3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
19 CcGetFileObjectFromBcb@4
20 CcGetFileObjectFromSectionPtrs@4
21 CcGetFlushedValidData@8
22 CcGetLsnForFileObject@8
23 CcInitializeCacheMap@20
25 CcFastMdlReadWait DATA
26 CcFastReadNotPossible DATA
37 CcPurgeCacheSection@16
40 CcScheduleReadAhead@12
41 CcSetAdditionalCacheAttributes@12
42 CcSetBcbOwnerPointer@8
43 CcSetDirtyPageThreshold@8
44 CcSetDirtyPinnedData@8
45 CcSetLogHandleForFile@12
46 CcSetReadAheadGranularity@8
47 CcUninitializeCacheMap@12
49 CcUnpinDataForThread@8
51 CcWaitForCurrentLazyWriterActivity@0
56 CmUnRegisterCallback@8
58 DbgBreakPointWithStatus@4
59 DbgLoadImageSymbols@12
63 DbgPrintReturnControlC
64 DbgQueryDebugFilterState@8
65 DbgSetDebugFilterState@12
66 @ExAcquireFastMutexUnsafe@4
67 ExAcquireResourceExclusive@8
68 ExAcquireResourceExclusiveLite@8
69 ExAcquireResourceSharedLite@8
70 @ExAcquireRundownProtection@4
71 @ExAcquireRundownProtectionEx@8
72 ExAcquireSharedStarveExclusive@8
73 ExAcquireSharedWaitForExclusive@8
74 ExAllocateFromPagedLookasideList@4=ExiAllocateFromPagedLookasideList@4
76 ExAllocatePoolWithQuota@8
77 ExAllocatePoolWithQuotaTag@12
78 ExAllocatePoolWithTag@12
79 ExAllocatePoolWithTagPriority@16
80 ExConvertExclusiveToSharedLite@4
82 ExDeleteNPagedLookasideList@4
83 ExDeletePagedLookasideList@4
85 ExDeleteResourceLite@4
86 ExDesktopObjectType DATA
87 ExDisableResourceBoostLite@4
89 ExEventObjectType DATA
93 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
94 ExGetCurrentProcessorCounts@12
95 ExGetCurrentProcessorCpuUsage@4
96 ExGetExclusiveWaiterCount@4
98 ExGetSharedWaiterCount@4
99 @ExInitializeRundownProtection@4
100 ExInitializeNPagedLookasideList@28
101 ExInitializePagedLookasideList@28
102 ExInitializeResource@4
103 ExInitializeResourceLite@4
105 ExInterlockedAddLargeInteger@16
106 @ExInterlockedAddLargeStatistic@8
107 ExInterlockedAddUlong@12
108 @ExInterlockedCompareExchange64@16
109 ExInterlockedDecrementLong@8
110 ExInterlockedExchangeUlong@12
111 ExInterlockedExtendZone@16
112 ExInterlockedIncrementLong@8
113 @ExInterlockedFlushSList@4
114 ExInterlockedInsertHeadList@12
115 ExInterlockedInsertTailList@12
116 ExInterlockedPopEntryList@8
117 @ExInterlockedPopEntrySList@8
118 ExInterlockedPushEntryList@12
119 @ExInterlockedPushEntrySList@12
120 ExInterlockedRemoveHeadList@8
121 ExIsProcessorFeaturePresent@4
122 ExIsResourceAcquiredExclusiveLite@4
123 ExIsResourceAcquiredSharedLite@4
124 ExLocalTimeToSystemTime@8
126 ExQueryPoolBlockSize@8
128 ExRaiseAccessViolation@0
129 ExRaiseDatatypeMisalignment@0
133 ExRegisterCallback@12
134 ExReinitializeResourceLite@4
135 @ExReInitializeRundownProtection@4
136 @ExReleaseFastMutexUnsafe@4
137 ExReleaseResourceForThread@8
138 ExReleaseResourceForThreadLite@8
139 @ExReleaseResourceLite@4
140 @ExReleaseRundownProtection@4
141 @ExReleaseRundownProtectionEx@8
142 @ExRundownCompleted@4
143 ExSemaphoreObjectType DATA
144 ExSetResourceOwnerPointer@8
145 ExSetTimerResolution@8
146 ExSystemExceptionFilter@0
147 ExSystemTimeToLocalTime@8
148 ExTryToAcquireResourceExclusiveLite@4
149 ExUnregisterCallback@4
152 @ExWaitForRundownProtectionRelease@4
153 ExWindowStationObjectType DATA
154 @ExfAcquirePushLockExclusive@4
155 @ExfAcquirePushLockShared@4
156 @ExfReleasePushLock@4
157 @ExfInterlockedAddUlong@12
158 @ExfInterlockedInsertHeadList@12
159 @ExfInterlockedInsertTailList@12
160 @ExfInterlockedCompareExchange64@12
161 @ExfInterlockedPopEntryList@8
162 @ExfInterlockedPushEntryList@12
163 @ExfInterlockedRemoveHeadList@8
164 @Exfi386InterlockedDecrementLong@4
165 @Exfi386InterlockedExchangeUlong@8
166 @Exfi386InterlockedIncrementLong@4
167 Exi386InterlockedDecrementLong@4
168 Exi386InterlockedExchangeUlong@8
169 Exi386InterlockedIncrementLong@4
170 FsRtlAcquireFileExclusive@4
171 FsRtlAddLargeMcbEntry@28
173 FsRtlAddToTunnelCache@32
174 FsRtlAllocateFileLock@8
176 FsRtlAllocatePoolWithQuota@8
177 FsRtlAllocatePoolWithQuotaTag@12
178 FsRtlAllocatePoolWithTag@12
179 FsRtlAllocateResource@0
180 FsRtlAreNamesEqual@16
182 FsRtlCheckLockForReadAccess@8
183 FsRtlCheckLockForWriteAccess@8
187 FsRtlCurrentBatchOplock@4
188 FsRtlDeleteKeyFromTunnelCache@12
189 FsRtlDeleteTunnelCache@4
190 FsRtlDeregisterUncProvider@4
193 FsRtlDoesDbcsContainWildCards@4
194 FsRtlDoesNameContainWildCards@4
195 FsRtlFastCheckLockForRead@24
196 FsRtlFastCheckLockForWrite@24
197 FsRtlFastUnlockAll@16
198 FsRtlFastUnlockAllByKey@20
199 FsRtlFastUnlockSingle@32
200 FsRtlFindInTunnelCache@32
203 FsRtlGetNextFileLock@8
204 FsRtlGetNextLargeMcbEntry@20
205 FsRtlGetNextMcbEntry@20
206 FsRtlIncrementCcFastReadNotPossible@0
207 FsRtlIncrementCcFastReadNoWait@0
208 FsRtlIncrementCcFastReadResourceMiss@0
209 FsRtlIncrementCcFastReadWait@0
210 FsRtlInitializeFileLock@12
211 FsRtlInitializeLargeMcb@8
213 FsRtlInitializeOplock@4
214 FsRtlInitializeTunnelCache@4
215 FsRtlInsertPerFileObjectContext@8
216 FsRtlInsertPerStreamContext@8
217 FsRtlIsDbcsInExpression@8
218 FsRtlIsFatDbcsLegal@20
219 FsRtlIsHpfsDbcsLegal@20
220 FsRtlIsNameInExpression@16
221 FsRtlIsNtstatusExpected@4
223 FsRtlIsTotalDeviceFailure@4
224 FsRtlLegalAnsiCharacterArray DATA
225 FsRtlLookupLargeMcbEntry@32
226 FsRtlLookupLastLargeMcbEntry@12
227 FsRtlLookupLastLargeMcbEntryAndIndex@16
228 FsRtlLookupLastMcbEntry@12
229 FsRtlLookupMcbEntry@20
230 FsRtlLookupPerFileObjectContext@12
231 FsRtlLookupPerStreamContextInternal@12
233 FsRtlMdlReadComplete@8
234 FsRtlMdlReadCompleteDev@12
236 FsRtlMdlWriteComplete@12
237 FsRtlMdlWriteCompleteDev@16
238 FsRtlNormalizeNtstatus@8
239 FsRtlNotifyChangeDirectory@28
240 FsRtlNotifyCleanup@12
241 FsRtlNotifyFilterChangeDirectory@44
242 FsRtlNotifyFilterReportChange@40
243 FsRtlNotifyFullChangeDirectory@40
244 FsRtlNotifyFullReportChange@36
245 FsRtlNotifyInitializeSync@4
246 FsRtlNotifyReportChange@20
247 FsRtlNotifyUninitializeSync@4
248 FsRtlNotifyVolumeEvent@8
249 FsRtlNumberOfRunsInLargeMcb@4
250 FsRtlNumberOfRunsInMcb@4
252 FsRtlOplockIsFastIoPossible@4
253 FsRtlPostPagingFileStackOverflow@12
254 FsRtlPostStackOverflow@12
255 FsRtlPrepareMdlWrite@24
256 FsRtlPrepareMdlWriteDev@28
258 FsRtlProcessFileLock@12
259 FsRtlRegisterUncProvider@12
261 FsRtlRemoveLargeMcbEntry@20
262 FsRtlRemoveMcbEntry@12
263 FsRtlRemovePerFileObjectContext@12
264 FsRtlRemovePerStreamContext@12
266 FsRtlSplitLargeMcb@20
268 FsRtlTeardownPerStreamContexts@4
269 FsRtlTruncateLargeMcb@12
271 FsRtlUninitializeFileLock@4
272 FsRtlUninitializeLargeMcb@4
273 FsRtlUninitializeMcb@4
274 FsRtlUninitializeOplock@4
275 HalDispatchTable DATA
276 HalPrivateDispatchTable DATA
278 InbvAcquireDisplayOwnership@0
279 InbvCheckDisplayOwnership@0
281 InbvEnableBootDriver@4
282 InbvEnableDisplayString@4
283 InbvInstallDisplayStringFilter@4
284 InbvIsBootDriverInstalled@0
285 InbvNotifyDisplayOwnershipLost@4
287 InbvSetScrollRegion@16
289 InbvSolidColorFill@20
290 InitSafeBootMode DATA
291 @InterlockedCompareExchange@12
292 @InterlockedDecrement@4
293 @InterlockedExchange@8
294 @InterlockedExchangeAdd@8
295 @InterlockedIncrement@4
296 @InterlockedPushEntrySList@8
297 @InterlockedPopEntrySList@4
298 IoAcquireCancelSpinLock@4
299 IoAcquireRemoveLockEx@20
300 IoAcquireVpbSpinLock@4
301 IoAdapterObjectType DATA
302 IoAllocateAdapterChannel@20
305 IoAllocateController@16
306 IoAllocateDriverObjectExtension@16
307 IoAllocateErrorLogEntry@8
309 IoAssignDriveLetters@16
312 IoAttachDeviceByPointer@8
313 IoAttachDeviceToDeviceStack@8
314 IoAttachDeviceToDeviceStackSafe@12
315 IoBuildAsynchronousFsdRequest@24
316 IoBuildDeviceIoControlRequest@36
318 IoBuildSynchronousFsdRequest@28
322 IoCheckDesiredAccess@8
323 IoCheckEaBufferValidity@12
324 IoCheckFunctionAccess@24
325 IoCheckQuerySetFileInformation@12
326 IoCheckQuerySetVolumeInformation@12
327 IoCheckQuotaBufferValidity@12
328 IoCheckShareAccess@20
330 IoConnectInterrupt@44
336 IoCreateFileSpecifyDeviceObjectHint@60
337 IoCreateNotificationEvent@8
338 IoCreateStreamFileObject@8
339 IoCreateStreamFileObjectEx@12
340 IoCreateStreamFileObjectLite@8
341 IoCreateSymbolicLink@8
342 IoCreateSynchronizationEvent@8
343 IoCreateUnprotectedSymbolicLink@8
353 IoDeleteSymbolicLink@4
355 IoDeviceHandlerObjectSize DATA
356 IoDeviceHandlerObjectType DATA
357 IoDeviceObjectType DATA
358 IoDisconnectInterrupt@4
359 IoDriverObjectType DATA
361 IoEnumerateDeviceObjectList@16
362 IoFastQueryNetworkAttributes@20
363 IoFileObjectType DATA
364 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
365 IoForwardIrpSynchronously@8
367 IoFreeErrorLogEntry@4
371 IoGetAttachedDevice@4
372 IoGetAttachedDeviceReference@4
373 IoGetBaseFileSystemDeviceObject@4
374 IoGetBootDiskInformation@8
375 IoGetConfigurationInformation@0
376 IoGetCurrentProcess@0
377 IoGetDeviceObjectPointer@16
378 IoGetDeviceAttachmentBaseRef@4
379 IoGetDeviceInterfaceAlias@12
380 IoGetDeviceInterfaces@16
381 IoGetDriverObjectExtension@8
382 IoGetDeviceProperty@20
383 IoGetDeviceToVerify@4
384 IoGetDiskDeviceObject@8
386 IoGetFileObjectGenericMapping@0
388 IoGetLowerDeviceObject@4
389 IoGetRelatedDeviceObject@4
390 IoGetRequestorProcess@4
391 IoGetRequestorProcessId@4
392 IoGetRequestorSessionId@8
396 IoInvalidateDeviceRelations@8
397 IoInvalidateDeviceState@4
398 IoInitializeRemoveLockEx@20
400 IoIsFileOriginRemote@4
402 IoIsValidNameGraftingBuffer@8
403 IoIsOperationSynchronous@4
404 IoMakeAssociatedIrp@8
405 IoOpenDeviceInterfaceRegistryKey@12
406 IoOpenDeviceRegistryKey@16
408 IoPnPDeliverServicePowerNotification@16
409 IoQueryDeviceDescription@32
410 IoQueryFileDosDeviceName@8
411 IoQueryFileInformation@20
412 IoQueryVolumeInformation@20
416 IoRaiseInformationalHardError@12
417 IoReadDiskSignature@12
418 IoReadOperationCount DATA
419 @IoReadPartitionTable@16
420 IoReadPartitionTableEx@8
421 IoReadTransferCount DATA
422 IoRegisterBootDriverReinitialization@12
423 IoRegisterDeviceInterface@16
424 IoRegisterDriverReinitialization@12
425 IoRegisterFileSystem@4
426 IoRegisterFsRegistrationChange@8
427 IoRegisterLastChanceShutdownNotification@4
428 IoRegisterPlugPlayNotification@28
429 IoRegisterShutdownNotification@4
430 IoReleaseCancelSpinLock@4
431 IoReleaseRemoveLockAndWaitEx@12
432 IoReleaseRemoveLockEx@12
433 IoReleaseVpbSpinLock@4
434 IoRemoveShareAccess@8
435 IoReportDetectedDevice@32
436 IoReportHalResourceUsage@16
437 IoReportResourceUsage@36
438 IoReportResourceForDetection@28
439 IoReportTargetDeviceChange@8
440 IoReportTargetDeviceChangeAsynchronous@16
441 IoRequestDeviceEject@4
443 IoSetCompletionRoutineEx@28
444 IoSetSystemPartition@4
445 IoSetDeviceInterfaceState@8
446 IoSetDeviceToVerify@8
448 IoSetHardErrorOrVerifyDevice@8
451 @IoSetPartitionInformation@16
452 IoSetPartitionInformationEx@12
453 IoSetStartIoAttributes@12
455 IoSetThreadHardErrorMode@4
458 IoStartNextPacketByKey@12
461 IoStatisticsLock DATA
463 IoSynchronousPageWrite@20
464 IoSynchronousInvalidateDeviceRelations@8
466 IoUnregisterFileSystem@4
467 IoUnregisterFsRegistrationChange@8
468 IoUnregisterPlugPlayNotification@4
469 IoUnregisterShutdownNotification@4
470 IoUpdateShareAccess@8
471 IoValidateDeviceIoControlAccess@8
472 IoVerifyPartitionTable@8
474 IoVolumeDeviceToDosName@8
475 IoWMIAllocateInstanceIds@12
476 IoWMIDeviceObjectToInstanceName@12
477 IoWMIExecuteMethod@24
478 IoWMIHandleToInstanceName@12
481 IoWMIQueryAllDataMultiple@16
482 IoWMIQuerySingleInstance@16
483 IoWMIQuerySingleInstanceMultiple@20
484 IoWMIRegistrationControl@8
485 IoWMISetNotificationCallback@12
486 IoWMISetSingleInstance@20
487 IoWMISetSingleItem@24
488 IoWMISuggestInstanceName@16
490 IoWriteErrorLogEntry@4
491 IoWriteOperationCount DATA
492 @IoWritePartitionTable@20
493 IoWritePartitionTableEx@8
494 IoWriteTransferCount DATA
496 @IofCompleteRequest@8
497 IoIsWdmVersionAvailable@8
498 KdDebuggerEnabled DATA
499 KdDebuggerNotPresent DATA
505 KdpServiceDispatcher@12
507 Ke386IoSetAccessProcess@8
508 Ke386QueryIoAccessMap@8
509 Ke386SetIoAccessMap@8
510 @KeAcquireGuardedMutex@4
511 @KeAcquireGuardedMutexUnsafe@4
512 KeAcquireSpinLockAtDpcLevel@4
513 @KeAcquireDispatcherDatabaseLockAtDpcLevel@0
514 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
515 KeAcquireInterruptSpinLock@4
516 KeAddSystemServiceTable@20
519 ;KeBoostCurrentThread
523 KeCapturePersistentThreadState@28
526 KeDcacheFlushCount DATA
527 KeDelayExecutionThread@12
528 KeDeregisterBugCheckCallback@4
529 KeDeregisterBugCheckReasonCallback@4
531 KeDisconnectInterrupt@4
532 KeEnterCriticalRegion@0
533 KeEnterGuardedRegion@0
534 KeEnterKernelDebugger@0
535 KeFindConfigurationEntry@16
536 KeFindConfigurationNextEntry@20
541 KeGetRecommendedSharedDataAlignment@0
543 KeI386AllocateGdtSelectors@8
544 ;KeI386Call16BitCStyleFunction
545 ;KeI386Call16BitFunction
546 KeI386FlatToGdtSelector@12
548 ;KeI386MachineType DATA
549 KeI386ReleaseGdtSelectors@8
551 ;KeI386SetGdtSelector
552 KeIcacheFlushCount DATA
554 KeInitializeDeviceQueue@4
557 @KeInitializeGuardedMutex@4
558 KeInitializeInterrupt@44
562 KeInitializeSemaphore@12
563 KeInitializeSpinLock@4
565 KeInitializeTimerEx@8
566 KeInsertByKeyDeviceQueue@12
567 KeInsertDeviceQueue@8
572 KeIsAttachedProcess@0
574 KeLeaveCriticalRegion@0
575 KeLeaveGuardedRegion@0
577 KeNumberProcessors DATA
579 KeProfileInterruptWithSource@8
581 KeQueryActiveProcessors@0
582 KeQueryInterruptTime@0
583 KeQueryPriorityThread@4
584 KeQueryRuntimeThread@8
587 KeQueryTimeIncrement@0
588 KeRaiseUserException@4
593 KeReadStateSemaphore@4
595 KeRegisterBugCheckCallback@20
596 KeRegisterBugCheckReasonCallback@16
597 @KeReleaseDispatcherDatabaseLockFromDpcLevel@0
598 @KeReleaseGuardedMutexUnsafe@4
599 @KeReleaseGuardedMutex@4
600 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
601 KeReleaseInterruptSpinLock@8
604 KeReleaseSemaphore@16
605 KeReleaseSpinLockFromDpcLevel@4
606 KeRemoveByKeyDeviceQueue@8
607 KeRemoveByKeyDeviceQueueIfBusy@8
608 KeRemoveDeviceQueue@4
609 KeRemoveEntryDeviceQueue@8
612 KeRemoveSystemServiceTable@4
614 KeRestoreFloatingPointState@4
615 KeRevertToUserAffinityThread@0
617 KeSaveFloatingPointState@4
618 KeSaveStateForHibernate
619 KeServiceDescriptorTable DATA
620 KeSetAffinityThread@8
621 KeSetBasePriorityThread@8
622 KeSetDmaIoCoherency@4
624 KeSetEventBoostPriority@8
625 KeSetIdealProcessorThread@8
627 KeSetKernelStackSwapEnable@4
628 KeSetPriorityThread@8
630 KeSetSystemAffinityThread@4
631 ;KeSetSwapContextNotifyRoutine
632 KeSetTargetProcessorDpc@8
633 ;KeSetThreadSelectNotifyRoutine
637 @KeSetTimeUpdateNotifyRoutine@4
638 KeStackAttachProcess@8
639 KeSynchronizeExecution@12
642 @KeTryToAcquireGuardedMutex@4
645 KeUnstackDetachProcess@4
646 KeUserModeCallback@20
647 KeWaitForMultipleObjects@32
648 KeWaitForMutexObject@20
649 KeWaitForSingleObject@20
650 @KefAcquireSpinLockAtDpcLevel@4
651 @KefReleaseSpinLockFromDpcLevel@4
657 KiKernelApcDeliveryCheck@0
658 KiDispatchInterrupt@0
659 KiEnableTimerWatchdog
660 KiInterruptDispatch2@8
661 KiIpiServiceRoutine@8
663 KiUnexpectedInterrupt@0
664 ;Kii386SpinOnSpinLock
668 LdrFindResourceDirectory_U@16
670 LpcPortObjectType DATA
672 LpcRequestWaitReplyPort@12
673 LsaCallAuthenticationPackage@28
674 LsaDeregisterLogonProcess@8
675 LsaFreeReturnBuffer@4
677 LsaLookupAuthenticationPackage@12
678 LsaRegisterLogonProcess@12
679 Mm64BitPhysicalAddress DATA
680 MmAddPhysicalMemory@8
681 MmAddVerifierThunks@8
682 MmAdjustWorkingSetSize@12
684 MmAllocateContiguousMemory@12
685 MmAllocateContiguousMemorySpecifyCache@32
686 MmAllocateMappingAddress@8
687 MmAllocateNonCachedMemory@4
688 MmAllocatePagesForMdl@28
689 MmBuildMdlForNonPagedPool@4
690 MmCanFileBeTruncated@8
693 MmDbgTranslatePhysicalAddress@8
694 MmDisableModifiedWriteOfSection@4
695 MmFlushImageSection@8
696 MmForceSectionClosed@8
697 MmFreeContiguousMemory@4
698 MmFreeContiguousMemorySpecifyCache@12
699 MmFreeMappingAddress@8
700 MmFreeNonCachedMemory@8
702 MmGetPhysicalAddress@4
703 MmGetPhysicalMemoryRanges@0
704 MmGetSystemRoutineAddress@4
705 MmGetVirtualForPhysical@8
707 MmHighestUserAddress DATA
709 MmIsDriverVerifying@4
710 MmIsNonPagedSystemAddressValid@4
711 MmIsRecursiveIoFault@0
712 MmIsThisAnNtAsSystem@0
713 MmIsVerifierEnabled@4
714 MmLockPagableDataSection@4
715 MmLockPagableImageSection@4=MmLockPagableDataSection@4
716 MmLockPagableSectionByHandle@4
719 MmMapLockedPagesSpecifyCache@24
720 MmMapLockedPagesWithReservedMapping@16
722 MmMapUserAddressesToPage@12
724 MmMapViewInSessionSpace@12
725 MmMapViewInSystemSpace@12
726 MmMapViewOfSection@40
727 MmMarkPhysicalMemoryAsBad@8
728 MmMarkPhysicalMemoryAsGood@8
731 MmProbeAndLockPages@12
732 MmProbeAndLockProcessPages@16
733 MmProbeAndLockSelectedPages@16
734 MmProtectMdlSystemAddress@8
736 MmRemovePhysicalMemory@8
737 MmResetDriverPaging@4
738 MmSectionObjectType DATA
739 MmSecureVirtualMemory@12
740 MmSetAddressRangeModified@8
741 MmSetBankedSection@24
743 MmSystemRangeStart DATA
744 MmTrimAllSystemPagableMemory@4
745 MmUnlockPagableImageSection@4
749 MmUnmapReservedMapping@12
750 MmUnmapVideoDisplay@8
751 MmUnmapViewInSessionSpace@4
752 MmUnmapViewInSystemSpace@4
753 MmUnmapViewOfSection@8
754 MmUnsecureVirtualMemory@4
755 MmUserProbeAddress DATA
758 NlsMbCodePageTag DATA
759 NlsMbOemCodePageTag DATA
761 NlsOemLeadByteInfo DATA
763 NtAdjustPrivilegesToken@24
765 NtAllocateLocallyUniqueId@4
767 NtAllocateVirtualMemory@24
778 NtDeviceIoControlFile@40
782 NtFreeVirtualMemory@16
786 NtMakePermanentObject@4
787 NtMapViewOfSection@40
788 NtNotifyChangeDirectoryFile@36
791 NtOpenProcessToken@12
792 NtOpenProcessTokenEx@16
795 NtOpenThreadTokenEx@20
796 NtQueryDirectoryFile@44
798 NtQueryInformationAtom@20
799 NtQueryInformationFile@20
800 NtQueryInformationProcess@20
801 NtQueryInformationThread@20
802 NtQueryInformationToken@20
803 NtQueryQuotaInformationFile@36
804 NtQuerySecurityObject@20
805 NtQuerySystemInformation@16
807 NtQueryVolumeInformationFile@20
810 NtRequestWaitReplyPort@12
813 NtSetInformationFile@20
814 NtSetInformationProcess@16
815 NtSetInformationThread@16
816 NtSetQuotaInformationFile@16
817 NtSetSecurityObject@12
818 NtSetVolumeInformationFile@20
825 NtWaitForSingleObject@12
828 ;ObCheckCreateObjectAccess@28
829 ;ObCheckObjectAccess@20
831 ObFindHandleForObject@20
832 ObGetObjectPointerCount@4
833 ObGetObjectSecurity@12
835 ObMakeTemporaryObject@4
836 ObOpenObjectByName@28
837 ObOpenObjectByPointer@28
839 ObQueryObjectAuditingByHandle@8
840 @ObfDereferenceObject@4
841 @ObfReferenceObject@4
842 ObReferenceObjectByHandle@24
843 ObReferenceObjectByName@32
844 ObReferenceObjectByPointer@16
845 ObReleaseObjectSecurity@8
846 ObDereferenceObject@4
847 ;ObSetSecurityDescriptorInfo@24
853 PoQueueShutdownWorkItem@4
854 PoRegisterDeviceForIdleDetection@16
855 PoRegisterSystemState@8
860 PoStartNextPowerIrp@4
861 PoUnregisterSystemState@4
864 PsAssignImpersonationToken@8
866 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
867 PsChargeProcessPagedPoolQuota@8
868 PsChargeProcessPoolQuota@12
869 PsCreateSystemProcess@12
870 PsCreateSystemThread@28
871 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
872 PsDereferencePrimaryToken@4
873 PsDisableImpersonation@8
874 PsEstablishWin32Callouts@4
875 PsGetCurrentProcess@0=KeGetCurrentProcess@0
876 PsGetCurrentProcessId@0
877 PsGetCurrentProcessSessionId@0
878 PsGetCurrentThread@0=KeGetCurrentThread@0
879 PsGetCurrentThreadId@0
880 PsGetCurrentThreadPreviousMode@0
881 PsGetCurrentThreadStackBase@0
882 PsGetCurrentThreadStackLimit@0
885 PsGetJobUIRestrictionsClass@4
886 PsGetProcessCreateTimeQuadPart@4
887 PsGetProcessDebugPort@4
888 PsGetProcessExitProcessCalled@4
889 PsGetProcessExitStatus@4
890 PsGetProcessExitTime@0
892 PsGetProcessImageFileName@4
893 PsGetProcessInheritedFromUniqueProcessId@4
896 PsGetProcessPriorityClass@4
897 PsGetProcessSectionBaseAddress@4
898 PsGetProcessSecurityPort@4
899 PsGetProcessSessionId@4
900 PsGetProcessWin32Process@4
901 PsGetProcessWin32WindowStation@4
902 PsGetThreadFreezeCount@4
903 PsGetThreadHardErrorsAreDisabled@4
906 PsGetThreadProcessId@4
907 PsGetThreadSessionId@4
909 PsGetThreadWin32Thread@4
913 PsImpersonateClient@20
914 PsInitialSystemProcess DATA
915 PsIsProcessBeingDebugged@4
917 PsIsThreadImpersonating@4
918 PsIsThreadTerminating@4
920 PsLookupProcessByProcessId@8
921 PsLookupProcessThreadByCid@12
922 PsLookupThreadByThreadId@8
924 PsReferenceImpersonationToken@16
925 PsReferencePrimaryToken@4
926 PsRemoveCreateThreadNotifyRoutine@4
927 PsRemoveLoadImageNotifyRoutine@4
928 PsRestoreImpersonation@8
930 PsReturnProcessNonPagedPoolQuota@8
931 PsReturnProcessPagedPoolQuota@8
933 PsRevertThreadToSelf@4
934 PsSetCreateProcessNotifyRoutine@8
935 PsSetCreateThreadNotifyRoutine@4
936 PsSetJobUIRestrictionsClass@8
937 PsSetLegoNotifyRoutine@4
938 PsSetProcessPriorityClass@8
939 PsSetProcessPriorityByClass@8
940 PsSetProcessSecurityPort@8
941 PsSetProcessWin32Process@8
942 PsSetProcessWindowStation@8
943 PsSetThreadHardErrorsAreDisabled@8
944 PsSetThreadWin32Thread@8
945 PsSetLoadImageNotifyRoutine@4
946 PsTerminateSystemThread@4
948 READ_REGISTER_UCHAR@4
949 READ_REGISTER_ULONG@4
950 READ_REGISTER_USHORT@4
951 READ_REGISTER_BUFFER_UCHAR@12
952 READ_REGISTER_BUFFER_ULONG@12
953 READ_REGISTER_BUFFER_USHORT@12
955 KeRosDumpStackFrames@8
956 KeRosGetStackFrames@8
957 RtlAbsoluteToSelfRelativeSD@12
958 RtlAddAccessAllowedAce@16
960 RtlAddAtomToAtomTable@12
962 ;RtlAllocateAndInitializeSid
964 RtlAnsiCharToUnicodeChar@4
965 RtlAnsiStringToUnicodeSize@4
966 RtlAnsiStringToUnicodeString@12
967 RtlAppendAsciizToString@8
968 RtlAppendStringToString@8
969 RtlAppendUnicodeStringToString@8
970 RtlAppendUnicodeToString@8
971 RtlAreAllAccessesGranted@8
972 RtlAreAnyAccessesGranted@8
977 RtlCaptureStackBackTrace@16
979 RtlCheckRegistryKey@8
984 RtlCompareMemoryUlong@12
986 RtlCompareUnicodeString@12
989 RtlConvertLongToLargeInteger@4
990 RtlConvertSidToUnicodeString@12
991 RtlConvertUlongToLargeInteger@4
996 RtlCopyUnicodeString@8
1000 RtlCreateRegistryKey@8
1001 RtlCreateSecurityDescriptor@8
1002 RtlCreateSystemVolumeInformationFolder@4
1003 RtlCreateUnicodeString@8
1004 RtlCustomCPToUnicodeN@24
1005 RtlDecompressBuffer@24
1006 RtlDecompressChunks@28
1007 RtlDecompressFragment@32
1010 RtlDeleteAtomFromAtomTable@8
1011 RtlDeleteElementGenericTable@8
1012 RtlDeleteElementGenericTableAvl@8
1014 RtlDeleteOwnersRanges@8
1016 RtlDeleteRegistryValue@12
1018 RtlDestroyAtomTable@4
1020 RtlDowncaseUnicodeString@12
1022 RtlEnlargedIntegerMultiply@8
1023 RtlEnlargedUnsignedDivide@16
1024 RtlEnlargedUnsignedMultiply@8
1025 RtlEnumerateGenericTable@8
1026 RtlEnumerateGenericTableAvl@8
1027 RtlEnumerateGenericTableLikeADirectory@28
1028 RtlEnumerateGenericTableWithoutSplaying@8
1029 RtlEnumerateGenericTableWithoutSplayingAvl@8
1033 RtlEqualUnicodeString@12
1034 RtlExtendedIntegerMultiply@12
1035 RtlExtendedLargeIntegerDivide@16
1036 RtlExtendedMagicDivide@20
1038 RtlFillMemoryUlong@12
1040 RtlFindClearBitsAndSet@12
1042 RtlFindFirstRunClear@8
1043 RtlFindFirstRunSet@8
1044 RtlFindLastBackwardRunClear@12
1045 RtlFindLeastSignificantBit@8
1046 RtlFindLongestRunClear@8
1047 RtlFindLongestRunSet@8
1049 RtlFindMostSignificantBit@8
1050 RtlFindNextForwardRunClear@12
1053 RtlFindSetBitsAndClear@12
1054 RtlFindUnicodePrefix@12
1055 RtlFormatCurrentUserKeyPath@4
1060 RtlFreeUnicodeString@4
1062 RtlGenerate8dot3Name@16
1064 RtlGetCallersAddress@8
1065 RtlGetCompressionWorkSpaceSize@12
1066 RtlGetDaclSecurityDescriptor@16
1067 RtlGetDefaultCodePage@8
1068 RtlGetElementGenericTable@8
1069 RtlGetElementGenericTableAvl@8
1071 RtlGetGroupSecurityDescriptor@12
1073 RtlGetNtGlobalFlags@0
1074 RtlGetOwnerSecurityDescriptor@12
1075 RtlGetSaclSecurityDescriptor@16
1076 RtlGetSetBootStatusData@24
1078 RtlHashUnicodeString@16
1080 RtlImageDirectoryEntryToData@16
1082 RtlInitCodePageTable@8
1084 RtlInitUnicodeString@8
1085 RtlInitializeBitMap@12
1086 RtlInitializeGenericTable@20
1087 RtlInitializeGenericTableAvl@20
1088 RtlInitializeRangeList@4
1090 RtlInitializeUnicodePrefix@4
1091 RtlInsertElementGenericTable@16
1092 RtlInsertElementGenericTableAvl@16
1093 RtlInsertElementGenericTableFull@24
1094 RtlInsertElementGenericTableFullAvl@24
1095 RtlInsertUnicodePrefix@12
1096 RtlInt64ToUnicodeString@16
1098 RtlIntegerToUnicode@16
1099 RtlIntegerToUnicodeString@12
1100 RtlInvertRangeList@8
1101 RtlIpv4AddressToStringA@8
1102 RtlIpv4AddressToStringExA@16
1103 RtlIpv4AddressToStringExW@16
1104 RtlIpv4AddressToStringW@8
1105 RtlIpv4StringToAddressA@16
1106 RtlIpv4StringToAddressExA@16
1107 RtlIpv4StringToAddressExW@16
1108 RtlIpv4StringToAddressW@16
1109 RtlIpv6AddressToStringA@8
1110 RtlIpv6AddressToStringExA@16
1111 RtlIpv6AddressToStringExW@16
1112 RtlIpv6AddressToStringW@8
1113 RtlIpv6StringToAddressA@16
1114 RtlIpv6StringToAddressExA@16
1115 RtlIpv6StringToAddressExW@16
1116 RtlIpv6StringToAddressW@16
1117 RtlIsGenericTableEmpty@4
1118 RtlIsGenericTableEmptyAvl@4
1119 RtlIsNameLegalDOS8Dot3@12
1120 RtlIsRangeAvailable@40
1121 RtlIsValidOemCharacter@4
1122 RtlLargeIntegerAdd@16
1123 RtlLargeIntegerArithmeticShift@12
1124 RtlLargeIntegerDivide@20
1125 RtlLargeIntegerNegate@8
1126 RtlLargeIntegerShiftLeft@12
1127 RtlLargeIntegerShiftRight@12
1128 RtlLargeIntegerSubtract@16
1129 RtlLengthRequiredSid@4
1130 RtlLengthSecurityDescriptor@4
1132 RtlLockBootStatusData@4
1133 RtlLookupAtomInAtomTable@12
1134 RtlLookupElementGenericTable@8
1135 RtlLookupElementGenericTableAvl@8
1136 RtlLookupElementGenericTableFull@16
1137 RtlLookupElementGenericTableFullAvl@16
1139 RtlMapSecurityErrorToNtStatus@4
1140 RtlMergeRangeLists@16
1142 RtlMultiByteToUnicodeN@20
1143 RtlMultiByteToUnicodeSize@12
1144 RtlNextUnicodePrefix@8
1145 RtlNtStatusToDosError@4
1146 RtlNtStatusToDosErrorNoTeb@4
1147 RtlNumberGenericTableElements@4
1148 RtlNumberGenericTableElementsAvl@4
1149 RtlNumberOfClearBits@4
1150 RtlNumberOfSetBits@4
1151 RtlOemStringToCountedUnicodeString@12
1152 RtlOemStringToUnicodeSize@4
1153 RtlOemStringToUnicodeString@12
1155 RtlPinAtomInAtomTable@8
1156 @RtlPrefetchMemoryNonTemporal@8
1158 RtlPrefixUnicodeString@12
1159 RtlQueryAtomInAtomTable@24
1160 RtlQueryRegistryValues@20
1161 RtlQueryTimeZoneInformation@4
1165 RtlRealPredecessor@4
1167 RtlRemoveUnicodePrefix@8
1169 RtlSecondsSince1970ToTime@8
1170 RtlSecondsSince1980ToTime@8
1171 RtlSelfRelativeToAbsoluteSD2@8
1172 RtlSelfRelativeToAbsoluteSD@44
1176 RtlSetDaclSecurityDescriptor@16
1177 RtlSetGroupSecurityDescriptor@12
1178 RtlSetOwnerSecurityDescriptor@12
1179 RtlSetSaclSecurityDescriptor@16
1180 RtlSetTimeZoneInformation@4
1184 RtlSubAuthorityCountSid@4
1185 RtlSubAuthoritySid@8
1186 RtlSubtreePredecessor@4
1187 RtlSubtreeSuccessor@4
1189 RtlTimeFieldsToTime@8
1190 RtlTimeToElapsedTimeFields@8
1191 RtlTimeToSecondsSince1970@8
1192 RtlTimeToSecondsSince1980@8
1193 RtlTimeToTimeFields@8
1195 @RtlUlonglongByteSwap@8
1196 RtlUnicodeStringToAnsiSize@4
1197 RtlUnicodeStringToAnsiString@12
1198 RtlUnicodeStringToCountedOemString@12
1199 RtlUnicodeStringToInteger@12
1200 RtlUnicodeStringToOemSize@4
1201 RtlUnicodeStringToOemString@12
1202 RtlUnicodeToCustomCPN@24
1203 RtlUnicodeToMultiByteN@20
1204 RtlUnicodeToMultiByteSize@12
1206 RtlUnlockBootStatusData@4
1208 RtlUpcaseUnicodeChar@4
1209 RtlUpcaseUnicodeString@12
1210 RtlUpcaseUnicodeStringToAnsiString@12
1211 RtlUpcaseUnicodeStringToCountedOemString@12
1212 RtlUpcaseUnicodeStringToOemString@12
1213 RtlUpcaseUnicodeToCustomCPN@24
1214 RtlUpcaseUnicodeToMultiByteN@20
1215 RtlUpcaseUnicodeToOemN@20
1218 @RtlUshortByteSwap@4
1219 RtlValidRelativeSecurityDescriptor@12
1220 RtlValidSecurityDescriptor@4
1222 RtlVerifyVersionInfo@16
1223 RtlVolumeDeviceToDosName@8
1224 RtlWalkFrameChain@12
1225 RtlWriteRegistryValue@24
1228 RtlxAnsiStringToUnicodeSize@4
1229 RtlxOemStringToUnicodeSize@4
1230 RtlxUnicodeStringToAnsiSize@4
1231 RtlxUnicodeStringToOemSize@4
1233 SeAppendPrivileges@8
1235 SeAssignSecurityEx@36
1236 SeAuditHardLinkCreation@12
1237 SeAuditingFileEvents@8
1238 SeAuditingFileEventsWithContext@12
1239 SeAuditingFileOrGlobalEvents@12
1240 SeAuditingHardLinkEvents@8
1241 SeAuditingHardLinkEventsWithContext@12
1242 SeCaptureSecurityDescriptor@20
1243 SeCaptureSubjectContext@4
1244 SeCloseObjectAuditAlarm@12
1245 SeCreateAccessState@16
1246 SeCreateClientSecurity@16
1247 SeCreateClientSecurityFromSubjectContext@16
1248 SeDeassignSecurity@4
1249 SeDeleteAccessState@4
1250 SeDeleteObjectAuditAlarm@8
1254 SeImpersonateClient@8
1255 SeImpersonateClientEx@8
1256 SeLockSubjectContext@4
1257 SeMarkLogonSessionForTerminationNotification@4
1258 SeOpenObjectAuditAlarm@36
1259 SeOpenObjectForDeleteAuditAlarm@36
1261 SePrivilegeObjectAuditAlarm@24
1262 SePublicDefaultDacl DATA
1263 SeQueryAuthenticationIdToken@8
1264 SeQueryInformationToken@12
1265 SeQuerySecurityDescriptorInfo@16
1266 SeQuerySessionIdToken@8
1267 SeRegisterLogonSessionTerminatedRoutine@4
1268 SeReleaseSecurityDescriptor@12
1269 SeReleaseSubjectContext@4
1270 SeSetAccessStateGenericMapping@8
1271 SeSetSecurityDescriptorInfo@24
1272 SeSetSecurityDescriptorInfoEx@28
1273 SeSinglePrivilegeCheck@12
1274 SeSystemDefaultDacl DATA
1275 SeTokenImpersonationLevel@4
1277 SeTokenIsRestricted@4
1278 SeTokenIsWriteRestricted@4
1280 SeUnlockSubjectContext@4
1281 SeUnregisterLogonSessionTerminatedRoutine@4
1282 SeValidSecurityDescriptor@8
1283 VerSetConditionMask@16
1284 WRITE_REGISTER_UCHAR@8
1285 WRITE_REGISTER_ULONG@8
1286 WRITE_REGISTER_USHORT@8
1287 WRITE_REGISTER_BUFFER_UCHAR@12
1288 WRITE_REGISTER_BUFFER_ULONG@12
1289 WRITE_REGISTER_BUFFER_USHORT@12
1290 ZwAccessCheckAndAuditAlarm@44
1292 ZwAdjustPrivilegesToken@24
1294 ZwAllocateVirtualMemory@24
1295 ZwAssignProcessToJobObject@8
1300 ZwCloseObjectAuditAlarm@12
1302 ZwCreateDirectoryObject@12
1305 ZwCreateJobObject@12
1308 ZwCreateSymbolicLinkObject@16
1314 ZwDeviceIoControlFile@40
1316 ZwDuplicateObject@28
1318 ZwEnumerateBootEntries@8
1320 ZwEnumerateValueKey@24
1321 ZwFlushInstructionCache@12
1323 ZwFlushVirtualMemory@16
1324 ZwFreeVirtualMemory@16
1326 ZwInitiatePowerAction@16
1330 ZwMakeTemporaryObject@4
1331 ZwMapViewOfSection@40
1332 ZwNotifyChangeKey@40
1333 ZwOpenDirectoryObject@12
1339 ZwOpenProcessToken@12
1340 ZwOpenProcessTokenEx@16
1342 ZwOpenSymbolicLinkObject@12
1344 ZwOpenThreadToken@16
1345 ZwOpenThreadTokenEx@20
1347 ZwPowerInformation@20
1349 ZwQueryBootEntryOrder@8
1350 ZwQueryBootOptions@8
1351 ZwQueryDefaultLocale@8
1352 ZwQueryDefaultUILanguage@4
1353 ZwQueryDirectoryFile@44
1354 ZwQueryDirectoryObject@28
1356 ZwQueryFullAttributesFile@8
1357 ZwQueryInformationAtom@20
1358 ZwQueryInformationFile@20
1359 ZwQueryInformationJobObject@20
1360 ZwQueryInformationProcess@20
1361 ZwQueryInformationThread@20
1362 ZwQueryInformationToken@20
1363 ZwQueryInstallUILanguage@4
1367 ZwQuerySecurityObject@20
1368 ZwQuerySymbolicLinkObject@12
1369 ZwQuerySystemInformation@16
1372 ZwQueryVolumeInformationFile@20
1375 ZwRequestWaitReplyPort@12
1380 ZwSetBootEntryOrder@8
1382 ZwSetDefaultLocale@8
1383 ZwSetDefaultUILanguage@4
1386 ZwSetInformationFile@20
1387 ZwSetInformationJobObject@16
1388 ZwSetInformationObject@16
1389 ZwSetInformationProcess@16
1390 ZwSetInformationThread@16
1391 ZwSetSecurityObject@12
1392 ZwSetSystemInformation@12
1396 ZwSetVolumeInformationFile@20
1397 ZwTerminateJobObject@8
1398 ZwTerminateProcess@8
1399 ZwTranslateFilePath@12
1402 ZwUnmapViewOfSection@8
1403 ZwWaitForMultipleObjects@20
1404 ZwWaitForSingleObject@12
1407 _abnormal_termination