Geoff Chappell, Software Analyst
The very large table on this page lists all the functions and variables—there are well over two and a half thousand—that appear in the export directory of any known x86, x64 or wow64 build of NTDLL.DLL from Windows NT. The NTDLL.DLL in the Windows that runs on DOS is here considered to be a separate executable (not presently catalogued).
For each name, the table gives just a brief summary of the applicable NTDLL versions and of the status with respect to Microsoft’s documentation. The table is intended as a master list. Details of each exports’s availability and documentation status may be found by looking for the export in other lists, according to its first version as shown here. In the Table of Contents, expand the entry for NTDLL Versions to get pages for each version. Some—presently very few—functions link directly from this list (and from the version lists) to an attempt at independent documentation. Additional explanatory notes, especially about the different sources and degrees of documentation, follow the table.
| Function | Applicable Versions | Documentation Status |
|---|---|---|
| ?Allocate@CBufferAllocator@@UAEPAXK@Z | 4.0 only | |
| A_SHAFinal | 6.0 and higher | |
| A_SHAInit | 6.0 and higher | |
| A_SHAUpdate | 6.0 and higher | |
| AitFireParentUsageEvent (2) | 6.1 to 6.3 | |
| AitLogFeatureUsageByApp (1) | 6.1 to 6.3 | |
| AlpcAdjustCompletionListConcurrencyCount | 6.0 and higher | |
| AlpcFreeCompletionListMessage | 6.0 and higher | |
| AlpcGetCompletionListLastMessageInformation | 6.0 and higher | |
| AlpcGetCompletionListMessageAttributes | 6.0 and higher | |
| AlpcGetHeaderSize | 6.0 and higher | |
| AlpcGetMessageAttribute | 6.0 and higher | |
| AlpcGetMessageFromCompletionList | 6.0 and higher | |
| AlpcGetOutstandingCompletionListMessageCount | 6.0 and higher | |
| AlpcInitializeMessageAttribute | 6.0 and higher | |
| AlpcMaxAllowedMessageLength | 6.0 and higher | |
| AlpcRegisterCompletionList | 6.0 and higher | |
| AlpcRegisterCompletionListWorkerThread | 6.0 and higher | |
| AlpcRundownCompletionList | 6.1 and higher | |
| AlpcUnregisterCompletionList | 6.0 and higher | |
| AlpcUnregisterCompletionListWorkerThread | 6.0 and higher | |
| ApiSetQueryApiSetPresence | 6.2 and higher | documented (reserved) |
| CsrAllocateCaptureBuffer | 3.10 and higher | |
| CsrAllocateCapturePointer | 3.10 to 4.0 | |
| CsrAllocateMessagePointer | 3.10 and higher | |
| CsrCaptureMessageBuffer | 3.10 and higher | |
| CsrCaptureMessageMultiUnicodeStringsInPlace | 5.1 and higher | |
| CsrCaptureMessageString | 3.10 and higher | |
| CsrCaptureTimeout | 3.10 and higher | |
| CsrClientCallServer | 3.10 and higher | |
| CsrClientConnectToServer | 3.10 and higher | |
| CsrClientMaxMessage | 3.10 to 3.51 | |
| CsrClientSendMessage | 3.10 to 3.51 | |
| CsrClientThreadConnect | 3.10 to 3.51 | |
| CsrDumpProfile | 3.10 only | |
| CsrFreeCaptureBuffer | 3.10 and higher | |
| CsrGetProcessId | 5.1 and higher | |
| CsrIdentifyAlertableThread | 3.10 and higher | |
| CsrNewThread | 3.10 to 6.0 before Windows Vista SP1 | |
| CsrProbeForRead | 3.10 to 5.2 | |
| CsrProbeForWrite | 3.10 to 5.2 | |
| CsrSetPriorityClass | 3.10 and higher | |
| CsrStartProfile | 3.10 only | |
| CsrStopDumpProfile | 3.10 only | |
| CsrStopProfile | 3.10 only | |
| CsrVerifyRegion | 6.0 and higher | |
| CsrpProcessCallbackRequest | 3.10 to 3.51 | |
| DbgBreakPoint | 3.10 and higher | documented (WDK) |
| DbgPrint | 3.10 and higher | documented (WDK) |
| DbgPrintEx | 5.1 and higher | documented (WDK) |
| DbgPrintReturnControlC | 5.0 and higher | declared (WDK) |
| DbgPrompt | 3.10 and higher | documented (WDK) |
| DbgQueryDebugFilterState | 5.1 and higher | declared (WDK) |
| DbgSetDebugFilterState | 5.1 and higher | declared (WDK) |
| DbgSsHandleKmApiMsg | 3.10 to 5.0 | |
| DbgSsInitialize | 3.10 to 5.0 | |
| DbgUiConnectToDbg | 3.10 and higher | |
| DbgUiContinue | 3.10 and higher | |
| DbgUiConvertStateChangeStructure | 5.1 and higher | |
| DbgUiConvertStateChangeStructureEx | 10.0 and higher | |
| DbgUiDebugActiveProcess | 5.1 and higher | |
| DbgUiGetThreadDebugObject | 5.1 and higher | |
| DbgUiIssueRemoteBreakin | 5.1 and higher | |
| DbgUiRemoteBreakin | 5.1 and higher | |
| DbgUiSetThreadDebugObject | 5.1 and higher | |
| DbgUiStopDebugging | 5.1 and higher | |
| DbgUiWaitStateChange | 3.10 and higher | |
| DbgUserBreakPoint | 3.10 and higher | |
| EtwControlTraceA | 5.2 only | |
| EtwControlTraceW | 5.2 only | |
| EtwCreateTraceInstanceId | 5.2 and higher | |
| EtwDeliverDataBlock | 6.0 and higher | |
| EtwEnableTrace | 5.2 only | |
| EtwEnumerateProcessRegGuids | 6.0 and higher | declared (Windows 10 WDK) |
| EtwEnumerateTraceGuids | 5.2 only | |
| EtwEventActivityIdControl | 6.0 and higher | declared (Windows 10 WDK) |
| EtwEventEnabled | 6.0 and higher | documented (WDK) |
| EtwEventProviderEnabled | 6.0 and higher | declared (Windows 10 WDK) |
| EtwEventRegister | 6.0 and higher | declared (Windows 10 WDK) |
| EtwEventSetInformation | 6.2 and higher | declared (Windows 10 WDK) |
| EtwEventUnregister | 6.0 and higher | declared (Windows 10 WDK) |
| EtwEventWrite | 6.0 and higher | declared (Windows 10 WDK) |
| EtwEventWriteEndScenario | 6.0 and higher | declared (Windows 10 WDK) |
| EtwEventWriteEx | 6.1 and higher | declared (Windows 10 WDK) |
| EtwEventWriteFull | 6.0 and higher | declared (Windows 10 WDK) |
| EtwEventWriteNoRegistration | 6.1 and higher | declared (Windows 10 WDK) |
| EtwEventWriteStartScenario | 6.0 and higher | declared (Windows 10 WDK) |
| EtwEventWriteString | 6.0 and higher | declared (Windows 10 WDK) |
| EtwEventWriteTransfer | 6.0 and higher | declared (Windows 10 WDK) |
| EtwFlushTraceA | 5.2 only | |
| EtwFlushTraceW | 5.2 only | |
| EtwGetTraceEnableFlags | 5.2 and higher | |
| EtwGetTraceEnableLevel | 5.2 and higher | |
| EtwGetTraceLoggerHandle | 5.2 and higher | |
| EtwLogTraceEvent | 6.0 and higher | |
| EtwNotificationRegister | 6.0 and higher | declared (Windows 10 WDK) |
| EtwNotificationRegistrationA | 5.2 only | |
| EtwNotificationRegistrationW | 5.2 only | |
| EtwNotificationUnregister | 6.0 and higher | declared (Windows 10 WDK) |
| EtwProcessPrivateLoggerRequest | 6.0 and higher | |
| EtwQueryAllTracesA | 5.2 only | |
| EtwQueryAllTracesW | 5.2 only | |
| EtwQueryTraceA | 5.2 only | |
| EtwQueryTraceW | 5.2 only | |
| EtwReceiveNotificationsA | 5.2 only | |
| EtwReceiveNotificationsW | 5.2 only | |
| EtwRegisterSecurityProvider | 6.0 and higher | declared (Windows 10 WDK) |
| EtwRegisterTraceGuidsA | 5.2 and higher | |
| EtwRegisterTraceGuidsW | 5.2 and higher | |
| EtwReplyNotification | 6.0 and higher | declared (Windows 10 WDK) |
| EtwSendNotification | 6.0 and higher | declared (Windows 10 WDK) |
| EtwSetMark | 6.0 and higher | declared (Windows 10 WDK) |
| EtwStartTraceA | 5.2 only | |
| EtwStartTraceW | 5.2 only | |
| EtwStopTraceA | 5.2 only | |
| EtwStopTraceW | 5.2 only | |
| EtwTraceEvent | 5.2 only | |
| EtwTraceEventInstance | 5.2 and higher | |
| EtwTraceMessage | 5.2 and higher | |
| EtwTraceMessageVa | 5.2 and higher | |
| EtwUnregisterTraceGuids | 5.2 and higher | |
| EtwUpdateTraceA | 5.2 only | |
| EtwUpdateTraceW | 5.2 only | |
| EtwWriteUMSecurityEvent | 6.0 and higher | declared (Windows 10 WDK) |
| EtwpCreateEtwThread | 6.0 and higher | |
| EtwpGetCpuSpeed | 6.0 and higher | |
| EtwpGetTraceBuffer | 5.2 only | |
| EtwpNotificationThread | 6.0 to 6.2 | |
| EtwpSetHWConfigFunction | 5.2 only | |
| EvtIntReportAuthzEventAndSourceAsync | 6.1 and higher | |
| EvtIntReportEventAndSourceAsync | 6.1 and higher | |
| ExpInterlockedPopEntrySListEnd | 5.2 from Windows Server 2003 SP1, and higher | |
| ExpInterlockedPopEntrySListEnd8 | 6.0 from Windows Vista SP2 only (x64 only) | |
| ExpInterlockedPopEntrySListEnd16 | 6.1 to 6.2 (x64 only) | |
| ExpInterlockedPopEntrySListFault | 5.2 from Windows Server 2003 SP1, and higher | |
| ExpInterlockedPopEntrySListFault8 | 6.0 from Windows Vista SP2 only (x64 only) | |
| ExpInterlockedPopEntrySListFault16 | 6.1 to 6.2 (x64 only) | |
| ExpInterlockedPopEntrySListResume | 5.2 from Windows Server 2003 SP1, and higher | |
| ExpInterlockedPopEntrySListResume8 | 6.0 from Windows Vista SP2 only (x64 only) | |
| ExpInterlockedPopEntrySListResume16 | 6.1 to 6.2 (x64 only) | |
| KiFastSystemCall | some 5.1, some 5.2, and higher (x86 only); in 5.1 from Windows XP SP2 and higher; in 5.2 from Windows Server 2003 SP1 and higher |
|
| KiFastSystemCallRet | some 5.1, some 5.2, and higher (x86 only); in 5.1 from Windows XP SP2 and higher; in 5.2 from Windows Server 2003 SP1 and higher |
|
| KiIntSystemCall | some 5.1, some 5.2, and higher (x86 only); in 5.1 from Windows XP SP2 and higher; in 5.2 from Windows Server 2003 SP1 and higher |
|
| KiRaiseUserExceptionDispatcher | 4.0 and higher | |
| KiUserApcDispatcher | 3.10 and higher | |
| KiUserCallbackDispatcher | 3.51 and higher | |
| KiUserExceptionDispatcher | 3.10 and higher | |
| KiUserInvertedFunctionTable | 6.3 and higher (x64 only) | |
| LdrAccessOutOfProcessResource | 5.1 to 5.2 | |
| LdrAccessResource | 3.10 and higher | |
| LdrAddDllDirectory | 6.2 and higher | |
| LdrAddLoadAsDataTable | 6.0 and higher | |
| LdrAddRefDll | 5.1 and higher | |
| LdrAlternateResourcesEnabled | 5.0 to 5.2 | |
| LdrAppxHandleIntegrityFailure | 6.2 and higher | |
| LdrCreateOutOfProcessImage | 5.1 to 5.2 | |
| LdrDestroyOutOfProcessImage | 5.1 to 5.2 | |
| LdrDisableThreadCalloutsForDll | 3.51 and higher | |
| LdrEnumResources | 3.51 and higher | |
| LdrEnumerateLoadedModules | 5.1 from Windows XP SP1, and higher | |
| LdrFastFailInLoaderCallout | 10.0 and higher | documented |
| LdrFindCreateProcessManifest | 5.1 to 5.2 | |
| LdrFindEntryForAddress | 3.10 and higher | |
| LdrFindResourceDirectory_U | 3.10 and higher | |
| LdrFindResourceEx_U | 5.1 and higher | |
| LdrFindResource_U | 3.10 and higher | |
| LdrFlushAlternateResourceModules | 5.0 and higher | |
| LdrGetDllDirectory | 6.2 and higher | |
| LdrGetDllFullName | 6.2 and higher | |
| LdrGetDllHandle | 3.10 and higher | |
| LdrGetDllHandleByMapping | 6.1 and higher | |
| LdrGetDllHandleByName | 6.1 and higher | |
| LdrGetDllHandleEx | 5.1 and higher | |
| LdrGetDllPath | 6.2 and higher | |
| LdrGetFailureData | 6.0 and higher | |
| LdrGetFileNameFromLoadAsDataTable | 6.0 and higher | |
| LdrGetKnownDllSectionHandle | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | |
| LdrGetProcedureAddress | 3.10 and higher | |
| LdrGetProcedureAddressEx | 6.0 and higher | |
| LdrGetProcedureAddressForCaller | 6.2 and higher | |
| LdrHotPatchRoutine | 5.1 from Windows XP SP2, to 6.2 | |
| LdrInitShimEngineDynamic | 5.1 and higher | |
| LdrInitializeThunk | 3.10 and higher | |
| LdrLoadAlternateResourceModule | 5.0 and higher | |
| LdrLoadAlternateResourceModuleEx | 6.0 and higher | |
| LdrLoadDll | 3.10 and higher | |
| LdrLockLoaderLock | 5.1 and higher | |
| LdrOpenImageFileOptionsKey | 5.2 from Windows Server 2003 SP1, and higher | |
| LdrProcessInitializationComplete | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | |
| LdrProcessRelocationBlock | 3.10 and higher | |
| LdrProcessRelocationBlockEx | 6.2 and higher | |
| LdrQueryImageFileExecutionOptions | 3.10 and higher | |
| LdrQueryImageFileExecutionOptionsEx | 5.2 and higher | |
| LdrQueryImageFileKeyOption | 5.2 from Windows Server 2003 SP1, and higher | |
| LdrQueryModuleServiceTags | 6.0 and higher | |
| LdrQueryOptionalDelayLoadedAPI | 6.2 and higher | |
| LdrQueryProcessModuleInformation | 3.10 and higher | |
| LdrRegisterDllNotification | 6.0 and higher | |
| LdrRemoveDllDirectory | 6.2 and higher | |
| LdrRemoveLoadAsDataTable | 6.0 and higher | |
| LdrResFindResource | 6.0 and higher | |
| LdrResFindResourceDirectory | 6.0 and higher | |
| LdrResGetRCConfig | 6.1 and higher | |
| LdrResRelease | 6.0 and higher | |
| LdrResSearchResource | 6.0 and higher | |
| LdrResolveDelayLoadedAPI | 6.2 and higher | |
| LdrResolveDelayLoadsFromDll | 6.2 and higher | |
| LdrRscIsTypeExist | 6.1 and higher | |
| LdrSetAppCompatDllRedirectionCallback | 5.1 and higher | |
| LdrSetDefaultDllDirectories | 6.2 and higher | |
| LdrSetDllDirectory | 6.2 and higher | |
| LdrSetDllManifestProber | 5.1 and higher | |
| LdrSetImplicitPathOptions | 6.3 and higher | |
| LdrSetMUICacheType | 6.0 and higher | |
| LdrShutdownProcess | 3.10 and higher | |
| LdrShutdownThread | 3.10 and higher | |
| LdrStandardizeSystemPath | 6.2 and higher | |
| LdrSystemDllInitBlock | 6.2 and higher | |
| LdrUnloadAlternateResourceModule | 5.0 and higher | |
| LdrUnloadAlternateResourceModuleEx | 6.0 and higher | |
| LdrUnloadDll | 3.10 and higher | |
| LdrUnlockLoaderLock | 5.1 and higher | |
| LdrUnregisterDllNotification | 6.0 and higher | |
| LdrVerifyImageMatchesChecksum | 3.10 and higher | |
| LdrVerifyImageMatchesChecksumEx | 6.0 and higher | |
| LdrWx86FormatVirtualImage | 6.0 from Windows Vista SP1, and higher (wow64 only) | |
| LdrpResGetMappingSize | 6.0 from Windows Vista SP1, and higher | |
| LdrpResGetRCConfig | 6.0 from Windows Vista SP1 and SP2 only | |
| LdrpResGetResourceDirectory | 6.0 from Windows Vista SP1, and higher | |
| MD4Final | 6.0 and higher | |
| MD4Init | 6.0 and higher | |
| MD4Update | 6.0 and higher | |
| MD5Final | 6.0 and higher | |
| MD5Init | 6.0 and higher | |
| MD5Update | 6.0 and higher | |
| NPXEMULATORTABLE (data) | 3.10 to 5.0 | |
| NlsAnsiCodePage | 4.0 and higher | |
| NlsMbCodePageTag (data) | 3.51 and higher | declared (WDK) |
| NlsMbOemCodePageTag (data) | 3.51 and higher | declared (WDK) |
| NtAcceptConnectPort | 3.10 and higher | |
| NtAccessCheck | 3.10 and higher | |
| NtAccessCheckAndAuditAlarm | 3.10 and higher | declared (WDK) |
| NtAccessCheckByType | 5.0 and higher | |
| NtAccessCheckByTypeAndAuditAlarm | 5.0 and higher | declared (WDK) |
| NtAccessCheckByTypeResultList | 5.0 and higher | |
| NtAccessCheckByTypeResultListAndAuditAlarm | 5.0 and higher | declared (WDK) |
| NtAccessCheckByTypeResultListAndAuditAlarmByHandle | 5.0 and higher | declared (WDK) |
| NtAcquireCMFViewOwnership | 6.0 only | |
| NtAddAtom | 4.0 and higher | |
| NtAddAtomEx | 6.2 and higher | |
| NtAddBootEntry | 5.1 and higher | |
| NtAddDriverEntry | 5.2 and higher | |
| NtAdjustGroupsToken | 3.10 and higher | declared (WDK) |
| NtAdjustPrivilegesToken | 3.10 and higher | declared (WDK) |
| NtAdjustTokenClaimsAndDeviceGroups | 6.2 and higher | |
| NtAlertResumeThread | 3.10 and higher | |
| NtAlertThread | 3.10 and higher | |
| NtAlertThreadByThreadId | 6.2 and higher | |
| NtAllocateLocallyUniqueId | 3.10 and higher | documented (WDK) |
| NtAllocateReserveObject | 6.1 and higher | |
| NtAllocateUserPhysicalPages | 5.0 and higher | |
| NtAllocateUuids | 3.51 and higher | |
| NtAllocateVirtualMemory | 3.10 and higher | documented (WDK) |
| NtAlpcAcceptConnectPort | 6.0 and higher | |
| NtAlpcCancelMessage | 6.0 and higher | |
| NtAlpcConnectPort | 6.0 and higher | |
| NtAlpcConnectPortEx | 6.2 and higher | |
| NtAlpcCreatePort | 6.0 and higher | |
| NtAlpcCreatePortSection | 6.0 and higher | |
| NtAlpcCreateResourceReserve | 6.0 and higher | |
| NtAlpcCreateSectionView | 6.0 and higher | |
| NtAlpcCreateSecurityContext | 6.0 and higher | |
| NtAlpcDeletePortSection | 6.0 and higher | |
| NtAlpcDeleteResourceReserve | 6.0 and higher | |
| NtAlpcDeleteSectionView | 6.0 and higher | |
| NtAlpcDeleteSecurityContext | 6.0 and higher | |
| NtAlpcDisconnectPort | 6.0 and higher | |
| NtAlpcImpersonateClientContainerOfPort | 10.0 and higher | |
| NtAlpcImpersonateClientOfPort | 6.0 and higher | |
| NtAlpcOpenSenderProcess | 6.0 and higher | |
| NtAlpcOpenSenderThread | 6.0 and higher | |
| NtAlpcQueryInformation | 6.0 and higher | |
| NtAlpcQueryInformationMessage | 6.0 and higher | |
| NtAlpcRevokeSecurityContext | 6.0 and higher | |
| NtAlpcSendWaitReceivePort | 6.0 and higher | |
| NtAlpcSetInformation | 6.0 and higher | |
| NtApphelpCacheControl | 5.2 and higher | declared (Windows 10 WDK) |
| NtAreMappedFilesTheSame | 5.0 and higher | |
| NtAssignProcessToJobObject | 5.0 and higher | |
| NtAssociateWaitCompletionPacket | 6.2 and higher | |
| NtCallbackReturn | 3.51 and higher | |
| NtCancelDeviceWakeupRequest | 5.0 to 6.0 | |
| NtCancelIoFile | 3.10 and higher | |
| NtCancelIoFileEx | 6.0 and higher | |
| NtCancelSynchronousIoFile | 6.0 and higher | |
| NtCancelTimer | 3.10 and higher | |
| NtCancelTimer2 | 6.3 and higher | |
| NtCancelWaitCompletionPacket | 6.2 and higher | |
| NtClearAllSavepointsTransaction | 6.0 before Windows Vista SP1 | |
| NtClearEvent | 3.51 and higher | |
| NtClearSavepointTransaction | 6.0 before Windows Vista SP1 | |
| NtClose | 3.10 and higher | documented |
| NtCloseObjectAuditAlarm | 3.10 and higher | declared (WDK) |
| NtCommitComplete | 6.0 and higher | documented (WDK) |
| NtCommitEnlistment | 6.0 and higher | documented (WDK) |
| NtCommitTransaction | 6.0 and higher | documented (WDK) |
| NtCompactKeys | 5.1 and higher | |
| NtCompareObjects | 10.0 and higher | |
| NtCompareTokens | 5.1 and higher | documented |
| NtCompleteConnectPort | 3.10 and higher | |
| NtCompressKey | 5.1 and higher | |
| NtConnectPort | 3.10 and higher | |
| NtContinue | 3.10 and higher | |
| NtCreateChannel | 4.0 to 5.0 | |
| NtCreateDebugObject | 5.1 and higher | |
| NtCreateDirectoryObject | 3.10 and higher | documented (WDK) |
| NtCreateDirectoryObjectEx | 6.2 and higher | |
| NtCreateEnlistment | 6.0 and higher | documented (WDK) |
| NtCreateEvent | 3.10 and higher | documented (WDK) |
| NtCreateEventPair | 3.10 and higher | |
| NtCreateFile | 3.10 and higher | documented (WDK) |
| NtCreateIRTimer | 6.2 and higher | |
| NtCreateIoCompletion | 3.51 and higher | |
| NtCreateJobObject | 5.0 and higher | |
| NtCreateJobSet | 5.1 and higher | |
| NtCreateKey | 3.10 and higher | documented (WDK) |
| NtCreateKeyTransacted | 6.0 and higher | |
| NtCreateKeyedEvent | 5.1 and higher | |
| NtCreateLowBoxToken | 6.2 and higher | |
| NtCreateMailslotFile | 3.10 and higher | |
| NtCreateMutant | 3.10 and higher | |
| NtCreateNamedPipeFile | 3.10 and higher | |
| NtCreatePagingFile | 3.10 and higher | |
| NtCreatePartition | 10.0 and higher | |
| NtCreatePort | 3.10 and higher | |
| NtCreatePrivateNamespace | 6.0 and higher | |
| NtCreateProcess | 3.10 and higher | |
| NtCreateProcessEx | 5.1 and higher | |
| NtCreateProfile | 3.10 and higher | |
| NtCreateProfileEx | 6.1 and higher | |
| NtCreateResourceManager | 6.0 and higher | documented (WDK) |
| NtCreateSection | 3.10 and higher | documented (WDK) |
| NtCreateSemaphore | 3.10 and higher | |
| NtCreateSymbolicLinkObject | 3.10 and higher | |
| NtCreateThread | 3.10 and higher | |
| NtCreateThreadEx | 6.0 and higher | |
| NtCreateTimer | 3.10 and higher | |
| NtCreateTimer2 | 6.3 and higher | |
| NtCreateToken | 3.10 and higher | |
| NtCreateTokenEx | 6.2 and higher | |
| NtCreateTransaction | 6.0 and higher | documented (WDK) |
| NtCreateTransactionManager | 6.0 and higher | documented (WDK) |
| NtCreateUserProcess | 6.0 and higher | |
| NtCreateWaitCompletionPacket | 6.2 and higher | |
| NtCreateWaitablePort | 5.0 and higher | |
| NtCreateWnfStateName | 6.2 and higher | |
| NtCreateWorkerFactory | 6.0 and higher | |
| NtCurrentTeb | 3.10 and higher (x86 only) | declared |
| NtDebugActiveProcess | 5.1 and higher | |
| NtDebugContinue | 5.1 and higher | |
| NtDelayExecution | 3.10 and higher | |
| NtDeleteAtom | 4.0 and higher | |
| NtDeleteBootEntry | 5.1 and higher | |
| NtDeleteDriverEntry | 5.2 and higher | |
| NtDeleteFile | 3.51 and higher | documented (WDK) |
| NtDeleteKey | 3.10 and higher | documented (WDK) |
| NtDeleteObjectAuditAlarm | 4.0 and higher | declared (WDK) |
| NtDeletePrivateNamespace | 6.0 and higher | |
| NtDeleteValueKey | 3.10 and higher | documented (WDK) |
| NtDeleteWnfStateData | 6.2 and higher | |
| NtDeleteWnfStateName | 6.2 and higher | |
| NtDeviceIoControlFile | 3.10 and higher | documented |
| NtDisableLastKnownGood | 6.1 and higher | |
| NtDisplayString | 3.10 and higher | |
| NtDrawText | 6.1 and higher | |
| NtDuplicateObject | 3.10 and higher | documented (WDK) |
| NtDuplicateToken | 3.10 and higher | documented (WDK) |
| NtEnableLastKnownGood | 6.1 and higher | |
| NtEnumerateBootEntries | 5.1 and higher | |
| NtEnumerateBus | 3.51 only | |
| NtEnumerateDriverEntries | 5.2 and higher | |
| NtEnumerateKey | 3.10 and higher | documented (WDK) |
| NtEnumerateSystemEnvironmentValuesEx | 5.1 and higher | |
| NtEnumerateTransactionObject | 6.0 and higher | documented (WDK) |
| NtEnumerateValueKey | 3.10 and higher | documented (WDK) |
| NtExtendSection | 3.10 and higher | |
| NtFilterBootOption | 6.2 and higher | |
| NtFilterToken | 5.0 and higher | declared (Windows 10 WDK) |
| NtFilterTokenEx | 6.2 and higher | |
| NtFindAtom | 4.0 and higher | |
| NtFlushBuffersFile | 3.10 and higher | documented (WDK) |
| NtFlushBuffersFileEx | 6.2 and higher | documented (WDK) |
| NtFlushInstallUILanguage | 6.0 and higher | |
| NtFlushInstructionCache | 3.10 and higher | |
| NtFlushKey | 3.10 and higher | documented (WDK) |
| NtFlushProcessWriteBuffers | 6.0 and higher | |
| NtFlushVirtualMemory | 3.10 and higher | documented (WDK) |
| NtFlushWriteBuffer | 3.10 and higher | |
| NtFreeUserPhysicalPages | 5.0 and higher | |
| NtFreeVirtualMemory | 3.10 and higher | documented (WDK) |
| NtFreezeRegistry | 6.0 and higher | |
| NtFreezeTransactions | 6.0 and higher | |
| NtFsControlFile | 3.10 and higher | documented (WDK) |
| NtGetCachedSigningLevel | 6.2 and higher | |
| NtGetCompleteWnfStateSubscription | 6.3 and higher | |
| NtGetContextThread | 3.10 and higher | |
| NtGetCurrentProcessorNumber | 5.2 and higher | documented |
| NtGetCurrentProcessorNumberEx | 10.0 and higher | |
| NtGetDevicePowerState | 5.0 and higher | declared (WDK) |
| NtGetMUIRegistryInfo | 6.0 and higher | |
| NtGetNextProcess | 6.0 and higher | |
| NtGetNextThread | 6.0 and higher | |
| NtGetNlsSectionPtr | 6.0 and higher | |
| NtGetNotificationResourceManager | 6.0 and higher | documented (WDK) |
| NtGetPlugPlayEvent | 3.51 to 6.1 | |
| NtGetTickCount | 3.10 and higher, except 5.1 | |
| NtGetWriteWatch | 5.0 and higher | |
| NtImpersonateAnonymousToken | 5.0 and higher | declared (WDK) |
| NtImpersonateClientOfPort | 3.10 and higher | |
| NtImpersonateThread | 3.10 and higher | |
| NtInitializeNlsFiles | 6.0 and higher | |
| NtInitializeRegistry | 3.10 and higher | |
| NtInitializeVDM | 3.10 only | |
| NtInitiatePowerAction | 5.0 and higher | declared (WDK) |
| NtIsProcessInJob | 5.1 and higher | |
| NtIsSystemResumeAutomatic | 5.0 and higher | declared (WDK) |
| NtIsUILanguageComitted | 6.0 and higher | |
| NtListTransactions | 6.0 before Windows Vista SP1 | |
| NtListenChannel | 4.0 to 5.0 | |
| NtListenPort | 3.10 and higher | |
| NtLoadDriver | 3.10 and higher | documented (WDK) |
| NtLoadKey | 3.10 and higher | |
| NtLoadKey2 | 4.0 and higher | |
| NtLoadKeyEx | 5.2 and higher | |
| NtLockFile | 3.10 and higher | documented (WDK) |
| NtLockProductActivationKeys | 5.1 and higher | |
| NtLockRegistryKey | 5.1 and higher | |
| NtLockVirtualMemory | 3.10 and higher | |
| NtMakePermanentObject | 5.1 and higher | |
| NtMakeTemporaryObject | 3.10 and higher | documented (WDK) |
| NtManagePartition | 10.0 and higher | |
| NtMapCMFModule | 6.0 and higher | |
| NtMapUserPhysicalPages | 5.0 and higher | |
| NtMapUserPhysicalPagesScatter | 5.0 and higher | |
| NtMapViewOfSection | 3.10 and higher | documented (WDK) |
| NtMarshallTransaction | 6.0 before Windows Vista SP1 | |
| NtModifyBootEntry | 5.1 and higher | |
| NtModifyDriverEntry | 5.2 and higher | |
| NtNotifyChangeDirectoryFile | 3.10 and higher | |
| NtNotifyChangeKey | 3.10 and higher | documented (WDK) |
| NtNotifyChangeMultipleKeys | 5.0 and higher | declared (Windows 10 SDK) |
| NtNotifyChangeSession | 6.1 and higher | |
| NtOpenChannel | 4.0 to 5.0 | |
| NtOpenDirectoryObject | 3.10 and higher | documented (WDK) |
| NtOpenEnlistment | 6.0 and higher | documented (WDK) |
| NtOpenEvent | 3.10 and higher | documented (WDK) |
| NtOpenEventPair | 3.10 and higher | |
| NtOpenFile | 3.10 and higher | documented (WDK) |
| NtOpenIoCompletion | 3.51 and higher | |
| NtOpenJobObject | 5.0 and higher | |
| NtOpenKey | 3.10 and higher | documented (WDK) |
| NtOpenKeyEx | 6.1 and higher | |
| NtOpenKeyTransacted | 6.0 and higher | |
| NtOpenKeyTransactedEx | 6.1 and higher | |
| NtOpenKeyedEvent | 5.1 and higher | |
| NtOpenMutant | 3.10 and higher | |
| NtOpenObjectAuditAlarm | 3.10 and higher | declared (WDK) |
| NtOpenPartition | 10.0 and higher | |
| NtOpenPrivateNamespace | 6.0 and higher | |
| NtOpenProcess | 3.10 and higher | documented (WDK) |
| NtOpenProcessToken | 3.10 and higher | declared (WDK) |
| NtOpenProcessTokenEx | 5.1 and higher | documented (WDK) |
| NtOpenResourceManager | 6.0 and higher | documented (WDK) |
| NtOpenSection | 3.10 and higher | documented (WDK) |
| NtOpenSemaphore | 3.10 and higher | |
| NtOpenSession | 6.0 and higher | |
| NtOpenSymbolicLinkObject | 3.10 and higher | documented (WDK) |
| NtOpenThread | 3.10 and higher | |
| NtOpenThreadToken | 3.10 and higher | declared (WDK) |
| NtOpenThreadTokenEx | 5.1 and higher | documented (WDK) |
| NtOpenTimer | 3.10 and higher | |
| NtOpenTransaction | 6.0 and higher | documented (WDK) |
| NtOpenTransactionManager | 6.0 and higher | documented (WDK) |
| NtPlugPlayControl | 3.51 and higher | |
| NtPowerInformation | 5.0 and higher | declared (WDK) |
| NtPrePrepareComplete | 6.0 and higher | documented (WDK) |
| NtPrePrepareEnlistment | 6.0 and higher | documented (WDK) |
| NtPrepareComplete | 6.0 and higher | documented (WDK) |
| NtPrepareEnlistment | 6.0 and higher | documented (WDK) |
| NtPrivilegeCheck | 3.10 and higher | declared (WDK) |
| NtPrivilegeObjectAuditAlarm | 3.10 and higher | declared (WDK) |
| NtPrivilegedServiceAuditAlarm | 3.10 and higher | declared (WDK) |
| NtPropagationComplete | 6.0 and higher | declared (WDK) |
| NtPropagationFailed | 6.0 and higher | declared (WDK) |
| NtProtectVirtualMemory | 3.10 and higher | |
| NtPullTransaction | 6.0 before Windows Vista SP1 | |
| NtPulseEvent | 3.10 and higher | |
| NtQueryAttributesFile | 3.51 and higher | |
| NtQueryBootEntryOrder | 5.1 and higher | |
| NtQueryBootOptions | 5.1 and higher | |
| NtQueryDebugFilterState | 5.1 and higher | |
| NtQueryDefaultLocale | 3.10 and higher | |
| NtQueryDefaultUILanguage | 5.0 and higher | |
| NtQueryDirectoryFile | 3.10 and higher | documented (WDK) |
| NtQueryDirectoryObject | 3.10 and higher | |
| NtQueryDriverEntryOrder | 5.2 and higher | |
| NtQueryEaFile | 3.10 and higher | |
| NtQueryEvent | 3.10 and higher | |
| NtQueryFullAttributesFile | 4.0 and higher | documented (WDK) |
| NtQueryInformationAtom | 4.0 and higher | |
| NtQueryInformationEnlistment | 6.0 and higher | documented (WDK) |
| NtQueryInformationFile | 3.10 and higher | documented (WDK) |
| NtQueryInformationJobObject | 5.0 and higher | |
| NtQueryInformationPort | 3.10 and higher | |
| NtQueryInformationProcess | 3.10 and higher | documented |
| NtQueryInformationResourceManager | 6.0 and higher | documented (WDK) |
| NtQueryInformationThread | 3.10 and higher | documented |
| NtQueryInformationToken | 3.10 and higher | documented (WDK) |
| NtQueryInformationTransaction | 6.0 and higher | documented (WDK) |
| NtQueryInformationTransactionManager | 6.0 and higher | documented (WDK) |
| NtQueryInformationWorkerFactory | 6.0 and higher | |
| NtQueryInstallUILanguage | 5.0 and higher | |
| NtQueryIntervalProfile | 3.10 and higher | |
| NtQueryIoCompletion | 3.51 and higher | |
| NtQueryKey | 3.10 and higher | documented (WDK) |
| NtQueryLicenseValue | 6.0 and higher | |
| NtQueryMultipleValueKey | 4.0 and higher | declared (Windows 10 SDK) |
| NtQueryMutant | 3.10 and higher | |
| NtQueryObject | 3.10 and higher | documented (WDK) |
| NtQueryOleDirectoryFile | 4.0 only | |
| NtQueryOpenSubKeys | 5.0 and higher | |
| NtQueryOpenSubKeysEx | 5.2 and higher | |
| NtQueryPerformanceCounter | 3.10 and higher | |
| NtQueryPortInformationProcess | 5.1 and higher | |
| NtQueryQuotaInformationFile | 5.0 and higher | documented (WDK) |
| NtQuerySection | 3.10 and higher | |
| NtQuerySecurityAttributesToken | 6.1 and higher | |
| NtQuerySecurityObject | 3.10 and higher | documented (WDK) |
| NtQuerySemaphore | 3.10 and higher | |
| NtQuerySymbolicLinkObject | 3.10 and higher | documented (WDK) |
| NtQuerySystemEnvironmentValue | 3.10 and higher | |
| NtQuerySystemEnvironmentValueEx | 5.1 and higher | |
| NtQuerySystemInformation | 3.10 and higher | documented |
| NtQuerySystemInformationEx | 6.1 and higher | |
| NtQuerySystemTime | 3.10 and higher | documented |
| NtQueryTimer | 3.10 and higher | |
| NtQueryTimerResolution | 3.51 and higher | |
| NtQueryValueKey | 3.10 and higher | documented (WDK) |
| NtQueryVirtualMemory | 3.10 and higher | declared (Windows 10 WDK) |
| NtQueryVolumeInformationFile | 3.10 and higher | documented (WDK) |
| NtQueryWnfStateData | 6.2 and higher | |
| NtQueryWnfStateNameInformation | 6.2 and higher | |
| NtQueueApcThread | 4.0 and higher | |
| NtQueueApcThreadEx | 6.1 and higher | |
| NtRaiseException | 3.10 and higher | |
| NtRaiseHardError | 3.10 and higher | |
| NtReadFile | 3.10 and higher | documented (WDK) |
| NtReadFileScatter | 4.0 from Windows NT 4.0 SP3, and higher | |
| NtReadOnlyEnlistment | 6.0 and higher | documented (WDK) |
| NtReadRequestData | 3.10 and higher | |
| NtReadVirtualMemory | 3.10 and higher | |
| NtRecoverEnlistment | 6.0 and higher | documented (WDK) |
| NtRecoverResourceManager | 6.0 and higher | documented (WDK) |
| NtRecoverTransactionManager | 6.0 and higher | documented (WDK) |
| NtRegisterNewDevice | 3.51 only | |
| NtRegisterProtocolAddressInformation | 6.0 and higher | declared (WDK) |
| NtRegisterThreadTerminatePort | 3.10 and higher | |
| NtReleaseCMFViewOwnership | 6.0 only | |
| NtReleaseKeyedEvent | 5.1 and higher | |
| NtReleaseMutant | 3.10 and higher | |
| NtReleaseProcessMutant | 3.10 to 3.51 | |
| NtReleaseSemaphore | 3.10 and higher | |
| NtReleaseWorkerFactoryWorker | 6.0 and higher | |
| NtRemoveIoCompletion | 3.51 and higher | |
| NtRemoveIoCompletionEx | 6.0 and higher | |
| NtRemoveProcessDebug | 5.1 and higher | |
| NtRenameKey | 5.1 and higher | |
| NtRenameTransactionManager | 6.0 from Windows Vista SP1, and higher | documented (WDK) |
| NtRenameValueKey | 3.10 only | |
| NtReplaceKey | 3.10 and higher | |
| NtReplacePartitionUnit | 6.0 from Windows Vista SP1, and higher | |
| NtReplyPort | 3.10 and higher | |
| NtReplyWaitReceivePort | 3.10 and higher | |
| NtReplyWaitReceivePortEx | 5.0 and higher | |
| NtReplyWaitReplyPort | 3.10 and higher | |
| NtReplyWaitSendChannel | 4.0 to 5.0 | |
| NtRequestDeviceWakeup | 5.0 to 6.0 | |
| NtRequestPort | 3.10 and higher | |
| NtRequestWaitReplyPort | 3.10 and higher | |
| NtRequestWakeupLatency | 5.0 to 6.0 | |
| NtResetEvent | 3.10 and higher | |
| NtResetWriteWatch | 5.0 and higher | |
| NtRestoreKey | 3.10 and higher | |
| NtResumeProcess | 5.1 and higher | |
| NtResumeThread | 3.10 and higher | |
| NtRevertContainerImpersonation | 10.0 and higher | |
| NtRollbackComplete | 6.0 and higher | documented (WDK) |
| NtRollbackEnlistment | 6.0 and higher | documented (WDK) |
| NtRollbackSavepointTransaction | 6.0 before Windows Vista SP1 | |
| NtRollbackTransaction | 6.0 and higher | documented (WDK) |
| NtRollforwardTransactionManager | 6.0 and higher | documented (WDK) |
| NtSaveKey | 3.10 and higher | |
| NtSaveKeyEx | 5.1 and higher | |
| NtSaveMergedKeys | 5.0 and higher | |
| NtSavepointComplete | 6.0 before Windows Vista SP1 | |
| NtSavepointTransaction | 6.0 before Windows Vista SP1 | |
| NtSecureConnectPort | 5.0 and higher | |
| NtSendWaitReplyChannel | 4.0 to 5.0 | |
| NtSerializeBoot | 6.1 and higher | |
| NtSetBootEntryOrder | 5.1 and higher | |
| NtSetBootOptions | 5.1 and higher | |
| NtSetCachedSigningLevel | 6.2 and higher | |
| NtSetContextChannel | 4.0 to 5.0 | |
| NtSetContextThread | 3.10 and higher | |
| NtSetDebugFilterState | 5.1 and higher | |
| NtSetDefaultHardErrorPort | 3.10 and higher | |
| NtSetDefaultLocale | 3.10 and higher | |
| NtSetDefaultUILanguage | 5.0 and higher | |
| NtSetDriverEntryOrder | 5.2 and higher | |
| NtSetEaFile | 3.10 and higher | |
| NtSetEvent | 3.10 and higher | documented (WDK) |
| NtSetEventBoostPriority | 5.1 and higher | |
| NtSetHighEventPair | 3.10 and higher | |
| NtSetHighWaitLowEventPair | 3.10 and higher | |
| NtSetHighWaitLowThread | 3.10 to 4.0 | |
| NtSetIRTimer | 6.2 and higher | |
| NtSetInformationDebugObject | 5.1 and higher | |
| NtSetInformationEnlistment | 6.0 and higher | documented (WDK) |
| NtSetInformationFile | 3.10 and higher | documented (WDK) |
| NtSetInformationJobObject | 5.0 and higher | |
| NtSetInformationKey | 3.10 and higher | declared (Windows 10 SDK) |
| NtSetInformationObject | 3.51 and higher | |
| NtSetInformationProcess | 3.10 and higher | |
| NtSetInformationResourceManager | 6.0 and higher | documented (WDK) |
| NtSetInformationSymbolicLink | 10.0 and higher | |
| NtSetInformationThread | 3.10 and higher | documented (WDK) |
| NtSetInformationToken | 3.10 and higher | documented (WDK) |
| NtSetInformationTransaction | 6.0 and higher | documented (WDK) |
| NtSetInformationTransactionManager | 6.0 and higher | documented (WDK) |
| NtSetInformationVirtualMemory | 6.2 and higher | declared (Windows 10 WDK) |
| NtSetInformationWorkerFactory | 6.0 and higher | |
| NtSetIntervalProfile | 3.10 and higher | |
| NtSetIoCompletion | 3.51 and higher | |
| NtSetIoCompletionEx | 6.1 and higher | |
| NtSetLdtEntries | 3.10 and higher | |
| NtSetLowEventPair | 3.10 and higher | |
| NtSetLowWaitHighEventPair | 3.10 and higher | |
| NtSetLowWaitHighThread | 3.10 to 4.0 | |
| NtSetQuotaInformationFile | 5.0 and higher | documented (WDK) |
| NtSetSecurityObject | 3.10 and higher | documented (WDK) |
| NtSetSystemEnvironmentValue | 3.10 and higher | |
| NtSetSystemEnvironmentValueEx | 5.1 and higher | |
| NtSetSystemInformation | 3.51 and higher | |
| NtSetSystemPowerState | 3.51 and higher | declared (WDK) |
| NtSetSystemTime | 3.10 and higher | |
| NtSetThreadExecutionState | 5.0 and higher | declared (WDK) |
| NtSetTimer | 3.10 and higher | |
| NtSetTimer2 | 6.3 and higher | |
| NtSetTimerEx | 6.1 and higher | |
| NtSetTimerResolution | 3.51 and higher | |
| NtSetUuidSeed | 5.0 and higher | |
| NtSetValueKey | 3.10 and higher | documented (WDK) |
| NtSetVolumeInformationFile | 3.10 and higher | documented (WDK) |
| NtSetWnfProcessNotificationEvent | 6.3 and higher | |
| NtShutdownSystem | 3.10 and higher | |
| NtShutdownWorkerFactory | 6.0 and higher | |
| NtSignalAndWaitForSingleObject | 4.0 and higher | |
| NtSinglePhaseReject | 6.0 and higher | documented (WDK) |
| NtStartProfile | 3.10 and higher | |
| NtStartTm | 6.0 before Windows Vista SP1 | |
| NtStopProfile | 3.10 and higher | |
| NtSubscribeWnfStateChange | 6.2 and higher | |
| NtSuspendProcess | 5.1 and higher | |
| NtSuspendThread | 3.10 and higher | |
| NtSystemDebugControl | 3.10 and higher | |
| NtTerminateJobObject | 5.0 and higher | |
| NtTerminateProcess | 3.10 and higher | documented (WDK) |
| NtTerminateThread | 3.10 and higher | |
| NtTestAlert | 3.10 and higher | |
| NtThawRegistry | 6.0 and higher | declared (Windows 10 WDK) |
| NtThawTransactions | 6.0 and higher | |
| NtTraceControl | 6.0 and higher | declared (Windows 10 WDK) |
| NtTraceEvent | 5.1 and higher | declared in Windows 10 WDK |
| NtTranslateFilePath | 5.1 and higher | |
| NtUmsThreadYield | 6.1 and higher | |
| NtUnloadDriver | 3.10 and higher | documented (WDK) |
| NtUnloadKey | 3.10 and higher | |
| NtUnloadKey2 | 5.2 and higher | |
| NtUnloadKeyEx | 5.1 and higher | |
| NtUnlockFile | 3.10 and higher | documented (WDK) |
| NtUnlockVirtualMemory | 3.10 and higher | |
| NtUnmapViewOfSection | 3.10 and higher | documented (WDK) |
| NtUnmapViewOfSectionEx | 6.2 and higher | |
| NtUnsubscribeWnfStateChange | 6.2 and higher | |
| NtUpdateWnfStateData | 6.2 and higher | |
| NtVdmControl | 3.10 and higher | |
| NtVdmStartExecution | 3.10 only | |
| NtW32Call | 3.51 to 4.0 from Windows NT 4.0 SP3 | |
| NtWaitForAlertByThreadId | 6.2 and higher | |
| NtWaitForDebugEvent | 5.1 and higher | |
| NtWaitForKeyedEvent | 5.1 and higher | |
| NtWaitForMultipleObjects | 3.10 and higher | |
| NtWaitForMultipleObjects32 | 5.2 from Windows Server 2003 SP1, and higher | |
| NtWaitForProcessMutant | 3.10 to 3.51 | |
| NtWaitForSingleObject | 3.10 and higher | documented |
| NtWaitForWnfNotifications | 6.2 only | |
| NtWaitForWorkViaWorkerFactory | 6.0 and higher | |
| NtWaitHighEventPair | 3.10 and higher | |
| NtWaitLowEventPair | 3.10 and higher | |
| NtWorkerFactoryWorkerReady | 6.0 and higher | |
| NtWow64AllocateVirtualMemory64 | 6.2 and higher (wow64 only) | |
| NtWow64CallFunction64 | 6.0 and higher (wow64 only) | |
| NtWow64CsrAllocateCaptureBuffer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64CsrAllocateMessagePointer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64CsrCaptureMessageBuffer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64CsrCaptureMessageString | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64CsrClientCallServer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64CsrClientConnectToServer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64CsrFreeCaptureBuffer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64CsrGetProcessId | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64CsrIdentifyAlertableThread | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64CsrNewThread | some 5.2 and some 6.0 (wow64 only); in 5.2 from Windows Server 2003 SP1 and higher; in 6.0 before Windows Vista SP1 |
|
| NtWow64CsrSetPriorityClass | some 5.2 and some 6.0 (wow64 only); in 5.2 from Windows Server 2003 SP1 and higher; in 6.0 before Windows Vista SP1 |
|
| NtWow64CsrVerifyRegion | 6.0 and higher (wow64 only) | |
| NtWow64DebuggerCall | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64GetCurrentProcessorNumberEx | 6.1 and higher (wow64 only) | |
| NtWow64GetNativeSystemInformation | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64InterlockedPopEntrySList | 6.1 only (wow64 only) | |
| NtWow64IsProcessorFeaturePresent | 10.0 and higher (wow64 only) | |
| NtWow64QueryInformationProcess64 | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64QueryVirtualMemory64 | 5.2 from Windows Server 2003 SP1, to 6.3 (wow64 only) | |
| NtWow64ReadVirtualMemory64 | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| NtWow64WriteVirtualMemory64 | 6.0 and higher (wow64 only) | |
| NtWriteFile | 3.10 and higher | documented (WDK) |
| NtWriteFileGather | 4.0 from Windows NT 4.0 SP3, and higher | |
| NtWriteRequestData | 3.10 and higher | |
| NtWriteVirtualMemory | 3.10 and higher | |
| NtYieldExecution | 4.0 and higher | |
| NtdllDefWindowProc_A | 6.0 from Windows Vista SP1, and higher | |
| NtdllDefWindowProc_W | 6.0 from Windows Vista SP1, and higher | |
| NtdllDialogWndProc_A | 6.0 from Windows Vista SP1, and higher | |
| NtdllDialogWndProc_W | 6.0 from Windows Vista SP1, and higher | |
| PfxFindPrefix | 3.10 and higher | declared (WDK) |
| PfxInitialize | 3.10 and higher | declared (WDK) |
| PfxInsertPrefix | 3.10 and higher | declared (WDK) |
| PfxRemovePrefix | 3.10 and higher | declared (WDK) |
| PssNtCaptureSnapshot | 6.3 and higher | |
| PssNtDuplicateSnapshot | 6.3 and higher | |
| PssNtFreeRemoteSnapshot | 6.3 and higher | |
| PssNtFreeSnapshot | 6.3 and higher | |
| PssNtFreeWalkMarker | 6.3 and higher | |
| PssNtQuerySnapshot | 6.3 and higher | |
| PssNtValidateDescriptor | 6.3 and higher | |
| PssNtWalkSnapshot | 6.3 and higher | |
| PropertyLengthAsVariant | 4.0 to 5.2 | |
| ResCCloseRuntimeView | 6.0 before Windows Vista SP1 | |
| ResCCompareCacheIDs | 6.0 before Windows Vista SP1 | |
| ResCCreateCultureMap | 6.0 before Windows Vista SP1 | |
| ResCCreateDefaultCultureMap | 6.0 before Windows Vista SP1 | |
| ResCCreateRuntimeView | 6.0 before Windows Vista SP1 | |
| ResCDirectoryCreateAndPopulate | 6.0 before Windows Vista SP1 | |
| ResCDirectoryCreateMapping | 6.0 before Windows Vista SP1 | |
| ResCDirectoryFree | 6.0 before Windows Vista SP1 | |
| ResCDirectoryGetBaseFolder | 6.0 before Windows Vista SP1 | |
| ResCDirectoryGetEntry | 6.0 before Windows Vista SP1 | |
| ResCDirectoryGetEntryCopy | 6.0 before Windows Vista SP1 | |
| ResCDirectoryGetEntryEx | 6.0 before Windows Vista SP1 | |
| ResCDirectoryGetEntryExCopy | 6.0 before Windows Vista SP1 | |
| ResCDirectoryGetEntryIndex | 6.0 before Windows Vista SP1 | |
| ResCDirectoryGetEntryIndexEx | 6.0 before Windows Vista SP1 | |
| ResCDirectoryGetFirstEntry | 6.0 before Windows Vista SP1 | |
| ResCDirectoryGetFirstEntryIndex | 6.0 before Windows Vista SP1 | |
| ResCDirectoryGetSegmentIndex | 6.0 before Windows Vista SP1 | |
| ResCDirectoryGetSegmentName | 6.0 before Windows Vista SP1 | |
| ResCDirectoryLoadFixedSize | 6.0 before Windows Vista SP1 | |
| ResCDirectoryOpenMapping | 6.0 before Windows Vista SP1 | |
| ResCFreeCultureMap | 6.0 before Windows Vista SP1 | |
| ResCGetCacheIndices | 6.0 before Windows Vista SP1 | |
| ResCGetCultureID | 6.0 before Windows Vista SP1 | |
| ResCGetCultureIndex | 6.0 before Windows Vista SP1 | |
| ResCGetCultureName | 6.0 before Windows Vista SP1 | |
| ResCGetHighestCacheIndex | 6.0 before Windows Vista SP1 | |
| ResCGetHighestConsecutiveCacheIndex | 6.0 before Windows Vista SP1 | |
| ResCGetIndexedName | 6.0 before Windows Vista SP1 | |
| ResCGetName | 6.0 before Windows Vista SP1 | |
| ResCGetRegistryBaseFolder | 6.0 before Windows Vista SP1 | |
| ResCGetRegistryConfig | 6.0 before Windows Vista SP1 | |
| ResCGetRegistryLatestIndex | 6.0 before Windows Vista SP1 | |
| ResCGetRegistryMappingPrefix | 6.0 before Windows Vista SP1 | |
| ResCGetRegistryStatus | 6.0 before Windows Vista SP1 | |
| ResCGetSubIndexedName | 6.0 before Windows Vista SP1 | |
| ResCInitRuntimeView | 6.0 before Windows Vista SP1 | |
| ResCInitRuntimeViewEx | 6.0 before Windows Vista SP1 | |
| ResCKeDirectoryOpenMapping | 6.0 before Windows Vista SP1 | |
| ResCKeGetBaseFolder | 6.0 before Windows Vista SP1 | |
| ResCKeGetCacheIndices | 6.0 before Windows Vista SP1 | |
| ResCKeInitRuntimeViewEx | 6.0 before Windows Vista SP1 | |
| ResCKeSegmentOpenMapping | 6.0 before Windows Vista SP1 | |
| ResCLoadCultureMap | 6.0 before Windows Vista SP1 | |
| ResCOpenRegistryKey | 6.0 before Windows Vista SP1 | |
| ResCOpenRuntimeView | 6.0 before Windows Vista SP1 | |
| ResCReleaseInitMutex | 6.0 before Windows Vista SP1 | |
| ResCReloadCultureMap | 6.0 before Windows Vista SP1 | |
| ResCRequestInitMutex | 6.0 before Windows Vista SP1 | |
| ResCRuntimeGetAnySegmentData | 6.0 before Windows Vista SP1 | |
| ResCRuntimeGetCultureID | 6.0 before Windows Vista SP1 | |
| ResCRuntimeGetEntryData | 6.0 before Windows Vista SP1 | |
| ResCRuntimeGetEntryDataEx | 6.0 before Windows Vista SP1 | |
| ResCRuntimeGetResourceData | 6.0 before Windows Vista SP1 | |
| ResCRuntimeGetResourceDataEx | 6.0 before Windows Vista SP1 | |
| ResCRuntimeGetResourceDataForCulture | 6.0 before Windows Vista SP1 | |
| ResCRuntimeGetSegmentData | 6.0 before Windows Vista SP1 | |
| ResCRuntimeGetSegmentDataEx | 6.0 before Windows Vista SP1 | |
| ResCRuntimeViewLoadCultureMap | 6.0 before Windows Vista SP1 | |
| ResCSaveRegistryBaseFolder | 6.0 before Windows Vista SP1 | |
| ResCSaveRegistryConfig | 6.0 before Windows Vista SP1 | |
| ResCSaveRegistryLatestIndex | 6.0 before Windows Vista SP1 | |
| ResCSaveRegistryStatus | 6.0 before Windows Vista SP1 | |
| ResCSegmentCreateAndPopulate | 6.0 before Windows Vista SP1 | |
| ResCSegmentCreateMapping | 6.0 before Windows Vista SP1 | |
| ResCSegmentFree | 6.0 before Windows Vista SP1 | |
| ResCSegmentGetData | 6.0 before Windows Vista SP1 | |
| ResCSegmentLoadFixedSize | 6.0 before Windows Vista SP1 | |
| ResCSegmentOpenMapping | 6.0 before Windows Vista SP1 | |
| ResCSegmentReserveMapping | 6.0 before Windows Vista SP1 | |
| ResCSetCacheSecurityType | 6.0 before Windows Vista SP1 | |
| RestoreEm87Context | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| RtlAbortRXact | 3.10 and higher | |
| RtlAbsoluteToSelfRelativeSD | 3.10 and higher | documented (WDK) |
| RtlAcquirePebLock | 3.10 and higher | |
| RtlAcquirePrivilege | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlAcquireReleaseSRWLockExclusive | 6.1 and higher | |
| RtlAcquireResourceExclusive | 3.10 and higher | |
| RtlAcquireResourceShared | 3.10 and higher | |
| RtlAcquireSRWLockExclusive | 6.0 and higher | |
| RtlAcquireSRWLockShared | 6.0 and higher | |
| RtlActivateActivationContext | 5.1 and higher | |
| RtlActivateActivationContextEx | 5.1 and higher | |
| RtlActivateActivationContextUnsafeFast | 5.1 and higher | |
| RtlAddAccessAllowedAce | 3.10 and higher | documented (WDK) |
| RtlAddAccessAllowedAceEx | 5.0 and higher | documented (WDK) |
| RtlAddAccessAllowedObjectAce | 5.0 and higher | |
| RtlAddAccessDeniedAce | 3.10 and higher | |
| RtlAddAccessDeniedAceEx | 5.0 and higher | |
| RtlAddAccessDeniedObjectAce | 5.0 and higher | |
| RtlAddAce | 3.10 and higher | documented (WDK) |
| RtlAddActionToRXact | 3.10 and higher | |
| RtlAddAtomToAtomTable | 4.0 and higher | |
| RtlAddAttributeActionToRXact | 3.10 and higher | |
| RtlAddAuditAccessAce | 3.10 and higher | |
| RtlAddAuditAccessAceEx | 5.0 and higher | |
| RtlAddAuditAccessObjectAce | 5.0 and higher | |
| RtlAddCompoundAce | 4.0 and higher | |
| RtlAddFunctionTable | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | documented (KERNEL32) |
| RtlAddGrowableFunctionTable | 6.2 and higher (x64 only) | documented |
| RtlAddIntegrityLabelToBoundaryDescriptor | 6.1 and higher | |
| RtlAddMandatoryAce | 6.0 and higher | |
| RtlAddProcessTrustLabelAce | 6.3 and higher | |
| RtlAddRange | 5.0 to 5.1 | |
| RtlAddRefActivationContext | 5.1 and higher | |
| RtlAddRefMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlAddResourceAttributeAce | 6.2 and higher | |
| RtlAddSIDToBoundaryDescriptor | 6.0 and higher | |
| RtlAddScopedPolicyIDAce | 6.2 and higher | |
| RtlAddVectoredContinueHandler | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlAddVectoredExceptionHandler | 5.1 and higher | |
| RtlAddressInSectionTable | 5.1 and higher | |
| RtlAdjustPrivilege | 3.10 and higher | |
| RtlAllocateActivationContextStack | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlAllocateAndInitializeSid | 3.10 and higher | documented (WDK) |
| RtlAllocateAndInitializeSidEx | 6.3 and higher | declared (Windows 10 WDK) |
| RtlAllocateHandle | 4.0 and higher | |
| RtlAllocateHeap | 3.10 and higher | documented (WDK) |
| RtlAllocateMemoryBlockLookaside | 6.0 and higher | |
| RtlAllocateMemoryZone | 6.0 and higher | |
| RtlAllocateWnfSerializationGroup | 6.2 and higher | |
| RtlAnalyzeProfile | 3.10 only | |
| RtlAnsiCharToUnicodeChar | 3.10 and higher | documented (WDK) |
| RtlAnsiStringToUnicodeSize | 3.10 and higher | documented (WDK) |
| RtlAnsiStringToUnicodeString | 3.10 and higher | documented |
| RtlAppendAsciizToString | 3.10 and higher | |
| RtlAppendPathElement | 5.1 and higher | |
| RtlAppendStringToString | 3.10 and higher | documented (WDK) |
| RtlAppendUnicodeStringToString | 3.10 and higher | documented (WDK) |
| RtlAppendUnicodeToString | 3.10 and higher | documented (WDK) |
| RtlApplicationVerifierStop | 5.1 and higher | |
| RtlApplyRXact | 3.10 and higher | |
| RtlApplyRXactNoFlush | 3.10 and higher | |
| RtlAppxIsFileOwnedByTrustedInstaller | 6.2 and higher | |
| RtlAreAllAccessesGranted | 3.10 and higher | |
| RtlAreAnyAccessesGranted | 3.10 and higher | |
| RtlAreBitsClear | 3.10 and higher | documented (WDK) |
| RtlAreBitsSet | 3.10 and higher | documented (WDK) |
| RtlAssert | 3.10 and higher | documented (WDK) |
| RtlAssert2 | 5.1 only | |
| RtlAvlInsertNodeEx | 6.2 and higher | |
| RtlAvlRemoveNode | 6.2 and higher | |
| RtlBarrier | 6.0 and higher | |
| RtlBarrierForDelete | 6.0 and higher | |
| RtlCallbackLpcClient | 5.0 only | |
| RtlCancelTimer | 5.0 and higher | |
| RtlCanonicalizeDomainName | 6.2 and higher | |
| RtlCapabilityCheck | 10.0 and higher | |
| RtlCaptureContext | 5.1 and higher | documented (KERNEL32) |
| RtlCaptureStackBackTrace | 3.10 and higher | documented (WDK) |
| RtlCaptureStackContext | 5.1 and higher (x86 only) | |
| RtlCharToInteger | 3.10 and higher | documented |
| RtlCheckForOrphanedCriticalSections | 5.0 and higher | |
| RtlCheckPortableOperatingSystem | 6.2 and higher | |
| RtlCheckProcessParameters | 5.1 to 5.2 | |
| RtlCheckRegistryKey | 3.10 and higher | documented (WDK) |
| RtlCheckSandboxedToken | 10.0 and higher | |
| RtlCheckTokenCapability | 6.2 and higher | |
| RtlCheckTokenMembership | 6.2 and higher | |
| RtlCheckTokenMembershipEx | 6.2 and higher | |
| RtlCleanUpTEBLangLists | 6.0 and higher | |
| RtlClearAllBits | 3.10 and higher | documented (WDK) |
| RtlClearBit | 6.2 and higher | documented (WDK) |
| RtlClearBits | 3.10 and higher | documented (WDK) |
| RtlCloneMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlCloneUserProcess | 6.0 and higher | |
| RtlClosePropertySet | 4.0 only | |
| RtlCmDecodeMemIoResource | 6.0 and higher | documented (WDK) |
| RtlCmEncodeMemIoResource | 6.0 and higher | documented (WDK) |
| RtlCommitDebugInfo | 6.0 and higher | |
| RtlCommitMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlCompactHeap | 3.10 and higher | |
| RtlCompareAltitudes | 6.0 and higher | declared (WDK) |
| RtlCompareMemory | 3.10 and higher | documented |
| RtlCompareMemoryUlong | 3.10 and higher | documented (WDK) |
| RtlCompareString | 3.10 and higher | documented (WDK) |
| RtlCompareUnicodeString | 3.10 and higher | documented (WDK) |
| RtlCompareUnicodeStrings | 6.0 and higher | declared (WDK) |
| RtlCompareVariants | 4.0 only | |
| RtlCompleteProcessCloning | 6.0 and higher (x64 only) | |
| RtlCompressBuffer | 3.51 and higher | documented (WDK) |
| RtlComputeCrc32 | 5.1 and higher | declared (Windows 10 WDK) |
| RtlComputeImportTableHash | 5.1 and higher | |
| RtlComputePrivatizedDllName_U | 5.1 and higher | |
| RtlConnectToSm | 6.0 and higher | |
| RtlConsoleMultiByteToUnicodeN | 3.10 and higher | |
| RtlContractHashTable | 6.1 and higher | declared (WDK) |
| RtlConvertDeviceFamilyInfoToString | 10.0 and higher | declared |
| RtlConvertExclusiveToShared | 3.10 and higher | |
| RtlConvertLCIDToString | 6.0 and higher | |
| RtlConvertLongToLargeInteger | 3.10 and higher (x86 only) | documented (WDK) |
| RtlConvertPropertyToVariant | 4.0 to 5.2 | |
| RtlConvertSRWLockExclusiveToShared | 10.0 and higher | |
| RtlConvertSharedToExclusive | 3.10 and higher | |
| RtlConvertSidToUnicodeString | 3.10 and higher | documented |
| RtlConvertToAutoInheritSecurityObject | 5.0 and higher | |
| RtlConvertUiListToApiList | 3.10 to 6.2 | |
| RtlConvertUlongToLargeInteger | 3.10 and higher (x86 only) | documented (WDK) |
| RtlConvertVariantToProperty | 4.0 to 5.2 | |
| RtlCopyBitMap | 6.2 and higher | declared (Windows 10 WDK) |
| RtlCopyContext | 6.1 from Windows 7 SP1, and higher | declared in Windows 10 WDK |
| RtlCopyExtendedContext | 6.1 and higher | declared (SDK) |
| RtlCopyLuid | 3.10 and higher | documented (WDK) |
| RtlCopyLuidAndAttributesArray | 3.10 and higher | |
| RtlCopyMappedMemory | 5.2 and higher | |
| RtlCopyMemory | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | documented (WDK) |
| RtlCopyMemoryNonTemporal | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | declared (WDK) |
| RtlCopyMemoryStreamTo | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlCopyOutOfProcessMemoryStreamTo | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlCopyRangeList | 5.0 to 5.1 | |
| RtlCopySecurityDescriptor | 3.10 and higher | |
| RtlCopySid | 3.10 and higher | documented (WDK) |
| RtlCopySidAndAttributesArray | 3.10 and higher | |
| RtlCopyString | 3.10 and higher | documented (WDK) |
| RtlCopyUnicodeString | 3.10 and higher | documented (WDK) |
| RtlCrc32 | 6.2 and higher | declared (Windows 10 SDK) |
| RtlCrc64 | 6.2 and higher | declared (Windows 10 SDK) |
| RtlCreateAcl | 3.10 and higher | documented (WDK) |
| RtlCreateActivationContext | 5.1 and higher | |
| RtlCreateAndSetSD | 3.10 and higher | |
| RtlCreateAtomTable | 4.0 and higher | |
| RtlCreateBootStatusDataFile | 5.1 and higher | |
| RtlCreateBoundaryDescriptor | 6.0 and higher | |
| RtlCreateEnvironment | 3.10 and higher | |
| RtlCreateEnvironmentEx | 6.0 and higher | |
| RtlCreateHashTable | 6.1 and higher | declared (WDK) |
| RtlCreateHashTableEx | 6.2 and higher | declared (Windows 10 WDK) |
| RtlCreateHeap | 3.10 and higher | documented (WDK) |
| RtlCreateLpcServer | 5.0 only | |
| RtlCreateMemoryBlockLookaside | 6.0 and higher | |
| RtlCreateMemoryZone | 6.0 and higher | |
| RtlCreateProcessParameters | 3.10 and higher | |
| RtlCreateProcessParametersEx | 6.0 and higher | |
| RtlCreateProcessReflection | 6.1 and higher | |
| RtlCreatePropertySet | 4.0 only | |
| RtlCreateQueryDebugBuffer | 3.51 and higher | |
| RtlCreateRegistryKey | 3.10 and higher | documented (WDK) |
| RtlCreateSecurityDescriptor | 3.10 and higher | documented (WDK) |
| RtlCreateServiceSid | 6.0 and higher | declared (WDK) |
| RtlCreateSystemVolumeInformationFolder | 5.1 and higher | documented (WDK) |
| RtlCreateTagHeap | 3.51 and higher | |
| RtlCreateTimer | 5.0 and higher | |
| RtlCreateTimerQueue | 5.0 and higher | |
| RtlCreateUmsCompletionList | 6.1 and higher (x64 only) | |
| RtlCreateUmsThread | 6.1 and higher (x64 only) | |
| RtlCreateUmsThreadContext | 6.1 and higher (x64 only) | |
| RtlCreateUnicodeString | 3.10 and higher | documented (WDK) |
| RtlCreateUnicodeStringFromAsciiz | 3.10 and higher | |
| RtlCreateUserProcess | 3.10 and higher | |
| RtlCreateUserSecurityObject | 3.10 and higher | |
| RtlCreateUserStack | 6.0 and higher | |
| RtlCreateUserThread | 3.10 and higher | |
| RtlCreateVirtualAccountSid | 6.1 and higher | declared (WDK) |
| RtlCultureNameToLCID | 6.0 and higher | |
| RtlCustomCPToUnicodeN | 3.10 and higher | documented (WDK) |
| RtlCutoverTimeToSystemTime | 3.51 and higher | declared (Windows 10 WDK) |
| RtlDeCommitDebugInfo | 6.0 and higher | |
| RtlDeNormalizeProcessParams | 3.10 and higher | |
| RtlDeactivateActivationContext | 5.1 and higher | |
| RtlDeactivateActivationContextUnsafeFast | 5.1 and higher | |
| RtlDebugPrintTimes | 5.0 and higher | |
| RtlDecodePointer | some 5.1, some 5.2, and higher; in 5.1 from Windows XP SP2 and higher; in 5.2 from Windows Server 2003 SP1 and higher |
|
| RtlDecodeRemotePointer | 10.0 and higher | |
| RtlDecodeSystemPointer | some 5.1, some 5.2, and higher; in 5.1 from Windows XP SP2 and higher; in 5.2 from Windows Server 2003 SP1 and higher |
|
| RtlDecompressBuffer | 3.51 and higher | documented (WDK) |
| RtlDecompressBufferEx | 6.2 and higher | documented (WDK) |
| RtlDecompressFragment | 3.51 and higher | documented (WDK) |
| RtlDefaultNpAcl | 5.0 and higher | |
| RtlDelete | 3.10 and higher | documented (WDK) |
| RtlDeleteAce | 3.10 and higher | documented (WDK) |
| RtlDeleteAtomFromAtomTable | 4.0 and higher | |
| RtlDeleteBarrier | 6.0 and higher | |
| RtlDeleteBoundaryDescriptor | 6.0 and higher | |
| RtlDeleteCriticalSection | 3.10 and higher | |
| RtlDeleteElementGenericTable | 3.10 and higher | documented (WDK) |
| RtlDeleteElementGenericTableAvl | 5.1 and higher | declared (WDK) |
| RtlDeleteElementGenericTableAvlEx | 6.2 and higher | declared (Windows 10 WDK) |
| RtlDeleteFunctionTable | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | documented (KERNEL32) |
| RtlDeleteGrowableFunctionTable | 6.2 and higher (x64 only) | documented |
| RtlDeleteHashTable | 6.1 and higher | declared (WDK) |
| RtlDeleteNoSplay | 4.0 and higher | documented (WDK) |
| RtlDeleteOwnersRanges | 5.0 to 5.1 | |
| RtlDeleteRange | 5.0 to 5.1 | |
| RtlDeleteRegistryValue | 3.10 and higher | documented (WDK) |
| RtlDeleteResource | 3.10 and higher | |
| RtlDeleteSecurityObject | 3.10 and higher | |
| RtlDeleteTimer | 5.0 and higher | |
| RtlDeleteTimerQueue | 5.0 and higher | |
| RtlDeleteTimerQueueEx | 5.0 and higher | |
| RtlDeleteUmsCompletionList | 6.1 and higher (x64 only) | |
| RtlDeleteUmsThreadContext | 6.1 and higher (x64 only) | |
| RtlDequeueUmsCompletionListItems | 6.1 and higher (x64 only) | |
| RtlDeregisterSecureMemoryCacheCallback | 6.0 from Windows Vista SP1, and higher | |
| RtlDeregisterWait | 5.0 and higher | |
| RtlDeregisterWaitEx | 5.0 and higher | |
| RtlDeriveCapabilitySidsFromName | 10.0 and higher | |
| RtlDestroyAtomTable | 4.0 and higher | |
| RtlDestroyEnvironment | 3.10 and higher | |
| RtlDestroyHandleTable | 4.0 and higher | |
| RtlDestroyHeap | 3.10 and higher | documented (WDK) |
| RtlDestroyMemoryBlockLookaside | 6.0 and higher | |
| RtlDestroyMemoryZone | 6.0 and higher | |
| RtlDestroyProcessParameters | 3.10 and higher | |
| RtlDestroyQueryDebugBuffer | 3.51 and higher | |
| RtlDetectHeapLeaks | 6.1 and higher | |
| RtlDetermineDosPathNameType_U | 3.10 and higher | |
| RtlDisableThreadProfiling | 6.1 and higher | |
| RtlDispatchAPC (8) | 6.1 and higher | |
| RtlDllShutdownInProgress | 5.1 and higher | |
| RtlDnsHostNameToComputerName | 5.0 and higher | |
| RtlDoesFileExists_U | 3.10 and higher | |
| RtlDosApplyFileIsolationRedirection_Ustr | 5.1 and higher | |
| RtlDosPathNameToNtPathName_U | 3.10 and higher | |
| RtlDosPathNameToNtPathName_U_WithStatus | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlDosPathNameToRelativeNtPathName_U | 5.2 and higher | |
| RtlDosPathNameToRelativeNtPathName_U_WithStatus | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlDosSearchPath_U | 3.10 and higher | |
| RtlDosSearchPath_Ustr | 5.1 and higher | |
| RtlDowncaseUnicodeChar | 5.1 and higher | documented (WDK) |
| RtlDowncaseUnicodeString | 4.0 and higher | documented (WDK) |
| RtlDumpResource | 3.10 and higher | |
| RtlDuplicateUnicodeString | 5.1 and higher | declared (WDK) |
| RtlEmptyAtomTable | 4.0 and higher | |
| RtlEnableEarlyCriticalSectionEventCreation | 5.0 and higher | |
| RtlEnableThreadProfiling | 6.1 and higher | |
| RtlEncodePointer | some 5.1, some 5.2, and higher; in 5.1 from Windows XP SP2 and higher; in 5.2 from Windows Server 2003 SP1 and higher |
|
| RtlEncodeRemotePointer | 10.0 and higher | |
| RtlEncodeSystemPointer | some 5.1, some 5.2, and higher; in 5.1 from Windows XP SP2 and higher; in 5.2 from Windows Server 2003 SP1 and higher |
|
| RtlEndEnumerationHashTable | 6.1 and higher | declared (WDK) |
| RtlEndStrongEnumerationHashTable | 10.0 and higher | declared (Windows 10 WDK) |
| RtlEndWeakEnumerationHashTable | 6.1 and higher | declared (WDK) |
| RtlEnlargedIntegerMultiply | 3.10 and higher (x86 only) | documented (WDK) |
| RtlEnlargedUnsignedDivide | 3.10 to 6.1 (x86 only) | documented (WDK) |
| RtlEnlargedUnsignedMultiply | 3.10 and higher (x86 only) | documented (WDK) |
| RtlEnterCriticalSection | 3.10 and higher | |
| RtlEnterUmsSchedulingMode | 6.1 and higher (x64 only) | |
| RtlEnumProcessHeaps | 3.51 and higher | |
| RtlEnumerateEntryHashTable | 6.1 and higher | declared (WDK) |
| RtlEnumerateGenericTable | 3.10 and higher | documented (WDK) |
| RtlEnumerateGenericTableAvl | 5.1 and higher | declared (WDK) |
| RtlEnumerateGenericTableLikeADirectory | 5.1 and higher | documented (WDK) |
| RtlEnumerateGenericTableWithoutSplaying | 3.10 and higher | documented (WDK) |
| RtlEnumerateGenericTableWithoutSplayingAvl | 5.1 and higher | declared (WDK) |
| RtlEnumerateProperties | 4.0 only | |
| RtlEqualComputerName | 3.10 and higher | |
| RtlEqualDomainName | 3.10 and higher | |
| RtlEqualLuid | 3.10 and higher | documented (WDK) |
| RtlEqualPrefixSid | 3.10 and higher | documented (WDK) |
| RtlEqualSid | 3.10 and higher | documented (WDK) |
| RtlEqualString | 3.10 and higher | documented (WDK) |
| RtlEqualUnicodeString | 3.10 and higher | documented (WDK) |
| RtlEqualWnfChangeStamps | 6.2 and higher | |
| RtlEraseUnicodeString | 3.10 and higher | |
| RtlEthernetAddressToStringA | 6.1 and higher | declared |
| RtlEthernetAddressToStringW | 6.1 and higher | declared |
| RtlEthernetStringToAddressA | 6.1 and higher | declared |
| RtlEthernetStringToAddressW | 6.1 and higher | declared |
| RtlExecuteUmsThread | 6.1 and higher (x64 only) | |
| RtlExitUserProcess | 6.0 and higher | |
| RtlExitUserThread | 5.1 and higher | |
| RtlExpandEnvironmentStrings | 3.10, then 6.0 and higher | |
| RtlExpandEnvironmentStrings_U | 3.10 and higher | |
| RtlExpandHashTable | 6.1 and higher | declared (WDK) |
| RtlExtendHeap | 3.51 to 5.2 | |
| RtlExtendMemoryBlockLookaside | 6.0 and higher | |
| RtlExtendMemoryZone | 6.0 and higher | |
| RtlExtendedIntegerMultiply | 3.10 and higher (x86 only) | documented |
| RtlExtendedLargeIntegerDivide | 3.10 and higher (x86 only) | documented |
| RtlExtendedMagicDivide | 3.10 and higher (x86 only) | documented (WDK) |
| RtlExtractBitMap | 6.2 and higher | declared (Windows 10 WDK) |
| RtlFillMemory | 3.10 and higher | documented (WDK) |
| RtlFillMemoryUlong | 3.10 and higher (x86 only) | documented (WDK) |
| RtlFillMemoryUlonglong | 6.1 and higher (x86 only) | documented (WDK) |
| RtlFinalReleaseOutOfProcessMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlFindAceByType | 6.0 and higher | |
| RtlFindActivationContextSectionGuid | 5.1 and higher | |
| RtlFindActivationContextSectionString | 5.1 and higher | |
| RtlFindCharInUnicodeString | 5.1 and higher | |
| RtlFindClearBits | 3.10 and higher | documented (WDK) |
| RtlFindClearBitsAndSet | 3.10 and higher | documented (WDK) |
| RtlFindClearRuns | 5.1 and higher | documented (WDK) |
| RtlFindClosestEncodableLength | 6.0 and higher | declared (Windows 10 WDK) |
| RtlFindLastBackwardRunClear | 5.0 and higher | documented (WDK) |
| RtlFindLeastSignificantBit | 5.0 and higher | documented (WDK) |
| RtlFindLongestRunClear | 3.10 and higher | documented (WDK) |
| RtlFindLongestRunSet | 3.10 to 4.0 | |
| RtlFindMessage | 3.10 and higher | |
| RtlFindMostSignificantBit | 5.0 and higher | documented (WDK) |
| RtlFindNextForwardRunClear | 5.0 and higher | documented (WDK) |
| RtlFindRange | 5.0 to 5.1 | |
| RtlFindSetBits | 3.10 and higher | documented (WDK) |
| RtlFindSetBitsAndClear | 3.10 and higher | documented (WDK) |
| RtlFindUnicodeSubstring | 10.0 and higher | |
| RtlFirstEntrySList | 5.1 and higher | documented |
| RtlFirstFreeAce | 3.10 and higher | |
| RtlFlsAlloc | 6.0 and higher | |
| RtlFlsFree | 6.0 and higher | |
| RtlFlushHeaps | 6.2 and higher | |
| RtlFlushPropertySet | 4.0 only | |
| RtlFlushSecureMemoryCache | 5.1 and higher | |
| RtlFormatCurrentUserKeyPath | 3.51 and higher | |
| RtlFormatMessage | 3.10 and higher | |
| RtlFormatMessageEx | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlFreeActivationContextStack | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlFreeAnsiString | 3.10 and higher | documented |
| RtlFreeHandle | 4.0 and higher | |
| RtlFreeHeap | 3.10 and higher | documented (WDK) |
| RtlFreeMemoryBlockLookaside | 6.0 and higher | |
| RtlFreeOemString | 3.10 and higher | documented |
| RtlFreeRangeList | 5.0 to 5.1 | |
| RtlFreeSid | 3.10 and higher | documented (WDK) |
| RtlFreeThreadActivationContextStack | 5.1 and higher | |
| RtlFreeUnicodeString | 3.10 and higher | documented |
| RtlFreeUserStack | 6.0 and higher | |
| RtlFreeUserThreadStack | 4.0 to 5.2 | |
| RtlGUIDFromString | 5.0 and higher | documented (WDK) |
| RtlGenerate8dot3Name | 3.10 and higher | documented (WDK) |
| RtlGetAce | 3.10 and higher | documented (WDK) |
| RtlGetActiveActivationContext | 5.1 and higher | |
| RtlGetAppContainerNamedObjectPath | 6.2 and higher | |
| RtlGetAppContainerParent | 6.3 and higher | |
| RtlGetAppContainerSidType | 6.3 and higher | |
| RtlGetCallersAddress | 3.10 and higher | documented (WDK) |
| RtlGetCompressionWorkSpaceSize | 3.51 and higher | documented (WDK) |
| RtlGetControlSecurityDescriptor | 3.10 and higher | |
| RtlGetCriticalSectionRecursionCount | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlGetCurrentDirectory_U | 3.10 and higher | |
| RtlGetCurrentPeb | 5.1 and higher | |
| RtlGetCurrentProcessorNumber | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlGetCurrentProcessorNumberEx | 6.1 and higher | |
| RtlGetCurrentTransaction | 6.0 and higher | |
| RtlGetCurrentUmsThread | 6.1 and higher (x64 only) | |
| RtlGetDaclSecurityDescriptor | 3.10 and higher | documented (WDK) |
| RtlGetDeviceFamilyInfoEnum | 10.0 and higher | declared (Windows 10 SDK) |
| RtlGetElementGenericTable | 3.10 and higher | documented (WDK) |
| RtlGetElementGenericTableAvl | 5.1 and higher | documented (WDK) |
| RtlGetEnabledExtendedFeatures | 6.1 and higher | documented (WDK) |
| RtlGetExepath | 6.2 and higher | |
| RtlGetExtendedContextLength | 6.1 and higher | declared |
| RtlGetExtendedFeaturesMask | 6.1 and higher | declared |
| RtlGetFileMUIPath | 6.0 and higher | |
| RtlGetFirstRange | 5.0 to 5.1 | |
| RtlGetFrame | 5.1 and higher | |
| RtlGetFullPathName_U | 3.10 and higher | |
| RtlGetFullPathname_UEx | 6.1 and higher | |
| RtlGetFullPathName_UstrEx | 5.2 and higher | |
| RtlGetFunctionTableListHead | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | |
| RtlGetGroupSecurityDescriptor | 3.10 and higher | documented (WDK) |
| RtlGetIntegerAtom | 6.0 and higher | |
| RtlGetHandleValueHeap | 3.10 only | |
| RtlGetHeapUserValue | 3.10 only | |
| RtlGetInterruptTimePrecise | 10.0 and higher | |
| RtlGetLastNtStatus | 5.1 and higher | |
| RtlGetLastWin32Error | 5.1 and higher | |
| RtlGetLengthWithoutLastFullDosOrNtPathElement | 5.1 and higher | |
| RtlGetLengthWithoutTrailingPathSeperators | 5.1 and higher | |
| RtlGetLocaleFileMappingAddress | 6.1 and higher | |
| RtlGetLongestNtPathLength | 3.51 and higher | |
| RtlGetNativeSystemInformation | 5.1 and higher | |
| RtlGetNextEntryHashTable | 6.1 and higher | declared (WDK) |
| RtlGetNextRange | 5.0 to 5.1 | |
| RtlGetNextUmsListItem | 6.1 and higher (x64 only) | |
| RtlGetNtGlobalFlags | 3.10 and higher | |
| RtlGetNtProductType | 3.10 and higher | |
| RtlGetNtVersionNumbers | 5.1 and higher | |
| RtlGetOwnerSecurityDescriptor | 3.10 and higher | documented (WDK) |
| RtlGetParentLocaleName | 6.0 and higher | |
| RtlGetProcessHeaps | 3.51 and higher | |
| RtlGetProcessPreferredUILanguages | 6.1 and higher | |
| RtlGetProductInfo | 6.0 and higher | declared |
| RtlGetSaclSecurityDescriptor | 3.10 and higher | documented (WDK) |
| RtlGetSearchPath | 6.2 and higher | |
| RtlGetSecurityDescriptorRMControl | 5.0 and higher | |
| RtlGetSetBootStatusData | 5.1 and higher | |
| RtlGetSystemPreferredUILanguages | 6.0 and higher | |
| RtlGetSystemTimePrecise | 6.2 and higher | |
| RtlGetThreadErrorMode | 5.2 and higher | |
| RtlGetThreadLangIdByIndex | 6.0 and higher | |
| RtlGetThreadPreferredUILanguages | 6.0 and higher | |
| RtlGetUILanguageInfo | 6.0 and higher | |
| RtlGetUmsCompletionListEvent | 6.1 and higher (x64 only) | |
| RtlGetUnloadEventTrace | 5.1 from Windows XP SP2, and higher | |
| RtlGetUnloadEventTraceEx | 6.0 and higher | |
| RtlGetUserInfoHeap | 3.51 and higher | |
| RtlGetUserPreferredUILanguages | 6.0 and higher | |
| RtlGetVersion | 5.0 and higher | documented (WDK) |
| RtlGrowFunctionTable | 6.2 and higher (x64 only) | documented |
| RtlGuidToPropertySetName | 4.0 only | |
| RtlHashUnicodeString | 5.1 and higher | documented (WDK) |
| RtlHeapTrkInitialize | 6.0 and higher | |
| RtlIdentifierAuthoritySid | 3.10 and higher | documented (WDK) |
| RtlIdnToAscii | 6.0 and higher | declared (WDK) |
| RtlIdnToNameprepUnicode | 6.0 and higher | declared (WDK) |
| RtlIdnToUnicode | 6.0 and higher | declared (WDK) |
| RtlImageDirectoryEntryToData | 3.10 and higher | |
| RtlImageNtHeader | 3.10 and higher | declared (Windows 10 WDK) |
| RtlImageNtHeaderEx | 5.2 and higher | declared (Windows 10 WDK) |
| RtlImageRvaToSection | 4.0 and higher | |
| RtlImageRvaToVa | 4.0 and higher | |
| RtlImpersonateLpcClient | 5.0 only | |
| RtlImpersonateSelf | 3.10 and higher | |
| RtlImpersonateSelfEx | 6.0 and higher | |
| RtlInitAnsiString | 3.10 and higher | documented |
| RtlInitAnsiStringEx | 5.2 and higher | declared (WDK) |
| RtlInitBarrier | 6.0 and higher | |
| RtlInitCodePageTable | 3.10 and higher | documented (WDK) |
| RtlInitEnumerationHashTable | 6.1 and higher | declared (WDK) |
| RtlInitMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlInitNlsTables | 3.10 and higher | |
| RtlInitOutOfProcessMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlInitString | 3.10 and higher | documented |
| RtlInitStringEx | 10.0 and higher | documented (WDK) |
| RtlInitStrongEnumerationHashTable | 10.0 and higher | declared (Windows 10 WDK) |
| RtlInitUnicodeString | 3.10 and higher | documented |
| RtlInitUnicodeStringEx | 5.1 and higher | declared (WDK) |
| RtlInitWeakEnumerationHashTable | 6.1 and higher | declared (WDK) |
| RtlInitializeAtomPackage | 4.0 and higher | |
| RtlInitializeBitMap | 3.10 and higher | documented (WDK) |
| RtlInitializeConditionVariable | 6.0 and higher | |
| RtlInitializeContext | 3.10 and higher | |
| RtlInitializeCriticalSection | 3.10 and higher | |
| RtlInitializeCriticalSectionAndSpinCount | 4.0 from Windows NT 4.0 SP3, and higher | |
| RtlInitializeCriticalSectionEx | 6.0 and higher | |
| RtlInitializeExceptionChain | 6.0 from Windows Vista SP1, and higher (x86 only) | |
| RtlInitializeExtendedContext | 6.1 and higher | declared |
| RtlInitializeGenericTable | 3.10 and higher | documented (WDK) |
| RtlInitializeGenericTableAvl | 5.1 and higher | declared (WDK) |
| RtlInitializeHandleTable | 4.0 and higher | |
| RtlInitializeNtUserPfn | 6.0 and higher | |
| RtlInitializeProfile | 3.10 only | |
| RtlInitializeRXact | 3.10 and higher | |
| RtlInitializeRangeList | 5.0 to 5.1 | |
| RtlInitializeResource | 3.10 and higher | |
| RtlInitializeSListHead | 5.1 and higher | documented |
| RtlInitializeSRWLock | 6.0 and higher | |
| RtlInitializeSid | 3.10 and higher | documented (WDK) |
| RtlInitializeSidEx | 10.0 and higher | declared (Windows 10 WDK) |
| RtlInitializeStackTraceDataBase | 3.10, then 5.1 from Windows XP SP2 to 5.2 | |
| RtlInsertElementGenericTable | 3.10 and higher | documented (WDK) |
| RtlInsertElementGenericTableAvl | 5.1 and higher | declared (WDK) |
| RtlInsertElementGenericTableFull | 5.2 and higher | declared (WDK) |
| RtlInsertElementGenericTableFullAvl | 5.2 and higher | documented (WDK) |
| RtlInsertEntryHashTable | 6.1 and higher | declared (WDK) |
| RtlInstallFunctionTableCallback | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | documented |
| RtlInt64ToUnicodeString | 5.0 and higher | documented (WDK) |
| RtlIntegerToChar | 3.10 and higher | |
| RtlIntegerToUnicodeString | 3.10 and higher | documented (WDK) |
| RtlInterlockedClearBitRun | 6.1 and higher | |
| RtlInterlockedCompareExchange64 | 5.2 and higher (x86 only) | |
| RtlInterlockedFlushSList | 5.1 and higher | documented |
| RtlInterlockedPopEntrySList | 5.1 and higher | documented |
| RtlInterlockedPushEntrySList | 5.1 and higher | documented |
| RtlInterlockedPushListSList | 5.1 and higher | |
| RtlInterlockedPushListSListEx | 6.2 and higher | declared in Windows 10 SDK |
| RtlInterlockedSetBitRun | 6.1 and higher | |
| RtlInvertRangeList | 5.0 to 5.1 | |
| RtlIoDecodeMemIoResource | 6.0 and higher | documented (WDK) |
| RtlIoEncodeMemIoResource | 6.0 and higher | documented (WDK) |
| RtlIpv4AddressToStringA | 5.1 and higher | documented |
| RtlIpv4AddressToStringExA | 5.1 from Windows XP SP2, and higher | documented |
| RtlIpv4AddressToStringExW | 5.1 from Windows XP SP2, and higher | documented |
| RtlIpv4AddressToStringW | 5.1 and higher | documented |
| RtlIpv4StringToAddressA | 5.1 and higher | documented |
| RtlIpv4StringToAddressExA | 5.1 from Windows XP SP2, and higher | documented |
| RtlIpv4StringToAddressExW | 5.1 from Windows XP SP2, and higher | documented |
| RtlIpv4StringToAddressW | 5.1 and higher | documented |
| RtlIpv6AddressToStringA | 5.1 and higher | documented |
| RtlIpv6AddressToStringExA | 5.1 from Windows XP SP2, and higher | documented |
| RtlIpv6AddressToStringExW | 5.1 from Windows XP SP2, and higher | documented |
| RtlIpv6AddressToStringW | 5.1 and higher | documented |
| RtlIpv6StringToAddressA | 5.1 and higher | documented |
| RtlIpv6StringToAddressExA | 5.1 from Windows XP SP2, and higher | documented |
| RtlIpv6StringToAddressExW | 5.1 from Windows XP SP2, and higher | documented |
| RtlIpv6StringToAddressW | 5.1 and higher | documented |
| RtlIsActivationContextActive | 5.1 and higher | |
| RtlIsCapabilitySid | 6.2 and higher | |
| RtlIsCriticalSectionLocked | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlIsCriticalSectionLockedByThread | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlIsCurrentThreadAttachExempt | 6.0 and higher | |
| RtlIsDosDeviceName_U | 3.10 and higher | |
| RtlIsGenericTableEmpty | 3.10 and higher | documented (WDK) |
| RtlIsGenericTableEmptyAvl | 5.1 and higher | declared (WDK) |
| RtlIsMultiSessionSku | 10.0 and higher | |
| RtlIsNameInExpression | 6.1 and higher | declared (WDK) |
| RtlIsNameLegalDOS8Dot3 | 3.51 and higher | documented |
| RtlIsNormalizedString | 6.0 and higher | declared (WDK) |
| RtlIsPackageSid | 6.2 and higher | |
| RtlIsParentOfChildAppContainer | 6.3 and higher | |
| RtlIsProcessorFeaturePresent | 10.0 and higher | |
| RtlIsRangeAvailable | 5.0 to 5.1 | |
| RtlIsTextUnicode | 3.51 and higher | |
| RtlIsThreadWithinLoaderCallout | 5.1 from Windows XP SP1, and higher | |
| RtlIsUntrustedObject | 6.2 and higher | declared (Windows 10 WDK) |
| RtlIsValidHandle | 4.0 and higher | |
| RtlIsValidIndexHandle | 4.0 and higher | |
| RtlIsValidLocaleName | 6.0 and higher | |
| RtlIsValidProcessTrustLabelSid | 6.3 and higher | |
| RtlKnownExceptionFilter | 6.1 and higher | |
| RtlLCIDToCultureName | 6.0 and higher | |
| RtlLargeIntegerAdd | 3.10 and higher (x86 only) | documented (WDK) |
| RtlLargeIntegerArithmeticShift | 3.10 and higher (x86 only) | documented (WDK) |
| RtlLargeIntegerDivide | 3.10 and higher (x86 only) | documented (WDK) |
| RtlLargeIntegerNegate | 3.10 and higher (x86 only) | documented (WDK) |
| RtlLargeIntegerShiftLeft | 3.10 and higher (x86 only) | documented (WDK) |
| RtlLargeIntegerShiftRight | 3.10 and higher (x86 only) | documented (WDK) |
| RtlLargeIntegerSubtract | 3.10 and higher (x86 only) | documented (WDK) |
| RtlLargeIntegerToChar | 3.10 and higher | |
| RtlLcidToLocaleName | 6.0 and higher | |
| RtlLeaveCriticalSection | 3.10 and higher | |
| RtlLengthRequiredSid | 3.10 and higher | documented (WDK) |
| RtlLengthSecurityDescriptor | 3.10 and higher | documented (WDK) |
| RtlLengthSid | 3.10 and higher | documented (WDK) |
| RtlLengthSidAsUnicodeString | 6.2 and higher | |
| RtlLoadString | 6.1 and higher | |
| RtlLocalTimeToSystemTime | 3.10 and higher | documented |
| RtlLocaleNameToLcid | 6.0 and higher | |
| RtlLocateExtendedFeature | 6.1 and higher | declared |
| RtlLocateLegacyContext | 6.1 and higher | declared |
| RtlLockBootStatusData | 5.1 and higher | |
| RtlLockCurrentThread | 6.0 and higher | |
| RtlLockHeap | 3.10 and higher | |
| RtlLockMemoryBlockLookaside | 6.0 and higher | |
| RtlLockMemoryStreamRegion | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlLockMemoryZone | 6.0 and higher | |
| RtlLockModuleSection | 6.0 and higher | |
| RtlLogStackBackTrace | 3.10, then 5.1 and higher | |
| RtlLookupAtomInAtomTable | 4.0 and higher | |
| RtlLookupElementGenericTable | 3.10 and higher | documented (WDK) |
| RtlLookupElementGenericTableAvl | 5.1 and higher | declared (WDK) |
| RtlLookupElementGenericTableFull | 5.2 and higher | declared (WDK) |
| RtlLookupElementGenericTableFullAvl | 5.2 and higher | documented (WDK) |
| RtlLookupEntryHashTable | 6.1 and higher | declared (WDK) |
| RtlLookupFunctionEntry | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | documented |
| RtlLookupFunctionTable | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | |
| RtlLookupSymbolByAddress | 3.10 only | |
| RtlLookupSymbolByName | 3.10 only | |
| RtlMakeSelfRelativeSD | 3.10 and higher | |
| RtlMapGenericMask | 3.10 and higher | documented (WDK) |
| RtlMapSecurityErrorToNtStatus | 5.1 and higher | |
| RtlMergeRangeLists | 5.0 to 5.1 | |
| RtlMoveMemory | 3.10 and higher | documented (WDK) |
| RtlMultiAppendUnicodeStringBuffer | 5.1 and higher | |
| RtlMultiByteToUnicodeN | 3.10 and higher | documented (WDK) |
| RtlMultiByteToUnicodeSize | 3.10 and higher | documented (WDK) |
| RtlMultipleAllocateHeap | 5.2 and higher | |
| RtlMultipleFreeHeap | 5.2 and higher | |
| RtlNewInstanceSecurityObject | 3.10 and higher | |
| RtlNewSecurityGrantedAccess | 3.10 and higher | |
| RtlNewSecurityObject | 3.10 and higher | |
| RtlNewSecurityObjectEx | 5.0 and higher | |
| RtlNewSecurityObjectWithMultipleInheritance | 5.1 and higher | |
| RtlNormalizeProcessParams | 3.10 and higher | |
| RtlNormalizeString | 6.0 and higher | declared (WDK) |
| RtlNtPathNameToDosPathName | 5.1 and higher | |
| RtlNtStatusToDosError | 3.10 and higher | documented |
| RtlNtStatusToDosErrorNoTeb | 5.1 and higher | documented (WDK) |
| RtlNtdllName | 6.0 and higher (x64 only) | |
| RtlNumberGenericTableElements | 3.10 and higher | documented (WDK) |
| RtlNumberGenericTableElementsAvl | 5.1 and higher | declared (WDK) |
| RtlNumberOfClearBits | 3.10 and higher | documented (WDK) |
| RtlNumberOfClearBitsInRange | 6.2 and higher | declared (Windows 10 WDK) |
| RtlNumberOfSetBits | 3.10 and higher | documented (WDK) |
| RtlNumberOfSetBitsInRange | 6.2 and higher | declared (Windows 10 WDK) |
| RtlNumberOfSetBitsUlongPtr | 6.0 from Windows Vista SP1, and higher | declared (WDK) |
| RtlOemStringToUnicodeSize | 3.10 and higher | documented (WDK) |
| RtlOemStringToUnicodeString | 3.10 and higher | documented (WDK) |
| RtlOemToUnicodeN | 3.10 and higher | documented (WDK) |
| RtlOnMappedStreamEvent | 4.0 from Windows NT 4.0 SP3 to SP6 | |
| RtlOpenCurrentUser | 3.10 and higher | |
| RtlOsDeploymentState | 10.0 and higher | declared in Windows 10 SDK |
| RtlOwnerAcesPresent | 6.0 and higher | |
| RtlPcToFileHeader | 3.10 and higher | documented |
| RtlPinAtomInAtomTable | 4.0 and higher | |
| RtlPopFrame | 5.1 and higher | |
| RtlPrefixString | 3.10 and higher | |
| RtlPrefixUnicodeString | 3.10 and higher | documented (WDK) |
| RtlPrepareForProcessCloning | 6.0 and higher (x64 only) | |
| RtlProcessFlsData | 6.0 and higher | |
| RtlPropertySetNameToGuid | 4.0 only | |
| RtlProtectHeap | 3.51 and higher | |
| RtlPublishWnfStateData | 6.2 and higher | |
| RtlPushFrame | 5.1 and higher | |
| RtlQueryActivationContextApplicationSettings | 6.0 and higher | |
| RtlQueryAtomInAtomTable | 4.0 and higher | |
| RtlQueryCriticalSectionOwner | 6.0 and higher | |
| RtlQueryDepthSList | 5.1 and higher | documented |
| RtlQueryDynamicTimeZoneInformation | 6.0 and higher | |
| RtlQueryElevationFlags | 6.0 and higher | |
| RtlQueryEnvironmentVariable | 3.10, then 6.0 and higher | |
| RtlQueryEnvironmentVariable_U | 3.10 and higher | |
| RtlQueryHeapInformation | 5.1 and higher | |
| RtlQueryInformationAcl | 3.10 and higher | |
| RtlQueryInformationActivationContext | 5.1 and higher | |
| RtlQueryInformationActiveActivationContext | 5.1 and higher | |
| RtlQueryInterfaceMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlQueryModuleInformation | 3.10, then 6.0 and higher | |
| RtlQueryPackageClaims | 10.0 and higher | declared (Windows 10 WDK) |
| RtlQueryPackageIdentity | 6.2 and higher | declared (Windows 10 WDK) |
| RtlQueryPackageIdentityEx | 6.3 and higher | declared (Windows 10 WDK) |
| RtlQueryPerformanceCounter | 6.1 and higher | |
| RtlQueryPerformanceFrequency | 6.1 and higher | |
| RtlQueryProcessBackTraceInformation | 3.10 and higher | |
| RtlQueryProcessDebugInformation | 3.51 and higher | |
| RtlQueryProcessHeapInformation | 3.10 and higher | |
| RtlQueryProcessLockInformation | 3.10 and higher | |
| RtlQueryProperties | 4.0 only | |
| RtlQueryPropertyNames | 4.0 only | |
| RtlQueryPropertySet | 4.0 only | |
| RtlQueryProtectedPolicy | 10.0 and higher | |
| RtlQueryRegistryValues | 3.10 and higher | documented |
| RtlQueryRegistryValuesEx | 6.2 and higher | |
| RtlQueryResourcePolicy | 6.3 from Windows 8.1 With Update, and higher | |
| RtlQuerySecurityObject | 3.10 and higher | |
| RtlQueryTagHeap | 3.51 and higher | |
| RtlQueryThreadProfiling | 6.1 and higher | |
| RtlQueryTimeZoneInformation | 3.10 and higher | |
| RtlQueryUmsThreadInformation | 6.1 and higher (x64 only) | |
| RtlQueryUnbiasedInterruptTime | 6.2 and higher | |
| RtlQueryValidationRunlevel | 6.2 and higher | declared (Windows 10 WDK) |
| RtlQueryWnfMetaNotification | 6.2 and higher | |
| RtlQueryWnfStateData | 6.2 and higher | |
| RtlQueryWnfStateDataWithExplicitScope | 6.2 and higher | |
| RtlQueueApcWow64Thread | 5.1 and higher | |
| RtlQueueWorkItem | 5.0 and higher | |
| RtlRaiseException | 3.10 and higher | declared (Windows 10 SDK) |
| RtlRaiseStatus | 3.10 and higher | |
| RtlRandom | 3.10 and higher | documented (WDK) |
| RtlRandomEx | 5.1 and higher | documented (WDK) |
| RtlRbInsertNodeEx | 6.2 and higher | |
| RtlRbRemoveNode | 6.2 and higher | |
| RtlReAllocateHeap | 3.10 and higher | |
| RtlReadMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlReadOutOfProcessMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlReadThreadProfilingData | 6.1 and higher | |
| RtlRealPredecessor | 3.10 and higher | documented (WDK) |
| RtlRealSuccessor | 3.10 and higher | documented (WDK) |
| RtlRegisterForWnfMetaNotification | 6.2 and higher | |
| RtlRegisterSecureMemoryCacheCallback | 5.1 and higher | |
| RtlRegisterThreadWithCsrss | 6.0 and higher | |
| RtlRegisterWait | 5.0 and higher | |
| RtlReleaseActivationContext | 5.1 and higher | |
| RtlReleaseMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlReleasePath | 6.2 and higher | |
| RtlReleasePebLock | 3.10 and higher | |
| RtlReleasePrivilege | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlReleaseRelativeName | 5.2 and higher | |
| RtlReleaseResource | 3.10 and higher | |
| RtlReleaseSRWLockExclusive | 6.0 and higher | |
| RtlReleaseSRWLockShared | 6.0 and higher | |
| RtlRemoteCall | 3.10 and higher | |
| RtlRemoveEntryHashTable | 6.1 and higher | declared (WDK) |
| RtlRemovePrivileges | 6.0 and higher | |
| RtlRemoveVectoredContinueHandler | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlRemoveVectoredExceptionHandler | 5.1 and higher | |
| RtlReplaceSidInSd | 6.1 and higher | declared (WDK) |
| RtlReportException | 6.0 and higher | |
| RtlReportSilentProcessExit | 6.1 and higher | |
| RtlReportSqmEscalation | 6.1 and higher | |
| RtlResetMemoryBlockLookaside | 6.0 and higher | |
| RtlResetMemoryZone | 6.0 and higher | |
| RtlResetNtUserPfn | 6.2 and higher | |
| RtlResetRtlTranslations | 3.10 and higher | |
| RtlRestoreContext | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | documented |
| RtlRestoreLastWin32Error | 5.1 and higher | |
| RtlRetrieveNtUserPfn | 6.0 and higher | |
| RtlRevertMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlRunDecodeUnicodeString | 3.10 and higher | |
| RtlRunEncodeUnicodeString | 3.10 and higher | |
| RtlRunOnceBeginInitialize | 6.0 and higher | documented (WDK) |
| RtlRunOnceComplete | 6.0 and higher | documented (WDK) |
| RtlRunOnceExecuteOnce | 6.0 and higher | documented (WDK) |
| RtlRunOnceInitialize | 6.0 and higher | documented (WDK) |
| RtlSecondsSince1970ToTime | 3.10 and higher | documented (WDK) |
| RtlSecondsSince1980ToTime | 3.10 and higher | documented (WDK) |
| RtlSeekMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlSelfRelativeToAbsoluteSD | 3.10 and higher | documented (WDK) |
| RtlSelfRelativeToAbsoluteSD2 | 5.0 and higher | |
| RtlSendMsgToSm | 6.0 and higher | |
| RtlSetAllBits | 3.10 and higher | documented (WDK) |
| RtlSetAttributesSecurityDescriptor | 4.0 and higher | |
| RtlSetBit | 6.2 and higher | documented (WDK) |
| RtlSetBits | 3.10 and higher | documented (WDK) |
| RtlSetControlSecurityDescriptor | 5.0 and higher | |
| RtlSetCriticalSectionSpinCount | 4.0 from Windows NT 4.0 SP3, and higher | |
| RtlSetCurrentDirectory_U | 3.10 and higher | |
| RtlSetCurrentEnvironment | 3.10 and higher | |
| RtlSetCurrentTransaction | 6.0 and higher | |
| RtlSetDaclSecurityDescriptor | 3.10 and higher | documented (WDK) |
| RtlSetDynamicTimeZoneInformation | 6.0 and higher | |
| RtlSetEnvironmentStrings | 5.2 and higher | |
| RtlSetEnvironmentVar | 6.0 and higher | |
| RtlSetEnvironmentVariable | 3.10 and higher | |
| RtlSetExtendedFeaturesMask | 6.1 and higher | declared |
| RtlSetGroupSecurityDescriptor | 3.10 and higher | documented (WDK) |
| RtlSetHeapInformation | 5.1 and higher | |
| RtlSetHandleValueHeap | 3.10 only | |
| RtlSetHeapUserValue | 3.10 only | |
| RtlSetInformationAcl | 3.10 and higher | |
| RtlSetIoCompletionCallback | 5.0 and higher | |
| RtlSetLastWin32Error | 5.1 and higher | |
| RtlSetLastWin32ErrorAndNtStatusFromNtStatus | 5.1 and higher | |
| RtlSetMemoryStreamSize | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlSetOwnerSecurityDescriptor | 3.10 and higher | documented (WDK) |
| RtlSetPortableOperatingSystem | 6.2 and higher | |
| RtlSetProcessDebugInformation | 6.0 and higher | |
| RtlSetProcessIsCritical | 5.1 and higher | |
| RtlSetProcessPreferredUILanguages | 6.1 and higher | |
| RtlSetProperties | 4.0 only | |
| RtlSetPropertyNames | 4.0 only | |
| RtlSetPropertySetClassId | 4.0 only | |
| RtlSetProtectedPolicy | 10.0 and higher | |
| RtlSetSaclSecurityDescriptor | 3.10 and higher | |
| RtlSetSearchPathMode | 6.2 and higher | |
| RtlSetSecurityDescriptorRMControl | 5.0 and higher | |
| RtlSetSecurityObject | 3.10 and higher | |
| RtlSetSecurityObjectEx | 5.0 and higher | |
| RtlSetThreadErrorMode | 5.2 and higher | |
| RtlSetThreadIsCritical | 5.1 and higher | |
| RtlSetThreadPoolStartFunc | 5.0 and higher | |
| RtlSetThreadPreferredUILanguages | 6.0 and higher | |
| RtlSetThreadSubProcessTag | 10.0 and higher | |
| RtlSetTimeZoneInformation | 3.10 and higher | |
| RtlSetTimer | 5.0 and higher | |
| RtlSetUmsThreadInformation | 6.1 and higher (x64 only) | |
| RtlSetUnhandledExceptionFilter | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlSetUnicodeCallouts | 4.0 to 5.2 | |
| RtlSetUserCallbackExceptionFilter | 6.0 from Windows Vista SP1, and higher (wow64 only) | |
| RtlSetUserFlagsHeap | 3.51 and higher | |
| RtlSetUserValueHeap | 3.51 and higher | |
| RtlShutdownLpcServer | 5.0 only | |
| RtlSidDominates | 6.0 and higher | |
| RtlSidDominatesForTrust | 6.3 and higher | |
| RtlSidEqualLevel | 6.0 and higher | |
| RtlSidHashInitialize | 6.0 and higher | |
| RtlSidHashLookup | 6.0 and higher | |
| RtlSidIsHigherLevel | 6.0 and higher | |
| RtlSizeHeap | 3.10 and higher | |
| RtlSleepConditionVariableCS | 6.0 and higher | |
| RtlSleepConditionVariableSRW | 6.0 and higher | |
| RtlSnapshotHeap | 3.10 only | |
| RtlSplay | 3.10 and higher | documented (WDK) |
| RtlStartProfile | 3.10 only | |
| RtlStartRXact | 3.10 and higher | |
| RtlStopProfile | 3.10 only | |
| RtlStatMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlStringFromGUID | 5.0 and higher | documented (WDK) |
| RtlStringFromGUIDEx | 6.3 and higher | declared (Windows 10 WDK) |
| RtlStronglyEnumerateEntryHashTable | 10.0 and higher | declared (Windows 10 WDK) |
| RtlSubAuthorityCountSid | 3.10 and higher | documented (WDK) |
| RtlSubAuthoritySid | 3.10 and higher | documented (WDK) |
| RtlSubscribeWnfStateChangeNotification | 6.2 and higher | |
| RtlSubtreePredecessor | 3.10 and higher | documented (WDK) |
| RtlSubtreeSuccessor | 3.10 and higher | documented (WDK) |
| RtlSwitchedVVI | 10.0 and higher | declared (Windows 10 SDK) |
| RtlSystemTimeToLocalTime | 3.10 and higher | declared (Windows 10 WDK) |
| RtlTestAndPublishWnfStateData | 6.2 and higher | |
| RtlTestBit | 6.0 and higher | documented (WDK) |
| RtlTestProtectedAccess | 6.3 and higher | |
| RtlTimeFieldsToTime | 3.10 and higher | documented (WDK) |
| RtlTimeToElapsedTimeFields | 3.10 and higher | declared (Windows 10 WDK) |
| RtlTimeToSecondsSince1970 | 3.10 and higher | documented |
| RtlTimeToSecondsSince1980 | 3.10 and higher | documented (WDK) |
| RtlTimeToTimeFields | 3.10 and higher | documented (WDK) |
| RtlTraceDatabaseAdd | 5.0 from Windows 2000 SP1, and higher | |
| RtlTraceDatabaseCreate | s5.0 from Windows 2000 SP1, and higher | |
| RtlTraceDatabaseDestroy | 5.0 from Windows 2000 SP1, and higher | |
| RtlTraceDatabaseEnumerate | 5.0 from Windows 2000 SP1, and higher | |
| RtlTraceDatabaseFind | 5.0 from Windows 2000 SP1, and higher | |
| RtlTraceDatabaseLock | 5.0 from Windows 2000 SP1, and higher | |
| RtlTraceDatabaseUnlock | 5.0 from Windows 2000 SP1, and higher | |
| RtlTraceDatabaseValidate | 5.0 from Windows 2000 SP1, and higher | |
| RtlTryAcquirePebLock | 6.0 and higher | |
| RtlTryAcquireSRWLockExclusive | 6.1 and higher | |
| RtlTryAcquireSRWLockShared | 6.1 and higher | |
| RtlTryConvertSRWLockSharedToExclusiveOrRelease | 6.2 and higher | |
| RtlTryEnterCriticalSection | 4.0 and higher | |
| RtlUTF8ToUnicodeN | 6.1 and higher | declared (Windows 10 WDK) |
| RtlUlongByteSwap | 5.0 and higher (x86 only) | documented (WDK) |
| RtlUlonglongByteSwap | 5.0 and higher (x86 only) | documented (WDK) |
| RtlUmsThreadYield | 6.1 and higher (x64 only) | |
| RtlUnhandledExceptionFilter | 5.1 and higher | |
| RtlUnhandledExceptionFilter2 | 5.1 and higher | |
| RtlUnicodeStringToAnsiSize | 3.10 and higher | documented (WDK) |
| RtlUnicodeStringToAnsiString | 3.10 and higher | documented |
| RtlUnicodeStringToCountedOemString | 3.10 and higher | documented (WDK) |
| RtlUnicodeStringToInteger | 3.10 and higher | documented (WDK) |
| RtlUnicodeStringToOemSize | 3.10 and higher | documented (WDK) |
| RtlUnicodeStringToOemString | 3.10 and higher | documented |
| RtlUnicodeToCustomCPN | 3.10 and higher | documented (WDK) |
| RtlUnicodeToMultiByteN | 3.10 and higher | documented (WDK) |
| RtlUnicodeToMultiByteSize | 3.10 and higher | documented |
| RtlUnicodeToOemN | 3.10 and higher | documented (WDK) |
| RtlUnicodeToUTF8N | 6.1 and higher | documented (WDK) |
| RtlUniform | 3.10 and higher | declared (Windows 10 SDK) |
| RtlUnlockBootStatusData | 5.1 and higher | |
| RtlUnlockCurrentThread | 6.0 and higher | |
| RtlUnlockHeap | 3.10 and higher | |
| RtlUnlockMemoryBlockLookaside | 6.0 and higher | |
| RtlUnlockMemoryStreamRegion | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlUnlockMemoryZone | 6.0 and higher | |
| RtlUnlockModuleSection | 6.0 and higher | |
| RtlUnsubscribeWnfNotificationWaitForCompletion | 6.2 and higher | |
| RtlUnsubscribeWnfNotificationWithCompletionCallback | 6.2 and higher | |
| RtlUnsubscribeWnfChangeNotification | 6.2 and higher | |
| RtlUnwind | 3.10 and higher | documented (KERNEL32) |
| RtlUnwindEx | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | documented |
| RtlUpcaseUnicodeChar | 3.10 and higher | documented (WDK) |
| RtlUpcaseUnicodeString | 3.10 and higher | documented (WDK) |
| RtlUpcaseUnicodeStringToAnsiString | 3.10 and higher | |
| RtlUpcaseUnicodeStringToCountedOemString | 3.10 and higher | documented (WDK) |
| RtlUpcaseUnicodeStringToOemString | 3.10 and higher | documented (WDK) |
| RtlUpcaseUnicodeToCustomCPN | 3.10 and higher | documented (WDK) |
| RtlUpcaseUnicodeToMultiByteN | 3.10 and higher | documented (WDK) |
| RtlUpcaseUnicodeToOemN | 3.10 and higher | documented (WDK) |
| RtlUpdateClonedCriticalSection | 6.0 and higher | |
| RtlUpdateClonedSRWLock | 6.0 and higher | |
| RtlUpdateTimer | 5.0 and higher | |
| RtlUpperChar | 3.10 and higher | documented (WDK) |
| RtlUpperString | 3.10 and higher | documented (WDK) |
| RtlUsageHeap | 3.51 to 5.2 | |
| RtlUserThreadStart | 6.0 and higher | |
| RtlUshortByteSwap | 5.0 and higher (x86 only) | documented (WDK) |
| RtlValidAcl | 3.10 and higher | |
| RtlValidProcessProtection | 6.3 and higher | |
| RtlValidRelativeSecurityDescriptor | 5.0 and higher | documented (WDK) |
| RtlValidSecurityDescriptor | 3.10 and higher | documented (WDK) |
| RtlValidSid | 3.10 and higher | documented (WDK) |
| RtlValidateHeap | 3.10 and higher | |
| RtlValidateProcessHeaps | 3.51 and higher | |
| RtlValidateUnicodeString | 5.1 and higher | declared (WDK) |
| RtlVerifyVersionInfo | 5.0 and higher | documented (WDK) |
| RtlVirtualUnwind | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | documented (KERNEL32) |
| RtlWaitForWnfMetaNotification | 6.2 and higher | |
| RtlWaitOnAddress | 6.2 and higher | |
| RtlWakeAddressAll | 6.2 and higher | |
| RtlWakeAddressAllNoFence | 6.2 and higher | |
| RtlWakeAddressSingle | 6.2 and higher | |
| RtlWakeAddressSingleNoFence | 6.2 and higher | |
| RtlWakeAllConditionVariable | 6.0 and higher | |
| RtlWakeConditionVariable | 6.0 and higher | |
| RtlWalkFrameChain | 5.0 and higher | documented (WDK) |
| RtlWalkHeap | 3.51 and higher | |
| RtlWeaklyEnumerateEntryHashTable | 6.1 and higher | declared (WDK) |
| RtlWerpReportException | 6.0 and higher | |
| RtlWnfCompareChangeStamp | 6.2 and higher | |
| RtlWnfDllUnloadCallback | 6.2 and higher | |
| RtlWoW64GetCpuAreaInfo | 10.0 and higher (x64 only) | |
| RtlWoW64GetCurrentCpuArea | 10.0 and higher (x64 only) | |
| RtlWow64CallFunction64 | 6.0 and higher | |
| RtlWow64EnableFsRedirection | 5.2 and higher | |
| RtlWow64EnableFsRedirectionEx | 5.2 from Windows Server 2003 SP1, and higher | |
| RtlWow64GetThreadContext | 6.0 and higher (x64 only) | |
| RtlWow64GetThreadSelectorEntry | 6.1 and higher (x64 only) | |
| RtlWow64LogMessageInEventLogger | 6.0 and higher (x64 and wow64 only) | |
| RtlWow64SetThreadContext | 6.0 and higher (x64 only) | |
| RtlWow64SuspendThread | 6.0 and higher (x64 only) | |
| RtlWow64SuspendThreadEx | 10.0 and higher (x64 only) | |
| RtlWriteMemoryStream | 5.1 and higher; not in wow64 before 6.0 |
|
| RtlWriteRegistryValue | 3.10 and higher | documented (WDK) |
| RtlZeroHeap | 3.51 and higher | |
| RtlZeroMemory | 3.10 and higher | documented (WDK) |
| RtlZombifyActivationContext | 5.1 and higher | |
| RtlpApplyLengthFunction | 5.1 and higher | |
| RtlpCheckDynamicTimeZoneInformation | 6.0 from Windows Vista SP1, and higher | |
| RtlpCleanupRegistryKeys | 6.0 and higher | |
| RtlpConvertAbsoluteToRelativeSecurityAttribute | 6.2 and higher | |
| RtlpConvertCultureNamesToLCIDs | 6.0 and higher | |
| RtlpConvertLCIDsToCultureNames | 6.0 and higher | |
| RtlpConvertRelativeToAbsoluteSecurityAttribute | 6.2 and higher | |
| RtlpCreateProcessRegistryInfo | 6.0 and higher | |
| RtlpEnsureBufferSize | 5.1 and higher | |
| RtlpExecuteUmsThread | 6.1 and higher (x64 only) | |
| RtlpFreezeTimeBias | 6.2 and higher | |
| RtlpGetDeviceFamilyInfoEnum | 10.0 and higher | |
| RtlpGetLCIDFromLangInfoNode | 6.0 and higher | |
| RtlpGetNameFromLangInfoNode | 6.0 and higher | |
| RtlpGetSystemDefaultUILanguage | 6.0 and higher | |
| RtlpGetUserOrMachineUILanguage4NLS | 6.0 and higher | |
| RtlpInitializeLangRegistryInfo | 6.0 and higher | |
| RtlpInitializeRtl | 3.10 to 3.51 | |
| RtlpInterlockedPopEntrySeqSListEnd | 6.0 from Windows Vista SP2, and higher (wow64 only) | |
| RtlpInterlockedPopEntrySeqSListFault | 6.0 from Windows Vista SP2, and higher (wow64 only) | |
| RtlpInterlockedPopEntrySeqSListResume | 6.0 from Windows Vista SP2, and higher (wow64 only) | |
| RtlpIsQualifiedLanguage | 6.0 and higher | |
| RtlpLoadMachineUIByPolicy | 6.0 and higher | |
| RtlpLoadUserUIByPolicy | 6.0 and higher | |
| RtlpMergeSecurityAttributeInformation | 6.2 and higher | |
| RtlpMuiFreeLangRegistryInfo | 6.0 and higher | |
| RtlpMuiRegCreateRegistryInfo | 6.0 and higher | |
| RtlpMuiRegFreeRegistryInfo | 6.0 and higher | |
| RtlpMuiRegLoadRegistryInfo | 6.0 and higher | |
| RtlpNotOwnerCriticalSection | 5.1 and higher | |
| RtlpNtCreateKey | 3.10 and higher | |
| RtlpNtEnumerateSubKey | 3.10 and higher | |
| RtlpNtMakeTemporaryKey | 3.10 and higher | |
| RtlpNtOpenKey | 3.10 and higher | |
| RtlpNtQueryValueKey | 3.10 and higher | |
| RtlpNtSetValueKey | 3.10 and higher | |
| RtlpQueryDefaultUILanguage | 6.0 and higher | |
| RtlpQueryProcessDebugInformationFromWow64 | 6.0 and higher (x64 only) | |
| RtlpQueryProcessDebugInformationRemote | 6.0 and higher (wow64 only) | |
| RtlpRefreshCachedUILanguage | 6.0 and higher | |
| RtlpSetInstallLanguage | 6.0 and higher | |
| RtlpSetPreferredUILanguages | 6.0 and higher | |
| RtlpSetUserPreferredUILanguages | 6.0 and higher | |
| RtlpUmsExecuteYieldThreadEnd | 6.1 and higher (x64 only) | |
| RtlpUmsThreadYield | 6.1 and higher (x64 only) | |
| RtlpUnWaitCriticalSection | 3.10 and higher | |
| RtlpVerifyAndCommitUILanguageSettings | 6.0 and higher | |
| RtlpWaitForCriticalSection | 3.10 and higher | |
| RtlpWnfNotificationThread | 6.2 only | |
| RtlxAnsiStringToUnicodeSize | 3.51 and higher | documented (WDK) |
| RtlxOemStringToUnicodeSize | 3.51 and higher | documented (WDK) |
| RtlxUnicodeStringToAnsiSize | 3.51 and higher | documented (WDK) |
| RtlxUnicodeStringToOemSize | 3.51 and higher | documented (WDK) |
| SaveEm87Context | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| SbExecuteProcedure | 6.1 and higher | |
| SbSelectProcedure | 6.1 and higher | |
| SbtDisableForCurrentProcess (5) | 6.1 to 6.3 | |
| SbtLogDllMapping (6) | 6.1 to 6.3 | |
| SbtLogExeInitializing (7) | 6.1 to 6.3 | |
| SbtLogSystemUsageByParent (3) | 6.1 to 6.3 | |
| SbtLogSystemUsageByStack (4) | 6.1 to 6.3 | |
| ShipAssert | 6.0 and higher | |
| ShipAssertGetBufferInfo | 6.0 and higher | |
| ShipAssertMsgA | 6.0 and higher | |
| ShipAssertMsgW | 6.0 and higher | |
| TpAllocAlpcCompletion | 6.0 and higher | |
| TpAllocAlpcCompletionEx | 6.1 and higher | |
| TpAllocCleanupGroup | 6.0 and higher | |
| TpAllocIoCompletion | 6.0 and higher | |
| TpAllocJobNotification | 6.2 and higher | |
| TpAllocPool | 6.0 and higher | |
| TpAllocTimer | 6.0 and higher | |
| TpAllocWait | 6.0 and higher | |
| TpAllocWork | 6.0 and higher | |
| TpAlpcRegisterCompletionList | 6.1 and higher | |
| TpAlpcUnregisterCompletionList | 6.1 and higher | |
| TpCallbackDetectedUnrecoverableError | 6.2 and higher | |
| TpCallbackIndependent | 6.1 and higher | |
| TpCallbackLeaveCriticalSectionOnCompletion | 6.0 and higher | |
| TpCallbackMayRunLong | 6.0 and higher | |
| TpCallbackReleaseMutexOnCompletion | 6.0 and higher | |
| TpCallbackReleaseSemaphoreOnCompletion | 6.0 and higher | |
| TpCallbackSendAlpcMessageOnCompletion | 6.3 and higher | |
| TpCallbackSendPendingAlpcMessage | 6.3 and higher | |
| TpCallbackSetEventOnCompletion | 6.0 and higher | |
| TpCallbackUnloadDllOnCompletion | 6.0 and higher | |
| TpCancelAsyncIoOperation | 6.0 and higher | |
| TpCaptureCaller | 6.0 and higher | |
| TpCheckTerminateWorker | 6.0 and higher | |
| TpDbgDumpHeapUsage | 6.0 and higher | |
| TpDbgGetFreeInfo | 6.1 only | |
| TpDbgSetLogRoutine | 6.0 and higher | |
| TpDisablePoolCallbackChecks | 6.1 and higher | |
| TpDisassociateCallback | 6.0 and higher | |
| TpIsTimerSet | 6.0 and higher | |
| TpPoolFreeUnusedNodes | 6.1 only | |
| TpPostWork | 6.0 and higher | |
| TpQueryPoolStackInformation | 6.1 and higher | |
| TpReleaseAlpcCompletion | 6.0 and higher | |
| TpReleaseCleanupGroup | 6.0 and higher | |
| TpReleaseCleanupGroupMembers | 6.0 and higher | |
| TpReleaseIoCompletion | 6.0 and higher | |
| TpReleaseJobNotification | 6.2 and higher | |
| TpReleasePool | 6.0 and higher | |
| TpReleaseTimer | 6.0 and higher | |
| TpReleaseWait | 6.0 and higher | |
| TpReleaseWork | 6.0 and higher | |
| TpSetDefaultPoolMaxThreads | 6.1 and higher | |
| TpSetDefaultPoolStackInformation | 6.1 and higher | |
| TpSetPoolMaxThreads | 6.0 and higher | |
| TpSetPoolMaxThreadsSoftLimit | 10.0 and higher | |
| TpSetPoolMinThreads | 6.0 and higher | |
| TpSetPoolStackInformation | 6.1 and higher | |
| TpSetPoolThreadBasePriority | 6.2 and higher | |
| TpSetPoolWorkerThreadIdleTimeout | 10.0 and higher | |
| TpSetTimer | 6.0 and higher | |
| TpSetTimerEx | 6.2 and higher | |
| TpSetWait | 6.0 and higher | |
| TpSetWaitEx | 6.2 and higher | |
| TpSimpleTryPost | 6.0 and higher | |
| TpStartAsyncIoOperation | 6.0 and higher | |
| TpTimerOutstandingCallbackCount | 6.2 and higher | |
| TpTrimPools | 6.3 from Windows 8.1 With Update, and higher | |
| TpWaitForAlpcCompletion | 6.0 and higher | |
| TpWaitForIoCompletion | 6.0 and higher | |
| TpWaitForJobNotification | 6.2 and higher | |
| TpWaitForTimer | 6.0 and higher | |
| TpWaitForWait | 6.0 and higher | |
| TpWaitForWork | 6.0 and higher | |
| VerSetConditionMask | 5.0 and higher | documented (KERNEL32) |
| WerCheckEventEscalation | 6.0 only | |
| WerReportSQMEvent | 6.0 and higher | |
| WerReportWatsonEvent | 6.0 only | |
| WinSqmAddToAverageDWORD | 6.1 and higher | |
| WinSqmAddToStream | 6.0 and higher | |
| WinSqmAddToStreamEx | 6.1 and higher | |
| WinSqmCheckEscalationAddToStreamEx | 6.1 and higher | |
| WinSqmCheckEscalationSetDWORD | 6.1 and higher | |
| WinSqmCheckEscalationSetDWORD64 | 6.1 and higher | |
| WinSqmCheckEscalationSetString | 6.1 and higher | |
| WinSqmCommonDatapointDelete | 6.1 and higher | |
| WinSqmCommonDatapointSetDWORD | 6.1 and higher | |
| WinSqmCommonDatapointSetDWORD64 | 6.1 and higher | |
| WinSqmCommonDatapointSetStreamEx | 6.1 and higher | |
| WinSqmCommonDatapointSetString | 6.1 and higher | |
| WinSqmEndSession | 6.0 and higher | |
| WinSqmEventEnabled | 6.0 and higher | |
| WinSqmEventWrite | 6.0 and higher | |
| WinSqmGetEscalationRuleStatus | 6.1 and higher | |
| WinSqmGetInstrumentationProperty | 6.1 and higher | |
| WinSqmIncrementDWORD | 6.1 and higher | |
| WinSqmIsOptedIn | 6.0 and higher | |
| WinSqmIsOptedInEx | 6.1 and higher | |
| WinSqmIsSessionDisabled | 6.2 and higher | |
| WinSqmSetDWORD | 6.1 and higher | |
| WinSqmSetDWORD64 | 6.1 and higher | |
| WinSqmSetEscalationInfo | 6.1 and higher | |
| WinSqmSetIfMaxDWORD | 6.1 and higher | |
| WinSqmSetIfMinDWORD | 6.1 and higher | |
| WinSqmSetString | 6.0 and higher | |
| WinSqmStartSession | 6.0 and higher | |
| WinSqmStartSessionForPartner | 6.3 and higher | |
| WinSqmStartSqmOptinListener | 10.0 and higher | |
| ZwAcceptConnectPort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwAccessCheck | 3.10 and higher | declared (Windows 10 WDK) |
| ZwAccessCheckAndAuditAlarm | 3.10 and higher | declared (Windows 10 WDK) |
| ZwAccessCheckByType | 5.0 and higher | declared (Windows 10 WDK) |
| ZwAccessCheckByTypeAndAuditAlarm | 5.0 and higher | declared (Windows 10 WDK) |
| ZwAccessCheckByTypeResultList | 5.0 and higher | declared (Windows 10 WDK) |
| ZwAccessCheckByTypeResultListAndAuditAlarm | 5.0 and higher | declared (Windows 10 WDK) |
| ZwAccessCheckByTypeResultListAndAuditAlarmByHandle | 5.0 and higher | declared (Windows 10 WDK) |
| ZwAcquireCMFViewOwnership | 6.0 only | |
| ZwAddAtom | 4.0 and higher | declared (Windows 10 WDK) |
| ZwAddAtomEx | 6.2 and higher | |
| ZwAddBootEntry | 5.1 and higher | declared (Windows 10 WDK) |
| ZwAddDriverEntry | 5.2 and higher | declared (Windows 10 WDK) |
| ZwAdjustGroupsToken | 3.10 and higher | declared (Windows 10 WDK) |
| ZwAdjustPrivilegesToken | 3.10 and higher | declared (Windows 10 WDK) |
| ZwAdjustTokenClaimsAndDeviceGroups | 6.2 and higher | declared (Windows 10 WDK) |
| ZwAlertResumeThread | 3.10 and higher | declared (Windows 10 WDK) |
| ZwAlertThread | 3.10 and higher | declared (Windows 10 WDK) |
| ZwAlertThreadByThreadId | 6.2 and higher | |
| ZwAllocateLocallyUniqueId | 3.10 and higher | documented (WDK) |
| ZwAllocateReserveObject | 6.1 and higher | declared (Windows 10 WDK) |
| ZwAllocateUserPhysicalPages | 5.0 and higher | declared (Windows 10 WDK) |
| ZwAllocateUuids | 3.51 and higher | declared (Windows 10 WDK) |
| ZwAllocateVirtualMemory | 3.10 and higher | documented (WDK) |
| ZwAlpcAcceptConnectPort | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcCancelMessage | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcConnectPort | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcConnectPortEx | 6.2 and higher | declared (Windows 10 WDK) |
| ZwAlpcCreatePort | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcCreatePortSection | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcCreateResourceReserve | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcCreateSectionView | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcCreateSecurityContext | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcDeletePortSection | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcDeleteResourceReserve | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcDeleteSectionView | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcDeleteSecurityContext | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcDisconnectPort | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcImpersonateClientContainerOfPort | 10.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcImpersonateClientOfPort | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcOpenSenderProcess | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcOpenSenderThread | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcQueryInformation | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcQueryInformationMessage | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcRevokeSecurityContext | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcSendWaitReceivePort | 6.0 and higher | declared (Windows 10 WDK) |
| ZwAlpcSetInformation | 6.0 and higher | declared (Windows 10 WDK) |
| ZwApphelpCacheControl | 5.2 and higher | |
| ZwAreMappedFilesTheSame | 5.0 and higher | declared (Windows 10 WDK) |
| ZwAssignProcessToJobObject | 5.0 and higher | declared (Windows 10 WDK) |
| ZwAssociateWaitCompletionPacket | 6.2 and higher | declared (Windows 10 WDK) |
| ZwCallbackReturn | 3.51 and higher | declared (Windows 10 WDK) |
| ZwCancelDeviceWakeupRequest | 5.0 to 6.0 | |
| ZwCancelIoFile | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCancelIoFileEx | 6.0 and higher | declared (Windows 10 WDK) |
| ZwCancelSynchronousIoFile | 6.0 and higher | declared (Windows 10 WDK) |
| ZwCancelTimer | 3.10 and higher | documented (WDK) |
| ZwCancelTimer2 | 6.3 and higher | declared (Windows 10 WDK) |
| ZwCancelWaitCompletionPacket | 6.2 and higher | declared (Windows 10 WDK) |
| ZwClearAllSavepointsTransaction | 6.0 before Windows Vista SP1 | |
| ZwClearEvent | 3.51 and higher | declared (Windows 10 WDK) |
| ZwClearSavepointTransaction | 6.0 before Windows Vista SP1 | |
| ZwClose | 3.10 and higher | documented (WDK) |
| ZwCloseObjectAuditAlarm | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCommitComplete | 6.0 and higher | documented (WDK) |
| ZwCommitEnlistment | 6.0 and higher | documented (WDK) |
| ZwCommitTransaction | 6.0 and higher | documented (WDK) |
| ZwCompactKeys | 5.1 and higher | declared (Windows 10 WDK) |
| ZwCompareObjects | 10.0 and higher | declared (Windows 10 WDK) |
| ZwCompareTokens | 5.1 and higher | declared (Windows 10 WDK) |
| ZwCompleteConnectPort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCompressKey | 5.1 and higher | declared (Windows 10 WDK) |
| ZwConnectPort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwContinue | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreateChannel | 4.0 to 5.0 | |
| ZwCreateDebugObject | 5.1 and higher | |
| ZwCreateDirectoryObject | 3.10 and higher | documented (WDK) |
| ZwCreateDirectoryObjectEx | 6.2 and higher | declared (Windows 10 WDK) |
| ZwCreateEnlistment | 6.0 and higher | documented (WDK) |
| ZwCreateEvent | 3.10 and higher | documented (WDK) |
| ZwCreateEventPair | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreateFile | 3.10 and higher | documented (WDK) |
| ZwCreateIRTimer | 6.2 and higher | declared (Windows 10 WDK) |
| ZwCreateIoCompletion | 3.51 and higher | declared (Windows 10 WDK) |
| ZwCreateJobObject | 5.0 and higher | declared (Windows 10 WDK) |
| ZwCreateJobSet | 5.1 and higher | declared (Windows 10 WDK) |
| ZwCreateKey | 3.10 and higher | documented (WDK) |
| ZwCreateKeyTransacted | 6.0 and higher | documented (WDK) |
| ZwCreateKeyedEvent | 5.1 and higher | declared (Windows 10 WDK) |
| ZwCreateLowBoxToken | 6.2 and higher | declared (Windows 10 WDK) |
| ZwCreateMailslotFile | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreateMutant | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreateNamedPipeFile | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreatePagingFile | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreatePartition | 10.0 and higher | declared (Windows 10 WDK) |
| ZwCreatePort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreatePrivateNamespace | 6.0 and higher | declared (Windows 10 WDK) |
| ZwCreateProcess | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreateProcessEx | 5.1 and higher | declared (Windows 10 WDK) |
| ZwCreateProfile | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreateProfileEx | 6.1 and higher | declared (Windows 10 WDK) |
| ZwCreateResourceManager | 6.0 and higher | documented (WDK) |
| ZwCreateSection | 3.10 and higher | documented (WDK) |
| ZwCreateSemaphore | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreateSymbolicLinkObject | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreateThread | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreateThreadEx | 6.0 and higher | declared (Windows 10 WDK) |
| ZwCreateTimer | 3.10 and higher | documented (WDK) |
| ZwCreateTimer2 | 6.3 and higher | declared (Windows 10 WDK) |
| ZwCreateToken | 3.10 and higher | declared (Windows 10 WDK) |
| ZwCreateTokenEx | 6.2 and higher | declared (Windows 10 WDK) |
| ZwCreateTransaction | 6.0 and higher | documented (WDK) |
| ZwCreateTransactionManager | 6.0 and higher | documented (WDK) |
| ZwCreateUserProcess | 6.0 and higher | declared (Windows 10 WDK) |
| ZwCreateWaitCompletionPacket | 6.2 and higher | declared (Windows 10 WDK) |
| ZwCreateWaitablePort | 5.0 and higher | declared (Windows 10 WDK) |
| ZwCreateWnfStateName | 6.2 and higher | declared (Windows 10 WDK) |
| ZwCreateWorkerFactory | 6.0 and higher | |
| ZwDebugActiveProcess | 5.1 and higher | |
| ZwDebugContinue | 5.1 and higher | |
| ZwDelayExecution | 3.10 and higher | |
| ZwDeleteAtom | 4.0 and higher | declared (Windows 10 WDK) |
| ZwDeleteBootEntry | 5.1 and higher | declared (Windows 10 WDK) |
| ZwDeleteDriverEntry | 5.2 and higher | declared (Windows 10 WDK) |
| ZwDeleteFile | 3.51 and higher | documented (WDK) |
| ZwDeleteKey | 3.10 and higher | documented (WDK) |
| ZwDeleteObjectAuditAlarm | 4.0 and higher | declared (Windows 10 WDK) |
| ZwDeletePrivateNamespace | 6.0 and higher | declared (Windows 10 WDK) |
| ZwDeleteValueKey | 3.10 and higher | documented (WDK) |
| ZwDeleteWnfStateData | 6.2 and higher | declared (Windows 10 WDK) |
| ZwDeleteWnfStateName | 6.2 and higher | declared (Windows 10 WDK) |
| ZwDeviceIoControlFile | 3.10 and higher | documented (WDK) |
| ZwDisableLastKnownGood | 6.1 and higher | declared (Windows 10 WDK) |
| ZwDisplayString | 3.10 and higher | declared (WDK) |
| ZwDrawText | 6.1 and higher | declared (Windows 10 WDK) |
| ZwDuplicateObject | 3.10 and higher | documented (WDK) |
| ZwDuplicateToken | 3.10 and higher | documented (WDK) |
| ZwEnableLastKnownGood | 6.1 and higher | declared (Windows 10 WDK) |
| ZwEnumerateBootEntries | 5.1 and higher | declared (Windows 10 WDK) |
| ZwEnumerateBus | 3.51 only | |
| ZwEnumerateDriverEntries | 5.2 and higher | declared (Windows 10 WDK) |
| ZwEnumerateKey | 3.10 and higher | documented (WDK) |
| ZwEnumerateSystemEnvironmentValuesEx | 5.1 and higher | declared (Windows 10 WDK) |
| ZwEnumerateTransactionObject | 6.0 and higher | documented (WDK) |
| ZwEnumerateValueKey | 3.10 and higher | documented (WDK) |
| ZwExtendSection | 3.10 and higher | declared (Windows 10 WDK) |
| ZwFilterBootOption | 6.2 and higher | declared (Windows 10 WDK) |
| ZwFilterToken | 5.0 and higher | declared (Windows 10 WDK) |
| ZwFilterTokenEx | 6.2 and higher | declared (Windows 10 WDK) |
| ZwFindAtom | 4.0 and higher | declared (Windows 10 WDK) |
| ZwFlushBuffersFile | 3.10 and higher | documented (WDK) |
| ZwFlushBuffersFileEx | 6.2 and higher | documented (WDK) |
| ZwFlushInstallUILanguage | 6.0 and higher | declared (Windows 10 WDK) |
| ZwFlushInstructionCache | 3.10 and higher | declared (Windows 10 WDK) |
| ZwFlushKey | 3.10 and higher | documented (WDK) |
| ZwFlushProcessWriteBuffers | 6.0 and higher | declared (Windows 10 WDK) |
| ZwFlushVirtualMemory | 3.10 and higher | documented (WDK) |
| ZwFlushWriteBuffer | 3.10 and higher | declared (Windows 10 WDK) |
| ZwFreeUserPhysicalPages | 5.0 and higher | declared (Windows 10 WDK) |
| ZwFreeVirtualMemory | 3.10 and higher | documented (WDK) |
| ZwFreezeRegistry | 6.0 and higher | declared (Windows 10 WDK) |
| ZwFreezeTransactions | 6.0 and higher | declared (Windows 10 WDK) |
| ZwFsControlFile | 3.10 and higher | documented (WDK) |
| ZwGetCachedSigningLevel | 6.2 and higher | declared (Windows 10 WDK) |
| ZwGetCompleteWnfStateSubscription | 6.3 and higher | declared (Windows 10 WDK) |
| ZwGetContextThread | 3.51 and higher | declared (Windows 10 WDK) |
| ZwGetCurrentProcessorNumber | 5.2 and higher | declared (Windows 10 WDK) |
| ZwGetCurrentProcessorNumberEx | 10.0 and higher | declared (Windows 10 WDK) |
| ZwGetDevicePowerState | 5.0 and higher | declared (Windows 10 WDK) |
| ZwGetMUIRegistryInfo | 6.0 and higher | declared (Windows 10 WDK) |
| ZwGetNextProcess | 6.0 and higher | declared (Windows 10 WDK) |
| ZwGetNextThread | 6.0 and higher | declared (Windows 10 WDK) |
| ZwGetNlsSectionPtr | 6.0 and higher | declared (Windows 10 WDK) |
| ZwGetNotificationResourceManager | 6.0 and higher | documented (WDK) |
| ZwGetPlugPlayEvent | 3.51 to 6.1 | declared (Windows 10 WDK) |
| ZwGetTickCount | 3.10 to 5.0 | declared (Windows 10 WDK) |
| ZwGetWriteWatch | 5.0 and higher | declared (Windows 10 WDK) |
| ZwImpersonateAnonymousToken | 5.0 and higher | declared (Windows 10 WDK) |
| ZwImpersonateClientOfPort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwImpersonateThread | 3.10 and higher | declared (Windows 10 WDK) |
| ZwInitializeNlsFiles | 6.0 and higher | declared (Windows 10 WDK) |
| ZwInitializeRegistry | 3.10 and higher | declared (Windows 10 WDK) |
| ZwInitializeVDM | 3.10 only | |
| ZwInitiatePowerAction | 5.0 and higher | declared (Windows 10 WDK) |
| ZwIsProcessInJob | 5.1 and higher | declared (Windows 10 WDK) |
| ZwIsSystemResumeAutomatic | 5.0 and higher | |
| ZwIsUILanguageComitted | 6.0 and higher | declared (Windows 10 WDK) |
| ZwListTransactions | 6.0 before Windows Vista SP1 | |
| ZwListenChannel | 4.0 to 5.0 | |
| ZwListenPort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwLoadDriver | 3.10 and higher | documented (WDK) |
| ZwLoadKey | 3.10 and higher | declared (Windows 10 WDK) |
| ZwLoadKey2 | 4.0 and higher | declared (Windows 10 WDK) |
| ZwLoadKeyEx | 5.2 and higher | declared (Windows 10 WDK) |
| ZwLockFile | 3.10 and higher | documented (WDK) |
| ZwLockProductActivationKeys | 5.1 and higher | declared (Windows 10 WDK) |
| ZwLockRegistryKey | 5.1 and higher | declared (Windows 10 WDK) |
| ZwLockVirtualMemory | 3.10 and higher | declared (Windows 10 WDK) |
| ZwMakePermanentObject | 5.1 and higher | declared (Windows 10 WDK) |
| ZwMakeTemporaryObject | 3.10 and higher | documented (WDK) |
| ZwManagePartition | 10.0 and higher | declared (Windows 10 WDK) |
| ZwMapCMFModule | 6.0 and higher | declared (Windows 10 WDK) |
| ZwMapUserPhysicalPages | 5.0 and higher | declared (Windows 10 WDK) |
| ZwMapUserPhysicalPagesScatter | 5.0 and higher | declared (Windows 10 WDK) |
| ZwMapViewOfSection | 3.10 and higher | documented (WDK) |
| ZwMarshallTransaction | 6.0 before Windows Vista SP1 | |
| ZwModifyBootEntry | 5.1 and higher | declared (Windows 10 WDK) |
| ZwModifyDriverEntry | 5.2 and higher | declared (Windows 10 WDK) |
| ZwNotifyChangeDirectoryFile | 3.10 and higher | declared (Windows 10 WDK) |
| ZwNotifyChangeKey | 3.10 and higher | documented (WDK) |
| ZwNotifyChangeMultipleKeys | 5.0 and higher | declared (WDK) |
| ZwNotifyChangeSession | 6.1 and higher | declared (Windows 10 WDK) |
| ZwOpenChannel | 4.0 to 5.0 | |
| ZwOpenDirectoryObject | 3.10 and higher | documented (WDK) |
| ZwOpenEnlistment | 6.0 and higher | documented (WDK) |
| ZwOpenEvent | 3.10 and higher | documented (WDK) |
| ZwOpenEventPair | 3.10 and higher | declared (Windows 10 WDK) |
| ZwOpenFile | 3.10 and higher | documented (WDK) |
| ZwOpenIoCompletion | 3.51 and higher | declared (Windows 10 WDK) |
| ZwOpenJobObject | 5.0 and higher | declared (Windows 10 WDK) |
| ZwOpenKey | 3.10 and higher | documented (WDK) |
| ZwOpenKeyEx | 6.1 and higher | documented (WDK) |
| ZwOpenKeyTransacted | 6.0 and higher | documented (WDK) |
| ZwOpenKeyTransactedEx | 6.1 and higher | documented (WDK) |
| ZwOpenKeyedEvent | 5.1 and higher | declared (Windows 10 WDK) |
| ZwOpenMutant | 3.10 and higher | declared (Windows 10 WDK) |
| ZwOpenObjectAuditAlarm | 3.10 and higher | declared (Windows 10 WDK) |
| ZwOpenPartition | 10.0 and higher | declared (Windows 10 WDK) |
| ZwOpenPrivateNamespace | 6.0 and higher | declared (Windows 10 WDK) |
| ZwOpenProcess | 3.10 and higher | documented (WDK) |
| ZwOpenProcessToken | 3.10 and higher | declared (Windows 10 WDK) |
| ZwOpenProcessTokenEx | 5.1 and higher | documented (WDK) |
| ZwOpenResourceManager | 6.0 and higher | documented (WDK) |
| ZwOpenSection | 3.10 and higher | documented (WDK) |
| ZwOpenSemaphore | 3.10 and higher | declared (Windows 10 WDK) |
| ZwOpenSession | 6.0 and higher | declared (Windows 10 WDK) |
| ZwOpenSymbolicLinkObject | 3.10 and higher | documented (WDK) |
| ZwOpenThread | 3.10 and higher | declared (Windows 10 WDK) |
| ZwOpenThreadToken | 3.10 and higher | declared (Windows 10 WDK) |
| ZwOpenThreadTokenEx | 5.1 and higher | documented (WDK) |
| ZwOpenTimer | 3.10 and higher | documented (WDK) |
| ZwOpenTransaction | 6.0 and higher | documented (WDK) |
| ZwOpenTransactionManager | 6.0 and higher | documented (WDK) |
| ZwPlugPlayControl | 3.51 and higher | declared (Windows 10 WDK) |
| ZwPowerInformation | 5.0 and higher | declared (WDK) |
| ZwPrePrepareComplete | 6.0 and higher | documented (WDK) |
| ZwPrePrepareEnlistment | 6.0 and higher | documented (WDK) |
| ZwPrepareComplete | 6.0 and higher | documented (WDK) |
| ZwPrepareEnlistment | 6.0 and higher | documented (WDK) |
| ZwPrivilegeCheck | 3.10 and higher | declared (Windows 10 WDK) |
| ZwPrivilegeObjectAuditAlarm | 3.10 and higher | declared (Windows 10 WDK) |
| ZwPrivilegedServiceAuditAlarm | 3.10 and higher | declared (Windows 10 WDK) |
| ZwPropagationComplete | 6.0 and higher | declared (Windows 10 WDK) |
| ZwPropagationFailed | 6.0 and higher | declared (Windows 10 WDK) |
| ZwProtectVirtualMemory | 3.10 and higher | declared (Windows 10 WDK) |
| ZwPullTransaction | 6.0 before Windows Vista SP1 | |
| ZwPulseEvent | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryAttributesFile | 3.51 and higher | declared (Windows 10 WDK) |
| ZwQueryBootEntryOrder | 5.1 and higher | declared (Windows 10 WDK) |
| ZwQueryBootOptions | 5.1 and higher | declared (Windows 10 WDK) |
| ZwQueryDebugFilterState | 5.1 and higher | declared (Windows 10 WDK) |
| ZwQueryDefaultLocale | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryDefaultUILanguage | 5.0 and higher | declared (Windows 10 WDK) |
| ZwQueryDirectoryFile | 3.10 and higher | documented (WDK) |
| ZwQueryDirectoryObject | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryDriverEntryOrder | 5.2 and higher | declared (Windows 10 WDK) |
| ZwQueryEaFile | 3.10 and higher | declared (WDK) |
| ZwQueryEvent | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryFullAttributesFile | 4.0 and higher | documented (WDK) |
| ZwQueryInformationAtom | 4.0 and higher | declared (Windows 10 WDK) |
| ZwQueryInformationEnlistment | 6.0 and higher | documented (WDK) |
| ZwQueryInformationFile | 3.10 and higher | documented (WDK) |
| ZwQueryInformationJobObject | 5.0 and higher | declared (Windows 10 WDK) |
| ZwQueryInformationPort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryInformationProcess | 3.10 and higher | documented |
| ZwQueryInformationResourceManager | 6.0 and higher | documented (WDK) |
| ZwQueryInformationThread | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryInformationToken | 3.10 and higher | documented (WDK) |
| ZwQueryInformationTransaction | 6.0 and higher | documented (WDK) |
| ZwQueryInformationTransactionManager | 6.0 and higher | documented (WDK) |
| ZwQueryInformationWorkerFactory | 6.0 and higher | |
| ZwQueryInstallUILanguage | 5.0 and higher | declared (Windows 10 WDK) |
| ZwQueryIntervalProfile | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryIoCompletion | 3.51 and higher | declared (Windows 10 WDK) |
| ZwQueryKey | 3.10 and higher | documented (WDK) |
| ZwQueryLicenseValue | 6.0 and higher | declared (Windows 10 WDK) |
| ZwQueryMultipleValueKey | 4.0 and higher | declared (WDK) |
| ZwQueryMutant | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryObject | 3.10 and higher | documented (WDK) |
| ZwQueryOleDirectoryFile | 4.0 only | |
| ZwQueryOpenSubKeys | 5.0 and higher | declared (Windows 10 WDK) |
| ZwQueryOpenSubKeysEx | 5.2 and higher | declared (Windows 10 WDK) |
| ZwQueryPerformanceCounter | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryPortInformationProcess | 5.1 and higher | declared (Windows 10 WDK) |
| ZwQueryQuotaInformationFile | 5.0 and higher | documented (WDK) |
| ZwQuerySection | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQuerySecurityAttributesToken | 6.1 and higher | |
| ZwQuerySecurityObject | 3.10 and higher | documented (WDK) |
| ZwQuerySemaphore | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQuerySymbolicLinkObject | 3.10 and higher | documented (WDK) |
| ZwQuerySystemEnvironmentValue | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQuerySystemEnvironmentValueEx | 5.1 and higher | declared (Windows 10 WDK) |
| ZwQuerySystemInformation | 3.10 and higher | documented |
| ZwQuerySystemInformationEx | 6.1 and higher | declared (Windows 10 WDK) |
| ZwQuerySystemTime | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryTimer | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryTimerResolution | 3.51 and higher | declared (Windows 10 WDK) |
| ZwQueryValueKey | 3.10 and higher | documented (WDK) |
| ZwQueryVirtualMemory | 3.10 and higher | declared (Windows 10 WDK) |
| ZwQueryVolumeInformationFile | 3.10 and higher | documented (WDK) |
| ZwQueryWnfStateData | 6.2 and higher | declared (Windows 10 WDK) |
| ZwQueryWnfStateNameInformation | 6.2 and higher | declared (Windows 10 WDK) |
| ZwQueueApcThread | 4.0 and higher | declared (Windows 10 WDK) |
| ZwQueueApcThreadEx | 6.1 and higher | declared (Windows 10 WDK) |
| ZwRaiseException | 3.10 and higher | declared (Windows 10 WDK) |
| ZwRaiseHardError | 3.10 and higher | declared (Windows 10 WDK) |
| ZwReadFile | 3.10 and higher | documented (WDK) |
| ZwReadFileScatter | 4.0 from Windows NT 4.0 SP3, and higher | declared (Windows 10 WDK) |
| ZwReadOnlyEnlistment | 6.0 and higher | documented (WDK) |
| ZwReadRequestData | 3.10 and higher | declared (Windows 10 WDK) |
| ZwReadVirtualMemory | 3.10 and higher | declared (Windows 10 WDK) |
| ZwRecoverEnlistment | 6.0 and higher | documented (WDK) |
| ZwRecoverResourceManager | 6.0 and higher | documented (WDK) |
| ZwRecoverTransactionManager | 6.0 and higher | documented (WDK) |
| ZwRegisterNewDevice | 3.51 only | |
| ZwRegisterProtocolAddressInformation | 6.0 and higher | declared (Windows 10 WDK) |
| ZwRegisterThreadTerminatePort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwReleaseCMFViewOwnership | 6.0 only | |
| ZwReleaseKeyedEvent | 5.1 and higher | declared (Windows 10 WDK) |
| ZwReleaseMutant | 3.10 and higher | declared (Windows 10 WDK) |
| ZwReleaseProcessMutant | 3.10 to 3.51 | |
| ZwReleaseSemaphore | 3.10 and higher | declared (Windows 10 WDK) |
| ZwReleaseWorkerFactoryWorker | 6.0 and higher | |
| ZwRemoveIoCompletion | 3.51 and higher | declared (Windows 10 WDK) |
| ZwRemoveIoCompletionEx | 6.0 and higher | declared (Windows 10 WDK) |
| ZwRemoveProcessDebug | 5.1 and higher | |
| ZwRenameKey | 5.1 and higher | declared (WDK) |
| ZwRenameTransactionManager | 6.0 from Windows Vista SP1, and higher | declared (Windows 10 WDK) |
| ZwRenameValueKey | 3.10 only | |
| ZwReplaceKey | 3.10 and higher | declared (Windows 10 WDK) |
| ZwReplacePartitionUnit | 6.0 from Windows Vista SP1, and higher | declared (Windows 10 WDK) |
| ZwReplyPort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwReplyWaitReceivePort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwReplyWaitReceivePortEx | 5.0 and higher | declared (Windows 10 WDK) |
| ZwReplyWaitReplyPort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwReplyWaitSendChannel | 4.0 to 5.0 | |
| ZwRequestDeviceWakeup | 5.0 to 6.0 | |
| ZwRequestPort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwRequestWaitReplyPort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwRequestWakeupLatency | 5.0 to 6.0 | |
| ZwResetEvent | 3.10 and higher | declared (Windows 10 WDK) |
| ZwResetWriteWatch | 5.0 and higher | declared (Windows 10 WDK) |
| ZwRestoreKey | 3.10 and higher | declared (Windows 10 WDK) |
| ZwResumeProcess | 5.1 and higher | declared (Windows 10 WDK) |
| ZwResumeThread | 3.10 and higher | declared (Windows 10 WDK) |
| ZwRevertContainerImpersonation | 10.0 and higher | declared (Windows 10 WDK) |
| ZwRollbackComplete | 6.0 and higher | documented (WDK) |
| ZwRollbackEnlistment | 6.0 and higher | documented (WDK) |
| ZwRollbackSavepointTransaction | 6.0 before Windows Vista SP1 | |
| ZwRollbackTransaction | 6.0 and higher | documented (WDK) |
| ZwRollforwardTransactionManager | 6.0 and higher | documented (WDK) |
| ZwSaveKey | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSaveKeyEx | 5.1 and higher | declared (Windows 10 WDK) |
| ZwSaveMergedKeys | 5.0 and higher | declared (Windows 10 WDK) |
| ZwSavepointComplete | 6.0 before Windows Vista SP1 | |
| ZwSavepointTransaction | 6.0 before Windows Vista SP1 | |
| ZwSecureConnectPort | 5.0 and higher | declared (Windows 10 WDK) |
| ZwSendWaitReplyChannel | 4.0 to 5.0 | |
| ZwSerializeBoot | 6.1 and higher | declared (Windows 10 WDK) |
| ZwSetBootEntryOrder | 5.1 and higher | declared (Windows 10 WDK) |
| ZwSetBootOptions | 5.1 and higher | declared (Windows 10 WDK) |
| ZwSetCachedSigningLevel | 6.2 and higher | declared (Windows 10 WDK) |
| ZwSetContextChannel | 4.0 to 5.0 | |
| ZwSetContextThread | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetDebugFilterState | 5.1 and higher | declared (Windows 10 WDK) |
| ZwSetDefaultHardErrorPort | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetDefaultLocale | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetDefaultUILanguage | 5.0 and higher | declared (Windows 10 WDK) |
| ZwSetDriverEntryOrder | 5.2 and higher | declared (Windows 10 WDK) |
| ZwSetEaFile | 3.10 and higher | declared (WDK) |
| ZwSetEvent | 3.10 and higher | documented (WDK) |
| ZwSetEventBoostPriority | 5.1 and higher | declared (Windows 10 WDK) |
| ZwSetHighEventPair | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetHighWaitLowEventPair | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetHighWaitLowThread | 3.10 to 4.0 | |
| ZwSetIRTimer | 6.2 and higher | declared (Windows 10 WDK) |
| ZwSetInformationDebugObject | 5.1 and higher | |
| ZwSetInformationEnlistment | 6.0 and higher | documented (WDK) |
| ZwSetInformationFile | 3.10 and higher | documented (WDK) |
| ZwSetInformationJobObject | 5.0 and higher | declared (Windows 10 WDK) |
| ZwSetInformationKey | 3.10 and higher | declared (WDK) |
| ZwSetInformationObject | 3.51 and higher | declared (Windows 10 WDK) |
| ZwSetInformationProcess | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetInformationResourceManager | 6.0 and higher | documented (WDK) |
| ZwSetInformationSymbolicLink | 10.0 and higher | declared (Windows 10 WDK) |
| ZwSetInformationThread | 3.10 and higher | documented (WDK) |
| ZwSetInformationToken | 3.10 and higher | documented (WDK) |
| ZwSetInformationTransaction | 6.0 and higher | documented (WDK) |
| ZwSetInformationTransactionManager | 6.0 and higher | declared (WDK) |
| ZwSetInformationVirtualMemory | 6.2 and higher | documented (WDK) |
| ZwSetInformationWorkerFactory | 6.0 and higher | |
| ZwSetIntervalProfile | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetIoCompletion | 3.51 and higher | declared (Windows 10 WDK) |
| ZwSetIoCompletionEx | 6.1 and higher | declared (Windows 10 WDK) |
| ZwSetLdtEntries | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetLowEventPair | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetLowWaitHighEventPair | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetLowWaitHighThread | 3.10 to 4.0 | |
| ZwSetQuotaInformationFile | 5.0 and higher | documented (WDK) |
| ZwSetSecurityObject | 3.10 and higher | documented (WDK) |
| ZwSetSystemEnvironmentValue | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetSystemEnvironmentValueEx | 5.1 and higher | declared (Windows 10 WDK) |
| ZwSetSystemInformation | 3.51 and higher | declared (Windows 10 WDK) |
| ZwSetSystemPowerState | 3.51 and higher | declared (Windows 10 WDK) |
| ZwSetSystemTime | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSetThreadExecutionState | 5.0 and higher | declared (Windows 10 WDK) |
| ZwSetTimer | 3.10 and higher | documented (WDK) |
| ZwSetTimer2 | 6.3 and higher | declared (Windows 10 WDK) |
| ZwSetTimerEx | 6.1 and higher | declared (WDK) |
| ZwSetTimerResolution | 3.51 and higher | declared (Windows 10 WDK) |
| ZwSetUuidSeed | 5.0 and higher | declared (Windows 10 WDK) |
| ZwSetValueKey | 3.10 and higher | documented (WDK) |
| ZwSetVolumeInformationFile | 3.10 and higher | documented (WDK) |
| ZwSetWnfProcessNotificationEvent | 6.3 and higher | declared (Windows 10 WDK) |
| ZwShutdownSystem | 3.10 and higher | declared (Windows 10 WDK) |
| ZwShutdownWorkerFactory | 6.0 and higher | |
| ZwSignalAndWaitForSingleObject | 4.0 and higher | declared (Windows 10 WDK) |
| ZwSinglePhaseReject | 6.0 and higher | documented (WDK) |
| ZwStartProfile | 3.10 and higher | declared (Windows 10 WDK) |
| ZwStartTm | 6.0 before Windows Vista SP1 | |
| ZwStopProfile | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSubscribeWnfStateChange | 6.2 and higher | declared (Windows 10 WDK) |
| ZwSuspendProcess | 5.1 and higher | declared (Windows 10 WDK) |
| ZwSuspendThread | 3.10 and higher | declared (Windows 10 WDK) |
| ZwSystemDebugControl | 3.10 and higher | declared (Windows 10 WDK) |
| ZwTerminateJobObject | 5.0 and higher | declared (Windows 10 WDK) |
| ZwTerminateProcess | 3.10 and higher | documented (WDK) |
| ZwTerminateThread | 3.10 and higher | declared (Windows 10 WDK) |
| ZwTestAlert | 3.10 and higher | declared (Windows 10 WDK) |
| ZwThawRegistry | 6.0 and higher | |
| ZwThawTransactions | 6.0 and higher | declared (Windows 10 WDK) |
| ZwTraceControl | 6.0 and higher | declared (Windows 10 WDK) |
| ZwTraceEvent | 5.1 and higher | declared (Windows 10 WDK) |
| ZwTranslateFilePath | 5.1 and higher | declared (Windows 10 WDK) |
| ZwUmsThreadYield | 6.1 and higher | declared (Windows 10 WDK) |
| ZwUnloadDriver | 3.10 and higher | documented (WDK) |
| ZwUnloadKey | 3.10 and higher | declared (Windows 10 WDK) |
| ZwUnloadKey2 | 5.2 and higher | declared (Windows 10 WDK) |
| ZwUnloadKeyEx | 5.1 and higher | declared (Windows 10 WDK) |
| ZwUnlockFile | 3.10 and higher | documented (WDK) |
| ZwUnlockVirtualMemory | 3.10 and higher | declared (Windows 10 WDK) |
| ZwUnmapViewOfSection | 3.10 and higher | documented (WDK) |
| ZwUnmapViewOfSectionEx | 6.2 and higher | declared (Windows 10 WDK) |
| ZwUnsubscribeWnfStateChange | 6.2 and higher | declared (Windows 10 WDK) |
| ZwUpdateWnfStateData | 6.2 and higher | declared (Windows 10 WDK) |
| ZwVdmControl | 3.10 and higher | |
| ZwVdmStartExecution | 3.10 only | |
| ZwW32Call | 3.51 to 4.0 from Windows NT 4.0 SP3 only | |
| ZwWaitForAlertByThreadId | 6.2 and higher | |
| ZwWaitForDebugEvent | 5.1 and higher | |
| ZwWaitForKeyedEvent | 5.1 and higher | declared (Windows 10 WDK) |
| ZwWaitForMultipleObjects | 3.10 and higher | declared (Windows 10 WDK) |
| ZwWaitForMultipleObjects32 | 5.2 from Windows Server 2003 SP1, and higher | declared (Windows 10 WDK) |
| ZwWaitForProcessMutant | 3.10 to 3.51 | declared (Windows 10 WDK) |
| ZwWaitForSingleObject | 3.10 and higher | documented (WDK) |
| ZwWaitForWnfNotifications | 6.2 only | |
| ZwWaitForWorkViaWorkerFactory | 6.0 and higher | |
| ZwWaitHighEventPair | 3.10 and higher | declared (Windows 10 WDK) |
| ZwWaitLowEventPair | 3.10 and higher | declared (Windows 10 WDK) |
| ZwWorkerFactoryWorkerReady | 6.0 and higher | |
| ZwWow64AllocateVirtualMemory64 | 6.2 and higher (wow64 only) | |
| ZwWow64CallFunction64 | 6.0 and higher (wow64 only) | |
| ZwWow64CsrAllocateCaptureBuffer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64CsrAllocateMessagePointer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64CsrCaptureMessageBuffer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64CsrCaptureMessageString | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64CsrClientCallServer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64CsrClientConnectToServer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64CsrFreeCaptureBuffer | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64CsrGetProcessId | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64CsrIdentifyAlertableThread | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64CsrNewThread | some 5.2 and some 6.0 (wow64 only); in 5.2 from Windows Server 2003 SP1 and higher; in 6.0 before Windows Vista SP1 |
|
| ZwWow64CsrSetPriorityClass | some 5.2 and some 6.0 (wow64 only); in 5.2 from Windows Server 2003 SP1 and higher; in 6.0 before Windows Vista SP1 |
|
| ZwWow64CsrVerifyRegion | 6.0 and higher (wow64 only) | |
| ZwWow64DebuggerCall | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64GetCurrentProcessorNumberEx | 6.1 and higher (wow64 only) | |
| ZwWow64GetNativeSystemInformation | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64InterlockedPopEntrySList | 6.1 only (wow64 only) | |
| ZwWow64IsProcessorFeaturePresent | 10.0 and higher (wow64 only) | |
| ZwWow64QueryInformationProcess64 | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64QueryVirtualMemory64 | 5.2 from Windows Server 2003 SP1 to 6.3 (wow64 only) | |
| ZwWow64ReadVirtualMemory64 | 5.2 from Windows Server 2003 SP1, and higher (wow64 only) | |
| ZwWow64WriteVirtualMemory64 | 6.0 and higher (wow64 only) | |
| ZwWriteFile | 3.10 and higher | documented (WDK) |
| ZwWriteFileGather | 4.0 from Windows NT 4.0 SP3, and higher | |
| ZwWriteRequestData | 3.10 and higher | |
| ZwWriteVirtualMemory | 3.10 and higher | |
| ZwYieldExecution | 4.0 and higher | |
| _CIcos | 5.1 and higher (x86 only) | |
| _CIlog | 5.1 and higher (x86 only) | |
| _CIpow | 3.51 and higher (x86 only) | |
| _CIsin | 5.1 and higher (x86 only) | |
| _CIsqrt | 5.1 and higher (x86 only) | |
| _ResCGetRegistryFlags | 6.0 before Windows Vista SP1 | |
| _ResCMatchFlags | 6.0 before Windows Vista SP1 | |
| _ResCSaveRegistryFlags | 6.0 before Windows Vista SP1 | |
| __C_specific_handler | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | |
| __chkstk | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | |
| __eCommonExceptions | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eEmulatorInit | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eF2XM1 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFABS | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFADD32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFADD64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFADDPreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFADDreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFADDtop | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFCHS | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFCOM | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFCOM32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFCOM64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFCOMP | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFCOMP32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFCOMP64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFCOMPP | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFCOS | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFDECSTP | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFDIV32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFDIV64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFDIVPreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFDIVR32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFDIVR64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFDIVRPreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFDIVRreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFDIVRtop | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFDIVreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFDIVtop | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFFREE | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFIADD16 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFIADD32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFICOM16 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFICOM32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFICOMP16 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFICOMP32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFIDIV16 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFIDIV32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFIDIVR16 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFIDIVR32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFILD16 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFILD32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFILD64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFIMUL16 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFIMUL32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFINCSTP | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFINIT | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFIST16 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFIST32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFISTP16 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFISTP32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFISTP64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFISUB16 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFISUB32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFISUBR16 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFISUBR32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFLD1 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFLD32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFLD64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFLD80 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFLDCW | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFLDENV | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFLDL2E | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFLDLN2 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFLDPI | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFLDZ | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFMUL32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFMUL64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFMULPreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFMULreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFMULtop | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFPATAN | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFPREM | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFPREM1 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFPTAN | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFRNDINT | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFRSTOR | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSAVE | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSCALE | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSIN | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSQRT | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFST | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFST32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFST64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSTCW | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSTENV | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSTP | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSTP32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSTP64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSTP80 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSTSW | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSUB32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSUB64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSUBPreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSUBR32 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSUBR64 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSUBRPreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSUBRreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSUBRtop | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSUBreg | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFSUBtop | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFTST | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFUCOM | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFUCOMP | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFUCOMPP | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFXAM | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFXCH | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFXTRACT | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFYL2X | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eFYL2XP1 | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __eGetStatusWord | 3.10 to some 5.1 and some 5.2; in 5.1 before Windows XP SP2; in 5.2 before Windows Server 2003 SP1 |
|
| __isascii | 4.0 and higher | documented (CRT) |
| __iscsym | 4.0 and higher | documented (CRT) |
| __iscsymf | 4.0 and higher | documented (CRT) |
| __misaligned_access | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | |
| __toascii | 4.0 and higher | documented (CRT) |
| _alldiv | 4.0 and higher (x86 only) | documented |
| _alldvrm | 5.1 and higher (x86 only) | |
| _allmul | 4.0 and higher (x86 only) | |
| _alloca_probe | 3.51 and higher (x86 only) | |
| _alloca_probe_16 | 6.0 and higher (x86 only) | |
| _alloca_probe_8 | 6.0 and higher (x86 only) | |
| _allrem | 4.0 and higher (x86 only) | |
| _allshl | 4.0 and higher (x86 only) | |
| _allshr | 4.0 and higher (x86 only) | |
| _atoi64 | 4.0 and higher | documented (CRT) |
| _aulldiv | 4.0 and higher (x86 only) | |
| _aulldvrm | 5.1 and higher (x86 only) | |
| _aullrem | 4.0 and higher (x86 only) | |
| _aullshr | 4.0 and higher (x86 only) | |
| _chkstk | 3.51 and higher (x86 only) | documented |
| _errno | 6.2 and higher | documented (CRT) |
| _except_handler4_common | 6.2 and higher (x86 only) | |
| _fltused | 3.51 and higher | |
| _ftol | 3.51 and higher (x86 only) | |
| ftol2 | 6.2 and higher (x86 only) | |
| ftol2_sse | 6.2 and higher (x86 only) | |
| _i64toa | 4.0 and higher | documented (CRT) |
| _i64toa_s | 6.1 and higher | documented (CRT) |
| _i64tow | 4.0 and higher | documented (CRT) |
| _i64tow_s | 6.1 and higher | documented (CRT) |
| _itoa | 3.51 and higher | documented (CRT) |
| _itoa_s | 6.1 and higher | documented (CRT) |
| _itow | 4.0 and higher | documented (CRT) |
| _itow_s | 6.1 and higher | documented (CRT) |
| _lfind | 5.1 and higher | documented (CRT) |
| _local_unwind | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | |
| _local_unwind4 | 6.2 and higher (x86 only) | |
| _ltoa | 3.51 and higher | documented (CRT) |
| _ltoa_s | 6.1 and higher | documented (CRT) |
| _ltow | 4.0 and higher | documented (CRT) |
| _ltow_s | 6.1 and higher | documented (CRT) |
| _makepath_s | 6.1 and higher | documented (CRT) |
| _memccpy | 3.51 and higher | documented (CRT) |
| _memicmp | 3.51 and higher | documented (CRT) |
| _setjmp | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | |
| _setjmpex | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | |
| _snprintf | 3.51 and higher | documented (CRT) |
| _snprintf_s | 6.1 and higher | documented (CRT) |
| _snscanf_s | 6.1 and higher | documented (CRT) |
| _snwprintf | 3.51 and higher | documented (CRT) |
| _snwprintf_s | 6.1 and higher | documented (CRT) |
| _snwscanf_s | 6.1 and higher | documented (CRT) |
| _splitpath | 3.51 and higher | documented (CRT) |
| _splitpath_s | 6.1 and higher | documented (CRT) |
| _strcmpi | 3.51 and higher | documented (CRT) |
| _stricmp | 3.51 and higher | documented (CRT) |
| _strlwr | 3.51 and higher | documented (CRT) |
| _strlwr_s | 6.2 and higher | documented (CRT) |
| _strnicmp | 3.51 and higher | documented (CRT) |
| _strnset_s | 6.1 and higher | documented (CRT) |
| _strset_s | 6.1 and higher | documented (CRT) |
| _strupr | 3.51 and higher | documented (CRT) |
| _strupr_s | 6.2 and higher | documented (CRT) |
| _swprintf | 6.0 and higher | documented (CRT) |
| _tolower | 4.0 to 5.2 | documented (CRT) |
| _toupper | 4.0 to 5.2 | documented (CRT) |
| _ui64toa | 5.0 and higher | documented (CRT) |
| _ui64toa_s | 6.1 and higher | documented (CRT) |
| _ui64tow | 5.1 and higher | documented (CRT) |
| _ui64tow_s | 6.1 and higher | documented (CRT) |
| _ultoa | 3.51 and higher | documented (CRT) |
| _ultoa_s | 6.1 and higher | documented (CRT) |
| _ultow | 4.0 and higher | documented (CRT) |
| _ultow_s | 6.1 and higher | documented (CRT) |
| _vscwprintf | 5.2 and higher | documented (CRT) |
| _vsnprintf | 3.51 and higher | documented (CRT) |
| _vsnprintf_s | 6.1 and higher | documented (CRT) |
| _vsnwprintf | 5.1 and higher | documented (CRT) |
| _vsnwprintf_s | 6.1 and higher | documented (CRT) |
| _vswprintf | 6.0 and higher | documented (CRT) |
| _wcsicmp | 3.51 and higher | documented (CRT) |
| _wcslwr | 3.51 and higher | documented (CRT) |
| _wcslwr_s | 6.2 and higher | documented (CRT) |
| _wcsnicmp | 3.51 and higher | documented (CRT) |
| _wcsnset_s | 6.1 and higher | documented (CRT) |
| _wcsset_s | 6.1 and higher | documented (CRT) |
| _wcstoi64 | 6.2 and higher | documented (CRT) |
| _wcstoui64 | 5.2 and higher | documented (CRT) |
| _wcsupr | 3.51 and higher | documented (CRT) |
| _wcsupr_s | 6.2 and higher | documented (CRT) |
| _wmakepath_s | 6.1 and higher | documented (CRT) |
| _wsplitpath_s | 6.1 and higher | documented (CRT) |
| _wtoi | 4.0 and higher | documented (CRT) |
| _wtoi64 | 4.0 and higher | documented (CRT) |
| _wtol | 4.0 and higher | documented (CRT) |
| abs | 3.51 and higher | documented (CRT) |
| atan | 3.51 and higher | documented (CRT) |
| atan2 | 10.0 and higher | documented (CRT) |
| atoi | 3.51 and higher | documented (CRT) |
| atol | 3.51 and higher | documented (CRT) |
| bsearch | 5.1 and higher | documented (CRT) |
| ceil | 3.51 and higher | documented (CRT) |
| cos | 3.51 and higher | documented (CRT) |
| fabs | 3.51 and higher | documented (CRT) |
| floor | 3.51 and higher | documented (CRT) |
| isalnum | 4.0 and higher | documented (CRT) |
| isalpha | 3.51 and higher | documented (CRT) |
| iscntrl | 4.0 and higher | documented (CRT) |
| isdigit | 3.51 and higher | documented (CRT) |
| isgraph | 4.0 and higher | documented (CRT) |
| islower | 3.51 and higher | documented (CRT) |
| isprint | 3.51 and higher | documented (CRT) |
| ispunct | 4.0 and higher | documented (CRT) |
| isspace | 3.51 and higher | documented (CRT) |
| isupper | 3.51 and higher | documented (CRT) |
| iswalnum | 6.2 and higher | documented (CRT) |
| iswalpha | 3.51 and higher | documented (CRT) |
| iswascii | 6.2 and higher | documented (CRT) |
| iswctype | 3.51 and higher | documented (CRT) |
| iswdigit | 5.0 and higher | documented (CRT) |
| iswgraph | 6.2 and higher | documented (CRT) |
| iswlower | 5.0 and higher | documented (CRT) |
| iswprint | 6.2 and higher | documented (CRT) |
| iswspace | 5.0 and higher | documented (CRT) |
| iswxdigit | 5.0 and higher | documented (CRT) |
| isxdigit | 3.51 and higher | documented (CRT) |
| labs | 3.51 and higher | documented (CRT) |
| log | 3.51 and higher | documented (CRT) |
| longjmp | 5.2 from Windows Server 2003 SP1, and higher (x64 only) | |
| mbstowcs | 3.51 and higher | documented (CRT) |
| memchr | 3.51 and higher | documented (CRT) |
| memcmp | 3.51 and higher | documented (CRT) |
| memcpy | 3.51 and higher | documented (CRT) |
| memcpy_s | 6.1 and higher | documented (CRT) |
| memmove | 3.51 and higher | documented (CRT) |
| memmove_s | 6.1 and higher | documented (CRT) |
| memset | 3.51 and higher | documented (CRT) |
| pow | 3.51 and higher | documented (CRT) |
| qsort | 3.51 and higher | documented (CRT) |
| qsort_s | 6.2 and higher | documented (CRT) |
| sin | 3.51 and higher | documented (CRT) |
| sprintf | 3.51 and higher | documented (CRT) |
| sprintf_s | 6.1 and higher | documented (CRT) |
| sqrt | 3.51 and higher | documented (CRT) |
| sscanf | 3.51 and higher | documented (CRT) |
| sscanf_s | 6.1 and higher | documented (CRT) |
| strcat | 3.51 and higher | documented (CRT) |
| strcat_s | 6.1 and higher | documented (CRT) |
| strchr | 3.51 and higher | documented (CRT) |
| strcmp | 3.51 and higher | documented (CRT) |
| strcpy | 3.51 and higher | documented (CRT) |
| strcpy_s | 6.1 and higher | documented (CRT) |
| strcspn | 3.51 and higher | documented (CRT) |
| strlen | 3.51 and higher | documented (CRT) |
| strncat | 3.51 and higher | documented (CRT) |
| strncat_s | 6.1 and higher | documented (CRT) |
| strncmp | 3.51 and higher | documented (CRT) |
| strncpy | 3.51 and higher | documented (CRT) |
| strncpy_s | 6.1 and higher | documented (CRT) |
| strnlen | 6.1 and higher | documented (CRT) |
| strpbrk | 3.51 and higher | documented (CRT) |
| strrchr | 3.51 and higher | documented (CRT) |
| strspn | 3.51 and higher | documented (CRT) |
| strstr | 3.51 and higher | documented (CRT) |
| strtok_s | 6.1 and higher | documented (CRT) |
| strtol | 4.0 and higher | documented (CRT) |
| strtoul | 4.0 and higher | documented (CRT) |
| swprintf | 3.51 and higher | documented (CRT) |
| swprintf_s | 6.1 and higher | documented (CRT) |
| swscanf_s | 6.1 and higher | documented (CRT) |
| tan | 3.51 and higher | documented (CRT) |
| tolower | 3.51 and higher | documented (CRT) |
| toupper | 3.51 and higher | documented (CRT) |
| towlower | 3.51 and higher | documented (CRT) |
| towupper | 3.51 and higher | documented (CRT) |
| vDbgPrintEx | 5.1 and higher | documented (WDK) |
| vDbgPrintExWithPrefix | 5.1 and higher | documented (WDK) |
| vsprintf | 3.51 and higher | documented (CRT) |
| vsprintf_s | 6.1 and higher | documented (CRT) |
| vswprintf_s | 6.1 and higher | documented (CRT) |
| wcscat | 3.51 and higher | documented (CRT) |
| wcscat_s | 6.1 and higher | documented (CRT) |
| wcschr | 3.51 and higher | documented (CRT) |
| wcscmp | 3.51 and higher | documented (CRT) |
| wcscpy | 3.51 and higher | documented (CRT) |
| wcscpy_s | 6.1 and higher | documented (CRT) |
| wcscspn | 3.51 and higher | documented (CRT) |
| wcslen | 3.51 and higher | documented (CRT) |
| wcsncat | 3.51 and higher | documented (CRT) |
| wcsncat_s | 6.1 and higher | documented (CRT) |
| wcsncmp | 3.51 and higher | documented (CRT) |
| wcsncpy | 3.51 and higher | documented (CRT) |
| wcsncpy_s | 6.1 and higher | documented (CRT) |
| wcsnlen | 6.1 and higher | documented (CRT) |
| wcspbrk | 3.51 and higher | documented (CRT) |
| wcsrchr | 3.51 and higher | documented (CRT) |
| wcsspn | 3.51 and higher | documented (CRT) |
| wcsstr | 3.51 and higher | documented (CRT) |
| wcstok | 3.51 only | documented (CRT) |
| wcstok_s | 6.2 and higher | documented (CRT) |
| wcstol | 3.51 and higher | documented (CRT) |
| wcstombs | 3.51 and higher | documented (CRT) |
| wcstoul | 3.51 and higher | documented (CRT) |
| xRtlDosPathNameToNtPathName | 3.10 only |
Function names are reproduced from the export directory of the NTDLL.DLL executable. All exports from NTDLL are by name, until Windows 7 introduces a few that are exported only by ordinal. Names for these few are inferred from symbol files that Microsoft supplies for customer support. The ordinal is given in parentheses immediately after the function’s name.
A few exports are of variables rather than functions. They are marked above by the word “data” in parentheses. These notes talk of all as functions, hoping no confusion will be caused by such loose terminology.
Since experience shows that this table is not always read with the knowledge of an advanced programmer, it must be stressed that a function’s presence in the export directory does not mean that a function is implemented non-trivially or that it will work satisfactorily if called. It means just that the function can be imported from other modules, and be called by them, for better or worse. That a function is exported from some version does not mean that Microsoft supports its use in that version even if such support is documented for later versions.
The NTDLL versions shown for each function are inferred from a study of public releases such as I have managed to find on old MSDN discs or have downloaded from Microsoft’s websites (whether free or requiring what is nowadays called a Visual Studio subscription). My holdings are incomplete and I anyway have no time for or interest in examining pre-release builds or hotfixes. Of necessity then, the table makes what I hope are reasonable assumptions about likely continuity, especially to suppose that a function will exist in future versions or that a function exists in all builds of a version if no counter-example is yet known. If you want more accurate or comprehensive information, try getting it from Microsoft.
A quick list of the studied versions is:
NTDLL exists in both 32-bit and 64-bit Windows. The latter provides both a 64-bit (x64) NTDLL in the System32 directory and a 32-bit (wow64) NTDLL in the SysWOW64 directory. The 32-bit NTDLL in 64-bit Windows differs from the 32-bit (x86) NTDLL in 32-bit Windows, but not by much, such that wow64 is here treated as an exceptional case of x86. In particular, the phrase “x86 only” stands for both the x86 and wow64 builds.
This study’s reference version of Microsoft’s documentation is the Microsoft Windows Software Development Kit (SDK) for Windows 7 and .NET Framework 3.51 Service Pack 1, apparently released in August 2009. The build date shown on the opening pages of this documentation is 22nd June 2009.
Choosing one reference edition is not ideal for all purposes. Functions inevitably will be added for versions released afterwards, and will typically not be listed above as documented until a new reference edition is adopted. There is also a loss of history. Of interest to many is that Microsoft sometimes does not document new functions until years have passed: that a function is marked above as documented does not mean it has always been documented, only that it is documented in the chosen reference edition. Of interest perhaps only to historians is that even documented functions are sometimes discontinued, meaning specifically that later versions do not export them. Do not rely on me to have searched old editions of the SDK or MSDN Library to find whether discontinued functions ever were documented.
That said, for as much precision as I do happen to know about the history of a function’s documentation, look for the function in the version lists. For instance, that is how this study means you to learn that although ZwLockFile is exported from at least as far back as Windows NT 3.51 (in 1995), it did not get documented until 2008 or 2009, and was then said to require at least Windows 7 even though its declaration in a header file makes it available if developing for Windows Vista. Please be aware that for thousands of functions, each looked for in nearly a dozen sources of documentation, there are bound to be some mistakes in my descriptions, and my account of the history is anyway deficient for not having found Installable File System (IFS) kits for Windows XP or Windows Server 2003.
Very few NTDLL functions are documented as being exported from NTDLL. Finding these few is difficult enough since what documentation does exist is scattered. That a function is not marked above as “documented” does not mean for certain that Microsoft does not document it, just that I haven’t yet found where.
Worse, the documentation status of NTDLL functions cannot be left just with whether Microsoft documents them as being exported from NTDLL. Many NTDLL functions are sort-of documented, by other means in other guises, such that they cannot properly be ruled undocumented. There are several mechanisms at play.
Many an NTDLL function has a higher-level function, often with a different name, that corresponds to it more or less closely. The higher-level functions, typically in KERNEL32.DLL or ADVAPI32.DLL, usually are documented, but identifying them all is not straightforward. The easy ones to find are not actually coded in the higher-level module but are exported from the higher-level module merely as forwards to NTDLL. These are enumerated completely just from a mechanical examination of the higher-level DLL’s export directory, but even they are not entirely well-defined, most notably for varying with the version. Other functions are coded in the higher-level module but very simply, e.g., as a jump to the code in NTDLL, or in some other way such that the NTDLL function provides the whole implementation of the higher-level function. These are enumerated only by inspecting the code, and I do not pretend to have done this anywhere near to completely even for one version. If a function that is not formally documented as being exported from NTDLL falls into either of these cases and is documented as being exported from the higher-level DLL, then it is marked in the table by adding the name of the higher-level DLL in brackets. If the higher-level function has a different name, then the difference is a bit much to convey meaningfully in this summary: refer to the more detailed Remarks in the function’s listing by version.
For many more NTDLL functions, the higher-level function re-dresses the NTDLL function, typically to take arguments in a different form or to return a different type, yet the correspondence remains close enough that calling the one rather than the other loses little or no functionality (though the higher-level function is generally to be preferred on architectural grounds). For these, it is not entirely satisfactory to call the NTDLL function undocumented if the higher-level one is documented, but neither is the correspondence in all such cases close enough to justify saying that the NTDLL function is documented in effect. To say one way or the other would be subjective beyond usefulness, and I leave these cases alone.
Most of the many NTDLL functions whose names begin with Nt or Zw are just calls to the NT kernel in ring 0 through a software interrupt or other mechanism such as the SYSENTER instruction. The ring 0 code that is reached this way is typically also exported from the NT kernel (usually just with the Zw prefix) so that it can be imported by other ring 0 code such as device drivers and installable file systems. Some, but by no means all, of these lower-level functions are documented in the Windows Driver Kit (WDK), with the Zw prefix for use from kernel mode and Nt for use from user mode.
A similar outcome through different means is presented by the many NTDLL functions whose names begin with Rtl. They are implemented more or less completely in NTDLL but by static linking from libraries such that they reproduce what is also in the ring 0 kernel. The WDK documentation of these functions may be presented as covering these functions only for their use in ring 0, but it is as good for when they are called as NTDLL functions.
All these functions, and any others that I happen to have noticed are documented in the WDK, are indicated in the table by adding WDK in brackets. It may be that Microsoft always intended that NTDLL is documented in the WDK rather than the SDK, such that what little has shown in the SDK is a leakage of internal detail.
Some NTDLL functions that are not documented in the WDK are at least declared in one or another header file from the WDK. Where known, these are marked above as “declared”, again with WDK in brackets if the applicable header file is from the WDK rather than the SDK.
The WDK documentation adopted by this study as a reference version is the first public release for Windows 7, installing as WDK 7600.16385.0, with documentation dated 18th June 2009.
Of course, no WDK can tell of functions that are new to later versions—but I can’t justify the time for tracking changes in each new WDK. If only for now, the only later WDK version that has been inspected for this study is the one for Windows 10. This is especially notable for providing headers that support Microsoft’s own use of undocumented functions by low-level user-mode modules such as services. A welcome side-effect is that almost all—though conspicuously not all—the Zw functions now have declarations.
Finally, NTDLL exports more than 100 functions from the C Run-Time (CRT) Library. Some are not documented even for the CRT because in practice all calls to them are generated by the compiler, but most are the sort of utility functions that no C or C++ programmer would want to be without just for working at too low a level to import them from MSVCRT.DLL. The CRT documentation is good for these, even though the functions are not formally documented as being exported from NTDLL. These are marked in the table by adding CRT in brackets.