2
; Definition file of ntoskrnl.exe
3
; Automatic generated by gendef
4
; written by Kai Tietz 2008
8
@ExAcquireFastMutexUnsafe@4
9
@ExAcquireRundownProtection@4
10
@ExAcquireRundownProtectionCacheAware@4
11
@ExAcquireRundownProtectionCacheAwareEx@4
12
@ExAcquireRundownProtectionEx@4
13
@ExEnterCriticalRegionAndAcquireFastMutexUnsafe@4
14
@ExInitializeRundownProtection@4
15
@ExInterlockedAddLargeStatistic@8
16
@ExInterlockedCompareExchange64@16
17
@ExInterlockedFlushSList@4
18
@ExInterlockedPopEntrySList@8
19
@ExInterlockedPushEntrySList@12
20
@ExReInitializeRundownProtection@4
21
@ExReInitializeRundownProtectionCacheAware@4
22
@ExReleaseFastMutexUnsafe@4
23
@ExReleaseFastMutexUnsafeAndLeaveCriticalRegion@4
24
@ExReleaseResourceAndLeaveCriticalRegion@4
25
@ExReleaseResourceAndLeavePriorityRegion@4
26
@ExReleaseResourceLite@4
27
@ExReleaseRundownProtection@4
28
@ExReleaseRundownProtectionCacheAware@4
29
@ExReleaseRundownProtectionCacheAwareEx@8
30
@ExReleaseRundownProtectionEx@8
32
@ExRundownCompletedCacheAware@4
33
@ExWaitForRundownProtectionRelease@4
34
@ExWaitForRundownProtectionReleaseCacheAware@4
35
@ExfAcquirePushLockExclusive@4
36
@ExfAcquirePushLockShared@4
37
@ExfInterlockedAddUlong@12
38
@ExfInterlockedCompareExchange64@12
39
@ExfInterlockedInsertHeadList@12
40
@ExfInterlockedInsertTailList@12
41
@ExfInterlockedPopEntryList@8
42
@ExfInterlockedPushEntryList@12
43
@ExfInterlockedRemoveHeadList@8
45
@ExfReleasePushLockExclusive@4
46
@ExfReleasePushLockShared@4
47
@ExfTryAcquirePushLockShared@4
48
@ExfTryToWakePushLock@4
50
@Exfi386InterlockedDecrementLong@4
51
@Exfi386InterlockedExchangeUlong@8
52
@Exfi386InterlockedIncrementLong@4
53
@ExiAcquireFastMutex@4
54
@ExiReleaseFastMutex@4
55
@ExiTryToAcquireFastMutex@4
57
@InterlockedCompareExchange@12
58
@InterlockedDecrement@4
59
@InterlockedExchange@8
60
@InterlockedExchangeAdd@8
61
@InterlockedIncrement@4
62
@InterlockedPopEntrySList@4
63
@InterlockedPushEntrySList@8
64
@IoGetPagingIoPriority@4
65
@IoReadPartitionTable@16
66
@IoSetPartitionInformation@16
67
@IoWritePartitionTable@20
70
@KeAcquireGuardedMutex@4
71
@KeAcquireGuardedMutexUnsafe@4
72
@KeAcquireInStackQueuedSpinLockAtDpcLevel@8
73
@KeAcquireInStackQueuedSpinLockForDpc@8
74
@KeAcquireSpinLockForDpc@8
75
@KeInitializeGuardedMutex@4
76
@KeInvalidateRangeAllCaches@8
77
@KeReleaseGuardedMutex@4
78
@KeReleaseGuardedMutexUnsafe@4
79
@KeReleaseInStackQueuedSpinLockForDpc@4
80
@KeReleaseInStackQueuedSpinLockFromDpcLevel@4
81
@KeReleaseSpinLockForDpc@8
83
@KeTryToAcquireGuardedMutex@4
84
@KeTryToAcquireSpinLockAtDpcLevel@4
86
@KefAcquireSpinLockAtDpcLevel@4
87
@KefReleaseSpinLockFromDpcLevel@4
89
;KiCheckForSListAddress
91
@ObfDereferenceObject@4
92
;ObfDereferenceObjectWithTag
94
;ObfReferenceObjectWithTag
95
@RtlPrefetchMemoryNonTemporal@8
97
@RtlUlonglongByteSwap@8
99
;SeAuditingWithTokenForSubcategory
103
AlpcGetMessageAttribute@8
104
AlpcInitializeMessageAttribute@16
106
CcCoherencyFlushAndPurgeCache@20
109
CcCopyWriteWontFlush@12
113
CcFastMdlReadWait DATA
116
CcGetFileObjectFromBcb@4
117
CcGetFileObjectFromSectionPtrs@4
118
CcGetFileObjectFromSectionPtrsRef@4
119
CcGetFlushedValidData@8
120
CcGetLsnForFileObject@8
121
CcInitializeCacheMap@20
123
CcIsThereDirtyDataEx@8
128
CcMdlWriteComplete@12
133
CcPurgeCacheSection@16
136
CcScheduleReadAhead@12
137
CcSetAdditionalCacheAttributes@12
138
CcSetBcbOwnerPointer@8
139
CcSetDirtyPageThreshold@8
140
CcSetDirtyPinnedData@8
143
CcSetLogHandleForFile@12
144
CcSetParallelFlushFile@8
145
CcSetReadAheadGranularity@8
147
CcUninitializeCacheMap@12
149
CcUnpinDataForThread@8
150
CcUnpinRepinnedBcb@12
151
CcWaitForCurrentLazyWriterActivity@0
153
CmCallbackGetKeyObjectID@16
154
CmGetBoundTransaction@8
155
CmGetCallbackVersion@8
157
CmRegisterCallback@12
158
CmRegisterCallbackEx@24
159
CmSetCallbackObjectContext@16
160
CmUnRegisterCallback@8
162
DbgBreakPointWithStatus@4
164
DbgLoadImageSymbols@12
167
DbgPrintReturnControlC
169
DbgQueryDebugFilterState@8
170
DbgSetDebugFilterState@12
171
DbgSetDebugPrintCallback@8
172
DbgkLkmdRegisterCallback@12
173
DbgkLkmdUnregisterCallback@4
174
EmClientQueryRuleState@8
175
EmClientRuleDeregisterNotification@4
176
EmClientRuleEvaluate@16
177
EmClientRuleRegisterNotification@16
178
EmProviderDeregister@4
179
EmProviderDeregisterEntry@4
180
EmProviderRegister@24
181
EmProviderRegisterEntry@16
182
EmpProviderRegister@24
183
EtwActivityIdControl@8
186
EtwProviderEnabled@20
188
EtwRegisterClassicProvider@20
189
EtwSendTraceBuffer@24
192
EtwWriteEndScenario@24
194
EtwWriteStartScenario@24
197
ExAcquireCacheAwarePushLockExclusive@4
198
ExAcquireResourceExclusiveLite@8
199
ExAcquireResourceSharedLite@8
200
ExAcquireSharedStarveExclusive@8
201
ExAcquireSharedWaitForExclusive@8
202
ExAcquireSpinLockExclusive@4
203
ExAcquireSpinLockExclusiveAtDpcLevel@4
204
ExAcquireSpinLockShared@4
205
ExAcquireSpinLockSharedAtDpcLevel@4
206
ExAllocateCacheAwarePushLock@4
207
ExAllocateCacheAwareRundownProtection@8
208
ExAllocateFromPagedLookasideList@4
210
ExAllocatePoolWithQuota@8
211
ExAllocatePoolWithQuotaTag@12
212
ExAllocatePoolWithTag@12
213
ExAllocatePoolWithTagPriority@16
214
ExConvertExclusiveToSharedLite@4
216
ExDeleteLookasideListEx@4
217
ExDeleteNPagedLookasideList@4
218
ExDeletePagedLookasideList@4
219
ExDeleteResourceLite@4
220
ExDesktopObjectType DATA
221
ExDisableResourceBoostLite@4
222
ExEnterCriticalRegionAndAcquireResourceExclusive@4
223
ExEnterCriticalRegionAndAcquireResourceShared@4
224
ExEnterCriticalRegionAndAcquireSharedWaitForExclusive@4
225
ExEnterPriorityRegionAndAcquireResourceExclusive@4
226
ExEnterPriorityRegionAndAcquireResourceShared@4
228
ExEventObjectType DATA
230
ExFetchLicenseData@12
231
ExFlushLookasideListEx@4
232
ExFreeCacheAwarePushLock@4
233
ExFreeCacheAwareRundownProtection@4
236
ExFreeToPagedLookasideList@8
237
ExGetCurrentProcessorCounts@12
238
ExGetCurrentProcessorCpuUsage@4
239
ExGetExclusiveWaiterCount@4
240
ExGetLicenseTamperState@4
242
ExGetSharedWaiterCount@4
243
ExInitializeLookasideListEx@32
244
ExInitializeNPagedLookasideList@28
245
ExInitializePagedLookasideList@28
246
ExInitializePushLock@4
247
ExInitializeResourceLite@4
248
ExInitializeRundownProtectionCacheAware@8
250
ExInterlockedAddLargeInteger@16
251
ExInterlockedAddUlong@12
252
ExInterlockedDecrementLong@8
253
ExInterlockedExchangeUlong@12
254
ExInterlockedExtendZone@16
255
@ExInterlockedIncrementLong@8
256
ExInterlockedInsertHeadList@12
257
ExInterlockedInsertTailList@12
258
ExInterlockedPopEntryList@8
259
ExInterlockedPushEntryList@12
260
ExInterlockedRemoveHeadList@8
261
ExIsProcessorFeaturePresent@4
262
ExIsResourceAcquiredExclusiveLite@4
263
ExIsResourceAcquiredSharedLite@4
264
ExLocalTimeToSystemTime@8
266
ExQueryAttributeInformation@16
267
ExQueryPoolBlockSize@8
269
ExRaiseAccessViolation@0
270
ExRaiseDatatypeMisalignment@0
274
ExRegisterAttributeInformationCallback@4
275
ExRegisterCallback@12
276
ExRegisterExtension@12
277
ExReinitializeResourceLite@4
278
ExReleaseCacheAwarePushLockExclusive@4
279
ExReleaseResourceForThreadLite@8
280
ExReleaseSpinLockExclusive@8
281
ExReleaseSpinLockExclusiveFromDpcLevel@4
282
ExReleaseSpinLockShared@8
283
ExReleaseSpinLockSharedFromDpcLevel@4
284
ExSemaphoreObjectType DATA
285
ExSetLicenseTamperState@4
286
ExSetResourceOwnerPointer@8
287
ExSetResourceOwnerPointerEx@12
288
ExSetTimerResolution@8
289
ExSizeOfRundownProtectionCacheAware@0
290
ExSystemExceptionFilter@0
291
ExSystemTimeToLocalTime@8
292
ExTryConvertSharedSpinLockExclusive@4
293
ExUnregisterAttributeInformationCallback@4
294
ExUnregisterCallback@4
295
ExUnregisterExtension@4
296
ExUpdateLicenseData@8
299
ExWindowStationObjectType DATA
300
Exi386InterlockedDecrementLong@4
301
Exi386InterlockedExchangeUlong@8
302
Exi386InterlockedIncrementLong@4
304
FsRtlAcknowledgeEcp@4
305
FsRtlAcquireFileExclusive@4
306
FsRtlAddBaseMcbEntry@28
307
FsRtlAddBaseMcbEntryEx@28
308
FsRtlAddLargeMcbEntry@28
310
FsRtlAddToTunnelCache@32
311
FsRtlAllocateExtraCreateParameter@24
312
FsRtlAllocateExtraCreateParameterFromLookasideList@24
313
FsRtlAllocateExtraCreateParameterList@8
314
FsRtlAllocateFileLock@8
316
FsRtlAllocatePoolWithQuota@8
317
FsRtlAllocatePoolWithQuotaTag@12
318
FsRtlAllocatePoolWithTag@12
319
FsRtlAllocateResource@0
320
FsRtlAreNamesEqual@16
321
FsRtlAreThereCurrentOrInProgressFileLocks@4
322
FsRtlAreVolumeStartupApplicationsComplete@0
324
FsRtlCancellableWaitForMultipleObjects@24
325
FsRtlCancellableWaitForSingleObject@12
326
FsRtlChangeBackingFileObject@16
327
FsRtlCheckLockForReadAccess@8
328
FsRtlCheckLockForWriteAccess@8
330
FsRtlCheckOplockEx@24
333
FsRtlCreateSectionForDataScan@40
334
FsRtlCurrentBatchOplock@4
336
FsRtlCurrentOplockH@4
337
FsRtlDeleteExtraCreateParameterLookasideList@8
338
FsRtlDeleteKeyFromTunnelCache@12
339
FsRtlDeleteTunnelCache@4
340
FsRtlDeregisterUncProvider@4
343
FsRtlDoesDbcsContainWildCards@4
344
FsRtlDoesNameContainWildCards@4
345
FsRtlFastCheckLockForRead@24
346
FsRtlFastCheckLockForWrite@24
347
FsRtlFastUnlockAll@16
348
FsRtlFastUnlockAllByKey@20
349
FsRtlFastUnlockSingle@32
350
FsRtlFindExtraCreateParameter@16
351
FsRtlFindInTunnelCache@32
352
FsRtlFreeExtraCreateParameter@4
353
FsRtlFreeExtraCreateParameterList@4
355
FsRtlGetEcpListFromIrp@8
357
FsRtlGetNextBaseMcbEntry@20
358
FsRtlGetNextExtraCreateParameter@20
359
FsRtlGetNextFileLock@8
360
FsRtlGetNextLargeMcbEntry@20
361
FsRtlGetNextMcbEntry@20
362
FsRtlGetVirtualDiskNestingLevel@12
363
FsRtlIncrementCcFastMdlReadWait@0
364
FsRtlIncrementCcFastReadNoWait@0
365
FsRtlIncrementCcFastReadNotPossible@0
366
FsRtlIncrementCcFastReadResourceMiss@0
367
FsRtlIncrementCcFastReadWait@0
368
FsRtlInitExtraCreateParameterLookasideList@16
369
FsRtlInitializeBaseMcb@8
370
FsRtlInitializeBaseMcbEx@12
371
FsRtlInitializeExtraCreateParameter@24
372
FsRtlInitializeExtraCreateParameterList@4
373
FsRtlInitializeFileLock@12
374
FsRtlInitializeLargeMcb@8
376
FsRtlInitializeOplock@4
377
FsRtlInitializeTunnelCache@4
378
FsRtlInsertExtraCreateParameter@8
379
FsRtlInsertPerFileContext@8
380
FsRtlInsertPerFileObjectContext@8
381
FsRtlInsertPerStreamContext@8
382
FsRtlIsDbcsInExpression@8
383
FsRtlIsEcpAcknowledged@4
384
FsRtlIsEcpFromUserMode@4
385
FsRtlIsFatDbcsLegal@20
386
FsRtlIsHpfsDbcsLegal@20
387
FsRtlIsNameInExpression@16
388
FsRtlIsNtstatusExpected@4
390
FsRtlIsTotalDeviceFailure@4
391
FsRtlLegalAnsiCharacterArray DATA
392
FsRtlLogCcFlushError@20
393
FsRtlLookupBaseMcbEntry@32
394
FsRtlLookupLargeMcbEntry@32
395
FsRtlLookupLastBaseMcbEntry@12
396
FsRtlLookupLastBaseMcbEntryAndIndex@16
397
FsRtlLookupLastLargeMcbEntry@12
398
FsRtlLookupLastLargeMcbEntryAndIndex@16
399
FsRtlLookupLastMcbEntry@12
400
FsRtlLookupMcbEntry@20
401
FsRtlLookupPerFileContext@12
402
FsRtlLookupPerFileObjectContext@12
403
FsRtlLookupPerStreamContextInternal@12
405
FsRtlMdlReadComplete@8
406
FsRtlMdlReadCompleteDev@12
408
FsRtlMdlWriteComplete@12
409
FsRtlMdlWriteCompleteDev@16
410
FsRtlMupGetProviderIdFromName@8
411
FsRtlMupGetProviderInfoFromFileObject@16
412
FsRtlNormalizeNtstatus@8
413
FsRtlNotifyChangeDirectory@28
414
FsRtlNotifyCleanup@12
415
FsRtlNotifyCleanupAll@8
416
FsRtlNotifyFilterChangeDirectory@44
417
FsRtlNotifyFilterReportChange@40
418
FsRtlNotifyFullChangeDirectory@40
419
FsRtlNotifyFullReportChange@36
420
FsRtlNotifyInitializeSync@4
421
FsRtlNotifyReportChange@20
422
FsRtlNotifyUninitializeSync@4
423
FsRtlNotifyVolumeEvent@8
424
FsRtlNotifyVolumeEventEx@12
425
FsRtlNumberOfRunsInBaseMcb@4
426
FsRtlNumberOfRunsInLargeMcb@4
427
FsRtlNumberOfRunsInMcb@4
429
FsRtlOplockBreakToNone@24
430
FsRtlOplockBreakToNoneEx@24
432
FsRtlOplockFsctrlEx@16
433
FsRtlOplockIsFastIoPossible@4
434
FsRtlOplockIsSharedRequest@4
435
FsRtlOplockKeysEqual@8
436
FsRtlPostPagingFileStackOverflow@12
437
FsRtlPostStackOverflow@12
438
FsRtlPrepareMdlWrite@24
439
FsRtlPrepareMdlWriteDev@28
441
FsRtlProcessFileLock@12
442
FsRtlQueryMaximumVirtualDiskNestingLevel@0
443
FsRtlRegisterFileSystemFilterCallbacks@8
444
FsRtlRegisterFltMgrCalls@4
445
FsRtlRegisterMupCalls@4
446
FsRtlRegisterUncProvider@12
447
FsRtlRegisterUncProviderEx@16
449
FsRtlRemoveBaseMcbEntry@20
450
FsRtlRemoveDotsFromPath@12
451
FsRtlRemoveExtraCreateParameter@16
452
FsRtlRemoveLargeMcbEntry@20
453
FsRtlRemoveMcbEntry@12
454
FsRtlRemovePerFileContext@12
455
FsRtlRemovePerFileObjectContext@12
456
FsRtlRemovePerStreamContext@12
459
FsRtlSetEcpListIntoIrp@8
461
FsRtlSplitLargeMcb@20
463
FsRtlTeardownPerFileContexts@4
464
FsRtlTeardownPerStreamContexts@4
465
FsRtlTruncateBaseMcb@12
466
FsRtlTruncateLargeMcb@12
468
FsRtlUninitializeBaseMcb@4
469
FsRtlUninitializeFileLock@4
470
FsRtlUninitializeLargeMcb@4
471
FsRtlUninitializeMcb@4
472
FsRtlUninitializeOplock@4
473
FsRtlValidateReparsePointBuffer@8
474
HalDispatchTable DATA
475
HalPrivateDispatchTable DATA
478
InbvAcquireDisplayOwnership@0
479
InbvCheckDisplayOwnership@0
481
InbvEnableBootDriver@4
482
InbvEnableDisplayString@4
483
InbvInstallDisplayStringFilter@4
484
InbvIsBootDriverInstalled@0
485
InbvNotifyDisplayOwnershipLost@4
487
InbvSetScrollRegion@16
489
InbvSolidColorFill@20
490
InitSafeBootMode DATA
491
IoAcquireCancelSpinLock@4
492
IoAcquireRemoveLockEx@20
493
IoAcquireVpbSpinLock@4
494
IoAdapterObjectType DATA
495
IoAdjustStackSizeForRedirection@12
496
IoAllocateAdapterChannel@20
497
IoAllocateController@16
498
IoAllocateDriverObjectExtension@16
499
IoAllocateErrorLogEntry@8
502
IoAllocateMiniCompletionPacket@8
503
IoAllocateSfioStreamIdentifier@16
505
IoApplyPriorityInfoThread@12
508
IoAttachDeviceByPointer@8
509
IoAttachDeviceToDeviceStack@8
510
IoAttachDeviceToDeviceStackSafe@12
511
IoBuildAsynchronousFsdRequest@24
512
IoBuildDeviceIoControlRequest@36
514
IoBuildSynchronousFsdRequest@28
518
IoCheckDesiredAccess@8
519
IoCheckEaBufferValidity@12
520
IoCheckFunctionAccess@24
521
IoCheckQuerySetFileInformation@12
522
IoCheckQuerySetVolumeInformation@12
523
IoCheckQuotaBufferValidity@12
524
IoCheckShareAccess@20
525
IoCheckShareAccessEx@24
527
IoClearIrpExtraCreateParameter@4
529
IoConnectInterrupt@44
530
IoConnectInterruptEx@4
538
IoCreateFileSpecifyDeviceObjectHint@60
539
IoCreateNotificationEvent@8
540
IoCreateStreamFileObject@8
541
IoCreateStreamFileObjectEx@12
542
IoCreateStreamFileObjectLite@8
543
IoCreateSymbolicLink@8
544
IoCreateSynchronizationEvent@8
545
IoCreateUnprotectedSymbolicLink@8
552
IoDeleteAllDependencyRelations@4
556
IoDeleteSymbolicLink@4
558
IoDeviceHandlerObjectSize DATA
559
IoDeviceHandlerObjectType DATA
560
IoDeviceObjectType DATA
561
IoDisconnectInterrupt@4
562
IoDisconnectInterruptEx@4
563
IoDriverObjectType DATA
564
IoDuplicateDependency@12
566
IoEnumerateDeviceObjectList@16
567
IoEnumerateRegisteredFiltersList@12
568
IoFastQueryNetworkAttributes@20
569
IoFileObjectType DATA
570
IoForwardAndCatchIrp@8
571
IoForwardIrpSynchronously@8
573
IoFreeErrorLogEntry@4
576
IoFreeMiniCompletionPacket@4
577
IoFreeSfioStreamIdentifier@8
579
IoGetAffinityInterrupt@8
580
IoGetAttachedDevice@4
581
IoGetAttachedDeviceReference@4
582
IoGetBaseFileSystemDeviceObject@4
583
IoGetBootDiskInformation@8
584
IoGetBootDiskInformationLite@4
585
IoGetConfigurationInformation@0
586
IoGetContainerInformation@16
587
IoGetCurrentProcess@0
588
IoGetDeviceAttachmentBaseRef@4
589
IoGetDeviceInterfaceAlias@12
590
IoGetDeviceInterfaces@16
591
IoGetDeviceNumaNode@8
592
IoGetDeviceObjectPointer@16
593
IoGetDeviceProperty@20
594
IoGetDevicePropertyData@32
595
IoGetDeviceToVerify@4
596
IoGetDiskDeviceObject@8
598
IoGetDriverObjectExtension@8
599
IoGetFileObjectGenericMapping@0
601
IoGetIoPriorityHint@4
602
IoGetIrpExtraCreateParameter@8
603
IoGetLowerDeviceObject@4
604
IoGetOplockKeyContext@4
605
IoGetRelatedDeviceObject@4
606
IoGetRequestorProcess@4
607
IoGetRequestorProcessId@4
608
IoGetRequestorSessionId@8
609
IoGetSfioStreamIdentifier@8
611
IoGetSymlinkSupportInformation@8
613
IoGetTransactionParameterBlock@4
615
IoInitializeRemoveLockEx@20
617
IoInitializeWorkItem@8
618
IoInvalidateDeviceRelations@8
619
IoInvalidateDeviceState@4
620
IoIsFileObjectIgnoringSharing@4
621
IoIsFileOriginRemote@4
622
IoIsOperationSynchronous@4
624
IoIsValidNameGraftingBuffer@8
625
IoIsWdmVersionAvailable@8
626
IoMakeAssociatedIrp@8
627
IoOpenDeviceInterfaceRegistryKey@12
628
IoOpenDeviceRegistryKey@16
630
IoQueryDeviceDescription@32
631
IoQueryFileDosDeviceName@8
632
IoQueryFileInformation@20
633
IoQueryVolumeInformation@20
638
IoRaiseInformationalHardError@12
639
IoReadDiskSignature@12
640
IoReadOperationCount DATA
641
IoReadPartitionTableEx@8
642
IoReadTransferCount DATA
643
IoRegisterBootDriverReinitialization@12
644
IoRegisterContainerNotification@20
645
IoRegisterDeviceInterface@16
646
IoRegisterDriverReinitialization@12
647
IoRegisterFileSystem@4
648
IoRegisterFsRegistrationChange@8
649
IoRegisterFsRegistrationChangeMountAware@12
650
IoRegisterLastChanceShutdownNotification@4
651
IoRegisterPlugPlayNotification@28
652
IoRegisterPriorityCallback@8
653
IoRegisterShutdownNotification@4
654
IoReleaseCancelSpinLock@4
655
IoReleaseRemoveLockAndWaitEx@12
656
IoReleaseRemoveLockEx@12
657
IoReleaseVpbSpinLock@4
658
IoRemoveShareAccess@8
659
IoReplaceFileObjectName@12
660
IoReplacePartitionUnit@12
661
IoReportDetectedDevice@32
662
IoReportHalResourceUsage@16
663
IoReportResourceForDetection@28
664
IoReportResourceUsage@36
666
IoReportTargetDeviceChange@8
667
IoReportTargetDeviceChangeAsynchronous@16
668
IoRequestDeviceEject@4
669
IoRequestDeviceEjectEx@16
670
IoRetrievePriorityInfo@16
672
IoSetCompletionRoutineEx@28
674
IoSetDeviceInterfaceState@8
675
IoSetDevicePropertyData@28
676
IoSetDeviceToVerify@8
677
IoSetFileObjectIgnoreSharing@4
679
IoSetHardErrorOrVerifyDevice@8
682
IoSetIoCompletionEx@28
683
IoSetIoPriorityHint@8
684
IoSetIoPriorityHintIntoFileObject@8
685
IoSetIoPriorityHintIntoThread@8
686
IoSetIrpExtraCreateParameter@8
687
IoSetOplockKeyContext@12
688
IoSetPartitionInformationEx@12
690
IoSetShareAccessEx@20
691
IoSetStartIoAttributes@12
692
IoSetSystemPartition@4
693
IoSetThreadHardErrorMode@4
697
IoStartNextPacketByKey@12
700
IoStatisticsLock DATA
702
IoSynchronousInvalidateDeviceRelations@8
703
IoSynchronousPageWrite@20
705
IoTranslateBusAddress@24
706
IoUninitializeWorkItem@4
707
IoUnregisterContainerNotification@4
708
IoUnregisterFileSystem@4
709
IoUnregisterFsRegistrationChange@8
710
IoUnregisterPlugPlayNotification@4
711
IoUnregisterPlugPlayNotificationEx@4
712
IoUnregisterPriorityCallback@4
713
IoUnregisterShutdownNotification@4
714
IoUpdateShareAccess@8
715
IoValidateDeviceIoControlAccess@8
716
IoVerifyPartitionTable@8
718
IoVolumeDeviceToDosName@8
719
IoWMIAllocateInstanceIds@12
720
IoWMIDeviceObjectToInstanceName@12
721
IoWMIExecuteMethod@24
722
IoWMIHandleToInstanceName@12
725
IoWMIQueryAllDataMultiple@16
726
IoWMIQuerySingleInstance@16
727
IoWMIQuerySingleInstanceMultiple@20
728
IoWMIRegistrationControl@8
729
IoWMISetNotificationCallback@12
730
IoWMISetSingleInstance@20
731
IoWMISetSingleItem@24
732
IoWMISuggestInstanceName@16
734
IoWithinStackLimits@8
735
IoWriteErrorLogEntry@4
736
IoWriteOperationCount DATA
737
IoWritePartitionTableEx@8
738
IoWriteTransferCount DATA
740
KdDebuggerEnabled DATA
741
KdDebuggerNotPresent DATA
744
KdEnteredDebugger DATA
747
KdRefreshDebuggerNotPresent@0
748
KdSystemDebugControl@28
750
Ke386IoSetAccessProcess@8
751
Ke386QueryIoAccessMap@8
752
Ke386SetIoAccessMap@8
753
KeAcquireInterruptSpinLock@4
754
KeAcquireSpinLockAtDpcLevel@4
755
KeAddGroupAffinityEx@12
756
KeAddProcessorAffinityEx@8
757
KeAddProcessorGroupAffinity@8
758
KeAddSystemServiceTable@20
760
KeAllocateCalloutStack@4
761
KeAllocateCalloutStackEx@16
763
KeAndGroupAffinityEx@12
764
KeAreAllApcsDisabled@0
770
KeCapturePersistentThreadState@32
771
KeCheckProcessorAffinityEx@8
772
KeCheckProcessorGroupAffinity@8
774
KeComplementAffinityEx@8
776
KeCountSetBitsAffinityEx@4
777
KeCountSetBitsGroupAffinity@4
778
KeDelayExecutionThread@12
779
KeDeregisterBugCheckCallback@4
780
KeDeregisterBugCheckReasonCallback@4
781
KeDeregisterNmiCallback@4
782
KeDeregisterProcessorChangeCallback@4
784
KeEnterCriticalRegion@0
785
KeEnterGuardedRegion@0
786
KeEnterKernelDebugger@0
787
KeEnumerateNextProcessor@8
788
KeExpandKernelStackAndCallout@12
789
KeExpandKernelStackAndCalloutEx@20
790
KeFindConfigurationEntry@16
791
KeFindConfigurationNextEntry@20
792
KeFindFirstSetLeftAffinityEx@4
793
KeFindFirstSetLeftGroupAffinity@4
794
KeFindFirstSetRightGroupAffinity@4
795
KeFirstGroupAffinityEx@8
800
KeGetCurrentNodeNumber@0
801
KeGetCurrentProcessorNumberEx@4
804
KeGetProcessorIndexFromNumber@4
805
KeGetProcessorNumberFromIndex@8
806
KeGetRecommendedSharedDataAlignment@0
807
KeGetXSaveFeatureFlags@0
809
KeI386AllocateGdtSelectors@8
810
KeI386Call16BitCStyleFunction@0
811
KeI386Call16BitFunction@0
812
KeI386FlatToGdtSelector@12
814
KeI386MachineType DATA
815
KeI386ReleaseGdtSelectors@8
817
KeI386SetGdtSelector@8
818
KeInitializeAffinityEx@4
820
KeInitializeCrashDumpHeader@20
821
KeInitializeDeviceQueue@4
823
KeInitializeEnumerationContext@8
824
KeInitializeEnumerationContextFromGroup@8
826
KeInitializeInterrupt@52
830
KeInitializeSemaphore@12
831
KeInitializeSpinLock@4
832
KeInitializeThreadedDpc@12
834
KeInitializeTimerEx@8
835
KeInsertByKeyDeviceQueue@12
836
KeInsertDeviceQueue@8
841
KeInterlockedClearProcessorAffinityEx@8
842
KeInterlockedSetProcessorAffinityEx@8
843
KeInvalidateAllCaches@0
845
KeIsAttachedProcess@0
846
KeIsEmptyAffinityEx@4
847
KeIsEqualAffinityEx@8
849
KeIsSingleGroupAffinityEx@8
850
KeIsSubsetAffinityEx@8
852
KeLeaveCriticalRegion@0
853
KeLeaveGuardedRegion@0
855
KeNumberProcessors DATA
857
KePollFreezeExecution@0
858
KeProcessorGroupAffinity@8
860
KeProfileInterruptWithSource@8
862
KeQueryActiveGroupCount@0
863
KeQueryActiveProcessorAffinity@4
864
KeQueryActiveProcessorCount@4
865
KeQueryActiveProcessorCountEx@4
866
KeQueryActiveProcessors@0
867
KeQueryDpcWatchdogInformation@4
868
KeQueryGroupAffinity@4
869
KeQueryGroupAffinityEx@8
870
KeQueryHardwareCounterConfiguration@12
871
KeQueryHighestNodeNumber@0
872
KeQueryInterruptTime@0
873
KeQueryLogicalProcessorRelationship@16
874
KeQueryMaximumGroupCount@0
875
KeQueryMaximumProcessorCount@0
876
KeQueryMaximumProcessorCountEx@4
877
KeQueryNodeActiveAffinity@12
878
KeQueryNodeMaximumProcessorCount@4
879
KeQueryPriorityThread@4
880
KeQueryRuntimeThread@8
883
KeQueryTimeIncrement@0
884
KeQueryUnbiasedInterruptTime@0
885
KeRaiseUserException@4
890
KeReadStateSemaphore@4
892
KeRegisterBugCheckCallback@20
893
KeRegisterBugCheckReasonCallback@16
894
KeRegisterNmiCallback@8
895
KeRegisterProcessorChangeCallback@12
896
KeReleaseInterruptSpinLock@8
899
KeReleaseSemaphore@16
900
KeReleaseSpinLockFromDpcLevel@4
901
KeRemoveByKeyDeviceQueue@8
902
KeRemoveByKeyDeviceQueueIfBusy@8
903
KeRemoveDeviceQueue@4
904
KeRemoveEntryDeviceQueue@8
905
KeRemoveGroupAffinityEx@12
906
KeRemoveProcessorAffinityEx@8
907
KeRemoveProcessorGroupAffinity@8
911
KeRemoveSystemServiceTable@4
913
KeRestoreExtendedProcessorState@4
914
KeRestoreFloatingPointState@4
915
KeRevertToUserAffinityThread@0
916
KeRevertToUserAffinityThreadEx@4
917
KeRevertToUserGroupAffinityThread@4
919
KeSaveExtendedProcessorState@12
920
KeSaveFloatingPointState@4
921
KeSaveStateForHibernate@0
922
KeServiceDescriptorTable DATA
923
KeSetActualBasePriorityThread@8
924
KeSetAffinityThread@8
925
KeSetBasePriorityThread@8
926
KeSetCoalescableTimer@24
927
KeSetDmaIoCoherency@4
929
KeSetEventBoostPriority@8
930
KeSetHardwareCounterConfiguration@8
931
KeSetIdealProcessorThread@8
933
KeSetKernelStackSwapEnable@4
934
KeSetPriorityThread@8
936
KeSetSystemAffinityThread@4
937
KeSetSystemAffinityThreadEx@4
938
KeSetSystemGroupAffinityThread@8
939
KeSetTargetProcessorDpc@8
940
KeSetTargetProcessorDpcEx@8
944
KeSignalCallDpcDone@4
945
KeSignalCallDpcSynchronize@4
946
KeStackAttachProcess@8
947
KeStartDynamicProcessor@16
948
KeSubtractAffinityEx@12
949
KeSynchronizeExecution@12
952
KeUnstackDetachProcess@4
954
KeUserModeCallback@20
955
KeWaitForMultipleObjects@32
956
KeWaitForMutexObject@20
957
KeWaitForSingleObject@20
959
KiCheckForKernelApcDelivery@0
962
KiDispatchInterrupt@0
963
KiIpiServiceRoutine@8
964
;KiUnexpectedInterrupt ; Check!!! Couldn't determine function argument count. Function doesn't return.
967
LdrFindResourceDirectory_U@16
968
LdrFindResourceEx_U@20
970
LdrResFindResource@36
971
LdrResFindResourceDirectory@28
972
LdrResSearchResource@32
973
LpcPortObjectType DATA
974
LpcReplyWaitReplyPort@12
976
LpcRequestWaitReplyPort@12
977
LpcRequestWaitReplyPortEx@12
978
LpcSendWaitReceivePort@28
979
LsaCallAuthenticationPackage@28
980
LsaDeregisterLogonProcess@4
981
LsaFreeReturnBuffer@4
983
LsaLookupAuthenticationPackage@12
984
LsaRegisterLogonProcess@12
985
Mm64BitPhysicalAddress DATA
986
MmAddPhysicalMemory@8
987
MmAddVerifierThunks@8
988
MmAdjustWorkingSetSize@16
990
MmAllocateContiguousMemory@12
991
MmAllocateContiguousMemorySpecifyCache@32
992
MmAllocateContiguousMemorySpecifyCacheNode@36
993
MmAllocateMappingAddress@8
994
MmAllocateNonCachedMemory@4
995
MmAllocatePagesForMdl@28
996
MmAllocatePagesForMdlEx@36
998
MmBuildMdlForNonPagedPool@4
999
MmCanFileBeTruncated@8
1000
MmCommitSessionMappedView@8
1001
MmCopyVirtualMemory@28
1005
MmDisableModifiedWriteOfSection@4
1006
MmDoesFileHaveUserWritableReferences@4
1007
MmFlushImageSection@8
1008
MmForceSectionClosed@8
1009
MmFreeContiguousMemory@4
1010
MmFreeContiguousMemorySpecifyCache@12
1011
MmFreeMappingAddress@8
1012
MmFreeNonCachedMemory@8
1013
MmFreePagesFromMdl@4
1014
MmGetPhysicalAddress@4
1015
MmGetPhysicalMemoryRanges@0
1016
MmGetSystemRoutineAddress@4
1017
MmGetVirtualForPhysical@8
1019
MmHighestUserAddress DATA
1021
MmIsDriverVerifying@4
1022
MmIsDriverVerifyingByAddress@4
1023
MmIsIoSpaceActive@12
1024
MmIsNonPagedSystemAddressValid@4
1025
MmIsRecursiveIoFault@0
1026
MmIsThisAnNtAsSystem@0
1027
MmIsVerifierEnabled@4
1028
MmLockPagableDataSection@4
1029
MmLockPagableImageSection@4
1030
MmLockPagableSectionByHandle@4
1033
MmMapLockedPagesSpecifyCache@24
1034
MmMapLockedPagesWithReservedMapping@16
1035
MmMapMemoryDumpMdl@4
1036
MmMapUserAddressesToPage@12
1037
MmMapVideoDisplay@16
1038
MmMapViewInSessionSpace@12
1039
MmMapViewInSystemSpace@12
1040
MmMapViewOfSection@40
1041
MmMarkPhysicalMemoryAsBad@8
1042
MmMarkPhysicalMemoryAsGood@8
1043
MmPageEntireDriver@4
1045
MmProbeAndLockPages@12
1046
MmProbeAndLockProcessPages@16
1047
MmProbeAndLockSelectedPages@16
1048
MmProtectMdlSystemAddress@8
1050
MmRemovePhysicalMemory@8
1051
MmResetDriverPaging@4
1052
MmRotatePhysicalView@24
1053
MmSectionObjectType DATA
1054
MmSecureVirtualMemory@12
1055
MmSetAddressRangeModified@8
1056
MmSetBankedSection@24
1058
MmSystemRangeStart DATA
1059
MmTrimAllSystemPagableMemory@4
1060
MmUnlockPagableImageSection@4
1063
MmUnmapLockedPages@8
1064
MmUnmapReservedMapping@12
1065
MmUnmapVideoDisplay@8
1066
MmUnmapViewInSessionSpace@4
1067
MmUnmapViewInSystemSpace@4
1068
MmUnmapViewOfSection@8
1069
MmUnsecureVirtualMemory@4
1070
MmUserProbeAddress DATA
1071
NlsAnsiCodePage DATA
1072
NlsLeadByteInfo DATA
1073
NlsMbCodePageTag DATA
1074
NlsMbOemCodePageTag DATA
1076
NlsOemLeadByteInfo DATA
1078
NtAdjustPrivilegesToken@24
1079
NtAllocateLocallyUniqueId@4
1081
NtAllocateVirtualMemory@24
1087
NtCommitEnlistment@8
1088
NtCommitTransaction@8
1090
NtCreateEnlistment@32
1093
NtCreateResourceManager@28
1095
NtCreateTransaction@40
1096
NtCreateTransactionManager@24
1099
NtDeviceIoControlFile@40
1100
NtDuplicateObject@28
1102
NtEnumerateTransactionObject@20
1104
NtFreeVirtualMemory@16
1105
NtFreezeTransactions@8
1107
NtGetEnvironmentVariableEx@20
1108
NtGetNotificationResourceManager@28
1111
NtMakePermanentObject@4
1112
NtMapViewOfSection@40
1113
NtNotifyChangeDirectoryFile@36
1117
NtOpenProcessToken@12
1118
NtOpenProcessTokenEx@16
1119
NtOpenResourceManager@20
1121
NtOpenThreadToken@16
1122
NtOpenThreadTokenEx@20
1123
NtOpenTransaction@20
1124
NtOpenTransactionManager@24
1125
NtPrePrepareComplete@8
1126
NtPrePrepareEnlistment@8
1128
NtPrepareEnlistment@8
1129
NtPropagationComplete@16
1130
NtPropagationFailed@12
1131
NtQueryDirectoryFile@44
1133
NtQueryEnvironmentVariableInfoEx@16
1134
NtQueryInformationAtom@20
1135
NtQueryInformationEnlistment@20
1136
NtQueryInformationFile@20
1137
NtQueryInformationProcess@20
1138
NtQueryInformationResourceManager@20
1139
NtQueryInformationThread@20
1140
NtQueryInformationToken@20
1141
NtQueryInformationTransaction@20
1142
NtQueryInformationTransactionManager@20
1143
NtQueryQuotaInformationFile@36
1144
NtQuerySecurityAttributesToken@24
1145
NtQuerySecurityObject@20
1146
NtQuerySystemInformation@16
1147
NtQuerySystemInformationEx@24
1148
NtQueryVolumeInformationFile@20
1150
NtReadOnlyEnlistment@8
1151
NtRecoverEnlistment@8
1152
NtRecoverResourceManager@4
1153
NtRecoverTransactionManager@4
1155
NtRequestWaitReplyPort@12
1156
NtRollbackComplete@8
1157
NtRollbackEnlistment@8
1158
NtRollbackTransaction@8
1161
NtSetInformationEnlistment@16
1162
NtSetInformationFile@20
1163
NtSetInformationProcess@16
1164
NtSetInformationResourceManager@16
1165
NtSetInformationThread@16
1166
NtSetInformationToken@16
1167
NtSetInformationTransaction@16
1168
NtSetQuotaInformationFile@16
1169
NtSetSecurityObject@12
1170
NtSetVolumeInformationFile@20
1172
NtThawTransactions@0
1177
NtWaitForSingleObject@12
1180
ObCheckCreateObjectAccess@28
1181
ObCheckObjectAccess@20
1184
ObCreateObjectType@16
1185
ObDeleteCapturedInsertInfo@4
1186
ObDereferenceObject@4
1187
ObDereferenceObjectDeferDelete@4
1188
ObDereferenceObjectDeferDeleteWithTag@8
1189
ObDereferenceSecurityDescriptor@8
1190
ObFindHandleForObject@20
1191
ObGetFilterVersion@0
1192
ObGetObjectSecurity@12
1195
ObIsDosDeviceLocallyMapped@8
1197
ObLogSecurityDescriptor@12
1198
ObMakeTemporaryObject@4
1199
ObOpenObjectByName@28
1200
ObOpenObjectByPointer@28
1201
ObOpenObjectByPointerWithTag@32
1203
ObQueryNameString@16
1204
ObQueryObjectAuditingByHandle@8
1205
ObReferenceObjectByHandle@24
1206
ObReferenceObjectByHandleWithTag@28
1207
ObReferenceObjectByName@32
1208
ObReferenceObjectByPointer@16
1209
ObReferenceObjectByPointerWithTag@20
1210
ObReferenceSecurityDescriptor@8
1211
ObRegisterCallbacks@8
1212
ObReleaseObjectSecurity@8
1213
ObSetHandleAttributes@12
1214
ObSetSecurityDescriptorInfo@24
1215
ObSetSecurityObjectByPointer@12
1216
ObUnRegisterCallbacks@4
1220
PcwCreateInstance@20
1229
PoCancelDeviceNotify@4
1230
PoClearPowerRequest@8
1231
PoCreatePowerRequest@12
1232
PoDeletePowerRequest@4
1233
PoDisableSleepStates@12
1236
PoQueryWatchdogTime@8
1237
PoQueueShutdownWorkItem@4
1238
PoReenableSleepStates@4
1239
PoRegisterDeviceForIdleDetection@16
1240
PoRegisterDeviceNotify@24
1241
PoRegisterPowerSettingCallback@20
1242
PoRegisterSystemState@8
1243
PoRequestPowerIrp@24
1244
PoRequestShutdownEvent@4
1246
PoSetFixedWakeSource@4
1252
PoShutdownBugCheck@4
1254
PoStartNextPowerIrp@4
1255
PoUnregisterPowerSettingCallback@4
1256
PoUnregisterSystemState@4
1257
PoUserShutdownInitiated@0
1260
PsCreateSystemProcess@12
1261
PsAcquireProcessExitSynchronization@4
1262
PsAssignImpersonationToken@8
1263
PsChargePoolQuota@12
1264
PsChargeProcessCpuCycles@12
1265
PsChargeProcessNonPagedPoolQuota@8
1266
PsChargeProcessPagedPoolQuota@8
1267
PsChargeProcessPoolQuota@12
1268
PsCreateSystemThread@28
1269
PsDereferenceImpersonationToken@4
1270
PsDereferencePrimaryToken@4
1271
PsDisableImpersonation@8
1272
PsEnterPriorityRegion@0
1273
PsEstablishWin32Callouts@4
1274
PsGetContextThread@12
1275
PsGetCurrentProcess@0
1276
PsGetCurrentProcessId@0
1277
PsGetCurrentProcessSessionId@0
1278
PsGetCurrentProcessWin32Process@0
1279
PsGetCurrentThread@0
1280
PsGetCurrentThreadId@0
1281
PsGetCurrentThreadPreviousMode@0
1282
PsGetCurrentThreadProcess@0
1283
PsGetCurrentThreadProcessId@0
1284
PsGetCurrentThreadStackBase@0
1285
PsGetCurrentThreadStackLimit@0
1286
PsGetCurrentThreadTeb@0
1287
PsGetCurrentThreadWin32Thread@0
1288
PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion@4
1291
PsGetJobUIRestrictionsClass@4
1292
PsGetProcessCreateTimeQuadPart@4
1293
PsGetProcessDebugPort@4
1294
PsGetProcessExitProcessCalled@4
1295
PsGetProcessExitStatus@4
1296
PsGetProcessExitTime@0
1298
PsGetProcessImageFileName@4
1299
PsGetProcessInheritedFromUniqueProcessId@4
1302
PsGetProcessPriorityClass@4
1303
PsGetProcessSectionBaseAddress@4
1304
PsGetProcessSecurityPort@4
1305
PsGetProcessSessionId@4
1306
PsGetProcessSessionIdEx@4
1307
PsGetProcessWin32Process@4
1308
PsGetProcessWin32WindowStation@4
1309
PsGetThreadFreezeCount@4
1310
PsGetThreadHardErrorsAreDisabled@4
1312
PsGetThreadProcess@4
1313
PsGetThreadProcessId@4
1314
PsGetThreadSessionId@4
1316
PsGetThreadWin32Thread@4
1318
PsImpersonateClient@20
1319
PsInitialSystemProcess DATA
1320
PsIsCurrentThreadPrefetching@0
1321
PsIsProcessBeingDebugged@4
1322
PsIsProtectedProcess@4
1325
PsIsThreadImpersonating@4
1326
PsIsThreadTerminating@4
1328
PsLeavePriorityRegion@0
1329
PsLookupProcessByProcessId@8
1330
PsLookupProcessThreadByCid@12
1331
PsLookupThreadByThreadId@8
1333
PsQueryProcessExceptionFlags@12
1334
PsReferenceImpersonationToken@16
1335
PsReferencePrimaryToken@4
1336
PsReferenceProcessFilePointer@8
1337
PsReleaseProcessExitSynchronization@4
1338
PsRemoveCreateThreadNotifyRoutine@4
1339
PsRemoveLoadImageNotifyRoutine@4
1340
PsRestoreImpersonation@8
1342
PsReturnPoolQuota@12
1343
PsReturnProcessNonPagedPoolQuota@8
1344
PsReturnProcessPagedPoolQuota@8
1345
PsRevertThreadToSelf@4
1347
PsSetContextThread@12
1348
PsSetCreateProcessNotifyRoutine@8
1349
PsSetCreateProcessNotifyRoutineEx@8
1350
PsSetCreateThreadNotifyRoutine@4
1351
PsSetCurrentThreadPrefetching@4
1352
PsSetJobUIRestrictionsClass@8
1353
PsSetLegoNotifyRoutine@4
1354
PsSetLoadImageNotifyRoutine@4
1355
PsSetProcessPriorityByClass@8
1356
PsSetProcessPriorityClass@8
1357
PsSetProcessSecurityPort@8
1358
PsSetProcessWin32Process@12
1359
PsSetProcessWindowStation@8
1360
PsSetThreadHardErrorsAreDisabled@8
1361
PsSetThreadWin32Thread@12
1363
PsTerminateSystemThread@4
1365
PsUILanguageComitted DATA
1366
PsWrapApcWow64Thread@8
1367
READ_REGISTER_BUFFER_UCHAR@12
1368
READ_REGISTER_BUFFER_ULONG@12
1369
READ_REGISTER_BUFFER_USHORT@12
1370
READ_REGISTER_UCHAR@4
1371
READ_REGISTER_ULONG@4
1372
READ_REGISTER_USHORT@4
1373
RtlAbsoluteToSelfRelativeSD@12
1374
RtlAddAccessAllowedAce@16
1375
RtlAddAccessAllowedAceEx@20
1377
RtlAddAtomToAtomTable@12
1380
RtlAnsiCharToUnicodeChar@4
1381
RtlAnsiStringToUnicodeSize@4
1382
RtlAnsiStringToUnicodeString@12
1383
RtlAppendAsciizToString@8
1384
RtlAppendStringToString@8
1385
RtlAppendUnicodeStringToString@8
1386
RtlAppendUnicodeToString@8
1387
RtlAreAllAccessesGranted@8
1388
RtlAreAnyAccessesGranted@8
1393
RtlCaptureStackBackTrace@16
1395
RtlCheckRegistryKey@8
1399
RtlCmDecodeMemIoResource@8
1400
RtlCmEncodeMemIoResource@24
1401
RtlCompareAltitudes@8
1403
RtlCompareMemoryUlong@12
1405
RtlCompareUnicodeString@12
1406
RtlCompareUnicodeStrings@20
1407
RtlCompressBuffer@32
1408
RtlCompressChunks@28
1410
RtlContractHashTable@4
1411
RtlConvertLongToLargeInteger@4
1412
RtlConvertSidToUnicodeString@12
1413
RtlConvertUlongToLargeInteger@4
1415
RtlCopyLuidAndAttributesArray@12
1418
RtlCopySidAndAttributesArray@28
1420
RtlCopyUnicodeString@8
1422
RtlCreateAtomTable@8
1423
RtlCreateHashTable@12
1425
RtlCreateRegistryKey@8
1426
RtlCreateSecurityDescriptor@8
1427
RtlCreateSystemVolumeInformationFolder@4
1428
RtlCreateUnicodeString@8
1429
RtlCustomCPToUnicodeN@24
1430
RtlDecompressBuffer@24
1431
RtlDecompressChunks@28
1432
RtlDecompressFragment@32
1435
RtlDeleteAtomFromAtomTable@8
1436
RtlDeleteElementGenericTable@8
1437
RtlDeleteElementGenericTableAvl@8
1438
RtlDeleteHashTable@4
1440
RtlDeleteOwnersRanges@8
1442
RtlDeleteRegistryValue@12
1444
RtlDestroyAtomTable@4
1446
RtlDowncaseUnicodeChar@4
1447
RtlDowncaseUnicodeString@12
1448
RtlDuplicateUnicodeString@12
1450
RtlEndEnumerationHashTable@8
1451
RtlEndWeakEnumerationHashTable@8
1452
RtlEnlargedIntegerMultiply@8
1453
RtlEnlargedUnsignedDivide@16
1454
RtlEnlargedUnsignedMultiply@8
1455
RtlEnumerateEntryHashTable@8
1456
RtlEnumerateGenericTable@8
1457
RtlEnumerateGenericTableAvl@8
1458
RtlEnumerateGenericTableLikeADirectory@28
1459
RtlEnumerateGenericTableWithoutSplaying@8
1460
RtlEnumerateGenericTableWithoutSplayingAvl@8
1464
RtlEqualUnicodeString@12
1465
RtlEthernetAddressToStringA@8
1466
RtlEthernetAddressToStringW@8
1467
RtlEthernetStringToAddressA@12
1468
RtlEthernetStringToAddressW@12
1469
RtlExpandHashTable@4
1470
RtlExtendedIntegerMultiply@12
1471
RtlExtendedLargeIntegerDivide@16
1472
RtlExtendedMagicDivide@20
1474
RtlFillMemoryUlong@12
1475
RtlFillMemoryUlonglong@16
1478
RtlFindClearBitsAndSet@12
1480
RtlFindClosestEncodableLength@12
1481
RtlFindFirstRunClear@8
1482
RtlFindLastBackwardRunClear@12
1483
RtlFindLeastSignificantBit@8
1484
RtlFindLongestRunClear@8
1486
RtlFindMostSignificantBit@8
1487
RtlFindNextForwardRunClear@12
1490
RtlFindSetBitsAndClear@12
1491
RtlFindUnicodePrefix@12
1492
RtlFormatCurrentUserKeyPath@4
1498
RtlFreeUnicodeString@4
1500
RtlGenerate8dot3Name@16
1502
RtlGetCallersAddress@8
1503
RtlGetCompressionWorkSpaceSize@12
1504
RtlGetDaclSecurityDescriptor@16
1505
RtlGetDefaultCodePage@8
1506
RtlGetElementGenericTable@8
1507
RtlGetElementGenericTableAvl@8
1508
RtlGetEnabledExtendedFeatures@8
1510
RtlGetGroupSecurityDescriptor@12
1513
RtlGetNextEntryHashTable@8
1515
RtlGetNtGlobalFlags@0
1516
RtlGetOwnerSecurityDescriptor@12
1517
RtlGetProductInfo@20
1518
RtlGetSaclSecurityDescriptor@16
1519
RtlGetSetBootStatusData@24
1520
RtlGetThreadLangIdByIndex@16
1522
RtlHashUnicodeString@16
1524
RtlIdnToNameprepUnicode@20
1526
RtlImageDirectoryEntryToData@16
1529
RtlInitAnsiStringEx@8
1530
RtlInitCodePageTable@8
1531
RtlInitEnumerationHashTable@8
1533
RtlInitUnicodeString@8
1534
RtlInitUnicodeStringEx@8
1535
RtlInitWeakEnumerationHashTable@8
1536
RtlInitializeBitMap@12
1537
RtlInitializeGenericTable@20
1538
RtlInitializeGenericTableAvl@20
1539
RtlInitializeRangeList@4
1541
RtlInitializeUnicodePrefix@4
1542
RtlInsertElementGenericTable@16
1543
RtlInsertElementGenericTableAvl@16
1544
RtlInsertElementGenericTableFull@24
1545
RtlInsertElementGenericTableFullAvl@24
1546
RtlInsertEntryHashTable@16
1547
RtlInsertUnicodePrefix@12
1548
RtlInt64ToUnicodeString@16
1550
RtlIntegerToUnicode@16
1551
RtlIntegerToUnicodeString@12
1552
RtlInvertRangeList@8
1553
RtlInvertRangeListEx@20
1554
RtlIoDecodeMemIoResource@16
1555
RtlIoEncodeMemIoResource@40
1556
RtlIpv4AddressToStringA@8
1557
RtlIpv4AddressToStringExA@16
1558
RtlIpv4AddressToStringExW@16
1559
RtlIpv4AddressToStringW@8
1560
RtlIpv4StringToAddressA@16
1561
RtlIpv4StringToAddressExA@16
1562
RtlIpv4StringToAddressExW@16
1563
RtlIpv4StringToAddressW@16
1564
RtlIpv6AddressToStringA@8
1565
RtlIpv6AddressToStringExA@20
1566
RtlIpv6AddressToStringExW@20
1567
RtlIpv6AddressToStringW@8
1568
RtlIpv6StringToAddressA@12
1569
RtlIpv6StringToAddressExA@16
1570
RtlIpv6StringToAddressExW@16
1571
RtlIpv6StringToAddressW@12
1572
RtlIsGenericTableEmpty@4
1573
RtlIsGenericTableEmptyAvl@4
1574
RtlIsNameLegalDOS8Dot3@12
1575
RtlIsNormalizedString@16
1576
RtlIsNtDdiVersionAvailable@4
1577
RtlIsRangeAvailable@40
1578
RtlIsServicePackVersionInstalled@4
1579
RtlIsValidOemCharacter@4
1580
RtlLargeIntegerAdd@16
1581
RtlLargeIntegerArithmeticShift@12
1582
RtlLargeIntegerDivide@20
1583
RtlLargeIntegerNegate@8
1584
RtlLargeIntegerShiftLeft@12
1585
RtlLargeIntegerShiftRight@12
1586
RtlLargeIntegerSubtract@16
1587
RtlLengthRequiredSid@4
1588
RtlLengthSecurityDescriptor@4
1591
RtlLocalTimeToSystemTime@8
1592
RtlLockBootStatusData@4
1593
RtlLookupAtomInAtomTable@12
1594
RtlLookupElementGenericTable@8
1595
RtlLookupElementGenericTableAvl@8
1596
RtlLookupElementGenericTableFull@16
1597
RtlLookupElementGenericTableFullAvl@16
1598
RtlLookupEntryHashTable@12
1599
RtlLookupFirstMatchingElementGenericTableAvl@12
1601
RtlMapSecurityErrorToNtStatus@4
1602
RtlMergeRangeLists@16
1604
RtlMultiByteToUnicodeN@20
1605
RtlMultiByteToUnicodeSize@12
1606
RtlNextUnicodePrefix@8
1607
RtlNormalizeString@20
1608
RtlNtStatusToDosError@4
1609
RtlNtStatusToDosErrorNoTeb@4
1610
RtlNumberGenericTableElements@4
1611
RtlNumberGenericTableElementsAvl@4
1612
RtlNumberOfClearBits@4
1613
RtlNumberOfSetBits@4
1614
RtlNumberOfSetBitsUlongPtr@4
1615
RtlOemStringToCountedUnicodeString@12
1616
RtlOemStringToUnicodeSize@4
1617
RtlOemStringToUnicodeString@12
1619
RtlOwnerAcesPresent@4
1620
RtlPinAtomInAtomTable@8
1622
RtlPrefixUnicodeString@12
1623
RtlQueryAtomInAtomTable@24
1624
RtlQueryDynamicTimeZoneInformation@4
1625
RtlQueryElevationFlags@4
1626
RtlQueryModuleInformation@12
1627
RtlQueryRegistryValues@20
1628
RtlQueryTimeZoneInformation@4
1629
RtlRaiseException@24
1632
RtlRealPredecessor@4
1634
RtlRemoveEntryHashTable@12
1635
RtlRemoveUnicodePrefix@8
1636
RtlReplaceSidInSd@16
1638
RtlRunOnceBeginInitialize@12
1639
RtlRunOnceComplete@12
1640
RtlRunOnceExecuteOnce@16
1641
RtlRunOnceInitialize@4
1642
RtlSecondsSince1970ToTime@8
1643
RtlSecondsSince1980ToTime@8
1644
RtlSelfRelativeToAbsoluteSD2@8
1645
RtlSelfRelativeToAbsoluteSD@44
1649
RtlSetDaclSecurityDescriptor@16
1650
RtlSetDynamicTimeZoneInformation@4
1651
RtlSetGroupSecurityDescriptor@12
1652
RtlSetOwnerSecurityDescriptor@12
1653
RtlSetSaclSecurityDescriptor@16
1654
RtlSetTimeZoneInformation@4
1655
RtlSidHashInitialize@12
1660
RtlSubAuthorityCountSid@4
1661
RtlSubAuthoritySid@8
1662
RtlSubtreePredecessor@4
1663
RtlSubtreeSuccessor@4
1664
RtlSystemTimeToLocalTime@8
1666
RtlTimeFieldsToTime@8
1667
RtlTimeToElapsedTimeFields@8
1668
RtlTimeToSecondsSince1970@8
1669
RtlTimeToSecondsSince1980@8
1670
RtlTimeToTimeFields@8
1671
RtlTraceDatabaseAdd@16
1672
RtlTraceDatabaseCreate@20
1673
RtlTraceDatabaseDestroy@4
1674
RtlTraceDatabaseEnumerate@12
1675
RtlTraceDatabaseFind@16
1676
RtlTraceDatabaseLock@4
1677
RtlTraceDatabaseUnlock@4
1678
RtlTraceDatabaseValidate@4
1679
RtlUTF8ToUnicodeN@20
1680
RtlUnicodeStringToAnsiSize@4
1681
RtlUnicodeStringToAnsiString@12
1682
RtlUnicodeStringToCountedOemString@12
1683
RtlUnicodeStringToInteger@12
1684
RtlUnicodeStringToOemSize@4
1685
RtlUnicodeStringToOemString@12
1686
RtlUnicodeToCustomCPN@24
1687
RtlUnicodeToMultiByteN@20
1688
RtlUnicodeToMultiByteSize@12
1690
RtlUnicodeToUTF8N@20
1691
RtlUnlockBootStatusData@4
1693
RtlUpcaseUnicodeChar@4
1694
RtlUpcaseUnicodeString@12
1695
RtlUpcaseUnicodeStringToAnsiString@12
1696
RtlUpcaseUnicodeStringToCountedOemString@12
1697
RtlUpcaseUnicodeStringToOemString@12
1698
RtlUpcaseUnicodeToCustomCPN@24
1699
RtlUpcaseUnicodeToMultiByteN@20
1700
RtlUpcaseUnicodeToOemN@20
1703
RtlValidRelativeSecurityDescriptor@12
1704
RtlValidSecurityDescriptor@4
1706
RtlValidateUnicodeString@8
1707
RtlVerifyVersionInfo@16
1708
RtlVolumeDeviceToDosName@8
1709
RtlWalkFrameChain@12
1710
RtlWeaklyEnumerateEntryHashTable@8
1711
RtlWriteRegistryValue@24
1714
RtlxAnsiStringToUnicodeSize@4
1715
RtlxOemStringToUnicodeSize@4
1716
RtlxUnicodeStringToAnsiSize@4
1717
RtlxUnicodeStringToOemSize@4
1720
SeAccessCheckFromState@40
1721
SeAccessCheckWithHint@44
1722
SeAppendPrivileges@8
1724
SeAssignSecurityEx@36
1725
SeAuditHardLinkCreation@12
1726
SeAuditHardLinkCreationWithTransaction@16
1727
SeAuditTransactionStateChange@12
1728
SeAuditingAnyFileEventsWithContext@8
1729
SeAuditingFileEvents@8
1730
SeAuditingFileEventsWithContext@12
1731
SeAuditingFileOrGlobalEvents@12
1732
SeAuditingHardLinkEvents@8
1733
SeAuditingHardLinkEventsWithContext@12
1734
SeCaptureSecurityDescriptor@20
1735
SeCaptureSubjectContext@4
1736
SeCaptureSubjectContextEx@12
1737
SeCloseObjectAuditAlarm@12
1738
SeCloseObjectAuditAlarmForNonObObject@16
1739
SeComputeAutoInheritByObjectType@12
1740
SeCreateAccessState@16
1741
SeCreateAccessStateEx@24
1742
SeCreateClientSecurity@16
1743
SeCreateClientSecurityFromSubjectContext@16
1744
SeDeassignSecurity@4
1745
SeDeleteAccessState@4
1746
SeDeleteObjectAuditAlarm@8
1747
SeDeleteObjectAuditAlarmWithTransaction@12
1753
SeImpersonateClient@8
1754
SeImpersonateClientEx@8
1755
SeLocateProcessImageName@8
1756
SeLockSubjectContext@4
1757
SeMarkLogonSessionForTerminationNotification@4
1758
SeOpenObjectAuditAlarm@36
1759
SeOpenObjectAuditAlarmForNonObObject@44
1760
SeOpenObjectAuditAlarmWithTransaction@40
1761
SeOpenObjectForDeleteAuditAlarm@36
1762
SeOpenObjectForDeleteAuditAlarmWithTransaction@40
1764
SePrivilegeObjectAuditAlarm@24
1765
SePublicDefaultDacl DATA
1766
SeQueryAuthenticationIdToken@8
1767
SeQueryInformationToken@12
1768
SeQuerySecurityAttributesToken@24
1769
SeQuerySecurityDescriptorInfo@16
1770
SeQuerySessionIdToken@8
1771
SeRegisterLogonSessionTerminatedRoutine@4
1772
SeReleaseSecurityDescriptor@12
1773
SeReleaseSubjectContext@4
1774
SeReportSecurityEvent@16
1775
SeReportSecurityEventWithSubCategory@20
1776
SeSetAccessStateGenericMapping@8
1777
SeSetAuditParameter@16
1778
SeSetSecurityAttributesToken@16
1779
SeSetSecurityDescriptorInfo@24
1780
SeSetSecurityDescriptorInfoEx@28
1781
SeSinglePrivilegeCheck@12
1783
SeSystemDefaultDacl DATA
1784
SeTokenImpersonationLevel@4
1786
SeTokenIsRestricted@4
1787
SeTokenIsWriteRestricted@4
1788
SeTokenObjectType DATA
1790
SeUnlockSubjectContext@4
1791
SeUnregisterLogonSessionTerminatedRoutine@4
1792
SeValidSecurityDescriptor@8
1793
TmCancelPropagationRequest@4
1795
TmCommitEnlistment@8
1796
TmCommitTransaction@8
1797
TmCreateEnlistment@36
1798
TmCurrentTransaction@4
1799
TmDereferenceEnlistmentKey@8
1800
TmEnableCallbacks@12
1801
TmEndPropagationRequest@4
1802
TmEnlistmentObjectType DATA
1803
TmFreezeTransactions@12
1804
TmGetTransactionId@8
1806
TmInitSystemPhase2@0
1807
TmInitializeResourceManager@20
1808
TmInitializeTransaction@36
1809
TmIsTransactionActive@4
1810
TmPrePrepareComplete@8
1811
TmPrePrepareEnlistment@8
1813
TmPrepareEnlistment@8
1814
TmPropagationComplete@16
1815
TmPropagationFailed@12
1816
TmReadOnlyEnlistment@8
1817
TmRecoverEnlistment@8
1818
TmRecoverResourceManager@4
1819
TmRecoverTransactionManager@8
1820
TmReferenceEnlistmentKey@8
1821
TmRequestOutcomeEnlistment@8
1822
TmResourceManagerObjectType DATA
1823
TmRollbackComplete@8
1824
TmRollbackEnlistment@8
1825
TmRollbackTransaction@8
1826
TmSetCurrentTransaction@4
1827
TmThawTransactions@0
1828
TmTransactionManagerObjectType DATA
1829
TmTransactionObjectType DATA
1830
TmpIsKTMCommitCoordinator@4
1831
VerSetConditionMask@16
1835
VfIsVerificationEnabled@8
1836
WRITE_REGISTER_BUFFER_UCHAR@12
1837
WRITE_REGISTER_BUFFER_ULONG@12
1838
WRITE_REGISTER_BUFFER_USHORT@12
1839
WRITE_REGISTER_UCHAR@8
1840
WRITE_REGISTER_ULONG@8
1841
WRITE_REGISTER_USHORT@8
1842
WheaAddErrorSource@8
1843
WheaConfigureErrorSource@8
1844
WheaGetErrorSource@4
1845
WheaInitializeRecordHeader@4
1847
WmiQueryTraceInformation@20
1849
WmiTraceMessageVa@24
1851
ZwAccessCheckAndAuditAlarm@44
1854
ZwAdjustPrivilegesToken@24
1856
ZwAllocateLocallyUniqueId@4
1857
ZwAllocateVirtualMemory@24
1858
ZwAlpcAcceptConnectPort@36
1859
ZwAlpcCancelMessage@12
1860
ZwAlpcConnectPort@44
1862
ZwAlpcCreatePortSection@24
1863
ZwAlpcCreateResourceReserve@16
1864
ZwAlpcCreateSectionView@12
1865
ZwAlpcCreateSecurityContext@12
1866
ZwAlpcDeletePortSection@12
1867
ZwAlpcDeleteResourceReserve@12
1868
ZwAlpcDeleteSectionView@12
1869
ZwAlpcDeleteSecurityContext@12
1870
ZwAlpcDisconnectPort@8
1871
ZwAlpcQueryInformation@20
1872
ZwAlpcSendWaitReceivePort@32
1873
ZwAlpcSetInformation@16
1874
ZwAssignProcessToJobObject@8
1879
ZwCloseObjectAuditAlarm@12
1881
ZwCommitEnlistment@8
1882
ZwCommitTransaction@8
1884
ZwCreateDirectoryObject@12
1885
ZwCreateEnlistment@32
1888
ZwCreateIoCompletion@16
1889
ZwCreateJobObject@12
1891
ZwCreateKeyTransacted@32
1892
ZwCreateResourceManager@28
1894
ZwCreateSymbolicLinkObject@16
1896
ZwCreateTransaction@40
1897
ZwCreateTransactionManager@24
1899
ZwDeleteDriverEntry@4
1903
ZwDeviceIoControlFile@40
1905
ZwDuplicateObject@28
1907
ZwEnumerateBootEntries@8
1908
ZwEnumerateDriverEntries@8
1910
ZwEnumerateTransactionObject@20
1911
ZwEnumerateValueKey@24
1912
ZwFlushBuffersFile@8
1913
ZwFlushInstructionCache@12
1915
ZwFlushVirtualMemory@16
1916
ZwFreeVirtualMemory@16
1918
ZwGetNotificationResourceManager@28
1919
ZwImpersonateAnonymousToken@4
1920
ZwInitiatePowerAction@16
1926
ZwLockProductActivationKeys@8
1927
ZwMakeTemporaryObject@4
1928
ZwMapViewOfSection@40
1930
ZwModifyDriverEntry@4
1931
ZwNotifyChangeKey@40
1932
ZwNotifyChangeSession@32
1933
ZwOpenDirectoryObject@12
1940
ZwOpenKeyTransacted@16
1941
ZwOpenKeyTransactedEx@20
1943
ZwOpenProcessToken@12
1944
ZwOpenProcessTokenEx@16
1945
ZwOpenResourceManager@20
1948
ZwOpenSymbolicLinkObject@12
1950
ZwOpenThreadToken@16
1951
ZwOpenThreadTokenEx@20
1953
ZwOpenTransaction@20
1954
ZwOpenTransactionManager@24
1955
ZwPowerInformation@20
1956
ZwPrePrepareComplete@8
1957
ZwPrePrepareEnlistment@8
1959
ZwPrepareEnlistment@8
1960
ZwPropagationComplete@16
1961
ZwPropagationFailed@12
1963
ZwQueryBootEntryOrder@8
1964
ZwQueryBootOptions@8
1965
ZwQueryDefaultLocale@8
1966
ZwQueryDefaultUILanguage@4
1967
ZwQueryDirectoryFile@44
1968
ZwQueryDirectoryObject@28
1969
ZwQueryDriverEntryOrder@8
1971
ZwQueryFullAttributesFile@8
1972
ZwQueryInformationEnlistment@20
1973
ZwQueryInformationFile@20
1974
ZwQueryInformationJobObject@20
1975
ZwQueryInformationProcess@20
1976
ZwQueryInformationResourceManager@20
1977
ZwQueryInformationThread@20
1978
ZwQueryInformationToken@20
1979
ZwQueryInformationTransaction@20
1980
ZwQueryInformationTransactionManager@20
1981
ZwQueryInstallUILanguage@4
1983
ZwQueryLicenseValue@20
1985
ZwQueryQuotaInformationFile@36
1987
ZwQuerySecurityAttributesToken@24
1988
ZwQuerySecurityObject@20
1989
ZwQuerySymbolicLinkObject@12
1990
ZwQuerySystemInformation@16
1992
ZwQueryVirtualMemory@24
1993
ZwQueryVolumeInformationFile@20
1995
ZwReadOnlyEnlistment@8
1996
ZwRecoverEnlistment@8
1997
ZwRecoverResourceManager@4
1998
ZwRecoverTransactionManager@4
1999
ZwRemoveIoCompletion@20
2000
ZwRemoveIoCompletionEx@24
2003
ZwRequestWaitReplyPort@12
2006
ZwRollbackComplete@8
2007
ZwRollbackEnlistment@8
2008
ZwRollbackTransaction@8
2011
ZwSecureConnectPort@36
2012
ZwSetBootEntryOrder@8
2014
ZwSetDefaultLocale@8
2015
ZwSetDefaultUILanguage@4
2016
ZwSetDriverEntryOrder@8
2019
ZwSetInformationEnlistment@16
2020
ZwSetInformationFile@20
2021
ZwSetInformationJobObject@16
2022
ZwSetInformationObject@16
2023
ZwSetInformationProcess@16
2024
ZwSetInformationResourceManager@16
2025
ZwSetInformationThread@16
2026
ZwSetInformationToken@16
2027
ZwSetInformationTransaction@16
2028
ZwSetQuotaInformationFile@16
2029
ZwSetSecurityObject@12
2030
ZwSetSystemInformation@12
2035
ZwSetVolumeInformationFile@20
2036
ZwTerminateJobObject@8
2037
ZwTerminateProcess@8
2039
ZwTranslateFilePath@16
2044
ZwUnmapViewOfSection@8
2045
ZwWaitForMultipleObjects@20
2046
ZwWaitForSingleObject@12
2052
_abnormal_termination
2169
vDbgPrintExWithPrefix@20