1461 lines
33 KiB
Modula-2
1461 lines
33 KiB
Modula-2
LIBRARY ntoskrnl.exe
|
|
EXPORTS
|
|
;CcCanIWrite
|
|
;CcCopyRead
|
|
;CcCopyWrite
|
|
;CcDeferWrite
|
|
;CcFastCopyRead
|
|
;CcFastCopyWrite
|
|
;CcFastMdlReadWait
|
|
;CcFastReadNotPossible
|
|
;CcFastReadWait
|
|
;CcFlushCache
|
|
;CcGetDirtyPages
|
|
;CcGetFileObjectFromBcb
|
|
;CcGetFileObjectFromSectionPtrs
|
|
;CcGetFlushedValidData
|
|
;CcGetLsnForFileObject
|
|
;CcInitializeCacheMap
|
|
;CcIsThereDirtyData
|
|
;CcMapData
|
|
;CcMdlRead
|
|
;CcMdlReadComplete
|
|
;CcMdlWriteAbort
|
|
;CcMdlWriteComplete
|
|
;CcPinMappedData
|
|
;CcPinRead
|
|
;CcPrepareMdlWrite
|
|
;CcPreparePinWrite
|
|
;CcPurgeCacheSection
|
|
;CcRemapBcb
|
|
;CcRepinBcb
|
|
;CcScheduleReadAhead
|
|
;CcSetAdditionalCacheAttributes
|
|
;CcSetBcbOwnerPointer
|
|
;CcSetDirtyPageThreshold
|
|
;CcSetDirtyPinnedData
|
|
;CcSetFileSizes
|
|
;CcSetLogHandleForFile
|
|
;CcSetReadAheadGranularity
|
|
;CcUninitializeCacheMap
|
|
;CcUnpinData
|
|
;CcUnpinDataForThread
|
|
;CcUnpinRepinnedBcb
|
|
;CcWaitForCurrentLazyWriterActivity
|
|
;CcZeroData
|
|
CmRegisterCallback@12
|
|
CmUnRegisterCallback@4
|
|
DbgBreakPoint@0
|
|
DbgBreakPointWithStatus@4
|
|
;DbgLoadImageSymbols
|
|
DbgPrint
|
|
DbgPrintEx
|
|
DbgPrintReturnControlC
|
|
;DbgPrompt
|
|
DbgQueryDebugFilterState@8
|
|
DbgSetDebugFilterState@12
|
|
@ExAcquireFastMutexUnsafe@4
|
|
ExAcquireResourceExclusiveLite@8
|
|
ExAcquireResourceSharedLite@8
|
|
;ExAcquireRundownProtection
|
|
ExAcquireSharedStarveExclusive@8
|
|
ExAcquireSharedWaitForExclusive@8
|
|
ExAllocateFromPagedLookasideList@4
|
|
ExAllocatePool@8
|
|
ExAllocatePoolWithQuota@8
|
|
ExAllocatePoolWithQuotaTag@12
|
|
ExAllocatePoolWithTag@12
|
|
ExAllocatePoolWithTagPriority@16
|
|
ExConvertExclusiveToSharedLite@4
|
|
ExCreateCallback@16
|
|
ExDeleteNPagedLookasideList@4
|
|
ExDeletePagedLookasideList@4
|
|
ExDeleteResourceLite@4
|
|
;ExDesktopObjectType DATA
|
|
;ExDisableResourceBoostLite
|
|
;ExEnumHandleTable
|
|
;ExEventObjectType DATA
|
|
ExExtendZone@12
|
|
ExFreePool@4
|
|
ExFreePoolWithTag@8
|
|
ExFreeToPagedLookasideList@8
|
|
;ExGetCurrentProcessorCounts
|
|
;ExGetCurrentProcessorCpuUsage
|
|
ExGetExclusiveWaiterCount@4
|
|
ExGetPreviousMode@0
|
|
ExGetSharedWaiterCount@4
|
|
ExInitializeNPagedLookasideList@28
|
|
ExInitializePagedLookasideList@28
|
|
ExInitializeResourceLite@4
|
|
;ExInitializeRundownProtection
|
|
ExInitializeZone@16
|
|
ExInterlockedAddLargeInteger@12
|
|
@ExInterlockedAddLargeStatistic@8
|
|
@ExInterlockedAddUlong@12
|
|
@ExInterlockedCompareExchange64@16
|
|
ExInterlockedDecrementLong@8
|
|
ExInterlockedExchangeUlong@12
|
|
ExInterlockedExtendZone@16
|
|
@ExInterlockedFlushSList@4
|
|
@ExInterlockedIncrementLong@8
|
|
@ExInterlockedInsertHeadList@12
|
|
@ExInterlockedInsertTailList@12
|
|
@ExInterlockedPopEntryList@8
|
|
;ExInterlockedPopEntrySList
|
|
@ExInterlockedPushEntryList@12
|
|
;ExInterlockedPushEntrySList
|
|
@ExInterlockedRemoveHeadList@8
|
|
ExIsProcessorFeaturePresent@4
|
|
ExIsResourceAcquiredExclusiveLite@4
|
|
ExIsResourceAcquiredSharedLite@4
|
|
ExLocalTimeToSystemTime@8
|
|
ExNotifyCallback@12
|
|
;ExQueryPoolBlockSize
|
|
ExQueueWorkItem@8
|
|
ExRaiseAccessViolation@0
|
|
ExRaiseDatatypeMisalignment@0
|
|
;ExRaiseException
|
|
;ExRaiseHardError
|
|
ExRaiseStatus@4
|
|
;ExReInitializeRundownProtection
|
|
ExRegisterCallback@12
|
|
ExReinitializeResourceLite@4
|
|
@ExReleaseFastMutexUnsafe@4
|
|
ExReleaseResourceForThreadLite@8
|
|
@ExReleaseResourceLite@4
|
|
;ExReleaseRundownProtection
|
|
;ExRundownCompleted
|
|
;ExSemaphoreObjectType DATA
|
|
ExSetResourceOwnerPointer@8
|
|
ExSetTimerResolution@8
|
|
;ExSystemExceptionFilter
|
|
ExSystemTimeToLocalTime@8
|
|
ExUnregisterCallback@4
|
|
ExUuidCreate@4
|
|
ExVerifySuite@4
|
|
;ExWaitForRundownProtectionRelease
|
|
;ExWindowStationObjectType DATA
|
|
;ExfInterlockedAddUlong
|
|
;ExfInterlockedCompareExchange64
|
|
;ExfInterlockedInsertHeadList
|
|
;ExfInterlockedInsertTailList
|
|
;ExfInterlockedPopEntryList
|
|
;ExfInterlockedPushEntryList
|
|
;ExfInterlockedRemoveHeadList
|
|
@Exfi386InterlockedDecrementLong@4
|
|
@Exfi386InterlockedExchangeUlong@8
|
|
@Exfi386InterlockedIncrementLong@4
|
|
;Exi386InterlockedDecrementLong
|
|
;Exi386InterlockedExchangeUlong
|
|
;Exi386InterlockedIncrementLong
|
|
;FsRtlAcquireFileExclusive
|
|
;FsRtlAddLargeMcbEntry
|
|
;FsRtlAddMcbEntry
|
|
;FsRtlAddToTunnelCache
|
|
;FsRtlAllocateFileLock
|
|
;FsRtlAllocatePool
|
|
;FsRtlAllocatePoolWithQuota
|
|
;FsRtlAllocatePoolWithQuotaTag
|
|
;FsRtlAllocatePoolWithTag
|
|
;FsRtlAllocateResource
|
|
;FsRtlAreNamesEqual
|
|
;FsRtlBalanceReads
|
|
;FsRtlCheckLockForReadAccess
|
|
;FsRtlCheckLockForWriteAccess
|
|
;FsRtlCheckOplock
|
|
;FsRtlCopyRead
|
|
;FsRtlCopyWrite
|
|
;FsRtlCurrentBatchOplock
|
|
;FsRtlDeleteKeyFromTunnelCache
|
|
;FsRtlDeleteTunnelCache
|
|
;FsRtlDeregisterUncProvider
|
|
;FsRtlDissectDbcs
|
|
;FsRtlDissectName
|
|
;FsRtlDoesDbcsContainWildCards
|
|
;FsRtlDoesNameContainWildCards
|
|
;FsRtlFastCheckLockForRead
|
|
;FsRtlFastCheckLockForWrite
|
|
;FsRtlFastUnlockAll
|
|
;FsRtlFastUnlockAllByKey
|
|
;FsRtlFastUnlockSingle
|
|
;FsRtlFindInTunnelCache
|
|
;FsRtlFreeFileLock
|
|
;FsRtlGetFileSize
|
|
;FsRtlGetNextFileLock
|
|
;FsRtlGetNextLargeMcbEntry
|
|
;FsRtlGetNextMcbEntry
|
|
;FsRtlIncrementCcFastReadNoWait
|
|
;FsRtlIncrementCcFastReadNotPossible
|
|
;FsRtlIncrementCcFastReadResourceMiss
|
|
;FsRtlIncrementCcFastReadWait
|
|
;FsRtlInitializeFileLock
|
|
;FsRtlInitializeLargeMcb
|
|
;FsRtlInitializeMcb
|
|
;FsRtlInitializeOplock
|
|
;FsRtlInitializeTunnelCache
|
|
;FsRtlInsertPerFileObjectContext
|
|
;FsRtlInsertPerStreamContext
|
|
;FsRtlIsDbcsInExpression
|
|
;FsRtlIsFatDbcsLegal
|
|
;FsRtlIsHpfsDbcsLegal
|
|
;FsRtlIsNameInExpression
|
|
;FsRtlIsNtstatusExpected
|
|
;FsRtlIsPagingFile
|
|
FsRtlIsTotalDeviceFailure@4
|
|
;FsRtlLegalAnsiCharacterArray
|
|
;FsRtlLookupLargeMcbEntry
|
|
;FsRtlLookupLastLargeMcbEntry
|
|
;FsRtlLookupLastLargeMcbEntryAndIndex
|
|
;FsRtlLookupLastMcbEntry
|
|
;FsRtlLookupMcbEntry
|
|
;FsRtlLookupPerFileObjectContext
|
|
;FsRtlLookupPerStreamContextInternal
|
|
;FsRtlMdlRead
|
|
;FsRtlMdlReadComplete
|
|
;FsRtlMdlReadCompleteDev
|
|
;FsRtlMdlReadDev
|
|
;FsRtlMdlWriteComplete
|
|
;FsRtlMdlWriteCompleteDev
|
|
;FsRtlNormalizeNtstatus
|
|
;FsRtlNotifyChangeDirectory
|
|
;FsRtlNotifyCleanup
|
|
;FsRtlNotifyFilterChangeDirectory
|
|
;FsRtlNotifyFilterReportChange
|
|
;FsRtlNotifyFullChangeDirectory
|
|
;FsRtlNotifyFullReportChange
|
|
;FsRtlNotifyInitializeSync
|
|
;FsRtlNotifyReportChange
|
|
;FsRtlNotifyUninitializeSync
|
|
;FsRtlNotifyVolumeEvent
|
|
;FsRtlNumberOfRunsInLargeMcb
|
|
;FsRtlNumberOfRunsInMcb
|
|
;FsRtlOplockFsctrl
|
|
;FsRtlOplockIsFastIoPossible
|
|
;FsRtlPostPagingFileStackOverflow
|
|
;FsRtlPostStackOverflow
|
|
;FsRtlPrepareMdlWrite
|
|
;FsRtlPrepareMdlWriteDev
|
|
;FsRtlPrivateLock
|
|
;FsRtlProcessFileLock
|
|
;FsRtlRegisterFileSystemFilterCallbacks
|
|
;FsRtlRegisterUncProvider
|
|
;FsRtlReleaseFile
|
|
;FsRtlRemoveLargeMcbEntry
|
|
;FsRtlRemoveMcbEntry
|
|
;FsRtlRemovePerFileObjectContext
|
|
;FsRtlRemovePerStreamContext
|
|
;FsRtlResetLargeMcb
|
|
;FsRtlSplitLargeMcb
|
|
;FsRtlSyncVolumes
|
|
;FsRtlTeardownPerStreamContexts
|
|
;FsRtlTruncateLargeMcb
|
|
;FsRtlTruncateMcb
|
|
;FsRtlUninitializeFileLock
|
|
;FsRtlUninitializeLargeMcb
|
|
;FsRtlUninitializeMcb
|
|
;FsRtlUninitializeOplock
|
|
;HalDispatchTable DATA
|
|
@HalExamineMBR@16
|
|
;HalPrivateDispatchTable DATA
|
|
;HeadlessDispatch
|
|
;InbvAcquireDisplayOwnership
|
|
;InbvCheckDisplayOwnership
|
|
;InbvDisplayString
|
|
;InbvEnableBootDriver
|
|
;InbvEnableDisplayString
|
|
;InbvInstallDisplayStringFilter
|
|
;InbvIsBootDriverInstalled
|
|
;InbvNotifyDisplayOwnershipLost
|
|
;InbvResetDisplay
|
|
;InbvSetScrollRegion
|
|
;InbvSetTextColor
|
|
;InbvSolidColorFill
|
|
;InitSafeBootMode DATA
|
|
@InterlockedCompareExchange@12
|
|
@InterlockedDecrement@4
|
|
@InterlockedExchange@8
|
|
@InterlockedExchangeAdd@8
|
|
@InterlockedIncrement@4
|
|
@InterlockedPopEntrySList@4
|
|
@InterlockedPushEntrySList@8
|
|
IoAcquireCancelSpinLock@4
|
|
IoAcquireRemoveLockEx@20
|
|
;IoAcquireVpbSpinLock
|
|
;IoAdapterObjectType DATA
|
|
IoAllocateAdapterChannel@20
|
|
IoAllocateController@16
|
|
IoAllocateDriverObjectExtension@16
|
|
IoAllocateErrorLogEntry@8
|
|
IoAllocateIrp@8
|
|
IoAllocateMdl@20
|
|
IoAllocateWorkItem@4
|
|
;IoAssignDriveLetters
|
|
IoAssignResources@24
|
|
IoAttachDevice@12
|
|
IoAttachDeviceByPointer@8
|
|
IoAttachDeviceToDeviceStack@8
|
|
;IoAttachDeviceToDeviceStackSafe
|
|
IoBuildAsynchronousFsdRequest@24
|
|
IoBuildDeviceIoControlRequest@36
|
|
IoBuildPartialMdl@16
|
|
IoBuildSynchronousFsdRequest@28
|
|
;IoCallDriver
|
|
IoCancelFileOpen@8
|
|
IoCancelIrp@4
|
|
;IoCheckDesiredAccess
|
|
;IoCheckEaBufferValidity
|
|
;IoCheckFunctionAccess
|
|
;IoCheckQuerySetFileInformation
|
|
;IoCheckQuerySetVolumeInformation
|
|
;IoCheckQuotaBufferValidity
|
|
IoCheckShareAccess@20
|
|
;IoCompleteRequest
|
|
IoConnectInterrupt@44
|
|
IoCreateController@4
|
|
IoCreateDevice@28
|
|
IoCreateDisk@8
|
|
;IoCreateDriver
|
|
IoCreateFile@56
|
|
;IoCreateFileSpecifyDeviceObjectHint
|
|
IoCreateNotificationEvent@8
|
|
;IoCreateStreamFileObject
|
|
;IoCreateStreamFileObjectEx
|
|
;IoCreateStreamFileObjectLite
|
|
IoCreateSymbolicLink@8
|
|
IoCreateSynchronizationEvent@8
|
|
IoCreateUnprotectedSymbolicLink@8
|
|
IoCsqInitialize@28
|
|
IoCsqInsertIrp@12
|
|
IoCsqRemoveIrp@8
|
|
IoCsqRemoveNextIrp@8
|
|
IoDeleteController@4
|
|
IoDeleteDevice@4
|
|
;IoDeleteDriver
|
|
IoDeleteSymbolicLink@4
|
|
IoDetachDevice@4
|
|
;IoDeviceHandlerObjectSize DATA
|
|
;IoDeviceHandlerObjectType DATA
|
|
;IoDeviceObjectType DATA
|
|
IoDisconnectInterrupt@4
|
|
;IoDriverObjectType DATA
|
|
;IoEnqueueIrp
|
|
;IoEnumerateDeviceObjectList
|
|
;IoFastQueryNetworkAttributes
|
|
;IoFileObjectType DATA
|
|
;IoForwardAndCatchIrp
|
|
IoForwardIrpSynchronously@8
|
|
IoFreeController@4
|
|
IoFreeErrorLogEntry@4
|
|
IoFreeIrp@4
|
|
IoFreeMdl@4
|
|
IoFreeWorkItem@4
|
|
IoGetAttachedDevice@4
|
|
IoGetAttachedDeviceReference@4
|
|
;IoGetBaseFileSystemDeviceObject
|
|
IoGetBootDiskInformation@8
|
|
IoGetConfigurationInformation@0
|
|
IoGetCurrentProcess@0
|
|
;IoGetDeviceAttachmentBaseRef
|
|
IoGetDeviceInterfaceAlias@12
|
|
IoGetDeviceInterfaces@16
|
|
IoGetDeviceObjectPointer@16
|
|
IoGetDeviceProperty@20
|
|
IoGetDeviceToVerify@4
|
|
;IoGetDiskDeviceObject
|
|
IoGetDmaAdapter@12
|
|
IoGetDriverObjectExtension@8
|
|
IoGetFileObjectGenericMapping@0
|
|
IoGetInitialStack@0
|
|
;IoGetLowerDeviceObject
|
|
IoGetRelatedDeviceObject@4
|
|
;IoGetRequestorProcess
|
|
;IoGetRequestorProcessId
|
|
;IoGetRequestorSessionId
|
|
IoGetStackLimits@8
|
|
;IoGetTopLevelIrp
|
|
IoInitializeIrp@12
|
|
IoInitializeRemoveLockEx@20
|
|
IoInitializeTimer@12
|
|
IoInvalidateDeviceRelations@8
|
|
IoInvalidateDeviceState@4
|
|
;IoIsFileOriginRemote
|
|
;IoIsOperationSynchronous
|
|
;IoIsSystemThread
|
|
;IoIsValidNameGraftingBuffer
|
|
IoIsWdmVersionAvailable@8
|
|
IoMakeAssociatedIrp@8
|
|
IoOpenDeviceInterfaceRegistryKey@12
|
|
IoOpenDeviceRegistryKey@16
|
|
;IoPageRead
|
|
;IoPnPDeliverServicePowerNotification
|
|
IoQueryDeviceDescription@32
|
|
;IoQueryFileDosDeviceName
|
|
;IoQueryFileInformation
|
|
;IoQueryVolumeInformation
|
|
;IoQueueThreadIrp
|
|
IoQueueWorkItem@16
|
|
IoRaiseHardError@12
|
|
IoRaiseInformationalHardError@12
|
|
IoReadDiskSignature@12
|
|
;IoReadOperationCount DATA
|
|
@IoReadPartitionTable@16
|
|
IoReadPartitionTableEx@8
|
|
;IoReadTransferCount DATA
|
|
IoRegisterBootDriverReinitialization@12
|
|
IoRegisterDeviceInterface@16
|
|
IoRegisterDriverReinitialization@12
|
|
;IoRegisterFileSystem
|
|
;IoRegisterFsRegistrationChange
|
|
;IoRegisterLastChanceShutdownNotification
|
|
IoRegisterPlugPlayNotification@28
|
|
IoRegisterShutdownNotification@4
|
|
IoReleaseCancelSpinLock@4
|
|
IoReleaseRemoveLockAndWaitEx@12
|
|
IoReleaseRemoveLockEx@12
|
|
;IoReleaseVpbSpinLock
|
|
IoRemoveShareAccess@8
|
|
IoReportDetectedDevice@32
|
|
;IoReportHalResourceUsage
|
|
IoReportResourceForDetection@28
|
|
IoReportResourceUsage@36
|
|
IoReportTargetDeviceChange@8
|
|
IoReportTargetDeviceChangeAsynchronous@16
|
|
IoRequestDeviceEject@4
|
|
IoReuseIrp@8
|
|
IoSetCompletionRoutineEx@28
|
|
IoSetDeviceInterfaceState@8
|
|
;IoSetDeviceToVerify
|
|
;IoSetFileOrigin
|
|
IoSetHardErrorOrVerifyDevice@8
|
|
;IoSetInformation
|
|
;IoSetIoCompletion
|
|
@IoSetPartitionInformation@16
|
|
IoSetPartitionInformationEx@12
|
|
IoSetShareAccess@16
|
|
IoSetStartIoAttributes@12
|
|
IoSetSystemPartition@4
|
|
IoSetThreadHardErrorMode@4
|
|
;IoSetTopLevelIrp
|
|
IoStartNextPacket@8
|
|
IoStartNextPacketByKey@12
|
|
IoStartPacket@16
|
|
IoStartTimer@4
|
|
;IoStatisticsLock DATA
|
|
IoStopTimer@4
|
|
;IoSynchronousInvalidateDeviceRelations
|
|
;IoSynchronousPageWrite
|
|
;IoThreadToProcess
|
|
;IoUnregisterFileSystem
|
|
;IoUnregisterFsRegistrationChange
|
|
IoUnregisterPlugPlayNotification@4
|
|
IoUnregisterShutdownNotification@4
|
|
IoUpdateShareAccess@8
|
|
IoVerifyPartitionTable@8
|
|
;IoVerifyVolume
|
|
IoVolumeDeviceToDosName@8
|
|
IoWMIAllocateInstanceIds@12
|
|
IoWMIDeviceObjectToInstanceName@12
|
|
IoWMIExecuteMethod@24
|
|
IoWMIHandleToInstanceName@12
|
|
IoWMIOpenBlock@12
|
|
IoWMIQueryAllData@12
|
|
IoWMIQueryAllDataMultiple@16
|
|
IoWMIQuerySingleInstance@16
|
|
IoWMIQuerySingleInstanceMultiple@20
|
|
IoWMIRegistrationControl@8
|
|
IoWMISetNotificationCallback@12
|
|
IoWMISetSingleInstance@20
|
|
IoWMISetSingleItem@24
|
|
IoWMISuggestInstanceName@16
|
|
IoWMIWriteEvent@4
|
|
IoWriteErrorLogEntry@4
|
|
;IoWriteOperationCount DATA
|
|
@IoWritePartitionTable@20
|
|
IoWritePartitionTableEx@8
|
|
;IoWriteTransferCount DATA
|
|
@IofCallDriver@8
|
|
@IofCompleteRequest@8
|
|
;KdDebuggerEnabled DATA
|
|
;KdDebuggerNotPresent DATA
|
|
KdDisableDebugger@0
|
|
KdEnableDebugger@0
|
|
;KdEnteredDebugger DATA
|
|
;KdPollBreakIn
|
|
;KdPowerTransition
|
|
;Ke386CallBios
|
|
Ke386IoSetAccessProcess@8
|
|
Ke386QueryIoAccessMap@8
|
|
Ke386SetIoAccessMap@8
|
|
@KeAcquireInStackQueuedSpinLockAtDpcLevel@8
|
|
KeAcquireInterruptSpinLock@4
|
|
;KeAcquireSpinLockAtDpcLevel
|
|
KeAddSystemServiceTable@20
|
|
KeAreApcsDisabled@0
|
|
KeAttachProcess@4
|
|
KeBugCheck@4
|
|
KeBugCheckEx@20
|
|
KeCancelTimer@4
|
|
KeClearEvent@4
|
|
;KeConnectInterrupt
|
|
;KeDcacheFlushCount DATA
|
|
KeDelayExecutionThread@12
|
|
KeDeregisterBugCheckCallback@4
|
|
KeDetachProcess@0
|
|
;KeDisconnectInterrupt
|
|
KeEnterCriticalRegion@0
|
|
;KeEnterKernelDebugger
|
|
;KeFindConfigurationEntry
|
|
;KeFindConfigurationNextEntry
|
|
;KeFlushEntireTb
|
|
KeGetCurrentThread@0
|
|
KeGetPreviousMode@0
|
|
KeGetRecommendedSharedDataAlignment@0
|
|
;KeI386AbiosCall
|
|
;KeI386AllocateGdtSelectors
|
|
;KeI386Call16BitCStyleFunction
|
|
;KeI386Call16BitFunction
|
|
;KeI386FlatToGdtSelector
|
|
;KeI386GetLid
|
|
;KeI386MachineType DATA
|
|
;KeI386ReleaseGdtSelectors
|
|
;KeI386ReleaseLid
|
|
;KeI386SetGdtSelector
|
|
;KeIcacheFlushCount DATA
|
|
KeInitializeApc@32
|
|
KeInitializeDeviceQueue@4
|
|
KeInitializeDpc@12
|
|
KeInitializeEvent@12
|
|
;KeInitializeInterrupt
|
|
;KeInitializeMutant
|
|
KeInitializeMutex@8
|
|
;KeInitializeQueue
|
|
KeInitializeSemaphore@12
|
|
KeInitializeSpinLock@4
|
|
KeInitializeTimer@4
|
|
KeInitializeTimerEx@8
|
|
KeInsertByKeyDeviceQueue@12
|
|
KeInsertDeviceQueue@8
|
|
;KeInsertHeadQueue
|
|
;KeInsertQueue
|
|
;KeInsertQueueApc
|
|
KeInsertQueueDpc@12
|
|
;KeIsAttachedProcess
|
|
;KeIsExecutingDpc
|
|
KeLeaveCriticalRegion@0
|
|
;KeLoaderBlock DATA
|
|
;KeNumberProcessors DATA
|
|
;KeProfileInterrupt
|
|
;KeProfileInterruptWithSource
|
|
KePulseEvent@12
|
|
;KeQueryActiveProcessors
|
|
KeQueryInterruptTime@0
|
|
KeQueryPriorityThread@4
|
|
;KeQueryRuntimeThread
|
|
KeQuerySystemTime@4
|
|
KeQueryTickCount@4
|
|
KeQueryTimeIncrement@0
|
|
;KeRaiseUserException
|
|
KeReadStateEvent@4
|
|
;KeReadStateMutant
|
|
KeReadStateMutex@4
|
|
;KeReadStateQueue
|
|
KeReadStateSemaphore@4
|
|
KeReadStateTimer@4
|
|
KeRegisterBugCheckCallback@20
|
|
KeReleaseInStackQueuedSpinLockFromDpcLevel@4
|
|
KeReleaseInterruptSpinLock@8
|
|
;KeReleaseMutant
|
|
KeReleaseMutex@8
|
|
KeReleaseSemaphore@16
|
|
;KeReleaseSpinLockFromDpcLevel
|
|
KeRemoveByKeyDeviceQueue@8
|
|
;KeRemoveByKeyDeviceQueueIfBusy
|
|
KeRemoveDeviceQueue@4
|
|
KeRemoveEntryDeviceQueue@8
|
|
;KeRemoveQueue
|
|
KeRemoveQueueDpc@4
|
|
;KeRemoveSystemServiceTable
|
|
KeResetEvent@4
|
|
KeRestoreFloatingPointState@4
|
|
;KeRevertToUserAffinityThread
|
|
;KeRundownQueue
|
|
KeSaveFloatingPointState@4
|
|
;KeSaveStateForHibernate
|
|
;KeServiceDescriptorTable DATA
|
|
;KeSetAffinityThread
|
|
KeSetBasePriorityThread@8
|
|
;KeSetDmaIoCoherency
|
|
KeSetEvent@12
|
|
;KeSetEventBoostPriority
|
|
;KeSetIdealProcessorThread
|
|
KeSetImportanceDpc@8
|
|
;KeSetKernelStackSwapEnable
|
|
KeSetPriorityThread@8
|
|
;KeSetProfileIrql
|
|
;KeSetSystemAffinityThread
|
|
KeSetTargetProcessorDpc@8
|
|
;KeSetTimeIncrement
|
|
@KeSetTimeUpdateNotifyRoutine@4
|
|
KeSetTimer@16
|
|
KeSetTimerEx@20
|
|
;KeStackAttachProcess
|
|
KeSynchronizeExecution@12
|
|
;KeTerminateThread
|
|
;KeTickCount DATA
|
|
;KeUnstackDetachProcess
|
|
;KeUpdateRunTime
|
|
;KeUpdateSystemTime
|
|
;KeUserModeCallback
|
|
KeWaitForMultipleObjects@32
|
|
KeWaitForMutexObject@20
|
|
KeWaitForSingleObject@20
|
|
@KefAcquireSpinLockAtDpcLevel@4
|
|
@KefReleaseSpinLockFromDpcLevel@4
|
|
;Kei386EoiHelper
|
|
;KiAcquireSpinLock
|
|
;KiBugCheckData DATA
|
|
;KiCoprocessorError
|
|
;KiDeliverApc
|
|
;KiDispatchInterrupt
|
|
;KiEnableTimerWatchdog DATA
|
|
;KiIpiServiceRoutine
|
|
;KiReleaseSpinLock
|
|
;KiUnexpectedInterrupt
|
|
;Kii386SpinOnSpinLock
|
|
;LdrAccessResource
|
|
;LdrEnumResources
|
|
;LdrFindResourceDirectory_U
|
|
;LdrFindResource_U
|
|
;LpcPortObjectType DATA
|
|
;LpcRequestPort
|
|
;LpcRequestWaitReplyPort
|
|
;LsaCallAuthenticationPackage
|
|
;LsaDeregisterLogonProcess
|
|
;LsaFreeReturnBuffer
|
|
;LsaLogonUser
|
|
;LsaLookupAuthenticationPackage
|
|
;LsaRegisterLogonProcess
|
|
;Mm64BitPhysicalAddress DATA
|
|
;MmAddPhysicalMemory
|
|
;MmAddVerifierThunks
|
|
;MmAdjustWorkingSetSize
|
|
MmAdvanceMdl@8
|
|
MmAllocateContiguousMemory@8
|
|
MmAllocateContiguousMemorySpecifyCache@20
|
|
MmAllocateMappingAddress@8
|
|
MmAllocateNonCachedMemory@4
|
|
MmAllocatePagesForMdl@28
|
|
MmBuildMdlForNonPagedPool@4
|
|
;MmCanFileBeTruncated
|
|
MmCreateMdl@12
|
|
MmCreateSection@32
|
|
;MmDisableModifiedWriteOfSection
|
|
MmFlushImageSection@8
|
|
;MmForceSectionClosed
|
|
MmFreeContiguousMemory@4
|
|
MmFreeContiguousMemorySpecifyCache@12
|
|
MmFreeMappingAddress@8
|
|
MmFreeNonCachedMemory@8
|
|
MmFreePagesFromMdl@4
|
|
MmGetPhysicalAddress@4
|
|
MmGetPhysicalMemoryRanges@0
|
|
MmGetSystemRoutineAddress@4
|
|
MmGetVirtualForPhysical@4
|
|
;MmGrowKernelStack
|
|
;MmHighestUserAddress DATA
|
|
MmIsAddressValid@4
|
|
MmIsDriverVerifying@4
|
|
MmIsNonPagedSystemAddressValid@4
|
|
;MmIsRecursiveIoFault
|
|
MmIsThisAnNtAsSystem@0
|
|
MmIsVerifierEnabled@4
|
|
MmLockPagableDataSection@4
|
|
MmLockPagableImageSection@4
|
|
MmLockPagableSectionByHandle@4
|
|
MmMapIoSpace@16
|
|
MmMapLockedPages@8
|
|
MmMapLockedPagesSpecifyCache@24
|
|
MmMapLockedPagesWithReservedMapping@16
|
|
;MmMapMemoryDumpMdl
|
|
MmMapUserAddressesToPage@12
|
|
MmMapVideoDisplay@12
|
|
MmMapViewInSessionSpace@12
|
|
MmMapViewInSystemSpace@12
|
|
;MmMapViewOfSection
|
|
MmMarkPhysicalMemoryAsBad@8
|
|
MmMarkPhysicalMemoryAsGood@8
|
|
MmPageEntireDriver@4
|
|
;MmPrefetchPages
|
|
MmProbeAndLockPages@12
|
|
MmProbeAndLockProcessPages@16
|
|
;MmProbeAndLockSelectedPages
|
|
MmProtectMdlSystemAddress@8
|
|
MmQuerySystemSize@0
|
|
MmRemovePhysicalMemory@8
|
|
MmResetDriverPaging@4
|
|
;MmSectionObjectType DATA
|
|
MmSecureVirtualMemory@12
|
|
;MmSetAddressRangeModified
|
|
;MmSetBankedSection
|
|
MmSizeOfMdl@8
|
|
;MmSystemRangeStart DATA
|
|
;MmTrimAllSystemPagableMemory
|
|
MmUnlockPagableImageSection@4
|
|
MmUnlockPages@4
|
|
MmUnmapIoSpace@8
|
|
MmUnmapLockedPages@8
|
|
MmUnmapReservedMapping@12
|
|
MmUnmapVideoDisplay@8
|
|
MmUnmapViewInSessionSpace@4
|
|
MmUnmapViewInSystemSpace@4
|
|
;MmUnmapViewOfSection
|
|
MmUnsecureVirtualMemory@4
|
|
;MmUserProbeAddress DATA
|
|
;NlsAnsiCodePage DATA
|
|
;NlsLeadByteInfo
|
|
;NlsMbCodePageTag DATA
|
|
;NlsMbOemCodePageTag DATA
|
|
;NlsOemCodePage DATA
|
|
;NlsOemLeadByteInfo
|
|
NtAddAtom@12
|
|
NtAdjustPrivilegesToken@24
|
|
NtAllocateLocallyUniqueId@4
|
|
NtAllocateUuids@16
|
|
NtAllocateVirtualMemory@24
|
|
;NtBuildNumber DATA
|
|
NtClose@4
|
|
NtConnectPort@32
|
|
NtCreateEvent@20
|
|
;NtCreateFile
|
|
NtCreateSection@28
|
|
NtDeleteAtom@4
|
|
NtDeleteFile@4
|
|
NtDeviceIoControlFile@40
|
|
NtDuplicateObject@28
|
|
NtDuplicateToken@24
|
|
NtFindAtom@12
|
|
NtFreeVirtualMemory@16
|
|
;NtFsControlFile
|
|
;NtGlobalFlag DATA
|
|
;NtLockFile
|
|
;NtMakePermanentObject
|
|
NtMapViewOfSection@40
|
|
;NtNotifyChangeDirectoryFile
|
|
NtOpenFile@24
|
|
NtOpenProcess@16
|
|
NtOpenProcessToken@12
|
|
;NtOpenProcessTokenEx
|
|
NtOpenThread@16
|
|
NtOpenThreadToken@16
|
|
;NtOpenThreadTokenEx
|
|
;NtQueryDirectoryFile
|
|
;NtQueryEaFile
|
|
NtQueryInformationAtom@20
|
|
;NtQueryInformationFile
|
|
NtQueryInformationProcess@20
|
|
NtQueryInformationThread@20
|
|
NtQueryInformationToken@20
|
|
;NtQueryQuotaInformationFile
|
|
NtQuerySecurityObject@20
|
|
NtQuerySystemInformation@16
|
|
;NtQueryVolumeInformationFile
|
|
NtReadFile@36
|
|
NtRequestPort@8
|
|
NtRequestWaitReplyPort@12
|
|
;NtSetEaFile
|
|
NtSetEvent@8
|
|
;NtSetInformationFile
|
|
NtSetInformationProcess@16
|
|
NtSetInformationThread@16
|
|
;NtSetQuotaInformationFile
|
|
NtSetSecurityObject@12
|
|
;NtSetVolumeInformationFile
|
|
NtShutdownSystem@4
|
|
;NtTraceEvent
|
|
;NtUnlockFile
|
|
NtVdmControl@8
|
|
NtWaitForSingleObject@12
|
|
NtWriteFile@36
|
|
ObAssignSecurity@16
|
|
;ObCheckCreateObjectAccess
|
|
;ObCheckObjectAccess
|
|
;ObCloseHandle
|
|
ObCreateObject@36
|
|
;ObCreateObjectType
|
|
;ObDereferenceObject
|
|
ObDereferenceSecurityDescriptor@8
|
|
;ObFindHandleForObject
|
|
ObGetObjectSecurity@12
|
|
ObInsertObject@24
|
|
ObLogSecurityDescriptor@12
|
|
ObMakeTemporaryObject@4
|
|
ObOpenObjectByName@28
|
|
ObOpenObjectByPointer@28
|
|
;ObQueryNameString
|
|
ObQueryObjectAuditingByHandle@8
|
|
ObReferenceObjectByHandle@24
|
|
ObReferenceObjectByName@32
|
|
ObReferenceObjectByPointer@16
|
|
ObReferenceSecurityDescriptor@8
|
|
ObReleaseObjectSecurity@8
|
|
;ObSetHandleAttributes
|
|
;ObSetSecurityDescriptorInfo
|
|
;ObSetSecurityObjectByPointer
|
|
@ObfDereferenceObject@4
|
|
@ObfReferenceObject@4
|
|
;PfxFindPrefix
|
|
;PfxInitialize
|
|
;PfxInsertPrefix
|
|
;PfxRemovePrefix
|
|
PoCallDriver@8
|
|
;PoCancelDeviceNotify
|
|
;PoQueueShutdownWorkItem
|
|
PoRegisterDeviceForIdleDetection@16
|
|
;PoRegisterDeviceNotify
|
|
PoRegisterSystemState@8
|
|
PoRequestPowerIrp@24
|
|
PoRequestShutdownEvent@4
|
|
;PoSetHiberRange
|
|
PoSetPowerState@12
|
|
PoSetSystemState@4
|
|
;PoShutdownBugCheck
|
|
PoStartNextPowerIrp@4
|
|
PoUnregisterSystemState@4
|
|
ProbeForRead@12
|
|
ProbeForWrite@12
|
|
;PsAssignImpersonationToken
|
|
;PsChargePoolQuota
|
|
;PsChargeProcessNonPagedPoolQuota
|
|
;PsChargeProcessPagedPoolQuota
|
|
;PsChargeProcessPoolQuota
|
|
PsCreateSystemProcess@12
|
|
PsCreateSystemThread@28
|
|
;PsDereferenceImpersonationToken
|
|
;PsDereferencePrimaryToken
|
|
;PsDisableImpersonation
|
|
;PsEstablishWin32Callouts
|
|
;PsGetCurrentProcess
|
|
PsGetCurrentProcessId@0
|
|
;PsGetCurrentProcessSessionId
|
|
;PsGetCurrentThread
|
|
PsGetCurrentThreadId@0
|
|
;PsGetCurrentThreadPreviousMode
|
|
;PsGetCurrentThreadStackBase
|
|
;PsGetCurrentThreadStackLimit
|
|
;PsGetJobLock
|
|
;PsGetJobSessionId
|
|
;PsGetJobUIRestrictionsClass
|
|
;PsGetProcessCreateTimeQuadPart
|
|
;PsGetProcessDebugPort
|
|
;PsGetProcessExitProcessCalled
|
|
;PsGetProcessExitStatus
|
|
;PsGetProcessExitTime
|
|
;PsGetProcessId
|
|
;PsGetProcessImageFileName
|
|
;PsGetProcessInheritedFromUniqueProcessId
|
|
;PsGetProcessJob
|
|
;PsGetProcessPeb
|
|
;PsGetProcessPriorityClass
|
|
;PsGetProcessSectionBaseAddress
|
|
;PsGetProcessSecurityPort
|
|
;PsGetProcessSessionId
|
|
;PsGetProcessWin32Process
|
|
;PsGetProcessWin32WindowStation
|
|
;PsGetThreadFreezeCount
|
|
;PsGetThreadHardErrorsAreDisabled
|
|
;PsGetThreadId
|
|
;PsGetThreadProcess
|
|
;PsGetThreadProcessId
|
|
;PsGetThreadSessionId
|
|
;PsGetThreadTeb
|
|
;PsGetThreadWin32Thread
|
|
PsGetVersion@16
|
|
;PsImpersonateClient
|
|
;PsInitialSystemProcess DATA
|
|
;PsIsProcessBeingDebugged
|
|
;PsIsSystemThread
|
|
;PsIsThreadImpersonating
|
|
;PsIsThreadTerminating
|
|
;PsJobType DATA
|
|
;PsLookupProcessByProcessId
|
|
;PsLookupProcessThreadByCid
|
|
;PsLookupThreadByThreadId
|
|
;PsProcessType DATA
|
|
;PsReferenceImpersonationToken
|
|
;PsReferencePrimaryToken
|
|
PsRemoveCreateThreadNotifyRoutine@4
|
|
PsRemoveLoadImageNotifyRoutine@4
|
|
;PsRestoreImpersonation
|
|
;PsReturnPoolQuota
|
|
;PsReturnProcessNonPagedPoolQuota
|
|
;PsReturnProcessPagedPoolQuota
|
|
;PsRevertThreadToSelf
|
|
;PsRevertToSelf
|
|
PsSetCreateProcessNotifyRoutine@8
|
|
PsSetCreateThreadNotifyRoutine@4
|
|
;PsSetJobUIRestrictionsClass
|
|
;PsSetLegoNotifyRoutine
|
|
PsSetLoadImageNotifyRoutine@4
|
|
;PsSetProcessPriorityByClass
|
|
;PsSetProcessPriorityClass
|
|
;PsSetProcessSecurityPort
|
|
;PsSetProcessWin32Process
|
|
;PsSetProcessWindowStation
|
|
;PsSetThreadHardErrorsAreDisabled
|
|
;PsSetThreadWin32Thread
|
|
PsTerminateSystemThread@4
|
|
;PsThreadType DATA
|
|
READ_REGISTER_BUFFER_UCHAR@12
|
|
READ_REGISTER_BUFFER_ULONG@12
|
|
READ_REGISTER_BUFFER_USHORT@12
|
|
READ_REGISTER_UCHAR@4
|
|
READ_REGISTER_ULONG@4
|
|
READ_REGISTER_USHORT@4
|
|
;RtlAbsoluteToSelfRelativeSD
|
|
;RtlAddAccessAllowedAce
|
|
;RtlAddAce
|
|
;RtlAddAtomToAtomTable
|
|
RtlAddRange@28
|
|
;RtlAllocateHeap
|
|
;RtlAnsiCharToUnicodeChar
|
|
RtlAnsiStringToUnicodeSize@4
|
|
RtlAnsiStringToUnicodeString@12
|
|
;RtlAppendAsciizToString
|
|
;RtlAppendStringToString
|
|
RtlAppendUnicodeStringToString@8
|
|
RtlAppendUnicodeToString@8
|
|
;RtlAreAllAccessesGranted
|
|
;RtlAreAnyAccessesGranted
|
|
RtlAreBitsClear@12
|
|
RtlAreBitsSet@12
|
|
RtlAssert@16
|
|
;RtlCaptureContext
|
|
;RtlCaptureStackBackTrace
|
|
RtlCharToInteger@12
|
|
RtlCheckRegistryKey@8
|
|
RtlClearAllBits@4
|
|
RtlClearBit@8
|
|
RtlClearBits@12
|
|
RtlCompareMemory@12
|
|
;RtlCompareMemoryUlong
|
|
RtlCompareString@12
|
|
RtlCompareUnicodeString@12
|
|
;RtlCompressBuffer
|
|
;RtlCompressChunks
|
|
RtlConvertLongToLargeInteger@4
|
|
;RtlConvertSidToUnicodeString
|
|
RtlConvertUlongToLargeInteger@4
|
|
;RtlCopyLuid
|
|
RtlCopyRangeList@8
|
|
;RtlCopySid
|
|
RtlCopyString@8
|
|
RtlCopyUnicodeString@8
|
|
;RtlCreateAcl
|
|
;RtlCreateAtomTable
|
|
;RtlCreateHeap
|
|
RtlCreateRegistryKey@8
|
|
RtlCreateSecurityDescriptor@8
|
|
;RtlCreateSystemVolumeInformationFolder
|
|
;RtlCreateUnicodeString
|
|
;RtlCustomCPToUnicodeN
|
|
;RtlDecompressBuffer
|
|
;RtlDecompressChunks
|
|
;RtlDecompressFragment
|
|
;RtlDelete
|
|
;RtlDeleteAce
|
|
;RtlDeleteAtomFromAtomTable
|
|
;RtlDeleteElementGenericTable
|
|
;RtlDeleteElementGenericTableAvl
|
|
;RtlDeleteNoSplay
|
|
RtlDeleteOwnersRanges@8
|
|
RtlDeleteRange@16
|
|
RtlDeleteRegistryValue@12
|
|
;RtlDescribeChunk
|
|
;RtlDestroyAtomTable
|
|
;RtlDestroyHeap
|
|
;RtlDowncaseUnicodeString
|
|
;RtlEmptyAtomTable
|
|
RtlEnlargedIntegerMultiply@8
|
|
RtlEnlargedUnsignedDivide@12
|
|
RtlEnlargedUnsignedMultiply@8
|
|
;RtlEnumerateGenericTable
|
|
;RtlEnumerateGenericTableAvl
|
|
;RtlEnumerateGenericTableLikeADirectory
|
|
;RtlEnumerateGenericTableWithoutSplaying
|
|
;RtlEnumerateGenericTableWithoutSplayingAvl
|
|
;RtlEqualLuid
|
|
;RtlEqualSid
|
|
RtlEqualString@12
|
|
RtlEqualUnicodeString@12
|
|
RtlExtendedIntegerMultiply@8
|
|
RtlExtendedLargeIntegerDivide@12
|
|
RtlExtendedMagicDivide@12
|
|
;RtlFillMemory
|
|
;RtlFillMemoryUlong
|
|
RtlFindClearBits@12
|
|
RtlFindClearBitsAndSet@12
|
|
RtlFindClearRuns@16
|
|
RtlFindFirstRunClear@8
|
|
RtlFindLastBackwardRunClear@12
|
|
RtlFindLeastSignificantBit@4
|
|
RtlFindLongestRunClear@8
|
|
;RtlFindMessage
|
|
RtlFindMostSignificantBit@4
|
|
RtlFindNextForwardRunClear@12
|
|
RtlFindRange@40
|
|
RtlFindSetBits@12
|
|
RtlFindSetBitsAndClear@12
|
|
;RtlFindUnicodePrefix
|
|
;RtlFormatCurrentUserKeyPath
|
|
RtlFreeAnsiString@4
|
|
;RtlFreeHeap
|
|
;RtlFreeOemString
|
|
RtlFreeRangeList@4
|
|
RtlFreeUnicodeString@4
|
|
RtlGUIDFromString@8
|
|
;RtlGenerate8dot3Name
|
|
;RtlGetAce
|
|
RtlGetCallersAddress@8
|
|
;RtlGetCompressionWorkSpaceSize
|
|
;RtlGetDaclSecurityDescriptor
|
|
;RtlGetDefaultCodePage
|
|
;RtlGetElementGenericTable
|
|
;RtlGetElementGenericTableAvl
|
|
RtlGetFirstRange@12
|
|
;RtlGetGroupSecurityDescriptor
|
|
RtlGetNextRange@12
|
|
;RtlGetNtGlobalFlags
|
|
;RtlGetOwnerSecurityDescriptor
|
|
;RtlGetSaclSecurityDescriptor
|
|
;RtlGetSetBootStatusData
|
|
RtlGetVersion@4
|
|
RtlHashUnicodeString@16
|
|
;RtlImageDirectoryEntryToData
|
|
;RtlImageNtHeader
|
|
RtlInitAnsiString@8
|
|
;RtlInitCodePageTable
|
|
RtlInitString@8
|
|
RtlInitUnicodeString@8
|
|
RtlInitializeBitMap@12
|
|
;RtlInitializeGenericTable
|
|
;RtlInitializeGenericTableAvl
|
|
RtlInitializeRangeList@4
|
|
;RtlInitializeSid
|
|
;RtlInitializeUnicodePrefix
|
|
;RtlInsertElementGenericTable
|
|
;RtlInsertElementGenericTableAvl
|
|
;RtlInsertElementGenericTableFull
|
|
;RtlInsertElementGenericTableFullAvl
|
|
;RtlInsertUnicodePrefix
|
|
RtlInt64ToUnicodeString@12
|
|
;RtlIntegerToChar
|
|
;RtlIntegerToUnicode
|
|
RtlIntegerToUnicodeString@12
|
|
RtlInvertRangeList@8
|
|
;RtlIpv4AddressToStringA
|
|
;RtlIpv4AddressToStringW
|
|
;RtlIpv4StringToAddressA
|
|
;RtlIpv4StringToAddressW
|
|
;RtlIpv6AddressToStringA
|
|
;RtlIpv6AddressToStringW
|
|
;RtlIpv6StringToAddressA
|
|
;RtlIpv6StringToAddressW
|
|
;RtlIsGenericTableEmpty
|
|
;RtlIsGenericTableEmptyAvl
|
|
;RtlIsNameLegalDOS8Dot3
|
|
RtlIsRangeAvailable@32
|
|
;RtlIsValidOemCharacter
|
|
RtlLargeIntegerAdd@8
|
|
RtlLargeIntegerArithmeticShift@8
|
|
RtlLargeIntegerDivide@12
|
|
RtlLargeIntegerNegate@4
|
|
RtlLargeIntegerShiftLeft@8
|
|
RtlLargeIntegerShiftRight@8
|
|
RtlLargeIntegerSubtract@8
|
|
;RtlLengthRequiredSid
|
|
RtlLengthSecurityDescriptor@4
|
|
;RtlLengthSid
|
|
;RtlLockBootStatusData
|
|
;RtlLookupAtomInAtomTable
|
|
;RtlLookupElementGenericTable
|
|
;RtlLookupElementGenericTableAvl
|
|
;RtlLookupElementGenericTableFull
|
|
;RtlLookupElementGenericTableFullAvl
|
|
RtlMapGenericMask@8
|
|
;RtlMapSecurityErrorToNtStatus
|
|
RtlMergeRangeLists@16
|
|
;RtlMoveMemory
|
|
;RtlMultiByteToUnicodeN
|
|
;RtlMultiByteToUnicodeSize
|
|
;RtlNextUnicodePrefix
|
|
;RtlNtStatusToDosError
|
|
;RtlNtStatusToDosErrorNoTeb
|
|
;RtlNumberGenericTableElements
|
|
;RtlNumberGenericTableElementsAvl
|
|
RtlNumberOfClearBits@4
|
|
RtlNumberOfSetBits@4
|
|
;RtlOemStringToCountedUnicodeString
|
|
;RtlOemStringToUnicodeSize
|
|
;RtlOemStringToUnicodeString
|
|
;RtlOemToUnicodeN
|
|
;RtlPinAtomInAtomTable
|
|
@RtlPrefetchMemoryNonTemporal@8
|
|
;RtlPrefixString
|
|
RtlPrefixUnicodeString@12
|
|
;RtlQueryAtomInAtomTable
|
|
RtlQueryRegistryValues@20
|
|
;RtlQueryTimeZoneInformation
|
|
;RtlRaiseException
|
|
;RtlRandom
|
|
;RtlRandomEx
|
|
;RtlRealPredecessor
|
|
;RtlRealSuccessor
|
|
;RtlRemoveUnicodePrefix
|
|
;RtlReserveChunk
|
|
;RtlSecondsSince1970ToTime
|
|
;RtlSecondsSince1980ToTime
|
|
;RtlSelfRelativeToAbsoluteSD
|
|
;RtlSelfRelativeToAbsoluteSD2
|
|
RtlSetAllBits@4
|
|
RtlSetBit@8
|
|
RtlSetBits@12
|
|
RtlSetDaclSecurityDescriptor@16
|
|
;RtlSetGroupSecurityDescriptor
|
|
;RtlSetOwnerSecurityDescriptor
|
|
;RtlSetSaclSecurityDescriptor
|
|
;RtlSetTimeZoneInformation
|
|
;RtlSizeHeap
|
|
;RtlSplay
|
|
RtlStringFromGUID@8
|
|
;RtlSubAuthorityCountSid
|
|
;RtlSubAuthoritySid
|
|
;RtlSubtreePredecessor
|
|
;RtlSubtreeSuccessor
|
|
RtlTestBit@8
|
|
RtlTimeFieldsToTime@8
|
|
;RtlTimeToElapsedTimeFields
|
|
;RtlTimeToSecondsSince1970
|
|
;RtlTimeToSecondsSince1980
|
|
RtlTimeToTimeFields@8
|
|
;RtlTraceDatabaseAdd
|
|
;RtlTraceDatabaseCreate
|
|
;RtlTraceDatabaseDestroy
|
|
;RtlTraceDatabaseEnumerate
|
|
;RtlTraceDatabaseFind
|
|
;RtlTraceDatabaseLock
|
|
;RtlTraceDatabaseUnlock
|
|
;RtlTraceDatabaseValidate
|
|
@RtlUlongByteSwap@4
|
|
@RtlUlonglongByteSwap@4
|
|
RtlUnicodeStringToAnsiSize@4
|
|
RtlUnicodeStringToAnsiString@12
|
|
;RtlUnicodeStringToCountedOemString
|
|
RtlUnicodeStringToInteger@12
|
|
;RtlUnicodeStringToOemSize
|
|
;RtlUnicodeStringToOemString
|
|
;RtlUnicodeToCustomCPN
|
|
;RtlUnicodeToMultiByteN
|
|
;RtlUnicodeToMultiByteSize
|
|
;RtlUnicodeToOemN
|
|
;RtlUnlockBootStatusData
|
|
;RtlUnwind
|
|
RtlUpcaseUnicodeChar@4
|
|
RtlUpcaseUnicodeString@12
|
|
;RtlUpcaseUnicodeStringToAnsiString
|
|
;RtlUpcaseUnicodeStringToCountedOemString
|
|
;RtlUpcaseUnicodeStringToOemString
|
|
;RtlUpcaseUnicodeToCustomCPN
|
|
;RtlUpcaseUnicodeToMultiByteN
|
|
;RtlUpcaseUnicodeToOemN
|
|
RtlUpperChar@4
|
|
RtlUpperString@8
|
|
RtlUshortByteSwap@4
|
|
RtlValidRelativeSecurityDescriptor@12
|
|
RtlValidSecurityDescriptor@4
|
|
;RtlValidSid
|
|
RtlVerifyVersionInfo@12
|
|
RtlVolumeDeviceToDosName@8
|
|
RtlWalkFrameChain@12
|
|
RtlWriteRegistryValue@24
|
|
;RtlZeroHeap
|
|
;RtlZeroMemory
|
|
;RtlxAnsiStringToUnicodeSize
|
|
;RtlxOemStringToUnicodeSize
|
|
RtlxUnicodeStringToAnsiSize@4
|
|
;RtlxUnicodeStringToOemSize
|
|
SeAccessCheck@40
|
|
;SeAppendPrivileges
|
|
SeAssignSecurity@28
|
|
SeAssignSecurityEx@36
|
|
;SeAuditHardLinkCreation
|
|
;SeAuditingFileEvents
|
|
;SeAuditingFileOrGlobalEvents
|
|
;SeAuditingHardLinkEvents
|
|
;SeCaptureSecurityDescriptor
|
|
;SeCaptureSubjectContext
|
|
;SeCloseObjectAuditAlarm
|
|
;SeCreateAccessState
|
|
;SeCreateClientSecurity
|
|
;SeCreateClientSecurityFromSubjectContext
|
|
SeDeassignSecurity@4
|
|
;SeDeleteAccessState
|
|
;SeDeleteObjectAuditAlarm
|
|
;SeExports DATA
|
|
;SeFilterToken
|
|
;SeFreePrivileges
|
|
;SeImpersonateClient
|
|
;SeImpersonateClientEx
|
|
;SeLockSubjectContext
|
|
;SeMarkLogonSessionForTerminationNotification
|
|
;SeOpenObjectAuditAlarm
|
|
;SeOpenObjectForDeleteAuditAlarm
|
|
;SePrivilegeCheck
|
|
;SePrivilegeObjectAuditAlarm
|
|
;SePublicDefaultDacl DATA
|
|
;SeQueryAuthenticationIdToken
|
|
;SeQueryInformationToken
|
|
;SeQuerySecurityDescriptorInfo
|
|
;SeQuerySessionIdToken
|
|
;SeRegisterLogonSessionTerminatedRoutine
|
|
;SeReleaseSecurityDescriptor
|
|
;SeReleaseSubjectContext
|
|
;SeSetAccessStateGenericMapping
|
|
;SeSetSecurityDescriptorInfo
|
|
;SeSetSecurityDescriptorInfoEx
|
|
SeSinglePrivilegeCheck@8
|
|
;SeSystemDefaultDacl DATA
|
|
;SeTokenImpersonationLevel
|
|
;SeTokenIsAdmin
|
|
;SeTokenIsRestricted
|
|
;SeTokenObjectType DATA
|
|
;SeTokenType
|
|
;SeUnlockSubjectContext
|
|
;SeUnregisterLogonSessionTerminatedRoutine
|
|
SeValidSecurityDescriptor@8
|
|
VerSetConditionMask@12
|
|
;VfFailDeviceNode
|
|
;VfFailDriver
|
|
;VfFailSystemBIOS
|
|
;VfIsVerificationEnabled
|
|
WRITE_REGISTER_BUFFER_UCHAR@12
|
|
WRITE_REGISTER_BUFFER_ULONG@12
|
|
WRITE_REGISTER_BUFFER_USHORT@12
|
|
WRITE_REGISTER_UCHAR@8
|
|
WRITE_REGISTER_ULONG@8
|
|
WRITE_REGISTER_USHORT@8
|
|
;WmiFlushTrace
|
|
;WmiGetClock
|
|
;WmiQueryTrace
|
|
WmiQueryTraceInformation@20
|
|
;WmiStartTrace
|
|
;WmiStopTrace
|
|
WmiTraceMessage
|
|
;WmiTraceMessageVa
|
|
;WmiUpdateTrace
|
|
;XIPDispatch
|
|
ZwAccessCheckAndAuditAlarm@44
|
|
;ZwAddBootEntry
|
|
ZwAdjustPrivilegesToken@24
|
|
ZwAlertThread@4
|
|
ZwAllocateVirtualMemory@24
|
|
ZwAssignProcessToJobObject@8
|
|
ZwCancelIoFile@8
|
|
ZwCancelTimer@8
|
|
;ZwClearEvent
|
|
ZwClose@4
|
|
ZwCloseObjectAuditAlarm@12
|
|
ZwConnectPort@32
|
|
ZwCreateDirectoryObject@12
|
|
ZwCreateEvent@20
|
|
ZwCreateFile@44
|
|
ZwCreateJobObject@12
|
|
ZwCreateKey@28
|
|
ZwCreateSection@28
|
|
ZwCreateSymbolicLinkObject@16
|
|
ZwCreateTimer@16
|
|
;ZwDeleteBootEntry
|
|
ZwDeleteFile@4
|
|
ZwDeleteKey@4
|
|
ZwDeleteValueKey@8
|
|
ZwDeviceIoControlFile@40
|
|
ZwDisplayString@4
|
|
ZwDuplicateObject@28
|
|
ZwDuplicateToken@24
|
|
;ZwEnumerateBootEntries
|
|
ZwEnumerateKey@24
|
|
ZwEnumerateValueKey@24
|
|
ZwFlushInstructionCache@12
|
|
ZwFlushKey@4
|
|
ZwFlushVirtualMemory@16
|
|
ZwFreeVirtualMemory@16
|
|
;ZwFsControlFile
|
|
ZwInitiatePowerAction@16
|
|
;ZwIsProcessInJob
|
|
ZwLoadDriver@4
|
|
ZwLoadKey@8
|
|
ZwMakeTemporaryObject@4
|
|
ZwMapViewOfSection@40
|
|
ZwNotifyChangeKey@40
|
|
ZwOpenDirectoryObject@12
|
|
;ZwOpenEvent
|
|
ZwOpenFile@24
|
|
ZwOpenJobObject@12
|
|
ZwOpenKey@12
|
|
;ZwOpenProcess
|
|
ZwOpenProcessToken@12
|
|
;ZwOpenProcessTokenEx
|
|
ZwOpenSection@12
|
|
ZwOpenSymbolicLinkObject@12
|
|
ZwOpenThread@16
|
|
ZwOpenThreadToken@16
|
|
;ZwOpenThreadTokenEx
|
|
ZwOpenTimer@12
|
|
ZwPowerInformation@20
|
|
;ZwPulseEvent
|
|
;ZwQueryBootEntryOrder
|
|
;ZwQueryBootOptions
|
|
ZwQueryDefaultLocale@8
|
|
ZwQueryDefaultUILanguage@4
|
|
;ZwQueryDirectoryFile
|
|
ZwQueryDirectoryObject@28
|
|
;ZwQueryEaFile
|
|
;ZwQueryFullAttributesFile
|
|
ZwQueryInformationFile@20
|
|
ZwQueryInformationJobObject@20
|
|
ZwQueryInformationProcess@20
|
|
ZwQueryInformationThread@20
|
|
ZwQueryInformationToken@20
|
|
ZwQueryInstallUILanguage@4
|
|
ZwQueryKey@20
|
|
ZwQueryObject@20
|
|
ZwQuerySection@20
|
|
ZwQuerySecurityObject@20
|
|
ZwQuerySymbolicLinkObject@12
|
|
ZwQuerySystemInformation@16
|
|
ZwQueryValueKey@24
|
|
;ZwQueryVolumeInformationFile
|
|
ZwReadFile@36
|
|
ZwReplaceKey@12
|
|
ZwRequestWaitReplyPort@12
|
|
;ZwResetEvent
|
|
ZwRestoreKey@12
|
|
ZwSaveKey@8
|
|
;ZwSaveKeyEx
|
|
;ZwSetBootEntryOrder
|
|
;ZwSetBootOptions
|
|
ZwSetDefaultLocale@8
|
|
ZwSetDefaultUILanguage@4
|
|
;ZwSetEaFile
|
|
ZwSetEvent@8
|
|
ZwSetInformationFile@20
|
|
ZwSetInformationJobObject@16
|
|
ZwSetInformationObject@16
|
|
ZwSetInformationProcess@16
|
|
ZwSetInformationThread@16
|
|
ZwSetSecurityObject@12
|
|
ZwSetSystemInformation@12
|
|
ZwSetSystemTime@8
|
|
ZwSetTimer@28
|
|
ZwSetValueKey@24
|
|
;ZwSetVolumeInformationFile
|
|
ZwTerminateJobObject@8
|
|
ZwTerminateProcess@8
|
|
;ZwTranslateFilePath
|
|
ZwUnloadDriver@4
|
|
ZwUnloadKey@4
|
|
ZwUnmapViewOfSection@8
|
|
;ZwWaitForMultipleObjects
|
|
ZwWaitForSingleObject@12
|
|
ZwWriteFile@36
|
|
ZwYieldExecution@0
|
|
;_CIcos
|
|
;_CIsin
|
|
;_CIsqrt
|
|
;_abnormal_termination
|
|
;_alldiv
|
|
;_alldvrm
|
|
;_allmul
|
|
;_alloca_probe
|
|
;_allrem
|
|
;_allshl
|
|
;_allshr
|
|
;_aulldiv
|
|
;_aulldvrm
|
|
;_aullrem
|
|
;_aullshr
|
|
;_except_handler2
|
|
;_except_handler3
|
|
;_global_unwind2
|
|
;_itoa
|
|
;_itow
|
|
;_local_unwind2
|
|
;_purecall
|
|
_snprintf
|
|
_snwprintf
|
|
_stricmp
|
|
_strlwr
|
|
_strnicmp
|
|
_strnset
|
|
_strrev
|
|
_strset
|
|
_strupr
|
|
_vsnprintf
|
|
_vsnwprintf
|
|
_wcsicmp@8
|
|
_wcslwr@4
|
|
_wcsnicmp@12
|
|
_wcsnset@12
|
|
_wcsrev@4
|
|
_wcsupr@4
|
|
;atoi
|
|
;atol
|
|
;isdigit
|
|
;islower
|
|
;isprint
|
|
;isspace
|
|
;isupper
|
|
;isxdigit
|
|
;mbstowcs
|
|
;mbtowc
|
|
memchr
|
|
memcpy
|
|
memmove
|
|
memset
|
|
;qsort
|
|
;rand
|
|
sprintf
|
|
;srand
|
|
strcat
|
|
strchr
|
|
strcmp
|
|
strcpy
|
|
strlen
|
|
strncat
|
|
strncmp
|
|
strncpy
|
|
strrchr
|
|
strspn
|
|
strstr
|
|
swprintf
|
|
;tolower
|
|
;toupper
|
|
;towlower
|
|
;towupper
|
|
;vDbgPrintEx
|
|
;vDbgPrintExWithPrefix
|
|
;vsprintf
|
|
wcscat
|
|
wcschr
|
|
wcscmp
|
|
wcscpy
|
|
wcscspn
|
|
wcslen
|
|
wcsncat
|
|
wcsncmp
|
|
wcsncpy
|
|
wcsrchr
|
|
wcsspn
|
|
wcsstr
|
|
;wcstombs
|
|
;wctomb
|