Windows Kernel Exports

The very large table on this page lists all the functions and variables—there are more than three thousand—that appear in the export directory of any known i386 (x86) or amd64 (x64) build of the Windows kernel. Many have been or still are exported from the kernel for other processor architectures, but x86 and x64 account for very nearly all Windows computers whose users actually do think of and use their computers as computers, in contrast to phones, devices and things. So, only x86 and x64 matter to this study.

This table is intended as a master list. For each name, the table gives just a brief summary of the applicable kernel versions and a colour-coded summary of status with respect to Microsoft’s documentation. Details of an export’s availability and documentation history may be found by looking for the export in other lists, according to its first version as shown here. In the Table of Contents, expand the kernel’s entry for History to get pages for each version. This is how this study means you to find, for example, that although a function of interest to you has been exported since 1993, it is said by Microsoft’s documentation to be available only starting from Windows Server 2003 SP1, and that even this wasn’t revealed until 2007.

Documentation status is summarised by colour coding. If you read this website with scripts enabled, then hovering the mouse over any coloured text will produce a tooltip that shows why the text is coloured. Functions that have their own non-trivial documentation are shown with no background colour, this documentation status being completely unremarkable. Functions that are documented as reserved or obsolete are shaded red or shaded grey, respectively, as quick indications that they are better avoided. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status. Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange. They are not formally documented, nor formally reserved, but neither are they completely undocumented: indeed, history shows they’re often on the way to being documented. Some undocumented functions aren’t declared in any WDK header now but had declarations disclosed by Microsoft in a “minwin” subdirectory of early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public knowledge even of the declaration is exceptional.

The first known Windows kernel is version 3.10. It is, of course, built for the x86 architecture. The first known x64 kernel is the version 5.2 from Windows Server 2003 SP1. That a function or variable is exported in all versions of the applicable architecture is often some sign of its being fundamental and seems deserving of an easy indication. The shorthand “all” means “3.10 and higher” for the x86 and “5.2 SP1 and higher” for the x64. When clearly limited just to the x64, version 5.2 is treated as beginning with SP1.

There has been a slow migration of functionality to the kernel from the HAL. That a kernel export started as a HAL export is indicated below by an “also from HAL” annotation. In all cases, the kernel has the substantial implementation. For whether the HAL retains a stub implementation or merely forwards its export to the kernel, look for the function in the HAL’s history of exports. Some migration has been x64-specific. Since the x86 implementations are not kernel exports, they might be omitted from the table, but to help with cross-referencing they are indicated below by an x86-specific direction to “see HAL”.

Substantial explanatory notes, especially about the different sources and degrees of documentation, follow the table.

Function Architecture Versions
AlpcCreateSecurityContext   1709 and higher
AlpcGetHeaderSize   6.0 and higher
AlpcGetMessageAttribute   6.0 and higher
AlpcInitializeMessageAttribute   6.0 and higher
BgkDisplayCharacter   6.2 and higher
BgkGetConsoleState   6.2 and higher
BgkGetCursorState   6.2 and higher
BgkSetCursor   6.2 and higher
CcAddDirtyPagesToExternalCache   6.2 and higher
CcAsyncCopyRead   10.0 and higher
CcCanIWrite   all
CcCoherencyFlushAndPurgeCache   6.1 and higher
CcCopyRead   all
CcCopyReadEx   6.2 and higher
CcCopyWrite   all
CcCopyWriteEx   6.2 and higher
CcCopyWriteWontFlush   6.1 and higher
CcDeductDirtyPagesFromExternalCache   6.2 and higher
CcDeferWrite   all
CcErrorCallbackRoutine   2004 and higher
CcFastCopyRead   4.0 and higher
CcFastCopyWrite   4.0 and higher
CcFastMdlReadWait (data)   4.0 and higher
CcFastReadNotPossible (data)   4.0 to 5.2
CcFastReadWait (data)   4.0 to 5.2
CcFlushCache   all
CcFlushCacheToLsn   6.2 and higher
CcGetCachedDirtyPageCountForFile   1607 and higher
CcGetDirtyPages   all
CcGetFileObjectFromBcb   all
CcGetFileObjectFromSectionPtrs   all
CcGetFileObjectFromSectionPtrsRef   6.0 and higher
CcGetFlushedValidData   5.0 and higher
CcGetLsnForFileObject   3.50 and higher
CcGetNumberOfMappedPages   1709 and higher
CcInitializeCacheMap   all
CcInitializeCacheMapEx   1607 and higher
CcIsCacheManagerCallbackNeeded   2004 and higher
CcIsThereDirtyData   all
CcIsThereDirtyDataEx   6.0 and higher
CcIsThereDirtyLoggedPages   6.2 and higher
CcMapData   all
CcMdlRead   all
CcMdlReadComplete   all
CcMdlWriteAbort   5.1 and higher
CcMdlWriteComplete   all
CcPinMappedData   all
CcPinRead   all
CcPrepareMdlWrite   all
CcPreparePinWrite   all
CcPurgeCacheSection   all
CcRegisterExternalCache   6.2 and higher
CcRemapBcb   5.0 and higher
CcRepinBcb   all
CcScheduleReadAhead   all
CcScheduleReadAheadEx   6.2 and higher
CcSetAdditionalCacheAttributes   all
CcSetAdditionalCacheAttributesEx   6.2 and higher
CcSetBcbOwnerPointer   4.0 and higher
CcSetDirtyPageThreshold   all
CcSetDirtyPinnedData   all
CcSetFileSizes   all
CcSetFileSizesEx   6.0 and higher
CcSetLogHandleForFile   all
CcSetLogHandleForFileEx   6.2 and higher
CcSetLoggedDataThreshold   6.2 and higher
CcSetParallelFlushFile   6.0 and higher
CcSetReadAheadGranularity   all
CcSetReadAheadGranularityEx   6.2 and higher
CcTestControl   6.0 and higher
CcUninitializeCacheMap   all
CcUnmapFileOffsetFromSystemCache   6.2 and higher
CcUnpinData   all
CcUnpinDataForThread   all
CcUnpinRepinnedBcb   all
CcUnregisterExternalCache   6.2 and higher
CcWaitForCurrentLazyWriterActivity   5.0 and higher
CcZeroData   all
CcZeroDataOnDisk   6.2 and higher
ClipInitHandles (25)   2004 and higher
CmCallbackGetKeyObjectID   6.0 and higher
CmCallbackGetKeyObjectIDEx   6.2 and higher
CmCallbackReleaseKeyObjectIDEx   6.2 and higher
CmGetBoundTransaction   6.0 and higher
CmGetCallbackVersion   6.0 and higher
CmKeyObjectType (data)   6.1 and higher
CmRegisterCallback   5.1 and higher
CmRegisterCallbackEx   6.0 and higher
CmRegisterMachineHiveLoadedNotification   2004 and higher
CmSetCallbackObjectContext   6.0 and higher
CmUnRegisterCallback   5.1 and higher
CmUnregisterMachineHiveLoadedNotification   2004 and higher
DbgBreakPoint   all
DbgBreakPointWithStatus   4.0 and higher
DbgCommandString   5.2 and higher
DbgLoadImageSymbols   all
DbgPrint   all
DbgPrintEx   5.1 and higher
DbgPrintReturnControlC   5.0 and higher
DbgPrompt   3.51 and higher
DbgQueryDebugFilterState   5.1 and higher
DbgSetDebugFilterState   5.1 and higher
DbgSetDebugPrintCallback   6.0 and higher
DbgkLkmdRegisterCallback   6.1 and higher
DbgkLkmdUnregisterCallback   6.1 and higher
DbgkWerCaptureLiveKernelDump   6.3 and higher
EmClientQueryRuleState   6.0 and higher
EmClientRuleDeregisterNotification   6.0 and higher
EmClientRuleEvaluate   6.0 and higher
EmClientRuleRegisterNotification   6.0 and higher
EmProviderDeregister   6.0 and higher
EmProviderDeregisterEntry   6.0 and higher
EmProviderRegister   6.0 and higher
EmProviderRegisterEntry   6.0 and higher
EmpProviderRegister   6.0 and higher
EtwActivityIdControl   6.0 and higher
EtwEnableTrace   6.0 and higher
EtwEventEnabled   6.0 and higher
EtwProviderEnabled   6.0 and higher
EtwRegister   6.0 and higher
EtwRegisterClassicProvider   6.0 SP1 and higher
EtwSendTraceBuffer   6.0 SP1 and higher
EtwSetInformation   10.0 and higher
EtwTelemetryCoverageReport   1709 and higher
EtwUnregister   6.0 and higher
EtwWrite   6.0 and higher
EtwWriteEndScenario   6.0 and higher
EtwWriteEx   6.1 and higher
EtwWriteStartScenario   6.0 and higher
EtwWriteString   6.0 and higher
EtwWriteTransfer   6.0 and higher
EtwpDisableStackWalkApc   1803 and higher
EtwpReenableStackWalkApc   1803 and higher
ExAcquireAutoExpandPushLockExclusive   10.0 and higher
ExAcquireAutoExpandPushLockShared   10.0 and higher
ExAcquireCacheAwarePushLockExclusive   6.0 and higher
ExAcquireCacheAwarePushLockExclusiveEx   6.3 and higher
ExAcquireCacheAwarePushLockSharedEx   6.3 and higher
ExAcquireFastMutex x64 all
x86 6.2 and higher;
also from HAL in 3.50 and higher
ExAcquireFastMutexUnsafe   3.50 and higher
ExAcquireFastResourceExclusive   1703 and higher
ExAcquireFastResourceShared   1703 and higher
ExAcquireFastResourceSharedStarveExclusive   1703 and higher
ExAcquirePushLockExclusiveEx   6.3 and higher
ExAcquirePushLockSharedEx   6.3 and higher
ExAcquireResourceExclusive   3.10 to 5.0
ExAcquireResourceExclusiveLite   3.50 and higher
ExAcquireResourceShared   3.10 only
ExAcquireResourceSharedLite   3.50 and higher
ExAcquireRundownProtection   5.1 and higher
ExAcquireRundownProtectionCacheAware   5.2 SP1 and higher
ExAcquireRundownProtectionCacheAwareEx   5.2 SP1 and higher
ExAcquireRundownProtectionEx   5.1 SP2 and higher
ExAcquireSharedStarveExclusive   3.51 and higher
ExAcquireSharedWaitForExclusive   3.50 and higher
ExAcquireSpinLockExclusive   6.0 SP1 and higher
ExAcquireSpinLockExclusiveAtDpcLevel   6.0 SP1 and higher
ExAcquireSpinLockShared   6.0 SP1 and higher
ExAcquireSpinLockSharedAtDpcLevel   6.0 SP1 and higher
ExActivationObjectType   1903 and higher
ExAllocateAutoExpandPushLock   10.0 and higher
ExAllocateCacheAwarePushLock   6.0 and higher
ExAllocateCacheAwareRundownProtection   5.2 SP1 and higher
ExAllocateFromPagedLookasideList x86 4.0 and higher
x64 5.2 only
ExAllocatePool   all
ExAllocatePool2   2004 and higher
ExAllocatePool3   2004 and higher
ExAllocatePoolWithQuota   all
ExAllocatePoolWithQuotaTag   3.50 and higher
ExAllocatePoolWithTag   3.50 and higher
ExAllocatePoolWithTagPriority   4.0 SP4 and higher
ExAllocateTimer   6.3 and higher
ExAllocateTimerInternal (3)   6.3 and higher
ExAllocateTimerInternal2 (4)   1703 and higher
ExBlockOnAddressPushLock   6.2 and higher
ExBlockPushLock   6.2 and higher
ExCancelTimer   6.3 and higher
ExCleanupAutoExpandPushLock   10.0 and higher
ExCleanupRundownProtectionCacheAware   10.0 and higher
ExCompositionObjectType (data)   6.3 and higher
ExCompositionSurfaceObjectType (data)   6.2 only
ExConvertExclusiveToShared   3.10 only
ExConvertExclusiveToSharedLite   3.50 and higher
ExConvertFastResourceExclusiveToShared   1703 and higher
ExConvertPushLockExclusiveToShared   10.0 and higher
ExCoreMessagingObjectType (data)   1607 and higher
ExCreateCallback   3.51 and higher
ExDeleteFastResource   1703 and higher
ExDeleteLookasideListEx   6.0 and higher
ExDeleteNPagedLookasideList   4.0 and higher
ExDeletePagedLookasideList   4.0 and higher
ExDeleteResource   3.10 to 5.0
ExDeleteResourceLite   3.50 and higher
ExDeleteTimer   6.3 and higher
ExDesktopObjectType (data)   4.0 and higher
ExDisableResourceBoost   3.10 only
ExDisableResourceBoostLite   3.50 and higher
ExDisownFastResource   1703 and higher
ExEnterCriticalRegionAndAcquireFastMutexUnsafe   5.2 SP1 and higher
ExEnterCriticalRegionAndAcquireResourceExclusive   5.2 SP1 and higher
ExEnterCriticalRegionAndAcquireResourceShared   5.2 SP1 and higher
ExEnterCriticalRegionAndAcquireSharedWaitForExclusive   5.2 SP1 and higher
ExEnterPriorityRegionAndAcquireResourceExclusive   6.0 SP1 and higher
ExEnterPriorityRegionAndAcquireResourceShared   6.0 SP1 and higher
ExEnumHandleTable   4.0 and higher
ExEnumerateSystemFirmwareTables   1607 and higher
ExEventObjectType (data)   3.51 and higher
ExExtendZone   all
ExFetchLicenseData   6.0 and higher
ExFlushLookasideListEx   6.0 and higher
ExFreeAutoExpandPushLock   10.0 and higher
ExFreeCacheAwarePushLock   6.0 and higher
ExFreeCacheAwareRundownProtection   5.2 SP1 and higher
ExFreePool   all
ExFreePoolWithTag   5.0 and higher
ExFreeToPagedLookasideList x86 4.0 and higher
x64 5.2 only
ExGetCurrentProcessorCounts   5.1 and higher
ExGetCurrentProcessorCpuUsage   5.1 and higher
ExGetExclusiveWaiterCount   3.50 and higher
ExGetFirmwareEnvironmentVariable   6.2 and higher
ExGetFirmwareType   1709 and higher
ExGetLicenseTamperState   6.0 and higher
ExGetPreviousMode   4.0 and higher
ExGetSharedWaiterCount   3.50 and higher
ExGetSystemFirmwareTable   1607 and higher
ExInitializeAutoExpandPushLock   10.0 and higher
ExInitializeFastOwnerEntry   1703 and higher
ExInitializeFastResource   1703 and higher
ExInitializeLookasideListEx   6.0 and higher
ExInitializeNPagedLookasideList   4.0 and higher
ExInitializePagedLookasideList   4.0 and higher
ExInitializePushLock   6.0 and higher
ExInitializeResource   3.10 to 5.0
ExInitializeResourceLite   3.50 and higher
ExInitializeRundownProtection   5.1 and higher
ExInitializeRundownProtectionCacheAware   5.2 SP1 and higher
ExInitializeRundownProtectionCacheAwareEx   10.0 and higher
ExInitializeZone   all
ExInterlockedAddLargeInteger   all
ExInterlockedAddLargeStatistic x86 3.50 and higher
ExInterlockedAddUlong   all
ExInterlockedCompareExchange64 x86 4.0 and higher
ExInterlockedDecrementLong x86 all
ExInterlockedExchangeUlong x86 all
ExInterlockedExtendZone   3.50 and higher
ExInterlockedFlushSList x86 5.0 and higher
ExInterlockedIncrementLong x86 all
ExInterlockedInsertHeadList   all
ExInterlockedInsertTailList   all
ExInterlockedPopEntryList   all
ExInterlockedPopEntrySList x86 4.0 and higher
ExInterlockedPushEntryList   all
ExInterlockedPushEntrySList x86 4.0 and higher
ExInterlockedRemoveHeadList   all
ExIsFastResourceContended   1703 and higher
ExIsFastResourceHeld   1703 and higher
ExIsFastResourceHeldExclusive   1703 and higher
ExIsManufacturingModeEnabled   10.0 and higher
ExIsProcessorFeaturePresent   4.0 and higher
ExIsResourceAcquiredExclusiveLite   3.50 and higher
ExIsResourceAcquiredShared   3.10 only
ExIsResourceAcquiredSharedLite   3.50 and higher
ExIsSoftBoot   1709 and higher
ExLocalTimeToSystemTime   all
ExNotifyBootDeviceRemoval   6.2 and higher
ExNotifyCallback   3.51 and higher
ExPostSystemEvent   3.51 to 4.0
ExQueryAttributeInformation   6.1 to 6.2
ExQueryDepthSList x64 all
ExQueryFastCacheAppOrigin   6.2 to 10.0
ExQueryFastCacheDevLicense   6.2 and higher
ExQueryPoolBlockSize   all
ExQueryTimerResolution   6.2 and higher
ExQueryWnfStateData   6.2 and higher
ExQueueWorkItem   all
ExRaiseAccessViolation   3.51 and higher
ExRaiseDatatypeMisalignment   3.51 and higher
ExRaiseException   3.51 and higher
ExRaiseHardError   all
ExRaiseStatus   all
ExRawInputManagerObjectType (data)   10.0 and higher
ExReInitializeRundownProtection   5.1 and higher
ExReInitializeRundownProtectionCacheAware   5.2 SP1 and higher
ExRealTimeIsUniversal   6.2 and higher
ExRegisterAttributeInformationCallback   6.1 to 6.2
ExRegisterBootDevice   6.2 and higher
ExRegisterCallback   3.51 and higher
ExRegisterExtension   6.1 and higher
ExReinitializeFastResource   1703 and higher
ExReinitializeResourceLite   3.51 and higher
ExReleaseAutoExpandPushLockExclusive   10.0 and higher
ExReleaseAutoExpandPushLockShared   10.0 and higher
ExReleaseCacheAwarePushLockExclusive   6.0 and higher
ExReleaseCacheAwarePushLockExclusiveEx   6.3 and higher
ExReleaseCacheAwarePushLockSharedEx   6.3 and higher
ExReleaseDisownedFastResource   1703 and higher
ExReleaseDisownedFastResourceExclusive   1703 and higher
ExReleaseDisownedFastResourceShared   1703 and higher
ExReleaseFastMutex x64 all
x86 6.2 and higher;
also from HAL in 3.50 and higher
ExReleaseFastMutexUnsafe   3.50 and higher
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion   5.2 SP1 and higher
ExReleaseFastResource   1703 and higher
ExReleaseFastResourceExclusive   1703 and higher
ExReleaseFastResourceShared   1703 and higher
ExReleasePushLockEx   6.3 and higher
ExReleasePushLockExclusiveEx   6.3 and higher
ExReleasePushLockSharedEx   6.3 and higher
ExReleaseResource   3.10 only
ExReleaseResourceAndLeaveCriticalRegion   5.2 SP1 and higher
ExReleaseResourceAndLeavePriorityRegion   6.0 SP1 and higher
ExReleaseResourceForThread   3.10 to 5.0
ExReleaseResourceForThreadLite   3.50 and higher
ExReleaseResourceLite   3.50 and higher
ExReleaseRundownProtection   5.1 and higher
ExReleaseRundownProtectionCacheAware   5.2 SP1 and higher
ExReleaseRundownProtectionCacheAwareEx   5.2 SP1 and higher
ExReleaseRundownProtectionEx   5.1 SP2 and higher
ExReleaseSpinLockExclusive   6.0 SP1 and higher
ExReleaseSpinLockExclusiveFromDpcLevel   6.0 SP1 and higher
ExReleaseSpinLockShared   6.0 SP1 and higher
ExReleaseSpinLockSharedFromDpcLevel   6.0 SP1 and higher
ExRundownCompleted   5.1 and higher
ExRundownCompletedCacheAware   5.2 SP1 and higher
ExSemaphoreObjectType (data)   5.0 and higher
ExSetFirmwareEnvironmentVariable   6.2 and higher
ExSetLicenseTamperState   6.0 and higher
ExSetResourceOwnerPointer   4.0 and higher
ExSetResourceOwnerPointerEx   6.1 and higher
ExSetTimer   6.3 and higher
ExSetTimerResolution   5.0 and higher
ExShareAddressSpaceWithDevice   10.0 and higher
ExSizeOfAutoExpandPushLock   10.0 and higher
ExSizeOfRundownProtectionCacheAware   5.2 SP1 and higher
ExSubscribeWnfStateChange   6.2 and higher
ExSvmBeginDeviceReset   1703 and higher
ExSvmFinalizeDeviceReset   1703 and higher
ExSystemExceptionFilter   all
ExSystemTimeToLocalTime   all
ExTimedWaitForUnblockPushLock   6.2 and higher
ExTimerObjectType (data)   10.0 and higher
ExTryAcquireAutoExpandPushLockExclusive   10.0 and higher
ExTryAcquireAutoExpandPushLockShared   10.0 and higher
ExTryAcquireCacheAwarePushLockExclusiveEx   10.0 and higher
ExTryAcquireCacheAwarePushLockSharedEx   10.0 and higher
ExTryAcquirePushLockExclusiveEx   6.3 and higher
ExTryAcquirePushLockSharedEx   6.3 and higher
ExTryAcquireSpinLockExclusiveAtDpcLevel   1607 and higher
ExTryAcquireSpinLockSharedAtDpcLevel   1607 and higher
ExTryConvertPushLockSharedToExclusiveEx   6.3 and higher
ExTryConvertSharedSpinLockExclusive   6.0 SP1 and higher
ExTryQueueWorkItem   6.2 and higher
ExTryToAcquireFastMutex x64 all
x86 6.2 and higher;
also from HAL in 3.50 and higher
ExTryToAcquireResourceExclusiveLite   6.3 and higher
ExTryToConvertFastResourceSharedToExclusive   1703 and higher
ExUnblockOnAddressPushLockEx   6.3 and higher
ExUnblockPushLockEx   6.3 and higher
ExUnregisterAttributeInformationCallback   6.1 to 6.2
ExUnregisterCallback   3.51 and higher
ExUnregisterExtension   6.1 and higher
ExUnsubscribeWnfStateChange   6.2 and higher
ExUpdateLicenseData   6.0 to 6.1,
not 6.2 to 6.3,
then 10.0 and higher
ExUpdateOsPfnInRegistry (28)   2004 and higher
ExUuidCreate   5.0 and higher
ExVerifySuite   5.1 and higher
ExWaitForRundownProtectionRelease   5.1 and higher
ExWaitForRundownProtectionReleaseCacheAware   5.2 SP1 and higher
ExWaitForUnblockPushLock   6.2 and higher
ExWindowStationObjectType (data)   4.0 and higher
ExfAcquirePushLockExclusive   5.1 SP2 and higher
ExfAcquirePushLockShared   5.1 SP2 and higher
ExfInterlockedAddUlong x86 3.50 and higher
ExfInterlockedCompareExchange64 x86 5.1 and higher
ExfInterlockedInsertHeadList x86 3.50 and higher
ExfInterlockedInsertTailList x86 3.50 and higher
ExfInterlockedPopEntryList x86 3.50 and higher
ExfInterlockedPushEntryList x86 3.50 and higher
ExfInterlockedRemoveHeadList x86 3.50 and higher
ExfReleasePushLock   5.1 SP2 and higher
ExfReleasePushLockExclusive   5.2 SP1 and higher
ExfReleasePushLockShared   5.2 SP1 and higher
ExfTryAcquirePushLockShared   6.0 and higher
ExfTryToWakePushLock   5.2 SP1 and higher
ExfUnblockPushLock   5.2 and higher
Exfi386InterlockedDecrementLong x86 3.50 and higher
Exfi386InterlockedExchangeUlong x86 3.50 and higher
Exfi386InterlockedIncrementLong x86 3.50 and higher
Exi386InterlockedDecrementLong x86 all
Exi386InterlockedExchangeUlong x86 all
Exi386InterlockedIncrementLong x86 all
ExiAcquireFastMutex x86 5.2 SP1 and higher
ExiReleaseFastMutex x86 5.2 SP1 and higher
ExiTryToAcquireFastMutex x86 5.2 SP1 and higher
ExpEtwTraceLicensingCacheChange (24)   2004 and higher
ExpGetKernelDataProtection (21)   2004 and higher
ExpInterlockedFlushSList x64 all
ExpInterlockedPopEntrySList x64 all
ExpInterlockedPushEntrySList x64 all
ExpReducedLicenseData (22)   2004 and higher
ExpSetKernelDataProtection (20)   2004 and higher
FirstEntrySList   6.0 and higher
FsRtlAcknowledgeEcp   6.0 and higher
FsRtlAcquireEofLock   6.2 and higher
FsRtlAcquireFileExclusive   5.0 and higher
FsRtlAcquireHeaderMutex   6.2 and higher
FsRtlAddBaseMcbEntry   5.2 and higher
FsRtlAddBaseMcbEntryEx   6.0 and higher
FsRtlAddLargeMcbEntry   all
FsRtlAddMcbEntry   all
FsRtlAddToTunnelCache   4.0 and higher
FsRtlAddToTunnelCacheEx   1809 and higher
FsRtlAllocateExtraCreateParameter   6.0 and higher
FsRtlAllocateExtraCreateParameterFromLookasideList   6.0 and higher
FsRtlAllocateExtraCreateParameterList   6.0 and higher
FsRtlAllocateFileLock   5.0 and higher
FsRtlAllocatePool   all
FsRtlAllocatePoolWithQuota   all
FsRtlAllocatePoolWithQuotaTag   3.50 and higher
FsRtlAllocatePoolWithTag   3.50 and higher
FsRtlAllocateResource   all
FsRtlAreNamesEqual   all
FsRtlAreThereCurrentOrInProgressFileLocks   6.1 and higher
FsRtlAreThereWaitingFileLocks   6.2 and higher
FsRtlAreVolumeStartupApplicationsComplete   6.0 and higher
FsRtlBalanceReads   all
FsRtlCancellableWaitForMultipleObjects   6.0 and higher
FsRtlCancellableWaitForSingleObject   6.0 and higher
FsRtlChangeBackingFileObject   6.0 and higher
FsRtlCheckLockForOplockRequest   6.2 and higher
FsRtlCheckLockForReadAccess   all
FsRtlCheckLockForWriteAccess   all
FsRtlCheckOplock   all
FsRtlCheckOplockEx   6.0 SP1 and higher
FsRtlCheckOplockEx2   2004 and higher
FsRtlCheckUpperOplock   6.3 and higher
FsRtlCopyRead   all
FsRtlCopyWrite   all
FsRtlCreateSectionForDataScan   5.1 SP3 and higher,
5.2 SP1 and higher,
then 6.0 and higher
FsRtlCurrentBatchOplock   all
FsRtlCurrentOplock   6.0 and higher
FsRtlCurrentOplockH   6.1 and higher
FsRtlDeleteExtraCreateParameterLookasideList   6.0 and higher
FsRtlDeleteKeyFromTunnelCache   4.0 and higher
FsRtlDeleteTunnelCache   4.0 and higher
FsRtlDeregisterUncProvider   all
FsRtlDismountComplete   6.2 and higher
FsRtlDissectDbcs   all
FsRtlDissectName   all
FsRtlDoesDbcsContainWildCards   all
FsRtlDoesNameContainWildCards   all
FsRtlFastCheckLockForRead   all
FsRtlFastCheckLockForWrite   all
FsRtlFastUnlockAll   all
FsRtlFastUnlockAllByKey   all
FsRtlFastUnlockSingle   all
FsRtlFindExtraCreateParameter   6.0 and higher
FsRtlFindInTunnelCache   4.0 and higher
FsRtlFindInTunnelCacheEx   1809 and higher
FsRtlFreeExtraCreateParameter   6.0 and higher
FsRtlFreeExtraCreateParameterList   6.0 and higher
FsRtlFreeFileLock   5.0 and higher
FsRtlGetCurrentProcessLoaderList   2004 and higher
FsRtlGetEcpListFromIrp   6.0 and higher
FsRtlGetFileNameInformation   6.2 and higher
FsRtlGetFileSize   4.0 and higher
FsRtlGetIoAtEof   6.2 and higher
FsRtlGetNextBaseMcbEntry   5.2 and higher
FsRtlGetNextExtraCreateParameter   6.0 and higher
FsRtlGetNextFileLock   all
FsRtlGetNextLargeMcbEntry   all
FsRtlGetNextMcbEntry   all
FsRtlGetSectorSizeInformation   6.2 and higher
FsRtlGetSupportedFeatures   6.2 and higher
FsRtlGetVirtualDiskNestingLevel   6.1 and higher
FsRtlHeatInit   6.3 and higher
FsRtlHeatLogIo   6.3 and higher
FsRtlHeatLogTierMove   6.3 and higher
FsRtlHeatUninit   6.3 and higher
FsRtlIncrementCcFastMdlReadWait   6.0 and higher
FsRtlIncrementCcFastReadNoWait   5.1 and higher
FsRtlIncrementCcFastReadNotPossible   5.1 and higher
FsRtlIncrementCcFastReadResourceMiss   5.1 and higher
FsRtlIncrementCcFastReadWait   5.1 and higher
FsRtlInitExtraCreateParameterLookasideList   6.0 and higher
FsRtlInitializeBaseMcb   5.2 and higher
FsRtlInitializeBaseMcbEx   6.0 and higher
FsRtlInitializeEofLock   6.2 and higher
FsRtlInitializeExtraCreateParameter   6.1 and higher
FsRtlInitializeExtraCreateParameterList   6.1 and higher
FsRtlInitializeFileLock   all
FsRtlInitializeLargeMcb   all
FsRtlInitializeMcb   all
FsRtlInitializeOplock   all
FsRtlInitializeTunnelCache   4.0 and higher
FsRtlInsertExtraCreateParameter   6.0 and higher
FsRtlInsertFilterContext   5.0 only
FsRtlInsertPerFileContext   6.0 and higher
FsRtlInsertPerFileObjectContext   5.1 and higher
FsRtlInsertPerStreamContext   5.1 and higher
FsRtlInsertReservedPerFileContext   6.3 to 1803
FsRtlInsertReservedPerStreamContext   6.3 to 1803
FsRtlIs32BitProcess   2004 and higher
FsRtlIsDaxVolume   1607 and higher
FsRtlIsDbcsInExpression   all
FsRtlIsEcpAcknowledged   6.0 and higher
FsRtlIsEcpFromUserMode   6.0 and higher
FsRtlIsExtentDangling   1607 and higher
FsRtlIsFatDbcsLegal   all
FsRtlIsHpfsDbcsLegal   all
FsRtlIsMobileOS   10.0 and higher
FsRtlIsNameInExpression   all
FsRtlIsNameInUnUpcasedExpression   1803 and higher
FsRtlIsNonEmptyDirectoryReparsePointAllowed   1607 and higher
FsRtlIsNtstatusExpected   all
FsRtlIsPagingFile   5.1 and higher
FsRtlIsSystemPagingFile   6.2 and higher
FsRtlIsTotalDeviceFailure   all
FsRtlIssueDeviceIoControl   6.2 and higher
FsRtlKernelFsControlFile   6.2 and higher
FsRtlLegalAnsiCharacterArray (data)   all
FsRtlLogCcFlushError   6.0 and higher
FsRtlLookupBaseMcbEntry   5.2 and higher
FsRtlLookupFilterContextInternal   5.0 only
FsRtlLookupLargeMcbEntry   all
FsRtlLookupLastBaseMcbEntry   5.2 and higher
FsRtlLookupLastBaseMcbEntryAndIndex   5.2 and higher
FsRtlLookupLastLargeMcbEntry   all
FsRtlLookupLastLargeMcbEntryAndIndex   5.0 and higher
FsRtlLookupLastMcbEntry   all
FsRtlLookupMcbEntry   all
FsRtlLookupPerFileContext   6.0 and higher
FsRtlLookupPerFileObjectContext   5.1 and higher
FsRtlLookupPerStreamContextInternal   5.1 and higher
FsRtlLookupReservedPerFileContext   6.3 to 1803
FsRtlLookupReservedPerStreamContext   6.3 to 1803
FsRtlMdlRead   all
FsRtlMdlReadComplete   4.0 and higher
FsRtlMdlReadCompleteDev   4.0 and higher
FsRtlMdlReadDev   4.0 and higher
FsRtlMdlReadEx   6.2 and higher
FsRtlMdlWriteComplete   4.0 and higher
FsRtlMdlWriteCompleteDev   4.0 and higher
FsRtlMupGetProviderIdFromName   6.0 and higher
FsRtlMupGetProviderInfoFromFileObject   6.0 and higher
FsRtlNormalizeNtstatus   all
FsRtlNotifyChangeDirectory   all
FsRtlNotifyCleanup   all
FsRtlNotifyCleanupAll   6.0 and higher
FsRtlNotifyFilterChangeDirectory   5.1 and higher
FsRtlNotifyFilterChangeDirectoryLite   10.0 and higher
FsRtlNotifyFilterReportChange   5.1 and higher
FsRtlNotifyFilterReportChangeLite   10.0 and higher
FsRtlNotifyFilterReportChangeLiteEx   1709 and higher
FsRtlNotifyFullChangeDirectory   3.50 and higher
FsRtlNotifyFullReportChange   3.50 and higher
FsRtlNotifyInitializeSync   3.50 and higher
FsRtlNotifyReportChange   all
FsRtlNotifyUninitializeSync   3.50 and higher
FsRtlNotifyVolumeEvent   5.0 and higher
FsRtlNotifyVolumeEventEx   6.0 and higher
FsRtlNumberOfRunsInBaseMcb   5.2 and higher
FsRtlNumberOfRunsInLargeMcb   all
FsRtlNumberOfRunsInMcb   all
FsRtlOplockBreakH   6.1 and higher
FsRtlOplockBreakToNone   6.0 and higher
FsRtlOplockBreakToNoneEx   6.1 and higher
FsRtlOplockFsctrl   all
FsRtlOplockFsctrlEx   6.1 and higher
FsRtlOplockGetAnyBreakOwnerProcess   2004 and higher
FsRtlOplockIsFastIoPossible   all
FsRtlOplockIsSharedRequest   6.1 and higher
FsRtlOplockKeysEqual   6.1 and higher
FsRtlPostPagingFileStackOverflow   3.51 and higher
FsRtlPostStackOverflow   all
FsRtlPrepareMdlWrite   all
FsRtlPrepareMdlWriteDev   4.0 and higher
FsRtlPrepareMdlWriteEx   6.2 and higher
FsRtlPrepareToReuseEcp   6.2 and higher
FsRtlPrivateLock   all
FsRtlProcessFileLock   all
FsRtlQueryCachedVdl   6.2 and higher
FsRtlQueryInformationFile   10.0 and higher
FsRtlQueryKernelEaFile   6.2 and higher
FsRtlQueryMaximumVirtualDiskNestingLevel   6.1 and higher
FsRtlRegisterFileSystemFilterCallbacks   5.1 and higher
FsRtlRegisterFltMgrCalls   6.0 and higher
FsRtlRegisterMupCalls   6.0 and higher
FsRtlRegisterUncProvider   all
FsRtlRegisterUncProviderEx   6.0 and higher
FsRtlRegisterUncProviderEx2   10.0 and higher
FsRtlReleaseEofLock   6.2 and higher
FsRtlReleaseFile   5.0 and higher
FsRtlReleaseFileNameInformation   6.2 and higher
FsRtlReleaseHeaderMutex   6.2 and higher
FsRtlRemoveBaseMcbEntry   5.2 and higher
FsRtlRemoveDotsFromPath   6.0 and higher
FsRtlRemoveExtraCreateParameter   6.0 and higher
FsRtlRemoveFilterContext   5.0 only
FsRtlRemoveLargeMcbEntry   all
FsRtlRemoveMcbEntry   all
FsRtlRemovePerFileContext   6.0 and higher
FsRtlRemovePerFileObjectContext   5.1 and higher
FsRtlRemovePerStreamContext   5.1 and higher
FsRtlRemoveReservedPerFileContext   6.3 to 1803
FsRtlRemoveReservedPerStreamContext   6.3 to 1803
FsRtlResetBaseMcb   5.2 and higher
FsRtlResetLargeMcb   5.0 and higher
FsRtlSendModernAppTermination   6.3 and higher
FsRtlSetDriverBacking   10.0 and higher
FsRtlSetEcpListIntoIrp   6.0 and higher
FsRtlSetKernelEaFile   6.2 and higher
FsRtlSplitBaseMcb   5.2 and higher
FsRtlSplitLargeMcb   3.50 and higher
FsRtlSyncVolumes   all
FsRtlTeardownFilterContexts   5.0 only
FsRtlTeardownPerFileContexts   6.0 and higher
FsRtlTeardownPerStreamContexts   5.1 and higher
FsRtlTruncateBaseMcb   5.2 and higher
FsRtlTruncateLargeMcb   3.50 and higher
FsRtlTruncateMcb   3.50 and higher
FsRtlTryToAcquireHeaderMutex   6.2 and higher
FsRtlUninitializeBaseMcb   5.2 and higher
FsRtlUninitializeFileLock   all
FsRtlUninitializeLargeMcb   all
FsRtlUninitializeMcb   all
FsRtlUninitializeOplock   all
FsRtlUpdateDiskCounters   6.2 and higher
FsRtlUpperOplockFsctrl   6.3 and higher
FsRtlValidateReparsePointBuffer   6.0 and higher
FsRtlVolumeDeviceToCorrelationId   1607 and higher
HalAcpiGetTableEx x64 2004 and higher;
also from HAL in 6.2 and higher
x86 see HAL in 6.2 and higher
HalAcquireDisplayOwnership x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalAdjustResourceList x64 2004 and higher;
also from HAL in all
x86 see HAL in 3.50 and higher
HalAllProcessorsStarted x64 2004 and higher;
also from HAL in all
x86 see HAL in 3.50 and higher
HalAllocateAdapterChannel x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalAllocateCommonBuffer x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalAllocateCrashDumpRegisters x64 2004 and higher;
also from HAL in all
x86 see HAL in 3.50 and higher
HalAllocateHardwareCounters x64 2004 and higher;
also from HAL in 6.1 and higher
x86 see HAL in 6.1 and higher
HalAssignSlotResources x64 2004 and higher;
also from HAL in all
x86 see HAL in 3.50 and higher
HalBugCheckSystem x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalCalibratePerformanceCounter x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalClearSoftwareInterrupt x64 2004 and higher;
also from HAL in all
x86 see HAL in 3.50 and higher
HalConvertDeviceIdtToIrql x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalDisableInterrupt x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalDispatchTable (data)   3.51 and higher
HalDisplayString x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalDmaAllocateCrashDumpRegistersEx x64 2004 and higher;
also from HAL in 6.2 and higher
x86 see HAL in 6.2 and higher
HalDmaFreeCrashDumpRegistersEx x64 2004 and higher;
also from HAL in 6.2 and higher
x86 see HAL in 6.2 and higher
HalEnableInterrupt x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalEnumerateEnvironmentVariablesEx x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalEnumerateProcessors x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 10.0 and higher
HalExamineMBR   5.1 and higher
HalFlushCommonBuffer x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalFreeCommonBuffer x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalFreeHardwareCounters x64 2004 and higher;
also from HAL in 6.1 and higher
x86 see HAL in 6.1 and higher
HalGetAdapter x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalGetBusData x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalGetBusDataByOffset x64 2004 and higher;
also from HAL in all
x86 see HAL in 3.50 and higher
HalGetEnvironmentVariable x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalGetEnvironmentVariableEx x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalGetInterruptTargetInformation x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalGetInterruptVector x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalGetMemoryCachingRequirements x64 2004 and higher;
also from HAL in 6.1 and higher
x86 see HAL in 6.1 and higher
HalGetMessageRoutingInfo x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalGetProcessorIdByNtNumber x64 2004 and higher;
also from HAL in 6.0 SP1 and higher
x86 see HAL in 6.0 SP1 and higher
HalGetVectorInput x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalHandleMcheck x64 2004 and higher;
also from HAL in all
HalHandleNMI x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalInitSystem x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalInitializeBios x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalInitializeOnResume x64 2004 and higher;
also from HAL in 6.0 SP1 and higher
x86 see HAL in 6.0 SP1 and higher
HalInitializeProcessor x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalIsHyperThreadingEnabled x64 2004 and higher;
also from HAL in all
HalMakeBeep x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalPerformEndOfInterrupt x64 2004 and higher;
also from HAL in 6.1 and higher
HalPrivateDispatchTable (data)   3.51 and higher
HalProcessorIdle x64 2004 and higher;
also from HAL in all
x86 see HAL in 3.50 and higher
HalQueryDisplayParameters x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalQueryEnvironmentVariableInfoEx x64 2004 and higher;
also from HAL in 6.0 SP1 and higher
x86 see HAL in 6.0 SP1 and higher
HalQueryMaximumProcessorCount x64 2004 and higher;
also from HAL in 6.0 SP1 and higher
x86 see HAL in 6.0 SP1 and higher
HalQueryRealTimeClock x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalReadDmaCounter x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalRegisterDynamicProcessor x64 2004 and higher;
also from HAL in 6.0 SP1 and higher
x86 see HAL in 6.0 SP1 and higher
HalRegisterErrataCallbacks x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalReportResourceUsage x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalRequestClockInterrupt x64 2004 and higher;
also from HAL in 6.1 and higher
x86 see HAL in 6.1 and higher
HalRequestDeferredRecoveryServiceInterrupt x64 2004 and higher;
also from HAL in 6.1 and higher
HalRequestIpi x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalRequestIpiSpecifyVector x64 2004 and higher;
also from HAL in 6.2 and higher
x86 see HAL in 6.2 and higher
HalRequestSoftwareInterrupt x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalReturnToFirmware x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalSendNMI x64 2004 and higher;
also from HAL in all
HalSendSoftwareInterrupt x64 2004 and higher;
also from HAL in all
x86 see HAL in 10.0 and higher
HalSetBusData x64 2004 and higher;
also from HAL in all
x86 see HAL in 3.50 and higher
HalSetBusDataByOffset x64 2004 and higher;
also from HAL in all
x86 see HAL in 3.50 and higher
HalSetDisplayParameters x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalSetEnvironmentVariable x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalSetEnvironmentVariableEx x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalSetProfileInterval x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalSetRealTimeClock x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalStartDynamicProcessor x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
HalStartNextProcessor x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalStartProfileInterrupt x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalStopProfileInterrupt x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalSystemVectorDispatchEntry x64 2004 and higher;
also from HAL in all
x86 see HAL in 4.0 and higher
HalTranslateBusAddress x64 2004 and higher;
also from HAL in all
x86 see HAL in all
HalWheaUpdateCmciPolicy x64 2004 and higher;
also from HAL in 2004 and higher
x86 see HAL in 2004 and higher
HeadlessDispatch   5.1 and higher
HviGetDebugDeviceOptions   10.0 and higher
HviGetEnlightenmentInformation   10.0 and higher
HviGetHardwareFeatures   10.0 and higher
HviGetHypervisorFeatures   10.0 and higher
HviGetHypervisorInterface   10.0 and higher
HviGetHypervisorVendorAndMaxFunction   10.0 and higher
HviGetHypervisorVersion   10.0 and higher
HviGetImplementationLimits   10.0 and higher
HviIsAnyHypervisorPresent   10.0 and higher
HviIsHypervisorMicrosoftCompatible   10.0 and higher
HviIsHypervisorVendorMicrosoft   10.0 and higher
HviIsIommuInUse   10.0 and higher
HvlGetLpIndexFromApicId   6.2 and higher
HvlGetLpIndexFromProcessorIndex   2004 and higher
HvlInvokeFastExtendedHypercall x64 1709 and higher
HvlInvokeHypercall   1703 and higher
HvlPerformEndOfInterrupt x64 6.2 and higher
HvlQueryActiveHypervisorProcessorCount   6.2 and higher
HvlQueryActiveProcessors   6.2 and higher
HvlQueryConnection   6.0 and higher
HvlQueryHypervisorProcessorNodeNumber   6.2 and higher
HvlQueryNumaDistance   6.3 and higher
HvlQueryProcessorTopology   6.2 and higher
HvlQueryProcessorTopologyCount   6.2 and higher
HvlQueryProcessorTopologyEx   1607 and higher
HvlQueryProcessorTopologyHighestId   6.2 and higher
HvlQueryStartedProcessors   1903 and higher
HvlReadPerformanceStateCounters   10.0 and higher
HvlRegisterInterruptCallback   6.2 and higher
HvlRegisterWheaErrorNotification   6.2 and higher
HvlUnregisterInterruptCallback   6.2 and higher
HvlUnregisterWheaErrorNotification   6.2 and higher
HvlUpdatePerformanceStateCountersForLp   2004 and higher
InbvAcquireDisplayOwnership   5.0 and higher
InbvCheckDisplayOwnership   5.0 and higher
InbvDisplayString   5.0 and higher
InbvEnableBootDriver   5.0 and higher
InbvEnableDisplayString   5.0 and higher
InbvInstallDisplayStringFilter   5.0 and higher
InbvIsBootDriverInstalled   5.0 and higher
InbvNotifyDisplayOwnershipChange   6.2 and higher
InbvNotifyDisplayOwnershipLost   5.0 and higher
InbvResetDisplay   5.0 and higher
InbvSetScrollRegion   5.0 and higher
InbvSetTextColor   5.0 and higher
InbvSetVirtualFrameBuffer   1511 and higher
InbvSolidColorFill   5.0 and higher
InitSafeBootMode (data)   5.0 and higher
InitializeSListHead x64 all
InterlockedCompareExchange x86 4.0 and higher
InterlockedDecrement x86 3.51 and higher
InterlockedExchange x86 3.51 and higher
InterlockedExchangeAdd x86 4.0 and higher
InterlockedIncrement x86 3.51 and higher
InterlockedPopEntrySList x86 5.1 and higher
InterlockedPushEntrySList x86 5.1 and higher
InterlockedPushListSList   6.3 and higher
IoAcquireCancelSpinLock   all
IoAcquireKsrPersistentMemory   2004 and higher
IoAcquireRemoveLockEx   5.0 and higher
IoAcquireVpbSpinLock   all
IoAdapterObjectType (data)   all
IoAdjustStackSizeForRedirection   6.1 and higher
IoAllocateAdapterChannel   all
IoAllocateController   all
IoAllocateDriverObjectExtension   5.0 and higher
IoAllocateErrorLogEntry   all
IoAllocateIrp   all
IoAllocateIrpEx   10.0 and higher
IoAllocateMdl   all
IoAllocateMiniCompletionPacket   6.0 and higher
IoAllocateSfioStreamIdentifier   6.0 and higher
IoAllocateWorkItem   5.0 and higher
IoApplyPriorityInfoThread   6.0 and higher
IoAssignDriveLetters   5.1 to 6.0;
also from HAL in 3.10 to 6.0
IoAssignResources   3.50 and higher
IoAttachDevice   all
IoAttachDeviceByPointer   all
IoAttachDeviceToDeviceStack   4.0 and higher
IoAttachDeviceToDeviceStackSafe   5.1 and higher
IoBoostThreadIo   6.2 and higher
IoBuildAsynchronousFsdRequest   all
IoBuildDeviceIoControlRequest   all
IoBuildPartialMdl   all
IoBuildSynchronousFsdRequest   all
IoCallDriver   all
IoCallDriverStackSafe   6.0 only
IoCancelFileOpen   5.0 and higher
IoCancelIrp   all
IoCheckDesiredAccess   all
IoCheckEaBufferValidity   all
IoCheckFunctionAccess   all
IoCheckLinkShareAccess   1709 and higher
IoCheckQuerySetFileInformation   5.0 and higher
IoCheckQuerySetVolumeInformation   5.0 and higher
IoCheckQuotaBufferValidity   5.0 and higher
IoCheckShareAccess   all
IoCheckShareAccessEx   6.0 and higher
IoCleanupIrp   1607 and higher
IoClearActivityIdThread   6.2 and higher
IoClearAdapterCryptoEngineExtension   1809 and higher
IoClearDependency   6.0 SP1 to 1607
IoClearFsTrackOffsetState   1511 and higher
IoClearIrpExtraCreateParameter   6.0 and higher
IoClearReservedDependency   6.2 only
IoCompleteRequest   all
IoCompletionObjectType (data)   6.2 and higher
IoConnectInterrupt   all
IoConnectInterruptEx   6.0 and higher
IoConvertFileHandleToKernelHandle   6.3 and higher
IoCopyDeviceObjectHint   6.2 and higher
IoCreateArcName   6.0 and higher
IoCreateController   all
IoCreateDevice   all
IoCreateDeviceSecure   2004 and higher
IoCreateDisk   5.1 and higher
IoCreateDriver   5.0 and higher
IoCreateFile   all
IoCreateFileEx   6.0 and higher
IoCreateFileSpecifyDeviceObjectHint   5.1 and higher
IoCreateNotificationEvent   4.0 and higher
IoCreateStreamFileObject   all
IoCreateStreamFileObjectEx   5.1 and higher
IoCreateStreamFileObjectEx2   6.2 and higher
IoCreateStreamFileObjectLite   5.0 and higher
IoCreateSymbolicLink   all
IoCreateSynchronizationEvent   all
IoCreateSystemThread   6.2 and higher
IoCreateUnprotectedSymbolicLink   all
IoCsqInitialize   5.1 and higher
IoCsqInitializeEx   5.2 and higher
IoCsqInsertIrp   5.1 and higher
IoCsqInsertIrpEx   5.2 and higher
IoCsqRemoveIrp   5.1 and higher
IoCsqRemoveNextIrp   5.1 and higher
IoDecrementKeepAliveCount   6.2 and higher
IoDeleteAllDependencyRelations   6.0 SP1 to 1607
IoDeleteController   all
IoDeleteDevice   all
IoDeleteDriver   5.0 and higher
IoDeleteSymbolicLink   all
IoDetachDevice   all
IoDeviceHandlerObjectSize (data)   4.0 and higher
IoDeviceHandlerObjectType (data)   4.0 and higher
IoDeviceObjectType (data)   all
IoDisconnectInterrupt   all
IoDisconnectInterruptEx   6.0 and higher
IoDriverObjectType (data)   3.51 and higher
IoDuplicateDependency   6.0 SP1 and higher
IoEnqueueIrp   3.50 and higher
IoEnumerateDeviceObjectList   5.1 and higher
IoEnumerateRegisteredFiltersList   5.1 SP3 and higher,
5.2 SP1 and higher,
then 6.0 and higher
IoFastQueryNetworkAttributes   4.0 and higher
IoFileObjectType (data)   all
IoFlushAdapterBuffers x64 2004 and higher;
also from HAL in all
x86 see HAL in all
IoForwardAndCatchIrp   5.1 and higher
IoForwardIrpSynchronously   5.1 and higher
IoFreeAdapterChannel x64 2004 and higher;
also from HAL in all
x86 see HAL in all
IoFreeController   all
IoFreeErrorLogEntry   5.1 and higher
IoFreeIrp   all
IoFreeKsrPersistentMemory   2004 and higher
IoFreeMapRegisters x64 2004 and higher;
also from HAL in all
x86 see HAL in all
IoFreeMdl   all
IoFreeMiniCompletionPacket   6.0 and higher
IoFreeSfioStreamIdentifier   6.0 and higher
IoFreeWorkItem   5.0 and higher
IoGetActivityIdIrp   6.2 and higher
IoGetActivityIdThread   6.2 and higher
IoGetAdapterCryptoEngineExtension   1703 and higher
IoGetAffinityInterrupt   6.1 and higher
IoGetAttachedDevice   3.51 and higher
IoGetAttachedDeviceReference   5.0 and higher
IoGetBaseFileSystemDeviceObject   4.0 and higher
IoGetBootDiskInformation   5.0 and higher
IoGetBootDiskInformationLite   6.0 and higher
IoGetConfigurationInformation   all
IoGetContainerInformation   6.1 and higher
IoGetCurrentProcess   all
IoGetDeviceAttachmentBaseRef   5.1 and higher
IoGetDeviceDirectory   1803 and higher
IoGetDeviceInterfaceAlias   5.0 and higher
IoGetDeviceInterfacePropertyData   6.2 and higher
IoGetDeviceInterfaces   5.0 and higher
IoGetDeviceNumaNode   6.1 and higher
IoGetDeviceObjectPointer   all
IoGetDeviceProperty   5.0 and higher
IoGetDevicePropertyData   6.0 and higher
IoGetDeviceToVerify   3.50 and higher
IoGetDiskDeviceObject   5.1 and higher
IoGetDmaAdapter   5.0 and higher
IoGetDriverDirectory   1803 and higher
IoGetDriverObjectExtension   5.0 and higher
IoGetFileObjectGenericMapping   3.50 and higher
IoGetFsTrackOffsetState   10.0 and higher
IoGetFsZeroingOffset   10.0 and higher
IoGetGenericIrpExtension   6.3 and higher
IoGetInitialStack   3.50 and higher
IoGetInitiatorProcess   6.2 and higher
IoGetIoAttributionHandle   1607 and higher
IoGetIoPriorityHint   6.0 and higher
IoGetIommuInterface   1803 and higher
IoGetIrpExtraCreateParameter   6.0 and higher
IoGetLowerDeviceObject   5.1 and higher
IoGetOplockKeyContext   6.1 and higher
IoGetOplockKeyContextEx   6.2 and higher
IoGetPagingIoPriority   5.2 and higher
IoGetRelatedDeviceObject   all
IoGetRequestorProcess   3.50 and higher
IoGetRequestorProcessId   5.0 and higher
IoGetRequestorSessionId   5.0 and higher
IoGetSfioStreamIdentifier   6.0 and higher
IoGetSilo   1607 and higher
IoGetSiloParameters   1511 and higher
IoGetStackLimits   4.0 and higher
IoGetSymLinkSupportInformation   6.0 SP2 and higher
IoGetTopLevelIrp   3.50 and higher
IoGetTransactionParameterBlock   6.0 and higher
IoIncrementKeepAliveCount   6.2 and higher
IoInitializeCrashDump   5.1 SP3 only
IoInitializeIrp   all
IoInitializeIrpEx   10.0 and higher
IoInitializeMiniCompletionPacket   6.2 and higher
IoInitializeRemoveLockEx   5.0 and higher
IoInitializeTimer   all
IoInitializeWorkItem   6.0 and higher
IoInvalidateDeviceRelations   5.0 and higher
IoInvalidateDeviceState   5.0 and higher
IoIrpHasFsTrackOffsetExtensionType   10.0 and higher
IoIs32bitProcess x64 all
IoIsActivityTracingEnabled   6.2 and higher
IoIsFileObjectIgnoringSharing   6.0 and higher
IoIsFileOriginRemote   5.0 SP3 and higher
IoIsInitiator32bitProcess x64 6.2 and higher
IoIsOperationSynchronous   all
IoIsSystemThread   3.50 and higher
IoIsValidIrpStatus   6.2 and higher
IoIsValidNameGraftingBuffer   5.0 and higher
IoIsWdmVersionAvailable   5.0 and higher
IoLoadCrashDumpDriver x64 6.3 and higher
IoMakeAssociatedIrp   all
IoMakeAssociatedIrpEx   10.0 and higher
IoMapTransfer x64 2004 and higher;
also from HAL in all
x86 see HAL in all
IoOpenDeviceInterfaceRegistryKey   5.0 and higher
IoOpenDeviceInstanceKey   4.0 only
IoOpenDeviceRegistryKey   5.0 and higher
IoOpenDriverRegistryKey   1803 and higher
IoPageRead   3.50 and higher
IoPnPDeliverServicePowerNotification   5.0 to 6.0
IoPropagateActivityIdToThread   6.2 and higher
IoPropagateIrpExtension   6.3 and higher
IoPropagateIrpExtensionEx   10.0 and higher
IoQueryDeviceDescription   all
IoQueryDeviceEnumInfo   4.0 only
IoQueryFileDosDeviceName   5.1 and higher
IoQueryFileInformation   3.51 and higher
IoQueryFullDriverPath   6.3 and higher
IoQueryInformationByName   1703 and higher
IoQueryInterface   10.0 and higher
IoQueryKsrPersistentMemorySize   2004 and higher
IoQueryVolumeInformation   3.51 and higher
IoQueueThreadIrp   4.0 and higher
IoQueueWorkItem   5.0 and higher
IoQueueWorkItemEx   6.0 and higher
IoQueueWorkItemToNode   6.2 and higher
IoRaiseHardError   all
IoRaiseInformationalHardError   all
IoReadDiskSignature   5.1 and higher
IoReadOperationCount (data)   all
IoReadPartitionTable   5.1 and higher;
also from HAL in all
IoReadPartitionTableEx   5.1 and higher
IoReadTransferCount (data)   all
IoRecordIoAttribution   1607 and higher
IoRegisterBootDriverCallback   6.2 and higher
IoRegisterBootDriverReinitialization   5.0 and higher
IoRegisterContainerNotification   6.1 and higher
IoRegisterDeviceInterface   5.0 and higher
IoRegisterDriverReinitialization   all
IoRegisterFileSystem   all
IoRegisterFsRegistrationChange   3.51 and higher
IoRegisterFsRegistrationChangeMountAware   6.1 and higher
IoRegisterIoTracking   6.2 and higher
IoRegisterLastChanceShutdownNotification   5.0 and higher
IoRegisterPlugPlayNotification   5.0 and higher
IoRegisterPriorityCallback   6.1 and higher
IoRegisterShutdownNotification   all
IoReleaseCancelSpinLock   all
IoReleaseRemoveLockAndWaitEx   5.0 and higher
IoReleaseRemoveLockEx   5.0 and higher
IoReleaseVpbSpinLock   all
IoRemoveLinkShareAccess   1709 and higher
IoRemoveLinkShareAccessEx   1903 and higher
IoRemoveShareAccess   all
IoReplaceFileObjectName   6.1 and higher
IoReplacePartitionUnit   6.0 SP1 and higher
IoReportDetectedDevice   5.0 and higher
IoReportHalResourceUsage   all
IoReportInterruptActive   6.2 and higher
IoReportInterruptInactive   6.2 and higher
IoReportResourceForDetection   5.0 and higher
IoReportResourceUsage   all
IoReportRootDevice   6.1 and higher
IoReportTargetDeviceChange   5.0 and higher
IoReportTargetDeviceChangeAsynchronous   5.0 and higher
IoRequestDeviceEject   5.0 and higher
IoRequestDeviceEjectEx   6.0 and higher
IoRequestDeviceRemovalForReset   10.0 and higher
IoReserveDependency   6.2 and higher
IoReserveKsrPersistentMemory   2004 and higher
IoResolveDependency   6.2 and higher
IoRetrievePriorityInfo   6.0 and higher
IoReuseIrp   5.0 and higher
IoSetActivityIdIrp   6.2 and higher
IoSetActivityIdThread   6.2 and higher
IoSetAdapterCryptoEngineExtension   1703 and higher
IoSetCompletionRoutineEx   5.1 and higher
IoSetDependency   6.0 SP1 and higher
IoSetDeviceInterfacePropertyData   6.2 and higher
IoSetDeviceInterfaceState   5.0 and higher
IoSetDevicePropertyData   6.0 and higher
IoSetDeviceToVerify   3.50 and higher
IoSetFileObjectIgnoreSharing   6.1 and higher
IoSetFileOrigin   5.0 SP3 and higher
IoSetFsTrackOffsetState   10.0 and higher
IoSetFsZeroingOffset   10.0 and higher
IoSetFsZeroingOffsetRequired   10.0 and higher
IoSetGenericIrpExtension   6.3 and higher
IoSetHardErrorOrVerifyDevice   all
IoSetInformation   all
IoSetIoAttributionIrp   1607 and higher
IoSetIoCompletion   5.0 and higher
IoSetIoCompletionEx   6.0 and higher
IoSetIoPriorityHint   6.0 and higher
IoSetIoPriorityHintIntoFileObject   6.0 and higher
IoSetIoPriorityHintIntoThread   6.0 and higher
IoSetIrpExtraCreateParameter   6.0 and higher
IoSetLinkShareAccess   1709 and higher
IoSetMasterIrpStatus   6.2 and higher
IoSetOplockKeyContext   6.1 only
IoSetPartitionInformation   5.1 and higher;
also from HAL in all
IoSetPartitionInformationEx   5.1 and higher
IoSetShareAccess   all
IoSetShareAccessEx   6.0 and higher
IoSetStartIoAttributes   5.1 and higher
IoSetSystemPartition   5.1 and higher
IoSetThreadHardErrorMode   4.0 and higher
IoSetTopLevelIrp   3.50 and higher
IoSizeOfIrpEx   10.0 and higher
IoSizeofGenericIrpExtension   6.3 and higher
IoSizeofWorkItem   6.0 and higher
IoStartNextPacket   all
IoStartNextPacketByKey   all
IoStartPacket   all
IoStartTimer   all
IoStatisticsLock (data)   all
IoSteerInterrupt   10.0 and higher
IoStopTimer   all
IoSynchronousCallDriver   6.2 and higher
IoSynchronousInvalidateDeviceRelations   5.0 to 1607
IoSynchronousPageWrite   3.50 and higher
IoTestDependency   6.3 and higher
IoThreadToProcess   3.50 and higher
IoTransferActivityId   6.2 and higher
IoTranslateBusAddress   5.2 SP1 and higher
IoTryQueueWorkItem   6.2 and higher
IoUninitializeWorkItem   6.0 and higher
IoUnregisterBootDriverCallback   6.2 and higher
IoUnregisterContainerNotification   6.1 and higher
IoUnregisterFileSystem   all
IoUnregisterFsRegistrationChange   3.51 and higher
IoUnregisterIoTracking   6.2 and higher
IoUnregisterPlugPlayNotification   5.0 and higher
IoUnregisterPlugPlayNotificationEx   6.1 and higher
IoUnregisterPriorityCallback   6.1 and higher
IoUnregisterShutdownNotification   all
IoUpdateLinkShareAccess   1709 and higher
IoUpdateLinkShareAccessEx   1903 and higher
IoUpdateShareAccess   all
IoValidateDeviceIoControlAccess   5.1 SP1 and higher
IoVerifyPartitionTable   5.1 and higher
IoVerifyVolume   all
IoVolumeDeviceNameToGuid   1511 and higher
IoVolumeDeviceNameToGuidPath   1511 and higher
IoVolumeDeviceToDosName   5.1 and higher
IoVolumeDeviceToGuid   6.2 and higher
IoVolumeDeviceToGuidPath   6.2 and higher
IoWMIAllocateInstanceIds   5.0 and higher
IoWMIDeviceObjectToInstanceName   5.1 and higher
IoWMIDeviceObjectToProviderId x64 all
IoWMIExecuteMethod   5.1 and higher
IoWMIHandleToInstanceName   5.1 and higher
IoWMIOpenBlock   5.1 and higher
IoWMIQueryAllData   5.1 and higher
IoWMIQueryAllDataMultiple   5.1 and higher
IoWMIQuerySingleInstance   5.1 and higher
IoWMIQuerySingleInstanceMultiple   5.1 and higher
IoWMIRegistrationControl   5.0 and higher
IoWMISetNotificationCallback   5.1 and higher
IoWMISetSingleInstance   5.1 and higher
IoWMISetSingleItem   5.1 and higher
IoWMISuggestInstanceName   5.0 and higher
IoWMIWriteEvent   5.0 and higher
IoWithinStackLimits   6.0 and higher
IoWriteErrorLogEntry   all
IoWriteKsrPersistentMemory   2004 and higher
IoWriteOperationCount (data)   all
IoWritePartitionTable   5.1 and higher;
also from HAL in all
IoWritePartitionTableEx   5.1 and higher
IoWriteTransferCount (data)   all
IofCallDriver   3.50 and higher
IofCompleteRequest   3.50 and higher
KdAcquireDebuggerLock   6.3 and higher
KdChangeOption   5.2 SP1 and higher
KdComPortInUse (data) x64 2004 and higher;
also from HAL in all
x86 see HAL in all
KdDebuggerEnabled (data)   all
KdDebuggerNotPresent (data)   all
KdDeregisterPowerHandler   6.3 and higher
KdDisableDebugger   5.0 and higher
KdEnableDebugger   5.0 and higher
KdEnteredDebugger (data)   5.0 and higher
KdEventLoggingEnabled (data)   10.0 and higher
KdGetDebugDevice   10.0 and higher
KdHvComPortInUse (data) x64 2004 and higher;
also from HAL in 6.2 and higher
x86 see HAL in 6.2 and higher
KdLogDbgPrint   6.2 and higher
KdPollBreakIn   all
KdPowerTransition   5.1 and higher
KdPowerTransitionEx   1703 and higher
KdRefreshDebuggerNotPresent   5.2 and higher
KdRegisterPowerHandler   6.3 and higher
KdReleaseDebuggerLock   6.3 and higher
KdSetEventLoggingPresent   10.0 and higher
KdSystemDebugControl   5.2 SP1 and higher
Ke386CallBios x86 3.10 to 6.1
Ke386IoSetAccessProcess x86 all
Ke386QueryIoAccessMap x86 all
Ke386SetIoAccessMap x86 all
KeAcquireGuardedMutex   5.2 SP1 and higher
KeAcquireGuardedMutexUnsafe   5.2 SP1 and higher
KeAcquireInStackQueuedSpinLock x64 all
x86 6.2 and higher;
also from HAL in 5.1 and higher
KeAcquireInStackQueuedSpinLockAtDpcLevel   5.1 and higher
KeAcquireInStackQueuedSpinLockForDpc   5.2 and higher
KeAcquireInStackQueuedSpinLockRaiseToSynch x64 all
x86 6.2 and higher;
also from HAL in 5.1 and higher
KeAcquireInterruptSpinLock   5.1 and higher
KeAcquireQueuedSpinLock x64 all
x86 6.2 and higher;
also from HAL in 5.0 and higher
KeAcquireQueuedSpinLockRaiseToSynch x64 all
x86 6.2 and higher;
also from HAL in 5.0 and higher
KeAcquireSpinLock x86 6.2 and higher;
also from HAL in all
KeAcquireSpinLockAtDpcLevel   all
KeAcquireSpinLockForDpc   5.2 and higher
KeAcquireSpinLockRaiseToDpc x64 all
KeAcquireSpinLockRaiseToSynch x64 all
x86 6.2 and higher;
also from HAL in 4.0 and higher
KeAddGroupAffinityEx   6.1 and higher
KeAddProcessorAffinityEx   6.1 and higher
KeAddProcessorGroupAffinity   6.1 and higher
KeAddSystemServiceTable   3.51 and higher
KeAddTriageDumpDataBlock   1803 and higher
KeAlertThread   6.0 and higher
KeAllocateCalloutStack   6.0 and higher
KeAllocateCalloutStackEx   6.1 and higher
KeAllocateProcessorProfileStructures   1903 and higher
KeAndAffinityEx   6.1 and higher
KeAndGroupAffinityEx   6.1 and higher
KeAreAllApcsDisabled   5.2 SP1 and higher
KeAreApcsDisabled   5.1 and higher
KeAttachProcess   all
KeBoostCurrentThread   4.0 only
KeBugCheck   all
KeBugCheckEx   all
KeCancelTimer   all
KeCancelTimer2   10.0 and higher
KeCapturePersistentThreadState   5.1 SP1 and higher
KeCheckProcessorAffinityEx   6.1 and higher
KeCheckProcessorGroupAffinity   6.1 and higher
KeClearEvent   3.50 and higher
KeClockInterruptNotify   6.3 and higher
KeClockTimerPowerChange   6.3 and higher
KeComplementAffinityEx   6.1 and higher
KeConnectInterrupt   3.51 to 5.2
KeConnectInterruptForHal x64 10.0 and higher
x86 1803 and higher
KeConvertAuxiliaryCounterToPerformanceCounter   10.0 and higher
KeConvertPerformanceCounterToAuxiliaryCounter   10.0 and higher
KeCopyAffinityEx   6.1 and higher
KeCountSetBitsAffinityEx   6.1 and higher
KeCountSetBitsGroupAffinity   6.1 and higher
KeDcacheFlushCount   3.10 to 5.1
KeDelayExecutionThread   all
KeDeregisterBoundCallback   10.0 and higher
KeDeregisterBugCheckCallback   3.50 and higher
KeDeregisterBugCheckReasonCallback   5.1 SP1 and higher
KeDeregisterNmiCallback   5.2 and higher
KeDeregisterProcessorChangeCallback   6.0 SP1 and higher
KeDetachProcess   all
KeDisconnectInterrupt   3.10 to 5.2
KeDispatchSecondaryInterrupt   6.2 and higher
KeDynamicPartitioningSupported   1809 and higher
KeEnterCriticalRegion   3.50 and higher
KeEnterGuardedRegion   5.2 SP1 and higher
KeEnterKernelDebugger   all
KeEnumerateNextProcessor   6.1 and higher
KeExpandKernelStackAndCallout x64 all
x86 6.0 and higher
KeExpandKernelStackAndCalloutEx   6.0 and higher
KeExpandKernelStackAndCalloutInternal (7)   1903 and higher
KeFindConfigurationEntry   all
KeFindConfigurationNextEntry   3.50 and higher
KeFindFirstSetLeftAffinityEx   6.1 and higher
KeFindFirstSetLeftGroupAffinity   6.1 and higher
KeFindFirstSetRightAffinityEx   6.3 and higher
KeFindFirstSetRightGroupAffinity   6.1 and higher
KeFirstGroupAffinityEx   6.1 and higher
KeFlushCurrentTbImmediately x64 1803 and higher
KeFlushEntireTb   all
KeFlushIoBuffers   10.0 and higher
KeFlushQueuedDpcs   5.1 SP2 and higher
KeFlushWriteBuffer x64 2004 and higher;
also from HAL in all
x86 see HAL in all
KeForceEnableNx   6.2 and higher
KeFreeCalloutStack   6.0 and higher
KeGenericCallDpc   5.2 and higher
KeGetClockOwner   6.3 and higher
KeGetClockTimerResolution   6.3 and higher
KeGetCurrentIrql x64 all
x86 see HAL in all
KeGetCurrentNodeNumber   6.1 and higher
KeGetCurrentProcessorNumberEx   6.1 and higher
KeGetCurrentThread   all
KeGetEffectiveIrql   1511 and higher
KeGetNextClockTickDuration   6.3 and higher
KeGetNextTimerExpirationDueTime   6.2 only
KeGetPreviousMode x86 all
KeGetProcessorIndexFromNumber   6.1 and higher
KeGetProcessorNumberFromIndex   6.1 and higher
KeGetRecommendedSharedDataAlignment   5.1 and higher
KeGetXSaveFeatureFlags   6.1 and higher
KeHwPolicyLocateResource   6.2 and higher
KeI386AbiosCall x86 3.10 to 6.1
KeI386AllocateGdtSelectors x86 3.10 to 6.1
KeI386Call16BitCStyleFunction x86 4.0 to 6.1
KeI386Call16BitFunction x86 3.51 to 6.1
KeI386FlatToGdtSelector x86 3.10 to 6.1
KeI386GetLid x86 3.10 to 6.1
KeI386MachineType (data) x86 all
KeI386ReleaseGdtSelectors x86 3.51 to 6.1
KeI386ReleaseLid x86 3.10 to 6.1
KeI386SetGdtSelector x86 3.51 to 6.1
KeIcacheFlushCount   3.10 to 5.1
KeInitializeAffinityEx   6.1 and higher
KeInitializeApc   all
KeInitializeCrashDumpHeader   5.2 SP1 and higher
KeInitializeDeviceQueue   all
KeInitializeDpc   all
KeInitializeEnumerationContext   6.1 and higher
KeInitializeEnumerationContextFromAffinity   10.0 and higher
KeInitializeEnumerationContextFromGroup   6.1 and higher
KeInitializeEvent   all
KeInitializeGuardedMutex   5.2 SP1 and higher
KeInitializeInterrupt   all
KeInitializeMutant   all
KeInitializeMutex   all
KeInitializePowerStatus   3.10 only
KeInitializeQueue   3.50 and higher
KeInitializeSecondaryInterruptServices   6.2 and higher
KeInitializeSemaphore   all
KeInitializeSpinLock x86 all
KeInitializeThreadedDpc   5.2 and higher
KeInitializeTimer   all
KeInitializeTimer2   10.0 and higher
KeInitializeTimerEx   4.0 and higher
KeInitializeTriageDumpDataArray   1803 and higher
KeInsertByKeyDeviceQueue   all
KeInsertDeviceQueue   all
KeInsertHeadQueue   3.51 and higher
KeInsertQueue   3.50 and higher
KeInsertQueueApc   all
KeInsertQueueDpc   all
KeInsertQueuePowerStatus   3.10 only
KeInterlockedClearProcessorAffinityEx   6.1 and higher
KeInterlockedSetProcessorAffinityEx   6.1 and higher
KeInvalidateAllCaches   5.2 and higher
KeInvalidateRangeAllCaches   6.0 and higher
KeInvalidateRangeAllCachesNoIpi   1803 and higher
KeIpiGenericCall   5.2 and higher
KeIsAttachedProcess   5.1 and higher
KeIsEmptyAffinityEx   6.1 and higher
KeIsEqualAffinityEx   6.1 and higher
KeIsExecutingDpc x86 all
x64 6.0 and higher
KeIsSingleGroupAffinityEx   6.1 and higher
KeIsSubsetAffinityEx   6.1 and higher
KeIsWaitListEmpty   5.2 SP1 and higher
KeLastBranchMSR (data) x64 all
KeLeaveCriticalRegion   all
KeLeaveGuardedRegion   5.2 SP1 and higher
KeLoadMTRR   6.2 and higher
KeLoaderBlock (data)   3.50 and higher
KeLowerIrql x64 all
x86 see HAL in all
KeNotifyProcessorFreezeSupported   10.0 and higher
KeNumberProcessors (data)   all
KeOrAffinityEx   6.1 and higher
KePollFreezeExecution x86 6.1 and higher
KePrepareToDispatchVirtualProcessor x64 1809 and higher
KeProcessorGroupAffinity   6.1 and higher
KeProfileInterrupt x86 3.10 to 6.1
KeProfileInterruptWithSource   3.51 and higher
KePulseEvent   3.51 and higher
KeQueryActiveGroupCount   6.1 and higher
KeQueryActiveProcessorAffinity   6.1 and higher
KeQueryActiveProcessorCount   6.0 and higher
KeQueryActiveProcessorCountEx   6.1 and higher
KeQueryActiveProcessors   5.0 and higher
KeQueryAuxiliaryCounterFrequency   10.0 and higher
KeQueryDpcWatchdogInformation   6.0 and higher
KeQueryEffectivePriorityThread   6.2 and higher
KeQueryGroupAffinity   6.1 and higher
KeQueryGroupAffinityEx   6.1 and higher
KeQueryHardwareCounterConfiguration   6.1 and higher
KeQueryHeteroCpuPolicyThread   10.0 and higher
KeQueryHighestNodeNumber   6.1 and higher
KeQueryInterruptTime x86 5.0 and higher
KeQueryInterruptTimePrecise   6.2 and higher
KeQueryLogicalProcessorRelationship   6.1 and higher
KeQueryMaximumGroupCount   6.1 and higher
KeQueryMaximumProcessorCount   6.0 and higher
KeQueryMaximumProcessorCountEx   6.1 and higher
KeQueryMultiThreadProcessorSet x64 all
KeQueryNodeActiveAffinity   6.1 and higher
KeQueryNodeMaximumProcessorCount   6.1 and higher
KeQueryPerformanceCounter x64 2004 and higher;
also from HAL in all
x86 see HAL in all
KeQueryPrcbAddress x64 all
KeQueryPriorityThread   5.0 and higher
KeQueryRuntimeThread   5.1 and higher
KeQuerySystemTime x86 all
KeQuerySystemTimePrecise   6.2 and higher
KeQueryTickCount x86 all
KeQueryTimeIncrement   all
KeQueryTotalCycleTimeThread   6.2 and higher
KeQueryUnbiasedInterruptTime   6.1 and higher
KeQueryUnbiasedInterruptTimePrecise   1607 and higher
KeRaiseIrqlToDpcLevel x64 all
x86 see HAL in 4.0 and higher
KeRaiseUserException   4.0 and higher
KeReadStateEvent   all
KeReadStateMutant   3.50 and higher
KeReadStateMutex   all
KeReadStateQueue   3.50 and higher
KeReadStateSemaphore   all
KeReadStateTimer   all
KeReenterRetpolinedCode x64 1809 and higher
KeRegisterBoundCallback   10.0 and higher
KeRegisterBugCheckCallback   3.50 and higher
KeRegisterBugCheckReasonCallback   5.1 SP1 and higher
KeRegisterNmiCallback   5.2 and higher
KeRegisterProcessorChangeCallback   6.0 SP1 and higher
KeReleaseGuardedMutex   5.2 SP1 and higher
KeReleaseGuardedMutexUnsafe   5.2 SP1 and higher
KeReleaseInStackQueuedSpinLock x64 all
x86 6.2 and higher;
also from HAL in 5.1 and higher
KeReleaseInStackQueuedSpinLockForDpc   5.2 and higher
KeReleaseInStackQueuedSpinLockFromDpcLevel   5.1 and higher
KeReleaseInterruptSpinLock   5.1 and higher
KeReleaseMutant   all
KeReleaseMutex   all
KeReleaseQueuedSpinLock x64 all
x86 6.2 and higher;
also from HAL in 5.0 and higher
KeReleaseSemaphore   all
KeReleaseSpinLock x64 all
x86 6.2 and higher;
also from HAL in all
KeReleaseSpinLockForDpc   5.2 and higher
KeReleaseSpinLockFromDpcLevel   all
KeRemoveByKeyDeviceQueue   all
KeRemoveByKeyDeviceQueueIfBusy   5.1 and higher
KeRemoveDeviceQueue   all
KeRemoveEntryDeviceQueue   all
KeRemoveGroupAffinityEx   6.1 and higher
KeRemoveProcessorAffinityEx   6.1 and higher
KeRemoveProcessorGroupAffinity   6.1 and higher
KeRemoveQueue   3.50 and higher
KeRemoveQueueDpc   all
KeRemoveQueueDpcEx   6.3 and higher
KeRemoveQueueEx   6.0 SP1 and higher
KeRemoveQueuePowerStatus   3.10 only
KeRemoveSystemServiceTable   5.1 and higher
KeReportCacheIncoherentDevice   10.0 and higher
KeResetEvent   all
KeRestoreExtendedProcessorState   6.1 and higher
KeRestoreFloatingPointState   4.0 and higher
KeRevertToUserAffinityThread   5.0 and higher
KeRevertToUserAffinityThreadEx   6.0 and higher
KeRevertToUserGroupAffinityThread   6.1 and higher
KeRundownQueue   4.0 and higher
KeSaveExtendedProcessorState   6.1 and higher
KeSaveFloatingPointState   4.0 and higher
KeSaveStateForHibernate (data)   5.0 and higher
KeServiceDescriptorTable (data) x86 3.51 and higher
x64 5.2 before SP2
KeSetActualBasePriorityThread   6.0 and higher
KeSetAffinityThread   4.0 and higher
KeSetBasePriorityThread   all
KeSetCoalescableTimer   6.1 and higher
KeSetDmaIoCoherency   3.51 and higher
KeSetEvent   all
KeSetEventBoostPriority   3.50 and higher
KeSetHardwareCounterConfiguration   6.1 and higher
KeSetHeteroCpuPolicyThread   10.0 and higher
KeSetIdealProcessorThread   4.0 and higher
KeSetImportanceDpc   3.51 and higher
KeSetKernelStackSwapEnable   4.0 and higher
KeSetLastBranchRecordInUse x64 1709 and higher
KeSetPriorityThread   all
KeSetProfileIrql   4.0 and higher
KeSetSelectedCpuSetsThread   10.0 and higher
KeSetSwapContextNotifyRoutine   4.0 to 5.0
KeSetSystemAffinityThread   5.0 and higher
KeSetSystemAffinityThreadEx   6.0 and higher
KeSetSystemGroupAffinityThread   6.1 and higher
KeSetTargetProcessorDpc   3.51 and higher
KeSetTargetProcessorDpcEx   6.1 and higher
KeSetThreadSelectNotifyRoutine   4.0 to 5.0
KeSetTimeIncrement   3.10 to 6.2
KeSetTimeUpdateNotifyRoutine   4.0 to 5.1
KeSetTimer   all
KeSetTimer2   10.0 and higher
KeSetTimerEx   4.0 and higher
KeSetTracepoint x64 1903 and higher
KeShouldYieldProcessor   10.0 and higher
KeSignalCallDpcDone   5.2 and higher
KeSignalCallDpcSynchronize   5.2 and higher
KeStackAttachProcess   5.0 and higher
KeStallExecutionProcessor x64 2004 and higher;
also from HAL in all
x86 see HAL in all
KeStallWhileFrozen   6.2 and higher
KeStartDynamicProcessor   6.0 and higher
KeSubtractAffinityEx   6.1 and higher
KeSweepLocalCaches   6.2 and higher
KeSynchronizeExecution   all
KeSynchronizeTimeToQpc   10.0 and higher
KeSystemFullyCacheCoherent   10.0 and higher
KeTerminateThread   3.10 to 6.0
KeTestAlertThread   6.0 SP1 and higher
KeTestSpinLock   5.2 and higher
KeTickCount (data) x86 3.50 and higher
KeTimeIncrement (data)   3.10 only
KeTryToAcquireGuardedMutex   5.2 SP1 and higher
KeTryToAcquireQueuedSpinLock x64 all
x86 6.2 and higher;
also from HAL in 5.0 and higher
KeTryToAcquireQueuedSpinLockRaiseToSynch x64 all
x86 6.2 and higher;
also from HAL in 5.0 and higher
KeTryToAcquireSpinLockAtDpcLevel   5.2 SP1 and higher
KeUnstackDetachProcess   5.0 and higher
KeUpdateRunTime   3.10 to 6.2
KeUpdateSystemTime   3.10 to 6.1
KeUpdateThreadTag   10.0 and higher
KeUpdateTime   6.2 only
KeUpdateTimeAssist   6.2 only
KeUserModeCallback   3.51 and higher
KeWaitForMultipleObjects   all
KeWaitForMutexObject   all
KeWaitForSingleObject   all
KeWriteProtectPAT   6.2 and higher
KeYieldExecution (6)   1809 and higher
KefAcquireSpinLockAtDpcLevel x86 3.50 and higher
KefReleaseSpinLockFromDpcLevel x86 3.50 and higher
Kei386EoiHelper x86 all
KfAcquireSpinLock x86 6.2 and higher;
also from HAL in 3.50 and higher
KfRaiseIrql x64 all
x86 see HAL in 3.50 and higher
KfReleaseSpinLock x86 6.2 and higher;
also from HAL in 3.50 and higher
KiAccumulateCycleStats x86 10.0 and higher
KiAcquireSpinLock x86 all
KiBeginThreadAccountingPeriod x86 10.0 and higher
KiBugCheckData (data)   4.0 and higher
KiCheckForKernelApcDelivery   5.2 and higher
KiCheckForSListAddress x86 5.2 SP2 and higher
KiCoprocessorError x86 3.10 to 6.2
KiCpuId x64 5.2 SP1 to 6.2
x86 6.2 only
KiDeliverApc x86 all
KiDispatchInterrupt x86 all
KiEnableTimerWatchdog x86 5.0 to 5.2
KiEndThreadAccountingPeriod x86 6.2 and higher
KiEntropyQueueDpc x86 6.2 and higher
KiIpiSend   3.10 to 3.51
KiIpiServiceRoutine x86 all
KiMcaExceptionHandlerWrapper x86 1909 and higher
KiReleaseSpinLock x86 all
KiUnexpectedInterrupt x86 all
Kii386SpinOnSpinLock x86 3.10 to 6.0
KitLogFeatureUsage   6.3 and higher
KseQueryDeviceData   6.2 and higher
KseQueryDeviceDataList   6.2 and higher
KseQueryDeviceFlags   6.2 and higher
KseRegisterShim   6.2 and higher
KseRegisterShimEx   6.2 and higher
KseSetDeviceFlags   6.2 and higher
KseUnregisterShim   6.2 and higher
LdrAccessResource   3.51 and higher
LdrEnumResources   3.51 and higher
LdrFindResourceDirectory_U   4.0 and higher
LdrFindResourceEx_U   6.0 and higher
LdrFindResource_U   3.51 and higher
LdrResFindResource   6.0 and higher
LdrResFindResourceDirectory   6.0 and higher
LdrResSearchResource   6.0 and higher
LpcPortObjectType (data)   5.0 and higher
LpcReplyWaitReplyPort   6.0 and higher
LpcRequestPort   3.51 and higher
LpcRequestWaitReplyPort   5.0 and higher
LpcRequestWaitReplyPortEx   6.0 and higher
LpcSendWaitReceivePort   6.0 and higher
LsaCallAuthenticationPackage   all
LsaDeregisterLogonProcess   all
LsaFreeReturnBuffer   all
LsaLogonUser   all
LsaLookupAuthenticationPackage   all
LsaRegisterLogonProcess   all
Mm64BitPhysicalAddress (data)   5.0 and higher
MmAddPhysicalMemory   5.0 and higher
MmAddVerifierSpecialThunks   10.0 and higher
MmAddVerifierThunks   5.1 and higher
MmAdjustWorkingSetSize   3.51 and higher
MmAdvanceMdl   5.1 and higher
MmAllocateContiguousMemory   all
MmAllocateContiguousMemorySpecifyCache   5.0 and higher
MmAllocateContiguousMemorySpecifyCacheNode   6.0 and higher
MmAllocateContiguousNodeMemory   6.2 and higher
MmAllocateMappingAddress   5.1 and higher
MmAllocateMappingAddressEx   2004 and higher
MmAllocateMdlForIoSpace   6.2 and higher
MmAllocateMemoryRanges   1903 and higher
MmAllocateNodePagesForMdlEx   6.2 and higher
MmAllocateNonCachedMemory   all
MmAllocatePagesForMdl   5.0 and higher
MmAllocatePagesForMdlEx   5.2 SP1 and higher
MmAllocatePartitionNodePagesForMdlEx   1607 and higher
MmAreMdlPagesCached   6.2 and higher
MmBadPointer (data)   6.0 and higher
MmBuildMdlForNonPagedPool   all
MmCanFileBeTruncated   3.50 and higher
MmChangeImageProtection   10.0 and higher
MmCommitSessionMappedView   5.1 SP2 and higher
MmConfigureGraphicsPtes   1903 and higher
MmCopyMemory   6.3 and higher
MmCopyVirtualMemory   6.0 and higher
MmCreateMdl   all
MmCreateMirror   5.2 and higher
MmCreateSection   3.51 and higher
MmDbgTranslatePhysicalAddress   3.10 to 4.0
MmDisableModifiedWriteOfSection   3.50 and higher
MmDoesFileHaveUserWritableReferences   5.2 SP2 and higher
MmFlushImageSection   all
MmForceSectionClosed   all
MmForceSectionClosedEx   1803 and higher
MmFreeContiguousMemory   all
MmFreeContiguousMemorySpecifyCache   5.0 and higher
MmFreeMappingAddress   5.1 and higher
MmFreeMemoryRanges   1903 and higher
MmFreeNonCachedMemory   all
MmFreePagesFromMdl   5.0 and higher
MmFreePagesFromMdlEx   1607 and higher
MmGetCacheAttribute   6.3 and higher
MmGetMaximumFileSectionSize   6.2 and higher
MmGetNumberOfPhysicalPages (12)   2004 and higher
MmGetPageBadStatus   1903 and higher
MmGetPhysicalAddress   all
MmGetPhysicalMemoryRanges   5.0 and higher
MmGetPhysicalMemoryRangesEx   1607 and higher
MmGetPhysicalMemoryRangesEx2   2004 and higher
MmGetSectionInformation   1709 and higher
MmGetSystemRoutineAddress   5.0 and higher
MmGetVirtualForPhysical   5.0 and higher
MmGrowKernelStack   4.0 and higher
MmHighestUserAddress (data)   4.0 SP3 and higher
MmIsAddressValid   all
MmIsDriverSuspectForVerifier   6.2 and higher
MmIsDriverVerifying   5.0 and higher
MmIsDriverVerifyingByAddress   6.0 and higher
MmIsIoSpaceActive   5.2 and higher
MmIsNonPagedSystemAddressValid   all
MmIsRecursiveIoFault   3.50 and higher
MmIsThisAnNtAsSystem   3.50 and higher
MmIsVerifierEnabled   5.1 and higher
MmLoadSystemImage   10.0 and higher
MmLockPagableDataSection   3.51 and higher
MmLockPagableImageSection   3.50 and higher
MmLockPagableSectionByHandle   3.51 and higher
MmLockPreChargedPagedPool   1809 and higher
MmMapIoSpace   all
MmMapIoSpaceEx   10.0 and higher
MmMapLockedPages   all
MmMapLockedPagesSpecifyCache   4.0 SP4 and higher
MmMapLockedPagesWithReservedMapping   5.1 and higher
MmMapMdl   1709 and higher
MmMapMemoryDumpMdl   3.50 and higher
MmMapMemoryDumpMdlEx   2004 and higher
MmMapUserAddressesToPage   5.0 and higher
MmMapVideoDisplay   4.0 and higher
MmMapViewInSessionSpace   5.0 and higher
MmMapViewInSessionSpaceEx   6.2 and higher
MmMapViewInSystemSpace   3.51 and higher
MmMapViewInSystemSpaceEx   6.2 and higher
MmMapViewOfSection   3.51 and higher
MmMarkPhysicalMemoryAsBad   5.1 and higher
MmMarkPhysicalMemoryAsGood   5.1 and higher
MmMdlPageContentsState   6.2 and higher
MmMdlPagesAreZero   6.3 and higher
MmObtainChargesToLockPagedPool   1809 and higher
MmPageEntireDriver   3.51 and higher
MmPartitionObjectType (data)   1607 to 1703
MmPrefetchPages   5.1 and higher
MmPrefetchVirtualAddresses   6.2 and higher
MmProbeAndLockPages   all
MmProbeAndLockProcessPages   5.0 and higher
MmProbeAndLockSelectedPages   5.0 and higher
MmProtectDriverSection   2004 and higher
MmProtectMdlSystemAddress   5.1 and higher
MmQueryMemoryRanges   1903 and higher
MmQuerySystemSize   all
MmRemovePhysicalMemory   5.0 and higher
MmResetDriverPaging   3.51 and higher
MmReturnChargesToLockPagedPool   1809 and higher
MmRotatePhysicalView   6.0 and higher
MmSectionObjectType (data)   3.51 and higher
MmSecureVirtualMemory   3.51 and higher
MmSecureVirtualMemoryEx   1903 and higher
MmSetAddressRangeModified   all
MmSetBankedSection   3.51 and higher
MmSetGraphicsPtes   1809 and higher
MmSetPermanentCacheAttribute   1607 and higher
MmSetUserExceptionCallout   6.0 only
MmSizeOfMdl   all
MmSystemRangeStart (data)   4.0 SP3 and higher
MmTrimAllSystemPagableMemory   5.0 and higher
MmUnloadSystemImage   10.0 and higher
MmUnlockPagableImageSection   3.50 and higher
MmUnlockPages   all
MmUnlockPreChargedPagedPool   1809 and higher
MmUnmapIoSpace   all
MmUnmapLockedPages   all
MmUnmapReservedMapping   5.1 and higher
MmUnmapVideoDisplay   4.0 and higher
MmUnmapViewInSessionSpace   5.0 and higher
MmUnmapViewInSystemSpace   3.51 and higher
MmUnmapViewOfSection   3.51 and higher
MmUnsecureVirtualMemory   3.51 and higher
MmUserProbeAddress (data)   4.0 SP3 and higher
NlsAnsiCodePage (data)   4.0 and higher
NlsLeadByteInfo (data)   all
NlsMbCodePageTag (data)   all
NlsMbOemCodePageTag (data)   3.50 and higher
NlsOemCodePage (data)   5.0 and higher
NlsOemLeadByteInfo (data)   3.50 and higher
NtAddAtom   4.0 and higher
NtAdjustPrivilegesToken   all
NtAllocateLocallyUniqueId   all
NtAllocateUuids   3.51 and higher
NtAllocateVirtualMemory   all
NtBuildGUID (data)   6.0 and higher
NtBuildLab (data)   6.0 and higher
NtBuildNumber (data)   3.51 and higher
NtClearAllSavepointsTransaction   6.0 before SP1
NtClearSavepointTransaction   6.0 before SP1
NtClose   all
NtCommitComplete   6.0 and higher
NtCommitEnlistment   6.0 and higher
NtCommitTransaction   6.0 and higher
NtCompareSigningLevels   1703 and higher
NtConnectPort   all
NtCreateCrossVmEvent   2004 and higher
NtCreateEnlistment   6.0 and higher
NtCreateEvent   all
NtCreateFile   all
NtCreateResourceManager   6.0 and higher
NtCreateSection   all
NtCreateTransaction   6.0 and higher
NtCreateTransactionManager   6.1 and higher
NtDeleteAtom   4.0 and higher
NtDeleteFile   3.50 and higher
NtDeviceIoControlFile   all
NtDuplicateObject   all
NtDuplicateToken   all
NtEnumerateTransactionObject   6.0 and higher
NtFindAtom   4.0 and higher
NtFreeVirtualMemory   all
NtFreezeTransactions   6.0 and higher
NtFsControlFile   all
NtGetEnvironmentVariableEx   6.0 SP1 and higher
NtGetNotificationResourceManager   6.0 and higher
NtGlobalFlag (data)   all
NtImageInfo (data)   1703 and higher
NtLockFile   all
NtMakePermanentObject   5.1 and higher
NtMapViewOfSection   all
NtMarshallTransaction   6.0 before SP1
NtNotifyChangeDirectoryFile   all
NtNotifyChangeDirectoryFileEx   1709 and higher
NtOpenEnlistment   6.0 and higher
NtOpenFile   all
NtOpenProcess   3.50 and higher
NtOpenProcessToken   all
NtOpenProcessTokenEx   5.1 and higher
NtOpenResourceManager   6.0 and higher
NtOpenThread   5.1 and higher
NtOpenThreadToken   5.1 and higher
NtOpenThreadTokenEx   5.1 and higher
NtOpenTransaction   6.0 and higher
NtOpenTransactionManager   6.1 and higher
NtPrePrepareComplete   6.1 and higher
NtPrePrepareEnlistment   6.0 and higher
NtPrepareComplete   6.0 and higher
NtPrepareEnlistment   6.0 and higher
NtPropagationComplete   6.1 and higher
NtPropagationFailed   6.1 and higher
NtPullTransaction   6.0 before SP1
NtQueryDirectoryFile   all
NtQueryDirectoryFileEx   1709 and higher
NtQueryEaFile   all
NtQueryEnvironmentVariableInfoEx   6.0 SP1 and higher
NtQueryInformationAtom   4.0 and higher
NtQueryInformationByName   2004 and higher
NtQueryInformationEnlistment   6.0 and higher
NtQueryInformationFile   all
NtQueryInformationProcess   3.50 and higher
NtQueryInformationResourceManager   6.0 and higher
NtQueryInformationThread   5.1 and higher
NtQueryInformationToken   all
NtQueryInformationTransaction   6.0 and higher
NtQueryInformationTransactionManager   6.0 and higher
NtQueryOleDirectoryFile   4.0 only
NtQueryQuotaInformationFile   5.0 and higher
NtQuerySecurityAttributesToken   6.1 and higher
NtQuerySecurityObject   all
NtQuerySystemInformation   5.0 and higher
NtQuerySystemInformationEx   6.1 and higher
NtQueryVolumeInformationFile   all
NtReadFile   all
NtReadFileScatter   2004 and higher
NtReadOnlyEnlistment   6.1 and higher
NtRecoverEnlistment   6.1 and higher
NtRecoverResourceManager   6.1 and higher
NtRecoverTransactionManager   6.1 and higher
NtRequestPort   all
NtRequestWaitReplyPort   all
NtRollbackComplete   6.1 and higher
NtRollbackEnlistment   6.0 and higher
NtRollbackTransaction   6.0 and higher
NtSavepointComplete   6.0 before SP1
NtSavepointTransaction   6.0 before SP1
NtSetCachedSigningLevel   6.2 and higher
NtSetEaFile   5.0 and higher
NtSetEvent   all
NtSetInformationEnlistment   6.0 and higher
NtSetInformationFile   all
NtSetInformationProcess   all
NtSetInformationResourceManager   6.0 and higher
NtSetInformationThread   all
NtSetInformationToken   6.1 and higher
NtSetInformationTransaction   6.0 and higher
NtSetInformationVirtualMemory   6.2 and higher
NtSetQuotaInformationFile   5.0 and higher
NtSetSecurityObject   all
NtSetVolumeInformationFile   5.0 and higher
NtShutdownSystem   5.1 and higher
NtStartTm   6.0 before SP1
NtThawTransactions   6.0 and higher
NtTraceControl   6.0 and higher
NtTraceEvent   5.1 and higher
NtUnlockFile   all
NtVdmControl   all
NtWaitForSingleObject   all
NtWriteFile   all
NtWriteFileGather   2004 and higher
ObAssignSecurity   4.0 and higher
ObCheckCreateObjectAccess   4.0 and higher
ObCheckObjectAccess   4.0 and higher
ObCloseHandle   5.1 and higher
ObCreateObject   all
ObCreateObjectType   5.1 and higher
ObCreateObjectTypeEx   1903 and higher
ObDeleteCapturedInsertInfo   5.0 SP4 and higher,
not 5.1,
then 5.2 and higher
ObDereferenceObject   all
ObDereferenceObjectDeferDelete   6.0 and higher
ObDereferenceObjectDeferDeleteWithTag   6.1 and higher
ObDereferenceSecurityDescriptor   5.1 and higher
ObDuplicateObject   6.2 and higher
ObFindHandleForObject   4.0 and higher
ObGetFilterVersion   6.0 SP1 and higher
ObGetObjectPointerCount   3.50 to 5.0
ObGetObjectSecurity   4.0 and higher
ObGetObjectType   6.1 and higher
ObInsertObject   all
ObIsDosDeviceLocallyMapped   5.1 SP3 and higher,
not 5.2,
then 6.0 and higher
ObIsKernelHandle   6.0 and higher
ObLogSecurityDescriptor   5.1 and higher
ObMakeTemporaryObject   3.50 and higher
ObOpenObjectByName   4.0 and higher
ObOpenObjectByNameEx   1511 and higher
ObOpenObjectByPointer   all
ObOpenObjectByPointerWithTag   6.1 and higher
ObQueryNameInfo   6.1 and higher
ObQueryNameString   all
ObQueryObjectAuditingByHandle   4.0 and higher
ObReferenceObjectByHandle   all
ObReferenceObjectByHandleWithTag   6.1 and higher
ObReferenceObjectByName   4.0 and higher
ObReferenceObjectByPointer   all
ObReferenceObjectByPointerWithTag   6.1 and higher
ObReferenceObjectSafe   6.2 and higher
ObReferenceObjectSafeWithTag   6.2 and higher
ObReferenceSecurityDescriptor   5.1 and higher
ObRegisterCallbacks   6.0 SP1 and higher
ObReleaseObjectSecurity   4.0 and higher
ObSetHandleAttributes   5.1 and higher
ObSetSecurityDescriptorInfo   4.0 and higher
ObSetSecurityObjectByPointer   5.1 and higher
ObUnRegisterCallbacks   6.0 SP1 and higher
ObWaitForMultipleObjects   6.2 and higher
ObWaitForSingleObject   6.2 and higher
ObfDereferenceObject   3.50 and higher
ObfDereferenceObjectWithTag   6.1 and higher
ObfReferenceObject   4.0 and higher
ObfReferenceObjectWithTag   6.1 and higher
POGOBuffer (data)   6.0 and higher
PcwAddInstance   6.1 and higher
PcwCloseInstance   6.1 and higher
PcwCreateInstance   6.1 and higher
PcwRegister   6.1 and higher
PcwUnregister   6.1 and higher
PfFileInfoNotify   6.0 and higher
PfxFindPrefix   all
PfxInitialize   all
PfxInsertPrefix   all
PfxRemovePrefix   all
PnpFreeSystemPdoList (13)   2004 and higher
PnpGetDeviceInstancePropertyData (14)   2004 and higher
PnpGetDeviceInstanceRegistryValue (15)   2004 and higher
PnpGetSystemPdoList (16)   2004 and higher
PoAllProcessorsDeepIdle   6.2 only
PoCallDriver   5.0 and higher
PoCancelDeviceNotify   5.0 and higher
PoClearPowerRequest   6.1 and higher
PoCpuIdledSinceLastCallImprecise   10.0 and higher
PoCreatePowerRequest   6.1 and higher
PoCreateThermalRequest   10.0 and higher
PoDeletePowerRequest   6.1 and higher
PoDeleteThermalRequest   10.0 and higher
PoDirectedDripsClearDeviceFlags   1809 and higher
PoDirectedDripsSetDeviceFlags   1809 and higher
PoDisableSleepStates   6.0 and higher
PoEndDeviceBusy   6.1 and higher
PoEnergyEstimationEnabled   10.0 and higher
PoFxCompleteDevicePowerNotRequired   6.2 and higher
PoFxCompleteDirectedPowerDown   1903 and higher
PoFxCompleteDirectedPowerTransition   1809 only
PoFxCompleteIdleCondition   6.2 and higher
PoFxCompleteIdleState   6.2 and higher
PoFxEnableDStateReporting   10.0 and higher
PoFxIdleComponent   6.2 and higher
PoFxIssueComponentPerfStateChange   10.0 and higher
PoFxIssueComponentPerfStateChangeMultiple   10.0 and higher
PoFxNotifySurprisePowerOn   6.2 and higher
PoFxPowerControl   6.2 and higher
PoFxPowerOnCrashdumpDevice   6.3 and higher
PoFxProcessorNotification   6.2 and higher
PoFxQueryCurrentComponentPerfState   10.0 and higher
PoFxRegisterComponentPerfStates   10.0 and higher
PoFxRegisterCoreDevice   6.2 and higher
PoFxRegisterCrashdumpDevice   6.3 and higher
PoFxRegisterDevice   6.2 and higher
PoFxRegisterDripsWatchdogCallback   1703 and higher
PoFxRegisterInternalDevice   1809 only
PoFxRegisterPlugin   6.2 and higher
PoFxRegisterPluginEx   6.2 and higher
PoFxRegisterPrimaryDevice   6.2 and higher
PoFxReportDevicePoweredOn   6.2 and higher
PoFxSetComponentLatency   6.2 and higher
PoFxSetComponentResidency   6.2 and higher
PoFxSetComponentWake   6.2 and higher
PoFxSetDeviceIdleTimeout   6.2 and higher
PoFxSetTargetDripsDevicePowerState   1709 and higher
PoFxStartDevicePowerManagement   6.2 and higher
PoFxUnregisterDevice   6.2 and higher
PoGetProcessorIdleAccounting   6.2 and higher
PoGetSystemWake   6.0 and higher
PoGetThermalRequestSupport   10.0 and higher
PoInitiateProcessorWake   6.2 and higher
PoLatencySensitivityHint   6.2 and higher
PoNotifyDisableDynamicTick   6.2 only
PoNotifyMediaBuffering   10.0 and higher
PoNotifyVSyncChange   6.2 and higher
PoQueryWatchdogTime   6.1 and higher
PoQueryPowerSequence   3.51 to 4.0
PoQueueShutdownWorkItem   5.1 and higher
PoReenableSleepStates   6.0 and higher
PoRegisterCoalescingCallback   6.2 and higher
PoRegisterDeviceForIdleDetection   3.51,
not 4.0,
then 5.0 and higher
PoRegisterDeviceNotify   5.0 and higher
PoRegisterPowerSettingCallback   6.0 and higher
PoRegisterSystemState   5.0 and higher
PoReportDirectedDripsCandidateDevice   1803 to 1809
PoRequestPowerChange   3.51 to 4.0
PoRequestPowerIrp   5.0 and higher
PoRequestShutdownEvent   5.1 and higher
PoSetDeviceBusyEx   6.0 SP1 and higher
PoSetDeviceIdleDetection   4.0 only
PoSetFixedWakeSource   6.0 and higher
PoSetHiberRange   5.0 and higher
PoSetPowerButtonHoldState   1703 and higher
PoSetPowerRequest   6.1 and higher
PoSetPowerState   5.0 and higher
PoSetSystemState   5.0 and higher
PoSetSystemWake   6.0 and higher
PoSetSystemWakeDevice   1511 and higher
PoSetThermalActiveCooling   10.0 and higher
PoSetThermalPassiveCooling   10.0 and higher
PoSetUserPresent   6.2 and higher
PoShutdownBugCheck   5.0 and higher
PoStartDeviceBusy   6.1 and higher
PoStartNextPowerIrp   5.0 and higher
PoUnregisterCoalescingCallback   6.2 and higher
PoUnregisterPowerSettingCallback   6.0 and higher
PoUnregisterSystemState   5.0 and higher
PoUserShutdownCancelled   6.2 and higher
PoUserShutdownInitiated   6.0 and higher
ProbeForRead   3.10,
not 3.50 to 4.0,
then 5.0 and higher
ProbeForWrite   all
PsAcquireProcessExitSynchronization   6.0 and higher
PsAcquireSiloHardReference   1607 and higher
PsAllocSiloContextSlot   1607 and higher
PsAllocateMonitorContextServerSilo   10.0 to 1511
PsAssignImpersonationToken   4.0 and higher
PsAssignProcessToJobObject   1703 and higher
PsAttachSiloToCurrentThread   10.0 and higher
PsCaptureUserProcessParameters (1)   6.2 and higher
PsChargePoolQuota   all
PsChargeProcessCpuCycles x64 6.0 only
x86 6.0 to 6.1
PsChargeProcessNonPagedPoolQuota   5.1 and higher
PsChargeProcessPagedPoolQuota   5.1 and higher
PsChargeProcessPoolQuota   5.1 and higher
PsChargeProcessWakeCounter   6.2 and higher
PsCreateSiloContext   1607 and higher
PsCreateSystemProcess   3.10 to 5.2
PsCreateSystemThread   all
PsCreateSystemThreadEx   6.2 and higher
PsCreateWin32Process   4.0 only
PsDeleteMonitorContextServerSilo   10.0 to 1511
PsDereferenceImpersonationToken   5.1 and higher
PsDereferenceKernelStack   6.2 and higher
PsDereferenceMonitorContextServerSilo   10.0 to 1511
PsDereferencePrimaryToken   5.1 and higher
PsDereferenceSiloContext   1607 and higher
PsDetachSiloFromCurrentThread   10.0 and higher
PsDisableImpersonation   5.0 and higher
PsEnterPriorityRegion   6.0 and higher
PsEqualCurrentServerSilo   1511 only
PsEqualCurrentSilo   10.0 to 1511
PsEstablishWin32Callouts   3.51 and higher
PsFreeSiloContextSlot   1607 and higher
PsGetContextThread   5.1 SP1 and higher
PsGetCurrentProcess   5.1 and higher
PsGetCurrentProcessId   4.0 and higher
PsGetCurrentProcessSessionId   5.1 and higher
PsGetCurrentProcessWin32Process   5.2 SP1 and higher
PsGetCurrentProcessWow64Process x64 all
PsGetCurrentServerSilo   1511 and higher
PsGetCurrentServerSiloName   1511 and higher
PsGetCurrentSilo   10.0 and higher
PsGetCurrentSiloObject   1511 only
PsGetCurrentThread   5.1 and higher
PsGetCurrentThreadId   4.0 and higher
PsGetCurrentThreadPreviousMode   5.1 and higher
PsGetCurrentThreadProcess   5.2 SP1 and higher
PsGetCurrentThreadProcessId   5.2 SP1 and higher
PsGetCurrentThreadStackBase   5.1 and higher
PsGetCurrentThreadStackLimit   5.1 and higher
PsGetCurrentThreadTeb   5.2 SP1 and higher
PsGetCurrentThreadWin32Thread   5.2 SP1 and higher
PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion   5.2 SP1 and higher
PsGetEffectiveContainerId   10.0 and higher
PsGetEffectiveServerSilo   1607 and higher
PsGetHostSilo   1607 and higher
PsGetJobLock   5.1 and higher
PsGetJobProperty   10.0 and higher
PsGetJobServerSilo   1511 and higher
PsGetJobSessionId   5.1 and higher
PsGetJobSilo   1607 and higher
PsGetJobUIRestrictionsClass   5.1 and higher
PsGetMonitorContextServerSilo   10.0 to 1511
PsGetParentSilo   1709 and higher
PsGetPermanentSiloContext   1607 and higher
PsGetProcessCommonJob   6.2 and higher
PsGetProcessCreateTimeQuadPart   5.1 and higher
PsGetProcessDebugPort   5.1 and higher
PsGetProcessDxgProcess   1607 and higher
PsGetProcessExitProcessCalled   5.1 and higher
PsGetProcessExitStatus   5.1 and higher
PsGetProcessExitTime   3.50 and higher
PsGetProcessId   5.1 and higher
PsGetProcessImageFileName   5.1 and higher
PsGetProcessInheritedFromUniqueProcessId   5.1 and higher
PsGetProcessJob   5.1 and higher
PsGetProcessPeb   5.1 and higher
PsGetProcessPriorityClass   5.1 and higher
PsGetProcessProtection   6.3 and higher
PsGetProcessSectionBaseAddress   5.1 and higher
PsGetProcessSecurityPort   5.1 and higher
PsGetProcessSequenceNumber   1703 and higher
PsGetProcessServerSilo   1511 and higher
PsGetProcessSessionId   5.1 and higher
PsGetProcessSessionIdEx   5.2 and higher
PsGetProcessSignatureLevel   6.2 and higher
PsGetProcessSilo   1709 and higher
PsGetProcessStartKey   1703 and higher
PsGetProcessWin32Process   5.1 and higher
PsGetProcessWin32WindowStation   5.1 and higher
PsGetProcessWow64Process x64 all
PsGetServerSiloDefaultCompartmentId   10.0 only
PsGetServerSiloServiceSessionId   10.0 and higher
PsGetSiloContainerId   1809 and higher
PsGetSiloContext   1607 and higher
PsGetSiloIdentifier   1511 and higher
PsGetSiloMonitorContextSlot   1607 and higher
PsGetSiloObject   10.0 only
PsGetSiloObjectFromJob   10.0 to 1511
PsGetThreadCreateTime   10.0 and higher
PsGetThreadExitStatus   6.2 and higher
PsGetThreadFreezeCount   5.1 and higher
PsGetThreadHardErrorsAreDisabled   5.1 and higher
PsGetThreadId   5.1 and higher
PsGetThreadProcess   5.1 and higher
PsGetThreadProcessId   5.1 and higher
PsGetThreadProperty   10.0 and higher
PsGetThreadServerSilo   1809 and higher
PsGetThreadSessionId   5.1 and higher
PsGetThreadTeb   5.1 and higher
PsGetThreadWin32Thread   5.1 and higher
PsGetVersion   4.0 and higher
PsGetWin32KFilterSet   1703 and higher
PsImpersonateClient   4.0 and higher
PsInitialSystemProcess (data)   all
PsInsertPermanentSiloContext   1607 and higher
PsInsertSiloContext   1607 and higher
PsInsertSiloObject   10.0 only
PsInsertSiloObjectFromJob   10.0 to 1511
PsIsCurrentThreadInServerSilo   1511 and higher
PsIsCurrentThreadPrefetching   6.0 and higher
PsIsDiskCountersEnabled   6.2 and higher
PsIsDpcActive   10.0 only
PsIsHostSilo   10.0 and higher
PsIsProcessBeingDebugged   5.1 and higher
PsIsProcessCommitRelinquished   1607 and higher
PsIsProcessInAppSilo   10.0 and higher
PsIsProtectedProcess   6.0 and higher
PsIsProtectedProcessLight   6.3 and higher
PsIsSystemProcess   5.2 SP1 and higher
PsIsSystemThread   5.1 and higher
PsIsThreadImpersonating   5.1 and higher
PsIsThreadTerminating   3.50 and higher
PsIsWin32KFilterAuditEnabled   1607 and higher
PsIsWin32KFilterAuditEnabledForProcess   1709 and higher
PsIsWin32KFilterEnabled   1607 and higher
PsIsWin32KFilterEnabledForProcess   1709 and higher
PsJobType (data)   5.0 and higher
PsLeavePriorityRegion   6.0 and higher
PsLoadedModuleList (data)   10.0 and higher
PsLoadedModuleResource (data)   10.0 and higher
PsLookupProcessByProcessId   3.51 and higher
PsLookupProcessThreadByCid   3.50 and higher
PsLookupThreadByThreadId   3.51 and higher
PsMakeSiloContextPermanent   1607 and higher
PsPartitionType (data)   1709 and higher
PsProcessType (data)   all
PsQueryProcessAttributesByToken   6.2 and higher
PsQueryProcessCommandLine   1607 and higher
PsQueryProcessExceptionFlags   6.0 SP1 and higher
PsQueryTotalCycleTimeProcess   6.2 and higher
PsReferenceImpersonationToken   3.51 and higher
PsReferenceKernelStack   6.2 and higher
PsReferenceMonitorContextServerSilo   10.0 to 1511
PsReferencePrimaryToken   3.51 and higher
PsReferenceProcessFilePointer   6.0 and higher
PsReferenceSiloContext   1607 and higher
PsRegisterAltSystemCallHandler   2004 and higher
PsRegisterMonitorServerSilo   10.0 to 1511
PsRegisterPicoProvider   10.0 and higher
PsRegisterSiloMonitor   1607 and higher
PsReleaseProcessExitSynchronization   6.0 and higher
PsReleaseProcessWakeCounter   6.2 and higher
PsReleaseSiloHardReference   1607 and higher
PsRemoveCreateThreadNotifyRoutine   5.1 and higher
PsRemoveLoadImageNotifyRoutine   5.1 and higher
PsRemoveSiloContext   1607 and higher
PsRemoveSiloObject   10.0 only
PsRemoveSiloObjectFromJob   10.0 to 1511
PsReplaceSiloContext   1607 and higher
PsRestoreImpersonation   5.0 and higher
PsResumeProcess   6.0 and higher
PsReturnPoolQuota   all
PsReturnProcessNonPagedPoolQuota   5.1 and higher
PsReturnProcessPagedPoolQuota   5.1 and higher
PsRevertThreadToSelf   5.1 and higher
PsRevertToSelf   4.0 and higher
PsSetContextThread   5.1 SP1 and higher
PsSetCreateProcessNotifyRoutine   3.50 and higher
PsSetCreateProcessNotifyRoutineEx   6.0 SP1 and higher
PsSetCreateProcessNotifyRoutineEx2   1511 and higher
PsSetCreateThreadNotifyRoutine   4.0 and higher
PsSetCreateThreadNotifyRoutineEx   10.0 and higher
PsSetCurrentThreadPrefetching   6.0 and higher
PsSetJobProperty   10.0 and higher
PsSetJobUIRestrictionsClass   5.1 to 6.1
PsSetLegoNotifyRoutine   4.0 and higher
PsSetLoadImageNotifyRoutine   5.0 and higher
PsSetLoadImageNotifyRoutineEx   1709 and higher
PsSetMonitorContextServerSilo   10.0 to 1511
PsSetNewKSecDD   5.0 SP4 only
PsSetProcessDxgProcess   1607 and higher
PsSetProcessFaultInformation   1709 and higher
PsSetProcessPriorityByClass   3.51 and higher
PsSetProcessPriorityClass   5.1 and higher
PsSetProcessSecurityPort   5.1 and higher
PsSetProcessWin32Process   5.1 and higher
PsSetProcessWindowStation   5.1 and higher
PsSetThreadHardErrorsAreDisabled   5.1 and higher
PsSetThreadProperty   10.0 and higher
PsSetThreadWin32Thread   5.1 and higher
PsSiloContextNonPagedType (data)   1607 and higher
PsSiloContextPagedType (data)   1607 and higher
PsStartMonitorServerSilo   10.0 to 1511
PsStartSiloMonitor   1607 and higher
PsSuspendProcess   6.0 and higher
PsTerminateServerSilo   1607 and higher
PsTerminateSystemThread   all
PsThreadType (data)   all
PsUILanguageComitted (data)   6.0 and higher
PsUnregisterMonitorServerSilo   10.0 to 1511
PsUnregisterSiloMonitor   1607 and higher
PsUpdateComponentPower   10.0 and higher
PsUpdateDiskCounters   6.2 and higher
PsWow64GetProcessMachine   1607 and higher
PsWow64IsMachineSupported   1803 and higher
PsWrapApcWow64Thread   5.2 SP1 and higher
PspDereferenceSiloObject   10.0 only
PspReferenceSiloObject   10.0 only
RtlAbsoluteToSelfRelativeSD   all
RtlAddAccessAllowedAce   all
RtlAddAccessAllowedAceEx   5.1 SP2 and higher
RtlAddAccessAllowedObjectAce   10.0 and higher
RtlAddAccessDeniedAceEx   10.0 and higher
RtlAddAccessDeniedObjectAce   10.0 and higher
RtlAddAccessFilterAce   1703 and higher
RtlAddAce   3.51 and higher
RtlAddAtomToAtomTable   4.0 and higher
RtlAddAtomToAtomTableEx   6.2 and higher
RtlAddAuditAccessAceEx   10.0 and higher
RtlAddAuditAccessObjectAce   10.0 and higher
RtlAddProcessTrustLabelAce   10.0 and higher
RtlAddRange   5.0 and higher
RtlAddResourceAttributeAce   6.2 and higher
RtlAllocateAndInitializeSid   3.51 to 4.0
RtlAllocateHeap   all
RtlAnsiCharToUnicodeChar   4.0 and higher
RtlAnsiStringToUnicodeSize   all
RtlAnsiStringToUnicodeString   all
RtlAppendAsciizToString   all
RtlAppendStringToString   all
RtlAppendUnicodeStringToString   all
RtlAppendUnicodeToString   all
RtlAreAllAccessesGranted   3.51 and higher
RtlAreAnyAccessesGranted   4.0 and higher
RtlAreBitsClear   all
RtlAreBitsClearEx x64 10.0 and higher
RtlAreBitsSet   all
RtlAreBitsSetEx x64 10.0 and higher
RtlAssert   all
RtlAvlInsertNodeEx   6.3 and higher
RtlAvlRemoveNode   6.3 and higher
RtlCapabilityCheck   10.0 and higher
RtlCapabilityCheckForSingleSessionSku   1709 and higher
RtlCaptureContext   5.0 and higher
RtlCaptureStackBackTrace   3.51 and higher
RtlCharToInteger   all
RtlCheckPortableOperatingSystem   6.2 and higher
RtlCheckRegistryKey   all
RtlCheckSystemBootStatusIntegrity   1709 and higher
RtlCheckTokenCapability   6.2 and higher
RtlCheckTokenMembership   6.2 and higher
RtlCheckTokenMembershipEx   6.2 and higher
RtlClearAllBits   all
RtlClearAllBitsEx x64 10.0 and higher
RtlClearBit   5.1 and higher
RtlClearBitEx x64 10.0 and higher
RtlClearBits   all
RtlClearBitsEx x64 10.0 and higher
RtlCmDecodeMemIoResource   6.0 and higher
RtlCmEncodeMemIoResource   6.0 and higher
RtlCompareAltitudes   6.0 and higher
RtlCompareMemory   all
RtlCompareMemoryUlong   all
RtlCompareString   all
RtlCompareUnicodeString   all
RtlCompareUnicodeStrings   6.1 and higher
RtlCompressBuffer   3.50 and higher
RtlCompressChunks   4.0 and higher
RtlComputeCrc32   6.0 and higher
RtlConstructCrossVmEventPath   1903 and higher
RtlConstructCrossVmMutexPath   2004 and higher
RtlContractHashTable   6.1 and higher
RtlConvertLongToLargeInteger x86 all
RtlConvertSidToUnicodeString   all
RtlConvertUlongToLargeInteger x86 all
RtlCopyBitMap   6.2 and higher
RtlCopyBitMapEx x64 1809 and higher
RtlCopyLuid   all
RtlCopyLuidAndAttributesArray   6.0 and higher
RtlCopyMemory x64 all
RtlCopyMemoryNonTemporal x64 all
RtlCopyRangeList   5.0 and higher
RtlCopySid   all
RtlCopySidAndAttributesArray   6.0 and higher
RtlCopyString   all
RtlCopyUnicodeString   all
RtlCrc32   6.2 and higher
RtlCrc64   6.2 and higher
RtlCreateAcl   all
RtlCreateAtomTable   4.0 and higher
RtlCreateAtomTableEx   6.2 and higher
RtlCreateHashTable   6.1 and higher
RtlCreateHashTableEx   6.2 and higher
RtlCreateHeap   all
RtlCreateRegistryKey   all
RtlCreateSecurityDescriptor   all
RtlCreateSystemVolumeInformationFolder   5.1 and higher
RtlCreateUnicodeString   3.51 and higher
RtlCreateUnicodeStringFromAsciiz   1903 and higher
RtlCreateUserThread   6.2 and higher
RtlCultureNameToLCID   6.2 and higher
RtlCustomCPToUnicodeN   all
RtlDecompressBuffer   3.50 and higher
RtlDecompressBufferEx   6.2 and higher
RtlDecompressBufferEx2   10.0 and higher
RtlDecompressChunks   4.0 and higher
RtlDecompressFragment   3.50 and higher
RtlDecompressFragmentEx   10.0 and higher
RtlDelete   all
RtlDeleteAce   5.0 and higher
RtlDeleteAtomFromAtomTable   4.0 and higher
RtlDeleteElementGenericTable   all
RtlDeleteElementGenericTableAvl   5.1 and higher
RtlDeleteElementGenericTableAvlEx   6.2 and higher
RtlDeleteHashTable   6.1 and higher
RtlDeleteNoSplay   4.0 and higher
RtlDeleteOwnersRanges   5.0 and higher
RtlDeleteRange   5.0 and higher
RtlDeleteRegistryValue   all
RtlDeriveCapabilitySidsFromName   1703 and higher
RtlDescribeChunk   4.0 and higher
RtlDestroyAtomTable   4.0 and higher
RtlDestroyHeap   all
RtlDowncaseUnicodeChar   6.1 and higher
RtlDowncaseUnicodeString   3.50 and higher
RtlDrainNonVolatileFlush x64 1703 and higher
RtlDuplicateUnicodeString   6.0 and higher
RtlEmptyAtomTable   4.0 and higher
RtlEndEnumerationHashTable   6.1 and higher
RtlEndStrongEnumerationHashTable   10.0 and higher
RtlEndWeakEnumerationHashTable   6.1 and higher
RtlEnlargedIntegerMultiply x86 all
RtlEnlargedUnsignedDivide x86 all
RtlEnlargedUnsignedMultiply x86 all
RtlEnumerateEntryHashTable   6.1 and higher
RtlEnumerateGenericTable   all
RtlEnumerateGenericTableAvl   5.1 and higher
RtlEnumerateGenericTableLikeADirectory   5.1 and higher
RtlEnumerateGenericTableWithoutSplaying   all
RtlEnumerateGenericTableWithoutSplayingAvl   5.1 and higher
RtlEqualLuid   all
RtlEqualSid   all
RtlEqualString   all
RtlEqualUnicodeString   all
RtlEqualWnfChangeStamps   6.2 and higher
RtlEthernetAddressToStringA   6.1 and higher
RtlEthernetAddressToStringW   6.1 and higher
RtlEthernetStringToAddressA   6.1 and higher
RtlEthernetStringToAddressW   6.1 and higher
RtlExpandHashTable   6.1 and higher
RtlExtendCorrelationVector   1709 and higher
RtlExtendedIntegerMultiply x86 all
RtlExtendedLargeIntegerDivide x86 all
RtlExtendedMagicDivide x86 all
RtlExtractBitMap   6.2 and higher
RtlExtractBitMapEx x64 1709 and higher
RtlFillMemory   all
RtlFillMemoryNonTemporal x64 1903 and higher
RtlFillMemoryUlong x86 all
RtlFillMemoryUlonglong x86 6.1 and higher
RtlFillNonVolatileMemory x64 1903 and higher
RtlFindAceByType   6.1 and higher
RtlFindClearBits   all
RtlFindClearBitsAndSet   all
RtlFindClearBitsAndSetEx x64 10.0 and higher
RtlFindClearBitsEx x64 10.0 and higher
RtlFindClearRuns   5.0 and higher
RtlFindClosestEncodableLength   6.0 and higher
RtlFindExportedRoutineByName   10.0 and higher
RtlFindFirstRunClear   all
RtlFindFirstRunSet   3.10 to 4.0
RtlFindLastBackwardRunClear   5.0 and higher
RtlFindLeastSignificantBit   5.0 and higher
RtlFindLongestRunClear   all
RtlFindLongestRunSet   3.10 to 4.0
RtlFindMessage   3.51 and higher
RtlFindMostSignificantBit   5.0 and higher
RtlFindNextForwardRunClear   5.0 and higher
RtlFindNextForwardRunClearCapped   1607 and higher
RtlFindNextForwardRunClearEx x64 10.0 and higher
RtlFindRange   5.0 and higher
RtlFindSetBits   all
RtlFindSetBitsAndClear   all
RtlFindSetBitsAndClearEx x64 10.0 and higher
RtlFindSetBitsEx x64 10.0 and higher
RtlFindUnicodePrefix   all
RtlFindUnicodeSubstring   1703 and higher
RtlFirstFreeAce   10.0 and higher
RtlFlushNonVolatileMemory x64 1703 and higher
RtlFlushNonVolatileMemoryRanges x64 1703 and higher
RtlFormatCurrentUserKeyPath   3.51 and higher
RtlFormatMessage   6.0 and higher
RtlFreeAnsiString   all
RtlFreeHeap   all
RtlFreeNonVolatileToken x64 1703 and higher
RtlFreeOemString   all
RtlFreeRangeList   5.0 and higher
RtlFreeUTF8String   2004 and higher
RtlFreeUnicodeString   all
RtlGUIDFromString   5.0 and higher
RtlGenerate8dot3Name   all
RtlGenerateClass5Guid   6.2 and higher
RtlGetAce   5.0 and higher
RtlGetActiveConsoleId   1607 and higher
RtlGetAppContainerNamedObjectPath   6.2 and higher
RtlGetAppContainerParent   6.3 and higher
RtlGetAppContainerSidType   6.3 and higher
RtlGetCallersAddress   all
RtlGetCompressionWorkSpaceSize   3.50 and higher
RtlGetConsoleSessionForegroundProcessId   1607 and higher
RtlGetControlSecurityDescriptor   10.0 and higher
RtlGetCurrentServiceSessionId   1511 and higher
RtlGetDaclSecurityDescriptor   all
RtlGetDefaultCodePage   4.0 and higher
RtlGetElementGenericTable   all
RtlGetElementGenericTableAvl   5.1 and higher
RtlGetEnabledExtendedAndSupervisorFeatures   1803 and higher
RtlGetEnabledExtendedFeatures   6.1 and higher
RtlGetFirstRange   5.0 and higher
RtlGetGroupSecurityDescriptor   all
RtlGetHostNtSystemRoot (17)   2004 and higher
RtlGetIntegerAtom   6.0 and higher
RtlGetHeapUserValue   3.10 only
RtlGetLastRange   6.1 and higher
RtlGetMultiTimePrecise   1903 and higher
RtlGetNextEntryHashTable   6.1 and higher
RtlGetNextRange   5.0 and higher
RtlGetNonVolatileToken x64 1703 and higher
RtlGetNtGlobalFlags   5.0 and higher
RtlGetNtProductType   1607 and higher
RtlGetNtSystemRoot   1703 and higher
RtlGetOwnerSecurityDescriptor   all
RtlGetPersistedStateLocation   1803 and higher
RtlGetProductInfo   6.0 and higher
RtlGetSaclSecurityDescriptor   5.0 and higher
RtlGetSessionProperties   1703 and higher
RtlGetSetBootStatusData   5.1 and higher
RtlGetSuiteMask   1607 and higher
RtlGetSystemBootStatus   1709 and higher
RtlGetSystemBootStatusEx   1709 and higher
RtlGetThreadLangIdByIndex   6.0 and higher
RtlGetTokenNamedObjectPath   1703 and higher
RtlGetVersion   5.1 and higher
RtlHashUnicodeString   5.1 and higher
RtlIdnToAscii   6.0 and higher
RtlIdnToNameprepUnicode   6.0 and higher
RtlIdnToUnicode   6.0 and higher
RtlImageDirectoryEntryToData   5.0 and higher
RtlImageNtHeader   3.51 and higher
RtlImageNtHeaderEx   6.3 and higher
RtlIncrementCorrelationVector   1709 and higher
RtlInitAnsiString   all
RtlInitAnsiStringEx   5.2 and higher
RtlInitCodePageTable   all
RtlInitEnumerationHashTable   6.1 and higher
RtlInitString   all
RtlInitStringEx   10.0 and higher
RtlInitStrongEnumerationHashTable   10.0 and higher
RtlInitUTF8String   2004 and higher
RtlInitUTF8StringEx   2004 and higher
RtlInitUnicodeString   all
RtlInitUnicodeStringEx   5.2 and higher
RtlInitWeakEnumerationHashTable   6.1 and higher
RtlInitializeBitMap   all
RtlInitializeBitMapEx x64 10.0 and higher
RtlInitializeCorrelationVector   1709 and higher
RtlInitializeGenericTable   all
RtlInitializeGenericTableAvl   5.1 and higher
RtlInitializeRangeList   5.0 and higher
RtlInitializeSid   3.51 and higher
RtlInitializeSidEx   10.0 and higher
RtlInitializeUnicodePrefix   all
RtlInsertElementGenericTable   all
RtlInsertElementGenericTableAvl   5.1 and higher
RtlInsertElementGenericTableFull   5.0 and higher
RtlInsertElementGenericTableFullAvl   5.1 and higher
RtlInsertEntryHashTable   6.1 and higher
RtlInsertUnicodePrefix   all
RtlInt64ToUnicodeString   5.1 and higher
RtlIntegerToChar   3.51 and higher
RtlIntegerToUnicode   5.1 and higher
RtlIntegerToUnicodeString   all
RtlInterlockedClearBitRun   6.3 and higher
RtlInterlockedClearBitRunEx x64 1903 and higher
RtlInterlockedSetBitRun   6.3 and higher
RtlInterlockedSetBitRunEx x64 1903 and higher
RtlInterlockedSetClearRun   6.3 and higher
RtlIntersectBitMaps   1809 and higher
RtlIntersectBitMapsEx x64 1809 and higher
RtlInvertRangeList   5.0 and higher
RtlInvertRangeListEx   6.0 and higher
RtlIoDecodeMemIoResource   6.0 and higher
RtlIoEncodeMemIoResource   6.0 and higher
RtlIpv4AddressToStringA   5.1 and higher
RtlIpv4AddressToStringExA   5.1 SP2 and higher
RtlIpv4AddressToStringExW   5.1 SP2 and higher
RtlIpv4AddressToStringW   5.1 and higher
RtlIpv4StringToAddressA   5.1 and higher
RtlIpv4StringToAddressExA   5.1 SP2 and higher
RtlIpv4StringToAddressExW   5.1 SP2 and higher
RtlIpv4StringToAddressW   5.1 and higher
RtlIpv6AddressToStringA   5.1 and higher
RtlIpv6AddressToStringExA   5.1 SP2 and higher
RtlIpv6AddressToStringExW   5.1 SP2 and higher
RtlIpv6AddressToStringW   5.1 and higher
RtlIpv6StringToAddressA   5.1 and higher
RtlIpv6StringToAddressExA   5.1 SP2 and higher
RtlIpv6StringToAddressExW   5.1 SP2 and higher
RtlIpv6StringToAddressW   5.1 and higher
RtlIsCloudFilesPlaceholder   1709 and higher
RtlIsElevatedRid   1703 and higher
RtlIsGenericTableEmpty   5.0 and higher
RtlIsGenericTableEmptyAvl   5.1 and higher
RtlIsMultiSessionSku   10.0 and higher
RtlIsMultiUsersInSessionSku   1607 and higher
RtlIsNameLegalDOS8Dot3   3.51 SP2 and higher
RtlIsNonEmptyDirectoryReparsePointAllowed   1703 and higher
RtlIsNormalizedString   6.0 and higher
RtlIsNtDdiVersionAvailable   6.0 and higher
RtlIsPartialPlaceholder   1709 and higher
RtlIsPartialPlaceholderFileHandle   1709 and higher
RtlIsPartialPlaceholderFileInfo   1709 and higher
RtlIsPlaceholderFileHandle   1703 only
RtlIsPlaceholderFileInfo   1703 only
RtlIsRangeAvailable   5.0 and higher
RtlIsSandboxedToken   10.0 and higher
RtlIsServicePackVersionInstalled   6.0 and higher
RtlIsStateSeparationEnabled   1709 and higher
RtlIsUntrustedObject   6.2 and higher
RtlIsValidOemCharacter   5.0 and higher
RtlIsZeroMemory   2004 and higher
RtlLCIDToCultureName   6.2 and higher
RtlLargeIntegerAdd x86 all
RtlLargeIntegerArithmeticShift x86 all
RtlLargeIntegerDivide x86 all
RtlLargeIntegerNegate x86 all
RtlLargeIntegerShiftLeft x86 all
RtlLargeIntegerShiftRight x86 all
RtlLargeIntegerSubtract x86 all
RtlLargeIntegerToChar   10.0 and higher
RtlLengthRequiredSid   all
RtlLengthSecurityDescriptor   all
RtlLengthSid   all
RtlLoadString   6.1 and higher
RtlLocalTimeToSystemTime   6.0 and higher
RtlLocateSupervisorFeature   1803 and higher
RtlLockBootStatusData   5.1 and higher
RtlLookupAtomInAtomTable   4.0 and higher
RtlLookupElementGenericTable   all
RtlLookupElementGenericTableAvl   5.1 and higher
RtlLookupElementGenericTableFull   5.0 and higher
RtlLookupElementGenericTableFullAvl   5.1 and higher
RtlLookupEntryHashTable   6.1 and higher
RtlLookupFirstMatchingElementGenericTableAvl   6.0 and higher
RtlLookupFunctionEntry x64 all
RtlMapGenericMask   all
RtlMapSecurityErrorToNtStatus   5.1 and higher
RtlMergeRangeLists   5.0 and higher
RtlMoveMemory   all
RtlMultiByteToUnicodeN   3.51 and higher
RtlMultiByteToUnicodeSize   4.0 and higher
RtlNextUnicodePrefix   all
RtlNormalizeSecurityDescriptor   2004 and higher
RtlNormalizeString   6.0 and higher
RtlNotifyFeatureUsage   2004 and higher
RtlNtStatusToDosError   all
RtlNtStatusToDosErrorNoTeb   all
RtlNumberGenericTableElements   all
RtlNumberGenericTableElementsAvl   5.1 and higher
RtlNumberOfClearBits   all
RtlNumberOfClearBitsEx x64 10.0 and higher
RtlNumberOfClearBitsInRange   6.2 and higher
RtlNumberOfSetBits   all
RtlNumberOfSetBitsEx x64 10.0 and higher
RtlNumberOfSetBitsInRange   6.2 and higher
RtlNumberOfSetBitsInRangeEx x64 1903 and higher
RtlNumberOfSetBitsUlongPtr   6.0 and higher
RtlOemStringToCountedUnicodeString   all
RtlOemStringToUnicodeSize   all
RtlOemStringToUnicodeString   all
RtlOemToUnicodeN   all
RtlOpenCurrentUser   6.2 and higher
RtlOpenImageFileOptionsKey   1709 and higher
RtlOsDeploymentState   10.0 and higher
RtlOwnerAcesPresent   6.1 and higher
RtlPcToFileHeader x64 all
x86 10.0 and higher
RtlPcToFileName   1709 and higher
RtlPcToFilePath   1709 and higher
RtlPinAtomInAtomTable   4.0 and higher
RtlPrefetchMemoryNonTemporal   5.0 SP3 and higher
RtlPrefixString   all
RtlPrefixUnicodeString   all
RtlQueryAllFeatureConfigurations   2004 and higher
RtlQueryAtomInAtomTable   4.0 and higher
RtlQueryDynamicTimeZoneInformation   6.0 and higher
RtlQueryElevationFlags   6.0 and higher
RtlQueryFeatureConfiguration   2004 and higher
RtlQueryFeatureConfigurationChangeStamp   2004 and higher
RtlQueryImageFileKeyOption   1709 and higher
RtlQueryInformationAcl   6.2 and higher
RtlQueryModuleInformation   6.0 and higher
RtlQueryPackageClaims   10.0 and higher
RtlQueryPackageIdentity   6.2 and higher
RtlQueryProcessPlaceholderCompatibilityMode   1803 and higher
RtlQueryRegistryValueWithFallback   1803 and higher
RtlQueryRegistryValues   all
RtlQueryRegistryValuesEx   6.2 and higher
RtlQueryThreadPlaceholderCompatibilityMode   1709 and higher
RtlQueryTimeZoneInformation   all
RtlQueryValidationRunLevel   6.2 and higher
RtlRaiseCustomSystemEventTrigger   1803 and higher
RtlRaiseException   4.0 and higher
RtlRaiseStatus   1607 and higher
RtlRandom   all
RtlRandomEx   5.1 and higher
RtlRbInsertNodeEx   6.2 and higher
RtlRbRemoveNode   6.2 and higher
RtlRbReplaceNode   10.0 and higher
RtlRealPredecessor   5.0 and higher
RtlRealSuccessor   5.0 and higher
RtlRegisterFeatureConfigurationChangeNotification   2004 and higher
RtlRemoveEntryHashTable   6.1 and higher
RtlRemoveUnicodePrefix   all
RtlReplaceSidInSd   6.1 and higher
RtlReserveChunk   4.0 and higher
RtlRestoreContext x64 all
RtlRestoreSystemBootStatusDefaults   1709 and higher
RtlRunOnceBeginInitialize   6.0 and higher
RtlRunOnceComplete   6.0 and higher
RtlRunOnceExecuteOnce   6.0 and higher
RtlRunOnceInitialize   6.0 and higher
RtlSecondsSince1970ToTime   all
RtlSecondsSince1980ToTime   all
RtlSelfRelativeToAbsoluteSD   5.0 and higher
RtlSelfRelativeToAbsoluteSD2   5.0 and higher
RtlSetActiveConsoleId   1607 and higher
RtlSetAllBits   all
RtlSetAllBitsEx x64 10.0 and higher
RtlSetBit   5.1 and higher
RtlSetBitEx x64 10.0 and higher
RtlSetBits   all
RtlSetBitsEx x64 10.0 and higher
RtlSetConsoleSessionForegroundProcessId   1607 and higher
RtlSetControlSecurityDescriptor   6.2 and higher
RtlSetDaclSecurityDescriptor   all
RtlSetDynamicTimeZoneInformation   6.0 and higher
RtlSetGroupSecurityDescriptor   all
RtlSetHeapUserValue   3.10 only
RtlSetOwnerSecurityDescriptor   all
RtlSetPortableOperatingSystem   6.2 and higher
RtlSetProcessPlaceholderCompatibilityMode   1803 and higher
RtlSetSaclSecurityDescriptor   3.51 and higher
RtlSetSystemBootStatus   1709 and higher
RtlSetSystemBootStatusEx   1709 and higher
RtlSetThreadPlaceholderCompatibilityMode   1709 and higher
RtlSetTimeZoneInformation   all
RtlShiftLeftBitMap   1709 and higher
RtlShiftLeftBitMapEx x64 1709 and higher
RtlSidHashInitialize   6.0 and higher
RtlSidHashLookup   6.0 and higher
RtlSizeHeap   5.0 and higher
RtlSplay   all
RtlStringFromGUID   5.0 and higher
RtlStronglyEnumerateEntryHashTable   10.0 and higher
RtlSubAuthorityCountSid   all
RtlSubAuthoritySid   all
RtlSubtreePredecessor   5.0 and higher
RtlSubtreeSuccessor   5.0 and higher
RtlSuffixUnicodeString   10.0 and higher
RtlSystemTimeToLocalTime   6.0 and higher
RtlTestBit   5.1 and higher
RtlTestBitEx x64 10.0 and higher
RtlTimeFieldsToTime   all
RtlTimeToElapsedTimeFields   5.1 and higher
RtlTimeToSecondsSince1970   all
RtlTimeToSecondsSince1980   all
RtlTimeToTimeFields   all
RtlTraceDatabaseAdd   5.0 SP1 and higher
RtlTraceDatabaseCreate   5.0 SP1 and higher
RtlTraceDatabaseDestroy   5.0 SP1 and higher
RtlTraceDatabaseEnumerate   5.0 SP1 and higher
RtlTraceDatabaseFind   5.0 SP1 and higher
RtlTraceDatabaseLock   5.0 SP1 and higher
RtlTraceDatabaseUnlock   5.0 SP1 and higher
RtlTraceDatabaseValidate   5.0 SP1 and higher
RtlUTF8StringToUnicodeString   2004 and higher
RtlUTF8ToUnicodeN   6.1 and higher
RtlUdiv128   1903 and higher
RtlUlongByteSwap x86 5.0 and higher
RtlUlonglongByteSwap x86 5.0 and higher
RtlUnicodeStringToAnsiSize   all
RtlUnicodeStringToAnsiString   all
RtlUnicodeStringToCountedOemString   all
RtlUnicodeStringToInt64   10.0 and higher
RtlUnicodeStringToInteger   3.51 and higher
RtlUnicodeStringToOemSize   all
RtlUnicodeStringToOemString   all
RtlUnicodeStringToUTF8String   2004 and higher
RtlUnicodeToCustomCPN   all
RtlUnicodeToMultiByteN   all
RtlUnicodeToMultiByteSize   3.51 and higher
RtlUnicodeToOemN   all
RtlUnicodeToUTF8N   6.1 and higher
RtlUnlockBootStatusData   5.1 and higher
RtlUnregisterFeatureConfigurationChangeNotification   2004 and higher
RtlUnsignedMultiplyHigh   1809 and higher
RtlUnwind   all
RtlUnwindEx x64 all
RtlUpcaseUnicodeChar   all
RtlUpcaseUnicodeString   all
RtlUpcaseUnicodeStringToAnsiString   all
RtlUpcaseUnicodeStringToCountedOemString   all
RtlUpcaseUnicodeStringToOemString   all
RtlUpcaseUnicodeToCustomCPN   all
RtlUpcaseUnicodeToMultiByteN   all
RtlUpcaseUnicodeToOemN   all
RtlUpperChar   all
RtlUpperString   all
RtlUshortByteSwap x86 5.0 and higher
RtlValidAcl   10.0 and higher
RtlValidRelativeSecurityDescriptor   5.0 and higher
RtlValidSecurityDescriptor   all
RtlValidSid   all
RtlValidateCorrelationVector   1709 and higher
RtlValidateUnicodeString   6.0 and higher
RtlVerifyVersionInfo   5.1 and higher
RtlVirtualUnwind x64 all
RtlVolumeDeviceToDosName   5.0 and higher
RtlWalkFrameChain   5.0 and higher
RtlWeaklyEnumerateEntryHashTable   6.1 and higher
RtlWriteNonVolatileMemory x64 1703 and higher
RtlWriteRegistryValue   all
RtlZeroHeap   3.51 and higher
RtlZeroMemory   all
RtlxAnsiStringToUnicodeSize   3.50 and higher
RtlxOemStringToUnicodeSize   3.50 and higher
RtlxUnicodeStringToAnsiSize   3.50 and higher
RtlxUnicodeStringToOemSize   3.50 and higher
SeAccessCheck   all
SeAccessCheckEx   6.1 and higher
SeAccessCheckFromState   6.0 and higher
SeAccessCheckFromStateEx   6.2 and higher
SeAccessCheckWithHint   6.1 and higher
SeAdjustAccessStateForAccessConstraints   1703 and higher
SeAdjustAccessStateForTrustLabel   6.3 and higher
SeAdjustObjectSecurity   1809 and higher
SeAppendPrivileges   all
SeAssignSecurity   all
SeAssignSecurityEx   5.0 and higher
SeAuditFipsCryptSelftests   1511 and higher
SeAuditHardLinkCreation   5.0 SP3 and higher
SeAuditHardLinkCreationWithTransaction   6.0 and higher
SeAuditTransactionStateChange   6.0 and higher
SeAuditingAnyFileEventsWithContext   6.1 and higher
SeAuditingAnyFileEventsWithContextEx   6.2 and higher
SeAuditingFileEvents   all
SeAuditingFileEventsWithContext   5.1 SP2 and higher
SeAuditingFileEventsWithContextEx   6.2 and higher
SeAuditingFileOrGlobalEvents   4.0 and higher
SeAuditingHardLinkEvents   5.0 SP3 and higher
SeAuditingHardLinkEventsWithContext   5.1 SP2 and higher
SeAuditingWithTokenForSubcategory   6.1 and higher
SeCaptureSecurityDescriptor   3.51 and higher
SeCaptureSubjectContext   all
SeCaptureSubjectContextEx   6.0 and higher
SeCheckForCriticalAceRemoval   1809 and higher
SeCloseObjectAuditAlarm   3.51 and higher
SeCloseObjectAuditAlarmForNonObObject   6.0 and higher
SeCodeIntegrityGetBuildExpiryTime (23)   2004 and higher
SeCompareSigningLevels   10.0 and higher
SeComputeAutoInheritByObjectType   6.0 and higher
SeConvertSecurityDescriptorToStringSecurityDescriptor   1703 and higher
SeConvertSidToStringSid   1703 and higher
SeConvertStringSecurityDescriptorToSecurityDescriptor   1703 and higher
SeConvertStringSidToSid   1703 and higher
SeCreateAccessState   3.51 and higher
SeCreateAccessStateEx   6.0 and higher
SeCreateClientSecurity   all
SeCreateClientSecurityEx   6.2 and higher
SeCreateClientSecurityFromSubjectContext   5.0 and higher
SeCreateClientSecurityFromSubjectContextEx   6.2 and higher
SeDeassignSecurity   all
SeDeleteAccessState   3.51 and higher
SeDeleteObjectAuditAlarm   4.0 and higher
SeDeleteObjectAuditAlarmWithTransaction   6.0 and higher
SeEtwWriteKMCveEvent   1607 and higher
SeExamineSacl   6.0 and higher
SeExports (data)   all
SeFilterToken   5.1 and higher
SeFreePrivileges   all
SeGetCachedSigningLevel   6.3 and higher
SeGetLinkedToken   6.0 and higher
SeGetLogonSessionToken   6.2 and higher
SeILSigningPolicyPtr (data)   1607 and higher
SeImpersonateClient   all
SeImpersonateClientEx   5.0 and higher
SeIsParentOfChildAppContainer   6.3 and higher
SeLocateProcessImageName   6.0 and higher
SeLockSubjectContext   all
SeMarkLogonSessionForTerminationNotification   3.51 SP5 and higher
SeMarkLogonSessionForTerminationNotificationEx   10.0 and higher
SeOpenObjectAuditAlarm   all
SeOpenObjectAuditAlarmForNonObObject   6.0 and higher
SeOpenObjectAuditAlarmWithTransaction   6.0 and higher
SeOpenObjectForDeleteAuditAlarm   4.0 and higher
SeOpenObjectForDeleteAuditAlarmWithTransaction   6.0 and higher
SePrivilegeCheck   3.51 and higher
SePrivilegeObjectAuditAlarm   3.51 and higher
SePublicDefaultDacl (data)   all
SeQueryAuthenticationIdToken   all
SeQueryInformationToken   5.0 and higher
SeQuerySecureBootPlatformManifest   1607 and higher
SeQuerySecureBootPolicyValue   6.2 and higher
SeQuerySecurityAttributesToken   6.1 and higher
SeQuerySecurityAttributesTokenAccessInformation   1607 and higher
SeQuerySecurityDescriptorInfo   all
SeQueryServerSiloToken   10.0 and higher
SeQuerySessionIdToken   5.0 and higher
SeQuerySessionIdTokenEx   10.0 and higher
SeRegisterImageVerificationCallback   6.3 and higher
SeRegisterLogonSessionTerminatedRoutine   3.51 SP5 and higher
SeRegisterLogonSessionTerminatedRoutineEx   10.0 and higher
SeReleaseSecurityDescriptor   3.51 and higher
SeReleaseSubjectContext   all
SeReportSecurityEvent   5.2 SP1 and higher
SeReportSecurityEventWithSubCategory   6.0 and higher
SeSecurityAttributePresent   6.2 and higher
SeSetAccessStateGenericMapping   4.0 and higher
SeSetAuditParameter   5.2 SP1 and higher
SeSetAuthorizationCallbacks   6.0 and higher
SeSetSecurityAttributesToken   6.1 and higher
SeSetSecurityAttributesTokenEx   10.0 and higher
SeSetSecurityDescriptorInfo   all
SeSetSecurityDescriptorInfoEx   5.0 and higher
SeSetSessionIdTokenWithLinked   1903 and higher
SeShouldCheckForAccessRightsFromParent   6.3 and higher
SeSinglePrivilegeCheck   all
SeSrpAccessCheck   6.1 and higher
SeSystemDefaultDacl (data)   all
SeSystemDefaultSd (data)   6.2 and higher
SeTokenFromAccessInformation   6.2 and higher
SeTokenImpersonationLevel   4.0 and higher
SeTokenIsAdmin   5.0 and higher
SeTokenIsRestricted   5.0 and higher
SeTokenIsWriteRestricted   5.1 SP2 and higher,
not 5.2,
then 6.0 and higher
SeTokenObjectType (data)   5.1 and higher
SeTokenType   all
SeUnlockSubjectContext   all
SeUnregisterImageVerificationCallback   6.3 and higher
SeUnregisterLogonSessionTerminatedRoutine   3.51 SP5 and higher
SeUnregisterLogonSessionTerminatedRoutineEx   10.0 and higher
SeValidSecurityDescriptor   3.50 and higher
SkAcquirePushLockExclusive   10.0 and higher
SkAllocatePool   10.0 and higher
SkFreePool   10.0 and higher
SkInitializePushLock   10.0 and higher
SkIsSecureKernel   10.0 and higher
SkQuerySecureKernelInformation   10.0 and higher
SkReleasePushLockExclusive   10.0 and higher
TmCancelPropagationRequest   6.0 and higher
TmCommitComplete   6.0 and higher
TmCommitEnlistment   6.0 and higher
TmCommitTransaction   6.0 and higher
TmCreateEnlistment   6.0 and higher
TmCurrentTransaction   6.0 and higher
TmDefaultTmOpenFileCount   6.0 before SP1
TmDereferenceEnlistmentKey   6.0 and higher
TmEnableCallbacks   6.0 and higher
TmEndPropagationRequest   6.0 and higher
TmEnlistmentObjectType (data)   6.0 and higher
TmFreezeTransactions   6.0 and higher
TmGetTransactionId   6.0 and higher
TmInitDefaultTemporaryTm   6.0 before SP1
TmInitSystem   6.0 and higher
TmInitSystemPhase2   6.0 and higher
TmInitializeResourceManager   6.0 to 6.1
TmInitializeTransaction   6.0 to 6.1
TmInitializeTransactionManager   6.2 and higher
TmIsKTMCommitCoordinator   6.2 and higher
TmIsTransactionActive   6.0 and higher
TmMarshallTransaction   6.0 before SP1
TmPrePrepareComplete   6.0 and higher
TmPrePrepareEnlistment   6.0 and higher
TmPrepareComplete   6.0 and higher
TmPrepareEnlistment   6.0 and higher
TmPropagationComplete   6.0 and higher
TmPropagationFailed   6.0 and higher
TmPullTransaction   6.0 before SP1
TmReadOnlyEnlistment   6.0 and higher
TmRecoverEnlistment   6.0 and higher
TmRecoverResourceManager   6.0 and higher
TmRecoverTransactionManager   6.0 and higher
TmReferenceEnlistmentKey   6.0 and higher
TmRenameTransactionManager   6.2 and higher
TmRequestOutcomeEnlistment   6.0 and higher
TmResourceManagerObjectType (data)   6.0 and higher
TmRmIsNotificationQueueEmpty_Temporary   6.0 before SP1
TmRollbackComplete   6.0 and higher
TmRollbackEnlistment   6.0 and higher
TmRollbackTransaction   6.0 and higher
TmSavepointComplete   6.0 before SP1
TmSavepointTransaction   6.0 before SP1
TmSetCurrentTransaction   6.0 and higher
TmSetPreviousModeToKernel   6.0 before SP1
TmSinglePhaseReject   6.2 and higher
TmThawTransactions   6.0 and higher
TmTransactionManagerObjectType (data)   6.0 and higher
TmTransactionObjectType (data)   6.0 and higher
TmpIsKTMCommitCoordinator   6.0 SP1 to 6.1
TtmNotifyDeviceArrival   1607 and higher
TtmNotifyDeviceDeparture   1607 and higher
TtmNotifyDeviceInput   1607 and higher
VerSetConditionMask   5.1 and higher
VfCheckNxPagePriority   10.0 and higher
VfCheckNxPageProtection   10.0 and higher
VfCheckNxPoolType   10.0 and higher
VfFailDeviceNode   5.1 and higher
VfFailDriver   5.1 and higher
VfFailSystemBIOS   5.1 and higher
VfInsertContext   6.3 and higher
VfIsRuleClassEnabled   1809 and higher
VfIsVerificationEnabled   5.1 and higher
VfQueryDeviceContext   6.3 and higher
VfQueryDispatchTable   6.3 and higher
VfQueryDriverContext   6.3 and higher
VfQueryIrpContext   6.3 and higher
VfQueryThreadContext   6.3 and higher
VfRemoveContext   6.3 and higher
VmAccessFault   10.0 to 1703
VmColdPagesHint   1703 only
VmCreateMemoryRange   10.0 to 1703
VmDeleteMemoryRange   10.0 to 1703
VmPauseResumeNotify   1607 to 1703
VslCapturePgoData (9)   1903 and higher
VslCreateSecureSection   1703 and higher
VslDeleteSecureSection   1703 and higher
VslExchangeEntropy   10.0 and higher
VslGetSecurePciDeviceAlternateFunctionNumberForVtl0Dma   1803 and higher
VslGetSecurePciEnabled   1709 and higher
VslQuerySecureDevice   1703 and higher
VslRetrieveMailbox   10.0 and higher
VslTestRoutine (5)   1709 and higher
WheaAddErrorSource   6.0 SP1 and higher
WheaAddErrorSourceDeviceDriver   1903 and higher
WheaAddErrorSourceDeviceDriverV1   2004 and higher
WheaAddHwErrorReportSectionDeviceDriver   2004 and higher
WheaAttemptClearPoison   1903 and higher
WheaAttemptPhysicalPageOffline x64 6.1 and higher
x86 1703 and higher
WheaConfigureErrorSource   6.1 and higher
WheaCreateHwErrorReportDeviceDriver   2004 and higher
WheaDeferredRecoveryService x64 6.1 and higher
WheaGetErrorSource   6.0 SP1 and higher
WheaHighIrqlLogSelEventHandlerRegister   1903 and higher
WheaHighIrqlLogSelEventHandlerUnregister   1903 and higher
WheaHwErrorReportAbandonDeviceDriver   2004 and higher
WheaHwErrorReportGetLogDataBufferDeviceDriver   2004 and higher
WheaHwErrorReportMarkAsCriticalDeviceDriver   2004 and higher
WheaHwErrorReportSetFatalSeverityDeviceDriver   2004 and higher
WheaHwErrorReportSetSectionNameDeviceDriver   2004 and higher
WheaHwErrorReportSetSeverityDeviceDriver   2004 and higher
WheaHwErrorReportSubmitDeviceDriver   2004 and higher
WheaInitializeDeferredRecoveryObject x64 6.1 and higher
WheaInitializeRecordHeader   6.1 and higher
WheaLogInternalEvent   1809 and higher
WheaRegisterErrSrcInitializer   6.0 only
WheaRegisterInUsePageOfflineNotification x64 6.2 and higher
WheaRemoveErrorSource   1903 and higher
WheaRemoveErrorSourceDeviceDriver   1903 and higher
WheaReportFatalHwErrorDeviceDriverEx   2004 and higher
WheaReportHwError   6.0 and higher
WheaReportHwErrorDeviceDriver   1903 and higher
WheaReportHwErrorDeviceDriverEx   2004 and higher
WheaRequestDeferredRecovery x64 6.1 and higher
WheaUnconfigureErrorSource   1903 and higher
WheaUnregisterInUsePageOfflineNotification x64 6.2 and higher
WmiFlushTrace   5.1 to 5.2
WmiGetClock   5.1 and higher
WmiQueryTrace   5.1 to 5.2
WmiQueryTraceInformation   5.1 and higher
WmiStartTrace   5.1 to 5.2
WmiStopTrace   5.1 to 5.2
WmiTraceFastEvent   5.2 only
WmiTraceMessage   5.1 and higher
WmiTraceMessageVa   5.1 and higher
WmiUpdateTrace   5.1 to 5.2
XIPDispatch   5.1 and higher
ZwAccessCheckAndAuditAlarm   all
ZwAddBootEntry   5.1 and higher
ZwAddDriverEntry   5.2 and higher
ZwAdjustPrivilegesToken   5.0 and higher
ZwAlertThread   3.51 and higher
ZwAllocateLocallyUniqueId   6.0 and higher
ZwAllocateReserveObject   1703 and higher
ZwAllocateVirtualMemory   all
ZwAllocateVirtualMemoryEx   1809 and higher
ZwAlpcAcceptConnectPort   6.0 and higher
ZwAlpcCancelMessage   6.0 and higher
ZwAlpcConnectPort   6.0 and higher
ZwAlpcConnectPortEx   6.2 and higher
ZwAlpcCreatePort   6.0 and higher
ZwAlpcCreatePortSection   6.0 and higher
ZwAlpcCreateResourceReserve   6.0 and higher
ZwAlpcCreateSectionView   6.0 and higher
ZwAlpcCreateSecurityContext   6.0 and higher
ZwAlpcDeletePortSection   6.0 and higher
ZwAlpcDeleteResourceReserve   6.0 and higher
ZwAlpcDeleteSectionView   6.0 and higher
ZwAlpcDeleteSecurityContext   6.0 and higher
ZwAlpcDisconnectPort   6.0 and higher
ZwAlpcOpenSenderProcess   1709 and higher
ZwAlpcOpenSenderThread   10.0 and higher
ZwAlpcQueryInformation   6.0 and higher
ZwAlpcQueryInformationMessage   10.0 and higher
ZwAlpcSendWaitReceivePort   6.0 and higher
ZwAlpcSetInformation   6.0 and higher
ZwAssignProcessToJobObject   5.1 and higher
ZwAssociateWaitCompletionPacket   6.3 and higher
ZwCancelIoFile   5.0 and higher
ZwCancelIoFileEx   6.3 and higher
ZwCancelTimer   5.0 and higher
ZwCancelWaitCompletionPacket   1703 and higher
ZwClearEvent   3.51 and higher
ZwClose   all
ZwCloseObjectAuditAlarm   all
ZwCommitComplete   6.1 and higher
ZwCommitEnlistment   6.0 and higher
ZwCommitRegistryTransaction   1607 and higher
ZwCommitTransaction   6.0 and higher
ZwCompareTokens   10.0 and higher
ZwConnectPort   3.50 and higher
ZwCreateCrossVmEvent   2004 and higher
ZwCreateDirectoryObject   all
ZwCreateEnlistment   6.0 and higher
ZwCreateEvent   3.50 and higher
ZwCreateFile   all
ZwCreateIoCompletion   6.0 and higher
ZwCreateJobObject   5.1 and higher
ZwCreateKey   all
ZwCreateKeyTransacted   6.0 and higher
ZwCreatePartition   1607 and higher
ZwCreateProcessEx   1607 and higher
ZwCreateProfileEx   1607 and higher
ZwCreateRegistryTransaction   1607 and higher
ZwCreateResourceManager   6.0 and higher
ZwCreateSection   all
ZwCreateSymbolicLinkObject   all
ZwCreateTimer   3.51,
not 4.0,
then 5.0 and higher
ZwCreateTransaction   6.0 and higher
ZwCreateTransactionManager   6.0 and higher
ZwCreateUserProcess (2)   6.2 and higher
ZwCreateWaitCompletionPacket   6.3 and higher
ZwCreateWnfStateName   6.2 and higher
ZwDeleteBootEntry   5.1 and higher
ZwDeleteDriverEntry   5.2 and higher
ZwDeleteFile   3.50 and higher
ZwDeleteKey   all
ZwDeleteValueKey   all
ZwDeleteWnfStateData   6.2 and higher
ZwDeleteWnfStateName   6.2 and higher
ZwDeviceIoControlFile   all
ZwDisplayString   all
ZwDuplicateObject   all
ZwDuplicateToken   3.51 and higher
ZwEnumerateBootEntries   5.1 and higher
ZwEnumerateDriverEntries   5.2 and higher
ZwEnumerateKey   all
ZwEnumerateTransactionObject   6.0 and higher
ZwEnumerateValueKey   all
ZwFlushBuffersFile   6.0 and higher
ZwFlushBuffersFileEx   6.2 and higher
ZwFlushInstructionCache   3.50 and higher
ZwFlushKey   all
ZwFlushVirtualMemory   5.0 and higher
ZwFreeVirtualMemory   all
ZwFsControlFile   3.50 and higher
ZwGetCachedSigningLevel   10.0 and higher
ZwGetNextProcess   10.0 and higher
ZwGetNextThread   1709 and higher
ZwGetNotificationResourceManager   6.0 and higher
ZwGetWriteWatch   2004 and higher
ZwImpersonateAnonymousToken   6.0 and higher
ZwInitiatePowerAction   5.0 and higher
ZwIsProcessInJob   5.1 and higher
ZwLoadDriver   all
ZwLoadKey   4.0 and higher
ZwLoadKeyEx   6.0 and higher
ZwLockFile   6.1 and higher
ZwLockProductActivationKeys   6.0 and higher
ZwLockVirtualMemory   6.3 and higher
ZwMakeTemporaryObject   all
ZwManagePartition   1607 and higher
ZwMapViewOfSection   all
ZwMarshallTransaction   6.0 before SP1
ZwModifyBootEntry   5.2 and higher
ZwModifyDriverEntry   5.2 and higher
ZwNotifyChangeDirectoryFile   10.0 and higher
ZwNotifyChangeDirectoryFileEx   1709 and higher
ZwNotifyChangeKey   3.51 and higher
ZwNotifyChangeSession   6.1 and higher
ZwOpenDirectoryObject   all
ZwOpenEnlistment   6.0 and higher
ZwOpenEvent   3.50 and higher
ZwOpenFile   all
ZwOpenJobObject   5.1 and higher
ZwOpenKey   all
ZwOpenKeyEx   6.1 and higher
ZwOpenKeyTransacted   6.0 and higher
ZwOpenKeyTransactedEx   6.1 and higher
ZwOpenPartition   1607 and higher
ZwOpenProcess   3.51 and higher
ZwOpenProcessToken   all
ZwOpenProcessTokenEx   5.1 and higher
ZwOpenRegistryTransaction   1607 and higher
ZwOpenResourceManager   6.0 and higher
ZwOpenSection   all
ZwOpenSession   6.1 and higher
ZwOpenSymbolicLinkObject   all
ZwOpenThread   3.51 and higher
ZwOpenThreadToken   all
ZwOpenThreadTokenEx   5.1 and higher
ZwOpenTimer   5.0 and higher
ZwOpenTransaction   6.0 and higher
ZwOpenTransactionManager   6.0 and higher
ZwPlugPlayControl (19)   2004 and higher
ZwPowerInformation   5.0 and higher
ZwPrePrepareComplete   6.1 and higher
ZwPrePrepareEnlistment   6.0 and higher
ZwPrepareComplete   6.0 and higher
ZwPrepareEnlistment   6.0 and higher
ZwPropagationComplete   6.1 and higher
ZwPropagationFailed   6.1 and higher
ZwProtectVirtualMemory   6.3 and higher
ZwPullTransaction   6.0 before SP1
ZwPulseEvent   3.51 and higher
ZwQueryBootEntryOrder   5.1 and higher
ZwQueryBootOptions   5.1 and higher
ZwQueryDefaultLocale   4.0 and higher
ZwQueryDefaultUILanguage   5.0 and higher
ZwQueryDirectoryFile   3.50 and higher
ZwQueryDirectoryFileEx   1709 and higher
ZwQueryDirectoryObject   5.0 and higher
ZwQueryDriverEntryOrder   5.2 and higher
ZwQueryEaFile   5.0 and higher
ZwQueryFullAttributesFile   5.1 and higher
ZwQueryInformationByName   1703 and higher
ZwQueryInformationEnlistment   6.0 and higher
ZwQueryInformationFile   all
ZwQueryInformationJobObject   5.1 and higher
ZwQueryInformationProcess   3.51 and higher
ZwQueryInformationResourceManager   6.0 and higher
ZwQueryInformationThread   5.1 and higher
ZwQueryInformationToken   all
ZwQueryInformationTransaction   6.0 and higher
ZwQueryInformationTransactionManager   6.0 and higher
ZwQueryInstallUILanguage   5.0 and higher
ZwQueryIntervalProfile   1607 and higher
ZwQueryKey   all
ZwQueryLicenseValue   6.0 and higher
ZwQueryObject   4.0 and higher
ZwQueryQuotaInformationFile   6.1 and higher
ZwQuerySection   3.50 and higher
ZwQuerySecurityAttributesToken   6.1 and higher
ZwQuerySecurityObject   3.51 and higher
ZwQuerySymbolicLinkObject   all
ZwQuerySystemEnvironmentValueEx   6.2 and higher
ZwQuerySystemInformation   4.0 and higher
ZwQuerySystemInformationEx   6.3 and higher
ZwQueryTimerResolution   1607 and higher
ZwQueryValueKey   all
ZwQueryVirtualMemory   6.0 and higher
ZwQueryVolumeInformationFile   all
ZwQueryWnfStateData   6.2 and higher
ZwQueryWnfStateNameInformation   6.2 and higher
ZwReadFile   all
ZwReadOnlyEnlistment   6.1 and higher
ZwRecoverEnlistment   6.0 and higher
ZwRecoverResourceManager   6.0 and higher
ZwRecoverTransactionManager   6.0 and higher
ZwRemoveIoCompletion   6.0 and higher
ZwRemoveIoCompletionEx   6.0 and higher
ZwRenameKey   6.1 SP1 and higher
ZwReplaceKey   4.0 and higher
ZwRequestPort   6.0 and higher
ZwRequestWaitReplyPort   3.50 and higher
ZwResetEvent   3.51 and higher
ZwResetWriteWatch   2004 and higher
ZwRestoreKey   5.0 and higher
ZwRollbackComplete   6.1 and higher
ZwRollbackEnlistment   6.0 and higher
ZwRollbackRegistryTransaction   1607 and higher
ZwRollbackTransaction   6.0 and higher
ZwSaveKey   4.0 and higher
ZwSaveKeyEx   5.1 and higher
ZwSavepointComplete   6.0 before SP1
ZwSavepointTransaction   6.0 before SP1
ZwSecureConnectPort   5.2 SP1 and higher
ZwSetBootEntryOrder   5.1 and higher
ZwSetBootOptions   5.1 and higher
ZwSetCachedSigningLevel   6.2 and higher
ZwSetDefaultLocale   3.51 and higher
ZwSetDefaultUILanguage   5.0 and higher
ZwSetDriverEntryOrder   5.2 and higher
ZwSetEaFile   5.0 and higher
ZwSetEvent   3.50 and higher
ZwSetInformationEnlistment   6.0 and higher
ZwSetInformationFile   3.50 and higher
ZwSetInformationJobObject   5.1 and higher
ZwSetInformationKey   6.2 and higher
ZwSetInformationObject   4.0 and higher
ZwSetInformationProcess   all
ZwSetInformationResourceManager   6.1 and higher
ZwSetInformationThread   3.50 and higher
ZwSetInformationToken   6.1 and higher
ZwSetInformationTransaction   6.0 and higher
ZwSetInformationVirtualMemory   6.2 and higher
ZwSetIntervalProfile   1607 and higher
ZwSetIoCompletion   1703 and higher
ZwSetIoCompletionEx   1703 and higher
ZwSetQuotaInformationFile   6.1 and higher
ZwSetSecurityObject   5.0 and higher
ZwSetSystemEnvironmentValueEx   6.2 and higher
ZwSetSystemInformation   3.51 and higher
ZwSetSystemTime   4.0 and higher
ZwSetTimer   3.51,
not 4.0,
then 5.0 and higher
ZwSetTimerEx   6.1 and higher
ZwSetTimerResolution   1607 and higher
ZwSetValueKey   all
ZwSetVolumeInformationFile   5.0 and higher
ZwStartProfile   1607 and higher
ZwStopProfile   1607 and higher
ZwSystemDebugControl   1903 and higher
ZwTerminateJobObject   5.1 and higher
ZwTerminateProcess   4.0 and higher
ZwTraceControl   10.0 and higher
ZwTraceEvent   6.1 and higher
ZwTranslateFilePath   5.1 and higher
ZwUnloadDriver   4.0 and higher
ZwUnloadKey   4.0 and higher
ZwUnloadKey2   1511 and higher
ZwUnloadKeyEx   6.0 and higher
ZwUnlockFile   6.1 and higher
ZwUnlockVirtualMemory   6.2 and higher
ZwUnmapViewOfSection   all
ZwUpdateWnfStateData   6.2 and higher
ZwWaitForMultipleObjects   3.51 and higher
ZwWaitForSingleObject   3.50 and higher
ZwWriteFile   all
ZwYieldExecution   4.0 and higher
__C_specific_handler x64 all
__chkstk x64 all
__misaligned_access x64 all
_CIcos x86 5.1 and higher
_CIsin x86 5.1 and higher
_CIsqrt x86 5.1 and higher
_abnormal_termination x86 3.50 and higher
_alldiv x86 4.0 and higher
_alldvrm x86 5.1 and higher
_allmul x86 4.0 and higher
_alloca_probe x86 5.1 and higher
_alloca_probe_16 x86 6.0 and higher
_alloca_probe_8 x86 6.0 and higher
_allrem x86 4.0 and higher
_allshl x86 4.0 and higher
_allshr x86 4.0 and higher
_aulldiv x86 4.0 and higher
_aulldvrm x86 5.1 and higher
_aullrem x86 4.0 and higher
_aullshr x86 4.0 and higher
_chkstk x86 6.0 and higher
_except_handler2 x86 all
_except_handler3 x86 5.0 and higher
_global_unwind2 x86 3.50 and higher
_finite   10.0 and higher
_i64toa_s   6.1 and higher
_i64tow_s   6.1 and higher
_itoa   all
_itoa_s   6.1 and higher
_itow   5.0 and higher
_itow_s   6.1 and higher
_local_unwind x64 all
_local_unwind2 x86 all
_ltoa_s   6.1 and higher
_ltow_s   6.1 and higher
_makepath_s   6.1 and higher
_purecall   3.50 and higher
_setjmp x64 all
_setjmpex x64 all
_snprintf   3.50 and higher
_snprintf_s   6.1 and higher
_snscanf_s   6.1 and higher
_snwprintf   3.50 and higher
_snwprintf_s   6.1 and higher
_snwscanf_s   6.1 and higher
_splitpath_s   6.1 and higher
_stricmp   all
_strlwr   3.50 and higher
_strnicmp   all
_strnset   4.0 and higher
_strnset_s   6.1 and higher
_strrev   4.0 and higher
_strset   4.0 and higher
_strset_s   6.1 and higher
_strtoui64   6.0 and higher
_strupr   3.50 and higher
_swprintf   6.0 and higher
_ui64toa_s   6.1 and higher
_ui64tow_s   6.1 and higher
_ultoa_s   6.1 and higher
_ultow_s   6.1 and higher
_vsnprintf   all
_vsnprintf_s   6.1 and higher
_vsnwprintf   5.1 and higher
_vsnwprintf_s   6.1 and higher
_vswprintf   6.0 and higher
_wcsicmp   3.50 and higher
_wcslwr   4.0 and higher
_wcslwr_s   10.0 and higher
_wcsnicmp   all
_wcsnset   4.0 and higher
_wcsnset_s   6.1 and higher
_wcsrev   4.0 and higher
_wcsset_s   6.1 and higher
_wcsupr   4.0 and higher
_wmakepath_s   6.1 and higher
_wsplitpath_s   6.1 and higher
_wtoi   6.1 and higher
_wtol   6.1 and higher
atoi   3.50 and higher
atol   3.50 and higher
bsearch   6.0 and higher
bsearch_s   6.2 and higher
isdigit   3.50 and higher
islower   3.50 and higher
isprint   3.50 and higher
isspace   3.50 and higher
isupper   3.50 and higher
iswalnum   10.0 and higher
iswdigit   10.0 and higher
iswspace   10.0 and higher
isxdigit   3.50 and higher
longjmp x64 all
mbstowcs   3.50 and higher
mbtowc   4.0 and higher
memchr   3.50 and higher
memcmp x64 all
x86 6.2 and higher
memcpy   3.50 and higher
memcpy_s   6.1 and higher
memmove   3.50 and higher
memmove_s   6.1 and higher
memset   3.50 and higher
psMUITest (data)   6.0 and higher
qsort   3.50 and higher
qsort_s   1803 and higher
rand   3.50 and higher
sprintf   all
sprintf_s   6.1 and higher
sqrt x64 10.0 and higher
sqrtf x64 10.0 and higher
srand   3.50 and higher
sscanf_s   6.1 and higher
strcat   4.0 and higher
strcat_s   6.1 and higher
strchr   3.50 and higher
strcmp   4.0 and higher
strcpy   4.0 and higher
strcpy_s   6.1 and higher
strlen   4.0 and higher
strncat   4.0 and higher
strncat_s   6.1 and higher
strncmp   3.50 and higher
strncpy   all
strncpy_s   6.1 and higher
strnlen   6.1 and higher
strrchr   3.50 and higher
strspn   4.0 and higher
strstr   all
strtok_s   6.1 and higher
swprintf   3.50 and higher
swprintf_s   6.1 and higher
swscanf_s   6.1 and higher
tolower   3.50 and higher
toupper   3.50 and higher
towlower   4.0 and higher
towupper   4.0 and higher
vDbgPrintEx   5.1 and higher
vDbgPrintExWithPrefix   5.1 and higher
vsprintf   3.50 and higher
vsprintf_s   6.1 and higher
vswprintf_s   6.1 and higher
wcscat   3.50 and higher
wcscat_s   6.1 and higher
wcschr   all
wcscmp   3.50 and higher
wcscpy   all
wcscpy_s   6.1 and higher
wcscspn   all
wcslen   all
wcsncat   4.0 and higher
wcsncat_s   6.1 and higher
wcsncmp   3.50 and higher
wcsncpy   3.50 and higher
wcsncpy_s   6.1 and higher
wcsnlen   6.1 and higher
wcsrchr   3.50 and higher
wcsspn   4.0 and higher
wcsstr   all
wcstombs   4.0 and higher
wcstoul   6.1 and higher
wctomb   4.0 and higher
x86BiosAllocateBuffer x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
x86BiosCall x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
x86BiosFreeBuffer x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
x86BiosReadMemory x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
x86BiosWriteMemory x64 2004 and higher;
also from HAL in 6.0 and higher
x86 see HAL in 6.0 and higher
unknown name (27)   2004 and higher


Names are reproduced from the export directory of the NTOSKRNL.EXE executable. All exports from the kernel are by name until version 6.2 introduces two that are exported only by ordinal. Names for ordinal-only exports are inferred from symbol files that Microsoft supplies for customer support. The ordinal is given in parentheses immediately after the function’s name.

A few exports are of variables rather than functions. They are marked above by the word “data” in parentheses. These notes talk of all as functions, hoping no confusion will be caused by the loose terminology.

Since experience shows that this table is not always read with the knowledge of an advanced programmer, it must be stressed that a function’s presence in the export directory does not mean that the function is implemented non-trivially, let alone that it will work satisfactorily if called. It means just that the function can be imported by other modules, and be called by them, for better or worse. That a function is first exported in some version does not mean that Microsoft supports its use in that version, even if such support is documented for later versions.


The kernel versions shown for each function are inferred from a study of public releases such as I have managed to find on old MSDN discs or downloaded from Microsoft’s websites, whether free or requiring what is nowadays called a Visual Studio subscription. My holdings are incomplete, especially for service packs of the earliest versions, and I anyway have no time for (or interest in) examining pre-release builds or hotfixes. Of necessity then, the table makes what I hope are reasonable assumptions about likely continuity, especially to suppose that a function will exist in future versions or that a function exists in all builds of a version if no counter-example is yet known. If you want more accurate or comprehensive information, try getting it from Microsoft.

Documentation Status

The foundation for all comment on Microsoft’s documentation of exported kernel functions is what looks to be Microsoft’s last packaging of WDK documentation to download for offline reference through Visual Studio under the heading “Windows Driver Kit (WDK)”. As this documentation says: “Windows Driver Kit (WDK) 10 is integrated with Microsoft Visual Studio 2015”. The large file, named v2Windows_Development_Windows_Driver_Development_B974_VS_85_en-us_3.mshc, from which this content is drawn appears to be as close as Microsoft now comes to publishing WDK documentation as a self-standing, explicitly dated collection. The file’s last modification date is 6th August 2015, which to my mind means it can reasonably be taken as Microsoft’s definitive offering of documentation for Windows 10 as first released on 29th July 2015.

What I know of any later WDK documentation is whatever I happen to have found at Microsoft’s website in occasional visits for which I can’t summon much commitment. Perhaps there is a better way, perhaps there are still packages to download for integration into Visual Studio, but I never have welcomed downloading the WDK and then having to go hunting for the related documentation. I may easily be wrong, but I don’t think it’s mere neglect that Microsoft’s documentation of Windows has for many years now—roughly coincidental with the expiry of constraints from its settlement of an anti-trust suit—become ever more problematic as a historical record both for accuracy and accessibility. To be clear, I can’t escape the thought that Microsoft wants it this way. An unstated lesson for Microsoft from that suit is that an openly available historical record can be inconvenient. Though history cannot be controlled, it would better be handled. A few paragraphs on this survey’s own history may help with this perspective.

When this page was first prepared in early 2009 it was developed from similar surveys of exports from user-mode modules, starting in 2004 with a survey of the Windows Shell. At least part of that survey’s motivation was to assess Microsoft’s compliance with the settlement’s provisions for documenting Windows API functions that were used by what the anti-trust suit termed Microsoft middleware (most notably including Internet Explorer). A natural reference for documentation at the time was the CD edition of the MSDN Library dated January 2004. By the time I started revising for Windows Vista, dated collections of the MSDN Library had ceased but the Windows Vista SDK was conveniently dated January 2007 and seemed natural as a new reference for user-mode documentation.

When my attention shifted to this website’s lack of kernel-mode material in 2009, the release of Windows 7 was imminent. I soon settled on its WDK as the chosen reference for all comment on Microsoft’s kernel-mode documentation and programming support. In this first public release of the WDK for Windows 7, numbered 7600.16385.0, most documentation is dated to 18th June 2009 and header files to 13th July 2009. Before the year was out, a revision named 7600.16385.1 added functions that had been new for Windows 7 but had somehow been overlooked for the first documentation. That much is welcome, of course. What troubles the historical record is that this revision cemented what had been a growing and apparently systematic misrepresentation by Microsoft of the early history: many ancient functions, including many that are fundamental to kernel-mode programming, have forever since been labelled by Microsoft as requiring “Windows 2000 and later”.

The 7600.16385.1 revision then turned out to be the last WDK that includes documentation. Up to then, the DDK or WDK had come with documentation. Starting with the WDK for Windows 8, documentation is not built in. Whatever may be the relative value to programmers of possibly stale documentation read in private versus possibly new documentation viewed online, and whatever may be the value to Microsoft of learning what documentation programmers actually do look at, the trouble for history is that Microsoft’s documentation of the Windows kernel is no longer published definitively and dated definitively.

That a function is marked above as documented does not mean that it has always been documented, only that it is documented in the reference edition, i.e., the downloadable collection of WDK documentation for Windows 10, or that I have noticed later documentation of it online.


Choosing a reference edition is not ideal for all purposes. Windows versions that get released afterwards will inevitably add functions, which then will typically not be listed above as documented until a new reference edition is adopted. I may adjust for observations that I happen to come across, but please understand that I do not intend to poll Microsoft’s websites to keep the documentation status up to date. I may not even be able to sustain a programme of regularly updating this list to match new choices of reference edition even years apart. If you want more frequent updating, then please remember that this bookkeeping is done at my own expense in the public interest: look instead for an alternative that is done commercially or by academics who draw a salary.


There is also potentially a loss of history because any chosen reference edition can be too recent. Of interest perhaps only to historians is that even documented functions are sometimes discontinued, meaning specifically that later versions do not export them. Of potentially much wider interest is that new functions are often not documented immediately by Microsoft and sometimes not for several years. For instance, many functions that were added to the kernel for Windows Vista were not documented until the WDK for Windows 8. That they were then said to be “available starting with Windows Vista” is welcome for being correct but hides six or so years in which they were not formally available (to everyone).

I tend to think that delayed documentation imposes significant costs on and barriers to third-party software development. Perhaps even worse, it risks tying third-party developers (and supposedly independent analysts and commentators) to Microsoft for the favour of getting documentation that is not yet available to all. But nobody can sensibly consider any of this without a careful account of the documentation history. For as much precision as I happen yet to know about the history of a function’s documentation, look for the function in the section on History. Please be aware that this is a work in progress. For thousands of functions, each to be looked for in dozens of documentation samples, there are bound to be some mistakes in my descriptions, and my account of the history is anyway deficient for not having found an Installable File System (IFS) Kit for any release of Windows XP or Windows Server 2003.

The IFS Kit is especially notable in this context of delayed documentation. Of the kernel functions that Microsoft does document, a significant proportion (not quite a third) are documented in the WDK only by the relatively recent inclusion of the IFS Kit which was for many years not nearly as readily available as was the ordinary Device Driver Kit (DDK). According to stories that can still be found on the Internet, Microsoft’s practice if only in the early years of Windows was that the IFS Kit was not just very expensive, relative for instance to an MSDN subscription, but also was sold only under some sort of Non-Disclosure Agreement. If the latter is true, then functions that were documented only in the IFS Kit were undocumented in effect, at least in the early years. In any case, even the IFS Kit didn’t have formal documentation before Windows 2000.


For some functions, the whole of Microsoft’s documentation is that the function is reserved for use by the system. Undocumented functions are occasionally promoted to reserved. Only very rarely is a reserved function later documented with any substance. That a function is marked above as reserved means that the only known mention of it in the current reference edition of Microsoft’s documentation is to say some such thing as that the function is reserved for the system or is not to be used in drivers. The function may have its own page, and even be given with a prototype and other details, or it may just appear in a list of names.

Other functions are said to be obsolete. These often are given with prototypes and sometimes with substantial documentation, presumably from before the function became obsolete. A few were already obsolete as early as the Windows NT 3.51 DDK and a few others seem to have gone directly from undocumented to obsolete. That a function is marked above as obsolete means that its page of documentation in the current reference edition is anything from slight to substantial but includes a remark that the function is obsolete.

Even for the functions that Microsoft does document non-trivially, Microsoft provides no master list. Documentation is scattered through the WDK. I see no easy way to automate a search and I have not typed the name of every function into the (surprisingly primitive) search pane of the Document Explorer or Microsoft Help Viewer or whatever. I have marked a function as documented—well, left it unmarked—if I have seen in the Contents pane that the function has its own page anywhere under numerous applicable headings. That a function is instead marked as undocumented does not mean for certain that Microsoft does not document it, just that I haven’t yet found where (including because I haven’t cared enough to look harder).

Some exports, especially of variables, are documented indirectly in the sense that a WDK header file defines a macro for access to the variable and the macro is documented. I do not count this above as documenting the export.

A handful of functions have user-mode equivalents, with the same prototypes, which are documented in the Software Development Kit (SDK). The user-mode documentation of such functions appears to be good for kernel-mode. This counts above as documenting the export unless some inference is detected that the user-mode documentation is intended as not applying to kernel mode.

While on the matter of equivalent user-mode documentation, special mention must be made of NTDLL. Many kernel-mode functions whose names start with Nt, Rtl or Zw also exist as user-mode functions exported from NTDLL. The WDK seems intended not just for kernel-mode programming but also for user-mode programming of the low-level sort that deals directly with NTDLL rather than with the base modules of the Win32 subsystem, e.g., with KERNEL32. Unfortunately, the WDK documentation and header files rarely state explicitly whether what is said of a function is meant just for the kernel or also for NTDLL or just for NTDLL. I have not yet worked out how to record this in the lists.

Finally, the kernel implements a selection of functions from the C Run-Time (CRT) Library. Some are not documented even for the CRT because in practice all calls to them are generated by the compiler, but most are the sort of utility functions that no low-level C or C++ programmer would want to be without. They could be supported through a kernel-mode DLL, but since the kernel uses them anyway, the implementations in the kernel are as well to be exported. The CRT documentation is good for these, even though they are not formally documented as being exported from the kernel.

As a quick summary, just over half of all kernel exports are documented, including just to say that the function is obsolete or reserved. The flip side is that roughly 30% of exports from the Windows kernel are completely undocumented, without even a declaration in a WDK header file.