3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
13 CcGetFileObjectFromSectionPtrs@4
16 CcSetDirtyPinnedData@8
21 DbgBreakPointWithStatus@4
22 ;DbgLoadImageSymbols@12
26 @ExAcquireFastMutexUnsafe@4
27 ExAcquireResourceExclusive@8
28 ExAcquireResourceExclusiveLite@8
29 ExAcquireResourceSharedLite@8
30 ExAcquireSharedStarveExclusive@8
31 ExAcquireSharedWaitForExclusive@8
32 ExAllocateFromPagedLookasideList@4
34 ExAllocatePoolWithQuota@8
35 ExAllocatePoolWithQuotaTag@12
36 ExAllocatePoolWithTag@12
37 ExConvertExclusiveToSharedLite@4
39 ExDeleteNPagedLookasideList@4
40 ExDeletePagedLookasideList@4
42 ExDeleteResourceLite@4
43 ExDesktopObjectType DATA
44 ExDisableResourceBoostLite@4
45 ExEventObjectType DATA
48 ExFreeToPagedLookasideList@8
49 ExGetExclusiveWaiterCount@4
51 ExGetSharedWaiterCount@4
52 ExInitializeNPagedLookasideList@28
53 ExInitializePagedLookasideList@28
54 ExInitializeResource@4
55 ExInitializeResourceLite@4
57 ExInterlockedAddLargeInteger@16
58 @ExInterlockedAddLargeStatistic@8
59 ExInterlockedAddUlong@12
60 @ExInterlockedCompareExchange64@16
61 ExInterlockedDecrementLong@8
62 ExInterlockedExchangeUlong@12
63 ExInterlockedExtendZone@16
64 ExInterlockedIncrementLong@8
65 ExInterlockedInsertHeadList@12
66 ExInterlockedInsertTailList@12
67 ExInterlockedPopEntryList@8
68 @ExInterlockedPopEntrySList@8
69 ExInterlockedPushEntryList@12
70 @ExInterlockedPushEntrySList@12
71 ExInterlockedRemoveHeadList@8
72 ExIsProcessorFeaturePresent@4
73 ExIsResourceAcquiredExclusiveLite@4
74 ExIsResourceAcquiredSharedLite@4
75 ExLocalTimeToSystemTime@8
80 ExRaiseAccessViolation@0
81 ExRaiseDatatypeMisalignment@0
86 ExReinitializeResourceLite@4
87 @ExReleaseFastMutexUnsafe@4
88 ExReleaseResourceForThread@8
89 ExReleaseResourceForThreadLite@8
90 @ExReleaseResourceLite@4
91 ExSetResourceOwnerPointer@8
92 ;ExSystemExceptionFilter
93 ExSystemTimeToLocalTime@8
94 ExTryToAcquireResourceExclusiveLite@4
95 ExUnregisterCallback@4
96 ExWindowStationObjectType DATA
97 ExInitializeBinaryTree@12
100 ExSearchBinaryTree@12
101 ExRemoveBinaryTree@12
102 ExTraverseBinaryTree@16
103 ExInitializeSplayTree@16
108 ExWeightOfSplayTree@8
109 ExTraverseSplayTree@16
110 ExInitializeHashTable@16
115 @ExfInterlockedAddUlong@12
116 @ExfInterlockedInsertHeadList@12
117 @ExfInterlockedInsertTailList@12
118 @ExfInterlockedPopEntryList@8
119 @ExfInterlockedPushEntryList@12
120 @ExfInterlockedRemoveHeadList@8
121 @Exfi386InterlockedDecrementLong@4
122 @Exfi386InterlockedExchangeUlong@8
123 @Exfi386InterlockedIncrementLong@4
124 Exi386InterlockedDecrementLong@4
125 Exi386InterlockedExchangeUlong@8
126 Exi386InterlockedIncrementLong@4
127 FsRtlAddLargeMcbEntry@28
129 FsRtlAddToTunnelCache@32
130 FsRtlAllocateFileLock@8
132 FsRtlAllocatePoolWithQuota@8
133 FsRtlAllocatePoolWithQuotaTag@12
134 FsRtlAllocatePoolWithTag@12
135 FsRtlAllocateResource@0
136 FsRtlAreNamesEqual@16
138 FsRtlCheckLockForReadAccess@8
139 FsRtlCheckLockForWriteAccess@8
143 FsRtlCurrentBatchOplock@4
144 FsRtlDeleteKeyFromTunnelCache@12
145 FsRtlDeleteTunnelCache@4
146 FsRtlDeregisterUncProvider@4
149 FsRtlDoesDbcsContainWildCards@4
150 FsRtlDoesNameContainWildCards@4
151 FsRtlFastCheckLockForRead@24
152 FsRtlFastCheckLockForWrite@24
153 FsRtlFastUnlockAll@16
154 FsRtlFastUnlockAllByKey@20
155 FsRtlFastUnlockSingle@32
156 FsRtlFindInTunnelCache@32
158 FsRtlGetNextFileLock@8
159 FsRtlGetNextLargeMcbEntry@20
160 FsRtlGetNextMcbEntry@20
161 FsRtlInitializeFileLock@12
162 FsRtlInitializeLargeMcb@8
164 FsRtlInitializeOplock@4
165 FsRtlInitializeTunnelCache@4
166 FsRtlIsDbcsInExpression@8
167 FsRtlIsFatDbcsLegal@20
168 FsRtlIsHpfsDbcsLegal@20
169 FsRtlIsNameInExpression@16
170 FsRtlIsNtstatusExpected@4
171 FsRtlIsTotalDeviceFailure@4
172 FsRtlLegalAnsiCharacterArray DATA
173 FsRtlLookupLargeMcbEntry@32
174 FsRtlLookupLastLargeMcbEntry@12
175 FsRtlLookupLastMcbEntry@12
176 FsRtlLookupMcbEntry@20
178 FsRtlMdlReadComplete@8
179 FsRtlMdlReadCompleteDev@12
181 FsRtlMdlWriteComplete@12
182 FsRtlMdlWriteCompleteDev@16
183 FsRtlNormalizeNtstatus@8
184 FsRtlNotifyChangeDirectory@28
185 FsRtlNotifyCleanup@12
186 FsRtlNotifyFullChangeDirectory@40
187 FsRtlNotifyFullReportChange@36
188 FsRtlNotifyInitializeSync@4
189 FsRtlNotifyReportChange@20
190 FsRtlNotifyUninitializeSync@4
191 FsRtlNotifyVolumeEvent@8
192 FsRtlNumberOfRunsInLargeMcb@4
193 FsRtlNumberOfRunsInMcb@4
195 FsRtlOplockIsFastIoPossible@4
196 FsRtlPostPagingFileStackOverflow@12
197 FsRtlPostStackOverflow@12
198 FsRtlPrepareMdlWrite@24
199 FsRtlPrepareMdlWriteDev@28
201 FsRtlProcessFileLock@12
202 FsRtlRegisterUncProvider@12
203 FsRtlRemoveLargeMcbEntry@20
204 FsRtlRemoveMcbEntry@12
205 FsRtlSplitLargeMcb@20
207 FsRtlTruncateLargeMcb@12
209 FsRtlUninitializeFileLock@4
210 FsRtlUninitializeLargeMcb@4
211 FsRtlUninitializeMcb@4
212 FsRtlUninitializeOplock@4
213 HalDispatchTable DATA
214 HalPrivateDispatchTable DATA
215 InbvAcquireDisplayOwnership@0
216 InbvCheckDisplayOwnership@0
218 InbvEnableBootDriver@4
219 InbvEnableDisplayString@4
220 InbvInstallDisplayStringFilter@4
221 InbvIsBootDriverInstalled@0
222 InbvNotifyDisplayOwnershipLost@4
224 InbvSetScrollRegion@16
226 InbvSolidColorFill@20
227 @InterlockedCompareExchange@12
228 @InterlockedDecrement@4
229 @InterlockedExchange@8
230 @InterlockedExchangeAdd@8
231 @InterlockedIncrement@4
232 @InterlockedPopEntrySList@4
233 @InterlockedPushEntrySList@8
234 IoAcquireCancelSpinLock@4
235 IoAcquireRemoveLockEx@20
236 IoAcquireVpbSpinLock@4
237 IoAdapterObjectType DATA
238 IoAllocateAdapterChannel@20
239 IoAllocateController@16
240 IoAllocateErrorLogEntry@8
245 IoAttachDeviceByPointer@8
246 IoAttachDeviceToDeviceStack@8
247 IoBuildAsynchronousFsdRequest@24
248 IoBuildDeviceIoControlRequest@36
250 IoBuildSynchronousFsdRequest@28
253 IoCheckDesiredAccess@8
254 IoCheckEaBufferValidity@12
255 IoCheckFunctionAccess@24
256 IoCheckShareAccess@20
258 IoConnectInterrupt@44
262 IoCreateNotificationEvent@8
263 IoCreateStreamFileObject@8
264 IoCreateSymbolicLink@8
265 IoCreateSynchronizationEvent@8
266 IoCreateUnprotectedSymbolicLink@8
269 IoDeleteSymbolicLink@4
271 IoDeviceHandlerObjectSize DATA
272 IoDeviceHandlerObjectType DATA
273 IoDisconnectInterrupt@4
274 IoDeviceObjectType DATA
275 IoDriverObjectType DATA
277 IoFastQueryNetworkAttributes@20
278 IoFileObjectType DATA
282 IoGetAttachedDevice@4
283 IoGetAttachedDeviceReference@4
284 IoGetBaseFileSystemDeviceObject@4
285 IoGetConfigurationInformation@0
286 IoGetCurrentProcess@0
287 IoGetDeviceObjectPointer@16
288 IoGetDeviceToVerify@4
289 IoGetFileObjectGenericMapping@0
291 IoGetRelatedDeviceObject@4
292 IoGetRequestorProcess@4
296 IoInvalidateDeviceState@4
297 IoInitializeRemoveLockEx@20
299 IoIsOperationSynchronous@4
300 IoMakeAssociatedIrp@8
301 IoOpenDeviceInstanceKey@20
303 IoQueryDeviceDescription@32
304 IoQueryDeviceEnumInfo@8
305 IoQueryFileInformation@20
306 IoQueryVolumeInformation@20
309 IoRaiseInformationalHardError@12
310 IoReadOperationCount DATA
311 @IoReadPartitionTable@16
312 IoReadTransferCount DATA
317 IoRegisterDeviceInterface@16
318 IoSetDeviceInterfaceState@8
319 IoGetDeviceProperty@20
320 IoOpenDeviceRegistryKey@16
321 IoInvalidateDeviceRelations@8
323 IoRegisterDriverReinitialization@12
324 IoRegisterFileSystem@4
325 IoRegisterFsRegistrationChange@8
326 IoRegisterShutdownNotification@4
327 IoReleaseCancelSpinLock@4
328 IoReleaseRemoveLockAndWaitEx@12
329 IoReleaseRemoveLockEx@12
330 IoReleaseVpbSpinLock@4
331 IoRemoveShareAccess@8
332 IoReportHalResourceUsage@16
333 IoReportResourceUsage@36
334 IoSetDeviceToVerify@8
335 IoSetHardErrorOrVerifyDevice@8
337 @IoSetPartitionInformation@16
339 IoSetThreadHardErrorMode@4
342 IoStartNextPacketByKey@12
345 IoStatisticsLock DATA
347 IoSynchronousPageWrite@20
349 IoUnregisterFileSystem@4
350 IoUnregisterFsRegistrationChange@8
351 IoUnregisterShutdownNotification@4
352 IoUpdateShareAccess@8
354 IoWriteErrorLogEntry@4
355 IoWriteOperationCount DATA
356 IoWritePartitionTable@20
357 IoWriteTransferCount DATA
359 @IofCompleteRequest@8
360 KdDebuggerEnabled DATA
361 KdDebuggerNotPresent DATA
363 KdSystemDebugControl@4
365 Ke386IoSetAccessProcess@8
366 Ke386QueryIoAccessMap@8
367 Ke386SetIoAccessMap@8
368 KeAcquireSpinLockAtDpcLevel@4
369 KeAddSystemServiceTable@20
371 ;KeBoostCurrentThread
377 KeDcacheFlushCount DATA
378 KeDelayExecutionThread@12
379 KeDeregisterBugCheckCallback@4
381 KeDisconnectInterrupt@4
382 KeEnterCriticalRegion@0
383 KeEnterKernelDebugger@0
384 ;KeFindConfigurationEntry
385 ;KeFindConfigurationNextEntry
390 ;KeI386AllocateGdtSelectors
391 ;KeI386Call16BitCStyleFunction
392 ;KeI386Call16BitFunction
393 ;KeI386FlatToGdtSelector
395 ;KeI386MachineType DATA
396 ;KeI386ReleaseGdtSelectors
398 ;KeI386SetGdtSelector
399 KeIcacheFlushCount DATA
401 KeInitializeDeviceQueue@4
404 KeInitializeInterrupt@44
408 KeInitializeSemaphore@12
409 KeInitializeSpinLock@4
411 KeInitializeTimerEx@8
412 KeInsertByKeyDeviceQueue@12
413 KeInsertDeviceQueue@8
419 KeLeaveCriticalRegion@0
421 KeNumberProcessors DATA
423 ;KeProfileInterruptWithSource
427 KeQueryTimeIncrement@0
428 ;KeRaiseUserException
434 KeReadStateSemaphore@4
436 KeRegisterBugCheckCallback@20
439 KeReleaseSemaphore@16
440 KeReleaseSpinLockFromDpcLevel@4
441 KeRemoveByKeyDeviceQueue@8
442 KeRemoveDeviceQueue@4
443 KeRemoveEntryDeviceQueue@8
447 KeRestoreFloatingPointState@4
449 KeSaveFloatingPointState@4
450 KeServiceDescriptorTable DATA
451 KeSetAffinityThread@8
452 KeSetBasePriorityThread@8
455 ;KeSetEventBoostPriority
456 ;KeSetIdealProcessorThread
458 ;KeSetKernelStackSwapEnable
459 KeSetPriorityThread@8
461 ;@KeSetSwapContextNotifyRoutine
462 KeSetTargetProcessorDpc@8
463 ;@KeSetThreadSelectNotifyRoutine
467 ;@KeSetTimeUpdateNotifyRoutine
468 KeSynchronizeExecution@12
473 KeWaitForMultipleObjects@32
474 KeWaitForMutexObject@20
475 KeWaitForSingleObject@20
476 ;@KefAcquireSpinLockAtDpcLevel
477 ;@KefReleaseSpinLockFromDpcLevel
479 ;@KiAcquireSpinLock@4
481 ;KiCoprocessorError@0
483 KiDispatchInterrupt@0
484 KiInterruptDispatch2@8
485 ;KiIpiServiceRoutine@8
486 ;@KiReleaseSpinLock@4
487 ;KiUnexpectedInterrupt
488 ;Kii386SpinOnSpinLock
492 ;LdrFindResourceDirectory_U@16
495 LsaCallAuthenticationPackage@28
496 LsaDeregisterLogonProcess@4
497 LsaFreeReturnBuffer@4
499 LsaLookupAuthenticationPackage@12
500 LsaRegisterLogonProcess@12
501 MmAdjustWorkingSetSize@16
502 MmAllocateContiguousAlignedMemory@16
503 MmAllocateContiguousMemory@12
504 MmAllocateNonCachedMemory@4
505 MmBuildMdlForNonPagedPool@4
506 MmCanFileBeTruncated@8
511 MmDbgTranslatePhysicalAddress@8
512 MmDisableModifiedWriteOfSection@4
513 MmFlushImageSection@8
514 MmForceSectionClosed@8
515 MmFreeContiguousMemory@4
516 MmFreeNonCachedMemory@8
517 MmGetPhysicalAddress@4
519 MmHighestUserAddress DATA
521 MmIsNonPagedSystemAddressValid@4
522 MmIsRecursiveIoFault@0
523 MmIsThisAnNtAsSystem@0
524 MmLockPagableDataSection@4
525 MmLockPagableImageSection@4=MmLockPagableDataSection@4
526 MmLockPagableSectionByHandle@4
531 MmMapViewInSystemSpace@12
532 MmMapViewOfSection@40
534 MmProbeAndLockPages@12
536 MmResetDriverPaging@4
537 MmSectionObjectType DATA
538 MmSecureVirtualMemory@12
539 MmSetAddressRangeModified@8
540 MmSetBankedSection@24
542 MmUnlockPagableImageSection@4
546 MmUnmapVideoDisplay@8
547 MmUnmapViewInSystemSpace@4
548 MmUnmapViewOfSection@8
549 MmUnsecureVirtualMemory@4
550 MmUserProbeAddress DATA
553 NlsMbCodePageTag DATA
554 NlsMbOemCodePageTag DATA
555 NlsOemLeadByteInfo DATA
557 NtAdjustPrivilegesToken@24
559 NtAllocateLocallyUniqueId@4
561 NtAllocateVirtualMemory@24
572 NtDeviceIoControlFile@40
576 NtFreeVirtualMemory@16
580 NtMapViewOfSection@40
581 NtNotifyChangeDirectoryFile@36
584 NtOpenProcessToken@12
585 NtQueryDirectoryFile@44
587 NtQueryInformationAtom@20
588 NtQueryInformationFile@20
589 NtQueryInformationProcess@20
590 NtQueryInformationToken@20
591 ;NtQueryOleDirectoryFile@ <--- ?
592 NtQuerySecurityObject@20
594 NtQueryVolumeInformationFile@20
597 NtRequestWaitReplyPort@12
599 NtSetInformationFile@20
600 NtSetInformationProcess@16
601 NtSetInformationThread@16
602 NtSetSecurityObject@12
607 NtWaitForSingleObject@12
610 ;ObCheckCreateObjectAccess@28
611 ;ObCheckObjectAccess@20
614 ;ObFindHandleForObject@20
615 ObGetObjectPointerCount@4
616 ObGetObjectSecurity@12
618 ObMakeTemporaryObject@4
619 ObOpenObjectByName@28
620 ObOpenObjectByPointer@28
622 ;ObQueryObjectAuditingByHandle@8
623 @ObfDereferenceObject@4
624 @ObfReferenceObject@4
625 ObReferenceObjectByHandle@24
626 ObReferenceObjectByName@32
627 ObReferenceObjectByPointer@16
628 ObReleaseObjectSecurity@8
629 ;ObSetSecurityDescriptorInfo@24
635 PoRegisterDeviceForIdleDetection@16
636 PoRegisterSystemState@8
641 PoStartNextPowerIrp@4
642 PoUnregisterSystemState@4
645 PsAssignImpersonationToken@8
646 ;PsChargePoolQuota@12
647 PsCreateSystemProcess@12
648 PsCreateSystemThread@28
649 PsCreateWin32Process@4
650 PsEstablishWin32Callouts@24
651 PsGetCurrentProcessId@0
652 PsGetCurrentThreadId@0
653 PsGetProcessExitTime@0
657 PsImpersonateClient@20
658 PsInitialSystemProcess DATA
659 PsIsThreadTerminating@4
660 PsLookupProcessByProcessId@8
661 PsLookupProcessThreadByCid@12
662 PsLookupThreadByThreadId@8
664 PsReferenceImpersonationToken@16
665 PsReferencePrimaryToken@4
666 ;PsReturnPoolQuota@12
668 PsSetCreateProcessNotifyRoutine@8
669 PsSetCreateThreadNotifyRoutine@4
670 ;PsSetLegoNotifyRoutine@4
671 ;PsSetProcessPriorityByClass@8
672 PsTerminateSystemThread@4
674 READ_REGISTER_UCHAR@4
675 READ_REGISTER_ULONG@4
676 READ_REGISTER_USHORT@4
677 READ_REGISTER_BUFFER_UCHAR@12
678 READ_REGISTER_BUFFER_ULONG@12
679 READ_REGISTER_BUFFER_USHORT@12
680 RtlAbsoluteToSelfRelativeSD@12
681 RtlAddAccessAllowedAce@16
683 RtlAddAtomToAtomTable@12
684 ;RtlAllocateAndInitializeSid
686 RtlAnsiCharToUnicodeChar@4
687 RtlAnsiStringToUnicodeSize@4
688 RtlAnsiStringToUnicodeString@12
689 RtlAppendAsciizToString@8
690 RtlAppendStringToString@8
691 RtlAppendUnicodeStringToString@8
692 RtlAppendUnicodeToString@8
693 RtlAreAllAccessesGranted@8
694 RtlAreAnyAccessesGranted@8
698 ;RtlCaptureStackBackTrace
700 RtlCheckRegistryKey@8
704 RtlCompareMemoryUlong@12
706 RtlCompareUnicodeString@12
709 RtlConvertLongToLargeInteger@4
710 RtlConvertSidToUnicodeString@12
711 RtlConvertUlongToLargeInteger@4
715 RtlCopyUnicodeString@8
719 RtlCreateRegistryKey@8
720 RtlCreateSecurityDescriptor@8
721 RtlCreateUnicodeString@8
722 RtlCustomCPToUnicodeN@24
723 RtlDecompressBuffer@24
724 RtlDecompressChunks@28
725 RtlDecompressFragment@32
727 RtlDeleteAtomFromAtomTable@8
728 ;RtlDeleteElementGenericTable
730 RtlDeleteRegistryValue@12
732 RtlDestroyAtomTable@4
734 RtlDowncaseUnicodeString@12
736 RtlEnlargedIntegerMultiply@8
737 RtlEnlargedUnsignedDivide@16
738 RtlEnlargedUnsignedMultiply@8
739 ;RtlEnumerateGenericTable
740 ;RtlEnumerateGenericTableWithoutSplaying
744 RtlEqualUnicodeString@12
745 RtlExtendedIntegerMultiply@12
746 RtlExtendedLargeIntegerDivide@16
747 RtlExtendedMagicDivide@20
749 RtlFillMemoryUlong@12
751 RtlFindClearBitsAndSet@12
752 RtlFindFirstRunClear@8
754 RtlFindLongestRunClear@8
755 RtlFindLongestRunSet@8
758 RtlFindSetBitsAndClear@12
759 ;RtlFindUnicodePrefix
760 RtlFormatCurrentUserKeyPath@4
764 RtlFreeUnicodeString@4
765 RtlGenerate8dot3Name@16
766 ;RtlGetCallersAddress
767 RtlGetCompressionWorkSpaceSize@12
768 RtlGetDaclSecurityDescriptor@16
769 RtlGetDefaultCodePage@8
770 ;RtlGetElementGenericTable
771 RtlGetGroupSecurityDescriptor@12
772 RtlGetOwnerSecurityDescriptor@12
774 RtlImageDirectoryEntryToData@16
776 RtlInitCodePageTable@8
778 RtlInitUnicodeString@8
779 RtlInitializeBitMap@12
780 ;RtlInitializeGenericTable
782 ;RtlInitializeUnicodePrefix
783 ;RtlInsertElementGenericTable
784 ;RtlInsertUnicodePrefix
786 RtlIntegerToUnicodeString@12
787 RtlIsNameLegalDOS8Dot3@12
788 RtlLargeIntegerAdd@16
789 RtlLargeIntegerArithmeticShift@12
790 RtlLargeIntegerDivide@20
791 RtlLargeIntegerNegate@8
792 RtlLargeIntegerShiftLeft@12
793 RtlLargeIntegerShiftRight@12
794 RtlLargeIntegerSubtract@16
795 RtlLengthRequiredSid@4
796 RtlLengthSecurityDescriptor@4
798 RtlLookupAtomInAtomTable@12
799 ;RtlLookupElementGenericTable
802 RtlMultiByteToUnicodeN@20
803 RtlMultiByteToUnicodeSize@12
804 ;RtlNextUnicodePrefix
805 RtlNtStatusToDosError@4
806 RtlNtStatusToDosErrorNoTeb@4
807 ;RtlNumberGenericTableElements
808 RtlNumberOfClearBits@4
810 RtlOemStringToCountedUnicodeString@12
811 RtlOemStringToUnicodeSize@4
812 RtlOemStringToUnicodeString@12
814 RtlPinAtomInAtomTable@8
816 RtlPrefixUnicodeString@12
817 RtlQueryAtomInAtomTable@24
818 RtlQueryRegistryValues@20
819 RtlQueryTimeZoneInformation@4
822 ;RtlRemoveUnicodePrefix
824 RtlSecondsSince1970ToTime@8
825 RtlSecondsSince1980ToTime@8
828 RtlSetDaclSecurityDescriptor@16
829 RtlSetGroupSecurityDescriptor@12
830 RtlSetOwnerSecurityDescriptor@12
831 RtlSetSaclSecurityDescriptor@16
832 RtlSetTimeZoneInformation@4
834 RtlSubAuthorityCountSid@4
836 RtlTimeFieldsToTime@8
837 RtlTimeToSecondsSince1970@8
838 RtlTimeToSecondsSince1980@8
839 RtlTimeToTimeFields@8
840 RtlUnicodeStringToAnsiSize@4
841 RtlUnicodeStringToAnsiString@12
842 RtlUnicodeStringToCountedOemString@12
843 RtlUnicodeStringToInteger@12
844 RtlUnicodeStringToOemSize@4
845 RtlUnicodeStringToOemString@12
846 RtlUnicodeToCustomCPN@24
847 RtlUnicodeToMultiByteN@20
848 RtlUnicodeToMultiByteSize@12
851 RtlUpcaseUnicodeChar@4
852 RtlUpcaseUnicodeString@12
853 RtlUpcaseUnicodeStringToAnsiString@12
854 RtlUpcaseUnicodeStringToCountedOemString@12
855 RtlUpcaseUnicodeStringToOemString@12
856 RtlUpcaseUnicodeToCustomCPN@24
857 RtlUpcaseUnicodeToMultiByteN@20
858 RtlUpcaseUnicodeToOemN@20
861 RtlValidSecurityDescriptor@4
863 RtlWriteRegistryValue@24
866 RtlxAnsiStringToUnicodeSize@4
867 RtlxOemStringToUnicodeSize@4
868 RtlxUnicodeStringToAnsiSize@4
869 RtlxUnicodeStringToOemSize@4
871 ;SeAppendPrivileges@8
873 ;SeAuditingFileEvents@8
874 ;SeAuditingFileOrGlobalEvents@18
875 ;SeCaptureSecurityDescriptor@20
876 SeCaptureSubjectContext@4
877 ;SeCloseObjectAuditAlarm@12
878 ;SeCreateAccessState@16
879 SeCreateClientSecurity@16
881 ;SeDeleteAccessState@4
882 ;SeDeleteObjectAuditAlarm@8
885 SeImpersonateClient@8
886 ;SeLockSubjectContext@4
887 ;SeMarkLogonSessionForTerminationNotification@4
888 ;SeOpenObjectAuditAlarm@36
889 ;SeOpenObjectForDeleteAuditAlarm@36
891 ;SePrivilegeObjectAuditAlarm@24
892 SePublicDefaultDacl DATA
893 ;SeQueryAuthenticationIdToken@8
894 ;SeQuerySecurityDescriptorInfo@16
895 ;SeRegisterLogonSessionTerminatedRoutine@4
896 ;SeReleaseSecurityDescriptor@12
897 SeReleaseSubjectContext@4
898 ;SeSetAccessStateGenericMapping@8
899 ;SeSetSecurityDescriptorInfo@24
900 SeSinglePrivilegeCheck@12
901 SeSystemDefaultDacl DATA
902 SeTokenImpersonationLevel@4
904 ;SeUnlockSubjectContext@4
905 ;SeUnregisterLogonSessionTerminatedRoutine@4
906 ;SeValidSecurityDescriptor@8
907 WRITE_REGISTER_UCHAR@8
908 WRITE_REGISTER_ULONG@8
909 WRITE_REGISTER_USHORT@8
910 WRITE_REGISTER_BUFFER_UCHAR@12
911 WRITE_REGISTER_BUFFER_ULONG@12
912 WRITE_REGISTER_BUFFER_USHORT@12
913 ZwAccessCheckAndAuditAlarm@44
915 ZwAllocateVirtualMemory@24
918 ZwCloseObjectAuditAlarm@12
920 ZwCreateDirectoryObject@12
925 ZwCreateSymbolicLinkObject@16
929 ZwDeviceIoControlFile@40
934 ZwEnumerateValueKey@24
935 ZwFlushInstructionCache@12
937 ZwFreeVirtualMemory@16
941 ZwMakeTemporaryObject@4
942 ZwMapViewOfSection@40
944 ZwOpenDirectoryObject@12
949 ZwOpenProcessToken@12
951 ZwOpenSymbolicLinkObject@12
955 ZwQueryDefaultLocale@8
956 ZwQueryDirectoryFile@44
957 ZwQueryInformationAtom@20
958 ZwQueryInformationFile@20
959 ZwQueryInformationProcess@20
960 ZwQueryInformationToken@20
964 ZwQuerySecurityObject@20
965 ZwQuerySymbolicLinkObject@12
966 ZwQuerySystemInformation@16
969 ZwQueryVolumeInformationFile@20
972 ZwRequestWaitReplyPort@12
977 ZwSetInformationFile@20
978 ZwSetInformationObject@16
979 ZwSetInformationProcess@16
980 ZwSetInformationThread@16
981 ZwSetSystemInformation@12
987 ZwUnmapViewOfSection@8
988 ZwWaitForMultipleObjects@20
989 ZwWaitForSingleObject@12
992 _abnormal_termination