinal	`1757`
Address	`0x808d0`

WinSqmCheckEscalationAddToStreamEx

Ordinal	`1758`
Address	`0x847c0`

WinSqmCheckEscalationSetDWORD

Ordinal	`1759`
Address	`0x847c0`

WinSqmCheckEscalationSetDWORD64

Ordinal	`1760`
Address	`0x847c0`

WinSqmCheckEscalationSetString

Ordinal	`1761`
Address	`0x847c0`

WinSqmCommonDatapointDelete

Ordinal	`1762`
Address	`0x863d0`

WinSqmCommonDatapointSetDWORD

Ordinal	`1763`
Address	`0x863d0`

WinSqmCommonDatapointSetDWORD64

Ordinal	`1764`
Address	`0x863d0`

WinSqmCommonDatapointSetStreamEx

Ordinal	`1765`
Address	`0x863d0`

WinSqmCommonDatapointSetString

Ordinal	`1766`
Address	`0x863d0`

WinSqmEndSession

Ordinal	`1767`
Address	`0x808d0`

WinSqmEventEnabled

Ordinal	`1768`
Address	`0x847c0`

WinSqmEventWrite

Ordinal	`1769`
Address	`0x847c0`

WinSqmGetEscalationRuleStatus

Ordinal	`1770`
Address	`0x847c0`

WinSqmGetInstrumentationProperty

Ordinal	`1771`
Address	`0xde840`

WinSqmIncrementDWORD

Ordinal	`1772`
Address	`0x808d0`

WinSqmIsOptedIn

Ordinal	`1773`
Address	`0x847c0`

WinSqmIsOptedInEx

Ordinal	`1774`
Address	`0x847c0`

WinSqmIsSessionDisabled

Ordinal	`1775`
Address	`0x863d0`

WinSqmSetDWORD

Ordinal	`1776`
Address	`0x808d0`

WinSqmSetDWORD64

Ordinal	`1777`
Address	`0x808d0`

WinSqmSetEscalationInfo

Ordinal	`1778`
Address	`0x863d0`

WinSqmSetIfMaxDWORD

Ordinal	`1779`
Address	`0x808d0`

WinSqmSetIfMinDWORD

Ordinal	`1780`
Address	`0x808d0`

WinSqmSetString

Ordinal	`1781`
Address	`0x808d0`

WinSqmStartSession

Ordinal	`1782`
Address	`0x862a0`

WinSqmStartSessionForPartner

Ordinal	`1783`
Address	`0x862a0`

WinSqmStartSqmOptinListener

Ordinal	`1784`
Address	`0x847c0`

ZwAcceptConnectPort

Ordinal	`1785`
Address	`0x9d590`

ZwAccessCheck

Ordinal	`1786`
Address	`0x9d550`

ZwAccessCheckAndAuditAlarm

Ordinal	`1787`
Address	`0x9da70`

ZwAccessCheckByType

Ordinal	`1788`
Address	`0x9e1a0`

ZwAccessCheckByTypeAndAuditAlarm

Ordinal	`1789`
Address	`0x9e070`

ZwAccessCheckByTypeResultList

Ordinal	`1790`
Address	`0x9e1c0`

ZwAccessCheckByTypeResultListAndAuditAlarm

Ordinal	`1791`
Address	`0x9e1e0`

ZwAccessCheckByTypeResultListAndAuditAlarmByHandle

Ordinal	`1792`
Address	`0x9e200`

ZwAcquireCrossVmMutant

Ordinal	`1793`
Address	`0x9e220`

ZwAcquireProcessActivityReference

Ordinal	`1794`
Address	`0x9e240`

ZwAddAtom

Ordinal	`1795`
Address	`0x9de30`

ZwAddAtomEx

Ordinal	`1796`
Address	`0x9e260`

ZwAddBootEntry

Ordinal	`1797`
Address	`0x9e280`

ZwAddDriverEntry

Ordinal	`1798`
Address	`0x9e2a0`

ZwAdjustGroupsToken

Ordinal	`1799`
Address	`0x9e2c0`

ZwAdjustPrivilegesToken

Ordinal	`1800`
Address	`0x9dd70`

ZwAdjustTokenClaimsAndDeviceGroups

Ordinal	`1801`
Address	`0x9e2e0`

ZwAlertResumeThread

Ordinal	`1802`
Address	`0x9e300`

ZwAlertThread

Ordinal	`1803`
Address	`0x9e320`

ZwAlertThreadByThreadId

Ordinal	`1804`
Address	`0x9e340`

ZwAllocateLocallyUniqueId

Ordinal	`1805`
Address	`0x9e360`

ZwAllocateReserveObject

Ordinal	`1806`
Address	`0x9e380`

ZwAllocateUserPhysicalPages

Ordinal	`1807`
Address	`0x9e3a0`

ZwAllocateUserPhysicalPagesEx

Ordinal	`1808`
Address	`0x9e3c0`

ZwAllocateUuids

Ordinal	`1809`
Address	`0x9e3e0`

ZwAllocateVirtualMemory

Ordinal	`1810`
Address	`0x9d850`

ZwAllocateVirtualMemoryEx

Ordinal	`1811`
Address	`0x9e400`

ZwAlpcAcceptConnectPort

Ordinal	`1812`
Address	`0x9e420`

ZwAlpcCancelMessage

Ordinal	`1813`
Address	`0x9e440`

ZwAlpcConnectPort

Ordinal	`1814`
Address	`0x9e460`

ZwAlpcConnectPortEx

Ordinal	`1815`
Address	`0x9e480`

ZwAlpcCreatePort

Ordinal	`1816`
Address	`0x9e4a0`

ZwAlpcCreatePortSection

Ordinal	`1817`
Address	`0x9e4c0`

ZwAlpcCreateResourceReserve

Ordinal	`1818`
Address	`0x9e4e0`

ZwAlpcCreateSectionView

Ordinal	`1819`
Address	`0x9e500`

ZwAlpcCreateSecurityContext

Ordinal	`1820`
Address	`0x9e520`

ZwAlpcDeletePortSection

Ordinal	`1821`
Address	`0x9e540`

ZwAlpcDeleteResourceReserve

Ordinal	`1822`
Address	`0x9e560`

ZwAlpcDeleteSectionView

Ordinal	`1823`
Address	`0x9e580`

ZwAlpcDeleteSecurityContext

Ordinal	`1824`
Address	`0x9e5a0`

ZwAlpcDisconnectPort

Ordinal	`1825`
Address	`0x9e5c0`

ZwAlpcImpersonateClientContainerOfPort

Ordinal	`1826`
Address	`0x9e5e0`

ZwAlpcImpersonateClientOfPort

Ordinal	`1827`
Address	`0x9e600`

ZwAlpcOpenSenderProcess

Ordinal	`1828`
Address	`0x9e620`

ZwAlpcOpenSenderThread

Ordinal	`1829`
Address	`0x9e640`

ZwAlpcQueryInformation

Ordinal	`1830`
Address	`0x9e660`

ZwAlpcQueryInformationMessage

Ordinal	`1831`
Address	`0x9e680`

ZwAlpcRevokeSecurityContext

Ordinal	`1832`
Address	`0x9e6a0`

ZwAlpcSendWaitReceivePort

Ordinal	`1833`
Address	`0x9e6c0`

ZwAlpcSetInformation

Ordinal	`1834`
Address	`0x9e6e0`

ZwApphelpCacheControl

Ordinal	`1835`
Address	`0x9ded0`

ZwAreMappedFilesTheSame

Ordinal	`1836`
Address	`0x9e700`

ZwAssignProcessToJobObject

Ordinal	`1837`
Address	`0x9e720`

ZwAssociateWaitCompletionPacket

Ordinal	`1838`
Address	`0x9e740`

ZwCallEnclave

Ordinal	`1839`
Address	`0x9e760`

ZwCallbackReturn

Ordinal	`1840`
Address	`0x9d5f0`

ZwCancelIoFile

Ordinal	`1841`
Address	`0x9e0e0`

ZwCancelIoFileEx

Ordinal	`1842`
Address	`0x9e780`

ZwCancelSynchronousIoFile

Ordinal	`1843`
Address	`0x9e7a0`

ZwCancelTimer

Ordinal	`1844`
Address	`0x9e160`

ZwCancelTimer2

Ordinal	`1845`
Address	`0x9e7c0`

ZwCancelWaitCompletionPacket

Ordinal	`1846`
Address	`0x9e7e0`

ZwClearEvent

Ordinal	`1847`
Address	`0x9dd10`

ZwClose

Ordinal	`1848`
Address	`0x9d730`

ZwCloseObjectAuditAlarm

Ordinal	`1849`
Address	`0x9dcb0`

ZwCommitComplete

Ordinal	`1850`
Address	`0x9e800`

ZwCommitEnlistment

Ordinal	`1851`
Address	`0x9e820`

ZwCommitRegistryTransaction

Ordinal	`1852`
Address	`0x9e840`

ZwCommitTransaction

Ordinal	`1853`
Address	`0x9e860`

ZwCompactKeys

Ordinal	`1854`
Address	`0x9e880`

ZwCompareObjects

Ordinal	`1855`
Address	`0x9e8a0`

ZwCompareSigningLevels

Ordinal	`1856`
Address	`0x9e8c0`

ZwCompareTokens

Ordinal	`1857`
Address	`0x9e8e0`

ZwCompleteConnectPort

Ordinal	`1858`
Address	`0x9e900`

ZwCompressKey

Ordinal	`1859`
Address	`0x9e920`

ZwConnectPort

Ordinal	`1860`
Address	`0x9e940`

ZwContinue

Ordinal	`1861`
Address	`0x9ddb0`

ZwContinueEx

Ordinal	`1862`
Address	`0x9e960`

ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter

Ordinal	`1863`
Address	`0x9e980`

ZwCopyFileChunk

Ordinal	`1864`
Address	`0x9e9a0`

ZwCreateCrossVmEvent

Ordinal	`1865`
Address	`0x9e9c0`

ZwCreateCrossVmMutant

Ordinal	`1866`
Address	`0x9e9e0`

ZwCreateDebugObject

Ordinal	`1867`
Address	`0x9ea00`

ZwCreateDirectoryObject

Ordinal	`1868`
Address	`0x9ea20`

ZwCreateDirectoryObjectEx

Ordinal	`1869`
Address	`0x9ea40`

ZwCreateEnclave

Ordinal	`1870`
Address	`0x9ea60`

ZwCreateEnlistment

Ordinal	`1871`
Address	`0x9ea80`

ZwCreateEvent

Ordinal	`1872`
Address	`0x9de50`

ZwCreateEventPair

Ordinal	`1873`
Address	`0x9eaa0`

ZwCreateFile

Ordinal	`1874`
Address	`0x9dff0`

ZwCreateIRTimer

Ordinal	`1875`
Address	`0x9eac0`

ZwCreateIoCompletion

Ordinal	`1876`
Address	`0x9eae0`

ZwCreateJobObject

Ordinal	`1877`
Address	`0x9eb00`

ZwCreateJobSet

Ordinal	`1878`
Address	`0x9eb20`

ZwCreateKey

Ordinal	`1879`
Address	`0x9d8f0`

ZwCreateKeyTransacted

Ordinal	`1880`
Address	`0x9eb40`

ZwCreateKeyedEvent

Ordinal	`1881`
Address	`0x9eb60`

ZwCreateLowBoxToken

Ordinal	`1882`
Address	`0x9eb80`

ZwCreateMailslotFile

Ordinal	`1883`
Address	`0x9eba0`

ZwCreateMutant

Ordinal	`1884`
Address	`0x9ebc0`

ZwCreateNamedPipeFile

Ordinal	`1885`
Address	`0x9ebe0`

ZwCreatePagingFile

Ordinal	`1886`
Address	`0x9ec00`

ZwCreatePartition

Ordinal	`1887`
Address	`0x9ec20`

ZwCreatePort

Ordinal	`1888`
Address	`0x9ec40`

ZwCreatePrivateNamespace

Ordinal	`1889`
Address	`0x9ec60`

ZwCreateProcess

Ordinal	`1890`
Address	`0x9ec80`

ZwCreateProcessEx

Ordinal	`1891`
Address	`0x9def0`

ZwCreateProfile

Ordinal	`1892`
Address	`0x9eca0`

ZwCreateProfileEx

Ordinal	`1893`
Address	`0x9ecc0`

ZwCreateRegistryTransaction

Ordinal	`1894`
Address	`0x9ece0`

ZwCreateResourceManager

Ordinal	`1895`
Address	`0x9ed00`

ZwCreateSection

Ordinal	`1896`
Address	`0x9de90`

ZwCreateSectionEx

Ordinal	`1897`
Address	`0x9ed20`

ZwCreateSemaphore

Ordinal	`1898`
Address	`0x9ed40`

ZwCreateSymbolicLinkObject

Ordinal	`1899`
Address	`0x9ed60`

ZwCreateThread

Ordinal	`1900`
Address	`0x9df10`

ZwCreateThreadEx

Ordinal	`1901`
Address	`0x9ed80`

ZwCreateTimer

Ordinal	`1902`
Address	`0x9eda0`

ZwCreateTimer2

Ordinal	`1903`
Address	`0x9edc0`

ZwCreateToken

Ordinal	`1904`
Address	`0x9ede0`

ZwCreateTokenEx

Ordinal	`1905`
Address	`0x9ee00`

ZwCreateTransaction

Ordinal	`1906`
Address	`0x9ee20`

ZwCreateTransactionManager

Ordinal	`1907`
Address	`0x9ee40`

ZwCreateUserProcess

Ordinal	`1908`
Address	`0x9ee60`

ZwCreateWaitCompletionPacket

Ordinal	`1909`
Address	`0x9ee80`

ZwCreateWaitablePort

Ordinal	`1910`
Address	`0x9eea0`

ZwCreateWnfStateName

Ordinal	`1911`
Address	`0x9eec0`

ZwCreateWorkerFactory

Ordinal	`1912`
Address	`0x9eee0`

ZwDebugActiveProcess

Ordinal	`1913`
Address	`0x9ef00`

ZwDebugContinue

Ordinal	`1914`
Address	`0x9ef20`

ZwDelayExecution

Ordinal	`1915`
Address	`0x9dbd0`

ZwDeleteAtom

Ordinal	`1916`
Address	`0x9ef40`

ZwDeleteBootEntry

Ordinal	`1917`
Address	`0x9ef60`

ZwDeleteDriverEntry

Ordinal	`1918`
Address	`0x9ef80`

ZwDeleteFile

Ordinal	`1919`
Address	`0x9efa0`

ZwDeleteKey

Ordinal	`1920`
Address	`0x9efc0`

ZwDeleteObjectAuditAlarm

Ordinal	`1921`
Address	`0x9efe0`

ZwDeletePrivateNamespace

Ordinal	`1922`
Address	`0x9f000`

ZwDeleteValueKey

Ordinal	`1923`
Address	`0x9f020`

ZwDeleteWnfStateData

Ordinal	`1924`
Address	`0x9f040`

ZwDeleteWnfStateName

Ordinal	`1925`
Address	`0x9f060`

ZwDeviceIoControlFile

Ordinal	`1926`
Address	`0x9d630`

ZwDirectGraphicsCall

Ordinal	`1927`
Address	`0x9f080`

ZwDisableLastKnownGood

Ordinal	`1928`
Address	`0x9f0a0`

ZwDisplayString

Ordinal	`1929`
Address	`0x9f0c0`

ZwDrawText

Ordinal	`1930`
Address	`0x9f0e0`

ZwDuplicateObject

Ordinal	`1931`
Address	`0x9dcd0`

ZwDuplicateToken

Ordinal	`1932`
Address	`0x9dd90`

ZwEnableLastKnownGood

Ordinal	`1933`
Address	`0x9f100`

ZwEnumerateBootEntries

Ordinal	`1934`
Address	`0x9f120`

ZwEnumerateDriverEntries

Ordinal	`1935`
Address	`0x9f140`

ZwEnumerateKey

Ordinal	`1936`
Address	`0x9db90`

ZwEnumerateSystemEnvironmentValuesEx

Ordinal	`1937`
Address	`0x9f160`

ZwEnumerateTransactionObject

Ordinal	`1938`
Address	`0x9f180`

ZwEnumerateValueKey

Ordinal	`1939`
Address	`0x9d7b0`

ZwExtendSection

Ordinal	`1940`
Address	`0x9f1a0`

ZwFilterBootOption

Ordinal	`1941`
Address	`0x9f1c0`

ZwFilterToken

Ordinal	`1942`
Address	`0x9f1e0`

ZwFilterTokenEx

Ordinal	`1943`
Address	`0x9f200`

ZwFindAtom

Ordinal	`1944`
Address	`0x9d7d0`

ZwFlushBuffersFile

Ordinal	`1945`
Address	`0x9deb0`

ZwFlushBuffersFileEx

Ordinal	`1946`
Address	`0x9f220`

ZwFlushInstallUILanguage

Ordinal	`1947`
Address	`0x9f240`

ZwFlushInstructionCache

Ordinal	`1948`
Address	`0x9f260`

ZwFlushKey

Ordinal	`1949`
Address	`0x9f280`

ZwFlushProcessWriteBuffers

Ordinal	`1950`
Address	`0x9f2a0`

ZwFlushVirtualMemory

Ordinal	`1951`
Address	`0x9f2c0`

ZwFlushWriteBuffer

Ordinal	`1952`
Address	`0x9f2e0`

ZwFreeUserPhysicalPages

Ordinal	`1953`
Address	`0x9f300`

ZwFreeVirtualMemory

Ordinal	`1954`
Address	`0x9d910`

ZwFreezeRegistry

Ordinal	`1955`
Address	`0x9f320`

ZwFreezeTransactions

Ordinal	`1956`
Address	`0x9f340`

ZwFsControlFile

Ordinal	`1957`
Address	`0x9dc70`

ZwGetCachedSigningLevel

Ordinal	`1958`
Address	`0x9f360`

ZwGetCompleteWnfStateSubscription

Ordinal	`1959`
Address	`0x9f380`

ZwGetContextThread

Ordinal	`1960`
Address	`0x9f3a0`

ZwGetCurrentProcessorNumber

Ordinal	`1961`
Address	`0x9f3c0`

ZwGetCurrentProcessorNumberEx

Ordinal	`1962`
Address	`0x9f3e0`

ZwGetDevicePowerState

Ordinal	`1963`
Address	`0x9f400`

ZwGetMUIRegistryInfo

Ordinal	`1964`
Address	`0x9f420`

ZwGetNextProcess

Ordinal	`1965`
Address	`0x9f440`

ZwGetNextThread

Ordinal	`1966`
Address	`0x9f460`

ZwGetNlsSectionPtr

Ordinal	`1967`
Address	`0x9f480`

ZwGetNotificationResourceManager

Ordinal	`1968`
Address	`0x9f4a0`

ZwGetWriteWatch

Ordinal	`1969`
Address	`0x9f4c0`

ZwImpersonateAnonymousToken

Ordinal	`1970`
Address	`0x9f4e0`

ZwImpersonateClientOfPort

Ordinal	`1971`
Address	`0x9d930`

ZwImpersonateThread

Ordinal	`1972`
Address	`0x9f500`

ZwInitializeEnclave

Ordinal	`1973`
Address	`0x9f520`

ZwInitializeNlsFiles

Ordinal	`1974`
Address	`0x9f540`

ZwInitializeRegistry

Ordinal	`1975`
Address	`0x9f560`

ZwInitiatePowerAction

Ordinal	`1976`
Address	`0x9f580`

ZwIsProcessInJob

Ordinal	`1977`
Address	`0x9df30`

ZwIsSystemResumeAutomatic

Ordinal	`1978`
Address	`0x9f5a0`

ZwIsUILanguageComitted

Ordinal	`1979`
Address	`0x9f5c0`

ZwListenPort

Ordinal	`1980`
Address	`0x9f5e0`

ZwLoadDriver

Ordinal	`1981`
Address	`0x9f600`

ZwLoadEnclaveData

Ordinal	`1982`
Address	`0x9f620`

ZwLoadKey

Ordinal	`1983`
Address	`0x9f640`

ZwLoadKey2

Ordinal	`1984`
Address	`0x9f660`

ZwLoadKey3

Ordinal	`1985`
Address	`0xa1020`

ZwLoadKeyEx

Ordinal	`1986`
Address	`0x9f680`

ZwLockFile

Ordinal	`1987`
Address	`0x9f6a0`

ZwLockProductActivationKeys

Ordinal	`1988`
Address	`0x9f6c0`

ZwLockRegistryKey

Ordinal	`1989`
Address	`0x9f6e0`

ZwLockVirtualMemory

Ordinal	`1990`
Address	`0x9f700`

ZwMakePermanentObject

Ordinal	`1991`
Address	`0x9f720`

ZwMakeTemporaryObject

Ordinal	`1992`
Address	`0x9f740`

ZwManageHotPatch

Ordinal	`1993`
Address	`0x9f760`

ZwManagePartition

Ordinal	`1994`
Address	`0x9f780`

ZwMapCMFModule

Ordinal	`1995`
Address	`0x9f7a0`

ZwMapUserPhysicalPages

Ordinal	`1996`
Address	`0x9f7c0`

ZwMapUserPhysicalPagesScatter

Ordinal	`1997`
Address	`0x9d5b0`

ZwMapViewOfSection

Ordinal	`1998`
Address	`0x9da50`

ZwMapViewOfSectionEx

Ordinal	`1999`
Address	`0x9f7e0`

ZwModifyBootEntry

Ordinal	`2000`
Address	`0x9f800`

ZwModifyDriverEntry

Ordinal	`2001`
Address	`0x9f820`

ZwNotifyChangeDirectoryFile

Ordinal	`2002`
Address	`0x9f840`

ZwNotifyChangeDirectoryFileEx

Ordinal	`2003`
Address	`0x9f860`

ZwNotifyChangeKey

Ordinal	`2004`
Address	`0x9f880`

ZwNotifyChangeMultipleKeys

Ordinal	`2005`
Address	`0x9f8a0`

ZwNotifyChangeSession

Ordinal	`2006`
Address	`0x9f8c0`

ZwOpenDirectoryObject

Ordinal	`2007`
Address	`0x9e050`

ZwOpenEnlistment

Ordinal	`2008`
Address	`0x9f8e0`

ZwOpenEvent

Ordinal	`2009`
Address	`0x9dd50`

ZwOpenEventPair

Ordinal	`2010`
Address	`0x9f900`

ZwOpenFile

Ordinal	`2011`
Address	`0x9dbb0`

ZwOpenIoCompletion

Ordinal	`2012`
Address	`0x9f920`

ZwOpenJobObject

Ordinal	`2013`
Address	`0x9f940`

ZwOpenKey

Ordinal	`2014`
Address	`0x9d790`

ZwOpenKeyEx

Ordinal	`2015`
Address	`0x9f960`

ZwOpenKeyTransacted

Ordinal	`2016`
Address	`0x9f980`

ZwOpenKeyTransactedEx

Ordinal	`2017`
Address	`0x9f9a0`

ZwOpenKeyedEvent

Ordinal	`2018`
Address	`0x9f9c0`

ZwOpenMutant

Ordinal	`2019`
Address	`0x9f9e0`

ZwOpenObjectAuditAlarm

Ordinal	`2020`
Address	`0x9fa00`

ZwOpenPartition

Ordinal	`2021`
Address	`0x9fa20`

ZwOpenPrivateNamespace

Ordinal	`2022`
Address	`0x9fa40`

ZwOpenProcess

Ordinal	`2023`
Address	`0x9da10`

ZwOpenProcessToken

Ordinal	`2024`
Address	`0x9fa60`

ZwOpenProcessTokenEx

Ordinal	`2025`
Address	`0x9db50`

ZwOpenRegistryTransaction

Ordinal	`2026`
Address	`0x9fa80`

ZwOpenResourceManager

Ordinal	`2027`
Address	`0x9faa0`

ZwOpenSection

Ordinal	`2028`
Address	`0x9dc30`

ZwOpenSemaphore

Ordinal	`2029`
Address	`0x9fac0`

ZwOpenSession

Ordinal	`2030`
Address	`0x9fae0`

ZwOpenSymbolicLinkObject

Ordinal	`2031`
Address	`0x9fb00`

ZwOpenThread

Ordinal	`2032`
Address	`0x9fb20`

ZwOpenThreadToken

Ordinal	`2033`
Address	`0x9d9d0`

ZwOpenThreadTokenEx

Ordinal	`2034`
Address	`0x9db30`

ZwOpenTimer

Ordinal	`2035`
Address	`0x9fb40`

ZwOpenTransaction

Ordinal	`2036`
Address	`0x9fb60`

ZwOpenTransactionManager

Ordinal	`2037`
Address	`0x9fb80`

ZwPlugPlayControl

Ordinal	`2038`
Address	`0x9fba0`

ZwPowerInformation

Ordinal	`2039`
Address	`0x9e120`

ZwPrePrepareComplete

Ordinal	`2040`
Address	`0x9fbc0`

ZwPrePrepareEnlistment

Ordinal	`2041`
Address	`0x9fbe0`

ZwPrepareComplete

Ordinal	`2042`
Address	`0x9fc00`

ZwPrepareEnlistment

Ordinal	`2043`
Address	`0x9fc20`

ZwPrivilegeCheck

Ordinal	`2044`
Address	`0x9fc40`

ZwPrivilegeObjectAuditAlarm

Ordinal	`2045`
Address	`0x9fc60`

ZwPrivilegedServiceAuditAlarm

Ordinal	`2046`
Address	`0x9fc80`

ZwPropagationComplete

Ordinal	`2047`
Address	`0x9fca0`

ZwPropagationFailed

Ordinal	`2048`
Address	`0x9fcc0`

ZwProtectVirtualMemory

Ordinal	`2049`
Address	`0x9df50`

ZwPssCaptureVaSpaceBulk

Ordinal	`2050`
Address	`0x9fce0`

ZwPulseEvent

Ordinal	`2051`
Address	`0x9fd00`

ZwQueryAttributesFile

Ordinal	`2052`
Address	`0x9dcf0`

ZwQueryAuxiliaryCounterFrequency

Ordinal	`2053`
Address	`0x9fd20`

ZwQueryBootEntryOrder

Ordinal	`2054`
Address	`0x9fd40`

ZwQueryBootOptions

Ordinal	`2055`
Address	`0x9fd60`

ZwQueryDebugFilterState

Ordinal	`2056`
Address	`0x9fd80`

ZwQueryDefaultLocale

Ordinal	`2057`
Address	`0x9d7f0`

ZwQueryDefaultUILanguage

Ordinal	`2058`
Address	`0x9ddd0`

ZwQueryDirectoryFile

Ordinal	`2059`
Address	`0x9dbf0`

ZwQueryDirectoryFileEx

Ordinal	`2060`
Address	`0x9fda0`

ZwQueryDirectoryObject

Ordinal	`2061`
Address	`0x9fdc0`

ZwQueryDriverEntryOrder

Ordinal	`2062`
Address	`0x9fde0`

ZwQueryEaFile

Ordinal	`2063`
Address	`0x9fe00`

ZwQueryEvent

Ordinal	`2064`
Address	`0x9e010`

ZwQueryFullAttributesFile

Ordinal	`2065`
Address	`0x9fe20`

ZwQueryInformationAtom

Ordinal	`2066`
Address	`0x9fe40`

ZwQueryInformationByName

Ordinal	`2067`
Address	`0x9fe60`

ZwQueryInformationEnlistment

Ordinal	`2068`
Address	`0x9fe80`

ZwQueryInformationFile

Ordinal	`2069`
Address	`0x9d770`

ZwQueryInformationJobObject

Ordinal	`2070`
Address	`0x9fea0`

ZwQueryInformationPort

Ordinal	`2071`
Address	`0x9fec0`

ZwQueryInformationProcess

Ordinal	`2072`
Address	`0x9d870`

ZwQueryInformationResourceManager

Ordinal	`2073`
Address	`0x9fee0`

ZwQueryInformationThread

Ordinal	`2074`
Address	`0x9d9f0`

ZwQueryInformationToken

Ordinal	`2075`
Address	`0x9d970`

ZwQueryInformationTransaction

Ordinal	`2076`
Address	`0x9ff00`

ZwQueryInformationTransactionManager

Ordinal	`2077`
Address	`0x9ff20`

ZwQueryInformationWorkerFactory

Ordinal	`2078`
Address	`0x9ff40`

ZwQueryInstallUILanguage

Ordinal	`2079`
Address	`0x9ff60`

ZwQueryIntervalProfile

Ordinal	`2080`
Address	`0x9ff80`

ZwQueryIoCompletion

Ordinal	`2081`
Address	`0x9ffa0`

ZwQueryKey

Ordinal	`2082`
Address	`0x9d810`

ZwQueryLicenseValue

Ordinal	`2083`
Address	`0x9ffc0`

ZwQueryMultipleValueKey

Ordinal	`2084`
Address	`0x9ffe0`

ZwQueryMutant

Ordinal	`2085`
Address	`0xa0000`

ZwQueryObject

Ordinal	`2086`
Address	`0x9d750`

ZwQueryOpenSubKeys

Ordinal	`2087`
Address	`0xa0020`

ZwQueryOpenSubKeysEx

Ordinal	`2088`
Address	`0xa0040`

ZwQueryPerformanceCounter

Ordinal	`2089`
Address	`0x9db70`

ZwQueryPortInformationProcess

Ordinal	`2090`
Address	`0xa0060`

ZwQueryQuotaInformationFile

Ordinal	`2091`
Address	`0xa0080`

ZwQuerySection

Ordinal	`2092`
Address	`0x9df70`

ZwQuerySecurityAttributesToken

Ordinal	`2093`
Address	`0xa00a0`

ZwQuerySecurityObject

Ordinal	`2094`
Address	`0xa00c0`

ZwQuerySecurityPolicy

Ordinal	`2095`
Address	`0xa00e0`

ZwQuerySemaphore

Ordinal	`2096`
Address	`0xa0100`

ZwQuerySymbolicLinkObject

Ordinal	`2097`
Address	`0xa0120`

ZwQuerySystemEnvironmentValue

Ordinal	`2098`
Address	`0xa0140`

ZwQuerySystemEnvironmentValueEx

Ordinal	`2099`
Address	`0xa0160`

ZwQuerySystemInformation

Ordinal	`2100`
Address	`0x9dc10`

ZwQuerySystemInformationEx

Ordinal	`2101`
Address	`0xa0180`

ZwQuerySystemTime

Ordinal	`2102`
Address	`0x9e090`

ZwQueryTimer

Ordinal	`2103`
Address	`0x9dc50`

ZwQueryTimerResolution

Ordinal	`2104`
Address	`0xa01a0`

ZwQueryValueKey

Ordinal	`2105`
Address	`0x9d830`

ZwQueryVirtualMemory

Ordinal	`2106`
Address	`0x9d9b0`

ZwQueryVolumeInformationFile

Ordinal	`2107`
Address	`0x9de70`

ZwQueryWnfStateData

Ordinal	`2108`
Address	`0xa01c0`

ZwQueryWnfStateNameInformation

Ordinal	`2109`
Address	`0xa01e0`

ZwQueueApcThread

Ordinal	`2110`
Address	`0x9ddf0`

ZwQueueApcThreadEx

Ordinal	`2111`
Address	`0xa0200`

ZwQueueApcThreadEx2

Ordinal	`2112`
Address	`0xa0220`

ZwRaiseException

Ordinal	`2113`
Address	`0xa0240`

ZwRaiseHardError

Ordinal	`2114`
Address	`0xa0260`

ZwReadFile

Ordinal	`2115`
Address	`0x9d610`

ZwReadFileScatter

Ordinal	`2116`
Address	`0x9db10`

ZwReadOnlyEnlistment

Ordinal	`2117`
Address	`0xa0280`

ZwReadRequestData

Ordinal	`2118`
Address	`0x9dfd0`

ZwReadVirtualMemory

Ordinal	`2119`
Address	`0x9dd30`

ZwRecoverEnlistment

Ordinal	`2120`
Address	`0xa02a0`

ZwRecoverResourceManager

Ordinal	`2121`
Address	`0xa02c0`

ZwRecoverTransactionManager

Ordinal	`2122`
Address	`0xa02e0`

ZwRegisterProtocolAddressInformation

Ordinal	`2123`
Address	`0xa0300`

ZwRegisterThreadTerminatePort

Ordinal	`2124`
Address	`0xa0320`

ZwReleaseKeyedEvent

Ordinal	`2125`
Address	`0xa0340`

ZwReleaseMutant

Ordinal	`2126`
Address	`0x9d950`

ZwReleaseSemaphore

Ordinal	`2127`
Address	`0x9d690`

ZwReleaseWorkerFactoryWorker

Ordinal	`2128`
Address	`0xa0360`

ZwRemoveIoCompletion

Ordinal	`2129`
Address	`0x9d670`

ZwRemoveIoCompletionEx

Ordinal	`2130`
Address	`0xa0380`

ZwRemoveProcessDebug

Ordinal	`2131`
Address	`0xa03a0`

ZwRenameKey

Ordinal	`2132`
Address	`0xa03c0`

ZwRenameTransactionManager

Ordinal	`2133`
Address	`0xa03e0`

ZwReplaceKey

Ordinal	`2134`
Address	`0xa0400`

ZwReplacePartitionUnit

Ordinal	`2135`
Address	`0xa0420`

ZwReplyPort

Ordinal	`2136`
Address	`0x9d6d0`

ZwReplyWaitReceivePort

Ordinal	`2137`
Address	`0x9d6b0`

ZwReplyWaitReceivePortEx

Ordinal	`2138`
Address	`0x9dab0`

ZwReplyWaitReplyPort

Ordinal	`2139`
Address	`0xa0440`

ZwRequestPort

Ordinal	`2140`
Address	`0xa0460`

ZwRequestWaitReplyPort

Ordinal	`2141`
Address	`0x9d990`

ZwResetEvent

Ordinal	`2142`
Address	`0xa0480`

ZwResetWriteWatch

Ordinal	`2143`
Address	`0xa04a0`

ZwRestoreKey

Ordinal	`2144`
Address	`0xa04c0`

ZwResumeProcess

Ordinal	`2145`
Address	`0xa04e0`

ZwResumeThread

Ordinal	`2146`
Address	`0x9df90`

ZwRevertContainerImpersonation

Ordinal	`2147`
Address	`0xa0500`

ZwRollbackComplete

Ordinal	`2148`
Address	`0xa0520`

ZwRollbackEnlistment

Ordinal	`2149`
Address	`0xa0540`

ZwRollbackRegistryTransaction

Ordinal	`2150`
Address	`0xa0560`

ZwRollbackTransaction

Ordinal	`2151`
Address	`0xa0580`

ZwRollforwardTransactionManager

Ordinal	`2152`
Address	`0xa05a0`

ZwSaveKey

Ordinal	`2153`
Address	`0xa05c0`

ZwSaveKeyEx

Ordinal	`2154`
Address	`0xa05e0`

ZwSaveMergedKeys

Ordinal	`2155`
Address	`0xa0600`

ZwSecureConnectPort

Ordinal	`2156`
Address	`0xa0620`

ZwSerializeBoot

Ordinal	`2157`
Address	`0xa0640`

ZwSetBootEntryOrder

Ordinal	`2158`
Address	`0xa0660`

ZwSetBootOptions

Ordinal	`2159`
Address	`0xa0680`

ZwSetCachedSigningLevel

Ordinal	`2160`
Address	`0xa06a0`

ZwSetCachedSigningLevel2

Ordinal	`2161`
Address	`0xa06c0`

ZwSetContextThread

Ordinal	`2162`
Address	`0xa06e0`

ZwSetDebugFilterState

Ordinal	`2163`
Address	`0xa0700`

ZwSetDefaultHardErrorPort

Ordinal	`2164`
Address	`0xa0720`

ZwSetDefaultLocale

Ordinal	`2165`
Address	`0xa0740`

ZwSetDefaultUILanguage

Ordinal	`2166`
Address	`0xa0760`

ZwSetDriverEntryOrder

Ordinal	`2167`
Address	`0xa0780`

ZwSetEaFile

Ordinal	`2168`
Address	`0xa07a0`

ZwSetEvent

Ordinal	`2169`
Address	`0x9d710`

ZwSetEventBoostPriority

Ordinal	`2170`
Address	`0x9daf0`

ZwSetHighEventPair

Ordinal	`2171`
Address	`0xa07c0`

ZwSetHighWaitLowEventPair

Ordinal	`2172`
Address	`0xa07e0`

ZwSetIRTimer

Ordinal	`2173`
Address	`0xa0800`

ZwSetInformationDebugObject

Ordinal	`2174`
Address	`0xa0820`

ZwSetInformationEnlistment

Ordinal	`2175`
Address	`0xa0840`

ZwSetInformationFile

Ordinal	`2176`
Address	`0x9da30`

ZwSetInformationJobObject

Ordinal	`2177`
Address	`0xa0860`

ZwSetInformationKey

Ordinal	`2178`
Address	`0xa0880`

ZwSetInformationObject

Ordinal	`2179`
Address	`0x9e0c0`

ZwSetInformationProcess

Ordinal	`2180`
Address	`0x9d8d0`

ZwSetInformationResourceManager

Ordinal	`2181`
Address	`0xa08a0`

ZwSetInformationSymbolicLink

Ordinal	`2182`
Address	`0xa08c0`

ZwSetInformationThread

Ordinal	`2183`
Address	`0x9d6f0`

ZwSetInformationToken

Ordinal	`2184`
Address	`0xa08e0`

ZwSetInformationTransaction

Ordinal	`2185`
Address	`0xa0900`

ZwSetInformationTransactionManager

Ordinal	`2186`
Address	`0xa0920`

ZwSetInformationVirtualMemory

Ordinal	`2187`
Address	`0xa0940`

ZwSetInformationWorkerFactory

Ordinal	`2188`
Address	`0xa0960`

ZwSetIntervalProfile

Ordinal	`2189`
Address	`0xa0980`

ZwSetIoCompletion

Ordinal	`2190`
Address	`0xa09a0`

ZwSetIoCompletionEx

Ordinal	`2191`
Address	`0xa09c0`

ZwSetLdtEntries

Ordinal	`2192`
Address	`0xa09e0`

ZwSetLowEventPair

Ordinal	`2193`
Address	`0xa0a00`

ZwSetLowWaitHighEventPair

Ordinal	`2194`
Address	`0xa0a20`

ZwSetQuotaInformationFile

Ordinal	`2195`
Address	`0xa0a40`

ZwSetSecurityObject

Ordinal	`2196`
Address	`0xa0a60`

ZwSetSystemEnvironmentValue

Ordinal	`2197`
Address	`0xa0a80`

ZwSetSystemEnvironmentValueEx

Ordinal	`2198`
Address	`0xa0aa0`

ZwSetSystemInformation

Ordinal	`2199`
Address	`0xa0ac0`

ZwSetSystemPowerState

Ordinal	`2200`
Address	`0xa0ae0`

ZwSetSystemTime

Ordinal	`2201`
Address	`0xa0b00`

ZwSetThreadExecutionState

Ordinal	`2202`
Address	`0xa0b20`

ZwSetTimer

Ordinal	`2203`
Address	`0x9e180`

ZwSetTimer2

Ordinal	`2204`
Address	`0xa0b40`

ZwSetTimerEx

Ordinal	`2205`
Address	`0xa0b60`

ZwSetTimerResolution

Ordinal	`2206`
Address	`0xa0b80`

ZwSetUuidSeed

Ordinal	`2207`
Address	`0xa0ba0`

ZwSetValueKey

Ordinal	`2208`
Address	`0x9e140`

ZwSetVolumeInformationFile

Ordinal	`2209`
Address	`0xa0bc0`

ZwSetWnfProcessNotificationEvent

Ordinal	`2210`
Address	`0xa0be0`

ZwShutdownSystem

Ordinal	`2211`
Address	`0xa0c00`

ZwShutdownWorkerFactory

Ordinal	`2212`
Address	`0xa0c20`

ZwSignalAndWaitForSingleObject

Ordinal	`2213`
Address	`0xa0c40`

ZwSinglePhaseReject

Ordinal	`2214`
Address	`0xa0c60`

ZwStartProfile

Ordinal	`2215`
Address	`0xa0c80`

ZwStopProfile

Ordinal	`2216`
Address	`0xa0ca0`

ZwSubscribeWnfStateChange

Ordinal	`2217`
Address	`0xa0cc0`

ZwSuspendProcess

Ordinal	`2218`
Address	`0xa0ce0`

ZwSuspendThread

Ordinal	`2219`
Address	`0xa0d00`

ZwSystemDebugControl

Ordinal	`2220`
Address	`0xa0d20`

ZwTerminateEnclave

Ordinal	`2221`
Address	`0xa0d40`

ZwTerminateJobObject

Ordinal	`2222`
Address	`0xa0d60`

ZwTerminateProcess

Ordinal	`2223`
Address	`0x9dad0`

ZwTerminateThread

Ordinal	`2224`
Address	`0x9dfb0`

ZwTestAlert

Ordinal	`2225`
Address	`0xa0d80`

ZwThawRegistry

Ordinal	`2226`
Address	`0xa0da0`

ZwThawTransactions

Ordinal	`2227`
Address	`0xa0dc0`

ZwTraceControl

Ordinal	`2228`
Address	`0xa0de0`

ZwTraceEvent

Ordinal	`2229`
Address	`0x9e100`

ZwTranslateFilePath

Ordinal	`2230`
Address	`0xa0e00`

ZwUmsThreadYield

Ordinal	`2231`
Address	`0xa0e20`

ZwUnloadDriver

Ordinal	`2232`
Address	`0xa0e40`

ZwUnloadKey

Ordinal	`2233`
Address	`0xa0e60`

ZwUnloadKey2

Ordinal	`2234`
Address	`0xa0e80`

ZwUnloadKeyEx

Ordinal	`2235`
Address	`0xa0ea0`

ZwUnlockFile

Ordinal	`2236`
Address	`0xa0ec0`

ZwUnlockVirtualMemory

Ordinal	`2237`
Address	`0xa0ee0`

ZwUnmapViewOfSection

Ordinal	`2238`
Address	`0x9da90`

ZwUnmapViewOfSectionEx

Ordinal	`2239`
Address	`0xa0f00`

ZwUnsubscribeWnfStateChange

Ordinal	`2240`
Address	`0xa0f20`

ZwUpdateWnfStateData

Ordinal	`2241`
Address	`0xa0f40`

ZwVdmControl

Ordinal	`2242`
Address	`0xa0f60`

ZwWaitForAlertByThreadId

Ordinal	`2243`
Address	`0xa0f80`

ZwWaitForDebugEvent

Ordinal	`2244`
Address	`0xa0fa0`

ZwWaitForKeyedEvent

Ordinal	`2245`
Address	`0xa0fc0`

ZwWaitForMultipleObjects

Ordinal	`2246`
Address	`0x9e0a0`

ZwWaitForMultipleObjects32

Ordinal	`2247`
Address	`0x9d890`

ZwWaitForSingleObject

Ordinal	`2248`
Address	`0x9d5d0`

ZwWaitForWorkViaWorkerFactory

Ordinal	`2249`
Address	`0xa0fe0`

ZwWaitHighEventPair

Ordinal	`2250`
Address	`0xa1000`

ZwWaitLowEventPair

Ordinal	`2251`
Address	`0xa1040`

ZwWorkerFactoryWorkerReady

Ordinal	`2252`
Address	`0x9d570`

ZwWriteFile

Ordinal	`2253`
Address	`0x9d650`

ZwWriteFileGather

Ordinal	`2254`
Address	`0x9d8b0`

ZwWriteRequestData

Ordinal	`2255`
Address	`0x9e030`

ZwWriteVirtualMemory

Ordinal	`2256`
Address	`0x9dc90`

ZwYieldExecution

Ordinal	`2257`
Address	`0x9de10`

__C_specific_handler

Ordinal	`2258`
Address	`0x8cdc0`

__chkstk

Ordinal	`2259`
Address	`0xa2810`

__isascii

Ordinal	`2260`
Address	`0x8cf90`

__iscsym

Ordinal	`2261`
Address	`0x8cfb0`

__iscsymf

Ordinal	`2262`
Address	`0x8cff0`

__misaligned_access

Ordinal	`2263`
Address	`0x808d0`

__toascii

Ordinal	`2264`
Address	`0x8d030`

_atoi64

Ordinal	`2265`
Address	`0x8d250`

_errno

Ordinal	`2266`
Address	`0x858c0`

_fltused

Ordinal	`2267`
Address	`0x166ac0`

_i64toa

Ordinal	`2268`
Address	`0x8d2c0`

_i64toa_s

Ordinal	`2269`
Address	`0x96950`

_i64tow

Ordinal	`2270`
Address	`0x8d460`

_i64tow_s

Ordinal	`2271`
Address	`0x96c50`

_itoa

Ordinal	`2272`
Address	`0x8d300`

_itoa_s

Ordinal	`2273`
Address	`0x96980`

_itow

Ordinal	`2274`
Address	`0x8d4a0`

_itow_s

Ordinal	`2275`
Address	`0x96c80`

_lfind

Ordinal	`2276`
Address	`0x8d640`

_local_unwind

Ordinal	`2277`
Address	`0x8d6f0`

_ltoa

Ordinal	`2278`
Address	`0x8d300`

_ltoa_s

Ordinal	`2279`
Address	`0x96980`

_ltow

Ordinal	`2280`
Address	`0x8d4a0`

_ltow_s

Ordinal	`2281`
Address	`0x96c80`

_makepath_s

Ordinal	`2282`
Address	`0x96f70`

_memccpy

Ordinal	`2283`
Address	`0x8d720`

_memicmp

Ordinal	`2284`
Address	`0x8d7c0`

_setjmp

Ordinal	`2285`
Address	`0xa3550`

_setjmpex

Ordinal	`2286`
Address	`0xa3610`

_snprintf

Ordinal	`2287`
Address	`0x8d7e0`

_snprintf_s

Ordinal	`2288`
Address	`0x970c0`

_snscanf_s

Ordinal	`2289`
Address	`0x97190`

_snwprintf

Ordinal	`2290`
Address	`0x8d890`

_snwprintf_s

Ordinal	`2291`
Address	`0x971d0`

_snwscanf_s

Ordinal	`2292`
Address	`0x972b0`

_splitpath

Ordinal	`2293`
Address	`0x8d970`

_splitpath_s

Ordinal	`2294`
Address	`0x972f0`

_strcmpi

Ordinal	`2295`
Address	`0x8dcd0`

_stricmp

Ordinal	`2296`
Address	`0x8dcd0`

_strlwr

Ordinal	`2297`
Address	`0x8dcf0`

_strlwr_s

Ordinal	`2298`
Address	`0x8dd20`

_strnicmp

Ordinal	`2299`
Address	`0x8ddf0`

_strnset_s

Ordinal	`2300`
Address	`0x97590`

_strset_s

Ordinal	`2301`
Address	`0x97620`

_strupr

Ordinal	`2302`
Address	`0x8de10`

_strupr_s

Ordinal	`2303`
Address	`0x8de60`

_swprintf

Ordinal	`2304`
Address	`0x8ded0`

_ui64toa

Ordinal	`2305`
Address	`0x8d330`

_ui64toa_s

Ordinal	`2306`
Address	`0x969b0`

_ui64tow

Ordinal	`2307`
Address	`0x8d4d0`

_ui64tow_s

Ordinal	`2308`
Address	`0x96cb0`

_ultoa

Ordinal	`2309`
Address	`0x8d350`

_ultoa_s

Ordinal	`2310`
Address	`0x969d0`

_ultow

Ordinal	`2311`
Address	`0x8d4f0`

_ultow_s

Ordinal	`2312`
Address	`0x96cd0`

_vscprintf

Ordinal	`2313`
Address	`0x8df90`

_vscwprintf

Ordinal	`2314`
Address	`0x8e0a0`

_vsnprintf

Ordinal	`2315`
Address	`0x8e180`

_vsnprintf_s

Ordinal	`2316`
Address	`0x970f0`

_vsnwprintf

Ordinal	`2317`
Address	`0x8e250`

_vsnwprintf_s

Ordinal	`2318`
Address	`0x97200`

_vswprintf

Ordinal	`2319`
Address	`0x8e0c0`

_wcsicmp

Ordinal	`2320`
Address	`0x8e350`

_wcslwr

Ordinal	`2321`
Address	`0x8e3b0`

_wcslwr_s

Ordinal	`2322`
Address	`0x8e410`

_wcsnicmp

Ordinal	`2323`
Address	`0x8e490`

_wcsnset_s

Ordinal	`2324`
Address	`0x8e500`

_wcsset_s

Ordinal	`2325`
Address	`0x8e590`

_wcstoi64

Ordinal	`2326`
Address	`0x8e5f0`

_wcstoui64

Ordinal	`2327`
Address	`0x8e620`

_wcsupr

Ordinal	`2328`
Address	`0x8e8c0`

_wcsupr_s

Ordinal	`2329`
Address	`0x8e900`

_wmakepath_s

Ordinal	`2330`
Address	`0x97680`

_wsplitpath_s

Ordinal	`2331`
Address	`0x97800`

_wtoi

Ordinal	`2332`
Address	`0x8e980`

_wtoi64

Ordinal	`2333`
Address	`0x8e9b0`

_wtol

Ordinal	`2334`
Address	`0x8e9d0`

abs

Ordinal	`2335`
Address	`0x8e9f0`

atan

Ordinal	`2336`
Address	`0x8ea00`

atan2

Ordinal	`2337`
Address	`0x8ec60`

atoi

Ordinal	`2338`
Address	`0x8d270`

atol

Ordinal	`2339`
Address	`0x8d2a0`

bsearch

Ordinal	`2340`
Address	`0x8f3a0`

bsearch_s

Ordinal	`2341`
Address	`0x8f4a0`

ceil

Ordinal	`2342`
Address	`0x8f5b0`

cos

Ordinal	`2343`
Address	`0x8f6d0`

fabs

Ordinal	`2344`
Address	`0x8ffb0`

floor

Ordinal	`2345`
Address	`0x90090`

isalnum

Ordinal	`2346`
Address	`0x8d040`

isalpha

Ordinal	`2347`
Address	`0x8d070`

iscntrl

Ordinal	`2348`
Address	`0x8d0a0`

isdigit

Ordinal	`2349`
Address	`0x8d0d0`

isgraph

Ordinal	`2350`
Address	`0x8d100`

islower

Ordinal	`2351`
Address	`0x8d130`

isprint

Ordinal	`2352`
Address	`0x8d160`

ispunct

Ordinal	`2353`
Address	`0x8d190`

isspace

Ordinal	`2354`
Address	`0x8d1c0`

isupper

Ordinal	`2355`
Address	`0x8d1f0`

iswalnum

Ordinal	`2356`
Address	`0x901c0`

iswalpha

Ordinal	`2357`
Address	`0x901d0`

iswascii

Ordinal	`2358`
Address	`0x901e0`

iswctype

Ordinal	`2359`
Address	`0x90290`

iswdigit

Ordinal	`2360`
Address	`0x90200`

iswgraph

Ordinal	`2361`
Address	`0x90210`

iswlower

Ordinal	`2362`
Address	`0x90220`

iswprint

Ordinal	`2363`
Address	`0x90230`

iswspace

Ordinal	`2364`
Address	`0x90240`

iswxdigit

Ordinal	`2365`
Address	`0x90250`

isxdigit

Ordinal	`2366`
Address	`0x8d220`

labs

Ordinal	`2367`
Address	`0x8e9f0`

log

Ordinal	`2368`
Address	`0x902c0`

longjmp

Ordinal	`2369`
Address	`0x905a0`

mbstowcs

Ordinal	`2370`
Address	`0x905d0`

memchr

Ordinal	`2371`
Address	`0x906b0`

memcmp

Ordinal	`2372`
Address	`0x906e0`

memcpy

Ordinal	`2373`
Address	`0xa43c0`

memcpy_s

Ordinal	`2374`
Address	`0x97ac0`

memmove

Ordinal	`2375`
Address	`0xa43c0`

memmove_s

Ordinal	`2376`
Address	`0x97b60`

memset

Ordinal	`2377`
Address	`0xa4680`

pow

Ordinal	`2378`
Address	`0xa36b0`

qsort

Ordinal	`2379`
Address	`0x907c0`

qsort_s

Ordinal	`2380`
Address	`0x90b50`

sin

Ordinal	`2381`
Address	`0x8faf0`

sprintf

Ordinal	`2382`
Address	`0x90f10`

sprintf_s

Ordinal	`2383`
Address	`0x97bc0`

sqrt

Ordinal	`2384`
Address	`0x90fa0`

sscanf

Ordinal	`2385`
Address	`0x910b0`

sscanf_s

Ordinal	`2386`
Address	`0x97c40`

strcat

Ordinal	`2387`
Address	`0x91180`

strcat_s

Ordinal	`2388`
Address	`0x97ca0`

strchr

Ordinal	`2389`
Address	`0x912e0`

strcmp

Ordinal	`2390`
Address	`0x91320`

strcpy

Ordinal	`2391`
Address	`0x91220`

strcpy_s

Ordinal	`2392`
Address	`0x97d40`

strcspn

Ordinal	`2393`
Address	`0x913e0`

strlen

Ordinal	`2394`
Address	`0x914a0`

strncat

Ordinal	`2395`
Address	`0x91560`

strncat_s

Ordinal	`2396`
Address	`0x97dd0`

strncmp

Ordinal	`2397`
Address	`0x91710`

strncpy

Ordinal	`2398`
Address	`0x917e0`

strncpy_s

Ordinal	`2399`
Address	`0x97ee0`

strnlen

Ordinal	`2400`
Address	`0x91950`

strpbrk

Ordinal	`2401`
Address	`0x91970`

strrchr

Ordinal	`2402`
Address	`0x91a20`

strspn

Ordinal	`2403`
Address	`0x91a50`

strstr

Ordinal	`2404`
Address	`0x91b20`

strtok_s

Ordinal	`2405`
Address	`0x97fd0`

strtol

Ordinal	`2406`
Address	`0x91da0`

strtoul

Ordinal	`2407`
Address	`0x91e00`

swprintf

Ordinal	`2408`
Address	`0x8ded0`

swprintf_s

Ordinal	`2409`
Address	`0x98140`

swscanf_s

Ordinal	`2410`
Address	`0x981d0`

tan

Ordinal	`2411`
Address	`0x91e40`

tolower

Ordinal	`2412`
Address	`0x922e0`

toupper

Ordinal	`2413`
Address	`0x92320`

towlower

Ordinal	`2414`
Address	`0x92390`

towupper

Ordinal	`2415`
Address	`0x923c0`

vDbgPrintEx

Ordinal	`2416`
Address	`0xe09b0`

vDbgPrintExWithPrefix

Ordinal	`2417`
Address	`0xe09e0`

vsprintf

Ordinal	`2418`
Address	`0x8e080`

vsprintf_s

Ordinal	`2419`
Address	`0x97bf0`

vswprintf_s

Ordinal	`2420`
Address	`0x98170`

wcscat

Ordinal	`2421`
Address	`0x923d0`

wcscat_s

Ordinal	`2422`
Address	`0x98230`

wcschr

Ordinal	`2423`
Address	`0x92440`

wcscmp

Ordinal	`2424`
Address	`0x92470`

wcscpy

Ordinal	`2425`
Address	`0x92410`

wcscpy_s

Ordinal	`2426`
Address	`0x982d0`

wcscspn

Ordinal	`2427`
Address	`0x924b0`

wcslen

Ordinal	`2428`
Address	`0x92500`

wcsncat

Ordinal	`2429`
Address	`0x92520`

wcsncat_s

Ordinal	`2430`
Address	`0x98360`

wcsncmp

Ordinal	`2431`
Address	`0x92570`

wcsncpy

Ordinal	`2432`
Address	`0x925b0`

wcsncpy_s

Ordinal	`2433`
Address	`0x98480`

wcsnlen

Ordinal	`2434`
Address	`0x92600`

wcspbrk

Ordinal	`2435`
Address	`0x92630`

wcsrchr

Ordinal	`2436`
Address	`0x92680`

wcsspn

Ordinal	`2437`
Address	`0x926c0`

wcsstr

Ordinal	`2438`
Address	`0x92710`

wcstok_s

Ordinal	`2439`
Address	`0x98580`

wcstol

Ordinal	`2440`
Address	`0x929a0`

wcstombs

Ordinal	`2441`
Address	`0x92a40`

wcstoul

Ordinal	`2442`
Address	`0x92a00`

1

Type	`MUI`
Language	English - United States
Codepage	UNKNOWN
Size	`0xc8`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.69191`
MD5	`ab096f58ba922ea337eb4bffb05c200f 🔍`
SHA1	`05092b3dd4b28d245a981f52beb9e341599d8473 🔍`
SHA256	`2f456eee2798dc58c1353adcba9abc75af643bb42cc2e7baf058f632b1c77d76 🔍`
SHA3	`2120aa7149521bd09a62a5c17af47916c2ea87c6c816c00611de623442b744a8 🔍`

1 (#2)

Type	`RT_MESSAGETABLE`
Language	English - United States
Codepage	UNKNOWN
Size	`0x6ffd0`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.34508`
MD5	`74bb07002e148fb5ca363a0aea1fcf40 🔍`
SHA1	`82dfc174edae2f9ef9cae2131c1015e7e6455f92 🔍`
SHA256	`62134f60c33f10d0631ad4151ff24f957224ded044c1295a7c17833c2afd3ca5 🔍`
SHA3	`09dda2025bee8515e261add48e46864a1438b41ce9ac70d0d278c18c3428ef72 🔍`

1 (#3)

Type	`RT_VERSION`
Language	English - United States
Codepage	UNKNOWN
Size	`0x380`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.50484`
MD5	`4fda0d496d7ad642050359437bfcb479 🔍`
SHA1	`466f1a820cf298485f3dffbecc83a23911db30f0 🔍`
SHA256	`7c69342545e2b3128b7254f47a9b36ae0a4e9d8252de5a6651db2af68e9b1239 🔍`
SHA3	`a63aa8b9fc8a0ba04f65deba07ba7cf73d5ef52493b63103c8a3f15cd5cb3d4a 🔍`

Version Info

Signature	`0xfeef04bd`
StructVersion	`0x10000`
FileVersion	10.0.19041.4522
ProductVersion	10.0.19041.4522
FileFlags	`(EMPTY)`
FileOs	`VOS_DOS_WINDOWS32` `VOS_NT` `VOS_NT_WINDOWS32` `VOS_WINCE` `VOS__WINDOWS32`
FileType	`VFT_DLL`
Language	English - United States
CompanyName	Microsoft Corporation
FileDescription	NT Layer DLL
FileVersion (#2)	10.0.19041.4522 (WinBuild.160101.0800)
InternalName	ntdll.dll
LegalCopyright	Â© Microsoft Corporation. All rights reserved.
OriginalFilename	ntdll.dll
ProductName	MicrosoftÂ® WindowsÂ® Operating System
ProductVersion (#2)	10.0.19041.4522

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2043-Jun-04 23:08:35
Version	`0.0`
SizeofData	`34`
AddressOfRawData	`0x140110`
PointerToRawData	`0x13cf10`
Referenced File	ntdll.pdb

IMAGE_DEBUG_TYPE_POGO

Characteristics	`0`
TimeDateStamp	2043-Jun-04 23:08:35
Version	`0.0`
SizeofData	`1724`
AddressOfRawData	`0x140134`
PointerToRawData	`0x13cf34`

UNKNOWN

Characteristics	`0`
TimeDateStamp	2043-Jun-04 23:08:35
Version	`0.0`
SizeofData	`36`
AddressOfRawData	`0x1407f0`
PointerToRawData	`0x13d5f0`

UNKNOWN (#2)

Characteristics	`0`
TimeDateStamp	2043-Jun-04 23:08:35
Version	`0.0`
SizeofData	`4`
AddressOfRawData	`0x140814`
PointerToRawData	`0x13d614`

TLS Callbacks

Load Configuration

Size	`0x118`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0x800`
EditList	`0`
SecurityCookie	`0x7ffdca994510`
GuardCFCheckFunctionPointer	`140728002482656`
GuardCFDispatchFunctionPointer	`0`
GuardCFFunctionTable	`0`
GuardCFFunctionCount	`0`
GuardFlags	`(EMPTY)`
CodeIntegrity.Flags	`0`
CodeIntegrity.Catalog	`0`
CodeIntegrity.CatalogOffset	`0`
CodeIntegrity.Reserved	`0`
GuardAddressTakenIatEntryTable	`0`
GuardAddressTakenIatEntryCount	`0`
GuardLongJumpTargetTable	`0`
GuardLongJumpTargetCount	`0`

RICH Header

XOR Key	`0x3906c643`
Unmarked objects	`0`
Exports (27412)	`1`
ASM objects (27412)	`35`
C objects (27412)	`129`
C objects (POGO O) (27412)	`287`
C++ objects (27412)	`27`
Resource objects (27412)	`1`
Linker (27412)	`1`

Errors

[*] Warning: The WIN_CERTIFICATE appears to be invalid.

Leave a comment

No comments yet.