1 ; $Id: ntoskrnl.edf,v 1.125 2002/07/27 13:02:37 ekohl Exp $
3 ; reactos/ntoskrnl/ntoskrnl.def
5 ; ReactOS Operating System
8 CcRosInitializeFileCache=CcRosInitializeFileCache@12
9 CcMdlReadComplete=CcMdlReadComplete@8
10 ;CcRosRequestCacheSegment=CcRosRequestCacheSegment@20
11 ;CcRosReleaseCacheSegment=CcRosReleaseCacheSegment@12
12 CcRosReleaseFileCache=CcRosReleaseFileCache@8
13 CcCopyRead=CcCopyRead@24
14 CcCopyWrite=CcCopyWrite@20
15 CcMapData=CcMapData@24
16 CcSetDirtyPinnedData=CcSetDirtyPinnedData@8
17 CcUnpinData=CcUnpinData@4
18 CcSetFileSizes=CcSetFileSizes@8
19 CcZeroData=CcZeroData@16
20 DbgBreakPoint=DbgBreakPoint@0
21 DbgBreakPointWithStatus=DbgBreakPointWithStatus@4
22 ;DbgLoadImageSymbols=DbgLoadImageSymbols@12
24 DbgPrompt=DbgPrompt@12
26 ExAcquireFastMutexUnsafe=@ExAcquireFastMutexUnsafe@4
27 ExAcquireResourceExclusive=ExAcquireResourceExclusive@8
28 ExAcquireResourceExclusiveLite=ExAcquireResourceExclusiveLite@8
29 ExAcquireResourceSharedLite=ExAcquireResourceSharedLite@8
30 ExAcquireSharedStarveExclusive=ExAcquireSharedStarveExclusive@8
31 ExAcquireSharedWaitForExclusive=ExAcquireSharedWaitForExclusive@8
32 ExAllocateFromPagedLookasideList=ExAllocateFromPagedLookasideList@4
33 ExAllocatePool=ExAllocatePool@8
34 ExAllocatePoolWithQuota=ExAllocatePoolWithQuota@8
35 ExAllocatePoolWithQuotaTag=ExAllocatePoolWithQuotaTag@12
36 ExAllocatePoolWithTag=ExAllocatePoolWithTag@12
37 ExConvertExclusiveToSharedLite=ExConvertExclusiveToSharedLite@4
38 ExCreateCallback=ExCreateCallback@16
39 ExDeleteNPagedLookasideList=ExDeleteNPagedLookasideList@4
40 ExDeletePagedLookasideList=ExDeletePagedLookasideList@4
41 ExDeleteResource=ExDeleteResource@4
42 ExDeleteResourceLite=ExDeleteResourceLite@4
43 ExDesktopObjectType DATA
44 ExDisableResourceBoostLite=ExDisableResourceBoostLite@4
45 ExEventObjectType DATA
46 ExExtendZone=ExExtendZone@12
47 ExFreePool=ExFreePool@4
48 ExFreeToPagedLookasideList=ExFreeToPagedLookasideList@8
49 ExGetExclusiveWaiterCount=ExGetExclusiveWaiterCount@4
50 ExGetPreviousMode=ExGetPreviousMode@0
51 ExGetSharedWaiterCount=ExGetSharedWaiterCount@4
52 ExInitializeNPagedLookasideList=ExInitializeNPagedLookasideList@28
53 ExInitializePagedLookasideList=ExInitializePagedLookasideList@28
54 ExInitializeResource=ExInitializeResource@4
55 ExInitializeResourceLite=ExInitializeResourceLite@4
56 ExInitializeZone=ExInitializeZone@16
57 ExInterlockedAddLargeInteger=ExInterlockedAddLargeInteger@16
58 ExInterlockedAddLargeStatistic=@ExInterlockedAddLargeStatistic@8
59 ExInterlockedAddUlong=ExInterlockedAddUlong@12
60 ExInterlockedCompareExchange64=@ExInterlockedCompareExchange64@16
61 ExInterlockedDecrementLong=ExInterlockedDecrementLong@8
62 ExInterlockedExchangeUlong=ExInterlockedExchangeUlong@12
63 ExInterlockedExtendZone=ExInterlockedExtendZone@16
64 ExInterlockedIncrementLong=ExInterlockedIncrementLong@8
65 ExInterlockedInsertHeadList=ExInterlockedInsertHeadList@12
66 ExInterlockedInsertTailList=ExInterlockedInsertTailList@12
67 ExInterlockedPopEntryList=ExInterlockedPopEntryList@8
68 ExInterlockedPopEntrySList=@ExInterlockedPopEntrySList@8
69 ExInterlockedPushEntryList=ExInterlockedPushEntryList@12
70 ExInterlockedPushEntrySList=@ExInterlockedPushEntrySList@12
71 ExInterlockedRemoveHeadList=ExInterlockedRemoveHeadList@8
72 ExIsProcessorFeaturePresent=ExIsProcessorFeaturePresent@4
73 ExIsResourceAcquiredExclusiveLite=ExIsResourceAcquiredExclusiveLite@4
74 ExIsResourceAcquiredSharedLite=ExIsResourceAcquiredSharedLite@4
75 ExLocalTimeToSystemTime=ExLocalTimeToSystemTime@8
76 ExNotifyCallback=ExNotifyCallback@12
77 ExPostSystemEvent=ExPostSystemEvent@12
79 ExQueueWorkItem=ExQueueWorkItem@8
80 ExRaiseAccessViolation=ExRaiseAccessViolation@0
81 ExRaiseDatatypeMisalignment=ExRaiseDatatypeMisalignment@0
84 ExRaiseStatus=ExRaiseStatus@4
85 ExRegisterCallback=ExRegisterCallback@12
86 ExReinitializeResourceLite=ExReinitializeResourceLite@4
87 ExReleaseFastMutexUnsafe=@ExReleaseFastMutexUnsafe@4
88 ExReleaseResourceForThread=ExReleaseResourceForThread@8
89 ExReleaseResourceForThreadLite=ExReleaseResourceForThreadLite@8
90 ExReleaseResourceLite=@ExReleaseResourceLite@4
91 ExSetResourceOwnerPointer=ExSetResourceOwnerPointer@8
92 ;ExSystemExceptionFilter
93 ExSystemTimeToLocalTime=ExSystemTimeToLocalTime@8
94 ExTryToAcquireResourceExclusiveLite=ExTryToAcquireResourceExclusiveLite@4
95 ExUnregisterCallback=ExUnregisterCallback@4
96 ExWindowStationObjectType DATA
97 ExInitializeBinaryTree=ExInitializeBinaryTree@12
98 ExDeleteBinaryTree=ExDeleteBinaryTree@4
99 ExInsertBinaryTree=ExInsertBinaryTree@12
100 ExSearchBinaryTree=ExSearchBinaryTree@12
101 ExRemoveBinaryTree=ExRemoveBinaryTree@12
102 ExTraverseBinaryTree=ExTraverseBinaryTree@16
103 ExInitializeSplayTree=ExInitializeSplayTree@16
104 ExDeleteSplayTree=ExDeleteSplayTree@4
105 ExInsertSplayTree=ExInsertSplayTree@12
106 ExSearchSplayTree=ExSearchSplayTree@12
107 ExRemoveSplayTree=ExRemoveSplayTree@12
108 ExWeightOfSplayTree=ExWeightOfSplayTree@8
109 ExTraverseSplayTree=ExTraverseSplayTree@16
110 ExInitializeHashTable=ExInitializeHashTable@16
111 ExDeleteHashTable=ExDeleteHashTable@4
112 ExInsertHashTable=ExInsertHashTable@16
113 ExSearchHashTable=ExSearchHashTable@16
114 ExRemoveHashTable=ExRemoveHashTable@16
115 ExfInterlockedAddUlong=@ExfInterlockedAddUlong@12
116 ExfInterlockedInsertHeadList=@ExfInterlockedInsertHeadList@12
117 ExfInterlockedInsertTailList=@ExfInterlockedInsertTailList@12
118 ExfInterlockedPopEntryList=@ExfInterlockedPopEntryList@8
119 ExfInterlockedPushEntryList=@ExfInterlockedPushEntryList@12
120 ExfInterlockedRemoveHeadList=@ExfInterlockedRemoveHeadList@8
121 Exfi386InterlockedDecrementLong=@Exfi386InterlockedDecrementLong@4
122 Exfi386InterlockedExchangeUlong=@Exfi386InterlockedExchangeUlong@8
123 Exfi386InterlockedIncrementLong=@Exfi386InterlockedIncrementLong@4
124 Exi386InterlockedDecrementLong=Exi386InterlockedDecrementLong@4
125 Exi386InterlockedExchangeUlong=Exi386InterlockedExchangeUlong@8
126 Exi386InterlockedIncrementLong=Exi386InterlockedIncrementLong@4
127 FsRtlAddLargeMcbEntry=FsRtlAddLargeMcbEntry@28
128 FsRtlAddMcbEntry=FsRtlAddMcbEntry@16
129 FsRtlAddToTunnelCache=FsRtlAddToTunnelCache@32
130 FsRtlAllocateFileLock=FsRtlAllocateFileLock@8
131 FsRtlAllocatePool=FsRtlAllocatePool@8
132 FsRtlAllocatePoolWithQuota=FsRtlAllocatePoolWithQuota@8
133 FsRtlAllocatePoolWithQuotaTag=FsRtlAllocatePoolWithQuotaTag@12
134 FsRtlAllocatePoolWithTag=FsRtlAllocatePoolWithTag@12
135 FsRtlAllocateResource=FsRtlAllocateResource@0
136 FsRtlAreNamesEqual=FsRtlAreNamesEqual@16
137 FsRtlBalanceReads=FsRtlBalanceReads@4
138 FsRtlCheckLockForReadAccess=FsRtlCheckLockForReadAccess@8
139 FsRtlCheckLockForWriteAccess=FsRtlCheckLockForWriteAccess@8
140 FsRtlCheckOplock=FsRtlCheckOplock@20
141 FsRtlCopyRead=FsRtlCopyRead@32
142 FsRtlCopyWrite=FsRtlCopyWrite@32
143 FsRtlCurrentBatchOplock=FsRtlCurrentBatchOplock@4
144 FsRtlDeleteKeyFromTunnelCache=FsRtlDeleteKeyFromTunnelCache@12
145 FsRtlDeleteTunnelCache=FsRtlDeleteTunnelCache@4
146 FsRtlDeregisterUncProvider=FsRtlDeregisterUncProvider@4
147 FsRtlDissectDbcs=FsRtlDissectDbcs@16
148 FsRtlDissectName=FsRtlDissectName@16
149 FsRtlDoesDbcsContainWildCards=FsRtlDoesDbcsContainWildCards@4
150 FsRtlDoesNameContainWildCards=FsRtlDoesNameContainWildCards@4
151 FsRtlFastCheckLockForRead=FsRtlFastCheckLockForRead@24
152 FsRtlFastCheckLockForWrite=FsRtlFastCheckLockForWrite@24
153 FsRtlFastUnlockAll=FsRtlFastUnlockAll@16
154 FsRtlFastUnlockAllByKey=FsRtlFastUnlockAllByKey@20
155 FsRtlFastUnlockSingle=FsRtlFastUnlockSingle@32
156 FsRtlFindInTunnelCache=FsRtlFindInTunnelCache@32
157 FsRtlGetFileSize=FsRtlGetFileSize@8
158 FsRtlGetNextFileLock=FsRtlGetNextFileLock@8
159 FsRtlGetNextLargeMcbEntry=FsRtlGetNextLargeMcbEntry@20
160 FsRtlGetNextMcbEntry=FsRtlGetNextMcbEntry@20
161 FsRtlInitializeFileLock=FsRtlInitializeFileLock@12
162 FsRtlInitializeLargeMcb=FsRtlInitializeLargeMcb@8
163 FsRtlInitializeMcb=FsRtlInitializeMcb@8
164 FsRtlInitializeOplock=FsRtlInitializeOplock@4
165 FsRtlInitializeTunnelCache=FsRtlInitializeTunnelCache@4
166 FsRtlIsDbcsInExpression=FsRtlIsDbcsInExpression@8
167 FsRtlIsFatDbcsLegal=FsRtlIsFatDbcsLegal@20
168 FsRtlIsHpfsDbcsLegal=FsRtlIsHpfsDbcsLegal@20
169 FsRtlIsNameInExpression=FsRtlIsNameInExpression@16
170 FsRtlIsNtstatusExpected=FsRtlIsNtstatusExpected@4
171 FsRtlIsTotalDeviceFailure=FsRtlIsTotalDeviceFailure@4
172 FsRtlLegalAnsiCharacterArray DATA
173 FsRtlLookupLargeMcbEntry=FsRtlLookupLargeMcbEntry@32
174 FsRtlLookupLastLargeMcbEntry=FsRtlLookupLastLargeMcbEntry@12
175 FsRtlLookupLastMcbEntry=FsRtlLookupLastMcbEntry@12
176 FsRtlLookupMcbEntry=FsRtlLookupMcbEntry@20
177 FsRtlMdlRead=FsRtlMdlRead@24
178 FsRtlMdlReadComplete=FsRtlMdlReadComplete@8
179 FsRtlMdlReadCompleteDev=FsRtlMdlReadCompleteDev@12
180 FsRtlMdlReadDev=FsRtlMdlReadDev@28
181 FsRtlMdlWriteComplete=FsRtlMdlWriteComplete@12
182 FsRtlMdlWriteCompleteDev=FsRtlMdlWriteCompleteDev@16
183 FsRtlNormalizeNtstatus=FsRtlNormalizeNtstatus@8
184 FsRtlNotifyChangeDirectory=FsRtlNotifyChangeDirectory@28
185 FsRtlNotifyCleanup=FsRtlNotifyCleanup@12
186 FsRtlNotifyFullChangeDirectory=FsRtlNotifyFullChangeDirectory@40
187 FsRtlNotifyFullReportChange=FsRtlNotifyFullReportChange@36
188 FsRtlNotifyInitializeSync=FsRtlNotifyInitializeSync@4
189 FsRtlNotifyReportChange=FsRtlNotifyReportChange@20
190 FsRtlNotifyUninitializeSync=FsRtlNotifyUninitializeSync@4
191 FsRtlNotifyVolumeEvent=FsRtlNotifyVolumeEvent@8
192 FsRtlNumberOfRunsInLargeMcb=FsRtlNumberOfRunsInLargeMcb@4
193 FsRtlNumberOfRunsInMcb=FsRtlNumberOfRunsInMcb@4
194 FsRtlOplockFsctrl=FsRtlOplockFsctrl@12
195 FsRtlOplockIsFastIoPossible=FsRtlOplockIsFastIoPossible@4
196 FsRtlPostPagingFileStackOverflow=FsRtlPostPagingFileStackOverflow@12
197 FsRtlPostStackOverflow=FsRtlPostStackOverflow@12
198 FsRtlPrepareMdlWrite=FsRtlPrepareMdlWrite@24
199 FsRtlPrepareMdlWriteDev=FsRtlPrepareMdlWriteDev@28
200 FsRtlPrivateLock=FsRtlPrivateLock@48
201 FsRtlProcessFileLock=FsRtlProcessFileLock@12
202 FsRtlRegisterUncProvider=FsRtlRegisterUncProvider@12
203 FsRtlRemoveLargeMcbEntry=FsRtlRemoveLargeMcbEntry@20
204 FsRtlRemoveMcbEntry=FsRtlRemoveMcbEntry@12
205 FsRtlSplitLargeMcb=FsRtlSplitLargeMcb@20
206 FsRtlSyncVolumes=FsRtlSyncVolumes@12
207 FsRtlTruncateLargeMcb=FsRtlTruncateLargeMcb@12
208 FsRtlTruncateMcb=FsRtlTruncateMcb@8
209 FsRtlUninitializeFileLock=FsRtlUninitializeFileLock@4
210 FsRtlUninitializeLargeMcb=FsRtlUninitializeLargeMcb@4
211 FsRtlUninitializeMcb=FsRtlUninitializeMcb@4
212 FsRtlUninitializeOplock=FsRtlUninitializeOplock@4
213 HalDispatchTable DATA
214 HalPrivateDispatchTable DATA
215 InterlockedCompareExchange=@InterlockedCompareExchange@12
216 InterlockedDecrement=@InterlockedDecrement@4
217 InterlockedExchange=@InterlockedExchange@8
218 InterlockedExchangeAdd=@InterlockedExchangeAdd@8
219 InterlockedIncrement=@InterlockedIncrement@4
220 IoAcquireCancelSpinLock=IoAcquireCancelSpinLock@4
221 IoAcquireVpbSpinLock=IoAcquireVpbSpinLock@4
222 IoAdapterObjectType DATA
223 IoAllocateAdapterChannel=IoAllocateAdapterChannel@20
224 IoAllocateIrp=IoAllocateIrp@8
225 IoAllocateMdl=IoAllocateMdl@20
226 IoAllocateController=IoAllocateController@16
227 IoAllocateErrorLogEntry=IoAllocateErrorLogEntry@8
228 IoAssignResources=IoAssignResources@24
229 IoAttachDevice=IoAttachDevice@12
230 IoAttachDeviceByPointer=IoAttachDeviceByPointer@8
231 IoAttachDeviceToDeviceStack=IoAttachDeviceToDeviceStack@8
232 IoBuildAsynchronousFsdRequest=IoBuildAsynchronousFsdRequest@24
233 IoBuildDeviceIoControlRequest=IoBuildDeviceIoControlRequest@36
234 IoBuildPartialMdl=IoBuildPartialMdl@16
235 IoBuildSynchronousFsdRequest=IoBuildSynchronousFsdRequest@28
236 IoCallDriver=IoCallDriver@8
237 IoCancelIrp=IoCancelIrp@4
238 IoCheckDesiredAccess=IoCheckDesiredAccess@8
239 IoCheckEaBufferValidity=IoCheckEaBufferValidity@12
240 IoCheckFunctionAccess=IoCheckFunctionAccess@24
241 IoCheckShareAccess=IoCheckShareAccess@20
242 IoCompleteRequest=IoCompleteRequest@8
243 IoConnectInterrupt=IoConnectInterrupt@44
244 IoCreateController=IoCreateController@4
245 IoCreateDevice=IoCreateDevice@28
246 IoCreateFile=IoCreateFile@56
247 IoCreateNotificationEvent=IoCreateNotificationEvent@8
248 IoCreateStreamFileObject=IoCreateStreamFileObject@8
249 IoCreateSymbolicLink=IoCreateSymbolicLink@8
250 IoCreateSynchronizationEvent=IoCreateSynchronizationEvent@8
251 IoCreateUnprotectedSymbolicLink=IoCreateUnprotectedSymbolicLink@8
252 IoDeleteController=IoDeleteController@4
253 IoDeleteDevice=IoDeleteDevice@4
254 IoDeleteSymbolicLink=IoDeleteSymbolicLink@4
255 IoDetachDevice=IoDetachDevice@4
256 IoDeviceHandlerObjectSize DATA
257 IoDeviceHandlerObjectType DATA
258 IoDeviceObjectType DATA
259 IoDisconnectInterrupt=IoDisconnectInterrupt@4
260 IoDriverObjectType DATA
261 IoEnqueueIrp=IoEnqueueIrp@4
262 IoFastQueryNetworkAttributes=IoFastQueryNetworkAttributes@20
263 IoFileObjectType DATA
264 IoFreeController=IoFreeController@4
265 IoFreeIrp=IoFreeIrp@4
266 IoFreeMdl=IoFreeMdl@4
267 IoGetAttachedDevice=IoGetAttachedDevice@4
268 IoGetAttachedDeviceReference=IoGetAttachedDeviceReference@4
269 IoGetBaseFileSystemDeviceObject=IoGetBaseFileSystemDeviceObject@4
270 IoGetConfigurationInformation=IoGetConfigurationInformation@0
271 IoGetCurrentProcess=IoGetCurrentProcess@0
272 IoGetDeviceObjectPointer=IoGetDeviceObjectPointer@16
273 IoGetDeviceToVerify=IoGetDeviceToVerify@4
274 IoGetFileObjectGenericMapping=IoGetFileObjectGenericMapping@0
275 IoGetInitialStack=IoGetInitialStack@0
276 IoGetRelatedDeviceObject=IoGetRelatedDeviceObject@4
277 IoGetRequestorProcess=IoGetRequestorProcess@4
278 IoGetStackLimits=IoGetStackLimits@8
279 IoGetTopLevelIrp=IoGetTopLevelIrp@0
280 IoInitializeIrp=IoInitializeIrp@12
281 IoInitializeTimer=IoInitializeTimer@12
282 IoIsOperationSynchronous=IoIsOperationSynchronous@4
283 IoMakeAssociatedIrp=IoMakeAssociatedIrp@8
284 IoOpenDeviceInstanceKey=IoOpenDeviceInstanceKey@20
285 ;IoPageRead=IoPageRead@16
286 IoQueryDeviceDescription=IoQueryDeviceDescription@32
287 IoQueryDeviceEnumInfo=IoQueryDeviceEnumInfo@8
288 IoQueryFileInformation=IoQueryFileInformation@20
289 IoQueryVolumeInformation=IoQueryVolumeInformation@20
290 IoQueueThreadIrp=IoQueueThreadIrp@4
291 IoRaiseHardError=IoRaiseHardError@12
292 IoRaiseInformationalHardError=IoRaiseInformationalHardError@12
293 IoReadOperationCount DATA
294 IoReadPartitionTable=IoReadPartitionTable@16
295 IoReadTransferCount DATA
296 IoRegisterDriverReinitialization=IoRegisterDriverReinitialization@12
297 IoRegisterFileSystem=IoRegisterFileSystem@4
298 IoRegisterFsRegistrationChange=IoRegisterFsRegistrationChange@8
299 IoRegisterShutdownNotification=IoRegisterShutdownNotification@4
300 IoReleaseCancelSpinLock=IoReleaseCancelSpinLock@4
301 IoReleaseVpbSpinLock=IoReleaseVpbSpinLock@4
302 IoRemoveShareAccess=IoRemoveShareAccess@8
303 IoReportHalResourceUsage=IoReportHalResourceUsage@16
304 IoReportResourceUsage=IoReportResourceUsage@36
305 IoSetDeviceToVerify=IoSetDeviceToVerify@8
306 IoSetHardErrorOrVerifyDevice=IoSetHardErrorOrVerifyDevice@8
307 IoSetInformation=IoSetInformation@16
308 IoSetPartitionInformation=IoSetPartitionInformation@16
309 IoSetShareAccess=IoSetShareAccess@16
310 IoSetThreadHardErrorMode=IoSetThreadHardErrorMode@4
311 IoSetTopLevelIrp=IoSetTopLevelIrp@4
312 IoStartNextPacket=IoStartNextPacket@8
313 IoStartNextPacketByKey=IoStartNextPacketByKey@12
314 IoStartPacket=IoStartPacket@16
315 IoStartTimer=IoStartTimer@4
316 IoStatisticsLock DATA
317 IoStopTimer=IoStopTimer@4
318 IoSynchronousPageWrite=IoSynchronousPageWrite@20
319 IoThreadToProcess=IoThreadToProcess@4
320 IoUnregisterFileSystem=IoUnregisterFileSystem@4
321 IoUnregisterFsRegistrationChange=IoUnregisterFsRegistrationChange@8
322 IoUnregisterShutdownNotification=IoUnregisterShutdownNotification@4
323 IoUpdateShareAccess=IoUpdateShareAccess@8
324 IoVerifyVolume=IoVerifyVolume@8
325 IoWriteErrorLogEntry=IoWriteErrorLogEntry@4
326 IoWriteOperationCount DATA
327 IoWritePartitionTable=IoWritePartitionTable@20
328 IoWriteTransferCount DATA
329 IofCallDriver=@IofCallDriver@8
330 IofCompleteRequest=@IofCompleteRequest@8
331 KdDebuggerEnabled DATA
332 KdDebuggerNotPresent DATA
333 KdPollBreakIn=KdPollBreakIn@0
334 KdSystemDebugControl=KdSystemDebugControl@4
335 Ke386CallBios=Ke386CallBios@8
336 ;Ke386IoSetAccessProcess
337 ;Ke386QueryIoAccessMap
339 KeAcquireSpinLockAtDpcLevel=KeAcquireSpinLockAtDpcLevel@4
340 KeAddSystemServiceTable=KeAddSystemServiceTable@20
341 KeAttachProcess=KeAttachProcess@4
342 ;KeBoostCurrentThread
343 KeBugCheck=KeBugCheck@4
344 KeBugCheckEx=KeBugCheckEx@20
345 KeCancelTimer=KeCancelTimer@4
346 KeClearEvent=KeClearEvent@4
347 KeConnectInterrupt=KeConnectInterrupt@4
348 ;KeDcacheFlushCount DATA
349 KeDelayExecutionThread=KeDelayExecutionThread@12
350 KeDeregisterBugCheckCallback=KeDeregisterBugCheckCallback@4
351 KeDetachProcess=KeDetachProcess@0
352 KeDisconnectInterrupt=KeDisconnectInterrupt@4
353 KeEnterCriticalRegion=KeEnterCriticalRegion@0
354 KeEnterKernelDebugger=KeEnterKernelDebugger@0
355 ;KeFindConfigurationEntry
356 ;KeFindConfigurationNextEntry
358 KeGetCurrentThread=KeGetCurrentThread@0
359 KeGetPreviousMode=KeGetPreviousMode@0
361 ;KeI386AllocateGdtSelectors
362 ;KeI386Call16BitCStyleFunction
363 ;KeI386Call16BitFunction
364 ;KeI386FlatToGdtSelector
366 ;KeI386MachineType DATA
367 ;KeI386ReleaseGdtSelectors
369 ;KeI386SetGdtSelector
370 ;KeIcacheFlushCount DATA
371 KeInitializeApc=KeInitializeApc@32
372 KeInitializeDeviceQueue=KeInitializeDeviceQueue@4
373 KeInitializeDpc=KeInitializeDpc@12
374 KeInitializeEvent=KeInitializeEvent@12
375 KeInitializeInterrupt=KeInitializeInterrupt@44
376 KeInitializeMutant=KeInitializeMutant@8
377 KeInitializeMutex=KeInitializeMutex@8
378 KeInitializeQueue=KeInitializeQueue@8
379 KeInitializeSemaphore=KeInitializeSemaphore@12
380 KeInitializeSpinLock=KeInitializeSpinLock@4
381 KeInitializeTimer=KeInitializeTimer@4
382 KeInitializeTimerEx=KeInitializeTimerEx@8
383 KeInsertByKeyDeviceQueue=KeInsertByKeyDeviceQueue@12
384 KeInsertDeviceQueue=KeInsertDeviceQueue@8
385 KeInsertHeadQueue=KeInsertHeadQueue@8
386 KeInsertQueue=KeInsertQueue@8
387 KeInsertQueueApc=KeInsertQueueApc@16
388 KeInsertQueueDpc=KeInsertQueueDpc@12
390 KeLeaveCriticalRegion=KeLeaveCriticalRegion@0
392 KeNumberProcessors DATA
394 ;KeProfileInterruptWithSource
395 KePulseEvent=KePulseEvent@12
396 KeQuerySystemTime=KeQuerySystemTime@4
397 KeQueryTickCount=KeQueryTickCount@4
398 KeQueryTimeIncrement=KeQueryTimeIncrement@0
399 ;KeRaiseUserException
400 KeReadStateEvent=KeReadStateEvent@4
401 KeReadStateMutant=KeReadStateMutant@4
402 KeReadStateMutex=KeReadStateMutex@4
403 KeReadStateQueue=KeReadStateQueue@4
404 KeReadStateSemaphore=KeReadStateSemaphore@4
405 KeReadStateTimer=KeReadStateTimer@4
406 KeRegisterBugCheckCallback=KeRegisterBugCheckCallback@20
407 KeReleaseMutant=KeReleaseMutant@16
408 KeReleaseMutex=KeReleaseMutex@8
409 KeReleaseSemaphore=KeReleaseSemaphore@16
410 KeReleaseSpinLockFromDpcLevel=KeReleaseSpinLockFromDpcLevel@4
411 KeRemoveByKeyDeviceQueue=KeRemoveByKeyDeviceQueue@8
412 KeRemoveDeviceQueue=KeRemoveDeviceQueue@4
413 KeRemoveEntryDeviceQueue=KeRemoveEntryDeviceQueue@8
414 KeRemoveQueue=KeRemoveQueue@12
415 KeRemoveQueueDpc=KeRemoveQueueDpc@4
416 KeResetEvent=KeResetEvent@4
417 ;KeRestoreFloatingPointState
418 KeRundownQueue=KeRundownQueue@4
419 ;KeSaveFloatingPointState
420 KeServiceDescriptorTable DATA
422 KeSetBasePriorityThread=KeSetBasePriorityThread@8
424 KeSetEvent=KeSetEvent@12
425 ;KeSetEventBoostPriority
426 ;KeSetIdealProcessorThread
427 KeSetImportanceDpc=KeSetImportanceDpc@8
428 ;KeSetKernelStackSwapEnable
429 KeSetPriorityThread=KeSetPriorityThread@8
431 ;KeSetSwapContextNotifyRoutine
432 KeSetTargetProcessorDpc=KeSetTargetProcessorDpc@8
433 ;KeSetThreadSelectNotifyRoutine
435 KeSetTimer=KeSetTimer@16
436 KeSetTimerEx=KeSetTimerEx@20
437 ;KeSetTimeUpdateNotifyRoutine
438 KeSynchronizeExecution=KeSynchronizeExecution@12
443 KeWaitForMultipleObjects=KeWaitForMultipleObjects@32
444 KeWaitForMutexObject=KeWaitForMutexObject@20
445 KeWaitForSingleObject=KeWaitForSingleObject@20
446 ;KefAcquireSpinLockAtDpcLevel
447 ;KefReleaseSpinLockFromDpcLevel
451 ;KiCoprocessorError@0
452 KiDeliverApc=KiDeliverApc@12
453 KiDispatchInterrupt=KiDispatchInterrupt@0
454 KiInterruptDispatch2=KiInterruptDispatch2@8
455 ;KiIpiServiceRoutine@8
457 ;KiUnexpectedInterrupt
458 ;Kii386SpinOnSpinLock
460 LdrAccessResource=LdrAccessResource@16
462 ;LdrFindResourceDirectory_U@16
463 LdrFindResource_U=LdrFindResource_U@16
465 LsaCallAuthenticationPackage=LsaCallAuthenticationPackage@28
466 LsaDeregisterLogonProcess=LsaDeregisterLogonProcess@8
467 LsaFreeReturnBuffer=LsaFreeReturnBuffer@4
468 LsaLogonUser=LsaLogonUser@56
469 LsaLookupAuthenticationPackage=LsaLookupAuthenticationPackage@12
470 LsaRegisterLogonProcess=LsaRegisterLogonProcess@12
471 MmAdjustWorkingSetSize=MmAdjustWorkingSetSize@12
472 MmAllocateContiguousAlignedMemory=MmAllocateContiguousAlignedMemory@16
473 MmAllocateContiguousMemory=MmAllocateContiguousMemory@12
474 MmAllocateNonCachedMemory=MmAllocateNonCachedMemory@4
475 MmBuildMdlForNonPagedPool=MmBuildMdlForNonPagedPool@4
476 MmCanFileBeTruncated=MmCanFileBeTruncated@8
477 MmCopyFromCaller=MmCopyFromCaller@12
478 MmCopyToCaller=MmCopyToCaller@12
479 MmCreateMdl=MmCreateMdl@12
480 MmCreateSection=MmCreateSection@32
481 MmDbgTranslatePhysicalAddress=MmDbgTranslatePhysicalAddress@8
482 MmDisableModifiedWriteOfSection=MmDisableModifiedWriteOfSection@4
483 MmFlushImageSection=MmFlushImageSection@8
484 MmForceSectionClosed=MmForceSectionClosed@8
485 MmFreeContiguousMemory=MmFreeContiguousMemory@4
486 MmFreeNonCachedMemory=MmFreeNonCachedMemory@8
487 MmGetPhysicalAddress=MmGetPhysicalAddress@4
488 MmGrowKernelStack=MmGrowKernelStack@4
489 MmHighestUserAddress DATA
490 MmIsAddressValid=MmIsAddressValid@4
491 MmIsNonPagedSystemAddressValid=MmIsNonPagedSystemAddressValid@4
492 MmIsRecursiveIoFault=MmIsRecursiveIoFault@0
493 MmIsThisAnNtAsSystem=MmIsThisAnNtAsSystem@0
494 MmLockPagableDataSection=MmLockPagableDataSection@4
495 MmLockPagableImageSection=MmLockPagableDataSection@4
496 MmLockPagableSectionByHandle=MmLockPagableSectionByHandle@4
497 MmMapIoSpace=MmMapIoSpace@16
498 MmMapLockedPages=MmMapLockedPages@8
499 MmMapMemoryDumpMdl=MmMapMemoryDumpMdl@4
500 MmMapVideoDisplay=MmMapVideoDisplay@16
501 MmMapViewInSystemSpace=MmMapViewInSystemSpace@12
502 MmMapViewOfSection=MmMapViewOfSection@40
503 MmPageEntireDriver=MmPageEntireDriver@4
504 MmProbeAndLockPages=MmProbeAndLockPages@12
505 MmQuerySystemSize=MmQuerySystemSize@0
506 MmResetDriverPaging=MmResetDriverPaging@4
507 MmSectionObjectType DATA
508 MmSecureVirtualMemory=MmSecureVirtualMemory@12
509 MmSetAddressRangeModified=MmSetAddressRangeModified@8
510 MmSetBankedSection=MmSetBankedSection@24
511 MmSizeOfMdl=MmSizeOfMdl@8
512 MmUnlockPagableImageSection=MmUnlockPagableImageSection@4
513 MmUnlockPages=MmUnlockPages@4
514 MmUnmapIoSpace=MmUnmapIoSpace@8
515 MmUnmapLockedPages=MmUnmapLockedPages@8
516 MmUnmapVideoDisplay=MmUnmapVideoDisplay@8
517 MmUnmapViewInSystemSpace=MmUnmapViewInSystemSpace@4
518 MmUnmapViewOfSection=MmUnmapViewOfSection@8
519 MmUnsecureVirtualMemory=MmUnsecureVirtualMemory@4
520 MmUserProbeAddress DATA
523 NlsMbCodePageTag DATA
524 NlsMbOemCodePageTag DATA
525 NlsOemLeadByteInfo DATA
526 NtAddAtom=NtAddAtom@8
527 NtAdjustPrivilegesToken=NtAdjustPrivilegesToken@24
528 NtAlertThread=NtAlertThread@4
529 NtAllocateLocallyUniqueId=NtAllocateLocallyUniqueId@4
530 NtAllocateUuids=NtAllocateUuids@12
531 NtAllocateVirtualMemory=NtAllocateVirtualMemory@24
534 NtConnectPort=NtConnectPort@32
535 NtCreateEvent=NtCreateEvent@20
536 NtCreateTimer=NtCreateTimer@16
537 NtOpenEvent=NtOpenEvent@12
538 NtCreateFile=NtCreateFile@44
539 NtCreateSection=NtCreateSection@28
540 NtDeleteAtom=NtDeleteAtom@4
541 NtDeleteFile=NtDeleteFile@4
542 NtDeviceIoControlFile=NtDeviceIoControlFile@40
543 NtDuplicateObject=NtDuplicateObject@28
544 NtDuplicateToken=NtDuplicateToken@24
545 NtFindAtom=NtFindAtom@8
546 NtFreeVirtualMemory=NtFreeVirtualMemory@16
547 NtFsControlFile=NtFsControlFile@40
549 NtLockFile=NtLockFile@40
550 NtMapViewOfSection=NtMapViewOfSection@40
551 NtNotifyChangeDirectoryFile=NtNotifyChangeDirectoryFile@36
552 NtOpenFile=NtOpenFile@24
553 NtOpenProcess=NtOpenProcess@16
554 NtOpenProcessToken=NtOpenProcessToken@12
555 NtQueryDirectoryFile=NtQueryDirectoryFile@44
556 NtQueryEaFile=NtQueryEaFile@36
557 NtQueryInformationAtom=NtQueryInformationAtom@20
558 NtQueryInformationFile=NtQueryInformationFile@20
559 NtQueryInformationProcess=NtQueryInformationProcess@20
560 NtQueryInformationToken=NtQueryInformationToken@20
561 ;NtQueryOleDirectoryFile@44 <--- ?
562 NtQuerySecurityObject=NtQuerySecurityObject@20
563 NtQuerySystemTime=NtQuerySystemTime@4
564 NtQueryVolumeInformationFile=NtQueryVolumeInformationFile@20
565 NtReadFile=NtReadFile@36
566 NtRequestPort=NtRequestPort@8
567 NtRequestWaitReplyPort@12
568 NtSetEvent=NtSetEvent@8
569 NtSetInformationFile=NtSetInformationFile@20
570 NtSetInformationProcess=NtSetInformationProcess@16
571 NtSetInformationThread=NtSetInformationThread@16
572 NtSetSecurityObject=NtSetSecurityObject@12
573 NtSetSystemTime=NtSetSystemTime@8
574 NtUnlockFile=NtUnlockFile@20
575 NtVdmControl=NtVdmControl@8
576 NtW32Call=NtW32Call@20
577 NtWaitForSingleObject=NtWaitForSingleObject@12
578 NtWriteFile=NtWriteFile@36
579 ObAssignSecurity=ObAssignSecurity@16
580 ;ObCheckCreateObjectAccess=ObCheckCreateObjectAccess@28
581 ;ObCheckObjectAccess=ObCheckObjectAccess@20
582 ;ObCreateObject=ObCreateObject@36
583 ObCreateObject=ObCreateObject@20
584 ;ObFindHandleForObject=ObFindHandleForObject@20
585 ObGetObjectPointerCount=ObGetObjectPointerCount@4
586 ObGetObjectSecurity=ObGetObjectSecurity@12
587 ;ObInsertObject=ObInsertObject@24
588 ObMakeTemporaryObject=ObMakeTemporaryObject@4
589 ObOpenObjectByName=ObOpenObjectByName@28
590 ObOpenObjectByPointer=ObOpenObjectByPointer@28
591 ;ObQueryNameString=ObQueryNameString@16
592 ;ObQueryObjectAuditingByHandle=ObQueryObjectAuditingByHandle@8
593 ObfDereferenceObject=@ObfDereferenceObject@4
594 ObfReferenceObject=@ObfReferenceObject@4
595 ObReferenceObjectByHandle=ObReferenceObjectByHandle@24
596 ObReferenceObjectByName=ObReferenceObjectByName@32
597 ObReferenceObjectByPointer=ObReferenceObjectByPointer@16
598 ObReleaseObjectSecurity=ObReleaseObjectSecurity@8
599 ;ObSetSecurityDescriptorInfo=ObSetSecurityDescriptorInfo@24
604 PoCallDriver=PoCallDriver@8
605 PoRegisterDeviceForIdleDetection=PoRegisterDeviceForIdleDetection@16
606 PoRegisterSystemState=PoRegisterSystemState@8
607 PoRequestPowerIrp=PoRequestPowerIrp@24
608 PoSetDeviceBusy=PoSetDeviceBusy@4
609 PoSetPowerState=PoSetPowerState@12
610 PoSetSystemState=PoSetSystemState@4
611 PoStartNextPowerIrp=PoStartNextPowerIrp@4
612 PoUnregisterSystemState=PoUnregisterSystemState@4
613 ;ProbeForWrite=ProbeForWrite@12
614 PsAssignImpersonationToken=PsAssignImpersonationToken@8
615 ;PsChargePoolQuota=PsChargePoolQuota@12
616 PsCreateSystemProcess=PsCreateSystemProcess@12
617 PsCreateSystemThread=PsCreateSystemThread@28
618 PsCreateWin32Thread=PsCreateWin32Thread@4
619 PsCreateWin32Process=PsCreateWin32Process@4
620 PsGetWin32Thread=PsGetWin32Thread@0
621 PsGetWin32Process=PsGetWin32Process@0
622 PsEstablishWin32Callouts=PsEstablishWin32Callouts@24
623 PsGetCurrentProcess=PsGetCurrentProcess@0
624 PsGetCurrentProcessId=PsGetCurrentProcessId@0
625 PsGetCurrentThreadId=PsGetCurrentThreadId@0
626 PsGetCurrentThread=PsGetCurrentThread@0
627 PsGetProcessExitTime=PsGetProcessExitTime@0
628 PsGetVersion=PsGetVersion@16
629 PsImpersonateClient=PsImpersonateClient@20
630 PsInitialSystemProcess DATA
631 PsIsThreadTerminating=PsIsThreadTerminating@4
632 PsLookupProcessByProcessId=PsLookupProcessByProcessId@8
633 PsLookupProcessThreadByCid=PsLookupProcessThreadByCid@12
634 PsLookupThreadByThreadId=PsLookupThreadByThreadId@8
636 PsReferenceImpersonationToken=PsReferenceImpersonationToken@16
637 PsReferencePrimaryToken=PsReferencePrimaryToken@4
639 PsRevertToSelf=PsRevertToSelf@0
640 PsSetCreateProcessNotifyRoutine=PsSetCreateProcessNotifyRoutine@8
641 PsSetCreateThreadNotifyRoutine=PsSetCreateThreadNotifyRoutine@4
642 ;PsSetLegoNotifyRoutine
643 ;PsSetProcessPriorityByClass
644 PsTerminateSystemThread=PsTerminateSystemThread@4
646 READ_REGISTER_UCHAR=READ_REGISTER_UCHAR@4
647 READ_REGISTER_ULONG=READ_REGISTER_ULONG@4
648 READ_REGISTER_USHORT=READ_REGISTER_USHORT@4
649 READ_REGISTER_BUFFER_UCHAR=READ_REGISTER_BUFFER_UCHAR@12
650 READ_REGISTER_BUFFER_ULONG=READ_REGISTER_BUFFER_ULONG@12
651 READ_REGISTER_BUFFER_USHORT=READ_REGISTER_BUFFER_USHORT@12
652 RtlAbsoluteToSelfRelativeSD=RtlAbsoluteToSelfRelativeSD@12
653 RtlAddAccessAllowedAce=RtlAddAccessAllowedAce@16
654 RtlAddAce=RtlAddAce@20
655 RtlAddAtomToAtomTable=RtlAddAtomToAtomTable@12
656 ;RtlAllocateAndInitializeSid
658 RtlAnsiCharToUnicodeChar=RtlAnsiCharToUnicodeChar@4
659 RtlAnsiStringToUnicodeSize=RtlAnsiStringToUnicodeSize@4
660 RtlAnsiStringToUnicodeString=RtlAnsiStringToUnicodeString@12
661 RtlAppendAsciizToString=RtlAppendAsciizToString@8
662 RtlAppendStringToString=RtlAppendStringToString@8
663 RtlAppendUnicodeStringToString=RtlAppendUnicodeStringToString@8
664 RtlAppendUnicodeToString=RtlAppendUnicodeToString@8
665 RtlAreAllAccessesGranted=RtlAreAllAccessesGranted@8
666 RtlAreAnyAccessesGranted=RtlAreAnyAccessesGranted@8
667 RtlAreBitsClear=RtlAreBitsClear@12
668 RtlAreBitsSet=RtlAreBitsSet@12
669 RtlAssert=RtlAssert@16
670 ;RtlCaptureStackBackTrace
671 RtlCharToInteger=RtlCharToInteger@12
672 RtlCheckRegistryKey=RtlCheckRegistryKey@8
673 RtlClearAllBits=RtlClearAllBits@4
674 RtlClearBits=RtlClearBits@12
675 RtlCompareMemory=RtlCompareMemory@12
676 RtlCompareMemoryUlong=RtlCompareMemoryUlong@12
677 RtlCompareString=RtlCompareString@12
678 RtlCompareUnicodeString=RtlCompareUnicodeString@12
679 RtlCompressBuffer=RtlCompressBuffer@32
680 RtlCompressChunks=RtlCompressChunks@28
681 RtlConvertLongToLargeInteger=RtlConvertLongToLargeInteger@4
682 RtlConvertSidToUnicodeString=RtlConvertSidToUnicodeString@12
683 RtlConvertUlongToLargeInteger=RtlConvertUlongToLargeInteger@4
684 RtlCopyLuid=RtlCopyLuid@8
685 RtlCopySid=RtlCopySid@12
686 RtlCopyString=RtlCopyString@8
687 RtlCopyUnicodeString=RtlCopyUnicodeString@8
688 RtlCreateAcl=RtlCreateAcl@12
689 RtlCreateAtomTable=RtlCreateAtomTable@8
691 RtlCreateRegistryKey=RtlCreateRegistryKey@8
692 RtlCreateSecurityDescriptor=RtlCreateSecurityDescriptor@8
693 RtlCreateUnicodeString=RtlCreateUnicodeString@8
694 RtlCustomCPToUnicodeN=RtlCustomCPToUnicodeN@24
695 RtlDecompressBuffer=RtlDecompressBuffer@24
696 RtlDecompressChunks=RtlDecompressChunks@28
697 RtlDecompressFragment=RtlDecompressFragment@32
699 RtlDeleteAtomFromAtomTable=RtlDeleteAtomFromAtomTable@8
700 ;RtlDeleteElementGenericTable
702 RtlDeleteRegistryValue=RtlDeleteRegistryValue@12
703 RtlDescribeChunk=RtlDescribeChunk@20
704 RtlDestroyAtomTable=RtlDestroyAtomTable@4
706 RtlDowncaseUnicodeString=RtlDowncaseUnicodeString@12
707 RtlEmptyAtomTable=RtlEmptyAtomTable@8
708 RtlEnlargedIntegerMultiply=RtlEnlargedIntegerMultiply@8
709 RtlEnlargedUnsignedDivide=RtlEnlargedUnsignedDivide@16
710 RtlEnlargedUnsignedMultiply=RtlEnlargedUnsignedMultiply@8
711 ;RtlEnumerateGenericTable
712 ;RtlEnumerateGenericTableWithoutSplaying
713 RtlEqualLuid=RtlEqualLuid@8
714 RtlEqualSid=RtlEqualSid@8
715 RtlEqualString=RtlEqualString@12
716 RtlEqualUnicodeString=RtlEqualUnicodeString@12
717 RtlExtendedIntegerMultiply=RtlExtendedIntegerMultiply@12
718 RtlExtendedLargeIntegerDivide=RtlExtendedLargeIntegerDivide@16
719 RtlExtendedMagicDivide=RtlExtendedMagicDivide@20
720 RtlFillMemory=RtlFillMemory@12
721 RtlFillMemoryUlong=RtlFillMemoryUlong@12
722 RtlFindClearBits=RtlFindClearBits@12
723 RtlFindClearBitsAndSet=RtlFindClearBitsAndSet@12
724 RtlFindFirstRunClear=RtlFindFirstRunClear@8
725 RtlFindFirstRunSet=RtlFindFirstRunSet@8
726 RtlFindLongestRunClear=RtlFindLongestRunClear@8
727 RtlFindLongestRunSet=RtlFindLongestRunSet@8
728 RtlFindMessage=RtlFindMessage@20
729 RtlFindSetBits=RtlFindSetBits@12
730 RtlFindSetBitsAndClear=RtlFindSetBitsAndClear@12
731 ;RtlFindUnicodePrefix
732 RtlFormatCurrentUserKeyPath=RtlFormatCurrentUserKeyPath@4
733 RtlFreeAnsiString=RtlFreeAnsiString@4
735 RtlFreeOemString=RtlFreeOemString@4
736 RtlFreeUnicodeString=RtlFreeUnicodeString@4
737 RtlGenerate8dot3Name=RtlGenerate8dot3Name@16
738 ;RtlGetCallersAddress
739 RtlGetCompressionWorkSpaceSize=RtlGetCompressionWorkSpaceSize@12
740 RtlGetDaclSecurityDescriptor=RtlGetDaclSecurityDescriptor@16
741 RtlGetDefaultCodePage=RtlGetDefaultCodePage@8
742 ;RtlGetElementGenericTable
743 RtlGetGroupSecurityDescriptor=RtlGetGroupSecurityDescriptor@12
744 RtlGetOwnerSecurityDescriptor=RtlGetOwnerSecurityDescriptor@12
745 RtlImageNtHeader=RtlImageNtHeader@4
746 RtlInitAnsiString=RtlInitAnsiString@8
747 ;RtlInitCodePageTable
748 RtlInitString=RtlInitString@8
749 RtlInitUnicodeString=RtlInitUnicodeString@8
750 RtlInitializeBitMap=RtlInitializeBitMap@12
751 ;RtlInitializeGenericTable
752 RtlInitializeSid=RtlInitializeSid@12
753 ;RtlInitializeUnicodePrefix
754 ;RtlInsertElementGenericTable
755 ;RtlInsertUnicodePrefix
756 RtlIntegerToChar=RtlIntegerToChar@16
757 RtlIntegerToUnicodeString=RtlIntegerToUnicodeString@12
758 RtlIsNameLegalDOS8Dot3=RtlIsNameLegalDOS8Dot3@12
759 RtlLargeIntegerAdd=RtlLargeIntegerAdd@16
760 RtlLargeIntegerArithmeticShift=RtlLargeIntegerArithmeticShift@12
761 RtlLargeIntegerDivide=RtlLargeIntegerDivide@20
762 RtlLargeIntegerNegate=RtlLargeIntegerNegate@8
763 RtlLargeIntegerShiftLeft=RtlLargeIntegerShiftLeft@12
764 RtlLargeIntegerShiftRight=RtlLargeIntegerShiftRight@12
765 RtlLargeIntegerSubtract=RtlLargeIntegerSubtract@16
766 RtlLengthRequiredSid=RtlLengthRequiredSid@4
767 RtlLengthSecurityDescriptor=RtlLengthSecurityDescriptor@4
768 RtlLengthSid=RtlLengthSid@4
769 RtlLookupAtomInAtomTable=RtlLookupAtomInAtomTable@12
770 ;RtlLookupElementGenericTable
771 RtlMapGenericMask=RtlMapGenericMask@8
772 RtlMoveMemory=RtlMoveMemory@12
773 RtlMultiByteToUnicodeN=RtlMultiByteToUnicodeN@20
774 RtlMultiByteToUnicodeSize=RtlMultiByteToUnicodeSize@12
775 ;RtlNextUnicodePrefix
776 RtlNtStatusToDosError=RtlNtStatusToDosError@4
777 RtlNtStatusToDosErrorNoTeb=RtlNtStatusToDosErrorNoTeb@4
778 ;RtlNumberGenericTableElements
779 RtlNumberOfClearBits=RtlNumberOfClearBits@4
780 RtlNumberOfSetBits=RtlNumberOfSetBits@4
781 RtlOemStringToCountedUnicodeString=RtlOemStringToCountedUnicodeString@12
782 RtlOemStringToUnicodeSize=RtlOemStringToUnicodeSize@4
783 RtlOemStringToUnicodeString=RtlOemStringToUnicodeString@12
784 RtlPinAtomInAtomTable=RtlPinAtomInAtomTable@8
785 RtlPrefixString=RtlPrefixString@12
786 RtlPrefixUnicodeString=RtlPrefixUnicodeString@12
787 RtlQueryAtomInAtomTable=RtlQueryAtomInAtomTable@24
788 RtlQueryRegistryValues=RtlQueryRegistryValues@20
789 RtlQueryTimeZoneInformation=RtlQueryTimeZoneInformation@4
790 RtlRaiseException=RtlRaiseException@4
792 ;RtlRemoveUnicodePrefix
793 RtlReserveChunk=RtlReserveChunk@20
794 RtlSecondsSince1970ToTime=RtlSecondsSince1970ToTime@8
795 RtlSecondsSince1980ToTime=RtlSecondsSince1980ToTime@8
796 RtlSetAllBits=RtlSetAllBits@4
797 RtlSetBits=RtlSetBits@12
798 RtlSetDaclSecurityDescriptor=RtlSetDaclSecurityDescriptor@16
799 RtlSetGroupSecurityDescriptor=RtlSetGroupSecurityDescriptor@12
800 RtlSetOwnerSecurityDescriptor=RtlSetOwnerSecurityDescriptor@12
801 RtlSetSaclSecurityDescriptor=RtlSetSaclSecurityDescriptor@16
802 RtlSetTimeZoneInformation=RtlSetTimeZoneInformation@4
804 RtlSubAuthorityCountSid=RtlSubAuthorityCountSid@4
805 RtlSubAuthoritySid=RtlSubAuthoritySid@8
806 RtlTimeFieldsToTime=RtlTimeFieldsToTime@8
807 RtlTimeToSecondsSince1970=RtlTimeToSecondsSince1970@8
808 RtlTimeToSecondsSince1980=RtlTimeToSecondsSince1980@8
809 RtlTimeToTimeFields=RtlTimeToTimeFields@8
810 RtlUnicodeStringToAnsiSize=RtlUnicodeStringToAnsiSize@4
811 RtlUnicodeStringToAnsiString=RtlUnicodeStringToAnsiString@12
812 RtlUnicodeStringToCountedOemString=RtlUnicodeStringToCountedOemString@12
813 RtlUnicodeStringToInteger=RtlUnicodeStringToInteger@12
814 RtlUnicodeStringToOemSize=RtlUnicodeStringToOemSize@4
815 RtlUnicodeStringToOemString=RtlUnicodeStringToOemString@12
816 RtlUnicodeToCustomCPN=RtlUnicodeToCustomCPN@24
817 RtlUnicodeToMultiByteN=RtlUnicodeToMultiByteN@20
818 RtlUnicodeToMultiByteSize=RtlUnicodeToMultiByteSize@12
819 RtlUnicodeToOemN=RtlUnicodeToOemN@20
820 RtlUnwind=RtlUnwind@16
821 RtlUpcaseUnicodeChar=RtlUpcaseUnicodeChar@4
822 RtlUpcaseUnicodeString=RtlUpcaseUnicodeString@12
823 RtlUpcaseUnicodeStringToAnsiString=RtlUpcaseUnicodeStringToAnsiString@12
824 RtlUpcaseUnicodeStringToCountedOemString=RtlUpcaseUnicodeStringToCountedOemString@12
825 RtlUpcaseUnicodeStringToOemString=RtlUpcaseUnicodeStringToOemString@12
826 RtlUpcaseUnicodeToCustomCPN=RtlUpcaseUnicodeToCustomCPN@24
827 RtlUpcaseUnicodeToMultiByteN=RtlUpcaseUnicodeToMultiByteN@20
828 RtlUpcaseUnicodeToOemN=RtlUpcaseUnicodeToOemN@20
829 RtlUpperChar=RtlUpperChar@4
830 RtlUpperString=RtlUpperString@8
831 RtlValidSecurityDescriptor=RtlValidSecurityDescriptor@4
832 RtlValidSid=RtlValidSid@4
833 RtlWriteRegistryValue=RtlWriteRegistryValue@24
835 RtlZeroMemory=RtlZeroMemory@8
836 RtlxAnsiStringToUnicodeSize=RtlxAnsiStringToUnicodeSize@4
837 RtlxOemStringToUnicodeSize=RtlxOemStringToUnicodeSize@4
838 RtlxUnicodeStringToAnsiSize=RtlxUnicodeStringToAnsiSize@4
839 RtlxUnicodeStringToOemSize=RtlxUnicodeStringToOemSize@4
840 SeAccessCheck=SeAccessCheck@40
841 ;SeAppendPrivileges=SeAppendPrivileges@8
842 SeAssignSecurity=SeAssignSecurity@28
843 ;SeAuditingFileEvents=SeAuditingFileEvents@8
844 ;SeAuditingFileOrGlobalEvents=SeAuditingFileOrGlobalEvents@18
845 ;SeCaptureSecurityDescriptor=SeCaptureSecurityDescriptor@20
846 SeCaptureSubjectContext=SeCaptureSubjectContext@4
847 ;SeCloseObjectAuditAlarm=SeCloseObjectAuditAlarm@12
848 ;SeCreateAccessState=SeCreateAccessState@16
849 SeCreateClientSecurity=SeCreateClientSecurity@16
850 SeDeassignSecurity=SeDeassignSecurity@4
851 ;SeDeleteAccessState=SeDeleteAccessState@4
852 ;SeDeleteObjectAuditAlarm=SeDeleteObjectAuditAlarm@8
854 ;SeFreePrivileges=SeFreePrivileges@4
855 SeImpersonateClient=SeImpersonateClient@8
856 ;SeLockSubjectContext=SeLockSubjectContext@4
857 ;SeMarkLogonSessionForTerminationNotification=SeMarkLogonSessionForTerminationNotification@4
858 ;SeOpenObjectAuditAlarm=SeOpenObjectAuditAlarm@36
859 ;SeOpenObjectForDeleteAuditAlarm=SeOpenObjectForDeleteAuditAlarm@36
860 SePrivilegeCheck=SePrivilegeCheck@12
861 ;SePrivilegeObjectAuditAlarm=SePrivilegeObjectAuditAlarm@24
862 SePublicDefaultDacl DATA
863 ;SeQueryAuthenticationIdToken=SeQueryAuthenticationIdToken@8
864 ;SeQuerySecurityDescriptorInfo=SeQuerySecurityDescriptorInfo@16
865 ;SeRegisterLogonSessionTerminatedRoutine=SeRegisterLogonSessionTerminatedRoutine@4
866 ;SeReleaseSecurityDescriptor=SeReleaseSecurityDescriptor@12
867 SeReleaseSubjectContext=SeReleaseSubjectContext@4
868 ;SeSetAccessStateGenericMapping=SeSetAccessStateGenericMapping@8
869 ;SeSetSecurityDescriptorInfo=SeSetSecurityDescriptorInfo@24
870 SeSinglePrivilegeCheck=SeSinglePrivilegeCheck@12
871 SeSystemDefaultDacl DATA
872 SeTokenImpersonationLevel=SeTokenImpersonationLevel@4
873 SeTokenType=SeTokenType@4
874 ;SeUnlockSubjectContext=SeUnlockSubjectContext@4
875 ;SeUnregisterLogonSessionTerminatedRoutine=SeUnregisterLogonSessionTerminatedRoutine@4
876 ;SeValidSecurityDescriptor=SeValidSecurityDescriptor@8
877 WRITE_REGISTER_UCHAR=WRITE_REGISTER_UCHAR@8
878 WRITE_REGISTER_ULONG=WRITE_REGISTER_ULONG@8
879 WRITE_REGISTER_USHORT=WRITE_REGISTER_USHORT@8
880 WRITE_REGISTER_BUFFER_UCHAR=WRITE_REGISTER_BUFFER_UCHAR@12
881 WRITE_REGISTER_BUFFER_ULONG=WRITE_REGISTER_BUFFER_ULONG@12
882 WRITE_REGISTER_BUFFER_USHORT=WRITE_REGISTER_BUFFER_USHORT@12
883 ZwAccessCheckAndAuditAlarm=ZwAccessCheckAndAuditAlarm@44
884 ZwAlertThread=ZwAlertThread@4
885 ZwAllocateVirtualMemory=ZwAllocateVirtualMemory@24
886 ZwClearEvent=ZwClearEvent@4
888 ZwCloseObjectAuditAlarm=ZwCloseObjectAuditAlarm@12
889 ZwConnectPort=ZwConnectPort@32
890 ZwCreateDirectoryObject=ZwCreateDirectoryObject@12
891 ZwCreateEvent=ZwCreateEvent@20
892 ZwCreateFile=ZwCreateFile@44
893 ZwCreateKey=ZwCreateKey@28
894 ZwCreateSection=ZwCreateSection@28
895 ZwCreateSymbolicLinkObject=ZwCreateSymbolicLinkObject@16
896 ZwDeleteFile=ZwDeleteFile@4
897 ZwDeleteKey=ZwDeleteKey@4
898 ZwDeleteValueKey=ZwDeleteValueKey@8
899 ZwDeviceIoControlFile=ZwDeviceIoControlFile@40
900 ZwDisplayString=ZwDisplayString@4
901 ZwDuplicateObject=ZwDuplicateObject@28
902 ZwDuplicateToken=ZwDuplicateToken@24
903 ZwEnumerateKey=ZwEnumerateKey@24
904 ZwEnumerateValueKey=ZwEnumerateValueKey@24
905 ZwFlushInstructionCache=ZwFlushInstructionCache@12
906 ZwFlushKey=ZwFlushKey@4
907 ZwFreeVirtualMemory=ZwFreeVirtualMemory@16
908 ZwFsControlFile=ZwFsControlFile@40
909 ZwLoadDriver=ZwLoadDriver@4
910 ZwLoadKey=ZwLoadKey@8
911 ZwMakeTemporaryObject=ZwMakeTemporaryObject@4
912 ZwMapViewOfSection=ZwMapViewOfSection@40
913 ZwNotifyChangeKey=ZwNotifyChangeKey@40
914 ZwOpenDirectoryObject=ZwOpenDirectoryObject@12
915 ZwOpenEvent=ZwOpenEvent@12
916 ZwOpenFile=ZwOpenFile@24
917 ZwOpenKey=ZwOpenKey@12
918 ZwOpenProcess=ZwOpenProcess@16
919 ZwOpenProcessToken=ZwOpenProcessToken@12
920 ZwOpenSection=ZwOpenSection@12
921 ZwOpenSymbolicLinkObject=ZwOpenSymbolicLinkObject@12
922 ZwOpenThread=ZwOpenThread@16
923 ZwOpenThreadToken=ZwOpenThreadToken@16
924 ZwPulseEvent=ZwPulseEvent@8
925 ZwQueryDefaultLocale=ZwQueryDefaultLocale@8
926 ZwQueryDirectoryFile=ZwQueryDirectoryFile@44
927 ZwQueryInformationAtom=ZwQueryInformationAtom@20
928 ZwQueryInformationFile=ZwQueryInformationFile@20
929 ZwQueryInformationProcess=ZwQueryInformationProcess@20
930 ZwQueryInformationToken=ZwQueryInformationToken@20
931 ZwQueryKey=ZwQueryKey@20
932 ZwQueryObject=ZwQueryObject@20
933 ZwQuerySection=ZwQuerySection@20
934 ZwQuerySecurityObject=ZwQuerySecurityObject@20
935 ZwQuerySymbolicLinkObject=ZwQuerySymbolicLinkObject@12
936 ZwQuerySystemInformation=ZwQuerySystemInformation@16
937 ZwQuerySystemTime=ZwQuerySystemTime@4
938 ZwQueryValueKey=ZwQueryValueKey@24
939 ZwQueryVolumeInformationFile=ZwQueryVolumeInformationFile@20
940 ZwReadFile=ZwReadFile@36
941 ZwReplaceKey=ZwReplaceKey@12
942 ZwRequestWaitReplyPort=ZwRequestWaitReplyPort@12
943 ZwResetEvent=ZwResetEvent@8
944 ZwSaveKey=ZwSaveKey@8
945 ZwSetDefaultLocale=ZwSetDefaultLocale@8
946 ZwSetEvent=ZwSetEvent@8
947 ZwSetInformationFile=ZwSetInformationFile@20
948 ZwSetInformationObject=ZwSetInformationObject@16
949 ZwSetInformationProcess=ZwSetInformationProcess@16
950 ZwSetInformationThread=ZwSetInformationThread@16
951 ZwSetSystemInformation=ZwSetSystemInformation@12
952 ZwSetSystemTime=ZwSetSystemTime@8
953 ZwSetValueKey=ZwSetValueKey@24
954 ZwTerminateProcess=ZwTerminateProcess@8
955 ZwUnloadDriver=ZwUnloadDriver@4
956 ZwUnloadKey=ZwUnloadKey@4
957 ZwUnmapViewOfSection=ZwUnmapViewOfSection@8
958 ZwWaitForMultipleObjects=ZwWaitForMultipleObjects@20
959 ZwWaitForSingleObject=ZwWaitForSingleObject@12
960 ZwWriteFile=ZwWriteFile@36
961 ZwYieldExecution=ZwYieldExecution@0
962 _abnormal_termination