3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
19 CcGetFileObjectFromBcb@4
20 CcGetFileObjectFromSectionPtrs@4
21 CcGetFlushedValidData@8
22 CcGetLsnForFileObject@8
23 CcInitializeCacheMap@20
25 CcFastMdlReadWait DATA
26 CcFastReadNotPossible DATA
37 CcPurgeCacheSection@16
40 CcScheduleReadAhead@12
41 CcSetAdditionalCacheAttributes@12
42 CcSetBcbOwnerPointer@8
43 CcSetDirtyPageThreshold@8
44 CcSetDirtyPinnedData@8
45 CcSetLogHandleForFile@12
46 CcSetReadAheadGranularity@8
47 CcUninitializeCacheMap@12
49 CcUnpinDataForThread@8
51 CcWaitForCurrentLazyWriterActivity@0
56 CmUnRegisterCallback@8
58 DbgBreakPointWithStatus@4
59 DbgLoadImageSymbols@12
63 DbgPrintReturnControlC
64 DbgQueryDebugFilterState@8
65 DbgSetDebugFilterState@12
66 @ExAcquireFastMutexUnsafe@4
67 ExAcquireResourceExclusive@8
68 ExAcquireResourceExclusiveLite@8
69 ExAcquireResourceSharedLite@8
70 @ExAcquireRundownProtection@4
71 @ExAcquireRundownProtectionEx@8
72 ExAcquireSharedStarveExclusive@8
73 ExAcquireSharedWaitForExclusive@8
74 ExAllocateFromPagedLookasideList@4=ExiAllocateFromPagedLookasideList@4
76 ExAllocatePoolWithQuota@8
77 ExAllocatePoolWithQuotaTag@12
78 ExAllocatePoolWithTag@12
79 ExAllocatePoolWithTagPriority@16
80 ExConvertExclusiveToSharedLite@4
82 ExDeleteNPagedLookasideList@4
83 ExDeletePagedLookasideList@4
85 ExDeleteResourceLite@4
86 ExDesktopObjectType DATA
87 ExDisableResourceBoostLite@4
89 ExEventObjectType DATA
93 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
94 ExGetCurrentProcessorCounts@12
95 ExGetCurrentProcessorCpuUsage@4
96 ExGetExclusiveWaiterCount@4
98 ExGetSharedWaiterCount@4
99 @ExInitializeRundownProtection@4
100 ExInitializeNPagedLookasideList@28
101 ExInitializePagedLookasideList@28
102 ExInitializeResource@4
103 ExInitializeResourceLite@4
105 ExInterlockedAddLargeInteger@16
106 @ExInterlockedAddLargeStatistic@8
107 ExInterlockedAddUlong@12
108 @ExInterlockedCompareExchange64@16
109 ExInterlockedDecrementLong@8
110 ExInterlockedExchangeUlong@12
111 ExInterlockedExtendZone@16
112 ExInterlockedIncrementLong@8
113 @ExInterlockedFlushSList@4
114 ExInterlockedInsertHeadList@12
115 ExInterlockedInsertTailList@12
116 ExInterlockedPopEntryList@8
117 @ExInterlockedPopEntrySList@8
118 ExInterlockedPushEntryList@12
119 @ExInterlockedPushEntrySList@12
120 ExInterlockedRemoveHeadList@8
121 ExIsProcessorFeaturePresent@4
122 ExIsResourceAcquiredExclusiveLite@4
123 ExIsResourceAcquiredSharedLite@4
124 ExLocalTimeToSystemTime@8
126 ExQueryPoolBlockSize@8
128 ExRaiseAccessViolation@0
129 ExRaiseDatatypeMisalignment@0
130 ExRaiseException@4=RtlRaiseException@4
132 ExRaiseStatus@4=RtlRaiseStatus@4
133 ExRegisterCallback@12
134 ExReinitializeResourceLite@4
135 @ExReInitializeRundownProtection@4
136 @ExReleaseFastMutexUnsafe@4
137 ExReleaseResourceForThread@8
138 ExReleaseResourceForThreadLite@8
139 @ExReleaseResourceLite@4
140 @ExReleaseRundownProtection@4
141 @ExReleaseRundownProtectionEx@8
142 @ExRundownCompleted@4
143 ExSemaphoreObjectType DATA
144 ExSetResourceOwnerPointer@8
145 ExSetTimerResolution@8
146 ExSystemExceptionFilter@0
147 ExSystemTimeToLocalTime@8
148 ExTryToAcquireResourceExclusiveLite@4
149 ExUnregisterCallback@4
152 @ExWaitForRundownProtectionRelease@4
153 ExWindowStationObjectType DATA
154 @ExfAcquirePushLockExclusive@4
155 @ExfAcquirePushLockShared@4
156 @ExfReleasePushLock@4
157 @ExfInterlockedAddUlong@12
158 @ExfInterlockedInsertHeadList@12
159 @ExfInterlockedInsertTailList@12
160 @ExfInterlockedCompareExchange64@12
161 @ExfInterlockedPopEntryList@8
162 @ExfInterlockedPushEntryList@12
163 @ExfInterlockedRemoveHeadList@8
164 @Exfi386InterlockedDecrementLong@4
165 @Exfi386InterlockedExchangeUlong@8
166 @Exfi386InterlockedIncrementLong@4
167 Exi386InterlockedDecrementLong@4
168 Exi386InterlockedExchangeUlong@8
169 Exi386InterlockedIncrementLong@4
170 FsRtlAcquireFileExclusive@4
171 FsRtlAddLargeMcbEntry@28
173 FsRtlAddToTunnelCache@32
174 FsRtlAllocateFileLock@8
176 FsRtlAllocatePoolWithQuota@8
177 FsRtlAllocatePoolWithQuotaTag@12
178 FsRtlAllocatePoolWithTag@12
179 FsRtlAllocateResource@0
180 FsRtlAreNamesEqual@16
182 FsRtlCheckLockForReadAccess@8
183 FsRtlCheckLockForWriteAccess@8
187 FsRtlCurrentBatchOplock@4
188 FsRtlDeleteKeyFromTunnelCache@12
189 FsRtlDeleteTunnelCache@4
190 FsRtlDeregisterUncProvider@4
193 FsRtlDoesDbcsContainWildCards@4
194 FsRtlDoesNameContainWildCards@4
195 FsRtlFastCheckLockForRead@24
196 FsRtlFastCheckLockForWrite@24
197 FsRtlFastUnlockAll@16
198 FsRtlFastUnlockAllByKey@20
199 FsRtlFastUnlockSingle@32
200 FsRtlFindInTunnelCache@32
203 FsRtlGetNextFileLock@8
204 FsRtlGetNextLargeMcbEntry@20
205 FsRtlGetNextMcbEntry@20
206 FsRtlIncrementCcFastReadNotPossible@0
207 FsRtlIncrementCcFastReadNoWait@0
208 FsRtlIncrementCcFastReadResourceMiss@0
209 FsRtlIncrementCcFastReadWait@0
210 FsRtlInitializeFileLock@12
211 FsRtlInitializeLargeMcb@8
213 FsRtlInitializeOplock@4
214 FsRtlInitializeTunnelCache@4
215 FsRtlInsertPerFileObjectContext@8
216 FsRtlInsertPerStreamContext@8
217 FsRtlIsDbcsInExpression@8
218 FsRtlIsFatDbcsLegal@20
219 FsRtlIsHpfsDbcsLegal@20
220 FsRtlIsNameInExpression@16
221 FsRtlIsNtstatusExpected@4
223 FsRtlIsTotalDeviceFailure@4
224 FsRtlLegalAnsiCharacterArray DATA
225 FsRtlLookupLargeMcbEntry@32
226 FsRtlLookupLastLargeMcbEntry@12
227 FsRtlLookupLastLargeMcbEntryAndIndex@16
228 FsRtlLookupLastMcbEntry@12
229 FsRtlLookupMcbEntry@20
230 FsRtlLookupPerFileObjectContext@12
231 FsRtlLookupPerStreamContextInternal@12
233 FsRtlMdlReadComplete@8
234 FsRtlMdlReadCompleteDev@12
236 FsRtlMdlWriteComplete@12
237 FsRtlMdlWriteCompleteDev@16
238 FsRtlNormalizeNtstatus@8
239 FsRtlNotifyChangeDirectory@28
240 FsRtlNotifyCleanup@12
241 FsRtlNotifyFilterChangeDirectory@44
242 FsRtlNotifyFilterReportChange@40
243 FsRtlNotifyFullChangeDirectory@40
244 FsRtlNotifyFullReportChange@36
245 FsRtlNotifyInitializeSync@4
246 FsRtlNotifyReportChange@20
247 FsRtlNotifyUninitializeSync@4
248 FsRtlNotifyVolumeEvent@8
249 FsRtlNumberOfRunsInLargeMcb@4
250 FsRtlNumberOfRunsInMcb@4
252 FsRtlOplockIsFastIoPossible@4
253 FsRtlPostPagingFileStackOverflow@12
254 FsRtlPostStackOverflow@12
255 FsRtlPrepareMdlWrite@24
256 FsRtlPrepareMdlWriteDev@28
258 FsRtlProcessFileLock@12
259 FsRtlRegisterUncProvider@12
261 FsRtlRemoveLargeMcbEntry@20
262 FsRtlRemoveMcbEntry@12
263 FsRtlRemovePerFileObjectContext@12
264 FsRtlRemovePerStreamContext@12
266 FsRtlSplitLargeMcb@20
268 FsRtlTeardownPerStreamContexts@4
269 FsRtlTruncateLargeMcb@12
271 FsRtlUninitializeFileLock@4
272 FsRtlUninitializeLargeMcb@4
273 FsRtlUninitializeMcb@4
274 FsRtlUninitializeOplock@4
275 HalDispatchTable DATA
276 HalPrivateDispatchTable DATA
278 InbvAcquireDisplayOwnership@0
279 InbvCheckDisplayOwnership@0
281 InbvEnableBootDriver@4
282 InbvEnableDisplayString@4
283 InbvInstallDisplayStringFilter@4
284 InbvIsBootDriverInstalled@0
285 InbvNotifyDisplayOwnershipLost@4
287 InbvSetScrollRegion@16
289 InbvSolidColorFill@20
290 InitSafeBootMode DATA
291 @InterlockedCompareExchange@12
292 @InterlockedDecrement@4
293 @InterlockedExchange@8
294 @InterlockedExchangeAdd@8
295 @InterlockedIncrement@4
296 @InterlockedPushEntrySList@8
297 @InterlockedPopEntrySList@4
298 IoAcquireCancelSpinLock@4
299 IoAcquireRemoveLockEx@20
300 IoAcquireVpbSpinLock@4
301 IoAdapterObjectType DATA
302 IoAllocateAdapterChannel@20
305 IoAllocateController@16
306 IoAllocateDriverObjectExtension@16
307 IoAllocateErrorLogEntry@8
309 IoAssignDriveLetters@16
312 IoAttachDeviceByPointer@8
313 IoAttachDeviceToDeviceStack@8
314 IoAttachDeviceToDeviceStackSafe@12
315 IoBuildAsynchronousFsdRequest@24
316 IoBuildDeviceIoControlRequest@36
318 IoBuildSynchronousFsdRequest@28
322 IoCheckDesiredAccess@8
323 IoCheckEaBufferValidity@12
324 IoCheckFunctionAccess@24
325 IoCheckQuerySetFileInformation@12
326 IoCheckQuerySetVolumeInformation@12
327 IoCheckQuotaBufferValidity@12
328 IoCheckShareAccess@20
330 IoConnectInterrupt@44
336 IoCreateFileSpecifyDeviceObjectHint@60
337 IoCreateNotificationEvent@8
338 IoCreateStreamFileObject@8
339 IoCreateStreamFileObjectEx@12
340 IoCreateStreamFileObjectLite@8
341 IoCreateSymbolicLink@8
342 IoCreateSynchronizationEvent@8
343 IoCreateUnprotectedSymbolicLink@8
353 IoDeleteSymbolicLink@4
355 IoDeviceHandlerObjectSize DATA
356 IoDeviceHandlerObjectType DATA
357 IoDeviceObjectType DATA
358 IoDisconnectInterrupt@4
359 IoDriverObjectType DATA
361 IoEnumerateDeviceObjectList@16
362 IoFastQueryNetworkAttributes@20
363 IoFileObjectType DATA
364 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
365 IoForwardIrpSynchronously@8
367 IoFreeErrorLogEntry@4
371 IoGetAttachedDevice@4
372 IoGetAttachedDeviceReference@4
373 IoGetBaseFileSystemDeviceObject@4
374 IoGetBootDiskInformation@8
375 IoGetConfigurationInformation@0
376 IoGetCurrentProcess@0
377 IoGetDeviceObjectPointer@16
378 IoGetDeviceAttachmentBaseRef@4
379 IoGetDeviceInterfaceAlias@12
380 IoGetDeviceInterfaces@16
381 IoGetDriverObjectExtension@8
382 IoGetDeviceProperty@20
383 IoGetDeviceToVerify@4
384 IoGetDiskDeviceObject@8
386 IoGetFileObjectGenericMapping@0
388 IoGetLowerDeviceObject@4
389 IoGetRelatedDeviceObject@4
390 IoGetRequestorProcess@4
391 IoGetRequestorProcessId@4
392 IoGetRequestorSessionId@8
396 IoInvalidateDeviceRelations@8
397 IoInvalidateDeviceState@4
398 IoInitializeRemoveLockEx@20
400 IoIsFileOriginRemote@4
402 IoIsValidNameGraftingBuffer@8
403 IoIsOperationSynchronous@4
404 IoMakeAssociatedIrp@8
405 IoOpenDeviceInterfaceRegistryKey@12
406 IoOpenDeviceRegistryKey@16
408 IoPnPDeliverServicePowerNotification@16
409 IoQueryDeviceDescription@32
410 IoQueryFileDosDeviceName@8
411 IoQueryFileInformation@20
412 IoQueryVolumeInformation@20
416 IoRaiseInformationalHardError@12
417 IoReadDiskSignature@12
418 IoReadOperationCount DATA
419 @IoReadPartitionTable@16
420 IoReadPartitionTableEx@8
421 IoReadTransferCount DATA
422 IoRegisterBootDriverReinitialization@12
423 IoRegisterDeviceInterface@16
424 IoRegisterDriverReinitialization@12
425 IoRegisterFileSystem@4
426 IoRegisterFsRegistrationChange@8
427 IoRegisterLastChanceShutdownNotification@4
428 IoRegisterPlugPlayNotification@28
429 IoRegisterShutdownNotification@4
430 IoReleaseCancelSpinLock@4
431 IoReleaseRemoveLockAndWaitEx@12
432 IoReleaseRemoveLockEx@12
433 IoReleaseVpbSpinLock@4
434 IoRemoveShareAccess@8
435 IoReportDetectedDevice@32
436 IoReportHalResourceUsage@16
437 IoReportResourceUsage@36
438 IoReportResourceForDetection@28
439 IoReportTargetDeviceChange@8
440 IoReportTargetDeviceChangeAsynchronous@16
441 IoRequestDeviceEject@4
443 IoSetCompletionRoutineEx@28
444 IoSetSystemPartition@4
445 IoSetDeviceInterfaceState@8
446 IoSetDeviceToVerify@8
448 IoSetHardErrorOrVerifyDevice@8
451 @IoSetPartitionInformation@16
452 IoSetPartitionInformationEx@12
453 IoSetStartIoAttributes@12
455 IoSetThreadHardErrorMode@4
458 IoStartNextPacketByKey@12
461 IoStatisticsLock DATA
463 IoSynchronousPageWrite@20
464 IoSynchronousInvalidateDeviceRelations@8
466 IoUnregisterFileSystem@4
467 IoUnregisterFsRegistrationChange@8
468 IoUnregisterPlugPlayNotification@4
469 IoUnregisterShutdownNotification@4
470 IoUpdateShareAccess@8
471 IoValidateDeviceIoControlAccess@8
472 IoVerifyPartitionTable@8
474 IoVolumeDeviceToDosName@8
475 IoWMIAllocateInstanceIds@12
476 IoWMIDeviceObjectToInstanceName@12
477 IoWMIExecuteMethod@24
478 IoWMIHandleToInstanceName@12
481 IoWMIQueryAllDataMultiple@16
482 IoWMIQuerySingleInstance@16
483 IoWMIQuerySingleInstanceMultiple@20
484 IoWMIRegistrationControl@8
485 IoWMISetNotificationCallback@12
486 IoWMISetSingleInstance@20
487 IoWMISetSingleItem@24
488 IoWMISuggestInstanceName@16
490 IoWriteErrorLogEntry@4
491 IoWriteOperationCount DATA
492 @IoWritePartitionTable@20
493 IoWritePartitionTableEx@8
494 IoWriteTransferCount DATA
496 @IofCompleteRequest@8
497 IoIsWdmVersionAvailable@8
498 KdDebuggerEnabled DATA
499 KdDebuggerNotPresent DATA
505 KdpServiceDispatcher@12
507 Ke386IoSetAccessProcess@8
508 Ke386QueryIoAccessMap@8
509 Ke386SetIoAccessMap@8
510 @KeAcquireGuardedMutex@4
511 @KeAcquireGuardedMutexUnsafe@4
512 KeAcquireSpinLockAtDpcLevel@4
513 @KeAcquireDispatcherDatabaseLockAtDpcLevel@0
514 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
515 KeAcquireInterruptSpinLock@4
516 KeAddSystemServiceTable@20
519 ;KeBoostCurrentThread
523 KeCapturePersistentThreadState@28
526 KeDcacheFlushCount DATA
527 KeDelayExecutionThread@12
528 KeDeregisterBugCheckCallback@4
529 KeDeregisterBugCheckReasonCallback@4
531 KeDisconnectInterrupt@4
532 KeEnterCriticalRegion@0
533 KeEnterGuardedRegion@0
534 KeEnterKernelDebugger@0
535 KeFindConfigurationEntry@16
536 KeFindConfigurationNextEntry@20
541 KeGetRecommendedSharedDataAlignment@0
543 KeI386AllocateGdtSelectors@8
544 ;KeI386Call16BitCStyleFunction
545 ;KeI386Call16BitFunction
546 KeI386FlatToGdtSelector@12
548 ;KeI386MachineType DATA
549 KeI386ReleaseGdtSelectors@8
551 ;KeI386SetGdtSelector
552 KeIcacheFlushCount DATA
554 KeInitializeDeviceQueue@4
557 @KeInitializeGuardedMutex@4
558 KeInitializeInterrupt@44
562 KeInitializeSemaphore@12
563 KeInitializeSpinLock@4
565 KeInitializeTimerEx@8
566 KeInsertByKeyDeviceQueue@12
567 KeInsertDeviceQueue@8
572 KeIsAttachedProcess@0
574 KeLeaveCriticalRegion@0
575 KeLeaveGuardedRegion@0
577 KeNumberProcessors DATA
579 KeProfileInterruptWithSource@8
581 KeQueryActiveProcessors@0
582 KeQueryInterruptTime@0
583 KeQueryPriorityThread@4
584 KeQueryRuntimeThread@8
587 KeQueryTimeIncrement@0
588 KeRaiseUserException@4
591 KeReadStateMutex@4=KeReadStateMutant@4
593 KeReadStateSemaphore@4
595 KeRegisterBugCheckCallback@20
596 KeRegisterBugCheckReasonCallback@16
597 @KeReleaseDispatcherDatabaseLockFromDpcLevel@0
598 @KeReleaseGuardedMutexUnsafe@4
599 @KeReleaseGuardedMutex@4
600 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
601 KeReleaseInterruptSpinLock@8
604 KeReleaseSemaphore@16
605 KeReleaseSpinLockFromDpcLevel@4
606 KeRemoveByKeyDeviceQueue@8
607 KeRemoveByKeyDeviceQueueIfBusy@8
608 KeRemoveDeviceQueue@4
609 KeRemoveEntryDeviceQueue@8
612 KeRemoveSystemServiceTable@4
614 KeRestoreFloatingPointState@4
615 KeRevertToUserAffinityThread@0
617 KeSaveFloatingPointState@4
618 KeSaveStateForHibernate
619 KeServiceDescriptorTable DATA
620 KeSetAffinityThread@8
621 KeSetBasePriorityThread@8
622 KeSetDmaIoCoherency@4
624 KeSetEventBoostPriority@8
625 KeSetIdealProcessorThread@8
627 KeSetKernelStackSwapEnable@4
628 KeSetPriorityThread@8
630 KeSetSystemAffinityThread@4
631 ;KeSetSwapContextNotifyRoutine
632 KeSetTargetProcessorDpc@8
633 ;KeSetThreadSelectNotifyRoutine
637 @KeSetTimeUpdateNotifyRoutine@4
638 KeStackAttachProcess@8
639 KeSynchronizeExecution@12
642 @KeTryToAcquireGuardedMutex@4
645 KeUnstackDetachProcess@4
646 KeUserModeCallback@20
647 KeWaitForMultipleObjects@32
648 KeWaitForMutexObject@20=KeWaitForSingleObject@20
649 KeWaitForSingleObject@20
650 @KefAcquireSpinLockAtDpcLevel@4
651 @KefReleaseSpinLockFromDpcLevel@4
656 KiCheckForKernelApcDelivery@0
658 KiDispatchInterrupt@0
659 KiEnableTimerWatchdog
660 KiInterruptDispatch2@8
661 KiIpiServiceRoutine@8
663 KiUnexpectedInterrupt@0
664 ;Kii386SpinOnSpinLock
668 LdrFindResourceDirectory_U@16
670 LpcPortObjectType DATA
672 LpcRequestWaitReplyPort@12
673 LsaCallAuthenticationPackage@28
674 LsaDeregisterLogonProcess@8
675 LsaFreeReturnBuffer@4
677 LsaLookupAuthenticationPackage@12
678 LsaRegisterLogonProcess@12
679 Mm64BitPhysicalAddress DATA
680 MmAddPhysicalMemory@8
681 MmAddVerifierThunks@8
682 MmAdjustWorkingSetSize@12
684 MmAllocateContiguousMemory@12
685 MmAllocateContiguousMemorySpecifyCache@32
686 MmAllocateMappingAddress@8
687 MmAllocateNonCachedMemory@4
688 MmAllocatePagesForMdl@28
689 MmBuildMdlForNonPagedPool@4
690 MmCanFileBeTruncated@8
693 MmDbgTranslatePhysicalAddress@8
694 MmDisableModifiedWriteOfSection@4
695 MmFlushImageSection@8
696 MmForceSectionClosed@8
697 MmFreeContiguousMemory@4
698 MmFreeContiguousMemorySpecifyCache@12
699 MmFreeMappingAddress@8
700 MmFreeNonCachedMemory@8
702 MmGetPhysicalAddress@4
703 MmGetPhysicalMemoryRanges@0
704 MmGetSystemRoutineAddress@4
705 MmGetVirtualForPhysical@8
707 MmHighestUserAddress DATA
709 MmIsDriverVerifying@4
710 MmIsNonPagedSystemAddressValid@4
711 MmIsRecursiveIoFault@0
712 MmIsThisAnNtAsSystem@0
713 MmIsVerifierEnabled@4
714 MmLockPagableDataSection@4
715 MmLockPagableImageSection@4=MmLockPagableDataSection@4
716 MmLockPagableSectionByHandle@4
719 MmMapLockedPagesSpecifyCache@24
720 MmMapLockedPagesWithReservedMapping@16
722 MmMapUserAddressesToPage@12
724 MmMapViewInSessionSpace@12
725 MmMapViewInSystemSpace@12
726 MmMapViewOfSection@40
727 MmMarkPhysicalMemoryAsBad@8
728 MmMarkPhysicalMemoryAsGood@8
731 MmProbeAndLockPages@12
732 MmProbeAndLockProcessPages@16
733 MmProbeAndLockSelectedPages@16
734 MmProtectMdlSystemAddress@8
736 MmRemovePhysicalMemory@8
737 MmResetDriverPaging@4
738 MmSectionObjectType DATA
739 MmSecureVirtualMemory@12
740 MmSetAddressRangeModified@8
741 MmSetBankedSection@24
743 MmSystemRangeStart DATA
744 MmTrimAllSystemPagableMemory@4
745 MmUnlockPagableImageSection@4
749 MmUnmapReservedMapping@12
750 MmUnmapVideoDisplay@8
751 MmUnmapViewInSessionSpace@4
752 MmUnmapViewInSystemSpace@4
753 MmUnmapViewOfSection@8
754 MmUnsecureVirtualMemory@4
755 MmUserProbeAddress DATA
758 NlsMbCodePageTag DATA
759 NlsMbOemCodePageTag DATA
761 NlsOemLeadByteInfo DATA
763 NtAdjustPrivilegesToken@24
765 NtAllocateLocallyUniqueId@4
767 NtAllocateVirtualMemory@24
778 NtDeviceIoControlFile@40
782 NtFreeVirtualMemory@16
786 NtMakePermanentObject@4
787 NtMapViewOfSection@40
788 NtNotifyChangeDirectoryFile@36
791 NtOpenProcessToken@12
792 NtOpenProcessTokenEx@16
795 NtOpenThreadTokenEx@20
796 NtQueryDirectoryFile@44
798 NtQueryInformationAtom@20
799 NtQueryInformationFile@20
800 NtQueryInformationProcess@20
801 NtQueryInformationThread@20
802 NtQueryInformationToken@20
803 NtQueryQuotaInformationFile@36
804 NtQuerySecurityObject@20
805 NtQuerySystemInformation@16
807 NtQueryVolumeInformationFile@20
810 NtRequestWaitReplyPort@12
813 NtSetInformationFile@20
814 NtSetInformationProcess@16
815 NtSetInformationThread@16
816 NtSetQuotaInformationFile@16
817 NtSetSecurityObject@12
818 NtSetVolumeInformationFile@20
825 NtWaitForSingleObject@12
828 ;ObCheckCreateObjectAccess@28
829 ;ObCheckObjectAccess@20
831 ObDereferenceSecurityDescriptor@8
832 ObFindHandleForObject@20
833 ObGetObjectPointerCount@4
834 ObGetObjectSecurity@12
836 ObLogSecurityDescriptor@12
837 ObMakeTemporaryObject@4
838 ObOpenObjectByName@28
839 ObOpenObjectByPointer@28
841 ObQueryObjectAuditingByHandle@8
842 @ObfDereferenceObject@4
843 @ObfReferenceObject@4
844 ObReferenceObjectByHandle@24
845 ObReferenceObjectByName@32
846 ObReferenceObjectByPointer@16
847 ObReleaseObjectSecurity@8
848 ObDereferenceObject@4
849 ;ObSetSecurityDescriptorInfo@24
855 PoQueueShutdownWorkItem@4
856 PoRegisterDeviceForIdleDetection@16
857 PoRegisterSystemState@8
862 PoStartNextPowerIrp@4
863 PoUnregisterSystemState@4
866 PsAssignImpersonationToken@8
868 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
869 PsChargeProcessPagedPoolQuota@8
870 PsChargeProcessPoolQuota@12
871 PsCreateSystemProcess@12
872 PsCreateSystemThread@28
873 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
874 PsDereferencePrimaryToken@4
875 PsDisableImpersonation@8
876 PsEstablishWin32Callouts@4
877 PsGetCurrentProcess@0=KeGetCurrentProcess@0
878 PsGetCurrentProcessId@0
879 PsGetCurrentProcessSessionId@0
880 PsGetCurrentThread@0=KeGetCurrentThread@0
881 PsGetCurrentThreadId@0
882 PsGetCurrentThreadPreviousMode@0
883 PsGetCurrentThreadStackBase@0
884 PsGetCurrentThreadStackLimit@0
887 PsGetJobUIRestrictionsClass@4
888 PsGetProcessCreateTimeQuadPart@4
889 PsGetProcessDebugPort@4
890 PsGetProcessExitProcessCalled@4
891 PsGetProcessExitStatus@4
892 PsGetProcessExitTime@0
894 PsGetProcessImageFileName@4
895 PsGetProcessInheritedFromUniqueProcessId@4
898 PsGetProcessPriorityClass@4
899 PsGetProcessSectionBaseAddress@4
900 PsGetProcessSecurityPort@4
901 PsGetProcessSessionId@4
902 PsGetProcessWin32Process@4
903 PsGetProcessWin32WindowStation@4
904 PsGetThreadFreezeCount@4
905 PsGetThreadHardErrorsAreDisabled@4
908 PsGetThreadProcessId@4
909 PsGetThreadSessionId@4
911 PsGetThreadWin32Thread@4
915 PsImpersonateClient@20
916 PsInitialSystemProcess DATA
917 PsIsProcessBeingDebugged@4
919 PsIsThreadImpersonating@4
920 PsIsThreadTerminating@4
922 PsLookupProcessByProcessId@8
923 PsLookupProcessThreadByCid@12
924 PsLookupThreadByThreadId@8
926 PsReferenceImpersonationToken@16
927 PsReferencePrimaryToken@4
928 PsRemoveCreateThreadNotifyRoutine@4
929 PsRemoveLoadImageNotifyRoutine@4
930 PsRestoreImpersonation@8
932 PsReturnProcessNonPagedPoolQuota@8
933 PsReturnProcessPagedPoolQuota@8
935 PsRevertThreadToSelf@4
936 PsSetCreateProcessNotifyRoutine@8
937 PsSetCreateThreadNotifyRoutine@4
938 PsSetJobUIRestrictionsClass@8
939 PsSetLegoNotifyRoutine@4
940 PsSetProcessPriorityClass@8
941 PsSetProcessPriorityByClass@8
942 PsSetProcessSecurityPort@8
943 PsSetProcessWin32Process@8
944 PsSetProcessWindowStation@8
945 PsSetThreadHardErrorsAreDisabled@8
946 PsSetThreadWin32Thread@8
947 PsSetLoadImageNotifyRoutine@4
948 PsTerminateSystemThread@4
950 READ_REGISTER_UCHAR@4
951 READ_REGISTER_ULONG@4
952 READ_REGISTER_USHORT@4
953 READ_REGISTER_BUFFER_UCHAR@12
954 READ_REGISTER_BUFFER_ULONG@12
955 READ_REGISTER_BUFFER_USHORT@12
957 KeRosDumpStackFrames@8
958 KeRosGetStackFrames@8
959 RtlAbsoluteToSelfRelativeSD@12
960 RtlAddAccessAllowedAce@16
962 RtlAddAtomToAtomTable@12
964 ;RtlAllocateAndInitializeSid
966 RtlAnsiCharToUnicodeChar@4
967 RtlAnsiStringToUnicodeSize@4=RtlxAnsiStringToUnicodeSize@4
968 RtlAnsiStringToUnicodeString@12
969 RtlAppendAsciizToString@8
970 RtlAppendStringToString@8
971 RtlAppendUnicodeStringToString@8
972 RtlAppendUnicodeToString@8
973 RtlAreAllAccessesGranted@8
974 RtlAreAnyAccessesGranted@8
979 RtlCaptureStackBackTrace@16
981 RtlCheckRegistryKey@8
986 RtlCompareMemoryUlong@12
988 RtlCompareUnicodeString@12
991 RtlConvertLongToLargeInteger@4
992 RtlConvertSidToUnicodeString@12
993 RtlConvertUlongToLargeInteger@4
998 RtlCopyUnicodeString@8
1000 RtlCreateAtomTable@8
1002 RtlCreateRegistryKey@8
1003 RtlCreateSecurityDescriptor@8
1004 RtlCreateSystemVolumeInformationFolder@4
1005 RtlCreateUnicodeString@8
1006 RtlCustomCPToUnicodeN@24
1007 RtlDecompressBuffer@24
1008 RtlDecompressChunks@28
1009 RtlDecompressFragment@32
1012 RtlDeleteAtomFromAtomTable@8
1013 RtlDeleteElementGenericTable@8
1014 RtlDeleteElementGenericTableAvl@8
1016 RtlDeleteOwnersRanges@8
1018 RtlDeleteRegistryValue@12
1020 RtlDestroyAtomTable@4
1022 RtlDowncaseUnicodeString@12
1023 RtlDuplicateUnicodeString@12
1025 RtlEnlargedIntegerMultiply@8
1026 RtlEnlargedUnsignedDivide@16
1027 RtlEnlargedUnsignedMultiply@8
1028 RtlEnumerateGenericTable@8
1029 RtlEnumerateGenericTableAvl@8
1030 RtlEnumerateGenericTableLikeADirectory@28
1031 RtlEnumerateGenericTableWithoutSplaying@8
1032 RtlEnumerateGenericTableWithoutSplayingAvl@8
1036 RtlEqualUnicodeString@12
1037 RtlExtendedIntegerMultiply@12
1038 RtlExtendedLargeIntegerDivide@16
1039 RtlExtendedMagicDivide@20
1041 RtlFillMemoryUlong@12
1043 RtlFindClearBitsAndSet@12
1045 RtlFindFirstRunClear@8
1046 RtlFindFirstRunSet@8
1047 RtlFindLastBackwardRunClear@12
1048 RtlFindLeastSignificantBit@8
1049 RtlFindLongestRunClear@8
1050 RtlFindLongestRunSet@8
1052 RtlFindMostSignificantBit@8
1053 RtlFindNextForwardRunClear@12
1056 RtlFindSetBitsAndClear@12
1057 RtlFindUnicodePrefix@12
1058 RtlFormatCurrentUserKeyPath@4
1063 RtlFreeUnicodeString@4
1065 RtlGenerate8dot3Name@16
1067 RtlGetCallersAddress@8
1068 RtlGetCompressionWorkSpaceSize@12
1069 RtlGetDaclSecurityDescriptor@16
1070 RtlGetDefaultCodePage@8
1071 RtlGetElementGenericTable@8
1072 RtlGetElementGenericTableAvl@8
1074 RtlGetGroupSecurityDescriptor@12
1076 RtlGetNtGlobalFlags@0
1077 RtlGetOwnerSecurityDescriptor@12
1078 RtlGetSaclSecurityDescriptor@16
1079 RtlGetSetBootStatusData@24
1081 RtlHashUnicodeString@16
1083 RtlImageDirectoryEntryToData@16
1085 RtlInitCodePageTable@8
1087 RtlInitUnicodeString@8
1088 RtlInitializeBitMap@12
1089 RtlInitializeGenericTable@20
1090 RtlInitializeGenericTableAvl@20
1091 RtlInitializeRangeList@4
1093 RtlInitializeUnicodePrefix@4
1094 RtlInsertElementGenericTable@16
1095 RtlInsertElementGenericTableAvl@16
1096 RtlInsertElementGenericTableFull@24
1097 RtlInsertElementGenericTableFullAvl@24
1098 RtlInsertUnicodePrefix@12
1099 RtlInt64ToUnicodeString@16
1101 RtlIntegerToUnicode@16
1102 RtlIntegerToUnicodeString@12
1103 RtlInvertRangeList@8
1104 RtlIpv4AddressToStringA@8
1105 RtlIpv4AddressToStringExA@16
1106 RtlIpv4AddressToStringExW@16
1107 RtlIpv4AddressToStringW@8
1108 RtlIpv4StringToAddressA@16
1109 RtlIpv4StringToAddressExA@16
1110 RtlIpv4StringToAddressExW@16
1111 RtlIpv4StringToAddressW@16
1112 RtlIpv6AddressToStringA@8
1113 RtlIpv6AddressToStringExA@16
1114 RtlIpv6AddressToStringExW@16
1115 RtlIpv6AddressToStringW@8
1116 RtlIpv6StringToAddressA@16
1117 RtlIpv6StringToAddressExA@16
1118 RtlIpv6StringToAddressExW@16
1119 RtlIpv6StringToAddressW@16
1120 RtlIsGenericTableEmpty@4
1121 RtlIsGenericTableEmptyAvl@4
1122 RtlIsNameLegalDOS8Dot3@12
1123 RtlIsRangeAvailable@40
1124 RtlIsValidOemCharacter@4
1125 RtlLargeIntegerAdd@16
1126 RtlLargeIntegerArithmeticShift@12
1127 RtlLargeIntegerDivide@20
1128 RtlLargeIntegerNegate@8
1129 RtlLargeIntegerShiftLeft@12
1130 RtlLargeIntegerShiftRight@12
1131 RtlLargeIntegerSubtract@16
1132 RtlLengthRequiredSid@4
1133 RtlLengthSecurityDescriptor@4
1135 RtlLockBootStatusData@4
1136 RtlLookupAtomInAtomTable@12
1137 RtlLookupElementGenericTable@8
1138 RtlLookupElementGenericTableAvl@8
1139 RtlLookupElementGenericTableFull@16
1140 RtlLookupElementGenericTableFullAvl@16
1142 RtlMapSecurityErrorToNtStatus@4
1143 RtlMergeRangeLists@16
1145 RtlMultiByteToUnicodeN@20
1146 RtlMultiByteToUnicodeSize@12
1147 RtlNextUnicodePrefix@8
1148 RtlNtStatusToDosError@4
1149 RtlNtStatusToDosErrorNoTeb@4
1150 RtlNumberGenericTableElements@4
1151 RtlNumberGenericTableElementsAvl@4
1152 RtlNumberOfClearBits@4
1153 RtlNumberOfSetBits@4
1154 RtlOemStringToCountedUnicodeString@12
1155 RtlOemStringToUnicodeSize@4=RtlxOemStringToUnicodeSize@4
1156 RtlOemStringToUnicodeString@12
1158 RtlPinAtomInAtomTable@8
1159 @RtlPrefetchMemoryNonTemporal@8
1161 RtlPrefixUnicodeString@12
1162 RtlQueryAtomInAtomTable@24
1163 RtlQueryRegistryValues@20
1164 RtlQueryTimeZoneInformation@4
1168 RtlRealPredecessor@4
1170 RtlRemoveUnicodePrefix@8
1172 RtlSecondsSince1970ToTime@8
1173 RtlSecondsSince1980ToTime@8
1174 RtlSelfRelativeToAbsoluteSD2@8
1175 RtlSelfRelativeToAbsoluteSD@44
1179 RtlSetDaclSecurityDescriptor@16
1180 RtlSetGroupSecurityDescriptor@12
1181 RtlSetOwnerSecurityDescriptor@12
1182 RtlSetSaclSecurityDescriptor@16
1183 RtlSetTimeZoneInformation@4
1187 RtlSubAuthorityCountSid@4
1188 RtlSubAuthoritySid@8
1189 RtlSubtreePredecessor@4
1190 RtlSubtreeSuccessor@4
1192 RtlTimeFieldsToTime@8
1193 RtlTimeToElapsedTimeFields@8
1194 RtlTimeToSecondsSince1970@8
1195 RtlTimeToSecondsSince1980@8
1196 RtlTimeToTimeFields@8
1198 @RtlUlonglongByteSwap@8
1199 RtlUnicodeStringToAnsiSize@4=RtlxUnicodeStringToAnsiSize@4
1200 RtlUnicodeStringToAnsiString@12
1201 RtlUnicodeStringToCountedOemString@12
1202 RtlUnicodeStringToInteger@12
1203 RtlUnicodeStringToOemSize@4=RtlxUnicodeStringToOemSize@4
1204 RtlUnicodeStringToOemString@12
1205 RtlUnicodeToCustomCPN@24
1206 RtlUnicodeToMultiByteN@20
1207 RtlUnicodeToMultiByteSize@12
1209 RtlUnlockBootStatusData@4
1211 RtlUpcaseUnicodeChar@4
1212 RtlUpcaseUnicodeString@12
1213 RtlUpcaseUnicodeStringToAnsiString@12
1214 RtlUpcaseUnicodeStringToCountedOemString@12
1215 RtlUpcaseUnicodeStringToOemString@12
1216 RtlUpcaseUnicodeToCustomCPN@24
1217 RtlUpcaseUnicodeToMultiByteN@20
1218 RtlUpcaseUnicodeToOemN@20
1221 @RtlUshortByteSwap@4
1222 RtlValidRelativeSecurityDescriptor@12
1223 RtlValidSecurityDescriptor@4
1225 RtlVerifyVersionInfo@16
1226 RtlVolumeDeviceToDosName@8
1227 RtlWalkFrameChain@12
1228 RtlWriteRegistryValue@24
1231 RtlxAnsiStringToUnicodeSize@4
1232 RtlxOemStringToUnicodeSize@4
1233 RtlxUnicodeStringToAnsiSize@4
1234 RtlxUnicodeStringToOemSize@4
1236 SeAppendPrivileges@8
1238 SeAssignSecurityEx@36
1239 SeAuditHardLinkCreation@12
1240 SeAuditingFileEvents@8
1241 SeAuditingFileEventsWithContext@12
1242 SeAuditingFileOrGlobalEvents@12
1243 SeAuditingHardLinkEvents@8
1244 SeAuditingHardLinkEventsWithContext@12
1245 SeCaptureSecurityDescriptor@20
1246 SeCaptureSubjectContext@4
1247 SeCloseObjectAuditAlarm@12
1248 SeCreateAccessState@16
1249 SeCreateClientSecurity@16
1250 SeCreateClientSecurityFromSubjectContext@16
1251 SeDeassignSecurity@4
1252 SeDeleteAccessState@4
1253 SeDeleteObjectAuditAlarm@8
1257 SeImpersonateClient@8
1258 SeImpersonateClientEx@8
1259 SeLockSubjectContext@4
1260 SeMarkLogonSessionForTerminationNotification@4
1261 SeOpenObjectAuditAlarm@36
1262 SeOpenObjectForDeleteAuditAlarm@36
1264 SePrivilegeObjectAuditAlarm@24
1265 SePublicDefaultDacl DATA
1266 SeQueryAuthenticationIdToken@8
1267 SeQueryInformationToken@12
1268 SeQuerySecurityDescriptorInfo@16
1269 SeQuerySessionIdToken@8
1270 SeRegisterLogonSessionTerminatedRoutine@4
1271 SeReleaseSecurityDescriptor@12
1272 SeReleaseSubjectContext@4
1273 SeSetAccessStateGenericMapping@8
1274 SeSetSecurityDescriptorInfo@24
1275 SeSetSecurityDescriptorInfoEx@28
1276 SeSinglePrivilegeCheck@12
1277 SeSystemDefaultDacl DATA
1278 SeTokenImpersonationLevel@4
1280 SeTokenIsRestricted@4
1281 SeTokenIsWriteRestricted@4
1283 SeUnlockSubjectContext@4
1284 SeUnregisterLogonSessionTerminatedRoutine@4
1285 SeValidSecurityDescriptor@8
1286 VerSetConditionMask@16
1287 WRITE_REGISTER_UCHAR@8
1288 WRITE_REGISTER_ULONG@8
1289 WRITE_REGISTER_USHORT@8
1290 WRITE_REGISTER_BUFFER_UCHAR@12
1291 WRITE_REGISTER_BUFFER_ULONG@12
1292 WRITE_REGISTER_BUFFER_USHORT@12
1293 ZwAccessCheckAndAuditAlarm@44
1295 ZwAdjustPrivilegesToken@24
1297 ZwAllocateVirtualMemory@24
1298 ZwAssignProcessToJobObject@8
1303 ZwCloseObjectAuditAlarm@12
1305 ZwCreateDirectoryObject@12
1308 ZwCreateJobObject@12
1311 ZwCreateSymbolicLinkObject@16
1317 ZwDeviceIoControlFile@40
1319 ZwDuplicateObject@28
1321 ZwEnumerateBootEntries@8
1323 ZwEnumerateValueKey@24
1324 ZwFlushInstructionCache@12
1326 ZwFlushVirtualMemory@16
1327 ZwFreeVirtualMemory@16
1329 ZwInitiatePowerAction@16
1333 ZwMakeTemporaryObject@4
1334 ZwMapViewOfSection@40
1335 ZwNotifyChangeKey@40
1336 ZwOpenDirectoryObject@12
1342 ZwOpenProcessToken@12
1343 ZwOpenProcessTokenEx@16
1345 ZwOpenSymbolicLinkObject@12
1347 ZwOpenThreadToken@16
1348 ZwOpenThreadTokenEx@20
1350 ZwPowerInformation@20
1352 ZwQueryBootEntryOrder@8
1353 ZwQueryBootOptions@8
1354 ZwQueryDefaultLocale@8
1355 ZwQueryDefaultUILanguage@4
1356 ZwQueryDirectoryFile@44
1357 ZwQueryDirectoryObject@28
1359 ZwQueryFullAttributesFile@8
1360 ZwQueryInformationAtom@20
1361 ZwQueryInformationFile@20
1362 ZwQueryInformationJobObject@20
1363 ZwQueryInformationProcess@20
1364 ZwQueryInformationThread@20
1365 ZwQueryInformationToken@20
1366 ZwQueryInstallUILanguage@4
1370 ZwQuerySecurityObject@20
1371 ZwQuerySymbolicLinkObject@12
1372 ZwQuerySystemInformation@16
1375 ZwQueryVolumeInformationFile@20
1378 ZwRequestWaitReplyPort@12
1383 ZwSetBootEntryOrder@8
1385 ZwSetDefaultLocale@8
1386 ZwSetDefaultUILanguage@4
1389 ZwSetInformationFile@20
1390 ZwSetInformationJobObject@16
1391 ZwSetInformationObject@16
1392 ZwSetInformationProcess@16
1393 ZwSetInformationThread@16
1394 ZwSetSecurityObject@12
1395 ZwSetSystemInformation@12
1399 ZwSetVolumeInformationFile@20
1400 ZwTerminateJobObject@8
1401 ZwTerminateProcess@8
1402 ZwTranslateFilePath@12
1405 ZwUnmapViewOfSection@8
1406 ZwWaitForMultipleObjects@20
1407 ZwWaitForSingleObject@12
1410 _abnormal_termination