[CMAKE]

[reactos.git] / ntoskrnl / ntoskrnl_i386.def

diff --git a/ntoskrnl/ntoskrnl_i386.def b/ntoskrnl/ntoskrnl_i386.def
index 8097c67..f04d6be 100644 (file)
--- a/ntoskrnl/ntoskrnl_i386.def
+++ b/ntoskrnl/ntoskrnl_i386.def
@@ -1,1591 +1,1528 @@
-; reactos/ntoskrnl/ntoskrnl.def
-;
-; ReactOS Operating System
-;
+
+LIBRARY ntoskrnl.exe
+
 EXPORTS
-CcCanIWrite@16
-CcCopyRead@24
-CcCopyWrite@20
-CcDeferWrite@24
-CcFastCopyRead@24
-CcFastCopyWrite@16
-CcFastMdlReadWait DATA
-CcFastReadNotPossible DATA
-CcFastReadWait DATA
-CcFlushCache@16
-CcGetDirtyPages@16
-CcGetFileObjectFromBcb@4
-CcGetFileObjectFromSectionPtrs@4
-CcGetFlushedValidData@8
-CcGetLsnForFileObject@8
-CcInitializeCacheMap@20
-CcIsThereDirtyData@4
-CcMapData@24
-CcMdlRead@20
-CcMdlReadComplete@8
-CcMdlWriteAbort@8
-CcMdlWriteComplete@12
-CcPinMappedData@20
-CcPinRead@24
-CcPrepareMdlWrite@20
-CcPreparePinWrite@28
-CcPurgeCacheSection@16
-CcRemapBcb@4
-CcRepinBcb@4
-CcScheduleReadAhead@12
-CcSetAdditionalCacheAttributes@12
-CcSetBcbOwnerPointer@8
-CcSetDirtyPageThreshold@8
-CcSetDirtyPinnedData@8
-CcSetFileSizes@8
-CcSetLogHandleForFile@12
-CcSetReadAheadGranularity@8
-CcUninitializeCacheMap@12
-CcUnpinData@4
-CcUnpinDataForThread@8
-CcUnpinRepinnedBcb@12
-CcWaitForCurrentLazyWriterActivity@0
-CcZeroData@16
-CmRegisterCallback@12
-CmUnRegisterCallback@8
-DbgBreakPoint@0
-DbgBreakPointWithStatus@4
-;DbgCommandString
-DbgLoadImageSymbols@12
-DbgPrint
-DbgPrintEx
-DbgPrintReturnControlC
-DbgPrompt@12
-DbgQueryDebugFilterState@8
-DbgSetDebugFilterState@12
-@ExAcquireFastMutexUnsafe@4
-ExAcquireResourceExclusiveLite@8
-ExAcquireResourceSharedLite@8
-ExAcquireRundownProtection=@ExfAcquireRundownProtection@4
-ExAcquireRundownProtectionCacheAware=@ExfAcquireRundownProtectionCacheAware@4
-ExAcquireRundownProtectionCacheAwareEx=@ExfAcquireRundownProtectionCacheAwareEx@8
-ExAcquireRundownProtectionEx=@ExfAcquireRundownProtectionEx@8
-ExAcquireSharedStarveExclusive@8
-ExAcquireSharedWaitForExclusive@8
-ExAllocateCacheAwareRundownProtection@8
-ExAllocateFromPagedLookasideList@4=ExiAllocateFromPagedLookasideList@4
-ExAllocatePool@8
-ExAllocatePoolWithQuota@8
-ExAllocatePoolWithQuotaTag@12
-ExAllocatePoolWithTag@12
-ExAllocatePoolWithTagPriority@16
-ExConvertExclusiveToSharedLite@4
-ExCreateCallback@16
-ExDeleteNPagedLookasideList@4
-ExDeletePagedLookasideList@4
-ExDeleteResourceLite@4
-ExDesktopObjectType
-ExDisableResourceBoostLite@4
-@ExEnterCriticalRegionAndAcquireFastMutexUnsafe@4
-ExEnterCriticalRegionAndAcquireResourceExclusive@4
-;ExEnterCriticalRegionAndAcquireResourceShared
-;ExEnterCriticalRegionAndAcquireSharedWaitForExclusive
-ExEnumHandleTable@16
-ExEventObjectType=_ExEventObjectType
-ExExtendZone@12
-ExFreeCacheAwareRundownProtection@4
-ExFreePool@4
-ExFreePoolWithTag@8
-ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8
-ExGetCurrentProcessorCounts@12
-ExGetCurrentProcessorCpuUsage@4
-ExGetExclusiveWaiterCount@4
-ExGetPreviousMode@0
-ExGetSharedWaiterCount@4
-ExInitializeNPagedLookasideList@28
-ExInitializePagedLookasideList@28
-ExInitializeResourceLite@4
-ExInitializeRundownProtection=@ExfInitializeRundownProtection@4
-ExInitializeRundownProtectionCacheAware@8
-ExInitializeZone@16
-ExInterlockedAddLargeInteger@16
-@ExInterlockedAddLargeStatistic@8
-ExInterlockedAddUlong@12
-@ExInterlockedCompareExchange64@16
-ExInterlockedDecrementLong@8
-ExInterlockedExchangeUlong@12
-ExInterlockedExtendZone@16
-@ExInterlockedFlushSList@4
-ExInterlockedIncrementLong@8
-ExInterlockedInsertHeadList@12
-ExInterlockedInsertTailList@12
-ExInterlockedPopEntryList@8
-@ExInterlockedPopEntrySList@8
-ExInterlockedPushEntryList@12
-@ExInterlockedPushEntrySList@12
-ExInterlockedRemoveHeadList@8
-ExIsProcessorFeaturePresent@4
-ExIsResourceAcquiredExclusiveLite@4
-ExIsResourceAcquiredSharedLite@4
-ExLocalTimeToSystemTime@8
-ExNotifyCallback@12
-ExQueryPoolBlockSize@8
-ExQueueWorkItem@8
-ExRaiseAccessViolation@0
-ExRaiseDatatypeMisalignment@0
-ExRaiseException@4=RtlRaiseException@4
-ExRaiseHardError@24
-ExRaiseStatus@4=RtlRaiseStatus@4
-ExReInitializeRundownProtection=@ExfReInitializeRundownProtection@4
-ExReInitializeRundownProtectionCacheAware=@ExfReInitializeRundownProtectionCacheAware@4
-ExRegisterCallback@12
-ExReinitializeResourceLite@4
-@ExReleaseFastMutexUnsafe@4
-@ExReleaseFastMutexUnsafeAndLeaveCriticalRegion@4
-@ExReleaseResourceAndLeaveCriticalRegion@4
-ExReleaseResourceForThreadLite@8
-@ExReleaseResourceLite@4
-ExReleaseRundownProtection=@ExfReleaseRundownProtection@4
-ExReleaseRundownProtectionCacheAware=@ExfReleaseRundownProtectionCacheAware@4
-ExReleaseRundownProtectionCacheAwareEx=@ExfReleaseRundownProtectionCacheAwareEx@8
-ExReleaseRundownProtectionEx=@ExfReleaseRundownProtectionEx@8
-ExRundownCompleted=@ExfRundownCompleted@4
-ExRundownCompletedCacheAware=@ExfRundownCompletedCacheAware@4
-ExSemaphoreObjectType=_ExSemaphoreObjectType
-ExSetResourceOwnerPointer@8
-ExSetTimerResolution@8
-ExSizeOfRundownProtectionCacheAware@0
-ExSystemExceptionFilter@0
-ExSystemTimeToLocalTime@8
-ExUnregisterCallback@4
-ExUuidCreate@4
-ExVerifySuite@4
-ExWaitForRundownProtectionRelease=@ExfWaitForRundownProtectionRelease@4
-ExWaitForRundownProtectionReleaseCacheAware=@ExfWaitForRundownProtectionReleaseCacheAware@4
-ExWindowStationObjectType DATA
-@ExfAcquirePushLockExclusive@4
-@ExfAcquirePushLockShared@4
-@ExfInterlockedAddUlong@12
-@ExfInterlockedCompareExchange64@12
-@ExfInterlockedInsertHeadList@12
-@ExfInterlockedInsertTailList@12
-@ExfInterlockedPopEntryList@8
-@ExfInterlockedPushEntryList@12
-@ExfInterlockedRemoveHeadList@8
-@ExfReleasePushLock@4
-@ExfReleasePushLockExclusive@4
-@ExfReleasePushLockShared@4
-@ExfTryToWakePushLock@4
-@ExfUnblockPushLock@8
-@Exfi386InterlockedDecrementLong@4
-@Exfi386InterlockedExchangeUlong@8
-@Exfi386InterlockedIncrementLong@4
-Exi386InterlockedDecrementLong@4
-Exi386InterlockedExchangeUlong@12
-Exi386InterlockedIncrementLong@4
-@ExiAcquireFastMutex@4=@ExAcquireFastMutex@4
-@ExiReleaseFastMutex@4=@ExReleaseFastMutex@4
-@ExiTryToAcquireFastMutex@4=@ExTryToAcquireFastMutex@4
-FsRtlAcquireFileExclusive
-;FsRtlAddBaseMcbEntry
-FsRtlAddLargeMcbEntry
-FsRtlAddMcbEntry
-FsRtlAddToTunnelCache
-FsRtlAllocateFileLock@8
-FsRtlAllocatePool
-FsRtlAllocatePoolWithQuota
-FsRtlAllocatePoolWithQuotaTag
-FsRtlAllocatePoolWithTag@12
-FsRtlAllocateResource
-FsRtlAreNamesEqual@16
-FsRtlBalanceReads
-FsRtlCheckLockForReadAccess@8
-FsRtlCheckLockForWriteAccess@8
-FsRtlCheckOplock@20
-FsRtlCopyRead@32
-FsRtlCopyWrite
-FsRtlCreateSectionForDataScan@40
-FsRtlCurrentBatchOplock@4
-FsRtlDeleteKeyFromTunnelCache
-FsRtlDeleteTunnelCache
-FsRtlDeregisterUncProvider
-FsRtlDissectDbcs
-FsRtlDissectName@16
-FsRtlDoesDbcsContainWildCards
-FsRtlDoesNameContainWildCards@4
-FsRtlFastCheckLockForRead@24
-FsRtlFastCheckLockForWrite
-FsRtlFastUnlockAll@16
-FsRtlFastUnlockAllByKey@20
-FsRtlFastUnlockSingle@32
-FsRtlFindInTunnelCache
-FsRtlFreeFileLock@4
-FsRtlGetFileSize
-;FsRtlGetNextBaseMcbEntry
-FsRtlGetNextFileLock
-FsRtlGetNextLargeMcbEntry
-FsRtlGetNextMcbEntry
-FsRtlIncrementCcFastReadNoWait
-FsRtlIncrementCcFastReadNotPossible
-FsRtlIncrementCcFastReadResourceMiss
-FsRtlIncrementCcFastReadWait
-;FsRtlInitializeBaseMcb
-FsRtlInitializeFileLock@12
-FsRtlInitializeLargeMcb
-FsRtlInitializeMcb
-FsRtlInitializeOplock
-FsRtlInitializeTunnelCache
-FsRtlInsertPerFileObjectContext
-FsRtlInsertPerStreamContext
-FsRtlIsDbcsInExpression
-FsRtlIsFatDbcsLegal@20
-FsRtlIsHpfsDbcsLegal
-FsRtlIsNameInExpression@16
-FsRtlIsNtstatusExpected@4
-FsRtlIsPagingFile
-FsRtlIsTotalDeviceFailure
-FsRtlLegalAnsiCharacterArray=_FsRtlLegalAnsiCharacterArray
-;FsRtlLookupBaseMcbEntry
-FsRtlLookupLargeMcbEntry
-;FsRtlLookupLastBaseMcbEntry
-;FsRtlLookupLastBaseMcbEntryAndIndex
-FsRtlLookupLastLargeMcbEntry
-FsRtlLookupLastLargeMcbEntryAndIndex
-FsRtlLookupLastMcbEntry
-FsRtlLookupMcbEntry
-FsRtlLookupPerFileObjectContext
-FsRtlLookupPerStreamContextInternal
-FsRtlMdlRead
-FsRtlMdlReadComplete
-FsRtlMdlReadCompleteDev@12
-FsRtlMdlReadDev@28
-FsRtlMdlWriteComplete
-FsRtlMdlWriteCompleteDev@16
-FsRtlNormalizeNtstatus@8
-FsRtlNotifyChangeDirectory
-FsRtlNotifyCleanup@12
-FsRtlNotifyFilterChangeDirectory
-FsRtlNotifyFilterReportChange
-FsRtlNotifyFullChangeDirectory@40
-FsRtlNotifyFullReportChange
-FsRtlNotifyInitializeSync@4
-FsRtlNotifyReportChange
-FsRtlNotifyUninitializeSync@4
-FsRtlNotifyVolumeEvent@8
-;FsRtlNumberOfRunsInBaseMcb
-FsRtlNumberOfRunsInLargeMcb
-FsRtlNumberOfRunsInMcb
-FsRtlOplockFsctrl@12
-FsRtlOplockIsFastIoPossible@4
-FsRtlPostPagingFileStackOverflow
-FsRtlPostStackOverflow
-FsRtlPrepareMdlWrite
-FsRtlPrepareMdlWriteDev@28
-FsRtlPrivateLock@48
-FsRtlProcessFileLock@12
-FsRtlRegisterFileSystemFilterCallbacks
-FsRtlRegisterUncProvider
-FsRtlReleaseFile
-;FsRtlRemoveBaseMcbEntry
-FsRtlRemoveLargeMcbEntry
-FsRtlRemoveMcbEntry
-FsRtlRemovePerFileObjectContext
-FsRtlRemovePerStreamContext
-;FsRtlResetBaseMcb
-FsRtlResetLargeMcb
-;FsRtlSplitBaseMcb
-FsRtlSplitLargeMcb
-FsRtlSyncVolumes
-FsRtlTeardownPerStreamContexts@4
-;FsRtlTruncateBaseMcb
-FsRtlTruncateLargeMcb
-FsRtlTruncateMcb
-;FsRtlUninitializeBaseMcb
-FsRtlUninitializeFileLock@4
-FsRtlUninitializeLargeMcb
-FsRtlUninitializeMcb
-FsRtlUninitializeOplock@4
-HalDispatchTable=_HalDispatchTable
-@HalExamineMBR@16
-HalPrivateDispatchTable DATA
-;HeadlessDispatch
-InbvAcquireDisplayOwnership@0
-InbvCheckDisplayOwnership@0
-InbvDisplayString@4
-InbvEnableBootDriver@4
-InbvEnableDisplayString@4
-InbvInstallDisplayStringFilter@4
-InbvIsBootDriverInstalled@0
-InbvNotifyDisplayOwnershipLost@4
-InbvResetDisplay@0
-InbvSetScrollRegion@16
-InbvSetTextColor@4
-InbvSolidColorFill@20
-InitSafeBootMode DATA
-@InterlockedCompareExchange@12
-@InterlockedDecrement@4
-@InterlockedExchange@8
-@InterlockedExchangeAdd@8
-@InterlockedIncrement@4
-@InterlockedPopEntrySList@4
-@InterlockedPushEntrySList@8
-IoAcquireCancelSpinLock@4
-IoAcquireRemoveLockEx@20
-IoAcquireVpbSpinLock@4
-IoAdapterObjectType DATA
-IoAllocateAdapterChannel@20
-IoAllocateController@16
-IoAllocateDriverObjectExtension@16
-IoAllocateErrorLogEntry@8
-IoAllocateIrp@8
-IoAllocateMdl@20
-IoAllocateWorkItem@4
-@IoAssignDriveLetters@16
-IoAssignResources@24
-IoAttachDevice@12
-IoAttachDeviceByPointer@8
-IoAttachDeviceToDeviceStack@8
-IoAttachDeviceToDeviceStackSafe@12
-IoBuildAsynchronousFsdRequest@24
-IoBuildDeviceIoControlRequest@36
-IoBuildPartialMdl@16
-IoBuildSynchronousFsdRequest@28
-IoCallDriver@8
-IoCancelFileOpen@8
-IoCancelIrp@4
-IoCheckDesiredAccess@8
-IoCheckEaBufferValidity@12
-IoCheckFunctionAccess@24
-IoCheckQuerySetFileInformation@12
-IoCheckQuerySetVolumeInformation@12
-IoCheckQuotaBufferValidity@12
-IoCheckShareAccess@20
-IoCompleteRequest@8
-IoConnectInterrupt@44
-IoCreateController@4
-IoCreateDevice@28
-IoCreateDisk@8
-IoCreateDriver@8
-IoCreateFile@56
-IoCreateFileSpecifyDeviceObjectHint@60
-IoCreateNotificationEvent@8
-IoCreateStreamFileObject@8
-IoCreateStreamFileObjectEx@12
-IoCreateStreamFileObjectLite@8
-IoCreateSymbolicLink@8
-IoCreateSynchronizationEvent@8
-IoCreateUnprotectedSymbolicLink@8
-IoCsqInitialize@28
-IoCsqInitializeEx@28
-IoCsqInsertIrp@12
-IoCsqInsertIrpEx@16
-IoCsqRemoveIrp@8
-IoCsqRemoveNextIrp@8
-IoDeleteController@4
-IoDeleteDevice@4
-IoDeleteDriver@4
-IoDeleteSymbolicLink@4
-IoDetachDevice@4
-IoDeviceHandlerObjectSize DATA
-IoDeviceHandlerObjectType DATA
-IoDeviceObjectType DATA
-IoDisconnectInterrupt@4
-IoDriverObjectType DATA
-IoEnqueueIrp@4
-IoEnumerateDeviceObjectList@16
-;IoEnumerateRegisteredFiltersList
-IoFastQueryNetworkAttributes@20
-IoFileObjectType=_IoFileObjectType
-IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
-IoForwardIrpSynchronously@8
-IoFreeController@4
-IoFreeErrorLogEntry@4
-IoFreeIrp@4
-IoFreeMdl@4
-IoFreeWorkItem@4
-IoGetAttachedDevice@4
-IoGetAttachedDeviceReference@4
-IoGetBaseFileSystemDeviceObject@4
-IoGetBootDiskInformation@8
-IoGetConfigurationInformation@0
-IoGetCurrentProcess@0
-IoGetDeviceAttachmentBaseRef@4
-IoGetDeviceInterfaceAlias@12
-IoGetDeviceInterfaces@16
-IoGetDeviceObjectPointer@16
-IoGetDeviceProperty@20
-IoGetDeviceToVerify@4
-IoGetDiskDeviceObject@8
-IoGetDmaAdapter@12
-IoGetDriverObjectExtension@8
-IoGetFileObjectGenericMapping@0
-IoGetInitialStack@0
-IoGetLowerDeviceObject@4
-;IoGetPagingIoPriority
-IoGetRelatedDeviceObject@4
-IoGetRequestorProcess@4
-IoGetRequestorProcessId@4
-IoGetRequestorSessionId@8
-IoGetStackLimits@8
-IoGetTopLevelIrp@0
-IoInitializeIrp@12
-IoInitializeRemoveLockEx@20
-IoInitializeTimer@12
-IoInvalidateDeviceRelations@8
-IoInvalidateDeviceState@4
-IoIsFileOriginRemote@4
-IoIsOperationSynchronous@4
-IoIsSystemThread@4
-IoIsValidNameGraftingBuffer@8
-IoIsWdmVersionAvailable@8
-IoMakeAssociatedIrp@8
-IoOpenDeviceInterfaceRegistryKey@12
-IoOpenDeviceRegistryKey@16
-IoPageRead@20
-IoPnPDeliverServicePowerNotification@16
-IoQueryDeviceDescription@32
-IoQueryFileDosDeviceName@8
-IoQueryFileInformation@20
-IoQueryVolumeInformation@20
-IoQueueThreadIrp@4
-IoQueueWorkItem@16
-IoRaiseHardError@12
-IoRaiseInformationalHardError@12
-IoReadDiskSignature@12
-IoReadOperationCount DATA
-@IoReadPartitionTable@16
-IoReadPartitionTableEx@8
-IoReadTransferCount DATA
-IoRegisterBootDriverReinitialization@12
-IoRegisterDeviceInterface@16
-IoRegisterDriverReinitialization@12
-IoRegisterFileSystem@4
-IoRegisterFsRegistrationChange@8
-IoRegisterLastChanceShutdownNotification@4
-IoRegisterPlugPlayNotification@28
-IoRegisterShutdownNotification@4
-IoReleaseCancelSpinLock@4
-IoReleaseRemoveLockAndWaitEx@12
-IoReleaseRemoveLockEx@12
-IoReleaseVpbSpinLock@4
-IoRemoveShareAccess@8
-IoReportDetectedDevice@32
-IoReportHalResourceUsage@16
-IoReportResourceForDetection@28
-IoReportResourceUsage@36
-IoReportTargetDeviceChange@8
-IoReportTargetDeviceChangeAsynchronous@16
-IoRequestDeviceEject@4
-IoReuseIrp@8
-IoSetCompletionRoutineEx@28
-IoSetDeviceInterfaceState@8
-IoSetDeviceToVerify@8
-IoSetFileOrigin@8
-IoSetHardErrorOrVerifyDevice@8
-IoSetInformation@16
-IoSetIoCompletion@24
-@IoSetPartitionInformation@16
-IoSetPartitionInformationEx@12
-IoSetShareAccess@16
-IoSetStartIoAttributes@12
-IoSetSystemPartition@4
-IoSetThreadHardErrorMode@4
-IoSetTopLevelIrp@4
-IoStartNextPacket@8
-IoStartNextPacketByKey@12
-IoStartPacket@16
-IoStartTimer@4
-IoStatisticsLock DATA
-IoStopTimer@4
-IoSynchronousInvalidateDeviceRelations@8
-IoSynchronousPageWrite@20
-IoThreadToProcess@4
-;IoTranslateBusAddress
-IoUnregisterFileSystem@4
-IoUnregisterFsRegistrationChange@8
-IoUnregisterPlugPlayNotification@4
-IoUnregisterShutdownNotification@4
-IoUpdateShareAccess@8
-IoValidateDeviceIoControlAccess@8
-IoVerifyPartitionTable@8
-IoVerifyVolume@8
-IoVolumeDeviceToDosName@8
-IoWMIAllocateInstanceIds@12
-IoWMIDeviceObjectToInstanceName@12
-IoWMIExecuteMethod@24
-IoWMIHandleToInstanceName@12
-IoWMIOpenBlock@12
-IoWMIQueryAllData@12
-IoWMIQueryAllDataMultiple@16
-IoWMIQuerySingleInstance@16
-IoWMIQuerySingleInstanceMultiple@20
-IoWMIRegistrationControl@8
-IoWMISetNotificationCallback@12
-IoWMISetSingleInstance@20
-IoWMISetSingleItem@24
-IoWMISuggestInstanceName@16
-IoWMIWriteEvent@4
-IoWriteErrorLogEntry@4
-IoWriteOperationCount DATA
-@IoWritePartitionTable@20
-IoWritePartitionTableEx@8
-IoWriteTransferCount DATA
-@IofCallDriver@8
-@IofCompleteRequest@8
-KdChangeOption@24
-KdDebuggerEnabled=_KdDebuggerEnabled
-KdDebuggerNotPresent=_KdDebuggerNotPresent
-KdDisableDebugger@0
-KdEnableDebugger@0
-KdEnteredDebugger
-KdPollBreakIn@0
-KdPowerTransition@4
-;KdRefreshDebuggerNotPresent
-KdSystemDebugControl@28
-Ke386CallBios@8
-;Ke386IoSetAccessProcess
-;Ke386QueryIoAccessMap
-;Ke386SetIoAccessMap
-@KeAcquireGuardedMutex@4
-@KeAcquireGuardedMutexUnsafe@4
-@KeAcquireInStackQueuedSpinLockAtDpcLevel@8
-;KeAcquireInStackQueuedSpinLockForDpc
-KeAcquireInterruptSpinLock@4
-KeAcquireSpinLockAtDpcLevel@4
-;KeAcquireSpinLockForDpc
-KeAddSystemServiceTable@20
-KeAreAllApcsDisabled@0
-KeAreApcsDisabled@0
-KeAttachProcess@4
-KeBugCheck@4
-KeBugCheckEx@20
-KeCancelTimer@4
-KeCapturePersistentThreadState@28
-KeClearEvent@4
-KeConnectInterrupt@4
-KeDelayExecutionThread@12
-KeDeregisterBugCheckCallback@4
-KeDeregisterBugCheckReasonCallback@4
-;KeDeregisterNmiCallback
-KeDetachProcess@0
-KeDisconnectInterrupt@4
-KeEnterCriticalRegion@0=_KeEnterCriticalRegion@0
-KeEnterGuardedRegion@0=_KeEnterGuardedRegion@0
-KeEnterKernelDebugger@0
-KeFindConfigurationEntry@16
-KeFindConfigurationNextEntry@20
-KeFlushEntireTb@8
-KeFlushQueuedDpcs@0
-;KeGenericCallDpc
-KeGetCurrentThread@0
-KeGetPreviousMode@0
-KeGetRecommendedSharedDataAlignment@0
-;KeI386AbiosCall
-KeI386AllocateGdtSelectors@8
-;KeI386Call16BitCStyleFunction
-;KeI386Call16BitFunction
-KeI386FlatToGdtSelector@12
-;KeI386GetLid
-;KeI386MachineType DATA
-KeI386ReleaseGdtSelectors@8
-;KeI386ReleaseLid
-;KeI386SetGdtSelector
-KeInitializeApc@32
-;KeInitializeCrashDumpHeader
-KeInitializeDeviceQueue@4
-KeInitializeDpc@12
-KeInitializeEvent@12
-@KeInitializeGuardedMutex@4
-KeInitializeInterrupt@44
-KeInitializeMutant@8
-KeInitializeMutex@8
-KeInitializeQueue@8
-KeInitializeSemaphore@12
-KeInitializeSpinLock@4
-;KeInitializeThreadedDpc
-KeInitializeTimer@4
-KeInitializeTimerEx@8
-KeInsertByKeyDeviceQueue@12
-KeInsertDeviceQueue@8
-KeInsertHeadQueue@8
-KeInsertQueue@8
-KeInsertQueueApc@16
-KeInsertQueueDpc@12
-KeInvalidateAllCaches@0
-KeIpiGenericCall@8
-KeIsAttachedProcess@0
-KeIsExecutingDpc@0
-;KeIsWaitListEmpty
-KeLeaveCriticalRegion@0=_KeLeaveCriticalRegion@0
-KeLeaveGuardedRegion@0=_KeLeaveGuardedRegion@0
-KeLoaderBlock DATA
-KeNumberProcessors DATA
-KeProfileInterrupt@4
-KeProfileInterruptWithSource@8
-KePulseEvent@12
-KeQueryActiveProcessors@0
-KeQueryInterruptTime@0
-KeQueryPriorityThread@4
-KeQueryRuntimeThread@8
-KeQuerySystemTime@4
-KeQueryTickCount@4
-KeQueryTimeIncrement@0
-KeRaiseUserException@4
-KeReadStateEvent@4
-KeReadStateMutant@4
-KeReadStateMutex@4=KeReadStateMutant@4
-KeReadStateQueue@4
-KeReadStateSemaphore@4
-KeReadStateTimer@4
-KeRegisterBugCheckCallback@20
-KeRegisterBugCheckReasonCallback@16
-;KeRegisterNmiCallback
-@KeReleaseGuardedMutex@4
-@KeReleaseGuardedMutexUnsafe@4
-;KeReleaseInStackQueuedSpinLockForDpc
-@KeReleaseInStackQueuedSpinLockFromDpcLevel@4
-KeReleaseInterruptSpinLock@8
-KeReleaseMutant@16
-KeReleaseMutex@8
-KeReleaseSemaphore@16
-;KeReleaseSpinLockForDpc
-KeReleaseSpinLockFromDpcLevel@4
-KeRemoveByKeyDeviceQueue@8
-KeRemoveByKeyDeviceQueueIfBusy@8
-KeRemoveDeviceQueue@4
-KeRemoveEntryDeviceQueue@8
-KeRemoveQueue@12
-KeRemoveQueueDpc@4
-KeRemoveSystemServiceTable@4
-KeResetEvent@4
-KeRestoreFloatingPointState@4
-KeRevertToUserAffinityThread@0
-KeRundownQueue@4
-KeSaveFloatingPointState@4
-KeSaveStateForHibernate
-KeServiceDescriptorTable DATA
-KeSetAffinityThread@8
-KeSetBasePriorityThread@8
-KeSetDmaIoCoherency@4
-KeSetEvent@12
-KeSetEventBoostPriority@8
-KeSetIdealProcessorThread@8
-KeSetImportanceDpc@8
-KeSetKernelStackSwapEnable@4
-KeSetPriorityThread@8
-KeSetProfileIrql@4
-KeSetSystemAffinityThread@4
-KeSetTargetProcessorDpc@8
-KeSetTimeIncrement@8
-KeSetTimer@16
-KeSetTimerEx@20
-;KeSignalCallDpcDone
-;KeSignalCallDpcSynchronize
-KeStackAttachProcess@8
-KeSynchronizeExecution@12
-KeTerminateThread@4
-;KeTestSpinLock
-KeTickCount DATA
-@KeTryToAcquireGuardedMutex@4
-@KeTryToAcquireSpinLockAtDpcLevel@4
-KeUnstackDetachProcess@4
-KeUpdateRunTime@4
-KeUpdateSystemTime@0
-KeUserModeCallback@20
-KeWaitForMultipleObjects@32
-KeWaitForMutexObject@20=KeWaitForSingleObject@20
-KeWaitForSingleObject@20
-@KefAcquireSpinLockAtDpcLevel@4
-@KefReleaseSpinLockFromDpcLevel@4
-Kei386EoiHelper@0
-@KiAcquireSpinLock@4
-;KiBugCheckData DATA
-KiCheckForKernelApcDelivery@0
-KiCoprocessorError@0
-KiDeliverApc@12
-KiDispatchInterrupt@0
-KiEnableTimerWatchdog
-KiIpiServiceRoutine@8
-@KiReleaseSpinLock@4
-KiUnexpectedInterrupt
-;Kii386SpinOnSpinLock
-LdrAccessResource@16
-LdrEnumResources@20
-LdrFindResourceDirectory_U@16
-LdrFindResource_U@16
-LpcPortObjectType DATA
-LpcRequestPort@8
-LpcRequestWaitReplyPort@12
-LsaCallAuthenticationPackage@28
-LsaDeregisterLogonProcess@8
-LsaFreeReturnBuffer@4
-LsaLogonUser@56
-LsaLookupAuthenticationPackage@12
-LsaRegisterLogonProcess@12
-Mm64BitPhysicalAddress DATA
-MmAddPhysicalMemory@8
-MmAddVerifierThunks@8
-MmAdjustWorkingSetSize@12
-MmAdvanceMdl@8
-MmAllocateContiguousMemory@12
-MmAllocateContiguousMemorySpecifyCache@32
-MmAllocateMappingAddress@8
-MmAllocateNonCachedMemory@4
-MmAllocatePagesForMdl@28
-;MmAllocatePagesForMdlEx
-MmBuildMdlForNonPagedPool@4
-MmCanFileBeTruncated@8
-;MmCommitSessionMappedView
-MmCreateMdl@12
-;MmCreateMirror
-MmCreateSection@32
-MmDisableModifiedWriteOfSection@4
-MmFlushImageSection@8
-MmForceSectionClosed@8
-MmFreeContiguousMemory@4
-MmFreeContiguousMemorySpecifyCache@12
-MmFreeMappingAddress@8
-MmFreeNonCachedMemory@8
-MmFreePagesFromMdl@4
-MmGetPhysicalAddress@4
-MmGetPhysicalMemoryRanges@0
-MmGetSystemRoutineAddress@4
-MmGetVirtualForPhysical@8
-MmGrowKernelStack@4
-MmHighestUserAddress DATA
-MmIsAddressValid@4
-MmIsDriverVerifying@4
-;MmIsIoSpaceActive
-MmIsNonPagedSystemAddressValid@4
-MmIsRecursiveIoFault@0
-MmIsThisAnNtAsSystem@0
-MmIsVerifierEnabled@4
-MmLockPagableDataSection@4
-MmLockPagableImageSection@4=MmLockPagableDataSection@4
-MmLockPagableSectionByHandle@4
-MmMapIoSpace@16
-MmMapLockedPages@8
-MmMapLockedPagesSpecifyCache@24
-MmMapLockedPagesWithReservedMapping@16
-MmMapMemoryDumpMdl@4
-MmMapUserAddressesToPage@12
-MmMapVideoDisplay@16
-MmMapViewInSessionSpace@12
-MmMapViewInSystemSpace@12
-MmMapViewOfSection@40
-MmMarkPhysicalMemoryAsBad@8
-MmMarkPhysicalMemoryAsGood@8
-MmPageEntireDriver@4
-MmPrefetchPages@8
-MmProbeAndLockPages@12
-MmProbeAndLockProcessPages@16
-MmProbeAndLockSelectedPages@16
-MmProtectMdlSystemAddress@8
-MmQuerySystemSize@0
-MmRemovePhysicalMemory@8
-MmResetDriverPaging@4
-MmSectionObjectType DATA
-MmSecureVirtualMemory@12
-MmSetAddressRangeModified@8
-MmSetBankedSection@24
-MmSizeOfMdl@8
-MmSystemRangeStart DATA
-MmTrimAllSystemPagableMemory@4
-MmUnlockPagableImageSection@4
-MmUnlockPages@4
-MmUnmapIoSpace@8
-MmUnmapLockedPages@8
-MmUnmapReservedMapping@12
-MmUnmapVideoDisplay@8
-MmUnmapViewInSessionSpace@4
-MmUnmapViewInSystemSpace@4
-MmUnmapViewOfSection@8
-MmUnsecureVirtualMemory@4
-MmUserProbeAddress DATA
-NlsAnsiCodePage DATA
-NlsLeadByteInfo DATA
-NlsMbCodePageTag DATA
-NlsMbOemCodePageTag DATA
-NlsOemCodePage DATA
-NlsOemLeadByteInfo=_NlsOemLeadByteInfo
-NtAddAtom@12
-NtAdjustPrivilegesToken@24
-NtAlertThread@4
-NtAllocateLocallyUniqueId@4
-NtAllocateUuids@16
-NtAllocateVirtualMemory@24
-NtBuildNumber DATA
-NtClose@4
-NtConnectPort@32
-NtCreateEvent@20
-NtCreateFile@44
-NtCreateSection@28
-NtCreateTimer@16
-NtDeleteAtom@4
-NtDeleteFile@4
-NtDeviceIoControlFile@40
-NtDuplicateObject@28
-NtDuplicateToken@24
-NtFindAtom@12
-NtFreeVirtualMemory@16
-NtFsControlFile@40
-NtGlobalFlag DATA
-NtLockFile@40
-NtMakePermanentObject@4
-NtMapViewOfSection@40
-NtNotifyChangeDirectoryFile@36
-NtOpenEvent@12
-NtOpenFile@24
-NtOpenProcess@16
-NtOpenProcessToken@12
-NtOpenProcessTokenEx@16
-NtOpenThread@16
-NtOpenThreadToken@16
-NtOpenThreadTokenEx@20
-NtQueryDirectoryFile@44
-NtQueryEaFile@36
-NtQueryInformationAtom@20
-NtQueryInformationFile@20
-NtQueryInformationProcess@20
-NtQueryInformationThread@20
-NtQueryInformationToken@20
-NtQueryQuotaInformationFile@36
-NtQuerySecurityObject@20
-NtQuerySystemInformation@16
-NtQueryVolumeInformationFile@20
-NtReadFile@36
-NtRequestPort@8
-NtRequestWaitReplyPort@12
-NtSetEaFile@16
-NtSetEvent@8
-NtSetInformationFile@20
-NtSetInformationProcess@16
-NtSetInformationThread@16
-NtSetQuotaInformationFile@16
-NtSetSecurityObject@12
-NtSetVolumeInformationFile@20
-NtShutdownSystem@4
-NtTraceEvent@16
-NtUnlockFile@20
-NtVdmControl@8
-NtWaitForSingleObject@12
-NtWriteFile@36
-ObAssignSecurity@16
-ObCheckCreateObjectAccess@28
-ObCheckObjectAccess@20
-ObCloseHandle@8
-ObCreateObject@36
-ObCreateObjectType@16
-;ObDeleteCapturedInsertInfo
-ObDereferenceObject@4
-ObDereferenceObjectDeferDelete@4
-ObDereferenceSecurityDescriptor@8
-ObFindHandleForObject@20
-ObGetObjectSecurity@12
-ObInsertObject@24
-ObIsKernelHandle@4
-ObLogSecurityDescriptor@12
-ObMakeTemporaryObject@4
-ObOpenObjectByName@28
-ObOpenObjectByPointer@28
-ObQueryNameString@16
-ObQueryObjectAuditingByHandle@8
-ObReferenceObjectByHandle@24
-ObReferenceObjectByName@32
-ObReferenceObjectByPointer@16
-ObReferenceSecurityDescriptor@8
-ObReleaseObjectSecurity@8
-;ObSetHandleAttributes@12
-ObSetSecurityDescriptorInfo@24
-ObSetSecurityObjectByPointer@12
-@ObfDereferenceObject@4
-@ObfReferenceObject@4
-;PfxFindPrefix
-;PfxInitialize
-;PfxInsertPrefix
-;PfxRemovePrefix
-PoCallDriver@8
-;PoCancelDeviceNotify
-PoQueueShutdownWorkItem@4
-PoRegisterDeviceForIdleDetection@16
-;PoRegisterDeviceNotify
-PoRegisterSystemState@8
-PoRequestPowerIrp@24
-;PoRequestShutdownEvent
-;PoSetHiberRange
-PoSetDeviceBusy@4
-PoSetPowerState@12
-PoSetSystemState@4
-;PoShutdownBugCheck
-PoStartNextPowerIrp@4
-PoUnregisterSystemState@4
-ProbeForRead@12
-ProbeForWrite@12
-PsAssignImpersonationToken@8
-PsChargePoolQuota@12
-PsChargeProcessNonPagedPoolQuota@4=PsDereferenceImpersonationToken@4
-PsChargeProcessPagedPoolQuota@8
-PsChargeProcessPoolQuota@12
-PsCreateSystemProcess@12
-PsCreateSystemThread@28
-PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4
-PsDereferencePrimaryToken@4
-PsDisableImpersonation@8
-PsEstablishWin32Callouts@4
-PsGetContextThread@12
-PsGetCurrentProcess@0=IoGetCurrentProcess@0
-PsGetCurrentProcessId@0
-PsGetCurrentProcessSessionId@0
-PsGetCurrentProcessWin32Process@0
-PsGetCurrentThread@0=KeGetCurrentThread@0
-PsGetCurrentThreadId@0
-PsGetCurrentThreadPreviousMode@0
-;PsGetCurrentThreadProcess
-;PsGetCurrentThreadProcessId
-PsGetCurrentThreadStackBase@0
-PsGetCurrentThreadStackLimit@0
-;PsGetCurrentThreadTeb
-PsGetCurrentThreadWin32Thread@0
-;PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion
-PsGetJobLock@4
-PsGetJobSessionId@4
-PsGetJobUIRestrictionsClass@4
-PsGetProcessCreateTimeQuadPart@4
-PsGetProcessDebugPort@4
-PsGetProcessExitProcessCalled@4
-PsGetProcessExitStatus@4
-PsGetProcessExitTime@0
-PsGetProcessId@4
-PsGetProcessImageFileName@4
-PsGetProcessInheritedFromUniqueProcessId@4
-PsGetProcessJob@4
-PsGetProcessPeb@4
-PsGetProcessPriorityClass@4
-PsGetProcessSectionBaseAddress@4
-PsGetProcessSecurityPort@4
-PsGetProcessSessionId@4
-;PsGetProcessSessionIdEx
-PsGetProcessWin32Process@4
-PsGetProcessWin32WindowStation@4
-PsGetThreadFreezeCount@4
-PsGetThreadHardErrorsAreDisabled@4
-PsGetThreadId@4
-PsGetThreadProcess@4
-PsGetThreadProcessId@4
-PsGetThreadSessionId@4
-PsGetThreadTeb@4
-PsGetThreadWin32Thread@4
-PsGetVersion@16
-PsImpersonateClient@20
-PsInitialSystemProcess DATA
-PsIsProcessBeingDebugged@4
-;PsIsSystemProcess
-PsIsSystemThread@4
-PsIsThreadImpersonating@4
-PsIsThreadTerminating@4
-PsJobType DATA
-PsLookupProcessByProcessId@8
-PsLookupProcessThreadByCid@12
-PsLookupThreadByThreadId@8
-PsProcessType=_PsProcessType
-PsReferenceImpersonationToken@16
-PsReferencePrimaryToken@4
-PsRemoveCreateThreadNotifyRoutine@4
-PsRemoveLoadImageNotifyRoutine@4
-PsRestoreImpersonation@8
-PsReturnPoolQuota@12
-PsReturnProcessNonPagedPoolQuota@8
-PsReturnProcessPagedPoolQuota@8
-PsRevertThreadToSelf@4
-PsRevertToSelf@0
-PsSetContextThread@12
-PsSetCreateProcessNotifyRoutine@8
-PsSetCreateThreadNotifyRoutine@4
-PsSetJobUIRestrictionsClass@8
-PsSetLegoNotifyRoutine@4
-PsSetLoadImageNotifyRoutine@4
-PsSetProcessPriorityByClass@8
-PsSetProcessPriorityClass@8
-PsSetProcessSecurityPort@8
-PsSetProcessWin32Process@8
-PsSetProcessWindowStation@8
-PsSetThreadHardErrorsAreDisabled@8
-PsSetThreadWin32Thread@8
-PsTerminateSystemThread@4
-PsThreadType=_PsThreadType
-;PsWrapApcWow64Thread
-READ_REGISTER_BUFFER_UCHAR@12
-READ_REGISTER_BUFFER_ULONG@12
-READ_REGISTER_BUFFER_USHORT@12
-READ_REGISTER_UCHAR@4
-READ_REGISTER_ULONG@4
-READ_REGISTER_USHORT@4
-KeRosDumpStackFrames@8
-RtlAbsoluteToSelfRelativeSD@12
-RtlAddAccessAllowedAce@16
-RtlAddAccessAllowedAceEx@20
-RtlAddAce@20
-RtlAddAtomToAtomTable@12
-RtlAddRange@36
-RtlAllocateAndInitializeSid@44
-RtlAllocateHeap@12
-RtlAnsiCharToUnicodeChar@4
-RtlAnsiStringToUnicodeSize@4=RtlxAnsiStringToUnicodeSize@4
-RtlAnsiStringToUnicodeString@12
-RtlAppendAsciizToString@8
-RtlAppendStringToString@8
-RtlAppendUnicodeStringToString@8
-RtlAppendUnicodeToString@8
-RtlAreAllAccessesGranted@8
-RtlAreAnyAccessesGranted@8
-RtlAreBitsClear@12
-RtlAreBitsSet@12
-RtlAssert@16
-RtlCaptureContext@4
-RtlCaptureStackBackTrace@16
-RtlCharToInteger@12
-RtlCheckRegistryKey@8
-RtlClearAllBits@4
-RtlClearBit@8
-RtlClearBits@12
-RtlCompareMemory@12
-RtlCompareMemoryUlong@12
-RtlCompareString@12
-RtlCompareUnicodeString@12
-RtlCompressBuffer@32
-RtlCompressChunks@28
-RtlConvertLongToLargeInteger@4
-RtlConvertSidToUnicodeString@12
-RtlConvertUlongToLargeInteger@4
-RtlCopyLuid@8
-RtlCopyRangeList@8
-RtlCopySid@12
-RtlCopyString@8
-RtlCopyUnicodeString@8
-RtlCreateAcl@12
-RtlCreateAtomTable@8
-RtlCreateHeap@24
-RtlCreateRegistryKey@8
-RtlCreateSecurityDescriptor@8
-RtlCreateSystemVolumeInformationFolder@4
-RtlCreateUnicodeString@8
-RtlCustomCPToUnicodeN@24
-RtlDecompressBuffer@24
-RtlDecompressChunks@28
-RtlDecompressFragment@32
-RtlDelete@4
-RtlDeleteAce@8
-RtlDeleteAtomFromAtomTable@8
-RtlDeleteElementGenericTable@8
-RtlDeleteElementGenericTableAvl@8
-RtlDeleteNoSplay@8
-RtlDeleteOwnersRanges@8
-RtlDeleteRange@24
-RtlDeleteRegistryValue@12
-RtlDescribeChunk@20
-RtlDestroyAtomTable@4
-RtlDestroyHeap@4
-RtlDowncaseUnicodeString@12
-RtlEmptyAtomTable@8
-RtlEnlargedIntegerMultiply@8
-RtlEnlargedUnsignedDivide@16
-RtlEnlargedUnsignedMultiply@8
-RtlEnumerateGenericTable@8
-RtlEnumerateGenericTableAvl@8
-RtlEnumerateGenericTableLikeADirectory@28
-RtlEnumerateGenericTableWithoutSplaying@8
-RtlEnumerateGenericTableWithoutSplayingAvl@8
-RtlEqualLuid@8
-RtlEqualSid@8
-RtlEqualString@12
-RtlEqualUnicodeString@12
-RtlExtendedIntegerMultiply@12
-RtlExtendedLargeIntegerDivide@16
-RtlExtendedMagicDivide@20
-RtlFillMemory@12
-RtlFillMemoryUlong@12
-RtlFindClearBits@12
-RtlFindClearBitsAndSet@12
-RtlFindClearRuns@16
-RtlFindFirstRunClear@8
-RtlFindLastBackwardRunClear@12
-RtlFindLeastSignificantBit@8
-RtlFindLongestRunClear@8
-RtlFindMessage@20
-RtlFindMostSignificantBit@8
-RtlFindNextForwardRunClear@12
-RtlFindRange@48
-RtlFindSetBits@12
-RtlFindSetBitsAndClear@12
-RtlFindUnicodePrefix@12
-RtlFormatCurrentUserKeyPath@4
-RtlFreeAnsiString@4
-RtlFreeHeap@12
-RtlFreeOemString@4
-RtlFreeRangeList@4
-RtlFreeUnicodeString@4
-RtlGUIDFromString@8
-RtlGenerate8dot3Name@16
-RtlGetAce@12
-RtlGetCallersAddress@8
-RtlGetCompressionWorkSpaceSize@12
-RtlGetDaclSecurityDescriptor@16
-RtlGetDefaultCodePage@8
-RtlGetElementGenericTable@8
-RtlGetElementGenericTableAvl@8
-RtlGetFirstRange@12
-RtlGetGroupSecurityDescriptor@12
-RtlGetNextRange@12
-RtlGetNtGlobalFlags@0
-RtlGetOwnerSecurityDescriptor@12
-RtlGetSaclSecurityDescriptor@16
-RtlGetSetBootStatusData@24
-RtlGetVersion@4
-RtlHashUnicodeString@16
-RtlImageDirectoryEntryToData@16
-RtlImageNtHeader@4
-RtlInitAnsiString@8
-RtlInitAnsiStringEx@8
-RtlInitCodePageTable@8
-RtlInitString@8
-RtlInitUnicodeString@8
-RtlInitUnicodeStringEx@8
-RtlInitializeBitMap@12
-RtlInitializeGenericTable@20
-RtlInitializeGenericTableAvl@20
-RtlInitializeRangeList@4
-RtlInitializeSid@12
-RtlInitializeUnicodePrefix@4
-RtlInsertElementGenericTable@16
-RtlInsertElementGenericTableAvl@16
-RtlInsertElementGenericTableFull@24
-RtlInsertElementGenericTableFullAvl@24
-RtlInsertUnicodePrefix@12
-RtlInt64ToUnicodeString@16
-RtlIntegerToChar@16
-RtlIntegerToUnicode@16
-RtlIntegerToUnicodeString@12
-RtlInvertRangeList@8
-RtlIpv4AddressToStringA@8
-RtlIpv4AddressToStringExA@16
-RtlIpv4AddressToStringExW@16
-RtlIpv4AddressToStringW@8
-RtlIpv4StringToAddressA@16
-RtlIpv4StringToAddressExA@16
-RtlIpv4StringToAddressExW@16
-RtlIpv4StringToAddressW@16
-RtlIpv6AddressToStringA@8
-RtlIpv6AddressToStringExA@20
-RtlIpv6AddressToStringExW@20
-RtlIpv6AddressToStringW@8
-RtlIpv6StringToAddressA@12
-RtlIpv6StringToAddressExA@16
-RtlIpv6StringToAddressExW@16
-RtlIpv6StringToAddressW@12
-RtlIsGenericTableEmpty@4
-RtlIsGenericTableEmptyAvl@4
-RtlIsNameLegalDOS8Dot3@12
-RtlIsRangeAvailable@40
-RtlIsValidOemCharacter@4
-RtlLargeIntegerAdd@16
-RtlLargeIntegerArithmeticShift@12
-RtlLargeIntegerDivide@20
-RtlLargeIntegerNegate@8
-RtlLargeIntegerShiftLeft@12
-RtlLargeIntegerShiftRight@12
-RtlLargeIntegerSubtract@16
-RtlLengthRequiredSid@4
-RtlLengthSecurityDescriptor@4
-RtlLengthSid@4
-RtlLockBootStatusData@4
-RtlLookupAtomInAtomTable@12
-RtlLookupElementGenericTable@8
-RtlLookupElementGenericTableAvl@8
-RtlLookupElementGenericTableFull@16
-RtlLookupElementGenericTableFullAvl@16
-RtlMapGenericMask@8
-RtlMapSecurityErrorToNtStatus@4
-RtlMergeRangeLists@16
-RtlMoveMemory@12
-RtlMultiByteToUnicodeN@20
-RtlMultiByteToUnicodeSize@12
-RtlNextUnicodePrefix@8
-RtlNtStatusToDosError@4
-RtlNtStatusToDosErrorNoTeb@4
-RtlNumberGenericTableElements@4
-RtlNumberGenericTableElementsAvl@4
-RtlNumberOfClearBits@4
-RtlNumberOfSetBits@4
-RtlOemStringToCountedUnicodeString@12
-RtlOemStringToUnicodeSize@4=RtlxOemStringToUnicodeSize@4
-RtlOemStringToUnicodeString@12
-RtlOemToUnicodeN@20
-RtlPinAtomInAtomTable@8
-@RtlPrefetchMemoryNonTemporal@8
-RtlPrefixString@12
-RtlPrefixUnicodeString@12
-RtlQueryAtomInAtomTable@24
-RtlQueryRegistryValues@20
-RtlQueryTimeZoneInformation@4
-RtlRaiseException@4
-RtlRandom@4
-RtlRandomEx@4
-RtlRealPredecessor@4
-RtlRealSuccessor@4
-RtlRemoveUnicodePrefix@8
-RtlReserveChunk@20
-RtlSecondsSince1970ToTime@8
-RtlSecondsSince1980ToTime@8
-RtlSelfRelativeToAbsoluteSD@44
-RtlSelfRelativeToAbsoluteSD2@8
-RtlSetAllBits@4
-RtlSetBit@8
-RtlSetBits@12
-RtlSetDaclSecurityDescriptor@16
-RtlSetGroupSecurityDescriptor@12
-RtlSetOwnerSecurityDescriptor@12
-RtlSetSaclSecurityDescriptor@16
-RtlSetTimeZoneInformation@4
-RtlSizeHeap@12
-RtlSplay@4
-RtlStringFromGUID@8
-RtlSubAuthorityCountSid@4
-RtlSubAuthoritySid@8
-RtlSubtreePredecessor@4
-RtlSubtreeSuccessor@4
-RtlTestBit@8
-RtlTimeFieldsToTime@8
-RtlTimeToElapsedTimeFields@8
-RtlTimeToSecondsSince1970@8
-RtlTimeToSecondsSince1980@8
-RtlTimeToTimeFields@8
-;RtlTraceDatabaseAdd
-;RtlTraceDatabaseCreate
-;RtlTraceDatabaseDestroy
-;RtlTraceDatabaseEnumerate
-;RtlTraceDatabaseFind
-;RtlTraceDatabaseLock
-;RtlTraceDatabaseUnlock
-;RtlTraceDatabaseValidate
-@RtlUlongByteSwap@4
-@RtlUlonglongByteSwap@8
-RtlUnicodeStringToAnsiSize@4=RtlxUnicodeStringToAnsiSize@4
-RtlUnicodeStringToAnsiString@12
-RtlUnicodeStringToCountedOemString@12
-RtlUnicodeStringToInteger@12
-RtlUnicodeStringToOemSize@4=RtlxUnicodeStringToOemSize@4
-RtlUnicodeStringToOemString@12
-RtlUnicodeToCustomCPN@24
-RtlUnicodeToMultiByteN@20
-RtlUnicodeToMultiByteSize@12
-RtlUnicodeToOemN@20
-RtlUnlockBootStatusData@4
-RtlUnwind@16
-RtlUpcaseUnicodeChar@4
-RtlUpcaseUnicodeString@12
-RtlUpcaseUnicodeStringToAnsiString@12
-RtlUpcaseUnicodeStringToCountedOemString@12
-RtlUpcaseUnicodeStringToOemString@12
-RtlUpcaseUnicodeToCustomCPN@24
-RtlUpcaseUnicodeToMultiByteN@20
-RtlUpcaseUnicodeToOemN@20
-RtlUpperChar@4
-RtlUpperString@8
-@RtlUshortByteSwap@4
-RtlValidRelativeSecurityDescriptor@12
-RtlValidSecurityDescriptor@4
-RtlValidSid@4
-RtlVerifyVersionInfo@16
-RtlVolumeDeviceToDosName@8
-RtlWalkFrameChain@12
-RtlWriteRegistryValue@24
-RtlZeroHeap@8
-RtlZeroMemory@8
-RtlxAnsiStringToUnicodeSize@4
-RtlxOemStringToUnicodeSize@4
-RtlxUnicodeStringToAnsiSize@4
-RtlxUnicodeStringToOemSize@4
-SeAccessCheck@40
-SeAppendPrivileges@8
-SeAssignSecurity@28
-SeAssignSecurityEx@36
-SeAuditHardLinkCreation@12
-SeAuditingFileEvents@8
-SeAuditingFileEventsWithContext@12
-SeAuditingFileOrGlobalEvents@12
-SeAuditingHardLinkEvents@8
-SeAuditingHardLinkEventsWithContext@12
-SeCaptureSecurityDescriptor@20
-SeCaptureSubjectContext@4
-SeCloseObjectAuditAlarm@12
-SeCreateAccessState@16
-SeCreateClientSecurity@16
-SeCreateClientSecurityFromSubjectContext@16
-SeDeassignSecurity@4
-SeDeleteAccessState@4
-SeDeleteObjectAuditAlarm@8
-SeExports DATA
-SeFilterToken@24
-SeFreePrivileges@4
-SeImpersonateClient@8
-SeImpersonateClientEx@8
-SeLockSubjectContext@4
-SeMarkLogonSessionForTerminationNotification@4
-SeOpenObjectAuditAlarm@36
-SeOpenObjectForDeleteAuditAlarm@36
-SePrivilegeCheck@12
-SePrivilegeObjectAuditAlarm@24
-SePublicDefaultDacl DATA
-SeQueryAuthenticationIdToken@8
-SeQueryInformationToken@12
-SeQuerySecurityDescriptorInfo@16
-SeQuerySessionIdToken@8
-SeRegisterLogonSessionTerminatedRoutine@4
-SeReleaseSecurityDescriptor@12
-SeReleaseSubjectContext@4
-SeSetAccessStateGenericMapping@8
-;SeSetAuditParameter
-SeSetSecurityDescriptorInfo@24
-SeSetSecurityDescriptorInfoEx@28
-SeSinglePrivilegeCheck@12
-SeSystemDefaultDacl DATA
-SeTokenImpersonationLevel@4
-SeTokenIsAdmin@4
-SeTokenIsRestricted@4
-SeTokenIsWriteRestricted@4
-SeTokenType@4
-SeUnlockSubjectContext@4
-SeUnregisterLogonSessionTerminatedRoutine@4
-SeValidSecurityDescriptor@8
-VerSetConditionMask@16
-;VfFailDeviceNode
-;VfFailDriver
-;VfFailSystemBIOS
-;VfIsVerificationEnabled
-WRITE_REGISTER_BUFFER_UCHAR@12
-WRITE_REGISTER_BUFFER_ULONG@12
-WRITE_REGISTER_BUFFER_USHORT@12
-WRITE_REGISTER_UCHAR@8
-WRITE_REGISTER_ULONG@8
-WRITE_REGISTER_USHORT@8
-;WmiFlushTrace
-;WmiGetClock
-;WmiQueryTrace
-;WmiQueryTraceInformation
-;WmiStartTrace
-;WmiStopTrace
-;WmiTraceFastEvent
-;WmiTraceMessage
-;WmiTraceMessageVa
-;WmiUpdateTrace
-;XIPDispatch
-ZwAccessCheckAndAuditAlarm@44
-ZwAddBootEntry@8
-ZwAddDriverEntry@8
-ZwAdjustPrivilegesToken@24
-ZwAlertThread@4
-ZwAllocateVirtualMemory@24
-ZwAssignProcessToJobObject@8
-ZwCancelIoFile@8
-ZwCancelTimer@8
-ZwClearEvent@4
-ZwClose@4
-ZwCloseObjectAuditAlarm@12
-ZwConnectPort@32
-ZwCreateDirectoryObject@12
-ZwCreateEvent@20
-ZwCreateFile@44
-ZwCreateJobObject@12
-ZwCreateKey@28
-ZwCreateSection@28
-ZwCreateSymbolicLinkObject@16
-ZwCreateTimer@16
-ZwDeleteBootEntry@4
-ZwDeleteDriverEntry@4
-ZwDeleteFile@4
-ZwDeleteKey@4
-ZwDeleteValueKey@8
-ZwDeviceIoControlFile@40
-ZwDisplayString@4
-ZwDuplicateObject@28
-ZwDuplicateToken@24
-ZwEnumerateBootEntries@8
-ZwEnumerateDriverEntries@8
-ZwEnumerateKey@24
-ZwEnumerateValueKey@24
-ZwFlushInstructionCache@12
-ZwFlushKey@4
-ZwFlushVirtualMemory@16
-ZwFreeVirtualMemory@16
-ZwFsControlFile@40
-ZwInitiatePowerAction@16
-ZwIsProcessInJob@8
-ZwLoadDriver@4
-ZwLoadKey@8
-ZwMakeTemporaryObject@4
-ZwMapViewOfSection@40
-ZwModifyBootEntry@4
-ZwModifyDriverEntry@4
-ZwNotifyChangeKey@40
-ZwOpenDirectoryObject@12
-ZwOpenEvent@12
-ZwOpenFile@24
-ZwOpenJobObject@12
-ZwOpenKey@12
-ZwOpenProcess@16
-ZwOpenProcessToken@12
-ZwOpenProcessTokenEx@16
-ZwOpenSection@12
-ZwOpenSymbolicLinkObject@12
-ZwOpenThread@16
-ZwOpenThreadToken@16
-ZwOpenThreadTokenEx@20
-ZwOpenTimer@12
-ZwPowerInformation@20
-ZwPulseEvent@8
-ZwQueryBootEntryOrder@8
-ZwQueryBootOptions@8
-ZwQueryDefaultLocale@8
-ZwQueryDefaultUILanguage@4
-ZwQueryDirectoryFile@44
-ZwQueryDirectoryObject@28
-ZwQueryDriverEntryOrder@8
-ZwQueryEaFile@36
-ZwQueryFullAttributesFile@8
-ZwQueryInformationAtom@20
-ZwQueryInformationFile@20
-ZwQueryInformationJobObject@20
-ZwQueryInformationProcess@20
-ZwQueryInformationThread@20
-ZwQueryInformationToken@20
-ZwQueryInstallUILanguage@4
-ZwQueryKey@20
-ZwQueryObject@20
-ZwQuerySection@20
-ZwQuerySecurityObject@20
-ZwQuerySymbolicLinkObject@12
-ZwQuerySystemInformation@16
-ZwQueryValueKey@24
-ZwQueryVolumeInformationFile@20
-ZwReadFile@36
-ZwReplaceKey@12
-ZwRequestWaitReplyPort@12
-ZwResetEvent@8
-ZwRestoreKey@12
-ZwSaveKey@8
-ZwSaveKeyEx@12
-ZwSecureConnectPort@36
-ZwSetBootEntryOrder@8
-ZwSetBootOptions@8
-ZwSetDefaultLocale@8
-ZwSetDefaultUILanguage@4
-ZwSetDriverEntryOrder@8
-ZwSetEaFile@16
-ZwSetEvent@8
-ZwSetInformationFile@20
-ZwSetInformationJobObject@16
-ZwSetInformationObject@16
-ZwSetInformationProcess@16
-ZwSetInformationThread@16
-ZwSetSecurityObject@12
-ZwSetSystemInformation@12
-ZwSetSystemTime@8
-ZwSetTimer@28
-ZwSetValueKey@24
-ZwSetVolumeInformationFile@20
-ZwTerminateJobObject@8
-ZwTerminateProcess@8
-ZwTranslateFilePath@16
-ZwUnloadDriver@4
-ZwUnloadKey@4
-ZwUnmapViewOfSection@8
-ZwWaitForMultipleObjects@20
-ZwWaitForSingleObject@12
-ZwWriteFile@36
-ZwYieldExecution@0
-;_CIcos
-;_CIsin
-;_CIsqrt
-_abnormal_termination
-_alldiv
-_alldvrm
-_allmul
-_alloca_probe
-_allrem
-_allshl
-_allshr
-_aulldiv
-_aulldvrm
-_aullrem
-_aullshr
-_except_handler2
-_except_handler3
-_global_unwind2
-_itoa
-_itow
-_local_unwind2
-_purecall
-_snprintf
-_snwprintf
-_stricmp
-_strlwr
-_strnicmp
-_strnset
-_strrev
-_strset
-_strupr
-_vsnprintf
-_vsnwprintf
-_wcsicmp
-_wcslwr
-_wcsnicmp
-_wcsnset
-_wcsrev
-_wcsupr
-atoi
-atol
-isdigit
-islower
-isprint
-isspace
-isupper
-isxdigit
-mbstowcs
-mbtowc
-memchr
-memcpy
-memcmp
-memmove
-memset
-qsort
-rand
-sprintf
-srand
-strcat
-strchr
-strcmp
-strcpy
-strlen
-strncat
-strncmp
-strncpy
-strrchr
-strspn
-strstr
-swprintf
-tolower
-toupper
-towlower
-towupper
-vDbgPrintEx
-vDbgPrintExWithPrefix
-vsprintf
-wcscat
-wcschr
-wcscmp
-wcscpy
-wcscspn
-wcslen
-wcsncat
-wcsncmp
-wcsncpy
-wcsrchr
-wcsspn
-wcsstr
-wcstombs
-wctomb
+  CcCanIWrite@16 @1
+  CcCopyRead@24 @2
+  CcCopyWrite@20 @3
+  CcDeferWrite@24 @4
+  CcFastCopyRead@24 @5
+  CcFastCopyWrite@16 @6
+  CcFastMdlReadWait @7 DATA
+  CcFastReadNotPossible @8 DATA
+  CcFastReadWait @9 DATA
+  CcFlushCache@16 @10
+  CcGetDirtyPages@16 @11
+  CcGetFileObjectFromBcb@4 @12
+  CcGetFileObjectFromSectionPtrs@4 @13
+  CcGetFlushedValidData@8 @14
+  CcGetLsnForFileObject@8 @15
+  CcInitializeCacheMap@20 @16
+  CcIsThereDirtyData@4 @17
+  CcMapData@24 @18
+  CcMdlRead@20 @19
+  CcMdlReadComplete@8 @20
+  CcMdlWriteAbort@8 @21
+  CcMdlWriteComplete@12 @22
+  CcPinMappedData@20 @23
+  CcPinRead@24 @24
+  CcPrepareMdlWrite@20 @25
+  CcPreparePinWrite@28 @26
+  CcPurgeCacheSection@16 @27
+  CcRemapBcb@4 @28
+  CcRepinBcb@4 @29
+  CcScheduleReadAhead@12 @30
+  CcSetAdditionalCacheAttributes@12 @31
+  CcSetBcbOwnerPointer@8 @32
+  CcSetDirtyPageThreshold@8 @33
+  CcSetDirtyPinnedData@8 @34
+  CcSetFileSizes@8 @35
+  CcSetLogHandleForFile@12 @36
+  CcSetReadAheadGranularity@8 @37
+  CcUninitializeCacheMap@12 @38
+  CcUnpinData@4 @39
+  CcUnpinDataForThread@8 @40
+  CcUnpinRepinnedBcb@12 @41
+  CcWaitForCurrentLazyWriterActivity@0 @42
+  CcZeroData@16 @43
+  CmRegisterCallback@12 @44
+  CmUnRegisterCallback@8 @45
+  DbgBreakPoint@0 @46
+  DbgBreakPointWithStatus@4 @47
+  DbgCommandString@8 @48
+  DbgLoadImageSymbols@12 @49
+  DbgPrint @50
+  DbgPrintEx @51
+  DbgPrintReturnControlC @52
+  DbgPrompt@12 @53
+  DbgQueryDebugFilterState@8 @54
+  DbgSetDebugFilterState@12 @55
+  @ExAcquireFastMutexUnsafe@4 @56
+  ExAcquireResourceExclusiveLite@8 @57
+  ExAcquireResourceSharedLite@8 @58
+  @ExAcquireRundownProtection@4=@ExfAcquireRundownProtection@4 @59
+  @ExAcquireRundownProtectionCacheAware@4=@ExfAcquireRundownProtectionCacheAware@4 @60
+  @ExAcquireRundownProtectionCacheAwareEx@8=@ExfAcquireRundownProtectionCacheAwareEx@8 @61
+  @ExAcquireRundownProtectionEx@8=@ExfAcquireRundownProtectionEx@8 @62
+  ExAcquireSharedStarveExclusive@8 @63
+  ExAcquireSharedWaitForExclusive@8 @64
+  ExAllocateCacheAwareRundownProtection@8 @65
+  ExAllocateFromPagedLookasideList@4=ExiAllocateFromPagedLookasideList@4 @66
+  ExAllocatePool@8 @67
+  ExAllocatePoolWithQuota@8 @68
+  ExAllocatePoolWithQuotaTag@12 @69
+  ExAllocatePoolWithTag@12 @70
+  ExAllocatePoolWithTagPriority@16 @71
+  ExConvertExclusiveToSharedLite@4 @72
+  ExCreateCallback@16 @73
+  ExDeleteNPagedLookasideList@4 @74
+  ExDeletePagedLookasideList@4 @75
+  ExDeleteResourceLite@4 @76
+  ExDesktopObjectType @77 DATA
+  ExDisableResourceBoostLite@4 @78
+  @ExEnterCriticalRegionAndAcquireFastMutexUnsafe@4 @79
+  ExEnterCriticalRegionAndAcquireResourceExclusive@4 @80
+  ExEnterCriticalRegionAndAcquireResourceShared@4 @81
+  ExEnterCriticalRegionAndAcquireSharedWaitForExclusive@4 @82
+  ExEnumHandleTable@16 @83
+  ExEventObjectType=_ExEventObjectType @84 DATA
+  ExExtendZone@12 @85
+  ExFreeCacheAwareRundownProtection@4 @86
+  ExFreePool@4 @87
+  ExFreePoolWithTag@8 @88
+  ExFreeToPagedLookasideList@8=ExiFreeToPagedLookasideList@8 @89
+  ExGetCurrentProcessorCounts@12 @90
+  ExGetCurrentProcessorCpuUsage@4 @91
+  ExGetExclusiveWaiterCount@4 @92
+  ExGetPreviousMode@0 @93
+  ExGetSharedWaiterCount@4 @94
+  ExInitializeNPagedLookasideList@28 @95
+  ExInitializePagedLookasideList@28 @96
+  ExInitializeResourceLite@4 @97
+  @ExInitializeRundownProtection@4=@ExfInitializeRundownProtection@4 @98
+  ExInitializeRundownProtectionCacheAware@8 @99
+  ExInitializeZone@16 @100
+  ExInterlockedAddLargeInteger@16 @101
+  @ExInterlockedAddLargeStatistic@8 @102
+  ExInterlockedAddUlong@12 @103
+  @ExInterlockedCompareExchange64@16 @104
+  ExInterlockedDecrementLong@8 @105
+  ExInterlockedExchangeUlong@12 @106
+  ExInterlockedExtendZone@16 @107
+  @ExInterlockedFlushSList@4 @108
+  ExInterlockedIncrementLong@8 @109
+  ExInterlockedInsertHeadList@12 @110
+  ExInterlockedInsertTailList@12 @111
+  ExInterlockedPopEntryList@8 @112
+  @ExInterlockedPopEntrySList@8 @113
+  ExInterlockedPushEntryList@12 @114
+  @ExInterlockedPushEntrySList@12 @115
+  ExInterlockedRemoveHeadList@8 @116
+  ExIsProcessorFeaturePresent@4 @117
+  ExIsResourceAcquiredExclusiveLite@4 @118
+  ExIsResourceAcquiredSharedLite@4 @119
+  ExLocalTimeToSystemTime@8 @120
+  ExNotifyCallback@12 @121
+  ExQueryPoolBlockSize@8 @122
+  ExQueueWorkItem@8 @123
+  ExRaiseAccessViolation@0 @124
+  ExRaiseDatatypeMisalignment@0 @125
+  ExRaiseException@4=RtlRaiseException@4 @126
+  ExRaiseHardError@24 @127
+  ExRaiseStatus@4=RtlRaiseStatus@4 @128
+  @ExReInitializeRundownProtection@4=@ExfReInitializeRundownProtection@4 @129
+  @ExReInitializeRundownProtectionCacheAware@4=@ExfReInitializeRundownProtectionCacheAware@4 @130
+  ExRegisterCallback@12 @131
+  ExReinitializeResourceLite@4 @132
+  @ExReleaseFastMutexUnsafe@4 @133
+  @ExReleaseFastMutexUnsafeAndLeaveCriticalRegion@4 @134
+  @ExReleaseResourceAndLeaveCriticalRegion@4 @135
+  ExReleaseResourceForThreadLite@8 @136
+  @ExReleaseResourceLite@4 @137
+  @ExReleaseRundownProtection@4=@ExfReleaseRundownProtection@4 @138
+  @ExReleaseRundownProtectionCacheAware@4=@ExfReleaseRundownProtectionCacheAware@4 @139
+  @ExReleaseRundownProtectionCacheAwareEx@8=@ExfReleaseRundownProtectionCacheAwareEx@8 @140
+  @ExReleaseRundownProtectionEx@8=@ExfReleaseRundownProtectionEx@8 @141
+  @ExRundownCompleted@4=@ExfRundownCompleted@4 @142
+  @ExRundownCompletedCacheAware@4=@ExfRundownCompletedCacheAware@4 @143
+  ExSemaphoreObjectType=_ExSemaphoreObjectType @144 DATA
+  ExSetResourceOwnerPointer@8 @145
+  ExSetTimerResolution@8 @146
+  ExSizeOfRundownProtectionCacheAware@0 @147
+  ExSystemExceptionFilter@0 @148
+  ExSystemTimeToLocalTime@8 @149
+  ExUnregisterCallback@4 @150
+  ExUuidCreate@4 @151
+  ExVerifySuite@4 @152
+  @ExWaitForRundownProtectionRelease@4=@ExfWaitForRundownProtectionRelease@4 @153
+  @ExWaitForRundownProtectionReleaseCacheAware@4=@ExfWaitForRundownProtectionReleaseCacheAware@4 @154
+  ExWindowStationObjectType @155 DATA
+  @ExfAcquirePushLockExclusive@4 @156
+  @ExfAcquirePushLockShared@4 @157
+  @ExfInterlockedAddUlong@12 @158
+  @ExfInterlockedCompareExchange64@12 @159
+  @ExfInterlockedInsertHeadList@12 @160
+  @ExfInterlockedInsertTailList@12 @161
+  @ExfInterlockedPopEntryList@8 @162
+  @ExfInterlockedPushEntryList@12 @163
+  @ExfInterlockedRemoveHeadList@8 @164
+  @ExfReleasePushLock@4 @165
+  @ExfReleasePushLockExclusive@4 @166
+  @ExfReleasePushLockShared@4 @167
+  @ExfTryToWakePushLock@4 @168
+  @ExfUnblockPushLock@8 @169
+  @Exfi386InterlockedDecrementLong@4 @170
+  @Exfi386InterlockedExchangeUlong@8 @171
+  @Exfi386InterlockedIncrementLong@4 @172
+  Exi386InterlockedDecrementLong@4 @173
+  Exi386InterlockedExchangeUlong@12 @174
+  Exi386InterlockedIncrementLong@4 @175
+  @ExiAcquireFastMutex@4=@ExAcquireFastMutex@4 @176
+  @ExiReleaseFastMutex@4=@ExReleaseFastMutex@4 @177
+  @ExiTryToAcquireFastMutex@4=@ExTryToAcquireFastMutex@4 @178
+  FsRtlAcquireFileExclusive@4 @179
+  FsRtlAddLargeMcbEntry@28 @180
+  FsRtlAddMcbEntry@16 @181
+  FsRtlAddToTunnelCache@32 @182
+  FsRtlAllocateFileLock@8 @183
+  FsRtlAllocatePool@8 @184
+  FsRtlAllocatePoolWithQuota@8 @185
+  FsRtlAllocatePoolWithQuotaTag@12 @186
+  FsRtlAllocatePoolWithTag@12 @187
+  FsRtlAllocateResource@0 @188
+  FsRtlAreNamesEqual@16 @189
+  FsRtlBalanceReads@4 @190
+  FsRtlCheckLockForReadAccess@8 @191
+  FsRtlCheckLockForWriteAccess@8 @192
+  FsRtlCheckOplock@20 @193
+  FsRtlCopyRead@32 @194
+  FsRtlCopyWrite@32 @195
+  FsRtlCreateSectionForDataScan@40 @196
+  FsRtlCurrentBatchOplock@4 @197
+  FsRtlDeleteKeyFromTunnelCache@12 @198
+  FsRtlDeleteTunnelCache@4 @199
+  FsRtlDeregisterUncProvider@4 @200
+  FsRtlDissectDbcs@16 @201
+  FsRtlDissectName@16 @202
+  FsRtlDoesDbcsContainWildCards@4 @203
+  FsRtlDoesNameContainWildCards@4 @204
+  FsRtlFastCheckLockForRead@24 @205
+  FsRtlFastCheckLockForWrite@24 @206
+  FsRtlFastUnlockAll@16 @207
+  FsRtlFastUnlockAllByKey@20 @208
+  FsRtlFastUnlockSingle@32 @209
+  FsRtlFindInTunnelCache@32 @210
+  FsRtlFreeFileLock@4 @211
+  FsRtlGetFileSize@8 @212
+  FsRtlGetNextFileLock@8 @213
+  FsRtlGetNextLargeMcbEntry@20 @214
+  FsRtlGetNextMcbEntry@20 @215
+  FsRtlIncrementCcFastReadNoWait@0 @216
+  FsRtlIncrementCcFastReadNotPossible@0 @217
+  FsRtlIncrementCcFastReadResourceMiss@0 @218
+  FsRtlIncrementCcFastReadWait@0 @219
+  FsRtlInitializeFileLock@12 @220
+  FsRtlInitializeLargeMcb@8 @221
+  FsRtlInitializeMcb@8 @222
+  FsRtlInitializeOplock@4 @223
+  FsRtlInitializeTunnelCache@4 @224
+  FsRtlInsertPerFileObjectContext@8 @225
+  FsRtlInsertPerStreamContext@8 @226
+  FsRtlIsDbcsInExpression@8 @227
+  FsRtlIsFatDbcsLegal@20 @228
+  FsRtlIsHpfsDbcsLegal@20 @229
+  FsRtlIsNameInExpression@16 @230
+  FsRtlIsNtstatusExpected@4 @231
+  FsRtlIsPagingFile@4 @232
+  FsRtlIsTotalDeviceFailure@4 @233
+  FsRtlLegalAnsiCharacterArray=_FsRtlLegalAnsiCharacterArray @234 DATA
+  FsRtlLookupLargeMcbEntry@32 @235
+  FsRtlLookupLastLargeMcbEntry@12 @236
+  FsRtlLookupLastLargeMcbEntryAndIndex@16 @237
+  FsRtlLookupLastMcbEntry@12 @238
+  FsRtlLookupMcbEntry@20 @239
+  FsRtlLookupPerFileObjectContext@12 @240
+  FsRtlLookupPerStreamContextInternal@12 @241
+  FsRtlMdlRead@24 @242
+  FsRtlMdlReadComplete@8 @243
+  FsRtlMdlReadCompleteDev@12 @244
+  FsRtlMdlReadDev@28 @245
+  FsRtlMdlWriteComplete@12 @246
+  FsRtlMdlWriteCompleteDev@16 @247
+  FsRtlNormalizeNtstatus@8 @248
+  FsRtlNotifyChangeDirectory@28 @249
+  FsRtlNotifyCleanup@12 @250
+  FsRtlNotifyFilterChangeDirectory@44 @251
+  FsRtlNotifyFilterReportChange@40 @252
+  FsRtlNotifyFullChangeDirectory@40 @253
+  FsRtlNotifyFullReportChange@36 @254
+  FsRtlNotifyInitializeSync@4 @255
+  FsRtlNotifyReportChange@20 @256
+  FsRtlNotifyUninitializeSync@4 @257
+  FsRtlNotifyVolumeEvent@8 @258
+  FsRtlNumberOfRunsInLargeMcb@4 @259
+  FsRtlNumberOfRunsInMcb@4 @260
+  FsRtlOplockFsctrl@12 @261
+  FsRtlOplockIsFastIoPossible@4 @262
+  FsRtlPostPagingFileStackOverflow@12 @263
+  FsRtlPostStackOverflow@12 @264
+  FsRtlPrepareMdlWrite@24 @265
+  FsRtlPrepareMdlWriteDev@28 @266
+  FsRtlPrivateLock@48 @267
+  FsRtlProcessFileLock@12 @268
+  FsRtlRegisterFileSystemFilterCallbacks@8 @269
+  FsRtlRegisterUncProvider@12 @270
+  FsRtlReleaseFile@4 @271
+  FsRtlRemoveLargeMcbEntry@20 @272
+  FsRtlRemoveMcbEntry@12 @273
+  FsRtlRemovePerFileObjectContext@12 @274
+  FsRtlRemovePerStreamContext@12 @275
+  FsRtlResetLargeMcb@8 @276
+  FsRtlSplitLargeMcb@20 @277
+  FsRtlSyncVolumes@12 @278
+  FsRtlTeardownPerStreamContexts@4 @279
+  FsRtlTruncateLargeMcb@12 @280
+  FsRtlTruncateMcb@8 @281
+  FsRtlUninitializeFileLock@4 @282
+  FsRtlUninitializeLargeMcb@4 @283
+  FsRtlUninitializeMcb@4 @284
+  FsRtlUninitializeOplock@4 @285
+  HalDispatchTable=_HalDispatchTable @286 DATA
+  @HalExamineMBR@16 @287
+  HalPrivateDispatchTable @288 DATA
+  InbvAcquireDisplayOwnership@0 @289
+  InbvCheckDisplayOwnership@0 @290
+  InbvDisplayString@4 @291
+  InbvEnableBootDriver@4 @292
+  InbvEnableDisplayString@4 @293
+  InbvInstallDisplayStringFilter@4 @294
+  InbvIsBootDriverInstalled@0 @295
+  InbvNotifyDisplayOwnershipLost@4 @296
+  InbvResetDisplay@0 @297
+  InbvSetScrollRegion@16 @298
+  InbvSetTextColor@4 @299
+  InbvSolidColorFill@20 @300
+  InitSafeBootMode @301 DATA
+  @InterlockedCompareExchange@12 @302
+  @InterlockedDecrement@4 @303
+  @InterlockedExchange@8 @304
+  @InterlockedExchangeAdd@8 @305
+  @InterlockedIncrement@4 @306
+  @InterlockedPopEntrySList@4 @307
+  @InterlockedPushEntrySList@8 @308
+  IoAcquireCancelSpinLock@4 @309
+  IoAcquireRemoveLockEx@20 @310
+  IoAcquireVpbSpinLock@4 @311
+  IoAdapterObjectType @312 DATA
+  IoAllocateAdapterChannel@20 @313
+  IoAllocateController@16 @314
+  IoAllocateDriverObjectExtension@16 @315
+  IoAllocateErrorLogEntry@8 @316
+  IoAllocateIrp@8 @317
+  IoAllocateMdl@20 @318
+  IoAllocateWorkItem@4 @319
+  @IoAssignDriveLetters@16 @320
+  IoAssignResources@24 @321
+  IoAttachDevice@12 @322
+  IoAttachDeviceByPointer@8 @323
+  IoAttachDeviceToDeviceStack@8 @324
+  IoAttachDeviceToDeviceStackSafe@12 @325
+  IoBuildAsynchronousFsdRequest@24 @326
+  IoBuildDeviceIoControlRequest@36 @327
+  IoBuildPartialMdl@16 @328
+  IoBuildSynchronousFsdRequest@28 @329
+  IoCallDriver@8 @330
+  IoCancelFileOpen@8 @331
+  IoCancelIrp@4 @332
+  IoCheckDesiredAccess@8 @333
+  IoCheckEaBufferValidity@12 @334
+  IoCheckFunctionAccess@24 @335
+  IoCheckQuerySetFileInformation@12 @336
+  IoCheckQuerySetVolumeInformation@12 @337
+  IoCheckQuotaBufferValidity@12 @338
+  IoCheckShareAccess@20 @339
+  IoCompleteRequest@8 @340
+  IoConnectInterrupt@44 @341
+  IoCreateController@4 @342
+  IoCreateDevice@28 @343
+  IoCreateDisk@8 @344
+  IoCreateDriver@8 @345
+  IoCreateFile@56 @346
+  IoCreateFileSpecifyDeviceObjectHint@60 @347
+  IoCreateNotificationEvent@8 @348
+  IoCreateStreamFileObject@8 @349
+  IoCreateStreamFileObjectEx@12 @350
+  IoCreateStreamFileObjectLite@8 @351
+  IoCreateSymbolicLink@8 @352
+  IoCreateSynchronizationEvent@8 @353
+  IoCreateUnprotectedSymbolicLink@8 @354
+  IoCsqInitialize@28 @355
+  IoCsqInitializeEx@28 @356
+  IoCsqInsertIrp@12 @357
+  IoCsqInsertIrpEx@16 @358
+  IoCsqRemoveIrp@8 @359
+  IoCsqRemoveNextIrp@8 @360
+  IoDeleteController@4 @361
+  IoDeleteDevice@4 @362
+  IoDeleteDriver@4 @363
+  IoDeleteSymbolicLink@4 @364
+  IoDetachDevice@4 @365
+  IoDeviceHandlerObjectSize @366 DATA
+  IoDeviceHandlerObjectType @367 DATA
+  IoDeviceObjectType @368 DATA
+  IoDisconnectInterrupt@4 @369
+  IoDriverObjectType @370 DATA
+  IoEnqueueIrp@4 @371
+  IoEnumerateDeviceObjectList@16 @372
+  IoEnumerateRegisteredFiltersList@12 @373
+  IoFastQueryNetworkAttributes@20 @374
+  IoFileObjectType=_IoFileObjectType @375 DATA
+  IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8 @376
+  IoForwardIrpSynchronously@8 @377
+  IoFreeController@4 @378
+  IoFreeErrorLogEntry@4 @379
+  IoFreeIrp@4 @380
+  IoFreeMdl@4 @381
+  IoFreeWorkItem@4 @382
+  IoGetAttachedDevice@4 @383
+  IoGetAttachedDeviceReference@4 @384
+  IoGetBaseFileSystemDeviceObject@4 @385
+  IoGetBootDiskInformation@8 @386
+  IoGetConfigurationInformation@0 @387
+  IoGetCurrentProcess@0 @388
+  IoGetDeviceAttachmentBaseRef@4 @389
+  IoGetDeviceInterfaceAlias@12 @390
+  IoGetDeviceInterfaces@16 @391
+  IoGetDeviceObjectPointer@16 @392
+  IoGetDeviceProperty@20 @393
+  IoGetDeviceToVerify@4 @394
+  IoGetDiskDeviceObject@8 @395
+  IoGetDmaAdapter@12 @396
+  IoGetDriverObjectExtension@8 @397
+  IoGetFileObjectGenericMapping@0 @398
+  IoGetInitialStack@0 @399
+  IoGetLowerDeviceObject@4 @400
+  @IoGetPagingIoPriority@4 @401
+  IoGetRelatedDeviceObject@4 @402
+  IoGetRequestorProcess@4 @403
+  IoGetRequestorProcessId@4 @404
+  IoGetRequestorSessionId@8 @405
+  IoGetStackLimits@8 @406
+  IoGetTopLevelIrp@0 @407
+  IoInitializeIrp@12 @408
+  IoInitializeRemoveLockEx@20 @409
+  IoInitializeTimer@12 @410
+  IoInvalidateDeviceRelations@8 @411
+  IoInvalidateDeviceState@4 @412
+  IoIsFileOriginRemote@4 @413
+  IoIsOperationSynchronous@4 @414
+  IoIsSystemThread@4 @415
+  IoIsValidNameGraftingBuffer@8 @416
+  IoIsWdmVersionAvailable@8 @417
+  IoMakeAssociatedIrp@8 @418
+  IoOpenDeviceInterfaceRegistryKey@12 @419
+  IoOpenDeviceRegistryKey@16 @420
+  IoPageRead@20 @421
+  IoPnPDeliverServicePowerNotification@16 @422
+  IoQueryDeviceDescription@32 @423
+  IoQueryFileDosDeviceName@8 @424
+  IoQueryFileInformation@20 @425
+  IoQueryVolumeInformation@20 @426
+  IoQueueThreadIrp@4 @427
+  IoQueueWorkItem@16 @428
+  IoRaiseHardError@12 @429
+  IoRaiseInformationalHardError@12 @430
+  IoReadDiskSignature@12 @431
+  IoReadOperationCount @432 DATA
+  @IoReadPartitionTable@16 @433
+  IoReadPartitionTableEx@8 @434
+  IoReadTransferCount @435 DATA
+  IoRegisterBootDriverReinitialization@12 @436
+  IoRegisterDeviceInterface@16 @437
+  IoRegisterDriverReinitialization@12 @438
+  IoRegisterFileSystem@4 @439
+  IoRegisterFsRegistrationChange@8 @440
+  IoRegisterLastChanceShutdownNotification@4 @441
+  IoRegisterPlugPlayNotification@28 @442
+  IoRegisterShutdownNotification@4 @443
+  IoReleaseCancelSpinLock@4 @444
+  IoReleaseRemoveLockAndWaitEx@12 @445
+  IoReleaseRemoveLockEx@12 @446
+  IoReleaseVpbSpinLock@4 @447
+  IoRemoveShareAccess@8 @448
+  IoReportDetectedDevice@32 @449
+  IoReportHalResourceUsage@16 @450
+  IoReportResourceForDetection@28 @451
+  IoReportResourceUsage@36 @452
+  IoReportTargetDeviceChange@8 @453
+  IoReportTargetDeviceChangeAsynchronous@16 @454
+  IoRequestDeviceEject@4 @455
+  IoReuseIrp@8 @456
+  IoSetCompletionRoutineEx@28 @457
+  IoSetDeviceInterfaceState@8 @458
+  IoSetDeviceToVerify@8 @459
+  IoSetFileOrigin@8 @460
+  IoSetHardErrorOrVerifyDevice@8 @461
+  IoSetInformation@16 @462
+  IoSetIoCompletion@24 @463
+  @IoSetPartitionInformation@16 @464
+  IoSetPartitionInformationEx@12 @465
+  IoSetShareAccess@16 @466
+  IoSetStartIoAttributes@12 @467
+  IoSetSystemPartition@4 @468
+  IoSetThreadHardErrorMode@4 @469
+  IoSetTopLevelIrp@4 @470
+  IoStartNextPacket@8 @471
+  IoStartNextPacketByKey@12 @472
+  IoStartPacket@16 @473
+  IoStartTimer@4 @474
+  IoStatisticsLock @475 DATA
+  IoStopTimer@4 @476
+  IoSynchronousInvalidateDeviceRelations@8 @477
+  IoSynchronousPageWrite@20 @478
+  IoThreadToProcess@4 @479
+  IoTranslateBusAddress@24 @480
+  IoUnregisterFileSystem@4 @481
+  IoUnregisterFsRegistrationChange@8 @482
+  IoUnregisterPlugPlayNotification@4 @483
+  IoUnregisterShutdownNotification@4 @484
+  IoUpdateShareAccess@8 @485
+  IoValidateDeviceIoControlAccess@8 @486
+  IoVerifyPartitionTable@8 @487
+  IoVerifyVolume@8 @488
+  IoVolumeDeviceToDosName@8 @489
+  IoWMIAllocateInstanceIds@12 @490
+  IoWMIDeviceObjectToInstanceName@12 @491
+  IoWMIExecuteMethod@24 @492
+  IoWMIHandleToInstanceName@12 @493
+  IoWMIOpenBlock@12 @494
+  IoWMIQueryAllData@12 @495
+  IoWMIQueryAllDataMultiple@16 @496
+  IoWMIQuerySingleInstance@16 @497
+  IoWMIQuerySingleInstanceMultiple@20 @498
+  IoWMIRegistrationControl@8 @499
+  IoWMISetNotificationCallback@12 @500
+  IoWMISetSingleInstance@20 @501
+  IoWMISetSingleItem@24 @502
+  IoWMISuggestInstanceName@16 @503
+  IoWMIWriteEvent@4 @504
+  IoWriteErrorLogEntry@4 @505
+  IoWriteOperationCount @506 DATA
+  @IoWritePartitionTable@20 @507
+  IoWritePartitionTableEx@8 @508
+  IoWriteTransferCount @509 DATA
+  @IofCallDriver@8 @510
+  @IofCompleteRequest@8 @511
+  KdChangeOption@24 @512
+  KdDebuggerEnabled=_KdDebuggerEnabled @513 DATA
+  KdDebuggerNotPresent=_KdDebuggerNotPresent @514 DATA
+  KdDisableDebugger@0 @515
+  KdEnableDebugger@0 @516
+  KdEnteredDebugger @517 DATA
+  KdPollBreakIn@0 @518
+  KdPowerTransition@4 @519
+  KdRefreshDebuggerNotPresent@0 @520
+  KdSystemDebugControl@28 @521
+  Ke386CallBios@8 @522
+  Ke386IoSetAccessProcess@8 @523
+  Ke386QueryIoAccessMap@8 @524
+  Ke386SetIoAccessMap@8 @525
+  @KeAcquireGuardedMutex@4 @526
+  @KeAcquireGuardedMutexUnsafe@4 @527
+  @KeAcquireInStackQueuedSpinLockAtDpcLevel@8 @528
+  @KeAcquireInStackQueuedSpinLockForDpc@8 @529
+  KeAcquireInterruptSpinLock@4 @530
+  KeAcquireSpinLockAtDpcLevel@4 @531
+  @KeAcquireSpinLockForDpc@4 @532
+  KeAddSystemServiceTable@20 @533
+  KeAreAllApcsDisabled@0 @534
+  KeAreApcsDisabled@0 @535
+  KeAttachProcess@4 @536
+  KeBugCheck@4 @537
+  KeBugCheckEx@20 @538
+  KeCancelTimer@4 @539
+  KeCapturePersistentThreadState@28 @540
+  KeClearEvent@4 @541
+  KeConnectInterrupt@4 @542
+  KeDelayExecutionThread@12 @543
+  KeDeregisterBugCheckCallback@4 @544
+  KeDeregisterBugCheckReasonCallback@4 @545
+  KeDeregisterNmiCallback@4 @546
+  KeDetachProcess@0 @547
+  KeDisconnectInterrupt@4 @548
+  KeEnterCriticalRegion@0=_KeEnterCriticalRegion@0 @549
+  KeEnterGuardedRegion@0=_KeEnterGuardedRegion@0 @550
+  KeEnterKernelDebugger@0 @551
+  KeFindConfigurationEntry@16 @552
+  KeFindConfigurationNextEntry@20 @553
+  KeFlushEntireTb@8 @554
+  KeFlushQueuedDpcs@0 @555
+  KeGetCurrentThread@0 @556
+  KeGetPreviousMode@0 @557
+  KeGetRecommendedSharedDataAlignment@0 @558
+  KeI386AllocateGdtSelectors@8 @559
+  KeI386FlatToGdtSelector@12 @560
+  KeI386MachineType @561 DATA
+  KeI386ReleaseGdtSelectors@8 @562
+  KeInitializeApc@32 @563
+  KeInitializeCrashDumpHeader@20 @564
+  KeInitializeDeviceQueue@4 @565
+  KeInitializeDpc@12 @566
+  KeInitializeEvent@12 @567
+  @KeInitializeGuardedMutex@4 @568
+  KeInitializeInterrupt@44 @569
+  KeInitializeMutant@8 @570
+  KeInitializeMutex@8 @571
+  KeInitializeQueue@8 @572
+  KeInitializeSemaphore@12 @573
+  KeInitializeSpinLock@4=_KeInitializeSpinLock@4 @574
+  KeInitializeThreadedDpc@12 @575
+  KeInitializeTimer@4 @576
+  KeInitializeTimerEx@8 @577
+  KeInsertByKeyDeviceQueue@12 @578
+  KeInsertDeviceQueue@8 @579
+  KeInsertHeadQueue@8 @580
+  KeInsertQueue@8 @581
+  KeInsertQueueApc@16 @582
+  KeInsertQueueDpc@12 @583
+  KeInvalidateAllCaches@0 @584
+  KeIpiGenericCall@8 @585
+  KeIsAttachedProcess@0 @586
+  KeIsExecutingDpc@0 @587
+  KeLeaveCriticalRegion@0=_KeLeaveCriticalRegion@0 @588
+  KeLeaveGuardedRegion@0=_KeLeaveGuardedRegion@0 @589
+  KeLoaderBlock @590 DATA
+  KeNumberProcessors @591 DATA
+  KeProfileInterrupt@4 @592
+  KeProfileInterruptWithSource@8 @593
+  KePulseEvent@12 @594
+  KeQueryActiveProcessors@0 @595
+  KeQueryInterruptTime@0 @596
+  KeQueryPriorityThread@4 @597
+  KeQueryRuntimeThread@8 @598
+  KeQuerySystemTime@4 @599
+  KeQueryTickCount@4 @600
+  KeQueryTimeIncrement@0 @601
+  KeRaiseUserException@4 @602
+  KeReadStateEvent@4 @603
+  KeReadStateMutant@4 @604
+  KeReadStateMutex@4=KeReadStateMutant@4 @605
+  KeReadStateQueue@4 @606
+  KeReadStateSemaphore@4 @607
+  KeReadStateTimer@4 @608
+  KeRegisterBugCheckCallback@20 @609
+  KeRegisterBugCheckReasonCallback@16 @610
+  KeRegisterNmiCallback@8 @611
+  @KeReleaseGuardedMutex@4 @612
+  @KeReleaseGuardedMutexUnsafe@4 @613
+  @KeReleaseInStackQueuedSpinLockForDpc@4 @614
+  @KeReleaseInStackQueuedSpinLockFromDpcLevel@4 @615
+  KeReleaseInterruptSpinLock@8 @616
+  KeReleaseMutant@16 @617
+  KeReleaseMutex@8 @618
+  KeReleaseSemaphore@16 @619
+  @KeReleaseSpinLockForDpc@8 @620
+  KeReleaseSpinLockFromDpcLevel@4 @621
+  KeRemoveByKeyDeviceQueue@8 @622
+  KeRemoveByKeyDeviceQueueIfBusy@8 @623
+  KeRemoveDeviceQueue@4 @624
+  KeRemoveEntryDeviceQueue@8 @625
+  KeRemoveQueue@12 @626
+  KeRemoveQueueDpc@4 @627
+  KeRemoveSystemServiceTable@4 @628
+  KeResetEvent@4 @629
+  KeRestoreFloatingPointState@4 @630
+  KeRevertToUserAffinityThread@0 @631
+  KeRundownQueue@4 @632
+  KeSaveFloatingPointState@4 @633
+  KeSaveStateForHibernate @634
+  KeServiceDescriptorTable @635 DATA
+  KeSetAffinityThread@8 @636
+  KeSetBasePriorityThread@8 @637
+  KeSetDmaIoCoherency@4 @638
+  KeSetEvent@12 @639
+  KeSetEventBoostPriority@8 @640
+  KeSetIdealProcessorThread@8 @641
+  KeSetImportanceDpc@8 @642
+  KeSetKernelStackSwapEnable@4 @643
+  KeSetPriorityThread@8 @644
+  KeSetProfileIrql@4 @645
+  KeSetSystemAffinityThread@4 @646
+  KeSetTargetProcessorDpc@8 @647
+  KeSetTimeIncrement@8 @648
+  KeSetTimer@16 @649
+  KeSetTimerEx@20 @650
+  KeStackAttachProcess@8 @651
+  KeSynchronizeExecution@12 @652
+  KeTerminateThread@4 @653
+  @KeTestSpinLock@4 @654
+  KeTickCount @655 DATA
+  @KeTryToAcquireGuardedMutex@4 @656
+  @KeTryToAcquireSpinLockAtDpcLevel@4 @657
+  KeUnstackDetachProcess@4 @658
+  KeUpdateRunTime@8 @659
+  @KeUpdateSystemTime@12 @660
+  KeUserModeCallback@20 @661
+  KeWaitForMultipleObjects@32 @662
+  KeWaitForMutexObject@20=KeWaitForSingleObject@20 @663
+  KeWaitForSingleObject@20 @664
+  @KefAcquireSpinLockAtDpcLevel@4 @665
+  @KefReleaseSpinLockFromDpcLevel@4 @666
+  Kei386EoiHelper@0 @667
+  @KiEoiHelper@4 @668
+  @KiAcquireSpinLock@4 @669
+  KiBugCheckData @670 DATA
+  KiCheckForKernelApcDelivery@0 @671
+  KiCoprocessorError@0 @672
+  KiDeliverApc@12 @673
+  KiDispatchInterrupt@0 @674
+  KiEnableTimerWatchdog @675 DATA
+  KiIpiServiceRoutine@8 @676
+  @KiReleaseSpinLock@4 @677
+  KiUnexpectedInterrupt @678
+  Kii386SpinOnSpinLock@8 @679
+  LdrAccessResource@16 @680
+  LdrEnumResources@20 @681
+  LdrFindResourceDirectory_U@16 @682
+  LdrFindResource_U@16 @683
+  LpcPortObjectType @684 DATA
+  LpcRequestPort@8 @685
+  LpcRequestWaitReplyPort@12 @686
+  LsaCallAuthenticationPackage@28 @687
+  LsaDeregisterLogonProcess@8 @688
+  LsaFreeReturnBuffer@4 @689
+  LsaLogonUser@56 @690
+  LsaLookupAuthenticationPackage@12 @691
+  LsaRegisterLogonProcess@12 @692
+  Mm64BitPhysicalAddress @693 DATA
+  MmAddPhysicalMemory@8 @694
+  MmAddVerifierThunks@8 @695
+  MmAdjustWorkingSetSize@16 @696
+  MmAdvanceMdl@8 @697
+  MmAllocateContiguousMemory@12 @698
+  MmAllocateContiguousMemorySpecifyCache@32 @699
+  MmAllocateMappingAddress@8 @700
+  MmAllocateNonCachedMemory@4 @701
+  MmAllocatePagesForMdl@28 @702
+  MmAllocatePagesForMdlEx@36 @703
+  MmBuildMdlForNonPagedPool@4 @704
+  MmCanFileBeTruncated@8 @705
+  MmCreateMdl@12 @706
+  MmCreateSection@32 @707
+  MmDisableModifiedWriteOfSection@4 @708
+  MmFlushImageSection@8 @709
+  MmForceSectionClosed@8 @710
+  MmFreeContiguousMemory@4 @711
+  MmFreeContiguousMemorySpecifyCache@12 @712
+  MmFreeMappingAddress@8 @713
+  MmFreeNonCachedMemory@8 @714
+  MmFreePagesFromMdl@4 @715
+  MmGetPhysicalAddress@4 @716
+  MmGetPhysicalMemoryRanges@0 @717
+  MmGetSystemRoutineAddress@4 @718
+  MmGetVirtualForPhysical@8 @719
+  MmGrowKernelStack@4 @720
+  MmHighestUserAddress @721 DATA
+  MmIsAddressValid@4 @722
+  MmIsDriverVerifying@4 @723
+  MmIsNonPagedSystemAddressValid@4 @724
+  MmIsRecursiveIoFault@0 @725
+  MmIsThisAnNtAsSystem@0 @726
+  MmIsVerifierEnabled@4 @727
+  MmLockPagableDataSection@4=MmLockPageableDataSection@4 @728
+  MmLockPagableImageSection@4=MmLockPageableDataSection@4 @729
+  MmLockPagableSectionByHandle@4=MmLockPageableSectionByHandle@4 @730
+  MmMapIoSpace@16 @731
+  MmMapLockedPages@8 @732
+  MmMapLockedPagesSpecifyCache@24 @733
+  MmMapLockedPagesWithReservedMapping@16 @734
+  MmMapMemoryDumpMdl@4 @735
+  MmMapUserAddressesToPage@12 @736
+  MmMapVideoDisplay@16 @737
+  MmMapViewInSessionSpace@12 @738
+  MmMapViewInSystemSpace@12 @739
+  MmMapViewOfSection@40 @740
+  MmMarkPhysicalMemoryAsBad@8 @741
+  MmMarkPhysicalMemoryAsGood@8 @742
+  MmPageEntireDriver@4 @743
+  MmPrefetchPages@8 @744
+  MmProbeAndLockPages@12 @745
+  MmProbeAndLockProcessPages@16 @746
+  MmProbeAndLockSelectedPages@16 @747
+  MmProtectMdlSystemAddress@8 @748
+  MmQuerySystemSize@0 @749
+  MmRemovePhysicalMemory@8 @750
+  MmResetDriverPaging@4 @751
+  MmSectionObjectType @752 DATA
+  MmSecureVirtualMemory@12 @753
+  MmSetAddressRangeModified@8 @754
+  MmSetBankedSection@24 @755
+  MmSizeOfMdl@8 @756
+  MmSystemRangeStart @757 DATA
+  MmTrimAllSystemPagableMemory@4=MmTrimAllSystemPageableMemory@4 @758
+  MmUnlockPagableImageSection@4=MmUnlockPageableImageSection@4 @759
+  MmUnlockPages@4 @760
+  MmUnmapIoSpace@8 @761
+  MmUnmapLockedPages@8 @762
+  MmUnmapReservedMapping@12 @763
+  MmUnmapVideoDisplay@8 @764
+  MmUnmapViewInSessionSpace@4 @765
+  MmUnmapViewInSystemSpace@4 @766
+  MmUnmapViewOfSection@8 @767
+  MmUnsecureVirtualMemory@4 @768
+  MmUserProbeAddress @769 DATA
+  NlsAnsiCodePage @770 DATA
+  NlsLeadByteInfo @771 DATA
+  NlsMbCodePageTag @772 DATA
+  NlsMbOemCodePageTag @773 DATA
+  NlsOemCodePage @774 DATA
+  NlsOemLeadByteInfo=_NlsOemLeadByteInfo @775 DATA
+  NtAddAtom@12 @776
+  NtAdjustPrivilegesToken@24 @777
+  NtAlertThread@4 @778
+  NtAllocateLocallyUniqueId@4 @779
+  NtAllocateUuids@16 @780
+  NtAllocateVirtualMemory@24 @781
+  NtBuildNumber @782 DATA
+  NtClose@4 @783
+  NtConnectPort@32 @784
+  NtCreateEvent@20 @785
+  NtCreateFile@44 @786
+  NtCreateSection@28 @787
+  NtCreateTimer@16 @788
+  NtDeleteAtom@4 @789
+  NtDeleteFile@4 @790
+  NtDeviceIoControlFile@40 @791
+  NtDuplicateObject@28 @792
+  NtDuplicateToken@24 @793
+  NtFindAtom@12 @794
+  NtFreeVirtualMemory@16 @795
+  NtFsControlFile@40 @796
+  NtGlobalFlag @797 DATA
+  NtLockFile@40 @798
+  NtMakePermanentObject@4 @799
+  NtMapViewOfSection@40 @800
+  NtNotifyChangeDirectoryFile@36 @801
+  NtOpenEvent@12 @802
+  NtOpenFile@24 @803
+  NtOpenProcess@16 @804
+  NtOpenProcessToken@12 @805
+  NtOpenProcessTokenEx@16 @806
+  NtOpenThread@16 @807
+  NtOpenThreadToken@16 @808
+  NtOpenThreadTokenEx@20 @809
+  NtQueryDirectoryFile@44 @810
+  NtQueryEaFile@36 @811
+  NtQueryInformationAtom@20 @812
+  NtQueryInformationFile@20 @813
+  NtQueryInformationProcess@20 @814
+  NtQueryInformationThread@20 @815
+  NtQueryInformationToken@20 @816
+  NtQueryQuotaInformationFile@36 @817
+  NtQuerySecurityObject@20 @818
+  NtQuerySystemInformation@16 @819
+  NtQueryVolumeInformationFile@20 @820
+  NtReadFile@36 @821
+  NtRequestPort@8 @822
+  NtRequestWaitReplyPort@12 @823
+  NtSetEaFile@16 @824
+  NtSetEvent@8 @825
+  NtSetInformationFile@20 @826
+  NtSetInformationProcess@16 @827
+  NtSetInformationThread@16 @828
+  NtSetQuotaInformationFile@16 @829
+  NtSetSecurityObject@12 @830
+  NtSetVolumeInformationFile@20 @831
+  NtShutdownSystem@4 @832
+  NtTraceEvent@16 @833
+  NtUnlockFile@20 @834
+  NtVdmControl@8 @835
+  NtWaitForSingleObject@12 @836
+  NtWriteFile@36 @837
+  ObAssignSecurity@16 @838
+  ObCheckCreateObjectAccess@28 @839
+  ObCheckObjectAccess@20 @840
+  ObCloseHandle@8 @841
+  ObCreateObject@36 @842
+  ObCreateObjectType@16 @843
+  ObDereferenceObject@4 @844
+  ObDereferenceObjectDeferDelete@4 @845
+  ObDereferenceSecurityDescriptor@8 @846
+  ObFindHandleForObject@20 @847
+  ObGetObjectSecurity@12 @848
+  ObInsertObject@24 @849
+  ObIsKernelHandle@4 @850
+  ObLogSecurityDescriptor@12 @851
+  ObMakeTemporaryObject@4 @852
+  ObOpenObjectByName@28 @853
+  ObOpenObjectByPointer@28 @854
+  ObQueryNameString@16 @855
+  ObQueryObjectAuditingByHandle@8 @856
+  ObReferenceObjectByHandle@24 @857
+  ObReferenceObjectByName@32 @858
+  ObReferenceObjectByPointer@16 @859
+  ObReferenceSecurityDescriptor@8 @860
+  ObReleaseObjectSecurity@8 @861
+  ObSetSecurityDescriptorInfo@24 @862
+  ObSetSecurityObjectByPointer@12 @863
+  @ObfDereferenceObject@4 @864
+  @ObfReferenceObject@4 @865
+  PoCallDriver@8 @866
+  PoCancelDeviceNotify@4 @867
+  PoQueueShutdownWorkItem@4 @868
+  PoRegisterDeviceForIdleDetection@16 @869
+  PoRegisterDeviceNotify@24 @870
+  PoRegisterSystemState@8 @871
+  PoRequestPowerIrp@24 @872
+  PoRequestShutdownEvent@4 @873
+  PoSetHiberRange@20 @874
+  PoSetPowerState@12 @875
+  PoSetSystemState@4 @876
+  PoShutdownBugCheck@24 @877
+  PoStartNextPowerIrp@4 @878
+  PoUnregisterSystemState@4 @879
+  ProbeForRead@12 @880
+  ProbeForWrite@12 @881
+  PsAssignImpersonationToken@8 @882
+  PsChargePoolQuota@12 @883
+  PsChargeProcessNonPagedPoolQuota@8 @884
+  PsChargeProcessPagedPoolQuota@8 @885
+  PsChargeProcessPoolQuota@12 @886
+  PsCreateSystemProcess@12 @887
+  PsCreateSystemThread@28 @888
+  PsDereferenceImpersonationToken@4=PsDereferencePrimaryToken@4 @889
+  PsDereferencePrimaryToken@4 @890
+  PsDisableImpersonation@8 @891
+  PsEstablishWin32Callouts@4 @892
+  PsGetContextThread@12 @893
+  PsGetCurrentProcess@0=IoGetCurrentProcess@0 @894
+  PsGetCurrentProcessId@0 @895
+  PsGetCurrentProcessSessionId@0 @896
+  PsGetCurrentProcessWin32Process@0 @897
+  PsGetCurrentThread@0=KeGetCurrentThread@0 @898
+  PsGetCurrentThreadId@0 @899
+  PsGetCurrentThreadPreviousMode@0 @900
+  PsGetCurrentThreadStackBase@0 @901
+  PsGetCurrentThreadStackLimit@0 @902
+  PsGetCurrentThreadWin32Thread@0 @903
+  PsGetJobLock@4 @904
+  PsGetJobSessionId@4 @905
+  PsGetJobUIRestrictionsClass@4 @906
+  PsGetProcessCreateTimeQuadPart@4 @907
+  PsGetProcessDebugPort@4 @908
+  PsGetProcessExitProcessCalled@4 @909
+  PsGetProcessExitStatus@4 @910
+  PsGetProcessExitTime@0 @911
+  PsGetProcessId@4 @912
+  PsGetProcessImageFileName@4 @913
+  PsGetProcessInheritedFromUniqueProcessId@4 @914
+  PsGetProcessJob@4 @915
+  PsGetProcessPeb@4 @916
+  PsGetProcessPriorityClass@4 @917
+  PsGetProcessSectionBaseAddress@4 @918
+  PsGetProcessSecurityPort@4 @919
+  PsGetProcessSessionId@4 @920
+  PsGetProcessWin32Process@4 @921
+  PsGetProcessWin32WindowStation@4 @922
+  PsGetThreadFreezeCount@4 @923
+  PsGetThreadHardErrorsAreDisabled@4 @924
+  PsGetThreadId@4 @925
+  PsGetThreadProcess@4 @926
+  PsGetThreadProcessId@4 @927
+  PsGetThreadSessionId@4 @928
+  PsGetThreadTeb@4 @929
+  PsGetThreadWin32Thread@4 @930
+  PsGetVersion@16 @931
+  PsImpersonateClient@20 @932
+  PsInitialSystemProcess @933 DATA
+  PsIsProcessBeingDebugged@4 @934
+  PsIsSystemProcess@4 @935
+  PsIsSystemThread@4 @936
+  PsIsThreadImpersonating@4 @937
+  PsIsThreadTerminating@4 @938
+  PsJobType @939 DATA
+  PsLookupProcessByProcessId@8 @940
+  PsLookupProcessThreadByCid@12 @941
+  PsLookupThreadByThreadId@8 @942
+  PsProcessType=_PsProcessType @943 DATA
+  PsReferenceImpersonationToken@16 @944
+  PsReferencePrimaryToken@4 @945
+  PsRemoveCreateThreadNotifyRoutine@4 @946
+  PsRemoveLoadImageNotifyRoutine@4 @947
+  PsRestoreImpersonation@8 @948
+  PsReturnPoolQuota@12 @949
+  PsReturnProcessNonPagedPoolQuota@8 @950
+  PsReturnProcessPagedPoolQuota@8 @951
+  PsRevertThreadToSelf@4 @952
+  PsRevertToSelf@0 @953
+  PsSetContextThread@12 @954
+  PsSetCreateProcessNotifyRoutine@8 @955
+  PsSetCreateThreadNotifyRoutine@4 @956
+  PsSetJobUIRestrictionsClass@8 @957
+  PsSetLegoNotifyRoutine@4 @958
+  PsSetLoadImageNotifyRoutine@4 @959
+  PsSetProcessPriorityByClass@8 @960
+  PsSetProcessPriorityClass@8 @961
+  PsSetProcessSecurityPort@8 @962
+  PsSetProcessWin32Process@8 @963
+  PsSetProcessWindowStation@8 @964
+  PsSetThreadHardErrorsAreDisabled@8 @965
+  PsSetThreadWin32Thread@8 @966
+  PsTerminateSystemThread@4 @967
+  PsThreadType=_PsThreadType @968 DATA
+  READ_REGISTER_BUFFER_UCHAR@12 @969
+  READ_REGISTER_BUFFER_ULONG@12 @970
+  READ_REGISTER_BUFFER_USHORT@12 @971
+  READ_REGISTER_UCHAR@4 @972
+  READ_REGISTER_ULONG@4 @973
+  READ_REGISTER_USHORT@4 @974
+  RtlAbsoluteToSelfRelativeSD@12 @975
+  RtlAddAccessAllowedAce@16 @976
+  RtlAddAccessAllowedAceEx@20 @977
+  RtlAddAce@20 @978
+  RtlAddAtomToAtomTable@12 @979
+  RtlAddRange@36 @980
+  RtlAllocateAndInitializeSid@44 @981
+  RtlAllocateHeap@12 @982
+  RtlAnsiCharToUnicodeChar@4 @983
+  RtlAnsiStringToUnicodeSize@4=RtlxAnsiStringToUnicodeSize@4 @984
+  RtlAnsiStringToUnicodeString@12 @985
+  RtlAppendAsciizToString@8 @986
+  RtlAppendStringToString@8 @987
+  RtlAppendUnicodeStringToString@8 @988
+  RtlAppendUnicodeToString@8 @989
+  RtlAreAllAccessesGranted@8 @990
+  RtlAreAnyAccessesGranted@8 @991
+  RtlAreBitsClear@12 @992
+  RtlAreBitsSet@12 @993
+  RtlAssert@16 @994
+  RtlCaptureContext@4 @995
+  RtlCaptureStackBackTrace@16 @996
+  RtlCharToInteger@12 @997
+  RtlCheckRegistryKey@8 @998
+  RtlClearAllBits@4 @999
+  RtlClearBit@8 @1000
+  RtlClearBits@12 @1001
+  RtlCompareMemory@12 @1002
+  RtlCompareMemoryUlong@12 @1003
+  RtlCompareString@12 @1004
+  RtlCompareUnicodeString@12 @1005
+  RtlCompressBuffer@32 @1006
+  RtlCompressChunks@28 @1007
+  RtlConvertLongToLargeInteger@4 @1008
+  RtlConvertSidToUnicodeString@12 @1009
+  RtlConvertUlongToLargeInteger@4 @1010
+  RtlCopyLuid@8 @1011
+  RtlCopyRangeList@8 @1012
+  RtlCopySid@12 @1013
+  RtlCopyString@8 @1014
+  RtlCopyUnicodeString@8 @1015
+  RtlCreateAcl@12 @1016
+  RtlCreateAtomTable@8 @1017
+  RtlCreateHeap@24 @1018
+  RtlCreateRegistryKey@8 @1019
+  RtlCreateSecurityDescriptor@8 @1020
+  RtlCreateSystemVolumeInformationFolder@4 @1021
+  RtlCreateUnicodeString@8 @1022
+  RtlCustomCPToUnicodeN@24 @1023
+  RtlDecompressBuffer@24 @1024
+  RtlDecompressChunks@28 @1025
+  RtlDecompressFragment@32 @1026
+  RtlDelete@4 @1027
+  RtlDeleteAce@8 @1028
+  RtlDeleteAtomFromAtomTable@8 @1029
+  RtlDeleteElementGenericTable@8 @1030
+  RtlDeleteElementGenericTableAvl@8 @1031
+  RtlDeleteNoSplay@8 @1032
+  RtlDeleteOwnersRanges@8 @1033
+  RtlDeleteRange@24 @1034
+  RtlDeleteRegistryValue@12 @1035
+  RtlDescribeChunk@20 @1036
+  RtlDestroyAtomTable@4 @1037
+  RtlDestroyHeap@4 @1038
+  RtlDowncaseUnicodeString@12 @1039
+  RtlEmptyAtomTable@8 @1040
+  RtlEnlargedIntegerMultiply@8 @1041
+  RtlEnlargedUnsignedDivide@16 @1042
+  RtlEnlargedUnsignedMultiply@8 @1043
+  RtlEnumerateGenericTable@8 @1044
+  RtlEnumerateGenericTableAvl@8 @1045
+  RtlEnumerateGenericTableLikeADirectory@28 @1046
+  RtlEnumerateGenericTableWithoutSplaying@8 @1047
+  RtlEnumerateGenericTableWithoutSplayingAvl@8 @1048
+  RtlEqualLuid@8 @1049
+  RtlEqualSid@8 @1050
+  RtlEqualString@12 @1051
+  RtlEqualUnicodeString@12 @1052
+  RtlExtendedIntegerMultiply@12 @1053
+  RtlExtendedLargeIntegerDivide@16 @1054
+  RtlExtendedMagicDivide@20 @1055
+  RtlFillMemory@12 @1056
+  RtlFillMemoryUlong@12 @1057
+  RtlFindClearBits@12 @1058
+  RtlFindClearBitsAndSet@12 @1059
+  RtlFindClearRuns@16 @1060
+  RtlFindFirstRunClear@8 @1061
+  RtlFindLastBackwardRunClear@12 @1062
+  RtlFindLeastSignificantBit@8 @1063
+  RtlFindLongestRunClear@8 @1064
+  RtlFindMessage@20 @1065
+  RtlFindMostSignificantBit@8 @1066
+  RtlFindNextForwardRunClear@12 @1067
+  RtlFindRange@48 @1068
+  RtlFindSetBits@12 @1069
+  RtlFindSetBitsAndClear@12 @1070
+  RtlFindUnicodePrefix@12 @1071
+  RtlFormatCurrentUserKeyPath@4 @1072
+  RtlFreeAnsiString@4 @1073
+  RtlFreeHeap@12 @1074
+  RtlFreeOemString@4 @1075
+  RtlFreeRangeList@4 @1076
+  RtlFreeUnicodeString@4 @1077
+  RtlGUIDFromString@8 @1078
+  RtlGenerate8dot3Name@16 @1079
+  RtlGetAce@12 @1080
+  RtlGetCallersAddress@8 @1081
+  RtlGetCompressionWorkSpaceSize@12 @1082
+  RtlGetDaclSecurityDescriptor@16 @1083
+  RtlGetDefaultCodePage@8 @1084
+  RtlGetElementGenericTable@8 @1085
+  RtlGetElementGenericTableAvl@8 @1086
+  RtlGetFirstRange@12 @1087
+  RtlGetGroupSecurityDescriptor@12 @1088
+  RtlGetNextRange@12 @1089
+  RtlGetNtGlobalFlags@0 @1090
+  RtlGetOwnerSecurityDescriptor@12 @1091
+  RtlGetSaclSecurityDescriptor@16 @1092
+  RtlGetSetBootStatusData@24 @1093
+  RtlGetVersion@4 @1094
+  RtlHashUnicodeString@16 @1095
+  RtlImageDirectoryEntryToData@16 @1096
+  RtlImageNtHeader@4 @1097
+  RtlInitAnsiString@8 @1098
+  RtlInitAnsiStringEx@8 @1099
+  RtlInitCodePageTable@8 @1100
+  RtlInitString@8 @1101
+  RtlInitUnicodeString@8 @1102
+  RtlInitUnicodeStringEx@8 @1103
+  RtlInitializeBitMap@12 @1104
+  RtlInitializeGenericTable@20 @1105
+  RtlInitializeGenericTableAvl@20 @1106
+  RtlInitializeRangeList@4 @1107
+  RtlInitializeSid@12 @1108
+  RtlInitializeUnicodePrefix@4 @1109
+  RtlInsertElementGenericTable@16 @1110
+  RtlInsertElementGenericTableAvl@16 @1111
+  RtlInsertElementGenericTableFull@24 @1112
+  RtlInsertElementGenericTableFullAvl@24 @1113
+  RtlInsertUnicodePrefix@12 @1114
+  RtlInt64ToUnicodeString@16 @1115
+  RtlIntegerToChar@16 @1116
+  RtlIntegerToUnicode@16 @1117
+  RtlIntegerToUnicodeString@12 @1118
+  RtlInvertRangeList@8 @1119
+  RtlIpv4AddressToStringA@8 @1120
+  RtlIpv4AddressToStringExA@16 @1121
+  RtlIpv4AddressToStringExW@16 @1122
+  RtlIpv4AddressToStringW@8 @1123
+  RtlIpv4StringToAddressA@16 @1124
+  RtlIpv4StringToAddressExA@16 @1125
+  RtlIpv4StringToAddressExW@16 @1126
+  RtlIpv4StringToAddressW@16 @1127
+  RtlIpv6AddressToStringA@8 @1128
+  RtlIpv6AddressToStringExA@20 @1129
+  RtlIpv6AddressToStringExW@20 @1130
+  RtlIpv6AddressToStringW@8 @1131
+  RtlIpv6StringToAddressA@12 @1132
+  RtlIpv6StringToAddressExA@16 @1133
+  RtlIpv6StringToAddressExW@16 @1134
+  RtlIpv6StringToAddressW@12 @1135
+  RtlIsGenericTableEmpty@4 @1136
+  RtlIsGenericTableEmptyAvl@4 @1137
+  RtlIsNameLegalDOS8Dot3@12 @1138
+  RtlIsRangeAvailable@40 @1139
+  RtlIsValidOemCharacter@4 @1140
+  RtlLargeIntegerAdd@16 @1141
+  RtlLargeIntegerArithmeticShift@12 @1142
+  RtlLargeIntegerDivide@20 @1143
+  RtlLargeIntegerNegate@8 @1144
+  RtlLargeIntegerShiftLeft@12 @1145
+  RtlLargeIntegerShiftRight@12 @1146
+  RtlLargeIntegerSubtract@16 @1147
+  RtlLengthRequiredSid@4 @1148
+  RtlLengthSecurityDescriptor@4 @1149
+  RtlLengthSid@4 @1150
+  RtlLockBootStatusData@4 @1151
+  RtlLookupAtomInAtomTable@12 @1152
+  RtlLookupElementGenericTable@8 @1153
+  RtlLookupElementGenericTableAvl@8 @1154
+  RtlLookupElementGenericTableFull@16 @1155
+  RtlLookupElementGenericTableFullAvl@16 @1156
+  RtlMapGenericMask@8 @1157
+  RtlMapSecurityErrorToNtStatus@4 @1158
+  RtlMergeRangeLists@16 @1159
+  RtlMoveMemory@12 @1160
+  RtlMultiByteToUnicodeN@20 @1161
+  RtlMultiByteToUnicodeSize@12 @1162
+  RtlNextUnicodePrefix@8 @1163
+  RtlNtStatusToDosError@4 @1164
+  RtlNtStatusToDosErrorNoTeb@4 @1165
+  RtlNumberGenericTableElements@4 @1166
+  RtlNumberGenericTableElementsAvl@4 @1167
+  RtlNumberOfClearBits@4 @1168
+  RtlNumberOfSetBits@4 @1169
+  RtlOemStringToCountedUnicodeString@12 @1170
+  RtlOemStringToUnicodeSize@4=RtlxOemStringToUnicodeSize@4 @1171
+  RtlOemStringToUnicodeString@12 @1172
+  RtlOemToUnicodeN@20 @1173
+  RtlPinAtomInAtomTable@8 @1174
+  @RtlPrefetchMemoryNonTemporal@8 @1175
+  RtlPrefixString@12 @1176
+  RtlPrefixUnicodeString@12 @1177
+  RtlQueryAtomInAtomTable@24 @1178
+  RtlQueryRegistryValues@20 @1179
+  RtlQueryTimeZoneInformation@4 @1180
+  RtlRaiseException@4 @1181
+  RtlRandom@4 @1182
+  RtlRandomEx@4 @1183
+  RtlRealPredecessor@4 @1184
+  RtlRealSuccessor@4 @1185
+  RtlRemoveUnicodePrefix@8 @1186
+  RtlReserveChunk@20 @1187
+  RtlSecondsSince1970ToTime@8 @1188
+  RtlSecondsSince1980ToTime@8 @1189
+  RtlSelfRelativeToAbsoluteSD@44 @1190
+  RtlSelfRelativeToAbsoluteSD2@8 @1191
+  RtlSetAllBits@4 @1192
+  RtlSetBit@8 @1193
+  RtlSetBits@12 @1194
+  RtlSetDaclSecurityDescriptor@16 @1195
+  RtlSetGroupSecurityDescriptor@12 @1196
+  RtlSetOwnerSecurityDescriptor@12 @1197
+  RtlSetSaclSecurityDescriptor@16 @1198
+  RtlSetTimeZoneInformation@4 @1199
+  RtlSizeHeap@12 @1200
+  RtlSplay@4 @1201
+  RtlStringFromGUID@8 @1202
+  RtlSubAuthorityCountSid@4 @1203
+  RtlSubAuthoritySid@8 @1204
+  RtlSubtreePredecessor@4 @1205
+  RtlSubtreeSuccessor@4 @1206
+  RtlTestBit@8 @1207
+  RtlTimeFieldsToTime@8 @1208
+  RtlTimeToElapsedTimeFields@8 @1209
+  RtlTimeToSecondsSince1970@8 @1210
+  RtlTimeToSecondsSince1980@8 @1211
+  RtlTimeToTimeFields@8 @1212
+  @RtlUlongByteSwap@4 @1213
+  @RtlUlonglongByteSwap@8 @1214
+  RtlUnicodeStringToAnsiSize@4=RtlxUnicodeStringToAnsiSize@4 @1215
+  RtlUnicodeStringToAnsiString@12 @1216
+  RtlUnicodeStringToCountedOemString@12 @1217
+  RtlUnicodeStringToInteger@12 @1218
+  RtlUnicodeStringToOemSize@4=RtlxUnicodeStringToOemSize@4 @1219
+  RtlUnicodeStringToOemString@12 @1220
+  RtlUnicodeToCustomCPN@24 @1221
+  RtlUnicodeToMultiByteN@20 @1222
+  RtlUnicodeToMultiByteSize@12 @1223
+  RtlUnicodeToOemN@20 @1224
+  RtlUnlockBootStatusData@4 @1225
+  RtlUnwind@16 @1226
+  RtlUpcaseUnicodeChar@4 @1227
+  RtlUpcaseUnicodeString@12 @1228
+  RtlUpcaseUnicodeStringToAnsiString@12 @1229
+  RtlUpcaseUnicodeStringToCountedOemString@12 @1230
+  RtlUpcaseUnicodeStringToOemString@12 @1231
+  RtlUpcaseUnicodeToCustomCPN@24 @1232
+  RtlUpcaseUnicodeToMultiByteN@20 @1233
+  RtlUpcaseUnicodeToOemN@20 @1234
+  RtlUpperChar@4 @1235
+  RtlUpperString@8 @1236
+  @RtlUshortByteSwap@4 @1237
+  RtlValidRelativeSecurityDescriptor@12 @1238
+  RtlValidSecurityDescriptor@4 @1239
+  RtlValidSid@4 @1240
+  RtlVerifyVersionInfo@16 @1241
+  RtlVolumeDeviceToDosName@8 @1242
+  RtlWalkFrameChain@12 @1243
+  RtlWriteRegistryValue@24 @1244
+  RtlZeroHeap@8 @1245
+  RtlZeroMemory@8 @1246
+  RtlxAnsiStringToUnicodeSize@4 @1247
+  RtlxOemStringToUnicodeSize@4 @1248
+  RtlxUnicodeStringToAnsiSize@4 @1249
+  RtlxUnicodeStringToOemSize@4 @1250
+  SeAccessCheck@40 @1251
+  SeAppendPrivileges@8 @1252
+  SeAssignSecurity@28 @1253
+  SeAssignSecurityEx@36 @1254
+  SeAuditHardLinkCreation@12 @1255
+  SeAuditingFileEvents@8 @1256
+  SeAuditingFileEventsWithContext@12 @1257
+  SeAuditingFileOrGlobalEvents@12 @1258
+  SeAuditingHardLinkEvents@8 @1259
+  SeAuditingHardLinkEventsWithContext@12 @1260
+  SeCaptureSecurityDescriptor@20 @1261
+  SeCaptureSubjectContext@4 @1262
+  SeCloseObjectAuditAlarm@12 @1263
+  SeCreateAccessState@16 @1264
+  SeCreateClientSecurity@16 @1265
+  SeCreateClientSecurityFromSubjectContext@16 @1266
+  SeDeassignSecurity@4 @1267
+  SeDeleteAccessState@4 @1268
+  SeDeleteObjectAuditAlarm@8 @1269
+  SeExports @1270 DATA
+  SeFilterToken@24 @1271
+  SeFreePrivileges@4 @1272
+  SeImpersonateClient@8 @1273
+  SeImpersonateClientEx@8 @1274
+  SeLockSubjectContext@4 @1275
+  SeMarkLogonSessionForTerminationNotification@4 @1276
+  SeOpenObjectAuditAlarm@36 @1277
+  SeOpenObjectForDeleteAuditAlarm@36 @1278
+  SePrivilegeCheck@12 @1279
+  SePrivilegeObjectAuditAlarm@24 @1280
+  SePublicDefaultDacl @1281 DATA
+  SeQueryAuthenticationIdToken@8 @1282
+  SeQueryInformationToken@12 @1283
+  SeQuerySecurityDescriptorInfo@16 @1284
+  SeQuerySessionIdToken@8 @1285
+  SeRegisterLogonSessionTerminatedRoutine@4 @1286
+  SeReleaseSecurityDescriptor@12 @1287
+  SeReleaseSubjectContext@4 @1288
+  SeSetAccessStateGenericMapping@8 @1289
+  SeSetSecurityDescriptorInfo@24 @1290
+  SeSetSecurityDescriptorInfoEx@28 @1291
+  SeSinglePrivilegeCheck@12 @1292
+  SeSystemDefaultDacl @1293 DATA
+  SeTokenImpersonationLevel@4 @1294
+  SeTokenIsAdmin@4 @1295
+  SeTokenIsRestricted@4 @1296
+  SeTokenIsWriteRestricted@4 @1297
+  SeTokenType@4 @1298
+  SeUnlockSubjectContext@4 @1299
+  SeUnregisterLogonSessionTerminatedRoutine@4 @1300
+  SeValidSecurityDescriptor@8 @1301
+  VerSetConditionMask@16 @1302
+  VfFailDeviceNode @1303
+  VfIsVerificationEnabled@8 @1304
+  WRITE_REGISTER_BUFFER_UCHAR@12 @1305
+  WRITE_REGISTER_BUFFER_ULONG@12 @1306
+  WRITE_REGISTER_BUFFER_USHORT@12 @1307
+  WRITE_REGISTER_UCHAR@8 @1308
+  WRITE_REGISTER_ULONG@8 @1309
+  WRITE_REGISTER_USHORT@8 @1310
+  WmiQueryTraceInformation@20 @1311
+  WmiTraceMessage @1312
+  WmiTraceMessageVa@24 @1313
+  ZwAccessCheckAndAuditAlarm@44 @1314
+  ZwAddBootEntry@8 @1315
+  ZwAddDriverEntry@8 @1316
+  ZwAdjustPrivilegesToken@24 @1317
+  ZwAlertThread@4 @1318
+  ZwAllocateVirtualMemory@24 @1319
+  ZwAssignProcessToJobObject@8 @1320
+  ZwCancelIoFile@8 @1321
+  ZwCancelTimer@8 @1322
+  ZwClearEvent@4 @1323
+  ZwClose@4 @1324
+  ZwCloseObjectAuditAlarm@12 @1325
+  ZwConnectPort@32 @1326
+  ZwCreateDirectoryObject@12 @1327
+  ZwCreateEvent@20 @1328
+  ZwCreateFile@44 @1329
+  ZwCreateJobObject@12 @1330
+  ZwCreateKey@28 @1331
+  ZwCreateSection@28 @1332
+  ZwCreateSymbolicLinkObject@16 @1333
+  ZwCreateTimer@16 @1334
+  ZwDeleteBootEntry@4 @1335
+  ZwDeleteDriverEntry@4 @1336
+  ZwDeleteFile@4 @1337
+  ZwDeleteKey@4 @1338
+  ZwDeleteValueKey@8 @1339
+  ZwDeviceIoControlFile@40 @1340
+  ZwDisplayString@4 @1341
+  ZwDuplicateObject@28 @1342
+  ZwDuplicateToken@24 @1343
+  ZwEnumerateBootEntries@8 @1344
+  ZwEnumerateDriverEntries@8 @1345
+  ZwEnumerateKey@24 @1346
+  ZwEnumerateValueKey@24 @1347
+  ZwFlushInstructionCache@12 @1348
+  ZwFlushKey@4 @1349
+  ZwFlushVirtualMemory@16 @1350
+  ZwFreeVirtualMemory@16 @1351
+  ZwFsControlFile@40 @1352
+  ZwInitiatePowerAction@16 @1353
+  ZwIsProcessInJob@8 @1354
+  ZwLoadDriver@4 @1355
+  ZwLoadKey@8 @1356
+  ZwMakeTemporaryObject@4 @1357
+  ZwMapViewOfSection@40 @1358
+  ZwModifyBootEntry@4 @1359
+  ZwModifyDriverEntry@4 @1360
+  ZwNotifyChangeKey@40 @1361
+  ZwOpenDirectoryObject@12 @1362
+  ZwOpenEvent@12 @1363
+  ZwOpenFile@24 @1364
+  ZwOpenJobObject@12 @1365
+  ZwOpenKey@12 @1366
+  ZwOpenProcess@16 @1367
+  ZwOpenProcessToken@12 @1368
+  ZwOpenProcessTokenEx@16 @1369
+  ZwOpenSection@12 @1370
+  ZwOpenSymbolicLinkObject@12 @1371
+  ZwOpenThread@16 @1372
+  ZwOpenThreadToken@16 @1373
+  ZwOpenThreadTokenEx@20 @1374
+  ZwOpenTimer@12 @1375
+  ZwPowerInformation@20 @1376
+  ZwPulseEvent@8 @1377
+  ZwQueryBootEntryOrder@8 @1378
+  ZwQueryBootOptions@8 @1379
+  ZwQueryDefaultLocale@8 @1380
+  ZwQueryDefaultUILanguage@4 @1381
+  ZwQueryDirectoryFile@44 @1382
+  ZwQueryDirectoryObject@28 @1383
+  ZwQueryDriverEntryOrder@8 @1384
+  ZwQueryEaFile@36 @1385
+  ZwQueryFullAttributesFile@8 @1386
+  ZwQueryInformationAtom@20 @1387
+  ZwQueryInformationFile@20 @1388
+  ZwQueryInformationJobObject@20 @1389
+  ZwQueryInformationProcess@20 @1390
+  ZwQueryInformationThread@20 @1391
+  ZwQueryInformationToken@20 @1392
+  ZwQueryInstallUILanguage@4 @1393
+  ZwQueryKey@20 @1394
+  ZwQueryObject@20 @1395
+  ZwQuerySection@20 @1396
+  ZwQuerySecurityObject@20 @1397
+  ZwQuerySymbolicLinkObject@12 @1398
+  ZwQuerySystemInformation@16 @1399
+  ZwQueryValueKey@24 @1400
+  ZwQueryVolumeInformationFile@20 @1401
+  ZwReadFile@36 @1402
+  ZwReplaceKey@12 @1403
+  ZwRequestWaitReplyPort@12 @1404
+  ZwResetEvent@8 @1405
+  ZwRestoreKey@12 @1406
+  ZwSaveKey@8 @1407
+  ZwSaveKeyEx@12 @1408
+  ZwSecureConnectPort@36 @1409
+  ZwSetBootEntryOrder@8 @1410
+  ZwSetBootOptions@8 @1411
+  ZwSetDefaultLocale@8 @1412
+  ZwSetDefaultUILanguage@4 @1413
+  ZwSetDriverEntryOrder@8 @1414
+  ZwSetEaFile@16 @1415
+  ZwSetEvent@8 @1416
+  ZwSetInformationFile@20 @1417
+  ZwSetInformationJobObject@16 @1418
+  ZwSetInformationObject@16 @1419
+  ZwSetInformationProcess@16 @1420
+  ZwSetInformationThread@16 @1421
+  ZwSetSecurityObject@12 @1422
+  ZwSetSystemInformation@12 @1423
+  ZwSetSystemTime@8 @1424
+  ZwSetTimer@28 @1425
+  ZwSetValueKey@24 @1426
+  ZwSetVolumeInformationFile@20 @1427
+  ZwTerminateJobObject@8 @1428
+  ZwTerminateProcess@8 @1429
+  ZwTranslateFilePath@16 @1430
+  ZwUnloadDriver@4 @1431
+  ZwUnloadKey@4 @1432
+  ZwUnmapViewOfSection@8 @1433
+  ZwWaitForMultipleObjects@20 @1434
+  ZwWaitForSingleObject@12 @1435
+  ZwWriteFile@36 @1436
+  ZwYieldExecution@0 @1437
+  _abnormal_termination @1438
+  _alldiv @1439
+  _alldvrm @1440
+  _allmul @1441
+  _alloca_probe @1442
+  _allrem @1443
+  _allshl @1444
+  _allshr @1445
+  _aulldiv @1446
+  _aulldvrm @1447
+  _aullrem @1448
+  _aullshr @1449
+  _except_handler2 @1450
+  _except_handler3 @1451
+  _global_unwind2 @1452
+  _itoa @1453
+  _itow @1454
+  _local_unwind2 @1455
+  _purecall @1456
+  _snprintf @1457
+  _snwprintf @1458
+  _stricmp @1459
+  _strlwr @1460
+  _strnicmp @1461
+  _strnset @1462
+  _strrev @1463
+  _strset @1464
+  _strupr @1465
+  _vsnprintf @1466
+  _vsnwprintf @1467
+  _wcsicmp @1468
+  _wcslwr @1469
+  _wcsnicmp @1470
+  _wcsnset @1471
+  _wcsrev @1472
+  _wcsupr @1473
+  atoi @1474
+  atol @1475
+  isdigit @1476
+  islower @1477
+  isprint @1478
+  isspace @1479
+  isupper @1480
+  isxdigit @1481
+  mbstowcs @1482
+  mbtowc @1483
+  memchr @1484
+  memcpy @1485
+  memmove @1486
+  memset @1487
+  qsort @1488
+  rand @1489
+  sprintf @1490
+  srand @1491
+  strcat @1492
+  strchr @1493
+  strcmp @1494
+  strcpy @1495
+  strlen @1496
+  strncat @1497
+  strncmp @1498
+  strncpy @1499
+  strrchr @1500
+  strspn @1501
+  strstr @1502
+  swprintf @1503
+  tolower @1504
+  toupper @1505
+  towlower @1506
+  towupper @1507
+  vDbgPrintEx@16 @1508
+  vDbgPrintExWithPrefix@20 @1509
+  vsprintf @1510
+  wcscat @1511
+  wcschr @1512
+  wcscmp @1513
+  wcscpy @1514
+  wcscspn @1515
+  wcslen @1516
+  wcsncat @1517
+  wcsncmp @1518
+  wcsncpy @1519
+  wcsrchr @1520
+  wcsspn @1521
+  wcsstr @1522
+  wcstombs @1523
+  wctomb @1524