3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
18 CcGetFileObjectFromBcb@4
19 CcGetFileObjectFromSectionPtrs@4
20 CcGetFlushedValidData@8
21 CcGetLsnForFileObject@8
22 CcInitializeCacheMap@20
24 CcFastMdlReadWait DATA
25 CcFastReadNotPossible DATA
36 CcPurgeCacheSection@16
39 CcScheduleReadAhead@12
40 CcSetAdditionalCacheAttributes@12
41 CcSetBcbOwnerPointer@8
42 CcSetDirtyPageThreshold@8
43 CcSetDirtyPinnedData@8
44 CcSetLogHandleForFile@12
45 CcSetReadAheadGranularity@8
46 CcUninitializeCacheMap@12
48 CcUnpinDataForThread@8
50 CcWaitForCurrentLazyWriterActivity@0
55 CmUnRegisterCallback@8
57 DbgBreakPointWithStatus@4
58 DbgLoadImageSymbols@12
62 DbgPrintReturnControlC
63 DbgQueryDebugFilterState@8
64 DbgSetDebugFilterState@12
65 @ExAcquireFastMutexUnsafe@4
66 ExAcquireResourceExclusive@8
67 ExAcquireResourceExclusiveLite@8
68 ExAcquireResourceSharedLite@8
69 @ExAcquireRundownProtection@4
70 @ExAcquireRundownProtectionEx@8
71 ExAcquireSharedStarveExclusive@8
72 ExAcquireSharedWaitForExclusive@8
73 @ExAllocateFromPagedLookasideList@4=@ExiAllocateFromPagedLookasideList@4
75 ExAllocatePoolWithQuota@8
76 ExAllocatePoolWithQuotaTag@12
77 ExAllocatePoolWithTag@12
78 ExAllocatePoolWithTagPriority@16
79 ExConvertExclusiveToSharedLite@4
81 ExDeleteNPagedLookasideList@4
82 ExDeletePagedLookasideList@4
84 ExDeleteResourceLite@4
85 ExDesktopObjectType DATA
86 ExDisableResourceBoostLite@4
88 ExEventObjectType DATA
92 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
93 ExGetCurrentProcessorCounts@12
94 ExGetCurrentProcessorCpuUsage@4
95 ExGetExclusiveWaiterCount@4
97 ExGetSharedWaiterCount@4
98 @ExInitializeRundownProtection@4
99 ExInitializeNPagedLookasideList@28
100 ExInitializePagedLookasideList@28
101 ExInitializeResource@4
102 ExInitializeResourceLite@4
104 ExInterlockedAddLargeInteger@16
105 @ExInterlockedAddLargeStatistic@8
106 ExInterlockedAddUlong@12
107 @ExInterlockedCompareExchange64@16
108 ExInterlockedDecrementLong@8
109 ExInterlockedExchangeUlong@12
110 ExInterlockedExtendZone@16
111 ExInterlockedIncrementLong@8
112 @ExInterlockedFlushSList@4
113 ExInterlockedInsertHeadList@12
114 ExInterlockedInsertTailList@12
115 ExInterlockedPopEntryList@8
116 @ExInterlockedPopEntrySList@8
117 ExInterlockedPushEntryList@12
118 @ExInterlockedPushEntrySList@12
119 ExInterlockedRemoveHeadList@8
120 ExIsProcessorFeaturePresent@4
121 ExIsResourceAcquiredExclusiveLite@4
122 ExIsResourceAcquiredSharedLite@4
123 ExLocalTimeToSystemTime@8
125 ExQueryPoolBlockSize@8
127 ExRaiseAccessViolation@0
128 ExRaiseDatatypeMisalignment@0
132 ExRegisterCallback@12
133 ExReinitializeResourceLite@4
134 @ExReInitializeRundownProtection@4
135 @ExReleaseFastMutexUnsafe@4
136 ExReleaseResourceForThread@8
137 ExReleaseResourceForThreadLite@8
138 @ExReleaseResourceLite@4
139 @ExReleaseRundownProtection@4
140 @ExReleaseRundownProtectionEx@8
141 ExRosDumpPagedPoolByTag@4
143 @ExRundownCompleted@4
144 ExSemaphoreObjectType DATA
145 ExSetResourceOwnerPointer@8
146 ExSetTimerResolution@8
147 ExSystemExceptionFilter@0
148 ExSystemTimeToLocalTime@8
149 ExTryToAcquireResourceExclusiveLite@4
150 ExUnregisterCallback@4
153 @ExWaitForRundownProtectionRelease@4
154 ExWindowStationObjectType DATA
155 @ExfAcquirePushLockExclusive@4
156 @ExfAcquirePushLockShared@4
157 @ExfReleasePushLock@4
158 @ExfInterlockedAddUlong@12
159 @ExfInterlockedInsertHeadList@12
160 @ExfInterlockedInsertTailList@12
161 @ExfInterlockedCompareExchange64@12
162 @ExfInterlockedPopEntryList@8
163 @ExfInterlockedPushEntryList@12
164 @ExfInterlockedRemoveHeadList@8
165 @Exfi386InterlockedDecrementLong@4
166 @Exfi386InterlockedExchangeUlong@8
167 @Exfi386InterlockedIncrementLong@4
168 Exi386InterlockedDecrementLong@4
169 Exi386InterlockedExchangeUlong@8
170 Exi386InterlockedIncrementLong@4
171 FsRtlAcquireFileExclusive@4
172 FsRtlAddLargeMcbEntry@28
174 FsRtlAddToTunnelCache@32
175 FsRtlAllocateFileLock@8
177 FsRtlAllocatePoolWithQuota@8
178 FsRtlAllocatePoolWithQuotaTag@12
179 FsRtlAllocatePoolWithTag@12
180 FsRtlAllocateResource@0
181 FsRtlAreNamesEqual@16
183 FsRtlCheckLockForReadAccess@8
184 FsRtlCheckLockForWriteAccess@8
188 FsRtlCurrentBatchOplock@4
189 FsRtlDeleteKeyFromTunnelCache@12
190 FsRtlDeleteTunnelCache@4
191 FsRtlDeregisterUncProvider@4
194 FsRtlDoesDbcsContainWildCards@4
195 FsRtlDoesNameContainWildCards@4
196 FsRtlFastCheckLockForRead@24
197 FsRtlFastCheckLockForWrite@24
198 FsRtlFastUnlockAll@16
199 FsRtlFastUnlockAllByKey@20
200 FsRtlFastUnlockSingle@32
201 FsRtlFindInTunnelCache@32
204 FsRtlGetNextFileLock@8
205 FsRtlGetNextLargeMcbEntry@20
206 FsRtlGetNextMcbEntry@20
207 FsRtlIncrementCcFastReadNotPossible@0
208 FsRtlIncrementCcFastReadNoWait@0
209 FsRtlIncrementCcFastReadResourceMiss@0
210 FsRtlIncrementCcFastReadWait@0
211 FsRtlInitializeFileLock@12
212 FsRtlInitializeLargeMcb@8
214 FsRtlInitializeOplock@4
215 FsRtlInitializeTunnelCache@4
216 FsRtlInsertPerFileObjectContext@8
217 FsRtlInsertPerStreamContext@8
218 FsRtlIsDbcsInExpression@8
219 FsRtlIsFatDbcsLegal@20
220 FsRtlIsHpfsDbcsLegal@20
221 FsRtlIsNameInExpression@16
222 FsRtlIsNtstatusExpected@4
224 FsRtlIsTotalDeviceFailure@4
225 FsRtlLegalAnsiCharacterArray DATA
226 FsRtlLookupLargeMcbEntry@32
227 FsRtlLookupLastLargeMcbEntry@12
228 FsRtlLookupLastLargeMcbEntryAndIndex@16
229 FsRtlLookupLastMcbEntry@12
230 FsRtlLookupMcbEntry@20
231 FsRtlLookupPerFileObjectContext@12
232 FsRtlLookupPerStreamContextInternal@12
234 FsRtlMdlReadComplete@8
235 FsRtlMdlReadCompleteDev@12
237 FsRtlMdlWriteComplete@12
238 FsRtlMdlWriteCompleteDev@16
239 FsRtlNormalizeNtstatus@8
240 FsRtlNotifyChangeDirectory@28
241 FsRtlNotifyCleanup@12
242 FsRtlNotifyFilterChangeDirectory@44
243 FsRtlNotifyFilterReportChange@40
244 FsRtlNotifyFullChangeDirectory@40
245 FsRtlNotifyFullReportChange@36
246 FsRtlNotifyInitializeSync@4
247 FsRtlNotifyReportChange@20
248 FsRtlNotifyUninitializeSync@4
249 FsRtlNotifyVolumeEvent@8
250 FsRtlNumberOfRunsInLargeMcb@4
251 FsRtlNumberOfRunsInMcb@4
253 FsRtlOplockIsFastIoPossible@4
254 FsRtlPostPagingFileStackOverflow@12
255 FsRtlPostStackOverflow@12
256 FsRtlPrepareMdlWrite@24
257 FsRtlPrepareMdlWriteDev@28
259 FsRtlProcessFileLock@12
260 FsRtlRegisterUncProvider@12
262 FsRtlRemoveLargeMcbEntry@20
263 FsRtlRemoveMcbEntry@12
264 FsRtlRemovePerFileObjectContext@12
265 FsRtlRemovePerStreamContext@12
267 FsRtlSplitLargeMcb@20
269 FsRtlTeardownPerStreamContexts@4
270 FsRtlTruncateLargeMcb@12
272 FsRtlUninitializeFileLock@4
273 FsRtlUninitializeLargeMcb@4
274 FsRtlUninitializeMcb@4
275 FsRtlUninitializeOplock@4
276 HalDispatchTable DATA
277 HalPrivateDispatchTable DATA
278 @HalExamineMBR=@xHalExamineMBR@16
279 InbvAcquireDisplayOwnership@0
280 InbvCheckDisplayOwnership@0
282 InbvEnableBootDriver@4
283 InbvEnableDisplayString@4
284 InbvInstallDisplayStringFilter@4
285 InbvIsBootDriverInstalled@0
286 InbvNotifyDisplayOwnershipLost@4
288 InbvSetScrollRegion@16
290 InbvSolidColorFill@20
291 InitSafeBootMode DATA
292 @InterlockedCompareExchange@12
293 @InterlockedDecrement@4
294 @InterlockedExchange@8
295 @InterlockedExchangeAdd@8
296 @InterlockedIncrement@4
297 @InterlockedPushEntrySList@8
298 @InterlockedPopEntrySList@4
299 IoAcquireCancelSpinLock@4
300 IoAcquireRemoveLockEx@20
301 IoAcquireVpbSpinLock@4
302 IoAdapterObjectType DATA
303 IoAllocateAdapterChannel@20
306 IoAllocateController@16
307 IoAllocateDriverObjectExtension@16
308 IoAllocateErrorLogEntry@8
310 IoAssignDriveLetters@16
313 IoAttachDeviceByPointer@8
314 IoAttachDeviceToDeviceStack@8
315 IoAttachDeviceToDeviceStackSafe@12
316 IoBuildAsynchronousFsdRequest@24
317 IoBuildDeviceIoControlRequest@36
319 IoBuildSynchronousFsdRequest@28
323 IoCheckDesiredAccess@8
324 IoCheckEaBufferValidity@12
325 IoCheckFunctionAccess@24
326 IoCheckQuerySetFileInformation@12
327 IoCheckQuerySetVolumeInformation@12
328 IoCheckQuotaBufferValidity@12
329 IoCheckShareAccess@20
331 IoConnectInterrupt@44
337 IoCreateFileSpecifyDeviceObjectHint@60
338 IoCreateNotificationEvent@8
339 IoCreateStreamFileObject@8
340 IoCreateStreamFileObjectEx@12
341 IoCreateStreamFileObjectLite@8
342 IoCreateSymbolicLink@8
343 IoCreateSynchronizationEvent@8
344 IoCreateUnprotectedSymbolicLink@8
354 IoDeleteSymbolicLink@4
356 IoDeviceHandlerObjectSize DATA
357 IoDeviceHandlerObjectType DATA
358 IoDeviceObjectType DATA
359 IoDisconnectInterrupt@4
360 IoDriverObjectType DATA
362 IoEnumerateDeviceObjectList@16
363 IoFastQueryNetworkAttributes@20
364 IoFileObjectType DATA
365 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
366 IoForwardIrpSynchronously@8
368 IoFreeErrorLogEntry@4
372 IoGetAttachedDevice@4
373 IoGetAttachedDeviceReference@4
374 IoGetBaseFileSystemDeviceObject@4
375 IoGetBootDiskInformation@8
376 IoGetConfigurationInformation@0
377 IoGetCurrentProcess@0
378 IoGetDeviceObjectPointer@16
379 IoGetDeviceAttachmentBaseRef@4
380 IoGetDeviceInterfaceAlias@12
381 IoGetDeviceInterfaces@16
382 IoGetDriverObjectExtension@8
383 IoGetDeviceProperty@20
384 IoGetDeviceToVerify@4
385 IoGetDiskDeviceObject@8
387 IoGetFileObjectGenericMapping@0
389 IoGetLowerDeviceObject@4
390 IoGetRelatedDeviceObject@4
391 IoGetRequestorProcess@4
392 IoGetRequestorProcessId@4
393 IoGetRequestorSessionId@8
397 IoInvalidateDeviceRelations@8
398 IoInvalidateDeviceState@4
399 IoInitializeRemoveLockEx@20
401 IoIsFileOriginRemote@4
403 IoIsValidNameGraftingBuffer@8
404 IoIsOperationSynchronous@4
405 IoMakeAssociatedIrp@8
406 IoOpenDeviceInstanceKey@20
407 IoOpenDeviceInterfaceRegistryKey@12
408 IoOpenDeviceRegistryKey@16
410 IoPnPDeliverServicePowerNotification@16
411 IoQueryDeviceDescription@32
412 IoQueryDeviceEnumInfo@8
413 IoQueryFileDosDeviceName@8
414 IoQueryFileInformation@20
415 IoQueryVolumeInformation@20
419 IoRaiseInformationalHardError@12
420 IoReadDiskSignature@12
421 IoReadOperationCount DATA
422 @IoReadPartitionTable@16
423 IoReadPartitionTableEx@8
424 IoReadTransferCount DATA
425 IoRegisterBootDriverReinitialization@12
426 IoRegisterDeviceInterface@16
427 IoRegisterDriverReinitialization@12
428 IoRegisterFileSystem@4
429 IoRegisterFsRegistrationChange@8
430 IoRegisterLastChanceShutdownNotification@4
431 IoRegisterPlugPlayNotification@28
432 IoRegisterShutdownNotification@4
433 IoReleaseCancelSpinLock@4
434 IoReleaseRemoveLockAndWaitEx@12
435 IoReleaseRemoveLockEx@12
436 IoReleaseVpbSpinLock@4
437 IoRemoveShareAccess@8
438 IoReportDetectedDevice@32
439 IoReportHalResourceUsage@16
440 IoReportResourceUsage@36
441 IoReportResourceForDetection@28
442 IoReportTargetDeviceChange@8
443 IoReportTargetDeviceChangeAsynchronous@16
444 IoRequestDeviceEject@4
446 IoSetCompletionRoutineEx@28
447 IoSetSystemPartition@4
448 IoSetDeviceInterfaceState@8
449 IoSetDeviceToVerify@8
451 IoSetHardErrorOrVerifyDevice@8
454 @IoSetPartitionInformation@16
455 IoSetPartitionInformationEx@12
456 IoSetStartIoAttributes@12
458 IoSetThreadHardErrorMode@4
461 IoStartNextPacketByKey@12
464 IoStatisticsLock DATA
466 IoSynchronousPageWrite@20
467 IoSynchronousInvalidateDeviceRelations@8
469 IoUnregisterFileSystem@4
470 IoUnregisterFsRegistrationChange@8
471 IoUnregisterPlugPlayNotification@4
472 IoUnregisterShutdownNotification@4
473 IoUpdateShareAccess@8
474 IoValidateDeviceIoControlAccess@8
475 IoVerifyPartitionTable@8
477 IoVolumeDeviceToDosName@8
478 IoWMIAllocateInstanceIds@12
479 IoWMIDeviceObjectToInstanceName@12
480 IoWMIExecuteMethod@24
481 IoWMIHandleToInstanceName@12
484 IoWMIQueryAllDataMultiple@16
485 IoWMIQuerySingleInstance@16
486 IoWMIQuerySingleInstanceMultiple@20
487 IoWMIRegistrationControl@8
488 IoWMISetNotificationCallback@12
489 IoWMISetSingleInstance@20
490 IoWMISetSingleItem@24
491 IoWMISuggestInstanceName@16
493 IoWriteErrorLogEntry@4
494 IoWriteOperationCount DATA
495 @IoWritePartitionTable@20
496 IoWritePartitionTableEx@8
497 IoWriteTransferCount DATA
499 @IofCompleteRequest@8
500 IoIsWdmVersionAvailable@8
501 KdDebuggerEnabled DATA
502 KdDebuggerNotPresent DATA
508 KdSystemDebugControl@4
510 Ke386IoSetAccessProcess@8
511 Ke386QueryIoAccessMap@8
512 Ke386SetIoAccessMap@8
513 KeAcquireSpinLockAtDpcLevel@4
514 KeAcquireDispatcherDatabaseLockAtDpcLevel
515 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
516 KeAcquireInterruptSpinLock@4
517 KeAddSystemServiceTable@20
520 ;KeBoostCurrentThread
524 KeCapturePersistentThreadState@28
527 KeDcacheFlushCount DATA
528 KeDelayExecutionThread@12
529 KeDeregisterBugCheckCallback@4
530 KeDeregisterBugCheckReasonCallback@4
532 KeDisconnectInterrupt@4
533 KeEnterCriticalRegion@0
534 KeEnterKernelDebugger@0
535 KeFindConfigurationEntry@16
536 KeFindConfigurationNextEntry@20
541 KeGetRecommendedSharedDataAlignment@0
543 KeI386AllocateGdtSelectors
544 ;KeI386Call16BitCStyleFunction
545 ;KeI386Call16BitFunction
546 KeI386FlatToGdtSelector
548 ;KeI386MachineType DATA
549 KeI386ReleaseGdtSelectors
551 ;KeI386SetGdtSelector
552 KeIcacheFlushCount DATA
554 KeInitializeDeviceQueue@4
557 KeInitializeInterrupt@44
561 KeInitializeSemaphore@12
562 KeInitializeSpinLock@4
564 KeInitializeTimerEx@8
565 KeInsertByKeyDeviceQueue@12
566 KeInsertDeviceQueue@8
571 KeIsAttachedProcess@0
573 KeLeaveCriticalRegion@0
575 KeNumberProcessors DATA
577 KeProfileInterruptWithSource@8
579 KeQueryActiveProcessors@0
580 KeQueryInterruptTime@0
581 KeQueryPriorityThread@4
582 KeQueryRuntimeThread@8
585 KeQueryTimeIncrement@0
586 KeRaiseUserException@4
591 KeReadStateSemaphore@4
593 KeRegisterBugCheckCallback@20
594 KeRegisterBugCheckReasonCallback@16
595 KeReleaseDispatcherDatabaseLockFromDpcLevel
596 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
597 KeReleaseInterruptSpinLock@8
600 KeReleaseSemaphore@16
601 KeReleaseSpinLockFromDpcLevel@4
602 KeRemoveByKeyDeviceQueue@8
603 KeRemoveByKeyDeviceQueueIfBusy@8
604 KeRemoveDeviceQueue@4
605 KeRemoveEntryDeviceQueue@8
608 KeRemoveSystemServiceTable@4
610 KeRestoreFloatingPointState@4
611 KeRevertToUserAffinityThread@0
613 KeSaveFloatingPointState@4
614 KeSaveStateForHibernate
615 KeServiceDescriptorTable DATA
616 KeSetAffinityThread@8
617 KeSetBasePriorityThread@8
618 KeSetDmaIoCoherency@4
620 KeSetEventBoostPriority@8
621 KeSetIdealProcessorThread@8
623 KeSetKernelStackSwapEnable@4
624 KeSetPriorityThread@8
626 KeSetSystemAffinityThread@4
627 ;KeSetSwapContextNotifyRoutine
628 KeSetTargetProcessorDpc@8
629 ;KeSetThreadSelectNotifyRoutine
633 @KeSetTimeUpdateNotifyRoutine@4
634 KeStackAttachProcess@8
635 KeSynchronizeExecution@12
640 KeUnstackDetachProcess@4
641 KeUserModeCallback@20
642 KeWaitForMultipleObjects@32
643 KeWaitForMutexObject@20
644 KeWaitForSingleObject@20
645 @KefAcquireSpinLockAtDpcLevel@4
646 @KefReleaseSpinLockFromDpcLevel@4
652 KiDispatchInterrupt@0
653 KiEnableTimerWatchdog
654 KiInterruptDispatch2@8
655 KiIpiServiceRoutine@8
657 KiUnexpectedInterrupt@0
658 ;Kii386SpinOnSpinLock
662 LdrFindResourceDirectory_U@16
664 LpcPortObjectType DATA
666 LpcRequestWaitReplyPort@12
667 LsaCallAuthenticationPackage@28
668 LsaDeregisterLogonProcess@8
669 LsaFreeReturnBuffer@4
671 LsaLookupAuthenticationPackage@12
672 LsaRegisterLogonProcess@12
673 Mm64BitPhysicalAddress DATA
674 MmAddPhysicalMemory@8
675 MmAddVerifierThunks@8
676 MmAdjustWorkingSetSize@12
678 MmAllocateContiguousAlignedMemory@36
679 MmAllocateContiguousMemory@12
680 MmAllocateContiguousMemorySpecifyCache@32
681 MmAllocateMappingAddress@8
682 MmAllocateNonCachedMemory@4
683 MmAllocatePagesForMdl@28
684 MmBuildMdlForNonPagedPool@4
685 MmCanFileBeTruncated@8
690 MmDbgTranslatePhysicalAddress@8
691 MmDisableModifiedWriteOfSection@4
692 MmFlushImageSection@8
693 MmForceSectionClosed@8
694 MmFreeContiguousMemory@4
695 MmFreeContiguousMemorySpecifyCache@12
696 MmFreeMappingAddress@8
697 MmFreeNonCachedMemory@8
699 MmGetPhysicalAddress@4
700 MmGetPhysicalMemoryRanges@0
701 MmGetSystemRoutineAddress@4
702 MmGetVirtualForPhysical@8
704 MmHighestUserAddress DATA
706 MmIsDriverVerifying@4
707 MmIsNonPagedSystemAddressValid@4
708 MmIsRecursiveIoFault@0
709 MmIsThisAnNtAsSystem@0
710 MmIsVerifierEnabled@4
711 MmLockPagableDataSection@4
712 MmLockPagableImageSection@4=MmLockPagableDataSection@4
713 MmLockPagableSectionByHandle@4
716 MmMapLockedPagesSpecifyCache@24
717 MmMapLockedPagesWithReservedMapping@16
719 MmMapUserAddressesToPage@12
721 MmMapViewInSessionSpace@12
722 MmMapViewInSystemSpace@12
723 MmMapViewOfSection@40
724 MmMarkPhysicalMemoryAsBad@8
725 MmMarkPhysicalMemoryAsGood@8
728 MmProbeAndLockPages@12
729 MmProbeAndLockProcessPages@16
730 MmProbeAndLockSelectedPages@16
731 MmProtectMdlSystemAddress@8
733 MmRemovePhysicalMemory@8
734 MmResetDriverPaging@4
735 MmSectionObjectType DATA
736 MmSecureVirtualMemory@12
737 MmSetAddressRangeModified@8
738 MmSetBankedSection@24
740 MmSystemRangeStart DATA
741 MmTrimAllSystemPagableMemory@4
742 MmUnlockPagableImageSection@4
746 MmUnmapReservedMapping@12
747 MmUnmapVideoDisplay@8
748 MmUnmapViewInSessionSpace@4
749 MmUnmapViewInSystemSpace@4
750 MmUnmapViewOfSection@8
751 MmUnsecureVirtualMemory@4
752 MmUserProbeAddress DATA
755 NlsMbCodePageTag DATA
756 NlsMbOemCodePageTag DATA
757 NlsOemLeadByteInfo DATA
759 NtAdjustPrivilegesToken@24
761 NtAllocateLocallyUniqueId@4
763 NtAllocateVirtualMemory@24
774 NtDeviceIoControlFile@40
778 NtFreeVirtualMemory@16
782 NtMakePermanentObject@4
783 NtMapViewOfSection@40
784 NtNotifyChangeDirectoryFile@36
787 NtOpenProcessToken@12
788 NtOpenProcessTokenEx@16
791 NtOpenThreadTokenEx@20
792 NtQueryDirectoryFile@44
794 NtQueryInformationAtom@20
795 NtQueryInformationFile@20
796 NtQueryInformationProcess@20
797 NtQueryInformationThread@20
798 NtQueryInformationToken@20
799 NtQueryQuotaInformationFile@36
800 NtQuerySecurityObject@20
801 NtQuerySystemInformation@16
803 NtQueryVolumeInformationFile@20
806 NtRequestWaitReplyPort@12
809 NtSetInformationFile@20
810 NtSetInformationProcess@16
811 NtSetInformationThread@16
812 NtSetQuotaInformationFile@16
813 NtSetSecurityObject@12
814 NtSetVolumeInformationFile@20
821 NtWaitForSingleObject@12
824 ;ObCheckCreateObjectAccess@28
825 ;ObCheckObjectAccess@20
827 ObFindHandleForObject@20
828 ObGetObjectPointerCount@4
829 ObGetObjectSecurity@12
831 ObMakeTemporaryObject@4
832 ObOpenObjectByName@28
833 ObOpenObjectByPointer@28
835 ObQueryObjectAuditingByHandle@8
836 @ObfDereferenceObject@4
837 @ObfReferenceObject@4
838 ObReferenceObjectByHandle@24
839 ObReferenceObjectByName@32
840 ObReferenceObjectByPointer@16
841 ObReleaseObjectSecurity@8
842 ObDereferenceObject@4
843 ;ObSetSecurityDescriptorInfo@24
849 PoRegisterDeviceForIdleDetection@16
850 PoRegisterSystemState@8
855 PoStartNextPowerIrp@4
856 PoUnregisterSystemState@4
859 PsAssignImpersonationToken@8
861 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
862 PsChargeProcessPagedPoolQuota@8
863 PsChargeProcessPoolQuota@12
864 PsCreateSystemProcess@12
865 PsCreateSystemThread@28
866 PsCreateWin32Process@4
867 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
868 PsDereferencePrimaryToken@4
869 PsDisableImpersonation@8
870 PsEstablishWin32Callouts@24
871 PsGetCurrentProcessId@0
872 PsGetCurrentProcessSessionId@0
873 PsGetCurrentThreadId@0
874 PsGetCurrentThreadPreviousMode@0
875 PsGetCurrentThreadStackBase@0
876 PsGetCurrentThreadStackLimit@0
879 PsGetJobUIRestrictionsClass@4
880 PsGetProcessCreateTimeQuadPart@4
881 PsGetProcessDebugPort@4
882 PsGetProcessExitProcessCalled@4
883 PsGetProcessExitStatus@4
884 PsGetProcessExitTime@0
886 PsGetProcessImageFileName@4
887 PsGetProcessInheritedFromUniqueProcessId@4
890 PsGetProcessPriorityClass@4
891 PsGetProcessSectionBaseAddress@4
892 PsGetProcessSecurityPort@4
893 PsGetProcessSessionId@4
894 PsGetProcessWin32Process@4
895 PsGetProcessWin32WindowStation@4
896 PsGetThreadFreezeCount@4
897 PsGetThreadHardErrorsAreDisabled@4
900 PsGetThreadProcessId@4
901 PsGetThreadSessionId@4
903 PsGetThreadWin32Thread@4
907 PsImpersonateClient@20
908 PsInitialSystemProcess DATA
909 PsIsProcessBeingDebugged@4
911 PsIsThreadImpersonating@4
912 PsIsThreadTerminating@4
914 PsLookupProcessByProcessId@8
915 PsLookupProcessThreadByCid@12
916 PsLookupThreadByThreadId@8
918 PsReferenceImpersonationToken@16
919 PsReferencePrimaryToken@4
920 PsRemoveCreateThreadNotifyRoutine@4
921 PsRemoveLoadImageNotifyRoutine@4
922 PsRestoreImpersonation@8
924 PsReturnProcessNonPagedPoolQuota@8
925 PsReturnProcessPagedPoolQuota@8
927 PsRevertThreadToSelf@4
928 PsSetCreateProcessNotifyRoutine@8
929 PsSetCreateThreadNotifyRoutine@4
930 PsSetJobUIRestrictionsClass@8
931 PsSetLegoNotifyRoutine@4
932 PsSetProcessPriorityClass@8
933 PsSetProcessSecurityPort@8
934 PsSetProcessWin32Process@8
935 PsSetProcessWin32WindowStation@8
936 PsSetThreadHardErrorsAreDisabled@8
937 PsSetThreadWin32Thread@8
938 PsSetLoadImageNotifyRoutine@4
939 PsTerminateSystemThread@4
941 READ_REGISTER_UCHAR@4
942 READ_REGISTER_ULONG@4
943 READ_REGISTER_USHORT@4
944 READ_REGISTER_BUFFER_UCHAR@12
945 READ_REGISTER_BUFFER_ULONG@12
946 READ_REGISTER_BUFFER_USHORT@12
948 KeRosDumpStackFrames@8
949 KeRosGetStackFrames@8
950 RtlAbsoluteToSelfRelativeSD@12
951 RtlAddAccessAllowedAce@16
953 RtlAddAtomToAtomTable@12
955 ;RtlAllocateAndInitializeSid
957 RtlAnsiCharToUnicodeChar@4
958 RtlAnsiStringToUnicodeSize@4
959 RtlAnsiStringToUnicodeString@12
960 RtlAppendAsciizToString@8
961 RtlAppendStringToString@8
962 RtlAppendUnicodeStringToString@8
963 RtlAppendUnicodeToString@8
964 RtlAreAllAccessesGranted@8
965 RtlAreAnyAccessesGranted@8
970 RtlCaptureStackBackTrace@16
972 RtlCheckRegistryKey@8
977 RtlCompareMemoryUlong@12
979 RtlCompareUnicodeString@12
982 RtlConvertLongToLargeInteger@4
983 RtlConvertSidToUnicodeString@12
984 RtlConvertUlongToLargeInteger@4
989 RtlCopyUnicodeString@8
993 RtlCreateRegistryKey@8
994 RtlCreateSecurityDescriptor@8
995 RtlCreateSystemVolumeInformationFolder@4
996 RtlCreateUnicodeString@8
997 RtlCustomCPToUnicodeN@24
998 RtlDecompressBuffer@24
999 RtlDecompressChunks@28
1000 RtlDecompressFragment@32
1003 RtlDeleteAtomFromAtomTable@8
1004 RtlDeleteElementGenericTable@8
1005 RtlDeleteElementGenericTableAvl@8
1007 RtlDeleteOwnersRanges@8
1009 RtlDeleteRegistryValue@12
1011 RtlDestroyAtomTable@4
1013 RtlDowncaseUnicodeString@12
1015 RtlEnlargedIntegerMultiply@8
1016 RtlEnlargedUnsignedDivide@16
1017 RtlEnlargedUnsignedMultiply@8
1018 RtlEnumerateGenericTable@8
1019 RtlEnumerateGenericTableAvl@8
1020 RtlEnumerateGenericTableLikeADirectory@28
1021 RtlEnumerateGenericTableWithoutSplaying@8
1022 RtlEnumerateGenericTableWithoutSplayingAvl@8
1026 RtlEqualUnicodeString@12
1027 RtlExtendedIntegerMultiply@12
1028 RtlExtendedLargeIntegerDivide@16
1029 RtlExtendedMagicDivide@20
1031 RtlFillMemoryUlong@12
1033 RtlFindClearBitsAndSet@12
1035 RtlFindFirstRunClear@8
1036 RtlFindFirstRunSet@8
1037 RtlFindLastBackwardRunClear@12
1038 RtlFindLeastSignificantBit@8
1039 RtlFindLongestRunClear@8
1040 RtlFindLongestRunSet@8
1042 RtlFindMostSignificantBit@8
1043 RtlFindNextForwardRunClear@12
1046 RtlFindSetBitsAndClear@12
1047 RtlFindUnicodePrefix@12
1048 RtlFormatCurrentUserKeyPath@4
1053 RtlFreeUnicodeString@4
1055 RtlGenerate8dot3Name@16
1057 RtlGetCallersAddress@8
1058 RtlGetCompressionWorkSpaceSize@12
1059 RtlGetDaclSecurityDescriptor@16
1060 RtlGetDefaultCodePage@8
1061 RtlGetElementGenericTable@8
1062 RtlGetElementGenericTableAvl@8
1064 RtlGetGroupSecurityDescriptor@12
1066 RtlGetNtGlobalFlags@0
1067 RtlGetOwnerSecurityDescriptor@12
1068 RtlGetSaclSecurityDescriptor@16
1069 RtlGetSetBootStatusData@24
1071 RtlHashUnicodeString@16
1073 RtlImageDirectoryEntryToData@16
1075 RtlInitCodePageTable@8
1077 RtlInitUnicodeString@8
1078 RtlInitializeBitMap@12
1079 RtlInitializeGenericTable@20
1080 RtlInitializeGenericTableAvl@20
1081 RtlInitializeRangeList@4
1083 RtlInitializeUnicodePrefix@4
1084 RtlInsertElementGenericTable@16
1085 RtlInsertElementGenericTableAvl@16
1086 RtlInsertElementGenericTableFull@24
1087 RtlInsertElementGenericTableFullAvl@24
1088 RtlInsertUnicodePrefix@12
1089 RtlInt64ToUnicodeString@16
1091 RtlIntegerToUnicode@16
1092 RtlIntegerToUnicodeString@12
1093 RtlInvertRangeList@8
1094 RtlIpv4AddressToStringA@8
1095 RtlIpv4AddressToStringExA@16
1096 RtlIpv4AddressToStringExW@16
1097 RtlIpv4AddressToStringW@8
1098 RtlIpv4StringToAddressA@16
1099 RtlIpv4StringToAddressExA@16
1100 RtlIpv4StringToAddressExW@16
1101 RtlIpv4StringToAddressW@16
1102 RtlIpv6AddressToStringA@8
1103 RtlIpv6AddressToStringExA@16
1104 RtlIpv6AddressToStringExW@16
1105 RtlIpv6AddressToStringW@8
1106 RtlIpv6StringToAddressA@16
1107 RtlIpv6StringToAddressExA@16
1108 RtlIpv6StringToAddressExW@16
1109 RtlIpv6StringToAddressW@16
1110 RtlIsGenericTableEmpty@4
1111 RtlIsGenericTableEmptyAvl@4
1112 RtlIsNameLegalDOS8Dot3@12
1113 RtlIsRangeAvailable@40
1114 RtlIsValidOemCharacter@4
1115 RtlLargeIntegerAdd@16
1116 RtlLargeIntegerArithmeticShift@12
1117 RtlLargeIntegerDivide@20
1118 RtlLargeIntegerNegate@8
1119 RtlLargeIntegerShiftLeft@12
1120 RtlLargeIntegerShiftRight@12
1121 RtlLargeIntegerSubtract@16
1122 RtlLengthRequiredSid@4
1123 RtlLengthSecurityDescriptor@4
1125 RtlLockBootStatusData@4
1126 RtlLookupAtomInAtomTable@12
1127 RtlLookupElementGenericTable@8
1128 RtlLookupElementGenericTableAvl@8
1129 RtlLookupElementGenericTableFull@16
1130 RtlLookupElementGenericTableFullAvl@16
1132 RtlMapSecurityErrorToNtStatus@4
1133 RtlMergeRangeLists@16
1135 RtlMultiByteToUnicodeN@20
1136 RtlMultiByteToUnicodeSize@12
1137 RtlNextUnicodePrefix@8
1138 RtlNtStatusToDosError@4
1139 RtlNtStatusToDosErrorNoTeb@4
1140 RtlNumberGenericTableElements@4
1141 RtlNumberGenericTableElementsAvl@4
1142 RtlNumberOfClearBits@4
1143 RtlNumberOfSetBits@4
1144 RtlOemStringToCountedUnicodeString@12
1145 RtlOemStringToUnicodeSize@4
1146 RtlOemStringToUnicodeString@12
1148 RtlPinAtomInAtomTable@8
1149 @RtlPrefetchMemoryNonTemporal@8
1151 RtlPrefixUnicodeString@12
1152 RtlQueryAtomInAtomTable@24
1153 RtlQueryRegistryValues@20
1154 RtlQueryTimeZoneInformation@4
1158 RtlRealPredecessor@4
1160 RtlRemoveUnicodePrefix@8
1162 RtlSecondsSince1970ToTime@8
1163 RtlSecondsSince1980ToTime@8
1164 RtlSelfRelativeToAbsoluteSD2@8
1165 RtlSelfRelativeToAbsoluteSD@44
1169 RtlSetDaclSecurityDescriptor@16
1170 RtlSetGroupSecurityDescriptor@12
1171 RtlSetOwnerSecurityDescriptor@12
1172 RtlSetSaclSecurityDescriptor@16
1173 RtlSetTimeZoneInformation@4
1177 RtlSubAuthorityCountSid@4
1178 RtlSubAuthoritySid@8
1179 RtlSubtreePredecessor@4
1180 RtlSubtreeSuccessor@4
1182 RtlTimeFieldsToTime@8
1183 RtlTimeToElapsedTimeFields@8
1184 RtlTimeToSecondsSince1970@8
1185 RtlTimeToSecondsSince1980@8
1186 RtlTimeToTimeFields@8
1188 @RtlUlonglongByteSwap@8
1189 RtlUnicodeStringToAnsiSize@4
1190 RtlUnicodeStringToAnsiString@12
1191 RtlUnicodeStringToCountedOemString@12
1192 RtlUnicodeStringToInteger@12
1193 RtlUnicodeStringToOemSize@4
1194 RtlUnicodeStringToOemString@12
1195 RtlUnicodeToCustomCPN@24
1196 RtlUnicodeToMultiByteN@20
1197 RtlUnicodeToMultiByteSize@12
1199 RtlUnlockBootStatusData@4
1201 RtlUpcaseUnicodeChar@4
1202 RtlUpcaseUnicodeString@12
1203 RtlUpcaseUnicodeStringToAnsiString@12
1204 RtlUpcaseUnicodeStringToCountedOemString@12
1205 RtlUpcaseUnicodeStringToOemString@12
1206 RtlUpcaseUnicodeToCustomCPN@24
1207 RtlUpcaseUnicodeToMultiByteN@20
1208 RtlUpcaseUnicodeToOemN@20
1211 @RtlUshortByteSwap@4
1212 RtlValidRelativeSecurityDescriptor@12
1213 RtlValidSecurityDescriptor@4
1215 ;RtlVerifyVersionInfo@16
1216 RtlVolumeDeviceToDosName@8
1217 RtlWalkFrameChain@12
1218 RtlWriteRegistryValue@24
1221 RtlxAnsiStringToUnicodeSize@4
1222 RtlxOemStringToUnicodeSize@4
1223 RtlxUnicodeStringToAnsiSize@4
1224 RtlxUnicodeStringToOemSize@4
1226 SeAppendPrivileges@8
1228 SeAssignSecurityEx@36
1229 SeAuditHardLinkCreation@12
1230 SeAuditingFileEvents@8
1231 SeAuditingFileEventsWithContext@12
1232 SeAuditingFileOrGlobalEvents@12
1233 SeAuditingHardLinkEvents@8
1234 SeAuditingHardLinkEventsWithContext@12
1235 SeCaptureSecurityDescriptor@20
1236 SeCaptureSubjectContext@4
1237 SeCloseObjectAuditAlarm@12
1238 SeCreateAccessState@16
1239 SeCreateClientSecurity@16
1240 SeCreateClientSecurityFromSubjectContext@16
1241 SeDeassignSecurity@4
1242 SeDeleteAccessState@4
1243 SeDeleteObjectAuditAlarm@8
1247 SeImpersonateClient@8
1248 SeImpersonateClientEx@8
1249 SeLockSubjectContext@4
1250 SeMarkLogonSessionForTerminationNotification@4
1251 SeOpenObjectAuditAlarm@36
1252 SeOpenObjectForDeleteAuditAlarm@36
1254 SePrivilegeObjectAuditAlarm@24
1255 SePublicDefaultDacl DATA
1256 SeQueryAuthenticationIdToken@8
1257 SeQueryInformationToken@12
1258 SeQuerySecurityDescriptorInfo@16
1259 SeQuerySessionIdToken@8
1260 SeRegisterLogonSessionTerminatedRoutine@4
1261 SeReleaseSecurityDescriptor@12
1262 SeReleaseSubjectContext@4
1263 SeSetAccessStateGenericMapping@8
1264 SeSetSecurityDescriptorInfo@24
1265 SeSetSecurityDescriptorInfoEx@28
1266 SeSinglePrivilegeCheck@12
1267 SeSystemDefaultDacl DATA
1268 SeTokenImpersonationLevel@4
1270 SeTokenIsRestricted@4
1271 SeTokenIsWriteRestricted@4
1273 SeUnlockSubjectContext@4
1274 SeUnregisterLogonSessionTerminatedRoutine@4
1275 SeValidSecurityDescriptor@8
1276 VerSetConditionMask@16
1277 WRITE_REGISTER_UCHAR@8
1278 WRITE_REGISTER_ULONG@8
1279 WRITE_REGISTER_USHORT@8
1280 WRITE_REGISTER_BUFFER_UCHAR@12
1281 WRITE_REGISTER_BUFFER_ULONG@12
1282 WRITE_REGISTER_BUFFER_USHORT@12
1283 ZwAccessCheckAndAuditAlarm@44
1285 ZwAdjustPrivilegesToken@24
1287 ZwAllocateVirtualMemory@24
1288 ZwAssignProcessToJobObject@8
1293 ZwCloseObjectAuditAlarm@12
1295 ZwCreateDirectoryObject@12
1298 ZwCreateJobObject@12
1301 ZwCreateSymbolicLinkObject@16
1307 ZwDeviceIoControlFile@40
1309 ZwDuplicateObject@28
1311 ZwEnumerateBootEntries@8
1313 ZwEnumerateValueKey@24
1314 ZwFlushInstructionCache@12
1316 ZwFlushVirtualMemory@16
1317 ZwFreeVirtualMemory@16
1319 ZwInitiatePowerAction@16
1323 ZwMakeTemporaryObject@4
1324 ZwMapViewOfSection@40
1325 ZwNotifyChangeKey@40
1326 ZwOpenDirectoryObject@12
1332 ZwOpenProcessToken@12
1333 ZwOpenProcessTokenEx@16
1335 ZwOpenSymbolicLinkObject@12
1337 ZwOpenThreadToken@16
1338 ZwOpenThreadTokenEx@20
1340 ZwPowerInformation@20
1342 ZwQueryBootEntryOrder@8
1343 ZwQueryBootOptions@8
1344 ZwQueryDefaultLocale@8
1345 ZwQueryDefaultUILanguage@4
1346 ZwQueryDirectoryFile@44
1347 ZwQueryDirectoryObject@28
1349 ZwQueryFullAttributesFile@8
1350 ZwQueryInformationAtom@20
1351 ZwQueryInformationFile@20
1352 ZwQueryInformationJobObject@20
1353 ZwQueryInformationProcess@20
1354 ZwQueryInformationThread@20
1355 ZwQueryInformationToken@20
1356 ZwQueryInstallUILanguage@4
1360 ZwQuerySecurityObject@20
1361 ZwQuerySymbolicLinkObject@12
1362 ZwQuerySystemInformation@16
1365 ZwQueryVolumeInformationFile@20
1368 ZwRequestWaitReplyPort@12
1373 ZwSetBootEntryOrder@8
1375 ZwSetDefaultLocale@8
1376 ZwSetDefaultUILanguage@4
1379 ZwSetInformationFile@20
1380 ZwSetInformationJobObject@16
1381 ZwSetInformationObject@16
1382 ZwSetInformationProcess@16
1383 ZwSetInformationThread@16
1384 ZwSetSecurityObject@12
1385 ZwSetSystemInformation@12
1389 ZwSetVolumeInformationFile@20
1390 ZwTerminateJobObject@8
1391 ZwTerminateProcess@8
1392 ZwTranslateFilePath@12
1395 ZwUnmapViewOfSection@8
1396 ZwWaitForMultipleObjects@20
1397 ZwWaitForSingleObject@12
1400 _abnormal_termination