diff --git a/lib/libc/mingw/lib32/ntdll.def b/lib/libc/mingw/lib32/ntdll.def
new file mode 100644
index 0000000000..d6837b113f
--- /dev/null
+++ b/lib/libc/mingw/lib32/ntdll.def
@@ -0,0 +1,2082 @@
+;
+; Definition file of ntdll.dll
+; Automatic generated by gendef
+; written by Kai Tietz 2008
+;
+LIBRARY "ntdll.dll"
+EXPORTS
+RtlActivateActivationContextUnsafeFast@0
+RtlDeactivateActivationContextUnsafeFast@0
+RtlInterlockedPushListSList@8
+@RtlUlongByteSwap@4
+@RtlUlonglongByteSwap@8
+@RtlUshortByteSwap@4
+ExpInterlockedPopEntrySListEnd@0
+ExpInterlockedPopEntrySListFault@0
+ExpInterlockedPopEntrySListResume@0
+RtlpInterlockedPopEntrySeqSListEnd@0
+RtlpInterlockedPopEntrySeqSListFault@0
+RtlpInterlockedPopEntrySeqSListResume@0
+A_SHAFinal@8
+A_SHAInit@4
+A_SHAUpdate@12
+AlpcAdjustCompletionListConcurrencyCount@8
+AlpcFreeCompletionListMessage@8
+AlpcGetCompletionListLastMessageInformation@12
+AlpcGetCompletionListMessageAttributes@8
+AlpcGetHeaderSize@4
+AlpcGetMessageAttribute@8
+AlpcGetMessageFromCompletionList@8
+AlpcGetOutstandingCompletionListMessageCount@4
+AlpcInitializeMessageAttribute@16
+AlpcMaxAllowedMessageLength@0
+AlpcRegisterCompletionList@20
+AlpcRegisterCompletionListWorkerThread@4
+AlpcRundownCompletionList@4
+AlpcUnregisterCompletionList@4
+AlpcUnregisterCompletionListWorkerThread@4
+CsrAllocateCaptureBuffer@8
+CsrAllocateMessagePointer@12
+CsrCaptureMessageBuffer@16
+CsrCaptureMessageMultiUnicodeStringsInPlace@12
+CsrCaptureMessageString@20
+CsrCaptureTimeout@8
+CsrClientCallServer@16
+CsrClientConnectToServer@20
+CsrFreeCaptureBuffer@4
+CsrGetProcessId@0
+CsrIdentifyAlertableThread@0
+CsrNewThread@0
+CsrProbeForRead@12
+CsrProbeForWrite@12
+CsrSetPriorityClass@8
+CsrVerifyRegion@8
+DbgBreakPoint@0
+DbgPrint
+DbgPrintEx
+DbgPrintReturnControlC
+DbgPrompt@12
+DbgQueryDebugFilterState@8
+DbgSetDebugFilterState@12
+DbgSsHandleKmApiMsg@8
+DbgSsInitialize@16
+DbgUiConnectToDbg@0
+DbgUiContinue@8
+DbgUiConvertStateChangeStructure@8
+DbgUiDebugActiveProcess@4
+DbgUiGetThreadDebugObject@0
+DbgUiIssueRemoteBreakin@4
+DbgUiRemoteBreakin@4
+DbgUiSetThreadDebugObject@4
+DbgUiStopDebugging@4
+DbgUiWaitStateChange@8
+DbgUserBreakPoint@0
+EtwCreateTraceInstanceId@8
+EtwDeliverDataBlock@4
+EtwEnumerateProcessRegGuids@12
+EtwEventActivityIdControl@8
+EtwEventEnabled@12
+EtwEventProviderEnabled@20
+EtwEventRegister@16
+EtwEventUnregister@8
+EtwEventWrite@20
+EtwEventWriteEndScenario@20
+EtwEventWriteEx@40
+EtwEventWriteFull@32
+EtwEventWriteNoRegistration@16
+EtwEventWriteStartScenario@20
+EtwEventWriteString@24
+EtwEventWriteTransfer@28
+EtwGetTraceEnableFlags@8
+EtwGetTraceEnableLevel@8
+EtwGetTraceLoggerHandle@4
+EtwLogTraceEvent@12
+EtwNotificationRegister@20
+EtwNotificationUnregister@12
+EtwProcessPrivateLoggerRequest@4
+EtwRegisterSecurityProvider@0
+EtwRegisterTraceGuidsA@32
+EtwRegisterTraceGuidsW@32
+EtwReplyNotification@4
+EtwSendNotification@20
+EtwSetMark@16
+EtwTraceEventInstance@20
+EtwTraceMessage
+EtwTraceMessageVa@24
+EtwUnregisterTraceGuids@8
+EtwWriteUMSecurityEvent@16
+EtwpCreateEtwThread@8
+EtwpGetCpuSpeed@8
+;EtwpNotificationThread
+EvtIntReportAuthzEventAndSourceAsync@44
+EvtIntReportEventAndSourceAsync@44
+KiFastSystemCall@0
+KiFastSystemCallRet@0
+KiIntSystemCall@0
+KiRaiseUserExceptionDispatcher@0
+KiUserApcDispatcher@20
+KiUserCallbackDispatcher@12
+KiUserExceptionDispatcher@8
+LdrAccessResource@16
+LdrAddLoadAsDataTable@16; Check!!! gendef says @20
+LdrAddRefDll@8
+LdrAlternateResourcesEnabled@0
+LdrDisableThreadCalloutsForDll@4
+LdrEnumResources@20
+LdrEnumerateLoadedModules@12
+LdrFindEntryForAddress@8
+LdrFindResourceDirectory_U@16
+LdrFindResourceEx_U@20
+LdrFindResource_U@16
+LdrFlushAlternateResourceModules@0
+LdrGetDllHandle@16
+LdrGetDllHandleByMapping@8
+LdrGetDllHandleByName@12
+LdrGetDllHandleEx@20
+LdrGetFailureData@0
+LdrGetFileNameFromLoadAsDataTable@8
+LdrGetProcedureAddress@16
+LdrGetProcedureAddressEx@20
+LdrHotPatchRoutine@0
+LdrInitShimEngineDynamic@4
+LdrInitializeThunk@16
+LdrLoadAlternateResourceModule@16
+LdrLoadAlternateResourceModuleEx@20
+LdrLoadDll@16
+LdrAlternateResourcesEnabled@0
+LdrLockLoaderLock@12
+LdrOpenImageFileOptionsKey@12
+LdrProcessRelocationBlock@16
+LdrQueryImageFileExecutionOptions@24
+LdrQueryImageFileExecutionOptionsEx@28
+LdrQueryImageFileKeyOption@24
+LdrQueryModuleServiceTags@12
+LdrQueryProcessModuleInformation@12
+LdrRegisterDllNotification@16
+LdrRemoveLoadAsDataTable@16
+LdrResFindResource@36
+LdrResFindResourceDirectory@28
+LdrResGetRCConfig@20
+LdrResRelease@12
+LdrResSearchResource@32
+LdrRscIsTypeExist@16
+LdrSetAppCompatDllRedirectionCallback@12
+LdrSetDllManifestProber@4
+LdrSetMUICacheType@4
+LdrShutdownProcess@0
+LdrShutdownThread@0
+LdrUnloadAlternateResourceModule@4
+LdrUnloadAlternateResourceModuleEx@8
+LdrUnloadDll@4
+LdrUnlockLoaderLock@8
+LdrUnregisterDllNotification@4
+LdrVerifyImageMatchesChecksum@16
+LdrVerifyImageMatchesChecksumEx@8
+LdrWx86FormatVirtualImage@12
+LdrpResGetMappingSize@16
+LdrpResGetRCConfig@20
+LdrpResGetResourceDirectory@20
+MD4Final@4
+MD4Init@4
+MD4Update@12
+MD5Final@4
+MD5Init@4
+MD5Update@12
+NlsAnsiCodePage DATA
+NlsMbCodePageTag DATA
+NlsMbOemCodePageTag DATA
+NtAcceptConnectPort@24
+NtAccessCheck@32
+NtAccessCheckAndAuditAlarm@44
+NtAccessCheckByType@44
+NtAccessCheckByTypeAndAuditAlarm@64
+NtAccessCheckByTypeResultList@44
+NtAccessCheckByTypeResultListAndAuditAlarm@64
+NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
+NtAcquireCMFViewOwnership@12
+NtAddAtom@12
+NtAddBootEntry@8
+NtAddDriverEntry@8
+NtAdjustGroupsToken@24
+NtAdjustPrivilegesToken@24
+NtAlertResumeThread@8
+NtAlertThread@4
+NtAllocateLocallyUniqueId@4
+NtAllocateReserveObject@12
+NtAllocateUserPhysicalPages@12
+NtAllocateUuids@16
+NtAllocateVirtualMemory@24
+NtAlpcAcceptConnectPort@36
+NtAlpcCancelMessage@12
+NtAlpcConnectPort@44
+NtAlpcCreatePort@12
+NtAlpcCreatePortSection@24
+NtAlpcCreateResourceReserve@16
+NtAlpcCreateSectionView@12
+NtAlpcCreateSecurityContext@12
+NtAlpcDeletePortSection@12
+NtAlpcDeleteResourceReserve@12
+NtAlpcDeleteSectionView@12
+NtAlpcDeleteSecurityContext@12
+NtAlpcDisconnectPort@8
+NtAlpcImpersonateClientOfPort@12
+NtAlpcOpenSenderProcess@24
+NtAlpcOpenSenderThread@24
+NtAlpcQueryInformation@20
+NtAlpcQueryInformationMessage@24
+NtAlpcRevokeSecurityContext@12
+NtAlpcSendWaitReceivePort@32
+NtAlpcSetInformation@16
+NtApphelpCacheControl@8
+NtAreMappedFilesTheSame@8
+NtAssignProcessToJobObject@8
+NtCallbackReturn@12
+NtCancelDeviceWakeupRequest@4
+NtCancelIoFile@8
+NtCancelIoFileEx@12
+NtCancelSynchronousIoFile@12
+NtCancelTimer@8
+NtClearEvent@4
+NtClose@4
+NtCloseObjectAuditAlarm@12
+NtCommitComplete@8
+NtCommitEnlistment@8
+NtCommitTransaction@8
+NtCompactKeys@8
+NtCompareTokens@12
+NtCompleteConnectPort@4
+NtCompressKey@4
+NtConnectPort@32
+NtContinue@8
+NtCreateDebugObject@16
+NtCreateDirectoryObject@12
+NtCreateEnlistment@32
+NtCreateEvent@20
+NtCreateEventPair@12
+NtCreateFile@44
+NtCreateIoCompletion@16
+NtCreateJobObject@12
+NtCreateJobSet@12
+NtCreateKey@28
+NtCreateKeyTransacted@32
+NtCreateKeyedEvent@16
+NtCreateMailslotFile@32
+NtCreateMutant@16
+NtCreateNamedPipeFile@56
+NtCreatePagingFile@16
+NtCreatePort@20
+NtCreatePrivateNamespace@16
+NtCreateProcess@32
+NtCreateProcessEx@36
+NtCreateProfile@36
+NtCreateProfileEx@40
+NtCreateResourceManager@28
+NtCreateSection@28
+NtCreateSemaphore@20
+NtCreateSymbolicLinkObject@16
+NtCreateThread@32
+NtCreateThreadEx@44
+NtCreateTimer@16
+NtCreateToken@52
+NtCreateTransaction@40
+NtCreateTransactionManager@24
+NtCreateUserProcess@44
+NtCreateWaitablePort@20
+NtCreateWorkerFactory@40
+NtCurrentTeb@0
+NtDebugActiveProcess@8
+NtDebugContinue@12
+NtDelayExecution@8
+NtDeleteAtom@4
+NtDeleteBootEntry@4
+NtDeleteDriverEntry@4
+NtDeleteFile@4
+NtDeleteKey@4
+NtDeleteObjectAuditAlarm@12
+NtDeletePrivateNamespace@4
+NtDeleteValueKey@8
+NtDeviceIoControlFile@40
+NtDisableLastKnownGood@0
+NtDisplayString@4
+NtDrawText@4
+NtDuplicateObject@28
+NtDuplicateToken@24
+NtEnableLastKnownGood@0
+NtEnumerateBootEntries@8
+NtEnumerateDriverEntries@8
+NtEnumerateKey@24
+NtEnumerateSystemEnvironmentValuesEx@12
+NtEnumerateTransactionObject@20
+NtEnumerateValueKey@24
+NtExtendSection@8
+NtFilterToken@24
+NtFindAtom@12
+NtFlushBuffersFile@8
+NtFlushInstallUILanguage@8
+NtFlushInstructionCache@12
+NtFlushKey@4
+NtFlushProcessWriteBuffers@0
+NtFlushVirtualMemory@16
+NtFlushWriteBuffer@0
+NtFreeUserPhysicalPages@12
+NtFreeVirtualMemory@16
+NtFreezeRegistry@4
+NtFreezeTransactions@8
+NtFsControlFile@40
+NtGetContextThread@8
+NtGetCurrentProcessorNumber@0
+NtGetDevicePowerState@8
+NtGetMUIRegistryInfo@12
+NtGetNextProcess@20
+NtGetNextThread@24
+NtGetNlsSectionPtr@20
+NtGetNotificationResourceManager@28
+NtGetPlugPlayEvent@16
+NtGetTickCount@0
+NtGetWriteWatch@28
+NtImpersonateAnonymousToken@4
+NtImpersonateClientOfPort@8
+NtImpersonateThread@12
+NtInitializeNlsFiles@16 ;Check!!! gendef says 12
+NtInitializeRegistry@4
+NtInitiatePowerAction@16
+NtIsProcessInJob@8
+NtIsSystemResumeAutomatic@0
+NtIsUILanguageComitted@0
+NtListenPort@8
+NtLoadDriver@4
+NtLoadKey2@12
+NtLoadKey@8
+NtLoadKeyEx@32
+NtLockFile@40
+NtLockProductActivationKeys@8
+NtLockRegistryKey@4
+NtLockVirtualMemory@16
+NtMakePermanentObject@4
+NtMakeTemporaryObject@4
+NtMapCMFModule@24
+NtMapUserPhysicalPages@12
+NtMapUserPhysicalPagesScatter@12
+NtMapViewOfSection@40
+NtModifyBootEntry@4
+NtModifyDriverEntry@4
+NtNotifyChangeDirectoryFile@36
+NtNotifyChangeKey@40
+NtNotifyChangeMultipleKeys@48
+NtNotifyChangeSession@32
+NtOpenDirectoryObject@12
+NtOpenEnlistment@20
+NtOpenEvent@12
+NtOpenEventPair@12
+NtOpenFile@24
+NtOpenIoCompletion@12
+NtOpenJobObject@12
+NtOpenKey@12
+NtOpenKeyEx@16
+NtOpenKeyTransacted@16
+NtOpenKeyTransactedEx@20
+NtOpenKeyedEvent@12
+NtOpenMutant@12
+NtOpenObjectAuditAlarm@48
+NtOpenPrivateNamespace@16
+NtOpenProcess@16
+NtOpenProcessToken@12
+NtOpenProcessTokenEx@16
+NtOpenResourceManager@20
+NtOpenSection@12
+NtOpenSemaphore@12
+NtOpenSession@12
+NtOpenSymbolicLinkObject@12
+NtOpenThread@16
+NtOpenThreadToken@16
+NtOpenThreadTokenEx@20
+NtOpenTimer@12
+NtOpenTransaction@20
+NtOpenTransactionManager@24
+NtPlugPlayControl@12
+NtPowerInformation@20
+NtPrePrepareComplete@8
+NtPrePrepareEnlistment@8
+NtPrepareComplete@8
+NtPrepareEnlistment@8
+NtPrivilegeCheck@12
+NtPrivilegeObjectAuditAlarm@24
+NtPrivilegedServiceAuditAlarm@20
+NtPropagationComplete@16
+NtPropagationFailed@12
+NtProtectVirtualMemory@20
+NtPulseEvent@8
+NtQueryAttributesFile@8
+NtQueryBootEntryOrder@8
+NtQueryBootOptions@8
+NtQueryDebugFilterState@8
+NtQueryDefaultLocale@8
+NtQueryDefaultUILanguage@4
+NtQueryDirectoryFile@44
+NtQueryDirectoryObject@28
+NtQueryDriverEntryOrder@8
+NtQueryEaFile@36
+NtQueryEvent@20
+NtQueryFullAttributesFile@8
+NtQueryInformationAtom@20
+NtQueryInformationEnlistment@20
+NtQueryInformationFile@20
+NtQueryInformationJobObject@20
+NtQueryInformationPort@20
+NtQueryInformationProcess@20
+NtQueryInformationResourceManager@20
+NtQueryInformationThread@20
+NtQueryInformationToken@20
+NtQueryInformationTransaction@20
+NtQueryInformationTransactionManager@20
+NtQueryInformationWorkerFactory@20
+NtQueryInstallUILanguage@4
+NtQueryIntervalProfile@8
+NtQueryIoCompletion@20
+NtQueryKey@20
+NtQueryLicenseValue@20
+NtQueryMultipleValueKey@24
+NtQueryMutant@20
+NtQueryObject@20
+NtQueryOpenSubKeys@8
+NtQueryOpenSubKeysEx@16
+NtQueryPerformanceCounter@8
+NtQueryPortInformationProcess@0
+NtQueryQuotaInformationFile@36
+NtQuerySection@20
+NtQuerySecurityAttributesToken@24
+NtQuerySecurityObject@20
+NtQuerySemaphore@20
+NtQuerySymbolicLinkObject@12
+NtQuerySystemEnvironmentValue@16
+NtQuerySystemEnvironmentValueEx@20
+NtQuerySystemInformation@16
+NtQuerySystemInformationEx@24
+NtQuerySystemTime@4
+NtQueryTimer@20
+NtQueryTimerResolution@12
+NtQueryValueKey@24
+NtQueryVirtualMemory@24
+NtQueryVolumeInformationFile@20
+NtQueueApcThread@20
+NtQueueApcThreadEx@24
+NtRaiseException@12
+NtRaiseHardError@24
+NtReadFile@36
+NtReadFileScatter@36
+NtReadOnlyEnlistment@8
+NtReadRequestData@24
+NtReadVirtualMemory@20
+NtRecoverEnlistment@8
+NtRecoverResourceManager@4
+NtRecoverTransactionManager@4
+NtRegisterProtocolAddressInformation@20
+NtRegisterThreadTerminatePort@4
+NtReleaseCMFViewOwnership@0
+NtReleaseKeyedEvent@16
+NtReleaseMutant@8
+NtReleaseSemaphore@12
+NtReleaseWorkerFactoryWorker@4
+NtRemoveIoCompletion@20
+NtRemoveIoCompletionEx@24
+NtRemoveProcessDebug@8
+NtRenameKey@8
+NtRenameTransactionManager@8
+NtReplaceKey@12
+NtReplacePartitionUnit@12
+NtReplyPort@8
+NtReplyWaitReceivePort@16
+NtReplyWaitReceivePortEx@20
+NtReplyWaitReplyPort@8
+NtRequestDeviceWakeup@4
+NtRequestPort@8
+NtRequestWaitReplyPort@12
+NtRequestWakeupLatency@4
+NtResetEvent@8
+NtResetWriteWatch@12
+NtRestoreKey@12
+NtResumeProcess@4
+NtResumeThread@8
+NtRollbackComplete@8
+NtRollbackEnlistment@8
+NtRollbackTransaction@8
+NtRollforwardTransactionManager@8
+NtSaveKey@8
+NtSaveKeyEx@12
+NtSaveMergedKeys@12
+NtSecureConnectPort@36
+NtSerializeBoot@0
+NtSetBootEntryOrder@8
+NtSetBootOptions@8
+NtSetContextThread@8
+NtSetDebugFilterState@12
+NtSetDefaultHardErrorPort@4
+NtSetDefaultLocale@8
+NtSetDefaultUILanguage@4
+NtSetDriverEntryOrder@8
+NtSetEaFile@16
+NtSetEvent@8
+NtSetEventBoostPriority@4
+NtSetHighEventPair@4
+NtSetHighWaitLowEventPair@4
+NtSetInformationDebugObject@20
+NtSetInformationEnlistment@16
+NtSetInformationFile@20
+NtSetInformationJobObject@16
+NtSetInformationKey@16
+NtSetInformationObject@16
+NtSetInformationProcess@16
+NtSetInformationResourceManager@16
+NtSetInformationThread@16
+NtSetInformationToken@16
+NtSetInformationTransaction@16
+NtSetInformationTransactionManager@16
+NtSetInformationWorkerFactory@16
+NtSetIntervalProfile@8
+NtSetIoCompletion@20
+NtSetIoCompletionEx@24
+NtSetLdtEntries@24
+NtSetLowEventPair@4
+NtSetLowWaitHighEventPair@4
+NtSetQuotaInformationFile@16
+NtSetSecurityObject@12
+NtSetSystemEnvironmentValue@8
+NtSetSystemEnvironmentValueEx@20
+NtSetSystemInformation@12
+NtSetSystemPowerState@12
+NtSetSystemTime@8
+NtSetThreadExecutionState@8
+NtSetTimer@28
+NtSetTimerEx@16
+NtSetTimerResolution@12
+NtSetUuidSeed@4
+NtSetValueKey@24
+NtSetVolumeInformationFile@20
+NtShutdownSystem@4
+NtShutdownWorkerFactory@8
+NtSignalAndWaitForSingleObject@16
+NtSinglePhaseReject@8
+NtStartProfile@4
+NtStopProfile@4
+NtSuspendProcess@4
+NtSuspendThread@8
+NtSystemDebugControl@24
+NtTerminateJobObject@8
+NtTerminateProcess@8
+NtTerminateThread@8
+NtTestAlert@0
+NtThawRegistry@0
+NtThawTransactions@0
+NtTraceControl@24
+NtTraceEvent@16
+NtTranslateFilePath@16
+NtUmsThreadYield@4
+NtUnloadDriver@4
+NtUnloadKey2@8
+NtUnloadKey@4
+NtUnloadKeyEx@8
+NtUnlockFile@20
+NtUnlockVirtualMemory@16
+NtUnmapViewOfSection@8
+NtVdmControl@8
+NtWaitForDebugEvent@16
+NtWaitForKeyedEvent@16
+NtWaitForMultipleObjects32@20
+NtWaitForMultipleObjects@20
+NtWaitForSingleObject@12
+NtWaitForWorkViaWorkerFactory@8
+NtWaitHighEventPair@4
+NtWaitLowEventPair@4
+NtWorkerFactoryWorkerReady@4
+NtWow64CallFunction64@28
+NtWow64CsrAllocateCaptureBuffer@8
+NtWow64CsrAllocateMessagePointer@12
+NtWow64CsrCaptureMessageBuffer@16
+NtWow64CsrCaptureMessageString@20
+NtWow64CsrClientCallServer@16
+NtWow64CsrClientConnectToServer@20
+NtWow64CsrFreeCaptureBuffer@4
+NtWow64CsrGetProcessId@0
+NtWow64CsrIdentifyAlertableThread@0
+NtWow64CsrVerifyRegion@8
+NtWow64DebuggerCall@20
+NtWow64GetCurrentProcessorNumberEx@4
+NtWow64GetNativeSystemInformation@16
+NtWow64InterlockedPopEntrySList@4
+NtWow64QueryInformationProcess64@20
+NtWow64QueryVirtualMemory64@32
+NtWow64ReadVirtualMemory64@28
+NtWow64WriteVirtualMemory64@28
+NtWriteFile@36
+NtWriteFileGather@36
+NtWriteRequestData@24
+NtWriteVirtualMemory@20
+NtYieldExecution@0
+; Not sure, but we assume here standard DefWindowProc arguments
+NtdllDefWindowProc_A@16
+NtdllDefWindowProc_W@16
+; Not sure, but we assume here standard DefDlgProc arguments
+NtdllDialogWndProc_A@16
+NtdllDialogWndProc_W@16
+PfxFindPrefix@8
+PfxInitialize@4
+PfxInsertPrefix@12
+PfxRemovePrefix@8
+RtlAbortRXact@4
+RtlAbsoluteToSelfRelativeSD@12
+RtlAcquirePebLock@0
+RtlAcquirePrivilege@16
+RtlAcquireReleaseSRWLockExclusive@4
+RtlAcquireResourceExclusive@8
+RtlAcquireResourceShared@8
+RtlAcquireSRWLockExclusive@4
+RtlAcquireSRWLockShared@4
+RtlActivateActivationContext@12
+RtlActivateActivationContextEx@16
+RtlAddAccessAllowedAce@16
+RtlAddAccessAllowedAceEx@20
+RtlAddAccessAllowedObjectAce@28
+RtlAddAccessDeniedAce@16
+RtlAddAccessDeniedAceEx@20
+RtlAddAccessDeniedObjectAce@28
+RtlAddAce@20
+RtlAddActionToRXact@24
+RtlAddAtomToAtomTable@12
+RtlAddAttributeActionToRXact@32
+RtlAddAuditAccessAce@24
+RtlAddAuditAccessAceEx@28
+RtlAddAuditAccessObjectAce@36
+RtlAddCompoundAce@24
+RtlAddIntegrityLabelToBoundaryDescriptor@8
+RtlAddMandatoryAce@24
+RtlAddRefActivationContext@4
+RtlAddRange@36
+RtlAddRefMemoryStream@4
+RtlAddSIDToBoundaryDescriptor@8
+RtlAddVectoredContinueHandler@8
+RtlAddVectoredExceptionHandler@8
+RtlAddressInSectionTable@12
+RtlAdjustPrivilege@16
+RtlAllocateActivationContextStack@4
+RtlAllocateAndInitializeSid@44
+RtlAllocateHandle@8
+RtlAllocateHeap@12
+RtlAllocateMemoryBlockLookaside@12
+RtlAllocateMemoryZone@12
+RtlAnsiCharToUnicodeChar@4
+RtlAnsiStringToUnicodeSize@4
+RtlAnsiStringToUnicodeString@12
+RtlAppendAsciizToString@8
+RtlAppendPathElement@12
+RtlAppendStringToString@8
+RtlAppendUnicodeStringToString@8
+RtlAppendUnicodeToString@8
+RtlApplicationVerifierStop@40
+RtlApplyRXact@4
+RtlApplyRXactNoFlush@4
+RtlAreAllAccessesGranted@8
+RtlAreAnyAccessesGranted@8
+RtlAreBitsClear@12
+RtlAreBitsSet@12
+RtlAssert@16
+RtlBarrier@8
+RtlBarrierForDelete@8
+RtlCallbackLpcClient@12
+RtlCancelTimer@8
+RtlCaptureContext@4
+RtlCaptureStackBackTrace@16
+RtlCaptureStackContext@12
+RtlCharToInteger@12
+RtlCheckForOrphanedCriticalSections@4
+RtlCheckRegistryKey@8
+RtlCleanUpTEBLangLists@0
+RtlClearAllBits@4
+RtlClearBits@12
+RtlCloneMemoryStream@8
+RtlCloneUserProcess@20
+RtlCmDecodeMemIoResource@8
+RtlCmEncodeMemIoResource@24
+RtlCommitDebugInfo@8
+RtlCommitMemoryStream@8
+RtlCompactHeap@8
+RtlCompareAltitudes@8
+RtlCompareMemory@12
+RtlCompareMemoryUlong@12
+RtlCompareString@12
+RtlCompareUnicodeString@12
+RtlCompareUnicodeStrings@20
+RtlCompressBuffer@32
+RtlComputeCrc32@12
+RtlComputeImportTableHash@12
+RtlComputePrivatizedDllName_U@12
+RtlConnectToSm@16
+RtlConsoleMultiByteToUnicodeN@24
+RtlContractHashTable@4
+RtlConvertExclusiveToShared@4
+RtlConvertLCIDToString@20
+RtlConvertLongToLargeInteger@4
+RtlConvertSharedToExclusive@4
+RtlConvertSidToUnicodeString@12
+RtlConvertToAutoInheritSecurityObject@24
+RtlConvertUiListToApiList@12
+RtlConvertUlongToLargeInteger@4
+RtlCopyExtendedContext@12
+RtlCopyLuid@8
+RtlCopyLuidAndAttributesArray@12
+RtlCopyMappedMemory@12
+RtlCopyMemoryStreamTo@24
+RtlCopyOutOfProcessMemoryStreamTo@24
+RtlCopyRangeList@8
+RtlCopySecurityDescriptor@8
+RtlCopySid@12
+RtlCopySidAndAttributesArray@28
+RtlCopyString@8
+RtlCopyUnicodeString@8
+RtlCreateAcl@12
+RtlCreateActivationContext@24
+RtlCreateAndSetSD@20
+RtlCreateAtomTable@8
+RtlCreateBootStatusDataFile@4
+RtlCreateBoundaryDescriptor@8
+RtlCreateEnvironment@8
+RtlCreateEnvironmentEx@12
+RtlCreateHashTable@12
+RtlCreateHeap@24
+RtlCreateLpcServer@24
+RtlCreateMemoryBlockLookaside@20
+RtlCreateMemoryZone@12
+RtlCreateProcessParameters@40
+RtlCreateProcessParametersEx@44
+RtlCreateProcessReflection@24
+RtlCreateQueryDebugBuffer@8
+RtlCreateRegistryKey@8
+RtlCreateSecurityDescriptor@8
+RtlCreateServiceSid@12
+RtlCreateSystemVolumeInformationFolder@4
+RtlCreateTagHeap@16
+RtlCreateTimer@28
+RtlCreateTimerQueue@4
+RtlCreateUnicodeString@8
+RtlCreateUnicodeStringFromAsciiz@8
+RtlCreateUserProcess@40
+RtlCreateUserSecurityObject@28
+RtlCreateUserStack@24
+RtlCreateUserThread@40
+RtlCreateVirtualAccountSid@16
+RtlCultureNameToLCID@8
+RtlCustomCPToUnicodeN@24
+RtlCutoverTimeToSystemTime@16
+RtlDeCommitDebugInfo@12
+RtlDeNormalizeProcessParams@4
+RtlDeactivateActivationContext@8
+RtlDebugPrintTimes@0
+RtlDecodePointer@4
+RtlDecodeSystemPointer@4
+RtlDecompressBuffer@24
+RtlDecompressFragment@32
+RtlDefaultNpAcl@4
+RtlDelete@4
+RtlDeleteAce@8
+RtlDeleteAtomFromAtomTable@8
+RtlDeleteBarrier@4
+RtlDeleteBoundaryDescriptor@4
+RtlDeleteCriticalSection@4
+RtlDeleteElementGenericTable@8
+RtlDeleteElementGenericTableAvl@8
+RtlDeleteHashTable@4
+RtlDeleteNoSplay@8
+RtlDeleteOwnersRanges@8
+RtlDeleteRange@24
+RtlDeleteRegistryValue@12
+RtlDeleteResource@4
+RtlDeleteSecurityObject@4
+RtlDeleteTimer@12
+RtlDeleteTimerQueue@4
+RtlDeleteTimerQueueEx@8
+RtlDeNormalizeProcessParams@4
+RtlDeregisterSecureMemoryCacheCallback@4
+RtlDeregisterWait@4
+RtlDeregisterWaitEx@8
+RtlDestroyAtomTable@4
+RtlDestroyEnvironment@4
+RtlDestroyHandleTable@4
+RtlDestroyHeap@4
+RtlDestroyMemoryBlockLookaside@4
+RtlDestroyMemoryZone@4
+RtlDestroyProcessParameters@4
+RtlDestroyQueryDebugBuffer@4
+RtlDetectHeapLeaks@0
+RtlDetermineDosPathNameType_U@4
+RtlDisableThreadProfiling@4
+RtlDllShutdownInProgress@0
+RtlDnsHostNameToComputerName@12
+RtlDoesFileExists_U@4
+RtlDosApplyFileIsolationRedirection_Ustr@36
+RtlDosPathNameToNtPathName_U@16
+RtlDosPathNameToNtPathName_U_WithStatus@16
+RtlDosPathNameToRelativeNtPathName_U@16
+RtlDosPathNameToRelativeNtPathName_U_WithStatus@16
+RtlDosSearchPath_U@24
+RtlDosSearchPath_Ustr@36
+RtlDowncaseUnicodeChar@4
+RtlDowncaseUnicodeString@12
+RtlDumpResource@4
+RtlDuplicateUnicodeString@12
+RtlEmptyAtomTable@8
+RtlEnableEarlyCriticalSectionEventCreation@0
+RtlEnableThreadProfiling@20
+RtlEncodePointer@4
+RtlEncodeSystemPointer@4
+RtlEndEnumerationHashTable@8
+RtlEndWeakEnumerationHashTable@8
+RtlEnlargedIntegerMultiply@8
+RtlEnlargedUnsignedDivide@16
+RtlEnlargedUnsignedMultiply@8
+RtlEnterCriticalSection@4
+RtlEnumProcessHeaps@8
+RtlEnumerateEntryHashTable@8
+RtlEnumerateGenericTable@8
+RtlEnumerateGenericTableAvl@8
+RtlEnumerateGenericTableLikeADirectory@28
+RtlEnumerateGenericTableWithoutSplaying@8
+RtlEnumerateGenericTableWithoutSplayingAvl@8
+RtlEqualComputerName@8
+RtlEqualDomainName@8
+RtlEqualLuid@8
+RtlEqualPrefixSid@8
+RtlEqualSid@8
+RtlEqualString@12
+RtlEqualUnicodeString@12
+RtlEraseUnicodeString@4
+RtlEthernetAddressToStringA@8
+RtlEthernetAddressToStringW@8
+RtlEthernetStringToAddressA@12
+RtlEthernetStringToAddressW@12
+RtlExitUserProcess@4
+; Not sure, but we assume @4
+RtlExitUserThread@4
+RtlExpandEnvironmentStrings@24
+RtlExpandEnvironmentStrings_U@16
+RtlExpandHashTable@4
+RtlExtendMemoryBlockLookaside@8
+RtlExtendMemoryZone@8
+RtlExtendedIntegerMultiply@12
+RtlExtendedLargeIntegerDivide@16
+RtlExtendedMagicDivide@20
+RtlExtendHeap@16
+RtlFillMemory@12
+RtlFillMemoryUlong@12
+RtlFillMemoryUlonglong@16
+RtlFinalReleaseOutOfProcessMemoryStream@4
+RtlFindAceByType@12
+RtlFindActivationContextSectionGuid@20
+RtlFindActivationContextSectionString@20
+RtlFindCharInUnicodeString@16
+RtlFindClearBits@12
+RtlFindClearBitsAndSet@12
+RtlFindClearRuns@16
+RtlFindClosestEncodableLength@12
+RtlFindLastBackwardRunClear@12
+RtlFindLeastSignificantBit@8
+RtlFindLongestRunClear@8
+RtlFindLongestRunSet@8
+RtlFindMessage@20
+RtlFindMostSignificantBit@8
+RtlFindNextForwardRunClear@12
+RtlFindRange@48
+RtlFindSetBits@12
+RtlFindSetBitsAndClear@12
+RtlFirstEntrySList@4
+RtlFirstFreeAce@8
+RtlFlsAlloc@8
+RtlFlsFree@4
+RtlFlushSecureMemoryCache@8
+RtlFormatCurrentUserKeyPath@4
+RtlFormatMessage@36
+RtlFormatMessageEx@40
+RtlFreeActivationContextStack@4
+RtlFreeAnsiString@4
+RtlFreeHandle@8
+RtlFreeHeap@12
+RtlFreeMemoryBlockLookaside@8
+RtlFreeOemString@4
+RtlFreeSid@4
+RtlFreeThreadActivationContextStack@0
+RtlFreeUnicodeString@4
+RtlFreeUserStack@4
+RtlFreeUserThreadStack@8
+RtlGUIDFromString@8
+RtlGenerate8dot3Name@16
+RtlGetAce@12
+RtlGetActiveActivationContext@4
+RtlGetCallersAddress@8
+RtlGetCompressionWorkSpaceSize@12
+RtlGetControlSecurityDescriptor@12
+RtlGetCriticalSectionRecursionCount@4
+RtlGetCurrentDirectory_U@8
+RtlGetCurrentPeb@0
+RtlGetCurrentProcessorNumber@0
+RtlGetCurrentProcessorNumberEx@4
+RtlGetCurrentTransaction@0
+RtlGetDaclSecurityDescriptor@16
+RtlGetElementGenericTable@8
+RtlGetElementGenericTableAvl@8
+RtlGetEnabledExtendedFeatures@8
+RtlGetExtendedContextLength@8
+RtlGetExtendedFeaturesMask@4
+RtlGetFileMUIPath@28
+RtlGetFirstRange@12
+RtlGetFrame@0
+RtlGetFullPathName_U@16
+RtlGetFullPathName_UEx@20
+RtlGetFullPathName_UstrEx@32
+RtlGetGroupSecurityDescriptor@12
+RtlGetIntegerAtom@8
+RtlGetLastNtStatus@0
+RtlGetLastWin32Error@0
+RtlGetLengthWithoutLastFullDosOrNtPathElement@12
+RtlGetLengthWithoutTrailingPathSeperators@12
+RtlGetLocaleFileMappingAddress@12
+RtlGetLongestNtPathLength@0
+RtlGetNativeSystemInformation@16
+RtlGetNextRange@12
+RtlGetNextEntryHashTable@8
+RtlGetNtGlobalFlags@0
+RtlGetNtProductType@4
+RtlGetNtVersionNumbers@12
+RtlGetOwnerSecurityDescriptor@12
+RtlGetParentLocaleName@16
+RtlGetProcessHeaps@8
+RtlGetProcessPreferredUILanguages@16
+RtlGetProductInfo@20
+RtlGetSaclSecurityDescriptor@16
+RtlGetSecurityDescriptorRMControl@8
+RtlGetSetBootStatusData@24
+RtlGetSystemPreferredUILanguages@20
+RtlGetThreadErrorMode@0
+RtlGetThreadLangIdByIndex@16
+RtlGetThreadPreferredUILanguages@16
+RtlGetUILanguageInfo@20
+RtlGetUnloadEventTrace@0
+RtlGetUnloadEventTraceEx@12
+RtlGetUserInfoHeap@20
+RtlGetUserPreferredUILanguages@20
+RtlGetVersion@4
+RtlGUIDFromString@8
+RtlHashUnicodeString@16
+RtlHeapTrkInitialize@4
+RtlIdentifierAuthoritySid@4
+RtlIdnToAscii@20
+RtlIdnToNameprepUnicode@20
+RtlIdnToUnicode@20
+RtlImageDirectoryEntryToData@16
+RtlImageNtHeader@4
+RtlImageNtHeaderEx@20
+RtlImageRvaToSection@12
+RtlImageRvaToVa@16
+RtlImpersonateLpcClient@8
+RtlImpersonateSelf@4
+RtlImpersonateSelfEx@12
+RtlInitAnsiString@8
+RtlInitAnsiStringEx@8
+RtlInitBarrier@12
+RtlInitCodePageTable@8
+RtlInitEnumerationHashTable@8
+RtlInitMemoryStream@4
+RtlInitNlsTables@16
+RtlInitOutOfProcessMemoryStream@4
+RtlInitString@8
+RtlInitUnicodeString@8
+RtlInitUnicodeStringEx@8
+RtlInitWeakEnumerationHashTable@8
+RtlInitializeAtomPackage@4
+RtlInitializeBitMap@12
+RtlInitializeConditionVariable@4
+RtlInitializeContext@20
+RtlInitializeCriticalSection@4
+RtlInitializeCriticalSectionAndSpinCount@8
+RtlInitializeCriticalSectionEx@12
+RtlInitializeExceptionChain@4
+RtlInitializeExtendedContext@12
+RtlInitializeGenericTable@20
+RtlInitializeGenericTableAvl@20
+RtlInitializeHandleTable@12
+RtlInitializeNtUserPfn@24
+RtlInitializeRXact@12
+RtlInitializeResource@4
+RtlInitializeSListHead@4
+RtlInitializeSRWLock@4
+RtlInitializeSid@12
+RtlInsertElementGenericTable@16
+RtlInsertElementGenericTableAvl@16
+RtlInsertElementGenericTableFull@24
+RtlInsertElementGenericTableFullAvl@24
+RtlInsertEntryHashTable@16
+RtlInt64ToUnicodeString@16
+RtlIntegerToChar@16
+RtlIntegerToUnicodeString@12
+RtlInterlockedClearBitRun@12
+RtlInterlockedCompareExchange64@20
+RtlInterlockedFlushSList@4
+RtlInterlockedPopEntrySList@4
+RtlInterlockedPushEntrySList@8
+RtlInvertRangeList@8
+RtlInterlockedSetBitRun@12
+RtlIoDecodeMemIoResource@16
+RtlIoEncodeMemIoResource@40
+RtlIpv4AddressToStringA@8
+RtlIpv4AddressToStringExA@16
+RtlIpv4AddressToStringExW@16
+RtlIpv4AddressToStringW@8
+RtlIpv4StringToAddressA@16
+RtlIpv4StringToAddressExA@16
+RtlIpv4StringToAddressExW@16
+RtlIpv4StringToAddressW@16
+RtlIpv6AddressToStringA@8
+RtlIpv6AddressToStringExA@20
+RtlIpv6AddressToStringExW@20
+RtlIpv6AddressToStringW@8
+RtlIpv6StringToAddressA@12
+RtlIpv6StringToAddressExA@16
+RtlIpv6StringToAddressExW@16
+RtlIpv6StringToAddressW@12
+RtlIsActivationContextActive@4
+RtlIsCriticalSectionLocked@4
+RtlIsCriticalSectionLockedByThread@4
+RtlIsCurrentThreadAttachExempt@0
+RtlIsDosDeviceName_U@4
+RtlIsGenericTableEmpty@4
+RtlIsGenericTableEmptyAvl@4
+RtlIsNameInExpression@16
+RtlIsNameLegalDOS8Dot3@12
+RtlIsNormalizedString@16
+RtlIsRangeAvailable@40
+RtlIsTextUnicode@12
+RtlIsThreadWithinLoaderCallout@0
+RtlIsValidHandle@8
+RtlIsValidIndexHandle@12
+RtlIsValidLocaleName@8
+RtlKnownExceptionFilter@4
+RtlLCIDToCultureName@8
+RtlLargeIntegerAdd@16
+RtlLargeIntegerArithmeticShift@12
+RtlLargeIntegerDivide@20
+RtlLargeIntegerNegate@8
+RtlLargeIntegerShiftLeft@12
+RtlLargeIntegerShiftRight@12
+RtlLargeIntegerSubtract@16
+RtlLargeIntegerToChar@16
+RtlLcidToLocaleName@16
+RtlLeaveCriticalSection@4
+RtlLengthRequiredSid@4
+RtlLengthSecurityDescriptor@4
+RtlLengthSid@4
+RtlLoadString@32
+RtlLocalTimeToSystemTime@8
+RtlLocaleNameToLcid@12
+RtlLocateExtendedFeature@12
+RtlLocateLegacyContext@8
+RtlLockBootStatusData@4
+RtlLockCurrentThread@0
+RtlLockHeap@4
+RtlLockMemoryBlockLookaside@4
+RtlLockMemoryStreamRegion@24
+RtlLockMemoryZone@4
+RtlLockModuleSection@4
+RtlLogStackBackTrace@0
+RtlLookupAtomInAtomTable@12
+RtlLookupElementGenericTable@8
+RtlLookupElementGenericTableAvl@8
+RtlLookupElementGenericTableFull@16
+RtlLookupElementGenericTableFullAvl@16
+RtlLookupEntryHashTable@12
+RtlMakeSelfRelativeSD@12
+RtlMapGenericMask@8
+RtlMapSecurityErrorToNtStatus@4
+RtlMergeRangeLists@16
+RtlMoveMemory@12
+RtlMultiAppendUnicodeStringBuffer@12
+RtlMultiByteToUnicodeN@20
+RtlMultiByteToUnicodeSize@12
+RtlMultipleAllocateHeap@20
+RtlMultipleFreeHeap@16
+RtlNewInstanceSecurityObject@40
+RtlNewSecurityGrantedAccess@24
+RtlNewSecurityObject@24
+RtlNewSecurityObjectEx@32
+RtlNewSecurityObjectWithMultipleInheritance@36
+RtlNormalizeProcessParams@4
+RtlNormalizeString@20
+RtlNtPathNameToDosPathName@16
+RtlNtStatusToDosError@4
+RtlNtStatusToDosErrorNoTeb@4
+RtlNumberGenericTableElements@4
+RtlNumberGenericTableElementsAvl@4
+RtlNumberOfClearBits@4
+RtlNumberOfSetBits@4
+RtlNumberOfSetBitsUlongPtr@4
+RtlOemStringToUnicodeSize@4
+RtlOemStringToUnicodeString@12
+RtlOemToUnicodeN@20
+RtlOpenCurrentUser@8
+RtlOwnerAcesPresent@4
+RtlPcToFileHeader@8
+RtlPinAtomInAtomTable@8
+RtlPopFrame@4
+RtlPrefixString@12
+RtlPrefixUnicodeString@12
+RtlProcessFlsData@4
+RtlProtectHeap@8
+RtlPushFrame@4
+RtlQueryActivationContextApplicationSettings@28
+RtlQueryAtomInAtomTable@24
+RtlQueryCriticalSectionOwner@4
+RtlQueryDepthSList@4
+RtlQueryDynamicTimeZoneInformation@4
+RtlQueryElevationFlags@4
+RtlQueryEnvironmentVariable@24
+RtlQueryEnvironmentVariable_U@12
+RtlQueryHeapInformation@20
+RtlQueryInformationAcl@16
+RtlQueryInformationActivationContext@28
+RtlQueryInformationActiveActivationContext@16
+RtlQueryInterfaceMemoryStream@12
+RtlQueryModuleInformation@12
+RtlQueryPerformanceCounter@4
+RtlQueryPerformanceFrequency@4
+RtlQueryProcessBackTraceInformation@4
+RtlQueryProcessDebugInformation@12
+RtlQueryProcessHeapInformation@4
+RtlQueryProcessLockInformation@4
+RtlQueryRegistryValues@20
+RtlQuerySecurityObject@20
+RtlQueryTagHeap@20
+RtlQueryThreadProfiling@8
+RtlQueryTimeZoneInformation@4
+RtlQueueApcWow64Thread@20
+RtlQueueWorkItem@12
+RtlRaiseException@4
+RtlRaiseStatus@4
+RtlRandom@4
+RtlRandomEx@4
+RtlReAllocateHeap@16
+RtlReadMemoryStream@16
+RtlReadOutOfProcessMemoryStream@16
+RtlReadThreadProfilingData@12
+RtlRealPredecessor@4
+RtlRealSuccessor@4
+RtlRegisterSecureMemoryCacheCallback@4
+RtlRegisterThreadWithCsrss@0
+RtlRegisterWait@24
+RtlReleaseActivationContext@4
+RtlReleaseMemoryStream@4
+RtlReleasePebLock@0
+RtlReleasePrivilege@4
+RtlReleaseRelativeName@4
+RtlReleaseResource@4
+RtlReleaseSRWLockExclusive@4
+RtlReleaseSRWLockShared@4
+RtlRemoteCall@28
+RtlRemoveEntryHashTable@12
+RtlRemovePrivileges@12
+RtlRemoveVectoredContinueHandler@4
+RtlRemoveVectoredExceptionHandler@4
+RtlReplaceSidInSd@16
+RtlReportException@12
+RtlReportSilentProcessExit@8
+RtlReportSqmEscalation@24
+RtlResetMemoryBlockLookaside@4
+RtlResetMemoryZone@4
+RtlResetRtlTranslations@4
+RtlRestoreLastWin32Error@4
+RtlRetrieveNtUserPfn@12
+RtlRevertMemoryStream@4
+RtlRunDecodeUnicodeString@8
+RtlRunEncodeUnicodeString@8
+RtlRunOnceBeginInitialize@12
+RtlRunOnceComplete@12
+RtlRunOnceExecuteOnce@16
+RtlRunOnceInitialize@4
+RtlSecondsSince1970ToTime@8
+RtlSecondsSince1980ToTime@8
+RtlSeekMemoryStream@20
+RtlSelfRelativeToAbsoluteSD2@8
+RtlSelfRelativeToAbsoluteSD@44
+RtlSendMsgToSm@8
+RtlSetAllBits@4
+RtlSetAttributesSecurityDescriptor@12
+RtlSetBits@12
+RtlSetControlSecurityDescriptor@12
+RtlSetCriticalSectionSpinCount@8
+RtlSetCurrentDirectory_U@4
+RtlSetCurrentEnvironment@8
+RtlSetCurrentTransaction@4
+RtlSetDaclSecurityDescriptor@16
+RtlSetDynamicTimeZoneInformation@4
+RtlSetEnvironmentStrings@8
+RtlSetEnvironmentVar@20
+RtlSetEnvironmentVariable@12
+RtlSetExtendedFeaturesMask@12
+RtlSetGroupSecurityDescriptor@12
+RtlSetHeapInformation@16
+RtlSetInformationAcl@16
+RtlSetIoCompletionCallback@12
+RtlSetLastWin32Error@4
+RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
+RtlSetMemoryStreamSize@12
+RtlSetOwnerSecurityDescriptor@12
+RtlSetProcessDebugInformation@12
+RtlSetProcessIsCritical@0
+RtlSetProcessPreferredUILanguages@12
+RtlSetSaclSecurityDescriptor@16
+RtlSetSecurityDescriptorRMControl@8
+RtlSetSecurityObject@20
+RtlSetSecurityObjectEx@24
+RtlSetThreadErrorMode@8
+RtlSetThreadIsCritical@0
+RtlSetThreadPoolStartFunc@8
+RtlSetThreadPreferredUILanguages@12
+RtlSetTimeZoneInformation@4
+RtlSetTimer@28
+RtlSetUnhandledExceptionFilter@4
+RtlSetUserCallbackExceptionFilter@4
+RtlSetUserFlagsHeap@20
+RtlSetUserValueHeap@16
+RtlShutdownLpcServer@4
+RtlSidDominates@12
+RtlSidEqualLevel@12
+RtlSidHashInitialize@12
+RtlSidHashLookup@8
+RtlSidIsHigherLevel@12
+RtlSizeHeap@12
+RtlSleepConditionVariableCS@12
+RtlSleepConditionVariableSRW@16
+RtlSplay@4
+RtlStartRXact@4
+RtlStatMemoryStream@12
+RtlStringFromGUID@8
+RtlSubAuthorityCountSid@4
+RtlSubAuthoritySid@8
+RtlSubtreePredecessor@4
+RtlSubtreeSuccessor@4
+RtlSystemTimeToLocalTime@8
+RtlTestBit@8
+RtlTimeFieldsToTime@8
+RtlTimeToElapsedTimeFields@8
+RtlTimeToSecondsSince1970@8
+RtlTimeToSecondsSince1980@8
+RtlTimeToTimeFields@8
+RtlTraceDatabaseAdd@16
+RtlTraceDatabaseCreate@20
+RtlTraceDatabaseDestroy@4
+RtlTraceDatabaseEnumerate@12
+RtlTraceDatabaseFind@16
+RtlTraceDatabaseLock@4
+RtlTraceDatabaseUnlock@4
+RtlTraceDatabaseValidate@4
+RtlTryAcquirePebLock@0
+RtlTryAcquireSRWLockExclusive@4
+RtlTryAcquireSRWLockShared@4
+RtlTryEnterCriticalSection@4
+RtlUTF8ToUnicodeN@20
+RtlUnhandledExceptionFilter2@8
+RtlUnhandledExceptionFilter@4
+RtlUnicodeStringToAnsiSize@4
+RtlUnicodeStringToAnsiString@12
+RtlUnicodeStringToCountedOemString@12
+RtlUnicodeStringToInteger@12
+RtlUnicodeStringToOemSize@4
+RtlUnicodeStringToOemString@12
+RtlUnicodeToCustomCPN@24
+RtlUnicodeToMultiByteN@20
+RtlUnicodeToMultiByteSize@12
+RtlUnicodeToOemN@20
+RtlUnicodeToUTF8N@20
+RtlUniform@4
+RtlUnlockBootStatusData@4
+RtlUnlockCurrentThread@0
+RtlUnlockHeap@4
+RtlUnlockMemoryBlockLookaside@4
+RtlUnlockMemoryStreamRegion@24
+RtlUnlockMemoryZone@4
+RtlUnlockModuleSection@4
+RtlUnwind@16
+RtlUpcaseUnicodeChar@4
+RtlUpcaseUnicodeString@12
+RtlUpcaseUnicodeStringToAnsiString@12
+RtlUpcaseUnicodeStringToCountedOemString@12
+RtlUpcaseUnicodeStringToOemString@12
+RtlUpcaseUnicodeToCustomCPN@24
+RtlUpcaseUnicodeToMultiByteN@20
+RtlUpcaseUnicodeToOemN@20
+RtlUpdateClonedCriticalSection@4
+RtlUpdateClonedSRWLock@8
+RtlUpdateTimer@16
+RtlUpperChar@4
+RtlUpperString@8
+RtlUsageHeap@12
+; Not sure.
+RtlUserThreadStart
+RtlValidAcl@4
+RtlValidRelativeSecurityDescriptor@12
+RtlValidSecurityDescriptor@4
+RtlValidSid@4
+RtlValidateHeap@12
+RtlValidateProcessHeaps@0
+RtlValidateUnicodeString@8
+RtlVerifyVersionInfo@16
+RtlWakeAllConditionVariable@4
+RtlWakeConditionVariable@4
+RtlWalkFrameChain@12
+RtlWalkHeap@8
+RtlWeaklyEnumerateEntryHashTable@8
+RtlWerpReportException@16
+RtlWow64CallFunction64@28
+RtlWow64EnableFsRedirection@4
+RtlWow64EnableFsRedirectionEx@8
+RtlWow64LogMessageInEventLogger@12
+RtlWriteMemoryStream@16
+RtlWriteRegistryValue@24
+RtlZeroHeap@8
+RtlZeroMemory@8
+RtlZombifyActivationContext@4
+RtlpApplyLengthFunction@16
+RtlpCheckDynamicTimeZoneInformation@8
+RtlpCleanupRegistryKeys@0
+RtlpConvertCultureNamesToLCIDs@8
+RtlpConvertLCIDsToCultureNames@8
+RtlpCreateProcessRegistryInfo@4
+RtlpEnsureBufferSize@12
+RtlpGetLCIDFromLangInfoNode@12
+RtlpGetNameFromLangInfoNode@12
+RtlpGetSystemDefaultUILanguage@4 ; Check!!! gendef says @8
+RtlpGetUserOrMachineUILanguage4NLS@12
+RtlpInitializeLangRegistryInfo@4
+RtlpIsQualifiedLanguage@12
+RtlpLoadMachineUIByPolicy@12
+RtlpLoadUserUIByPolicy@12
+RtlpMuiFreeLangRegistryInfo@4
+RtlpMuiRegCreateRegistryInfo@0
+RtlpMuiRegFreeRegistryInfo@8
+RtlpMuiRegLoadRegistryInfo@8
+RtlpNotOwnerCriticalSection@0 ; Check!!! gebdef says @4
+RtlpNtCreateKey@24
+RtlpNtEnumerateSubKey@16
+RtlpNtMakeTemporaryKey@4
+RtlpNtOpenKey@16
+RtlpNtQueryValueKey@20
+RtlpNtSetValueKey@16
+RtlpQueryDefaultUILanguage@8
+; Not sure.
+RtlpQueryProcessDebugInformationRemote
+RtlpRefreshCachedUILanguage@8
+RtlpSetInstallLanguage@8
+RtlpSetPreferredUILanguages@12
+RtlpSetUserPreferredUILanguages@12
+RtlpUnWaitCriticalSection@4
+RtlpVerifyAndCommitUILanguageSettings@4
+RtlpWaitForCriticalSection@4
+RtlxAnsiStringToUnicodeSize@4
+RtlxOemStringToUnicodeSize@4
+RtlxUnicodeStringToAnsiSize@4
+RtlxUnicodeStringToOemSize@4
+SbExecuteProcedure@20
+SbSelectProcedure@16
+ShipAssert@8
+ShipAssertGetBufferInfo@8
+ShipAssertMsgA@12
+ShipAssertMsgW@12
+TpAllocAlpcCompletion@20
+TpAllocAlpcCompletionEx@20
+TpAllocCleanupGroup@4
+TpAllocIoCompletion@20
+TpAllocPool@8
+TpAllocTimer@16
+TpAllocWait@16
+TpAllocWork@16
+TpAlpcRegisterCompletionList@4
+TpAlpcUnregisterCompletionList@4
+TpCallbackIndependent@4
+TpCallbackLeaveCriticalSectionOnCompletion@8
+TpCallbackMayRunLong@4
+TpCallbackReleaseMutexOnCompletion@8
+TpCallbackReleaseSemaphoreOnCompletion@12
+TpCallbackSetEventOnCompletion@8
+TpCallbackUnloadDllOnCompletion@8
+TpCancelAsyncIoOperation@4
+TpCaptureCaller@4
+TpCheckTerminateWorker@4
+TpDbgDumpHeapUsage@12
+TpDbgGetFreeInfo@8
+TpDbgSetLogRoutine@4
+TpDisablePoolCallbackChecks@4
+TpDisassociateCallback@4
+TpIsTimerSet@4
+TpPoolFreeUnusedNodes@4
+TpPostWork@4
+TpQueryPoolStackInformation@8
+TpReleaseAlpcCompletion@4
+TpReleaseCleanupGroup@4
+TpReleaseCleanupGroupMembers@12
+TpReleaseIoCompletion@4
+TpReleasePool@4
+TpReleaseTimer@4
+TpReleaseWait@4
+TpReleaseWork@4
+TpSetDefaultPoolMaxThreads@4
+TpSetDefaultPoolStackInformation@4
+TpSetPoolMaxThreads@8
+TpSetPoolMinThreads@8
+TpSetPoolStackInformation@8
+TpSetTimer@16
+TpSetWait@12
+TpSimpleTryPost@12
+TpStartAsyncIoOperation@4
+TpWaitForAlpcCompletion@4
+TpWaitForIoCompletion@8
+TpWaitForTimer@8
+TpWaitForWait@8
+TpWaitForWork@8
+VerSetConditionMask@16
+WerCheckEventEscalation@8
+WerReportSQMEvent@12
+WerReportWatsonEvent@16
+WerReportSQMEvent@16
+WinSqmAddToAverageDWORD@12
+WinSqmAddToStream@16
+WinSqmAddToStreamEx@20
+WinSqmCheckEscalationAddToStreamEx@20
+WinSqmCheckEscalationSetDWORD64@20
+WinSqmCheckEscalationSetDWORD@16
+WinSqmCheckEscalationSetString@16
+WinSqmCommonDatapointDelete@4
+WinSqmCommonDatapointSetDWORD64@16
+WinSqmCommonDatapointSetDWORD@12
+WinSqmCommonDatapointSetStreamEx@20
+WinSqmCommonDatapointSetString@12
+WinSqmEndSession@4
+WinSqmEventEnabled@8
+WinSqmEventWrite@12
+WinSqmGetEscalationRuleStatus@8
+WinSqmGetInstrumentationProperty@16
+WinSqmIncrementDWORD@12
+WinSqmIsOptedIn@0
+WinSqmIsOptedInEx@4
+WinSqmSetDWORD64@16
+WinSqmSetDWORD@12
+WinSqmSetEscalationInfo@16
+WinSqmSetIfMaxDWORD@12
+WinSqmSetIfMinDWORD@12
+WinSqmSetString@12
+WinSqmStartSession@12
+ZwAcceptConnectPort@24
+ZwAccessCheck@32
+ZwAccessCheckAndAuditAlarm@44
+ZwAccessCheckByType@44
+ZwAccessCheckByTypeAndAuditAlarm@64
+ZwAccessCheckByTypeResultList@44
+ZwAccessCheckByTypeResultListAndAuditAlarm@64
+ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
+ZwAcquireCMFViewOwnership@12
+ZwAddAtom@12
+ZwAddBootEntry@8
+ZwAddDriverEntry@8
+ZwAdjustGroupsToken@24
+ZwAdjustPrivilegesToken@24
+ZwAlertResumeThread@8
+ZwAlertThread@4
+ZwAllocateLocallyUniqueId@4
+ZwAllocateReserveObject@12
+ZwAllocateUserPhysicalPages@12
+ZwAllocateUuids@16
+ZwAllocateVirtualMemory@24
+ZwAlpcAcceptConnectPort@36
+ZwAlpcCancelMessage@12
+ZwAlpcConnectPort@44
+ZwAlpcCreatePort@12
+ZwAlpcCreatePortSection@24
+ZwAlpcCreateResourceReserve@16
+ZwAlpcCreateSectionView@12
+ZwAlpcCreateSecurityContext@12
+ZwAlpcDeletePortSection@12
+ZwAlpcDeleteResourceReserve@12
+ZwAlpcDeleteSectionView@12
+ZwAlpcDeleteSecurityContext@12
+ZwAlpcDisconnectPort@8
+ZwAlpcImpersonateClientOfPort@12
+ZwAlpcOpenSenderProcess@24
+ZwAlpcOpenSenderThread@24
+ZwAlpcQueryInformation@20
+ZwAlpcQueryInformationMessage@24
+ZwAlpcRevokeSecurityContext@12
+ZwAlpcSendWaitReceivePort@32
+ZwAlpcSetInformation@16
+ZwApphelpCacheControl@8
+ZwAreMappedFilesTheSame@8
+ZwAssignProcessToJobObject@8
+ZwCallbackReturn@12
+ZwCancelDeviceWakeupRequest@4
+ZwCancelIoFile@8
+ZwCancelIoFileEx@12
+ZwCancelSynchronousIoFile@12
+ZwCancelTimer@8
+ZwClearEvent@4
+ZwClose@4
+ZwCloseObjectAuditAlarm@12
+ZwCommitComplete@8
+ZwCommitEnlistment@8
+ZwCommitTransaction@8
+ZwCompactKeys@8
+ZwCompareTokens@12
+ZwCompleteConnectPort@4
+ZwCompressKey@4
+ZwConnectPort@32
+ZwContinue@8
+ZwCreateDebugObject@16
+ZwCreateDirectoryObject@12
+ZwCreateEnlistment@32
+ZwCreateEvent@20
+ZwCreateEventPair@12
+ZwCreateFile@44
+ZwCreateIoCompletion@16
+ZwCreateJobObject@12
+ZwCreateJobSet@12
+ZwCreateKey@28
+ZwCreateKeyTransacted@32
+ZwCreateKeyedEvent@16
+ZwCreateMailslotFile@32
+ZwCreateMutant@16
+ZwCreateNamedPipeFile@56
+ZwCreatePagingFile@16
+ZwCreatePort@20
+ZwCreatePrivateNamespace@16
+ZwCreateProcess@32
+ZwCreateProcessEx@36
+ZwCreateProfile@36
+ZwCreateProfileEx@40
+ZwCreateResourceManager@28
+ZwCreateSection@28
+ZwCreateSemaphore@20
+ZwCreateSymbolicLinkObject@16
+ZwCreateThread@32
+ZwCreateThreadEx@44
+ZwCreateTimer@16
+ZwCreateToken@52
+ZwCreateTransaction@40
+ZwCreateTransactionManager@24
+ZwCreateUserProcess@44
+ZwCreateWaitablePort@20
+ZwCreateWorkerFactory@40
+ZwDebugActiveProcess@8
+ZwDebugContinue@12
+ZwDelayExecution@8
+ZwDeleteAtom@4
+ZwDeleteBootEntry@4
+ZwDeleteDriverEntry@4
+ZwDeleteFile@4
+ZwDeleteKey@4
+ZwDeleteObjectAuditAlarm@12
+ZwDeletePrivateNamespace@4
+ZwDeleteValueKey@8
+ZwDeviceIoControlFile@40
+ZwDisableLastKnownGood@0
+ZwDisplayString@4
+ZwDrawText@4
+ZwDuplicateObject@28
+ZwDuplicateToken@24
+ZwEnableLastKnownGood@0
+ZwEnumerateBootEntries@8
+ZwEnumerateDriverEntries@8
+ZwEnumerateKey@24
+ZwEnumerateSystemEnvironmentValuesEx@12
+ZwEnumerateTransactionObject@20
+ZwEnumerateValueKey@24
+ZwExtendSection@8
+ZwFilterToken@24
+ZwFindAtom@12
+ZwFlushBuffersFile@8
+ZwFlushInstallUILanguage@8
+ZwFlushInstructionCache@12
+ZwFlushKey@4
+ZwFlushProcessWriteBuffers@0
+ZwFlushVirtualMemory@16
+ZwFlushWriteBuffer@0
+ZwFreeUserPhysicalPages@12
+ZwFreeVirtualMemory@16
+ZwFreezeRegistry@4
+ZwFreezeTransactions@8
+ZwFsControlFile@40
+ZwGetContextThread@8
+ZwGetCurrentProcessorNumber@0
+ZwGetDevicePowerState@8
+ZwGetMUIRegistryInfo@12
+ZwGetNextProcess@20
+ZwGetNextThread@24
+ZwGetNlsSectionPtr@20
+ZwGetNotificationResourceManager@28
+ZwGetPlugPlayEvent@16
+ZwGetTickCount@0
+ZwGetWriteWatch@28
+ZwImpersonateAnonymousToken@4
+ZwImpersonateClientOfPort@8
+ZwImpersonateThread@12
+ZwInitializeNlsFiles@16
+ZwInitializeRegistry@4
+ZwInitiatePowerAction@16
+ZwIsProcessInJob@8
+ZwIsSystemResumeAutomatic@0
+ZwIsUILanguageComitted@0
+ZwListenPort@8
+ZwLoadDriver@4
+ZwLoadKey2@12
+ZwLoadKey@8
+ZwLoadKeyEx@32
+ZwLockFile@40
+ZwLockProductActivationKeys@8
+ZwLockRegistryKey@4
+ZwLockVirtualMemory@16
+ZwMakePermanentObject@4
+ZwMakeTemporaryObject@4
+ZwMapCMFModule@24
+ZwMapUserPhysicalPages@12
+ZwMapUserPhysicalPagesScatter@12
+ZwMapViewOfSection@40
+ZwModifyBootEntry@4
+ZwModifyDriverEntry@4
+ZwNotifyChangeDirectoryFile@36
+ZwNotifyChangeKey@40
+ZwNotifyChangeMultipleKeys@48
+ZwNotifyChangeSession@32
+ZwOpenDirectoryObject@12
+ZwOpenEnlistment@20
+ZwOpenEvent@12
+ZwOpenEventPair@12
+ZwOpenFile@24
+ZwOpenIoCompletion@12
+ZwOpenJobObject@12
+ZwOpenKey@12
+ZwOpenKeyEx@16
+ZwOpenKeyTransacted@16
+ZwOpenKeyTransactedEx@20
+ZwOpenKeyedEvent@12
+ZwOpenMutant@12
+ZwOpenObjectAuditAlarm@48
+ZwOpenPrivateNamespace@16
+ZwOpenProcess@16
+ZwOpenProcessToken@12
+ZwOpenProcessTokenEx@16
+ZwOpenResourceManager@20
+ZwOpenSection@12
+ZwOpenSemaphore@12
+ZwOpenSession@12
+ZwOpenSymbolicLinkObject@12
+ZwOpenThread@16
+ZwOpenThreadToken@16
+ZwOpenThreadTokenEx@20
+ZwOpenTimer@12
+ZwOpenTransaction@20
+ZwOpenTransactionManager@24
+ZwPlugPlayControl@12
+ZwPowerInformation@20
+ZwPrePrepareComplete@8
+ZwPrePrepareEnlistment@8
+ZwPrepareComplete@8
+ZwPrepareEnlistment@8
+ZwPrivilegeCheck@12
+ZwPrivilegeObjectAuditAlarm@24
+ZwPrivilegedServiceAuditAlarm@20
+ZwPropagationComplete@16
+ZwPropagationFailed@12
+ZwProtectVirtualMemory@20
+ZwPulseEvent@8
+ZwQueryAttributesFile@8
+ZwQueryBootEntryOrder@8
+ZwQueryBootOptions@8
+ZwQueryDebugFilterState@8
+ZwQueryDefaultLocale@8
+ZwQueryDefaultUILanguage@4
+ZwQueryDirectoryFile@44
+ZwQueryDirectoryObject@28
+ZwQueryDriverEntryOrder@8
+ZwQueryEaFile@36
+ZwQueryEvent@20
+ZwQueryFullAttributesFile@8
+ZwQueryInformationAtom@20
+ZwQueryInformationEnlistment@20
+ZwQueryInformationFile@20
+ZwQueryInformationJobObject@20
+ZwQueryInformationPort@20
+ZwQueryInformationProcess@20
+ZwQueryInformationResourceManager@20
+ZwQueryInformationThread@20
+ZwQueryInformationToken@20
+ZwQueryInformationTransaction@20
+ZwQueryInformationTransactionManager@20
+ZwQueryInformationWorkerFactory@20
+ZwQueryInstallUILanguage@4
+ZwQueryIntervalProfile@8
+ZwQueryIoCompletion@20
+ZwQueryKey@20
+ZwQueryLicenseValue@20
+ZwQueryMultipleValueKey@24
+ZwQueryMutant@20
+ZwQueryObject@20
+ZwQueryOpenSubKeys@8
+ZwQueryOpenSubKeysEx@16
+ZwQueryPerformanceCounter@8
+ZwQueryPortInformationProcess@0
+ZwQueryQuotaInformationFile@36
+ZwQuerySection@20
+ZwQuerySecurityAttributesToken@24
+ZwQuerySecurityObject@20
+ZwQuerySemaphore@20
+ZwQuerySymbolicLinkObject@12
+ZwQuerySystemEnvironmentValue@16
+ZwQuerySystemEnvironmentValueEx@20
+ZwQuerySystemInformation@16
+ZwQuerySystemInformationEx@24
+ZwQuerySystemTime@4
+ZwQueryTimer@20
+ZwQueryTimerResolution@12
+ZwQueryValueKey@24
+ZwQueryVirtualMemory@24
+ZwQueryVolumeInformationFile@20
+ZwQueueApcThread@20
+ZwQueueApcThreadEx@24
+ZwRaiseException@12
+ZwRaiseHardError@24
+ZwReadFile@36
+ZwReadFileScatter@36
+ZwReadOnlyEnlistment@8
+ZwReadRequestData@24
+ZwReadVirtualMemory@20
+ZwRecoverEnlistment@8
+ZwRecoverResourceManager@4
+ZwRecoverTransactionManager@4
+ZwRegisterProtocolAddressInformation@20
+ZwRegisterThreadTerminatePort@4
+ZwReleaseCMFViewOwnership@0
+ZwReleaseKeyedEvent@16
+ZwReleaseMutant@8
+ZwReleaseSemaphore@12
+ZwReleaseWorkerFactoryWorker@4
+ZwRemoveIoCompletion@20
+ZwRemoveIoCompletionEx@24
+ZwRemoveProcessDebug@8
+ZwRenameKey@8
+ZwRenameTransactionManager@8
+ZwReplaceKey@12
+ZwReplacePartitionUnit@12
+ZwReplyPort@8
+ZwReplyWaitReceivePort@16
+ZwReplyWaitReceivePortEx@20
+ZwReplyWaitReplyPort@8
+ZwRequestDeviceWakeup@4
+ZwRequestPort@8
+ZwRequestWaitReplyPort@12
+ZwRequestWakeupLatency@4
+ZwResetEvent@8
+ZwResetWriteWatch@12
+ZwRestoreKey@12
+ZwResumeProcess@4
+ZwResumeThread@8
+ZwRollbackComplete@8
+ZwRollbackEnlistment@8
+ZwRollbackTransaction@8
+ZwRollforwardTransactionManager@8
+ZwSaveKey@8
+ZwSaveKeyEx@12
+ZwSaveMergedKeys@12
+ZwSecureConnectPort@36
+ZwSerializeBoot@0
+ZwSetBootEntryOrder@8
+ZwSetBootOptions@8
+ZwSetContextThread@8
+ZwSetDebugFilterState@12
+ZwSetDefaultHardErrorPort@4
+ZwSetDefaultLocale@8
+ZwSetDefaultUILanguage@4
+ZwSetDriverEntryOrder@8
+ZwSetEaFile@16
+ZwSetEvent@8
+ZwSetEventBoostPriority@4
+ZwSetHighEventPair@4
+ZwSetHighWaitLowEventPair@4
+ZwSetInformationDebugObject@20
+ZwSetInformationEnlistment@16
+ZwSetInformationFile@20
+ZwSetInformationJobObject@16
+ZwSetInformationKey@16
+ZwSetInformationObject@16
+ZwSetInformationProcess@16
+ZwSetInformationResourceManager@16
+ZwSetInformationThread@16
+ZwSetInformationToken@16
+ZwSetInformationTransaction@16
+ZwSetInformationTransactionManager@16
+ZwSetInformationWorkerFactory@16
+ZwSetIntervalProfile@8
+ZwSetIoCompletion@20
+ZwSetIoCompletionEx@24
+ZwSetLdtEntries@24
+ZwSetLowEventPair@4
+ZwSetLowWaitHighEventPair@4
+ZwSetQuotaInformationFile@16
+ZwSetSecurityObject@12
+ZwSetSystemEnvironmentValue@8
+ZwSetSystemEnvironmentValueEx@20
+ZwSetSystemInformation@12
+ZwSetSystemPowerState@12
+ZwSetSystemTime@8
+ZwSetThreadExecutionState@8
+ZwSetTimer@28
+ZwSetTimerEx@16
+ZwSetTimerResolution@12
+ZwSetUuidSeed@4
+ZwSetValueKey@24
+ZwSetVolumeInformationFile@20
+ZwShutdownSystem@4
+ZwShutdownWorkerFactory@8
+ZwSignalAndWaitForSingleObject@16
+ZwSinglePhaseReject@8
+ZwStartProfile@4
+ZwStopProfile@4
+ZwSuspendProcess@4
+ZwSuspendThread@8
+ZwSystemDebugControl@24
+ZwTerminateJobObject@8
+ZwTerminateProcess@8
+ZwTerminateThread@8
+ZwTestAlert@0
+ZwThawRegistry@0
+ZwThawTransactions@0
+ZwTraceControl@24
+ZwTraceEvent@16
+ZwTranslateFilePath@16
+ZwUmsThreadYield@4
+ZwUnloadDriver@4
+ZwUnloadKey2@8
+ZwUnloadKey@4
+ZwUnloadKeyEx@8
+ZwUnlockFile@20
+ZwUnlockVirtualMemory@16
+ZwUnmapViewOfSection@8
+ZwVdmControl@8
+ZwWaitForDebugEvent@16
+ZwWaitForKeyedEvent@16
+ZwWaitForMultipleObjects32@20
+ZwWaitForMultipleObjects@20
+ZwWaitForSingleObject@12
+ZwWaitForWorkViaWorkerFactory@8
+ZwWaitHighEventPair@4
+ZwWaitLowEventPair@4
+ZwWorkerFactoryWorkerReady@4
+ZwWow64CallFunction64@28
+ZwWow64CsrAllocateCaptureBuffer@8
+ZwWow64CsrAllocateMessagePointer@12
+ZwWow64CsrCaptureMessageBuffer@16
+ZwWow64CsrCaptureMessageString@20
+ZwWow64CsrClientCallServer@16
+ZwWow64CsrClientConnectToServer@20
+ZwWow64CsrFreeCaptureBuffer@4
+ZwWow64CsrGetProcessId@0
+ZwWow64CsrIdentifyAlertableThread@0
+ZwWow64CsrVerifyRegion@8
+ZwWow64DebuggerCall@20
+ZwWow64GetCurrentProcessorNumberEx@4
+ZwWow64GetNativeSystemInformation@16
+ZwWow64InterlockedPopEntrySList@4
+ZwWow64QueryInformationProcess64@20
+ZwWow64QueryVirtualMemory64@32
+ZwWow64ReadVirtualMemory64@28
+ZwWow64WriteVirtualMemory64@28
+ZwWriteFile@36
+ZwWriteFileGather@36
+ZwWriteRequestData@24
+ZwWriteVirtualMemory@20
+ZwYieldExecution@0
+_CIcos
+_CIlog
+_CIpow
+_CIsin
+_CIsqrt
+__isascii
+__iscsym
+__iscsymf
+__toascii
+_alldiv
+_alldvrm@16
+_allmul@16
+_alloca_probe
+_alloca_probe_16
+_alloca_probe_8
+_allrem@16
+_allshl
+_allshr
+_atoi64
+_aulldiv@16
+_aulldvrm@16
+_aullrem@16
+_aullshr
+;_chkstk
+_fltused DATA
+_ftol
+_i64toa
+_i64toa_s
+_i64tow
+_i64tow_s
+_itoa
+_itoa_s
+_itow
+_itow_s
+_lfind
+_ltoa
+_ltoa_s
+_ltow
+_ltow_s
+_makepath_s
+_memccpy
+_memicmp
+_snprintf
+_snprintf_s
+_snscanf_s
+_snwprintf
+_snwprintf_s
+_snwscanf_s
+_splitpath
+_splitpath_s
+_strcmpi
+_stricmp
+_strlwr
+_strnicmp
+_strnset_s
+_strset_s
+_strupr
+_swprintf
+_tolower
+_toupper
+_ui64toa
+_ui64toa_s
+_ui64tow
+_ui64tow_s
+_ultoa
+_ultoa_s
+_ultow
+_ultow_s
+_vscwprintf
+_vsnprintf
+_vsnprintf_s
+_vsnwprintf
+_vsnwprintf_s
+_vswprintf
+_wcsicmp
+_wcslwr
+_wcsnicmp
+_wcsnset_s
+_wcsset_s
+_wcstoui64
+_wcsupr
+_wmakepath_s
+_wsplitpath_s
+_wtoi
+_wtoi64
+_wtol
+abs
+atan DATA
+atoi
+atol
+bsearch
+ceil
+cos DATA
+fabs DATA
+floor DATA
+isalnum
+isalpha
+iscntrl
+isdigit
+isgraph
+islower
+isprint
+ispunct
+isspace
+isupper
+iswalpha
+iswctype
+iswdigit
+iswlower
+iswspace
+iswxdigit
+isxdigit
+labs
+log
+mbstowcs
+memchr
+memcmp
+memcpy
+memcpy_s
+memmove
+memmove_s
+memset
+pow
+qsort
+sin
+sprintf
+sprintf_s
+sqrt
+sscanf
+sscanf_s
+strcat
+strcat_s
+strchr
+strcmp
+strcpy
+strcpy_s
+strcspn
+strlen
+strncat
+strncat_s
+strncmp
+strncpy
+strncpy_s
+strnlen
+strpbrk
+strrchr
+strspn
+strstr
+strtok_s
+strtol
+strtoul
+swprintf
+swprintf_s
+swscanf_s
+tan
+tolower
+toupper
+towlower
+towupper
+vDbgPrintEx@16
+vDbgPrintExWithPrefix@20
+vsprintf
+vsprintf_s
+vswprintf_s
+wcscat
+wcscat_s
+wcschr
+wcscmp
+wcscpy
+wcscpy_s
+wcscspn
+wcslen
+wcsncat
+wcsncat_s
+wcsncmp
+wcsncpy
+wcsncpy_s
+wcsnlen
+wcspbrk
+wcsrchr
+wcsspn
+wcsstr
+wcstol
+wcstombs
+wcstoul
diff --git a/lib/libc/mingw/lib64/ntdll.def b/lib/libc/mingw/lib64/ntdll.def
new file mode 100644
index 0000000000..2b2ad36f8a
--- /dev/null
+++ b/lib/libc/mingw/lib64/ntdll.def
@@ -0,0 +1,2037 @@
+;
+; Definition file of ntdll.dll
+; Automatic generated by gendef
+; written by Kai Tietz 2008
+;
+LIBRARY "ntdll.dll"
+EXPORTS
+PropertyLengthAsVariant
+RtlConvertPropertyToVariant
+RtlConvertVariantToProperty
+A_SHAFinal
+A_SHAInit
+A_SHAUpdate
+AlpcAdjustCompletionListConcurrencyCount
+AlpcFreeCompletionListMessage
+AlpcGetCompletionListLastMessageInformation
+AlpcGetCompletionListMessageAttributes
+AlpcGetHeaderSize
+AlpcGetMessageAttribute
+AlpcGetMessageFromCompletionList
+AlpcGetOutstandingCompletionListMessageCount
+AlpcInitializeMessageAttribute
+AlpcMaxAllowedMessageLength
+AlpcRegisterCompletionList
+AlpcRegisterCompletionListWorkerThread
+AlpcRundownCompletionList
+AlpcUnregisterCompletionList
+AlpcUnregisterCompletionListWorkerThread
+CsrAllocateCaptureBuffer
+CsrAllocateMessagePointer
+CsrCaptureMessageBuffer
+CsrCaptureMessageMultiUnicodeStringsInPlace
+CsrCaptureMessageString
+CsrCaptureTimeout
+CsrClientCallServer
+CsrClientConnectToServer
+CsrFreeCaptureBuffer
+CsrGetProcessId
+CsrIdentifyAlertableThread
+CsrNewThread
+CsrProbeForRead
+CsrProbeForWrite
+CsrSetPriorityClass
+CsrVerifyRegion
+DbgBreakPoint
+DbgPrint
+DbgPrintEx
+DbgPrintReturnControlC
+DbgPrompt
+DbgQueryDebugFilterState
+DbgSetDebugFilterState
+DbgUiConnectToDbg
+DbgUiContinue
+DbgUiConvertStateChangeStructure
+DbgUiDebugActiveProcess
+DbgUiGetThreadDebugObject
+DbgUiIssueRemoteBreakin
+DbgUiRemoteBreakin
+DbgUiSetThreadDebugObject
+DbgUiStopDebugging
+DbgUiWaitStateChange
+DbgUserBreakPoint
+EtwControlTraceA
+EtwControlTraceW
+EtwCreateTraceInstanceId
+EtwEnableTrace
+EtwEnumerateTraceGuids
+EtwFlushTraceA
+EtwFlushTraceW
+EtwDeliverDataBlock
+EtwEnumerateProcessRegGuids
+EtwEventActivityIdControl
+EtwEventEnabled
+EtwEventProviderEnabled
+EtwEventRegister
+EtwEventUnregister
+EtwEventWrite
+EtwEventWriteEndScenario
+EtwEventWriteEx
+EtwEventWriteFull
+EtwEventWriteNoRegistration
+EtwEventWriteStartScenario
+EtwEventWriteString
+EtwEventWriteTransfer
+EtwGetTraceEnableFlags
+EtwGetTraceEnableLevel
+EtwGetTraceLoggerHandle
+EtwNotificationRegistrationA
+EtwNotificationRegistrationW
+EtwQueryAllTracesA
+EtwQueryAllTracesW
+EtwQueryTraceA
+EtwQueryTraceW
+EtwReceiveNotificationsA
+EtwReceiveNotificationsW
+EtwLogTraceEvent
+EtwNotificationRegister
+EtwNotificationUnregister
+EtwProcessPrivateLoggerRequest
+EtwRegisterSecurityProvider
+EtwRegisterTraceGuidsA
+EtwRegisterTraceGuidsW
+EtwStartTraceA
+EtwStartTraceW
+EtwStopTraceA
+EtwStopTraceW
+EtwTraceEvent
+EtwReplyNotification
+EtwSendNotification
+EtwSetMark
+EtwTraceEventInstance
+EtwTraceMessage
+EtwTraceMessageVa
+EtwUnregisterTraceGuids
+EtwUpdateTraceA
+EtwUpdateTraceW
+EtwpGetTraceBuffer
+EtwpSetHWConfigFunction
+EtwWriteUMSecurityEvent
+EtwpCreateEtwThread
+EtwpGetCpuSpeed
+EtwpNotificationThread
+EvtIntReportAuthzEventAndSourceAsync
+EvtIntReportEventAndSourceAsync
+ExpInterlockedPopEntrySListEnd
+ExpInterlockedPopEntrySListEnd16
+ExpInterlockedPopEntrySListFault
+ExpInterlockedPopEntrySListFault16
+ExpInterlockedPopEntrySListResume
+ExpInterlockedPopEntrySListResume16
+KiRaiseUserExceptionDispatcher
+KiUserApcDispatcher
+KiUserCallbackDispatcher
+KiUserExceptionDispatcher
+LdrAccessOutOfProcessResource
+LdrAccessResource
+LdrAddLoadAsDataTable
+LdrAddRefDll
+LdrAlternateResourcesEnabled
+LdrCreateOutOfProcessImage
+LdrDestroyOutOfProcessImage
+LdrDisableThreadCalloutsForDll
+LdrEnumResources
+LdrEnumerateLoadedModules
+LdrFindCreateProcessManifest
+LdrFindEntryForAddress
+LdrFindResourceDirectory_U
+LdrFindResourceEx_U
+LdrFindResource_U
+LdrFlushAlternateResourceModules
+LdrGetDllHandle
+LdrGetDllHandleByMapping
+LdrGetDllHandleByName
+LdrGetDllHandleEx
+LdrGetFailureData
+LdrGetFileNameFromLoadAsDataTable
+LdrGetKnownDllSectionHandle
+LdrGetProcedureAddress
+LdrGetProcedureAddressEx
+LdrHotPatchRoutine
+LdrInitShimEngineDynamic
+LdrInitializeThunk
+LdrLoadAlternateResourceModule
+LdrLoadAlternateResourceModuleEx
+LdrLoadDll
+LdrLockLoaderLock
+LdrOpenImageFileOptionsKey
+LdrProcessInitializationComplete
+LdrProcessRelocationBlock
+LdrQueryImageFileExecutionOptions
+LdrQueryImageFileExecutionOptionsEx
+LdrQueryImageFileKeyOption
+LdrQueryModuleServiceTags
+LdrQueryProcessModuleInformation
+LdrRegisterDllNotification
+LdrRemoveLoadAsDataTable
+LdrResFindResource
+LdrResFindResourceDirectory
+LdrResGetRCConfig
+LdrResRelease
+LdrResSearchResource
+LdrRscIsTypeExist
+LdrSetAppCompatDllRedirectionCallback
+LdrSetDllManifestProber
+LdrSetMUICacheType
+LdrShutdownProcess
+LdrShutdownThread
+LdrUnloadAlternateResourceModule
+LdrUnloadAlternateResourceModuleEx
+LdrUnloadDll
+LdrUnlockLoaderLock
+LdrUnregisterDllNotification
+LdrVerifyImageMatchesChecksum
+LdrVerifyImageMatchesChecksumEx
+LdrpResGetMappingSize
+LdrpResGetResourceDirectory
+MD4Final
+MD4Init
+MD4Update
+MD5Final
+MD5Init
+MD5Update
+NlsAnsiCodePage DATA
+NlsMbCodePageTag DATA
+NlsMbOemCodePageTag DATA
+NtAcceptConnectPort
+NtAccessCheck
+NtAccessCheckAndAuditAlarm
+NtAccessCheckByType
+NtAccessCheckByTypeAndAuditAlarm
+NtAccessCheckByTypeResultList
+NtAccessCheckByTypeResultListAndAuditAlarm
+NtAccessCheckByTypeResultListAndAuditAlarmByHandle
+NtAddAtom
+NtAddBootEntry
+NtAddDriverEntry
+NtAdjustGroupsToken
+NtAdjustPrivilegesToken
+NtAlertResumeThread
+NtAlertThread
+NtAllocateLocallyUniqueId
+NtAllocateReserveObject
+NtAllocateUserPhysicalPages
+NtAllocateUuids
+NtAllocateVirtualMemory
+NtAlpcAcceptConnectPort
+NtAlpcCancelMessage
+NtAlpcConnectPort
+NtAlpcCreatePort
+NtAlpcCreatePortSection
+NtAlpcCreateResourceReserve
+NtAlpcCreateSectionView
+NtAlpcCreateSecurityContext
+NtAlpcDeletePortSection
+NtAlpcDeleteResourceReserve
+NtAlpcDeleteSectionView
+NtAlpcDeleteSecurityContext
+NtAlpcDisconnectPort
+NtAlpcImpersonateClientOfPort
+NtAlpcOpenSenderProcess
+NtAlpcOpenSenderThread
+NtAlpcQueryInformation
+NtAlpcQueryInformationMessage
+NtAlpcRevokeSecurityContext
+NtAlpcSendWaitReceivePort
+NtAlpcSetInformation
+NtApphelpCacheControl
+NtAreMappedFilesTheSame
+NtAssignProcessToJobObject
+NtCallbackReturn
+NtCancelDeviceWakeupRequest
+NtCancelIoFile
+NtCancelIoFileEx
+NtCancelSynchronousIoFile
+NtCancelTimer
+NtClearEvent
+NtClose
+NtCloseObjectAuditAlarm
+NtCommitComplete
+NtCommitEnlistment
+NtCommitTransaction
+NtCompactKeys
+NtCompareTokens
+NtCompleteConnectPort
+NtCompressKey
+NtConnectPort
+NtContinue
+NtCreateDebugObject
+NtCreateDirectoryObject
+NtCreateEnlistment
+NtCreateEvent
+NtCreateEventPair
+NtCreateFile
+NtCreateIoCompletion
+NtCreateJobObject
+NtCreateJobSet
+NtCreateKey
+NtCreateKeyTransacted
+NtCreateKeyedEvent
+NtCreateMailslotFile
+NtCreateMutant
+NtCreateNamedPipeFile
+NtCreatePagingFile
+NtCreatePort
+NtCreatePrivateNamespace
+NtCreateProcess
+NtCreateProcessEx
+NtCreateProfile
+NtCreateProfileEx
+NtCreateResourceManager
+NtCreateSection
+NtCreateSemaphore
+NtCreateSymbolicLinkObject
+NtCreateThread
+NtCreateThreadEx
+NtCreateTimer
+NtCreateToken
+NtCreateTransaction
+NtCreateTransactionManager
+NtCreateUserProcess
+NtCreateWaitablePort
+NtCreateWorkerFactory
+NtDebugActiveProcess
+NtDebugContinue
+NtDelayExecution
+NtDeleteAtom
+NtDeleteBootEntry
+NtDeleteDriverEntry
+NtDeleteFile
+NtDeleteKey
+NtDeleteObjectAuditAlarm
+NtDeletePrivateNamespace
+NtDeleteValueKey
+NtDeviceIoControlFile
+NtDisableLastKnownGood
+NtDisplayString
+NtDrawText
+NtDuplicateObject
+NtDuplicateToken
+NtEnableLastKnownGood
+NtEnumerateBootEntries
+NtEnumerateDriverEntries
+NtEnumerateKey
+NtEnumerateSystemEnvironmentValuesEx
+NtEnumerateTransactionObject
+NtEnumerateValueKey
+NtExtendSection
+NtFilterToken
+NtFindAtom
+NtFlushBuffersFile
+NtFlushInstallUILanguage
+NtFlushInstructionCache
+NtFlushKey
+NtFlushProcessWriteBuffers
+NtFlushVirtualMemory
+NtFlushWriteBuffer
+NtFreeUserPhysicalPages
+NtFreeVirtualMemory
+NtFreezeRegistry
+NtFreezeTransactions
+NtFsControlFile
+NtGetContextThread
+NtGetCurrentProcessorNumber
+NtGetDevicePowerState
+NtGetMUIRegistryInfo
+NtGetNextProcess
+NtGetNextThread
+NtGetNlsSectionPtr
+NtGetNotificationResourceManager
+NtGetPlugPlayEvent
+NtGetTickCount
+NtGetWriteWatch
+NtImpersonateAnonymousToken
+NtImpersonateClientOfPort
+NtImpersonateThread
+NtInitializeNlsFiles
+NtInitializeRegistry
+NtInitiatePowerAction
+NtIsProcessInJob
+NtIsSystemResumeAutomatic
+NtIsUILanguageComitted
+NtListenPort
+NtLoadDriver
+NtLoadKey
+NtLoadKey2
+NtLoadKeyEx
+NtLockFile
+NtLockProductActivationKeys
+NtLockRegistryKey
+NtLockVirtualMemory
+NtMakePermanentObject
+NtMakeTemporaryObject
+NtMapCMFModule
+NtMapUserPhysicalPages
+NtMapUserPhysicalPagesScatter
+NtMapViewOfSection
+NtModifyBootEntry
+NtModifyDriverEntry
+NtNotifyChangeDirectoryFile
+NtNotifyChangeKey
+NtNotifyChangeMultipleKeys
+NtNotifyChangeSession
+NtOpenDirectoryObject
+NtOpenEnlistment
+NtOpenEvent
+NtOpenEventPair
+NtOpenFile
+NtOpenIoCompletion
+NtOpenJobObject
+NtOpenKey
+NtOpenKeyEx
+NtOpenKeyTransacted
+NtOpenKeyTransactedEx
+NtOpenKeyedEvent
+NtOpenMutant
+NtOpenObjectAuditAlarm
+NtOpenPrivateNamespace
+NtOpenProcess
+NtOpenProcessToken
+NtOpenProcessTokenEx
+NtOpenResourceManager
+NtOpenSection
+NtOpenSemaphore
+NtOpenSession
+NtOpenSymbolicLinkObject
+NtOpenThread
+NtOpenThreadToken
+NtOpenThreadTokenEx
+NtOpenTimer
+NtOpenTransaction
+NtOpenTransactionManager
+NtPlugPlayControl
+NtPowerInformation
+NtPrePrepareComplete
+NtPrePrepareEnlistment
+NtPrepareComplete
+NtPrepareEnlistment
+NtPrivilegeCheck
+NtPrivilegeObjectAuditAlarm
+NtPrivilegedServiceAuditAlarm
+NtPropagationComplete
+NtPropagationFailed
+NtProtectVirtualMemory
+NtPulseEvent
+NtQueryAttributesFile
+NtQueryBootEntryOrder
+NtQueryBootOptions
+NtQueryDebugFilterState
+NtQueryDefaultLocale
+NtQueryDefaultUILanguage
+NtQueryDirectoryFile
+NtQueryDirectoryObject
+NtQueryDriverEntryOrder
+NtQueryEaFile
+NtQueryEvent
+NtQueryFullAttributesFile
+NtQueryInformationAtom
+NtQueryInformationEnlistment
+NtQueryInformationFile
+NtQueryInformationJobObject
+NtQueryInformationPort
+NtQueryInformationProcess
+NtQueryInformationResourceManager
+NtQueryInformationThread
+NtQueryInformationToken
+NtQueryInformationTransaction
+NtQueryInformationTransactionManager
+NtQueryInformationWorkerFactory
+NtQueryInstallUILanguage
+NtQueryIntervalProfile
+NtQueryIoCompletion
+NtQueryKey
+NtQueryLicenseValue
+NtQueryMultipleValueKey
+NtQueryMutant
+NtQueryObject
+NtQueryOpenSubKeys
+NtQueryOpenSubKeysEx
+NtQueryPerformanceCounter
+NtQueryPortInformationProcess
+NtQueryQuotaInformationFile
+NtQuerySection
+NtQuerySecurityAttributesToken
+NtQuerySecurityObject
+NtQuerySemaphore
+NtQuerySymbolicLinkObject
+NtQuerySystemEnvironmentValue
+NtQuerySystemEnvironmentValueEx
+NtQuerySystemInformation
+NtQuerySystemInformationEx
+NtQuerySystemTime
+NtQueryTimer
+NtQueryTimerResolution
+NtQueryValueKey
+NtQueryVirtualMemory
+NtQueryVolumeInformationFile
+NtQueueApcThread
+NtQueueApcThreadEx
+NtRaiseException
+NtRaiseHardError
+NtReadFile
+NtReadFileScatter
+NtReadOnlyEnlistment
+NtReadRequestData
+NtReadVirtualMemory
+NtRecoverEnlistment
+NtRecoverResourceManager
+NtRecoverTransactionManager
+NtRegisterProtocolAddressInformation
+NtRegisterThreadTerminatePort
+NtReleaseKeyedEvent
+NtReleaseMutant
+NtReleaseSemaphore
+NtReleaseWorkerFactoryWorker
+NtRemoveIoCompletion
+NtRemoveIoCompletionEx
+NtRemoveProcessDebug
+NtRenameKey
+NtRenameTransactionManager
+NtReplaceKey
+NtReplacePartitionUnit
+NtReplyPort
+NtReplyWaitReceivePort
+NtReplyWaitReceivePortEx
+NtReplyWaitReplyPort
+NtRequestDeviceWakeup
+NtRequestPort
+NtRequestWaitReplyPort
+NtRequestWakeupLatency
+NtResetEvent
+NtResetWriteWatch
+NtRestoreKey
+NtResumeProcess
+NtResumeThread
+NtRollbackComplete
+NtRollbackEnlistment
+NtRollbackTransaction
+NtRollforwardTransactionManager
+NtSaveKey
+NtSaveKeyEx
+NtSaveMergedKeys
+NtSecureConnectPort
+NtSerializeBoot
+NtSetBootEntryOrder
+NtSetBootOptions
+NtSetContextThread
+NtSetDebugFilterState
+NtSetDefaultHardErrorPort
+NtSetDefaultLocale
+NtSetDefaultUILanguage
+NtSetDriverEntryOrder
+NtSetEaFile
+NtSetEvent
+NtSetEventBoostPriority
+NtSetHighEventPair
+NtSetHighWaitLowEventPair
+NtSetInformationDebugObject
+NtSetInformationEnlistment
+NtSetInformationFile
+NtSetInformationJobObject
+NtSetInformationKey
+NtSetInformationObject
+NtSetInformationProcess
+NtSetInformationResourceManager
+NtSetInformationThread
+NtSetInformationToken
+NtSetInformationTransaction
+NtSetInformationTransactionManager
+NtSetInformationWorkerFactory
+NtSetIntervalProfile
+NtSetIoCompletion
+NtSetIoCompletionEx
+NtSetLdtEntries
+NtSetLowEventPair
+NtSetLowWaitHighEventPair
+NtSetQuotaInformationFile
+NtSetSecurityObject
+NtSetSystemEnvironmentValue
+NtSetSystemEnvironmentValueEx
+NtSetSystemInformation
+NtSetSystemPowerState
+NtSetSystemTime
+NtSetThreadExecutionState
+NtSetTimer
+NtSetTimerEx
+NtSetTimerResolution
+NtSetUuidSeed
+NtSetValueKey
+NtSetVolumeInformationFile
+NtShutdownSystem
+NtShutdownWorkerFactory
+NtSignalAndWaitForSingleObject
+NtSinglePhaseReject
+NtStartProfile
+NtStopProfile
+NtSuspendProcess
+NtSuspendThread
+NtSystemDebugControl
+NtTerminateJobObject
+NtTerminateProcess
+NtTerminateThread
+NtTestAlert
+NtThawRegistry
+NtThawTransactions
+NtTraceControl
+NtTraceEvent
+NtTranslateFilePath
+NtUmsThreadYield
+NtUnloadDriver
+NtUnloadKey
+NtUnloadKey2
+NtUnloadKeyEx
+NtUnlockFile
+NtUnlockVirtualMemory
+NtUnmapViewOfSection
+NtVdmControl
+NtWaitForDebugEvent
+NtWaitForKeyedEvent
+NtWaitForMultipleObjects
+NtWaitForMultipleObjects32
+NtWaitForSingleObject
+NtWaitForWorkViaWorkerFactory
+NtWaitHighEventPair
+NtWaitLowEventPair
+NtWorkerFactoryWorkerReady
+NtWriteFile
+NtWriteFileGather
+NtWriteRequestData
+NtWriteVirtualMemory
+NtYieldExecution
+NtdllDefWindowProc_A
+NtdllDefWindowProc_W
+NtdllDialogWndProc_A
+NtdllDialogWndProc_W
+PfxFindPrefix
+PfxInitialize
+PfxInsertPrefix
+PfxRemovePrefix
+RtlAbortRXact
+RtlAbsoluteToSelfRelativeSD
+RtlAcquirePebLock
+RtlAcquirePrivilege
+RtlAcquireReleaseSRWLockExclusive
+RtlAcquireResourceExclusive
+RtlAcquireResourceShared
+RtlAcquireSRWLockExclusive
+RtlAcquireSRWLockShared
+RtlActivateActivationContext
+RtlActivateActivationContextEx
+RtlActivateActivationContextUnsafeFast
+RtlAddAccessAllowedAce
+RtlAddAccessAllowedAceEx
+RtlAddAccessAllowedObjectAce
+RtlAddAccessDeniedAce
+RtlAddAccessDeniedAceEx
+RtlAddAccessDeniedObjectAce
+RtlAddAce
+RtlAddActionToRXact
+RtlAddAtomToAtomTable
+RtlAddAttributeActionToRXact
+RtlAddAuditAccessAce
+RtlAddAuditAccessAceEx
+RtlAddAuditAccessObjectAce
+RtlAddCompoundAce
+RtlAddFunctionTable
+RtlAddIntegrityLabelToBoundaryDescriptor
+RtlAddMandatoryAce
+RtlAddRefActivationContext
+RtlAddRefMemoryStream
+RtlAddSIDToBoundaryDescriptor
+RtlAddVectoredContinueHandler
+RtlAddVectoredExceptionHandler
+RtlAddressInSectionTable
+RtlAdjustPrivilege
+RtlAllocateActivationContextStack
+RtlAllocateAndInitializeSid
+RtlAllocateHandle
+RtlAllocateHeap
+RtlAllocateMemoryBlockLookaside
+RtlAllocateMemoryZone
+RtlAnsiCharToUnicodeChar
+RtlAnsiStringToUnicodeSize
+RtlAnsiStringToUnicodeString
+RtlAppendAsciizToString
+RtlAppendPathElement
+RtlAppendStringToString
+RtlAppendUnicodeStringToString
+RtlAppendUnicodeToString
+RtlApplicationVerifierStop
+RtlApplyRXact
+RtlApplyRXactNoFlush
+RtlAreAllAccessesGranted
+RtlAreAnyAccessesGranted
+RtlAreBitsClear
+RtlAreBitsSet
+RtlAssert
+RtlBarrier
+RtlBarrierForDelete
+RtlCancelTimer
+RtlCaptureContext
+RtlCaptureStackBackTrace
+RtlCharToInteger
+RtlCheckForOrphanedCriticalSections
+RtlCheckProcessParameters
+RtlCheckRegistryKey
+RtlCleanUpTEBLangLists
+RtlClearAllBits
+RtlClearBits
+RtlCloneMemoryStream
+RtlCloneUserProcess
+RtlCmDecodeMemIoResource
+RtlCmEncodeMemIoResource
+RtlCommitDebugInfo
+RtlCommitMemoryStream
+RtlCompactHeap
+RtlCompareAltitudes
+RtlCompareMemory
+RtlCompareMemoryUlong
+RtlCompareString
+RtlCompareUnicodeString
+RtlCompareUnicodeStrings
+RtlCompleteProcessCloning
+RtlCompressBuffer
+RtlComputeCrc32
+RtlComputeImportTableHash
+RtlComputePrivatizedDllName_U
+RtlConnectToSm
+RtlConsoleMultiByteToUnicodeN
+RtlContractHashTable
+RtlConvertExclusiveToShared
+RtlConvertLCIDToString
+RtlConvertSharedToExclusive
+RtlConvertSidToUnicodeString
+RtlConvertToAutoInheritSecurityObject
+RtlConvertUiListToApiList
+RtlCopyExtendedContext
+RtlCopyLuid
+RtlCopyLuidAndAttributesArray
+RtlCopyMappedMemory
+RtlCopyMemory
+RtlCopyMemoryNonTemporal
+RtlCopyMemoryStreamTo
+RtlCopyOutOfProcessMemoryStreamTo
+RtlCopySecurityDescriptor
+RtlCopySid
+RtlCopySidAndAttributesArray
+RtlCopyString
+RtlCopyUnicodeString
+RtlCreateAcl
+RtlCreateActivationContext
+RtlCreateAndSetSD
+RtlCreateAtomTable
+RtlCreateBootStatusDataFile
+RtlCreateBoundaryDescriptor
+RtlCreateEnvironment
+RtlCreateEnvironmentEx
+RtlCreateHashTable
+RtlCreateHeap
+RtlCreateMemoryBlockLookaside
+RtlCreateMemoryZone
+RtlCreateProcessParameters
+RtlCreateProcessParametersEx
+RtlCreateProcessReflection
+RtlCreateQueryDebugBuffer
+RtlCreateRegistryKey
+RtlCreateSecurityDescriptor
+RtlCreateServiceSid
+RtlCreateSystemVolumeInformationFolder
+RtlCreateTagHeap
+RtlCreateTimer
+RtlCreateTimerQueue
+RtlCreateUmsCompletionList
+RtlCreateUmsThread
+RtlCreateUmsThreadContext
+RtlCreateUnicodeString
+RtlCreateUnicodeStringFromAsciiz
+RtlCreateUserProcess
+RtlCreateUserSecurityObject
+RtlCreateUserStack
+RtlCreateUserThread
+RtlCreateVirtualAccountSid
+RtlCultureNameToLCID
+RtlCustomCPToUnicodeN
+RtlCutoverTimeToSystemTime
+RtlDeCommitDebugInfo
+RtlDeNormalizeProcessParams
+RtlDeactivateActivationContext
+RtlDeactivateActivationContextUnsafeFast
+RtlDebugPrintTimes
+RtlDecodePointer
+RtlDecodeSystemPointer
+RtlDecompressBuffer
+RtlDecompressFragment
+RtlDefaultNpAcl
+RtlDelete
+RtlDeleteAce
+RtlDeleteAtomFromAtomTable
+RtlDeleteBarrier
+RtlDeleteBoundaryDescriptor
+RtlDeleteCriticalSection
+RtlDeleteElementGenericTable
+RtlDeleteElementGenericTableAvl
+RtlDeleteFunctionTable
+RtlDeleteHashTable
+RtlDeleteNoSplay
+RtlDeleteRegistryValue
+RtlDeleteResource
+RtlDeleteSecurityObject
+RtlDeleteTimer
+RtlDeleteTimerQueue
+RtlDeleteTimerQueueEx
+RtlDeleteUmsCompletionList
+RtlDeleteUmsThreadContext
+RtlDequeueUmsCompletionListItems
+RtlDeregisterSecureMemoryCacheCallback
+RtlDeregisterWait
+RtlDeregisterWaitEx
+RtlDestroyAtomTable
+RtlDestroyEnvironment
+RtlDestroyHandleTable
+RtlDestroyHeap
+RtlDestroyMemoryBlockLookaside
+RtlDestroyMemoryZone
+RtlDestroyProcessParameters
+RtlDestroyQueryDebugBuffer
+RtlDetectHeapLeaks
+RtlDetermineDosPathNameType_U
+RtlDisableThreadProfiling
+RtlDllShutdownInProgress
+RtlDnsHostNameToComputerName
+RtlDoesFileExists_U
+RtlDosApplyFileIsolationRedirection_Ustr
+RtlDosPathNameToNtPathName_U
+RtlDosPathNameToNtPathName_U_WithStatus
+RtlDosPathNameToRelativeNtPathName_U
+RtlDosPathNameToRelativeNtPathName_U_WithStatus
+RtlDosSearchPath_U
+RtlDosSearchPath_Ustr
+RtlDowncaseUnicodeChar
+RtlDowncaseUnicodeString
+RtlDumpResource
+RtlDuplicateUnicodeString
+RtlEmptyAtomTable
+RtlEnableEarlyCriticalSectionEventCreation
+RtlEnableThreadProfiling
+RtlEncodePointer
+RtlEncodeSystemPointer
+RtlEndEnumerationHashTable
+RtlEndWeakEnumerationHashTable
+RtlEnterCriticalSection
+RtlEnterUmsSchedulingMode
+RtlEnumProcessHeaps
+RtlEnumerateEntryHashTable
+RtlEnumerateGenericTable
+RtlEnumerateGenericTableAvl
+RtlEnumerateGenericTableLikeADirectory
+RtlEnumerateGenericTableWithoutSplaying
+RtlEnumerateGenericTableWithoutSplayingAvl
+RtlEqualComputerName
+RtlEqualDomainName
+RtlEqualLuid
+RtlEqualPrefixSid
+RtlEqualSid
+RtlEqualString
+RtlEqualUnicodeString
+RtlEraseUnicodeString
+RtlEthernetAddressToStringA
+RtlEthernetAddressToStringW
+RtlEthernetStringToAddressA
+RtlEthernetStringToAddressW
+RtlExecuteUmsThread
+RtlExitUserProcess
+RtlExitUserThread
+RtlExpandEnvironmentStrings
+RtlExpandEnvironmentStrings_U
+RtlExtendHeap
+RtlExpandHashTable
+RtlExtendMemoryBlockLookaside
+RtlExtendMemoryZone
+RtlFillMemory
+RtlFinalReleaseOutOfProcessMemoryStream
+RtlFindAceByType
+RtlFindActivationContextSectionGuid
+RtlFindActivationContextSectionString
+RtlFindCharInUnicodeString
+RtlFindClearBits
+RtlFindClearBitsAndSet
+RtlFindClearRuns
+RtlFindClosestEncodableLength
+RtlFindLastBackwardRunClear
+RtlFindLeastSignificantBit
+RtlFindLongestRunClear
+RtlFindMessage
+RtlFindMostSignificantBit
+RtlFindNextForwardRunClear
+RtlFindSetBits
+RtlFindSetBitsAndClear
+RtlFirstEntrySList
+RtlFirstFreeAce
+RtlFlsAlloc
+RtlFlsFree
+RtlFlushSecureMemoryCache
+RtlFormatCurrentUserKeyPath
+RtlFormatMessage
+RtlFormatMessageEx
+RtlFreeActivationContextStack
+RtlFreeAnsiString
+RtlFreeHandle
+RtlFreeHeap
+RtlFreeMemoryBlockLookaside
+RtlFreeOemString
+RtlFreeSid
+RtlFreeThreadActivationContextStack
+RtlFreeUnicodeString
+RtlFreeUserThreadStack
+RtlFreeUserStack
+RtlGUIDFromString
+RtlGenerate8dot3Name
+RtlGetAce
+RtlGetActiveActivationContext
+RtlGetCallersAddress
+RtlGetCompressionWorkSpaceSize
+RtlGetControlSecurityDescriptor
+RtlGetCriticalSectionRecursionCount
+RtlGetCurrentDirectory_U
+RtlGetCurrentPeb
+RtlGetCurrentProcessorNumber
+RtlGetCurrentProcessorNumberEx
+RtlGetCurrentTransaction
+RtlGetCurrentUmsThread
+RtlGetDaclSecurityDescriptor
+RtlGetElementGenericTable
+RtlGetElementGenericTableAvl
+RtlGetEnabledExtendedFeatures
+RtlGetExtendedContextLength
+RtlGetExtendedFeaturesMask
+RtlGetFileMUIPath
+RtlGetFrame
+RtlGetFullPathName_U
+RtlGetFullPathName_UEx
+RtlGetFullPathName_UstrEx
+RtlGetFunctionTableListHead
+RtlGetGroupSecurityDescriptor
+RtlGetIntegerAtom
+RtlGetLastNtStatus
+RtlGetLastWin32Error
+RtlGetLengthWithoutLastFullDosOrNtPathElement
+RtlGetLengthWithoutTrailingPathSeperators
+RtlGetLocaleFileMappingAddress
+RtlGetLongestNtPathLength
+RtlGetNativeSystemInformation
+RtlGetNextEntryHashTable
+RtlGetNextUmsListItem
+RtlGetNtGlobalFlags
+RtlGetNtProductType
+RtlGetNtVersionNumbers
+RtlGetOwnerSecurityDescriptor
+RtlGetParentLocaleName
+RtlGetProcessHeaps
+RtlGetProcessPreferredUILanguages
+RtlGetProductInfo
+RtlGetSaclSecurityDescriptor
+RtlGetSecurityDescriptorRMControl
+RtlGetSetBootStatusData
+RtlGetSystemPreferredUILanguages
+RtlGetThreadErrorMode
+RtlGetThreadLangIdByIndex
+RtlGetThreadPreferredUILanguages
+RtlGetUILanguageInfo
+RtlGetUmsCompletionListEvent
+RtlGetUnloadEventTrace
+RtlGetUnloadEventTraceEx
+RtlGetUserInfoHeap
+RtlGetUserPreferredUILanguages
+RtlGetVersion
+RtlHashUnicodeString
+RtlHeapTrkInitialize
+RtlIdentifierAuthoritySid
+RtlIdnToAscii
+RtlIdnToNameprepUnicode
+RtlIdnToUnicode
+RtlImageDirectoryEntryToData
+RtlImageNtHeader
+RtlImageNtHeaderEx
+RtlImageRvaToSection
+RtlImageRvaToVa
+RtlImpersonateSelf
+RtlImpersonateSelfEx
+RtlInitAnsiString
+RtlInitAnsiStringEx
+RtlInitBarrier
+RtlInitCodePageTable
+RtlInitEnumerationHashTable
+RtlInitMemoryStream
+RtlInitNlsTables
+RtlInitOutOfProcessMemoryStream
+RtlInitString
+RtlInitUnicodeString
+RtlInitUnicodeStringEx
+RtlInitWeakEnumerationHashTable
+RtlInitializeAtomPackage
+RtlInitializeBitMap
+RtlInitializeConditionVariable
+RtlInitializeContext
+RtlInitializeCriticalSection
+RtlInitializeCriticalSectionAndSpinCount
+RtlInitializeCriticalSectionEx
+RtlInitializeExtendedContext
+RtlInitializeGenericTable
+RtlInitializeGenericTableAvl
+RtlInitializeHandleTable
+RtlInitializeNtUserPfn
+RtlInitializeRXact
+RtlInitializeResource
+RtlInitializeSListHead
+RtlInitializeSRWLock
+RtlInitializeSid
+RtlInsertElementGenericTable
+RtlInsertElementGenericTableAvl
+RtlInsertElementGenericTableFull
+RtlInsertElementGenericTableFullAvl
+RtlInsertEntryHashTable
+RtlInstallFunctionTableCallback
+RtlInt64ToUnicodeString
+RtlIntegerToChar
+RtlIntegerToUnicodeString
+RtlInterlockedClearBitRun
+RtlInterlockedFlushSList
+RtlInterlockedPopEntrySList
+RtlInterlockedPushEntrySList
+RtlInterlockedPushListSList
+RtlInterlockedSetBitRun
+RtlIoDecodeMemIoResource
+RtlIoEncodeMemIoResource
+RtlIpv4AddressToStringA
+RtlIpv4AddressToStringExA
+RtlIpv4AddressToStringExW
+RtlIpv4AddressToStringW
+RtlIpv4StringToAddressA
+RtlIpv4StringToAddressExA
+RtlIpv4StringToAddressExW
+RtlIpv4StringToAddressW
+RtlIpv6AddressToStringA
+RtlIpv6AddressToStringExA
+RtlIpv6AddressToStringExW
+RtlIpv6AddressToStringW
+RtlIpv6StringToAddressA
+RtlIpv6StringToAddressExA
+RtlIpv6StringToAddressExW
+RtlIpv6StringToAddressW
+RtlIsActivationContextActive
+RtlIsCriticalSectionLocked
+RtlIsCriticalSectionLockedByThread
+RtlIsCurrentThreadAttachExempt
+RtlIsDosDeviceName_U
+RtlIsGenericTableEmpty
+RtlIsGenericTableEmptyAvl
+RtlIsNameInExpression
+RtlIsNameLegalDOS8Dot3
+RtlIsNormalizedString
+RtlIsTextUnicode
+RtlIsThreadWithinLoaderCallout
+RtlIsValidHandle
+RtlIsValidIndexHandle
+RtlIsValidLocaleName
+RtlKnownExceptionFilter
+RtlLCIDToCultureName
+RtlLargeIntegerToChar
+RtlLcidToLocaleName
+RtlLeaveCriticalSection
+RtlLengthRequiredSid
+RtlLengthSecurityDescriptor
+RtlLengthSid
+RtlLoadString
+RtlLocalTimeToSystemTime
+RtlLocaleNameToLcid
+RtlLocateExtendedFeature
+RtlLocateLegacyContext
+RtlLockBootStatusData
+RtlLockCurrentThread
+RtlLockHeap
+RtlLockMemoryBlockLookaside
+RtlLockMemoryStreamRegion
+RtlLockMemoryZone
+RtlLockModuleSection
+RtlLogStackBackTrace
+RtlLookupAtomInAtomTable
+RtlLookupElementGenericTable
+RtlLookupElementGenericTableAvl
+RtlLookupElementGenericTableFull
+RtlLookupElementGenericTableFullAvl
+RtlLookupEntryHashTable
+RtlLookupFunctionEntry
+RtlLookupFunctionTable
+RtlMakeSelfRelativeSD
+RtlMapGenericMask
+RtlMapSecurityErrorToNtStatus
+RtlMoveMemory
+RtlMultiAppendUnicodeStringBuffer
+RtlMultiByteToUnicodeN
+RtlMultiByteToUnicodeSize
+RtlMultipleAllocateHeap
+RtlMultipleFreeHeap
+RtlNewInstanceSecurityObject
+RtlNewSecurityGrantedAccess
+RtlNewSecurityObject
+RtlNewSecurityObjectEx
+RtlNewSecurityObjectWithMultipleInheritance
+RtlNormalizeProcessParams
+RtlNormalizeString
+RtlNtPathNameToDosPathName
+RtlNtStatusToDosError
+RtlNtStatusToDosErrorNoTeb
+RtlNtdllName DATA
+RtlNumberGenericTableElements
+RtlNumberGenericTableElementsAvl
+RtlNumberOfClearBits
+RtlNumberOfSetBits
+RtlNumberOfSetBitsUlongPtr
+RtlOemStringToUnicodeSize
+RtlOemStringToUnicodeString
+RtlOemToUnicodeN
+RtlOpenCurrentUser
+RtlOwnerAcesPresent
+RtlPcToFileHeader
+RtlPinAtomInAtomTable
+RtlPopFrame
+RtlPrefixString
+RtlPrefixUnicodeString
+RtlPrepareForProcessCloning
+RtlProcessFlsData
+RtlProtectHeap
+RtlPushFrame
+RtlQueryActivationContextApplicationSettings
+RtlQueryAtomInAtomTable
+RtlQueryCriticalSectionOwner
+RtlQueryDepthSList
+RtlQueryDynamicTimeZoneInformation
+RtlQueryElevationFlags
+RtlQueryEnvironmentVariable
+RtlQueryEnvironmentVariable_U
+RtlQueryHeapInformation
+RtlQueryInformationAcl
+RtlQueryInformationActivationContext
+RtlQueryInformationActiveActivationContext
+RtlQueryInterfaceMemoryStream
+RtlQueryModuleInformation
+RtlQueryPerformanceCounter
+RtlQueryPerformanceFrequency
+RtlQueryProcessBackTraceInformation
+RtlQueryProcessDebugInformation
+RtlQueryProcessHeapInformation
+RtlQueryProcessLockInformation
+RtlQueryRegistryValues
+RtlQuerySecurityObject
+RtlQueryTagHeap
+RtlQueryThreadProfiling
+RtlQueryTimeZoneInformation
+RtlQueryUmsThreadInformation
+RtlQueueApcWow64Thread
+RtlQueueWorkItem
+RtlRaiseException
+RtlRaiseStatus
+RtlRandom
+RtlRandomEx
+RtlReAllocateHeap
+RtlReadMemoryStream
+RtlReadOutOfProcessMemoryStream
+RtlReadThreadProfilingData
+RtlRealPredecessor
+RtlRealSuccessor
+RtlRegisterSecureMemoryCacheCallback
+RtlRegisterThreadWithCsrss
+RtlRegisterWait
+RtlReleaseActivationContext
+RtlReleaseMemoryStream
+RtlReleasePebLock
+RtlReleasePrivilege
+RtlReleaseRelativeName
+RtlReleaseResource
+RtlReleaseSRWLockExclusive
+RtlReleaseSRWLockShared
+RtlRemoteCall
+RtlRemoveEntryHashTable
+RtlRemovePrivileges
+RtlRemoveVectoredContinueHandler
+RtlRemoveVectoredExceptionHandler
+RtlReplaceSidInSd
+RtlReportException
+RtlReportSilentProcessExit
+RtlReportSqmEscalation
+RtlResetMemoryBlockLookaside
+RtlResetMemoryZone
+RtlResetRtlTranslations
+RtlRestoreContext
+RtlRestoreLastWin32Error
+RtlRetrieveNtUserPfn
+RtlRevertMemoryStream
+RtlRunDecodeUnicodeString
+RtlRunEncodeUnicodeString
+RtlRunOnceBeginInitialize
+RtlRunOnceComplete
+RtlRunOnceExecuteOnce
+RtlRunOnceInitialize
+RtlSecondsSince1970ToTime
+RtlSecondsSince1980ToTime
+RtlSeekMemoryStream
+RtlSelfRelativeToAbsoluteSD
+RtlSelfRelativeToAbsoluteSD2
+RtlSendMsgToSm
+RtlSetAllBits
+RtlSetAttributesSecurityDescriptor
+RtlSetBits
+RtlSetControlSecurityDescriptor
+RtlSetCriticalSectionSpinCount
+RtlSetCurrentDirectory_U
+RtlSetCurrentEnvironment
+RtlSetCurrentTransaction
+RtlSetDaclSecurityDescriptor
+RtlSetDynamicTimeZoneInformation
+RtlSetEnvironmentStrings
+RtlSetEnvironmentVar
+RtlSetEnvironmentVariable
+RtlSetExtendedFeaturesMask
+RtlSetGroupSecurityDescriptor
+RtlSetHeapInformation
+RtlSetInformationAcl
+RtlSetIoCompletionCallback
+RtlSetLastWin32Error
+RtlSetLastWin32ErrorAndNtStatusFromNtStatus
+RtlSetMemoryStreamSize
+RtlSetOwnerSecurityDescriptor
+RtlSetProcessDebugInformation
+RtlSetProcessIsCritical
+RtlSetProcessPreferredUILanguages
+RtlSetSaclSecurityDescriptor
+RtlSetSecurityDescriptorRMControl
+RtlSetSecurityObject
+RtlSetSecurityObjectEx
+RtlSetThreadErrorMode
+RtlSetThreadIsCritical
+RtlSetThreadPoolStartFunc
+RtlSetThreadPreferredUILanguages
+RtlSetTimeZoneInformation
+RtlSetTimer
+RtlSetUmsThreadInformation
+RtlSetUnhandledExceptionFilter
+RtlSetUnicodeCallouts
+RtlSetUserFlagsHeap
+RtlSetUserValueHeap
+RtlSidDominates
+RtlSidEqualLevel
+RtlSidHashInitialize
+RtlSidHashLookup
+RtlSidIsHigherLevel
+RtlSizeHeap
+RtlSleepConditionVariableCS
+RtlSleepConditionVariableSRW
+RtlSplay
+RtlStartRXact
+RtlStatMemoryStream
+RtlStringFromGUID
+RtlSubAuthorityCountSid
+RtlSubAuthoritySid
+RtlSubtreePredecessor
+RtlSubtreeSuccessor
+RtlSystemTimeToLocalTime
+RtlTestBit
+RtlTimeFieldsToTime
+RtlTimeToElapsedTimeFields
+RtlTimeToSecondsSince1970
+RtlTimeToSecondsSince1980
+RtlTimeToTimeFields
+RtlTraceDatabaseAdd
+RtlTraceDatabaseCreate
+RtlTraceDatabaseDestroy
+RtlTraceDatabaseEnumerate
+RtlTraceDatabaseFind
+RtlTraceDatabaseLock
+RtlTraceDatabaseUnlock
+RtlTraceDatabaseValidate
+RtlTryAcquirePebLock
+RtlTryAcquireSRWLockExclusive
+RtlTryAcquireSRWLockShared
+RtlTryEnterCriticalSection
+RtlUTF8ToUnicodeN
+RtlUmsThreadYield
+RtlUnhandledExceptionFilter
+RtlUnhandledExceptionFilter2
+RtlUnicodeStringToAnsiSize
+RtlUnicodeStringToAnsiString
+RtlUnicodeStringToCountedOemString
+RtlUnicodeStringToInteger
+RtlUnicodeStringToOemSize
+RtlUnicodeStringToOemString
+RtlUnicodeToCustomCPN
+RtlUnicodeToMultiByteN
+RtlUnicodeToMultiByteSize
+RtlUnicodeToOemN
+RtlUnicodeToUTF8N
+RtlUniform
+RtlUnlockBootStatusData
+RtlUnlockCurrentThread
+RtlUnlockHeap
+RtlUnlockMemoryBlockLookaside
+RtlUnlockMemoryStreamRegion
+RtlUnlockMemoryZone
+RtlUnlockModuleSection
+RtlUnwind
+RtlUnwindEx
+RtlUpcaseUnicodeChar
+RtlUpcaseUnicodeString
+RtlUpcaseUnicodeStringToAnsiString
+RtlUpcaseUnicodeStringToCountedOemString
+RtlUpcaseUnicodeStringToOemString
+RtlUpcaseUnicodeToCustomCPN
+RtlUpcaseUnicodeToMultiByteN
+RtlUpcaseUnicodeToOemN
+RtlUpdateClonedCriticalSection
+RtlUpdateClonedSRWLock
+RtlUpdateTimer
+RtlUpperChar
+RtlUpperString
+RtlUsageHeap
+RtlUserThreadStart
+RtlValidAcl
+RtlValidRelativeSecurityDescriptor
+RtlValidSecurityDescriptor
+RtlValidSid
+RtlValidateHeap
+RtlValidateProcessHeaps
+RtlValidateUnicodeString
+RtlVerifyVersionInfo
+RtlVirtualUnwind
+RtlWakeAllConditionVariable
+RtlWakeConditionVariable
+RtlWalkFrameChain
+RtlWalkHeap
+RtlWeaklyEnumerateEntryHashTable
+RtlWerpReportException
+RtlWow64CallFunction64
+RtlWow64EnableFsRedirection
+RtlWow64EnableFsRedirectionEx
+RtlWow64GetThreadContext
+RtlWow64GetThreadSelectorEntry
+RtlWow64LogMessageInEventLogger
+RtlWow64SetThreadContext
+RtlWow64SuspendThread
+RtlWriteMemoryStream
+RtlWriteRegistryValue
+RtlZeroHeap
+RtlZeroMemory
+RtlZombifyActivationContext
+RtlpApplyLengthFunction
+RtlpCheckDynamicTimeZoneInformation
+RtlpCleanupRegistryKeys
+RtlpConvertCultureNamesToLCIDs
+RtlpConvertLCIDsToCultureNames
+RtlpCreateProcessRegistryInfo
+RtlpEnsureBufferSize
+RtlpExecuteUmsThread
+RtlpGetLCIDFromLangInfoNode
+RtlpGetNameFromLangInfoNode
+RtlpGetSystemDefaultUILanguage
+RtlpGetUserOrMachineUILanguage4NLS
+RtlpInitializeLangRegistryInfo
+RtlpIsQualifiedLanguage
+RtlpLoadMachineUIByPolicy
+RtlpLoadUserUIByPolicy
+RtlpMuiFreeLangRegistryInfo
+RtlpMuiRegCreateRegistryInfo
+RtlpMuiRegFreeRegistryInfo
+RtlpMuiRegLoadRegistryInfo
+RtlpNotOwnerCriticalSection
+RtlpNtCreateKey
+RtlpNtEnumerateSubKey
+RtlpNtMakeTemporaryKey
+RtlpNtOpenKey
+RtlpNtQueryValueKey
+RtlpNtSetValueKey
+RtlpQueryDefaultUILanguage
+RtlpQueryProcessDebugInformationFromWow64
+RtlpRefreshCachedUILanguage
+RtlpSetInstallLanguage
+RtlpSetPreferredUILanguages
+RtlpSetUserPreferredUILanguages
+RtlpUmsExecuteYieldThreadEnd
+RtlpUmsThreadYield
+RtlpUnWaitCriticalSection
+RtlpVerifyAndCommitUILanguageSettings
+RtlpWaitForCriticalSection
+RtlxAnsiStringToUnicodeSize
+RtlxOemStringToUnicodeSize
+RtlxUnicodeStringToAnsiSize
+RtlxUnicodeStringToOemSize
+SbExecuteProcedure
+SbSelectProcedure
+ShipAssert
+ShipAssertGetBufferInfo
+ShipAssertMsgA
+ShipAssertMsgW
+TpAllocAlpcCompletion
+TpAllocAlpcCompletionEx
+TpAllocCleanupGroup
+TpAllocIoCompletion
+TpAllocPool
+TpAllocTimer
+TpAllocWait
+TpAllocWork
+TpAlpcRegisterCompletionList
+TpAlpcUnregisterCompletionList
+TpCallbackIndependent
+TpCallbackLeaveCriticalSectionOnCompletion
+TpCallbackMayRunLong
+TpCallbackReleaseMutexOnCompletion
+TpCallbackReleaseSemaphoreOnCompletion
+TpCallbackSetEventOnCompletion
+TpCallbackUnloadDllOnCompletion
+TpCancelAsyncIoOperation
+TpCaptureCaller
+TpCheckTerminateWorker
+TpDbgDumpHeapUsage
+TpDbgGetFreeInfo
+TpDbgSetLogRoutine
+TpDisablePoolCallbackChecks
+TpDisassociateCallback
+TpIsTimerSet
+TpPoolFreeUnusedNodes
+TpPostWork
+TpQueryPoolStackInformation
+TpReleaseAlpcCompletion
+TpReleaseCleanupGroup
+TpReleaseCleanupGroupMembers
+TpReleaseIoCompletion
+TpReleasePool
+TpReleaseTimer
+TpReleaseWait
+TpReleaseWork
+TpSetDefaultPoolMaxThreads
+TpSetDefaultPoolStackInformation
+TpSetPoolMaxThreads
+TpSetPoolMinThreads
+TpSetPoolStackInformation
+TpSetTimer
+TpSetWait
+TpSimpleTryPost
+TpStartAsyncIoOperation
+TpWaitForAlpcCompletion
+TpWaitForIoCompletion
+TpWaitForTimer
+TpWaitForWait
+TpWaitForWork
+VerSetConditionMask
+WerReportSQMEvent
+WinSqmAddToAverageDWORD
+WinSqmAddToStream
+WinSqmAddToStreamEx
+WinSqmCheckEscalationAddToStreamEx
+WinSqmCheckEscalationSetDWORD
+WinSqmCheckEscalationSetDWORD64
+WinSqmCheckEscalationSetString
+WinSqmCommonDatapointDelete
+WinSqmCommonDatapointSetDWORD
+WinSqmCommonDatapointSetDWORD64
+WinSqmCommonDatapointSetStreamEx
+WinSqmCommonDatapointSetString
+WinSqmEndSession
+WinSqmEventEnabled
+WinSqmEventWrite
+WinSqmGetEscalationRuleStatus
+WinSqmGetInstrumentationProperty
+WinSqmIncrementDWORD
+WinSqmIsOptedIn
+WinSqmIsOptedInEx
+WinSqmSetDWORD
+WinSqmSetDWORD64
+WinSqmSetEscalationInfo
+WinSqmSetIfMaxDWORD
+WinSqmSetIfMinDWORD
+WinSqmSetString
+WinSqmStartSession
+ZwAcceptConnectPort
+ZwAccessCheck
+ZwAccessCheckAndAuditAlarm
+ZwAccessCheckByType
+ZwAccessCheckByTypeAndAuditAlarm
+ZwAccessCheckByTypeResultList
+ZwAccessCheckByTypeResultListAndAuditAlarm
+ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
+ZwAddAtom
+ZwAddBootEntry
+ZwAddDriverEntry
+ZwAdjustGroupsToken
+ZwAdjustPrivilegesToken
+ZwAlertResumeThread
+ZwAlertThread
+ZwAllocateLocallyUniqueId
+ZwAllocateReserveObject
+ZwAllocateUserPhysicalPages
+ZwAllocateUuids
+ZwAllocateVirtualMemory
+ZwAlpcAcceptConnectPort
+ZwAlpcCancelMessage
+ZwAlpcConnectPort
+ZwAlpcCreatePort
+ZwAlpcCreatePortSection
+ZwAlpcCreateResourceReserve
+ZwAlpcCreateSectionView
+ZwAlpcCreateSecurityContext
+ZwAlpcDeletePortSection
+ZwAlpcDeleteResourceReserve
+ZwAlpcDeleteSectionView
+ZwAlpcDeleteSecurityContext
+ZwAlpcDisconnectPort
+ZwAlpcImpersonateClientOfPort
+ZwAlpcOpenSenderProcess
+ZwAlpcOpenSenderThread
+ZwAlpcQueryInformation
+ZwAlpcQueryInformationMessage
+ZwAlpcRevokeSecurityContext
+ZwAlpcSendWaitReceivePort
+ZwAlpcSetInformation
+ZwApphelpCacheControl
+ZwAreMappedFilesTheSame
+ZwAssignProcessToJobObject
+ZwCallbackReturn
+ZwCancelDeviceWakeupRequest
+ZwCancelIoFile
+ZwCancelIoFileEx
+ZwCancelSynchronousIoFile
+ZwCancelTimer
+ZwClearEvent
+ZwClose
+ZwCloseObjectAuditAlarm
+ZwCommitComplete
+ZwCommitEnlistment
+ZwCommitTransaction
+ZwCompactKeys
+ZwCompareTokens
+ZwCompleteConnectPort
+ZwCompressKey
+ZwConnectPort
+ZwContinue
+ZwCreateDebugObject
+ZwCreateDirectoryObject
+ZwCreateEnlistment
+ZwCreateEvent
+ZwCreateEventPair
+ZwCreateFile
+ZwCreateIoCompletion
+ZwCreateJobObject
+ZwCreateJobSet
+ZwCreateKey
+ZwCreateKeyTransacted
+ZwCreateKeyedEvent
+ZwCreateMailslotFile
+ZwCreateMutant
+ZwCreateNamedPipeFile
+ZwCreatePagingFile
+ZwCreatePort
+ZwCreatePrivateNamespace
+ZwCreateProcess
+ZwCreateProcessEx
+ZwCreateProfile
+ZwCreateProfileEx
+ZwCreateResourceManager
+ZwCreateSection
+ZwCreateSemaphore
+ZwCreateSymbolicLinkObject
+ZwCreateThread
+ZwCreateThreadEx
+ZwCreateTimer
+ZwCreateToken
+ZwCreateTransaction
+ZwCreateTransactionManager
+ZwCreateUserProcess
+ZwCreateWaitablePort
+ZwCreateWorkerFactory
+ZwDebugActiveProcess
+ZwDebugContinue
+ZwDelayExecution
+ZwDeleteAtom
+ZwDeleteBootEntry
+ZwDeleteDriverEntry
+ZwDeleteFile
+ZwDeleteKey
+ZwDeleteObjectAuditAlarm
+ZwDeletePrivateNamespace
+ZwDeleteValueKey
+ZwDeviceIoControlFile
+ZwDisableLastKnownGood
+ZwDisplayString
+ZwDrawText
+ZwDuplicateObject
+ZwDuplicateToken
+ZwEnableLastKnownGood
+ZwEnumerateBootEntries
+ZwEnumerateDriverEntries
+ZwEnumerateKey
+ZwEnumerateSystemEnvironmentValuesEx
+ZwEnumerateTransactionObject
+ZwEnumerateValueKey
+ZwExtendSection
+ZwFilterToken
+ZwFindAtom
+ZwFlushBuffersFile
+ZwFlushInstallUILanguage
+ZwFlushInstructionCache
+ZwFlushKey
+ZwFlushProcessWriteBuffers
+ZwFlushVirtualMemory
+ZwFlushWriteBuffer
+ZwFreeUserPhysicalPages
+ZwFreeVirtualMemory
+ZwFreezeRegistry
+ZwFreezeTransactions
+ZwFsControlFile
+ZwGetContextThread
+ZwGetCurrentProcessorNumber
+ZwGetDevicePowerState
+ZwGetMUIRegistryInfo
+ZwGetNextProcess
+ZwGetNextThread
+ZwGetNlsSectionPtr
+ZwGetNotificationResourceManager
+ZwGetPlugPlayEvent
+ZwGetWriteWatch
+ZwImpersonateAnonymousToken
+ZwImpersonateClientOfPort
+ZwImpersonateThread
+ZwInitializeNlsFiles
+ZwInitializeRegistry
+ZwInitiatePowerAction
+ZwIsProcessInJob
+ZwIsSystemResumeAutomatic
+ZwIsUILanguageComitted
+ZwListenPort
+ZwLoadDriver
+ZwLoadKey
+ZwLoadKey2
+ZwLoadKeyEx
+ZwLockFile
+ZwLockProductActivationKeys
+ZwLockRegistryKey
+ZwLockVirtualMemory
+ZwMakePermanentObject
+ZwMakeTemporaryObject
+ZwMapCMFModule
+ZwMapUserPhysicalPages
+ZwMapUserPhysicalPagesScatter
+ZwMapViewOfSection
+ZwModifyBootEntry
+ZwModifyDriverEntry
+ZwNotifyChangeDirectoryFile
+ZwNotifyChangeKey
+ZwNotifyChangeMultipleKeys
+ZwNotifyChangeSession
+ZwOpenDirectoryObject
+ZwOpenEnlistment
+ZwOpenEvent
+ZwOpenEventPair
+ZwOpenFile
+ZwOpenIoCompletion
+ZwOpenJobObject
+ZwOpenKey
+ZwOpenKeyEx
+ZwOpenKeyTransacted
+ZwOpenKeyTransactedEx
+ZwOpenKeyedEvent
+ZwOpenMutant
+ZwOpenObjectAuditAlarm
+ZwOpenPrivateNamespace
+ZwOpenProcess
+ZwOpenProcessToken
+ZwOpenProcessTokenEx
+ZwOpenResourceManager
+ZwOpenSection
+ZwOpenSemaphore
+ZwOpenSession
+ZwOpenSymbolicLinkObject
+ZwOpenThread
+ZwOpenThreadToken
+ZwOpenThreadTokenEx
+ZwOpenTimer
+ZwOpenTransaction
+ZwOpenTransactionManager
+ZwPlugPlayControl
+ZwPowerInformation
+ZwPrePrepareComplete
+ZwPrePrepareEnlistment
+ZwPrepareComplete
+ZwPrepareEnlistment
+ZwPrivilegeCheck
+ZwPrivilegeObjectAuditAlarm
+ZwPrivilegedServiceAuditAlarm
+ZwPropagationComplete
+ZwPropagationFailed
+ZwProtectVirtualMemory
+ZwPulseEvent
+ZwQueryAttributesFile
+ZwQueryBootEntryOrder
+ZwQueryBootOptions
+ZwQueryDebugFilterState
+ZwQueryDefaultLocale
+ZwQueryDefaultUILanguage
+ZwQueryDirectoryFile
+ZwQueryDirectoryObject
+ZwQueryDriverEntryOrder
+ZwQueryEaFile
+ZwQueryEvent
+ZwQueryFullAttributesFile
+ZwQueryInformationAtom
+ZwQueryInformationEnlistment
+ZwQueryInformationFile
+ZwQueryInformationJobObject
+ZwQueryInformationPort
+ZwQueryInformationProcess
+ZwQueryInformationResourceManager
+ZwQueryInformationThread
+ZwQueryInformationToken
+ZwQueryInformationTransaction
+ZwQueryInformationTransactionManager
+ZwQueryInformationWorkerFactory
+ZwQueryInstallUILanguage
+ZwQueryIntervalProfile
+ZwQueryIoCompletion
+ZwQueryKey
+ZwQueryLicenseValue
+ZwQueryMultipleValueKey
+ZwQueryMutant
+ZwQueryObject
+ZwQueryOpenSubKeys
+ZwQueryOpenSubKeysEx
+ZwQueryPerformanceCounter
+ZwQueryPortInformationProcess
+ZwQueryQuotaInformationFile
+ZwQuerySection
+ZwQuerySecurityAttributesToken
+ZwQuerySecurityObject
+ZwQuerySemaphore
+ZwQuerySymbolicLinkObject
+ZwQuerySystemEnvironmentValue
+ZwQuerySystemEnvironmentValueEx
+ZwQuerySystemInformation
+ZwQuerySystemInformationEx
+ZwQuerySystemTime
+ZwQueryTimer
+ZwQueryTimerResolution
+ZwQueryValueKey
+ZwQueryVirtualMemory
+ZwQueryVolumeInformationFile
+ZwQueueApcThread
+ZwQueueApcThreadEx
+ZwRaiseException
+ZwRaiseHardError
+ZwReadFile
+ZwReadFileScatter
+ZwReadOnlyEnlistment
+ZwReadRequestData
+ZwReadVirtualMemory
+ZwRecoverEnlistment
+ZwRecoverResourceManager
+ZwRecoverTransactionManager
+ZwRegisterProtocolAddressInformation
+ZwRegisterThreadTerminatePort
+ZwReleaseKeyedEvent
+ZwReleaseMutant
+ZwReleaseSemaphore
+ZwReleaseWorkerFactoryWorker
+ZwRemoveIoCompletion
+ZwRemoveIoCompletionEx
+ZwRemoveProcessDebug
+ZwRenameKey
+ZwRenameTransactionManager
+ZwReplaceKey
+ZwReplacePartitionUnit
+ZwReplyPort
+ZwReplyWaitReceivePort
+ZwReplyWaitReceivePortEx
+ZwReplyWaitReplyPort
+ZwRequestDeviceWakeup
+ZwRequestPort
+ZwRequestWaitReplyPort
+ZwRequestWakeupLatency
+ZwResetEvent
+ZwResetWriteWatch
+ZwRestoreKey
+ZwResumeProcess
+ZwResumeThread
+ZwRollbackComplete
+ZwRollbackEnlistment
+ZwRollbackTransaction
+ZwRollforwardTransactionManager
+ZwSaveKey
+ZwSaveKeyEx
+ZwSaveMergedKeys
+ZwSecureConnectPort
+ZwSerializeBoot
+ZwSetBootEntryOrder
+ZwSetBootOptions
+ZwSetContextThread
+ZwSetDebugFilterState
+ZwSetDefaultHardErrorPort
+ZwSetDefaultLocale
+ZwSetDefaultUILanguage
+ZwSetDriverEntryOrder
+ZwSetEaFile
+ZwSetEvent
+ZwSetEventBoostPriority
+ZwSetHighEventPair
+ZwSetHighWaitLowEventPair
+ZwSetInformationDebugObject
+ZwSetInformationEnlistment
+ZwSetInformationFile
+ZwSetInformationJobObject
+ZwSetInformationKey
+ZwSetInformationObject
+ZwSetInformationProcess
+ZwSetInformationResourceManager
+ZwSetInformationThread
+ZwSetInformationToken
+ZwSetInformationTransaction
+ZwSetInformationTransactionManager
+ZwSetInformationWorkerFactory
+ZwSetIntervalProfile
+ZwSetIoCompletion
+ZwSetIoCompletionEx
+ZwSetLdtEntries
+ZwSetLowEventPair
+ZwSetLowWaitHighEventPair
+ZwSetQuotaInformationFile
+ZwSetSecurityObject
+ZwSetSystemEnvironmentValue
+ZwSetSystemEnvironmentValueEx
+ZwSetSystemInformation
+ZwSetSystemPowerState
+ZwSetSystemTime
+ZwSetThreadExecutionState
+ZwSetTimer
+ZwSetTimerEx
+ZwSetTimerResolution
+ZwSetUuidSeed
+ZwSetValueKey
+ZwSetVolumeInformationFile
+ZwShutdownSystem
+ZwShutdownWorkerFactory
+ZwSignalAndWaitForSingleObject
+ZwSinglePhaseReject
+ZwStartProfile
+ZwStopProfile
+ZwSuspendProcess
+ZwSuspendThread
+ZwSystemDebugControl
+ZwTerminateJobObject
+ZwTerminateProcess
+ZwTerminateThread
+ZwTestAlert
+ZwThawRegistry
+ZwThawTransactions
+ZwTraceControl
+ZwTraceEvent
+ZwTranslateFilePath
+ZwUmsThreadYield
+ZwUnloadDriver
+ZwUnloadKey
+ZwUnloadKey2
+ZwUnloadKeyEx
+ZwUnlockFile
+ZwUnlockVirtualMemory
+ZwUnmapViewOfSection
+ZwVdmControl
+ZwWaitForDebugEvent
+ZwWaitForKeyedEvent
+ZwWaitForMultipleObjects
+ZwWaitForMultipleObjects32
+ZwWaitForSingleObject
+ZwWaitForWorkViaWorkerFactory
+ZwWaitHighEventPair
+ZwWaitLowEventPair
+ZwWorkerFactoryWorkerReady
+ZwWriteFile
+ZwWriteFileGather
+ZwWriteRequestData
+ZwWriteVirtualMemory
+ZwYieldExecution
+__C_specific_handler
+;__chkstk
+__isascii
+__iscsym
+__iscsymf
+__misaligned_access
+__toascii
+_atoi64
+_fltused DATA
+_i64toa
+_i64toa_s
+_i64tow
+_i64tow_s
+_itoa
+_itoa_s
+_itow
+_itow_s
+_lfind
+_local_unwind
+_ltoa
+_ltoa_s
+_ltow
+_ltow_s
+_makepath_s
+_memccpy
+_memicmp
+_setjmp
+_setjmpex
+_snprintf
+_snprintf_s
+_snscanf_s
+_snwprintf
+_snwprintf_s
+_snwscanf_s
+_splitpath
+_splitpath_s
+_strcmpi
+_stricmp
+_strlwr
+_strnicmp
+_strnset_s
+_strset_s
+_strupr
+_tolower
+_toupper
+_swprintf
+_ui64toa
+_ui64toa_s
+_ui64tow
+_ui64tow_s
+_ultoa
+_ultoa_s
+_ultow
+_ultow_s
+_vscwprintf
+_vsnprintf
+_vsnprintf_s
+_vsnwprintf
+_vsnwprintf_s
+_vswprintf
+_wcsicmp
+_wcslwr
+_wcsnicmp
+_wcsnset_s
+_wcsset_s
+_wcstoui64
+_wcsupr
+_wmakepath_s
+_wsplitpath_s
+_wtoi
+_wtoi64
+_wtol
+abs
+atan DATA
+atoi
+atol
+bsearch
+ceil
+cos DATA
+fabs DATA
+floor DATA
+isalnum
+isalpha
+iscntrl
+isdigit
+isgraph
+islower
+isprint
+ispunct
+isspace
+isupper
+iswalpha
+iswctype
+iswdigit
+iswlower
+iswspace
+iswxdigit
+isxdigit
+labs
+log
+longjmp DATA
+mbstowcs
+memchr
+memcmp
+memcpy
+memcpy_s
+memmove
+memmove_s
+memset
+pow
+qsort
+sin
+sprintf
+sprintf_s
+sqrt
+sscanf
+sscanf_s
+strcat
+strcat_s
+strchr
+strcmp
+strcpy
+strcpy_s
+strcspn
+strlen
+strncat
+strncat_s
+strncmp
+strncpy
+strncpy_s
+strnlen
+strpbrk
+strrchr
+strspn
+strstr
+strtok_s
+strtol
+strtoul
+swprintf
+swprintf_s
+swscanf_s
+tan
+tolower
+toupper
+towlower
+towupper
+vDbgPrintEx
+vDbgPrintExWithPrefix
+vsprintf
+vsprintf_s
+vswprintf_s
+wcscat
+wcscat_s
+wcschr
+wcscmp
+wcscpy
+wcscpy_s
+wcscspn
+wcslen
+wcsncat
+wcsncat_s
+wcsncmp
+wcsncpy
+wcsncpy_s
+wcsnlen
+wcspbrk
+wcsrchr
+wcsspn
+wcsstr
+wcstol
+wcstombs
+wcstoul
diff --git a/lib/libc/mingw/libarm32/ntdll.def b/lib/libc/mingw/libarm32/ntdll.def
new file mode 100644
index 0000000000..13099a9792
--- /dev/null
+++ b/lib/libc/mingw/libarm32/ntdll.def
@@ -0,0 +1,2165 @@
+;
+; Definition file of ntdll.dll
+; Automatic generated by gendef
+; written by Kai Tietz 2008-2014
+;
+LIBRARY "ntdll.dll"
+EXPORTS
+ord_1 @1
+ord_2 @2
+ord_3 @3
+ord_4 @4
+ord_5 @5
+ord_6 @6
+ord_7 @7
+ord_8 @8
+A_SHAFinal
+A_SHAInit
+A_SHAUpdate
+AlpcAdjustCompletionListConcurrencyCount
+AlpcFreeCompletionListMessage
+AlpcGetCompletionListLastMessageInformation
+AlpcGetCompletionListMessageAttributes
+AlpcGetHeaderSize
+AlpcGetMessageAttribute
+AlpcGetMessageFromCompletionList
+AlpcGetOutstandingCompletionListMessageCount
+AlpcInitializeMessageAttribute
+AlpcMaxAllowedMessageLength
+AlpcRegisterCompletionList
+AlpcRegisterCompletionListWorkerThread
+AlpcRundownCompletionList
+AlpcUnregisterCompletionList
+AlpcUnregisterCompletionListWorkerThread
+ApiSetQueryApiSetPresence
+CsrAllocateCaptureBuffer
+CsrAllocateMessagePointer
+CsrCaptureMessageBuffer
+CsrCaptureMessageMultiUnicodeStringsInPlace
+CsrCaptureMessageString
+CsrCaptureTimeout
+CsrClientCallServer
+CsrClientConnectToServer
+CsrFreeCaptureBuffer
+CsrGetProcessId
+CsrIdentifyAlertableThread
+CsrSetPriorityClass
+CsrVerifyRegion
+DbgBreakPoint
+DbgPrint
+DbgPrintEx
+DbgPrintReturnControlC
+DbgPrompt
+DbgQueryDebugFilterState
+DbgSetDebugFilterState
+DbgUiConnectToDbg
+DbgUiContinue
+DbgUiConvertStateChangeStructure
+DbgUiDebugActiveProcess
+DbgUiGetThreadDebugObject
+DbgUiIssueRemoteBreakin
+DbgUiRemoteBreakin
+DbgUiSetThreadDebugObject
+DbgUiStopDebugging
+DbgUiWaitStateChange
+DbgUserBreakPoint
+EtwCreateTraceInstanceId
+EtwDeliverDataBlock
+EtwEnumerateProcessRegGuids
+EtwEventActivityIdControl
+EtwEventEnabled
+EtwEventProviderEnabled
+EtwEventRegister
+EtwEventSetInformation
+EtwEventUnregister
+EtwEventWrite
+EtwEventWriteEndScenario
+EtwEventWriteEx
+EtwEventWriteFull
+EtwEventWriteNoRegistration
+EtwEventWriteStartScenario
+EtwEventWriteString
+EtwEventWriteTransfer
+EtwGetTraceEnableFlags
+EtwGetTraceEnableLevel
+EtwGetTraceLoggerHandle
+EtwLogTraceEvent
+EtwNotificationRegister
+EtwNotificationUnregister
+EtwProcessPrivateLoggerRequest
+EtwRegisterSecurityProvider
+EtwRegisterTraceGuidsA
+EtwRegisterTraceGuidsW
+EtwReplyNotification
+EtwSendNotification
+EtwSetMark
+EtwTraceEventInstance
+EtwTraceMessage
+EtwTraceMessageVa
+EtwUnregisterTraceGuids
+EtwWriteUMSecurityEvent
+EtwpCreateEtwThread
+EtwpGetCpuSpeed
+EvtIntReportAuthzEventAndSourceAsync
+EvtIntReportEventAndSourceAsync
+ExpInterlockedPopEntrySListEnd
+ExpInterlockedPopEntrySListFault
+ExpInterlockedPopEntrySListResume
+KiRaiseUserExceptionDispatcher
+KiUserApcDispatcher
+KiUserCallbackDispatcher
+KiUserExceptionDispatcher
+KiUserInvertedFunctionTable DATA
+LdrAccessResource
+LdrAddDllDirectory
+LdrAddLoadAsDataTable
+LdrAddRefDll
+LdrAppxHandleIntegrityFailure
+LdrDisableThreadCalloutsForDll
+LdrEnumResources
+LdrEnumerateLoadedModules
+LdrFindEntryForAddress
+LdrFindResourceDirectory_U
+LdrFindResourceEx_U
+LdrFindResource_U
+LdrFlushAlternateResourceModules
+LdrGetDllDirectory
+LdrGetDllFullName
+LdrGetDllHandle
+LdrGetDllHandleByMapping
+LdrGetDllHandleByName
+LdrGetDllHandleEx
+LdrGetDllPath
+LdrGetFailureData
+LdrGetFileNameFromLoadAsDataTable
+LdrGetProcedureAddress
+LdrGetProcedureAddressEx
+LdrGetProcedureAddressForCaller
+LdrInitShimEngineDynamic
+LdrInitializeThunk
+LdrLoadAlternateResourceModule
+LdrLoadAlternateResourceModuleEx
+LdrLoadDll
+LdrLockLoaderLock
+LdrOpenImageFileOptionsKey
+LdrProcessRelocationBlock
+LdrProcessRelocationBlockEx
+LdrQueryImageFileExecutionOptions
+LdrQueryImageFileExecutionOptionsEx
+LdrQueryImageFileKeyOption
+LdrQueryModuleServiceTags
+LdrQueryOptionalDelayLoadedAPI
+LdrQueryProcessModuleInformation
+LdrRegisterDllNotification
+LdrRemoveDllDirectory
+LdrRemoveLoadAsDataTable
+LdrResFindResource
+LdrResFindResourceDirectory
+LdrResGetRCConfig
+LdrResRelease
+LdrResSearchResource
+LdrResolveDelayLoadedAPI
+LdrResolveDelayLoadsFromDll
+LdrRscIsTypeExist
+LdrSetAppCompatDllRedirectionCallback
+LdrSetDefaultDllDirectories
+LdrSetDllDirectory
+LdrSetDllManifestProber
+LdrSetImplicitPathOptions
+LdrSetMUICacheType
+LdrShutdownProcess
+LdrShutdownThread
+LdrStandardizeSystemPath
+LdrSystemDllInitBlock DATA
+LdrUnloadAlternateResourceModule
+LdrUnloadAlternateResourceModuleEx
+LdrUnloadDll
+LdrUnlockLoaderLock
+LdrUnregisterDllNotification
+LdrVerifyImageMatchesChecksum
+LdrVerifyImageMatchesChecksumEx
+LdrpResGetMappingSize
+LdrpResGetResourceDirectory
+MD4Final
+MD4Init
+MD4Update
+MD5Final
+MD5Init
+MD5Update
+NlsAnsiCodePage DATA
+NlsMbCodePageTag DATA
+NlsMbOemCodePageTag DATA
+NtAcceptConnectPort
+NtAccessCheck
+NtAccessCheckAndAuditAlarm
+NtAccessCheckByType
+NtAccessCheckByTypeAndAuditAlarm
+NtAccessCheckByTypeResultList
+NtAccessCheckByTypeResultListAndAuditAlarm
+NtAccessCheckByTypeResultListAndAuditAlarmByHandle
+NtAddAtom
+NtAddAtomEx
+NtAddBootEntry
+NtAddDriverEntry
+NtAdjustGroupsToken
+NtAdjustPrivilegesToken
+NtAdjustTokenClaimsAndDeviceGroups
+NtAlertResumeThread
+NtAlertThread
+NtAlertThreadByThreadId
+NtAllocateLocallyUniqueId
+NtAllocateReserveObject
+NtAllocateUserPhysicalPages
+NtAllocateUuids
+NtAllocateVirtualMemory
+NtAlpcAcceptConnectPort
+NtAlpcCancelMessage
+NtAlpcConnectPort
+NtAlpcConnectPortEx
+NtAlpcCreatePort
+NtAlpcCreatePortSection
+NtAlpcCreateResourceReserve
+NtAlpcCreateSectionView
+NtAlpcCreateSecurityContext
+NtAlpcDeletePortSection
+NtAlpcDeleteResourceReserve
+NtAlpcDeleteSectionView
+NtAlpcDeleteSecurityContext
+NtAlpcDisconnectPort
+NtAlpcImpersonateClientOfPort
+NtAlpcOpenSenderProcess
+NtAlpcOpenSenderThread
+NtAlpcQueryInformation
+NtAlpcQueryInformationMessage
+NtAlpcRevokeSecurityContext
+NtAlpcSendWaitReceivePort
+NtAlpcSetInformation
+NtApphelpCacheControl
+NtAreMappedFilesTheSame
+NtAssignProcessToJobObject
+NtAssociateWaitCompletionPacket
+NtCallbackReturn
+NtCancelIoFile
+NtCancelIoFileEx
+NtCancelSynchronousIoFile
+NtCancelTimer
+NtCancelTimer2
+NtCancelWaitCompletionPacket
+NtClearEvent
+NtClose
+NtCloseObjectAuditAlarm
+NtCommitComplete
+NtCommitEnlistment
+NtCommitTransaction
+NtCompactKeys
+NtCompareTokens
+NtCompleteConnectPort
+NtCompressKey
+NtConnectPort
+NtContinue
+NtCreateDebugObject
+NtCreateDirectoryObject
+NtCreateDirectoryObjectEx
+NtCreateEnlistment
+NtCreateEvent
+NtCreateEventPair
+NtCreateFile
+NtCreateIRTimer
+NtCreateIoCompletion
+NtCreateJobObject
+NtCreateJobSet
+NtCreateKey
+NtCreateKeyTransacted
+NtCreateKeyedEvent
+NtCreateLowBoxToken
+NtCreateMailslotFile
+NtCreateMutant
+NtCreateNamedPipeFile
+NtCreatePagingFile
+NtCreatePort
+NtCreatePrivateNamespace
+NtCreateProcess
+NtCreateProcessEx
+NtCreateProfile
+NtCreateProfileEx
+NtCreateResourceManager
+NtCreateSection
+NtCreateSemaphore
+NtCreateSymbolicLinkObject
+NtCreateThread
+NtCreateThreadEx
+NtCreateTimer
+NtCreateTimer2
+NtCreateToken
+NtCreateTokenEx
+NtCreateTransaction
+NtCreateTransactionManager
+NtCreateUserProcess
+NtCreateWaitCompletionPacket
+NtCreateWaitablePort
+NtCreateWnfStateName
+NtCreateWorkerFactory
+NtDebugActiveProcess
+NtDebugContinue
+NtDelayExecution
+NtDeleteAtom
+NtDeleteBootEntry
+NtDeleteDriverEntry
+NtDeleteFile
+NtDeleteKey
+NtDeleteObjectAuditAlarm
+NtDeletePrivateNamespace
+NtDeleteValueKey
+NtDeleteWnfStateData
+NtDeleteWnfStateName
+NtDeviceIoControlFile
+NtDisableLastKnownGood
+NtDisplayString
+NtDrawText
+NtDuplicateObject
+NtDuplicateToken
+NtEnableLastKnownGood
+NtEnumerateBootEntries
+NtEnumerateDriverEntries
+NtEnumerateKey
+NtEnumerateSystemEnvironmentValuesEx
+NtEnumerateTransactionObject
+NtEnumerateValueKey
+NtExtendSection
+NtFilterBootOption
+NtFilterToken
+NtFilterTokenEx
+NtFindAtom
+NtFlushBuffersFile
+NtFlushBuffersFileEx
+NtFlushInstallUILanguage
+NtFlushInstructionCache
+NtFlushKey
+NtFlushProcessWriteBuffers
+NtFlushVirtualMemory
+NtFlushWriteBuffer
+NtFreeUserPhysicalPages
+NtFreeVirtualMemory
+NtFreezeRegistry
+NtFreezeTransactions
+NtFsControlFile
+NtGetCachedSigningLevel
+NtGetCompleteWnfStateSubscription
+NtGetContextThread
+NtGetCurrentProcessorNumber
+NtGetDevicePowerState
+NtGetMUIRegistryInfo
+NtGetNextProcess
+NtGetNextThread
+NtGetNlsSectionPtr
+NtGetNotificationResourceManager
+NtGetTickCount
+NtGetWriteWatch
+NtImpersonateAnonymousToken
+NtImpersonateClientOfPort
+NtImpersonateThread
+NtInitializeNlsFiles
+NtInitializeRegistry
+NtInitiatePowerAction
+NtIsProcessInJob
+NtIsSystemResumeAutomatic
+NtIsUILanguageComitted
+NtListenPort
+NtLoadDriver
+NtLoadKey
+NtLoadKey2
+NtLoadKeyEx
+NtLockFile
+NtLockProductActivationKeys
+NtLockRegistryKey
+NtLockVirtualMemory
+NtMakePermanentObject
+NtMakeTemporaryObject
+NtMapCMFModule
+NtMapUserPhysicalPages
+NtMapUserPhysicalPagesScatter
+NtMapViewOfSection
+NtModifyBootEntry
+NtModifyDriverEntry
+NtNotifyChangeDirectoryFile
+NtNotifyChangeKey
+NtNotifyChangeMultipleKeys
+NtNotifyChangeSession
+NtOpenDirectoryObject
+NtOpenEnlistment
+NtOpenEvent
+NtOpenEventPair
+NtOpenFile
+NtOpenIoCompletion
+NtOpenJobObject
+NtOpenKey
+NtOpenKeyEx
+NtOpenKeyTransacted
+NtOpenKeyTransactedEx
+NtOpenKeyedEvent
+NtOpenMutant
+NtOpenObjectAuditAlarm
+NtOpenPrivateNamespace
+NtOpenProcess
+NtOpenProcessToken
+NtOpenProcessTokenEx
+NtOpenResourceManager
+NtOpenSection
+NtOpenSemaphore
+NtOpenSession
+NtOpenSymbolicLinkObject
+NtOpenThread
+NtOpenThreadToken
+NtOpenThreadTokenEx
+NtOpenTimer
+NtOpenTransaction
+NtOpenTransactionManager
+NtPlugPlayControl
+NtPowerInformation
+NtPrePrepareComplete
+NtPrePrepareEnlistment
+NtPrepareComplete
+NtPrepareEnlistment
+NtPrivilegeCheck
+NtPrivilegeObjectAuditAlarm
+NtPrivilegedServiceAuditAlarm
+NtPropagationComplete
+NtPropagationFailed
+NtProtectVirtualMemory
+NtPulseEvent
+NtQueryAttributesFile
+NtQueryBootEntryOrder
+NtQueryBootOptions
+NtQueryDebugFilterState
+NtQueryDefaultLocale
+NtQueryDefaultUILanguage
+NtQueryDirectoryFile
+NtQueryDirectoryObject
+NtQueryDriverEntryOrder
+NtQueryEaFile
+NtQueryEvent
+NtQueryFullAttributesFile
+NtQueryInformationAtom
+NtQueryInformationEnlistment
+NtQueryInformationFile
+NtQueryInformationJobObject
+NtQueryInformationPort
+NtQueryInformationProcess
+NtQueryInformationResourceManager
+NtQueryInformationThread
+NtQueryInformationToken
+NtQueryInformationTransaction
+NtQueryInformationTransactionManager
+NtQueryInformationWorkerFactory
+NtQueryInstallUILanguage
+NtQueryIntervalProfile
+NtQueryIoCompletion
+NtQueryKey
+NtQueryLicenseValue
+NtQueryMultipleValueKey
+NtQueryMutant
+NtQueryObject
+NtQueryOpenSubKeys
+NtQueryOpenSubKeysEx
+NtQueryPerformanceCounter
+NtQueryPortInformationProcess
+NtQueryQuotaInformationFile
+NtQuerySection
+NtQuerySecurityAttributesToken
+NtQuerySecurityObject
+NtQuerySemaphore
+NtQuerySymbolicLinkObject
+NtQuerySystemEnvironmentValue
+NtQuerySystemEnvironmentValueEx
+NtQuerySystemInformation
+NtQuerySystemInformationEx
+NtQuerySystemTime
+NtQueryTimer
+NtQueryTimerResolution
+NtQueryValueKey
+NtQueryVirtualMemory
+NtQueryVolumeInformationFile
+NtQueryWnfStateData
+NtQueryWnfStateNameInformation
+NtQueueApcThread
+NtQueueApcThreadEx
+NtRaiseException
+NtRaiseHardError
+NtReadFile
+NtReadFileScatter
+NtReadOnlyEnlistment
+NtReadRequestData
+NtReadVirtualMemory
+NtRecoverEnlistment
+NtRecoverResourceManager
+NtRecoverTransactionManager
+NtRegisterProtocolAddressInformation
+NtRegisterThreadTerminatePort
+NtReleaseKeyedEvent
+NtReleaseMutant
+NtReleaseSemaphore
+NtReleaseWorkerFactoryWorker
+NtRemoveIoCompletion
+NtRemoveIoCompletionEx
+NtRemoveProcessDebug
+NtRenameKey
+NtRenameTransactionManager
+NtReplaceKey
+NtReplacePartitionUnit
+NtReplyPort
+NtReplyWaitReceivePort
+NtReplyWaitReceivePortEx
+NtReplyWaitReplyPort
+NtRequestPort
+NtRequestWaitReplyPort
+NtResetEvent
+NtResetWriteWatch
+NtRestoreKey
+NtResumeProcess
+NtResumeThread
+NtRollbackComplete
+NtRollbackEnlistment
+NtRollbackTransaction
+NtRollforwardTransactionManager
+NtSaveKey
+NtSaveKeyEx
+NtSaveMergedKeys
+NtSecureConnectPort
+NtSerializeBoot
+NtSetBootEntryOrder
+NtSetBootOptions
+NtSetCachedSigningLevel
+NtSetContextThread
+NtSetDebugFilterState
+NtSetDefaultHardErrorPort
+NtSetDefaultLocale
+NtSetDefaultUILanguage
+NtSetDriverEntryOrder
+NtSetEaFile
+NtSetEvent
+NtSetEventBoostPriority
+NtSetHighEventPair
+NtSetHighWaitLowEventPair
+NtSetIRTimer
+NtSetInformationDebugObject
+NtSetInformationEnlistment
+NtSetInformationFile
+NtSetInformationJobObject
+NtSetInformationKey
+NtSetInformationObject
+NtSetInformationProcess
+NtSetInformationResourceManager
+NtSetInformationThread
+NtSetInformationToken
+NtSetInformationTransaction
+NtSetInformationTransactionManager
+NtSetInformationVirtualMemory
+NtSetInformationWorkerFactory
+NtSetIntervalProfile
+NtSetIoCompletion
+NtSetIoCompletionEx
+NtSetLdtEntries
+NtSetLowEventPair
+NtSetLowWaitHighEventPair
+NtSetQuotaInformationFile
+NtSetSecurityObject
+NtSetSystemEnvironmentValue
+NtSetSystemEnvironmentValueEx
+NtSetSystemInformation
+NtSetSystemPowerState
+NtSetSystemTime
+NtSetThreadExecutionState
+NtSetTimer
+NtSetTimer2
+NtSetTimerEx
+NtSetTimerResolution
+NtSetUuidSeed
+NtSetValueKey
+NtSetVolumeInformationFile
+NtSetWnfProcessNotificationEvent
+NtShutdownSystem
+NtShutdownWorkerFactory
+NtSignalAndWaitForSingleObject
+NtSinglePhaseReject
+NtStartProfile
+NtStopProfile
+NtSubscribeWnfStateChange
+NtSuspendProcess
+NtSuspendThread
+NtSystemDebugControl
+NtTerminateJobObject
+NtTerminateProcess
+NtTerminateThread
+NtTestAlert
+NtThawRegistry
+NtThawTransactions
+NtTraceControl
+NtTraceEvent
+NtTranslateFilePath
+NtUmsThreadYield
+NtUnloadDriver
+NtUnloadKey
+NtUnloadKey2
+NtUnloadKeyEx
+NtUnlockFile
+NtUnlockVirtualMemory
+NtUnmapViewOfSection
+NtUnmapViewOfSectionEx
+NtUnsubscribeWnfStateChange
+NtUpdateWnfStateData
+NtVdmControl
+NtWaitForAlertByThreadId
+NtWaitForDebugEvent
+NtWaitForKeyedEvent
+NtWaitForMultipleObjects
+NtWaitForMultipleObjects32
+NtWaitForSingleObject
+NtWaitForWorkViaWorkerFactory
+NtWaitHighEventPair
+NtWaitLowEventPair
+NtWorkerFactoryWorkerReady
+NtWriteFile
+NtWriteFileGather
+NtWriteRequestData
+NtWriteVirtualMemory
+NtYieldExecution
+NtdllDefWindowProc_A
+NtdllDefWindowProc_W
+NtdllDialogWndProc_A
+NtdllDialogWndProc_W
+PfxFindPrefix
+PfxInitialize
+PfxInsertPrefix
+PfxRemovePrefix
+PssNtCaptureSnapshot
+PssNtDuplicateSnapshot
+PssNtFreeRemoteSnapshot
+PssNtFreeSnapshot
+PssNtFreeWalkMarker
+PssNtQuerySnapshot
+PssNtValidateDescriptor
+PssNtWalkSnapshot
+ReadTimeStampCounter
+RtlAbortRXact
+RtlAbsoluteToSelfRelativeSD
+RtlAcquirePebLock
+RtlAcquirePrivilege
+RtlAcquireReleaseSRWLockExclusive
+RtlAcquireResourceExclusive
+RtlAcquireResourceShared
+RtlAcquireSRWLockExclusive
+RtlAcquireSRWLockShared
+RtlActivateActivationContext
+RtlActivateActivationContextEx
+RtlActivateActivationContextUnsafeFast
+RtlAddAccessAllowedAce
+RtlAddAccessAllowedAceEx
+RtlAddAccessAllowedObjectAce
+RtlAddAccessDeniedAce
+RtlAddAccessDeniedAceEx
+RtlAddAccessDeniedObjectAce
+RtlAddAce
+RtlAddActionToRXact
+RtlAddAtomToAtomTable
+RtlAddAttributeActionToRXact
+RtlAddAuditAccessAce
+RtlAddAuditAccessAceEx
+RtlAddAuditAccessObjectAce
+RtlAddCompoundAce
+RtlAddFunctionTable
+RtlAddGrowableFunctionTable
+RtlAddIntegrityLabelToBoundaryDescriptor
+RtlAddMandatoryAce
+RtlAddProcessTrustLabelAce
+RtlAddRefActivationContext
+RtlAddRefMemoryStream
+RtlAddResourceAttributeAce
+RtlAddSIDToBoundaryDescriptor
+RtlAddScopedPolicyIDAce
+RtlAddVectoredContinueHandler
+RtlAddVectoredExceptionHandler
+RtlAddressInSectionTable
+RtlAdjustPrivilege
+RtlAllocateActivationContextStack
+RtlAllocateAndInitializeSid
+RtlAllocateAndInitializeSidEx
+RtlAllocateHandle
+RtlAllocateHeap
+RtlAllocateMemoryBlockLookaside
+RtlAllocateMemoryZone
+RtlAllocateWnfSerializationGroup
+RtlAnsiCharToUnicodeChar
+RtlAnsiStringToUnicodeSize
+RtlAnsiStringToUnicodeString
+RtlAppendAsciizToString
+RtlAppendPathElement
+RtlAppendStringToString
+RtlAppendUnicodeStringToString
+RtlAppendUnicodeToString
+RtlApplicationVerifierStop
+RtlApplyRXact
+RtlApplyRXactNoFlush
+RtlAppxIsFileOwnedByTrustedInstaller
+RtlAreAllAccessesGranted
+RtlAreAnyAccessesGranted
+RtlAreBitsClear
+RtlAreBitsSet
+RtlAssert
+RtlAvlInsertNodeEx
+RtlAvlRemoveNode
+RtlBarrier
+RtlBarrierForDelete
+RtlCancelTimer
+RtlCanonicalizeDomainName
+RtlCaptureContext
+RtlCaptureStackBackTrace
+RtlCharToInteger
+RtlCheckForOrphanedCriticalSections
+RtlCheckPortableOperatingSystem
+RtlCheckRegistryKey
+RtlCheckTokenCapability
+RtlCheckTokenMembership
+RtlCheckTokenMembershipEx
+RtlCleanUpTEBLangLists
+RtlClearAllBits
+RtlClearBit
+RtlClearBits
+RtlCloneMemoryStream
+RtlCloneUserProcess
+RtlCmDecodeMemIoResource
+RtlCmEncodeMemIoResource
+RtlCommitDebugInfo
+RtlCommitMemoryStream
+RtlCompactHeap
+RtlCompareAltitudes
+RtlCompareMemory
+RtlCompareMemoryUlong
+RtlCompareString
+RtlCompareUnicodeString
+RtlCompareUnicodeStrings
+RtlCompressBuffer
+RtlComputeCrc32
+RtlComputeImportTableHash
+RtlComputePrivatizedDllName_U
+RtlConnectToSm
+RtlConsoleMultiByteToUnicodeN
+RtlContractHashTable
+RtlConvertExclusiveToShared
+RtlConvertLCIDToString
+RtlConvertSharedToExclusive
+RtlConvertSidToUnicodeString
+RtlConvertToAutoInheritSecurityObject
+RtlCopyBitMap
+RtlCopyContext
+RtlCopyExtendedContext
+RtlCopyLuid
+RtlCopyLuidAndAttributesArray
+RtlCopyMappedMemory
+RtlCopyMemory
+RtlCopyMemoryStreamTo
+RtlCopyOutOfProcessMemoryStreamTo
+RtlCopySecurityDescriptor
+RtlCopySid
+RtlCopySidAndAttributesArray
+RtlCopyString
+RtlCopyUnicodeString
+RtlCrc32
+RtlCrc64
+RtlCreateAcl
+RtlCreateActivationContext
+RtlCreateAndSetSD
+RtlCreateAtomTable
+RtlCreateBootStatusDataFile
+RtlCreateBoundaryDescriptor
+RtlCreateEnvironment
+RtlCreateEnvironmentEx
+RtlCreateHashTable
+RtlCreateHashTableEx
+RtlCreateHeap
+RtlCreateMemoryBlockLookaside
+RtlCreateMemoryZone
+RtlCreateProcessParameters
+RtlCreateProcessParametersEx
+RtlCreateProcessReflection
+RtlCreateQueryDebugBuffer
+RtlCreateRegistryKey
+RtlCreateSecurityDescriptor
+RtlCreateServiceSid
+RtlCreateSystemVolumeInformationFolder
+RtlCreateTagHeap
+RtlCreateTimer
+RtlCreateTimerQueue
+RtlCreateUnicodeString
+RtlCreateUnicodeStringFromAsciiz
+RtlCreateUserProcess
+RtlCreateUserSecurityObject
+RtlCreateUserStack
+RtlCreateUserThread
+RtlCreateVirtualAccountSid
+RtlCultureNameToLCID
+RtlCustomCPToUnicodeN
+RtlCutoverTimeToSystemTime
+RtlDeCommitDebugInfo
+RtlDeNormalizeProcessParams
+RtlDeactivateActivationContext
+RtlDeactivateActivationContextUnsafeFast
+RtlDebugPrintTimes
+RtlDecodePointer
+RtlDecodeSystemPointer
+RtlDecompressBuffer
+RtlDecompressBufferEx
+RtlDecompressFragment
+RtlDefaultNpAcl
+RtlDelete
+RtlDeleteAce
+RtlDeleteAtomFromAtomTable
+RtlDeleteBarrier
+RtlDeleteBoundaryDescriptor
+RtlDeleteCriticalSection
+RtlDeleteElementGenericTable
+RtlDeleteElementGenericTableAvl
+RtlDeleteElementGenericTableAvlEx
+RtlDeleteFunctionTable
+RtlDeleteGrowableFunctionTable
+RtlDeleteHashTable
+RtlDeleteNoSplay
+RtlDeleteRegistryValue
+RtlDeleteResource
+RtlDeleteSecurityObject
+RtlDeleteTimer
+RtlDeleteTimerQueue
+RtlDeleteTimerQueueEx
+RtlDeregisterSecureMemoryCacheCallback
+RtlDeregisterWait
+RtlDeregisterWaitEx
+RtlDestroyAtomTable
+RtlDestroyEnvironment
+RtlDestroyHandleTable
+RtlDestroyHeap
+RtlDestroyMemoryBlockLookaside
+RtlDestroyMemoryZone
+RtlDestroyProcessParameters
+RtlDestroyQueryDebugBuffer
+RtlDetectHeapLeaks
+RtlDetermineDosPathNameType_U
+RtlDisableThreadProfiling
+RtlDllShutdownInProgress
+RtlDnsHostNameToComputerName
+RtlDoesFileExists_U
+RtlDosApplyFileIsolationRedirection_Ustr
+RtlDosPathNameToNtPathName_U
+RtlDosPathNameToNtPathName_U_WithStatus
+RtlDosPathNameToRelativeNtPathName_U
+RtlDosPathNameToRelativeNtPathName_U_WithStatus
+RtlDosSearchPath_U
+RtlDosSearchPath_Ustr
+RtlDowncaseUnicodeChar
+RtlDowncaseUnicodeString
+RtlDumpResource
+RtlDuplicateUnicodeString
+RtlEmptyAtomTable
+RtlEnableEarlyCriticalSectionEventCreation
+RtlEnableThreadProfiling
+RtlEncodePointer
+RtlEncodeSystemPointer
+RtlEndEnumerationHashTable
+RtlEndWeakEnumerationHashTable
+RtlEnterCriticalSection
+RtlEnumProcessHeaps
+RtlEnumerateEntryHashTable
+RtlEnumerateGenericTable
+RtlEnumerateGenericTableAvl
+RtlEnumerateGenericTableLikeADirectory
+RtlEnumerateGenericTableWithoutSplaying
+RtlEnumerateGenericTableWithoutSplayingAvl
+RtlEqualComputerName
+RtlEqualDomainName
+RtlEqualLuid
+RtlEqualPrefixSid
+RtlEqualSid
+RtlEqualString
+RtlEqualUnicodeString
+RtlEqualWnfChangeStamps
+RtlEraseUnicodeString
+RtlEthernetAddressToStringA
+RtlEthernetAddressToStringW
+RtlEthernetStringToAddressA
+RtlEthernetStringToAddressW
+RtlExitUserProcess
+RtlExitUserThread
+RtlExpandEnvironmentStrings
+RtlExpandEnvironmentStrings_U
+RtlExpandHashTable
+RtlExtendMemoryBlockLookaside
+RtlExtendMemoryZone
+RtlExtendedMagicDivide
+RtlExtractBitMap
+RtlFillMemory
+RtlFillMemoryUlong
+RtlFillMemoryUlonglong
+RtlFinalReleaseOutOfProcessMemoryStream
+RtlFindAceByType
+RtlFindActivationContextSectionGuid
+RtlFindActivationContextSectionString
+RtlFindCharInUnicodeString
+RtlFindClearBits
+RtlFindClearBitsAndSet
+RtlFindClearRuns
+RtlFindClosestEncodableLength
+RtlFindLastBackwardRunClear
+RtlFindLeastSignificantBit
+RtlFindLongestRunClear
+RtlFindMessage
+RtlFindMostSignificantBit
+RtlFindNextForwardRunClear
+RtlFindSetBits
+RtlFindSetBitsAndClear
+RtlFirstEntrySList
+RtlFirstFreeAce
+RtlFlsAlloc
+RtlFlsFree
+RtlFlushHeaps
+RtlFlushSecureMemoryCache
+RtlFormatCurrentUserKeyPath
+RtlFormatMessage
+RtlFormatMessageEx
+RtlFreeActivationContextStack
+RtlFreeAnsiString
+RtlFreeHandle
+RtlFreeHeap
+RtlFreeMemoryBlockLookaside
+RtlFreeOemString
+RtlFreeSid
+RtlFreeThreadActivationContextStack
+RtlFreeUnicodeString
+RtlFreeUserStack
+RtlGUIDFromString
+RtlGenerate8dot3Name
+RtlGetAce
+RtlGetActiveActivationContext
+RtlGetAppContainerNamedObjectPath
+RtlGetAppContainerParent
+RtlGetAppContainerSidType
+RtlGetCallersAddress
+RtlGetCompressionWorkSpaceSize
+RtlGetControlSecurityDescriptor
+RtlGetCriticalSectionRecursionCount
+RtlGetCurrentDirectory_U
+RtlGetCurrentPeb
+RtlGetCurrentProcessorNumber
+RtlGetCurrentProcessorNumberEx
+RtlGetCurrentTransaction
+RtlGetDaclSecurityDescriptor
+RtlGetElementGenericTable
+RtlGetElementGenericTableAvl
+RtlGetEnabledExtendedFeatures
+RtlGetExePath
+RtlGetExtendedContextLength
+RtlGetExtendedFeaturesMask
+RtlGetFileMUIPath
+RtlGetFrame
+RtlGetFullPathName_U
+RtlGetFullPathName_UEx
+RtlGetFullPathName_UstrEx
+RtlGetFunctionTableListHead
+RtlGetGroupSecurityDescriptor
+RtlGetIntegerAtom
+RtlGetLastNtStatus
+RtlGetLastWin32Error
+RtlGetLengthWithoutLastFullDosOrNtPathElement
+RtlGetLengthWithoutTrailingPathSeperators
+RtlGetLocaleFileMappingAddress
+RtlGetLongestNtPathLength
+RtlGetNativeSystemInformation
+RtlGetNextEntryHashTable
+RtlGetNtGlobalFlags
+RtlGetNtProductType
+RtlGetNtVersionNumbers
+RtlGetOwnerSecurityDescriptor
+RtlGetParentLocaleName
+RtlGetProcessHeaps
+RtlGetProcessPreferredUILanguages
+RtlGetProductInfo
+RtlGetSaclSecurityDescriptor
+RtlGetSearchPath
+RtlGetSecurityDescriptorRMControl
+RtlGetSetBootStatusData
+RtlGetSystemPreferredUILanguages
+RtlGetSystemTimePrecise
+RtlGetThreadErrorMode
+RtlGetThreadLangIdByIndex
+RtlGetThreadPreferredUILanguages
+RtlGetUILanguageInfo
+RtlGetUnloadEventTrace
+RtlGetUnloadEventTraceEx
+RtlGetUserInfoHeap
+RtlGetUserPreferredUILanguages
+RtlGetVersion
+RtlGrowFunctionTable
+RtlHashUnicodeString
+RtlHeapTrkInitialize
+RtlIdentifierAuthoritySid
+RtlIdnToAscii
+RtlIdnToNameprepUnicode
+RtlIdnToUnicode
+RtlImageDirectoryEntryToData
+RtlImageNtHeader
+RtlImageNtHeaderEx
+RtlImageRvaToSection
+RtlImageRvaToVa
+RtlImpersonateSelf
+RtlImpersonateSelfEx
+RtlInitAnsiString
+RtlInitAnsiStringEx
+RtlInitBarrier
+RtlInitCodePageTable
+RtlInitEnumerationHashTable
+RtlInitMemoryStream
+RtlInitNlsTables
+RtlInitOutOfProcessMemoryStream
+RtlInitString
+RtlInitUnicodeString
+RtlInitUnicodeStringEx
+RtlInitWeakEnumerationHashTable
+RtlInitializeAtomPackage
+RtlInitializeBitMap
+RtlInitializeConditionVariable
+RtlInitializeContext
+RtlInitializeCriticalSection
+RtlInitializeCriticalSectionAndSpinCount
+RtlInitializeCriticalSectionEx
+RtlInitializeExtendedContext
+RtlInitializeGenericTable
+RtlInitializeGenericTableAvl
+RtlInitializeHandleTable
+RtlInitializeNtUserPfn
+RtlInitializeRXact
+RtlInitializeResource
+RtlInitializeSListHead
+RtlInitializeSRWLock
+RtlInitializeSid
+RtlInsertElementGenericTable
+RtlInsertElementGenericTableAvl
+RtlInsertElementGenericTableFull
+RtlInsertElementGenericTableFullAvl
+RtlInsertEntryHashTable
+RtlInstallFunctionTableCallback
+RtlInt64ToUnicodeString
+RtlIntegerToChar
+RtlIntegerToUnicodeString
+RtlInterlockedClearBitRun
+RtlInterlockedFlushSList
+RtlInterlockedPopEntrySList
+RtlInterlockedPushEntrySList
+RtlInterlockedPushListSList
+RtlInterlockedPushListSListEx
+RtlInterlockedSetBitRun
+RtlIoDecodeMemIoResource
+RtlIoEncodeMemIoResource
+RtlIpv4AddressToStringA
+RtlIpv4AddressToStringExA
+RtlIpv4AddressToStringExW
+RtlIpv4AddressToStringW
+RtlIpv4StringToAddressA
+RtlIpv4StringToAddressExA
+RtlIpv4StringToAddressExW
+RtlIpv4StringToAddressW
+RtlIpv6AddressToStringA
+RtlIpv6AddressToStringExA
+RtlIpv6AddressToStringExW
+RtlIpv6AddressToStringW
+RtlIpv6StringToAddressA
+RtlIpv6StringToAddressExA
+RtlIpv6StringToAddressExW
+RtlIpv6StringToAddressW
+RtlIsActivationContextActive
+RtlIsCapabilitySid
+RtlIsCriticalSectionLocked
+RtlIsCriticalSectionLockedByThread
+RtlIsCurrentThreadAttachExempt
+RtlIsDosDeviceName_U
+RtlIsGenericTableEmpty
+RtlIsGenericTableEmptyAvl
+RtlIsNameInExpression
+RtlIsNameLegalDOS8Dot3
+RtlIsNormalizedString
+RtlIsPackageSid
+RtlIsParentOfChildAppContainer
+RtlIsTextUnicode
+RtlIsThreadWithinLoaderCallout
+RtlIsUntrustedObject
+RtlIsValidHandle
+RtlIsValidIndexHandle
+RtlIsValidLocaleName
+RtlIsValidProcessTrustLabelSid
+RtlKnownExceptionFilter
+RtlLCIDToCultureName
+RtlLargeIntegerToChar
+RtlLcidToLocaleName
+RtlLeaveCriticalSection
+RtlLengthRequiredSid
+RtlLengthSecurityDescriptor
+RtlLengthSid
+RtlLengthSidAsUnicodeString
+RtlLoadString
+RtlLocalTimeToSystemTime
+RtlLocaleNameToLcid
+RtlLocateExtendedFeature
+RtlLocateLegacyContext
+RtlLockBootStatusData
+RtlLockCurrentThread
+RtlLockHeap
+RtlLockMemoryBlockLookaside
+RtlLockMemoryStreamRegion
+RtlLockMemoryZone
+RtlLockModuleSection
+RtlLogStackBackTrace
+RtlLookupAtomInAtomTable
+RtlLookupElementGenericTable
+RtlLookupElementGenericTableAvl
+RtlLookupElementGenericTableFull
+RtlLookupElementGenericTableFullAvl
+RtlLookupEntryHashTable
+RtlLookupFunctionEntry
+RtlLookupFunctionTable
+RtlMakeSelfRelativeSD
+RtlMapGenericMask
+RtlMapSecurityErrorToNtStatus
+RtlMoveMemory
+RtlMultiAppendUnicodeStringBuffer
+RtlMultiByteToUnicodeN
+RtlMultiByteToUnicodeSize
+RtlMultipleAllocateHeap
+RtlMultipleFreeHeap
+RtlNewInstanceSecurityObject
+RtlNewSecurityGrantedAccess
+RtlNewSecurityObject
+RtlNewSecurityObjectEx
+RtlNewSecurityObjectWithMultipleInheritance
+RtlNormalizeProcessParams
+RtlNormalizeString
+RtlNtPathNameToDosPathName
+RtlNtStatusToDosError
+RtlNtStatusToDosErrorNoTeb
+RtlNumberGenericTableElements
+RtlNumberGenericTableElementsAvl
+RtlNumberOfClearBits
+RtlNumberOfClearBitsInRange
+RtlNumberOfSetBits
+RtlNumberOfSetBitsInRange
+RtlNumberOfSetBitsUlongPtr
+RtlOemStringToUnicodeSize
+RtlOemStringToUnicodeString
+RtlOemToUnicodeN
+RtlOpenCurrentUser
+RtlOwnerAcesPresent
+RtlPcToFileHeader
+RtlPinAtomInAtomTable
+RtlPopFrame
+RtlPrefixString
+RtlPrefixUnicodeString
+RtlProcessFlsData
+RtlProtectHeap
+RtlPublishWnfStateData
+RtlPushFrame
+RtlQueryActivationContextApplicationSettings
+RtlQueryAtomInAtomTable
+RtlQueryCriticalSectionOwner
+RtlQueryDepthSList
+RtlQueryDynamicTimeZoneInformation
+RtlQueryElevationFlags
+RtlQueryEnvironmentVariable
+RtlQueryEnvironmentVariable_U
+RtlQueryHeapInformation
+RtlQueryInformationAcl
+RtlQueryInformationActivationContext
+RtlQueryInformationActiveActivationContext
+RtlQueryInterfaceMemoryStream
+RtlQueryModuleInformation
+RtlQueryPackageIdentity
+RtlQueryPackageIdentityEx
+RtlQueryPerformanceCounter
+RtlQueryPerformanceFrequency
+RtlQueryProcessBackTraceInformation
+RtlQueryProcessDebugInformation
+RtlQueryProcessHeapInformation
+RtlQueryProcessLockInformation
+RtlQueryRegistryValues
+RtlQueryRegistryValuesEx
+RtlQueryResourcePolicy
+RtlQuerySecurityObject
+RtlQueryTagHeap
+RtlQueryThreadProfiling
+RtlQueryTimeZoneInformation
+RtlQueryUnbiasedInterruptTime
+RtlQueryValidationRunlevel
+RtlQueryWnfMetaNotification
+RtlQueryWnfStateData
+RtlQueryWnfStateDataWithExplicitScope
+RtlQueueApcWow64Thread
+RtlQueueWorkItem
+RtlRaiseException
+RtlRaiseStatus
+RtlRandom
+RtlRandomEx
+RtlRbInsertNodeEx
+RtlRbRemoveNode
+RtlReAllocateHeap
+RtlReadMemoryStream
+RtlReadOutOfProcessMemoryStream
+RtlReadThreadProfilingData
+RtlRealPredecessor
+RtlRealSuccessor
+RtlRegisterForWnfMetaNotification
+RtlRegisterSecureMemoryCacheCallback
+RtlRegisterThreadWithCsrss
+RtlRegisterWait
+RtlReleaseActivationContext
+RtlReleaseMemoryStream
+RtlReleasePath
+RtlReleasePebLock
+RtlReleasePrivilege
+RtlReleaseRelativeName
+RtlReleaseResource
+RtlReleaseSRWLockExclusive
+RtlReleaseSRWLockShared
+RtlRemoteCall
+RtlRemoveEntryHashTable
+RtlRemovePrivileges
+RtlRemoveVectoredContinueHandler
+RtlRemoveVectoredExceptionHandler
+RtlReplaceSidInSd
+RtlReportException
+RtlReportSilentProcessExit
+RtlReportSqmEscalation
+RtlResetMemoryBlockLookaside
+RtlResetMemoryZone
+RtlResetNtUserPfn
+RtlResetRtlTranslations
+RtlRestoreContext
+RtlRestoreLastWin32Error
+RtlRetrieveNtUserPfn
+RtlRevertMemoryStream
+RtlRunDecodeUnicodeString
+RtlRunEncodeUnicodeString
+RtlRunOnceBeginInitialize
+RtlRunOnceComplete
+RtlRunOnceExecuteOnce
+RtlRunOnceInitialize
+RtlSecondsSince1970ToTime
+RtlSecondsSince1980ToTime
+RtlSeekMemoryStream
+RtlSelfRelativeToAbsoluteSD
+RtlSelfRelativeToAbsoluteSD2
+RtlSendMsgToSm
+RtlSetAllBits
+RtlSetAttributesSecurityDescriptor
+RtlSetBit
+RtlSetBits
+RtlSetControlSecurityDescriptor
+RtlSetCriticalSectionSpinCount
+RtlSetCurrentDirectory_U
+RtlSetCurrentEnvironment
+RtlSetCurrentTransaction
+RtlSetDaclSecurityDescriptor
+RtlSetDynamicTimeZoneInformation
+RtlSetEnvironmentStrings
+RtlSetEnvironmentVar
+RtlSetEnvironmentVariable
+RtlSetExtendedFeaturesMask
+RtlSetGroupSecurityDescriptor
+RtlSetHeapInformation
+RtlSetInformationAcl
+RtlSetIoCompletionCallback
+RtlSetLastWin32Error
+RtlSetLastWin32ErrorAndNtStatusFromNtStatus
+RtlSetMemoryStreamSize
+RtlSetOwnerSecurityDescriptor
+RtlSetPortableOperatingSystem
+RtlSetProcessDebugInformation
+RtlSetProcessIsCritical
+RtlSetProcessPreferredUILanguages
+RtlSetSaclSecurityDescriptor
+RtlSetSearchPathMode
+RtlSetSecurityDescriptorRMControl
+RtlSetSecurityObject
+RtlSetSecurityObjectEx
+RtlSetThreadErrorMode
+RtlSetThreadIsCritical
+RtlSetThreadPoolStartFunc
+RtlSetThreadPreferredUILanguages
+RtlSetTimeZoneInformation
+RtlSetTimer
+RtlSetUnhandledExceptionFilter
+RtlSetUserFlagsHeap
+RtlSetUserValueHeap
+RtlSidDominates
+RtlSidDominatesForTrust
+RtlSidEqualLevel
+RtlSidHashInitialize
+RtlSidHashLookup
+RtlSidIsHigherLevel
+RtlSizeHeap
+RtlSleepConditionVariableCS
+RtlSleepConditionVariableSRW
+RtlSplay
+RtlStartRXact
+RtlStatMemoryStream
+RtlStringFromGUID
+RtlStringFromGUIDEx
+RtlSubAuthorityCountSid
+RtlSubAuthoritySid
+RtlSubscribeWnfStateChangeNotification
+RtlSubtreePredecessor
+RtlSubtreeSuccessor
+RtlSystemTimeToLocalTime
+RtlTestAndPublishWnfStateData
+RtlTestBit
+RtlTestProtectedAccess
+RtlTimeFieldsToTime
+RtlTimeToElapsedTimeFields
+RtlTimeToSecondsSince1970
+RtlTimeToSecondsSince1980
+RtlTimeToTimeFields
+RtlTraceDatabaseAdd
+RtlTraceDatabaseCreate
+RtlTraceDatabaseDestroy
+RtlTraceDatabaseEnumerate
+RtlTraceDatabaseFind
+RtlTraceDatabaseLock
+RtlTraceDatabaseUnlock
+RtlTraceDatabaseValidate
+RtlTryAcquirePebLock
+RtlTryAcquireSRWLockExclusive
+RtlTryAcquireSRWLockShared
+RtlTryConvertSRWLockSharedToExclusiveOrRelease
+RtlTryEnterCriticalSection
+RtlUTF8ToUnicodeN
+RtlUlongByteSwap
+RtlUlonglongByteSwap
+RtlUnhandledExceptionFilter
+RtlUnhandledExceptionFilter2
+RtlUnicodeStringToAnsiSize
+RtlUnicodeStringToAnsiString
+RtlUnicodeStringToCountedOemString
+RtlUnicodeStringToInteger
+RtlUnicodeStringToOemSize
+RtlUnicodeStringToOemString
+RtlUnicodeToCustomCPN
+RtlUnicodeToMultiByteN
+RtlUnicodeToMultiByteSize
+RtlUnicodeToOemN
+RtlUnicodeToUTF8N
+RtlUniform
+RtlUnlockBootStatusData
+RtlUnlockCurrentThread
+RtlUnlockHeap
+RtlUnlockMemoryBlockLookaside
+RtlUnlockMemoryStreamRegion
+RtlUnlockMemoryZone
+RtlUnlockModuleSection
+RtlUnsubscribeWnfNotificationWaitForCompletion
+RtlUnsubscribeWnfNotificationWithCompletionCallback
+RtlUnsubscribeWnfStateChangeNotification
+RtlUnwind
+RtlUnwindEx
+RtlUpcaseUnicodeChar
+RtlUpcaseUnicodeString
+RtlUpcaseUnicodeStringToAnsiString
+RtlUpcaseUnicodeStringToCountedOemString
+RtlUpcaseUnicodeStringToOemString
+RtlUpcaseUnicodeToCustomCPN
+RtlUpcaseUnicodeToMultiByteN
+RtlUpcaseUnicodeToOemN
+RtlUpdateClonedCriticalSection
+RtlUpdateClonedSRWLock
+RtlUpdateTimer
+RtlUpperChar
+RtlUpperString
+RtlUserThreadStart
+RtlUshortByteSwap
+RtlValidAcl
+RtlValidProcessProtection
+RtlValidRelativeSecurityDescriptor
+RtlValidSecurityDescriptor
+RtlValidSid
+RtlValidateHeap
+RtlValidateProcessHeaps
+RtlValidateUnicodeString
+RtlVerifyVersionInfo
+RtlVirtualUnwind
+RtlWaitForWnfMetaNotification
+RtlWaitOnAddress
+RtlWakeAddressAll
+RtlWakeAddressAllNoFence
+RtlWakeAddressSingle
+RtlWakeAddressSingleNoFence
+RtlWakeAllConditionVariable
+RtlWakeConditionVariable
+RtlWalkFrameChain
+RtlWalkHeap
+RtlWeaklyEnumerateEntryHashTable
+RtlWerpReportException
+RtlWnfCompareChangeStamp
+RtlWnfDllUnloadCallback
+RtlWow64CallFunction64
+RtlWow64EnableFsRedirection
+RtlWow64EnableFsRedirectionEx
+RtlWriteMemoryStream
+RtlWriteRegistryValue
+RtlZeroHeap
+RtlZeroMemory
+RtlZombifyActivationContext
+RtlpApplyLengthFunction
+RtlpCheckDynamicTimeZoneInformation
+RtlpCleanupRegistryKeys
+RtlpConvertAbsoluteToRelativeSecurityAttribute
+RtlpConvertCultureNamesToLCIDs
+RtlpConvertLCIDsToCultureNames
+RtlpConvertRelativeToAbsoluteSecurityAttribute
+RtlpCreateProcessRegistryInfo
+RtlpEnsureBufferSize
+RtlpFreezeTimeBias DATA
+RtlpGetLCIDFromLangInfoNode
+RtlpGetNameFromLangInfoNode
+RtlpGetSystemDefaultUILanguage
+RtlpGetUserOrMachineUILanguage4NLS
+RtlpInitializeLangRegistryInfo
+RtlpIsQualifiedLanguage
+RtlpLoadMachineUIByPolicy
+RtlpLoadUserUIByPolicy
+RtlpMergeSecurityAttributeInformation
+RtlpMuiFreeLangRegistryInfo
+RtlpMuiRegCreateRegistryInfo
+RtlpMuiRegFreeRegistryInfo
+RtlpMuiRegLoadRegistryInfo
+RtlpNotOwnerCriticalSection
+RtlpNtCreateKey
+RtlpNtEnumerateSubKey
+RtlpNtMakeTemporaryKey
+RtlpNtOpenKey
+RtlpNtQueryValueKey
+RtlpNtSetValueKey
+RtlpQueryDefaultUILanguage
+RtlpRefreshCachedUILanguage
+RtlpSetInstallLanguage
+RtlpSetPreferredUILanguages
+RtlpSetUserPreferredUILanguages
+RtlpUnWaitCriticalSection
+RtlpVerifyAndCommitUILanguageSettings
+RtlpWaitForCriticalSection
+RtlxAnsiStringToUnicodeSize
+RtlxOemStringToUnicodeSize
+RtlxUnicodeStringToAnsiSize
+RtlxUnicodeStringToOemSize
+SbExecuteProcedure
+SbSelectProcedure
+ShipAssert
+ShipAssertGetBufferInfo
+ShipAssertMsgA
+ShipAssertMsgW
+TpAllocAlpcCompletion
+TpAllocAlpcCompletionEx
+TpAllocCleanupGroup
+TpAllocIoCompletion
+TpAllocJobNotification
+TpAllocPool
+TpAllocTimer
+TpAllocWait
+TpAllocWork
+TpAlpcRegisterCompletionList
+TpAlpcUnregisterCompletionList
+TpCallbackDetectedUnrecoverableError
+TpCallbackIndependent
+TpCallbackLeaveCriticalSectionOnCompletion
+TpCallbackMayRunLong
+TpCallbackReleaseMutexOnCompletion
+TpCallbackReleaseSemaphoreOnCompletion
+TpCallbackSendAlpcMessageOnCompletion
+TpCallbackSendPendingAlpcMessage
+TpCallbackSetEventOnCompletion
+TpCallbackUnloadDllOnCompletion
+TpCancelAsyncIoOperation
+TpCaptureCaller
+TpCheckTerminateWorker
+TpDbgDumpHeapUsage
+TpDbgSetLogRoutine
+TpDisablePoolCallbackChecks
+TpDisassociateCallback
+TpIsTimerSet
+TpPostWork
+TpQueryPoolStackInformation
+TpReleaseAlpcCompletion
+TpReleaseCleanupGroup
+TpReleaseCleanupGroupMembers
+TpReleaseIoCompletion
+TpReleaseJobNotification
+TpReleasePool
+TpReleaseTimer
+TpReleaseWait
+TpReleaseWork
+TpSetDefaultPoolMaxThreads
+TpSetDefaultPoolStackInformation
+TpSetPoolMaxThreads
+TpSetPoolMinThreads
+TpSetPoolStackInformation
+TpSetPoolThreadBasePriority
+TpSetTimer
+TpSetTimerEx
+TpSetWait
+TpSetWaitEx
+TpSimpleTryPost
+TpStartAsyncIoOperation
+TpTimerOutstandingCallbackCount
+TpTrimPools
+TpWaitForAlpcCompletion
+TpWaitForIoCompletion
+TpWaitForJobNotification
+TpWaitForTimer
+TpWaitForWait
+TpWaitForWork
+VerSetConditionMask
+WerReportSQMEvent
+WinSqmAddToAverageDWORD
+WinSqmAddToStream
+WinSqmAddToStreamEx
+WinSqmCheckEscalationAddToStreamEx
+WinSqmCheckEscalationSetDWORD
+WinSqmCheckEscalationSetDWORD64
+WinSqmCheckEscalationSetString
+WinSqmCommonDatapointDelete
+WinSqmCommonDatapointSetDWORD
+WinSqmCommonDatapointSetDWORD64
+WinSqmCommonDatapointSetStreamEx
+WinSqmCommonDatapointSetString
+WinSqmEndSession
+WinSqmEventEnabled
+WinSqmEventWrite
+WinSqmGetEscalationRuleStatus
+WinSqmGetInstrumentationProperty
+WinSqmIncrementDWORD
+WinSqmIsOptedIn
+WinSqmIsOptedInEx
+WinSqmIsSessionDisabled
+WinSqmSetDWORD
+WinSqmSetDWORD64
+WinSqmSetEscalationInfo
+WinSqmSetIfMaxDWORD
+WinSqmSetIfMinDWORD
+WinSqmSetString
+WinSqmStartSession
+WinSqmStartSessionForPartner
+ZwAcceptConnectPort
+ZwAccessCheck
+ZwAccessCheckAndAuditAlarm
+ZwAccessCheckByType
+ZwAccessCheckByTypeAndAuditAlarm
+ZwAccessCheckByTypeResultList
+ZwAccessCheckByTypeResultListAndAuditAlarm
+ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
+ZwAddAtom
+ZwAddAtomEx
+ZwAddBootEntry
+ZwAddDriverEntry
+ZwAdjustGroupsToken
+ZwAdjustPrivilegesToken
+ZwAdjustTokenClaimsAndDeviceGroups
+ZwAlertResumeThread
+ZwAlertThread
+ZwAlertThreadByThreadId
+ZwAllocateLocallyUniqueId
+ZwAllocateReserveObject
+ZwAllocateUserPhysicalPages
+ZwAllocateUuids
+ZwAllocateVirtualMemory
+ZwAlpcAcceptConnectPort
+ZwAlpcCancelMessage
+ZwAlpcConnectPort
+ZwAlpcConnectPortEx
+ZwAlpcCreatePort
+ZwAlpcCreatePortSection
+ZwAlpcCreateResourceReserve
+ZwAlpcCreateSectionView
+ZwAlpcCreateSecurityContext
+ZwAlpcDeletePortSection
+ZwAlpcDeleteResourceReserve
+ZwAlpcDeleteSectionView
+ZwAlpcDeleteSecurityContext
+ZwAlpcDisconnectPort
+ZwAlpcImpersonateClientOfPort
+ZwAlpcOpenSenderProcess
+ZwAlpcOpenSenderThread
+ZwAlpcQueryInformation
+ZwAlpcQueryInformationMessage
+ZwAlpcRevokeSecurityContext
+ZwAlpcSendWaitReceivePort
+ZwAlpcSetInformation
+ZwApphelpCacheControl
+ZwAreMappedFilesTheSame
+ZwAssignProcessToJobObject
+ZwAssociateWaitCompletionPacket
+ZwCallbackReturn
+ZwCancelIoFile
+ZwCancelIoFileEx
+ZwCancelSynchronousIoFile
+ZwCancelTimer
+ZwCancelTimer2
+ZwCancelWaitCompletionPacket
+ZwClearEvent
+ZwClose
+ZwCloseObjectAuditAlarm
+ZwCommitComplete
+ZwCommitEnlistment
+ZwCommitTransaction
+ZwCompactKeys
+ZwCompareTokens
+ZwCompleteConnectPort
+ZwCompressKey
+ZwConnectPort
+ZwContinue
+ZwCreateDebugObject
+ZwCreateDirectoryObject
+ZwCreateDirectoryObjectEx
+ZwCreateEnlistment
+ZwCreateEvent
+ZwCreateEventPair
+ZwCreateFile
+ZwCreateIRTimer
+ZwCreateIoCompletion
+ZwCreateJobObject
+ZwCreateJobSet
+ZwCreateKey
+ZwCreateKeyTransacted
+ZwCreateKeyedEvent
+ZwCreateLowBoxToken
+ZwCreateMailslotFile
+ZwCreateMutant
+ZwCreateNamedPipeFile
+ZwCreatePagingFile
+ZwCreatePort
+ZwCreatePrivateNamespace
+ZwCreateProcess
+ZwCreateProcessEx
+ZwCreateProfile
+ZwCreateProfileEx
+ZwCreateResourceManager
+ZwCreateSection
+ZwCreateSemaphore
+ZwCreateSymbolicLinkObject
+ZwCreateThread
+ZwCreateThreadEx
+ZwCreateTimer
+ZwCreateTimer2
+ZwCreateToken
+ZwCreateTokenEx
+ZwCreateTransaction
+ZwCreateTransactionManager
+ZwCreateUserProcess
+ZwCreateWaitCompletionPacket
+ZwCreateWaitablePort
+ZwCreateWnfStateName
+ZwCreateWorkerFactory
+ZwDebugActiveProcess
+ZwDebugContinue
+ZwDelayExecution
+ZwDeleteAtom
+ZwDeleteBootEntry
+ZwDeleteDriverEntry
+ZwDeleteFile
+ZwDeleteKey
+ZwDeleteObjectAuditAlarm
+ZwDeletePrivateNamespace
+ZwDeleteValueKey
+ZwDeleteWnfStateData
+ZwDeleteWnfStateName
+ZwDeviceIoControlFile
+ZwDisableLastKnownGood
+ZwDisplayString
+ZwDrawText
+ZwDuplicateObject
+ZwDuplicateToken
+ZwEnableLastKnownGood
+ZwEnumerateBootEntries
+ZwEnumerateDriverEntries
+ZwEnumerateKey
+ZwEnumerateSystemEnvironmentValuesEx
+ZwEnumerateTransactionObject
+ZwEnumerateValueKey
+ZwExtendSection
+ZwFilterBootOption
+ZwFilterToken
+ZwFilterTokenEx
+ZwFindAtom
+ZwFlushBuffersFile
+ZwFlushBuffersFileEx
+ZwFlushInstallUILanguage
+ZwFlushInstructionCache
+ZwFlushKey
+ZwFlushProcessWriteBuffers
+ZwFlushVirtualMemory
+ZwFlushWriteBuffer
+ZwFreeUserPhysicalPages
+ZwFreeVirtualMemory
+ZwFreezeRegistry
+ZwFreezeTransactions
+ZwFsControlFile
+ZwGetCachedSigningLevel
+ZwGetCompleteWnfStateSubscription
+ZwGetContextThread
+ZwGetCurrentProcessorNumber
+ZwGetDevicePowerState
+ZwGetMUIRegistryInfo
+ZwGetNextProcess
+ZwGetNextThread
+ZwGetNlsSectionPtr
+ZwGetNotificationResourceManager
+ZwGetWriteWatch
+ZwImpersonateAnonymousToken
+ZwImpersonateClientOfPort
+ZwImpersonateThread
+ZwInitializeNlsFiles
+ZwInitializeRegistry
+ZwInitiatePowerAction
+ZwIsProcessInJob
+ZwIsSystemResumeAutomatic
+ZwIsUILanguageComitted
+ZwListenPort
+ZwLoadDriver
+ZwLoadKey
+ZwLoadKey2
+ZwLoadKeyEx
+ZwLockFile
+ZwLockProductActivationKeys
+ZwLockRegistryKey
+ZwLockVirtualMemory
+ZwMakePermanentObject
+ZwMakeTemporaryObject
+ZwMapCMFModule
+ZwMapUserPhysicalPages
+ZwMapUserPhysicalPagesScatter
+ZwMapViewOfSection
+ZwModifyBootEntry
+ZwModifyDriverEntry
+ZwNotifyChangeDirectoryFile
+ZwNotifyChangeKey
+ZwNotifyChangeMultipleKeys
+ZwNotifyChangeSession
+ZwOpenDirectoryObject
+ZwOpenEnlistment
+ZwOpenEvent
+ZwOpenEventPair
+ZwOpenFile
+ZwOpenIoCompletion
+ZwOpenJobObject
+ZwOpenKey
+ZwOpenKeyEx
+ZwOpenKeyTransacted
+ZwOpenKeyTransactedEx
+ZwOpenKeyedEvent
+ZwOpenMutant
+ZwOpenObjectAuditAlarm
+ZwOpenPrivateNamespace
+ZwOpenProcess
+ZwOpenProcessToken
+ZwOpenProcessTokenEx
+ZwOpenResourceManager
+ZwOpenSection
+ZwOpenSemaphore
+ZwOpenSession
+ZwOpenSymbolicLinkObject
+ZwOpenThread
+ZwOpenThreadToken
+ZwOpenThreadTokenEx
+ZwOpenTimer
+ZwOpenTransaction
+ZwOpenTransactionManager
+ZwPlugPlayControl
+ZwPowerInformation
+ZwPrePrepareComplete
+ZwPrePrepareEnlistment
+ZwPrepareComplete
+ZwPrepareEnlistment
+ZwPrivilegeCheck
+ZwPrivilegeObjectAuditAlarm
+ZwPrivilegedServiceAuditAlarm
+ZwPropagationComplete
+ZwPropagationFailed
+ZwProtectVirtualMemory
+ZwPulseEvent
+ZwQueryAttributesFile
+ZwQueryBootEntryOrder
+ZwQueryBootOptions
+ZwQueryDebugFilterState
+ZwQueryDefaultLocale
+ZwQueryDefaultUILanguage
+ZwQueryDirectoryFile
+ZwQueryDirectoryObject
+ZwQueryDriverEntryOrder
+ZwQueryEaFile
+ZwQueryEvent
+ZwQueryFullAttributesFile
+ZwQueryInformationAtom
+ZwQueryInformationEnlistment
+ZwQueryInformationFile
+ZwQueryInformationJobObject
+ZwQueryInformationPort
+ZwQueryInformationProcess
+ZwQueryInformationResourceManager
+ZwQueryInformationThread
+ZwQueryInformationToken
+ZwQueryInformationTransaction
+ZwQueryInformationTransactionManager
+ZwQueryInformationWorkerFactory
+ZwQueryInstallUILanguage
+ZwQueryIntervalProfile
+ZwQueryIoCompletion
+ZwQueryKey
+ZwQueryLicenseValue
+ZwQueryMultipleValueKey
+ZwQueryMutant
+ZwQueryObject
+ZwQueryOpenSubKeys
+ZwQueryOpenSubKeysEx
+ZwQueryPerformanceCounter
+ZwQueryPortInformationProcess
+ZwQueryQuotaInformationFile
+ZwQuerySection
+ZwQuerySecurityAttributesToken
+ZwQuerySecurityObject
+ZwQuerySemaphore
+ZwQuerySymbolicLinkObject
+ZwQuerySystemEnvironmentValue
+ZwQuerySystemEnvironmentValueEx
+ZwQuerySystemInformation
+ZwQuerySystemInformationEx
+ZwQuerySystemTime
+ZwQueryTimer
+ZwQueryTimerResolution
+ZwQueryValueKey
+ZwQueryVirtualMemory
+ZwQueryVolumeInformationFile
+ZwQueryWnfStateData
+ZwQueryWnfStateNameInformation
+ZwQueueApcThread
+ZwQueueApcThreadEx
+ZwRaiseException
+ZwRaiseHardError
+ZwReadFile
+ZwReadFileScatter
+ZwReadOnlyEnlistment
+ZwReadRequestData
+ZwReadVirtualMemory
+ZwRecoverEnlistment
+ZwRecoverResourceManager
+ZwRecoverTransactionManager
+ZwRegisterProtocolAddressInformation
+ZwRegisterThreadTerminatePort
+ZwReleaseKeyedEvent
+ZwReleaseMutant
+ZwReleaseSemaphore
+ZwReleaseWorkerFactoryWorker
+ZwRemoveIoCompletion
+ZwRemoveIoCompletionEx
+ZwRemoveProcessDebug
+ZwRenameKey
+ZwRenameTransactionManager
+ZwReplaceKey
+ZwReplacePartitionUnit
+ZwReplyPort
+ZwReplyWaitReceivePort
+ZwReplyWaitReceivePortEx
+ZwReplyWaitReplyPort
+ZwRequestPort
+ZwRequestWaitReplyPort
+ZwResetEvent
+ZwResetWriteWatch
+ZwRestoreKey
+ZwResumeProcess
+ZwResumeThread
+ZwRollbackComplete
+ZwRollbackEnlistment
+ZwRollbackTransaction
+ZwRollforwardTransactionManager
+ZwSaveKey
+ZwSaveKeyEx
+ZwSaveMergedKeys
+ZwSecureConnectPort
+ZwSerializeBoot
+ZwSetBootEntryOrder
+ZwSetBootOptions
+ZwSetCachedSigningLevel
+ZwSetContextThread
+ZwSetDebugFilterState
+ZwSetDefaultHardErrorPort
+ZwSetDefaultLocale
+ZwSetDefaultUILanguage
+ZwSetDriverEntryOrder
+ZwSetEaFile
+ZwSetEvent
+ZwSetEventBoostPriority
+ZwSetHighEventPair
+ZwSetHighWaitLowEventPair
+ZwSetIRTimer
+ZwSetInformationDebugObject
+ZwSetInformationEnlistment
+ZwSetInformationFile
+ZwSetInformationJobObject
+ZwSetInformationKey
+ZwSetInformationObject
+ZwSetInformationProcess
+ZwSetInformationResourceManager
+ZwSetInformationThread
+ZwSetInformationToken
+ZwSetInformationTransaction
+ZwSetInformationTransactionManager
+ZwSetInformationVirtualMemory
+ZwSetInformationWorkerFactory
+ZwSetIntervalProfile
+ZwSetIoCompletion
+ZwSetIoCompletionEx
+ZwSetLdtEntries
+ZwSetLowEventPair
+ZwSetLowWaitHighEventPair
+ZwSetQuotaInformationFile
+ZwSetSecurityObject
+ZwSetSystemEnvironmentValue
+ZwSetSystemEnvironmentValueEx
+ZwSetSystemInformation
+ZwSetSystemPowerState
+ZwSetSystemTime
+ZwSetThreadExecutionState
+ZwSetTimer
+ZwSetTimer2
+ZwSetTimerEx
+ZwSetTimerResolution
+ZwSetUuidSeed
+ZwSetValueKey
+ZwSetVolumeInformationFile
+ZwSetWnfProcessNotificationEvent
+ZwShutdownSystem
+ZwShutdownWorkerFactory
+ZwSignalAndWaitForSingleObject
+ZwSinglePhaseReject
+ZwStartProfile
+ZwStopProfile
+ZwSubscribeWnfStateChange
+ZwSuspendProcess
+ZwSuspendThread
+ZwSystemDebugControl
+ZwTerminateJobObject
+ZwTerminateProcess
+ZwTerminateThread
+ZwTestAlert
+ZwThawRegistry
+ZwThawTransactions
+ZwTraceControl
+ZwTraceEvent
+ZwTranslateFilePath
+ZwUmsThreadYield
+ZwUnloadDriver
+ZwUnloadKey
+ZwUnloadKey2
+ZwUnloadKeyEx
+ZwUnlockFile
+ZwUnlockVirtualMemory
+ZwUnmapViewOfSection
+ZwUnmapViewOfSectionEx
+ZwUnsubscribeWnfStateChange
+ZwUpdateWnfStateData
+ZwVdmControl
+ZwWaitForAlertByThreadId
+ZwWaitForDebugEvent
+ZwWaitForKeyedEvent
+ZwWaitForMultipleObjects
+ZwWaitForMultipleObjects32
+ZwWaitForSingleObject
+ZwWaitForWorkViaWorkerFactory
+ZwWaitHighEventPair
+ZwWaitLowEventPair
+ZwWorkerFactoryWorkerReady
+ZwWriteFile
+ZwWriteFileGather
+ZwWriteRequestData
+ZwWriteVirtualMemory
+ZwYieldExecution
+__C_specific_handler
+__chkstk
+__isascii
+__iscsym
+__iscsymf
+__jump_unwind
+__toascii
+_atoi64
+_errno
+_fltused DATA
+_i64toa
+_i64toa_s
+_i64tow
+_i64tow_s
+_itoa
+_itoa_s
+_itow
+_itow_s
+_lfind
+_ltoa
+_ltoa_s
+_ltow
+_ltow_s
+_makepath_s
+_memccpy
+_memicmp
+_setjmp
+_setjmpex
+_snprintf
+_snprintf_s
+_snscanf_s
+_snwprintf
+_snwprintf_s
+_snwscanf_s
+_splitpath
+_splitpath_s
+_strcmpi
+_stricmp
+_strlwr
+_strlwr_s
+_strnicmp
+_strnset_s
+_strset_s
+_strupr
+_strupr_s
+_swprintf
+_ui64toa
+_ui64toa_s
+_ui64tow
+_ui64tow_s
+_ultoa
+_ultoa_s
+_ultow
+_ultow_s
+_vscwprintf
+_vsnprintf
+_vsnprintf_s
+_vsnwprintf
+_vsnwprintf_s
+_vswprintf
+_wcsicmp
+_wcslwr
+_wcslwr_s
+_wcsnicmp
+_wcsnset_s
+_wcsset_s
+_wcstoi64
+_wcstoui64
+_wcsupr
+_wcsupr_s
+_wmakepath_s
+_wsplitpath_s
+_wtoi
+_wtoi64
+_wtol
+abs
+atan
+atoi
+atol
+bsearch
+ceil
+cos
+fabs
+floor
+isalnum
+isalpha
+iscntrl
+isdigit
+isgraph
+islower
+isprint
+ispunct
+isspace
+isupper
+iswalnum
+iswalpha
+iswascii
+iswctype
+iswdigit
+iswgraph
+iswlower
+iswprint
+iswspace
+iswxdigit
+isxdigit
+labs
+log
+longjmp
+mbstowcs
+memchr
+memcmp
+memcpy
+memcpy_s
+memmove
+memmove_s
+memset
+pow
+qsort
+qsort_s
+sin
+sprintf
+sprintf_s
+sqrt
+sscanf
+sscanf_s
+strcat
+strcat_s
+strchr
+strcmp
+strcpy
+strcpy_s
+strcspn
+strlen
+strncat
+strncat_s
+strncmp
+strncpy
+strncpy_s
+strnlen
+strpbrk
+strrchr
+strspn
+strstr
+strtok_s
+strtol
+strtoul
+swprintf
+swprintf_s
+swscanf_s
+tan
+tolower
+toupper
+towlower
+towupper
+vDbgPrintEx
+vDbgPrintExWithPrefix
+vsprintf
+vsprintf_s
+vswprintf_s
+wcscat
+wcscat_s
+wcschr
+wcscmp
+wcscpy
+wcscpy_s
+wcscspn
+wcslen
+wcsncat
+wcsncat_s
+wcsncmp
+wcsncpy
+wcsncpy_s
+wcsnlen
+wcspbrk
+wcsrchr
+wcsspn
+wcsstr
+wcstok_s
+wcstol
+wcstombs
+wcstoul
diff --git a/src/link.cpp b/src/link.cpp
index 215710d6a8..445035eb73 100644
--- a/src/link.cpp
+++ b/src/link.cpp
@@ -571,6 +571,9 @@ static const MinGWDef mingw_def_list[] = {
     {"shell32", "lib-common" OS_SEP "shell32.def", true},
     {"user32", "lib-common" OS_SEP "user32.def.in", true},
     {"kernel32", "lib-common" OS_SEP "kernel32.def.in", true},
+    {"ntdll", "libarm32" OS_SEP "ntdll.def", true},
+    {"ntdll", "lib32" OS_SEP "ntdll.def", true},
+    {"ntdll", "lib64" OS_SEP "ntdll.def", true},
 };
 
 struct LinkJob {