1 ; $Id: ntoskrnl.def,v 1.205 2004/12/21 04:05:18 royce Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
18 CcGetFileObjectFromBcb@4
19 CcGetFileObjectFromSectionPtrs@4
20 CcGetFlushedValidData@8
21 CcGetLsnForFileObject@8
22 CcInitializeCacheMap@20
24 CcFastMdlReadWait DATA
25 CcFastReadNotPossible DATA
36 CcPurgeCacheSection@16
39 CcScheduleReadAhead@12
40 CcSetAdditionalCacheAttributes@12
41 CcSetBcbOwnerPointer@8
42 CcSetDirtyPageThreshold@8
43 CcSetDirtyPinnedData@8
44 CcSetLogHandleForFile@12
45 CcSetReadAheadGranularity@8
46 CcUninitializeCacheMap@12
48 CcUnpinDataForThread@8
50 CcWaitForCurrentLazyWriterActivity@0
55 CmUnRegisterCallback@8
57 DbgBreakPointWithStatus@4
58 DbgLoadImageSymbols@12
62 DbgPrintReturnControlC
63 DbgQueryDebugFilterState@8
64 DbgSetDebugFilterState@12
65 @ExAcquireFastMutexUnsafe@4
66 ExAcquireResourceExclusive@8
67 ExAcquireResourceExclusiveLite@8
68 ExAcquireResourceSharedLite@8
69 @ExAcquireRundownProtection@4
70 @ExAcquireRundownProtectionEx@8
71 ExAcquireSharedStarveExclusive@8
72 ExAcquireSharedWaitForExclusive@8
73 @ExAllocateFromPagedLookasideList@4=@ExiAllocateFromPagedLookasideList@4
75 ExAllocatePoolWithQuota@8
76 ExAllocatePoolWithQuotaTag@12
77 ExAllocatePoolWithTag@12
78 ExAllocatePoolWithTagPriority@16
79 ExConvertExclusiveToSharedLite@4
81 ExDeleteNPagedLookasideList@4
82 ExDeletePagedLookasideList@4
84 ExDeleteResourceLite@4
85 ExDesktopObjectType DATA
86 ExDisableResourceBoostLite@4
88 ExEventObjectType DATA
92 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
93 ExGetCurrentProcessorCounts@12
94 ExGetCurrentProcessorCpuUsage@4
95 ExGetExclusiveWaiterCount@4
97 ExGetSharedWaiterCount@4
98 @ExInitializeRundownProtection@4
99 ExInitializeNPagedLookasideList@28
100 ExInitializePagedLookasideList@28
101 ExInitializeResource@4
102 ExInitializeResourceLite@4
104 ExInterlockedAddLargeInteger@16
105 @ExInterlockedAddLargeStatistic@8
106 ExInterlockedAddUlong@12
107 @ExInterlockedCompareExchange64@16
108 ExInterlockedDecrementLong@8
109 ExInterlockedExchangeUlong@12
110 ExInterlockedExtendZone@16
111 ExInterlockedIncrementLong@8
112 @ExInterlockedFlushSList@4
113 ExInterlockedInsertHeadList@12
114 ExInterlockedInsertTailList@12
115 ExInterlockedPopEntryList@8
116 @ExInterlockedPopEntrySList@8
117 ExInterlockedPushEntryList@12
118 @ExInterlockedPushEntrySList@12
119 ExInterlockedRemoveHeadList@8
120 ExIsProcessorFeaturePresent@4
121 ExIsResourceAcquiredExclusiveLite@4
122 ExIsResourceAcquiredSharedLite@4
123 ExLocalTimeToSystemTime@8
126 ExQueryPoolBlockSize@8
128 ExRaiseAccessViolation@0
129 ExRaiseDatatypeMisalignment@0
133 ExRegisterCallback@12
134 ExReinitializeResourceLite@4
135 @ExReInitializeRundownProtection@4
136 @ExReleaseFastMutexUnsafe@4
137 ExReleaseResourceForThread@8
138 ExReleaseResourceForThreadLite@8
139 @ExReleaseResourceLite@4
140 @ExReleaseRundownProtection@4
141 @ExReleaseRundownProtectionEx@8
142 ExRosDumpPagedPoolByTag@4
144 @ExRundownCompleted@4
145 ExSetResourceOwnerPointer@8
146 ExSetTimerResolution@8
147 ExSystemExceptionFilter@0
148 ExSystemTimeToLocalTime@8
149 ExTryToAcquireResourceExclusiveLite@4
150 ExUnregisterCallback@4
153 @ExWaitForRundownProtectionRelease@4
154 ExWindowStationObjectType DATA
155 ExInitializeBinaryTree@12
157 ExInsertBinaryTree@12
158 ExSearchBinaryTree@12
159 ExRemoveBinaryTree@12
160 ExTraverseBinaryTree@16
161 ExInitializeSplayTree@16
166 ExWeightOfSplayTree@8
167 ExTraverseSplayTree@16
168 ExInitializeHashTable@16
173 @ExfAcquirePushLockExclusive@4
174 @ExfAcquirePushLockShared@4
175 @ExfReleasePushLock@4
176 @ExfInterlockedAddUlong@12
177 @ExfInterlockedInsertHeadList@12
178 @ExfInterlockedInsertTailList@12
179 @ExfInterlockedCompareExchange64@12
180 @ExfInterlockedPopEntryList@8
181 @ExfInterlockedPushEntryList@12
182 @ExfInterlockedRemoveHeadList@8
183 @Exfi386InterlockedDecrementLong@4
184 @Exfi386InterlockedExchangeUlong@8
185 @Exfi386InterlockedIncrementLong@4
186 Exi386InterlockedDecrementLong@4
187 Exi386InterlockedExchangeUlong@8
188 Exi386InterlockedIncrementLong@4
189 FsRtlAcquireFileExclusive@4
190 FsRtlAddLargeMcbEntry@28
192 FsRtlAddToTunnelCache@32
193 FsRtlAllocateFileLock@8
195 FsRtlAllocatePoolWithQuota@8
196 FsRtlAllocatePoolWithQuotaTag@12
197 FsRtlAllocatePoolWithTag@12
198 FsRtlAllocateResource@0
199 FsRtlAreNamesEqual@16
201 FsRtlCheckLockForReadAccess@8
202 FsRtlCheckLockForWriteAccess@8
206 FsRtlCurrentBatchOplock@4
207 FsRtlDeleteKeyFromTunnelCache@12
208 FsRtlDeleteTunnelCache@4
209 FsRtlDeregisterUncProvider@4
212 FsRtlDoesDbcsContainWildCards@4
213 FsRtlDoesNameContainWildCards@4
214 FsRtlFastCheckLockForRead@24
215 FsRtlFastCheckLockForWrite@24
216 FsRtlFastUnlockAll@16
217 FsRtlFastUnlockAllByKey@20
218 FsRtlFastUnlockSingle@32
219 FsRtlFindInTunnelCache@32
222 FsRtlGetNextFileLock@8
223 FsRtlGetNextLargeMcbEntry@20
224 FsRtlGetNextMcbEntry@20
225 FsRtlIncrementCcFastReadNotPossible@0
226 FsRtlIncrementCcFastReadNoWait@0
227 FsRtlIncrementCcFastReadResourceMiss@0
228 FsRtlIncrementCcFastReadWait@0
229 FsRtlInitializeFileLock@12
230 FsRtlInitializeLargeMcb@8
232 FsRtlInitializeOplock@4
233 FsRtlInitializeTunnelCache@4
234 FsRtlInsertPerFileObjectContext@8
235 FsRtlInsertPerStreamContext@8
236 FsRtlIsDbcsInExpression@8
237 FsRtlIsFatDbcsLegal@20
238 FsRtlIsHpfsDbcsLegal@20
239 FsRtlIsNameInExpression@16
240 FsRtlIsNtstatusExpected@4
242 FsRtlIsTotalDeviceFailure@4
243 FsRtlLegalAnsiCharacterArray DATA
244 FsRtlLookupLargeMcbEntry@32
245 FsRtlLookupLastLargeMcbEntry@12
246 FsRtlLookupLastLargeMcbEntryAndIndex@16
247 FsRtlLookupLastMcbEntry@12
248 FsRtlLookupMcbEntry@20
249 FsRtlLookupPerFileObjectContext@12
250 FsRtlLookupPerStreamContextInternal@12
252 FsRtlMdlReadComplete@8
253 FsRtlMdlReadCompleteDev@12
255 FsRtlMdlWriteComplete@12
256 FsRtlMdlWriteCompleteDev@16
257 FsRtlNormalizeNtstatus@8
258 FsRtlNotifyChangeDirectory@28
259 FsRtlNotifyCleanup@12
260 FsRtlNotifyFilterChangeDirectory@44
261 FsRtlNotifyFilterReportChange@40
262 FsRtlNotifyFullChangeDirectory@40
263 FsRtlNotifyFullReportChange@36
264 FsRtlNotifyInitializeSync@4
265 FsRtlNotifyReportChange@20
266 FsRtlNotifyUninitializeSync@4
267 FsRtlNotifyVolumeEvent@8
268 FsRtlNumberOfRunsInLargeMcb@4
269 FsRtlNumberOfRunsInMcb@4
271 FsRtlOplockIsFastIoPossible@4
272 FsRtlPostPagingFileStackOverflow@12
273 FsRtlPostStackOverflow@12
274 FsRtlPrepareMdlWrite@24
275 FsRtlPrepareMdlWriteDev@28
277 FsRtlProcessFileLock@12
278 FsRtlRegisterUncProvider@12
280 FsRtlRemoveLargeMcbEntry@20
281 FsRtlRemoveMcbEntry@12
282 FsRtlRemovePerFileObjectContext@12
283 FsRtlRemovePerStreamContext@12
285 FsRtlSplitLargeMcb@20
287 FsRtlTeardownPerStreamContexts@4
288 FsRtlTruncateLargeMcb@12
290 FsRtlUninitializeFileLock@4
291 FsRtlUninitializeLargeMcb@4
292 FsRtlUninitializeMcb@4
293 FsRtlUninitializeOplock@4
294 HalDispatchTable DATA
295 HalPrivateDispatchTable DATA
296 @HalExamineMBR=@xHalExamineMBR@16
297 InbvAcquireDisplayOwnership@0
298 InbvCheckDisplayOwnership@0
300 InbvEnableBootDriver@4
301 InbvEnableDisplayString@4
302 InbvInstallDisplayStringFilter@4
303 InbvIsBootDriverInstalled@0
304 InbvNotifyDisplayOwnershipLost@4
306 InbvSetScrollRegion@16
308 InbvSolidColorFill@20
309 InitSafeBootMode DATA
310 @InterlockedCompareExchange@12
311 @InterlockedDecrement@4
312 @InterlockedExchange@8
313 @InterlockedExchangeAdd@8
314 @InterlockedIncrement@4
315 @InterlockedPushEntrySList@8
316 @InterlockedPopEntrySList@4
317 IoAcquireCancelSpinLock@4
318 IoAcquireRemoveLockEx@20
319 IoAcquireVpbSpinLock@4
320 IoAdapterObjectType DATA
321 IoAllocateAdapterChannel@20
324 IoAllocateController@16
325 IoAllocateDriverObjectExtension@16
326 IoAllocateErrorLogEntry@8
328 IoAssignDriveLetters@16
331 IoAttachDeviceByPointer@8
332 IoAttachDeviceToDeviceStack@8
333 IoAttachDeviceToDeviceStackSafe@12
334 IoBuildAsynchronousFsdRequest@24
335 IoBuildDeviceIoControlRequest@36
337 IoBuildSynchronousFsdRequest@28
341 IoCheckDesiredAccess@8
342 IoCheckEaBufferValidity@12
343 IoCheckFunctionAccess@24
344 IoCheckQuerySetFileInformation@12
345 IoCheckQuerySetVolumeInformation@12
346 IoCheckQuotaBufferValidity@12
347 IoCheckShareAccess@20
349 IoConnectInterrupt@44
355 IoCreateFileSpecifyDeviceObjectHint@60
356 IoCreateNotificationEvent@8
357 IoCreateStreamFileObject@8
358 IoCreateStreamFileObjectEx@12
359 IoCreateStreamFileObjectLite@8
360 IoCreateSymbolicLink@8
361 IoCreateSynchronizationEvent@8
362 IoCreateUnprotectedSymbolicLink@8
372 IoDeleteSymbolicLink@4
374 IoDeviceHandlerObjectSize DATA
375 IoDeviceHandlerObjectType DATA
376 IoDeviceObjectType DATA
377 IoDisconnectInterrupt@4
378 IoDriverObjectType DATA
380 IoEnumerateDeviceObjectList@16
381 IoFastQueryNetworkAttributes@20
382 IoFileObjectType DATA
383 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
384 IoForwardIrpSynchronously@8
386 IoFreeErrorLogEntry@4
390 IoGetAttachedDevice@4
391 IoGetAttachedDeviceReference@4
392 IoGetBaseFileSystemDeviceObject@4
393 IoGetBootDiskInformation@8
394 IoGetConfigurationInformation@0
395 IoGetCurrentProcess@0
396 IoGetDeviceObjectPointer@16
397 IoGetDeviceAttachmentBaseRef@4
398 IoGetDeviceInterfaceAlias@12
399 IoGetDeviceInterfaces@16
400 IoGetDriverObjectExtension@8
401 IoGetDeviceProperty@20
402 IoGetDeviceToVerify@4
403 IoGetDiskDeviceObject@8
405 IoGetFileObjectGenericMapping@0
407 IoGetLowerDeviceObject@4
408 IoGetRelatedDeviceObject@4
409 IoGetRequestorProcess@4
410 IoGetRequestorProcessId@4
411 IoGetRequestorSessionId@8
415 IoInvalidateDeviceRelations@8
416 IoInvalidateDeviceState@4
417 IoInitializeRemoveLockEx@20
419 IoIsFileOriginRemote@4
421 IoIsValidNameGraftingBuffer@8
422 IoIsOperationSynchronous@4
423 IoMakeAssociatedIrp@8
424 IoOpenDeviceInstanceKey@20
425 IoOpenDeviceInterfaceRegistryKey@12
426 IoOpenDeviceRegistryKey@16
428 IoPnPDeliverServicePowerNotification@16
429 IoQueryDeviceDescription@32
430 IoQueryDeviceEnumInfo@8
431 IoQueryFileDosDeviceName@8
432 IoQueryFileInformation@20
433 IoQueryVolumeInformation@20
437 IoRaiseInformationalHardError@12
438 IoReadDiskSignature@12
439 IoReadOperationCount DATA
440 @IoReadPartitionTable@16
441 IoReadPartitionTableEx@8
442 IoReadTransferCount DATA
443 IoRegisterBootDriverReinitialization@12
444 IoRegisterDeviceInterface@16
445 IoRegisterDriverReinitialization@12
446 IoRegisterFileSystem@4
447 IoRegisterFsRegistrationChange@8
448 IoRegisterLastChanceShutdownNotification@4
449 IoRegisterPlugPlayNotification@28
450 IoRegisterShutdownNotification@4
451 IoReleaseCancelSpinLock@4
452 IoReleaseRemoveLockAndWaitEx@12
453 IoReleaseRemoveLockEx@12
454 IoReleaseVpbSpinLock@4
455 IoRemoveShareAccess@8
456 IoReportDetectedDevice@32
457 IoReportHalResourceUsage@16
458 IoReportResourceUsage@36
459 IoReportResourceForDetection@28
460 IoReportTargetDeviceChange@8
461 IoReportTargetDeviceChangeAsynchronous@16
462 IoRequestDeviceEject@4
464 IoSetCompletionRoutineEx@28
465 IoSetSystemPartition@4
466 IoSetDeviceInterfaceState@8
467 IoSetDeviceToVerify@8
469 IoSetHardErrorOrVerifyDevice@8
472 @IoSetPartitionInformation@16
473 IoSetPartitionInformationEx@12
474 IoSetStartIoAttributes@12
476 IoSetThreadHardErrorMode@4
479 IoStartNextPacketByKey@12
482 IoStatisticsLock DATA
484 IoSynchronousPageWrite@20
485 IoSynchronousInvalidateDeviceRelations@8
487 IoUnregisterFileSystem@4
488 IoUnregisterFsRegistrationChange@8
489 IoUnregisterPlugPlayNotification@4
490 IoUnregisterShutdownNotification@4
491 IoUpdateShareAccess@8
492 IoValidateDeviceIoControlAccess@8
493 IoVerifyPartitionTable@8
495 IoVolumeDeviceToDosName@8
496 IoWMIAllocateInstanceIds@12
497 IoWMIDeviceObjectToInstanceName@12
498 IoWMIExecuteMethod@24
499 IoWMIHandleToInstanceName@12
502 IoWMIQueryAllDataMultiple@16
503 IoWMIQuerySingleInstance@16
504 IoWMIQuerySingleInstanceMultiple@20
505 IoWMIRegistrationControl@8
506 IoWMISetNotificationCallback@12
507 IoWMISetSingleInstance@20
508 IoWMISetSingleItem@24
509 IoWMISuggestInstanceName@16
511 IoWriteErrorLogEntry@4
512 IoWriteOperationCount DATA
513 @IoWritePartitionTable@20
514 IoWritePartitionTableEx@8
515 IoWriteTransferCount DATA
517 @IofCompleteRequest@8
518 IoIsWdmVersionAvailable@8
519 KdDebuggerEnabled DATA
520 KdDebuggerNotPresent DATA
526 KdSystemDebugControl@4
528 Ke386IoSetAccessProcess@8
529 Ke386QueryIoAccessMap@8
530 Ke386SetIoAccessMap@8
531 KeAcquireSpinLockAtDpcLevel@4
532 KeAcquireDispatcherDatabaseLockAtDpcLevel
533 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
534 KeAcquireInterruptSpinLock@4
535 KeAddSystemServiceTable@20
538 ;KeBoostCurrentThread
542 KeCapturePersistentThreadState@28
545 KeDcacheFlushCount DATA
546 KeDelayExecutionThread@12
547 KeDeregisterBugCheckCallback@4
548 KeDeregisterBugCheckReasonCallback@4
550 KeDisconnectInterrupt@4
551 KeEnterCriticalRegion@0
552 KeEnterKernelDebugger@0
553 KeFindConfigurationEntry@16
554 KeFindConfigurationNextEntry@20
559 KeGetRecommendedSharedDataAlignment@0
561 KeI386AllocateGdtSelectors
562 ;KeI386Call16BitCStyleFunction
563 ;KeI386Call16BitFunction
564 KeI386FlatToGdtSelector
566 ;KeI386MachineType DATA
567 KeI386ReleaseGdtSelectors
569 ;KeI386SetGdtSelector
570 KeIcacheFlushCount DATA
572 KeInitializeDeviceQueue@4
575 KeInitializeInterrupt@44
579 KeInitializeSemaphore@12
580 KeInitializeSpinLock@4
582 KeInitializeTimerEx@8
583 KeInsertByKeyDeviceQueue@12
584 KeInsertDeviceQueue@8
589 KeIsAttachedProcess@0
591 KeLeaveCriticalRegion@0
593 KeNumberProcessors DATA
595 KeProfileInterruptWithSource@8
597 KeQueryActiveProcessors@0
598 KeQueryInterruptTime@0
599 KeQueryPriorityThread@4
600 KeQueryRuntimeThread@8
603 KeQueryTimeIncrement@0
604 KeRaiseUserException@4
609 KeReadStateSemaphore@4
611 KeRegisterBugCheckCallback@20
612 KeRegisterBugCheckReasonCallback@16
613 KeReleaseDispatcherDatabaseLockFromDpcLevel
614 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
615 KeReleaseInterruptSpinLock@8
618 KeReleaseSemaphore@16
619 KeReleaseSpinLockFromDpcLevel@4
620 KeRemoveByKeyDeviceQueue@8
621 KeRemoveByKeyDeviceQueueIfBusy@8
622 KeRemoveDeviceQueue@4
623 KeRemoveEntryDeviceQueue@8
626 KeRemoveSystemServiceTable@4
628 KeRestoreFloatingPointState@4
629 KeRevertToUserAffinityThread@0
631 KeSaveFloatingPointState@4
632 KeSaveStateForHibernate
633 KeServiceDescriptorTable DATA
634 KeSetAffinityThread@8
635 KeSetBasePriorityThread@8
636 KeSetDmaIoCoherency@4
638 KeSetEventBoostPriority@8
639 KeSetIdealProcessorThread@8
641 KeSetKernelStackSwapEnable@4
642 KeSetPriorityThread@8
644 KeSetSystemAffinityThread@4
645 ;KeSetSwapContextNotifyRoutine
646 KeSetTargetProcessorDpc@8
647 ;KeSetThreadSelectNotifyRoutine
651 @KeSetTimeUpdateNotifyRoutine@4
652 KeStackAttachProcess@8
653 KeSynchronizeExecution@12
658 KeUnstackDetachProcess@4
659 KeUserModeCallback@20
660 KeWaitForMultipleObjects@32
661 KeWaitForMutexObject@20
662 KeWaitForSingleObject@20
663 @KefAcquireSpinLockAtDpcLevel@4
664 @KefReleaseSpinLockFromDpcLevel@4
670 KiDispatchInterrupt@0
671 KiEnableTimerWatchdog
672 KiInterruptDispatch2@8
673 KiIpiServiceRoutine@8
675 KiUnexpectedInterrupt@0
676 ;Kii386SpinOnSpinLock
680 LdrFindResourceDirectory_U@16
683 LpcRequestWaitReplyPort@12
684 LsaCallAuthenticationPackage@28
685 LsaDeregisterLogonProcess@8
686 LsaFreeReturnBuffer@4
688 LsaLookupAuthenticationPackage@12
689 LsaRegisterLogonProcess@12
690 Mm64BitPhysicalAddress DATA
691 MmAddPhysicalMemory@8
692 MmAddVerifierThunks@8
693 MmAdjustWorkingSetSize@12
695 MmAllocateContiguousAlignedMemory@36
696 MmAllocateContiguousMemory@12
697 MmAllocateContiguousMemorySpecifyCache@32
698 MmAllocateMappingAddress@8
699 MmAllocateNonCachedMemory@4
700 MmAllocatePagesForMdl@28
701 MmBuildMdlForNonPagedPool@4
702 MmCanFileBeTruncated@8
707 MmDbgTranslatePhysicalAddress@8
708 MmDisableModifiedWriteOfSection@4
709 MmFlushImageSection@8
710 MmForceSectionClosed@8
711 MmFreeContiguousMemory@4
712 MmFreeContiguousMemorySpecifyCache@12
713 MmFreeMappingAddress@8
714 MmFreeNonCachedMemory@8
716 MmGetPhysicalAddress@4
717 MmGetPhysicalMemoryRanges@0
718 MmGetSystemRoutineAddress@4
719 MmGetVirtualForPhysical@8
721 MmHighestUserAddress DATA
723 MmIsDriverVerifying@4
724 MmIsNonPagedSystemAddressValid@4
725 MmIsRecursiveIoFault@0
726 MmIsThisAnNtAsSystem@0
727 MmIsVerifierEnabled@4
728 MmLockPagableDataSection@4
729 MmLockPagableImageSection@4=MmLockPagableDataSection@4
730 MmLockPagableSectionByHandle@4
733 MmMapLockedPagesSpecifyCache@24
734 MmMapLockedPagesWithReservedMapping@16
736 MmMapUserAddressesToPage@12
738 MmMapViewInSessionSpace@12
739 MmMapViewInSystemSpace@12
740 MmMapViewOfSection@40
741 MmMarkPhysicalMemoryAsBad@8
742 MmMarkPhysicalMemoryAsGood@8
745 MmProbeAndLockPages@12
746 MmProbeAndLockProcessPages@16
747 MmProbeAndLockSelectedPages@16
748 MmProtectMdlSystemAddress@8
750 MmRemovePhysicalMemory@8
751 MmResetDriverPaging@4
752 MmSectionObjectType DATA
753 MmSecureVirtualMemory@12
754 MmSetAddressRangeModified@8
755 MmSetBankedSection@24
757 MmSystemRangeStart DATA
758 MmTrimAllSystemPagableMemory@4
759 MmUnlockPagableImageSection@4
763 MmUnmapReservedMapping@12
764 MmUnmapVideoDisplay@8
765 MmUnmapViewInSessionSpace@4
766 MmUnmapViewInSystemSpace@4
767 MmUnmapViewOfSection@8
768 MmUnsecureVirtualMemory@4
769 MmUserProbeAddress DATA
772 NlsMbCodePageTag DATA
773 NlsMbOemCodePageTag DATA
774 NlsOemLeadByteInfo DATA
776 NtAdjustPrivilegesToken@24
778 NtAllocateLocallyUniqueId@4
780 NtAllocateVirtualMemory@24
791 NtDeviceIoControlFile@40
795 NtFreeVirtualMemory@16
799 NtMakePermanentObject@4
800 NtMapViewOfSection@40
801 NtNotifyChangeDirectoryFile@36
804 NtOpenProcessToken@12
805 NtOpenProcessTokenEx@16
808 NtOpenThreadTokenEx@20
809 NtQueryDirectoryFile@44
811 NtQueryInformationAtom@20
812 NtQueryInformationFile@20
813 NtQueryInformationProcess@20
814 NtQueryInformationThread@20
815 NtQueryInformationToken@20
816 ;NtQueryOleDirectoryFile@44 <--- ?
817 NtQueryQuotaInformationFile@36
818 NtQuerySecurityObject@20
819 NtQuerySystemInformation@16
821 NtQueryVolumeInformationFile@20
824 NtRequestWaitReplyPort@12
827 NtSetInformationFile@20
828 NtSetInformationProcess@16
829 NtSetInformationThread@16
830 NtSetQuotaInformationFile@16
831 NtSetSecurityObject@12
832 NtSetVolumeInformationFile@20
839 NtWaitForSingleObject@12
842 ;ObCheckCreateObjectAccess@28
843 ;ObCheckObjectAccess@20
845 ObFindHandleForObject@20
846 ObGetObjectPointerCount@4
847 ObGetObjectSecurity@12
849 ObMakeTemporaryObject@4
850 ObOpenObjectByName@28
851 ObOpenObjectByPointer@28
853 ObQueryObjectAuditingByHandle@8
854 @ObfDereferenceObject@4
855 @ObfReferenceObject@4
856 ObReferenceObjectByHandle@24
857 ObReferenceObjectByName@32
858 ObReferenceObjectByPointer@16
859 ObReleaseObjectSecurity@8
860 ObDereferenceObject@4
861 ;ObSetSecurityDescriptorInfo@24
867 PoRegisterDeviceForIdleDetection@16
868 PoRegisterSystemState@8
873 PoStartNextPowerIrp@4
874 PoUnregisterSystemState@4
877 PsAssignImpersonationToken@8
879 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
880 PsChargeProcessPagedPoolQuota@8
881 PsChargeProcessPoolQuota@12
882 PsCreateSystemProcess@12
883 PsCreateSystemThread@28
884 PsCreateWin32Process@4
885 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
886 PsDereferencePrimaryToken@4
887 PsDisableImpersonation@8
888 PsEstablishWin32Callouts@24
889 PsGetCurrentProcessId@0
890 PsGetCurrentProcessSessionId@0
891 PsGetCurrentThreadId@0
892 PsGetCurrentThreadPreviousMode@0
893 PsGetCurrentThreadStackBase@0
894 PsGetCurrentThreadStackLimit@0
897 PsGetJobUIRestrictionsClass@4
898 PsGetProcessCreateTimeQuadPart@4
899 PsGetProcessDebugPort@4
900 PsGetProcessExitProcessCalled@4
901 PsGetProcessExitStatus@4
902 PsGetProcessExitTime@0
904 PsGetProcessImageFileName@4
905 PsGetProcessInheritedFromUniqueProcessId@4
908 PsGetProcessPriorityClass@4
909 PsGetProcessSectionBaseAddress@4
910 PsGetProcessSecurityPort@4
911 PsGetProcessSessionId@4
912 PsGetProcessWin32Process@4
913 PsGetProcessWin32WindowStation@4
914 PsGetThreadFreezeCount@4
915 PsGetThreadHardErrorsAreDisabled@4
918 PsGetThreadProcessId@4
919 PsGetThreadSessionId@4
921 PsGetThreadWin32Thread@4
925 PsImpersonateClient@20
926 PsInitialSystemProcess DATA
927 PsIsProcessBeingDebugged@4
929 PsIsThreadImpersonating@4
930 PsIsThreadTerminating@4
932 PsLookupProcessByProcessId@8
933 PsLookupProcessThreadByCid@12
934 PsLookupThreadByThreadId@8
936 PsReferenceImpersonationToken@16
937 PsReferencePrimaryToken@4
938 PsRemoveCreateThreadNotifyRoutine@4
939 PsRemoveLoadImageNotifyRoutine@4
940 PsRestoreImpersonation@8
942 PsReturnProcessNonPagedPoolQuota@8
943 PsReturnProcessPagedPoolQuota@8
945 PsRevertThreadToSelf@4
946 PsSetCreateProcessNotifyRoutine@8
947 PsSetCreateThreadNotifyRoutine@4
948 PsSetJobUIRestrictionsClass@8
949 PsSetLegoNotifyRoutine@4
950 PsSetProcessPriorityClass@8
951 PsSetProcessSecurityPort@8
952 PsSetProcessWin32Process@8
953 PsSetProcessWin32WindowStation@8
954 PsSetThreadHardErrorsAreDisabled@8
955 PsSetThreadWin32Thread@8
956 PsSetLoadImageNotifyRoutine@4
957 PsTerminateSystemThread@4
959 READ_REGISTER_UCHAR@4
960 READ_REGISTER_ULONG@4
961 READ_REGISTER_USHORT@4
962 READ_REGISTER_BUFFER_UCHAR@12
963 READ_REGISTER_BUFFER_ULONG@12
964 READ_REGISTER_BUFFER_USHORT@12
966 KeRosDumpStackFrames@8
967 KeRosGetStackFrames@8
968 RtlAbsoluteToSelfRelativeSD@12
969 RtlAddAccessAllowedAce@16
971 RtlAddAtomToAtomTable@12
973 ;RtlAllocateAndInitializeSid
975 RtlAnsiCharToUnicodeChar@4
976 RtlAnsiStringToUnicodeSize@4
977 RtlAnsiStringToUnicodeString@12
978 RtlAppendAsciizToString@8
979 RtlAppendStringToString@8
980 RtlAppendUnicodeStringToString@8
981 RtlAppendUnicodeToString@8
982 RtlAreAllAccessesGranted@8
983 RtlAreAnyAccessesGranted@8
988 RtlCaptureStackBackTrace@16
990 RtlCheckRegistryKey@8
995 RtlCompareMemoryUlong@12
997 RtlCompareUnicodeString@12
1000 RtlConvertLongToLargeInteger@4
1001 RtlConvertSidToUnicodeString@12
1002 RtlConvertUlongToLargeInteger@4
1007 RtlCopyUnicodeString@8
1009 RtlCreateAtomTable@8
1011 RtlCreateRegistryKey@8
1012 RtlCreateSecurityDescriptor@8
1013 RtlCreateSystemVolumeInformationFolder@4
1014 RtlCreateUnicodeString@8
1015 RtlCustomCPToUnicodeN@24
1016 RtlDecompressBuffer@24
1017 RtlDecompressChunks@28
1018 RtlDecompressFragment@32
1021 RtlDeleteAtomFromAtomTable@8
1022 RtlDeleteElementGenericTable@8
1023 RtlDeleteElementGenericTableAvl@8
1025 RtlDeleteOwnersRanges@8
1027 RtlDeleteRegistryValue@12
1029 RtlDestroyAtomTable@4
1031 RtlDowncaseUnicodeString@12
1033 RtlEnlargedIntegerMultiply@8
1034 RtlEnlargedUnsignedDivide@16
1035 RtlEnlargedUnsignedMultiply@8
1036 RtlEnumerateGenericTable@8
1037 RtlEnumerateGenericTableAvl@8
1038 RtlEnumerateGenericTableLikeADirectory@28
1039 RtlEnumerateGenericTableWithoutSplaying@8
1040 RtlEnumerateGenericTableWithoutSplayingAvl@8
1044 RtlEqualUnicodeString@12
1045 RtlExtendedIntegerMultiply@12
1046 RtlExtendedLargeIntegerDivide@16
1047 RtlExtendedMagicDivide@20
1049 RtlFillMemoryUlong@12
1051 RtlFindClearBitsAndSet@12
1053 RtlFindFirstRunClear@8
1054 RtlFindFirstRunSet@8
1055 RtlFindLastBackwardRunClear@12
1056 RtlFindLeastSignificantBit@8
1057 RtlFindLongestRunClear@8
1058 RtlFindLongestRunSet@8
1060 RtlFindMostSignificantBit@8
1061 RtlFindNextForwardRunClear@12
1064 RtlFindSetBitsAndClear@12
1065 RtlFindUnicodePrefix@12
1066 RtlFormatCurrentUserKeyPath@4
1071 RtlFreeUnicodeString@4
1073 RtlGenerate8dot3Name@16
1075 RtlGetCallersAddress@8
1076 RtlGetCompressionWorkSpaceSize@12
1077 RtlGetDaclSecurityDescriptor@16
1078 RtlGetDefaultCodePage@8
1079 RtlGetElementGenericTable@8
1080 RtlGetElementGenericTableAvl@8
1082 RtlGetGroupSecurityDescriptor@12
1084 RtlGetNtGlobalFlags@0
1085 RtlGetOwnerSecurityDescriptor@12
1086 RtlGetSaclSecurityDescriptor@16
1087 RtlGetSetBootStatusData@24
1089 RtlHashUnicodeString@16
1091 RtlImageDirectoryEntryToData@16
1093 RtlInitCodePageTable@8
1095 RtlInitUnicodeString@8
1096 RtlInitializeBitMap@12
1097 RtlInitializeGenericTable@20
1098 RtlInitializeGenericTableAvl@20
1099 RtlInitializeRangeList@4
1101 RtlInitializeUnicodePrefix@4
1102 RtlInsertElementGenericTable@16
1103 RtlInsertElementGenericTableAvl@16
1104 RtlInsertElementGenericTableFull@24
1105 RtlInsertElementGenericTableFullAvl@24
1106 RtlInsertUnicodePrefix@12
1107 RtlInt64ToUnicodeString@16
1109 RtlIntegerToUnicode@16
1110 RtlIntegerToUnicodeString@12
1111 RtlInvertRangeList@8
1112 RtlIpv4AddressToStringA@8
1113 RtlIpv4AddressToStringExA@16
1114 RtlIpv4AddressToStringExW@16
1115 RtlIpv4AddressToStringW@8
1116 RtlIpv4StringToAddressA@16
1117 RtlIpv4StringToAddressExA@16
1118 RtlIpv4StringToAddressExW@16
1119 RtlIpv4StringToAddressW@16
1120 RtlIpv6AddressToStringA@8
1121 RtlIpv6AddressToStringExA@16
1122 RtlIpv6AddressToStringExW@16
1123 RtlIpv6AddressToStringW@8
1124 RtlIpv6StringToAddressA@16
1125 RtlIpv6StringToAddressExA@16
1126 RtlIpv6StringToAddressExW@16
1127 RtlIpv6StringToAddressW@16
1128 RtlIsGenericTableEmpty@4
1129 RtlIsGenericTableEmptyAvl@4
1130 RtlIsNameLegalDOS8Dot3@12
1131 RtlIsRangeAvailable@40
1132 RtlIsValidOemCharacter@4
1133 RtlLargeIntegerAdd@16
1134 RtlLargeIntegerArithmeticShift@12
1135 RtlLargeIntegerDivide@20
1136 RtlLargeIntegerNegate@8
1137 RtlLargeIntegerShiftLeft@12
1138 RtlLargeIntegerShiftRight@12
1139 RtlLargeIntegerSubtract@16
1140 RtlLengthRequiredSid@4
1141 RtlLengthSecurityDescriptor@4
1143 RtlLockBootStatusData@4
1144 RtlLookupAtomInAtomTable@12
1145 RtlLookupElementGenericTable@8
1146 RtlLookupElementGenericTableAvl@8
1147 RtlLookupElementGenericTableFull@16
1148 RtlLookupElementGenericTableFullAvl@16
1150 RtlMapSecurityErrorToNtStatus@4
1151 RtlMergeRangeLists@16
1153 RtlMultiByteToUnicodeN@20
1154 RtlMultiByteToUnicodeSize@12
1155 RtlNextUnicodePrefix@8
1156 RtlNtStatusToDosError@4
1157 RtlNtStatusToDosErrorNoTeb@4
1158 RtlNumberGenericTableElements@4
1159 RtlNumberGenericTableElementsAvl@4
1160 RtlNumberOfClearBits@4
1161 RtlNumberOfSetBits@4
1162 RtlOemStringToCountedUnicodeString@12
1163 RtlOemStringToUnicodeSize@4
1164 RtlOemStringToUnicodeString@12
1166 RtlPinAtomInAtomTable@8
1167 @RtlPrefetchMemoryNonTemporal@8
1169 RtlPrefixUnicodeString@12
1170 RtlQueryAtomInAtomTable@24
1171 RtlQueryRegistryValues@20
1172 RtlQueryTimeZoneInformation@4
1176 RtlRealPredecessor@4
1178 RtlRemoveUnicodePrefix@8
1180 RtlSecondsSince1970ToTime@8
1181 RtlSecondsSince1980ToTime@8
1182 RtlSelfRelativeToAbsoluteSD2@8
1183 RtlSelfRelativeToAbsoluteSD@44
1187 RtlSetDaclSecurityDescriptor@16
1188 RtlSetGroupSecurityDescriptor@12
1189 RtlSetOwnerSecurityDescriptor@12
1190 RtlSetSaclSecurityDescriptor@16
1191 RtlSetTimeZoneInformation@4
1195 RtlSubAuthorityCountSid@4
1196 RtlSubAuthoritySid@8
1197 RtlSubtreePredecessor@4
1198 RtlSubtreeSuccessor@4
1200 RtlTimeFieldsToTime@8
1201 RtlTimeToElapsedTimeFields@8
1202 RtlTimeToSecondsSince1970@8
1203 RtlTimeToSecondsSince1980@8
1204 RtlTimeToTimeFields@8
1206 @RtlUlonglongByteSwap@8
1207 RtlUnicodeStringToAnsiSize@4
1208 RtlUnicodeStringToAnsiString@12
1209 RtlUnicodeStringToCountedOemString@12
1210 RtlUnicodeStringToInteger@12
1211 RtlUnicodeStringToOemSize@4
1212 RtlUnicodeStringToOemString@12
1213 RtlUnicodeToCustomCPN@24
1214 RtlUnicodeToMultiByteN@20
1215 RtlUnicodeToMultiByteSize@12
1217 RtlUnlockBootStatusData@4
1219 RtlUpcaseUnicodeChar@4
1220 RtlUpcaseUnicodeString@12
1221 RtlUpcaseUnicodeStringToAnsiString@12
1222 RtlUpcaseUnicodeStringToCountedOemString@12
1223 RtlUpcaseUnicodeStringToOemString@12
1224 RtlUpcaseUnicodeToCustomCPN@24
1225 RtlUpcaseUnicodeToMultiByteN@20
1226 RtlUpcaseUnicodeToOemN@20
1229 @RtlUshortByteSwap@4
1230 RtlValidRelativeSecurityDescriptor@12
1231 RtlValidSecurityDescriptor@4
1233 ;RtlVerifyVersionInfo@16
1234 RtlVolumeDeviceToDosName@8
1235 RtlWalkFrameChain@12
1236 RtlWriteRegistryValue@24
1239 RtlxAnsiStringToUnicodeSize@4
1240 RtlxOemStringToUnicodeSize@4
1241 RtlxUnicodeStringToAnsiSize@4
1242 RtlxUnicodeStringToOemSize@4
1244 SeAppendPrivileges@8
1246 SeAssignSecurityEx@36
1247 SeAuditHardLinkCreation@12
1248 SeAuditingFileEvents@8
1249 SeAuditingFileEventsWithContext@12
1250 SeAuditingFileOrGlobalEvents@12
1251 SeAuditingHardLinkEvents@8
1252 SeAuditingHardLinkEventsWithContext@12
1253 SeCaptureSecurityDescriptor@20
1254 SeCaptureSubjectContext@4
1255 SeCloseObjectAuditAlarm@12
1256 SeCreateAccessState@16
1257 SeCreateClientSecurity@16
1258 SeCreateClientSecurityFromSubjectContext@16
1259 SeDeassignSecurity@4
1260 SeDeleteAccessState@4
1261 SeDeleteObjectAuditAlarm@8
1265 SeImpersonateClient@8
1266 SeImpersonateClientEx@8
1267 SeLockSubjectContext@4
1268 SeMarkLogonSessionForTerminationNotification@4
1269 SeOpenObjectAuditAlarm@36
1270 SeOpenObjectForDeleteAuditAlarm@36
1272 SePrivilegeObjectAuditAlarm@24
1273 SePublicDefaultDacl DATA
1274 SeQueryAuthenticationIdToken@8
1275 SeQueryInformationToken@12
1276 SeQuerySecurityDescriptorInfo@16
1277 SeQuerySessionIdToken@8
1278 SeRegisterLogonSessionTerminatedRoutine@4
1279 SeReleaseSecurityDescriptor@12
1280 SeReleaseSubjectContext@4
1281 SeSetAccessStateGenericMapping@8
1282 SeSetSecurityDescriptorInfo@24
1283 SeSetSecurityDescriptorInfoEx@28
1284 SeSinglePrivilegeCheck@12
1285 SeSystemDefaultDacl DATA
1286 SeTokenImpersonationLevel@4
1288 SeTokenIsRestricted@4
1289 SeTokenIsWriteRestricted@4
1291 SeUnlockSubjectContext@4
1292 SeUnregisterLogonSessionTerminatedRoutine@4
1293 SeValidSecurityDescriptor@8
1294 VerSetConditionMask@16
1295 WRITE_REGISTER_UCHAR@8
1296 WRITE_REGISTER_ULONG@8
1297 WRITE_REGISTER_USHORT@8
1298 WRITE_REGISTER_BUFFER_UCHAR@12
1299 WRITE_REGISTER_BUFFER_ULONG@12
1300 WRITE_REGISTER_BUFFER_USHORT@12
1301 ZwAccessCheckAndAuditAlarm@44
1303 ZwAdjustPrivilegesToken@24
1305 ZwAllocateVirtualMemory@24
1306 ZwAssignProcessToJobObject@8
1311 ZwCloseObjectAuditAlarm@12
1313 ZwCreateDirectoryObject@12
1316 ZwCreateJobObject@12
1319 ZwCreateSymbolicLinkObject@16
1325 ZwDeviceIoControlFile@40
1327 ZwDuplicateObject@28
1329 ZwEnumerateBootEntries@8
1331 ZwEnumerateValueKey@24
1332 ZwFlushInstructionCache@12
1334 ZwFlushVirtualMemory@16
1335 ZwFreeVirtualMemory@16
1337 ZwInitiatePowerAction@16
1341 ZwMakeTemporaryObject@4
1342 ZwMapViewOfSection@40
1343 ZwNotifyChangeKey@40
1344 ZwOpenDirectoryObject@12
1350 ZwOpenProcessToken@12
1351 ZwOpenProcessTokenEx@16
1353 ZwOpenSymbolicLinkObject@12
1355 ZwOpenThreadToken@16
1356 ZwOpenThreadTokenEx@20
1358 ZwPowerInformation@20
1360 ZwQueryBootEntryOrder@8
1361 ZwQueryBootOptions@8
1362 ZwQueryDefaultLocale@8
1363 ZwQueryDefaultUILanguage@4
1364 ZwQueryDirectoryFile@44
1365 ZwQueryDirectoryObject@28
1367 ZwQueryFullAttributesFile@8
1368 ZwQueryInformationAtom@20
1369 ZwQueryInformationFile@20
1370 ZwQueryInformationJobObject@20
1371 ZwQueryInformationProcess@20
1372 ZwQueryInformationThread@20
1373 ZwQueryInformationToken@20
1374 ZwQueryInstallUILanguage@4
1378 ZwQuerySecurityObject@20
1379 ZwQuerySymbolicLinkObject@12
1380 ZwQuerySystemInformation@16
1383 ZwQueryVolumeInformationFile@20
1386 ZwRequestWaitReplyPort@12
1391 ZwSetBootEntryOrder@8
1393 ZwSetDefaultLocale@8
1394 ZwSetDefaultUILanguage@4
1397 ZwSetInformationFile@20
1398 ZwSetInformationJobObject@16
1399 ZwSetInformationObject@16
1400 ZwSetInformationProcess@16
1401 ZwSetInformationThread@16
1402 ZwSetSecurityObject@12
1403 ZwSetSystemInformation@12
1407 ZwSetVolumeInformationFile@20
1408 ZwTerminateJobObject@8
1409 ZwTerminateProcess@8
1410 ZwTranslateFilePath@12
1413 ZwUnmapViewOfSection@8
1414 ZwWaitForMultipleObjects@20
1415 ZwWaitForSingleObject@12
1418 _abnormal_termination