2 ExAcquireFastMutexUnsafe
3 ExInterlockedAddLargeStatistic
4 ExInterlockedCompareExchange64
5 ExInterlockedPopEntrySList
6 ExInterlockedPushEntrySList
7 ExReleaseFastMutexUnsafe
10 ExfInterlockedInsertHeadList
11 ExfInterlockedInsertTailList
12 ExfInterlockedPopEntryList
13 ExfInterlockedPushEntryList
14 ExfInterlockedRemoveHeadList
15 Exfi386InterlockedDecrementLong
16 Exfi386InterlockedExchangeUlong
17 Exfi386InterlockedIncrementLong
18 InterlockedCompareExchange
21 InterlockedExchangeAdd
25 KeSetSwapContextNotifyRoutine
26 KeSetThreadSelectNotifyRoutine
27 KeSetTimeUpdateNotifyRoutine
28 KefAcquireSpinLockAtDpcLevel
29 KefReleaseSpinLockFromDpcLevel
47 CcGetFileObjectFromBcb
48 CcGetFileObjectFromSectionPtrs
63 CcSetAdditionalCacheAttributes
65 CcSetDirtyPageThreshold
69 CcSetReadAheadGranularity
70 CcUninitializeCacheMap
76 DbgBreakPointWithStatus
80 ExAcquireResourceExclusive
81 ExAcquireResourceExclusiveLite
82 ExAcquireResourceSharedLite
83 ExAcquireSharedStarveExclusive
84 ExAcquireSharedWaitForExclusive
85 ExAllocateFromPagedLookasideList
87 ExAllocatePoolWithQuota
88 ExAllocatePoolWithQuotaTag
90 ExConvertExclusiveToSharedLite
92 ExDeleteNPagedLookasideList
93 ExDeletePagedLookasideList
97 ExDisableResourceBoostLite
102 ExFreeToPagedLookasideList
103 ExGetExclusiveWaiterCount
105 ExGetSharedWaiterCount
106 ExInitializeNPagedLookasideList
107 ExInitializePagedLookasideList
109 ExInitializeResourceLite
111 ExInterlockedAddLargeInteger
112 ExInterlockedAddUlong
113 ExInterlockedDecrementLong
114 ExInterlockedExchangeUlong
115 ExInterlockedExtendZone
116 ExInterlockedIncrementLong
117 ExInterlockedInsertHeadList
118 ExInterlockedInsertTailList
119 ExInterlockedPopEntryList
120 ExInterlockedPushEntryList
121 ExInterlockedRemoveHeadList
122 ExIsProcessorFeaturePresent
123 ExIsResourceAcquiredExclusiveLite
124 ExIsResourceAcquiredSharedLite
125 ExLocalTimeToSystemTime
130 ExRaiseAccessViolation
131 ExRaiseDatatypeMisalignment
136 ExReinitializeResourceLite
137 ExReleaseResourceForThread
138 ExReleaseResourceForThreadLite
139 ExSetResourceOwnerPointer
140 ExSystemExceptionFilter
141 ExSystemTimeToLocalTime
143 ExWindowStationObjectType
144 Exi386InterlockedDecrementLong
145 Exi386InterlockedExchangeUlong
146 Exi386InterlockedIncrementLong
147 FsRtlAddLargeMcbEntry
149 FsRtlAddToTunnelCache
151 FsRtlAllocatePoolWithQuota
152 FsRtlAllocatePoolWithQuotaTag
153 FsRtlAllocatePoolWithTag
154 FsRtlAllocateResource
157 FsRtlCheckLockForReadAccess
158 FsRtlCheckLockForWriteAccess
162 FsRtlCurrentBatchOplock
163 FsRtlDeleteKeyFromTunnelCache
164 FsRtlDeleteTunnelCache
165 FsRtlDeregisterUncProvider
168 FsRtlDoesDbcsContainWildCards
169 FsRtlDoesNameContainWildCards
170 FsRtlFastCheckLockForRead
171 FsRtlFastCheckLockForWrite
173 FsRtlFastUnlockAllByKey
174 FsRtlFastUnlockSingle
175 FsRtlFindInTunnelCache
178 FsRtlGetNextLargeMcbEntry
180 FsRtlInitializeFileLock
181 FsRtlInitializeLargeMcb
183 FsRtlInitializeOplock
184 FsRtlInitializeTunnelCache
185 FsRtlIsDbcsInExpression
188 FsRtlIsNameInExpression
189 FsRtlIsNtstatusExpected
190 FsRtlIsTotalDeviceFailure
191 FsRtlLegalAnsiCharacterArray
192 FsRtlLookupLargeMcbEntry
193 FsRtlLookupLastLargeMcbEntry
194 FsRtlLookupLastMcbEntry
198 FsRtlMdlReadCompleteDev
200 FsRtlMdlWriteComplete
201 FsRtlMdlWriteCompleteDev
202 FsRtlNormalizeNtstatus
203 FsRtlNotifyChangeDirectory
205 FsRtlNotifyFullChangeDirectory
206 FsRtlNotifyFullReportChange
207 FsRtlNotifyInitializeSync
208 FsRtlNotifyReportChange
209 FsRtlNotifyUninitializeSync
210 FsRtlNumberOfRunsInLargeMcb
211 FsRtlNumberOfRunsInMcb
213 FsRtlOplockIsFastIoPossible
214 FsRtlPostPagingFileStackOverflow
215 FsRtlPostStackOverflow
217 FsRtlPrepareMdlWriteDev
220 FsRtlRegisterUncProvider
221 FsRtlRemoveLargeMcbEntry
225 FsRtlTruncateLargeMcb
227 FsRtlUninitializeFileLock
228 FsRtlUninitializeLargeMcb
230 FsRtlUninitializeOplock
232 HalPrivateDispatchTable
233 IoAcquireCancelSpinLock
236 IoAllocateAdapterChannel
238 IoAllocateErrorLogEntry
243 IoAttachDeviceByPointer
244 IoAttachDeviceToDeviceStack
245 IoBuildAsynchronousFsdRequest
246 IoBuildDeviceIoControlRequest
248 IoBuildSynchronousFsdRequest
252 IoCheckEaBufferValidity
253 IoCheckFunctionAccess
260 IoCreateNotificationEvent
261 IoCreateStreamFileObject
263 IoCreateSynchronizationEvent
264 IoCreateUnprotectedSymbolicLink
269 IoDeviceHandlerObjectSize
270 IoDeviceHandlerObjectType
272 IoDisconnectInterrupt
275 IoFastQueryNetworkAttributes
281 IoGetBaseFileSystemDeviceObject
282 IoGetConfigurationInformation
284 IoGetDeviceObjectPointer
286 IoGetFileObjectGenericMapping
288 IoGetRelatedDeviceObject
289 IoGetRequestorProcess
294 IoIsOperationSynchronous
297 IoOpenDeviceInstanceKey
299 IoQueryDeviceDescription
300 IoQueryDeviceEnumInfo
301 IoQueryFileInformation
302 IoQueryVolumeInformation
305 IoRaiseInformationalHardError
308 IoRegisterDriverReinitialization
310 IoRegisterFsRegistrationChange
311 IoRegisterShutdownNotification
312 IoReleaseCancelSpinLock
315 IoReportHalResourceUsage
316 IoReportResourceUsage
318 IoSetHardErrorOrVerifyDevice
321 IoSetThreadHardErrorMode
324 IoStartNextPacketByKey
329 IoSynchronousPageWrite
331 IoUnregisterFileSystem
332 IoUnregisterFsRegistrationChange
333 IoUnregisterShutdownNotification
337 IoWriteOperationCount
343 Ke386IoSetAccessProcess
344 Ke386QueryIoAccessMap
346 KeAcquireSpinLockAtDpcLevel
347 KeAddSystemServiceTable
356 KeDelayExecutionThread
357 KeDeregisterBugCheckCallback
359 KeDisconnectInterrupt
360 KeEnterCriticalRegion
361 KeEnterKernelDebugger
362 KeFindConfigurationEntry
363 KeFindConfigurationNextEntry
368 KeI386AllocateGdtSelectors
369 KeI386Call16BitCStyleFunction
370 KeI386Call16BitFunction
371 KeI386FlatToGdtSelector
374 KeI386ReleaseGdtSelectors
379 KeInitializeDeviceQueue
382 KeInitializeInterrupt
386 KeInitializeSemaphore
390 KeInsertByKeyDeviceQueue
397 KeLeaveCriticalRegion
401 KeProfileInterruptWithSource
413 KeRegisterBugCheckCallback
417 KeReleaseSpinLockFromDpcLevel
418 KeRemoveByKeyDeviceQueue
420 KeRemoveEntryDeviceQueue
424 KeRestoreFloatingPointState
426 KeSaveFloatingPointState
427 KeServiceDescriptorTable
429 KeSetBasePriorityThread
432 KeSetEventBoostPriority
433 KeSetIdealProcessorThread
435 KeSetKernelStackSwapEnable
438 KeSetTargetProcessorDpc
442 KeSynchronizeExecution
448 KeWaitForMultipleObjects
450 KeWaitForSingleObject
456 KiUnexpectedInterrupt
459 LdrFindResourceDirectory_U
462 LsaCallAuthenticationPackage
463 LsaDeregisterLogonProcess
466 LsaLookupAuthenticationPackage
467 LsaRegisterLogonProcess
468 MmAdjustWorkingSetSize
469 MmAllocateContiguousMemory
470 MmAllocateNonCachedMemory
471 MmBuildMdlForNonPagedPool
475 MmDbgTranslatePhysicalAddress
476 MmDisableModifiedWriteOfSection
479 MmFreeContiguousMemory
480 MmFreeNonCachedMemory
484 MmIsNonPagedSystemAddressValid
487 MmLockPagableDataSection
488 MmLockPagableImageSection
489 MmLockPagableSectionByHandle
494 MmMapViewInSystemSpace
501 MmSecureVirtualMemory
502 MmSetAddressRangeModified
505 MmUnlockPagableImageSection
510 MmUnmapViewInSystemSpace
512 MmUnsecureVirtualMemory
519 NtAdjustPrivilegesToken
520 NtAllocateLocallyUniqueId
522 NtAllocateVirtualMemory
531 NtDeviceIoControlFile
540 NtNotifyChangeDirectoryFile
546 NtQueryInformationAtom
547 NtQueryInformationFile
548 NtQueryInformationProcess
549 NtQueryInformationToken
550 NtQueryOleDirectoryFile
551 NtQuerySecurityObject
552 NtQueryVolumeInformationFile
555 NtRequestWaitReplyPort
558 NtSetInformationProcess
559 NtSetInformationThread
563 NtWaitForSingleObject
566 ObCheckCreateObjectAccess
570 ObFindHandleForObject
571 ObGetObjectPointerCount
574 ObMakeTemporaryObject
576 ObOpenObjectByPointer
578 ObQueryObjectAuditingByHandle
579 ObReferenceObjectByHandle
580 ObReferenceObjectByName
581 ObReferenceObjectByPointer
582 ObReleaseObjectSecurity
583 ObSetSecurityDescriptorInfo
590 PoSetDeviceIdleDetection
592 PsAssignImpersonationToken
594 PsCreateSystemProcess
597 PsEstablishWin32Callouts
598 PsGetCurrentProcessId
603 PsInitialSystemProcess
604 PsIsThreadTerminating
605 PsLookupProcessByProcessId
606 PsLookupProcessThreadByCid
607 PsLookupThreadByThreadId
609 PsReferenceImpersonationToken
610 PsReferencePrimaryToken
613 PsSetCreateProcessNotifyRoutine
614 PsSetCreateThreadNotifyRoutine
615 PsSetLegoNotifyRoutine
616 PsSetProcessPriorityByClass
617 PsTerminateSystemThread
619 READ_REGISTER_BUFFER_UCHAR
620 READ_REGISTER_BUFFER_ULONG
621 READ_REGISTER_BUFFER_USHORT
625 RtlAbsoluteToSelfRelativeSD
626 RtlAddAccessAllowedAce
628 RtlAddAtomToAtomTable
629 RtlAllocateAndInitializeSid
631 RtlAnsiCharToUnicodeChar
632 RtlAnsiStringToUnicodeSize
633 RtlAnsiStringToUnicodeString
634 RtlAppendAsciizToString
635 RtlAppendStringToString
636 RtlAppendUnicodeStringToString
637 RtlAppendUnicodeToString
638 RtlAreAllAccessesGranted
639 RtlAreAnyAccessesGranted
643 RtlCaptureStackBackTrace
649 RtlCompareMemoryUlong
651 RtlCompareUnicodeString
654 RtlConvertLongToLargeInteger
655 RtlConvertSidToUnicodeString
656 RtlConvertUlongToLargeInteger
665 RtlCreateSecurityDescriptor
666 RtlCreateUnicodeString
667 RtlCustomCPToUnicodeN
670 RtlDecompressFragment
672 RtlDeleteAtomFromAtomTable
673 RtlDeleteElementGenericTable
675 RtlDeleteRegistryValue
679 RtlDowncaseUnicodeString
681 RtlEnlargedIntegerMultiply
682 RtlEnlargedUnsignedDivide
683 RtlEnlargedUnsignedMultiply
684 RtlEnumerateGenericTable
685 RtlEnumerateGenericTableWithoutSplaying
689 RtlEqualUnicodeString
690 RtlExtendedIntegerMultiply
691 RtlExtendedLargeIntegerDivide
692 RtlExtendedMagicDivide
696 RtlFindClearBitsAndSet
699 RtlFindLongestRunClear
703 RtlFindSetBitsAndClear
705 RtlFormatCurrentUserKeyPath
712 RtlGetCompressionWorkSpaceSize
713 RtlGetDaclSecurityDescriptor
714 RtlGetDefaultCodePage
715 RtlGetElementGenericTable
716 RtlGetGroupSecurityDescriptor
717 RtlGetOwnerSecurityDescriptor
724 RtlInitializeGenericTable
726 RtlInitializeUnicodePrefix
727 RtlInsertElementGenericTable
728 RtlInsertUnicodePrefix
730 RtlIntegerToUnicodeString
731 RtlIsNameLegalDOS8Dot3
733 RtlLargeIntegerArithmeticShift
734 RtlLargeIntegerDivide
735 RtlLargeIntegerNegate
736 RtlLargeIntegerShiftLeft
737 RtlLargeIntegerShiftRight
738 RtlLargeIntegerSubtract
740 RtlLengthSecurityDescriptor
742 RtlLookupAtomInAtomTable
743 RtlLookupElementGenericTable
746 RtlMultiByteToUnicodeN
747 RtlMultiByteToUnicodeSize
749 RtlNtStatusToDosError
750 RtlNtStatusToDosErrorNoTeb
751 RtlNumberGenericTableElements
754 RtlOemStringToCountedUnicodeString
755 RtlOemStringToUnicodeSize
756 RtlOemStringToUnicodeString
758 RtlPinAtomInAtomTable
760 RtlPrefixUnicodeString
761 RtlQueryAtomInAtomTable
762 RtlQueryRegistryValues
763 RtlQueryTimeZoneInformation
766 RtlRemoveUnicodePrefix
768 RtlSecondsSince1970ToTime
769 RtlSecondsSince1980ToTime
772 RtlSetDaclSecurityDescriptor
773 RtlSetGroupSecurityDescriptor
774 RtlSetOwnerSecurityDescriptor
775 RtlSetSaclSecurityDescriptor
776 RtlSetTimeZoneInformation
778 RtlSubAuthorityCountSid
781 RtlTimeToSecondsSince1970
782 RtlTimeToSecondsSince1980
784 RtlUnicodeStringToAnsiSize
785 RtlUnicodeStringToAnsiString
786 RtlUnicodeStringToCountedOemString
787 RtlUnicodeStringToInteger
788 RtlUnicodeStringToOemSize
789 RtlUnicodeStringToOemString
790 RtlUnicodeToCustomCPN
791 RtlUnicodeToMultiByteN
792 RtlUnicodeToMultiByteSize
796 RtlUpcaseUnicodeString
797 RtlUpcaseUnicodeStringToAnsiString
798 RtlUpcaseUnicodeStringToCountedOemString
799 RtlUpcaseUnicodeStringToOemString
800 RtlUpcaseUnicodeToCustomCPN
801 RtlUpcaseUnicodeToMultiByteN
802 RtlUpcaseUnicodeToOemN
805 RtlValidSecurityDescriptor
807 RtlWriteRegistryValue
810 RtlxAnsiStringToUnicodeSize
811 RtlxOemStringToUnicodeSize
812 RtlxUnicodeStringToAnsiSize
813 RtlxUnicodeStringToOemSize
818 SeAuditingFileOrGlobalEvents
819 SeCaptureSecurityDescriptor
820 SeCaptureSubjectContext
821 SeCloseObjectAuditAlarm
823 SeCreateClientSecurity
826 SeDeleteObjectAuditAlarm
831 sionForTerminationNotification
832 SeOpenObjectAuditAlarm
833 SeOpenObjectForDeleteAuditAlarm
835 SePrivilegeObjectAuditAlarm
837 SeQueryAuthenticationIdToken
838 SeQuerySecurityDescriptorInfo
839 SeRegisterLogonSessionTerminatedRoutine
840 SeReleaseSecurityDescriptor
841 SeReleaseSubjectContext
842 SeSetAccessStateGenericMapping
843 SeSetSecurityDescriptorInfo
844 SeSinglePrivilegeCheck
846 SeTokenImpersonationLevel
848 SeUnlockSubjectContext
849 SeUnregisterLogonSessionTerminatedRoutine
850 SeValidSecurityDescriptor
851 WRITE_REGISTER_BUFFER_UCHAR
852 WRITE_REGISTER_BUFFER_ULONG
853 WRITE_REGISTER_BUFFER_USHORT
856 WRITE_REGISTER_USHORT
857 ZwAccessCheckAndAuditAlarm
859 ZwAllocateVirtualMemory
862 ZwCloseObjectAuditAlarm
864 ZwCreateDirectoryObject
869 ZwCreateSymbolicLinkObject
873 ZwDeviceIoControlFile
879 ZwFlushInstructionCache
885 ZwMakeTemporaryObject
888 ZwOpenDirectoryObject
895 ZwOpenSymbolicLinkObject
901 ZwQueryInformationFile
902 ZwQueryInformationProcess
903 ZwQueryInformationToken
907 ZwQuerySecurityObject
908 ZwQuerySymbolicLinkObject
909 ZwQuerySystemInformation
911 ZwQueryVolumeInformationFile
914 ZwRequestWaitReplyPort
920 ZwSetInformationObject
921 ZwSetInformationProcess
922 ZwSetInformationThread
923 ZwSetSystemInformation
930 ZwWaitForMultipleObjects
931 ZwWaitForSingleObject
934 _abnormal_termination
1014 KeRaiseIrqlToDpcLevel
1017 ExTryToAcquireFastMutex
1018 HalRequestSoftwareInterrupt
1021 HalQueryRealTimeClock
1025 KeQueryPerformanceCounter
1026 HalGetEnvironmentVariable
1027 HalSetEnvironmentVariable
1030 HalReportResourceUsage
1031 HalAllProcessorsStarted
1032 HalAllocateAdapterChannel
1033 HalGetInterruptVector
1034 HalTranslateBusAddress
1035 HalAdjustResourceList
1036 IoAssignDriveLetters
1037 IoReadPartitionTable
1038 HalAllocateCommonBuffer
1051 HalInitializeProcessor
1053 HalClearSoftwareInterrupt
1054 KeRaiseIrqlToSynchLevel
1056 HalBeginSystemInterrupt
1057 HalEndSystemInterrupt
1058 HalEnableSystemInterrupt
1059 HalDisableSystemInterrupt
1060 HalSystemVectorDispatchEntry
1063 HalSetProfileInterval
1064 HalStartProfileInterrupt
1065 HalStopProfileInterrupt
1066 HalQueryDisplayParameters
1070 KeStallExecutionProcessor