1 ; $Id: ntoskrnl.def,v 1.196 2004/10/18 20:56:22 navaraf Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
18 CcGetFileObjectFromBcb@4
19 CcGetFileObjectFromSectionPtrs@4
20 CcGetFlushedValidData@8
21 CcGetLsnForFileObject@8
22 CcInitializeCacheMap@20
24 CcFastMdlReadWait DATA
25 CcFastReadNotPossible DATA
36 CcPurgeCacheSection@16
39 CcScheduleReadAhead@12
40 CcSetAdditionalCacheAttributes@12
41 CcSetBcbOwnerPointer@8
42 CcSetDirtyPageThreshold@8
43 CcSetDirtyPinnedData@8
44 CcSetLogHandleForFile@12
45 CcSetReadAheadGranularity@8
46 CcUninitializeCacheMap@12
48 CcUnpinDataForThread@8
50 CcWaitForCurrentLazyWriterActivity@0
55 CmUnRegisterCallback@8
57 DbgBreakPointWithStatus@4
58 DbgLoadImageSymbols@12
62 DbgPrintReturnControlC
63 DbgQueryDebugFilterState@8
64 DbgSetDebugFilterState@12
65 @ExAcquireFastMutexUnsafe@4
66 ExAcquireResourceExclusive@8
67 ExAcquireResourceExclusiveLite@8
68 ExAcquireResourceSharedLite@8
69 @ExAcquireRundownProtection@4
70 @ExAcquireRundownProtectionEx@8
71 ExAcquireSharedStarveExclusive@8
72 ExAcquireSharedWaitForExclusive@8
73 @ExAllocateFromPagedLookasideList@4=@ExiAllocateFromPagedLookasideList@4
75 ExAllocatePoolWithQuota@8
76 ExAllocatePoolWithQuotaTag@12
77 ExAllocatePoolWithTag@12
78 ExAllocatePoolWithTagPriority@16
79 ExConvertExclusiveToSharedLite@4
81 ExDeleteNPagedLookasideList@4
82 ExDeletePagedLookasideList@4
84 ExDeleteResourceLite@4
85 ExDesktopObjectType DATA
86 ExDisableResourceBoostLite@4
88 ExEventObjectType DATA
92 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
93 ExGetCurrentProcessorCounts@12
94 ExGetCurrentProcessorCpuUsage@4
95 ExGetExclusiveWaiterCount@4
97 ExGetSharedWaiterCount@4
98 @ExInitializeRundownProtection@4
99 ExInitializeNPagedLookasideList@28
100 ExInitializePagedLookasideList@28
101 ExInitializeResource@4
102 ExInitializeResourceLite@4
104 ExInterlockedAddLargeInteger@16
105 @ExInterlockedAddLargeStatistic@8
106 ExInterlockedAddUlong@12
107 @ExInterlockedCompareExchange64@16
108 ExInterlockedDecrementLong@8
109 ExInterlockedExchangeUlong@12
110 ExInterlockedExtendZone@16
111 ExInterlockedIncrementLong@8
112 @ExInterlockedFlushSList@4
113 ExInterlockedInsertHeadList@12
114 ExInterlockedInsertTailList@12
115 ExInterlockedPopEntryList@8
116 @ExInterlockedPopEntrySList@8
117 ExInterlockedPushEntryList@12
118 @ExInterlockedPushEntrySList@12
119 ExInterlockedRemoveHeadList@8
120 ExIsProcessorFeaturePresent@4
121 ExIsResourceAcquiredExclusiveLite@4
122 ExIsResourceAcquiredSharedLite@4
123 ExLocalTimeToSystemTime@8
126 ExQueryPoolBlockSize@8
128 ExRaiseAccessViolation@0
129 ExRaiseDatatypeMisalignment@0
133 ExRegisterCallback@12
134 ExReinitializeResourceLite@4
135 @ExReInitializeRundownProtection@4
136 @ExReleaseFastMutexUnsafe@4
137 ExReleaseResourceForThread@8
138 ExReleaseResourceForThreadLite@8
139 @ExReleaseResourceLite@4
140 @ExReleaseRundownProtection@4
141 @ExReleaseRundownProtectionEx@8
142 @ExRundownCompleted@4
143 ExSetResourceOwnerPointer@8
144 ExSetTimerResolution@8
145 ExSystemExceptionFilter@0
146 ExSystemTimeToLocalTime@8
147 ExTryToAcquireResourceExclusiveLite@4
148 ExUnregisterCallback@4
151 @ExWaitForRundownProtectionRelease@4
152 ExWindowStationObjectType DATA
153 ExInitializeBinaryTree@12
155 ExInsertBinaryTree@12
156 ExSearchBinaryTree@12
157 ExRemoveBinaryTree@12
158 ExTraverseBinaryTree@16
159 ExInitializeSplayTree@16
164 ExWeightOfSplayTree@8
165 ExTraverseSplayTree@16
166 ExInitializeHashTable@16
171 @ExfAcquirePushLockExclusive@4
172 @ExfAcquirePushLockShared@4
173 @ExfReleasePushLock@4
174 @ExfInterlockedAddUlong@12
175 @ExfInterlockedInsertHeadList@12
176 @ExfInterlockedInsertTailList@12
177 @ExfInterlockedCompareExchange64@12
178 @ExfInterlockedPopEntryList@8
179 @ExfInterlockedPushEntryList@12
180 @ExfInterlockedRemoveHeadList@8
181 @Exfi386InterlockedDecrementLong@4
182 @Exfi386InterlockedExchangeUlong@8
183 @Exfi386InterlockedIncrementLong@4
184 Exi386InterlockedDecrementLong@4
185 Exi386InterlockedExchangeUlong@8
186 Exi386InterlockedIncrementLong@4
187 FsRtlAcquireFileExclusive@4
188 FsRtlAddLargeMcbEntry@28
190 FsRtlAddToTunnelCache@32
191 FsRtlAllocateFileLock@8
193 FsRtlAllocatePoolWithQuota@8
194 FsRtlAllocatePoolWithQuotaTag@12
195 FsRtlAllocatePoolWithTag@12
196 FsRtlAllocateResource@0
197 FsRtlAreNamesEqual@16
199 FsRtlCheckLockForReadAccess@8
200 FsRtlCheckLockForWriteAccess@8
204 FsRtlCurrentBatchOplock@4
205 FsRtlDeleteKeyFromTunnelCache@12
206 FsRtlDeleteTunnelCache@4
207 FsRtlDeregisterUncProvider@4
210 FsRtlDoesDbcsContainWildCards@4
211 FsRtlDoesNameContainWildCards@4
212 FsRtlFastCheckLockForRead@24
213 FsRtlFastCheckLockForWrite@24
214 FsRtlFastUnlockAll@16
215 FsRtlFastUnlockAllByKey@20
216 FsRtlFastUnlockSingle@32
217 FsRtlFindInTunnelCache@32
220 FsRtlGetNextFileLock@8
221 FsRtlGetNextLargeMcbEntry@20
222 FsRtlGetNextMcbEntry@20
223 FsRtlIncrementCcFastReadNotPossible@0
224 FsRtlIncrementCcFastReadNoWait@0
225 FsRtlIncrementCcFastReadResourceMiss@0
226 FsRtlIncrementCcFastReadWait@0
227 FsRtlInitializeFileLock@12
228 FsRtlInitializeLargeMcb@8
230 FsRtlInitializeOplock@4
231 FsRtlInitializeTunnelCache@4
232 FsRtlInsertPerFileObjectContext@8
233 FsRtlInsertPerStreamContext@8
234 FsRtlIsDbcsInExpression@8
235 FsRtlIsFatDbcsLegal@20
236 FsRtlIsHpfsDbcsLegal@20
237 FsRtlIsNameInExpression@16
238 FsRtlIsNtstatusExpected@4
240 FsRtlIsTotalDeviceFailure@4
241 FsRtlLegalAnsiCharacterArray DATA
242 FsRtlLookupLargeMcbEntry@32
243 FsRtlLookupLastLargeMcbEntry@12
244 FsRtlLookupLastLargeMcbEntryAndInde@16=FsRtlLookupLastLargeMcbEntryAndIndex@16
245 FsRtlLookupLastMcbEntry@12
246 FsRtlLookupMcbEntry@20
247 FsRtlLookupPerFileObjectContext@12
248 FsRtlLookupPerStreamContextInternal@12
250 FsRtlMdlReadComplete@8
251 FsRtlMdlReadCompleteDev@12
253 FsRtlMdlWriteComplete@12
254 FsRtlMdlWriteCompleteDev@16
255 FsRtlNormalizeNtstatus@8
256 FsRtlNotifyChangeDirectory@28
257 FsRtlNotifyCleanup@12
258 FsRtlNotifyFilterChangeDirectory@44
259 FsRtlNotifyFilterReportChange@40
260 FsRtlNotifyFullChangeDirectory@40
261 FsRtlNotifyFullReportChange@36
262 FsRtlNotifyInitializeSync@4
263 FsRtlNotifyReportChange@20
264 FsRtlNotifyUninitializeSync@4
265 FsRtlNotifyVolumeEvent@8
266 FsRtlNumberOfRunsInLargeMcb@4
267 FsRtlNumberOfRunsInMcb@4
269 FsRtlOplockIsFastIoPossible@4
270 FsRtlPostPagingFileStackOverflow@12
271 FsRtlPostStackOverflow@12
272 FsRtlPrepareMdlWrite@24
273 FsRtlPrepareMdlWriteDev@28
275 FsRtlProcessFileLock@12
276 FsRtlRegisterUncProvider@12
278 FsRtlRemoveLargeMcbEntry@20
279 FsRtlRemoveMcbEntry@12
280 FsRtlRemovePerFileObjectContext@12
281 FsRtlRemovePerStreamContext@12
283 FsRtlSplitLargeMcb@20
285 FsRtlTruncateLargeMcb@12
287 FsRtlUninitializeFileLock@4
288 FsRtlUninitializeLargeMcb@4
289 FsRtlUninitializeMcb@4
290 FsRtlUninitializeOplock@4
291 HalDispatchTable DATA
292 HalPrivateDispatchTable DATA
293 @HalExamineMBR=@xHalExamineMBR@16
294 InbvAcquireDisplayOwnership@0
295 InbvCheckDisplayOwnership@0
297 InbvEnableBootDriver@4
298 InbvEnableDisplayString@4
299 InbvInstallDisplayStringFilter@4
300 InbvIsBootDriverInstalled@0
301 InbvNotifyDisplayOwnershipLost@4
303 InbvSetScrollRegion@16
305 InbvSolidColorFill@20
306 @InterlockedCompareExchange@12
307 @InterlockedDecrement@4
308 @InterlockedExchange@8
309 @InterlockedExchangeAdd@8
310 @InterlockedIncrement@4
311 @InterlockedPushEntrySList@8
312 @InterlockedPopEntrySList@4
313 IoAcquireCancelSpinLock@4
314 IoAcquireRemoveLockEx@20
315 IoAcquireVpbSpinLock@4
316 IoAdapterObjectType DATA
317 IoAllocateAdapterChannel@20
320 IoAllocateController@16
321 IoAllocateDriverObjectExtension@16
322 IoAllocateErrorLogEntry@8
324 IoAssignDriveLetters@16
327 IoAttachDeviceByPointer@8
328 IoAttachDeviceToDeviceStack@8
329 IoAttachDeviceToDeviceStackSafe@12
330 IoBuildAsynchronousFsdRequest@24
331 IoBuildDeviceIoControlRequest@36
333 IoBuildSynchronousFsdRequest@28
337 IoCheckDesiredAccess@8
338 IoCheckEaBufferValidity@12
339 IoCheckFunctionAccess@24
340 IoCheckQuerySetFileInformation@12
341 IoCheckQuerySetVolumeInformation@12
342 IoCheckQuotaBufferValidity@12
343 IoCheckShareAccess@20
345 IoConnectInterrupt@44
351 IoCreateFileSpecifyDeviceObjectHint@60
352 IoCreateNotificationEvent@8
353 IoCreateStreamFileObject@8
354 IoCreateStreamFileObjectEx@12
355 IoCreateStreamFileObjectLite@8
356 IoCreateSymbolicLink@8
357 IoCreateSynchronizationEvent@8
358 IoCreateUnprotectedSymbolicLink@8
362 IoDeleteSymbolicLink@4
364 IoDeviceHandlerObjectSize DATA
365 IoDeviceHandlerObjectType DATA
366 IoDeviceObjectType DATA
367 IoDisconnectInterrupt@4
368 IoDriverObjectType DATA
370 IoEnumerateDeviceObjectList@16
371 IoFastQueryNetworkAttributes@20
372 IoFileObjectType DATA
373 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
374 IoForwardIrpSynchronously@8
376 IoFreeErrorLogEntry@4
380 IoGetAttachedDevice@4
381 IoGetAttachedDeviceReference@4
382 IoGetBaseFileSystemDeviceObject@4
383 IoGetBootDiskInformation@8
384 IoGetConfigurationInformation@0
385 IoGetCurrentProcess@0
386 IoGetDeviceObjectPointer@16
387 IoGetDeviceAttachmentBaseRef@4
388 IoGetDeviceInterfaceAlias@12
389 IoGetDeviceInterfaces@16
390 IoGetDriverObjectExtension@8
391 IoGetDeviceProperty@20
392 IoGetDeviceToVerify@4
393 IoGetDiskDeviceObject@8
395 IoGetFileObjectGenericMapping@0
397 IoGetLowerDeviceObject@4
398 IoGetRelatedDeviceObject@4
399 IoGetRequestorProcess@4
400 IoGetRequestorProcessId@4
401 IoGetRequestorSessionId@8
405 IoInvalidateDeviceRelations@8
406 IoInvalidateDeviceState@4
407 IoInitializeRemoveLockEx@20
409 IoIsFileOriginRemote@4
411 IoIsValidNameGraftingBuffer@8
412 IoIsOperationSynchronous@4
413 IoMakeAssociatedIrp@8
414 IoOpenDeviceInstanceKey@20
415 IoOpenDeviceInterfaceRegistryKey@12
416 IoOpenDeviceRegistryKey@16
418 IoPnPDeliverServicePowerNotification@16
419 IoQueryDeviceDescription@32
420 IoQueryDeviceEnumInfo@8
421 IoQueryFileDosDeviceName@8
422 IoQueryFileInformation@20
423 IoQueryVolumeInformation@20
427 IoRaiseInformationalHardError@12
428 IoReadDiskSignature@12
429 IoReadOperationCount DATA
430 IoReadPartitionTable@16
431 IoReadPartitionTableEx@8
432 IoReadTransferCount DATA
433 IoRegisterBootDriverReinitialization@12
434 IoRegisterDeviceInterface@16
435 IoRegisterDriverReinitialization@12
436 IoRegisterFileSystem@4
437 IoRegisterFsRegistrationChange@8
438 IoRegisterLastChanceShutdownNotification@4
439 IoRegisterPlugPlayNotification@28
440 IoRegisterShutdownNotification@4
441 IoReleaseCancelSpinLock@4
442 IoReleaseRemoveLockAndWaitEx@12
443 IoReleaseRemoveLockEx@12
444 IoReleaseVpbSpinLock@4
445 IoRemoveShareAccess@8
446 IoReportDetectedDevice@32
447 IoReportHalResourceUsage@16
448 IoReportResourceUsage@36
449 IoReportResourceForDetection@28
450 IoReportTargetDeviceChange@8
451 IoReportTargetDeviceChangeAsynchronous@16
452 IoRequestDeviceEject@4
454 IoSetCompletionRoutineEx@28
455 IoSetSystemPartition@4
456 IoSetDeviceInterfaceState@8
457 IoSetDeviceToVerify@8
459 IoSetHardErrorOrVerifyDevice@8
462 IoSetPartitionInformation@16
463 IoSetPartitionInformationEx@12
464 IoSetStartIoAttributes@12
466 IoSetThreadHardErrorMode@4
469 IoStartNextPacketByKey@12
472 IoStatisticsLock DATA
474 IoSynchronousPageWrite@20
475 IoSynchronousInvalidateDeviceRelations@8
477 IoUnregisterFileSystem@4
478 IoUnregisterFsRegistrationChange@8
479 IoUnregisterPlugPlayNotification@4
480 IoUnregisterShutdownNotification@4
481 IoUpdateShareAccess@8
482 IoValidateDeviceIoControlAccess@8
483 IoVerifyPartitionTable@8
485 IoVolumeDeviceToDosName@8
486 IoWMIAllocateInstanceIds@12
487 IoWMIDeviceObjectToInstanceName@12
488 IoWMIExecuteMethod@24
489 IoWMIHandleToInstanceName@12
492 IoWMIQueryAllDataMultiple@16
493 IoWMIQuerySingleInstance@16
494 IoWMIQuerySingleInstanceMultiple@20
495 IoWMIRegistrationControl@8
496 IoWMISetNotificationCallback@12
497 IoWMISetSingleInstance@20
498 IoWMISetSingleItem@24
499 IoWMISuggestInstanceName@16
501 IoWriteErrorLogEntry@4
502 IoWriteOperationCount DATA
503 IoWritePartitionTable@20
504 IoWritePartitionTableEx@8
505 IoWriteTransferCount DATA
507 @IofCompleteRequest@8
508 IoIsWdmVersionAvailable@8
509 KdDebuggerEnabled DATA
510 KdDebuggerNotPresent DATA
516 KdSystemDebugControl@4
518 Ke386IoSetAccessProcess@8
519 Ke386QueryIoAccessMap@8
520 Ke386SetIoAccessMap@8
521 KeAcquireSpinLockAtDpcLevel@4
522 KeAcquireDispatcherDatabaseLockAtDpcLevel
523 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
524 KeAcquireInterruptSpinLock@4
525 KeAddSystemServiceTable@20
528 ;KeBoostCurrentThread
532 KeCapturePersistentThreadState@28
535 KeDcacheFlushCount DATA
536 KeDelayExecutionThread@12
537 KeDeregisterBugCheckCallback@4
538 KeDeregisterBugCheckReasonCallback@4
540 KeDisconnectInterrupt@4
541 KeEnterCriticalRegion@0
542 KeEnterKernelDebugger@0
543 KeFindConfigurationEntry@16
544 KeFindConfigurationNextEntry@20
549 KeGetRecommendedSharedDataAlignment@0
551 KeI386AllocateGdtSelectors
552 ;KeI386Call16BitCStyleFunction
553 ;KeI386Call16BitFunction
554 KeI386FlatToGdtSelector
556 ;KeI386MachineType DATA
557 KeI386ReleaseGdtSelectors
559 ;KeI386SetGdtSelector
560 KeIcacheFlushCount DATA
562 KeInitializeDeviceQueue@4
565 KeInitializeInterrupt@44
569 KeInitializeSemaphore@12
570 KeInitializeSpinLock@4
572 KeInitializeTimerEx@8
573 KeInsertByKeyDeviceQueue@12
574 KeInsertDeviceQueue@8
579 KeIsAttachedProcess@0
581 KeLeaveCriticalRegion@0
583 KeNumberProcessors DATA
585 KeProfileInterruptWithSource@8
587 KeQueryActiveProcessors@0
588 KeQueryInterruptTime@0
589 KeQueryPriorityThread@4
590 KeQueryRuntimeThread@8
593 KeQueryTimeIncrement@0
594 KeRaiseUserException@4
600 KeReadStateSemaphore@4
602 KeRegisterBugCheckCallback@20
603 KeRegisterBugCheckReasonCallback@16
604 KeReleaseDispatcherDatabaseLockFromDpcLevel
605 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
606 KeReleaseInterruptSpinLock@8
609 KeReleaseSemaphore@16
610 KeReleaseSpinLockFromDpcLevel@4
611 KeRemoveByKeyDeviceQueue@8
612 KeRemoveByKeyDeviceQueueIfBusy@8
613 KeRemoveDeviceQueue@4
614 KeRemoveEntryDeviceQueue@8
617 KeRemoveSystemServiceTable@4
619 KeRestoreFloatingPointState@4
620 KeRevertToUserAffinityThread@0
622 KeSaveFloatingPointState@4
623 KeSaveStateForHibernate
624 KeServiceDescriptorTable DATA
625 KeSetAffinityThread@8
626 KeSetBasePriorityThread@8
627 KeSetDmaIoCoherency@4
629 KeSetEventBoostPriority@8
630 KeSetIdealProcessorThread@8
632 KeSetKernelStackSwapEnable@4
633 KeSetPriorityThread@8
635 KeSetSystemAffinityThread@4
636 ;KeSetSwapContextNotifyRoutine
637 KeSetTargetProcessorDpc@8
638 ;KeSetThreadSelectNotifyRoutine
642 @KeSetTimeUpdateNotifyRoutine@4
643 KeStackAttachProcess@8
644 KeSynchronizeExecution@12
649 KeUnstackDetachProcess@4
650 KeUserModeCallback@20
651 KeWaitForMultipleObjects@32
652 KeWaitForMutexObject@20
653 KeWaitForSingleObject@20
654 @KefAcquireSpinLockAtDpcLevel@4
655 @KefReleaseSpinLockFromDpcLevel@4
661 KiDispatchInterrupt@0
662 KiEnableTimerWatchdog
663 KiInterruptDispatch2@8
664 KiIpiServiceRoutine@8
666 KiUnexpectedInterrupt@0
667 ;Kii386SpinOnSpinLock
671 LdrFindResourceDirectory_U@16
674 LpcRequestWaitReplyPort@12
675 LsaCallAuthenticationPackage@28
676 LsaDeregisterLogonProcess@8
677 LsaFreeReturnBuffer@4
679 LsaLookupAuthenticationPackage@12
680 LsaRegisterLogonProcess@12
681 Mm64BitPhysicalAddress DATA
682 MmAddPhysicalMemory@8
683 MmAddVerifierThunks@8
684 MmAdjustWorkingSetSize@12
686 MmAllocateContiguousAlignedMemory@36
687 MmAllocateContiguousMemory@12
688 MmAllocateContiguousMemorySpecifyCache@32
689 MmAllocateMappingAddress@8
690 MmAllocateNonCachedMemory@4
691 MmAllocatePagesForMdl@28
692 MmBuildMdlForNonPagedPool@4
693 MmCanFileBeTruncated@8
698 MmDbgTranslatePhysicalAddress@8
699 MmDisableModifiedWriteOfSection@4
700 MmFlushImageSection@8
701 MmForceSectionClosed@8
702 MmFreeContiguousMemory@4
703 MmFreeContiguousMemorySpecifyCache@12
704 MmFreeMappingAddress@8
705 MmFreeNonCachedMemory@8
707 MmGetPhysicalAddress@4
708 MmGetPhysicalMemoryRanges@0
709 MmGetSystemRoutineAddress@4
710 MmGetVirtualForPhysical@8
712 MmHighestUserAddress DATA
714 MmIsDriverVerifying@4
715 MmIsNonPagedSystemAddressValid@4
716 MmIsRecursiveIoFault@0
717 MmIsThisAnNtAsSystem@0
718 MmIsVerifierEnabled@4
719 MmLockPagableDataSection@4
720 MmLockPagableImageSection@4=MmLockPagableDataSection@4
721 MmLockPagableSectionByHandle@4
724 MmMapLockedPagesSpecifyCache@24
725 MmMapLockedPagesWithReservedMapping@16
727 MmMapUserAddressesToPage@12
729 MmMapViewInSessionSpace@12
730 MmMapViewInSystemSpace@12
731 MmMapViewOfSection@40
732 MmMarkPhysicalMemoryAsBad@8
733 MmMarkPhysicalMemoryAsGood@8
736 MmProbeAndLockPages@12
737 MmProbeAndLockProcessPages@16
738 MmProbeAndLockSelectedPages@16
739 MmProtectMdlSystemAddress@8
741 MmRemovePhysicalMemory@8
742 MmResetDriverPaging@4
743 MmSectionObjectType DATA
744 MmSecureVirtualMemory@12
745 MmSetAddressRangeModified@8
746 MmSetBankedSection@24
748 MmSystemRangeStart DATA
749 MmTrimAllSystemPagableMemory@4
750 MmUnlockPagableImageSection@4
754 MmUnmapReservedMapping@12
755 MmUnmapVideoDisplay@8
756 MmUnmapViewInSessionSpace@4
757 MmUnmapViewInSystemSpace@4
758 MmUnmapViewOfSection@8
759 MmUnsecureVirtualMemory@4
760 MmUserProbeAddress DATA
763 NlsMbCodePageTag DATA
764 NlsMbOemCodePageTag DATA
765 NlsOemLeadByteInfo DATA
767 NtAdjustPrivilegesToken@24
769 NtAllocateLocallyUniqueId@4
771 NtAllocateVirtualMemory@24
782 NtDeviceIoControlFile@40
786 NtFreeVirtualMemory@16
790 NtMakePermanentObject@4
791 NtMapViewOfSection@40
792 NtNotifyChangeDirectoryFile@36
795 NtOpenProcessToken@12
796 NtOpenProcessTokenEx@16
799 NtOpenThreadTokenEx@20
800 NtQueryDirectoryFile@44
802 NtQueryInformationAtom@20
803 NtQueryInformationFile@20
804 NtQueryInformationProcess@20
805 NtQueryInformationThread@20
806 NtQueryInformationToken@20
807 ;NtQueryOleDirectoryFile@44 <--- ?
808 NtQueryQuotaInformationFile@36
809 NtQuerySecurityObject@20
810 NtQuerySystemInformation@16
812 NtQueryVolumeInformationFile@20
815 NtRequestWaitReplyPort@12
818 NtSetInformationFile@20
819 NtSetInformationProcess@16
820 NtSetInformationThread@16
821 NtSetQuotaInformationFile@16
822 NtSetSecurityObject@12
823 NtSetVolumeInformationFile@20
830 NtWaitForSingleObject@12
833 ;ObCheckCreateObjectAccess@28
834 ;ObCheckObjectAccess@20
836 ObFindHandleForObject@20
837 ObGetObjectPointerCount@4
838 ObGetObjectSecurity@12
840 ObMakeTemporaryObject@4
841 ObOpenObjectByName@28
842 ObOpenObjectByPointer@28
844 ObQueryObjectAuditingByHandle@8
845 @ObfDereferenceObject@4
846 @ObfReferenceObject@4
847 ObReferenceObjectByHandle@24
848 ObReferenceObjectByName@32
849 ObReferenceObjectByPointer@16
850 ObReleaseObjectSecurity@8
851 ObDereferenceObject@4
852 ;ObSetSecurityDescriptorInfo@24
858 PoRegisterDeviceForIdleDetection@16
859 PoRegisterSystemState@8
864 PoStartNextPowerIrp@4
865 PoUnregisterSystemState@4
868 PsAssignImpersonationToken@8
870 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
871 PsChargeProcessPagedPoolQuota@8
872 PsChargeProcessPoolQuota@12
873 PsCreateSystemProcess@12
874 PsCreateSystemThread@28
875 PsCreateWin32Process@4
876 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
877 PsDereferencePrimaryToken@4
878 PsDisableImpersonation@8
879 PsEstablishWin32Callouts@24
880 PsGetCurrentProcessId@0
881 PsGetCurrentProcessSessionId@0
882 PsGetCurrentThreadId@0
883 PsGetCurrentThreadPreviousMode@0
884 PsGetCurrentThreadStackBase@0
885 PsGetCurrentThreadStackLimit@0
888 PsGetJobUIRestrictionsClass@4
889 PsGetProcessCreateTimeQuadPart@4
890 PsGetProcessDebugPort@4
891 PsGetProcessExitProcessCalled@4
892 PsGetProcessExitStatus@4
893 PsGetProcessExitTime@0
895 PsGetProcessImageFileName@4
896 PsGetProcessInheritedFromUniqueProcessId@4
899 PsGetProcessPriorityClass@4
900 PsGetProcessSectionBaseAddress@4
901 PsGetProcessSecurityPort@4
902 PsGetProcessSessionId@4
903 PsGetProcessWin32Process@4
904 PsGetProcessWin32WindowStation@4
905 PsGetThreadFreezeCount@4
906 PsGetThreadHardErrorsAreDisabled@4
909 PsGetThreadProcessId@4
910 PsGetThreadSessionId@4
912 PsGetThreadWin32Thread@4
916 PsImpersonateClient@20
917 PsInitialSystemProcess DATA
918 PsIsProcessBeingDebugged@4
920 PsIsThreadImpersonating@4
921 PsIsThreadTerminating@4
923 PsLookupProcessByProcessId@8
924 PsLookupProcessThreadByCid@12
925 PsLookupThreadByThreadId@8
927 PsReferenceImpersonationToken@16
928 PsReferencePrimaryToken@4
929 PsRemoveCreateThreadNotifyRoutine@4
930 PsRemoveLoadImageNotifyRoutine@4
931 PsRestoreImpersonation@8
933 PsReturnProcessNonPagedPoolQuota@8
934 PsReturnProcessPagedPoolQuota@8
936 PsRevertThreadToSelf@4
937 PsSetCreateProcessNotifyRoutine@8
938 PsSetCreateThreadNotifyRoutine@4
939 PsSetJobUIRestrictionsClass@8
940 PsSetLegoNotifyRoutine@4
941 PsSetProcessPriorityClass@8
942 PsSetProcessSecurityPort@8
943 PsSetProcessWin32Process@8
944 PsSetProcessWin32WindowStation@8
945 PsSetThreadHardErrorsAreDisabled@8
946 PsSetThreadWin32Thread@8
947 PsSetLoadImageNotifyRoutine@4
948 PsTerminateSystemThread@4
950 READ_REGISTER_UCHAR@4
951 READ_REGISTER_ULONG@4
952 READ_REGISTER_USHORT@4
953 READ_REGISTER_BUFFER_UCHAR@12
954 READ_REGISTER_BUFFER_ULONG@12
955 READ_REGISTER_BUFFER_USHORT@12
957 KeRosDumpStackFrames@8
958 RtlAbsoluteToSelfRelativeSD@12
959 RtlAddAccessAllowedAce@16
961 RtlAddAtomToAtomTable@12
963 ;RtlAllocateAndInitializeSid
965 RtlAnsiCharToUnicodeChar@4
966 RtlAnsiStringToUnicodeSize@4
967 RtlAnsiStringToUnicodeString@12
968 RtlAppendAsciizToString@8
969 RtlAppendStringToString@8
970 RtlAppendUnicodeStringToString@8
971 RtlAppendUnicodeToString@8
972 RtlAreAllAccessesGranted@8
973 RtlAreAnyAccessesGranted@8
978 RtlCaptureStackBackTrace@16
980 RtlCheckRegistryKey@8
985 RtlCompareMemoryUlong@12
987 RtlCompareUnicodeString@12
990 RtlConvertLongToLargeInteger@4
991 RtlConvertSidToUnicodeString@12
992 RtlConvertUlongToLargeInteger@4
997 RtlCopyUnicodeString@8
1001 RtlCreateRegistryKey@8
1002 RtlCreateSecurityDescriptor@8
1003 RtlCreateSystemVolumeInformationFolder@4
1004 RtlCreateUnicodeString@8
1005 RtlCustomCPToUnicodeN@24
1006 RtlDecompressBuffer@24
1007 RtlDecompressChunks@28
1008 RtlDecompressFragment@32
1011 RtlDeleteAtomFromAtomTable@8
1012 RtlDeleteElementGenericTable@8
1013 RtlDeleteElementGenericTableAvl@8
1015 RtlDeleteOwnersRanges@8
1017 RtlDeleteRegistryValue@12
1019 RtlDestroyAtomTable@4
1021 RtlDowncaseUnicodeString@12
1023 RtlEnlargedIntegerMultiply@8
1024 RtlEnlargedUnsignedDivide@16
1025 RtlEnlargedUnsignedMultiply@8
1026 RtlEnumerateGenericTable@8
1027 RtlEnumerateGenericTableAvl@8
1028 RtlEnumerateGenericTableLikeADirectory@28
1029 RtlEnumerateGenericTableWithoutSplaying@8
1030 RtlEnumerateGenericTableWithoutSplayingAvl@8
1034 RtlEqualUnicodeString@12
1035 RtlExtendedIntegerMultiply@12
1036 RtlExtendedLargeIntegerDivide@16
1037 RtlExtendedMagicDivide@20
1039 RtlFillMemoryUlong@12
1041 RtlFindClearBitsAndSet@12
1043 RtlFindFirstRunClear@8
1044 RtlFindFirstRunSet@8
1045 RtlFindLastBackwardRunClear@12
1046 RtlFindLeastSignificantBit@8
1047 RtlFindLongestRunClear@8
1048 RtlFindLongestRunSet@8
1050 RtlFindMostSignificantBit@8
1051 RtlFindNextForwardRunClear@12
1054 RtlFindSetBitsAndClear@12
1055 RtlFindUnicodePrefix@12
1056 RtlFormatCurrentUserKeyPath@4
1061 RtlFreeUnicodeString@4
1063 RtlGenerate8dot3Name@16
1065 RtlGetCallersAddress@8
1066 RtlGetCompressionWorkSpaceSize@12
1067 RtlGetDaclSecurityDescriptor@16
1068 RtlGetDefaultCodePage@8
1069 RtlGetElementGenericTable@8
1070 RtlGetElementGenericTableAvl@8
1072 RtlGetGroupSecurityDescriptor@12
1074 RtlGetNtGlobalFlags@0
1075 RtlGetOwnerSecurityDescriptor@12
1076 RtlGetSaclSecurityDescriptor@16
1077 RtlGetSetBootStatusData@24
1079 RtlHashUnicodeString@16
1081 RtlImageDirectoryEntryToData@16
1083 RtlInitCodePageTable@8
1085 RtlInitUnicodeString@8
1086 RtlInitializeBitMap@12
1087 RtlInitializeGenericTable@20
1088 RtlInitializeGenericTableAvl@20
1089 RtlInitializeRangeList@4
1091 RtlInitializeUnicodePrefix@4
1092 RtlInsertElementGenericTable@16
1093 RtlInsertElementGenericTableAvl@16
1094 RtlInsertElementGenericTableFull@24
1095 RtlInsertElementGenericTableFullAvl@24
1096 RtlInsertUnicodePrefix@12
1097 RtlInt64ToUnicodeString@16
1099 RtlIntegerToUnicode@16
1100 RtlIntegerToUnicodeString@12
1101 RtlInvertRangeList@8
1102 RtlIpv4AddressToStringA@8
1103 RtlIpv4AddressToStringExA@16
1104 RtlIpv4AddressToStringExW@16
1105 RtlIpv4AddressToStringW@8
1106 RtlIpv4StringToAddressA@16
1107 RtlIpv4StringToAddressExA@16
1108 RtlIpv4StringToAddressExW@16
1109 RtlIpv4StringToAddressW@16
1110 RtlIpv6AddressToStringA@8
1111 RtlIpv6AddressToStringExA@16
1112 RtlIpv6AddressToStringExW@16
1113 RtlIpv6AddressToStringW@8
1114 RtlIpv6StringToAddressA@16
1115 RtlIpv6StringToAddressExA@16
1116 RtlIpv6StringToAddressExW@16
1117 RtlIpv6StringToAddressW@16
1118 RtlIsGenericTableEmpty@4
1119 RtlIsGenericTableEmptyAvl@4
1120 RtlIsNameLegalDOS8Dot3@12
1121 RtlIsRangeAvailable@40
1122 RtlIsValidOemCharacter@4
1123 RtlLargeIntegerAdd@16
1124 RtlLargeIntegerArithmeticShift@12
1125 RtlLargeIntegerDivide@20
1126 RtlLargeIntegerNegate@8
1127 RtlLargeIntegerShiftLeft@12
1128 RtlLargeIntegerShiftRight@12
1129 RtlLargeIntegerSubtract@16
1130 RtlLengthRequiredSid@4
1131 RtlLengthSecurityDescriptor@4
1133 RtlLockBootStatusData@4
1134 RtlLookupAtomInAtomTable@12
1135 RtlLookupElementGenericTable@8
1136 RtlLookupElementGenericTableAvl@8
1137 RtlLookupElementGenericTableFull@16
1138 RtlLookupElementGenericTableFullAvl@16
1140 RtlMapSecurityErrorToNtStatus@4
1141 RtlMergeRangeLists@16
1143 RtlMultiByteToUnicodeN@20
1144 RtlMultiByteToUnicodeSize@12
1145 RtlNextUnicodePrefix@8
1146 RtlNtStatusToDosError@4
1147 RtlNtStatusToDosErrorNoTeb@4
1148 RtlNumberGenericTableElements@4
1149 RtlNumberGenericTableElementsAvl@4
1150 RtlNumberOfClearBits@4
1151 RtlNumberOfSetBits@4
1152 RtlOemStringToCountedUnicodeString@12
1153 RtlOemStringToUnicodeSize@4
1154 RtlOemStringToUnicodeString@12
1156 RtlPinAtomInAtomTable@8
1157 @RtlPrefetchMemoryNonTemporal@8
1159 RtlPrefixUnicodeString@12
1160 RtlQueryAtomInAtomTable@24
1161 RtlQueryRegistryValues@20
1162 RtlQueryTimeZoneInformation@4
1166 RtlRealPredecessor@4
1168 RtlRemoveUnicodePrefix@8
1170 RtlSecondsSince1970ToTime@8
1171 RtlSecondsSince1980ToTime@8
1172 RtlSelfRelativeToAbsoluteSD2@8
1173 RtlSelfRelativeToAbsoluteSD@44
1177 RtlSetDaclSecurityDescriptor@16
1178 RtlSetGroupSecurityDescriptor@12
1179 RtlSetOwnerSecurityDescriptor@12
1180 RtlSetSaclSecurityDescriptor@16
1181 RtlSetTimeZoneInformation@4
1185 RtlSubAuthorityCountSid@4
1186 RtlSubAuthoritySid@8
1187 RtlSubtreePredecessor@4
1188 RtlSubtreeSuccessor@4
1190 RtlTimeFieldsToTime@8
1191 RtlTimeToElapsedTimeFields@8
1192 RtlTimeToSecondsSince1970@8
1193 RtlTimeToSecondsSince1980@8
1194 RtlTimeToTimeFields@8
1196 @RtlUlonglongByteSwap@8
1197 RtlUnicodeStringToAnsiSize@4
1198 RtlUnicodeStringToAnsiString@12
1199 RtlUnicodeStringToCountedOemString@12
1200 RtlUnicodeStringToInteger@12
1201 RtlUnicodeStringToOemSize@4
1202 RtlUnicodeStringToOemString@12
1203 RtlUnicodeToCustomCPN@24
1204 RtlUnicodeToMultiByteN@20
1205 RtlUnicodeToMultiByteSize@12
1207 RtlUnlockBootStatusData@4
1209 RtlUpcaseUnicodeChar@4
1210 RtlUpcaseUnicodeString@12
1211 RtlUpcaseUnicodeStringToAnsiString@12
1212 RtlUpcaseUnicodeStringToCountedOemString@12
1213 RtlUpcaseUnicodeStringToOemString@12
1214 RtlUpcaseUnicodeToCustomCPN@24
1215 RtlUpcaseUnicodeToMultiByteN@20
1216 RtlUpcaseUnicodeToOemN@20
1219 @RtlUshortByteSwap@4
1220 RtlValidRelativeSecurityDescriptor@12
1221 RtlValidSecurityDescriptor@4
1223 ;RtlVerifyVersionInfo@16
1224 RtlVolumeDeviceToDosName@8
1225 RtlWalkFrameChain@12
1226 RtlWriteRegistryValue@24
1229 RtlxAnsiStringToUnicodeSize@4
1230 RtlxOemStringToUnicodeSize@4
1231 RtlxUnicodeStringToAnsiSize@4
1232 RtlxUnicodeStringToOemSize@4
1234 SeAppendPrivileges@8
1236 SeAssignSecurityEx@36
1237 SeAuditHardLinkCreation@12
1238 SeAuditingFileEvents@8
1239 SeAuditingFileEventsWithContext@12
1240 SeAuditingFileOrGlobalEvents@12
1241 SeAuditingHardLinkEvents@8
1242 SeAuditingHardLinkEventsWithContext@12
1243 SeCaptureSecurityDescriptor@20
1244 SeCaptureSubjectContext@4
1245 SeCloseObjectAuditAlarm@12
1246 SeCreateAccessState@16
1247 SeCreateClientSecurity@16
1248 SeCreateClientSecurityFromSubjectContext@16
1249 SeDeassignSecurity@4
1250 SeDeleteAccessState@4
1251 SeDeleteObjectAuditAlarm@8
1255 SeImpersonateClient@8
1256 SeImpersonateClientEx@8
1257 SeLockSubjectContext@4
1258 SeMarkLogonSessionForTerminationNotification@4
1259 SeOpenObjectAuditAlarm@36
1260 SeOpenObjectForDeleteAuditAlarm@36
1262 SePrivilegeObjectAuditAlarm@24
1263 SePublicDefaultDacl DATA
1264 SeQueryAuthenticationIdToken@8
1265 SeQueryInformationToken@12
1266 SeQuerySecurityDescriptorInfo@16
1267 SeQuerySessionIdToken@8
1268 SeRegisterLogonSessionTerminatedRoutine@4
1269 SeReleaseSecurityDescriptor@12
1270 SeReleaseSubjectContext@4
1271 SeSetAccessStateGenericMapping@8
1272 SeSetSecurityDescriptorInfo@24
1273 SeSetSecurityDescriptorInfoEx@28
1274 SeSinglePrivilegeCheck@12
1275 SeSystemDefaultDacl DATA
1276 SeTokenImpersonationLevel@4
1278 SeTokenIsRestricted@4
1279 SeTokenIsWriteRestricted@4
1281 SeUnlockSubjectContext@4
1282 SeUnregisterLogonSessionTerminatedRoutine@4
1283 SeValidSecurityDescriptor@8
1284 WRITE_REGISTER_UCHAR@8
1285 WRITE_REGISTER_ULONG@8
1286 WRITE_REGISTER_USHORT@8
1287 WRITE_REGISTER_BUFFER_UCHAR@12
1288 WRITE_REGISTER_BUFFER_ULONG@12
1289 WRITE_REGISTER_BUFFER_USHORT@12
1290 ZwAccessCheckAndAuditAlarm@44
1292 ZwAdjustPrivilegesToken@24
1294 ZwAllocateVirtualMemory@24
1295 ZwAssignProcessToJobObject@8
1300 ZwCloseObjectAuditAlarm@12
1302 ZwCreateDirectoryObject@12
1305 ZwCreateJobObject@12
1308 ZwCreateSymbolicLinkObject@16
1314 ZwDeviceIoControlFile@40
1316 ZwDuplicateObject@28
1318 ZwEnumerateBootEntries@8
1320 ZwEnumerateValueKey@24
1321 ZwFlushInstructionCache@12
1323 ZwFlushVirtualMemory@16
1324 ZwFreeVirtualMemory@16
1326 ZwInitiatePowerAction@16
1330 ZwMakeTemporaryObject@4
1331 ZwMapViewOfSection@40
1332 ZwNotifyChangeKey@40
1333 ZwOpenDirectoryObject@12
1339 ZwOpenProcessToken@12
1340 ZwOpenProcessTokenEx@16
1342 ZwOpenSymbolicLinkObject@12
1344 ZwOpenThreadToken@16
1345 ZwOpenThreadTokenEx@20
1347 ZwPowerInformation@20
1349 ZwQueryBootEntryOrder@8
1350 ZwQueryBootOptions@8
1351 ZwQueryDefaultLocale@8
1352 ZwQueryDefaultUILanguage@4
1353 ZwQueryDirectoryFile@44
1354 ZwQueryDirectoryObject@28
1356 ZwQueryFullAttributesFile@8
1357 ZwQueryInformationAtom@20
1358 ZwQueryInformationFile@20
1359 ZwQueryInformationJobObject@20
1360 ZwQueryInformationProcess@20
1361 ZwQueryInformationThread@20
1362 ZwQueryInformationToken@20
1363 ZwQueryInstallUILanguage@4
1367 ZwQuerySecurityObject@20
1368 ZwQuerySymbolicLinkObject@12
1369 ZwQuerySystemInformation@16
1372 ZwQueryVolumeInformationFile@20
1375 ZwRequestWaitReplyPort@12
1380 ZwSetBootEntryOrder@8
1382 ZwSetDefaultLocale@8
1383 ZwSetDefaultUILanguage@4
1386 ZwSetInformationFile@20
1387 ZwSetInformationJobObject@16
1388 ZwSetInformationObject@16
1389 ZwSetInformationProcess@16
1390 ZwSetInformationThread@16
1391 ZwSetSecurityObject@12
1392 ZwSetSystemInformation@12
1396 ZwSetVolumeInformationFile@20
1397 ZwTerminateJobObject@8
1398 ZwTerminateProcess@8
1399 ZwTranslateFilePath@12
1402 ZwUnmapViewOfSection@8
1403 ZwWaitForMultipleObjects@20
1404 ZwWaitForSingleObject@12
1407 _abnormal_termination