;======================================================;
;                                                      ;
;       ntdll.inc for EC v2 Fasm visual projects       ;
;                   (version 1.0.1)                    ;
;                                                      ;
;          Copyright © Ramon Sala - 2020-2021          ;
;                                                      ;
;======================================================;

if ~defined NTDLL_INC
define NTDLL_INC    1

if ~defined KERNEL32_INC
    include 'kernel32.inc'
end if

MAXIMUM_FILENAME_LENGTH                         equ     256
PORT_MAXIMUM_MESSAGE_LENGTH                     equ     256
INITIAL_PRIVILEGE_COUNT                         equ     3

FSCTL_GET_VOLUME_INFORMATION                    equ     90064H

DOS_PATHTYPE_UNC                                equ     00000001H
DOS_PATHTYPE_ROOTDRIVE                          equ     00000002H
DOS_PATHTYPE_STREAM                             equ     00000003H
DOS_PATHTYPE_NT                                 equ     00000004H
DOS_PATHTYPE_NAME                               equ     00000005H
DOS_PATHTYPE_DEVICE                             equ     00000006H
DOS_PATHTYPE_LOCALUNCROOT                       equ     00000007H

FILE_REMOVABLE_MEDIA                            equ     00000001H
FILE_READ_ONLY_DEVICE                           equ     00000002H
FILE_FLOPPY_DISKETTE                            equ     00000004H
FILE_WRITE_ONCE_MEDIA                           equ     00000008H
FILE_REMOTE_DEVICE                              equ     00000010H
FILE_DEVICE_IS_MOUNTED                          equ     00000020H
FILE_VIRTUAL_VOLUME                             equ     00000040H
FILE_AUTOGENERATED_DEVICE_NAME                  equ     00000080H
FILE_DEVICE_SECURE_OPEN                         equ     00000100H

FILE_SUPERSEDE                                  equ     00000000H
FILE_OPEN                                       equ     00000001H
FILE_CREATE                                     equ     00000002H
FILE_OPEN_IF                                    equ     00000003H
FILE_OVERWRITE                                  equ     00000004H
FILE_OVERWRITE_IF                               equ     00000005H
FILE_MAXIMUM_DISPOSITION                        equ     00000005H

FILE_DIRECTORY_FILE                             equ     00000001H
FILE_WRITE_THROUGH                              equ     00000002H
FILE_SequENTIAL_ONLY                            equ     00000004H
FILE_NO_INTERMEDIATE_BUFFERING                  equ     00000008H

FILE_SYNCHRONOUS_IO_ALERT                       equ     00000010H
FILE_SYNCHRONOUS_IO_NONALERT                    equ     00000020H
FILE_NON_DIRECTORY_FILE                         equ     00000040H
FILE_CREATE_TREE_CONNECTION                     equ     00000080H

FILE_COMPLETE_IF_OPLOCKED                       equ     00000100H
FILE_NO_EA_KNOWLEDGE                            equ     00000200H
FILE_OPEN_FOR_RECOVERY                          equ     00000400H
FILE_RANDOM_ACCESS                              equ     00000800H

FILE_DELETE_ON_CLOSE                            equ     00001000H
FILE_OPEN_BY_FILE_ID                            equ     00002000H
FILE_OPEN_FOR_BACKUP_INTENT                     equ     00004000H
FILE_NO_COMPRESSION                             equ     00008000H

FILE_RESERVE_OPFILTER                           equ     00100000H
FILE_OPEN_REPARSE_POINT                         equ     00200000H
FILE_OPEN_NO_RECALL                             equ     00400000H
FILE_OPEN_FOR_FREE_SPACE_QUERY                  equ     00800000H

FILE_COPY_STRUCTURED_STORAGE                    equ     00000041H
FILE_STRUCTURED_STORAGE                         equ     00000441H

FILE_VALID_OPTION_FLAGS                         equ     00FFFFFFH
FILE_VALID_PIPE_OPTION_FLAGS                    equ     00000032H
FILE_VALID_MAILSLOT_OPTION_FLAGS                equ     00000032H
FILE_VALID_SET_FLAGS                            equ     00000036H

THREAD_STATE_INITIALIZED                        equ     0
THREAD_STATE_READY                              equ     1
THREAD_STATE_RUNNING                            equ     2
THREAD_STATE_STANDBY                            equ     3
THREAD_STATE_TERMINATED                         equ     4
THREAD_STATE_WAIT                               equ     5
THREAD_STATE_TRANSITION                         equ     6
THREAD_STATE_UNKNOWN                            equ     7

OB_TYPE_TYPE                                    equ     1
OB_TYPE_DIRECTORY                               equ     2
OB_TYPE_SYMBOLIC_LINK                           equ     3
OB_TYPE_TOKEN                                   equ     4
OB_TYPE_PROCESS                                 equ     5
OB_TYPE_THREAD                                  equ     6
OB_TYPE_EVENT                                   equ     7
OB_TYPE_EVENT_PAIR                              equ     8
OB_TYPE_MUTANT                                  equ     9
OB_TYPE_SEMAPHORE                               equ     10
OB_TYPE_TIMER                                   equ     11
OB_TYPE_PROFILE                                 equ     12
OB_TYPE_WINDOW_STATION                          equ     13
OB_TYPE_DESKTOP                                 equ     14
OB_TYPE_SECTION                                 equ     15
OB_TYPE_KEY                                     equ     16
OB_TYPE_PORT                                    equ     17
OB_TYPE_ADAPTER                                 equ     18
OB_TYPE_CONTROLLER                              equ     19
OB_TYPE_DEVICE                                  equ     20
OB_TYPE_DRIVER                                  equ     21
OB_TYPE_IO_COMPLETION                           equ     22
OB_TYPE_FILE                                    equ     23

OBJ_INHERIT                                     equ     00000002H
OBJ_PERMANENT                                   equ     00000010H
OBJ_EXCLUSIVE                                   equ     00000020H
OBJ_CASE_INSENSITIVE                            equ     00000040H
OBJ_OPENIF                                      equ     00000080H
OBJ_OPENLINK                                    equ     00000100H
OBJ_VALID_ATTRIBUTES                            equ     000001F2H


DIRECTORY_QUERY                                 equ     0001H
DIRECTORY_TRAVERSE                              equ     0002H
DIRECTORY_CREATE_OBJECT                         equ     0004H
DIRECTORY_CREATE_SUBDIRECTORY                   equ     0008H
DIRECTORY_ALL_ACCESS                            equ     (STANDARD_RIGHTS_RequIRED or 0FH)

SYMBOLIC_LINK_QUERY                             equ     0001H
SYMBOLIC_LINK_ALL_ACCESS                        equ     (STANDARD_RIGHTS_RequIRED or 01H)

SE_MIN_WELL_KNOWN_PRIVILEGE                     equ     2
SE_CREATE_TOKEN_PRIVILEGE                       equ     2
SE_ASSIGNPRIMARYTOKEN_PRIVILEGE                 equ     3
SE_LOCK_MEMORY_PRIVILEGE                        equ     4
SE_INCREASE_QUOTA_PRIVILEGE                     equ     5
SE_UNSOLICITED_INPUT_PRIVILEGE                  equ     6
SE_MACHINE_ACCOUNT_PRIVILEGE                    equ     6
SE_TCB_PRIVILEGE                                equ     7
SE_SECURITY_PRIVILEGE                           equ     8
SE_TAKE_OWNERSHIP_PRIVILEGE                     equ     9
SE_LOAD_DRIVER_PRIVILEGE                        equ     10
SE_SYSTEM_PROFILE_PRIVILEGE                     equ     11
SE_SYSTEMTIME_PRIVILEGE                         equ     12
SE_PROF_SINGLE_PROCESS_PRIVILEGE                equ     13
SE_INC_BASE_PRIORITY_PRIVILEGE                  equ     14
SE_CREATE_PAGEFILE_PRIVILEGE                    equ     15
SE_CREATE_PERMANENT_PRIVILEGE                   equ     16
SE_BACKUP_PRIVILEGE                             equ     17
SE_RESTORE_PRIVILEGE                            equ     18
SE_SHUTDOWN_PRIVILEGE                           equ     19
SE_DEBUG_PRIVILEGE                              equ     20
SE_AUDIT_PRIVILEGE                              equ     21
SE_SYSTEM_ENVIRONMENT_PRIVILEGE                 equ     22
SE_CHANGE_NOTIFY_PRIVILEGE                      equ     23
SE_REMOTE_SHUTDOWN_PRIVILEGE                    equ     24
SE_MAX_WELL_KNOWN_PRIVILEGE                     equ     SE_REMOTE_SHUTDOWN_PRIVILEGE

PROCESS_PARAMETERS_NORMALIZED                   equ     1

LDR_STATIC_LINK                                 equ     0000002H
LDR_IMAGE_DLL                                   equ     0000004H
LDR_LOAD_IN_PROGRESS                            equ     0001000H
LDR_UNLOAD_IN_PROGRESS                          equ     0002000H
LDR_ENTRY_PROCESSED                             equ     0004000H
LDR_ENTRY_INSERTED                              equ     0008000H
LDR_CURRENT_LOAD                                equ     0010000H
LDR_FAILED_BUILTIN_LOAD                         equ     0020000H
LDR_DONT_CALL_FOR_THREADS                       equ     0040000H
LDR_PROCESS_ATTACH_CALLED                       equ     0080000H
LDR_DEBUG_SYMBOLS_LOADED                        equ     0100000H
LDR_IMAGE_NOT_AT_BASE                           equ     0200000H
LDR_WX86_IGNORE_MACHINETYPE                     equ     0400000H
LDR_COR_IMAGE                                   equ     00400000H
LDR_COR_OWNS_UNMAP                              equ     00800000H
LDR_SYSTEM_MAPPED                               equ     01000000H
LDR_IMAGE_VERIFYING                             equ     02000000H
LDR_DRIVER_DEPENDENT_DLL                        equ     04000000H
LDR_ENTRY_NATIVE                                equ     08000000H
LDR_REDIRECTED                                  equ     10000000H
LDR_NON_PAGED_DEBUG_INFO                        equ     20000000H
LDR_MM_LOADED                                   equ     40000000H
LDR_COMPAT_DATABASE_PROCESSED                   equ     80000000H

;POOL_TYPE Enumeration
NonPagedPool                                    equ     0
PagedPool                                       equ     1
NonPagedPoolMustSucceed                         equ     2
DontUseThisType                                 equ     3
NonPagedPoolCacheAligned                        equ     4
PagedPoolCacheAligned                           equ     5
NonPagedPoolCacheAlignedMustS                   equ     6
MaxPoolType                                     equ     7

;KWAIT_REASON Enumeration
Executive                                       equ     0
FreePage                                        equ     1
PageIn                                          equ     2
PoolAllocation                                  equ     3
DelayExecution                                  equ     4
Suspended                                       equ     5
UserRequest                                     equ     6
WrExecutive                                     equ     7
WrFreePage                                      equ     8
WrPageIn                                        equ     9
WrPoolAllocation                                equ     10
WrDelayExecution                                equ     11
WrSuspended                                     equ     12
WrUserRequest                                   equ     13
WrEventPair                                     equ     14
WrQueue                                         equ     15
WrLpcReceive                                    equ     16
WrLpcReply                                      equ     17
WrVirtualMemory                                 equ     18
WrPageOut                                       equ     19
WrRendezvous                                    equ     20
Spare2                                          equ     21
Spare3                                          equ     22
Spare4                                          equ     23
Spare5                                          equ     24
Spare6                                          equ     25
WrKernel                                        equ     26
MaximumWaitReason                               equ     27

;SYSTEMINFOCLASS Enumeration
SystemBasicInformation                          equ     0
SystemProcessorInformation                      equ     1
SystemPerformanceInformation                    equ     2
SystemTimeOfDayInformation                      equ     3
SystemPathInformation                           equ     4 ;Not implemented
SystemProcessInformation                        equ     5
SystemCallCounts                                equ     6
SystemCallCountInformation                      equ     6
SystemConfigurationInformation                  equ     7
SystemDeviceInformation                         equ     7
SystemProcessorTimes                            equ     8
SystemProcessorPerformanceInformation           equ     8
SystemGlobalFlag                                equ     9
SystemFlagsInformation                          equ     9
SystemCallTimeInformation                       equ     10
SystemModuleInformation                         equ     11
SystemLockInformation                           equ     12
SystemStackTraceInformation                     equ     13
SystemPagedPoolInformation                      equ     14
SystemNonPagedPoolInformation                   equ     15
SystemHandleInformation                         equ     16
SystemObjectInformation                         equ     17
SystemPagefileInformation                       equ     18
SystemInstructionEmulationCounts                equ     19
SystemVdmInstemulInformation                    equ     19
SystemVdmBopInformation                         equ     20 ;Not implemented
SystemCacheInformation                          equ     21
SystemFileCacheInformation                      equ     21
SystemPoolTagInformation                        equ     22
SystemProcessorStatistics                       equ     23
SystemInterruptInformation                      equ     23
SystemDpcInformation                            equ     24
SystemDpcBehaviorInformation                    equ     24
SystemFullMemoryInformation                     equ     25
SystemLoadImage                                 equ     26
SystemLoadGdiDriverInformation                  equ     26
SystemUnloadImage                               equ     27
SystemUnloadGdiDriverInformation                equ     27
SystemTimeAdjustment                            equ     28
SystemTimeAdjustmentInformation                 equ     28
SystemSummaryMemoryInformation                  equ     29
SystemMirrorMemoryInformation                   equ     30
SystemPerformanceTraceInformation               equ     31
SystemCrashDumpInformation                      equ     32 ;Not implemented
SystemObsolete0                                 equ     32 ;Not implemented
SystemExceptionInformation                      equ     33
SystemCrashDumpStateInformation                 equ     34
SystemKernelDebuggerInformation                 equ     35
SystemContextSwitchInformation                  equ     36
SystemRegistryQuotaInformation                  equ     37
SystemLoadAndCallImage                          equ     38
SystemExtendServiceTableInformation             equ     38
SystemPrioritySeparation                        equ     39
SystemVerifierAddDriverInformation              equ     40
SystemVerifierRemoveDriverInformation           equ     41
SystemProcessorIdleInformation                  equ     42
SystemLegacyDriverInformation                   equ     43
SystemTimeZoneInformation                       equ     44
SystemCurrentTimeZoneInformation                equ     44
SystemLookasideInformation                      equ     45
SystemSetTimeSlipEvent                          equ     46
SystemTimeSlipNotification                      equ     46
SystemCreateSession                             equ     47
SystemSessionCreate                             equ     47
SystemDeleteSession                             equ     48
SystemSessionDetach                             equ     48
SystemSessionInformation                        equ     49
SystemRangeStartInformation                     equ     50
SystemVerifierInformation                       equ     51
SystemAddVerifier                               equ     52
SystemVerifierThunkExtend                       equ     52
SystemSessionProcessesInformation               equ     53
SystemLoadGdiDriverInSystemSpace                equ     54
SystemNumaProcessorMap                          equ     55
SystemPrefetcherInformation                     equ     56
SystemExtendedProcessInformation                equ     57
SystemRecommendedSharedDataAlignment            equ     58
SystemComPlusPackage                            equ     59
SystemNumaAvailableMemory                       equ     60
SystemProcessorPowerInformation                 equ     61
SystemEmulationBasicInformation                 equ     62
SystemEmulationProcessorInformation             equ     63
SystemExtendedHandleInformation                 equ     64
SystemLostDelayedWriteInformation               equ     65
SystemBigPoolInformation                        equ     66
SystemSessionPoolTagInformation                 equ     67
SystemSessionMappedViewInformation              equ     68
SystemHotpatchInformation                       equ     69
SystemObjectSecurityMode                        equ     70
SystemWatchdogTimerHandler                      equ     71
SystemWatchdogTimerInformation                  equ     72
SystemLogicalProcessorInformation               equ     73
SystemWow64SharedInformationObsolete            equ     74
SystemRegisterFirmwareTableInformationHandler   equ     75
SystemFirmwareTableInformation                  equ     76
SystemModuleInformationEx                       equ     77
SystemVerifierTriageInformation                 equ     78
SystemSuperfetchInformation                     equ     79
SystemMemoryListInformation                     equ     80
SystemFileCacheInformationEx                    equ     81
SystemThreadPriorityClientIdInformation         equ     82
SystemProcessorIdleCycleTimeInformation         equ     83
SystemVerifierCancellationInformation           equ     84
SystemProcessorPowerInformationEx               equ     85
SystemRefTraceInformation                       equ     96
SystemSpecialPoolInformation                    equ     87
SystemProcessIdInformation                      equ     88
SystemErrorPortInformation                      equ     89
SystemBootEnvironmentInformation                equ     90
SystemHypervisorInformation                     equ     91
SystemVerifierInformationEx                     equ     92
SystemTimeZoneInformation                       equ     93
SystemImageFileExecutionOptionsInformation      equ     94
SystemCoverageInformation                       equ     95
SystemPrefetchPatchInformation                  equ     96
SystemVerifierFaultsInformation                 equ     97
SystemSystemPartitionInformation                equ     98
SystemSystemDiskInformation                     equ     99
SystemProcessorPerformanceDistribution          equ     100
SystemNumaProximityNodeInformation              equ     101
SystemDynamicTimeZoneInformation                equ     102
SystemCodeIntegrityInformation                  equ     103
SystemProcessorMicrocodeUpdateInformation       equ     104
SystemProcessorBrandString                      equ     105
SystemVirtualAddressInformation                 equ     106
SystemLogicalProcessorAndGroupInformation       equ     107
SystemProcessorCycleTimeInformation             equ     108
SystemStoreInformation                          equ     109
SystemRegistryAppendString                      equ     110
SystemAitSamplingValue                          equ     111
SystemVhdBootInformation                        equ     112
SystemCpuQuotaInformation                       equ     113
SystemNativeBasicInformation                    equ     114
SystemSpare1                                    equ     115
SystemLowPriorityIoInformation                  equ     116
SystemTpmBootEntropyInformation                 equ     117
SystemVerifierCountersInformation               equ     118
SystemPagedPoolInformationEx                    equ     119
SystemSystemPtesInformationEx                   equ     120
SystemNodeDistanceInformation                   equ     121
SystemAcpiAuditInformation                      equ     122
SystemBasicPerformanceInformation               equ     123
SystemQueryPerformanceCounterInformation        equ     124
SystemSessionBigPoolInformation                 equ     125
SystemBootGraphicsInformation                   equ     126
SystemScrubPhysicalMemoryInformation            equ     127
SystemBadPageInformation                        equ     128
SystemProcessorProfileControlArea               equ     129
SystemCombinePhysicalMemoryInformation          equ     130
SystemEntropyInterruptTimingCallback            equ     131
SystemConsoleInformation                        equ     132
SystemPlatformBinaryInformation                 equ     133
SystemThrottleNotificationInformation           equ     134
SystemHypervisorProcessorCountInformation       equ     135
SystemDeviceDataInformation                     equ     136
SystemDeviceDataEnumerationInformation          equ     137
SystemMemoryTopologyInformation                 equ     138
SystemMemoryChannelInformation                  equ     139
SystemBootLogoInformation                       equ     140
SystemProcessorPerformanceInformationEx         equ     141
SystemSpare0                                    equ     142
SystemSecureBootPolicyInformation               equ     143
SystemPageFileInformationEx                     equ     144
SystemSecureBootInformation                     equ     145
SystemEntropyInterruptTimingRawInformation      equ     146
SystemPortableWorkspaceEfiLauncherInformation   equ     147
SystemFullProcessInformation                    equ     148
SystemKernelDebuggerInformationEx               equ     149
SystemBootMetadataInformation                   equ     150
SystemSoftRebootInformation                     equ     151
SystemElamCertificateInformation                equ     152
SystemOfflineDumpConfigInformation              equ     153
SystemProcessorFeaturesInformation              equ     154
SystemRegistryReconciliationInformation         equ     155
SystemEdidInformation                           equ     156
SystemManufacturingInformation                  equ     157
SystemEnergyEstimationConfigInformation         equ     158
SystemHypervisorDetailInformation               equ     159
SystemProcessorCycleStatsInformation            equ     160
SystemVmGenerationCountInformation              equ     161
SystemTrustedPlatformModuleInformation          equ     162
SystemKernelDebuggerFlags                       equ     163
SystemCodeIntegrityPolicyInformation            equ     164
SystemIsolatedUserModeInformation               equ     165
SystemHardwareSecurityTestInterfaceResultsInformation equ  166
SystemSingleModuleInformation                   equ     167
SystemAllowedCpuSetsInformation                 equ     168
SystemDmaProtectionInformation                  equ     169
SystemInterruptCpuSetsInformation               equ     170
SystemSecureBootPolicyFullInformation           equ     171
SystemCodeIntegrityPolicyFullInformation        equ     172
SystemAffinitizedInterruptProcessorInformation  equ     173
SystemRootSiloInformation                       equ     174
MaxSystemInfoClass                              equ     175

;THREAD_STATE Enumeration
StateInitialized                                equ     0
StateReady                                      equ     1
StateRunning                                    equ     2
StateStandby                                    equ     3
StateTerminated                                 equ     4
StateWait                                       equ     5
StateTransition                                 equ     6
StateUnknown                                    equ     7

;FILE_INFORMATION_CLASS Enumeration
FileDirectoryInformation                        equ     1
FileFullDirectoryInformation                    equ     2
FileBothDirectoryInformation                    equ     3
FileBasicInformation                            equ     4
FileStandardInformation                         equ     5
FileInternalInformation                         equ     6
FileEaInformation                               equ     7
FileAccessInformation                           equ     8
FileNameInformation                             equ     9
FileRenameInformation                           equ     10
FileLinkInformation                             equ     11
FileNamesInformation                            equ     12
FileDispositionInformation                      equ     13
FilePositionInformation                         equ     14
FileFullEaInformation                           equ     15
FileModeInformation                             equ     16
FileAlignmentInformation                        equ     17
FileAllInformation                              equ     18
FileAllocationInformation                       equ     19
FileEndOfFileInformation                        equ     20
FileAlternateNameInformation                    equ     21
FileStreamInformation                           equ     22
FilePipeInformation                             equ     23
FilePipeLocalInformation                        equ     24
FilePipeRemoteInformation                       equ     25
FileMailslotQueryInformation                    equ     26
FileMailslotSetInformation                      equ     27
FileCompressionInformation                      equ     28
FileObjectIdInformation                         equ     29
FileCompletionInformation                       equ     30
FileMoveClusterInformation                      equ     31
FileInformationReserved32                       equ     32
FileInformationReserved33                       equ     33
FileNetworkOpenInformation                      equ     34
FileMaximumInformation                          equ     35

;KEY_INFORMATION_CLASS Enumeration
KeyBasicInformation                             equ     0
KeyNodeInformation                              equ     1
KeyFullInformation                              equ     2
KeyNameInformation                              equ     3
KeyCachedInformation                            equ     4
KeyVirtualizationInformation                    equ     5

;KEY_VALUE_INFORMATION_CLASS Enumeration
KeyValueBasicInformation                        equ     0
KeyValueFullInformation                         equ     1
KeyValuePartialInformation                      equ     2

;PROCESSINFOCLASS Enumeration
ProcessBasicInformation                         equ     0
ProcessQuotaLimits                              equ     1
ProcessIoCounters                               equ     2
ProcessVmCounters                               equ     3
ProcessTimes                                    equ     4
ProcessBasePriority                             equ     5
ProcessRaisePriority                            equ     6
ProcessDebugPort                                equ     7
ProcessExceptionPort                            equ     8
ProcessAccessToken                              equ     9
ProcessLdtInformation                           equ     10
ProcessLdtSize                                  equ     11
ProcessDefaultHardErrorMode                     equ     12
ProcessIoPortHandlers                           equ     13
ProcessPooledUsageAndLimits                     equ     14
ProcessWorkingSetWatch                          equ     15
ProcessUserModeIOPL                             equ     16
ProcessEnableAlignmentFaultFixup                equ     17
ProcessPriorityClass                            equ     18
ProcessWx86Information                          equ     19
ProcessHandleCount                              equ     20
ProcessAffinityMask                             equ     21
ProcessPriorityBoost                            equ     22
ProcessDeviceMap                                equ     23
ProcessSessionInformation                       equ     24
ProcessForegroundInformation                    equ     25
ProcessWow64Information                         equ     26
MaxProcessInfoClass                             equ     27

;LPC_TYPE Enumeration
LPC_NEW_MESSAGE                                 equ     0
LPC_RequEST                                     equ     1
LPC_REPLY                                       equ     2
LPC_DATAGRAM                                    equ     3
LPC_LOST_REPLY                                  equ     4
LPC_PORT_CLOSED                                 equ     5
LPC_CLIENT_DIED                                 equ     6
LPC_EXCEPTION                                   equ     7
LPC_DEBUG_EVENT                                 equ     8
LPC_ERROR_EVENT                                 equ     9
LPC_CONNECTION_RequEST                          equ     10
LPC_CONNECTION_REFUSED                          equ     11
LPC_MAXIMUM                                     equ     12

;SECTION_INHERIT Enumeration
ViewShare                                       equ     1
ViewUnmap                                       equ     2

;SECTION_INFORMATION_CLASS Enumeration
SectionBasicInformation                         equ     0
SectionImageInformation                         equ     1

;OBJECT_INFORMATION_CLASS Enumeration
ObjectBasicInformation                          equ     0
ObjectNameInformation                           equ     1
ObjectTypeInformation                           equ     2
ObjectAllTypesInformation                       equ     3
ObjectHandleInformation                         equ     4

;MEMORY_INFORMATION_CLASS Enumeration
MemoryBasicInformation                          equ     0
MemoryWorkingSetList                            equ     1
MemorySectionName                               equ     2
MemoryBasicVlmInformation                       equ     3

;THREADINFOCLASS Enumeration
ThreadBasicInformation                          equ     0
ThreadTimes                                     equ     1
ThreadPriority                                  equ     2
ThreadBasePriority                              equ     3
ThreadAffinityMask                              equ     4
ThreadImpersonationToken                        equ     5
ThreadDescriptorTableEntry                      equ     6
ThreadEnableAlignmentFaultFixup                 equ     7
ThreadEventPair                                 equ     8
ThreadQuerySetWin32StartAddress                 equ     9
ThreadZeroTlsCell                               equ     10
ThreadPerformanceCount                          equ     11
ThreadAmILastThread                             equ     12
ThreadIdealProcessor                            equ     13
ThreadPriorityBoost                             equ     14
ThreadSetTlsArrayAddress                        equ     15
ThreadIsIoPending                               equ     16
ThreadHideFromDebugger                          equ     17
MaxThreadInfoClass                              equ     18

;FSINFOCLASS Enumeration
FileFsVolumeInformation                         equ     1
FileFsLabelInformation                          equ     2
FileFsSizeInformation                           equ     3
FileFsDeviceInformation                         equ     4
FileFsAttributeInformation                      equ     5
FileFsControlInformation                        equ     6
FileFsFullSizeInformation                       equ     7
FileFsObjectIdInformation                       equ     8
FileFsMaximumInformation                        equ     9

;PLUGPLAY_BUS_CLASS Enumeration
SystemBus                                       equ     0
PlugPlayVirtualBus                              equ     1
MaxPlugPlayBusClass                             equ     2

;PLUGPLAY_VIRTUAL_BUS_TYPE Enumeration
Root                                            equ     0
MaxPlugPlayVirtualBusType                       equ     1

;INTERFACE_TYPE Enumeration
InterfaceTypeUndefined                          equ     (-1)
Internal                                        equ     0
Isa                                             equ     1
Eisa                                            equ     2
MicroChannel                                    equ     3
TurboChannel                                    equ     4
PCIBus                                          equ     5
VMEBus                                          equ     6
NuBus                                           equ     7
PCMCIABus                                       equ     8
CBus                                            equ     9
MPIBus                                          equ     10
MPSABus                                         equ     11
ProcessorInternal                               equ     12
InternalPowerBus                                equ     13
PNPISABus                                       equ     14
PNPBus                                          equ     15
MaximumInterfaceType                            equ     16

;SYSTEM_DOCK_STATE Enumeration
SystemDockStateUnknown                          equ     0
SystemUndocked                                  equ     1
SystemDocked                                    equ     2

MAX_SYSTEM_MODULE_NAME_LENGTH                   equ     256

LPC_MAX_MESSAGE_SIZE                            equ     148
LPC_MAX_DATA_SIZE                               equ     104

SIZE_OF_80387_REGISTERS                         equ     80
MAXIMUM_SUPPORTED_EXTENSION                     equ     512

_CONTEXT_i386                                   equ     010000H
_CONTEXT_AMD64                                  equ     100000H
_CONTEXT_CONTROL                                equ     1
_CONTEXT_INTEGER                                equ     2

IMAGE_REL_BASED_MASK                            equ     0FFFH
IMAGE_REL_BASED_SHIFT                           equ     12

IMAGE_SIZEOF_BASE_RELOCATION                    equ     8

UWOP_PUSH_NONVOL                                equ     0
UWOP_ALLOC_LARGE                                equ     1
UWOP_ALLOC_SMALL                                equ     2
UWOP_SET_FPREG                                  equ     3
UWOP_SAVE_NONVOL                                equ     4
UWOP_SAVE_NONVOL_FAR                            equ     5
UWOP_SAVE_XMM128                                equ     6
UWOP_SAVE_XMM128_FAR                            equ     7
UWOP_PUSH_MACHFRAME                             equ     8

PDI_MODULES                                     equ     01H
PDI_BACKTRACE                                   equ     02H
PDI_HEAPS                                       equ     04H
PDI_HEAP_TAGS                                   equ     08H
PDI_HEAP_BLOCKS                                 equ     10H
PDI_LOCKS                                       equ     20H

UNW_FLAG_NHANDLER                               equ     0H
UNW_FLAG_EHANDLER                               equ     1H
UNW_FLAG_UHANDLER                               equ     2H
UNW_FLAG_CHAININFO                              equ     4H

MAX_BUS_NAME                                    equ     24

KRNL_NORMAL_PRIORITY_CLASS                      equ     02H
KRNL_IDLE_PRIORITY_CLASS                        equ     01H
KRNL_HIGH_PRIORITY_CLASS                        equ     03H
KRNL_REALTIME_PRIORITY_CLASS                    equ     04H

;======================================== Structures ======================================;
if ~defined LARGE_INTEGER_DEF
    LARGE_INTEGER_DEF equ 1
    struct LARGE_INTEGER
        LowPart  dd ?
        HighPart dd ?
    ends
end if

if ~defined ULARGE_INTEGER_DEF
    ULARGE_INTEGER_DEF equ 1
    struct ULARGE_INTEGER
        LowPart  dd ?
        HighPart dd ?
    ends
end if

if ~defined UNICODE_STRING32_DEFINED
    define UNICODE_STRING32_DEFINED 1
    struct UNICODE_STRING32
        Length          dw ?
        MaximumLength   dw ?
        Buffer          dd ?
    ends
end if

if ~defined UNICODE_STRING64_DEFINED
    define UNICODE_STRING64_DEFINED 1
    struct UNICODE_STRING64
        Length          dw ?
        MaximumLength   dw ?
        Reserved        dd ?
        Buffer          dq ?
    ends
end if

struct OBJECT_ATTRIBUTES
    Length                   dd    ?
    RootDirectory            xptr ?
    ObjectName               xptr  ?
    Attributes               dd    ?
    SecurityDescriptor       xptr  ?
    SecurityQualityOfService xptr  ?
ends

struct CLIENT_ID
    UniqueProcess   xptr ?
    UniqueThread    xptr ?
ends

struct NT_TIB
    ExceptionList   xptr ?
    StackBase       xptr ?
    StackLimit      xptr ?
    SubSystemTib    xptr ?
    union
        FiberData   xptr ?
        Version     dd   ?
    ends
    ArbitraryUserPointer xptr ?
    Self            xptr ?
ends

struct PEB_FREE_BLOCK
    Next    xptr ?
    Size    dd   ?
ends

struct CURDIR
   DosPath  UNICODE_STRING
   Handle   xptr ?
ends

struct RTL_DRIVE_LETTER_CURDIR
    Flags       dd ?
    Length      dw ?
    TimeStamp   dd ?
    DosPath     STRING
ends

struct PROCESS_PARAMETERS
    MaximumLength       dd   ?
    Length              dd   ?
    Flags               dd   ?
    DebugFlags          dd   ?
    ConsoleHandle       xptr ?
    ConsoleFlags        dd   ?
    StandardInput       xptr ?
    StandardOutput      xptr ?
    StandardError       xptr ?
    CurrentDirectory    CURDIR
    DllPath             UNICODE_STRING
    ImagePathName       UNICODE_STRING
    CommandLine         UNICODE_STRING
    Environment         xptr ?
    StartingX           dd   ?
    StartingY           dd   ?
    CountX              dd   ?
    CountY              dd   ?
    CountCharsX         dd   ?
    CountCharsY         dd   ?
    FillAttribute       dd   ?
    WindowFlags         dd   ?
    ShowWindowFlags     dd   ?
    WindowTitle         UNICODE_STRING
    Desktop             UNICODE_STRING
    ShellInfo           UNICODE_STRING
    RuntimeInfo         UNICODE_STRING
    CurrentDirectores   RTL_DRIVE_LETTER_CURDIR 32
ends

struct RTL_BITMAP
    SizeOfBitMap    dd   ?
    Buffer          xptr ?
ends

struct LDR_DATA_TABLE_ENTRY64
    InLoadOrderModuleList           LIST_ENTRY64
    InMemoryOrderModuleList         LIST_ENTRY64
    InInitializationOrderModuleList LIST_ENTRY64
    DllBase                         dq ?
    EntryPoint                      dq ?
    SizeOfImage                     dd ?
    FullDllName                     UNICODE_STRING64
    BaseDllName                     UNICODE_STRING64
    Flags                           dd ?
    LoadCount                       dw ?
    TlsIndex                        dw ?
    union
        HashLinks                   LIST_ENTRY64
        struct
            SectionPointer          dq ?
            CheckSum                dd ?
        ends
    ends
    union
        TimeDateStamp               dd ?
        LoadedImports               dq ?
    ends
    EntryPointActivationContext     dq ?
    PatchInformation                dq ?
ends

struct LDR_DATA_TABLE_ENTRY32
    InLoadOrderModuleList           LIST_ENTRY32
    InMemoryOrderModuleList         LIST_ENTRY32
    InInitializationOrderModuleList LIST_ENTRY32
    DllBase                         dd ?
    EntryPoint                      dd ?
    SizeOfImage                     dd ?
    FullDllName                     UNICODE_STRING32
    BaseDllName                     UNICODE_STRING32
    Flags                           dd ?
    LoadCount                       dw ?
    TlsIndex                        dw ?
    union
        HashLinks                   LIST_ENTRY32
        struct
            SectionPointer          dd ?
            CheckSum                dd ?
        ends
        union
            TimeDateStamp               dd ?
            LoadedImports               dd ?
        ends
    ends
    EntryPointActivationContext     dd ?
    PatchInformation                dd ?
ends

struct LDR_DATA_TABLE_ENTRY
     InLoadOrderLinks           LIST_ENTRY
     InMemoryOrderLinks         LIST_ENTRY
     InInitializationOrderLinks LIST_ENTRY
     DllBase                    xptr ?
     EntryPoint                 xptr ?
     SizeOfImage                dd   ?
     FullDllName                UNICODE_STRING
     BaseDllName                UNICODE_STRING
     Flags                      dd   ?
     LoadCount                  dw   ?
     TlsIndex                   dw   ?
     union
          HashLinks             LIST_ENTRY
          struct
               SectionPointer   xptr ?
               CheckSum         dd   ?
          ends
     ends
     union
          TimeDateStamp         dd   ?
          LoadedImports         xptr ?
     ends
     _ACTIVATION_CONTEXT        xptr ?
     PatchInformation           xptr ?
     ForwarderLinks             LIST_ENTRY
     ServiceTagLinks            LIST_ENTRY
     StaticLinks                LIST_ENTRY
ends

struct PEB_LDR_DATA64
    Length                          dd ?
    Initialized                     db ?
    SsHandle                        dq ?
    InLoadOrderModuleList           LIST_ENTRY64
    InMemoryOrderModuleList         LIST_ENTRY64
    InInitializationOrderModuleList LIST_ENTRY64
ends

struct PEB_LDR_DATA32
    Length                          dd ?
    Initialized                     db ?
    SsHandle                        dd ?
    InLoadOrderModuleList           LIST_ENTRY32
    InMemoryOrderModuleList         LIST_ENTRY32
    InInitializationOrderModuleList LIST_ENTRY32
ends

struct PEB_LDR_DATA
    Length                          dd   ?
    Initialized                     db   ?
    SsHandle                        xptr ?
    InLoadOrderModuleList           LIST_ENTRY
    InMemoryOrderModuleList         LIST_ENTRY
    InInitializationOrderModuleList LIST_ENTRY
ends

struct SYSTEM_STRINGS
    SystemRoot          UNICODE_STRING
    System32Root        UNICODE_STRING
    BaseNamedObjects    UNICODE_STRING
ends

struct TEXT_INFO
    Reserved        xptr ?
    SystemStrings   xptr ?
ends

struct PEB64
    InheritedAddressSpace    db ?
    ReadImageFileExecOptions db ?
    BeingDebugged            db ?
    b003                     db ?
    Reserved0                dd ?
    Mutant                   dq ?
    ImageBaseAddress         dq ?
    Ldr                      dq ?
    ProcessParameters        dq ?
ends

struct PEB32
    InheritedAddressSpace    db ?
    ReadImageFileExecOptions db ?
    BeingDebugged            db ?
    b003                     db ?
    Mutant                   dd ?
    ImageBaseAddress         dd ?
    Ldr                      dd ?
    ProcessParameters        dd ?
ends

struct PEB
    InheritedAddressSpace            db ?
    ReadImageFileExecOptions         db ?
    BeingDebugged                    db ?
    b003                             db ?
    Mutant                           xptr ?
    ImageBaseAddress                 xptr ?
    Ldr                              xptr ?
    ProcessParameters                xptr ?
    SubSystemData                    xptr ?
    ProcessHeap                      xptr ?
    FastPebLock                      xptr ?
    FastPebLockRoutine               xptr ?
    FastPebUnlockRoutine             xptr ?
    EnvironmentUpdateCount           dd   ?
    KernelCallbackTable              xptr ?
    EventLogSection                  xptr ?
    EventLog                         xptr ?
    FreeList                         xptr ?
    TlsExpansionCounter              dd   ?
    TlsBitmap                        xptr ?
    TlsBitmapData                    dd   ?
    ReadOnlySharedMemoryBase         xptr ?
    ReadOnlySharedMemoryHeap         xptr ?
    ReadOnlyStaticServerData         xptr ?
    InitAnsiCodePageData             xptr ?
    InitOemCodePageData              xptr ?
    InitUnicodeCaseTableData         xptr ?
    KeNumberProcessors               dd   ?
    NtGlobalFlag                     dd   ?
    d6C                              dd   ?
    MmCriticalSectionTimeout         LARGE_INTEGER
    MmHeapSegmentReserve             dd   ?
    MmHeapSegmentCommit              dd   ?
    MmHeapDeCommitTotalFreeThreshold dd   ?
    MmHeapDeCommitFreeBlockThreshold dd   ?
    NumberOfHeaps                    dd   ?
    AvailableHeaps                   dd   ?
    ProcessHeapsListBuffer           xptr ?
    GdiSharedHandleTable             xptr ?
    ProcessStarterHelper             xptr ?
    GdiDCAttributeList               xptr ?
    LoaderLock                       xptr ?
    NtMajorVersion                   dd   ?
    NtMinorVersion                   dd   ?
    NtBuildNumber                    dw   ?
    NtCSDVersion                     dw   ?
    PlatformId                       dd   ?
    Subsystem                        dd   ?
    MajorSubsystemVersion            dd   ?
    MinorSubsystemVersion            dd   ?
    AffinityMask                     xptr ?
    GdiHandleBuffer                  dd   ?
    PostProcessInitRoutine           dd   ?
    TlsExpansionBitmap               dd   ?
    TlsExpansionBitmapBits           dw   ?
    SessionId                        dd   ?
    AppCompatFlags                   ULARGE_INTEGER
    CSDVersion                       xptr ?
ends

struct TEB
    Tib                          NT_TIB
    EnvironmentPointer           xptr ?
    Cid                          CLIENT_ID
    ActiveRpcInfo                xptr ?
    ThreadLocalStoragePointer    xptr ?
    Peb                          xptr ?
    LastErrorValue               dd   ?
    CountOfOwnedCriticalSections dd   ?
    CsrClientThread              xptr ?
    Win32ThreadInfo              xptr ?
    Win32ClientInfo              dd   01FH dup(?)
    WOW32Reserved                xptr ?
    CurrentLocale                dd   ?
    FpSoftwareStatusRegister     dd   ?
    SystemReserved1              xptr ?
    Spare1                       xptr ?
    ExceptionCode                dd   ?
    SpareBytes1                  dd   28 dup(?)
    SystemReserved2              xptr ?
    gdiRgn                       dd   ?
    gdiPen                       dd   ?
    gdiBrush                     dd   ?
    RealClientId                 CLIENT_ID
    GdiCachedProcessHandle       xptr ?
    GdiClientPID                 dd   ?
    GdiClientTID                 dd   ?
    GdiThreadLocaleInfo          xptr ?
    UserReserved                 xptr 5 dup(?)
    glDispatchTable              xptr 118 dup(?)
    glReserved1                  dd   01AH dup(?)
    glReserved2                  xptr ?
    glSectionInfo                xptr ?
    glSection                    xptr ?
    glTable                      xptr ?
    glCurrentRC                  xptr ?
    glContext                    xptr ?
    LastStatusValue              dd   ?
    StaticUnicodeString          UNICODE_STRING
    StaticUnicodeBuffer          dw 105 dup(?)
    DeallocationStack            xptr ?
    TlsSlots                     xptr 40 dup(?)
    TlsLinks                     LIST_ENTRY
    Vdm                          xptr ?
    ReservedForNtRpc             xptr ?
    DbgSsReserved                xptr 2 dup(?)
    HardErrorDisabled            dd   ?
    Instrumentation              xptr 10 dup(?)
    WinSockData                  xptr ?
    GdiBatchCount                dd   ?
    _Spare2                      dd   ?
    _Spare3                      dd   ?
    _Spare4                      dd   ?
    ReservedForOle               xptr ?
    WaitingOnLoaderLock          dd   ?
    StackCommit                  xptr ?
    StackCommitMax               xptr ?
    StackReserve                 xptr ?
ends

struct DISPATCHER_HEADER
    uType           db ?
    uAbsolute       db ?
    uSize           db ?
    uInserted       db ?
    lSignalState    dd ?
    WaitListHead    LIST_ENTRY
ends

struct KPROCESS
    Header          DISPATCHER_HEADER
    le10            LIST_ENTRY
    d18             dd ?
    d1C             dd ?
    d20             dd ?
    d24             dd ?
    d28             dd ?
    d2C             dd ?
    d30             dd ?
    d34             dd ?
    dKernelTime     dd ?
    dUserTime       dd ?
    le40            LIST_ENTRY
    OutSwapList     LIST_ENTRY
    ThreadListHead  LIST_ENTRY
    d58             dd ?
    AffinityMask    xptr ?
    w60             dw ?
    bBasePriority   db ?
    b63             db ?
    w64             dw ?
    b66             db ?
    fPriorityBoost  db ?
ends

struct PORT_MESSAGE
    DataSize            dw ?
    MessageSize         dw ?
    MessageType         dw ?
    VirtualRangesOffset dw ?
    ClientId            CLIENT_ID
    MessageId           dd ?
    SectionSize         dd ?
    Data                db 2 dup(?)
ends

struct SERVICE_DESCRIPTOR_TABLE
    ServiceTable    xptr ?
    puCounterTable  xptr ?
    uTableSize      dd   ?
    pbArgumentTable xptr ?
ends

struct KSEMAPHORE
    Header  DISPATCHER_HEADER
    lLimit  dd ?
ends

struct KTHREAD
    Header                      DISPATCHER_HEADER
    le010                       LIST_ENTRY
    d018                        dd   ?
    d01C                        dd   ?
    pTeb                        xptr ?
    d024                        dd   ?
    d028                        dd   ?
    b02C                        db   ?
    bThreadState                db   ?
    w02E                        dw   ?
    w030                        dw   ?
    b032                        db   ?
    bPriority                   db   ?
    le034                       LIST_ENTRY
    le03C                       LIST_ENTRY
    pProcess                    xptr ?
    d048                        dd   ?
    dContextSwitches            dd   ?
    d050                        dd   ?
    w054                        dw   ?
    b056                        db   ?
    bWaitReason                 db   ?
    d058                        dd   ?
    ple05C                      xptr ?
    ple060                      xptr ?
    d064                        dd   ?
    bBasePriority               db   ?
    b069                        db   ?
    w06A                        dw   ?
    d06C                        dd   ?
    d070                        dd   ?
    d074                        dd   ?
    d078                        dd   ?
    d07C                        dd   ?
    d080                        dd   ?
    d084                        dd   ?
    d088                        dd   ?
    d08C                        dd   ?
    d090                        dd   ?
    d094                        dd   ?
    d098                        dd   ?
    d09C                        dd   ?
    d0A0                        dd   ?
    d0A4                        dd   ?
    d0A8                        dd   ?
    d0AC                        dd   ?
    d0B0                        dd   ?
    d0B4                        dd   ?
    d0B8                        dd   ?
    d0BC                        dd   ?
    d0C0                        dd   ?
    d0C4                        dd   ?
    d0C8                        dd   ?
    d0CC                        dd   ?
    d0D0                        dd   ?
    d0D4                        dd   ?
    d0D8                        dd   ?
    pServiceDescriptorTable     xptr ?
    d0E0                        dd   ?
    d0E4                        dd   ?
    d0E8                        dd   ?
    d0EC                        dd   ?
    le0F0                       LIST_ENTRY
    d0F8                        dd   ?
    d0FC                        dd   ?
    d100                        dd   ?
    d104                        dd   ?
    d108                        dd   ?
    d10C                        dd   ?
    d110                        dd   ?
    d114                        dd   ?
    d118                        dd   ?
    b11C                        db   ?
    b11D                        db   ?
    w11E                        dw   ?
    d120                        dd   ?
    d124                        dd   ?
    d128                        dd   ?
    d12C                        dd   ?
    d130                        dd   ?
    w134                        dw   ?
    b136                        db   ?
    ProcessorMode               db   ?
    dKernelTime                 dd   ?
    dUserTime                   dd   ?
    d140                        dd   ?
    d144                        dd   ?
    d148                        dd   ?
    d14C                        dd   ?
    d150                        dd   ?
    d154                        dd   ?
    d158                        dd   ?
    d15C                        dd   ?
    d160                        dd   ?
    d164                        dd   ?
    d168                        dd   ?
    d16C                        dd   ?
    d170                        dd   ?
    SuspendNop                  xptr ?
    d178                        dd   ?
    d17C                        dd   ?
    d180                        dd   ?
    d184                        dd   ?
    d188                        dd   ?
    d18C                        dd   ?
    SuspendSemaphore            KSEMAPHORE
    ThreadList                  LIST_ENTRY
    d1AC                        dd   ?
ends

struct ETHREAD
    Tcb                         KTHREAD
    liCreateTime                LARGE_INTEGER
    liExitTime                  LARGE_INTEGER
    ExitStatus                  dd   ?
    PostBlockList               LIST_ENTRY
    TerminationPortList         LIST_ENTRY
    uActiveTimerListLock        dd   ?
    ActiveTimerListHead         LIST_ENTRY
    Cid                         CLIENT_ID
    LpcReplySemaphore           KSEMAPHORE
    uLpcReplyMessage            dd   ?
    liLpcReplyMessageId         LARGE_INTEGER
    uImpersonationInfo          dd   ?
    IrpList                     LIST_ENTRY
    TopLevelIrp                 LIST_ENTRY
    uReadClusterSize            dd   ?
    fForwardClusterOnly         db   ?
    fDisablePageFaultClustering db   ?
    fDeadThread                 db   ?
    fHasTerminated              db   ?
    uEventPair                  dd   ?
    uGrantedAccess              dd   ?
    uThreadsProcess             dd   ?
    pStartAddress               xptr ?
    Win32StartAddress           xptr ?
    fLpcExitThreadCalled        db   ?
    fHardErrorsAreDisabled      db   ?
    wUknown1                    dw   ?
    dwUknown2                   dd   ?
ends

struct KEVENT
    Header  DISPATCHER_HEADER
ends

struct ERESOURCE_OLD
    SystemResourcesList         LIST_ENTRY
    OwnerThreads                xptr ?
    pbOwnerCounts               xptr ?
    wTableSize                  dw   ?
    wActiveCount                dw   ?
    wFlag                       dw   ?
    wTableRover                 dw   ?
    bInitialOwnerCounts         db   4 dup(?)
    InitialOwnerThreads         dd   4 dup(?)
    dwUknown1                   dd   ?
    uContentionCount            dd   ?
    wNumberOfExclusiveWaiters   dw   ?
    wNumberOfSharedWaiters      dw   ?
    SharedWaiters               KSEMAPHORE
    ExclusiveWaiters            KEVENT
    SpinLock                    xptr ?
    uCreatorBackTraceIndex      dd   ?
    wDepth                      dw   ?
    wUknown2                    dw   ?
    pOwnerBackTrace             xptr 4 dup(?)
ends

struct OWNER_ENTRY
    OwnerThread                 dd   ?
    union
        OwnerCount              dd   ?
        TableSize               dd   ?
    ends
ends

struct ERESOURCE_LITE
    SystemResourcesList         LIST_ENTRY
    OwnerTable                  xptr ?
    sActiveCount                dw   ?
    wFlag                       dw   ?
    SharedWaiters               xptr ?
    ExclusiveWaiters            xptr ?
    OwnerThreads                OWNER_ENTRY 2
    uContentionCount            dd ?
    wNumberOfSharedWaiters      dw ?
    wNumberOfExclusiveWaiters   dw ?
    union
        pAddress                xptr ?
        uCreatorBackTraceIndex  dd ?
    ends
    SpinLock                    xptr ?
ends

struct IO_STATUS_BLOCK
  union
    Status    dd ?
    Pointer   xptr ?
  ends
  Information xptr ?
ends

if ~defined QUOTA_LIMITS_DEFINED
    define QUOTA_LIMITS_DEFINED 1
    struct QUOTA_LIMITS
        PagedPoolLimit          xptr ?
        NonPagedPoolLimit       xptr ?
        MinimumWorkingSetSize   xptr ?
        MaximumWorkingSetSize   xptr ?
        PagefileLimit           xptr ?
        TimeLimit               LARGE_INTEGER
    ends
end if

struct IOCOUNTERS
    uReadOperationCount     dd ?
    uWriteOperationCount    dd ?
    uOtherOperationCount    dd ?
    liReadTransferCount     LARGE_INTEGER
    liWriteTransferCount    LARGE_INTEGER
    liOtherTransferCount    LARGE_INTEGER
ends

struct VM_COUNTERS
    uPeakVirtualSize            dd ?
    uVirtualSize                dd ?
    uPageFaultCount             dd ?
    uPeakWorkingSetSize         dd ?
    uWorkingSetSize             dd ?
    uQuotaPeakPagedPoolUsage    dd ?
    uQuotaPagedPoolUsage        dd ?
    uQuotaPeakNonPagedPoolUsage dd ?
    uQuotaNonPagedPoolUsage     dd ?
    uPagefileUsage              dd ?
    uPeakPagefileUsage          dd ?
ends

struct KERNEL_USER_TIMES
    liCreateTime    LARGE_INTEGER
    liExitTime      LARGE_INTEGER
    liKernelTime    LARGE_INTEGER
    liUserTime      LARGE_INTEGER
ends

struct BASE_PRIORITY_INFORMATION
    BasePriority dd ?
ends

struct AFFINITY_MASK
    AffinityMask xptr ?
ends

struct TIME_FIELDS
    wYear           dw ?
    wMonth          dw ?
    wDay            dw ?
    wHour           dw ?
    wMinute         dw ?
    wSecond         dw ?
    wMilliseconds   dw ?
    wWeekday        dw ?
ends

struct NTFS_VOLUME_DATA_BUFFER
    liSerialNumber          LARGE_INTEGER
    liNumberOfSectors       LARGE_INTEGER
    liTotalClusters         LARGE_INTEGER
    liFreeClusters          LARGE_INTEGER
    liReserved              LARGE_INTEGER
    uBytesPerSector         dd ?
    uBytesPerCluster        dd ?
    uBytesPerMFTRecord      dd ?
    uClustersPerMFTRecord   dd ?
    liMFTLength             LARGE_INTEGER
    liMFTStart              LARGE_INTEGER
    liMFTMirrorStart        LARGE_INTEGER
    liMFTZoneStart          LARGE_INTEGER
    liMFTZoneEnd            LARGE_INTEGER
ends

struct OBJDIR_INFORMATION
    ObjectName      UNICODE_STRING
    ObjectTypeName  UNICODE_STRING
    Data            db 2 dup(?)
ends

struct FILE_FS_VOLUME_INFORMATION
    VolumeCreationTime  LARGE_INTEGER
    VolumeSerialNumber  dd ?
    VolumeLabelLength   dd ?
    SupportsObjects     db ?
    VolumeLabel         dw 2 dup(?)
ends

struct FILE_FS_LABEL_INFORMATION
    VolumeLabelLength   dd ?
    VolumeLabel         dw 2 dup(?)
ends

struct FILE_FS_SIZE_INFORMATION
    TotalAllocationUnits        LARGE_INTEGER
    AvailableAllocationUnits    LARGE_INTEGER
    SectorsPerAllocationUnit    dd ?
    BytesPerSector              dd ?
ends

struct FILE_FS_DEVICE_INFORMATION
    DeviceType      dd ?
    Characteristics dd ?
ends

struct FILE_FS_ATTRIBUTE_INFORMATION
    FileSystemAttributes        dd ?
    MaximumComponentNameLength  dd ?
    FileSystemNameLength        dd ?
    FileSystemName              dw 2 dup(?)
ends

struct FILE_FS_CONTROL_INFORMATION
    FreeSpaceStartFiltering LARGE_INTEGER
    FreeSpaceThreshold      LARGE_INTEGER
    FreeSpaceStopFiltering  LARGE_INTEGER
    DefaultQuotaThreshold   LARGE_INTEGER
    DefaultQuotaLimit       LARGE_INTEGER
    FileSystemControlFlags  dd ?
ends

struct FILE_FS_FULL_SIZE_INFORMATION
    TotalQuotaAllocationUnits       LARGE_INTEGER
    AvailablequotaAllocationUnits   LARGE_INTEGER
    AvailableAllocationUnits        LARGE_INTEGER
    SectorsPerAllocationUnit        dd ?
    BytesPerSector                  dd ?
ends

struct FILE_FS_OBJECT_ID_INFORMATION
    VolumeObjectId              GUID
    VolumeObjectIdExtendedInfo  dd 12 dup(?)
ends

struct SYSTEM_BASIC_INFORMATION
    dwUnknown1                  dd   ?
    uKeMaximumIncrement         dd   ?
    uPageSize                   dd   ?
    uMmNumberOfPhysicalPages    dd   ?
    uMmLowestPhysicalPage       dd   ?
    uMmHighestPhysicalPage      dd   ?
    uAllocationGranularity      dd   ?
    pLowestUserAddress          xptr ?
    pMmHighestUserAddress       xptr ?
    uKeActiveProcessors         xptr ?
    bKeNumberProcessors         db   ?
    bUnknown2                   db   ?
    wUnknown3                   dw   ?
ends

struct SYSTEM_PROCESSOR_INFORMATION
    wKeProcessorArchitecture    dw   ?
    wKeProcessorLevel           dw   ?
    wKeProcessorRevision        dw   ?
    wUnknown1                   dw   ?
    uKeFeatureBits              dd   ?
ends

struct MM_INFO_COUNTERS
    uPageFaults             dd ?
    uWriteCopyFaults        dd ?
    uTransistionFaults      dd ?
    uCacheTransitionCount   dd ?
    uDemandZeroFaults       dd ?
    uPagesRead              dd ?
    uPageReadIos            dd ?
    uCacheReadCount         dd ?
    uCacheIoCount           dd ?
    uPagefilePagesWritten   dd ?
    uPagefilePageWriteIos   dd ?
    uMappedFilePagesWritten dd ?
    uMappedFilePageWriteIos dd ?
ends

struct SYSTEM_PERFORMANCE_INFORMATION
    liIdleTime                              LARGE_INTEGER
    liIoReadTransferCount                   LARGE_INTEGER
    liIoWriteTransferCount                  LARGE_INTEGER
    liIoOtherTransferCount                  LARGE_INTEGER
    uIoReadOperationCount                   dd ?
    uIoWriteOperationCount                  dd ?
    uIoOtherOperationCount                  dd ?
    uMmAvailablePages                       dd ?
    uMmTotalCommittedPages                  dd ?
    uMmTotalCommitLimit                     dd ?
    uMmPeakCommitLimit                      dd ?
    MmInfoCounters                          MM_INFO_COUNTERS
    uPoolPaged                              dd ?
    uPoolNonPaged                           dd ?
    uPagedPoolAllocs                        dd ?
    uPagedPoolFrees                         dd ?
    uNonPagedPoolAllocs                     dd ?
    uNonPagedPoolFrees                      dd ?
    uMmTotalFreeSystemPages                 dd ?
    uMmSystemCodePage                       dd ?
    uMmTotalSystemDriverPages               dd ?
    uMmTotalSystemCodePages                 dd ?
    uSmallNonPagedLookasideListAllocateHits dd ?
    uSmallPagedLookasideListAllocateHits    dd ?
    dwUnknown1                              dd ?
    uMmSystemCachePage                      dd ?
    uMmPagedPoolPage                        dd ?
    uMmSystemDriverPage                     dd ?
    uCcFastReadNoWait                       dd ?
    uCcFastReadWait                         dd ?
    uCcFastReadResourceMiss                 dd ?
    uCcFastReadNotPossible                  dd ?
    uCcFastMdlReadNoWait                    dd ?
    uCcFastMdlReadWait                      dd ?
    uCcFastMdlReadResourceMiss              dd ?
    uCcFastMdlReadNotPossible               dd ?
    uCcMapDataNoWait                        dd ?
    uCcMapDataWait                          dd ?
    uCcMapDataNoWaitMiss                    dd ?
    uCcMapDataWaitMiss                      dd ?
    uCcPinMappedDataCount                   dd ?
    uCcPinReadNoWait                        dd ?
    uCcPinReadWait                          dd ?
    uCcPinReadNoWaitMiss                    dd ?
    uCcPinReadWaitMiss                      dd ?
    uCcCopyReadNoWait                       dd ?
    uCcCopyReadWait                         dd ?
    uCcCopyReadNoWaitMiss                   dd ?
    uCcCopyReadWaitMiss                     dd ?
    uCcMdlReadNoWait                        dd ?
    uCcMdlReadWait                          dd ?
    uCcMdlReadNoWaitMiss                    dd ?
    uCcMdlReadWaitMiss                      dd ?
    uCcReadAheadIos                         dd ?
    uCcLazyWriteIos                         dd ?
    uCcLazyWritePages                       dd ?
    uCcDataFlushes                          dd ?
    uCcDataPages                            dd ?
    uTotalContextSwitches                   dd ?
    uFirstLevelTbFills                      dd ?
    uSecondLevelTbFills                     dd ?
    uSystemCalls                            dd ?
ends

struct SYSTEM_TIME_INFORMATION
    liKeBootTime            LARGE_INTEGER
    liKeSystemTime          LARGE_INTEGER
    liExpTimeZoneBias       LARGE_INTEGER
    uExpCurrentTimeZoneId   dd ?
    dwUnknown1              dd ?
ends

struct SYSTEM_THREAD
    liKernelTime    xptr ?
    liUserTime      xptr ?
    liCreateTime    xptr ?
    WaitTime        dd   ?
    pStartAddress   xptr ?
    Cid             CLIENT_ID
    Priority        dd   ?
    BasePriority    dd   ?
    ContextSwitches dd   ?
    ThreadState     dd   ?
    WaitReason      dd   ?
    dwUnknown2      dd   ?
ends

struct SYSTEM_PROCESS_INFORMATION
    uNext                           dd ?
    uThreadCount                    dd ?
    liUnknown1                      LARGE_INTEGER
    liUnknown2                      LARGE_INTEGER
    liUnknown3                      LARGE_INTEGER
    liCreateTime                    LARGE_INTEGER
    liUserTime                      LARGE_INTEGER
    liKernelTime                    LARGE_INTEGER
    usName                          UNICODE_STRING
    BasePriority                    dd ?
    uUniqueProcessId                dd ?
    uInheritedFromUniqueProcessId   dd ?
    uHandleCount                    dd ?
    uSessionId                      dd ?
    dwUnknown5                      dd ?
    VmCounters                      VM_COUNTERS
    uCommitCharge                   dd ?
    aST                             SYSTEM_THREAD 2
ends

struct IO_COUNTERSEX
    ReadOperationCount  LARGE_INTEGER
    WriteOperationCount LARGE_INTEGER
    OtherOperationCount LARGE_INTEGER
    ReadTransferCount   LARGE_INTEGER
    WriteTransferCount  LARGE_INTEGER
    OtherTransferCount  LARGE_INTEGER
ends

struct SYSTEM_PROCESS_INFORMATION_2000
    uNext                           dd ?
    uThreadCount                    dd ?
    liUnknown1                      LARGE_INTEGER
    liUnknown2                      LARGE_INTEGER
    liUnknown3                      LARGE_INTEGER
    liCreateTime                    LARGE_INTEGER
    liUserTime                      LARGE_INTEGER
    liKernelTime                    LARGE_INTEGER
    usName                          UNICODE_STRING
    BasePriority                    dd ?
    uUniqueProcessId                dd ?
    uInheritedFromUniqueProcessId   dd ?
    uHandleCount                    dd ?
    uSessionId                      dd ?
    dwUnknown5                      dd ?
    VmCounters                      VM_COUNTERS
    uCommitCharge                   dd ?
    IoCounters                      IO_COUNTERSEX
    aST                             SYSTEM_THREAD 2
ends

struct SYSTEM_CONFIGURATION_INFORMATION
    uDiskCount      dd ?
    uFloppyCount    dd ?
    uCDRomCount     dd ?
    uTapeCount      dd ?
    uSerialCount    dd ?
    uParallelCount  dd ?
ends

struct SYSTEM_PROCESSOR_COUNTERS
    liProcessorTime     LARGE_INTEGER
    liKernelTime        LARGE_INTEGER
    liUserTime          LARGE_INTEGER
    liDpcTime           LARGE_INTEGER
    liInterruptTime     LARGE_INTEGER
    uInterruptCount     dd ?
    dwUnknown1          dd ?
ends

struct SYSTEM_GLOBAL_FLAG
    NtGlobalFlag    dd ?
ends

struct SYSTEM_CALL_TIME_INFORMATION
    Length          dd ?
    TotalCalls      dd ?
    TimeOfCalls     LARGE_INTEGER 2
ends

struct SYSTEM_MODULE
    Reserved            dd 2 dup(?)
    Base                dd ?
    Size                dd ?
    Flags               dd ?
    Index               dw ?
    _Unknown            dw ?
    LoadCount           dw ?
    ModuleNameOffset    dw ?
    ImageName           db MAX_SYSTEM_MODULE_NAME_LENGTH dup(?)
ends

if ~defined SYSTEM_MODULE_INFORMATION_DEFINED
    define SYSTEM_MODULE_INFORMATION_DEFINED 1
    struct SYSTEM_MODULE_INFORMATION
        uCount           dd   ?
        aSM              SYSTEM_MODULE 2
        Reserved         dd   2 dup(?)
        Base             xptr ?
        Size             dd   ?
        Flags            dd   ?
        Index            dw   ?
        _Unknown         dw   ?
        LoadCount        dw   ?
        ModuleNameOffset dw   ?
        ImageName        db   256 dup(?)
    ends
end if

struct SYSTEM_MODULE64
    Reserved         dd 2 dup(?)
    Base             dq ?
    Size             dd ?
    Flags            dd ?
    Index            dw ?
    _Unknown         dw ?
    LoadCount        dw ?
    ModuleNameOffset dw ?
    ImageName        db MAX_SYSTEM_MODULE_NAME_LENGTH dup(?)
ends

struct SYSTEM_MODULE_INFORMATION64
    uCount  dd ?
    aSM     SYSTEM_MODULE64 2
ends

struct SYSTEM_LOCK
    union
        pEResourceOld           xptr ?
        pEResourceLite          xptr ?
        pEResource              xptr ?
    ends
    wUnknown1                   dw   ?
    wUnknown2                   dw   ?
    ExclusiveOwnerThreadId      dd   ?
    uActiveCount                dd   ?
    uContentionCount            dd   ?
    dwUnknown3                  dd   ?
    dwUnknown4                  dd   ?
    uNumberOfSharedWaiters      dd   ?
    uNumberOfExclusiveWaiters   dd   ?
ends

struct SYSTEM_LOCK_INFORMATION
    uCount  dd ?
    aSL     SYSTEM_LOCK 2
ends

struct SYSTEM_HANDLE
    uIdProcess      dd   ?
    ObjectType      db   ?
    Flags           db   ?
    Handle          dw   ?
    pObject         xptr ?
    GrantedAccess   dd   ?
ends

struct SYSTEM_HANDLE_INFORMATION
    uCount  dd ?
    aSH     SYSTEM_HANDLE 2
ends

struct SYSTEM_OBJECTTYPE_INFORMATION
    NextEntryOffset     dd ?
    ObjectCount         dd ?
    HandleCount         dd ?
    TypeIndex           dd ?
    InvalidAttributes   dd ?
    GenericMapping      GENERIC_MAPPING
    ValidAccessMask     dd ?
    PoolType            dd ?
    SecurityRequired    db ?
    WaitableObject      db ?
    TypeName            UNICODE_STRING
ends

struct SYSTEM_OBJECT_INFORMATION
    NextEntryOffset         dd   ?
    Object                  xptr ?
    CreatorProcessId        dd   ?
    CreatorBackTraceIndex   dw ?
    Flags                   dw ?
    PointerCount            dd   ?
    HandleCount             dd   ?
    PagedPoolCharge         dd   ?
    NonPagedPoolCharge      dd   ?
    ExclusiveProcessId      dd   ?
    SecurityDescriptor      xptr ?
    ObjectName              UNICODE_STRING
ends

struct SYSTEM_PAGE_FILE_INFORMATION
    NextEntryOffset dd ?
    CurrentSize     dd ?
    TotalUsed       dd ?
    PeakUsed        dd ?
    FileName        UNICODE_STRING
ends

struct SYSTEM_VDM_INSTEMUL_INFO
    fExVdmSegmentNotPresent dd ?
    uOpcode0FV86            dd ?
    uOpcodeESPrefixV86      dd ?
    uOpcodeCSPrefixV86      dd ?
    uOpcodeSSPrefixV86      dd ?
    uOpcodeDSPrefixV86      dd ?
    uOpcodeFSPrefixV86      dd ?
    uOpcodeGSPrefixV86      dd ?
    uOpcodeOPER32PrefixV86  dd ?
    uOpcodeADDR32PrefixV86  dd ?
    uOpcodeINSBV86          dd ?
    uOpcodeINSWV86          dd ?
    uOpcodeOUTSBV86         dd ?
    uOpcodeOUTSWV86         dd ?
    uOpcodePUSHFV86         dd ?
    uOpcodePOPFV86          dd ?
    uOpcodeINTnnV86         dd ?
    uOpcodeINTOV86          dd ?
    uOpcodeIRETV86          dd ?
    uOpcodeINBimmV86        dd ?
    uOpcodeINWimmV86        dd ?
    uOpcodeOUTBimmV86       dd ?
    uOpcodeOUTWimmV86       dd ?
    uOpcodeINBV86           dd ?
    uOpcodeINWV86           dd ?
    uOpcodeOUTBV86          dd ?
    uOpcodeOUTWV86          dd ?
    uOpcodeLOCKPrefixV86    dd ?
    uOpcodeREPNEPrefixV86   dd ?
    uOpcodeREPPrefixV86     dd ?
    uOpcodeHLTV86           dd ?
    uOpcodeCLIV86           dd ?
    uOpcodeSTIV86           dd ?
    uVdmBopCount            dd ?
ends

struct SYSTEM_CACHE_INFORMATION
    uFileCache                  dd ?
    uFileCachePeak              dd ?
    PageFaultCount              dd ?
    MinimumWorkingSet           dd ?
    MaximumWorkingSet           dd ?
    TransitionSharedPages       dd ?
    TransitionSharedPagesPeak   dd ?
    Reserved                    dd 2 dup(?)
ends

struct SYSTEM_POOL_ENTRY
    Allocated               db   ?
    Spare0                  db   ?
    AllocatorBackTraceIndex dw   ?
    Size                    dd   ?
    union
        Tag                 db   4 dup(?)
        TagUlong            dd   ?
        ProcessChargedQuota xptr ?
    ends
ends

struct SYSTEM_POOL_INFORMATION
    TotalSize       dd   ?
    FirstEntry      xptr ?
    EntryOverhead   dw   ?
    PoolTagPresent  db   ?
    Spare0          db   ?
    NumberOfEntries dd   ?
    Entries         SYSTEM_POOL_ENTRY 2
ends

struct SYSTEM_POOL_TAG
    union
        Tag             db 4 dup(?)
        TagUlong        dd ?
    ends
    PagedPoolAllocs     dd ?
    PagedPoolFrees      dd ?
    PagedPoolUsage      dd ?
    NonPagedPoolAllocs  dd ?
    NonPagedPoolFrees   dd ?
    NonPagedPoolUsage   dd ?
ends

struct SYSTEM_POOL_TAG_INFORMATION
    uCount  dd ?
    aSPT    SYSTEM_POOL_TAG 2
ends

struct SYSTEM_INTERRUPT_INFORMATION
    ContextSwitches dd ?
    DpcCount        dd ?
    DpcRate         dd ?
    TimeIncrement   dd ?
    DpcBypassCount  dd ?
    ApcBypassCount  dd ?
ends

struct SYSTEM_DPC_INFORMATION
    dwUnknown1           dd ?
    MaximumDpcQueueDepth dd ?
    MinimumDpcRate       dd ?
    AdjustDpcThreshold   dd ?
    IdealDpcRate         dd ?
ends

struct SYSTEM_MEMORY_INFO
    StringOffset    xptr ?
    ValidCount      dw ?
    TransitionCount dw ?
    ModifiedCount   dw ?
    PageTableCount  dw ?
ends

struct SYSTEM_MEMORY_INFORMATION
    InfoSize    dd ?
    StringStart dd ?
    Memory      SYSTEM_MEMORY_INFO 2
ends

struct SYSTEM_LOAD_DRIVER
    DriverName      UNICODE_STRING
    BaseAddress     xptr ?
    SectionPointer  xptr ?
    EntryPoint      xptr ?
    ExportDirectory xptr ?
ends

struct SYSTEM_UNLOAD_DRIVER
    SectionPointer xptr ?
ends

struct SYSTEM_QUERY_TIME_ADJUSTMENT
    TimeAdjustment      dd ?
    MaximumIncrement    dd ?
    TimeSynchronization db ?
ends

struct SYSTEM_SET_TIME_ADJUSTMENT
    TimeAdjustment      dd ?
    TimeSynchronization db ?
ends

struct SYSTEM_CRASH_DUMP_INFORMATION
    CrashDumpSectionHandle  xptr ?
ends

struct SYSTEM_CRASH_DUMP_INFORMATION_2000
    CrashDumpSectionHandle  xptr ?
    _Unknown                xptr ?
ends

struct SYSTEM_EXCEPTION_INFORMATION
    AlignmentFixupCount     dd ?
    ExceptionDispatchCount  dd ?
    FloatingEmulationCount  dd ?
    ByteWordEmulationCount  dd ?
ends

struct SYSTEM_CRASH_DUMP_STATE_INFORMATION
    ValidCrashDump  dd ?
ends

struct SYSTEM_CRASH_DUMP_STATE_INFORMATION_2000
    ValidCrashDump  dd ?
    _Unknown        dd ?
ends

struct SYSTEM_DEBUGGER_INFORMATION
    KernelDebuggerEnabled       db ?
    KernelDebuggerNotPresent    db ?
ends

struct SYSTEM_CONTEXT_SWITCH_INFORMATION
    ContextSwitches dd ?
    FindAny         dd ?
    FindLast        dd ?
    FindIdeal       dd ?
    IdleAny         dd ?
    IdleCurrent     dd ?
    IdleLast        dd ?
    IdleIdeal       dd ?
    PreemptAny      dd ?
    PreemptCurrent  dd ?
    PreemptLast     dd ?
    SwitchToIdle    dd ?
ends

struct SYSTEM_REGISTRY_QUOTA_INFORMATION
    RegistryQuotaAllowed    dd ?
    RegistryQuotaUsed       dd ?
    PagedPoolSize           dd ?
ends

struct SYSTEM_ADD_DRIVER
    ModuleName UNICODE_STRING
ends

struct SYSTEM_PRIORITY_SEPARATION_INFORMATION
    PrioritySeparation  dd ?
ends

struct PLUGPLAY_BUS_TYPE
    BusClass                    dd ?
    union
        SystemBusType           dd ?
        PlugPlayVirtualBusType  dd ?
    ends
ends

struct PLUGPLAY_BUS_INSTANCE
    BusType     PLUGPLAY_BUS_TYPE
    BusNumber   dd ?
    BusName     dw MAX_BUS_NAME dup(?)
ends

struct SYSTEM_PLUGPLAY_BUS_INFORMATION
    BusCount    dd ?
    BusInstance PLUGPLAY_BUS_INSTANCE 2
ends

struct SYSTEM_DOCK_INFORMATION
    DockState       dd ?
    DeviceBusType   dd ?
    DeviceBusNumber dd ?
    SlotNumber      dd ?
ends

struct SYSTEM_POWER_INFORMATION
    SystemSuspendSupported          db ?
    SystemHibernateSupported        db ?
    ResumeTimerSupportsSuspend      db ?
    ResumeTimerSupportsHibernate    db ?
    LidSupported                    db ?
    TurboSettingSupported           db ?
    TurboMode                       db ?
    SystemAcOrDc                    db ?
    PowerDownDisabled               db ?
    SpindownDrives                  LARGE_INTEGER
ends

struct SYSTEM_PROCESSOR_SPEED_INFORMATION
    MaximumProcessorSpeed   dd ?
    CurrentAvailableSpeed   dd ?
    ConfiguredSpeedLimit    dd ?
    PowerLimit              db ?
    ThermalLimit            db ?
    TurboLimit              db ?
ends

struct SYSTEM_TIME_ZONE_INFORMATION
    Bias            dd ?
    StandardName    dw 32 dup(?)
    StandardDate    TIME_FIELDS
    StandardBias    dd ?
    DaylightName    dw 32 dup(?)
    DaylightDate    TIME_FIELDS
    DaylightBias    dd ?
ends

struct SYSTEM_LOOKASIDE
    Depth           dw ?
    MaximumDepth    dw ?
    TotalAllocates  dd ?
    AllocateMisses  dd ?
    TotalFrees      dd ?
    FreeMisses      dd ?
    Type            dd ?
    Tag             dd ?
    Size            dd ?
ends

struct SYSTEM_LOOKASIDE_INFORMATION
    asl SYSTEM_LOOKASIDE
ends

struct SYSTEM_SET_TIME_SLIP_EVENT
    TimeSlipEvent   xptr ?
ends

struct SYSTEM_CREATE_SESSION
    Session dd ?
ends

struct SYSTEM_DELETE_SESSION
    Session dd ?
ends

struct SYSTEM_RANGE_START_INFORMATION
    SystemRangeStart xptr ?
ends

struct FILE_DIRECTORY_INFORMATION
    NextEntryOffset dd ?
    FileIndex       dd ?
    CreationTime    LARGE_INTEGER
    LastAccessTime  LARGE_INTEGER
    LastWriteTime   LARGE_INTEGER
    ChangeTime      LARGE_INTEGER
    EndOfFile       LARGE_INTEGER
    AllocationSize  LARGE_INTEGER
    FileAttributes  dd ?
    FileNameLength  dd ?
    FileName        dw 2 dup(?)
ends

struct FILE_FULL_DIR_INFORMATION
    NextEntryOffset dd ?
    FileIndex       dd ?
    CreationTime    LARGE_INTEGER
    LastAccessTime  LARGE_INTEGER
    LastWriteTime   LARGE_INTEGER
    ChangeTime      LARGE_INTEGER
    EndOfFile       LARGE_INTEGER
    AllocationSize  LARGE_INTEGER
    FileAttributes  dd ?
    FileNameLength  dd ?
    EaSize          dd ?
    FileName        dw 2 dup(?)
ends

struct FILE_BOTH_DIR_INFORMATION
    NextEntryOffset dd ?
    FileIndex       dd ?
    CreationTime    LARGE_INTEGER
    LastAccessTime  LARGE_INTEGER
    LastWriteTime   LARGE_INTEGER
    ChangeTime      LARGE_INTEGER
    EndOfFile       LARGE_INTEGER
    AllocationSize  LARGE_INTEGER
    FileAttributes  dd ?
    FileNameLength  dd ?
    EaSize          dd ?
    ShortNameLength db ?
    ShortName       dw 12 dup(?)
    FileName        dw 2 dup(?)
ends

struct FILE_BASIC_INFORMATION
    CreationTime    LARGE_INTEGER
    LastAccessTime  LARGE_INTEGER
    LastWriteTime   LARGE_INTEGER
    ChangeTime      LARGE_INTEGER
    FileAttributes  dd ?
ends

struct FILE_STANDARD_INFORMATION
    AllocationSize  LARGE_INTEGER
    EndOfFile       LARGE_INTEGER
    NumberOfLinks   dd ?
    DeletePending   db ?
    Directory       db ?
ends
                                                            
struct FILE_INTERNAL_INFORMATION
    IndexNumber LARGE_INTEGER
ends

struct FILE_EA_INFORMATION
    EaSize dd ?
ends

struct FILE_ACCESS_INFORMATION
    AccessFlags dd ?
ends

struct FILE_NAME_INFORMATION
    FileNameLength  dd ?
    FileName        dw 2 dup(?)
ends

struct FILE_RENAME_INFORMATION
    ReplaceIfExists db ?
    RootDirectory   xptr ?
    FileNameLength  dd ?
    FileName        dw 2 dup(?)
ends

struct FILE_LINK_INFORMATION
    ReplaceIfExists db ?
    RootDirectory   xptr ?
    FileNameLength  dd ?
    FileName        dw 2 dup(?)
ends

struct FILE_NAMES_INFORMATION
    NextEntryOffset dd ?
    FileIndex       dd ?
    FileNameLength  dd ?
    FileName        dw 2 dup(?)
ends

struct FILE_ALLOCATION_INFORMATION
    AllocationSize LARGE_INTEGER
ends

struct FILE_COMPRESSION_INFORMATION
    CompressedFileSize   LARGE_INTEGER
    CompressionFormat    dw ?
    CompressionUnitShift db ?
    ChunkShift           db ?
    ClusterShift         db ?
    Reserved             db 3 dup(?)
ends

struct FILE_COMPLETION_INFORMATION
    Port    xptr ?
    Key     dd    ?
ends

struct KEY_VALUE_BASIC_INFORMATION
    TitleIndex  dd ?
    Type        dd ?
    NameLength  dd ?
    _Name       dw 2 dup(?)
ends

struct KEY_VALUE_FULL_INFORMATION
    TitleIndex  dd ?
    Type        dd ?
    DataOffset  dd ?
    DataLength  dd ?
    NameLength  dd ?
    _Name       dw 2 dup(?)
ends

struct KEY_VALUE_PARTIAL_INFORMATION
    TitleIndex  dd ?
    Type        dd ?
    DataLength  dd ?
    Data        db 2 dup(?)
ends

struct KEY_NODE_INFORMATION
    LastWriteTime   LARGE_INTEGER
    TitleIndex      dd ?
    ClassOffset     dd ?
    ClassLength     dd ?
    NameLength      dd ?
    _Name           dw 2 dup(?)
ends

struct KEY_NAME_INFORMATION
    NameLength  dd ?
    _Name       dw 2 dup(?)
ends

struct PROCESS_BASIC_INFORMATION32
    ExitStatus                      dd ?
    PebBaseAddress                  dd ?
    AffinityMask                    dd ?
    BasePriority                    dd ?
    uUniqueProcessId                dd ?
    uInheritedFromUniqueProcessId   dd ?
ends

struct PROCESS_BASIC_INFORMATION64
    ExitStatus                      dd ?
    Reserved0                       dd ?
    PebBaseAddress                  dq ?
    AffinityMask                    dq ?
    BasePriority                    dd ?
    Reserved1                       dd ?
    uUniqueProcessId                dq ?
    uInheritedFromUniqueProcessId   dq ?
ends

struct PROCESS_BASIC_INFORMATION
    ExitStatus                      dd ?
    PebBaseAddress                  xptr ?
    AffinityMask                    xptr ?
    BasePriority                    dd ?
    uUniqueProcessId                xptr ?
    uInheritedFromUniqueProcessId   dd ?
ends

struct PROCESS_RAISE_PRIORITY
    RaisePriority dd ?
ends

struct PROCESS_DEBUG_PORT_INFORMATION
    DebugPort xptr ?
ends

struct PROCESS_EXCEPTION_PORT
    ExceptionPort xptr ?
ends

struct PROCESS_ACCESS_TOKEN
    Token   xptr ?
    Thread  xptr ?
ends

struct PROCESS_WOW64_INFORMATION
    Wow64PebBaseAddress xptr ?
ends

if ~defined LDT_ENTRY_DEFINED
    define LDT_ENTRY_DEFINED 1

    struct LDT_ENTRY
        LimitLow dw ?
        BaseLow  dw ?
        union
            struct
                BaseMid db ?
                Flags1  db ?
                Flags2  db ?
                BaseHi  db ?
            ends
            struct
                LDTBits dd ?
            ends
        ends
    ends
    LDT_TABLE_SIZE equ (8 * 1024 * sizeof.LDT_ENTRY)
end if

struct PROCESS_LDT_INFORMATION
    Start       dd ?
    Length      dd ?
    LdtEntries  LDT_ENTRY 2
ends

struct PROCESS_LDT_SIZE
    Length dd ?
ends

struct PROCESS_DEFAULT_HARDERROR_MODE_INFORMATION
    HardErrorMode dd ?
ends

struct PROCESS_POOLED_USAGE_AND_LIMITS_INFORMATION
    PeakPagedPoolUsage      dd ?
    PagedPoolUsage          dd ?
    PagedPoolLimit          dd ?
    PeakNonPagedPoolUsage   dd ?
    NonPagedPoolUsage       dd ?
    NonPagedPoolLimit       dd ?
    PeakPagefileUsage       dd ?
    PagefileUsage           dd ?
    PagefileLimit           dd ?
ends

struct PROCESS_WS_WATCH_INFORMATION
    FaultingPc  xptr ?
    FaultingVa  xptr ?
ends

struct PROCESS_IOPL
    Iopl dd ?
ends

struct PROCESS_ALLIGNMENT_FAULT_FIXUP
    EnableAllignmentFaultFixup db ?
ends

struct PROCESS_PRIORITY_CLASS_INFORMATION
    _Unknown        db ?
    PriorityClass   db ?
ends

struct PROCESS_X86_INFORMATION
    x86Info dd ?
ends

struct PROCESS_HANDLE_COUNT_INFORMATION
    HandleCount dd ?
ends

struct PROCESS_PRIORITY_BOOST_INFORMATION
    PriorityBoostEnabled dd ?
ends

struct PROCESS_DEVICE_MAP_INFORMATION
    union
        struct
            DirectoryHandle xptr ?
        ends
        struct
            DriveMap        dd    ?
            DriveType       db    32 dup(?)
        ends
    ends
ends

struct PROCESS_SESSION_INFORMATION
    SessionId dd ?
ends

struct USER_STACK
    FixedStackBase          xptr ?
    FixedStackLimit         xptr ?
    ExpandableStackBase     xptr ?
    ExpandableStackLimit    xptr ?
    ExpandableStackBottom   xptr ?
ends

struct THREAD_BASIC_INFORMATION
    ExitStatus      dd   ?
    TebBaseAddress  xptr ?
    ClientId        CLIENT_ID
    AffinityMask    xptr ?
    Priority        dd ?
    BasePriority    dd ?
ends

struct THREAD_PRIORITY
    Priority dd ?
ends

struct THREAD_DESCRIPTOR_TABLE_ENTRY_INFORMATION
    Selector    dd ?
    Descriptor  LDT_ENTRY
ends

struct THREAD_EVENTPAIR
    EventPair xptr ?
ends

struct THREAD_WIN32_START_ADDRESS_INFORMATION
    Win32StartAddress xptr ?
ends

struct THREAD_ZERO_TLSCELL
    TlsIndex dd ?
ends

struct THREAD_PERFORMANCE_COUNTER_INFORMATION
    Count1 dd ?
    Count2 dd ?
ends

struct THREAD_AMI_LAST_THREAD
    AmILastThread dd ?
ends

struct THREAD_IDEAL_PROCESSOR
    IdealProcessor dd ?
ends

struct THREAD_TLS_ARRAY
    TlsArray    xptr ?
ends

struct THREAD_IS_IO_PENDING_INFORMATION
    IsIOPending dd ?
ends

struct THREAD_HIDE_FROM_DEBUGGER
    HideFromDebugger dd ?
ends

struct SECTION_BASIC_INFORMATION
    BaseAddress xptr ?
    Attributes  dd   ?
    Size        LARGE_INTEGER
ends

struct SECTION_IMAGE_INFORMATION
    EntryPoint              xptr ?
    Unknown1                dd ?
    StackReserve            dd ?
    StackCommit             dd ?
    Subsystem               dd ?
    MinorSubsystemVersion   dw ?
    MajorSubsystemVersion   dw ?
    Unknown2                dd ?
    Characteristics         dd ?
    ImageNumber             dw ?
    Executable              db ?
    Unknown3                db ?
    Unknown4                dd 3 dup(?)
ends

struct OBJECT_BASIC_INFORMATION
    Attributes                  dd ?
    GrantedAccess               dd ?
    HandleCount                 dd ?
    PointerCount                dd ?
    PagedPoolUsage              dd ?
    NonPagedPoolUsage           dd ?
    Reserved                    dd 3 dup(?)
    NameInformationLength       dd ?
    TypeInformationLength       dd ?
    SecurityDescriptorLength    dd ?
    CreateTime                  LARGE_INTEGER
ends

struct OBJECT_NAME_INFORMATION
    _Name UNICODE_STRING
ends

struct OBJECT_TYPE_INFORMATION
    _Name                   UNICODE_STRING
    ObjectCount             dd ?
    HandleCount             dd ?
    Reserved1               dd 4 dup(?)
    PeakObjectCount         dd ?
    PeakHandleCount         dd ?
    Reserved2               dd 4 dup(?)
    InvalidAttributes       dd ?
    GenericMapping          GENERIC_MAPPING
    ValidAccess             dd ?
    _Unknown                db ?
    MaintainHandleDatabase  db ?
    Reserved3               db 2 dup(?)
    PoolType                dd ?
    PagedPoolUsage          dd ?
    NonPagedPoolUsage       dd ?
ends

struct OBJECT_ALL_TYPES_INFORMATION
    NumberOfTypes   dd ?
    TypeInformation OBJECT_TYPE_INFORMATION
ends

struct OBJECT_HANDLE_ATTRIBUTE_INFORMATION
    Inherit             db ?
    ProtectFromClose    db ?
ends

if ~defined MEMORY_BASIC_INFORMATION_DEFINED
    define MEMORY_BASIC_INFORMATION_DEFINED 1
    struct MEMORY_BASIC_INFORMATION
		BaseAddress         xptr ?
		AllocationBase      xptr ?
		AllocationProtect   dd   ?
        PartitionId         dw   ?
		RegionSize          xptr ?
		State               dd   ?
		Protect             dd   ?
		Type                dd   ?
    ends
end if

struct MEMORY_WORKING_SET_LIST
    NumberOfPages   dd ?
    WorkingSetList  dd 2 dup(?)
ends

struct MEMORY_SECTION_NAME
    SectionFileName UNICODE_STRING
ends

struct DEBUG_BUFFER
    SectionHandle           xptr ?
    SectionBase             xptr  ?
    RemoteSectionBase       xptr  ?
    SectionBaseDelta        dd    ?
    EventPairHandle         xptr ?
    _Unknown                dd    2 dup(?)
    RemoteThreadHandle      xptr ?
    InfoClassMask           dd    ?
    SizeOfInfo              dd    ?
    AllocatedSize           dd    ?
    SectionSize             dd    ?
    ModuleInformation       xptr  ?
    BackTraceInformation    xptr  ?
    HeapInformation         xptr  ?
    LockInformation         xptr  ?
    Reserved                xptr  8 dup(?)
ends

struct DEBUG_MODULE_INFORMATION
    Reserved            dd 2 dup(?)
    Base                dd ?
    Size                dd ?
    Flags               dd ?
    Index               dw ?
    _Unknown            dw ?
    LoadCount           dw ?
    ModuleNameOffset    dw ?
    ImageName           db 256 dup(?)
ends

struct DEBUG_HEAP_INFORMATION
    Base        dd   ?
    Flags       dd   ?
    Granularity dw   ?
    _Unknown    dw   ?
    Allocated   dd   ?
    Committed   dd   ?
    TagCount    dd   ?
    BlockCount  dd   ?
    Reserved    dd   7 dup(?)
    Tags        xptr ?
    Blocks      xptr ?
ends

struct DEBUG_LOCK_INFORMATION
    Address                     xptr ?
    Type                        dw   ?
    CreatorBackTraceIndex       dw   ?
    OwnerThreadId               dd   ?
    ActiveCount                 dd   ?
    ContentionCount             dd   ?
    EntryCount                  dd   ?
    RecursionCount              dd   ?
    NumberOfSharedWaiters       dd   ?
    NumberOfExclusiveWaiters    dd   ?
ends

struct PORT_SECTION_WRITE
    Length          dd   ?
    SectionHandle   xptr ?
    SectionOffset   dd   ?
    ViewSize        dd   ?
    ViewBase        xptr ?
    TargetViewBase  xptr ?
ends

struct PORT_SECTION_READ
    Length      dd   ?
    ViewSize    dd   ?
    ViewBase    xptr ?
ends

if ~defined CONTEXT32_DEFINED
    define CONTEXT32_DEFINED 1
    struct CONTEXT32
        ContextFlags        dd ?
        _Dr0                dd ?
        _Dr1                dd ?
        _Dr2                dd ?
        _Dr3                dd ?
        _Dr6                dd ?
        _Dr7                dd ?
        FloatSave           FLOATING_SAVE_AREA
        SegGs               dd ?
        SegFs               dd ?
        SegEs               dd ?
        SegDs               dd ?
        _Edi                dd ?
        _Esi                dd ?
        _Ebx                dd ?
        _Edx                dd ?
        _Ecx                dd ?
        _Eax                dd ?
        _Ebp                dd ?
        _Eip                dd ?
        SegCs               dd ?
        EFlags              dd ?
        _Esp                dd ?
        SegSs               dd ?
        ExtendedRegisters   db MAXIMUM_SUPPORTED_EXTENSION dup(?)
    ends
end if

struct SCOPE_RECORD
    BeginAddress    dd ?
    EndAddress      dd ?
    HandlerAddress  dd ?
    JumpTarget      dd ?
ends

struct SCOPE_TABLE
    Count          dd ?
    ScopeRecord    SCOPE_RECORD 2
ends

struct EXCEPTION_DATA
    union
        ExceptionHandler dd ?
        FunctionEntry    dd ?
    ends
    ScopeTable          SCOPE_TABLE
ends

if ~defined XMM_SAVE_AREA32_DEFINED
    define XMM_SAVE_AREA32_DEFINED 1
    struct XMM_SAVE_AREA32
        ControlWord     dw ?
        StatusWord      dw ?
        TagWord         db ?
        Reserved1       db ?
        ErrorOpcode     dw ?
        ErrorOffset     dd ?
        ErrorSelector   dw ?
        Reserved2       dw ?
        DataOffset      dd ?
        DataSelector    dw ?
        Reserved3       dw ?
        MxCsr           dd ?
        MxCsr_Mask      dd ?
        FloatRegisters  M128A 8
        XmmRegisters    M128A 16
        Reserved4       db 96 dup(?)
    ends
end if

if ~defined CONTEXT64_DEFINED
    define CONTEXT64_DEFINED 1
    struct CONTEXT64
        P1Home                  dq ?
        P2Home                  dq ?
        P3Home                  dq ?
        P4Home                  dq ?
        P5Home                  dq ?
        P6Home                  dq ?
        ContextFlags            dd ?
        MxCsr                   dd ?
        SegCs                   dw ?
        SegDs                   dw ?
        SegEs                   dw ?
        SegFs                   dw ?
        SegGs                   dw ?
        SegSs                   dw ?
        EFlags                  dd ?
        _Dr0                    dq ?
        _Dr1                    dq ?
        _Dr2                    dq ?
        _Dr3                    dq ?
        _Dr6                    dq ?
        _Dr7                    dq ?
        _Rax                    dq ?
        _Rcx                    dq ?
        _Rdx                    dq ?
        _Rbx                    dq ?
        _Rsp                    dq ?
        _Rbp                    dq ?
        _Rsi                    dq ?
        _Rdi                    dq ?
        _R8                     dq ?
        _R9                     dq ?
        _R10                    dq ?
        _R11                    dq ?
        _R12                    dq ?
        _R13                    dq ?
        _R14                    dq ?
        _R15                    dq ?
        _Rip                    dq ?
        union
            FltSave             XMM_SAVE_AREA32
            struct 
                Header          M128A 2
                Legacy          M128A 8
                _Xmm0           M128A
                _Xmm1           M128A
                _Xmm2           M128A
                _Xmm3           M128A
                _Xmm4           M128A
                _Xmm5           M128A
                _Xmm6           M128A
                _Xmm7           M128A
                _Xmm8           M128A
                _Xmm9           M128A
                _Xmm10          M128A
                _Xmm11          M128A
                _Xmm12          M128A
                _Xmm13          M128A
                _Xmm14          M128A
                _Xmm15          M128A
            ends
        ends
        VectorRegister          M128A 26
        VectorControl           dq ?
        DebugControl            dq ?
        LastBranchToRip         dq ?
        LastBranchFromRip       dq ?
        LastExceptionToRip      dq ?
        LastExceptionFromRip    dq ?
    ends
end if

struct IMAGE_BASE_RELOCATION_EX
    VirtualAddress  dd ?
    SizeOfBlock     dd ?
    TypeOffset      dw 2 dup(?)
ends

;======================================== Functions =======================================;
if defined APP_WIN64
    if (NTDDI_VERSION >= NTDDI_WINXP)
        if ~defined __C_specific_handler
            extrn '__imp___C_specific_handler' as __C_specific_handler:qword
        end if
        if ~defined __chkstk
            extrn '__imp___chkstk' as __chkstk:qword
        end if
    end if
    extrn '__imp___isascii' as __isascii:qword
    extrn '__imp___iscsym' as __iscsym:qword
    extrn '__imp___iscsymf' as __iscsymf:qword
    extrn '__imp___toascii' as __toascii:qword
    extrn '__imp__atoi64' as _atoi64:qword
    extrn '__imp__i64toa' as _i64toa:qword
    extrn '__imp__i64tow' as _i64tow:qword
    extrn '__imp__itoa' as _itoa:qword
    extrn '__imp__itow' as _itow:qword
    extrn '__imp__lfind' as _lfind:qword
    extrn '__imp__local_unwind' as _local_unwind:qword
    extrn '__imp__ltoa' as _ltoa:qword
    extrn '__imp__ltow' as _ltow:qword
    extrn '__imp__memccpy' as _memccpy:qword
    extrn '__imp__memicmp' as _memicmp:qword
    extrn '__imp__setjmp' as _setjmp:qword
    extrn '__imp__setjmpex' as _setjmpex:qword
    extrn '__imp__snprintf' as _snprintf:qword
    extrn '__imp__snwprintf' as _snwprintf:qword
    extrn '__imp__splitpath' as _splitpath:qword
    extrn '__imp__strcmpi' as _strcmpi:qword
    extrn '__imp__stricmp' as _stricmp:qword
    extrn '__imp__strlwr' as _strlwr:qword
    extrn '__imp__strnicmp' as _strnicmp:qword
    extrn '__imp__strupr' as _strupr:qword
    extrn '__imp__ui64toa' as _ui64toa:qword
    extrn '__imp__ui64tow' as _ui64tow:qword
    extrn '__imp__ultoa' as _ultoa:qword
    extrn '__imp__ultow' as _ultow:qword
    extrn '__imp__vscwprintf' as _vscwprintf:qword
    extrn '__imp__vsnprintf' as _vsnprintf:qword
    extrn '__imp__vsnwprintf' as _vsnwprintf:qword
    extrn '__imp__wcsicmp' as _wcsicmp:qword
    extrn '__imp__wcslwr' as _wcslwr:qword
    extrn '__imp__wcsnicmp' as _wcsnicmp:qword
    extrn '__imp__wcstoui64' as _wcstoui64:qword
    extrn '__imp__wcsupr' as _wcsupr:qword
    extrn '__imp__wtoi' as _wtoi:qword
    extrn '__imp__wtoi64' as _wtoi64:qword
    extrn '__imp__wtol' as _wtol:qword
    extrn '__imp_abs' as abs:qword
    extrn '__imp_atan' as atan:qword
    extrn '__imp_atoi' as atoi:qword
    extrn '__imp_atol' as atol:qword
    extrn '__imp_bsearch' as bsearch:qword
    extrn '__imp_ceil' as ceil:qword
    extrn '__imp_cos' as cos:qword
    extrn '__imp_CsrAllocateCaptureBuffer' as CsrAllocateCaptureBuffer:qword
    extrn '__imp_CsrAllocateMessagePointer' as CsrAllocateMessagePointer:qword
    extrn '__imp_CsrCaptureMessageBuffer' as CsrCaptureMessageBuffer:qword
    extrn '__imp_CsrCaptureMessageMultiUnicodeStringsInPlace' as CsrCaptureMessageMultiUnicodeStringsInPlace:qword
    extrn '__imp_CsrCaptureMessageString' as CsrCaptureMessageString:qword
    extrn '__imp_CsrCaptureTimeout' as CsrCaptureTimeout:qword
    extrn '__imp_CsrClientCallServer' as CsrClientCallServer:qword
    extrn '__imp_CsrClientConnectToServer' as CsrClientConnectToServer:qword
    extrn '__imp_CsrFreeCaptureBuffer' as CsrFreeCaptureBuffer:qword
    extrn '__imp_CsrGetProcessId' as CsrGetProcessId:qword
    extrn '__imp_CsrIdentifyAlertableThread' as CsrIdentifyAlertableThread:qword
    extrn '__imp_CsrSetPriorityClass' as CsrSetPriorityClass:qword
    extrn '__imp_DbgBreakPoint' as DbgBreakPoint:qword
    extrn '__imp_DbgPrint' as DbgPrint:qword
    extrn '__imp_DbgPrintEx' as DbgPrintEx:qword
    extrn '__imp_DbgPrintReturnControlC' as DbgPrintReturnControlC:qword
    extrn '__imp_DbgPrompt' as DbgPrompt:qword
    extrn '__imp_DbgQueryDebugFilterState' as DbgQueryDebugFilterState:qword
    extrn '__imp_DbgSetDebugFilterState' as DbgSetDebugFilterState:qword
    extrn '__imp_DbgUiConnectToDbg' as DbgUiConnectToDbg:qword
    extrn '__imp_DbgUiContinue' as DbgUiContinue:qword
    extrn '__imp_DbgUiConvertStateChangeStructure' as DbgUiConvertStateChangeStructure:qword
    extrn '__imp_DbgUiDebugActiveProcess' as DbgUiDebugActiveProcess:qword
    extrn '__imp_DbgUiGetThreadDebugObject' as DbgUiGetThreadDebugObject:qword
    extrn '__imp_DbgUiIssueRemoteBreakin' as DbgUiIssueRemoteBreakin:qword
    extrn '__imp_DbgUiRemoteBreakin' as DbgUiRemoteBreakin:qword
    extrn '__imp_DbgUiSetThreadDebugObject' as DbgUiSetThreadDebugObject:qword
    extrn '__imp_DbgUiStopDebugging' as DbgUiStopDebugging:qword
    extrn '__imp_DbgUiWaitStateChange' as DbgUiWaitStateChange:qword
    extrn '__imp_DbgUserBreakPoint' as DbgUserBreakPoint:qword
    extrn '__imp_EtwCreateTraceInstanceId' as EtwCreateTraceInstanceId:qword
    extrn '__imp_EtwGetTraceEnableFlags' as EtwGetTraceEnableFlags:qword
    extrn '__imp_EtwGetTraceEnableLevel' as EtwGetTraceEnableLevel:qword
    extrn '__imp_EtwGetTraceLoggerHandle' as EtwGetTraceLoggerHandle:qword
    extrn '__imp_EtwRegisterTraceGuidsA' as EtwRegisterTraceGuidsA:qword
    extrn '__imp_EtwRegisterTraceGuidsW' as EtwRegisterTraceGuidsW:qword
    extrn '__imp_EtwTraceMessage' as EtwTraceMessage:qword
    extrn '__imp_EtwUnregisterTraceGuids' as EtwUnregisterTraceGuids:qword
    extrn '__imp_floor' as floor:qword
    extrn '__imp_isalnum' as isalnum:qword
    extrn '__imp_isalpha' as isalpha:qword
    extrn '__imp_iscntrl' as iscntrl:qword
    extrn '__imp_isdigit' as isdigit:qword
    extrn '__imp_isgraph' as isgraph:qword
    extrn '__imp_islower' as islower:qword
    extrn '__imp_isprint' as isprint:qword
    extrn '__imp_ispunct' as ispunct:qword
    extrn '__imp_isspace' as isspace:qword
    extrn '__imp_isupper' as isupper:qword
    extrn '__imp_iswalpha' as iswalpha:qword
    extrn '__imp_iswctype' as iswctype:qword
    extrn '__imp_iswdigit' as iswdigit:qword
    extrn '__imp_iswlower' as iswlower:qword
    extrn '__imp_iswspace' as iswspace:qword
    extrn '__imp_iswxdigit' as iswxdigit:qword
    extrn '__imp_isxdigit' as isxdigit:qword
    extrn '__imp_KiRaiseUserExceptionDispatcher' as KiRaiseUserExceptionDispatcher:qword
    extrn '__imp_KiUserApcDispatcher' as KiUserApcDispatcher:qword
    extrn '__imp_KiUserCallbackDispatcher' as KiUserCallbackDispatcher:qword
    extrn '__imp_KiUserExceptionDispatcher' as KiUserExceptionDispatcher:qword
    extrn '__imp_labs' as labs:qword
    extrn '__imp_LdrAccessResource' as LdrAccessResource:qword
    extrn '__imp_LdrAddRefDll' as LdrAddRefDll:qword
    extrn '__imp_LdrDisableThreadCalloutsForDll' as LdrDisableThreadCalloutsForDll:qword
    extrn '__imp_LdrEnumerateLoadedModules' as LdrEnumerateLoadedModules:qword
    extrn '__imp_LdrEnumResources' as LdrEnumResources:qword
    extrn '__imp_LdrFindEntryForAddress' as LdrFindEntryForAddress:qword
    extrn '__imp_LdrFindResource_U' as LdrFindResource_U:qword
    extrn '__imp_LdrFindResourceDirectory_U' as LdrFindResourceDirectory_U:qword
    extrn '__imp_LdrFindResourceEx_U' as LdrFindResourceEx_U:qword
    extrn '__imp_LdrFlushAlternateResourceModules' as LdrFlushAlternateResourceModules:qword
    extrn '__imp_LdrGetDllHandle' as LdrGetDllHandle:qword
    extrn '__imp_LdrGetDllHandleEx' as LdrGetDllHandleEx:qword
    extrn '__imp_LdrGetProcedureAddress' as LdrGetProcedureAddress:qword
    extrn '__imp_LdrInitializeThunk' as LdrInitializeThunk:qword
    extrn '__imp_LdrInitShimEngineDynamic' as LdrInitShimEngineDynamic:qword
    extrn '__imp_LdrLoadAlternateResourceModule' as LdrLoadAlternateResourceModule:qword
    extrn '__imp_LdrLoadDll' as LdrLoadDll:qword
    extrn '__imp_LdrLockLoaderLock' as LdrLockLoaderLock:qword
    extrn '__imp_LdrOpenImageFileOptionsKey' as LdrOpenImageFileOptionsKey:qword
    extrn '__imp_LdrProcessRelocationBlock' as LdrProcessRelocationBlock:qword
    extrn '__imp_LdrQueryImageFileExecutionOptions' as LdrQueryImageFileExecutionOptions:qword
    extrn '__imp_LdrQueryImageFileExecutionOptionsEx' as LdrQueryImageFileExecutionOptionsEx:qword
    extrn '__imp_LdrQueryImageFileKeyOption' as LdrQueryImageFileKeyOption:qword
    extrn '__imp_LdrQueryProcessModuleInformation' as LdrQueryProcessModuleInformation:qword
    extrn '__imp_LdrSetAppCompatDllRedirectionCallback' as LdrSetAppCompatDllRedirectionCallback:qword
    extrn '__imp_LdrSetDllManifestProber' as LdrSetDllManifestProber:qword
    extrn '__imp_LdrShutdownProcess' as LdrShutdownProcess:qword
    extrn '__imp_LdrShutdownThread' as LdrShutdownThread:qword
    extrn '__imp_LdrUnloadAlternateResourceModule' as LdrUnloadAlternateResourceModule:qword
    extrn '__imp_LdrUnloadDll' as LdrUnloadDll:qword
    extrn '__imp_LdrUnlockLoaderLock' as LdrUnlockLoaderLock:qword
    extrn '__imp_LdrVerifyImageMatchesChecksum' as LdrVerifyImageMatchesChecksum:qword
    extrn '__imp_log' as log:qword
    extrn '__imp_longjmp' as longjmp:qword
    extrn '__imp_mbstowcs' as mbstowcs:qword
    extrn '__imp_memchr' as memchr:qword
    extrn '__imp_memcmp' as memcmp:qword
    extrn '__imp_memcpy' as memcpy:qword
    extrn '__imp_memmove' as memmove:qword
    extrn '__imp_memset' as memset:qword
    extrn '__imp_NlsAnsiCodePage' as NlsAnsiCodePage:qword
    extrn '__imp_NlsMbCodePageTag' as NlsMbCodePageTag:qword
    extrn '__imp_NlsMbOemCodePageTag' as NlsMbOemCodePageTag:qword
    extrn '__imp_NtAcceptConnectPort' as NtAcceptConnectPort:qword
    extrn '__imp_NtAccessCheck' as NtAccessCheck:qword
    extrn '__imp_NtAccessCheckAndAuditAlarm' as NtAccessCheckAndAuditAlarm:qword
    extrn '__imp_NtAccessCheckByType' as NtAccessCheckByType:qword
    extrn '__imp_NtAccessCheckByTypeAndAuditAlarm' as NtAccessCheckByTypeAndAuditAlarm:qword
    extrn '__imp_NtAccessCheckByTypeResultList' as NtAccessCheckByTypeResultList:qword
    extrn '__imp_NtAccessCheckByTypeResultListAndAuditAlarm' as NtAccessCheckByTypeResultListAndAuditAlarm:qword
    extrn '__imp_NtAccessCheckByTypeResultListAndAuditAlarmByHandle' as NtAccessCheckByTypeResultListAndAuditAlarmByHandle:qword
    extrn '__imp_NtAddAtom' as NtAddAtom:qword
    extrn '__imp_NtAddBootEntry' as NtAddBootEntry:qword
    extrn '__imp_NtAddDriverEntry' as NtAddDriverEntry:qword
    extrn '__imp_NtAdjustGroupsToken' as NtAdjustGroupsToken:qword
    extrn '__imp_NtAdjustPrivilegesToken' as NtAdjustPrivilegesToken:qword
    extrn '__imp_NtAlertResumeThread' as NtAlertResumeThread:qword
    extrn '__imp_NtAlertThread' as NtAlertThread:qword
    extrn '__imp_NtAllocateLocallyUniqueId' as NtAllocateLocallyUniqueId:qword
    extrn '__imp_NtAllocateUserPhysicalPages' as NtAllocateUserPhysicalPages:qword
    extrn '__imp_NtAllocateUuids' as NtAllocateUuids:qword
    extrn '__imp_NtAllocateVirtualMemory' as NtAllocateVirtualMemory:qword
    extrn '__imp_NtApphelpCacheControl' as NtApphelpCacheControl:qword
    extrn '__imp_NtAreMappedFilesTheSame' as NtAreMappedFilesTheSame:qword
    extrn '__imp_NtAssignProcessToJobObject' as NtAssignProcessToJobObject:qword
    extrn '__imp_NtCallbackReturn' as NtCallbackReturn:qword
    extrn '__imp_NtCancelIoFile' as NtCancelIoFile:qword
    extrn '__imp_NtCancelTimer' as NtCancelTimer:qword
    extrn '__imp_NtClearEvent' as NtClearEvent:qword
    extrn '__imp_NtClose' as NtClose:qword
    extrn '__imp_NtCloseObjectAuditAlarm' as NtCloseObjectAuditAlarm:qword
    extrn '__imp_NtCompactKeys' as NtCompactKeys:qword
    extrn '__imp_NtCompareTokens' as NtCompareTokens:qword
    extrn '__imp_NtCompleteConnectPort' as NtCompleteConnectPort:qword
    extrn '__imp_NtCompressKey' as NtCompressKey:qword
    extrn '__imp_NtConnectPort' as NtConnectPort:qword
    extrn '__imp_NtContinue' as NtContinue:qword
    extrn '__imp_NtCreateDebugObject' as NtCreateDebugObject:qword
    extrn '__imp_NtCreateDirectoryObject' as NtCreateDirectoryObject:qword
    extrn '__imp_NtCreateEvent' as NtCreateEvent:qword
    extrn '__imp_NtCreateEventPair' as NtCreateEventPair:qword
    extrn '__imp_NtCreateFile' as NtCreateFile:qword
    extrn '__imp_NtCreateIoCompletion' as NtCreateIoCompletion:qword
    extrn '__imp_NtCreateJobObject' as NtCreateJobObject:qword
    extrn '__imp_NtCreateJobSet' as NtCreateJobSet:qword
    extrn '__imp_NtCreateKey' as NtCreateKey:qword
    extrn '__imp_NtCreateKeyedEvent' as NtCreateKeyedEvent:qword
    extrn '__imp_NtCreateMailslotFile' as NtCreateMailslotFile:qword
    extrn '__imp_NtCreateMutant' as NtCreateMutant:qword
    extrn '__imp_NtCreateNamedPipeFile' as NtCreateNamedPipeFile:qword
    extrn '__imp_NtCreatePagingFile' as NtCreatePagingFile:qword
    extrn '__imp_NtCreatePort' as NtCreatePort:qword
    extrn '__imp_NtCreateProcess' as NtCreateProcess:qword
    extrn '__imp_NtCreateProcessEx' as NtCreateProcessEx:qword
    extrn '__imp_NtCreateProfile' as NtCreateProfile:qword
    extrn '__imp_NtCreateSection' as NtCreateSection:qword
    extrn '__imp_NtCreateSemaphore' as NtCreateSemaphore:qword
    extrn '__imp_NtCreateSymbolicLinkObject' as NtCreateSymbolicLinkObject:qword
    extrn '__imp_NtCreateThread' as NtCreateThread:qword
    extrn '__imp_NtCreateTimer' as NtCreateTimer:qword
    extrn '__imp_NtCreateToken' as NtCreateToken:qword
    extrn '__imp_NtCreateWaitablePort' as NtCreateWaitablePort:qword
    extrn '__imp_NtDebugActiveProcess' as NtDebugActiveProcess:qword
    extrn '__imp_NtDebugContinue' as NtDebugContinue:qword
    extrn '__imp_NtDelayExecution' as NtDelayExecution:qword
    extrn '__imp_NtDeleteAtom' as NtDeleteAtom:qword
    extrn '__imp_NtDeleteBootEntry' as NtDeleteBootEntry:qword
    extrn '__imp_NtDeleteDriverEntry' as NtDeleteDriverEntry:qword
    extrn '__imp_NtDeleteFile' as NtDeleteFile:qword
    extrn '__imp_NtDeleteKey' as NtDeleteKey:qword
    extrn '__imp_NtDeleteObjectAuditAlarm' as NtDeleteObjectAuditAlarm:qword
    extrn '__imp_NtDeleteValueKey' as NtDeleteValueKey:qword
    extrn '__imp_NtDeviceIoControlFile' as NtDeviceIoControlFile:qword
    extrn '__imp_NtDisableLastKnownGood' as NtDisableLastKnownGood:qword
    extrn '__imp_NtDisplayString' as NtDisplayString:qword
    extrn '__imp_NtDuplicateObject' as NtDuplicateObject:qword
    extrn '__imp_NtDuplicateToken' as NtDuplicateToken:qword
    extrn '__imp_NtEnableLastKnownGood' as NtEnableLastKnownGood:qword
    extrn '__imp_NtEnumerateBootEntries' as NtEnumerateBootEntries:qword
    extrn '__imp_NtEnumerateDriverEntries' as NtEnumerateDriverEntries:qword
    extrn '__imp_NtEnumerateKey' as NtEnumerateKey:qword
    extrn '__imp_NtEnumerateSystemEnvironmentValuesEx' as NtEnumerateSystemEnvironmentValuesEx:qword
    extrn '__imp_NtEnumerateValueKey' as NtEnumerateValueKey:qword
    extrn '__imp_NtExtendSection' as NtExtendSection:qword
    extrn '__imp_NtFilterToken' as NtFilterToken:qword
    extrn '__imp_NtFindAtom' as NtFindAtom:qword
    extrn '__imp_NtFlushBuffersFile' as NtFlushBuffersFile:qword
    extrn '__imp_NtFlushInstructionCache' as NtFlushInstructionCache:qword
    extrn '__imp_NtFlushKey' as NtFlushKey:qword
    extrn '__imp_NtFlushVirtualMemory' as NtFlushVirtualMemory:qword
    extrn '__imp_NtFlushWriteBuffer' as NtFlushWriteBuffer:qword
    extrn '__imp_NtFreeUserPhysicalPages' as NtFreeUserPhysicalPages:qword
    extrn '__imp_NtFreeVirtualMemory' as NtFreeVirtualMemory:qword
    extrn '__imp_NtFsControlFile' as NtFsControlFile:qword
    extrn '__imp_NtGetContextThread' as NtGetContextThread:qword
    extrn '__imp_NtGetCurrentProcessorNumber' as NtGetCurrentProcessorNumber:qword
    extrn '__imp_NtGetDevicePowerState' as NtGetDevicePowerState:qword
    extrn '__imp_NtGetTickCount' as NtGetTickCount:qword
    extrn '__imp_NtGetWriteWatch' as NtGetWriteWatch:qword
    extrn '__imp_NtImpersonateAnonymousToken' as NtImpersonateAnonymousToken:qword
    extrn '__imp_NtImpersonateClientOfPort' as NtImpersonateClientOfPort:qword
    extrn '__imp_NtImpersonateThread' as NtImpersonateThread:qword
    extrn '__imp_NtInitializeRegistry' as NtInitializeRegistry:qword
    extrn '__imp_NtInitiatePowerAction' as NtInitiatePowerAction:qword
    extrn '__imp_NtIsProcessInJob' as NtIsProcessInJob:qword
    extrn '__imp_NtIsSystemResumeAutomatic' as NtIsSystemResumeAutomatic:qword
    extrn '__imp_NtListenPort' as NtListenPort:qword
    extrn '__imp_NtLoadDriver' as NtLoadDriver:qword
    extrn '__imp_NtLoadKey' as NtLoadKey:qword
    extrn '__imp_NtLoadKey2' as NtLoadKey2:qword
    extrn '__imp_NtLoadKeyEx' as NtLoadKeyEx:qword
    extrn '__imp_NtLockFile' as NtLockFile:qword
    extrn '__imp_NtLockProductActivationKeys' as NtLockProductActivationKeys:qword
    extrn '__imp_NtLockRegistryKey' as NtLockRegistryKey:qword
    extrn '__imp_NtLockVirtualMemory' as NtLockVirtualMemory:qword
    extrn '__imp_NtMakePermanentObject' as NtMakePermanentObject:qword
    extrn '__imp_NtMakeTemporaryObject' as NtMakeTemporaryObject:qword
    extrn '__imp_NtMapUserPhysicalPages' as NtMapUserPhysicalPages:qword
    extrn '__imp_NtMapUserPhysicalPagesScatter' as NtMapUserPhysicalPagesScatter:qword
    extrn '__imp_NtMapViewOfSection' as NtMapViewOfSection:qword
    extrn '__imp_NtModifyBootEntry' as NtModifyBootEntry:qword
    extrn '__imp_NtModifyDriverEntry' as NtModifyDriverEntry:qword
    extrn '__imp_NtNotifyChangeDirectoryFile' as NtNotifyChangeDirectoryFile:qword
    extrn '__imp_NtNotifyChangeKey' as NtNotifyChangeKey:qword
    extrn '__imp_NtNotifyChangeMultipleKeys' as NtNotifyChangeMultipleKeys:qword
    extrn '__imp_NtOpenDirectoryObject' as NtOpenDirectoryObject:qword
    extrn '__imp_NtOpenEvent' as NtOpenEvent:qword
    extrn '__imp_NtOpenEventPair' as NtOpenEventPair:qword
    extrn '__imp_NtOpenFile' as NtOpenFile:qword
    extrn '__imp_NtOpenIoCompletion' as NtOpenIoCompletion:qword
    extrn '__imp_NtOpenJobObject' as NtOpenJobObject:qword
    extrn '__imp_NtOpenKey' as NtOpenKey:qword
    extrn '__imp_NtOpenKeyedEvent' as NtOpenKeyedEvent:qword
    extrn '__imp_NtOpenMutant' as NtOpenMutant:qword
    extrn '__imp_NtOpenObjectAuditAlarm' as NtOpenObjectAuditAlarm:qword
    extrn '__imp_NtOpenProcess' as NtOpenProcess:qword
    extrn '__imp_NtOpenProcessToken' as NtOpenProcessToken:qword
    extrn '__imp_NtOpenProcessTokenEx' as NtOpenProcessTokenEx:qword
    extrn '__imp_NtOpenSection' as NtOpenSection:qword
    extrn '__imp_NtOpenSemaphore' as NtOpenSemaphore:qword
    extrn '__imp_NtOpenSymbolicLinkObject' as NtOpenSymbolicLinkObject:qword
    extrn '__imp_NtOpenThread' as NtOpenThread:qword
    extrn '__imp_NtOpenThreadToken' as NtOpenThreadToken:qword
    extrn '__imp_NtOpenThreadTokenEx' as NtOpenThreadTokenEx:qword
    extrn '__imp_NtOpenTimer' as NtOpenTimer:qword
    extrn '__imp_NtPlugPlayControl' as NtPlugPlayControl:qword
    extrn '__imp_NtPowerInformation' as NtPowerInformation:qword
    extrn '__imp_NtPrivilegeCheck' as NtPrivilegeCheck:qword
    extrn '__imp_NtPrivilegedServiceAuditAlarm' as NtPrivilegedServiceAuditAlarm:qword
    extrn '__imp_NtPrivilegeObjectAuditAlarm' as NtPrivilegeObjectAuditAlarm:qword
    extrn '__imp_NtProtectVirtualMemory' as NtProtectVirtualMemory:qword
    extrn '__imp_NtPulseEvent' as NtPulseEvent:qword
    extrn '__imp_NtQueryAttributesFile' as NtQueryAttributesFile:qword
    extrn '__imp_NtQueryBootEntryOrder' as NtQueryBootEntryOrder:qword
    extrn '__imp_NtQueryBootOptions' as NtQueryBootOptions:qword
    extrn '__imp_NtQueryDebugFilterState' as NtQueryDebugFilterState:qword
    extrn '__imp_NtQueryDefaultLocale' as NtQueryDefaultLocale:qword
    extrn '__imp_NtQueryDefaultUILanguage' as NtQueryDefaultUILanguage:qword
    extrn '__imp_NtQueryDirectoryFile' as NtQueryDirectoryFile:qword
    extrn '__imp_NtQueryDirectoryObject' as NtQueryDirectoryObject:qword
    extrn '__imp_NtQueryDriverEntryOrder' as NtQueryDriverEntryOrder:qword
    extrn '__imp_NtQueryEaFile' as NtQueryEaFile:qword
    extrn '__imp_NtQueryEvent' as NtQueryEvent:qword
    extrn '__imp_NtQueryFullAttributesFile' as NtQueryFullAttributesFile:qword
    extrn '__imp_NtQueryInformationAtom' as NtQueryInformationAtom:qword
    extrn '__imp_NtQueryInformationFile' as NtQueryInformationFile:qword
    extrn '__imp_NtQueryInformationJobObject' as NtQueryInformationJobObject:qword
    extrn '__imp_NtQueryInformationPort' as NtQueryInformationPort:qword
    extrn '__imp_NtQueryInformationProcess' as NtQueryInformationProcess:qword
    extrn '__imp_NtQueryInformationThread' as NtQueryInformationThread:qword
    extrn '__imp_NtQueryInformationToken' as NtQueryInformationToken:qword
    extrn '__imp_NtQueryInstallUILanguage' as NtQueryInstallUILanguage:qword
    extrn '__imp_NtQueryIntervalProfile' as NtQueryIntervalProfile:qword
    extrn '__imp_NtQueryIoCompletion' as NtQueryIoCompletion:qword
    extrn '__imp_NtQueryKey' as NtQueryKey:qword
    extrn '__imp_NtQueryMultipleValueKey' as NtQueryMultipleValueKey:qword
    extrn '__imp_NtQueryMutant' as NtQueryMutant:qword
    extrn '__imp_NtQueryObject' as NtQueryObject:qword
    extrn '__imp_NtQueryOpenSubKeys' as NtQueryOpenSubKeys:qword
    extrn '__imp_NtQueryPerformanceCounter' as NtQueryPerformanceCounter:qword
    extrn '__imp_NtQueryPortInformationProcess' as NtQueryPortInformationProcess:qword
    extrn '__imp_NtQueryQuotaInformationFile' as NtQueryQuotaInformationFile:qword
    extrn '__imp_NtQuerySection' as NtQuerySection:qword
    extrn '__imp_NtQuerySecurityObject' as NtQuerySecurityObject:qword
    extrn '__imp_NtQuerySemaphore' as NtQuerySemaphore:qword
    extrn '__imp_NtQuerySymbolicLinkObject' as NtQuerySymbolicLinkObject:qword
    extrn '__imp_NtQuerySystemEnvironmentValue' as NtQuerySystemEnvironmentValue:qword
    extrn '__imp_NtQuerySystemEnvironmentValueEx' as NtQuerySystemEnvironmentValueEx:qword
    extrn '__imp_NtQuerySystemInformation' as NtQuerySystemInformation:qword
    extrn '__imp_NtQuerySystemTime' as NtQuerySystemTime:qword
    extrn '__imp_NtQueryTimer' as NtQueryTimer:qword
    extrn '__imp_NtQueryTimerResolution' as NtQueryTimerResolution:qword
    extrn '__imp_NtQueryValueKey' as NtQueryValueKey:qword
    extrn '__imp_NtQueryVirtualMemory' as NtQueryVirtualMemory:qword
    extrn '__imp_NtQueryVolumeInformationFile' as NtQueryVolumeInformationFile:qword
    extrn '__imp_NtQueueApcThread' as NtQueueApcThread:qword
    extrn '__imp_NtRaiseException' as NtRaiseException:qword
    extrn '__imp_NtRaiseHardError' as NtRaiseHardError:qword
    extrn '__imp_NtReadFile' as NtReadFile:qword
    extrn '__imp_NtReadFileScatter' as NtReadFileScatter:qword
    extrn '__imp_NtReadRequestData' as NtReadRequestData:qword
    extrn '__imp_NtReadVirtualMemory' as NtReadVirtualMemory:qword
    extrn '__imp_NtRegisterThreadTerminatePort' as NtRegisterThreadTerminatePort:qword
    extrn '__imp_NtReleaseKeyedEvent' as NtReleaseKeyedEvent:qword
    extrn '__imp_NtReleaseMutant' as NtReleaseMutant:qword
    extrn '__imp_NtReleaseSemaphore' as NtReleaseSemaphore:qword
    extrn '__imp_NtRemoveIoCompletion' as NtRemoveIoCompletion:qword
    extrn '__imp_NtRemoveProcessDebug' as NtRemoveProcessDebug:qword
    extrn '__imp_NtRenameKey' as NtRenameKey:qword
    extrn '__imp_NtReplaceKey' as NtReplaceKey:qword
    extrn '__imp_NtReplyPort' as NtReplyPort:qword
    extrn '__imp_NtReplyWaitReceivePort' as NtReplyWaitReceivePort:qword
    extrn '__imp_NtReplyWaitReceivePortEx' as NtReplyWaitReceivePortEx:qword
    extrn '__imp_NtReplyWaitReplyPort' as NtReplyWaitReplyPort:qword
    extrn '__imp_NtRequestPort' as NtRequestPort:qword
    extrn '__imp_NtRequestWaitReplyPort' as NtRequestWaitReplyPort:qword
    extrn '__imp_NtResetEvent' as NtResetEvent:qword
    extrn '__imp_NtResetWriteWatch' as NtResetWriteWatch:qword
    extrn '__imp_NtRestoreKey' as NtRestoreKey:qword
    extrn '__imp_NtResumeProcess' as NtResumeProcess:qword
    extrn '__imp_NtResumeThread' as NtResumeThread:qword
    extrn '__imp_NtSaveKey' as NtSaveKey:qword
    extrn '__imp_NtSaveKeyEx' as NtSaveKeyEx:qword
    extrn '__imp_NtSaveMergedKeys' as NtSaveMergedKeys:qword
    extrn '__imp_NtSecureConnectPort' as NtSecureConnectPort:qword
    extrn '__imp_NtSetBootEntryOrder' as NtSetBootEntryOrder:qword
    extrn '__imp_NtSetBootOptions' as NtSetBootOptions:qword
    extrn '__imp_NtSetContextThread' as NtSetContextThread:qword
    extrn '__imp_NtSetDebugFilterState' as NtSetDebugFilterState:qword
    extrn '__imp_NtSetDefaultHardErrorPort' as NtSetDefaultHardErrorPort:qword
    extrn '__imp_NtSetDefaultLocale' as NtSetDefaultLocale:qword
    extrn '__imp_NtSetDefaultUILanguage' as NtSetDefaultUILanguage:qword
    extrn '__imp_NtSetDriverEntryOrder' as NtSetDriverEntryOrder:qword
    extrn '__imp_NtSetEaFile' as NtSetEaFile:qword
    extrn '__imp_NtSetEvent' as NtSetEvent:qword
    extrn '__imp_NtSetEventBoostPriority' as NtSetEventBoostPriority:qword
    extrn '__imp_NtSetHighEventPair' as NtSetHighEventPair:qword
    extrn '__imp_NtSetHighWaitLowEventPair' as NtSetHighWaitLowEventPair:qword
    extrn '__imp_NtSetInformationDebugObject' as NtSetInformationDebugObject:qword
    extrn '__imp_NtSetInformationFile' as NtSetInformationFile:qword
    extrn '__imp_NtSetInformationJobObject' as NtSetInformationJobObject:qword
    extrn '__imp_NtSetInformationKey' as NtSetInformationKey:qword
    extrn '__imp_NtSetInformationObject' as NtSetInformationObject:qword
    extrn '__imp_NtSetInformationProcess' as NtSetInformationProcess:qword
    extrn '__imp_NtSetInformationThread' as NtSetInformationThread:qword
    extrn '__imp_NtSetInformationToken' as NtSetInformationToken:qword
    extrn '__imp_NtSetIntervalProfile' as NtSetIntervalProfile:qword
    extrn '__imp_NtSetIoCompletion' as NtSetIoCompletion:qword
    extrn '__imp_NtSetLdtEntries' as NtSetLdtEntries:qword
    extrn '__imp_NtSetLowEventPair' as NtSetLowEventPair:qword
    extrn '__imp_NtSetLowWaitHighEventPair' as NtSetLowWaitHighEventPair:qword
    extrn '__imp_NtSetQuotaInformationFile' as NtSetQuotaInformationFile:qword
    extrn '__imp_NtSetSecurityObject' as NtSetSecurityObject:qword
    extrn '__imp_NtSetSystemEnvironmentValue' as NtSetSystemEnvironmentValue:qword
    extrn '__imp_NtSetSystemEnvironmentValueEx' as NtSetSystemEnvironmentValueEx:qword
    extrn '__imp_NtSetSystemInformation' as NtSetSystemInformation:qword
    extrn '__imp_NtSetSystemPowerState' as NtSetSystemPowerState:qword
    extrn '__imp_NtSetSystemTime' as NtSetSystemTime:qword
    extrn '__imp_NtSetThreadExecutionState' as NtSetThreadExecutionState:qword
    extrn '__imp_NtSetTimer' as NtSetTimer:qword
    extrn '__imp_NtSetTimerResolution' as NtSetTimerResolution:qword
    extrn '__imp_NtSetUuidSeed' as NtSetUuidSeed:qword
    extrn '__imp_NtSetValueKey' as NtSetValueKey:qword
    extrn '__imp_NtSetVolumeInformationFile' as NtSetVolumeInformationFile:qword
    extrn '__imp_NtShutdownSystem' as NtShutdownSystem:qword
    extrn '__imp_NtSignalAndWaitForSingleObject' as NtSignalAndWaitForSingleObject:qword
    extrn '__imp_NtStartProfile' as NtStartProfile:qword
    extrn '__imp_NtStopProfile' as NtStopProfile:qword
    extrn '__imp_NtSuspendProcess' as NtSuspendProcess:qword
    extrn '__imp_NtSuspendThread' as NtSuspendThread:qword
    extrn '__imp_NtSystemDebugControl' as NtSystemDebugControl:qword
    extrn '__imp_NtTerminateJobObject' as NtTerminateJobObject:qword
    extrn '__imp_NtTerminateProcess' as NtTerminateProcess:qword
    extrn '__imp_NtTerminateThread' as NtTerminateThread:qword
    extrn '__imp_NtTestAlert' as NtTestAlert:qword
    extrn '__imp_NtTraceEvent' as NtTraceEvent:qword
    extrn '__imp_NtTranslateFilePath' as NtTranslateFilePath:qword
    extrn '__imp_NtUnloadDriver' as NtUnloadDriver:qword
    extrn '__imp_NtUnloadKey' as NtUnloadKey:qword
    extrn '__imp_NtUnloadKey2' as NtUnloadKey2:qword
    extrn '__imp_NtUnloadKeyEx' as NtUnloadKeyEx:qword
    extrn '__imp_NtUnlockFile' as NtUnlockFile:qword
    extrn '__imp_NtUnlockVirtualMemory' as NtUnlockVirtualMemory:qword
    extrn '__imp_NtUnmapViewOfSection' as NtUnmapViewOfSection:qword
    extrn '__imp_NtVdmControl' as NtVdmControl:qword
    extrn '__imp_NtWaitForDebugEvent' as NtWaitForDebugEvent:qword
    extrn '__imp_NtWaitForKeyedEvent' as NtWaitForKeyedEvent:qword
    extrn '__imp_NtWaitForMultipleObjects' as NtWaitForMultipleObjects:qword
    extrn '__imp_NtWaitForMultipleObjects32' as NtWaitForMultipleObjects32:qword
    extrn '__imp_NtWaitForSingleObject' as NtWaitForSingleObject:qword
    extrn '__imp_NtWaitHighEventPair' as NtWaitHighEventPair:qword
    extrn '__imp_NtWaitLowEventPair' as NtWaitLowEventPair:qword
    extrn '__imp_NtWriteFile' as NtWriteFile:qword
    extrn '__imp_NtWriteFileGather' as NtWriteFileGather:qword
    extrn '__imp_NtWriteRequestData' as NtWriteRequestData:qword
    extrn '__imp_NtWriteVirtualMemory' as NtWriteVirtualMemory:qword
    extrn '__imp_NtYieldExecution' as NtYieldExecution:qword
    extrn '__imp_PfxFindPrefix' as PfxFindPrefix:qword
    extrn '__imp_PfxInitialize' as PfxInitialize:qword
    extrn '__imp_PfxInsertPrefix' as PfxInsertPrefix:qword
    extrn '__imp_PfxRemovePrefix' as PfxRemovePrefix:qword
    extrn '__imp_pow' as pow:qword
    extrn '__imp_qsort' as qsort:qword
    extrn '__imp_RtlAbortRXact' as RtlAbortRXact:qword
    extrn '__imp_RtlAbsoluteToSelfRelativeSD' as RtlAbsoluteToSelfRelativeSD:qword
    extrn '__imp_RtlAcquirePebLock' as RtlAcquirePebLock:qword
    extrn '__imp_RtlAcquirePrivilege' as RtlAcquirePrivilege:qword
    extrn '__imp_RtlAcquireResourceExclusive' as RtlAcquireResourceExclusive:qword
    extrn '__imp_RtlAcquireResourceShared' as RtlAcquireResourceShared:qword
    extrn '__imp_RtlActivateActivationContext' as RtlActivateActivationContext:qword
    extrn '__imp_RtlActivateActivationContextEx' as RtlActivateActivationContextEx:qword
    extrn '__imp_RtlActivateActivationContextUnsafeFast' as RtlActivateActivationContextUnsafeFast:qword
    extrn '__imp_RtlAddAccessAllowedAce' as RtlAddAccessAllowedAce:qword
    extrn '__imp_RtlAddAccessAllowedAceEx' as RtlAddAccessAllowedAceEx:qword
    extrn '__imp_RtlAddAccessAllowedObjectAce' as RtlAddAccessAllowedObjectAce:qword
    extrn '__imp_RtlAddAccessDeniedAce' as RtlAddAccessDeniedAce:qword
    extrn '__imp_RtlAddAccessDeniedAceEx' as RtlAddAccessDeniedAceEx:qword
    extrn '__imp_RtlAddAccessDeniedObjectAce' as RtlAddAccessDeniedObjectAce:qword
    extrn '__imp_RtlAddAce' as RtlAddAce:qword
    extrn '__imp_RtlAddActionToRXact' as RtlAddActionToRXact:qword
    extrn '__imp_RtlAddAtomToAtomTable' as RtlAddAtomToAtomTable:qword
    extrn '__imp_RtlAddAttributeActionToRXact' as RtlAddAttributeActionToRXact:qword
    extrn '__imp_RtlAddAuditAccessAce' as RtlAddAuditAccessAce:qword
    extrn '__imp_RtlAddAuditAccessAceEx' as RtlAddAuditAccessAceEx:qword
    extrn '__imp_RtlAddAuditAccessObjectAce' as RtlAddAuditAccessObjectAce:qword
    extrn '__imp_RtlAddCompoundAce' as RtlAddCompoundAce:qword
    extrn '__imp_RtlAddFunctionTable' as RtlAddFunctionTable:qword
    extrn '__imp_RtlAddRefActivationContext' as RtlAddRefActivationContext:qword
    extrn '__imp_RtlAddRefMemoryStream' as RtlAddRefMemoryStream:qword
    extrn '__imp_RtlAddressInSectionTable' as RtlAddressInSectionTable:qword
    extrn '__imp_RtlAddVectoredContinueHandler' as RtlAddVectoredContinueHandler:qword
    extrn '__imp_RtlAddVectoredExceptionHandler' as RtlAddVectoredExceptionHandler:qword
    extrn '__imp_RtlAdjustPrivilege' as RtlAdjustPrivilege:qword
    extrn '__imp_RtlAllocateActivationContextStack' as RtlAllocateActivationContextStack:qword
    extrn '__imp_RtlAllocateAndInitializeSid' as RtlAllocateAndInitializeSid:qword
    extrn '__imp_RtlAllocateHandle' as RtlAllocateHandle:qword
    extrn '__imp_RtlAllocateHeap' as RtlAllocateHeap:qword
    extrn '__imp_RtlAnsiCharToUnicodeChar' as RtlAnsiCharToUnicodeChar:qword
    extrn '__imp_RtlAnsiStringToUnicodeSize' as RtlAnsiStringToUnicodeSize:qword
    extrn '__imp_RtlAnsiStringToUnicodeString' as RtlAnsiStringToUnicodeString:qword
    extrn '__imp_RtlAppendAsciizToString' as RtlAppendAsciizToString:qword
    extrn '__imp_RtlAppendPathElement' as RtlAppendPathElement:qword
    extrn '__imp_RtlAppendStringToString' as RtlAppendStringToString:qword
    extrn '__imp_RtlAppendUnicodeStringToString' as RtlAppendUnicodeStringToString:qword
    extrn '__imp_RtlAppendUnicodeToString' as RtlAppendUnicodeToString:qword
    extrn '__imp_RtlApplicationVerifierStop' as RtlApplicationVerifierStop:qword
    extrn '__imp_RtlApplyRXact' as RtlApplyRXact:qword
    extrn '__imp_RtlApplyRXactNoFlush' as RtlApplyRXactNoFlush:qword
    extrn '__imp_RtlAreAllAccessesGranted' as RtlAreAllAccessesGranted:qword
    extrn '__imp_RtlAreAnyAccessesGranted' as RtlAreAnyAccessesGranted:qword
    extrn '__imp_RtlAreBitsClear' as RtlAreBitsClear:qword
    extrn '__imp_RtlAreBitsSet' as RtlAreBitsSet:qword
    extrn '__imp_RtlAssert' as RtlAssert:qword
    extrn '__imp_RtlCancelTimer' as RtlCancelTimer:qword
    extrn '__imp_RtlCaptureContext' as RtlCaptureContext:qword
    extrn '__imp_RtlCaptureStackBackTrace' as RtlCaptureStackBackTrace:qword
    extrn '__imp_RtlCharToInteger' as RtlCharToInteger:qword
    extrn '__imp_RtlCheckForOrphanedCriticalSections' as RtlCheckForOrphanedCriticalSections:qword
    extrn '__imp_RtlCheckRegistryKey' as RtlCheckRegistryKey:qword
    extrn '__imp_RtlClearAllBits' as RtlClearAllBits:qword
    extrn '__imp_RtlClearBits' as RtlClearBits:qword
    extrn '__imp_RtlCloneMemoryStream' as RtlCloneMemoryStream:qword
    extrn '__imp_RtlCommitMemoryStream' as RtlCommitMemoryStream:qword
    extrn '__imp_RtlCompactHeap' as RtlCompactHeap:qword
    extrn '__imp_RtlCompareMemory' as RtlCompareMemory:qword
    extrn '__imp_RtlCompareMemoryUlong' as RtlCompareMemoryUlong:qword
    extrn '__imp_RtlCompareString' as RtlCompareString:qword
    extrn '__imp_RtlCompareUnicodeString' as RtlCompareUnicodeString:qword
    extrn '__imp_RtlCompressBuffer' as RtlCompressBuffer:qword
    extrn '__imp_RtlComputeCrc32' as RtlComputeCrc32:qword
    extrn '__imp_RtlComputeImportTableHash' as RtlComputeImportTableHash:qword
    extrn '__imp_RtlComputePrivatizedDllName_U' as RtlComputePrivatizedDllName_U:qword
    extrn '__imp_RtlConsoleMultiByteToUnicodeN' as RtlConsoleMultiByteToUnicodeN:qword
    extrn '__imp_RtlConvertExclusiveToShared' as RtlConvertExclusiveToShared:qword
    extrn '__imp_RtlConvertSharedToExclusive' as RtlConvertSharedToExclusive:qword
    extrn '__imp_RtlConvertSidToUnicodeString' as RtlConvertSidToUnicodeString:qword
    extrn '__imp_RtlConvertToAutoInheritSecurityObject' as RtlConvertToAutoInheritSecurityObject:qword
    extrn '__imp_RtlCopyLuid' as RtlCopyLuid:qword
    extrn '__imp_RtlCopyLuidAndAttributesArray' as RtlCopyLuidAndAttributesArray:qword
    extrn '__imp_RtlCopyMappedMemory' as RtlCopyMappedMemory:qword
    extrn '__imp_RtlCopyMemory' as RtlCopyMemory:qword
    extrn '__imp_RtlCopyMemoryNonTemporal' as RtlCopyMemoryNonTemporal:qword
    extrn '__imp_RtlCopyMemoryStreamTo' as RtlCopyMemoryStreamTo:qword
    extrn '__imp_RtlCopyOutOfProcessMemoryStreamTo' as RtlCopyOutOfProcessMemoryStreamTo:qword
    extrn '__imp_RtlCopySecurityDescriptor' as RtlCopySecurityDescriptor:qword
    extrn '__imp_RtlCopySid' as RtlCopySid:qword
    extrn '__imp_RtlCopySidAndAttributesArray' as RtlCopySidAndAttributesArray:qword
    extrn '__imp_RtlCopyString' as RtlCopyString:qword
    extrn '__imp_RtlCopyUnicodeString' as RtlCopyUnicodeString:qword
    extrn '__imp_RtlCreateAcl' as RtlCreateAcl:qword
    extrn '__imp_RtlCreateActivationContext' as RtlCreateActivationContext:qword
    extrn '__imp_RtlCreateAndSetSD' as RtlCreateAndSetSD:qword
    extrn '__imp_RtlCreateAtomTable' as RtlCreateAtomTable:qword
    extrn '__imp_RtlCreateBootStatusDataFile' as RtlCreateBootStatusDataFile:qword
    extrn '__imp_RtlCreateEnvironment' as RtlCreateEnvironment:qword
    extrn '__imp_RtlCreateHeap' as RtlCreateHeap:qword
    extrn '__imp_RtlCreateProcessParameters' as RtlCreateProcessParameters:qword
    extrn '__imp_RtlCreatequeryDebugBuffer' as RtlCreatequeryDebugBuffer:qword
    extrn '__imp_RtlCreateRegistryKey' as RtlCreateRegistryKey:qword
    extrn '__imp_RtlCreateSecurityDescriptor' as RtlCreateSecurityDescriptor:qword
    extrn '__imp_RtlCreateServiceSid' as RtlCreateServiceSid:qword
    extrn '__imp_RtlCreateSystemVolumeInformationFolder' as RtlCreateSystemVolumeInformationFolder:qword
    extrn '__imp_RtlCreateTagHeap' as RtlCreateTagHeap:qword
    extrn '__imp_RtlCreateTimer' as RtlCreateTimer:qword
    extrn '__imp_RtlCreateTimerQueue' as RtlCreateTimerQueue:qword
    extrn '__imp_RtlCreateUnicodeString' as RtlCreateUnicodeString:qword
    extrn '__imp_RtlCreateUnicodeStringFromAsciiz' as RtlCreateUnicodeStringFromAsciiz:qword
    extrn '__imp_RtlCreateUserProcess' as RtlCreateUserProcess:qword
    extrn '__imp_RtlCreateUserSecurityObject' as RtlCreateUserSecurityObject:qword
    extrn '__imp_RtlCreateUserThread' as RtlCreateUserThread:qword
    extrn '__imp_RtlCustomCPToUnicodeN' as RtlCustomCPToUnicodeN:qword
    extrn '__imp_RtlCutoverTimeToSystemTime' as RtlCutoverTimeToSystemTime:qword
    extrn '__imp_RtlDeactivateActivationContext' as RtlDeactivateActivationContext:qword
    extrn '__imp_RtlDeactivateActivationContextUnsafeFast' as RtlDeactivateActivationContextUnsafeFast:qword
    extrn '__imp_RtlDebugPrintTimes' as RtlDebugPrintTimes:qword
    extrn '__imp_RtlDecodePointer' as RtlDecodePointer:qword
    extrn '__imp_RtlDecodeSystemPointer' as RtlDecodeSystemPointer:qword
    extrn '__imp_RtlDecompressBuffer' as RtlDecompressBuffer:qword
    extrn '__imp_RtlDecompressFragment' as RtlDecompressFragment:qword
    extrn '__imp_RtlDefaultNpAcl' as RtlDefaultNpAcl:qword
    extrn '__imp_RtlDelete' as RtlDelete:qword
    extrn '__imp_RtlDeleteAce' as RtlDeleteAce:qword
    extrn '__imp_RtlDeleteAtomFromAtomTable' as RtlDeleteAtomFromAtomTable:qword
    extrn '__imp_RtlDeleteCriticalSection' as RtlDeleteCriticalSection:qword
    extrn '__imp_RtlDeleteElementGenericTable' as RtlDeleteElementGenericTable:qword
    extrn '__imp_RtlDeleteElementGenericTableAvl' as RtlDeleteElementGenericTableAvl:qword
    extrn '__imp_RtlDeleteFunctionTable' as RtlDeleteFunctionTable:qword
    extrn '__imp_RtlDeleteNoSplay' as RtlDeleteNoSplay:qword
    extrn '__imp_RtlDeleteRegistryValue' as RtlDeleteRegistryValue:qword
    extrn '__imp_RtlDeleteResource' as RtlDeleteResource:qword
    extrn '__imp_RtlDeleteSecurityObject' as RtlDeleteSecurityObject:qword
    extrn '__imp_RtlDeleteTimer' as RtlDeleteTimer:qword
    extrn '__imp_RtlDeleteTimerQueue' as RtlDeleteTimerQueue:qword
    extrn '__imp_RtlDeleteTimerQueueEx' as RtlDeleteTimerQueueEx:qword
    extrn '__imp_RtlDeNormalizeProcessParams' as RtlDeNormalizeProcessParams:qword
    extrn '__imp_RtlDeregisterWait' as RtlDeregisterWait:qword
    extrn '__imp_RtlDeregisterWaitEx' as RtlDeregisterWaitEx:qword
    extrn '__imp_RtlDestroyAtomTable' as RtlDestroyAtomTable:qword
    extrn '__imp_RtlDestroyEnvironment' as RtlDestroyEnvironment:qword
    extrn '__imp_RtlDestroyHandleTable' as RtlDestroyHandleTable:qword
    extrn '__imp_RtlDestroyHeap' as RtlDestroyHeap:qword
    extrn '__imp_RtlDestroyProcessParameters' as RtlDestroyProcessParameters:qword
    extrn '__imp_RtlDestroyQueryDebugBuffer' as RtlDestroyQueryDebugBuffer:qword
    extrn '__imp_RtlDetermineDosPathNameType_U' as RtlDetermineDosPathNameType_U:qword
    extrn '__imp_RtlDllShutdownInProgress' as RtlDllShutdownInProgress:qword
    extrn '__imp_RtlDnsHostNameToComputerName' as RtlDnsHostNameToComputerName:qword
    extrn '__imp_RtlDoesFileExists_U' as RtlDoesFileExists_U:qword
    extrn '__imp_RtlDosApplyFileIsolationRedirection_Ustr' as RtlDosApplyFileIsolationRedirection_Ustr:qword
    extrn '__imp_RtlDosPathNameToNtPathName_U' as RtlDosPathNameToNtPathName_U:qword
    extrn '__imp_RtlDosPathNameToNtPathName_U_WithStatus' as RtlDosPathNameToNtPathName_U_WithStatus:qword
    extrn '__imp_RtlDosPathNameToRelativeNtPathName_U' as RtlDosPathNameToRelativeNtPathName_U:qword
    extrn '__imp_RtlDosPathNameToRelativeNtPathName_U_WithStatus' as RtlDosPathNameToRelativeNtPathName_U_WithStatus:qword
    extrn '__imp_RtlDosSearchPath_U' as RtlDosSearchPath_U:qword
    extrn '__imp_RtlDosSearchPath_Ustr' as RtlDosSearchPath_Ustr:qword
    extrn '__imp_RtlDowncaseUnicodeChar' as RtlDowncaseUnicodeChar:qword
    extrn '__imp_RtlDowncaseUnicodeString' as RtlDowncaseUnicodeString:qword
    extrn '__imp_RtlDumpResource' as RtlDumpResource:qword
    extrn '__imp_RtlDuplicateUnicodeString' as RtlDuplicateUnicodeString:qword
    extrn '__imp_RtlEmptyAtomTable' as RtlEmptyAtomTable:qword
    extrn '__imp_RtlEnableEarlyCriticalSectionEventCreation' as RtlEnableEarlyCriticalSectionEventCreation:qword
    extrn '__imp_RtlEncodePointer' as RtlEncodePointer:qword
    extrn '__imp_RtlEncodeSystemPointer' as RtlEncodeSystemPointer:qword
    extrn '__imp_RtlEnterCriticalSection' as RtlEnterCriticalSection:qword
    extrn '__imp_RtlEnumerateGenericTable' as RtlEnumerateGenericTable:qword
    extrn '__imp_RtlEnumerateGenericTableAvl' as RtlEnumerateGenericTableAvl:qword
    extrn '__imp_RtlEnumerateGenericTableLikeADirectory' as RtlEnumerateGenericTableLikeADirectory:qword
    extrn '__imp_RtlEnumerateGenericTableWithoutSplaying' as RtlEnumerateGenericTableWithoutSplaying:qword
    extrn '__imp_RtlEnumerateGenericTableWithoutSplayingAvl' as RtlEnumerateGenericTableWithoutSplayingAvl:qword
    extrn '__imp_RtlEnumProcessHeaps' as RtlEnumProcessHeaps:qword
    extrn '__imp_RtlequalComputerName' as RtlequalComputerName:qword
    extrn '__imp_RtlequalDomainName' as RtlequalDomainName:qword
    extrn '__imp_RtlequalLuid' as RtlequalLuid:qword
    extrn '__imp_RtlequalPrefixSid' as RtlequalPrefixSid:qword
    extrn '__imp_RtlequalSid' as RtlequalSid:qword
    extrn '__imp_RtlequalString' as RtlequalString:qword
    extrn '__imp_RtlequalUnicodeString' as RtlequalUnicodeString:qword
    extrn '__imp_RtlEraseUnicodeString' as RtlEraseUnicodeString:qword
    extrn '__imp_RtlExitUserThread' as RtlExitUserThread:qword
    extrn '__imp_RtlExpandEnvironmentStrings_U' as RtlExpandEnvironmentStrings_U:qword
    extrn '__imp_RtlFillMemory' as RtlFillMemory:qword
    extrn '__imp_RtlFinalReleaseOutOfProcessMemoryStream' as RtlFinalReleaseOutOfProcessMemoryStream:qword
    extrn '__imp_RtlFindActivationContextSectionGuid' as RtlFindActivationContextSectionGuid:qword
    extrn '__imp_RtlFindActivationContextSectionString' as RtlFindActivationContextSectionString:qword
    extrn '__imp_RtlFindCharInUnicodeString' as RtlFindCharInUnicodeString:qword
    extrn '__imp_RtlFindClearBits' as RtlFindClearBits:qword
    extrn '__imp_RtlFindClearBitsAndSet' as RtlFindClearBitsAndSet:qword
    extrn '__imp_RtlFindClearRuns' as RtlFindClearRuns:qword
    extrn '__imp_RtlFindLastBackwardRunClear' as RtlFindLastBackwardRunClear:qword
    extrn '__imp_RtlFindLeastSignificantBit' as RtlFindLeastSignificantBit:qword
    extrn '__imp_RtlFindLongestRunClear' as RtlFindLongestRunClear:qword
    extrn '__imp_RtlFindMessage' as RtlFindMessage:qword
    extrn '__imp_RtlFindMostSignificantBit' as RtlFindMostSignificantBit:qword
    extrn '__imp_RtlFindNextForwardRunClear' as RtlFindNextForwardRunClear:qword
    extrn '__imp_RtlFindSetBits' as RtlFindSetBits:qword
    extrn '__imp_RtlFindSetBitsAndClear' as RtlFindSetBitsAndClear:qword
    extrn '__imp_RtlFirstEntrySList' as RtlFirstEntrySList:qword
    extrn '__imp_RtlFirstFreeAce' as RtlFirstFreeAce:qword
    extrn '__imp_RtlFlushSecureMemoryCache' as RtlFlushSecureMemoryCache:qword
    extrn '__imp_RtlFormatCurrentUserKeyPath' as RtlFormatCurrentUserKeyPath:qword
    extrn '__imp_RtlFormatMessage' as RtlFormatMessage:qword
    extrn '__imp_RtlFormatMessageEx' as RtlFormatMessageEx:qword
    extrn '__imp_RtlFreeActivationContextStack' as RtlFreeActivationContextStack:qword
    extrn '__imp_RtlFreeAnsiString' as RtlFreeAnsiString:qword
    extrn '__imp_RtlFreeHandle' as RtlFreeHandle:qword
    extrn '__imp_RtlFreeHeap' as RtlFreeHeap:qword
    extrn '__imp_RtlFreeOemString' as RtlFreeOemString:qword
    extrn '__imp_RtlFreeSid' as RtlFreeSid:qword
    extrn '__imp_RtlFreeThreadActivationContextStack' as RtlFreeThreadActivationContextStack:qword
    extrn '__imp_RtlFreeUnicodeString' as RtlFreeUnicodeString:qword
    extrn '__imp_RtlGenerate8dot3Name' as RtlGenerate8dot3Name:qword
    extrn '__imp_RtlGetAce' as RtlGetAce:qword
    extrn '__imp_RtlGetActiveActivationContext' as RtlGetActiveActivationContext:qword
    extrn '__imp_RtlGetCallersAddress' as RtlGetCallersAddress:qword
    extrn '__imp_RtlGetCompressionWorkSpaceSize' as RtlGetCompressionWorkSpaceSize:qword
    extrn '__imp_RtlGetControlSecurityDescriptor' as RtlGetControlSecurityDescriptor:qword
    extrn '__imp_RtlGetCriticalSectionRecursionCount' as RtlGetCriticalSectionRecursionCount:qword
    extrn '__imp_RtlGetCurrentDirectory_U' as RtlGetCurrentDirectory_U:qword
    extrn '__imp_RtlGetCurrentPeb' as RtlGetCurrentPeb:qword
    extrn '__imp_RtlGetCurrentProcessorNumber' as RtlGetCurrentProcessorNumber:qword
    extrn '__imp_RtlGetDaclSecurityDescriptor' as RtlGetDaclSecurityDescriptor:qword
    extrn '__imp_RtlGetElementGenericTable' as RtlGetElementGenericTable:qword
    extrn '__imp_RtlGetElementGenericTableAvl' as RtlGetElementGenericTableAvl:qword
    extrn '__imp_RtlGetFrame' as RtlGetFrame:qword
    extrn '__imp_RtlGetFullPathName_U' as RtlGetFullPathName_U:qword
    extrn '__imp_RtlGetFullPathName_UstrEx' as RtlGetFullPathName_UstrEx:qword
    extrn '__imp_RtlGetFunctionTableListHead' as RtlGetFunctionTableListHead:qword
    extrn '__imp_RtlGetGroupSecurityDescriptor' as RtlGetGroupSecurityDescriptor:qword
    extrn '__imp_RtlGetLastNtStatus' as RtlGetLastNtStatus:qword
    extrn '__imp_RtlGetLastWin32Error' as RtlGetLastWin32Error:qword
    extrn '__imp_RtlGetLengthWithoutLastFullDosOrNtPathElement' as RtlGetLengthWithoutLastFullDosOrNtPathElement:qword
    extrn '__imp_RtlGetLengthWithoutTrailingPathSeperators' as RtlGetLengthWithoutTrailingPathSeperators:qword
    extrn '__imp_RtlGetLongestNtPathLength' as RtlGetLongestNtPathLength:qword
    extrn '__imp_RtlGetNativeSystemInformation' as RtlGetNativeSystemInformation:qword
    extrn '__imp_RtlGetNtGlobalFlags' as RtlGetNtGlobalFlags:qword
    extrn '__imp_RtlGetNtProductType' as RtlGetNtProductType:qword
    extrn '__imp_RtlGetNtVersionNumbers' as RtlGetNtVersionNumbers:qword
    extrn '__imp_RtlGetOwnerSecurityDescriptor' as RtlGetOwnerSecurityDescriptor:qword
    extrn '__imp_RtlGetProcessHeaps' as RtlGetProcessHeaps:qword
    extrn '__imp_RtlGetSaclSecurityDescriptor' as RtlGetSaclSecurityDescriptor:qword
    extrn '__imp_RtlGetSecurityDescriptorRMControl' as RtlGetSecurityDescriptorRMControl:qword
    extrn '__imp_RtlGetSetBootStatusData' as RtlGetSetBootStatusData:qword
    extrn '__imp_RtlGetThreadErrorMode' as RtlGetThreadErrorMode:qword
    extrn '__imp_RtlGetUnloadEventTrace' as RtlGetUnloadEventTrace:qword
    extrn '__imp_RtlGetVersion' as RtlGetVersion:qword
    extrn '__imp_RtlGUIDFromString' as RtlGUIDFromString:qword
    extrn '__imp_RtlHashUnicodeString' as RtlHashUnicodeString:qword
    extrn '__imp_RtlIdentifierAuthoritySid' as RtlIdentifierAuthoritySid:qword
    extrn '__imp_RtlImageDirectoryEntryToData' as RtlImageDirectoryEntryToData:qword
    extrn '__imp_RtlImageNtHeader' as RtlImageNtHeader:qword
    extrn '__imp_RtlImageNtHeaderEx' as RtlImageNtHeaderEx:qword
    extrn '__imp_RtlImageRvaToSection' as RtlImageRvaToSection:qword
    extrn '__imp_RtlImageRvaToVa' as RtlImageRvaToVa:qword
    extrn '__imp_RtlImpersonateSelf' as RtlImpersonateSelf:qword
    extrn '__imp_RtlInitAnsiString' as RtlInitAnsiString:qword
    extrn '__imp_RtlInitAnsiStringEx' as RtlInitAnsiStringEx:qword
    extrn '__imp_RtlInitCodePageTable' as RtlInitCodePageTable:qword
    extrn '__imp_RtlInitializeAtomPackage' as RtlInitializeAtomPackage:qword
    extrn '__imp_RtlInitializeBitMap' as RtlInitializeBitMap:qword
    extrn '__imp_RtlInitializeContext' as RtlInitializeContext:qword
    extrn '__imp_RtlInitializeCriticalSection' as RtlInitializeCriticalSection:qword
    extrn '__imp_RtlInitializeCriticalSectionAndSpinCount' as RtlInitializeCriticalSectionAndSpinCount:qword
    extrn '__imp_RtlInitializeGenericTable' as RtlInitializeGenericTable:qword
    extrn '__imp_RtlInitializeGenericTableAvl' as RtlInitializeGenericTableAvl:qword
    extrn '__imp_RtlInitializeHandleTable' as RtlInitializeHandleTable:qword
    extrn '__imp_RtlInitializeResource' as RtlInitializeResource:qword
    extrn '__imp_RtlInitializeRXact' as RtlInitializeRXact:qword
    extrn '__imp_RtlInitializeSid' as RtlInitializeSid:qword
    extrn '__imp_RtlInitializeSListHead' as RtlInitializeSListHead:qword
    extrn '__imp_RtlInitMemoryStream' as RtlInitMemoryStream:qword
    extrn '__imp_RtlInitNlsTables' as RtlInitNlsTables:qword
    extrn '__imp_RtlInitOutOfProcessMemoryStream' as RtlInitOutOfProcessMemoryStream:qword
    extrn '__imp_RtlInitString' as RtlInitString:qword
    extrn '__imp_RtlInitUnicodeString' as RtlInitUnicodeString:qword
    extrn '__imp_RtlInitUnicodeStringEx' as RtlInitUnicodeStringEx:qword
    extrn '__imp_RtlInsertElementGenericTable' as RtlInsertElementGenericTable:qword
    extrn '__imp_RtlInsertElementGenericTableAvl' as RtlInsertElementGenericTableAvl:qword
    extrn '__imp_RtlInsertElementGenericTableFull' as RtlInsertElementGenericTableFull:qword
    extrn '__imp_RtlInsertElementGenericTableFullAvl' as RtlInsertElementGenericTableFullAvl:qword
    extrn '__imp_RtlInstallFunctionTableCallback' as RtlInstallFunctionTableCallback:qword
    extrn '__imp_RtlInt64ToUnicodeString' as RtlInt64ToUnicodeString:qword
    extrn '__imp_RtlIntegerToChar' as RtlIntegerToChar:qword
    extrn '__imp_RtlIntegerToUnicodeString' as RtlIntegerToUnicodeString:qword
    extrn '__imp_RtlInterlockedFlushSList' as RtlInterlockedFlushSList:qword
    extrn '__imp_RtlInterlockedPopEntrySList' as RtlInterlockedPopEntrySList:qword
    extrn '__imp_RtlInterlockedPushEntrySList' as RtlInterlockedPushEntrySList:qword
    extrn '__imp_RtlInterlockedPushListSList' as RtlInterlockedPushListSList:qword
    extrn '__imp_RtlIpv4AddressToStringA' as RtlIpv4AddressToStringA:qword
    extrn '__imp_RtlIpv4AddressToStringExA' as RtlIpv4AddressToStringExA:qword
    extrn '__imp_RtlIpv4AddressToStringExW' as RtlIpv4AddressToStringExW:qword
    extrn '__imp_RtlIpv4AddressToStringW' as RtlIpv4AddressToStringW:qword
    extrn '__imp_RtlIpv4StringToAddressA' as RtlIpv4StringToAddressA:qword
    extrn '__imp_RtlIpv4StringToAddressExA' as RtlIpv4StringToAddressExA:qword
    extrn '__imp_RtlIpv4StringToAddressExW' as RtlIpv4StringToAddressExW:qword
    extrn '__imp_RtlIpv4StringToAddressW' as RtlIpv4StringToAddressW:qword
    extrn '__imp_RtlIpv6AddressToStringA' as RtlIpv6AddressToStringA:qword
    extrn '__imp_RtlIpv6AddressToStringExA' as RtlIpv6AddressToStringExA:qword
    extrn '__imp_RtlIpv6AddressToStringExW' as RtlIpv6AddressToStringExW:qword
    extrn '__imp_RtlIpv6AddressToStringW' as RtlIpv6AddressToStringW:qword
    extrn '__imp_RtlIpv6StringToAddressA' as RtlIpv6StringToAddressA:qword
    extrn '__imp_RtlIpv6StringToAddressExA' as RtlIpv6StringToAddressExA:qword
    extrn '__imp_RtlIpv6StringToAddressExW' as RtlIpv6StringToAddressExW:qword
    extrn '__imp_RtlIpv6StringToAddressW' as RtlIpv6StringToAddressW:qword
    extrn '__imp_RtlIsActivationContextActive' as RtlIsActivationContextActive:qword
    extrn '__imp_RtlIsCriticalSectionLocked' as RtlIsCriticalSectionLocked:qword
    extrn '__imp_RtlIsCriticalSectionLockedByThread' as RtlIsCriticalSectionLockedByThread:qword
    extrn '__imp_RtlIsDosDeviceName_U' as RtlIsDosDeviceName_U:qword
    extrn '__imp_RtlIsGenericTableEmpty' as RtlIsGenericTableEmpty:qword
    extrn '__imp_RtlIsGenericTableEmptyAvl' as RtlIsGenericTableEmptyAvl:qword
    extrn '__imp_RtlIsNameLegalDOS8Dot3' as RtlIsNameLegalDOS8Dot3:qword
    extrn '__imp_RtlIsTextUnicode' as RtlIsTextUnicode:qword
    extrn '__imp_RtlIsThreadWithinLoaderCallout' as RtlIsThreadWithinLoaderCallout:qword
    extrn '__imp_RtlIsValidHandle' as RtlIsValidHandle:qword
    extrn '__imp_RtlIsValidIndexHandle' as RtlIsValidIndexHandle:qword
    extrn '__imp_RtlLargeIntegerToChar' as RtlLargeIntegerToChar:qword
    extrn '__imp_RtlLeaveCriticalSection' as RtlLeaveCriticalSection:qword
    extrn '__imp_RtlLengthRequiredSid' as RtlLengthRequiredSid:qword
    extrn '__imp_RtlLengthSecurityDescriptor' as RtlLengthSecurityDescriptor:qword
    extrn '__imp_RtlLengthSid' as RtlLengthSid:qword
    extrn '__imp_RtlLocalTimeToSystemTime' as RtlLocalTimeToSystemTime:qword
    extrn '__imp_RtlLockBootStatusData' as RtlLockBootStatusData:qword
    extrn '__imp_RtlLockHeap' as RtlLockHeap:qword
    extrn '__imp_RtlLockMemoryStreamRegion' as RtlLockMemoryStreamRegion:qword
    extrn '__imp_RtlLogStackBackTrace' as RtlLogStackBackTrace:qword
    extrn '__imp_RtlLookupAtomInAtomTable' as RtlLookupAtomInAtomTable:qword
    extrn '__imp_RtlLookupElementGenericTable' as RtlLookupElementGenericTable:qword
    extrn '__imp_RtlLookupElementGenericTableAvl' as RtlLookupElementGenericTableAvl:qword
    extrn '__imp_RtlLookupElementGenericTableFull' as RtlLookupElementGenericTableFull:qword
    extrn '__imp_RtlLookupElementGenericTableFullAvl' as RtlLookupElementGenericTableFullAvl:qword
    extrn '__imp_RtlLookupFunctionEntry' as RtlLookupFunctionEntry:qword
    extrn '__imp_RtlLookupFunctionTable' as RtlLookupFunctionTable:qword
    extrn '__imp_RtlMakeSelfRelativeSD' as RtlMakeSelfRelativeSD:qword
    extrn '__imp_RtlMapGenericMask' as RtlMapGenericMask:qword
    extrn '__imp_RtlMapSecurityErrorToNtStatus' as RtlMapSecurityErrorToNtStatus:qword
    extrn '__imp_RtlMoveMemory' as RtlMoveMemory:qword
    extrn '__imp_RtlMultiAppendUnicodeStringBuffer' as RtlMultiAppendUnicodeStringBuffer:qword
    extrn '__imp_RtlMultiByteToUnicodeN' as RtlMultiByteToUnicodeN:qword
    extrn '__imp_RtlMultiByteToUnicodeSize' as RtlMultiByteToUnicodeSize:qword
    extrn '__imp_RtlMultipleAllocateHeap' as RtlMultipleAllocateHeap:qword
    extrn '__imp_RtlMultipleFreeHeap' as RtlMultipleFreeHeap:qword
    extrn '__imp_RtlNewInstanceSecurityObject' as RtlNewInstanceSecurityObject:qword
    extrn '__imp_RtlNewSecurityGrantedAccess' as RtlNewSecurityGrantedAccess:qword
    extrn '__imp_RtlNewSecurityObject' as RtlNewSecurityObject:qword
    extrn '__imp_RtlNewSecurityObjectEx' as RtlNewSecurityObjectEx:qword
    extrn '__imp_RtlNewSecurityObjectWithMultipleInheritance' as RtlNewSecurityObjectWithMultipleInheritance:qword
    extrn '__imp_RtlNormalizeProcessParams' as RtlNormalizeProcessParams:qword
    extrn '__imp_RtlNtPathNameToDosPathName' as RtlNtPathNameToDosPathName:qword
    extrn '__imp_RtlNtStatusToDosError' as RtlNtStatusToDosError:qword
    extrn '__imp_RtlNtStatusToDosErrorNoTeb' as RtlNtStatusToDosErrorNoTeb:qword
    extrn '__imp_RtlNumberGenericTableElements' as RtlNumberGenericTableElements:qword
    extrn '__imp_RtlNumberGenericTableElementsAvl' as RtlNumberGenericTableElementsAvl:qword
    extrn '__imp_RtlNumberOfClearBits' as RtlNumberOfClearBits:qword
    extrn '__imp_RtlNumberOfSetBits' as RtlNumberOfSetBits:qword
    extrn '__imp_RtlOemStringToUnicodeSize' as RtlOemStringToUnicodeSize:qword
    extrn '__imp_RtlOemStringToUnicodeString' as RtlOemStringToUnicodeString:qword
    extrn '__imp_RtlOemToUnicodeN' as RtlOemToUnicodeN:qword
    extrn '__imp_RtlOpenCurrentUser' as RtlOpenCurrentUser:qword
    extrn '__imp_RtlpApplyLengthFunction' as RtlpApplyLengthFunction:qword
    extrn '__imp_RtlPcToFileHeader' as RtlPcToFileHeader:qword
    extrn '__imp_RtlpEnsureBufferSize' as RtlpEnsureBufferSize:qword
    extrn '__imp_RtlPinAtomInAtomTable' as RtlPinAtomInAtomTable:qword
    extrn '__imp_RtlpNotOwnerCriticalSection' as RtlpNotOwnerCriticalSection:qword
    extrn '__imp_RtlpNtCreateKey' as RtlpNtCreateKey:qword
    extrn '__imp_RtlpNtEnumerateSubKey' as RtlpNtEnumerateSubKey:qword
    extrn '__imp_RtlpNtMakeTemporaryKey' as RtlpNtMakeTemporaryKey:qword
    extrn '__imp_RtlpNtOpenKey' as RtlpNtOpenKey:qword
    extrn '__imp_RtlpNtQueryValueKey' as RtlpNtQueryValueKey:qword
    extrn '__imp_RtlpNtSetValueKey' as RtlpNtSetValueKey:qword
    extrn '__imp_RtlPopFrame' as RtlPopFrame:qword
    extrn '__imp_RtlPrefixString' as RtlPrefixString:qword
    extrn '__imp_RtlPrefixUnicodeString' as RtlPrefixUnicodeString:qword
    extrn '__imp_RtlProtectHeap' as RtlProtectHeap:qword
    extrn '__imp_RtlpUnWaitCriticalSection' as RtlpUnWaitCriticalSection:qword
    extrn '__imp_RtlPushFrame' as RtlPushFrame:qword
    extrn '__imp_RtlpWaitForCriticalSection' as RtlpWaitForCriticalSection:qword
    extrn '__imp_RtlQueryAtomInAtomTable' as RtlQueryAtomInAtomTable:qword
    extrn '__imp_RtlQueryDepthSList' as RtlQueryDepthSList:qword
    extrn '__imp_RtlQueryEnvironmentVariable_U' as RtlQueryEnvironmentVariable_U:qword
    extrn '__imp_RtlQueryHeapInformation' as RtlQueryHeapInformation:qword
    extrn '__imp_RtlQueryInformationAcl' as RtlQueryInformationAcl:qword
    extrn '__imp_RtlQueryInformationActivationContext' as RtlQueryInformationActivationContext:qword
    extrn '__imp_RtlQueryInformationActiveActivationContext' as RtlQueryInformationActiveActivationContext:qword
    extrn '__imp_RtlQueryInterfaceMemoryStream' as RtlQueryInterfaceMemoryStream:qword
    extrn '__imp_RtlQueryProcessBackTraceInformation' as RtlQueryProcessBackTraceInformation:qword
    extrn '__imp_RtlQueryProcessDebugInformation' as RtlQueryProcessDebugInformation:qword
    extrn '__imp_RtlQueryProcessHeapInformation' as RtlQueryProcessHeapInformation:qword
    extrn '__imp_RtlQueryProcessLockInformation' as RtlQueryProcessLockInformation:qword
    extrn '__imp_RtlQueryRegistryValues' as RtlQueryRegistryValues:qword
    extrn '__imp_RtlQuerySecurityObject' as RtlQuerySecurityObject:qword
    extrn '__imp_RtlQueryTagHeap' as RtlQueryTagHeap:qword
    extrn '__imp_RtlQueryTimeZoneInformation' as RtlQueryTimeZoneInformation:qword
    extrn '__imp_RtlQueueWorkItem' as RtlQueueWorkItem:qword
    extrn '__imp_RtlRaiseException' as RtlRaiseException:qword
    extrn '__imp_RtlRaiseStatus' as RtlRaiseStatus:qword
    extrn '__imp_RtlRandom' as RtlRandom:qword
    extrn '__imp_RtlRandomEx' as RtlRandomEx:qword
    extrn '__imp_RtlReadMemoryStream' as RtlReadMemoryStream:qword
    extrn '__imp_RtlReadOutOfProcessMemoryStream' as RtlReadOutOfProcessMemoryStream:qword
    extrn '__imp_RtlReAllocateHeap' as RtlReAllocateHeap:qword
    extrn '__imp_RtlRealPredecessor' as RtlRealPredecessor:qword
    extrn '__imp_RtlRealSuccessor' as RtlRealSuccessor:qword
    extrn '__imp_RtlRegisterSecureMemoryCacheCallback' as RtlRegisterSecureMemoryCacheCallback:qword
    extrn '__imp_RtlRegisterWait' as RtlRegisterWait:qword
    extrn '__imp_RtlReleaseActivationContext' as RtlReleaseActivationContext:qword
    extrn '__imp_RtlReleaseMemoryStream' as RtlReleaseMemoryStream:qword
    extrn '__imp_RtlReleasePebLock' as RtlReleasePebLock:qword
    extrn '__imp_RtlReleasePrivilege' as RtlReleasePrivilege:qword
    extrn '__imp_RtlReleaseRelativeName' as RtlReleaseRelativeName:qword
    extrn '__imp_RtlReleaseResource' as RtlReleaseResource:qword
    extrn '__imp_RtlRemoteCall' as RtlRemoteCall:qword
    extrn '__imp_RtlRemoveVectoredContinueHandler' as RtlRemoveVectoredContinueHandler:qword
    extrn '__imp_RtlRemoveVectoredExceptionHandler' as RtlRemoveVectoredExceptionHandler:qword
    extrn '__imp_RtlResetRtlTranslations' as RtlResetRtlTranslations:qword
    extrn '__imp_RtlRestoreContext' as RtlRestoreContext:qword
    extrn '__imp_RtlRestoreLastWin32Error' as RtlRestoreLastWin32Error:qword
    extrn '__imp_RtlRevertMemoryStream' as RtlRevertMemoryStream:qword
    extrn '__imp_RtlRunDecodeUnicodeString' as RtlRunDecodeUnicodeString:qword
    extrn '__imp_RtlRunEncodeUnicodeString' as RtlRunEncodeUnicodeString:qword
    extrn '__imp_RtlSecondsSince1970ToTime' as RtlSecondsSince1970ToTime:qword
    extrn '__imp_RtlSecondsSince1980ToTime' as RtlSecondsSince1980ToTime:qword
    extrn '__imp_RtlSeekMemoryStream' as RtlSeekMemoryStream:qword
    extrn '__imp_RtlSelfRelativeToAbsoluteSD' as RtlSelfRelativeToAbsoluteSD:qword
    extrn '__imp_RtlSelfRelativeToAbsoluteSD2' as RtlSelfRelativeToAbsoluteSD2:qword
    extrn '__imp_RtlSetAllBits' as RtlSetAllBits:qword
    extrn '__imp_RtlSetAttributesSecurityDescriptor' as RtlSetAttributesSecurityDescriptor:qword
    extrn '__imp_RtlSetBits' as RtlSetBits:qword
    extrn '__imp_RtlSetControlSecurityDescriptor' as RtlSetControlSecurityDescriptor:qword
    extrn '__imp_RtlSetCriticalSectionSpinCount' as RtlSetCriticalSectionSpinCount:qword
    extrn '__imp_RtlSetCurrentDirectory_U' as RtlSetCurrentDirectory_U:qword
    extrn '__imp_RtlSetCurrentEnvironment' as RtlSetCurrentEnvironment:qword
    extrn '__imp_RtlSetDaclSecurityDescriptor' as RtlSetDaclSecurityDescriptor:qword
    extrn '__imp_RtlSetEnvironmentStrings' as RtlSetEnvironmentStrings:qword
    extrn '__imp_RtlSetEnvironmentVariable' as RtlSetEnvironmentVariable:qword
    extrn '__imp_RtlSetGroupSecurityDescriptor' as RtlSetGroupSecurityDescriptor:qword
    extrn '__imp_RtlSetHeapInformation' as RtlSetHeapInformation:qword
    extrn '__imp_RtlSetInformationAcl' as RtlSetInformationAcl:qword
    extrn '__imp_RtlSetIoCompletionCallback' as RtlSetIoCompletionCallback:qword
    extrn '__imp_RtlSetLastWin32Error' as RtlSetLastWin32Error:qword
    extrn '__imp_RtlSetLastWin32ErrorAndNtStatusFromNtStatus' as RtlSetLastWin32ErrorAndNtStatusFromNtStatus:qword
    extrn '__imp_RtlSetMemoryStreamSize' as RtlSetMemoryStreamSize:qword
    extrn '__imp_RtlSetOwnerSecurityDescriptor' as RtlSetOwnerSecurityDescriptor:qword
    extrn '__imp_RtlSetProcessIsCritical' as RtlSetProcessIsCritical:qword
    extrn '__imp_RtlSetSaclSecurityDescriptor' as RtlSetSaclSecurityDescriptor:qword
    extrn '__imp_RtlSetSecurityDescriptorRMControl' as RtlSetSecurityDescriptorRMControl:qword
    extrn '__imp_RtlSetSecurityObject' as RtlSetSecurityObject:qword
    extrn '__imp_RtlSetSecurityObjectEx' as RtlSetSecurityObjectEx:qword
    extrn '__imp_RtlSetThreadErrorMode' as RtlSetThreadErrorMode:qword
    extrn '__imp_RtlSetThreadIsCritical' as RtlSetThreadIsCritical:qword
    extrn '__imp_RtlSetThreadPoolStartFunc' as RtlSetThreadPoolStartFunc:qword
    extrn '__imp_RtlSetTimer' as RtlSetTimer:qword
    extrn '__imp_RtlSetTimeZoneInformation' as RtlSetTimeZoneInformation:qword
    extrn '__imp_RtlSetUnhandledExceptionFilter' as RtlSetUnhandledExceptionFilter:qword
    extrn '__imp_RtlSizeHeap' as RtlSizeHeap:qword
    extrn '__imp_RtlSplay' as RtlSplay:qword
    extrn '__imp_RtlStartRXact' as RtlStartRXact:qword
    extrn '__imp_RtlStatMemoryStream' as RtlStatMemoryStream:qword
    extrn '__imp_RtlStringFromGUID' as RtlStringFromGUID:qword
    extrn '__imp_RtlSubAuthorityCountSid' as RtlSubAuthorityCountSid:qword
    extrn '__imp_RtlSubAuthoritySid' as RtlSubAuthoritySid:qword
    extrn '__imp_RtlSubtreePredecessor' as RtlSubtreePredecessor:qword
    extrn '__imp_RtlSubtreeSuccessor' as RtlSubtreeSuccessor:qword
    extrn '__imp_RtlSystemTimeToLocalTime' as RtlSystemTimeToLocalTime:qword
    extrn '__imp_RtlTimeFieldsToTime' as RtlTimeFieldsToTime:qword
    extrn '__imp_RtlTimeToElapsedTimeFields' as RtlTimeToElapsedTimeFields:qword
    extrn '__imp_RtlTimeToSecondsSince1970' as RtlTimeToSecondsSince1970:qword
    extrn '__imp_RtlTimeToSecondsSince1980' as RtlTimeToSecondsSince1980:qword
    extrn '__imp_RtlTimeToTimeFields' as RtlTimeToTimeFields:qword
    extrn '__imp_RtlTraceDatabaseAdd' as RtlTraceDatabaseAdd:qword
    extrn '__imp_RtlTraceDatabaseCreate' as RtlTraceDatabaseCreate:qword
    extrn '__imp_RtlTraceDatabaseDestroy' as RtlTraceDatabaseDestroy:qword
    extrn '__imp_RtlTraceDatabaseEnumerate' as RtlTraceDatabaseEnumerate:qword
    extrn '__imp_RtlTraceDatabaseFind' as RtlTraceDatabaseFind:qword
    extrn '__imp_RtlTraceDatabaseLock' as RtlTraceDatabaseLock:qword
    extrn '__imp_RtlTraceDatabaseUnlock' as RtlTraceDatabaseUnlock:qword
    extrn '__imp_RtlTraceDatabaseValidate' as RtlTraceDatabaseValidate:qword
    extrn '__imp_RtlTryEnterCriticalSection' as RtlTryEnterCriticalSection:qword
    extrn '__imp_RtlUnhandledExceptionFilter' as RtlUnhandledExceptionFilter:qword
    extrn '__imp_RtlUnhandledExceptionFilter2' as RtlUnhandledExceptionFilter2:qword
    extrn '__imp_RtlUnicodeStringToAnsiSize' as RtlUnicodeStringToAnsiSize:qword
    extrn '__imp_RtlUnicodeStringToAnsiString' as RtlUnicodeStringToAnsiString:qword
    extrn '__imp_RtlUnicodeStringToCountedOemString' as RtlUnicodeStringToCountedOemString:qword
    extrn '__imp_RtlUnicodeStringToInteger' as RtlUnicodeStringToInteger:qword
    extrn '__imp_RtlUnicodeStringToOemSize' as RtlUnicodeStringToOemSize:qword
    extrn '__imp_RtlUnicodeStringToOemString' as RtlUnicodeStringToOemString:qword
    extrn '__imp_RtlUnicodeToCustomCPN' as RtlUnicodeToCustomCPN:qword
    extrn '__imp_RtlUnicodeToMultiByteN' as RtlUnicodeToMultiByteN:qword
    extrn '__imp_RtlUnicodeToMultiByteSize' as RtlUnicodeToMultiByteSize:qword
    extrn '__imp_RtlUnicodeToOemN' as RtlUnicodeToOemN:qword
    extrn '__imp_RtlUniform' as RtlUniform:qword
    extrn '__imp_RtlUnlockBootStatusData' as RtlUnlockBootStatusData:qword
    extrn '__imp_RtlUnlockHeap' as RtlUnlockHeap:qword
    extrn '__imp_RtlUnlockMemoryStreamRegion' as RtlUnlockMemoryStreamRegion:qword
    extrn '__imp_RtlUnwind' as RtlUnwind:qword
    extrn '__imp_RtlUnwindEx' as RtlUnwindEx:qword
    extrn '__imp_RtlUpcaseUnicodeChar' as RtlUpcaseUnicodeChar:qword
    extrn '__imp_RtlUpcaseUnicodeString' as RtlUpcaseUnicodeString:qword
    extrn '__imp_RtlUpcaseUnicodeStringToAnsiString' as RtlUpcaseUnicodeStringToAnsiString:qword
    extrn '__imp_RtlUpcaseUnicodeStringToCountedOemString' as RtlUpcaseUnicodeStringToCountedOemString:qword
    extrn '__imp_RtlUpcaseUnicodeStringToOemString' as RtlUpcaseUnicodeStringToOemString:qword
    extrn '__imp_RtlUpcaseUnicodeToCustomCPN' as RtlUpcaseUnicodeToCustomCPN:qword
    extrn '__imp_RtlUpcaseUnicodeToMultiByteN' as RtlUpcaseUnicodeToMultiByteN:qword
    extrn '__imp_RtlUpcaseUnicodeToOemN' as RtlUpcaseUnicodeToOemN:qword
    extrn '__imp_RtlUpdateTimer' as RtlUpdateTimer:qword
    extrn '__imp_RtlUpperChar' as RtlUpperChar:qword
    extrn '__imp_RtlUpperString' as RtlUpperString:qword
    extrn '__imp_RtlValidAcl' as RtlValidAcl:qword
    extrn '__imp_RtlValidateHeap' as RtlValidateHeap:qword
    extrn '__imp_RtlValidateProcessHeaps' as RtlValidateProcessHeaps:qword
    extrn '__imp_RtlValidateUnicodeString' as RtlValidateUnicodeString:qword
    extrn '__imp_RtlValidRelativeSecurityDescriptor' as RtlValidRelativeSecurityDescriptor:qword
    extrn '__imp_RtlValidSecurityDescriptor' as RtlValidSecurityDescriptor:qword
    extrn '__imp_RtlValidSid' as RtlValidSid:qword
    extrn '__imp_RtlVerifyVersionInfo' as RtlVerifyVersionInfo:qword
    extrn '__imp_RtlVirtualUnwind' as RtlVirtualUnwind:qword
    extrn '__imp_RtlWalkFrameChain' as RtlWalkFrameChain:qword
    extrn '__imp_RtlWalkHeap' as RtlWalkHeap:qword
    extrn '__imp_RtlWow64EnableFsRedirectionEx' as RtlWow64EnableFsRedirectionEx:qword
    extrn '__imp_RtlWriteMemoryStream' as RtlWriteMemoryStream:qword
    extrn '__imp_RtlWriteRegistryValue' as RtlWriteRegistryValue:qword
    extrn '__imp_RtlxAnsiStringToUnicodeSize' as RtlxAnsiStringToUnicodeSize:qword
    extrn '__imp_RtlxOemStringToUnicodeSize' as RtlxOemStringToUnicodeSize:qword
    extrn '__imp_RtlxUnicodeStringToAnsiSize' as RtlxUnicodeStringToAnsiSize:qword
    extrn '__imp_RtlxUnicodeStringToOemSize' as RtlxUnicodeStringToOemSize:qword
    extrn '__imp_RtlZeroHeap' as RtlZeroHeap:qword
    extrn '__imp_RtlZeroMemory' as RtlZeroMemory:qword
    extrn '__imp_RtlZombifyActivationContext' as RtlZombifyActivationContext:qword
    extrn '__imp_sin' as sin:qword
    extrn '__imp_sprintf' as sprintf:qword
    extrn '__imp_sqrt' as sqrt:qword
    extrn '__imp_sscanf' as sscanf:qword
    extrn '__imp_strcat' as strcat:qword
    extrn '__imp_strchr' as strchr:qword
    extrn '__imp_strcmp' as strcmp:qword
    extrn '__imp_strcpy' as strcpy:qword
    extrn '__imp_strcspn' as strcspn:qword
    extrn '__imp_strlen' as strlen:qword
    extrn '__imp_strncat' as strncat:qword
    extrn '__imp_strncmp' as strncmp:qword
    extrn '__imp_strncpy' as strncpy:qword
    extrn '__imp_strpbrk' as strpbrk:qword
    extrn '__imp_strrchr' as strrchr:qword
    extrn '__imp_strspn' as strspn:qword
    extrn '__imp_strstr' as strstr:qword
    extrn '__imp_strtol' as strtol:qword
    extrn '__imp_strtoul' as strtoul:qword
    extrn '__imp_swprintf' as swprintf:qword
    extrn '__imp_tan' as tan:qword
    extrn '__imp_tolower' as tolower:qword
    extrn '__imp_toupper' as toupper:qword
    extrn '__imp_towlower' as towlower:qword
    extrn '__imp_towupper' as towupper:qword
    extrn '__imp_vDbgPrintEx' as vDbgPrintEx:qword
    extrn '__imp_vDbgPrintExWithPrefix' as vDbgPrintExWithPrefix:qword
    extrn '__imp_VerSetConditionMask' as VerSetConditionMask:qword
    extrn '__imp_vsprintf' as vsprintf:qword
    extrn '__imp_wcscat' as wcscat:qword
    extrn '__imp_wcschr' as wcschr:qword
    extrn '__imp_wcscmp' as wcscmp:qword
    extrn '__imp_wcscpy' as wcscpy:qword
    extrn '__imp_wcscspn' as wcscspn:qword
    extrn '__imp_wcslen' as wcslen:qword
    extrn '__imp_wcsncat' as wcsncat:qword
    extrn '__imp_wcsncmp' as wcsncmp:qword
    extrn '__imp_wcsncpy' as wcsncpy:qword
    extrn '__imp_wcspbrk' as wcspbrk:qword
    extrn '__imp_wcsrchr' as wcsrchr:qword
    extrn '__imp_wcsspn' as wcsspn:qword
    extrn '__imp_wcsstr' as wcsstr:qword
    extrn '__imp_wcstol' as wcstol:qword
    extrn '__imp_wcstombs' as wcstombs:qword
    extrn '__imp_wcstoul' as wcstoul:qword
    extrn '__imp_ZwAcceptConnectPort' as ZwAcceptConnectPort:qword
    extrn '__imp_ZwAccessCheck' as ZwAccessCheck:qword
    extrn '__imp_ZwAccessCheckAndAuditAlarm' as ZwAccessCheckAndAuditAlarm:qword
    extrn '__imp_ZwAccessCheckByType' as ZwAccessCheckByType:qword
    extrn '__imp_ZwAccessCheckByTypeAndAuditAlarm' as ZwAccessCheckByTypeAndAuditAlarm:qword
    extrn '__imp_ZwAccessCheckByTypeResultList' as ZwAccessCheckByTypeResultList:qword
    extrn '__imp_ZwAccessCheckByTypeResultListAndAuditAlarm' as ZwAccessCheckByTypeResultListAndAuditAlarm:qword
    extrn '__imp_ZwAccessCheckByTypeResultListAndAuditAlarmByHandle' as ZwAccessCheckByTypeResultListAndAuditAlarmByHandle:qword
    extrn '__imp_ZwAddAtom' as ZwAddAtom:qword
    extrn '__imp_ZwAddBootEntry' as ZwAddBootEntry:qword
    extrn '__imp_ZwAddDriverEntry' as ZwAddDriverEntry:qword
    extrn '__imp_ZwAdjustGroupsToken' as ZwAdjustGroupsToken:qword
    extrn '__imp_ZwAdjustPrivilegesToken' as ZwAdjustPrivilegesToken:qword
    extrn '__imp_ZwAlertResumeThread' as ZwAlertResumeThread:qword
    extrn '__imp_ZwAlertThread' as ZwAlertThread:qword
    extrn '__imp_ZwAllocateLocallyUniqueId' as ZwAllocateLocallyUniqueId:qword
    extrn '__imp_ZwAllocateUserPhysicalPages' as ZwAllocateUserPhysicalPages:qword
    extrn '__imp_ZwAllocateUuids' as ZwAllocateUuids:qword
    extrn '__imp_ZwAllocateVirtualMemory' as ZwAllocateVirtualMemory:qword
    extrn '__imp_ZwAreMappedFilesTheSame' as ZwAreMappedFilesTheSame:qword
    extrn '__imp_ZwAssignProcessToJobObject' as ZwAssignProcessToJobObject:qword
    extrn '__imp_ZwCallbackReturn' as ZwCallbackReturn:qword
    extrn '__imp_ZwCancelIoFile' as ZwCancelIoFile:qword
    extrn '__imp_ZwCancelTimer' as ZwCancelTimer:qword
    extrn '__imp_ZwClearEvent' as ZwClearEvent:qword
    extrn '__imp_ZwClose' as ZwClose:qword
    extrn '__imp_ZwCloseObjectAuditAlarm' as ZwCloseObjectAuditAlarm:qword
    extrn '__imp_ZwCompactKeys' as ZwCompactKeys:qword
    extrn '__imp_ZwCompareTokens' as ZwCompareTokens:qword
    extrn '__imp_ZwCompleteConnectPort' as ZwCompleteConnectPort:qword
    extrn '__imp_ZwCompressKey' as ZwCompressKey:qword
    extrn '__imp_ZwConnectPort' as ZwConnectPort:qword
    extrn '__imp_ZwContinue' as ZwContinue:qword
    extrn '__imp_ZwCreateDebugObject' as ZwCreateDebugObject:qword
    extrn '__imp_ZwCreateDirectoryObject' as ZwCreateDirectoryObject:qword
    extrn '__imp_ZwCreateEvent' as ZwCreateEvent:qword
    extrn '__imp_ZwCreateEventPair' as ZwCreateEventPair:qword
    extrn '__imp_ZwCreateFile' as ZwCreateFile:qword
    extrn '__imp_ZwCreateIoCompletion' as ZwCreateIoCompletion:qword
    extrn '__imp_ZwCreateJobObject' as ZwCreateJobObject:qword
    extrn '__imp_ZwCreateJobSet' as ZwCreateJobSet:qword
    extrn '__imp_ZwCreateKey' as ZwCreateKey:qword
    extrn '__imp_ZwCreateKeyedEvent' as ZwCreateKeyedEvent:qword
    extrn '__imp_ZwCreateMailslotFile' as ZwCreateMailslotFile:qword
    extrn '__imp_ZwCreateMutant' as ZwCreateMutant:qword
    extrn '__imp_ZwCreateNamedPipeFile' as ZwCreateNamedPipeFile:qword
    extrn '__imp_ZwCreatePagingFile' as ZwCreatePagingFile:qword
    extrn '__imp_ZwCreatePort' as ZwCreatePort:qword
    extrn '__imp_ZwCreateProcess' as ZwCreateProcess:qword
    extrn '__imp_ZwCreateProcessEx' as ZwCreateProcessEx:qword
    extrn '__imp_ZwCreateProfile' as ZwCreateProfile:qword
    extrn '__imp_ZwCreateSection' as ZwCreateSection:qword
    extrn '__imp_ZwCreateSemaphore' as ZwCreateSemaphore:qword
    extrn '__imp_ZwCreateSymbolicLinkObject' as ZwCreateSymbolicLinkObject:qword
    extrn '__imp_ZwCreateThread' as ZwCreateThread:qword
    extrn '__imp_ZwCreateTimer' as ZwCreateTimer:qword
    extrn '__imp_ZwCreateToken' as ZwCreateToken:qword
    extrn '__imp_ZwCreateWaitablePort' as ZwCreateWaitablePort:qword
    extrn '__imp_ZwDebugActiveProcess' as ZwDebugActiveProcess:qword
    extrn '__imp_ZwDebugContinue' as ZwDebugContinue:qword
    extrn '__imp_ZwDelayExecution' as ZwDelayExecution:qword
    extrn '__imp_ZwDeleteAtom' as ZwDeleteAtom:qword
    extrn '__imp_ZwDeleteBootEntry' as ZwDeleteBootEntry:qword
    extrn '__imp_ZwDeleteDriverEntry' as ZwDeleteDriverEntry:qword
    extrn '__imp_ZwDeleteFile' as ZwDeleteFile:qword
    extrn '__imp_ZwDeleteKey' as ZwDeleteKey:qword
    extrn '__imp_ZwDeleteObjectAuditAlarm' as ZwDeleteObjectAuditAlarm:qword
    extrn '__imp_ZwDeleteValueKey' as ZwDeleteValueKey:qword
    extrn '__imp_ZwDeviceIoControlFile' as ZwDeviceIoControlFile:qword
    extrn '__imp_ZwDisplayString' as ZwDisplayString:qword
    extrn '__imp_ZwDuplicateObject' as ZwDuplicateObject:qword
    extrn '__imp_ZwDuplicateToken' as ZwDuplicateToken:qword
    extrn '__imp_ZwEnumerateBootEntries' as ZwEnumerateBootEntries:qword
    extrn '__imp_ZwEnumerateDriverEntries' as ZwEnumerateDriverEntries:qword
    extrn '__imp_ZwEnumerateKey' as ZwEnumerateKey:qword
    extrn '__imp_ZwEnumerateSystemEnvironmentValuesEx' as ZwEnumerateSystemEnvironmentValuesEx:qword
    extrn '__imp_ZwEnumerateValueKey' as ZwEnumerateValueKey:qword
    extrn '__imp_ZwExtendSection' as ZwExtendSection:qword
    extrn '__imp_ZwFilterToken' as ZwFilterToken:qword
    extrn '__imp_ZwFindAtom' as ZwFindAtom:qword
    extrn '__imp_ZwFlushBuffersFile' as ZwFlushBuffersFile:qword
    extrn '__imp_ZwFlushInstructionCache' as ZwFlushInstructionCache:qword
    extrn '__imp_ZwFlushKey' as ZwFlushKey:qword
    extrn '__imp_ZwFlushVirtualMemory' as ZwFlushVirtualMemory:qword
    extrn '__imp_ZwFlushWriteBuffer' as ZwFlushWriteBuffer:qword
    extrn '__imp_ZwFreeUserPhysicalPages' as ZwFreeUserPhysicalPages:qword
    extrn '__imp_ZwFreeVirtualMemory' as ZwFreeVirtualMemory:qword
    extrn '__imp_ZwFsControlFile' as ZwFsControlFile:qword
    extrn '__imp_ZwGetCurrentProcessorNumber' as ZwGetCurrentProcessorNumber:qword
    extrn '__imp_ZwGetContextThread' as ZwGetContextThread:qword
    extrn '__imp_ZwGetDevicePowerState' as ZwGetDevicePowerState:qword
    extrn '__imp_ZwGetWriteWatch' as ZwGetWriteWatch:qword
    extrn '__imp_ZwImpersonateAnonymousToken' as ZwImpersonateAnonymousToken:qword
    extrn '__imp_ZwImpersonateClientOfPort' as ZwImpersonateClientOfPort:qword
    extrn '__imp_ZwImpersonateThread' as ZwImpersonateThread:qword
    extrn '__imp_ZwInitializeRegistry' as ZwInitializeRegistry:qword
    extrn '__imp_ZwInitiatePowerAction' as ZwInitiatePowerAction:qword
    extrn '__imp_ZwIsProcessInJob' as ZwIsProcessInJob:qword
    extrn '__imp_ZwIsSystemResumeAutomatic' as ZwIsSystemResumeAutomatic:qword
    extrn '__imp_ZwListenPort' as ZwListenPort:qword
    extrn '__imp_ZwLoadDriver' as ZwLoadDriver:qword
    extrn '__imp_ZwLoadKey' as ZwLoadKey:qword
    extrn '__imp_ZwLoadKey2' as ZwLoadKey2:qword
    extrn '__imp_ZwLoadKeyEx' as ZwLoadKeyEx:qword
    extrn '__imp_ZwLockFile' as ZwLockFile:qword
    extrn '__imp_ZwLockProductActivationKeys' as ZwLockProductActivationKeys:qword
    extrn '__imp_ZwLockRegistryKey' as ZwLockRegistryKey:qword
    extrn '__imp_ZwLockVirtualMemory' as ZwLockVirtualMemory:qword
    extrn '__imp_ZwMakePermanentObject' as ZwMakePermanentObject:qword
    extrn '__imp_ZwMakeTemporaryObject' as ZwMakeTemporaryObject:qword
    extrn '__imp_ZwMapUserPhysicalPages' as ZwMapUserPhysicalPages:qword
    extrn '__imp_ZwMapUserPhysicalPagesScatter' as ZwMapUserPhysicalPagesScatter:qword
    extrn '__imp_ZwMapViewOfSection' as ZwMapViewOfSection:qword
    extrn '__imp_ZwModifyBootEntry' as ZwModifyBootEntry:qword
    extrn '__imp_ZwModifyDriverEntry' as ZwModifyDriverEntry:qword
    extrn '__imp_ZwNotifyChangeDirectoryFile' as ZwNotifyChangeDirectoryFile:qword
    extrn '__imp_ZwNotifyChangeKey' as ZwNotifyChangeKey:qword
    extrn '__imp_ZwNotifyChangeMultipleKeys' as ZwNotifyChangeMultipleKeys:qword
    extrn '__imp_ZwOpenDirectoryObject' as ZwOpenDirectoryObject:qword
    extrn '__imp_ZwOpenEvent' as ZwOpenEvent:qword
    extrn '__imp_ZwOpenEventPair' as ZwOpenEventPair:qword
    extrn '__imp_ZwOpenFile' as ZwOpenFile:qword
    extrn '__imp_ZwOpenIoCompletion' as ZwOpenIoCompletion:qword
    extrn '__imp_ZwOpenJobObject' as ZwOpenJobObject:qword
    extrn '__imp_ZwOpenKey' as ZwOpenKey:qword
    extrn '__imp_ZwOpenKeyedEvent' as ZwOpenKeyedEvent:qword
    extrn '__imp_ZwOpenMutant' as ZwOpenMutant:qword
    extrn '__imp_ZwOpenObjectAuditAlarm' as ZwOpenObjectAuditAlarm:qword
    extrn '__imp_ZwOpenProcess' as ZwOpenProcess:qword
    extrn '__imp_ZwOpenProcessToken' as ZwOpenProcessToken:qword
    extrn '__imp_ZwOpenProcessTokenEx' as ZwOpenProcessTokenEx:qword
    extrn '__imp_ZwOpenSection' as ZwOpenSection:qword
    extrn '__imp_ZwOpenSemaphore' as ZwOpenSemaphore:qword
    extrn '__imp_ZwOpenSymbolicLinkObject' as ZwOpenSymbolicLinkObject:qword
    extrn '__imp_ZwOpenThread' as ZwOpenThread:qword
    extrn '__imp_ZwOpenThreadToken' as ZwOpenThreadToken:qword
    extrn '__imp_ZwOpenThreadTokenEx' as ZwOpenThreadTokenEx:qword
    extrn '__imp_ZwOpenTimer' as ZwOpenTimer:qword
    extrn '__imp_ZwPlugPlayControl' as ZwPlugPlayControl:qword
    extrn '__imp_ZwPowerInformation' as ZwPowerInformation:qword
    extrn '__imp_ZwPrivilegeCheck' as ZwPrivilegeCheck:qword
    extrn '__imp_ZwPrivilegedServiceAuditAlarm' as ZwPrivilegedServiceAuditAlarm:qword
    extrn '__imp_ZwPrivilegeObjectAuditAlarm' as ZwPrivilegeObjectAuditAlarm:qword
    extrn '__imp_ZwProtectVirtualMemory' as ZwProtectVirtualMemory:qword
    extrn '__imp_ZwPulseEvent' as ZwPulseEvent:qword
    extrn '__imp_ZwQueryAttributesFile' as ZwQueryAttributesFile:qword
    extrn '__imp_ZwQueryBootEntryOrder' as ZwQueryBootEntryOrder:qword
    extrn '__imp_ZwQueryBootOptions' as ZwQueryBootOptions:qword
    extrn '__imp_ZwQueryDebugFilterState' as ZwQueryDebugFilterState:qword
    extrn '__imp_ZwQueryDefaultLocale' as ZwQueryDefaultLocale:qword
    extrn '__imp_ZwQueryDefaultUILanguage' as ZwQueryDefaultUILanguage:qword
    extrn '__imp_ZwQueryDirectoryFile' as ZwQueryDirectoryFile:qword
    extrn '__imp_ZwQueryDirectoryObject' as ZwQueryDirectoryObject:qword
    extrn '__imp_ZwQueryDriverEntryOrder' as ZwQueryDriverEntryOrder:qword
    extrn '__imp_ZwQueryEaFile' as ZwQueryEaFile:qword
    extrn '__imp_ZwQueryEvent' as ZwQueryEvent:qword
    extrn '__imp_ZwQueryFullAttributesFile' as ZwQueryFullAttributesFile:qword
    extrn '__imp_ZwQueryInformationAtom' as ZwQueryInformationAtom:qword
    extrn '__imp_ZwQueryInformationFile' as ZwQueryInformationFile:qword
    extrn '__imp_ZwQueryInformationJobObject' as ZwQueryInformationJobObject:qword
    extrn '__imp_ZwQueryInformationPort' as ZwQueryInformationPort:qword
    extrn '__imp_ZwQueryInformationProcess' as ZwQueryInformationProcess:qword
    extrn '__imp_ZwQueryInformationThread' as ZwQueryInformationThread:qword
    extrn '__imp_ZwQueryInformationToken' as ZwQueryInformationToken:qword
    extrn '__imp_ZwQueryInstallUILanguage' as ZwQueryInstallUILanguage:qword
    extrn '__imp_ZwQueryIntervalProfile' as ZwQueryIntervalProfile:qword
    extrn '__imp_ZwQueryIoCompletion' as ZwQueryIoCompletion:qword
    extrn '__imp_ZwQueryKey' as ZwQueryKey:qword
    extrn '__imp_ZwQueryMultipleValueKey' as ZwQueryMultipleValueKey:qword
    extrn '__imp_ZwQueryMutant' as ZwQueryMutant:qword
    extrn '__imp_ZwQueryObject' as ZwQueryObject:qword
    extrn '__imp_ZwQueryOpenSubKeys' as ZwQueryOpenSubKeys:qword
    extrn '__imp_ZwQueryOpenSubKeysEx' as ZwQueryOpenSubKeysEx:qword
    extrn '__imp_ZwQueryPerformanceCounter' as ZwQueryPerformanceCounter:qword
    extrn '__imp_ZwQueryPortInformationProcess' as ZwQueryPortInformationProcess:qword
    extrn '__imp_ZwQueryQuotaInformationFile' as ZwQueryQuotaInformationFile:qword
    extrn '__imp_ZwQuerySection' as ZwQuerySection:qword
    extrn '__imp_ZwQuerySecurityObject' as ZwQuerySecurityObject:qword
    extrn '__imp_ZwQuerySemaphore' as ZwQuerySemaphore:qword
    extrn '__imp_ZwQuerySymbolicLinkObject' as ZwQuerySymbolicLinkObject:qword
    extrn '__imp_ZwQuerySystemEnvironmentValue' as ZwQuerySystemEnvironmentValue:qword
    extrn '__imp_ZwQuerySystemEnvironmentValueEx' as ZwQuerySystemEnvironmentValueEx:qword
    extrn '__imp_ZwQuerySystemInformation' as ZwQuerySystemInformation:qword
    extrn '__imp_ZwQuerySystemTime' as ZwQuerySystemTime:qword
    extrn '__imp_ZwQueryTimer' as ZwQueryTimer:qword
    extrn '__imp_ZwQueryTimerResolution' as ZwQueryTimerResolution:qword
    extrn '__imp_ZwQueryValueKey' as ZwQueryValueKey:qword
    extrn '__imp_ZwQueryVirtualMemory' as ZwQueryVirtualMemory:qword
    extrn '__imp_ZwQueryVolumeInformationFile' as ZwQueryVolumeInformationFile:qword
    extrn '__imp_ZwQueueApcThread' as ZwQueueApcThread:qword
    extrn '__imp_ZwRaiseException' as ZwRaiseException:qword
    extrn '__imp_ZwRaiseHardError' as ZwRaiseHardError:qword
    extrn '__imp_ZwReadFile' as ZwReadFile:qword
    extrn '__imp_ZwReadFileScatter' as ZwReadFileScatter:qword
    extrn '__imp_ZwReadRequestData' as ZwReadRequestData:qword
    extrn '__imp_ZwReadVirtualMemory' as ZwReadVirtualMemory:qword
    extrn '__imp_ZwRegisterThreadTerminatePort' as ZwRegisterThreadTerminatePort:qword
    extrn '__imp_ZwReleaseKeyedEvent' as ZwReleaseKeyedEvent:qword
    extrn '__imp_ZwReleaseMutant' as ZwReleaseMutant:qword
    extrn '__imp_ZwReleaseSemaphore' as ZwReleaseSemaphore:qword
    extrn '__imp_ZwRemoveIoCompletion' as ZwRemoveIoCompletion:qword
    extrn '__imp_ZwRemoveProcessDebug' as ZwRemoveProcessDebug:qword
    extrn '__imp_ZwRenameKey' as ZwRenameKey:qword
    extrn '__imp_ZwReplaceKey' as ZwReplaceKey:qword
    extrn '__imp_ZwReplyPort' as ZwReplyPort:qword
    extrn '__imp_ZwReplyWaitReceivePort' as ZwReplyWaitReceivePort:qword
    extrn '__imp_ZwReplyWaitReceivePortEx' as ZwReplyWaitReceivePortEx:qword
    extrn '__imp_ZwReplyWaitReplyPort' as ZwReplyWaitReplyPort:qword
    extrn '__imp_ZwRequestPort' as ZwRequestPort:qword
    extrn '__imp_ZwRequestWaitReplyPort' as ZwRequestWaitReplyPort:qword
    extrn '__imp_ZwResetEvent' as ZwResetEvent:qword
    extrn '__imp_ZwResetWriteWatch' as ZwResetWriteWatch:qword
    extrn '__imp_ZwRestoreKey' as ZwRestoreKey:qword
    extrn '__imp_ZwResumeProcess' as ZwResumeProcess:qword
    extrn '__imp_ZwResumeThread' as ZwResumeThread:qword
    extrn '__imp_ZwSaveKey' as ZwSaveKey:qword
    extrn '__imp_ZwSaveKeyEx' as ZwSaveKeyEx:qword
    extrn '__imp_ZwSaveMergedKeys' as ZwSaveMergedKeys:qword
    extrn '__imp_ZwSecureConnectPort' as ZwSecureConnectPort:qword
    extrn '__imp_ZwSetBootEntryOrder' as ZwSetBootEntryOrder:qword
    extrn '__imp_ZwSetBootOptions' as ZwSetBootOptions:qword
    extrn '__imp_ZwSetContextThread' as ZwSetContextThread:qword
    extrn '__imp_ZwSetDebugFilterState' as ZwSetDebugFilterState:qword
    extrn '__imp_ZwSetDefaultHardErrorPort' as ZwSetDefaultHardErrorPort:qword
    extrn '__imp_ZwSetDefaultLocale' as ZwSetDefaultLocale:qword
    extrn '__imp_ZwSetDefaultUILanguage' as ZwSetDefaultUILanguage:qword
    extrn '__imp_ZwSetDriverEntryOrder' as ZwSetDriverEntryOrder:qword
    extrn '__imp_ZwSetEaFile' as ZwSetEaFile:qword
    extrn '__imp_ZwSetEvent' as ZwSetEvent:qword
    extrn '__imp_ZwSetEventBoostPriority' as ZwSetEventBoostPriority:qword
    extrn '__imp_ZwSetHighEventPair' as ZwSetHighEventPair:qword
    extrn '__imp_ZwSetHighWaitLowEventPair' as ZwSetHighWaitLowEventPair:qword
    extrn '__imp_ZwSetInformationDebugObject' as ZwSetInformationDebugObject:qword
    extrn '__imp_ZwSetInformationFile' as ZwSetInformationFile:qword
    extrn '__imp_ZwSetInformationJobObject' as ZwSetInformationJobObject:qword
    extrn '__imp_ZwSetInformationKey' as ZwSetInformationKey:qword
    extrn '__imp_ZwSetInformationObject' as ZwSetInformationObject:qword
    extrn '__imp_ZwSetInformationProcess' as ZwSetInformationProcess:qword
    extrn '__imp_ZwSetInformationThread' as ZwSetInformationThread:qword
    extrn '__imp_ZwSetInformationToken' as ZwSetInformationToken:qword
    extrn '__imp_ZwSetIntervalProfile' as ZwSetIntervalProfile:qword
    extrn '__imp_ZwSetIoCompletion' as ZwSetIoCompletion:qword
    extrn '__imp_ZwSetLdtEntries' as ZwSetLdtEntries:qword
    extrn '__imp_ZwSetLowEventPair' as ZwSetLowEventPair:qword
    extrn '__imp_ZwSetLowWaitHighEventPair' as ZwSetLowWaitHighEventPair:qword
    extrn '__imp_ZwSetQuotaInformationFile' as ZwSetQuotaInformationFile:qword
    extrn '__imp_ZwSetSecurityObject' as ZwSetSecurityObject:qword
    extrn '__imp_ZwSetSystemEnvironmentValue' as ZwSetSystemEnvironmentValue:qword
    extrn '__imp_ZwSetSystemEnvironmentValueEx' as ZwSetSystemEnvironmentValueEx:qword
    extrn '__imp_ZwSetSystemInformation' as ZwSetSystemInformation:qword
    extrn '__imp_ZwSetSystemPowerState' as ZwSetSystemPowerState:qword
    extrn '__imp_ZwSetSystemTime' as ZwSetSystemTime:qword
    extrn '__imp_ZwSetThreadExecutionState' as ZwSetThreadExecutionState:qword
    extrn '__imp_ZwSetTimer' as ZwSetTimer:qword
    extrn '__imp_ZwSetTimerResolution' as ZwSetTimerResolution:qword
    extrn '__imp_ZwSetUuidSeed' as ZwSetUuidSeed:qword
    extrn '__imp_ZwSetValueKey' as ZwSetValueKey:qword
    extrn '__imp_ZwSetVolumeInformationFile' as ZwSetVolumeInformationFile:qword
    extrn '__imp_ZwShutdownSystem' as ZwShutdownSystem:qword
    extrn '__imp_ZwSignalAndWaitForSingleObject' as ZwSignalAndWaitForSingleObject:qword
    extrn '__imp_ZwStartProfile' as ZwStartProfile:qword
    extrn '__imp_ZwStopProfile' as ZwStopProfile:qword
    extrn '__imp_ZwSuspendProcess' as ZwSuspendProcess:qword
    extrn '__imp_ZwSuspendThread' as ZwSuspendThread:qword
    extrn '__imp_ZwSystemDebugControl' as ZwSystemDebugControl:qword
    extrn '__imp_ZwTerminateJobObject' as ZwTerminateJobObject:qword
    extrn '__imp_ZwTerminateProcess' as ZwTerminateProcess:qword
    extrn '__imp_ZwTerminateThread' as ZwTerminateThread:qword
    extrn '__imp_ZwTestAlert' as ZwTestAlert:qword
    extrn '__imp_ZwTraceEvent' as ZwTraceEvent:qword
    extrn '__imp_ZwTranslateFilePath' as ZwTranslateFilePath:qword
    extrn '__imp_ZwUnloadDriver' as ZwUnloadDriver:qword
    extrn '__imp_ZwUnloadKey' as ZwUnloadKey:qword
    extrn '__imp_ZwUnloadKey2' as ZwUnloadKey2:qword
    extrn '__imp_ZwUnloadKeyEx' as ZwUnloadKeyEx:qword
    extrn '__imp_ZwUnlockFile' as ZwUnlockFile:qword
    extrn '__imp_ZwUnlockVirtualMemory' as ZwUnlockVirtualMemory:qword
    extrn '__imp_ZwUnmapViewOfSection' as ZwUnmapViewOfSection:qword
    extrn '__imp_ZwVdmControl' as ZwVdmControl:qword
    extrn '__imp_ZwWaitForDebugEvent' as ZwWaitForDebugEvent:qword
    extrn '__imp_ZwWaitForKeyedEvent' as ZwWaitForKeyedEvent:qword
    extrn '__imp_ZwWaitForMultipleObjects' as ZwWaitForMultipleObjects:qword
    extrn '__imp_ZwWaitForMultipleObjects32' as ZwWaitForMultipleObjects32:qword
    extrn '__imp_ZwWaitForSingleObject' as ZwWaitForSingleObject:qword
    extrn '__imp_ZwWaitHighEventPair' as ZwWaitHighEventPair:qword
    extrn '__imp_ZwWaitLowEventPair' as ZwWaitLowEventPair:qword
    extrn '__imp_ZwWriteFile' as ZwWriteFile:qword
    extrn '__imp_ZwWriteFileGather' as ZwWriteFileGather:qword
    extrn '__imp_ZwWriteRequestData' as ZwWriteRequestData:qword
    extrn '__imp_ZwWriteVirtualMemory' as ZwWriteVirtualMemory:qword
    extrn '__imp_ZwYieldExecution' as ZwYieldExecution:qword
    if (NTDDI_VERSION >= NTDDI_VISTA)
        extrn '__imp_A_SHAFinal' as A_SHAFinal:qword
        extrn '__imp_A_SHAInit' as A_SHAInit:qword
        extrn '__imp_A_SHAUpdate' as A_SHAUpdate:qword
        extrn '__imp_AlpcAdjustCompletionListConcurrencyCount' as AlpcAdjustCompletionListConcurrencyCount:qword
        extrn '__imp_AlpcFreeCompletionListMessage' as AlpcFreeCompletionListMessage:qword
        extrn '__imp_AlpcGetCompletionListLastMessageInformation' as AlpcGetCompletionListLastMessageInformation:qword
        extrn '__imp_AlpcGetCompletionListMessageAttributes' as AlpcGetCompletionListMessageAttributes:qword
        extrn '__imp_AlpcGetHeaderSize' as AlpcGetHeaderSize:qword
        extrn '__imp_AlpcGetMessageAttribute' as AlpcGetMessageAttribute:qword
        extrn '__imp_AlpcGetMessageFromCompletionList' as AlpcGetMessageFromCompletionList:qword
        extrn '__imp_AlpcGetOutstandingCompletionListMessageCount' as AlpcGetOutstandingCompletionListMessageCount:qword
        extrn '__imp_AlpcInitializeMessageAttribute' as AlpcInitializeMessageAttribute:qword
        extrn '__imp_AlpcMaxAllowedMessageLength' as AlpcMaxAllowedMessageLength:qword
        extrn '__imp_AlpcRegisterCompletionList' as AlpcRegisterCompletionList:qword
        extrn '__imp_AlpcRegisterCompletionListWorkerThread' as AlpcRegisterCompletionListWorkerThread:qword
        extrn '__imp_AlpcRundownCompletionList' as AlpcRundownCompletionList:qword
        extrn '__imp_AlpcUnregisterCompletionList' as AlpcUnregisterCompletionList:qword
        extrn '__imp_AlpcUnregisterCompletionListWorkerThread' as AlpcUnregisterCompletionListWorkerThread:qword
        extrn '__imp_CsrVerifyRegion' as CsrVerifyRegion:qword
        extrn '__imp_EtwDeliverDataBlock' as EtwDeliverDataBlock:qword
        extrn '__imp_EtwEnumerateProcessRegGuids' as EtwEnumerateProcessRegGuids:qword
        extrn '__imp_EtwEventActivityIdControl' as EtwEventActivityIdControl:qword
        extrn '__imp_EtwEventEnabled' as EtwEventEnabled:qword
        extrn '__imp_EtwEventProviderEnabled' as EtwEventProviderEnabled:qword
        extrn '__imp_EtwEventRegister' as EtwEventRegister:qword
        extrn '__imp_EtwEventUnregister' as EtwEventUnregister:qword
        extrn '__imp_EtwEventWrite' as EtwEventWrite:qword
        extrn '__imp_EtwEventWriteEndScenario' as EtwEventWriteEndScenario:qword
        extrn '__imp_EtwEventWriteFull' as EtwEventWriteFull:qword
        extrn '__imp_EtwEventWriteStartScenario' as EtwEventWriteStartScenario:qword
        extrn '__imp_EtwEventWriteString' as EtwEventWriteString:qword
        extrn '__imp_EtwEventWriteTransfer' as EtwEventWriteTransfer:qword
        extrn '__imp_EtwLogTraceEvent' as EtwLogTraceEvent:qword
        extrn '__imp_EtwNotificationRegister' as EtwNotificationRegister:qword
        extrn '__imp_EtwNotificationUnregister' as EtwNotificationUnregister:qword
        extrn '__imp_EtwProcessPrivateLoggerRequest' as EtwProcessPrivateLoggerRequest:qword
        extrn '__imp_EtwRegisterSecurityProvider' as EtwRegisterSecurityProvider:qword
        extrn '__imp_EtwReplyNotification' as EtwReplyNotification:qword
        extrn '__imp_EtwSendNotification' as EtwSendNotification:qword
        extrn '__imp_EtwSetMark' as EtwSetMark:qword
        extrn '__imp_EtwTraceEventInstance' as EtwTraceEventInstance:qword
        extrn '__imp_EtwWriteUMSecurityEvent' as EtwWriteUMSecurityEvent:qword
        extrn '__imp_EtwpCreateEtwThread' as EtwpCreateEtwThread:qword
        extrn '__imp_EtwpGetCpuSpeed' as EtwpGetCpuSpeed:qword
        extrn '__imp_LdrAddLoadAsDataTable' as LdrAddLoadAsDataTable:qword
        extrn '__imp_LdrGetFailureData' as LdrGetFailureData:qword
        extrn '__imp_LdrGetFileNameFromLoadAsDataTable' as LdrGetFileNameFromLoadAsDataTable:qword
        extrn '__imp_LdrGetProcedureAddressEx' as LdrGetProcedureAddressEx:qword
        extrn '__imp_LdrLoadAlternateResourceModuleEx' as LdrLoadAlternateResourceModuleEx:qword
        extrn '__imp_LdrQueryModuleServiceTags' as LdrQueryModuleServiceTags:qword
        extrn '__imp_LdrRegisterDllNotification' as LdrRegisterDllNotification:qword
        extrn '__imp_LdrRemoveLoadAsDataTable' as LdrRemoveLoadAsDataTable:qword
        extrn '__imp_LdrResFindResource' as LdrResFindResource:qword
        extrn '__imp_LdrResFindResourceDirectory' as LdrResFindResourceDirectory:qword
        extrn '__imp_LdrResRelease' as LdrResRelease:qword
        extrn '__imp_LdrResSearchResource' as LdrResSearchResource:qword
        extrn '__imp_LdrSetMUICacheType' as LdrSetMUICacheType:qword
        extrn '__imp_LdrUnloadAlternateResourceModuleEx' as LdrUnloadAlternateResourceModuleEx:qword
        extrn '__imp_LdrUnregisterDllNotification' as LdrUnregisterDllNotification:qword
        extrn '__imp_LdrVerifyImageMatchesChecksumEx' as LdrVerifyImageMatchesChecksumEx:qword
        extrn '__imp_LdrpResGetMappingSize' as LdrpResGetMappingSize:qword
        extrn '__imp_LdrpResGetResourceDirectory' as LdrpResGetResourceDirectory:qword
        extrn '__imp_MD4Final' as MD4Final:qword
        extrn '__imp_MD4Init' as MD4Init:qword
        extrn '__imp_MD4Update' as MD4Update:qword
        extrn '__imp_MD5Final' as MD5Final:qword
        extrn '__imp_MD5Init' as MD5Init:qword
        extrn '__imp_MD5Update' as MD5Update:qword
        extrn '__imp_NtAlpcAcceptConnectPort' as NtAlpcAcceptConnectPort:qword
        extrn '__imp_NtAlpcCancelMessage' as NtAlpcCancelMessage:qword
        extrn '__imp_NtAlpcConnectPort' as NtAlpcConnectPort:qword
        extrn '__imp_NtAlpcCreatePort' as NtAlpcCreatePort:qword
        extrn '__imp_NtAlpcCreatePortSection' as NtAlpcCreatePortSection:qword
        extrn '__imp_NtAlpcCreateResourceReserve' as NtAlpcCreateResourceReserve:qword
        extrn '__imp_NtAlpcCreateSectionView' as NtAlpcCreateSectionView:qword
        extrn '__imp_NtAlpcCreateSecurityContext' as NtAlpcCreateSecurityContext:qword
        extrn '__imp_NtAlpcDeletePortSection' as NtAlpcDeletePortSection:qword
        extrn '__imp_NtAlpcDeleteResourceReserve' as NtAlpcDeleteResourceReserve:qword
        extrn '__imp_NtAlpcDeleteSectionView' as NtAlpcDeleteSectionView:qword
        extrn '__imp_NtAlpcDeleteSecurityContext' as NtAlpcDeleteSecurityContext:qword
        extrn '__imp_NtAlpcDisconnectPort' as NtAlpcDisconnectPort:qword
        extrn '__imp_NtAlpcImpersonateClientOfPort' as NtAlpcImpersonateClientOfPort:qword
        extrn '__imp_NtAlpcOpenSenderProcess' as NtAlpcOpenSenderProcess:qword
        extrn '__imp_NtAlpcOpenSenderThread' as NtAlpcOpenSenderThread:qword
        extrn '__imp_NtAlpcQueryInformation' as NtAlpcQueryInformation:qword
        extrn '__imp_NtAlpcQueryInformationMessage' as NtAlpcQueryInformationMessage:qword
        extrn '__imp_NtAlpcRevokeSecurityContext' as NtAlpcRevokeSecurityContext:qword
        extrn '__imp_NtAlpcSendWaitReceivePort' as NtAlpcSendWaitReceivePort:qword
        extrn '__imp_NtAlpcSetInformation' as NtAlpcSetInformation:qword
        extrn '__imp_NtCancelIoFileEx' as NtCancelIoFileEx:qword
        extrn '__imp_NtCancelSynchronousIoFile' as NtCancelSynchronousIoFile:qword
        extrn '__imp_NtCommitComplete' as NtCommitComplete:qword
        extrn '__imp_NtCommitEnlistment' as NtCommitEnlistment:qword
        extrn '__imp_NtCommitTransaction' as NtCommitTransaction:qword
        extrn '__imp_NtCreateEnlistment' as NtCreateEnlistment:qword
        extrn '__imp_NtCreateKeyTransacted' as NtCreateKeyTransacted:qword
        extrn '__imp_NtCreatePrivateNamespace' as NtCreatePrivateNamespace:qword
        extrn '__imp_NtCreateResourceManager' as NtCreateResourceManager:qword
        extrn '__imp_NtCreateThreadEx' as NtCreateThreadEx:qword
        extrn '__imp_NtCreateTransaction' as NtCreateTransaction:qword
        extrn '__imp_NtCreateTransactionManager' as NtCreateTransactionManager:qword
        extrn '__imp_NtCreateUserProcess' as NtCreateUserProcess:qword
        extrn '__imp_NtCreateWorkerFactory' as NtCreateWorkerFactory:qword
        extrn '__imp_NtDeletePrivateNamespace' as NtDeletePrivateNamespace:qword
        extrn '__imp_NtEnumerateTransactionObject' as NtEnumerateTransactionObject:qword
        extrn '__imp_NtFlushInstallUILanguage' as NtFlushInstallUILanguage:qword
        extrn '__imp_NtFlushProcessWriteBuffers' as NtFlushProcessWriteBuffers:qword
        extrn '__imp_NtFreezeRegistry' as NtFreezeRegistry:qword
        extrn '__imp_NtFreezeTransactions' as NtFreezeTransactions:qword
        extrn '__imp_NtGetMUIRegistryInfo' as NtGetMUIRegistryInfo:qword
        extrn '__imp_NtGetNextProcess' as NtGetNextProcess:qword
        extrn '__imp_NtGetNextThread' as NtGetNextThread:qword
        extrn '__imp_NtGetNlsSectionPtr' as NtGetNlsSectionPtr:qword
        extrn '__imp_NtGetNotificationResourceManager' as NtGetNotificationResourceManager:qword
        extrn '__imp_NtInitializeNlsFiles' as NtInitializeNlsFiles:qword
        extrn '__imp_NtIsUILanguageComitted' as NtIsUILanguageComitted:qword
        extrn '__imp_NtMapCMFModule' as NtMapCMFModule:qword
        extrn '__imp_NtOpenEnlistment' as NtOpenEnlistment:qword
        extrn '__imp_NtOpenKeyTransacted' as NtOpenKeyTransacted:qword
        extrn '__imp_NtOpenPrivateNamespace' as NtOpenPrivateNamespace:qword
        extrn '__imp_NtOpenResourceManager' as NtOpenResourceManager:qword
        extrn '__imp_NtOpenSession' as NtOpenSession:qword
        extrn '__imp_NtOpenTransaction' as NtOpenTransaction:qword
        extrn '__imp_NtOpenTransactionManager' as NtOpenTransactionManager:qword
        extrn '__imp_NtPrePrepareComplete' as NtPrePrepareComplete:qword
        extrn '__imp_NtPrePrepareEnlistment' as NtPrePrepareEnlistment:qword
        extrn '__imp_NtPrepareComplete' as NtPrepareComplete:qword
        extrn '__imp_NtPrepareEnlistment' as NtPrepareEnlistment:qword
        extrn '__imp_NtPropagationComplete' as NtPropagationComplete:qword
        extrn '__imp_NtPropagationFailed' as NtPropagationFailed:qword
        extrn '__imp_NtQueryInformationEnlistment' as NtQueryInformationEnlistment:qword
        extrn '__imp_NtQueryInformationResourceManager' as NtQueryInformationResourceManager:qword
        extrn '__imp_NtQueryInformationTransaction' as NtQueryInformationTransaction:qword
        extrn '__imp_NtQueryInformationTransactionManager' as NtQueryInformationTransactionManager:qword
        extrn '__imp_NtQueryInformationWorkerFactory' as NtQueryInformationWorkerFactory:qword
        extrn '__imp_NtQueryLicenseValue' as NtQueryLicenseValue:qword
        extrn '__imp_NtReadOnlyEnlistment' as NtReadOnlyEnlistment:qword
        extrn '__imp_NtRecoverEnlistment' as NtRecoverEnlistment:qword
        extrn '__imp_NtRecoverResourceManager' as NtRecoverResourceManager:qword
        extrn '__imp_NtRecoverTransactionManager' as NtRecoverTransactionManager:qword
        extrn '__imp_NtRegisterProtocolAddressInformation' as NtRegisterProtocolAddressInformation:qword
        extrn '__imp_NtReleaseWorkerFactoryWorker' as NtReleaseWorkerFactoryWorker:qword
        extrn '__imp_NtRemoveIoCompletionEx' as NtRemoveIoCompletionEx:qword
        extrn '__imp_NtRenameTransactionManager' as NtRenameTransactionManager:qword
        extrn '__imp_NtReplacePartitionUnit' as NtReplacePartitionUnit:qword
        extrn '__imp_NtRollbackComplete' as NtRollbackComplete:qword
        extrn '__imp_NtRollbackEnlistment' as NtRollbackEnlistment:qword
        extrn '__imp_NtRollbackTransaction' as NtRollbackTransaction:qword
        extrn '__imp_NtRollforwardTransactionManager' as NtRollforwardTransactionManager:qword
        extrn '__imp_NtSetInformationEnlistment' as NtSetInformationEnlistment:qword
        extrn '__imp_NtSetInformationResourceManager' as NtSetInformationResourceManager:qword
        extrn '__imp_NtSetInformationTransaction' as NtSetInformationTransaction:qword
        extrn '__imp_NtSetInformationTransactionManager' as NtSetInformationTransactionManager:qword
        extrn '__imp_NtSetInformationWorkerFactory' as NtSetInformationWorkerFactory:qword
        extrn '__imp_NtShutdownWorkerFactory' as NtShutdownWorkerFactory:qword
        extrn '__imp_NtSinglePhaseReject' as NtSinglePhaseReject:qword
        extrn '__imp_NtThawRegistry' as NtThawRegistry:qword
        extrn '__imp_NtThawTransactions' as NtThawTransactions:qword
        extrn '__imp_NtTraceControl' as NtTraceControl:qword
        extrn '__imp_NtWaitForWorkViaWorkerFactory' as NtWaitForWorkViaWorkerFactory:qword
        extrn '__imp_NtWorkerFactoryWorkerReady' as NtWorkerFactoryWorkerReady:qword
        extrn '__imp_NtdllDefWindowProc_A' as NtdllDefWindowProc_A:qword
        extrn '__imp_NtdllDefWindowProc_W' as NtdllDefWindowProc_W:qword
        extrn '__imp_NtdllDialogWndProc_A' as NtdllDialogWndProc_A:qword
        extrn '__imp_NtdllDialogWndProc_W' as NtdllDialogWndProc_W:qword
        extrn '__imp_RtlAcquireSRWLockExclusive' as RtlAcquireSRWLockExclusive:qword
        extrn '__imp_RtlAcquireSRWLockShared' as RtlAcquireSRWLockShared:qword
        extrn '__imp_RtlAddMandatoryAce' as RtlAddMandatoryAce:qword
        extrn '__imp_RtlAddSIDToBoundaryDescriptor' as RtlAddSIDToBoundaryDescriptor:qword
        extrn '__imp_RtlAllocateMemoryBlockLookaside' as RtlAllocateMemoryBlockLookaside:qword
        extrn '__imp_RtlAllocateMemoryZone' as RtlAllocateMemoryZone:qword
        extrn '__imp_RtlBarrier' as RtlBarrier:qword
        extrn '__imp_RtlBarrierForDelete' as RtlBarrierForDelete:qword
        extrn '__imp_RtlCleanUpTEBLangLists' as RtlCleanUpTEBLangLists:qword
        extrn '__imp_RtlCloneUserProcess' as RtlCloneUserProcess:qword
        extrn '__imp_RtlCmDecodeMemIoResource' as RtlCmDecodeMemIoResource:qword
        extrn '__imp_RtlCmEncodeMemIoResource' as RtlCmEncodeMemIoResource:qword
        extrn '__imp_RtlCommitDebugInfo' as RtlCommitDebugInfo:qword
        extrn '__imp_RtlCompareAltitudes' as RtlCompareAltitudes:qword
        extrn '__imp_RtlCompareUnicodeStrings' as RtlCompareUnicodeStrings:qword
        extrn '__imp_RtlConnectToSm' as RtlConnectToSm:qword
        extrn '__imp_RtlConvertLCIDToString' as RtlConvertLCIDToString:qword
        extrn '__imp_RtlCreateBoundaryDescriptor' as RtlCreateBoundaryDescriptor:qword
        extrn '__imp_RtlCreateEnvironmentEx' as RtlCreateEnvironmentEx:qword
        extrn '__imp_RtlCreateMemoryBlockLookaside' as RtlCreateMemoryBlockLookaside:qword
        extrn '__imp_RtlCreateMemoryZone' as RtlCreateMemoryZone:qword
        extrn '__imp_RtlCreateProcessParametersEx' as RtlCreateProcessParametersEx:qword
        extrn '__imp_RtlCreateUserStack' as RtlCreateUserStack:qword
        extrn '__imp_RtlCultureNameToLCID' as RtlCultureNameToLCID:qword
        extrn '__imp_RtlDeCommitDebugInfo' as RtlDeCommitDebugInfo:qword
        extrn '__imp_RtlDeleteBarrier' as RtlDeleteBarrier:qword
        extrn '__imp_RtlDeleteBoundaryDescriptor' as RtlDeleteBoundaryDescriptor:qword
        extrn '__imp_RtlDeregisterSecureMemoryCacheCallback' as RtlDeregisterSecureMemoryCacheCallback:qword
        extrn '__imp_RtlDestroyMemoryBlockLookaside' as RtlDestroyMemoryBlockLookaside:qword
        extrn '__imp_RtlDestroyMemoryZone' as RtlDestroyMemoryZone:qword
        extrn '__imp_RtlExitUserProcess' as RtlExitUserProcess:qword
        extrn '__imp_RtlExpandEnvironmentStrings' as RtlExpandEnvironmentStrings:qword
        extrn '__imp_RtlExtendMemoryBlockLookaside' as RtlExtendMemoryBlockLookaside:qword
        extrn '__imp_RtlExtendMemoryZone' as RtlExtendMemoryZone:qword
        extrn '__imp_RtlFindAceByType' as RtlFindAceByType:qword
        extrn '__imp_RtlFindClosestEncodableLength' as RtlFindClosestEncodableLength:qword
        extrn '__imp_RtlFlsAlloc' as RtlFlsAlloc:qword
        extrn '__imp_RtlFlsFree' as RtlFlsFree:qword
        extrn '__imp_RtlFreeMemoryBlockLookaside' as RtlFreeMemoryBlockLookaside:qword
        extrn '__imp_RtlFreeUserStack' as RtlFreeUserStack:qword
        extrn '__imp_RtlGetCurrentTransaction' as RtlGetCurrentTransaction:qword
        extrn '__imp_RtlGetFileMUIPath' as RtlGetFileMUIPath:qword
        extrn '__imp_RtlGetIntegerAtom' as RtlGetIntegerAtom:qword
        extrn '__imp_RtlGetParentLocaleName' as RtlGetParentLocaleName:qword
        extrn '__imp_RtlGetProductInfo' as RtlGetProductInfo:qword
        extrn '__imp_RtlGetSystemPreferredUILanguages' as RtlGetSystemPreferredUILanguages:qword
        extrn '__imp_RtlGetThreadLangIdByIndex' as RtlGetThreadLangIdByIndex:qword
        extrn '__imp_RtlGetThreadPreferredUILanguages' as RtlGetThreadPreferredUILanguages:qword
        extrn '__imp_RtlGetUILanguageInfo' as RtlGetUILanguageInfo:qword
        extrn '__imp_RtlGetUnloadEventTraceEx' as RtlGetUnloadEventTraceEx:qword
        extrn '__imp_RtlGetUserPreferredUILanguages' as RtlGetUserPreferredUILanguages:qword
        extrn '__imp_RtlHeapTrkInitialize' as RtlHeapTrkInitialize:qword
        extrn '__imp_RtlIdnToAscii' as RtlIdnToAscii:qword
        extrn '__imp_RtlIdnToNameprepUnicode' as RtlIdnToNameprepUnicode:qword
        extrn '__imp_RtlIdnToUnicode' as RtlIdnToUnicode:qword
        extrn '__imp_RtlImpersonateSelfEx' as RtlImpersonateSelfEx:qword
        extrn '__imp_RtlInitBarrier' as RtlInitBarrier:qword
        extrn '__imp_RtlInitializeConditionVariable' as RtlInitializeConditionVariable:qword
        extrn '__imp_RtlInitializeCriticalSectionEx' as RtlInitializeCriticalSectionEx:qword
        extrn '__imp_RtlInitializeNtUserPfn' as RtlInitializeNtUserPfn:qword
        extrn '__imp_RtlInitializeSRWLock' as RtlInitializeSRWLock:qword
        extrn '__imp_RtlIoDecodeMemIoResource' as RtlIoDecodeMemIoResource:qword
        extrn '__imp_RtlIoEncodeMemIoResource' as RtlIoEncodeMemIoResource:qword
        extrn '__imp_RtlIsCurrentThreadAttachExempt' as RtlIsCurrentThreadAttachExempt:qword
        extrn '__imp_RtlIsNormalizedString' as RtlIsNormalizedString:qword
        extrn '__imp_RtlIsValidLocaleName' as RtlIsValidLocaleName:qword
        extrn '__imp_RtlLCIDToCultureName' as RtlLCIDToCultureName:qword
        extrn '__imp_RtlLcidToLocaleName' as RtlLcidToLocaleName:qword
        extrn '__imp_RtlLocaleNameToLcid' as RtlLocaleNameToLcid:qword
        extrn '__imp_RtlLockCurrentThread' as RtlLockCurrentThread:qword
        extrn '__imp_RtlLockMemoryBlockLookaside' as RtlLockMemoryBlockLookaside:qword
        extrn '__imp_RtlLockMemoryZone' as RtlLockMemoryZone:qword
        extrn '__imp_RtlLockModuleSection' as RtlLockModuleSection:qword
        extrn '__imp_RtlNormalizeString' as RtlNormalizeString:qword
        extrn '__imp_RtlNumberOfSetBitsUlongPtr' as RtlNumberOfSetBitsUlongPtr:qword
        extrn '__imp_RtlOwnerAcesPresent' as RtlOwnerAcesPresent:qword
        extrn '__imp_RtlProcessFlsData' as RtlProcessFlsData:qword
        extrn '__imp_RtlQueryActivationContextApplicationSettings' as RtlQueryActivationContextApplicationSettings:qword
        extrn '__imp_RtlQueryDynamicTimeZoneInformation' as RtlQueryDynamicTimeZoneInformation:qword
        extrn '__imp_RtlQueryElevationFlags' as RtlQueryElevationFlags:qword
        extrn '__imp_RtlQueryEnvironmentVariable' as RtlQueryEnvironmentVariable:qword
        extrn '__imp_RtlQueryModuleInformation' as RtlQueryModuleInformation:qword
        extrn '__imp_RtlRegisterThreadWithCsrss' as RtlRegisterThreadWithCsrss:qword
        extrn '__imp_RtlReleaseSRWLockExclusive' as RtlReleaseSRWLockExclusive:qword
        extrn '__imp_RtlReleaseSRWLockShared' as RtlReleaseSRWLockShared:qword
        extrn '__imp_RtlRemovePrivileges' as RtlRemovePrivileges:qword
        extrn '__imp_RtlReportException' as RtlReportException:qword
        extrn '__imp_RtlResetMemoryBlockLookaside' as RtlResetMemoryBlockLookaside:qword
        extrn '__imp_RtlResetMemoryZone' as RtlResetMemoryZone:qword
        extrn '__imp_RtlRetrieveNtUserPfn' as RtlRetrieveNtUserPfn:qword
        extrn '__imp_RtlRunOnceBeginInitialize' as RtlRunOnceBeginInitialize:qword
        extrn '__imp_RtlRunOnceComplete' as RtlRunOnceComplete:qword
        extrn '__imp_RtlRunOnceExecuteOnce' as RtlRunOnceExecuteOnce:qword
        extrn '__imp_RtlRunOnceInitialize' as RtlRunOnceInitialize:qword
        extrn '__imp_RtlSendMsgToSm' as RtlSendMsgToSm:qword
        extrn '__imp_RtlSetCurrentTransaction' as RtlSetCurrentTransaction:qword
        extrn '__imp_RtlSetDynamicTimeZoneInformation' as RtlSetDynamicTimeZoneInformation:qword
        extrn '__imp_RtlSetEnvironmentVar' as RtlSetEnvironmentVar:qword
        extrn '__imp_RtlSetProcessDebugInformation' as RtlSetProcessDebugInformation:qword
        extrn '__imp_RtlSetThreadPreferredUILanguages' as RtlSetThreadPreferredUILanguages:qword
        extrn '__imp_RtlSetUserFlagsHeap' as RtlSetUserFlagsHeap:qword
        extrn '__imp_RtlSetUserValueHeap' as RtlSetUserValueHeap:qword
        extrn '__imp_RtlSidDominates' as RtlSidDominates:qword
        extrn '__imp_RtlSidequalLevel' as RtlSidequalLevel:qword
        extrn '__imp_RtlSidHashInitialize' as RtlSidHashInitialize:qword
        extrn '__imp_RtlSidHashLookup' as RtlSidHashLookup:qword
        extrn '__imp_RtlSidIsHigherLevel' as RtlSidIsHigherLevel:qword
        extrn '__imp_RtlSleepConditionVariableCS' as RtlSleepConditionVariableCS:qword
        extrn '__imp_RtlSleepConditionVariableSRW' as RtlSleepConditionVariableSRW:qword
        extrn '__imp_RtlTestBit' as RtlTestBit:qword
        extrn '__imp_RtlTryAcquirePebLock' as RtlTryAcquirePebLock:qword
        extrn '__imp_RtlUnlockCurrentThread' as RtlUnlockCurrentThread:qword
        extrn '__imp_RtlUnlockMemoryBlockLookaside' as RtlUnlockMemoryBlockLookaside:qword
        extrn '__imp_RtlUnlockMemoryZone' as RtlUnlockMemoryZone:qword
        extrn '__imp_RtlUnlockModuleSection' as RtlUnlockModuleSection:qword
        extrn '__imp_RtlUpdateClonedCriticalSection' as RtlUpdateClonedCriticalSection:qword
        extrn '__imp_RtlUpdateClonedSRWLock' as RtlUpdateClonedSRWLock:qword
        extrn '__imp_RtlUserThreadStart' as RtlUserThreadStart:qword
        extrn '__imp_RtlWakeAllConditionVariable' as RtlWakeAllConditionVariable:qword
        extrn '__imp_RtlWakeConditionVariable' as RtlWakeConditionVariable:qword
        extrn '__imp_RtlWerpReportException' as RtlWerpReportException:qword
        extrn '__imp_RtlWow64CallFunction64' as RtlWow64CallFunction64:qword
        extrn '__imp_RtlWow64EnableFsRedirection' as RtlWow64EnableFsRedirection:qword
        extrn '__imp_RtlpCheckDynamicTimeZoneInformation' as RtlpCheckDynamicTimeZoneInformation:qword
        extrn '__imp_RtlpCleanupRegistryKeys' as RtlpCleanupRegistryKeys:qword
        extrn '__imp_RtlpConvertCultureNamesToLCIDs' as RtlpConvertCultureNamesToLCIDs:qword
        extrn '__imp_RtlpConvertLCIDsToCultureNames' as RtlpConvertLCIDsToCultureNames:qword
        extrn '__imp_RtlpCreateProcessRegistryInfo' as RtlpCreateProcessRegistryInfo:qword
        extrn '__imp_RtlpGetLCIDFromLangInfoNode' as RtlpGetLCIDFromLangInfoNode:qword
        extrn '__imp_RtlpGetNameFromLangInfoNode' as RtlpGetNameFromLangInfoNode:qword
        extrn '__imp_RtlpGetSystemDefaultUILanguage' as RtlpGetSystemDefaultUILanguage:qword
        extrn '__imp_RtlpGetUserOrMachineUILanguage4NLS' as RtlpGetUserOrMachineUILanguage4NLS:qword
        extrn '__imp_RtlpInitializeLangRegistryInfo' as RtlpInitializeLangRegistryInfo:qword
        extrn '__imp_RtlpIsQualifiedLanguage' as RtlpIsQualifiedLanguage:qword
        extrn '__imp_RtlpLoadMachineUIByPolicy' as RtlpLoadMachineUIByPolicy:qword
        extrn '__imp_RtlpLoadUserUIByPolicy' as RtlpLoadUserUIByPolicy:qword
        extrn '__imp_RtlpMuiFreeLangRegistryInfo' as RtlpMuiFreeLangRegistryInfo:qword
        extrn '__imp_RtlpMuiRegCreateRegistryInfo' as RtlpMuiRegCreateRegistryInfo:qword
        extrn '__imp_RtlpMuiRegFreeRegistryInfo' as RtlpMuiRegFreeRegistryInfo:qword
        extrn '__imp_RtlpMuiRegLoadRegistryInfo' as RtlpMuiRegLoadRegistryInfo:qword
        extrn '__imp_RtlpQueryDefaultUILanguage' as RtlpQueryDefaultUILanguage:qword
        extrn '__imp_RtlpRefreshCachedUILanguage' as RtlpRefreshCachedUILanguage:qword
        extrn '__imp_RtlpSetInstallLanguage' as RtlpSetInstallLanguage:qword
        extrn '__imp_RtlpSetPreferredUILanguages' as RtlpSetPreferredUILanguages:qword
        extrn '__imp_RtlpSetUserPreferredUILanguages' as RtlpSetUserPreferredUILanguages:qword
        extrn '__imp_RtlpVerifyAndCommitUILanguageSettings' as RtlpVerifyAndCommitUILanguageSettings:qword
        extrn '__imp_ShipAssert' as ShipAssert:qword
        extrn '__imp_ShipAssertGetBufferInfo' as ShipAssertGetBufferInfo:qword
        extrn '__imp_ShipAssertMsgA' as ShipAssertMsgA:qword
        extrn '__imp_ShipAssertMsgW' as ShipAssertMsgW:qword
        extrn '__imp_TpAllocAlpcCompletion' as TpAllocAlpcCompletion:qword
        extrn '__imp_TpAllocCleanupGroup' as TpAllocCleanupGroup:qword
        extrn '__imp_TpAllocIoCompletion' as TpAllocIoCompletion:qword
        extrn '__imp_TpAllocPool' as TpAllocPool:qword
        extrn '__imp_TpAllocTimer' as TpAllocTimer:qword
        extrn '__imp_TpAllocWait' as TpAllocWait:qword
        extrn '__imp_TpAllocWork' as TpAllocWork:qword
        extrn '__imp_TpCallbackLeaveCriticalSectionOnCompletion' as TpCallbackLeaveCriticalSectionOnCompletion:qword
        extrn '__imp_TpCallbackMayRunLong' as TpCallbackMayRunLong:qword
        extrn '__imp_TpCallbackReleaseMutexOnCompletion' as TpCallbackReleaseMutexOnCompletion:qword
        extrn '__imp_TpCallbackReleaseSemaphoreOnCompletion' as TpCallbackReleaseSemaphoreOnCompletion:qword
        extrn '__imp_TpCallbackSetEventOnCompletion' as TpCallbackSetEventOnCompletion:qword
        extrn '__imp_TpCallbackUnloadDllOnCompletion' as TpCallbackUnloadDllOnCompletion:qword
        extrn '__imp_TpCancelAsyncIoOperation' as TpCancelAsyncIoOperation:qword
        extrn '__imp_TpCaptureCaller' as TpCaptureCaller:qword
        extrn '__imp_TpCheckTerminateWorker' as TpCheckTerminateWorker:qword
        extrn '__imp_TpDbgDumpHeapUsage' as TpDbgDumpHeapUsage:qword
        extrn '__imp_TpDbgSetLogRoutine' as TpDbgSetLogRoutine:qword
        extrn '__imp_TpDisassociateCallback' as TpDisassociateCallback:qword
        extrn '__imp_TpIsTimerSet' as TpIsTimerSet:qword
        extrn '__imp_TpPostWork' as TpPostWork:qword
        extrn '__imp_TpReleaseAlpcCompletion' as TpReleaseAlpcCompletion:qword
        extrn '__imp_TpReleaseCleanupGroup' as TpReleaseCleanupGroup:qword
        extrn '__imp_TpReleaseCleanupGroupMembers' as TpReleaseCleanupGroupMembers:qword
        extrn '__imp_TpReleaseIoCompletion' as TpReleaseIoCompletion:qword
        extrn '__imp_TpReleasePool' as TpReleasePool:qword
        extrn '__imp_TpReleaseTimer' as TpReleaseTimer:qword
        extrn '__imp_TpReleaseWait' as TpReleaseWait:qword
        extrn '__imp_TpReleaseWork' as TpReleaseWork:qword
        extrn '__imp_TpSetPoolMaxThreads' as TpSetPoolMaxThreads:qword
        extrn '__imp_TpSetPoolMinThreads' as TpSetPoolMinThreads:qword
        extrn '__imp_TpSetTimer' as TpSetTimer:qword
        extrn '__imp_TpSetWait' as TpSetWait:qword
        extrn '__imp_TpSimpleTryPost' as TpSimpleTryPost:qword
        extrn '__imp_TpStartAsyncIoOperation' as TpStartAsyncIoOperation:qword
        extrn '__imp_TpWaitForAlpcCompletion' as TpWaitForAlpcCompletion:qword
        extrn '__imp_TpWaitForIoCompletion' as TpWaitForIoCompletion:qword
        extrn '__imp_TpWaitForTimer' as TpWaitForTimer:qword
        extrn '__imp_TpWaitForWait' as TpWaitForWait:qword
        extrn '__imp_TpWaitForWork' as TpWaitForWork:qword
        extrn '__imp_WerReportSQMEvent' as WerReportSQMEvent:qword
        extrn '__imp_WinSqmAddToStream' as WinSqmAddToStream:qword
        extrn '__imp_WinSqmEndSession' as WinSqmEndSession:qword
        extrn '__imp_WinSqmEventEnabled' as WinSqmEventEnabled:qword
        extrn '__imp_WinSqmEventWrite' as WinSqmEventWrite:qword
        extrn '__imp_WinSqmIsOptedIn' as WinSqmIsOptedIn:qword
        extrn '__imp_WinSqmSetString' as WinSqmSetString:qword
        extrn '__imp_WinSqmStartSession' as WinSqmStartSession:qword
        extrn '__imp_ZwAlpcAcceptConnectPort' as ZwAlpcAcceptConnectPort:qword
        extrn '__imp_ZwAlpcCancelMessage' as ZwAlpcCancelMessage:qword
        extrn '__imp_ZwAlpcConnectPort' as ZwAlpcConnectPort:qword
        extrn '__imp_ZwAlpcCreatePort' as ZwAlpcCreatePort:qword
        extrn '__imp_ZwAlpcCreatePortSection' as ZwAlpcCreatePortSection:qword
        extrn '__imp_ZwAlpcCreateResourceReserve' as ZwAlpcCreateResourceReserve:qword
        extrn '__imp_ZwAlpcCreateSectionView' as ZwAlpcCreateSectionView:qword
        extrn '__imp_ZwAlpcCreateSecurityContext' as ZwAlpcCreateSecurityContext:qword
        extrn '__imp_ZwAlpcDeletePortSection' as ZwAlpcDeletePortSection:qword
        extrn '__imp_ZwAlpcDeleteResourceReserve' as ZwAlpcDeleteResourceReserve:qword
        extrn '__imp_ZwAlpcDeleteSectionView' as ZwAlpcDeleteSectionView:qword
        extrn '__imp_ZwAlpcDeleteSecurityContext' as ZwAlpcDeleteSecurityContext:qword
        extrn '__imp_ZwAlpcDisconnectPort' as ZwAlpcDisconnectPort:qword
        extrn '__imp_ZwAlpcImpersonateClientOfPort' as ZwAlpcImpersonateClientOfPort:qword
        extrn '__imp_ZwAlpcOpenSenderProcess' as ZwAlpcOpenSenderProcess:qword
        extrn '__imp_ZwAlpcOpenSenderThread' as ZwAlpcOpenSenderThread:qword
        extrn '__imp_ZwAlpcQueryInformation' as ZwAlpcQueryInformation:qword
        extrn '__imp_ZwAlpcQueryInformationMessage' as ZwAlpcQueryInformationMessage:qword
        extrn '__imp_ZwAlpcRevokeSecurityContext' as ZwAlpcRevokeSecurityContext:qword
        extrn '__imp_ZwAlpcSendWaitReceivePort' as ZwAlpcSendWaitReceivePort:qword
        extrn '__imp_ZwAlpcSetInformation' as ZwAlpcSetInformation:qword
        extrn '__imp_ZwCancelIoFileEx' as ZwCancelIoFileEx:qword
        extrn '__imp_ZwCancelSynchronousIoFile' as ZwCancelSynchronousIoFile:qword
        extrn '__imp_ZwCommitComplete' as ZwCommitComplete:qword
        extrn '__imp_ZwCommitEnlistment' as ZwCommitEnlistment:qword
        extrn '__imp_ZwCommitTransaction' as ZwCommitTransaction:qword
        extrn '__imp_ZwCreateEnlistment' as ZwCreateEnlistment:qword
        extrn '__imp_ZwCreateKeyTransacted' as ZwCreateKeyTransacted:qword
        extrn '__imp_ZwCreatePrivateNamespace' as ZwCreatePrivateNamespace:qword
        extrn '__imp_ZwCreateResourceManager' as ZwCreateResourceManager:qword
        extrn '__imp_ZwCreateThreadEx' as ZwCreateThreadEx:qword
        extrn '__imp_ZwCreateTransaction' as ZwCreateTransaction:qword
        extrn '__imp_ZwCreateTransactionManager' as ZwCreateTransactionManager:qword
        extrn '__imp_ZwCreateUserProcess' as ZwCreateUserProcess:qword
        extrn '__imp_ZwCreateWorkerFactory' as ZwCreateWorkerFactory:qword
        extrn '__imp_ZwDeletePrivateNamespace' as ZwDeletePrivateNamespace:qword
        extrn '__imp_ZwEnumerateTransactionObject' as ZwEnumerateTransactionObject:qword
        extrn '__imp_ZwFlushInstallUILanguage' as ZwFlushInstallUILanguage:qword
        extrn '__imp_ZwFlushProcessWriteBuffers' as ZwFlushProcessWriteBuffers:qword
        extrn '__imp_ZwFreezeRegistry' as ZwFreezeRegistry:qword
        extrn '__imp_ZwFreezeTransactions' as ZwFreezeTransactions:qword
        extrn '__imp_ZwGetMUIRegistryInfo' as ZwGetMUIRegistryInfo:qword
        extrn '__imp_ZwGetNextProcess' as ZwGetNextProcess:qword
        extrn '__imp_ZwGetNextThread' as ZwGetNextThread:qword
        extrn '__imp_ZwGetNlsSectionPtr' as ZwGetNlsSectionPtr:qword
        extrn '__imp_ZwGetNotificationResourceManager' as ZwGetNotificationResourceManager:qword
        extrn '__imp_ZwInitializeNlsFiles' as ZwInitializeNlsFiles:qword
        extrn '__imp_ZwIsUILanguageComitted' as ZwIsUILanguageComitted:qword
        extrn '__imp_ZwMapCMFModule' as ZwMapCMFModule:qword
        extrn '__imp_ZwOpenEnlistment' as ZwOpenEnlistment:qword
        extrn '__imp_ZwOpenKeyTransacted' as ZwOpenKeyTransacted:qword
        extrn '__imp_ZwOpenPrivateNamespace' as ZwOpenPrivateNamespace:qword
        extrn '__imp_ZwOpenResourceManager' as ZwOpenResourceManager:qword
        extrn '__imp_ZwOpenSession' as ZwOpenSession:qword
        extrn '__imp_ZwOpenTransaction' as ZwOpenTransaction:qword
        extrn '__imp_ZwOpenTransactionManager' as ZwOpenTransactionManager:qword
        extrn '__imp_ZwPrePrepareComplete' as ZwPrePrepareComplete:qword
        extrn '__imp_ZwPrePrepareEnlistment' as ZwPrePrepareEnlistment:qword
        extrn '__imp_ZwPrepareComplete' as ZwPrepareComplete:qword
        extrn '__imp_ZwPrepareEnlistment' as ZwPrepareEnlistment:qword
        extrn '__imp_ZwPropagationComplete' as ZwPropagationComplete:qword
        extrn '__imp_ZwPropagationFailed' as ZwPropagationFailed:qword
        extrn '__imp_ZwQueryInformationEnlistment' as ZwQueryInformationEnlistment:qword
        extrn '__imp_ZwQueryInformationResourceManager' as ZwQueryInformationResourceManager:qword
        extrn '__imp_ZwQueryInformationTransaction' as ZwQueryInformationTransaction:qword
        extrn '__imp_ZwQueryInformationTransactionManager' as ZwQueryInformationTransactionManager:qword
        extrn '__imp_ZwQueryInformationWorkerFactory' as ZwQueryInformationWorkerFactory:qword
        extrn '__imp_ZwQueryLicenseValue' as ZwQueryLicenseValue:qword
        extrn '__imp_ZwReadOnlyEnlistment' as ZwReadOnlyEnlistment:qword
        extrn '__imp_ZwRecoverEnlistment' as ZwRecoverEnlistment:qword
        extrn '__imp_ZwRecoverResourceManager' as ZwRecoverResourceManager:qword
        extrn '__imp_ZwRecoverTransactionManager' as ZwRecoverTransactionManager:qword
        extrn '__imp_ZwRegisterProtocolAddressInformation' as ZwRegisterProtocolAddressInformation:qword
        extrn '__imp_ZwReleaseWorkerFactoryWorker' as ZwReleaseWorkerFactoryWorker:qword
        extrn '__imp_ZwRemoveIoCompletionEx' as ZwRemoveIoCompletionEx:qword
        extrn '__imp_ZwRenameTransactionManager' as ZwRenameTransactionManager:qword
        extrn '__imp_ZwReplacePartitionUnit' as ZwReplacePartitionUnit:qword
        extrn '__imp_ZwRollbackComplete' as ZwRollbackComplete:qword
        extrn '__imp_ZwRollbackEnlistment' as ZwRollbackEnlistment:qword
        extrn '__imp_ZwRollbackTransaction' as ZwRollbackTransaction:qword
        extrn '__imp_ZwRollforwardTransactionManager' as ZwRollforwardTransactionManager:qword
        extrn '__imp_ZwSetInformationEnlistment' as ZwSetInformationEnlistment:qword
        extrn '__imp_ZwSetInformationResourceManager' as ZwSetInformationResourceManager:qword
        extrn '__imp_ZwSetInformationTransaction' as ZwSetInformationTransaction:qword
        extrn '__imp_ZwSetInformationTransactionManager' as ZwSetInformationTransactionManager:qword
        extrn '__imp_ZwSetInformationWorkerFactory' as ZwSetInformationWorkerFactory:qword
        extrn '__imp_ZwShutdownWorkerFactory' as ZwShutdownWorkerFactory:qword
        extrn '__imp_ZwSinglePhaseReject' as ZwSinglePhaseReject:qword
        extrn '__imp_ZwThawRegistry' as ZwThawRegistry:qword
        extrn '__imp_ZwThawTransactions' as ZwThawTransactions:qword
        extrn '__imp_ZwTraceControl' as ZwTraceControl:qword
        extrn '__imp_ZwWaitForWorkViaWorkerFactory' as ZwWaitForWorkViaWorkerFactory:qword
        extrn '__imp_ZwWorkerFactoryWorkerReady' as ZwWorkerFactoryWorkerReady:qword
        extrn '__imp__swprintf' as _swprintf:qword
        extrn '__imp__vswprintf' as _vswprintf:qword
 
        define NtdllDefWindowProcA equ NtdllDefWindowProc_A
        define NtdllDialogWndProcA equ NtdllDialogWndProc_A
        define NtdllDefWindowProcW equ NtdllDefWindowProc_W
        define NtdllDialogWndProcW equ NtdllDialogWndProc_W
        
        api NtdllDefWindowProc,\
            NtdllDialogWndProc,\
            ShipAssertMsg
    end if

    if (NTDDI_VERSION >= NTDDI_WIN7)
        extrn '__imp_EtwEventSetInformation' as EtwEventSetInformation:qword
        extrn '__imp_EtwEventWriteEx' as EtwEventWriteEx:qword
        extrn '__imp_EtwEventWriteNoRegistration' as EtwEventWriteNoRegistration:qword
        extrn '__imp_EvtIntReportAuthzEventAndSourceAsync' as EvtIntReportAuthzEventAndSourceAsync:qword
        extrn '__imp_EvtIntReportEventAndSourceAsync' as EvtIntReportEventAndSourceAsync:qword
        extrn '__imp_LdrGetDllHandleByMapping' as LdrGetDllHandleByMapping:qword
        extrn '__imp_LdrGetDllHandleByName' as LdrGetDllHandleByName:qword
        extrn '__imp_LdrGetKnownDllSectionHandle' as LdrGetKnownDllSectionHandle:qword
        extrn '__imp_LdrResGetRCConfig' as LdrResGetRCConfig:qword
        extrn '__imp_LdrRscIsTypeExist' as LdrRscIsTypeExist:qword
        extrn '__imp_LdrLoadEnclaveModule' as LdrLoadEnclaveModule:qword
        extrn '__imp_LdrSystemDllInitBlock' as LdrSystemDllInitBlock:qword
        extrn '__imp_memcpy_s' as memcpy_s:qword
        extrn '__imp_memmove_s' as memmove_s:qword
        extrn '__imp_NtAllocateReserveObject' as NtAllocateReserveObject:qword
        extrn '__imp_NtCreateProfileEx' as NtCreateProfileEx:qword
        extrn '__imp_NtDrawText' as NtDrawText:qword
        extrn '__imp_NtNotifyChangeDirectoryFileEx' as NtNotifyChangeDirectoryFileEx:qword
        extrn '__imp_NtNotifyChangeSession' as NtNotifyChangeSession:qword
        extrn '__imp_NtOpenKeyEx' as NtOpenKeyEx:qword
        extrn '__imp_NtOpenKeyTransactedEx' as NtOpenKeyTransactedEx:qword
        extrn '__imp_NtQuerySecurityAttributesToken' as NtQuerySecurityAttributesToken:qword
        extrn '__imp_NtQuerySystemInformationEx' as NtQuerySystemInformationEx:qword
        extrn '__imp_NtQueueApcThreadEx' as NtQueueApcThreadEx:qword
        extrn '__imp_NtSerializeBoot' as NtSerializeBoot:qword
        extrn '__imp_NtSetIoCompletionEx' as NtSetIoCompletionEx:qword
        extrn '__imp_NtSetTimerEx' as NtSetTimerEx:qword
        extrn '__imp_NtUmsThreadYield' as NtUmsThreadYield:qword
        extrn '__imp_RtlAcquireReleaseSRWLockExclusive' as RtlAcquireReleaseSRWLockExclusive:qword
        extrn '__imp_RtlAddIntegrityLabelToBoundaryDescriptor' as RtlAddIntegrityLabelToBoundaryDescriptor:qword
        if (NTDDI_VERSION <> NTDDI_WIN81)
            extrn '__imp_RtlCheckSandboxedToken' as RtlCheckSandboxedToken:qword
        end if
        extrn '__imp_RtlContractHashTable' as RtlContractHashTable:qword
        extrn '__imp_RtlCopyContext' as RtlCopyContext:qword
        extrn '__imp_RtlCopyExtendedContext' as RtlCopyExtendedContext:qword
        extrn '__imp_RtlCreateHashTable' as RtlCreateHashTable:qword
        extrn '__imp_RtlCreateProcessReflection' as RtlCreateProcessReflection:qword
        extrn '__imp_RtlCreateVirtualAccountSid' as RtlCreateVirtualAccountSid:qword
        extrn '__imp_RtlDeleteHashTable' as RtlDeleteHashTable:qword
        extrn '__imp_RtlDetectHeapLeaks' as RtlDetectHeapLeaks:qword
        extrn '__imp_RtlDisableThreadProfiling' as RtlDisableThreadProfiling:qword
        extrn '__imp_RtlEnableThreadProfiling' as RtlEnableThreadProfiling:qword
        extrn '__imp_RtlEndEnumerationHashTable' as RtlEndEnumerationHashTable:qword
        extrn '__imp_RtlEndWeakEnumerationHashTable' as RtlEndWeakEnumerationHashTable:qword
        extrn '__imp_RtlEnumerateEntryHashTable' as RtlEnumerateEntryHashTable:qword
        extrn '__imp_RtlEthernetAddressToStringA' as RtlEthernetAddressToStringA:qword
        extrn '__imp_RtlEthernetAddressToStringW' as RtlEthernetAddressToStringW:qword
        extrn '__imp_RtlEthernetStringToAddressA' as RtlEthernetStringToAddressA:qword
        extrn '__imp_RtlEthernetStringToAddressW' as RtlEthernetStringToAddressW:qword
        extrn '__imp_RtlExpandHashTable' as RtlExpandHashTable:qword
        extrn '__imp_RtlGetCurrentProcessorNumberEx' as RtlGetCurrentProcessorNumberEx:qword
        extrn '__imp_RtlGetEnabledExtendedFeatures' as RtlGetEnabledExtendedFeatures:qword
        extrn '__imp_RtlGetExtendedContextLength' as RtlGetExtendedContextLength:qword
        extrn '__imp_RtlGetExtendedFeaturesMask' as RtlGetExtendedFeaturesMask:qword
        extrn '__imp_RtlGetFullPathName_UEx' as RtlGetFullPathName_UEx:qword
        extrn '__imp_RtlGetLocaleFileMappingAddress' as RtlGetLocaleFileMappingAddress:qword
        extrn '__imp_RtlGetNextEntryHashTable' as RtlGetNextEntryHashTable:qword
        extrn '__imp_RtlGetProcessPreferredUILanguages' as RtlGetProcessPreferredUILanguages:qword
        extrn '__imp_RtlInitializeExtendedContext' as RtlInitializeExtendedContext:qword
        extrn '__imp_RtlInitEnumerationHashTable' as RtlInitEnumerationHashTable:qword
        extrn '__imp_RtlInitWeakEnumerationHashTable' as RtlInitWeakEnumerationHashTable:qword
        extrn '__imp_RtlInsertEntryHashTable' as RtlInsertEntryHashTable:qword
        extrn '__imp_RtlInterlockedClearBitRun' as RtlInterlockedClearBitRun:qword
        extrn '__imp_RtlInterlockedSetBitRun' as RtlInterlockedSetBitRun:qword
        extrn '__imp_RtlIsNameInExpression' as RtlIsNameInExpression:qword
        extrn '__imp_RtlKnownExceptionFilter' as RtlKnownExceptionFilter:qword
        extrn '__imp_RtlLoadStringA' as RtlLoadStringA:qword
        extrn '__imp_RtlLoadStringW' as RtlLoadStringW:qword
        extrn '__imp_RtlLocateExtendedFeature' as RtlLocateExtendedFeature:qword
        extrn '__imp_RtlLocateLegacyContext' as RtlLocateLegacyContext:qword
        extrn '__imp_RtlLookupEntryHashTable' as RtlLookupEntryHashTable:qword
        extrn '__imp_RtlQueryCriticalSectionOwner' as RtlQueryCriticalSectionOwner:qword
        extrn '__imp_RtlQueryPerformanceCounter' as RtlQueryPerformanceCounter:qword
        extrn '__imp_RtlQueryPerformanceFrequency' as RtlQueryPerformanceFrequency:qword
        extrn '__imp_RtlQueryThreadProfiling' as RtlQueryThreadProfiling:qword
        extrn '__imp_RtlReadThreadProfilingData' as RtlReadThreadProfilingData:qword
        extrn '__imp_RtlRemoveEntryHashTable' as RtlRemoveEntryHashTable:qword
        extrn '__imp_RtlReplaceSidInSd' as RtlReplaceSidInSd:qword
        extrn '__imp_RtlReportSilentProcessExit' as RtlReportSilentProcessExit:qword
        extrn '__imp_RtlReportSqmEscalation' as RtlReportSqmEscalation:qword
        extrn '__imp_RtlSetExtendedFeaturesMask' as RtlSetExtendedFeaturesMask:qword
        extrn '__imp_RtlSetProcessPreferredUILanguages' as RtlSetProcessPreferredUILanguages:qword
        extrn '__imp_RtlTryAcquireSRWLockExclusive' as RtlTryAcquireSRWLockExclusive:qword
        extrn '__imp_RtlTryAcquireSRWLockShared' as RtlTryAcquireSRWLockShared:qword
        extrn '__imp_RtlUnicodeToUTF8N' as RtlUnicodeToUTF8N:qword
        extrn '__imp_RtlUTF8ToUnicodeN' as RtlUTF8ToUnicodeN:qword
        extrn '__imp_RtlWeaklyEnumerateEntryHashTable' as RtlWeaklyEnumerateEntryHashTable:qword
        extrn '__imp_RtlWow64GetThreadContext' as RtlWow64GetThreadContext:qword
        extrn '__imp_RtlWow64LogMessageInEventLogger' as RtlWow64LogMessageInEventLogger:qword
        extrn '__imp_RtlWow64SetThreadContext' as RtlWow64SetThreadContext:qword
        extrn '__imp_SbExecuteProcedure' as SbExecuteProcedure:qword
        extrn '__imp_SbSelectProcedure' as SbSelectProcedure:qword
        extrn '__imp_sprintf_s' as sprintf_s:qword
        extrn '__imp_sscanf_s' as sscanf_s:qword
        extrn '__imp_strcat_s' as strcat_s:qword
        extrn '__imp_strcpy_s' as strcpy_s:qword
        extrn '__imp_strncat_s' as strncat_s:qword
        extrn '__imp_strncpy_s' as strncpy_s:qword
        extrn '__imp_strnlen' as strnlen:qword
        extrn '__imp_strtok_s' as strtok_s:qword
        extrn '__imp_swprintf_s' as swprintf_s:qword
        extrn '__imp_swscanf_s' as swscanf_s:qword
        extrn '__imp_TpAllocAlpcCompletionEx' as TpAllocAlpcCompletionEx:qword
        extrn '__imp_TpAlpcRegisterCompletionList' as TpAlpcRegisterCompletionList:qword
        extrn '__imp_TpAlpcUnregisterCompletionList' as TpAlpcUnregisterCompletionList:qword
        extrn '__imp_TpCallbackIndependent' as TpCallbackIndependent:qword
        extrn '__imp_TpDisablePoolCallbackChecks' as TpDisablePoolCallbackChecks:qword
        extrn '__imp_TpQueryPoolStackInformation' as TpQueryPoolStackInformation:qword
        extrn '__imp_TpSetDefaultPoolMaxThreads' as TpSetDefaultPoolMaxThreads:qword
        extrn '__imp_TpSetDefaultPoolStackInformation' as TpSetDefaultPoolStackInformation:qword
        extrn '__imp_TpSetPoolStackInformation' as TpSetPoolStackInformation:qword
        extrn '__imp_vsprintf_s' as vsprintf_s:qword
        extrn '__imp_vswprintf_s' as vswprintf_s:qword
        extrn '__imp_wcscat_s' as wcscat_s:qword
        extrn '__imp_wcscpy_s' as wcscpy_s:qword
        extrn '__imp_wcsncat_s' as wcsncat_s:qword
        extrn '__imp_wcsncpy_s' as wcsncpy_s:qword
        extrn '__imp_wcsnlen' as wcsnlen:qword
        extrn '__imp_WinSqmAddToAverageDWORD' as WinSqmAddToAverageDWORD:qword
        extrn '__imp_WinSqmAddToStreamEx' as WinSqmAddToStreamEx:qword
        extrn '__imp_WinSqmCheckEscalationAddToStreamEx' as WinSqmCheckEscalationAddToStreamEx:qword
        extrn '__imp_WinSqmCheckEscalationSetDWORD' as WinSqmCheckEscalationSetDWORD:qword
        extrn '__imp_WinSqmCheckEscalationSetDWORD64' as WinSqmCheckEscalationSetDWORD64:qword
        extrn '__imp_WinSqmCheckEscalationSetString' as WinSqmCheckEscalationSetString:qword
        extrn '__imp_WinSqmCommonDatapointDelete' as WinSqmCommonDatapointDelete:qword
        extrn '__imp_WinSqmCommonDatapointSetDWORD' as WinSqmCommonDatapointSetDWORD:qword
        extrn '__imp_WinSqmCommonDatapointSetDWORD64' as WinSqmCommonDatapointSetDWORD64:qword
        extrn '__imp_WinSqmCommonDatapointSetStreamEx' as WinSqmCommonDatapointSetStreamEx:qword
        extrn '__imp_WinSqmCommonDatapointSetString' as WinSqmCommonDatapointSetString:qword
        extrn '__imp_WinSqmGetEscalationRuleStatus' as WinSqmGetEscalationRuleStatus:qword
        extrn '__imp_WinSqmGetInstrumentationProperty' as WinSqmGetInstrumentationProperty:qword
        extrn '__imp_WinSqmIncrementDWORD' as WinSqmIncrementDWORD:qword
        extrn '__imp_WinSqmIsOptedInEx' as WinSqmIsOptedInEx:qword
        extrn '__imp_WinSqmSetDWORD' as WinSqmSetDWORD:qword
        extrn '__imp_WinSqmSetDWORD64' as WinSqmSetDWORD64:qword
        extrn '__imp_WinSqmSetEscalationInfo' as WinSqmSetEscalationInfo:qword
        extrn '__imp_WinSqmSetIfMaxDWORD' as WinSqmSetIfMaxDWORD:qword
        extrn '__imp_WinSqmSetIfMinDWORD' as WinSqmSetIfMinDWORD:qword
        extrn '__imp_ZwAllocateReserveObject' as ZwAllocateReserveObject:qword
        extrn '__imp_ZwCreateProfileEx' as ZwCreateProfileEx:qword
        extrn '__imp_ZwDisableLastKnownGood' as ZwDisableLastKnownGood:qword
        extrn '__imp_ZwDrawText' as ZwDrawText:qword
        extrn '__imp_ZwEnableLastKnownGood' as ZwEnableLastKnownGood:qword
        extrn '__imp_ZwNotifyChangeSession' as ZwNotifyChangeSession:qword
        extrn '__imp_ZwOpenKeyEx' as ZwOpenKeyEx:qword
        extrn '__imp_ZwOpenKeyTransactedEx' as ZwOpenKeyTransactedEx:qword
        extrn '__imp_ZwQuerySecurityAttributesToken' as ZwQuerySecurityAttributesToken:qword
        extrn '__imp_ZwQuerySystemInformationEx' as ZwQuerySystemInformationEx:qword
        extrn '__imp_ZwQueueApcThreadEx' as ZwQueueApcThreadEx:qword
        extrn '__imp_ZwSerializeBoot' as ZwSerializeBoot:qword
        extrn '__imp_ZwSetIoCompletionEx' as ZwSetIoCompletionEx:qword
        extrn '__imp_ZwSetTimerEx' as ZwSetTimerEx:qword
        extrn '__imp_ZwUmsThreadYield' as ZwUmsThreadYield:qword
        extrn '__imp__i64toa_s' as _i64toa_s:qword
        extrn '__imp__i64tow_s' as _i64tow_s:qword
        extrn '__imp__itoa_s' as _itoa_s:qword
        extrn '__imp__itow_s' as _itow_s:qword
        extrn '__imp__ltoa_s' as _ltoa_s:qword
        extrn '__imp__ltow_s' as _ltow_s:qword
        extrn '__imp__makepath_s' as _makepath_s:qword
        extrn '__imp__snprintf_s' as _snprintf_s:qword
        extrn '__imp__snscanf_s' as _snscanf_s:qword
        extrn '__imp__snwprintf_s' as _snwprintf_s:qword
        extrn '__imp__snwscanf_s' as _snwscanf_s:qword
        extrn '__imp__splitpath_s' as _splitpath_s:qword
        extrn '__imp__strnset_s' as _strnset_s:qword
        extrn '__imp__strset_s' as _strset_s:qword
        extrn '__imp__ui64toa_s' as _ui64toa_s:qword
        extrn '__imp__ui64tow_s' as _ui64tow_s:qword
        extrn '__imp__ultoa_s' as _ultoa_s:qword
        extrn '__imp__ultow_s' as _ultow_s:qword
        extrn '__imp__vsnprintf_s' as _vsnprintf_s:qword
        extrn '__imp__vsnwprintf_s' as _vsnwprintf_s:qword
        extrn '__imp__wcsnset_s' as _wcsnset_s:qword
        extrn '__imp__wcsset_s' as _wcsset_s:qword
        extrn '__imp__wmakepath_s' as _wmakepath_s:qword
        extrn '__imp__wsplitpath_s' as _wsplitpath_s:qword

        api RtlEthernetAddressToString,\
            RtlEthernetStringToAddress,\
            RtlLoadString
    end if
    if (NTDDI_VERSION >= NTDDI_WIN8)
        extrn '__imp_ApiSetQueryApiSetPresence' as ApiSetQueryApiSetPresence:qword
        extrn '__imp_LdrAddDllDirectory' as LdrAddDllDirectory:qword
        extrn '__imp_LdrAppxHandleIntegrityFailure' as LdrAppxHandleIntegrityFailure:qword
        extrn '__imp_LdrGetDllDirectory' as LdrGetDllDirectory:qword
        extrn '__imp_LdrGetDllFullName' as LdrGetDllFullName:qword
        extrn '__imp_LdrGetDllPath' as LdrGetDllPath:qword
        extrn '__imp_LdrGetProcedureAddressForCaller' as LdrGetProcedureAddressForCaller:qword
        extrn '__imp_LdrProcessRelocationBlockEx' as LdrProcessRelocationBlockEx:qword
        extrn '__imp_LdrQueryOptionalDelayLoadedAPI' as LdrQueryOptionalDelayLoadedAPI:qword
        extrn '__imp_LdrRemoveDllDirectory' as LdrRemoveDllDirectory:qword
        extrn '__imp_LdrResolveDelayLoadedAPI' as LdrResolveDelayLoadedAPI:qword
        extrn '__imp_LdrResolveDelayLoadsFromDll' as LdrResolveDelayLoadsFromDll:qword
        extrn '__imp_LdrSetDefaultDllDirectories' as LdrSetDefaultDllDirectories:qword
        extrn '__imp_LdrSetDllDirectory' as LdrSetDllDirectory:qword
        extrn '__imp_LdrStandardizeSystemPath' as LdrStandardizeSystemPath:qword
        extrn '__imp_NtAddAtomEx' as NtAddAtomEx:qword
        extrn '__imp_NtAdjustTokenClaimsAndDeviceGroups' as NtAdjustTokenClaimsAndDeviceGroups:qword
        extrn '__imp_NtAlertThreadByThreadId' as NtAlertThreadByThreadId:qword
        extrn '__imp_NtAlpcConnectPortEx' as NtAlpcConnectPortEx:qword
        extrn '__imp_NtAssociateWaitCompletionPacket' as NtAssociateWaitCompletionPacket:qword
        extrn '__imp_NtCancelWaitCompletionPacket' as NtCancelWaitCompletionPacket:qword
        extrn '__imp_NtCreateDirectoryObjectEx' as NtCreateDirectoryObjectEx:qword
        extrn '__imp_NtCreateIRTimer' as NtCreateIRTimer:qword
        extrn '__imp_NtCreateLowBoxToken' as NtCreateLowBoxToken:qword
        extrn '__imp_NtCreateTokenEx' as NtCreateTokenEx:qword
        extrn '__imp_NtCreateWaitCompletionPacket' as NtCreateWaitCompletionPacket:qword
        extrn '__imp_NtCreateWnfStateName' as NtCreateWnfStateName:qword
        extrn '__imp_NtDeleteWnfStateData' as NtDeleteWnfStateData:qword
        extrn '__imp_NtDeleteWnfStateName' as NtDeleteWnfStateName:qword
        extrn '__imp_NtFilterBootOption' as NtFilterBootOption:qword
        extrn '__imp_NtFilterTokenEx' as NtFilterTokenEx:qword
        extrn '__imp_NtFlushBuffersFileEx' as NtFlushBuffersFileEx:qword
        extrn '__imp_NtGetCachedSigningLevel' as NtGetCachedSigningLevel:qword
        extrn '__imp_NtQueryWnfStateData' as NtQueryWnfStateData:qword
        extrn '__imp_NtQueryWnfStateNameInformation' as NtQueryWnfStateNameInformation:qword
        extrn '__imp_NtSetCachedSigningLevel' as NtSetCachedSigningLevel:qword
        extrn '__imp_NtSetIRTimer' as NtSetIRTimer:qword
        extrn '__imp_NtSetInformationVirtualMemory' as NtSetInformationVirtualMemory:qword
        extrn '__imp_NtSubscribeWnfStateChange' as NtSubscribeWnfStateChange:qword
        extrn '__imp_NtUnmapViewOfSectionEx' as NtUnmapViewOfSectionEx:qword
        extrn '__imp_NtUnsubscribeWnfStateChange' as NtUnsubscribeWnfStateChange:qword
        extrn '__imp_NtUpdateWnfStateData' as NtUpdateWnfStateData:qword
        extrn '__imp_NtWaitForAlertByThreadId' as NtWaitForAlertByThreadId:qword
        extrn '__imp_RtlAddGrowableFunctionTable' as RtlAddGrowableFunctionTable:qword
        extrn '__imp_RtlAddResourceAttributeAce' as RtlAddResourceAttributeAce:qword
        extrn '__imp_RtlAddScopedPolicyIDAce' as RtlAddScopedPolicyIDAce:qword
        extrn '__imp_RtlAllocateWnfSerializationGroup' as RtlAllocateWnfSerializationGroup:qword
        extrn '__imp_RtlAppxIsFileOwnedByTrustedInstaller' as RtlAppxIsFileOwnedByTrustedInstaller:qword
        extrn '__imp_RtlAvlInsertNodeEx' as RtlAvlInsertNodeEx:qword
        extrn '__imp_RtlAvlRemoveNode' as RtlAvlRemoveNode:qword
        extrn '__imp_RtlCanonicalizeDomainName' as RtlCanonicalizeDomainName:qword
        extrn '__imp_RtlCheckPortableOperatingSystem' as RtlCheckPortableOperatingSystem:qword
        extrn '__imp_RtlCheckTokenCapability' as RtlCheckTokenCapability:qword
        extrn '__imp_RtlCheckTokenMembership' as RtlCheckTokenMembership:qword
        extrn '__imp_RtlCheckTokenMembershipEx' as RtlCheckTokenMembershipEx:qword
        extrn '__imp_RtlClearBit' as RtlClearBit:qword
        extrn '__imp_RtlCopyBitMap' as RtlCopyBitMap:qword
        extrn '__imp_RtlCrc32' as RtlCrc32:qword
        extrn '__imp_RtlCrc64' as RtlCrc64:qword
        extrn '__imp_RtlCreateHashTableEx' as RtlCreateHashTableEx:qword
        extrn '__imp_RtlDecompressBufferEx' as RtlDecompressBufferEx:qword
        extrn '__imp_RtlDeleteElementGenericTableAvlEx' as RtlDeleteElementGenericTableAvlEx:qword
        extrn '__imp_RtlDeleteGrowableFunctionTable' as RtlDeleteGrowableFunctionTable:qword
        extrn '__imp_RtlequalWnfChangeStamps' as RtlequalWnfChangeStamps:qword
        extrn '__imp_RtlExtractBitMap' as RtlExtractBitMap:qword
        extrn '__imp_RtlFlushHeaps' as RtlFlushHeaps:qword
        extrn '__imp_RtlGetAppContainerNamedObjectPath' as RtlGetAppContainerNamedObjectPath:qword
        extrn '__imp_RtlGetExePath' as RtlGetExePath:qword
        extrn '__imp_RtlGetSearchPath' as RtlGetSearchPath:qword
        extrn '__imp_RtlGetSystemTimePrecise' as RtlGetSystemTimePrecise:qword
        extrn '__imp_RtlGrowFunctionTable' as RtlGrowFunctionTable:qword
        extrn '__imp_RtlInterlockedPushListSListEx' as RtlInterlockedPushListSListEx:qword
        extrn '__imp_RtlIsCapabilitySid' as RtlIsCapabilitySid:qword
        extrn '__imp_RtlIsPackageSid' as RtlIsPackageSid:qword
        extrn '__imp_RtlIsUntrustedObject' as RtlIsUntrustedObject:qword
        extrn '__imp_RtlLengthSidAsUnicodeString' as RtlLengthSidAsUnicodeString:qword
        extrn '__imp_RtlNumberOfClearBitsInRange' as RtlNumberOfClearBitsInRange:qword
        extrn '__imp_RtlNumberOfSetBitsInRange' as RtlNumberOfSetBitsInRange:qword
        extrn '__imp_RtlpConvertAbsoluteToRelativeSecurityAttribute' as RtlpConvertAbsoluteToRelativeSecurityAttribute:qword
        extrn '__imp_RtlpConvertRelativeToAbsoluteSecurityAttribute' as RtlpConvertRelativeToAbsoluteSecurityAttribute:qword
        extrn '__imp_RtlpFreezeTimeBias' as RtlpFreezeTimeBias:qword
        extrn '__imp_RtlpMergeSecurityAttributeInformation' as RtlpMergeSecurityAttributeInformation:qword
        extrn '__imp_RtlPublishWnfStateData' as RtlPublishWnfStateData:qword
        extrn '__imp_RtlQueryPackageIdentity' as RtlQueryPackageIdentity:qword
        extrn '__imp_RtlQueryRegistryValuesEx' as RtlQueryRegistryValuesEx:qword
        extrn '__imp_RtlQueryUnbiasedInterruptTime' as RtlQueryUnbiasedInterruptTime:qword
        extrn '__imp_RtlQueryValidationRunlevel' as RtlQueryValidationRunlevel:qword
        extrn '__imp_RtlQueryWnfMetaNotification' as RtlQueryWnfMetaNotification:qword
        extrn '__imp_RtlQueryWnfStateData' as RtlQueryWnfStateData:qword
        extrn '__imp_RtlQueryWnfStateDataWithExplicitScope' as RtlQueryWnfStateDataWithExplicitScope:qword
        extrn '__imp_RtlQueueApcWow64Thread' as RtlQueueApcWow64Thread:qword
        extrn '__imp_RtlRbInsertNodeEx' as RtlRbInsertNodeEx:qword
        extrn '__imp_RtlRbRemoveNode' as RtlRbRemoveNode:qword
        extrn '__imp_RtlRegisterForWnfMetaNotification' as RtlRegisterForWnfMetaNotification:qword
        extrn '__imp_RtlReleasePath' as RtlReleasePath:qword
        extrn '__imp_RtlResetNtUserPfn' as RtlResetNtUserPfn:qword
        extrn '__imp_RtlSetBit' as RtlSetBit:qword
        extrn '__imp_RtlSetPortableOperatingSystem' as RtlSetPortableOperatingSystem:qword
        extrn '__imp_RtlSetSearchPathMode' as RtlSetSearchPathMode:qword
        extrn '__imp_RtlSubscribeWnfStateChangeNotification' as RtlSubscribeWnfStateChangeNotification:qword
        extrn '__imp_RtlTryConvertSRWLockSharedToExclusiveOrRelease' as RtlTryConvertSRWLockSharedToExclusiveOrRelease:qword
        extrn '__imp_RtlTestAndPublishWnfStateData' as RtlTestAndPublishWnfStateData:qword
        extrn '__imp_RtlUnsubscribeWnfNotificationWaitForCompletion' as RtlUnsubscribeWnfNotificationWaitForCompletion:qword
        extrn '__imp_RtlUnsubscribeWnfNotificationWithCompletionCallback' as RtlUnsubscribeWnfNotificationWithCompletionCallback:qword
        extrn '__imp_RtlUnsubscribeWnfStateChangeNotification' as RtlUnsubscribeWnfStateChangeNotification:qword
        extrn '__imp_RtlWaitOnAddress' as RtlWaitOnAddress:qword
        extrn '__imp_RtlWaitForWnfMetaNotification' as RtlWaitForWnfMetaNotification:qword
        extrn '__imp_RtlWakeAddressAll' as RtlWakeAddressAll:qword
        extrn '__imp_RtlWakeAddressSingle' as RtlWakeAddressSingle:qword
        extrn '__imp_RtlWakeAddressSingleNoFence' as RtlWakeAddressSingleNoFence:qword
        extrn '__imp_RtlWakeAddressAllNoFence' as RtlWakeAddressAllNoFence:qword
        extrn '__imp_RtlWnfCompareChangeStamp' as RtlWnfCompareChangeStamp:qword
        extrn '__imp_RtlWnfDllUnloadCallback' as RtlWnfDllUnloadCallback:qword
        extrn '__imp_TpSetTimerEx' as TpSetTimerEx:qword
        extrn '__imp_TpSetWaitEx' as TpSetWaitEx:qword
        extrn '__imp_TpTimerOutstandingCallbackCount' as TpTimerOutstandingCallbackCount:qword
        extrn '__imp_WinSqmIsSessionDisabled' as WinSqmIsSessionDisabled:qword
        extrn '__imp_TpAllocJobNotification' as TpAllocJobNotification:qword
        extrn '__imp_TpCallbackDetectedUnrecoverableError' as TpCallbackDetectedUnrecoverableError:qword
        extrn '__imp_TpReleaseJobNotification' as TpReleaseJobNotification:qword
        extrn '__imp_TpSetPoolThreadBasePriority' as TpSetPoolThreadBasePriority:qword
        extrn '__imp_TpWaitForJobNotification' as TpWaitForJobNotification:qword
        extrn '__imp_ZwAddAtomEx' as ZwAddAtomEx:qword
        extrn '__imp_ZwAdjustTokenClaimsAndDeviceGroups' as ZwAdjustTokenClaimsAndDeviceGroups:qword
        extrn '__imp_ZwAlertThreadByThreadId' as ZwAlertThreadByThreadId:qword
        extrn '__imp_ZwAlpcConnectPortEx' as ZwAlpcConnectPortEx:qword
        extrn '__imp_ZwAssociateWaitCompletionPacket' as ZwAssociateWaitCompletionPacket:qword
        extrn '__imp_ZwCancelWaitCompletionPacket' as ZwCancelWaitCompletionPacket:qword
        extrn '__imp_ZwCreateDirectoryObjectEx' as ZwCreateDirectoryObjectEx:qword
        extrn '__imp_ZwCreateIRTimer' as ZwCreateIRTimer:qword
        extrn '__imp_ZwCreateLowBoxToken' as ZwCreateLowBoxToken:qword
        extrn '__imp_ZwCreateTokenEx' as ZwCreateTokenEx:qword
        extrn '__imp_ZwCreateWaitCompletionPacket' as ZwCreateWaitCompletionPacket:qword
        extrn '__imp_ZwCreateWnfStateName' as ZwCreateWnfStateName:qword
        extrn '__imp_ZwDeleteWnfStateData' as ZwDeleteWnfStateData:qword
        extrn '__imp_ZwDeleteWnfStateName' as ZwDeleteWnfStateName:qword
        extrn '__imp_ZwFilterBootOption' as ZwFilterBootOption:qword
        extrn '__imp_ZwFilterTokenEx' as ZwFilterTokenEx:qword
        extrn '__imp_ZwFlushBuffersFileEx' as ZwFlushBuffersFileEx:qword
        extrn '__imp_ZwGetCachedSigningLevel' as ZwGetCachedSigningLevel:qword
        extrn '__imp_ZwQueryWnfStateData' as ZwQueryWnfStateData:qword
        extrn '__imp_ZwQueryWnfStateNameInformation' as ZwQueryWnfStateNameInformation:qword
        extrn '__imp_ZwSetCachedSigningLevel' as ZwSetCachedSigningLevel:qword
        extrn '__imp_ZwSetIRTimer' as ZwSetIRTimer:qword
        extrn '__imp_ZwSetInformationVirtualMemory' as ZwSetInformationVirtualMemory:qword
        extrn '__imp_ZwSubscribeWnfStateChange' as ZwSubscribeWnfStateChange:qword
        extrn '__imp_ZwUnmapViewOfSectionEx' as ZwUnmapViewOfSectionEx:qword
        extrn '__imp_ZwUnsubscribeWnfStateChange' as ZwUnsubscribeWnfStateChange:qword
        extrn '__imp_ZwUpdateWnfStateData' as ZwUpdateWnfStateData:qword
        extrn '__imp_ZwWaitForAlertByThreadId' as ZwWaitForAlertByThreadId:qword
        extrn '__imp__errno' as _errno:qword
        extrn '__imp__strlwr_s' as _strlwr_s:qword
        extrn '__imp__strupr_s' as _strupr_s:qword
        extrn '__imp__wcslwr_s' as _wcslwr_s:qword
        extrn '__imp__wcstoi64' as _wcstoi64:qword
        extrn '__imp__wcsupr_s' as _wcsupr_s:qword
        extrn '__imp_iswalnum' as iswalnum:qword
        extrn '__imp_iswascii' as iswascii:qword
        extrn '__imp_iswgraph' as iswgraph:qword
        extrn '__imp_iswprint' as iswprint:qword
        extrn '__imp_qsort_s' as qsort_s:qword
        extrn '__imp_wcstok_s' as wcstok_s:qword
    end if

    if (NTDDI_VERSION >= NTDDI_WIN81)
        extrn '__imp_NtCancelTimer2' as NtCancelTimer2:qword
        extrn '__imp_NtCreateTimer2' as NtCreateTimer2:qword
        extrn '__imp_NtGetCompleteWnfStateSubscription' as NtGetCompleteWnfStateSubscription:qword
        extrn '__imp_NtSetTimer2' as NtSetTimer2:qword
        extrn '__imp_NtSetWnfProcessNotificationEvent' as NtSetWnfProcessNotificationEvent:qword
        extrn '__imp_LdrSetImplicitPathOptions' as LdrSetImplicitPathOptions:qword
        extrn '__imp_PssNtCaptureSnapshot' as PssNtCaptureSnapshot:qword
        extrn '__imp_PssNtDuplicateSnapshot' as PssNtDuplicateSnapshot:qword
        extrn '__imp_PssNtFreeRemoteSnapshot' as PssNtFreeRemoteSnapshot:qword
        extrn '__imp_PssNtFreeSnapshot' as PssNtFreeSnapshot:qword
        extrn '__imp_PssNtFreeWalkMarker' as PssNtFreeWalkMarker:qword
        extrn '__imp_PssNtQuerySnapshot' as PssNtQuerySnapshot:qword
        extrn '__imp_PssNtValidateDescriptor' as PssNtValidateDescriptor:qword
        extrn '__imp_PssNtWalkSnapshot' as PssNtWalkSnapshot:qword
        extrn '__imp_RtlAddProcessTrustLabelAce' as RtlAddProcessTrustLabelAce:qword
        extrn '__imp_RtlAllocateAndInitializeSidEx' as RtlAllocateAndInitializeSidEx:qword
        extrn '__imp_RtlGetAppContainerParent' as RtlGetAppContainerParent:qword
        extrn '__imp_RtlGetAppContainerSidType' as RtlGetAppContainerSidType:qword
        extrn '__imp_RtlIsParentOfChildAppContainer' as RtlIsParentOfChildAppContainer:qword
        extrn '__imp_RtlIsValidProcessTrustLabelSid' as RtlIsValidProcessTrustLabelSid:qword
        extrn '__imp_RtlQueryPackageIdentityEx' as RtlQueryPackageIdentityEx:qword
        extrn '__imp_RtlQueryResourcePolicy' as RtlQueryResourcePolicy:qword
        extrn '__imp_RtlSidDominatesForTrust' as RtlSidDominatesForTrust:qword
        extrn '__imp_RtlStringFromGUIDEx' as RtlStringFromGUIDEx:qword
        extrn '__imp_RtlTestProtectedAccess' as RtlTestProtectedAccess:qword
        extrn '__imp_RtlValidProcessProtection' as RtlValidProcessProtection:qword
        extrn '__imp_TpCallbackSendAlpcMessageOnCompletion' as TpCallbackSendAlpcMessageOnCompletion:qword
        extrn '__imp_TpCallbackSendPendingAlpcMessage' as TpCallbackSendPendingAlpcMessage:qword
        extrn '__imp_TpTrimPools' as TpTrimPools:qword
        extrn '__imp_WinSqmStartSessionForPartner' as WinSqmStartSessionForPartner:qword
        extrn '__imp_ZwCancelTimer2' as ZwCancelTimer2:qword
        extrn '__imp_ZwCreateTimer2' as ZwCreateTimer2:qword
        extrn '__imp_ZwGetCompleteWnfStateSubscription' as ZwGetCompleteWnfStateSubscription:qword
        extrn '__imp_ZwSetTimer2' as ZwSetTimer2:qword
        extrn '__imp_ZwSetWnfProcessNotificationEvent' as ZwSetWnfProcessNotificationEvent:qword
    end if

    if (NTDDI_VERSION >= NTDDI_WIN10)
        extrn '__imp_ApiSetQueryApiSetPresenceEx' as ApiSetQueryApiSetPresenceEx:qword
        extrn '__imp_DbgUiConvertStateChangeStructureEx' as DbgUiConvertStateChangeStructureEx:qword
        extrn '__imp_LdrCallEnclave' as LdrCallEnclave:qword
        extrn '__imp_LdrControlFlowGuardEnforced' as LdrControlFlowGuardEnforced:qword
        extrn '__imp_LdrCreateEnclave' as LdrCreateEnclave:qword
        extrn '__imp_LdrDeleteEnclave' as LdrDeleteEnclave:qword
        extrn '__imp_LdrFastFailInLoaderCallout' as LdrFastFailInLoaderCallout:qword
        extrn '__imp_LdrInitializeEnclave' as LdrInitializeEnclave:qword
        extrn '__imp_LdrIsModuleSxsRedirected' as LdrIsModuleSxsRedirected:qword
        extrn '__imp_LdrUpdatePackageSearchPath' as LdrUpdatePackageSearchPath:qword
        extrn '__imp_NtAcquireProcessActivityReference' as NtAcquireProcessActivityReference:qword
        extrn '__imp_NtAllocateVirtualMemoryEx' as NtAllocateVirtualMemoryEx:qword
        extrn '__imp_NtAlpcImpersonateClientContainerOfPort' as NtAlpcImpersonateClientContainerOfPort:qword
        extrn '__imp_NtCallEnclave' as NtCallEnclave:qword
        extrn '__imp_NtCommitRegistryTransaction' as NtCommitRegistryTransaction:qword
        extrn '__imp_NtCompareObjects' as NtCompareObjects:qword
        extrn '__imp_NtCompareSigningLevels' as NtCompareSigningLevels:qword
        extrn '__imp_NtConvertBetweenAuxiliaryCounterAndPerformanceCounter' as NtConvertBetweenAuxiliaryCounterAndPerformanceCounter:qword
        extrn '__imp_NtCreateCrossVmEvent' as NtCreateCrossVmEvent:qword
        extrn '__imp_NtCreateEnclave' as NtCreateEnclave:qword
        extrn '__imp_NtCreatePartition' as NtCreatePartition:qword
        extrn '__imp_NtCreateRegistryTransaction' as NtCreateRegistryTransaction:qword
        extrn '__imp_NtCreateSectionEx' as NtCreateSectionEx:qword
        extrn '__imp_NtGetCurrentProcessorNumberEx' as NtGetCurrentProcessorNumberEx:qword
        extrn '__imp_NtInitializeEnclave' as NtInitializeEnclave:qword
        extrn '__imp_NtLoadEnclaveData' as NtLoadEnclaveData:qword
        extrn '__imp_NtManageHotPatch' as NtManageHotPatch:qword
        extrn '__imp_NtManagePartition' as NtManagePartition:qword
        extrn '__imp_NtMapViewOfSectionEx' as NtMapViewOfSectionEx:qword
        extrn '__imp_NtOpenPartition' as NtOpenPartition:qword
        extrn '__imp_NtOpenRegistryTransaction' as NtOpenRegistryTransaction:qword
        extrn '__imp_NtQueryAuxiliaryCounterFrequency' as NtQueryAuxiliaryCounterFrequency:qword
        extrn '__imp_NtQueryDirectoryFileEx' as NtQueryDirectoryFileEx:qword
        extrn '__imp_NtQueryInformationByName' as NtQueryInformationByName:qword
        extrn '__imp_NtQuerySecurityPolicy' as NtQuerySecurityPolicy:qword
        extrn '__imp_NtRevertContainerImpersonation' as NtRevertContainerImpersonation:qword
        extrn '__imp_NtRollbackRegistryTransaction' as NtRollbackRegistryTransaction:qword
        extrn '__imp_NtSetCachedSigningLevel2' as NtSetCachedSigningLevel2:qword
        extrn '__imp_NtSetInformationSymbolicLink' as NtSetInformationSymbolicLink:qword
        extrn '__imp_NtTerminateEnclave' as NtTerminateEnclave:qword
        extrn '__imp_RtlAddAccessFilterAce' as RtlAddAccessFilterAce:qword
        extrn '__imp_RtlAreLongPathsEnabled' as RtlAreLongPathsEnabled:qword
        extrn '__imp_RtlCapabilityCheck' as RtlCapabilityCheck:qword
        extrn '__imp_RtlCapabilityCheckForSingleSessionSku' as RtlCapabilityCheckForSingleSessionSku:qword
        extrn '__imp_RtlCheckBootStatusIntegrity' as RtlCheckBootStatusIntegrity:qword
        extrn '__imp_RtlCheckSystemBootStatusIntegrity' as RtlCheckSystemBootStatusIntegrity:qword
        extrn '__imp_RtlClearThreadWorkOnBehalfTicket' as RtlClearThreadWorkOnBehalfTicket:qword
        extrn '__imp_RtlConstructCrossVmEventPath' as RtlConstructCrossVmEventPath:qword
        extrn '__imp_RtlConvertDeviceFamilyInfoToString' as RtlConvertDeviceFamilyInfoToString:qword
        extrn '__imp_RtlConvertSRWLockExclusiveToShared' as RtlConvertSRWLockExclusiveToShared:qword
        extrn '__imp_RtlCreateProcessParametersWithTemplate' as RtlCreateProcessParametersWithTemplate:qword
        extrn '__imp_RtlCreateUserProcessEx' as RtlCreateUserProcessEx:qword
        extrn '__imp_RtlDecodeRemotePointer' as RtlDecodeRemotePointer:qword
        extrn '__imp_RtlDeriveCapabilitySidsFromName' as RtlDeriveCapabilitySidsFromName:qword
        extrn '__imp_RtlDoesNameContainWildCards' as RtlDoesNameContainWildCards:qword
        extrn '__imp_RtlDosLongPathNameToNtPathName_U_WithStatus' as RtlDosLongPathNameToNtPathName_U_WithStatus:qword
        extrn '__imp_RtlDosLongPathNameToRelativeNtPathName_U_WithStatus' as RtlDosLongPathNameToRelativeNtPathName_U_WithStatus:qword
        extrn '__imp_RtlDrainNonVolatileFlush' as RtlDrainNonVolatileFlush:qword
        extrn '__imp_RtlEncodeRemotePointer' as RtlEncodeRemotePointer:qword
        extrn '__imp_RtlEndStrongEnumerationHashTable' as RtlEndStrongEnumerationHashTable:qword
        extrn '__imp_RtlExtendCorrelationVector' as RtlExtendCorrelationVector:qword
        extrn '__imp_RtlFillMemoryNonTemporal' as RtlFillMemoryNonTemporal:qword
        extrn '__imp_RtlFillNonVolatileMemory' as RtlFillNonVolatileMemory:qword
        extrn '__imp_RtlFindExportedRoutineByName' as RtlFindExportedRoutineByName:qword
        extrn '__imp_RtlFindUnicodeSubstring' as RtlFindUnicodeSubstring:qword
        extrn '__imp_RtlFlsGetValue' as RtlFlsGetValue:qword
        extrn '__imp_RtlFlsSetValue' as RtlFlsSetValue:qword
        extrn '__imp_RtlFlushNonVolatileMemory' as RtlFlushNonVolatileMemory:qword
        extrn '__imp_RtlFlushNonVolatileMemoryRanges' as RtlFlushNonVolatileMemoryRanges:qword
        extrn '__imp_RtlFreeNonVolatileToken' as RtlFreeNonVolatileToken:qword
        extrn '__imp_RtlGetActiveConsoleId' as RtlGetActiveConsoleId:qword
        extrn '__imp_RtlGetConsoleSessionForegroundProcessId' as RtlGetConsoleSessionForegroundProcessId:qword
        extrn '__imp_RtlGetCurrentServiceSessionId' as RtlGetCurrentServiceSessionId:qword
        extrn '__imp_RtlGetDeviceFamilyInfoEnum' as RtlGetDeviceFamilyInfoEnum:qword
        extrn '__imp_RtlGetExtendedContextLength2' as RtlGetExtendedContextLength2:qword
        extrn '__imp_RtlGetInterruptTimePrecise' as RtlGetInterruptTimePrecise:qword
        extrn '__imp_RtlGetMultiTimePrecise' as RtlGetMultiTimePrecise:qword
        extrn '__imp_RtlGetNonVolatileToken' as RtlGetNonVolatileToken:qword
        extrn '__imp_RtlGetNtSystemRoot' as RtlGetNtSystemRoot:qword
        extrn '__imp_RtlGetPersistedStateLocation' as RtlGetPersistedStateLocation:qword
        extrn '__imp_RtlGetSessionProperties' as RtlGetSessionProperties:qword
        extrn '__imp_RtlGetSuiteMask' as RtlGetSuiteMask:qword
        extrn '__imp_RtlGetSystemBootStatus' as RtlGetSystemBootStatus:qword
        extrn '__imp_RtlGetSystemBootStatusEx' as RtlGetSystemBootStatusEx:qword
        extrn '__imp_RtlGetThreadWorkOnBehalfTicket' as RtlGetThreadWorkOnBehalfTicket:qword
        extrn '__imp_RtlGetTokenNamedObjectPath' as RtlGetTokenNamedObjectPath:qword
        extrn '__imp_RtlGuardCheckLongJumpTarget' as RtlGuardCheckLongJumpTarget:qword
        extrn '__imp_RtlIncrementCorrelationVector' as RtlIncrementCorrelationVector:qword
        extrn '__imp_RtlInitializeCorrelationVector' as RtlInitializeCorrelationVector:qword
        extrn '__imp_RtlInitializeExtendedContext2' as RtlInitializeExtendedContext2:qword
        extrn '__imp_RtlInitializeSidEx' as RtlInitializeSidEx:qword
        extrn '__imp_RtlInitStringEx' as RtlInitStringEx:qword
        extrn '__imp_RtlInitStrongEnumerationHashTable' as RtlInitStrongEnumerationHashTable:qword
        extrn '__imp_RtlIsCloudFilesPlaceholder' as RtlIsCloudFilesPlaceholder:qword
        extrn '__imp_RtlIsCurrentProcess' as RtlIsCurrentProcess:qword
        extrn '__imp_RtlIsCurrentThread' as RtlIsCurrentThread:qword
        extrn '__imp_RtlIsElevatedRid' as RtlIsElevatedRid:qword
        extrn '__imp_RtlIsMultiSessionSku' as RtlIsMultiSessionSku:qword
        extrn '__imp_RtlIsMultiUsersInSessionSku' as RtlIsMultiUsersInSessionSku:qword
        extrn '__imp_RtlIsNameInUnUpcasedExpression' as RtlIsNameInUnUpcasedExpression:qword
        extrn '__imp_RtlIsNonEmptyDirectoryReparsePointAllowed' as RtlIsNonEmptyDirectoryReparsePointAllowed:qword
        extrn '__imp_RtlIsPartialPlaceholder' as RtlIsPartialPlaceholder:qword
        extrn '__imp_RtlIsPartialPlaceholderFileHandle' as RtlIsPartialPlaceholderFileHandle:qword
        extrn '__imp_RtlIsPartialPlaceholderFileInfo' as RtlIsPartialPlaceholderFileInfo:qword
        extrn '__imp_RtlIsProcessorFeaturePresent' as RtlIsProcessorFeaturePresent:qword
        extrn '__imp_RtlIsStateSeparationEnabled' as RtlIsStateSeparationEnabled:qword
        extrn '__imp_RtlLocateExtendedFeature2' as RtlLocateExtendedFeature2:qword
        extrn '__imp_RtlLookupFirstMatchingElementGenericTableAvl' as RtlLookupFirstMatchingElementGenericTableAvl:qword
        extrn '__imp_RtlOsDeploymentState' as RtlOsDeploymentState:qword
        extrn '__imp_RtlQueryImageMitigationPolicy' as RtlQueryImageMitigationPolicy:qword
        extrn '__imp_RtlQueryPackageClaims' as RtlQueryPackageClaims:qword
        extrn '__imp_RtlQueryProcessPlaceholderCompatibilityMode' as RtlQueryProcessPlaceholderCompatibilityMode:qword
        extrn '__imp_RtlQueryProtectedPolicy' as RtlQueryProtectedPolicy:qword
        extrn '__imp_RtlQueryRegistryValueWithFallback' as RtlQueryRegistryValueWithFallback:qword
        extrn '__imp_RtlQueryThreadPlaceholderCompatibilityMode' as RtlQueryThreadPlaceholderCompatibilityMode:qword
        extrn '__imp_RtlQueryTokenHostIdAsUlong64' as RtlQueryTokenHostIdAsUlong64:qword
        extrn '__imp_RtlRaiseCustomSystemEventTrigger' as RtlRaiseCustomSystemEventTrigger:qword
        extrn '__imp_RtlReplaceSystemDirectoryInPath' as RtlReplaceSystemDirectoryInPath:qword
        extrn '__imp_RtlReportExceptionEx' as RtlReportExceptionEx:qword
        extrn '__imp_RtlRestoreBootStatusDefaults' as RtlRestoreBootStatusDefaults:qword
        extrn '__imp_RtlRestoreSystemBootStatusDefaults' as RtlRestoreSystemBootStatusDefaults:qword
        extrn '__imp_RtlSetImageMitigationPolicy' as RtlSetImageMitigationPolicy:qword
        extrn '__imp_RtlSetProcessPlaceholderCompatibilityMode' as RtlSetProcessPlaceholderCompatibilityMode:qword
        extrn '__imp_RtlSetProtectedPolicy' as RtlSetProtectedPolicy:qword
        extrn '__imp_RtlSetProxiedProcessId' as RtlSetProxiedProcessId:qword
        extrn '__imp_RtlSetSystemBootStatus' as RtlSetSystemBootStatus:qword
        extrn '__imp_RtlSetSystemBootStatusEx' as RtlSetSystemBootStatusEx:qword
        extrn '__imp_RtlSetThreadPlaceholderCompatibilityMode' as RtlSetThreadPlaceholderCompatibilityMode:qword
        extrn '__imp_RtlSetThreadSubProcessTag' as RtlSetThreadSubProcessTag:qword
        extrn '__imp_RtlSetThreadWorkOnBehalfTicket' as RtlSetThreadWorkOnBehalfTicket:qword
        extrn '__imp_RtlStronglyEnumerateEntryHashTable' as RtlStronglyEnumerateEntryHashTable:qword
        extrn '__imp_RtlSwitchedVVI' as RtlSwitchedVVI:qword
        extrn '__imp_RtlUdiv128' as RtlUdiv128:qword
        extrn '__imp_RtlValidateCorrelationVector' as RtlValidateCorrelationVector:qword
        extrn '__imp_RtlWow64GetCpuAreaInfo' as RtlWow64GetCpuAreaInfo:qword
        extrn '__imp_RtlWow64GetCurrentMachine' as RtlWow64GetCurrentMachine:qword
        extrn '__imp_RtlWow64GetequivalentMachineCHPE' as RtlWow64GetequivalentMachineCHPE:qword
        extrn '__imp_RtlWow64GetProcessMachines' as RtlWow64GetProcessMachines:qword
        extrn '__imp_RtlWow64GetSharedInfoProcess' as RtlWow64GetSharedInfoProcess:qword
        extrn '__imp_RtlWow64IsWowGuestMachineSupported' as RtlWow64IsWowGuestMachineSupported:qword
        extrn '__imp_RtlWriteNonVolatileMemory' as RtlWriteNonVolatileMemory:qword
        extrn '__imp_RtlpGetDeviceFamilyInfoEnum' as RtlpGetDeviceFamilyInfoEnum:qword
        extrn '__imp_RtlpTimeFieldsToTime' as RtlpTimeFieldsToTime:qword
        extrn '__imp_RtlpTimeToTimeFields' as RtlpTimeToTimeFields:qword
        extrn '__imp_TpSetPoolMaxThreadsSoftLimit' as TpSetPoolMaxThreadsSoftLimit:qword
        extrn '__imp_TpSetPoolThreadCpuSets' as TpSetPoolThreadCpuSets:qword
        extrn '__imp_TpSetPoolWorkerThreadIdleTimeout' as TpSetPoolWorkerThreadIdleTimeout:qword
        extrn '__imp_WerReportExceptionWorker' as WerReportExceptionWorker:qword
        extrn '__imp_WinSqmStartSqmOptinListener' as WinSqmStartSqmOptinListener:qword
        extrn '__imp_ZwAcquireProcessActivityReference' as ZwAcquireProcessActivityReference:qword
        extrn '__imp_ZwAllocateVirtualMemoryEx' as ZwAllocateVirtualMemoryEx:qword
        extrn '__imp_ZwAlpcImpersonateClientContainerOfPort' as ZwAlpcImpersonateClientContainerOfPort:qword
        extrn '__imp_ZwCallEnclave' as ZwCallEnclave:qword
        extrn '__imp_ZwCommitRegistryTransaction' as ZwCommitRegistryTransaction:qword
        extrn '__imp_ZwCompareObjects' as ZwCompareObjects:qword
        extrn '__imp_ZwCompareSigningLevels' as ZwCompareSigningLevels:qword
        extrn '__imp_ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter' as ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter:qword
        extrn '__imp_ZwCreateCrossVmEvent' as ZwCreateCrossVmEvent:qword
        extrn '__imp_ZwCreateEnclave' as ZwCreateEnclave:qword
        extrn '__imp_ZwCreatePartition' as ZwCreatePartition:qword
        extrn '__imp_ZwCreateRegistryTransaction' as ZwCreateRegistryTransaction:qword
        extrn '__imp_ZwCreateSectionEx' as ZwCreateSectionEx:qword
        extrn '__imp_ZwGetCurrentProcessorNumberEx' as ZwGetCurrentProcessorNumberEx:qword
        extrn '__imp_ZwInitializeEnclave' as ZwInitializeEnclave:qword
        extrn '__imp_ZwLoadEnclaveData' as ZwLoadEnclaveData:qword
        extrn '__imp_ZwManageHotPatch' as ZwManageHotPatch:qword
        extrn '__imp_ZwManagePartition' as ZwManagePartition:qword
        extrn '__imp_ZwMapViewOfSectionEx' as ZwMapViewOfSectionEx:qword
        extrn '__imp_ZwNotifyChangeDirectoryFileEx' as ZwNotifyChangeDirectoryFileEx:qword
        extrn '__imp_ZwOpenPartition' as ZwOpenPartition:qword
        extrn '__imp_ZwOpenRegistryTransaction' as ZwOpenRegistryTransaction:qword
        extrn '__imp_ZwQueryAuxiliaryCounterFrequency' as ZwQueryAuxiliaryCounterFrequency:qword
        extrn '__imp_ZwQueryInformationByName' as ZwQueryInformationByName:qword
        extrn '__imp_ZwQuerySecurityPolicy' as ZwQuerySecurityPolicy:qword
        extrn '__imp_ZwRevertContainerImpersonation' as ZwRevertContainerImpersonation:qword
        extrn '__imp_ZwRollbackRegistryTransaction' as ZwRollbackRegistryTransaction:qword
        extrn '__imp_ZwSetCachedSigningLevel2' as ZwSetCachedSigningLevel2:qword
        extrn '__imp_ZwSetInformationSymbolicLink' as ZwSetInformationSymbolicLink:qword
        extrn '__imp_ZwTerminateEnclave' as ZwTerminateEnclave:qword
        extrn '__imp__vscprintf' as _vscprintf:qword
        extrn '__imp_atan2' as atan2:qword
        extrn '__imp_bsearch_s' as bsearch_s:qword

        api EtwRegisterTraceGuids,\
            RtlIpv4AddressToStringEx,\
            RtlIpv4AddressToString,\
            RtlIpv4StringToAddressEx,\
            RtlIpv4StringToAddress,\
            RtlIpv6AddressToStringEx,\
            RtlIpv6AddressToString,\
            RtlIpv6StringToAddressEx,\
            RtlIpv6StringToAddress
    end if
else
    extrn '__imp__CsrAllocateCaptureBuffer@8' as CsrAllocateCaptureBuffer:dword
    extrn '__imp__CsrAllocateMessagePointer@12' as CsrAllocateMessagePointer:dword
    extrn '__imp__CsrCaptureMessageBuffer@16' as CsrCaptureMessageBuffer:dword
    extrn '__imp__CsrCaptureMessageMultiUnicodeStringsInPlace@12' as CsrCaptureMessageMultiUnicodeStringsInPlace:dword
    extrn '__imp__CsrCaptureMessageString@20' as CsrCaptureMessageString:dword
    extrn '__imp__CsrCaptureTimeout@8' as CsrCaptureTimeout:dword
    extrn '__imp__CsrClientCallServer@16' as CsrClientCallServer:dword
    extrn '__imp__CsrClientConnectToServer@20' as CsrClientConnectToServer:dword
    extrn '__imp__CsrFreeCaptureBuffer@4' as CsrFreeCaptureBuffer:dword
    extrn '__imp__CsrGetProcessId@0' as CsrGetProcessId:dword
    extrn '__imp__CsrIdentifyAlertableThread@0' as CsrIdentifyAlertableThread:dword
    extrn '__imp__CsrNewThread@0' as CsrNewThread:dword
    extrn '__imp__CsrProbeForRead@12' as CsrProbeForRead:dword
    extrn '__imp__CsrProbeForWrite@12' as CsrProbeForWrite:dword
    extrn '__imp__CsrSetPriorityClass@8' as CsrSetPriorityClass:dword
    extrn '__imp__DbgBreakPoint@0' as DbgBreakPoint:dword
    extrn '__imp__DbgPrint@4' as DbgPrint:dword
    extrn '__imp__DbgPrintEx@4' as DbgPrintEx:dword
    extrn '__imp__DbgPrintReturnControlC@4' as DbgPrintReturnControlC:dword
    extrn '__imp__DbgPrompt@12' as DbgPrompt:dword
    extrn '__imp__DbgQueryDebugFilterState@8' as DbgQueryDebugFilterState:dword
    extrn '__imp__DbgSetDebugFilterState@12' as DbgSetDebugFilterState:dword
    extrn '__imp__DbgUiConnectToDbg@0' as DbgUiConnectToDbg:dword
    extrn '__imp__DbgUiContinue@8' as DbgUiContinue:dword
    extrn '__imp__DbgUiConvertStateChangeStructure@8' as DbgUiConvertStateChangeStructure:dword
    extrn '__imp__DbgUiDebugActiveProcess@4' as DbgUiDebugActiveProcess:dword
    extrn '__imp__DbgUiGetThreadDebugObject@0' as DbgUiGetThreadDebugObject:dword
    extrn '__imp__DbgUiIssueRemoteBreakin@4' as DbgUiIssueRemoteBreakin:dword
    extrn '__imp__DbgUiRemoteBreakin@4' as DbgUiRemoteBreakin:dword
    extrn '__imp__DbgUiSetThreadDebugObject@4' as DbgUiSetThreadDebugObject:dword
    extrn '__imp__DbgUiStopDebugging@4' as DbgUiStopDebugging:dword
    extrn '__imp__DbgUiWaitStateChange@8' as DbgUiWaitStateChange:dword
    extrn '__imp__DbgUserBreakPoint@0' as DbgUserBreakPoint:dword
    extrn '__imp__KiFastSystemCall@0' as KiFastSystemCall:dword
    extrn '__imp__KiFastSystemCallRet@0' as KiFastSystemCallRet:dword
    extrn '__imp__KiIntSystemCall@0' as KiIntSystemCall:dword
    extrn '__imp__KiRaiseUserExceptionDispatcher@0' as KiRaiseUserExceptionDispatcher:dword
    extrn '__imp__KiUserApcDispatcher@20' as KiUserApcDispatcher:dword
    extrn '__imp__KiUserCallbackDispatcher@12' as KiUserCallbackDispatcher:dword
    extrn '__imp__KiUserExceptionDispatcher@8' as KiUserExceptionDispatcher:dword
    extrn '__imp__LdrAccessOutOfProcessResource@20' as LdrAccessOutOfProcessResource:dword
    extrn '__imp__LdrAccessResource@16' as LdrAccessResource:dword
    extrn '__imp__LdrAddRefDll@8' as LdrAddRefDll:dword
    extrn '__imp__LdrAlternateResourcesEnabled@0' as LdrAlternateResourcesEnabled:dword
    extrn '__imp__LdrCreateOutOfProcessImage@16' as LdrCreateOutOfProcessImage:dword
    extrn '__imp__LdrDestroyOutOfProcessImage@4' as LdrDestroyOutOfProcessImage:dword
    extrn '__imp__LdrDisableThreadCalloutsForDll@4' as LdrDisableThreadCalloutsForDll:dword
    extrn '__imp__LdrEnumerateLoadedModules@12' as LdrEnumerateLoadedModules:dword
    extrn '__imp__LdrEnumResources@20' as LdrEnumResources:dword
    extrn '__imp__LdrFindCreateProcessManifest@20' as LdrFindCreateProcessManifest:dword
    extrn '__imp__LdrFindEntryForAddress@8' as LdrFindEntryForAddress:dword
    extrn '__imp__LdrFindResource_U@16' as LdrFindResource_U:dword
    extrn '__imp__LdrFindResourceDirectory_U@16' as LdrFindResourceDirectory_U:dword
    extrn '__imp__LdrFindResourceEx_U@20' as LdrFindResourceEx_U:dword
    extrn '__imp__LdrFlushAlternateResourceModules@0' as LdrFlushAlternateResourceModules:dword
    extrn '__imp__LdrGetDllHandle@16' as LdrGetDllHandle:dword
    extrn '__imp__LdrGetDllHandleEx@20' as LdrGetDllHandleEx:dword
    extrn '__imp__LdrGetProcedureAddress@16' as LdrGetProcedureAddress:dword
    extrn '__imp__LdrHotPatchRoutine@4' as LdrHotPatchRoutine:dword
    extrn '__imp__LdrInitializeThunk@16' as LdrInitializeThunk:dword
    extrn '__imp__LdrInitShimEngineDynamic@4' as LdrInitShimEngineDynamic:dword
    extrn '__imp__LdrLoadAlternateResourceModule@8' as LdrLoadAlternateResourceModule:dword
    extrn '__imp__LdrLoadDll@16' as LdrLoadDll:dword
    extrn '__imp__LdrLockLoaderLock@12' as LdrLockLoaderLock:dword
    extrn '__imp__LdrProcessRelocationBlock@16' as LdrProcessRelocationBlock:dword
    extrn '__imp__LdrQueryImageFileExecutionOptions@24' as LdrQueryImageFileExecutionOptions:dword
    extrn '__imp__LdrQueryProcessModuleInformation@12' as LdrQueryProcessModuleInformation:dword
    extrn '__imp__LdrSetAppCompatDllRedirectionCallback@12' as LdrSetAppCompatDllRedirectionCallback:dword
    extrn '__imp__LdrSetDllManifestProber@4' as LdrSetDllManifestProber:dword
    extrn '__imp__LdrShutdownProcess@0' as LdrShutdownProcess:dword
    extrn '__imp__LdrShutdownThread@0' as LdrShutdownThread:dword
    extrn '__imp__LdrUnloadAlternateResourceModule@4' as LdrUnloadAlternateResourceModule:dword
    extrn '__imp__LdrUnloadDll@4' as LdrUnloadDll:dword
    extrn '__imp__LdrUnlockLoaderLock@8' as LdrUnlockLoaderLock:dword
    extrn '__imp__LdrVerifyImageMatchesChecksum@16' as LdrVerifyImageMatchesChecksum:dword
    extrn '__imp__NlsAnsiCodePage@4' as NlsAnsiCodePage:dword
    extrn '__imp__NlsMbCodePageTag@4' as NlsMbCodePageTag:dword
    extrn '__imp__NlsMbOemCodePageTag@4' as NlsMbOemCodePageTag:dword
    extrn '__imp__NtAcceptConnectPort@24' as NtAcceptConnectPort:dword
    extrn '__imp__NtAccessCheck@32' as NtAccessCheck:dword
    extrn '__imp__NtAccessCheckAndAuditAlarm@44' as NtAccessCheckAndAuditAlarm:dword
    extrn '__imp__NtAccessCheckByType@44' as NtAccessCheckByType:dword
    extrn '__imp__NtAccessCheckByTypeAndAuditAlarm@64' as NtAccessCheckByTypeAndAuditAlarm:dword
    extrn '__imp__NtAccessCheckByTypeResultList@44' as NtAccessCheckByTypeResultList:dword
    extrn '__imp__NtAccessCheckByTypeResultListAndAuditAlarm@64' as NtAccessCheckByTypeResultListAndAuditAlarm:dword
    extrn '__imp__NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68' as NtAccessCheckByTypeResultListAndAuditAlarmByHandle:dword
    extrn '__imp__NtAddAtom@12' as NtAddAtom:dword
    extrn '__imp__NtAddBootEntry@8' as NtAddBootEntry:dword
    extrn '__imp__NtAdjustGroupsToken@24' as NtAdjustGroupsToken:dword
    extrn '__imp__NtAdjustPrivilegesToken@24' as NtAdjustPrivilegesToken:dword
    extrn '__imp__NtAlertResumeThread@8' as NtAlertResumeThread:dword
    extrn '__imp__NtAlertThread@4' as NtAlertThread:dword
    extrn '__imp__NtAllocateLocallyUniqueId@4' as NtAllocateLocallyUniqueId:dword
    extrn '__imp__NtAllocateUserPhysicalPages@12' as NtAllocateUserPhysicalPages:dword
    extrn '__imp__NtAllocateUuids@16' as NtAllocateUuids:dword
    extrn '__imp__NtAllocateVirtualMemory@24' as NtAllocateVirtualMemory:dword
    extrn '__imp__NtAreMappedFilesTheSame@8' as NtAreMappedFilesTheSame:dword
    extrn '__imp__NtAssignProcessToJobObject@8' as NtAssignProcessToJobObject:dword
    extrn '__imp__NtCallbackReturn@12' as NtCallbackReturn:dword
    extrn '__imp__NtCancelDeviceWakeupRequest@4' as NtCancelDeviceWakeupRequest:dword
    extrn '__imp__NtCancelIoFile@8' as NtCancelIoFile:dword
    extrn '__imp__NtCancelTimer@8' as NtCancelTimer:dword
    extrn '__imp__NtClearEvent@4' as NtClearEvent:dword
    extrn '__imp__NtClose@4' as NtClose:dword
    extrn '__imp__NtCloseObjectAuditAlarm@12' as NtCloseObjectAuditAlarm:dword
    extrn '__imp__NtCompactKeys@8' as NtCompactKeys:dword
    extrn '__imp__NtCompareTokens@12' as NtCompareTokens:dword
    extrn '__imp__NtCompleteConnectPort@4' as NtCompleteConnectPort:dword
    extrn '__imp__NtCompressKey@4' as NtCompressKey:dword
    extrn '__imp__NtConnectPort@32' as NtConnectPort:dword
    extrn '__imp__NtContinue@8' as NtContinue:dword
    extrn '__imp__NtCreateDebugObject@16' as NtCreateDebugObject:dword
    extrn '__imp__NtCreateDirectoryObject@12' as NtCreateDirectoryObject:dword
    extrn '__imp__NtCreateEvent@20' as NtCreateEvent:dword
    extrn '__imp__NtCreateEventPair@12' as NtCreateEventPair:dword
    extrn '__imp__NtCreateFile@44' as NtCreateFile:dword
    extrn '__imp__NtCreateIoCompletion@16' as NtCreateIoCompletion:dword
    extrn '__imp__NtCreateJobObject@12' as NtCreateJobObject:dword
    extrn '__imp__NtCreateJobSet@12' as NtCreateJobSet:dword
    extrn '__imp__NtCreateKey@28' as NtCreateKey:dword
    extrn '__imp__NtCreateKeyedEvent@16' as NtCreateKeyedEvent:dword
    extrn '__imp__NtCreateMailslotFile@32' as NtCreateMailslotFile:dword
    extrn '__imp__NtCreateMutant@16' as NtCreateMutant:dword
    extrn '__imp__NtCreateNamedPipeFile@56' as NtCreateNamedPipeFile:dword
    extrn '__imp__NtCreatePagingFile@16' as NtCreatePagingFile:dword
    extrn '__imp__NtCreatePort@20' as NtCreatePort:dword
    extrn '__imp__NtCreateProcess@32' as NtCreateProcess:dword
    extrn '__imp__NtCreateProcessEx@36' as NtCreateProcessEx:dword
    extrn '__imp__NtCreateProfile@36' as NtCreateProfile:dword
    extrn '__imp__NtCreateSection@28' as NtCreateSection:dword
    extrn '__imp__NtCreateSemaphore@20' as NtCreateSemaphore:dword
    extrn '__imp__NtCreateSymbolicLinkObject@16' as NtCreateSymbolicLinkObject:dword
    extrn '__imp__NtCreateThread@32' as NtCreateThread:dword
    extrn '__imp__NtCreateTimer@16' as NtCreateTimer:dword
    extrn '__imp__NtCreateToken@52' as NtCreateToken:dword
    extrn '__imp__NtCreateWaitablePort@20' as NtCreateWaitablePort:dword
    extrn '__imp__NtCurrentTeb@0' as NtCurrentTeb:dword
    extrn '__imp__NtDebugActiveProcess@8' as NtDebugActiveProcess:dword
    extrn '__imp__NtDebugContinue@12' as NtDebugContinue:dword
    extrn '__imp__NtDelayExecution@8' as NtDelayExecution:dword
    extrn '__imp__NtDeleteAtom@4' as NtDeleteAtom:dword
    extrn '__imp__NtDeleteBootEntry@4' as NtDeleteBootEntry:dword
    extrn '__imp__NtDeleteFile@4' as NtDeleteFile:dword
    extrn '__imp__NtDeleteKey@4' as NtDeleteKey:dword
    extrn '__imp__NtDeleteObjectAuditAlarm@12' as NtDeleteObjectAuditAlarm:dword
    extrn '__imp__NtDeleteValueKey@8' as NtDeleteValueKey:dword
    extrn '__imp__NtDeviceIoControlFile@40' as NtDeviceIoControlFile:dword
    extrn '__imp__NtDisplayString@4' as NtDisplayString:dword
    extrn '__imp__NtDuplicateObject@28' as NtDuplicateObject:dword
    extrn '__imp__NtDuplicateToken@24' as NtDuplicateToken:dword
    extrn '__imp__NtEnumerateBootEntries@8' as NtEnumerateBootEntries:dword
    extrn '__imp__NtEnumerateKey@24' as NtEnumerateKey:dword
    extrn '__imp__NtEnumerateSystemEnvironmentValuesEx@12' as NtEnumerateSystemEnvironmentValuesEx:dword
    extrn '__imp__NtEnumerateValueKey@24' as NtEnumerateValueKey:dword
    extrn '__imp__NtExtendSection@8' as NtExtendSection:dword
    extrn '__imp__NtFilterToken@24' as NtFilterToken:dword
    extrn '__imp__NtFindAtom@12' as NtFindAtom:dword
    extrn '__imp__NtFlushBuffersFile@8' as NtFlushBuffersFile:dword
    extrn '__imp__NtFlushInstructionCache@12' as NtFlushInstructionCache:dword
    extrn '__imp__NtFlushKey@4' as NtFlushKey:dword
    extrn '__imp__NtFlushVirtualMemory@16' as NtFlushVirtualMemory:dword
    extrn '__imp__NtFlushWriteBuffer@0' as NtFlushWriteBuffer:dword
    extrn '__imp__NtFreeUserPhysicalPages@12' as NtFreeUserPhysicalPages:dword
    extrn '__imp__NtFreeVirtualMemory@16' as NtFreeVirtualMemory:dword
    extrn '__imp__NtFsControlFile@40' as NtFsControlFile:dword
    extrn '__imp__NtGetContextThread@8' as NtGetContextThread:dword
    extrn '__imp__NtGetDevicePowerState@8' as NtGetDevicePowerState:dword
    extrn '__imp__NtGetPlugPlayEvent@16' as NtGetPlugPlayEvent:dword
    extrn '__imp__NtGetWriteWatch@28' as NtGetWriteWatch:dword
    extrn '__imp__NtImpersonateAnonymousToken@4' as NtImpersonateAnonymousToken:dword
    extrn '__imp__NtImpersonateClientOfPort@8' as NtImpersonateClientOfPort:dword
    extrn '__imp__NtImpersonateThread@12' as NtImpersonateThread:dword
    extrn '__imp__NtInitializeRegistry@4' as NtInitializeRegistry:dword
    extrn '__imp__NtInitiatePowerAction@16' as NtInitiatePowerAction:dword
    extrn '__imp__NtIsProcessInJob@8' as NtIsProcessInJob:dword
    extrn '__imp__NtIsSystemResumeAutomatic@0' as NtIsSystemResumeAutomatic:dword
    extrn '__imp__NtListenPort@8' as NtListenPort:dword
    extrn '__imp__NtLoadDriver@4' as NtLoadDriver:dword
    extrn '__imp__NtLoadKey@8' as NtLoadKey:dword
    extrn '__imp__NtLoadKey2@12' as NtLoadKey2:dword
    extrn '__imp__NtLockFile@40' as NtLockFile:dword
    extrn '__imp__NtLockProductActivationKeys@8' as NtLockProductActivationKeys:dword
    extrn '__imp__NtLockRegistryKey@4' as NtLockRegistryKey:dword
    extrn '__imp__NtLockVirtualMemory@16' as NtLockVirtualMemory:dword
    extrn '__imp__NtMakePermanentObject@4' as NtMakePermanentObject:dword
    extrn '__imp__NtMakeTemporaryObject@4' as NtMakeTemporaryObject:dword
    extrn '__imp__NtMapUserPhysicalPages@12' as NtMapUserPhysicalPages:dword
    extrn '__imp__NtMapUserPhysicalPagesScatter@12' as NtMapUserPhysicalPagesScatter:dword
    extrn '__imp__NtMapViewOfSection@40' as NtMapViewOfSection:dword
    extrn '__imp__NtModifyBootEntry@4' as NtModifyBootEntry:dword
    extrn '__imp__NtNotifyChangeDirectoryFile@36' as NtNotifyChangeDirectoryFile:dword
    extrn '__imp__NtNotifyChangeKey@40' as NtNotifyChangeKey:dword
    extrn '__imp__NtNotifyChangeMultipleKeys@48' as NtNotifyChangeMultipleKeys:dword
    extrn '__imp__NtOpenDirectoryObject@12' as NtOpenDirectoryObject:dword
    extrn '__imp__NtOpenEvent@12' as NtOpenEvent:dword
    extrn '__imp__NtOpenEventPair@12' as NtOpenEventPair:dword
    extrn '__imp__NtOpenFile@24' as NtOpenFile:dword
    extrn '__imp__NtOpenIoCompletion@12' as NtOpenIoCompletion:dword
    extrn '__imp__NtOpenJobObject@12' as NtOpenJobObject:dword
    extrn '__imp__NtOpenKey@12' as NtOpenKey:dword
    extrn '__imp__NtOpenKeyedEvent@12' as NtOpenKeyedEvent:dword
    extrn '__imp__NtOpenMutant@12' as NtOpenMutant:dword
    extrn '__imp__NtOpenObjectAuditAlarm@48' as NtOpenObjectAuditAlarm:dword
    extrn '__imp__NtOpenProcess@16' as NtOpenProcess:dword
    extrn '__imp__NtOpenProcessToken@12' as NtOpenProcessToken:dword
    extrn '__imp__NtOpenProcessTokenEx@16' as NtOpenProcessTokenEx:dword
    extrn '__imp__NtOpenSection@12' as NtOpenSection:dword
    extrn '__imp__NtOpenSemaphore@12' as NtOpenSemaphore:dword
    extrn '__imp__NtOpenSymbolicLinkObject@12' as NtOpenSymbolicLinkObject:dword
    extrn '__imp__NtOpenThread@16' as NtOpenThread:dword
    extrn '__imp__NtOpenThreadToken@16' as NtOpenThreadToken:dword
    extrn '__imp__NtOpenThreadTokenEx@20' as NtOpenThreadTokenEx:dword
    extrn '__imp__NtOpenTimer@12' as NtOpenTimer:dword
    extrn '__imp__NtPlugPlayControl@12' as NtPlugPlayControl:dword
    extrn '__imp__NtPowerInformation@20' as NtPowerInformation:dword
    extrn '__imp__NtPrivilegeCheck@12' as NtPrivilegeCheck:dword
    extrn '__imp__NtPrivilegedServiceAuditAlarm@20' as NtPrivilegedServiceAuditAlarm:dword
    extrn '__imp__NtPrivilegeObjectAuditAlarm@24' as NtPrivilegeObjectAuditAlarm:dword
    extrn '__imp__NtProtectVirtualMemory@20' as NtProtectVirtualMemory:dword
    extrn '__imp__NtPulseEvent@8' as NtPulseEvent:dword
    extrn '__imp__NtQueryAttributesFile@8' as NtQueryAttributesFile:dword
    extrn '__imp__NtQueryBootEntryOrder@8' as NtQueryBootEntryOrder:dword
    extrn '__imp__NtQueryBootOptions@8' as NtQueryBootOptions:dword
    extrn '__imp__NtQueryDebugFilterState@8' as NtQueryDebugFilterState:dword
    extrn '__imp__NtQueryDefaultLocale@8' as NtQueryDefaultLocale:dword
    extrn '__imp__NtQueryDefaultUILanguage@4' as NtQueryDefaultUILanguage:dword
    extrn '__imp__NtQueryDirectoryFile@44' as NtQueryDirectoryFile:dword
    extrn '__imp__NtQueryDirectoryObject@28' as NtQueryDirectoryObject:dword
    extrn '__imp__NtQueryEaFile@36' as NtQueryEaFile:dword
    extrn '__imp__NtQueryEvent@20' as NtQueryEvent:dword
    extrn '__imp__NtQueryFullAttributesFile@8' as NtQueryFullAttributesFile:dword
    extrn '__imp__NtQueryInformationAtom@20' as NtQueryInformationAtom:dword
    extrn '__imp__NtQueryInformationFile@20' as NtQueryInformationFile:dword
    extrn '__imp__NtQueryInformationJobObject@20' as NtQueryInformationJobObject:dword
    extrn '__imp__NtQueryInformationPort@20' as NtQueryInformationPort:dword
    extrn '__imp__NtQueryInformationProcess@20' as NtQueryInformationProcess:dword
    extrn '__imp__NtQueryInformationThread@20' as NtQueryInformationThread:dword
    extrn '__imp__NtQueryInformationToken@20' as NtQueryInformationToken:dword
    extrn '__imp__NtQueryInstallUILanguage@4' as NtQueryInstallUILanguage:dword
    extrn '__imp__NtQueryIntervalProfile@8' as NtQueryIntervalProfile:dword
    extrn '__imp__NtQueryIoCompletion@20' as NtQueryIoCompletion:dword
    extrn '__imp__NtQueryKey@20' as NtQueryKey:dword
    extrn '__imp__NtQueryMultipleValueKey@24' as NtQueryMultipleValueKey:dword
    extrn '__imp__NtQueryMutant@20' as NtQueryMutant:dword
    extrn '__imp__NtQueryObject@20' as NtQueryObject:dword
    extrn '__imp__NtQueryOpenSubKeys@8' as NtQueryOpenSubKeys:dword
    extrn '__imp__NtQueryPerformanceCounter@8' as NtQueryPerformanceCounter:dword
    extrn '__imp__NtQueryPortInformationProcess@0' as NtQueryPortInformationProcess:dword
    extrn '__imp__NtQueryQuotaInformationFile@36' as NtQueryQuotaInformationFile:dword
    extrn '__imp__NtQuerySection@20' as NtQuerySection:dword
    extrn '__imp__NtQuerySecurityObject@20' as NtQuerySecurityObject:dword
    extrn '__imp__NtQuerySemaphore@20' as NtQuerySemaphore:dword
    extrn '__imp__NtQuerySymbolicLinkObject@12' as NtQuerySymbolicLinkObject:dword
    extrn '__imp__NtQuerySystemEnvironmentValue@16' as NtQuerySystemEnvironmentValue:dword
    extrn '__imp__NtQuerySystemEnvironmentValueEx@20' as NtQuerySystemEnvironmentValueEx:dword
    extrn '__imp__NtQuerySystemInformation@16' as NtQuerySystemInformation:dword
    extrn '__imp__NtQuerySystemTime@4' as NtQuerySystemTime:dword
    extrn '__imp__NtQueryTimer@20' as NtQueryTimer:dword
    extrn '__imp__NtQueryTimerResolution@12' as NtQueryTimerResolution:dword
    extrn '__imp__NtQueryValueKey@24' as NtQueryValueKey:dword
    extrn '__imp__NtQueryVirtualMemory@24' as NtQueryVirtualMemory:dword
    extrn '__imp__NtQueryVolumeInformationFile@20' as NtQueryVolumeInformationFile:dword
    extrn '__imp__NtQueueApcThread@20' as NtQueueApcThread:dword
    extrn '__imp__NtRaiseException@12' as NtRaiseException:dword
    extrn '__imp__NtRaiseHardError@24' as NtRaiseHardError:dword
    extrn '__imp__NtReadFile@36' as NtReadFile:dword
    extrn '__imp__NtReadFileScatter@36' as NtReadFileScatter:dword
    extrn '__imp__NtReadRequestData@24' as NtReadRequestData:dword
    extrn '__imp__NtReadVirtualMemory@20' as NtReadVirtualMemory:dword
    extrn '__imp__NtRegisterThreadTerminatePort@4' as NtRegisterThreadTerminatePort:dword
    extrn '__imp__NtReleaseKeyedEvent@16' as NtReleaseKeyedEvent:dword
    extrn '__imp__NtReleaseMutant@8' as NtReleaseMutant:dword
    extrn '__imp__NtReleaseSemaphore@12' as NtReleaseSemaphore:dword
    extrn '__imp__NtRemoveIoCompletion@20' as NtRemoveIoCompletion:dword
    extrn '__imp__NtRemoveProcessDebug@8' as NtRemoveProcessDebug:dword
    extrn '__imp__NtRenameKey@8' as NtRenameKey:dword
    extrn '__imp__NtReplaceKey@12' as NtReplaceKey:dword
    extrn '__imp__NtReplyPort@8' as NtReplyPort:dword
    extrn '__imp__NtReplyWaitReceivePort@16' as NtReplyWaitReceivePort:dword
    extrn '__imp__NtReplyWaitReceivePortEx@20' as NtReplyWaitReceivePortEx:dword
    extrn '__imp__NtReplyWaitReplyPort@8' as NtReplyWaitReplyPort:dword
    extrn '__imp__NtRequestDeviceWakeup@4' as NtRequestDeviceWakeup:dword
    extrn '__imp__NtRequestPort@8' as NtRequestPort:dword
    extrn '__imp__NtRequestWaitReplyPort@12' as NtRequestWaitReplyPort:dword
    extrn '__imp__NtRequestWakeupLatency@4' as NtRequestWakeupLatency:dword
    extrn '__imp__NtResetEvent@8' as NtResetEvent:dword
    extrn '__imp__NtResetWriteWatch@12' as NtResetWriteWatch:dword
    extrn '__imp__NtRestoreKey@12' as NtRestoreKey:dword
    extrn '__imp__NtResumeProcess@4' as NtResumeProcess:dword
    extrn '__imp__NtResumeThread@8' as NtResumeThread:dword
    extrn '__imp__NtSaveKey@8' as NtSaveKey:dword
    extrn '__imp__NtSaveKeyEx@12' as NtSaveKeyEx:dword
    extrn '__imp__NtSaveMergedKeys@12' as NtSaveMergedKeys:dword
    extrn '__imp__NtSecureConnectPort@36' as NtSecureConnectPort:dword
    extrn '__imp__NtSetBootEntryOrder@8' as NtSetBootEntryOrder:dword
    extrn '__imp__NtSetBootOptions@8' as NtSetBootOptions:dword
    extrn '__imp__NtSetContextThread@8' as NtSetContextThread:dword
    extrn '__imp__NtSetDebugFilterState@12' as NtSetDebugFilterState:dword
    extrn '__imp__NtSetDefaultHardErrorPort@4' as NtSetDefaultHardErrorPort:dword
    extrn '__imp__NtSetDefaultLocale@8' as NtSetDefaultLocale:dword
    extrn '__imp__NtSetDefaultUILanguage@4' as NtSetDefaultUILanguage:dword
    extrn '__imp__NtSetEaFile@16' as NtSetEaFile:dword
    extrn '__imp__NtSetEvent@8' as NtSetEvent:dword
    extrn '__imp__NtSetEventBoostPriority@4' as NtSetEventBoostPriority:dword
    extrn '__imp__NtSetHighEventPair@4' as NtSetHighEventPair:dword
    extrn '__imp__NtSetHighWaitLowEventPair@4' as NtSetHighWaitLowEventPair:dword
    extrn '__imp__NtSetInformationDebugObject@20' as NtSetInformationDebugObject:dword
    extrn '__imp__NtSetInformationFile@20' as NtSetInformationFile:dword
    extrn '__imp__NtSetInformationJobObject@16' as NtSetInformationJobObject:dword
    extrn '__imp__NtSetInformationKey@16' as NtSetInformationKey:dword
    extrn '__imp__NtSetInformationObject@16' as NtSetInformationObject:dword
    extrn '__imp__NtSetInformationProcess@16' as NtSetInformationProcess:dword
    extrn '__imp__NtSetInformationThread@16' as NtSetInformationThread:dword
    extrn '__imp__NtSetInformationToken@16' as NtSetInformationToken:dword
    extrn '__imp__NtSetIntervalProfile@8' as NtSetIntervalProfile:dword
    extrn '__imp__NtSetIoCompletion@20' as NtSetIoCompletion:dword
    extrn '__imp__NtSetLdtEntries@24' as NtSetLdtEntries:dword
    extrn '__imp__NtSetLowEventPair@4' as NtSetLowEventPair:dword
    extrn '__imp__NtSetLowWaitHighEventPair@4' as NtSetLowWaitHighEventPair:dword
    extrn '__imp__NtSetQuotaInformationFile@16' as NtSetQuotaInformationFile:dword
    extrn '__imp__NtSetSecurityObject@12' as NtSetSecurityObject:dword
    extrn '__imp__NtSetSystemEnvironmentValue@8' as NtSetSystemEnvironmentValue:dword
    extrn '__imp__NtSetSystemEnvironmentValueEx@20' as NtSetSystemEnvironmentValueEx:dword
    extrn '__imp__NtSetSystemInformation@12' as NtSetSystemInformation:dword
    extrn '__imp__NtSetSystemPowerState@12' as NtSetSystemPowerState:dword
    extrn '__imp__NtSetSystemTime@8' as NtSetSystemTime:dword
    extrn '__imp__NtSetThreadExecutionState@8' as NtSetThreadExecutionState:dword
    extrn '__imp__NtSetTimer@28' as NtSetTimer:dword
    extrn '__imp__NtSetTimerResolution@12' as NtSetTimerResolution:dword
    extrn '__imp__NtSetUuidSeed@4' as NtSetUuidSeed:dword
    extrn '__imp__NtSetValueKey@24' as NtSetValueKey:dword
    extrn '__imp__NtSetVolumeInformationFile@20' as NtSetVolumeInformationFile:dword
    extrn '__imp__NtShutdownSystem@4' as NtShutdownSystem:dword
    extrn '__imp__NtSignalAndWaitForSingleObject@16' as NtSignalAndWaitForSingleObject:dword
    extrn '__imp__NtStartProfile@4' as NtStartProfile:dword
    extrn '__imp__NtStopProfile@4' as NtStopProfile:dword
    extrn '__imp__NtSuspendProcess@4' as NtSuspendProcess:dword
    extrn '__imp__NtSuspendThread@8' as NtSuspendThread:dword
    extrn '__imp__NtSystemDebugControl@24' as NtSystemDebugControl:dword
    extrn '__imp__NtTerminateJobObject@8' as NtTerminateJobObject:dword
    extrn '__imp__NtTerminateProcess@8' as NtTerminateProcess:dword
    extrn '__imp__NtTerminateThread@8' as NtTerminateThread:dword
    extrn '__imp__NtTestAlert@0' as NtTestAlert:dword
    extrn '__imp__NtTraceEvent@16' as NtTraceEvent:dword
    extrn '__imp__NtTranslateFilePath@16' as NtTranslateFilePath:dword
    extrn '__imp__NtUnloadDriver@4' as NtUnloadDriver:dword
    extrn '__imp__NtUnloadKey@4' as NtUnloadKey:dword
    extrn '__imp__NtUnloadKeyEx@8' as NtUnloadKeyEx:dword
    extrn '__imp__NtUnlockFile@20' as NtUnlockFile:dword
    extrn '__imp__NtUnlockVirtualMemory@16' as NtUnlockVirtualMemory:dword
    extrn '__imp__NtUnmapViewOfSection@8' as NtUnmapViewOfSection:dword
    extrn '__imp__NtVdmControl@8' as NtVdmControl:dword
    extrn '__imp__NtWaitForDebugEvent@16' as NtWaitForDebugEvent:dword
    extrn '__imp__NtWaitForKeyedEvent@16' as NtWaitForKeyedEvent:dword
    extrn '__imp__NtWaitForMultipleObjects@20' as NtWaitForMultipleObjects:dword
    extrn '__imp__NtWaitForSingleObject@12' as NtWaitForSingleObject:dword
    extrn '__imp__NtWaitHighEventPair@4' as NtWaitHighEventPair:dword
    extrn '__imp__NtWaitLowEventPair@4' as NtWaitLowEventPair:dword
    extrn '__imp__NtWriteFile@36' as NtWriteFile:dword
    extrn '__imp__NtWriteFileGather@36' as NtWriteFileGather:dword
    extrn '__imp__NtWriteRequestData@24' as NtWriteRequestData:dword
    extrn '__imp__NtWriteVirtualMemory@20' as NtWriteVirtualMemory:dword
    extrn '__imp__NtYieldExecution@0' as NtYieldExecution:dword
    extrn '__imp__PfxFindPrefix@8' as PfxFindPrefix:dword
    extrn '__imp__PfxInitialize@4' as PfxInitialize:dword
    extrn '__imp__PfxInsertPrefix@12' as PfxInsertPrefix:dword
    extrn '__imp__PfxRemovePrefix@8' as PfxRemovePrefix:dword
    extrn '__imp__RtlAbortRXact@4' as RtlAbortRXact:dword
    extrn '__imp__RtlAbsoluteToSelfRelativeSD@12' as RtlAbsoluteToSelfRelativeSD:dword
    extrn '__imp__RtlAcquirePebLock@0' as RtlAcquirePebLock:dword
    extrn '__imp__RtlAcquireResourceExclusive@8' as RtlAcquireResourceExclusive:dword
    extrn '__imp__RtlAcquireResourceShared@8' as RtlAcquireResourceShared:dword
    extrn '__imp__RtlActivateActivationContext@12' as RtlActivateActivationContext:dword
    extrn '__imp__RtlActivateActivationContextEx@16' as RtlActivateActivationContextEx:dword
    extrn '__imp__RtlActivateActivationContextUnsafeFast@8' as RtlActivateActivationContextUnsafeFast:dword
    extrn '__imp__RtlAddAccessAllowedAce@16' as RtlAddAccessAllowedAce:dword
    extrn '__imp__RtlAddAccessAllowedAceEx@20' as RtlAddAccessAllowedAceEx:dword
    extrn '__imp__RtlAddAccessAllowedObjectAce@28' as RtlAddAccessAllowedObjectAce:dword
    extrn '__imp__RtlAddAccessDeniedAce@16' as RtlAddAccessDeniedAce:dword
    extrn '__imp__RtlAddAccessDeniedAceEx@20' as RtlAddAccessDeniedAceEx:dword
    extrn '__imp__RtlAddAccessDeniedObjectAce@28' as RtlAddAccessDeniedObjectAce:dword
    extrn '__imp__RtlAddAce@20' as RtlAddAce:dword
    extrn '__imp__RtlAddActionToRXact@24' as RtlAddActionToRXact:dword
    extrn '__imp__RtlAddAtomToAtomTable@12' as RtlAddAtomToAtomTable:dword
    extrn '__imp__RtlAddAttributeActionToRXact@32' as RtlAddAttributeActionToRXact:dword
    extrn '__imp__RtlAddAuditAccessAce@24' as RtlAddAuditAccessAce:dword
    extrn '__imp__RtlAddAuditAccessAceEx@28' as RtlAddAuditAccessAceEx:dword
    extrn '__imp__RtlAddAuditAccessObjectAce@36' as RtlAddAuditAccessObjectAce:dword
    extrn '__imp__RtlAddCompoundAce@24' as RtlAddCompoundAce:dword
    extrn '__imp__RtlAddRange@36' as RtlAddRange:dword
    extrn '__imp__RtlAddRefActivationContext@4' as RtlAddRefActivationContext:dword
    extrn '__imp__RtlAddRefMemoryStream@4' as RtlAddRefMemoryStream:dword
    extrn '__imp__RtlAddressInSectionTable@12' as RtlAddressInSectionTable:dword
    extrn '__imp__RtlAddVectoredExceptionHandler@8' as RtlAddVectoredExceptionHandler:dword
    extrn '__imp__RtlAdjustPrivilege@16' as RtlAdjustPrivilege:dword
    extrn '__imp__RtlAllocateAndInitializeSid@44' as RtlAllocateAndInitializeSid:dword
    extrn '__imp__RtlAllocateHandle@8' as RtlAllocateHandle:dword
    extrn '__imp__RtlAllocateHeap@12' as RtlAllocateHeap:dword
    extrn '__imp__RtlAnsiCharToUnicodeChar@4' as RtlAnsiCharToUnicodeChar:dword
    extrn '__imp__RtlAnsiStringToUnicodeSize@4' as RtlAnsiStringToUnicodeSize:dword
    extrn '__imp__RtlAnsiStringToUnicodeString@12' as RtlAnsiStringToUnicodeString:dword
    extrn '__imp__RtlAppendAsciizToString@8' as RtlAppendAsciizToString:dword
    extrn '__imp__RtlAppendPathElement@12' as RtlAppendPathElement:dword
    extrn '__imp__RtlAppendStringToString@8' as RtlAppendStringToString:dword
    extrn '__imp__RtlAppendUnicodeStringToString@8' as RtlAppendUnicodeStringToString:dword
    extrn '__imp__RtlAppendUnicodeToString@8' as RtlAppendUnicodeToString:dword
    extrn '__imp__RtlApplicationVerifierStop@40' as RtlApplicationVerifierStop:dword
    extrn '__imp__RtlApplyRXact@4' as RtlApplyRXact:dword
    extrn '__imp__RtlApplyRXactNoFlush@4' as RtlApplyRXactNoFlush:dword
    extrn '__imp__RtlAreAllAccessesGranted@8' as RtlAreAllAccessesGranted:dword
    extrn '__imp__RtlAreAnyAccessesGranted@8' as RtlAreAnyAccessesGranted:dword
    extrn '__imp__RtlAreBitsClear@12' as RtlAreBitsClear:dword
    extrn '__imp__RtlAreBitsSet@12' as RtlAreBitsSet:dword
    extrn '__imp__RtlAssert@16' as RtlAssert:dword
    extrn '__imp__RtlAssert2@20' as RtlAssert2:dword
    extrn '__imp__RtlCancelTimer@8' as RtlCancelTimer:dword
    extrn '__imp__RtlCaptureContext@4' as RtlCaptureContext:dword
    extrn '__imp__RtlCaptureStackBackTrace@16' as RtlCaptureStackBackTrace:dword
    extrn '__imp__RtlCaptureStackContext@12' as RtlCaptureStackContext:dword
    extrn '__imp__RtlCharToInteger@12' as RtlCharToInteger:dword
    extrn '__imp__RtlCheckForOrphanedCriticalSections@4' as RtlCheckForOrphanedCriticalSections:dword
    extrn '__imp__RtlCheckProcessParameters@16' as RtlCheckProcessParameters:dword
    extrn '__imp__RtlCheckRegistryKey@8' as RtlCheckRegistryKey:dword
    extrn '__imp__RtlClearAllBits@4' as RtlClearAllBits:dword
    extrn '__imp__RtlClearBits@12' as RtlClearBits:dword
    extrn '__imp__RtlCloneMemoryStream@8' as RtlCloneMemoryStream:dword
    extrn '__imp__RtlCommitMemoryStream@8' as RtlCommitMemoryStream:dword
    extrn '__imp__RtlCompactHeap@8' as RtlCompactHeap:dword
    extrn '__imp__RtlCompareMemory@12' as RtlCompareMemory:dword
    extrn '__imp__RtlCompareMemoryUlong@12' as RtlCompareMemoryUlong:dword
    extrn '__imp__RtlCompareString@12' as RtlCompareString:dword
    extrn '__imp__RtlCompareUnicodeString@12' as RtlCompareUnicodeString:dword
    extrn '__imp__RtlCompressBuffer@32' as RtlCompressBuffer:dword
    extrn '__imp__RtlComputeCrc32@12' as RtlComputeCrc32:dword
    extrn '__imp__RtlComputeImportTableHash@12' as RtlComputeImportTableHash:dword
    extrn '__imp__RtlComputePrivatizedDllName_U@12' as RtlComputePrivatizedDllName_U:dword
    extrn '__imp__RtlConsoleMultiByteToUnicodeN@24' as RtlConsoleMultiByteToUnicodeN:dword
    extrn '__imp__RtlConvertExclusiveToShared@4' as RtlConvertExclusiveToShared:dword
    extrn '__imp__RtlConvertLongToLargeInteger@4' as RtlConvertLongToLargeInteger:dword
    extrn '__imp__RtlConvertSharedToExclusive@4' as RtlConvertSharedToExclusive:dword
    extrn '__imp__RtlConvertSidToUnicodeString@12' as RtlConvertSidToUnicodeString:dword
    extrn '__imp__RtlConvertToAutoInheritSecurityObject@24' as RtlConvertToAutoInheritSecurityObject:dword
    extrn '__imp__RtlConvertUiListToApiList@12' as RtlConvertUiListToApiList:dword
    extrn '__imp__RtlConvertUlongToLargeInteger@4' as RtlConvertUlongToLargeInteger:dword
    extrn '__imp__RtlCopyLuid@8' as RtlCopyLuid:dword
    extrn '__imp__RtlCopyLuidAndAttributesArray@12' as RtlCopyLuidAndAttributesArray:dword
    extrn '__imp__RtlCopyMemoryStreamTo@24' as RtlCopyMemoryStreamTo:dword
    extrn '__imp__RtlCopyOutOfProcessMemoryStreamTo@24' as RtlCopyOutOfProcessMemoryStreamTo:dword
    extrn '__imp__RtlCopyRangeList@8' as RtlCopyRangeList:dword
    extrn '__imp__RtlCopySecurityDescriptor@8' as RtlCopySecurityDescriptor:dword
    extrn '__imp__RtlCopySid@12' as RtlCopySid:dword
    extrn '__imp__RtlCopySidAndAttributesArray@28' as RtlCopySidAndAttributesArray:dword
    extrn '__imp__RtlCopyString@8' as RtlCopyString:dword
    extrn '__imp__RtlCopyUnicodeString@8' as RtlCopyUnicodeString:dword
    extrn '__imp__RtlCreateAcl@12' as RtlCreateAcl:dword
    extrn '__imp__RtlCreateActivationContext@24' as RtlCreateActivationContext:dword
    extrn '__imp__RtlCreateAndSetSD@20' as RtlCreateAndSetSD:dword
    extrn '__imp__RtlCreateAtomTable@8' as RtlCreateAtomTable:dword
    extrn '__imp__RtlCreateBootStatusDataFile@0' as RtlCreateBootStatusDataFile:dword
    extrn '__imp__RtlCreateEnvironment@8' as RtlCreateEnvironment:dword
    extrn '__imp__RtlCreateHeap@24' as RtlCreateHeap:dword
    extrn '__imp__RtlCreateProcessParameters@40' as RtlCreateProcessParameters:dword
    extrn '__imp__RtlCreateQueryDebugBuffer@8' as RtlCreateQueryDebugBuffer:dword
    extrn '__imp__RtlCreateRegistryKey@8' as RtlCreateRegistryKey:dword
    extrn '__imp__RtlCreateSecurityDescriptor@8' as RtlCreateSecurityDescriptor:dword
    extrn '__imp__RtlCreateSystemVolumeInformationFolder@4' as RtlCreateSystemVolumeInformationFolder:dword
    extrn '__imp__RtlCreateTagHeap@16' as RtlCreateTagHeap:dword
    extrn '__imp__RtlCreateTimer@28' as RtlCreateTimer:dword
    extrn '__imp__RtlCreateTimerQueue@4' as RtlCreateTimerQueue:dword
    extrn '__imp__RtlCreateUnicodeString@8' as RtlCreateUnicodeString:dword
    extrn '__imp__RtlCreateUnicodeStringFromAsciiz@8' as RtlCreateUnicodeStringFromAsciiz:dword
    extrn '__imp__RtlCreateUserProcess@40' as RtlCreateUserProcess:dword
    extrn '__imp__RtlCreateUserSecurityObject@28' as RtlCreateUserSecurityObject:dword
    extrn '__imp__RtlCreateUserThread@40' as RtlCreateUserThread:dword
    extrn '__imp__RtlCustomCPToUnicodeN@24' as RtlCustomCPToUnicodeN:dword
    extrn '__imp__RtlCutoverTimeToSystemTime@16' as RtlCutoverTimeToSystemTime:dword
    extrn '__imp__RtlDeactivateActivationContext@8' as RtlDeactivateActivationContext:dword
    extrn '__imp__RtlDeactivateActivationContextUnsafeFast@4' as RtlDeactivateActivationContextUnsafeFast:dword
    extrn '__imp__RtlDebugPrintTimes@0' as RtlDebugPrintTimes:dword
    extrn '__imp__RtlDecodePointer@4' as RtlDecodePointer:dword
    extrn '__imp__RtlDecodeSystemPointer@4' as RtlDecodeSystemPointer:dword
    extrn '__imp__RtlDecompressBuffer@24' as RtlDecompressBuffer:dword
    extrn '__imp__RtlDecompressFragment@32' as RtlDecompressFragment:dword
    extrn '__imp__RtlDefaultNpAcl@4' as RtlDefaultNpAcl:dword
    extrn '__imp__RtlDelete@4' as RtlDelete:dword
    extrn '__imp__RtlDeleteAce@8' as RtlDeleteAce:dword
    extrn '__imp__RtlDeleteAtomFromAtomTable@8' as RtlDeleteAtomFromAtomTable:dword
    extrn '__imp__RtlDeleteCriticalSection@4' as RtlDeleteCriticalSection:dword
    extrn '__imp__RtlDeleteElementGenericTable@8' as RtlDeleteElementGenericTable:dword
    extrn '__imp__RtlDeleteElementGenericTableAvl@8' as RtlDeleteElementGenericTableAvl:dword
    extrn '__imp__RtlDeleteNoSplay@8' as RtlDeleteNoSplay:dword
    extrn '__imp__RtlDeleteOwnersRanges@8' as RtlDeleteOwnersRanges:dword
    extrn '__imp__RtlDeleteRange@24' as RtlDeleteRange:dword
    extrn '__imp__RtlDeleteRegistryValue@12' as RtlDeleteRegistryValue:dword
    extrn '__imp__RtlDeleteResource@4' as RtlDeleteResource:dword
    extrn '__imp__RtlDeleteSecurityObject@4' as RtlDeleteSecurityObject:dword
    extrn '__imp__RtlDeleteTimer@12' as RtlDeleteTimer:dword
    extrn '__imp__RtlDeleteTimerQueue@4' as RtlDeleteTimerQueue:dword
    extrn '__imp__RtlDeleteTimerQueueEx@8' as RtlDeleteTimerQueueEx:dword
    extrn '__imp__RtlDeNormalizeProcessParams@4' as RtlDeNormalizeProcessParams:dword
    extrn '__imp__RtlDeregisterWait@4' as RtlDeregisterWait:dword
    extrn '__imp__RtlDeregisterWaitEx@8' as RtlDeregisterWaitEx:dword
    extrn '__imp__RtlDestroyAtomTable@4' as RtlDestroyAtomTable:dword
    extrn '__imp__RtlDestroyEnvironment@4' as RtlDestroyEnvironment:dword
    extrn '__imp__RtlDestroyHandleTable@4' as RtlDestroyHandleTable:dword
    extrn '__imp__RtlDestroyHeap@4' as RtlDestroyHeap:dword
    extrn '__imp__RtlDestroyProcessParameters@4' as RtlDestroyProcessParameters:dword
    extrn '__imp__RtlDestroyQueryDebugBuffer@4' as RtlDestroyQueryDebugBuffer:dword
    extrn '__imp__RtlDetermineDosPathNameType_U@4' as RtlDetermineDosPathNameType_U:dword
    extrn '__imp__RtlDllShutdownInProgress@0' as RtlDllShutdownInProgress:dword
    extrn '__imp__RtlDnsHostNameToComputerName@12' as RtlDnsHostNameToComputerName:dword
    extrn '__imp__RtlDoesFileExists_U@4' as RtlDoesFileExists_U:dword
    extrn '__imp__RtlDosApplyFileIsolationRedirection_Ustr@36' as RtlDosApplyFileIsolationRedirection_Ustr:dword
    extrn '__imp__RtlDosPathNameToNtPathName_U@16' as RtlDosPathNameToNtPathName_U:dword
    extrn '__imp__RtlDosSearchPath_U@24' as RtlDosSearchPath_U:dword
    extrn '__imp__RtlDosSearchPath_Ustr@36' as RtlDosSearchPath_Ustr:dword
    extrn '__imp__RtlDowncaseUnicodeChar@4' as RtlDowncaseUnicodeChar:dword
    extrn '__imp__RtlDowncaseUnicodeString@12' as RtlDowncaseUnicodeString:dword
    extrn '__imp__RtlDumpResource@4' as RtlDumpResource:dword
    extrn '__imp__RtlDuplicateUnicodeString@12' as RtlDuplicateUnicodeString:dword
    extrn '__imp__RtlEmptyAtomTable@8' as RtlEmptyAtomTable:dword
    extrn '__imp__RtlEnableEarlyCriticalSectionEventCreation@0' as RtlEnableEarlyCriticalSectionEventCreation:dword
    extrn '__imp__RtlEncodePointer@4' as RtlEncodePointer:dword
    extrn '__imp__RtlEncodeSystemPointer@4' as RtlEncodeSystemPointer:dword
    extrn '__imp__RtlEnlargedIntegerMultiply@8' as RtlEnlargedIntegerMultiply:dword
    extrn '__imp__RtlEnlargedUnsignedDivide@16' as RtlEnlargedUnsignedDivide:dword
    extrn '__imp__RtlEnlargedUnsignedMultiply@8' as RtlEnlargedUnsignedMultiply:dword
    extrn '__imp__RtlEnterCriticalSection@4' as RtlEnterCriticalSection:dword
    extrn '__imp__RtlEnumerateGenericTable@8' as RtlEnumerateGenericTable:dword
    extrn '__imp__RtlEnumerateGenericTableAvl@8' as RtlEnumerateGenericTableAvl:dword
    extrn '__imp__RtlEnumerateGenericTableLikeADirectory@28' as RtlEnumerateGenericTableLikeADirectory:dword
    extrn '__imp__RtlEnumerateGenericTableWithoutSplaying@8' as RtlEnumerateGenericTableWithoutSplaying:dword
    extrn '__imp__RtlEnumerateGenericTableWithoutSplayingAvl@8' as RtlEnumerateGenericTableWithoutSplayingAvl:dword
    extrn '__imp__RtlEnumProcessHeaps@8' as RtlEnumProcessHeaps:dword
    extrn '__imp__RtlEqualComputerName@8' as RtlEqualComputerName:dword
    extrn '__imp__RtlEqualDomainName@8' as RtlEqualDomainName:dword
    extrn '__imp__RtlEqualLuid@8' as RtlEqualLuid:dword
    extrn '__imp__RtlEqualPrefixSid@8' as RtlEqualPrefixSid:dword
    extrn '__imp__RtlEqualSid@8' as RtlEqualSid:dword
    extrn '__imp__RtlEqualString@12' as RtlEqualString:dword
    extrn '__imp__RtlEqualUnicodeString@12' as RtlEqualUnicodeString:dword
    extrn '__imp__RtlEraseUnicodeString@4' as RtlEraseUnicodeString:dword
    extrn '__imp__RtlExitUserThread@4' as RtlExitUserThread:dword
    extrn '__imp__RtlExpandEnvironmentStrings_U@16' as RtlExpandEnvironmentStrings_U:dword
    extrn '__imp__RtlExtendedIntegerMultiply@12' as RtlExtendedIntegerMultiply:dword
    extrn '__imp__RtlExtendedLargeIntegerDivide@16' as RtlExtendedLargeIntegerDivide:dword
    extrn '__imp__RtlExtendedMagicDivide@20' as RtlExtendedMagicDivide:dword
    extrn '__imp__RtlExtendHeap@16' as RtlExtendHeap:dword
    extrn '__imp__RtlFillMemory@12' as RtlFillMemory:dword
    extrn '__imp__RtlFillMemoryUlong@12' as RtlFillMemoryUlong:dword
    extrn '__imp__RtlFinalReleaseOutOfProcessMemoryStream@4' as RtlFinalReleaseOutOfProcessMemoryStream:dword
    extrn '__imp__RtlFindActivationContextSectionGuid@20' as RtlFindActivationContextSectionGuid:dword
    extrn '__imp__RtlFindActivationContextSectionString@20' as RtlFindActivationContextSectionString:dword
    extrn '__imp__RtlFindCharInUnicodeString@16' as RtlFindCharInUnicodeString:dword
    extrn '__imp__RtlFindClearBits@12' as RtlFindClearBits:dword
    extrn '__imp__RtlFindClearBitsAndSet@12' as RtlFindClearBitsAndSet:dword
    extrn '__imp__RtlFindClearRuns@16' as RtlFindClearRuns:dword
    extrn '__imp__RtlFindLastBackwardRunClear@12' as RtlFindLastBackwardRunClear:dword
    extrn '__imp__RtlFindLeastSignificantBit@8' as RtlFindLeastSignificantBit:dword
    extrn '__imp__RtlFindLongestRunClear@8' as RtlFindLongestRunClear:dword
    extrn '__imp__RtlFindMessage@20' as RtlFindMessage:dword
    extrn '__imp__RtlFindMostSignificantBit@8' as RtlFindMostSignificantBit:dword
    extrn '__imp__RtlFindNextForwardRunClear@12' as RtlFindNextForwardRunClear:dword
    extrn '__imp__RtlFindRange@48' as RtlFindRange:dword
    extrn '__imp__RtlFindSetBits@12' as RtlFindSetBits:dword
    extrn '__imp__RtlFindSetBitsAndClear@12' as RtlFindSetBitsAndClear:dword
    extrn '__imp__RtlFirstEntrySList@4' as RtlFirstEntrySList:dword
    extrn '__imp__RtlFirstFreeAce@8' as RtlFirstFreeAce:dword
    extrn '__imp__RtlFlushSecureMemoryCache@8' as RtlFlushSecureMemoryCache:dword
    extrn '__imp__RtlFormatCurrentUserKeyPath@4' as RtlFormatCurrentUserKeyPath:dword
    extrn '__imp__RtlFormatMessage@36' as RtlFormatMessage:dword
    extrn '__imp__RtlFreeAnsiString@4' as RtlFreeAnsiString:dword
    extrn '__imp__RtlFreeHandle@8' as RtlFreeHandle:dword
    extrn '__imp__RtlFreeHeap@12' as RtlFreeHeap:dword
    extrn '__imp__RtlFreeOemString@4' as RtlFreeOemString:dword
    extrn '__imp__RtlFreeRangeList@4' as RtlFreeRangeList:dword
    extrn '__imp__RtlFreeSid@4' as RtlFreeSid:dword
    extrn '__imp__RtlFreeThreadActivationContextStack@0' as RtlFreeThreadActivationContextStack:dword
    extrn '__imp__RtlFreeUnicodeString@4' as RtlFreeUnicodeString:dword
    extrn '__imp__RtlFreeUserThreadStack@8' as RtlFreeUserThreadStack:dword
    extrn '__imp__RtlGenerate8dot3Name@16' as RtlGenerate8dot3Name:dword
    extrn '__imp__RtlGetAce@12' as RtlGetAce:dword
    extrn '__imp__RtlGetActiveActivationContext@4' as RtlGetActiveActivationContext:dword
    extrn '__imp__RtlGetCallersAddress@8' as RtlGetCallersAddress:dword
    extrn '__imp__RtlGetCompressionWorkSpaceSize@12' as RtlGetCompressionWorkSpaceSize:dword
    extrn '__imp__RtlGetControlSecurityDescriptor@12' as RtlGetControlSecurityDescriptor:dword
    extrn '__imp__RtlGetCurrentDirectory_U@8' as RtlGetCurrentDirectory_U:dword
    extrn '__imp__RtlGetCurrentPeb@0' as RtlGetCurrentPeb:dword
    extrn '__imp__RtlGetDaclSecurityDescriptor@16' as RtlGetDaclSecurityDescriptor:dword
    extrn '__imp__RtlGetElementGenericTable@8' as RtlGetElementGenericTable:dword
    extrn '__imp__RtlGetElementGenericTableAvl@8' as RtlGetElementGenericTableAvl:dword
    extrn '__imp__RtlGetFirstRange@12' as RtlGetFirstRange:dword
    extrn '__imp__RtlGetFrame@0' as RtlGetFrame:dword
    extrn '__imp__RtlGetFullPathName_U@16' as RtlGetFullPathName_U:dword
    extrn '__imp__RtlGetGroupSecurityDescriptor@12' as RtlGetGroupSecurityDescriptor:dword
    extrn '__imp__RtlGetLastNtStatus@0' as RtlGetLastNtStatus:dword
    extrn '__imp__RtlGetLastWin32Error@0' as RtlGetLastWin32Error:dword
    extrn '__imp__RtlGetLengthWithoutLastFullDosOrNtPathElement@12' as RtlGetLengthWithoutLastFullDosOrNtPathElement:dword
    extrn '__imp__RtlGetLengthWithoutTrailingPathSeperators@12' as RtlGetLengthWithoutTrailingPathSeperators:dword
    extrn '__imp__RtlGetLongestNtPathLength@0' as RtlGetLongestNtPathLength:dword
    extrn '__imp__RtlGetNativeSystemInformation@16' as RtlGetNativeSystemInformation:dword
    extrn '__imp__RtlGetNextRange@12' as RtlGetNextRange:dword
    extrn '__imp__RtlGetNtGlobalFlags@0' as RtlGetNtGlobalFlags:dword
    extrn '__imp__RtlGetNtProductType@4' as RtlGetNtProductType:dword
    extrn '__imp__RtlGetNtVersionNumbers@12' as RtlGetNtVersionNumbers:dword
    extrn '__imp__RtlGetOwnerSecurityDescriptor@12' as RtlGetOwnerSecurityDescriptor:dword
    extrn '__imp__RtlGetProcessHeaps@8' as RtlGetProcessHeaps:dword
    extrn '__imp__RtlGetSaclSecurityDescriptor@16' as RtlGetSaclSecurityDescriptor:dword
    extrn '__imp__RtlGetSecurityDescriptorRMControl@8' as RtlGetSecurityDescriptorRMControl:dword
    extrn '__imp__RtlGetSetBootStatusData@24' as RtlGetSetBootStatusData:dword
    extrn '__imp__RtlGetUnloadEventTrace@0' as RtlGetUnloadEventTrace:dword
    extrn '__imp__RtlGetUserInfoHeap@20' as RtlGetUserInfoHeap:dword
    extrn '__imp__RtlGetVersion@4' as RtlGetVersion:dword
    extrn '__imp__RtlGUIDFromString@8' as RtlGUIDFromString:dword
    extrn '__imp__RtlHashUnicodeString@16' as RtlHashUnicodeString:dword
    extrn '__imp__RtlIdentifierAuthoritySid@4' as RtlIdentifierAuthoritySid:dword
    extrn '__imp__RtlImageDirectoryEntryToData@16' as RtlImageDirectoryEntryToData:dword
    extrn '__imp__RtlImageNtHeader@4' as RtlImageNtHeader:dword
    extrn '__imp__RtlImageRvaToSection@12' as RtlImageRvaToSection:dword
    extrn '__imp__RtlImageRvaToVa@16' as RtlImageRvaToVa:dword
    extrn '__imp__RtlImpersonateSelf@4' as RtlImpersonateSelf:dword
    extrn '__imp__RtlInitAnsiString@8' as RtlInitAnsiString:dword
    extrn '__imp__RtlInitCodePageTable@8' as RtlInitCodePageTable:dword
    extrn '__imp__RtlInitializeAtomPackage@4' as RtlInitializeAtomPackage:dword
    extrn '__imp__RtlInitializeBitMap@12' as RtlInitializeBitMap:dword
    extrn '__imp__RtlInitializeContext@20' as RtlInitializeContext:dword
    extrn '__imp__RtlInitializeCriticalSection@4' as RtlInitializeCriticalSection:dword
    extrn '__imp__RtlInitializeCriticalSectionAndSpinCount@8' as RtlInitializeCriticalSectionAndSpinCount:dword
    extrn '__imp__RtlInitializeGenericTable@20' as RtlInitializeGenericTable:dword
    extrn '__imp__RtlInitializeGenericTableAvl@20' as RtlInitializeGenericTableAvl:dword
    extrn '__imp__RtlInitializeHandleTable@12' as RtlInitializeHandleTable:dword
    extrn '__imp__RtlInitializeRangeList@4' as RtlInitializeRangeList:dword
    extrn '__imp__RtlInitializeResource@4' as RtlInitializeResource:dword
    extrn '__imp__RtlInitializeRXact@12' as RtlInitializeRXact:dword
    extrn '__imp__RtlInitializeSid@12' as RtlInitializeSid:dword
    extrn '__imp__RtlInitializeSListHead@4' as RtlInitializeSListHead:dword
    extrn '__imp__RtlInitializeStackTraceDataBase@12' as RtlInitializeStackTraceDataBase:dword
    extrn '__imp__RtlInitMemoryStream@4' as RtlInitMemoryStream:dword
    extrn '__imp__RtlInitNlsTables@16' as RtlInitNlsTables:dword
    extrn '__imp__RtlInitOutOfProcessMemoryStream@4' as RtlInitOutOfProcessMemoryStream:dword
    extrn '__imp__RtlInitString@8' as RtlInitString:dword
    extrn '__imp__RtlInitUnicodeString@8' as RtlInitUnicodeString:dword
    extrn '__imp__RtlInitUnicodeStringEx@8' as RtlInitUnicodeStringEx:dword
    extrn '__imp__RtlInsertElementGenericTable@16' as RtlInsertElementGenericTable:dword
    extrn '__imp__RtlInsertElementGenericTableAvl@16' as RtlInsertElementGenericTableAvl:dword
    extrn '__imp__RtlInt64ToUnicodeString@16' as RtlInt64ToUnicodeString:dword
    extrn '__imp__RtlIntegerToChar@16' as RtlIntegerToChar:dword
    extrn '__imp__RtlIntegerToUnicodeString@12' as RtlIntegerToUnicodeString:dword
    extrn '__imp__RtlInterlockedFlushSList@4' as RtlInterlockedFlushSList:dword
    extrn '__imp__RtlInterlockedPopEntrySList@4' as RtlInterlockedPopEntrySList:dword
    extrn '__imp__RtlInterlockedPushEntrySList@8' as RtlInterlockedPushEntrySList:dword
    extrn '__imp__RtlInvertRangeList@8' as RtlInvertRangeList:dword
    extrn '__imp__RtlIpv4AddressToStringA@8' as RtlIpv4AddressToStringA:dword
    extrn '__imp__RtlIpv4AddressToStringExA@16' as RtlIpv4AddressToStringExA:dword
    extrn '__imp__RtlIpv4AddressToStringExW@16' as RtlIpv4AddressToStringExW:dword
    extrn '__imp__RtlIpv4AddressToStringW@8' as RtlIpv4AddressToStringW:dword
    extrn '__imp__RtlIpv4StringToAddressA@16' as RtlIpv4StringToAddressA:dword
    extrn '__imp__RtlIpv4StringToAddressExA@16' as RtlIpv4StringToAddressExA:dword
    extrn '__imp__RtlIpv4StringToAddressExW@16' as RtlIpv4StringToAddressExW:dword
    extrn '__imp__RtlIpv4StringToAddressW@16' as RtlIpv4StringToAddressW:dword
    extrn '__imp__RtlIpv6AddressToStringA@8' as RtlIpv6AddressToStringA:dword
    extrn '__imp__RtlIpv6AddressToStringExA@20' as RtlIpv6AddressToStringExA:dword
    extrn '__imp__RtlIpv6AddressToStringExW@20' as RtlIpv6AddressToStringExW:dword
    extrn '__imp__RtlIpv6AddressToStringW@8' as RtlIpv6AddressToStringW:dword
    extrn '__imp__RtlIpv6StringToAddressA@12' as RtlIpv6StringToAddressA:dword
    extrn '__imp__RtlIpv6StringToAddressExA@16' as RtlIpv6StringToAddressExA:dword
    extrn '__imp__RtlIpv6StringToAddressExW@16' as RtlIpv6StringToAddressExW:dword
    extrn '__imp__RtlIpv6StringToAddressW@12' as RtlIpv6StringToAddressW:dword
    extrn '__imp__RtlIsActivationContextActive@4' as RtlIsActivationContextActive:dword
    extrn '__imp__RtlIsDosDeviceName_U@4' as RtlIsDosDeviceName_U:dword
    extrn '__imp__RtlIsGenericTableEmpty@4' as RtlIsGenericTableEmpty:dword
    extrn '__imp__RtlIsGenericTableEmptyAvl@4' as RtlIsGenericTableEmptyAvl:dword
    extrn '__imp__RtlIsNameLegalDOS8Dot3@12' as RtlIsNameLegalDOS8Dot3:dword
    extrn '__imp__RtlIsRangeAvailable@40' as RtlIsRangeAvailable:dword
    extrn '__imp__RtlIsTextUnicode@12' as RtlIsTextUnicode:dword
    extrn '__imp__RtlIsThreadWithinLoaderCallout@0' as RtlIsThreadWithinLoaderCallout:dword
    extrn '__imp__RtlIsValidHandle@8' as RtlIsValidHandle:dword
    extrn '__imp__RtlIsValidIndexHandle@12' as RtlIsValidIndexHandle:dword
    extrn '__imp__RtlLargeIntegerAdd@16' as RtlLargeIntegerAdd:dword
    extrn '__imp__RtlLargeIntegerArithmeticShift@12' as RtlLargeIntegerArithmeticShift:dword
    extrn '__imp__RtlLargeIntegerDivide@20' as RtlLargeIntegerDivide:dword
    extrn '__imp__RtlLargeIntegerNegate@8' as RtlLargeIntegerNegate:dword
    extrn '__imp__RtlLargeIntegerShiftLeft@12' as RtlLargeIntegerShiftLeft:dword
    extrn '__imp__RtlLargeIntegerShiftRight@12' as RtlLargeIntegerShiftRight:dword
    extrn '__imp__RtlLargeIntegerSubtract@16' as RtlLargeIntegerSubtract:dword
    extrn '__imp__RtlLargeIntegerToChar@16' as RtlLargeIntegerToChar:dword
    extrn '__imp__RtlLeaveCriticalSection@4' as RtlLeaveCriticalSection:dword
    extrn '__imp__RtlLengthRequiredSid@4' as RtlLengthRequiredSid:dword
    extrn '__imp__RtlLengthSecurityDescriptor@4' as RtlLengthSecurityDescriptor:dword
    extrn '__imp__RtlLengthSid@4' as RtlLengthSid:dword
    extrn '__imp__RtlLocalTimeToSystemTime@8' as RtlLocalTimeToSystemTime:dword
    extrn '__imp__RtlLockBootStatusData@4' as RtlLockBootStatusData:dword
    extrn '__imp__RtlLockHeap@4' as RtlLockHeap:dword
    extrn '__imp__RtlLockMemoryStreamRegion@24' as RtlLockMemoryStreamRegion:dword
    extrn '__imp__RtlLogStackBackTrace@0' as RtlLogStackBackTrace:dword
    extrn '__imp__RtlLookupAtomInAtomTable@12' as RtlLookupAtomInAtomTable:dword
    extrn '__imp__RtlLookupElementGenericTable@8' as RtlLookupElementGenericTable:dword
    extrn '__imp__RtlLookupElementGenericTableAvl@8' as RtlLookupElementGenericTableAvl:dword
    extrn '__imp__RtlMakeSelfRelativeSD@12' as RtlMakeSelfRelativeSD:dword
    extrn '__imp__RtlMapGenericMask@8' as RtlMapGenericMask:dword
    extrn '__imp__RtlMapSecurityErrorToNtStatus@4' as RtlMapSecurityErrorToNtStatus:dword
    extrn '__imp__RtlMergeRangeLists@16' as RtlMergeRangeLists:dword
    extrn '__imp__RtlMoveMemory@12' as RtlMoveMemory:dword
    extrn '__imp__RtlMultiAppendUnicodeStringBuffer@12' as RtlMultiAppendUnicodeStringBuffer:dword
    extrn '__imp__RtlMultiByteToUnicodeN@20' as RtlMultiByteToUnicodeN:dword
    extrn '__imp__RtlMultiByteToUnicodeSize@12' as RtlMultiByteToUnicodeSize:dword
    extrn '__imp__RtlNewInstanceSecurityObject@40' as RtlNewInstanceSecurityObject:dword
    extrn '__imp__RtlNewSecurityGrantedAccess@24' as RtlNewSecurityGrantedAccess:dword
    extrn '__imp__RtlNewSecurityObject@24' as RtlNewSecurityObject:dword
    extrn '__imp__RtlNewSecurityObjectEx@32' as RtlNewSecurityObjectEx:dword
    extrn '__imp__RtlNewSecurityObjectWithMultipleInheritance@36' as RtlNewSecurityObjectWithMultipleInheritance:dword
    extrn '__imp__RtlNormalizeProcessParams@4' as RtlNormalizeProcessParams:dword
    extrn '__imp__RtlNtPathNameToDosPathName@16' as RtlNtPathNameToDosPathName:dword
    extrn '__imp__RtlNtStatusToDosError@4' as RtlNtStatusToDosError:dword
    extrn '__imp__RtlNtStatusToDosErrorNoTeb@4' as RtlNtStatusToDosErrorNoTeb:dword
    extrn '__imp__RtlNumberGenericTableElements@4' as RtlNumberGenericTableElements:dword
    extrn '__imp__RtlNumberGenericTableElementsAvl@4' as RtlNumberGenericTableElementsAvl:dword
    extrn '__imp__RtlNumberOfClearBits@4' as RtlNumberOfClearBits:dword
    extrn '__imp__RtlNumberOfSetBits@4' as RtlNumberOfSetBits:dword
    extrn '__imp__RtlOemStringToUnicodeSize@4' as RtlOemStringToUnicodeSize:dword
    extrn '__imp__RtlOemStringToUnicodeString@12' as RtlOemStringToUnicodeString:dword
    extrn '__imp__RtlOemToUnicodeN@20' as RtlOemToUnicodeN:dword
    extrn '__imp__RtlOpenCurrentUser@8' as RtlOpenCurrentUser:dword
    extrn '__imp__RtlpApplyLengthFunction@16' as RtlpApplyLengthFunction:dword
    extrn '__imp__RtlPcToFileHeader@8' as RtlPcToFileHeader:dword
    extrn '__imp__RtlpEnsureBufferSize@12' as RtlpEnsureBufferSize:dword
    extrn '__imp__RtlPinAtomInAtomTable@8' as RtlPinAtomInAtomTable:dword
    extrn '__imp__RtlpNotOwnerCriticalSection@4' as RtlpNotOwnerCriticalSection:dword
    extrn '__imp__RtlpNtCreateKey@24' as RtlpNtCreateKey:dword
    extrn '__imp__RtlpNtEnumerateSubKey@16' as RtlpNtEnumerateSubKey:dword
    extrn '__imp__RtlpNtMakeTemporaryKey@4' as RtlpNtMakeTemporaryKey:dword
    extrn '__imp__RtlpNtOpenKey@16' as RtlpNtOpenKey:dword
    extrn '__imp__RtlpNtQueryValueKey@20' as RtlpNtQueryValueKey:dword
    extrn '__imp__RtlpNtSetValueKey@16' as RtlpNtSetValueKey:dword
    extrn '__imp__RtlPopFrame@4' as RtlPopFrame:dword
    extrn '__imp__RtlPrefixString@12' as RtlPrefixString:dword
    extrn '__imp__RtlPrefixUnicodeString@12' as RtlPrefixUnicodeString:dword
    extrn '__imp__RtlProtectHeap@8' as RtlProtectHeap:dword
    extrn '__imp__RtlpUnWaitCriticalSection@4' as RtlpUnWaitCriticalSection:dword
    extrn '__imp__RtlPushFrame@4' as RtlPushFrame:dword
    extrn '__imp__RtlpWaitForCriticalSection@4' as RtlpWaitForCriticalSection:dword
    extrn '__imp__RtlQueryAtomInAtomTable@24' as RtlQueryAtomInAtomTable:dword
    extrn '__imp__RtlQueryDepthSList@4' as RtlQueryDepthSList:dword
    extrn '__imp__RtlQueryEnvironmentVariable_U@12' as RtlQueryEnvironmentVariable_U:dword
    extrn '__imp__RtlQueryHeapInformation@20' as RtlQueryHeapInformation:dword
    extrn '__imp__RtlQueryInformationAcl@16' as RtlQueryInformationAcl:dword
    extrn '__imp__RtlQueryInformationActivationContext@28' as RtlQueryInformationActivationContext:dword
    extrn '__imp__RtlQueryInformationActiveActivationContext@16' as RtlQueryInformationActiveActivationContext:dword
    extrn '__imp__RtlQueryInterfaceMemoryStream@12' as RtlQueryInterfaceMemoryStream:dword
    extrn '__imp__RtlQueryProcessBackTraceInformation@4' as RtlQueryProcessBackTraceInformation:dword
    extrn '__imp__RtlQueryProcessDebugInformation@12' as RtlQueryProcessDebugInformation:dword
    extrn '__imp__RtlQueryProcessHeapInformation@4' as RtlQueryProcessHeapInformation:dword
    extrn '__imp__RtlQueryProcessLockInformation@4' as RtlQueryProcessLockInformation:dword
    extrn '__imp__RtlQueryRegistryValues@20' as RtlQueryRegistryValues:dword
    extrn '__imp__RtlQuerySecurityObject@20' as RtlQuerySecurityObject:dword
    extrn '__imp__RtlQueryTagHeap@20' as RtlQueryTagHeap:dword
    extrn '__imp__RtlQueryTimeZoneInformation@4' as RtlQueryTimeZoneInformation:dword
    extrn '__imp__RtlQueueApcWow64Thread@20' as RtlQueueApcWow64Thread:dword
    extrn '__imp__RtlQueueWorkItem@12' as RtlQueueWorkItem:dword
    extrn '__imp__RtlRaiseException@4' as RtlRaiseException:dword
    extrn '__imp__RtlRaiseStatus@4' as RtlRaiseStatus:dword
    extrn '__imp__RtlRandom@4' as RtlRandom:dword
    extrn '__imp__RtlRandomEx@4' as RtlRandomEx:dword
    extrn '__imp__RtlReadMemoryStream@16' as RtlReadMemoryStream:dword
    extrn '__imp__RtlReadOutOfProcessMemoryStream@16' as RtlReadOutOfProcessMemoryStream:dword
    extrn '__imp__RtlReAllocateHeap@16' as RtlReAllocateHeap:dword
    extrn '__imp__RtlRealPredecessor@4' as RtlRealPredecessor:dword
    extrn '__imp__RtlRealSuccessor@4' as RtlRealSuccessor:dword
    extrn '__imp__RtlRegisterSecureMemoryCacheCallback@4' as RtlRegisterSecureMemoryCacheCallback:dword
    extrn '__imp__RtlRegisterWait@24' as RtlRegisterWait:dword
    extrn '__imp__RtlReleaseActivationContext@4' as RtlReleaseActivationContext:dword
    extrn '__imp__RtlReleaseMemoryStream@4' as RtlReleaseMemoryStream:dword
    extrn '__imp__RtlReleasePebLock@0' as RtlReleasePebLock:dword
    extrn '__imp__RtlReleaseResource@4' as RtlReleaseResource:dword
    extrn '__imp__RtlRemoteCall@28' as RtlRemoteCall:dword
    extrn '__imp__RtlRemoveVectoredExceptionHandler@4' as RtlRemoveVectoredExceptionHandler:dword
    extrn '__imp__RtlResetRtlTranslations@4' as RtlResetRtlTranslations:dword
    extrn '__imp__RtlRestoreLastWin32Error@4' as RtlRestoreLastWin32Error:dword
    extrn '__imp__RtlRevertMemoryStream@4' as RtlRevertMemoryStream:dword
    extrn '__imp__RtlRunDecodeUnicodeString@8' as RtlRunDecodeUnicodeString:dword
    extrn '__imp__RtlRunEncodeUnicodeString@8' as RtlRunEncodeUnicodeString:dword
    extrn '__imp__RtlSecondsSince1970ToTime@8' as RtlSecondsSince1970ToTime:dword
    extrn '__imp__RtlSecondsSince1980ToTime@8' as RtlSecondsSince1980ToTime:dword
    extrn '__imp__RtlSeekMemoryStream@20' as RtlSeekMemoryStream:dword
    extrn '__imp__RtlSelfRelativeToAbsoluteSD@44' as RtlSelfRelativeToAbsoluteSD:dword
    extrn '__imp__RtlSelfRelativeToAbsoluteSD2@8' as RtlSelfRelativeToAbsoluteSD2:dword
    extrn '__imp__RtlSetAllBits@4' as RtlSetAllBits:dword
    extrn '__imp__RtlSetAttributesSecurityDescriptor@12' as RtlSetAttributesSecurityDescriptor:dword
    extrn '__imp__RtlSetBits@12' as RtlSetBits:dword
    extrn '__imp__RtlSetControlSecurityDescriptor@12' as RtlSetControlSecurityDescriptor:dword
    extrn '__imp__RtlSetCriticalSectionSpinCount@8' as RtlSetCriticalSectionSpinCount:dword
    extrn '__imp__RtlSetCurrentDirectory_U@4' as RtlSetCurrentDirectory_U:dword
    extrn '__imp__RtlSetCurrentEnvironment@8' as RtlSetCurrentEnvironment:dword
    extrn '__imp__RtlSetDaclSecurityDescriptor@16' as RtlSetDaclSecurityDescriptor:dword
    extrn '__imp__RtlSetEnvironmentVariable@12' as RtlSetEnvironmentVariable:dword
    extrn '__imp__RtlSetGroupSecurityDescriptor@12' as RtlSetGroupSecurityDescriptor:dword
    extrn '__imp__RtlSetHeapInformation@16' as RtlSetHeapInformation:dword
    extrn '__imp__RtlSetInformationAcl@16' as RtlSetInformationAcl:dword
    extrn '__imp__RtlSetIoCompletionCallback@12' as RtlSetIoCompletionCallback:dword
    extrn '__imp__RtlSetLastWin32Error@4' as RtlSetLastWin32Error:dword
    extrn '__imp__RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4' as RtlSetLastWin32ErrorAndNtStatusFromNtStatus:dword
    extrn '__imp__RtlSetMemoryStreamSize@12' as RtlSetMemoryStreamSize:dword
    extrn '__imp__RtlSetOwnerSecurityDescriptor@12' as RtlSetOwnerSecurityDescriptor:dword
    extrn '__imp__RtlSetProcessIsCritical@4' as RtlSetProcessIsCritical:dword
    extrn '__imp__RtlSetSaclSecurityDescriptor@16' as RtlSetSaclSecurityDescriptor:dword
    extrn '__imp__RtlSetSecurityDescriptorRMControl@8' as RtlSetSecurityDescriptorRMControl:dword
    extrn '__imp__RtlSetSecurityObject@20' as RtlSetSecurityObject:dword
    extrn '__imp__RtlSetSecurityObjectEx@24' as RtlSetSecurityObjectEx:dword
    extrn '__imp__RtlSetThreadIsCritical@4' as RtlSetThreadIsCritical:dword
    extrn '__imp__RtlSetThreadPoolStartFunc@8' as RtlSetThreadPoolStartFunc:dword
    extrn '__imp__RtlSetTimer@28' as RtlSetTimer:dword
    extrn '__imp__RtlSetTimeZoneInformation@4' as RtlSetTimeZoneInformation:dword
    extrn '__imp__RtlSetUnicodeCallouts@4' as RtlSetUnicodeCallouts:dword
    extrn '__imp__RtlSetUserFlagsHeap@20' as RtlSetUserFlagsHeap:dword
    extrn '__imp__RtlSetUserValueHeap@16' as RtlSetUserValueHeap:dword
    extrn '__imp__RtlSizeHeap@12' as RtlSizeHeap:dword
    extrn '__imp__RtlSplay@4' as RtlSplay:dword
    extrn '__imp__RtlStartRXact@4' as RtlStartRXact:dword
    extrn '__imp__RtlStatMemoryStream@12' as RtlStatMemoryStream:dword
    extrn '__imp__RtlStringFromGUID@8' as RtlStringFromGUID:dword
    extrn '__imp__RtlSubAuthorityCountSid@4' as RtlSubAuthorityCountSid:dword
    extrn '__imp__RtlSubAuthoritySid@8' as RtlSubAuthoritySid:dword
    extrn '__imp__RtlSubtreePredecessor@4' as RtlSubtreePredecessor:dword
    extrn '__imp__RtlSubtreeSuccessor@4' as RtlSubtreeSuccessor:dword
    extrn '__imp__RtlSystemTimeToLocalTime@8' as RtlSystemTimeToLocalTime:dword
    extrn '__imp__RtlTimeFieldsToTime@8' as RtlTimeFieldsToTime:dword
    extrn '__imp__RtlTimeToElapsedTimeFields@8' as RtlTimeToElapsedTimeFields:dword
    extrn '__imp__RtlTimeToSecondsSince1970@8' as RtlTimeToSecondsSince1970:dword
    extrn '__imp__RtlTimeToSecondsSince1980@8' as RtlTimeToSecondsSince1980:dword
    extrn '__imp__RtlTimeToTimeFields@8' as RtlTimeToTimeFields:dword
    extrn '__imp__RtlTraceDatabaseAdd@16' as RtlTraceDatabaseAdd:dword
    extrn '__imp__RtlTraceDatabaseCreate@20' as RtlTraceDatabaseCreate:dword
    extrn '__imp__RtlTraceDatabaseDestroy@4' as RtlTraceDatabaseDestroy:dword
    extrn '__imp__RtlTraceDatabaseEnumerate@12' as RtlTraceDatabaseEnumerate:dword
    extrn '__imp__RtlTraceDatabaseFind@16' as RtlTraceDatabaseFind:dword
    extrn '__imp__RtlTraceDatabaseLock@4' as RtlTraceDatabaseLock:dword
    extrn '__imp__RtlTraceDatabaseUnlock@4' as RtlTraceDatabaseUnlock:dword
    extrn '__imp__RtlTraceDatabaseValidate@4' as RtlTraceDatabaseValidate:dword
    extrn '__imp__RtlTryEnterCriticalSection@4' as RtlTryEnterCriticalSection:dword
    extrn '__imp__RtlUnhandledExceptionFilter@4' as RtlUnhandledExceptionFilter:dword
    extrn '__imp__RtlUnhandledExceptionFilter2@8' as RtlUnhandledExceptionFilter2:dword
    extrn '__imp__RtlUnicodeStringToAnsiSize@4' as RtlUnicodeStringToAnsiSize:dword
    extrn '__imp__RtlUnicodeStringToAnsiString@12' as RtlUnicodeStringToAnsiString:dword
    extrn '__imp__RtlUnicodeStringToCountedOemString@12' as RtlUnicodeStringToCountedOemString:dword
    extrn '__imp__RtlUnicodeStringToInteger@12' as RtlUnicodeStringToInteger:dword
    extrn '__imp__RtlUnicodeStringToOemSize@4' as RtlUnicodeStringToOemSize:dword
    extrn '__imp__RtlUnicodeStringToOemString@12' as RtlUnicodeStringToOemString:dword
    extrn '__imp__RtlUnicodeToCustomCPN@24' as RtlUnicodeToCustomCPN:dword
    extrn '__imp__RtlUnicodeToMultiByteN@20' as RtlUnicodeToMultiByteN:dword
    extrn '__imp__RtlUnicodeToMultiByteSize@12' as RtlUnicodeToMultiByteSize:dword
    extrn '__imp__RtlUnicodeToOemN@20' as RtlUnicodeToOemN:dword
    extrn '__imp__RtlUniform@4' as RtlUniform:dword
    extrn '__imp__RtlUnlockBootStatusData@4' as RtlUnlockBootStatusData:dword
    extrn '__imp__RtlUnlockHeap@4' as RtlUnlockHeap:dword
    extrn '__imp__RtlUnlockMemoryStreamRegion@24' as RtlUnlockMemoryStreamRegion:dword
    extrn '__imp__RtlUnwind@16' as RtlUnwind:dword
    extrn '__imp__RtlUpcaseUnicodeChar@4' as RtlUpcaseUnicodeChar:dword
    extrn '__imp__RtlUpcaseUnicodeString@12' as RtlUpcaseUnicodeString:dword
    extrn '__imp__RtlUpcaseUnicodeStringToAnsiString@12' as RtlUpcaseUnicodeStringToAnsiString:dword
    extrn '__imp__RtlUpcaseUnicodeStringToCountedOemString@12' as RtlUpcaseUnicodeStringToCountedOemString:dword
    extrn '__imp__RtlUpcaseUnicodeStringToOemString@12' as RtlUpcaseUnicodeStringToOemString:dword
    extrn '__imp__RtlUpcaseUnicodeToCustomCPN@24' as RtlUpcaseUnicodeToCustomCPN:dword
    extrn '__imp__RtlUpcaseUnicodeToMultiByteN@20' as RtlUpcaseUnicodeToMultiByteN:dword
    extrn '__imp__RtlUpcaseUnicodeToOemN@20' as RtlUpcaseUnicodeToOemN:dword
    extrn '__imp__RtlUpdateTimer@16' as RtlUpdateTimer:dword
    extrn '__imp__RtlUpperChar@4' as RtlUpperChar:dword
    extrn '__imp__RtlUpperString@8' as RtlUpperString:dword
    extrn '__imp__RtlUsageHeap@12' as RtlUsageHeap:dword
    extrn '__imp__RtlValidAcl@4' as RtlValidAcl:dword
    extrn '__imp__RtlValidateHeap@12' as RtlValidateHeap:dword
    extrn '__imp__RtlValidateProcessHeaps@0' as RtlValidateProcessHeaps:dword
    extrn '__imp__RtlValidateUnicodeString@8' as RtlValidateUnicodeString:dword
    extrn '__imp__RtlValidRelativeSecurityDescriptor@12' as RtlValidRelativeSecurityDescriptor:dword
    extrn '__imp__RtlValidSecurityDescriptor@4' as RtlValidSecurityDescriptor:dword
    extrn '__imp__RtlValidSid@4' as RtlValidSid:dword
    extrn '__imp__RtlVerifyVersionInfo@16' as RtlVerifyVersionInfo:dword
    extrn '__imp__RtlWalkFrameChain@12' as RtlWalkFrameChain:dword
    extrn '__imp__RtlWalkHeap@8' as RtlWalkHeap:dword
    extrn '__imp__RtlWriteMemoryStream@16' as RtlWriteMemoryStream:dword
    extrn '__imp__RtlWriteRegistryValue@24' as RtlWriteRegistryValue:dword
    extrn '__imp__RtlxAnsiStringToUnicodeSize@4' as RtlxAnsiStringToUnicodeSize:dword
    extrn '__imp__RtlxOemStringToUnicodeSize@4' as RtlxOemStringToUnicodeSize:dword
    extrn '__imp__RtlxUnicodeStringToAnsiSize@4' as RtlxUnicodeStringToAnsiSize:dword
    extrn '__imp__RtlxUnicodeStringToOemSize@4' as RtlxUnicodeStringToOemSize:dword
    extrn '__imp__RtlZeroHeap@8' as RtlZeroHeap:dword
    extrn '__imp__RtlZeroMemory@8' as RtlZeroMemory:dword
    extrn '__imp__RtlZombifyActivationContext@4' as RtlZombifyActivationContext:dword
    extrn '__imp__VerSetConditionMask@16' as VerSetConditionMask:dword
    extrn '__imp__ZwAcceptConnectPort@24' as ZwAcceptConnectPort:dword
    extrn '__imp__ZwAccessCheck@32' as ZwAccessCheck:dword
    extrn '__imp__ZwAccessCheckAndAuditAlarm@44' as ZwAccessCheckAndAuditAlarm:dword
    extrn '__imp__ZwAccessCheckByType@44' as ZwAccessCheckByType:dword
    extrn '__imp__ZwAccessCheckByTypeAndAuditAlarm@64' as ZwAccessCheckByTypeAndAuditAlarm:dword
    extrn '__imp__ZwAccessCheckByTypeResultList@44' as ZwAccessCheckByTypeResultList:dword
    extrn '__imp__ZwAccessCheckByTypeResultListAndAuditAlarm@64' as ZwAccessCheckByTypeResultListAndAuditAlarm:dword
    extrn '__imp__ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68' as ZwAccessCheckByTypeResultListAndAuditAlarmByHandle:dword
    extrn '__imp__ZwAddAtom@12' as ZwAddAtom:dword
    extrn '__imp__ZwAddBootEntry@8' as ZwAddBootEntry:dword
    extrn '__imp__ZwAdjustGroupsToken@24' as ZwAdjustGroupsToken:dword
    extrn '__imp__ZwAdjustPrivilegesToken@24' as ZwAdjustPrivilegesToken:dword
    extrn '__imp__ZwAlertResumeThread@8' as ZwAlertResumeThread:dword
    extrn '__imp__ZwAlertThread@4' as ZwAlertThread:dword
    extrn '__imp__ZwAllocateLocallyUniqueId@4' as ZwAllocateLocallyUniqueId:dword
    extrn '__imp__ZwAllocateUserPhysicalPages@12' as ZwAllocateUserPhysicalPages:dword
    extrn '__imp__ZwAllocateUuids@16' as ZwAllocateUuids:dword
    extrn '__imp__ZwAllocateVirtualMemory@24' as ZwAllocateVirtualMemory:dword
    extrn '__imp__ZwAreMappedFilesTheSame@8' as ZwAreMappedFilesTheSame:dword
    extrn '__imp__ZwAssignProcessToJobObject@8' as ZwAssignProcessToJobObject:dword
    extrn '__imp__ZwCallbackReturn@12' as ZwCallbackReturn:dword
    extrn '__imp__ZwCancelDeviceWakeupRequest@4' as ZwCancelDeviceWakeupRequest:dword
    extrn '__imp__ZwCancelIoFile@8' as ZwCancelIoFile:dword
    extrn '__imp__ZwCancelTimer@8' as ZwCancelTimer:dword
    extrn '__imp__ZwClearEvent@4' as ZwClearEvent:dword
    extrn '__imp__ZwClose@4' as ZwClose:dword
    extrn '__imp__ZwCloseObjectAuditAlarm@12' as ZwCloseObjectAuditAlarm:dword
    extrn '__imp__ZwCompactKeys@8' as ZwCompactKeys:dword
    extrn '__imp__ZwCompareTokens@12' as ZwCompareTokens:dword
    extrn '__imp__ZwCompleteConnectPort@4' as ZwCompleteConnectPort:dword
    extrn '__imp__ZwCompressKey@4' as ZwCompressKey:dword
    extrn '__imp__ZwConnectPort@32' as ZwConnectPort:dword
    extrn '__imp__ZwContinue@8' as ZwContinue:dword
    extrn '__imp__ZwCreateDebugObject@16' as ZwCreateDebugObject:dword
    extrn '__imp__ZwCreateDirectoryObject@12' as ZwCreateDirectoryObject:dword
    extrn '__imp__ZwCreateEvent@20' as ZwCreateEvent:dword
    extrn '__imp__ZwCreateEventPair@12' as ZwCreateEventPair:dword
    extrn '__imp__ZwCreateFile@44' as ZwCreateFile:dword
    extrn '__imp__ZwCreateIoCompletion@16' as ZwCreateIoCompletion:dword
    extrn '__imp__ZwCreateJobObject@12' as ZwCreateJobObject:dword
    extrn '__imp__ZwCreateJobSet@12' as ZwCreateJobSet:dword
    extrn '__imp__ZwCreateKey@28' as ZwCreateKey:dword
    extrn '__imp__ZwCreateKeyedEvent@16' as ZwCreateKeyedEvent:dword
    extrn '__imp__ZwCreateMailslotFile@32' as ZwCreateMailslotFile:dword
    extrn '__imp__ZwCreateMutant@16' as ZwCreateMutant:dword
    extrn '__imp__ZwCreateNamedPipeFile@56' as ZwCreateNamedPipeFile:dword
    extrn '__imp__ZwCreatePagingFile@16' as ZwCreatePagingFile:dword
    extrn '__imp__ZwCreatePort@20' as ZwCreatePort:dword
    extrn '__imp__ZwCreateProcess@32' as ZwCreateProcess:dword
    extrn '__imp__ZwCreateProcessEx@36' as ZwCreateProcessEx:dword
    extrn '__imp__ZwCreateProfile@36' as ZwCreateProfile:dword
    extrn '__imp__ZwCreateSection@28' as ZwCreateSection:dword
    extrn '__imp__ZwCreateSemaphore@20' as ZwCreateSemaphore:dword
    extrn '__imp__ZwCreateSymbolicLinkObject@16' as ZwCreateSymbolicLinkObject:dword
    extrn '__imp__ZwCreateThread@32' as ZwCreateThread:dword
    extrn '__imp__ZwCreateTimer@16' as ZwCreateTimer:dword
    extrn '__imp__ZwCreateToken@52' as ZwCreateToken:dword
    extrn '__imp__ZwCreateWaitablePort@20' as ZwCreateWaitablePort:dword
    extrn '__imp__ZwDebugActiveProcess@8' as ZwDebugActiveProcess:dword
    extrn '__imp__ZwDebugContinue@12' as ZwDebugContinue:dword
    extrn '__imp__ZwDelayExecution@8' as ZwDelayExecution:dword
    extrn '__imp__ZwDeleteAtom@4' as ZwDeleteAtom:dword
    extrn '__imp__ZwDeleteBootEntry@4' as ZwDeleteBootEntry:dword
    extrn '__imp__ZwDeleteFile@4' as ZwDeleteFile:dword
    extrn '__imp__ZwDeleteKey@4' as ZwDeleteKey:dword
    extrn '__imp__ZwDeleteObjectAuditAlarm@12' as ZwDeleteObjectAuditAlarm:dword
    extrn '__imp__ZwDeleteValueKey@8' as ZwDeleteValueKey:dword
    extrn '__imp__ZwDeviceIoControlFile@40' as ZwDeviceIoControlFile:dword
    extrn '__imp__ZwDisplayString@4' as ZwDisplayString:dword
    extrn '__imp__ZwDuplicateObject@28' as ZwDuplicateObject:dword
    extrn '__imp__ZwDuplicateToken@24' as ZwDuplicateToken:dword
    extrn '__imp__ZwEnumerateBootEntries@8' as ZwEnumerateBootEntries:dword
    extrn '__imp__ZwEnumerateKey@24' as ZwEnumerateKey:dword
    extrn '__imp__ZwEnumerateSystemEnvironmentValuesEx@12' as ZwEnumerateSystemEnvironmentValuesEx:dword
    extrn '__imp__ZwEnumerateValueKey@24' as ZwEnumerateValueKey:dword
    extrn '__imp__ZwExtendSection@8' as ZwExtendSection:dword
    extrn '__imp__ZwFilterToken@24' as ZwFilterToken:dword
    extrn '__imp__ZwFindAtom@12' as ZwFindAtom:dword
    extrn '__imp__ZwFlushBuffersFile@8' as ZwFlushBuffersFile:dword
    extrn '__imp__ZwFlushInstructionCache@12' as ZwFlushInstructionCache:dword
    extrn '__imp__ZwFlushKey@4' as ZwFlushKey:dword
    extrn '__imp__ZwFlushVirtualMemory@16' as ZwFlushVirtualMemory:dword
    extrn '__imp__ZwFlushWriteBuffer@0' as ZwFlushWriteBuffer:dword
    extrn '__imp__ZwFreeUserPhysicalPages@12' as ZwFreeUserPhysicalPages:dword
    extrn '__imp__ZwFreeVirtualMemory@16' as ZwFreeVirtualMemory:dword
    extrn '__imp__ZwFsControlFile@40' as ZwFsControlFile:dword
    extrn '__imp__ZwGetContextThread@8' as ZwGetContextThread:dword
    extrn '__imp__ZwGetDevicePowerState@8' as ZwGetDevicePowerState:dword
    extrn '__imp__ZwGetPlugPlayEvent@16' as ZwGetPlugPlayEvent:dword
    extrn '__imp__ZwGetWriteWatch@28' as ZwGetWriteWatch:dword
    extrn '__imp__ZwImpersonateAnonymousToken@4' as ZwImpersonateAnonymousToken:dword
    extrn '__imp__ZwImpersonateClientOfPort@8' as ZwImpersonateClientOfPort:dword
    extrn '__imp__ZwImpersonateThread@12' as ZwImpersonateThread:dword
    extrn '__imp__ZwInitializeRegistry@4' as ZwInitializeRegistry:dword
    extrn '__imp__ZwInitiatePowerAction@16' as ZwInitiatePowerAction:dword
    extrn '__imp__ZwIsProcessInJob@8' as ZwIsProcessInJob:dword
    extrn '__imp__ZwIsSystemResumeAutomatic@0' as ZwIsSystemResumeAutomatic:dword
    extrn '__imp__ZwListenPort@8' as ZwListenPort:dword
    extrn '__imp__ZwLoadDriver@4' as ZwLoadDriver:dword
    extrn '__imp__ZwLoadKey@8' as ZwLoadKey:dword
    extrn '__imp__ZwLoadKey2@12' as ZwLoadKey2:dword
    extrn '__imp__ZwLockFile@40' as ZwLockFile:dword
    extrn '__imp__ZwLockProductActivationKeys@8' as ZwLockProductActivationKeys:dword
    extrn '__imp__ZwLockRegistryKey@4' as ZwLockRegistryKey:dword
    extrn '__imp__ZwLockVirtualMemory@16' as ZwLockVirtualMemory:dword
    extrn '__imp__ZwMakePermanentObject@4' as ZwMakePermanentObject:dword
    extrn '__imp__ZwMakeTemporaryObject@4' as ZwMakeTemporaryObject:dword
    extrn '__imp__ZwMapUserPhysicalPages@12' as ZwMapUserPhysicalPages:dword
    extrn '__imp__ZwMapUserPhysicalPagesScatter@12' as ZwMapUserPhysicalPagesScatter:dword
    extrn '__imp__ZwMapViewOfSection@40' as ZwMapViewOfSection:dword
    extrn '__imp__ZwModifyBootEntry@4' as ZwModifyBootEntry:dword
    extrn '__imp__ZwNotifyChangeDirectoryFile@36' as ZwNotifyChangeDirectoryFile:dword
    extrn '__imp__ZwNotifyChangeKey@40' as ZwNotifyChangeKey:dword
    extrn '__imp__ZwNotifyChangeMultipleKeys@48' as ZwNotifyChangeMultipleKeys:dword
    extrn '__imp__ZwOpenDirectoryObject@12' as ZwOpenDirectoryObject:dword
    extrn '__imp__ZwOpenEvent@12' as ZwOpenEvent:dword
    extrn '__imp__ZwOpenEventPair@12' as ZwOpenEventPair:dword
    extrn '__imp__ZwOpenFile@24' as ZwOpenFile:dword
    extrn '__imp__ZwOpenIoCompletion@12' as ZwOpenIoCompletion:dword
    extrn '__imp__ZwOpenJobObject@12' as ZwOpenJobObject:dword
    extrn '__imp__ZwOpenKey@12' as ZwOpenKey:dword
    extrn '__imp__ZwOpenKeyedEvent@12' as ZwOpenKeyedEvent:dword
    extrn '__imp__ZwOpenMutant@12' as ZwOpenMutant:dword
    extrn '__imp__ZwOpenObjectAuditAlarm@48' as ZwOpenObjectAuditAlarm:dword
    extrn '__imp__ZwOpenProcess@16' as ZwOpenProcess:dword
    extrn '__imp__ZwOpenProcessToken@12' as ZwOpenProcessToken:dword
    extrn '__imp__ZwOpenProcessTokenEx@16' as ZwOpenProcessTokenEx:dword
    extrn '__imp__ZwOpenSection@12' as ZwOpenSection:dword
    extrn '__imp__ZwOpenSemaphore@12' as ZwOpenSemaphore:dword
    extrn '__imp__ZwOpenSymbolicLinkObject@12' as ZwOpenSymbolicLinkObject:dword
    extrn '__imp__ZwOpenThread@16' as ZwOpenThread:dword
    extrn '__imp__ZwOpenThreadToken@16' as ZwOpenThreadToken:dword
    extrn '__imp__ZwOpenThreadTokenEx@20' as ZwOpenThreadTokenEx:dword
    extrn '__imp__ZwOpenTimer@12' as ZwOpenTimer:dword
    extrn '__imp__ZwPlugPlayControl@12' as ZwPlugPlayControl:dword
    extrn '__imp__ZwPowerInformation@20' as ZwPowerInformation:dword
    extrn '__imp__ZwPrivilegeCheck@12' as ZwPrivilegeCheck:dword
    extrn '__imp__ZwPrivilegedServiceAuditAlarm@20' as ZwPrivilegedServiceAuditAlarm:dword
    extrn '__imp__ZwPrivilegeObjectAuditAlarm@24' as ZwPrivilegeObjectAuditAlarm:dword
    extrn '__imp__ZwProtectVirtualMemory@20' as ZwProtectVirtualMemory:dword
    extrn '__imp__ZwPulseEvent@8' as ZwPulseEvent:dword
    extrn '__imp__ZwQueryAttributesFile@8' as ZwQueryAttributesFile:dword
    extrn '__imp__ZwQueryBootEntryOrder@8' as ZwQueryBootEntryOrder:dword
    extrn '__imp__ZwQueryBootOptions@8' as ZwQueryBootOptions:dword
    extrn '__imp__ZwQueryDebugFilterState@8' as ZwQueryDebugFilterState:dword
    extrn '__imp__ZwQueryDefaultLocale@8' as ZwQueryDefaultLocale:dword
    extrn '__imp__ZwQueryDefaultUILanguage@4' as ZwQueryDefaultUILanguage:dword
    extrn '__imp__ZwQueryDirectoryFile@44' as ZwQueryDirectoryFile:dword
    extrn '__imp__ZwQueryDirectoryObject@28' as ZwQueryDirectoryObject:dword
    extrn '__imp__ZwQueryEaFile@36' as ZwQueryEaFile:dword
    extrn '__imp__ZwQueryEvent@20' as ZwQueryEvent:dword
    extrn '__imp__ZwQueryFullAttributesFile@8' as ZwQueryFullAttributesFile:dword
    extrn '__imp__ZwQueryInformationAtom@20' as ZwQueryInformationAtom:dword
    extrn '__imp__ZwQueryInformationFile@20' as ZwQueryInformationFile:dword
    extrn '__imp__ZwQueryInformationJobObject@20' as ZwQueryInformationJobObject:dword
    extrn '__imp__ZwQueryInformationPort@20' as ZwQueryInformationPort:dword
    extrn '__imp__ZwQueryInformationProcess@20' as ZwQueryInformationProcess:dword
    extrn '__imp__ZwQueryInformationThread@20' as ZwQueryInformationThread:dword
    extrn '__imp__ZwQueryInformationToken@20' as ZwQueryInformationToken:dword
    extrn '__imp__ZwQueryInstallUILanguage@4' as ZwQueryInstallUILanguage:dword
    extrn '__imp__ZwQueryIntervalProfile@8' as ZwQueryIntervalProfile:dword
    extrn '__imp__ZwQueryIoCompletion@20' as ZwQueryIoCompletion:dword
    extrn '__imp__ZwQueryKey@20' as ZwQueryKey:dword
    extrn '__imp__ZwQueryMultipleValueKey@24' as ZwQueryMultipleValueKey:dword
    extrn '__imp__ZwQueryMutant@20' as ZwQueryMutant:dword
    extrn '__imp__ZwQueryObject@20' as ZwQueryObject:dword
    extrn '__imp__ZwQueryOpenSubKeys@8' as ZwQueryOpenSubKeys:dword
    extrn '__imp__ZwQueryPerformanceCounter@8' as ZwQueryPerformanceCounter:dword
    extrn '__imp__ZwQueryPortInformationProcess@0' as ZwQueryPortInformationProcess:dword
    extrn '__imp__ZwQueryQuotaInformationFile@36' as ZwQueryQuotaInformationFile:dword
    extrn '__imp__ZwQuerySection@20' as ZwQuerySection:dword
    extrn '__imp__ZwQuerySecurityObject@20' as ZwQuerySecurityObject:dword
    extrn '__imp__ZwQuerySemaphore@20' as ZwQuerySemaphore:dword
    extrn '__imp__ZwQuerySymbolicLinkObject@12' as ZwQuerySymbolicLinkObject:dword
    extrn '__imp__ZwQuerySystemEnvironmentValue@16' as ZwQuerySystemEnvironmentValue:dword
    extrn '__imp__ZwQuerySystemEnvironmentValueEx@20' as ZwQuerySystemEnvironmentValueEx:dword
    extrn '__imp__ZwQuerySystemInformation@16' as ZwQuerySystemInformation:dword
    extrn '__imp__ZwQuerySystemTime@4' as ZwQuerySystemTime:dword
    extrn '__imp__ZwQueryTimer@20' as ZwQueryTimer:dword
    extrn '__imp__ZwQueryTimerResolution@12' as ZwQueryTimerResolution:dword
    extrn '__imp__ZwQueryValueKey@24' as ZwQueryValueKey:dword
    extrn '__imp__ZwQueryVirtualMemory@24' as ZwQueryVirtualMemory:dword
    extrn '__imp__ZwQueryVolumeInformationFile@20' as ZwQueryVolumeInformationFile:dword
    extrn '__imp__ZwQueueApcThread@20' as ZwQueueApcThread:dword
    extrn '__imp__ZwRaiseException@12' as ZwRaiseException:dword
    extrn '__imp__ZwRaiseHardError@24' as ZwRaiseHardError:dword
    extrn '__imp__ZwReadFile@36' as ZwReadFile:dword
    extrn '__imp__ZwReadFileScatter@36' as ZwReadFileScatter:dword
    extrn '__imp__ZwReadRequestData@24' as ZwReadRequestData:dword
    extrn '__imp__ZwReadVirtualMemory@20' as ZwReadVirtualMemory:dword
    extrn '__imp__ZwRegisterThreadTerminatePort@4' as ZwRegisterThreadTerminatePort:dword
    extrn '__imp__ZwReleaseKeyedEvent@16' as ZwReleaseKeyedEvent:dword
    extrn '__imp__ZwReleaseMutant@8' as ZwReleaseMutant:dword
    extrn '__imp__ZwReleaseSemaphore@12' as ZwReleaseSemaphore:dword
    extrn '__imp__ZwRemoveIoCompletion@20' as ZwRemoveIoCompletion:dword
    extrn '__imp__ZwRemoveProcessDebug@8' as ZwRemoveProcessDebug:dword
    extrn '__imp__ZwRenameKey@8' as ZwRenameKey:dword
    extrn '__imp__ZwReplaceKey@12' as ZwReplaceKey:dword
    extrn '__imp__ZwReplyPort@8' as ZwReplyPort:dword
    extrn '__imp__ZwReplyWaitReceivePort@16' as ZwReplyWaitReceivePort:dword
    extrn '__imp__ZwReplyWaitReceivePortEx@20' as ZwReplyWaitReceivePortEx:dword
    extrn '__imp__ZwReplyWaitReplyPort@8' as ZwReplyWaitReplyPort:dword
    extrn '__imp__ZwRequestDeviceWakeup@4' as ZwRequestDeviceWakeup:dword
    extrn '__imp__ZwRequestPort@8' as ZwRequestPort:dword
    extrn '__imp__ZwRequestWaitReplyPort@12' as ZwRequestWaitReplyPort:dword
    extrn '__imp__ZwRequestWakeupLatency@4' as ZwRequestWakeupLatency:dword
    extrn '__imp__ZwResetEvent@8' as ZwResetEvent:dword
    extrn '__imp__ZwResetWriteWatch@12' as ZwResetWriteWatch:dword
    extrn '__imp__ZwRestoreKey@12' as ZwRestoreKey:dword
    extrn '__imp__ZwResumeProcess@4' as ZwResumeProcess:dword
    extrn '__imp__ZwResumeThread@8' as ZwResumeThread:dword
    extrn '__imp__ZwSaveKey@8' as ZwSaveKey:dword
    extrn '__imp__ZwSaveKeyEx@12' as ZwSaveKeyEx:dword
    extrn '__imp__ZwSaveMergedKeys@12' as ZwSaveMergedKeys:dword
    extrn '__imp__ZwSecureConnectPort@36' as ZwSecureConnectPort:dword
    extrn '__imp__ZwSetBootEntryOrder@8' as ZwSetBootEntryOrder:dword
    extrn '__imp__ZwSetBootOptions@8' as ZwSetBootOptions:dword
    extrn '__imp__ZwSetContextThread@8' as ZwSetContextThread:dword
    extrn '__imp__ZwSetDebugFilterState@12' as ZwSetDebugFilterState:dword
    extrn '__imp__ZwSetDefaultHardErrorPort@4' as ZwSetDefaultHardErrorPort:dword
    extrn '__imp__ZwSetDefaultLocale@8' as ZwSetDefaultLocale:dword
    extrn '__imp__ZwSetDefaultUILanguage@4' as ZwSetDefaultUILanguage:dword
    extrn '__imp__ZwSetEaFile@16' as ZwSetEaFile:dword
    extrn '__imp__ZwSetEvent@8' as ZwSetEvent:dword
    extrn '__imp__ZwSetEventBoostPriority@4' as ZwSetEventBoostPriority:dword
    extrn '__imp__ZwSetHighEventPair@4' as ZwSetHighEventPair:dword
    extrn '__imp__ZwSetHighWaitLowEventPair@4' as ZwSetHighWaitLowEventPair:dword
    extrn '__imp__ZwSetInformationDebugObject@20' as ZwSetInformationDebugObject:dword
    extrn '__imp__ZwSetInformationFile@20' as ZwSetInformationFile:dword
    extrn '__imp__ZwSetInformationJobObject@16' as ZwSetInformationJobObject:dword
    extrn '__imp__ZwSetInformationKey@16' as ZwSetInformationKey:dword
    extrn '__imp__ZwSetInformationObject@16' as ZwSetInformationObject:dword
    extrn '__imp__ZwSetInformationProcess@16' as ZwSetInformationProcess:dword
    extrn '__imp__ZwSetInformationThread@16' as ZwSetInformationThread:dword
    extrn '__imp__ZwSetInformationToken@16' as ZwSetInformationToken:dword
    extrn '__imp__ZwSetIntervalProfile@8' as ZwSetIntervalProfile:dword
    extrn '__imp__ZwSetIoCompletion@20' as ZwSetIoCompletion:dword
    extrn '__imp__ZwSetLdtEntries@24' as ZwSetLdtEntries:dword
    extrn '__imp__ZwSetLowEventPair@4' as ZwSetLowEventPair:dword
    extrn '__imp__ZwSetLowWaitHighEventPair@4' as ZwSetLowWaitHighEventPair:dword
    extrn '__imp__ZwSetQuotaInformationFile@16' as ZwSetQuotaInformationFile:dword
    extrn '__imp__ZwSetSecurityObject@12' as ZwSetSecurityObject:dword
    extrn '__imp__ZwSetSystemEnvironmentValue@8' as ZwSetSystemEnvironmentValue:dword
    extrn '__imp__ZwSetSystemEnvironmentValueEx@20' as ZwSetSystemEnvironmentValueEx:dword
    extrn '__imp__ZwSetSystemInformation@12' as ZwSetSystemInformation:dword
    extrn '__imp__ZwSetSystemPowerState@12' as ZwSetSystemPowerState:dword
    extrn '__imp__ZwSetSystemTime@8' as ZwSetSystemTime:dword
    extrn '__imp__ZwSetThreadExecutionState@8' as ZwSetThreadExecutionState:dword
    extrn '__imp__ZwSetTimer@28' as ZwSetTimer:dword
    extrn '__imp__ZwSetTimerResolution@12' as ZwSetTimerResolution:dword
    extrn '__imp__ZwSetUuidSeed@4' as ZwSetUuidSeed:dword
    extrn '__imp__ZwSetValueKey@24' as ZwSetValueKey:dword
    extrn '__imp__ZwSetVolumeInformationFile@20' as ZwSetVolumeInformationFile:dword
    extrn '__imp__ZwShutdownSystem@4' as ZwShutdownSystem:dword
    extrn '__imp__ZwSignalAndWaitForSingleObject@16' as ZwSignalAndWaitForSingleObject:dword
    extrn '__imp__ZwStartProfile@4' as ZwStartProfile:dword
    extrn '__imp__ZwStopProfile@4' as ZwStopProfile:dword
    extrn '__imp__ZwSuspendProcess@4' as ZwSuspendProcess:dword
    extrn '__imp__ZwSuspendThread@8' as ZwSuspendThread:dword
    extrn '__imp__ZwSystemDebugControl@24' as ZwSystemDebugControl:dword
    extrn '__imp__ZwTerminateJobObject@8' as ZwTerminateJobObject:dword
    extrn '__imp__ZwTerminateProcess@8' as ZwTerminateProcess:dword
    extrn '__imp__ZwTerminateThread@8' as ZwTerminateThread:dword
    extrn '__imp__ZwTestAlert@0' as ZwTestAlert:dword
    extrn '__imp__ZwTraceEvent@16' as ZwTraceEvent:dword
    extrn '__imp__ZwTranslateFilePath@16' as ZwTranslateFilePath:dword
    extrn '__imp__ZwUnloadDriver@4' as ZwUnloadDriver:dword
    extrn '__imp__ZwUnloadKey@4' as ZwUnloadKey:dword
    extrn '__imp__ZwUnloadKeyEx@8' as ZwUnloadKeyEx:dword
    extrn '__imp__ZwUnlockFile@20' as ZwUnlockFile:dword
    extrn '__imp__ZwUnlockVirtualMemory@16' as ZwUnlockVirtualMemory:dword
    extrn '__imp__ZwUnmapViewOfSection@8' as ZwUnmapViewOfSection:dword
    extrn '__imp__ZwVdmControl@8' as ZwVdmControl:dword
    extrn '__imp__ZwWaitForDebugEvent@16' as ZwWaitForDebugEvent:dword
    extrn '__imp__ZwWaitForKeyedEvent@16' as ZwWaitForKeyedEvent:dword
    extrn '__imp__ZwWaitForMultipleObjects@20' as ZwWaitForMultipleObjects:dword
    extrn '__imp__ZwWaitForSingleObject@12' as ZwWaitForSingleObject:dword
    extrn '__imp__ZwWaitHighEventPair@4' as ZwWaitHighEventPair:dword
    extrn '__imp__ZwWaitLowEventPair@4' as ZwWaitLowEventPair:dword
    extrn '__imp__ZwWriteFile@36' as ZwWriteFile:dword
    extrn '__imp__ZwWriteFileGather@36' as ZwWriteFileGather:dword
    extrn '__imp__ZwWriteRequestData@24' as ZwWriteRequestData:dword
    extrn '__imp__ZwWriteVirtualMemory@20' as ZwWriteVirtualMemory:dword
    extrn '__imp__ZwYieldExecution@0' as ZwYieldExecution:dword

    api RtlIpv4AddressToStringEx,\
        RtlIpv4AddressToString,\
        RtlIpv4StringToAddressEx,\
        RtlIpv4StringToAddress,\
        RtlIpv6AddressToStringEx,\
        RtlIpv6AddressToString,\
        RtlIpv6StringToAddressEx,\
        RtlIpv6StringToAddress
end if

;======================= Undocumented functions (unknown arguments) =======================;
;if defined APP_WIN_64
    ;extrn '__imp_EtwTraceMessageVa' as EtwTraceMessageVa:qword
    ;extrn '__imp_ExpInterlockedPopEntrySListEnd' as ExpInterlockedPopEntrySListEnd:qword
    ;extrn '__imp_ExpInterlockedPopEntrySListFault' as ExpInterlockedPopEntrySListFault:qword
    ;extrn '__imp_ExpInterlockedPopEntrySListResume' as ExpInterlockedPopEntrySListResume:qword
    ;extrn '__imp_LdrProcessInitializationComplete' as LdrProcessInitializationComplete:qword
    ;extrn '__imp__fltused' as _fltused:qword
    ;extrn '__imp_ZwApphelpCacheControl' as ZwApphelpCacheControl:qword
    ;if ~defined __misaligned_access
    ;    extrn '__imp___misaligned_access' as __misaligned_access:qword
    ;end if
    ;IF (NTDDI_VERSION >= NTDDI_VISTA)
    ;    extrn '__imp_RtlCompleteProcessCloning' as RtlCompleteProcessCloning:qword
    ;end if
    ;IF (NTDDI_VERSION >= NTDDI_WIN7)
    ;    extrn '__imp_RtlCreateUmsCompletionList' as RtlCreateUmsCompletionList:qword
    ;    extrn '__imp_RtlCreateUmsThreadContext' as RtlCreateUmsThreadContext:qword
    ;    extrn '__imp_RtlDeleteUmsCompletionList' as RtlDeleteUmsCompletionList:qword
    ;    extrn '__imp_RtlDeleteUmsThreadContext' as RtlDeleteUmsThreadContext:qword
    ;    extrn '__imp_RtlDequeueUmsCompletionListItems' as RtlDequeueUmsCompletionListItems:qword
    ;    extrn '__imp_RtlEnterUmsSchedulingMode' as RtlEnterUmsSchedulingMode:qword
    ;    extrn '__imp_RtlExecuteUmsThread' as RtlExecuteUmsThread:qword
    ;    extrn '__imp_RtlGetCurrentUmsThread' as RtlGetCurrentUmsThread:qword
    ;    extrn '__imp_RtlGetNextUmsListItem' as RtlGetNextUmsListItem:qword
    ;    extrn '__imp_RtlGetUmsCompletionListEvent' as RtlGetUmsCompletionListEvent:qword
    ;    extrn '__imp_RtlpUmsExecuteYieldThreadEnd' as RtlpUmsExecuteYieldThreadEnd:qword
    ;    extrn '__imp_RtlpUmsThreadYield' as RtlpUmsThreadYield:qword
    ;    extrn '__imp_RtlNtdllName' as RtlNtdllName:qword
    ;    extrn '__imp_RtlpExecuteUmsThread' as RtlpExecuteUmsThread:qword
    ;    extrn '__imp_RtlPrepareForProcessCloning' as RtlPrepareForProcessCloning:qword
    ;    extrn '__imp_RtlpQueryProcessDebugInformationFromWow64' as RtlpQueryProcessDebugInformationFromWow64:qword
    ;    extrn '__imp_RtlQueryUmsThreadInformation' as RtlQueryUmsThreadInformation:qword
    ;    extrn '__imp_RtlSetUmsThreadInformation' as RtlSetUmsThreadInformation:qword
    ;    extrn '__imp_RtlUmsThreadYield' as RtlUmsThreadYield:qword
    ;    extrn '__imp_RtlWow64GetThreadSelectorEntry' as RtlWow64GetThreadSelectorEntry:qword
    ;    extrn '__imp_RtlWow64SuspendThread' as RtlWow64SuspendThread:qword
    ;end if
    ;if (NTDDI_VERSION >= NTDDI_WIN81)
    ;    extrn '__imp_KiUserInvertedFunctionTable' as KiUserInvertedFunctionTable:qword
    ;end if
    ;if (NTDDI_VERSION >= NTDDI_WIN10)
    ;    extrn '__imp_EtwCheckCoverage' as EtwCheckCoverage:qword
    ;    extrn '__imp_RtlCallEnclaveReturn' as RtlCallEnclaveReturn:qword
    ;    extrn '__imp_RtlCreateUserFiberShadowStack' as :qword
    ;    extrn '__imp_RtlEnclaveCallDispatch' as RtlEnclaveCallDispatch:qword
    ;    extrn '__imp_RtlEnclaveCallDispatchReturn' as RtlEnclaveCallDispatchReturn:qword
    ;    extrn '__imp_RtlFreeUserFiberShadowStack' as RtlFreeUserFiberShadowStack:qword
    ;    extrn '__imp_RtlInitializeBitMapEx' as RtlInitializeBitMapEx:qword
    ;    extrn '__imp_RtlTestBitEx' as RtlTestBitEx:qword
    ;    extrn '__imp_RtlUserFiberStart' as RtlUserFiberStart:qword
    ;    extrn '__imp_RtlWow64GetCurrentCpuArea' as RtlWow64GetCurrentCpuArea:qword
    ;    extrn '__imp_RtlWow64SuspendProcess' as RtlWow64SuspendProcess:qword
    ;    extrn '__imp_RtlpQueryProcessDebugInformationRemote' as RtlpQueryProcessDebugInformationRemote:qword
    ;    extrn '__imp_RtlpWow64CtxFromAmd64' as RtlpWow64CtxFromAmd64:qword
    ;    extrn '__imp_RtlpWow64GetContextOnAmd64' as RtlpWow64GetContextOnAmd64:qword
    ;    extrn '__imp_RtlpWow64SetContextOnAmd64' as RtlpWow64SetContextOnAmd64:qword
    ;    extrn '__imp_RtlWow64PopAllCrossProcessWorkFromWorkList' as RtlWow64PopAllCrossProcessWorkFromWorkList:qword
    ;    extrn '__imp_RtlWow64PopCrossProcessWorkFromFreeList' as RtlWow64PopCrossProcessWorkFromFreeList:qword
    ;    extrn '__imp_RtlWow64PushCrossProcessWorkOntoFreeList' as RtlWow64PushCrossProcessWorkOntoFreeList:qword
    ;    extrn '__imp_RtlWow64PushCrossProcessWorkOntoWorkList' as RtlWow64PushCrossProcessWorkOntoWorkList:qword
    ;    extrn '__imp_RtlWow64RequestCrossProcessHeavyFlush' as RtlWow64RequestCrossProcessHeavyFlush:qword
    ;end if
;else
    ;extrn '__imp__EtwTraceMessageVa@??' as EtwTraceMessageVa:dword
    ;extrn '__imp__ExpInterlockedPopEntrySListEnd@??' as ExpInterlockedPopEntrySListEnd:dword
    ;extrn '__imp__ExpInterlockedPopEntrySListFault@??' as ExpInterlockedPopEntrySListFault:dword
    ;extrn '__imp__ExpInterlockedPopEntrySListResume@??' as ExpInterlockedPopEntrySListResume:dword
    ;extrn '__imp__LdrProcessInitializationComplete@??' as LdrProcessInitializationComplete:dword
    ;extrn '__imp___fltused@??' as _fltused:dword
    ;extrn '__imp__ZwApphelpCacheControl@??' as ZwApphelpCacheControl:dword
    ;if ~defined __misaligned_access
    ;    extrn '__imp____misaligned_access@??' as __misaligned_access:dword
    ;end if
    ;IF (NTDDI_VERSION >= NTDDI_VISTA)
    ;    extrn '__imp__RtlCompleteProcessCloning@??' as RtlCompleteProcessCloning:dword
    ;end if
    ;IF (NTDDI_VERSION >= NTDDI_WIN7)
    ;    extrn '__imp__RtlCreateUmsCompletionList@??' as RtlCreateUmsCompletionList:dword
    ;    extrn '__imp__RtlCreateUmsThreadContext@??' as RtlCreateUmsThreadContext:dword
    ;    extrn '__imp__RtlDeleteUmsCompletionList@??' as RtlDeleteUmsCompletionList:dword
    ;    extrn '__imp__RtlDeleteUmsThreadContext@??' as RtlDeleteUmsThreadContext:dword
    ;    extrn '__imp__RtlDequeueUmsCompletionListItems@??' as RtlDequeueUmsCompletionListItems:dword
    ;    extrn '__imp__RtlEnterUmsSchedulingMode@??' as RtlEnterUmsSchedulingMode:dword
    ;    extrn '__imp__RtlExecuteUmsThread@??' as RtlExecuteUmsThread:dword
    ;    extrn '__imp__RtlGetCurrentUmsThread@??' as RtlGetCurrentUmsThread:dword
    ;    extrn '__imp__RtlGetNextUmsListItem@??' as RtlGetNextUmsListItem:dword
    ;    extrn '__imp__RtlGetUmsCompletionListEvent@??' as RtlGetUmsCompletionListEvent:dword
    ;    extrn '__imp__RtlpUmsExecuteYieldThreadEnd@??' as RtlpUmsExecuteYieldThreadEnd:dword
    ;    extrn '__imp__RtlpUmsThreadYield@??' as RtlpUmsThreadYield:dword
    ;    extrn '__imp__RtlNtdllName@??' as RtlNtdllName:dword
    ;    extrn '__imp__RtlpExecuteUmsThread@??' as RtlpExecuteUmsThread:dword
    ;    extrn '__imp__RtlPrepareForProcessCloning@??' as RtlPrepareForProcessCloning:dword
    ;    extrn '__imp__RtlpQueryProcessDebugInformationFromWow64@??' as RtlpQueryProcessDebugInformationFromWow64:dword
    ;    extrn '__imp__RtlQueryUmsThreadInformation@??' as RtlQueryUmsThreadInformation:dword
    ;    extrn '__imp__RtlSetUmsThreadInformation@??' as RtlSetUmsThreadInformation:dword
    ;    extrn '__imp__RtlUmsThreadYield@??' as RtlUmsThreadYield:dword
    ;    extrn '__imp__RtlWow64GetThreadSelectorEntry@??' as RtlWow64GetThreadSelectorEntry:dword
    ;    extrn '__imp__RtlWow64SuspendThread@??' as RtlWow64SuspendThread:dword
    ;end if
    ;if (NTDDI_VERSION >= NTDDI_WIN81)
    ;    extrn '__imp__KiUserInvertedFunctionTable@??' as KiUserInvertedFunctionTable:dword
    ;end if
    ;if (NTDDI_VERSION >= NTDDI_WIN10)
    ;    extrn '__imp__EtwCheckCoverage@??' as EtwCheckCoverage:dword
    ;    extrn '__imp__RtlCallEnclaveReturn@??' as RtlCallEnclaveReturn:dword
    ;    extrn '__imp__RtlCreateUserFiberShadowStack@??' as :dword
    ;    extrn '__imp__RtlEnclaveCallDispatch@??' as RtlEnclaveCallDispatch:dword
    ;    extrn '__imp__RtlEnclaveCallDispatchReturn@??' as RtlEnclaveCallDispatchReturn:dword
    ;    extrn '__imp__RtlFreeUserFiberShadowStack@??' as RtlFreeUserFiberShadowStack:dword
    ;    extrn '__imp__RtlInitializeBitMapEx@??' as RtlInitializeBitMapEx:dword
    ;    extrn '__imp__RtlTestBitEx@??' as RtlTestBitEx:dword
    ;    extrn '__imp__RtlUserFiberStart@??' as RtlUserFiberStart:dword
    ;    extrn '__imp__RtlWow64GetCurrentCpuArea@??' as RtlWow64GetCurrentCpuArea:dword
    ;    extrn '__imp__RtlWow64SuspendProcess@??' as RtlWow64SuspendProcess:dword
    ;    extrn '__imp__RtlpQueryProcessDebugInformationRemote@??' as RtlpQueryProcessDebugInformationRemote:dword
    ;    extrn '__imp__RtlpWow64CtxFromAmd64@??' as RtlpWow64CtxFromAmd64:dword
    ;    extrn '__imp__RtlpWow64GetContextOnAmd64@??' as RtlpWow64GetContextOnAmd64:dword
    ;    extrn '__imp__RtlpWow64SetContextOnAmd64@??' as RtlpWow64SetContextOnAmd64:dword
    ;    extrn '__imp__RtlWow64PopAllCrossProcessWorkFromWorkList@??' as RtlWow64PopAllCrossProcessWorkFromWorkList:dword
    ;    extrn '__imp__RtlWow64PopCrossProcessWorkFromFreeList@??' as RtlWow64PopCrossProcessWorkFromFreeList:dword
    ;    extrn '__imp__RtlWow64PushCrossProcessWorkOntoFreeList@??' as RtlWow64PushCrossProcessWorkOntoFreeList:dword
    ;    extrn '__imp__RtlWow64PushCrossProcessWorkOntoWorkList@??' as RtlWow64PushCrossProcessWorkOntoWorkList:dword
    ;    extrn '__imp__RtlWow64RequestCrossProcessHeavyFlush@??' as RtlWow64RequestCrossProcessHeavyFlush:dword
    ;end if
;end if

end if ;NTDLL_INC
