1 ; $Id: ntoskrnl.def,v 1.153 2003/06/02 10:04:28 ekohl Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
13 CcGetFileObjectFromSectionPtrs@4
16 CcSetDirtyPinnedData@8
21 DbgBreakPointWithStatus@4
22 ;DbgLoadImageSymbols@12
26 @ExAcquireFastMutexUnsafe@4
27 ExAcquireResourceExclusive@8
28 ExAcquireResourceExclusiveLite@8
29 ExAcquireResourceSharedLite@8
30 ExAcquireSharedStarveExclusive@8
31 ExAcquireSharedWaitForExclusive@8
32 ExAllocateFromPagedLookasideList@4
34 ExAllocatePoolWithQuota@8
35 ExAllocatePoolWithQuotaTag@12
36 ExAllocatePoolWithTag@12
37 ExConvertExclusiveToSharedLite@4
39 ExDeleteNPagedLookasideList@4
40 ExDeletePagedLookasideList@4
42 ExDeleteResourceLite@4
43 ExDesktopObjectType DATA
44 ExDisableResourceBoostLite@4
45 ExEventObjectType DATA
48 ExFreeToPagedLookasideList@8
49 ExGetExclusiveWaiterCount@4
51 ExGetSharedWaiterCount@4
52 ExInitializeNPagedLookasideList@28
53 ExInitializePagedLookasideList@28
54 ExInitializeResource@4
55 ExInitializeResourceLite@4
57 ExInterlockedAddLargeInteger@16
58 @ExInterlockedAddLargeStatistic@8
59 ExInterlockedAddUlong@12
60 @ExInterlockedCompareExchange64@16
61 ExInterlockedDecrementLong@8
62 ExInterlockedExchangeUlong@12
63 ExInterlockedExtendZone@16
64 ExInterlockedIncrementLong@8
65 ExInterlockedInsertHeadList@12
66 ExInterlockedInsertTailList@12
67 ExInterlockedPopEntryList@8
68 @ExInterlockedPopEntrySList@8
69 ExInterlockedPushEntryList@12
70 @ExInterlockedPushEntrySList@12
71 ExInterlockedRemoveHeadList@8
72 ExIsProcessorFeaturePresent@4
73 ExIsResourceAcquiredExclusiveLite@4
74 ExIsResourceAcquiredSharedLite@4
75 ExLocalTimeToSystemTime@8
80 ExRaiseAccessViolation@0
81 ExRaiseDatatypeMisalignment@0
86 ExReinitializeResourceLite@4
87 @ExReleaseFastMutexUnsafe@4
88 ExReleaseResourceForThread@8
89 ExReleaseResourceForThreadLite@8
90 @ExReleaseResourceLite@4
91 ExSetResourceOwnerPointer@8
92 ;ExSystemExceptionFilter
93 ExSystemTimeToLocalTime@8
94 ExTryToAcquireResourceExclusiveLite@4
95 ExUnregisterCallback@4
96 ExWindowStationObjectType DATA
97 ExInitializeBinaryTree@12
100 ExSearchBinaryTree@12
101 ExRemoveBinaryTree@12
102 ExTraverseBinaryTree@16
103 ExInitializeSplayTree@16
108 ExWeightOfSplayTree@8
109 ExTraverseSplayTree@16
110 ExInitializeHashTable@16
115 @ExfInterlockedAddUlong@12
116 @ExfInterlockedInsertHeadList@12
117 @ExfInterlockedInsertTailList@12
118 @ExfInterlockedPopEntryList@8
119 @ExfInterlockedPushEntryList@12
120 @ExfInterlockedRemoveHeadList@8
121 @Exfi386InterlockedDecrementLong@4
122 @Exfi386InterlockedExchangeUlong@8
123 @Exfi386InterlockedIncrementLong@4
124 Exi386InterlockedDecrementLong@4
125 Exi386InterlockedExchangeUlong@8
126 Exi386InterlockedIncrementLong@4
127 FsRtlAddLargeMcbEntry@28
129 FsRtlAddToTunnelCache@32
130 FsRtlAllocateFileLock@8
132 FsRtlAllocatePoolWithQuota@8
133 FsRtlAllocatePoolWithQuotaTag@12
134 FsRtlAllocatePoolWithTag@12
135 FsRtlAllocateResource@0
136 FsRtlAreNamesEqual@16
138 FsRtlCheckLockForReadAccess@8
139 FsRtlCheckLockForWriteAccess@8
143 FsRtlCurrentBatchOplock@4
144 FsRtlDeleteKeyFromTunnelCache@12
145 FsRtlDeleteTunnelCache@4
146 FsRtlDeregisterUncProvider@4
149 FsRtlDoesDbcsContainWildCards@4
150 FsRtlDoesNameContainWildCards@4
151 FsRtlFastCheckLockForRead@24
152 FsRtlFastCheckLockForWrite@24
153 FsRtlFastUnlockAll@16
154 FsRtlFastUnlockAllByKey@20
155 FsRtlFastUnlockSingle@32
156 FsRtlFindInTunnelCache@32
158 FsRtlGetNextFileLock@8
159 FsRtlGetNextLargeMcbEntry@20
160 FsRtlGetNextMcbEntry@20
161 FsRtlInitializeFileLock@12
162 FsRtlInitializeLargeMcb@8
164 FsRtlInitializeOplock@4
165 FsRtlInitializeTunnelCache@4
166 FsRtlIsDbcsInExpression@8
167 FsRtlIsFatDbcsLegal@20
168 FsRtlIsHpfsDbcsLegal@20
169 FsRtlIsNameInExpression@16
170 FsRtlIsNtstatusExpected@4
171 FsRtlIsTotalDeviceFailure@4
172 FsRtlLegalAnsiCharacterArray DATA
173 FsRtlLookupLargeMcbEntry@32
174 FsRtlLookupLastLargeMcbEntry@12
175 FsRtlLookupLastMcbEntry@12
176 FsRtlLookupMcbEntry@20
178 FsRtlMdlReadComplete@8
179 FsRtlMdlReadCompleteDev@12
181 FsRtlMdlWriteComplete@12
182 FsRtlMdlWriteCompleteDev@16
183 FsRtlNormalizeNtstatus@8
184 FsRtlNotifyChangeDirectory@28
185 FsRtlNotifyCleanup@12
186 FsRtlNotifyFullChangeDirectory@40
187 FsRtlNotifyFullReportChange@36
188 FsRtlNotifyInitializeSync@4
189 FsRtlNotifyReportChange@20
190 FsRtlNotifyUninitializeSync@4
191 FsRtlNotifyVolumeEvent@8
192 FsRtlNumberOfRunsInLargeMcb@4
193 FsRtlNumberOfRunsInMcb@4
195 FsRtlOplockIsFastIoPossible@4
196 FsRtlPostPagingFileStackOverflow@12
197 FsRtlPostStackOverflow@12
198 FsRtlPrepareMdlWrite@24
199 FsRtlPrepareMdlWriteDev@28
201 FsRtlProcessFileLock@12
202 FsRtlRegisterUncProvider@12
203 FsRtlRemoveLargeMcbEntry@20
204 FsRtlRemoveMcbEntry@12
205 FsRtlSplitLargeMcb@20
207 FsRtlTruncateLargeMcb@12
209 FsRtlUninitializeFileLock@4
210 FsRtlUninitializeLargeMcb@4
211 FsRtlUninitializeMcb@4
212 FsRtlUninitializeOplock@4
213 HalDispatchTable DATA
214 HalPrivateDispatchTable DATA
215 @InterlockedCompareExchange@12
216 @InterlockedDecrement@4
217 @InterlockedExchange@8
218 @InterlockedExchangeAdd@8
219 @InterlockedIncrement@4
220 IoAcquireCancelSpinLock@4
221 IoAcquireRemoveLockEx@20
222 IoAcquireVpbSpinLock@4
223 IoAdapterObjectType DATA
224 IoAllocateAdapterChannel@20
225 IoAllocateController@16
226 IoAllocateErrorLogEntry@8
231 IoAttachDeviceByPointer@8
232 IoAttachDeviceToDeviceStack@8
233 IoBuildAsynchronousFsdRequest@24
234 IoBuildDeviceIoControlRequest@36
236 IoBuildSynchronousFsdRequest@28
239 IoCheckDesiredAccess@8
240 IoCheckEaBufferValidity@12
241 IoCheckFunctionAccess@24
242 IoCheckShareAccess@20
244 IoConnectInterrupt@44
248 IoCreateNotificationEvent@8
249 IoCreateStreamFileObject@8
250 IoCreateSymbolicLink@8
251 IoCreateSynchronizationEvent@8
252 IoCreateUnprotectedSymbolicLink@8
255 IoDeleteSymbolicLink@4
257 IoDeviceHandlerObjectSize DATA
258 IoDeviceHandlerObjectType DATA
259 IoDisconnectInterrupt@4
260 IoDeviceObjectType DATA
261 IoDriverObjectType DATA
263 IoFastQueryNetworkAttributes@20
264 IoFileObjectType DATA
268 IoGetAttachedDevice@4
269 IoGetAttachedDeviceReference@4
270 IoGetBaseFileSystemDeviceObject@4
271 IoGetConfigurationInformation@0
272 IoGetCurrentProcess@0
273 IoGetDeviceObjectPointer@16
274 IoGetDeviceToVerify@4
275 IoGetFileObjectGenericMapping@0
277 IoGetRelatedDeviceObject@4
278 IoGetRequestorProcess@4
282 IoInvalidateDeviceState@4
283 IoInitializeRemoveLockEx@20
285 IoIsOperationSynchronous@4
286 IoMakeAssociatedIrp@8
287 IoOpenDeviceInstanceKey@20
289 IoQueryDeviceDescription@32
290 IoQueryDeviceEnumInfo@8
291 IoQueryFileInformation@20
292 IoQueryVolumeInformation@20
295 IoRaiseInformationalHardError@12
296 IoReadOperationCount DATA
297 IoReadPartitionTable@16
298 IoReadTransferCount DATA
303 IoRegisterDeviceInterface@16
304 IoSetDeviceInterfaceState@8
305 IoGetDeviceProperty@20
306 IoOpenDeviceRegistryKey@16
307 IoInvalidateDeviceRelations@8
309 IoRegisterDriverReinitialization@12
310 IoRegisterFileSystem@4
311 IoRegisterFsRegistrationChange@8
312 IoRegisterShutdownNotification@4
313 IoReleaseCancelSpinLock@4
314 IoReleaseRemoveLockAndWaitEx@12
315 IoReleaseRemoveLockEx@12
316 IoReleaseVpbSpinLock@4
317 IoRemoveShareAccess@8
318 IoReportHalResourceUsage@16
319 IoReportResourceUsage@36
320 IoSetDeviceToVerify@8
321 IoSetHardErrorOrVerifyDevice@8
323 IoSetPartitionInformation@16
325 IoSetThreadHardErrorMode@4
328 IoStartNextPacketByKey@12
331 IoStatisticsLock DATA
333 IoSynchronousPageWrite@20
335 IoUnregisterFileSystem@4
336 IoUnregisterFsRegistrationChange@8
337 IoUnregisterShutdownNotification@4
338 IoUpdateShareAccess@8
340 IoWriteErrorLogEntry@4
341 IoWriteOperationCount DATA
342 IoWritePartitionTable@20
343 IoWriteTransferCount DATA
345 @IofCompleteRequest@8
346 KdDebuggerEnabled DATA
347 KdDebuggerNotPresent DATA
349 KdSystemDebugControl@4
351 ;Ke386IoSetAccessProcess
352 ;Ke386QueryIoAccessMap
354 KeAcquireSpinLockAtDpcLevel@4
355 KeAddSystemServiceTable@20
357 ;KeBoostCurrentThread
363 KeDcacheFlushCount DATA
364 KeDelayExecutionThread@12
365 KeDeregisterBugCheckCallback@4
367 KeDisconnectInterrupt@4
368 KeEnterCriticalRegion@0
369 KeEnterKernelDebugger@0
370 ;KeFindConfigurationEntry
371 ;KeFindConfigurationNextEntry
376 ;KeI386AllocateGdtSelectors
377 ;KeI386Call16BitCStyleFunction
378 ;KeI386Call16BitFunction
379 ;KeI386FlatToGdtSelector
381 ;KeI386MachineType DATA
382 ;KeI386ReleaseGdtSelectors
384 ;KeI386SetGdtSelector
385 KeIcacheFlushCount DATA
387 KeInitializeDeviceQueue@4
390 KeInitializeInterrupt@44
394 KeInitializeSemaphore@12
395 KeInitializeSpinLock@4
397 KeInitializeTimerEx@8
398 KeInsertByKeyDeviceQueue@12
399 KeInsertDeviceQueue@8
405 KeLeaveCriticalRegion@0
407 KeNumberProcessors DATA
409 ;KeProfileInterruptWithSource
413 KeQueryTimeIncrement@0
414 ;KeRaiseUserException
420 KeReadStateSemaphore@4
422 KeRegisterBugCheckCallback@20
425 KeReleaseSemaphore@16
426 KeReleaseSpinLockFromDpcLevel@4
427 KeRemoveByKeyDeviceQueue@8
428 KeRemoveDeviceQueue@4
429 KeRemoveEntryDeviceQueue@8
433 ;KeRestoreFloatingPointState
435 ;KeSaveFloatingPointState
436 KeServiceDescriptorTable DATA
437 KeSetAffinityThread@8
438 KeSetBasePriorityThread@8
441 ;KeSetEventBoostPriority
442 ;KeSetIdealProcessorThread
444 ;KeSetKernelStackSwapEnable
445 KeSetPriorityThread@8
447 ;@KeSetSwapContextNotifyRoutine
448 KeSetTargetProcessorDpc@8
449 ;@KeSetThreadSelectNotifyRoutine
453 ;@KeSetTimeUpdateNotifyRoutine
454 KeSynchronizeExecution@12
459 KeWaitForMultipleObjects@32
460 KeWaitForMutexObject@20
461 KeWaitForSingleObject@20
462 ;@KefAcquireSpinLockAtDpcLevel
463 ;@KefReleaseSpinLockFromDpcLevel
465 ;@KiAcquireSpinLock@4
467 ;KiCoprocessorError@0
469 KiDispatchInterrupt@0
470 KiInterruptDispatch2@8
471 ;KiIpiServiceRoutine@8
472 ;@KiReleaseSpinLock@4
473 ;KiUnexpectedInterrupt
474 ;Kii386SpinOnSpinLock
478 ;LdrFindResourceDirectory_U@16
481 LsaCallAuthenticationPackage@28
482 LsaDeregisterLogonProcess@8
483 LsaFreeReturnBuffer@4
485 LsaLookupAuthenticationPackage@12
486 LsaRegisterLogonProcess@12
487 MmAdjustWorkingSetSize@12
488 MmAllocateContiguousAlignedMemory@16
489 MmAllocateContiguousMemory@12
490 MmAllocateNonCachedMemory@4
491 MmBuildMdlForNonPagedPool@4
492 MmCanFileBeTruncated@8
497 MmDbgTranslatePhysicalAddress@8
498 MmDisableModifiedWriteOfSection@4
499 MmFlushImageSection@8
500 MmForceSectionClosed@8
501 MmFreeContiguousMemory@4
502 MmFreeNonCachedMemory@8
503 MmGetPhysicalAddress@4
505 MmHighestUserAddress DATA
507 MmIsNonPagedSystemAddressValid@4
508 MmIsRecursiveIoFault@0
509 MmIsThisAnNtAsSystem@0
510 MmLockPagableDataSection@4
511 MmLockPagableImageSection@4=MmLockPagableDataSection@4
512 MmLockPagableSectionByHandle@4
517 MmMapViewInSystemSpace@12
518 MmMapViewOfSection@40
520 MmProbeAndLockPages@12
522 MmResetDriverPaging@4
523 MmSectionObjectType DATA
524 MmSecureVirtualMemory@12
525 MmSetAddressRangeModified@8
526 MmSetBankedSection@24
528 MmUnlockPagableImageSection@4
532 MmUnmapVideoDisplay@8
533 MmUnmapViewInSystemSpace@4
534 MmUnmapViewOfSection@8
535 MmUnsecureVirtualMemory@4
536 MmUserProbeAddress DATA
539 NlsMbCodePageTag DATA
540 NlsMbOemCodePageTag DATA
541 NlsOemLeadByteInfo DATA
543 NtAdjustPrivilegesToken@24
545 NtAllocateLocallyUniqueId@4
547 NtAllocateVirtualMemory@24
558 NtDeviceIoControlFile@40
562 NtFreeVirtualMemory@16
566 NtMapViewOfSection@40
567 NtNotifyChangeDirectoryFile@36
570 NtOpenProcessToken@12
571 NtQueryDirectoryFile@44
573 NtQueryInformationAtom@20
574 NtQueryInformationFile@20
575 NtQueryInformationProcess@20
576 NtQueryInformationToken@20
577 ;NtQueryOleDirectoryFile@ <--- ?
578 NtQuerySecurityObject@20
580 NtQueryVolumeInformationFile@20
583 NtRequestWaitReplyPort@12
585 NtSetInformationFile@20
586 NtSetInformationProcess@16
587 NtSetInformationThread@16
588 NtSetSecurityObject@12
593 NtWaitForSingleObject@12
596 ;ObCheckCreateObjectAccess@28
597 ;ObCheckObjectAccess@20
600 ;ObFindHandleForObject@20
601 ObGetObjectPointerCount@4
602 ObGetObjectSecurity@12
604 ObMakeTemporaryObject@4
605 ObOpenObjectByName@28
606 ObOpenObjectByPointer@28
608 ;ObQueryObjectAuditingByHandle@8
609 @ObfDereferenceObject@4
610 @ObfReferenceObject@4
611 ObReferenceObjectByHandle@24
612 ObReferenceObjectByName@32
613 ObReferenceObjectByPointer@16
614 ObReleaseObjectSecurity@8
615 ;ObSetSecurityDescriptorInfo@24
621 PoRegisterDeviceForIdleDetection@16
622 PoRegisterSystemState@8
627 PoStartNextPowerIrp@4
628 PoUnregisterSystemState@4
630 PsAssignImpersonationToken@8
631 ;PsChargePoolQuota@12
632 PsCreateSystemProcess@12
633 PsCreateSystemThread@28
634 PsCreateWin32Thread@4
635 PsCreateWin32Process@4
638 PsEstablishWin32Callouts@24
639 PsGetCurrentProcessId@0
640 PsGetCurrentThreadId@0
641 PsGetProcessExitTime@0
643 PsImpersonateClient@20
644 PsInitialSystemProcess DATA
645 PsIsThreadTerminating@4
646 PsLookupProcessByProcessId@8
647 PsLookupProcessThreadByCid@12
648 PsLookupThreadByThreadId@8
650 PsReferenceImpersonationToken@16
651 PsReferencePrimaryToken@4
652 ;PsReturnPoolQuota@12
654 PsSetCreateProcessNotifyRoutine@8
655 PsSetCreateThreadNotifyRoutine@4
656 ;PsSetLegoNotifyRoutine@4
657 ;PsSetProcessPriorityByClass@8
658 PsTerminateSystemThread@4
660 READ_REGISTER_UCHAR@4
661 READ_REGISTER_ULONG@4
662 READ_REGISTER_USHORT@4
663 READ_REGISTER_BUFFER_UCHAR@12
664 READ_REGISTER_BUFFER_ULONG@12
665 READ_REGISTER_BUFFER_USHORT@12
666 RtlAbsoluteToSelfRelativeSD@12
667 RtlAddAccessAllowedAce@16
669 RtlAddAtomToAtomTable@12
670 ;RtlAllocateAndInitializeSid
672 RtlAnsiCharToUnicodeChar@4
673 RtlAnsiStringToUnicodeSize@4
674 RtlAnsiStringToUnicodeString@12
675 RtlAppendAsciizToString@8
676 RtlAppendStringToString@8
677 RtlAppendUnicodeStringToString@8
678 RtlAppendUnicodeToString@8
679 RtlAreAllAccessesGranted@8
680 RtlAreAnyAccessesGranted@8
684 ;RtlCaptureStackBackTrace
686 RtlCheckRegistryKey@8
690 RtlCompareMemoryUlong@12
692 RtlCompareUnicodeString@12
695 RtlConvertLongToLargeInteger@4
696 RtlConvertSidToUnicodeString@12
697 RtlConvertUlongToLargeInteger@4
701 RtlCopyUnicodeString@8
705 RtlCreateRegistryKey@8
706 RtlCreateSecurityDescriptor@8
707 RtlCreateUnicodeString@8
708 RtlCustomCPToUnicodeN@24
709 RtlDecompressBuffer@24
710 RtlDecompressChunks@28
711 RtlDecompressFragment@32
713 RtlDeleteAtomFromAtomTable@8
714 ;RtlDeleteElementGenericTable
716 RtlDeleteRegistryValue@12
718 RtlDestroyAtomTable@4
720 RtlDowncaseUnicodeString@12
722 RtlEnlargedIntegerMultiply@8
723 RtlEnlargedUnsignedDivide@16
724 RtlEnlargedUnsignedMultiply@8
725 ;RtlEnumerateGenericTable
726 ;RtlEnumerateGenericTableWithoutSplaying
730 RtlEqualUnicodeString@12
731 RtlExtendedIntegerMultiply@12
732 RtlExtendedLargeIntegerDivide@16
733 RtlExtendedMagicDivide@20
735 RtlFillMemoryUlong@12
737 RtlFindClearBitsAndSet@12
738 RtlFindFirstRunClear@8
740 RtlFindLongestRunClear@8
741 RtlFindLongestRunSet@8
744 RtlFindSetBitsAndClear@12
745 ;RtlFindUnicodePrefix
746 RtlFormatCurrentUserKeyPath@4
750 RtlFreeUnicodeString@4
751 RtlGenerate8dot3Name@16
752 ;RtlGetCallersAddress
753 RtlGetCompressionWorkSpaceSize@12
754 RtlGetDaclSecurityDescriptor@16
755 RtlGetDefaultCodePage@8
756 ;RtlGetElementGenericTable
757 RtlGetGroupSecurityDescriptor@12
758 RtlGetOwnerSecurityDescriptor@12
761 RtlInitCodePageTable@8
763 RtlInitUnicodeString@8
764 RtlInitializeBitMap@12
765 ;RtlInitializeGenericTable
767 ;RtlInitializeUnicodePrefix
768 ;RtlInsertElementGenericTable
769 ;RtlInsertUnicodePrefix
771 RtlIntegerToUnicodeString@12
772 RtlIsNameLegalDOS8Dot3@12
773 RtlLargeIntegerAdd@16
774 RtlLargeIntegerArithmeticShift@12
775 RtlLargeIntegerDivide@20
776 RtlLargeIntegerNegate@8
777 RtlLargeIntegerShiftLeft@12
778 RtlLargeIntegerShiftRight@12
779 RtlLargeIntegerSubtract@16
780 RtlLengthRequiredSid@4
781 RtlLengthSecurityDescriptor@4
783 RtlLookupAtomInAtomTable@12
784 ;RtlLookupElementGenericTable
787 RtlMultiByteToUnicodeN@20
788 RtlMultiByteToUnicodeSize@12
789 ;RtlNextUnicodePrefix
790 RtlNtStatusToDosError@4
791 RtlNtStatusToDosErrorNoTeb@4
792 ;RtlNumberGenericTableElements
793 RtlNumberOfClearBits@4
795 RtlOemStringToCountedUnicodeString@12
796 RtlOemStringToUnicodeSize@4
797 RtlOemStringToUnicodeString@12
799 RtlPinAtomInAtomTable@8
801 RtlPrefixUnicodeString@12
802 RtlQueryAtomInAtomTable@24
803 RtlQueryRegistryValues@20
804 RtlQueryTimeZoneInformation@4
807 ;RtlRemoveUnicodePrefix
809 RtlSecondsSince1970ToTime@8
810 RtlSecondsSince1980ToTime@8
813 RtlSetDaclSecurityDescriptor@16
814 RtlSetGroupSecurityDescriptor@12
815 RtlSetOwnerSecurityDescriptor@12
816 RtlSetSaclSecurityDescriptor@16
817 RtlSetTimeZoneInformation@4
819 RtlSubAuthorityCountSid@4
821 RtlTimeFieldsToTime@8
822 RtlTimeToSecondsSince1970@8
823 RtlTimeToSecondsSince1980@8
824 RtlTimeToTimeFields@8
825 RtlUnicodeStringToAnsiSize@4
826 RtlUnicodeStringToAnsiString@12
827 RtlUnicodeStringToCountedOemString@12
828 RtlUnicodeStringToInteger@12
829 RtlUnicodeStringToOemSize@4
830 RtlUnicodeStringToOemString@12
831 RtlUnicodeToCustomCPN@24
832 RtlUnicodeToMultiByteN@20
833 RtlUnicodeToMultiByteSize@12
836 RtlUpcaseUnicodeChar@4
837 RtlUpcaseUnicodeString@12
838 RtlUpcaseUnicodeStringToAnsiString@12
839 RtlUpcaseUnicodeStringToCountedOemString@12
840 RtlUpcaseUnicodeStringToOemString@12
841 RtlUpcaseUnicodeToCustomCPN@24
842 RtlUpcaseUnicodeToMultiByteN@20
843 RtlUpcaseUnicodeToOemN@20
846 RtlValidSecurityDescriptor@4
848 RtlWriteRegistryValue@24
851 RtlxAnsiStringToUnicodeSize@4
852 RtlxOemStringToUnicodeSize@4
853 RtlxUnicodeStringToAnsiSize@4
854 RtlxUnicodeStringToOemSize@4
856 ;SeAppendPrivileges@8
858 ;SeAuditingFileEvents@8
859 ;SeAuditingFileOrGlobalEvents@18
860 ;SeCaptureSecurityDescriptor@20
861 SeCaptureSubjectContext@4
862 ;SeCloseObjectAuditAlarm@12
863 ;SeCreateAccessState@16
864 SeCreateClientSecurity@16
866 ;SeDeleteAccessState@4
867 ;SeDeleteObjectAuditAlarm@8
870 SeImpersonateClient@8
871 ;SeLockSubjectContext@4
872 ;SeMarkLogonSessionForTerminationNotification@4
873 ;SeOpenObjectAuditAlarm@36
874 ;SeOpenObjectForDeleteAuditAlarm@36
876 ;SePrivilegeObjectAuditAlarm@24
877 SePublicDefaultDacl DATA
878 ;SeQueryAuthenticationIdToken@8
879 ;SeQuerySecurityDescriptorInfo@16
880 ;SeRegisterLogonSessionTerminatedRoutine@4
881 ;SeReleaseSecurityDescriptor@12
882 SeReleaseSubjectContext@4
883 ;SeSetAccessStateGenericMapping@8
884 ;SeSetSecurityDescriptorInfo@24
885 SeSinglePrivilegeCheck@12
886 SeSystemDefaultDacl DATA
887 SeTokenImpersonationLevel@4
889 ;SeUnlockSubjectContext@4
890 ;SeUnregisterLogonSessionTerminatedRoutine@4
891 ;SeValidSecurityDescriptor@8
892 WRITE_REGISTER_UCHAR@8
893 WRITE_REGISTER_ULONG@8
894 WRITE_REGISTER_USHORT@8
895 WRITE_REGISTER_BUFFER_UCHAR@12
896 WRITE_REGISTER_BUFFER_ULONG@12
897 WRITE_REGISTER_BUFFER_USHORT@12
898 ZwAccessCheckAndAuditAlarm@44
900 ZwAllocateVirtualMemory@24
903 ZwCloseObjectAuditAlarm@12
905 ZwCreateDirectoryObject@12
910 ZwCreateSymbolicLinkObject@16
914 ZwDeviceIoControlFile@40
919 ZwEnumerateValueKey@24
920 ZwFlushInstructionCache@12
922 ZwFreeVirtualMemory@16
926 ZwMakeTemporaryObject@4
927 ZwMapViewOfSection@40
929 ZwOpenDirectoryObject@12
934 ZwOpenProcessToken@12
936 ZwOpenSymbolicLinkObject@12
940 ZwQueryDefaultLocale@8
941 ZwQueryDirectoryFile@44
942 ZwQueryInformationAtom@20
943 ZwQueryInformationFile@20
944 ZwQueryInformationProcess@20
945 ZwQueryInformationToken@20
949 ZwQuerySecurityObject@20
950 ZwQuerySymbolicLinkObject@12
951 ZwQuerySystemInformation@16
954 ZwQueryVolumeInformationFile@20
957 ZwRequestWaitReplyPort@12
962 ZwSetInformationFile@20
963 ZwSetInformationObject@16
964 ZwSetInformationProcess@16
965 ZwSetInformationThread@16
966 ZwSetSystemInformation@12
972 ZwUnmapViewOfSection@8
973 ZwWaitForMultipleObjects@20
974 ZwWaitForSingleObject@12
977 _abnormal_termination