ExDeleteNPagedLookasideList@4
ExDeletePagedLookasideList@4
ExDeleteResourceLite@4
-ExDesktopObjectType DATA
+ExDesktopObjectType
ExDisableResourceBoostLite@4
ExEnumHandleTable@16
@ExEnterCriticalRegionAndAcquireFastMutexUnsafe@4
-ExEventObjectType DATA
+ExEventObjectType=_ExEventObjectType
ExExtendZone@12
ExFreePool@4
ExFreePoolWithTag@8
@ExReleaseFastMutexUnsafeAndLeaveCriticalRegion@4
ExReleaseResourceForThreadLite@8
@ExReleaseResourceLite@4
-ExSemaphoreObjectType DATA
+ExSemaphoreObjectType=_ExSemaphoreObjectType
ExSetResourceOwnerPointer@8
ExSetTimerResolution@8
ExSystemExceptionFilter@0
ExSystemTimeToLocalTime@8
+@ExiTryToAcquireFastMutex@4=@ExTryToAcquireFastMutex@4
ExTryToAcquireResourceExclusiveLite@4
ExUnregisterCallback@4
ExUuidCreate@4
Exi386InterlockedDecrementLong@4
Exi386InterlockedExchangeUlong@12
Exi386InterlockedIncrementLong@4
-FsRtlAcquireFileExclusive@4
-FsRtlAddLargeMcbEntry@28
-FsRtlAddMcbEntry@16
-FsRtlAddToTunnelCache@32
-FsRtlAllocateFileLock@8
-FsRtlAllocatePool@8
-FsRtlAllocatePoolWithQuota@8
-FsRtlAllocatePoolWithQuotaTag@12
-FsRtlAllocatePoolWithTag@12
-FsRtlAllocateResource@0
+FsRtlAcquireFileExclusive
+;FsRtlAddBaseMcbEntry
+FsRtlAddLargeMcbEntry
+FsRtlAddMcbEntry
+FsRtlAddToTunnelCache
+FsRtlAllocateFileLock
+FsRtlAllocatePool
+FsRtlAllocatePoolWithQuota
+FsRtlAllocatePoolWithQuotaTag
+FsRtlAllocatePoolWithTag
+FsRtlAllocateResource
FsRtlAreNamesEqual@16
-FsRtlBalanceReads@4
+FsRtlBalanceReads
FsRtlCheckLockForReadAccess@8
FsRtlCheckLockForWriteAccess@8
-FsRtlCheckOplock@20
-FsRtlCopyRead@32
-FsRtlCopyWrite@32
-FsRtlCurrentBatchOplock@4
-FsRtlDeleteKeyFromTunnelCache@12
-FsRtlDeleteTunnelCache@4
-FsRtlDeregisterUncProvider@4
-FsRtlDissectDbcs@16
-FsRtlDissectName@16
-FsRtlDoesDbcsContainWildCards@4
+FsRtlCheckOplock
+FsRtlCopyRead
+FsRtlCopyWrite
+;FsRtlCreateSectionForDataScan
+FsRtlCurrentBatchOplock
+FsRtlDeleteKeyFromTunnelCache
+FsRtlDeleteTunnelCache
+FsRtlDeregisterUncProvider
+FsRtlDissectDbcs
+FsRtlDissectName
+FsRtlDoesDbcsContainWildCards
FsRtlDoesNameContainWildCards@4
-FsRtlFastCheckLockForRead@24
-FsRtlFastCheckLockForWrite@24
+FsRtlFastCheckLockForRead
+FsRtlFastCheckLockForWrite
FsRtlFastUnlockAll@16
-FsRtlFastUnlockAllByKey@20
-FsRtlFastUnlockSingle@32
-FsRtlFindInTunnelCache@32
-FsRtlFreeFileLock@4
-FsRtlGetFileSize@8
-FsRtlGetNextFileLock@8
-FsRtlGetNextLargeMcbEntry@20
-FsRtlGetNextMcbEntry@20
-FsRtlIncrementCcFastReadNotPossible@0
-FsRtlIncrementCcFastReadNoWait@0
-FsRtlIncrementCcFastReadResourceMiss@0
-FsRtlIncrementCcFastReadWait@0
+FsRtlFastUnlockAllByKey
+FsRtlFastUnlockSingle
+FsRtlFindInTunnelCache
+FsRtlFreeFileLock
+FsRtlGetFileSize
+;FsRtlGetNextBaseMcbEntry
+FsRtlGetNextFileLock
+FsRtlGetNextLargeMcbEntry
+FsRtlGetNextMcbEntry
+FsRtlIncrementCcFastReadNotPossible
+FsRtlIncrementCcFastReadNoWait
+FsRtlIncrementCcFastReadResourceMiss
+FsRtlIncrementCcFastReadWait
+;FsRtlInitializeBaseMcb
FsRtlInitializeFileLock@12
-FsRtlInitializeLargeMcb@8
-FsRtlInitializeMcb@8
-FsRtlInitializeOplock@4
-FsRtlInitializeTunnelCache@4
-FsRtlInsertPerFileObjectContext@8
-FsRtlInsertPerStreamContext@8
-FsRtlIsDbcsInExpression@8
-FsRtlIsFatDbcsLegal@20
-FsRtlIsHpfsDbcsLegal@20
+FsRtlInitializeLargeMcb
+FsRtlInitializeMcb
+FsRtlInitializeOplock
+FsRtlInitializeTunnelCache
+FsRtlInsertPerFileObjectContext
+FsRtlInsertPerStreamContext
+FsRtlIsDbcsInExpression
+FsRtlIsFatDbcsLegal
+FsRtlIsHpfsDbcsLegal
FsRtlIsNameInExpression@16
-FsRtlIsNtstatusExpected@4
-FsRtlIsPagingFile@4
-FsRtlIsTotalDeviceFailure@4
+FsRtlIsNtstatusExpected
+FsRtlIsPagingFile
+FsRtlIsTotalDeviceFailure
FsRtlLegalAnsiCharacterArray=_FsRtlLegalAnsiCharacterArray
-FsRtlLookupLargeMcbEntry@32
-FsRtlLookupLastLargeMcbEntry@12
-FsRtlLookupLastLargeMcbEntryAndIndex@16
-FsRtlLookupLastMcbEntry@12
-FsRtlLookupMcbEntry@20
-FsRtlLookupPerFileObjectContext@12
-FsRtlLookupPerStreamContextInternal@12
-FsRtlMdlRead@24
-FsRtlMdlReadComplete@8
-FsRtlMdlReadCompleteDev@12
-FsRtlMdlReadDev@28
-FsRtlMdlWriteComplete@12
-FsRtlMdlWriteCompleteDev@16
-FsRtlNormalizeNtstatus@8
-FsRtlNotifyChangeDirectory@28
-FsRtlNotifyCleanup@12
-FsRtlNotifyFilterChangeDirectory@44
-FsRtlNotifyFilterReportChange@40
-FsRtlNotifyFullChangeDirectory@40
-FsRtlNotifyFullReportChange@36
-FsRtlNotifyInitializeSync@4
-FsRtlNotifyReportChange@20
-FsRtlNotifyUninitializeSync@4
-FsRtlNotifyVolumeEvent@8
-FsRtlNumberOfRunsInLargeMcb@4
-FsRtlNumberOfRunsInMcb@4
-FsRtlOplockFsctrl@12
-FsRtlOplockIsFastIoPossible@4
-FsRtlPostPagingFileStackOverflow@12
-FsRtlPostStackOverflow@12
-FsRtlPrepareMdlWrite@24
-FsRtlPrepareMdlWriteDev@28
-FsRtlPrivateLock@48
+;FsRtlLookupBaseMcbEntry
+FsRtlLookupLargeMcbEntry
+;FsRtlLookupLastBaseMcbEntry
+;FsRtlLookupLastBaseMcbEntryAndIndex
+FsRtlLookupLastLargeMcbEntry
+FsRtlLookupLastLargeMcbEntryAndIndex
+FsRtlLookupLastMcbEntry
+FsRtlLookupMcbEntry
+FsRtlLookupPerFileObjectContext
+FsRtlLookupPerStreamContextInternal
+FsRtlMdlRead
+FsRtlMdlReadComplete
+FsRtlMdlReadCompleteDev
+FsRtlMdlReadDev
+FsRtlMdlWriteComplete
+FsRtlMdlWriteCompleteDev
+FsRtlNormalizeNtstatus
+FsRtlNotifyChangeDirectory
+FsRtlNotifyCleanup
+FsRtlNotifyFilterChangeDirectory
+FsRtlNotifyFilterReportChange
+FsRtlNotifyFullChangeDirectory
+FsRtlNotifyFullReportChange
+FsRtlNotifyInitializeSync
+FsRtlNotifyReportChange
+FsRtlNotifyUninitializeSync
+FsRtlNotifyVolumeEvent
+;FsRtlNumberOfRunsInBaseMcb
+FsRtlNumberOfRunsInLargeMcb
+FsRtlNumberOfRunsInMcb
+FsRtlOplockFsctrl
+FsRtlOplockIsFastIoPossible
+FsRtlPostPagingFileStackOverflow
+FsRtlPostStackOverflow
+FsRtlPrepareMdlWrite
+FsRtlPrepareMdlWriteDev
+FsRtlPrivateLock
FsRtlProcessFileLock@12
-FsRtlRegisterUncProvider@12
-FsRtlReleaseFile@4
-FsRtlRemoveLargeMcbEntry@20
-FsRtlRemoveMcbEntry@12
-FsRtlRemovePerFileObjectContext@12
-FsRtlRemovePerStreamContext@12
-FsRtlResetLargeMcb@8
-FsRtlSplitLargeMcb@20
-FsRtlSyncVolumes@12
-FsRtlTeardownPerStreamContexts@4
-FsRtlTruncateLargeMcb@12
-FsRtlTruncateMcb@8
+FsRtlRegisterFileSystemFilterCallbacks
+FsRtlRegisterUncProvider
+FsRtlReleaseFile
+;FsRtlRemoveBaseMcbEntry
+FsRtlRemoveLargeMcbEntry
+FsRtlRemoveMcbEntry
+FsRtlRemovePerFileObjectContext
+FsRtlRemovePerStreamContext
+;FsRtlResetBaseMcb
+FsRtlResetLargeMcb
+;FsRtlSplitBaseMcb
+FsRtlSplitLargeMcb
+FsRtlSyncVolumes
+FsRtlTeardownPerStreamContexts
+;FsRtlTruncateBaseMcb
+FsRtlTruncateLargeMcb
+FsRtlTruncateMcb
+;FsRtlUninitializeBaseMcb
FsRtlUninitializeFileLock@4
-FsRtlUninitializeLargeMcb@4
-FsRtlUninitializeMcb@4
-FsRtlUninitializeOplock@4
+FsRtlUninitializeLargeMcb
+FsRtlUninitializeMcb
+FsRtlUninitializeOplock
HalDispatchTable=_HalDispatchTable
HalPrivateDispatchTable DATA
@HalExamineMBR@16
IoAllocateDriverObjectExtension@16
IoAllocateErrorLogEntry@8
IoAllocateWorkItem@4
-IoAssignDriveLetters@16
+@IoAssignDriveLetters@16
IoAssignResources@24
IoAttachDevice@12
IoAttachDeviceByPointer@8
@IofCallDriver@8
@IofCompleteRequest@8
IoIsWdmVersionAvailable@8
-KdComPortInUse DATA
-KdDebuggerEnabled=_KdDebuggerEnabled
+KdComPortInUse
KdDebuggerNotPresent=_KdDebuggerNotPresent
-KdDisableDebugger@0
-KdEnableDebugger@0
-KdEnteredDebugger
-KdPollBreakIn@0
-KdPowerTransition@4
-KdpServiceDispatcher@12
Ke386CallBios@8
@KeAcquireGuardedMutex@4
@KeAcquireGuardedMutexUnsafe@4
KeDeregisterBugCheckReasonCallback@4
KeDetachProcess@0
KeDisconnectInterrupt@4
-KeEnterCriticalRegion@0
-KeEnterGuardedRegion@0
-KeEnterKernelDebugger@0
+KeEnterCriticalRegion@0=_KeEnterCriticalRegion@0
+KeEnterGuardedRegion@0=_KeEnterGuardedRegion@0
+;KeEnterKernelDebugger@0
KeFindConfigurationEntry@16
KeFindConfigurationNextEntry@20
KeFlushEntireTb@8
KeInsertQueueDpc@12
KeIsAttachedProcess@0
KeIsExecutingDpc@0
-KeLeaveCriticalRegion@0
-KeLeaveGuardedRegion@0
+KeLeaveCriticalRegion@0=_KeLeaveCriticalRegion@0
+KeLeaveGuardedRegion@0=_KeLeaveGuardedRegion@0
KeLoaderBlock DATA
KeNumberProcessors DATA
KeProfileInterrupt@4
KeTerminateThread@4
KeTickCount DATA
@KeTryToAcquireGuardedMutex@4
+@KeTryToAcquireSpinLockAtDpcLevel@4
KeUpdateRunTime@4
KeUpdateSystemTime@0
KeUnstackDetachProcess@4
KiCheckForKernelApcDelivery@0
KiDeliverApc@12
KiDispatchInterrupt@0
-KiInterruptDispatch2@8
-KiEnableTimerWatchdog
+;KiEnableTimerWatchdog
KiIpiServiceRoutine@8
@KiReleaseSpinLock@4
KiUnexpectedInterrupt
PsLookupProcessByProcessId@8
PsLookupProcessThreadByCid@12
PsLookupThreadByThreadId@8
-PsProcessType DATA
+PsProcessType=_PsProcessType
PsReferenceImpersonationToken@16
PsReferencePrimaryToken@4
PsRemoveCreateThreadNotifyRoutine@4
ZwCreateSection@28
ZwCreateSymbolicLinkObject@16
ZwCreateTimer@16
-ZwDeleteBootEntry@8
ZwDeleteFile@4
ZwDeleteKey@4
ZwDeleteValueKey@8
ZwSetVolumeInformationFile@20
ZwTerminateJobObject@8
ZwTerminateProcess@8
-ZwTranslateFilePath@12
+ZwTranslateFilePath@16
ZwUnloadDriver@4
ZwUnloadKey@4
ZwUnmapViewOfSection@8