3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache=CcRosInitializeFileCache@8
9 CcMdlReadComplete=CcMdlReadComplete@8
10 CcRosReleaseFileCache=CcRosReleaseFileCache@4
11 CcCopyRead=CcCopyRead@24
12 CcCopyWrite=CcCopyWrite@20
13 CcFlushCache=CcFlushCache@16
14 CcGetFileObjectFromSectionPtrs=CcGetFileObjectFromSectionPtrs@4
15 CcMapData=CcMapData@24
16 CcSetDirtyPinnedData=CcSetDirtyPinnedData@8
17 CcUnpinData=CcUnpinData@4
18 CcSetFileSizes=CcSetFileSizes@8
19 CcZeroData=CcZeroData@16
20 DbgBreakPoint=DbgBreakPoint@0
21 DbgBreakPointWithStatus=DbgBreakPointWithStatus@4
22 ;DbgLoadImageSymbols=DbgLoadImageSymbols@12
24 DbgPrompt=DbgPrompt@12
26 ExAcquireFastMutexUnsafe=@ExAcquireFastMutexUnsafe@4
27 ExAcquireResourceExclusive=ExAcquireResourceExclusive@8
28 ExAcquireResourceExclusiveLite=ExAcquireResourceExclusiveLite@8
29 ExAcquireResourceSharedLite=ExAcquireResourceSharedLite@8
30 ExAcquireSharedStarveExclusive=ExAcquireSharedStarveExclusive@8
31 ExAcquireSharedWaitForExclusive=ExAcquireSharedWaitForExclusive@8
32 ExAllocateFromPagedLookasideList=ExAllocateFromPagedLookasideList@4
33 ExAllocatePool=ExAllocatePool@8
34 ExAllocatePoolWithQuota=ExAllocatePoolWithQuota@8
35 ExAllocatePoolWithQuotaTag=ExAllocatePoolWithQuotaTag@12
36 ExAllocatePoolWithTag=ExAllocatePoolWithTag@12
37 ExConvertExclusiveToSharedLite=ExConvertExclusiveToSharedLite@4
38 ExCreateCallback=ExCreateCallback@16
39 ExDeleteNPagedLookasideList=ExDeleteNPagedLookasideList@4
40 ExDeletePagedLookasideList=ExDeletePagedLookasideList@4
41 ExDeleteResource=ExDeleteResource@4
42 ExDeleteResourceLite=ExDeleteResourceLite@4
43 ExDesktopObjectType DATA
44 ExDisableResourceBoostLite=ExDisableResourceBoostLite@4
45 ExEventObjectType DATA
46 ExExtendZone=ExExtendZone@12
47 ExFreePool=ExFreePool@4
48 ExFreeToPagedLookasideList=ExFreeToPagedLookasideList@8
49 ExGetExclusiveWaiterCount=ExGetExclusiveWaiterCount@4
50 ExGetPreviousMode=ExGetPreviousMode@0
51 ExGetSharedWaiterCount=ExGetSharedWaiterCount@4
52 ExInitializeNPagedLookasideList=ExInitializeNPagedLookasideList@28
53 ExInitializePagedLookasideList=ExInitializePagedLookasideList@28
54 ExInitializeResource=ExInitializeResource@4
55 ExInitializeResourceLite=ExInitializeResourceLite@4
56 ExInitializeZone=ExInitializeZone@16
57 ExInterlockedAddLargeInteger=ExInterlockedAddLargeInteger@16
58 ExInterlockedAddLargeStatistic=@ExInterlockedAddLargeStatistic@8
59 ExInterlockedAddUlong=ExInterlockedAddUlong@12
60 ExInterlockedCompareExchange64=@ExInterlockedCompareExchange64@16
61 ExInterlockedDecrementLong=ExInterlockedDecrementLong@8
62 ExInterlockedExchangeUlong=ExInterlockedExchangeUlong@12
63 ExInterlockedExtendZone=ExInterlockedExtendZone@16
64 ExInterlockedIncrementLong=ExInterlockedIncrementLong@8
65 ExInterlockedInsertHeadList=ExInterlockedInsertHeadList@12
66 ExInterlockedInsertTailList=ExInterlockedInsertTailList@12
67 ExInterlockedPopEntryList=ExInterlockedPopEntryList@8
68 ExInterlockedPopEntrySList=@ExInterlockedPopEntrySList@8
69 ExInterlockedPushEntryList=ExInterlockedPushEntryList@12
70 ExInterlockedPushEntrySList=@ExInterlockedPushEntrySList@12
71 ExInterlockedRemoveHeadList=ExInterlockedRemoveHeadList@8
72 ExIsProcessorFeaturePresent=ExIsProcessorFeaturePresent@4
73 ExIsResourceAcquiredExclusiveLite=ExIsResourceAcquiredExclusiveLite@4
74 ExIsResourceAcquiredSharedLite=ExIsResourceAcquiredSharedLite@4
75 ExLocalTimeToSystemTime=ExLocalTimeToSystemTime@8
76 ExNotifyCallback=ExNotifyCallback@12
77 ExPostSystemEvent=ExPostSystemEvent@12
79 ExQueueWorkItem=ExQueueWorkItem@8
80 ExRaiseAccessViolation=ExRaiseAccessViolation@0
81 ExRaiseDatatypeMisalignment=ExRaiseDatatypeMisalignment@0
84 ExRaiseStatus=ExRaiseStatus@4
85 ExRegisterCallback=ExRegisterCallback@12
86 ExReinitializeResourceLite=ExReinitializeResourceLite@4
87 ExReleaseFastMutexUnsafe=@ExReleaseFastMutexUnsafe@4
88 ExReleaseResourceForThread=ExReleaseResourceForThread@8
89 ExReleaseResourceForThreadLite=ExReleaseResourceForThreadLite@8
90 ExReleaseResourceLite=@ExReleaseResourceLite@4
91 ExSetResourceOwnerPointer=ExSetResourceOwnerPointer@8
92 ;ExSystemExceptionFilter
93 ExSystemTimeToLocalTime=ExSystemTimeToLocalTime@8
94 ExTryToAcquireResourceExclusiveLite=ExTryToAcquireResourceExclusiveLite@4
95 ExUnregisterCallback=ExUnregisterCallback@4
96 ExWindowStationObjectType DATA
97 ExInitializeBinaryTree=ExInitializeBinaryTree@12
98 ExDeleteBinaryTree=ExDeleteBinaryTree@4
99 ExInsertBinaryTree=ExInsertBinaryTree@12
100 ExSearchBinaryTree=ExSearchBinaryTree@12
101 ExRemoveBinaryTree=ExRemoveBinaryTree@12
102 ExTraverseBinaryTree=ExTraverseBinaryTree@16
103 ExInitializeSplayTree=ExInitializeSplayTree@16
104 ExDeleteSplayTree=ExDeleteSplayTree@4
105 ExInsertSplayTree=ExInsertSplayTree@12
106 ExSearchSplayTree=ExSearchSplayTree@12
107 ExRemoveSplayTree=ExRemoveSplayTree@12
108 ExWeightOfSplayTree=ExWeightOfSplayTree@8
109 ExTraverseSplayTree=ExTraverseSplayTree@16
110 ExInitializeHashTable=ExInitializeHashTable@16
111 ExDeleteHashTable=ExDeleteHashTable@4
112 ExInsertHashTable=ExInsertHashTable@16
113 ExSearchHashTable=ExSearchHashTable@16
114 ExRemoveHashTable=ExRemoveHashTable@16
115 ExfInterlockedAddUlong=@ExfInterlockedAddUlong@12
116 ExfInterlockedInsertHeadList=@ExfInterlockedInsertHeadList@12
117 ExfInterlockedInsertTailList=@ExfInterlockedInsertTailList@12
118 ExfInterlockedPopEntryList=@ExfInterlockedPopEntryList@8
119 ExfInterlockedPushEntryList=@ExfInterlockedPushEntryList@12
120 ExfInterlockedRemoveHeadList=@ExfInterlockedRemoveHeadList@8
121 Exfi386InterlockedDecrementLong=@Exfi386InterlockedDecrementLong@4
122 Exfi386InterlockedExchangeUlong=@Exfi386InterlockedExchangeUlong@8
123 Exfi386InterlockedIncrementLong=@Exfi386InterlockedIncrementLong@4
124 Exi386InterlockedDecrementLong=Exi386InterlockedDecrementLong@4
125 Exi386InterlockedExchangeUlong=Exi386InterlockedExchangeUlong@8
126 Exi386InterlockedIncrementLong=Exi386InterlockedIncrementLong@4
127 FsRtlAddLargeMcbEntry=FsRtlAddLargeMcbEntry@28
128 FsRtlAddMcbEntry=FsRtlAddMcbEntry@16
129 FsRtlAddToTunnelCache=FsRtlAddToTunnelCache@32
130 FsRtlAllocateFileLock=FsRtlAllocateFileLock@8
131 FsRtlAllocatePool=FsRtlAllocatePool@8
132 FsRtlAllocatePoolWithQuota=FsRtlAllocatePoolWithQuota@8
133 FsRtlAllocatePoolWithQuotaTag=FsRtlAllocatePoolWithQuotaTag@12
134 FsRtlAllocatePoolWithTag=FsRtlAllocatePoolWithTag@12
135 FsRtlAllocateResource=FsRtlAllocateResource@0
136 FsRtlAreNamesEqual=FsRtlAreNamesEqual@16
137 FsRtlBalanceReads=FsRtlBalanceReads@4
138 FsRtlCheckLockForReadAccess=FsRtlCheckLockForReadAccess@8
139 FsRtlCheckLockForWriteAccess=FsRtlCheckLockForWriteAccess@8
140 FsRtlCheckOplock=FsRtlCheckOplock@20
141 FsRtlCopyRead=FsRtlCopyRead@32
142 FsRtlCopyWrite=FsRtlCopyWrite@32
143 FsRtlCurrentBatchOplock=FsRtlCurrentBatchOplock@4
144 FsRtlDeleteKeyFromTunnelCache=FsRtlDeleteKeyFromTunnelCache@12
145 FsRtlDeleteTunnelCache=FsRtlDeleteTunnelCache@4
146 FsRtlDeregisterUncProvider=FsRtlDeregisterUncProvider@4
147 FsRtlDissectDbcs=FsRtlDissectDbcs@16
148 FsRtlDissectName=FsRtlDissectName@16
149 FsRtlDoesDbcsContainWildCards=FsRtlDoesDbcsContainWildCards@4
150 FsRtlDoesNameContainWildCards=FsRtlDoesNameContainWildCards@4
151 FsRtlFastCheckLockForRead=FsRtlFastCheckLockForRead@24
152 FsRtlFastCheckLockForWrite=FsRtlFastCheckLockForWrite@24
153 FsRtlFastUnlockAll=FsRtlFastUnlockAll@16
154 FsRtlFastUnlockAllByKey=FsRtlFastUnlockAllByKey@20
155 FsRtlFastUnlockSingle=FsRtlFastUnlockSingle@32
156 FsRtlFindInTunnelCache=FsRtlFindInTunnelCache@32
157 FsRtlGetFileSize=FsRtlGetFileSize@8
158 FsRtlGetNextFileLock=FsRtlGetNextFileLock@8
159 FsRtlGetNextLargeMcbEntry=FsRtlGetNextLargeMcbEntry@20
160 FsRtlGetNextMcbEntry=FsRtlGetNextMcbEntry@20
161 FsRtlInitializeFileLock=FsRtlInitializeFileLock@12
162 FsRtlInitializeLargeMcb=FsRtlInitializeLargeMcb@8
163 FsRtlInitializeMcb=FsRtlInitializeMcb@8
164 FsRtlInitializeOplock=FsRtlInitializeOplock@4
165 FsRtlInitializeTunnelCache=FsRtlInitializeTunnelCache@4
166 FsRtlIsDbcsInExpression=FsRtlIsDbcsInExpression@8
167 FsRtlIsFatDbcsLegal=FsRtlIsFatDbcsLegal@20
168 FsRtlIsHpfsDbcsLegal=FsRtlIsHpfsDbcsLegal@20
169 FsRtlIsNameInExpression=FsRtlIsNameInExpression@16
170 FsRtlIsNtstatusExpected=FsRtlIsNtstatusExpected@4
171 FsRtlIsTotalDeviceFailure=FsRtlIsTotalDeviceFailure@4
172 FsRtlLegalAnsiCharacterArray DATA
173 FsRtlLookupLargeMcbEntry=FsRtlLookupLargeMcbEntry@32
174 FsRtlLookupLastLargeMcbEntry=FsRtlLookupLastLargeMcbEntry@12
175 FsRtlLookupLastMcbEntry=FsRtlLookupLastMcbEntry@12
176 FsRtlLookupMcbEntry=FsRtlLookupMcbEntry@20
177 FsRtlMdlRead=FsRtlMdlRead@24
178 FsRtlMdlReadComplete=FsRtlMdlReadComplete@8
179 FsRtlMdlReadCompleteDev=FsRtlMdlReadCompleteDev@12
180 FsRtlMdlReadDev=FsRtlMdlReadDev@28
181 FsRtlMdlWriteComplete=FsRtlMdlWriteComplete@12
182 FsRtlMdlWriteCompleteDev=FsRtlMdlWriteCompleteDev@16
183 FsRtlNormalizeNtstatus=FsRtlNormalizeNtstatus@8
184 FsRtlNotifyChangeDirectory=FsRtlNotifyChangeDirectory@28
185 FsRtlNotifyCleanup=FsRtlNotifyCleanup@12
186 FsRtlNotifyFullChangeDirectory=FsRtlNotifyFullChangeDirectory@40
187 FsRtlNotifyFullReportChange=FsRtlNotifyFullReportChange@36
188 FsRtlNotifyInitializeSync=FsRtlNotifyInitializeSync@4
189 FsRtlNotifyReportChange=FsRtlNotifyReportChange@20
190 FsRtlNotifyUninitializeSync=FsRtlNotifyUninitializeSync@4
191 FsRtlNotifyVolumeEvent=FsRtlNotifyVolumeEvent@8
192 FsRtlNumberOfRunsInLargeMcb=FsRtlNumberOfRunsInLargeMcb@4
193 FsRtlNumberOfRunsInMcb=FsRtlNumberOfRunsInMcb@4
194 FsRtlOplockFsctrl=FsRtlOplockFsctrl@12
195 FsRtlOplockIsFastIoPossible=FsRtlOplockIsFastIoPossible@4
196 FsRtlPostPagingFileStackOverflow=FsRtlPostPagingFileStackOverflow@12
197 FsRtlPostStackOverflow=FsRtlPostStackOverflow@12
198 FsRtlPrepareMdlWrite=FsRtlPrepareMdlWrite@24
199 FsRtlPrepareMdlWriteDev=FsRtlPrepareMdlWriteDev@28
200 FsRtlPrivateLock=FsRtlPrivateLock@48
201 FsRtlProcessFileLock=FsRtlProcessFileLock@12
202 FsRtlRegisterUncProvider=FsRtlRegisterUncProvider@12
203 FsRtlRemoveLargeMcbEntry=FsRtlRemoveLargeMcbEntry@20
204 FsRtlRemoveMcbEntry=FsRtlRemoveMcbEntry@12
205 FsRtlSplitLargeMcb=FsRtlSplitLargeMcb@20
206 FsRtlSyncVolumes=FsRtlSyncVolumes@12
207 FsRtlTruncateLargeMcb=FsRtlTruncateLargeMcb@12
208 FsRtlTruncateMcb=FsRtlTruncateMcb@8
209 FsRtlUninitializeFileLock=FsRtlUninitializeFileLock@4
210 FsRtlUninitializeLargeMcb=FsRtlUninitializeLargeMcb@4
211 FsRtlUninitializeMcb=FsRtlUninitializeMcb@4
212 FsRtlUninitializeOplock=FsRtlUninitializeOplock@4
213 HalDispatchTable DATA
214 HalPrivateDispatchTable DATA
215 InterlockedCompareExchange=@InterlockedCompareExchange@12
216 InterlockedDecrement=@InterlockedDecrement@4
217 InterlockedExchange=@InterlockedExchange@8
218 InterlockedExchangeAdd=@InterlockedExchangeAdd@8
219 InterlockedIncrement=@InterlockedIncrement@4
220 IoAcquireCancelSpinLock=IoAcquireCancelSpinLock@4
221 IoAcquireVpbSpinLock=IoAcquireVpbSpinLock@4
222 IoAdapterObjectType DATA
223 IoAllocateAdapterChannel=IoAllocateAdapterChannel@20
224 IoAllocateIrp=IoAllocateIrp@8
225 IoAllocateMdl=IoAllocateMdl@20
226 IoAllocateController=IoAllocateController@16
227 IoAllocateErrorLogEntry=IoAllocateErrorLogEntry@8
228 IoAssignResources=IoAssignResources@24
229 IoAttachDevice=IoAttachDevice@12
230 IoAttachDeviceByPointer=IoAttachDeviceByPointer@8
231 IoAttachDeviceToDeviceStack=IoAttachDeviceToDeviceStack@8
232 IoBuildAsynchronousFsdRequest=IoBuildAsynchronousFsdRequest@24
233 IoBuildDeviceIoControlRequest=IoBuildDeviceIoControlRequest@36
234 IoBuildPartialMdl=IoBuildPartialMdl@16
235 IoBuildSynchronousFsdRequest=IoBuildSynchronousFsdRequest@28
236 IoCallDriver=IoCallDriver@8
237 IoCancelIrp=IoCancelIrp@4
238 IoCheckDesiredAccess=IoCheckDesiredAccess@8
239 IoCheckEaBufferValidity=IoCheckEaBufferValidity@12
240 IoCheckFunctionAccess=IoCheckFunctionAccess@24
241 IoCheckShareAccess=IoCheckShareAccess@20
242 IoCompleteRequest=IoCompleteRequest@8
243 IoConnectInterrupt=IoConnectInterrupt@44
244 IoCreateController=IoCreateController@4
245 IoCreateDevice=IoCreateDevice@28
246 IoCreateFile=IoCreateFile@56
247 IoCreateNotificationEvent=IoCreateNotificationEvent@8
248 IoCreateStreamFileObject=IoCreateStreamFileObject@8
249 IoCreateSymbolicLink=IoCreateSymbolicLink@8
250 IoCreateSynchronizationEvent=IoCreateSynchronizationEvent@8
251 IoCreateUnprotectedSymbolicLink=IoCreateUnprotectedSymbolicLink@8
252 IoDeleteController=IoDeleteController@4
253 IoDeleteDevice=IoDeleteDevice@4
254 IoDeleteSymbolicLink=IoDeleteSymbolicLink@4
255 IoDetachDevice=IoDetachDevice@4
256 IoDeviceHandlerObjectSize DATA
257 IoDeviceHandlerObjectType DATA
258 IoDeviceObjectType DATA
259 IoDisconnectInterrupt=IoDisconnectInterrupt@4
260 IoDriverObjectType DATA
261 IoEnqueueIrp=IoEnqueueIrp@4
262 IoFastQueryNetworkAttributes=IoFastQueryNetworkAttributes@20
263 IoFileObjectType DATA
264 IoFreeController=IoFreeController@4
265 IoFreeIrp=IoFreeIrp@4
266 IoFreeMdl=IoFreeMdl@4
267 IoGetAttachedDevice=IoGetAttachedDevice@4
268 IoGetAttachedDeviceReference=IoGetAttachedDeviceReference@4
269 IoGetBaseFileSystemDeviceObject=IoGetBaseFileSystemDeviceObject@4
270 IoGetConfigurationInformation=IoGetConfigurationInformation@0
271 IoGetCurrentProcess=IoGetCurrentProcess@0
272 IoGetDeviceObjectPointer=IoGetDeviceObjectPointer@16
273 IoGetDeviceToVerify=IoGetDeviceToVerify@4
274 IoGetFileObjectGenericMapping=IoGetFileObjectGenericMapping@0
275 IoGetInitialStack=IoGetInitialStack@0
276 IoGetRelatedDeviceObject=IoGetRelatedDeviceObject@4
277 IoGetRequestorProcess=IoGetRequestorProcess@4
278 IoGetStackLimits=IoGetStackLimits@8
279 IoGetTopLevelIrp=IoGetTopLevelIrp@0
280 IoInitializeIrp=IoInitializeIrp@12
281 IoInvalidateDeviceState=IoInvalidateDeviceState@4
282 IoInitializeRemoveLockEx=IoInitializeRemoveLockEx@20
283 IoInitializeTimer=IoInitializeTimer@12
284 IoIsOperationSynchronous=IoIsOperationSynchronous@4
285 IoMakeAssociatedIrp=IoMakeAssociatedIrp@8
286 IoOpenDeviceInstanceKey=IoOpenDeviceInstanceKey@20
287 IoPageRead=IoPageRead@20
288 IoQueryDeviceDescription=IoQueryDeviceDescription@32
289 IoQueryDeviceEnumInfo=IoQueryDeviceEnumInfo@8
290 IoQueryFileInformation=IoQueryFileInformation@20
291 IoQueryVolumeInformation=IoQueryVolumeInformation@20
292 IoQueueThreadIrp=IoQueueThreadIrp@4
293 IoRaiseHardError=IoRaiseHardError@12
294 IoRaiseInformationalHardError=IoRaiseInformationalHardError@12
295 IoReadOperationCount DATA
296 IoReadPartitionTable=IoReadPartitionTable@16
297 IoReadTransferCount DATA
299 IoFreeWorkItem=IoFreeWorkItem@4
300 IoAllocateWorkItem=IoAllocateWorkItem@4
301 IoQueueWorkItem=IoQueueWorkItem@16
302 IoRegisterDeviceInterface=IoRegisterDeviceInterface@16
303 IoSetDeviceInterfaceState=IoSetDeviceInterfaceState@8
304 IoGetDeviceProperty=IoGetDeviceProperty@20
305 IoOpenDeviceRegistryKey=IoOpenDeviceRegistryKey@16
306 IoInvalidateDeviceRelations=IoInvalidateDeviceRelations@8
308 IoRegisterDriverReinitialization=IoRegisterDriverReinitialization@12
309 IoRegisterFileSystem=IoRegisterFileSystem@4
310 IoRegisterFsRegistrationChange=IoRegisterFsRegistrationChange@8
311 IoRegisterShutdownNotification=IoRegisterShutdownNotification@4
312 IoReleaseCancelSpinLock=IoReleaseCancelSpinLock@4
313 IoReleaseRemoveLockAndWaitEx=IoReleaseRemoveLockAndWaitEx@12
314 IoReleaseRemoveLockEx=IoReleaseRemoveLockEx@12
315 IoReleaseVpbSpinLock=IoReleaseVpbSpinLock@4
316 IoRemoveShareAccess=IoRemoveShareAccess@8
317 IoReportHalResourceUsage=IoReportHalResourceUsage@16
318 IoReportResourceUsage=IoReportResourceUsage@36
319 IoSetDeviceToVerify=IoSetDeviceToVerify@8
320 IoSetHardErrorOrVerifyDevice=IoSetHardErrorOrVerifyDevice@8
321 IoSetInformation=IoSetInformation@16
322 IoSetPartitionInformation=IoSetPartitionInformation@16
323 IoSetShareAccess=IoSetShareAccess@16
324 IoSetThreadHardErrorMode=IoSetThreadHardErrorMode@4
325 IoSetTopLevelIrp=IoSetTopLevelIrp@4
326 IoStartNextPacket=IoStartNextPacket@8
327 IoStartNextPacketByKey=IoStartNextPacketByKey@12
328 IoStartPacket=IoStartPacket@16
329 IoStartTimer=IoStartTimer@4
330 IoStatisticsLock DATA
331 IoStopTimer=IoStopTimer@4
332 IoSynchronousPageWrite=IoSynchronousPageWrite@20
333 IoThreadToProcess=IoThreadToProcess@4
334 IoUnregisterFileSystem=IoUnregisterFileSystem@4
335 IoUnregisterFsRegistrationChange=IoUnregisterFsRegistrationChange@8
336 IoUnregisterShutdownNotification=IoUnregisterShutdownNotification@4
337 IoUpdateShareAccess=IoUpdateShareAccess@8
338 IoVerifyVolume=IoVerifyVolume@8
339 IoWriteErrorLogEntry=IoWriteErrorLogEntry@4
340 IoWriteOperationCount DATA
341 IoWritePartitionTable=IoWritePartitionTable@20
342 IoWriteTransferCount DATA
343 IofCallDriver=@IofCallDriver@8
344 IofCompleteRequest=@IofCompleteRequest@8
345 KdDebuggerEnabled DATA
346 KdDebuggerNotPresent DATA
347 KdPollBreakIn=KdPollBreakIn@0
348 KdSystemDebugControl=KdSystemDebugControl@4
349 Ke386CallBios=Ke386CallBios@8
350 ;Ke386IoSetAccessProcess
351 ;Ke386QueryIoAccessMap
353 KeAcquireSpinLockAtDpcLevel=KeAcquireSpinLockAtDpcLevel@4
354 KeAddSystemServiceTable=KeAddSystemServiceTable@20
355 KeAttachProcess=KeAttachProcess@4
356 ;KeBoostCurrentThread
357 KeBugCheck=KeBugCheck@4
358 KeBugCheckEx=KeBugCheckEx@20
359 KeCancelTimer=KeCancelTimer@4
360 KeClearEvent=KeClearEvent@4
361 KeConnectInterrupt=KeConnectInterrupt@4
362 KeDcacheFlushCount DATA
363 KeDelayExecutionThread=KeDelayExecutionThread@12
364 KeDeregisterBugCheckCallback=KeDeregisterBugCheckCallback@4
365 KeDetachProcess=KeDetachProcess@0
366 KeDisconnectInterrupt=KeDisconnectInterrupt@4
367 KeEnterCriticalRegion=KeEnterCriticalRegion@0
368 KeEnterKernelDebugger=KeEnterKernelDebugger@0
369 ;KeFindConfigurationEntry
370 ;KeFindConfigurationNextEntry
372 KeGetCurrentThread=KeGetCurrentThread@0
373 KeGetPreviousMode=KeGetPreviousMode@0
375 ;KeI386AllocateGdtSelectors
376 ;KeI386Call16BitCStyleFunction
377 ;KeI386Call16BitFunction
378 ;KeI386FlatToGdtSelector
380 ;KeI386MachineType DATA
381 ;KeI386ReleaseGdtSelectors
383 ;KeI386SetGdtSelector
384 KeIcacheFlushCount DATA
385 KeInitializeApc=KeInitializeApc@32
386 KeInitializeDeviceQueue=KeInitializeDeviceQueue@4
387 KeInitializeDpc=KeInitializeDpc@12
388 KeInitializeEvent=KeInitializeEvent@12
389 KeInitializeInterrupt=KeInitializeInterrupt@44
390 KeInitializeMutant=KeInitializeMutant@8
391 KeInitializeMutex=KeInitializeMutex@8
392 KeInitializeQueue=KeInitializeQueue@8
393 KeInitializeSemaphore=KeInitializeSemaphore@12
394 KeInitializeSpinLock=KeInitializeSpinLock@4
395 KeInitializeTimer=KeInitializeTimer@4
396 KeInitializeTimerEx=KeInitializeTimerEx@8
397 KeInsertByKeyDeviceQueue=KeInsertByKeyDeviceQueue@12
398 KeInsertDeviceQueue=KeInsertDeviceQueue@8
399 KeInsertHeadQueue=KeInsertHeadQueue@8
400 KeInsertQueue=KeInsertQueue@8
401 KeInsertQueueApc=KeInsertQueueApc@16
402 KeInsertQueueDpc=KeInsertQueueDpc@12
404 KeLeaveCriticalRegion=KeLeaveCriticalRegion@0
406 KeNumberProcessors DATA
408 ;KeProfileInterruptWithSource
409 KePulseEvent=KePulseEvent@12
410 KeQuerySystemTime=KeQuerySystemTime@4
411 KeQueryTickCount=KeQueryTickCount@4
412 KeQueryTimeIncrement=KeQueryTimeIncrement@0
413 ;KeRaiseUserException
414 KeRescheduleThread=KeRescheduleThread@0
415 KeReadStateEvent=KeReadStateEvent@4
416 KeReadStateMutant=KeReadStateMutant@4
417 KeReadStateMutex=KeReadStateMutex@4
418 KeReadStateQueue=KeReadStateQueue@4
419 KeReadStateSemaphore=KeReadStateSemaphore@4
420 KeReadStateTimer=KeReadStateTimer@4
421 KeRegisterBugCheckCallback=KeRegisterBugCheckCallback@20
422 KeReleaseMutant=KeReleaseMutant@16
423 KeReleaseMutex=KeReleaseMutex@8
424 KeReleaseSemaphore=KeReleaseSemaphore@16
425 KeReleaseSpinLockFromDpcLevel=KeReleaseSpinLockFromDpcLevel@4
426 KeRemoveByKeyDeviceQueue=KeRemoveByKeyDeviceQueue@8
427 KeRemoveDeviceQueue=KeRemoveDeviceQueue@4
428 KeRemoveEntryDeviceQueue=KeRemoveEntryDeviceQueue@8
429 KeRemoveQueue=KeRemoveQueue@12
430 KeRemoveQueueDpc=KeRemoveQueueDpc@4
431 KeResetEvent=KeResetEvent@4
432 ;KeRestoreFloatingPointState
433 KeRundownQueue=KeRundownQueue@4
434 ;KeSaveFloatingPointState
435 KeServiceDescriptorTable DATA
436 KeSetAffinityThread@8
437 KeSetBasePriorityThread=KeSetBasePriorityThread@8
439 KeSetEvent=KeSetEvent@12
440 ;KeSetEventBoostPriority
441 ;KeSetIdealProcessorThread
442 KeSetImportanceDpc=KeSetImportanceDpc@8
443 ;KeSetKernelStackSwapEnable
444 KeSetPriorityThread=KeSetPriorityThread@8
446 ;KeSetSwapContextNotifyRoutine
447 KeSetTargetProcessorDpc=KeSetTargetProcessorDpc@8
448 ;KeSetThreadSelectNotifyRoutine
450 KeSetTimer=KeSetTimer@16
451 KeSetTimerEx=KeSetTimerEx@20
452 ;KeSetTimeUpdateNotifyRoutine
453 KeSynchronizeExecution=KeSynchronizeExecution@12
458 KeWaitForMultipleObjects=KeWaitForMultipleObjects@32
459 KeWaitForMutexObject=KeWaitForMutexObject@20
460 KeWaitForSingleObject=KeWaitForSingleObject@20
461 ;KefAcquireSpinLockAtDpcLevel
462 ;KefReleaseSpinLockFromDpcLevel
466 ;KiCoprocessorError@0
467 KiDeliverApc=KiDeliverApc@12
468 KiDispatchInterrupt=KiDispatchInterrupt@0
469 KiInterruptDispatch2=KiInterruptDispatch2@8
470 ;KiIpiServiceRoutine@8
472 ;KiUnexpectedInterrupt
473 ;Kii386SpinOnSpinLock
475 LdrAccessResource=LdrAccessResource@16
477 ;LdrFindResourceDirectory_U@16
478 LdrFindResource_U=LdrFindResource_U@16
480 LsaCallAuthenticationPackage=LsaCallAuthenticationPackage@28
481 LsaDeregisterLogonProcess=LsaDeregisterLogonProcess@8
482 LsaFreeReturnBuffer=LsaFreeReturnBuffer@4
483 LsaLogonUser=LsaLogonUser@56
484 LsaLookupAuthenticationPackage=LsaLookupAuthenticationPackage@12
485 LsaRegisterLogonProcess=LsaRegisterLogonProcess@12
486 MmAdjustWorkingSetSize=MmAdjustWorkingSetSize@12
487 MmAllocateContiguousAlignedMemory=MmAllocateContiguousAlignedMemory@16
488 MmAllocateContiguousMemory=MmAllocateContiguousMemory@12
489 MmAllocateNonCachedMemory=MmAllocateNonCachedMemory@4
490 MmBuildMdlForNonPagedPool=MmBuildMdlForNonPagedPool@4
491 MmCanFileBeTruncated=MmCanFileBeTruncated@8
492 MmCopyFromCaller=MmCopyFromCaller@12
493 MmCopyToCaller=MmCopyToCaller@12
494 MmCreateMdl=MmCreateMdl@12
495 MmCreateSection=MmCreateSection@32
496 MmDbgTranslatePhysicalAddress=MmDbgTranslatePhysicalAddress@8
497 MmDisableModifiedWriteOfSection=MmDisableModifiedWriteOfSection@4
498 MmFlushImageSection=MmFlushImageSection@8
499 MmForceSectionClosed=MmForceSectionClosed@8
500 MmFreeContiguousMemory=MmFreeContiguousMemory@4
501 MmFreeNonCachedMemory=MmFreeNonCachedMemory@8
502 MmGetPhysicalAddress=MmGetPhysicalAddress@4
503 MmGrowKernelStack=MmGrowKernelStack@4
504 MmHighestUserAddress DATA
505 MmIsAddressValid=MmIsAddressValid@4
506 MmIsNonPagedSystemAddressValid=MmIsNonPagedSystemAddressValid@4
507 MmIsRecursiveIoFault=MmIsRecursiveIoFault@0
508 MmIsThisAnNtAsSystem=MmIsThisAnNtAsSystem@0
509 MmLockPagableDataSection=MmLockPagableDataSection@4
510 MmLockPagableImageSection=MmLockPagableDataSection@4
511 MmLockPagableSectionByHandle=MmLockPagableSectionByHandle@4
512 MmMapIoSpace=MmMapIoSpace@16
513 MmMapLockedPages=MmMapLockedPages@8
514 MmMapMemoryDumpMdl=MmMapMemoryDumpMdl@4
515 MmMapVideoDisplay=MmMapVideoDisplay@16
516 MmMapViewInSystemSpace=MmMapViewInSystemSpace@12
517 MmMapViewOfSection=MmMapViewOfSection@40
518 MmPageEntireDriver=MmPageEntireDriver@4
519 MmProbeAndLockPages=MmProbeAndLockPages@12
520 MmQuerySystemSize=MmQuerySystemSize@0
521 MmResetDriverPaging=MmResetDriverPaging@4
522 MmSectionObjectType DATA
523 MmSecureVirtualMemory=MmSecureVirtualMemory@12
524 MmSetAddressRangeModified=MmSetAddressRangeModified@8
525 MmSetBankedSection=MmSetBankedSection@24
526 MmSizeOfMdl=MmSizeOfMdl@8
527 MmUnlockPagableImageSection=MmUnlockPagableImageSection@4
528 MmUnlockPages=MmUnlockPages@4
529 MmUnmapIoSpace=MmUnmapIoSpace@8
530 MmUnmapLockedPages=MmUnmapLockedPages@8
531 MmUnmapVideoDisplay=MmUnmapVideoDisplay@8
532 MmUnmapViewInSystemSpace=MmUnmapViewInSystemSpace@4
533 MmUnmapViewOfSection=MmUnmapViewOfSection@8
534 MmUnsecureVirtualMemory=MmUnsecureVirtualMemory@4
535 MmUserProbeAddress DATA
538 NlsMbCodePageTag DATA
539 NlsMbOemCodePageTag DATA
540 NlsOemLeadByteInfo DATA
541 NtAddAtom=NtAddAtom@8
542 NtAdjustPrivilegesToken=NtAdjustPrivilegesToken@24
543 NtAlertThread=NtAlertThread@4
544 NtAllocateLocallyUniqueId=NtAllocateLocallyUniqueId@4
545 NtAllocateUuids=NtAllocateUuids@12
546 NtAllocateVirtualMemory=NtAllocateVirtualMemory@24
549 NtConnectPort=NtConnectPort@32
550 NtCreateEvent=NtCreateEvent@20
551 NtCreateTimer=NtCreateTimer@16
552 NtOpenEvent=NtOpenEvent@12
553 NtCreateFile=NtCreateFile@44
554 NtCreateSection=NtCreateSection@28
555 NtDeleteAtom=NtDeleteAtom@4
556 NtDeleteFile=NtDeleteFile@4
557 NtDeviceIoControlFile=NtDeviceIoControlFile@40
558 NtDuplicateObject=NtDuplicateObject@28
559 NtDuplicateToken=NtDuplicateToken@24
560 NtFindAtom=NtFindAtom@8
561 NtFreeVirtualMemory=NtFreeVirtualMemory@16
562 NtFsControlFile=NtFsControlFile@40
564 NtLockFile=NtLockFile@40
565 NtMapViewOfSection=NtMapViewOfSection@40
566 NtNotifyChangeDirectoryFile=NtNotifyChangeDirectoryFile@36
567 NtOpenFile=NtOpenFile@24
568 NtOpenProcess=NtOpenProcess@16
569 NtOpenProcessToken=NtOpenProcessToken@12
570 NtQueryDirectoryFile=NtQueryDirectoryFile@44
571 NtQueryEaFile=NtQueryEaFile@36
572 NtQueryInformationAtom=NtQueryInformationAtom@20
573 NtQueryInformationFile=NtQueryInformationFile@20
574 NtQueryInformationProcess=NtQueryInformationProcess@20
575 NtQueryInformationToken=NtQueryInformationToken@20
576 ;NtQueryOleDirectoryFile@44 <--- ?
577 NtQuerySecurityObject=NtQuerySecurityObject@20
578 NtQuerySystemTime=NtQuerySystemTime@4
579 NtQueryVolumeInformationFile=NtQueryVolumeInformationFile@20
580 NtReadFile=NtReadFile@36
581 NtRequestPort=NtRequestPort@8
582 NtRequestWaitReplyPort@12
583 NtSetEvent=NtSetEvent@8
584 NtSetInformationFile=NtSetInformationFile@20
585 NtSetInformationProcess=NtSetInformationProcess@16
586 NtSetInformationThread=NtSetInformationThread@16
587 NtSetSecurityObject=NtSetSecurityObject@12
588 NtSetSystemTime=NtSetSystemTime@8
589 NtUnlockFile=NtUnlockFile@20
590 NtVdmControl=NtVdmControl@8
591 NtW32Call=NtW32Call@20
592 NtWaitForSingleObject=NtWaitForSingleObject@12
593 NtWriteFile=NtWriteFile@36
594 ObAssignSecurity=ObAssignSecurity@16
595 ;ObCheckCreateObjectAccess=ObCheckCreateObjectAccess@28
596 ;ObCheckObjectAccess=ObCheckObjectAccess@20
597 ;ObCreateObject=ObCreateObject@36
598 ObCreateObject=ObCreateObject@20
599 ;ObFindHandleForObject=ObFindHandleForObject@20
600 ObGetObjectPointerCount=ObGetObjectPointerCount@4
601 ObGetObjectSecurity=ObGetObjectSecurity@12
602 ;ObInsertObject=ObInsertObject@24
603 ObMakeTemporaryObject=ObMakeTemporaryObject@4
604 ObOpenObjectByName=ObOpenObjectByName@28
605 ObOpenObjectByPointer=ObOpenObjectByPointer@28
606 ;ObQueryNameString=ObQueryNameString@16
607 ;ObQueryObjectAuditingByHandle=ObQueryObjectAuditingByHandle@8
608 ObfDereferenceObject=@ObfDereferenceObject@4
609 ObfReferenceObject=@ObfReferenceObject@4
610 ObReferenceObjectByHandle=ObReferenceObjectByHandle@24
611 ObReferenceObjectByName=ObReferenceObjectByName@32
612 ObReferenceObjectByPointer=ObReferenceObjectByPointer@16
613 ObReleaseObjectSecurity=ObReleaseObjectSecurity@8
614 ;ObSetSecurityDescriptorInfo=ObSetSecurityDescriptorInfo@24
619 PoCallDriver=PoCallDriver@8
620 PoRegisterDeviceForIdleDetection=PoRegisterDeviceForIdleDetection@16
621 PoRegisterSystemState=PoRegisterSystemState@8
622 PoRequestPowerIrp=PoRequestPowerIrp@24
623 PoSetDeviceBusy=PoSetDeviceBusy@4
624 PoSetPowerState=PoSetPowerState@12
625 PoSetSystemState=PoSetSystemState@4
626 PoStartNextPowerIrp=PoStartNextPowerIrp@4
627 PoUnregisterSystemState=PoUnregisterSystemState@4
628 ;ProbeForWrite=ProbeForWrite@12
629 PsAssignImpersonationToken=PsAssignImpersonationToken@8
630 ;PsChargePoolQuota=PsChargePoolQuota@12
631 PsCreateSystemProcess=PsCreateSystemProcess@12
632 PsCreateSystemThread=PsCreateSystemThread@28
633 PsCreateWin32Thread=PsCreateWin32Thread@4
634 PsCreateWin32Process=PsCreateWin32Process@4
635 PsGetWin32Thread=PsGetWin32Thread@0
636 PsGetWin32Process=PsGetWin32Process@0
637 PsEstablishWin32Callouts=PsEstablishWin32Callouts@24
638 PsGetCurrentProcessId=PsGetCurrentProcessId@0
639 PsGetCurrentThreadId=PsGetCurrentThreadId@0
640 PsGetProcessExitTime=PsGetProcessExitTime@0
641 PsGetVersion=PsGetVersion@16
642 PsImpersonateClient=PsImpersonateClient@20
643 PsInitialSystemProcess DATA
644 PsIsThreadTerminating=PsIsThreadTerminating@4
645 PsLookupProcessByProcessId=PsLookupProcessByProcessId@8
646 PsLookupProcessThreadByCid=PsLookupProcessThreadByCid@12
647 PsLookupThreadByThreadId=PsLookupThreadByThreadId@8
649 PsReferenceImpersonationToken=PsReferenceImpersonationToken@16
650 PsReferencePrimaryToken=PsReferencePrimaryToken@4
652 PsRevertToSelf=PsRevertToSelf@0
653 PsSetCreateProcessNotifyRoutine=PsSetCreateProcessNotifyRoutine@8
654 PsSetCreateThreadNotifyRoutine=PsSetCreateThreadNotifyRoutine@4
655 ;PsSetLegoNotifyRoutine
656 ;PsSetProcessPriorityByClass
657 PsTerminateSystemThread=PsTerminateSystemThread@4
659 READ_REGISTER_UCHAR=READ_REGISTER_UCHAR@4
660 READ_REGISTER_ULONG=READ_REGISTER_ULONG@4
661 READ_REGISTER_USHORT=READ_REGISTER_USHORT@4
662 READ_REGISTER_BUFFER_UCHAR=READ_REGISTER_BUFFER_UCHAR@12
663 READ_REGISTER_BUFFER_ULONG=READ_REGISTER_BUFFER_ULONG@12
664 READ_REGISTER_BUFFER_USHORT=READ_REGISTER_BUFFER_USHORT@12
665 RtlAbsoluteToSelfRelativeSD=RtlAbsoluteToSelfRelativeSD@12
666 RtlAddAccessAllowedAce=RtlAddAccessAllowedAce@16
667 RtlAddAce=RtlAddAce@20
668 RtlAddAtomToAtomTable=RtlAddAtomToAtomTable@12
669 ;RtlAllocateAndInitializeSid
671 RtlAnsiCharToUnicodeChar=RtlAnsiCharToUnicodeChar@4
672 RtlAnsiStringToUnicodeSize=RtlAnsiStringToUnicodeSize@4
673 RtlAnsiStringToUnicodeString=RtlAnsiStringToUnicodeString@12
674 RtlAppendAsciizToString=RtlAppendAsciizToString@8
675 RtlAppendStringToString=RtlAppendStringToString@8
676 RtlAppendUnicodeStringToString=RtlAppendUnicodeStringToString@8
677 RtlAppendUnicodeToString=RtlAppendUnicodeToString@8
678 RtlAreAllAccessesGranted=RtlAreAllAccessesGranted@8
679 RtlAreAnyAccessesGranted=RtlAreAnyAccessesGranted@8
680 RtlAreBitsClear=RtlAreBitsClear@12
681 RtlAreBitsSet=RtlAreBitsSet@12
682 RtlAssert=RtlAssert@16
683 ;RtlCaptureStackBackTrace
684 RtlCharToInteger=RtlCharToInteger@12
685 RtlCheckRegistryKey=RtlCheckRegistryKey@8
686 RtlClearAllBits=RtlClearAllBits@4
687 RtlClearBits=RtlClearBits@12
688 RtlCompareMemory=RtlCompareMemory@12
689 RtlCompareMemoryUlong=RtlCompareMemoryUlong@12
690 RtlCompareString=RtlCompareString@12
691 RtlCompareUnicodeString=RtlCompareUnicodeString@12
692 RtlCompressBuffer=RtlCompressBuffer@32
693 RtlCompressChunks=RtlCompressChunks@28
694 RtlConvertLongToLargeInteger=RtlConvertLongToLargeInteger@4
695 RtlConvertSidToUnicodeString=RtlConvertSidToUnicodeString@12
696 RtlConvertUlongToLargeInteger=RtlConvertUlongToLargeInteger@4
697 RtlCopyLuid=RtlCopyLuid@8
698 RtlCopySid=RtlCopySid@12
699 RtlCopyString=RtlCopyString@8
700 RtlCopyUnicodeString=RtlCopyUnicodeString@8
701 RtlCreateAcl=RtlCreateAcl@12
702 RtlCreateAtomTable=RtlCreateAtomTable@8
704 RtlCreateRegistryKey=RtlCreateRegistryKey@8
705 RtlCreateSecurityDescriptor=RtlCreateSecurityDescriptor@8
706 RtlCreateUnicodeString=RtlCreateUnicodeString@8
707 RtlCustomCPToUnicodeN=RtlCustomCPToUnicodeN@24
708 RtlDecompressBuffer=RtlDecompressBuffer@24
709 RtlDecompressChunks=RtlDecompressChunks@28
710 RtlDecompressFragment=RtlDecompressFragment@32
712 RtlDeleteAtomFromAtomTable=RtlDeleteAtomFromAtomTable@8
713 ;RtlDeleteElementGenericTable
715 RtlDeleteRegistryValue=RtlDeleteRegistryValue@12
716 RtlDescribeChunk=RtlDescribeChunk@20
717 RtlDestroyAtomTable=RtlDestroyAtomTable@4
719 RtlDowncaseUnicodeString=RtlDowncaseUnicodeString@12
720 RtlEmptyAtomTable=RtlEmptyAtomTable@8
721 RtlEnlargedIntegerMultiply=RtlEnlargedIntegerMultiply@8
722 RtlEnlargedUnsignedDivide=RtlEnlargedUnsignedDivide@16
723 RtlEnlargedUnsignedMultiply=RtlEnlargedUnsignedMultiply@8
724 ;RtlEnumerateGenericTable
725 ;RtlEnumerateGenericTableWithoutSplaying
726 RtlEqualLuid=RtlEqualLuid@8
727 RtlEqualSid=RtlEqualSid@8
728 RtlEqualString=RtlEqualString@12
729 RtlEqualUnicodeString=RtlEqualUnicodeString@12
730 RtlExtendedIntegerMultiply=RtlExtendedIntegerMultiply@12
731 RtlExtendedLargeIntegerDivide=RtlExtendedLargeIntegerDivide@16
732 RtlExtendedMagicDivide=RtlExtendedMagicDivide@20
733 RtlFillMemory=RtlFillMemory@12
734 RtlFillMemoryUlong=RtlFillMemoryUlong@12
735 RtlFindClearBits=RtlFindClearBits@12
736 RtlFindClearBitsAndSet=RtlFindClearBitsAndSet@12
737 RtlFindFirstRunClear=RtlFindFirstRunClear@8
738 RtlFindFirstRunSet=RtlFindFirstRunSet@8
739 RtlFindLongestRunClear=RtlFindLongestRunClear@8
740 RtlFindLongestRunSet=RtlFindLongestRunSet@8
741 RtlFindMessage=RtlFindMessage@20
742 RtlFindSetBits=RtlFindSetBits@12
743 RtlFindSetBitsAndClear=RtlFindSetBitsAndClear@12
744 ;RtlFindUnicodePrefix
745 RtlFormatCurrentUserKeyPath=RtlFormatCurrentUserKeyPath@4
746 RtlFreeAnsiString=RtlFreeAnsiString@4
748 RtlFreeOemString=RtlFreeOemString@4
749 RtlFreeUnicodeString=RtlFreeUnicodeString@4
750 RtlGenerate8dot3Name=RtlGenerate8dot3Name@16
751 ;RtlGetCallersAddress
752 RtlGetCompressionWorkSpaceSize=RtlGetCompressionWorkSpaceSize@12
753 RtlGetDaclSecurityDescriptor=RtlGetDaclSecurityDescriptor@16
754 RtlGetDefaultCodePage=RtlGetDefaultCodePage@8
755 ;RtlGetElementGenericTable
756 RtlGetGroupSecurityDescriptor=RtlGetGroupSecurityDescriptor@12
757 RtlGetOwnerSecurityDescriptor=RtlGetOwnerSecurityDescriptor@12
758 RtlImageNtHeader=RtlImageNtHeader@4
759 RtlInitAnsiString=RtlInitAnsiString@8
760 ;RtlInitCodePageTable
761 RtlInitString=RtlInitString@8
762 RtlInitUnicodeString=RtlInitUnicodeString@8
763 RtlInitializeBitMap=RtlInitializeBitMap@12
764 ;RtlInitializeGenericTable
765 RtlInitializeSid=RtlInitializeSid@12
766 ;RtlInitializeUnicodePrefix
767 ;RtlInsertElementGenericTable
768 ;RtlInsertUnicodePrefix
769 RtlIntegerToChar=RtlIntegerToChar@16
770 RtlIntegerToUnicodeString=RtlIntegerToUnicodeString@12
771 RtlIsNameLegalDOS8Dot3=RtlIsNameLegalDOS8Dot3@12
772 RtlLargeIntegerAdd=RtlLargeIntegerAdd@16
773 RtlLargeIntegerArithmeticShift=RtlLargeIntegerArithmeticShift@12
774 RtlLargeIntegerDivide=RtlLargeIntegerDivide@20
775 RtlLargeIntegerNegate=RtlLargeIntegerNegate@8
776 RtlLargeIntegerShiftLeft=RtlLargeIntegerShiftLeft@12
777 RtlLargeIntegerShiftRight=RtlLargeIntegerShiftRight@12
778 RtlLargeIntegerSubtract=RtlLargeIntegerSubtract@16
779 RtlLengthRequiredSid=RtlLengthRequiredSid@4
780 RtlLengthSecurityDescriptor=RtlLengthSecurityDescriptor@4
781 RtlLengthSid=RtlLengthSid@4
782 RtlLookupAtomInAtomTable=RtlLookupAtomInAtomTable@12
783 ;RtlLookupElementGenericTable
784 RtlMapGenericMask=RtlMapGenericMask@8
785 RtlMoveMemory=RtlMoveMemory@12
786 RtlMultiByteToUnicodeN=RtlMultiByteToUnicodeN@20
787 RtlMultiByteToUnicodeSize=RtlMultiByteToUnicodeSize@12
788 ;RtlNextUnicodePrefix
789 RtlNtStatusToDosError=RtlNtStatusToDosError@4
790 RtlNtStatusToDosErrorNoTeb=RtlNtStatusToDosErrorNoTeb@4
791 ;RtlNumberGenericTableElements
792 RtlNumberOfClearBits=RtlNumberOfClearBits@4
793 RtlNumberOfSetBits=RtlNumberOfSetBits@4
794 RtlOemStringToCountedUnicodeString=RtlOemStringToCountedUnicodeString@12
795 RtlOemStringToUnicodeSize=RtlOemStringToUnicodeSize@4
796 RtlOemStringToUnicodeString=RtlOemStringToUnicodeString@12
797 RtlPinAtomInAtomTable=RtlPinAtomInAtomTable@8
798 RtlPrefixString=RtlPrefixString@12
799 RtlPrefixUnicodeString=RtlPrefixUnicodeString@12
800 RtlQueryAtomInAtomTable=RtlQueryAtomInAtomTable@24
801 RtlQueryRegistryValues=RtlQueryRegistryValues@20
802 RtlQueryTimeZoneInformation=RtlQueryTimeZoneInformation@4
803 RtlRaiseException=RtlRaiseException@4
805 ;RtlRemoveUnicodePrefix
806 RtlReserveChunk=RtlReserveChunk@20
807 RtlSecondsSince1970ToTime=RtlSecondsSince1970ToTime@8
808 RtlSecondsSince1980ToTime=RtlSecondsSince1980ToTime@8
809 RtlSetAllBits=RtlSetAllBits@4
810 RtlSetBits=RtlSetBits@12
811 RtlSetDaclSecurityDescriptor=RtlSetDaclSecurityDescriptor@16
812 RtlSetGroupSecurityDescriptor=RtlSetGroupSecurityDescriptor@12
813 RtlSetOwnerSecurityDescriptor=RtlSetOwnerSecurityDescriptor@12
814 RtlSetSaclSecurityDescriptor=RtlSetSaclSecurityDescriptor@16
815 RtlSetTimeZoneInformation=RtlSetTimeZoneInformation@4
817 RtlSubAuthorityCountSid=RtlSubAuthorityCountSid@4
818 RtlSubAuthoritySid=RtlSubAuthoritySid@8
819 RtlTimeFieldsToTime=RtlTimeFieldsToTime@8
820 RtlTimeToSecondsSince1970=RtlTimeToSecondsSince1970@8
821 RtlTimeToSecondsSince1980=RtlTimeToSecondsSince1980@8
822 RtlTimeToTimeFields=RtlTimeToTimeFields@8
823 RtlUnicodeStringToAnsiSize=RtlUnicodeStringToAnsiSize@4
824 RtlUnicodeStringToAnsiString=RtlUnicodeStringToAnsiString@12
825 RtlUnicodeStringToCountedOemString=RtlUnicodeStringToCountedOemString@12
826 RtlUnicodeStringToInteger=RtlUnicodeStringToInteger@12
827 RtlUnicodeStringToOemSize=RtlUnicodeStringToOemSize@4
828 RtlUnicodeStringToOemString=RtlUnicodeStringToOemString@12
829 RtlUnicodeToCustomCPN=RtlUnicodeToCustomCPN@24
830 RtlUnicodeToMultiByteN=RtlUnicodeToMultiByteN@20
831 RtlUnicodeToMultiByteSize=RtlUnicodeToMultiByteSize@12
832 RtlUnicodeToOemN=RtlUnicodeToOemN@20
833 RtlUnwind=RtlUnwind@16
834 RtlUpcaseUnicodeChar=RtlUpcaseUnicodeChar@4
835 RtlUpcaseUnicodeString=RtlUpcaseUnicodeString@12
836 RtlUpcaseUnicodeStringToAnsiString=RtlUpcaseUnicodeStringToAnsiString@12
837 RtlUpcaseUnicodeStringToCountedOemString=RtlUpcaseUnicodeStringToCountedOemString@12
838 RtlUpcaseUnicodeStringToOemString=RtlUpcaseUnicodeStringToOemString@12
839 RtlUpcaseUnicodeToCustomCPN=RtlUpcaseUnicodeToCustomCPN@24
840 RtlUpcaseUnicodeToMultiByteN=RtlUpcaseUnicodeToMultiByteN@20
841 RtlUpcaseUnicodeToOemN=RtlUpcaseUnicodeToOemN@20
842 RtlUpperChar=RtlUpperChar@4
843 RtlUpperString=RtlUpperString@8
844 RtlValidSecurityDescriptor=RtlValidSecurityDescriptor@4
845 RtlValidSid=RtlValidSid@4
846 RtlWriteRegistryValue=RtlWriteRegistryValue@24
848 RtlZeroMemory=RtlZeroMemory@8
849 RtlxAnsiStringToUnicodeSize=RtlxAnsiStringToUnicodeSize@4
850 RtlxOemStringToUnicodeSize=RtlxOemStringToUnicodeSize@4
851 RtlxUnicodeStringToAnsiSize=RtlxUnicodeStringToAnsiSize@4
852 RtlxUnicodeStringToOemSize=RtlxUnicodeStringToOemSize@4
853 SeAccessCheck=SeAccessCheck@40
854 ;SeAppendPrivileges=SeAppendPrivileges@8
855 SeAssignSecurity=SeAssignSecurity@28
856 ;SeAuditingFileEvents=SeAuditingFileEvents@8
857 ;SeAuditingFileOrGlobalEvents=SeAuditingFileOrGlobalEvents@18
858 ;SeCaptureSecurityDescriptor=SeCaptureSecurityDescriptor@20
859 SeCaptureSubjectContext=SeCaptureSubjectContext@4
860 ;SeCloseObjectAuditAlarm=SeCloseObjectAuditAlarm@12
861 ;SeCreateAccessState=SeCreateAccessState@16
862 SeCreateClientSecurity=SeCreateClientSecurity@16
863 SeDeassignSecurity=SeDeassignSecurity@4
864 ;SeDeleteAccessState=SeDeleteAccessState@4
865 ;SeDeleteObjectAuditAlarm=SeDeleteObjectAuditAlarm@8
867 ;SeFreePrivileges=SeFreePrivileges@4
868 SeImpersonateClient=SeImpersonateClient@8
869 ;SeLockSubjectContext=SeLockSubjectContext@4
870 ;SeMarkLogonSessionForTerminationNotification=SeMarkLogonSessionForTerminationNotification@4
871 ;SeOpenObjectAuditAlarm=SeOpenObjectAuditAlarm@36
872 ;SeOpenObjectForDeleteAuditAlarm=SeOpenObjectForDeleteAuditAlarm@36
873 SePrivilegeCheck=SePrivilegeCheck@12
874 ;SePrivilegeObjectAuditAlarm=SePrivilegeObjectAuditAlarm@24
875 SePublicDefaultDacl DATA
876 ;SeQueryAuthenticationIdToken=SeQueryAuthenticationIdToken@8
877 ;SeQuerySecurityDescriptorInfo=SeQuerySecurityDescriptorInfo@16
878 ;SeRegisterLogonSessionTerminatedRoutine=SeRegisterLogonSessionTerminatedRoutine@4
879 ;SeReleaseSecurityDescriptor=SeReleaseSecurityDescriptor@12
880 SeReleaseSubjectContext=SeReleaseSubjectContext@4
881 ;SeSetAccessStateGenericMapping=SeSetAccessStateGenericMapping@8
882 ;SeSetSecurityDescriptorInfo=SeSetSecurityDescriptorInfo@24
883 SeSinglePrivilegeCheck=SeSinglePrivilegeCheck@12
884 SeSystemDefaultDacl DATA
885 SeTokenImpersonationLevel=SeTokenImpersonationLevel@4
886 SeTokenType=SeTokenType@4
887 ;SeUnlockSubjectContext=SeUnlockSubjectContext@4
888 ;SeUnregisterLogonSessionTerminatedRoutine=SeUnregisterLogonSessionTerminatedRoutine@4
889 ;SeValidSecurityDescriptor=SeValidSecurityDescriptor@8
890 WRITE_REGISTER_UCHAR=WRITE_REGISTER_UCHAR@8
891 WRITE_REGISTER_ULONG=WRITE_REGISTER_ULONG@8
892 WRITE_REGISTER_USHORT=WRITE_REGISTER_USHORT@8
893 WRITE_REGISTER_BUFFER_UCHAR=WRITE_REGISTER_BUFFER_UCHAR@12
894 WRITE_REGISTER_BUFFER_ULONG=WRITE_REGISTER_BUFFER_ULONG@12
895 WRITE_REGISTER_BUFFER_USHORT=WRITE_REGISTER_BUFFER_USHORT@12
896 ZwAccessCheckAndAuditAlarm=ZwAccessCheckAndAuditAlarm@44
897 ZwAlertThread=ZwAlertThread@4
898 ZwAllocateVirtualMemory=ZwAllocateVirtualMemory@24
899 ZwClearEvent=ZwClearEvent@4
901 ZwCloseObjectAuditAlarm=ZwCloseObjectAuditAlarm@12
902 ZwConnectPort=ZwConnectPort@32
903 ZwCreateDirectoryObject=ZwCreateDirectoryObject@12
904 ZwCreateEvent=ZwCreateEvent@20
905 ZwCreateFile=ZwCreateFile@44
906 ZwCreateKey=ZwCreateKey@28
907 ZwCreateSection=ZwCreateSection@28
908 ZwCreateSymbolicLinkObject=ZwCreateSymbolicLinkObject@16
909 ZwDeleteFile=ZwDeleteFile@4
910 ZwDeleteKey=ZwDeleteKey@4
911 ZwDeleteValueKey=ZwDeleteValueKey@8
912 ZwDeviceIoControlFile=ZwDeviceIoControlFile@40
913 ZwDisplayString=ZwDisplayString@4
914 ZwDuplicateObject=ZwDuplicateObject@28
915 ZwDuplicateToken=ZwDuplicateToken@24
916 ZwEnumerateKey=ZwEnumerateKey@24
917 ZwEnumerateValueKey=ZwEnumerateValueKey@24
918 ZwFlushInstructionCache=ZwFlushInstructionCache@12
919 ZwFlushKey=ZwFlushKey@4
920 ZwFreeVirtualMemory=ZwFreeVirtualMemory@16
921 ZwFsControlFile=ZwFsControlFile@40
922 ZwLoadDriver=ZwLoadDriver@4
923 ZwLoadKey=ZwLoadKey@8
924 ZwMakeTemporaryObject=ZwMakeTemporaryObject@4
925 ZwMapViewOfSection=ZwMapViewOfSection@40
926 ZwNotifyChangeKey=ZwNotifyChangeKey@40
927 ZwOpenDirectoryObject=ZwOpenDirectoryObject@12
928 ZwOpenEvent=ZwOpenEvent@12
929 ZwOpenFile=ZwOpenFile@24
930 ZwOpenKey=ZwOpenKey@12
931 ZwOpenProcess=ZwOpenProcess@16
932 ZwOpenProcessToken=ZwOpenProcessToken@12
933 ZwOpenSection=ZwOpenSection@12
934 ZwOpenSymbolicLinkObject=ZwOpenSymbolicLinkObject@12
935 ZwOpenThread=ZwOpenThread@16
936 ZwOpenThreadToken=ZwOpenThreadToken@16
937 ZwPulseEvent=ZwPulseEvent@8
938 ZwQueryDefaultLocale=ZwQueryDefaultLocale@8
939 ZwQueryDirectoryFile=ZwQueryDirectoryFile@44
940 ZwQueryInformationAtom=ZwQueryInformationAtom@20
941 ZwQueryInformationFile=ZwQueryInformationFile@20
942 ZwQueryInformationProcess=ZwQueryInformationProcess@20
943 ZwQueryInformationToken=ZwQueryInformationToken@20
944 ZwQueryKey=ZwQueryKey@20
945 ZwQueryObject=ZwQueryObject@20
946 ZwQuerySection=ZwQuerySection@20
947 ZwQuerySecurityObject=ZwQuerySecurityObject@20
948 ZwQuerySymbolicLinkObject=ZwQuerySymbolicLinkObject@12
949 ZwQuerySystemInformation=ZwQuerySystemInformation@16
950 ZwQuerySystemTime=ZwQuerySystemTime@4
951 ZwQueryValueKey=ZwQueryValueKey@24
952 ZwQueryVolumeInformationFile=ZwQueryVolumeInformationFile@20
953 ZwReadFile=ZwReadFile@36
954 ZwReplaceKey=ZwReplaceKey@12
955 ZwRequestWaitReplyPort=ZwRequestWaitReplyPort@12
956 ZwResetEvent=ZwResetEvent@8
957 ZwSaveKey=ZwSaveKey@8
958 ZwSetDefaultLocale=ZwSetDefaultLocale@8
959 ZwSetEvent=ZwSetEvent@8
960 ZwSetInformationFile=ZwSetInformationFile@20
961 ZwSetInformationObject=ZwSetInformationObject@16
962 ZwSetInformationProcess=ZwSetInformationProcess@16
963 ZwSetInformationThread=ZwSetInformationThread@16
964 ZwSetSystemInformation=ZwSetSystemInformation@12
965 ZwSetSystemTime=ZwSetSystemTime@8
966 ZwSetValueKey=ZwSetValueKey@24
967 ZwTerminateProcess=ZwTerminateProcess@8
968 ZwUnloadDriver=ZwUnloadDriver@4
969 ZwUnloadKey=ZwUnloadKey@4
970 ZwUnmapViewOfSection=ZwUnmapViewOfSection@8
971 ZwWaitForMultipleObjects=ZwWaitForMultipleObjects@20
972 ZwWaitForSingleObject=ZwWaitForSingleObject@12
973 ZwWriteFile=ZwWriteFile@36
974 ZwYieldExecution=ZwYieldExecution@0
975 _abnormal_termination