1 ; $Id: ntoskrnl.def,v 1.142 2002/09/07 15:12:47 chorns Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@12
9 ;CcRosRequestCacheSegment@20
10 ;CcRosReleaseCacheSegment@12
11 CcRosReleaseFileCache@8
16 CcSetDirtyPinnedData@8
21 DbgBreakPointWithStatus@4
22 ;DbgLoadImageSymbols@12
26 @ExAcquireFastMutexUnsafe@4
27 ExAcquireResourceExclusive@8
28 ExAcquireResourceExclusiveLite@8
29 ExAcquireResourceSharedLite@8
30 ExAcquireSharedStarveExclusive@8
31 ExAcquireSharedWaitForExclusive@8
32 ExAllocateFromNPagedLookasideList@4
33 ExAllocateFromPagedLookasideList@4
35 ExAllocatePoolWithQuota@8
36 ExAllocatePoolWithQuotaTag@12
37 ExAllocatePoolWithTag@12
38 ExConvertExclusiveToSharedLite@4
40 ExDeleteNPagedLookasideList@4
41 ExDeletePagedLookasideList@4
43 ExDeleteResourceLite@4
44 ExDesktopObjectType DATA
45 ExDisableResourceBoostLite@4
46 ExEventObjectType DATA
49 ExFreeToNPagedLookasideList@8
50 ExFreeToPagedLookasideList@8
51 ExGetExclusiveWaiterCount@4
53 ExGetSharedWaiterCount@4
54 ExInitializeNPagedLookasideList@28
55 ExInitializePagedLookasideList@28
56 ExInitializeResource@4
57 ExInitializeResourceLite@4
59 ExInterlockedAddLargeInteger@16
60 @ExInterlockedAddLargeStatistic@8
61 @ExInterlockedAddUlong@12
62 @ExInterlockedCompareExchange64@16
63 ExInterlockedDecrementLong@8
64 ExInterlockedExchangeUlong@12
65 ExInterlockedExtendZone@16
66 ExInterlockedIncrementLong@8
67 @ExInterlockedInsertHeadList@12
68 @ExInterlockedInsertTailList@12
69 @ExInterlockedPopEntryList@8
70 @ExInterlockedPopEntrySList@8
71 @ExInterlockedPushEntryList@12
72 @ExInterlockedPushEntrySList@12
73 @ExInterlockedRemoveHeadList@8
74 ExIsProcessorFeaturePresent@4
75 ExIsResourceAcquiredExclusiveLite@4
76 ExIsResourceAcquiredSharedLite@4
77 ExLocalTimeToSystemTime@8
82 ExRaiseAccessViolation@0
83 ExRaiseDatatypeMisalignment@0
88 ExReinitializeResourceLite@4
89 @ExReleaseFastMutexUnsafe@4
90 ExReleaseResourceForThread@8
91 ExReleaseResourceForThreadLite@8
92 @ExReleaseResourceLite@4
93 ExSetResourceOwnerPointer@8
94 ;ExSystemExceptionFilter
95 ExSystemTimeToLocalTime@8
96 ExTryToAcquireResourceExclusiveLite@4
97 ExUnregisterCallback@4
98 ExWindowStationObjectType DATA
99 ExInitializeBinaryTree@12
101 ExInsertBinaryTree@12
102 ExSearchBinaryTree@12
103 ExRemoveBinaryTree@12
104 ExTraverseBinaryTree@16
105 ExInitializeSplayTree@16
110 ExWeightOfSplayTree@8
111 ExTraverseSplayTree@16
112 ExInitializeHashTable@16
117 @ExfInterlockedAddUlong@12
118 @ExfInterlockedInsertHeadList@12
119 @ExfInterlockedInsertTailList@12
120 @ExfInterlockedPopEntryList@8
121 @ExfInterlockedPushEntryList@12
122 @ExfInterlockedRemoveHeadList@8
123 @Exfi386InterlockedDecrementLong@4
124 @Exfi386InterlockedExchangeUlong@8
125 @Exfi386InterlockedIncrementLong@4
126 Exi386InterlockedDecrementLong@4
127 Exi386InterlockedExchangeUlong@8
128 Exi386InterlockedIncrementLong@4
129 FsRtlAddLargeMcbEntry@28
131 FsRtlAddToTunnelCache@32
132 FsRtlAllocateFileLock@8
134 FsRtlAllocatePoolWithQuota@8
135 FsRtlAllocatePoolWithQuotaTag@12
136 FsRtlAllocatePoolWithTag@12
137 FsRtlAllocateResource@0
138 FsRtlAreNamesEqual@16
140 FsRtlCheckLockForReadAccess@8
141 FsRtlCheckLockForWriteAccess@8
145 FsRtlCurrentBatchOplock@4
146 FsRtlDeleteKeyFromTunnelCache@12
147 FsRtlDeleteTunnelCache@4
148 FsRtlDeregisterUncProvider@4
151 FsRtlDoesDbcsContainWildCards@4
152 FsRtlDoesNameContainWildCards@4
153 FsRtlFastCheckLockForRead@24
154 FsRtlFastCheckLockForWrite@24
155 FsRtlFastUnlockAll@16
156 FsRtlFastUnlockAllByKey@20
157 FsRtlFastUnlockSingle@32
158 FsRtlFindInTunnelCache@32
160 FsRtlGetNextFileLock@8
161 FsRtlGetNextLargeMcbEntry@20
162 FsRtlGetNextMcbEntry@20
163 FsRtlInitializeFileLock@12
164 FsRtlInitializeLargeMcb@8
166 FsRtlInitializeOplock@4
167 FsRtlInitializeTunnelCache@4
168 FsRtlIsDbcsInExpression@8
169 FsRtlIsFatDbcsLegal@20
170 FsRtlIsHpfsDbcsLegal@20
171 FsRtlIsNameInExpression@16
172 FsRtlIsNtstatusExpected@4
173 FsRtlIsTotalDeviceFailure@4
174 FsRtlLegalAnsiCharacterArray DATA
175 FsRtlLookupLargeMcbEntry@32
176 FsRtlLookupLastLargeMcbEntry@12
177 FsRtlLookupLastMcbEntry@12
178 FsRtlLookupMcbEntry@20
180 FsRtlMdlReadComplete@8
181 FsRtlMdlReadCompleteDev@12
183 FsRtlMdlWriteComplete@12
184 FsRtlMdlWriteCompleteDev@16
185 FsRtlNormalizeNtstatus@8
186 FsRtlNotifyChangeDirectory@28
187 FsRtlNotifyCleanup@12
188 FsRtlNotifyFullChangeDirectory@40
189 FsRtlNotifyFullReportChange@36
190 FsRtlNotifyInitializeSync@4
191 FsRtlNotifyReportChange@20
192 FsRtlNotifyUninitializeSync@4
193 FsRtlNotifyVolumeEvent@8
194 FsRtlNumberOfRunsInLargeMcb@4
195 FsRtlNumberOfRunsInMcb@4
197 FsRtlOplockIsFastIoPossible@4
198 FsRtlPostPagingFileStackOverflow@12
199 FsRtlPostStackOverflow@12
200 FsRtlPrepareMdlWrite@24
201 FsRtlPrepareMdlWriteDev@28
203 FsRtlProcessFileLock@12
204 FsRtlRegisterUncProvider@12
205 FsRtlRemoveLargeMcbEntry@20
206 FsRtlRemoveMcbEntry@12
207 FsRtlSplitLargeMcb@20
209 FsRtlTruncateLargeMcb@12
211 FsRtlUninitializeFileLock@4
212 FsRtlUninitializeLargeMcb@4
213 FsRtlUninitializeMcb@4
214 FsRtlUninitializeOplock@4
215 HalDispatchTable DATA
216 HalPrivateDispatchTable DATA
217 @InterlockedCompareExchange@12
218 @InterlockedDecrement@4
219 @InterlockedExchange@8
220 @InterlockedExchangeAdd@8
221 @InterlockedIncrement@4
222 @InterlockedPopEntrySList@4
223 @InterlockedPushEntrySList@8
224 IoAcquireCancelSpinLock@4
225 IoAcquireRemoveLockEx@20
226 IoAcquireVpbSpinLock@4
227 IoAdapterObjectType DATA
228 IoAllocateAdapterChannel@20
229 IoAllocateController@16
230 IoAllocateErrorLogEntry@8
235 IoAttachDeviceByPointer@8
236 IoAttachDeviceToDeviceStack@8
237 IoBuildAsynchronousFsdRequest@24
238 IoBuildDeviceIoControlRequest@36
240 IoBuildSynchronousFsdRequest@28
243 IoCheckDesiredAccess@8
244 IoCheckEaBufferValidity@12
245 IoCheckFunctionAccess@24
246 IoCheckShareAccess@20
248 IoConnectInterrupt@44
252 IoCreateNotificationEvent@8
253 IoCreateStreamFileObject@8
254 IoCreateSymbolicLink@8
255 IoCreateSynchronizationEvent@8
256 IoCreateUnprotectedSymbolicLink@8
259 IoDeleteSymbolicLink@4
261 IoDeviceHandlerObjectSize DATA
262 IoDeviceHandlerObjectType DATA
263 IoDisconnectInterrupt@4
264 IoDeviceObjectType DATA
265 IoDriverObjectType DATA
267 IoFastQueryNetworkAttributes@20
268 IoFileObjectType DATA
272 IoGetAttachedDevice@4
273 IoGetAttachedDeviceReference@4
274 IoGetBaseFileSystemDeviceObject@4
275 IoGetConfigurationInformation@0
276 IoGetCurrentProcess@0
277 IoGetDeviceObjectPointer@16
278 IoGetDeviceToVerify@4
279 IoGetFileObjectGenericMapping@0
281 IoGetRelatedDeviceObject@4
282 IoGetRequestorProcess@4
286 IoInitializeRemoveLockEx@20
288 IoIsOperationSynchronous@4
289 IoMakeAssociatedIrp@8
290 IoOpenDeviceInstanceKey@20
292 IoQueryDeviceDescription@32
293 IoQueryDeviceEnumInfo@8
294 IoQueryFileInformation@20
295 IoQueryVolumeInformation@20
298 IoRaiseInformationalHardError@12
299 IoReadOperationCount DATA
300 IoReadPartitionTable@16
301 IoReadTransferCount DATA
302 IoRegisterDriverReinitialization@12
303 IoRegisterFileSystem@4
304 IoRegisterFsRegistrationChange@8
305 IoRegisterShutdownNotification@4
306 IoReleaseCancelSpinLock@4
307 IoReleaseRemoveLockAndWaitEx@12
308 IoReleaseRemoveLockEx@12
309 IoReleaseVpbSpinLock@4
310 IoRemoveShareAccess@8
311 IoReportHalResourceUsage@16
312 IoReportResourceUsage@36
313 IoSetDeviceToVerify@8
314 IoSetHardErrorOrVerifyDevice@8
316 IoSetPartitionInformation@16
318 IoSetThreadHardErrorMode@4
321 IoStartNextPacketByKey@12
324 IoStatisticsLock DATA
326 IoSynchronousPageWrite@20
328 IoUnregisterFileSystem@4
329 IoUnregisterFsRegistrationChange@8
330 IoUnregisterShutdownNotification@4
331 IoUpdateShareAccess@8
333 IoWriteErrorLogEntry@4
334 IoWriteOperationCount DATA
335 IoWritePartitionTable@20
336 IoWriteTransferCount DATA
338 @IofCompleteRequest@8
339 KdDebuggerEnabled DATA
340 KdDebuggerNotPresent DATA
342 KdSystemDebugControl@4
344 ;Ke386IoSetAccessProcess
345 ;Ke386QueryIoAccessMap
347 KeAcquireSpinLockAtDpcLevel@4
348 KeAddSystemServiceTable@20
350 ;KeBoostCurrentThread
356 KeDcacheFlushCount DATA
357 KeDelayExecutionThread@12
358 KeDeregisterBugCheckCallback@4
360 KeDisconnectInterrupt@4
361 KeEnterCriticalRegion@0
362 KeEnterKernelDebugger@0
363 ;KeFindConfigurationEntry
364 ;KeFindConfigurationNextEntry
369 ;KeI386AllocateGdtSelectors
370 ;KeI386Call16BitCStyleFunction
371 ;KeI386Call16BitFunction
372 ;KeI386FlatToGdtSelector
374 ;KeI386MachineType DATA
375 ;KeI386ReleaseGdtSelectors
377 ;KeI386SetGdtSelector
378 KeIcacheFlushCount DATA
380 KeInitializeDeviceQueue@4
383 KeInitializeInterrupt@44
387 KeInitializeSemaphore@12
388 KeInitializeSpinLock@4
390 KeInitializeTimerEx@8
391 KeInsertByKeyDeviceQueue@12
392 KeInsertDeviceQueue@8
398 KeLeaveCriticalRegion@0
400 KeNumberProcessors DATA
402 ;KeProfileInterruptWithSource
406 KeQueryTimeIncrement@0
407 ;KeRaiseUserException
412 KeReadStateSemaphore@4
414 KeRegisterBugCheckCallback@20
417 KeReleaseSemaphore@16
418 KeReleaseSpinLockFromDpcLevel@4
419 KeRemoveByKeyDeviceQueue@8
420 KeRemoveDeviceQueue@4
421 KeRemoveEntryDeviceQueue@8
425 ;KeRestoreFloatingPointState
427 ;KeSaveFloatingPointState
428 KeServiceDescriptorTable DATA
430 KeSetBasePriorityThread@8
433 ;KeSetEventBoostPriority
434 ;KeSetIdealProcessorThread
436 ;KeSetKernelStackSwapEnable
437 KeSetPriorityThread@8
439 ;@KeSetSwapContextNotifyRoutine
440 KeSetTargetProcessorDpc@8
441 ;@KeSetThreadSelectNotifyRoutine
445 ;@KeSetTimeUpdateNotifyRoutine
446 KeSynchronizeExecution@12
451 KeWaitForMultipleObjects@32
452 KeWaitForMutexObject@20
453 KeWaitForSingleObject@20
454 @KefAcquireSpinLockAtDpcLevel@4
455 @KefReleaseSpinLockFromDpcLevel@4
457 ;@KiAcquireSpinLock@4
459 ;KiCoprocessorError@0
461 KiDispatchInterrupt@0
462 KiInterruptDispatch2@8
463 ;KiIpiServiceRoutine@8
464 ;@KiReleaseSpinLock@4
465 ;KiUnexpectedInterrupt
466 ;Kii386SpinOnSpinLock
470 ;LdrFindResourceDirectory_U@16
473 LsaCallAuthenticationPackage@28
474 LsaDeregisterLogonProcess@8
475 LsaFreeReturnBuffer@4
477 LsaLookupAuthenticationPackage@12
478 LsaRegisterLogonProcess@12
479 MmAdjustWorkingSetSize@12
480 MmAllocateContiguousAlignedMemory@16
481 MmAllocateContiguousMemory@12
482 MmAllocateNonCachedMemory@4
483 MmBuildMdlForNonPagedPool@4
484 MmCanFileBeTruncated@8
489 MmDbgTranslatePhysicalAddress@8
490 MmDisableModifiedWriteOfSection@4
491 MmFlushImageSection@8
492 MmForceSectionClosed@8
493 MmFreeContiguousMemory@4
494 MmFreeNonCachedMemory@8
495 MmGetPhysicalAddress@4
497 MmHighestUserAddress DATA
499 MmIsNonPagedSystemAddressValid@4
500 MmIsRecursiveIoFault@0
501 MmIsThisAnNtAsSystem@0
502 MmLockPagableDataSection@4
503 MmLockPagableImageSection@4=MmLockPagableDataSection@4
504 MmLockPagableSectionByHandle@4
509 MmMapViewInSystemSpace@12
510 MmMapViewOfSection@40
512 MmProbeAndLockPages@12
514 MmResetDriverPaging@4
515 MmSectionObjectType DATA
516 MmSecureVirtualMemory@12
517 MmSetAddressRangeModified@8
518 MmSetBankedSection@24
520 MmUnlockPagableImageSection@4
524 MmUnmapVideoDisplay@8
525 MmUnmapViewInSystemSpace@4
526 MmUnmapViewOfSection@8
527 MmUnsecureVirtualMemory@4
528 MmUserProbeAddress DATA
531 NlsMbCodePageTag DATA
532 NlsMbOemCodePageTag DATA
533 NlsOemLeadByteInfo DATA
535 NtAdjustPrivilegesToken@24
537 NtAllocateLocallyUniqueId@4
539 NtAllocateVirtualMemory@24
550 NtDeviceIoControlFile@40
554 NtFreeVirtualMemory@16
558 NtMapViewOfSection@40
559 NtNotifyChangeDirectoryFile@36
562 NtOpenProcessToken@12
563 NtQueryDirectoryFile@44
565 NtQueryInformationAtom@20
566 NtQueryInformationFile@20
567 NtQueryInformationProcess@20
568 NtQueryInformationToken@20
569 ;NtQueryOleDirectoryFile@ <--- ?
570 NtQuerySecurityObject@20
572 NtQueryVolumeInformationFile@20
575 NtRequestWaitReplyPort@12
577 NtSetInformationFile@20
578 NtSetInformationProcess@16
579 NtSetInformationThread@16
580 NtSetSecurityObject@12
585 NtWaitForSingleObject@12
588 ;ObCheckCreateObjectAccess@28
589 ;ObCheckObjectAccess@20
592 ;ObFindHandleForObject@20
593 ObGetObjectPointerCount@4
594 ObGetObjectSecurity@12
596 ObMakeTemporaryObject@4
597 ObOpenObjectByName@28
598 ObOpenObjectByPointer@28
599 ;ObQueryNameString@16
600 ;ObQueryObjectAuditingByHandle@8
601 @ObfDereferenceObject@4
602 @ObfReferenceObject@4
603 ObReferenceObjectByHandle@24
604 ObReferenceObjectByName@32
605 ObReferenceObjectByPointer@16
606 ObReleaseObjectSecurity@8
607 ;ObSetSecurityDescriptorInfo@24
613 PoRegisterDeviceForIdleDetection@16
614 PoRegisterSystemState@8
619 PoStartNextPowerIrp@4
620 PoUnregisterSystemState@4
622 PsAssignImpersonationToken@8
623 ;PsChargePoolQuota@12
624 PsCreateSystemProcess@12
625 PsCreateSystemThread@28
626 PsCreateWin32Thread@4
627 PsCreateWin32Process@4
630 PsEstablishWin32Callouts@24
631 PsGetCurrentProcess@0
632 PsGetCurrentProcessId@0
633 PsGetCurrentThreadId@0
635 PsGetProcessExitTime@0
637 PsImpersonateClient@20
638 PsInitialSystemProcess DATA
639 PsIsThreadTerminating@4
640 PsLookupProcessByProcessId@8
641 PsLookupProcessThreadByCid@12
642 PsLookupThreadByThreadId@8
644 PsReferenceImpersonationToken@16
645 PsReferencePrimaryToken@4
646 ;PsReturnPoolQuota@12
648 PsSetCreateProcessNotifyRoutine@8
649 PsSetCreateThreadNotifyRoutine@4
650 ;PsSetLegoNotifyRoutine@4
651 ;PsSetProcessPriorityByClass@8
652 PsTerminateSystemThread@4
654 READ_REGISTER_UCHAR@4
655 READ_REGISTER_ULONG@4
656 READ_REGISTER_USHORT@4
657 READ_REGISTER_BUFFER_UCHAR@12
658 READ_REGISTER_BUFFER_ULONG@12
659 READ_REGISTER_BUFFER_USHORT@12
660 RtlAbsoluteToSelfRelativeSD@12
661 RtlAddAccessAllowedAce@16
663 RtlAddAtomToAtomTable@12
664 ;RtlAllocateAndInitializeSid
666 RtlAnsiCharToUnicodeChar@4
667 RtlAnsiStringToUnicodeSize@4
668 RtlAnsiStringToUnicodeString@12
669 RtlAppendAsciizToString@8
670 RtlAppendStringToString@8
671 RtlAppendUnicodeStringToString@8
672 RtlAppendUnicodeToString@8
673 RtlAreAllAccessesGranted@8
674 RtlAreAnyAccessesGranted@8
678 ;RtlCaptureStackBackTrace
680 RtlCheckRegistryKey@8
684 RtlCompareMemoryUlong@12
686 RtlCompareUnicodeString@12
689 RtlConvertLongToLargeInteger@4
690 RtlConvertSidToUnicodeString@12
691 RtlConvertUlongToLargeInteger@4
695 RtlCopyUnicodeString@8
699 RtlCreateRegistryKey@8
700 RtlCreateSecurityDescriptor@8
701 RtlCreateUnicodeString@8
702 RtlCustomCPToUnicodeN@24
703 RtlDecompressBuffer@24
704 RtlDecompressChunks@28
705 RtlDecompressFragment@32
707 RtlDeleteAtomFromAtomTable@8
708 ;RtlDeleteElementGenericTable
710 RtlDeleteRegistryValue@12
712 RtlDestroyAtomTable@4
714 RtlDowncaseUnicodeString@12
716 RtlEnlargedIntegerMultiply@8
717 RtlEnlargedUnsignedDivide@16
718 RtlEnlargedUnsignedMultiply@8
719 ;RtlEnumerateGenericTable
720 ;RtlEnumerateGenericTableWithoutSplaying
724 RtlEqualUnicodeString@12
725 RtlExtendedIntegerMultiply@12
726 RtlExtendedLargeIntegerDivide@16
727 RtlExtendedMagicDivide@20
729 RtlFillMemoryUlong@12
731 RtlFindClearBitsAndSet@12
732 RtlFindFirstRunClear@8
734 RtlFindLongestRunClear@8
735 RtlFindLongestRunSet@8
738 RtlFindSetBitsAndClear@12
739 ;RtlFindUnicodePrefix
740 RtlFormatCurrentUserKeyPath@4
744 RtlFreeUnicodeString@4
745 RtlGenerate8dot3Name@16
746 ;RtlGetCallersAddress
747 RtlGetCompressionWorkSpaceSize@12
748 RtlGetDaclSecurityDescriptor@16
749 RtlGetDefaultCodePage@8
750 ;RtlGetElementGenericTable
751 RtlGetGroupSecurityDescriptor@12
752 RtlGetOwnerSecurityDescriptor@12
755 ;RtlInitCodePageTable
757 RtlInitUnicodeString@8
758 RtlInitializeBitMap@12
759 ;RtlInitializeGenericTable
761 ;RtlInitializeUnicodePrefix
762 ;RtlInsertElementGenericTable
763 ;RtlInsertUnicodePrefix
765 RtlIntegerToUnicodeString@12
766 RtlIsNameLegalDOS8Dot3@12
767 RtlLargeIntegerAdd@16
768 RtlLargeIntegerArithmeticShift@12
769 RtlLargeIntegerDivide@20
770 RtlLargeIntegerNegate@8
771 RtlLargeIntegerShiftLeft@12
772 RtlLargeIntegerShiftRight@12
773 RtlLargeIntegerSubtract@16
774 RtlLengthRequiredSid@4
775 RtlLengthSecurityDescriptor@4
777 RtlLookupAtomInAtomTable@12
778 ;RtlLookupElementGenericTable
781 RtlMultiByteToUnicodeN@20
782 RtlMultiByteToUnicodeSize@12
783 ;RtlNextUnicodePrefix
784 RtlNtStatusToDosError@4
785 RtlNtStatusToDosErrorNoTeb@4
786 ;RtlNumberGenericTableElements
787 RtlNumberOfClearBits@4
789 RtlOemStringToCountedUnicodeString@12
790 RtlOemStringToUnicodeSize@4
791 RtlOemStringToUnicodeString@12
793 RtlPinAtomInAtomTable@8
795 RtlPrefixUnicodeString@12
796 RtlQueryAtomInAtomTable@24
797 RtlQueryRegistryValues@20
798 RtlQueryTimeZoneInformation@4
801 ;RtlRemoveUnicodePrefix
803 RtlSecondsSince1970ToTime@8
804 RtlSecondsSince1980ToTime@8
807 RtlSetDaclSecurityDescriptor@16
808 RtlSetGroupSecurityDescriptor@12
809 RtlSetOwnerSecurityDescriptor@12
810 RtlSetSaclSecurityDescriptor@16
811 RtlSetTimeZoneInformation@4
813 RtlSubAuthorityCountSid@4
815 RtlTimeFieldsToTime@8
816 RtlTimeToSecondsSince1970@8
817 RtlTimeToSecondsSince1980@8
818 RtlTimeToTimeFields@8
819 RtlUnicodeStringToAnsiSize@4
820 RtlUnicodeStringToAnsiString@12
821 RtlUnicodeStringToCountedOemString@12
822 RtlUnicodeStringToInteger@12
823 RtlUnicodeStringToOemSize@4
824 RtlUnicodeStringToOemString@12
825 RtlUnicodeToCustomCPN@24
826 RtlUnicodeToMultiByteN@20
827 RtlUnicodeToMultiByteSize@12
830 RtlUpcaseUnicodeChar@4
831 RtlUpcaseUnicodeString@12
832 RtlUpcaseUnicodeStringToAnsiString@12
833 RtlUpcaseUnicodeStringToCountedOemString@12
834 RtlUpcaseUnicodeStringToOemString@12
835 RtlUpcaseUnicodeToCustomCPN@24
836 RtlUpcaseUnicodeToMultiByteN@20
837 RtlUpcaseUnicodeToOemN@20
840 RtlValidSecurityDescriptor@4
842 RtlWriteRegistryValue@24
845 RtlxAnsiStringToUnicodeSize@4
846 RtlxOemStringToUnicodeSize@4
847 RtlxUnicodeStringToAnsiSize@4
848 RtlxUnicodeStringToOemSize@4
850 ;SeAppendPrivileges@8
852 ;SeAuditingFileEvents@8
853 ;SeAuditingFileOrGlobalEvents@18
854 ;SeCaptureSecurityDescriptor@20
855 SeCaptureSubjectContext@4
856 ;SeCloseObjectAuditAlarm@12
857 ;SeCreateAccessState@16
858 SeCreateClientSecurity@16
860 ;SeDeleteAccessState@4
861 ;SeDeleteObjectAuditAlarm@8
864 SeImpersonateClient@8
865 ;SeLockSubjectContext@4
866 ;SeMarkLogonSessionForTerminationNotification@4
867 ;SeOpenObjectAuditAlarm@36
868 ;SeOpenObjectForDeleteAuditAlarm@36
870 ;SePrivilegeObjectAuditAlarm@24
871 SePublicDefaultDacl DATA
872 ;SeQueryAuthenticationIdToken@8
873 ;SeQuerySecurityDescriptorInfo@16
874 ;SeRegisterLogonSessionTerminatedRoutine@4
875 ;SeReleaseSecurityDescriptor@12
876 SeReleaseSubjectContext@4
877 ;SeSetAccessStateGenericMapping@8
878 ;SeSetSecurityDescriptorInfo@24
879 SeSinglePrivilegeCheck@12
880 SeSystemDefaultDacl DATA
881 SeTokenImpersonationLevel@4
883 ;SeUnlockSubjectContext@4
884 ;SeUnregisterLogonSessionTerminatedRoutine@4
885 ;SeValidSecurityDescriptor@8
886 WRITE_REGISTER_UCHAR@8
887 WRITE_REGISTER_ULONG@8
888 WRITE_REGISTER_USHORT@8
889 WRITE_REGISTER_BUFFER_UCHAR@12
890 WRITE_REGISTER_BUFFER_ULONG@12
891 WRITE_REGISTER_BUFFER_USHORT@12
892 ZwAccessCheckAndAuditAlarm@44
894 ZwAllocateVirtualMemory@24
897 ZwCloseObjectAuditAlarm@12
899 ZwCreateDirectoryObject@12
904 ZwCreateSymbolicLinkObject@16
908 ZwDeviceIoControlFile@40
913 ZwEnumerateValueKey@24
914 ZwFlushInstructionCache@12
916 ZwFreeVirtualMemory@16
920 ZwMakeTemporaryObject@4
921 ZwMapViewOfSection@40
923 ZwOpenDirectoryObject@12
928 ZwOpenProcessToken@12
930 ZwOpenSymbolicLinkObject@12
934 ZwQueryDefaultLocale@8
935 ZwQueryDirectoryFile@44
936 ZwQueryInformationAtom@20
937 ZwQueryInformationFile@20
938 ZwQueryInformationProcess@20
939 ZwQueryInformationToken@20
943 ZwQuerySecurityObject@20
944 ZwQuerySymbolicLinkObject@12
945 ZwQuerySystemInformation@16
948 ZwQueryVolumeInformationFile@20
951 ZwRequestWaitReplyPort@12
956 ZwSetInformationFile@20
957 ZwSetInformationObject@16
958 ZwSetInformationProcess@16
959 ZwSetInformationThread@16
960 ZwSetSystemInformation@12
966 ZwUnmapViewOfSection@8
967 ZwWaitForMultipleObjects@20
968 ZwWaitForSingleObject@12
971 _abnormal_termination