3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
19 CcGetFileObjectFromBcb@4
20 CcGetFileObjectFromSectionPtrs@4
21 CcGetFlushedValidData@8
22 CcGetLsnForFileObject@8
23 CcInitializeCacheMap@20
25 CcFastMdlReadWait DATA
26 CcFastReadNotPossible DATA
37 CcPurgeCacheSection@16
40 CcScheduleReadAhead@12
41 CcSetAdditionalCacheAttributes@12
42 CcSetBcbOwnerPointer@8
43 CcSetDirtyPageThreshold@8
44 CcSetDirtyPinnedData@8
45 CcSetLogHandleForFile@12
46 CcSetReadAheadGranularity@8
47 CcUninitializeCacheMap@12
49 CcUnpinDataForThread@8
51 CcWaitForCurrentLazyWriterActivity@0
56 CmUnRegisterCallback@8
58 DbgBreakPointWithStatus@4
59 DbgLoadImageSymbols@12
63 DbgPrintReturnControlC
64 DbgQueryDebugFilterState@8
65 DbgSetDebugFilterState@12
66 @ExiAcquireFastMutex@4=@ExAcquireFastMutex@4
67 @ExAcquireFastMutexUnsafe@4
68 ExAcquireRundownProtection=@ExfAcquireRundownProtection@4
69 ExAcquireRundownProtectionCacheAware=@ExfAcquireRundownProtectionCacheAware@4
70 ExAcquireRundownProtectionCacheAwareEx=@ExfAcquireRundownProtectionCacheAwareEx@8
71 ExAcquireRundownProtectionEx=@ExfAcquireRundownProtectionEx@8
72 ExInitializeRundownProtection=@ExfInitializeRundownProtection@4
73 ExReInitializeRundownProtection=@ExfReInitializeRundownProtection@4
74 ExReInitializeRundownProtectionCacheAware=@ExfReInitializeRundownProtectionCacheAware@4
75 ExReleaseRundownProtection=@ExfReleaseRundownProtection@4
76 ExReleaseRundownProtectionCacheAware=@ExfReleaseRundownProtectionCacheAware@4
77 ExReleaseRundownProtectionCacheAwareEx=@ExfReleaseRundownProtectionCacheAwareEx@8
78 ExReleaseRundownProtectionEx=@ExfReleaseRundownProtectionEx@8
79 ExRundownCompleted=@ExfRundownCompleted@4
80 ExRundownCompletedCacheAware=@ExfRundownCompletedCacheAware@4
81 ExWaitForRundownProtectionRelease=@ExfWaitForRundownProtectionRelease@4
82 ExWaitForRundownProtectionReleaseCacheAware=@ExfWaitForRundownProtectionReleaseCacheAware@4
83 ExAllocateCacheAwareRundownProtection@8
84 ExFreeCacheAwareRundownProtection@4
85 ExInitializeRundownProtectionCacheAware@8
86 ExSizeOfRundownProtectionCacheAware@0
87 ExAcquireResourceExclusiveLite@8
88 ExAcquireResourceSharedLite@8
89 ExAcquireSharedStarveExclusive@8
90 ExAcquireSharedWaitForExclusive@8
91 ExAllocateFromPagedLookasideList@4=ExiAllocateFromPagedLookasideList@4
93 ExAllocatePoolWithQuota@8
94 ExAllocatePoolWithQuotaTag@12
95 ExAllocatePoolWithTag@12
96 ExAllocatePoolWithTagPriority@16
97 ExConvertExclusiveToSharedLite@4
99 ExDeleteNPagedLookasideList@4
100 ExDeletePagedLookasideList@4
101 ExDeleteResourceLite@4
102 ExDesktopObjectType DATA
103 ExDisableResourceBoostLite@4
105 @ExEnterCriticalRegionAndAcquireFastMutexUnsafe@4
106 ExEventObjectType DATA
110 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
111 ExGetCurrentProcessorCounts@12
112 ExGetCurrentProcessorCpuUsage@4
113 ExGetExclusiveWaiterCount@4
115 ExGetSharedWaiterCount@4
116 ExInitializeNPagedLookasideList@28
117 ExInitializePagedLookasideList@28
118 ExInitializeResourceLite@4
120 ExInterlockedAddLargeInteger@16
121 @ExInterlockedAddLargeStatistic@8
122 ExInterlockedAddUlong@12
123 @ExInterlockedCompareExchange64@16
124 ExInterlockedDecrementLong@8
125 ExInterlockedExchangeUlong@12
126 ExInterlockedExtendZone@16
127 ExInterlockedIncrementLong@8
128 @ExInterlockedFlushSList@4
129 ExInterlockedInsertHeadList@12
130 ExInterlockedInsertTailList@12
131 ExInterlockedPopEntryList@8
132 @ExInterlockedPopEntrySList@8
133 ExInterlockedPushEntryList@12
134 @ExInterlockedPushEntrySList@12
135 ExInterlockedRemoveHeadList@8
136 ExIsProcessorFeaturePresent@4
137 ExIsResourceAcquiredExclusiveLite@4
138 ExIsResourceAcquiredSharedLite@4
139 ExLocalTimeToSystemTime@8
141 ExQueryPoolBlockSize@8
143 ExRaiseAccessViolation@0
144 ExRaiseDatatypeMisalignment@0
145 ExRaiseException@4=RtlRaiseException@4
147 ExRaiseStatus@4=RtlRaiseStatus@4
148 ExRegisterCallback@12
149 ExReinitializeResourceLite@4
150 @ExiReleaseFastMutex@4=@ExReleaseFastMutex@4
151 @ExReleaseFastMutexUnsafe@4
152 @ExReleaseFastMutexUnsafeAndLeaveCriticalRegion@4
153 ExReleaseResourceForThreadLite@8
154 @ExReleaseResourceLite@4
155 ExSemaphoreObjectType DATA
156 ExSetResourceOwnerPointer@8
157 ExSetTimerResolution@8
158 ExSystemExceptionFilter@0
159 ExSystemTimeToLocalTime@8
160 ExTryToAcquireResourceExclusiveLite@4
161 ExUnregisterCallback@4
164 ExWindowStationObjectType DATA
165 @ExfInterlockedAddUlong@12
166 @ExfInterlockedInsertHeadList@12
167 @ExfInterlockedInsertTailList@12
168 @ExfInterlockedCompareExchange64@12
169 @ExfInterlockedPopEntryList@8
170 @ExfInterlockedPushEntryList@12
171 @ExfInterlockedRemoveHeadList@8
172 @Exfi386InterlockedDecrementLong@4
173 @Exfi386InterlockedExchangeUlong@8
174 @Exfi386InterlockedIncrementLong@4
175 Exi386InterlockedDecrementLong@4
176 Exi386InterlockedExchangeUlong@12
177 Exi386InterlockedIncrementLong@4
178 FsRtlAcquireFileExclusive@4
179 FsRtlAddLargeMcbEntry@28
181 FsRtlAddToTunnelCache@32
182 FsRtlAllocateFileLock@8
184 FsRtlAllocatePoolWithQuota@8
185 FsRtlAllocatePoolWithQuotaTag@12
186 FsRtlAllocatePoolWithTag@12
187 FsRtlAllocateResource@0
188 FsRtlAreNamesEqual@16
190 FsRtlCheckLockForReadAccess@8
191 FsRtlCheckLockForWriteAccess@8
195 FsRtlCurrentBatchOplock@4
196 FsRtlDeleteKeyFromTunnelCache@12
197 FsRtlDeleteTunnelCache@4
198 FsRtlDeregisterUncProvider@4
201 FsRtlDoesDbcsContainWildCards@4
202 FsRtlDoesNameContainWildCards@4
203 FsRtlFastCheckLockForRead@24
204 FsRtlFastCheckLockForWrite@24
205 FsRtlFastUnlockAll@16
206 FsRtlFastUnlockAllByKey@20
207 FsRtlFastUnlockSingle@32
208 FsRtlFindInTunnelCache@32
211 FsRtlGetNextFileLock@8
212 FsRtlGetNextLargeMcbEntry@20
213 FsRtlGetNextMcbEntry@20
214 FsRtlIncrementCcFastReadNotPossible@0
215 FsRtlIncrementCcFastReadNoWait@0
216 FsRtlIncrementCcFastReadResourceMiss@0
217 FsRtlIncrementCcFastReadWait@0
218 FsRtlInitializeFileLock@12
219 FsRtlInitializeLargeMcb@8
221 FsRtlInitializeOplock@4
222 FsRtlInitializeTunnelCache@4
223 FsRtlInsertPerFileObjectContext@8
224 FsRtlInsertPerStreamContext@8
225 FsRtlIsDbcsInExpression@8
226 FsRtlIsFatDbcsLegal@20
227 FsRtlIsHpfsDbcsLegal@20
228 FsRtlIsNameInExpression@16
229 FsRtlIsNtstatusExpected@4
231 FsRtlIsTotalDeviceFailure@4
232 FsRtlLegalAnsiCharacterArray DATA
233 FsRtlLookupLargeMcbEntry@32
234 FsRtlLookupLastLargeMcbEntry@12
235 FsRtlLookupLastLargeMcbEntryAndIndex@16
236 FsRtlLookupLastMcbEntry@12
237 FsRtlLookupMcbEntry@20
238 FsRtlLookupPerFileObjectContext@12
239 FsRtlLookupPerStreamContextInternal@12
241 FsRtlMdlReadComplete@8
242 FsRtlMdlReadCompleteDev@12
244 FsRtlMdlWriteComplete@12
245 FsRtlMdlWriteCompleteDev@16
246 FsRtlNormalizeNtstatus@8
247 FsRtlNotifyChangeDirectory@28
248 FsRtlNotifyCleanup@12
249 FsRtlNotifyFilterChangeDirectory@44
250 FsRtlNotifyFilterReportChange@40
251 FsRtlNotifyFullChangeDirectory@40
252 FsRtlNotifyFullReportChange@36
253 FsRtlNotifyInitializeSync@4
254 FsRtlNotifyReportChange@20
255 FsRtlNotifyUninitializeSync@4
256 FsRtlNotifyVolumeEvent@8
257 FsRtlNumberOfRunsInLargeMcb@4
258 FsRtlNumberOfRunsInMcb@4
260 FsRtlOplockIsFastIoPossible@4
261 FsRtlPostPagingFileStackOverflow@12
262 FsRtlPostStackOverflow@12
263 FsRtlPrepareMdlWrite@24
264 FsRtlPrepareMdlWriteDev@28
266 FsRtlProcessFileLock@12
267 FsRtlRegisterUncProvider@12
269 FsRtlRemoveLargeMcbEntry@20
270 FsRtlRemoveMcbEntry@12
271 FsRtlRemovePerFileObjectContext@12
272 FsRtlRemovePerStreamContext@12
274 FsRtlSplitLargeMcb@20
276 FsRtlTeardownPerStreamContexts@4
277 FsRtlTruncateLargeMcb@12
279 FsRtlUninitializeFileLock@4
280 FsRtlUninitializeLargeMcb@4
281 FsRtlUninitializeMcb@4
282 FsRtlUninitializeOplock@4
283 HalDispatchTable DATA
284 HalPrivateDispatchTable DATA
286 InbvAcquireDisplayOwnership@0
287 InbvCheckDisplayOwnership@0
289 InbvEnableBootDriver@4
290 InbvEnableDisplayString@4
291 InbvInstallDisplayStringFilter@4
292 InbvIsBootDriverInstalled@0
293 InbvNotifyDisplayOwnershipLost@4
295 InbvSetScrollRegion@16
297 InbvSolidColorFill@20
298 InitSafeBootMode DATA
299 @InterlockedCompareExchange@12
300 @InterlockedDecrement@4
301 @InterlockedExchange@8
302 @InterlockedExchangeAdd@8
303 @InterlockedIncrement@4
304 @InterlockedPushEntrySList@8
305 @InterlockedPopEntrySList@4
306 IoAcquireCancelSpinLock@4
307 IoAcquireRemoveLockEx@20
308 IoAcquireVpbSpinLock@4
309 IoAdapterObjectType DATA
310 IoAllocateAdapterChannel@20
313 IoAllocateController@16
314 IoAllocateDriverObjectExtension@16
315 IoAllocateErrorLogEntry@8
317 IoAssignDriveLetters@16
320 IoAttachDeviceByPointer@8
321 IoAttachDeviceToDeviceStack@8
322 IoAttachDeviceToDeviceStackSafe@12
323 IoBuildAsynchronousFsdRequest@24
324 IoBuildDeviceIoControlRequest@36
326 IoBuildSynchronousFsdRequest@28
330 IoCheckDesiredAccess@8
331 IoCheckEaBufferValidity@12
332 IoCheckFunctionAccess@24
333 IoCheckQuerySetFileInformation@12
334 IoCheckQuerySetVolumeInformation@12
335 IoCheckQuotaBufferValidity@12
336 IoCheckShareAccess@20
338 IoConnectInterrupt@44
344 IoCreateFileSpecifyDeviceObjectHint@60
345 IoCreateNotificationEvent@8
346 IoCreateStreamFileObject@8
347 IoCreateStreamFileObjectEx@12
348 IoCreateStreamFileObjectLite@8
349 IoCreateSymbolicLink@8
350 IoCreateSynchronizationEvent@8
351 IoCreateUnprotectedSymbolicLink@8
361 IoDeleteSymbolicLink@4
363 IoDeviceHandlerObjectSize DATA
364 IoDeviceHandlerObjectType DATA
365 IoDeviceObjectType DATA
366 IoDisconnectInterrupt@4
367 IoDriverObjectType DATA
369 IoEnumerateDeviceObjectList@16
370 IoFastQueryNetworkAttributes@20
371 IoFileObjectType DATA
372 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
373 IoForwardIrpSynchronously@8
375 IoFreeErrorLogEntry@4
379 IoGetAttachedDevice@4
380 IoGetAttachedDeviceReference@4
381 IoGetBaseFileSystemDeviceObject@4
382 IoGetBootDiskInformation@8
383 IoGetConfigurationInformation@0
384 IoGetCurrentProcess@0
385 IoGetDeviceObjectPointer@16
386 IoGetDeviceAttachmentBaseRef@4
387 IoGetDeviceInterfaceAlias@12
388 IoGetDeviceInterfaces@16
389 IoGetDriverObjectExtension@8
390 IoGetDeviceProperty@20
391 IoGetDeviceToVerify@4
392 IoGetDiskDeviceObject@8
394 IoGetFileObjectGenericMapping@0
396 IoGetLowerDeviceObject@4
397 IoGetRelatedDeviceObject@4
398 IoGetRequestorProcess@4
399 IoGetRequestorProcessId@4
400 IoGetRequestorSessionId@8
404 IoInvalidateDeviceRelations@8
405 IoInvalidateDeviceState@4
406 IoInitializeRemoveLockEx@20
408 IoIsFileOriginRemote@4
410 IoIsValidNameGraftingBuffer@8
411 IoIsOperationSynchronous@4
412 IoMakeAssociatedIrp@8
413 IoOpenDeviceInterfaceRegistryKey@12
414 IoOpenDeviceRegistryKey@16
416 IoPnPDeliverServicePowerNotification@16
417 IoQueryDeviceDescription@32
418 IoQueryFileDosDeviceName@8
419 IoQueryFileInformation@20
420 IoQueryVolumeInformation@20
424 IoRaiseInformationalHardError@12
425 IoReadDiskSignature@12
426 IoReadOperationCount DATA
427 @IoReadPartitionTable@16
428 IoReadPartitionTableEx@8
429 IoReadTransferCount DATA
430 IoRegisterBootDriverReinitialization@12
431 IoRegisterDeviceInterface@16
432 IoRegisterDriverReinitialization@12
433 IoRegisterFileSystem@4
434 IoRegisterFsRegistrationChange@8
435 IoRegisterLastChanceShutdownNotification@4
436 IoRegisterPlugPlayNotification@28
437 IoRegisterShutdownNotification@4
438 IoReleaseCancelSpinLock@4
439 IoReleaseRemoveLockAndWaitEx@12
440 IoReleaseRemoveLockEx@12
441 IoReleaseVpbSpinLock@4
442 IoRemoveShareAccess@8
443 IoReportDetectedDevice@32
444 IoReportHalResourceUsage@16
445 IoReportResourceUsage@36
446 IoReportResourceForDetection@28
447 IoReportTargetDeviceChange@8
448 IoReportTargetDeviceChangeAsynchronous@16
449 IoRequestDeviceEject@4
451 IoSetCompletionRoutineEx@28
452 IoSetSystemPartition@4
453 IoSetDeviceInterfaceState@8
454 IoSetDeviceToVerify@8
456 IoSetHardErrorOrVerifyDevice@8
459 @IoSetPartitionInformation@16
460 IoSetPartitionInformationEx@12
461 IoSetStartIoAttributes@12
463 IoSetThreadHardErrorMode@4
466 IoStartNextPacketByKey@12
469 IoStatisticsLock DATA
471 IoSynchronousPageWrite@20
472 IoSynchronousInvalidateDeviceRelations@8
474 IoUnregisterFileSystem@4
475 IoUnregisterFsRegistrationChange@8
476 IoUnregisterPlugPlayNotification@4
477 IoUnregisterShutdownNotification@4
478 IoUpdateShareAccess@8
479 IoValidateDeviceIoControlAccess@8
480 IoVerifyPartitionTable@8
482 IoVolumeDeviceToDosName@8
483 IoWMIAllocateInstanceIds@12
484 IoWMIDeviceObjectToInstanceName@12
485 IoWMIExecuteMethod@24
486 IoWMIHandleToInstanceName@12
489 IoWMIQueryAllDataMultiple@16
490 IoWMIQuerySingleInstance@16
491 IoWMIQuerySingleInstanceMultiple@20
492 IoWMIRegistrationControl@8
493 IoWMISetNotificationCallback@12
494 IoWMISetSingleInstance@20
495 IoWMISetSingleItem@24
496 IoWMISuggestInstanceName@16
498 IoWriteErrorLogEntry@4
499 IoWriteOperationCount DATA
500 @IoWritePartitionTable@20
501 IoWritePartitionTableEx@8
502 IoWriteTransferCount DATA
504 @IofCompleteRequest@8
505 IoIsWdmVersionAvailable@8
506 KdDebuggerEnabled DATA
507 KdDebuggerNotPresent DATA
513 KdpServiceDispatcher@12
515 Ke386IoSetAccessProcess@8
516 Ke386QueryIoAccessMap@8
517 Ke386SetIoAccessMap@8
518 @KeAcquireGuardedMutex@4
519 @KeAcquireGuardedMutexUnsafe@4
520 KeAcquireSpinLockAtDpcLevel@4
521 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
522 KeAcquireInterruptSpinLock@4
523 KeAddSystemServiceTable@20
526 ;KeBoostCurrentThread
530 KeCapturePersistentThreadState@28
533 KeDcacheFlushCount DATA
534 KeDelayExecutionThread@12
535 KeDeregisterBugCheckCallback@4
536 KeDeregisterBugCheckReasonCallback@4
538 KeDisconnectInterrupt@4
539 KeEnterCriticalRegion@0
540 KeEnterGuardedRegion@0
541 KeEnterKernelDebugger@0
542 KeFindConfigurationEntry@16
543 KeFindConfigurationNextEntry@20
548 KeGetRecommendedSharedDataAlignment@0
550 KeI386AllocateGdtSelectors@8
551 ;KeI386Call16BitCStyleFunction
552 ;KeI386Call16BitFunction
553 KeI386FlatToGdtSelector@12
555 ;KeI386MachineType DATA
556 KeI386ReleaseGdtSelectors@8
558 ;KeI386SetGdtSelector
559 KeIcacheFlushCount DATA
561 KeInitializeDeviceQueue@4
564 @KeInitializeGuardedMutex@4
565 KeInitializeInterrupt@44
569 KeInitializeSemaphore@12
570 KeInitializeSpinLock@4
572 KeInitializeTimerEx@8
573 KeInsertByKeyDeviceQueue@12
574 KeInsertDeviceQueue@8
579 KeIsAttachedProcess@0
581 KeLeaveCriticalRegion@0
582 KeLeaveGuardedRegion@0
584 KeNumberProcessors DATA
586 KeProfileInterruptWithSource@8
588 KeQueryActiveProcessors@0
589 KeQueryInterruptTime@0
590 KeQueryPriorityThread@4
591 KeQueryRuntimeThread@8
594 KeQueryTimeIncrement@0
595 KeRaiseUserException@4
598 KeReadStateMutex@4=KeReadStateMutant@4
600 KeReadStateSemaphore@4
602 KeRegisterBugCheckCallback@20
603 KeRegisterBugCheckReasonCallback@16
604 @KeReleaseGuardedMutexUnsafe@4
605 @KeReleaseGuardedMutex@4
606 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
607 KeReleaseInterruptSpinLock@8
610 KeReleaseSemaphore@16
611 KeReleaseSpinLockFromDpcLevel@4
612 KeRemoveByKeyDeviceQueue@8
613 KeRemoveByKeyDeviceQueueIfBusy@8
614 KeRemoveDeviceQueue@4
615 KeRemoveEntryDeviceQueue@8
618 KeRemoveSystemServiceTable@4
620 KeRestoreFloatingPointState@4
621 KeRevertToUserAffinityThread@0
623 KeSaveFloatingPointState@4
624 KeSaveStateForHibernate
625 KeServiceDescriptorTable DATA
626 KeSetAffinityThread@8
627 KeSetBasePriorityThread@8
628 KeSetDmaIoCoherency@4
630 KeSetEventBoostPriority@8
631 KeSetIdealProcessorThread@8
633 KeSetKernelStackSwapEnable@4
634 KeSetPriorityThread@8
636 KeSetSystemAffinityThread@4
637 ;KeSetSwapContextNotifyRoutine
638 KeSetTargetProcessorDpc@8
639 ;KeSetThreadSelectNotifyRoutine
643 @KeSetTimeUpdateNotifyRoutine@4
644 KeStackAttachProcess@8
645 KeSynchronizeExecution@12
648 @KeTryToAcquireGuardedMutex@4
651 KeUnstackDetachProcess@4
652 KeUserModeCallback@20
653 KeWaitForMultipleObjects@32
654 KeWaitForMutexObject@20=KeWaitForSingleObject@20
655 KeWaitForSingleObject@20
656 @KefAcquireSpinLockAtDpcLevel@4
657 @KefReleaseSpinLockFromDpcLevel@4
662 KiCheckForKernelApcDelivery@0
664 KiDispatchInterrupt@0
665 KiEnableTimerWatchdog
666 KiInterruptDispatch2@8
667 KiIpiServiceRoutine@8
669 KiUnexpectedInterrupt@0
670 ;Kii386SpinOnSpinLock
674 LdrFindResourceDirectory_U@16
676 LpcPortObjectType DATA
678 LpcRequestWaitReplyPort@12
679 LsaCallAuthenticationPackage@28
680 LsaDeregisterLogonProcess@8
681 LsaFreeReturnBuffer@4
683 LsaLookupAuthenticationPackage@12
684 LsaRegisterLogonProcess@12
685 Mm64BitPhysicalAddress DATA
686 MmAddPhysicalMemory@8
687 MmAddVerifierThunks@8
688 MmAdjustWorkingSetSize@12
690 MmAllocateContiguousMemory@12
691 MmAllocateContiguousMemorySpecifyCache@32
692 MmAllocateMappingAddress@8
693 MmAllocateNonCachedMemory@4
694 MmAllocatePagesForMdl@28
695 MmBuildMdlForNonPagedPool@4
696 MmCanFileBeTruncated@8
699 MmDbgTranslatePhysicalAddress@8
700 MmDisableModifiedWriteOfSection@4
701 MmFlushImageSection@8
702 MmForceSectionClosed@8
703 MmFreeContiguousMemory@4
704 MmFreeContiguousMemorySpecifyCache@12
705 MmFreeMappingAddress@8
706 MmFreeNonCachedMemory@8
708 MmGetPhysicalAddress@4
709 MmGetPhysicalMemoryRanges@0
710 MmGetSystemRoutineAddress@4
711 MmGetVirtualForPhysical@8
713 MmHighestUserAddress DATA
715 MmIsDriverVerifying@4
716 MmIsNonPagedSystemAddressValid@4
717 MmIsRecursiveIoFault@0
718 MmIsThisAnNtAsSystem@0
719 MmIsVerifierEnabled@4
720 MmLockPagableDataSection@4
721 MmLockPagableImageSection@4=MmLockPagableDataSection@4
722 MmLockPagableSectionByHandle@4
725 MmMapLockedPagesSpecifyCache@24
726 MmMapLockedPagesWithReservedMapping@16
728 MmMapUserAddressesToPage@12
730 MmMapViewInSessionSpace@12
731 MmMapViewInSystemSpace@12
732 MmMapViewOfSection@40
733 MmMarkPhysicalMemoryAsBad@8
734 MmMarkPhysicalMemoryAsGood@8
737 MmProbeAndLockPages@12
738 MmProbeAndLockProcessPages@16
739 MmProbeAndLockSelectedPages@16
740 MmProtectMdlSystemAddress@8
742 MmRemovePhysicalMemory@8
743 MmResetDriverPaging@4
744 MmSectionObjectType DATA
745 MmSecureVirtualMemory@12
746 MmSetAddressRangeModified@8
747 MmSetBankedSection@24
749 MmSystemRangeStart DATA
750 MmTrimAllSystemPagableMemory@4
751 MmUnlockPagableImageSection@4
755 MmUnmapReservedMapping@12
756 MmUnmapVideoDisplay@8
757 MmUnmapViewInSessionSpace@4
758 MmUnmapViewInSystemSpace@4
759 MmUnmapViewOfSection@8
760 MmUnsecureVirtualMemory@4
761 MmUserProbeAddress DATA
764 NlsMbCodePageTag DATA
765 NlsMbOemCodePageTag DATA
767 NlsOemLeadByteInfo DATA
769 NtAdjustPrivilegesToken@24
771 NtAllocateLocallyUniqueId@4
773 NtAllocateVirtualMemory@24
784 NtDeviceIoControlFile@40
788 NtFreeVirtualMemory@16
792 NtMakePermanentObject@4
793 NtMapViewOfSection@40
794 NtNotifyChangeDirectoryFile@36
797 NtOpenProcessToken@12
798 NtOpenProcessTokenEx@16
801 NtOpenThreadTokenEx@20
802 NtQueryDirectoryFile@44
804 NtQueryInformationAtom@20
805 NtQueryInformationFile@20
806 NtQueryInformationProcess@20
807 NtQueryInformationThread@20
808 NtQueryInformationToken@20
809 NtQueryQuotaInformationFile@36
810 NtQuerySecurityObject@20
811 NtQuerySystemInformation@16
813 NtQueryVolumeInformationFile@20
816 NtRequestWaitReplyPort@12
819 NtSetInformationFile@20
820 NtSetInformationProcess@16
821 NtSetInformationThread@16
822 NtSetQuotaInformationFile@16
823 NtSetSecurityObject@12
824 NtSetVolumeInformationFile@20
831 NtWaitForSingleObject@12
837 ;ObCheckCreateObjectAccess@28
838 ;ObCheckObjectAccess@20
841 ObCreateObjectType@16
842 ObDereferenceObject@4
843 ObDereferenceSecurityDescriptor@8
844 @ObfDereferenceObject@4
845 ObFindHandleForObject@20
846 @ObfReferenceObject@4
847 ObGetObjectSecurity@12
849 ObLogSecurityDescriptor@12
850 ObMakeTemporaryObject@4
851 ObOpenObjectByName@28
852 ObOpenObjectByPointer@28
854 ObQueryObjectAuditingByHandle@8
855 ObReferenceObjectByHandle@24
856 ObReferenceObjectByName@32
857 ObReferenceObjectByPointer@16
858 ;ObReferenceSecurityDescriptor@8
859 ObReleaseObjectSecurity@8
860 ;ObSetHandleAttributes@12
861 ;ObSetSecurityDescriptorInfo@24
862 ;ObSetSecurityObjectByPointer@12
872 PoQueueShutdownWorkItem@4
873 PoRegisterDeviceForIdleDetection@16
874 PoRegisterSystemState@8
879 PoStartNextPowerIrp@4
880 PoUnregisterSystemState@4
883 PsAssignImpersonationToken@8
885 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
886 PsChargeProcessPagedPoolQuota@8
887 PsChargeProcessPoolQuota@12
888 PsCreateSystemProcess@12
889 PsCreateSystemThread@28
890 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
891 PsDereferencePrimaryToken@4
892 PsDisableImpersonation@8
893 PsEstablishWin32Callouts@4
894 PsGetCurrentProcess@0=KeGetCurrentProcess@0
895 PsGetCurrentProcessId@0
896 PsGetCurrentProcessSessionId@0
897 PsGetCurrentThread@0=KeGetCurrentThread@0
898 PsGetCurrentThreadId@0
899 PsGetCurrentThreadPreviousMode@0
900 PsGetCurrentThreadStackBase@0
901 PsGetCurrentThreadStackLimit@0
904 PsGetJobUIRestrictionsClass@4
905 PsGetProcessCreateTimeQuadPart@4
906 PsGetProcessDebugPort@4
907 PsGetProcessExitProcessCalled@4
908 PsGetProcessExitStatus@4
909 PsGetProcessExitTime@0
911 PsGetProcessImageFileName@4
912 PsGetProcessInheritedFromUniqueProcessId@4
915 PsGetProcessPriorityClass@4
916 PsGetProcessSectionBaseAddress@4
917 PsGetProcessSecurityPort@4
918 PsGetProcessSessionId@4
919 PsGetProcessWin32Process@4
920 PsGetProcessWin32WindowStation@4
921 PsGetThreadFreezeCount@4
922 PsGetThreadHardErrorsAreDisabled@4
925 PsGetThreadProcessId@4
926 PsGetThreadSessionId@4
928 PsGetThreadWin32Thread@4
932 PsImpersonateClient@20
933 PsInitialSystemProcess DATA
934 PsIsProcessBeingDebugged@4
936 PsIsThreadImpersonating@4
937 PsIsThreadTerminating@4
939 PsLookupProcessByProcessId@8
940 PsLookupProcessThreadByCid@12
941 PsLookupThreadByThreadId@8
943 PsReferenceImpersonationToken@16
944 PsReferencePrimaryToken@4
945 PsRemoveCreateThreadNotifyRoutine@4
946 PsRemoveLoadImageNotifyRoutine@4
947 PsRestoreImpersonation@8
949 PsReturnProcessNonPagedPoolQuota@8
950 PsReturnProcessPagedPoolQuota@8
952 PsRevertThreadToSelf@4
953 PsSetCreateProcessNotifyRoutine@8
954 PsSetCreateThreadNotifyRoutine@4
955 PsSetJobUIRestrictionsClass@8
956 PsSetLegoNotifyRoutine@4
957 PsSetProcessPriorityClass@8
958 PsSetProcessPriorityByClass@8
959 PsSetProcessSecurityPort@8
960 PsSetProcessWin32Process@8
961 PsSetProcessWindowStation@8
962 PsSetThreadHardErrorsAreDisabled@8
963 PsSetThreadWin32Thread@8
964 PsSetLoadImageNotifyRoutine@4
965 PsTerminateSystemThread@4
967 READ_REGISTER_UCHAR@4
968 READ_REGISTER_ULONG@4
969 READ_REGISTER_USHORT@4
970 READ_REGISTER_BUFFER_UCHAR@12
971 READ_REGISTER_BUFFER_ULONG@12
972 READ_REGISTER_BUFFER_USHORT@12
974 KeRosDumpStackFrames@8
975 KeRosGetStackFrames@8
976 RtlAbsoluteToSelfRelativeSD@12
977 RtlAddAccessAllowedAce@16
979 RtlAddAtomToAtomTable@12
981 ;RtlAllocateAndInitializeSid
983 RtlAnsiCharToUnicodeChar@4
984 RtlAnsiStringToUnicodeSize@4=RtlxAnsiStringToUnicodeSize@4
985 RtlAnsiStringToUnicodeString@12
986 RtlAppendAsciizToString@8
987 RtlAppendStringToString@8
988 RtlAppendUnicodeStringToString@8
989 RtlAppendUnicodeToString@8
990 RtlAreAllAccessesGranted@8
991 RtlAreAnyAccessesGranted@8
996 RtlCaptureStackBackTrace@16
998 RtlCheckRegistryKey@8
1003 RtlCompareMemoryUlong@12
1005 RtlCompareUnicodeString@12
1006 RtlCompressBuffer@32
1007 RtlCompressChunks@28
1008 RtlConvertLongToLargeInteger@4
1009 RtlConvertSidToUnicodeString@12
1010 RtlConvertUlongToLargeInteger@4
1015 RtlCopyUnicodeString@8
1017 RtlCreateAtomTable@8
1019 RtlCreateRegistryKey@8
1020 RtlCreateSecurityDescriptor@8
1021 RtlCreateSystemVolumeInformationFolder@4
1022 RtlCreateUnicodeString@8
1023 RtlCustomCPToUnicodeN@24
1024 RtlDecompressBuffer@24
1025 RtlDecompressChunks@28
1026 RtlDecompressFragment@32
1029 RtlDeleteAtomFromAtomTable@8
1030 RtlDeleteElementGenericTable@8
1031 RtlDeleteElementGenericTableAvl@8
1033 RtlDeleteOwnersRanges@8
1035 RtlDeleteRegistryValue@12
1037 RtlDestroyAtomTable@4
1039 RtlDowncaseUnicodeString@12
1040 RtlDuplicateUnicodeString@12
1042 RtlEnlargedIntegerMultiply@8
1043 RtlEnlargedUnsignedDivide@16
1044 RtlEnlargedUnsignedMultiply@8
1045 RtlEnumerateGenericTable@8
1046 RtlEnumerateGenericTableAvl@8
1047 RtlEnumerateGenericTableLikeADirectory@28
1048 RtlEnumerateGenericTableWithoutSplaying@8
1049 RtlEnumerateGenericTableWithoutSplayingAvl@8
1053 RtlEqualUnicodeString@12
1054 RtlExtendedIntegerMultiply@12
1055 RtlExtendedLargeIntegerDivide@16
1056 RtlExtendedMagicDivide@20
1058 RtlFillMemoryUlong@12
1060 RtlFindClearBitsAndSet@12
1062 RtlFindFirstRunClear@8
1063 RtlFindFirstRunSet@8
1064 RtlFindLastBackwardRunClear@12
1065 RtlFindLeastSignificantBit@8
1066 RtlFindLongestRunClear@8
1067 RtlFindLongestRunSet@8
1069 RtlFindMostSignificantBit@8
1070 RtlFindNextForwardRunClear@12
1073 RtlFindSetBitsAndClear@12
1074 RtlFindUnicodePrefix@12
1075 RtlFormatCurrentUserKeyPath@4
1080 RtlFreeUnicodeString@4
1082 RtlGenerate8dot3Name@16
1084 RtlGetCallersAddress@8
1085 RtlGetCompressionWorkSpaceSize@12
1086 RtlGetDaclSecurityDescriptor@16
1087 RtlGetDefaultCodePage@8
1088 RtlGetElementGenericTable@8
1089 RtlGetElementGenericTableAvl@8
1091 RtlGetGroupSecurityDescriptor@12
1093 RtlGetNtGlobalFlags@0
1094 RtlGetOwnerSecurityDescriptor@12
1095 RtlGetSaclSecurityDescriptor@16
1096 RtlGetSetBootStatusData@24
1098 RtlHashUnicodeString@16
1100 RtlImageDirectoryEntryToData@16
1102 RtlInitCodePageTable@8
1104 RtlInitUnicodeString@8
1105 RtlInitializeBitMap@12
1106 RtlInitializeGenericTable@20
1107 RtlInitializeGenericTableAvl@20
1108 RtlInitializeRangeList@4
1110 RtlInitializeUnicodePrefix@4
1111 RtlInsertElementGenericTable@16
1112 RtlInsertElementGenericTableAvl@16
1113 RtlInsertElementGenericTableFull@24
1114 RtlInsertElementGenericTableFullAvl@24
1115 RtlInsertUnicodePrefix@12
1116 RtlInt64ToUnicodeString@16
1118 RtlIntegerToUnicode@16
1119 RtlIntegerToUnicodeString@12
1120 RtlInvertRangeList@8
1121 RtlIpv4AddressToStringA@8
1122 RtlIpv4AddressToStringExA@16
1123 RtlIpv4AddressToStringExW@16
1124 RtlIpv4AddressToStringW@8
1125 RtlIpv4StringToAddressA@16
1126 RtlIpv4StringToAddressExA@16
1127 RtlIpv4StringToAddressExW@16
1128 RtlIpv4StringToAddressW@16
1129 RtlIpv6AddressToStringA@8
1130 RtlIpv6AddressToStringExA@20
1131 RtlIpv6AddressToStringExW@20
1132 RtlIpv6AddressToStringW@8
1133 RtlIpv6StringToAddressA@12
1134 RtlIpv6StringToAddressExA@16
1135 RtlIpv6StringToAddressExW@16
1136 RtlIpv6StringToAddressW@12
1137 RtlIsGenericTableEmpty@4
1138 RtlIsGenericTableEmptyAvl@4
1139 RtlIsNameLegalDOS8Dot3@12
1140 RtlIsRangeAvailable@40
1141 RtlIsValidOemCharacter@4
1142 RtlLargeIntegerAdd@16
1143 RtlLargeIntegerArithmeticShift@12
1144 RtlLargeIntegerDivide@20
1145 RtlLargeIntegerNegate@8
1146 RtlLargeIntegerShiftLeft@12
1147 RtlLargeIntegerShiftRight@12
1148 RtlLargeIntegerSubtract@16
1149 RtlLengthRequiredSid@4
1150 RtlLengthSecurityDescriptor@4
1152 RtlLockBootStatusData@4
1153 RtlLookupAtomInAtomTable@12
1154 RtlLookupElementGenericTable@8
1155 RtlLookupElementGenericTableAvl@8
1156 RtlLookupElementGenericTableFull@16
1157 RtlLookupElementGenericTableFullAvl@16
1159 RtlMapSecurityErrorToNtStatus@4
1160 RtlMergeRangeLists@16
1162 RtlMultiByteToUnicodeN@20
1163 RtlMultiByteToUnicodeSize@12
1164 RtlNextUnicodePrefix@8
1165 RtlNtStatusToDosError@4
1166 RtlNtStatusToDosErrorNoTeb@4
1167 RtlNumberGenericTableElements@4
1168 RtlNumberGenericTableElementsAvl@4
1169 RtlNumberOfClearBits@4
1170 RtlNumberOfSetBits@4
1171 RtlOemStringToCountedUnicodeString@12
1172 RtlOemStringToUnicodeSize@4=RtlxOemStringToUnicodeSize@4
1173 RtlOemStringToUnicodeString@12
1175 RtlPinAtomInAtomTable@8
1176 @RtlPrefetchMemoryNonTemporal@8
1178 RtlPrefixUnicodeString@12
1179 RtlQueryAtomInAtomTable@24
1180 RtlQueryRegistryValues@20
1181 RtlQueryTimeZoneInformation@4
1185 RtlRealPredecessor@4
1187 RtlRemoveUnicodePrefix@8
1189 RtlSecondsSince1970ToTime@8
1190 RtlSecondsSince1980ToTime@8
1191 RtlSelfRelativeToAbsoluteSD2@8
1192 RtlSelfRelativeToAbsoluteSD@44
1196 RtlSetDaclSecurityDescriptor@16
1197 RtlSetGroupSecurityDescriptor@12
1198 RtlSetOwnerSecurityDescriptor@12
1199 RtlSetSaclSecurityDescriptor@16
1200 RtlSetTimeZoneInformation@4
1204 RtlSubAuthorityCountSid@4
1205 RtlSubAuthoritySid@8
1206 RtlSubtreePredecessor@4
1207 RtlSubtreeSuccessor@4
1209 RtlTimeFieldsToTime@8
1210 RtlTimeToElapsedTimeFields@8
1211 RtlTimeToSecondsSince1970@8
1212 RtlTimeToSecondsSince1980@8
1213 RtlTimeToTimeFields@8
1215 @RtlUlonglongByteSwap@8
1216 RtlUnicodeStringToAnsiSize@4=RtlxUnicodeStringToAnsiSize@4
1217 RtlUnicodeStringToAnsiString@12
1218 RtlUnicodeStringToCountedOemString@12
1219 RtlUnicodeStringToInteger@12
1220 RtlUnicodeStringToOemSize@4=RtlxUnicodeStringToOemSize@4
1221 RtlUnicodeStringToOemString@12
1222 RtlUnicodeToCustomCPN@24
1223 RtlUnicodeToMultiByteN@20
1224 RtlUnicodeToMultiByteSize@12
1226 RtlUnlockBootStatusData@4
1228 RtlUpcaseUnicodeChar@4
1229 RtlUpcaseUnicodeString@12
1230 RtlUpcaseUnicodeStringToAnsiString@12
1231 RtlUpcaseUnicodeStringToCountedOemString@12
1232 RtlUpcaseUnicodeStringToOemString@12
1233 RtlUpcaseUnicodeToCustomCPN@24
1234 RtlUpcaseUnicodeToMultiByteN@20
1235 RtlUpcaseUnicodeToOemN@20
1238 @RtlUshortByteSwap@4
1239 RtlValidRelativeSecurityDescriptor@12
1240 RtlValidSecurityDescriptor@4
1242 RtlVerifyVersionInfo@16
1243 RtlVolumeDeviceToDosName@8
1244 RtlWalkFrameChain@12
1245 RtlWriteRegistryValue@24
1248 RtlxAnsiStringToUnicodeSize@4
1249 RtlxOemStringToUnicodeSize@4
1250 RtlxUnicodeStringToAnsiSize@4
1251 RtlxUnicodeStringToOemSize@4
1253 SeAppendPrivileges@8
1255 SeAssignSecurityEx@36
1256 SeAuditHardLinkCreation@12
1257 SeAuditingFileEvents@8
1258 SeAuditingFileEventsWithContext@12
1259 SeAuditingFileOrGlobalEvents@12
1260 SeAuditingHardLinkEvents@8
1261 SeAuditingHardLinkEventsWithContext@12
1262 SeCaptureSecurityDescriptor@20
1263 SeCaptureSubjectContext@4
1264 SeCloseObjectAuditAlarm@12
1265 SeCreateAccessState@16
1266 SeCreateClientSecurity@16
1267 SeCreateClientSecurityFromSubjectContext@16
1268 SeDeassignSecurity@4
1269 SeDeleteAccessState@4
1270 SeDeleteObjectAuditAlarm@8
1274 SeImpersonateClient@8
1275 SeImpersonateClientEx@8
1276 SeLockSubjectContext@4
1277 SeMarkLogonSessionForTerminationNotification@4
1278 SeOpenObjectAuditAlarm@36
1279 SeOpenObjectForDeleteAuditAlarm@36
1281 SePrivilegeObjectAuditAlarm@24
1282 SePublicDefaultDacl DATA
1283 SeQueryAuthenticationIdToken@8
1284 SeQueryInformationToken@12
1285 SeQuerySecurityDescriptorInfo@16
1286 SeQuerySessionIdToken@8
1287 SeRegisterLogonSessionTerminatedRoutine@4
1288 SeReleaseSecurityDescriptor@12
1289 SeReleaseSubjectContext@4
1290 SeSetAccessStateGenericMapping@8
1291 SeSetSecurityDescriptorInfo@24
1292 SeSetSecurityDescriptorInfoEx@28
1293 SeSinglePrivilegeCheck@12
1294 SeSystemDefaultDacl DATA
1295 SeTokenImpersonationLevel@4
1297 SeTokenIsRestricted@4
1298 SeTokenIsWriteRestricted@4
1300 SeUnlockSubjectContext@4
1301 SeUnregisterLogonSessionTerminatedRoutine@4
1302 SeValidSecurityDescriptor@8
1303 VerSetConditionMask@16
1304 WRITE_REGISTER_UCHAR@8
1305 WRITE_REGISTER_ULONG@8
1306 WRITE_REGISTER_USHORT@8
1307 WRITE_REGISTER_BUFFER_UCHAR@12
1308 WRITE_REGISTER_BUFFER_ULONG@12
1309 WRITE_REGISTER_BUFFER_USHORT@12
1310 ZwAccessCheckAndAuditAlarm@44
1312 ZwAdjustPrivilegesToken@24
1314 ZwAllocateVirtualMemory@24
1315 ZwAssignProcessToJobObject@8
1320 ZwCloseObjectAuditAlarm@12
1322 ZwCreateDirectoryObject@12
1325 ZwCreateJobObject@12
1328 ZwCreateSymbolicLinkObject@16
1334 ZwDeviceIoControlFile@40
1336 ZwDuplicateObject@28
1338 ZwEnumerateBootEntries@8
1340 ZwEnumerateValueKey@24
1341 ZwFlushInstructionCache@12
1343 ZwFlushVirtualMemory@16
1344 ZwFreeVirtualMemory@16
1346 ZwInitiatePowerAction@16
1350 ZwMakeTemporaryObject@4
1351 ZwMapViewOfSection@40
1352 ZwNotifyChangeKey@40
1353 ZwOpenDirectoryObject@12
1359 ZwOpenProcessToken@12
1360 ZwOpenProcessTokenEx@16
1362 ZwOpenSymbolicLinkObject@12
1364 ZwOpenThreadToken@16
1365 ZwOpenThreadTokenEx@20
1367 ZwPowerInformation@20
1369 ZwQueryBootEntryOrder@8
1370 ZwQueryBootOptions@8
1371 ZwQueryDefaultLocale@8
1372 ZwQueryDefaultUILanguage@4
1373 ZwQueryDirectoryFile@44
1374 ZwQueryDirectoryObject@28
1376 ZwQueryFullAttributesFile@8
1377 ZwQueryInformationAtom@20
1378 ZwQueryInformationFile@20
1379 ZwQueryInformationJobObject@20
1380 ZwQueryInformationProcess@20
1381 ZwQueryInformationThread@20
1382 ZwQueryInformationToken@20
1383 ZwQueryInstallUILanguage@4
1387 ZwQuerySecurityObject@20
1388 ZwQuerySymbolicLinkObject@12
1389 ZwQuerySystemInformation@16
1392 ZwQueryVolumeInformationFile@20
1395 ZwRequestWaitReplyPort@12
1400 ZwSetBootEntryOrder@8
1402 ZwSetDefaultLocale@8
1403 ZwSetDefaultUILanguage@4
1406 ZwSetInformationFile@20
1407 ZwSetInformationJobObject@16
1408 ZwSetInformationObject@16
1409 ZwSetInformationProcess@16
1410 ZwSetInformationThread@16
1411 ZwSetSecurityObject@12
1412 ZwSetSystemInformation@12
1416 ZwSetVolumeInformationFile@20
1417 ZwTerminateJobObject@8
1418 ZwTerminateProcess@8
1419 ZwTranslateFilePath@12
1422 ZwUnmapViewOfSection@8
1423 ZwWaitForMultipleObjects@20
1424 ZwWaitForSingleObject@12
1427 _abnormal_termination