1 ; $Id: ntoskrnl.def,v 1.191 2004/09/16 11:46:17 ekohl Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
18 CcGetFileObjectFromBcb@4
19 CcGetFileObjectFromSectionPtrs@4
20 CcGetFlushedValidData@8
21 CcGetLsnForFileObject@8
22 CcInitializeCacheMap@20
24 CcFastMdlReadWait DATA
25 CcFastReadNotPossible DATA
36 CcPurgeCacheSection@16
39 CcScheduleReadAhead@12
40 CcSetAdditionalCacheAttributes@12
41 CcSetBcbOwnerPointer@8
42 CcSetDirtyPageThreshold@8
43 CcSetDirtyPinnedData@8
44 CcSetLogHandleForFile@12
45 CcSetReadAheadGranularity@8
46 CcUninitializeCacheMap@12
48 CcUnpinDataForThread@8
50 CcWaitForCurrentLazyWriterActivity@0
55 CmUnRegisterCallback@8
57 DbgBreakPointWithStatus@4
58 DbgLoadImageSymbols@12
62 DbgPrintReturnControlC
63 DbgQueryDebugFilterState@8
64 DbgSetDebugFilterState@12
66 @ExAcquireFastMutexUnsafe@4
67 ExAcquireResourceExclusive@8
68 ExAcquireResourceExclusiveLite@8
69 ExAcquireResourceSharedLite@8
70 @ExAcquireRundownProtection@4
71 @ExAcquireRundownProtectionEx@8
72 ExAcquireSharedStarveExclusive@8
73 ExAcquireSharedWaitForExclusive@8
74 @ExAllocateFromPagedLookasideList@4=@ExiAllocateFromPagedLookasideList@4
76 ExAllocatePoolWithQuota@8
77 ExAllocatePoolWithQuotaTag@12
78 ExAllocatePoolWithTag@12
79 ExAllocatePoolWithTagPriority@16
80 ExConvertExclusiveToSharedLite@4
82 ExDeleteNPagedLookasideList@4
83 ExDeletePagedLookasideList@4
85 ExDeleteResourceLite@4
86 ExDesktopObjectType DATA
87 ExDisableResourceBoostLite@4
89 ExEventObjectType DATA
93 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
94 ExGetCurrentProcessorCounts@12
95 ExGetCurrentProcessorCpuUsage@4
96 ExGetExclusiveWaiterCount@4
98 ExGetSharedWaiterCount@4
99 @ExInitializeRundownProtection@4
100 ExInitializeNPagedLookasideList@28
101 ExInitializePagedLookasideList@28
102 ExInitializeResource@4
103 ExInitializeResourceLite@4
105 ExInterlockedAddLargeInteger@16
106 @ExInterlockedAddLargeStatistic@8
107 @ExInterlockedAddUlong@12
108 @ExInterlockedCompareExchange64@16
109 ExInterlockedDecrementLong@8
110 ExInterlockedExchangeUlong@12
111 ExInterlockedExtendZone@16
112 ExInterlockedIncrementLong@8
113 @ExInterlockedFlushSList@4
114 @ExInterlockedInsertHeadList@12
115 @ExInterlockedInsertTailList@12
116 @ExInterlockedPopEntryList@8
117 @ExInterlockedPopEntrySList@8
118 @ExInterlockedPushEntryList@12
119 @ExInterlockedPushEntrySList@12
120 @ExInterlockedRemoveHeadList@8
121 ExIsProcessorFeaturePresent@4
122 ExIsResourceAcquiredExclusiveLite@4
123 ExIsResourceAcquiredSharedLite@4
124 ExLocalTimeToSystemTime@8
127 ExQueryPoolBlockSize@8
129 ExRaiseAccessViolation@0
130 ExRaiseDatatypeMisalignment@0
134 ExRegisterCallback@12
135 ExReinitializeResourceLite@4
136 @ExReInitializeRundownProtection@4
137 @ExReleaseFastMutexUnsafe@4
138 ExReleaseResourceForThread@8
139 ExReleaseResourceForThreadLite@8
140 @ExReleaseResourceLite@4
141 @ExReleaseRundownProtection@4
142 @ExReleaseRundownProtectionEx@8
143 @ExRundownCompleted@4
144 ExSetResourceOwnerPointer@8
145 ExSetTimerResolution@8
146 ExSystemExceptionFilter@0
147 ExSystemTimeToLocalTime@8
148 ExTryToAcquireResourceExclusiveLite@4
149 ExUnregisterCallback@4
152 @ExWaitForRundownProtectionRelease@4
153 ExWindowStationObjectType DATA
154 ExInitializeBinaryTree@12
156 ExInsertBinaryTree@12
157 ExSearchBinaryTree@12
158 ExRemoveBinaryTree@12
159 ExTraverseBinaryTree@16
160 ExInitializeSplayTree@16
165 ExWeightOfSplayTree@8
166 ExTraverseSplayTree@16
167 ExInitializeHashTable@16
172 @ExfAcquirePushLockExclusive@4
173 @ExfAcquirePushLockShared@4
174 @ExfReleasePushLock@4
175 @ExfInterlockedAddUlong@12
176 @ExfInterlockedInsertHeadList@12
177 @ExfInterlockedInsertTailList@12
178 @ExfInterlockedCompareExchange64@12
179 @ExfInterlockedPopEntryList@8
180 @ExfInterlockedPushEntryList@12
181 @ExfInterlockedRemoveHeadList@8
182 @Exfi386InterlockedDecrementLong@4
183 @Exfi386InterlockedExchangeUlong@8
184 @Exfi386InterlockedIncrementLong@4
185 Exi386InterlockedDecrementLong@4
186 Exi386InterlockedExchangeUlong@8
187 Exi386InterlockedIncrementLong@4
188 FsRtlAcquireFileExclusive@4
189 FsRtlAddLargeMcbEntry@28
191 FsRtlAddToTunnelCache@32
192 FsRtlAllocateFileLock@8
194 FsRtlAllocatePoolWithQuota@8
195 FsRtlAllocatePoolWithQuotaTag@12
196 FsRtlAllocatePoolWithTag@12
197 FsRtlAllocateResource@0
198 FsRtlAreNamesEqual@16
200 FsRtlCheckLockForReadAccess@8
201 FsRtlCheckLockForWriteAccess@8
205 FsRtlCurrentBatchOplock@4
206 FsRtlDeleteKeyFromTunnelCache@12
207 FsRtlDeleteTunnelCache@4
208 FsRtlDeregisterUncProvider@4
211 FsRtlDoesDbcsContainWildCards@4
212 FsRtlDoesNameContainWildCards@4
213 FsRtlFastCheckLockForRead@24
214 FsRtlFastCheckLockForWrite@24
215 FsRtlFastUnlockAll@16
216 FsRtlFastUnlockAllByKey@20
217 FsRtlFastUnlockSingle@32
218 FsRtlFindInTunnelCache@32
221 FsRtlGetNextFileLock@8
222 FsRtlGetNextLargeMcbEntry@20
223 FsRtlGetNextMcbEntry@20
224 FsRtlIncrementCcFastReadNotPossible@0
225 FsRtlIncrementCcFastReadNoWait@0
226 FsRtlIncrementCcFastReadResourceMiss@0
227 FsRtlIncrementCcFastReadWait@0
228 FsRtlInitializeFileLock@12
229 FsRtlInitializeLargeMcb@8
231 FsRtlInitializeOplock@4
232 FsRtlInitializeTunnelCache@4
233 FsRtlInsertPerFileObjectContext@8
234 FsRtlInsertPerStreamContext@8
235 FsRtlIsDbcsInExpression@8
236 FsRtlIsFatDbcsLegal@20
237 FsRtlIsHpfsDbcsLegal@20
238 FsRtlIsNameInExpression@16
239 FsRtlIsNtstatusExpected@4
241 FsRtlIsTotalDeviceFailure@4
242 FsRtlLegalAnsiCharacterArray DATA
243 FsRtlLookupLargeMcbEntry@32
244 FsRtlLookupLastLargeMcbEntry@12
245 FsRtlLookupLastLargeMcbEntryAndInde@16=FsRtlLookupLastLargeMcbEntryAndIndex@16
246 FsRtlLookupLastMcbEntry@12
247 FsRtlLookupMcbEntry@20
248 FsRtlLookupPerFileObjectContext@12
249 FsRtlLookupPerStreamContextInternal@12
251 FsRtlMdlReadComplete@8
252 FsRtlMdlReadCompleteDev@12
254 FsRtlMdlWriteComplete@12
255 FsRtlMdlWriteCompleteDev@16
256 FsRtlNormalizeNtstatus@8
257 FsRtlNotifyChangeDirectory@28
258 FsRtlNotifyCleanup@12
259 FsRtlNotifyFilterChangeDirectory@44
260 FsRtlNotifyFilterReportChange@40
261 FsRtlNotifyFullChangeDirectory@40
262 FsRtlNotifyFullReportChange@36
263 FsRtlNotifyInitializeSync@4
264 FsRtlNotifyReportChange@20
265 FsRtlNotifyUninitializeSync@4
266 FsRtlNotifyVolumeEvent@8
267 FsRtlNumberOfRunsInLargeMcb@4
268 FsRtlNumberOfRunsInMcb@4
270 FsRtlOplockIsFastIoPossible@4
271 FsRtlPostPagingFileStackOverflow@12
272 FsRtlPostStackOverflow@12
273 FsRtlPrepareMdlWrite@24
274 FsRtlPrepareMdlWriteDev@28
276 FsRtlProcessFileLock@12
277 FsRtlRegisterUncProvider@12
279 FsRtlRemoveLargeMcbEntry@20
280 FsRtlRemoveMcbEntry@12
281 FsRtlRemovePerFileObjectContext@12
282 FsRtlRemovePerStreamContext@12
284 FsRtlSplitLargeMcb@20
286 FsRtlTruncateLargeMcb@12
288 FsRtlUninitializeFileLock@4
289 FsRtlUninitializeLargeMcb@4
290 FsRtlUninitializeMcb@4
291 FsRtlUninitializeOplock@4
292 HalDispatchTable DATA
293 HalPrivateDispatchTable DATA
294 @HalExamineMBR=@xHalExamineMBR@16
295 InbvAcquireDisplayOwnership@0
296 InbvCheckDisplayOwnership@0
298 InbvEnableBootDriver@4
299 InbvEnableDisplayString@4
300 InbvInstallDisplayStringFilter@4
301 InbvIsBootDriverInstalled@0
302 InbvNotifyDisplayOwnershipLost@4
304 InbvSetScrollRegion@16
306 InbvSolidColorFill@20
307 @InterlockedCompareExchange@12
308 @InterlockedDecrement@4
309 @InterlockedExchange@8
310 @InterlockedExchangeAdd@8
311 @InterlockedIncrement@4
312 @InterlockedPushEntrySList@8
313 @InterlockedPopEntrySList@4
314 IoAcquireCancelSpinLock@4
315 IoAcquireRemoveLockEx@20
316 IoAcquireVpbSpinLock@4
317 IoAdapterObjectType DATA
318 IoAllocateAdapterChannel@20
321 IoAllocateController@16
322 IoAllocateDriverObjectExtension@16
323 IoAllocateErrorLogEntry@8
325 IoAssignDriveLetters@16
328 IoAttachDeviceByPointer@8
329 IoAttachDeviceToDeviceStack@8
330 IoAttachDeviceToDeviceStackSafe@12
331 IoBuildAsynchronousFsdRequest@24
332 IoBuildDeviceIoControlRequest@36
334 IoBuildSynchronousFsdRequest@28
338 IoCheckDesiredAccess@8
339 IoCheckEaBufferValidity@12
340 IoCheckFunctionAccess@24
341 IoCheckQuerySetFileInformation@12
342 IoCheckQuerySetVolumeInformation@12
343 IoCheckQuotaBufferValidity@12
344 IoCheckShareAccess@20
346 IoConnectInterrupt@44
352 IoCreateFileSpecifyDeviceObjectHint@60
353 IoCreateNotificationEvent@8
354 IoCreateStreamFileObject@8
355 IoCreateStreamFileObjectEx@12
356 IoCreateStreamFileObjectLite@8
357 IoCreateSymbolicLink@8
358 IoCreateSynchronizationEvent@8
359 IoCreateUnprotectedSymbolicLink@8
363 IoDeleteSymbolicLink@4
365 IoDeviceHandlerObjectSize DATA
366 IoDeviceHandlerObjectType DATA
367 IoDeviceObjectType DATA
368 IoDisconnectInterrupt@4
369 IoDriverObjectType DATA
371 IoEnumerateDeviceObjectList@16
372 IoFastQueryNetworkAttributes@20
373 IoFileObjectType DATA
374 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
375 IoForwardIrpSynchronously@8
377 IoFreeErrorLogEntry@4
381 IoGetAttachedDevice@4
382 IoGetAttachedDeviceReference@4
383 IoGetBaseFileSystemDeviceObject@4
384 IoGetBootDiskInformation@8
385 IoGetConfigurationInformation@0
386 IoGetCurrentProcess@0
387 IoGetDeviceObjectPointer@16
388 IoGetDeviceAttachmentBaseRef@4
389 IoGetDeviceInterfaceAlias@12
390 IoGetDeviceInterfaces@16
391 IoGetDriverObjectExtension@8
392 IoGetDeviceProperty@20
393 IoGetDeviceToVerify@4
394 IoGetDiskDeviceObject@8
396 IoGetFileObjectGenericMapping@0
398 IoGetLowerDeviceObject@4
399 IoGetRelatedDeviceObject@4
400 IoGetRequestorProcess@4
401 IoGetRequestorProcessId@4
402 IoGetRequestorSessionId@8
406 IoInvalidateDeviceRelations@8
407 IoInvalidateDeviceState@4
408 IoInitializeRemoveLockEx@20
410 IoIsFileOriginRemote@4
412 IoIsValidNameGraftingBuffer@8
413 IoIsOperationSynchronous@4
414 IoMakeAssociatedIrp@8
415 IoOpenDeviceInstanceKey@20
416 IoOpenDeviceInterfaceRegistryKey@12
417 IoOpenDeviceRegistryKey@16
419 IoPnPDeliverServicePowerNotification@16
420 IoQueryDeviceDescription@32
421 IoQueryDeviceEnumInfo@8
422 IoQueryFileDosDeviceName@8
423 IoQueryFileInformation@20
424 IoQueryVolumeInformation@20
428 IoRaiseInformationalHardError@12
429 IoReadDiskSignature@12
430 IoReadOperationCount DATA
431 IoReadPartitionTable@16
432 IoReadPartitionTableEx@8
433 IoReadTransferCount DATA
434 IoRegisterBootDriverReinitialization@12
435 IoRegisterDeviceInterface@16
436 IoRegisterDriverReinitialization@12
437 IoRegisterFileSystem@4
438 IoRegisterFsRegistrationChange@8
439 IoRegisterLastChanceShutdownNotification@4
440 IoRegisterPlugPlayNotification@28
441 IoRegisterShutdownNotification@4
442 IoReleaseCancelSpinLock@4
443 IoReleaseRemoveLockAndWaitEx@12
444 IoReleaseRemoveLockEx@12
445 IoReleaseVpbSpinLock@4
446 IoRemoveShareAccess@8
447 IoReportDetectedDevice@32
448 IoReportHalResourceUsage@16
449 IoReportResourceUsage@36
450 IoReportResourceForDetection@28
451 IoReportTargetDeviceChange@8
452 IoReportTargetDeviceChangeAsynchronous@16
453 IoRequestDeviceEject@4
455 IoSetCompletionRoutineEx@28
456 IoSetSystemPartition@4
457 IoSetDeviceInterfaceState@8
458 IoSetDeviceToVerify@8
460 IoSetHardErrorOrVerifyDevice@8
463 IoSetPartitionInformation@16
464 IoSetPartitionInformationEx@12
465 IoSetStartIoAttributes@12
467 IoSetThreadHardErrorMode@4
470 IoStartNextPacketByKey@12
473 IoStatisticsLock DATA
475 IoSynchronousPageWrite@20
476 IoSynchronousInvalidateDeviceRelations@8
478 IoUnregisterFileSystem@4
479 IoUnregisterFsRegistrationChange@8
480 IoUnregisterPlugPlayNotification@4
481 IoUnregisterShutdownNotification@4
482 IoUpdateShareAccess@8
483 IoValidateDeviceIoControlAccess@8
484 IoVerifyPartitionTable@8
486 IoVolumeDeviceToDosName@8
487 IoWMIAllocateInstanceIds@12
488 IoWMIDeviceObjectToInstanceName@12
489 IoWMIExecuteMethod@24
490 IoWMIHandleToInstanceName@12
493 IoWMIQueryAllDataMultiple@16
494 IoWMIQuerySingleInstance@16
495 IoWMIQuerySingleInstanceMultiple@20
496 IoWMIRegistrationControl@8
497 IoWMISetNotificationCallback@12
498 IoWMISetSingleInstance@20
499 IoWMISetSingleItem@24
500 IoWMISuggestInstanceName@16
502 IoWriteErrorLogEntry@4
503 IoWriteOperationCount DATA
504 IoWritePartitionTable@20
505 IoWritePartitionTableEx@8
506 IoWriteTransferCount DATA
508 @IofCompleteRequest@8
509 IoIsWdmVersionAvailable@8
510 KdDebuggerEnabled DATA
511 KdDebuggerNotPresent DATA
517 KdSystemDebugControl@4
519 Ke386IoSetAccessProcess@8
520 Ke386QueryIoAccessMap@8
521 Ke386SetIoAccessMap@8
522 KeAcquireSpinLockAtDpcLevel@4
523 KeAcquireDispatcherDatabaseLockAtDpcLevel
524 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
525 KeAcquireInterruptSpinLock@4
526 KeAddSystemServiceTable@20
529 ;KeBoostCurrentThread
533 KeCapturePersistentThreadState@28
536 KeDcacheFlushCount DATA
537 KeDelayExecutionThread@12
538 KeDeregisterBugCheckCallback@4
539 KeDeregisterBugCheckReasonCallback@4
541 KeDisconnectInterrupt@4
542 KeEnterCriticalRegion@0
543 KeEnterKernelDebugger@0
544 KeFindConfigurationEntry@16
545 KeFindConfigurationNextEntry@20
550 KeGetRecommendedSharedDataAlignment@0
552 KeI386AllocateGdtSelectors
553 ;KeI386Call16BitCStyleFunction
554 ;KeI386Call16BitFunction
555 KeI386FlatToGdtSelector
557 ;KeI386MachineType DATA
558 KeI386ReleaseGdtSelectors
560 ;KeI386SetGdtSelector
561 KeIcacheFlushCount DATA
563 KeInitializeDeviceQueue@4
566 KeInitializeInterrupt@44
570 KeInitializeSemaphore@12
571 KeInitializeSpinLock@4
573 KeInitializeTimerEx@8
574 KeInsertByKeyDeviceQueue@12
575 KeInsertDeviceQueue@8
580 KeIsAttachedProcess@0
582 KeLeaveCriticalRegion@0
584 KeNumberProcessors DATA
586 KeProfileInterruptWithSource@8
588 KeQueryActiveProcessors@0
589 KeQueryInterruptTime@0
590 KeQueryPriorityThread@4
591 KeQueryRuntimeThread@8
594 KeQueryTimeIncrement@0
595 KeRaiseUserException@4
601 KeReadStateSemaphore@4
603 KeRegisterBugCheckCallback@20
604 KeRegisterBugCheckReasonCallback@16
605 KeReleaseDispatcherDatabaseLockFromDpcLevel
606 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
607 KeReleaseInterruptSpinLock@8
610 KeReleaseSemaphore@16
611 KeReleaseSpinLockFromDpcLevel@4
612 KeRemoveByKeyDeviceQueue@8
613 KeRemoveByKeyDeviceQueueIfBusy@8
614 KeRemoveDeviceQueue@4
615 KeRemoveEntryDeviceQueue@8
618 KeRemoveSystemServiceTable@4
620 KeRestoreFloatingPointState@4
621 KeRevertToUserAffinityThread@0
623 KeSaveFloatingPointState@4
624 KeSaveStateForHibernate
625 KeServiceDescriptorTable DATA
626 KeSetAffinityThread@8
627 KeSetBasePriorityThread@8
628 KeSetDmaIoCoherency@4
630 KeSetEventBoostPriority@8
631 KeSetIdealProcessorThread@8
633 KeSetKernelStackSwapEnable@4
634 KeSetPriorityThread@8
636 KeSetSystemAffinityThread@4
637 ;KeSetSwapContextNotifyRoutine
638 KeSetTargetProcessorDpc@8
639 ;KeSetThreadSelectNotifyRoutine
643 @KeSetTimeUpdateNotifyRoutine@4
644 KeStackAttachProcess@8
645 KeSynchronizeExecution@12
650 KeUnstackDetachProcess@4
651 KeUserModeCallback@20
652 KeWaitForMultipleObjects@32
653 KeWaitForMutexObject@20
654 KeWaitForSingleObject@20
655 @KefAcquireSpinLockAtDpcLevel@4
656 @KefReleaseSpinLockFromDpcLevel@4
662 KiDispatchInterrupt@0
663 KiEnableTimerWatchdog
664 KiInterruptDispatch2@8
665 KiIpiServiceRoutine@8
667 KiUnexpectedInterrupt@0
668 ;Kii386SpinOnSpinLock
672 LdrFindResourceDirectory_U@16
675 LpcRequestWaitReplyPort@12
676 LsaCallAuthenticationPackage@28
677 LsaDeregisterLogonProcess@8
678 LsaFreeReturnBuffer@4
680 LsaLookupAuthenticationPackage@12
681 LsaRegisterLogonProcess@12
682 Mm64BitPhysicalAddress DATA
683 MmAddPhysicalMemory@8
684 MmAddVerifierThunks@8
685 MmAdjustWorkingSetSize@12
687 MmAllocateContiguousAlignedMemory@36
688 MmAllocateContiguousMemory@12
689 MmAllocateContiguousMemorySpecifyCache@32
690 MmAllocateMappingAddress@8
691 MmAllocateNonCachedMemory@4
692 MmAllocatePagesForMdl@28
693 MmBuildMdlForNonPagedPool@4
694 MmCanFileBeTruncated@8
699 MmDbgTranslatePhysicalAddress@8
700 MmDisableModifiedWriteOfSection@4
701 MmFlushImageSection@8
702 MmForceSectionClosed@8
703 MmFreeContiguousMemory@4
704 MmFreeContiguousMemorySpecifyCache@12
705 MmFreeMappingAddress@8
706 MmFreeNonCachedMemory@8
708 MmGetPhysicalAddress@4
709 MmGetPhysicalMemoryRanges@0
710 MmGetSystemRoutineAddress@4
711 MmGetVirtualForPhysical@8
713 MmHighestUserAddress DATA
715 MmIsDriverVerifying@4
716 MmIsNonPagedSystemAddressValid@4
717 MmIsRecursiveIoFault@0
718 MmIsThisAnNtAsSystem@0
719 MmIsVerifierEnabled@4
720 MmLockPagableDataSection@4
721 MmLockPagableImageSection@4=MmLockPagableDataSection@4
722 MmLockPagableSectionByHandle@4
725 MmMapLockedPagesSpecifyCache@24
726 MmMapLockedPagesWithReservedMapping@16
728 MmMapUserAddressesToPage@12
730 MmMapViewInSessionSpace@12
731 MmMapViewInSystemSpace@12
732 MmMapViewOfSection@40
733 MmMarkPhysicalMemoryAsBad@8
734 MmMarkPhysicalMemoryAsGood@8
737 MmProbeAndLockPages@12
738 MmProbeAndLockProcessPages@16
739 MmProbeAndLockSelectedPages@16
740 MmProtectMdlSystemAddress@8
742 MmRemovePhysicalMemory@8
743 MmResetDriverPaging@4
744 MmSectionObjectType DATA
745 MmSecureVirtualMemory@12
746 MmSetAddressRangeModified@8
747 MmSetBankedSection@24
749 MmSystemRangeStart DATA
750 MmTrimAllSystemPagableMemory@4
751 MmUnlockPagableImageSection@4
755 MmUnmapReservedMapping@12
756 MmUnmapVideoDisplay@8
757 MmUnmapViewInSessionSpace@4
758 MmUnmapViewInSystemSpace@4
759 MmUnmapViewOfSection@8
760 MmUnsecureVirtualMemory@4
761 MmUserProbeAddress DATA
764 NlsMbCodePageTag DATA
765 NlsMbOemCodePageTag DATA
766 NlsOemLeadByteInfo DATA
768 NtAdjustPrivilegesToken@24
770 NtAllocateLocallyUniqueId@4
772 NtAllocateVirtualMemory@24
783 NtDeviceIoControlFile@40
787 NtFreeVirtualMemory@16
791 NtMakePermanentObject@4
792 NtMapViewOfSection@40
793 NtNotifyChangeDirectoryFile@36
796 NtOpenProcessToken@12
797 NtOpenProcessTokenEx@16
800 NtOpenThreadTokenEx@20
801 NtQueryDirectoryFile@44
803 NtQueryInformationAtom@20
804 NtQueryInformationFile@20
805 NtQueryInformationProcess@20
806 NtQueryInformationThread@20
807 NtQueryInformationToken@20
808 ;NtQueryOleDirectoryFile@44 <--- ?
809 NtQueryQuotaInformationFile@36
810 NtQuerySecurityObject@20
811 NtQuerySystemInformation@16
813 NtQueryVolumeInformationFile@20
816 NtRequestWaitReplyPort@12
819 NtSetInformationFile@20
820 NtSetInformationProcess@16
821 NtSetInformationThread@16
822 NtSetQuotaInformationFile@16
823 NtSetSecurityObject@12
824 NtSetVolumeInformationFile@20
831 NtWaitForSingleObject@12
834 ;ObCheckCreateObjectAccess@28
835 ;ObCheckObjectAccess@20
837 ;ObFindHandleForObject@20
838 ObGetObjectPointerCount@4
839 ObGetObjectSecurity@12
841 ObMakeTemporaryObject@4
842 ObOpenObjectByName@28
843 ObOpenObjectByPointer@28
845 ObQueryObjectAuditingByHandle@8
846 @ObfDereferenceObject@4
847 @ObfReferenceObject@4
848 ObReferenceObjectByHandle@24
849 ObReferenceObjectByName@32
850 ObReferenceObjectByPointer@16
851 ObReleaseObjectSecurity@8
852 ObDereferenceObject@4
853 ;ObSetSecurityDescriptorInfo@24
859 PoRegisterDeviceForIdleDetection@16
860 PoRegisterSystemState@8
865 PoStartNextPowerIrp@4
866 PoUnregisterSystemState@4
869 PsAssignImpersonationToken@8
871 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
872 PsChargeProcessPagedPoolQuota@8
873 PsChargeProcessPoolQuota@12
874 PsCreateSystemProcess@12
875 PsCreateSystemThread@28
876 PsCreateWin32Process@4
877 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
878 PsDereferencePrimaryToken@4
879 PsDisableImpersonation@8
880 PsEstablishWin32Callouts@24
881 PsGetCurrentProcessId@0
882 PsGetCurrentProcessSessionId@0
883 PsGetCurrentThreadId@0
884 PsGetCurrentThreadPreviousMode@0
885 PsGetCurrentThreadStackBase@0
886 PsGetCurrentThreadStackLimit@0
889 PsGetJobUIRestrictionsClass@4
890 PsGetProcessCreateTimeQuadPart@4
891 PsGetProcessDebugPort@4
892 PsGetProcessExitProcessCalled@4
893 PsGetProcessExitStatus@4
894 PsGetProcessExitTime@0
896 PsGetProcessImageFileName@4
897 PsGetProcessInheritedFromUniqueProcessId@4
900 PsGetProcessPriorityClass@4
901 PsGetProcessSectionBaseAddress@4
902 PsGetProcessSecurityPort@4
903 PsGetProcessSessionId@4
904 PsGetProcessWin32Process@4
905 PsGetProcessWin32WindowStation@4
906 PsGetThreadFreezeCount@4
907 PsGetThreadHardErrorsAreDisabled@4
910 PsGetThreadProcessId@4
911 PsGetThreadSessionId@4
913 PsGetThreadWin32Thread@4
917 PsImpersonateClient@20
918 PsInitialSystemProcess DATA
919 PsIsProcessBeingDebugged@4
921 PsIsThreadImpersonating@4
922 PsIsThreadTerminating@4
924 PsLookupProcessByProcessId@8
925 PsLookupProcessThreadByCid@12
926 PsLookupThreadByThreadId@8
928 PsReferenceImpersonationToken@16
929 PsReferencePrimaryToken@4
930 PsRemoveCreateThreadNotifyRoutine@4
931 PsRemoveLoadImageNotifyRoutine@4
932 PsRestoreImpersonation@8
934 PsReturnProcessNonPagedPoolQuota@8
935 PsReturnProcessPagedPoolQuota@8
937 PsRevertThreadToSelf@4
938 PsSetCreateProcessNotifyRoutine@8
939 PsSetCreateThreadNotifyRoutine@4
940 PsSetJobUIRestrictionsClass@8
941 PsSetLegoNotifyRoutine@4
942 PsSetProcessPriorityClass@8
943 PsSetProcessSecurityPort@8
944 PsSetProcessWin32Process@8
945 PsSetProcessWin32WindowStation@8
946 PsSetThreadHardErrorsAreDisabled@8
947 PsSetThreadWin32Thread@8
948 PsSetLoadImageNotifyRoutine@4
949 PsTerminateSystemThread@4
951 READ_REGISTER_UCHAR@4
952 READ_REGISTER_ULONG@4
953 READ_REGISTER_USHORT@4
954 READ_REGISTER_BUFFER_UCHAR@12
955 READ_REGISTER_BUFFER_ULONG@12
956 READ_REGISTER_BUFFER_USHORT@12
958 KeRosDumpStackFrames@8
959 RtlAbsoluteToSelfRelativeSD@12
960 RtlAddAccessAllowedAce@16
962 RtlAddAtomToAtomTable@12
964 ;RtlAllocateAndInitializeSid
966 RtlAnsiCharToUnicodeChar@4
967 RtlAnsiStringToUnicodeSize@4
968 RtlAnsiStringToUnicodeString@12
969 RtlAppendAsciizToString@8
970 RtlAppendStringToString@8
971 RtlAppendUnicodeStringToString@8
972 RtlAppendUnicodeToString@8
973 RtlAreAllAccessesGranted@8
974 RtlAreAnyAccessesGranted@8
979 RtlCaptureStackBackTrace@16
981 RtlCheckRegistryKey@8
986 RtlCompareMemoryUlong@12
988 RtlCompareUnicodeString@12
991 RtlConvertLongToLargeInteger@4
992 RtlConvertSidToUnicodeString@12
993 RtlConvertUlongToLargeInteger@4
998 RtlCopyUnicodeString@8
1000 RtlCreateAtomTable@8
1002 RtlCreateRegistryKey@8
1003 RtlCreateSecurityDescriptor@8
1004 RtlCreateSystemVolumeInformationFolder@4
1005 RtlCreateUnicodeString@8
1006 RtlCustomCPToUnicodeN@24
1007 RtlDecompressBuffer@24
1008 RtlDecompressChunks@28
1009 RtlDecompressFragment@32
1012 RtlDeleteAtomFromAtomTable@8
1013 RtlDeleteElementGenericTable@8
1014 RtlDeleteElementGenericTableAvl@8
1016 RtlDeleteOwnersRanges@8
1018 RtlDeleteRegistryValue@12
1020 RtlDestroyAtomTable@4
1022 RtlDowncaseUnicodeString@12
1024 RtlEnlargedIntegerMultiply@8
1025 RtlEnlargedUnsignedDivide@16
1026 RtlEnlargedUnsignedMultiply@8
1027 RtlEnumerateGenericTable@8
1028 RtlEnumerateGenericTableAvl@8
1029 RtlEnumerateGenericTableLikeADirectory@28
1030 RtlEnumerateGenericTableWithoutSplaying@8
1031 RtlEnumerateGenericTableWithoutSplayingAvl@8
1035 RtlEqualUnicodeString@12
1036 RtlExtendedIntegerMultiply@12
1037 RtlExtendedLargeIntegerDivide@16
1038 RtlExtendedMagicDivide@20
1040 RtlFillMemoryUlong@12
1042 RtlFindClearBitsAndSet@12
1044 RtlFindFirstRunClear@8
1045 RtlFindFirstRunSet@8
1046 RtlFindLastBackwardRunClear@12
1047 RtlFindLeastSignificantBit@8
1048 RtlFindLongestRunClear@8
1049 RtlFindLongestRunSet@8
1051 RtlFindMostSignificantBit@8
1052 RtlFindNextForwardRunClear@12
1055 RtlFindSetBitsAndClear@12
1056 RtlFindUnicodePrefix@12
1057 RtlFormatCurrentUserKeyPath@4
1062 RtlFreeUnicodeString@4
1064 RtlGenerate8dot3Name@16
1066 RtlGetCallersAddress@8
1067 RtlGetCompressionWorkSpaceSize@12
1068 RtlGetDaclSecurityDescriptor@16
1069 RtlGetDefaultCodePage@8
1070 RtlGetElementGenericTable@8
1071 RtlGetElementGenericTableAvl@8
1073 RtlGetGroupSecurityDescriptor@12
1075 RtlGetNtGlobalFlags@0
1076 RtlGetOwnerSecurityDescriptor@12
1077 RtlGetSaclSecurityDescriptor@16
1078 RtlGetSetBootStatusData@24
1080 RtlHashUnicodeString@16
1082 RtlImageDirectoryEntryToData@16
1084 RtlInitCodePageTable@8
1086 RtlInitUnicodeString@8
1087 RtlInitializeBitMap@12
1088 RtlInitializeGenericTable@20
1089 RtlInitializeGenericTableAvl@20
1090 RtlInitializeRangeList@4
1092 RtlInitializeUnicodePrefix@4
1093 RtlInsertElementGenericTable@16
1094 RtlInsertElementGenericTableAvl@16
1095 RtlInsertElementGenericTableFull@24
1096 RtlInsertElementGenericTableFullAvl@24
1097 RtlInsertUnicodePrefix@12
1098 RtlInt64ToUnicodeString@16
1100 RtlIntegerToUnicode@16
1101 RtlIntegerToUnicodeString@12
1102 RtlInvertRangeList@8
1103 RtlIpv4AddressToStringA@8
1104 RtlIpv4AddressToStringExA@16
1105 RtlIpv4AddressToStringExW@16
1106 RtlIpv4AddressToStringW@8
1107 RtlIpv4StringToAddressA@16
1108 RtlIpv4StringToAddressExA@16
1109 RtlIpv4StringToAddressExW@16
1110 RtlIpv4StringToAddressW@16
1111 RtlIpv6AddressToStringA@8
1112 RtlIpv6AddressToStringExA@16
1113 RtlIpv6AddressToStringExW@16
1114 RtlIpv6AddressToStringW@8
1115 RtlIpv6StringToAddressA@16
1116 RtlIpv6StringToAddressExA@16
1117 RtlIpv6StringToAddressExW@16
1118 RtlIpv6StringToAddressW@16
1119 RtlIsGenericTableEmpty@4
1120 RtlIsGenericTableEmptyAvl@4
1121 RtlIsNameLegalDOS8Dot3@12
1122 RtlIsRangeAvailable@40
1123 RtlIsValidOemCharacter@4
1124 RtlLargeIntegerAdd@16
1125 RtlLargeIntegerArithmeticShift@12
1126 RtlLargeIntegerDivide@20
1127 RtlLargeIntegerNegate@8
1128 RtlLargeIntegerShiftLeft@12
1129 RtlLargeIntegerShiftRight@12
1130 RtlLargeIntegerSubtract@16
1131 RtlLengthRequiredSid@4
1132 RtlLengthSecurityDescriptor@4
1134 RtlLockBootStatusData@4
1135 RtlLookupAtomInAtomTable@12
1136 RtlLookupElementGenericTable@8
1137 RtlLookupElementGenericTableAvl@8
1138 RtlLookupElementGenericTableFull@16
1139 RtlLookupElementGenericTableFullAvl@16
1141 RtlMapSecurityErrorToNtStatus@4
1142 RtlMergeRangeLists@16
1144 RtlMultiByteToUnicodeN@20
1145 RtlMultiByteToUnicodeSize@12
1146 RtlNextUnicodePrefix@8
1147 RtlNtStatusToDosError@4
1148 RtlNtStatusToDosErrorNoTeb@4
1149 RtlNumberGenericTableElements@4
1150 RtlNumberGenericTableElementsAvl@4
1151 RtlNumberOfClearBits@4
1152 RtlNumberOfSetBits@4
1153 RtlOemStringToCountedUnicodeString@12
1154 RtlOemStringToUnicodeSize@4
1155 RtlOemStringToUnicodeString@12
1157 RtlPinAtomInAtomTable@8
1158 @RtlPrefetchMemoryNonTemporal@8
1160 RtlPrefixUnicodeString@12
1161 RtlQueryAtomInAtomTable@24
1162 RtlQueryRegistryValues@20
1163 RtlQueryTimeZoneInformation@4
1167 RtlRealPredecessor@4
1169 RtlRemoveUnicodePrefix@8
1171 RtlSecondsSince1970ToTime@8
1172 RtlSecondsSince1980ToTime@8
1173 RtlSelfRelativeToAbsoluteSD2@8
1174 RtlSelfRelativeToAbsoluteSD@44
1178 RtlSetDaclSecurityDescriptor@16
1179 RtlSetGroupSecurityDescriptor@12
1180 RtlSetOwnerSecurityDescriptor@12
1181 RtlSetSaclSecurityDescriptor@16
1182 RtlSetTimeZoneInformation@4
1186 RtlSubAuthorityCountSid@4
1187 RtlSubAuthoritySid@8
1188 RtlSubtreePredecessor@4
1189 RtlSubtreeSuccessor@4
1191 RtlTimeFieldsToTime@8
1192 RtlTimeToElapsedTimeFields@8
1193 RtlTimeToSecondsSince1970@8
1194 RtlTimeToSecondsSince1980@8
1195 RtlTimeToTimeFields@8
1197 @RtlUlonglongByteSwap@8
1198 RtlUnicodeStringToAnsiSize@4
1199 RtlUnicodeStringToAnsiString@12
1200 RtlUnicodeStringToCountedOemString@12
1201 RtlUnicodeStringToInteger@12
1202 RtlUnicodeStringToOemSize@4
1203 RtlUnicodeStringToOemString@12
1204 RtlUnicodeToCustomCPN@24
1205 RtlUnicodeToMultiByteN@20
1206 RtlUnicodeToMultiByteSize@12
1208 RtlUnlockBootStatusData@4
1210 RtlUpcaseUnicodeChar@4
1211 RtlUpcaseUnicodeString@12
1212 RtlUpcaseUnicodeStringToAnsiString@12
1213 RtlUpcaseUnicodeStringToCountedOemString@12
1214 RtlUpcaseUnicodeStringToOemString@12
1215 RtlUpcaseUnicodeToCustomCPN@24
1216 RtlUpcaseUnicodeToMultiByteN@20
1217 RtlUpcaseUnicodeToOemN@20
1220 @RtlUshortByteSwap@4
1221 RtlValidRelativeSecurityDescriptor@12
1222 RtlValidSecurityDescriptor@4
1224 ;RtlVerifyVersionInfo@16
1225 RtlVolumeDeviceToDosName@8
1226 RtlWalkFrameChain@12
1227 RtlWriteRegistryValue@24
1230 RtlxAnsiStringToUnicodeSize@4
1231 RtlxOemStringToUnicodeSize@4
1232 RtlxUnicodeStringToAnsiSize@4
1233 RtlxUnicodeStringToOemSize@4
1235 SeAppendPrivileges@8
1237 SeAssignSecurityEx@36
1238 SeAuditHardLinkCreation@12
1239 SeAuditingFileEvents@8
1240 SeAuditingFileEventsWithContext@12
1241 SeAuditingFileOrGlobalEvents@12
1242 SeAuditingHardLinkEvents@8
1243 SeAuditingHardLinkEventsWithContext@12
1244 SeCaptureSecurityDescriptor@20
1245 SeCaptureSubjectContext@4
1246 SeCloseObjectAuditAlarm@12
1247 SeCreateAccessState@16
1248 SeCreateClientSecurity@16
1249 SeCreateClientSecurityFromSubjectContext@16
1250 SeDeassignSecurity@4
1251 SeDeleteAccessState@4
1252 SeDeleteObjectAuditAlarm@8
1256 SeImpersonateClient@8
1257 SeImpersonateClientEx@8
1258 SeLockSubjectContext@4
1259 SeMarkLogonSessionForTerminationNotification@4
1260 SeOpenObjectAuditAlarm@36
1261 SeOpenObjectForDeleteAuditAlarm@36
1263 SePrivilegeObjectAuditAlarm@24
1264 SePublicDefaultDacl DATA
1265 SeQueryAuthenticationIdToken@8
1266 SeQueryInformationToken@12
1267 SeQuerySecurityDescriptorInfo@16
1268 SeQuerySessionIdToken@8
1269 SeRegisterLogonSessionTerminatedRoutine@4
1270 SeReleaseSecurityDescriptor@12
1271 SeReleaseSubjectContext@4
1272 SeSetAccessStateGenericMapping@8
1273 SeSetSecurityDescriptorInfo@24
1274 SeSetSecurityDescriptorInfoEx@28
1275 SeSinglePrivilegeCheck@12
1276 SeSystemDefaultDacl DATA
1277 SeTokenImpersonationLevel@4
1279 SeTokenIsRestricted@4
1280 SeTokenIsWriteRestricted@4
1282 SeUnlockSubjectContext@4
1283 SeUnregisterLogonSessionTerminatedRoutine@4
1284 SeValidSecurityDescriptor@8
1285 WRITE_REGISTER_UCHAR@8
1286 WRITE_REGISTER_ULONG@8
1287 WRITE_REGISTER_USHORT@8
1288 WRITE_REGISTER_BUFFER_UCHAR@12
1289 WRITE_REGISTER_BUFFER_ULONG@12
1290 WRITE_REGISTER_BUFFER_USHORT@12
1291 ZwAccessCheckAndAuditAlarm@44
1293 ZwAdjustPrivilegesToken@24
1295 ZwAllocateVirtualMemory@24
1296 ZwAssignProcessToJobObject@8
1301 ZwCloseObjectAuditAlarm@12
1303 ZwCreateDirectoryObject@12
1306 ZwCreateJobObject@12
1309 ZwCreateSymbolicLinkObject@16
1315 ZwDeviceIoControlFile@40
1317 ZwDuplicateObject@28
1319 ZwEnumerateBootEntries@8
1321 ZwEnumerateValueKey@24
1322 ZwFlushInstructionCache@12
1324 ZwFlushVirtualMemory@16
1325 ZwFreeVirtualMemory@16
1327 ZwInitiatePowerAction@16
1331 ZwMakeTemporaryObject@4
1332 ZwMapViewOfSection@40
1333 ZwNotifyChangeKey@40
1334 ZwOpenDirectoryObject@12
1340 ZwOpenProcessToken@12
1341 ZwOpenProcessTokenEx@16
1343 ZwOpenSymbolicLinkObject@12
1345 ZwOpenThreadToken@16
1346 ZwOpenThreadTokenEx@20
1348 ZwPowerInformation@20
1350 ZwQueryBootEntryOrder@8
1351 ZwQueryBootOptions@8
1352 ZwQueryDefaultLocale@8
1353 ZwQueryDefaultUILanguage@4
1354 ZwQueryDirectoryFile@44
1355 ZwQueryDirectoryObject@28
1357 ZwQueryFullAttributesFile@8
1358 ZwQueryInformationAtom@20
1359 ZwQueryInformationFile@20
1360 ZwQueryInformationJobObject@20
1361 ZwQueryInformationProcess@20
1362 ZwQueryInformationThread@20
1363 ZwQueryInformationToken@20
1364 ZwQueryInstallUILanguage@4
1368 ZwQuerySecurityObject@20
1369 ZwQuerySymbolicLinkObject@12
1370 ZwQuerySystemInformation@16
1373 ZwQueryVolumeInformationFile@20
1376 ZwRequestWaitReplyPort@12
1381 ZwSetBootEntryOrder@8
1383 ZwSetDefaultLocale@8
1384 ZwSetDefaultUILanguage@4
1387 ZwSetInformationFile@20
1388 ZwSetInformationJobObject@16
1389 ZwSetInformationObject@16
1390 ZwSetInformationProcess@16
1391 ZwSetInformationThread@16
1392 ZwSetSecurityObject@12
1393 ZwSetSystemInformation@12
1397 ZwSetVolumeInformationFile@20
1398 ZwTerminateJobObject@8
1399 ZwTerminateProcess@8
1400 ZwTranslateFilePath@12
1403 ZwUnmapViewOfSection@8
1404 ZwWaitForMultipleObjects@20
1405 ZwWaitForSingleObject@12
1408 _abnormal_termination