1 ; $Id: ntoskrnl.def,v 1.199 2004/11/07 22:55:37 navaraf Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
18 CcGetFileObjectFromBcb@4
19 CcGetFileObjectFromSectionPtrs@4
20 CcGetFlushedValidData@8
21 CcGetLsnForFileObject@8
22 CcInitializeCacheMap@20
24 CcFastMdlReadWait DATA
25 CcFastReadNotPossible DATA
36 CcPurgeCacheSection@16
39 CcScheduleReadAhead@12
40 CcSetAdditionalCacheAttributes@12
41 CcSetBcbOwnerPointer@8
42 CcSetDirtyPageThreshold@8
43 CcSetDirtyPinnedData@8
44 CcSetLogHandleForFile@12
45 CcSetReadAheadGranularity@8
46 CcUninitializeCacheMap@12
48 CcUnpinDataForThread@8
50 CcWaitForCurrentLazyWriterActivity@0
55 CmUnRegisterCallback@8
57 DbgBreakPointWithStatus@4
58 DbgLoadImageSymbols@12
62 DbgPrintReturnControlC
63 DbgQueryDebugFilterState@8
64 DbgSetDebugFilterState@12
65 @ExAcquireFastMutexUnsafe@4
66 ExAcquireResourceExclusive@8
67 ExAcquireResourceExclusiveLite@8
68 ExAcquireResourceSharedLite@8
69 @ExAcquireRundownProtection@4
70 @ExAcquireRundownProtectionEx@8
71 ExAcquireSharedStarveExclusive@8
72 ExAcquireSharedWaitForExclusive@8
73 @ExAllocateFromPagedLookasideList@4=@ExiAllocateFromPagedLookasideList@4
75 ExAllocatePoolWithQuota@8
76 ExAllocatePoolWithQuotaTag@12
77 ExAllocatePoolWithTag@12
78 ExAllocatePoolWithTagPriority@16
79 ExConvertExclusiveToSharedLite@4
81 ExDeleteNPagedLookasideList@4
82 ExDeletePagedLookasideList@4
84 ExDeleteResourceLite@4
85 ExDesktopObjectType DATA
86 ExDisableResourceBoostLite@4
88 ExEventObjectType DATA
92 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
93 ExGetCurrentProcessorCounts@12
94 ExGetCurrentProcessorCpuUsage@4
95 ExGetExclusiveWaiterCount@4
97 ExGetSharedWaiterCount@4
98 @ExInitializeRundownProtection@4
99 ExInitializeNPagedLookasideList@28
100 ExInitializePagedLookasideList@28
101 ExInitializeResource@4
102 ExInitializeResourceLite@4
104 ExInterlockedAddLargeInteger@16
105 @ExInterlockedAddLargeStatistic@8
106 ExInterlockedAddUlong@12
107 @ExInterlockedCompareExchange64@16
108 ExInterlockedDecrementLong@8
109 ExInterlockedExchangeUlong@12
110 ExInterlockedExtendZone@16
111 ExInterlockedIncrementLong@8
112 @ExInterlockedFlushSList@4
113 ExInterlockedInsertHeadList@12
114 ExInterlockedInsertTailList@12
115 ExInterlockedPopEntryList@8
116 @ExInterlockedPopEntrySList@8
117 ExInterlockedPushEntryList@12
118 @ExInterlockedPushEntrySList@12
119 ExInterlockedRemoveHeadList@8
120 ExIsProcessorFeaturePresent@4
121 ExIsResourceAcquiredExclusiveLite@4
122 ExIsResourceAcquiredSharedLite@4
123 ExLocalTimeToSystemTime@8
126 ExQueryPoolBlockSize@8
128 ExRaiseAccessViolation@0
129 ExRaiseDatatypeMisalignment@0
133 ExRegisterCallback@12
134 ExReinitializeResourceLite@4
135 @ExReInitializeRundownProtection@4
136 @ExReleaseFastMutexUnsafe@4
137 ExReleaseResourceForThread@8
138 ExReleaseResourceForThreadLite@8
139 @ExReleaseResourceLite@4
140 @ExReleaseRundownProtection@4
141 @ExReleaseRundownProtectionEx@8
142 @ExRundownCompleted@4
143 ExSetResourceOwnerPointer@8
144 ExSetTimerResolution@8
145 ExSystemExceptionFilter@0
146 ExSystemTimeToLocalTime@8
147 ExTryToAcquireResourceExclusiveLite@4
148 ExUnregisterCallback@4
151 @ExWaitForRundownProtectionRelease@4
152 ExWindowStationObjectType DATA
153 ExInitializeBinaryTree@12
155 ExInsertBinaryTree@12
156 ExSearchBinaryTree@12
157 ExRemoveBinaryTree@12
158 ExTraverseBinaryTree@16
159 ExInitializeSplayTree@16
164 ExWeightOfSplayTree@8
165 ExTraverseSplayTree@16
166 ExInitializeHashTable@16
171 @ExfAcquirePushLockExclusive@4
172 @ExfAcquirePushLockShared@4
173 @ExfReleasePushLock@4
174 @ExfInterlockedAddUlong@12
175 @ExfInterlockedInsertHeadList@12
176 @ExfInterlockedInsertTailList@12
177 @ExfInterlockedCompareExchange64@12
178 @ExfInterlockedPopEntryList@8
179 @ExfInterlockedPushEntryList@12
180 @ExfInterlockedRemoveHeadList@8
181 @Exfi386InterlockedDecrementLong@4
182 @Exfi386InterlockedExchangeUlong@8
183 @Exfi386InterlockedIncrementLong@4
184 Exi386InterlockedDecrementLong@4
185 Exi386InterlockedExchangeUlong@8
186 Exi386InterlockedIncrementLong@4
187 FsRtlAcquireFileExclusive@4
188 FsRtlAddLargeMcbEntry@28
190 FsRtlAddToTunnelCache@32
191 FsRtlAllocateFileLock@8
193 FsRtlAllocatePoolWithQuota@8
194 FsRtlAllocatePoolWithQuotaTag@12
195 FsRtlAllocatePoolWithTag@12
196 FsRtlAllocateResource@0
197 FsRtlAreNamesEqual@16
199 FsRtlCheckLockForReadAccess@8
200 FsRtlCheckLockForWriteAccess@8
204 FsRtlCurrentBatchOplock@4
205 FsRtlDeleteKeyFromTunnelCache@12
206 FsRtlDeleteTunnelCache@4
207 FsRtlDeregisterUncProvider@4
210 FsRtlDoesDbcsContainWildCards@4
211 FsRtlDoesNameContainWildCards@4
212 FsRtlFastCheckLockForRead@24
213 FsRtlFastCheckLockForWrite@24
214 FsRtlFastUnlockAll@16
215 FsRtlFastUnlockAllByKey@20
216 FsRtlFastUnlockSingle@32
217 FsRtlFindInTunnelCache@32
220 FsRtlGetNextFileLock@8
221 FsRtlGetNextLargeMcbEntry@20
222 FsRtlGetNextMcbEntry@20
223 FsRtlIncrementCcFastReadNotPossible@0
224 FsRtlIncrementCcFastReadNoWait@0
225 FsRtlIncrementCcFastReadResourceMiss@0
226 FsRtlIncrementCcFastReadWait@0
227 FsRtlInitializeFileLock@12
228 FsRtlInitializeLargeMcb@8
230 FsRtlInitializeOplock@4
231 FsRtlInitializeTunnelCache@4
232 FsRtlInsertPerFileObjectContext@8
233 FsRtlInsertPerStreamContext@8
234 FsRtlIsDbcsInExpression@8
235 FsRtlIsFatDbcsLegal@20
236 FsRtlIsHpfsDbcsLegal@20
237 FsRtlIsNameInExpression@16
238 FsRtlIsNtstatusExpected@4
240 FsRtlIsTotalDeviceFailure@4
241 FsRtlLegalAnsiCharacterArray DATA
242 FsRtlLookupLargeMcbEntry@32
243 FsRtlLookupLastLargeMcbEntry@12
244 FsRtlLookupLastLargeMcbEntryAndInde@16=FsRtlLookupLastLargeMcbEntryAndIndex@16
245 FsRtlLookupLastMcbEntry@12
246 FsRtlLookupMcbEntry@20
247 FsRtlLookupPerFileObjectContext@12
248 FsRtlLookupPerStreamContextInternal@12
250 FsRtlMdlReadComplete@8
251 FsRtlMdlReadCompleteDev@12
253 FsRtlMdlWriteComplete@12
254 FsRtlMdlWriteCompleteDev@16
255 FsRtlNormalizeNtstatus@8
256 FsRtlNotifyChangeDirectory@28
257 FsRtlNotifyCleanup@12
258 FsRtlNotifyFilterChangeDirectory@44
259 FsRtlNotifyFilterReportChange@40
260 FsRtlNotifyFullChangeDirectory@40
261 FsRtlNotifyFullReportChange@36
262 FsRtlNotifyInitializeSync@4
263 FsRtlNotifyReportChange@20
264 FsRtlNotifyUninitializeSync@4
265 FsRtlNotifyVolumeEvent@8
266 FsRtlNumberOfRunsInLargeMcb@4
267 FsRtlNumberOfRunsInMcb@4
269 FsRtlOplockIsFastIoPossible@4
270 FsRtlPostPagingFileStackOverflow@12
271 FsRtlPostStackOverflow@12
272 FsRtlPrepareMdlWrite@24
273 FsRtlPrepareMdlWriteDev@28
275 FsRtlProcessFileLock@12
276 FsRtlRegisterUncProvider@12
278 FsRtlRemoveLargeMcbEntry@20
279 FsRtlRemoveMcbEntry@12
280 FsRtlRemovePerFileObjectContext@12
281 FsRtlRemovePerStreamContext@12
283 FsRtlSplitLargeMcb@20
285 FsRtlTruncateLargeMcb@12
287 FsRtlUninitializeFileLock@4
288 FsRtlUninitializeLargeMcb@4
289 FsRtlUninitializeMcb@4
290 FsRtlUninitializeOplock@4
291 HalDispatchTable DATA
292 HalPrivateDispatchTable DATA
293 @HalExamineMBR=@xHalExamineMBR@16
294 InbvAcquireDisplayOwnership@0
295 InbvCheckDisplayOwnership@0
297 InbvEnableBootDriver@4
298 InbvEnableDisplayString@4
299 InbvInstallDisplayStringFilter@4
300 InbvIsBootDriverInstalled@0
301 InbvNotifyDisplayOwnershipLost@4
303 InbvSetScrollRegion@16
305 InbvSolidColorFill@20
306 InitSafeBootMode DATA
307 @InterlockedCompareExchange@12
308 @InterlockedDecrement@4
309 @InterlockedExchange@8
310 @InterlockedExchangeAdd@8
311 @InterlockedIncrement@4
312 @InterlockedPushEntrySList@8
313 @InterlockedPopEntrySList@4
314 IoAcquireCancelSpinLock@4
315 IoAcquireRemoveLockEx@20
316 IoAcquireVpbSpinLock@4
317 IoAdapterObjectType DATA
318 IoAllocateAdapterChannel@20
321 IoAllocateController@16
322 IoAllocateDriverObjectExtension@16
323 IoAllocateErrorLogEntry@8
325 IoAssignDriveLetters@16
328 IoAttachDeviceByPointer@8
329 IoAttachDeviceToDeviceStack@8
330 IoAttachDeviceToDeviceStackSafe@12
331 IoBuildAsynchronousFsdRequest@24
332 IoBuildDeviceIoControlRequest@36
334 IoBuildSynchronousFsdRequest@28
338 IoCheckDesiredAccess@8
339 IoCheckEaBufferValidity@12
340 IoCheckFunctionAccess@24
341 IoCheckQuerySetFileInformation@12
342 IoCheckQuerySetVolumeInformation@12
343 IoCheckQuotaBufferValidity@12
344 IoCheckShareAccess@20
346 IoConnectInterrupt@44
352 IoCreateFileSpecifyDeviceObjectHint@60
353 IoCreateNotificationEvent@8
354 IoCreateStreamFileObject@8
355 IoCreateStreamFileObjectEx@12
356 IoCreateStreamFileObjectLite@8
357 IoCreateSymbolicLink@8
358 IoCreateSynchronizationEvent@8
359 IoCreateUnprotectedSymbolicLink@8
363 IoDeleteSymbolicLink@4
365 IoDeviceHandlerObjectSize DATA
366 IoDeviceHandlerObjectType DATA
367 IoDeviceObjectType DATA
368 IoDisconnectInterrupt@4
369 IoDriverObjectType DATA
371 IoEnumerateDeviceObjectList@16
372 IoFastQueryNetworkAttributes@20
373 IoFileObjectType DATA
374 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
375 IoForwardIrpSynchronously@8
377 IoFreeErrorLogEntry@4
381 IoGetAttachedDevice@4
382 IoGetAttachedDeviceReference@4
383 IoGetBaseFileSystemDeviceObject@4
384 IoGetBootDiskInformation@8
385 IoGetConfigurationInformation@0
386 IoGetCurrentProcess@0
387 IoGetDeviceObjectPointer@16
388 IoGetDeviceAttachmentBaseRef@4
389 IoGetDeviceInterfaceAlias@12
390 IoGetDeviceInterfaces@16
391 IoGetDriverObjectExtension@8
392 IoGetDeviceProperty@20
393 IoGetDeviceToVerify@4
394 IoGetDiskDeviceObject@8
396 IoGetFileObjectGenericMapping@0
398 IoGetLowerDeviceObject@4
399 IoGetRelatedDeviceObject@4
400 IoGetRequestorProcess@4
401 IoGetRequestorProcessId@4
402 IoGetRequestorSessionId@8
406 IoInvalidateDeviceRelations@8
407 IoInvalidateDeviceState@4
408 IoInitializeRemoveLockEx@20
410 IoIsFileOriginRemote@4
412 IoIsValidNameGraftingBuffer@8
413 IoIsOperationSynchronous@4
414 IoMakeAssociatedIrp@8
415 IoOpenDeviceInstanceKey@20
416 IoOpenDeviceInterfaceRegistryKey@12
417 IoOpenDeviceRegistryKey@16
419 IoPnPDeliverServicePowerNotification@16
420 IoQueryDeviceDescription@32
421 IoQueryDeviceEnumInfo@8
422 IoQueryFileDosDeviceName@8
423 IoQueryFileInformation@20
424 IoQueryVolumeInformation@20
428 IoRaiseInformationalHardError@12
429 IoReadDiskSignature@12
430 IoReadOperationCount DATA
431 IoReadPartitionTable@16
432 IoReadPartitionTableEx@8
433 IoReadTransferCount DATA
434 IoRegisterBootDriverReinitialization@12
435 IoRegisterDeviceInterface@16
436 IoRegisterDriverReinitialization@12
437 IoRegisterFileSystem@4
438 IoRegisterFsRegistrationChange@8
439 IoRegisterLastChanceShutdownNotification@4
440 IoRegisterPlugPlayNotification@28
441 IoRegisterShutdownNotification@4
442 IoReleaseCancelSpinLock@4
443 IoReleaseRemoveLockAndWaitEx@12
444 IoReleaseRemoveLockEx@12
445 IoReleaseVpbSpinLock@4
446 IoRemoveShareAccess@8
447 IoReportDetectedDevice@32
448 IoReportHalResourceUsage@16
449 IoReportResourceUsage@36
450 IoReportResourceForDetection@28
451 IoReportTargetDeviceChange@8
452 IoReportTargetDeviceChangeAsynchronous@16
453 IoRequestDeviceEject@4
455 IoSetCompletionRoutineEx@28
456 IoSetSystemPartition@4
457 IoSetDeviceInterfaceState@8
458 IoSetDeviceToVerify@8
460 IoSetHardErrorOrVerifyDevice@8
463 IoSetPartitionInformation@16
464 IoSetPartitionInformationEx@12
465 IoSetStartIoAttributes@12
467 IoSetThreadHardErrorMode@4
470 IoStartNextPacketByKey@12
473 IoStatisticsLock DATA
475 IoSynchronousPageWrite@20
476 IoSynchronousInvalidateDeviceRelations@8
478 IoUnregisterFileSystem@4
479 IoUnregisterFsRegistrationChange@8
480 IoUnregisterPlugPlayNotification@4
481 IoUnregisterShutdownNotification@4
482 IoUpdateShareAccess@8
483 IoValidateDeviceIoControlAccess@8
484 IoVerifyPartitionTable@8
486 IoVolumeDeviceToDosName@8
487 IoWMIAllocateInstanceIds@12
488 IoWMIDeviceObjectToInstanceName@12
489 IoWMIExecuteMethod@24
490 IoWMIHandleToInstanceName@12
493 IoWMIQueryAllDataMultiple@16
494 IoWMIQuerySingleInstance@16
495 IoWMIQuerySingleInstanceMultiple@20
496 IoWMIRegistrationControl@8
497 IoWMISetNotificationCallback@12
498 IoWMISetSingleInstance@20
499 IoWMISetSingleItem@24
500 IoWMISuggestInstanceName@16
502 IoWriteErrorLogEntry@4
503 IoWriteOperationCount DATA
504 IoWritePartitionTable@20
505 IoWritePartitionTableEx@8
506 IoWriteTransferCount DATA
508 @IofCompleteRequest@8
509 IoIsWdmVersionAvailable@8
510 KdDebuggerEnabled DATA
511 KdDebuggerNotPresent DATA
517 KdSystemDebugControl@4
519 Ke386IoSetAccessProcess@8
520 Ke386QueryIoAccessMap@8
521 Ke386SetIoAccessMap@8
522 KeAcquireSpinLockAtDpcLevel@4
523 KeAcquireDispatcherDatabaseLockAtDpcLevel
524 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
525 KeAcquireInterruptSpinLock@4
526 KeAddSystemServiceTable@20
529 ;KeBoostCurrentThread
533 KeCapturePersistentThreadState@28
536 KeDcacheFlushCount DATA
537 KeDelayExecutionThread@12
538 KeDeregisterBugCheckCallback@4
539 KeDeregisterBugCheckReasonCallback@4
541 KeDisconnectInterrupt@4
542 KeEnterCriticalRegion@0
543 KeEnterKernelDebugger@0
544 KeFindConfigurationEntry@16
545 KeFindConfigurationNextEntry@20
550 KeGetRecommendedSharedDataAlignment@0
552 KeI386AllocateGdtSelectors
553 ;KeI386Call16BitCStyleFunction
554 ;KeI386Call16BitFunction
555 KeI386FlatToGdtSelector
557 ;KeI386MachineType DATA
558 KeI386ReleaseGdtSelectors
560 ;KeI386SetGdtSelector
561 KeIcacheFlushCount DATA
563 KeInitializeDeviceQueue@4
566 KeInitializeInterrupt@44
570 KeInitializeSemaphore@12
571 KeInitializeSpinLock@4
573 KeInitializeTimerEx@8
574 KeInsertByKeyDeviceQueue@12
575 KeInsertDeviceQueue@8
580 KeIsAttachedProcess@0
582 KeLeaveCriticalRegion@0
584 KeNumberProcessors DATA
586 KeProfileInterruptWithSource@8
588 KeQueryActiveProcessors@0
589 KeQueryInterruptTime@0
590 KeQueryPriorityThread@4
591 KeQueryRuntimeThread@8
594 KeQueryTimeIncrement@0
595 KeRaiseUserException@4
600 KeReadStateSemaphore@4
602 KeRegisterBugCheckCallback@20
603 KeRegisterBugCheckReasonCallback@16
604 KeReleaseDispatcherDatabaseLockFromDpcLevel
605 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
606 KeReleaseInterruptSpinLock@8
609 KeReleaseSemaphore@16
610 KeReleaseSpinLockFromDpcLevel@4
611 KeRemoveByKeyDeviceQueue@8
612 KeRemoveByKeyDeviceQueueIfBusy@8
613 KeRemoveDeviceQueue@4
614 KeRemoveEntryDeviceQueue@8
617 KeRemoveSystemServiceTable@4
619 KeRestoreFloatingPointState@4
620 KeRevertToUserAffinityThread@0
622 KeSaveFloatingPointState@4
623 KeSaveStateForHibernate
624 KeServiceDescriptorTable DATA
625 KeSetAffinityThread@8
626 KeSetBasePriorityThread@8
627 KeSetDmaIoCoherency@4
629 KeSetEventBoostPriority@8
630 KeSetIdealProcessorThread@8
632 KeSetKernelStackSwapEnable@4
633 KeSetPriorityThread@8
635 KeSetSystemAffinityThread@4
636 ;KeSetSwapContextNotifyRoutine
637 KeSetTargetProcessorDpc@8
638 ;KeSetThreadSelectNotifyRoutine
642 @KeSetTimeUpdateNotifyRoutine@4
643 KeStackAttachProcess@8
644 KeSynchronizeExecution@12
649 KeUnstackDetachProcess@4
650 KeUserModeCallback@20
651 KeWaitForMultipleObjects@32
652 KeWaitForMutexObject@20
653 KeWaitForSingleObject@20
654 @KefAcquireSpinLockAtDpcLevel@4
655 @KefReleaseSpinLockFromDpcLevel@4
661 KiDispatchInterrupt@0
662 KiEnableTimerWatchdog
663 KiInterruptDispatch2@8
664 KiIpiServiceRoutine@8
666 KiUnexpectedInterrupt@0
667 ;Kii386SpinOnSpinLock
671 LdrFindResourceDirectory_U@16
674 LpcRequestWaitReplyPort@12
675 LsaCallAuthenticationPackage@28
676 LsaDeregisterLogonProcess@8
677 LsaFreeReturnBuffer@4
679 LsaLookupAuthenticationPackage@12
680 LsaRegisterLogonProcess@12
681 Mm64BitPhysicalAddress DATA
682 MmAddPhysicalMemory@8
683 MmAddVerifierThunks@8
684 MmAdjustWorkingSetSize@12
686 MmAllocateContiguousAlignedMemory@36
687 MmAllocateContiguousMemory@12
688 MmAllocateContiguousMemorySpecifyCache@32
689 MmAllocateMappingAddress@8
690 MmAllocateNonCachedMemory@4
691 MmAllocatePagesForMdl@28
692 MmBuildMdlForNonPagedPool@4
693 MmCanFileBeTruncated@8
698 MmDbgTranslatePhysicalAddress@8
699 MmDisableModifiedWriteOfSection@4
700 MmFlushImageSection@8
701 MmForceSectionClosed@8
702 MmFreeContiguousMemory@4
703 MmFreeContiguousMemorySpecifyCache@12
704 MmFreeMappingAddress@8
705 MmFreeNonCachedMemory@8
707 MmGetPhysicalAddress@4
708 MmGetPhysicalMemoryRanges@0
709 MmGetSystemRoutineAddress@4
710 MmGetVirtualForPhysical@8
712 MmHighestUserAddress DATA
714 MmIsDriverVerifying@4
715 MmIsNonPagedSystemAddressValid@4
716 MmIsRecursiveIoFault@0
717 MmIsThisAnNtAsSystem@0
718 MmIsVerifierEnabled@4
719 MmLockPagableDataSection@4
720 MmLockPagableImageSection@4=MmLockPagableDataSection@4
721 MmLockPagableSectionByHandle@4
724 MmMapLockedPagesSpecifyCache@24
725 MmMapLockedPagesWithReservedMapping@16
727 MmMapUserAddressesToPage@12
729 MmMapViewInSessionSpace@12
730 MmMapViewInSystemSpace@12
731 MmMapViewOfSection@40
732 MmMarkPhysicalMemoryAsBad@8
733 MmMarkPhysicalMemoryAsGood@8
736 MmProbeAndLockPages@12
737 MmProbeAndLockProcessPages@16
738 MmProbeAndLockSelectedPages@16
739 MmProtectMdlSystemAddress@8
741 MmRemovePhysicalMemory@8
742 MmResetDriverPaging@4
743 MmSectionObjectType DATA
744 MmSecureVirtualMemory@12
745 MmSetAddressRangeModified@8
746 MmSetBankedSection@24
748 MmSystemRangeStart DATA
749 MmTrimAllSystemPagableMemory@4
750 MmUnlockPagableImageSection@4
754 MmUnmapReservedMapping@12
755 MmUnmapVideoDisplay@8
756 MmUnmapViewInSessionSpace@4
757 MmUnmapViewInSystemSpace@4
758 MmUnmapViewOfSection@8
759 MmUnsecureVirtualMemory@4
760 MmUserProbeAddress DATA
763 NlsMbCodePageTag DATA
764 NlsMbOemCodePageTag DATA
765 NlsOemLeadByteInfo DATA
767 NtAdjustPrivilegesToken@24
769 NtAllocateLocallyUniqueId@4
771 NtAllocateVirtualMemory@24
782 NtDeviceIoControlFile@40
786 NtFreeVirtualMemory@16
790 NtMakePermanentObject@4
791 NtMapViewOfSection@40
792 NtNotifyChangeDirectoryFile@36
795 NtOpenProcessToken@12
796 NtOpenProcessTokenEx@16
799 NtOpenThreadTokenEx@20
800 NtQueryDirectoryFile@44
802 NtQueryInformationAtom@20
803 NtQueryInformationFile@20
804 NtQueryInformationProcess@20
805 NtQueryInformationThread@20
806 NtQueryInformationToken@20
807 ;NtQueryOleDirectoryFile@44 <--- ?
808 NtQueryQuotaInformationFile@36
809 NtQuerySecurityObject@20
810 NtQuerySystemInformation@16
812 NtQueryVolumeInformationFile@20
815 NtRequestWaitReplyPort@12
818 NtSetInformationFile@20
819 NtSetInformationProcess@16
820 NtSetInformationThread@16
821 NtSetQuotaInformationFile@16
822 NtSetSecurityObject@12
823 NtSetVolumeInformationFile@20
830 NtWaitForSingleObject@12
833 ;ObCheckCreateObjectAccess@28
834 ;ObCheckObjectAccess@20
836 ObFindHandleForObject@20
837 ObGetObjectPointerCount@4
838 ObGetObjectSecurity@12
840 ObMakeTemporaryObject@4
841 ObOpenObjectByName@28
842 ObOpenObjectByPointer@28
844 ObQueryObjectAuditingByHandle@8
845 @ObfDereferenceObject@4
846 @ObfReferenceObject@4
847 ObReferenceObjectByHandle@24
848 ObReferenceObjectByName@32
849 ObReferenceObjectByPointer@16
850 ObReleaseObjectSecurity@8
851 ObDereferenceObject@4
852 ;ObSetSecurityDescriptorInfo@24
858 PoRegisterDeviceForIdleDetection@16
859 PoRegisterSystemState@8
864 PoStartNextPowerIrp@4
865 PoUnregisterSystemState@4
868 PsAssignImpersonationToken@8
870 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
871 PsChargeProcessPagedPoolQuota@8
872 PsChargeProcessPoolQuota@12
873 PsCreateSystemProcess@12
874 PsCreateSystemThread@28
875 PsCreateWin32Process@4
876 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
877 PsDereferencePrimaryToken@4
878 PsDisableImpersonation@8
879 PsEstablishWin32Callouts@24
880 PsGetCurrentProcessId@0
881 PsGetCurrentProcessSessionId@0
882 PsGetCurrentThreadId@0
883 PsGetCurrentThreadPreviousMode@0
884 PsGetCurrentThreadStackBase@0
885 PsGetCurrentThreadStackLimit@0
888 PsGetJobUIRestrictionsClass@4
889 PsGetProcessCreateTimeQuadPart@4
890 PsGetProcessDebugPort@4
891 PsGetProcessExitProcessCalled@4
892 PsGetProcessExitStatus@4
893 PsGetProcessExitTime@0
895 PsGetProcessImageFileName@4
896 PsGetProcessInheritedFromUniqueProcessId@4
899 PsGetProcessPriorityClass@4
900 PsGetProcessSectionBaseAddress@4
901 PsGetProcessSecurityPort@4
902 PsGetProcessSessionId@4
903 PsGetProcessWin32Process@4
904 PsGetProcessWin32WindowStation@4
905 PsGetThreadFreezeCount@4
906 PsGetThreadHardErrorsAreDisabled@4
909 PsGetThreadProcessId@4
910 PsGetThreadSessionId@4
912 PsGetThreadWin32Thread@4
916 PsImpersonateClient@20
917 PsInitialSystemProcess DATA
918 PsIsProcessBeingDebugged@4
920 PsIsThreadImpersonating@4
921 PsIsThreadTerminating@4
923 PsLookupProcessByProcessId@8
924 PsLookupProcessThreadByCid@12
925 PsLookupThreadByThreadId@8
927 PsReferenceImpersonationToken@16
928 PsReferencePrimaryToken@4
929 PsRemoveCreateThreadNotifyRoutine@4
930 PsRemoveLoadImageNotifyRoutine@4
931 PsRestoreImpersonation@8
933 PsReturnProcessNonPagedPoolQuota@8
934 PsReturnProcessPagedPoolQuota@8
936 PsRevertThreadToSelf@4
937 PsSetCreateProcessNotifyRoutine@8
938 PsSetCreateThreadNotifyRoutine@4
939 PsSetJobUIRestrictionsClass@8
940 PsSetLegoNotifyRoutine@4
941 PsSetProcessPriorityClass@8
942 PsSetProcessSecurityPort@8
943 PsSetProcessWin32Process@8
944 PsSetProcessWin32WindowStation@8
945 PsSetThreadHardErrorsAreDisabled@8
946 PsSetThreadWin32Thread@8
947 PsSetLoadImageNotifyRoutine@4
948 PsTerminateSystemThread@4
950 READ_REGISTER_UCHAR@4
951 READ_REGISTER_ULONG@4
952 READ_REGISTER_USHORT@4
953 READ_REGISTER_BUFFER_UCHAR@12
954 READ_REGISTER_BUFFER_ULONG@12
955 READ_REGISTER_BUFFER_USHORT@12
957 KeRosDumpStackFrames@8
958 RtlAbsoluteToSelfRelativeSD@12
959 RtlAddAccessAllowedAce@16
961 RtlAddAtomToAtomTable@12
963 ;RtlAllocateAndInitializeSid
965 RtlAnsiCharToUnicodeChar@4
966 RtlAnsiStringToUnicodeSize@4
967 RtlAnsiStringToUnicodeString@12
968 RtlAppendAsciizToString@8
969 RtlAppendStringToString@8
970 RtlAppendUnicodeStringToString@8
971 RtlAppendUnicodeToString@8
972 RtlAreAllAccessesGranted@8
973 RtlAreAnyAccessesGranted@8
978 RtlCaptureStackBackTrace@16
980 RtlCheckRegistryKey@8
985 RtlCompareMemoryUlong@12
987 RtlCompareUnicodeString@12
990 RtlConvertLongToLargeInteger@4
991 RtlConvertSidToUnicodeString@12
992 RtlConvertUlongToLargeInteger@4
997 RtlCopyUnicodeString@8
1001 RtlCreateRegistryKey@8
1002 RtlCreateSecurityDescriptor@8
1003 RtlCreateSystemVolumeInformationFolder@4
1004 RtlCreateUnicodeString@8
1005 RtlCustomCPToUnicodeN@24
1006 RtlDecompressBuffer@24
1007 RtlDecompressChunks@28
1008 RtlDecompressFragment@32
1011 RtlDeleteAtomFromAtomTable@8
1012 RtlDeleteElementGenericTable@8
1013 RtlDeleteElementGenericTableAvl@8
1015 RtlDeleteOwnersRanges@8
1017 RtlDeleteRegistryValue@12
1019 RtlDestroyAtomTable@4
1021 RtlDowncaseUnicodeString@12
1023 RtlEnlargedIntegerMultiply@8
1024 RtlEnlargedUnsignedDivide@16
1025 RtlEnlargedUnsignedMultiply@8
1026 RtlEnumerateGenericTable@8
1027 RtlEnumerateGenericTableAvl@8
1028 RtlEnumerateGenericTableLikeADirectory@28
1029 RtlEnumerateGenericTableWithoutSplaying@8
1030 RtlEnumerateGenericTableWithoutSplayingAvl@8
1034 RtlEqualUnicodeString@12
1035 RtlExtendedIntegerMultiply@12
1036 RtlExtendedLargeIntegerDivide@16
1037 RtlExtendedMagicDivide@20
1039 RtlFillMemoryUlong@12
1041 RtlFindClearBitsAndSet@12
1043 RtlFindFirstRunClear@8
1044 RtlFindFirstRunSet@8
1045 RtlFindLastBackwardRunClear@12
1046 RtlFindLeastSignificantBit@8
1047 RtlFindLongestRunClear@8
1048 RtlFindLongestRunSet@8
1050 RtlFindMostSignificantBit@8
1051 RtlFindNextForwardRunClear@12
1054 RtlFindSetBitsAndClear@12
1055 RtlFindUnicodePrefix@12
1056 RtlFormatCurrentUserKeyPath@4
1061 RtlFreeUnicodeString@4
1063 RtlGenerate8dot3Name@16
1065 RtlGetCallersAddress@8
1066 RtlGetCompressionWorkSpaceSize@12
1067 RtlGetDaclSecurityDescriptor@16
1068 RtlGetDefaultCodePage@8
1069 RtlGetElementGenericTable@8
1070 RtlGetElementGenericTableAvl@8
1072 RtlGetGroupSecurityDescriptor@12
1074 RtlGetNtGlobalFlags@0
1075 RtlGetOwnerSecurityDescriptor@12
1076 RtlGetSaclSecurityDescriptor@16
1077 RtlGetSetBootStatusData@24
1079 RtlHashUnicodeString@16
1081 RtlImageDirectoryEntryToData@16
1083 RtlInitCodePageTable@8
1085 RtlInitUnicodeString@8
1086 RtlInitializeBitMap@12
1087 RtlInitializeGenericTable@20
1088 RtlInitializeGenericTableAvl@20
1089 RtlInitializeRangeList@4
1091 RtlInitializeUnicodePrefix@4
1092 RtlInsertElementGenericTable@16
1093 RtlInsertElementGenericTableAvl@16
1094 RtlInsertElementGenericTableFull@24
1095 RtlInsertElementGenericTableFullAvl@24
1096 RtlInsertUnicodePrefix@12
1097 RtlInt64ToUnicodeString@16
1099 RtlIntegerToUnicode@16
1100 RtlIntegerToUnicodeString@12
1101 RtlInvertRangeList@8
1102 RtlIpv4AddressToStringA@8
1103 RtlIpv4AddressToStringExA@16
1104 RtlIpv4AddressToStringExW@16
1105 RtlIpv4AddressToStringW@8
1106 RtlIpv4StringToAddressA@16
1107 RtlIpv4StringToAddressExA@16
1108 RtlIpv4StringToAddressExW@16
1109 RtlIpv4StringToAddressW@16
1110 RtlIpv6AddressToStringA@8
1111 RtlIpv6AddressToStringExA@16
1112 RtlIpv6AddressToStringExW@16
1113 RtlIpv6AddressToStringW@8
1114 RtlIpv6StringToAddressA@16
1115 RtlIpv6StringToAddressExA@16
1116 RtlIpv6StringToAddressExW@16
1117 RtlIpv6StringToAddressW@16
1118 RtlIsGenericTableEmpty@4
1119 RtlIsGenericTableEmptyAvl@4
1120 RtlIsNameLegalDOS8Dot3@12
1121 RtlIsRangeAvailable@40
1122 RtlIsValidOemCharacter@4
1123 RtlLargeIntegerAdd@16
1124 RtlLargeIntegerArithmeticShift@12
1125 RtlLargeIntegerDivide@20
1126 RtlLargeIntegerNegate@8
1127 RtlLargeIntegerShiftLeft@12
1128 RtlLargeIntegerShiftRight@12
1129 RtlLargeIntegerSubtract@16
1130 RtlLengthRequiredSid@4
1131 RtlLengthSecurityDescriptor@4
1133 RtlLockBootStatusData@4
1134 RtlLookupAtomInAtomTable@12
1135 RtlLookupElementGenericTable@8
1136 RtlLookupElementGenericTableAvl@8
1137 RtlLookupElementGenericTableFull@16
1138 RtlLookupElementGenericTableFullAvl@16
1140 RtlMapSecurityErrorToNtStatus@4
1141 RtlMergeRangeLists@16
1143 RtlMultiByteToUnicodeN@20
1144 RtlMultiByteToUnicodeSize@12
1145 RtlNextUnicodePrefix@8
1146 RtlNtStatusToDosError@4
1147 RtlNtStatusToDosErrorNoTeb@4
1148 RtlNumberGenericTableElements@4
1149 RtlNumberGenericTableElementsAvl@4
1150 RtlNumberOfClearBits@4
1151 RtlNumberOfSetBits@4
1152 RtlOemStringToCountedUnicodeString@12
1153 RtlOemStringToUnicodeSize@4
1154 RtlOemStringToUnicodeString@12
1156 RtlPinAtomInAtomTable@8
1157 @RtlPrefetchMemoryNonTemporal@8
1159 RtlPrefixUnicodeString@12
1160 RtlQueryAtomInAtomTable@24
1161 RtlQueryRegistryValues@20
1162 RtlQueryTimeZoneInformation@4
1166 RtlRealPredecessor@4
1168 RtlRemoveUnicodePrefix@8
1170 RtlSecondsSince1970ToTime@8
1171 RtlSecondsSince1980ToTime@8
1172 RtlSelfRelativeToAbsoluteSD2@8
1173 RtlSelfRelativeToAbsoluteSD@44
1177 RtlSetDaclSecurityDescriptor@16
1178 RtlSetGroupSecurityDescriptor@12
1179 RtlSetOwnerSecurityDescriptor@12
1180 RtlSetSaclSecurityDescriptor@16
1181 RtlSetTimeZoneInformation@4
1185 RtlSubAuthorityCountSid@4
1186 RtlSubAuthoritySid@8
1187 RtlSubtreePredecessor@4
1188 RtlSubtreeSuccessor@4
1190 RtlTimeFieldsToTime@8
1191 RtlTimeToElapsedTimeFields@8
1192 RtlTimeToSecondsSince1970@8
1193 RtlTimeToSecondsSince1980@8
1194 RtlTimeToTimeFields@8
1196 @RtlUlonglongByteSwap@8
1197 RtlUnicodeStringToAnsiSize@4
1198 RtlUnicodeStringToAnsiString@12
1199 RtlUnicodeStringToCountedOemString@12
1200 RtlUnicodeStringToInteger@12
1201 RtlUnicodeStringToOemSize@4
1202 RtlUnicodeStringToOemString@12
1203 RtlUnicodeToCustomCPN@24
1204 RtlUnicodeToMultiByteN@20
1205 RtlUnicodeToMultiByteSize@12
1207 RtlUnlockBootStatusData@4
1209 RtlUpcaseUnicodeChar@4
1210 RtlUpcaseUnicodeString@12
1211 RtlUpcaseUnicodeStringToAnsiString@12
1212 RtlUpcaseUnicodeStringToCountedOemString@12
1213 RtlUpcaseUnicodeStringToOemString@12
1214 RtlUpcaseUnicodeToCustomCPN@24
1215 RtlUpcaseUnicodeToMultiByteN@20
1216 RtlUpcaseUnicodeToOemN@20
1219 @RtlUshortByteSwap@4
1220 RtlValidRelativeSecurityDescriptor@12
1221 RtlValidSecurityDescriptor@4
1223 ;RtlVerifyVersionInfo@16
1224 RtlVolumeDeviceToDosName@8
1225 RtlWalkFrameChain@12
1226 RtlWriteRegistryValue@24
1229 RtlxAnsiStringToUnicodeSize@4
1230 RtlxOemStringToUnicodeSize@4
1231 RtlxUnicodeStringToAnsiSize@4
1232 RtlxUnicodeStringToOemSize@4
1234 SeAppendPrivileges@8
1236 SeAssignSecurityEx@36
1237 SeAuditHardLinkCreation@12
1238 SeAuditingFileEvents@8
1239 SeAuditingFileEventsWithContext@12
1240 SeAuditingFileOrGlobalEvents@12
1241 SeAuditingHardLinkEvents@8
1242 SeAuditingHardLinkEventsWithContext@12
1243 SeCaptureSecurityDescriptor@20
1244 SeCaptureSubjectContext@4
1245 SeCloseObjectAuditAlarm@12
1246 SeCreateAccessState@16
1247 SeCreateClientSecurity@16
1248 SeCreateClientSecurityFromSubjectContext@16
1249 SeDeassignSecurity@4
1250 SeDeleteAccessState@4
1251 SeDeleteObjectAuditAlarm@8
1255 SeImpersonateClient@8
1256 SeImpersonateClientEx@8
1257 SeLockSubjectContext@4
1258 SeMarkLogonSessionForTerminationNotification@4
1259 SeOpenObjectAuditAlarm@36
1260 SeOpenObjectForDeleteAuditAlarm@36
1262 SePrivilegeObjectAuditAlarm@24
1263 SePublicDefaultDacl DATA
1264 SeQueryAuthenticationIdToken@8
1265 SeQueryInformationToken@12
1266 SeQuerySecurityDescriptorInfo@16
1267 SeQuerySessionIdToken@8
1268 SeRegisterLogonSessionTerminatedRoutine@4
1269 SeReleaseSecurityDescriptor@12
1270 SeReleaseSubjectContext@4
1271 SeSetAccessStateGenericMapping@8
1272 SeSetSecurityDescriptorInfo@24
1273 SeSetSecurityDescriptorInfoEx@28
1274 SeSinglePrivilegeCheck@12
1275 SeSystemDefaultDacl DATA
1276 SeTokenImpersonationLevel@4
1278 SeTokenIsRestricted@4
1279 SeTokenIsWriteRestricted@4
1281 SeUnlockSubjectContext@4
1282 SeUnregisterLogonSessionTerminatedRoutine@4
1283 SeValidSecurityDescriptor@8
1284 VerSetConditionMask@16
1285 WRITE_REGISTER_UCHAR@8
1286 WRITE_REGISTER_ULONG@8
1287 WRITE_REGISTER_USHORT@8
1288 WRITE_REGISTER_BUFFER_UCHAR@12
1289 WRITE_REGISTER_BUFFER_ULONG@12
1290 WRITE_REGISTER_BUFFER_USHORT@12
1291 ZwAccessCheckAndAuditAlarm@44
1293 ZwAdjustPrivilegesToken@24
1295 ZwAllocateVirtualMemory@24
1296 ZwAssignProcessToJobObject@8
1301 ZwCloseObjectAuditAlarm@12
1303 ZwCreateDirectoryObject@12
1306 ZwCreateJobObject@12
1309 ZwCreateSymbolicLinkObject@16
1315 ZwDeviceIoControlFile@40
1317 ZwDuplicateObject@28
1319 ZwEnumerateBootEntries@8
1321 ZwEnumerateValueKey@24
1322 ZwFlushInstructionCache@12
1324 ZwFlushVirtualMemory@16
1325 ZwFreeVirtualMemory@16
1327 ZwInitiatePowerAction@16
1331 ZwMakeTemporaryObject@4
1332 ZwMapViewOfSection@40
1333 ZwNotifyChangeKey@40
1334 ZwOpenDirectoryObject@12
1340 ZwOpenProcessToken@12
1341 ZwOpenProcessTokenEx@16
1343 ZwOpenSymbolicLinkObject@12
1345 ZwOpenThreadToken@16
1346 ZwOpenThreadTokenEx@20
1348 ZwPowerInformation@20
1350 ZwQueryBootEntryOrder@8
1351 ZwQueryBootOptions@8
1352 ZwQueryDefaultLocale@8
1353 ZwQueryDefaultUILanguage@4
1354 ZwQueryDirectoryFile@44
1355 ZwQueryDirectoryObject@28
1357 ZwQueryFullAttributesFile@8
1358 ZwQueryInformationAtom@20
1359 ZwQueryInformationFile@20
1360 ZwQueryInformationJobObject@20
1361 ZwQueryInformationProcess@20
1362 ZwQueryInformationThread@20
1363 ZwQueryInformationToken@20
1364 ZwQueryInstallUILanguage@4
1368 ZwQuerySecurityObject@20
1369 ZwQuerySymbolicLinkObject@12
1370 ZwQuerySystemInformation@16
1373 ZwQueryVolumeInformationFile@20
1376 ZwRequestWaitReplyPort@12
1381 ZwSetBootEntryOrder@8
1383 ZwSetDefaultLocale@8
1384 ZwSetDefaultUILanguage@4
1387 ZwSetInformationFile@20
1388 ZwSetInformationJobObject@16
1389 ZwSetInformationObject@16
1390 ZwSetInformationProcess@16
1391 ZwSetInformationThread@16
1392 ZwSetSecurityObject@12
1393 ZwSetSystemInformation@12
1397 ZwSetVolumeInformationFile@20
1398 ZwTerminateJobObject@8
1399 ZwTerminateProcess@8
1400 ZwTranslateFilePath@12
1403 ZwUnmapViewOfSection@8
1404 ZwWaitForMultipleObjects@20
1405 ZwWaitForSingleObject@12
1408 _abnormal_termination