ExDeleteNPagedLookasideList@4
ExDeletePagedLookasideList@4
ExDeleteResourceLite@4
-ExDesktopObjectType DATA
+ExDesktopObjectType
ExDisableResourceBoostLite@4
ExEnumHandleTable@16
@ExEnterCriticalRegionAndAcquireFastMutexUnsafe@4
-ExEventObjectType DATA
+ExEventObjectType=_ExEventObjectType
ExExtendZone@12
ExFreePool@4
ExFreePoolWithTag@8
@ExReleaseFastMutexUnsafeAndLeaveCriticalRegion@4
ExReleaseResourceForThreadLite@8
@ExReleaseResourceLite@4
-ExSemaphoreObjectType DATA
+ExSemaphoreObjectType=_ExSemaphoreObjectType
ExSetResourceOwnerPointer@8
ExSetTimerResolution@8
ExSystemExceptionFilter@0
ExSystemTimeToLocalTime@8
+@ExiTryToAcquireFastMutex@4=@ExTryToAcquireFastMutex@4
ExTryToAcquireResourceExclusiveLite@4
ExUnregisterCallback@4
ExUuidCreate@4
Exi386InterlockedDecrementLong@4
Exi386InterlockedExchangeUlong@12
Exi386InterlockedIncrementLong@4
-FsRtlAcquireFileExclusive@4
-FsRtlAddLargeMcbEntry@28
-FsRtlAddMcbEntry@16
-FsRtlAddToTunnelCache@32
-FsRtlAllocateFileLock@8
-FsRtlAllocatePool@8
-FsRtlAllocatePoolWithQuota@8
-FsRtlAllocatePoolWithQuotaTag@12
-FsRtlAllocatePoolWithTag@12
-FsRtlAllocateResource@0
+FsRtlAcquireFileExclusive
+;FsRtlAddBaseMcbEntry
+FsRtlAddLargeMcbEntry
+FsRtlAddMcbEntry
+FsRtlAddToTunnelCache
+FsRtlAllocateFileLock
+FsRtlAllocatePool
+FsRtlAllocatePoolWithQuota
+FsRtlAllocatePoolWithQuotaTag
+FsRtlAllocatePoolWithTag
+FsRtlAllocateResource
FsRtlAreNamesEqual@16
-FsRtlBalanceReads@4
+FsRtlBalanceReads
FsRtlCheckLockForReadAccess@8
FsRtlCheckLockForWriteAccess@8
-FsRtlCheckOplock@20
-FsRtlCopyRead@32
-FsRtlCopyWrite@32
-FsRtlCurrentBatchOplock@4
-FsRtlDeleteKeyFromTunnelCache@12
-FsRtlDeleteTunnelCache@4
-FsRtlDeregisterUncProvider@4
-FsRtlDissectDbcs@16
-FsRtlDissectName@16
-FsRtlDoesDbcsContainWildCards@4
+FsRtlCheckOplock
+FsRtlCopyRead
+FsRtlCopyWrite
+;FsRtlCreateSectionForDataScan
+FsRtlCurrentBatchOplock
+FsRtlDeleteKeyFromTunnelCache
+FsRtlDeleteTunnelCache
+FsRtlDeregisterUncProvider
+FsRtlDissectDbcs
+FsRtlDissectName
+FsRtlDoesDbcsContainWildCards
FsRtlDoesNameContainWildCards@4
-FsRtlFastCheckLockForRead@24
-FsRtlFastCheckLockForWrite@24
+FsRtlFastCheckLockForRead
+FsRtlFastCheckLockForWrite
FsRtlFastUnlockAll@16
-FsRtlFastUnlockAllByKey@20
-FsRtlFastUnlockSingle@32
-FsRtlFindInTunnelCache@32
-FsRtlFreeFileLock@4
-FsRtlGetFileSize@8
-FsRtlGetNextFileLock@8
-FsRtlGetNextLargeMcbEntry@20
-FsRtlGetNextMcbEntry@20
-FsRtlIncrementCcFastReadNotPossible@0
-FsRtlIncrementCcFastReadNoWait@0
-FsRtlIncrementCcFastReadResourceMiss@0
-FsRtlIncrementCcFastReadWait@0
+FsRtlFastUnlockAllByKey
+FsRtlFastUnlockSingle
+FsRtlFindInTunnelCache
+FsRtlFreeFileLock
+FsRtlGetFileSize
+;FsRtlGetNextBaseMcbEntry
+FsRtlGetNextFileLock
+FsRtlGetNextLargeMcbEntry
+FsRtlGetNextMcbEntry
+FsRtlIncrementCcFastReadNotPossible
+FsRtlIncrementCcFastReadNoWait
+FsRtlIncrementCcFastReadResourceMiss
+FsRtlIncrementCcFastReadWait
+;FsRtlInitializeBaseMcb
FsRtlInitializeFileLock@12
-FsRtlInitializeLargeMcb@8
-FsRtlInitializeMcb@8
-FsRtlInitializeOplock@4
-FsRtlInitializeTunnelCache@4
-FsRtlInsertPerFileObjectContext@8
-FsRtlInsertPerStreamContext@8
-FsRtlIsDbcsInExpression@8
-FsRtlIsFatDbcsLegal@20
-FsRtlIsHpfsDbcsLegal@20
+FsRtlInitializeLargeMcb
+FsRtlInitializeMcb
+FsRtlInitializeOplock
+FsRtlInitializeTunnelCache
+FsRtlInsertPerFileObjectContext
+FsRtlInsertPerStreamContext
+FsRtlIsDbcsInExpression
+FsRtlIsFatDbcsLegal
+FsRtlIsHpfsDbcsLegal
FsRtlIsNameInExpression@16
-FsRtlIsNtstatusExpected@4
-FsRtlIsPagingFile@4
-FsRtlIsTotalDeviceFailure@4
-FsRtlLegalAnsiCharacterArray DATA
-FsRtlLookupLargeMcbEntry@32
-FsRtlLookupLastLargeMcbEntry@12
-FsRtlLookupLastLargeMcbEntryAndIndex@16
-FsRtlLookupLastMcbEntry@12
-FsRtlLookupMcbEntry@20
-FsRtlLookupPerFileObjectContext@12
-FsRtlLookupPerStreamContextInternal@12
-FsRtlMdlRead@24
-FsRtlMdlReadComplete@8
-FsRtlMdlReadCompleteDev@12
-FsRtlMdlReadDev@28
-FsRtlMdlWriteComplete@12
-FsRtlMdlWriteCompleteDev@16
-FsRtlNormalizeNtstatus@8
-FsRtlNotifyChangeDirectory@28
-FsRtlNotifyCleanup@12
-FsRtlNotifyFilterChangeDirectory@44
-FsRtlNotifyFilterReportChange@40
-FsRtlNotifyFullChangeDirectory@40
-FsRtlNotifyFullReportChange@36
-FsRtlNotifyInitializeSync@4
-FsRtlNotifyReportChange@20
-FsRtlNotifyUninitializeSync@4
-FsRtlNotifyVolumeEvent@8
-FsRtlNumberOfRunsInLargeMcb@4
-FsRtlNumberOfRunsInMcb@4
-FsRtlOplockFsctrl@12
-FsRtlOplockIsFastIoPossible@4
-FsRtlPostPagingFileStackOverflow@12
-FsRtlPostStackOverflow@12
-FsRtlPrepareMdlWrite@24
-FsRtlPrepareMdlWriteDev@28
-FsRtlPrivateLock@48
+FsRtlIsNtstatusExpected
+FsRtlIsPagingFile
+FsRtlIsTotalDeviceFailure
+FsRtlLegalAnsiCharacterArray=_FsRtlLegalAnsiCharacterArray
+;FsRtlLookupBaseMcbEntry
+FsRtlLookupLargeMcbEntry
+;FsRtlLookupLastBaseMcbEntry
+;FsRtlLookupLastBaseMcbEntryAndIndex
+FsRtlLookupLastLargeMcbEntry
+FsRtlLookupLastLargeMcbEntryAndIndex
+FsRtlLookupLastMcbEntry
+FsRtlLookupMcbEntry
+FsRtlLookupPerFileObjectContext
+FsRtlLookupPerStreamContextInternal
+FsRtlMdlRead
+FsRtlMdlReadComplete
+FsRtlMdlReadCompleteDev
+FsRtlMdlReadDev
+FsRtlMdlWriteComplete
+FsRtlMdlWriteCompleteDev
+FsRtlNormalizeNtstatus
+FsRtlNotifyChangeDirectory
+FsRtlNotifyCleanup
+FsRtlNotifyFilterChangeDirectory
+FsRtlNotifyFilterReportChange
+FsRtlNotifyFullChangeDirectory
+FsRtlNotifyFullReportChange
+FsRtlNotifyInitializeSync
+FsRtlNotifyReportChange
+FsRtlNotifyUninitializeSync
+FsRtlNotifyVolumeEvent
+;FsRtlNumberOfRunsInBaseMcb
+FsRtlNumberOfRunsInLargeMcb
+FsRtlNumberOfRunsInMcb
+FsRtlOplockFsctrl
+FsRtlOplockIsFastIoPossible
+FsRtlPostPagingFileStackOverflow
+FsRtlPostStackOverflow
+FsRtlPrepareMdlWrite
+FsRtlPrepareMdlWriteDev
+FsRtlPrivateLock
FsRtlProcessFileLock@12
-FsRtlRegisterUncProvider@12
-FsRtlReleaseFile@4
-FsRtlRemoveLargeMcbEntry@20
-FsRtlRemoveMcbEntry@12
-FsRtlRemovePerFileObjectContext@12
-FsRtlRemovePerStreamContext@12
-FsRtlResetLargeMcb@8
-FsRtlSplitLargeMcb@20
-FsRtlSyncVolumes@12
-FsRtlTeardownPerStreamContexts@4
-FsRtlTruncateLargeMcb@12
-FsRtlTruncateMcb@8
+FsRtlRegisterFileSystemFilterCallbacks
+FsRtlRegisterUncProvider
+FsRtlReleaseFile
+;FsRtlRemoveBaseMcbEntry
+FsRtlRemoveLargeMcbEntry
+FsRtlRemoveMcbEntry
+FsRtlRemovePerFileObjectContext
+FsRtlRemovePerStreamContext
+;FsRtlResetBaseMcb
+FsRtlResetLargeMcb
+;FsRtlSplitBaseMcb
+FsRtlSplitLargeMcb
+FsRtlSyncVolumes
+FsRtlTeardownPerStreamContexts
+;FsRtlTruncateBaseMcb
+FsRtlTruncateLargeMcb
+FsRtlTruncateMcb
+;FsRtlUninitializeBaseMcb
FsRtlUninitializeFileLock@4
-FsRtlUninitializeLargeMcb@4
-FsRtlUninitializeMcb@4
-FsRtlUninitializeOplock@4
-HalDispatchTable DATA
+FsRtlUninitializeLargeMcb
+FsRtlUninitializeMcb
+FsRtlUninitializeOplock
+HalDispatchTable=_HalDispatchTable
HalPrivateDispatchTable DATA
@HalExamineMBR@16
InbvAcquireDisplayOwnership@0
IoAllocateDriverObjectExtension@16
IoAllocateErrorLogEntry@8
IoAllocateWorkItem@4
-IoAssignDriveLetters@16
+@IoAssignDriveLetters@16
IoAssignResources@24
IoAttachDevice@12
IoAttachDeviceByPointer@8
IoEnqueueIrp@4
IoEnumerateDeviceObjectList@16
IoFastQueryNetworkAttributes@20
-IoFileObjectType DATA
+IoFileObjectType=_IoFileObjectType
IoForwardAndCatchIrp@8=IoForwardIrpSynchronously@8
IoForwardIrpSynchronously@8
IoFreeController@4
@IofCallDriver@8
@IofCompleteRequest@8
IoIsWdmVersionAvailable@8
-KdComPortInUse DATA
-KdDebuggerEnabled DATA
-KdDebuggerNotPresent DATA
-KdDisableDebugger@0
-KdEnableDebugger@0
-KdEnteredDebugger
-KdPollBreakIn@0
-KdPowerTransition@4
-KdpServiceDispatcher@12
+KdComPortInUse
+KdDebuggerNotPresent=_KdDebuggerNotPresent
Ke386CallBios@8
-Ke386IoSetAccessProcess@8
-Ke386QueryIoAccessMap@8
-Ke386SetIoAccessMap@8
@KeAcquireGuardedMutex@4
@KeAcquireGuardedMutexUnsafe@4
KeAcquireSpinLockAtDpcLevel@4
KeDeregisterBugCheckReasonCallback@4
KeDetachProcess@0
KeDisconnectInterrupt@4
-KeEnterCriticalRegion@0
-KeEnterGuardedRegion@0
-KeEnterKernelDebugger@0
+KeEnterCriticalRegion@0=_KeEnterCriticalRegion@0
+KeEnterGuardedRegion@0=_KeEnterGuardedRegion@0
+;KeEnterKernelDebugger@0
KeFindConfigurationEntry@16
KeFindConfigurationNextEntry@20
KeFlushEntireTb@8
KeInsertQueueDpc@12
KeIsAttachedProcess@0
KeIsExecutingDpc@0
-KeLeaveCriticalRegion@0
-KeLeaveGuardedRegion@0
+KeLeaveCriticalRegion@0=_KeLeaveCriticalRegion@0
+KeLeaveGuardedRegion@0=_KeLeaveGuardedRegion@0
KeLoaderBlock DATA
KeNumberProcessors DATA
KeProfileInterrupt@4
KeSetTimeIncrement@8
KeSetTimer@16
KeSetTimerEx@20
-@KeSetTimeUpdateNotifyRoutine@4
KeStackAttachProcess@8
KeSynchronizeExecution@12
KeTerminateThread@4
KeTickCount DATA
@KeTryToAcquireGuardedMutex@4
-KeUpdateRunTime@8
-KeUpdateSystemTime@8
+@KeTryToAcquireSpinLockAtDpcLevel@4
+KeUpdateRunTime@4
+KeUpdateSystemTime@0
KeUnstackDetachProcess@4
KeUserModeCallback@20
KeWaitForMultipleObjects@32
KeWaitForSingleObject@20
@KefAcquireSpinLockAtDpcLevel@4
@KefReleaseSpinLockFromDpcLevel@4
-;Kei386EoiHelper
+Kei386EoiHelper@0
@KiAcquireSpinLock@4
;KiBugCheckData DATA
KiCoprocessorError@0
KiCheckForKernelApcDelivery@0
KiDeliverApc@12
KiDispatchInterrupt@0
-KiEnableTimerWatchdog
-KiInterruptDispatch2@8
+;KiEnableTimerWatchdog
KiIpiServiceRoutine@8
@KiReleaseSpinLock@4
-KiUnexpectedInterrupt@0
+KiUnexpectedInterrupt
;Kii386SpinOnSpinLock
KiRawTicks DATA
LdrAccessResource@16
PsDisableImpersonation@8
PsEstablishWin32Callouts@4
PsGetContextThread@12
-PsGetCurrentProcess@0=KeGetCurrentProcess@0
+PsGetCurrentProcess@0=IoGetCurrentProcess@0
PsGetCurrentProcessId@0
+PsGetCurrentProcessWin32Process@0
PsGetCurrentProcessSessionId@0
PsGetCurrentThread@0=KeGetCurrentThread@0
PsGetCurrentThreadId@0
PsGetCurrentThreadPreviousMode@0
+PsGetCurrentThreadWin32Thread@0
PsGetCurrentThreadStackBase@0
PsGetCurrentThreadStackLimit@0
PsGetJobLock@4
PsGetThreadTeb@4
PsGetThreadWin32Thread@4
PsGetVersion@16
-PsGetWin32Thread@0
-PsGetWin32Process@0
PsImpersonateClient@20
PsInitialSystemProcess DATA
PsIsProcessBeingDebugged@4
PsLookupProcessByProcessId@8
PsLookupProcessThreadByCid@12
PsLookupThreadByThreadId@8
-PsProcessType DATA
+PsProcessType=_PsProcessType
PsReferenceImpersonationToken@16
PsReferencePrimaryToken@4
PsRemoveCreateThreadNotifyRoutine@4
PsSetThreadWin32Thread@8
PsSetLoadImageNotifyRoutine@4
PsTerminateSystemThread@4
-PsThreadType DATA
+PsThreadType=_PsThreadType
READ_REGISTER_UCHAR@4
READ_REGISTER_ULONG@4
READ_REGISTER_USHORT@4
READ_REGISTER_BUFFER_USHORT@12
KiRosPrintAddress@4
KeRosDumpStackFrames@8
-KeRosGetStackFrames@8
RtlAbsoluteToSelfRelativeSD@12
RtlAddAccessAllowedAce@16
RtlAddAce@20
ZwCreateSection@28
ZwCreateSymbolicLinkObject@16
ZwCreateTimer@16
-ZwDeleteBootEntry@8
ZwDeleteFile@4
ZwDeleteKey@4
ZwDeleteValueKey@8
ZwSetVolumeInformationFile@20
ZwTerminateJobObject@8
ZwTerminateProcess@8
-ZwTranslateFilePath@12
+ZwTranslateFilePath@16
ZwUnloadDriver@4
ZwUnloadKey@4
ZwUnmapViewOfSection@8