3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
18 CcGetFileObjectFromBcb@4
19 CcGetFileObjectFromSectionPtrs@4
20 CcGetFlushedValidData@8
21 CcGetLsnForFileObject@8
22 CcInitializeCacheMap@20
24 CcFastMdlReadWait DATA
25 CcFastReadNotPossible DATA
36 CcPurgeCacheSection@16
39 CcScheduleReadAhead@12
40 CcSetAdditionalCacheAttributes@12
41 CcSetBcbOwnerPointer@8
42 CcSetDirtyPageThreshold@8
43 CcSetDirtyPinnedData@8
44 CcSetLogHandleForFile@12
45 CcSetReadAheadGranularity@8
46 CcUninitializeCacheMap@12
48 CcUnpinDataForThread@8
50 CcWaitForCurrentLazyWriterActivity@0
55 CmUnRegisterCallback@8
57 DbgBreakPointWithStatus@4
58 DbgLoadImageSymbols@12
62 DbgPrintReturnControlC
63 DbgQueryDebugFilterState@8
64 DbgSetDebugFilterState@12
65 @ExAcquireFastMutexUnsafe@4
66 ExAcquireResourceExclusive@8
67 ExAcquireResourceExclusiveLite@8
68 ExAcquireResourceSharedLite@8
69 @ExAcquireRundownProtection@4
70 @ExAcquireRundownProtectionEx@8
71 ExAcquireSharedStarveExclusive@8
72 ExAcquireSharedWaitForExclusive@8
73 @ExAllocateFromPagedLookasideList@4=@ExiAllocateFromPagedLookasideList@4
75 ExAllocatePoolWithQuota@8
76 ExAllocatePoolWithQuotaTag@12
77 ExAllocatePoolWithTag@12
78 ExAllocatePoolWithTagPriority@16
79 ExConvertExclusiveToSharedLite@4
81 ExDeleteNPagedLookasideList@4
82 ExDeletePagedLookasideList@4
84 ExDeleteResourceLite@4
85 ExDesktopObjectType DATA
86 ExDisableResourceBoostLite@4
88 ExEventObjectType DATA
92 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
93 ExGetCurrentProcessorCounts@12
94 ExGetCurrentProcessorCpuUsage@4
95 ExGetExclusiveWaiterCount@4
97 ExGetSharedWaiterCount@4
98 @ExInitializeRundownProtection@4
99 ExInitializeNPagedLookasideList@28
100 ExInitializePagedLookasideList@28
101 ExInitializeResource@4
102 ExInitializeResourceLite@4
104 ExInterlockedAddLargeInteger@16
105 @ExInterlockedAddLargeStatistic@8
106 ExInterlockedAddUlong@12
107 @ExInterlockedCompareExchange64@16
108 ExInterlockedDecrementLong@8
109 ExInterlockedExchangeUlong@12
110 ExInterlockedExtendZone@16
111 ExInterlockedIncrementLong@8
112 @ExInterlockedFlushSList@4
113 ExInterlockedInsertHeadList@12
114 ExInterlockedInsertTailList@12
115 ExInterlockedPopEntryList@8
116 @ExInterlockedPopEntrySList@8
117 ExInterlockedPushEntryList@12
118 @ExInterlockedPushEntrySList@12
119 ExInterlockedRemoveHeadList@8
120 ExIsProcessorFeaturePresent@4
121 ExIsResourceAcquiredExclusiveLite@4
122 ExIsResourceAcquiredSharedLite@4
123 ExLocalTimeToSystemTime@8
125 ExQueryPoolBlockSize@8
127 ExRaiseAccessViolation@0
128 ExRaiseDatatypeMisalignment@0
132 ExRegisterCallback@12
133 ExReinitializeResourceLite@4
134 @ExReInitializeRundownProtection@4
135 @ExReleaseFastMutexUnsafe@4
136 ExReleaseResourceForThread@8
137 ExReleaseResourceForThreadLite@8
138 @ExReleaseResourceLite@4
139 @ExReleaseRundownProtection@4
140 @ExReleaseRundownProtectionEx@8
141 ExRosDumpPagedPoolByTag@4
143 @ExRundownCompleted@4
144 ExSemaphoreObjectType DATA
145 ExSetResourceOwnerPointer@8
146 ExSetTimerResolution@8
147 ExSystemExceptionFilter@0
148 ExSystemTimeToLocalTime@8
149 ExTryToAcquireResourceExclusiveLite@4
150 ExUnregisterCallback@4
153 @ExWaitForRundownProtectionRelease@4
154 ExWindowStationObjectType DATA
155 @ExfAcquirePushLockExclusive@4
156 @ExfAcquirePushLockShared@4
157 @ExfReleasePushLock@4
158 @ExfInterlockedAddUlong@12
159 @ExfInterlockedInsertHeadList@12
160 @ExfInterlockedInsertTailList@12
161 @ExfInterlockedCompareExchange64@12
162 @ExfInterlockedPopEntryList@8
163 @ExfInterlockedPushEntryList@12
164 @ExfInterlockedRemoveHeadList@8
165 @Exfi386InterlockedDecrementLong@4
166 @Exfi386InterlockedExchangeUlong@8
167 @Exfi386InterlockedIncrementLong@4
168 Exi386InterlockedDecrementLong@4
169 Exi386InterlockedExchangeUlong@8
170 Exi386InterlockedIncrementLong@4
171 FsRtlAcquireFileExclusive@4
172 FsRtlAddLargeMcbEntry@28
174 FsRtlAddToTunnelCache@32
175 FsRtlAllocateFileLock@8
177 FsRtlAllocatePoolWithQuota@8
178 FsRtlAllocatePoolWithQuotaTag@12
179 FsRtlAllocatePoolWithTag@12
180 FsRtlAllocateResource@0
181 FsRtlAreNamesEqual@16
183 FsRtlCheckLockForReadAccess@8
184 FsRtlCheckLockForWriteAccess@8
188 FsRtlCurrentBatchOplock@4
189 FsRtlDeleteKeyFromTunnelCache@12
190 FsRtlDeleteTunnelCache@4
191 FsRtlDeregisterUncProvider@4
194 FsRtlDoesDbcsContainWildCards@4
195 FsRtlDoesNameContainWildCards@4
196 FsRtlFastCheckLockForRead@24
197 FsRtlFastCheckLockForWrite@24
198 FsRtlFastUnlockAll@16
199 FsRtlFastUnlockAllByKey@20
200 FsRtlFastUnlockSingle@32
201 FsRtlFindInTunnelCache@32
204 FsRtlGetNextFileLock@8
205 FsRtlGetNextLargeMcbEntry@20
206 FsRtlGetNextMcbEntry@20
207 FsRtlIncrementCcFastReadNotPossible@0
208 FsRtlIncrementCcFastReadNoWait@0
209 FsRtlIncrementCcFastReadResourceMiss@0
210 FsRtlIncrementCcFastReadWait@0
211 FsRtlInitializeFileLock@12
212 FsRtlInitializeLargeMcb@8
214 FsRtlInitializeOplock@4
215 FsRtlInitializeTunnelCache@4
216 FsRtlInsertPerFileObjectContext@8
217 FsRtlInsertPerStreamContext@8
218 FsRtlIsDbcsInExpression@8
219 FsRtlIsFatDbcsLegal@20
220 FsRtlIsHpfsDbcsLegal@20
221 FsRtlIsNameInExpression@16
222 FsRtlIsNtstatusExpected@4
224 FsRtlIsTotalDeviceFailure@4
225 FsRtlLegalAnsiCharacterArray DATA
226 FsRtlLookupLargeMcbEntry@32
227 FsRtlLookupLastLargeMcbEntry@12
228 FsRtlLookupLastLargeMcbEntryAndIndex@16
229 FsRtlLookupLastMcbEntry@12
230 FsRtlLookupMcbEntry@20
231 FsRtlLookupPerFileObjectContext@12
232 FsRtlLookupPerStreamContextInternal@12
234 FsRtlMdlReadComplete@8
235 FsRtlMdlReadCompleteDev@12
237 FsRtlMdlWriteComplete@12
238 FsRtlMdlWriteCompleteDev@16
239 FsRtlNormalizeNtstatus@8
240 FsRtlNotifyChangeDirectory@28
241 FsRtlNotifyCleanup@12
242 FsRtlNotifyFilterChangeDirectory@44
243 FsRtlNotifyFilterReportChange@40
244 FsRtlNotifyFullChangeDirectory@40
245 FsRtlNotifyFullReportChange@36
246 FsRtlNotifyInitializeSync@4
247 FsRtlNotifyReportChange@20
248 FsRtlNotifyUninitializeSync@4
249 FsRtlNotifyVolumeEvent@8
250 FsRtlNumberOfRunsInLargeMcb@4
251 FsRtlNumberOfRunsInMcb@4
253 FsRtlOplockIsFastIoPossible@4
254 FsRtlPostPagingFileStackOverflow@12
255 FsRtlPostStackOverflow@12
256 FsRtlPrepareMdlWrite@24
257 FsRtlPrepareMdlWriteDev@28
259 FsRtlProcessFileLock@12
260 FsRtlRegisterUncProvider@12
262 FsRtlRemoveLargeMcbEntry@20
263 FsRtlRemoveMcbEntry@12
264 FsRtlRemovePerFileObjectContext@12
265 FsRtlRemovePerStreamContext@12
267 FsRtlSplitLargeMcb@20
269 FsRtlTeardownPerStreamContexts@4
270 FsRtlTruncateLargeMcb@12
272 FsRtlUninitializeFileLock@4
273 FsRtlUninitializeLargeMcb@4
274 FsRtlUninitializeMcb@4
275 FsRtlUninitializeOplock@4
276 HalDispatchTable DATA
277 HalPrivateDispatchTable DATA
278 @HalExamineMBR=@xHalExamineMBR@16
279 InbvAcquireDisplayOwnership@0
280 InbvCheckDisplayOwnership@0
282 InbvEnableBootDriver@4
283 InbvEnableDisplayString@4
284 InbvInstallDisplayStringFilter@4
285 InbvIsBootDriverInstalled@0
286 InbvNotifyDisplayOwnershipLost@4
288 InbvSetScrollRegion@16
290 InbvSolidColorFill@20
291 InitSafeBootMode DATA
292 @InterlockedCompareExchange@12
293 @InterlockedDecrement@4
294 @InterlockedExchange@8
295 @InterlockedExchangeAdd@8
296 @InterlockedIncrement@4
297 @InterlockedPushEntrySList@8
298 @InterlockedPopEntrySList@4
299 IoAcquireCancelSpinLock@4
300 IoAcquireRemoveLockEx@20
301 IoAcquireVpbSpinLock@4
302 IoAdapterObjectType DATA
303 IoAllocateAdapterChannel@20
306 IoAllocateController@16
307 IoAllocateDriverObjectExtension@16
308 IoAllocateErrorLogEntry@8
310 IoAssignDriveLetters@16
313 IoAttachDeviceByPointer@8
314 IoAttachDeviceToDeviceStack@8
315 IoAttachDeviceToDeviceStackSafe@12
316 IoBuildAsynchronousFsdRequest@24
317 IoBuildDeviceIoControlRequest@36
319 IoBuildSynchronousFsdRequest@28
323 IoCheckDesiredAccess@8
324 IoCheckEaBufferValidity@12
325 IoCheckFunctionAccess@24
326 IoCheckQuerySetFileInformation@12
327 IoCheckQuerySetVolumeInformation@12
328 IoCheckQuotaBufferValidity@12
329 IoCheckShareAccess@20
331 IoConnectInterrupt@44
337 IoCreateFileSpecifyDeviceObjectHint@60
338 IoCreateNotificationEvent@8
339 IoCreateStreamFileObject@8
340 IoCreateStreamFileObjectEx@12
341 IoCreateStreamFileObjectLite@8
342 IoCreateSymbolicLink@8
343 IoCreateSynchronizationEvent@8
344 IoCreateUnprotectedSymbolicLink@8
354 IoDeleteSymbolicLink@4
356 IoDeviceHandlerObjectSize DATA
357 IoDeviceHandlerObjectType DATA
358 IoDeviceObjectType DATA
359 IoDisconnectInterrupt@4
360 IoDriverObjectType DATA
362 IoEnumerateDeviceObjectList@16
363 IoFastQueryNetworkAttributes@20
364 IoFileObjectType DATA
365 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
366 IoForwardIrpSynchronously@8
368 IoFreeErrorLogEntry@4
372 IoGetAttachedDevice@4
373 IoGetAttachedDeviceReference@4
374 IoGetBaseFileSystemDeviceObject@4
375 IoGetBootDiskInformation@8
376 IoGetConfigurationInformation@0
377 IoGetCurrentProcess@0
378 IoGetDeviceObjectPointer@16
379 IoGetDeviceAttachmentBaseRef@4
380 IoGetDeviceInterfaceAlias@12
381 IoGetDeviceInterfaces@16
382 IoGetDriverObjectExtension@8
383 IoGetDeviceProperty@20
384 IoGetDeviceToVerify@4
385 IoGetDiskDeviceObject@8
387 IoGetFileObjectGenericMapping@0
389 IoGetLowerDeviceObject@4
390 IoGetRelatedDeviceObject@4
391 IoGetRequestorProcess@4
392 IoGetRequestorProcessId@4
393 IoGetRequestorSessionId@8
397 IoInvalidateDeviceRelations@8
398 IoInvalidateDeviceState@4
399 IoInitializeRemoveLockEx@20
401 IoIsFileOriginRemote@4
403 IoIsValidNameGraftingBuffer@8
404 IoIsOperationSynchronous@4
405 IoMakeAssociatedIrp@8
406 IoOpenDeviceInstanceKey@20
407 IoOpenDeviceInterfaceRegistryKey@12
408 IoOpenDeviceRegistryKey@16
410 IoPnPDeliverServicePowerNotification@16
411 IoQueryDeviceDescription@32
412 IoQueryDeviceEnumInfo@8
413 IoQueryFileDosDeviceName@8
414 IoQueryFileInformation@20
415 IoQueryVolumeInformation@20
419 IoRaiseInformationalHardError@12
420 IoReadDiskSignature@12
421 IoReadOperationCount DATA
422 @IoReadPartitionTable@16
423 IoReadPartitionTableEx@8
424 IoReadTransferCount DATA
425 IoRegisterBootDriverReinitialization@12
426 IoRegisterDeviceInterface@16
427 IoRegisterDriverReinitialization@12
428 IoRegisterFileSystem@4
429 IoRegisterFsRegistrationChange@8
430 IoRegisterLastChanceShutdownNotification@4
431 IoRegisterPlugPlayNotification@28
432 IoRegisterShutdownNotification@4
433 IoReleaseCancelSpinLock@4
434 IoReleaseRemoveLockAndWaitEx@12
435 IoReleaseRemoveLockEx@12
436 IoReleaseVpbSpinLock@4
437 IoRemoveShareAccess@8
438 IoReportDetectedDevice@32
439 IoReportHalResourceUsage@16
440 IoReportResourceUsage@36
441 IoReportResourceForDetection@28
442 IoReportTargetDeviceChange@8
443 IoReportTargetDeviceChangeAsynchronous@16
444 IoRequestDeviceEject@4
446 IoSetCompletionRoutineEx@28
447 IoSetSystemPartition@4
448 IoSetDeviceInterfaceState@8
449 IoSetDeviceToVerify@8
451 IoSetHardErrorOrVerifyDevice@8
454 @IoSetPartitionInformation@16
455 IoSetPartitionInformationEx@12
456 IoSetStartIoAttributes@12
458 IoSetThreadHardErrorMode@4
461 IoStartNextPacketByKey@12
464 IoStatisticsLock DATA
466 IoSynchronousPageWrite@20
467 IoSynchronousInvalidateDeviceRelations@8
469 IoUnregisterFileSystem@4
470 IoUnregisterFsRegistrationChange@8
471 IoUnregisterPlugPlayNotification@4
472 IoUnregisterShutdownNotification@4
473 IoUpdateShareAccess@8
474 IoValidateDeviceIoControlAccess@8
475 IoVerifyPartitionTable@8
477 IoVolumeDeviceToDosName@8
478 IoWMIAllocateInstanceIds@12
479 IoWMIDeviceObjectToInstanceName@12
480 IoWMIExecuteMethod@24
481 IoWMIHandleToInstanceName@12
484 IoWMIQueryAllDataMultiple@16
485 IoWMIQuerySingleInstance@16
486 IoWMIQuerySingleInstanceMultiple@20
487 IoWMIRegistrationControl@8
488 IoWMISetNotificationCallback@12
489 IoWMISetSingleInstance@20
490 IoWMISetSingleItem@24
491 IoWMISuggestInstanceName@16
493 IoWriteErrorLogEntry@4
494 IoWriteOperationCount DATA
495 @IoWritePartitionTable@20
496 IoWritePartitionTableEx@8
497 IoWriteTransferCount DATA
499 @IofCompleteRequest@8
500 IoIsWdmVersionAvailable@8
501 KdDebuggerEnabled DATA
502 KdDebuggerNotPresent DATA
508 KdSystemDebugControl@4
510 Ke386IoSetAccessProcess@8
511 Ke386QueryIoAccessMap@8
512 Ke386SetIoAccessMap@8
513 KeAcquireSpinLockAtDpcLevel@4
514 @KeAcquireDispatcherDatabaseLockAtDpcLevel@0
515 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
516 KeAcquireInterruptSpinLock@4
517 KeAddSystemServiceTable@20
520 ;KeBoostCurrentThread
524 KeCapturePersistentThreadState@28
527 KeDcacheFlushCount DATA
528 KeDelayExecutionThread@12
529 KeDeregisterBugCheckCallback@4
530 KeDeregisterBugCheckReasonCallback@4
532 KeDisconnectInterrupt@4
533 KeEnterCriticalRegion@0
534 KeEnterKernelDebugger@0
535 KeFindConfigurationEntry@16
536 KeFindConfigurationNextEntry@20
541 KeGetRecommendedSharedDataAlignment@0
543 KeI386AllocateGdtSelectors
544 ;KeI386Call16BitCStyleFunction
545 ;KeI386Call16BitFunction
546 KeI386FlatToGdtSelector
548 ;KeI386MachineType DATA
549 KeI386ReleaseGdtSelectors
551 ;KeI386SetGdtSelector
552 KeIcacheFlushCount DATA
554 KeInitializeDeviceQueue@4
557 KeInitializeInterrupt@44
561 KeInitializeSemaphore@12
562 KeInitializeSpinLock@4
564 KeInitializeTimerEx@8
565 KeInsertByKeyDeviceQueue@12
566 KeInsertDeviceQueue@8
571 KeIsAttachedProcess@0
573 KeLeaveCriticalRegion@0
575 KeNumberProcessors DATA
577 KeProfileInterruptWithSource@8
579 KeQueryActiveProcessors@0
580 KeQueryInterruptTime@0
581 KeQueryPriorityThread@4
582 KeQueryRuntimeThread@8
585 KeQueryTimeIncrement@0
586 KeRaiseUserException@4
591 KeReadStateSemaphore@4
593 KeRegisterBugCheckCallback@20
594 KeRegisterBugCheckReasonCallback@16
595 @KeReleaseDispatcherDatabaseLockFromDpcLevel@0
596 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
597 KeReleaseInterruptSpinLock@8
600 KeReleaseSemaphore@16
601 KeReleaseSpinLockFromDpcLevel@4
602 KeRemoveByKeyDeviceQueue@8
603 KeRemoveByKeyDeviceQueueIfBusy@8
604 KeRemoveDeviceQueue@4
605 KeRemoveEntryDeviceQueue@8
608 KeRemoveSystemServiceTable@4
610 KeRestoreFloatingPointState@4
611 KeRevertToUserAffinityThread@0
613 KeSaveFloatingPointState@4
614 KeSaveStateForHibernate
615 KeServiceDescriptorTable DATA
616 KeSetAffinityThread@8
617 KeSetBasePriorityThread@8
618 KeSetDmaIoCoherency@4
620 KeSetEventBoostPriority@8
621 KeSetIdealProcessorThread@8
623 KeSetKernelStackSwapEnable@4
624 KeSetPriorityThread@8
626 KeSetSystemAffinityThread@4
627 ;KeSetSwapContextNotifyRoutine
628 KeSetTargetProcessorDpc@8
629 ;KeSetThreadSelectNotifyRoutine
633 @KeSetTimeUpdateNotifyRoutine@4
634 KeStackAttachProcess@8
635 KeSynchronizeExecution@12
640 KeUnstackDetachProcess@4
641 KeUserModeCallback@20
642 KeWaitForMultipleObjects@32
643 KeWaitForMutexObject@20
644 KeWaitForSingleObject@20
645 @KefAcquireSpinLockAtDpcLevel@4
646 @KefReleaseSpinLockFromDpcLevel@4
652 KiDispatchInterrupt@0
653 KiEnableTimerWatchdog
654 KiInterruptDispatch2@8
655 KiIpiServiceRoutine@8
657 KiUnexpectedInterrupt@0
658 ;Kii386SpinOnSpinLock
662 LdrFindResourceDirectory_U@16
664 LpcPortObjectType DATA
666 LpcRequestWaitReplyPort@12
667 LsaCallAuthenticationPackage@28
668 LsaDeregisterLogonProcess@8
669 LsaFreeReturnBuffer@4
671 LsaLookupAuthenticationPackage@12
672 LsaRegisterLogonProcess@12
673 Mm64BitPhysicalAddress DATA
674 MmAddPhysicalMemory@8
675 MmAddVerifierThunks@8
676 MmAdjustWorkingSetSize@12
678 MmAllocateContiguousAlignedMemory@36
679 MmAllocateContiguousMemory@12
680 MmAllocateContiguousMemorySpecifyCache@32
681 MmAllocateMappingAddress@8
682 MmAllocateNonCachedMemory@4
683 MmAllocatePagesForMdl@28
684 MmBuildMdlForNonPagedPool@4
685 MmCanFileBeTruncated@8
690 MmDbgTranslatePhysicalAddress@8
691 MmDisableModifiedWriteOfSection@4
692 MmFlushImageSection@8
693 MmForceSectionClosed@8
694 MmFreeContiguousMemory@4
695 MmFreeContiguousMemorySpecifyCache@12
696 MmFreeMappingAddress@8
697 MmFreeNonCachedMemory@8
699 MmGetPhysicalAddress@4
700 MmGetPhysicalMemoryRanges@0
701 MmGetSystemRoutineAddress@4
702 MmGetVirtualForPhysical@8
704 MmHighestUserAddress DATA
706 MmIsDriverVerifying@4
707 MmIsNonPagedSystemAddressValid@4
708 MmIsRecursiveIoFault@0
709 MmIsThisAnNtAsSystem@0
710 MmIsVerifierEnabled@4
711 MmLockPagableDataSection@4
712 MmLockPagableImageSection@4=MmLockPagableDataSection@4
713 MmLockPagableSectionByHandle@4
716 MmMapLockedPagesSpecifyCache@24
717 MmMapLockedPagesWithReservedMapping@16
719 MmMapUserAddressesToPage@12
721 MmMapViewInSessionSpace@12
722 MmMapViewInSystemSpace@12
723 MmMapViewOfSection@40
724 MmMarkPhysicalMemoryAsBad@8
725 MmMarkPhysicalMemoryAsGood@8
728 MmProbeAndLockPages@12
729 MmProbeAndLockProcessPages@16
730 MmProbeAndLockSelectedPages@16
731 MmProtectMdlSystemAddress@8
733 MmRemovePhysicalMemory@8
734 MmResetDriverPaging@4
735 MmSectionObjectType DATA
736 MmSecureVirtualMemory@12
737 MmSetAddressRangeModified@8
738 MmSetBankedSection@24
740 MmSystemRangeStart DATA
741 MmTrimAllSystemPagableMemory@4
742 MmUnlockPagableImageSection@4
746 MmUnmapReservedMapping@12
747 MmUnmapVideoDisplay@8
748 MmUnmapViewInSessionSpace@4
749 MmUnmapViewInSystemSpace@4
750 MmUnmapViewOfSection@8
751 MmUnsecureVirtualMemory@4
752 MmUserProbeAddress DATA
755 NlsMbCodePageTag DATA
756 NlsMbOemCodePageTag DATA
757 NlsOemLeadByteInfo DATA
759 NtAdjustPrivilegesToken@24
761 NtAllocateLocallyUniqueId@4
763 NtAllocateVirtualMemory@24
774 NtDeviceIoControlFile@40
778 NtFreeVirtualMemory@16
782 NtMakePermanentObject@4
783 NtMapViewOfSection@40
784 NtNotifyChangeDirectoryFile@36
787 NtOpenProcessToken@12
788 NtOpenProcessTokenEx@16
791 NtOpenThreadTokenEx@20
792 NtQueryDirectoryFile@44
794 NtQueryInformationAtom@20
795 NtQueryInformationFile@20
796 NtQueryInformationProcess@20
797 NtQueryInformationThread@20
798 NtQueryInformationToken@20
799 NtQueryQuotaInformationFile@36
800 NtQuerySecurityObject@20
801 NtQuerySystemInformation@16
803 NtQueryVolumeInformationFile@20
806 NtRequestWaitReplyPort@12
809 NtSetInformationFile@20
810 NtSetInformationProcess@16
811 NtSetInformationThread@16
812 NtSetQuotaInformationFile@16
813 NtSetSecurityObject@12
814 NtSetVolumeInformationFile@20
821 NtWaitForSingleObject@12
824 ;ObCheckCreateObjectAccess@28
825 ;ObCheckObjectAccess@20
827 ObFindHandleForObject@20
828 ObGetObjectPointerCount@4
829 ObGetObjectSecurity@12
831 ObMakeTemporaryObject@4
832 ObOpenObjectByName@28
833 ObOpenObjectByPointer@28
835 ObQueryObjectAuditingByHandle@8
836 @ObfDereferenceObject@4
837 @ObfReferenceObject@4
838 ObReferenceObjectByHandle@24
839 ObReferenceObjectByName@32
840 ObReferenceObjectByPointer@16
841 ObReleaseObjectSecurity@8
842 ObDereferenceObject@4
843 ;ObSetSecurityDescriptorInfo@24
849 PoQueueShutdownWorkItem@4
850 PoRegisterDeviceForIdleDetection@16
851 PoRegisterSystemState@8
856 PoStartNextPowerIrp@4
857 PoUnregisterSystemState@4
860 PsAssignImpersonationToken@8
862 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
863 PsChargeProcessPagedPoolQuota@8
864 PsChargeProcessPoolQuota@12
865 PsCreateSystemProcess@12
866 PsCreateSystemThread@28
867 PsCreateWin32Process@4
868 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
869 PsDereferencePrimaryToken@4
870 PsDisableImpersonation@8
871 PsEstablishWin32Callouts@24
872 PsGetCurrentProcessId@0
873 PsGetCurrentProcessSessionId@0
874 PsGetCurrentThreadId@0
875 PsGetCurrentThreadPreviousMode@0
876 PsGetCurrentThreadStackBase@0
877 PsGetCurrentThreadStackLimit@0
880 PsGetJobUIRestrictionsClass@4
881 PsGetProcessCreateTimeQuadPart@4
882 PsGetProcessDebugPort@4
883 PsGetProcessExitProcessCalled@4
884 PsGetProcessExitStatus@4
885 PsGetProcessExitTime@0
887 PsGetProcessImageFileName@4
888 PsGetProcessInheritedFromUniqueProcessId@4
891 PsGetProcessPriorityClass@4
892 PsGetProcessSectionBaseAddress@4
893 PsGetProcessSecurityPort@4
894 PsGetProcessSessionId@4
895 PsGetProcessWin32Process@4
896 PsGetProcessWin32WindowStation@4
897 PsGetThreadFreezeCount@4
898 PsGetThreadHardErrorsAreDisabled@4
901 PsGetThreadProcessId@4
902 PsGetThreadSessionId@4
904 PsGetThreadWin32Thread@4
908 PsImpersonateClient@20
909 PsInitialSystemProcess DATA
910 PsIsProcessBeingDebugged@4
912 PsIsThreadImpersonating@4
913 PsIsThreadTerminating@4
915 PsLookupProcessByProcessId@8
916 PsLookupProcessThreadByCid@12
917 PsLookupThreadByThreadId@8
919 PsReferenceImpersonationToken@16
920 PsReferencePrimaryToken@4
921 PsRemoveCreateThreadNotifyRoutine@4
922 PsRemoveLoadImageNotifyRoutine@4
923 PsRestoreImpersonation@8
925 PsReturnProcessNonPagedPoolQuota@8
926 PsReturnProcessPagedPoolQuota@8
928 PsRevertThreadToSelf@4
929 PsSetCreateProcessNotifyRoutine@8
930 PsSetCreateThreadNotifyRoutine@4
931 PsSetJobUIRestrictionsClass@8
932 PsSetLegoNotifyRoutine@4
933 PsSetProcessPriorityClass@8
934 PsSetProcessSecurityPort@8
935 PsSetProcessWin32Process@8
936 PsSetProcessWin32WindowStation@8
937 PsSetThreadHardErrorsAreDisabled@8
938 PsSetThreadWin32Thread@8
939 PsSetLoadImageNotifyRoutine@4
940 PsTerminateSystemThread@4
942 READ_REGISTER_UCHAR@4
943 READ_REGISTER_ULONG@4
944 READ_REGISTER_USHORT@4
945 READ_REGISTER_BUFFER_UCHAR@12
946 READ_REGISTER_BUFFER_ULONG@12
947 READ_REGISTER_BUFFER_USHORT@12
949 KeRosDumpStackFrames@8
950 KeRosGetStackFrames@8
951 RtlAbsoluteToSelfRelativeSD@12
952 RtlAddAccessAllowedAce@16
954 RtlAddAtomToAtomTable@12
956 ;RtlAllocateAndInitializeSid
958 RtlAnsiCharToUnicodeChar@4
959 RtlAnsiStringToUnicodeSize@4
960 RtlAnsiStringToUnicodeString@12
961 RtlAppendAsciizToString@8
962 RtlAppendStringToString@8
963 RtlAppendUnicodeStringToString@8
964 RtlAppendUnicodeToString@8
965 RtlAreAllAccessesGranted@8
966 RtlAreAnyAccessesGranted@8
971 RtlCaptureStackBackTrace@16
973 RtlCheckRegistryKey@8
978 RtlCompareMemoryUlong@12
980 RtlCompareUnicodeString@12
983 RtlConvertLongToLargeInteger@4
984 RtlConvertSidToUnicodeString@12
985 RtlConvertUlongToLargeInteger@4
990 RtlCopyUnicodeString@8
994 RtlCreateRegistryKey@8
995 RtlCreateSecurityDescriptor@8
996 RtlCreateSystemVolumeInformationFolder@4
997 RtlCreateUnicodeString@8
998 RtlCustomCPToUnicodeN@24
999 RtlDecompressBuffer@24
1000 RtlDecompressChunks@28
1001 RtlDecompressFragment@32
1004 RtlDeleteAtomFromAtomTable@8
1005 RtlDeleteElementGenericTable@8
1006 RtlDeleteElementGenericTableAvl@8
1008 RtlDeleteOwnersRanges@8
1010 RtlDeleteRegistryValue@12
1012 RtlDestroyAtomTable@4
1014 RtlDowncaseUnicodeString@12
1016 RtlEnlargedIntegerMultiply@8
1017 RtlEnlargedUnsignedDivide@16
1018 RtlEnlargedUnsignedMultiply@8
1019 RtlEnumerateGenericTable@8
1020 RtlEnumerateGenericTableAvl@8
1021 RtlEnumerateGenericTableLikeADirectory@28
1022 RtlEnumerateGenericTableWithoutSplaying@8
1023 RtlEnumerateGenericTableWithoutSplayingAvl@8
1027 RtlEqualUnicodeString@12
1028 RtlExtendedIntegerMultiply@12
1029 RtlExtendedLargeIntegerDivide@16
1030 RtlExtendedMagicDivide@20
1032 RtlFillMemoryUlong@12
1034 RtlFindClearBitsAndSet@12
1036 RtlFindFirstRunClear@8
1037 RtlFindFirstRunSet@8
1038 RtlFindLastBackwardRunClear@12
1039 RtlFindLeastSignificantBit@8
1040 RtlFindLongestRunClear@8
1041 RtlFindLongestRunSet@8
1043 RtlFindMostSignificantBit@8
1044 RtlFindNextForwardRunClear@12
1047 RtlFindSetBitsAndClear@12
1048 RtlFindUnicodePrefix@12
1049 RtlFormatCurrentUserKeyPath@4
1054 RtlFreeUnicodeString@4
1056 RtlGenerate8dot3Name@16
1058 RtlGetCallersAddress@8
1059 RtlGetCompressionWorkSpaceSize@12
1060 RtlGetDaclSecurityDescriptor@16
1061 RtlGetDefaultCodePage@8
1062 RtlGetElementGenericTable@8
1063 RtlGetElementGenericTableAvl@8
1065 RtlGetGroupSecurityDescriptor@12
1067 RtlGetNtGlobalFlags@0
1068 RtlGetOwnerSecurityDescriptor@12
1069 RtlGetSaclSecurityDescriptor@16
1070 RtlGetSetBootStatusData@24
1072 RtlHashUnicodeString@16
1074 RtlImageDirectoryEntryToData@16
1076 RtlInitCodePageTable@8
1078 RtlInitUnicodeString@8
1079 RtlInitializeBitMap@12
1080 RtlInitializeGenericTable@20
1081 RtlInitializeGenericTableAvl@20
1082 RtlInitializeRangeList@4
1084 RtlInitializeUnicodePrefix@4
1085 RtlInsertElementGenericTable@16
1086 RtlInsertElementGenericTableAvl@16
1087 RtlInsertElementGenericTableFull@24
1088 RtlInsertElementGenericTableFullAvl@24
1089 RtlInsertUnicodePrefix@12
1090 RtlInt64ToUnicodeString@16
1092 RtlIntegerToUnicode@16
1093 RtlIntegerToUnicodeString@12
1094 RtlInvertRangeList@8
1095 RtlIpv4AddressToStringA@8
1096 RtlIpv4AddressToStringExA@16
1097 RtlIpv4AddressToStringExW@16
1098 RtlIpv4AddressToStringW@8
1099 RtlIpv4StringToAddressA@16
1100 RtlIpv4StringToAddressExA@16
1101 RtlIpv4StringToAddressExW@16
1102 RtlIpv4StringToAddressW@16
1103 RtlIpv6AddressToStringA@8
1104 RtlIpv6AddressToStringExA@16
1105 RtlIpv6AddressToStringExW@16
1106 RtlIpv6AddressToStringW@8
1107 RtlIpv6StringToAddressA@16
1108 RtlIpv6StringToAddressExA@16
1109 RtlIpv6StringToAddressExW@16
1110 RtlIpv6StringToAddressW@16
1111 RtlIsGenericTableEmpty@4
1112 RtlIsGenericTableEmptyAvl@4
1113 RtlIsNameLegalDOS8Dot3@12
1114 RtlIsRangeAvailable@40
1115 RtlIsValidOemCharacter@4
1116 RtlLargeIntegerAdd@16
1117 RtlLargeIntegerArithmeticShift@12
1118 RtlLargeIntegerDivide@20
1119 RtlLargeIntegerNegate@8
1120 RtlLargeIntegerShiftLeft@12
1121 RtlLargeIntegerShiftRight@12
1122 RtlLargeIntegerSubtract@16
1123 RtlLengthRequiredSid@4
1124 RtlLengthSecurityDescriptor@4
1126 RtlLockBootStatusData@4
1127 RtlLookupAtomInAtomTable@12
1128 RtlLookupElementGenericTable@8
1129 RtlLookupElementGenericTableAvl@8
1130 RtlLookupElementGenericTableFull@16
1131 RtlLookupElementGenericTableFullAvl@16
1133 RtlMapSecurityErrorToNtStatus@4
1134 RtlMergeRangeLists@16
1136 RtlMultiByteToUnicodeN@20
1137 RtlMultiByteToUnicodeSize@12
1138 RtlNextUnicodePrefix@8
1139 RtlNtStatusToDosError@4
1140 RtlNtStatusToDosErrorNoTeb@4
1141 RtlNumberGenericTableElements@4
1142 RtlNumberGenericTableElementsAvl@4
1143 RtlNumberOfClearBits@4
1144 RtlNumberOfSetBits@4
1145 RtlOemStringToCountedUnicodeString@12
1146 RtlOemStringToUnicodeSize@4
1147 RtlOemStringToUnicodeString@12
1149 RtlPinAtomInAtomTable@8
1150 @RtlPrefetchMemoryNonTemporal@8
1152 RtlPrefixUnicodeString@12
1153 RtlQueryAtomInAtomTable@24
1154 RtlQueryRegistryValues@20
1155 RtlQueryTimeZoneInformation@4
1159 RtlRealPredecessor@4
1161 RtlRemoveUnicodePrefix@8
1163 RtlSecondsSince1970ToTime@8
1164 RtlSecondsSince1980ToTime@8
1165 RtlSelfRelativeToAbsoluteSD2@8
1166 RtlSelfRelativeToAbsoluteSD@44
1170 RtlSetDaclSecurityDescriptor@16
1171 RtlSetGroupSecurityDescriptor@12
1172 RtlSetOwnerSecurityDescriptor@12
1173 RtlSetSaclSecurityDescriptor@16
1174 RtlSetTimeZoneInformation@4
1178 RtlSubAuthorityCountSid@4
1179 RtlSubAuthoritySid@8
1180 RtlSubtreePredecessor@4
1181 RtlSubtreeSuccessor@4
1183 RtlTimeFieldsToTime@8
1184 RtlTimeToElapsedTimeFields@8
1185 RtlTimeToSecondsSince1970@8
1186 RtlTimeToSecondsSince1980@8
1187 RtlTimeToTimeFields@8
1189 @RtlUlonglongByteSwap@8
1190 RtlUnicodeStringToAnsiSize@4
1191 RtlUnicodeStringToAnsiString@12
1192 RtlUnicodeStringToCountedOemString@12
1193 RtlUnicodeStringToInteger@12
1194 RtlUnicodeStringToOemSize@4
1195 RtlUnicodeStringToOemString@12
1196 RtlUnicodeToCustomCPN@24
1197 RtlUnicodeToMultiByteN@20
1198 RtlUnicodeToMultiByteSize@12
1200 RtlUnlockBootStatusData@4
1202 RtlUpcaseUnicodeChar@4
1203 RtlUpcaseUnicodeString@12
1204 RtlUpcaseUnicodeStringToAnsiString@12
1205 RtlUpcaseUnicodeStringToCountedOemString@12
1206 RtlUpcaseUnicodeStringToOemString@12
1207 RtlUpcaseUnicodeToCustomCPN@24
1208 RtlUpcaseUnicodeToMultiByteN@20
1209 RtlUpcaseUnicodeToOemN@20
1212 @RtlUshortByteSwap@4
1213 RtlValidRelativeSecurityDescriptor@12
1214 RtlValidSecurityDescriptor@4
1216 RtlVerifyVersionInfo@16
1217 RtlVolumeDeviceToDosName@8
1218 RtlWalkFrameChain@12
1219 RtlWriteRegistryValue@24
1222 RtlxAnsiStringToUnicodeSize@4
1223 RtlxOemStringToUnicodeSize@4
1224 RtlxUnicodeStringToAnsiSize@4
1225 RtlxUnicodeStringToOemSize@4
1227 SeAppendPrivileges@8
1229 SeAssignSecurityEx@36
1230 SeAuditHardLinkCreation@12
1231 SeAuditingFileEvents@8
1232 SeAuditingFileEventsWithContext@12
1233 SeAuditingFileOrGlobalEvents@12
1234 SeAuditingHardLinkEvents@8
1235 SeAuditingHardLinkEventsWithContext@12
1236 SeCaptureSecurityDescriptor@20
1237 SeCaptureSubjectContext@4
1238 SeCloseObjectAuditAlarm@12
1239 SeCreateAccessState@16
1240 SeCreateClientSecurity@16
1241 SeCreateClientSecurityFromSubjectContext@16
1242 SeDeassignSecurity@4
1243 SeDeleteAccessState@4
1244 SeDeleteObjectAuditAlarm@8
1248 SeImpersonateClient@8
1249 SeImpersonateClientEx@8
1250 SeLockSubjectContext@4
1251 SeMarkLogonSessionForTerminationNotification@4
1252 SeOpenObjectAuditAlarm@36
1253 SeOpenObjectForDeleteAuditAlarm@36
1255 SePrivilegeObjectAuditAlarm@24
1256 SePublicDefaultDacl DATA
1257 SeQueryAuthenticationIdToken@8
1258 SeQueryInformationToken@12
1259 SeQuerySecurityDescriptorInfo@16
1260 SeQuerySessionIdToken@8
1261 SeRegisterLogonSessionTerminatedRoutine@4
1262 SeReleaseSecurityDescriptor@12
1263 SeReleaseSubjectContext@4
1264 SeSetAccessStateGenericMapping@8
1265 SeSetSecurityDescriptorInfo@24
1266 SeSetSecurityDescriptorInfoEx@28
1267 SeSinglePrivilegeCheck@12
1268 SeSystemDefaultDacl DATA
1269 SeTokenImpersonationLevel@4
1271 SeTokenIsRestricted@4
1272 SeTokenIsWriteRestricted@4
1274 SeUnlockSubjectContext@4
1275 SeUnregisterLogonSessionTerminatedRoutine@4
1276 SeValidSecurityDescriptor@8
1277 VerSetConditionMask@16
1278 WRITE_REGISTER_UCHAR@8
1279 WRITE_REGISTER_ULONG@8
1280 WRITE_REGISTER_USHORT@8
1281 WRITE_REGISTER_BUFFER_UCHAR@12
1282 WRITE_REGISTER_BUFFER_ULONG@12
1283 WRITE_REGISTER_BUFFER_USHORT@12
1284 ZwAccessCheckAndAuditAlarm@44
1286 ZwAdjustPrivilegesToken@24
1288 ZwAllocateVirtualMemory@24
1289 ZwAssignProcessToJobObject@8
1294 ZwCloseObjectAuditAlarm@12
1296 ZwCreateDirectoryObject@12
1299 ZwCreateJobObject@12
1302 ZwCreateSymbolicLinkObject@16
1308 ZwDeviceIoControlFile@40
1310 ZwDuplicateObject@28
1312 ZwEnumerateBootEntries@8
1314 ZwEnumerateValueKey@24
1315 ZwFlushInstructionCache@12
1317 ZwFlushVirtualMemory@16
1318 ZwFreeVirtualMemory@16
1320 ZwInitiatePowerAction@16
1324 ZwMakeTemporaryObject@4
1325 ZwMapViewOfSection@40
1326 ZwNotifyChangeKey@40
1327 ZwOpenDirectoryObject@12
1333 ZwOpenProcessToken@12
1334 ZwOpenProcessTokenEx@16
1336 ZwOpenSymbolicLinkObject@12
1338 ZwOpenThreadToken@16
1339 ZwOpenThreadTokenEx@20
1341 ZwPowerInformation@20
1343 ZwQueryBootEntryOrder@8
1344 ZwQueryBootOptions@8
1345 ZwQueryDefaultLocale@8
1346 ZwQueryDefaultUILanguage@4
1347 ZwQueryDirectoryFile@44
1348 ZwQueryDirectoryObject@28
1350 ZwQueryFullAttributesFile@8
1351 ZwQueryInformationAtom@20
1352 ZwQueryInformationFile@20
1353 ZwQueryInformationJobObject@20
1354 ZwQueryInformationProcess@20
1355 ZwQueryInformationThread@20
1356 ZwQueryInformationToken@20
1357 ZwQueryInstallUILanguage@4
1361 ZwQuerySecurityObject@20
1362 ZwQuerySymbolicLinkObject@12
1363 ZwQuerySystemInformation@16
1366 ZwQueryVolumeInformationFile@20
1369 ZwRequestWaitReplyPort@12
1374 ZwSetBootEntryOrder@8
1376 ZwSetDefaultLocale@8
1377 ZwSetDefaultUILanguage@4
1380 ZwSetInformationFile@20
1381 ZwSetInformationJobObject@16
1382 ZwSetInformationObject@16
1383 ZwSetInformationProcess@16
1384 ZwSetInformationThread@16
1385 ZwSetSecurityObject@12
1386 ZwSetSystemInformation@12
1390 ZwSetVolumeInformationFile@20
1391 ZwTerminateJobObject@8
1392 ZwTerminateProcess@8
1393 ZwTranslateFilePath@12
1396 ZwUnmapViewOfSection@8
1397 ZwWaitForMultipleObjects@20
1398 ZwWaitForSingleObject@12
1401 _abnormal_termination