3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
19 CcGetFileObjectFromBcb@4
20 CcGetFileObjectFromSectionPtrs@4
21 CcGetFlushedValidData@8
22 CcGetLsnForFileObject@8
23 CcInitializeCacheMap@20
25 CcFastMdlReadWait DATA
26 CcFastReadNotPossible DATA
37 CcPurgeCacheSection@16
40 CcScheduleReadAhead@12
41 CcSetAdditionalCacheAttributes@12
42 CcSetBcbOwnerPointer@8
43 CcSetDirtyPageThreshold@8
44 CcSetDirtyPinnedData@8
45 CcSetLogHandleForFile@12
46 CcSetReadAheadGranularity@8
47 CcUninitializeCacheMap@12
49 CcUnpinDataForThread@8
51 CcWaitForCurrentLazyWriterActivity@0
56 CmUnRegisterCallback@8
58 DbgBreakPointWithStatus@4
59 DbgLoadImageSymbols@12
63 DbgPrintReturnControlC
64 DbgQueryDebugFilterState@8
65 DbgSetDebugFilterState@12
66 @ExiAcquireFastMutex@4=@ExAcquireFastMutex@4
67 @ExAcquireFastMutexUnsafe@4
68 ExAcquireRundownProtection=@ExfAcquireRundownProtection@4
69 ExAcquireRundownProtectionCacheAware=@ExfAcquireRundownProtectionCacheAware@4
70 ExAcquireRundownProtectionCacheAwareEx=@ExfAcquireRundownProtectionCacheAwareEx@8
71 ExAcquireRundownProtectionEx=@ExfAcquireRundownProtectionEx@8
72 ExInitializeRundownProtection=@ExfInitializeRundownProtection@4
73 ExReInitializeRundownProtection=@ExfReInitializeRundownProtection@4
74 ExReInitializeRundownProtectionCacheAware=@ExfReInitializeRundownProtectionCacheAware@4
75 ExReleaseRundownProtection=@ExfReleaseRundownProtection@4
76 ExReleaseRundownProtectionCacheAware=@ExfReleaseRundownProtectionCacheAware@4
77 ExReleaseRundownProtectionCacheAwareEx=@ExfReleaseRundownProtectionCacheAwareEx@8
78 ExReleaseRundownProtectionEx=@ExfReleaseRundownProtectionEx@8
79 ExRundownCompleted=@ExfRundownCompleted@4
80 ExRundownCompletedCacheAware=@ExfRundownCompletedCacheAware@4
81 ExWaitForRundownProtectionRelease=@ExfWaitForRundownProtectionRelease@4
82 ExWaitForRundownProtectionReleaseCacheAware=@ExfWaitForRundownProtectionReleaseCacheAware@4
83 ExAllocateCacheAwareRundownProtection@8
84 ExFreeCacheAwareRundownProtection@4
85 ExInitializeRundownProtectionCacheAware@8
86 ExSizeOfRundownProtectionCacheAware@0
87 ExAcquireResourceExclusive@8
88 ExAcquireResourceExclusiveLite@8
89 ExAcquireResourceSharedLite@8
90 ExAcquireSharedStarveExclusive@8
91 ExAcquireSharedWaitForExclusive@8
92 ExAllocateFromPagedLookasideList@4=ExiAllocateFromPagedLookasideList@4
94 ExAllocatePoolWithQuota@8
95 ExAllocatePoolWithQuotaTag@12
96 ExAllocatePoolWithTag@12
97 ExAllocatePoolWithTagPriority@16
98 ExConvertExclusiveToSharedLite@4
100 ExDeleteNPagedLookasideList@4
101 ExDeletePagedLookasideList@4
103 ExDeleteResourceLite@4
104 ExDesktopObjectType DATA
105 ExDisableResourceBoostLite@4
107 @ExEnterCriticalRegionAndAcquireFastMutexUnsafe@4
108 ExEventObjectType DATA
112 ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
113 ExGetCurrentProcessorCounts@12
114 ExGetCurrentProcessorCpuUsage@4
115 ExGetExclusiveWaiterCount@4
117 ExGetSharedWaiterCount@4
118 ExInitializeNPagedLookasideList@28
119 ExInitializePagedLookasideList@28
120 ExInitializeResource@4
121 ExInitializeResourceLite@4
123 ExInterlockedAddLargeInteger@16
124 @ExInterlockedAddLargeStatistic@8
125 ExInterlockedAddUlong@12
126 @ExInterlockedCompareExchange64@16
127 ExInterlockedDecrementLong@8
128 ExInterlockedExchangeUlong@12
129 ExInterlockedExtendZone@16
130 ExInterlockedIncrementLong@8
131 @ExInterlockedFlushSList@4
132 ExInterlockedInsertHeadList@12
133 ExInterlockedInsertTailList@12
134 ExInterlockedPopEntryList@8
135 @ExInterlockedPopEntrySList@8
136 ExInterlockedPushEntryList@12
137 @ExInterlockedPushEntrySList@12
138 ExInterlockedRemoveHeadList@8
139 ExIsProcessorFeaturePresent@4
140 ExIsResourceAcquiredExclusiveLite@4
141 ExIsResourceAcquiredSharedLite@4
142 ExLocalTimeToSystemTime@8
144 ExQueryPoolBlockSize@8
146 ExRaiseAccessViolation@0
147 ExRaiseDatatypeMisalignment@0
148 ExRaiseException@4=RtlRaiseException@4
150 ExRaiseStatus@4=RtlRaiseStatus@4
151 ExRegisterCallback@12
152 ExReinitializeResourceLite@4
153 @ExiReleaseFastMutex@4=@ExReleaseFastMutex@4
154 @ExReleaseFastMutexUnsafe@4
155 @ExReleaseFastMutexUnsafeAndLeaveCriticalRegion@4
156 ExReleaseResourceForThread@8
157 ExReleaseResourceForThreadLite@8
158 @ExReleaseResourceLite@4
159 ExSemaphoreObjectType DATA
160 ExSetResourceOwnerPointer@8
161 ExSetTimerResolution@8
162 ExSystemExceptionFilter@0
163 ExSystemTimeToLocalTime@8
164 ExTryToAcquireResourceExclusiveLite@4
165 ExUnregisterCallback@4
168 ExWindowStationObjectType DATA
169 @ExfInterlockedAddUlong@12
170 @ExfInterlockedInsertHeadList@12
171 @ExfInterlockedInsertTailList@12
172 @ExfInterlockedCompareExchange64@12
173 @ExfInterlockedPopEntryList@8
174 @ExfInterlockedPushEntryList@12
175 @ExfInterlockedRemoveHeadList@8
176 @Exfi386InterlockedDecrementLong@4
177 @Exfi386InterlockedExchangeUlong@8
178 @Exfi386InterlockedIncrementLong@4
179 Exi386InterlockedDecrementLong@4
180 Exi386InterlockedExchangeUlong@8
181 Exi386InterlockedIncrementLong@4
182 FsRtlAcquireFileExclusive@4
183 FsRtlAddLargeMcbEntry@28
185 FsRtlAddToTunnelCache@32
186 FsRtlAllocateFileLock@8
188 FsRtlAllocatePoolWithQuota@8
189 FsRtlAllocatePoolWithQuotaTag@12
190 FsRtlAllocatePoolWithTag@12
191 FsRtlAllocateResource@0
192 FsRtlAreNamesEqual@16
194 FsRtlCheckLockForReadAccess@8
195 FsRtlCheckLockForWriteAccess@8
199 FsRtlCurrentBatchOplock@4
200 FsRtlDeleteKeyFromTunnelCache@12
201 FsRtlDeleteTunnelCache@4
202 FsRtlDeregisterUncProvider@4
205 FsRtlDoesDbcsContainWildCards@4
206 FsRtlDoesNameContainWildCards@4
207 FsRtlFastCheckLockForRead@24
208 FsRtlFastCheckLockForWrite@24
209 FsRtlFastUnlockAll@16
210 FsRtlFastUnlockAllByKey@20
211 FsRtlFastUnlockSingle@32
212 FsRtlFindInTunnelCache@32
215 FsRtlGetNextFileLock@8
216 FsRtlGetNextLargeMcbEntry@20
217 FsRtlGetNextMcbEntry@20
218 FsRtlIncrementCcFastReadNotPossible@0
219 FsRtlIncrementCcFastReadNoWait@0
220 FsRtlIncrementCcFastReadResourceMiss@0
221 FsRtlIncrementCcFastReadWait@0
222 FsRtlInitializeFileLock@12
223 FsRtlInitializeLargeMcb@8
225 FsRtlInitializeOplock@4
226 FsRtlInitializeTunnelCache@4
227 FsRtlInsertPerFileObjectContext@8
228 FsRtlInsertPerStreamContext@8
229 FsRtlIsDbcsInExpression@8
230 FsRtlIsFatDbcsLegal@20
231 FsRtlIsHpfsDbcsLegal@20
232 FsRtlIsNameInExpression@16
233 FsRtlIsNtstatusExpected@4
235 FsRtlIsTotalDeviceFailure@4
236 FsRtlLegalAnsiCharacterArray DATA
237 FsRtlLookupLargeMcbEntry@32
238 FsRtlLookupLastLargeMcbEntry@12
239 FsRtlLookupLastLargeMcbEntryAndIndex@16
240 FsRtlLookupLastMcbEntry@12
241 FsRtlLookupMcbEntry@20
242 FsRtlLookupPerFileObjectContext@12
243 FsRtlLookupPerStreamContextInternal@12
245 FsRtlMdlReadComplete@8
246 FsRtlMdlReadCompleteDev@12
248 FsRtlMdlWriteComplete@12
249 FsRtlMdlWriteCompleteDev@16
250 FsRtlNormalizeNtstatus@8
251 FsRtlNotifyChangeDirectory@28
252 FsRtlNotifyCleanup@12
253 FsRtlNotifyFilterChangeDirectory@44
254 FsRtlNotifyFilterReportChange@40
255 FsRtlNotifyFullChangeDirectory@40
256 FsRtlNotifyFullReportChange@36
257 FsRtlNotifyInitializeSync@4
258 FsRtlNotifyReportChange@20
259 FsRtlNotifyUninitializeSync@4
260 FsRtlNotifyVolumeEvent@8
261 FsRtlNumberOfRunsInLargeMcb@4
262 FsRtlNumberOfRunsInMcb@4
264 FsRtlOplockIsFastIoPossible@4
265 FsRtlPostPagingFileStackOverflow@12
266 FsRtlPostStackOverflow@12
267 FsRtlPrepareMdlWrite@24
268 FsRtlPrepareMdlWriteDev@28
270 FsRtlProcessFileLock@12
271 FsRtlRegisterUncProvider@12
273 FsRtlRemoveLargeMcbEntry@20
274 FsRtlRemoveMcbEntry@12
275 FsRtlRemovePerFileObjectContext@12
276 FsRtlRemovePerStreamContext@12
278 FsRtlSplitLargeMcb@20
280 FsRtlTeardownPerStreamContexts@4
281 FsRtlTruncateLargeMcb@12
283 FsRtlUninitializeFileLock@4
284 FsRtlUninitializeLargeMcb@4
285 FsRtlUninitializeMcb@4
286 FsRtlUninitializeOplock@4
287 HalDispatchTable DATA
288 HalPrivateDispatchTable DATA
290 InbvAcquireDisplayOwnership@0
291 InbvCheckDisplayOwnership@0
293 InbvEnableBootDriver@4
294 InbvEnableDisplayString@4
295 InbvInstallDisplayStringFilter@4
296 InbvIsBootDriverInstalled@0
297 InbvNotifyDisplayOwnershipLost@4
299 InbvSetScrollRegion@16
301 InbvSolidColorFill@20
302 InitSafeBootMode DATA
303 @InterlockedCompareExchange@12
304 @InterlockedDecrement@4
305 @InterlockedExchange@8
306 @InterlockedExchangeAdd@8
307 @InterlockedIncrement@4
308 @InterlockedPushEntrySList@8
309 @InterlockedPopEntrySList@4
310 IoAcquireCancelSpinLock@4
311 IoAcquireRemoveLockEx@20
312 IoAcquireVpbSpinLock@4
313 IoAdapterObjectType DATA
314 IoAllocateAdapterChannel@20
317 IoAllocateController@16
318 IoAllocateDriverObjectExtension@16
319 IoAllocateErrorLogEntry@8
321 IoAssignDriveLetters@16
324 IoAttachDeviceByPointer@8
325 IoAttachDeviceToDeviceStack@8
326 IoAttachDeviceToDeviceStackSafe@12
327 IoBuildAsynchronousFsdRequest@24
328 IoBuildDeviceIoControlRequest@36
330 IoBuildSynchronousFsdRequest@28
334 IoCheckDesiredAccess@8
335 IoCheckEaBufferValidity@12
336 IoCheckFunctionAccess@24
337 IoCheckQuerySetFileInformation@12
338 IoCheckQuerySetVolumeInformation@12
339 IoCheckQuotaBufferValidity@12
340 IoCheckShareAccess@20
342 IoConnectInterrupt@44
348 IoCreateFileSpecifyDeviceObjectHint@60
349 IoCreateNotificationEvent@8
350 IoCreateStreamFileObject@8
351 IoCreateStreamFileObjectEx@12
352 IoCreateStreamFileObjectLite@8
353 IoCreateSymbolicLink@8
354 IoCreateSynchronizationEvent@8
355 IoCreateUnprotectedSymbolicLink@8
365 IoDeleteSymbolicLink@4
367 IoDeviceHandlerObjectSize DATA
368 IoDeviceHandlerObjectType DATA
369 IoDeviceObjectType DATA
370 IoDisconnectInterrupt@4
371 IoDriverObjectType DATA
373 IoEnumerateDeviceObjectList@16
374 IoFastQueryNetworkAttributes@20
375 IoFileObjectType DATA
376 IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
377 IoForwardIrpSynchronously@8
379 IoFreeErrorLogEntry@4
383 IoGetAttachedDevice@4
384 IoGetAttachedDeviceReference@4
385 IoGetBaseFileSystemDeviceObject@4
386 IoGetBootDiskInformation@8
387 IoGetConfigurationInformation@0
388 IoGetCurrentProcess@0
389 IoGetDeviceObjectPointer@16
390 IoGetDeviceAttachmentBaseRef@4
391 IoGetDeviceInterfaceAlias@12
392 IoGetDeviceInterfaces@16
393 IoGetDriverObjectExtension@8
394 IoGetDeviceProperty@20
395 IoGetDeviceToVerify@4
396 IoGetDiskDeviceObject@8
398 IoGetFileObjectGenericMapping@0
400 IoGetLowerDeviceObject@4
401 IoGetRelatedDeviceObject@4
402 IoGetRequestorProcess@4
403 IoGetRequestorProcessId@4
404 IoGetRequestorSessionId@8
408 IoInvalidateDeviceRelations@8
409 IoInvalidateDeviceState@4
410 IoInitializeRemoveLockEx@20
412 IoIsFileOriginRemote@4
414 IoIsValidNameGraftingBuffer@8
415 IoIsOperationSynchronous@4
416 IoMakeAssociatedIrp@8
417 IoOpenDeviceInterfaceRegistryKey@12
418 IoOpenDeviceRegistryKey@16
420 IoPnPDeliverServicePowerNotification@16
421 IoQueryDeviceDescription@32
422 IoQueryFileDosDeviceName@8
423 IoQueryFileInformation@20
424 IoQueryVolumeInformation@20
428 IoRaiseInformationalHardError@12
429 IoReadDiskSignature@12
430 IoReadOperationCount DATA
431 @IoReadPartitionTable@16
432 IoReadPartitionTableEx@8
433 IoReadTransferCount DATA
434 IoRegisterBootDriverReinitialization@12
435 IoRegisterDeviceInterface@16
436 IoRegisterDriverReinitialization@12
437 IoRegisterFileSystem@4
438 IoRegisterFsRegistrationChange@8
439 IoRegisterLastChanceShutdownNotification@4
440 IoRegisterPlugPlayNotification@28
441 IoRegisterShutdownNotification@4
442 IoReleaseCancelSpinLock@4
443 IoReleaseRemoveLockAndWaitEx@12
444 IoReleaseRemoveLockEx@12
445 IoReleaseVpbSpinLock@4
446 IoRemoveShareAccess@8
447 IoReportDetectedDevice@32
448 IoReportHalResourceUsage@16
449 IoReportResourceUsage@36
450 IoReportResourceForDetection@28
451 IoReportTargetDeviceChange@8
452 IoReportTargetDeviceChangeAsynchronous@16
453 IoRequestDeviceEject@4
455 IoSetCompletionRoutineEx@28
456 IoSetSystemPartition@4
457 IoSetDeviceInterfaceState@8
458 IoSetDeviceToVerify@8
460 IoSetHardErrorOrVerifyDevice@8
463 @IoSetPartitionInformation@16
464 IoSetPartitionInformationEx@12
465 IoSetStartIoAttributes@12
467 IoSetThreadHardErrorMode@4
470 IoStartNextPacketByKey@12
473 IoStatisticsLock DATA
475 IoSynchronousPageWrite@20
476 IoSynchronousInvalidateDeviceRelations@8
478 IoUnregisterFileSystem@4
479 IoUnregisterFsRegistrationChange@8
480 IoUnregisterPlugPlayNotification@4
481 IoUnregisterShutdownNotification@4
482 IoUpdateShareAccess@8
483 IoValidateDeviceIoControlAccess@8
484 IoVerifyPartitionTable@8
486 IoVolumeDeviceToDosName@8
487 IoWMIAllocateInstanceIds@12
488 IoWMIDeviceObjectToInstanceName@12
489 IoWMIExecuteMethod@24
490 IoWMIHandleToInstanceName@12
493 IoWMIQueryAllDataMultiple@16
494 IoWMIQuerySingleInstance@16
495 IoWMIQuerySingleInstanceMultiple@20
496 IoWMIRegistrationControl@8
497 IoWMISetNotificationCallback@12
498 IoWMISetSingleInstance@20
499 IoWMISetSingleItem@24
500 IoWMISuggestInstanceName@16
502 IoWriteErrorLogEntry@4
503 IoWriteOperationCount DATA
504 @IoWritePartitionTable@20
505 IoWritePartitionTableEx@8
506 IoWriteTransferCount DATA
508 @IofCompleteRequest@8
509 IoIsWdmVersionAvailable@8
510 KdDebuggerEnabled DATA
511 KdDebuggerNotPresent DATA
517 KdpServiceDispatcher@12
519 Ke386IoSetAccessProcess@8
520 Ke386QueryIoAccessMap@8
521 Ke386SetIoAccessMap@8
522 @KeAcquireGuardedMutex@4
523 @KeAcquireGuardedMutexUnsafe@4
524 KeAcquireSpinLockAtDpcLevel@4
525 @KeAcquireDispatcherDatabaseLockAtDpcLevel@0
526 @KeAcquireInStackQueuedSpinLockAtDpcLevel@8
527 KeAcquireInterruptSpinLock@4
528 KeAddSystemServiceTable@20
531 ;KeBoostCurrentThread
535 KeCapturePersistentThreadState@28
538 KeDcacheFlushCount DATA
539 KeDelayExecutionThread@12
540 KeDeregisterBugCheckCallback@4
541 KeDeregisterBugCheckReasonCallback@4
543 KeDisconnectInterrupt@4
544 KeEnterCriticalRegion@0
545 KeEnterGuardedRegion@0
546 KeEnterKernelDebugger@0
547 KeFindConfigurationEntry@16
548 KeFindConfigurationNextEntry@20
553 KeGetRecommendedSharedDataAlignment@0
555 KeI386AllocateGdtSelectors@8
556 ;KeI386Call16BitCStyleFunction
557 ;KeI386Call16BitFunction
558 KeI386FlatToGdtSelector@12
560 ;KeI386MachineType DATA
561 KeI386ReleaseGdtSelectors@8
563 ;KeI386SetGdtSelector
564 KeIcacheFlushCount DATA
566 KeInitializeDeviceQueue@4
569 @KeInitializeGuardedMutex@4
570 KeInitializeInterrupt@44
574 KeInitializeSemaphore@12
575 KeInitializeSpinLock@4
577 KeInitializeTimerEx@8
578 KeInsertByKeyDeviceQueue@12
579 KeInsertDeviceQueue@8
584 KeIsAttachedProcess@0
586 KeLeaveCriticalRegion@0
587 KeLeaveGuardedRegion@0
589 KeNumberProcessors DATA
591 KeProfileInterruptWithSource@8
593 KeQueryActiveProcessors@0
594 KeQueryInterruptTime@0
595 KeQueryPriorityThread@4
596 KeQueryRuntimeThread@8
599 KeQueryTimeIncrement@0
600 KeRaiseUserException@4
603 KeReadStateMutex@4=KeReadStateMutant@4
605 KeReadStateSemaphore@4
607 KeRegisterBugCheckCallback@20
608 KeRegisterBugCheckReasonCallback@16
609 @KeReleaseDispatcherDatabaseLockFromDpcLevel@0
610 @KeReleaseGuardedMutexUnsafe@4
611 @KeReleaseGuardedMutex@4
612 @KeReleaseInStackQueuedSpinLockFromDpcLevel@4
613 KeReleaseInterruptSpinLock@8
616 KeReleaseSemaphore@16
617 KeReleaseSpinLockFromDpcLevel@4
618 KeRemoveByKeyDeviceQueue@8
619 KeRemoveByKeyDeviceQueueIfBusy@8
620 KeRemoveDeviceQueue@4
621 KeRemoveEntryDeviceQueue@8
624 KeRemoveSystemServiceTable@4
626 KeRestoreFloatingPointState@4
627 KeRevertToUserAffinityThread@0
629 KeSaveFloatingPointState@4
630 KeSaveStateForHibernate
631 KeServiceDescriptorTable DATA
632 KeSetAffinityThread@8
633 KeSetBasePriorityThread@8
634 KeSetDmaIoCoherency@4
636 KeSetEventBoostPriority@8
637 KeSetIdealProcessorThread@8
639 KeSetKernelStackSwapEnable@4
640 KeSetPriorityThread@8
642 KeSetSystemAffinityThread@4
643 ;KeSetSwapContextNotifyRoutine
644 KeSetTargetProcessorDpc@8
645 ;KeSetThreadSelectNotifyRoutine
649 @KeSetTimeUpdateNotifyRoutine@4
650 KeStackAttachProcess@8
651 KeSynchronizeExecution@12
654 @KeTryToAcquireGuardedMutex@4
657 KeUnstackDetachProcess@4
658 KeUserModeCallback@20
659 KeWaitForMultipleObjects@32
660 KeWaitForMutexObject@20=KeWaitForSingleObject@20
661 KeWaitForSingleObject@20
662 @KefAcquireSpinLockAtDpcLevel@4
663 @KefReleaseSpinLockFromDpcLevel@4
668 KiCheckForKernelApcDelivery@0
670 KiDispatchInterrupt@0
671 KiEnableTimerWatchdog
672 KiInterruptDispatch2@8
673 KiIpiServiceRoutine@8
675 KiUnexpectedInterrupt@0
676 ;Kii386SpinOnSpinLock
680 LdrFindResourceDirectory_U@16
682 LpcPortObjectType DATA
684 LpcRequestWaitReplyPort@12
685 LsaCallAuthenticationPackage@28
686 LsaDeregisterLogonProcess@8
687 LsaFreeReturnBuffer@4
689 LsaLookupAuthenticationPackage@12
690 LsaRegisterLogonProcess@12
691 Mm64BitPhysicalAddress DATA
692 MmAddPhysicalMemory@8
693 MmAddVerifierThunks@8
694 MmAdjustWorkingSetSize@12
696 MmAllocateContiguousMemory@12
697 MmAllocateContiguousMemorySpecifyCache@32
698 MmAllocateMappingAddress@8
699 MmAllocateNonCachedMemory@4
700 MmAllocatePagesForMdl@28
701 MmBuildMdlForNonPagedPool@4
702 MmCanFileBeTruncated@8
705 MmDbgTranslatePhysicalAddress@8
706 MmDisableModifiedWriteOfSection@4
707 MmFlushImageSection@8
708 MmForceSectionClosed@8
709 MmFreeContiguousMemory@4
710 MmFreeContiguousMemorySpecifyCache@12
711 MmFreeMappingAddress@8
712 MmFreeNonCachedMemory@8
714 MmGetPhysicalAddress@4
715 MmGetPhysicalMemoryRanges@0
716 MmGetSystemRoutineAddress@4
717 MmGetVirtualForPhysical@8
719 MmHighestUserAddress DATA
721 MmIsDriverVerifying@4
722 MmIsNonPagedSystemAddressValid@4
723 MmIsRecursiveIoFault@0
724 MmIsThisAnNtAsSystem@0
725 MmIsVerifierEnabled@4
726 MmLockPagableDataSection@4
727 MmLockPagableImageSection@4=MmLockPagableDataSection@4
728 MmLockPagableSectionByHandle@4
731 MmMapLockedPagesSpecifyCache@24
732 MmMapLockedPagesWithReservedMapping@16
734 MmMapUserAddressesToPage@12
736 MmMapViewInSessionSpace@12
737 MmMapViewInSystemSpace@12
738 MmMapViewOfSection@40
739 MmMarkPhysicalMemoryAsBad@8
740 MmMarkPhysicalMemoryAsGood@8
743 MmProbeAndLockPages@12
744 MmProbeAndLockProcessPages@16
745 MmProbeAndLockSelectedPages@16
746 MmProtectMdlSystemAddress@8
748 MmRemovePhysicalMemory@8
749 MmResetDriverPaging@4
750 MmSectionObjectType DATA
751 MmSecureVirtualMemory@12
752 MmSetAddressRangeModified@8
753 MmSetBankedSection@24
755 MmSystemRangeStart DATA
756 MmTrimAllSystemPagableMemory@4
757 MmUnlockPagableImageSection@4
761 MmUnmapReservedMapping@12
762 MmUnmapVideoDisplay@8
763 MmUnmapViewInSessionSpace@4
764 MmUnmapViewInSystemSpace@4
765 MmUnmapViewOfSection@8
766 MmUnsecureVirtualMemory@4
767 MmUserProbeAddress DATA
770 NlsMbCodePageTag DATA
771 NlsMbOemCodePageTag DATA
773 NlsOemLeadByteInfo DATA
775 NtAdjustPrivilegesToken@24
777 NtAllocateLocallyUniqueId@4
779 NtAllocateVirtualMemory@24
790 NtDeviceIoControlFile@40
794 NtFreeVirtualMemory@16
798 NtMakePermanentObject@4
799 NtMapViewOfSection@40
800 NtNotifyChangeDirectoryFile@36
803 NtOpenProcessToken@12
804 NtOpenProcessTokenEx@16
807 NtOpenThreadTokenEx@20
808 NtQueryDirectoryFile@44
810 NtQueryInformationAtom@20
811 NtQueryInformationFile@20
812 NtQueryInformationProcess@20
813 NtQueryInformationThread@20
814 NtQueryInformationToken@20
815 NtQueryQuotaInformationFile@36
816 NtQuerySecurityObject@20
817 NtQuerySystemInformation@16
819 NtQueryVolumeInformationFile@20
822 NtRequestWaitReplyPort@12
825 NtSetInformationFile@20
826 NtSetInformationProcess@16
827 NtSetInformationThread@16
828 NtSetQuotaInformationFile@16
829 NtSetSecurityObject@12
830 NtSetVolumeInformationFile@20
837 NtWaitForSingleObject@12
840 ;ObCheckCreateObjectAccess@28
841 ;ObCheckObjectAccess@20
843 ObDereferenceSecurityDescriptor@8
844 ObFindHandleForObject@20
845 ObGetObjectPointerCount@4
846 ObGetObjectSecurity@12
848 ObLogSecurityDescriptor@12
849 ObMakeTemporaryObject@4
850 ObOpenObjectByName@28
851 ObOpenObjectByPointer@28
853 ObQueryObjectAuditingByHandle@8
854 @ObfDereferenceObject@4
855 @ObfReferenceObject@4
856 ObReferenceObjectByHandle@24
857 ObReferenceObjectByName@32
858 ObReferenceObjectByPointer@16
859 ObReleaseObjectSecurity@8
860 ObDereferenceObject@4
861 ;ObSetSecurityDescriptorInfo@24
867 PoQueueShutdownWorkItem@4
868 PoRegisterDeviceForIdleDetection@16
869 PoRegisterSystemState@8
874 PoStartNextPowerIrp@4
875 PoUnregisterSystemState@4
878 PsAssignImpersonationToken@8
880 PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
881 PsChargeProcessPagedPoolQuota@8
882 PsChargeProcessPoolQuota@12
883 PsCreateSystemProcess@12
884 PsCreateSystemThread@28
885 PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
886 PsDereferencePrimaryToken@4
887 PsDisableImpersonation@8
888 PsEstablishWin32Callouts@4
889 PsGetCurrentProcess@0=KeGetCurrentProcess@0
890 PsGetCurrentProcessId@0
891 PsGetCurrentProcessSessionId@0
892 PsGetCurrentThread@0=KeGetCurrentThread@0
893 PsGetCurrentThreadId@0
894 PsGetCurrentThreadPreviousMode@0
895 PsGetCurrentThreadStackBase@0
896 PsGetCurrentThreadStackLimit@0
899 PsGetJobUIRestrictionsClass@4
900 PsGetProcessCreateTimeQuadPart@4
901 PsGetProcessDebugPort@4
902 PsGetProcessExitProcessCalled@4
903 PsGetProcessExitStatus@4
904 PsGetProcessExitTime@0
906 PsGetProcessImageFileName@4
907 PsGetProcessInheritedFromUniqueProcessId@4
910 PsGetProcessPriorityClass@4
911 PsGetProcessSectionBaseAddress@4
912 PsGetProcessSecurityPort@4
913 PsGetProcessSessionId@4
914 PsGetProcessWin32Process@4
915 PsGetProcessWin32WindowStation@4
916 PsGetThreadFreezeCount@4
917 PsGetThreadHardErrorsAreDisabled@4
920 PsGetThreadProcessId@4
921 PsGetThreadSessionId@4
923 PsGetThreadWin32Thread@4
927 PsImpersonateClient@20
928 PsInitialSystemProcess DATA
929 PsIsProcessBeingDebugged@4
931 PsIsThreadImpersonating@4
932 PsIsThreadTerminating@4
934 PsLookupProcessByProcessId@8
935 PsLookupProcessThreadByCid@12
936 PsLookupThreadByThreadId@8
938 PsReferenceImpersonationToken@16
939 PsReferencePrimaryToken@4
940 PsRemoveCreateThreadNotifyRoutine@4
941 PsRemoveLoadImageNotifyRoutine@4
942 PsRestoreImpersonation@8
944 PsReturnProcessNonPagedPoolQuota@8
945 PsReturnProcessPagedPoolQuota@8
947 PsRevertThreadToSelf@4
948 PsSetCreateProcessNotifyRoutine@8
949 PsSetCreateThreadNotifyRoutine@4
950 PsSetJobUIRestrictionsClass@8
951 PsSetLegoNotifyRoutine@4
952 PsSetProcessPriorityClass@8
953 PsSetProcessPriorityByClass@8
954 PsSetProcessSecurityPort@8
955 PsSetProcessWin32Process@8
956 PsSetProcessWindowStation@8
957 PsSetThreadHardErrorsAreDisabled@8
958 PsSetThreadWin32Thread@8
959 PsSetLoadImageNotifyRoutine@4
960 PsTerminateSystemThread@4
962 READ_REGISTER_UCHAR@4
963 READ_REGISTER_ULONG@4
964 READ_REGISTER_USHORT@4
965 READ_REGISTER_BUFFER_UCHAR@12
966 READ_REGISTER_BUFFER_ULONG@12
967 READ_REGISTER_BUFFER_USHORT@12
969 KeRosDumpStackFrames@8
970 KeRosGetStackFrames@8
971 RtlAbsoluteToSelfRelativeSD@12
972 RtlAddAccessAllowedAce@16
974 RtlAddAtomToAtomTable@12
976 ;RtlAllocateAndInitializeSid
978 RtlAnsiCharToUnicodeChar@4
979 RtlAnsiStringToUnicodeSize@4=RtlxAnsiStringToUnicodeSize@4
980 RtlAnsiStringToUnicodeString@12
981 RtlAppendAsciizToString@8
982 RtlAppendStringToString@8
983 RtlAppendUnicodeStringToString@8
984 RtlAppendUnicodeToString@8
985 RtlAreAllAccessesGranted@8
986 RtlAreAnyAccessesGranted@8
991 RtlCaptureStackBackTrace@16
993 RtlCheckRegistryKey@8
998 RtlCompareMemoryUlong@12
1000 RtlCompareUnicodeString@12
1001 RtlCompressBuffer@32
1002 RtlCompressChunks@28
1003 RtlConvertLongToLargeInteger@4
1004 RtlConvertSidToUnicodeString@12
1005 RtlConvertUlongToLargeInteger@4
1010 RtlCopyUnicodeString@8
1012 RtlCreateAtomTable@8
1014 RtlCreateRegistryKey@8
1015 RtlCreateSecurityDescriptor@8
1016 RtlCreateSystemVolumeInformationFolder@4
1017 RtlCreateUnicodeString@8
1018 RtlCustomCPToUnicodeN@24
1019 RtlDecompressBuffer@24
1020 RtlDecompressChunks@28
1021 RtlDecompressFragment@32
1024 RtlDeleteAtomFromAtomTable@8
1025 RtlDeleteElementGenericTable@8
1026 RtlDeleteElementGenericTableAvl@8
1028 RtlDeleteOwnersRanges@8
1030 RtlDeleteRegistryValue@12
1032 RtlDestroyAtomTable@4
1034 RtlDowncaseUnicodeString@12
1035 RtlDuplicateUnicodeString@12
1037 RtlEnlargedIntegerMultiply@8
1038 RtlEnlargedUnsignedDivide@16
1039 RtlEnlargedUnsignedMultiply@8
1040 RtlEnumerateGenericTable@8
1041 RtlEnumerateGenericTableAvl@8
1042 RtlEnumerateGenericTableLikeADirectory@28
1043 RtlEnumerateGenericTableWithoutSplaying@8
1044 RtlEnumerateGenericTableWithoutSplayingAvl@8
1048 RtlEqualUnicodeString@12
1049 RtlExtendedIntegerMultiply@12
1050 RtlExtendedLargeIntegerDivide@16
1051 RtlExtendedMagicDivide@20
1053 RtlFillMemoryUlong@12
1055 RtlFindClearBitsAndSet@12
1057 RtlFindFirstRunClear@8
1058 RtlFindFirstRunSet@8
1059 RtlFindLastBackwardRunClear@12
1060 RtlFindLeastSignificantBit@8
1061 RtlFindLongestRunClear@8
1062 RtlFindLongestRunSet@8
1064 RtlFindMostSignificantBit@8
1065 RtlFindNextForwardRunClear@12
1068 RtlFindSetBitsAndClear@12
1069 RtlFindUnicodePrefix@12
1070 RtlFormatCurrentUserKeyPath@4
1075 RtlFreeUnicodeString@4
1077 RtlGenerate8dot3Name@16
1079 RtlGetCallersAddress@8
1080 RtlGetCompressionWorkSpaceSize@12
1081 RtlGetDaclSecurityDescriptor@16
1082 RtlGetDefaultCodePage@8
1083 RtlGetElementGenericTable@8
1084 RtlGetElementGenericTableAvl@8
1086 RtlGetGroupSecurityDescriptor@12
1088 RtlGetNtGlobalFlags@0
1089 RtlGetOwnerSecurityDescriptor@12
1090 RtlGetSaclSecurityDescriptor@16
1091 RtlGetSetBootStatusData@24
1093 RtlHashUnicodeString@16
1095 RtlImageDirectoryEntryToData@16
1097 RtlInitCodePageTable@8
1099 RtlInitUnicodeString@8
1100 RtlInitializeBitMap@12
1101 RtlInitializeGenericTable@20
1102 RtlInitializeGenericTableAvl@20
1103 RtlInitializeRangeList@4
1105 RtlInitializeUnicodePrefix@4
1106 RtlInsertElementGenericTable@16
1107 RtlInsertElementGenericTableAvl@16
1108 RtlInsertElementGenericTableFull@24
1109 RtlInsertElementGenericTableFullAvl@24
1110 RtlInsertUnicodePrefix@12
1111 RtlInt64ToUnicodeString@16
1113 RtlIntegerToUnicode@16
1114 RtlIntegerToUnicodeString@12
1115 RtlInvertRangeList@8
1116 RtlIpv4AddressToStringA@8
1117 RtlIpv4AddressToStringExA@16
1118 RtlIpv4AddressToStringExW@16
1119 RtlIpv4AddressToStringW@8
1120 RtlIpv4StringToAddressA@16
1121 RtlIpv4StringToAddressExA@16
1122 RtlIpv4StringToAddressExW@16
1123 RtlIpv4StringToAddressW@16
1124 RtlIpv6AddressToStringA@8
1125 RtlIpv6AddressToStringExA@16
1126 RtlIpv6AddressToStringExW@16
1127 RtlIpv6AddressToStringW@8
1128 RtlIpv6StringToAddressA@12
1129 RtlIpv6StringToAddressExA@16
1130 RtlIpv6StringToAddressExW@16
1131 RtlIpv6StringToAddressW@12
1132 RtlIsGenericTableEmpty@4
1133 RtlIsGenericTableEmptyAvl@4
1134 RtlIsNameLegalDOS8Dot3@12
1135 RtlIsRangeAvailable@40
1136 RtlIsValidOemCharacter@4
1137 RtlLargeIntegerAdd@16
1138 RtlLargeIntegerArithmeticShift@12
1139 RtlLargeIntegerDivide@20
1140 RtlLargeIntegerNegate@8
1141 RtlLargeIntegerShiftLeft@12
1142 RtlLargeIntegerShiftRight@12
1143 RtlLargeIntegerSubtract@16
1144 RtlLengthRequiredSid@4
1145 RtlLengthSecurityDescriptor@4
1147 RtlLockBootStatusData@4
1148 RtlLookupAtomInAtomTable@12
1149 RtlLookupElementGenericTable@8
1150 RtlLookupElementGenericTableAvl@8
1151 RtlLookupElementGenericTableFull@16
1152 RtlLookupElementGenericTableFullAvl@16
1154 RtlMapSecurityErrorToNtStatus@4
1155 RtlMergeRangeLists@16
1157 RtlMultiByteToUnicodeN@20
1158 RtlMultiByteToUnicodeSize@12
1159 RtlNextUnicodePrefix@8
1160 RtlNtStatusToDosError@4
1161 RtlNtStatusToDosErrorNoTeb@4
1162 RtlNumberGenericTableElements@4
1163 RtlNumberGenericTableElementsAvl@4
1164 RtlNumberOfClearBits@4
1165 RtlNumberOfSetBits@4
1166 RtlOemStringToCountedUnicodeString@12
1167 RtlOemStringToUnicodeSize@4=RtlxOemStringToUnicodeSize@4
1168 RtlOemStringToUnicodeString@12
1170 RtlPinAtomInAtomTable@8
1171 @RtlPrefetchMemoryNonTemporal@8
1173 RtlPrefixUnicodeString@12
1174 RtlQueryAtomInAtomTable@24
1175 RtlQueryRegistryValues@20
1176 RtlQueryTimeZoneInformation@4
1180 RtlRealPredecessor@4
1182 RtlRemoveUnicodePrefix@8
1184 RtlSecondsSince1970ToTime@8
1185 RtlSecondsSince1980ToTime@8
1186 RtlSelfRelativeToAbsoluteSD2@8
1187 RtlSelfRelativeToAbsoluteSD@44
1191 RtlSetDaclSecurityDescriptor@16
1192 RtlSetGroupSecurityDescriptor@12
1193 RtlSetOwnerSecurityDescriptor@12
1194 RtlSetSaclSecurityDescriptor@16
1195 RtlSetTimeZoneInformation@4
1199 RtlSubAuthorityCountSid@4
1200 RtlSubAuthoritySid@8
1201 RtlSubtreePredecessor@4
1202 RtlSubtreeSuccessor@4
1204 RtlTimeFieldsToTime@8
1205 RtlTimeToElapsedTimeFields@8
1206 RtlTimeToSecondsSince1970@8
1207 RtlTimeToSecondsSince1980@8
1208 RtlTimeToTimeFields@8
1210 @RtlUlonglongByteSwap@8
1211 RtlUnicodeStringToAnsiSize@4=RtlxUnicodeStringToAnsiSize@4
1212 RtlUnicodeStringToAnsiString@12
1213 RtlUnicodeStringToCountedOemString@12
1214 RtlUnicodeStringToInteger@12
1215 RtlUnicodeStringToOemSize@4=RtlxUnicodeStringToOemSize@4
1216 RtlUnicodeStringToOemString@12
1217 RtlUnicodeToCustomCPN@24
1218 RtlUnicodeToMultiByteN@20
1219 RtlUnicodeToMultiByteSize@12
1221 RtlUnlockBootStatusData@4
1223 RtlUpcaseUnicodeChar@4
1224 RtlUpcaseUnicodeString@12
1225 RtlUpcaseUnicodeStringToAnsiString@12
1226 RtlUpcaseUnicodeStringToCountedOemString@12
1227 RtlUpcaseUnicodeStringToOemString@12
1228 RtlUpcaseUnicodeToCustomCPN@24
1229 RtlUpcaseUnicodeToMultiByteN@20
1230 RtlUpcaseUnicodeToOemN@20
1233 @RtlUshortByteSwap@4
1234 RtlValidRelativeSecurityDescriptor@12
1235 RtlValidSecurityDescriptor@4
1237 RtlVerifyVersionInfo@16
1238 RtlVolumeDeviceToDosName@8
1239 RtlWalkFrameChain@12
1240 RtlWriteRegistryValue@24
1243 RtlxAnsiStringToUnicodeSize@4
1244 RtlxOemStringToUnicodeSize@4
1245 RtlxUnicodeStringToAnsiSize@4
1246 RtlxUnicodeStringToOemSize@4
1248 SeAppendPrivileges@8
1250 SeAssignSecurityEx@36
1251 SeAuditHardLinkCreation@12
1252 SeAuditingFileEvents@8
1253 SeAuditingFileEventsWithContext@12
1254 SeAuditingFileOrGlobalEvents@12
1255 SeAuditingHardLinkEvents@8
1256 SeAuditingHardLinkEventsWithContext@12
1257 SeCaptureSecurityDescriptor@20
1258 SeCaptureSubjectContext@4
1259 SeCloseObjectAuditAlarm@12
1260 SeCreateAccessState@16
1261 SeCreateClientSecurity@16
1262 SeCreateClientSecurityFromSubjectContext@16
1263 SeDeassignSecurity@4
1264 SeDeleteAccessState@4
1265 SeDeleteObjectAuditAlarm@8
1269 SeImpersonateClient@8
1270 SeImpersonateClientEx@8
1271 SeLockSubjectContext@4
1272 SeMarkLogonSessionForTerminationNotification@4
1273 SeOpenObjectAuditAlarm@36
1274 SeOpenObjectForDeleteAuditAlarm@36
1276 SePrivilegeObjectAuditAlarm@24
1277 SePublicDefaultDacl DATA
1278 SeQueryAuthenticationIdToken@8
1279 SeQueryInformationToken@12
1280 SeQuerySecurityDescriptorInfo@16
1281 SeQuerySessionIdToken@8
1282 SeRegisterLogonSessionTerminatedRoutine@4
1283 SeReleaseSecurityDescriptor@12
1284 SeReleaseSubjectContext@4
1285 SeSetAccessStateGenericMapping@8
1286 SeSetSecurityDescriptorInfo@24
1287 SeSetSecurityDescriptorInfoEx@28
1288 SeSinglePrivilegeCheck@12
1289 SeSystemDefaultDacl DATA
1290 SeTokenImpersonationLevel@4
1292 SeTokenIsRestricted@4
1293 SeTokenIsWriteRestricted@4
1295 SeUnlockSubjectContext@4
1296 SeUnregisterLogonSessionTerminatedRoutine@4
1297 SeValidSecurityDescriptor@8
1298 VerSetConditionMask@16
1299 WRITE_REGISTER_UCHAR@8
1300 WRITE_REGISTER_ULONG@8
1301 WRITE_REGISTER_USHORT@8
1302 WRITE_REGISTER_BUFFER_UCHAR@12
1303 WRITE_REGISTER_BUFFER_ULONG@12
1304 WRITE_REGISTER_BUFFER_USHORT@12
1305 ZwAccessCheckAndAuditAlarm@44
1307 ZwAdjustPrivilegesToken@24
1309 ZwAllocateVirtualMemory@24
1310 ZwAssignProcessToJobObject@8
1315 ZwCloseObjectAuditAlarm@12
1317 ZwCreateDirectoryObject@12
1320 ZwCreateJobObject@12
1323 ZwCreateSymbolicLinkObject@16
1329 ZwDeviceIoControlFile@40
1331 ZwDuplicateObject@28
1333 ZwEnumerateBootEntries@8
1335 ZwEnumerateValueKey@24
1336 ZwFlushInstructionCache@12
1338 ZwFlushVirtualMemory@16
1339 ZwFreeVirtualMemory@16
1341 ZwInitiatePowerAction@16
1345 ZwMakeTemporaryObject@4
1346 ZwMapViewOfSection@40
1347 ZwNotifyChangeKey@40
1348 ZwOpenDirectoryObject@12
1354 ZwOpenProcessToken@12
1355 ZwOpenProcessTokenEx@16
1357 ZwOpenSymbolicLinkObject@12
1359 ZwOpenThreadToken@16
1360 ZwOpenThreadTokenEx@20
1362 ZwPowerInformation@20
1364 ZwQueryBootEntryOrder@8
1365 ZwQueryBootOptions@8
1366 ZwQueryDefaultLocale@8
1367 ZwQueryDefaultUILanguage@4
1368 ZwQueryDirectoryFile@44
1369 ZwQueryDirectoryObject@28
1371 ZwQueryFullAttributesFile@8
1372 ZwQueryInformationAtom@20
1373 ZwQueryInformationFile@20
1374 ZwQueryInformationJobObject@20
1375 ZwQueryInformationProcess@20
1376 ZwQueryInformationThread@20
1377 ZwQueryInformationToken@20
1378 ZwQueryInstallUILanguage@4
1382 ZwQuerySecurityObject@20
1383 ZwQuerySymbolicLinkObject@12
1384 ZwQuerySystemInformation@16
1387 ZwQueryVolumeInformationFile@20
1390 ZwRequestWaitReplyPort@12
1395 ZwSetBootEntryOrder@8
1397 ZwSetDefaultLocale@8
1398 ZwSetDefaultUILanguage@4
1401 ZwSetInformationFile@20
1402 ZwSetInformationJobObject@16
1403 ZwSetInformationObject@16
1404 ZwSetInformationProcess@16
1405 ZwSetInformationThread@16
1406 ZwSetSecurityObject@12
1407 ZwSetSystemInformation@12
1411 ZwSetVolumeInformationFile@20
1412 ZwTerminateJobObject@8
1413 ZwTerminateProcess@8
1414 ZwTranslateFilePath@12
1417 ZwUnmapViewOfSection@8
1418 ZwWaitForMultipleObjects@20
1419 ZwWaitForSingleObject@12
1422 _abnormal_termination