1 ; $Id: ntoskrnl.edf,v 1.100 2001/09/03 20:41:52 ea Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache=CcRosInitializeFileCache@12
9 CcMdlReadComplete=CcMdlReadComplete@8
10 CcRosRequestCacheSegment=CcRosRequestCacheSegment@20
11 CcRosReleaseCacheSegment=CcRosReleaseCacheSegment@12
12 CcRosReleaseFileCache=CcRosReleaseFileCache@8
13 DbgBreakPoint=DbgBreakPoint@0
14 DbgBreakPointWithStatus=DbgBreakPointWithStatus@4
15 ;DbgLoadImageSymbols=DbgLoadImageSymbols@12
17 DbgPrompt=DbgPrompt@12
19 ExAcquireFastMutexUnsafe=@ExAcquireFastMutexUnsafe@4
20 ExAcquireResourceExclusive=ExAcquireResourceExclusive@8
21 ExAcquireResourceExclusiveLite=ExAcquireResourceExclusiveLite@8
22 ExAcquireResourceSharedLite=ExAcquireResourceSharedLite@8
23 ExAcquireSharedStarveExclusive=ExAcquireSharedStarveExclusive@8
24 ExAcquireSharedWaitForExclusive=ExAcquireSharedWaitForExclusive@8
25 ExAllocateFromPagedLookasideList=ExAllocateFromPagedLookasideList@4
26 ExAllocatePool=ExAllocatePool@8
27 ExAllocatePoolWithQuota=ExAllocatePoolWithQuota@8
28 ExAllocatePoolWithQuotaTag=ExAllocatePoolWithQuotaTag@12
29 ExAllocatePoolWithTag=ExAllocatePoolWithTag@12
30 ExConvertExclusiveToSharedLite=ExConvertExclusiveToSharedLite@4
31 ExCreateCallback=ExCreateCallback@16
32 ExDeleteNPagedLookasideList=ExDeleteNPagedLookasideList@4
33 ExDeletePagedLookasideList=ExDeletePagedLookasideList@4
34 ExDeleteResource=ExDeleteResource@4
35 ExDeleteResourceLite=ExDeleteResourceLite@4
36 ExDesktopObjectType DATA
37 ExDisableResourceBoostLite=ExDisableResourceBoostLite@4
38 ExEventObjectType DATA
39 ExExtendZone=ExExtendZone@12
40 ExFreePool=ExFreePool@4
41 ExFreeToPagedLookasideList=ExFreeToPagedLookasideList@8
42 ExGetExclusiveWaiterCount=ExGetExclusiveWaiterCount@4
43 ExGetPreviousMode=ExGetPreviousMode@0
44 ExGetSharedWaiterCount=ExGetSharedWaiterCount@4
45 ExInitializeNPagedLookasideList=ExInitializeNPagedLookasideList@28
46 ExInitializePagedLookasideList=ExInitializePagedLookasideList@28
47 ExInitializeResource=ExInitializeResource@4
48 ExInitializeResourceLite=ExInitializeResourceLite@4
49 ExInitializeZone=ExInitializeZone@16
50 ExInterlockedAddLargeInteger=ExInterlockedAddLargeInteger@16
51 ExInterlockedAddLargeStatistic=@ExInterlockedAddLargeStatistic@8
52 ExInterlockedAddUlong=ExInterlockedAddUlong@12
53 ExInterlockedCompareExchange64=@ExInterlockedCompareExchange64@16
54 ExInterlockedDecrementLong=ExInterlockedDecrementLong@8
55 ExInterlockedExchangeUlong=ExInterlockedExchangeUlong@12
56 ExInterlockedExtendZone=ExInterlockedExtendZone@16
57 ExInterlockedIncrementLong=ExInterlockedIncrementLong@8
58 ExInterlockedInsertHeadList=ExInterlockedInsertHeadList@12
59 ExInterlockedInsertTailList=ExInterlockedInsertTailList@12
60 ExInterlockedPopEntryList=ExInterlockedPopEntryList@8
61 ExInterlockedPopEntrySList=@ExInterlockedPopEntrySList@8
62 ExInterlockedPushEntryList=ExInterlockedPushEntryList@12
63 ExInterlockedPushEntrySList=@ExInterlockedPushEntrySList@12
64 ExInterlockedRemoveHeadList=ExInterlockedRemoveHeadList@8
65 ExIsProcessorFeaturePresent=ExIsProcessorFeaturePresent@4
66 ExIsResourceAcquiredExclusiveLite=ExIsResourceAcquiredExclusiveLite@4
67 ExIsResourceAcquiredSharedLite=ExIsResourceAcquiredSharedLite@4
68 ExLocalTimeToSystemTime=ExLocalTimeToSystemTime@8
69 ExNotifyCallback=ExNotifyCallback@12
70 ExPostSystemEvent=ExPostSystemEvent@12
72 ExQueueWorkItem=ExQueueWorkItem@8
73 ExRaiseAccessViolation=ExRaiseAccessViolation@0
74 ExRaiseDatatypeMisalignment=ExRaiseDatatypeMisalignment@0
77 ExRaiseStatus=ExRaiseStatus@4
78 ExRegisterCallback=ExRegisterCallback@12
79 ExReinitializeResourceLite=ExReinitializeResourceLite@4
80 ExReleaseFastMutexUnsafe=@ExReleaseFastMutexUnsafe@4
81 ExReleaseResourceForThread=ExReleaseResourceForThread@8
82 ExReleaseResourceForThreadLite=ExReleaseResourceForThreadLite@8
83 ExReleaseResourceLite=@ExReleaseResourceLite@4
84 ExSetResourceOwnerPointer=ExSetResourceOwnerPointer@8
85 ;ExSystemExceptionFilter
86 ExSystemTimeToLocalTime=ExSystemTimeToLocalTime@8
87 ExTryToAcquireResourceExclusiveLite=ExTryToAcquireResourceExclusiveLite@4
88 ExUnregisterCallback=ExUnregisterCallback@4
89 ExWindowStationObjectType DATA
90 ExfInterlockedAddUlong=@ExfInterlockedAddUlong@12
91 ;ExfInterlockedInsertHeadList
92 ;ExfInterlockedInsertTailList
93 ;ExfInterlockedPopEntryList
94 ;ExfInterlockedPushEntryList
95 ;ExfInterlockedRemoveHeadList
96 Exfi386InterlockedDecrementLong=@Exfi386InterlockedDecrementLong@4
97 Exfi386InterlockedExchangeUlong=@Exfi386InterlockedExchangeUlong@8
98 Exfi386InterlockedIncrementLong=@Exfi386InterlockedIncrementLong@4
99 Exi386InterlockedDecrementLong=Exi386InterlockedDecrementLong@4
100 Exi386InterlockedExchangeUlong=Exi386InterlockedExchangeUlong@8
101 Exi386InterlockedIncrementLong=Exi386InterlockedIncrementLong@4
102 FsRtlAddLargeMcbEntry=FsRtlAddLargeMcbEntry@28
103 FsRtlAddMcbEntry=FsRtlAddMcbEntry@16
104 FsRtlAddToTunnelCache=FsRtlAddToTunnelCache@32
105 FsRtlAllocatePool=FsRtlAllocatePool@8
106 FsRtlAllocatePoolWithQuota=FsRtlAllocatePoolWithQuota@8
107 FsRtlAllocatePoolWithQuotaTag=FsRtlAllocatePoolWithQuotaTag@12
108 FsRtlAllocatePoolWithTag=FsRtlAllocatePoolWithTag@12
109 FsRtlAllocateResource=FsRtlAllocateResource@0
110 FsRtlAreNamesEqual=FsRtlAreNamesEqual@16
111 FsRtlBalanceReads=FsRtlBalanceReads@4
112 FsRtlCheckLockForReadAccess=FsRtlCheckLockForReadAccess@8
113 FsRtlCheckLockForWriteAccess=FsRtlCheckLockForWriteAccess@8
114 FsRtlCheckOplock=FsRtlCheckOplock@20
115 FsRtlCopyRead=FsRtlCopyRead@32
116 FsRtlCopyWrite=FsRtlCopyWrite@32
117 FsRtlCurrentBatchOplock=FsRtlCurrentBatchOplock@4
118 FsRtlDeleteKeyFromTunnelCache=FsRtlDeleteKeyFromTunnelCache@12
119 FsRtlDeleteTunnelCache=FsRtlDeleteTunnelCache@4
120 FsRtlDeregisterUncProvider=FsRtlDeregisterUncProvider@4
121 FsRtlDissectDbcs=FsRtlDissectDbcs@16
122 FsRtlDissectName=FsRtlDissectName@16
123 FsRtlDoesDbcsContainWildCards=FsRtlDoesDbcsContainWildCards@4
124 FsRtlDoesNameContainWildCards=FsRtlDoesNameContainWildCards@4
125 FsRtlFastCheckLockForRead=FsRtlFastCheckLockForRead@24
126 FsRtlFastCheckLockForWrite=FsRtlFastCheckLockForWrite@24
127 FsRtlFastUnlockAll=FsRtlFastUnlockAll@16
128 FsRtlFastUnlockAllByKey=FsRtlFastUnlockAllByKey@20
129 FsRtlFastUnlockSingle=FsRtlFastUnlockSingle@32
130 FsRtlFindInTunnelCache=FsRtlFindInTunnelCache@32
131 FsRtlGetFileSize=FsRtlGetFileSize@8
132 FsRtlGetNextFileLock=FsRtlGetNextFileLock@8
133 FsRtlGetNextLargeMcbEntry=FsRtlGetNextLargeMcbEntry@20
134 FsRtlGetNextMcbEntry=FsRtlGetNextMcbEntry@20
135 FsRtlInitializeFileLock=FsRtlInitializeFileLock@12
136 FsRtlInitializeLargeMcb=FsRtlInitializeLargeMcb@8
137 FsRtlInitializeMcb=FsRtlInitializeMcb@8
138 FsRtlInitializeOplock=FsRtlInitializeOplock@4
139 FsRtlInitializeTunnelCache=FsRtlInitializeTunnelCache@4
140 FsRtlIsDbcsInExpression=FsRtlIsDbcsInExpression@8
141 FsRtlIsFatDbcsLegal=FsRtlIsFatDbcsLegal@20
142 FsRtlIsHpfsDbcsLegal=FsRtlIsHpfsDbcsLegal@20
143 FsRtlIsNameInExpression=FsRtlIsNameInExpression@16
144 FsRtlIsNtstatusExpected=FsRtlIsNtstatusExpected@4
145 FsRtlIsTotalDeviceFailure=FsRtlIsTotalDeviceFailure@4
146 FsRtlLegalAnsiCharacterArray DATA
147 FsRtlLookupLargeMcbEntry=FsRtlLookupLargeMcbEntry@32
148 FsRtlLookupLastLargeMcbEntry=FsRtlLookupLastLargeMcbEntry@12
149 FsRtlLookupLastMcbEntry=FsRtlLookupLastMcbEntry@12
150 FsRtlLookupMcbEntry=FsRtlLookupMcbEntry@20
151 FsRtlMdlRead=FsRtlMdlRead@24
152 FsRtlMdlReadComplete=FsRtlMdlReadComplete@8
153 FsRtlMdlReadCompleteDev=FsRtlMdlReadCompleteDev@12
154 FsRtlMdlReadDev=FsRtlMdlReadDev@28
155 FsRtlMdlWriteComplete=FsRtlMdlWriteComplete@12
156 FsRtlMdlWriteCompleteDev=FsRtlMdlWriteCompleteDev@16
157 FsRtlNormalizeNtstatus=FsRtlNormalizeNtstatus@8
158 FsRtlNotifyChangeDirectory=FsRtlNotifyChangeDirectory@28
159 FsRtlNotifyCleanup=FsRtlNotifyCleanup@12
160 FsRtlNotifyFullChangeDirectory=FsRtlNotifyFullChangeDirectory@40
161 FsRtlNotifyFullReportChange=FsRtlNotifyFullReportChange@36
162 FsRtlNotifyInitializeSync=FsRtlNotifyInitializeSync@4
163 FsRtlNotifyReportChange=FsRtlNotifyReportChange@20
164 FsRtlNotifyUninitializeSync=FsRtlNotifyUninitializeSync@4
165 FsRtlNumberOfRunsInLargeMcb=FsRtlNumberOfRunsInLargeMcb@4
166 FsRtlNumberOfRunsInMcb=FsRtlNumberOfRunsInMcb@4
167 FsRtlOplockFsctrl=FsRtlOplockFsctrl@12
168 FsRtlOplockIsFastIoPossible=FsRtlOplockIsFastIoPossible@4
169 FsRtlPostPagingFileStackOverflow=FsRtlPostPagingFileStackOverflow@12
170 FsRtlPostStackOverflow=FsRtlPostStackOverflow@12
171 FsRtlPrepareMdlWrite=FsRtlPrepareMdlWrite@24
172 FsRtlPrepareMdlWriteDev=FsRtlPrepareMdlWriteDev@28
173 FsRtlPrivateLock=FsRtlPrivateLock@48
174 FsRtlProcessFileLock=FsRtlProcessFileLock@12
175 FsRtlRegisterUncProvider=FsRtlRegisterUncProvider@12
176 FsRtlRemoveLargeMcbEntry=FsRtlRemoveLargeMcbEntry@20
177 FsRtlRemoveMcbEntry=FsRtlRemoveMcbEntry@12
178 FsRtlSplitLargeMcb=FsRtlSplitLargeMcb@20
179 FsRtlSyncVolumes=FsRtlSyncVolumes@12
180 FsRtlTruncateLargeMcb=FsRtlTruncateLargeMcb@12
181 FsRtlTruncateMcb=FsRtlTruncateMcb@8
182 FsRtlUninitializeFileLock=FsRtlUninitializeFileLock@4
183 FsRtlUninitializeLargeMcb=FsRtlUninitializeLargeMcb@4
184 FsRtlUninitializeMcb=FsRtlUninitializeMcb@4
185 FsRtlUninitializeOplock=FsRtlUninitializeOplock@4
186 HalDispatchTable DATA
187 HalPrivateDispatchTable DATA
188 InterlockedCompareExchange=@InterlockedCompareExchange@12
189 InterlockedDecrement=@InterlockedDecrement@4
190 InterlockedExchange=@InterlockedExchange@8
191 InterlockedExchangeAdd=@InterlockedExchangeAdd@8
192 InterlockedIncrement=@InterlockedIncrement@4
193 IoAcquireCancelSpinLock=IoAcquireCancelSpinLock@4
194 IoAcquireVpbSpinLock=IoAcquireVpbSpinLock@4
195 IoAdapterObjectType DATA
196 IoAllocateAdapterChannel=IoAllocateAdapterChannel@20
197 IoAllocateIrp=IoAllocateIrp@8
198 IoAllocateMdl=IoAllocateMdl@20
199 IoAllocateController=IoAllocateController@16
200 IoAllocateErrorLogEntry=IoAllocateErrorLogEntry@8
201 IoAssignResources=IoAssignResources@24
202 IoAttachDevice=IoAttachDevice@12
203 IoAttachDeviceByPointer=IoAttachDeviceByPointer@8
204 IoAttachDeviceToDeviceStack=IoAttachDeviceToDeviceStack@8
205 IoBuildAsynchronousFsdRequest=IoBuildAsynchronousFsdRequest@24
206 IoBuildDeviceIoControlRequest=IoBuildDeviceIoControlRequest@36
207 IoBuildPartialMdl=IoBuildPartialMdl@16
208 IoBuildSynchronousFsdRequest=IoBuildSynchronousFsdRequest@28
209 IoCallDriver=IoCallDriver@8
210 IoCancelIrp=IoCancelIrp@4
211 IoCheckDesiredAccess=IoCheckDesiredAccess@8
212 IoCheckEaBufferValidity=IoCheckEaBufferValidity@12
213 IoCheckFunctionAccess=IoCheckFunctionAccess@24
214 IoCheckShareAccess=IoCheckShareAccess@20
215 IoCompleteRequest=IoCompleteRequest@8
216 IoConnectInterrupt=IoConnectInterrupt@44
217 IoCreateController=IoCreateController@4
218 IoCreateDevice=IoCreateDevice@28
219 IoCreateFile=IoCreateFile@56
220 IoCreateNotificationEvent=IoCreateNotificationEvent@8
221 IoCreateStreamFileObject=IoCreateStreamFileObject@8
222 IoCreateSymbolicLink=IoCreateSymbolicLink@8
223 IoCreateSynchronizationEvent=IoCreateSynchronizationEvent@8
224 IoCreateUnprotectedSymbolicLink=IoCreateUnprotectedSymbolicLink@8
225 IoDeleteController=IoDeleteController@4
226 IoDeleteDevice=IoDeleteDevice@4
227 IoDeleteSymbolicLink=IoDeleteSymbolicLink@4
228 IoDetachDevice=IoDetachDevice@4
229 IoDeviceHandlerObjectSize DATA
230 IoDeviceHandlerObjectType DATA
231 IoDeviceObjectType DATA
232 IoDisconnectInterrupt=IoDisconnectInterrupt@4
233 IoDriverObjectType DATA
234 IoEnqueueIrp=IoEnqueueIrp@4
235 IoFastQueryNetworkAttributes=IoFastQueryNetworkAttributes@20
236 IoFileObjectType DATA
237 IoFreeController=IoFreeController@4
238 IoFreeIrp=IoFreeIrp@4
239 IoFreeMdl=IoFreeMdl@4
240 IoGetAttachedDevice=IoGetAttachedDevice@4
241 IoGetAttachedDeviceReference=IoGetAttachedDeviceReference@4
242 IoGetBaseFileSystemDeviceObject=IoGetBaseFileSystemDeviceObject@4
243 IoGetConfigurationInformation=IoGetConfigurationInformation@0
244 IoGetCurrentProcess=IoGetCurrentProcess@0
245 IoGetDeviceObjectPointer=IoGetDeviceObjectPointer@16
246 IoGetDeviceToVerify=IoGetDeviceToVerify@4
247 IoGetFileObjectGenericMapping=IoGetFileObjectGenericMapping@0
248 IoGetInitialStack=IoGetInitialStack@0
249 IoGetRelatedDeviceObject=IoGetRelatedDeviceObject@4
250 IoGetRequestorProcess=IoGetRequestorProcess@4
251 IoGetStackLimits=IoGetStackLimits@8
252 IoGetTopLevelIrp=IoGetTopLevelIrp@0
253 IoInitializeIrp=IoInitializeIrp@12
254 IoInitializeTimer=IoInitializeTimer@12
255 IoIsOperationSynchronous=IoIsOperationSynchronous@4
256 IoMakeAssociatedIrp=IoMakeAssociatedIrp@8
257 IoOpenDeviceInstanceKey=IoOpenDeviceInstanceKey@20
258 ;IoPageRead=IoPageRead@16
259 IoQueryDeviceDescription=IoQueryDeviceDescription@32
260 IoQueryDeviceEnumInfo=IoQueryDeviceEnumInfo@8
261 IoQueryFileInformation=IoQueryFileInformation@20
262 IoQueryVolumeInformation=IoQueryVolumeInformation@20
263 IoQueueThreadIrp=IoQueueThreadIrp@4
264 IoRaiseHardError=IoRaiseHardError@12
265 IoRaiseInformationalHardError=IoRaiseInformationalHardError@12
266 IoReadOperationCount DATA
267 IoReadPartitionTable=IoReadPartitionTable@16
268 IoReadTransferCount DATA
269 IoRegisterDriverReinitialization=IoRegisterDriverReinitialization@12
270 IoRegisterFileSystem=IoRegisterFileSystem@4
271 IoRegisterFsRegistrationChange=IoRegisterFsRegistrationChange@8
272 IoRegisterShutdownNotification=IoRegisterShutdownNotification@4
273 IoReleaseCancelSpinLock=IoReleaseCancelSpinLock@4
274 IoReleaseVpbSpinLock=IoReleaseVpbSpinLock@4
275 IoRemoveShareAccess=IoRemoveShareAccess@8
276 IoReportHalResourceUsage=IoReportHalResourceUsage@16
277 IoReportResourceUsage=IoReportResourceUsage@36
278 IoSetDeviceToVerify=IoSetDeviceToVerify@8
279 IoSetHardErrorOrVerifyDevice=IoSetHardErrorOrVerifyDevice@8
280 IoSetInformation=IoSetInformation@16
281 IoSetPartitionInformation=IoSetPartitionInformation@16
282 IoSetShareAccess=IoSetShareAccess@16
283 IoSetThreadHardErrorMode=IoSetThreadHardErrorMode@4
284 IoSetTopLevelIrp=IoSetTopLevelIrp@4
285 IoStartNextPacket=IoStartNextPacket@8
286 IoStartNextPacketByKey=IoStartNextPacketByKey@12
287 IoStartPacket=IoStartPacket@16
288 IoStartTimer=IoStartTimer@4
289 IoStatisticsLock DATA
290 IoStopTimer=IoStopTimer@4
291 IoSynchronousPageWrite=IoSynchronousPageWrite@20
292 IoThreadToProcess=IoThreadToProcess@4
293 IoUnregisterFileSystem=IoUnregisterFileSystem@4
294 IoUnregisterFsRegistrationChange=IoUnregisterFsRegistrationChange@8
295 IoUnregisterShutdownNotification=IoUnregisterShutdownNotification@4
296 IoUpdateShareAccess=IoUpdateShareAccess@8
297 IoVerifyVolume=IoVerifyVolume@8
298 IoWriteErrorLogEntry=IoWriteErrorLogEntry@4
299 IoWriteOperationCount DATA
300 IoWritePartitionTable=IoWritePartitionTable@20
301 IoWriteTransferCount DATA
302 IofCallDriver=@IofCallDriver@8
303 IofCompleteRequest=@IofCompleteRequest@8
304 KdDebuggerEnabled DATA
305 KdDebuggerNotPresent DATA
306 KdPollBreakIn=KdPollBreakIn@0
307 KdSystemDebugControl=KdSystemDebugControl@4
308 Ke386CallBios=Ke386CallBios@8
309 ;Ke386IoSetAccessProcess
310 ;Ke386QueryIoAccessMap
312 KeAcquireSpinLockAtDpcLevel=KeAcquireSpinLockAtDpcLevel@4
313 KeAddSystemServiceTable=KeAddSystemServiceTable@20
314 KeAttachProcess=KeAttachProcess@4
315 ;KeBoostCurrentThread
316 KeBugCheck=KeBugCheck@4
317 KeBugCheckEx=KeBugCheckEx@20
318 KeCancelTimer=KeCancelTimer@4
319 KeClearEvent=KeClearEvent@4
320 KeConnectInterrupt=KeConnectInterrupt@4
321 ;KeDcacheFlushCount DATA
322 KeDelayExecutionThread=KeDelayExecutionThread@12
323 KeDeregisterBugCheckCallback=KeDeregisterBugCheckCallback@4
324 KeDetachProcess=KeDetachProcess@0
325 KeDisconnectInterrupt=KeDisconnectInterrupt@4
326 KeEnterCriticalRegion=KeEnterCriticalRegion@0
327 KeEnterKernelDebugger=KeEnterKernelDebugger@0
328 ;KeFindConfigurationEntry
329 ;KeFindConfigurationNextEntry
331 KeGetCurrentThread=KeGetCurrentThread@0
332 KeGetPreviousMode=KeGetPreviousMode@0
334 ;KeI386AllocateGdtSelectors
335 ;KeI386Call16BitCStyleFunction
336 ;KeI386Call16BitFunction
337 ;KeI386FlatToGdtSelector
340 ;KeI386ReleaseGdtSelectors
342 ;KeI386SetGdtSelector
343 ;KeIcacheFlushCount DATA
344 KeInitializeApc=KeInitializeApc@32
345 KeInitializeDeviceQueue=KeInitializeDeviceQueue@4
346 KeInitializeDpc=KeInitializeDpc@12
347 KeInitializeEvent=KeInitializeEvent@12
348 KeInitializeInterrupt=KeInitializeInterrupt@44
350 KeInitializeMutex=KeInitializeMutex@8
352 KeInitializeSemaphore=KeInitializeSemaphore@12
353 KeInitializeSpinLock=KeInitializeSpinLock@4
354 KeInitializeTimer=KeInitializeTimer@4
355 KeInitializeTimerEx=KeInitializeTimerEx@8
356 KeInsertByKeyDeviceQueue=KeInsertByKeyDeviceQueue@12
357 KeInsertDeviceQueue=KeInsertDeviceQueue@8
360 KeInsertQueueApc=KeInsertQueueApc@16
361 KeInsertQueueDpc=KeInsertQueueDpc@12
363 KeLeaveCriticalRegion=KeLeaveCriticalRegion@0
365 KeNumberProcessors DATA
367 ;KeProfileInterruptWithSource
368 KePulseEvent=KePulseEvent@12
369 KeQuerySystemTime=KeQuerySystemTime@4
370 KeQueryTickCount=KeQueryTickCount@4
371 KeQueryTimeIncrement=KeQueryTimeIncrement@0
372 ;KeRaiseUserException
373 KeReadStateEvent=KeReadStateEvent@4
375 KeReadStateMutex=KeReadStateMutex@4
377 KeReadStateSemaphore=KeReadStateSemaphore@4
378 KeReadStateTimer=KeReadStateTimer@4
379 KeRegisterBugCheckCallback=KeRegisterBugCheckCallback@20
381 KeReleaseMutex=KeReleaseMutex@8
382 KeReleaseSemaphore=KeReleaseSemaphore@16
383 KeReleaseSpinLockFromDpcLevel=KeReleaseSpinLockFromDpcLevel@4
384 KeRemoveByKeyDeviceQueue=KeRemoveByKeyDeviceQueue@8
385 KeRemoveDeviceQueue=KeRemoveDeviceQueue@4
386 ;KeRemoveEntryDeviceQueue
388 KeRemoveQueueDpc=KeRemoveQueueDpc@4
389 KeResetEvent=KeResetEvent@4
390 ;KeRestoreFloatingPointState
392 ;KeSaveFloatingPointState
393 KeServiceDescriptorTable DATA
395 KeSetBasePriorityThread=KeSetBasePriorityThread@8
397 KeSetEvent=KeSetEvent@12
398 ;KeSetEventBoostPriority
399 ;KeSetIdealProcessorThread
400 KeSetImportanceDpc=KeSetImportanceDpc@8
401 ;KeSetKernelStackSwapEnable
402 KeSetPriorityThread=KeSetPriorityThread@8
404 ;KeSetSwapContextNotifyRoutine
405 KeSetTargetProcessorDpc=KeSetTargetProcessorDpc@8
406 ;KeSetThreadSelectNotifyRoutine
408 KeSetTimer=KeSetTimer@16
409 KeSetTimerEx=KeSetTimerEx@20
410 ;KeSetTimeUpdateNotifyRoutine
411 KeSynchronizeExecution=KeSynchronizeExecution@12
416 KeWaitForMultipleObjects=KeWaitForMultipleObjects@32
417 KeWaitForMutexObject=KeWaitForMutexObject@20
418 KeWaitForSingleObject=KeWaitForSingleObject@20
419 ;KefAcquireSpinLockAtDpcLevel
420 ;KefReleaseSpinLockFromDpcLevel
424 ;KiCoprocessorError@0
425 KiDeliverApc=KiDeliverApc@12
426 KiDispatchInterrupt=KiDispatchInterrupt@0
427 ;KiIpiServiceRoutine@8
429 ;KiUnexpectedInterrupt
430 ;Kii386SpinOnSpinLock
432 LdrAccessResource=LdrAccessResource@16
434 ;LdrFindResourceDirectory_U@16
435 LdrFindResource_U=LdrFindResource_U@16
437 LsaCallAuthenticationPackage=LsaCallAuthenticationPackage@28
438 LsaDeregisterLogonProcess=LsaDeregisterLogonProcess@8
439 LsaFreeReturnBuffer=LsaFreeReturnBuffer@4
440 LsaLogonUser=LsaLogonUser@56
441 LsaLookupAuthenticationPackage=LsaLookupAuthenticationPackage@12
442 LsaRegisterLogonProcess=LsaRegisterLogonProcess@12
443 MmAdjustWorkingSetSize=MmAdjustWorkingSetSize@12
444 MmAllocateContiguousAlignedMemory=MmAllocateContiguousAlignedMemory@16
445 MmAllocateContiguousMemory=MmAllocateContiguousMemory@12
446 MmAllocateNonCachedMemory=MmAllocateNonCachedMemory@4
447 MmBuildMdlForNonPagedPool=MmBuildMdlForNonPagedPool@4
448 MmCanFileBeTruncated=MmCanFileBeTruncated@8
449 MmCreateMdl=MmCreateMdl@12
450 MmCreateSection=MmCreateSection@32
451 MmDbgTranslatePhysicalAddress=MmDbgTranslatePhysicalAddress@8
452 MmDisableModifiedWriteOfSection=MmDisableModifiedWriteOfSection@4
453 MmFlushImageSection=MmFlushImageSection@8
454 MmForceSectionClosed=MmForceSectionClosed@8
455 MmFreeContiguousMemory=MmFreeContiguousMemory@4
456 MmFreeNonCachedMemory=MmFreeNonCachedMemory@8
457 MmGetPhysicalAddress=MmGetPhysicalAddress@4
458 MmGrowKernelStack=MmGrowKernelStack@4
459 MmHighestUserAddress DATA
460 MmIsAddressValid=MmIsAddressValid@4
461 MmIsNonPagedSystemAddressValid=MmIsNonPagedSystemAddressValid@4
462 MmIsRecursiveIoFault=MmIsRecursiveIoFault@0
463 MmIsThisAnNtAsSystem=MmIsThisAnNtAsSystem@0
464 MmLockPagableDataSection=MmLockPagableDataSection@4
465 MmLockPagableImageSection=MmLockPagableDataSection@4
466 MmLockPagableSectionByHandle=MmLockPagableSectionByHandle@4
467 MmMapIoSpace=MmMapIoSpace@16
468 MmMapLockedPages=MmMapLockedPages@8
469 MmMapMemoryDumpMdl=MmMapMemoryDumpMdl@4
470 MmMapVideoDisplay=MmMapVideoDisplay@16
471 MmMapViewInSystemSpace=MmMapViewInSystemSpace@12
472 MmMapViewOfSection=MmMapViewOfSection@40
473 MmPageEntireDriver=MmPageEntireDriver@4
474 MmProbeAndLockPages=MmProbeAndLockPages@12
475 MmQuerySystemSize=MmQuerySystemSize@0
476 MmResetDriverPaging=MmResetDriverPaging@4
477 MmSectionObjectType DATA
478 MmSecureVirtualMemory=MmSecureVirtualMemory@12
479 MmSetAddressRangeModified=MmSetAddressRangeModified@8
480 MmSetBankedSection=MmSetBankedSection@24
481 MmSizeOfMdl=MmSizeOfMdl@8
482 MmUnlockPagableImageSection=MmUnlockPagableImageSection@4
483 MmUnlockPages=MmUnlockPages@4
484 MmUnmapIoSpace=MmUnmapIoSpace@8
485 MmUnmapLockedPages=MmUnmapLockedPages@8
486 MmUnmapVideoDisplay=MmUnmapVideoDisplay@8
487 MmUnmapViewInSystemSpace=MmUnmapViewInSystemSpace@4
488 MmUnmapViewOfSection=MmUnmapViewOfSection@8
489 MmUnsecureVirtualMemory=MmUnsecureVirtualMemory@4
490 MmUserProbeAddress DATA
493 NlsMbCodePageTag DATA
494 NlsMbOemCodePageTag DATA
495 NlsOemLeadByteInfo DATA
496 NtAddAtom=NtAddAtom@8
497 NtAdjustPrivilegesToken=NtAdjustPrivilegesToken@24
498 NtAllocateLocallyUniqueId=NtAllocateLocallyUniqueId@4
499 NtAllocateUuids=NtAllocateUuids@12
500 NtAllocateVirtualMemory=NtAllocateVirtualMemory@24
503 NtConnectPort=NtConnectPort@32
504 NtCreateEvent=NtCreateEvent@20
505 NtCreateTimer=NtCreateTimer@16
506 NtOpenEvent=NtOpenEvent@12
507 NtCreateFile=NtCreateFile@44
508 NtCreateSection=NtCreateSection@28
509 NtDeleteAtom=NtDeleteAtom@4
510 NtDeleteFile=NtDeleteFile@4
511 NtDeviceIoControlFile=NtDeviceIoControlFile@40
512 NtDuplicateObject=NtDuplicateObject@28
513 NtDuplicateToken=NtDuplicateToken@24
514 NtFindAtom=NtFindAtom@8
515 NtFreeVirtualMemory=NtFreeVirtualMemory@16
516 NtFsControlFile=NtFsControlFile@40
518 NtLockFile=NtLockFile@40
519 NtMapViewOfSection=NtMapViewOfSection@40
520 NtNotifyChangeDirectoryFile=NtNotifyChangeDirectoryFile@36
521 NtOpenFile=NtOpenFile@24
522 NtOpenProcess=NtOpenProcess@16
523 NtOpenProcessToken=NtOpenProcessToken@12
524 NtQueryDirectoryFile=NtQueryDirectoryFile@44
525 NtQueryEaFile=NtQueryEaFile@36
526 NtQueryInformationAtom=NtQueryInformationAtom@20
527 NtQueryInformationFile=NtQueryInformationFile@20
528 NtQueryInformationProcess=NtQueryInformationProcess@20
529 NtQueryInformationToken=NtQueryInformationToken@20
530 ;NtQueryOleDirectoryFile@44 <--- ?
531 NtQuerySecurityObject=NtQuerySecurityObject@20
532 NtQuerySystemTime=NtQuerySystemTime@4
533 NtQueryVolumeInformationFile=NtQueryVolumeInformationFile@20
534 NtReadFile=NtReadFile@36
535 NtRequestPort=NtRequestPort@8
536 NtRequestWaitReplyPort@12
537 NtSetEvent=NtSetEvent@8
538 NtSetInformationFile=NtSetInformationFile@20
539 NtSetInformationProcess=NtSetInformationProcess@16
540 NtSetInformationThread=NtSetInformationThread@16
541 NtSetSecurityObject=NtSetSecurityObject@12
542 NtSetSystemTime=NtSetSystemTime@8
543 NtUnlockFile=NtUnlockFile@20
544 NtVdmControl=NtVdmControl@8
545 NtWaitForSingleObject=NtWaitForSingleObject@12
546 NtWriteFile=NtWriteFile@36
547 ;ObAssignSecurity=ObAssignSecurity@16
548 ;ObCheckCreateObjectAccess=ObCheckCreateObjectAccess@28
549 ;ObCheckObjectAccess=ObCheckObjectAccess@20
550 ;ObCreateObject=ObCreateObject@36
551 ObCreateObject=ObCreateObject@20
552 ;ObFindHandleForObject=ObFindHandleForObject@20
553 ;ObGetObjectPointerCount=ObGetObjectPointerCount@4
554 ;ObGetObjectSecurity=ObGetObjectSecurity@12
555 ;ObInsertObject=ObInsertObject@24
556 ObMakeTemporaryObject=ObMakeTemporaryObject@4
557 ObOpenObjectByName=ObOpenObjectByName@28
558 ObOpenObjectByPointer=ObOpenObjectByPointer@28
559 ;ObQueryNameString=ObQueryNameString@16
560 ;ObQueryObjectAuditingByHandle=ObQueryObjectAuditingByHandle@8
561 ObfDereferenceObject=@ObfDereferenceObject@4
562 ObfReferenceObject=@ObfReferenceObject@4
563 ObReferenceObjectByHandle=ObReferenceObjectByHandle@24
564 ObReferenceObjectByName=ObReferenceObjectByName@32
565 ObReferenceObjectByPointer=ObReferenceObjectByPointer@16
566 ;ObReleaseObjectSecurity=ObReleaseObjectSecurity@8
567 ;ObSetSecurityDescriptorInfo=ObSetSecurityDescriptorInfo@24
568 ObAddEntryDirectory=ObAddEntryDirectory@12
573 PoCallDriver=PoCallDriver@8
574 PoRegisterDeviceForIdleDetection=PoRegisterDeviceForIdleDetection@16
575 PoRegisterSystemState=PoRegisterSystemState@8
576 PoRequestPowerIrp=PoRequestPowerIrp@24
577 PoSetDeviceBusy=PoSetDeviceBusy@4
578 PoSetPowerState=PoSetPowerState@12
579 PoSetSystemState=PoSetSystemState@4
580 PoStartNextPowerIrp=PoStartNextPowerIrp@4
581 PoUnregisterSystemState=PoUnregisterSystemState@4
582 ;ProbeForWrite=ProbeForWrite@12
583 PsAssignImpersonationToken=PsAssignImpersonationToken@8
584 ;PsChargePoolQuota=PsChargePoolQuota@12
585 PsCreateSystemProcess=PsCreateSystemProcess@12
586 PsCreateSystemThread=PsCreateSystemThread@28
587 ;PsCreateWin32Process
588 PsDispatchThread=PsDispatchThread@4
589 ;PsEstablishWin32Callouts
590 PsGetCurrentProcessId=PsGetCurrentProcessId@0
591 PsGetCurrentThreadId=PsGetCurrentThreadId@0
592 PsGetCurrentThread=PsGetCurrentThread@0
593 ;PsGetProcessExitTime
594 PsGetVersion=PsGetVersion@16
595 PsImpersonateClient=PsImpersonateClient@20
596 PsInitialSystemProcess DATA
597 ;PsIsThreadTerminating
598 ;PsLookupProcessByProcessId
599 ;PsLookupProcessThreadByCid
600 ;PsLookupThreadByThreadId
602 PsReferenceImpersonationToken=PsReferenceImpersonationToken@16
603 PsReferencePrimaryToken=PsReferencePrimaryToken@4
605 PsRevertToSelf=PsRevertToSelf@4
606 ;PsSetCreateProcessNotifyRoutine
607 ;PsSetCreateThreadNotifyRoutine
608 ;PsSetLegoNotifyRoutine
609 ;PsSetProcessPriorityByClass
610 PsTerminateSystemThread=PsTerminateSystemThread@4
612 READ_REGISTER_UCHAR=READ_REGISTER_UCHAR@4
613 READ_REGISTER_ULONG=READ_REGISTER_ULONG@4
614 READ_REGISTER_USHORT=READ_REGISTER_USHORT@4
615 READ_REGISTER_BUFFER_UCHAR=READ_REGISTER_BUFFER_UCHAR@12
616 READ_REGISTER_BUFFER_ULONG=READ_REGISTER_BUFFER_ULONG@12
617 READ_REGISTER_BUFFER_USHORT=READ_REGISTER_BUFFER_USHORT@12
618 RtlAbsoluteToSelfRelativeSD=RtlAbsoluteToSelfRelativeSD@12
619 RtlAddAccessAllowedAce=RtlAddAccessAllowedAce@16
620 RtlAddAce=RtlAddAce@20
621 RtlAddAtomToAtomTable=RtlAddAtomToAtomTable@12
622 ;RtlAllocateAndInitializeSid
624 RtlAnsiCharToUnicodeChar=RtlAnsiCharToUnicodeChar@4
625 RtlAnsiStringToUnicodeSize=RtlAnsiStringToUnicodeSize@4
626 RtlAnsiStringToUnicodeString=RtlAnsiStringToUnicodeString@12
627 RtlAppendAsciizToString=RtlAppendAsciizToString@8
628 RtlAppendStringToString=RtlAppendStringToString@8
629 RtlAppendUnicodeStringToString=RtlAppendUnicodeStringToString@8
630 RtlAppendUnicodeToString=RtlAppendUnicodeToString@8
631 RtlAreAllAccessesGranted=RtlAreAllAccessesGranted@8
632 RtlAreAnyAccessesGranted=RtlAreAnyAccessesGranted@8
633 RtlAreBitsClear=RtlAreBitsClear@12
634 RtlAreBitsSet=RtlAreBitsSet@12
635 RtlAssert=RtlAssert@16
636 ;RtlCaptureStackBackTrace
637 RtlCharToInteger=RtlCharToInteger@12
638 RtlCheckRegistryKey=RtlCheckRegistryKey@8
639 RtlClearAllBits=RtlClearAllBits@4
640 RtlClearBits=RtlClearBits@12
641 RtlCompareMemory=RtlCompareMemory@12
642 RtlCompareMemoryUlong=RtlCompareMemoryUlong@12
643 RtlCompareString=RtlCompareString@12
644 RtlCompareUnicodeString=RtlCompareUnicodeString@12
647 RtlConvertLongToLargeInteger=RtlConvertLongToLargeInteger@4
648 RtlConvertSidToUnicodeString=RtlConvertSidToUnicodeString@12
649 RtlConvertUlongToLargeInteger=RtlConvertUlongToLargeInteger@4
650 RtlCopyLuid=RtlCopyLuid@8
651 RtlCopySid=RtlCopySid@12
652 RtlCopyString=RtlCopyString@8
653 RtlCopyUnicodeString=RtlCopyUnicodeString@8
654 RtlCreateAcl=RtlCreateAcl@12
655 RtlCreateAtomTable=RtlCreateAtomTable@8
657 RtlCreateRegistryKey=RtlCreateRegistryKey@8
658 RtlCreateSecurityDescriptor=RtlCreateSecurityDescriptor@8
659 RtlCreateUnicodeString=RtlCreateUnicodeString@8
660 RtlCustomCPToUnicodeN=RtlCustomCPToUnicodeN@24
663 ;RtlDecompressFragment
665 RtlDeleteAtomFromAtomTable=RtlDeleteAtomFromAtomTable@8
666 ;RtlDeleteElementGenericTable
668 RtlDeleteRegistryValue=RtlDeleteRegistryValue@12
670 RtlDestroyAtomTable=RtlDestroyAtomTable@4
672 RtlDowncaseUnicodeString=RtlDowncaseUnicodeString@12
673 RtlEmptyAtomTable=RtlEmptyAtomTable@8
674 RtlEnlargedIntegerMultiply=RtlEnlargedIntegerMultiply@8
675 RtlEnlargedUnsignedDivide=RtlEnlargedUnsignedDivide@16
676 RtlEnlargedUnsignedMultiply=RtlEnlargedUnsignedMultiply@8
677 ;RtlEnumerateGenericTable
678 ;RtlEnumerateGenericTableWithoutSplaying
679 RtlEqualLuid=RtlEqualLuid@8
680 RtlEqualSid=RtlEqualSid@8
681 RtlEqualString=RtlEqualString@12
682 RtlEqualUnicodeString=RtlEqualUnicodeString@12
683 RtlExtendedIntegerMultiply=RtlExtendedIntegerMultiply@12
684 RtlExtendedLargeIntegerDivide=RtlExtendedLargeIntegerDivide@16
685 RtlExtendedMagicDivide=RtlExtendedMagicDivide@20
686 RtlFillMemory=RtlFillMemory@12
687 RtlFillMemoryUlong=RtlFillMemoryUlong@12
688 RtlFindClearBits=RtlFindClearBits@12
689 RtlFindClearBitsAndSet=RtlFindClearBitsAndSet@12
690 RtlFindFirstRunClear=RtlFindFirstRunClear@8
691 RtlFindFirstRunSet=RtlFindFirstRunSet@8
692 RtlFindLongestRunClear=RtlFindLongestRunClear@8
693 RtlFindLongestRunSet=RtlFindLongestRunSet@8
694 RtlFindMessage=RtlFindMessage@20
695 RtlFindSetBits=RtlFindSetBits@12
696 RtlFindSetBitsAndClear=RtlFindSetBitsAndClear@12
697 ;RtlFindUnicodePrefix
698 RtlFormatCurrentUserKeyPath=RtlFormatCurrentUserKeyPath@4
699 RtlFreeAnsiString=RtlFreeAnsiString@4
701 RtlFreeOemString=RtlFreeOemString@4
702 RtlFreeUnicodeString=RtlFreeUnicodeString@4
703 ;RtlGenerate8dot3Name
704 ;RtlGetCallersAddress
705 ;RtlGetCompressionWorkSpaceSize
706 RtlGetDaclSecurityDescriptor=RtlGetDaclSecurityDescriptor@16
707 RtlGetDefaultCodePage=RtlGetDefaultCodePage@8
708 ;RtlGetElementGenericTable
709 RtlGetGroupSecurityDescriptor=RtlGetGroupSecurityDescriptor@12
710 RtlGetOwnerSecurityDescriptor=RtlGetOwnerSecurityDescriptor@12
711 RtlImageNtHeader=RtlImageNtHeader@4
712 RtlInitAnsiString=RtlInitAnsiString@8
713 ;RtlInitCodePageTable
714 RtlInitString=RtlInitString@8
715 RtlInitUnicodeString=RtlInitUnicodeString@8
716 RtlInitializeBitMap=RtlInitializeBitMap@12
717 ;RtlInitializeGenericTable
718 RtlInitializeSid=RtlInitializeSid@12
719 ;RtlInitializeUnicodePrefix
720 ;RtlInsertElementGenericTable
721 ;RtlInsertUnicodePrefix
722 RtlIntegerToChar=RtlIntegerToChar@16
723 RtlIntegerToUnicodeString=RtlIntegerToUnicodeString@12
724 ;RtlIsNameLegalDOS8Dot3
725 RtlLargeIntegerAdd=RtlLargeIntegerAdd@16
726 RtlLargeIntegerArithmeticShift=RtlLargeIntegerArithmeticShift@12
727 RtlLargeIntegerDivide=RtlLargeIntegerDivide@20
728 RtlLargeIntegerNegate=RtlLargeIntegerNegate@8
729 RtlLargeIntegerShiftLeft=RtlLargeIntegerShiftLeft@12
730 RtlLargeIntegerShiftRight=RtlLargeIntegerShiftRight@12
731 RtlLargeIntegerSubtract=RtlLargeIntegerSubtract@16
732 RtlLengthRequiredSid=RtlLengthRequiredSid@4
733 RtlLengthSecurityDescriptor=RtlLengthSecurityDescriptor@4
734 RtlLengthSid=RtlLengthSid@4
735 RtlLookupAtomInAtomTable=RtlLookupAtomInAtomTable@12
736 ;RtlLookupElementGenericTable
737 RtlMapGenericMask=RtlMapGenericMask@8
738 RtlMoveMemory=RtlMoveMemory@12
739 RtlMultiByteToUnicodeN=RtlMultiByteToUnicodeN@20
740 RtlMultiByteToUnicodeSize=RtlMultiByteToUnicodeSize@12
741 ;RtlNextUnicodePrefix
742 RtlNtStatusToDosError=RtlNtStatusToDosError@4
743 RtlNtStatusToDosErrorNoTeb=RtlNtStatusToDosErrorNoTeb@4
744 ;RtlNumberGenericTableElements
745 RtlNumberOfClearBits=RtlNumberOfClearBits@4
746 RtlNumberOfSetBits=RtlNumberOfSetBits@4
747 RtlOemStringToCountedUnicodeString=RtlOemStringToCountedUnicodeString@12
748 RtlOemStringToUnicodeSize=RtlOemStringToUnicodeSize@4
749 RtlOemStringToUnicodeString=RtlOemStringToUnicodeString@12
750 RtlPinAtomInAtomTable=RtlPinAtomInAtomTable@8
751 RtlPrefixString=RtlPrefixString@12
752 RtlPrefixUnicodeString=RtlPrefixUnicodeString@12
753 RtlQueryAtomInAtomTable=RtlQueryAtomInAtomTable@24
754 RtlQueryRegistryValues=RtlQueryRegistryValues@20
755 RtlQueryTimeZoneInformation=RtlQueryTimeZoneInformation@4
756 RtlRaiseException=RtlRaiseException@4
758 ;RtlRemoveUnicodePrefix
760 RtlSecondsSince1970ToTime=RtlSecondsSince1970ToTime@8
761 RtlSecondsSince1980ToTime=RtlSecondsSince1980ToTime@8
762 RtlSetAllBits=RtlSetAllBits@4
763 RtlSetBits=RtlSetBits@12
764 RtlSetDaclSecurityDescriptor=RtlSetDaclSecurityDescriptor@16
765 RtlSetGroupSecurityDescriptor=RtlSetGroupSecurityDescriptor@12
766 RtlSetOwnerSecurityDescriptor=RtlSetOwnerSecurityDescriptor@12
767 RtlSetSaclSecurityDescriptor=RtlSetSaclSecurityDescriptor@16
768 RtlSetTimeZoneInformation=RtlSetTimeZoneInformation@4
770 RtlSubAuthorityCountSid=RtlSubAuthorityCountSid@4
771 RtlSubAuthoritySid=RtlSubAuthoritySid@8
772 RtlTimeFieldsToTime=RtlTimeFieldsToTime@8
773 RtlTimeToSecondsSince1970=RtlTimeToSecondsSince1970@8
774 RtlTimeToSecondsSince1980=RtlTimeToSecondsSince1980@8
775 RtlTimeToTimeFields=RtlTimeToTimeFields@8
776 RtlUnicodeStringToAnsiSize=RtlUnicodeStringToAnsiSize@4
777 RtlUnicodeStringToAnsiString=RtlUnicodeStringToAnsiString@12
778 RtlUnicodeStringToCountedOemString=RtlUnicodeStringToCountedOemString@12
779 RtlUnicodeStringToInteger=RtlUnicodeStringToInteger@12
780 RtlUnicodeStringToOemSize=RtlUnicodeStringToOemSize@4
781 RtlUnicodeStringToOemString=RtlUnicodeStringToOemString@12
782 RtlUnicodeToCustomCPN=RtlUnicodeToCustomCPN@24
783 RtlUnicodeToMultiByteN=RtlUnicodeToMultiByteN@20
784 RtlUnicodeToMultiByteSize=RtlUnicodeToMultiByteSize@12
785 RtlUnicodeToOemN=RtlUnicodeToOemN@20
786 RtlUnwind=RtlUnwind@16
787 RtlUpcaseUnicodeChar=RtlUpcaseUnicodeChar@4
788 RtlUpcaseUnicodeString=RtlUpcaseUnicodeString@12
789 RtlUpcaseUnicodeStringToAnsiString=RtlUpcaseUnicodeStringToAnsiString@12
790 RtlUpcaseUnicodeStringToCountedOemString=RtlUpcaseUnicodeStringToCountedOemString@12
791 RtlUpcaseUnicodeStringToOemString=RtlUpcaseUnicodeStringToOemString@12
792 RtlUpcaseUnicodeToCustomCPN=RtlUpcaseUnicodeToCustomCPN@24
793 RtlUpcaseUnicodeToMultiByteN=RtlUpcaseUnicodeToMultiByteN@20
794 RtlUpcaseUnicodeToOemN=RtlUpcaseUnicodeToOemN@20
795 RtlUpperChar=RtlUpperChar@4
796 RtlUpperString=RtlUpperString@8
797 RtlValidSecurityDescriptor=RtlValidSecurityDescriptor@4
798 RtlValidSid=RtlValidSid@4
799 RtlWriteRegistryValue=RtlWriteRegistryValue@24
801 RtlZeroMemory=RtlZeroMemory@8
802 RtlxAnsiStringToUnicodeSize=RtlxAnsiStringToUnicodeSize@4
803 RtlxOemStringToUnicodeSize=RtlxOemStringToUnicodeSize@4
804 RtlxUnicodeStringToAnsiSize=RtlxUnicodeStringToAnsiSize@4
805 RtlxUnicodeStringToOemSize=RtlxUnicodeStringToOemSize@4
806 SeAccessCheck=SeAccessCheck@40
807 ;SeAppendPrivileges=SeAppendPrivileges@8
808 SeAssignSecurity=SeAssignSecurity@28
809 ;SeAuditingFileEvents=SeAuditingFileEvents@8
810 ;SeAuditingFileOrGlobalEvents=SeAuditingFileOrGlobalEvents@18
811 ;SeCaptureSecurityDescriptor=SeCaptureSecurityDescriptor@20
812 SeCaptureSubjectContext=SeCaptureSubjectContext@4
813 ;SeCloseObjectAuditAlarm=SeCloseObjectAuditAlarm@12
814 ;SeCreateAccessState=SeCreateAccessState@16
815 SeCreateClientSecurity=SeCreateClientSecurity@16
816 SeDeassignSecurity=SeDeassignSecurity@4
817 ;SeDeleteAccessState=SeDeleteAccessState@4
818 ;SeDeleteObjectAuditAlarm=SeDeleteObjectAuditAlarm@8
820 ;SeFreePrivileges=SeFreePrivileges@4
821 SeImpersonateClient=SeImpersonateClient@8
822 ;SeLockSubjectContext=SeLockSubjectContext@4
823 ;SeMarkLogonSessionForTerminationNotification=SeMarkLogonSessionForTerminationNotification@4
824 ;SeOpenObjectAuditAlarm=SeOpenObjectAuditAlarm@36
825 ;SeOpenObjectForDeleteAuditAlarm=SeOpenObjectForDeleteAuditAlarm@36
826 SePrivilegeCheck=SePrivilegeCheck@12
827 ;SePrivilegeObjectAuditAlarm=SePrivilegeObjectAuditAlarm@24
828 ;SePublicDefaultDacl DATA
829 ;SeQueryAuthenticationIdToken=SeQueryAuthenticationIdToken@8
830 ;SeQuerySecurityDescriptorInfo=SeQuerySecurityDescriptorInfo@16
831 ;SeRegisterLogonSessionTerminatedRoutine=SeRegisterLogonSessionTerminatedRoutine@4
832 ;SeReleaseSecurityDescriptor=SeReleaseSecurityDescriptor@12
833 SeReleaseSubjectContext=SeReleaseSubjectContext@4
834 ;SeSetAccessStateGenericMapping=SeSetAccessStateGenericMapping@8
835 ;SeSetSecurityDescriptorInfo=SeSetSecurityDescriptorInfo@24
836 ;SeSinglePrivilegeCheck=SeSinglePrivilegeCheck@12
837 ;SeSystemDefaultDacl DATA
838 ;SeTokenImpersonationLevel=SeTokenImpersonationLevel@4
840 ;SeUnlockSubjectContext=SeUnlockSubjectContext@4
841 ;SeUnregisterLogonSessionTerminatedRoutine=SeUnregisterLogonSessionTerminatedRoutine@4
842 ;SeValidSecurityDescriptor=SeValidSecurityDescriptor@8
843 WRITE_REGISTER_UCHAR=WRITE_REGISTER_UCHAR@8
844 WRITE_REGISTER_ULONG=WRITE_REGISTER_ULONG@8
845 WRITE_REGISTER_USHORT=WRITE_REGISTER_USHORT@8
846 WRITE_REGISTER_BUFFER_UCHAR=WRITE_REGISTER_BUFFER_UCHAR@12
847 WRITE_REGISTER_BUFFER_ULONG=WRITE_REGISTER_BUFFER_ULONG@12
848 WRITE_REGISTER_BUFFER_USHORT=WRITE_REGISTER_BUFFER_USHORT@12
849 ZwAccessCheckAndAuditAlarm=ZwAccessCheckAndAuditAlarm@44
850 ZwAlertThread=ZwAlertThread@4
851 ZwAllocateVirtualMemory=ZwAllocateVirtualMemory@24
852 ZwClearEvent=ZwClearEvent@4
854 ZwCloseObjectAuditAlarm=ZwCloseObjectAuditAlarm@12
855 ZwConnectPort=ZwConnectPort@32
856 ZwCreateDirectoryObject=ZwCreateDirectoryObject@12
857 ZwCreateEvent=ZwCreateEvent@20
858 ZwCreateFile=ZwCreateFile@44
859 ZwCreateKey=ZwCreateKey@28
860 ZwCreateSection=ZwCreateSection@28
861 ZwCreateSymbolicLinkObject=ZwCreateSymbolicLinkObject@16
862 ZwDeleteFile=ZwDeleteFile@4
863 ZwDeleteKey=ZwDeleteKey@4
864 ZwDeleteValueKey=ZwDeleteValueKey@8
865 ZwDeviceIoControlFile=ZwDeviceIoControlFile@40
866 ZwDisplayString=ZwDisplayString@4
867 ZwDuplicateObject=ZwDuplicateObject@28
868 ZwDuplicateToken=ZwDuplicateToken@24
869 ZwEnumerateKey=ZwEnumerateKey@24
870 ZwEnumerateValueKey=ZwEnumerateValueKey@24
871 ZwFlushInstructionCache=ZwFlushInstructionCache@12
872 ZwFlushKey=ZwFlushKey@4
873 ZwFreeVirtualMemory=ZwFreeVirtualMemory@16
874 ZwFsControlFile=ZwFsControlFile@40
875 ZwLoadDriver=ZwLoadDriver@4
876 ZwLoadKey=ZwLoadKey@8
877 ZwMakeTemporaryObject=ZwMakeTemporaryObject@4
878 ZwMapViewOfSection=ZwMapViewOfSection@40
879 ZwNotifyChangeKey=ZwNotifyChangeKey@40
880 ZwOpenDirectoryObject=ZwOpenDirectoryObject@12
881 ZwOpenEvent=ZwOpenEvent@12
882 ZwOpenFile=ZwOpenFile@24
883 ZwOpenKey=ZwOpenKey@12
884 ZwOpenProcess=ZwOpenProcess@16
885 ZwOpenProcessToken=ZwOpenProcessToken@12
886 ZwOpenSection=ZwOpenSection@12
887 ZwOpenSymbolicLinkObject=ZwOpenSymbolicLinkObject@12
888 ZwOpenThread=ZwOpenThread@16
889 ZwOpenThreadToken=ZwOpenThreadToken@16
890 ZwPulseEvent=ZwPulseEvent@8
891 ZwQueryDefaultLocale=ZwQueryDefaultLocale@8
892 ZwQueryDirectoryFile=ZwQueryDirectoryFile@44
893 ZwQueryInformationAtom=ZwQueryInformationAtom@20
894 ZwQueryInformationFile=ZwQueryInformationFile@20
895 ZwQueryInformationProcess=ZwQueryInformationProcess@20
896 ZwQueryInformationToken=ZwQueryInformationToken@20
897 ZwQueryKey=ZwQueryKey@20
898 ZwQueryObject=ZwQueryObject@20
899 ZwQuerySection=ZwQuerySection@20
900 ZwQuerySecurityObject=ZwQuerySecurityObject@20
901 ZwQuerySymbolicLinkObject=ZwQuerySymbolicLinkObject@12
902 ZwQuerySystemInformation=ZwQuerySystemInformation@16
903 ZwQuerySystemTime=ZwQuerySystemTime@4
904 ZwQueryValueKey=ZwQueryValueKey@24
905 ZwQueryVolumeInformationFile=ZwQueryVolumeInformationFile@20
906 ZwReadFile=ZwReadFile@36
907 ZwReplaceKey=ZwReplaceKey@12
908 ZwRequestWaitReplyPort=ZwRequestWaitReplyPort@12
909 ZwResetEvent=ZwResetEvent@8
910 ZwSaveKey=ZwSaveKey@8
911 ZwSetDefaultLocale=ZwSetDefaultLocale@8
912 ZwSetEvent=ZwSetEvent@8
913 ZwSetInformationFile=ZwSetInformationFile@20
914 ZwSetInformationObject=ZwSetInformationObject@16
915 ZwSetInformationProcess=ZwSetInformationProcess@16
916 ZwSetInformationThread=ZwSetInformationThread@16
917 ZwSetSystemInformation=ZwSetSystemInformation@12
918 ZwSetSystemTime=ZwSetSystemTime@8
919 ZwSetValueKey=ZwSetValueKey@24
920 ZwTerminateProcess=ZwTerminateProcess@8
921 ZwUnloadDriver=ZwUnloadDriver@4
922 ZwUnloadKey=ZwUnloadKey@4
923 ZwUnmapViewOfSection=ZwUnmapViewOfSection@8
924 ZwWaitForMultipleObjects=ZwWaitForMultipleObjects@20
925 ZwWaitForSingleObject=ZwWaitForSingleObject@12
926 ZwWriteFile=ZwWriteFile@36
927 ZwYieldExecution=ZwYieldExecution@0
928 ;_abnormal_termination