ntdll.inc

这是asm驱动的开发包

RtlPrefixString                                    proto stdcall :DWORD, :DWORD, :DWORD
RtlPrefixUnicodeString                             proto stdcall :DWORD, :DWORD, :DWORD
RtlProtectHeap                                     proto stdcall :DWORD, :DWORD
RtlQueryAtomInAtomTable                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlQueryEnvironmentVariable_U                      proto stdcall :DWORD, :DWORD, :DWORD
RtlQueryInformationAcl                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlQueryProcessBackTraceInformation                proto stdcall :DWORD
RtlQueryProcessDebugInformation                    proto stdcall :DWORD, :DWORD, :DWORD
RtlQueryProcessHeapInformation                     proto stdcall :DWORD
RtlQueryProcessLockInformation                     proto stdcall :DWORD
RtlQueryRegistryValues                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlQuerySecurityObject                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlQueryTagHeap                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlQueryTimeZoneInformation                        proto stdcall :DWORD
RtlQueueWorkItem                                   proto stdcall :DWORD, :DWORD, :DWORD
RtlRaiseException                                  proto stdcall :DWORD
RtlRaiseStatus                                     proto stdcall :DWORD
RtlRandom                                          proto stdcall :DWORD
RtlReAllocateHeap                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlRealPredecessor                                 proto stdcall :DWORD
RtlRealSuccessor                                   proto stdcall :DWORD
RtlRegisterWait                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlReleasePebLock                                  proto stdcall
RtlReleaseResource                                 proto stdcall :DWORD
RtlRemoteCall                                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlResetRtlTranslations                            proto stdcall :DWORD
RtlRunDecodeUnicodeString                          proto stdcall :DWORD, :DWORD
RtlRunEncodeUnicodeString                          proto stdcall :DWORD, :DWORD
RtlSecondsSince1970ToTime                          proto stdcall :DWORD, :DWORD
RtlSecondsSince1980ToTime                          proto stdcall :DWORD, :DWORD
RtlSelfRelativeToAbsoluteSD2                       proto stdcall :DWORD, :DWORD
RtlSelfRelativeToAbsoluteSD                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlSetAllBits                                      proto stdcall :DWORD
RtlSetAttributesSecurityDescriptor                 proto stdcall :DWORD, :DWORD, :DWORD
RtlSetBits                                         proto stdcall :DWORD, :DWORD, :DWORD
RtlSetControlSecurityDescriptor                    proto stdcall :DWORD, :DWORD, :DWORD
RtlSetCriticalSectionSpinCount                     proto stdcall :DWORD, :DWORD
RtlSetCurrentDirectory_U                           proto stdcall :DWORD
RtlSetCurrentEnvironment                           proto stdcall :DWORD, :DWORD
RtlSetDaclSecurityDescriptor                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlSetEnvironmentVariable                          proto stdcall :DWORD, :DWORD, :DWORD
RtlSetGroupSecurityDescriptor                      proto stdcall :DWORD, :DWORD, :DWORD
RtlSetInformationAcl                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlSetIoCompletionCallback                         proto stdcall :DWORD, :DWORD, :DWORD
RtlSetOwnerSecurityDescriptor                      proto stdcall :DWORD, :DWORD, :DWORD
RtlSetSaclSecurityDescriptor                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlSetSecurityDescriptorRMControl                  proto stdcall :DWORD, :DWORD
RtlSetSecurityObject                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlSetSecurityObjectEx                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlSetThreadPoolStartFunc                          proto stdcall :DWORD, :DWORD
RtlSetTimeZoneInformation                          proto stdcall :DWORD
RtlSetTimer                                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlSetUnicodeCallouts                              proto stdcall :DWORD
RtlSetUserFlagsHeap                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlSetUserValueHeap                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlShutdownLpcServer                               proto stdcall :DWORD
RtlSizeHeap                                        proto stdcall :DWORD, :DWORD, :DWORD
RtlSplay                                           proto stdcall :DWORD
RtlStartRXact                                      proto stdcall :DWORD
RtlStringFromGUID                                  proto stdcall :DWORD, :DWORD
RtlSubAuthorityCountSid                            proto stdcall :DWORD
RtlSubAuthoritySid                                 proto stdcall :DWORD, :DWORD
RtlSubtreePredecessor                              proto stdcall :DWORD
RtlSubtreeSuccessor                                proto stdcall :DWORD
RtlSystemTimeToLocalTime                           proto stdcall :DWORD, :DWORD
RtlTimeFieldsToTime                                proto stdcall :DWORD, :DWORD
RtlTimeToElapsedTimeFields                         proto stdcall :DWORD, :DWORD
RtlTimeToSecondsSince1970                          proto stdcall :DWORD, :DWORD
RtlTimeToSecondsSince1980                          proto stdcall :DWORD, :DWORD
RtlTimeToTimeFields                                proto stdcall :DWORD, :DWORD
RtlTraceDatabaseAdd                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlTraceDatabaseCreate                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlTraceDatabaseDestroy                            proto stdcall :DWORD
RtlTraceDatabaseEnumerate                          proto stdcall :DWORD, :DWORD, :DWORD
RtlTraceDatabaseFind                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlTraceDatabaseLock                               proto stdcall :DWORD
RtlTraceDatabaseUnlock                             proto stdcall :DWORD
RtlTraceDatabaseValidate                           proto stdcall :DWORD
RtlTryEnterCriticalSection                         proto stdcall :DWORD
RtlUnicodeStringToAnsiSize                         proto stdcall :DWORD
RtlUnicodeStringToAnsiString                       proto stdcall :DWORD, :DWORD, :DWORD
RtlUnicodeStringToCountedOemString                 proto stdcall :DWORD, :DWORD, :DWORD
RtlUnicodeStringToInteger                          proto stdcall :DWORD, :DWORD, :DWORD
RtlUnicodeStringToOemSize                          proto stdcall :DWORD
RtlUnicodeStringToOemString                        proto stdcall :DWORD, :DWORD, :DWORD
RtlUnicodeToCustomCPN                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlUnicodeToMultiByteN                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlUnicodeToMultiByteSize                          proto stdcall :DWORD, :DWORD, :DWORD
RtlUnicodeToOemN                                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlUniform                                         proto stdcall :DWORD
RtlUnlockHeap                                      proto stdcall :DWORD
RtlUnwind                                          proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlUpcaseUnicodeChar                               proto stdcall :DWORD
RtlUpcaseUnicodeString                             proto stdcall :DWORD, :DWORD, :DWORD
RtlUpcaseUnicodeStringToAnsiString                 proto stdcall :DWORD, :DWORD, :DWORD
RtlUpcaseUnicodeStringToCountedOemString           proto stdcall :DWORD, :DWORD, :DWORD
RtlUpcaseUnicodeStringToOemString                  proto stdcall :DWORD, :DWORD, :DWORD
RtlUpcaseUnicodeToCustomCPN                        proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlUpcaseUnicodeToMultiByteN                       proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlUpcaseUnicodeToOemN                             proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlUpdateTimer                                     proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlUpperChar                                       proto stdcall :DWORD
RtlUpperString                                     proto stdcall :DWORD, :DWORD
RtlUsageHeap                                       proto stdcall :DWORD, :DWORD, :DWORD
RtlValidAcl                                        proto stdcall :DWORD
RtlValidRelativeSecurityDescriptor                 proto stdcall :DWORD, :DWORD, :DWORD
RtlValidSecurityDescriptor                         proto stdcall :DWORD
RtlValidSid                                        proto stdcall :DWORD
RtlValidateHeap                                    proto stdcall :DWORD, :DWORD, :DWORD
RtlValidateProcessHeaps                            proto stdcall
RtlVerifyVersionInfo                               proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlWalkFrameChain                                  proto stdcall :DWORD, :DWORD, :DWORD
RtlWalkHeap                                        proto stdcall :DWORD, :DWORD
RtlWriteRegistryValue                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlZeroHeap                                        proto stdcall :DWORD, :DWORD
RtlZeroMemory                                      proto stdcall :DWORD, :DWORD
RtlpNtCreateKey                                    proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlpNtEnumerateSubKey                              proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlpNtMakeTemporaryKey                             proto stdcall :DWORD
RtlpNtOpenKey                                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlpNtQueryValueKey                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
RtlpNtSetValueKey                                  proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
RtlpUnWaitCriticalSection                          proto stdcall :DWORD
RtlpWaitForCriticalSection                         proto stdcall :DWORD
RtlxAnsiStringToUnicodeSize                        proto stdcall :DWORD
RtlxOemStringToUnicodeSize                         proto stdcall :DWORD
RtlxUnicodeStringToAnsiSize                        proto stdcall :DWORD
RtlxUnicodeStringToOemSize                         proto stdcall :DWORD
VerSetConditionMask                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD
ZwAcceptConnectPort                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwAccessCheck                                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwAccessCheckAndAuditAlarm                         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwAccessCheckByType                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwAccessCheckByTypeAndAuditAlarm                   proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwAccessCheckByTypeResultList                      proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwAccessCheckByTypeResultListAndAuditAlarm         proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwAddAtom                                          proto stdcall :DWORD, :DWORD, :DWORD
ZwAdjustGroupsToken                                proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwAdjustPrivilegesToken                            proto stdcall :DWORD, :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
ZwAlertResumeThread                                proto stdcall :DWORD, :DWORD
ZwAlertThread                                      proto stdcall :DWORD
ZwA