1 ; $Id: ntoskrnl.edf,v 1.112 2002/01/27 01:11:23 dwelch Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache=CcRosInitializeFileCache@12
9 CcMdlReadComplete=CcMdlReadComplete@8
10 ;CcRosRequestCacheSegment=CcRosRequestCacheSegment@20
11 ;CcRosReleaseCacheSegment=CcRosReleaseCacheSegment@12
12 CcRosReleaseFileCache=CcRosReleaseFileCache@8
13 CcCopyRead=CcCopyRead@24
14 CcCopyWrite=CcCopyWrite@20
15 CcMapData=CcMapData@24
16 CcSetDirtyPinnedData=CcSetDirtyPinnedData@8
17 CcUnpinData=CcUnpinData@4
18 CcSetFileSizes=CcSetFileSizes@8
19 DbgBreakPoint=DbgBreakPoint@0
20 DbgBreakPointWithStatus=DbgBreakPointWithStatus@4
21 ;DbgLoadImageSymbols=DbgLoadImageSymbols@12
23 DbgPrompt=DbgPrompt@12
25 ExAcquireFastMutexUnsafe=@ExAcquireFastMutexUnsafe@4
26 ExAcquireResourceExclusive=ExAcquireResourceExclusive@8
27 ExAcquireResourceExclusiveLite=ExAcquireResourceExclusiveLite@8
28 ExAcquireResourceSharedLite=ExAcquireResourceSharedLite@8
29 ExAcquireSharedStarveExclusive=ExAcquireSharedStarveExclusive@8
30 ExAcquireSharedWaitForExclusive=ExAcquireSharedWaitForExclusive@8
31 ExAllocateFromPagedLookasideList=ExAllocateFromPagedLookasideList@4
32 ExAllocatePool=ExAllocatePool@8
33 ExAllocatePoolWithQuota=ExAllocatePoolWithQuota@8
34 ExAllocatePoolWithQuotaTag=ExAllocatePoolWithQuotaTag@12
35 ExAllocatePoolWithTag=ExAllocatePoolWithTag@12
36 ExConvertExclusiveToSharedLite=ExConvertExclusiveToSharedLite@4
37 ExCreateCallback=ExCreateCallback@16
38 ExDeleteNPagedLookasideList=ExDeleteNPagedLookasideList@4
39 ExDeletePagedLookasideList=ExDeletePagedLookasideList@4
40 ExDeleteResource=ExDeleteResource@4
41 ExDeleteResourceLite=ExDeleteResourceLite@4
42 ExDesktopObjectType DATA
43 ExDisableResourceBoostLite=ExDisableResourceBoostLite@4
44 ExEventObjectType DATA
45 ExExtendZone=ExExtendZone@12
46 ExFreePool=ExFreePool@4
47 ExFreeToPagedLookasideList=ExFreeToPagedLookasideList@8
48 ExGetExclusiveWaiterCount=ExGetExclusiveWaiterCount@4
49 ExGetPreviousMode=ExGetPreviousMode@0
50 ExGetSharedWaiterCount=ExGetSharedWaiterCount@4
51 ExInitializeNPagedLookasideList=ExInitializeNPagedLookasideList@28
52 ExInitializePagedLookasideList=ExInitializePagedLookasideList@28
53 ExInitializeResource=ExInitializeResource@4
54 ExInitializeResourceLite=ExInitializeResourceLite@4
55 ExInitializeZone=ExInitializeZone@16
56 ExInterlockedAddLargeInteger=ExInterlockedAddLargeInteger@16
57 ExInterlockedAddLargeStatistic=@ExInterlockedAddLargeStatistic@8
58 ExInterlockedAddUlong=ExInterlockedAddUlong@12
59 ExInterlockedCompareExchange64=@ExInterlockedCompareExchange64@16
60 ExInterlockedDecrementLong=ExInterlockedDecrementLong@8
61 ExInterlockedExchangeUlong=ExInterlockedExchangeUlong@12
62 ExInterlockedExtendZone=ExInterlockedExtendZone@16
63 ExInterlockedIncrementLong=ExInterlockedIncrementLong@8
64 ExInterlockedInsertHeadList=ExInterlockedInsertHeadList@12
65 ExInterlockedInsertTailList=ExInterlockedInsertTailList@12
66 ExInterlockedPopEntryList=ExInterlockedPopEntryList@8
67 ExInterlockedPopEntrySList=@ExInterlockedPopEntrySList@8
68 ExInterlockedPushEntryList=ExInterlockedPushEntryList@12
69 ExInterlockedPushEntrySList=@ExInterlockedPushEntrySList@12
70 ExInterlockedRemoveHeadList=ExInterlockedRemoveHeadList@8
71 ExIsProcessorFeaturePresent=ExIsProcessorFeaturePresent@4
72 ExIsResourceAcquiredExclusiveLite=ExIsResourceAcquiredExclusiveLite@4
73 ExIsResourceAcquiredSharedLite=ExIsResourceAcquiredSharedLite@4
74 ExLocalTimeToSystemTime=ExLocalTimeToSystemTime@8
75 ExNotifyCallback=ExNotifyCallback@12
76 ExPostSystemEvent=ExPostSystemEvent@12
78 ExQueueWorkItem=ExQueueWorkItem@8
79 ExRaiseAccessViolation=ExRaiseAccessViolation@0
80 ExRaiseDatatypeMisalignment=ExRaiseDatatypeMisalignment@0
83 ExRaiseStatus=ExRaiseStatus@4
84 ExRegisterCallback=ExRegisterCallback@12
85 ExReinitializeResourceLite=ExReinitializeResourceLite@4
86 ExReleaseFastMutexUnsafe=@ExReleaseFastMutexUnsafe@4
87 ExReleaseResourceForThread=ExReleaseResourceForThread@8
88 ExReleaseResourceForThreadLite=ExReleaseResourceForThreadLite@8
89 ExReleaseResourceLite=@ExReleaseResourceLite@4
90 ExSetResourceOwnerPointer=ExSetResourceOwnerPointer@8
91 ;ExSystemExceptionFilter
92 ExSystemTimeToLocalTime=ExSystemTimeToLocalTime@8
93 ExTryToAcquireResourceExclusiveLite=ExTryToAcquireResourceExclusiveLite@4
94 ExUnregisterCallback=ExUnregisterCallback@4
95 ExWindowStationObjectType DATA
96 ExfInterlockedAddUlong=@ExfInterlockedAddUlong@12
97 ;ExfInterlockedInsertHeadList
98 ;ExfInterlockedInsertTailList
99 ;ExfInterlockedPopEntryList
100 ;ExfInterlockedPushEntryList
101 ;ExfInterlockedRemoveHeadList
102 Exfi386InterlockedDecrementLong=@Exfi386InterlockedDecrementLong@4
103 Exfi386InterlockedExchangeUlong=@Exfi386InterlockedExchangeUlong@8
104 Exfi386InterlockedIncrementLong=@Exfi386InterlockedIncrementLong@4
105 Exi386InterlockedDecrementLong=Exi386InterlockedDecrementLong@4
106 Exi386InterlockedExchangeUlong=Exi386InterlockedExchangeUlong@8
107 Exi386InterlockedIncrementLong=Exi386InterlockedIncrementLong@4
108 FsRtlAddLargeMcbEntry=FsRtlAddLargeMcbEntry@28
109 FsRtlAddMcbEntry=FsRtlAddMcbEntry@16
110 FsRtlAddToTunnelCache=FsRtlAddToTunnelCache@32
111 FsRtlAllocateFileLock=FsRtlAllocateFileLock@8
112 FsRtlAllocatePool=FsRtlAllocatePool@8
113 FsRtlAllocatePoolWithQuota=FsRtlAllocatePoolWithQuota@8
114 FsRtlAllocatePoolWithQuotaTag=FsRtlAllocatePoolWithQuotaTag@12
115 FsRtlAllocatePoolWithTag=FsRtlAllocatePoolWithTag@12
116 FsRtlAllocateResource=FsRtlAllocateResource@0
117 FsRtlAreNamesEqual=FsRtlAreNamesEqual@16
118 FsRtlBalanceReads=FsRtlBalanceReads@4
119 FsRtlCheckLockForReadAccess=FsRtlCheckLockForReadAccess@8
120 FsRtlCheckLockForWriteAccess=FsRtlCheckLockForWriteAccess@8
121 FsRtlCheckOplock=FsRtlCheckOplock@20
122 FsRtlCopyRead=FsRtlCopyRead@32
123 FsRtlCopyWrite=FsRtlCopyWrite@32
124 FsRtlCurrentBatchOplock=FsRtlCurrentBatchOplock@4
125 FsRtlDeleteKeyFromTunnelCache=FsRtlDeleteKeyFromTunnelCache@12
126 FsRtlDeleteTunnelCache=FsRtlDeleteTunnelCache@4
127 FsRtlDeregisterUncProvider=FsRtlDeregisterUncProvider@4
128 FsRtlDissectDbcs=FsRtlDissectDbcs@16
129 FsRtlDissectName=FsRtlDissectName@16
130 FsRtlDoesDbcsContainWildCards=FsRtlDoesDbcsContainWildCards@4
131 FsRtlDoesNameContainWildCards=FsRtlDoesNameContainWildCards@4
132 FsRtlFastCheckLockForRead=FsRtlFastCheckLockForRead@24
133 FsRtlFastCheckLockForWrite=FsRtlFastCheckLockForWrite@24
134 FsRtlFastUnlockAll=FsRtlFastUnlockAll@16
135 FsRtlFastUnlockAllByKey=FsRtlFastUnlockAllByKey@20
136 FsRtlFastUnlockSingle=FsRtlFastUnlockSingle@32
137 FsRtlFindInTunnelCache=FsRtlFindInTunnelCache@32
138 FsRtlGetFileSize=FsRtlGetFileSize@8
139 FsRtlGetNextFileLock=FsRtlGetNextFileLock@8
140 FsRtlGetNextLargeMcbEntry=FsRtlGetNextLargeMcbEntry@20
141 FsRtlGetNextMcbEntry=FsRtlGetNextMcbEntry@20
142 FsRtlInitializeFileLock=FsRtlInitializeFileLock@12
143 FsRtlInitializeLargeMcb=FsRtlInitializeLargeMcb@8
144 FsRtlInitializeMcb=FsRtlInitializeMcb@8
145 FsRtlInitializeOplock=FsRtlInitializeOplock@4
146 FsRtlInitializeTunnelCache=FsRtlInitializeTunnelCache@4
147 FsRtlIsDbcsInExpression=FsRtlIsDbcsInExpression@8
148 FsRtlIsFatDbcsLegal=FsRtlIsFatDbcsLegal@20
149 FsRtlIsHpfsDbcsLegal=FsRtlIsHpfsDbcsLegal@20
150 FsRtlIsNameInExpression=FsRtlIsNameInExpression@16
151 FsRtlIsNtstatusExpected=FsRtlIsNtstatusExpected@4
152 FsRtlIsTotalDeviceFailure=FsRtlIsTotalDeviceFailure@4
153 FsRtlLegalAnsiCharacterArray DATA
154 FsRtlLookupLargeMcbEntry=FsRtlLookupLargeMcbEntry@32
155 FsRtlLookupLastLargeMcbEntry=FsRtlLookupLastLargeMcbEntry@12
156 FsRtlLookupLastMcbEntry=FsRtlLookupLastMcbEntry@12
157 FsRtlLookupMcbEntry=FsRtlLookupMcbEntry@20
158 FsRtlMdlRead=FsRtlMdlRead@24
159 FsRtlMdlReadComplete=FsRtlMdlReadComplete@8
160 FsRtlMdlReadCompleteDev=FsRtlMdlReadCompleteDev@12
161 FsRtlMdlReadDev=FsRtlMdlReadDev@28
162 FsRtlMdlWriteComplete=FsRtlMdlWriteComplete@12
163 FsRtlMdlWriteCompleteDev=FsRtlMdlWriteCompleteDev@16
164 FsRtlNormalizeNtstatus=FsRtlNormalizeNtstatus@8
165 FsRtlNotifyChangeDirectory=FsRtlNotifyChangeDirectory@28
166 FsRtlNotifyCleanup=FsRtlNotifyCleanup@12
167 FsRtlNotifyFullChangeDirectory=FsRtlNotifyFullChangeDirectory@40
168 FsRtlNotifyFullReportChange=FsRtlNotifyFullReportChange@36
169 FsRtlNotifyInitializeSync=FsRtlNotifyInitializeSync@4
170 FsRtlNotifyReportChange=FsRtlNotifyReportChange@20
171 FsRtlNotifyUninitializeSync=FsRtlNotifyUninitializeSync@4
172 FsRtlNotifyVolumeEvent=FsRtlNotifyVolumeEvent@8
173 FsRtlNumberOfRunsInLargeMcb=FsRtlNumberOfRunsInLargeMcb@4
174 FsRtlNumberOfRunsInMcb=FsRtlNumberOfRunsInMcb@4
175 FsRtlOplockFsctrl=FsRtlOplockFsctrl@12
176 FsRtlOplockIsFastIoPossible=FsRtlOplockIsFastIoPossible@4
177 FsRtlPostPagingFileStackOverflow=FsRtlPostPagingFileStackOverflow@12
178 FsRtlPostStackOverflow=FsRtlPostStackOverflow@12
179 FsRtlPrepareMdlWrite=FsRtlPrepareMdlWrite@24
180 FsRtlPrepareMdlWriteDev=FsRtlPrepareMdlWriteDev@28
181 FsRtlPrivateLock=FsRtlPrivateLock@48
182 FsRtlProcessFileLock=FsRtlProcessFileLock@12
183 FsRtlRegisterUncProvider=FsRtlRegisterUncProvider@12
184 FsRtlRemoveLargeMcbEntry=FsRtlRemoveLargeMcbEntry@20
185 FsRtlRemoveMcbEntry=FsRtlRemoveMcbEntry@12
186 FsRtlSplitLargeMcb=FsRtlSplitLargeMcb@20
187 FsRtlSyncVolumes=FsRtlSyncVolumes@12
188 FsRtlTruncateLargeMcb=FsRtlTruncateLargeMcb@12
189 FsRtlTruncateMcb=FsRtlTruncateMcb@8
190 FsRtlUninitializeFileLock=FsRtlUninitializeFileLock@4
191 FsRtlUninitializeLargeMcb=FsRtlUninitializeLargeMcb@4
192 FsRtlUninitializeMcb=FsRtlUninitializeMcb@4
193 FsRtlUninitializeOplock=FsRtlUninitializeOplock@4
194 HalDispatchTable DATA
195 HalPrivateDispatchTable DATA
196 InterlockedCompareExchange=@InterlockedCompareExchange@12
197 InterlockedDecrement=@InterlockedDecrement@4
198 InterlockedExchange=@InterlockedExchange@8
199 InterlockedExchangeAdd=@InterlockedExchangeAdd@8
200 InterlockedIncrement=@InterlockedIncrement@4
201 IoAcquireCancelSpinLock=IoAcquireCancelSpinLock@4
202 IoAcquireVpbSpinLock=IoAcquireVpbSpinLock@4
203 IoAdapterObjectType DATA
204 IoAllocateAdapterChannel=IoAllocateAdapterChannel@20
205 IoAllocateIrp=IoAllocateIrp@8
206 IoAllocateMdl=IoAllocateMdl@20
207 IoAllocateController=IoAllocateController@16
208 IoAllocateErrorLogEntry=IoAllocateErrorLogEntry@8
209 IoAssignResources=IoAssignResources@24
210 IoAttachDevice=IoAttachDevice@12
211 IoAttachDeviceByPointer=IoAttachDeviceByPointer@8
212 IoAttachDeviceToDeviceStack=IoAttachDeviceToDeviceStack@8
213 IoBuildAsynchronousFsdRequest=IoBuildAsynchronousFsdRequest@24
214 IoBuildDeviceIoControlRequest=IoBuildDeviceIoControlRequest@36
215 IoBuildPartialMdl=IoBuildPartialMdl@16
216 IoBuildSynchronousFsdRequest=IoBuildSynchronousFsdRequest@28
217 IoCallDriver=IoCallDriver@8
218 IoCancelIrp=IoCancelIrp@4
219 IoCheckDesiredAccess=IoCheckDesiredAccess@8
220 IoCheckEaBufferValidity=IoCheckEaBufferValidity@12
221 IoCheckFunctionAccess=IoCheckFunctionAccess@24
222 IoCheckShareAccess=IoCheckShareAccess@20
223 IoCompleteRequest=IoCompleteRequest@8
224 IoConnectInterrupt=IoConnectInterrupt@44
225 IoCreateController=IoCreateController@4
226 IoCreateDevice=IoCreateDevice@28
227 IoCreateFile=IoCreateFile@56
228 IoCreateNotificationEvent=IoCreateNotificationEvent@8
229 IoCreateStreamFileObject=IoCreateStreamFileObject@8
230 IoCreateSymbolicLink=IoCreateSymbolicLink@8
231 IoCreateSynchronizationEvent=IoCreateSynchronizationEvent@8
232 IoCreateUnprotectedSymbolicLink=IoCreateUnprotectedSymbolicLink@8
233 IoDeleteController=IoDeleteController@4
234 IoDeleteDevice=IoDeleteDevice@4
235 IoDeleteSymbolicLink=IoDeleteSymbolicLink@4
236 IoDetachDevice=IoDetachDevice@4
237 IoDeviceHandlerObjectSize DATA
238 IoDeviceHandlerObjectType DATA
239 IoDeviceObjectType DATA
240 IoDisconnectInterrupt=IoDisconnectInterrupt@4
241 IoDriverObjectType DATA
242 IoEnqueueIrp=IoEnqueueIrp@4
243 IoFastQueryNetworkAttributes=IoFastQueryNetworkAttributes@20
244 IoFileObjectType DATA
245 IoFreeController=IoFreeController@4
246 IoFreeIrp=IoFreeIrp@4
247 IoFreeMdl=IoFreeMdl@4
248 IoGetAttachedDevice=IoGetAttachedDevice@4
249 IoGetAttachedDeviceReference=IoGetAttachedDeviceReference@4
250 IoGetBaseFileSystemDeviceObject=IoGetBaseFileSystemDeviceObject@4
251 IoGetConfigurationInformation=IoGetConfigurationInformation@0
252 IoGetCurrentProcess=IoGetCurrentProcess@0
253 IoGetDeviceObjectPointer=IoGetDeviceObjectPointer@16
254 IoGetDeviceToVerify=IoGetDeviceToVerify@4
255 IoGetFileObjectGenericMapping=IoGetFileObjectGenericMapping@0
256 IoGetInitialStack=IoGetInitialStack@0
257 IoGetRelatedDeviceObject=IoGetRelatedDeviceObject@4
258 IoGetRequestorProcess=IoGetRequestorProcess@4
259 IoGetStackLimits=IoGetStackLimits@8
260 IoGetTopLevelIrp=IoGetTopLevelIrp@0
261 IoInitializeIrp=IoInitializeIrp@12
262 IoInitializeTimer=IoInitializeTimer@12
263 IoIsOperationSynchronous=IoIsOperationSynchronous@4
264 IoMakeAssociatedIrp=IoMakeAssociatedIrp@8
265 IoOpenDeviceInstanceKey=IoOpenDeviceInstanceKey@20
266 ;IoPageRead=IoPageRead@16
267 IoQueryDeviceDescription=IoQueryDeviceDescription@32
268 IoQueryDeviceEnumInfo=IoQueryDeviceEnumInfo@8
269 IoQueryFileInformation=IoQueryFileInformation@20
270 IoQueryVolumeInformation=IoQueryVolumeInformation@20
271 IoQueueThreadIrp=IoQueueThreadIrp@4
272 IoRaiseHardError=IoRaiseHardError@12
273 IoRaiseInformationalHardError=IoRaiseInformationalHardError@12
274 IoReadOperationCount DATA
275 IoReadPartitionTable=IoReadPartitionTable@16
276 IoReadTransferCount DATA
277 IoRegisterDriverReinitialization=IoRegisterDriverReinitialization@12
278 IoRegisterFileSystem=IoRegisterFileSystem@4
279 IoRegisterFsRegistrationChange=IoRegisterFsRegistrationChange@8
280 IoRegisterShutdownNotification=IoRegisterShutdownNotification@4
281 IoReleaseCancelSpinLock=IoReleaseCancelSpinLock@4
282 IoReleaseVpbSpinLock=IoReleaseVpbSpinLock@4
283 IoRemoveShareAccess=IoRemoveShareAccess@8
284 IoReportHalResourceUsage=IoReportHalResourceUsage@16
285 IoReportResourceUsage=IoReportResourceUsage@36
286 IoSetDeviceToVerify=IoSetDeviceToVerify@8
287 IoSetHardErrorOrVerifyDevice=IoSetHardErrorOrVerifyDevice@8
288 IoSetInformation=IoSetInformation@16
289 IoSetPartitionInformation=IoSetPartitionInformation@16
290 IoSetShareAccess=IoSetShareAccess@16
291 IoSetThreadHardErrorMode=IoSetThreadHardErrorMode@4
292 IoSetTopLevelIrp=IoSetTopLevelIrp@4
293 IoStartNextPacket=IoStartNextPacket@8
294 IoStartNextPacketByKey=IoStartNextPacketByKey@12
295 IoStartPacket=IoStartPacket@16
296 IoStartTimer=IoStartTimer@4
297 IoStatisticsLock DATA
298 IoStopTimer=IoStopTimer@4
299 IoSynchronousPageWrite=IoSynchronousPageWrite@20
300 IoThreadToProcess=IoThreadToProcess@4
301 IoUnregisterFileSystem=IoUnregisterFileSystem@4
302 IoUnregisterFsRegistrationChange=IoUnregisterFsRegistrationChange@8
303 IoUnregisterShutdownNotification=IoUnregisterShutdownNotification@4
304 IoUpdateShareAccess=IoUpdateShareAccess@8
305 IoVerifyVolume=IoVerifyVolume@8
306 IoWriteErrorLogEntry=IoWriteErrorLogEntry@4
307 IoWriteOperationCount DATA
308 IoWritePartitionTable=IoWritePartitionTable@20
309 IoWriteTransferCount DATA
310 IofCallDriver=@IofCallDriver@8
311 IofCompleteRequest=@IofCompleteRequest@8
312 KdDebuggerEnabled DATA
313 KdDebuggerNotPresent DATA
314 KdPollBreakIn=KdPollBreakIn@0
315 KdSystemDebugControl=KdSystemDebugControl@4
316 Ke386CallBios=Ke386CallBios@8
317 ;Ke386IoSetAccessProcess
318 ;Ke386QueryIoAccessMap
320 KeAcquireSpinLockAtDpcLevel=KeAcquireSpinLockAtDpcLevel@4
321 KeAddSystemServiceTable=KeAddSystemServiceTable@20
322 KeAttachProcess=KeAttachProcess@4
323 ;KeBoostCurrentThread
324 KeBugCheck=KeBugCheck@4
325 KeBugCheckEx=KeBugCheckEx@20
326 KeCancelTimer=KeCancelTimer@4
327 KeClearEvent=KeClearEvent@4
328 KeConnectInterrupt=KeConnectInterrupt@4
329 ;KeDcacheFlushCount DATA
330 KeDelayExecutionThread=KeDelayExecutionThread@12
331 KeDeregisterBugCheckCallback=KeDeregisterBugCheckCallback@4
332 KeDetachProcess=KeDetachProcess@0
333 KeDisconnectInterrupt=KeDisconnectInterrupt@4
334 KeEnterCriticalRegion=KeEnterCriticalRegion@0
335 KeEnterKernelDebugger=KeEnterKernelDebugger@0
336 ;KeFindConfigurationEntry
337 ;KeFindConfigurationNextEntry
339 KeGetCurrentThread=KeGetCurrentThread@0
340 KeGetPreviousMode=KeGetPreviousMode@0
342 ;KeI386AllocateGdtSelectors
343 ;KeI386Call16BitCStyleFunction
344 ;KeI386Call16BitFunction
345 ;KeI386FlatToGdtSelector
348 ;KeI386ReleaseGdtSelectors
350 ;KeI386SetGdtSelector
351 ;KeIcacheFlushCount DATA
352 KeInitializeApc=KeInitializeApc@32
353 KeInitializeDeviceQueue=KeInitializeDeviceQueue@4
354 KeInitializeDpc=KeInitializeDpc@12
355 KeInitializeEvent=KeInitializeEvent@12
356 KeInitializeInterrupt=KeInitializeInterrupt@44
357 KeInitializeMutant=KeInitializeMutant@8
358 KeInitializeMutex=KeInitializeMutex@8
359 KeInitializeQueue=KeInitializeQueue@8
360 KeInitializeSemaphore=KeInitializeSemaphore@12
361 KeInitializeSpinLock=KeInitializeSpinLock@4
362 KeInitializeTimer=KeInitializeTimer@4
363 KeInitializeTimerEx=KeInitializeTimerEx@8
364 KeInsertByKeyDeviceQueue=KeInsertByKeyDeviceQueue@12
365 KeInsertDeviceQueue=KeInsertDeviceQueue@8
366 KeInsertHeadQueue=KeInsertHeadQueue@8
367 KeInsertQueue=KeInsertQueue@8
368 KeInsertQueueApc=KeInsertQueueApc@16
369 KeInsertQueueDpc=KeInsertQueueDpc@12
371 KeLeaveCriticalRegion=KeLeaveCriticalRegion@0
373 KeNumberProcessors DATA
375 ;KeProfileInterruptWithSource
376 KePulseEvent=KePulseEvent@12
377 KeQuerySystemTime=KeQuerySystemTime@4
378 KeQueryTickCount=KeQueryTickCount@4
379 KeQueryTimeIncrement=KeQueryTimeIncrement@0
380 ;KeRaiseUserException
381 KeReadStateEvent=KeReadStateEvent@4
382 KeReadStateMutant=KeReadStateMutant@4
383 KeReadStateMutex=KeReadStateMutex@4
384 KeReadStateQueue=KeReadStateQueue@4
385 KeReadStateSemaphore=KeReadStateSemaphore@4
386 KeReadStateTimer=KeReadStateTimer@4
387 KeRegisterBugCheckCallback=KeRegisterBugCheckCallback@20
388 KeReleaseMutant=KeReleaseMutant@16
389 KeReleaseMutex=KeReleaseMutex@8
390 KeReleaseSemaphore=KeReleaseSemaphore@16
391 KeReleaseSpinLockFromDpcLevel=KeReleaseSpinLockFromDpcLevel@4
392 KeRemoveByKeyDeviceQueue=KeRemoveByKeyDeviceQueue@8
393 KeRemoveDeviceQueue=KeRemoveDeviceQueue@4
394 KeRemoveEntryDeviceQueue=KeRemoveEntryDeviceQueue@8
395 KeRemoveQueue=KeRemoveQueue@12
396 KeRemoveQueueDpc=KeRemoveQueueDpc@4
397 KeResetEvent=KeResetEvent@4
398 ;KeRestoreFloatingPointState
399 KeRundownQueue=KeRundownQueue@4
400 ;KeSaveFloatingPointState
401 KeServiceDescriptorTable DATA
403 KeSetBasePriorityThread=KeSetBasePriorityThread@8
405 KeSetEvent=KeSetEvent@12
406 ;KeSetEventBoostPriority
407 ;KeSetIdealProcessorThread
408 KeSetImportanceDpc=KeSetImportanceDpc@8
409 ;KeSetKernelStackSwapEnable
410 KeSetPriorityThread=KeSetPriorityThread@8
412 ;KeSetSwapContextNotifyRoutine
413 KeSetTargetProcessorDpc=KeSetTargetProcessorDpc@8
414 ;KeSetThreadSelectNotifyRoutine
416 KeSetTimer=KeSetTimer@16
417 KeSetTimerEx=KeSetTimerEx@20
418 ;KeSetTimeUpdateNotifyRoutine
419 KeSynchronizeExecution=KeSynchronizeExecution@12
424 KeWaitForMultipleObjects=KeWaitForMultipleObjects@32
425 KeWaitForMutexObject=KeWaitForMutexObject@20
426 KeWaitForSingleObject=KeWaitForSingleObject@20
427 ;KefAcquireSpinLockAtDpcLevel
428 ;KefReleaseSpinLockFromDpcLevel
432 ;KiCoprocessorError@0
433 KiDeliverApc=KiDeliverApc@12
434 KiDispatchInterrupt=KiDispatchInterrupt@0
435 ;KiIpiServiceRoutine@8
437 ;KiUnexpectedInterrupt
438 ;Kii386SpinOnSpinLock
440 LdrAccessResource=LdrAccessResource@16
442 ;LdrFindResourceDirectory_U@16
443 LdrFindResource_U=LdrFindResource_U@16
445 LsaCallAuthenticationPackage=LsaCallAuthenticationPackage@28
446 LsaDeregisterLogonProcess=LsaDeregisterLogonProcess@8
447 LsaFreeReturnBuffer=LsaFreeReturnBuffer@4
448 LsaLogonUser=LsaLogonUser@56
449 LsaLookupAuthenticationPackage=LsaLookupAuthenticationPackage@12
450 LsaRegisterLogonProcess=LsaRegisterLogonProcess@12
451 MmAdjustWorkingSetSize=MmAdjustWorkingSetSize@12
452 MmAllocateContiguousAlignedMemory=MmAllocateContiguousAlignedMemory@16
453 MmAllocateContiguousMemory=MmAllocateContiguousMemory@12
454 MmAllocateNonCachedMemory=MmAllocateNonCachedMemory@4
455 MmBuildMdlForNonPagedPool=MmBuildMdlForNonPagedPool@4
456 MmCanFileBeTruncated=MmCanFileBeTruncated@8
457 MmCreateMdl=MmCreateMdl@12
458 MmCreateSection=MmCreateSection@32
459 MmDbgTranslatePhysicalAddress=MmDbgTranslatePhysicalAddress@8
460 MmDisableModifiedWriteOfSection=MmDisableModifiedWriteOfSection@4
461 MmFlushImageSection=MmFlushImageSection@8
462 MmForceSectionClosed=MmForceSectionClosed@8
463 MmFreeContiguousMemory=MmFreeContiguousMemory@4
464 MmFreeNonCachedMemory=MmFreeNonCachedMemory@8
465 MmGetPhysicalAddress=MmGetPhysicalAddress@4
466 MmGrowKernelStack=MmGrowKernelStack@4
467 MmHighestUserAddress DATA
468 MmIsAddressValid=MmIsAddressValid@4
469 MmIsNonPagedSystemAddressValid=MmIsNonPagedSystemAddressValid@4
470 MmIsRecursiveIoFault=MmIsRecursiveIoFault@0
471 MmIsThisAnNtAsSystem=MmIsThisAnNtAsSystem@0
472 MmLockPagableDataSection=MmLockPagableDataSection@4
473 MmLockPagableImageSection=MmLockPagableDataSection@4
474 MmLockPagableSectionByHandle=MmLockPagableSectionByHandle@4
475 MmMapIoSpace=MmMapIoSpace@16
476 MmMapLockedPages=MmMapLockedPages@8
477 MmMapMemoryDumpMdl=MmMapMemoryDumpMdl@4
478 MmMapVideoDisplay=MmMapVideoDisplay@16
479 MmMapViewInSystemSpace=MmMapViewInSystemSpace@12
480 MmMapViewOfSection=MmMapViewOfSection@40
481 MmPageEntireDriver=MmPageEntireDriver@4
482 MmProbeAndLockPages=MmProbeAndLockPages@12
483 MmQuerySystemSize=MmQuerySystemSize@0
484 MmResetDriverPaging=MmResetDriverPaging@4
485 MmSectionObjectType DATA
486 MmSecureVirtualMemory=MmSecureVirtualMemory@12
487 MmSetAddressRangeModified=MmSetAddressRangeModified@8
488 MmSetBankedSection=MmSetBankedSection@24
489 MmSizeOfMdl=MmSizeOfMdl@8
490 MmUnlockPagableImageSection=MmUnlockPagableImageSection@4
491 MmUnlockPages=MmUnlockPages@4
492 MmUnmapIoSpace=MmUnmapIoSpace@8
493 MmUnmapLockedPages=MmUnmapLockedPages@8
494 MmUnmapVideoDisplay=MmUnmapVideoDisplay@8
495 MmUnmapViewInSystemSpace=MmUnmapViewInSystemSpace@4
496 MmUnmapViewOfSection=MmUnmapViewOfSection@8
497 MmUnsecureVirtualMemory=MmUnsecureVirtualMemory@4
498 MmUserProbeAddress DATA
501 NlsMbCodePageTag DATA
502 NlsMbOemCodePageTag DATA
503 NlsOemLeadByteInfo DATA
504 NtAddAtom=NtAddAtom@8
505 NtAdjustPrivilegesToken=NtAdjustPrivilegesToken@24
506 NtAlertThread=NtAlertThread@4
507 NtAllocateLocallyUniqueId=NtAllocateLocallyUniqueId@4
508 NtAllocateUuids=NtAllocateUuids@12
509 NtAllocateVirtualMemory=NtAllocateVirtualMemory@24
512 NtConnectPort=NtConnectPort@32
513 NtCreateEvent=NtCreateEvent@20
514 NtCreateTimer=NtCreateTimer@16
515 NtOpenEvent=NtOpenEvent@12
516 NtCreateFile=NtCreateFile@44
517 NtCreateSection=NtCreateSection@28
518 NtDeleteAtom=NtDeleteAtom@4
519 NtDeleteFile=NtDeleteFile@4
520 NtDeviceIoControlFile=NtDeviceIoControlFile@40
521 NtDuplicateObject=NtDuplicateObject@28
522 NtDuplicateToken=NtDuplicateToken@24
523 NtFindAtom=NtFindAtom@8
524 NtFreeVirtualMemory=NtFreeVirtualMemory@16
525 NtFsControlFile=NtFsControlFile@40
527 NtLockFile=NtLockFile@40
528 NtMapViewOfSection=NtMapViewOfSection@40
529 NtNotifyChangeDirectoryFile=NtNotifyChangeDirectoryFile@36
530 NtOpenFile=NtOpenFile@24
531 NtOpenProcess=NtOpenProcess@16
532 NtOpenProcessToken=NtOpenProcessToken@12
533 NtQueryDirectoryFile=NtQueryDirectoryFile@44
534 NtQueryEaFile=NtQueryEaFile@36
535 NtQueryInformationAtom=NtQueryInformationAtom@20
536 NtQueryInformationFile=NtQueryInformationFile@20
537 NtQueryInformationProcess=NtQueryInformationProcess@20
538 NtQueryInformationToken=NtQueryInformationToken@20
539 ;NtQueryOleDirectoryFile@44 <--- ?
540 NtQuerySecurityObject=NtQuerySecurityObject@20
541 NtQuerySystemTime=NtQuerySystemTime@4
542 NtQueryVolumeInformationFile=NtQueryVolumeInformationFile@20
543 NtReadFile=NtReadFile@36
544 NtRequestPort=NtRequestPort@8
545 NtRequestWaitReplyPort@12
546 NtSetEvent=NtSetEvent@8
547 NtSetInformationFile=NtSetInformationFile@20
548 NtSetInformationProcess=NtSetInformationProcess@16
549 NtSetInformationThread=NtSetInformationThread@16
550 NtSetSecurityObject=NtSetSecurityObject@12
551 NtSetSystemTime=NtSetSystemTime@8
552 NtUnlockFile=NtUnlockFile@20
553 NtVdmControl=NtVdmControl@8
554 NtW32Call=NtW32Call@20
555 NtWaitForSingleObject=NtWaitForSingleObject@12
556 NtWriteFile=NtWriteFile@36
557 ;ObAssignSecurity=ObAssignSecurity@16
558 ;ObCheckCreateObjectAccess=ObCheckCreateObjectAccess@28
559 ;ObCheckObjectAccess=ObCheckObjectAccess@20
560 ;ObCreateObject=ObCreateObject@36
561 ObCreateObject=ObCreateObject@20
562 ;ObFindHandleForObject=ObFindHandleForObject@20
563 ;ObGetObjectPointerCount=ObGetObjectPointerCount@4
564 ;ObGetObjectSecurity=ObGetObjectSecurity@12
565 ;ObInsertObject=ObInsertObject@24
566 ObMakeTemporaryObject=ObMakeTemporaryObject@4
567 ObOpenObjectByName=ObOpenObjectByName@28
568 ObOpenObjectByPointer=ObOpenObjectByPointer@28
569 ;ObQueryNameString=ObQueryNameString@16
570 ;ObQueryObjectAuditingByHandle=ObQueryObjectAuditingByHandle@8
571 ObfDereferenceObject=@ObfDereferenceObject@4
572 ObfReferenceObject=@ObfReferenceObject@4
573 ObReferenceObjectByHandle=ObReferenceObjectByHandle@24
574 ObReferenceObjectByName=ObReferenceObjectByName@32
575 ObReferenceObjectByPointer=ObReferenceObjectByPointer@16
576 ;ObReleaseObjectSecurity=ObReleaseObjectSecurity@8
577 ;ObSetSecurityDescriptorInfo=ObSetSecurityDescriptorInfo@24
578 ObAddEntryDirectory=ObAddEntryDirectory@12
583 PoCallDriver=PoCallDriver@8
584 PoRegisterDeviceForIdleDetection=PoRegisterDeviceForIdleDetection@16
585 PoRegisterSystemState=PoRegisterSystemState@8
586 PoRequestPowerIrp=PoRequestPowerIrp@24
587 PoSetDeviceBusy=PoSetDeviceBusy@4
588 PoSetPowerState=PoSetPowerState@12
589 PoSetSystemState=PoSetSystemState@4
590 PoStartNextPowerIrp=PoStartNextPowerIrp@4
591 PoUnregisterSystemState=PoUnregisterSystemState@4
592 ;ProbeForWrite=ProbeForWrite@12
593 PsAssignImpersonationToken=PsAssignImpersonationToken@8
594 ;PsChargePoolQuota=PsChargePoolQuota@12
595 PsCreateSystemProcess=PsCreateSystemProcess@12
596 PsCreateSystemThread=PsCreateSystemThread@28
597 PsCreateWin32Thread=PsCreateWin32Thread@4
598 PsCreateWin32Process=PsCreateWin32Process@4
599 PsGetWin32Thread=PsGetWin32Thread@0
600 PsGetWin32Process=PsGetWin32Process@0
601 PsEstablishWin32Callouts=PsEstablishWin32Callouts@24
602 PsGetCurrentProcess=PsGetCurrentProcess@0
603 PsGetCurrentProcessId=PsGetCurrentProcessId@0
604 PsGetCurrentThreadId=PsGetCurrentThreadId@0
605 PsGetCurrentThread=PsGetCurrentThread@0
606 PsGetProcessExitTime=PsGetProcessExitTime@0
607 PsGetVersion=PsGetVersion@16
608 PsImpersonateClient=PsImpersonateClient@20
609 PsInitialSystemProcess DATA
610 PsIsThreadTerminating=PsIsThreadTerminating@4
611 PsLookupProcessByProcessId=PsLookupProcessByProcessId@8
612 PsLookupProcessThreadByCid=PsLookupProcessThreadByCid@12
613 PsLookupThreadByThreadId=PsLookupThreadByThreadId@8
615 PsReferenceImpersonationToken=PsReferenceImpersonationToken@16
616 PsReferencePrimaryToken=PsReferencePrimaryToken@4
618 PsRevertToSelf=PsRevertToSelf@0
619 PsSetCreateProcessNotifyRoutine=PsSetCreateProcessNotifyRoutine@8
620 PsSetCreateThreadNotifyRoutine=PsSetCreateThreadNotifyRoutine@4
621 ;PsSetLegoNotifyRoutine
622 ;PsSetProcessPriorityByClass
623 PsTerminateSystemThread=PsTerminateSystemThread@4
625 READ_REGISTER_UCHAR=READ_REGISTER_UCHAR@4
626 READ_REGISTER_ULONG=READ_REGISTER_ULONG@4
627 READ_REGISTER_USHORT=READ_REGISTER_USHORT@4
628 READ_REGISTER_BUFFER_UCHAR=READ_REGISTER_BUFFER_UCHAR@12
629 READ_REGISTER_BUFFER_ULONG=READ_REGISTER_BUFFER_ULONG@12
630 READ_REGISTER_BUFFER_USHORT=READ_REGISTER_BUFFER_USHORT@12
631 RtlAbsoluteToSelfRelativeSD=RtlAbsoluteToSelfRelativeSD@12
632 RtlAddAccessAllowedAce=RtlAddAccessAllowedAce@16
633 RtlAddAce=RtlAddAce@20
634 RtlAddAtomToAtomTable=RtlAddAtomToAtomTable@12
635 ;RtlAllocateAndInitializeSid
637 RtlAnsiCharToUnicodeChar=RtlAnsiCharToUnicodeChar@4
638 RtlAnsiStringToUnicodeSize=RtlAnsiStringToUnicodeSize@4
639 RtlAnsiStringToUnicodeString=RtlAnsiStringToUnicodeString@12
640 RtlAppendAsciizToString=RtlAppendAsciizToString@8
641 RtlAppendStringToString=RtlAppendStringToString@8
642 RtlAppendUnicodeStringToString=RtlAppendUnicodeStringToString@8
643 RtlAppendUnicodeToString=RtlAppendUnicodeToString@8
644 RtlAreAllAccessesGranted=RtlAreAllAccessesGranted@8
645 RtlAreAnyAccessesGranted=RtlAreAnyAccessesGranted@8
646 RtlAreBitsClear=RtlAreBitsClear@12
647 RtlAreBitsSet=RtlAreBitsSet@12
648 RtlAssert=RtlAssert@16
649 ;RtlCaptureStackBackTrace
650 RtlCharToInteger=RtlCharToInteger@12
651 RtlCheckRegistryKey=RtlCheckRegistryKey@8
652 RtlClearAllBits=RtlClearAllBits@4
653 RtlClearBits=RtlClearBits@12
654 RtlCompareMemory=RtlCompareMemory@12
655 RtlCompareMemoryUlong=RtlCompareMemoryUlong@12
656 RtlCompareString=RtlCompareString@12
657 RtlCompareUnicodeString=RtlCompareUnicodeString@12
660 RtlConvertLongToLargeInteger=RtlConvertLongToLargeInteger@4
661 RtlConvertSidToUnicodeString=RtlConvertSidToUnicodeString@12
662 RtlConvertUlongToLargeInteger=RtlConvertUlongToLargeInteger@4
663 RtlCopyLuid=RtlCopyLuid@8
664 RtlCopySid=RtlCopySid@12
665 RtlCopyString=RtlCopyString@8
666 RtlCopyUnicodeString=RtlCopyUnicodeString@8
667 RtlCreateAcl=RtlCreateAcl@12
668 RtlCreateAtomTable=RtlCreateAtomTable@8
670 RtlCreateRegistryKey=RtlCreateRegistryKey@8
671 RtlCreateSecurityDescriptor=RtlCreateSecurityDescriptor@8
672 RtlCreateUnicodeString=RtlCreateUnicodeString@8
673 RtlCustomCPToUnicodeN=RtlCustomCPToUnicodeN@24
676 ;RtlDecompressFragment
678 RtlDeleteAtomFromAtomTable=RtlDeleteAtomFromAtomTable@8
679 ;RtlDeleteElementGenericTable
681 RtlDeleteRegistryValue=RtlDeleteRegistryValue@12
683 RtlDestroyAtomTable=RtlDestroyAtomTable@4
685 RtlDowncaseUnicodeString=RtlDowncaseUnicodeString@12
686 RtlEmptyAtomTable=RtlEmptyAtomTable@8
687 RtlEnlargedIntegerMultiply=RtlEnlargedIntegerMultiply@8
688 RtlEnlargedUnsignedDivide=RtlEnlargedUnsignedDivide@16
689 RtlEnlargedUnsignedMultiply=RtlEnlargedUnsignedMultiply@8
690 ;RtlEnumerateGenericTable
691 ;RtlEnumerateGenericTableWithoutSplaying
692 RtlEqualLuid=RtlEqualLuid@8
693 RtlEqualSid=RtlEqualSid@8
694 RtlEqualString=RtlEqualString@12
695 RtlEqualUnicodeString=RtlEqualUnicodeString@12
696 RtlExtendedIntegerMultiply=RtlExtendedIntegerMultiply@12
697 RtlExtendedLargeIntegerDivide=RtlExtendedLargeIntegerDivide@16
698 RtlExtendedMagicDivide=RtlExtendedMagicDivide@20
699 RtlFillMemory=RtlFillMemory@12
700 RtlFillMemoryUlong=RtlFillMemoryUlong@12
701 RtlFindClearBits=RtlFindClearBits@12
702 RtlFindClearBitsAndSet=RtlFindClearBitsAndSet@12
703 RtlFindFirstRunClear=RtlFindFirstRunClear@8
704 RtlFindFirstRunSet=RtlFindFirstRunSet@8
705 RtlFindLongestRunClear=RtlFindLongestRunClear@8
706 RtlFindLongestRunSet=RtlFindLongestRunSet@8
707 RtlFindMessage=RtlFindMessage@20
708 RtlFindSetBits=RtlFindSetBits@12
709 RtlFindSetBitsAndClear=RtlFindSetBitsAndClear@12
710 ;RtlFindUnicodePrefix
711 RtlFormatCurrentUserKeyPath=RtlFormatCurrentUserKeyPath@4
712 RtlFreeAnsiString=RtlFreeAnsiString@4
714 RtlFreeOemString=RtlFreeOemString@4
715 RtlFreeUnicodeString=RtlFreeUnicodeString@4
716 ;RtlGenerate8dot3Name
717 ;RtlGetCallersAddress
718 ;RtlGetCompressionWorkSpaceSize
719 RtlGetDaclSecurityDescriptor=RtlGetDaclSecurityDescriptor@16
720 RtlGetDefaultCodePage=RtlGetDefaultCodePage@8
721 ;RtlGetElementGenericTable
722 RtlGetGroupSecurityDescriptor=RtlGetGroupSecurityDescriptor@12
723 RtlGetOwnerSecurityDescriptor=RtlGetOwnerSecurityDescriptor@12
724 RtlImageNtHeader=RtlImageNtHeader@4
725 RtlInitAnsiString=RtlInitAnsiString@8
726 ;RtlInitCodePageTable
727 RtlInitString=RtlInitString@8
728 RtlInitUnicodeString=RtlInitUnicodeString@8
729 RtlInitializeBitMap=RtlInitializeBitMap@12
730 ;RtlInitializeGenericTable
731 RtlInitializeSid=RtlInitializeSid@12
732 ;RtlInitializeUnicodePrefix
733 ;RtlInsertElementGenericTable
734 ;RtlInsertUnicodePrefix
735 RtlIntegerToChar=RtlIntegerToChar@16
736 RtlIntegerToUnicodeString=RtlIntegerToUnicodeString@12
737 ;RtlIsNameLegalDOS8Dot3
738 RtlLargeIntegerAdd=RtlLargeIntegerAdd@16
739 RtlLargeIntegerArithmeticShift=RtlLargeIntegerArithmeticShift@12
740 RtlLargeIntegerDivide=RtlLargeIntegerDivide@20
741 RtlLargeIntegerNegate=RtlLargeIntegerNegate@8
742 RtlLargeIntegerShiftLeft=RtlLargeIntegerShiftLeft@12
743 RtlLargeIntegerShiftRight=RtlLargeIntegerShiftRight@12
744 RtlLargeIntegerSubtract=RtlLargeIntegerSubtract@16
745 RtlLengthRequiredSid=RtlLengthRequiredSid@4
746 RtlLengthSecurityDescriptor=RtlLengthSecurityDescriptor@4
747 RtlLengthSid=RtlLengthSid@4
748 RtlLookupAtomInAtomTable=RtlLookupAtomInAtomTable@12
749 ;RtlLookupElementGenericTable
750 RtlMapGenericMask=RtlMapGenericMask@8
751 RtlMoveMemory=RtlMoveMemory@12
752 RtlMultiByteToUnicodeN=RtlMultiByteToUnicodeN@20
753 RtlMultiByteToUnicodeSize=RtlMultiByteToUnicodeSize@12
754 ;RtlNextUnicodePrefix
755 RtlNtStatusToDosError=RtlNtStatusToDosError@4
756 RtlNtStatusToDosErrorNoTeb=RtlNtStatusToDosErrorNoTeb@4
757 ;RtlNumberGenericTableElements
758 RtlNumberOfClearBits=RtlNumberOfClearBits@4
759 RtlNumberOfSetBits=RtlNumberOfSetBits@4
760 RtlOemStringToCountedUnicodeString=RtlOemStringToCountedUnicodeString@12
761 RtlOemStringToUnicodeSize=RtlOemStringToUnicodeSize@4
762 RtlOemStringToUnicodeString=RtlOemStringToUnicodeString@12
763 RtlPinAtomInAtomTable=RtlPinAtomInAtomTable@8
764 RtlPrefixString=RtlPrefixString@12
765 RtlPrefixUnicodeString=RtlPrefixUnicodeString@12
766 RtlQueryAtomInAtomTable=RtlQueryAtomInAtomTable@24
767 RtlQueryRegistryValues=RtlQueryRegistryValues@20
768 RtlQueryTimeZoneInformation=RtlQueryTimeZoneInformation@4
769 RtlRaiseException=RtlRaiseException@4
771 ;RtlRemoveUnicodePrefix
773 RtlSecondsSince1970ToTime=RtlSecondsSince1970ToTime@8
774 RtlSecondsSince1980ToTime=RtlSecondsSince1980ToTime@8
775 RtlSetAllBits=RtlSetAllBits@4
776 RtlSetBits=RtlSetBits@12
777 RtlSetDaclSecurityDescriptor=RtlSetDaclSecurityDescriptor@16
778 RtlSetGroupSecurityDescriptor=RtlSetGroupSecurityDescriptor@12
779 RtlSetOwnerSecurityDescriptor=RtlSetOwnerSecurityDescriptor@12
780 RtlSetSaclSecurityDescriptor=RtlSetSaclSecurityDescriptor@16
781 RtlSetTimeZoneInformation=RtlSetTimeZoneInformation@4
783 RtlSubAuthorityCountSid=RtlSubAuthorityCountSid@4
784 RtlSubAuthoritySid=RtlSubAuthoritySid@8
785 RtlTimeFieldsToTime=RtlTimeFieldsToTime@8
786 RtlTimeToSecondsSince1970=RtlTimeToSecondsSince1970@8
787 RtlTimeToSecondsSince1980=RtlTimeToSecondsSince1980@8
788 RtlTimeToTimeFields=RtlTimeToTimeFields@8
789 RtlUnicodeStringToAnsiSize=RtlUnicodeStringToAnsiSize@4
790 RtlUnicodeStringToAnsiString=RtlUnicodeStringToAnsiString@12
791 RtlUnicodeStringToCountedOemString=RtlUnicodeStringToCountedOemString@12
792 RtlUnicodeStringToInteger=RtlUnicodeStringToInteger@12
793 RtlUnicodeStringToOemSize=RtlUnicodeStringToOemSize@4
794 RtlUnicodeStringToOemString=RtlUnicodeStringToOemString@12
795 RtlUnicodeToCustomCPN=RtlUnicodeToCustomCPN@24
796 RtlUnicodeToMultiByteN=RtlUnicodeToMultiByteN@20
797 RtlUnicodeToMultiByteSize=RtlUnicodeToMultiByteSize@12
798 RtlUnicodeToOemN=RtlUnicodeToOemN@20
799 RtlUnwind=RtlUnwind@16
800 RtlUpcaseUnicodeChar=RtlUpcaseUnicodeChar@4
801 RtlUpcaseUnicodeString=RtlUpcaseUnicodeString@12
802 RtlUpcaseUnicodeStringToAnsiString=RtlUpcaseUnicodeStringToAnsiString@12
803 RtlUpcaseUnicodeStringToCountedOemString=RtlUpcaseUnicodeStringToCountedOemString@12
804 RtlUpcaseUnicodeStringToOemString=RtlUpcaseUnicodeStringToOemString@12
805 RtlUpcaseUnicodeToCustomCPN=RtlUpcaseUnicodeToCustomCPN@24
806 RtlUpcaseUnicodeToMultiByteN=RtlUpcaseUnicodeToMultiByteN@20
807 RtlUpcaseUnicodeToOemN=RtlUpcaseUnicodeToOemN@20
808 RtlUpperChar=RtlUpperChar@4
809 RtlUpperString=RtlUpperString@8
810 RtlValidSecurityDescriptor=RtlValidSecurityDescriptor@4
811 RtlValidSid=RtlValidSid@4
812 RtlWriteRegistryValue=RtlWriteRegistryValue@24
814 RtlZeroMemory=RtlZeroMemory@8
815 RtlxAnsiStringToUnicodeSize=RtlxAnsiStringToUnicodeSize@4
816 RtlxOemStringToUnicodeSize=RtlxOemStringToUnicodeSize@4
817 RtlxUnicodeStringToAnsiSize=RtlxUnicodeStringToAnsiSize@4
818 RtlxUnicodeStringToOemSize=RtlxUnicodeStringToOemSize@4
819 SeAccessCheck=SeAccessCheck@40
820 ;SeAppendPrivileges=SeAppendPrivileges@8
821 SeAssignSecurity=SeAssignSecurity@28
822 ;SeAuditingFileEvents=SeAuditingFileEvents@8
823 ;SeAuditingFileOrGlobalEvents=SeAuditingFileOrGlobalEvents@18
824 ;SeCaptureSecurityDescriptor=SeCaptureSecurityDescriptor@20
825 SeCaptureSubjectContext=SeCaptureSubjectContext@4
826 ;SeCloseObjectAuditAlarm=SeCloseObjectAuditAlarm@12
827 ;SeCreateAccessState=SeCreateAccessState@16
828 SeCreateClientSecurity=SeCreateClientSecurity@16
829 SeDeassignSecurity=SeDeassignSecurity@4
830 ;SeDeleteAccessState=SeDeleteAccessState@4
831 ;SeDeleteObjectAuditAlarm=SeDeleteObjectAuditAlarm@8
833 ;SeFreePrivileges=SeFreePrivileges@4
834 SeImpersonateClient=SeImpersonateClient@8
835 ;SeLockSubjectContext=SeLockSubjectContext@4
836 ;SeMarkLogonSessionForTerminationNotification=SeMarkLogonSessionForTerminationNotification@4
837 ;SeOpenObjectAuditAlarm=SeOpenObjectAuditAlarm@36
838 ;SeOpenObjectForDeleteAuditAlarm=SeOpenObjectForDeleteAuditAlarm@36
839 SePrivilegeCheck=SePrivilegeCheck@12
840 ;SePrivilegeObjectAuditAlarm=SePrivilegeObjectAuditAlarm@24
841 ;SePublicDefaultDacl DATA
842 ;SeQueryAuthenticationIdToken=SeQueryAuthenticationIdToken@8
843 ;SeQuerySecurityDescriptorInfo=SeQuerySecurityDescriptorInfo@16
844 ;SeRegisterLogonSessionTerminatedRoutine=SeRegisterLogonSessionTerminatedRoutine@4
845 ;SeReleaseSecurityDescriptor=SeReleaseSecurityDescriptor@12
846 SeReleaseSubjectContext=SeReleaseSubjectContext@4
847 ;SeSetAccessStateGenericMapping=SeSetAccessStateGenericMapping@8
848 ;SeSetSecurityDescriptorInfo=SeSetSecurityDescriptorInfo@24
849 ;SeSinglePrivilegeCheck=SeSinglePrivilegeCheck@12
850 ;SeSystemDefaultDacl DATA
851 ;SeTokenImpersonationLevel=SeTokenImpersonationLevel@4
853 ;SeUnlockSubjectContext=SeUnlockSubjectContext@4
854 ;SeUnregisterLogonSessionTerminatedRoutine=SeUnregisterLogonSessionTerminatedRoutine@4
855 ;SeValidSecurityDescriptor=SeValidSecurityDescriptor@8
856 WRITE_REGISTER_UCHAR=WRITE_REGISTER_UCHAR@8
857 WRITE_REGISTER_ULONG=WRITE_REGISTER_ULONG@8
858 WRITE_REGISTER_USHORT=WRITE_REGISTER_USHORT@8
859 WRITE_REGISTER_BUFFER_UCHAR=WRITE_REGISTER_BUFFER_UCHAR@12
860 WRITE_REGISTER_BUFFER_ULONG=WRITE_REGISTER_BUFFER_ULONG@12
861 WRITE_REGISTER_BUFFER_USHORT=WRITE_REGISTER_BUFFER_USHORT@12
862 ZwAccessCheckAndAuditAlarm=ZwAccessCheckAndAuditAlarm@44
863 ZwAlertThread=ZwAlertThread@4
864 ZwAllocateVirtualMemory=ZwAllocateVirtualMemory@24
865 ZwClearEvent=ZwClearEvent@4
867 ZwCloseObjectAuditAlarm=ZwCloseObjectAuditAlarm@12
868 ZwConnectPort=ZwConnectPort@32
869 ZwCreateDirectoryObject=ZwCreateDirectoryObject@12
870 ZwCreateEvent=ZwCreateEvent@20
871 ZwCreateFile=ZwCreateFile@44
872 ZwCreateKey=ZwCreateKey@28
873 ZwCreateSection=ZwCreateSection@28
874 ZwCreateSymbolicLinkObject=ZwCreateSymbolicLinkObject@16
875 ZwDeleteFile=ZwDeleteFile@4
876 ZwDeleteKey=ZwDeleteKey@4
877 ZwDeleteValueKey=ZwDeleteValueKey@8
878 ZwDeviceIoControlFile=ZwDeviceIoControlFile@40
879 ZwDisplayString=ZwDisplayString@4
880 ZwDuplicateObject=ZwDuplicateObject@28
881 ZwDuplicateToken=ZwDuplicateToken@24
882 ZwEnumerateKey=ZwEnumerateKey@24
883 ZwEnumerateValueKey=ZwEnumerateValueKey@24
884 ZwFlushInstructionCache=ZwFlushInstructionCache@12
885 ZwFlushKey=ZwFlushKey@4
886 ZwFreeVirtualMemory=ZwFreeVirtualMemory@16
887 ZwFsControlFile=ZwFsControlFile@40
888 ZwLoadDriver=ZwLoadDriver@4
889 ZwLoadKey=ZwLoadKey@8
890 ZwMakeTemporaryObject=ZwMakeTemporaryObject@4
891 ZwMapViewOfSection=ZwMapViewOfSection@40
892 ZwNotifyChangeKey=ZwNotifyChangeKey@40
893 ZwOpenDirectoryObject=ZwOpenDirectoryObject@12
894 ZwOpenEvent=ZwOpenEvent@12
895 ZwOpenFile=ZwOpenFile@24
896 ZwOpenKey=ZwOpenKey@12
897 ZwOpenProcess=ZwOpenProcess@16
898 ZwOpenProcessToken=ZwOpenProcessToken@12
899 ZwOpenSection=ZwOpenSection@12
900 ZwOpenSymbolicLinkObject=ZwOpenSymbolicLinkObject@12
901 ZwOpenThread=ZwOpenThread@16
902 ZwOpenThreadToken=ZwOpenThreadToken@16
903 ZwPulseEvent=ZwPulseEvent@8
904 ZwQueryDefaultLocale=ZwQueryDefaultLocale@8
905 ZwQueryDirectoryFile=ZwQueryDirectoryFile@44
906 ZwQueryInformationAtom=ZwQueryInformationAtom@20
907 ZwQueryInformationFile=ZwQueryInformationFile@20
908 ZwQueryInformationProcess=ZwQueryInformationProcess@20
909 ZwQueryInformationToken=ZwQueryInformationToken@20
910 ZwQueryKey=ZwQueryKey@20
911 ZwQueryObject=ZwQueryObject@20
912 ZwQuerySection=ZwQuerySection@20
913 ZwQuerySecurityObject=ZwQuerySecurityObject@20
914 ZwQuerySymbolicLinkObject=ZwQuerySymbolicLinkObject@12
915 ZwQuerySystemInformation=ZwQuerySystemInformation@16
916 ZwQuerySystemTime=ZwQuerySystemTime@4
917 ZwQueryValueKey=ZwQueryValueKey@24
918 ZwQueryVolumeInformationFile=ZwQueryVolumeInformationFile@20
919 ZwReadFile=ZwReadFile@36
920 ZwReplaceKey=ZwReplaceKey@12
921 ZwRequestWaitReplyPort=ZwRequestWaitReplyPort@12
922 ZwResetEvent=ZwResetEvent@8
923 ZwSaveKey=ZwSaveKey@8
924 ZwSetDefaultLocale=ZwSetDefaultLocale@8
925 ZwSetEvent=ZwSetEvent@8
926 ZwSetInformationFile=ZwSetInformationFile@20
927 ZwSetInformationObject=ZwSetInformationObject@16
928 ZwSetInformationProcess=ZwSetInformationProcess@16
929 ZwSetInformationThread=ZwSetInformationThread@16
930 ZwSetSystemInformation=ZwSetSystemInformation@12
931 ZwSetSystemTime=ZwSetSystemTime@8
932 ZwSetValueKey=ZwSetValueKey@24
933 ZwTerminateProcess=ZwTerminateProcess@8
934 ZwUnloadDriver=ZwUnloadDriver@4
935 ZwUnloadKey=ZwUnloadKey@4
936 ZwUnmapViewOfSection=ZwUnmapViewOfSection@8
937 ZwWaitForMultipleObjects=ZwWaitForMultipleObjects@20
938 ZwWaitForSingleObject=ZwWaitForSingleObject@12
939 ZwWriteFile=ZwWriteFile@36
940 ZwYieldExecution=ZwYieldExecution@0
941 _abnormal_termination