2008-02-08 06:07:47 +00:00
|
|
|
; reactos/ntoskrnl/ntoskrnl.def
|
|
|
|
|
;
|
|
|
|
|
; ReactOS Operating System
|
|
|
|
|
;
|
|
|
|
|
EXPORTS
|
|
|
|
|
CcCanIWrite
|
|
|
|
|
CcCopyRead
|
|
|
|
|
CcCopyWrite
|
|
|
|
|
CcDeferWrite
|
|
|
|
|
CcFastCopyRead
|
|
|
|
|
CcFastCopyWrite
|
|
|
|
|
CcFlushCache
|
|
|
|
|
CcGetDirtyPages
|
|
|
|
|
CcGetFileObjectFromBcb
|
|
|
|
|
CcGetFileObjectFromSectionPtrs
|
|
|
|
|
CcGetFlushedValidData
|
|
|
|
|
CcGetLsnForFileObject
|
|
|
|
|
CcInitializeCacheMap
|
|
|
|
|
CcIsThereDirtyData
|
|
|
|
|
CcFastMdlReadWait DATA
|
|
|
|
|
CcFastReadNotPossible DATA
|
|
|
|
|
CcFastReadWait DATA
|
|
|
|
|
CcMapData
|
|
|
|
|
CcMdlRead
|
|
|
|
|
CcMdlReadComplete
|
|
|
|
|
CcMdlWriteAbort
|
|
|
|
|
CcMdlWriteComplete
|
|
|
|
|
CcPinMappedData
|
|
|
|
|
CcPinRead
|
|
|
|
|
CcPrepareMdlWrite
|
|
|
|
|
CcPreparePinWrite
|
|
|
|
|
CcPurgeCacheSection
|
|
|
|
|
CcRemapBcb
|
|
|
|
|
CcRepinBcb
|
|
|
|
|
CcScheduleReadAhead
|
|
|
|
|
CcSetAdditionalCacheAttributes
|
|
|
|
|
CcSetBcbOwnerPointer
|
|
|
|
|
CcSetDirtyPageThreshold
|
|
|
|
|
CcSetDirtyPinnedData
|
|
|
|
|
CcSetLogHandleForFile
|
|
|
|
|
CcSetReadAheadGranularity
|
|
|
|
|
CcUninitializeCacheMap
|
|
|
|
|
CcUnpinData
|
|
|
|
|
CcUnpinDataForThread
|
|
|
|
|
CcUnpinRepinnedBcb
|
|
|
|
|
CcWaitForCurrentLazyWriterActivity
|
|
|
|
|
CcSetFileSizes
|
|
|
|
|
CcZeroData
|
|
|
|
|
CmRegisterCallback
|
|
|
|
|
CmUnRegisterCallback
|
|
|
|
|
DbgBreakPoint
|
|
|
|
|
DbgBreakPointWithStatus
|
|
|
|
|
DbgLoadImageSymbols
|
|
|
|
|
DbgPrint
|
|
|
|
|
DbgPrompt
|
|
|
|
|
DbgPrintEx
|
|
|
|
|
DbgPrintReturnControlC
|
|
|
|
|
DbgQueryDebugFilterState
|
|
|
|
|
DbgSetDebugFilterState
|
|
|
|
|
ExiAcquireFastMutex=ExAcquireFastMutex
|
|
|
|
|
ExAcquireFastMutexUnsafe
|
|
|
|
|
ExAcquireRundownProtection=ExfAcquireRundownProtection
|
|
|
|
|
ExAcquireRundownProtectionCacheAware=ExfAcquireRundownProtectionCacheAware
|
|
|
|
|
ExAcquireRundownProtectionCacheAwareEx=ExfAcquireRundownProtectionCacheAwareEx
|
|
|
|
|
ExAcquireRundownProtectionEx=ExfAcquireRundownProtectionEx
|
|
|
|
|
ExInitializeRundownProtection=ExfInitializeRundownProtection
|
|
|
|
|
ExReInitializeRundownProtection=ExfReInitializeRundownProtection
|
|
|
|
|
ExReInitializeRundownProtectionCacheAware=ExfReInitializeRundownProtectionCacheAware
|
|
|
|
|
ExReleaseRundownProtection=ExfReleaseRundownProtection
|
|
|
|
|
ExReleaseRundownProtectionCacheAware=ExfReleaseRundownProtectionCacheAware
|
|
|
|
|
ExReleaseRundownProtectionCacheAwareEx=ExfReleaseRundownProtectionCacheAwareEx
|
|
|
|
|
ExReleaseRundownProtectionEx=ExfReleaseRundownProtectionEx
|
|
|
|
|
ExRundownCompleted=ExfRundownCompleted
|
|
|
|
|
ExRundownCompletedCacheAware=ExfRundownCompletedCacheAware
|
|
|
|
|
ExWaitForRundownProtectionRelease=ExfWaitForRundownProtectionRelease
|
|
|
|
|
ExWaitForRundownProtectionReleaseCacheAware=ExfWaitForRundownProtectionReleaseCacheAware
|
|
|
|
|
ExAllocateCacheAwareRundownProtection
|
|
|
|
|
ExFreeCacheAwareRundownProtection
|
|
|
|
|
ExInitializeRundownProtectionCacheAware
|
|
|
|
|
ExSizeOfRundownProtectionCacheAware
|
|
|
|
|
ExAcquireResourceExclusiveLite
|
|
|
|
|
ExAcquireResourceSharedLite
|
|
|
|
|
ExAcquireSharedStarveExclusive
|
|
|
|
|
ExAcquireSharedWaitForExclusive
|
|
|
|
|
ExAllocateFromPagedLookasideList=ExiAllocateFromPagedLookasideList
|
|
|
|
|
ExAllocatePool
|
|
|
|
|
ExAllocatePoolWithQuota
|
|
|
|
|
ExAllocatePoolWithQuotaTag
|
|
|
|
|
ExAllocatePoolWithTag
|
|
|
|
|
ExAllocatePoolWithTagPriority
|
|
|
|
|
ExConvertExclusiveToSharedLite
|
|
|
|
|
ExCreateCallback
|
|
|
|
|
ExDeleteNPagedLookasideList
|
|
|
|
|
ExDeletePagedLookasideList
|
|
|
|
|
ExDeleteResourceLite
|
|
|
|
|
ExDesktopObjectType
|
|
|
|
|
ExDisableResourceBoostLite
|
|
|
|
|
ExEnumHandleTable
|
|
|
|
|
ExEnterCriticalRegionAndAcquireFastMutexUnsafe
|
|
|
|
|
ExEventObjectType=_ExEventObjectType
|
|
|
|
|
ExExtendZone
|
|
|
|
|
ExFreePool
|
|
|
|
|
ExFreePoolWithTag
|
|
|
|
|
ExFreeToPagedLookasideList=ExiFreeToPagedLookasideList
|
|
|
|
|
ExGetCurrentProcessorCounts
|
|
|
|
|
ExGetCurrentProcessorCpuUsage
|
|
|
|
|
ExGetExclusiveWaiterCount
|
|
|
|
|
ExGetPreviousMode
|
|
|
|
|
ExGetSharedWaiterCount
|
|
|
|
|
ExInitializeNPagedLookasideList
|
|
|
|
|
ExInitializePagedLookasideList
|
|
|
|
|
ExInitializeResourceLite
|
|
|
|
|
ExInitializeZone
|
|
|
|
|
ExInterlockedAddLargeInteger
|
|
|
|
|
ExInterlockedAddLargeStatistic
|
|
|
|
|
ExInterlockedAddUlong
|
|
|
|
|
ExInterlockedCompareExchange64
|
|
|
|
|
ExInterlockedDecrementLong
|
|
|
|
|
ExInterlockedExchangeUlong
|
|
|
|
|
ExInterlockedExtendZone
|
|
|
|
|
ExInterlockedIncrementLong
|
|
|
|
|
ExInterlockedFlushSList
|
|
|
|
|
ExInterlockedInsertHeadList
|
|
|
|
|
ExInterlockedInsertTailList
|
|
|
|
|
ExInterlockedPopEntryList
|
|
|
|
|
ExInterlockedPopEntrySList
|
|
|
|
|
ExInterlockedPushEntryList
|
|
|
|
|
ExInterlockedPushEntrySList
|
|
|
|
|
ExInterlockedRemoveHeadList
|
|
|
|
|
ExIsProcessorFeaturePresent
|
|
|
|
|
ExIsResourceAcquiredExclusiveLite
|
|
|
|
|
ExIsResourceAcquiredSharedLite
|
|
|
|
|
ExLocalTimeToSystemTime
|
|
|
|
|
ExNotifyCallback
|
|
|
|
|
ExQueryPoolBlockSize
|
|
|
|
|
ExQueueWorkItem
|
|
|
|
|
ExRaiseAccessViolation
|
|
|
|
|
ExRaiseDatatypeMisalignment
|
|
|
|
|
ExRaiseException=RtlRaiseException
|
|
|
|
|
ExRaiseHardError
|
|
|
|
|
ExRaiseStatus=RtlRaiseStatus
|
|
|
|
|
ExRegisterCallback
|
|
|
|
|
ExReinitializeResourceLite
|
|
|
|
|
ExiReleaseFastMutex=ExReleaseFastMutex
|
|
|
|
|
ExReleaseFastMutexUnsafe
|
|
|
|
|
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
|
|
|
|
|
ExReleaseResourceForThreadLite
|
|
|
|
|
ExReleaseResourceLite
|
|
|
|
|
ExSemaphoreObjectType=_ExSemaphoreObjectType
|
|
|
|
|
ExSetResourceOwnerPointer
|
|
|
|
|
ExSetTimerResolution
|
|
|
|
|
ExSystemExceptionFilter
|
|
|
|
|
ExSystemTimeToLocalTime
|
|
|
|
|
ExiTryToAcquireFastMutex=ExTryToAcquireFastMutex
|
|
|
|
|
ExTryToAcquireResourceExclusiveLite
|
|
|
|
|
ExUnregisterCallback
|
|
|
|
|
ExUuidCreate
|
|
|
|
|
ExVerifySuite
|
|
|
|
|
ExWindowStationObjectType DATA
|
|
|
|
|
ExfInterlockedAddUlong
|
|
|
|
|
ExfInterlockedInsertHeadList
|
|
|
|
|
ExfInterlockedInsertTailList
|
|
|
|
|
ExfInterlockedCompareExchange64
|
|
|
|
|
ExfInterlockedPopEntryList
|
|
|
|
|
ExfInterlockedPushEntryList
|
|
|
|
|
ExfInterlockedRemoveHeadList
|
|
|
|
|
FsRtlAcquireFileExclusive
|
|
|
|
|
;FsRtlAddBaseMcbEntry
|
|
|
|
|
FsRtlAddLargeMcbEntry
|
|
|
|
|
FsRtlAddMcbEntry
|
|
|
|
|
FsRtlAddToTunnelCache
|
|
|
|
|
FsRtlAllocateFileLock
|
|
|
|
|
FsRtlAllocatePool
|
|
|
|
|
FsRtlAllocatePoolWithQuota
|
|
|
|
|
FsRtlAllocatePoolWithQuotaTag
|
|
|
|
|
FsRtlAllocatePoolWithTag
|
|
|
|
|
FsRtlAllocateResource
|
|
|
|
|
FsRtlAreNamesEqual
|
|
|
|
|
FsRtlBalanceReads
|
|
|
|
|
FsRtlCheckLockForReadAccess
|
|
|
|
|
FsRtlCheckLockForWriteAccess
|
|
|
|
|
FsRtlCheckOplock
|
|
|
|
|
FsRtlCopyRead
|
|
|
|
|
FsRtlCopyWrite
|
|
|
|
|
;FsRtlCreateSectionForDataScan
|
|
|
|
|
FsRtlCurrentBatchOplock
|
|
|
|
|
FsRtlDeleteKeyFromTunnelCache
|
|
|
|
|
FsRtlDeleteTunnelCache
|
|
|
|
|
FsRtlDeregisterUncProvider
|
|
|
|
|
FsRtlDissectDbcs
|
|
|
|
|
FsRtlDissectName
|
|
|
|
|
FsRtlDoesDbcsContainWildCards
|
|
|
|
|
FsRtlDoesNameContainWildCards
|
|
|
|
|
FsRtlFastCheckLockForRead
|
|
|
|
|
FsRtlFastCheckLockForWrite
|
|
|
|
|
FsRtlFastUnlockAll
|
|
|
|
|
FsRtlFastUnlockAllByKey
|
|
|
|
|
FsRtlFastUnlockSingle
|
|
|
|
|
FsRtlFindInTunnelCache
|
|
|
|
|
FsRtlFreeFileLock
|
|
|
|
|
FsRtlGetFileSize
|
|
|
|
|
;FsRtlGetNextBaseMcbEntry
|
|
|
|
|
FsRtlGetNextFileLock
|
|
|
|
|
FsRtlGetNextLargeMcbEntry
|
|
|
|
|
FsRtlGetNextMcbEntry
|
|
|
|
|
FsRtlIncrementCcFastReadNotPossible
|
|
|
|
|
FsRtlIncrementCcFastReadNoWait
|
|
|
|
|
FsRtlIncrementCcFastReadResourceMiss
|
|
|
|
|
FsRtlIncrementCcFastReadWait
|
|
|
|
|
;FsRtlInitializeBaseMcb
|
|
|
|
|
FsRtlInitializeFileLock
|
|
|
|
|
FsRtlInitializeLargeMcb
|
|
|
|
|
FsRtlInitializeMcb
|
|
|
|
|
FsRtlInitializeOplock
|
|
|
|
|
FsRtlInitializeTunnelCache
|
|
|
|
|
FsRtlInsertPerFileObjectContext
|
|
|
|
|
FsRtlInsertPerStreamContext
|
|
|
|
|
FsRtlIsDbcsInExpression
|
|
|
|
|
FsRtlIsFatDbcsLegal
|
|
|
|
|
FsRtlIsHpfsDbcsLegal
|
|
|
|
|
FsRtlIsNameInExpression
|
|
|
|
|
FsRtlIsNtstatusExpected
|
|
|
|
|
FsRtlIsPagingFile
|
|
|
|
|
FsRtlIsTotalDeviceFailure
|
|
|
|
|
FsRtlLegalAnsiCharacterArray=_FsRtlLegalAnsiCharacterArray
|
|
|
|
|
;FsRtlLookupBaseMcbEntry
|
|
|
|
|
FsRtlLookupLargeMcbEntry
|
|
|
|
|
;FsRtlLookupLastBaseMcbEntry
|
|
|
|
|
;FsRtlLookupLastBaseMcbEntryAndIndex
|
|
|
|
|
FsRtlLookupLastLargeMcbEntry
|
|
|
|
|
FsRtlLookupLastLargeMcbEntryAndIndex
|
|
|
|
|
FsRtlLookupLastMcbEntry
|
|
|
|
|
FsRtlLookupMcbEntry
|
|
|
|
|
FsRtlLookupPerFileObjectContext
|
|
|
|
|
FsRtlLookupPerStreamContextInternal
|
|
|
|
|
FsRtlMdlRead
|
|
|
|
|
FsRtlMdlReadComplete
|
|
|
|
|
FsRtlMdlReadCompleteDev
|
|
|
|
|
FsRtlMdlReadDev
|
|
|
|
|
FsRtlMdlWriteComplete
|
|
|
|
|
FsRtlMdlWriteCompleteDev
|
|
|
|
|
FsRtlNormalizeNtstatus
|
|
|
|
|
FsRtlNotifyChangeDirectory
|
|
|
|
|
FsRtlNotifyCleanup
|
|
|
|
|
FsRtlNotifyFilterChangeDirectory
|
|
|
|
|
FsRtlNotifyFilterReportChange
|
|
|
|
|
FsRtlNotifyFullChangeDirectory
|
|
|
|
|
FsRtlNotifyFullReportChange
|
|
|
|
|
FsRtlNotifyInitializeSync
|
|
|
|
|
FsRtlNotifyReportChange
|
|
|
|
|
FsRtlNotifyUninitializeSync
|
|
|
|
|
FsRtlNotifyVolumeEvent
|
|
|
|
|
;FsRtlNumberOfRunsInBaseMcb
|
|
|
|
|
FsRtlNumberOfRunsInLargeMcb
|
|
|
|
|
FsRtlNumberOfRunsInMcb
|
|
|
|
|
FsRtlOplockFsctrl
|
|
|
|
|
FsRtlOplockIsFastIoPossible
|
|
|
|
|
FsRtlPostPagingFileStackOverflow
|
|
|
|
|
FsRtlPostStackOverflow
|
|
|
|
|
FsRtlPrepareMdlWrite
|
|
|
|
|
FsRtlPrepareMdlWriteDev
|
|
|
|
|
FsRtlPrivateLock
|
|
|
|
|
FsRtlProcessFileLock
|
|
|
|
|
FsRtlRegisterFileSystemFilterCallbacks
|
|
|
|
|
FsRtlRegisterUncProvider
|
|
|
|
|
FsRtlReleaseFile
|
|
|
|
|
;FsRtlRemoveBaseMcbEntry
|
|
|
|
|
FsRtlRemoveLargeMcbEntry
|
|
|
|
|
FsRtlRemoveMcbEntry
|
|
|
|
|
FsRtlRemovePerFileObjectContext
|
|
|
|
|
FsRtlRemovePerStreamContext
|
|
|
|
|
;FsRtlResetBaseMcb
|
|
|
|
|
FsRtlResetLargeMcb
|
|
|
|
|
;FsRtlSplitBaseMcb
|
|
|
|
|
FsRtlSplitLargeMcb
|
|
|
|
|
FsRtlSyncVolumes
|
|
|
|
|
FsRtlTeardownPerStreamContexts
|
|
|
|
|
;FsRtlTruncateBaseMcb
|
|
|
|
|
FsRtlTruncateLargeMcb
|
|
|
|
|
FsRtlTruncateMcb
|
|
|
|
|
;FsRtlUninitializeBaseMcb
|
|
|
|
|
FsRtlUninitializeFileLock
|
|
|
|
|
FsRtlUninitializeLargeMcb
|
|
|
|
|
FsRtlUninitializeMcb
|
|
|
|
|
FsRtlUninitializeOplock
|
|
|
|
|
HalDispatchTable=_HalDispatchTable
|
|
|
|
|
HalPrivateDispatchTable DATA
|
|
|
|
|
HalExamineMBR
|
|
|
|
|
InbvAcquireDisplayOwnership
|
|
|
|
|
InbvCheckDisplayOwnership
|
|
|
|
|
InbvDisplayString
|
|
|
|
|
InbvEnableBootDriver
|
|
|
|
|
InbvEnableDisplayString
|
|
|
|
|
InbvInstallDisplayStringFilter
|
|
|
|
|
InbvIsBootDriverInstalled
|
|
|
|
|
InbvNotifyDisplayOwnershipLost
|
|
|
|
|
InbvResetDisplay
|
|
|
|
|
InbvSetScrollRegion
|
|
|
|
|
InbvSetTextColor
|
|
|
|
|
InbvSolidColorFill
|
|
|
|
|
InitSafeBootMode DATA
|
|
|
|
|
InterlockedCompareExchange
|
|
|
|
|
InterlockedDecrement
|
|
|
|
|
InterlockedExchange
|
|
|
|
|
InterlockedExchangeAdd
|
|
|
|
|
InterlockedIncrement
|
|
|
|
|
InterlockedPushEntrySList
|
|
|
|
|
InterlockedPopEntrySList
|
|
|
|
|
IoAcquireCancelSpinLock
|
|
|
|
|
IoAcquireRemoveLockEx
|
|
|
|
|
IoAcquireVpbSpinLock
|
|
|
|
|
IoAdapterObjectType DATA
|
|
|
|
|
IoAllocateAdapterChannel
|
|
|
|
|
IoAllocateIrp
|
|
|
|
|
IoAllocateMdl
|
|
|
|
|
IoAllocateController
|
|
|
|
|
IoAllocateDriverObjectExtension
|
|
|
|
|
IoAllocateErrorLogEntry
|
|
|
|
|
IoAllocateWorkItem
|
|
|
|
|
IoAssignDriveLetters
|
|
|
|
|
IoAssignResources
|
|
|
|
|
IoAttachDevice
|
|
|
|
|
IoAttachDeviceByPointer
|
|
|
|
|
IoAttachDeviceToDeviceStack
|
|
|
|
|
IoAttachDeviceToDeviceStackSafe
|
|
|
|
|
IoBuildAsynchronousFsdRequest
|
|
|
|
|
IoBuildDeviceIoControlRequest
|
|
|
|
|
IoBuildPartialMdl
|
|
|
|
|
IoBuildSynchronousFsdRequest
|
|
|
|
|
IoCallDriver
|
|
|
|
|
IoCancelFileOpen
|
|
|
|
|
IoCancelIrp
|
|
|
|
|
IoCheckDesiredAccess
|
|
|
|
|
IoCheckEaBufferValidity
|
|
|
|
|
IoCheckFunctionAccess
|
|
|
|
|
IoCheckQuerySetFileInformation
|
|
|
|
|
IoCheckQuerySetVolumeInformation
|
|
|
|
|
IoCheckQuotaBufferValidity
|
|
|
|
|
IoCheckShareAccess
|
|
|
|
|
IoCompleteRequest
|
|
|
|
|
IoConnectInterrupt
|
|
|
|
|
IoCreateController
|
|
|
|
|
IoCreateDevice
|
|
|
|
|
IoCreateDisk
|
|
|
|
|
IoCreateDriver
|
|
|
|
|
IoCreateFile
|
|
|
|
|
IoCreateFileSpecifyDeviceObjectHint
|
|
|
|
|
IoCreateNotificationEvent
|
|
|
|
|
IoCreateStreamFileObject
|
|
|
|
|
IoCreateStreamFileObjectEx
|
|
|
|
|
IoCreateStreamFileObjectLite
|
|
|
|
|
IoCreateSymbolicLink
|
|
|
|
|
IoCreateSynchronizationEvent
|
|
|
|
|
IoCreateUnprotectedSymbolicLink
|
|
|
|
|
IoCsqInitialize
|
|
|
|
|
IoCsqInitializeEx
|
|
|
|
|
IoCsqInsertIrp
|
|
|
|
|
IoCsqInsertIrpEx
|
|
|
|
|
IoCsqRemoveIrp
|
|
|
|
|
IoCsqRemoveNextIrp
|
|
|
|
|
IoDeleteController
|
|
|
|
|
IoDeleteDevice
|
|
|
|
|
IoDeleteDriver
|
|
|
|
|
IoDeleteSymbolicLink
|
|
|
|
|
IoDetachDevice
|
|
|
|
|
IoDeviceHandlerObjectSize DATA
|
|
|
|
|
IoDeviceHandlerObjectType DATA
|
|
|
|
|
IoDeviceObjectType DATA
|
|
|
|
|
IoDisconnectInterrupt
|
|
|
|
|
IoDriverObjectType DATA
|
|
|
|
|
IoEnqueueIrp
|
|
|
|
|
IoEnumerateDeviceObjectList
|
|
|
|
|
IoFastQueryNetworkAttributes
|
|
|
|
|
IoFileObjectType=_IoFileObjectType
|
|
|
|
|
IoForwardAndCatchIrp=IoForwardIrpSynchronously
|
|
|
|
|
IoForwardIrpSynchronously
|
|
|
|
|
IoFreeController
|
|
|
|
|
IoFreeErrorLogEntry
|
|
|
|
|
IoFreeIrp
|
|
|
|
|
IoFreeMdl
|
|
|
|
|
IoFreeWorkItem
|
|
|
|
|
IoGetAttachedDevice
|
|
|
|
|
IoGetAttachedDeviceReference
|
|
|
|
|
IoGetBaseFileSystemDeviceObject
|
|
|
|
|
IoGetBootDiskInformation
|
|
|
|
|
IoGetConfigurationInformation
|
|
|
|
|
IoGetCurrentProcess
|
|
|
|
|
IoGetDeviceObjectPointer
|
|
|
|
|
IoGetDeviceAttachmentBaseRef
|
|
|
|
|
IoGetDeviceInterfaceAlias
|
|
|
|
|
IoGetDeviceInterfaces
|
|
|
|
|
IoGetDriverObjectExtension
|
|
|
|
|
IoGetDeviceProperty
|
|
|
|
|
IoGetDeviceToVerify
|
|
|
|
|
IoGetDiskDeviceObject
|
|
|
|
|
IoGetDmaAdapter
|
|
|
|
|
IoGetFileObjectGenericMapping
|
|
|
|
|
IoGetInitialStack
|
|
|
|
|
IoGetLowerDeviceObject
|
|
|
|
|
IoGetRelatedDeviceObject
|
|
|
|
|
IoGetRequestorProcess
|
|
|
|
|
IoGetRequestorProcessId
|
|
|
|
|
IoGetRequestorSessionId
|
|
|
|
|
IoGetStackLimits
|
|
|
|
|
IoGetTopLevelIrp
|
|
|
|
|
IoInitializeIrp
|
|
|
|
|
IoInvalidateDeviceRelations
|
|
|
|
|
IoInvalidateDeviceState
|
|
|
|
|
IoInitializeRemoveLockEx
|
|
|
|
|
IoInitializeTimer
|
|
|
|
|
IoIsFileOriginRemote
|
|
|
|
|
IoIsSystemThread
|
|
|
|
|
IoIsValidNameGraftingBuffer
|
|
|
|
|
IoIsOperationSynchronous
|
|
|
|
|
IoMakeAssociatedIrp
|
|
|
|
|
IoOpenDeviceInterfaceRegistryKey
|
|
|
|
|
IoOpenDeviceRegistryKey
|
|
|
|
|
IoPageRead
|
|
|
|
|
IoPnPDeliverServicePowerNotification
|
|
|
|
|
IoQueryDeviceDescription
|
|
|
|
|
IoQueryFileDosDeviceName
|
|
|
|
|
IoQueryFileInformation
|
|
|
|
|
IoQueryVolumeInformation
|
|
|
|
|
IoQueueThreadIrp
|
|
|
|
|
IoQueueWorkItem
|
|
|
|
|
IoRaiseHardError
|
|
|
|
|
IoRaiseInformationalHardError
|
|
|
|
|
IoReadDiskSignature
|
|
|
|
|
IoReadOperationCount DATA
|
|
|
|
|
IoReadPartitionTable
|
|
|
|
|
IoReadPartitionTableEx
|
|
|
|
|
IoReadTransferCount DATA
|
|
|
|
|
IoRegisterBootDriverReinitialization
|
|
|
|
|
IoRegisterDeviceInterface
|
|
|
|
|
IoRegisterDriverReinitialization
|
|
|
|
|
IoRegisterFileSystem
|
|
|
|
|
IoRegisterFsRegistrationChange
|
|
|
|
|
IoRegisterLastChanceShutdownNotification
|
|
|
|
|
IoRegisterPlugPlayNotification
|
|
|
|
|
IoRegisterShutdownNotification
|
|
|
|
|
IoReleaseCancelSpinLock
|
|
|
|
|
IoReleaseRemoveLockAndWaitEx
|
|
|
|
|
IoReleaseRemoveLockEx
|
|
|
|
|
IoReleaseVpbSpinLock
|
|
|
|
|
IoRemoveShareAccess
|
|
|
|
|
IoReportDetectedDevice
|
|
|
|
|
IoReportHalResourceUsage
|
|
|
|
|
IoReportResourceUsage
|
|
|
|
|
IoReportResourceForDetection
|
|
|
|
|
IoReportTargetDeviceChange
|
|
|
|
|
IoReportTargetDeviceChangeAsynchronous
|
|
|
|
|
IoRequestDeviceEject
|
|
|
|
|
IoReuseIrp
|
|
|
|
|
IoSetCompletionRoutineEx
|
|
|
|
|
IoSetSystemPartition
|
|
|
|
|
IoSetDeviceInterfaceState
|
|
|
|
|
IoSetDeviceToVerify
|
|
|
|
|
IoSetFileOrigin
|
|
|
|
|
IoSetHardErrorOrVerifyDevice
|
|
|
|
|
IoSetInformation
|
|
|
|
|
IoSetIoCompletion
|
|
|
|
|
IoSetPartitionInformation
|
|
|
|
|
IoSetPartitionInformationEx
|
|
|
|
|
IoSetStartIoAttributes
|
|
|
|
|
IoSetShareAccess
|
|
|
|
|
IoSetThreadHardErrorMode
|
|
|
|
|
IoSetTopLevelIrp
|
|
|
|
|
IoStartNextPacket
|
|
|
|
|
IoStartNextPacketByKey
|
|
|
|
|
IoStartPacket
|
|
|
|
|
IoStartTimer
|
|
|
|
|
IoStatisticsLock DATA
|
|
|
|
|
IoStopTimer
|
|
|
|
|
IoSynchronousPageWrite
|
|
|
|
|
IoSynchronousInvalidateDeviceRelations
|
|
|
|
|
IoThreadToProcess
|
|
|
|
|
IoUnregisterFileSystem
|
|
|
|
|
IoUnregisterFsRegistrationChange
|
|
|
|
|
IoUnregisterPlugPlayNotification
|
|
|
|
|
IoUnregisterShutdownNotification
|
|
|
|
|
IoUpdateShareAccess
|
|
|
|
|
IoValidateDeviceIoControlAccess
|
|
|
|
|
IoVerifyPartitionTable
|
|
|
|
|
IoVerifyVolume
|
|
|
|
|
IoVolumeDeviceToDosName
|
|
|
|
|
IoWMIAllocateInstanceIds
|
|
|
|
|
IoWMIDeviceObjectToInstanceName
|
|
|
|
|
IoWMIExecuteMethod
|
|
|
|
|
IoWMIHandleToInstanceName
|
|
|
|
|
IoWMIOpenBlock
|
|
|
|
|
IoWMIQueryAllData
|
|
|
|
|
IoWMIQueryAllDataMultiple
|
|
|
|
|
IoWMIQuerySingleInstance
|
|
|
|
|
IoWMIQuerySingleInstanceMultiple
|
|
|
|
|
IoWMIRegistrationControl
|
|
|
|
|
IoWMISetNotificationCallback
|
|
|
|
|
IoWMISetSingleInstance
|
|
|
|
|
IoWMISetSingleItem
|
|
|
|
|
IoWMISuggestInstanceName
|
|
|
|
|
IoWMIWriteEvent
|
|
|
|
|
IoWriteErrorLogEntry
|
|
|
|
|
IoWriteOperationCount DATA
|
|
|
|
|
IoWritePartitionTable
|
|
|
|
|
IoWritePartitionTableEx
|
|
|
|
|
IoWriteTransferCount DATA
|
|
|
|
|
IofCallDriver
|
|
|
|
|
IofCompleteRequest
|
|
|
|
|
IoIsWdmVersionAvailable
|
|
|
|
|
KdChangeOption
|
|
|
|
|
KdDebuggerEnabled=_KdDebuggerEnabled
|
|
|
|
|
KdDebuggerNotPresent=_KdDebuggerNotPresent
|
|
|
|
|
KdDisableDebugger
|
|
|
|
|
KdEnableDebugger
|
|
|
|
|
KdEnteredDebugger
|
|
|
|
|
KdPollBreakIn
|
|
|
|
|
KdPowerTransition
|
|
|
|
|
KdSystemDebugControl
|
|
|
|
|
KeAcquireGuardedMutex
|
|
|
|
|
KeAcquireGuardedMutexUnsafe
|
|
|
|
|
KeAcquireSpinLockAtDpcLevel
|
|
|
|
|
KeAcquireInStackQueuedSpinLockAtDpcLevel
|
|
|
|
|
KeAcquireInterruptSpinLock
|
|
|
|
|
KeAddSystemServiceTable
|
|
|
|
|
KeAreApcsDisabled
|
|
|
|
|
KeAttachProcess
|
|
|
|
|
;KeBoostCurrentThread
|
|
|
|
|
KeBugCheck
|
|
|
|
|
KeBugCheckEx
|
|
|
|
|
KeCancelTimer
|
|
|
|
|
KeCapturePersistentThreadState
|
|
|
|
|
KeClearEvent
|
|
|
|
|
KeConnectInterrupt
|
|
|
|
|
KeDcacheFlushCount DATA
|
|
|
|
|
KeDelayExecutionThread
|
|
|
|
|
KeDeregisterBugCheckCallback
|
|
|
|
|
KeDeregisterBugCheckReasonCallback
|
|
|
|
|
KeDetachProcess
|
|
|
|
|
KeDisconnectInterrupt
|
|
|
|
|
KeEnterCriticalRegion=_KeEnterCriticalRegion
|
|
|
|
|
KeEnterGuardedRegion=_KeEnterGuardedRegion
|
|
|
|
|
KeEnterKernelDebugger
|
|
|
|
|
KeFindConfigurationEntry
|
|
|
|
|
KeFindConfigurationNextEntry
|
|
|
|
|
KeFlushEntireTb
|
|
|
|
|
KeFlushQueuedDpcs
|
|
|
|
|
KeGetCurrentThread
|
|
|
|
|
KeGetPreviousMode
|
|
|
|
|
KeGetRecommendedSharedDataAlignment
|
|
|
|
|
KeIcacheFlushCount DATA
|
|
|
|
|
KeInitializeApc
|
|
|
|
|
KeInitializeDeviceQueue
|
|
|
|
|
KeInitializeDpc
|
|
|
|
|
KeInitializeEvent
|
|
|
|
|
KeInitializeGuardedMutex
|
|
|
|
|
KeInitializeInterrupt
|
|
|
|
|
KeInitializeMutant
|
|
|
|
|
KeInitializeMutex
|
|
|
|
|
KeInitializeQueue
|
|
|
|
|
KeInitializeSemaphore
|
|
|
|
|
KeInitializeSpinLock
|
|
|
|
|
KeInitializeTimer
|
|
|
|
|
KeInitializeTimerEx
|
|
|
|
|
KeInsertByKeyDeviceQueue
|
|
|
|
|
KeInsertDeviceQueue
|
|
|
|
|
KeInsertHeadQueue
|
|
|
|
|
KeInsertQueue
|
|
|
|
|
KeInsertQueueApc
|
|
|
|
|
KeInsertQueueDpc
|
|
|
|
|
KeIsAttachedProcess
|
|
|
|
|
KeIsExecutingDpc
|
|
|
|
|
KeLeaveCriticalRegion=_KeLeaveCriticalRegion
|
|
|
|
|
KeLeaveGuardedRegion=_KeLeaveGuardedRegion
|
|
|
|
|
KeLoaderBlock DATA
|
|
|
|
|
KeNumberProcessors DATA
|
|
|
|
|
KeProfileInterrupt
|
|
|
|
|
KeProfileInterruptWithSource
|
|
|
|
|
KePulseEvent
|
|
|
|
|
KeQueryActiveProcessors
|
|
|
|
|
KeQueryInterruptTime
|
|
|
|
|
KeQueryPriorityThread
|
|
|
|
|
KeQueryRuntimeThread
|
|
|
|
|
KeQuerySystemTime
|
|
|
|
|
KeQueryTickCount
|
|
|
|
|
KeQueryTimeIncrement
|
|
|
|
|
KeRaiseUserException
|
|
|
|
|
KeReadStateEvent
|
|
|
|
|
KeReadStateMutant
|
|
|
|
|
KeReadStateMutex=KeReadStateMutant
|
|
|
|
|
KeReadStateQueue
|
|
|
|
|
KeReadStateSemaphore
|
|
|
|
|
KeReadStateTimer
|
|
|
|
|
KeRegisterBugCheckCallback
|
|
|
|
|
KeRegisterBugCheckReasonCallback
|
|
|
|
|
KeReleaseGuardedMutexUnsafe
|
|
|
|
|
KeReleaseGuardedMutex
|
|
|
|
|
KeReleaseInStackQueuedSpinLockFromDpcLevel
|
|
|
|
|
KeReleaseInterruptSpinLock
|
|
|
|
|
KeReleaseMutant
|
|
|
|
|
KeReleaseMutex
|
|
|
|
|
KeReleaseSemaphore
|
|
|
|
|
KeReleaseSpinLockFromDpcLevel
|
|
|
|
|
KeRemoveByKeyDeviceQueue
|
|
|
|
|
KeRemoveByKeyDeviceQueueIfBusy
|
|
|
|
|
KeRemoveDeviceQueue
|
|
|
|
|
KeRemoveEntryDeviceQueue
|
|
|
|
|
KeRemoveQueue
|
|
|
|
|
KeRemoveQueueDpc
|
|
|
|
|
KeRemoveSystemServiceTable
|
|
|
|
|
KeResetEvent
|
|
|
|
|
KeRevertToUserAffinityThread
|
|
|
|
|
KeRundownQueue
|
|
|
|
|
KeSaveStateForHibernate
|
|
|
|
|
KeServiceDescriptorTable DATA
|
|
|
|
|
KeSetAffinityThread
|
|
|
|
|
KeSetBasePriorityThread
|
|
|
|
|
KeSetDmaIoCoherency
|
|
|
|
|
KeSetEvent
|
|
|
|
|
KeSetEventBoostPriority
|
|
|
|
|
KeSetIdealProcessorThread
|
|
|
|
|
KeSetImportanceDpc
|
|
|
|
|
KeSetKernelStackSwapEnable
|
|
|
|
|
KeSetPriorityThread
|
|
|
|
|
KeSetProfileIrql
|
|
|
|
|
KeSetSystemAffinityThread
|
|
|
|
|
;KeSetSwapContextNotifyRoutine
|
|
|
|
|
KeSetTargetProcessorDpc
|
|
|
|
|
;KeSetThreadSelectNotifyRoutine
|
|
|
|
|
KeSetTimeIncrement
|
|
|
|
|
KeSetTimer
|
|
|
|
|
KeSetTimerEx
|
|
|
|
|
KeStackAttachProcess
|
|
|
|
|
KeSynchronizeExecution
|
|
|
|
|
KeTerminateThread
|
|
|
|
|
KeTickCount DATA
|
|
|
|
|
KeTryToAcquireGuardedMutex
|
|
|
|
|
KeUpdateRunTime
|
|
|
|
|
KeUpdateSystemTime
|
|
|
|
|
KeUnstackDetachProcess
|
|
|
|
|
KeUserModeCallback
|
|
|
|
|
KeWaitForMultipleObjects
|
|
|
|
|
KeWaitForMutexObject=KeWaitForSingleObject
|
|
|
|
|
KeWaitForSingleObject
|
|
|
|
|
KefAcquireSpinLockAtDpcLevel
|
|
|
|
|
KefReleaseSpinLockFromDpcLevel
|
|
|
|
|
KiAcquireSpinLock
|
|
|
|
|
;KiBugCheckData DATA
|
|
|
|
|
KiCheckForKernelApcDelivery
|
|
|
|
|
KiDeliverApc
|
|
|
|
|
KiEnableTimerWatchdog
|
|
|
|
|
KiIpiServiceRoutine
|
|
|
|
|
KiReleaseSpinLock
|
|
|
|
|
KiUnexpectedInterrupt
|
|
|
|
|
;Kii386SpinOnSpinLock
|
|
|
|
|
KiRawTicks DATA
|
|
|
|
|
LdrAccessResource
|
|
|
|
|
LdrEnumResources
|
|
|
|
|
LdrFindResourceDirectory_U
|
|
|
|
|
LdrFindResource_U
|
|
|
|
|
LpcPortObjectType DATA
|
|
|
|
|
LpcRequestPort
|
|
|
|
|
LpcRequestWaitReplyPort
|
|
|
|
|
LsaCallAuthenticationPackage
|
|
|
|
|
LsaDeregisterLogonProcess
|
|
|
|
|
LsaFreeReturnBuffer
|
|
|
|
|
LsaLogonUser
|
|
|
|
|
LsaLookupAuthenticationPackage
|
|
|
|
|
LsaRegisterLogonProcess
|
|
|
|
|
Mm64BitPhysicalAddress DATA
|
|
|
|
|
MmAddPhysicalMemory
|
|
|
|
|
MmAddVerifierThunks
|
|
|
|
|
MmAdjustWorkingSetSize
|
|
|
|
|
MmAdvanceMdl
|
|
|
|
|
MmAllocateContiguousMemory
|
|
|
|
|
MmAllocateContiguousMemorySpecifyCache
|
|
|
|
|
MmAllocateMappingAddress
|
|
|
|
|
MmAllocateNonCachedMemory
|
|
|
|
|
MmAllocatePagesForMdl
|
|
|
|
|
MmBuildMdlForNonPagedPool
|
|
|
|
|
MmCanFileBeTruncated
|
|
|
|
|
MmCreateMdl
|
|
|
|
|
MmCreateSection
|
|
|
|
|
MmDisableModifiedWriteOfSection
|
|
|
|
|
MmFlushImageSection
|
|
|
|
|
MmForceSectionClosed
|
|
|
|
|
MmFreeContiguousMemory
|
|
|
|
|
MmFreeContiguousMemorySpecifyCache
|
|
|
|
|
MmFreeMappingAddress
|
|
|
|
|
MmFreeNonCachedMemory
|
|
|
|
|
MmFreePagesFromMdl
|
|
|
|
|
MmGetPhysicalAddress
|
|
|
|
|
MmGetPhysicalMemoryRanges
|
|
|
|
|
MmGetSystemRoutineAddress
|
|
|
|
|
MmGetVirtualForPhysical
|
|
|
|
|
MmGrowKernelStack
|
|
|
|
|
MmHighestUserAddress DATA
|
|
|
|
|
MmIsAddressValid
|
|
|
|
|
MmIsDriverVerifying
|
|
|
|
|
MmIsNonPagedSystemAddressValid
|
|
|
|
|
MmIsRecursiveIoFault
|
|
|
|
|
MmIsThisAnNtAsSystem
|
|
|
|
|
MmIsVerifierEnabled
|
|
|
|
|
MmLockPagableDataSection
|
|
|
|
|
MmLockPagableImageSection=MmLockPagableDataSection
|
|
|
|
|
MmLockPagableSectionByHandle
|
|
|
|
|
MmMapIoSpace
|
|
|
|
|
MmMapLockedPages
|
|
|
|
|
MmMapLockedPagesSpecifyCache
|
|
|
|
|
MmMapLockedPagesWithReservedMapping
|
|
|
|
|
MmMapMemoryDumpMdl
|
|
|
|
|
MmMapUserAddressesToPage
|
|
|
|
|
MmMapVideoDisplay
|
|
|
|
|
MmMapViewInSessionSpace
|
|
|
|
|
MmMapViewInSystemSpace
|
|
|
|
|
MmMapViewOfSection
|
|
|
|
|
MmMarkPhysicalMemoryAsBad
|
|
|
|
|
MmMarkPhysicalMemoryAsGood
|
|
|
|
|
MmPageEntireDriver
|
|
|
|
|
MmPrefetchPages
|
|
|
|
|
MmProbeAndLockPages
|
|
|
|
|
MmProbeAndLockProcessPages
|
|
|
|
|
MmProbeAndLockSelectedPages
|
|
|
|
|
MmProtectMdlSystemAddress
|
|
|
|
|
MmQuerySystemSize
|
|
|
|
|
MmRemovePhysicalMemory
|
|
|
|
|
MmResetDriverPaging
|
|
|
|
|
MmSectionObjectType DATA
|
|
|
|
|
MmSecureVirtualMemory
|
|
|
|
|
MmSetAddressRangeModified
|
|
|
|
|
MmSetBankedSection
|
|
|
|
|
MmSizeOfMdl
|
|
|
|
|
MmSystemRangeStart DATA
|
|
|
|
|
MmTrimAllSystemPagableMemory
|
|
|
|
|
MmUnlockPagableImageSection
|
|
|
|
|
MmUnlockPages
|
|
|
|
|
MmUnmapIoSpace
|
|
|
|
|
MmUnmapLockedPages
|
|
|
|
|
MmUnmapReservedMapping
|
|
|
|
|
MmUnmapVideoDisplay
|
|
|
|
|
MmUnmapViewInSessionSpace
|
|
|
|
|
MmUnmapViewInSystemSpace
|
|
|
|
|
MmUnmapViewOfSection
|
|
|
|
|
MmUnsecureVirtualMemory
|
|
|
|
|
MmUserProbeAddress DATA
|
|
|
|
|
NlsAnsiCodePage DATA
|
|
|
|
|
NlsLeadByteInfo DATA
|
|
|
|
|
NlsMbCodePageTag DATA
|
|
|
|
|
NlsMbOemCodePageTag DATA
|
|
|
|
|
NlsOemCodePage DATA
|
2008-07-21 01:41:04 +00:00
|
|
|
NlsOemLeadByteInfo=_NlsOemLeadByteInfo
|
2008-02-08 06:07:47 +00:00
|
|
|
NtAddAtom
|
|
|
|
|
NtAdjustPrivilegesToken
|
|
|
|
|
NtAlertThread
|
|
|
|
|
NtAllocateLocallyUniqueId
|
|
|
|
|
NtAllocateUuids
|
|
|
|
|
NtAllocateVirtualMemory
|
|
|
|
|
NtBuildNumber DATA
|
|
|
|
|
NtClose
|
|
|
|
|
NtConnectPort
|
|
|
|
|
NtCreateEvent
|
|
|
|
|
NtCreateTimer
|
|
|
|
|
NtOpenEvent
|
|
|
|
|
NtCreateFile
|
|
|
|
|
NtCreateSection
|
|
|
|
|
NtDeleteAtom
|
|
|
|
|
NtDeleteFile
|
|
|
|
|
NtDeviceIoControlFile
|
|
|
|
|
NtDuplicateObject
|
|
|
|
|
NtDuplicateToken
|
|
|
|
|
NtFindAtom
|
|
|
|
|
NtFreeVirtualMemory
|
|
|
|
|
NtFsControlFile
|
|
|
|
|
NtGlobalFlag DATA
|
|
|
|
|
NtLockFile
|
|
|
|
|
NtMakePermanentObject
|
|
|
|
|
NtMapViewOfSection
|
|
|
|
|
NtNotifyChangeDirectoryFile
|
|
|
|
|
NtOpenFile
|
|
|
|
|
NtOpenProcess
|
|
|
|
|
NtOpenProcessToken
|
|
|
|
|
NtOpenProcessTokenEx
|
|
|
|
|
NtOpenThread
|
|
|
|
|
NtOpenThreadToken
|
|
|
|
|
NtOpenThreadTokenEx
|
|
|
|
|
NtQueryDirectoryFile
|
|
|
|
|
NtQueryEaFile
|
|
|
|
|
NtQueryInformationAtom
|
|
|
|
|
NtQueryInformationFile
|
|
|
|
|
NtQueryInformationProcess
|
|
|
|
|
NtQueryInformationThread
|
|
|
|
|
NtQueryInformationToken
|
|
|
|
|
NtQueryQuotaInformationFile
|
|
|
|
|
NtQuerySecurityObject
|
|
|
|
|
NtQuerySystemInformation
|
|
|
|
|
NtQuerySystemTime
|
|
|
|
|
NtQueryVolumeInformationFile
|
|
|
|
|
NtReadFile
|
|
|
|
|
NtRequestPort
|
|
|
|
|
NtRequestWaitReplyPort
|
|
|
|
|
NtSetEaFile
|
|
|
|
|
NtSetEvent
|
|
|
|
|
NtSetInformationFile
|
|
|
|
|
NtSetInformationProcess
|
|
|
|
|
NtSetInformationThread
|
|
|
|
|
NtSetQuotaInformationFile
|
|
|
|
|
NtSetSecurityObject
|
|
|
|
|
NtSetVolumeInformationFile
|
|
|
|
|
NtSetSystemTime
|
|
|
|
|
NtShutdownSystem
|
|
|
|
|
NtTraceEvent
|
|
|
|
|
NtUnlockFile
|
|
|
|
|
NtVdmControl
|
|
|
|
|
NtW32Call
|
|
|
|
|
NtWaitForSingleObject
|
|
|
|
|
NtWriteFile
|
|
|
|
|
|
|
|
|
|
;
|
|
|
|
|
; Object Manager
|
|
|
|
|
ObAssignSecurity
|
|
|
|
|
ObCheckCreateObjectAccess
|
|
|
|
|
ObCheckObjectAccess
|
|
|
|
|
ObCloseHandle
|
|
|
|
|
ObCreateObject
|
|
|
|
|
ObCreateObjectType
|
|
|
|
|
ObDereferenceObject
|
|
|
|
|
ObDereferenceObjectDeferDelete
|
|
|
|
|
ObDereferenceSecurityDescriptor
|
|
|
|
|
ObfDereferenceObject
|
|
|
|
|
ObFindHandleForObject
|
|
|
|
|
ObfReferenceObject
|
|
|
|
|
ObGetObjectSecurity
|
|
|
|
|
ObInsertObject
|
|
|
|
|
ObIsKernelHandle
|
|
|
|
|
ObLogSecurityDescriptor
|
|
|
|
|
ObMakeTemporaryObject
|
|
|
|
|
ObOpenObjectByName
|
|
|
|
|
ObOpenObjectByPointer
|
|
|
|
|
ObQueryNameString
|
|
|
|
|
ObQueryObjectAuditingByHandle
|
|
|
|
|
ObReferenceObjectByHandle
|
|
|
|
|
ObReferenceObjectByName
|
|
|
|
|
ObReferenceObjectByPointer
|
|
|
|
|
;ObReferenceSecurityDescriptor
|
|
|
|
|
ObReleaseObjectSecurity
|
|
|
|
|
;ObSetHandleAttributes
|
|
|
|
|
;ObSetSecurityDescriptorInfo
|
|
|
|
|
;ObSetSecurityObjectByPointer
|
|
|
|
|
|
|
|
|
|
;
|
|
|
|
|
;
|
|
|
|
|
;
|
|
|
|
|
;PfxFindPrefix
|
|
|
|
|
;PfxInitialize
|
|
|
|
|
;PfxInsertPrefix
|
|
|
|
|
;PfxRemovePrefix
|
|
|
|
|
PoCallDriver
|
|
|
|
|
PoQueueShutdownWorkItem
|
|
|
|
|
PoRegisterDeviceForIdleDetection
|
|
|
|
|
PoRegisterSystemState
|
|
|
|
|
PoRequestPowerIrp
|
|
|
|
|
PoSetDeviceBusy
|
|
|
|
|
PoSetPowerState
|
|
|
|
|
PoSetSystemState
|
|
|
|
|
PoStartNextPowerIrp
|
|
|
|
|
PoUnregisterSystemState
|
|
|
|
|
ProbeForRead
|
|
|
|
|
ProbeForWrite
|
|
|
|
|
PsAssignImpersonationToken
|
|
|
|
|
PsChargePoolQuota
|
|
|
|
|
PsChargeProcessNonPagedPoolQuota=PsDereferenceImpersonationToken
|
|
|
|
|
PsChargeProcessPagedPoolQuota
|
|
|
|
|
PsChargeProcessPoolQuota
|
|
|
|
|
PsCreateSystemProcess
|
|
|
|
|
PsCreateSystemThread
|
|
|
|
|
PsDereferenceImpersonationToken=PsDereferencePrimaryToken
|
|
|
|
|
PsDereferencePrimaryToken
|
|
|
|
|
PsDisableImpersonation
|
|
|
|
|
PsEstablishWin32Callouts
|
|
|
|
|
PsGetContextThread
|
|
|
|
|
PsGetCurrentProcess=IoGetCurrentProcess
|
|
|
|
|
PsGetCurrentProcessId
|
|
|
|
|
PsGetCurrentProcessWin32Process
|
|
|
|
|
PsGetCurrentProcessSessionId
|
|
|
|
|
PsGetCurrentThread=KeGetCurrentThread
|
|
|
|
|
PsGetCurrentThreadId
|
|
|
|
|
PsGetCurrentThreadPreviousMode
|
|
|
|
|
PsGetCurrentThreadWin32Thread
|
|
|
|
|
PsGetCurrentThreadStackBase
|
|
|
|
|
PsGetCurrentThreadStackLimit
|
|
|
|
|
PsGetJobLock
|
|
|
|
|
PsGetJobSessionId
|
|
|
|
|
PsGetJobUIRestrictionsClass
|
|
|
|
|
PsGetProcessCreateTimeQuadPart
|
|
|
|
|
PsGetProcessDebugPort
|
|
|
|
|
PsGetProcessExitProcessCalled
|
|
|
|
|
PsGetProcessExitStatus
|
|
|
|
|
PsGetProcessExitTime
|
|
|
|
|
PsGetProcessId
|
|
|
|
|
PsGetProcessImageFileName
|
|
|
|
|
PsGetProcessInheritedFromUniqueProcessId
|
|
|
|
|
PsGetProcessJob
|
|
|
|
|
PsGetProcessPeb
|
|
|
|
|
PsGetProcessPriorityClass
|
|
|
|
|
PsGetProcessSectionBaseAddress
|
|
|
|
|
PsGetProcessSecurityPort
|
|
|
|
|
PsGetProcessSessionId
|
|
|
|
|
PsGetProcessWin32Process
|
|
|
|
|
PsGetProcessWin32WindowStation
|
|
|
|
|
PsGetThreadFreezeCount
|
|
|
|
|
PsGetThreadHardErrorsAreDisabled
|
|
|
|
|
PsGetThreadId
|
|
|
|
|
PsGetThreadProcess
|
|
|
|
|
PsGetThreadProcessId
|
|
|
|
|
PsGetThreadSessionId
|
|
|
|
|
PsGetThreadTeb
|
|
|
|
|
PsGetThreadWin32Thread
|
|
|
|
|
PsGetVersion
|
|
|
|
|
PsImpersonateClient
|
|
|
|
|
PsInitialSystemProcess DATA
|
|
|
|
|
PsIsProcessBeingDebugged
|
|
|
|
|
PsIsSystemThread
|
|
|
|
|
PsIsThreadImpersonating
|
|
|
|
|
PsIsThreadTerminating
|
|
|
|
|
PsJobType DATA
|
|
|
|
|
PsLookupProcessByProcessId
|
|
|
|
|
PsLookupProcessThreadByCid
|
|
|
|
|
PsLookupThreadByThreadId
|
|
|
|
|
PsProcessType=_PsProcessType
|
|
|
|
|
PsReferenceImpersonationToken
|
|
|
|
|
PsReferencePrimaryToken
|
|
|
|
|
PsRemoveCreateThreadNotifyRoutine
|
|
|
|
|
PsRemoveLoadImageNotifyRoutine
|
|
|
|
|
PsRestoreImpersonation
|
|
|
|
|
PsReturnPoolQuota
|
|
|
|
|
PsReturnProcessNonPagedPoolQuota
|
|
|
|
|
PsReturnProcessPagedPoolQuota
|
|
|
|
|
PsRevertToSelf
|
|
|
|
|
PsRevertThreadToSelf
|
|
|
|
|
PsSetContextThread
|
|
|
|
|
PsSetCreateProcessNotifyRoutine
|
|
|
|
|
PsSetCreateThreadNotifyRoutine
|
|
|
|
|
PsSetJobUIRestrictionsClass
|
|
|
|
|
PsSetLegoNotifyRoutine
|
|
|
|
|
PsSetProcessPriorityClass
|
|
|
|
|
PsSetProcessPriorityByClass
|
|
|
|
|
PsSetProcessSecurityPort
|
|
|
|
|
PsSetProcessWin32Process
|
|
|
|
|
PsSetProcessWindowStation
|
|
|
|
|
PsSetThreadHardErrorsAreDisabled
|
|
|
|
|
PsSetThreadWin32Thread
|
|
|
|
|
PsSetLoadImageNotifyRoutine
|
|
|
|
|
PsTerminateSystemThread
|
|
|
|
|
PsThreadType=_PsThreadType
|
|
|
|
|
READ_REGISTER_UCHAR
|
|
|
|
|
READ_REGISTER_ULONG
|
|
|
|
|
READ_REGISTER_USHORT
|
|
|
|
|
READ_REGISTER_BUFFER_UCHAR
|
|
|
|
|
READ_REGISTER_BUFFER_ULONG
|
|
|
|
|
READ_REGISTER_BUFFER_USHORT
|
|
|
|
|
KeRosDumpStackFrames
|
|
|
|
|
RtlAbsoluteToSelfRelativeSD
|
|
|
|
|
RtlAddAccessAllowedAce
|
|
|
|
|
RtlAddAce
|
|
|
|
|
RtlAddAtomToAtomTable
|
|
|
|
|
RtlAddRange
|
|
|
|
|
;RtlAllocateAndInitializeSid
|
|
|
|
|
RtlAllocateHeap
|
|
|
|
|
RtlAnsiCharToUnicodeChar
|
|
|
|
|
RtlAnsiStringToUnicodeSize=RtlxAnsiStringToUnicodeSize
|
|
|
|
|
RtlAnsiStringToUnicodeString
|
|
|
|
|
RtlAppendAsciizToString
|
|
|
|
|
RtlAppendStringToString
|
|
|
|
|
RtlAppendUnicodeStringToString
|
|
|
|
|
RtlAppendUnicodeToString
|
|
|
|
|
RtlAreAllAccessesGranted
|
|
|
|
|
RtlAreAnyAccessesGranted
|
|
|
|
|
RtlAreBitsClear
|
|
|
|
|
RtlAreBitsSet
|
|
|
|
|
RtlAssert
|
|
|
|
|
RtlCaptureContext
|
|
|
|
|
RtlCaptureStackBackTrace
|
|
|
|
|
RtlCharToInteger
|
|
|
|
|
RtlCheckRegistryKey
|
|
|
|
|
RtlClearAllBits
|
|
|
|
|
RtlClearBit
|
|
|
|
|
RtlClearBits
|
|
|
|
|
RtlCompareMemory
|
|
|
|
|
RtlCompareMemoryUlong
|
|
|
|
|
RtlCompareString
|
|
|
|
|
RtlCompareUnicodeString
|
|
|
|
|
RtlCompressBuffer
|
|
|
|
|
RtlCompressChunks
|
|
|
|
|
RtlConvertLongToLargeInteger
|
|
|
|
|
RtlConvertSidToUnicodeString
|
|
|
|
|
RtlConvertUlongToLargeInteger
|
|
|
|
|
RtlCopyLuid
|
|
|
|
|
RtlCopyRangeList
|
|
|
|
|
RtlCopySid
|
|
|
|
|
RtlCopyString
|
|
|
|
|
RtlCopyUnicodeString
|
|
|
|
|
RtlCreateAcl
|
|
|
|
|
RtlCreateAtomTable
|
|
|
|
|
RtlCreateHeap
|
|
|
|
|
RtlCreateRegistryKey
|
|
|
|
|
RtlCreateSecurityDescriptor
|
|
|
|
|
RtlCreateSystemVolumeInformationFolder
|
|
|
|
|
RtlCreateUnicodeString
|
|
|
|
|
RtlCustomCPToUnicodeN
|
|
|
|
|
RtlDecompressBuffer
|
|
|
|
|
RtlDecompressChunks
|
|
|
|
|
RtlDecompressFragment
|
|
|
|
|
RtlDelete
|
|
|
|
|
RtlDeleteAce
|
|
|
|
|
RtlDeleteAtomFromAtomTable
|
|
|
|
|
RtlDeleteElementGenericTable
|
|
|
|
|
RtlDeleteElementGenericTableAvl
|
|
|
|
|
RtlDeleteNoSplay
|
|
|
|
|
RtlDeleteOwnersRanges
|
|
|
|
|
RtlDeleteRange
|
|
|
|
|
RtlDeleteRegistryValue
|
|
|
|
|
RtlDescribeChunk
|
|
|
|
|
RtlDestroyAtomTable
|
|
|
|
|
RtlDestroyHeap
|
|
|
|
|
RtlDowncaseUnicodeString
|
|
|
|
|
RtlDuplicateUnicodeString
|
|
|
|
|
RtlEmptyAtomTable
|
|
|
|
|
RtlEnlargedIntegerMultiply
|
|
|
|
|
RtlEnlargedUnsignedDivide
|
|
|
|
|
RtlEnlargedUnsignedMultiply
|
|
|
|
|
RtlEnumerateGenericTable
|
|
|
|
|
RtlEnumerateGenericTableAvl
|
|
|
|
|
RtlEnumerateGenericTableLikeADirectory
|
|
|
|
|
RtlEnumerateGenericTableWithoutSplaying
|
|
|
|
|
RtlEnumerateGenericTableWithoutSplayingAvl
|
|
|
|
|
RtlEqualLuid
|
|
|
|
|
RtlEqualSid
|
|
|
|
|
RtlEqualString
|
|
|
|
|
RtlEqualUnicodeString
|
|
|
|
|
RtlExtendedIntegerMultiply
|
|
|
|
|
RtlExtendedLargeIntegerDivide
|
|
|
|
|
RtlExtendedMagicDivide
|
|
|
|
|
RtlFillMemory
|
|
|
|
|
RtlFillMemoryUlong
|
|
|
|
|
RtlFindClearBits
|
|
|
|
|
RtlFindClearBitsAndSet
|
|
|
|
|
RtlFindClearRuns
|
|
|
|
|
RtlFindFirstRunClear
|
|
|
|
|
RtlFindFirstRunSet
|
|
|
|
|
RtlFindLastBackwardRunClear
|
|
|
|
|
RtlFindLeastSignificantBit
|
|
|
|
|
RtlFindLongestRunClear
|
|
|
|
|
RtlFindLongestRunSet
|
|
|
|
|
RtlFindMessage
|
|
|
|
|
RtlFindMostSignificantBit
|
|
|
|
|
RtlFindNextForwardRunClear
|
|
|
|
|
RtlFindRange
|
|
|
|
|
RtlFindSetBits
|
|
|
|
|
RtlFindSetBitsAndClear
|
|
|
|
|
RtlFindUnicodePrefix
|
|
|
|
|
RtlFormatCurrentUserKeyPath
|
|
|
|
|
RtlFreeAnsiString
|
|
|
|
|
RtlFreeHeap
|
|
|
|
|
RtlFreeRangeList
|
|
|
|
|
RtlFreeOemString
|
|
|
|
|
RtlFreeUnicodeString
|
|
|
|
|
RtlGUIDFromString
|
|
|
|
|
RtlGenerate8dot3Name
|
|
|
|
|
RtlGetAce
|
|
|
|
|
RtlGetCallersAddress
|
|
|
|
|
RtlGetCompressionWorkSpaceSize
|
|
|
|
|
RtlGetDaclSecurityDescriptor
|
|
|
|
|
RtlGetDefaultCodePage
|
|
|
|
|
RtlGetElementGenericTable
|
|
|
|
|
RtlGetElementGenericTableAvl
|
|
|
|
|
RtlGetFirstRange
|
|
|
|
|
RtlGetGroupSecurityDescriptor
|
|
|
|
|
RtlGetNextRange
|
|
|
|
|
RtlGetNtGlobalFlags
|
|
|
|
|
RtlGetOwnerSecurityDescriptor
|
|
|
|
|
RtlGetSaclSecurityDescriptor
|
|
|
|
|
RtlGetSetBootStatusData
|
|
|
|
|
RtlGetVersion
|
|
|
|
|
RtlHashUnicodeString
|
|
|
|
|
RtlImageNtHeader
|
|
|
|
|
RtlImageDirectoryEntryToData
|
|
|
|
|
RtlInitAnsiString
|
|
|
|
|
RtlInitCodePageTable
|
|
|
|
|
RtlInitString
|
|
|
|
|
RtlInitUnicodeString
|
|
|
|
|
RtlInitializeBitMap
|
|
|
|
|
RtlInitializeGenericTable
|
|
|
|
|
RtlInitializeGenericTableAvl
|
|
|
|
|
RtlInitializeRangeList
|
|
|
|
|
RtlInitializeSid
|
|
|
|
|
RtlInitializeUnicodePrefix
|
|
|
|
|
RtlInsertElementGenericTable
|
|
|
|
|
RtlInsertElementGenericTableAvl
|
|
|
|
|
RtlInsertElementGenericTableFull
|
|
|
|
|
RtlInsertElementGenericTableFullAvl
|
|
|
|
|
RtlInsertUnicodePrefix
|
|
|
|
|
RtlInt64ToUnicodeString
|
|
|
|
|
RtlIntegerToChar
|
|
|
|
|
RtlIntegerToUnicode
|
|
|
|
|
RtlIntegerToUnicodeString
|
|
|
|
|
RtlInvertRangeList
|
|
|
|
|
RtlIpv4AddressToStringA
|
|
|
|
|
RtlIpv4AddressToStringExA
|
|
|
|
|
RtlIpv4AddressToStringExW
|
|
|
|
|
RtlIpv4AddressToStringW
|
|
|
|
|
RtlIpv4StringToAddressA
|
|
|
|
|
RtlIpv4StringToAddressExA
|
|
|
|
|
RtlIpv4StringToAddressExW
|
|
|
|
|
RtlIpv4StringToAddressW
|
|
|
|
|
RtlIpv6AddressToStringA
|
|
|
|
|
RtlIpv6AddressToStringExA
|
|
|
|
|
RtlIpv6AddressToStringExW
|
|
|
|
|
RtlIpv6AddressToStringW
|
|
|
|
|
RtlIpv6StringToAddressA
|
|
|
|
|
RtlIpv6StringToAddressExA
|
|
|
|
|
RtlIpv6StringToAddressExW
|
|
|
|
|
RtlIpv6StringToAddressW
|
|
|
|
|
RtlIsGenericTableEmpty
|
|
|
|
|
RtlIsGenericTableEmptyAvl
|
|
|
|
|
RtlIsNameLegalDOS8Dot3
|
|
|
|
|
RtlIsRangeAvailable
|
|
|
|
|
RtlIsValidOemCharacter
|
|
|
|
|
RtlLargeIntegerAdd
|
|
|
|
|
RtlLargeIntegerArithmeticShift
|
|
|
|
|
RtlLargeIntegerDivide
|
|
|
|
|
RtlLargeIntegerNegate
|
|
|
|
|
RtlLargeIntegerShiftLeft
|
|
|
|
|
RtlLargeIntegerShiftRight
|
|
|
|
|
RtlLargeIntegerSubtract
|
|
|
|
|
RtlLengthRequiredSid
|
|
|
|
|
RtlLengthSecurityDescriptor
|
|
|
|
|
RtlLengthSid
|
|
|
|
|
RtlLockBootStatusData
|
|
|
|
|
RtlLookupAtomInAtomTable
|
|
|
|
|
RtlLookupElementGenericTable
|
|
|
|
|
RtlLookupElementGenericTableAvl
|
|
|
|
|
RtlLookupElementGenericTableFull
|
|
|
|
|
RtlLookupElementGenericTableFullAvl
|
|
|
|
|
RtlMapGenericMask
|
|
|
|
|
RtlMapSecurityErrorToNtStatus
|
|
|
|
|
RtlMergeRangeLists
|
|
|
|
|
RtlMoveMemory
|
|
|
|
|
RtlMultiByteToUnicodeN
|
|
|
|
|
RtlMultiByteToUnicodeSize
|
|
|
|
|
RtlNextUnicodePrefix
|
|
|
|
|
RtlNtStatusToDosError
|
|
|
|
|
RtlNtStatusToDosErrorNoTeb
|
|
|
|
|
RtlNumberGenericTableElements
|
|
|
|
|
RtlNumberGenericTableElementsAvl
|
|
|
|
|
RtlNumberOfClearBits
|
|
|
|
|
RtlNumberOfSetBits
|
|
|
|
|
RtlOemStringToCountedUnicodeString
|
|
|
|
|
RtlOemStringToUnicodeSize=RtlxOemStringToUnicodeSize
|
|
|
|
|
RtlOemStringToUnicodeString
|
|
|
|
|
RtlOemToUnicodeN
|
|
|
|
|
RtlPinAtomInAtomTable
|
|
|
|
|
RtlPrefetchMemoryNonTemporal
|
|
|
|
|
RtlPrefixString
|
|
|
|
|
RtlPrefixUnicodeString
|
|
|
|
|
RtlQueryAtomInAtomTable
|
|
|
|
|
RtlQueryRegistryValues
|
|
|
|
|
RtlQueryTimeZoneInformation
|
|
|
|
|
RtlRaiseException
|
|
|
|
|
RtlRandom
|
|
|
|
|
RtlRandomEx
|
|
|
|
|
RtlRealPredecessor
|
|
|
|
|
RtlRealSuccessor
|
|
|
|
|
RtlRemoveUnicodePrefix
|
|
|
|
|
RtlReserveChunk
|
|
|
|
|
RtlSecondsSince1970ToTime
|
|
|
|
|
RtlSecondsSince1980ToTime
|
|
|
|
|
RtlSelfRelativeToAbsoluteSD2
|
|
|
|
|
RtlSelfRelativeToAbsoluteSD
|
|
|
|
|
RtlSetAllBits
|
|
|
|
|
RtlSetBit
|
|
|
|
|
RtlSetBits
|
|
|
|
|
RtlSetDaclSecurityDescriptor
|
|
|
|
|
RtlSetGroupSecurityDescriptor
|
|
|
|
|
RtlSetOwnerSecurityDescriptor
|
|
|
|
|
RtlSetSaclSecurityDescriptor
|
|
|
|
|
RtlSetTimeZoneInformation
|
|
|
|
|
RtlSizeHeap
|
|
|
|
|
RtlSplay
|
|
|
|
|
RtlStringFromGUID
|
|
|
|
|
RtlSubAuthorityCountSid
|
|
|
|
|
RtlSubAuthoritySid
|
|
|
|
|
RtlSubtreePredecessor
|
|
|
|
|
RtlSubtreeSuccessor
|
|
|
|
|
RtlTestBit
|
|
|
|
|
RtlTimeFieldsToTime
|
|
|
|
|
RtlTimeToElapsedTimeFields
|
|
|
|
|
RtlTimeToSecondsSince1970
|
|
|
|
|
RtlTimeToSecondsSince1980
|
|
|
|
|
RtlTimeToTimeFields
|
|
|
|
|
RtlUlongByteSwap
|
|
|
|
|
RtlUlonglongByteSwap
|
|
|
|
|
RtlUnicodeStringToAnsiSize=RtlxUnicodeStringToAnsiSize
|
|
|
|
|
RtlUnicodeStringToAnsiString
|
|
|
|
|
RtlUnicodeStringToCountedOemString
|
|
|
|
|
RtlUnicodeStringToInteger
|
|
|
|
|
RtlUnicodeStringToOemSize=RtlxUnicodeStringToOemSize
|
|
|
|
|
RtlUnicodeStringToOemString
|
|
|
|
|
RtlUnicodeToCustomCPN
|
|
|
|
|
RtlUnicodeToMultiByteN
|
|
|
|
|
RtlUnicodeToMultiByteSize
|
|
|
|
|
RtlUnicodeToOemN
|
|
|
|
|
RtlUnlockBootStatusData
|
|
|
|
|
RtlUnwind
|
|
|
|
|
RtlUpcaseUnicodeChar
|
|
|
|
|
RtlUpcaseUnicodeString
|
|
|
|
|
RtlUpcaseUnicodeStringToAnsiString
|
|
|
|
|
RtlUpcaseUnicodeStringToCountedOemString
|
|
|
|
|
RtlUpcaseUnicodeStringToOemString
|
|
|
|
|
RtlUpcaseUnicodeToCustomCPN
|
|
|
|
|
RtlUpcaseUnicodeToMultiByteN
|
|
|
|
|
RtlUpcaseUnicodeToOemN
|
|
|
|
|
RtlUpperChar
|
|
|
|
|
RtlUpperString
|
|
|
|
|
RtlUshortByteSwap
|
|
|
|
|
RtlValidRelativeSecurityDescriptor
|
|
|
|
|
RtlValidSecurityDescriptor
|
|
|
|
|
RtlValidSid
|
|
|
|
|
RtlVerifyVersionInfo
|
|
|
|
|
RtlVolumeDeviceToDosName
|
|
|
|
|
RtlWalkFrameChain
|
|
|
|
|
RtlWriteRegistryValue
|
|
|
|
|
RtlZeroHeap
|
|
|
|
|
RtlZeroMemory
|
|
|
|
|
RtlxAnsiStringToUnicodeSize
|
|
|
|
|
RtlxOemStringToUnicodeSize
|
|
|
|
|
RtlxUnicodeStringToAnsiSize
|
|
|
|
|
RtlxUnicodeStringToOemSize
|
|
|
|
|
SeAccessCheck
|
|
|
|
|
SeAppendPrivileges
|
|
|
|
|
SeAssignSecurity
|
|
|
|
|
SeAssignSecurityEx
|
|
|
|
|
SeAuditHardLinkCreation
|
|
|
|
|
SeAuditingFileEvents
|
|
|
|
|
SeAuditingFileEventsWithContext
|
|
|
|
|
SeAuditingFileOrGlobalEvents
|
|
|
|
|
SeAuditingHardLinkEvents
|
|
|
|
|
SeAuditingHardLinkEventsWithContext
|
|
|
|
|
SeCaptureSecurityDescriptor
|
|
|
|
|
SeCaptureSubjectContext
|
|
|
|
|
SeCloseObjectAuditAlarm
|
|
|
|
|
SeCreateAccessState
|
|
|
|
|
SeCreateClientSecurity
|
|
|
|
|
SeCreateClientSecurityFromSubjectContext
|
|
|
|
|
SeDeassignSecurity
|
|
|
|
|
SeDeleteAccessState
|
|
|
|
|
SeDeleteObjectAuditAlarm
|
|
|
|
|
SeExports DATA
|
|
|
|
|
SeFilterToken
|
|
|
|
|
SeFreePrivileges
|
|
|
|
|
SeImpersonateClient
|
|
|
|
|
SeImpersonateClientEx
|
|
|
|
|
SeLockSubjectContext
|
|
|
|
|
SeMarkLogonSessionForTerminationNotification
|
|
|
|
|
SeOpenObjectAuditAlarm
|
|
|
|
|
SeOpenObjectForDeleteAuditAlarm
|
|
|
|
|
SePrivilegeCheck
|
|
|
|
|
SePrivilegeObjectAuditAlarm
|
|
|
|
|
SePublicDefaultDacl DATA
|
|
|
|
|
SeQueryAuthenticationIdToken
|
|
|
|
|
SeQueryInformationToken
|
|
|
|
|
SeQuerySecurityDescriptorInfo
|
|
|
|
|
SeQuerySessionIdToken
|
|
|
|
|
SeRegisterLogonSessionTerminatedRoutine
|
|
|
|
|
SeReleaseSecurityDescriptor
|
|
|
|
|
SeReleaseSubjectContext
|
|
|
|
|
SeSetAccessStateGenericMapping
|
|
|
|
|
SeSetSecurityDescriptorInfo
|
|
|
|
|
SeSetSecurityDescriptorInfoEx
|
|
|
|
|
SeSinglePrivilegeCheck
|
|
|
|
|
SeSystemDefaultDacl DATA
|
|
|
|
|
SeTokenImpersonationLevel
|
|
|
|
|
SeTokenIsAdmin
|
|
|
|
|
SeTokenIsRestricted
|
|
|
|
|
SeTokenIsWriteRestricted
|
|
|
|
|
SeTokenType
|
|
|
|
|
SeUnlockSubjectContext
|
|
|
|
|
SeUnregisterLogonSessionTerminatedRoutine
|
|
|
|
|
SeValidSecurityDescriptor
|
|
|
|
|
VerSetConditionMask
|
|
|
|
|
WRITE_REGISTER_UCHAR
|
|
|
|
|
WRITE_REGISTER_ULONG
|
|
|
|
|
WRITE_REGISTER_USHORT
|
|
|
|
|
WRITE_REGISTER_BUFFER_UCHAR
|
|
|
|
|
WRITE_REGISTER_BUFFER_ULONG
|
|
|
|
|
WRITE_REGISTER_BUFFER_USHORT
|
|
|
|
|
ZwAccessCheckAndAuditAlarm
|
|
|
|
|
ZwAddBootEntry
|
|
|
|
|
ZwAdjustPrivilegesToken
|
|
|
|
|
ZwAlertThread
|
|
|
|
|
ZwAllocateVirtualMemory
|
|
|
|
|
ZwAssignProcessToJobObject
|
|
|
|
|
ZwCancelIoFile
|
|
|
|
|
ZwCancelTimer
|
|
|
|
|
ZwClearEvent
|
|
|
|
|
ZwClose
|
|
|
|
|
ZwCloseObjectAuditAlarm
|
|
|
|
|
ZwConnectPort
|
|
|
|
|
ZwCreateDirectoryObject
|
|
|
|
|
ZwCreateEvent
|
|
|
|
|
ZwCreateFile
|
|
|
|
|
ZwCreateJobObject
|
|
|
|
|
ZwCreateKey
|
|
|
|
|
ZwCreateSection
|
|
|
|
|
ZwCreateSymbolicLinkObject
|
|
|
|
|
ZwCreateTimer
|
|
|
|
|
ZwDeleteFile
|
|
|
|
|
ZwDeleteKey
|
|
|
|
|
ZwDeleteValueKey
|
|
|
|
|
ZwDeviceIoControlFile
|
|
|
|
|
ZwDisplayString
|
|
|
|
|
ZwDuplicateObject
|
|
|
|
|
ZwDuplicateToken
|
|
|
|
|
ZwEnumerateBootEntries
|
|
|
|
|
ZwEnumerateKey
|
|
|
|
|
ZwEnumerateValueKey
|
|
|
|
|
ZwFlushInstructionCache
|
|
|
|
|
ZwFlushKey
|
|
|
|
|
ZwFlushVirtualMemory
|
|
|
|
|
ZwFreeVirtualMemory
|
|
|
|
|
ZwFsControlFile
|
|
|
|
|
ZwInitiatePowerAction
|
|
|
|
|
ZwIsProcessInJob
|
|
|
|
|
ZwLoadDriver
|
|
|
|
|
ZwLoadKey
|
|
|
|
|
ZwMakeTemporaryObject
|
|
|
|
|
ZwMapViewOfSection
|
|
|
|
|
ZwNotifyChangeKey
|
|
|
|
|
ZwOpenDirectoryObject
|
|
|
|
|
ZwOpenEvent
|
|
|
|
|
ZwOpenFile
|
|
|
|
|
ZwOpenJobObject
|
|
|
|
|
ZwOpenKey
|
|
|
|
|
ZwOpenProcess
|
|
|
|
|
ZwOpenProcessToken
|
|
|
|
|
ZwOpenProcessTokenEx
|
|
|
|
|
ZwOpenSection
|
|
|
|
|
ZwOpenSymbolicLinkObject
|
|
|
|
|
ZwOpenThread
|
|
|
|
|
ZwOpenThreadToken
|
|
|
|
|
ZwOpenThreadTokenEx
|
|
|
|
|
ZwOpenTimer
|
|
|
|
|
ZwPowerInformation
|
|
|
|
|
ZwPulseEvent
|
|
|
|
|
ZwQueryBootEntryOrder
|
|
|
|
|
ZwQueryBootOptions
|
|
|
|
|
ZwQueryDefaultLocale
|
|
|
|
|
ZwQueryDefaultUILanguage
|
|
|
|
|
ZwQueryDirectoryFile
|
|
|
|
|
ZwQueryDirectoryObject
|
|
|
|
|
ZwQueryEaFile
|
|
|
|
|
ZwQueryFullAttributesFile
|
|
|
|
|
ZwQueryInformationAtom
|
|
|
|
|
ZwQueryInformationFile
|
|
|
|
|
ZwQueryInformationJobObject
|
|
|
|
|
ZwQueryInformationProcess
|
|
|
|
|
ZwQueryInformationThread
|
|
|
|
|
ZwQueryInformationToken
|
|
|
|
|
ZwQueryInstallUILanguage
|
|
|
|
|
ZwQueryKey
|
|
|
|
|
ZwQueryObject
|
|
|
|
|
ZwQuerySection
|
|
|
|
|
ZwQuerySecurityObject
|
|
|
|
|
ZwQuerySymbolicLinkObject
|
|
|
|
|
ZwQuerySystemInformation
|
|
|
|
|
ZwQuerySystemTime
|
|
|
|
|
ZwQueryValueKey
|
|
|
|
|
ZwQueryVolumeInformationFile
|
|
|
|
|
ZwReadFile
|
|
|
|
|
ZwReplaceKey
|
|
|
|
|
ZwRequestWaitReplyPort
|
|
|
|
|
ZwResetEvent
|
|
|
|
|
ZwRestoreKey
|
|
|
|
|
ZwSaveKey
|
|
|
|
|
ZwSaveKeyEx
|
|
|
|
|
ZwSetBootEntryOrder
|
|
|
|
|
ZwSetBootOptions
|
|
|
|
|
ZwSetDefaultLocale
|
|
|
|
|
ZwSetDefaultUILanguage
|
|
|
|
|
ZwSetEaFile
|
|
|
|
|
ZwSetEvent
|
|
|
|
|
ZwSetInformationFile
|
|
|
|
|
ZwSetInformationJobObject
|
|
|
|
|
ZwSetInformationObject
|
|
|
|
|
ZwSetInformationProcess
|
|
|
|
|
ZwSetInformationThread
|
|
|
|
|
ZwSetSecurityObject
|
|
|
|
|
ZwSetSystemInformation
|
|
|
|
|
ZwSetSystemTime
|
|
|
|
|
ZwSetTimer
|
|
|
|
|
ZwSetValueKey
|
|
|
|
|
ZwSetVolumeInformationFile
|
|
|
|
|
ZwTerminateJobObject
|
|
|
|
|
ZwTerminateProcess
|
|
|
|
|
ZwTranslateFilePath
|
|
|
|
|
ZwUnloadDriver
|
|
|
|
|
ZwUnloadKey
|
|
|
|
|
ZwUnmapViewOfSection
|
|
|
|
|
ZwWaitForMultipleObjects
|
|
|
|
|
ZwWaitForSingleObject
|
|
|
|
|
ZwWriteFile
|
|
|
|
|
ZwYieldExecution
|
|
|
|
|
_abnormal_termination
|
|
|
|
|
_except_handler2
|
|
|
|
|
_except_handler3
|
|
|
|
|
_global_unwind2
|
|
|
|
|
_itoa
|
|
|
|
|
_itow
|
|
|
|
|
_local_unwind2
|
|
|
|
|
_purecall
|
|
|
|
|
_snprintf
|
|
|
|
|
_snwprintf
|
|
|
|
|
_stricmp
|
|
|
|
|
_strlwr
|
|
|
|
|
_strnicmp
|
|
|
|
|
_strnset
|
|
|
|
|
_strrev
|
|
|
|
|
_strset
|
|
|
|
|
_strupr
|
|
|
|
|
_vsnprintf
|
|
|
|
|
_vsnwprintf
|
|
|
|
|
_wcsicmp
|
|
|
|
|
_wcslwr
|
|
|
|
|
_wcsnicmp
|
|
|
|
|
_wcsnset
|
|
|
|
|
_wcsrev
|
|
|
|
|
_wcsupr
|
|
|
|
|
atoi
|
|
|
|
|
atol
|
|
|
|
|
isdigit
|
|
|
|
|
islower
|
|
|
|
|
isprint
|
|
|
|
|
isspace
|
|
|
|
|
isupper
|
|
|
|
|
isxdigit
|
|
|
|
|
mbstowcs
|
|
|
|
|
mbtowc
|
|
|
|
|
memchr
|
|
|
|
|
memcpy
|
|
|
|
|
memmove
|
|
|
|
|
memset
|
|
|
|
|
qsort
|
|
|
|
|
rand
|
|
|
|
|
sprintf
|
|
|
|
|
srand
|
|
|
|
|
strcat
|
|
|
|
|
strchr
|
|
|
|
|
strcmp
|
|
|
|
|
strcpy
|
|
|
|
|
strlen
|
|
|
|
|
strncat
|
|
|
|
|
strncmp
|
|
|
|
|
strncpy
|
|
|
|
|
strrchr
|
|
|
|
|
strspn
|
|
|
|
|
strstr
|
|
|
|
|
swprintf
|
|
|
|
|
tolower
|
|
|
|
|
toupper
|
|
|
|
|
towlower
|
|
|
|
|
towupper
|
|
|
|
|
vDbgPrintEx
|
|
|
|
|
vDbgPrintExWithPrefix
|
|
|
|
|
vsprintf
|
|
|
|
|
wcscat
|
|
|
|
|
wcschr
|
|
|
|
|
wcscmp
|
|
|
|
|
wcscpy
|
|
|
|
|
wcscspn
|
|
|
|
|
wcslen
|
|
|
|
|
wcsncat
|
|
|
|
|
wcsncmp
|
|
|
|
|
wcsncpy
|
|
|
|
|
wcsrchr
|
|
|
|
|
wcsspn
|
|
|
|
|
wcsstr
|
|
|
|
|
wcstombs
|
|
|
|
|
wctomb
|
