NTDLL Exports

The very large table on this page lists all the functions and variables—there are well over two and a half thousand—that appear in the export directory of any known i386 (x86), amd64 (x64) or wow64 build of NTDLL.DLL from Windows NT up to and including the original Windows 10.

Many have been or still are exported from NTDLL for other processor architectures, but x86 and x64 account for very nearly all Windows computers whose users actually do think of and use their computers as computers, in contrast to phones, devices and things. So, only x86 and x64 (and wow64, being x86 adapted specially for x64) matter to this study.

The NTDLL.DLL from the Windows that runs on DOS is here considered to be a separate executable (not presently catalogued).


This page is intended as a master list. For each NTDLL export, the table gives just a brief summary of the applicable NTDLL versions and a colour-coded summary of status with respect to Microsoft’s documentation (at roughly the release of the original Windows 10).

For details of an export’s availability and documentation history, look for the export in other lists, according to its first version as shown here. In the Table of Contents, expand NTDLL’s entry for Versions to get pages for each version.

Some—presently very few—functions link directly from this master list (and from the version lists) to an attempt at independent documentation.


Documentation status is summarised by colour coding. (Had the website’s scripts run as expected, then hovering over any colour-coded text would produce a tooltip that shows why the text is coloured.) (To decode a colour, hover for a tooltip.)

Functions that have their own non-trivial documentation are shown with no background colour, since this documentation status would be completely unremarkable, if only in an idealised world of open design.

As an obvious contrast used throughout this website, functions that look to be completely undocumented are highlighted yellow. That most rows of the table then start with yellow may benefit from advance understanding of NTDLL as the kernel’s exposure to user-mode subsystems (of which Win32 is just one of potentially many). In each subsystem, higher-level code interacts with the lower levels of the subsystem, not with NTDLL. For instance, most Win32 programs and DLLs import Win32 API functions from KERNEL32.DLL (and others), not from NTDLL. The vast majority of NTDLL exports are treated as the subsystems’ private system calls to kernel mode or as common support for all subsystems to re-present each in their own way to their higher-level components. Either way, the plain intention is that the NTDLL exports themselves are not for wide use. In the real world of closed-source design, the undocumented status of most NTDLL exports is only to be expected, even as unremarkable.

That said, one of the practicalities in the design is that each NTDLL export that is in some sense a system call typically has the same name as the kernel-mode implementation that it accesses and NTDLL exports that are fully implemented in user mode often have parallel implementations in kernel mode, again with the same names. Thus may an NTDLL export correspond closely to a kernel-mode function among the Windows Kernel Exports. If this kernel-mode export is documented in a Windows Driver Kit (WDK) for kernel-mode use, then the otherwise undocumented NTDLL export is shaded green as my suggestion that it is documented in effect. The vast majority of NTDLL exports that are documented at all are documented this way.

Functions that are explicitly documented as reserved or obsolete—no matter how or where—are shaded red or shaded grey, respectively, as quick indications that they are better avoided.

Many undocumented functions do at least have C-language declarations in one or another header file from the Software Development Kit (SDK) or, for reasons sketched above, the WDK. These exports are shaded orange. They are not formally documented, nor formally reserved, but neither are they completely undocumented: indeed, history shows they’re often on the way to getting documented. Some undocumented functions aren’t declared in any header now but had declarations disclosed by Microsoft in a “minwin” subdirectory of early editions of the WDK for Windows 10 which Microsoft seems since to have been withdrawn from distribution. These are highlighted orange to indicate that public disclosure even of the declaration was exceptional.

Processor Architectures

NTDLL exists in both 32-bit and 64-bit Windows. The latter provides both a 64-bit (x64) NTDLL in the System32 directory and a 32-bit (wow64) NTDLL in the SysWOW64 directory. The 32-bit NTDLL in 64-bit Windows differs from the 32-bit (x86) NTDLL in 32-bit Windows, but not by much, such that wow64 is here treated as an exceptional case of x86 specialised for x64 execution. Where x86 is not contrasted with wow64, it stands for both x86 and wow64.


That a function or variable is exported in all versions of the applicable architecture is often some sign of its being fundamental, which seems deserving of an easy indication. The shorthand “all” means “3.10 and higher” for the x86 and “5.2 SP1 and higher” for x64 and wow64. When clearly limited just to x64 or wow64, version 5.2 is treated as beginning with SP1.

Substantial explanatory notes, especially about the different sources and degrees of documentation, follow the table.

Master Table

As noted in the first paragraph, there are thousands of exports. To have them all on one page seems desirable even at the price of a large download. Having them all in one huge table is not without benefit either, both for reading and preparation, but laying out so large a table can sometimes take a browser most of a second even on a fast computer—and if you anyway want just one or a few functions, scrolling through thousands is not a neglible chore.

The buttons that show immediately below are an experiment at deferring the presentation until you want it and at letting you select how much of it to see at any one time. You can show all the thousands of exports as one table or you can have it separated into categories which you can show and hide individually.

If scripts run as expected, there are buttons here to control the table’s presentation.

Function Architecture Versions
?Allocate@CBufferAllocator@@UAEPAXK@Z   4.0 only
A_SHAFinal   6.0 and higher
A_SHAInit   6.0 and higher
A_SHAUpdate   6.0 and higher
AitFireParentUsageEvent (2)   6.1 to 6.3
AitLogFeatureUsageByApp (1)   6.1 to 6.3
AlpcAdjustCompletionListConcurrencyCount   6.0 and higher
AlpcFreeCompletionListMessage   6.0 and higher
AlpcGetCompletionListLastMessageInformation   6.0 and higher
AlpcGetCompletionListMessageAttributes   6.0 and higher
AlpcGetHeaderSize   6.0 and higher
AlpcGetMessageAttribute   6.0 and higher
AlpcGetMessageFromCompletionList   6.0 and higher
AlpcGetOutstandingCompletionListMessageCount   6.0 and higher
AlpcInitializeMessageAttribute   6.0 and higher
AlpcMaxAllowedMessageLength   6.0 and higher
AlpcRegisterCompletionList   6.0 and higher
AlpcRegisterCompletionListWorkerThread   6.0 and higher
AlpcRundownCompletionList   6.1 and higher
AlpcUnregisterCompletionList   6.0 and higher
AlpcUnregisterCompletionListWorkerThread   6.0 and higher
ApiSetQueryApiSetPresence   6.2 and higher
CsrAllocateCaptureBuffer   all
CsrAllocateCapturePointer   3.10 to 4.0
CsrAllocateMessagePointer   all
CsrCaptureMessageBuffer   all
CsrCaptureMessageMultiUnicodeStringsInPlace   5.1 and higher
CsrCaptureMessageString   all
CsrCaptureTimeout   all
CsrClientCallServer   all
CsrClientConnectToServer   all
CsrClientMaxMessage   3.10 to 3.51
CsrClientSendMessage   3.10 to 3.51
CsrClientThreadConnect   3.10 to 3.51
CsrDumpProfile   3.10 only
CsrFreeCaptureBuffer   all
CsrGetProcessId   5.1 and higher
CsrIdentifyAlertableThread   all
CsrNewThread   3.10 to 6.0 before SP1
CsrProbeForRead   3.10 to 5.2
CsrProbeForWrite   3.10 to 5.2
CsrSetPriorityClass   all
CsrStartProfile   3.10 only
CsrStopDumpProfile   3.10 only
CsrStopProfile   3.10 only
CsrVerifyRegion   6.0 and higher
CsrpProcessCallbackRequest   3.10 to 3.51
DbgBreakPoint   all
DbgPrint   all
DbgPrintEx   5.1 and higher
DbgPrintReturnControlC   5.0 and higher
DbgPrompt   all
DbgQueryDebugFilterState   5.1 and higher
DbgSetDebugFilterState   5.1 and higher
DbgSsHandleKmApiMsg   3.10 to 5.0
DbgSsInitialize   3.10 to 5.0
DbgUiConnectToDbg   all
DbgUiContinue   all
DbgUiConvertStateChangeStructure   5.1 and higher
DbgUiConvertStateChangeStructureEx   10.0 and higher
DbgUiDebugActiveProcess   5.1 and higher
DbgUiGetThreadDebugObject   5.1 and higher
DbgUiIssueRemoteBreakin   5.1 and higher
DbgUiRemoteBreakin   5.1 and higher
DbgUiSetThreadDebugObject   5.1 and higher
DbgUiStopDebugging   5.1 and higher
DbgUiWaitStateChange   all
DbgUserBreakPoint   all
EtwControlTraceA   5.2 only
EtwControlTraceW   5.2 only
EtwCreateTraceInstanceId   5.2 and higher
EtwDeliverDataBlock   6.0 and higher
EtwEnableTrace   5.2 only
EtwEnumerateProcessRegGuids   6.0 and higher
EtwEnumerateTraceGuids   5.2 only
EtwEventActivityIdControl   6.0 and higher
EtwEventEnabled   6.0 and higher
EtwEventProviderEnabled   6.0 and higher
EtwEventRegister   6.0 and higher
EtwEventSetInformation   6.2 and higher
EtwEventUnregister   6.0 and higher
EtwEventWrite   6.0 and higher
EtwEventWriteEndScenario   6.0 and higher
EtwEventWriteEx   6.1 and higher
EtwEventWriteFull   6.0 and higher
EtwEventWriteNoRegistration   6.1 and higher
EtwEventWriteStartScenario   6.0 and higher
EtwEventWriteString   6.0 and higher
EtwEventWriteTransfer   6.0 and higher
EtwFlushTraceA   5.2 only
EtwFlushTraceW   5.2 only
EtwGetTraceEnableFlags   5.2 and higher
EtwGetTraceEnableLevel   5.2 and higher
EtwGetTraceLoggerHandle   5.2 and higher
EtwLogTraceEvent   6.0 and higher
EtwNotificationRegister   6.0 and higher
EtwNotificationRegistrationA   5.2 only
EtwNotificationRegistrationW   5.2 only
EtwNotificationUnregister   6.0 and higher
EtwProcessPrivateLoggerRequest   6.0 and higher
EtwQueryAllTracesA   5.2 only
EtwQueryAllTracesW   5.2 only
EtwQueryTraceA   5.2 only
EtwQueryTraceW   5.2 only
EtwReceiveNotificationsA   5.2 only
EtwReceiveNotificationsW   5.2 only
EtwRegisterSecurityProvider   6.0 and higher
EtwRegisterTraceGuidsA   5.2 and higher
EtwRegisterTraceGuidsW   5.2 and higher
EtwReplyNotification   6.0 and higher
EtwSendNotification   6.0 and higher
EtwSetMark   6.0 and higher
EtwStartTraceA   5.2 only
EtwStartTraceW   5.2 only
EtwStopTraceA   5.2 only
EtwStopTraceW   5.2 only
EtwTraceEvent   5.2 only
EtwTraceEventInstance   5.2 and higher
EtwTraceMessage   5.2 and higher
EtwTraceMessageVa   5.2 and higher
EtwUnregisterTraceGuids   5.2 and higher
EtwUpdateTraceA   5.2 only
EtwUpdateTraceW   5.2 only
EtwWriteUMSecurityEvent   6.0 and higher
EtwpCreateEtwThread   6.0 and higher
EtwpGetCpuSpeed   6.0 and higher
EtwpGetTraceBuffer   5.2 only
EtwpNotificationThread   6.0 to 6.2
EtwpSetHWConfigFunction   5.2 only
EvtIntReportAuthzEventAndSourceAsync   6.1 and higher
EvtIntReportEventAndSourceAsync   6.1 and higher
ExpInterlockedPopEntrySListEnd   5.2 SP1 and higher
ExpInterlockedPopEntrySListEnd8 x64 6.0 SP2 only
ExpInterlockedPopEntrySListEnd16 x64 6.1 to 6.2
ExpInterlockedPopEntrySListFault   5.2 SP1 and higher
ExpInterlockedPopEntrySListFault8 x64 6.0 SP2 only
ExpInterlockedPopEntrySListFault16 x64 6.1 to 6.2
ExpInterlockedPopEntrySListResume   5.2 SP1 and higher
ExpInterlockedPopEntrySListResume8 x64 6.0 SP2 only
ExpInterlockedPopEntrySListResume16 x64 6.1 to 6.2
KiFastSystemCall x86 5.1 SP2 and higher;
5.2 SP1 and higher;
6.0 and higher
KiFastSystemCallRet x86 5.1 SP2 and higher;
5.2 SP1 and higher;
6.0 and higher
KiIntSystemCall x86 5.1 SP2 and higher;
5.2 SP1 and higher;
6.0 and higher
KiRaiseUserExceptionDispatcher   4.0 and higher
KiUserApcDispatcher   all
KiUserCallbackDispatcher   3.51 and higher
KiUserExceptionDispatcher   all
KiUserInvertedFunctionTable x64 6.3 and higher
LdrAccessOutOfProcessResource   5.1 to 5.2
LdrAccessResource   all
LdrAddDllDirectory   6.2 and higher
LdrAddLoadAsDataTable   6.0 and higher
LdrAddRefDll   5.1 and higher
LdrAlternateResourcesEnabled   5.0 to 5.2
LdrAppxHandleIntegrityFailure   6.2 and higher
LdrCreateOutOfProcessImage   5.1 to 5.2
LdrDestroyOutOfProcessImage   5.1 to 5.2
LdrDisableThreadCalloutsForDll   3.50 and higher
LdrEnumResources   3.51 and higher
LdrEnumerateLoadedModules   5.1 SP1 and higher
LdrFastFailInLoaderCallout   10.0 and higher
LdrFindCreateProcessManifest   5.1 to 5.2
LdrFindEntryForAddress   all
LdrFindResourceDirectory_U   all
LdrFindResourceEx_U   5.1 and higher
LdrFindResource_U   all
LdrFlushAlternateResourceModules   5.0 and higher
LdrGetDllDirectory   6.2 and higher
LdrGetDllFullName   6.2 and higher
LdrGetDllHandle   all
LdrGetDllHandleByMapping   6.1 and higher
LdrGetDllHandleByName   6.1 and higher
LdrGetDllHandleEx   5.1 and higher
LdrGetDllPath   6.2 and higher
LdrGetFailureData   6.0 and higher
LdrGetFileNameFromLoadAsDataTable   6.0 and higher
LdrGetKnownDllSectionHandle x64 all
LdrGetProcedureAddress   all
LdrGetProcedureAddressEx   6.0 and higher
LdrGetProcedureAddressForCaller   6.2 and higher
LdrHotPatchRoutine   5.1 SP2 to 6.2
LdrInitShimEngineDynamic   5.1 and higher
LdrInitializeThunk   all
LdrLoadAlternateResourceModule   5.0 and higher
LdrLoadAlternateResourceModuleEx   6.0 and higher
LdrLoadDll   all
LdrLockLoaderLock   5.1 and higher
LdrOpenImageFileOptionsKey   5.2 SP1 and higher
LdrProcessInitializationComplete x64 all
LdrProcessRelocationBlock   all
LdrProcessRelocationBlockEx   6.2 and higher
LdrQueryImageFileExecutionOptions   all
LdrQueryImageFileExecutionOptionsEx   5.2 and higher
LdrQueryImageFileKeyOption   5.2 SP1 and higher
LdrQueryModuleServiceTags   6.0 and higher
LdrQueryOptionalDelayLoadedAPI   6.2 and higher
LdrQueryProcessModuleInformation   all
LdrRegisterDllNotification   6.0 and higher
LdrRemoveDllDirectory   6.2 and higher
LdrRemoveLoadAsDataTable   6.0 and higher
LdrResFindResource   6.0 and higher
LdrResFindResourceDirectory   6.0 and higher
LdrResGetRCConfig   6.1 and higher
LdrResRelease   6.0 and higher
LdrResSearchResource   6.0 and higher
LdrResolveDelayLoadedAPI   6.2 and higher
LdrResolveDelayLoadsFromDll   6.2 and higher
LdrRscIsTypeExist   6.1 and higher
LdrSetAppCompatDllRedirectionCallback   5.1 and higher
LdrSetDefaultDllDirectories   6.2 and higher
LdrSetDllDirectory   6.2 and higher
LdrSetDllManifestProber   5.1 and higher
LdrSetImplicitPathOptions   6.3 and higher
LdrSetMUICacheType   6.0 and higher
LdrShutdownProcess   all
LdrShutdownThread   all
LdrStandardizeSystemPath   6.2 and higher
LdrSystemDllInitBlock   6.2 and higher
LdrUnloadAlternateResourceModule   5.0 and higher
LdrUnloadAlternateResourceModuleEx   6.0 and higher
LdrUnloadDll   all
LdrUnlockLoaderLock   5.1 and higher
LdrUnregisterDllNotification   6.0 and higher
LdrVerifyImageMatchesChecksum   all
LdrVerifyImageMatchesChecksumEx   6.0 and higher
LdrWx86FormatVirtualImage wow64 6.0 SP1 and higher
LdrpResGetMappingSize   6.0 SP1 and higher
LdrpResGetRCConfig   6.0 SP1 and SP2 only
LdrpResGetResourceDirectory   6.0 SP1 and higher
MD4Final   6.0 and higher
MD4Init   6.0 and higher
MD4Update   6.0 and higher
MD5Final   6.0 and higher
MD5Init   6.0 and higher
MD5Update   6.0 and higher
NPXEMULATORTABLE (data)   3.10 to 5.0
NlsAnsiCodePage (data)   4.0 and higher
NlsMbCodePageTag (data)   3.50 and higher
NlsMbOemCodePageTag (data)   3.50 and higher
NtAcceptConnectPort   all
NtAccessCheck   all
NtAccessCheckAndAuditAlarm   all
NtAccessCheckByType   5.0 and higher
NtAccessCheckByTypeAndAuditAlarm   5.0 and higher
NtAccessCheckByTypeResultList   5.0 and higher
NtAccessCheckByTypeResultListAndAuditAlarm   5.0 and higher
NtAccessCheckByTypeResultListAndAuditAlarmByHandle   5.0 and higher
NtAcquireCMFViewOwnership   6.0 only
NtAddAtom   4.0 and higher
NtAddAtomEx   6.2 and higher
NtAddBootEntry   5.1 and higher
NtAddDriverEntry   5.2 and higher
NtAdjustGroupsToken   all
NtAdjustPrivilegesToken   all
NtAdjustTokenClaimsAndDeviceGroups   6.2 and higher
NtAlertResumeThread   all
NtAlertThread   all
NtAlertThreadByThreadId   6.2 and higher
NtAllocateLocallyUniqueId   all
NtAllocateReserveObject   6.1 and higher
NtAllocateUserPhysicalPages   5.0 and higher
NtAllocateUuids   3.51 and higher
NtAllocateVirtualMemory   all
NtAlpcAcceptConnectPort   6.0 and higher
NtAlpcCancelMessage   6.0 and higher
NtAlpcConnectPort   6.0 and higher
NtAlpcConnectPortEx   6.2 and higher
NtAlpcCreatePort   6.0 and higher
NtAlpcCreatePortSection   6.0 and higher
NtAlpcCreateResourceReserve   6.0 and higher
NtAlpcCreateSectionView   6.0 and higher
NtAlpcCreateSecurityContext   6.0 and higher
NtAlpcDeletePortSection   6.0 and higher
NtAlpcDeleteResourceReserve   6.0 and higher
NtAlpcDeleteSectionView   6.0 and higher
NtAlpcDeleteSecurityContext   6.0 and higher
NtAlpcDisconnectPort   6.0 and higher
NtAlpcImpersonateClientContainerOfPort   10.0 and higher
NtAlpcImpersonateClientOfPort   6.0 and higher
NtAlpcOpenSenderProcess   6.0 and higher
NtAlpcOpenSenderThread   6.0 and higher
NtAlpcQueryInformation   6.0 and higher
NtAlpcQueryInformationMessage   6.0 and higher
NtAlpcRevokeSecurityContext   6.0 and higher
NtAlpcSendWaitReceivePort   6.0 and higher
NtAlpcSetInformation   6.0 and higher
NtApphelpCacheControl   5.2 and higher
NtAreMappedFilesTheSame   5.0 and higher
NtAssignProcessToJobObject   5.0 and higher
NtAssociateWaitCompletionPacket   6.2 and higher
NtCallbackReturn   3.51 and higher
NtCancelDeviceWakeupRequest   5.0 to 6.0
NtCancelIoFile   all
NtCancelIoFileEx   6.0 and higher
NtCancelSynchronousIoFile   6.0 and higher
NtCancelTimer   all
NtCancelTimer2   6.3 and higher
NtCancelWaitCompletionPacket   6.2 and higher
NtClearAllSavepointsTransaction   6.0 before SP1
NtClearEvent   3.50 and higher
NtClearSavepointTransaction   6.0 before SP1
NtClose   all
NtCloseObjectAuditAlarm   all
NtCommitComplete   6.0 and higher
NtCommitEnlistment   6.0 and higher
NtCommitTransaction   6.0 and higher
NtCompactKeys   5.1 and higher
NtCompareObjects   10.0 and higher
NtCompareTokens   5.1 and higher
NtCompleteConnectPort   all
NtCompressKey   5.1 and higher
NtConnectPort   all
NtContinue   all
NtCreateChannel   4.0 to 5.0
NtCreateDebugObject   5.1 and higher
NtCreateDirectoryObject   all
NtCreateDirectoryObjectEx   6.2 and higher
NtCreateEnlistment   6.0 and higher
NtCreateEvent   all
NtCreateEventPair   all
NtCreateFile   all
NtCreateIRTimer   6.2 and higher
NtCreateIoCompletion   3.50 and higher
NtCreateJobObject   5.0 and higher
NtCreateJobSet   5.1 and higher
NtCreateKey   all
NtCreateKeyTransacted   6.0 and higher
NtCreateKeyedEvent   5.1 and higher
NtCreateLowBoxToken   6.2 and higher
NtCreateMailslotFile   all
NtCreateMutant   all
NtCreateNamedPipeFile   all
NtCreatePagingFile   all
NtCreatePartition   10.0 and higher
NtCreatePort   all
NtCreatePrivateNamespace   6.0 and higher
NtCreateProcess   all
NtCreateProcessEx   5.1 and higher
NtCreateProfile   all
NtCreateProfileEx   6.1 and higher
NtCreateResourceManager   6.0 and higher
NtCreateSection   all
NtCreateSemaphore   all
NtCreateSymbolicLinkObject   all
NtCreateThread   all
NtCreateThreadEx   6.0 and higher
NtCreateTimer   all
NtCreateTimer2   6.3 and higher
NtCreateToken   all
NtCreateTokenEx   6.2 and higher
NtCreateTransaction   6.0 and higher
NtCreateTransactionManager   6.0 and higher
NtCreateUserProcess   6.0 and higher
NtCreateWaitCompletionPacket   6.2 and higher
NtCreateWaitablePort   5.0 and higher
NtCreateWnfStateName   6.2 and higher
NtCreateWorkerFactory   6.0 and higher
NtCurrentTeb x86 all
NtDebugActiveProcess   5.1 and higher
NtDebugContinue   5.1 and higher
NtDelayExecution   all
NtDeleteAtom   4.0 and higher
NtDeleteBootEntry   5.1 and higher
NtDeleteDriverEntry   5.2 and higher
NtDeleteFile   3.50 and higher
NtDeleteKey   all
NtDeleteObjectAuditAlarm   4.0 and higher
NtDeletePrivateNamespace   6.0 and higher
NtDeleteValueKey   all
NtDeleteWnfStateData   6.2 and higher
NtDeleteWnfStateName   6.2 and higher
NtDeviceIoControlFile   all
NtDisableLastKnownGood   6.1 and higher
NtDisplayString   all
NtDrawText   6.1 and higher
NtDuplicateObject   all
NtDuplicateToken   all
NtEnableLastKnownGood   6.1 and higher
NtEnumerateBootEntries   5.1 and higher
NtEnumerateBus   3.51 only
NtEnumerateDriverEntries   5.2 and higher
NtEnumerateKey   all
NtEnumerateSystemEnvironmentValuesEx   5.1 and higher
NtEnumerateTransactionObject   6.0 and higher
NtEnumerateValueKey   all
NtExtendSection   all
NtFilterBootOption   6.2 and higher
NtFilterToken   5.0 and higher
NtFilterTokenEx   6.2 and higher
NtFindAtom   4.0 and higher
NtFlushBuffersFile   all
NtFlushBuffersFileEx   6.2 and higher
NtFlushInstallUILanguage   6.0 and higher
NtFlushInstructionCache   all
NtFlushKey   all
NtFlushProcessWriteBuffers   6.0 and higher
NtFlushVirtualMemory   all
NtFlushWriteBuffer   all
NtFreeUserPhysicalPages   5.0 and higher
NtFreeVirtualMemory   all
NtFreezeRegistry   6.0 and higher
NtFreezeTransactions   6.0 and higher
NtFsControlFile   all
NtGetCachedSigningLevel   6.2 and higher
NtGetCompleteWnfStateSubscription   6.3 and higher
NtGetContextThread   all
NtGetCurrentProcessorNumber   5.2 and higher
NtGetCurrentProcessorNumberEx   10.0 and higher
NtGetDevicePowerState   5.0 and higher
NtGetMUIRegistryInfo   6.0 and higher
NtGetNextProcess   6.0 and higher
NtGetNextThread   6.0 and higher
NtGetNlsSectionPtr   6.0 and higher
NtGetNotificationResourceManager   6.0 and higher
NtGetPlugPlayEvent   3.51 to 6.1
NtGetTickCount   all except 5.1
NtGetWriteWatch   5.0 and higher
NtImpersonateAnonymousToken   5.0 and higher
NtImpersonateClientOfPort   all
NtImpersonateThread   all
NtInitializeNlsFiles   6.0 and higher
NtInitializeRegistry   all
NtInitializeVDM   3.10 only
NtInitiatePowerAction   5.0 and higher
NtIsProcessInJob   5.1 and higher
NtIsSystemResumeAutomatic   5.0 and higher
NtIsUILanguageComitted   6.0 and higher
NtListTransactions   6.0 before SP1
NtListenChannel   4.0 to 5.0
NtListenPort   all
NtLoadDriver   all
NtLoadKey   all
NtLoadKey2   4.0 and higher
NtLoadKeyEx   5.2 and higher
NtLockFile   all
NtLockProductActivationKeys   5.1 and higher
NtLockRegistryKey   5.1 and higher
NtLockVirtualMemory   all
NtMakePermanentObject   5.1 and higher
NtMakeTemporaryObject   all
NtManagePartition   10.0 and higher
NtMapCMFModule   6.0 and higher
NtMapUserPhysicalPages   5.0 and higher
NtMapUserPhysicalPagesScatter   5.0 and higher
NtMapViewOfSection   all
NtMarshallTransaction   6.0 before SP1
NtModifyBootEntry   5.1 and higher
NtModifyDriverEntry   5.2 and higher
NtNotifyChangeDirectoryFile   all
NtNotifyChangeKey   all
NtNotifyChangeMultipleKeys   5.0 and higher
NtNotifyChangeSession   6.1 and higher
NtOpenChannel   4.0 to 5.0
NtOpenDirectoryObject   all
NtOpenEnlistment   6.0 and higher
NtOpenEvent   all
NtOpenEventPair   all
NtOpenFile   all
NtOpenIoCompletion   3.50 and higher
NtOpenJobObject   5.0 and higher
NtOpenKey   all
NtOpenKeyEx   6.1 and higher
NtOpenKeyTransacted   6.0 and higher
NtOpenKeyTransactedEx   6.1 and higher
NtOpenKeyedEvent   5.1 and higher
NtOpenMutant   all
NtOpenObjectAuditAlarm   all
NtOpenPartition   10.0 and higher
NtOpenPrivateNamespace   6.0 and higher
NtOpenProcess   all
NtOpenProcessToken   all
NtOpenProcessTokenEx   5.1 and higher
NtOpenResourceManager   6.0 and higher
NtOpenSection   all
NtOpenSemaphore   all
NtOpenSession   6.0 and higher
NtOpenSymbolicLinkObject   all
NtOpenThread   all
NtOpenThreadToken   all
NtOpenThreadTokenEx   5.1 and higher
NtOpenTimer   all
NtOpenTransaction   6.0 and higher
NtOpenTransactionManager   6.0 and higher
NtPlugPlayControl   3.51 and higher
NtPowerInformation   5.0 and higher
NtPrePrepareComplete   6.0 and higher
NtPrePrepareEnlistment   6.0 and higher
NtPrepareComplete   6.0 and higher
NtPrepareEnlistment   6.0 and higher
NtPrivilegeCheck   all
NtPrivilegeObjectAuditAlarm   all
NtPrivilegedServiceAuditAlarm   all
NtPropagationComplete   6.0 and higher
NtPropagationFailed   6.0 and higher
NtProtectVirtualMemory   all
NtPullTransaction   6.0 before SP1
NtPulseEvent   all
NtQueryAttributesFile   3.50 and higher
NtQueryBootEntryOrder   5.1 and higher
NtQueryBootOptions   5.1 and higher
NtQueryDebugFilterState   5.1 and higher
NtQueryDefaultLocale   all
NtQueryDefaultUILanguage   5.0 and higher
NtQueryDirectoryFile   all
NtQueryDirectoryObject   all
NtQueryDriverEntryOrder   5.2 and higher
NtQueryEaFile   all
NtQueryEvent   all
NtQueryFullAttributesFile   4.0 and higher
NtQueryInformationAtom   4.0 and higher
NtQueryInformationEnlistment   6.0 and higher
NtQueryInformationFile   all
NtQueryInformationJobObject   5.0 and higher
NtQueryInformationPort   all
NtQueryInformationProcess   all
NtQueryInformationResourceManager   6.0 and higher
NtQueryInformationThread   all
NtQueryInformationToken   all
NtQueryInformationTransaction   6.0 and higher
NtQueryInformationTransactionManager   6.0 and higher
NtQueryInformationWorkerFactory   6.0 and higher
NtQueryInstallUILanguage   5.0 and higher
NtQueryIntervalProfile   all
NtQueryIoCompletion   3.50 and higher
NtQueryKey   all
NtQueryLicenseValue   6.0 and higher
NtQueryMultipleValueKey   4.0 and higher
NtQueryMutant   all
NtQueryObject   all
NtQueryOleDirectoryFile   4.0 only
NtQueryOpenSubKeys   5.0 and higher
NtQueryOpenSubKeysEx   5.2 and higher
NtQueryPerformanceCounter   all
NtQueryPortInformationProcess   5.1 and higher
NtQueryQuotaInformationFile   5.0 and higher
NtQuerySection   all
NtQuerySecurityAttributesToken   6.1 and higher
NtQuerySecurityObject   all
NtQuerySemaphore   all
NtQuerySymbolicLinkObject   all
NtQuerySystemEnvironmentValue   all
NtQuerySystemEnvironmentValueEx   5.1 and higher
NtQuerySystemInformation   all
NtQuerySystemInformationEx   6.1 and higher
NtQuerySystemTime   all
NtQueryTimer   all
NtQueryTimerResolution   3.50 and higher
NtQueryValueKey   all
NtQueryVirtualMemory   all
NtQueryVolumeInformationFile   all
NtQueryWnfStateData   6.2 and higher
NtQueryWnfStateNameInformation   6.2 and higher
NtQueueApcThread   4.0 and higher
NtQueueApcThreadEx   6.1 and higher
NtRaiseException   all
NtRaiseHardError   all
NtReadFile   all
NtReadFileScatter   4.0 SP2 and higher
NtReadOnlyEnlistment   6.0 and higher
NtReadRequestData   all
NtReadVirtualMemory   all
NtRecoverEnlistment   6.0 and higher
NtRecoverResourceManager   6.0 and higher
NtRecoverTransactionManager   6.0 and higher
NtRegisterNewDevice   3.51 only
NtRegisterProtocolAddressInformation   6.0 and higher
NtRegisterThreadTerminatePort   all
NtReleaseCMFViewOwnership   6.0 only
NtReleaseKeyedEvent   5.1 and higher
NtReleaseMutant   all
NtReleaseProcessMutant   3.10 to 3.51
NtReleaseSemaphore   all
NtReleaseWorkerFactoryWorker   6.0 and higher
NtRemoveIoCompletion   3.50 and higher
NtRemoveIoCompletionEx   6.0 and higher
NtRemoveProcessDebug   5.1 and higher
NtRenameKey   5.1 and higher
NtRenameTransactionManager   6.0 SP1 and higher
NtRenameValueKey   3.10 only
NtReplaceKey   all
NtReplacePartitionUnit   6.0 SP1 and higher
NtReplyPort   all
NtReplyWaitReceivePort   all
NtReplyWaitReceivePortEx   5.0 and higher
NtReplyWaitReplyPort   all
NtReplyWaitSendChannel   4.0 to 5.0
NtRequestDeviceWakeup   5.0 to 6.0
NtRequestPort   all
NtRequestWaitReplyPort   all
NtRequestWakeupLatency   5.0 to 6.0
NtResetEvent   all
NtResetWriteWatch   5.0 and higher
NtRestoreKey   all
NtResumeProcess   5.1 and higher
NtResumeThread   all
NtRevertContainerImpersonation   10.0 and higher
NtRollbackComplete   6.0 and higher
NtRollbackEnlistment   6.0 and higher
NtRollbackSavepointTransaction   6.0 before SP1
NtRollbackTransaction   6.0 and higher
NtRollforwardTransactionManager   6.0 and higher
NtSaveKey   all
NtSaveKeyEx   5.1 and higher
NtSaveMergedKeys   5.0 and higher
NtSavepointComplete   6.0 before SP1
NtSavepointTransaction   6.0 before SP1
NtSecureConnectPort   5.0 and higher
NtSendWaitReplyChannel   4.0 to 5.0
NtSerializeBoot   6.1 and higher
NtSetBootEntryOrder   5.1 and higher
NtSetBootOptions   5.1 and higher
NtSetCachedSigningLevel   6.2 and higher
NtSetContextChannel   4.0 to 5.0
NtSetContextThread   all
NtSetDebugFilterState   5.1 and higher
NtSetDefaultHardErrorPort   all
NtSetDefaultLocale   all
NtSetDefaultUILanguage   5.0 and higher
NtSetDriverEntryOrder   5.2 and higher
NtSetEaFile   all
NtSetEvent   all
NtSetEventBoostPriority   5.1 and higher
NtSetHighEventPair   all
NtSetHighWaitLowEventPair   all
NtSetHighWaitLowThread   3.10 to 4.0
NtSetIRTimer   6.2 and higher
NtSetInformationDebugObject   5.1 and higher
NtSetInformationEnlistment   6.0 and higher
NtSetInformationFile   all
NtSetInformationJobObject   5.0 and higher
NtSetInformationKey   all
NtSetInformationObject   3.50 and higher
NtSetInformationProcess   all
NtSetInformationResourceManager   6.0 and higher
NtSetInformationSymbolicLink   10.0 and higher
NtSetInformationThread   all
NtSetInformationToken   all
NtSetInformationTransaction   6.0 and higher
NtSetInformationTransactionManager   6.0 and higher
NtSetInformationVirtualMemory   6.2 and higher
NtSetInformationWorkerFactory   6.0 and higher
NtSetIntervalProfile   all
NtSetIoCompletion   3.51 and higher
NtSetIoCompletionEx   6.1 and higher
NtSetLdtEntries   all
NtSetLowEventPair   all
NtSetLowWaitHighEventPair   all
NtSetLowWaitHighThread   3.10 to 4.0
NtSetQuotaInformationFile   5.0 and higher
NtSetSecurityObject   all
NtSetSystemEnvironmentValue   all
NtSetSystemEnvironmentValueEx   5.1 and higher
NtSetSystemInformation   3.50 and higher
NtSetSystemPowerState   3.51 and higher
NtSetSystemTime   all
NtSetThreadExecutionState   5.0 and higher
NtSetTimer   all
NtSetTimer2   6.3 and higher
NtSetTimerEx   6.1 and higher
NtSetTimerResolution   3.50 and higher
NtSetUuidSeed   5.0 and higher
NtSetValueKey   all
NtSetVolumeInformationFile   all
NtSetWnfProcessNotificationEvent   6.3 and higher
NtShutdownSystem   all
NtShutdownWorkerFactory   6.0 and higher
NtSignalAndWaitForSingleObject   4.0 and higher
NtSinglePhaseReject   6.0 and higher
NtStartProfile   all
NtStartTm   6.0 before SP1
NtStopProfile   all
NtSubscribeWnfStateChange   6.2 and higher
NtSuspendProcess   5.1 and higher
NtSuspendThread   all
NtSystemDebugControl   all
NtTerminateJobObject   5.0 and higher
NtTerminateProcess   all
NtTerminateThread   all
NtTestAlert   all
NtThawRegistry   6.0 and higher
NtThawTransactions   6.0 and higher
NtTraceControl   6.0 and higher
NtTraceEvent   5.1 and higher
NtTranslateFilePath   5.1 and higher
NtUmsThreadYield   6.1 and higher
NtUnloadDriver   all
NtUnloadKey   all
NtUnloadKey2   5.2 and higher
NtUnloadKeyEx   5.1 and higher
NtUnlockFile   all
NtUnlockVirtualMemory   all
NtUnmapViewOfSection   all
NtUnmapViewOfSectionEx   6.2 and higher
NtUnsubscribeWnfStateChange   6.2 and higher
NtUpdateWnfStateData   6.2 and higher
NtVdmControl   all
NtVdmStartExecution   3.10 only
NtW32Call   3.51 to 4.0 SP3
NtWaitForAlertByThreadId   6.2 and higher
NtWaitForDebugEvent   5.1 and higher
NtWaitForKeyedEvent   5.1 and higher
NtWaitForMultipleObjects   all
NtWaitForMultipleObjects32   5.2 SP1 and higher
NtWaitForProcessMutant   3.10 to 3.51
NtWaitForSingleObject   all
NtWaitForWnfNotifications   6.2 only
NtWaitForWorkViaWorkerFactory   6.0 and higher
NtWaitHighEventPair   all
NtWaitLowEventPair   all
NtWorkerFactoryWorkerReady   6.0 and higher
NtWow64AllocateVirtualMemory64 wow64 6.2 and higher
NtWow64CallFunction64 wow64 6.0 and higher
NtWow64CsrAllocateCaptureBuffer wow64 all
NtWow64CsrAllocateMessagePointer wow64 all
NtWow64CsrCaptureMessageBuffer wow64 all
NtWow64CsrCaptureMessageString wow64 all
NtWow64CsrClientCallServer wow64 all
NtWow64CsrClientConnectToServer wow64 all
NtWow64CsrFreeCaptureBuffer wow64 all
NtWow64CsrGetProcessId wow64 all
NtWow64CsrIdentifyAlertableThread wow64 all
NtWow64CsrNewThread wow64 5.2 SP1 to 6.0 before SP1
NtWow64CsrSetPriorityClass wow64 5.2 SP1 to 6.0 before SP1
NtWow64CsrVerifyRegion wow64 6.0 and higher
NtWow64DebuggerCall wow64 all
NtWow64GetCurrentProcessorNumberEx wow64 6.1 and higher
NtWow64GetNativeSystemInformation wow64 all
NtWow64InterlockedPopEntrySList wow64 6.1 only
NtWow64IsProcessorFeaturePresent wow64 10.0 and higher
NtWow64QueryInformationProcess64 wow64 all
NtWow64QueryVirtualMemory64 wow64 5.2 SP1 to 6.3
NtWow64ReadVirtualMemory64 wow64 all
NtWow64WriteVirtualMemory64 wow64 6.0 and higher
NtWriteFile   all
NtWriteFileGather   4.0 SP2 and higher
NtWriteRequestData   all
NtWriteVirtualMemory   all
NtYieldExecution   4.0 and higher
NtdllDefWindowProc_A   6.0 SP1 and higher
NtdllDefWindowProc_W   6.0 SP1 and higher
NtdllDialogWndProc_A   6.0 SP1 and higher
NtdllDialogWndProc_W   6.0 SP1 and higher
PfxFindPrefix   all
PfxInitialize   all
PfxInsertPrefix   all
PfxRemovePrefix   all
PssNtCaptureSnapshot   6.3 and higher
PssNtDuplicateSnapshot   6.3 and higher
PssNtFreeRemoteSnapshot   6.3 and higher
PssNtFreeSnapshot   6.3 and higher
PssNtFreeWalkMarker   6.3 and higher
PssNtQuerySnapshot   6.3 and higher
PssNtValidateDescriptor   6.3 and higher
PssNtWalkSnapshot   6.3 and higher
PropertyLengthAsVariant   4.0 to 5.2
ResCCloseRuntimeView   6.0 before SP1
ResCCompareCacheIDs   6.0 before SP1
ResCCreateCultureMap   6.0 before SP1
ResCCreateDefaultCultureMap   6.0 before SP1
ResCCreateRuntimeView   6.0 before SP1
ResCDirectoryCreateAndPopulate   6.0 before SP1
ResCDirectoryCreateMapping   6.0 before SP1
ResCDirectoryFree   6.0 before SP1
ResCDirectoryGetBaseFolder   6.0 before SP1
ResCDirectoryGetEntry   6.0 before SP1
ResCDirectoryGetEntryCopy   6.0 before SP1
ResCDirectoryGetEntryEx   6.0 before SP1
ResCDirectoryGetEntryExCopy   6.0 before SP1
ResCDirectoryGetEntryIndex   6.0 before SP1
ResCDirectoryGetEntryIndexEx   6.0 before SP1
ResCDirectoryGetFirstEntry   6.0 before SP1
ResCDirectoryGetFirstEntryIndex   6.0 before SP1
ResCDirectoryGetSegmentIndex   6.0 before SP1
ResCDirectoryGetSegmentName   6.0 before SP1
ResCDirectoryLoadFixedSize   6.0 before SP1
ResCDirectoryOpenMapping   6.0 before SP1
ResCFreeCultureMap   6.0 before SP1
ResCGetCacheIndices   6.0 before SP1
ResCGetCultureID   6.0 before SP1
ResCGetCultureIndex   6.0 before SP1
ResCGetCultureName   6.0 before SP1
ResCGetHighestCacheIndex   6.0 before SP1
ResCGetHighestConsecutiveCacheIndex   6.0 before SP1
ResCGetIndexedName   6.0 before SP1
ResCGetName   6.0 before SP1
ResCGetRegistryBaseFolder   6.0 before SP1
ResCGetRegistryConfig   6.0 before SP1
ResCGetRegistryLatestIndex   6.0 before SP1
ResCGetRegistryMappingPrefix   6.0 before SP1
ResCGetRegistryStatus   6.0 before SP1
ResCGetSubIndexedName   6.0 before SP1
ResCInitRuntimeView   6.0 before SP1
ResCInitRuntimeViewEx   6.0 before SP1
ResCKeDirectoryOpenMapping   6.0 before SP1
ResCKeGetBaseFolder   6.0 before SP1
ResCKeGetCacheIndices   6.0 before SP1
ResCKeInitRuntimeViewEx   6.0 before SP1
ResCKeSegmentOpenMapping   6.0 before SP1
ResCLoadCultureMap   6.0 before SP1
ResCOpenRegistryKey   6.0 before SP1
ResCOpenRuntimeView   6.0 before SP1
ResCReleaseInitMutex   6.0 before SP1
ResCReloadCultureMap   6.0 before SP1
ResCRequestInitMutex   6.0 before SP1
ResCRuntimeGetAnySegmentData   6.0 before SP1
ResCRuntimeGetCultureID   6.0 before SP1
ResCRuntimeGetEntryData   6.0 before SP1
ResCRuntimeGetEntryDataEx   6.0 before SP1
ResCRuntimeGetResourceData   6.0 before SP1
ResCRuntimeGetResourceDataEx   6.0 before SP1
ResCRuntimeGetResourceDataForCulture   6.0 before SP1
ResCRuntimeGetSegmentData   6.0 before SP1
ResCRuntimeGetSegmentDataEx   6.0 before SP1
ResCRuntimeViewLoadCultureMap   6.0 before SP1
ResCSaveRegistryBaseFolder   6.0 before SP1
ResCSaveRegistryConfig   6.0 before SP1
ResCSaveRegistryLatestIndex   6.0 before SP1
ResCSaveRegistryStatus   6.0 before SP1
ResCSegmentCreateAndPopulate   6.0 before SP1
ResCSegmentCreateMapping   6.0 before SP1
ResCSegmentFree   6.0 before SP1
ResCSegmentGetData   6.0 before SP1
ResCSegmentLoadFixedSize   6.0 before SP1
ResCSegmentOpenMapping   6.0 before SP1
ResCSegmentReserveMapping   6.0 before SP1
ResCSetCacheSecurityType   6.0 before SP1
RestoreEm87Context   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
RtlAbortRXact   all
RtlAbsoluteToSelfRelativeSD   all
RtlAcquirePebLock   all
RtlAcquirePrivilege   5.2 SP1 and higher
RtlAcquireReleaseSRWLockExclusive   6.1 and higher
RtlAcquireResourceExclusive   all
RtlAcquireResourceShared   all
RtlAcquireSRWLockExclusive   6.0 and higher
RtlAcquireSRWLockShared   6.0 and higher
RtlActivateActivationContext   5.1 and higher
RtlActivateActivationContextEx   5.1 and higher
RtlActivateActivationContextUnsafeFast   5.1 and higher
RtlAddAccessAllowedAce   all
RtlAddAccessAllowedAceEx   5.0 and higher
RtlAddAccessAllowedObjectAce   5.0 and higher
RtlAddAccessDeniedAce   all
RtlAddAccessDeniedAceEx   5.0 and higher
RtlAddAccessDeniedObjectAce   5.0 and higher
RtlAddAce   all
RtlAddActionToRXact   all
RtlAddAtomToAtomTable   4.0 and higher
RtlAddAttributeActionToRXact   all
RtlAddAuditAccessAce   all
RtlAddAuditAccessAceEx   5.0 and higher
RtlAddAuditAccessObjectAce   5.0 and higher
RtlAddCompoundAce   4.0 and higher
RtlAddFunctionTable x64 all
RtlAddGrowableFunctionTable x64 6.2 and higher
RtlAddIntegrityLabelToBoundaryDescriptor   6.1 and higher
RtlAddMandatoryAce   6.0 and higher
RtlAddProcessTrustLabelAce   6.3 and higher
RtlAddRange   5.0 to 5.1
RtlAddRefActivationContext   5.1 and higher
RtlAddRefMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlAddResourceAttributeAce   6.2 and higher
RtlAddSIDToBoundaryDescriptor   6.0 and higher
RtlAddScopedPolicyIDAce   6.2 and higher
RtlAddVectoredContinueHandler   5.2 SP1 and higher
RtlAddVectoredExceptionHandler   5.1 and higher
RtlAddressInSectionTable   5.1 and higher
RtlAdjustPrivilege   all
RtlAllocateActivationContextStack   5.2 SP1 and higher
RtlAllocateAndInitializeSid   all
RtlAllocateAndInitializeSidEx   6.3 and higher
RtlAllocateHandle   4.0 and higher
RtlAllocateHeap   all
RtlAllocateMemoryBlockLookaside   6.0 and higher
RtlAllocateMemoryZone   6.0 and higher
RtlAllocateWnfSerializationGroup   6.2 and higher
RtlAnalyzeProfile   3.10 only
RtlAnsiCharToUnicodeChar   all
RtlAnsiStringToUnicodeSize   all
RtlAnsiStringToUnicodeString   all
RtlAppendAsciizToString   all
RtlAppendPathElement   5.1 and higher
RtlAppendStringToString   all
RtlAppendUnicodeStringToString   all
RtlAppendUnicodeToString   all
RtlApplicationVerifierStop   5.1 and higher
RtlApplyRXact   all
RtlApplyRXactNoFlush   all
RtlAppxIsFileOwnedByTrustedInstaller   6.2 and higher
RtlAreAllAccessesGranted   all
RtlAreAnyAccessesGranted   all
RtlAreBitsClear   all
RtlAreBitsSet   all
RtlAssert   all
RtlAssert2   5.1 only
RtlAvlInsertNodeEx   6.2 and higher
RtlAvlRemoveNode   6.2 and higher
RtlBarrier   6.0 and higher
RtlBarrierForDelete   6.0 and higher
RtlCallbackLpcClient   5.0 only
RtlCancelTimer   5.0 and higher
RtlCanonicalizeDomainName   6.2 and higher
RtlCapabilityCheck   10.0 and higher
RtlCaptureContext   5.1 and higher
RtlCaptureStackBackTrace   all
RtlCaptureStackContext x86 5.1 and higher
RtlCharToInteger   all
RtlCheckForOrphanedCriticalSections   5.0 and higher
RtlCheckPortableOperatingSystem   6.2 and higher
RtlCheckProcessParameters   5.1 to 5.2
RtlCheckRegistryKey   all
RtlCheckSandboxedToken   10.0 and higher
RtlCheckTokenCapability   6.2 and higher
RtlCheckTokenMembership   6.2 and higher
RtlCheckTokenMembershipEx   6.2 and higher
RtlCleanUpTEBLangLists   6.0 and higher
RtlClearAllBits   all
RtlClearBit   6.2 and higher
RtlClearBits   all
RtlCloneMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlCloneUserProcess   6.0 and higher
RtlClosePropertySet   4.0 only
RtlCmDecodeMemIoResource   6.0 and higher
RtlCmEncodeMemIoResource   6.0 and higher
RtlCommitDebugInfo   6.0 and higher
RtlCommitMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlCompactHeap   all
RtlCompareAltitudes   6.0 and higher
RtlCompareMemory   all
RtlCompareMemoryUlong   all
RtlCompareString   all
RtlCompareUnicodeString   all
RtlCompareUnicodeStrings   6.0 and higher
RtlCompareVariants   4.0 only
RtlCompleteProcessCloning x64 6.0 and higher
RtlCompressBuffer   3.50 and higher
RtlComputeCrc32   5.1 and higher
RtlComputeImportTableHash   5.1 and higher
RtlComputePrivatizedDllName_U   5.1 and higher
RtlConnectToSm   6.0 and higher
RtlConsoleMultiByteToUnicodeN   all
RtlContractHashTable   6.1 and higher
RtlConvertDeviceFamilyInfoToString   10.0 and higher
RtlConvertExclusiveToShared   all
RtlConvertLCIDToString   6.0 and higher
RtlConvertLongToLargeInteger x86 all
RtlConvertPropertyToVariant   4.0 to 5.2
RtlConvertSRWLockExclusiveToShared   10.0 and higher
RtlConvertSharedToExclusive   all
RtlConvertSidToUnicodeString   all
RtlConvertToAutoInheritSecurityObject   5.0 and higher
RtlConvertUiListToApiList   3.10 to 6.2
RtlConvertUlongToLargeInteger x86 all
RtlConvertVariantToProperty   4.0 to 5.2
RtlCopyBitMap   6.2 and higher
RtlCopyContext   6.1 SP1 and higher
RtlCopyExtendedContext   6.1 and higher
RtlCopyLuid   all
RtlCopyLuidAndAttributesArray   all
RtlCopyMappedMemory   5.2 and higher
RtlCopyMemory x64 all
RtlCopyMemoryNonTemporal x64 all
RtlCopyMemoryStreamTo x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlCopyOutOfProcessMemoryStreamTo x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlCopyRangeList   5.0 to 5.1
RtlCopySecurityDescriptor   all
RtlCopySid   all
RtlCopySidAndAttributesArray   all
RtlCopyString   all
RtlCopyUnicodeString   all
RtlCrc32   6.2 and higher
RtlCrc64   6.2 and higher
RtlCreateAcl   all
RtlCreateActivationContext   5.1 and higher
RtlCreateAndSetSD   all
RtlCreateAtomTable   4.0 and higher
RtlCreateBootStatusDataFile   5.1 and higher
RtlCreateBoundaryDescriptor   6.0 and higher
RtlCreateEnvironment   all
RtlCreateEnvironmentEx   6.0 and higher
RtlCreateHashTable   6.1 and higher
RtlCreateHashTableEx   6.2 and higher
RtlCreateHeap   all
RtlCreateLpcServer   5.0 only
RtlCreateMemoryBlockLookaside   6.0 and higher
RtlCreateMemoryZone   6.0 and higher
RtlCreateProcessParameters   all
RtlCreateProcessParametersEx   6.0 and higher
RtlCreateProcessReflection   6.1 and higher
RtlCreatePropertySet   4.0 only
RtlCreateQueryDebugBuffer   3.51 and higher
RtlCreateRegistryKey   all
RtlCreateSecurityDescriptor   all
RtlCreateServiceSid   6.0 and higher
RtlCreateSystemVolumeInformationFolder   5.1 and higher
RtlCreateTagHeap   3.51 and higher
RtlCreateTimer   5.0 and higher
RtlCreateTimerQueue   5.0 and higher
RtlCreateUmsCompletionList x64 6.1 and higher
RtlCreateUmsThread x64 6.1 and higher
RtlCreateUmsThreadContext x64 6.1 and higher
RtlCreateUnicodeString   all
RtlCreateUnicodeStringFromAsciiz   all
RtlCreateUserProcess   all
RtlCreateUserSecurityObject   all
RtlCreateUserStack   6.0 and higher
RtlCreateUserThread   all
RtlCreateVirtualAccountSid   6.1 and higher
RtlCultureNameToLCID   6.0 and higher
RtlCustomCPToUnicodeN   all
RtlCutoverTimeToSystemTime   3.50 and higher
RtlDeCommitDebugInfo   6.0 and higher
RtlDeNormalizeProcessParams   all
RtlDeactivateActivationContext   5.1 and higher
RtlDeactivateActivationContextUnsafeFast   5.1 and higher
RtlDebugPrintTimes   5.0 and higher
RtlDecodePointer   5.1 SP2 and higher;
5.2 SP1 and higher;
6.0 and higher
RtlDecodeRemotePointer   10.0 and higher
RtlDecodeSystemPointer   5.1 SP2 and higher;
5.2 SP1 and higher;
6.0 and higher
RtlDecompressBuffer   3.50 and higher
RtlDecompressBufferEx   6.2 and higher
RtlDecompressFragment   3.50 and higher
RtlDefaultNpAcl   5.0 and higher
RtlDelete   all
RtlDeleteAce   all
RtlDeleteAtomFromAtomTable   4.0 and higher
RtlDeleteBarrier   6.0 and higher
RtlDeleteBoundaryDescriptor   6.0 and higher
RtlDeleteCriticalSection   all
RtlDeleteElementGenericTable   all
RtlDeleteElementGenericTableAvl   5.1 and higher
RtlDeleteElementGenericTableAvlEx   6.2 and higher
RtlDeleteFunctionTable x64 all
RtlDeleteGrowableFunctionTable x64 6.2 and higher
RtlDeleteHashTable   6.1 and higher
RtlDeleteNoSplay   4.0 and higher
RtlDeleteOwnersRanges   5.0 to 5.1
RtlDeleteRange   5.0 to 5.1
RtlDeleteRegistryValue   all
RtlDeleteResource   all
RtlDeleteSecurityObject   all
RtlDeleteTimer   5.0 and higher
RtlDeleteTimerQueue   5.0 and higher
RtlDeleteTimerQueueEx   5.0 and higher
RtlDeleteUmsCompletionList x64 6.1 and higher
RtlDeleteUmsThreadContext x64 6.1 and higher
RtlDequeueUmsCompletionListItems x64 6.1 and higher
RtlDeregisterSecureMemoryCacheCallback   6.0 SP1 and higher
RtlDeregisterWait   5.0 and higher
RtlDeregisterWaitEx   5.0 and higher
RtlDeriveCapabilitySidsFromName   10.0 and higher
RtlDestroyAtomTable   4.0 and higher
RtlDestroyEnvironment   all
RtlDestroyHandleTable   4.0 and higher
RtlDestroyHeap   all
RtlDestroyMemoryBlockLookaside   6.0 and higher
RtlDestroyMemoryZone   6.0 and higher
RtlDestroyProcessParameters   all
RtlDestroyQueryDebugBuffer   3.51 and higher
RtlDetectHeapLeaks   6.1 and higher
RtlDetermineDosPathNameType_U   all
RtlDisableThreadProfiling   6.1 and higher
RtlDispatchAPC (8)   6.1 and higher
RtlDllShutdownInProgress   5.1 and higher
RtlDnsHostNameToComputerName   5.0 and higher
RtlDoesFileExists_U   all
RtlDosApplyFileIsolationRedirection_Ustr   5.1 and higher
RtlDosPathNameToNtPathName_U   all
RtlDosPathNameToNtPathName_U_WithStatus   5.2 SP1 and higher
RtlDosPathNameToRelativeNtPathName_U   5.2 and higher
RtlDosPathNameToRelativeNtPathName_U_WithStatus   5.2 SP1 and higher
RtlDosSearchPath_U   all
RtlDosSearchPath_Ustr   5.1 and higher
RtlDowncaseUnicodeChar   5.1 and higher
RtlDowncaseUnicodeString   4.0 and higher
RtlDumpResource   all
RtlDuplicateUnicodeString   5.1 and higher
RtlEmptyAtomTable   4.0 and higher
RtlEnableEarlyCriticalSectionEventCreation   5.0 and higher
RtlEnableThreadProfiling   6.1 and higher
RtlEncodePointer   5.1 SP2 and higher;
5.2 SP1 and higher;
6.0 and higher
RtlEncodeRemotePointer   10.0 and higher
RtlEncodeSystemPointer   5.1 SP2 and higher;
5.2 SP1 and higher;
6.0 and higher
RtlEndEnumerationHashTable   6.1 and higher
RtlEndStrongEnumerationHashTable   10.0 and higher
RtlEndWeakEnumerationHashTable   6.1 and higher
RtlEnlargedIntegerMultiply x86 all
RtlEnlargedUnsignedDivide x86 3.10 to 6.1
RtlEnlargedUnsignedMultiply x86 all
RtlEnterCriticalSection   all
RtlEnterUmsSchedulingMode x64 6.1 and higher
RtlEnumProcessHeaps   3.51 and higher
RtlEnumerateEntryHashTable   6.1 and higher
RtlEnumerateGenericTable   all
RtlEnumerateGenericTableAvl   5.1 and higher
RtlEnumerateGenericTableLikeADirectory   5.1 and higher
RtlEnumerateGenericTableWithoutSplaying   all
RtlEnumerateGenericTableWithoutSplayingAvl   5.1 and higher
RtlEnumerateProperties   4.0 only
RtlEqualComputerName   all
RtlEqualDomainName   all
RtlEqualLuid   all
RtlEqualPrefixSid   all
RtlEqualSid   all
RtlEqualString   all
RtlEqualUnicodeString   all
RtlEqualWnfChangeStamps   6.2 and higher
RtlEraseUnicodeString   all
RtlEthernetAddressToStringA   6.1 and higher
RtlEthernetAddressToStringW   6.1 and higher
RtlEthernetStringToAddressA   6.1 and higher
RtlEthernetStringToAddressW   6.1 and higher
RtlExecuteUmsThread x64 6.1 and higher
RtlExitUserProcess   6.0 and higher
RtlExitUserThread   5.1 and higher
RtlExpandEnvironmentStrings   3.10 only;
then 6.0 and higher
RtlExpandEnvironmentStrings_U   all
RtlExpandHashTable   6.1 and higher
RtlExtendHeap   3.51 to 5.2
RtlExtendMemoryBlockLookaside   6.0 and higher
RtlExtendMemoryZone   6.0 and higher
RtlExtendedIntegerMultiply x86 all
RtlExtendedLargeIntegerDivide x86 all
RtlExtendedMagicDivide x86 all
RtlExtractBitMap   6.2 and higher
RtlFillMemory   all
RtlFillMemoryUlong x86 all
RtlFillMemoryUlonglong x86 6.1 and higher
RtlFinalReleaseOutOfProcessMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlFindAceByType   6.0 and higher
RtlFindActivationContextSectionGuid   5.1 and higher
RtlFindActivationContextSectionString   5.1 and higher
RtlFindCharInUnicodeString   5.1 and higher
RtlFindClearBits   all
RtlFindClearBitsAndSet   all
RtlFindClearRuns   5.1 and higher
RtlFindClosestEncodableLength   6.0 and higher
RtlFindLastBackwardRunClear   5.0 and higher
RtlFindLeastSignificantBit   5.0 and higher
RtlFindLongestRunClear   all
RtlFindLongestRunSet   3.10 to 4.0
RtlFindMessage   all
RtlFindMostSignificantBit   5.0 and higher
RtlFindNextForwardRunClear   5.0 and higher
RtlFindRange   5.0 to 5.1
RtlFindSetBits   all
RtlFindSetBitsAndClear   all
RtlFindUnicodeSubstring   10.0 and higher
RtlFirstEntrySList   5.1 and higher
RtlFirstFreeAce   all
RtlFlsAlloc   6.0 and higher
RtlFlsFree   6.0 and higher
RtlFlushHeaps   6.2 and higher
RtlFlushPropertySet   4.0 only
RtlFlushSecureMemoryCache   5.1 and higher
RtlFormatCurrentUserKeyPath   3.50 and higher
RtlFormatMessage   all
RtlFormatMessageEx   5.2 SP1 and higher
RtlFreeActivationContextStack   5.2 SP1 and higher
RtlFreeAnsiString   all
RtlFreeHandle   4.0 and higher
RtlFreeHeap   all
RtlFreeMemoryBlockLookaside   6.0 and higher
RtlFreeOemString   all
RtlFreeRangeList   5.0 to 5.1
RtlFreeSid   all
RtlFreeThreadActivationContextStack   5.1 and higher
RtlFreeUnicodeString   all
RtlFreeUserStack   6.0 and higher
RtlFreeUserThreadStack   4.0 to 5.2
RtlGUIDFromString   5.0 and higher
RtlGenerate8dot3Name   all
RtlGetAce   all
RtlGetActiveActivationContext   5.1 and higher
RtlGetAppContainerNamedObjectPath   6.2 and higher
RtlGetAppContainerParent   6.3 and higher
RtlGetAppContainerSidType   6.3 and higher
RtlGetCallersAddress   all
RtlGetCompressionWorkSpaceSize   3.50 and higher
RtlGetControlSecurityDescriptor   all
RtlGetCriticalSectionRecursionCount   5.2 SP1 and higher
RtlGetCurrentDirectory_U   all
RtlGetCurrentPeb   5.1 and higher
RtlGetCurrentProcessorNumber   5.2 SP1 and higher
RtlGetCurrentProcessorNumberEx   6.1 and higher
RtlGetCurrentTransaction   6.0 and higher
RtlGetCurrentUmsThread x64 6.1 and higher
RtlGetDaclSecurityDescriptor   all
RtlGetDeviceFamilyInfoEnum   10.0 and higher
RtlGetElementGenericTable   all
RtlGetElementGenericTableAvl   5.1 and higher
RtlGetEnabledExtendedFeatures   6.1 and higher
RtlGetExepath   6.2 and higher
RtlGetExtendedContextLength   6.1 and higher
RtlGetExtendedFeaturesMask   6.1 and higher
RtlGetFileMUIPath   6.0 and higher
RtlGetFirstRange   5.0 to 5.1
RtlGetFrame   5.1 and higher
RtlGetFullPathName_U   all
RtlGetFullPathname_UEx   6.1 and higher
RtlGetFullPathName_UstrEx   5.2 and higher
RtlGetFunctionTableListHead x64 all
RtlGetGroupSecurityDescriptor   all
RtlGetIntegerAtom   6.0 and higher
RtlGetHandleValueHeap   3.10 only
RtlGetHeapUserValue   3.10 only
RtlGetInterruptTimePrecise   10.0 and higher
RtlGetLastNtStatus   5.1 and higher
RtlGetLastWin32Error   5.1 and higher
RtlGetLengthWithoutLastFullDosOrNtPathElement   5.1 and higher
RtlGetLengthWithoutTrailingPathSeperators   5.1 and higher
RtlGetLocaleFileMappingAddress   6.1 and higher
RtlGetLongestNtPathLength   3.51 and higher
RtlGetNativeSystemInformation   5.1 and higher
RtlGetNextEntryHashTable   6.1 and higher
RtlGetNextRange   5.0 to 5.1
RtlGetNextUmsListItem x64 6.1 and higher
RtlGetNtGlobalFlags   all
RtlGetNtProductType   all
RtlGetNtVersionNumbers   5.1 and higher
RtlGetOwnerSecurityDescriptor   all
RtlGetParentLocaleName   6.0 and higher
RtlGetProcessHeaps   3.51 and higher
RtlGetProcessPreferredUILanguages   6.1 and higher
RtlGetProductInfo   6.0 and higher
RtlGetSaclSecurityDescriptor   all
RtlGetSearchPath   6.2 and higher
RtlGetSecurityDescriptorRMControl   5.0 and higher
RtlGetSetBootStatusData   5.1 and higher
RtlGetSystemPreferredUILanguages   6.0 and higher
RtlGetSystemTimePrecise   6.2 and higher
RtlGetThreadErrorMode   5.2 and higher
RtlGetThreadLangIdByIndex   6.0 and higher
RtlGetThreadPreferredUILanguages   6.0 and higher
RtlGetUILanguageInfo   6.0 and higher
RtlGetUmsCompletionListEvent x64 6.1 and higher
RtlGetUnloadEventTrace   5.1 SP2 and higher
RtlGetUnloadEventTraceEx   6.0 and higher
RtlGetUserFlagsHeap   3.50 only
RtlGetUserValueHeap   3.50 only
RtlGetUserInfoHeap   3.51 and higher
RtlGetUserPreferredUILanguages   6.0 and higher
RtlGetVersion   5.0 and higher
RtlGrowFunctionTable x64 6.2 and higher
RtlGuidToPropertySetName   4.0 only
RtlHashUnicodeString   5.1 and higher
RtlHeapTrkInitialize   6.0 and higher
RtlIdentifierAuthoritySid   all
RtlIdnToAscii   6.0 and higher
RtlIdnToNameprepUnicode   6.0 and higher
RtlIdnToUnicode   6.0 and higher
RtlImageDirectoryEntryToData   all
RtlImageNtHeader   all
RtlImageNtHeaderEx   5.2 and higher
RtlImageRvaToSection   4.0 and higher
RtlImageRvaToVa   4.0 and higher
RtlImpersonateLpcClient   5.0 only
RtlImpersonateSelf   all
RtlImpersonateSelfEx   6.0 and higher
RtlInitAnsiString   all
RtlInitAnsiStringEx   5.2 and higher
RtlInitBarrier   6.0 and higher
RtlInitCodePageTable   all
RtlInitEnumerationHashTable   6.1 and higher
RtlInitMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlInitNlsTables   all
RtlInitOutOfProcessMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlInitString   all
RtlInitStringEx   10.0 and higher
RtlInitStrongEnumerationHashTable   10.0 and higher
RtlInitUnicodeString   all
RtlInitUnicodeStringEx   5.1 and higher
RtlInitWeakEnumerationHashTable   6.1 and higher
RtlInitializeAtomPackage   4.0 and higher
RtlInitializeBitMap   all
RtlInitializeConditionVariable   6.0 and higher
RtlInitializeContext   all
RtlInitializeCriticalSection   all
RtlInitializeCriticalSectionAndSpinCount   4.0 SP3 and higher
RtlInitializeCriticalSectionEx   6.0 and higher
RtlInitializeExceptionChain x86 6.0 SP1 and higher
RtlInitializeExtendedContext   6.1 and higher
RtlInitializeGenericTable   all
RtlInitializeGenericTableAvl   5.1 and higher
RtlInitializeHandleTable   4.0 and higher
RtlInitializeNtUserPfn   6.0 and higher
RtlInitializeProfile   3.10 only
RtlInitializeRXact   all
RtlInitializeRangeList   5.0 to 5.1
RtlInitializeResource   all
RtlInitializeSListHead   5.1 and higher
RtlInitializeSRWLock   6.0 and higher
RtlInitializeSid   all
RtlInitializeSidEx   10.0 and higher
RtlInitializeStackTraceDataBase   3.10 only;
then 5.1 SP2 to 5.2
RtlInsertElementGenericTable   all
RtlInsertElementGenericTableAvl   5.1 and higher
RtlInsertElementGenericTableFull   5.2 and higher
RtlInsertElementGenericTableFullAvl   5.2 and higher
RtlInsertEntryHashTable   6.1 and higher
RtlInstallFunctionTableCallback x64 all
RtlInt64ToUnicodeString   5.0 and higher
RtlIntegerToChar   all
RtlIntegerToUnicodeString   all
RtlInterlockedClearBitRun   6.1 and higher
RtlInterlockedCompareExchange64 x86 5.2 and higher
RtlInterlockedFlushSList   5.1 and higher
RtlInterlockedPopEntrySList   5.1 and higher
RtlInterlockedPushEntrySList   5.1 and higher
RtlInterlockedPushListSList   5.1 and higher
RtlInterlockedPushListSListEx   6.2 and higher
RtlInterlockedSetBitRun   6.1 and higher
RtlInvertRangeList   5.0 to 5.1
RtlIoDecodeMemIoResource   6.0 and higher
RtlIoEncodeMemIoResource   6.0 and higher
RtlIpv4AddressToStringA   5.1 and higher
RtlIpv4AddressToStringExA   5.1 SP2 and higher
RtlIpv4AddressToStringExW   5.1 SP2 and higher
RtlIpv4AddressToStringW   5.1 and higher
RtlIpv4StringToAddressA   5.1 and higher
RtlIpv4StringToAddressExA   5.1 SP2 and higher
RtlIpv4StringToAddressExW   5.1 SP2 and higher
RtlIpv4StringToAddressW   5.1 and higher
RtlIpv6AddressToStringA   5.1 and higher
RtlIpv6AddressToStringExA   5.1 SP2 and higher
RtlIpv6AddressToStringExW   5.1 SP2 and higher
RtlIpv6AddressToStringW   5.1 and higher
RtlIpv6StringToAddressA   5.1 and higher
RtlIpv6StringToAddressExA   5.1 SP2 and higher
RtlIpv6StringToAddressExW   5.1 SP2 and higher
RtlIpv6StringToAddressW   5.1 and higher
RtlIsActivationContextActive   5.1 and higher
RtlIsCapabilitySid   6.2 and higher
RtlIsCriticalSectionLocked   5.2 SP1 and higher
RtlIsCriticalSectionLockedByThread   5.2 SP1 and higher
RtlIsCurrentThreadAttachExempt   6.0 and higher
RtlIsDosDeviceName_U   all
RtlIsGenericTableEmpty   all
RtlIsGenericTableEmptyAvl   5.1 and higher
RtlIsMultiSessionSku   10.0 and higher
RtlIsNameInExpression   6.1 and higher
RtlIsNameLegalDOS8Dot3   3.51 and higher
RtlIsNormalizedString   6.0 and higher
RtlIsPackageSid   6.2 and higher
RtlIsParentOfChildAppContainer   6.3 and higher
RtlIsProcessorFeaturePresent   10.0 and higher
RtlIsRangeAvailable   5.0 to 5.1
RtlIsTextUnicode   3.50 and higher
RtlIsThreadWithinLoaderCallout   5.1 SP1 and higher
RtlIsUntrustedObject   6.2 and higher
RtlIsValidHandle   4.0 and higher
RtlIsValidIndexHandle   4.0 and higher
RtlIsValidLocaleName   6.0 and higher
RtlIsValidProcessTrustLabelSid   6.3 and higher
RtlKnownExceptionFilter   6.1 and higher
RtlLCIDToCultureName   6.0 and higher
RtlLargeIntegerAdd x86 all
RtlLargeIntegerArithmeticShift x86 all
RtlLargeIntegerDivide x86 all
RtlLargeIntegerNegate x86 all
RtlLargeIntegerShiftLeft x86 all
RtlLargeIntegerShiftRight x86 all
RtlLargeIntegerSubtract x86 all
RtlLargeIntegerToChar   all
RtlLcidToLocaleName   6.0 and higher
RtlLeaveCriticalSection   all
RtlLengthRequiredSid   all
RtlLengthSecurityDescriptor   all
RtlLengthSid   all
RtlLengthSidAsUnicodeString   6.2 and higher
RtlLoadString   6.1 and higher
RtlLocalTimeToSystemTime   all
RtlLocaleNameToLcid   6.0 and higher
RtlLocateExtendedFeature   6.1 and higher
RtlLocateLegacyContext   6.1 and higher
RtlLockBootStatusData   5.1 and higher
RtlLockCurrentThread   6.0 and higher
RtlLockHeap   all
RtlLockMemoryBlockLookaside   6.0 and higher
RtlLockMemoryStreamRegion x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlLockMemoryZone   6.0 and higher
RtlLockModuleSection   6.0 and higher
RtlLogStackBackTrace   3.10 only;
then 5.1 and higher
RtlLookupAtomInAtomTable   4.0 and higher
RtlLookupElementGenericTable   all
RtlLookupElementGenericTableAvl   5.1 and higher
RtlLookupElementGenericTableFull   5.2 and higher
RtlLookupElementGenericTableFullAvl   5.2 and higher
RtlLookupEntryHashTable   6.1 and higher
RtlLookupFunctionEntry x64 all
RtlLookupFunctionTable x64 all
RtlLookupSymbolByAddress   3.10 only
RtlLookupSymbolByName   3.10 only
RtlMakeSelfRelativeSD   all
RtlMapGenericMask   all
RtlMapSecurityErrorToNtStatus   5.1 and higher
RtlMergeRangeLists   5.0 to 5.1
RtlMoveMemory   all
RtlMultiAppendUnicodeStringBuffer   5.1 and higher
RtlMultiByteToUnicodeN   all
RtlMultiByteToUnicodeSize   all
RtlMultipleAllocateHeap   5.2 and higher
RtlMultipleFreeHeap   5.2 and higher
RtlNewInstanceSecurityObject   all
RtlNewSecurityGrantedAccess   all
RtlNewSecurityObject   all
RtlNewSecurityObjectEx   5.0 and higher
RtlNewSecurityObjectWithMultipleInheritance   5.1 and higher
RtlNormalizeProcessParams   all
RtlNormalizeString   6.0 and higher
RtlNtPathNameToDosPathName   5.1 and higher
RtlNtStatusToDosError   all
RtlNtStatusToDosErrorNoTeb   5.1 and higher
RtlNtdllName x64 6.0 and higher
RtlNumberGenericTableElements   all
RtlNumberGenericTableElementsAvl   5.1 and higher
RtlNumberOfClearBits   all
RtlNumberOfClearBitsInRange   6.2 and higher
RtlNumberOfSetBits   all
RtlNumberOfSetBitsInRange   6.2 and higher
RtlNumberOfSetBitsUlongPtr   6.0 SP1 and higher
RtlOemStringToUnicodeSize   all
RtlOemStringToUnicodeString   all
RtlOemToUnicodeN   all
RtlOnMappedStreamEvent   4.0 SP2 to SP6
RtlOpenCurrentUser   all
RtlOsDeploymentState   10.0 and higher
RtlOwnerAcesPresent   6.0 and higher
RtlPcToFileHeader   all
RtlPinAtomInAtomTable   4.0 and higher
RtlPopFrame   5.1 and higher
RtlPrefixString   all
RtlPrefixUnicodeString   all
RtlPrepareForProcessCloning x64 6.0 and higher
RtlProcessFlsData   6.0 and higher
RtlPropertySetNameToGuid   4.0 only
RtlProtectHeap   3.51 and higher
RtlPublishWnfStateData   6.2 and higher
RtlPushFrame   5.1 and higher
RtlQueryActivationContextApplicationSettings   6.0 and higher
RtlQueryAtomInAtomTable   4.0 and higher
RtlQueryCriticalSectionOwner   6.0 and higher
RtlQueryDepthSList   5.1 and higher
RtlQueryDynamicTimeZoneInformation   6.0 and higher
RtlQueryElevationFlags   6.0 and higher
RtlQueryEnvironmentVariable   3.10 only;
then 6.0 and higher
RtlQueryEnvironmentVariable_U   all
RtlQueryHeapInformation   5.1 and higher
RtlQueryInformationAcl   all
RtlQueryInformationActivationContext   5.1 and higher
RtlQueryInformationActiveActivationContext   5.1 and higher
RtlQueryInterfaceMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlQueryModuleInformation   3.10 only;
then 6.0 and higher
RtlQueryPackageClaims   10.0 and higher
RtlQueryPackageIdentity   6.2 and higher
RtlQueryPackageIdentityEx   6.3 and higher
RtlQueryPerformanceCounter   6.1 and higher
RtlQueryPerformanceFrequency   6.1 and higher
RtlQueryProcessBackTraceInformation   all
RtlQueryProcessDebugInformation   3.51 and higher
RtlQueryProcessHeapInformation   all
RtlQueryProcessLockInformation   all
RtlQueryProperties   4.0 only
RtlQueryPropertyNames   4.0 only
RtlQueryPropertySet   4.0 only
RtlQueryProtectedPolicy   10.0 and higher
RtlQueryRegistryValues   all
RtlQueryRegistryValuesEx   6.2 and higher
RtlQueryResourcePolicy   6.3 Update and higher
RtlQuerySecurityObject   all
RtlQueryTagHeap   3.51 and higher
RtlQueryThreadProfiling   6.1 and higher
RtlQueryTimeZoneInformation   all
RtlQueryUmsThreadInformation x64 6.1 and higher
RtlQueryUnbiasedInterruptTime   6.2 and higher
RtlQueryValidationRunlevel   6.2 and higher
RtlQueryWnfMetaNotification   6.2 and higher
RtlQueryWnfStateData   6.2 and higher
RtlQueryWnfStateDataWithExplicitScope   6.2 and higher
RtlQueueApcWow64Thread   5.1 and higher
RtlQueueWorkItem   5.0 and higher
RtlRaiseException   all
RtlRaiseStatus   all
RtlRandom   all
RtlRandomEx   5.1 and higher
RtlRbInsertNodeEx   6.2 and higher
RtlRbRemoveNode   6.2 and higher
RtlReAllocateHeap   all
RtlReadMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlReadOutOfProcessMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlReadThreadProfilingData   6.1 and higher
RtlRealPredecessor   all
RtlRealSuccessor   all
RtlRegisterForWnfMetaNotification   6.2 and higher
RtlRegisterSecureMemoryCacheCallback   5.1 and higher
RtlRegisterThreadWithCsrss   6.0 and higher
RtlRegisterWait   5.0 and higher
RtlReleaseActivationContext   5.1 and higher
RtlReleaseMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlReleasePath   6.2 and higher
RtlReleasePebLock   all
RtlReleasePrivilege   5.2 SP1 and higher
RtlReleaseRelativeName   5.2 and higher
RtlReleaseResource   all
RtlReleaseSRWLockExclusive   6.0 and higher
RtlReleaseSRWLockShared   6.0 and higher
RtlRemoteCall   all
RtlRemoveEntryHashTable   6.1 and higher
RtlRemovePrivileges   6.0 and higher
RtlRemoveVectoredContinueHandler   5.2 SP1 and higher
RtlRemoveVectoredExceptionHandler   5.1 and higher
RtlReplaceSidInSd   6.1 and higher
RtlReportException   6.0 and higher
RtlReportSilentProcessExit   6.1 and higher
RtlReportSqmEscalation   6.1 and higher
RtlResetMemoryBlockLookaside   6.0 and higher
RtlResetMemoryZone   6.0 and higher
RtlResetNtUserPfn   6.2 and higher
RtlResetRtlTranslations   all
RtlRestoreContext x64 all
RtlRestoreLastWin32Error   5.1 and higher
RtlRetrieveNtUserPfn   6.0 and higher
RtlRevertMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlRunDecodeUnicodeString   all
RtlRunEncodeUnicodeString   all
RtlRunOnceBeginInitialize   6.0 and higher
RtlRunOnceComplete   6.0 and higher
RtlRunOnceExecuteOnce   6.0 and higher
RtlRunOnceInitialize   6.0 and higher
RtlSecondsSince1970ToTime   all
RtlSecondsSince1980ToTime   all
RtlSeekMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlSelfRelativeToAbsoluteSD   all
RtlSelfRelativeToAbsoluteSD2   5.0 and higher
RtlSendMsgToSm   6.0 and higher
RtlSetAllBits   all
RtlSetAttributesSecurityDescriptor   4.0 and higher
RtlSetBit   6.2 and higher
RtlSetBits   all
RtlSetControlSecurityDescriptor   5.0 and higher
RtlSetCriticalSectionSpinCount   4.0 SP3 and higher
RtlSetCurrentDirectory_U   all
RtlSetCurrentEnvironment   all
RtlSetCurrentTransaction   6.0 and higher
RtlSetDaclSecurityDescriptor   all
RtlSetDynamicTimeZoneInformation   6.0 and higher
RtlSetEnvironmentStrings   5.2 and higher
RtlSetEnvironmentVar   6.0 and higher
RtlSetEnvironmentVariable   all
RtlSetExtendedFeaturesMask   6.1 and higher
RtlSetGroupSecurityDescriptor   all
RtlSetHeapInformation   5.1 and higher
RtlSetHandleValueHeap   3.10 only
RtlSetHeapUserValue   3.10 only
RtlSetInformationAcl   all
RtlSetIoCompletionCallback   5.0 and higher
RtlSetLastWin32Error   5.1 and higher
RtlSetLastWin32ErrorAndNtStatusFromNtStatus   5.1 and higher
RtlSetMemoryStreamSize x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlSetOwnerSecurityDescriptor   all
RtlSetPortableOperatingSystem   6.2 and higher
RtlSetProcessDebugInformation   6.0 and higher
RtlSetProcessIsCritical   5.1 and higher
RtlSetProcessPreferredUILanguages   6.1 and higher
RtlSetProperties   4.0 only
RtlSetPropertyNames   4.0 only
RtlSetPropertySetClassId   4.0 only
RtlSetProtectedPolicy   10.0 and higher
RtlSetSaclSecurityDescriptor   all
RtlSetSearchPathMode   6.2 and higher
RtlSetSecurityDescriptorRMControl   5.0 and higher
RtlSetSecurityObject   all
RtlSetSecurityObjectEx   5.0 and higher
RtlSetThreadErrorMode   5.2 and higher
RtlSetThreadIsCritical   5.1 and higher
RtlSetThreadPoolStartFunc   5.0 and higher
RtlSetThreadPreferredUILanguages   6.0 and higher
RtlSetThreadSubProcessTag   10.0 and higher
RtlSetTimeZoneInformation   all
RtlSetTimer   5.0 and higher
RtlSetUmsThreadInformation x64 6.1 and higher
RtlSetUnhandledExceptionFilter   5.2 SP1 and higher
RtlSetUnicodeCallouts   4.0 to 5.2
RtlSetUserCallbackExceptionFilter wow64 6.0 SP1 and higher
RtlSetUserFlagsHeap   3.50 and higher
RtlSetUserValueHeap   3.50 and higher
RtlShutdownLpcServer   5.0 only
RtlSidDominates   6.0 and higher
RtlSidDominatesForTrust   6.3 and higher
RtlSidEqualLevel   6.0 and higher
RtlSidHashInitialize   6.0 and higher
RtlSidHashLookup   6.0 and higher
RtlSidIsHigherLevel   6.0 and higher
RtlSizeHeap   all
RtlSleepConditionVariableCS   6.0 and higher
RtlSleepConditionVariableSRW   6.0 and higher
RtlSnapshotHeap   3.10 only
RtlSplay   all
RtlStartProfile   3.10 only
RtlStartRXact   all
RtlStopProfile   3.10 only
RtlStatMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlStringFromGUID   5.0 and higher
RtlStringFromGUIDEx   6.3 and higher
RtlStronglyEnumerateEntryHashTable   10.0 and higher
RtlSubAuthorityCountSid   all
RtlSubAuthoritySid   all
RtlSubscribeWnfStateChangeNotification   6.2 and higher
RtlSubtreePredecessor   all
RtlSubtreeSuccessor   all
RtlSwitchedVVI   10.0 and higher
RtlSystemTimeToLocalTime   all
RtlTestAndPublishWnfStateData   6.2 and higher
RtlTestBit   6.0 and higher
RtlTestProtectedAccess   6.3 and higher
RtlTimeFieldsToTime   all
RtlTimeToElapsedTimeFields   all
RtlTimeToSecondsSince1970   all
RtlTimeToSecondsSince1980   all
RtlTimeToTimeFields   all
RtlTraceDatabaseAdd   5.0 SP1 and higher
RtlTraceDatabaseCreate   s5.0 SP1 and higher
RtlTraceDatabaseDestroy   5.0 SP1 and higher
RtlTraceDatabaseEnumerate   5.0 SP1 and higher
RtlTraceDatabaseFind   5.0 SP1 and higher
RtlTraceDatabaseLock   5.0 SP1 and higher
RtlTraceDatabaseUnlock   5.0 SP1 and higher
RtlTraceDatabaseValidate   5.0 SP1 and higher
RtlTryAcquirePebLock   6.0 and higher
RtlTryAcquireSRWLockExclusive   6.1 and higher
RtlTryAcquireSRWLockShared   6.1 and higher
RtlTryConvertSRWLockSharedToExclusiveOrRelease   6.2 and higher
RtlTryEnterCriticalSection   4.0 and higher
RtlUTF8ToUnicodeN   6.1 and higher
RtlUlongByteSwap x86 5.0 and higher
RtlUlonglongByteSwap x86 5.0 and higher
RtlUmsThreadYield x64 6.1 and higher
RtlUnhandledExceptionFilter   5.1 and higher
RtlUnhandledExceptionFilter2   5.1 and higher
RtlUnicodeStringToAnsiSize   all
RtlUnicodeStringToAnsiString   all
RtlUnicodeStringToCountedOemString   all
RtlUnicodeStringToInteger   all
RtlUnicodeStringToOemSize   all
RtlUnicodeStringToOemString   all
RtlUnicodeToCustomCPN   all
RtlUnicodeToMultiByteN   all
RtlUnicodeToMultiByteSize   all
RtlUnicodeToOemN   all
RtlUnicodeToUTF8N   6.1 and higher
RtlUniform   all
RtlUnlockBootStatusData   5.1 and higher
RtlUnlockCurrentThread   6.0 and higher
RtlUnlockHeap   all
RtlUnlockMemoryBlockLookaside   6.0 and higher
RtlUnlockMemoryStreamRegion x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlUnlockMemoryZone   6.0 and higher
RtlUnlockModuleSection   6.0 and higher
RtlUnsubscribeWnfNotificationWaitForCompletion   6.2 and higher
RtlUnsubscribeWnfNotificationWithCompletionCallback   6.2 and higher
RtlUnsubscribeWnfChangeNotification   6.2 and higher
RtlUnwind   all
RtlUnwindEx x64 all
RtlUpcaseUnicodeChar   all
RtlUpcaseUnicodeString   all
RtlUpcaseUnicodeStringToAnsiString   all
RtlUpcaseUnicodeStringToCountedOemString   all
RtlUpcaseUnicodeStringToOemString   all
RtlUpcaseUnicodeToCustomCPN   all
RtlUpcaseUnicodeToMultiByteN   all
RtlUpcaseUnicodeToOemN   all
RtlUpdateClonedCriticalSection   6.0 and higher
RtlUpdateClonedSRWLock   6.0 and higher
RtlUpdateTimer   5.0 and higher
RtlUpperChar   all
RtlUpperString   all
RtlUsageHeap   3.51 to 5.2
RtlUserThreadStart   6.0 and higher
RtlUshortByteSwap x86 5.0 and higher
RtlValidAcl   all
RtlValidProcessProtection   6.3 and higher
RtlValidRelativeSecurityDescriptor   5.0 and higher
RtlValidSecurityDescriptor   all
RtlValidSid   all
RtlValidateHeap   all
RtlValidateProcessHeaps   3.51 and higher
RtlValidateUnicodeString   5.1 and higher
RtlVerifyVersionInfo   5.0 and higher
RtlVirtualUnwind x64 all
RtlWaitForWnfMetaNotification   6.2 and higher
RtlWaitOnAddress   6.2 and higher
RtlWakeAddressAll   6.2 and higher
RtlWakeAddressAllNoFence   6.2 and higher
RtlWakeAddressSingle   6.2 and higher
RtlWakeAddressSingleNoFence   6.2 and higher
RtlWakeAllConditionVariable   6.0 and higher
RtlWakeConditionVariable   6.0 and higher
RtlWalkFrameChain   5.0 and higher
RtlWalkHeap   3.50 and higher
RtlWeaklyEnumerateEntryHashTable   6.1 and higher
RtlWerpReportException   6.0 and higher
RtlWnfCompareChangeStamp   6.2 and higher
RtlWnfDllUnloadCallback   6.2 and higher
RtlWoW64GetCpuAreaInfo x64 10.0 and higher
RtlWoW64GetCurrentCpuArea x64 10.0 and higher
RtlWow64CallFunction64   6.0 and higher
RtlWow64EnableFsRedirection   5.2 and higher
RtlWow64EnableFsRedirectionEx   5.2 SP1 and higher
RtlWow64GetThreadContext x64 6.0 and higher
RtlWow64GetThreadSelectorEntry x64 6.1 and higher
RtlWow64LogMessageInEventLogger x64 and wow64 6.0 and higher
RtlWow64SetThreadContext x64 6.0 and higher
RtlWow64SuspendThread x64 6.0 and higher
RtlWow64SuspendThreadEx x64 10.0 and higher
RtlWriteMemoryStream x86 and x64 5.1 and higher
wow64 6.0 and higher
RtlWriteRegistryValue   all
RtlZeroHeap   3.50 and higher
RtlZeroMemory   all
RtlZombifyActivationContext   5.1 and higher
RtlpApplyLengthFunction   5.1 and higher
RtlpCheckDynamicTimeZoneInformation   6.0 SP1 and higher
RtlpCleanupRegistryKeys   6.0 and higher
RtlpConvertAbsoluteToRelativeSecurityAttribute   6.2 and higher
RtlpConvertCultureNamesToLCIDs   6.0 and higher
RtlpConvertLCIDsToCultureNames   6.0 and higher
RtlpConvertRelativeToAbsoluteSecurityAttribute   6.2 and higher
RtlpCreateProcessRegistryInfo   6.0 and higher
RtlpEnsureBufferSize   5.1 and higher
RtlpExecuteUmsThread x64 6.1 and higher
RtlpFreezeTimeBias   6.2 and higher
RtlpGetDeviceFamilyInfoEnum   10.0 and higher
RtlpGetLCIDFromLangInfoNode   6.0 and higher
RtlpGetNameFromLangInfoNode   6.0 and higher
RtlpGetSystemDefaultUILanguage   6.0 and higher
RtlpGetUserOrMachineUILanguage4NLS   6.0 and higher
RtlpInitializeLangRegistryInfo   6.0 and higher
RtlpInitializeRtl   3.10 to 3.51
RtlpInterlockedPopEntrySeqSListEnd wow64 6.0 SP2 and higher
RtlpInterlockedPopEntrySeqSListFault wow64 6.0 SP2 and higher
RtlpInterlockedPopEntrySeqSListResume wow64 6.0 SP2 and higher
RtlpIsQualifiedLanguage   6.0 and higher
RtlpLoadMachineUIByPolicy   6.0 and higher
RtlpLoadUserUIByPolicy   6.0 and higher
RtlpMergeSecurityAttributeInformation   6.2 and higher
RtlpMuiFreeLangRegistryInfo   6.0 and higher
RtlpMuiRegCreateRegistryInfo   6.0 and higher
RtlpMuiRegFreeRegistryInfo   6.0 and higher
RtlpMuiRegLoadRegistryInfo   6.0 and higher
RtlpNotOwnerCriticalSection   5.1 and higher
RtlpNtCreateKey   all
RtlpNtEnumerateSubKey   all
RtlpNtMakeTemporaryKey   all
RtlpNtOpenKey   all
RtlpNtQueryValueKey   all
RtlpNtSetValueKey   all
RtlpQueryDefaultUILanguage   6.0 and higher
RtlpQueryProcessDebugInformationFromWow64 x64 6.0 and higher
RtlpQueryProcessDebugInformationRemote wow64 6.0 and higher
RtlpRefreshCachedUILanguage   6.0 and higher
RtlpSetInstallLanguage   6.0 and higher
RtlpSetPreferredUILanguages   6.0 and higher
RtlpSetUserPreferredUILanguages   6.0 and higher
RtlpUmsExecuteYieldThreadEnd x64 6.1 and higher
RtlpUmsThreadYield x64 6.1 and higher
RtlpUnWaitCriticalSection   all
RtlpVerifyAndCommitUILanguageSettings   6.0 and higher
RtlpWaitForCriticalSection   all
RtlpWnfNotificationThread   6.2 only
RtlxAnsiStringToUnicodeSize   3.50 and higher
RtlxOemStringToUnicodeSize   3.50 and higher
RtlxUnicodeStringToAnsiSize   3.50 and higher
RtlxUnicodeStringToOemSize   3.50 and higher
SaveEm87Context   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
SbExecuteProcedure   6.1 and higher
SbSelectProcedure   6.1 and higher
SbtDisableForCurrentProcess (5)   6.1 to 6.3
SbtLogDllMapping (6)   6.1 to 6.3
SbtLogExeInitializing (7)   6.1 to 6.3
SbtLogSystemUsageByParent (3)   6.1 to 6.3
SbtLogSystemUsageByStack (4)   6.1 to 6.3
ShipAssert   6.0 and higher
ShipAssertGetBufferInfo   6.0 and higher
ShipAssertMsgA   6.0 and higher
ShipAssertMsgW   6.0 and higher
TpAllocAlpcCompletion   6.0 and higher
TpAllocAlpcCompletionEx   6.1 and higher
TpAllocCleanupGroup   6.0 and higher
TpAllocIoCompletion   6.0 and higher
TpAllocJobNotification   6.2 and higher
TpAllocPool   6.0 and higher
TpAllocTimer   6.0 and higher
TpAllocWait   6.0 and higher
TpAllocWork   6.0 and higher
TpAlpcRegisterCompletionList   6.1 and higher
TpAlpcUnregisterCompletionList   6.1 and higher
TpCallbackDetectedUnrecoverableError   6.2 and higher
TpCallbackIndependent   6.1 and higher
TpCallbackLeaveCriticalSectionOnCompletion   6.0 and higher
TpCallbackMayRunLong   6.0 and higher
TpCallbackReleaseMutexOnCompletion   6.0 and higher
TpCallbackReleaseSemaphoreOnCompletion   6.0 and higher
TpCallbackSendAlpcMessageOnCompletion   6.3 and higher
TpCallbackSendPendingAlpcMessage   6.3 and higher
TpCallbackSetEventOnCompletion   6.0 and higher
TpCallbackUnloadDllOnCompletion   6.0 and higher
TpCancelAsyncIoOperation   6.0 and higher
TpCaptureCaller   6.0 and higher
TpCheckTerminateWorker   6.0 and higher
TpDbgDumpHeapUsage   6.0 and higher
TpDbgGetFreeInfo   6.1 only
TpDbgSetLogRoutine   6.0 and higher
TpDisablePoolCallbackChecks   6.1 and higher
TpDisassociateCallback   6.0 and higher
TpIsTimerSet   6.0 and higher
TpPoolFreeUnusedNodes   6.1 only
TpPostWork   6.0 and higher
TpQueryPoolStackInformation   6.1 and higher
TpReleaseAlpcCompletion   6.0 and higher
TpReleaseCleanupGroup   6.0 and higher
TpReleaseCleanupGroupMembers   6.0 and higher
TpReleaseIoCompletion   6.0 and higher
TpReleaseJobNotification   6.2 and higher
TpReleasePool   6.0 and higher
TpReleaseTimer   6.0 and higher
TpReleaseWait   6.0 and higher
TpReleaseWork   6.0 and higher
TpSetDefaultPoolMaxThreads   6.1 and higher
TpSetDefaultPoolStackInformation   6.1 and higher
TpSetPoolMaxThreads   6.0 and higher
TpSetPoolMaxThreadsSoftLimit   10.0 and higher
TpSetPoolMinThreads   6.0 and higher
TpSetPoolStackInformation   6.1 and higher
TpSetPoolThreadBasePriority   6.2 and higher
TpSetPoolWorkerThreadIdleTimeout   10.0 and higher
TpSetTimer   6.0 and higher
TpSetTimerEx   6.2 and higher
TpSetWait   6.0 and higher
TpSetWaitEx   6.2 and higher
TpSimpleTryPost   6.0 and higher
TpStartAsyncIoOperation   6.0 and higher
TpTimerOutstandingCallbackCount   6.2 and higher
TpTrimPools   6.3 Update and higher
TpWaitForAlpcCompletion   6.0 and higher
TpWaitForIoCompletion   6.0 and higher
TpWaitForJobNotification   6.2 and higher
TpWaitForTimer   6.0 and higher
TpWaitForWait   6.0 and higher
TpWaitForWork   6.0 and higher
VerSetConditionMask   5.0 and higher
WerCheckEventEscalation   6.0 only
WerReportSQMEvent   6.0 and higher
WerReportWatsonEvent   6.0 only
WinSqmAddToAverageDWORD   6.1 and higher
WinSqmAddToStream   6.0 and higher
WinSqmAddToStreamEx   6.1 and higher
WinSqmCheckEscalationAddToStreamEx   6.1 and higher
WinSqmCheckEscalationSetDWORD   6.1 and higher
WinSqmCheckEscalationSetDWORD64   6.1 and higher
WinSqmCheckEscalationSetString   6.1 and higher
WinSqmCommonDatapointDelete   6.1 and higher
WinSqmCommonDatapointSetDWORD   6.1 and higher
WinSqmCommonDatapointSetDWORD64   6.1 and higher
WinSqmCommonDatapointSetStreamEx   6.1 and higher
WinSqmCommonDatapointSetString   6.1 and higher
WinSqmEndSession   6.0 and higher
WinSqmEventEnabled   6.0 and higher
WinSqmEventWrite   6.0 and higher
WinSqmGetEscalationRuleStatus   6.1 and higher
WinSqmGetInstrumentationProperty   6.1 and higher
WinSqmIncrementDWORD   6.1 and higher
WinSqmIsOptedIn   6.0 and higher
WinSqmIsOptedInEx   6.1 and higher
WinSqmIsSessionDisabled   6.2 and higher
WinSqmSetDWORD   6.1 and higher
WinSqmSetDWORD64   6.1 and higher
WinSqmSetEscalationInfo   6.1 and higher
WinSqmSetIfMaxDWORD   6.1 and higher
WinSqmSetIfMinDWORD   6.1 and higher
WinSqmSetString   6.0 and higher
WinSqmStartSession   6.0 and higher
WinSqmStartSessionForPartner   6.3 and higher
WinSqmStartSqmOptinListener   10.0 and higher
ZwAcceptConnectPort   all
ZwAccessCheck   all
ZwAccessCheckAndAuditAlarm   all
ZwAccessCheckByType   5.0 and higher
ZwAccessCheckByTypeAndAuditAlarm   5.0 and higher
ZwAccessCheckByTypeResultList   5.0 and higher
ZwAccessCheckByTypeResultListAndAuditAlarm   5.0 and higher
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle   5.0 and higher
ZwAcquireCMFViewOwnership   6.0 only
ZwAddAtom   4.0 and higher
ZwAddAtomEx   6.2 and higher
ZwAddBootEntry   5.1 and higher
ZwAddDriverEntry   5.2 and higher
ZwAdjustGroupsToken   all
ZwAdjustPrivilegesToken   all
ZwAdjustTokenClaimsAndDeviceGroups   6.2 and higher
ZwAlertResumeThread   all
ZwAlertThread   all
ZwAlertThreadByThreadId   6.2 and higher
ZwAllocateLocallyUniqueId   all
ZwAllocateReserveObject   6.1 and higher
ZwAllocateUserPhysicalPages   5.0 and higher
ZwAllocateUuids   3.51 and higher
ZwAllocateVirtualMemory   all
ZwAlpcAcceptConnectPort   6.0 and higher
ZwAlpcCancelMessage   6.0 and higher
ZwAlpcConnectPort   6.0 and higher
ZwAlpcConnectPortEx   6.2 and higher
ZwAlpcCreatePort   6.0 and higher
ZwAlpcCreatePortSection   6.0 and higher
ZwAlpcCreateResourceReserve   6.0 and higher
ZwAlpcCreateSectionView   6.0 and higher
ZwAlpcCreateSecurityContext   6.0 and higher
ZwAlpcDeletePortSection   6.0 and higher
ZwAlpcDeleteResourceReserve   6.0 and higher
ZwAlpcDeleteSectionView   6.0 and higher
ZwAlpcDeleteSecurityContext   6.0 and higher
ZwAlpcDisconnectPort   6.0 and higher
ZwAlpcImpersonateClientContainerOfPort   10.0 and higher
ZwAlpcImpersonateClientOfPort   6.0 and higher
ZwAlpcOpenSenderProcess   6.0 and higher
ZwAlpcOpenSenderThread   6.0 and higher
ZwAlpcQueryInformation   6.0 and higher
ZwAlpcQueryInformationMessage   6.0 and higher
ZwAlpcRevokeSecurityContext   6.0 and higher
ZwAlpcSendWaitReceivePort   6.0 and higher
ZwAlpcSetInformation   6.0 and higher
ZwApphelpCacheControl   5.2 and higher
ZwAreMappedFilesTheSame   5.0 and higher
ZwAssignProcessToJobObject   5.0 and higher
ZwAssociateWaitCompletionPacket   6.2 and higher
ZwCallbackReturn   3.51 and higher
ZwCancelDeviceWakeupRequest   5.0 to 6.0
ZwCancelIoFile   all
ZwCancelIoFileEx   6.0 and higher
ZwCancelSynchronousIoFile   6.0 and higher
ZwCancelTimer   all
ZwCancelTimer2   6.3 and higher
ZwCancelWaitCompletionPacket   6.2 and higher
ZwClearAllSavepointsTransaction   6.0 before SP1
ZwClearEvent   3.50 and higher
ZwClearSavepointTransaction   6.0 before SP1
ZwClose   all
ZwCloseObjectAuditAlarm   all
ZwCommitComplete   6.0 and higher
ZwCommitEnlistment   6.0 and higher
ZwCommitTransaction   6.0 and higher
ZwCompactKeys   5.1 and higher
ZwCompareObjects   10.0 and higher
ZwCompareTokens   5.1 and higher
ZwCompleteConnectPort   all
ZwCompressKey   5.1 and higher
ZwConnectPort   all
ZwContinue   all
ZwCreateChannel   4.0 to 5.0
ZwCreateDebugObject   5.1 and higher
ZwCreateDirectoryObject   all
ZwCreateDirectoryObjectEx   6.2 and higher
ZwCreateEnlistment   6.0 and higher
ZwCreateEvent   all
ZwCreateEventPair   all
ZwCreateFile   all
ZwCreateIRTimer   6.2 and higher
ZwCreateIoCompletion   3.50 and higher
ZwCreateJobObject   5.0 and higher
ZwCreateJobSet   5.1 and higher
ZwCreateKey   all
ZwCreateKeyTransacted   6.0 and higher
ZwCreateKeyedEvent   5.1 and higher
ZwCreateLowBoxToken   6.2 and higher
ZwCreateMailslotFile   all
ZwCreateMutant   all
ZwCreateNamedPipeFile   all
ZwCreatePagingFile   all
ZwCreatePartition   10.0 and higher
ZwCreatePort   all
ZwCreatePrivateNamespace   6.0 and higher
ZwCreateProcess   all
ZwCreateProcessEx   5.1 and higher
ZwCreateProfile   all
ZwCreateProfileEx   6.1 and higher
ZwCreateResourceManager   6.0 and higher
ZwCreateSection   all
ZwCreateSemaphore   all
ZwCreateSymbolicLinkObject   all
ZwCreateThread   all
ZwCreateThreadEx   6.0 and higher
ZwCreateTimer   all
ZwCreateTimer2   6.3 and higher
ZwCreateToken   all
ZwCreateTokenEx   6.2 and higher
ZwCreateTransaction   6.0 and higher
ZwCreateTransactionManager   6.0 and higher
ZwCreateUserProcess   6.0 and higher
ZwCreateWaitCompletionPacket   6.2 and higher
ZwCreateWaitablePort   5.0 and higher
ZwCreateWnfStateName   6.2 and higher
ZwCreateWorkerFactory   6.0 and higher
ZwDebugActiveProcess   5.1 and higher
ZwDebugContinue   5.1 and higher
ZwDelayExecution   all
ZwDeleteAtom   4.0 and higher
ZwDeleteBootEntry   5.1 and higher
ZwDeleteDriverEntry   5.2 and higher
ZwDeleteFile   3.50 and higher
ZwDeleteKey   all
ZwDeleteObjectAuditAlarm   4.0 and higher
ZwDeletePrivateNamespace   6.0 and higher
ZwDeleteValueKey   all
ZwDeleteWnfStateData   6.2 and higher
ZwDeleteWnfStateName   6.2 and higher
ZwDeviceIoControlFile   all
ZwDisableLastKnownGood   6.1 and higher
ZwDisplayString   all
ZwDrawText   6.1 and higher
ZwDuplicateObject   all
ZwDuplicateToken   all
ZwEnableLastKnownGood   6.1 and higher
ZwEnumerateBootEntries   5.1 and higher
ZwEnumerateBus   3.51 only
ZwEnumerateDriverEntries   5.2 and higher
ZwEnumerateKey   all
ZwEnumerateSystemEnvironmentValuesEx   5.1 and higher
ZwEnumerateTransactionObject   6.0 and higher
ZwEnumerateValueKey   all
ZwExtendSection   all
ZwFilterBootOption   6.2 and higher
ZwFilterToken   5.0 and higher
ZwFilterTokenEx   6.2 and higher
ZwFindAtom   4.0 and higher
ZwFlushBuffersFile   all
ZwFlushBuffersFileEx   6.2 and higher
ZwFlushInstallUILanguage   6.0 and higher
ZwFlushInstructionCache   all
ZwFlushKey   all
ZwFlushProcessWriteBuffers   6.0 and higher
ZwFlushVirtualMemory   all
ZwFlushWriteBuffer   all
ZwFreeUserPhysicalPages   5.0 and higher
ZwFreeVirtualMemory   all
ZwFreezeRegistry   6.0 and higher
ZwFreezeTransactions   6.0 and higher
ZwFsControlFile   all
ZwGetCachedSigningLevel   6.2 and higher
ZwGetCompleteWnfStateSubscription   6.3 and higher
ZwGetContextThread   3.51 and higher
ZwGetCurrentProcessorNumber   5.2 and higher
ZwGetCurrentProcessorNumberEx   10.0 and higher
ZwGetDevicePowerState   5.0 and higher
ZwGetMUIRegistryInfo   6.0 and higher
ZwGetNextProcess   6.0 and higher
ZwGetNextThread   6.0 and higher
ZwGetNlsSectionPtr   6.0 and higher
ZwGetNotificationResourceManager   6.0 and higher
ZwGetPlugPlayEvent   3.51 to 6.1
ZwGetTickCount   3.10 to 5.0
ZwGetWriteWatch   5.0 and higher
ZwImpersonateAnonymousToken   5.0 and higher
ZwImpersonateClientOfPort   all
ZwImpersonateThread   all
ZwInitializeNlsFiles   6.0 and higher
ZwInitializeRegistry   all
ZwInitializeVDM   3.10 only
ZwInitiatePowerAction   5.0 and higher
ZwIsProcessInJob   5.1 and higher
ZwIsSystemResumeAutomatic   5.0 and higher
ZwIsUILanguageComitted   6.0 and higher
ZwListTransactions   6.0 before SP1
ZwListenChannel   4.0 to 5.0
ZwListenPort   all
ZwLoadDriver   all
ZwLoadKey   all
ZwLoadKey2   4.0 and higher
ZwLoadKeyEx   5.2 and higher
ZwLockFile   all
ZwLockProductActivationKeys   5.1 and higher
ZwLockRegistryKey   5.1 and higher
ZwLockVirtualMemory   all
ZwMakePermanentObject   5.1 and higher
ZwMakeTemporaryObject   all
ZwManagePartition   10.0 and higher
ZwMapCMFModule   6.0 and higher
ZwMapUserPhysicalPages   5.0 and higher
ZwMapUserPhysicalPagesScatter   5.0 and higher
ZwMapViewOfSection   all
ZwMarshallTransaction   6.0 before SP1
ZwModifyBootEntry   5.1 and higher
ZwModifyDriverEntry   5.2 and higher
ZwNotifyChangeDirectoryFile   all
ZwNotifyChangeKey   all
ZwNotifyChangeMultipleKeys   5.0 and higher
ZwNotifyChangeSession   6.1 and higher
ZwOpenChannel   4.0 to 5.0
ZwOpenDirectoryObject   all
ZwOpenEnlistment   6.0 and higher
ZwOpenEvent   all
ZwOpenEventPair   all
ZwOpenFile   all
ZwOpenIoCompletion   3.50 and higher
ZwOpenJobObject   5.0 and higher
ZwOpenKey   all
ZwOpenKeyEx   6.1 and higher
ZwOpenKeyTransacted   6.0 and higher
ZwOpenKeyTransactedEx   6.1 and higher
ZwOpenKeyedEvent   5.1 and higher
ZwOpenMutant   all
ZwOpenObjectAuditAlarm   all
ZwOpenPartition   10.0 and higher
ZwOpenPrivateNamespace   6.0 and higher
ZwOpenProcess   all
ZwOpenProcessToken   all
ZwOpenProcessTokenEx   5.1 and higher
ZwOpenResourceManager   6.0 and higher
ZwOpenSection   all
ZwOpenSemaphore   all
ZwOpenSession   6.0 and higher
ZwOpenSymbolicLinkObject   all
ZwOpenThread   all
ZwOpenThreadToken   all
ZwOpenThreadTokenEx   5.1 and higher
ZwOpenTimer   all
ZwOpenTransaction   6.0 and higher
ZwOpenTransactionManager   6.0 and higher
ZwPlugPlayControl   3.51 and higher
ZwPowerInformation   5.0 and higher
ZwPrePrepareComplete   6.0 and higher
ZwPrePrepareEnlistment   6.0 and higher
ZwPrepareComplete   6.0 and higher
ZwPrepareEnlistment   6.0 and higher
ZwPrivilegeCheck   all
ZwPrivilegeObjectAuditAlarm   all
ZwPrivilegedServiceAuditAlarm   all
ZwPropagationComplete   6.0 and higher
ZwPropagationFailed   6.0 and higher
ZwProtectVirtualMemory   all
ZwPullTransaction   6.0 before SP1
ZwPulseEvent   all
ZwQueryAttributesFile   3.50 and higher
ZwQueryBootEntryOrder   5.1 and higher
ZwQueryBootOptions   5.1 and higher
ZwQueryDebugFilterState   5.1 and higher
ZwQueryDefaultLocale   all
ZwQueryDefaultUILanguage   5.0 and higher
ZwQueryDirectoryFile   all
ZwQueryDirectoryObject   all
ZwQueryDriverEntryOrder   5.2 and higher
ZwQueryEaFile   all
ZwQueryEvent   all
ZwQueryFullAttributesFile   4.0 and higher
ZwQueryInformationAtom   4.0 and higher
ZwQueryInformationEnlistment   6.0 and higher
ZwQueryInformationFile   all
ZwQueryInformationJobObject   5.0 and higher
ZwQueryInformationPort   all
ZwQueryInformationProcess   all
ZwQueryInformationResourceManager   6.0 and higher
ZwQueryInformationThread   all
ZwQueryInformationToken   all
ZwQueryInformationTransaction   6.0 and higher
ZwQueryInformationTransactionManager   6.0 and higher
ZwQueryInformationWorkerFactory   6.0 and higher
ZwQueryInstallUILanguage   5.0 and higher
ZwQueryIntervalProfile   all
ZwQueryIoCompletion   3.50 and higher
ZwQueryKey   all
ZwQueryLicenseValue   6.0 and higher
ZwQueryMultipleValueKey   4.0 and higher
ZwQueryMutant   all
ZwQueryObject   all
ZwQueryOleDirectoryFile   4.0 only
ZwQueryOpenSubKeys   5.0 and higher
ZwQueryOpenSubKeysEx   5.2 and higher
ZwQueryPerformanceCounter   all
ZwQueryPortInformationProcess   5.1 and higher
ZwQueryQuotaInformationFile   5.0 and higher
ZwQuerySection   all
ZwQuerySecurityAttributesToken   6.1 and higher
ZwQuerySecurityObject   all
ZwQuerySemaphore   all
ZwQuerySymbolicLinkObject   all
ZwQuerySystemEnvironmentValue   all
ZwQuerySystemEnvironmentValueEx   5.1 and higher
ZwQuerySystemInformation   all
ZwQuerySystemInformationEx   6.1 and higher
ZwQuerySystemTime   all
ZwQueryTimer   all
ZwQueryTimerResolution   3.50 and higher
ZwQueryValueKey   all
ZwQueryVirtualMemory   all
ZwQueryVolumeInformationFile   all
ZwQueryWnfStateData   6.2 and higher
ZwQueryWnfStateNameInformation   6.2 and higher
ZwQueueApcThread   4.0 and higher
ZwQueueApcThreadEx   6.1 and higher
ZwRaiseException   all
ZwRaiseHardError   all
ZwReadFile   all
ZwReadFileScatter   4.0 SP2 and higher
ZwReadOnlyEnlistment   6.0 and higher
ZwReadRequestData   all
ZwReadVirtualMemory   all
ZwRecoverEnlistment   6.0 and higher
ZwRecoverResourceManager   6.0 and higher
ZwRecoverTransactionManager   6.0 and higher
ZwRegisterNewDevice   3.51 only
ZwRegisterProtocolAddressInformation   6.0 and higher
ZwRegisterThreadTerminatePort   all
ZwReleaseCMFViewOwnership   6.0 only
ZwReleaseKeyedEvent   5.1 and higher
ZwReleaseMutant   all
ZwReleaseProcessMutant   3.10 to 3.51
ZwReleaseSemaphore   all
ZwReleaseWorkerFactoryWorker   6.0 and higher
ZwRemoveIoCompletion   3.50 and higher
ZwRemoveIoCompletionEx   6.0 and higher
ZwRemoveProcessDebug   5.1 and higher
ZwRenameKey   5.1 and higher
ZwRenameTransactionManager   6.0 SP1 and higher
ZwRenameValueKey   3.10 only
ZwReplaceKey   all
ZwReplacePartitionUnit   6.0 SP1 and higher
ZwReplyPort   all
ZwReplyWaitReceivePort   all
ZwReplyWaitReceivePortEx   5.0 and higher
ZwReplyWaitReplyPort   all
ZwReplyWaitSendChannel   4.0 to 5.0
ZwRequestDeviceWakeup   5.0 to 6.0
ZwRequestPort   all
ZwRequestWaitReplyPort   all
ZwRequestWakeupLatency   5.0 to 6.0
ZwResetEvent   all
ZwResetWriteWatch   5.0 and higher
ZwRestoreKey   all
ZwResumeProcess   5.1 and higher
ZwResumeThread   all
ZwRevertContainerImpersonation   10.0 and higher
ZwRollbackComplete   6.0 and higher
ZwRollbackEnlistment   6.0 and higher
ZwRollbackSavepointTransaction   6.0 before SP1
ZwRollbackTransaction   6.0 and higher
ZwRollforwardTransactionManager   6.0 and higher
ZwSaveKey   all
ZwSaveKeyEx   5.1 and higher
ZwSaveMergedKeys   5.0 and higher
ZwSavepointComplete   6.0 before SP1
ZwSavepointTransaction   6.0 before SP1
ZwSecureConnectPort   5.0 and higher
ZwSendWaitReplyChannel   4.0 to 5.0
ZwSerializeBoot   6.1 and higher
ZwSetBootEntryOrder   5.1 and higher
ZwSetBootOptions   5.1 and higher
ZwSetCachedSigningLevel   6.2 and higher
ZwSetContextChannel   4.0 to 5.0
ZwSetContextThread   all
ZwSetDebugFilterState   5.1 and higher
ZwSetDefaultHardErrorPort   all
ZwSetDefaultLocale   all
ZwSetDefaultUILanguage   5.0 and higher
ZwSetDriverEntryOrder   5.2 and higher
ZwSetEaFile   all
ZwSetEvent   all
ZwSetEventBoostPriority   5.1 and higher
ZwSetHighEventPair   all
ZwSetHighWaitLowEventPair   all
ZwSetHighWaitLowThread   3.10 to 4.0
ZwSetIRTimer   6.2 and higher
ZwSetInformationDebugObject   5.1 and higher
ZwSetInformationEnlistment   6.0 and higher
ZwSetInformationFile   all
ZwSetInformationJobObject   5.0 and higher
ZwSetInformationKey   all
ZwSetInformationObject   3.50 and higher
ZwSetInformationProcess   all
ZwSetInformationResourceManager   6.0 and higher
ZwSetInformationSymbolicLink   10.0 and higher
ZwSetInformationThread   all
ZwSetInformationToken   all
ZwSetInformationTransaction   6.0 and higher
ZwSetInformationTransactionManager   6.0 and higher
ZwSetInformationVirtualMemory   6.2 and higher
ZwSetInformationWorkerFactory   6.0 and higher
ZwSetIntervalProfile   all
ZwSetIoCompletion   3.51 and higher
ZwSetIoCompletionEx   6.1 and higher
ZwSetLdtEntries   all
ZwSetLowEventPair   all
ZwSetLowWaitHighEventPair   all
ZwSetLowWaitHighThread   3.10 to 4.0
ZwSetQuotaInformationFile   5.0 and higher
ZwSetSecurityObject   all
ZwSetSystemEnvironmentValue   all
ZwSetSystemEnvironmentValueEx   5.1 and higher
ZwSetSystemInformation   3.50 and higher
ZwSetSystemPowerState   3.51 and higher
ZwSetSystemTime   all
ZwSetThreadExecutionState   5.0 and higher
ZwSetTimer   all
ZwSetTimer2   6.3 and higher
ZwSetTimerEx   6.1 and higher
ZwSetTimerResolution   3.50 and higher
ZwSetUuidSeed   5.0 and higher
ZwSetValueKey   all
ZwSetVolumeInformationFile   all
ZwSetWnfProcessNotificationEvent   6.3 and higher
ZwShutdownSystem   all
ZwShutdownWorkerFactory   6.0 and higher
ZwSignalAndWaitForSingleObject   4.0 and higher
ZwSinglePhaseReject   6.0 and higher
ZwStartProfile   all
ZwStartTm   6.0 before SP1
ZwStopProfile   all
ZwSubscribeWnfStateChange   6.2 and higher
ZwSuspendProcess   5.1 and higher
ZwSuspendThread   all
ZwSystemDebugControl   all
ZwTerminateJobObject   5.0 and higher
ZwTerminateProcess   all
ZwTerminateThread   all
ZwTestAlert   all
ZwThawRegistry   6.0 and higher
ZwThawTransactions   6.0 and higher
ZwTraceControl   6.0 and higher
ZwTraceEvent   5.1 and higher
ZwTranslateFilePath   5.1 and higher
ZwUmsThreadYield   6.1 and higher
ZwUnloadDriver   all
ZwUnloadKey   all
ZwUnloadKey2   5.2 and higher
ZwUnloadKeyEx   5.1 and higher
ZwUnlockFile   all
ZwUnlockVirtualMemory   all
ZwUnmapViewOfSection   all
ZwUnmapViewOfSectionEx   6.2 and higher
ZwUnsubscribeWnfStateChange   6.2 and higher
ZwUpdateWnfStateData   6.2 and higher
ZwVdmControl   all
ZwVdmStartExecution   3.10 only
ZwW32Call   3.51 to 4.0 SP3
ZwWaitForAlertByThreadId   6.2 and higher
ZwWaitForDebugEvent   5.1 and higher
ZwWaitForKeyedEvent   5.1 and higher
ZwWaitForMultipleObjects   all
ZwWaitForMultipleObjects32   5.2 SP1 and higher
ZwWaitForProcessMutant   3.10 to 3.51
ZwWaitForSingleObject   all
ZwWaitForWnfNotifications   6.2 only
ZwWaitForWorkViaWorkerFactory   6.0 and higher
ZwWaitHighEventPair   all
ZwWaitLowEventPair   all
ZwWorkerFactoryWorkerReady   6.0 and higher
ZwWow64AllocateVirtualMemory64 wow64 6.2 and higher
ZwWow64CallFunction64 wow64 6.0 and higher
ZwWow64CsrAllocateCaptureBuffer wow64 all
ZwWow64CsrAllocateMessagePointer wow64 all
ZwWow64CsrCaptureMessageBuffer wow64 all
ZwWow64CsrCaptureMessageString wow64 all
ZwWow64CsrClientCallServer wow64 all
ZwWow64CsrClientConnectToServer wow64 all
ZwWow64CsrFreeCaptureBuffer wow64 all
ZwWow64CsrGetProcessId wow64 all
ZwWow64CsrIdentifyAlertableThread wow64 all
ZwWow64CsrNewThread wow64 5.2 SP1 to 6.0 before SP1
ZwWow64CsrSetPriorityClass wow64 5.2 SP1 to 6.0 before SP1
ZwWow64CsrVerifyRegion wow64 6.0 and higher
ZwWow64DebuggerCall wow64 all
ZwWow64GetCurrentProcessorNumberEx wow64 6.1 and higher
ZwWow64GetNativeSystemInformation wow64 all
ZwWow64InterlockedPopEntrySList wow64 6.1 only
ZwWow64IsProcessorFeaturePresent wow64 10.0 and higher
ZwWow64QueryInformationProcess64 wow64 all
ZwWow64QueryVirtualMemory64 wow64 5.2 SP1 to 6.3
ZwWow64ReadVirtualMemory64 wow64 all
ZwWow64WriteVirtualMemory64 wow64 6.0 and higher
ZwWriteFile   all
ZwWriteFileGather   4.0 SP2 and higher
ZwWriteRequestData   all
ZwWriteVirtualMemory   all
ZwYieldExecution   4.0 and higher
_CIcos x86 5.1 and higher
_CIlog x86 5.1 and higher
_CIpow x86 3.50 and higher
_CIsin x86 5.1 and higher
_CIsqrt x86 5.1 and higher
_ResCGetRegistryFlags   6.0 before SP1
_ResCMatchFlags   6.0 before SP1
_ResCSaveRegistryFlags   6.0 before SP1
__C_specific_handler x64 all
__chkstk x64 all
__eCommonExceptions   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eEmulatorInit   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eF2XM1   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFABS   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFADD32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFADD64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFADDPreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFADDreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFADDtop   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFCHS   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFCOM   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFCOM32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFCOM64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFCOMP   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFCOMP32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFCOMP64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFCOMPP   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFCOS   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFDECSTP   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFDIV32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFDIV64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFDIVPreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFDIVR32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFDIVR64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFDIVRPreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFDIVRreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFDIVRtop   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFDIVreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFDIVtop   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFFREE   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFIADD16   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFIADD32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFICOM16   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFICOM32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFICOMP16   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFICOMP32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFIDIV16   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFIDIV32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFIDIVR16   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFIDIVR32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFILD16   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFILD32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFILD64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFIMUL16   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFIMUL32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFINCSTP   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFINIT   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFIST16   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFIST32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFISTP16   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFISTP32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFISTP64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFISUB16   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFISUB32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFISUBR16   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFISUBR32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFLD1   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFLD32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFLD64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFLD80   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFLDCW   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFLDENV   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFLDL2E   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFLDLN2   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFLDPI   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFLDZ   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFMUL32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFMUL64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFMULPreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFMULreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFMULtop   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFPATAN   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFPREM   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFPREM1   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFPTAN   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFRNDINT   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFRSTOR   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSAVE   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSCALE   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSIN   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSQRT   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFST   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFST32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFST64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSTCW   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSTENV   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSTP   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSTP32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSTP64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSTP80   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSTSW   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSUB32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSUB64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSUBPreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSUBR32   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSUBR64   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSUBRPreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSUBRreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSUBRtop   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSUBreg   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFSUBtop   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFTST   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFUCOM   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFUCOMP   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFUCOMPP   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFXAM   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFXCH   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFXTRACT   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFYL2X   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eFYL2XP1   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__eGetStatusWord   3.10 to 5.0;
5.1 before SP2;
5.2 before SP1
__isascii   4.0 and higher
__iscsym   4.0 and higher
__iscsymf   4.0 and higher
__misaligned_access x64 all
__toascii   4.0 and higher
_abnormal_termination   3.50 only
_alldiv x86 4.0 and higher
_alldvrm x86 5.1 and higher
_allmul x86 4.0 and higher
_alloca_probe x86 3.51 and higher
_alloca_probe_16 x86 6.0 and higher
_alloca_probe_8 x86 6.0 and higher
_allrem x86 4.0 and higher
_allshl x86 4.0 and higher
_allshr x86 4.0 and higher
_atoi64   4.0 and higher
_aulldiv x86 4.0 and higher
_aulldvrm x86 5.1 and higher
_aullrem x86 4.0 and higher
_aullshr x86 4.0 and higher
_chkstk x86 3.50 and higher
_errno   6.2 and higher
_except_handler2   3.50 only
_except_handler4_common x86 6.2 and higher
_fltused   3.50 and higher
_ftol x86 3.50 and higher
ftol2 x86 6.2 and higher
ftol2_sse x86 6.2 and higher
_global_unwind2   3.50 only
_i64toa   4.0 and higher
_i64toa_s   6.1 and higher
_i64tow   4.0 and higher
_i64tow_s   6.1 and higher
_itoa   3.50 and higher
_itoa_s   6.1 and higher
_itow   4.0 and higher
_itow_s   6.1 and higher
_lfind   5.1 and higher
_local_unwind x64 all
_local_unwind2   3.50 only
_local_unwind4 x86 6.2 and higher
_ltoa   3.50 and higher
_ltoa_s   6.1 and higher
_ltow   4.0 and higher
_ltow_s   6.1 and higher
_makepath_s   6.1 and higher
_memccpy   3.50 and higher
_memicmp   3.50 and higher
_setjmp x64 all
_setjmpex x64 all
_snprintf   3.50 and higher
_snprintf_s   6.1 and higher
_snscanf_s   6.1 and higher
_snwprintf   3.50 and higher
_snwprintf_s   6.1 and higher
_snwscanf_s   6.1 and higher
_splitpath   3.50 and higher
_splitpath_s   6.1 and higher
_strcmpi   3.50 and higher
_stricmp   3.50 and higher
_strlwr   3.50 and higher
_strlwr_s   6.2 and higher
_strnicmp   3.50 and higher
_strnset_s   6.1 and higher
_strset_s   6.1 and higher
_strupr   3.50 and higher
_strupr_s   6.2 and higher
_swprintf   6.0 and higher
_tolower   4.0 to 5.2
_toupper   4.0 to 5.2
_ui64toa   5.0 and higher
_ui64toa_s   6.1 and higher
_ui64tow   5.1 and higher
_ui64tow_s   6.1 and higher
_ultoa   3.50 and higher
_ultoa_s   6.1 and higher
_ultow   4.0 and higher
_ultow_s   6.1 and higher
_vscwprintf   5.2 and higher
_vsnprintf   3.50 and higher
_vsnprintf_s   6.1 and higher
_vsnwprintf   5.1 and higher
_vsnwprintf_s   6.1 and higher
_vswprintf   6.0 and higher
_wcsicmp   3.50 and higher
_wcslwr   3.50 and higher
_wcslwr_s   6.2 and higher
_wcsnicmp   3.50 and higher
_wcsnset_s   6.1 and higher
_wcsset_s   6.1 and higher
_wcstoi64   6.2 and higher
_wcstoui64   5.2 and higher
_wcsupr   3.50 and higher
_wcsupr_s   6.2 and higher
_wmakepath_s   6.1 and higher
_wsplitpath_s   6.1 and higher
_wtoi   4.0 and higher
_wtoi64   4.0 and higher
_wtol   4.0 and higher
abs   3.50 and higher
atan   3.50 and higher
atan2   10.0 and higher
atoi   3.50 and higher
atol   3.50 and higher
bsearch   5.1 and higher
ceil   3.50 and higher
cos   3.50 and higher
fabs   3.50 and higher
floor   3.50 and higher
isalnum   4.0 and higher
isalpha   3.50 and higher
iscntrl   4.0 and higher
isdigit   3.50 and higher
isgraph   4.0 and higher
islower   3.50 and higher
isprint   3.50 and higher
ispunct   4.0 and higher
isspace   3.50 and higher
isupper   3.50 and higher
iswalnum   6.2 and higher
iswalpha   3.50 and higher
iswascii   6.2 and higher
iswctype   3.50 and higher
iswdigit   5.0 and higher
iswgraph   6.2 and higher
iswlower   5.0 and higher
iswprint   6.2 and higher
iswspace   5.0 and higher
iswxdigit   5.0 and higher
isxdigit   3.50 and higher
labs   3.50 and higher
log   3.50 and higher
longjmp x64 all
mbstowcs   3.50 and higher
memchr   3.50 and higher
memcmp   3.50 and higher
memcpy   3.50 and higher
memcpy_s   6.1 and higher
memmove   3.50 and higher
memmove_s   6.1 and higher
memset   3.50 and higher
pow   3.50 and higher
qsort   3.50 and higher
qsort_s   6.2 and higher
sin   3.50 and higher
sprintf   3.50 and higher
sprintf_s   6.1 and higher
sqrt   3.50 and higher
sscanf   3.50 and higher
sscanf_s   6.1 and higher
strcat   3.50 and higher
strcat_s   6.1 and higher
strchr   3.50 and higher
strcmp   3.50 and higher
strcpy   3.50 and higher
strcpy_s   6.1 and higher
strcspn   3.50 and higher
strlen   3.50 and higher
strncat   3.50 and higher
strncat_s   6.1 and higher
strncmp   3.50 and higher
strncpy   3.50 and higher
strncpy_s   6.1 and higher
strnlen   6.1 and higher
strpbrk   3.50 and higher
strrchr   3.50 and higher
strspn   3.50 and higher
strstr   3.50 and higher
strtok_s   6.1 and higher
strtol   4.0 and higher
strtoul   4.0 and higher
swprintf   3.50 and higher
swprintf_s   6.1 and higher
swscanf_s   6.1 and higher
tan   3.50 and higher
tolower   3.50 and higher
toupper   3.50 and higher
towlower   3.50 and higher
towupper   3.50 and higher
vDbgPrintEx   5.1 and higher
vDbgPrintExWithPrefix   5.1 and higher
vsprintf   3.50 and higher
vsprintf_s   6.1 and higher
vswprintf_s   6.1 and higher
wcscat   3.50 and higher
wcscat_s   6.1 and higher
wcschr   3.50 and higher
wcscmp   3.50 and higher
wcscpy   3.50 and higher
wcscpy_s   6.1 and higher
wcscspn   3.50 and higher
wcslen   3.50 and higher
wcsncat   3.50 and higher
wcsncat_s   6.1 and higher
wcsncmp   3.50 and higher
wcsncpy   3.50 and higher
wcsncpy_s   6.1 and higher
wcsnlen   6.1 and higher
wcspbrk   3.50 and higher
wcsrchr   3.50 and higher
wcsspn   3.50 and higher
wcsstr   3.50 and higher
wcstok   3.50 to 3.51
wcstok_s   6.2 and higher
wcstol   3.50 and higher
wcstombs   3.50 and higher
wcstoul   3.50 and higher
xRtlDosPathNameToNtPathName   3.10 only


Function names are reproduced from the export directory of the NTDLL.DLL executable. All exports from NTDLL are by name, until Windows 7 introduces a few that are exported only by ordinal. Names for these few are inferred from symbol files that Microsoft supplies for customer support. The ordinal is given in parentheses immediately after the function’s name.

A few exports are of variables rather than functions. They are marked above by the word “data” in parentheses. These notes talk of all as functions, hoping no confusion will be caused by such loose terminology.

Since experience shows that this table is not always read with the knowledge of an advanced programmer, it must be stressed that a function’s presence in the export directory does not mean that the function is implemented non-trivially, let alone that it will work satisfactorily if called. It means just that the function can be imported by other modules, and be called by them, for better or worse. That a function is first exported in some version does not mean that Microsoft supports its use in that version, even if such support is documented for later versions.


The NTDLL versions shown for each function are inferred from a study of public releases such as I have managed to find on old MSDN discs or have downloaded from Microsoft’s websites (whether free or requiring what is nowadays called a Visual Studio subscription). My holdings are incomplete and I anyway have no time for or interest in examining pre-release builds or hotfixes.

Of necessity then, the table makes what I hope are reasonable assumptions about likely continuity, especially to suppose that a function will exist in future versions or that a function exists in all builds of a version if no counter-example is yet known. If you want more accurate or comprehensive information, try getting it from Microsoft.

A quick list of the studied versions, each understood to mean the original and a selection of service packs, is:

Documentation Status

As sketched above for the colour coding, very few NTDLL functions are documented as being exported from NTDLL. Finding these few is difficult enough since what documentation does exist is scattered. That a function is colur-coded above as undocumented does not mean for certain that Microsoft does not document it (or declare it in some header), just that I haven’t yet found where.

Worse, the documentation status of NTDLL functions cannot be left just with whether Microsoft documents them as being exported from NTDLL. Many NTDLL functions are sort-of documented, by other means in other guises, such that they cannot properly be ruled undocumented. There are several mechanisms at play.

Higher-Level Documentation

Many an NTDLL function has a higher-level function, often with a different name, that corresponds to it more or less closely. The higher-level functions, typically in KERNEL32.DLL or ADVAPI32.DLL, usually are documented—most exist as the bread and butter of Win32 programming—but identifying them all is not straightforward.

The easy ones to find are not actually coded in the higher-level module but are exported from the higher-level module merely as forwards to NTDLL. These can be enumerated completely just from a mechanical examination of the higher-level DLL’s export directory, but even they are not entirely well-defined, most notably for varying with the version.

Other functions are coded in the higher-level module but very simply, e.g., as a jump to the code in NTDLL, or in some other way such that the NTDLL function provides the whole implementation of the higher-level function. These are enumerated only by inspecting the code, and I do not imagine I will ever do this anywhere near to completely even for one version.

If a function that is not formally documented as being exported from NTDLL falls into either of these cases and is documented as being exported from the higher-level DLL, then I do not count it as an undocumented NTDLL export. If the higher-level function has a different name, then the difference is a bit much to convey meaningfully in this summary: refer to the more detailed Remarks in the function’s listing by version.

For many more NTDLL functions, the higher-level function re-dresses the NTDLL function, typically to take arguments in a different form or to return a different type, yet the correspondence remains close enough that calling the one rather than the other loses little or no functionality (though the higher-level function is generally to be preferred on architectural grounds). For these, it is not entirely satisfactory to call the NTDLL function undocumented if the higher-level one is documented, but neither is the correspondence in all such cases close enough to justify saying that the NTDLL function is documented in effect. To say one way or the other would be subjective beyond usefulness, and I leave these cases alone.

WDK Documentation

Most of the many NTDLL functions whose names begin with Nt or Zw are just calls to the NT kernel in ring 0 through a software interrupt or other mechanism such as the sysenter instruction. The ring 0 code that is reached this way may also be exported from the NT kernel (often just with the Zw prefix) so that it can be imported by other ring 0 code such as device drivers and installable file systems. Some, but by no means all, of these lower-level functions are documented in the WDK, with the Zw prefix for use from kernel mode and Nt for use from user mode.

A similar outcome through different means is presented by the many NTDLL functions whose names begin with Rtl. They are implemented more or less completely in NTDLL but many have duplicate implementations in the ring 0 kernel. Some differ slightly. Some are identical, apparently from being coded in libraries for static linking into both the kernel and NTDLL. Though the WDK documentation presents these functions only for their use in ring 0, it looks to be equally applicable when they are called as NTDLL functions.

It may be that Microsoft always intended that NTDLL is documented in the WDK (if at all) rather than the SDK, such that what little has shown in the SDK is a leakage of internal detail.

CRT Documentation

Finally, NTDLL exports more than 100 functions from the C Run-Time (CRT) Library. Some are not documented even for the CRT because in practice all calls to them are generated by the compiler, but most are the sort of utility functions that no C or C++ programmer would want to be without. None have the compiler-version dependencies that might otherwise steer the programmer to static linking or to importing from an MSVCRT.DLL that varies with the Visual Studio version and might not be available at run time on any given computer. The programmer may anyway be working at too low a level even for importing from the Windows-supplied MSVCRT.DLL (not that Microsoft is known to have encouraged this technique). Importing these utility functions from NTDLL.DLL is the lowest-level option. The CRT documentation is good for them as exports from NTDLL even without formally saying so.