1 ; $Id: ntoskrnl.def,v 1.173 2004/02/02 00:36:07 ekohl Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
13 CcGetFileObjectFromSectionPtrs@4
16 CcSetDirtyPinnedData@8
21 DbgBreakPointWithStatus@4
22 ;DbgLoadImageSymbols@12
26 @ExAcquireFastMutexUnsafe@4
27 ExAcquireResourceExclusive@8
28 ExAcquireResourceExclusiveLite@8
29 ExAcquireResourceSharedLite@8
30 ExAcquireSharedStarveExclusive@8
31 ExAcquireSharedWaitForExclusive@8
32 @ExAllocateFromPagedLookasideList@4
34 ExAllocatePoolWithQuota@8
35 ExAllocatePoolWithQuotaTag@12
36 ExAllocatePoolWithTag@12
37 ExConvertExclusiveToSharedLite@4
39 ExDeleteNPagedLookasideList@4
40 ExDeletePagedLookasideList@4
42 ExDeleteResourceLite@4
43 ExDesktopObjectType DATA
44 ExDisableResourceBoostLite@4
45 ExEventObjectType DATA
49 ExFreeToPagedLookasideList@8
50 ExGetExclusiveWaiterCount@4
52 ExGetSharedWaiterCount@4
53 ExInitializeNPagedLookasideList@28
54 ExInitializePagedLookasideList@28
55 ExInitializeResource@4
56 ExInitializeResourceLite@4
58 ExInterlockedAddLargeInteger@16
59 @ExInterlockedAddLargeStatistic@8
60 @ExInterlockedAddUlong@12
61 @ExInterlockedCompareExchange64@16
62 ExInterlockedDecrementLong@8
63 ExInterlockedExchangeUlong@12
64 ExInterlockedExtendZone@16
65 ExInterlockedIncrementLong@8
66 @ExInterlockedInsertHeadList@12
67 @ExInterlockedInsertTailList@12
68 @ExInterlockedPopEntryList@8
69 @ExInterlockedPopEntrySList@8
70 @ExInterlockedPushEntryList@12
71 @ExInterlockedPushEntrySList@12
72 @ExInterlockedRemoveHeadList@8
73 ExIsProcessorFeaturePresent@4
74 ExIsResourceAcquiredExclusiveLite@4
75 ExIsResourceAcquiredSharedLite@4
76 ExLocalTimeToSystemTime@8
81 ExRaiseAccessViolation@0
82 ExRaiseDatatypeMisalignment@0
87 ExReinitializeResourceLite@4
88 @ExReleaseFastMutexUnsafe@4
89 ExReleaseResourceForThread@8
90 ExReleaseResourceForThreadLite@8
91 @ExReleaseResourceLite@4
92 ExSetResourceOwnerPointer@8
93 ;ExSystemExceptionFilter
94 ExSystemTimeToLocalTime@8
95 ExTryToAcquireResourceExclusiveLite@4
96 ExUnregisterCallback@4
97 ExWindowStationObjectType DATA
98 ExInitializeBinaryTree@12
100 ExInsertBinaryTree@12
101 ExSearchBinaryTree@12
102 ExRemoveBinaryTree@12
103 ExTraverseBinaryTree@16
104 ExInitializeSplayTree@16
109 ExWeightOfSplayTree@8
110 ExTraverseSplayTree@16
111 ExInitializeHashTable@16
116 @ExfInterlockedAddUlong@12
117 @ExfInterlockedInsertHeadList@12
118 @ExfInterlockedInsertTailList@12
119 @ExfInterlockedPopEntryList@8
120 @ExfInterlockedPushEntryList@12
121 @ExfInterlockedRemoveHeadList@8
122 @Exfi386InterlockedDecrementLong@4
123 @Exfi386InterlockedExchangeUlong@8
124 @Exfi386InterlockedIncrementLong@4
125 Exi386InterlockedDecrementLong@4
126 Exi386InterlockedExchangeUlong@8
127 Exi386InterlockedIncrementLong@4
128 FsRtlAddLargeMcbEntry@28
130 FsRtlAddToTunnelCache@32
131 FsRtlAllocateFileLock@8
133 FsRtlAllocatePoolWithQuota@8
134 FsRtlAllocatePoolWithQuotaTag@12
135 FsRtlAllocatePoolWithTag@12
136 FsRtlAllocateResource@0
137 FsRtlAreNamesEqual@16
139 FsRtlCheckLockForReadAccess@8
140 FsRtlCheckLockForWriteAccess@8
144 FsRtlCurrentBatchOplock@4
145 FsRtlDeleteKeyFromTunnelCache@12
146 FsRtlDeleteTunnelCache@4
147 FsRtlDeregisterUncProvider@4
150 FsRtlDoesDbcsContainWildCards@4
151 FsRtlDoesNameContainWildCards@4
152 FsRtlFastCheckLockForRead@24
153 FsRtlFastCheckLockForWrite@24
154 FsRtlFastUnlockAll@16
155 FsRtlFastUnlockAllByKey@20
156 FsRtlFastUnlockSingle@32
157 FsRtlFindInTunnelCache@32
159 FsRtlGetNextFileLock@8
160 FsRtlGetNextLargeMcbEntry@20
161 FsRtlGetNextMcbEntry@20
162 FsRtlInitializeFileLock@12
163 FsRtlInitializeLargeMcb@8
165 FsRtlInitializeOplock@4
166 FsRtlInitializeTunnelCache@4
167 FsRtlIsDbcsInExpression@8
168 FsRtlIsFatDbcsLegal@20
169 FsRtlIsHpfsDbcsLegal@20
170 FsRtlIsNameInExpression@16
171 FsRtlIsNtstatusExpected@4
172 FsRtlIsTotalDeviceFailure@4
173 FsRtlLegalAnsiCharacterArray DATA
174 FsRtlLookupLargeMcbEntry@32
175 FsRtlLookupLastLargeMcbEntry@12
176 FsRtlLookupLastMcbEntry@12
177 FsRtlLookupMcbEntry@20
179 FsRtlMdlReadComplete@8
180 FsRtlMdlReadCompleteDev@12
182 FsRtlMdlWriteComplete@12
183 FsRtlMdlWriteCompleteDev@16
184 FsRtlNormalizeNtstatus@8
185 FsRtlNotifyChangeDirectory@28
186 FsRtlNotifyCleanup@12
187 FsRtlNotifyFullChangeDirectory@40
188 FsRtlNotifyFullReportChange@36
189 FsRtlNotifyInitializeSync@4
190 FsRtlNotifyReportChange@20
191 FsRtlNotifyUninitializeSync@4
192 FsRtlNotifyVolumeEvent@8
193 FsRtlNumberOfRunsInLargeMcb@4
194 FsRtlNumberOfRunsInMcb@4
196 FsRtlOplockIsFastIoPossible@4
197 FsRtlPostPagingFileStackOverflow@12
198 FsRtlPostStackOverflow@12
199 FsRtlPrepareMdlWrite@24
200 FsRtlPrepareMdlWriteDev@28
202 FsRtlProcessFileLock@12
203 FsRtlRegisterUncProvider@12
204 FsRtlRemoveLargeMcbEntry@20
205 FsRtlRemoveMcbEntry@12
206 FsRtlSplitLargeMcb@20
208 FsRtlTruncateLargeMcb@12
210 FsRtlUninitializeFileLock@4
211 FsRtlUninitializeLargeMcb@4
212 FsRtlUninitializeMcb@4
213 FsRtlUninitializeOplock@4
214 HalDispatchTable DATA
215 HalPrivateDispatchTable DATA
216 InbvAcquireDisplayOwnership@0
217 InbvCheckDisplayOwnership@0
219 InbvEnableBootDriver@4
220 InbvEnableDisplayString@4
221 InbvInstallDisplayStringFilter@4
222 InbvIsBootDriverInstalled@0
223 InbvNotifyDisplayOwnershipLost@4
225 InbvSetScrollRegion@16
227 InbvSolidColorFill@20
228 @InterlockedCompareExchange@12
229 @InterlockedDecrement@4
230 @InterlockedExchange@8
231 @InterlockedExchangeAdd@8
232 @InterlockedIncrement@4
233 @InterlockedPopEntrySList@4
234 @InterlockedPushEntrySList@8
235 IoAcquireCancelSpinLock@4
236 IoAcquireRemoveLockEx@20
237 IoAcquireVpbSpinLock@4
238 IoAdapterObjectType DATA
239 IoAllocateAdapterChannel@20
240 IoAllocateController@16
241 IoAllocateErrorLogEntry@8
247 IoAttachDeviceByPointer@8
248 IoAttachDeviceToDeviceStack@8
249 IoBuildAsynchronousFsdRequest@24
250 IoBuildDeviceIoControlRequest@36
252 IoBuildSynchronousFsdRequest@28
255 IoCheckDesiredAccess@8
256 IoCheckEaBufferValidity@12
257 IoCheckFunctionAccess@24
258 IoCheckShareAccess@20
260 IoConnectInterrupt@44
264 IoCreateNotificationEvent@8
265 IoCreateStreamFileObject@8
266 IoCreateSymbolicLink@8
267 IoCreateSynchronizationEvent@8
268 IoCreateUnprotectedSymbolicLink@8
271 IoDeleteSymbolicLink@4
273 IoDeviceHandlerObjectSize DATA
274 IoDeviceHandlerObjectType DATA
275 IoDisconnectInterrupt@4
276 IoDeviceObjectType DATA
277 IoDriverObjectType DATA
279 IoFastQueryNetworkAttributes@20
280 IoFileObjectType DATA
285 IoGetAttachedDevice@4
286 IoGetAttachedDeviceReference@4
287 IoGetBaseFileSystemDeviceObject@4
288 IoGetConfigurationInformation@0
289 IoGetCurrentProcess@0
290 IoGetDeviceObjectPointer@16
291 IoGetDeviceProperty@20
292 IoGetDeviceToVerify@4
293 IoGetFileObjectGenericMapping@0
295 IoGetRelatedDeviceObject@4
296 IoGetRequestorProcess@4
300 IoInvalidateDeviceRelations@8
301 IoInvalidateDeviceState@4
302 IoInitializeRemoveLockEx@20
304 IoIsOperationSynchronous@4
305 IoMakeAssociatedIrp@8
306 IoOpenDeviceInstanceKey@20
307 IoOpenDeviceRegistryKey@16
309 IoQueryDeviceDescription@32
310 IoQueryDeviceEnumInfo@8
311 IoQueryFileInformation@20
312 IoQueryVolumeInformation@20
316 IoRaiseInformationalHardError@12
317 IoReadOperationCount DATA
318 IoReadPartitionTable@16
319 IoReadTransferCount DATA
320 IoRegisterDeviceInterface@16
321 IoRegisterDriverReinitialization@12
322 IoRegisterFileSystem@4
323 IoRegisterFsRegistrationChange@8
324 IoRegisterShutdownNotification@4
325 IoReleaseCancelSpinLock@4
326 IoReleaseRemoveLockAndWaitEx@12
327 IoReleaseRemoveLockEx@12
328 IoReleaseVpbSpinLock@4
329 IoRemoveShareAccess@8
330 IoReportHalResourceUsage@16
331 IoReportResourceUsage@36
332 IoSetDeviceInterfaceState@8
333 IoSetDeviceToVerify@8
334 IoSetHardErrorOrVerifyDevice@8
336 IoSetPartitionInformation@16
338 IoSetThreadHardErrorMode@4
341 IoStartNextPacketByKey@12
344 IoStatisticsLock DATA
346 IoSynchronousPageWrite@20
348 IoUnregisterFileSystem@4
349 IoUnregisterFsRegistrationChange@8
350 IoUnregisterShutdownNotification@4
351 IoUpdateShareAccess@8
353 IoWriteErrorLogEntry@4
354 IoWriteOperationCount DATA
355 IoWritePartitionTable@20
356 IoWriteTransferCount DATA
358 @IofCompleteRequest@8
359 KdDebuggerEnabled DATA
360 KdDebuggerNotPresent DATA
362 KdSystemDebugControl@4
364 Ke386IoSetAccessProcess@8
365 Ke386QueryIoAccessMap@8
366 Ke386SetIoAccessMap@8
367 KeAcquireSpinLockAtDpcLevel@4
368 KeAddSystemServiceTable@20
370 ;KeBoostCurrentThread
376 KeDcacheFlushCount DATA
377 KeDelayExecutionThread@12
378 KeDeregisterBugCheckCallback@4
380 KeDisconnectInterrupt@4
381 KeEnterCriticalRegion@0
382 KeEnterKernelDebugger@0
383 ;KeFindConfigurationEntry
384 ;KeFindConfigurationNextEntry
389 ;KeI386AllocateGdtSelectors
390 ;KeI386Call16BitCStyleFunction
391 ;KeI386Call16BitFunction
392 ;KeI386FlatToGdtSelector
394 ;KeI386MachineType DATA
395 ;KeI386ReleaseGdtSelectors
397 ;KeI386SetGdtSelector
398 KeIcacheFlushCount DATA
400 KeInitializeDeviceQueue@4
403 KeInitializeInterrupt@44
407 KeInitializeSemaphore@12
408 KeInitializeSpinLock@4
410 KeInitializeTimerEx@8
411 KeInsertByKeyDeviceQueue@12
412 KeInsertDeviceQueue@8
418 KeLeaveCriticalRegion@0
420 KeNumberProcessors DATA
422 ;KeProfileInterruptWithSource
426 KeQueryTimeIncrement@0
427 ;KeRaiseUserException
433 KeReadStateSemaphore@4
435 KeRegisterBugCheckCallback@20
438 KeReleaseSemaphore@16
439 KeReleaseSpinLockFromDpcLevel@4
440 KeRemoveByKeyDeviceQueue@8
441 KeRemoveDeviceQueue@4
442 KeRemoveEntryDeviceQueue@8
446 KeRestoreFloatingPointState@4
448 KeSaveFloatingPointState@4
449 KeServiceDescriptorTable DATA
450 KeSetAffinityThread@8
451 KeSetBasePriorityThread@8
454 ;KeSetEventBoostPriority
455 ;KeSetIdealProcessorThread
457 ;KeSetKernelStackSwapEnable
458 KeSetPriorityThread@8
460 ;@KeSetSwapContextNotifyRoutine
461 KeSetTargetProcessorDpc@8
462 ;@KeSetThreadSelectNotifyRoutine
466 ;@KeSetTimeUpdateNotifyRoutine
467 KeSynchronizeExecution@12
472 KeWaitForMultipleObjects@32
473 KeWaitForMutexObject@20
474 KeWaitForSingleObject@20
475 ;@KefAcquireSpinLockAtDpcLevel
476 ;@KefReleaseSpinLockFromDpcLevel
480 ;KiCoprocessorError@0
482 KiDispatchInterrupt@0
483 KiInterruptDispatch2@8
484 ;KiIpiServiceRoutine@8
486 ;KiUnexpectedInterrupt
487 ;Kii386SpinOnSpinLock
491 ;LdrFindResourceDirectory_U@16
494 LsaCallAuthenticationPackage@28
495 LsaDeregisterLogonProcess@8
496 LsaFreeReturnBuffer@4
498 LsaLookupAuthenticationPackage@12
499 LsaRegisterLogonProcess@12
500 MmAdjustWorkingSetSize@12
501 MmAllocateContiguousAlignedMemory@36
502 MmAllocateContiguousMemory@12
503 MmAllocateContiguousMemorySpecifyCache@32
504 MmAllocateNonCachedMemory@4
505 MmBuildMdlForNonPagedPool@4
506 MmCanFileBeTruncated@8
511 MmDbgTranslatePhysicalAddress@8
512 MmDisableModifiedWriteOfSection@4
513 MmFlushImageSection@8
514 MmForceSectionClosed@8
515 MmFreeContiguousMemory@4
516 MmFreeContiguousMemorySpecifyCache@12
517 MmFreeNonCachedMemory@8
518 MmGetPhysicalAddress@4
520 MmHighestUserAddress DATA
522 MmIsNonPagedSystemAddressValid@4
523 MmIsRecursiveIoFault@0
524 MmIsThisAnNtAsSystem@0
525 MmLockPagableDataSection@4
526 MmLockPagableImageSection@4=MmLockPagableDataSection@4
527 MmLockPagableSectionByHandle@4
532 MmMapViewInSystemSpace@12
533 MmMapViewOfSection@40
535 MmProbeAndLockPages@12
537 MmResetDriverPaging@4
538 MmSectionObjectType DATA
539 MmSecureVirtualMemory@12
540 MmSetAddressRangeModified@8
541 MmSetBankedSection@24
543 MmUnlockPagableImageSection@4
547 MmUnmapVideoDisplay@8
548 MmUnmapViewInSystemSpace@4
549 MmUnmapViewOfSection@8
550 MmUnsecureVirtualMemory@4
551 MmUserProbeAddress DATA
554 NlsMbCodePageTag DATA
555 NlsMbOemCodePageTag DATA
556 NlsOemLeadByteInfo DATA
558 NtAdjustPrivilegesToken@24
560 NtAllocateLocallyUniqueId@4
562 NtAllocateVirtualMemory@24
573 NtDeviceIoControlFile@40
577 NtFreeVirtualMemory@16
581 NtMapViewOfSection@40
582 NtNotifyChangeDirectoryFile@36
585 NtOpenProcessToken@12
586 NtQueryDirectoryFile@44
588 NtQueryInformationAtom@20
589 NtQueryInformationFile@20
590 NtQueryInformationProcess@20
591 NtQueryInformationToken@20
592 ;NtQueryOleDirectoryFile@ <--- ?
593 NtQuerySecurityObject@20
595 NtQueryVolumeInformationFile@20
598 NtRequestWaitReplyPort@12
600 NtSetInformationFile@20
601 NtSetInformationProcess@16
602 NtSetInformationThread@16
603 NtSetSecurityObject@12
608 NtWaitForSingleObject@12
611 ;ObCheckCreateObjectAccess@28
612 ;ObCheckObjectAccess@20
614 ;ObFindHandleForObject@20
615 ObGetObjectPointerCount@4
616 ObGetObjectSecurity@12
618 ObMakeTemporaryObject@4
619 ObOpenObjectByName@28
620 ObOpenObjectByPointer@28
622 ObQueryObjectAuditingByHandle@8
623 @ObfDereferenceObject@4
624 @ObfReferenceObject@4
625 ObReferenceObjectByHandle@24
626 ObReferenceObjectByName@32
627 ObReferenceObjectByPointer@16
628 ObReleaseObjectSecurity@8
629 ObDereferenceObject@4
630 ;ObSetSecurityDescriptorInfo@24
636 PoRegisterDeviceForIdleDetection@16
637 PoRegisterSystemState@8
642 PoStartNextPowerIrp@4
643 PoUnregisterSystemState@4
646 PsAssignImpersonationToken@8
647 ;PsChargePoolQuota@12
648 PsCreateSystemProcess@12
649 PsCreateSystemThread@28
650 PsCreateWin32Process@4
651 PsEstablishWin32Callouts@24
652 PsGetCurrentProcessId@0
653 PsGetCurrentThreadId@0
654 PsGetProcessExitTime@0
658 PsImpersonateClient@20
659 PsInitialSystemProcess DATA
660 PsIsThreadTerminating@4
661 PsLookupProcessByProcessId@8
662 PsLookupProcessThreadByCid@12
663 PsLookupThreadByThreadId@8
665 PsReferenceImpersonationToken@16
666 PsReferencePrimaryToken@4
667 ;PsReturnPoolQuota@12
669 PsSetCreateProcessNotifyRoutine@8
670 PsSetCreateThreadNotifyRoutine@4
671 ;PsSetLegoNotifyRoutine@4
672 ;PsSetProcessPriorityByClass@8
673 PsTerminateSystemThread@4
675 READ_REGISTER_UCHAR@4
676 READ_REGISTER_ULONG@4
677 READ_REGISTER_USHORT@4
678 READ_REGISTER_BUFFER_UCHAR@12
679 READ_REGISTER_BUFFER_ULONG@12
680 READ_REGISTER_BUFFER_USHORT@12
681 RtlAbsoluteToSelfRelativeSD@12
682 RtlAddAccessAllowedAce@16
684 RtlAddAtomToAtomTable@12
685 ;RtlAllocateAndInitializeSid
687 RtlAnsiCharToUnicodeChar@4
688 RtlAnsiStringToUnicodeSize@4
689 RtlAnsiStringToUnicodeString@12
690 RtlAppendAsciizToString@8
691 RtlAppendStringToString@8
692 RtlAppendUnicodeStringToString@8
693 RtlAppendUnicodeToString@8
694 RtlAreAllAccessesGranted@8
695 RtlAreAnyAccessesGranted@8
699 ;RtlCaptureStackBackTrace
701 RtlCheckRegistryKey@8
705 RtlCompareMemoryUlong@12
707 RtlCompareUnicodeString@12
710 RtlConvertLongToLargeInteger@4
711 RtlConvertSidToUnicodeString@12
712 RtlConvertUlongToLargeInteger@4
716 RtlCopyUnicodeString@8
720 RtlCreateRegistryKey@8
721 RtlCreateSecurityDescriptor@8
722 RtlCreateUnicodeString@8
723 RtlCustomCPToUnicodeN@24
724 RtlDecompressBuffer@24
725 RtlDecompressChunks@28
726 RtlDecompressFragment@32
728 RtlDeleteAtomFromAtomTable@8
729 ;RtlDeleteElementGenericTable
731 RtlDeleteRegistryValue@12
733 RtlDestroyAtomTable@4
735 RtlDowncaseUnicodeString@12
737 RtlEnlargedIntegerMultiply@8
738 RtlEnlargedUnsignedDivide@16
739 RtlEnlargedUnsignedMultiply@8
740 ;RtlEnumerateGenericTable
741 ;RtlEnumerateGenericTableWithoutSplaying
745 RtlEqualUnicodeString@12
746 RtlExtendedIntegerMultiply@12
747 RtlExtendedLargeIntegerDivide@16
748 RtlExtendedMagicDivide@20
750 RtlFillMemoryUlong@12
752 RtlFindClearBitsAndSet@12
753 RtlFindFirstRunClear@8
755 RtlFindLeastSignificantBit@8
756 RtlFindLongestRunClear@8
757 RtlFindLongestRunSet@8
759 RtlFindMostSignificantBit@8
761 RtlFindSetBitsAndClear@12
762 ;RtlFindUnicodePrefix
763 RtlFormatCurrentUserKeyPath@4
767 RtlFreeUnicodeString@4
768 RtlGenerate8dot3Name@16
769 ;RtlGetCallersAddress
770 RtlGetCompressionWorkSpaceSize@12
771 RtlGetDaclSecurityDescriptor@16
772 RtlGetDefaultCodePage@8
773 ;RtlGetElementGenericTable
774 RtlGetGroupSecurityDescriptor@12
775 RtlGetOwnerSecurityDescriptor@12
777 RtlImageDirectoryEntryToData@16
779 RtlInitCodePageTable@8
781 RtlInitUnicodeString@8
782 RtlInitializeBitMap@12
783 ;RtlInitializeGenericTable
785 ;RtlInitializeUnicodePrefix
786 ;RtlInsertElementGenericTable
787 ;RtlInsertUnicodePrefix
789 RtlIntegerToUnicodeString@12
790 RtlIsNameLegalDOS8Dot3@12
791 RtlLargeIntegerAdd@16
792 RtlLargeIntegerArithmeticShift@12
793 RtlLargeIntegerDivide@20
794 RtlLargeIntegerNegate@8
795 RtlLargeIntegerShiftLeft@12
796 RtlLargeIntegerShiftRight@12
797 RtlLargeIntegerSubtract@16
798 RtlLengthRequiredSid@4
799 RtlLengthSecurityDescriptor@4
801 RtlLookupAtomInAtomTable@12
802 ;RtlLookupElementGenericTable
805 RtlMultiByteToUnicodeN@20
806 RtlMultiByteToUnicodeSize@12
807 ;RtlNextUnicodePrefix
808 RtlNtStatusToDosError@4
809 RtlNtStatusToDosErrorNoTeb@4
810 ;RtlNumberGenericTableElements
811 RtlNumberOfClearBits@4
813 RtlOemStringToCountedUnicodeString@12
814 RtlOemStringToUnicodeSize@4
815 RtlOemStringToUnicodeString@12
817 RtlPinAtomInAtomTable@8
819 RtlPrefixUnicodeString@12
820 RtlQueryAtomInAtomTable@24
821 RtlQueryRegistryValues@20
822 RtlQueryTimeZoneInformation@4
825 ;RtlRemoveUnicodePrefix
827 RtlSecondsSince1970ToTime@8
828 RtlSecondsSince1980ToTime@8
831 RtlSetDaclSecurityDescriptor@16
832 RtlSetGroupSecurityDescriptor@12
833 RtlSetOwnerSecurityDescriptor@12
834 RtlSetSaclSecurityDescriptor@16
835 RtlSetTimeZoneInformation@4
837 RtlSubAuthorityCountSid@4
839 RtlTimeFieldsToTime@8
840 RtlTimeToSecondsSince1970@8
841 RtlTimeToSecondsSince1980@8
842 RtlTimeToTimeFields@8
843 RtlUnicodeStringToAnsiSize@4
844 RtlUnicodeStringToAnsiString@12
845 RtlUnicodeStringToCountedOemString@12
846 RtlUnicodeStringToInteger@12
847 RtlUnicodeStringToOemSize@4
848 RtlUnicodeStringToOemString@12
849 RtlUnicodeToCustomCPN@24
850 RtlUnicodeToMultiByteN@20
851 RtlUnicodeToMultiByteSize@12
854 RtlUpcaseUnicodeChar@4
855 RtlUpcaseUnicodeString@12
856 RtlUpcaseUnicodeStringToAnsiString@12
857 RtlUpcaseUnicodeStringToCountedOemString@12
858 RtlUpcaseUnicodeStringToOemString@12
859 RtlUpcaseUnicodeToCustomCPN@24
860 RtlUpcaseUnicodeToMultiByteN@20
861 RtlUpcaseUnicodeToOemN@20
864 RtlValidSecurityDescriptor@4
866 RtlWriteRegistryValue@24
869 RtlxAnsiStringToUnicodeSize@4
870 RtlxOemStringToUnicodeSize@4
871 RtlxUnicodeStringToAnsiSize@4
872 RtlxUnicodeStringToOemSize@4
874 ;SeAppendPrivileges@8
876 ;SeAuditingFileEvents@8
877 ;SeAuditingFileOrGlobalEvents@18
878 ;SeCaptureSecurityDescriptor@20
879 SeCaptureSubjectContext@4
880 ;SeCloseObjectAuditAlarm@12
881 ;SeCreateAccessState@16
882 SeCreateClientSecurity@16
884 ;SeDeleteAccessState@4
885 ;SeDeleteObjectAuditAlarm@8
888 SeImpersonateClient@8
889 ;SeLockSubjectContext@4
890 ;SeMarkLogonSessionForTerminationNotification@4
891 ;SeOpenObjectAuditAlarm@36
892 ;SeOpenObjectForDeleteAuditAlarm@36
894 ;SePrivilegeObjectAuditAlarm@24
895 SePublicDefaultDacl DATA
896 ;SeQueryAuthenticationIdToken@8
897 ;SeQuerySecurityDescriptorInfo@16
898 ;SeRegisterLogonSessionTerminatedRoutine@4
899 ;SeReleaseSecurityDescriptor@12
900 SeReleaseSubjectContext@4
901 ;SeSetAccessStateGenericMapping@8
902 ;SeSetSecurityDescriptorInfo@24
903 SeSinglePrivilegeCheck@12
904 SeSystemDefaultDacl DATA
905 SeTokenImpersonationLevel@4
907 ;SeUnlockSubjectContext@4
908 ;SeUnregisterLogonSessionTerminatedRoutine@4
909 ;SeValidSecurityDescriptor@8
910 WRITE_REGISTER_UCHAR@8
911 WRITE_REGISTER_ULONG@8
912 WRITE_REGISTER_USHORT@8
913 WRITE_REGISTER_BUFFER_UCHAR@12
914 WRITE_REGISTER_BUFFER_ULONG@12
915 WRITE_REGISTER_BUFFER_USHORT@12
916 ZwAccessCheckAndAuditAlarm@44
918 ZwAllocateVirtualMemory@24
921 ZwCloseObjectAuditAlarm@12
923 ZwCreateDirectoryObject@12
928 ZwCreateSymbolicLinkObject@16
932 ZwDeviceIoControlFile@40
937 ZwEnumerateValueKey@24
938 ZwFlushInstructionCache@12
940 ZwFreeVirtualMemory@16
944 ZwMakeTemporaryObject@4
945 ZwMapViewOfSection@40
947 ZwOpenDirectoryObject@12
952 ZwOpenProcessToken@12
954 ZwOpenSymbolicLinkObject@12
958 ZwQueryDefaultLocale@8
959 ZwQueryDirectoryFile@44
960 ZwQueryInformationAtom@20
961 ZwQueryInformationFile@20
962 ZwQueryInformationProcess@20
963 ZwQueryInformationToken@20
967 ZwQuerySecurityObject@20
968 ZwQuerySymbolicLinkObject@12
969 ZwQuerySystemInformation@16
972 ZwQueryVolumeInformationFile@20
975 ZwRequestWaitReplyPort@12
980 ZwSetInformationFile@20
981 ZwSetInformationObject@16
982 ZwSetInformationProcess@16
983 ZwSetInformationThread@16
984 ZwSetSystemInformation@12
990 ZwUnmapViewOfSection@8
991 ZwWaitForMultipleObjects@20
992 ZwWaitForSingleObject@12
995 _abnormal_termination