1 ; $Id: ntoskrnl.def,v 1.120 2001/11/29 16:41:22 ekohl Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@12
9 ;CcRosRequestCacheSegment@20
10 ;CcRosReleaseCacheSegment@12
11 CcRosReleaseFileCache@8
16 CcSetDirtyPinnedData@8
20 DbgBreakPointWithStatus@4
21 ;DbgLoadImageSymbols@12
25 @ExAcquireFastMutexUnsafe@4
26 ExAcquireResourceExclusive@8
27 ExAcquireResourceExclusiveLite@8
28 ExAcquireResourceSharedLite@8
29 ExAcquireSharedStarveExclusive@8
30 ExAcquireSharedWaitForExclusive@8
31 ExAllocateFromPagedLookasideList@4
33 ExAllocatePoolWithQuota@8
34 ExAllocatePoolWithQuotaTag@12
35 ExAllocatePoolWithTag@12
36 ExConvertExclusiveToSharedLite@4
38 ExDeleteNPagedLookasideList@4
39 ExDeletePagedLookasideList@4
41 ExDeleteResourceLite@4
42 ExDesktopObjectType DATA
43 ExDisableResourceBoostLite@4
44 ExEventObjectType DATA
47 ExFreeToPagedLookasideList@8
48 ExGetExclusiveWaiterCount@4
50 ExGetSharedWaiterCount@4
51 ExInitializeNPagedLookasideList@28
52 ExInitializePagedLookasideList@28
53 ExInitializeResource@4
54 ExInitializeResourceLite@4
56 ExInterlockedAddLargeInteger@16
57 @ExInterlockedAddLargeStatistic@8
58 ExInterlockedAddUlong@12
59 @ExInterlockedCompareExchange64@16
60 ExInterlockedDecrementLong@8
61 ExInterlockedExchangeUlong@12
62 ExInterlockedExtendZone@16
63 ExInterlockedIncrementLong@8
64 ExInterlockedInsertHeadList@12
65 ExInterlockedInsertTailList@12
66 ExInterlockedPopEntryList@8
67 @ExInterlockedPopEntrySList@8
68 ExInterlockedPushEntryList@12
69 @ExInterlockedPushEntrySList@12
70 ExInterlockedRemoveHeadList@8
71 ExIsProcessorFeaturePresent@4
72 ExIsResourceAcquiredExclusiveLite@4
73 ExIsResourceAcquiredSharedLite@4
74 ExLocalTimeToSystemTime@8
79 ExRaiseAccessViolation@0
80 ExRaiseDatatypeMisalignment@0
85 ExReinitializeResourceLite@4
86 @ExReleaseFastMutexUnsafe@4
87 ExReleaseResourceForThread@8
88 ExReleaseResourceForThreadLite@8
89 @ExReleaseResourceLite@4
90 ExSetResourceOwnerPointer@8
91 ;ExSystemExceptionFilter
92 ExSystemTimeToLocalTime@8
93 ExTryToAcquireResourceExclusiveLite@4
94 ExUnregisterCallback@4
95 ExWindowStationObjectType DATA
96 @ExfInterlockedAddUlong@12
97 ;@ExfInterlockedInsertHeadList
98 ;@ExfInterlockedInsertTailList
99 ;@ExfInterlockedPopEntryList
100 ;@ExfInterlockedPushEntryList
101 ;@ExfInterlockedRemoveHeadList
102 @Exfi386InterlockedDecrementLong@4
103 @Exfi386InterlockedExchangeUlong@8
104 @Exfi386InterlockedIncrementLong@4
105 Exi386InterlockedDecrementLong@4
106 Exi386InterlockedExchangeUlong@8
107 Exi386InterlockedIncrementLong@4
108 FsRtlAddLargeMcbEntry@28
110 FsRtlAddToTunnelCache@32
112 FsRtlAllocatePoolWithQuota@8
113 FsRtlAllocatePoolWithQuotaTag@12
114 FsRtlAllocatePoolWithTag@12
115 FsRtlAllocateResource@0
116 FsRtlAreNamesEqual@16
118 FsRtlCheckLockForReadAccess@8
119 FsRtlCheckLockForWriteAccess@8
123 FsRtlCurrentBatchOplock@4
124 FsRtlDeleteKeyFromTunnelCache@12
125 FsRtlDeleteTunnelCache@4
126 FsRtlDeregisterUncProvider@4
129 FsRtlDoesDbcsContainWildCards@4
130 FsRtlDoesNameContainWildCards@4
131 FsRtlFastCheckLockForRead@24
132 FsRtlFastCheckLockForWrite@24
133 FsRtlFastUnlockAll@16
134 FsRtlFastUnlockAllByKey@20
135 FsRtlFastUnlockSingle@32
136 FsRtlFindInTunnelCache@32
138 FsRtlGetNextFileLock@8
139 FsRtlGetNextLargeMcbEntry@20
140 FsRtlGetNextMcbEntry@20
141 FsRtlInitializeFileLock@12
142 FsRtlInitializeLargeMcb@8
144 FsRtlInitializeOplock@4
145 FsRtlInitializeTunnelCache@4
146 FsRtlIsDbcsInExpression@8
147 FsRtlIsFatDbcsLegal@20
148 FsRtlIsHpfsDbcsLegal@20
149 FsRtlIsNameInExpression@16
150 FsRtlIsNtstatusExpected@4
151 FsRtlIsTotalDeviceFailure@4
152 FsRtlLegalAnsiCharacterArray DATA
153 FsRtlLookupLargeMcbEntry@32
154 FsRtlLookupLastLargeMcbEntry@12
155 FsRtlLookupLastMcbEntry@12
156 FsRtlLookupMcbEntry@20
158 FsRtlMdlReadComplete@8
159 FsRtlMdlReadCompleteDev@12
161 FsRtlMdlWriteComplete@12
162 FsRtlMdlWriteCompleteDev@16
163 FsRtlNormalizeNtstatus@8
164 FsRtlNotifyChangeDirectory@28
165 FsRtlNotifyCleanup@12
166 FsRtlNotifyFullChangeDirectory@40
167 FsRtlNotifyFullReportChange@36
168 FsRtlNotifyInitializeSync@4
169 FsRtlNotifyReportChange@20
170 FsRtlNotifyUninitializeSync@4
171 FsRtlNumberOfRunsInLargeMcb@4
172 FsRtlNumberOfRunsInMcb@4
174 FsRtlOplockIsFastIoPossible@4
175 FsRtlPostPagingFileStackOverflow@12
176 FsRtlPostStackOverflow@12
177 FsRtlPrepareMdlWrite@24
178 FsRtlPrepareMdlWriteDev@28
180 FsRtlProcessFileLock@12
181 FsRtlRegisterUncProvider@12
182 FsRtlRemoveLargeMcbEntry@20
183 FsRtlRemoveMcbEntry@12
184 FsRtlSplitLargeMcb@20
186 FsRtlTruncateLargeMcb@12
188 FsRtlUninitializeFileLock@4
189 FsRtlUninitializeLargeMcb@4
190 FsRtlUninitializeMcb@4
191 FsRtlUninitializeOplock@4
192 HalDispatchTable DATA
193 HalPrivateDispatchTable DATA
194 @InterlockedCompareExchange@12
195 @InterlockedDecrement@4
196 @InterlockedExchange@8
197 @InterlockedExchangeAdd@8
198 @InterlockedIncrement@4
199 IoAcquireCancelSpinLock@4
200 IoAcquireVpbSpinLock@4
201 IoAdapterObjectType DATA
202 IoAllocateAdapterChannel@20
203 IoAllocateController@16
204 IoAllocateErrorLogEntry@8
209 IoAttachDeviceByPointer@8
210 IoAttachDeviceToDeviceStack@8
211 IoBuildAsynchronousFsdRequest@24
212 IoBuildDeviceIoControlRequest@36
214 IoBuildSynchronousFsdRequest@28
217 IoCheckDesiredAccess@8
218 IoCheckEaBufferValidity@12
219 IoCheckFunctionAccess@24
220 IoCheckShareAccess@20
222 IoConnectInterrupt@44
226 IoCreateNotificationEvent@8
227 IoCreateStreamFileObject@8
228 IoCreateSymbolicLink@8
229 IoCreateSynchronizationEvent@8
230 IoCreateUnprotectedSymbolicLink@8
233 IoDeleteSymbolicLink@4
235 IoDeviceHandlerObjectSize DATA
236 IoDeviceHandlerObjectType DATA
237 IoDisconnectInterrupt@4
238 IoDeviceObjectType DATA
239 IoDriverObjectType DATA
241 IoFastQueryNetworkAttributes@20
242 IoFileObjectType DATA
246 IoGetAttachedDevice@4
247 IoGetAttachedDeviceReference@4
248 IoGetBaseFileSystemDeviceObject@4
249 IoGetConfigurationInformation@0
250 IoGetCurrentProcess@0
251 IoGetDeviceObjectPointer@16
252 IoGetDeviceToVerify@4
253 IoGetFileObjectGenericMapping@0
255 IoGetRelatedDeviceObject@4
256 IoGetRequestorProcess@4
261 IoIsOperationSynchronous@4
262 IoMakeAssociatedIrp@8
263 IoOpenDeviceInstanceKey@20
265 IoQueryDeviceDescription@32
266 IoQueryDeviceEnumInfo@8
267 IoQueryFileInformation@20
268 IoQueryVolumeInformation@20
271 IoRaiseInformationalHardError@12
272 IoReadOperationCount DATA
273 IoReadPartitionTable@16
274 IoReadTransferCount DATA
275 IoRegisterDriverReinitialization@12
276 IoRegisterFileSystem@4
277 IoRegisterFsRegistrationChange@8
278 IoRegisterShutdownNotification@4
279 IoReleaseCancelSpinLock@4
280 IoReleaseVpbSpinLock@4
281 IoRemoveShareAccess@8
282 IoReportHalResourceUsage@16
283 IoReportResourceUsage@36
284 IoSetDeviceToVerify@8
285 IoSetHardErrorOrVerifyDevice@8
287 IoSetPartitionInformation@16
289 IoSetThreadHardErrorMode@4
292 IoStartNextPacketByKey@12
295 IoStatisticsLock DATA
297 IoSynchronousPageWrite@20
299 IoUnregisterFileSystem@4
300 IoUnregisterFsRegistrationChange@8
301 IoUnregisterShutdownNotification@4
302 IoUpdateShareAccess@8
304 IoWriteErrorLogEntry@4
305 IoWriteOperationCount DATA
306 IoWritePartitionTable@20
307 IoWriteTransferCount DATA
309 @IofCompleteRequest@8
310 KdDebuggerEnabled DATA
311 KdDebuggerNotPresent DATA
313 KdSystemDebugControl@4
315 ;Ke386IoSetAccessProcess
316 ;Ke386QueryIoAccessMap
318 KeAcquireSpinLockAtDpcLevel@4
319 KeAddSystemServiceTable@20
321 ;KeBoostCurrentThread
327 ;KeDcacheFlushCount DATA
328 KeDelayExecutionThread@12
329 KeDeregisterBugCheckCallback@4
331 KeDisconnectInterrupt@4
332 KeEnterCriticalRegion@0
333 KeEnterKernelDebugger@0
334 ;KeFindConfigurationEntry
335 ;KeFindConfigurationNextEntry
340 ;KeI386AllocateGdtSelectors
341 ;KeI386Call16BitCStyleFunction
342 ;KeI386Call16BitFunction
343 ;KeI386FlatToGdtSelector
346 ;KeI386ReleaseGdtSelectors
348 ;KeI386SetGdtSelector
349 ;KeIcacheFlushCount DATA
351 KeInitializeDeviceQueue@4
354 KeInitializeInterrupt@44
358 KeInitializeSemaphore@12
359 KeInitializeSpinLock@4
361 KeInitializeTimerEx@8
362 KeInsertByKeyDeviceQueue@12
363 KeInsertDeviceQueue@8
369 KeLeaveCriticalRegion@0
371 KeNumberProcessors DATA
373 ;KeProfileInterruptWithSource
377 KeQueryTimeIncrement@0
378 ;KeRaiseUserException
383 KeReadStateSemaphore@4
385 KeRegisterBugCheckCallback@20
388 KeReleaseSemaphore@16
389 KeReleaseSpinLockFromDpcLevel@4
390 KeRemoveByKeyDeviceQueue@8
391 KeRemoveDeviceQueue@4
392 ;KeRemoveEntryDeviceQueue
396 ;KeRestoreFloatingPointState
398 ;KeSaveFloatingPointState
399 KeServiceDescriptorTable DATA
401 KeSetBasePriorityThread@8
404 ;KeSetEventBoostPriority
405 ;KeSetIdealProcessorThread
407 ;KeSetKernelStackSwapEnable
408 KeSetPriorityThread@8
410 ;@KeSetSwapContextNotifyRoutine
411 KeSetTargetProcessorDpc@8
412 ;@KeSetThreadSelectNotifyRoutine
416 ;@KeSetTimeUpdateNotifyRoutine
417 KeSynchronizeExecution@12
422 KeWaitForMultipleObjects@32
423 KeWaitForMutexObject@20
424 KeWaitForSingleObject@20
425 ;@KefAcquireSpinLockAtDpcLevel
426 ;@KefReleaseSpinLockFromDpcLevel
428 ;@KiAcquireSpinLock@4
430 ;KiCoprocessorError@0
432 KiDispatchInterrupt@0
433 ;KiIpiServiceRoutine@8
434 ;@KiReleaseSpinLock@4
435 ;KiUnexpectedInterrupt
436 ;Kii386SpinOnSpinLock
440 ;LdrFindResourceDirectory_U@16
443 LsaCallAuthenticationPackage@28
444 LsaDeregisterLogonProcess@8
445 LsaFreeReturnBuffer@4
447 LsaLookupAuthenticationPackage@12
448 LsaRegisterLogonProcess@12
449 MmAdjustWorkingSetSize@12
450 MmAllocateContiguousAlignedMemory@16
451 MmAllocateContiguousMemory@12
452 MmAllocateNonCachedMemory@4
453 MmBuildMdlForNonPagedPool@4
454 MmCanFileBeTruncated@8
457 MmDbgTranslatePhysicalAddress@8
458 MmDisableModifiedWriteOfSection@4
459 MmFlushImageSection@8
460 MmForceSectionClosed@8
461 MmFreeContiguousMemory@4
462 MmFreeNonCachedMemory@8
463 MmGetPhysicalAddress@4
465 MmHighestUserAddress DATA
467 MmIsNonPagedSystemAddressValid@4
468 MmIsRecursiveIoFault@0
469 MmIsThisAnNtAsSystem@0
470 MmLockPagableDataSection@4
471 MmLockPagableImageSection@4=MmLockPagableDataSection@4
472 MmLockPagableSectionByHandle@4
477 MmMapViewInSystemSpace@12
478 MmMapViewOfSection@40
480 MmProbeAndLockPages@12
482 MmResetDriverPaging@4
483 MmSectionObjectType DATA
484 MmSecureVirtualMemory@12
485 MmSetAddressRangeModified@8
486 MmSetBankedSection@24
488 MmUnlockPagableImageSection@4
492 MmUnmapVideoDisplay@8
493 MmUnmapViewInSystemSpace@4
494 MmUnmapViewOfSection@8
495 MmUnsecureVirtualMemory@4
496 MmUserProbeAddress DATA
499 NlsMbCodePageTag DATA
500 NlsMbOemCodePageTag DATA
501 NlsOemLeadByteInfo DATA
503 NtAdjustPrivilegesToken@24
504 NtAllocateLocallyUniqueId@4
506 NtAllocateVirtualMemory@24
517 NtDeviceIoControlFile@40
521 NtFreeVirtualMemory@16
525 NtMapViewOfSection@40
526 NtNotifyChangeDirectoryFile@36
529 NtOpenProcessToken@12
530 NtQueryDirectoryFile@44
532 NtQueryInformationAtom@20
533 NtQueryInformationFile@20
534 NtQueryInformationProcess@20
535 NtQueryInformationToken@20
536 ;NtQueryOleDirectoryFile@ <--- ?
537 NtQuerySecurityObject@20
539 NtQueryVolumeInformationFile@20
542 NtRequestWaitReplyPort@12
544 NtSetInformationFile@20
545 NtSetInformationProcess@16
546 NtSetInformationThread@16
547 NtSetSecurityObject@12
551 NtWaitForSingleObject@12
554 ;ObCheckCreateObjectAccess@28
555 ;ObCheckObjectAccess@20
558 ;ObFindHandleForObject@20
559 ;ObGetObjectPointerCount@4
560 ;ObGetObjectSecurity@12
562 ObMakeTemporaryObject@4
563 ObOpenObjectByName@28
564 ObOpenObjectByPointer@28
565 ;ObQueryNameString@16
566 ;ObQueryObjectAuditingByHandle@8
567 @ObfDereferenceObject@4
568 @ObfReferenceObject@4
569 ObReferenceObjectByHandle@24
570 ObReferenceObjectByName@32
571 ObReferenceObjectByPointer@16
572 ;ObReleaseObjectSecurity@8
573 ;ObSetSecurityDescriptorInfo@24
574 ObAddEntryDirectory@12
580 PoRegisterDeviceForIdleDetection@16
581 PoRegisterSystemState@8
586 PoStartNextPowerIrp@4
587 PoUnregisterSystemState@4
589 PsAssignImpersonationToken@8
590 ;PsChargePoolQuota@12
591 PsCreateSystemProcess@12
592 PsCreateSystemThread@28
593 ;PsCreateWin32Process@4
595 ;PsEstablishWin32Callouts@24
596 PsGetCurrentProcessId@0
597 PsGetCurrentThreadId@0
599 PsGetProcessExitTime@0
601 PsImpersonateClient@20
602 PsInitialSystemProcess DATA
603 PsIsThreadTerminating@4
604 ;PsLookupProcessByProcessId@8
605 ;PsLookupProcessThreadByCid@12
606 ;PsLookupThreadByThreadId@8
608 PsReferenceImpersonationToken@16
609 PsReferencePrimaryToken@4
610 ;PsReturnPoolQuota@12
612 ;PsSetCreateProcessNotifyRoutine@8
613 ;PsSetCreateThreadNotifyRoutine@4
614 ;PsSetLegoNotifyRoutine@4
615 ;PsSetProcessPriorityByClass@8
616 PsTerminateSystemThread@4
618 READ_REGISTER_UCHAR@4
619 READ_REGISTER_ULONG@4
620 READ_REGISTER_USHORT@4
621 READ_REGISTER_BUFFER_UCHAR@12
622 READ_REGISTER_BUFFER_ULONG@12
623 READ_REGISTER_BUFFER_USHORT@12
624 RtlAbsoluteToSelfRelativeSD@12
625 RtlAddAccessAllowedAce@16
627 RtlAddAtomToAtomTable@12
628 ;RtlAllocateAndInitializeSid
630 RtlAnsiCharToUnicodeChar@4
631 RtlAnsiStringToUnicodeSize@4
632 RtlAnsiStringToUnicodeString@12
633 RtlAppendAsciizToString@8
634 RtlAppendStringToString@8
635 RtlAppendUnicodeStringToString@8
636 RtlAppendUnicodeToString@8
637 RtlAreAllAccessesGranted@8
638 RtlAreAnyAccessesGranted@8
642 ;RtlCaptureStackBackTrace
644 RtlCheckRegistryKey@8
648 RtlCompareMemoryUlong@12
650 RtlCompareUnicodeString@12
653 RtlConvertLongToLargeInteger@4
654 RtlConvertSidToUnicodeString@12
655 RtlConvertUlongToLargeInteger@4
659 RtlCopyUnicodeString@8
663 RtlCreateRegistryKey@8
664 RtlCreateSecurityDescriptor@8
665 RtlCreateUnicodeString@8
666 RtlCustomCPToUnicodeN@24
669 ;RtlDecompressFragment
671 RtlDeleteAtomFromAtomTable@8
672 ;RtlDeleteElementGenericTable
674 RtlDeleteRegistryValue@12
676 RtlDestroyAtomTable@4
678 RtlDowncaseUnicodeString@12
680 RtlEnlargedIntegerMultiply@8
681 RtlEnlargedUnsignedDivide@16
682 RtlEnlargedUnsignedMultiply@8
683 ;RtlEnumerateGenericTable
684 ;RtlEnumerateGenericTableWithoutSplaying
688 RtlEqualUnicodeString@12
689 RtlExtendedIntegerMultiply@12
690 RtlExtendedLargeIntegerDivide@16
691 RtlExtendedMagicDivide@20
693 RtlFillMemoryUlong@12
695 RtlFindClearBitsAndSet@12
696 RtlFindFirstRunClear@8
698 RtlFindLongestRunClear@8
699 RtlFindLongestRunSet@8
702 RtlFindSetBitsAndClear@12
703 ;RtlFindUnicodePrefix
704 RtlFormatCurrentUserKeyPath@4
708 RtlFreeUnicodeString@4
709 ;RtlGenerate8dot3Name
710 ;RtlGetCallersAddress
711 ;RtlGetCompressionWorkSpaceSize
712 RtlGetDaclSecurityDescriptor@16
713 RtlGetDefaultCodePage@8
714 ;RtlGetElementGenericTable
715 RtlGetGroupSecurityDescriptor@12
716 RtlGetOwnerSecurityDescriptor@12
719 ;RtlInitCodePageTable
721 RtlInitUnicodeString@8
722 RtlInitializeBitMap@12
723 ;RtlInitializeGenericTable
725 ;RtlInitializeUnicodePrefix
726 ;RtlInsertElementGenericTable
727 ;RtlInsertUnicodePrefix
729 RtlIntegerToUnicodeString@12
730 ;RtlIsNameLegalDOS8Dot3
731 RtlLargeIntegerAdd@16
732 RtlLargeIntegerArithmeticShift@12
733 RtlLargeIntegerDivide@20
734 RtlLargeIntegerNegate@8
735 RtlLargeIntegerShiftLeft@12
736 RtlLargeIntegerShiftRight@12
737 RtlLargeIntegerSubtract@16
738 RtlLengthRequiredSid@4
739 RtlLengthSecurityDescriptor@4
741 RtlLookupAtomInAtomTable@12
742 ;RtlLookupElementGenericTable
745 RtlMultiByteToUnicodeN@20
746 RtlMultiByteToUnicodeSize@12
747 ;RtlNextUnicodePrefix
748 RtlNtStatusToDosError@4
749 RtlNtStatusToDosErrorNoTeb@4
750 ;RtlNumberGenericTableElements
751 RtlNumberOfClearBits@4
753 RtlOemStringToCountedUnicodeString@12
754 RtlOemStringToUnicodeSize@4
755 RtlOemStringToUnicodeString@12
757 RtlPinAtomInAtomTable@8
759 RtlPrefixUnicodeString@12
760 RtlQueryAtomInAtomTable@24
761 RtlQueryRegistryValues@20
762 RtlQueryTimeZoneInformation@4
765 ;RtlRemoveUnicodePrefix
767 RtlSecondsSince1970ToTime@8
768 RtlSecondsSince1980ToTime@8
771 RtlSetDaclSecurityDescriptor@16
772 RtlSetGroupSecurityDescriptor@12
773 RtlSetOwnerSecurityDescriptor@12
774 RtlSetSaclSecurityDescriptor@16
775 RtlSetTimeZoneInformation@4
777 RtlSubAuthorityCountSid@4
779 RtlTimeFieldsToTime@8
780 RtlTimeToSecondsSince1970@8
781 RtlTimeToSecondsSince1980@8
782 RtlTimeToTimeFields@8
783 RtlUnicodeStringToAnsiSize@4
784 RtlUnicodeStringToAnsiString@12
785 RtlUnicodeStringToCountedOemString@12
786 RtlUnicodeStringToInteger@12
787 RtlUnicodeStringToOemSize@4
788 RtlUnicodeStringToOemString@12
789 RtlUnicodeToCustomCPN@24
790 RtlUnicodeToMultiByteN@20
791 RtlUnicodeToMultiByteSize@12
794 RtlUpcaseUnicodeChar@4
795 RtlUpcaseUnicodeString@12
796 RtlUpcaseUnicodeStringToAnsiString@12
797 RtlUpcaseUnicodeStringToCountedOemString@12
798 RtlUpcaseUnicodeStringToOemString@12
799 RtlUpcaseUnicodeToCustomCPN@24
800 RtlUpcaseUnicodeToMultiByteN@20
801 RtlUpcaseUnicodeToOemN@20
804 RtlValidSecurityDescriptor@4
806 RtlWriteRegistryValue@24
809 RtlxAnsiStringToUnicodeSize@4
810 RtlxOemStringToUnicodeSize@4
811 RtlxUnicodeStringToAnsiSize@4
812 RtlxUnicodeStringToOemSize@4
814 ;SeAppendPrivileges@8
816 ;SeAuditingFileEvents@8
817 ;SeAuditingFileOrGlobalEvents@18
818 ;SeCaptureSecurityDescriptor@20
819 SeCaptureSubjectContext@4
820 ;SeCloseObjectAuditAlarm@12
821 ;SeCreateAccessState@16
822 SeCreateClientSecurity@16
824 ;SeDeleteAccessState@4
825 ;SeDeleteObjectAuditAlarm@8
828 SeImpersonateClient@8
829 ;SeLockSubjectContext@4
830 ;SeMarkLogonSessionForTerminationNotification@4
831 ;SeOpenObjectAuditAlarm@36
832 ;SeOpenObjectForDeleteAuditAlarm@36
834 ;SePrivilegeObjectAuditAlarm@24
835 ;SePublicDefaultDacl DATA
836 ;SeQueryAuthenticationIdToken@8
837 ;SeQuerySecurityDescriptorInfo@16
838 ;SeRegisterLogonSessionTerminatedRoutine@4
839 ;SeReleaseSecurityDescriptor@12
840 SeReleaseSubjectContext@4
841 ;SeSetAccessStateGenericMapping@8
842 ;SeSetSecurityDescriptorInfo@24
843 ;SeSinglePrivilegeCheck@12
844 ;SeSystemDefaultDacl DATA
845 ;SeTokenImpersonationLevel@4
847 ;SeUnlockSubjectContext@4
848 ;SeUnregisterLogonSessionTerminatedRoutine@4
849 ;SeValidSecurityDescriptor@8
850 WRITE_REGISTER_UCHAR@8
851 WRITE_REGISTER_ULONG@8
852 WRITE_REGISTER_USHORT@8
853 WRITE_REGISTER_BUFFER_UCHAR@12
854 WRITE_REGISTER_BUFFER_ULONG@12
855 WRITE_REGISTER_BUFFER_USHORT@12
856 ZwAccessCheckAndAuditAlarm@44
858 ZwAllocateVirtualMemory@24
861 ZwCloseObjectAuditAlarm@12
863 ZwCreateDirectoryObject@12
868 ZwCreateSymbolicLinkObject@16
872 ZwDeviceIoControlFile@40
877 ZwEnumerateValueKey@24
878 ZwFlushInstructionCache@12
880 ZwFreeVirtualMemory@16
884 ZwMakeTemporaryObject@4
885 ZwMapViewOfSection@40
887 ZwOpenDirectoryObject@12
892 ZwOpenProcessToken@12
894 ZwOpenSymbolicLinkObject@12
898 ZwQueryDefaultLocale@8
899 ZwQueryDirectoryFile@44
900 ZwQueryInformationAtom@20
901 ZwQueryInformationFile@20
902 ZwQueryInformationProcess@20
903 ZwQueryInformationToken@20
907 ZwQuerySecurityObject@20
908 ZwQuerySymbolicLinkObject@12
909 ZwQuerySystemInformation@16
912 ZwQueryVolumeInformationFile@20
915 ZwRequestWaitReplyPort@12
920 ZwSetInformationFile@20
921 ZwSetInformationObject@16
922 ZwSetInformationProcess@16
923 ZwSetInformationThread@16
924 ZwSetSystemInformation@12
930 ZwUnmapViewOfSection@8
931 ZwWaitForMultipleObjects@20
932 ZwWaitForSingleObject@12
935 _abnormal_termination