@ fastcall -arch=i386 ExiReleaseFastMutex(ptr) ExReleaseFastMutex
@ fastcall -arch=i386 ExiTryToAcquireFastMutex(ptr) ExTryToAcquireFastMutex
@ stdcall FsRtlAcquireFileExclusive(ptr)
-;FsRtlAddBaseMcbEntry
+@ stdcall FsRtlAddBaseMcbEntry(ptr long long long long long long)
@ stdcall FsRtlAddLargeMcbEntry(ptr long long long long long long)
@ stdcall FsRtlAddMcbEntry(ptr long long long)
@ stdcall FsRtlAddToTunnelCache(ptr long long ptr ptr long long ptr)
@ stdcall FsRtlFindInTunnelCache(ptr long long ptr ptr ptr ptr ptr)
@ stdcall FsRtlFreeFileLock(ptr)
@ stdcall FsRtlGetFileSize(ptr ptr)
-;FsRtlGetNextBaseMcbEntry
+@ stdcall FsRtlGetNextBaseMcbEntry(ptr long ptr ptr ptr)
@ stdcall FsRtlGetNextFileLock(ptr long)
@ stdcall FsRtlGetNextLargeMcbEntry(ptr long ptr ptr ptr)
@ stdcall FsRtlGetNextMcbEntry(ptr long ptr ptr ptr)
@ stdcall FsRtlIncrementCcFastReadNotPossible()
@ stdcall FsRtlIncrementCcFastReadResourceMiss()
@ stdcall FsRtlIncrementCcFastReadWait()
-;FsRtlInitializeBaseMcb
+@ stdcall FsRtlInitializeBaseMcb(ptr ptr)
@ stdcall FsRtlInitializeFileLock(ptr ptr ptr)
@ stdcall FsRtlInitializeLargeMcb(ptr long)
@ stdcall FsRtlInitializeMcb(ptr long)
@ stdcall FsRtlIsPagingFile(ptr)
@ stdcall FsRtlIsTotalDeviceFailure(ptr)
@ extern FsRtlLegalAnsiCharacterArray _FsRtlLegalAnsiCharacterArray
-;FsRtlLookupBaseMcbEntry
+@ stdcall FsRtlLookupBaseMcbEntry(ptr long long ptr ptr ptr ptr ptr)
@ stdcall FsRtlLookupLargeMcbEntry(ptr long long ptr ptr ptr ptr ptr)
-;FsRtlLookupLastBaseMcbEntry
-;FsRtlLookupLastBaseMcbEntryAndIndex
+@ stdcall FsRtlLookupLastBaseMcbEntry(ptr ptr ptr)
+@ stdcall FsRtlLookupLastBaseMcbEntryAndIndex(ptr ptr ptr ptr)
@ stdcall FsRtlLookupLastLargeMcbEntry(ptr ptr ptr)
@ stdcall FsRtlLookupLastLargeMcbEntryAndIndex(ptr ptr ptr ptr)
@ stdcall FsRtlLookupLastMcbEntry(ptr ptr ptr)
@ stdcall FsRtlNotifyReportChange(ptr ptr ptr ptr long)
@ stdcall FsRtlNotifyUninitializeSync(ptr)
@ stdcall FsRtlNotifyVolumeEvent(ptr long)
-;FsRtlNumberOfRunsInBaseMcb
+@ stdcall FsRtlNumberOfRunsInBaseMcb(ptr)
@ stdcall FsRtlNumberOfRunsInLargeMcb(ptr)
@ stdcall FsRtlNumberOfRunsInMcb(ptr)
@ stdcall FsRtlOplockFsctrl(ptr ptr long)
@ stdcall FsRtlRegisterFileSystemFilterCallbacks(ptr ptr)
@ stdcall FsRtlRegisterUncProvider(ptr ptr long)
@ stdcall FsRtlReleaseFile(ptr)
-;FsRtlRemoveBaseMcbEntry
+@ stdcall FsRtlRemoveBaseMcbEntry(ptr long long long long)
@ stdcall FsRtlRemoveLargeMcbEntry(ptr long long long long)
@ stdcall FsRtlRemoveMcbEntry(ptr long long)
@ stdcall FsRtlRemovePerFileObjectContext(ptr ptr ptr)
@ stdcall FsRtlRemovePerStreamContext(ptr ptr ptr)
-;FsRtlResetBaseMcb
+@ stdcall FsRtlResetBaseMcb(ptr)
@ stdcall FsRtlResetLargeMcb(ptr long)
-;FsRtlSplitBaseMcb
+@ stdcall FsRtlSplitBaseMcb(ptr long long long long)
@ stdcall FsRtlSplitLargeMcb(ptr long long long long)
@ stdcall FsRtlSyncVolumes(long long long)
@ stdcall FsRtlTeardownPerStreamContexts(ptr)
-;FsRtlTruncateBaseMcb
+@ stdcall FsRtlTruncateBaseMcb(ptr long long)
@ stdcall FsRtlTruncateLargeMcb(ptr long long)
@ stdcall FsRtlTruncateMcb(ptr long)
-;FsRtlUninitializeBaseMcb
+@ stdcall FsRtlUninitializeBaseMcb(ptr)
@ stdcall FsRtlUninitializeFileLock(ptr)
@ stdcall FsRtlUninitializeLargeMcb(ptr)
@ stdcall FsRtlUninitializeMcb(ptr)
@ stdcall KeFindConfigurationNextEntry(ptr long long ptr ptr)
@ stdcall KeFlushEntireTb(long long)
@ stdcall KeFlushQueuedDpcs()
-;KeGenericCallDpc
+@ stdcall KeGenericCallDpc(ptr ptr)
@ stdcall KeGetCurrentThread()
@ stdcall KeGetPreviousMode()
@ stdcall KeGetRecommendedSharedDataAlignment()
@ stdcall KeLeaveCriticalRegion() _KeLeaveCriticalRegion
@ stdcall KeLeaveGuardedRegion() _KeLeaveGuardedRegion
@ extern KeLoaderBlock
-@ cdecl -arch=x86_64 KeLowerIrql(long)
+@ cdecl -arch=x86_64 -private KeLowerIrql(long)
@ extern KeNumberProcessors _KeNumberProcessors
@ stdcall -arch=i386,arm KeProfileInterrupt(ptr)
@ stdcall KeProfileInterruptWithSource(ptr long)
@ stdcall -arch=i386,arm KeQuerySystemTime(ptr)
@ stdcall -arch=i386,arm KeQueryTickCount(ptr)
@ stdcall KeQueryTimeIncrement()
-@ cdecl -arch=x86_64 KeRaiseIrqlToDpcLevel()
+@ cdecl -arch=x86_64 -private KeRaiseIrqlToDpcLevel()
@ stdcall KeRaiseUserException(long)
@ stdcall KeReadStateEvent(ptr)
@ stdcall KeReadStateMutant(ptr)
@ stdcall KeRegisterNmiCallback(ptr ptr)
@ fastcall KeReleaseGuardedMutex(ptr)
@ fastcall KeReleaseGuardedMutexUnsafe(ptr)
+@ cdecl -arch=x86_64 KeReleaseInStackQueuedSpinLock(ptr)
@ fastcall KeReleaseInStackQueuedSpinLockForDpc(ptr)
@ fastcall KeReleaseInStackQueuedSpinLockFromDpcLevel(ptr)
@ stdcall KeReleaseInterruptSpinLock(ptr long)
@ stdcall KeSetTimeIncrement(long long)
@ stdcall KeSetTimer(ptr long long ptr)
@ stdcall KeSetTimerEx(ptr long long long ptr)
-;KeSignalCallDpcDone
-;KeSignalCallDpcSynchronize
+@ stdcall KeSignalCallDpcDone(ptr)
+@ stdcall KeSignalCallDpcSynchronize(ptr)
@ stdcall KeStackAttachProcess(ptr ptr)
@ stdcall KeSynchronizeExecution(ptr ptr ptr)
@ stdcall KeTerminateThread(long)
@ fastcall -arch=i386,arm KefAcquireSpinLockAtDpcLevel(ptr)
@ fastcall -arch=i386,arm KefReleaseSpinLockFromDpcLevel(ptr)
@ stdcall -arch=i386 Kei386EoiHelper()
-@ cdecl -arch=x86_64 KfRaiseIrql(long)
+@ cdecl -arch=x86_64 -private KfRaiseIrql(long)
@ fastcall -arch=i386 KiEoiHelper(ptr)
@ fastcall -arch=i386,arm KiAcquireSpinLock(ptr)
@ extern KiBugCheckData
@ stdcall ObCloseHandle(ptr long)
@ stdcall ObCreateObject(long ptr ptr long ptr long long long ptr)
@ stdcall ObCreateObjectType(ptr ptr ptr ptr)
-;ObDeleteCapturedInsertInfo
+@ stdcall ObDeleteCapturedInsertInfo(ptr)
@ stdcall ObDereferenceObject(ptr)
@ stdcall -arch=i386,arm ObDereferenceObjectDeferDelete(ptr)
@ stdcall ObDereferenceSecurityDescriptor(ptr long)
@ stdcall ObReferenceObjectByPointer(ptr long ptr long)
@ stdcall ObReferenceSecurityDescriptor(ptr long)
@ stdcall ObReleaseObjectSecurity(ptr long)
-;ObSetHandleAttributes@12
+@ stdcall ObSetHandleAttributes(ptr ptr long)
@ stdcall ObSetSecurityDescriptorInfo(ptr ptr ptr ptr long ptr)
@ stdcall ObSetSecurityObjectByPointer(ptr long ptr)
@ fastcall ObfDereferenceObject(ptr)
@ stdcall PsGetCurrentThread() KeGetCurrentThread
@ stdcall PsGetCurrentThreadId()
@ stdcall PsGetCurrentThreadPreviousMode()
-;PsGetCurrentThreadProcess
-;PsGetCurrentThreadProcessId
+@ stdcall PsGetCurrentThreadProcess()
+@ stdcall PsGetCurrentThreadProcessId()
@ stdcall PsGetCurrentThreadStackBase()
@ stdcall PsGetCurrentThreadStackLimit()
-;PsGetCurrentThreadTeb
+@ stdcall PsGetCurrentThreadTeb()
@ stdcall PsGetCurrentThreadWin32Thread()
;PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion
@ stdcall PsGetJobLock(ptr)
@ stdcall RtlConvertSidToUnicodeString(ptr ptr long)
@ stdcall RtlConvertUlongToLargeInteger(long)
@ stdcall RtlCopyLuid(ptr ptr)
+@ stdcall -arch=x86_64 RtlCopyMemory(ptr ptr int64) memmove
+@ stdcall -arch=x86_64 RtlCopyMemoryNonTemporal(ptr ptr int64) memmove
@ stdcall RtlCopyRangeList(ptr ptr)
@ stdcall RtlCopySid(long ptr ptr)
@ stdcall RtlCopyString(ptr ptr)
@ stdcall RtlValidSid(ptr)
@ stdcall RtlVerifyVersionInfo(ptr long long long)
@ cdecl -arch=x86_64 RtlVirtualUnwind(long double double ptr ptr ptr ptr ptr)
-@ stdcall RtlVolumeDeviceToDosName(ptr ptr)
+@ stdcall RtlVolumeDeviceToDosName(ptr ptr) IoVolumeDeviceToDosName
@ stdcall RtlWalkFrameChain(ptr long long)
@ stdcall RtlWriteRegistryValue(long wstr wstr long ptr long)
@ stdcall RtlZeroHeap(ptr long)
@ stdcall SeTokenIsAdmin(ptr)
@ stdcall SeTokenIsRestricted(ptr)
@ stdcall SeTokenIsWriteRestricted(ptr)
+@ extern SeTokenObjectType
@ stdcall SeTokenType(ptr)
@ stdcall SeUnlockSubjectContext(ptr)
@ stdcall SeUnregisterLogonSessionTerminatedRoutine(ptr)