1 ; $Id: ntoskrnl.def,v 1.181 2004/05/20 12:42:51 ekohl Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache@8
9 CcRosReleaseFileCache@4
13 CcGetFileObjectFromSectionPtrs@4
16 CcSetDirtyPinnedData@8
21 DbgBreakPointWithStatus@4
22 ;DbgLoadImageSymbols@12
26 @ExAcquireFastMutexUnsafe@4
27 ExAcquireResourceExclusive@8
28 ExAcquireResourceExclusiveLite@8
29 ExAcquireResourceSharedLite@8
30 ExAcquireSharedStarveExclusive@8
31 ExAcquireSharedWaitForExclusive@8
32 @ExAllocateFromPagedLookasideList@4
34 ExAllocatePoolWithQuota@8
35 ExAllocatePoolWithQuotaTag@12
36 ExAllocatePoolWithTag@12
37 ExConvertExclusiveToSharedLite@4
39 ExDeleteNPagedLookasideList@4
40 ExDeletePagedLookasideList@4
42 ExDeleteResourceLite@4
43 ExDesktopObjectType DATA
44 ExDisableResourceBoostLite@4
45 ExEventObjectType DATA
49 ExFreeToPagedLookasideList@8
50 ExGetExclusiveWaiterCount@4
52 ExGetSharedWaiterCount@4
53 ExInitializeNPagedLookasideList@28
54 ExInitializePagedLookasideList@28
55 ExInitializeResource@4
56 ExInitializeResourceLite@4
58 ExInterlockedAddLargeInteger@16
59 @ExInterlockedAddLargeStatistic@8
60 @ExInterlockedAddUlong@12
61 @ExInterlockedCompareExchange64@16
62 ExInterlockedDecrementLong@8
63 ExInterlockedExchangeUlong@12
64 ExInterlockedExtendZone@16
65 ExInterlockedIncrementLong@8
66 @ExInterlockedInsertHeadList@12
67 @ExInterlockedInsertTailList@12
68 @ExInterlockedPopEntryList@8
69 @ExInterlockedPopEntrySList@8
70 @ExInterlockedPushEntryList@12
71 @ExInterlockedPushEntrySList@12
72 @ExInterlockedRemoveHeadList@8
73 ExIsProcessorFeaturePresent@4
74 ExIsResourceAcquiredExclusiveLite@4
75 ExIsResourceAcquiredSharedLite@4
76 ExLocalTimeToSystemTime@8
81 ExRaiseAccessViolation@0
82 ExRaiseDatatypeMisalignment@0
87 ExReinitializeResourceLite@4
88 @ExReleaseFastMutexUnsafe@4
89 ExReleaseResourceForThread@8
90 ExReleaseResourceForThreadLite@8
91 @ExReleaseResourceLite@4
92 ExSetResourceOwnerPointer@8
93 ;ExSystemExceptionFilter
94 ExSystemTimeToLocalTime@8
95 ExTryToAcquireResourceExclusiveLite@4
96 ExUnregisterCallback@4
97 ExWindowStationObjectType DATA
98 ExInitializeBinaryTree@12
100 ExInsertBinaryTree@12
101 ExSearchBinaryTree@12
102 ExRemoveBinaryTree@12
103 ExTraverseBinaryTree@16
104 ExInitializeSplayTree@16
109 ExWeightOfSplayTree@8
110 ExTraverseSplayTree@16
111 ExInitializeHashTable@16
116 @ExfInterlockedAddUlong@12
117 @ExfInterlockedInsertHeadList@12
118 @ExfInterlockedInsertTailList@12
119 @ExfInterlockedPopEntryList@8
120 @ExfInterlockedPushEntryList@12
121 @ExfInterlockedRemoveHeadList@8
122 @Exfi386InterlockedDecrementLong@4
123 @Exfi386InterlockedExchangeUlong@8
124 @Exfi386InterlockedIncrementLong@4
125 Exi386InterlockedDecrementLong@4
126 Exi386InterlockedExchangeUlong@8
127 Exi386InterlockedIncrementLong@4
128 FsRtlAddLargeMcbEntry@28
130 FsRtlAddToTunnelCache@32
131 FsRtlAllocateFileLock@8
133 FsRtlAllocatePoolWithQuota@8
134 FsRtlAllocatePoolWithQuotaTag@12
135 FsRtlAllocatePoolWithTag@12
136 FsRtlAllocateResource@0
137 FsRtlAreNamesEqual@16
139 FsRtlCheckLockForReadAccess@8
140 FsRtlCheckLockForWriteAccess@8
144 FsRtlCurrentBatchOplock@4
145 FsRtlDeleteKeyFromTunnelCache@12
146 FsRtlDeleteTunnelCache@4
147 FsRtlDeregisterUncProvider@4
150 FsRtlDoesDbcsContainWildCards@4
151 FsRtlDoesNameContainWildCards@4
152 FsRtlFastCheckLockForRead@24
153 FsRtlFastCheckLockForWrite@24
154 FsRtlFastUnlockAll@16
155 FsRtlFastUnlockAllByKey@20
156 FsRtlFastUnlockSingle@32
157 FsRtlFindInTunnelCache@32
159 FsRtlGetNextFileLock@8
160 FsRtlGetNextLargeMcbEntry@20
161 FsRtlGetNextMcbEntry@20
162 FsRtlInitializeFileLock@12
163 FsRtlInitializeLargeMcb@8
165 FsRtlInitializeOplock@4
166 FsRtlInitializeTunnelCache@4
167 FsRtlIsDbcsInExpression@8
168 FsRtlIsFatDbcsLegal@20
169 FsRtlIsHpfsDbcsLegal@20
170 FsRtlIsNameInExpression@16
171 FsRtlIsNtstatusExpected@4
172 FsRtlIsTotalDeviceFailure@4
173 FsRtlLegalAnsiCharacterArray DATA
174 FsRtlLookupLargeMcbEntry@32
175 FsRtlLookupLastLargeMcbEntry@12
176 FsRtlLookupLastMcbEntry@12
177 FsRtlLookupMcbEntry@20
179 FsRtlMdlReadComplete@8
180 FsRtlMdlReadCompleteDev@12
182 FsRtlMdlWriteComplete@12
183 FsRtlMdlWriteCompleteDev@16
184 FsRtlNormalizeNtstatus@8
185 FsRtlNotifyChangeDirectory@28
186 FsRtlNotifyCleanup@12
187 FsRtlNotifyFullChangeDirectory@40
188 FsRtlNotifyFullReportChange@36
189 FsRtlNotifyInitializeSync@4
190 FsRtlNotifyReportChange@20
191 FsRtlNotifyUninitializeSync@4
192 FsRtlNotifyVolumeEvent@8
193 FsRtlNumberOfRunsInLargeMcb@4
194 FsRtlNumberOfRunsInMcb@4
196 FsRtlOplockIsFastIoPossible@4
197 FsRtlPostPagingFileStackOverflow@12
198 FsRtlPostStackOverflow@12
199 FsRtlPrepareMdlWrite@24
200 FsRtlPrepareMdlWriteDev@28
202 FsRtlProcessFileLock@12
203 FsRtlRegisterUncProvider@12
204 FsRtlRemoveLargeMcbEntry@20
205 FsRtlRemoveMcbEntry@12
206 FsRtlSplitLargeMcb@20
208 FsRtlTruncateLargeMcb@12
210 FsRtlUninitializeFileLock@4
211 FsRtlUninitializeLargeMcb@4
212 FsRtlUninitializeMcb@4
213 FsRtlUninitializeOplock@4
214 HalDispatchTable DATA
215 HalPrivateDispatchTable DATA
216 InbvAcquireDisplayOwnership@0
217 InbvCheckDisplayOwnership@0
219 InbvEnableBootDriver@4
220 InbvEnableDisplayString@4
221 InbvInstallDisplayStringFilter@4
222 InbvIsBootDriverInstalled@0
223 InbvNotifyDisplayOwnershipLost@4
225 InbvSetScrollRegion@16
227 InbvSolidColorFill@20
228 @InterlockedCompareExchange@12
229 @InterlockedDecrement@4
230 @InterlockedExchange@8
231 @InterlockedExchangeAdd@8
232 @InterlockedIncrement@4
233 @InterlockedPopEntrySList@4
234 @InterlockedPushEntrySList@8
235 IoAcquireCancelSpinLock@4
236 IoAcquireRemoveLockEx@20
237 IoAcquireVpbSpinLock@4
238 IoAdapterObjectType DATA
239 IoAllocateAdapterChannel@20
240 IoAllocateController@16
241 IoAllocateDriverObjectExtension@16
242 IoAllocateErrorLogEntry@8
248 IoAttachDeviceByPointer@8
249 IoAttachDeviceToDeviceStack@8
250 IoBuildAsynchronousFsdRequest@24
251 IoBuildDeviceIoControlRequest@36
253 IoBuildSynchronousFsdRequest@28
256 IoCheckDesiredAccess@8
257 IoCheckEaBufferValidity@12
258 IoCheckFunctionAccess@24
259 IoCheckShareAccess@20
261 IoConnectInterrupt@44
265 IoCreateNotificationEvent@8
266 IoCreateStreamFileObject@8
267 IoCreateSymbolicLink@8
268 IoCreateSynchronizationEvent@8
269 IoCreateUnprotectedSymbolicLink@8
272 IoDeleteSymbolicLink@4
274 IoDeviceHandlerObjectSize DATA
275 IoDeviceHandlerObjectType DATA
276 IoDisconnectInterrupt@4
277 IoDeviceObjectType DATA
278 IoDriverObjectType DATA
280 IoFastQueryNetworkAttributes@20
281 IoFileObjectType DATA
286 IoGetAttachedDevice@4
287 IoGetAttachedDeviceReference@4
288 IoGetBaseFileSystemDeviceObject@4
289 IoGetConfigurationInformation@0
290 IoGetCurrentProcess@0
291 IoGetDriverObjectExtension@8
292 IoGetDeviceObjectPointer@16
293 IoGetDeviceProperty@20
294 IoGetDeviceToVerify@4
295 IoGetFileObjectGenericMapping@0
297 IoGetRelatedDeviceObject@4
298 IoGetRequestorProcess@4
302 IoInvalidateDeviceRelations@8
303 IoInvalidateDeviceState@4
304 IoInitializeRemoveLockEx@20
306 IoIsOperationSynchronous@4
307 IoMakeAssociatedIrp@8
308 IoOpenDeviceInstanceKey@20
309 IoOpenDeviceRegistryKey@16
311 IoQueryDeviceDescription@32
312 IoQueryDeviceEnumInfo@8
313 IoQueryFileInformation@20
314 IoQueryVolumeInformation@20
318 IoRaiseInformationalHardError@12
319 IoReadOperationCount DATA
320 IoReadPartitionTable@16
321 IoReadTransferCount DATA
322 IoRegisterDeviceInterface@16
323 IoRegisterDriverReinitialization@12
324 IoRegisterFileSystem@4
325 IoRegisterFsRegistrationChange@8
326 IoRegisterShutdownNotification@4
327 IoReleaseCancelSpinLock@4
328 IoReleaseRemoveLockAndWaitEx@12
329 IoReleaseRemoveLockEx@12
330 IoReleaseVpbSpinLock@4
331 IoRemoveShareAccess@8
332 IoReportHalResourceUsage@16
333 IoReportResourceUsage@36
334 IoSetDeviceInterfaceState@8
335 IoSetDeviceToVerify@8
336 IoSetHardErrorOrVerifyDevice@8
338 IoSetPartitionInformation@16
340 IoSetThreadHardErrorMode@4
343 IoStartNextPacketByKey@12
346 IoStatisticsLock DATA
348 IoSynchronousPageWrite@20
350 IoUnregisterFileSystem@4
351 IoUnregisterFsRegistrationChange@8
352 IoUnregisterShutdownNotification@4
353 IoUpdateShareAccess@8
355 IoWriteErrorLogEntry@4
356 IoWriteOperationCount DATA
357 IoWritePartitionTable@20
358 IoWriteTransferCount DATA
360 @IofCompleteRequest@8
361 KdDebuggerEnabled DATA
362 KdDebuggerNotPresent DATA
364 KdSystemDebugControl@4
366 Ke386IoSetAccessProcess@8
367 Ke386QueryIoAccessMap@8
368 Ke386SetIoAccessMap@8
369 KeAcquireSpinLockAtDpcLevel@4
370 KeAddSystemServiceTable@20
372 ;KeBoostCurrentThread
378 KeDcacheFlushCount DATA
379 KeDelayExecutionThread@12
380 KeDeregisterBugCheckCallback@4
382 KeDisconnectInterrupt@4
383 KeEnterCriticalRegion@0
384 KeEnterKernelDebugger@0
385 ;KeFindConfigurationEntry
386 ;KeFindConfigurationNextEntry
391 ;KeI386AllocateGdtSelectors
392 ;KeI386Call16BitCStyleFunction
393 ;KeI386Call16BitFunction
394 ;KeI386FlatToGdtSelector
396 ;KeI386MachineType DATA
397 ;KeI386ReleaseGdtSelectors
399 ;KeI386SetGdtSelector
400 KeIcacheFlushCount DATA
402 KeInitializeDeviceQueue@4
405 KeInitializeInterrupt@44
409 KeInitializeSemaphore@12
410 KeInitializeSpinLock@4
412 KeInitializeTimerEx@8
413 KeInsertByKeyDeviceQueue@12
414 KeInsertDeviceQueue@8
420 KeLeaveCriticalRegion@0
422 KeNumberProcessors DATA
424 ;KeProfileInterruptWithSource
428 KeQueryTimeIncrement@0
429 ;KeRaiseUserException
435 KeReadStateSemaphore@4
437 KeRegisterBugCheckCallback@20
440 KeReleaseSemaphore@16
441 KeReleaseSpinLockFromDpcLevel@4
442 KeRemoveByKeyDeviceQueue@8
443 KeRemoveDeviceQueue@4
444 KeRemoveEntryDeviceQueue@8
448 KeRestoreFloatingPointState@4
450 KeSaveFloatingPointState@4
451 KeServiceDescriptorTable DATA
452 KeSetAffinityThread@8
453 KeSetBasePriorityThread@8
456 ;KeSetEventBoostPriority
457 ;KeSetIdealProcessorThread
459 ;KeSetKernelStackSwapEnable
460 KeSetPriorityThread@8
462 ;@KeSetSwapContextNotifyRoutine
463 KeSetTargetProcessorDpc@8
464 ;@KeSetThreadSelectNotifyRoutine
468 ;@KeSetTimeUpdateNotifyRoutine
469 KeSynchronizeExecution@12
474 KeWaitForMultipleObjects@32
475 KeWaitForMutexObject@20
476 KeWaitForSingleObject@20
477 @KefAcquireSpinLockAtDpcLevel@4=KefAcquireSpinLockAtDpcLevel
478 @KefReleaseSpinLockFromDpcLevel@4=KefReleaseSpinLockFromDpcLevel
482 ;KiCoprocessorError@0
484 KiDispatchInterrupt@0
485 KiInterruptDispatch2@8
486 ;KiIpiServiceRoutine@8
488 ;KiUnexpectedInterrupt
489 ;Kii386SpinOnSpinLock
493 ;LdrFindResourceDirectory_U@16
496 LsaCallAuthenticationPackage@28
497 LsaDeregisterLogonProcess@8
498 LsaFreeReturnBuffer@4
500 LsaLookupAuthenticationPackage@12
501 LsaRegisterLogonProcess@12
502 MmAdjustWorkingSetSize@12
503 MmAllocateContiguousAlignedMemory@36
504 MmAllocateContiguousMemory@12
505 MmAllocateContiguousMemorySpecifyCache@32
506 MmAllocateNonCachedMemory@4
507 MmAllocatePagesForMdl@28
508 MmBuildMdlForNonPagedPool@4
509 MmCanFileBeTruncated@8
514 MmDbgTranslatePhysicalAddress@8
515 MmDisableModifiedWriteOfSection@4
516 MmFlushImageSection@8
517 MmForceSectionClosed@8
518 MmFreeContiguousMemory@4
519 MmFreeContiguousMemorySpecifyCache@12
520 MmFreeNonCachedMemory@8
522 MmGetPhysicalAddress@4
524 MmHighestUserAddress DATA
526 MmIsNonPagedSystemAddressValid@4
527 MmIsRecursiveIoFault@0
528 MmIsThisAnNtAsSystem@0
529 MmLockPagableDataSection@4
530 MmLockPagableImageSection@4=MmLockPagableDataSection@4
531 MmLockPagableSectionByHandle@4
534 MmMapLockedPagesSpecifyCache@24
537 MmMapViewInSystemSpace@12
538 MmMapViewOfSection@40
540 MmProbeAndLockPages@12
542 MmResetDriverPaging@4
543 MmSectionObjectType DATA
544 MmSecureVirtualMemory@12
545 MmSetAddressRangeModified@8
546 MmSetBankedSection@24
548 MmUnlockPagableImageSection@4
552 MmUnmapVideoDisplay@8
553 MmUnmapViewInSystemSpace@4
554 MmUnmapViewOfSection@8
555 MmUnsecureVirtualMemory@4
556 MmUserProbeAddress DATA
559 NlsMbCodePageTag DATA
560 NlsMbOemCodePageTag DATA
561 NlsOemLeadByteInfo DATA
563 NtAdjustPrivilegesToken@24
565 NtAllocateLocallyUniqueId@4
567 NtAllocateVirtualMemory@24
578 NtDeviceIoControlFile@40
582 NtFreeVirtualMemory@16
586 NtMapViewOfSection@40
587 NtNotifyChangeDirectoryFile@36
590 NtOpenProcessToken@12
591 NtQueryDirectoryFile@44
593 NtQueryInformationAtom@20
594 NtQueryInformationFile@20
595 NtQueryInformationProcess@20
596 NtQueryInformationToken@20
597 ;NtQueryOleDirectoryFile@ <--- ?
598 NtQuerySecurityObject@20
600 NtQueryVolumeInformationFile@20
603 NtRequestWaitReplyPort@12
605 NtSetInformationFile@20
606 NtSetInformationProcess@16
607 NtSetInformationThread@16
608 NtSetSecurityObject@12
613 NtWaitForSingleObject@12
616 ;ObCheckCreateObjectAccess@28
617 ;ObCheckObjectAccess@20
619 ;ObFindHandleForObject@20
620 ObGetObjectPointerCount@4
621 ObGetObjectSecurity@12
623 ObMakeTemporaryObject@4
624 ObOpenObjectByName@28
625 ObOpenObjectByPointer@28
627 ObQueryObjectAuditingByHandle@8
628 @ObfDereferenceObject@4
629 @ObfReferenceObject@4
630 ObReferenceObjectByHandle@24
631 ObReferenceObjectByName@32
632 ObReferenceObjectByPointer@16
633 ObReleaseObjectSecurity@8
634 ObDereferenceObject@4
635 ;ObSetSecurityDescriptorInfo@24
641 PoRegisterDeviceForIdleDetection@16
642 PoRegisterSystemState@8
647 PoStartNextPowerIrp@4
648 PoUnregisterSystemState@4
651 PsAssignImpersonationToken@8
652 ;PsChargePoolQuota@12
653 PsCreateSystemProcess@12
654 PsCreateSystemThread@28
655 PsCreateWin32Process@4
656 PsEstablishWin32Callouts@24
657 PsGetCurrentProcessId@0
658 PsGetCurrentThreadId@0
659 PsGetProcessExitTime@0
663 PsImpersonateClient@20
664 PsInitialSystemProcess DATA
665 PsIsThreadTerminating@4
666 PsLookupProcessByProcessId@8
667 PsLookupProcessThreadByCid@12
668 PsLookupThreadByThreadId@8
670 PsReferenceImpersonationToken@16
671 PsReferencePrimaryToken@4
672 ;PsReturnPoolQuota@12
674 PsSetCreateProcessNotifyRoutine@8
675 PsSetCreateThreadNotifyRoutine@4
676 ;PsSetLegoNotifyRoutine@4
677 PsSetLoadImageNotifyRoutine@4
678 ;PsSetProcessPriorityByClass@8
679 PsTerminateSystemThread@4
681 READ_REGISTER_UCHAR@4
682 READ_REGISTER_ULONG@4
683 READ_REGISTER_USHORT@4
684 READ_REGISTER_BUFFER_UCHAR@12
685 READ_REGISTER_BUFFER_ULONG@12
686 READ_REGISTER_BUFFER_USHORT@12
687 RtlAbsoluteToSelfRelativeSD@12
688 RtlAddAccessAllowedAce@16
690 RtlAddAtomToAtomTable@12
691 ;RtlAllocateAndInitializeSid
693 RtlAnsiCharToUnicodeChar@4
694 RtlAnsiStringToUnicodeSize@4
695 RtlAnsiStringToUnicodeString@12
696 RtlAppendAsciizToString@8
697 RtlAppendStringToString@8
698 RtlAppendUnicodeStringToString@8
699 RtlAppendUnicodeToString@8
700 RtlAreAllAccessesGranted@8
701 RtlAreAnyAccessesGranted@8
705 ;RtlCaptureStackBackTrace
707 RtlCheckRegistryKey@8
711 RtlCompareMemoryUlong@12
713 RtlCompareUnicodeString@12
716 RtlConvertLongToLargeInteger@4
717 RtlConvertSidToUnicodeString@12
718 RtlConvertUlongToLargeInteger@4
722 RtlCopyUnicodeString@8
726 RtlCreateRegistryKey@8
727 RtlCreateSecurityDescriptor@8
728 RtlCreateUnicodeString@8
729 RtlCustomCPToUnicodeN@24
730 RtlDecompressBuffer@24
731 RtlDecompressChunks@28
732 RtlDecompressFragment@32
734 RtlDeleteAtomFromAtomTable@8
735 ;RtlDeleteElementGenericTable
737 RtlDeleteRegistryValue@12
739 RtlDestroyAtomTable@4
741 RtlDowncaseUnicodeString@12
743 RtlEnlargedIntegerMultiply@8
744 RtlEnlargedUnsignedDivide@16
745 RtlEnlargedUnsignedMultiply@8
746 ;RtlEnumerateGenericTable
747 ;RtlEnumerateGenericTableWithoutSplaying
751 RtlEqualUnicodeString@12
752 RtlExtendedIntegerMultiply@12
753 RtlExtendedLargeIntegerDivide@16
754 RtlExtendedMagicDivide@20
756 RtlFillMemoryUlong@12
758 RtlFindClearBitsAndSet@12
759 RtlFindFirstRunClear@8
761 RtlFindLeastSignificantBit@8
762 RtlFindLongestRunClear@8
763 RtlFindLongestRunSet@8
765 RtlFindMostSignificantBit@8
767 RtlFindSetBitsAndClear@12
768 ;RtlFindUnicodePrefix
769 RtlFormatCurrentUserKeyPath@4
773 RtlFreeUnicodeString@4
774 RtlGenerate8dot3Name@16
775 ;RtlGetCallersAddress
776 RtlGetCompressionWorkSpaceSize@12
777 RtlGetDaclSecurityDescriptor@16
778 RtlGetDefaultCodePage@8
779 ;RtlGetElementGenericTable
780 RtlGetGroupSecurityDescriptor@12
781 RtlGetOwnerSecurityDescriptor@12
784 RtlImageDirectoryEntryToData@16
786 RtlInitCodePageTable@8
788 RtlInitUnicodeString@8
789 RtlInitializeBitMap@12
790 ;RtlInitializeGenericTable
792 ;RtlInitializeUnicodePrefix
793 ;RtlInsertElementGenericTable
794 ;RtlInsertUnicodePrefix
796 RtlIntegerToUnicodeString@12
797 RtlIsNameLegalDOS8Dot3@12
798 RtlLargeIntegerAdd@16
799 RtlLargeIntegerArithmeticShift@12
800 RtlLargeIntegerDivide@20
801 RtlLargeIntegerNegate@8
802 RtlLargeIntegerShiftLeft@12
803 RtlLargeIntegerShiftRight@12
804 RtlLargeIntegerSubtract@16
805 RtlLengthRequiredSid@4
806 RtlLengthSecurityDescriptor@4
808 RtlLookupAtomInAtomTable@12
809 ;RtlLookupElementGenericTable
812 RtlMultiByteToUnicodeN@20
813 RtlMultiByteToUnicodeSize@12
814 ;RtlNextUnicodePrefix
815 RtlNtStatusToDosError@4
816 RtlNtStatusToDosErrorNoTeb@4
817 ;RtlNumberGenericTableElements
818 RtlNumberOfClearBits@4
820 RtlOemStringToCountedUnicodeString@12
821 RtlOemStringToUnicodeSize@4
822 RtlOemStringToUnicodeString@12
824 RtlPinAtomInAtomTable@8
826 RtlPrefixUnicodeString@12
827 RtlQueryAtomInAtomTable@24
828 RtlQueryRegistryValues@20
829 RtlQueryTimeZoneInformation@4
832 ;RtlRemoveUnicodePrefix
834 RtlSecondsSince1970ToTime@8
835 RtlSecondsSince1980ToTime@8
838 RtlSetDaclSecurityDescriptor@16
839 RtlSetGroupSecurityDescriptor@12
840 RtlSetOwnerSecurityDescriptor@12
841 RtlSetSaclSecurityDescriptor@16
842 RtlSetTimeZoneInformation@4
844 RtlSubAuthorityCountSid@4
846 RtlTimeFieldsToTime@8
847 RtlTimeToSecondsSince1970@8
848 RtlTimeToSecondsSince1980@8
849 RtlTimeToTimeFields@8
851 @RtlUlonglongByteSwap@8
852 RtlUnicodeStringToAnsiSize@4
853 RtlUnicodeStringToAnsiString@12
854 RtlUnicodeStringToCountedOemString@12
855 RtlUnicodeStringToInteger@12
856 RtlUnicodeStringToOemSize@4
857 RtlUnicodeStringToOemString@12
858 RtlUnicodeToCustomCPN@24
859 RtlUnicodeToMultiByteN@20
860 RtlUnicodeToMultiByteSize@12
863 RtlUpcaseUnicodeChar@4
864 RtlUpcaseUnicodeString@12
865 RtlUpcaseUnicodeStringToAnsiString@12
866 RtlUpcaseUnicodeStringToCountedOemString@12
867 RtlUpcaseUnicodeStringToOemString@12
868 RtlUpcaseUnicodeToCustomCPN@24
869 RtlUpcaseUnicodeToMultiByteN@20
870 RtlUpcaseUnicodeToOemN@20
874 RtlValidSecurityDescriptor@4
876 RtlWriteRegistryValue@24
879 RtlxAnsiStringToUnicodeSize@4
880 RtlxOemStringToUnicodeSize@4
881 RtlxUnicodeStringToAnsiSize@4
882 RtlxUnicodeStringToOemSize@4
884 ;SeAppendPrivileges@8
886 ;SeAuditingFileEvents@8
887 ;SeAuditingFileOrGlobalEvents@18
888 ;SeCaptureSecurityDescriptor@20
889 SeCaptureSubjectContext@4
890 ;SeCloseObjectAuditAlarm@12
891 ;SeCreateAccessState@16
892 SeCreateClientSecurity@16
894 ;SeDeleteAccessState@4
895 SeDeleteObjectAuditAlarm@8
898 SeImpersonateClient@8
899 SeLockSubjectContext@4
900 ;SeMarkLogonSessionForTerminationNotification@4
901 SeOpenObjectAuditAlarm@36
902 SeOpenObjectForDeleteAuditAlarm@36
904 ;SePrivilegeObjectAuditAlarm@24
905 SePublicDefaultDacl DATA
906 SeQueryAuthenticationIdToken@8
907 SeQuerySecurityDescriptorInfo@16
908 ;SeRegisterLogonSessionTerminatedRoutine@4
909 ;SeReleaseSecurityDescriptor@12
910 SeReleaseSubjectContext@4
911 ;SeSetAccessStateGenericMapping@8
912 SeSetSecurityDescriptorInfo@24
913 SeSinglePrivilegeCheck@12
914 SeSystemDefaultDacl DATA
915 SeTokenImpersonationLevel@4
917 SeUnlockSubjectContext@4
918 ;SeUnregisterLogonSessionTerminatedRoutine@4
919 SeValidSecurityDescriptor@8
920 WRITE_REGISTER_UCHAR@8
921 WRITE_REGISTER_ULONG@8
922 WRITE_REGISTER_USHORT@8
923 WRITE_REGISTER_BUFFER_UCHAR@12
924 WRITE_REGISTER_BUFFER_ULONG@12
925 WRITE_REGISTER_BUFFER_USHORT@12
926 ZwAccessCheckAndAuditAlarm@44
928 ZwAllocateVirtualMemory@24
931 ZwCloseObjectAuditAlarm@12
933 ZwCreateDirectoryObject@12
938 ZwCreateSymbolicLinkObject@16
942 ZwDeviceIoControlFile@40
947 ZwEnumerateValueKey@24
948 ZwFlushInstructionCache@12
950 ZwFreeVirtualMemory@16
954 ZwMakeTemporaryObject@4
955 ZwMapViewOfSection@40
957 ZwOpenDirectoryObject@12
962 ZwOpenProcessToken@12
964 ZwOpenSymbolicLinkObject@12
968 ZwQueryDefaultLocale@8
969 ZwQueryDirectoryFile@44
970 ZwQueryInformationAtom@20
971 ZwQueryInformationFile@20
972 ZwQueryInformationProcess@20
973 ZwQueryInformationToken@20
977 ZwQuerySecurityObject@20
978 ZwQuerySymbolicLinkObject@12
979 ZwQuerySystemInformation@16
982 ZwQueryVolumeInformationFile@20
985 ZwRequestWaitReplyPort@12
990 ZwSetInformationFile@20
991 ZwSetInformationObject@16
992 ZwSetInformationProcess@16
993 ZwSetInformationThread@16
994 ZwSetSystemInformation@12
1000 ZwUnmapViewOfSection@8
1001 ZwWaitForMultipleObjects@20
1002 ZwWaitForSingleObject@12
1005 _abnormal_termination