@ fastcall -arch=i386 Exfi386InterlockedExchangeUlong(ptr long)
@ fastcall -arch=i386 Exfi386InterlockedIncrementLong(ptr)
@ stdcall -arch=i386 Exi386InterlockedDecrementLong(ptr)
-@ stdcall -arch=i386 Exi386InterlockedExchangeUlong(ptr long long)
+@ stdcall -arch=i386 Exi386InterlockedExchangeUlong(ptr long)
@ stdcall -arch=i386 Exi386InterlockedIncrementLong(ptr)
@ fastcall -arch=i386 ExiAcquireFastMutex(ptr) ExAcquireFastMutex
@ fastcall -arch=i386 ExiReleaseFastMutex(ptr) ExReleaseFastMutex
@ fastcall -arch=i386 ExiTryToAcquireFastMutex(ptr) ExTryToAcquireFastMutex
@ stdcall FsRtlAcquireFileExclusive(ptr)
-;FsRtlAddBaseMcbEntry
+@ stdcall FsRtlAddBaseMcbEntry(ptr long long long long long long)
@ stdcall FsRtlAddLargeMcbEntry(ptr long long long long long long)
@ stdcall FsRtlAddMcbEntry(ptr long long long)
@ stdcall FsRtlAddToTunnelCache(ptr long long ptr ptr long long ptr)
@ stdcall FsRtlFindInTunnelCache(ptr long long ptr ptr ptr ptr ptr)
@ stdcall FsRtlFreeFileLock(ptr)
@ stdcall FsRtlGetFileSize(ptr ptr)
-;FsRtlGetNextBaseMcbEntry
+@ stdcall FsRtlGetNextBaseMcbEntry(ptr long ptr ptr ptr)
@ stdcall FsRtlGetNextFileLock(ptr long)
@ stdcall FsRtlGetNextLargeMcbEntry(ptr long ptr ptr ptr)
@ stdcall FsRtlGetNextMcbEntry(ptr long ptr ptr ptr)
@ stdcall FsRtlIncrementCcFastReadNotPossible()
@ stdcall FsRtlIncrementCcFastReadResourceMiss()
@ stdcall FsRtlIncrementCcFastReadWait()
-;FsRtlInitializeBaseMcb
+@ stdcall FsRtlInitializeBaseMcb(ptr ptr)
@ stdcall FsRtlInitializeFileLock(ptr ptr ptr)
@ stdcall FsRtlInitializeLargeMcb(ptr long)
@ stdcall FsRtlInitializeMcb(ptr long)
@ stdcall FsRtlIsPagingFile(ptr)
@ stdcall FsRtlIsTotalDeviceFailure(ptr)
@ extern FsRtlLegalAnsiCharacterArray _FsRtlLegalAnsiCharacterArray
-;FsRtlLookupBaseMcbEntry
+@ stdcall FsRtlLookupBaseMcbEntry(ptr long long ptr ptr ptr ptr ptr)
@ stdcall FsRtlLookupLargeMcbEntry(ptr long long ptr ptr ptr ptr ptr)
-;FsRtlLookupLastBaseMcbEntry
-;FsRtlLookupLastBaseMcbEntryAndIndex
+@ stdcall FsRtlLookupLastBaseMcbEntry(ptr ptr ptr)
+@ stdcall FsRtlLookupLastBaseMcbEntryAndIndex(ptr ptr ptr ptr)
@ stdcall FsRtlLookupLastLargeMcbEntry(ptr ptr ptr)
@ stdcall FsRtlLookupLastLargeMcbEntryAndIndex(ptr ptr ptr ptr)
@ stdcall FsRtlLookupLastMcbEntry(ptr ptr ptr)
@ stdcall FsRtlNotifyReportChange(ptr ptr ptr ptr long)
@ stdcall FsRtlNotifyUninitializeSync(ptr)
@ stdcall FsRtlNotifyVolumeEvent(ptr long)
-;FsRtlNumberOfRunsInBaseMcb
+@ stdcall FsRtlNumberOfRunsInBaseMcb(ptr)
@ stdcall FsRtlNumberOfRunsInLargeMcb(ptr)
@ stdcall FsRtlNumberOfRunsInMcb(ptr)
@ stdcall FsRtlOplockFsctrl(ptr ptr long)
@ stdcall FsRtlRegisterFileSystemFilterCallbacks(ptr ptr)
@ stdcall FsRtlRegisterUncProvider(ptr ptr long)
@ stdcall FsRtlReleaseFile(ptr)
-;FsRtlRemoveBaseMcbEntry
+@ stdcall FsRtlRemoveBaseMcbEntry(ptr long long long long)
@ stdcall FsRtlRemoveLargeMcbEntry(ptr long long long long)
@ stdcall FsRtlRemoveMcbEntry(ptr long long)
@ stdcall FsRtlRemovePerFileObjectContext(ptr ptr ptr)
@ stdcall FsRtlRemovePerStreamContext(ptr ptr ptr)
-;FsRtlResetBaseMcb
+@ stdcall FsRtlResetBaseMcb(ptr)
@ stdcall FsRtlResetLargeMcb(ptr long)
-;FsRtlSplitBaseMcb
+@ stdcall FsRtlSplitBaseMcb(ptr long long long long)
@ stdcall FsRtlSplitLargeMcb(ptr long long long long)
@ stdcall FsRtlSyncVolumes(long long long)
@ stdcall FsRtlTeardownPerStreamContexts(ptr)
-;FsRtlTruncateBaseMcb
+@ stdcall FsRtlTruncateBaseMcb(ptr long long)
@ stdcall FsRtlTruncateLargeMcb(ptr long long)
@ stdcall FsRtlTruncateMcb(ptr long)
-;FsRtlUninitializeBaseMcb
+@ stdcall FsRtlUninitializeBaseMcb(ptr)
@ stdcall FsRtlUninitializeFileLock(ptr)
@ stdcall FsRtlUninitializeLargeMcb(ptr)
@ stdcall FsRtlUninitializeMcb(ptr)
@ extern HalDispatchTable _HalDispatchTable
@ fastcall HalExamineMBR(ptr long long ptr)
@ extern HalPrivateDispatchTable
-;HeadlessDispatch
+@ stdcall HeadlessDispatch(long ptr long ptr ptr)
@ stdcall InbvAcquireDisplayOwnership()
@ stdcall InbvCheckDisplayOwnership()
@ stdcall InbvDisplayString(str)
@ stdcall -arch=i386 Ke386SetIoAccessMap(long ptr)
@ fastcall KeAcquireGuardedMutex(ptr)
@ fastcall KeAcquireGuardedMutexUnsafe(ptr)
+@ cdecl -arch=x86_64 KeAcquireInStackQueuedSpinLock(ptr ptr)
@ fastcall KeAcquireInStackQueuedSpinLockAtDpcLevel(ptr ptr)
@ fastcall KeAcquireInStackQueuedSpinLockForDpc(ptr ptr)
+@ cdecl -arch=x86_64 KeAcquireInStackQueuedSpinLockRaiseToSynch(ptr ptr)
@ stdcall KeAcquireInterruptSpinLock(ptr)
+@ cdecl -arch=x86_64 KeAcquireQueuedSpinLock(long)
+@ cdecl -arch=x86_64 KeAcquireQueuedSpinLockRaiseToSynch(long)
@ stdcall KeAcquireSpinLockAtDpcLevel(ptr)
@ fastcall KeAcquireSpinLockForDpc(ptr)
@ stdcall -arch=x86_64 KeAcquireSpinLockRaiseToDpc(ptr)
+@ stdcall -arch=x86_64 KeAcquireSpinLockRaiseToSynch(ptr)
@ stdcall KeAddSystemServiceTable(ptr ptr long ptr long)
@ stdcall KeAreAllApcsDisabled()
@ stdcall KeAreApcsDisabled()
@ stdcall KeEnterCriticalRegion() _KeEnterCriticalRegion
@ stdcall KeEnterGuardedRegion() _KeEnterGuardedRegion
@ stdcall KeEnterKernelDebugger()
+;@ stdcall -arch=x86_64 KeExpandKernelStackAndCallout(ptr ptr double)
@ stdcall KeFindConfigurationEntry(ptr long long ptr)
@ stdcall KeFindConfigurationNextEntry(ptr long long ptr ptr)
@ stdcall KeFlushEntireTb(long long)
@ stdcall KeFlushQueuedDpcs()
-;KeGenericCallDpc
+@ stdcall KeGenericCallDpc(ptr ptr)
@ stdcall KeGetCurrentThread()
@ stdcall KeGetPreviousMode()
@ stdcall KeGetRecommendedSharedDataAlignment()
-;KeI386AbiosCall
+; -arch=i386 KeI386AbiosCall
@ stdcall -arch=i386 KeI386AllocateGdtSelectors(ptr long)
; -arch=i386 KeI386Call16BitCStyleFunction
; -arch=i386 KeI386Call16BitFunction
@ stdcall KeInvalidateAllCaches()
@ stdcall KeIpiGenericCall(ptr ptr)
@ stdcall KeIsAttachedProcess()
-@ stdcall KeIsExecutingDpc()
+@ stdcall -arch=i386,arm KeIsExecutingDpc()
;KeIsWaitListEmpty
+;@ cdecl -arch=x86_64 KeLastBranchMSR()
@ stdcall KeLeaveCriticalRegion() _KeLeaveCriticalRegion
@ stdcall KeLeaveGuardedRegion() _KeLeaveGuardedRegion
@ extern KeLoaderBlock
-@ extern KeNumberProcessors
-@ stdcall KeProfileInterrupt(ptr)
+@ cdecl -arch=x86_64 -private KeLowerIrql(long)
+@ extern KeNumberProcessors _KeNumberProcessors
+@ stdcall -arch=i386,arm KeProfileInterrupt(ptr)
@ stdcall KeProfileInterruptWithSource(ptr long)
@ stdcall KePulseEvent(ptr long long)
@ stdcall KeQueryActiveProcessors()
@ stdcall -arch=i386,arm KeQueryInterruptTime()
+;@ cdecl -arch=x86_64 KeQueryMultiThreadProcessorSet
+;@ cdecl -arch=x86_64 KeQueryPrcbAddress
@ stdcall KeQueryPriorityThread(ptr)
@ stdcall KeQueryRuntimeThread(ptr ptr)
@ stdcall -arch=i386,arm KeQuerySystemTime(ptr)
-@ stdcall KeQueryTickCount(ptr)
+@ stdcall -arch=i386,arm KeQueryTickCount(ptr)
@ stdcall KeQueryTimeIncrement()
+@ cdecl -arch=x86_64 -private KeRaiseIrqlToDpcLevel()
@ stdcall KeRaiseUserException(long)
@ stdcall KeReadStateEvent(ptr)
@ stdcall KeReadStateMutant(ptr)
@ stdcall KeRegisterNmiCallback(ptr ptr)
@ fastcall KeReleaseGuardedMutex(ptr)
@ fastcall KeReleaseGuardedMutexUnsafe(ptr)
+@ cdecl -arch=x86_64 KeReleaseInStackQueuedSpinLock(ptr)
@ fastcall KeReleaseInStackQueuedSpinLockForDpc(ptr)
@ fastcall KeReleaseInStackQueuedSpinLockFromDpcLevel(ptr)
@ stdcall KeReleaseInterruptSpinLock(ptr long)
@ stdcall KeReleaseMutant(ptr long long long)
@ stdcall KeReleaseMutex(ptr long)
+@ cdecl -arch=x86_64 KeReleaseQueuedSpinLock(long long)
@ stdcall KeReleaseSemaphore(ptr long long long)
@ stdcall -arch=x86_64 KeReleaseSpinLock(ptr long)
@ fastcall KeReleaseSpinLockForDpc(ptr long)
@ stdcall KeRemoveQueueDpc(ptr)
@ stdcall KeRemoveSystemServiceTable(long)
@ stdcall KeResetEvent(ptr)
-@ stdcall KeRestoreFloatingPointState(ptr)
+@ stdcall -arch=i386 KeRestoreFloatingPointState(ptr)
+@ stdcall -arch=x86_64 KeRestoreFloatingPointState(ptr) KxRestoreFloatingPointState
@ stdcall KeRevertToUserAffinityThread()
@ stdcall KeRundownQueue(ptr)
-@ stdcall KeSaveFloatingPointState(ptr)
+@ stdcall -arch=i386 KeSaveFloatingPointState(ptr)
+@ stdcall -arch=x86_64 KeSaveFloatingPointState(ptr) KxSaveFloatingPointState
@ cdecl KeSaveStateForHibernate(ptr)
@ extern KeServiceDescriptorTable
@ stdcall KeSetAffinityThread(ptr long)
@ stdcall KeSetTimeIncrement(long long)
@ stdcall KeSetTimer(ptr long long ptr)
@ stdcall KeSetTimerEx(ptr long long long ptr)
-;KeSignalCallDpcDone
-;KeSignalCallDpcSynchronize
+@ stdcall KeSignalCallDpcDone(ptr)
+@ stdcall KeSignalCallDpcSynchronize(ptr)
@ stdcall KeStackAttachProcess(ptr ptr)
@ stdcall KeSynchronizeExecution(ptr ptr ptr)
@ stdcall KeTerminateThread(long)
@ fastcall KeTestSpinLock(ptr)
-@ extern KeTickCount
+@ extern -arch=i386,arm KeTickCount
@ fastcall KeTryToAcquireGuardedMutex(ptr)
+@ cdecl -arch=x86_64 KeTryToAcquireQueuedSpinLock(long long)
+@ cdecl -arch=x86_64 KeTryToAcquireQueuedSpinLockRaiseToSynch(long long)
@ fastcall KeTryToAcquireSpinLockAtDpcLevel(ptr)
@ stdcall KeUnstackDetachProcess(ptr)
@ stdcall KeUpdateRunTime(ptr long)
@ stdcall KeWaitForMultipleObjects(long ptr long long long long ptr ptr)
@ stdcall KeWaitForMutexObject(ptr long long long ptr) KeWaitForSingleObject
@ stdcall KeWaitForSingleObject(ptr long long long ptr)
-@ fastcall KefAcquireSpinLockAtDpcLevel(ptr)
-@ fastcall KefReleaseSpinLockFromDpcLevel(ptr)
+@ fastcall -arch=i386,arm KefAcquireSpinLockAtDpcLevel(ptr)
+@ fastcall -arch=i386,arm KefReleaseSpinLockFromDpcLevel(ptr)
@ stdcall -arch=i386 Kei386EoiHelper()
+@ cdecl -arch=x86_64 -private KfRaiseIrql(long)
@ fastcall -arch=i386 KiEoiHelper(ptr)
-@ fastcall KiAcquireSpinLock(ptr)
+@ fastcall -arch=i386,arm KiAcquireSpinLock(ptr)
@ extern KiBugCheckData
@ stdcall KiCheckForKernelApcDelivery()
-;KiCheckForSListAddress
+;-arch=i386,arm KiCheckForSListAddress
@ stdcall -arch=i386 KiCoprocessorError()
-@ stdcall KiDeliverApc(long ptr ptr)
+;@ cdecl -arch=x86_64 KiCpuId()
+@ stdcall -arch=i386,arm KiDeliverApc(long ptr ptr)
@ stdcall -arch=i386 KiDispatchInterrupt()
-@ extern KiEnableTimerWatchdog
-@ stdcall KiIpiServiceRoutine(ptr ptr)
-@ fastcall KiReleaseSpinLock(ptr)
-@ cdecl KiUnexpectedInterrupt()
+@ extern -arch=i386,arm KiEnableTimerWatchdog
+@ stdcall -arch=i386,arm KiIpiServiceRoutine(ptr ptr)
+@ fastcall -arch=i386,arm KiReleaseSpinLock(ptr)
+@ cdecl -arch=i386,arm KiUnexpectedInterrupt()
@ stdcall -arch=i386 Kii386SpinOnSpinLock(ptr long)
@ stdcall LdrAccessResource(ptr ptr ptr ptr)
@ stdcall LdrEnumResources(ptr ptr long ptr ptr)
@ stdcall MmAllocatePagesForMdlEx(long long long long long long long long long)
@ stdcall MmBuildMdlForNonPagedPool(ptr)
@ stdcall MmCanFileBeTruncated(ptr ptr)
-;MmCommitSessionMappedView
+@ stdcall MmCommitSessionMappedView(ptr ptr)
@ stdcall MmCreateMdl(ptr ptr long)
;MmCreateMirror
@ stdcall MmCreateSection(ptr long ptr ptr long long ptr ptr)
@ extern NlsOemLeadByteInfo _NlsOemLeadByteInfo
@ stdcall NtAddAtom(wstr long ptr)
@ stdcall NtAdjustPrivilegesToken(ptr long ptr long ptr ptr)
-@ stdcall NtAlertThread(ptr)
+@ stdcall -arch=i386,arm NtAlertThread(ptr)
@ stdcall NtAllocateLocallyUniqueId(ptr)
@ stdcall NtAllocateUuids(ptr ptr ptr ptr)
@ stdcall NtAllocateVirtualMemory(ptr ptr long ptr long long)
@ stdcall NtCreateEvent(ptr long ptr long long)
@ stdcall NtCreateFile(ptr long ptr ptr ptr long long long long ptr long)
@ stdcall NtCreateSection(ptr long ptr ptr long long ptr)
-@ stdcall NtCreateTimer(ptr long ptr long)
+@ stdcall -arch=i386,arm NtCreateTimer(ptr long ptr long)
@ stdcall NtDeleteAtom(ptr)
@ stdcall NtDeleteFile(ptr)
@ stdcall NtDeviceIoControlFile(ptr ptr ptr ptr ptr long ptr long ptr long)
@ stdcall NtMakePermanentObject(ptr)
@ stdcall NtMapViewOfSection(ptr ptr ptr long long ptr ptr long long long)
@ stdcall NtNotifyChangeDirectoryFile(ptr ptr ptr ptr ptr ptr long long long)
-@ stdcall NtOpenEvent(ptr long ptr)
+@ stdcall -arch=i386,arm NtOpenEvent(ptr long ptr)
@ stdcall NtOpenFile(ptr long ptr ptr long long)
@ stdcall NtOpenProcess(ptr long ptr ptr)
@ stdcall NtOpenProcessToken(ptr long ptr)
@ stdcall ObCloseHandle(ptr long)
@ stdcall ObCreateObject(long ptr ptr long ptr long long long ptr)
@ stdcall ObCreateObjectType(ptr ptr ptr ptr)
-;ObDeleteCapturedInsertInfo
+@ stdcall ObDeleteCapturedInsertInfo(ptr)
@ stdcall ObDereferenceObject(ptr)
-@ stdcall ObDereferenceObjectDeferDelete(ptr)
+@ stdcall -arch=i386,arm ObDereferenceObjectDeferDelete(ptr)
@ stdcall ObDereferenceSecurityDescriptor(ptr long)
@ stdcall ObFindHandleForObject(ptr ptr ptr ptr ptr)
@ stdcall ObGetObjectSecurity(ptr ptr ptr)
@ stdcall ObInsertObject(ptr ptr long long ptr ptr)
-@ stdcall ObIsKernelHandle(ptr)
+@ stdcall -arch=i386,arm ObIsKernelHandle(ptr)
@ stdcall ObLogSecurityDescriptor(ptr ptr long)
@ stdcall ObMakeTemporaryObject(ptr)
@ stdcall ObOpenObjectByName(ptr ptr long ptr long ptr ptr)
@ stdcall ObReferenceObjectByPointer(ptr long ptr long)
@ stdcall ObReferenceSecurityDescriptor(ptr long)
@ stdcall ObReleaseObjectSecurity(ptr long)
-;ObSetHandleAttributes@12
+@ stdcall ObSetHandleAttributes(ptr ptr long)
@ stdcall ObSetSecurityDescriptorInfo(ptr ptr ptr ptr long ptr)
@ stdcall ObSetSecurityObjectByPointer(ptr long ptr)
@ fastcall ObfDereferenceObject(ptr)
@ stdcall PsGetCurrentProcessId()
@ stdcall PsGetCurrentProcessSessionId()
@ stdcall PsGetCurrentProcessWin32Process()
+;@ cdecl -arch=x86_64 PsGetCurrentProcessWow64Process()
@ stdcall PsGetCurrentThread() KeGetCurrentThread
@ stdcall PsGetCurrentThreadId()
@ stdcall PsGetCurrentThreadPreviousMode()
-;PsGetCurrentThreadProcess
-;PsGetCurrentThreadProcessId
+@ stdcall PsGetCurrentThreadProcess()
+@ stdcall PsGetCurrentThreadProcessId()
@ stdcall PsGetCurrentThreadStackBase()
@ stdcall PsGetCurrentThreadStackLimit()
-;PsGetCurrentThreadTeb
+@ stdcall PsGetCurrentThreadTeb()
@ stdcall PsGetCurrentThreadWin32Thread()
-;PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion
+@ stdcall PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion(ptr)
@ stdcall PsGetJobLock(ptr)
@ stdcall PsGetJobSessionId(ptr)
@ stdcall PsGetJobUIRestrictionsClass(ptr)
@ stdcall PsGetProcessSectionBaseAddress(ptr)
@ stdcall PsGetProcessSecurityPort(ptr)
@ stdcall PsGetProcessSessionId(ptr)
-;PsGetProcessSessionIdEx
+@ stdcall PsGetProcessSessionIdEx(ptr)
@ stdcall PsGetProcessWin32Process(ptr)
@ stdcall PsGetProcessWin32WindowStation(ptr)
+;@ cdecl -arch=x86_64 PsGetProcessWow64Process()
@ stdcall PsGetThreadFreezeCount(ptr)
@ stdcall PsGetThreadHardErrorsAreDisabled(ptr)
@ stdcall PsGetThreadId(ptr)
@ stdcall PsSetProcessPriorityByClass(ptr ptr)
@ stdcall PsSetProcessPriorityClass(ptr long)
@ stdcall PsSetProcessSecurityPort(ptr ptr)
-@ stdcall PsSetProcessWin32Process(ptr ptr)
+@ stdcall PsSetProcessWin32Process(ptr ptr ptr)
@ stdcall PsSetProcessWindowStation(ptr ptr)
@ stdcall PsSetThreadHardErrorsAreDisabled(ptr long)
-@ stdcall PsSetThreadWin32Thread(ptr ptr)
+@ stdcall PsSetThreadWin32Thread(ptr ptr ptr)
@ stdcall PsTerminateSystemThread(long)
@ extern PsThreadType _PsThreadType
;PsWrapApcWow64Thread
@ stdcall RtlAddAce(ptr long long ptr long)
@ stdcall RtlAddAtomToAtomTable(ptr wstr ptr)
@ stdcall RtlAddRange(ptr long long long long long long ptr ptr)
-@ stdcall RtlAllocateAndInitializeSid(ptr long long long long long long long long long ptr)
+@ stdcall -arch=i386,arm RtlAllocateAndInitializeSid(ptr long long long long long long long long long ptr)
@ stdcall RtlAllocateHeap(ptr long long)
@ stdcall RtlAnsiCharToUnicodeChar(ptr)
@ stdcall RtlAnsiStringToUnicodeSize(ptr) RtlxAnsiStringToUnicodeSize
@ stdcall RtlConvertSidToUnicodeString(ptr ptr long)
@ stdcall RtlConvertUlongToLargeInteger(long)
@ stdcall RtlCopyLuid(ptr ptr)
+@ stdcall -arch=x86_64 RtlCopyMemory(ptr ptr int64) memmove
+@ stdcall -arch=x86_64 RtlCopyMemoryNonTemporal(ptr ptr int64) memmove
@ stdcall RtlCopyRangeList(ptr ptr)
@ stdcall RtlCopySid(long ptr ptr)
@ stdcall RtlCopyString(ptr ptr)
@ stdcall RtlDestroyHeap(ptr)
@ stdcall RtlDowncaseUnicodeString(ptr ptr long)
@ stdcall RtlEmptyAtomTable(ptr long)
-@ stdcall RtlEnlargedIntegerMultiply(long long)
-@ stdcall RtlEnlargedUnsignedDivide(long long long ptr)
-@ stdcall RtlEnlargedUnsignedMultiply(long long)
+@ stdcall -arch=win32 RtlEnlargedIntegerMultiply(long long)
+@ stdcall -arch=win32 RtlEnlargedUnsignedDivide(long long long ptr)
+@ stdcall -arch=win32 RtlEnlargedUnsignedMultiply(long long)
@ stdcall RtlEnumerateGenericTable(ptr long)
@ stdcall RtlEnumerateGenericTableAvl(ptr long)
@ stdcall RtlEnumerateGenericTableLikeADirectory(ptr ptr ptr long ptr ptr ptr)
@ stdcall RtlEqualSid(ptr ptr)
@ stdcall RtlEqualString(ptr ptr long)
@ stdcall RtlEqualUnicodeString(ptr ptr long)
-@ stdcall RtlExtendedIntegerMultiply(long long long)
-@ stdcall RtlExtendedLargeIntegerDivide(long long long ptr)
-@ stdcall RtlExtendedMagicDivide(long long long long long)
+@ stdcall -arch=win32 RtlExtendedIntegerMultiply(long long long)
+@ stdcall -arch=win32 RtlExtendedLargeIntegerDivide(long long long ptr)
+@ stdcall -arch=win32 RtlExtendedMagicDivide(long long long long long)
@ stdcall RtlFillMemory(ptr long long)
-@ stdcall RtlFillMemoryUlong(ptr long long)
+@ stdcall -arch=i386,arm RtlFillMemoryUlong(ptr long long)
@ stdcall RtlFindClearBits(ptr long long)
@ stdcall RtlFindClearBitsAndSet(ptr long long)
@ stdcall RtlFindClearRuns(ptr ptr long long)
@ stdcall RtlIsNameLegalDOS8Dot3(ptr ptr ptr)
@ stdcall RtlIsRangeAvailable(ptr long long long long long long ptr ptr ptr)
@ stdcall RtlIsValidOemCharacter(ptr)
-@ stdcall RtlLargeIntegerAdd(long long long long)
-@ stdcall RtlLargeIntegerArithmeticShift(long long long)
-@ stdcall RtlLargeIntegerDivide(long long long long ptr)
-@ stdcall RtlLargeIntegerNegate(long long)
-@ stdcall RtlLargeIntegerShiftLeft(long long long)
-@ stdcall RtlLargeIntegerShiftRight(long long long)
-@ stdcall RtlLargeIntegerSubtract(long long long long)
+@ stdcall -arch=win32 RtlLargeIntegerAdd(long long long long)
+@ stdcall -arch=win32 RtlLargeIntegerArithmeticShift(long long long)
+@ stdcall -arch=win32 RtlLargeIntegerDivide(long long long long ptr)
+@ stdcall -arch=win32 RtlLargeIntegerNegate(long long)
+@ stdcall -arch=win32 RtlLargeIntegerShiftLeft(long long long)
+@ stdcall -arch=win32 RtlLargeIntegerShiftRight(long long long)
+@ stdcall -arch=win32 RtlLargeIntegerSubtract(long long long long)
@ stdcall RtlLengthRequiredSid(long)
@ stdcall RtlLengthSecurityDescriptor(ptr)
@ stdcall RtlLengthSid(ptr)
@ stdcall RtlLookupElementGenericTableAvl(ptr ptr)
@ stdcall RtlLookupElementGenericTableFull(ptr ptr ptr ptr)
@ stdcall RtlLookupElementGenericTableFullAvl(ptr ptr ptr ptr)
+@ cdecl -arch=x86_64 RtlLookupFunctionEntry(double ptr ptr)
@ stdcall RtlMapGenericMask(ptr ptr)
@ stdcall RtlMapSecurityErrorToNtStatus(long)
@ stdcall RtlMergeRangeLists(ptr ptr ptr long)
@ stdcall RtlOemStringToUnicodeSize(ptr) RtlxOemStringToUnicodeSize
@ stdcall RtlOemStringToUnicodeString(ptr ptr long)
@ stdcall RtlOemToUnicodeN(wstr long ptr ptr long)
+@ cdecl -arch=x86_64 RtlPcToFileHeader(ptr ptr)
@ stdcall RtlPinAtomInAtomTable(ptr ptr)
@ fastcall RtlPrefetchMemoryNonTemporal(ptr long)
@ stdcall RtlPrefixString(ptr ptr long)
@ stdcall RtlRealSuccessor(ptr)
@ stdcall RtlRemoveUnicodePrefix(ptr ptr)
@ stdcall RtlReserveChunk(long ptr ptr ptr long)
+@ cdecl -arch=x86_64 RtlRestoreContext(ptr ptr)
@ stdcall RtlSecondsSince1970ToTime(long ptr)
@ stdcall RtlSecondsSince1980ToTime(long ptr)
@ stdcall RtlSelfRelativeToAbsoluteSD(ptr ptr ptr ptr ptr ptr ptr ptr ptr ptr ptr)
@ stdcall RtlUnicodeToOemN(ptr long ptr wstr long)
@ stdcall RtlUnlockBootStatusData(ptr)
@ stdcall RtlUnwind(ptr ptr ptr ptr)
+@ cdecl -arch=x86_64 RtlUnwindEx(double double ptr ptr ptr ptr)
@ stdcall RtlUpcaseUnicodeChar(long)
@ stdcall RtlUpcaseUnicodeString(ptr ptr long)
@ stdcall RtlUpcaseUnicodeStringToAnsiString(ptr ptr long)
@ stdcall RtlValidSecurityDescriptor(ptr)
@ stdcall RtlValidSid(ptr)
@ stdcall RtlVerifyVersionInfo(ptr long long long)
-@ stdcall RtlVolumeDeviceToDosName(ptr ptr)
+@ cdecl -arch=x86_64 RtlVirtualUnwind(long double double ptr ptr ptr ptr ptr)
+@ stdcall RtlVolumeDeviceToDosName(ptr ptr) IoVolumeDeviceToDosName
@ stdcall RtlWalkFrameChain(ptr long long)
@ stdcall RtlWriteRegistryValue(long wstr wstr long ptr long)
@ stdcall RtlZeroHeap(ptr long)
@ stdcall SeRegisterLogonSessionTerminatedRoutine(ptr)
@ stdcall SeReleaseSecurityDescriptor(ptr long long)
@ stdcall SeReleaseSubjectContext(ptr)
+@ stdcall SeReportSecurityEvent(long ptr ptr ptr)
@ stdcall SeSetAccessStateGenericMapping(ptr ptr)
-;SeSetAuditParameter
+@ stdcall SeSetAuditParameter(ptr long long ptr)
@ stdcall SeSetSecurityDescriptorInfo(ptr ptr ptr ptr long ptr)
@ stdcall SeSetSecurityDescriptorInfoEx(ptr ptr ptr ptr long long ptr)
@ stdcall SeSinglePrivilegeCheck(long long long)
@ stdcall SeTokenIsAdmin(ptr)
@ stdcall SeTokenIsRestricted(ptr)
@ stdcall SeTokenIsWriteRestricted(ptr)
+@ extern SeTokenObjectType
@ stdcall SeTokenType(ptr)
@ stdcall SeUnlockSubjectContext(ptr)
@ stdcall SeUnregisterLogonSessionTerminatedRoutine(ptr)
@ stdcall ZwQueryDriverEntryOrder(ptr ptr)
@ stdcall ZwQueryEaFile(ptr ptr ptr long long ptr long ptr long)
@ stdcall ZwQueryFullAttributesFile(ptr ptr)
-@ stdcall ZwQueryInformationAtom(ptr long ptr long ptr)
+@ stdcall -arch=i386,arm ZwQueryInformationAtom(ptr long ptr long ptr)
@ stdcall ZwQueryInformationFile(ptr ptr ptr long long)
@ stdcall ZwQueryInformationJobObject(ptr long ptr long ptr)
@ stdcall ZwQueryInformationProcess(ptr long ptr long ptr)
@ stdcall ZwWaitForSingleObject(ptr long ptr)
@ stdcall ZwWriteFile(ptr ptr ptr ptr ptr ptr long ptr ptr)
@ stdcall ZwYieldExecution()
-;_CIcos
-;_CIsin
-;_CIsqrt
+@ cdecl -arch=x86_64 __C_specific_handler(ptr long ptr ptr)
+@ cdecl -arch=x86_64 __chkstk()
+;@ cdecl -arch=x86_64 __misaligned_access()
+;@ cdecl -arch=i386 _CIcos
+;@ cdecl -arch=i386 _CIsin
+;@ cdecl -arch=i386 _CIsqrt
@ cdecl -arch=i386,arm _abnormal_termination()
@ cdecl -arch=i386 _alldiv()
@ cdecl -arch=i386 _alldvrm()
@ cdecl _itoa()
@ cdecl _itow()
@ cdecl -arch=i386,arm _local_unwind2()
+@ cdecl -arch=x86_64 _local_unwind()
@ cdecl _purecall()
+@ cdecl -arch=x86_64 _setjmp(ptr ptr)
+@ cdecl -arch=x86_64 _setjmpex(ptr ptr)
@ cdecl _snprintf()
@ cdecl _snwprintf()
@ cdecl _stricmp()
@ cdecl isspace()
@ cdecl isupper()
@ cdecl isxdigit()
+@ cdecl -arch=x86_64 longjmp(ptr long)
@ cdecl mbstowcs()
@ cdecl mbtowc()
@ cdecl memchr()
+@ cdecl -arch=x86_64 memcmp()
@ cdecl memcpy()
@ cdecl memmove()
@ cdecl memset()