3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
18 CcGetFileObjectFromBcb@4
19 CcGetFileObjectFromSectionPtrs@4
20 CcGetFlushedValidData@8
21 CcGetLsnForFileObject@8
22 CcInitializeCacheMap@20
24 CcFastMdlReadWait DATA
25 CcFastReadNotPossible DATA
36 CcPurgeCacheSection@16
39 CcScheduleReadAhead@12
40 CcSetAdditionalCacheAttributes@12
41 CcSetBcbOwnerPointer@8
42 CcSetDirtyPageThreshold@8
43 CcSetDirtyPinnedData@8
44 CcSetLogHandleForFile@12
45 CcSetReadAheadGranularity@8
46 CcUninitializeCacheMap@12
48 CcUnpinDataForThread@8
50 CcWaitForCurrentLazyWriterActivity@0
55 CmUnRegisterCallback@8
57 DbgBreakPointWithStatus@4
58 DbgLoadImageSymbols@12
62 DbgPrintReturnControlC
63 DbgQueryDebugFilterState@8
64 DbgSetDebugFilterState@12
65 @ExAcquireFastMutexUnsafe@4
66 ExAcquireResourceExclusive@8
67 ExAcquireResourceExclusiveLite@8
68 ExAcquireResourceSharedLite@8
69 @ExAcquireRundownProtection@4
70 @ExAcquireRundownProtectionEx@8
71 ExAcquireSharedStarveExclusive@8
72 ExAcquireSharedWaitForExclusive@8
73 @ExAllocateFromPagedLookasideList@4=@ExiAllocateFromPagedLookasideList@4
75 ExAllocatePoolWithQuota@8
76 ExAllocatePoolWithQuotaTag@12
77 ExAllocatePoolWithTag@12
78 ExAllocatePoolWithTagPriority@16
79 ExConvertExclusiveToSharedLite@4
81 ExDeleteNPagedLookasideList@4
82 ExDeletePagedLookasideList@4
84 ExDeleteResourceLite@4
85 ExDesktopObjectType DATA
86 ExDisableResourceBoostLite@4
88 ExEventObjectType DATA
92 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
93 ExGetCurrentProcessorCounts@12
94 ExGetCurrentProcessorCpuUsage@4
95 ExGetExclusiveWaiterCount@4
97 ExGetSharedWaiterCount@4
98 @ExInitializeRundownProtection@4
99 ExInitializeNPagedLookasideList@28
100 ExInitializePagedLookasideList@28
101 ExInitializeResource@4
102 ExInitializeResourceLite@4
104 ExInterlockedAddLargeInteger@16
105 @ExInterlockedAddLargeStatistic@8
106 ExInterlockedAddUlong@12
107 @ExInterlockedCompareExchange64@16
108 ExInterlockedDecrementLong@8
109 ExInterlockedExchangeUlong@12
110 ExInterlockedExtendZone@16
111 ExInterlockedIncrementLong@8
112 @ExInterlockedFlushSList@4
113 ExInterlockedInsertHeadList@12
114 ExInterlockedInsertTailList@12
115 ExInterlockedPopEntryList@8
116 @ExInterlockedPopEntrySList@8
117 ExInterlockedPushEntryList@12
118 @ExInterlockedPushEntrySList@12
119 ExInterlockedRemoveHeadList@8
120 ExIsProcessorFeaturePresent@4
121 ExIsResourceAcquiredExclusiveLite@4
122 ExIsResourceAcquiredSharedLite@4
123 ExLocalTimeToSystemTime@8
125 ExQueryPoolBlockSize@8
127 ExRaiseAccessViolation@0
128 ExRaiseDatatypeMisalignment@0
132 ExRegisterCallback@12
133 ExReinitializeResourceLite@4
134 @ExReInitializeRundownProtection@4
135 @ExReleaseFastMutexUnsafe@4
136 ExReleaseResourceForThread@8
137 ExReleaseResourceForThreadLite@8
138 @ExReleaseResourceLite@4
139 @ExReleaseRundownProtection@4
140 @ExReleaseRundownProtectionEx@8
141 ExRosDumpPagedPoolByTag@4
143 @ExRundownCompleted@4
144 ExSemaphoreObjectType DATA
145 ExSetResourceOwnerPointer@8
146 ExSetTimerResolution@8
147 ExSystemExceptionFilter@0
148 ExSystemTimeToLocalTime@8
149 ExTryToAcquireResourceExclusiveLite@4
150 ExUnregisterCallback@4
153 @ExWaitForRundownProtectionRelease@4
154 ExWindowStationObjectType DATA
155 @ExfAcquirePushLockExclusive@4
156 @ExfAcquirePushLockShared@4
157 @ExfReleasePushLock@4
158 @ExfInterlockedAddUlong@12
159 @ExfInterlockedInsertHeadList@12
160 @ExfInterlockedInsertTailList@12
161 @ExfInterlockedCompareExchange64@12
162 @ExfInterlockedPopEntryList@8
163 @ExfInterlockedPushEntryList@12
164 @ExfInterlockedRemoveHeadList@8
165 @Exfi386InterlockedDecrementLong@4
166 @Exfi386InterlockedExchangeUlong@8
167 @Exfi386InterlockedIncrementLong@4
168 Exi386InterlockedDecrementLong@4
169 Exi386InterlockedExchangeUlong@8
170 Exi386InterlockedIncrementLong@4
171 FsRtlAcquireFileExclusive@4
172 FsRtlAddLargeMcbEntry@28
174 FsRtlAddToTunnelCache@32
175 FsRtlAllocateFileLock@8
177 FsRtlAllocatePoolWithQuota@8
178 FsRtlAllocatePoolWithQuotaTag@12
179 FsRtlAllocatePoolWithTag@12
180 FsRtlAllocateResource@0
181 FsRtlAreNamesEqual@16
183 FsRtlCheckLockForReadAccess@8
184 FsRtlCheckLockForWriteAccess@8
188 FsRtlCurrentBatchOplock@4
189 FsRtlDeleteKeyFromTunnelCache@12
190 FsRtlDeleteTunnelCache@4
191 FsRtlDeregisterUncProvider@4
194 FsRtlDoesDbcsContainWildCards@4
195 FsRtlDoesNameContainWildCards@4
196 FsRtlFastCheckLockForRead@24
197 FsRtlFastCheckLockForWrite@24
198 FsRtlFastUnlockAll@16
199 FsRtlFastUnlockAllByKey@20
200 FsRtlFastUnlockSingle@32
201 FsRtlFindInTunnelCache@32
204 FsRtlGetNextFileLock@8
205 FsRtlGetNextLargeMcbEntry@20
206 FsRtlGetNextMcbEntry@20
207 FsRtlIncrementCcFastReadNotPossible@0
208 FsRtlIncrementCcFastReadNoWait@0
209 FsRtlIncrementCcFastReadResourceMiss@0
210 FsRtlIncrementCcFastReadWait@0
211 FsRtlInitializeFileLock@12
212 FsRtlInitializeLargeMcb@8
214 FsRtlInitializeOplock@4
215 FsRtlInitializeTunnelCache@4
216 FsRtlInsertPerFileObjectContext@8
217 FsRtlInsertPerStreamContext@8
218 FsRtlIsDbcsInExpression@8
219 FsRtlIsFatDbcsLegal@20
220 FsRtlIsHpfsDbcsLegal@20
221 FsRtlIsNameInExpression@16
222 FsRtlIsNtstatusExpected@4
224 FsRtlIsTotalDeviceFailure@4
225 FsRtlLegalAnsiCharacterArray DATA
226 FsRtlLookupLargeMcbEntry@32
227 FsRtlLookupLastLargeMcbEntry@12
228 FsRtlLookupLastLargeMcbEntryAndIndex@16
229 FsRtlLookupLastMcbEntry@12
230 FsRtlLookupMcbEntry@20
231 FsRtlLookupPerFileObjectContext@12
232 FsRtlLookupPerStreamContextInternal@12
234 FsRtlMdlReadComplete@8
235 FsRtlMdlReadCompleteDev@12
237 FsRtlMdlWriteComplete@12
238 FsRtlMdlWriteCompleteDev@16
239 FsRtlNormalizeNtstatus@8
240 FsRtlNotifyChangeDirectory@28
241 FsRtlNotifyCleanup@12
242 FsRtlNotifyFilterChangeDirectory@44
243 FsRtlNotifyFilterReportChange@40
244 FsRtlNotifyFullChangeDirectory@40
245 FsRtlNotifyFullReportChange@36
246 FsRtlNotifyInitializeSync@4
247 FsRtlNotifyReportChange@20
248 FsRtlNotifyUninitializeSync@4
249 FsRtlNotifyVolumeEvent@8
250 FsRtlNumberOfRunsInLargeMcb@4
251 FsRtlNumberOfRunsInMcb@4
253 FsRtlOplockIsFastIoPossible@4
254 FsRtlPostPagingFileStackOverflow@12
255 FsRtlPostStackOverflow@12
256 FsRtlPrepareMdlWrite@24
257 FsRtlPrepareMdlWriteDev@28
259 FsRtlProcessFileLock@12
260 FsRtlRegisterUncProvider@12
262 FsRtlRemoveLargeMcbEntry@20
263 FsRtlRemoveMcbEntry@12
264 FsRtlRemovePerFileObjectContext@12
265 FsRtlRemovePerStreamContext@12
267 FsRtlSplitLargeMcb@20
269 FsRtlTeardownPerStreamContexts@4
270 FsRtlTruncateLargeMcb@12
272 FsRtlUninitializeFileLock@4
273 FsRtlUninitializeLargeMcb@4
274 FsRtlUninitializeMcb@4
275 FsRtlUninitializeOplock@4
276 HalDispatchTable DATA
277 HalPrivateDispatchTable DATA
278 @HalExamineMBR=@xHalExamineMBR@16
279 InbvAcquireDisplayOwnership@0
280 InbvCheckDisplayOwnership@0
282 InbvEnableBootDriver@4
283 InbvEnableDisplayString@4
284 InbvInstallDisplayStringFilter@4
285 InbvIsBootDriverInstalled@0
286 InbvNotifyDisplayOwnershipLost@4
288 InbvSetScrollRegion@16
290 InbvSolidColorFill@20
291 InitSafeBootMode DATA
292 @InterlockedCompareExchange@12
293 @InterlockedDecrement@4
294 @InterlockedExchange@8
295 @InterlockedExchangeAdd@8
296 @InterlockedIncrement@4
297 @InterlockedPushEntrySList@8
298 @InterlockedPopEntrySList@4
299 IoAcquireCancelSpinLock@4
300 IoAcquireRemoveLockEx@20
301 IoAcquireVpbSpinLock@4
302 IoAdapterObjectType DATA
303 IoAllocateAdapterChannel@20
306 IoAllocateController@16
307 IoAllocateDriverObjectExtension@16
308 IoAllocateErrorLogEntry@8
310 IoAssignDriveLetters@16
313 IoAttachDeviceByPointer@8
314 IoAttachDeviceToDeviceStack@8
315 IoAttachDeviceToDeviceStackSafe@12
316 IoBuildAsynchronousFsdRequest@24
317 IoBuildDeviceIoControlRequest@36
319 IoBuildSynchronousFsdRequest@28
323 IoCheckDesiredAccess@8
324 IoCheckEaBufferValidity@12
325 IoCheckFunctionAccess@24
326 IoCheckQuerySetFileInformation@12
327 IoCheckQuerySetVolumeInformation@12
328 IoCheckQuotaBufferValidity@12
329 IoCheckShareAccess@20
331 IoConnectInterrupt@44
337 IoCreateFileSpecifyDeviceObjectHint@60
338 IoCreateNotificationEvent@8
339 IoCreateStreamFileObject@8
340 IoCreateStreamFileObjectEx@12
341 IoCreateStreamFileObjectLite@8
342 IoCreateSymbolicLink@8
343 IoCreateSynchronizationEvent@8
344 IoCreateUnprotectedSymbolicLink@8
354 IoDeleteSymbolicLink@4
356 IoDeviceHandlerObjectSize DATA
357 IoDeviceHandlerObjectType DATA
358 IoDeviceObjectType DATA
359 IoDisconnectInterrupt@4
360 IoDriverObjectType DATA
362 IoEnumerateDeviceObjectList@16
363 IoFastQueryNetworkAttributes@20
364 IoFileObjectType DATA
365 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
366 IoForwardIrpSynchronously@8
368 IoFreeErrorLogEntry@4
372 IoGetAttachedDevice@4
373 IoGetAttachedDeviceReference@4
374 IoGetBaseFileSystemDeviceObject@4
375 IoGetBootDiskInformation@8
376 IoGetConfigurationInformation@0
377 IoGetCurrentProcess@0
378 IoGetDeviceObjectPointer@16
379 IoGetDeviceAttachmentBaseRef@4
380 IoGetDeviceInterfaceAlias@12
381 IoGetDeviceInterfaces@16
382 IoGetDriverObjectExtension@8
383 IoGetDeviceProperty@20
384 IoGetDeviceToVerify@4
385 IoGetDiskDeviceObject@8
387 IoGetFileObjectGenericMapping@0
389 IoGetLowerDeviceObject@4
390 IoGetRelatedDeviceObject@4
391 IoGetRequestorProcess@4
392 IoGetRequestorProcessId@4
393 IoGetRequestorSessionId@8
397 IoInvalidateDeviceRelations@8
398 IoInvalidateDeviceState@4
399 IoInitializeRemoveLockEx@20
401 IoIsFileOriginRemote@4
403 IoIsValidNameGraftingBuffer@8
404 IoIsOperationSynchronous@4
405 IoMakeAssociatedIrp@8
406 IoOpenDeviceInterfaceRegistryKey@12
407 IoOpenDeviceRegistryKey@16
409 IoPnPDeliverServicePowerNotification@16
410 IoQueryDeviceDescription@32
411 IoQueryFileDosDeviceName@8
412 IoQueryFileInformation@20
413 IoQueryVolumeInformation@20
417 IoRaiseInformationalHardError@12
418 IoReadDiskSignature@12
419 IoReadOperationCount DATA
420 @IoReadPartitionTable@16
421 IoReadPartitionTableEx@8
422 IoReadTransferCount DATA
423 IoRegisterBootDriverReinitialization@12
424 IoRegisterDeviceInterface@16
425 IoRegisterDriverReinitialization@12
426 IoRegisterFileSystem@4
427 IoRegisterFsRegistrationChange@8
428 IoRegisterLastChanceShutdownNotification@4
429 IoRegisterPlugPlayNotification@28
430 IoRegisterShutdownNotification@4
431 IoReleaseCancelSpinLock@4
432 IoReleaseRemoveLockAndWaitEx@12
433 IoReleaseRemoveLockEx@12
434 IoReleaseVpbSpinLock@4
435 IoRemoveShareAccess@8
436 IoReportDetectedDevice@32
437 IoReportHalResourceUsage@16
438 IoReportResourceUsage@36
439 IoReportResourceForDetection@28
440 IoReportTargetDeviceChange@8
441 IoReportTargetDeviceChangeAsynchronous@16
442 IoRequestDeviceEject@4
444 IoSetCompletionRoutineEx@28
445 IoSetSystemPartition@4
446 IoSetDeviceInterfaceState@8
447 IoSetDeviceToVerify@8
449 IoSetHardErrorOrVerifyDevice@8
452 @IoSetPartitionInformation@16
453 IoSetPartitionInformationEx@12
454 IoSetStartIoAttributes@12
456 IoSetThreadHardErrorMode@4
459 IoStartNextPacketByKey@12
462 IoStatisticsLock DATA
464 IoSynchronousPageWrite@20
465 IoSynchronousInvalidateDeviceRelations@8
467 IoUnregisterFileSystem@4
468 IoUnregisterFsRegistrationChange@8
469 IoUnregisterPlugPlayNotification@4
470 IoUnregisterShutdownNotification@4
471 IoUpdateShareAccess@8
472 IoValidateDeviceIoControlAccess@8
473 IoVerifyPartitionTable@8
475 IoVolumeDeviceToDosName@8
476 IoWMIAllocateInstanceIds@12
477 IoWMIDeviceObjectToInstanceName@12
478 IoWMIExecuteMethod@24
479 IoWMIHandleToInstanceName@12
482 IoWMIQueryAllDataMultiple@16
483 IoWMIQuerySingleInstance@16
484 IoWMIQuerySingleInstanceMultiple@20
485 IoWMIRegistrationControl@8
486 IoWMISetNotificationCallback@12
487 IoWMISetSingleInstance@20
488 IoWMISetSingleItem@24
489 IoWMISuggestInstanceName@16
491 IoWriteErrorLogEntry@4
492 IoWriteOperationCount DATA
493 @IoWritePartitionTable@20
494 IoWritePartitionTableEx@8
495 IoWriteTransferCount DATA
497 @IofCompleteRequest@8
498 IoIsWdmVersionAvailable@8
499 KdDebuggerEnabled DATA
500 KdDebuggerNotPresent DATA
506 KdpServiceDispatcher@12
508 Ke386IoSetAccessProcess@8
509 Ke386QueryIoAccessMap@8
510 Ke386SetIoAccessMap@8
511 KeAcquireSpinLockAtDpcLevel@4
512 @KeAcquireDispatcherDatabaseLockAtDpcLevel@0
513 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
514 KeAcquireInterruptSpinLock@4
515 KeAddSystemServiceTable@20
518 ;KeBoostCurrentThread
522 KeCapturePersistentThreadState@28
525 KeDcacheFlushCount DATA
526 KeDelayExecutionThread@12
527 KeDeregisterBugCheckCallback@4
528 KeDeregisterBugCheckReasonCallback@4
530 KeDisconnectInterrupt@4
531 KeEnterCriticalRegion@0
532 KeEnterKernelDebugger@0
533 KeFindConfigurationEntry@16
534 KeFindConfigurationNextEntry@20
539 KeGetRecommendedSharedDataAlignment@0
541 KeI386AllocateGdtSelectors
542 ;KeI386Call16BitCStyleFunction
543 ;KeI386Call16BitFunction
544 KeI386FlatToGdtSelector
546 ;KeI386MachineType DATA
547 KeI386ReleaseGdtSelectors
549 ;KeI386SetGdtSelector
550 KeIcacheFlushCount DATA
552 KeInitializeDeviceQueue@4
555 KeInitializeInterrupt@44
559 KeInitializeSemaphore@12
560 KeInitializeSpinLock@4
562 KeInitializeTimerEx@8
563 KeInsertByKeyDeviceQueue@12
564 KeInsertDeviceQueue@8
569 KeIsAttachedProcess@0
571 KeLeaveCriticalRegion@0
573 KeNumberProcessors DATA
575 KeProfileInterruptWithSource@8
577 KeQueryActiveProcessors@0
578 KeQueryInterruptTime@0
579 KeQueryPriorityThread@4
580 KeQueryRuntimeThread@8
583 KeQueryTimeIncrement@0
584 KeRaiseUserException@4
589 KeReadStateSemaphore@4
591 KeRegisterBugCheckCallback@20
592 KeRegisterBugCheckReasonCallback@16
593 @KeReleaseDispatcherDatabaseLockFromDpcLevel@0
594 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
595 KeReleaseInterruptSpinLock@8
598 KeReleaseSemaphore@16
599 KeReleaseSpinLockFromDpcLevel@4
600 KeRemoveByKeyDeviceQueue@8
601 KeRemoveByKeyDeviceQueueIfBusy@8
602 KeRemoveDeviceQueue@4
603 KeRemoveEntryDeviceQueue@8
606 KeRemoveSystemServiceTable@4
608 KeRestoreFloatingPointState@4
609 KeRevertToUserAffinityThread@0
611 KeSaveFloatingPointState@4
612 KeSaveStateForHibernate
613 KeServiceDescriptorTable DATA
614 KeSetAffinityThread@8
615 KeSetBasePriorityThread@8
616 KeSetDmaIoCoherency@4
618 KeSetEventBoostPriority@8
619 KeSetIdealProcessorThread@8
621 KeSetKernelStackSwapEnable@4
622 KeSetPriorityThread@8
624 KeSetSystemAffinityThread@4
625 ;KeSetSwapContextNotifyRoutine
626 KeSetTargetProcessorDpc@8
627 ;KeSetThreadSelectNotifyRoutine
631 @KeSetTimeUpdateNotifyRoutine@4
632 KeStackAttachProcess@8
633 KeSynchronizeExecution@12
638 KeUnstackDetachProcess@4
639 KeUserModeCallback@20
640 KeWaitForMultipleObjects@32
641 KeWaitForMutexObject@20
642 KeWaitForSingleObject@20
643 @KefAcquireSpinLockAtDpcLevel@4
644 @KefReleaseSpinLockFromDpcLevel@4
650 KiKernelApcDeliveryCheck@0
651 KiDispatchInterrupt@0
652 KiEnableTimerWatchdog
653 KiInterruptDispatch2@8
654 KiIpiServiceRoutine@8
656 KiUnexpectedInterrupt@0
657 ;Kii386SpinOnSpinLock
661 LdrFindResourceDirectory_U@16
663 LpcPortObjectType DATA
665 LpcRequestWaitReplyPort@12
666 LsaCallAuthenticationPackage@28
667 LsaDeregisterLogonProcess@8
668 LsaFreeReturnBuffer@4
670 LsaLookupAuthenticationPackage@12
671 LsaRegisterLogonProcess@12
672 Mm64BitPhysicalAddress DATA
673 MmAddPhysicalMemory@8
674 MmAddVerifierThunks@8
675 MmAdjustWorkingSetSize@12
677 MmAllocateContiguousAlignedMemory@36
678 MmAllocateContiguousMemory@12
679 MmAllocateContiguousMemorySpecifyCache@32
680 MmAllocateMappingAddress@8
681 MmAllocateNonCachedMemory@4
682 MmAllocatePagesForMdl@28
683 MmBuildMdlForNonPagedPool@4
684 MmCanFileBeTruncated@8
689 MmDbgTranslatePhysicalAddress@8
690 MmDisableModifiedWriteOfSection@4
691 MmFlushImageSection@8
692 MmForceSectionClosed@8
693 MmFreeContiguousMemory@4
694 MmFreeContiguousMemorySpecifyCache@12
695 MmFreeMappingAddress@8
696 MmFreeNonCachedMemory@8
698 MmGetPhysicalAddress@4
699 MmGetPhysicalMemoryRanges@0
700 MmGetSystemRoutineAddress@4
701 MmGetVirtualForPhysical@8
703 MmHighestUserAddress DATA
705 MmIsDriverVerifying@4
706 MmIsNonPagedSystemAddressValid@4
707 MmIsRecursiveIoFault@0
708 MmIsThisAnNtAsSystem@0
709 MmIsVerifierEnabled@4
710 MmLockPagableDataSection@4
711 MmLockPagableImageSection@4=MmLockPagableDataSection@4
712 MmLockPagableSectionByHandle@4
715 MmMapLockedPagesSpecifyCache@24
716 MmMapLockedPagesWithReservedMapping@16
718 MmMapUserAddressesToPage@12
720 MmMapViewInSessionSpace@12
721 MmMapViewInSystemSpace@12
722 MmMapViewOfSection@40
723 MmMarkPhysicalMemoryAsBad@8
724 MmMarkPhysicalMemoryAsGood@8
727 MmProbeAndLockPages@12
728 MmProbeAndLockProcessPages@16
729 MmProbeAndLockSelectedPages@16
730 MmProtectMdlSystemAddress@8
732 MmRemovePhysicalMemory@8
733 MmResetDriverPaging@4
734 MmSectionObjectType DATA
735 MmSecureVirtualMemory@12
736 MmSetAddressRangeModified@8
737 MmSetBankedSection@24
739 MmSystemRangeStart DATA
740 MmTrimAllSystemPagableMemory@4
741 MmUnlockPagableImageSection@4
745 MmUnmapReservedMapping@12
746 MmUnmapVideoDisplay@8
747 MmUnmapViewInSessionSpace@4
748 MmUnmapViewInSystemSpace@4
749 MmUnmapViewOfSection@8
750 MmUnsecureVirtualMemory@4
751 MmUserProbeAddress DATA
754 NlsMbCodePageTag DATA
755 NlsMbOemCodePageTag DATA
756 NlsOemLeadByteInfo DATA
758 NtAdjustPrivilegesToken@24
760 NtAllocateLocallyUniqueId@4
762 NtAllocateVirtualMemory@24
773 NtDeviceIoControlFile@40
777 NtFreeVirtualMemory@16
781 NtMakePermanentObject@4
782 NtMapViewOfSection@40
783 NtNotifyChangeDirectoryFile@36
786 NtOpenProcessToken@12
787 NtOpenProcessTokenEx@16
790 NtOpenThreadTokenEx@20
791 NtQueryDirectoryFile@44
793 NtQueryInformationAtom@20
794 NtQueryInformationFile@20
795 NtQueryInformationProcess@20
796 NtQueryInformationThread@20
797 NtQueryInformationToken@20
798 NtQueryQuotaInformationFile@36
799 NtQuerySecurityObject@20
800 NtQuerySystemInformation@16
802 NtQueryVolumeInformationFile@20
805 NtRequestWaitReplyPort@12
808 NtSetInformationFile@20
809 NtSetInformationProcess@16
810 NtSetInformationThread@16
811 NtSetQuotaInformationFile@16
812 NtSetSecurityObject@12
813 NtSetVolumeInformationFile@20
820 NtWaitForSingleObject@12
823 ;ObCheckCreateObjectAccess@28
824 ;ObCheckObjectAccess@20
826 ObFindHandleForObject@20
827 ObGetObjectPointerCount@4
828 ObGetObjectSecurity@12
830 ObMakeTemporaryObject@4
831 ObOpenObjectByName@28
832 ObOpenObjectByPointer@28
834 ObQueryObjectAuditingByHandle@8
835 @ObfDereferenceObject@4
836 @ObfReferenceObject@4
837 ObReferenceObjectByHandle@24
838 ObReferenceObjectByName@32
839 ObReferenceObjectByPointer@16
840 ObReleaseObjectSecurity@8
841 ObDereferenceObject@4
842 ;ObSetSecurityDescriptorInfo@24
848 PoQueueShutdownWorkItem@4
849 PoRegisterDeviceForIdleDetection@16
850 PoRegisterSystemState@8
855 PoStartNextPowerIrp@4
856 PoUnregisterSystemState@4
859 PsAssignImpersonationToken@8
861 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
862 PsChargeProcessPagedPoolQuota@8
863 PsChargeProcessPoolQuota@12
864 PsCreateSystemProcess@12
865 PsCreateSystemThread@28
866 PsCreateWin32Process@4
867 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
868 PsDereferencePrimaryToken@4
869 PsDisableImpersonation@8
870 PsEstablishWin32Callouts@24
871 PsGetCurrentProcessId@0
872 PsGetCurrentProcessSessionId@0
873 PsGetCurrentThreadId@0
874 PsGetCurrentThreadPreviousMode@0
875 PsGetCurrentThreadStackBase@0
876 PsGetCurrentThreadStackLimit@0
879 PsGetJobUIRestrictionsClass@4
880 PsGetProcessCreateTimeQuadPart@4
881 PsGetProcessDebugPort@4
882 PsGetProcessExitProcessCalled@4
883 PsGetProcessExitStatus@4
884 PsGetProcessExitTime@0
886 PsGetProcessImageFileName@4
887 PsGetProcessInheritedFromUniqueProcessId@4
890 PsGetProcessPriorityClass@4
891 PsGetProcessSectionBaseAddress@4
892 PsGetProcessSecurityPort@4
893 PsGetProcessSessionId@4
894 PsGetProcessWin32Process@4
895 PsGetProcessWin32WindowStation@4
896 PsGetThreadFreezeCount@4
897 PsGetThreadHardErrorsAreDisabled@4
900 PsGetThreadProcessId@4
901 PsGetThreadSessionId@4
903 PsGetThreadWin32Thread@4
907 PsImpersonateClient@20
908 PsInitialSystemProcess DATA
909 PsIsProcessBeingDebugged@4
911 PsIsThreadImpersonating@4
912 PsIsThreadTerminating@4
914 PsLookupProcessByProcessId@8
915 PsLookupProcessThreadByCid@12
916 PsLookupThreadByThreadId@8
918 PsReferenceImpersonationToken@16
919 PsReferencePrimaryToken@4
920 PsRemoveCreateThreadNotifyRoutine@4
921 PsRemoveLoadImageNotifyRoutine@4
922 PsRestoreImpersonation@8
924 PsReturnProcessNonPagedPoolQuota@8
925 PsReturnProcessPagedPoolQuota@8
927 PsRevertThreadToSelf@4
928 PsSetCreateProcessNotifyRoutine@8
929 PsSetCreateThreadNotifyRoutine@4
930 PsSetJobUIRestrictionsClass@8
931 PsSetLegoNotifyRoutine@4
932 PsSetProcessPriorityClass@8
933 PsSetProcessSecurityPort@8
934 PsSetProcessWin32Process@8
935 PsSetProcessWin32WindowStation@8
936 PsSetThreadHardErrorsAreDisabled@8
937 PsSetThreadWin32Thread@8
938 PsSetLoadImageNotifyRoutine@4
939 PsTerminateSystemThread@4
941 READ_REGISTER_UCHAR@4
942 READ_REGISTER_ULONG@4
943 READ_REGISTER_USHORT@4
944 READ_REGISTER_BUFFER_UCHAR@12
945 READ_REGISTER_BUFFER_ULONG@12
946 READ_REGISTER_BUFFER_USHORT@12
948 KeRosDumpStackFrames@8
949 KeRosGetStackFrames@8
950 RtlAbsoluteToSelfRelativeSD@12
951 RtlAddAccessAllowedAce@16
953 RtlAddAtomToAtomTable@12
955 ;RtlAllocateAndInitializeSid
957 RtlAnsiCharToUnicodeChar@4
958 RtlAnsiStringToUnicodeSize@4
959 RtlAnsiStringToUnicodeString@12
960 RtlAppendAsciizToString@8
961 RtlAppendStringToString@8
962 RtlAppendUnicodeStringToString@8
963 RtlAppendUnicodeToString@8
964 RtlAreAllAccessesGranted@8
965 RtlAreAnyAccessesGranted@8
970 RtlCaptureStackBackTrace@16
972 RtlCheckRegistryKey@8
977 RtlCompareMemoryUlong@12
979 RtlCompareUnicodeString@12
982 RtlConvertLongToLargeInteger@4
983 RtlConvertSidToUnicodeString@12
984 RtlConvertUlongToLargeInteger@4
989 RtlCopyUnicodeString@8
993 RtlCreateRegistryKey@8
994 RtlCreateSecurityDescriptor@8
995 RtlCreateSystemVolumeInformationFolder@4
996 RtlCreateUnicodeString@8
997 RtlCustomCPToUnicodeN@24
998 RtlDecompressBuffer@24
999 RtlDecompressChunks@28
1000 RtlDecompressFragment@32
1003 RtlDeleteAtomFromAtomTable@8
1004 RtlDeleteElementGenericTable@8
1005 RtlDeleteElementGenericTableAvl@8
1007 RtlDeleteOwnersRanges@8
1009 RtlDeleteRegistryValue@12
1011 RtlDestroyAtomTable@4
1013 RtlDowncaseUnicodeString@12
1015 RtlEnlargedIntegerMultiply@8
1016 RtlEnlargedUnsignedDivide@16
1017 RtlEnlargedUnsignedMultiply@8
1018 RtlEnumerateGenericTable@8
1019 RtlEnumerateGenericTableAvl@8
1020 RtlEnumerateGenericTableLikeADirectory@28
1021 RtlEnumerateGenericTableWithoutSplaying@8
1022 RtlEnumerateGenericTableWithoutSplayingAvl@8
1026 RtlEqualUnicodeString@12
1027 RtlExtendedIntegerMultiply@12
1028 RtlExtendedLargeIntegerDivide@16
1029 RtlExtendedMagicDivide@20
1031 RtlFillMemoryUlong@12
1033 RtlFindClearBitsAndSet@12
1035 RtlFindFirstRunClear@8
1036 RtlFindFirstRunSet@8
1037 RtlFindLastBackwardRunClear@12
1038 RtlFindLeastSignificantBit@8
1039 RtlFindLongestRunClear@8
1040 RtlFindLongestRunSet@8
1042 RtlFindMostSignificantBit@8
1043 RtlFindNextForwardRunClear@12
1046 RtlFindSetBitsAndClear@12
1047 RtlFindUnicodePrefix@12
1048 RtlFormatCurrentUserKeyPath@4
1053 RtlFreeUnicodeString@4
1055 RtlGenerate8dot3Name@16
1057 RtlGetCallersAddress@8
1058 RtlGetCompressionWorkSpaceSize@12
1059 RtlGetDaclSecurityDescriptor@16
1060 RtlGetDefaultCodePage@8
1061 RtlGetElementGenericTable@8
1062 RtlGetElementGenericTableAvl@8
1064 RtlGetGroupSecurityDescriptor@12
1066 RtlGetNtGlobalFlags@0
1067 RtlGetOwnerSecurityDescriptor@12
1068 RtlGetSaclSecurityDescriptor@16
1069 RtlGetSetBootStatusData@24
1071 RtlHashUnicodeString@16
1073 RtlImageDirectoryEntryToData@16
1075 RtlInitCodePageTable@8
1077 RtlInitUnicodeString@8
1078 RtlInitializeBitMap@12
1079 RtlInitializeGenericTable@20
1080 RtlInitializeGenericTableAvl@20
1081 RtlInitializeRangeList@4
1083 RtlInitializeUnicodePrefix@4
1084 RtlInsertElementGenericTable@16
1085 RtlInsertElementGenericTableAvl@16
1086 RtlInsertElementGenericTableFull@24
1087 RtlInsertElementGenericTableFullAvl@24
1088 RtlInsertUnicodePrefix@12
1089 RtlInt64ToUnicodeString@16
1091 RtlIntegerToUnicode@16
1092 RtlIntegerToUnicodeString@12
1093 RtlInvertRangeList@8
1094 RtlIpv4AddressToStringA@8
1095 RtlIpv4AddressToStringExA@16
1096 RtlIpv4AddressToStringExW@16
1097 RtlIpv4AddressToStringW@8
1098 RtlIpv4StringToAddressA@16
1099 RtlIpv4StringToAddressExA@16
1100 RtlIpv4StringToAddressExW@16
1101 RtlIpv4StringToAddressW@16
1102 RtlIpv6AddressToStringA@8
1103 RtlIpv6AddressToStringExA@16
1104 RtlIpv6AddressToStringExW@16
1105 RtlIpv6AddressToStringW@8
1106 RtlIpv6StringToAddressA@16
1107 RtlIpv6StringToAddressExA@16
1108 RtlIpv6StringToAddressExW@16
1109 RtlIpv6StringToAddressW@16
1110 RtlIsGenericTableEmpty@4
1111 RtlIsGenericTableEmptyAvl@4
1112 RtlIsNameLegalDOS8Dot3@12
1113 RtlIsRangeAvailable@40
1114 RtlIsValidOemCharacter@4
1115 RtlLargeIntegerAdd@16
1116 RtlLargeIntegerArithmeticShift@12
1117 RtlLargeIntegerDivide@20
1118 RtlLargeIntegerNegate@8
1119 RtlLargeIntegerShiftLeft@12
1120 RtlLargeIntegerShiftRight@12
1121 RtlLargeIntegerSubtract@16
1122 RtlLengthRequiredSid@4
1123 RtlLengthSecurityDescriptor@4
1125 RtlLockBootStatusData@4
1126 RtlLookupAtomInAtomTable@12
1127 RtlLookupElementGenericTable@8
1128 RtlLookupElementGenericTableAvl@8
1129 RtlLookupElementGenericTableFull@16
1130 RtlLookupElementGenericTableFullAvl@16
1132 RtlMapSecurityErrorToNtStatus@4
1133 RtlMergeRangeLists@16
1135 RtlMultiByteToUnicodeN@20
1136 RtlMultiByteToUnicodeSize@12
1137 RtlNextUnicodePrefix@8
1138 RtlNtStatusToDosError@4
1139 RtlNtStatusToDosErrorNoTeb@4
1140 RtlNumberGenericTableElements@4
1141 RtlNumberGenericTableElementsAvl@4
1142 RtlNumberOfClearBits@4
1143 RtlNumberOfSetBits@4
1144 RtlOemStringToCountedUnicodeString@12
1145 RtlOemStringToUnicodeSize@4
1146 RtlOemStringToUnicodeString@12
1148 RtlPinAtomInAtomTable@8
1149 @RtlPrefetchMemoryNonTemporal@8
1151 RtlPrefixUnicodeString@12
1152 RtlQueryAtomInAtomTable@24
1153 RtlQueryRegistryValues@20
1154 RtlQueryTimeZoneInformation@4
1158 RtlRealPredecessor@4
1160 RtlRemoveUnicodePrefix@8
1162 RtlSecondsSince1970ToTime@8
1163 RtlSecondsSince1980ToTime@8
1164 RtlSelfRelativeToAbsoluteSD2@8
1165 RtlSelfRelativeToAbsoluteSD@44
1169 RtlSetDaclSecurityDescriptor@16
1170 RtlSetGroupSecurityDescriptor@12
1171 RtlSetOwnerSecurityDescriptor@12
1172 RtlSetSaclSecurityDescriptor@16
1173 RtlSetTimeZoneInformation@4
1177 RtlSubAuthorityCountSid@4
1178 RtlSubAuthoritySid@8
1179 RtlSubtreePredecessor@4
1180 RtlSubtreeSuccessor@4
1182 RtlTimeFieldsToTime@8
1183 RtlTimeToElapsedTimeFields@8
1184 RtlTimeToSecondsSince1970@8
1185 RtlTimeToSecondsSince1980@8
1186 RtlTimeToTimeFields@8
1188 @RtlUlonglongByteSwap@8
1189 RtlUnicodeStringToAnsiSize@4
1190 RtlUnicodeStringToAnsiString@12
1191 RtlUnicodeStringToCountedOemString@12
1192 RtlUnicodeStringToInteger@12
1193 RtlUnicodeStringToOemSize@4
1194 RtlUnicodeStringToOemString@12
1195 RtlUnicodeToCustomCPN@24
1196 RtlUnicodeToMultiByteN@20
1197 RtlUnicodeToMultiByteSize@12
1199 RtlUnlockBootStatusData@4
1201 RtlUpcaseUnicodeChar@4
1202 RtlUpcaseUnicodeString@12
1203 RtlUpcaseUnicodeStringToAnsiString@12
1204 RtlUpcaseUnicodeStringToCountedOemString@12
1205 RtlUpcaseUnicodeStringToOemString@12
1206 RtlUpcaseUnicodeToCustomCPN@24
1207 RtlUpcaseUnicodeToMultiByteN@20
1208 RtlUpcaseUnicodeToOemN@20
1211 @RtlUshortByteSwap@4
1212 RtlValidRelativeSecurityDescriptor@12
1213 RtlValidSecurityDescriptor@4
1215 RtlVerifyVersionInfo@16
1216 RtlVolumeDeviceToDosName@8
1217 RtlWalkFrameChain@12
1218 RtlWriteRegistryValue@24
1221 RtlxAnsiStringToUnicodeSize@4
1222 RtlxOemStringToUnicodeSize@4
1223 RtlxUnicodeStringToAnsiSize@4
1224 RtlxUnicodeStringToOemSize@4
1226 SeAppendPrivileges@8
1228 SeAssignSecurityEx@36
1229 SeAuditHardLinkCreation@12
1230 SeAuditingFileEvents@8
1231 SeAuditingFileEventsWithContext@12
1232 SeAuditingFileOrGlobalEvents@12
1233 SeAuditingHardLinkEvents@8
1234 SeAuditingHardLinkEventsWithContext@12
1235 SeCaptureSecurityDescriptor@20
1236 SeCaptureSubjectContext@4
1237 SeCloseObjectAuditAlarm@12
1238 SeCreateAccessState@16
1239 SeCreateClientSecurity@16
1240 SeCreateClientSecurityFromSubjectContext@16
1241 SeDeassignSecurity@4
1242 SeDeleteAccessState@4
1243 SeDeleteObjectAuditAlarm@8
1247 SeImpersonateClient@8
1248 SeImpersonateClientEx@8
1249 SeLockSubjectContext@4
1250 SeMarkLogonSessionForTerminationNotification@4
1251 SeOpenObjectAuditAlarm@36
1252 SeOpenObjectForDeleteAuditAlarm@36
1254 SePrivilegeObjectAuditAlarm@24
1255 SePublicDefaultDacl DATA
1256 SeQueryAuthenticationIdToken@8
1257 SeQueryInformationToken@12
1258 SeQuerySecurityDescriptorInfo@16
1259 SeQuerySessionIdToken@8
1260 SeRegisterLogonSessionTerminatedRoutine@4
1261 SeReleaseSecurityDescriptor@12
1262 SeReleaseSubjectContext@4
1263 SeSetAccessStateGenericMapping@8
1264 SeSetSecurityDescriptorInfo@24
1265 SeSetSecurityDescriptorInfoEx@28
1266 SeSinglePrivilegeCheck@12
1267 SeSystemDefaultDacl DATA
1268 SeTokenImpersonationLevel@4
1270 SeTokenIsRestricted@4
1271 SeTokenIsWriteRestricted@4
1273 SeUnlockSubjectContext@4
1274 SeUnregisterLogonSessionTerminatedRoutine@4
1275 SeValidSecurityDescriptor@8
1276 VerSetConditionMask@16
1277 WRITE_REGISTER_UCHAR@8
1278 WRITE_REGISTER_ULONG@8
1279 WRITE_REGISTER_USHORT@8
1280 WRITE_REGISTER_BUFFER_UCHAR@12
1281 WRITE_REGISTER_BUFFER_ULONG@12
1282 WRITE_REGISTER_BUFFER_USHORT@12
1283 ZwAccessCheckAndAuditAlarm@44
1285 ZwAdjustPrivilegesToken@24
1287 ZwAllocateVirtualMemory@24
1288 ZwAssignProcessToJobObject@8
1293 ZwCloseObjectAuditAlarm@12
1295 ZwCreateDirectoryObject@12
1298 ZwCreateJobObject@12
1301 ZwCreateSymbolicLinkObject@16
1307 ZwDeviceIoControlFile@40
1309 ZwDuplicateObject@28
1311 ZwEnumerateBootEntries@8
1313 ZwEnumerateValueKey@24
1314 ZwFlushInstructionCache@12
1316 ZwFlushVirtualMemory@16
1317 ZwFreeVirtualMemory@16
1319 ZwInitiatePowerAction@16
1323 ZwMakeTemporaryObject@4
1324 ZwMapViewOfSection@40
1325 ZwNotifyChangeKey@40
1326 ZwOpenDirectoryObject@12
1332 ZwOpenProcessToken@12
1333 ZwOpenProcessTokenEx@16
1335 ZwOpenSymbolicLinkObject@12
1337 ZwOpenThreadToken@16
1338 ZwOpenThreadTokenEx@20
1340 ZwPowerInformation@20
1342 ZwQueryBootEntryOrder@8
1343 ZwQueryBootOptions@8
1344 ZwQueryDefaultLocale@8
1345 ZwQueryDefaultUILanguage@4
1346 ZwQueryDirectoryFile@44
1347 ZwQueryDirectoryObject@28
1349 ZwQueryFullAttributesFile@8
1350 ZwQueryInformationAtom@20
1351 ZwQueryInformationFile@20
1352 ZwQueryInformationJobObject@20
1353 ZwQueryInformationProcess@20
1354 ZwQueryInformationThread@20
1355 ZwQueryInformationToken@20
1356 ZwQueryInstallUILanguage@4
1360 ZwQuerySecurityObject@20
1361 ZwQuerySymbolicLinkObject@12
1362 ZwQuerySystemInformation@16
1365 ZwQueryVolumeInformationFile@20
1368 ZwRequestWaitReplyPort@12
1373 ZwSetBootEntryOrder@8
1375 ZwSetDefaultLocale@8
1376 ZwSetDefaultUILanguage@4
1379 ZwSetInformationFile@20
1380 ZwSetInformationJobObject@16
1381 ZwSetInformationObject@16
1382 ZwSetInformationProcess@16
1383 ZwSetInformationThread@16
1384 ZwSetSecurityObject@12
1385 ZwSetSystemInformation@12
1389 ZwSetVolumeInformationFile@20
1390 ZwTerminateJobObject@8
1391 ZwTerminateProcess@8
1392 ZwTranslateFilePath@12
1395 ZwUnmapViewOfSection@8
1396 ZwWaitForMultipleObjects@20
1397 ZwWaitForSingleObject@12
1400 _abnormal_termination