search

lucasg / Dependencies

A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.
MIT License
9.14k stars 751 forks source link

Ability to sort output in command line #142

Closed mikewa1 closed 4 years ago

mikewa1 commented 4 years ago

Hi,

First of all, this tool has been a lifesaver for me! I use it to ensure that no new API functions are used unless reviewed for compatibility (such as software designed to support Windows 7 starts using something available from Windows 8 only).

I wonder if "dependencies.exe -imports" output can be optionally sorted by name? The issue here is every time the exe dependencies are changed, the order of imports changes too. Which makes it difficult to DIFF during our reviews. If these are sorted, DIFF would work just fine.

I could try to post-process it via command line sort utilities, but it's not an easy solution because the output is structured by module name and line-level sorting breaks this structure.

Thanks!

MarekKnapek commented 4 years ago

Hi @fmike7, imports gist should do what you want.

mikewa1 commented 4 years ago

Hi @fmike7, imports gist should do what you want.

  • Make sure you have Visual C++ (not C#) compiler installed (version 2019).
  • Compile the program by invoking cl imports.cpp /std:c++latest /EHsc from developer command prompt (launch it from Start menu).
  • Launch the tool imports.exe c:\windows\system32\taskmgr.exe or imports.exe /sort c:\windows\system32\taskmgr.exe.

@MarekKnapek

Wow, this seems to be a very neat tool! The only thing that doesn't fit my need is it's recursive loading of dependencies. I don't care much what system DLLs are dependent on and it's very system-dependent, so actually would like to see only what it directly imported by the EXE. Such as I would care a lot about what is imported from kernel32.dll by the EXE, but what lies underneath that in all those api-ms-win-core-*.dll does not really matter.

Would be great if you could add an option to avoid such recursion.

MarekKnapek commented 4 years ago

Hi @fmike7, are you referring to my gist I linked earlier? It is already non-recursive. It will display all imported functions from all imported DLLs. But will not recurse into those DLLs and will not process them in any way.

In fact, searching for the correct DLL, you depend on, on disc is the difficult part.

If you execute imports.exe /sort c:\path\to\your\app.exe from command line, the tool will emit all imports from kernel32.dll, user32.dll, your.dll, and so on. But it will not search for those DLLs on disc and will not try to analyze them.

Marek

mikewa1 commented 4 years ago

Actually you are right, thanks! For taskmgr.exe it is actually importing all those api-ms-win-core-*.dll directly, but for my own exe it's not doing it. Thanks a lot!

lucasg commented 4 years ago

@fmike7 : Also did you know you can have an Json export ? That way you can process it with whatever scripting language you're most familiar with.

E.g in powershell:

PS> $json = & O:\Dependencies\Releases\v1.10\x64_Release\Dependencies.exe -imports C:\Windows\System32\kernel32.dll -json | ConvertFrom-Json
PS> $json | Select-Object *

Imports
-------
{@{Flags=0; Name=api-ms-win-core-rtlsupport-l1-1-0.dll; NumberOfEntries=13; ImportList=System.Object[]}, @{Flags=0; ...

PS> $json.Imports | Select-Object Name, ImportList | Sort-Object Name
Name                                             ImportList
----                                             ----------
api-ms-win-core-appcompat-l1-1-0.dll             {@{Hint=0; Ordinal=0; Name=BaseCheckAppcompatCache; ModuleName=api-...
api-ms-win-core-appcompat-l1-1-1.dll             {@{Hint=5; Ordinal=5; Name=BaseFreeAppCompatDataForProcess; ModuleN...
api-ms-win-core-comm-l1-1-0.dll                  {@{Hint=11; Ordinal=11; Name=PurgeComm; ModuleName=api-ms-win-core-...
api-ms-win-core-console-l1-1-0.dll               {@{Hint=0; Ordinal=0; Name=AllocConsole; ModuleName=api-ms-win-core...
api-ms-win-core-console-l1-2-0.dll               {@{Hint=1; Ordinal=1; Name=AttachConsole; ModuleName=api-ms-win-cor...
api-ms-win-core-console-l1-2-1.dll               {@{Hint=15; Ordinal=15; Name=ResizePseudoConsole; ModuleName=api-ms...
api-ms-win-core-console-l2-1-0.dll               {@{Hint=6; Ordinal=6; Name=GetConsoleCursorInfo; ModuleName=api-ms-...
api-ms-win-core-console-l2-2-0.dll               {@{Hint=12; Ordinal=12; Name=GetConsoleTitleW; ModuleName=api-ms-wi...
api-ms-win-core-console-l3-2-0.dll               {@{Hint=2; Ordinal=2; Name=ExpungeConsoleCommandHistoryA; ModuleNam...
api-ms-win-core-datetime-l1-1-0.dll              {@{Hint=0; Ordinal=0; Name=GetDateFormatA; ModuleName=api-ms-win-co...
api-ms-win-core-datetime-l1-1-1.dll              {@{Hint=1; Ordinal=1; Name=GetDateFormatEx; ModuleName=api-ms-win-c...
api-ms-win-core-datetime-l1-1-2.dll              {@{Hint=3; Ordinal=3; Name=GetDurationFormatEx; ModuleName=api-ms-w...
api-ms-win-core-debug-l1-1-0.dll                 {@{Hint=5; Ordinal=5; Name=IsDebuggerPresent; ModuleName=api-ms-win...
api-ms-win-core-debug-l1-1-1.dll                 {@{Hint=1; Ordinal=1; Name=ContinueDebugEvent; ModuleName=api-ms-wi...
api-ms-win-core-delayload-l1-1-0.dll             {@{Hint=0; Ordinal=0; Name=DelayLoadFailureHook; ModuleName=api-ms-...
api-ms-win-core-errorhandling-l1-1-0.dll         {@{Hint=12; Ordinal=12; Name=SetErrorMode; ModuleName=api-ms-win-co...
api-ms-win-core-errorhandling-l1-1-3.dll         {@{Hint=14; Ordinal=14; Name=SetThreadErrorMode; ModuleName=api-ms-...
api-ms-win-core-fibers-l1-1-0.dll                {@{Hint=0; Ordinal=0; Name=FlsAlloc; ModuleName=api-ms-win-core-fib...
api-ms-win-core-fibers-l2-1-0.dll                {@{Hint=6; Ordinal=6; Name=SwitchToFiber; ModuleName=api-ms-win-cor...
api-ms-win-core-fibers-l2-1-1.dll                {@{Hint=4; Ordinal=4; Name=CreateFiberEx; ModuleName=api-ms-win-cor...
api-ms-win-core-file-l1-1-0.dll                  {@{Hint=20; Ordinal=20; Name=FindFirstFileW; ModuleName=api-ms-win-...
api-ms-win-core-file-l1-2-0.dll                  {@{Hint=62; Ordinal=62; Name=GetTempPathW; ModuleName=api-ms-win-co...
api-ms-win-core-file-l1-2-1.dll                  {@{Hint=31; Ordinal=31; Name=GetCompressedFileSizeA; ModuleName=api...
api-ms-win-core-file-l1-2-2.dll                  {@{Hint=63; Ordinal=63; Name=GetVolumeInformationA; ModuleName=api-...
api-ms-win-core-file-l2-1-0.dll                  {@{Hint=13; Ordinal=13; Name=ReadDirectoryChangesW; ModuleName=api-...
api-ms-win-core-file-l2-1-1.dll                  {@{Hint=10; Ordinal=10; Name=OpenFileById; ModuleName=api-ms-win-co...
api-ms-win-core-file-l2-1-2.dll                  {@{Hint=4; Ordinal=4; Name=CreateHardLinkA; ModuleName=api-ms-win-c...
api-ms-win-core-file-l2-1-3.dll                  {@{Hint=12; Ordinal=12; Name=ReadDirectoryChangesExW; ModuleName=ap...
api-ms-win-core-handle-l1-1-0.dll                {@{Hint=2; Ordinal=2; Name=DuplicateHandle; ModuleName=api-ms-win-c...
api-ms-win-core-heap-l1-1-0.dll                  {@{Hint=12; Ordinal=12; Name=HeapUnlock; ModuleName=api-ms-win-core...
api-ms-win-core-heap-l2-1-0.dll                  {@{Hint=3; Ordinal=3; Name=LocalFree; ModuleName=api-ms-win-core-he...
api-ms-win-core-io-l1-1-0.dll                    {@{Hint=4; Ordinal=4; Name=DeviceIoControl; ModuleName=api-ms-win-c...
api-ms-win-core-io-l1-1-1.dll                    {@{Hint=0; Ordinal=0; Name=CancelIo; ModuleName=api-ms-win-core-io-...
api-ms-win-core-job-l1-1-0.dll                   {@{Hint=0; Ordinal=0; Name=IsProcessInJob; ModuleName=api-ms-win-co...
api-ms-win-core-largeinteger-l1-1-0.dll          {@{Hint=0; Ordinal=0; Name=MulDiv; ModuleName=api-ms-win-core-large...
api-ms-win-core-libraryloader-l1-2-0.dll         {@{Hint=32; Ordinal=32; Name=SizeofResource; ModuleName=api-ms-win-...
api-ms-win-core-libraryloader-l1-2-1.dll         {@{Hint=10; Ordinal=10; Name=FindResourceW; ModuleName=api-ms-win-c...
api-ms-win-core-libraryloader-l1-2-2.dll         {@{Hint=6; Ordinal=6; Name=EnumResourceNamesW; ModuleName=api-ms-wi...
api-ms-win-core-libraryloader-l2-1-0.dll         {@{Hint=0; Ordinal=0; Name=LoadPackagedLibrary; ModuleName=api-ms-w...
api-ms-win-core-localization-l1-2-0.dll          {@{Hint=46; Ordinal=46; Name=IsValidLanguageGroup; ModuleName=api-m...
api-ms-win-core-localization-l2-1-0.dll          {@{Hint=4; Ordinal=4; Name=EnumDateFormatsExW; ModuleName=api-ms-wi...
api-ms-win-core-localization-private-l1-1-0.dll  {@{Hint=4; Ordinal=4; Name=NlsGetCacheUpdateCount; ModuleName=api-m...
api-ms-win-core-memory-l1-1-0.dll                {@{Hint=53; Ordinal=53; Name=VirtualQueryEx; ModuleName=api-ms-win-...
api-ms-win-core-memory-l1-1-1.dll                {@{Hint=31; Ordinal=31; Name=ResetWriteWatch; ModuleName=api-ms-win...
api-ms-win-core-memory-l1-1-2.dll                {@{Hint=30; Ordinal=30; Name=RegisterBadMemoryNotification; ModuleN...
api-ms-win-core-namedpipe-l1-2-2.dll             {@{Hint=0; Ordinal=0; Name=CallNamedPipeW; ModuleName=api-ms-win-co...
api-ms-win-core-namespace-l1-1-0.dll             {@{Hint=1; Ordinal=1; Name=ClosePrivateNamespace; ModuleName=api-ms...
api-ms-win-core-normalization-l1-1-0.dll         {@{Hint=3; Ordinal=3; Name=NormalizeString; ModuleName=api-ms-win-c...
api-ms-win-core-processenvironment-l1-1-0.dll    {@{Hint=1; Ordinal=1; Name=ExpandEnvironmentStringsW; ModuleName=ap...
api-ms-win-core-processenvironment-l1-2-0.dll    {@{Hint=15; Ordinal=15; Name=SearchPathA; ModuleName=api-ms-win-cor...
api-ms-win-core-processsnapshot-l1-1-0.dll       {@{Hint=7; Ordinal=7; Name=PssWalkMarkerSeekToBeginning; ModuleName...
api-ms-win-core-processthreads-l1-1-0.dll        {@{Hint=32; Ordinal=32; Name=GetStartupInfoW; ModuleName=api-ms-win...
api-ms-win-core-processthreads-l1-1-1.dll        {@{Hint=48; Ordinal=48; Name=OpenProcess; ModuleName=api-ms-win-cor...
api-ms-win-core-processthreads-l1-1-2.dll        {@{Hint=34; Ordinal=34; Name=GetSystemTimes; ModuleName=api-ms-win-...
api-ms-win-core-processthreads-l1-1-3.dll        {@{Hint=26; Ordinal=26; Name=GetProcessInformation; ModuleName=api-...
api-ms-win-core-processtopology-l1-1-0.dll       {@{Hint=0; Ordinal=0; Name=GetProcessGroupAffinity; ModuleName=api-...
api-ms-win-core-profile-l1-1-0.dll               {@{Hint=0; Ordinal=0; Name=QueryPerformanceCounter; ModuleName=api-...
api-ms-win-core-psapi-ansi-l1-1-0.dll            {@{Hint=0; Ordinal=0; Name=K32EnumPageFilesA; ModuleName=api-ms-win...
api-ms-win-core-psapi-l1-1-0.dll                 {@{Hint=20; Ordinal=20; Name=QueryFullProcessImageNameW; ModuleName...
api-ms-win-core-realtime-l1-1-0.dll              {@{Hint=3; Ordinal=3; Name=QueryIdleProcessorCycleTime; ModuleName=...
api-ms-win-core-registry-l1-1-0.dll              {@{Hint=23; Ordinal=23; Name=RegLoadKeyA; ModuleName=api-ms-win-cor...
api-ms-win-core-rtlsupport-l1-1-0.dll            {@{Hint=8; Ordinal=8; Name=RtlInstallFunctionTableCallback; ModuleN...
api-ms-win-core-sidebyside-l1-1-0.dll            {@{Hint=7; Ordinal=7; Name=QueryActCtxSettingsW; ModuleName=api-ms-...
api-ms-win-core-string-l1-1-0.dll                {@{Hint=6; Ordinal=6; Name=MultiByteToWideChar; ModuleName=api-ms-w...
api-ms-win-core-synch-l1-1-0.dll                 {@{Hint=26; Ordinal=26; Name=InitializeCriticalSectionEx; ModuleNam...
api-ms-win-core-synch-l1-2-0.dll                 {@{Hint=28; Ordinal=28; Name=InitializeSynchronizationBarrier; Modu...
api-ms-win-core-synch-l1-2-1.dll                 {@{Hint=52; Ordinal=52; Name=WaitForMultipleObjects; ModuleName=api...
api-ms-win-core-sysinfo-l1-1-0.dll               {@{Hint=26; Ordinal=26; Name=GetTickCount; ModuleName=api-ms-win-co...
api-ms-win-core-sysinfo-l1-2-0.dll               {@{Hint=8; Ordinal=8; Name=GetNativeSystemInfo; ModuleName=api-ms-w...
api-ms-win-core-sysinfo-l1-2-1.dll               {@{Hint=36; Ordinal=36; Name=SetComputerNameEx2W; ModuleName=api-ms...
api-ms-win-core-sysinfo-l1-2-3.dll               {@{Hint=39; Ordinal=39; Name=SetComputerNameW; ModuleName=api-ms-wi...
api-ms-win-core-systemtopology-l1-1-0.dll        {@{Hint=1; Ordinal=1; Name=GetNumaNodeProcessorMaskEx; ModuleName=a...
api-ms-win-core-systemtopology-l1-1-1.dll        {@{Hint=2; Ordinal=2; Name=GetNumaProximityNodeEx; ModuleName=api-m...
api-ms-win-core-threadpool-legacy-l1-1-0.dll     {@{Hint=0; Ordinal=0; Name=ChangeTimerQueueTimer; ModuleName=api-ms...
api-ms-win-core-threadpool-private-l1-1-0.dll    {@{Hint=0; Ordinal=0; Name=RegisterWaitForSingleObjectEx; ModuleNam...
api-ms-win-core-timezone-l1-1-0.dll              {@{Hint=11; Ordinal=11; Name=SystemTimeToTzSpecificLocalTime; Modul...
api-ms-win-core-util-l1-1-0.dll                  {@{Hint=0; Ordinal=0; Name=Beep; ModuleName=api-ms-win-core-util-l1...
api-ms-win-core-windowserrorreporting-l1-1-0.dll {@{Hint=8; Ordinal=8; Name=WerRegisterMemoryBlock; ModuleName=api-m...
api-ms-win-core-windowserrorreporting-l1-1-1.dll {@{Hint=13; Ordinal=13; Name=WerUnregisterCustomMetadata; ModuleNam...
api-ms-win-core-windowserrorreporting-l1-1-2.dll {@{Hint=12; Ordinal=12; Name=WerUnregisterAppLocalDump; ModuleName=...
api-ms-win-core-wow64-l1-1-0.dll                 {@{Hint=5; Ordinal=5; Name=IsWow64Process; ModuleName=api-ms-win-co...
api-ms-win-core-wow64-l1-1-1.dll                 {@{Hint=1; Ordinal=1; Name=GetSystemWow64Directory2W; ModuleName=ap...
api-ms-win-core-xstate-l2-1-0.dll                {@{Hint=0; Ordinal=0; Name=CopyContext; ModuleName=api-ms-win-core-...
api-ms-win-core-xstate-l2-1-1.dll                {@{Hint=4; Ordinal=4; Name=InitializeContext2; ModuleName=api-ms-wi...
api-ms-win-eventing-provider-l1-1-0.dll          {@{Hint=9; Ordinal=9; Name=EventWriteTransfer; ModuleName=api-ms-wi...
api-ms-win-security-appcontainer-l1-1-0.dll      {@{Hint=0; Ordinal=0; Name=GetAppContainerNamedObjectPath; ModuleNa...
api-ms-win-security-base-l1-1-0.dll              {@{Hint=0; Ordinal=0; Name=AccessCheck; ModuleName=api-ms-win-secur...
api-ms-win-security-base-l1-2-0.dll              {@{Hint=19; Ordinal=19; Name=AddScopedPolicyIDAce; ModuleName=api-m...
KERNELBASE.dll                                   {@{Hint=268; Ordinal=268; Name=PrivCopyFileExW; ModuleName=KERNELBA...
ntdll.dll                                        {@{Hint=1441; Ordinal=1441; Name=RtlSizeHeap; ModuleName=ntdll.dll;...

PS> $sorted_imports = $json.Imports | Select-Object Name, ImportList | Sort-Object Name
PS>  foreach ($import in $sorted_imports){
>> Write-Host $import.Name
>> $import.ImportList | Select-Object Name | Sort-Object Name
>> }
api-ms-win-core-appcompat-l1-1-0.dll

api-ms-win-core-appcompat-l1-1-1.dll
api-ms-win-core-comm-l1-1-0.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-console-l1-2-1.dll
api-ms-win-core-console-l2-1-0.dll
api-ms-win-core-console-l2-2-0.dll
api-ms-win-core-console-l3-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-datetime-l1-1-1.dll
api-ms-win-core-datetime-l1-1-2.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-debug-l1-1-1.dll
api-ms-win-core-delayload-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-3.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-fibers-l2-1-0.dll
api-ms-win-core-fibers-l2-1-1.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l1-2-1.dll
api-ms-win-core-file-l1-2-2.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-file-l2-1-1.dll
api-ms-win-core-file-l2-1-2.dll
api-ms-win-core-file-l2-1-3.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-heap-l2-1-0.dll
api-ms-win-core-io-l1-1-0.dll
api-ms-win-core-io-l1-1-1.dll
api-ms-win-core-job-l1-1-0.dll
api-ms-win-core-largeinteger-l1-1-0.dll
api-ms-win-core-libraryloader-l1-2-0.dll
api-ms-win-core-libraryloader-l1-2-1.dll
api-ms-win-core-libraryloader-l1-2-2.dll
api-ms-win-core-libraryloader-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-localization-l2-1-0.dll
api-ms-win-core-localization-private-l1-1-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-memory-l1-1-1.dll
api-ms-win-core-memory-l1-1-2.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-namedpipe-l1-2-1.dll
api-ms-win-core-namedpipe-l1-2-2.dll
api-ms-win-core-namespace-l1-1-0.dll
api-ms-win-core-normalization-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processenvironment-l1-2-0.dll
api-ms-win-core-processsnapshot-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-processthreads-l1-1-2.dll
api-ms-win-core-processthreads-l1-1-3.dll
api-ms-win-core-processtopology-l1-1-0.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-psapi-ansi-l1-1-0.dll
api-ms-win-core-psapi-l1-1-0.dll
api-ms-win-core-realtime-l1-1-0.dll
api-ms-win-core-registry-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-sidebyside-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-synch-l1-2-1.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-sysinfo-l1-2-0.dll
api-ms-win-core-sysinfo-l1-2-1.dll
api-ms-win-core-sysinfo-l1-2-3.dll
api-ms-win-core-systemtopology-l1-1-0.dll
api-ms-win-core-systemtopology-l1-1-1.dll
api-ms-win-core-threadpool-legacy-l1-1-0.dll
api-ms-win-core-threadpool-private-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-core-windowserrorreporting-l1-1-0.dll
api-ms-win-core-windowserrorreporting-l1-1-1.dll
api-ms-win-core-windowserrorreporting-l1-1-2.dll
api-ms-win-core-wow64-l1-1-0.dll
api-ms-win-core-wow64-l1-1-1.dll
api-ms-win-core-xstate-l2-1-0.dll
api-ms-win-core-xstate-l2-1-1.dll
api-ms-win-eventing-provider-l1-1-0.dll
api-ms-win-security-appcontainer-l1-1-0.dll
api-ms-win-security-base-l1-1-0.dll
api-ms-win-security-base-l1-2-0.dll
KERNELBASE.dll
ntdll.dll
Name
----
BaseCheckAppcompatCache
BaseCheckAppcompatCacheEx
BaseCleanupAppcompatCacheSupport
BaseDumpAppcompatCache
BaseFlushAppcompatCache
BaseInitAppcompatCacheSupport
BaseUpdateAppcompatCache
BaseFreeAppCompatDataForProcess
BaseReadAppCompatDataForProcess
ClearCommBreak
ClearCommError
EscapeCommFunction
GetCommConfig
GetCommMask
GetCommModemStatus
GetCommProperties
GetCommState
GetCommTimeouts
PurgeComm
SetCommBreak
SetCommConfig
SetCommMask
SetCommState
SetCommTimeouts
SetupComm
TransmitCommChar
WaitCommEvent
AllocConsole
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetNumberOfConsoleInputEvents
ReadConsoleA
ReadConsoleInputA
ReadConsoleInputW
ReadConsoleW
SetConsoleCtrlHandler
SetConsoleMode
WriteConsoleA
WriteConsoleW
AttachConsole
FreeConsole
PeekConsoleInputA
PeekConsoleInputW
ClosePseudoConsole
CreatePseudoConsole
ResizePseudoConsole
CreateConsoleScreenBuffer
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FillConsoleOutputCharacterW
FlushConsoleInputBuffer
GenerateConsoleCtrlEvent
GetConsoleCursorInfo
GetConsoleScreenBufferInfo
GetConsoleScreenBufferInfoEx
GetLargestConsoleWindowSize
ReadConsoleOutputA
ReadConsoleOutputAttribute
ReadConsoleOutputCharacterA
ReadConsoleOutputCharacterW
ReadConsoleOutputW
ScrollConsoleScreenBufferA
ScrollConsoleScreenBufferW
SetConsoleActiveScreenBuffer
SetConsoleCP
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleOutputCP
SetConsoleScreenBufferInfoEx
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleWindowInfo
WriteConsoleInputA
WriteConsoleInputW
WriteConsoleOutputA
WriteConsoleOutputAttribute
WriteConsoleOutputCharacterA
WriteConsoleOutputCharacterW
WriteConsoleOutputW
GetConsoleOriginalTitleA
GetConsoleOriginalTitleW
GetConsoleTitleA
GetConsoleTitleW
SetConsoleTitleA
SetConsoleTitleW
AddConsoleAliasA
AddConsoleAliasW
ExpungeConsoleCommandHistoryA
ExpungeConsoleCommandHistoryW
GetConsoleAliasA
GetConsoleAliasesA
GetConsoleAliasesLengthA
GetConsoleAliasesLengthW
GetConsoleAliasesW
GetConsoleAliasExesA
GetConsoleAliasExesLengthA
GetConsoleAliasExesLengthW
GetConsoleAliasExesW
GetConsoleAliasW
GetConsoleCommandHistoryA
GetConsoleCommandHistoryLengthA
GetConsoleCommandHistoryLengthW
GetConsoleCommandHistoryW
GetConsoleDisplayMode
GetConsoleFontSize
GetConsoleHistoryInfo
GetConsoleProcessList
GetConsoleSelectionInfo
GetConsoleWindow
GetCurrentConsoleFont
GetCurrentConsoleFontEx
GetNumberOfConsoleMouseButtons
SetConsoleDisplayMode
SetConsoleHistoryInfo
SetConsoleNumberOfCommandsA
SetConsoleNumberOfCommandsW
SetCurrentConsoleFontEx
GetDateFormatA
GetDateFormatW
GetTimeFormatA
GetTimeFormatW
GetDateFormatEx
GetTimeFormatEx
GetDurationFormatEx
DebugBreak
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
CheckRemoteDebuggerPresent
ContinueDebugEvent
DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEvent
DelayLoadFailureHook
GetErrorMode
GetLastError
RaiseException
SetErrorMode
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetThreadErrorMode
SetThreadErrorMode
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
ConvertFiberToThread
ConvertThreadToFiber
CreateFiber
DeleteFiber
SwitchToFiber
ConvertThreadToFiberEx
CreateFiberEx
CompareFileTime
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DefineDosDeviceW
DeleteFileA
DeleteFileW
DeleteVolumeMountPointW
FileTimeToLocalFileTime
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstVolumeW
FindNextChangeNotification
FindNextFileA
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFinalPathNameByHandleA
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetLogicalDriveStringsW
GetTempFileNameW
GetVolumeInformationByHandleW
GetVolumeInformationW
GetVolumePathNameW
LocalFileTimeToFileTime
LockFile
LockFileEx
QueryDosDeviceW
ReadFile
ReadFileEx
ReadFileScatter
RemoveDirectoryA
RemoveDirectoryW
SetEndOfFile
SetFileAttributesA
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
UnlockFile
UnlockFileEx
WriteFile
WriteFileEx
WriteFileGather
CreateFile2
GetTempPathW
GetVolumePathNamesForVolumeNameW
GetCompressedFileSizeA
GetCompressedFileSizeW
SetFileIoOverlappedRange
FindFirstFileNameW
FindFirstStreamW
FindNextFileNameW
GetTempFileNameA
GetTempPathA
GetVolumeInformationA
CopyFile2
CopyFileExW
CreateDirectoryExW
CreateHardLinkW
CreateSymbolicLinkW
GetFileInformationByHandleEx
MoveFileExW
MoveFileWithProgressW
ReadDirectoryChangesW
ReOpenFile
ReplaceFileW
OpenFileById
CopyFileW
CreateHardLinkA
ReadDirectoryChangesExW
CloseHandle
DuplicateHandle
GetHandleInformation
SetHandleInformation
GetProcessHeap
GetProcessHeaps
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapLock
HeapQueryInformation
HeapReAlloc
HeapSetInformation
HeapUnlock
HeapValidate
HeapWalk
LocalFree
CancelIoEx
CreateIoCompletionPort
DeviceIoControl
GetOverlappedResult
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
CancelIo
CancelSynchronousIo
IsProcessInJob
MulDiv
DisableThreadLibraryCalls
EnumResourceLanguagesExA
EnumResourceLanguagesExW
EnumResourceNamesExA
EnumResourceNamesExW
EnumResourceTypesExA
EnumResourceTypesExW
FindResourceExW
FindStringOrdinal
FreeLibrary
FreeLibraryAndExitThread
FreeResource
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
LoadLibraryExA
LoadLibraryExW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryA
LoadLibraryW
EnumResourceNamesW
LoadPackagedLibrary
ConvertDefaultLocale
EnumSystemLocalesA
EnumSystemLocalesW
FindNLSString
FindNLSStringEx
FormatMessageA
FormatMessageW
GetACP
GetCalendarInfoEx
GetCalendarInfoW
GetCPInfo
GetCPInfoExW
GetFileMUIInfo
GetFileMUIPath
GetLocaleInfoA
GetLocaleInfoEx
GetLocaleInfoW
GetNLSVersion
GetNLSVersionEx
GetOEMCP
GetProcessPreferredUILanguages
GetSystemDefaultLangID
GetSystemDefaultLCID
GetSystemPreferredUILanguages
GetThreadLocale
GetThreadPreferredUILanguages
GetThreadUILanguage
GetUILanguageInfo
GetUserDefaultLangID
GetUserDefaultLCID
GetUserPreferredUILanguages
IdnToAscii
IdnToUnicode
IsDBCSLeadByte
IsDBCSLeadByteEx
IsNLSDefinedString
IsValidCodePage
IsValidLanguageGroup
IsValidLocale
IsValidLocaleName
IsValidNLSVersion
LCMapStringA
LCMapStringEx
LCMapStringW
LocaleNameToLCID
ResolveLocaleName
SetCalendarInfoW
SetLocaleInfoW
SetProcessPreferredUILanguages
SetThreadLocale
SetThreadPreferredUILanguages
SetThreadUILanguage
VerLanguageNameA
VerLanguageNameW
EnumCalendarInfoExEx
EnumCalendarInfoExW
EnumCalendarInfoW
EnumDateFormatsExEx
EnumDateFormatsExW
EnumDateFormatsW
EnumSystemCodePagesW
EnumTimeFormatsEx
EnumTimeFormatsW
GetCurrencyFormatEx
GetNumberFormatEx
NlsCheckPolicy
NlsEventDataDescCreate
NlsGetCacheUpdateCount
NlsUpdateLocale
NlsUpdateSystemLocale
NlsWriteEtwEvent
CreateFileMappingW
FlushViewOfFile
MapViewOfFile
MapViewOfFileEx
OpenFileMappingW
ReadProcessMemory
UnmapViewOfFile
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WriteProcessMemory
CreateFileMappingNumaW
CreateMemoryResourceNotification
GetLargePageMinimum
GetProcessWorkingSetSizeEx
GetSystemFileCacheSize
GetWriteWatch
QueryMemoryResourceNotification
ResetWriteWatch
SetProcessWorkingSetSizeEx
SetSystemFileCacheSize
VirtualLock
VirtualUnlock
AllocateUserPhysicalPages
AllocateUserPhysicalPagesNuma
FreeUserPhysicalPages
GetMemoryErrorHandlingCapabilities
MapUserPhysicalPages
RegisterBadMemoryNotification
UnregisterBadMemoryNotification
VirtualAllocExNuma
ConnectNamedPipe
CreateNamedPipeW
CreatePipe
DisconnectNamedPipe
GetNamedPipeClientComputerNameW
PeekNamedPipe
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetNamedPipeHandleStateW
CallNamedPipeW
AddSIDToBoundaryDescriptor
ClosePrivateNamespace
CreateBoundaryDescriptorW
CreatePrivateNamespaceW
DeleteBoundaryDescriptor
OpenPrivateNamespaceW
GetStringScripts
IdnToNameprepUnicode
IsNormalizedString
NormalizeString
VerifyScripts
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStdHandle
SearchPathW
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
SetStdHandleEx
NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathW
SearchPathA
PssCaptureSnapshot
PssDuplicateSnapshot
PssFreeSnapshot
PssQuerySnapshot
PssWalkMarkerCreate
PssWalkMarkerFree
PssWalkMarkerGetPosition
PssWalkMarkerSeekToBeginning
PssWalkMarkerSetPosition
PssWalkSnapshot
CreateProcessA
CreateProcessW
CreateRemoteThread
CreateRemoteThreadEx
DeleteProcThreadAttributeList
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
GetExitCodeThread
GetPriorityClass
GetProcessId
GetProcessIdOfThread
GetProcessTimes
GetProcessVersion
GetStartupInfoW
GetThreadId
GetThreadPriority
GetThreadPriorityBoost
InitializeProcThreadAttributeList
OpenProcessToken
OpenThread
ProcessIdToSessionId
QueryProcessAffinityUpdateMode
QueueUserAPC
ResumeThread
SetPriorityClass
SetProcessAffinityUpdateMode
SetProcessShutdownParameters
SetThreadPriority
SetThreadPriorityBoost
SetThreadStackGuarantee
SuspendThread
SwitchToThread
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsSetValue
UpdateProcThreadAttribute
FlushInstructionCache
GetProcessHandleCount
GetProcessMitigationPolicy
GetThreadContext
GetThreadIdealProcessorEx
GetThreadTimes
IsProcessorFeaturePresent
OpenProcess
SetProcessMitigationPolicy
SetThreadContext
SetThreadIdealProcessorEx
GetProcessPriorityBoost
GetSystemTimes
GetThreadInformation
GetThreadIOPendingFlag
SetProcessPriorityBoost
SetThreadInformation
GetProcessInformation
GetProcessShutdownParameters
SetProcessInformation
SetThreadIdealProcessor
GetProcessGroupAffinity
GetThreadGroupAffinity
SetThreadGroupAffinity
QueryPerformanceCounter
QueryPerformanceFrequency
K32EnumPageFilesA
K32GetDeviceDriverBaseNameA
K32GetDeviceDriverFileNameA
K32GetMappedFileNameA
K32GetModuleBaseNameA
K32GetModuleFileNameExA
K32GetProcessImageFileNameA
QueryFullProcessImageNameA
K32EmptyWorkingSet
K32EnumDeviceDrivers
K32EnumPageFilesW
K32EnumProcesses
K32EnumProcessModules
K32EnumProcessModulesEx
K32GetDeviceDriverBaseNameW
K32GetDeviceDriverFileNameW
K32GetMappedFileNameW
K32GetModuleBaseNameW
K32GetModuleFileNameExW
K32GetModuleInformation
K32GetPerformanceInfo
K32GetProcessImageFileNameW
K32GetProcessMemoryInfo
K32GetWsChanges
K32GetWsChangesEx
K32InitializeProcessForWsWatch
K32QueryWorkingSet
K32QueryWorkingSetEx
QueryFullProcessImageNameW
QueryIdleProcessorCycleTime
QueryIdleProcessorCycleTimeEx
QueryProcessCycleTime
QueryThreadCycleTime
QueryUnbiasedInterruptTime
RegCloseKey
RegCopyTreeW
RegCreateKeyExA
RegCreateKeyExW
RegDeleteKeyExA
RegDeleteKeyExW
RegDeleteTreeA
RegDeleteTreeW
RegDeleteValueA
RegDeleteValueW
RegDisablePredefinedCacheEx
RegEnumKeyExA
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegFlushKey
RegGetKeySecurity
RegGetValueA
RegGetValueW
RegLoadAppKeyW
RegLoadKeyA
RegLoadKeyW
RegLoadMUIStringA
RegLoadMUIStringW
RegNotifyChangeKeyValue
RegOpenCurrentUser
RegOpenKeyExA
RegOpenKeyExW
RegOpenUserClassesRoot
RegQueryInfoKeyA
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegRestoreKeyA
RegRestoreKeyW
RegSaveKeyExA
RegSaveKeyExW
RegSetKeySecurity
RegSetValueExA
RegSetValueExW
RegUnLoadKeyA
RegUnLoadKeyW
RtlAddFunctionTable
RtlCaptureContext
RtlCaptureStackBackTrace
RtlCompareMemory
RtlDeleteFunctionTable
RtlInstallFunctionTableCallback
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlRaiseException
RtlRestoreContext
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
ActivateActCtx
AddRefActCtx
CreateActCtxW
DeactivateActCtx
FindActCtxSectionGuid
FindActCtxSectionStringW
GetCurrentActCtx
QueryActCtxSettingsW
QueryActCtxW
ReleaseActCtx
ZombifyActCtx
CompareStringEx
CompareStringOrdinal
CompareStringW
FoldStringW
GetStringTypeExW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
CancelWaitableTimer
CreateEventA
CreateEventExA
CreateEventExW
CreateEventW
CreateMutexA
CreateMutexExA
CreateMutexExW
CreateMutexW
CreateSemaphoreExW
CreateWaitableTimerExW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
LeaveCriticalSection
OpenEventA
OpenEventW
OpenMutexW
OpenSemaphoreW
OpenWaitableTimerW
ReleaseMutex
ReleaseSemaphore
ResetEvent
SetEvent
SetWaitableTimer
SleepEx
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
DeleteSynchronizationBarrier
EnterSynchronizationBarrier
InitializeSynchronizationBarrier
InitOnceExecuteOnce
SignalObjectAndWait
CreateSemaphoreW
WaitForMultipleObjects
GetComputerNameExA
GetComputerNameExW
GetLocalTime
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTickCount
GetVersion
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalMemoryStatusEx
SetLocalTime
EnumSystemFirmwareTables
GetNativeSystemInfo
GetProductInfo
GetSystemFirmwareTable
GetSystemTimePreciseAsFileTime
SetComputerNameExW
SetSystemTime
DnsHostnameToComputerNameExW
GetPhysicallyInstalledSystemMemory
SetComputerNameEx2W
SetComputerNameA
SetComputerNameExA
SetComputerNameW
GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
GetNumaProximityNodeEx
ChangeTimerQueueTimer
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueEx
DeleteTimerQueueTimer
QueueUserWorkItem
UnregisterWaitEx
RegisterWaitForSingleObjectEx
FileTimeToSystemTime
GetDynamicTimeZoneInformation
GetTimeZoneInformation
GetTimeZoneInformationForYear
SetDynamicTimeZoneInformation
SetTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
Beep
GetApplicationRecoveryCallback
GetApplicationRestartSettings
WerRegisterFile
WerRegisterMemoryBlock
WerRegisterRuntimeExceptionModule
WerUnregisterFile
WerUnregisterMemoryBlock
WerUnregisterRuntimeExceptionModule
WerRegisterAdditionalProcess
WerRegisterCustomMetadata
WerRegisterExcludedMemoryBlock
WerUnregisterAdditionalProcess
WerUnregisterCustomMetadata
WerUnregisterExcludedMemoryBlock
WerRegisterAppLocalDump
WerUnregisterAppLocalDump
IsWow64Process
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
GetSystemWow64Directory2W
GetSystemWow64DirectoryA
GetSystemWow64DirectoryW
IsWow64Process2
CopyContext
GetEnabledXStateFeatures
GetXStateFeaturesMask
InitializeContext
LocateXStateFeature
SetXStateFeaturesMask
InitializeContext2
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
GetAppContainerNamedObjectPath
AccessCheck
AllocateAndInitializeSid
DuplicateToken
EqualSid
FreeSid
AddResourceAttributeAce
AddScopedPolicyIDAce
CheckTokenCapability
CheckTokenMembershipEx
GetAppContainerAce
GetCachedSigningLevel
SetCachedSigningLevel
AppContainerFreeMemory
AppContainerLookupMoniker
AppXGetOSMaxVersionTested
AppXPostSuccessExtension
AppXPreCreationExtension
AppXReleaseAppXContext
AreFileApisANSI
BaseDllFreeResourceId
BaseDllMapResourceIdW
BaseFormatObjectAttributes
BaseGetNamedObjectDirectory
BasepAdjustObjectAttributesForPrivateNamespace
BasepNotifyTrackingService
CheckAllowDecryptedRemoteDestinationPolicy
CheckGroupPolicyEnabled
ClosePackageInfo
CompareStringA
CreateProcessAsUserA
CreateProcessAsUserW
CreateProcessInternalA
CreateProcessInternalW
EnumLanguageGroupLocalesW
EnumSystemLanguageGroupsW
EnumSystemLocalesEx
EnumUILanguagesW
FatalAppExitA
FatalAppExitW
GetCalendar
GetCurrentPackageFullName
GetEightBitStringToUnicodeStringRoutine
GetEraNameCountedString
GetLocaleInfoHelper
GetNamedLocaleHashNode
GetNamedPipeAttribute
GetPackageFullName
GetPackageTargetPlatformProperty
GetProcAddressForCaller
GetPtrCalData
GetPtrCalDataArray
GetRegistryExtensionFlags
GetStringTableEntry
GetStringTypeA
GetSystemDefaultLocaleName
GetSystemDefaultUILanguage
GetTargetPlatformContext
GetUnicodeStringToEightBitSizeRoutine
GetUnicodeStringToEightBitStringRoutine
GetUserDefaultLocaleName
GetUserDefaultUILanguage
GetUserOverrideString
GetUserOverrideWord
GetVolumeNameForVolumeMountPointW
GlobalAlloc
GlobalFree
HeapSummary
Internal_EnumCalendarInfo
Internal_EnumDateFormats
Internal_EnumLanguageGroupLocales
Internal_EnumSystemCodePages
Internal_EnumSystemLanguageGroups
Internal_EnumTimeFormats
Internal_EnumUILanguages
InternalLcidToName
KernelBaseGetGlobalData
LCIDToLocaleName
LoadStringBaseExW
LocalAlloc
LocalLock
LocalReAlloc
LocalUnlock
lstrcmpiW
lstrcmpW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW
MapViewOfFileExNuma
MoveFileWithProgressTransactedW
NlsIsUserDefaultLocale
NlsValidateLocale
NotifyMountMgr
OpenPackageInfoByFullNameForUser
OpenRegKey
PackageIdFromFullName
PrivCopyFileExW
PulseEvent
SetFileApisToANSI
SetFileApisToOEM
Sleep
__C_specific_handler
_local_unwind
_memicmp
_stricmp
_strnicmp
_vsnwprintf
_wcsicmp
_wcslwr
_wcsnicmp
_wtol
atol
bsearch
cos
CsrAllocateCaptureBuffer
CsrAllocateMessagePointer
CsrCaptureMessageMultiUnicodeStringsInPlace
CsrCaptureMessageString
CsrClientCallServer
CsrFreeCaptureBuffer
CsrVerifyRegion
DbgPrint
DbgPrintEx
DbgUiGetThreadDebugObject
DbgUiIssueRemoteBreakin
EtwEventEnabled
EtwEventRegister
EtwEventUnregister
EtwEventWrite
EtwEventWriteNoRegistration
floor
isdigit
LdrAddRefDll
LdrDisableThreadCalloutsForDll
LdrFindResource_U
LdrFindResourceEx_U
LdrGetDllDirectory
LdrGetProcedureAddress
LdrLoadDll
LdrOpenImageFileOptionsKey
LdrQueryImageFileExecutionOptions
LdrQueryImageFileKeyOption
LdrResFindResourceDirectory
LdrResSearchResource
LdrSetDllDirectory
LdrSetDllManifestProber
LdrUnloadDll
memcmp
memcpy
memmove
memmove_s
memset
NlsMbCodePageTag
NtAddAtomEx
NtAllocateVirtualMemory
NtApphelpCacheControl
NtAssignProcessToJobObject
NtClearEvent
NtClose
NtCreateEvent
NtCreateFile
NtCreateJobObject
NtCreateJobSet
NtCreateKey
NtCreateMailslotFile
NtCreateSection
NtDeleteAtom
NtDeleteValueKey
NtDeviceIoControlFile
NtEnumerateKey
NtEnumerateValueKey
NtFindAtom
NtFlushKey
NtFreeVirtualMemory
NtFsControlFile
NtGetDevicePowerState
NtInitiatePowerAction
NtIsSystemResumeAutomatic
NtLockFile
NtMapUserPhysicalPagesScatter
NtMapViewOfSection
NtOpenFile
NtOpenJobObject
NtOpenKey
NtOpenProcessToken
NtOpenThreadToken
NtPowerInformation
NtProtectVirtualMemory
NtQueryAttributesFile
NtQueryDirectoryFile
NtQueryEaFile
NtQueryEvent
NtQueryFullAttributesFile
NtQueryInformationAtom
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInformationToken
NtQueryInstallUILanguage
NtQueryLicenseValue
NtQuerySection
NtQuerySecurityObject
NtQuerySystemEnvironmentValueEx
NtQuerySystemInformation
NtQueryTimerResolution
NtQueryValueKey
NtQueryVirtualMemory
NtQueryVolumeInformationFile
NtQueryWnfStateData
NtRaiseHardError
NtReadFile
NtReadVirtualMemory
NtReplacePartitionUnit
NtSetEaFile
NtSetInformationDebugObject
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationProcess
NtSetInformationThread
NtSetSecurityObject
NtSetSystemEnvironmentValueEx
NtSetSystemInformation
NtSetThreadExecutionState
NtSetTimerResolution
NtSetValueKey
NtSetVolumeInformationFile
NtTerminateJobObject
NtTerminateProcess
NtUnlockFile
NtUnmapViewOfSection
NtWaitForMultipleObjects
NtWaitForSingleObject
NtWriteFile
RtlAcquirePrivilege
RtlAcquireSRWLockExclusive
RtlActivateActivationContext
RtlActivateActivationContextUnsafeFast
RtlAddAccessAllowedAce
RtlAddAtomToAtomTable
RtlAddIntegrityLabelToBoundaryDescriptor
RtlAddRefActivationContext
RtlAllocateAndInitializeSid
RtlAllocateHandle
RtlAllocateHeap
RtlAnsiStringToUnicodeString
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlCharToInteger
RtlCompactHeap
RtlCompareUnicodeString
RtlComputeImportTableHash
RtlConvertSidToUnicodeString
RtlCopyUnicodeString
RtlCreateAcl
RtlCreateActivationContext
RtlCreateAtomTable
RtlCreateBoundaryDescriptor
RtlCreateEnvironment
RtlCreateEnvironmentEx
RtlCreateQueryDebugBuffer
RtlCreateSecurityDescriptor
RtlCreateUmsCompletionList
RtlCreateUmsThreadContext
RtlCreateUnicodeString
RtlCreateUnicodeStringFromAsciiz
RtlDeactivateActivationContext
RtlDeactivateActivationContextUnsafeFast
RtlDecodeSystemPointer
RtlDeleteAtomFromAtomTable
RtlDeleteUmsCompletionList
RtlDeleteUmsThreadContext
RtlDequeueUmsCompletionListItems
RtlDeregisterSecureMemoryCacheCallback
RtlDeregisterWait
RtlDestroyAtomTable
RtlDestroyEnvironment
RtlDestroyQueryDebugBuffer
RtlDetermineDosPathNameType_U
RtlDisableThreadProfiling
RtlDnsHostNameToComputerName
RtlDoesFileExists_U
RtlDosPathNameToNtPathName_U
RtlDosPathNameToNtPathName_U_WithStatus
RtlDosPathNameToRelativeNtPathName_U
RtlEnableThreadProfiling
RtlEncodeSystemPointer
RtlEnterCriticalSection
RtlEnterUmsSchedulingMode
RtlEqualSid
RtlEqualString
RtlEqualUnicodeString
RtlExecuteUmsThread
RtlExitUserProcess
RtlExitUserThread
RtlExpandEnvironmentStrings_U
RtlFindActivationContextSectionGuid
RtlFindActivationContextSectionString
RtlFormatCurrentUserKeyPath
RtlFreeAnsiString
RtlFreeHandle
RtlFreeHeap
RtlFreeOemString
RtlFreeSid
RtlFreeUnicodeString
RtlGetActiveActivationContext
RtlGetActiveConsoleId
RtlGetAppContainerParent
RtlGetAppContainerSidType
RtlGetCurrentDirectory_U
RtlGetCurrentProcessorNumberEx
RtlGetCurrentServiceSessionId
RtlGetCurrentTransaction
RtlGetCurrentUmsThread
RtlGetDeviceFamilyInfoEnum
RtlGetFullPathName_U
RtlGetFullPathName_UEx
RtlGetLengthWithoutLastFullDosOrNtPathElement
RtlGetLongestNtPathLength
RtlGetNativeSystemInformation
RtlGetNextUmsListItem
RtlGetNtSystemRoot
RtlGetSuiteMask
RtlGetThreadErrorMode
RtlGetThreadPreferredUILanguages
RtlGetUILanguageInfo
RtlGetUmsCompletionListEvent
RtlGetUserInfoHeap
RtlGetVersion
RtlGUIDFromString
RtlHashUnicodeString
RtlImageDirectoryEntryToData
RtlImageNtHeader
RtlImageNtHeaderEx
RtlInitAnsiString
RtlInitAnsiStringEx
RtlInitializeCriticalSection
RtlInitializeSid
RtlInitString
RtlInitUnicodeString
RtlInitUnicodeStringEx
RtlIntegerToUnicodeString
RtlIsNameLegalDOS8Dot3
RtlIsTextUnicode
RtlIsValidHandle
RtlLCIDToCultureName
RtlLeaveCriticalSection
RtlLengthSecurityDescriptor
RtlLockHeap
RtlLookupAtomInAtomTable
RtlMultiAppendUnicodeStringBuffer
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlNtPathNameToDosPathName
RtlNtStatusToDosError
RtlNtStatusToDosErrorNoTeb
RtlOemStringToUnicodeString
RtlpApplyLengthFunction
RtlpConvertCultureNamesToLCIDs
RtlpConvertLCIDsToCultureNames
RtlpEnsureBufferSize
RtlPrefixString
RtlPrefixUnicodeString
RtlPublishWnfStateData
RtlQueryActivationContextApplicationSettings
RtlQueryAtomInAtomTable
RtlQueryElevationFlags
RtlQueryEnvironmentVariable
RtlQueryEnvironmentVariable_U
RtlQueryInformationActivationContext
RtlQueryPackageClaims
RtlQueryPackageIdentity
RtlQueryProcessDebugInformation
RtlQueryProtectedPolicy
RtlQueryRegistryValuesEx
RtlQueryThreadProfiling
RtlQueryUmsThreadInformation
RtlQueryWnfStateData
RtlRaiseStatus
RtlReadThreadProfilingData
RtlReAllocateHeap
RtlRegisterSecureMemoryCacheCallback
RtlRegisterWait
RtlReleaseActivationContext
RtlReleasePebLock
RtlReleasePrivilege
RtlReleaseRelativeName
RtlReleaseSRWLockExclusive
RtlRunOnceExecuteOnce
RtlSetCurrentTransaction
RtlSetDaclSecurityDescriptor
RtlSetEnvironmentStrings
RtlSetEnvironmentVariable
RtlSetGroupSecurityDescriptor
RtlSetIoCompletionCallback
RtlSetLastWin32Error
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlSetOwnerSecurityDescriptor
RtlSetProtectedPolicy
RtlSetSearchPathMode
RtlSetThreadPoolStartFunc
RtlSetThreadPreferredUILanguages
RtlSetUmsThreadInformation
RtlSetUserValueHeap
RtlSizeHeap
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlSubscribeWnfStateChangeNotification
RtlSwitchedVVI
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlTryAcquirePebLock
RtlUmsThreadYield
RtlUnhandledExceptionFilter
RtlUnicodeStringToAnsiString
RtlUnicodeStringToInteger
RtlUnicodeStringToOemString
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlUnlockHeap
RtlUnsubscribeWnfStateChangeNotification
RtlUpcaseUnicodeChar
RtlVerifyVersionInfo
RtlWerpReportException
RtlWow64EnableFsRedirection
RtlWow64GetThreadContext
RtlWow64GetThreadSelectorEntry
RtlWow64LogMessageInEventLogger
RtlWow64SetThreadContext
RtlWow64SuspendThread
RtlxAnsiStringToUnicodeSize
RtlxUnicodeStringToAnsiSize
RtlZombifyActivationContext
sin
strcat_s
strchr
strcpy_s
strncmp
strncpy_s
strnlen
strrchr
swprintf_s
tolower
toupper
towlower
TpAllocCleanupGroup
TpAllocIoCompletion
TpAllocPool
TpAllocTimer
TpAllocWait
TpAllocWork
TpCallbackMayRunLong
TpCaptureCaller
TpQueryPoolStackInformation
TpSetPoolMinThreads
TpSetPoolStackInformation
TpSimpleTryPost
VerSetConditionMask
wcscat_s
wcschr
wcscmp
wcscpy_s
wcscspn
wcsncmp
wcsncpy
wcsncpy_s
wcsnlen
wcsrchr
wcsstr
ZwClose
ZwCreateFile
ZwCreateSection
ZwEnumerateKey
ZwMapViewOfSection
ZwOpenFile
ZwOpenKey
ZwQueryDirectoryFile
ZwQueryInformationFile
ZwQuerySystemInformation
ZwQueryValueKey
ZwUnmapViewOfSection
mikewa1 commented 4 years ago

Ok, I will keep it in mind too!