3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
19 CcGetFileObjectFromBcb@4
20 CcGetFileObjectFromSectionPtrs@4
21 CcGetFlushedValidData@8
22 CcGetLsnForFileObject@8
23 CcInitializeCacheMap@20
25 CcFastMdlReadWait DATA
26 CcFastReadNotPossible DATA
37 CcPurgeCacheSection@16
40 CcScheduleReadAhead@12
41 CcSetAdditionalCacheAttributes@12
42 CcSetBcbOwnerPointer@8
43 CcSetDirtyPageThreshold@8
44 CcSetDirtyPinnedData@8
45 CcSetLogHandleForFile@12
46 CcSetReadAheadGranularity@8
47 CcUninitializeCacheMap@12
49 CcUnpinDataForThread@8
51 CcWaitForCurrentLazyWriterActivity@0
56 CmUnRegisterCallback@8
58 DbgBreakPointWithStatus@4
59 DbgLoadImageSymbols@12
63 DbgPrintReturnControlC
64 DbgQueryDebugFilterState@8
65 DbgSetDebugFilterState@12
66 @ExiAcquireFastMutex@4=@ExAcquireFastMutex@4
67 @ExAcquireFastMutexUnsafe@4
68 ExAcquireResourceExclusive@8
69 ExAcquireResourceExclusiveLite@8
70 ExAcquireResourceSharedLite@8
71 @ExAcquireRundownProtection@4
72 @ExAcquireRundownProtectionEx@8
73 ExAcquireSharedStarveExclusive@8
74 ExAcquireSharedWaitForExclusive@8
75 ExAllocateFromPagedLookasideList@4=ExiAllocateFromPagedLookasideList@4
77 ExAllocatePoolWithQuota@8
78 ExAllocatePoolWithQuotaTag@12
79 ExAllocatePoolWithTag@12
80 ExAllocatePoolWithTagPriority@16
81 ExConvertExclusiveToSharedLite@4
83 ExDeleteNPagedLookasideList@4
84 ExDeletePagedLookasideList@4
86 ExDeleteResourceLite@4
87 ExDesktopObjectType DATA
88 ExDisableResourceBoostLite@4
90 @ExEnterCriticalRegionAndAcquireFastMutexUnsafe@4
91 ExEventObjectType DATA
95 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
96 ExGetCurrentProcessorCounts@12
97 ExGetCurrentProcessorCpuUsage@4
98 ExGetExclusiveWaiterCount@4
100 ExGetSharedWaiterCount@4
101 @ExInitializeRundownProtection@4
102 ExInitializeNPagedLookasideList@28
103 ExInitializePagedLookasideList@28
104 ExInitializeResource@4
105 ExInitializeResourceLite@4
107 ExInterlockedAddLargeInteger@16
108 @ExInterlockedAddLargeStatistic@8
109 ExInterlockedAddUlong@12
110 @ExInterlockedCompareExchange64@16
111 ExInterlockedDecrementLong@8
112 ExInterlockedExchangeUlong@12
113 ExInterlockedExtendZone@16
114 ExInterlockedIncrementLong@8
115 @ExInterlockedFlushSList@4
116 ExInterlockedInsertHeadList@12
117 ExInterlockedInsertTailList@12
118 ExInterlockedPopEntryList@8
119 @ExInterlockedPopEntrySList@8
120 ExInterlockedPushEntryList@12
121 @ExInterlockedPushEntrySList@12
122 ExInterlockedRemoveHeadList@8
123 ExIsProcessorFeaturePresent@4
124 ExIsResourceAcquiredExclusiveLite@4
125 ExIsResourceAcquiredSharedLite@4
126 ExLocalTimeToSystemTime@8
128 ExQueryPoolBlockSize@8
130 ExRaiseAccessViolation@0
131 ExRaiseDatatypeMisalignment@0
132 ExRaiseException@4=RtlRaiseException@4
134 ExRaiseStatus@4=RtlRaiseStatus@4
135 ExRegisterCallback@12
136 ExReinitializeResourceLite@4
137 @ExReInitializeRundownProtection@4
138 @ExiReleaseFastMutex@4=@ExReleaseFastMutex@4
139 @ExReleaseFastMutexUnsafe@4
140 @ExReleaseFastMutexUnsafeAndLeaveCriticalRegion@4
141 ExReleaseResourceForThread@8
142 ExReleaseResourceForThreadLite@8
143 @ExReleaseResourceLite@4
144 @ExReleaseRundownProtection@4
145 @ExReleaseRundownProtectionEx@8
146 @ExRundownCompleted@4
147 ExSemaphoreObjectType DATA
148 ExSetResourceOwnerPointer@8
149 ExSetTimerResolution@8
150 ExSystemExceptionFilter@0
151 ExSystemTimeToLocalTime@8
152 ExTryToAcquireResourceExclusiveLite@4
153 ExUnregisterCallback@4
156 @ExWaitForRundownProtectionRelease@4
157 ExWindowStationObjectType DATA
158 @ExfAcquirePushLockExclusive@4
159 @ExfAcquirePushLockShared@4
160 @ExfReleasePushLock@4
161 @ExfInterlockedAddUlong@12
162 @ExfInterlockedInsertHeadList@12
163 @ExfInterlockedInsertTailList@12
164 @ExfInterlockedCompareExchange64@12
165 @ExfInterlockedPopEntryList@8
166 @ExfInterlockedPushEntryList@12
167 @ExfInterlockedRemoveHeadList@8
168 @Exfi386InterlockedDecrementLong@4
169 @Exfi386InterlockedExchangeUlong@8
170 @Exfi386InterlockedIncrementLong@4
171 Exi386InterlockedDecrementLong@4
172 Exi386InterlockedExchangeUlong@8
173 Exi386InterlockedIncrementLong@4
174 FsRtlAcquireFileExclusive@4
175 FsRtlAddLargeMcbEntry@28
177 FsRtlAddToTunnelCache@32
178 FsRtlAllocateFileLock@8
180 FsRtlAllocatePoolWithQuota@8
181 FsRtlAllocatePoolWithQuotaTag@12
182 FsRtlAllocatePoolWithTag@12
183 FsRtlAllocateResource@0
184 FsRtlAreNamesEqual@16
186 FsRtlCheckLockForReadAccess@8
187 FsRtlCheckLockForWriteAccess@8
191 FsRtlCurrentBatchOplock@4
192 FsRtlDeleteKeyFromTunnelCache@12
193 FsRtlDeleteTunnelCache@4
194 FsRtlDeregisterUncProvider@4
197 FsRtlDoesDbcsContainWildCards@4
198 FsRtlDoesNameContainWildCards@4
199 FsRtlFastCheckLockForRead@24
200 FsRtlFastCheckLockForWrite@24
201 FsRtlFastUnlockAll@16
202 FsRtlFastUnlockAllByKey@20
203 FsRtlFastUnlockSingle@32
204 FsRtlFindInTunnelCache@32
207 FsRtlGetNextFileLock@8
208 FsRtlGetNextLargeMcbEntry@20
209 FsRtlGetNextMcbEntry@20
210 FsRtlIncrementCcFastReadNotPossible@0
211 FsRtlIncrementCcFastReadNoWait@0
212 FsRtlIncrementCcFastReadResourceMiss@0
213 FsRtlIncrementCcFastReadWait@0
214 FsRtlInitializeFileLock@12
215 FsRtlInitializeLargeMcb@8
217 FsRtlInitializeOplock@4
218 FsRtlInitializeTunnelCache@4
219 FsRtlInsertPerFileObjectContext@8
220 FsRtlInsertPerStreamContext@8
221 FsRtlIsDbcsInExpression@8
222 FsRtlIsFatDbcsLegal@20
223 FsRtlIsHpfsDbcsLegal@20
224 FsRtlIsNameInExpression@16
225 FsRtlIsNtstatusExpected@4
227 FsRtlIsTotalDeviceFailure@4
228 FsRtlLegalAnsiCharacterArray DATA
229 FsRtlLookupLargeMcbEntry@32
230 FsRtlLookupLastLargeMcbEntry@12
231 FsRtlLookupLastLargeMcbEntryAndIndex@16
232 FsRtlLookupLastMcbEntry@12
233 FsRtlLookupMcbEntry@20
234 FsRtlLookupPerFileObjectContext@12
235 FsRtlLookupPerStreamContextInternal@12
237 FsRtlMdlReadComplete@8
238 FsRtlMdlReadCompleteDev@12
240 FsRtlMdlWriteComplete@12
241 FsRtlMdlWriteCompleteDev@16
242 FsRtlNormalizeNtstatus@8
243 FsRtlNotifyChangeDirectory@28
244 FsRtlNotifyCleanup@12
245 FsRtlNotifyFilterChangeDirectory@44
246 FsRtlNotifyFilterReportChange@40
247 FsRtlNotifyFullChangeDirectory@40
248 FsRtlNotifyFullReportChange@36
249 FsRtlNotifyInitializeSync@4
250 FsRtlNotifyReportChange@20
251 FsRtlNotifyUninitializeSync@4
252 FsRtlNotifyVolumeEvent@8
253 FsRtlNumberOfRunsInLargeMcb@4
254 FsRtlNumberOfRunsInMcb@4
256 FsRtlOplockIsFastIoPossible@4
257 FsRtlPostPagingFileStackOverflow@12
258 FsRtlPostStackOverflow@12
259 FsRtlPrepareMdlWrite@24
260 FsRtlPrepareMdlWriteDev@28
262 FsRtlProcessFileLock@12
263 FsRtlRegisterUncProvider@12
265 FsRtlRemoveLargeMcbEntry@20
266 FsRtlRemoveMcbEntry@12
267 FsRtlRemovePerFileObjectContext@12
268 FsRtlRemovePerStreamContext@12
270 FsRtlSplitLargeMcb@20
272 FsRtlTeardownPerStreamContexts@4
273 FsRtlTruncateLargeMcb@12
275 FsRtlUninitializeFileLock@4
276 FsRtlUninitializeLargeMcb@4
277 FsRtlUninitializeMcb@4
278 FsRtlUninitializeOplock@4
279 HalDispatchTable DATA
280 HalPrivateDispatchTable DATA
282 InbvAcquireDisplayOwnership@0
283 InbvCheckDisplayOwnership@0
285 InbvEnableBootDriver@4
286 InbvEnableDisplayString@4
287 InbvInstallDisplayStringFilter@4
288 InbvIsBootDriverInstalled@0
289 InbvNotifyDisplayOwnershipLost@4
291 InbvSetScrollRegion@16
293 InbvSolidColorFill@20
294 InitSafeBootMode DATA
295 @InterlockedCompareExchange@12
296 @InterlockedDecrement@4
297 @InterlockedExchange@8
298 @InterlockedExchangeAdd@8
299 @InterlockedIncrement@4
300 @InterlockedPushEntrySList@8
301 @InterlockedPopEntrySList@4
302 IoAcquireCancelSpinLock@4
303 IoAcquireRemoveLockEx@20
304 IoAcquireVpbSpinLock@4
305 IoAdapterObjectType DATA
306 IoAllocateAdapterChannel@20
309 IoAllocateController@16
310 IoAllocateDriverObjectExtension@16
311 IoAllocateErrorLogEntry@8
313 IoAssignDriveLetters@16
316 IoAttachDeviceByPointer@8
317 IoAttachDeviceToDeviceStack@8
318 IoAttachDeviceToDeviceStackSafe@12
319 IoBuildAsynchronousFsdRequest@24
320 IoBuildDeviceIoControlRequest@36
322 IoBuildSynchronousFsdRequest@28
326 IoCheckDesiredAccess@8
327 IoCheckEaBufferValidity@12
328 IoCheckFunctionAccess@24
329 IoCheckQuerySetFileInformation@12
330 IoCheckQuerySetVolumeInformation@12
331 IoCheckQuotaBufferValidity@12
332 IoCheckShareAccess@20
334 IoConnectInterrupt@44
340 IoCreateFileSpecifyDeviceObjectHint@60
341 IoCreateNotificationEvent@8
342 IoCreateStreamFileObject@8
343 IoCreateStreamFileObjectEx@12
344 IoCreateStreamFileObjectLite@8
345 IoCreateSymbolicLink@8
346 IoCreateSynchronizationEvent@8
347 IoCreateUnprotectedSymbolicLink@8
357 IoDeleteSymbolicLink@4
359 IoDeviceHandlerObjectSize DATA
360 IoDeviceHandlerObjectType DATA
361 IoDeviceObjectType DATA
362 IoDisconnectInterrupt@4
363 IoDriverObjectType DATA
365 IoEnumerateDeviceObjectList@16
366 IoFastQueryNetworkAttributes@20
367 IoFileObjectType DATA
368 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
369 IoForwardIrpSynchronously@8
371 IoFreeErrorLogEntry@4
375 IoGetAttachedDevice@4
376 IoGetAttachedDeviceReference@4
377 IoGetBaseFileSystemDeviceObject@4
378 IoGetBootDiskInformation@8
379 IoGetConfigurationInformation@0
380 IoGetCurrentProcess@0
381 IoGetDeviceObjectPointer@16
382 IoGetDeviceAttachmentBaseRef@4
383 IoGetDeviceInterfaceAlias@12
384 IoGetDeviceInterfaces@16
385 IoGetDriverObjectExtension@8
386 IoGetDeviceProperty@20
387 IoGetDeviceToVerify@4
388 IoGetDiskDeviceObject@8
390 IoGetFileObjectGenericMapping@0
392 IoGetLowerDeviceObject@4
393 IoGetRelatedDeviceObject@4
394 IoGetRequestorProcess@4
395 IoGetRequestorProcessId@4
396 IoGetRequestorSessionId@8
400 IoInvalidateDeviceRelations@8
401 IoInvalidateDeviceState@4
402 IoInitializeRemoveLockEx@20
404 IoIsFileOriginRemote@4
406 IoIsValidNameGraftingBuffer@8
407 IoIsOperationSynchronous@4
408 IoMakeAssociatedIrp@8
409 IoOpenDeviceInterfaceRegistryKey@12
410 IoOpenDeviceRegistryKey@16
412 IoPnPDeliverServicePowerNotification@16
413 IoQueryDeviceDescription@32
414 IoQueryFileDosDeviceName@8
415 IoQueryFileInformation@20
416 IoQueryVolumeInformation@20
420 IoRaiseInformationalHardError@12
421 IoReadDiskSignature@12
422 IoReadOperationCount DATA
423 @IoReadPartitionTable@16
424 IoReadPartitionTableEx@8
425 IoReadTransferCount DATA
426 IoRegisterBootDriverReinitialization@12
427 IoRegisterDeviceInterface@16
428 IoRegisterDriverReinitialization@12
429 IoRegisterFileSystem@4
430 IoRegisterFsRegistrationChange@8
431 IoRegisterLastChanceShutdownNotification@4
432 IoRegisterPlugPlayNotification@28
433 IoRegisterShutdownNotification@4
434 IoReleaseCancelSpinLock@4
435 IoReleaseRemoveLockAndWaitEx@12
436 IoReleaseRemoveLockEx@12
437 IoReleaseVpbSpinLock@4
438 IoRemoveShareAccess@8
439 IoReportDetectedDevice@32
440 IoReportHalResourceUsage@16
441 IoReportResourceUsage@36
442 IoReportResourceForDetection@28
443 IoReportTargetDeviceChange@8
444 IoReportTargetDeviceChangeAsynchronous@16
445 IoRequestDeviceEject@4
447 IoSetCompletionRoutineEx@28
448 IoSetSystemPartition@4
449 IoSetDeviceInterfaceState@8
450 IoSetDeviceToVerify@8
452 IoSetHardErrorOrVerifyDevice@8
455 @IoSetPartitionInformation@16
456 IoSetPartitionInformationEx@12
457 IoSetStartIoAttributes@12
459 IoSetThreadHardErrorMode@4
462 IoStartNextPacketByKey@12
465 IoStatisticsLock DATA
467 IoSynchronousPageWrite@20
468 IoSynchronousInvalidateDeviceRelations@8
470 IoUnregisterFileSystem@4
471 IoUnregisterFsRegistrationChange@8
472 IoUnregisterPlugPlayNotification@4
473 IoUnregisterShutdownNotification@4
474 IoUpdateShareAccess@8
475 IoValidateDeviceIoControlAccess@8
476 IoVerifyPartitionTable@8
478 IoVolumeDeviceToDosName@8
479 IoWMIAllocateInstanceIds@12
480 IoWMIDeviceObjectToInstanceName@12
481 IoWMIExecuteMethod@24
482 IoWMIHandleToInstanceName@12
485 IoWMIQueryAllDataMultiple@16
486 IoWMIQuerySingleInstance@16
487 IoWMIQuerySingleInstanceMultiple@20
488 IoWMIRegistrationControl@8
489 IoWMISetNotificationCallback@12
490 IoWMISetSingleInstance@20
491 IoWMISetSingleItem@24
492 IoWMISuggestInstanceName@16
494 IoWriteErrorLogEntry@4
495 IoWriteOperationCount DATA
496 @IoWritePartitionTable@20
497 IoWritePartitionTableEx@8
498 IoWriteTransferCount DATA
500 @IofCompleteRequest@8
501 IoIsWdmVersionAvailable@8
502 KdDebuggerEnabled DATA
503 KdDebuggerNotPresent DATA
509 KdpServiceDispatcher@12
511 Ke386IoSetAccessProcess@8
512 Ke386QueryIoAccessMap@8
513 Ke386SetIoAccessMap@8
514 @KeAcquireGuardedMutex@4
515 @KeAcquireGuardedMutexUnsafe@4
516 KeAcquireSpinLockAtDpcLevel@4
517 @KeAcquireDispatcherDatabaseLockAtDpcLevel@0
518 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
519 KeAcquireInterruptSpinLock@4
520 KeAddSystemServiceTable@20
523 ;KeBoostCurrentThread
527 KeCapturePersistentThreadState@28
530 KeDcacheFlushCount DATA
531 KeDelayExecutionThread@12
532 KeDeregisterBugCheckCallback@4
533 KeDeregisterBugCheckReasonCallback@4
535 KeDisconnectInterrupt@4
536 KeEnterCriticalRegion@0
537 KeEnterGuardedRegion@0
538 KeEnterKernelDebugger@0
539 KeFindConfigurationEntry@16
540 KeFindConfigurationNextEntry@20
545 KeGetRecommendedSharedDataAlignment@0
547 KeI386AllocateGdtSelectors@8
548 ;KeI386Call16BitCStyleFunction
549 ;KeI386Call16BitFunction
550 KeI386FlatToGdtSelector@12
552 ;KeI386MachineType DATA
553 KeI386ReleaseGdtSelectors@8
555 ;KeI386SetGdtSelector
556 KeIcacheFlushCount DATA
558 KeInitializeDeviceQueue@4
561 @KeInitializeGuardedMutex@4
562 KeInitializeInterrupt@44
566 KeInitializeSemaphore@12
567 KeInitializeSpinLock@4
569 KeInitializeTimerEx@8
570 KeInsertByKeyDeviceQueue@12
571 KeInsertDeviceQueue@8
576 KeIsAttachedProcess@0
578 KeLeaveCriticalRegion@0
579 KeLeaveGuardedRegion@0
581 KeNumberProcessors DATA
583 KeProfileInterruptWithSource@8
585 KeQueryActiveProcessors@0
586 KeQueryInterruptTime@0
587 KeQueryPriorityThread@4
588 KeQueryRuntimeThread@8
591 KeQueryTimeIncrement@0
592 KeRaiseUserException@4
595 KeReadStateMutex@4=KeReadStateMutant@4
597 KeReadStateSemaphore@4
599 KeRegisterBugCheckCallback@20
600 KeRegisterBugCheckReasonCallback@16
601 @KeReleaseDispatcherDatabaseLockFromDpcLevel@0
602 @KeReleaseGuardedMutexUnsafe@4
603 @KeReleaseGuardedMutex@4
604 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
605 KeReleaseInterruptSpinLock@8
608 KeReleaseSemaphore@16
609 KeReleaseSpinLockFromDpcLevel@4
610 KeRemoveByKeyDeviceQueue@8
611 KeRemoveByKeyDeviceQueueIfBusy@8
612 KeRemoveDeviceQueue@4
613 KeRemoveEntryDeviceQueue@8
616 KeRemoveSystemServiceTable@4
618 KeRestoreFloatingPointState@4
619 KeRevertToUserAffinityThread@0
621 KeSaveFloatingPointState@4
622 KeSaveStateForHibernate
623 KeServiceDescriptorTable DATA
624 KeSetAffinityThread@8
625 KeSetBasePriorityThread@8
626 KeSetDmaIoCoherency@4
628 KeSetEventBoostPriority@8
629 KeSetIdealProcessorThread@8
631 KeSetKernelStackSwapEnable@4
632 KeSetPriorityThread@8
634 KeSetSystemAffinityThread@4
635 ;KeSetSwapContextNotifyRoutine
636 KeSetTargetProcessorDpc@8
637 ;KeSetThreadSelectNotifyRoutine
641 @KeSetTimeUpdateNotifyRoutine@4
642 KeStackAttachProcess@8
643 KeSynchronizeExecution@12
646 @KeTryToAcquireGuardedMutex@4
649 KeUnstackDetachProcess@4
650 KeUserModeCallback@20
651 KeWaitForMultipleObjects@32
652 KeWaitForMutexObject@20=KeWaitForSingleObject@20
653 KeWaitForSingleObject@20
654 @KefAcquireSpinLockAtDpcLevel@4
655 @KefReleaseSpinLockFromDpcLevel@4
660 KiCheckForKernelApcDelivery@0
662 KiDispatchInterrupt@0
663 KiEnableTimerWatchdog
664 KiInterruptDispatch2@8
665 KiIpiServiceRoutine@8
667 KiUnexpectedInterrupt@0
668 ;Kii386SpinOnSpinLock
672 LdrFindResourceDirectory_U@16
674 LpcPortObjectType DATA
676 LpcRequestWaitReplyPort@12
677 LsaCallAuthenticationPackage@28
678 LsaDeregisterLogonProcess@8
679 LsaFreeReturnBuffer@4
681 LsaLookupAuthenticationPackage@12
682 LsaRegisterLogonProcess@12
683 Mm64BitPhysicalAddress DATA
684 MmAddPhysicalMemory@8
685 MmAddVerifierThunks@8
686 MmAdjustWorkingSetSize@12
688 MmAllocateContiguousMemory@12
689 MmAllocateContiguousMemorySpecifyCache@32
690 MmAllocateMappingAddress@8
691 MmAllocateNonCachedMemory@4
692 MmAllocatePagesForMdl@28
693 MmBuildMdlForNonPagedPool@4
694 MmCanFileBeTruncated@8
697 MmDbgTranslatePhysicalAddress@8
698 MmDisableModifiedWriteOfSection@4
699 MmFlushImageSection@8
700 MmForceSectionClosed@8
701 MmFreeContiguousMemory@4
702 MmFreeContiguousMemorySpecifyCache@12
703 MmFreeMappingAddress@8
704 MmFreeNonCachedMemory@8
706 MmGetPhysicalAddress@4
707 MmGetPhysicalMemoryRanges@0
708 MmGetSystemRoutineAddress@4
709 MmGetVirtualForPhysical@8
711 MmHighestUserAddress DATA
713 MmIsDriverVerifying@4
714 MmIsNonPagedSystemAddressValid@4
715 MmIsRecursiveIoFault@0
716 MmIsThisAnNtAsSystem@0
717 MmIsVerifierEnabled@4
718 MmLockPagableDataSection@4
719 MmLockPagableImageSection@4=MmLockPagableDataSection@4
720 MmLockPagableSectionByHandle@4
723 MmMapLockedPagesSpecifyCache@24
724 MmMapLockedPagesWithReservedMapping@16
726 MmMapUserAddressesToPage@12
728 MmMapViewInSessionSpace@12
729 MmMapViewInSystemSpace@12
730 MmMapViewOfSection@40
731 MmMarkPhysicalMemoryAsBad@8
732 MmMarkPhysicalMemoryAsGood@8
735 MmProbeAndLockPages@12
736 MmProbeAndLockProcessPages@16
737 MmProbeAndLockSelectedPages@16
738 MmProtectMdlSystemAddress@8
740 MmRemovePhysicalMemory@8
741 MmResetDriverPaging@4
742 MmSectionObjectType DATA
743 MmSecureVirtualMemory@12
744 MmSetAddressRangeModified@8
745 MmSetBankedSection@24
747 MmSystemRangeStart DATA
748 MmTrimAllSystemPagableMemory@4
749 MmUnlockPagableImageSection@4
753 MmUnmapReservedMapping@12
754 MmUnmapVideoDisplay@8
755 MmUnmapViewInSessionSpace@4
756 MmUnmapViewInSystemSpace@4
757 MmUnmapViewOfSection@8
758 MmUnsecureVirtualMemory@4
759 MmUserProbeAddress DATA
762 NlsMbCodePageTag DATA
763 NlsMbOemCodePageTag DATA
765 NlsOemLeadByteInfo DATA
767 NtAdjustPrivilegesToken@24
769 NtAllocateLocallyUniqueId@4
771 NtAllocateVirtualMemory@24
782 NtDeviceIoControlFile@40
786 NtFreeVirtualMemory@16
790 NtMakePermanentObject@4
791 NtMapViewOfSection@40
792 NtNotifyChangeDirectoryFile@36
795 NtOpenProcessToken@12
796 NtOpenProcessTokenEx@16
799 NtOpenThreadTokenEx@20
800 NtQueryDirectoryFile@44
802 NtQueryInformationAtom@20
803 NtQueryInformationFile@20
804 NtQueryInformationProcess@20
805 NtQueryInformationThread@20
806 NtQueryInformationToken@20
807 NtQueryQuotaInformationFile@36
808 NtQuerySecurityObject@20
809 NtQuerySystemInformation@16
811 NtQueryVolumeInformationFile@20
814 NtRequestWaitReplyPort@12
817 NtSetInformationFile@20
818 NtSetInformationProcess@16
819 NtSetInformationThread@16
820 NtSetQuotaInformationFile@16
821 NtSetSecurityObject@12
822 NtSetVolumeInformationFile@20
829 NtWaitForSingleObject@12
832 ;ObCheckCreateObjectAccess@28
833 ;ObCheckObjectAccess@20
835 ObDereferenceSecurityDescriptor@8
836 ObFindHandleForObject@20
837 ObGetObjectPointerCount@4
838 ObGetObjectSecurity@12
840 ObLogSecurityDescriptor@12
841 ObMakeTemporaryObject@4
842 ObOpenObjectByName@28
843 ObOpenObjectByPointer@28
845 ObQueryObjectAuditingByHandle@8
846 @ObfDereferenceObject@4
847 @ObfReferenceObject@4
848 ObReferenceObjectByHandle@24
849 ObReferenceObjectByName@32
850 ObReferenceObjectByPointer@16
851 ObReleaseObjectSecurity@8
852 ObDereferenceObject@4
853 ;ObSetSecurityDescriptorInfo@24
859 PoQueueShutdownWorkItem@4
860 PoRegisterDeviceForIdleDetection@16
861 PoRegisterSystemState@8
866 PoStartNextPowerIrp@4
867 PoUnregisterSystemState@4
870 PsAssignImpersonationToken@8
872 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
873 PsChargeProcessPagedPoolQuota@8
874 PsChargeProcessPoolQuota@12
875 PsCreateSystemProcess@12
876 PsCreateSystemThread@28
877 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
878 PsDereferencePrimaryToken@4
879 PsDisableImpersonation@8
880 PsEstablishWin32Callouts@4
881 PsGetCurrentProcess@0=KeGetCurrentProcess@0
882 PsGetCurrentProcessId@0
883 PsGetCurrentProcessSessionId@0
884 PsGetCurrentThread@0=KeGetCurrentThread@0
885 PsGetCurrentThreadId@0
886 PsGetCurrentThreadPreviousMode@0
887 PsGetCurrentThreadStackBase@0
888 PsGetCurrentThreadStackLimit@0
891 PsGetJobUIRestrictionsClass@4
892 PsGetProcessCreateTimeQuadPart@4
893 PsGetProcessDebugPort@4
894 PsGetProcessExitProcessCalled@4
895 PsGetProcessExitStatus@4
896 PsGetProcessExitTime@0
898 PsGetProcessImageFileName@4
899 PsGetProcessInheritedFromUniqueProcessId@4
902 PsGetProcessPriorityClass@4
903 PsGetProcessSectionBaseAddress@4
904 PsGetProcessSecurityPort@4
905 PsGetProcessSessionId@4
906 PsGetProcessWin32Process@4
907 PsGetProcessWin32WindowStation@4
908 PsGetThreadFreezeCount@4
909 PsGetThreadHardErrorsAreDisabled@4
912 PsGetThreadProcessId@4
913 PsGetThreadSessionId@4
915 PsGetThreadWin32Thread@4
919 PsImpersonateClient@20
920 PsInitialSystemProcess DATA
921 PsIsProcessBeingDebugged@4
923 PsIsThreadImpersonating@4
924 PsIsThreadTerminating@4
926 PsLookupProcessByProcessId@8
927 PsLookupProcessThreadByCid@12
928 PsLookupThreadByThreadId@8
930 PsReferenceImpersonationToken@16
931 PsReferencePrimaryToken@4
932 PsRemoveCreateThreadNotifyRoutine@4
933 PsRemoveLoadImageNotifyRoutine@4
934 PsRestoreImpersonation@8
936 PsReturnProcessNonPagedPoolQuota@8
937 PsReturnProcessPagedPoolQuota@8
939 PsRevertThreadToSelf@4
940 PsSetCreateProcessNotifyRoutine@8
941 PsSetCreateThreadNotifyRoutine@4
942 PsSetJobUIRestrictionsClass@8
943 PsSetLegoNotifyRoutine@4
944 PsSetProcessPriorityClass@8
945 PsSetProcessPriorityByClass@8
946 PsSetProcessSecurityPort@8
947 PsSetProcessWin32Process@8
948 PsSetProcessWindowStation@8
949 PsSetThreadHardErrorsAreDisabled@8
950 PsSetThreadWin32Thread@8
951 PsSetLoadImageNotifyRoutine@4
952 PsTerminateSystemThread@4
954 READ_REGISTER_UCHAR@4
955 READ_REGISTER_ULONG@4
956 READ_REGISTER_USHORT@4
957 READ_REGISTER_BUFFER_UCHAR@12
958 READ_REGISTER_BUFFER_ULONG@12
959 READ_REGISTER_BUFFER_USHORT@12
961 KeRosDumpStackFrames@8
962 KeRosGetStackFrames@8
963 RtlAbsoluteToSelfRelativeSD@12
964 RtlAddAccessAllowedAce@16
966 RtlAddAtomToAtomTable@12
968 ;RtlAllocateAndInitializeSid
970 RtlAnsiCharToUnicodeChar@4
971 RtlAnsiStringToUnicodeSize@4=RtlxAnsiStringToUnicodeSize@4
972 RtlAnsiStringToUnicodeString@12
973 RtlAppendAsciizToString@8
974 RtlAppendStringToString@8
975 RtlAppendUnicodeStringToString@8
976 RtlAppendUnicodeToString@8
977 RtlAreAllAccessesGranted@8
978 RtlAreAnyAccessesGranted@8
983 RtlCaptureStackBackTrace@16
985 RtlCheckRegistryKey@8
990 RtlCompareMemoryUlong@12
992 RtlCompareUnicodeString@12
995 RtlConvertLongToLargeInteger@4
996 RtlConvertSidToUnicodeString@12
997 RtlConvertUlongToLargeInteger@4
1002 RtlCopyUnicodeString@8
1004 RtlCreateAtomTable@8
1006 RtlCreateRegistryKey@8
1007 RtlCreateSecurityDescriptor@8
1008 RtlCreateSystemVolumeInformationFolder@4
1009 RtlCreateUnicodeString@8
1010 RtlCustomCPToUnicodeN@24
1011 RtlDecompressBuffer@24
1012 RtlDecompressChunks@28
1013 RtlDecompressFragment@32
1016 RtlDeleteAtomFromAtomTable@8
1017 RtlDeleteElementGenericTable@8
1018 RtlDeleteElementGenericTableAvl@8
1020 RtlDeleteOwnersRanges@8
1022 RtlDeleteRegistryValue@12
1024 RtlDestroyAtomTable@4
1026 RtlDowncaseUnicodeString@12
1027 RtlDuplicateUnicodeString@12
1029 RtlEnlargedIntegerMultiply@8
1030 RtlEnlargedUnsignedDivide@16
1031 RtlEnlargedUnsignedMultiply@8
1032 RtlEnumerateGenericTable@8
1033 RtlEnumerateGenericTableAvl@8
1034 RtlEnumerateGenericTableLikeADirectory@28
1035 RtlEnumerateGenericTableWithoutSplaying@8
1036 RtlEnumerateGenericTableWithoutSplayingAvl@8
1040 RtlEqualUnicodeString@12
1041 RtlExtendedIntegerMultiply@12
1042 RtlExtendedLargeIntegerDivide@16
1043 RtlExtendedMagicDivide@20
1045 RtlFillMemoryUlong@12
1047 RtlFindClearBitsAndSet@12
1049 RtlFindFirstRunClear@8
1050 RtlFindFirstRunSet@8
1051 RtlFindLastBackwardRunClear@12
1052 RtlFindLeastSignificantBit@8
1053 RtlFindLongestRunClear@8
1054 RtlFindLongestRunSet@8
1056 RtlFindMostSignificantBit@8
1057 RtlFindNextForwardRunClear@12
1060 RtlFindSetBitsAndClear@12
1061 RtlFindUnicodePrefix@12
1062 RtlFormatCurrentUserKeyPath@4
1067 RtlFreeUnicodeString@4
1069 RtlGenerate8dot3Name@16
1071 RtlGetCallersAddress@8
1072 RtlGetCompressionWorkSpaceSize@12
1073 RtlGetDaclSecurityDescriptor@16
1074 RtlGetDefaultCodePage@8
1075 RtlGetElementGenericTable@8
1076 RtlGetElementGenericTableAvl@8
1078 RtlGetGroupSecurityDescriptor@12
1080 RtlGetNtGlobalFlags@0
1081 RtlGetOwnerSecurityDescriptor@12
1082 RtlGetSaclSecurityDescriptor@16
1083 RtlGetSetBootStatusData@24
1085 RtlHashUnicodeString@16
1087 RtlImageDirectoryEntryToData@16
1089 RtlInitCodePageTable@8
1091 RtlInitUnicodeString@8
1092 RtlInitializeBitMap@12
1093 RtlInitializeGenericTable@20
1094 RtlInitializeGenericTableAvl@20
1095 RtlInitializeRangeList@4
1097 RtlInitializeUnicodePrefix@4
1098 RtlInsertElementGenericTable@16
1099 RtlInsertElementGenericTableAvl@16
1100 RtlInsertElementGenericTableFull@24
1101 RtlInsertElementGenericTableFullAvl@24
1102 RtlInsertUnicodePrefix@12
1103 RtlInt64ToUnicodeString@16
1105 RtlIntegerToUnicode@16
1106 RtlIntegerToUnicodeString@12
1107 RtlInvertRangeList@8
1108 RtlIpv4AddressToStringA@8
1109 RtlIpv4AddressToStringExA@16
1110 RtlIpv4AddressToStringExW@16
1111 RtlIpv4AddressToStringW@8
1112 RtlIpv4StringToAddressA@16
1113 RtlIpv4StringToAddressExA@16
1114 RtlIpv4StringToAddressExW@16
1115 RtlIpv4StringToAddressW@16
1116 RtlIpv6AddressToStringA@8
1117 RtlIpv6AddressToStringExA@16
1118 RtlIpv6AddressToStringExW@16
1119 RtlIpv6AddressToStringW@8
1120 RtlIpv6StringToAddressA@16
1121 RtlIpv6StringToAddressExA@16
1122 RtlIpv6StringToAddressExW@16
1123 RtlIpv6StringToAddressW@16
1124 RtlIsGenericTableEmpty@4
1125 RtlIsGenericTableEmptyAvl@4
1126 RtlIsNameLegalDOS8Dot3@12
1127 RtlIsRangeAvailable@40
1128 RtlIsValidOemCharacter@4
1129 RtlLargeIntegerAdd@16
1130 RtlLargeIntegerArithmeticShift@12
1131 RtlLargeIntegerDivide@20
1132 RtlLargeIntegerNegate@8
1133 RtlLargeIntegerShiftLeft@12
1134 RtlLargeIntegerShiftRight@12
1135 RtlLargeIntegerSubtract@16
1136 RtlLengthRequiredSid@4
1137 RtlLengthSecurityDescriptor@4
1139 RtlLockBootStatusData@4
1140 RtlLookupAtomInAtomTable@12
1141 RtlLookupElementGenericTable@8
1142 RtlLookupElementGenericTableAvl@8
1143 RtlLookupElementGenericTableFull@16
1144 RtlLookupElementGenericTableFullAvl@16
1146 RtlMapSecurityErrorToNtStatus@4
1147 RtlMergeRangeLists@16
1149 RtlMultiByteToUnicodeN@20
1150 RtlMultiByteToUnicodeSize@12
1151 RtlNextUnicodePrefix@8
1152 RtlNtStatusToDosError@4
1153 RtlNtStatusToDosErrorNoTeb@4
1154 RtlNumberGenericTableElements@4
1155 RtlNumberGenericTableElementsAvl@4
1156 RtlNumberOfClearBits@4
1157 RtlNumberOfSetBits@4
1158 RtlOemStringToCountedUnicodeString@12
1159 RtlOemStringToUnicodeSize@4=RtlxOemStringToUnicodeSize@4
1160 RtlOemStringToUnicodeString@12
1162 RtlPinAtomInAtomTable@8
1163 @RtlPrefetchMemoryNonTemporal@8
1165 RtlPrefixUnicodeString@12
1166 RtlQueryAtomInAtomTable@24
1167 RtlQueryRegistryValues@20
1168 RtlQueryTimeZoneInformation@4
1172 RtlRealPredecessor@4
1174 RtlRemoveUnicodePrefix@8
1176 RtlSecondsSince1970ToTime@8
1177 RtlSecondsSince1980ToTime@8
1178 RtlSelfRelativeToAbsoluteSD2@8
1179 RtlSelfRelativeToAbsoluteSD@44
1183 RtlSetDaclSecurityDescriptor@16
1184 RtlSetGroupSecurityDescriptor@12
1185 RtlSetOwnerSecurityDescriptor@12
1186 RtlSetSaclSecurityDescriptor@16
1187 RtlSetTimeZoneInformation@4
1191 RtlSubAuthorityCountSid@4
1192 RtlSubAuthoritySid@8
1193 RtlSubtreePredecessor@4
1194 RtlSubtreeSuccessor@4
1196 RtlTimeFieldsToTime@8
1197 RtlTimeToElapsedTimeFields@8
1198 RtlTimeToSecondsSince1970@8
1199 RtlTimeToSecondsSince1980@8
1200 RtlTimeToTimeFields@8
1202 @RtlUlonglongByteSwap@8
1203 RtlUnicodeStringToAnsiSize@4=RtlxUnicodeStringToAnsiSize@4
1204 RtlUnicodeStringToAnsiString@12
1205 RtlUnicodeStringToCountedOemString@12
1206 RtlUnicodeStringToInteger@12
1207 RtlUnicodeStringToOemSize@4=RtlxUnicodeStringToOemSize@4
1208 RtlUnicodeStringToOemString@12
1209 RtlUnicodeToCustomCPN@24
1210 RtlUnicodeToMultiByteN@20
1211 RtlUnicodeToMultiByteSize@12
1213 RtlUnlockBootStatusData@4
1215 RtlUpcaseUnicodeChar@4
1216 RtlUpcaseUnicodeString@12
1217 RtlUpcaseUnicodeStringToAnsiString@12
1218 RtlUpcaseUnicodeStringToCountedOemString@12
1219 RtlUpcaseUnicodeStringToOemString@12
1220 RtlUpcaseUnicodeToCustomCPN@24
1221 RtlUpcaseUnicodeToMultiByteN@20
1222 RtlUpcaseUnicodeToOemN@20
1225 @RtlUshortByteSwap@4
1226 RtlValidRelativeSecurityDescriptor@12
1227 RtlValidSecurityDescriptor@4
1229 RtlVerifyVersionInfo@16
1230 RtlVolumeDeviceToDosName@8
1231 RtlWalkFrameChain@12
1232 RtlWriteRegistryValue@24
1235 RtlxAnsiStringToUnicodeSize@4
1236 RtlxOemStringToUnicodeSize@4
1237 RtlxUnicodeStringToAnsiSize@4
1238 RtlxUnicodeStringToOemSize@4
1240 SeAppendPrivileges@8
1242 SeAssignSecurityEx@36
1243 SeAuditHardLinkCreation@12
1244 SeAuditingFileEvents@8
1245 SeAuditingFileEventsWithContext@12
1246 SeAuditingFileOrGlobalEvents@12
1247 SeAuditingHardLinkEvents@8
1248 SeAuditingHardLinkEventsWithContext@12
1249 SeCaptureSecurityDescriptor@20
1250 SeCaptureSubjectContext@4
1251 SeCloseObjectAuditAlarm@12
1252 SeCreateAccessState@16
1253 SeCreateClientSecurity@16
1254 SeCreateClientSecurityFromSubjectContext@16
1255 SeDeassignSecurity@4
1256 SeDeleteAccessState@4
1257 SeDeleteObjectAuditAlarm@8
1261 SeImpersonateClient@8
1262 SeImpersonateClientEx@8
1263 SeLockSubjectContext@4
1264 SeMarkLogonSessionForTerminationNotification@4
1265 SeOpenObjectAuditAlarm@36
1266 SeOpenObjectForDeleteAuditAlarm@36
1268 SePrivilegeObjectAuditAlarm@24
1269 SePublicDefaultDacl DATA
1270 SeQueryAuthenticationIdToken@8
1271 SeQueryInformationToken@12
1272 SeQuerySecurityDescriptorInfo@16
1273 SeQuerySessionIdToken@8
1274 SeRegisterLogonSessionTerminatedRoutine@4
1275 SeReleaseSecurityDescriptor@12
1276 SeReleaseSubjectContext@4
1277 SeSetAccessStateGenericMapping@8
1278 SeSetSecurityDescriptorInfo@24
1279 SeSetSecurityDescriptorInfoEx@28
1280 SeSinglePrivilegeCheck@12
1281 SeSystemDefaultDacl DATA
1282 SeTokenImpersonationLevel@4
1284 SeTokenIsRestricted@4
1285 SeTokenIsWriteRestricted@4
1287 SeUnlockSubjectContext@4
1288 SeUnregisterLogonSessionTerminatedRoutine@4
1289 SeValidSecurityDescriptor@8
1290 VerSetConditionMask@16
1291 WRITE_REGISTER_UCHAR@8
1292 WRITE_REGISTER_ULONG@8
1293 WRITE_REGISTER_USHORT@8
1294 WRITE_REGISTER_BUFFER_UCHAR@12
1295 WRITE_REGISTER_BUFFER_ULONG@12
1296 WRITE_REGISTER_BUFFER_USHORT@12
1297 ZwAccessCheckAndAuditAlarm@44
1299 ZwAdjustPrivilegesToken@24
1301 ZwAllocateVirtualMemory@24
1302 ZwAssignProcessToJobObject@8
1307 ZwCloseObjectAuditAlarm@12
1309 ZwCreateDirectoryObject@12
1312 ZwCreateJobObject@12
1315 ZwCreateSymbolicLinkObject@16
1321 ZwDeviceIoControlFile@40
1323 ZwDuplicateObject@28
1325 ZwEnumerateBootEntries@8
1327 ZwEnumerateValueKey@24
1328 ZwFlushInstructionCache@12
1330 ZwFlushVirtualMemory@16
1331 ZwFreeVirtualMemory@16
1333 ZwInitiatePowerAction@16
1337 ZwMakeTemporaryObject@4
1338 ZwMapViewOfSection@40
1339 ZwNotifyChangeKey@40
1340 ZwOpenDirectoryObject@12
1346 ZwOpenProcessToken@12
1347 ZwOpenProcessTokenEx@16
1349 ZwOpenSymbolicLinkObject@12
1351 ZwOpenThreadToken@16
1352 ZwOpenThreadTokenEx@20
1354 ZwPowerInformation@20
1356 ZwQueryBootEntryOrder@8
1357 ZwQueryBootOptions@8
1358 ZwQueryDefaultLocale@8
1359 ZwQueryDefaultUILanguage@4
1360 ZwQueryDirectoryFile@44
1361 ZwQueryDirectoryObject@28
1363 ZwQueryFullAttributesFile@8
1364 ZwQueryInformationAtom@20
1365 ZwQueryInformationFile@20
1366 ZwQueryInformationJobObject@20
1367 ZwQueryInformationProcess@20
1368 ZwQueryInformationThread@20
1369 ZwQueryInformationToken@20
1370 ZwQueryInstallUILanguage@4
1374 ZwQuerySecurityObject@20
1375 ZwQuerySymbolicLinkObject@12
1376 ZwQuerySystemInformation@16
1379 ZwQueryVolumeInformationFile@20
1382 ZwRequestWaitReplyPort@12
1387 ZwSetBootEntryOrder@8
1389 ZwSetDefaultLocale@8
1390 ZwSetDefaultUILanguage@4
1393 ZwSetInformationFile@20
1394 ZwSetInformationJobObject@16
1395 ZwSetInformationObject@16
1396 ZwSetInformationProcess@16
1397 ZwSetInformationThread@16
1398 ZwSetSecurityObject@12
1399 ZwSetSystemInformation@12
1403 ZwSetVolumeInformationFile@20
1404 ZwTerminateJobObject@8
1405 ZwTerminateProcess@8
1406 ZwTranslateFilePath@12
1409 ZwUnmapViewOfSection@8
1410 ZwWaitForMultipleObjects@20
1411 ZwWaitForSingleObject@12
1414 _abnormal_termination