API-MS-Win-Core-XState-L1-1-0

All functions in the API-MS-Win-Core-XState-L1-1-0 set are exports from NTDLL. All are new for version 6.1. All are declared in the Windows Driver Kit (WDK), though only one is documented, and only then for use in kernel mode.

• RtlCopyExtendedContext
• RtlGetEnabledExtendedFeatures
• RtlGetExtendedContextLength
• RtlGetExtendedFeaturesMask
• RtlInitializeExtendedContext
• RtlLocateExtendedFeature
• RtlLocateLegacyContext
• RtlSetExtendedFeaturesMask

The Windows 7 schema redirects this API Set to NTDLL. Thus:

• high-level executables, which do not use the API Set, continue to import these functions from NTDLL;
• low-level executables have their imports from the API Set redirected to NTDLL.

That said, there surely are not meant to be any high-level executables trying to import these functions from anywhere. The only known importer is KERNEL32, to support documented functions that have the same names but no Rtl prefix, and KERNEL32 imports from the API Set.