1 ; $Id: ntoskrnl.def,v 1.185 2004/07/17 05:13:05 ion Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
13 CcGetFileObjectFromSectionPtrs@4
16 CcSetDirtyPinnedData@8
21 DbgBreakPointWithStatus@4
22 ;DbgLoadImageSymbols@12
26 @ExAcquireFastMutexUnsafe@4
27 ExAcquireResourceExclusive@8
28 ExAcquireResourceExclusiveLite@8
29 ExAcquireResourceSharedLite@8
30 ExAcquireSharedStarveExclusive@8
31 ExAcquireSharedWaitForExclusive@8
32 @ExAllocateFromPagedLookasideList@4
34 ExAllocatePoolWithQuota@8
35 ExAllocatePoolWithQuotaTag@12
36 ExAllocatePoolWithTag@12
37 ExConvertExclusiveToSharedLite@4
39 ExDeleteNPagedLookasideList@4
40 ExDeletePagedLookasideList@4
42 ExDeleteResourceLite@4
43 ExDesktopObjectType DATA
44 ExDisableResourceBoostLite@4
45 ExEventObjectType DATA
49 ExFreeToPagedLookasideList@8
50 ExGetExclusiveWaiterCount@4
52 ExGetSharedWaiterCount@4
53 ExInitializeNPagedLookasideList@28
54 ExInitializePagedLookasideList@28
55 ExInitializeResource@4
56 ExInitializeResourceLite@4
58 ExInterlockedAddLargeInteger@16
59 @ExInterlockedAddLargeStatistic@8
60 @ExInterlockedAddUlong@12
61 @ExInterlockedCompareExchange64@16
62 ExInterlockedDecrementLong@8
63 ExInterlockedExchangeUlong@12
64 ExInterlockedExtendZone@16
65 ExInterlockedIncrementLong@8
66 @ExInterlockedInsertHeadList@12
67 @ExInterlockedInsertTailList@12
68 @ExInterlockedPopEntryList@8
69 @ExInterlockedPopEntrySList@8
70 @ExInterlockedPushEntryList@12
71 @ExInterlockedPushEntrySList@12
72 @ExInterlockedRemoveHeadList@8
73 ExIsProcessorFeaturePresent@4
74 ExIsResourceAcquiredExclusiveLite@4
75 ExIsResourceAcquiredSharedLite@4
76 ExLocalTimeToSystemTime@8
81 ExRaiseAccessViolation@0
82 ExRaiseDatatypeMisalignment@0
87 ExReinitializeResourceLite@4
88 @ExReleaseFastMutexUnsafe@4
89 ExReleaseResourceForThread@8
90 ExReleaseResourceForThreadLite@8
91 @ExReleaseResourceLite@4
92 ExSetResourceOwnerPointer@8
93 ;ExSystemExceptionFilter
94 ExSystemTimeToLocalTime@8
95 ExTryToAcquireResourceExclusiveLite@4
96 ExUnregisterCallback@4
97 ExWindowStationObjectType DATA
98 ExInitializeBinaryTree@12
100 ExInsertBinaryTree@12
101 ExSearchBinaryTree@12
102 ExRemoveBinaryTree@12
103 ExTraverseBinaryTree@16
104 ExInitializeSplayTree@16
109 ExWeightOfSplayTree@8
110 ExTraverseSplayTree@16
111 ExInitializeHashTable@16
116 @ExfInterlockedAddUlong@12
117 @ExfInterlockedInsertHeadList@12
118 @ExfInterlockedInsertTailList@12
119 @ExfInterlockedPopEntryList@8
120 @ExfInterlockedPushEntryList@12
121 @ExfInterlockedRemoveHeadList@8
122 @Exfi386InterlockedDecrementLong@4
123 @Exfi386InterlockedExchangeUlong@8
124 @Exfi386InterlockedIncrementLong@4
125 Exi386InterlockedDecrementLong@4
126 Exi386InterlockedExchangeUlong@8
127 Exi386InterlockedIncrementLong@4
128 FsRtlAddLargeMcbEntry@28
130 FsRtlAddToTunnelCache@32
131 FsRtlAllocateFileLock@8
133 FsRtlAllocatePoolWithQuota@8
134 FsRtlAllocatePoolWithQuotaTag@12
135 FsRtlAllocatePoolWithTag@12
136 FsRtlAllocateResource@0
137 FsRtlAreNamesEqual@16
139 FsRtlCheckLockForReadAccess@8
140 FsRtlCheckLockForWriteAccess@8
144 FsRtlCurrentBatchOplock@4
145 FsRtlDeleteKeyFromTunnelCache@12
146 FsRtlDeleteTunnelCache@4
147 FsRtlDeregisterUncProvider@4
150 FsRtlDoesDbcsContainWildCards@4
151 FsRtlDoesNameContainWildCards@4
152 FsRtlFastCheckLockForRead@24
153 FsRtlFastCheckLockForWrite@24
154 FsRtlFastUnlockAll@16
155 FsRtlFastUnlockAllByKey@20
156 FsRtlFastUnlockSingle@32
157 FsRtlFindInTunnelCache@32
159 FsRtlGetNextFileLock@8
160 FsRtlGetNextLargeMcbEntry@20
161 FsRtlGetNextMcbEntry@20
162 FsRtlInitializeFileLock@12
163 FsRtlInitializeLargeMcb@8
165 FsRtlInitializeOplock@4
166 FsRtlInitializeTunnelCache@4
167 FsRtlIsDbcsInExpression@8
168 FsRtlIsFatDbcsLegal@20
169 FsRtlIsHpfsDbcsLegal@20
170 FsRtlIsNameInExpression@16
171 FsRtlIsNtstatusExpected@4
172 FsRtlIsTotalDeviceFailure@4
173 FsRtlLegalAnsiCharacterArray DATA
174 FsRtlLookupLargeMcbEntry@32
175 FsRtlLookupLastLargeMcbEntry@12
176 FsRtlLookupLastMcbEntry@12
177 FsRtlLookupMcbEntry@20
179 FsRtlMdlReadComplete@8
180 FsRtlMdlReadCompleteDev@12
182 FsRtlMdlWriteComplete@12
183 FsRtlMdlWriteCompleteDev@16
184 FsRtlNormalizeNtstatus@8
185 FsRtlNotifyChangeDirectory@28
186 FsRtlNotifyCleanup@12
187 FsRtlNotifyFullChangeDirectory@40
188 FsRtlNotifyFullReportChange@36
189 FsRtlNotifyInitializeSync@4
190 FsRtlNotifyReportChange@20
191 FsRtlNotifyUninitializeSync@4
192 FsRtlNotifyVolumeEvent@8
193 FsRtlNumberOfRunsInLargeMcb@4
194 FsRtlNumberOfRunsInMcb@4
196 FsRtlOplockIsFastIoPossible@4
197 FsRtlPostPagingFileStackOverflow@12
198 FsRtlPostStackOverflow@12
199 FsRtlPrepareMdlWrite@24
200 FsRtlPrepareMdlWriteDev@28
202 FsRtlProcessFileLock@12
203 FsRtlRegisterUncProvider@12
204 FsRtlRemoveLargeMcbEntry@20
205 FsRtlRemoveMcbEntry@12
206 FsRtlSplitLargeMcb@20
208 FsRtlTruncateLargeMcb@12
210 FsRtlUninitializeFileLock@4
211 FsRtlUninitializeLargeMcb@4
212 FsRtlUninitializeMcb@4
213 FsRtlUninitializeOplock@4
214 HalDispatchTable DATA
215 HalPrivateDispatchTable DATA
216 InbvAcquireDisplayOwnership@0
217 InbvCheckDisplayOwnership@0
219 InbvEnableBootDriver@4
220 InbvEnableDisplayString@4
221 InbvInstallDisplayStringFilter@4
222 InbvIsBootDriverInstalled@0
223 InbvNotifyDisplayOwnershipLost@4
225 InbvSetScrollRegion@16
227 InbvSolidColorFill@20
228 @InterlockedCompareExchange@12
229 @InterlockedDecrement@4
230 @InterlockedExchange@8
231 @InterlockedExchangeAdd@8
232 @InterlockedIncrement@4
233 @InterlockedPopEntrySList@4
234 @InterlockedPushEntrySList@8
235 IoAcquireCancelSpinLock@4
236 IoAcquireRemoveLockEx@20
237 IoAcquireVpbSpinLock@4
238 IoAdapterObjectType DATA
239 IoAllocateAdapterChannel@20
240 IoAllocateController@16
241 IoAllocateDriverObjectExtension@16
242 IoAllocateErrorLogEntry@8
248 IoAttachDeviceByPointer@8
249 IoAttachDeviceToDeviceStack@8
250 IoBuildAsynchronousFsdRequest@24
251 IoBuildDeviceIoControlRequest@36
253 IoBuildSynchronousFsdRequest@28
256 IoCheckDesiredAccess@8
257 IoCheckEaBufferValidity@12
258 IoCheckFunctionAccess@24
259 IoCheckShareAccess@20
261 IoConnectInterrupt@44
265 IoCreateNotificationEvent@8
266 IoCreateStreamFileObject@8
267 IoCreateSymbolicLink@8
268 IoCreateSynchronizationEvent@8
269 IoCreateUnprotectedSymbolicLink@8
272 IoDeleteSymbolicLink@4
274 IoDeviceHandlerObjectSize DATA
275 IoDeviceHandlerObjectType DATA
276 IoDisconnectInterrupt@4
277 IoDeviceObjectType DATA
278 IoDriverObjectType DATA
280 IoFastQueryNetworkAttributes@20
281 IoFileObjectType DATA
286 IoGetAttachedDevice@4
287 IoGetAttachedDeviceReference@4
288 IoGetBaseFileSystemDeviceObject@4
289 IoGetConfigurationInformation@0
290 IoGetCurrentProcess@0
291 IoGetDriverObjectExtension@8
292 IoGetDeviceObjectPointer@16
293 IoGetDeviceProperty@20
294 IoGetDeviceToVerify@4
295 IoGetFileObjectGenericMapping@0
297 IoGetRelatedDeviceObject@4
298 IoGetRequestorProcess@4
302 IoInvalidateDeviceRelations@8
303 IoInvalidateDeviceState@4
304 IoInitializeRemoveLockEx@20
306 IoIsOperationSynchronous@4
307 IoMakeAssociatedIrp@8
308 IoOpenDeviceInstanceKey@20
309 IoOpenDeviceRegistryKey@16
311 IoQueryDeviceDescription@32
312 IoQueryDeviceEnumInfo@8
313 IoQueryFileInformation@20
314 IoQueryVolumeInformation@20
318 IoRaiseInformationalHardError@12
319 IoReadOperationCount DATA
320 IoReadPartitionTable@16
321 IoReadTransferCount DATA
322 IoRegisterDeviceInterface@16
323 IoRegisterDriverReinitialization@12
324 IoRegisterFileSystem@4
325 IoRegisterFsRegistrationChange@8
326 IoRegisterShutdownNotification@4
327 IoReleaseCancelSpinLock@4
328 IoReleaseRemoveLockAndWaitEx@12
329 IoReleaseRemoveLockEx@12
330 IoReleaseVpbSpinLock@4
331 IoRemoveShareAccess@8
332 IoReportHalResourceUsage@16
333 IoReportResourceUsage@36
334 IoSetDeviceInterfaceState@8
335 IoSetDeviceToVerify@8
336 IoSetHardErrorOrVerifyDevice@8
338 IoSetPartitionInformation@16
340 IoSetThreadHardErrorMode@4
343 IoStartNextPacketByKey@12
346 IoStatisticsLock DATA
348 IoSynchronousPageWrite@20
350 IoUnregisterFileSystem@4
351 IoUnregisterFsRegistrationChange@8
352 IoUnregisterShutdownNotification@4
353 IoUpdateShareAccess@8
355 IoWriteErrorLogEntry@4
356 IoWriteOperationCount DATA
357 IoWritePartitionTable@20
358 IoWriteTransferCount DATA
360 @IofCompleteRequest@8
361 KdDebuggerEnabled DATA
362 KdDebuggerNotPresent DATA
364 KdSystemDebugControl@4
366 Ke386IoSetAccessProcess@8
367 Ke386QueryIoAccessMap@8
368 Ke386SetIoAccessMap@8
369 KeAcquireSpinLockAtDpcLevel@4
370 KeAddSystemServiceTable@20
372 ;KeBoostCurrentThread
378 KeDcacheFlushCount DATA
379 KeDelayExecutionThread@12
380 KeDeregisterBugCheckCallback@4
382 KeDisconnectInterrupt@4
383 KeEnterCriticalRegion@0
384 KeEnterKernelDebugger@0
385 ;KeFindConfigurationEntry
386 ;KeFindConfigurationNextEntry
391 ;KeI386AllocateGdtSelectors
392 ;KeI386Call16BitCStyleFunction
393 ;KeI386Call16BitFunction
394 ;KeI386FlatToGdtSelector
396 ;KeI386MachineType DATA
397 ;KeI386ReleaseGdtSelectors
399 ;KeI386SetGdtSelector
400 KeIcacheFlushCount DATA
402 KeInitializeDeviceQueue@4
405 KeInitializeInterrupt@44
409 KeInitializeSemaphore@12
410 KeInitializeSpinLock@4
412 KeInitializeTimerEx@8
413 KeInsertByKeyDeviceQueue@12
414 KeInsertDeviceQueue@8
420 KeLeaveCriticalRegion@0
422 KeNumberProcessors DATA
424 ;KeProfileInterruptWithSource
428 KeQueryTimeIncrement@0
429 ;KeRaiseUserException
435 KeReadStateSemaphore@4
437 KeRegisterBugCheckCallback@20
440 KeReleaseSemaphore@16
441 KeReleaseSpinLockFromDpcLevel@4
442 KeRemoveByKeyDeviceQueue@8
443 KeRemoveDeviceQueue@4
444 KeRemoveEntryDeviceQueue@8
448 KeRestoreFloatingPointState@4
450 KeSaveFloatingPointState@4
451 KeServiceDescriptorTable DATA
452 KeSetAffinityThread@8
453 KeSetBasePriorityThread@8
456 ;KeSetEventBoostPriority
457 ;KeSetIdealProcessorThread
459 ;KeSetKernelStackSwapEnable
460 KeSetPriorityThread@8
462 ;@KeSetSwapContextNotifyRoutine
463 KeSetTargetProcessorDpc@8
464 ;@KeSetThreadSelectNotifyRoutine
468 ;@KeSetTimeUpdateNotifyRoutine
469 KeSynchronizeExecution@12
474 KeWaitForMultipleObjects@32
475 KeWaitForMutexObject@20
476 KeWaitForSingleObject@20
477 @KefAcquireSpinLockAtDpcLevel@4=KefAcquireSpinLockAtDpcLevel
478 @KefReleaseSpinLockFromDpcLevel@4=KefReleaseSpinLockFromDpcLevel
482 ;KiCoprocessorError@0
484 KiDispatchInterrupt@0
485 KiInterruptDispatch2@8
486 ;KiIpiServiceRoutine@8
488 ;KiUnexpectedInterrupt
489 ;Kii386SpinOnSpinLock
493 ;LdrFindResourceDirectory_U@16
496 LsaCallAuthenticationPackage@28
497 LsaDeregisterLogonProcess@8
498 LsaFreeReturnBuffer@4
500 LsaLookupAuthenticationPackage@12
501 LsaRegisterLogonProcess@12
502 Mm64BitPhysicalAddress DATA
503 MmAddPhysicalMemory@8
504 MmAddVerifierThunks@8
506 MmAllocateMappingAddress@8
507 MmFreeMappingAddress@8
508 MmGetPhysicalMemoryRanges@0
509 MmGetSystemRoutineAddress@4
510 MmGetVirtualForPhysical@8
511 MmIsDriverVerifying@4
512 MmIsVerifierEnabled@4
513 MmMapLockedPagesWithReservedMapping@16
514 MmMapUserAddressesToPage@12
515 MmMapViewInSessionSpace@12
516 MmMarkPhysicalMemoryAsBad@8
517 MmMarkPhysicalMemoryAsGood@8
519 MmProbeAndLockProcessPages@16
520 MmProbeAndLockSelectedPages@16
521 MmProtectMdlSystemAddress@8
522 MmRemovePhysicalMemory@8
523 MmSystemRangeStart DATA
524 MmUnmapReservedMapping@12
525 MmUnmapViewInSessionSpace@4
526 MmAdjustWorkingSetSize@12
527 MmAllocateContiguousAlignedMemory@36
528 MmAllocateContiguousMemory@12
529 MmAllocateContiguousMemorySpecifyCache@32
530 MmAllocateNonCachedMemory@4
531 MmAllocatePagesForMdl@28
532 MmBuildMdlForNonPagedPool@4
533 MmCanFileBeTruncated@8
538 MmDbgTranslatePhysicalAddress@8
539 MmDisableModifiedWriteOfSection@4
540 MmFlushImageSection@8
541 MmForceSectionClosed@8
542 MmFreeContiguousMemory@4
543 MmFreeContiguousMemorySpecifyCache@12
544 MmFreeNonCachedMemory@8
546 MmGetPhysicalAddress@4
548 MmHighestUserAddress DATA
550 MmIsNonPagedSystemAddressValid@4
551 MmIsRecursiveIoFault@0
552 MmIsThisAnNtAsSystem@0
553 MmLockPagableDataSection@4
554 MmLockPagableImageSection@4=MmLockPagableDataSection@4
555 MmLockPagableSectionByHandle@4
558 MmMapLockedPagesSpecifyCache@24
561 MmMapViewInSystemSpace@12
562 MmMapViewOfSection@40
564 MmProbeAndLockPages@12
566 MmResetDriverPaging@4
567 MmSectionObjectType DATA
568 MmSecureVirtualMemory@12
569 MmSetAddressRangeModified@8
570 MmSetBankedSection@24
572 MmUnlockPagableImageSection@4
576 MmUnmapVideoDisplay@8
577 MmUnmapViewInSystemSpace@4
578 MmUnmapViewOfSection@8
579 MmUnsecureVirtualMemory@4
580 MmUserProbeAddress DATA
583 NlsMbCodePageTag DATA
584 NlsMbOemCodePageTag DATA
585 NlsOemLeadByteInfo DATA
587 NtAdjustPrivilegesToken@24
589 NtAllocateLocallyUniqueId@4
591 NtAllocateVirtualMemory@24
602 NtDeviceIoControlFile@40
606 NtFreeVirtualMemory@16
610 NtMapViewOfSection@40
611 NtNotifyChangeDirectoryFile@36
614 NtOpenProcessToken@12
615 NtQueryDirectoryFile@44
617 NtQueryInformationAtom@20
618 NtQueryInformationFile@20
619 NtQueryInformationProcess@20
620 NtQueryInformationToken@20
621 ;NtQueryOleDirectoryFile@ <--- ?
622 NtQuerySecurityObject@20
624 NtQueryVolumeInformationFile@20
627 NtRequestWaitReplyPort@12
629 NtSetInformationFile@20
630 NtSetInformationProcess@16
631 NtSetInformationThread@16
632 NtSetSecurityObject@12
637 NtWaitForSingleObject@12
639 tMakePermanentObject@4
640 NtOpenProcessTokenEx@16
643 NtOpenThreadTokenEx@20
644 NtQueryInformationThread@20
645 NtQueryQuotaInformationFile@36
646 NtQuerySystemInformation@16
648 NtSetQuotaInformationFile@16
649 NtSetVolumeInformationFile@20
653 ;ObCheckCreateObjectAccess@28
654 ;ObCheckObjectAccess@20
656 ;ObFindHandleForObject@20
657 ObGetObjectPointerCount@4
658 ObGetObjectSecurity@12
660 ObMakeTemporaryObject@4
661 ObOpenObjectByName@28
662 ObOpenObjectByPointer@28
664 ObQueryObjectAuditingByHandle@8
665 @ObfDereferenceObject@4
666 @ObfReferenceObject@4
667 ObReferenceObjectByHandle@24
668 ObReferenceObjectByName@32
669 ObReferenceObjectByPointer@16
670 ObReleaseObjectSecurity@8
671 ObDereferenceObject@4
672 ;ObSetSecurityDescriptorInfo@24
678 PoRegisterDeviceForIdleDetection@16
679 PoRegisterSystemState@8
684 PoStartNextPowerIrp@4
685 PoUnregisterSystemState@4
688 PsAssignImpersonationToken@8
689 ;PsChargePoolQuota@12
690 PsCreateSystemProcess@12
691 PsCreateSystemThread@28
692 PsCreateWin32Process@4
693 PsEstablishWin32Callouts@24
694 PsGetCurrentProcessId@0
695 PsGetCurrentThreadId@0
696 PsGetProcessExitTime@0
700 PsImpersonateClient@20
701 PsInitialSystemProcess DATA
702 PsIsThreadTerminating@4
703 PsLookupProcessByProcessId@8
704 PsLookupProcessThreadByCid@12
705 PsLookupThreadByThreadId@8
707 PsReferenceImpersonationToken@16
708 PsReferencePrimaryToken@4
709 ;PsReturnPoolQuota@12
711 PsSetCreateProcessNotifyRoutine@8
712 PsSetCreateThreadNotifyRoutine@4
713 ;PsSetLegoNotifyRoutine@4
714 PsSetLoadImageNotifyRoutine@4
715 ;PsSetProcessPriorityByClass@8
716 PsTerminateSystemThread@4
718 READ_REGISTER_UCHAR@4
719 READ_REGISTER_ULONG@4
720 READ_REGISTER_USHORT@4
721 READ_REGISTER_BUFFER_UCHAR@12
722 READ_REGISTER_BUFFER_ULONG@12
723 READ_REGISTER_BUFFER_USHORT@12
725 KeRosDumpStackFrames@8
726 RtlAbsoluteToSelfRelativeSD@12
727 RtlAddAccessAllowedAce@16
729 RtlAddAtomToAtomTable@12
731 ;RtlAllocateAndInitializeSid
733 RtlAnsiCharToUnicodeChar@4
734 RtlAnsiStringToUnicodeSize@4
735 RtlAnsiStringToUnicodeString@12
736 RtlAppendAsciizToString@8
737 RtlAppendStringToString@8
738 RtlAppendUnicodeStringToString@8
739 RtlAppendUnicodeToString@8
740 RtlAreAllAccessesGranted@8
741 RtlAreAnyAccessesGranted@8
745 ;RtlCaptureStackBackTrace
747 RtlCheckRegistryKey@8
751 RtlCompareMemoryUlong@12
753 RtlCompareUnicodeString@12
756 RtlConvertLongToLargeInteger@4
757 RtlConvertSidToUnicodeString@12
758 RtlConvertUlongToLargeInteger@4
763 RtlCopyUnicodeString@8
767 RtlCreateRegistryKey@8
768 RtlCreateSecurityDescriptor@8
769 RtlCreateUnicodeString@8
770 RtlCustomCPToUnicodeN@24
771 RtlDecompressBuffer@24
772 RtlDecompressChunks@28
773 RtlDecompressFragment@32
775 RtlDeleteAtomFromAtomTable@8
776 ;RtlDeleteElementGenericTable
778 RtlDeleteOwnersRanges@8
780 RtlDeleteRegistryValue@12
782 RtlDestroyAtomTable@4
784 RtlDowncaseUnicodeString@12
786 RtlEnlargedIntegerMultiply@8
787 RtlEnlargedUnsignedDivide@16
788 RtlEnlargedUnsignedMultiply@8
789 ;RtlEnumerateGenericTable
790 ;RtlEnumerateGenericTableWithoutSplaying
794 RtlEqualUnicodeString@12
795 RtlExtendedIntegerMultiply@12
796 RtlExtendedLargeIntegerDivide@16
797 RtlExtendedMagicDivide@20
799 RtlFillMemoryUlong@12
801 RtlFindClearBitsAndSet@12
802 RtlFindFirstRunClear@8
804 RtlFindLeastSignificantBit@8
805 RtlFindLongestRunClear@8
806 RtlFindLongestRunSet@8
808 RtlFindMostSignificantBit@8
811 RtlFindSetBitsAndClear@12
812 ;RtlFindUnicodePrefix
813 RtlFormatCurrentUserKeyPath@4
818 RtlFreeUnicodeString@4
819 RtlGenerate8dot3Name@16
820 ;RtlGetCallersAddress
821 RtlGetCompressionWorkSpaceSize@12
822 RtlGetDaclSecurityDescriptor@16
823 RtlGetDefaultCodePage@8
824 ;RtlGetElementGenericTable
826 RtlGetGroupSecurityDescriptor@12
828 RtlGetOwnerSecurityDescriptor@12
831 RtlImageDirectoryEntryToData@16
833 RtlInitCodePageTable@8
835 RtlInitUnicodeString@8
836 RtlInitializeBitMap@12
837 ;RtlInitializeGenericTable
838 RtlInitializeRangeList@4
840 ;RtlInitializeUnicodePrefix
841 ;RtlInsertElementGenericTable
842 ;RtlInsertUnicodePrefix
844 RtlIntegerToUnicodeString@12
846 RtlIsNameLegalDOS8Dot3@12
847 RtlIsRangeAvailable@40
848 RtlLargeIntegerAdd@16
849 RtlLargeIntegerArithmeticShift@12
850 RtlLargeIntegerDivide@20
851 RtlLargeIntegerNegate@8
852 RtlLargeIntegerShiftLeft@12
853 RtlLargeIntegerShiftRight@12
854 RtlLargeIntegerSubtract@16
855 RtlLengthRequiredSid@4
856 RtlLengthSecurityDescriptor@4
858 RtlLookupAtomInAtomTable@12
859 ;RtlLookupElementGenericTable
861 RtlMergeRangeLists@16
863 RtlMultiByteToUnicodeN@20
864 RtlMultiByteToUnicodeSize@12
865 ;RtlNextUnicodePrefix
866 RtlNtStatusToDosError@4
867 RtlNtStatusToDosErrorNoTeb@4
868 ;RtlNumberGenericTableElements
869 RtlNumberOfClearBits@4
871 RtlOemStringToCountedUnicodeString@12
872 RtlOemStringToUnicodeSize@4
873 RtlOemStringToUnicodeString@12
875 RtlPinAtomInAtomTable@8
877 RtlPrefixUnicodeString@12
878 RtlQueryAtomInAtomTable@24
879 RtlQueryRegistryValues@20
880 RtlQueryTimeZoneInformation@4
883 ;RtlRemoveUnicodePrefix
885 RtlSecondsSince1970ToTime@8
886 RtlSecondsSince1980ToTime@8
889 RtlSetDaclSecurityDescriptor@16
890 RtlSetGroupSecurityDescriptor@12
891 RtlSetOwnerSecurityDescriptor@12
892 RtlSetSaclSecurityDescriptor@16
893 RtlSetTimeZoneInformation@4
895 RtlSubAuthorityCountSid@4
897 RtlTimeFieldsToTime@8
898 RtlTimeToSecondsSince1970@8
899 RtlTimeToSecondsSince1980@8
900 RtlTimeToTimeFields@8
902 @RtlUlonglongByteSwap@8
903 RtlUnicodeStringToAnsiSize@4
904 RtlUnicodeStringToAnsiString@12
905 RtlUnicodeStringToCountedOemString@12
906 RtlUnicodeStringToInteger@12
907 RtlUnicodeStringToOemSize@4
908 RtlUnicodeStringToOemString@12
909 RtlUnicodeToCustomCPN@24
910 RtlUnicodeToMultiByteN@20
911 RtlUnicodeToMultiByteSize@12
914 RtlUpcaseUnicodeChar@4
915 RtlUpcaseUnicodeString@12
916 RtlUpcaseUnicodeStringToAnsiString@12
917 RtlUpcaseUnicodeStringToCountedOemString@12
918 RtlUpcaseUnicodeStringToOemString@12
919 RtlUpcaseUnicodeToCustomCPN@24
920 RtlUpcaseUnicodeToMultiByteN@20
921 RtlUpcaseUnicodeToOemN@20
925 RtlValidSecurityDescriptor@4
927 RtlWriteRegistryValue@24
930 RtlxAnsiStringToUnicodeSize@4
931 RtlxOemStringToUnicodeSize@4
932 RtlxUnicodeStringToAnsiSize@4
933 RtlxUnicodeStringToOemSize@4
935 ;SeAppendPrivileges@8
937 ;SeAuditingFileEvents@8
938 ;SeAuditingFileOrGlobalEvents@18
939 ;SeCaptureSecurityDescriptor@20
940 SeCaptureSubjectContext@4
941 ;SeCloseObjectAuditAlarm@12
942 ;SeCreateAccessState@16
943 SeCreateClientSecurity@16
945 ;SeDeleteAccessState@4
946 SeDeleteObjectAuditAlarm@8
949 SeImpersonateClient@8
950 SeLockSubjectContext@4
951 ;SeMarkLogonSessionForTerminationNotification@4
952 SeOpenObjectAuditAlarm@36
953 SeOpenObjectForDeleteAuditAlarm@36
955 ;SePrivilegeObjectAuditAlarm@24
956 SePublicDefaultDacl DATA
957 SeQueryAuthenticationIdToken@8
958 SeQuerySecurityDescriptorInfo@16
959 ;SeRegisterLogonSessionTerminatedRoutine@4
960 ;SeReleaseSecurityDescriptor@12
961 SeReleaseSubjectContext@4
962 ;SeSetAccessStateGenericMapping@8
963 SeSetSecurityDescriptorInfo@24
964 SeSinglePrivilegeCheck@12
965 SeSystemDefaultDacl DATA
966 SeTokenImpersonationLevel@4
968 SeUnlockSubjectContext@4
969 ;SeUnregisterLogonSessionTerminatedRoutine@4
970 SeValidSecurityDescriptor@8
971 WRITE_REGISTER_UCHAR@8
972 WRITE_REGISTER_ULONG@8
973 WRITE_REGISTER_USHORT@8
974 WRITE_REGISTER_BUFFER_UCHAR@12
975 WRITE_REGISTER_BUFFER_ULONG@12
976 WRITE_REGISTER_BUFFER_USHORT@12
977 ZwAccessCheckAndAuditAlarm@44
979 ZwAllocateVirtualMemory@24
982 ZwCloseObjectAuditAlarm@12
984 ZwCreateDirectoryObject@12
989 ZwCreateSymbolicLinkObject@16
993 ZwDeviceIoControlFile@40
998 ZwEnumerateValueKey@24
999 ZwFlushInstructionCache@12
1001 ZwFreeVirtualMemory@16
1005 ZwMakeTemporaryObject@4
1006 ZwMapViewOfSection@40
1007 ZwNotifyChangeKey@40
1008 ZwOpenDirectoryObject@12
1013 ZwOpenProcessToken@12
1015 ZwOpenSymbolicLinkObject@12
1017 ZwOpenThreadToken@16
1019 ZwQueryDefaultLocale@8
1020 ZwQueryDirectoryFile@44
1021 ZwQueryInformationAtom@20
1022 ZwQueryInformationFile@20
1023 ZwQueryInformationProcess@20
1024 ZwQueryInformationToken@20
1028 ZwQuerySecurityObject@20
1029 ZwQuerySymbolicLinkObject@12
1030 ZwQuerySystemInformation@16
1033 ZwQueryVolumeInformationFile@20
1036 ZwRequestWaitReplyPort@12
1039 ZwSetDefaultLocale@8
1041 ZwSetInformationFile@20
1042 ZwSetInformationObject@16
1043 ZwSetInformationProcess@16
1044 ZwSetInformationThread@16
1045 ZwSetSystemInformation@12
1048 ZwTerminateProcess@8
1051 ZwUnmapViewOfSection@8
1052 ZwWaitForMultipleObjects@20
1053 ZwWaitForSingleObject@12
1057 ZwAdjustPrivilegesToken@24
1058 ZwAssignProcessToJobObject@8
1061 ZwCreateJobObject@12
1064 ZwEnumerateBootEntries@8
1065 ZwFlushVirtualMemory@16
1066 ZwInitiatePowerAction@16
1069 ZwOpenProcessTokenEx@16
1070 ZwOpenThreadTokenEx@20
1072 ZwPowerInformation@20
1073 ZwQueryBootEntryOrder@8
1074 ZwQueryBootOptions@8
1075 ZwQueryDefaultUILanguage@4
1076 ZwQueryDirectoryObject@28
1078 ZwQueryFullAttributesFile@8
1079 ZwQueryInformationJobObject@20
1080 ZwQueryInformationThread@20
1081 ZwQueryInstallUILanguage@4
1084 ZwSetBootEntryOrder@8
1086 ZwSetDefaultUILanguage@4
1088 ZwSetInformationJobObject@16
1089 ZwSetSecurityObject@12
1091 ZwSetVolumeInformationFile@20
1092 ZwTerminateJobObject@8
1093 ZwTranslateFilePath@12
1094 _abnormal_termination