1 ; $Id: ntoskrnl.def,v 1.160 2003/08/11 18:50:12 chorns Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
13 CcGetFileObjectFromSectionPtrs@4
16 CcSetDirtyPinnedData@8
21 DbgBreakPointWithStatus@4
22 ;DbgLoadImageSymbols@12
26 @ExAcquireFastMutexUnsafe@4
27 ExAcquireResourceExclusive@8
28 ExAcquireResourceExclusiveLite@8
29 ExAcquireResourceSharedLite@8
30 ExAcquireSharedStarveExclusive@8
31 ExAcquireSharedWaitForExclusive@8
32 @ExAllocateFromPagedLookasideList@4
34 ExAllocatePoolWithQuota@8
35 ExAllocatePoolWithQuotaTag@12
36 ExAllocatePoolWithTag@12
37 ExConvertExclusiveToSharedLite@4
39 ExDeleteNPagedLookasideList@4
40 ExDeletePagedLookasideList@4
42 ExDeleteResourceLite@4
43 ExDesktopObjectType DATA
44 ExDisableResourceBoostLite@4
45 ExEventObjectType DATA
48 ExFreeToPagedLookasideList@8
49 ExGetExclusiveWaiterCount@4
51 ExGetSharedWaiterCount@4
52 ExInitializeNPagedLookasideList@28
53 ExInitializePagedLookasideList@28
54 ExInitializeResource@4
55 ExInitializeResourceLite@4
57 ExInterlockedAddLargeInteger@16
58 @ExInterlockedAddLargeStatistic@8
59 @ExInterlockedAddUlong@12
60 @ExInterlockedCompareExchange64@16
61 ExInterlockedDecrementLong@8
62 ExInterlockedExchangeUlong@12
63 ExInterlockedExtendZone@16
64 ExInterlockedIncrementLong@8
65 @ExInterlockedInsertHeadList@12
66 @ExInterlockedInsertTailList@12
67 @ExInterlockedPopEntryList@8
68 @ExInterlockedPopEntrySList@8
69 @ExInterlockedPushEntryList@12
70 @ExInterlockedPushEntrySList@12
71 @ExInterlockedRemoveHeadList@8
72 ExIsProcessorFeaturePresent@4
73 ExIsResourceAcquiredExclusiveLite@4
74 ExIsResourceAcquiredSharedLite@4
75 ExLocalTimeToSystemTime@8
80 ExRaiseAccessViolation@0
81 ExRaiseDatatypeMisalignment@0
86 ExReinitializeResourceLite@4
87 @ExReleaseFastMutexUnsafe@4
88 ExReleaseResourceForThread@8
89 ExReleaseResourceForThreadLite@8
90 @ExReleaseResourceLite@4
91 ExSetResourceOwnerPointer@8
92 ;ExSystemExceptionFilter
93 ExSystemTimeToLocalTime@8
94 ExTryToAcquireResourceExclusiveLite@4
95 ExUnregisterCallback@4
96 ExWindowStationObjectType DATA
97 ExInitializeBinaryTree@12
100 ExSearchBinaryTree@12
101 ExRemoveBinaryTree@12
102 ExTraverseBinaryTree@16
103 ExInitializeSplayTree@16
108 ExWeightOfSplayTree@8
109 ExTraverseSplayTree@16
110 ExInitializeHashTable@16
115 @ExfInterlockedAddUlong@12
116 @ExfInterlockedInsertHeadList@12
117 @ExfInterlockedInsertTailList@12
118 @ExfInterlockedPopEntryList@8
119 @ExfInterlockedPushEntryList@12
120 @ExfInterlockedRemoveHeadList@8
121 @Exfi386InterlockedDecrementLong@4
122 @Exfi386InterlockedExchangeUlong@8
123 @Exfi386InterlockedIncrementLong@4
124 Exi386InterlockedDecrementLong@4
125 Exi386InterlockedExchangeUlong@8
126 Exi386InterlockedIncrementLong@4
127 FsRtlAddLargeMcbEntry@28
129 FsRtlAddToTunnelCache@32
130 FsRtlAllocateFileLock@8
132 FsRtlAllocatePoolWithQuota@8
133 FsRtlAllocatePoolWithQuotaTag@12
134 FsRtlAllocatePoolWithTag@12
135 FsRtlAllocateResource@0
136 FsRtlAreNamesEqual@16
138 FsRtlCheckLockForReadAccess@8
139 FsRtlCheckLockForWriteAccess@8
143 FsRtlCurrentBatchOplock@4
144 FsRtlDeleteKeyFromTunnelCache@12
145 FsRtlDeleteTunnelCache@4
146 FsRtlDeregisterUncProvider@4
149 FsRtlDoesDbcsContainWildCards@4
150 FsRtlDoesNameContainWildCards@4
151 FsRtlFastCheckLockForRead@24
152 FsRtlFastCheckLockForWrite@24
153 FsRtlFastUnlockAll@16
154 FsRtlFastUnlockAllByKey@20
155 FsRtlFastUnlockSingle@32
156 FsRtlFindInTunnelCache@32
158 FsRtlGetNextFileLock@8
159 FsRtlGetNextLargeMcbEntry@20
160 FsRtlGetNextMcbEntry@20
161 FsRtlInitializeFileLock@12
162 FsRtlInitializeLargeMcb@8
164 FsRtlInitializeOplock@4
165 FsRtlInitializeTunnelCache@4
166 FsRtlIsDbcsInExpression@8
167 FsRtlIsFatDbcsLegal@20
168 FsRtlIsHpfsDbcsLegal@20
169 FsRtlIsNameInExpression@16
170 FsRtlIsNtstatusExpected@4
171 FsRtlIsTotalDeviceFailure@4
172 FsRtlLegalAnsiCharacterArray DATA
173 FsRtlLookupLargeMcbEntry@32
174 FsRtlLookupLastLargeMcbEntry@12
175 FsRtlLookupLastMcbEntry@12
176 FsRtlLookupMcbEntry@20
178 FsRtlMdlReadComplete@8
179 FsRtlMdlReadCompleteDev@12
181 FsRtlMdlWriteComplete@12
182 FsRtlMdlWriteCompleteDev@16
183 FsRtlNormalizeNtstatus@8
184 FsRtlNotifyChangeDirectory@28
185 FsRtlNotifyCleanup@12
186 FsRtlNotifyFullChangeDirectory@40
187 FsRtlNotifyFullReportChange@36
188 FsRtlNotifyInitializeSync@4
189 FsRtlNotifyReportChange@20
190 FsRtlNotifyUninitializeSync@4
191 FsRtlNotifyVolumeEvent@8
192 FsRtlNumberOfRunsInLargeMcb@4
193 FsRtlNumberOfRunsInMcb@4
195 FsRtlOplockIsFastIoPossible@4
196 FsRtlPostPagingFileStackOverflow@12
197 FsRtlPostStackOverflow@12
198 FsRtlPrepareMdlWrite@24
199 FsRtlPrepareMdlWriteDev@28
201 FsRtlProcessFileLock@12
202 FsRtlRegisterUncProvider@12
203 FsRtlRemoveLargeMcbEntry@20
204 FsRtlRemoveMcbEntry@12
205 FsRtlSplitLargeMcb@20
207 FsRtlTruncateLargeMcb@12
209 FsRtlUninitializeFileLock@4
210 FsRtlUninitializeLargeMcb@4
211 FsRtlUninitializeMcb@4
212 FsRtlUninitializeOplock@4
213 HalDispatchTable DATA
214 HalPrivateDispatchTable DATA
215 InbvAcquireDisplayOwnership@0
216 InbvCheckDisplayOwnership@0
218 InbvEnableBootDriver@4
219 InbvEnableDisplayString@4
220 InbvInstallDisplayStringFilter@4
221 InbvIsBootDriverInstalled@0
222 InbvNotifyDisplayOwnershipLost@4
224 InbvSetScrollRegion@16
226 InbvSolidColorFill@20
227 @InterlockedCompareExchange@12
228 @InterlockedDecrement@4
229 @InterlockedExchange@8
230 @InterlockedExchangeAdd@8
231 @InterlockedIncrement@4
232 @InterlockedPopEntrySList@4
233 @InterlockedPushEntrySList@8
234 IoAcquireCancelSpinLock@4
235 IoAcquireRemoveLockEx@20
236 IoAcquireVpbSpinLock@4
237 IoAdapterObjectType DATA
238 IoAllocateAdapterChannel@20
239 IoAllocateController@16
240 IoAllocateErrorLogEntry@8
245 IoAttachDeviceByPointer@8
246 IoAttachDeviceToDeviceStack@8
247 IoBuildAsynchronousFsdRequest@24
248 IoBuildDeviceIoControlRequest@36
250 IoBuildSynchronousFsdRequest@28
253 IoCheckDesiredAccess@8
254 IoCheckEaBufferValidity@12
255 IoCheckFunctionAccess@24
256 IoCheckShareAccess@20
258 IoConnectInterrupt@44
262 IoCreateNotificationEvent@8
263 IoCreateStreamFileObject@8
264 IoCreateSymbolicLink@8
265 IoCreateSynchronizationEvent@8
266 IoCreateUnprotectedSymbolicLink@8
269 IoDeleteSymbolicLink@4
271 IoDeviceHandlerObjectSize DATA
272 IoDeviceHandlerObjectType DATA
273 IoDisconnectInterrupt@4
274 IoDeviceObjectType DATA
275 IoDriverObjectType DATA
277 IoFastQueryNetworkAttributes@20
278 IoFileObjectType DATA
282 IoGetAttachedDevice@4
283 IoGetAttachedDeviceReference@4
284 IoGetBaseFileSystemDeviceObject@4
285 IoGetConfigurationInformation@0
286 IoGetCurrentProcess@0
287 IoGetDeviceObjectPointer@16
288 IoGetDeviceToVerify@4
289 IoGetFileObjectGenericMapping@0
291 IoGetRelatedDeviceObject@4
292 IoGetRequestorProcess@4
296 IoInvalidateDeviceState@4
297 IoInitializeRemoveLockEx@20
299 IoIsOperationSynchronous@4
300 IoMakeAssociatedIrp@8
301 IoOpenDeviceInstanceKey@20
303 IoQueryDeviceDescription@32
304 IoQueryDeviceEnumInfo@8
305 IoQueryFileInformation@20
306 IoQueryVolumeInformation@20
309 IoRaiseInformationalHardError@12
310 IoReadOperationCount DATA
311 IoReadPartitionTable@16
312 IoReadTransferCount DATA
317 IoRegisterDeviceInterface@16
318 IoSetDeviceInterfaceState@8
319 IoGetDeviceProperty@20
320 IoOpenDeviceRegistryKey@16
321 IoInvalidateDeviceRelations@8
323 IoRegisterDriverReinitialization@12
324 IoRegisterFileSystem@4
325 IoRegisterFsRegistrationChange@8
326 IoRegisterShutdownNotification@4
327 IoReleaseCancelSpinLock@4
328 IoReleaseRemoveLockAndWaitEx@12
329 IoReleaseRemoveLockEx@12
330 IoReleaseVpbSpinLock@4
331 IoRemoveShareAccess@8
332 IoReportHalResourceUsage@16
333 IoReportResourceUsage@36
334 IoSetDeviceToVerify@8
335 IoSetHardErrorOrVerifyDevice@8
337 IoSetPartitionInformation@16
339 IoSetThreadHardErrorMode@4
342 IoStartNextPacketByKey@12
345 IoStatisticsLock DATA
347 IoSynchronousPageWrite@20
349 IoUnregisterFileSystem@4
350 IoUnregisterFsRegistrationChange@8
351 IoUnregisterShutdownNotification@4
352 IoUpdateShareAccess@8
354 IoWriteErrorLogEntry@4
355 IoWriteOperationCount DATA
356 IoWritePartitionTable@20
357 IoWriteTransferCount DATA
359 @IofCompleteRequest@8
360 KdDebuggerEnabled DATA
361 KdDebuggerNotPresent DATA
363 KdSystemDebugControl@4
365 ;Ke386IoSetAccessProcess
366 ;Ke386QueryIoAccessMap
368 KeAcquireSpinLockAtDpcLevel@4
369 KeAddSystemServiceTable@20
371 ;KeBoostCurrentThread
377 KeDcacheFlushCount DATA
378 KeDelayExecutionThread@12
379 KeDeregisterBugCheckCallback@4
381 KeDisconnectInterrupt@4
382 KeEnterCriticalRegion@0
383 KeEnterKernelDebugger@0
384 ;KeFindConfigurationEntry
385 ;KeFindConfigurationNextEntry
390 ;KeI386AllocateGdtSelectors
391 ;KeI386Call16BitCStyleFunction
392 ;KeI386Call16BitFunction
393 ;KeI386FlatToGdtSelector
395 ;KeI386MachineType DATA
396 ;KeI386ReleaseGdtSelectors
398 ;KeI386SetGdtSelector
399 KeIcacheFlushCount DATA
401 KeInitializeDeviceQueue@4
404 KeInitializeInterrupt@44
408 KeInitializeSemaphore@12
409 KeInitializeSpinLock@4
411 KeInitializeTimerEx@8
412 KeInsertByKeyDeviceQueue@12
413 KeInsertDeviceQueue@8
419 KeLeaveCriticalRegion@0
421 KeNumberProcessors DATA
423 ;KeProfileInterruptWithSource
427 KeQueryTimeIncrement@0
428 ;KeRaiseUserException
434 KeReadStateSemaphore@4
436 KeRegisterBugCheckCallback@20
439 KeReleaseSemaphore@16
440 KeReleaseSpinLockFromDpcLevel@4
441 KeRemoveByKeyDeviceQueue@8
442 KeRemoveDeviceQueue@4
443 KeRemoveEntryDeviceQueue@8
447 ;KeRestoreFloatingPointState
449 ;KeSaveFloatingPointState
450 KeServiceDescriptorTable DATA
451 KeSetAffinityThread@8
452 KeSetBasePriorityThread@8
455 ;KeSetEventBoostPriority
456 ;KeSetIdealProcessorThread
458 ;KeSetKernelStackSwapEnable
459 KeSetPriorityThread@8
461 ;@KeSetSwapContextNotifyRoutine
462 KeSetTargetProcessorDpc@8
463 ;@KeSetThreadSelectNotifyRoutine
467 ;@KeSetTimeUpdateNotifyRoutine
468 KeSynchronizeExecution@12
473 KeWaitForMultipleObjects@32
474 KeWaitForMutexObject@20
475 KeWaitForSingleObject@20
476 ;@KefAcquireSpinLockAtDpcLevel
477 ;@KefReleaseSpinLockFromDpcLevel
479 ;@KiAcquireSpinLock@4
481 ;KiCoprocessorError@0
483 KiDispatchInterrupt@0
484 KiInterruptDispatch2@8
485 ;KiIpiServiceRoutine@8
486 ;@KiReleaseSpinLock@4
487 ;KiUnexpectedInterrupt
488 ;Kii386SpinOnSpinLock
492 ;LdrFindResourceDirectory_U@16
495 LsaCallAuthenticationPackage@28
496 LsaDeregisterLogonProcess@8
497 LsaFreeReturnBuffer@4
499 LsaLookupAuthenticationPackage@12
500 LsaRegisterLogonProcess@12
501 MmAdjustWorkingSetSize@12
502 MmAllocateContiguousAlignedMemory@16
503 MmAllocateContiguousMemory@12
504 MmAllocateNonCachedMemory@4
505 MmBuildMdlForNonPagedPool@4
506 MmCanFileBeTruncated@8
511 MmDbgTranslatePhysicalAddress@8
512 MmDisableModifiedWriteOfSection@4
513 MmFlushImageSection@8
514 MmForceSectionClosed@8
515 MmFreeContiguousMemory@4
516 MmFreeNonCachedMemory@8
517 MmGetPhysicalAddress@4
519 MmHighestUserAddress DATA
521 MmIsNonPagedSystemAddressValid@4
522 MmIsRecursiveIoFault@0
523 MmIsThisAnNtAsSystem@0
524 MmLockPagableDataSection@4
525 MmLockPagableImageSection@4=MmLockPagableDataSection@4
526 MmLockPagableSectionByHandle@4
531 MmMapViewInSystemSpace@12
532 MmMapViewOfSection@40
534 MmProbeAndLockPages@12
536 MmResetDriverPaging@4
537 MmSectionObjectType DATA
538 MmSecureVirtualMemory@12
539 MmSetAddressRangeModified@8
540 MmSetBankedSection@24
542 MmUnlockPagableImageSection@4
546 MmUnmapVideoDisplay@8
547 MmUnmapViewInSystemSpace@4
548 MmUnmapViewOfSection@8
549 MmUnsecureVirtualMemory@4
550 MmUserProbeAddress DATA
553 NlsMbCodePageTag DATA
554 NlsMbOemCodePageTag DATA
555 NlsOemLeadByteInfo DATA
557 NtAdjustPrivilegesToken@24
559 NtAllocateLocallyUniqueId@4
561 NtAllocateVirtualMemory@24
572 NtDeviceIoControlFile@40
576 NtFreeVirtualMemory@16
580 NtMapViewOfSection@40
581 NtNotifyChangeDirectoryFile@36
584 NtOpenProcessToken@12
585 NtQueryDirectoryFile@44
587 NtQueryInformationAtom@20
588 NtQueryInformationFile@20
589 NtQueryInformationProcess@20
590 NtQueryInformationToken@20
591 ;NtQueryOleDirectoryFile@ <--- ?
592 NtQuerySecurityObject@20
594 NtQueryVolumeInformationFile@20
597 NtRequestWaitReplyPort@12
599 NtSetInformationFile@20
600 NtSetInformationProcess@16
601 NtSetInformationThread@16
602 NtSetSecurityObject@12
607 NtWaitForSingleObject@12
610 ;ObCheckCreateObjectAccess@28
611 ;ObCheckObjectAccess@20
614 ;ObFindHandleForObject@20
615 ObGetObjectPointerCount@4
616 ObGetObjectSecurity@12
618 ObMakeTemporaryObject@4
619 ObOpenObjectByName@28
620 ObOpenObjectByPointer@28
622 ;ObQueryObjectAuditingByHandle@8
623 @ObfDereferenceObject@4
624 @ObfReferenceObject@4
625 ObReferenceObjectByHandle@24
626 ObReferenceObjectByName@32
627 ObReferenceObjectByPointer@16
628 ObReleaseObjectSecurity@8
629 ;ObSetSecurityDescriptorInfo@24
635 PoRegisterDeviceForIdleDetection@16
636 PoRegisterSystemState@8
641 PoStartNextPowerIrp@4
642 PoUnregisterSystemState@4
644 PsAssignImpersonationToken@8
645 ;PsChargePoolQuota@12
646 PsCreateSystemProcess@12
647 PsCreateSystemThread@28
648 PsCreateWin32Process@4
649 PsEstablishWin32Callouts@24
650 PsGetCurrentProcessId@0
651 PsGetCurrentThreadId@0
652 PsGetProcessExitTime@0
656 PsImpersonateClient@20
657 PsInitialSystemProcess DATA
658 PsIsThreadTerminating@4
659 PsLookupProcessByProcessId@8
660 PsLookupProcessThreadByCid@12
661 PsLookupThreadByThreadId@8
663 PsReferenceImpersonationToken@16
664 PsReferencePrimaryToken@4
665 ;PsReturnPoolQuota@12
667 PsSetCreateProcessNotifyRoutine@8
668 PsSetCreateThreadNotifyRoutine@4
669 ;PsSetLegoNotifyRoutine@4
670 ;PsSetProcessPriorityByClass@8
671 PsTerminateSystemThread@4
673 READ_REGISTER_UCHAR@4
674 READ_REGISTER_ULONG@4
675 READ_REGISTER_USHORT@4
676 READ_REGISTER_BUFFER_UCHAR@12
677 READ_REGISTER_BUFFER_ULONG@12
678 READ_REGISTER_BUFFER_USHORT@12
679 RtlAbsoluteToSelfRelativeSD@12
680 RtlAddAccessAllowedAce@16
682 RtlAddAtomToAtomTable@12
683 ;RtlAllocateAndInitializeSid
685 RtlAnsiCharToUnicodeChar@4
686 RtlAnsiStringToUnicodeSize@4
687 RtlAnsiStringToUnicodeString@12
688 RtlAppendAsciizToString@8
689 RtlAppendStringToString@8
690 RtlAppendUnicodeStringToString@8
691 RtlAppendUnicodeToString@8
692 RtlAreAllAccessesGranted@8
693 RtlAreAnyAccessesGranted@8
697 ;RtlCaptureStackBackTrace
699 RtlCheckRegistryKey@8
703 RtlCompareMemoryUlong@12
705 RtlCompareUnicodeString@12
708 RtlConvertLongToLargeInteger@4
709 RtlConvertSidToUnicodeString@12
710 RtlConvertUlongToLargeInteger@4
714 RtlCopyUnicodeString@8
718 RtlCreateRegistryKey@8
719 RtlCreateSecurityDescriptor@8
720 RtlCreateUnicodeString@8
721 RtlCustomCPToUnicodeN@24
722 RtlDecompressBuffer@24
723 RtlDecompressChunks@28
724 RtlDecompressFragment@32
726 RtlDeleteAtomFromAtomTable@8
727 ;RtlDeleteElementGenericTable
729 RtlDeleteRegistryValue@12
731 RtlDestroyAtomTable@4
733 RtlDowncaseUnicodeString@12
735 RtlEnlargedIntegerMultiply@8
736 RtlEnlargedUnsignedDivide@16
737 RtlEnlargedUnsignedMultiply@8
738 ;RtlEnumerateGenericTable
739 ;RtlEnumerateGenericTableWithoutSplaying
743 RtlEqualUnicodeString@12
744 RtlExtendedIntegerMultiply@12
745 RtlExtendedLargeIntegerDivide@16
746 RtlExtendedMagicDivide@20
748 RtlFillMemoryUlong@12
750 RtlFindClearBitsAndSet@12
751 RtlFindFirstRunClear@8
753 RtlFindLongestRunClear@8
754 RtlFindLongestRunSet@8
757 RtlFindSetBitsAndClear@12
758 ;RtlFindUnicodePrefix
759 RtlFormatCurrentUserKeyPath@4
763 RtlFreeUnicodeString@4
764 RtlGenerate8dot3Name@16
765 ;RtlGetCallersAddress
766 RtlGetCompressionWorkSpaceSize@12
767 RtlGetDaclSecurityDescriptor@16
768 RtlGetDefaultCodePage@8
769 ;RtlGetElementGenericTable
770 RtlGetGroupSecurityDescriptor@12
771 RtlGetOwnerSecurityDescriptor@12
774 RtlInitCodePageTable@8
776 RtlInitUnicodeString@8
777 RtlInitializeBitMap@12
778 ;RtlInitializeGenericTable
780 ;RtlInitializeUnicodePrefix
781 ;RtlInsertElementGenericTable
782 ;RtlInsertUnicodePrefix
784 RtlIntegerToUnicodeString@12
785 RtlIsNameLegalDOS8Dot3@12
786 RtlLargeIntegerAdd@16
787 RtlLargeIntegerArithmeticShift@12
788 RtlLargeIntegerDivide@20
789 RtlLargeIntegerNegate@8
790 RtlLargeIntegerShiftLeft@12
791 RtlLargeIntegerShiftRight@12
792 RtlLargeIntegerSubtract@16
793 RtlLengthRequiredSid@4
794 RtlLengthSecurityDescriptor@4
796 RtlLookupAtomInAtomTable@12
797 ;RtlLookupElementGenericTable
800 RtlMultiByteToUnicodeN@20
801 RtlMultiByteToUnicodeSize@12
802 ;RtlNextUnicodePrefix
803 RtlNtStatusToDosError@4
804 RtlNtStatusToDosErrorNoTeb@4
805 ;RtlNumberGenericTableElements
806 RtlNumberOfClearBits@4
808 RtlOemStringToCountedUnicodeString@12
809 RtlOemStringToUnicodeSize@4
810 RtlOemStringToUnicodeString@12
812 RtlPinAtomInAtomTable@8
814 RtlPrefixUnicodeString@12
815 RtlQueryAtomInAtomTable@24
816 RtlQueryRegistryValues@20
817 RtlQueryTimeZoneInformation@4
820 ;RtlRemoveUnicodePrefix
822 RtlSecondsSince1970ToTime@8
823 RtlSecondsSince1980ToTime@8
826 RtlSetDaclSecurityDescriptor@16
827 RtlSetGroupSecurityDescriptor@12
828 RtlSetOwnerSecurityDescriptor@12
829 RtlSetSaclSecurityDescriptor@16
830 RtlSetTimeZoneInformation@4
832 RtlSubAuthorityCountSid@4
834 RtlTimeFieldsToTime@8
835 RtlTimeToSecondsSince1970@8
836 RtlTimeToSecondsSince1980@8
837 RtlTimeToTimeFields@8
838 RtlUnicodeStringToAnsiSize@4
839 RtlUnicodeStringToAnsiString@12
840 RtlUnicodeStringToCountedOemString@12
841 RtlUnicodeStringToInteger@12
842 RtlUnicodeStringToOemSize@4
843 RtlUnicodeStringToOemString@12
844 RtlUnicodeToCustomCPN@24
845 RtlUnicodeToMultiByteN@20
846 RtlUnicodeToMultiByteSize@12
849 RtlUpcaseUnicodeChar@4
850 RtlUpcaseUnicodeString@12
851 RtlUpcaseUnicodeStringToAnsiString@12
852 RtlUpcaseUnicodeStringToCountedOemString@12
853 RtlUpcaseUnicodeStringToOemString@12
854 RtlUpcaseUnicodeToCustomCPN@24
855 RtlUpcaseUnicodeToMultiByteN@20
856 RtlUpcaseUnicodeToOemN@20
859 RtlValidSecurityDescriptor@4
861 RtlWriteRegistryValue@24
864 RtlxAnsiStringToUnicodeSize@4
865 RtlxOemStringToUnicodeSize@4
866 RtlxUnicodeStringToAnsiSize@4
867 RtlxUnicodeStringToOemSize@4
869 ;SeAppendPrivileges@8
871 ;SeAuditingFileEvents@8
872 ;SeAuditingFileOrGlobalEvents@18
873 ;SeCaptureSecurityDescriptor@20
874 SeCaptureSubjectContext@4
875 ;SeCloseObjectAuditAlarm@12
876 ;SeCreateAccessState@16
877 SeCreateClientSecurity@16
879 ;SeDeleteAccessState@4
880 ;SeDeleteObjectAuditAlarm@8
883 SeImpersonateClient@8
884 ;SeLockSubjectContext@4
885 ;SeMarkLogonSessionForTerminationNotification@4
886 ;SeOpenObjectAuditAlarm@36
887 ;SeOpenObjectForDeleteAuditAlarm@36
889 ;SePrivilegeObjectAuditAlarm@24
890 SePublicDefaultDacl DATA
891 ;SeQueryAuthenticationIdToken@8
892 ;SeQuerySecurityDescriptorInfo@16
893 ;SeRegisterLogonSessionTerminatedRoutine@4
894 ;SeReleaseSecurityDescriptor@12
895 SeReleaseSubjectContext@4
896 ;SeSetAccessStateGenericMapping@8
897 ;SeSetSecurityDescriptorInfo@24
898 SeSinglePrivilegeCheck@12
899 SeSystemDefaultDacl DATA
900 SeTokenImpersonationLevel@4
902 ;SeUnlockSubjectContext@4
903 ;SeUnregisterLogonSessionTerminatedRoutine@4
904 ;SeValidSecurityDescriptor@8
905 WRITE_REGISTER_UCHAR@8
906 WRITE_REGISTER_ULONG@8
907 WRITE_REGISTER_USHORT@8
908 WRITE_REGISTER_BUFFER_UCHAR@12
909 WRITE_REGISTER_BUFFER_ULONG@12
910 WRITE_REGISTER_BUFFER_USHORT@12
911 ZwAccessCheckAndAuditAlarm@44
913 ZwAllocateVirtualMemory@24
916 ZwCloseObjectAuditAlarm@12
918 ZwCreateDirectoryObject@12
923 ZwCreateSymbolicLinkObject@16
927 ZwDeviceIoControlFile@40
932 ZwEnumerateValueKey@24
933 ZwFlushInstructionCache@12
935 ZwFreeVirtualMemory@16
939 ZwMakeTemporaryObject@4
940 ZwMapViewOfSection@40
942 ZwOpenDirectoryObject@12
947 ZwOpenProcessToken@12
949 ZwOpenSymbolicLinkObject@12
953 ZwQueryDefaultLocale@8
954 ZwQueryDirectoryFile@44
955 ZwQueryInformationAtom@20
956 ZwQueryInformationFile@20
957 ZwQueryInformationProcess@20
958 ZwQueryInformationToken@20
962 ZwQuerySecurityObject@20
963 ZwQuerySymbolicLinkObject@12
964 ZwQuerySystemInformation@16
967 ZwQueryVolumeInformationFile@20
970 ZwRequestWaitReplyPort@12
975 ZwSetInformationFile@20
976 ZwSetInformationObject@16
977 ZwSetInformationProcess@16
978 ZwSetInformationThread@16
979 ZwSetSystemInformation@12
985 ZwUnmapViewOfSection@8
986 ZwWaitForMultipleObjects@20
987 ZwWaitForSingleObject@12
990 _abnormal_termination