@ stdcall -arch=i386 KiFastSystemCall()
@ stdcall -arch=i386 KiFastSystemCallRet()
@ stdcall -arch=i386 KiIntSystemCall()
-@ stdcall -arch=i386 ExpInterlockedPopEntrySListEnd()
-@ stdcall -arch=i386 ExpInterlockedPopEntrySListFault()
-@ stdcall -arch=i386 ExpInterlockedPopEntrySListResume()
+@ stdcall -arch=i386,x86_64 ExpInterlockedPopEntrySListEnd()
+@ stdcall -arch=i386,x86_64 ExpInterlockedPopEntrySListFault()
+@ stdcall -arch=i386,x86_64 ExpInterlockedPopEntrySListResume()
@ stdcall KiRaiseUserExceptionDispatcher()
@ stdcall KiUserApcDispatcher(ptr ptr ptr ptr)
@ stdcall KiUserCallbackDispatcher(ptr ptr long) ; CHECKME
;@ stdcall LdrDestroyOutOfProcessImage
@ stdcall LdrDisableThreadCalloutsForDll(long)
@ stdcall LdrEnumResources(ptr ptr long ptr ptr)
-;@ stdcall LdrEnumerateLoadedModules
+@ stdcall LdrEnumerateLoadedModules(long ptr long)
;@ stdcall LdrFindCreateProcessManifest ; 5.1 and 5.2 only
@ stdcall LdrFindEntryForAddress(ptr ptr)
@ stdcall LdrFindResourceDirectory_U(long ptr long ptr)
@ stdcall LdrFindResource_U(long ptr long ptr)
;@ stdcall LdrFlushAlternateResourceModules
@ stdcall LdrGetDllHandle(wstr long ptr ptr)
-;@ stdcall LdrGetDllHandleEx
+@ stdcall LdrGetDllHandleEx(long wstr long ptr ptr)
@ stdcall LdrGetProcedureAddress(ptr ptr long ptr)
;@ stdcall LdrHotPatchRoutine
;@ stdcall LdrInitShimEngineDynamic
@ stdcall LdrInitializeThunk(long long long long)
-;@ stdcall LdrLoadAlternateResourceModule
+@ stdcall LdrLoadAlternateResourceModule(ptr ptr)
@ stdcall LdrLoadDll(wstr long ptr ptr)
@ stdcall LdrLockLoaderLock(long ptr ptr)
;@ stdcall LdrOpenImageFileOptionsKey ; 5.2 SP1 and higher
;@ stdcall RtlAbortRXact
@ stdcall RtlAbsoluteToSelfRelativeSD(ptr ptr ptr)
@ stdcall RtlAcquirePebLock()
+@ stdcall RtlAcquirePrivilege(ptr long long ptr)
@ stdcall RtlAcquireResourceExclusive(ptr long)
@ stdcall RtlAcquireResourceShared(ptr long)
@ stdcall RtlAcquireSRWLockExclusive(ptr)
@ stdcall RtlAcquireSRWLockShared(ptr)
@ stdcall RtlActivateActivationContext(long ptr ptr)
-;@ stdcall RtlActivateActivationContextEx
-@ stdcall RtlActivateActivationContextUnsafeFast(ptr ptr)
+@ stdcall RtlActivateActivationContextEx(long ptr ptr ptr)
+@ fastcall RtlActivateActivationContextUnsafeFast(ptr ptr)
@ stdcall RtlAddAccessAllowedAce(ptr long long ptr)
@ stdcall RtlAddAccessAllowedAceEx(ptr long long long ptr)
@ stdcall RtlAddAccessAllowedObjectAce(ptr long long long ptr ptr ptr)
;@ stdcall RtlAddCompoundAce
;@ stdcall RtlAddRange ; 5.0 and 5.1 only
@ stdcall -arch=x86_64 RtlAddFunctionTable(ptr long long)
-@ stdcall RtlAddMandatoryAce(ptr long long long long ptr)
+;@ stdcall RtlAddMandatoryAce(ptr long long long long ptr)
@ stdcall RtlAddRefActivationContext(ptr)
;@ stdcall RtlAddRefMemoryStream
@ stdcall RtlAddVectoredContinueHandler(long ptr)
@ stdcall RtlAddVectoredExceptionHandler(long ptr)
;@ stdcall RtlAddressInSectionTable
@ stdcall RtlAdjustPrivilege(long long long ptr)
-@ stdcall RtlAllocateActivationContextStack(ptr) ; CHEKME
+@ stdcall RtlAllocateActivationContextStack(ptr) ; CHECKME
@ stdcall RtlAllocateAndInitializeSid(ptr long long long long long long long long long ptr)
@ stdcall RtlAllocateHandle(ptr ptr)
@ stdcall RtlAllocateHeap(ptr long ptr)
@ stdcall RtlCompareUnicodeString (ptr ptr long)
@ stdcall RtlCompressBuffer(long ptr long ptr long long ptr ptr)
@ stdcall RtlComputeCrc32(long ptr long)
-;@ stdcall RtlComputeImportTableHash
+@ stdcall RtlComputeImportTableHash(ptr ptr long)
;@ stdcall RtlComputePrivatizedDllName_U
;@ stdcall RtlConsoleMultiByteToUnicodeN
@ stdcall RtlConvertExclusiveToShared(ptr)
;@ stdcall RtlConvertPropertyToVariant
@ stdcall RtlConvertSharedToExclusive(ptr)
@ stdcall RtlConvertSidToUnicodeString(ptr ptr long)
-;@ stdcall RtlConvertToAutoInheritSecurityObject
+@ stdcall RtlConvertToAutoInheritSecurityObject(ptr ptr ptr ptr long ptr)
;@ stdcall RtlConvertUiListToApiList
@ stdcall -arch=win32 -ret64 RtlConvertUlongToLargeInteger(long)
;@ stdcall RtlConvertVariantToProperty
@ stdcall RtlCopyUnicodeString(ptr ptr)
@ stdcall RtlCreateAcl(ptr long long)
@ stdcall RtlCreateActivationContext(ptr ptr)
-;@ stdcall RtlCreateAndSetSD
+@ stdcall RtlCreateAndSetSD(ptr long ptr ptr ptr)
@ stdcall RtlCreateAtomTable(long ptr)
@ stdcall RtlCreateBootStatusDataFile()
@ stdcall RtlCreateEnvironment(long ptr)
@ stdcall RtlCreateUnicodeString(ptr wstr)
@ stdcall RtlCreateUnicodeStringFromAsciiz(ptr str)
@ stdcall RtlCreateUserProcess(ptr long ptr ptr ptr ptr long ptr ptr ptr)
-;@ stdcall RtlCreateUserSecurityObject
+@ stdcall RtlCreateUserSecurityObject(ptr long ptr ptr long ptr ptr)
@ stdcall RtlCreateUserThread(long ptr long ptr long long ptr ptr ptr ptr)
@ stdcall RtlCustomCPToUnicodeN(ptr wstr long ptr str long)
@ stdcall RtlCutoverTimeToSystemTime(ptr ptr ptr long)
@ stdcall RtlDeNormalizeProcessParams(ptr)
@ stdcall RtlDeactivateActivationContext(long long)
-@ stdcall RtlDeactivateActivationContextUnsafeFast(ptr)
+@ fastcall RtlDeactivateActivationContextUnsafeFast(ptr)
;@ stdcall RtlDebugPrintTimes
@ stdcall RtlDecodePointer(ptr)
@ stdcall RtlDecodeSystemPointer(ptr) RtlEncodeSystemPointer
@ stdcall RtlDllShutdownInProgress()
@ stdcall RtlDnsHostNameToComputerName(ptr ptr long)
@ stdcall RtlDoesFileExists_U(wstr)
-;@ stdcall RtlDosApplyFileIsolationRedirection_Ustr
+@ stdcall RtlDosApplyFileIsolationRedirection_Ustr(long ptr ptr ptr ptr ptr ptr ptr ptr)
@ stdcall RtlDosPathNameToNtPathName_U(wstr ptr ptr ptr)
;@ stdcall RtlDosPathNameToNtPathName_U_WithStatus ; 5.2 SP1, and higher
@ stdcall RtlDosPathNameToRelativeNtPathName_U(ptr ptr ptr ptr) ; CHECKME
;@ stdcall RtlDosPathNameToRelativeNtPathName_U_WithStatus
@ stdcall RtlDosSearchPath_U(wstr wstr wstr long ptr ptr)
-;@ stdcall RtlDosSearchPath_Ustr
+@ stdcall RtlDosSearchPath_Ustr(long ptr ptr ptr ptr ptr ptr ptr ptr)
@ stdcall RtlDowncaseUnicodeChar(long)
@ stdcall RtlDowncaseUnicodeString(ptr ptr long)
@ stdcall RtlDumpResource(ptr)
@ stdcall RtlFormatCurrentUserKeyPath(ptr)
@ stdcall RtlFormatMessage(ptr long long long long ptr ptr long)
;@ stdcall RtlFormatMessageEx
-;@ stdcall RtlFreeActivationContextStack
+@ stdcall RtlFreeActivationContextStack(ptr)
@ stdcall RtlFreeAnsiString(long)
@ stdcall RtlFreeHandle(ptr ptr)
@ stdcall RtlFreeHeap(long long long)
@ stdcall RtlGetFirstRange(ptr ptr ptr)
;@ stdcall RtlGetFrame
@ stdcall RtlGetFullPathName_U(wstr long ptr ptr)
-;@ stdcall RtlGetFullPathName_UstrEx
+@ stdcall RtlGetFullPathName_UstrEx(ptr ptr ptr ptr ptr ptr ptr ptr)
@ stdcall RtlGetGroupSecurityDescriptor(ptr ptr ptr)
@ stdcall RtlGetLastNtStatus()
@ stdcall RtlGetLastWin32Error()
@ stdcall RtlGetSaclSecurityDescriptor(ptr ptr ptr ptr)
@ stdcall RtlGetSecurityDescriptorRMControl(ptr ptr)
@ stdcall RtlGetSetBootStatusData(ptr long long ptr long long)
-;@ stdcall RtlGetThreadErrorMode
+@ stdcall RtlGetThreadErrorMode()
;@ stdcall RtlGetUnloadEventTrace
@ stdcall RtlGetUserInfoHeap(ptr long ptr ptr ptr)
@ stdcall RtlGetVersion(ptr)
@ stdcall RtlIdentifierAuthoritySid(ptr)
@ stdcall RtlImageDirectoryEntryToData(long long long ptr)
@ stdcall RtlImageNtHeader(long)
-;@ stdcall RtlImageNtHeaderEx
+@ stdcall RtlImageNtHeaderEx(long ptr double ptr)
@ stdcall RtlImageRvaToSection(ptr long long)
@ stdcall RtlImageRvaToVa(ptr long long ptr)
@ stdcall RtlImpersonateSelf(long)
;@ stdcall RtlInitializeStackTraceDataBase ; 5.1 SP2 and SP3, and 5.2 only
@ stdcall RtlInsertElementGenericTable(ptr ptr long ptr)
@ stdcall RtlInsertElementGenericTableAvl(ptr ptr long ptr)
+@ stdcall -arch=x86_64 RtlInstallFunctionTableCallback(double double long ptr ptr ptr)
@ stdcall RtlInt64ToUnicodeString(double long ptr)
@ stdcall RtlIntegerToChar(long long long ptr)
@ stdcall RtlIntegerToUnicodeString(long long ptr)
-;@ stdcall RtlInterlockedCompareExchange64
+@ stdcall -arch=win32 -ret64 RtlInterlockedCompareExchange64(ptr double double)
@ stdcall -arch=i386,x86_64 RtlInterlockedFlushSList(ptr)
@ stdcall -arch=i386,x86_64 RtlInterlockedPopEntrySList(ptr)
@ stdcall -arch=i386,x86_64 RtlInterlockedPushEntrySList(ptr ptr)
;@ stdcall RtlMultiAppendUnicodeStringBuffer
@ stdcall RtlMultiByteToUnicodeN(ptr long ptr ptr long)
@ stdcall RtlMultiByteToUnicodeSize(ptr str long)
-;@ stdcall RtlNewInstanceSecurityObject
-;@ stdcall RtlNewSecurityGrantedAccess
+@ stdcall RtlNewInstanceSecurityObject(long long ptr ptr ptr ptr ptr long ptr ptr)
+@ stdcall RtlNewSecurityGrantedAccess(long ptr ptr ptr ptr ptr)
@ stdcall RtlNewSecurityObject(ptr ptr ptr long ptr ptr)
-;@ stdcall RtlNewSecurityObjectEx
-;@ stdcall RtlNewSecurityObjectWithMultipleInheritance
+@ stdcall RtlNewSecurityObjectEx(ptr ptr ptr ptr long long ptr ptr)
+@ stdcall RtlNewSecurityObjectWithMultipleInheritance(ptr ptr ptr ptr long long long ptr ptr)
@ stdcall RtlNormalizeProcessParams(ptr)
@ stdcall RtlNtPathNameToDosPathName(ptr ptr ptr ptr) ; CHECKME
@ stdcall RtlNtStatusToDosError(long)
@ stdcall RtlReleaseActivationContext(ptr)
;@ stdcall RtlReleaseMemoryStream
@ stdcall RtlReleasePebLock()
+@ stdcall RtlReleasePrivilege(ptr)
+@ stdcall RtlReleaseRelativeName(ptr)
@ stdcall RtlReleaseResource(ptr)
@ stdcall RtlReleaseSRWLockExclusive(ptr)
@ stdcall RtlReleaseSRWLockShared(ptr)
@ stdcall RtlRemoveVectoredContinueHandler(ptr)
@ stdcall RtlRemoveVectoredExceptionHandler(ptr)
@ stdcall RtlResetRtlTranslations(ptr)
+@ stdcall -arch=x86_64 RtlRestoreContext(ptr ptr)
@ stdcall RtlRestoreLastWin32Error(long) RtlSetLastWin32Error
;@ stdcall RtlRevertMemoryStream
@ stdcall RtlRunDecodeUnicodeString(long ptr)
@ stdcall RtlSetSaclSecurityDescriptor(ptr long ptr long)
@ stdcall RtlSetSecurityDescriptorRMControl(ptr ptr)
@ stdcall RtlSetSecurityObject(long ptr ptr ptr ptr)
-;@ stdcall RtlSetSecurityObjectEx
-;@ stdcall RtlSetThreadErrorMode
-;@ stdcall RtlSetThreadIsCritical
-;@ stdcall RtlSetThreadPoolStartFunc
+@ stdcall RtlSetSecurityObjectEx(long ptr ptr long ptr ptr)
+@ stdcall RtlSetThreadErrorMode(long ptr)
+@ stdcall RtlSetThreadIsCritical(long ptr long)
+@ stdcall RtlSetThreadPoolStartFunc(ptr ptr)
@ stdcall RtlSetTimeZoneInformation(ptr)
;@ stdcall RtlSetTimer
@ stdcall RtlSetUnhandledExceptionFilter(ptr)
@ stdcall -arch=x86_64 RtlVirtualUnwind(long long long ptr ptr ptr ptr ptr)
@ stdcall RtlWalkFrameChain(ptr long long)
@ stdcall RtlWalkHeap(long ptr)
-;@ stdcall RtlWow64EnableFsRedirection(long)
-;@ stdcall RtlWow64EnableFsRedirectionEx(long ptr)
+@ stdcall RtlWow64EnableFsRedirection(long)
+@ stdcall RtlWow64EnableFsRedirectionEx(long ptr)
@ stdcall RtlWakeAllConditionVariable(ptr)
@ stdcall RtlWakeConditionVariable(ptr)
;@ stdcall RtlWriteMemoryStream
@ stdcall ZwWriteRequestData(ptr ptr long ptr long ptr)
@ stdcall ZwWriteVirtualMemory(long ptr ptr long ptr)
@ stdcall ZwYieldExecution()
-;@ cdecl _CIcos
-;@ cdecl _CIlog
-;@ cdecl -private -arch=i386 _CIpow()
-;@ cdecl _CIsin
-;@ cdecl _CIsqrt
-;@ stdcall -arch=x86_64 __C_specific_handler(ptr long ptr ptr)
+@ cdecl -arch=i386 _CIcos()
+@ cdecl -arch=i386 _CIlog()
+@ cdecl -arch=i386 _CIpow()
+@ cdecl -arch=i386 _CIsin()
+@ cdecl -arch=i386 _CIsqrt()
+@ cdecl -arch=x86_64 __C_specific_handler(ptr long ptr ptr)
@ cdecl __isascii(long)
@ cdecl __iscsym(long)
@ cdecl __iscsymf(long)
@ cdecl -arch=i386 _aulldvrm()
@ cdecl -arch=i386 -ret64 _aullrem(double double)
@ cdecl -arch=i386 _aullshr()
-@ cdecl -arch=i386 -norelay _chkstk()
+@ extern -arch=i386 _chkstk
@ cdecl -arch=i386,x86_64 _fltused()
@ cdecl -arch=i386 -ret64 _ftol()
@ cdecl _i64toa(double ptr long)
@ cdecl _itoa(long ptr long)
@ cdecl _itow(long ptr long)
@ cdecl _lfind(ptr ptr ptr long ptr)
+@ cdecl -arch=x86_64 _local_unwind()
@ cdecl _ltoa(long ptr long)
@ cdecl _ltow(long ptr long)
@ cdecl _memccpy(ptr ptr long long)
@ cdecl _ui64tow(double ptr long)
@ cdecl _ultoa(long ptr long)
@ cdecl _ultow(long ptr long)
-;@ cdecl _vscwprintf
+@ cdecl _vscwprintf(wstr ptr)
@ cdecl _vsnprintf(ptr long str ptr)
@ cdecl _vsnwprintf(ptr long wstr ptr)
@ cdecl _wcsicmp(wstr wstr)