3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
19 CcGetFileObjectFromBcb@4
20 CcGetFileObjectFromSectionPtrs@4
21 CcGetFlushedValidData@8
22 CcGetLsnForFileObject@8
23 CcInitializeCacheMap@20
25 CcFastMdlReadWait DATA
26 CcFastReadNotPossible DATA
37 CcPurgeCacheSection@16
40 CcScheduleReadAhead@12
41 CcSetAdditionalCacheAttributes@12
42 CcSetBcbOwnerPointer@8
43 CcSetDirtyPageThreshold@8
44 CcSetDirtyPinnedData@8
45 CcSetLogHandleForFile@12
46 CcSetReadAheadGranularity@8
47 CcUninitializeCacheMap@12
49 CcUnpinDataForThread@8
51 CcWaitForCurrentLazyWriterActivity@0
56 CmUnRegisterCallback@8
58 DbgBreakPointWithStatus@4
59 DbgLoadImageSymbols@12
63 DbgPrintReturnControlC
64 DbgQueryDebugFilterState@8
65 DbgSetDebugFilterState@12
66 @ExiAcquireFastMutex@4=@ExAcquireFastMutex@4
67 @ExAcquireFastMutexUnsafe@4
68 ExAcquireRundownProtection=@ExfAcquireRundownProtection@4
69 ExAcquireRundownProtectionCacheAware=@ExfAcquireRundownProtectionCacheAware@4
70 ExAcquireRundownProtectionCacheAwareEx=@ExfAcquireRundownProtectionCacheAwareEx@8
71 ExAcquireRundownProtectionEx=@ExfAcquireRundownProtectionEx@8
72 ExInitializeRundownProtection=@ExfInitializeRundownProtection@4
73 ExReInitializeRundownProtection=@ExfReInitializeRundownProtection@4
74 ExReInitializeRundownProtectionCacheAware=@ExfReInitializeRundownProtectionCacheAware@4
75 ExReleaseRundownProtection=@ExfReleaseRundownProtection@4
76 ExReleaseRundownProtectionCacheAware=@ExfReleaseRundownProtectionCacheAware@4
77 ExReleaseRundownProtectionCacheAwareEx=@ExfReleaseRundownProtectionCacheAwareEx@8
78 ExReleaseRundownProtectionEx=@ExfReleaseRundownProtectionEx@8
79 ExRundownCompleted=@ExfRundownCompleted@4
80 ExRundownCompletedCacheAware=@ExfRundownCompletedCacheAware@4
81 ExWaitForRundownProtectionRelease=@ExfWaitForRundownProtectionRelease@4
82 ExWaitForRundownProtectionReleaseCacheAware=@ExfWaitForRundownProtectionReleaseCacheAware@4
83 ExAllocateCacheAwareRundownProtection@8
84 ExFreeCacheAwareRundownProtection@4
85 ExInitializeRundownProtectionCacheAware@8
86 ExSizeOfRundownProtectionCacheAware@0
87 ExAcquireResourceExclusiveLite@8
88 ExAcquireResourceSharedLite@8
89 ExAcquireSharedStarveExclusive@8
90 ExAcquireSharedWaitForExclusive@8
91 ExAllocateFromPagedLookasideList@4=ExiAllocateFromPagedLookasideList@4
93 ExAllocatePoolWithQuota@8
94 ExAllocatePoolWithQuotaTag@12
95 ExAllocatePoolWithTag@12
96 ExAllocatePoolWithTagPriority@16
97 ExConvertExclusiveToSharedLite@4
99 ExDeleteNPagedLookasideList@4
100 ExDeletePagedLookasideList@4
101 ExDeleteResourceLite@4
102 ExDesktopObjectType DATA
103 ExDisableResourceBoostLite@4
105 @ExEnterCriticalRegionAndAcquireFastMutexUnsafe@4
106 ExEventObjectType DATA
110 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
111 ExGetCurrentProcessorCounts@12
112 ExGetCurrentProcessorCpuUsage@4
113 ExGetExclusiveWaiterCount@4
115 ExGetSharedWaiterCount@4
116 ExInitializeNPagedLookasideList@28
117 ExInitializePagedLookasideList@28
118 ExInitializeResourceLite@4
120 ExInterlockedAddLargeInteger@16
121 @ExInterlockedAddLargeStatistic@8
122 ExInterlockedAddUlong@12
123 @ExInterlockedCompareExchange64@16
124 ExInterlockedDecrementLong@8
125 ExInterlockedExchangeUlong@12
126 ExInterlockedExtendZone@16
127 ExInterlockedIncrementLong@8
128 @ExInterlockedFlushSList@4
129 ExInterlockedInsertHeadList@12
130 ExInterlockedInsertTailList@12
131 ExInterlockedPopEntryList@8
132 @ExInterlockedPopEntrySList@8
133 ExInterlockedPushEntryList@12
134 @ExInterlockedPushEntrySList@12
135 ExInterlockedRemoveHeadList@8
136 ExIsProcessorFeaturePresent@4
137 ExIsResourceAcquiredExclusiveLite@4
138 ExIsResourceAcquiredSharedLite@4
139 ExLocalTimeToSystemTime@8
141 ExQueryPoolBlockSize@8
143 ExRaiseAccessViolation@0
144 ExRaiseDatatypeMisalignment@0
145 ExRaiseException@4=RtlRaiseException@4
147 ExRaiseStatus@4=RtlRaiseStatus@4
148 ExRegisterCallback@12
149 ExReinitializeResourceLite@4
150 @ExiReleaseFastMutex@4=@ExReleaseFastMutex@4
151 @ExReleaseFastMutexUnsafe@4
152 @ExReleaseFastMutexUnsafeAndLeaveCriticalRegion@4
153 ExReleaseResourceForThreadLite@8
154 @ExReleaseResourceLite@4
155 ExSemaphoreObjectType DATA
156 ExSetResourceOwnerPointer@8
157 ExSetTimerResolution@8
158 ExSystemExceptionFilter@0
159 ExSystemTimeToLocalTime@8
160 ExTryToAcquireResourceExclusiveLite@4
161 ExUnregisterCallback@4
164 ExWindowStationObjectType DATA
165 @ExfInterlockedAddUlong@12
166 @ExfInterlockedInsertHeadList@12
167 @ExfInterlockedInsertTailList@12
168 @ExfInterlockedCompareExchange64@12
169 @ExfInterlockedPopEntryList@8
170 @ExfInterlockedPushEntryList@12
171 @ExfInterlockedRemoveHeadList@8
172 @Exfi386InterlockedDecrementLong@4
173 @Exfi386InterlockedExchangeUlong@8
174 @Exfi386InterlockedIncrementLong@4
175 Exi386InterlockedDecrementLong@4
176 Exi386InterlockedExchangeUlong@12
177 Exi386InterlockedIncrementLong@4
178 FsRtlAcquireFileExclusive@4
179 FsRtlAddLargeMcbEntry@28
181 FsRtlAddToTunnelCache@32
182 FsRtlAllocateFileLock@8
184 FsRtlAllocatePoolWithQuota@8
185 FsRtlAllocatePoolWithQuotaTag@12
186 FsRtlAllocatePoolWithTag@12
187 FsRtlAllocateResource@0
188 FsRtlAreNamesEqual@16
190 FsRtlCheckLockForReadAccess@8
191 FsRtlCheckLockForWriteAccess@8
195 FsRtlCurrentBatchOplock@4
196 FsRtlDeleteKeyFromTunnelCache@12
197 FsRtlDeleteTunnelCache@4
198 FsRtlDeregisterUncProvider@4
201 FsRtlDoesDbcsContainWildCards@4
202 FsRtlDoesNameContainWildCards@4
203 FsRtlFastCheckLockForRead@24
204 FsRtlFastCheckLockForWrite@24
205 FsRtlFastUnlockAll@16
206 FsRtlFastUnlockAllByKey@20
207 FsRtlFastUnlockSingle@32
208 FsRtlFindInTunnelCache@32
211 FsRtlGetNextFileLock@8
212 FsRtlGetNextLargeMcbEntry@20
213 FsRtlGetNextMcbEntry@20
214 FsRtlIncrementCcFastReadNotPossible@0
215 FsRtlIncrementCcFastReadNoWait@0
216 FsRtlIncrementCcFastReadResourceMiss@0
217 FsRtlIncrementCcFastReadWait@0
218 FsRtlInitializeFileLock@12
219 FsRtlInitializeLargeMcb@8
221 FsRtlInitializeOplock@4
222 FsRtlInitializeTunnelCache@4
223 FsRtlInsertPerFileObjectContext@8
224 FsRtlInsertPerStreamContext@8
225 FsRtlIsDbcsInExpression@8
226 FsRtlIsFatDbcsLegal@20
227 FsRtlIsHpfsDbcsLegal@20
228 FsRtlIsNameInExpression@16
229 FsRtlIsNtstatusExpected@4
231 FsRtlIsTotalDeviceFailure@4
232 FsRtlLegalAnsiCharacterArray DATA
233 FsRtlLookupLargeMcbEntry@32
234 FsRtlLookupLastLargeMcbEntry@12
235 FsRtlLookupLastLargeMcbEntryAndIndex@16
236 FsRtlLookupLastMcbEntry@12
237 FsRtlLookupMcbEntry@20
238 FsRtlLookupPerFileObjectContext@12
239 FsRtlLookupPerStreamContextInternal@12
241 FsRtlMdlReadComplete@8
242 FsRtlMdlReadCompleteDev@12
244 FsRtlMdlWriteComplete@12
245 FsRtlMdlWriteCompleteDev@16
246 FsRtlNormalizeNtstatus@8
247 FsRtlNotifyChangeDirectory@28
248 FsRtlNotifyCleanup@12
249 FsRtlNotifyFilterChangeDirectory@44
250 FsRtlNotifyFilterReportChange@40
251 FsRtlNotifyFullChangeDirectory@40
252 FsRtlNotifyFullReportChange@36
253 FsRtlNotifyInitializeSync@4
254 FsRtlNotifyReportChange@20
255 FsRtlNotifyUninitializeSync@4
256 FsRtlNotifyVolumeEvent@8
257 FsRtlNumberOfRunsInLargeMcb@4
258 FsRtlNumberOfRunsInMcb@4
260 FsRtlOplockIsFastIoPossible@4
261 FsRtlPostPagingFileStackOverflow@12
262 FsRtlPostStackOverflow@12
263 FsRtlPrepareMdlWrite@24
264 FsRtlPrepareMdlWriteDev@28
266 FsRtlProcessFileLock@12
267 FsRtlRegisterUncProvider@12
269 FsRtlRemoveLargeMcbEntry@20
270 FsRtlRemoveMcbEntry@12
271 FsRtlRemovePerFileObjectContext@12
272 FsRtlRemovePerStreamContext@12
274 FsRtlSplitLargeMcb@20
276 FsRtlTeardownPerStreamContexts@4
277 FsRtlTruncateLargeMcb@12
279 FsRtlUninitializeFileLock@4
280 FsRtlUninitializeLargeMcb@4
281 FsRtlUninitializeMcb@4
282 FsRtlUninitializeOplock@4
283 HalDispatchTable DATA
284 HalPrivateDispatchTable DATA
286 InbvAcquireDisplayOwnership@0
287 InbvCheckDisplayOwnership@0
289 InbvEnableBootDriver@4
290 InbvEnableDisplayString@4
291 InbvInstallDisplayStringFilter@4
292 InbvIsBootDriverInstalled@0
293 InbvNotifyDisplayOwnershipLost@4
295 InbvSetScrollRegion@16
297 InbvSolidColorFill@20
298 InitSafeBootMode DATA
299 @InterlockedCompareExchange@12
300 @InterlockedDecrement@4
301 @InterlockedExchange@8
302 @InterlockedExchangeAdd@8
303 @InterlockedIncrement@4
304 @InterlockedPushEntrySList@8
305 @InterlockedPopEntrySList@4
306 IoAcquireCancelSpinLock@4
307 IoAcquireRemoveLockEx@20
308 IoAcquireVpbSpinLock@4
309 IoAdapterObjectType DATA
310 IoAllocateAdapterChannel@20
313 IoAllocateController@16
314 IoAllocateDriverObjectExtension@16
315 IoAllocateErrorLogEntry@8
317 IoAssignDriveLetters@16
320 IoAttachDeviceByPointer@8
321 IoAttachDeviceToDeviceStack@8
322 IoAttachDeviceToDeviceStackSafe@12
323 IoBuildAsynchronousFsdRequest@24
324 IoBuildDeviceIoControlRequest@36
326 IoBuildSynchronousFsdRequest@28
330 IoCheckDesiredAccess@8
331 IoCheckEaBufferValidity@12
332 IoCheckFunctionAccess@24
333 IoCheckQuerySetFileInformation@12
334 IoCheckQuerySetVolumeInformation@12
335 IoCheckQuotaBufferValidity@12
336 IoCheckShareAccess@20
338 IoConnectInterrupt@44
344 IoCreateFileSpecifyDeviceObjectHint@60
345 IoCreateNotificationEvent@8
346 IoCreateStreamFileObject@8
347 IoCreateStreamFileObjectEx@12
348 IoCreateStreamFileObjectLite@8
349 IoCreateSymbolicLink@8
350 IoCreateSynchronizationEvent@8
351 IoCreateUnprotectedSymbolicLink@8
361 IoDeleteSymbolicLink@4
363 IoDeviceHandlerObjectSize DATA
364 IoDeviceHandlerObjectType DATA
365 IoDeviceObjectType DATA
366 IoDisconnectInterrupt@4
367 IoDriverObjectType DATA
369 IoEnumerateDeviceObjectList@16
370 IoFastQueryNetworkAttributes@20
371 IoFileObjectType DATA
372 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
373 IoForwardIrpSynchronously@8
375 IoFreeErrorLogEntry@4
379 IoGetAttachedDevice@4
380 IoGetAttachedDeviceReference@4
381 IoGetBaseFileSystemDeviceObject@4
382 IoGetBootDiskInformation@8
383 IoGetConfigurationInformation@0
384 IoGetCurrentProcess@0
385 IoGetDeviceObjectPointer@16
386 IoGetDeviceAttachmentBaseRef@4
387 IoGetDeviceInterfaceAlias@12
388 IoGetDeviceInterfaces@16
389 IoGetDriverObjectExtension@8
390 IoGetDeviceProperty@20
391 IoGetDeviceToVerify@4
392 IoGetDiskDeviceObject@8
394 IoGetFileObjectGenericMapping@0
396 IoGetLowerDeviceObject@4
397 IoGetRelatedDeviceObject@4
398 IoGetRequestorProcess@4
399 IoGetRequestorProcessId@4
400 IoGetRequestorSessionId@8
404 IoInvalidateDeviceRelations@8
405 IoInvalidateDeviceState@4
406 IoInitializeRemoveLockEx@20
408 IoIsFileOriginRemote@4
410 IoIsValidNameGraftingBuffer@8
411 IoIsOperationSynchronous@4
412 IoMakeAssociatedIrp@8
413 IoOpenDeviceInterfaceRegistryKey@12
414 IoOpenDeviceRegistryKey@16
416 IoPnPDeliverServicePowerNotification@16
417 IoQueryDeviceDescription@32
418 IoQueryFileDosDeviceName@8
419 IoQueryFileInformation@20
420 IoQueryVolumeInformation@20
424 IoRaiseInformationalHardError@12
425 IoReadDiskSignature@12
426 IoReadOperationCount DATA
427 @IoReadPartitionTable@16
428 IoReadPartitionTableEx@8
429 IoReadTransferCount DATA
430 IoRegisterBootDriverReinitialization@12
431 IoRegisterDeviceInterface@16
432 IoRegisterDriverReinitialization@12
433 IoRegisterFileSystem@4
434 IoRegisterFsRegistrationChange@8
435 IoRegisterLastChanceShutdownNotification@4
436 IoRegisterPlugPlayNotification@28
437 IoRegisterShutdownNotification@4
438 IoReleaseCancelSpinLock@4
439 IoReleaseRemoveLockAndWaitEx@12
440 IoReleaseRemoveLockEx@12
441 IoReleaseVpbSpinLock@4
442 IoRemoveShareAccess@8
443 IoReportDetectedDevice@32
444 IoReportHalResourceUsage@16
445 IoReportResourceUsage@36
446 IoReportResourceForDetection@28
447 IoReportTargetDeviceChange@8
448 IoReportTargetDeviceChangeAsynchronous@16
449 IoRequestDeviceEject@4
451 IoSetCompletionRoutineEx@28
452 IoSetSystemPartition@4
453 IoSetDeviceInterfaceState@8
454 IoSetDeviceToVerify@8
456 IoSetHardErrorOrVerifyDevice@8
459 @IoSetPartitionInformation@16
460 IoSetPartitionInformationEx@12
461 IoSetStartIoAttributes@12
463 IoSetThreadHardErrorMode@4
466 IoStartNextPacketByKey@12
469 IoStatisticsLock DATA
471 IoSynchronousPageWrite@20
472 IoSynchronousInvalidateDeviceRelations@8
474 IoUnregisterFileSystem@4
475 IoUnregisterFsRegistrationChange@8
476 IoUnregisterPlugPlayNotification@4
477 IoUnregisterShutdownNotification@4
478 IoUpdateShareAccess@8
479 IoValidateDeviceIoControlAccess@8
480 IoVerifyPartitionTable@8
482 IoVolumeDeviceToDosName@8
483 IoWMIAllocateInstanceIds@12
484 IoWMIDeviceObjectToInstanceName@12
485 IoWMIExecuteMethod@24
486 IoWMIHandleToInstanceName@12
489 IoWMIQueryAllDataMultiple@16
490 IoWMIQuerySingleInstance@16
491 IoWMIQuerySingleInstanceMultiple@20
492 IoWMIRegistrationControl@8
493 IoWMISetNotificationCallback@12
494 IoWMISetSingleInstance@20
495 IoWMISetSingleItem@24
496 IoWMISuggestInstanceName@16
498 IoWriteErrorLogEntry@4
499 IoWriteOperationCount DATA
500 @IoWritePartitionTable@20
501 IoWritePartitionTableEx@8
502 IoWriteTransferCount DATA
504 @IofCompleteRequest@8
505 IoIsWdmVersionAvailable@8
506 KdDebuggerEnabled DATA
507 KdDebuggerNotPresent DATA
513 KdpServiceDispatcher@12
515 Ke386IoSetAccessProcess@8
516 Ke386QueryIoAccessMap@8
517 Ke386SetIoAccessMap@8
518 @KeAcquireGuardedMutex@4
519 @KeAcquireGuardedMutexUnsafe@4
520 KeAcquireSpinLockAtDpcLevel@4
521 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
522 KeAcquireInterruptSpinLock@4
523 KeAddSystemServiceTable@20
526 ;KeBoostCurrentThread
530 KeCapturePersistentThreadState@28
533 KeDcacheFlushCount DATA
534 KeDelayExecutionThread@12
535 KeDeregisterBugCheckCallback@4
536 KeDeregisterBugCheckReasonCallback@4
538 KeDisconnectInterrupt@4
539 KeEnterCriticalRegion@0
540 KeEnterGuardedRegion@0
541 KeEnterKernelDebugger@0
542 KeFindConfigurationEntry@16
543 KeFindConfigurationNextEntry@20
548 KeGetRecommendedSharedDataAlignment@0
550 KeI386AllocateGdtSelectors@8
551 ;KeI386Call16BitCStyleFunction
552 ;KeI386Call16BitFunction
553 KeI386FlatToGdtSelector@12
555 ;KeI386MachineType DATA
556 KeI386ReleaseGdtSelectors@8
558 ;KeI386SetGdtSelector
559 KeIcacheFlushCount DATA
561 KeInitializeDeviceQueue@4
564 @KeInitializeGuardedMutex@4
565 KeInitializeInterrupt@44
569 KeInitializeSemaphore@12
570 KeInitializeSpinLock@4
572 KeInitializeTimerEx@8
573 KeInsertByKeyDeviceQueue@12
574 KeInsertDeviceQueue@8
579 KeIsAttachedProcess@0
581 KeLeaveCriticalRegion@0
582 KeLeaveGuardedRegion@0
584 KeNumberProcessors DATA
586 KeProfileInterruptWithSource@8
588 KeQueryActiveProcessors@0
589 KeQueryInterruptTime@0
590 KeQueryPriorityThread@4
591 KeQueryRuntimeThread@8
594 KeQueryTimeIncrement@0
595 KeRaiseUserException@4
598 KeReadStateMutex@4=KeReadStateMutant@4
600 KeReadStateSemaphore@4
602 KeRegisterBugCheckCallback@20
603 KeRegisterBugCheckReasonCallback@16
604 @KeReleaseGuardedMutexUnsafe@4
605 @KeReleaseGuardedMutex@4
606 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
607 KeReleaseInterruptSpinLock@8
610 KeReleaseSemaphore@16
611 KeReleaseSpinLockFromDpcLevel@4
612 KeRemoveByKeyDeviceQueue@8
613 KeRemoveByKeyDeviceQueueIfBusy@8
614 KeRemoveDeviceQueue@4
615 KeRemoveEntryDeviceQueue@8
618 KeRemoveSystemServiceTable@4
620 KeRestoreFloatingPointState@4
621 KeRevertToUserAffinityThread@0
623 KeSaveFloatingPointState@4
624 KeSaveStateForHibernate
625 KeServiceDescriptorTable DATA
626 KeSetAffinityThread@8
627 KeSetBasePriorityThread@8
628 KeSetDmaIoCoherency@4
630 KeSetEventBoostPriority@8
631 KeSetIdealProcessorThread@8
633 KeSetKernelStackSwapEnable@4
634 KeSetPriorityThread@8
636 KeSetSystemAffinityThread@4
637 ;KeSetSwapContextNotifyRoutine
638 KeSetTargetProcessorDpc@8
639 ;KeSetThreadSelectNotifyRoutine
643 @KeSetTimeUpdateNotifyRoutine@4
644 KeStackAttachProcess@8
645 KeSynchronizeExecution@12
648 @KeTryToAcquireGuardedMutex@4
651 KeUnstackDetachProcess@4
652 KeUserModeCallback@20
653 KeWaitForMultipleObjects@32
654 KeWaitForMutexObject@20=KeWaitForSingleObject@20
655 KeWaitForSingleObject@20
656 @KefAcquireSpinLockAtDpcLevel@4
657 @KefReleaseSpinLockFromDpcLevel@4
662 KiCheckForKernelApcDelivery@0
664 KiDispatchInterrupt@0
665 KiEnableTimerWatchdog
666 KiInterruptDispatch2@8
667 KiIpiServiceRoutine@8
669 KiUnexpectedInterrupt@0
670 ;Kii386SpinOnSpinLock
674 LdrFindResourceDirectory_U@16
676 LpcPortObjectType DATA
678 LpcRequestWaitReplyPort@12
679 LsaCallAuthenticationPackage@28
680 LsaDeregisterLogonProcess@8
681 LsaFreeReturnBuffer@4
683 LsaLookupAuthenticationPackage@12
684 LsaRegisterLogonProcess@12
685 Mm64BitPhysicalAddress DATA
686 MmAddPhysicalMemory@8
687 MmAddVerifierThunks@8
688 MmAdjustWorkingSetSize@12
690 MmAllocateContiguousMemory@12
691 MmAllocateContiguousMemorySpecifyCache@32
692 MmAllocateMappingAddress@8
693 MmAllocateNonCachedMemory@4
694 MmAllocatePagesForMdl@28
695 MmBuildMdlForNonPagedPool@4
696 MmCanFileBeTruncated@8
699 MmDbgTranslatePhysicalAddress@8
700 MmDisableModifiedWriteOfSection@4
701 MmFlushImageSection@8
702 MmForceSectionClosed@8
703 MmFreeContiguousMemory@4
704 MmFreeContiguousMemorySpecifyCache@12
705 MmFreeMappingAddress@8
706 MmFreeNonCachedMemory@8
708 MmGetPhysicalAddress@4
709 MmGetPhysicalMemoryRanges@0
710 MmGetSystemRoutineAddress@4
711 MmGetVirtualForPhysical@8
713 MmHighestUserAddress DATA
715 MmIsDriverVerifying@4
716 MmIsNonPagedSystemAddressValid@4
717 MmIsRecursiveIoFault@0
718 MmIsThisAnNtAsSystem@0
719 MmIsVerifierEnabled@4
720 MmLockPagableDataSection@4
721 MmLockPagableImageSection@4=MmLockPagableDataSection@4
722 MmLockPagableSectionByHandle@4
725 MmMapLockedPagesSpecifyCache@24
726 MmMapLockedPagesWithReservedMapping@16
728 MmMapUserAddressesToPage@12
730 MmMapViewInSessionSpace@12
731 MmMapViewInSystemSpace@12
732 MmMapViewOfSection@40
733 MmMarkPhysicalMemoryAsBad@8
734 MmMarkPhysicalMemoryAsGood@8
737 MmProbeAndLockPages@12
738 MmProbeAndLockProcessPages@16
739 MmProbeAndLockSelectedPages@16
740 MmProtectMdlSystemAddress@8
742 MmRemovePhysicalMemory@8
743 MmResetDriverPaging@4
744 MmSectionObjectType DATA
745 MmSecureVirtualMemory@12
746 MmSetAddressRangeModified@8
747 MmSetBankedSection@24
749 MmSystemRangeStart DATA
750 MmTrimAllSystemPagableMemory@4
751 MmUnlockPagableImageSection@4
755 MmUnmapReservedMapping@12
756 MmUnmapVideoDisplay@8
757 MmUnmapViewInSessionSpace@4
758 MmUnmapViewInSystemSpace@4
759 MmUnmapViewOfSection@8
760 MmUnsecureVirtualMemory@4
761 MmUserProbeAddress DATA
764 NlsMbCodePageTag DATA
765 NlsMbOemCodePageTag DATA
767 NlsOemLeadByteInfo DATA
769 NtAdjustPrivilegesToken@24
771 NtAllocateLocallyUniqueId@4
773 NtAllocateVirtualMemory@24
784 NtDeviceIoControlFile@40
788 NtFreeVirtualMemory@16
792 NtMakePermanentObject@4
793 NtMapViewOfSection@40
794 NtNotifyChangeDirectoryFile@36
797 NtOpenProcessToken@12
798 NtOpenProcessTokenEx@16
801 NtOpenThreadTokenEx@20
802 NtQueryDirectoryFile@44
804 NtQueryInformationAtom@20
805 NtQueryInformationFile@20
806 NtQueryInformationProcess@20
807 NtQueryInformationThread@20
808 NtQueryInformationToken@20
809 NtQueryQuotaInformationFile@36
810 NtQuerySecurityObject@20
811 NtQuerySystemInformation@16
813 NtQueryVolumeInformationFile@20
816 NtRequestWaitReplyPort@12
819 NtSetInformationFile@20
820 NtSetInformationProcess@16
821 NtSetInformationThread@16
822 NtSetQuotaInformationFile@16
823 NtSetSecurityObject@12
824 NtSetVolumeInformationFile@20
831 NtWaitForSingleObject@12
834 ;ObCheckCreateObjectAccess@28
835 ;ObCheckObjectAccess@20
837 ObDereferenceSecurityDescriptor@8
838 ObFindHandleForObject@20
839 ObGetObjectPointerCount@4
840 ObGetObjectSecurity@12
842 ObLogSecurityDescriptor@12
843 ObMakeTemporaryObject@4
844 ObOpenObjectByName@28
845 ObOpenObjectByPointer@28
847 ObQueryObjectAuditingByHandle@8
848 @ObfDereferenceObject@4
849 @ObfReferenceObject@4
850 ObReferenceObjectByHandle@24
851 ObReferenceObjectByName@32
852 ObReferenceObjectByPointer@16
853 ObReleaseObjectSecurity@8
854 ObDereferenceObject@4
855 ;ObSetSecurityDescriptorInfo@24
861 PoQueueShutdownWorkItem@4
862 PoRegisterDeviceForIdleDetection@16
863 PoRegisterSystemState@8
868 PoStartNextPowerIrp@4
869 PoUnregisterSystemState@4
872 PsAssignImpersonationToken@8
874 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
875 PsChargeProcessPagedPoolQuota@8
876 PsChargeProcessPoolQuota@12
877 PsCreateSystemProcess@12
878 PsCreateSystemThread@28
879 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
880 PsDereferencePrimaryToken@4
881 PsDisableImpersonation@8
882 PsEstablishWin32Callouts@4
883 PsGetCurrentProcess@0=KeGetCurrentProcess@0
884 PsGetCurrentProcessId@0
885 PsGetCurrentProcessSessionId@0
886 PsGetCurrentThread@0=KeGetCurrentThread@0
887 PsGetCurrentThreadId@0
888 PsGetCurrentThreadPreviousMode@0
889 PsGetCurrentThreadStackBase@0
890 PsGetCurrentThreadStackLimit@0
893 PsGetJobUIRestrictionsClass@4
894 PsGetProcessCreateTimeQuadPart@4
895 PsGetProcessDebugPort@4
896 PsGetProcessExitProcessCalled@4
897 PsGetProcessExitStatus@4
898 PsGetProcessExitTime@0
900 PsGetProcessImageFileName@4
901 PsGetProcessInheritedFromUniqueProcessId@4
904 PsGetProcessPriorityClass@4
905 PsGetProcessSectionBaseAddress@4
906 PsGetProcessSecurityPort@4
907 PsGetProcessSessionId@4
908 PsGetProcessWin32Process@4
909 PsGetProcessWin32WindowStation@4
910 PsGetThreadFreezeCount@4
911 PsGetThreadHardErrorsAreDisabled@4
914 PsGetThreadProcessId@4
915 PsGetThreadSessionId@4
917 PsGetThreadWin32Thread@4
921 PsImpersonateClient@20
922 PsInitialSystemProcess DATA
923 PsIsProcessBeingDebugged@4
925 PsIsThreadImpersonating@4
926 PsIsThreadTerminating@4
928 PsLookupProcessByProcessId@8
929 PsLookupProcessThreadByCid@12
930 PsLookupThreadByThreadId@8
932 PsReferenceImpersonationToken@16
933 PsReferencePrimaryToken@4
934 PsRemoveCreateThreadNotifyRoutine@4
935 PsRemoveLoadImageNotifyRoutine@4
936 PsRestoreImpersonation@8
938 PsReturnProcessNonPagedPoolQuota@8
939 PsReturnProcessPagedPoolQuota@8
941 PsRevertThreadToSelf@4
942 PsSetCreateProcessNotifyRoutine@8
943 PsSetCreateThreadNotifyRoutine@4
944 PsSetJobUIRestrictionsClass@8
945 PsSetLegoNotifyRoutine@4
946 PsSetProcessPriorityClass@8
947 PsSetProcessPriorityByClass@8
948 PsSetProcessSecurityPort@8
949 PsSetProcessWin32Process@8
950 PsSetProcessWindowStation@8
951 PsSetThreadHardErrorsAreDisabled@8
952 PsSetThreadWin32Thread@8
953 PsSetLoadImageNotifyRoutine@4
954 PsTerminateSystemThread@4
956 READ_REGISTER_UCHAR@4
957 READ_REGISTER_ULONG@4
958 READ_REGISTER_USHORT@4
959 READ_REGISTER_BUFFER_UCHAR@12
960 READ_REGISTER_BUFFER_ULONG@12
961 READ_REGISTER_BUFFER_USHORT@12
963 KeRosDumpStackFrames@8
964 KeRosGetStackFrames@8
965 RtlAbsoluteToSelfRelativeSD@12
966 RtlAddAccessAllowedAce@16
968 RtlAddAtomToAtomTable@12
970 ;RtlAllocateAndInitializeSid
972 RtlAnsiCharToUnicodeChar@4
973 RtlAnsiStringToUnicodeSize@4=RtlxAnsiStringToUnicodeSize@4
974 RtlAnsiStringToUnicodeString@12
975 RtlAppendAsciizToString@8
976 RtlAppendStringToString@8
977 RtlAppendUnicodeStringToString@8
978 RtlAppendUnicodeToString@8
979 RtlAreAllAccessesGranted@8
980 RtlAreAnyAccessesGranted@8
985 RtlCaptureStackBackTrace@16
987 RtlCheckRegistryKey@8
992 RtlCompareMemoryUlong@12
994 RtlCompareUnicodeString@12
997 RtlConvertLongToLargeInteger@4
998 RtlConvertSidToUnicodeString@12
999 RtlConvertUlongToLargeInteger@4
1004 RtlCopyUnicodeString@8
1006 RtlCreateAtomTable@8
1008 RtlCreateRegistryKey@8
1009 RtlCreateSecurityDescriptor@8
1010 RtlCreateSystemVolumeInformationFolder@4
1011 RtlCreateUnicodeString@8
1012 RtlCustomCPToUnicodeN@24
1013 RtlDecompressBuffer@24
1014 RtlDecompressChunks@28
1015 RtlDecompressFragment@32
1018 RtlDeleteAtomFromAtomTable@8
1019 RtlDeleteElementGenericTable@8
1020 RtlDeleteElementGenericTableAvl@8
1022 RtlDeleteOwnersRanges@8
1024 RtlDeleteRegistryValue@12
1026 RtlDestroyAtomTable@4
1028 RtlDowncaseUnicodeString@12
1029 RtlDuplicateUnicodeString@12
1031 RtlEnlargedIntegerMultiply@8
1032 RtlEnlargedUnsignedDivide@16
1033 RtlEnlargedUnsignedMultiply@8
1034 RtlEnumerateGenericTable@8
1035 RtlEnumerateGenericTableAvl@8
1036 RtlEnumerateGenericTableLikeADirectory@28
1037 RtlEnumerateGenericTableWithoutSplaying@8
1038 RtlEnumerateGenericTableWithoutSplayingAvl@8
1042 RtlEqualUnicodeString@12
1043 RtlExtendedIntegerMultiply@12
1044 RtlExtendedLargeIntegerDivide@16
1045 RtlExtendedMagicDivide@20
1047 RtlFillMemoryUlong@12
1049 RtlFindClearBitsAndSet@12
1051 RtlFindFirstRunClear@8
1052 RtlFindFirstRunSet@8
1053 RtlFindLastBackwardRunClear@12
1054 RtlFindLeastSignificantBit@8
1055 RtlFindLongestRunClear@8
1056 RtlFindLongestRunSet@8
1058 RtlFindMostSignificantBit@8
1059 RtlFindNextForwardRunClear@12
1062 RtlFindSetBitsAndClear@12
1063 RtlFindUnicodePrefix@12
1064 RtlFormatCurrentUserKeyPath@4
1069 RtlFreeUnicodeString@4
1071 RtlGenerate8dot3Name@16
1073 RtlGetCallersAddress@8
1074 RtlGetCompressionWorkSpaceSize@12
1075 RtlGetDaclSecurityDescriptor@16
1076 RtlGetDefaultCodePage@8
1077 RtlGetElementGenericTable@8
1078 RtlGetElementGenericTableAvl@8
1080 RtlGetGroupSecurityDescriptor@12
1082 RtlGetNtGlobalFlags@0
1083 RtlGetOwnerSecurityDescriptor@12
1084 RtlGetSaclSecurityDescriptor@16
1085 RtlGetSetBootStatusData@24
1087 RtlHashUnicodeString@16
1089 RtlImageDirectoryEntryToData@16
1091 RtlInitCodePageTable@8
1093 RtlInitUnicodeString@8
1094 RtlInitializeBitMap@12
1095 RtlInitializeGenericTable@20
1096 RtlInitializeGenericTableAvl@20
1097 RtlInitializeRangeList@4
1099 RtlInitializeUnicodePrefix@4
1100 RtlInsertElementGenericTable@16
1101 RtlInsertElementGenericTableAvl@16
1102 RtlInsertElementGenericTableFull@24
1103 RtlInsertElementGenericTableFullAvl@24
1104 RtlInsertUnicodePrefix@12
1105 RtlInt64ToUnicodeString@16
1107 RtlIntegerToUnicode@16
1108 RtlIntegerToUnicodeString@12
1109 RtlInvertRangeList@8
1110 RtlIpv4AddressToStringA@8
1111 RtlIpv4AddressToStringExA@16
1112 RtlIpv4AddressToStringExW@16
1113 RtlIpv4AddressToStringW@8
1114 RtlIpv4StringToAddressA@16
1115 RtlIpv4StringToAddressExA@16
1116 RtlIpv4StringToAddressExW@16
1117 RtlIpv4StringToAddressW@16
1118 RtlIpv6AddressToStringA@8
1119 RtlIpv6AddressToStringExA@16
1120 RtlIpv6AddressToStringExW@16
1121 RtlIpv6AddressToStringW@8
1122 RtlIpv6StringToAddressA@12
1123 RtlIpv6StringToAddressExA@16
1124 RtlIpv6StringToAddressExW@16
1125 RtlIpv6StringToAddressW@12
1126 RtlIsGenericTableEmpty@4
1127 RtlIsGenericTableEmptyAvl@4
1128 RtlIsNameLegalDOS8Dot3@12
1129 RtlIsRangeAvailable@40
1130 RtlIsValidOemCharacter@4
1131 RtlLargeIntegerAdd@16
1132 RtlLargeIntegerArithmeticShift@12
1133 RtlLargeIntegerDivide@20
1134 RtlLargeIntegerNegate@8
1135 RtlLargeIntegerShiftLeft@12
1136 RtlLargeIntegerShiftRight@12
1137 RtlLargeIntegerSubtract@16
1138 RtlLengthRequiredSid@4
1139 RtlLengthSecurityDescriptor@4
1141 RtlLockBootStatusData@4
1142 RtlLookupAtomInAtomTable@12
1143 RtlLookupElementGenericTable@8
1144 RtlLookupElementGenericTableAvl@8
1145 RtlLookupElementGenericTableFull@16
1146 RtlLookupElementGenericTableFullAvl@16
1148 RtlMapSecurityErrorToNtStatus@4
1149 RtlMergeRangeLists@16
1151 RtlMultiByteToUnicodeN@20
1152 RtlMultiByteToUnicodeSize@12
1153 RtlNextUnicodePrefix@8
1154 RtlNtStatusToDosError@4
1155 RtlNtStatusToDosErrorNoTeb@4
1156 RtlNumberGenericTableElements@4
1157 RtlNumberGenericTableElementsAvl@4
1158 RtlNumberOfClearBits@4
1159 RtlNumberOfSetBits@4
1160 RtlOemStringToCountedUnicodeString@12
1161 RtlOemStringToUnicodeSize@4=RtlxOemStringToUnicodeSize@4
1162 RtlOemStringToUnicodeString@12
1164 RtlPinAtomInAtomTable@8
1165 @RtlPrefetchMemoryNonTemporal@8
1167 RtlPrefixUnicodeString@12
1168 RtlQueryAtomInAtomTable@24
1169 RtlQueryRegistryValues@20
1170 RtlQueryTimeZoneInformation@4
1174 RtlRealPredecessor@4
1176 RtlRemoveUnicodePrefix@8
1178 RtlSecondsSince1970ToTime@8
1179 RtlSecondsSince1980ToTime@8
1180 RtlSelfRelativeToAbsoluteSD2@8
1181 RtlSelfRelativeToAbsoluteSD@44
1185 RtlSetDaclSecurityDescriptor@16
1186 RtlSetGroupSecurityDescriptor@12
1187 RtlSetOwnerSecurityDescriptor@12
1188 RtlSetSaclSecurityDescriptor@16
1189 RtlSetTimeZoneInformation@4
1193 RtlSubAuthorityCountSid@4
1194 RtlSubAuthoritySid@8
1195 RtlSubtreePredecessor@4
1196 RtlSubtreeSuccessor@4
1198 RtlTimeFieldsToTime@8
1199 RtlTimeToElapsedTimeFields@8
1200 RtlTimeToSecondsSince1970@8
1201 RtlTimeToSecondsSince1980@8
1202 RtlTimeToTimeFields@8
1204 @RtlUlonglongByteSwap@8
1205 RtlUnicodeStringToAnsiSize@4=RtlxUnicodeStringToAnsiSize@4
1206 RtlUnicodeStringToAnsiString@12
1207 RtlUnicodeStringToCountedOemString@12
1208 RtlUnicodeStringToInteger@12
1209 RtlUnicodeStringToOemSize@4=RtlxUnicodeStringToOemSize@4
1210 RtlUnicodeStringToOemString@12
1211 RtlUnicodeToCustomCPN@24
1212 RtlUnicodeToMultiByteN@20
1213 RtlUnicodeToMultiByteSize@12
1215 RtlUnlockBootStatusData@4
1217 RtlUpcaseUnicodeChar@4
1218 RtlUpcaseUnicodeString@12
1219 RtlUpcaseUnicodeStringToAnsiString@12
1220 RtlUpcaseUnicodeStringToCountedOemString@12
1221 RtlUpcaseUnicodeStringToOemString@12
1222 RtlUpcaseUnicodeToCustomCPN@24
1223 RtlUpcaseUnicodeToMultiByteN@20
1224 RtlUpcaseUnicodeToOemN@20
1227 @RtlUshortByteSwap@4
1228 RtlValidRelativeSecurityDescriptor@12
1229 RtlValidSecurityDescriptor@4
1231 RtlVerifyVersionInfo@16
1232 RtlVolumeDeviceToDosName@8
1233 RtlWalkFrameChain@12
1234 RtlWriteRegistryValue@24
1237 RtlxAnsiStringToUnicodeSize@4
1238 RtlxOemStringToUnicodeSize@4
1239 RtlxUnicodeStringToAnsiSize@4
1240 RtlxUnicodeStringToOemSize@4
1242 SeAppendPrivileges@8
1244 SeAssignSecurityEx@36
1245 SeAuditHardLinkCreation@12
1246 SeAuditingFileEvents@8
1247 SeAuditingFileEventsWithContext@12
1248 SeAuditingFileOrGlobalEvents@12
1249 SeAuditingHardLinkEvents@8
1250 SeAuditingHardLinkEventsWithContext@12
1251 SeCaptureSecurityDescriptor@20
1252 SeCaptureSubjectContext@4
1253 SeCloseObjectAuditAlarm@12
1254 SeCreateAccessState@16
1255 SeCreateClientSecurity@16
1256 SeCreateClientSecurityFromSubjectContext@16
1257 SeDeassignSecurity@4
1258 SeDeleteAccessState@4
1259 SeDeleteObjectAuditAlarm@8
1263 SeImpersonateClient@8
1264 SeImpersonateClientEx@8
1265 SeLockSubjectContext@4
1266 SeMarkLogonSessionForTerminationNotification@4
1267 SeOpenObjectAuditAlarm@36
1268 SeOpenObjectForDeleteAuditAlarm@36
1270 SePrivilegeObjectAuditAlarm@24
1271 SePublicDefaultDacl DATA
1272 SeQueryAuthenticationIdToken@8
1273 SeQueryInformationToken@12
1274 SeQuerySecurityDescriptorInfo@16
1275 SeQuerySessionIdToken@8
1276 SeRegisterLogonSessionTerminatedRoutine@4
1277 SeReleaseSecurityDescriptor@12
1278 SeReleaseSubjectContext@4
1279 SeSetAccessStateGenericMapping@8
1280 SeSetSecurityDescriptorInfo@24
1281 SeSetSecurityDescriptorInfoEx@28
1282 SeSinglePrivilegeCheck@12
1283 SeSystemDefaultDacl DATA
1284 SeTokenImpersonationLevel@4
1286 SeTokenIsRestricted@4
1287 SeTokenIsWriteRestricted@4
1289 SeUnlockSubjectContext@4
1290 SeUnregisterLogonSessionTerminatedRoutine@4
1291 SeValidSecurityDescriptor@8
1292 VerSetConditionMask@16
1293 WRITE_REGISTER_UCHAR@8
1294 WRITE_REGISTER_ULONG@8
1295 WRITE_REGISTER_USHORT@8
1296 WRITE_REGISTER_BUFFER_UCHAR@12
1297 WRITE_REGISTER_BUFFER_ULONG@12
1298 WRITE_REGISTER_BUFFER_USHORT@12
1299 ZwAccessCheckAndAuditAlarm@44
1301 ZwAdjustPrivilegesToken@24
1303 ZwAllocateVirtualMemory@24
1304 ZwAssignProcessToJobObject@8
1309 ZwCloseObjectAuditAlarm@12
1311 ZwCreateDirectoryObject@12
1314 ZwCreateJobObject@12
1317 ZwCreateSymbolicLinkObject@16
1323 ZwDeviceIoControlFile@40
1325 ZwDuplicateObject@28
1327 ZwEnumerateBootEntries@8
1329 ZwEnumerateValueKey@24
1330 ZwFlushInstructionCache@12
1332 ZwFlushVirtualMemory@16
1333 ZwFreeVirtualMemory@16
1335 ZwInitiatePowerAction@16
1339 ZwMakeTemporaryObject@4
1340 ZwMapViewOfSection@40
1341 ZwNotifyChangeKey@40
1342 ZwOpenDirectoryObject@12
1348 ZwOpenProcessToken@12
1349 ZwOpenProcessTokenEx@16
1351 ZwOpenSymbolicLinkObject@12
1353 ZwOpenThreadToken@16
1354 ZwOpenThreadTokenEx@20
1356 ZwPowerInformation@20
1358 ZwQueryBootEntryOrder@8
1359 ZwQueryBootOptions@8
1360 ZwQueryDefaultLocale@8
1361 ZwQueryDefaultUILanguage@4
1362 ZwQueryDirectoryFile@44
1363 ZwQueryDirectoryObject@28
1365 ZwQueryFullAttributesFile@8
1366 ZwQueryInformationAtom@20
1367 ZwQueryInformationFile@20
1368 ZwQueryInformationJobObject@20
1369 ZwQueryInformationProcess@20
1370 ZwQueryInformationThread@20
1371 ZwQueryInformationToken@20
1372 ZwQueryInstallUILanguage@4
1376 ZwQuerySecurityObject@20
1377 ZwQuerySymbolicLinkObject@12
1378 ZwQuerySystemInformation@16
1381 ZwQueryVolumeInformationFile@20
1384 ZwRequestWaitReplyPort@12
1389 ZwSetBootEntryOrder@8
1391 ZwSetDefaultLocale@8
1392 ZwSetDefaultUILanguage@4
1395 ZwSetInformationFile@20
1396 ZwSetInformationJobObject@16
1397 ZwSetInformationObject@16
1398 ZwSetInformationProcess@16
1399 ZwSetInformationThread@16
1400 ZwSetSecurityObject@12
1401 ZwSetSystemInformation@12
1405 ZwSetVolumeInformationFile@20
1406 ZwTerminateJobObject@8
1407 ZwTerminateProcess@8
1408 ZwTranslateFilePath@12
1411 ZwUnmapViewOfSection@8
1412 ZwWaitForMultipleObjects@20
1413 ZwWaitForSingleObject@12
1416 _abnormal_termination