1 ; $Id: ntoskrnl.def,v 1.190 2004/09/16 10:25:17 gvg Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
18 CcGetFileObjectFromBcb@4
19 CcGetFileObjectFromSectionPtrs@4
20 CcGetFlushedValidData@8
21 CcGetLsnForFileObject@8
22 CcInitializeCacheMap@20
24 CcFastMdlReadWait DATA
25 CcFastReadNotPossible DATA
36 CcPurgeCacheSection@16
39 CcScheduleReadAhead@12
40 CcSetAdditionalCacheAttributes@12
41 CcSetBcbOwnerPointer@8
42 CcSetDirtyPageThreshold@8
43 CcSetDirtyPinnedData@8
44 CcSetLogHandleForFile@12
45 CcSetReadAheadGranularity@8
46 CcUninitializeCacheMap@12
48 CcUnpinDataForThread@8
50 CcWaitForCurrentLazyWriterActivity@0
55 CmUnRegisterCallback@8
57 DbgBreakPointWithStatus@4
58 DbgLoadImageSymbols@12
62 DbgPrintReturnControlC
63 DbgQueryDebugFilterState@8
64 DbgSetDebugFilterState@12
66 @ExAcquireFastMutexUnsafe@4
67 ExAcquireResourceExclusive@8
68 ExAcquireResourceExclusiveLite@8
69 ExAcquireResourceSharedLite@8
70 @ExAcquireRundownProtection@4
71 @ExAcquireRundownProtectionEx@8
72 ExAcquireSharedStarveExclusive@8
73 ExAcquireSharedWaitForExclusive@8
74 @ExAllocateFromPagedLookasideList@4=@ExiAllocateFromPagedLookasideList@4
76 ExAllocatePoolWithQuota@8
77 ExAllocatePoolWithQuotaTag@12
78 ExAllocatePoolWithTag@12
79 ExAllocatePoolWithTagPriority@16
80 ExConvertExclusiveToSharedLite@4
82 ExDeleteNPagedLookasideList@4
83 ExDeletePagedLookasideList@4
85 ExDeleteResourceLite@4
86 ExDesktopObjectType DATA
87 ExDisableResourceBoostLite@4
89 ExEventObjectType DATA
93 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
94 ExGetCurrentProcessorCounts@12
95 ExGetCurrentProcessorCpuUsage@4
96 ExGetExclusiveWaiterCount@4
98 ExGetSharedWaiterCount@4
99 @ExInitializeRundownProtection@4
100 ExInitializeNPagedLookasideList@28
101 ExInitializePagedLookasideList@28
102 ExInitializeResource@4
103 ExInitializeResourceLite@4
105 ExInterlockedAddLargeInteger@16
106 @ExInterlockedAddLargeStatistic@8
107 @ExInterlockedAddUlong@12
108 @ExInterlockedCompareExchange64@16
109 ExInterlockedDecrementLong@8
110 ExInterlockedExchangeUlong@12
111 ExInterlockedExtendZone@16
112 ExInterlockedIncrementLong@8
113 @ExInterlockedFlushSList@4
114 @ExInterlockedInsertHeadList@12
115 @ExInterlockedInsertTailList@12
116 @ExInterlockedPopEntryList@8
117 @ExInterlockedPopEntrySList@8
118 @ExInterlockedPushEntryList@12
119 @ExInterlockedPushEntrySList@12
120 @ExInterlockedRemoveHeadList@8
121 ExIsProcessorFeaturePresent@4
122 ExIsResourceAcquiredExclusiveLite@4
123 ExIsResourceAcquiredSharedLite@4
124 ExLocalTimeToSystemTime@8
127 ExQueryPoolBlockSize@8
129 ExRaiseAccessViolation@0
130 ExRaiseDatatypeMisalignment@0
134 ExRegisterCallback@12
135 ExReinitializeResourceLite@4
136 @ExReInitializeRundownProtection@4
137 @ExReleaseFastMutexUnsafe@4
138 ExReleaseResourceForThread@8
139 ExReleaseResourceForThreadLite@8
140 @ExReleaseResourceLite@4
141 @ExReleaseRundownProtection@4
142 @ExReleaseRundownProtectionEx@8
143 @ExRundownCompleted@4
144 ExSetResourceOwnerPointer@8
145 ExSetTimerResolution@8
146 ExSystemExceptionFilter@0
147 ExSystemTimeToLocalTime@8
148 ExTryToAcquireResourceExclusiveLite@4
149 ExUnregisterCallback@4
152 @ExWaitForRundownProtectionRelease@4
153 ExWindowStationObjectType DATA
154 ExInitializeBinaryTree@12
156 ExInsertBinaryTree@12
157 ExSearchBinaryTree@12
158 ExRemoveBinaryTree@12
159 ExTraverseBinaryTree@16
160 ExInitializeSplayTree@16
165 ExWeightOfSplayTree@8
166 ExTraverseSplayTree@16
167 ExInitializeHashTable@16
172 @ExfAcquirePushLockExclusive@4
173 @ExfAcquirePushLockShared@4
174 @ExfReleasePushLock@4
175 @ExfInterlockedAddUlong@12
176 @ExfInterlockedInsertHeadList@12
177 @ExfInterlockedInsertTailList@12
178 @ExfInterlockedCompareExchange64@12
179 @ExfInterlockedPopEntryList@8
180 @ExfInterlockedPushEntryList@12
181 @ExfInterlockedRemoveHeadList@8
182 @Exfi386InterlockedDecrementLong@4
183 @Exfi386InterlockedExchangeUlong@8
184 @Exfi386InterlockedIncrementLong@4
185 Exi386InterlockedDecrementLong@4
186 Exi386InterlockedExchangeUlong@8
187 Exi386InterlockedIncrementLong@4
188 FsRtlAcquireFileExclusive@4
189 FsRtlAddLargeMcbEntry@28
191 FsRtlAddToTunnelCache@32
192 FsRtlAllocateFileLock@8
194 FsRtlAllocatePoolWithQuota@8
195 FsRtlAllocatePoolWithQuotaTag@12
196 FsRtlAllocatePoolWithTag@12
197 FsRtlAllocateResource@0
198 FsRtlAreNamesEqual@16
200 FsRtlCheckLockForReadAccess@8
201 FsRtlCheckLockForWriteAccess@8
205 FsRtlCurrentBatchOplock@4
206 FsRtlDeleteKeyFromTunnelCache@12
207 FsRtlDeleteTunnelCache@4
208 FsRtlDeregisterUncProvider@4
211 FsRtlDoesDbcsContainWildCards@4
212 FsRtlDoesNameContainWildCards@4
213 FsRtlFastCheckLockForRead@24
214 FsRtlFastCheckLockForWrite@24
215 FsRtlFastUnlockAll@16
216 FsRtlFastUnlockAllByKey@20
217 FsRtlFastUnlockSingle@32
218 FsRtlFindInTunnelCache@32
221 FsRtlGetNextFileLock@8
222 FsRtlGetNextLargeMcbEntry@20
223 FsRtlGetNextMcbEntry@20
224 FsRtlIncrementCcFastReadNotPossible@0
225 FsRtlIncrementCcFastReadNoWait@0
226 FsRtlIncrementCcFastReadResourceMiss@0
227 FsRtlIncrementCcFastReadWait@0
228 FsRtlInitializeFileLock@12
229 FsRtlInitializeLargeMcb@8
231 FsRtlInitializeOplock@4
232 FsRtlInitializeTunnelCache@4
233 FsRtlInsertPerFileObjectContext@8
234 FsRtlInsertPerStreamContext@8
235 FsRtlIsDbcsInExpression@8
236 FsRtlIsFatDbcsLegal@20
237 FsRtlIsHpfsDbcsLegal@20
238 FsRtlIsNameInExpression@16
239 FsRtlIsNtstatusExpected@4
241 FsRtlIsTotalDeviceFailure@4
242 FsRtlLegalAnsiCharacterArray DATA
243 FsRtlLookupLargeMcbEntry@32
244 FsRtlLookupLastLargeMcbEntry@12
245 FsRtlLookupLastLargeMcbEntryAndInde@16=FsRtlLookupLastLargeMcbEntryAndIndex@16
246 FsRtlLookupLastMcbEntry@12
247 FsRtlLookupMcbEntry@20
248 FsRtlLookupPerFileObjectContext@12
249 FsRtlLookupPerStreamContextInternal@12
251 FsRtlMdlReadComplete@8
252 FsRtlMdlReadCompleteDev@12
254 FsRtlMdlWriteComplete@12
255 FsRtlMdlWriteCompleteDev@16
256 FsRtlNormalizeNtstatus@8
257 FsRtlNotifyChangeDirectory@28
258 FsRtlNotifyCleanup@12
259 FsRtlNotifyFilterChangeDirectory@44
260 FsRtlNotifyFilterReportChange@40
261 FsRtlNotifyFullChangeDirectory@40
262 FsRtlNotifyFullReportChange@36
263 FsRtlNotifyInitializeSync@4
264 FsRtlNotifyReportChange@20
265 FsRtlNotifyUninitializeSync@4
266 FsRtlNotifyVolumeEvent@8
267 FsRtlNumberOfRunsInLargeMcb@4
268 FsRtlNumberOfRunsInMcb@4
270 FsRtlOplockIsFastIoPossible@4
271 FsRtlPostPagingFileStackOverflow@12
272 FsRtlPostStackOverflow@12
273 FsRtlPrepareMdlWrite@24
274 FsRtlPrepareMdlWriteDev@28
276 FsRtlProcessFileLock@12
277 FsRtlRegisterUncProvider@12
279 FsRtlRemoveLargeMcbEntry@20
280 FsRtlRemoveMcbEntry@12
281 FsRtlRemovePerFileObjectContext@12
282 FsRtlRemovePerStreamContext@12
284 FsRtlSplitLargeMcb@20
286 FsRtlTruncateLargeMcb@12
288 FsRtlUninitializeFileLock@4
289 FsRtlUninitializeLargeMcb@4
290 FsRtlUninitializeMcb@4
291 FsRtlUninitializeOplock@4
292 HalDispatchTable DATA
293 HalPrivateDispatchTable DATA
294 @HalExamineMBR=@xHalExamineMBR@16
295 InbvAcquireDisplayOwnership@0
296 InbvCheckDisplayOwnership@0
298 InbvEnableBootDriver@4
299 InbvEnableDisplayString@4
300 InbvInstallDisplayStringFilter@4
301 InbvIsBootDriverInstalled@0
302 InbvNotifyDisplayOwnershipLost@4
304 InbvSetScrollRegion@16
306 InbvSolidColorFill@20
307 @InterlockedCompareExchange@12
308 @InterlockedDecrement@4
309 @InterlockedExchange@8
310 @InterlockedExchangeAdd@8
311 @InterlockedIncrement@4
312 @InterlockedPushEntrySList@8
313 @InterlockedPopEntrySList@4
314 IoAcquireCancelSpinLock@4
315 IoAcquireRemoveLockEx@20
316 IoAcquireVpbSpinLock@4
317 IoAdapterObjectType DATA
318 IoAllocateAdapterChannel@20
321 IoAllocateController@16
322 IoAllocateDriverObjectExtension@16
323 IoAllocateErrorLogEntry@8
325 IoAssignDriveLetters@16
328 IoAttachDeviceByPointer@8
329 IoAttachDeviceToDeviceStack@8
330 IoAttachDeviceToDeviceStackSafe@12
331 IoBuildAsynchronousFsdRequest@24
332 IoBuildDeviceIoControlRequest@36
334 IoBuildSynchronousFsdRequest@28
338 IoCheckDesiredAccess@8
339 IoCheckEaBufferValidity@12
340 IoCheckFunctionAccess@24
341 IoCheckQuerySetFileInformation@12
342 IoCheckQuerySetVolumeInformation@12
343 IoCheckQuotaBufferValidity@12
344 IoCheckShareAccess@20
346 IoConnectInterrupt@44
352 IoCreateFileSpecifyDeviceObjectHint@60
353 IoCreateNotificationEvent@8
354 IoCreateStreamFileObject@8
355 IoCreateStreamFileObjectEx@12
356 IoCreateStreamFileObjectLite@8
357 IoCreateSymbolicLink@8
358 IoCreateSynchronizationEvent@8
359 IoCreateUnprotectedSymbolicLink@8
363 IoDeleteSymbolicLink@4
365 IoDeviceHandlerObjectSize DATA
366 IoDeviceHandlerObjectType DATA
367 IoDeviceObjectType DATA
368 IoDisconnectInterrupt@4
369 IoDriverObjectType DATA
371 IoEnumerateDeviceObjectList@16
372 IoFastQueryNetworkAttributes@20
373 IoFileObjectType DATA
374 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
375 IoForwardIrpSynchronously@8
377 IoFreeErrorLogEntry@4
381 IoGetAttachedDevice@4
382 IoGetAttachedDeviceReference@4
383 IoGetBaseFileSystemDeviceObject@4
384 IoGetBootDiskInformation@8
385 IoGetConfigurationInformation@0
386 IoGetCurrentProcess@0
387 IoGetDeviceObjectPointer@16
388 IoGetDeviceAttachmentBaseRef@4
389 IoGetDeviceInterfaceAlias@12
390 IoGetDeviceInterfaces@16
391 IoGetDriverObjectExtension@8
392 IoGetDeviceProperty@20
393 IoGetDeviceToVerify@4
394 IoGetDiskDeviceObject@8
396 IoGetFileObjectGenericMapping@0
398 IoGetLowerDeviceObject@4
399 IoGetRelatedDeviceObject@4
400 IoGetRequestorProcess@4
401 IoGetRequestorProcessId@4
402 IoGetRequestorSessionId@8
406 IoInvalidateDeviceRelations@8
407 IoInvalidateDeviceState@4
408 IoInitializeRemoveLockEx@20
410 IoIsFileOriginRemote@4
412 IoIsValidNameGraftingBuffer@8
413 IoIsOperationSynchronous@4
414 IoMakeAssociatedIrp@8
415 IoOpenDeviceInstanceKey@20
416 IoOpenDeviceInterfaceRegistryKey@12
417 IoOpenDeviceRegistryKey@16
419 IoPnPDeliverServicePowerNotification@16
420 IoQueryDeviceDescription@32
421 IoQueryDeviceEnumInfo@8
422 IoQueryFileDosDeviceName@8
423 IoQueryFileInformation@20
424 IoQueryVolumeInformation@20
428 IoRaiseInformationalHardError@12
429 IoReadDiskSignature@12
430 IoReadOperationCount DATA
431 IoReadPartitionTable@16
432 IoReadPartitionTableEx@8
433 IoReadTransferCount DATA
434 IoRegisterBootDriverReinitialization@12
435 IoRegisterDeviceInterface@16
436 IoRegisterDriverReinitialization@12
437 IoRegisterFileSystem@4
438 IoRegisterFsRegistrationChange@8
439 IoRegisterLastChanceShutdownNotification@4
440 IoRegisterPlugPlayNotification@28
441 IoRegisterShutdownNotification@4
442 IoReleaseCancelSpinLock@4
443 IoReleaseRemoveLockAndWaitEx@12
444 IoReleaseRemoveLockEx@12
445 IoReleaseVpbSpinLock@4
446 IoRemoveShareAccess@8
447 IoReportDetectedDevice@32
448 IoReportHalResourceUsage@16
449 IoReportResourceUsage@36
450 IoReportResourceForDetection@28
451 IoReportTargetDeviceChange@8
452 IoReportTargetDeviceChangeAsynchronous@16
453 IoRequestDeviceEject@4
455 IoSetCompletionRoutineEx@28
456 IoSetSystemPartition@4
457 IoSetDeviceInterfaceState@8
458 IoSetDeviceToVerify@8
460 IoSetHardErrorOrVerifyDevice@8
463 IoSetPartitionInformation@16
464 IoSetPartitionInformationEx@12
465 IoSetStartIoAttributes@12
467 IoSetThreadHardErrorMode@4
470 IoStartNextPacketByKey@12
473 IoStatisticsLock DATA
475 IoSynchronousPageWrite@20
476 IoSynchronousInvalidateDeviceRelations@8
478 IoUnregisterFileSystem@4
479 IoUnregisterFsRegistrationChange@8
480 IoUnregisterPlugPlayNotification@4
481 IoUnregisterShutdownNotification@4
482 IoUpdateShareAccess@8
483 IoValidateDeviceIoControlAccess@8
484 IoVerifyPartitionTable@8
486 IoVolumeDeviceToDosName@8
487 IoWMIAllocateInstanceIds@12
488 IoWMIDeviceObjectToInstanceName@12
489 IoWMIExecuteMethod@24
490 IoWMIHandleToInstanceName@12
493 IoWMIQueryAllDataMultiple@16
494 IoWMIQuerySingleInstance@16
495 IoWMIQuerySingleInstanceMultiple@20
496 IoWMIRegistrationControl@8
497 IoWMISetNotificationCallback@12
498 IoWMISetSingleInstance@20
499 IoWMISetSingleItem@24
500 IoWMISuggestInstanceName@16
502 IoWriteErrorLogEntry@4
503 IoWriteOperationCount DATA
504 IoWritePartitionTable@20
505 IoWritePartitionTableEx@8
506 IoWriteTransferCount DATA
508 @IofCompleteRequest@8
509 IoIsWdmVersionAvailable@8
510 KdDebuggerEnabled DATA
511 KdDebuggerNotPresent DATA
517 KdSystemDebugControl@4
519 Ke386IoSetAccessProcess@8
520 Ke386QueryIoAccessMap@8
521 Ke386SetIoAccessMap@8
522 KeAcquireSpinLockAtDpcLevel@4
523 KeAcquireDispatcherDatabaseLockAtDpcLevel
524 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
525 KeAcquireInterruptSpinLock@4
526 KeAddSystemServiceTable@20
529 ;KeBoostCurrentThread
533 KeCapturePersistentThreadState@28
536 KeDcacheFlushCount DATA
537 KeDelayExecutionThread@12
538 KeDeregisterBugCheckCallback@4
539 KeDeregisterBugCheckReasonCallback@4
541 KeDisconnectInterrupt@4
542 KeEnterCriticalRegion@0
543 KeEnterKernelDebugger@0
544 KeFindConfigurationEntry@16
545 KeFindConfigurationNextEntry@20
550 KeGetRecommendedSharedDataAlignment@0
551 KeI386AllocateGdtSelectors
552 KeI386FlatToGdtSelector
553 KeI386ReleaseGdtSelectors
555 ;KeI386AllocateGdtSelectors
556 ;KeI386Call16BitCStyleFunction
557 ;KeI386Call16BitFunction
558 ;KeI386FlatToGdtSelector
560 ;KeI386MachineType DATA
561 ;KeI386ReleaseGdtSelectors
563 ;KeI386SetGdtSelector
564 KeIcacheFlushCount DATA
566 KeInitializeDeviceQueue@4
569 KeInitializeInterrupt@44
573 KeInitializeSemaphore@12
574 KeInitializeSpinLock@4
576 KeInitializeTimerEx@8
577 KeInsertByKeyDeviceQueue@12
578 KeInsertDeviceQueue@8
583 KeIsAttachedProcess@0
585 KeLeaveCriticalRegion@0
587 KeNumberProcessors DATA
589 KeProfileInterruptWithSource@8
591 KeQueryActiveProcessors@0
592 KeQueryInterruptTime@0
593 KeQueryPriorityThread@4
594 KeQueryRuntimeThread@8
597 KeQueryTimeIncrement@0
598 KeRaiseUserException@4
604 KeReadStateSemaphore@4
606 KeRegisterBugCheckCallback@20
607 KeRegisterBugCheckReasonCallback@16
608 KeReleaseDispatcherDatabaseLockFromDpcLevel
609 KeReleaseInterruptSpinLock@8
610 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
613 KeReleaseSemaphore@16
614 KeReleaseSpinLockFromDpcLevel@4
615 KeRemoveByKeyDeviceQueue@8
616 KeRemoveByKeyDeviceQueueIfBusy@8
617 KeRemoveDeviceQueue@4
618 KeRemoveEntryDeviceQueue@8
621 KeRemoveSystemServiceTable@4
623 KeRestoreFloatingPointState@4
624 KeRevertToUserAffinityThread@0
626 KeSaveFloatingPointState@4
627 KeSaveStateForHibernate
628 KeServiceDescriptorTable DATA
629 KeSetAffinityThread@8
630 KeSetBasePriorityThread@8
631 KeSetDmaIoCoherency@4
633 KeSetEventBoostPriority@8
634 KeSetIdealProcessorThread@8
636 KeSetKernelStackSwapEnable@4
637 KeSetPriorityThread@8
639 KeSetSystemAffinityThread@4
640 ;KeSetSwapContextNotifyRoutine
641 KeSetTargetProcessorDpc@8
642 ;KeSetThreadSelectNotifyRoutine
644 @KeSetTimeUpdateNotifyRoutine@4
645 KeStackAttachProcess@8
648 ;KeSetTimeUpdateNotifyRoutine
649 KeSynchronizeExecution@12
654 KeUnstackDetachProcess@4
655 KeUserModeCallback@20
656 KeWaitForMultipleObjects@32
657 KeWaitForMutexObject@20
658 KeWaitForSingleObject@20
659 @KefAcquireSpinLockAtDpcLevel@4
660 @KefReleaseSpinLockFromDpcLevel@4
666 KiDispatchInterrupt@0
667 KiEnableTimerWatchdog
668 KiInterruptDispatch2@8
669 KiIpiServiceRoutine@8
671 KiUnexpectedInterrupt@0
672 ;Kii386SpinOnSpinLock
676 LdrFindResourceDirectory_U@16
679 LpcRequestWaitReplyPort@12
680 LsaCallAuthenticationPackage@28
681 LsaDeregisterLogonProcess@8
682 LsaFreeReturnBuffer@4
684 LsaLookupAuthenticationPackage@12
685 LsaRegisterLogonProcess@12
686 Mm64BitPhysicalAddress DATA
687 MmAddPhysicalMemory@8
688 MmAddVerifierThunks@8
689 MmAdjustWorkingSetSize@12
691 MmAllocateContiguousAlignedMemory@36
692 MmAllocateContiguousMemory@12
693 MmAllocateContiguousMemorySpecifyCache@32
694 MmAllocateMappingAddress@8
695 MmAllocateNonCachedMemory@4
696 MmAllocatePagesForMdl@28
697 MmBuildMdlForNonPagedPool@4
698 MmCanFileBeTruncated@8
703 MmDbgTranslatePhysicalAddress@8
704 MmDisableModifiedWriteOfSection@4
705 MmFlushImageSection@8
706 MmForceSectionClosed@8
707 MmFreeContiguousMemory@4
708 MmFreeContiguousMemorySpecifyCache@12
709 MmFreeMappingAddress@8
710 MmFreeNonCachedMemory@8
712 MmGetPhysicalAddress@4
713 MmGetPhysicalMemoryRanges@0
714 MmGetSystemRoutineAddress@4
715 MmGetVirtualForPhysical@8
717 MmHighestUserAddress DATA
719 MmIsDriverVerifying@4
720 MmIsNonPagedSystemAddressValid@4
721 MmIsRecursiveIoFault@0
722 MmIsThisAnNtAsSystem@0
723 MmIsVerifierEnabled@4
724 MmLockPagableDataSection@4
725 MmLockPagableImageSection@4=MmLockPagableDataSection@4
726 MmLockPagableSectionByHandle@4
729 MmMapLockedPagesSpecifyCache@24
730 MmMapLockedPagesWithReservedMapping@16
732 MmMapUserAddressesToPage@12
734 MmMapViewInSessionSpace@12
735 MmMapViewInSystemSpace@12
736 MmMapViewOfSection@40
737 MmMarkPhysicalMemoryAsBad@8
738 MmMarkPhysicalMemoryAsGood@8
741 MmProbeAndLockPages@12
742 MmProbeAndLockProcessPages@16
743 MmProbeAndLockSelectedPages@16
744 MmProtectMdlSystemAddress@8
746 MmRemovePhysicalMemory@8
747 MmResetDriverPaging@4
748 MmSectionObjectType DATA
749 MmSecureVirtualMemory@12
750 MmSetAddressRangeModified@8
751 MmSetBankedSection@24
753 MmSystemRangeStart DATA
754 MmTrimAllSystemPagableMemory@4
755 MmUnlockPagableImageSection@4
759 MmUnmapReservedMapping@12
760 MmUnmapVideoDisplay@8
761 MmUnmapViewInSessionSpace@4
762 MmUnmapViewInSystemSpace@4
763 MmUnmapViewOfSection@8
764 MmUnsecureVirtualMemory@4
765 MmUserProbeAddress DATA
768 NlsMbCodePageTag DATA
769 NlsMbOemCodePageTag DATA
770 NlsOemLeadByteInfo DATA
772 NtAdjustPrivilegesToken@24
774 NtAllocateLocallyUniqueId@4
776 NtAllocateVirtualMemory@24
787 NtDeviceIoControlFile@40
791 NtFreeVirtualMemory@16
795 NtMakePermanentObject@4
796 NtMapViewOfSection@40
797 NtNotifyChangeDirectoryFile@36
800 NtOpenProcessToken@12
801 NtOpenProcessTokenEx@16
804 NtOpenThreadTokenEx@20
805 NtQueryDirectoryFile@44
807 NtQueryInformationAtom@20
808 NtQueryInformationFile@20
809 NtQueryInformationProcess@20
810 NtQueryInformationThread@20
811 NtQueryInformationToken@20
812 ;NtQueryOleDirectoryFile@44 <--- ?
813 NtQueryQuotaInformationFile@36
814 NtQuerySecurityObject@20
815 NtQuerySystemInformation@16
817 NtQueryVolumeInformationFile@20
820 NtRequestWaitReplyPort@12
823 NtSetInformationFile@20
824 NtSetInformationProcess@16
825 NtSetInformationThread@16
826 NtSetQuotaInformationFile@16
827 NtSetSecurityObject@12
828 NtSetVolumeInformationFile@20
835 NtWaitForSingleObject@12
838 ;ObCheckCreateObjectAccess@28
839 ;ObCheckObjectAccess@20
841 ;ObFindHandleForObject@20
842 ObGetObjectPointerCount@4
843 ObGetObjectSecurity@12
845 ObMakeTemporaryObject@4
846 ObOpenObjectByName@28
847 ObOpenObjectByPointer@28
849 ObQueryObjectAuditingByHandle@8
850 @ObfDereferenceObject@4
851 @ObfReferenceObject@4
852 ObReferenceObjectByHandle@24
853 ObReferenceObjectByName@32
854 ObReferenceObjectByPointer@16
855 ObReleaseObjectSecurity@8
856 ObDereferenceObject@4
857 ;ObSetSecurityDescriptorInfo@24
863 PoRegisterDeviceForIdleDetection@16
864 PoRegisterSystemState@8
869 PoStartNextPowerIrp@4
870 PoUnregisterSystemState@4
873 PsAssignImpersonationToken@8
875 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
876 PsChargeProcessPagedPoolQuota@8
877 PsChargeProcessPoolQuota@12
878 PsCreateSystemProcess@12
879 PsCreateSystemThread@28
880 PsCreateWin32Process@4
881 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
882 PsDereferencePrimaryToken@4
883 PsDisableImpersonation@8
884 PsEstablishWin32Callouts@24
885 PsGetCurrentProcessId@0
886 PsGetCurrentProcessSessionId@0
887 PsGetCurrentThreadId@0
888 PsGetCurrentThreadPreviousMode@0
889 PsGetCurrentThreadStackBase@0
890 PsGetCurrentThreadStackLimit@0
893 PsGetJobUIRestrictionsClass@4
894 PsGetProcessCreateTimeQuadPart@4
895 PsGetProcessDebugPort@4
896 PsGetProcessExitProcessCalled@4
897 PsGetProcessExitStatus@4
898 PsGetProcessExitTime@0
900 PsGetProcessImageFileName@4
901 PsGetProcessInheritedFromUniqueProcessId@4
904 PsGetProcessPriorityClass@4
905 PsGetProcessSectionBaseAddress@4
906 PsGetProcessSecurityPort@4
907 PsGetProcessSessionId@4
908 PsGetProcessWin32Process@4
909 PsGetProcessWin32WindowStation@4
910 PsGetThreadFreezeCount@4
911 PsGetThreadHardErrorsAreDisabled@4
914 PsGetThreadProcessId@4
915 PsGetThreadSessionId@4
917 PsGetThreadWin32Thread@4
921 PsImpersonateClient@20
922 PsInitialSystemProcess DATA
923 PsIsProcessBeingDebugged@4
925 PsIsThreadImpersonating@4
926 PsIsThreadTerminating@4
928 PsLookupProcessByProcessId@8
929 PsLookupProcessThreadByCid@12
930 PsLookupThreadByThreadId@8
932 PsReferenceImpersonationToken@16
933 PsReferencePrimaryToken@4
934 PsRemoveCreateThreadNotifyRoutine@4
935 PsRemoveLoadImageNotifyRoutine@4
936 PsRestoreImpersonation@8
938 PsReturnProcessNonPagedPoolQuota@8
939 PsReturnProcessPagedPoolQuota@8
941 PsRevertThreadToSelf@4
942 PsSetCreateProcessNotifyRoutine@8
943 PsSetCreateThreadNotifyRoutine@4
944 PsSetJobUIRestrictionsClass@8
945 PsSetLegoNotifyRoutine@4
946 PsSetProcessPriorityClass@8
947 PsSetProcessSecurityPort@8
948 PsSetProcessWin32Process@8
949 PsSetProcessWin32WindowStation@8
950 PsSetThreadHardErrorsAreDisabled@8
951 PsSetThreadWin32Thread@8
952 PsSetLoadImageNotifyRoutine@4
953 PsTerminateSystemThread@4
955 READ_REGISTER_UCHAR@4
956 READ_REGISTER_ULONG@4
957 READ_REGISTER_USHORT@4
958 READ_REGISTER_BUFFER_UCHAR@12
959 READ_REGISTER_BUFFER_ULONG@12
960 READ_REGISTER_BUFFER_USHORT@12
962 KeRosDumpStackFrames@8
963 RtlAbsoluteToSelfRelativeSD@12
964 RtlAddAccessAllowedAce@16
966 RtlAddAtomToAtomTable@12
968 ;RtlAllocateAndInitializeSid
970 RtlAnsiCharToUnicodeChar@4
971 RtlAnsiStringToUnicodeSize@4
972 RtlAnsiStringToUnicodeString@12
973 RtlAppendAsciizToString@8
974 RtlAppendStringToString@8
975 RtlAppendUnicodeStringToString@8
976 RtlAppendUnicodeToString@8
977 RtlAreAllAccessesGranted@8
978 RtlAreAnyAccessesGranted@8
983 RtlCaptureStackBackTrace@16
985 RtlCheckRegistryKey@8
990 RtlCompareMemoryUlong@12
992 RtlCompareUnicodeString@12
995 RtlConvertLongToLargeInteger@4
996 RtlConvertSidToUnicodeString@12
997 RtlConvertUlongToLargeInteger@4
1002 RtlCopyUnicodeString@8
1004 RtlCreateAtomTable@8
1006 RtlCreateRegistryKey@8
1007 RtlCreateSecurityDescriptor@8
1008 RtlCreateSystemVolumeInformationFolder@4
1009 RtlCreateUnicodeString@8
1010 RtlCustomCPToUnicodeN@24
1011 RtlDecompressBuffer@24
1012 RtlDecompressChunks@28
1013 RtlDecompressFragment@32
1016 RtlDeleteAtomFromAtomTable@8
1017 RtlDeleteElementGenericTable@8
1018 RtlDeleteElementGenericTableAvl@8
1020 RtlDeleteOwnersRanges@8
1022 RtlDeleteRegistryValue@12
1024 RtlDestroyAtomTable@4
1026 RtlDowncaseUnicodeString@12
1028 RtlEnlargedIntegerMultiply@8
1029 RtlEnlargedUnsignedDivide@16
1030 RtlEnlargedUnsignedMultiply@8
1031 RtlEnumerateGenericTable@8
1032 RtlEnumerateGenericTableAvl@8
1033 RtlEnumerateGenericTableLikeADirectory@28
1034 RtlEnumerateGenericTableWithoutSplaying@8
1035 RtlEnumerateGenericTableWithoutSplayingAvl@8
1039 RtlEqualUnicodeString@12
1040 RtlExtendedIntegerMultiply@12
1041 RtlExtendedLargeIntegerDivide@16
1042 RtlExtendedMagicDivide@20
1044 RtlFillMemoryUlong@12
1046 RtlFindClearBitsAndSet@12
1048 RtlFindFirstRunClear@8
1049 RtlFindFirstRunSet@8
1050 RtlFindLastBackwardRunClear@12
1051 RtlFindLeastSignificantBit@8
1052 RtlFindLongestRunClear@8
1053 RtlFindLongestRunSet@8
1055 RtlFindMostSignificantBit@8
1056 RtlFindNextForwardRunClear@12
1059 RtlFindSetBitsAndClear@12
1060 RtlFindUnicodePrefix@12
1061 RtlFormatCurrentUserKeyPath@4
1066 RtlFreeUnicodeString@4
1068 RtlGenerate8dot3Name@16
1070 RtlGetCallersAddress@8
1071 RtlGetCompressionWorkSpaceSize@12
1072 RtlGetDaclSecurityDescriptor@16
1073 RtlGetDefaultCodePage@8
1074 RtlGetElementGenericTable@8
1075 RtlGetElementGenericTableAvl@8
1077 RtlGetGroupSecurityDescriptor@12
1079 RtlGetNtGlobalFlags@0
1080 RtlGetOwnerSecurityDescriptor@12
1081 RtlGetSaclSecurityDescriptor@16
1082 RtlGetSetBootStatusData@24
1084 RtlHashUnicodeString@16
1086 RtlImageDirectoryEntryToData@16
1088 RtlInitCodePageTable@8
1090 RtlInitUnicodeString@8
1091 RtlInitializeBitMap@12
1092 RtlInitializeGenericTable@20
1093 RtlInitializeGenericTableAvl@20
1094 RtlInitializeRangeList@4
1096 RtlInitializeUnicodePrefix@4
1097 RtlInsertElementGenericTable@16
1098 RtlInsertElementGenericTableAvl@16
1099 RtlInsertElementGenericTableFull@24
1100 RtlInsertElementGenericTableFullAvl@24
1101 RtlInsertUnicodePrefix@12
1102 RtlInt64ToUnicodeString@16
1104 RtlIntegerToUnicode@16
1105 RtlIntegerToUnicodeString@12
1106 RtlInvertRangeList@8
1107 RtlIpv4AddressToStringA@8
1108 RtlIpv4AddressToStringExA@16
1109 RtlIpv4AddressToStringExW@16
1110 RtlIpv4AddressToStringW@8
1111 RtlIpv4StringToAddressA@16
1112 RtlIpv4StringToAddressExA@16
1113 RtlIpv4StringToAddressExW@16
1114 RtlIpv4StringToAddressW@16
1115 RtlIpv6AddressToStringA@8
1116 RtlIpv6AddressToStringExA@16
1117 RtlIpv6AddressToStringExW@16
1118 RtlIpv6AddressToStringW@8
1119 RtlIpv6StringToAddressA@16
1120 RtlIpv6StringToAddressExA@16
1121 RtlIpv6StringToAddressExW@16
1122 RtlIpv6StringToAddressW@16
1123 RtlIsGenericTableEmpty@4
1124 RtlIsGenericTableEmptyAvl@4
1125 RtlIsNameLegalDOS8Dot3@12
1126 RtlIsRangeAvailable@40
1127 RtlIsValidOemCharacter@4
1128 RtlLargeIntegerAdd@16
1129 RtlLargeIntegerArithmeticShift@12
1130 RtlLargeIntegerDivide@20
1131 RtlLargeIntegerNegate@8
1132 RtlLargeIntegerShiftLeft@12
1133 RtlLargeIntegerShiftRight@12
1134 RtlLargeIntegerSubtract@16
1135 RtlLengthRequiredSid@4
1136 RtlLengthSecurityDescriptor@4
1138 RtlLockBootStatusData@4
1139 RtlLookupAtomInAtomTable@12
1140 RtlLookupElementGenericTable@8
1141 RtlLookupElementGenericTableAvl@8
1142 RtlLookupElementGenericTableFull@16
1143 RtlLookupElementGenericTableFullAvl@16
1145 RtlMapSecurityErrorToNtStatus@4
1146 RtlMergeRangeLists@16
1148 RtlMultiByteToUnicodeN@20
1149 RtlMultiByteToUnicodeSize@12
1150 RtlNextUnicodePrefix@8
1151 RtlNtStatusToDosError@4
1152 RtlNtStatusToDosErrorNoTeb@4
1153 RtlNumberGenericTableElements@4
1154 RtlNumberGenericTableElementsAvl@4
1155 RtlNumberOfClearBits@4
1156 RtlNumberOfSetBits@4
1157 RtlOemStringToCountedUnicodeString@12
1158 RtlOemStringToUnicodeSize@4
1159 RtlOemStringToUnicodeString@12
1161 RtlPinAtomInAtomTable@8
1162 @RtlPrefetchMemoryNonTemporal@8
1164 RtlPrefixUnicodeString@12
1165 RtlQueryAtomInAtomTable@24
1166 RtlQueryRegistryValues@20
1167 RtlQueryTimeZoneInformation@4
1171 RtlRealPredecessor@4
1173 RtlRemoveUnicodePrefix@8
1175 RtlSecondsSince1970ToTime@8
1176 RtlSecondsSince1980ToTime@8
1177 RtlSelfRelativeToAbsoluteSD2@8
1178 RtlSelfRelativeToAbsoluteSD@44
1182 RtlSetDaclSecurityDescriptor@16
1183 RtlSetGroupSecurityDescriptor@12
1184 RtlSetOwnerSecurityDescriptor@12
1185 RtlSetSaclSecurityDescriptor@16
1186 RtlSetTimeZoneInformation@4
1190 RtlSubAuthorityCountSid@4
1191 RtlSubAuthoritySid@8
1192 RtlSubtreePredecessor@4
1193 RtlSubtreeSuccessor@4
1195 RtlTimeFieldsToTime@8
1196 RtlTimeToElapsedTimeFields@8
1197 RtlTimeToSecondsSince1970@8
1198 RtlTimeToSecondsSince1980@8
1199 RtlTimeToTimeFields@8
1201 @RtlUlonglongByteSwap@8
1202 RtlUnicodeStringToAnsiSize@4
1203 RtlUnicodeStringToAnsiString@12
1204 RtlUnicodeStringToCountedOemString@12
1205 RtlUnicodeStringToInteger@12
1206 RtlUnicodeStringToOemSize@4
1207 RtlUnicodeStringToOemString@12
1208 RtlUnicodeToCustomCPN@24
1209 RtlUnicodeToMultiByteN@20
1210 RtlUnicodeToMultiByteSize@12
1212 RtlUnlockBootStatusData@4
1214 RtlUpcaseUnicodeChar@4
1215 RtlUpcaseUnicodeString@12
1216 RtlUpcaseUnicodeStringToAnsiString@12
1217 RtlUpcaseUnicodeStringToCountedOemString@12
1218 RtlUpcaseUnicodeStringToOemString@12
1219 RtlUpcaseUnicodeToCustomCPN@24
1220 RtlUpcaseUnicodeToMultiByteN@20
1221 RtlUpcaseUnicodeToOemN@20
1224 @RtlUshortByteSwap@4
1225 RtlValidRelativeSecurityDescriptor@12
1226 RtlValidSecurityDescriptor@4
1228 ;RtlVerifyVersionInfo@16
1229 RtlVolumeDeviceToDosName@8
1230 RtlWalkFrameChain@12
1231 RtlWriteRegistryValue@24
1234 RtlxAnsiStringToUnicodeSize@4
1235 RtlxOemStringToUnicodeSize@4
1236 RtlxUnicodeStringToAnsiSize@4
1237 RtlxUnicodeStringToOemSize@4
1239 SeAppendPrivileges@8
1241 SeAssignSecurityEx@36
1242 SeAuditHardLinkCreation@12
1243 SeAuditingFileEvents@8
1244 SeAuditingFileEventsWithContext@12
1245 SeAuditingFileOrGlobalEvents@12
1246 SeAuditingHardLinkEvents@8
1247 SeAuditingHardLinkEventsWithContext@12
1248 SeCaptureSecurityDescriptor@20
1249 SeCaptureSubjectContext@4
1250 SeCloseObjectAuditAlarm@12
1251 SeCreateAccessState@16
1252 SeCreateClientSecurity@16
1253 SeCreateClientSecurityFromSubjectContext@16
1254 SeDeassignSecurity@4
1255 SeDeleteAccessState@4
1256 SeDeleteObjectAuditAlarm@8
1260 SeImpersonateClient@8
1261 SeImpersonateClientEx@8
1262 SeLockSubjectContext@4
1263 SeMarkLogonSessionForTerminationNotification@4
1264 SeOpenObjectAuditAlarm@36
1265 SeOpenObjectForDeleteAuditAlarm@36
1267 SePrivilegeObjectAuditAlarm@24
1268 SePublicDefaultDacl DATA
1269 SeQueryAuthenticationIdToken@8
1270 SeQueryInformationToken@12
1271 SeQuerySecurityDescriptorInfo@16
1272 SeQuerySessionIdToken@8
1273 SeRegisterLogonSessionTerminatedRoutine@4
1274 SeReleaseSecurityDescriptor@12
1275 SeReleaseSubjectContext@4
1276 SeSetAccessStateGenericMapping@8
1277 SeSetSecurityDescriptorInfo@24
1278 SeSetSecurityDescriptorInfoEx@28
1279 SeSinglePrivilegeCheck@12
1280 SeSystemDefaultDacl DATA
1281 SeTokenImpersonationLevel@4
1283 SeTokenIsRestricted@4
1284 SeTokenIsWriteRestricted@4
1286 SeUnlockSubjectContext@4
1287 SeUnregisterLogonSessionTerminatedRoutine@4
1288 SeValidSecurityDescriptor@8
1289 WRITE_REGISTER_UCHAR@8
1290 WRITE_REGISTER_ULONG@8
1291 WRITE_REGISTER_USHORT@8
1292 WRITE_REGISTER_BUFFER_UCHAR@12
1293 WRITE_REGISTER_BUFFER_ULONG@12
1294 WRITE_REGISTER_BUFFER_USHORT@12
1295 ZwAccessCheckAndAuditAlarm@44
1297 ZwAllocateVirtualMemory@24
1300 ZwCloseObjectAuditAlarm@12
1302 ZwCreateDirectoryObject@12
1307 ZwCreateSymbolicLinkObject@16
1311 ZwDeviceIoControlFile@40
1313 ZwDuplicateObject@28
1316 ZwEnumerateValueKey@24
1317 ZwFlushInstructionCache@12
1319 ZwFreeVirtualMemory@16
1323 ZwMakeTemporaryObject@4
1324 ZwMapViewOfSection@40
1325 ZwNotifyChangeKey@40
1326 ZwOpenDirectoryObject@12
1331 ZwOpenProcessToken@12
1333 ZwOpenSymbolicLinkObject@12
1335 ZwOpenThreadToken@16
1337 ZwQueryDefaultLocale@8
1338 ZwQueryDirectoryFile@44
1339 ZwQueryInformationAtom@20
1340 ZwQueryInformationFile@20
1341 ZwQueryInformationProcess@20
1342 ZwQueryInformationToken@20
1346 ZwQuerySecurityObject@20
1347 ZwQuerySymbolicLinkObject@12
1348 ZwQuerySystemInformation@16
1351 ZwQueryVolumeInformationFile@20
1354 ZwRequestWaitReplyPort@12
1357 ZwSetDefaultLocale@8
1359 ZwSetInformationFile@20
1360 ZwSetInformationObject@16
1361 ZwSetInformationProcess@16
1362 ZwSetInformationThread@16
1363 ZwSetSystemInformation@12
1366 ZwTerminateProcess@8
1369 ZwUnmapViewOfSection@8
1370 ZwWaitForMultipleObjects@20
1371 ZwWaitForSingleObject@12
1375 ZwAdjustPrivilegesToken@24
1376 ZwAssignProcessToJobObject@8
1379 ZwCreateJobObject@12
1382 ZwEnumerateBootEntries@8
1383 ZwFlushVirtualMemory@16
1384 ZwInitiatePowerAction@16
1387 ZwOpenProcessTokenEx@16
1388 ZwOpenThreadTokenEx@20
1390 ZwPowerInformation@20
1391 ZwQueryBootEntryOrder@8
1392 ZwQueryBootOptions@8
1393 ZwQueryDefaultUILanguage@4
1394 ZwQueryDirectoryObject@28
1396 ZwQueryFullAttributesFile@8
1397 ZwQueryInformationJobObject@20
1398 ZwQueryInformationThread@20
1399 ZwQueryInstallUILanguage@4
1402 ZwSetBootEntryOrder@8
1404 ZwSetDefaultUILanguage@4
1406 ZwSetInformationJobObject@16
1407 ZwSetSecurityObject@12
1409 ZwSetVolumeInformationFile@20
1410 ZwTerminateJobObject@8
1411 ZwTranslateFilePath@12
1412 _abnormal_termination