Thanks for the help, here is the list of what I still need: advapi32.dll A_SHAFinal A_SHAInit A_SHAUpdate CancelOverlappedAccess CloseCodeAuthzLevel ComputeAccessTokenFromCodeAuthzLevel ConvertAccessToSecurityDescriptorA ConvertAccessToSecurityDescriptorW ConvertSDToStringSDRootDomainA ConvertSDToStringSDRootDomainW ConvertSecurityDescriptorToAccessA ConvertSecurityDescriptorToAccessNamedA ConvertSecurityDescriptorToAccessNamedW ConvertSecurityDescriptorToAccessW ConvertStringSDToSDRootDomainA ConvertStringSDToSDRootDomainW CreateCodeAuthzLevel CredProfileLoaded CredpConvertCredential CredpConvertTargetInfo CredpDecodeCredential CredpEncodeCredential ElfBackupEventLogFileA ElfBackupEventLogFileW ElfChangeNotify ElfClearEventLogFileA ElfClearEventLogFileW ElfCloseEventLog ElfDeregisterEventSource ElfNumberOfRecords ElfOldestRecord ElfOpenBackupEventLogA ElfOpenBackupEventLogW ElfOpenEventLogA ElfOpenEventLogW ElfReadEventLogA ElfReadEventLogW ElfRegisterEventSourceA ElfRegisterEventSourceW ElfReportEventA ElfReportEventW EncryptedFileKeyInfo FreeEncryptedFileKeyInfo GetAccessPermissionsForObjectA GetAccessPermissionsForObjectW GetInformationCodeAuthzLevelW GetInformationCodeAuthzPolicyW GetNamedSecurityInfoExA GetNamedSecurityInfoExW GetOverlappedAccessResults I_ScGetCurrentGroupStateW I_ScIsSecurityProcess I_ScPnPGetServiceName I_ScSendTSMessage I_ScSetServiceBitsA I_ScSetServiceBitsW IdentifyCodeAuthzLevelW LsaAddPrivilegesToAccount LsaClearAuditLog LsaCreateAccount LsaCreateSecret LsaCreateTrustedDomain LsaDelete LsaEnumerateAccounts LsaEnumeratePrivileges LsaEnumeratePrivilegesOfAccount LsaGetQuotasForAccount LsaGetRemoteUserName LsaGetSystemAccessAccount LsaGetUserName LsaICLookupNames LsaICLookupNamesWithCreds LsaICLookupSids LsaICLookupSidsWithCreds LsaLookupPrivilegeDisplayName LsaLookupPrivilegeName LsaLookupPrivilegeValue LsaOpenAccount LsaOpenPolicySce LsaOpenSecret LsaOpenTrustedDomain LsaQueryInfoTrustedDomain LsaQuerySecret LsaQuerySecurityObject LsaRemovePrivilegesFromAccount LsaRetrievePrivateData LsaSetInformationTrustedDomain LsaSetQuotasForAccount LsaSetSecret LsaSetSecurityObject LsaSetSystemAccessAccount MD4Final MD4Init MD4Update MD5Final MD5Init MD5Update ProcessIdleTasks QueryWindows31FilesMigration RegisterIdleTask SaferiChangeRegistryScope SaferiCompareTokenLevels SaferiPopulateDefaultsInRegistry SaferiRecordEventLogEntry SaferiReplaceProcessThreadTokens SaferiSearchMatchingHashRules SetEntriesInAccessListA SetEntriesInAccessListW SetEntriesInAuditListA SetEntriesInAuditListW SetInformationCodeAuthzLevelW SetInformationCodeAuthzPolicyW SetNamedSecurityInfoExA SetNamedSecurityInfoExW SetSecurityInfoExA SetSecurityInfoExW SynchronizeWindows31FilesAndWindowsNTRegistry SystemFunction036 SystemFunction040 SystemFunction041 TrusteeAccessToObjectA TrusteeAccessToObjectW UnregisterIdleTask WdmWmiServiceMain WmiCloseBlock WmiCloseTraceWithCursor WmiConvertTimestamp WmiDevInstToInstanceNameA WmiDevInstToInstanceNameW WmiEnumerateGuids WmiExecuteMethodA WmiExecuteMethodW WmiFileHandleToInstanceNameA WmiFileHandleToInstanceNameW WmiFreeBuffer WmiGetFirstTraceOffset WmiGetNextEvent WmiGetTraceHeader WmiMofEnumerateResourcesA WmiMofEnumerateResourcesW WmiNotificationRegistrationA WmiNotificationRegistrationW WmiOpenBlock WmiOpenTraceWithCursor WmiParseTraceEvent WmiQueryAllDataA WmiQueryAllDataMultipleA WmiQueryAllDataMultipleW WmiQueryAllDataW WmiQueryGuidInformation WmiQuerySingleInstanceA WmiQuerySingleInstanceMultipleA WmiQuerySingleInstanceMultipleW WmiQuerySingleInstanceW WmiReceiveNotificationsA WmiReceiveNotificationsW WmiSetSingleInstanceA WmiSetSingleInstanceW WmiSetSingleItemA WmiSetSingleItemW
fmifs.dll ChkdskEx ComputeFmMediaType FormatEx2 QueryAvailableFileSystemFormat QueryDeviceInformation QueryDeviceInformationByHandle QueryFileSystemName QueryLatestFileSystemVersion
gdi32.dll GdiConvertBitmapV5 GdiGetSpoolMessage GdiInitializeLanguagePack GdiPrinterThunk cGetTTFFromFOT
iphlpapi.dll AllocateAndGetArpEntTableFromStack AllocateAndGetIfTableFromStack AllocateAndGetIpAddrTableFromStack AllocateAndGetIpForwardTableFromStack AllocateAndGetIpNetTableFromStack AllocateAndGetTcpExTableFromStack AllocateAndGetTcpTableFromStack AllocateAndGetUdpExTableFromStack AllocateAndGetUdpTableFromStack FlushIpNetTableFromStack GetBestInterfaceFromStack GetBestRouteFromStack GetIcmpStatsFromStack GetIcmpStatsFromStackEx GetIfEntryFromStack GetIfTableFromStack GetIgmpList GetIpAddrTableFromStack GetIpForwardTableFromStack GetIpNetTableFromStack GetIpStatsFromStack GetIpStatsFromStackEx GetTcpStatsFromStack GetTcpStatsFromStackEx GetTcpTableFromStack GetUdpStatsFromStack GetUdpStatsFromStackEx GetUdpTableFromStack InternalCreateIpForwardEntry InternalCreateIpNetEntry InternalDeleteIpForwardEntry InternalDeleteIpNetEntry InternalGetIfTable InternalGetIpAddrTable InternalGetIpForwardTable InternalGetIpNetTable InternalGetTcpTable InternalGetUdpTable InternalSetIfEntry InternalSetIpForwardEntry InternalSetIpNetEntry InternalSetIpStats InternalSetTcpEntry IsLocalAddress NTPTimeToNTFileTime NTTimeToNTPTime NhGetGuidFromInterfaceName NhGetInterfaceNameFromDeviceGuid NhGetInterfaceNameFromGuid NhpAllocateAndGetInterfaceInfoFromStack NhpGetInterfaceIndexFromStack NotifyRouteChangeEx RtlIpv4AddressToStringExA RtlIpv4AddressToStringExW RtlIpv4StringToAddressExA RtlIpv4StringToAddressExW RtlIpv6AddressToStringExA RtlIpv6AddressToStringExW RtlIpv6StringToAddressExA RtlIpv6StringToAddressExW SetAdapterIpAddress SetBlockRoutes SetIfEntryToStack SetIpForwardEntryToStack SetIpMultihopRouteEntryToStack SetIpNetEntryToStack SetIpRouteEntryToStack SetIpStatsToStack SetProxyArpEntryToStack SetRouteWithRef SetTcpEntryToStack _PfAddFiltersToInterface@24 _PfAddGlobalFilterToInterface@8 _PfBindInterfaceToIPAddress@12 _PfBindInterfaceToIndex@16 _PfCreateInterface@24 _PfDeleteInterface@4 _PfDeleteLog@0 _PfGetInterfaceStatistics@16 _PfMakeLog@4 _PfRebindFilters@8 _PfRemoveFilterHandles@12 _PfRemoveFiltersFromInterface@20 _PfRemoveGlobalFilterFromInterface@8 _PfSetLogBuffer@28 _PfTestPacket@20 _PfUnBindInterface@4 do_echo_rep do_echo_req register_icmp
kernel32.dll AddLocalAlternateComputerNameA AddLocalAlternateComputerNameW BaseCheckAppcompatCache BaseCleanupAppcompatCache BaseCleanupAppcompatCacheSupport BaseDumpAppcompatCache BaseFlushAppcompatCache BaseInitAppcompatCache BaseInitAppcompatCacheSupport BaseProcessInitPostImport BaseUpdateAppcompatCache CreateNlsSecurityDescriptor CreateProcessInternalA CreateProcessInternalW CreateSocketHandle DelayLoadFailureHook DosPathToSessionPathA DosPathToSessionPathW EnumerateLocalComputerNamesA EnumerateLocalComputerNamesW GetCPFileNameFromRegistry GetComPlusPackageInstallStatus GetConsoleCharType GetConsoleCursorMode GetConsoleInputExeNameA GetConsoleInputExeNameW GetConsoleNlsMode GetDefaultSortkeySize GetHandleContext GetLinguistLangSize GetNlsSectionName GetNumaAvailableMemory GetNumaAvailableMemoryNode GetNumaProcessorMap IsValidUILanguage LZCloseFile LZCreateFileW NlsConvertIntegerToString NlsGetCacheUpdateCount NlsResetProcessLocale NumaVirtualQueryNode OpenDataFile PrivCopyFileExW PrivMoveFileIdentityW ReadConsoleInputExA ReadConsoleInputExW RegisterConsoleIME RegisterConsoleOS2 RemoveLocalAlternateComputerNameA RemoveLocalAlternateComputerNameW RtlCaptureStackBackTrace SetCPGlobal SetClientTimeZoneInformation SetComPlusPackageInstallStatus SetConsoleCursorMode SetConsoleIcon SetConsoleInputExeNameA SetConsoleInputExeNameW SetConsoleLocalEUDC SetConsoleNlsMode SetConsoleOS2OemFormat SetHandleContext SetLocalPrimaryComputerNameA SetLocalPrimaryComputerNameW SetTermsrvAppInstallMode SetThreadUILanguage TermsrvAppInstallMode UTRegister UTUnRegister UnregisterConsoleIME ValidateLCType ValidateLocale
lz32.dll LZCloseFile LZCreateFileW
ntdll.dll CsrCaptureMessageMultiUnicodeStringsInPlace CsrGetProcessId DbgPrintEx DbgPrintReturnControlC DbgQueryDebugFilterState DbgSetDebugFilterState DbgUiConvertStateChangeStructure DbgUiDebugActiveProcess DbgUiGetThreadDebugObject DbgUiSetThreadDebugObject DbgUiStopDebugging KiRaiseUserExceptionDispatcher LdrAccessOutOfProcessResource LdrAddRefDll LdrAlternateResourcesEnabled LdrCreateOutOfProcessImage LdrDestroyOutOfProcessImage LdrEnumResources LdrEnumerateLoadedModules LdrFindCreateProcessManifest LdrFindResourceEx_U LdrFlushAlternateResourceModules LdrGetDllHandleEx LdrInitShimEngineDynamic LdrLoadAlternateResourceModule LdrLockLoaderLock LdrProcessRelocationBlock LdrSetAppCompatDllRedirectionCallback LdrSetDllManifestProber LdrUnloadAlternateResourceModule LdrUnlockLoaderLock NtAccessCheckByType NtAccessCheckByTypeAndAuditAlarm NtAccessCheckByTypeResultList NtAccessCheckByTypeResultListAndAuditAlarm NtAccessCheckByTypeResultListAndAuditAlarmByHandle NtAddBootEntry NtAllocateUserPhysicalPages NtAreMappedFilesTheSame NtAssignProcessToJobObject NtCancelDeviceWakeupRequest NtCompactKeys NtCompareTokens NtCompressKey NtCreateDebugObject NtCreateJobObject NtCreateJobSet NtCreateKeyedEvent NtCreateProcessEx NtDebugActiveProcess NtDebugContinue NtDeleteBootEntry NtEnumerateBootEntries NtEnumerateSystemEnvironmentValuesEx NtFilterToken NtFreeUserPhysicalPages NtGetDevicePowerState NtGetWriteWatch NtImpersonateAnonymousToken NtInitiatePowerAction NtIsProcessInJob NtIsSystemResumeAutomatic NtLockProductActivationKeys NtLockRegistryKey NtMakePermanentObject NtMapUserPhysicalPages NtMapUserPhysicalPagesScatter NtModifyBootEntry NtNotifyChangeMultipleKeys NtOpenJobObject NtOpenKeyedEvent NtOpenProcessTokenEx NtOpenThreadTokenEx NtPowerInformation NtQueryBootEntryOrder NtQueryBootOptions NtQueryDebugFilterState NtQueryDefaultUILanguage NtQueryInformationJobObject NtQueryInstallUILanguage NtQueryOpenSubKeys NtQueryPortInformationProcess NtQueryQuotaInformationFile NtQuerySystemEnvironmentValueEx NtReleaseKeyedEvent NtRemoveProcessDebug NtRenameKey NtReplyWaitReceivePortEx NtRequestDeviceWakeup NtRequestWakeupLatency NtResetWriteWatch NtResumeProcess NtSaveKeyEx NtSaveMergedKeys NtSecureConnectPort NtSetBootEntryOrder NtSetBootOptions NtSetDebugFilterState NtSetDefaultUILanguage NtSetEventBoostPriority NtSetInformationDebugObject NtSetInformationJobObject NtSetQuotaInformationFile NtSetSystemEnvironmentValueEx NtSetThreadExecutionState NtSetUuidSeed NtSuspendProcess NtTerminateJobObject NtTraceEvent NtTranslateFilePath NtUnloadKeyEx NtWaitForDebugEvent NtWaitForKeyedEvent PfxFindPrefix PfxInitialize PfxInsertPrefix PfxRemovePrefix PropertyLengthAsVariant RestoreEm87Context RtlAbortRXact RtlActivateActivationContext RtlActivateActivationContextEx RtlActivateActivationContextUnsafeFast RtlAddAccessAllowedAceEx RtlAddAccessAllowedObjectAce RtlAddAccessDeniedAceEx RtlAddAccessDeniedObjectAce RtlAddActionToRXact RtlAddAttributeActionToRXact RtlAddAuditAccessAceEx RtlAddAuditAccessObjectAce RtlAddCompoundAce RtlAddRange RtlAddRefActivationContext RtlAddRefMemoryStream RtlAddVectoredExceptionHandler RtlAddressInSectionTable RtlAppendPathElement RtlApplicationVerifierStop RtlApplyRXact RtlApplyRXactNoFlush RtlAssert2 RtlCancelTimer RtlCaptureContext RtlCaptureStackBackTrace RtlCaptureStackContext RtlCheckForOrphanedCriticalSections RtlCheckProcessParameters RtlCloneMemoryStream RtlCommitMemoryStream RtlComputeCrc32 RtlComputeImportTableHash RtlComputePrivatizedDllName_U RtlConsoleMultiByteToUnicodeN RtlConvertPropertyToVariant RtlConvertToAutoInheritSecurityObject RtlConvertUiListToApiList RtlConvertVariantToProperty RtlCopyMemoryStreamTo RtlCopyOutOfProcessMemoryStreamTo RtlCopyRangeList RtlCopySecurityDescriptor RtlCreateActivationContext RtlCreateAndSetSD RtlCreateBootStatusDataFile RtlCreateQueryDebugBuffer RtlCreateSystemVolumeInformationFolder RtlCreateTagHeap RtlCreateTimer RtlCreateTimerQueue RtlCreateUserSecurityObject RtlCutoverTimeToSystemTime RtlDeactivateActivationContext RtlDeactivateActivationContextUnsafeFast RtlDebugPrintTimes RtlDefaultNpAcl RtlDelete RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl RtlDeleteNoSplay RtlDeleteOwnersRanges RtlDeleteRange RtlDeleteSecurityObject RtlDeleteTimer RtlDeleteTimerQueue RtlDeleteTimerQueueEx RtlDeregisterWait RtlDeregisterWaitEx RtlDestroyQueryDebugBuffer RtlDllShutdownInProgress RtlDnsHostNameToComputerName RtlDosApplyFileIsolationRedirection_Ustr RtlDosSearchPath_Ustr RtlDowncaseUnicodeChar RtlDuplicateUnicodeString RtlEnableEarlyCriticalSectionEventCreation RtlEnumerateGenericTable RtlEnumerateGenericTableAvl RtlEnumerateGenericTableLikeADirectory RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl RtlExtendHeap RtlFinalReleaseOutOfProcessMemoryStream RtlFindActivationContextSectionGuid RtlFindActivationContextSectionString RtlFindCharInUnicodeString RtlFindClearRuns RtlFindLastBackwardRunClear RtlFindLeastSignificantBit RtlFindMostSignificantBit RtlFindNextForwardRunClear RtlFindRange RtlFirstEntrySList RtlFlushSecureMemoryCache RtlFormatMessage RtlFreeRangeList RtlFreeThreadActivationContextStack RtlGUIDFromString RtlGetActiveActivationContext RtlGetCallersAddress RtlGetCurrentPeb RtlGetElementGenericTable RtlGetElementGenericTableAvl RtlGetFirstRange RtlGetFrame RtlGetLastNtStatus RtlGetLastWin32Error RtlGetLengthWithoutLastFullDosOrNtPathElement RtlGetLengthWithoutTrailingPathSeperators RtlGetNativeSystemInformation RtlGetNextRange RtlGetSecurityDescriptorRMControl RtlGetSetBootStatusData RtlGetUserInfoHeap RtlGetVersion RtlHashUnicodeString RtlInitMemoryStream RtlInitOutOfProcessMemoryStream RtlInitUnicodeStringEx RtlInitializeAtomPackage RtlInitializeCriticalSectionAndSpinCount RtlInitializeGenericTable RtlInitializeGenericTableAvl RtlInitializeRXact RtlInitializeRangeList RtlInitializeSListHead RtlInsertElementGenericTable RtlInsertElementGenericTableAvl RtlInt64ToUnicodeString RtlInterlockedFlushSList RtlInterlockedPopEntrySList RtlInterlockedPushEntrySList RtlInterlockedPushListSList RtlInvertRangeList RtlIpv4AddressToStringA RtlIpv4AddressToStringW RtlIpv4StringToAddressA RtlIpv4StringToAddressW RtlIpv6AddressToStringA RtlIpv6AddressToStringW RtlIpv6StringToAddressA RtlIpv6StringToAddressW RtlIsActivationContextActive RtlIsGenericTableEmpty RtlIsGenericTableEmptyAvl RtlIsRangeAvailable RtlIsThreadWithinLoaderCallout RtlLockBootStatusData RtlLockMemoryStreamRegion RtlLogStackBackTrace RtlLookupElementGenericTable RtlLookupElementGenericTableAvl RtlMapSecurityErrorToNtStatus RtlMergeRangeLists RtlMultiAppendUnicodeStringBuffer RtlNewInstanceSecurityObject RtlNewSecurityGrantedAccess RtlNewSecurityObject RtlNewSecurityObjectEx RtlNewSecurityObjectWithMultipleInheritance RtlNtPathNameToDosPathName RtlNtStatusToDosErrorNoTeb RtlNumberGenericTableElements RtlNumberGenericTableElementsAvl RtlPcToFileHeader RtlPopFrame RtlProtectHeap RtlPushFrame RtlQueryDepthSList RtlQueryHeapInformation RtlQueryInformationActivationContext RtlQueryInformationActiveActivationContext RtlQueryInterfaceMemoryStream RtlQueryProcessBackTraceInformation RtlQueryProcessDebugInformation RtlQueryProcessHeapInformation RtlQueryProcessLockInformation RtlQuerySecurityObject RtlQueryTagHeap RtlQueueApcWow64Thread RtlQueueWorkItem RtlRandomEx RtlReadMemoryStream RtlReadOutOfProcessMemoryStream RtlRealPredecessor RtlRealSuccessor RtlRegisterSecureMemoryCacheCallback RtlRegisterWait RtlReleaseActivationContext RtlReleaseMemoryStream RtlRemoteCall RtlRemoveVectoredExceptionHandler RtlRestoreLastWin32Error RtlRevertMemoryStream RtlSeekMemoryStream RtlSelfRelativeToAbsoluteSD2 RtlSetAttributesSecurityDescriptor RtlSetControlSecurityDescriptor RtlSetCriticalSectionSpinCount RtlSetHeapInformation RtlSetIoCompletionCallback RtlSetLastWin32Error RtlSetLastWin32ErrorAndNtStatusFromNtStatus RtlSetMemoryStreamSize RtlSetProcessIsCritical RtlSetSecurityDescriptorRMControl RtlSetSecurityObject RtlSetSecurityObjectEx RtlSetThreadIsCritical RtlSetThreadPoolStartFunc RtlSetTimer RtlSetUnicodeCallouts RtlSetUserFlagsHeap RtlSetUserValueHeap RtlSplay RtlStartRXact RtlStatMemoryStream RtlStringFromGUID RtlTraceDatabaseAdd RtlTraceDatabaseCreate RtlTraceDatabaseDestroy RtlTraceDatabaseEnumerate RtlTraceDatabaseFind RtlTraceDatabaseLock RtlTraceDatabaseUnlock RtlTraceDatabaseValidate RtlUlongByteSwap RtlUlonglongByteSwap RtlUnhandledExceptionFilter RtlUnhandledExceptionFilter2 RtlUnlockBootStatusData RtlUnlockMemoryStreamRegion RtlUpdateTimer RtlUsageHeap RtlUshortByteSwap RtlValidRelativeSecurityDescriptor RtlValidateUnicodeString RtlVerifyVersionInfo RtlWalkFrameChain RtlWalkHeap RtlWriteMemoryStream RtlZeroHeap RtlZombifyActivationContext RtlpApplyLengthFunction RtlpEnsureBufferSize RtlpNotOwnerCriticalSection RtlpUnWaitCriticalSection RtlpWaitForCriticalSection SaveEm87Context VerSetConditionMask ZwAccessCheckByType ZwAccessCheckByTypeAndAuditAlarm ZwAccessCheckByTypeResultList ZwAccessCheckByTypeResultListAndAuditAlarm ZwAccessCheckByTypeResultListAndAuditAlarmByHandle ZwAddBootEntry ZwAllocateUserPhysicalPages ZwAreMappedFilesTheSame ZwAssignProcessToJobObject ZwCancelDeviceWakeupRequest ZwCompactKeys ZwCompareTokens ZwCompressKey ZwCreateDebugObject ZwCreateJobObject ZwCreateJobSet ZwCreateKeyedEvent ZwCreateProcessEx ZwCreateWaitablePort ZwDebugActiveProcess ZwDebugContinue ZwDeleteBootEntry ZwEnumerateBootEntries ZwEnumerateSystemEnvironmentValuesEx ZwFilterToken ZwFreeUserPhysicalPages ZwGetDevicePowerState ZwGetWriteWatch ZwImpersonateAnonymousToken ZwInitiatePowerAction ZwIsProcessInJob ZwIsSystemResumeAutomatic ZwLockProductActivationKeys ZwLockRegistryKey ZwMakePermanentObject ZwMapUserPhysicalPages ZwMapUserPhysicalPagesScatter ZwModifyBootEntry ZwNotifyChangeMultipleKeys ZwOpenJobObject ZwOpenKeyedEvent ZwOpenProcessTokenEx ZwOpenThreadTokenEx ZwPowerInformation ZwQueryBootEntryOrder ZwQueryBootOptions ZwQueryDebugFilterState ZwQueryDefaultUILanguage ZwQueryInformationJobObject ZwQueryInstallUILanguage ZwQueryOpenSubKeys ZwQueryPortInformationProcess ZwQueryQuotaInformationFile ZwQuerySystemEnvironmentValueEx ZwReleaseKeyedEvent ZwRemoveProcessDebug ZwRenameKey ZwReplyWaitReceivePortEx ZwRequestDeviceWakeup ZwRequestWakeupLatency ZwResetWriteWatch ZwResumeProcess ZwSaveKeyEx ZwSaveMergedKeys ZwSecureConnectPort ZwSetBootEntryOrder ZwSetBootOptions ZwSetDebugFilterState ZwSetDefaultUILanguage ZwSetEventBoostPriority ZwSetInformationDebugObject ZwSetInformationJobObject ZwSetQuotaInformationFile ZwSetSystemEnvironmentValueEx ZwSetThreadExecutionState ZwSetUuidSeed ZwSuspendProcess ZwTerminateJobObject ZwTraceEvent ZwTranslateFilePath ZwUnloadKeyEx ZwWaitForDebugEvent ZwWaitForKeyedEvent _CIcos _CIlog _CIpow _CIsin _CIsqrt __eCommonExceptions __eEmulatorInit __eF2XM1 __eFABS __eFADD32 __eFADD64 __eFADDPreg __eFADDreg __eFADDtop __eFCHS __eFCOM __eFCOM32 __eFCOM64 __eFCOMP __eFCOMP32 __eFCOMP64 __eFCOMPP __eFCOS __eFDECSTP __eFDIV32 __eFDIV64 __eFDIVPreg __eFDIVR32 __eFDIVR64 __eFDIVRPreg __eFDIVRreg __eFDIVRtop __eFDIVreg __eFDIVtop __eFFREE __eFIADD16 __eFIADD32 __eFICOM16 __eFICOM32 __eFICOMP16 __eFICOMP32 __eFIDIV16 __eFIDIV32 __eFIDIVR16 __eFIDIVR32 __eFILD16 __eFILD32 __eFILD64 __eFIMUL16 __eFIMUL32 __eFINCSTP __eFINIT __eFIST16 __eFIST32 __eFISTP16 __eFISTP32 __eFISTP64 __eFISUB16 __eFISUB32 __eFISUBR16 __eFISUBR32 __eFLD1 __eFLD32 __eFLD64 __eFLD80 __eFLDCW __eFLDENV __eFLDL2E __eFLDLN2 __eFLDPI __eFLDZ __eFMUL32 __eFMUL64 __eFMULPreg __eFMULreg __eFMULtop __eFPATAN __eFPREM __eFPREM1 __eFPTAN __eFRNDINT __eFRSTOR __eFSAVE __eFSCALE __eFSIN __eFSQRT __eFST __eFST32 __eFST64 __eFSTCW __eFSTENV __eFSTP __eFSTP32 __eFSTP64 __eFSTP80 __eFSTSW __eFSUB32 __eFSUB64 __eFSUBPreg __eFSUBR32 __eFSUBR64 __eFSUBRPreg __eFSUBRreg __eFSUBRtop __eFSUBreg __eFSUBtop __eFTST __eFUCOM __eFUCOMP __eFUCOMPP __eFXAM __eFXCH __eFXTRACT __eFYL2X __eFYL2XP1 __eGetStatusWord _alldvrm _aulldvrm _lfind _ui64toa _ui64tow _vsnwprintf bsearch iswdigit iswlower iswxdigit sscanf vDbgPrintEx vDbgPrintExWithPrefix
secur32.dll GetSecurityUserInfo SealMessage SecCacheSspiPackages SecDeleteUserModeContext SecGetLocaleSpecificEncryptionRules SecInitUserModeContext SecpFreeMemory SecpTranslateName SecpTranslateNameEx UnsealMessage
syssetup.dll AsrAddSifEntryA AsrAddSifEntryW AsrCreateStateFileA AsrCreateStateFileW AsrFreeContext AsrRestorePlugPlayRegistryData AsrpGetLocalDiskInfo AsrpGetLocalVolumeInfo AsrpRestoreNonCriticalDisksW CdromPropPageProvider ComputerClassInstaller CreateLocalAdminAccount CreateLocalAdminAccountEx CreateLocalUserAccount CriticalDeviceCoInstaller DevInstallW DeviceBayClassInstaller DiskPropPageProvider DoInstallComponentInfs EisaUpHalCoInstaller EisaUpHalPropPageProvider GenerateName HdcClassInstaller InitializeSetupLog InstallWindowsNt InvokeExternalApplicationEx KeyboardClassInstaller LegacyDriverPropPageProvider MigrateExceptionPackages MouseClassInstaller NtApmClassInstaller OpkCheckVersion PS2MousePropPageProvider PnPInitializationThread PrepareForAudit RepairStartMenuItems ReportError RunOEMExtraTasks ScsiClassInstaller SetAccountsDomainSid SetupAddOrRemoveTestCertificate SetupChangeLocale SetupChangeLocaleEx SetupCreateOptionalComponentsPage SetupDestroyLanguageList SetupDestroyPhoneList SetupEnumerateRegisteredOsComponents SetupExtendPartition SetupGetGeoOptions SetupGetKeyboardOptions SetupGetLocaleOptions SetupGetProductType SetupGetSetupInfo SetupGetValidEula SetupInfObjectInstallActionW (forwarded to SETUPAPI.InstallHinfSectionW) SetupInstallCatalog SetupMapTapiToIso SetupOobeBnk SetupOobeCleanup SetupOobeInitDebugLog SetupOobeInitPostServices SetupOobeInitPreServices SetupPidGen3 SetupQueryRegisteredOsComponent SetupQueryRegisteredOsComponentsOrder SetupReadPhoneList SetupRegisterOsComponent SetupSetAdminPassword SetupSetDisplay SetupSetIntlOptions SetupSetRegisteredOsComponentsOrder SetupSetSetupInfo SetupShellSettings SetupStartService SetupUnRegisterOsComponent StorageCoInstaller SystemUpdateUserProfileDirectory TapeClassInstaller TapePropPageProvider TerminateSetupLog UpdatePnpDeviceDrivers UpgradePrinters ViewSetupActionLog VolumeClassInstaller pSetupDebugPrint pSetuplogSfcError
user32.dll AllowForegroundActivation BuildReasonArray CalcMenuBar CliImmSetHotKey CreateSystemThreads CtxInitUser32 DdeGetQualityOfService DestroyReasons DeviceEventWorker DisplayExitWindowsWarnings EnterReaderModeHelper GetAppCompatFlags2 GetCursorFrameInfo GetReasonTitleFromReasonCode GetWinStationInfo InitializeLpkHooks InitializeWin32EntryTable IsServerSideWindow IsWindowInDestroy LoadKeyboardLayoutEx MessageBoxTimeoutA MessageBoxTimeoutW PaintMenuBar PrivateSetDbgTag PrivateSetRipFlags QuerySendMessage QueryUserCounters ReasonCodeNeedsBugID ReasonCodeNeedsComment RecordShutdownReason RegisterMessagePumpHook RegisterUserApiHook ResolveDesktopForWOW SetConsoleReserveKeys SetCursorContents ShowStartGlass UnregisterMessagePumpHook UnregisterUserApiHook UpdatePerUserSystemParameters User32InitializeImmEntryTable UserLpkPSMTextOut UserLpkTabbedTextOut UserRegisterWowHandlers VRipOutput VTagOutput Win32PoolAllocationStats
ws2_32.dll WEP WSApSetPostRoutine
wsock32.dll MigrateWinsockConfiguration NPLoadNameSpaces WEP WSApSetPostRoutine dn_expand getnetbyname inet_network rcmd rexec rresvport s_perror sethostname
Still looking for the correct prototypes for these, ones that exactly match the microsoft implementations. (matching the ntdll stuff to the ntoskrnl stuff didnt help me find them so I need the specific prototypes as they apply to ntdll.dll)