1 ; $Id: ntoskrnl.def,v 1.183 2004/05/28 21:16:27 royce Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
13 CcGetFileObjectFromSectionPtrs@4
16 CcSetDirtyPinnedData@8
21 DbgBreakPointWithStatus@4
22 ;DbgLoadImageSymbols@12
26 @ExAcquireFastMutexUnsafe@4
27 ExAcquireResourceExclusive@8
28 ExAcquireResourceExclusiveLite@8
29 ExAcquireResourceSharedLite@8
30 ExAcquireSharedStarveExclusive@8
31 ExAcquireSharedWaitForExclusive@8
32 @ExAllocateFromPagedLookasideList@4
34 ExAllocatePoolWithQuota@8
35 ExAllocatePoolWithQuotaTag@12
36 ExAllocatePoolWithTag@12
37 ExConvertExclusiveToSharedLite@4
39 ExDeleteNPagedLookasideList@4
40 ExDeletePagedLookasideList@4
42 ExDeleteResourceLite@4
43 ExDesktopObjectType DATA
44 ExDisableResourceBoostLite@4
45 ExEventObjectType DATA
49 ExFreeToPagedLookasideList@8
50 ExGetExclusiveWaiterCount@4
52 ExGetSharedWaiterCount@4
53 ExInitializeNPagedLookasideList@28
54 ExInitializePagedLookasideList@28
55 ExInitializeResource@4
56 ExInitializeResourceLite@4
58 ExInterlockedAddLargeInteger@16
59 @ExInterlockedAddLargeStatistic@8
60 @ExInterlockedAddUlong@12
61 @ExInterlockedCompareExchange64@16
62 ExInterlockedDecrementLong@8
63 ExInterlockedExchangeUlong@12
64 ExInterlockedExtendZone@16
65 ExInterlockedIncrementLong@8
66 @ExInterlockedInsertHeadList@12
67 @ExInterlockedInsertTailList@12
68 @ExInterlockedPopEntryList@8
69 @ExInterlockedPopEntrySList@8
70 @ExInterlockedPushEntryList@12
71 @ExInterlockedPushEntrySList@12
72 @ExInterlockedRemoveHeadList@8
73 ExIsProcessorFeaturePresent@4
74 ExIsResourceAcquiredExclusiveLite@4
75 ExIsResourceAcquiredSharedLite@4
76 ExLocalTimeToSystemTime@8
81 ExRaiseAccessViolation@0
82 ExRaiseDatatypeMisalignment@0
87 ExReinitializeResourceLite@4
88 @ExReleaseFastMutexUnsafe@4
89 ExReleaseResourceForThread@8
90 ExReleaseResourceForThreadLite@8
91 @ExReleaseResourceLite@4
92 ExSetResourceOwnerPointer@8
93 ;ExSystemExceptionFilter
94 ExSystemTimeToLocalTime@8
95 ExTryToAcquireResourceExclusiveLite@4
96 ExUnregisterCallback@4
97 ExWindowStationObjectType DATA
98 ExInitializeBinaryTree@12
100 ExInsertBinaryTree@12
101 ExSearchBinaryTree@12
102 ExRemoveBinaryTree@12
103 ExTraverseBinaryTree@16
104 ExInitializeSplayTree@16
109 ExWeightOfSplayTree@8
110 ExTraverseSplayTree@16
111 ExInitializeHashTable@16
116 @ExfInterlockedAddUlong@12
117 @ExfInterlockedInsertHeadList@12
118 @ExfInterlockedInsertTailList@12
119 @ExfInterlockedPopEntryList@8
120 @ExfInterlockedPushEntryList@12
121 @ExfInterlockedRemoveHeadList@8
122 @Exfi386InterlockedDecrementLong@4
123 @Exfi386InterlockedExchangeUlong@8
124 @Exfi386InterlockedIncrementLong@4
125 Exi386InterlockedDecrementLong@4
126 Exi386InterlockedExchangeUlong@8
127 Exi386InterlockedIncrementLong@4
128 FsRtlAddLargeMcbEntry@28
130 FsRtlAddToTunnelCache@32
131 FsRtlAllocateFileLock@8
133 FsRtlAllocatePoolWithQuota@8
134 FsRtlAllocatePoolWithQuotaTag@12
135 FsRtlAllocatePoolWithTag@12
136 FsRtlAllocateResource@0
137 FsRtlAreNamesEqual@16
139 FsRtlCheckLockForReadAccess@8
140 FsRtlCheckLockForWriteAccess@8
144 FsRtlCurrentBatchOplock@4
145 FsRtlDeleteKeyFromTunnelCache@12
146 FsRtlDeleteTunnelCache@4
147 FsRtlDeregisterUncProvider@4
150 FsRtlDoesDbcsContainWildCards@4
151 FsRtlDoesNameContainWildCards@4
152 FsRtlFastCheckLockForRead@24
153 FsRtlFastCheckLockForWrite@24
154 FsRtlFastUnlockAll@16
155 FsRtlFastUnlockAllByKey@20
156 FsRtlFastUnlockSingle@32
157 FsRtlFindInTunnelCache@32
159 FsRtlGetNextFileLock@8
160 FsRtlGetNextLargeMcbEntry@20
161 FsRtlGetNextMcbEntry@20
162 FsRtlInitializeFileLock@12
163 FsRtlInitializeLargeMcb@8
165 FsRtlInitializeOplock@4
166 FsRtlInitializeTunnelCache@4
167 FsRtlIsDbcsInExpression@8
168 FsRtlIsFatDbcsLegal@20
169 FsRtlIsHpfsDbcsLegal@20
170 FsRtlIsNameInExpression@16
171 FsRtlIsNtstatusExpected@4
172 FsRtlIsTotalDeviceFailure@4
173 FsRtlLegalAnsiCharacterArray DATA
174 FsRtlLookupLargeMcbEntry@32
175 FsRtlLookupLastLargeMcbEntry@12
176 FsRtlLookupLastMcbEntry@12
177 FsRtlLookupMcbEntry@20
179 FsRtlMdlReadComplete@8
180 FsRtlMdlReadCompleteDev@12
182 FsRtlMdlWriteComplete@12
183 FsRtlMdlWriteCompleteDev@16
184 FsRtlNormalizeNtstatus@8
185 FsRtlNotifyChangeDirectory@28
186 FsRtlNotifyCleanup@12
187 FsRtlNotifyFullChangeDirectory@40
188 FsRtlNotifyFullReportChange@36
189 FsRtlNotifyInitializeSync@4
190 FsRtlNotifyReportChange@20
191 FsRtlNotifyUninitializeSync@4
192 FsRtlNotifyVolumeEvent@8
193 FsRtlNumberOfRunsInLargeMcb@4
194 FsRtlNumberOfRunsInMcb@4
196 FsRtlOplockIsFastIoPossible@4
197 FsRtlPostPagingFileStackOverflow@12
198 FsRtlPostStackOverflow@12
199 FsRtlPrepareMdlWrite@24
200 FsRtlPrepareMdlWriteDev@28
202 FsRtlProcessFileLock@12
203 FsRtlRegisterUncProvider@12
204 FsRtlRemoveLargeMcbEntry@20
205 FsRtlRemoveMcbEntry@12
206 FsRtlSplitLargeMcb@20
208 FsRtlTruncateLargeMcb@12
210 FsRtlUninitializeFileLock@4
211 FsRtlUninitializeLargeMcb@4
212 FsRtlUninitializeMcb@4
213 FsRtlUninitializeOplock@4
214 HalDispatchTable DATA
215 HalPrivateDispatchTable DATA
216 InbvAcquireDisplayOwnership@0
217 InbvCheckDisplayOwnership@0
219 InbvEnableBootDriver@4
220 InbvEnableDisplayString@4
221 InbvInstallDisplayStringFilter@4
222 InbvIsBootDriverInstalled@0
223 InbvNotifyDisplayOwnershipLost@4
225 InbvSetScrollRegion@16
227 InbvSolidColorFill@20
228 @InterlockedCompareExchange@12
229 @InterlockedDecrement@4
230 @InterlockedExchange@8
231 @InterlockedExchangeAdd@8
232 @InterlockedIncrement@4
233 @InterlockedPopEntrySList@4
234 @InterlockedPushEntrySList@8
235 IoAcquireCancelSpinLock@4
236 IoAcquireRemoveLockEx@20
237 IoAcquireVpbSpinLock@4
238 IoAdapterObjectType DATA
239 IoAllocateAdapterChannel@20
240 IoAllocateController@16
241 IoAllocateDriverObjectExtension@16
242 IoAllocateErrorLogEntry@8
248 IoAttachDeviceByPointer@8
249 IoAttachDeviceToDeviceStack@8
250 IoBuildAsynchronousFsdRequest@24
251 IoBuildDeviceIoControlRequest@36
253 IoBuildSynchronousFsdRequest@28
256 IoCheckDesiredAccess@8
257 IoCheckEaBufferValidity@12
258 IoCheckFunctionAccess@24
259 IoCheckShareAccess@20
261 IoConnectInterrupt@44
265 IoCreateNotificationEvent@8
266 IoCreateStreamFileObject@8
267 IoCreateSymbolicLink@8
268 IoCreateSynchronizationEvent@8
269 IoCreateUnprotectedSymbolicLink@8
272 IoDeleteSymbolicLink@4
274 IoDeviceHandlerObjectSize DATA
275 IoDeviceHandlerObjectType DATA
276 IoDisconnectInterrupt@4
277 IoDeviceObjectType DATA
278 IoDriverObjectType DATA
280 IoFastQueryNetworkAttributes@20
281 IoFileObjectType DATA
286 IoGetAttachedDevice@4
287 IoGetAttachedDeviceReference@4
288 IoGetBaseFileSystemDeviceObject@4
289 IoGetConfigurationInformation@0
290 IoGetCurrentProcess@0
291 IoGetDriverObjectExtension@8
292 IoGetDeviceObjectPointer@16
293 IoGetDeviceProperty@20
294 IoGetDeviceToVerify@4
295 IoGetFileObjectGenericMapping@0
297 IoGetRelatedDeviceObject@4
298 IoGetRequestorProcess@4
302 IoInvalidateDeviceRelations@8
303 IoInvalidateDeviceState@4
304 IoInitializeRemoveLockEx@20
306 IoIsOperationSynchronous@4
307 IoMakeAssociatedIrp@8
308 IoOpenDeviceInstanceKey@20
309 IoOpenDeviceRegistryKey@16
311 IoQueryDeviceDescription@32
312 IoQueryDeviceEnumInfo@8
313 IoQueryFileInformation@20
314 IoQueryVolumeInformation@20
318 IoRaiseInformationalHardError@12
319 IoReadOperationCount DATA
320 IoReadPartitionTable@16
321 IoReadTransferCount DATA
322 IoRegisterDeviceInterface@16
323 IoRegisterDriverReinitialization@12
324 IoRegisterFileSystem@4
325 IoRegisterFsRegistrationChange@8
326 IoRegisterShutdownNotification@4
327 IoReleaseCancelSpinLock@4
328 IoReleaseRemoveLockAndWaitEx@12
329 IoReleaseRemoveLockEx@12
330 IoReleaseVpbSpinLock@4
331 IoRemoveShareAccess@8
332 IoReportHalResourceUsage@16
333 IoReportResourceUsage@36
334 IoSetDeviceInterfaceState@8
335 IoSetDeviceToVerify@8
336 IoSetHardErrorOrVerifyDevice@8
338 IoSetPartitionInformation@16
340 IoSetThreadHardErrorMode@4
343 IoStartNextPacketByKey@12
346 IoStatisticsLock DATA
348 IoSynchronousPageWrite@20
350 IoUnregisterFileSystem@4
351 IoUnregisterFsRegistrationChange@8
352 IoUnregisterShutdownNotification@4
353 IoUpdateShareAccess@8
355 IoWriteErrorLogEntry@4
356 IoWriteOperationCount DATA
357 IoWritePartitionTable@20
358 IoWriteTransferCount DATA
360 @IofCompleteRequest@8
361 KdDebuggerEnabled DATA
362 KdDebuggerNotPresent DATA
364 KdSystemDebugControl@4
366 Ke386IoSetAccessProcess@8
367 Ke386QueryIoAccessMap@8
368 Ke386SetIoAccessMap@8
369 KeAcquireSpinLockAtDpcLevel@4
370 KeAddSystemServiceTable@20
372 ;KeBoostCurrentThread
378 KeDcacheFlushCount DATA
379 KeDelayExecutionThread@12
380 KeDeregisterBugCheckCallback@4
382 KeDisconnectInterrupt@4
383 KeEnterCriticalRegion@0
384 KeEnterKernelDebugger@0
385 ;KeFindConfigurationEntry
386 ;KeFindConfigurationNextEntry
391 ;KeI386AllocateGdtSelectors
392 ;KeI386Call16BitCStyleFunction
393 ;KeI386Call16BitFunction
394 ;KeI386FlatToGdtSelector
396 ;KeI386MachineType DATA
397 ;KeI386ReleaseGdtSelectors
399 ;KeI386SetGdtSelector
400 KeIcacheFlushCount DATA
402 KeInitializeDeviceQueue@4
405 KeInitializeInterrupt@44
409 KeInitializeSemaphore@12
410 KeInitializeSpinLock@4
412 KeInitializeTimerEx@8
413 KeInsertByKeyDeviceQueue@12
414 KeInsertDeviceQueue@8
420 KeLeaveCriticalRegion@0
422 KeNumberProcessors DATA
424 ;KeProfileInterruptWithSource
428 KeQueryTimeIncrement@0
429 ;KeRaiseUserException
435 KeReadStateSemaphore@4
437 KeRegisterBugCheckCallback@20
440 KeReleaseSemaphore@16
441 KeReleaseSpinLockFromDpcLevel@4
442 KeRemoveByKeyDeviceQueue@8
443 KeRemoveDeviceQueue@4
444 KeRemoveEntryDeviceQueue@8
448 KeRestoreFloatingPointState@4
450 KeSaveFloatingPointState@4
451 KeServiceDescriptorTable DATA
452 KeSetAffinityThread@8
453 KeSetBasePriorityThread@8
456 ;KeSetEventBoostPriority
457 ;KeSetIdealProcessorThread
459 ;KeSetKernelStackSwapEnable
460 KeSetPriorityThread@8
462 ;@KeSetSwapContextNotifyRoutine
463 KeSetTargetProcessorDpc@8
464 ;@KeSetThreadSelectNotifyRoutine
468 ;@KeSetTimeUpdateNotifyRoutine
469 KeSynchronizeExecution@12
474 KeWaitForMultipleObjects@32
475 KeWaitForMutexObject@20
476 KeWaitForSingleObject@20
477 @KefAcquireSpinLockAtDpcLevel@4=KefAcquireSpinLockAtDpcLevel
478 @KefReleaseSpinLockFromDpcLevel@4=KefReleaseSpinLockFromDpcLevel
482 ;KiCoprocessorError@0
484 KiDispatchInterrupt@0
485 KiInterruptDispatch2@8
486 ;KiIpiServiceRoutine@8
488 ;KiUnexpectedInterrupt
489 ;Kii386SpinOnSpinLock
493 ;LdrFindResourceDirectory_U@16
496 LsaCallAuthenticationPackage@28
497 LsaDeregisterLogonProcess@8
498 LsaFreeReturnBuffer@4
500 LsaLookupAuthenticationPackage@12
501 LsaRegisterLogonProcess@12
502 MmAdjustWorkingSetSize@12
503 MmAllocateContiguousAlignedMemory@36
504 MmAllocateContiguousMemory@12
505 MmAllocateContiguousMemorySpecifyCache@32
506 MmAllocateNonCachedMemory@4
507 MmAllocatePagesForMdl@28
508 MmBuildMdlForNonPagedPool@4
509 MmCanFileBeTruncated@8
514 MmDbgTranslatePhysicalAddress@8
515 MmDisableModifiedWriteOfSection@4
516 MmFlushImageSection@8
517 MmForceSectionClosed@8
518 MmFreeContiguousMemory@4
519 MmFreeContiguousMemorySpecifyCache@12
520 MmFreeNonCachedMemory@8
522 MmGetPhysicalAddress@4
524 MmHighestUserAddress DATA
526 MmIsNonPagedSystemAddressValid@4
527 MmIsRecursiveIoFault@0
528 MmIsThisAnNtAsSystem@0
529 MmLockPagableDataSection@4
530 MmLockPagableImageSection@4=MmLockPagableDataSection@4
531 MmLockPagableSectionByHandle@4
534 MmMapLockedPagesSpecifyCache@24
537 MmMapViewInSystemSpace@12
538 MmMapViewOfSection@40
540 MmProbeAndLockPages@12
542 MmResetDriverPaging@4
543 MmSectionObjectType DATA
544 MmSecureVirtualMemory@12
545 MmSetAddressRangeModified@8
546 MmSetBankedSection@24
548 MmUnlockPagableImageSection@4
552 MmUnmapVideoDisplay@8
553 MmUnmapViewInSystemSpace@4
554 MmUnmapViewOfSection@8
555 MmUnsecureVirtualMemory@4
556 MmUserProbeAddress DATA
559 NlsMbCodePageTag DATA
560 NlsMbOemCodePageTag DATA
561 NlsOemLeadByteInfo DATA
563 NtAdjustPrivilegesToken@24
565 NtAllocateLocallyUniqueId@4
567 NtAllocateVirtualMemory@24
578 NtDeviceIoControlFile@40
582 NtFreeVirtualMemory@16
586 NtMapViewOfSection@40
587 NtNotifyChangeDirectoryFile@36
590 NtOpenProcessToken@12
591 NtQueryDirectoryFile@44
593 NtQueryInformationAtom@20
594 NtQueryInformationFile@20
595 NtQueryInformationProcess@20
596 NtQueryInformationToken@20
597 ;NtQueryOleDirectoryFile@ <--- ?
598 NtQuerySecurityObject@20
600 NtQueryVolumeInformationFile@20
603 NtRequestWaitReplyPort@12
605 NtSetInformationFile@20
606 NtSetInformationProcess@16
607 NtSetInformationThread@16
608 NtSetSecurityObject@12
613 NtWaitForSingleObject@12
616 ;ObCheckCreateObjectAccess@28
617 ;ObCheckObjectAccess@20
619 ;ObFindHandleForObject@20
620 ObGetObjectPointerCount@4
621 ObGetObjectSecurity@12
623 ObMakeTemporaryObject@4
624 ObOpenObjectByName@28
625 ObOpenObjectByPointer@28
627 ObQueryObjectAuditingByHandle@8
628 @ObfDereferenceObject@4
629 @ObfReferenceObject@4
630 ObReferenceObjectByHandle@24
631 ObReferenceObjectByName@32
632 ObReferenceObjectByPointer@16
633 ObReleaseObjectSecurity@8
634 ObDereferenceObject@4
635 ;ObSetSecurityDescriptorInfo@24
641 PoRegisterDeviceForIdleDetection@16
642 PoRegisterSystemState@8
647 PoStartNextPowerIrp@4
648 PoUnregisterSystemState@4
651 PsAssignImpersonationToken@8
652 ;PsChargePoolQuota@12
653 PsCreateSystemProcess@12
654 PsCreateSystemThread@28
655 PsCreateWin32Process@4
656 PsEstablishWin32Callouts@24
657 PsGetCurrentProcessId@0
658 PsGetCurrentThreadId@0
659 PsGetProcessExitTime@0
663 PsImpersonateClient@20
664 PsInitialSystemProcess DATA
665 PsIsThreadTerminating@4
666 PsLookupProcessByProcessId@8
667 PsLookupProcessThreadByCid@12
668 PsLookupThreadByThreadId@8
670 PsReferenceImpersonationToken@16
671 PsReferencePrimaryToken@4
672 ;PsReturnPoolQuota@12
674 PsSetCreateProcessNotifyRoutine@8
675 PsSetCreateThreadNotifyRoutine@4
676 ;PsSetLegoNotifyRoutine@4
677 PsSetLoadImageNotifyRoutine@4
678 ;PsSetProcessPriorityByClass@8
679 PsTerminateSystemThread@4
681 READ_REGISTER_UCHAR@4
682 READ_REGISTER_ULONG@4
683 READ_REGISTER_USHORT@4
684 READ_REGISTER_BUFFER_UCHAR@12
685 READ_REGISTER_BUFFER_ULONG@12
686 READ_REGISTER_BUFFER_USHORT@12
688 KeRosDumpStackFrames@8
689 RtlAbsoluteToSelfRelativeSD@12
690 RtlAddAccessAllowedAce@16
692 RtlAddAtomToAtomTable@12
694 ;RtlAllocateAndInitializeSid
696 RtlAnsiCharToUnicodeChar@4
697 RtlAnsiStringToUnicodeSize@4
698 RtlAnsiStringToUnicodeString@12
699 RtlAppendAsciizToString@8
700 RtlAppendStringToString@8
701 RtlAppendUnicodeStringToString@8
702 RtlAppendUnicodeToString@8
703 RtlAreAllAccessesGranted@8
704 RtlAreAnyAccessesGranted@8
708 ;RtlCaptureStackBackTrace
710 RtlCheckRegistryKey@8
714 RtlCompareMemoryUlong@12
716 RtlCompareUnicodeString@12
719 RtlConvertLongToLargeInteger@4
720 RtlConvertSidToUnicodeString@12
721 RtlConvertUlongToLargeInteger@4
726 RtlCopyUnicodeString@8
730 RtlCreateRegistryKey@8
731 RtlCreateSecurityDescriptor@8
732 RtlCreateUnicodeString@8
733 RtlCustomCPToUnicodeN@24
734 RtlDecompressBuffer@24
735 RtlDecompressChunks@28
736 RtlDecompressFragment@32
738 RtlDeleteAtomFromAtomTable@8
739 ;RtlDeleteElementGenericTable
741 RtlDeleteOwnersRanges@8
743 RtlDeleteRegistryValue@12
745 RtlDestroyAtomTable@4
747 RtlDowncaseUnicodeString@12
749 RtlEnlargedIntegerMultiply@8
750 RtlEnlargedUnsignedDivide@16
751 RtlEnlargedUnsignedMultiply@8
752 ;RtlEnumerateGenericTable
753 ;RtlEnumerateGenericTableWithoutSplaying
757 RtlEqualUnicodeString@12
758 RtlExtendedIntegerMultiply@12
759 RtlExtendedLargeIntegerDivide@16
760 RtlExtendedMagicDivide@20
762 RtlFillMemoryUlong@12
764 RtlFindClearBitsAndSet@12
765 RtlFindFirstRunClear@8
767 RtlFindLeastSignificantBit@8
768 RtlFindLongestRunClear@8
769 RtlFindLongestRunSet@8
771 RtlFindMostSignificantBit@8
774 RtlFindSetBitsAndClear@12
775 ;RtlFindUnicodePrefix
776 RtlFormatCurrentUserKeyPath@4
781 RtlFreeUnicodeString@4
782 RtlGenerate8dot3Name@16
783 ;RtlGetCallersAddress
784 RtlGetCompressionWorkSpaceSize@12
785 RtlGetDaclSecurityDescriptor@16
786 RtlGetDefaultCodePage@8
787 ;RtlGetElementGenericTable
789 RtlGetGroupSecurityDescriptor@12
791 RtlGetOwnerSecurityDescriptor@12
794 RtlImageDirectoryEntryToData@16
796 RtlInitCodePageTable@8
798 RtlInitUnicodeString@8
799 RtlInitializeBitMap@12
800 ;RtlInitializeGenericTable
801 RtlInitializeRangeList@4
803 ;RtlInitializeUnicodePrefix
804 ;RtlInsertElementGenericTable
805 ;RtlInsertUnicodePrefix
807 RtlIntegerToUnicodeString@12
809 RtlIsNameLegalDOS8Dot3@12
810 RtlIsRangeAvailable@40
811 RtlLargeIntegerAdd@16
812 RtlLargeIntegerArithmeticShift@12
813 RtlLargeIntegerDivide@20
814 RtlLargeIntegerNegate@8
815 RtlLargeIntegerShiftLeft@12
816 RtlLargeIntegerShiftRight@12
817 RtlLargeIntegerSubtract@16
818 RtlLengthRequiredSid@4
819 RtlLengthSecurityDescriptor@4
821 RtlLookupAtomInAtomTable@12
822 ;RtlLookupElementGenericTable
824 RtlMergeRangeLists@16
826 RtlMultiByteToUnicodeN@20
827 RtlMultiByteToUnicodeSize@12
828 ;RtlNextUnicodePrefix
829 RtlNtStatusToDosError@4
830 RtlNtStatusToDosErrorNoTeb@4
831 ;RtlNumberGenericTableElements
832 RtlNumberOfClearBits@4
834 RtlOemStringToCountedUnicodeString@12
835 RtlOemStringToUnicodeSize@4
836 RtlOemStringToUnicodeString@12
838 RtlPinAtomInAtomTable@8
840 RtlPrefixUnicodeString@12
841 RtlQueryAtomInAtomTable@24
842 RtlQueryRegistryValues@20
843 RtlQueryTimeZoneInformation@4
846 ;RtlRemoveUnicodePrefix
848 RtlSecondsSince1970ToTime@8
849 RtlSecondsSince1980ToTime@8
852 RtlSetDaclSecurityDescriptor@16
853 RtlSetGroupSecurityDescriptor@12
854 RtlSetOwnerSecurityDescriptor@12
855 RtlSetSaclSecurityDescriptor@16
856 RtlSetTimeZoneInformation@4
858 RtlSubAuthorityCountSid@4
860 RtlTimeFieldsToTime@8
861 RtlTimeToSecondsSince1970@8
862 RtlTimeToSecondsSince1980@8
863 RtlTimeToTimeFields@8
865 @RtlUlonglongByteSwap@8
866 RtlUnicodeStringToAnsiSize@4
867 RtlUnicodeStringToAnsiString@12
868 RtlUnicodeStringToCountedOemString@12
869 RtlUnicodeStringToInteger@12
870 RtlUnicodeStringToOemSize@4
871 RtlUnicodeStringToOemString@12
872 RtlUnicodeToCustomCPN@24
873 RtlUnicodeToMultiByteN@20
874 RtlUnicodeToMultiByteSize@12
877 RtlUpcaseUnicodeChar@4
878 RtlUpcaseUnicodeString@12
879 RtlUpcaseUnicodeStringToAnsiString@12
880 RtlUpcaseUnicodeStringToCountedOemString@12
881 RtlUpcaseUnicodeStringToOemString@12
882 RtlUpcaseUnicodeToCustomCPN@24
883 RtlUpcaseUnicodeToMultiByteN@20
884 RtlUpcaseUnicodeToOemN@20
888 RtlValidSecurityDescriptor@4
890 RtlWriteRegistryValue@24
893 RtlxAnsiStringToUnicodeSize@4
894 RtlxOemStringToUnicodeSize@4
895 RtlxUnicodeStringToAnsiSize@4
896 RtlxUnicodeStringToOemSize@4
898 ;SeAppendPrivileges@8
900 ;SeAuditingFileEvents@8
901 ;SeAuditingFileOrGlobalEvents@18
902 ;SeCaptureSecurityDescriptor@20
903 SeCaptureSubjectContext@4
904 ;SeCloseObjectAuditAlarm@12
905 ;SeCreateAccessState@16
906 SeCreateClientSecurity@16
908 ;SeDeleteAccessState@4
909 SeDeleteObjectAuditAlarm@8
912 SeImpersonateClient@8
913 SeLockSubjectContext@4
914 ;SeMarkLogonSessionForTerminationNotification@4
915 SeOpenObjectAuditAlarm@36
916 SeOpenObjectForDeleteAuditAlarm@36
918 ;SePrivilegeObjectAuditAlarm@24
919 SePublicDefaultDacl DATA
920 SeQueryAuthenticationIdToken@8
921 SeQuerySecurityDescriptorInfo@16
922 ;SeRegisterLogonSessionTerminatedRoutine@4
923 ;SeReleaseSecurityDescriptor@12
924 SeReleaseSubjectContext@4
925 ;SeSetAccessStateGenericMapping@8
926 SeSetSecurityDescriptorInfo@24
927 SeSinglePrivilegeCheck@12
928 SeSystemDefaultDacl DATA
929 SeTokenImpersonationLevel@4
931 SeUnlockSubjectContext@4
932 ;SeUnregisterLogonSessionTerminatedRoutine@4
933 SeValidSecurityDescriptor@8
934 WRITE_REGISTER_UCHAR@8
935 WRITE_REGISTER_ULONG@8
936 WRITE_REGISTER_USHORT@8
937 WRITE_REGISTER_BUFFER_UCHAR@12
938 WRITE_REGISTER_BUFFER_ULONG@12
939 WRITE_REGISTER_BUFFER_USHORT@12
940 ZwAccessCheckAndAuditAlarm@44
942 ZwAllocateVirtualMemory@24
945 ZwCloseObjectAuditAlarm@12
947 ZwCreateDirectoryObject@12
952 ZwCreateSymbolicLinkObject@16
956 ZwDeviceIoControlFile@40
961 ZwEnumerateValueKey@24
962 ZwFlushInstructionCache@12
964 ZwFreeVirtualMemory@16
968 ZwMakeTemporaryObject@4
969 ZwMapViewOfSection@40
971 ZwOpenDirectoryObject@12
976 ZwOpenProcessToken@12
978 ZwOpenSymbolicLinkObject@12
982 ZwQueryDefaultLocale@8
983 ZwQueryDirectoryFile@44
984 ZwQueryInformationAtom@20
985 ZwQueryInformationFile@20
986 ZwQueryInformationProcess@20
987 ZwQueryInformationToken@20
991 ZwQuerySecurityObject@20
992 ZwQuerySymbolicLinkObject@12
993 ZwQuerySystemInformation@16
996 ZwQueryVolumeInformationFile@20
999 ZwRequestWaitReplyPort@12
1002 ZwSetDefaultLocale@8
1004 ZwSetInformationFile@20
1005 ZwSetInformationObject@16
1006 ZwSetInformationProcess@16
1007 ZwSetInformationThread@16
1008 ZwSetSystemInformation@12
1011 ZwTerminateProcess@8
1014 ZwUnmapViewOfSection@8
1015 ZwWaitForMultipleObjects@20
1016 ZwWaitForSingleObject@12
1019 _abnormal_termination