Author: Mateusz "j00ru" Jurczyk (j00ru.vx tech blog)
Team Vexillium
| ActivateActCtx | |
| AddRefActCtx | |
| AddResourceAttributeAce | |
| AddSIDToBoundaryDescriptor | |
| AddScopedPolicyIDAce | |
| AdjustTokenDeviceClaims | |
| AdjustTokenDeviceGroups | |
| AdjustTokenUserClaims | |
| AllocConsole | |
| AttachConsole | |
| BaseCheckAppcompatCache | |
| BaseCheckAppcompatCacheEx | |
| BaseCleanupAppcompatCacheSupport | |
| BaseDumpAppcompatCache | |
| BaseFlushAppcompatCache | |
| BaseInitAppcompatCacheSupport | |
| BaseIsAppcompatInfrastructureDisabled | |
| BaseMarkFileForDelete | |
| BaseUpdateAppcompatCache | |
| BasepAdjustObjectAttributesForPrivateNamespace | |
| BasepCopyFileCallback | |
| BasepCopyFileExW | |
| BasepNotifyTrackingService | |
| CLOSE_LOCAL_HANDLE_INTERNAL | |
| CallbackDetectedUnrecoverableError | |
| CancelIo | |
| CancelSynchronousIo | |
| CharLowerA | |
| CharLowerBuffA | |
| CharLowerBuffW | |
| CharLowerW | |
| CharNextA | |
| CharNextExA | |
| CharNextW | |
| CharPrevA | |
| CharPrevExA | |
| CharPrevW | |
| CharUpperA | |
| CharUpperBuffA | |
| CharUpperBuffW | |
| CharUpperW | |
| CheckTokenCapability | |
| CheckTokenMembershipEx | |
| ChrCmpIA | |
| ChrCmpIW | |
| ClearCommBreak | |
| ClearCommError | |
| ClosePrivateNamespace | |
| CloseTrace | |
| ContinueDebugEvent | |
| ControlTraceA | |
| ControlTraceW | |
| CopyFileExW | |
| CreateActCtxW | |
| CreateBoundaryDescriptorW | |
| CreateConsoleScreenBuffer | |
| CreateDirectoryExW | |
| CreateFile2 | |
| CreateHardLinkW | |
| CreateMemoryResourceNotification | |
| CreatePrivateNamespaceW | |
| CreateProcessA | |
| CreateProcessAsUserW | |
| CreateProcessInternalA | |
| CreateProcessInternalW | |
| CreateProcessW | |
| CreateSymbolicLinkW | |
| CtrlRoutine | |
| DeactivateActCtx | |
| DebugActiveProcess | |
| DebugActiveProcessStop | |
| DelayLoadFailureHook | |
| DelayLoadFailureHookLookup | |
| DeleteBoundaryDescriptor | |
| DeleteSynchronizationBarrier | |
| DisablePredefinedHandleTableInternal | |
| DsBindWithSpnExW | |
| DsCrackNamesW | |
| DsFreeDomainControllerInfoW | |
| DsFreeNameResultW | |
| DsFreePasswordCredentials | |
| DsGetDomainControllerInfoW | |
| DsMakePasswordCredentialsW | |
| DsUnBindW | |
| EmptyWorkingSet | |
| EnableTraceEx2 | |
| EnterCriticalPolicySectionInternal | |
| EnterSynchronizationBarrier | |
| EnumDeviceDrivers | |
| EnumDynamicTimeZoneInformation | |
| EnumPageFilesA | |
| EnumPageFilesW | |
| EnumProcessModules | |
| EnumProcessModulesEx | |
| EnumProcesses | |
| EnumResourceLanguagesExA | |
| EnumResourceLanguagesExW | |
| EnumResourceNamesExA | |
| EnumResourceNamesExW | |
| EnumResourceTypesExA | |
| EnumResourceTypesExW | |
| EnumSystemFirmwareTables | |
| EnumerateTraceGuidsEx | |
| EnumerateTraces | |
| EscapeCommFunction | |
| EventAccessControl | |
| EventAccessQuery | |
| EventAccessRemove | |
| EventActivityIdControl | |
| EventEnabled | |
| EventProviderEnabled | |
| EventRegister | |
| EventSetInformation | |
| EventUnregister | |
| EventWrite | |
| EventWriteEx | |
| EventWriteString | |
| EventWriteTransfer | |
| FillConsoleOutputAttribute | |
| FillConsoleOutputCharacterA | |
| FillConsoleOutputCharacterW | |
| FindActCtxSectionGuid | |
| FindActCtxSectionStringW | |
| FlushConsoleInputBuffer | |
| FlushInstructionCache | |
| ForceSyncFgPolicyInternal | |
| FreeConsole | |
| FreeGPOListInternalA | |
| FreeGPOListInternalW | |
| GenerateConsoleCtrlEvent | |
| GenerateGPNotificationInternal | |
| GetAcceptLanguagesA | |
| GetAcceptLanguagesW | |
| GetAdjustObjectAttributesForPrivateNamespaceRoutine | |
| GetAppContainerAce | |
| GetAppContainerNamedObjectPath | |
| GetApplicationRecoveryCallback | |
| GetApplicationRestartSettings | |
| GetAppliedGPOListInternalA | |
| GetAppliedGPOListInternalW | |
| GetCommConfig | |
| GetCommMask | |
| GetCommModemStatus | |
| GetCommProperties | |
| GetCommState | |
| GetCommTimeouts | |
| GetConsoleCP | |
| GetConsoleCursorInfo | |
| GetConsoleInputExeNameA | |
| GetConsoleInputExeNameW | |
| GetConsoleMode | |
| GetConsoleOutputCP | |
| GetConsoleScreenBufferInfo | |
| GetConsoleScreenBufferInfoEx | |
| GetConsoleTitleW | |
| GetCurrentActCtx | |
| GetCurrentThreadStackLimits | |
| GetDateFormatA | |
| GetDateFormatEx | |
| GetDateFormatW | |
| GetDeviceDriverBaseNameA | |
| GetDeviceDriverBaseNameW | |
| GetDeviceDriverFileNameA | |
| GetDeviceDriverFileNameW | |
| GetDynamicTimeZoneInformationEffectiveYears | |
| GetEightBitStringToUnicodeSizeRoutine | |
| GetEightBitStringToUnicodeStringRoutine | |
| GetFileInformationByHandleEx | |
| GetFileVersionInfoByHandle | |
| GetFileVersionInfoExA | |
| GetFileVersionInfoExW | |
| GetFileVersionInfoSizeExA | |
| GetFileVersionInfoSizeExW | |
| GetGPOListInternalA | |
| GetGPOListInternalW | |
| GetLargePageMinimum | |
| GetLargestConsoleWindowSize | |
| GetMappedFileNameA | |
| GetMappedFileNameW | |
| GetModuleBaseNameA | |
| GetModuleBaseNameW | |
| GetModuleFileNameExA | |
| GetModuleFileNameExW | |
| GetModuleInformation | |
| GetNativeSystemInfo | |
| GetNativeSystemPageSize | |
| GetNextFgPolicyRefreshInfoInternal | |
| GetNumaHighestNodeNumber | |
| GetNumaNodeProcessorMaskEx | |
| GetNumberOfConsoleInputEvents | |
| GetOsSafeBootMode | |
| GetOverlappedResultEx | |
| GetPerformanceInfo | |
| GetPreviousFgPolicyRefreshInfoInternal | |
| GetProcAddressForCaller | |
| GetProcessGroupAffinity | |
| GetProcessImageFileNameA | |
| GetProcessImageFileNameW | |
| GetProcessMemoryInfo | |
| GetProcessWorkingSetSizeEx | |
| GetProductInfo | |
| GetRegistryExtensionFlags | |
| GetSystemFileCacheSize | |
| GetSystemFirmwareTable | |
| GetSystemPageSize | |
| GetSystemTimePreciseAsFileTime | |
| GetTempPathW | |
| GetThreadContext | |
| GetThreadGroupAffinity | |
| GetThreadIdealProcessorEx | |
| GetThreadTimes | |
| GetTimeFormatA | |
| GetTimeFormatEx | |
| GetTimeFormatW | |
| GetTraceEnableFlags | |
| GetTraceEnableLevel | |
| GetTraceLoggerHandle | |
| GetUnicodeStringToEightBitSizeRoutine | |
| GetUnicodeStringToEightBitStringRoutine | |
| GetVolumeNameForVolumeMountPointW | |
| GetVolumePathNamesForVolumeNameW | |
| GetWriteWatch | |
| GetWsChanges | |
| GetWsChangesEx | |
| HashData | |
| IdnToAscii | |
| IdnToUnicode | |
| InitOnceBeginInitialize | |
| InitOnceComplete | |
| InitOnceExecuteOnce | |
| InitOnceInitialize | |
| InitializeConditionVariable | |
| InitializeProcessForWsWatch | |
| InitializeSynchronizationBarrier | |
| InternetTimeFromSystemTimeA | |
| InternetTimeFromSystemTimeW | |
| InternetTimeToSystemTimeA | |
| InternetTimeToSystemTimeW | |
| IsCharAlphaA | |
| IsCharAlphaNumericA | |
| IsCharAlphaNumericW | |
| IsCharAlphaW | |
| IsCharBlankW | |
| IsCharCntrlW | |
| IsCharDigitW | |
| IsCharLowerA | |
| IsCharLowerW | |
| IsCharPunctW | |
| IsCharSpaceA | |
| IsCharSpaceW | |
| IsCharUpperA | |
| IsCharUpperW | |
| IsCharXDigitW | |
| IsInternetESCEnabled | |
| IsProcessorFeaturePresent | |
| IsSyncForegroundPolicyRefresh | |
| IsThreadAFiber | |
| IsTimeZoneRedirectionEnabled | |
| IsValidNLSVersion | |
| LeaveCriticalPolicySectionInternal | |
| LoadAppInitDlls | |
| MapPredefinedHandleInternal | |
| MoveFileExW | |
| MoveFileWithProgressTransactedW | |
| MoveFileWithProgressW | |
| OpenPrivateNamespaceW | |
| OpenTraceW | |
| ParseURLA | |
| ParseURLW | |
| PathAddBackslashA | |
| PathAddBackslashW | |
| PathAddExtensionA | |
| PathAddExtensionW | |
| PathAllocCanonicalize | |
| PathAllocCombine | |
| PathAppendA | |
| PathAppendW | |
| PathCanonicalizeA | |
| PathCanonicalizeW | |
| PathCchAddBackslash | |
| PathCchAddBackslashEx | |
| PathCchAddExtension | |
| PathCchAppend | |
| PathCchAppendEx | |
| PathCchCanonicalize | |
| PathCchCanonicalizeEx | |
| PathCchCombine | |
| PathCchCombineEx | |
| PathCchFindExtension | |
| PathCchIsRoot | |
| PathCchRemoveBackslash | |
| PathCchRemoveBackslashEx | |
| PathCchRemoveExtension | |
| PathCchRemoveFileSpec | |
| PathCchRenameExtension | |
| PathCchSkipRoot | |
| PathCchStripPrefix | |
| PathCchStripToRoot | |
| PathCombineA | |
| PathCombineW | |
| PathCommonPrefixA | |
| PathCommonPrefixW | |
| PathCreateFromUrlA | |
| PathCreateFromUrlAlloc | |
| PathCreateFromUrlW | |
| PathFileExistsA | |
| PathFileExistsW | |
| PathFindExtensionA | |
| PathFindExtensionW | |
| PathFindFileNameA | |
| PathFindFileNameW | |
| PathFindNextComponentA | |
| PathFindNextComponentW | |
| PathGetCharTypeA | |
| PathGetCharTypeW | |
| PathGetDriveNumberA | |
| PathGetDriveNumberW | |
| PathIsFileSpecA | |
| PathIsFileSpecW | |
| PathIsLFNFileSpecA | |
| PathIsLFNFileSpecW | |
| PathIsPrefixA | |
| PathIsPrefixW | |
| PathIsRelativeA | |
| PathIsRelativeW | |
| PathIsRootA | |
| PathIsRootW | |
| PathIsSameRootA | |
| PathIsSameRootW | |
| PathIsUNCA | |
| PathIsUNCEx | |
| PathIsUNCServerA | |
| PathIsUNCServerShareA | |
| PathIsUNCServerShareW | |
| PathIsUNCServerW | |
| PathIsUNCW | |
| PathIsURLA | |
| PathIsURLW | |
| PathIsValidCharA | |
| PathIsValidCharW | |
| PathMatchSpecA | |
| PathMatchSpecExA | |
| PathMatchSpecExW | |
| PathMatchSpecW | |
| PathParseIconLocationA | |
| PathParseIconLocationW | |
| PathRelativePathToA | |
| PathRelativePathToW | |
| PathRemoveBackslashA | |
| PathRemoveBackslashW | |
| PathRemoveBlanksA | |
| PathRemoveBlanksW | |
| PathRemoveExtensionA | |
| PathRemoveExtensionW | |
| PathRemoveFileSpecA | |
| PathRemoveFileSpecW | |
| PathRenameExtensionA | |
| PathRenameExtensionW | |
| PathSkipRootA | |
| PathSkipRootW | |
| PathStripPathA | |
| PathStripPathW | |
| PathStripToRootA | |
| PathStripToRootW | |
| PathUnExpandEnvStringsA | |
| PathUnExpandEnvStringsW | |
| PathUnquoteSpacesA | |
| PathUnquoteSpacesW | |
| PeekConsoleInputA | |
| PeekConsoleInputW | |
| PoolPerAppKeyStateInternal | |
| PrivCopyFileExW | |
| ProcessTrace | |
| PurgeComm | |
| QISearch | |
| QueryActCtxSettingsW | |
| QueryActCtxW | |
| QueryAllTracesA | |
| QueryAllTracesW | |
| QueryMemoryResourceNotification | |
| QueryOptionalDelayLoadedAPI | |
| QueryUnbiasedInterruptTime | |
| QueryWorkingSet | |
| QueryWorkingSetEx | |
| QueueUserWorkItem | |
| ReadConsoleA | |
| ReadConsoleInputA | |
| ReadConsoleInputExA | |
| ReadConsoleInputExW | |
| ReadConsoleInputW | |
| ReadConsoleOutputA | |
| ReadConsoleOutputAttribute | |
| ReadConsoleOutputCharacterA | |
| ReadConsoleOutputCharacterW | |
| ReadConsoleOutputW | |
| ReadConsoleW | |
| RefreshPolicyExInternal | |
| RefreshPolicyInternal | |
| RegCloseKey | |
| RegCopyTreeW | |
| RegCreateKeyExA | |
| RegCreateKeyExInternalA | |
| RegCreateKeyExInternalW | |
| RegCreateKeyExW | |
| RegDeleteKeyExA | |
| RegDeleteKeyExInternalA | |
| RegDeleteKeyExInternalW | |
| RegDeleteKeyExW | |
| RegDeleteTreeA | |
| RegDeleteTreeW | |
| RegDeleteValueA | |
| RegDeleteValueW | |
| RegDisablePredefinedCacheEx | |
| RegEnumKeyExA | |
| RegEnumKeyExW | |
| RegEnumValueA | |
| RegEnumValueW | |
| RegFlushKey | |
| RegGetKeySecurity | |
| RegGetValueA | |
| RegGetValueW | |
| RegKrnGetAppKeyEventAddressInternal | |
| RegKrnGetAppKeyLoaded | |
| RegKrnGetClassesEnumTableAddressInternal | |
| RegKrnGetHKEY_ClassesRootAddress | |
| RegKrnGetTermsrvRegistryExtensionFlags | |
| RegKrnResetAppKeyLoaded | |
| RegKrnSetDllHasThreadStateGlobal | |
| RegKrnSetTermsrvRegistryExtensionFlags | |
| RegLoadAppKeyA | |
| RegLoadAppKeyW | |
| RegLoadKeyA | |
| RegLoadKeyW | |
| RegLoadMUIStringA | |
| RegLoadMUIStringW | |
| RegNotifyChangeKeyValue | |
| RegOpenCurrentUser | |
| RegOpenKeyExA | |
| RegOpenKeyExInternalA | |
| RegOpenKeyExInternalW | |
| RegOpenKeyExW | |
| RegOpenUserClassesRoot | |
| RegQueryInfoKeyA | |
| RegQueryInfoKeyW | |
| RegQueryValueExA | |
| RegQueryValueExW | |
| RegRestoreKeyA | |
| RegRestoreKeyW | |
| RegSaveKeyExA | |
| RegSaveKeyExW | |
| RegSetKeySecurity | |
| RegSetValueExA | |
| RegSetValueExW | |
| RegUnLoadKeyA | |
| RegUnLoadKeyW | |
| RegisterGPNotificationInternal | |
| RegisterTraceGuidsA | |
| RegisterTraceGuidsW | |
| ReleaseActCtx | |
| RemapPredefinedHandleInternal | |
| RemoveTraceCallback | |
| ReplaceFileW | |
| ResetWriteWatch | |
| ResolveDelayLoadedAPI | |
| ResolveDelayLoadsFromDll | |
| RsopLoggingEnabledInternal | |
| SHExpandEnvironmentStringsA | |
| SHExpandEnvironmentStringsW | |
| SHLoadIndirectString | |
| SHRegCloseUSKey | |
| SHRegCreateUSKeyA | |
| SHRegCreateUSKeyW | |
| SHRegDeleteEmptyUSKeyA | |
| SHRegDeleteEmptyUSKeyW | |
| SHRegDeleteUSValueA | |
| SHRegDeleteUSValueW | |
| SHRegEnumUSKeyA | |
| SHRegEnumUSKeyW | |
| SHRegEnumUSValueA | |
| SHRegEnumUSValueW | |
| SHRegGetBoolUSValueA | |
| SHRegGetBoolUSValueW | |
| SHRegGetUSValueA | |
| SHRegGetUSValueW | |
| SHRegOpenUSKeyA | |
| SHRegOpenUSKeyW | |
| SHRegQueryInfoUSKeyA | |
| SHRegQueryInfoUSKeyW | |
| SHRegQueryUSValueA | |
| SHRegQueryUSValueW | |
| SHRegSetUSValueA | |
| SHRegSetUSValueW | |
| SHRegWriteUSValueA | |
| SHRegWriteUSValueW | |
| SHTruncateString | |
| ScrollConsoleScreenBufferA | |
| ScrollConsoleScreenBufferW | |
| SetClientTimeZoneInformation | |
| SetCommBreak | |
| SetCommConfig | |
| SetCommMask | |
| SetCommState | |
| SetCommTimeouts | |
| SetComputerNameExW | |
| SetConsoleActiveScreenBuffer | |
| SetConsoleCP | |
| SetConsoleCtrlHandler | |
| SetConsoleCursorInfo | |
| SetConsoleCursorPosition | |
| SetConsoleInputExeNameA | |
| SetConsoleInputExeNameW | |
| SetConsoleMode | |
| SetConsoleOutputCP | |
| SetConsoleScreenBufferInfoEx | |
| SetConsoleScreenBufferSize | |
| SetConsoleTextAttribute | |
| SetConsoleTitleW | |
| SetConsoleWindowInfo | |
| SetDynamicTimeZoneInformation | |
| SetLastConsoleEventActive | |
| SetProcessGroupAffinity | |
| SetProcessPreferredUILanguages | |
| SetProcessWorkingSetSizeEx | |
| SetSystemFileCacheSize | |
| SetSystemTime | |
| SetThreadContext | |
| SetThreadGroupAffinity | |
| SetThreadIdealProcessorEx | |
| SetThreadPreferredUILanguages | |
| SetThreadUILanguage | |
| SetThreadpoolTimerEx | |
| SetThreadpoolWaitEx | |
| SetTimeZoneInformation | |
| SetTraceCallback | |
| SetUnhandledExceptionFilter | |
| SetupComm | |
| SleepConditionVariableCS | |
| SleepConditionVariableSRW | |
| StartTraceA | |
| StartTraceW | |
| StopTraceW | |
| StrCSpnA | |
| StrCSpnIA | |
| StrCSpnIW | |
| StrCSpnW | |
| StrCatBuffA | |
| StrCatBuffW | |
| StrCatChainW | |
| StrChrA | |
| StrChrA_MB | |
| StrChrIA | |
| StrChrIW | |
| StrChrNIW | |
| StrChrNW | |
| StrChrW | |
| StrCmpCA | |
| StrCmpCW | |
| StrCmpICA | |
| StrCmpICW | |
| StrCmpIW | |
| StrCmpLogicalW | |
| StrCmpNA | |
| StrCmpNCA | |
| StrCmpNCW | |
| StrCmpNIA | |
| StrCmpNICA | |
| StrCmpNICW | |
| StrCmpNIW | |
| StrCmpNW | |
| StrCmpW | |
| StrCpyNW | |
| StrCpyNXA | |
| StrCpyNXW | |
| StrDupA | |
| StrDupW | |
| StrIsIntlEqualA | |
| StrIsIntlEqualW | |
| StrPBrkA | |
| StrPBrkW | |
| StrRChrA | |
| StrRChrIA | |
| StrRChrIW | |
| StrRChrW | |
| StrRStrIA | |
| StrRStrIW | |
| StrSpnA | |
| StrSpnW | |
| StrStrA | |
| StrStrIA | |
| StrStrIW | |
| StrStrNIW | |
| StrStrNW | |
| StrStrW | |
| StrToInt64ExA | |
| StrToInt64ExW | |
| StrToIntA | |
| StrToIntExA | |
| StrToIntExW | |
| StrToIntW | |
| StrTrimA | |
| StrTrimW | |
| TraceEvent | |
| TraceMessage | |
| TraceMessageVa | |
| TraceQueryInformation | |
| TraceSetInformation | |
| TransmitCommChar | |
| UnhandledExceptionFilter | |
| UnregisterGPNotificationInternal | |
| UnregisterTraceGuids | |
| UrlApplySchemeA | |
| UrlApplySchemeW | |
| UrlCanonicalizeA | |
| UrlCanonicalizeW | |
| UrlCombineA | |
| UrlCombineW | |
| UrlCompareA | |
| UrlCompareW | |
| UrlCreateFromPathA | |
| UrlCreateFromPathW | |
| UrlEscapeA | |
| UrlEscapeW | |
| UrlFixupW | |
| UrlGetLocationA | |
| UrlGetLocationW | |
| UrlGetPartA | |
| UrlGetPartW | |
| UrlHashA | |
| UrlHashW | |
| UrlIsA | |
| UrlIsNoHistoryA | |
| UrlIsNoHistoryW | |
| UrlIsOpaqueA | |
| UrlIsOpaqueW | |
| UrlIsW | |
| UrlUnescapeA | |
| UrlUnescapeW | |
| VerFindFileA | |
| VerFindFileW | |
| VerQueryValueA | |
| VerQueryValueW | |
| VirtualLock | |
| VirtualUnlock | |
| WaitCommEvent | |
| WaitForDebugEvent | |
| WaitForMachinePolicyForegroundProcessingInternal | |
| WaitForUserPolicyForegroundProcessingInternal | |
| WakeAllConditionVariable | |
| WakeConditionVariable | |
| WerRegisterMemoryBlock | |
| WerUnregisterMemoryBlock | |
| WerpNotifyLoadStringResource | |
| WerpNotifyUseStringResource | |
| WriteConsoleA | |
| WriteConsoleInputA | |
| WriteConsoleInputW | |
| WriteConsoleOutputA | |
| WriteConsoleOutputAttribute | |
| WriteConsoleOutputCharacterA | |
| WriteConsoleOutputCharacterW | |
| WriteConsoleOutputW | |
| WriteConsoleW | |
| ZombifyActCtx | |
| _AddMUIStringToCache | |
| _GetMUIStringFromCache | |
| _OpenMuiStringCache | |
| __dllonexit3 | |
| __wgetmainargs | |
| _amsg_exit | |
| _c_exit | |
| _cexit | |
| _exit | |
| _initterm | |
| _initterm_e | |
| _invalid_parameter | |
| _onexit | |
| _purecall | |
| _time64 | |
| atexit | |
| exit | |
| hgets | |
| hwprintf | |
| time | |
| wprintf | |
| BaseGetProcessDllPath | |
| BaseGetProcessExePath | |
| BaseInvalidateDllSearchPathCache | |
| BaseInvalidateProcessSearchPathCache | |
| BaseReleaseProcessDllPath | |
| BaseReleaseProcessExePath | |
| InvalidateTzSpecificCache |