Difference between revisions of "Techwiki:Ntoskrnl export list"
ThePhysicist (talk | contribs) m (ThePhysicist moved page Techwiki:Ntoskrnl export list part 1 to Techwiki:Ntoskrnl export list: No need to split the table) |
ThePhysicist (talk | contribs) |
||
Line 1: | Line 1: | ||
− | This is | + | This is the list of exports from ntoskrnl. Taken from Windows XP SP2 Build 2600. |
{| border="1" cellpadding="1" cellspacing="0" style="font-size: 100%; border: gray solid 1px; border-collapse: collapse; text-align: left; width: 100%" | {| border="1" cellpadding="1" cellspacing="0" style="font-size: 100%; border: gray solid 1px; border-collapse: collapse; text-align: left; width: 100%" | ||
Line 727: | Line 727: | ||
|-MmUnsecureVirtualMemory || 728 | |-MmUnsecureVirtualMemory || 728 | ||
||MmUserProbeAddress || 729 | ||MmUserProbeAddress || 729 | ||
+ | |-NlsAnsiCodePage || 730 | ||
+ | ||NlsLeadByteInfo || 731 | ||
+ | |-NlsMbCodePageTag || 732 | ||
+ | ||NlsMbOemCodePageTag || 733 | ||
+ | |-NlsOemCodePage || 734 | ||
+ | ||NlsOemLeadByteInfo || 735 | ||
+ | |-NtAddAtom || 736 | ||
+ | ||NtAdjustPrivilegesToken || 737 | ||
+ | |-NtAllocateLocallyUniqueId || 738 | ||
+ | ||NtAllocateUuids || 739 | ||
+ | |-NtAllocateVirtualMemory || 740 | ||
+ | ||NtBuildNumber || 741 | ||
+ | |-NtClose || 742 | ||
+ | ||NtConnectPort || 743 | ||
+ | |-NtCreateEvent || 744 | ||
+ | ||NtCreateFile || 745 | ||
+ | |-NtCreateSection || 746 | ||
+ | ||NtDeleteAtom || 747 | ||
+ | |-NtDeleteFile || 748 | ||
+ | ||NtDeviceIoControlFile || 749 | ||
+ | |-NtDuplicateObject || 750 | ||
+ | ||NtDuplicateToken || 751 | ||
+ | |-NtFindAtom || 752 | ||
+ | ||NtFreeVirtualMemory || 753 | ||
+ | |-NtFsControlFile || 754 | ||
+ | ||NtGlobalFlag || 755 | ||
+ | |-NtLockFile || 756 | ||
+ | ||NtMakePermanentObject || 757 | ||
+ | |-NtMapViewOfSection || 758 | ||
+ | ||NtNotifyChangeDirectoryFile || 759 | ||
+ | |-NtOpenFile || 760 | ||
+ | ||NtOpenProcess || 761 | ||
+ | |-NtOpenProcessToken || 762 | ||
+ | ||NtOpenProcessTokenEx || 763 | ||
+ | |-NtOpenThread || 764 | ||
+ | ||NtOpenThreadToken || 765 | ||
+ | |-NtOpenThreadTokenEx || 766 | ||
+ | ||NtQueryDirectoryFile || 767 | ||
+ | |-NtQueryEaFile || 768 | ||
+ | ||NtQueryInformationAtom || 769 | ||
+ | |-NtQueryInformationFile || 770 | ||
+ | ||NtQueryInformationProcess || 771 | ||
+ | |-NtQueryInformationThread || 772 | ||
+ | ||NtQueryInformationToken || 773 | ||
+ | |-NtQueryQuotaInformationFile || 774 | ||
+ | ||NtQuerySecurityObject || 775 | ||
+ | |-NtQuerySystemInformation || 776 | ||
+ | ||NtQueryVolumeInformationFile || 777 | ||
+ | |-NtReadFile || 778 | ||
+ | ||NtRequestPort || 779 | ||
+ | |-NtRequestWaitReplyPort || 780 | ||
+ | ||NtSetEaFile || 781 | ||
+ | |-NtSetEvent || 782 | ||
+ | ||NtSetInformationFile || 783 | ||
+ | |-NtSetInformationProcess || 784 | ||
+ | ||NtSetInformationThread || 785 | ||
+ | |-NtSetQuotaInformationFile || 786 | ||
+ | ||NtSetSecurityObject || 787 | ||
+ | |-NtSetVolumeInformationFile || 788 | ||
+ | ||NtShutdownSystem || 789 | ||
+ | |-NtTraceEvent || 790 | ||
+ | ||NtUnlockFile || 791 | ||
+ | |-NtVdmControl || 792 | ||
+ | ||NtWaitForSingleObject || 793 | ||
+ | |-NtWriteFile || 794 | ||
+ | ||ObAssignSecurity || 795 | ||
+ | |-ObCheckCreateObjectAccess || 796 | ||
+ | ||ObCheckObjectAccess || 797 | ||
+ | |-ObCloseHandle || 798 | ||
+ | ||ObCreateObject || 799 | ||
+ | |-ObCreateObjectType || 800 | ||
+ | ||ObDereferenceObject || 801 | ||
+ | |-ObDereferenceSecurityDescriptor || 802 | ||
+ | ||ObFindHandleForObject || 803 | ||
+ | |-ObGetObjectSecurity || 804 | ||
+ | ||ObInsertObject || 805 | ||
+ | |-ObLogSecurityDescriptor || 806 | ||
+ | ||ObMakeTemporaryObject || 807 | ||
+ | |-ObOpenObjectByName || 808 | ||
+ | ||ObOpenObjectByPointer || 809 | ||
+ | |-ObQueryNameString || 810 | ||
+ | ||ObQueryObjectAuditingByHandle || 811 | ||
+ | |-ObReferenceObjectByHandle || 812 | ||
+ | ||ObReferenceObjectByName || 813 | ||
+ | |-ObReferenceObjectByPointer || 814 | ||
+ | ||ObReferenceSecurityDescriptor || 815 | ||
+ | |-ObReleaseObjectSecurity || 816 | ||
+ | ||ObSetHandleAttributes || 817 | ||
+ | |-ObSetSecurityDescriptorInfo || 818 | ||
+ | ||ObSetSecurityObjectByPointer || 819 | ||
+ | |-ObfDereferenceObject || 51 | ||
+ | ||ObfReferenceObject || 52 | ||
+ | |-PfxFindPrefix || 820 | ||
+ | ||PfxInitialize || 821 | ||
+ | |-PfxInsertPrefix || 822 | ||
+ | ||PfxRemovePrefix || 823 | ||
+ | |-PoCallDriver || 824 | ||
+ | ||PoCancelDeviceNotify || 825 | ||
+ | |-PoQueueShutdownWorkItem || 826 | ||
+ | ||PoRegisterDeviceForIdleDetection || 827 | ||
+ | |-PoRegisterDeviceNotify || 828 | ||
+ | ||PoRegisterSystemState || 829 | ||
+ | |-PoRequestPowerIrp || 830 | ||
+ | ||PoRequestShutdownEvent || 831 | ||
+ | |-PoSetHiberRange || 832 | ||
+ | ||PoSetPowerState || 833 | ||
+ | |-PoSetSystemState || 834 | ||
+ | ||PoShutdownBugCheck || 835 | ||
+ | |-PoStartNextPowerIrp || 836 | ||
+ | ||PoUnregisterSystemState || 837 | ||
+ | |-ProbeForRead || 838 | ||
+ | ||ProbeForWrite || 839 | ||
+ | |-PsAssignImpersonationToken || 840 | ||
+ | ||PsChargePoolQuota || 841 | ||
+ | |-PsChargeProcessNonPagedPoolQuota || 842 | ||
+ | ||PsChargeProcessPagedPoolQuota || 843 | ||
+ | |-PsChargeProcessPoolQuota || 844 | ||
+ | ||PsCreateSystemProcess || 845 | ||
+ | |-PsCreateSystemThread || 846 | ||
+ | ||PsDereferenceImpersonationToken || 847 | ||
+ | |-PsDereferencePrimaryToken || 848 | ||
+ | ||PsDisableImpersonation || 849 | ||
+ | |-PsEstablishWin32Callouts || 850 | ||
+ | ||PsGetContextThread || 851 | ||
+ | |-PsGetCurrentProcess || 852 | ||
+ | ||PsGetCurrentProcessId || 853 | ||
+ | |-PsGetCurrentProcessSessionId || 854 | ||
+ | ||PsGetCurrentThread || 855 | ||
+ | |-PsGetCurrentThreadId || 856 | ||
+ | ||PsGetCurrentThreadPreviousMode || 857 | ||
+ | |-PsGetCurrentThreadStackBase || 858 | ||
+ | ||PsGetCurrentThreadStackLimit || 859 | ||
+ | |-PsGetJobLock || 860 | ||
+ | ||PsGetJobSessionId || 861 | ||
+ | |-PsGetJobUIRestrictionsClass || 862 | ||
+ | ||PsGetProcessCreateTimeQuadPart || 863 | ||
+ | |-PsGetProcessDebugPort || 864 | ||
+ | ||PsGetProcessExitProcessCalled || 865 | ||
+ | |-PsGetProcessExitStatus || 866 | ||
+ | ||PsGetProcessExitTime || 867 | ||
+ | |-PsGetProcessId || 868 | ||
+ | ||PsGetProcessImageFileName || 869 | ||
+ | |-PsGetProcessInheritedFromUniqueProcessId || 870 | ||
+ | ||PsGetProcessJob || 871 | ||
+ | |-PsGetProcessPeb || 872 | ||
+ | ||PsGetProcessPriorityClass || 873 | ||
+ | |-PsGetProcessSectionBaseAddress || 874 | ||
+ | ||PsGetProcessSecurityPort || 875 | ||
+ | |-PsGetProcessSessionId || 876 | ||
+ | ||PsGetProcessWin32Process || 877 | ||
+ | |-PsGetProcessWin32WindowStation || 878 | ||
+ | ||PsGetThreadFreezeCount || 879 | ||
+ | |-PsGetThreadHardErrorsAreDisabled || 880 | ||
+ | ||PsGetThreadId || 881 | ||
+ | |-PsGetThreadProcess || 882 | ||
+ | ||PsGetThreadProcessId || 883 | ||
+ | |-PsGetThreadSessionId || 884 | ||
+ | ||PsGetThreadTeb || 885 | ||
+ | |-PsGetThreadWin32Thread || 886 | ||
+ | ||PsGetVersion || 887 | ||
+ | |-PsImpersonateClient || 888 | ||
+ | ||PsInitialSystemProcess || 889 | ||
+ | |-PsIsProcessBeingDebugged || 890 | ||
+ | ||PsIsSystemThread || 891 | ||
+ | |-PsIsThreadImpersonating || 892 | ||
+ | ||PsIsThreadTerminating || 893 | ||
+ | |-PsJobType || 894 | ||
+ | ||PsLookupProcessByProcessId || 895 | ||
+ | |-PsLookupProcessThreadByCid || 896 | ||
+ | ||PsLookupThreadByThreadId || 897 | ||
+ | |-PsProcessType || 898 | ||
+ | ||PsReferenceImpersonationToken || 899 | ||
+ | |-PsReferencePrimaryToken || 900 | ||
+ | ||PsRemoveCreateThreadNotifyRoutine || 901 | ||
+ | |-PsRemoveLoadImageNotifyRoutine || 902 | ||
+ | ||PsRestoreImpersonation || 903 | ||
+ | |-PsReturnPoolQuota || 904 | ||
+ | ||PsReturnProcessNonPagedPoolQuota || 905 | ||
+ | |-PsReturnProcessPagedPoolQuota || 906 | ||
+ | ||PsRevertThreadToSelf || 907 | ||
+ | |-PsRevertToSelf || 908 | ||
+ | ||PsSetContextThread || 909 | ||
+ | |-PsSetCreateProcessNotifyRoutine || 910 | ||
+ | ||PsSetCreateThreadNotifyRoutine || 911 | ||
+ | |-PsSetJobUIRestrictionsClass || 912 | ||
+ | ||PsSetLegoNotifyRoutine || 913 | ||
+ | |-PsSetLoadImageNotifyRoutine || 914 | ||
+ | ||PsSetProcessPriorityByClass || 915 | ||
+ | |-PsSetProcessPriorityClass || 916 | ||
+ | ||PsSetProcessSecurityPort || 917 | ||
+ | |-PsSetProcessWin32Process || 918 | ||
+ | ||PsSetProcessWindowStation || 919 | ||
+ | |-PsSetThreadHardErrorsAreDisabled || 920 | ||
+ | ||PsSetThreadWin32Thread || 921 | ||
+ | |-PsTerminateSystemThread || 922 | ||
+ | ||PsThreadType || 923 | ||
+ | |-READ_REGISTER_BUFFER_UCHAR || 924 | ||
+ | ||READ_REGISTER_BUFFER_ULONG || 925 | ||
+ | |-READ_REGISTER_BUFFER_USHORT || 926 | ||
+ | ||READ_REGISTER_UCHAR || 927 | ||
+ | |-READ_REGISTER_ULONG || 928 | ||
+ | ||READ_REGISTER_USHORT || 929 | ||
+ | |-RtlAbsoluteToSelfRelativeSD || 930 | ||
+ | ||RtlAddAccessAllowedAce || 931 | ||
+ | |-RtlAddAccessAllowedAceEx || 932 | ||
+ | ||RtlAddAce || 933 | ||
+ | |-RtlAddAtomToAtomTable || 934 | ||
+ | ||RtlAddRange || 935 | ||
+ | |-RtlAllocateHeap || 936 | ||
+ | ||RtlAnsiCharToUnicodeChar || 937 | ||
+ | |-RtlAnsiStringToUnicodeSize || 938 | ||
+ | ||RtlAnsiStringToUnicodeString || 939 | ||
+ | |-RtlAppendAsciizToString || 940 | ||
+ | ||RtlAppendStringToString || 941 | ||
+ | |-RtlAppendUnicodeStringToString || 942 | ||
+ | ||RtlAppendUnicodeToString || 943 | ||
+ | |-RtlAreAllAccessesGranted || 944 | ||
+ | ||RtlAreAnyAccessesGranted || 945 | ||
+ | |-RtlAreBitsClear || 946 | ||
+ | ||RtlAreBitsSet || 947 | ||
+ | |-RtlAssert || 948 | ||
+ | ||RtlCaptureContext || 949 | ||
+ | |-RtlCaptureStackBackTrace || 950 | ||
+ | ||RtlCharToInteger || 951 | ||
+ | |-RtlCheckRegistryKey || 952 | ||
+ | ||RtlClearAllBits || 953 | ||
+ | |-RtlClearBit || 954 | ||
+ | ||RtlClearBits || 955 | ||
+ | |-RtlCompareMemory || 956 | ||
+ | ||RtlCompareMemoryUlong || 957 | ||
+ | |-RtlCompareString || 958 | ||
+ | ||RtlCompareUnicodeString || 959 | ||
+ | |-RtlCompressBuffer || 960 | ||
+ | ||RtlCompressChunks || 961 | ||
+ | |-RtlConvertLongToLargeInteger || 962 | ||
+ | ||RtlConvertSidToUnicodeString || 963 | ||
+ | |-RtlConvertUlongToLargeInteger || 964 | ||
+ | ||RtlCopyLuid || 965 | ||
+ | |-RtlCopyRangeList || 966 | ||
+ | ||RtlCopySid || 967 | ||
+ | |-RtlCopyString || 968 | ||
+ | ||RtlCopyUnicodeString || 969 | ||
+ | |-RtlCreateAcl || 970 | ||
+ | ||RtlCreateAtomTable || 971 | ||
+ | |-RtlCreateHeap || 972 | ||
+ | ||RtlCreateRegistryKey || 973 | ||
+ | |-RtlCreateSecurityDescriptor || 974 | ||
+ | ||RtlCreateSystemVolumeInformationFolder || 975 | ||
+ | |-RtlCreateUnicodeString || 976 | ||
+ | ||RtlCustomCPToUnicodeN || 977 | ||
+ | |-RtlDecompressBuffer || 978 | ||
+ | ||RtlDecompressChunks || 979 | ||
+ | |-RtlDecompressFragment || 980 | ||
+ | ||RtlDelete || 981 | ||
+ | |-RtlDeleteAce || 982 | ||
+ | ||RtlDeleteAtomFromAtomTable || 983 | ||
+ | |-RtlDeleteElementGenericTable || 984 | ||
+ | ||RtlDeleteElementGenericTableAvl || 985 | ||
+ | |-RtlDeleteNoSplay || 986 | ||
+ | ||RtlDeleteOwnersRanges || 987 | ||
+ | |-RtlDeleteRange || 988 | ||
+ | ||RtlDeleteRegistryValue || 989 | ||
+ | |-RtlDescribeChunk || 990 | ||
+ | ||RtlDestroyAtomTable || 991 | ||
+ | |-RtlDestroyHeap || 992 | ||
+ | ||RtlDowncaseUnicodeString || 993 | ||
+ | |-RtlEmptyAtomTable || 994 | ||
+ | ||RtlEnlargedIntegerMultiply || 995 | ||
+ | |-RtlEnlargedUnsignedDivide || 996 | ||
+ | ||RtlEnlargedUnsignedMultiply || 997 | ||
+ | |-RtlEnumerateGenericTable || 998 | ||
+ | ||RtlEnumerateGenericTableAvl || 999 | ||
+ | |-RtlEnumerateGenericTableLikeADirectory || 1000 | ||
+ | ||RtlEnumerateGenericTableWithoutSplaying || 1001 | ||
+ | |-RtlEnumerateGenericTableWithoutSplayingAvl || 1002 | ||
+ | ||RtlEqualLuid || 1003 | ||
+ | |-RtlEqualSid || 1004 | ||
+ | ||RtlEqualString || 1005 | ||
+ | |-RtlEqualUnicodeString || 1006 | ||
+ | ||RtlExtendedIntegerMultiply || 1007 | ||
+ | |-RtlExtendedLargeIntegerDivide || 1008 | ||
+ | ||RtlExtendedMagicDivide || 1009 | ||
+ | |-RtlFillMemory || 1010 | ||
+ | ||RtlFillMemoryUlong || 1011 | ||
+ | |-RtlFindClearBits || 1012 | ||
+ | ||RtlFindClearBitsAndSet || 1013 | ||
+ | |-RtlFindClearRuns || 1014 | ||
+ | ||RtlFindFirstRunClear || 1015 | ||
+ | |-RtlFindLastBackwardRunClear || 1016 | ||
+ | ||RtlFindLeastSignificantBit || 1017 | ||
+ | |-RtlFindLongestRunClear || 1018 | ||
+ | ||RtlFindMessage || 1019 | ||
+ | |-RtlFindMostSignificantBit || 1020 | ||
+ | ||RtlFindNextForwardRunClear || 1021 | ||
+ | |-RtlFindRange || 1022 | ||
+ | ||RtlFindSetBits || 1023 | ||
+ | |-RtlFindSetBitsAndClear || 1024 | ||
+ | ||RtlFindUnicodePrefix || 1025 | ||
+ | |-RtlFormatCurrentUserKeyPath || 1026 | ||
+ | ||RtlFreeAnsiString || 1027 | ||
+ | |-RtlFreeHeap || 1028 | ||
+ | ||RtlFreeOemString || 1029 | ||
+ | |-RtlFreeRangeList || 1030 | ||
+ | ||RtlFreeUnicodeString || 1031 | ||
+ | |-RtlGUIDFromString || 1032 | ||
+ | ||RtlGenerate8dot3Name || 1033 | ||
+ | |-RtlGetAce || 1034 | ||
+ | ||RtlGetCallersAddress || 1035 | ||
+ | |-RtlGetCompressionWorkSpaceSize || 1036 | ||
+ | ||RtlGetDaclSecurityDescriptor || 1037 | ||
+ | |-RtlGetDefaultCodePage || 1038 | ||
+ | ||RtlGetElementGenericTable || 1039 | ||
+ | |-RtlGetElementGenericTableAvl || 1040 | ||
+ | ||RtlGetFirstRange || 1041 | ||
+ | |-RtlGetGroupSecurityDescriptor || 1042 | ||
+ | ||RtlGetNextRange || 1043 | ||
+ | |-RtlGetNtGlobalFlags || 1044 | ||
+ | ||RtlGetOwnerSecurityDescriptor || 1045 | ||
+ | |-RtlGetSaclSecurityDescriptor || 1046 | ||
+ | ||RtlGetSetBootStatusData || 1047 | ||
+ | |-RtlGetVersion || 1048 | ||
+ | ||RtlHashUnicodeString || 1049 | ||
+ | |-RtlImageDirectoryEntryToData || 1050 | ||
+ | ||RtlImageNtHeader || 1051 | ||
+ | |-RtlInitAnsiString || 1052 | ||
+ | ||RtlInitCodePageTable || 1053 | ||
+ | |-RtlInitString || 1054 | ||
+ | ||RtlInitUnicodeString || 1055 | ||
+ | |-RtlInitializeBitMap || 1056 | ||
+ | ||RtlInitializeGenericTable || 1057 | ||
+ | |-RtlInitializeGenericTableAvl || 1058 | ||
+ | ||RtlInitializeRangeList || 1059 | ||
+ | |-RtlInitializeSid || 1060 | ||
+ | ||RtlInitializeUnicodePrefix || 1061 | ||
+ | |-RtlInsertElementGenericTable || 1062 | ||
+ | ||RtlInsertElementGenericTableAvl || 1063 | ||
+ | |-RtlInsertElementGenericTableFull || 1064 | ||
+ | ||RtlInsertElementGenericTableFullAvl || 1065 | ||
+ | |-RtlInsertUnicodePrefix || 1066 | ||
+ | ||RtlInt64ToUnicodeString || 1067 | ||
+ | |-RtlIntegerToChar || 1068 | ||
+ | ||RtlIntegerToUnicode || 1069 | ||
+ | |-RtlIntegerToUnicodeString || 1070 | ||
+ | ||RtlInvertRangeList || 1071 | ||
+ | |-RtlIpv4AddressToStringA || 1072 | ||
+ | ||RtlIpv4AddressToStringExA || 1073 | ||
+ | |-RtlIpv4AddressToStringExW || 1074 | ||
+ | ||RtlIpv4AddressToStringW || 1075 | ||
+ | |-RtlIpv4StringToAddressA || 1076 | ||
+ | ||RtlIpv4StringToAddressExA || 1077 | ||
+ | |-RtlIpv4StringToAddressExW || 1078 | ||
+ | ||RtlIpv4StringToAddressW || 1079 | ||
+ | |-RtlIpv6AddressToStringA || 1080 | ||
+ | ||RtlIpv6AddressToStringExA || 1081 | ||
+ | |-RtlIpv6AddressToStringExW || 1082 | ||
+ | ||RtlIpv6AddressToStringW || 1083 | ||
+ | |-RtlIpv6StringToAddressA || 1084 | ||
+ | ||RtlIpv6StringToAddressExA || 1085 | ||
+ | |-RtlIpv6StringToAddressExW || 1086 | ||
+ | ||RtlIpv6StringToAddressW || 1087 | ||
+ | |-RtlIsGenericTableEmpty || 1088 | ||
+ | ||RtlIsGenericTableEmptyAvl || 1089 | ||
+ | |-RtlIsNameLegalDOS8Dot3 || 1090 | ||
+ | ||RtlIsRangeAvailable || 1091 | ||
+ | |-RtlIsValidOemCharacter || 1092 | ||
+ | ||RtlLargeIntegerAdd || 1093 | ||
+ | |-RtlLargeIntegerArithmeticShift || 1094 | ||
+ | ||RtlLargeIntegerDivide || 1095 | ||
+ | |-RtlLargeIntegerNegate || 1096 | ||
+ | ||RtlLargeIntegerShiftLeft || 1097 | ||
+ | |-RtlLargeIntegerShiftRight || 1098 | ||
+ | ||RtlLargeIntegerSubtract || 1099 | ||
+ | |-RtlLengthRequiredSid || 1100 | ||
+ | ||RtlLengthSecurityDescriptor || 1101 | ||
+ | |-RtlLengthSid || 1102 | ||
+ | ||RtlLockBootStatusData || 1103 | ||
+ | |-RtlLookupAtomInAtomTable || 1104 | ||
+ | ||RtlLookupElementGenericTable || 1105 | ||
+ | |-RtlLookupElementGenericTableAvl || 1106 | ||
+ | ||RtlLookupElementGenericTableFull || 1107 | ||
+ | |-RtlLookupElementGenericTableFullAvl || 1108 | ||
+ | ||RtlMapGenericMask || 1109 | ||
+ | |-RtlMapSecurityErrorToNtStatus || 1110 | ||
+ | ||RtlMergeRangeLists || 1111 | ||
+ | |-RtlMoveMemory || 1112 | ||
+ | ||RtlMultiByteToUnicodeN || 1113 | ||
+ | |-RtlMultiByteToUnicodeSize || 1114 | ||
+ | ||RtlNextUnicodePrefix || 1115 | ||
+ | |-RtlNtStatusToDosError || 1116 | ||
+ | ||RtlNtStatusToDosErrorNoTeb || 1117 | ||
+ | |-RtlNumberGenericTableElements || 1118 | ||
+ | ||RtlNumberGenericTableElementsAvl || 1119 | ||
+ | |-RtlNumberOfClearBits || 1120 | ||
+ | ||RtlNumberOfSetBits || 1121 | ||
+ | |-RtlOemStringToCountedUnicodeString || 1122 | ||
+ | ||RtlOemStringToUnicodeSize || 1123 | ||
+ | |-RtlOemStringToUnicodeString || 1124 | ||
+ | ||RtlOemToUnicodeN || 1125 | ||
+ | |-RtlPinAtomInAtomTable|| 1126 | ||
+ | ||RtlPrefetchMemoryNonTemporal || 53 | ||
+ | |-RtlPrefixString || 1127 | ||
+ | ||RtlPrefixUnicodeString || 1128 | ||
+ | |-RtlQueryAtomInAtomTable || 1129 | ||
+ | ||RtlQueryRegistryValues || 1130 | ||
+ | |-RtlQueryTimeZoneInformation || 1131 | ||
+ | ||RtlRaiseException || 1132 | ||
+ | |-RtlRandom || 1133 | ||
+ | ||RtlRandomEx || 1134 | ||
+ | |-RtlRealPredecessor || 1135 | ||
+ | ||RtlRealSuccessor || 1136 | ||
+ | |-RtlRemoveUnicodePrefix || 1137 | ||
+ | ||RtlReserveChunk || 1138 | ||
+ | |-RtlSecondsSince1970ToTime || 1139 | ||
+ | ||RtlSecondsSince1980ToTime || 1140 | ||
+ | |-RtlSelfRelativeToAbsoluteSD || 1142 | ||
+ | ||RtlSelfRelativeToAbsoluteSD2 || 1141 | ||
+ | |-RtlSetAllBits || 1143 | ||
+ | ||RtlSetBit || 1144 | ||
+ | |-RtlSetBits || 1145 | ||
+ | ||RtlSetDaclSecurityDescriptor || 1146 | ||
+ | |-RtlSetGroupSecurityDescriptor || 1147 | ||
+ | ||RtlSetOwnerSecurityDescriptor || 1148 | ||
+ | |-RtlSetSaclSecurityDescriptor || 1149 | ||
+ | ||RtlSetTimeZoneInformation || 1150 | ||
+ | |-RtlSizeHeap || 1151 | ||
+ | ||RtlSplay || 1152 | ||
+ | |-RtlStringFromGUID || 1153 | ||
+ | ||RtlSubAuthorityCountSid || 1154 | ||
+ | |-RtlSubAuthoritySid || 1155 | ||
+ | ||RtlSubtreePredecessor || 1156 | ||
+ | |-RtlSubtreeSuccessor || 1157 | ||
+ | ||RtlTestBit || 1158 | ||
+ | |-RtlTimeFieldsToTime || 1159 | ||
+ | ||RtlTimeToElapsedTimeFields || 1160 | ||
+ | |-RtlTimeToSecondsSince1970 || 1161 | ||
+ | ||RtlTimeToSecondsSince1980 || 1162 | ||
+ | |-RtlTimeToTimeFields || 1163 | ||
+ | ||RtlTraceDatabaseAdd || 1164 | ||
+ | |-RtlTraceDatabaseCreate || 1165 | ||
+ | ||RtlTraceDatabaseDestroy || 1166 | ||
+ | |-RtlTraceDatabaseEnumerate || 1167 | ||
+ | ||RtlTraceDatabaseFind || 1168 | ||
+ | |-RtlTraceDatabaseLock || 1169 | ||
+ | ||RtlTraceDatabaseUnlock || 1170 | ||
+ | |-RtlTraceDatabaseValidate || 1171 | ||
+ | ||RtlUlongByteSwap || 54 | ||
+ | |-RtlUlonglongByteSwap || 55 | ||
+ | ||RtlUnicodeStringToAnsiSize || 1172 | ||
+ | |-RtlUnicodeStringToAnsiString|| 1173 | ||
+ | ||RtlUnicodeStringToCountedOemString || 1174 | ||
+ | |-RtlUnicodeStringToInteger || 1175 | ||
+ | ||RtlUnicodeStringToOemSize || 1176 | ||
+ | |-RtlUnicodeStringToOemString|| 1177 | ||
+ | ||RtlUnicodeToCustomCPN || 1178 | ||
+ | |-RtlUnicodeToMultiByteN || 1179 | ||
+ | ||RtlUnicodeToMultiByteSize || 1180 | ||
+ | |-RtlUnicodeToOemN || 1181 | ||
+ | ||RtlUnlockBootStatusData || 1182 | ||
+ | |-RtlUnwind || 1183 | ||
+ | ||RtlUpcaseUnicodeChar || 1184 | ||
+ | |-RtlUpcaseUnicodeString || 1185 | ||
+ | ||RtlUpcaseUnicodeStringToAnsiString || 1186 | ||
+ | |-RtlUpcaseUnicodeStringToCountedOemString || 1187 | ||
+ | ||RtlUpcaseUnicodeStringToOemString || 1188 | ||
+ | |-RtlUpcaseUnicodeToCustomCPN || 1189 | ||
+ | ||RtlUpcaseUnicodeToMultiByteN || 1190 | ||
+ | |-RtlUpcaseUnicodeToOemN || 1191 | ||
+ | ||RtlUpperChar || 1192 | ||
+ | |-RtlUpperString || 1193 | ||
+ | ||RtlUshortByteSwap || 56 | ||
+ | |-RtlValidRelativeSecurityDescriptor || 1194 | ||
+ | ||RtlValidSecurityDescriptor || 1195 | ||
+ | |-RtlValidSid || 1196 | ||
+ | ||RtlVerifyVersionInfo || 1197 | ||
+ | |-RtlVolumeDeviceToDosName || 1198 | ||
+ | ||RtlWalkFrameChain || 1199 | ||
+ | |-RtlWriteRegistryValue || 1200 | ||
+ | ||RtlZeroHeap || 1201 | ||
+ | |-RtlZeroMemory || 1202 | ||
+ | ||RtlxAnsiStringToUnicodeSize || 1203 | ||
+ | |-RtlxOemStringToUnicodeSize || 1204 | ||
+ | ||RtlxUnicodeStringToAnsiSize || 1205 | ||
+ | |-RtlxUnicodeStringToOemSize || 1206 | ||
+ | ||SeAccessCheck || 1207 | ||
+ | |-SeAppendPrivileges || 1208 | ||
+ | ||SeAssignSecurity || 1209 | ||
+ | |-SeAssignSecurityEx || 1210 | ||
+ | ||SeAuditHardLinkCreation || 1211 | ||
+ | |-SeAuditingFileEvents || 1212 | ||
+ | ||SeAuditingFileEventsWithContext || 1213 | ||
+ | |-SeAuditingFileOrGlobalEvents || 1214 | ||
+ | ||SeAuditingHardLinkEvents || 1215 | ||
+ | |-SeAuditingHardLinkEventsWithContext || 1216 | ||
+ | ||SeCaptureSecurityDescriptor || 1217 | ||
+ | |-SeCaptureSubjectContext || 1218 | ||
+ | ||SeCloseObjectAuditAlarm || 1219 | ||
+ | |-SeCreateAccessState || 1220 | ||
+ | ||SeCreateClientSecurity || 1221 | ||
+ | |-SeCreateClientSecurityFromSubjectContext || 1222 | ||
+ | ||SeDeassignSecurity || 1223 | ||
+ | |-SeDeleteAccessState || 1224 | ||
+ | ||SeDeleteObjectAuditAlarm || 1225 | ||
+ | |-SeExports || 1226 | ||
+ | ||SeFilterToken || 1227 | ||
+ | |-SeFreePrivileges || 1228 | ||
+ | ||SeImpersonateClient || 1229 | ||
+ | |-SeImpersonateClientEx || 1230 | ||
+ | ||SeLockSubjectContext || 1231 | ||
+ | |-SeMarkLogonSessionForTerminationNotification || 1232 | ||
+ | ||SeOpenObjectAuditAlarm || 1233 | ||
+ | |-SeOpenObjectForDeleteAuditAlarm || 1234 | ||
+ | ||SePrivilegeCheck || 1235 | ||
+ | |-SePrivilegeObjectAuditAlarm || 1236 | ||
+ | ||SePublicDefaultDacl || 1237 | ||
+ | |-SeQueryAuthenticationIdToken || 1238 | ||
+ | ||SeQueryInformationToken || 1239 | ||
+ | |-SeQuerySecurityDescriptorInfo || 1240 | ||
+ | ||SeQuerySessionIdToken || 1241 | ||
+ | |-SeRegisterLogonSessionTerminatedRoutine || 1242 | ||
+ | ||SeReleaseSecurityDescriptor || 1243 | ||
+ | |-SeReleaseSubjectContext || 1244 | ||
+ | ||SeSetAccessStateGenericMapping || 1245 | ||
+ | |-SeSetSecurityDescriptorInfo || 1246 | ||
+ | ||SeSetSecurityDescriptorInfoEx || 1247 | ||
+ | |-SeSinglePrivilegeCheck || 1248 | ||
+ | ||SeSystemDefaultDacl || 1249 | ||
+ | |-SeTokenImpersonationLevel || 1250 | ||
+ | ||SeTokenIsAdmin || 1251 | ||
+ | |-SeTokenIsRestricted || 1252 | ||
+ | ||SeTokenIsWriteRestricted || 1253 | ||
+ | |-SeTokenObjectType || 1254 | ||
+ | ||SeTokenType || 1255 | ||
+ | |-SeUnlockSubjectContext || 1256 | ||
+ | ||SeUnregisterLogonSessionTerminatedRoutine || 1257 | ||
+ | |-SeValidSecurityDescriptor || 1258 | ||
+ | ||VerSetConditionMask || 1259 | ||
+ | |-VfFailDeviceNode || 1260 | ||
+ | ||VfFailDriver || 1261 | ||
+ | |-VfFailSystemBIOS || 1262 | ||
+ | ||VfIsVerificationEnabled || 1263 | ||
+ | |-WRITE_REGISTER_BUFFER_UCHAR || 1264 | ||
+ | ||WRITE_REGISTER_BUFFER_ULONG || 1265 | ||
+ | |-WRITE_REGISTER_BUFFER_USHORT || 1266 | ||
+ | ||WRITE_REGISTER_UCHAR || 1267 | ||
+ | |-WRITE_REGISTER_ULONG || 1268 | ||
+ | ||WRITE_REGISTER_USHORT || 1269 | ||
+ | |-WmiFlushTrace || 1270 | ||
+ | ||WmiGetClock || 57 | ||
+ | |-WmiQueryTrace || 1271 | ||
+ | ||WmiQueryTraceInformation || 1272 | ||
+ | |-WmiStartTrace || 1273 | ||
+ | ||WmiStopTrace || 1274 | ||
+ | |-WmiTraceMessage || 1275 | ||
+ | ||WmiTraceMessageVa || 1276 | ||
+ | |-WmiUpdateTrace || 1277 | ||
+ | ||XIPDispatch || 1278 | ||
+ | |-ZwAccessCheckAndAuditAlarm || 1279 | ||
+ | ||ZwAddBootEntry || 1280 | ||
+ | |-ZwAdjustPrivilegesToken || 1281 | ||
+ | ||ZwAlertThread || 1282 | ||
+ | |-ZwAllocateVirtualMemory || 1283 | ||
+ | ||ZwAssignProcessToJobObject || 1284 | ||
+ | |-ZwCancelIoFile || 1285 | ||
+ | ||ZwCancelTimer || 1286 | ||
+ | |-ZwClearEvent || 1287 | ||
+ | ||ZwClose || 1288 | ||
+ | |-ZwCloseObjectAuditAlarm || 1289 | ||
+ | ||ZwConnectPort || 1290 | ||
+ | |-ZwCreateDirectoryObject || 1291 | ||
+ | ||ZwCreateEvent || 1292 | ||
+ | |-ZwCreateFile || 1293 | ||
+ | ||ZwCreateJobObject || 1294 | ||
+ | |-ZwCreateKey || 1295 | ||
+ | ||ZwCreateSection || 1296 | ||
+ | |-ZwCreateSymbolicLinkObject || 1297 | ||
+ | ||ZwCreateTimer || 1298 | ||
+ | |-ZwDeleteBootEntry || 1299 | ||
+ | ||ZwDeleteFile || 1300 | ||
+ | |-ZwDeleteKey || 1301 | ||
+ | ||ZwDeleteValueKey || 1302 | ||
+ | |-ZwDeviceIoControlFile || 1303 | ||
+ | ||ZwDisplayString || 1304 | ||
+ | |-ZwDuplicateObject || 1305 | ||
+ | ||ZwDuplicateToken || 1306 | ||
+ | |-ZwEnumerateBootEntries || 1307 | ||
+ | ||ZwEnumerateKey || 1308 | ||
+ | |-ZwEnumerateValueKey || 1309 | ||
+ | ||ZwFlushInstructionCache || 1310 | ||
+ | |-ZwFlushKey || 1311 | ||
+ | ||ZwFlushVirtualMemory || 1312 | ||
+ | |-ZwFreeVirtualMemory || 1313 | ||
+ | ||ZwFsControlFile || 1314 | ||
+ | |-ZwInitiatePowerAction || 1315 | ||
+ | ||ZwIsProcessInJob || 1316 | ||
+ | |-ZwLoadDriver || 1317 | ||
+ | ||ZwLoadKey || 1318 | ||
+ | |-ZwMakeTemporaryObject || 1319 | ||
+ | ||ZwMapViewOfSection || 1320 | ||
+ | |-ZwNotifyChangeKey || 1321 | ||
+ | ||ZwOpenDirectoryObject || 1322 | ||
+ | |-ZwOpenEvent || 1323 | ||
+ | ||ZwOpenFile || 1324 | ||
+ | |-ZwOpenJobObject || 1325 | ||
+ | ||ZwOpenKey || 1326 | ||
+ | |-ZwOpenProcess || 1327 | ||
+ | ||ZwOpenProcessToken || 1328 | ||
+ | |-ZwOpenProcessTokenEx || 1329 | ||
+ | ||ZwOpenSection || 1330 | ||
+ | |-ZwOpenSymbolicLinkObject || 1331 | ||
+ | ||ZwOpenThread || 1332 | ||
+ | |-ZwOpenThreadToken || 1333 | ||
+ | ||ZwOpenThreadTokenEx || 1334 | ||
+ | |-ZwOpenTimer || 1335 | ||
+ | ||ZwPowerInformation || 1336 | ||
+ | |-ZwPulseEvent || 1337 | ||
+ | ||ZwQueryBootEntryOrder || 1338 | ||
+ | |-ZwQueryBootOptions || 1339 | ||
+ | ||ZwQueryDefaultLocale || 1340 | ||
+ | |-ZwQueryDefaultUILanguage || 1341 | ||
+ | ||ZwQueryDirectoryFile || 1342 | ||
+ | |-ZwQueryDirectoryObject || 1343 | ||
+ | ||ZwQueryEaFile || 1344 | ||
+ | |-ZwQueryFullAttributesFile || 1345 | ||
+ | ||ZwQueryInformationFile || 1346 | ||
+ | |-ZwQueryInformationJobObject || 1347 | ||
+ | ||ZwQueryInformationProcess || 1348 | ||
+ | |-ZwQueryInformationThread || 1349 | ||
+ | ||ZwQueryInformationToken || 1350 | ||
+ | |-ZwQueryInstallUILanguage || 1351 | ||
+ | ||ZwQueryKey || 1352 | ||
+ | |-ZwQueryObject || 1353 | ||
+ | ||ZwQuerySection || 1354 | ||
+ | |-ZwQuerySecurityObject || 1355 | ||
+ | ||ZwQuerySymbolicLinkObject || 1356 | ||
+ | |-ZwQuerySystemInformation || 1357 | ||
+ | ||ZwQueryValueKey || 1358 | ||
+ | |-ZwQueryVolumeInformationFile || 1359 | ||
+ | ||ZwReadFile || 1360 | ||
+ | |-ZwReplaceKey || 1361 | ||
+ | ||ZwRequestWaitReplyPort || 1362 | ||
+ | |-ZwResetEvent || 1363 | ||
+ | ||ZwRestoreKey || 1364 | ||
+ | |-ZwSaveKey || 1365 | ||
+ | ||ZwSaveKeyEx || 1366 | ||
+ | |-ZwSetBootEntryOrder || 1367 | ||
+ | ||ZwSetBootOptions || 1368 | ||
+ | |-ZwSetDefaultLocale || 1369 | ||
+ | ||ZwSetDefaultUILanguage || 1370 | ||
+ | |-ZwSetEaFile || 1371 | ||
+ | ||ZwSetEvent || 1372 | ||
+ | |-ZwSetInformationFile || 1373 | ||
+ | ||ZwSetInformationJobObject || 1374 | ||
+ | |-ZwSetInformationObject || 1375 | ||
+ | ||ZwSetInformationProcess || 1376 | ||
+ | |-ZwSetInformationThread || 1377 | ||
+ | ||ZwSetSecurityObject || 1378 | ||
+ | |-ZwSetSystemInformation || 1379 | ||
+ | ||ZwSetSystemTime || 1380 | ||
+ | |-ZwSetTimer || 1381 | ||
+ | ||ZwSetValueKey || 1382 | ||
+ | |-ZwSetVolumeInformationFile || 1383 | ||
+ | ||ZwTerminateJobObject || 1384 | ||
+ | |-ZwTerminateProcess || 1385 | ||
+ | ||ZwTranslateFilePath || 1386 | ||
+ | |-ZwUnloadDriver || 1387 | ||
+ | ||ZwUnloadKey || 1388 | ||
+ | |-ZwUnmapViewOfSection || 1389 | ||
+ | ||ZwWaitForMultipleObjects || 1390 | ||
+ | |-ZwWaitForSingleObject || 1391 | ||
+ | ||ZwWriteFile || 1392 | ||
+ | |-ZwYieldExecution || 1393 | ||
+ | ||_CIcos || 1394 | ||
+ | |-_CIsin || 1395 | ||
+ | ||_CIsqrt || 1396 | ||
+ | |-_abnormal_termination || 1397 | ||
+ | ||_alldiv || 1398 | ||
+ | |-_alldvrm || 1399 | ||
+ | ||_allmul || 1400 | ||
+ | |-_alloca_probe || 1401 | ||
+ | ||_allrem || 1402 | ||
+ | |-_allshl || 1403 | ||
+ | ||_allshr || 1404 | ||
+ | |-_aulldiv || 1405 | ||
+ | ||_aulldvrm || 1406 | ||
+ | |-_aullrem || 1407 | ||
+ | ||_aullshr || 1408 | ||
+ | |-_except_handler2 || 1409 | ||
+ | ||_except_handler3 || 1410 | ||
+ | |-_global_unwind2 || 1411 | ||
+ | ||_itoa || 1412 | ||
+ | |-_itow || 1413 | ||
+ | ||_local_unwind2 || 1414 | ||
+ | |-_purecall || 1415 | ||
+ | ||_snprintf || 1416 | ||
+ | |-_snwprintf || 1417 | ||
+ | ||_stricmp || 1418 | ||
+ | |-_strlwr || 1419 | ||
+ | ||_strnicmp || 1420 | ||
+ | |-_strnset || 1421 | ||
+ | ||_strrev || 1422 | ||
+ | |-_strset || 1423 | ||
+ | ||_strupr || 1424 | ||
+ | |-_vsnprintf || 1425 | ||
+ | ||_vsnwprintf || 1426 | ||
+ | |-_wcsicmp || 1427 | ||
+ | ||_wcslwr || 1428 | ||
+ | |-_wcsnicmp || 1429 | ||
+ | ||_wcsnset || 1430 | ||
+ | |-_wcsrev || 1431 | ||
+ | ||_wcsupr || 1432 | ||
+ | |-atoi || 1433 | ||
+ | ||atol || 1434 | ||
+ | |-isdigit || 1435 | ||
+ | ||islower || 1436 | ||
+ | |-isprint || 1437 | ||
+ | ||isspace || 1438 | ||
+ | |-isupper || 1439 | ||
+ | ||isxdigit || 1440 | ||
+ | |-mbstowcs || 1441 | ||
+ | ||mbtowc || 1442 | ||
+ | |-memchr || 1443 | ||
+ | ||memcpy || 1444 | ||
+ | |-memmove || 1445 | ||
+ | ||memset || 1446 | ||
+ | |-qsort || 1447 | ||
+ | ||rand || 1448 | ||
+ | |-sprintf || 1449 | ||
+ | ||srand || 1450 | ||
+ | |-strcat || 1451 | ||
+ | ||strchr || 1452 | ||
+ | |-strcmp || 1453 | ||
+ | ||strcpy || 1454 | ||
+ | |-strlen || 1455 | ||
+ | ||strncat || 1456 | ||
+ | |-strncmp || 1457 | ||
+ | ||strncpy || 1458 | ||
+ | |-strrchr || 1459 | ||
+ | ||strspn || 1460 | ||
+ | |-strstr || 1461 | ||
+ | ||swprintf || 1462 | ||
+ | |-tolower || 1463 | ||
+ | ||toupper || 1464 | ||
+ | |-towlower || 1465 | ||
+ | ||towupper || 1466 | ||
+ | |-vDbgPrintEx || 1467 | ||
+ | ||vDbgPrintExWithPrefix || 1468 | ||
+ | |-vsprintf || 1469 | ||
+ | ||wcscat || 1470 | ||
+ | |-wcschr || 1471 | ||
+ | ||wcscmp || 1472 | ||
+ | |-wcscpy || 1473 | ||
+ | ||wcscspn || 1474 | ||
+ | |-wcslen || 1475 | ||
+ | ||wcsncat || 1476 | ||
+ | |-wcsncmp || 1477 | ||
+ | ||wcsncpy || 1478 | ||
+ | |-wcsrchr || 1479 | ||
+ | ||wcsspn || 1480 | ||
+ | |-wcsstr || 1481 | ||
+ | ||wcstombs || 1482 | ||
+ | |-wctomb || 1483 |
Revision as of 14:26, 22 May 2016
This is the list of exports from ntoskrnl. Taken from Windows XP SP2 Build 2600.
Name | # win xp |
CcCopyRead | 61 |
CcDeferWrite | 63 |
CcFastCopyWrite | 65 |
CcFastReadNotPossible | 67 |
CcFlushCache | 69 |
CcGetFileObjectFromBcb | 71 |
CcGetFlushedValidData | 73 |
CcInitializeCacheMap | 75 |
CcMapData | 77 |
CcMdlReadComplete | 79 |
CcMdlWriteComplete | 81 |
CcPinRead | 83 |
CcPreparePinWrite | 85 |
CcRemapBcb | 87 |
CcScheduleReadAhead | 89 |
CcSetBcbOwnerPointer | 91 |
CcSetDirtyPinnedData | 93 |
CcSetLogHandleForFile | 95 |
CcUninitializeCacheMap | 97 |
CcUnpinDataForThread | 99 |
CcWaitForCurrentLazyWriterActivity | 101 |
CmRegisterCallback | 103 |
DbgBreakPoint | 105 |
DbgLoadImageSymbols | 107 |
DbgPrintEx | 109 |
DbgPrompt | 111 |
DbgSetDebugFilterState | 113 |
ExAcquireResourceExclusiveLite | 114 |
ExAcquireRundownProtection | 2 |
ExAcquireSharedStarveExclusive | 116 |
ExAllocateFromPagedLookasideList | 118 |
ExAllocatePoolWithQuota | 120 |
ExAllocatePoolWithTag | 122 |
ExConvertExclusiveToSharedLite | 124 |
ExDeleteNPagedLookasideList | 126 |
ExDeleteResourceLite | 128 |
ExDisableResourceBoostLite | 130 |
ExEventObjectType | 132 |
ExFreePool | 134 |
ExFreeToPagedLookasideList | 136 |
ExGetCurrentProcessorCpuUsage | 138 |
ExGetPreviousMode | 140 |
ExInitializeNPagedLookasideList | 142 |
ExInitializeResourceLite | 144 |
ExInitializeZone | 145 |
ExInterlockedAddLargeStatistic | 5 |
ExInterlockedCompareExchange64 | 6 |
ExInterlockedExchangeUlong | 149 |
ExInterlockedFlushSList | 7 |
ExInterlockedInsertHeadList | 152 |
ExInterlockedPopEntryList | 154 |
ExInterlockedPushEntryList | 155 |
ExInterlockedRemoveHeadList | 156 |
ExIsResourceAcquiredExclusiveLite | 158 |
ExLocalTimeToSystemTime | 160 |
ExQueryPoolBlockSize | 162 |
ExRaiseAccessViolation | 164 |
ExRaiseException | 166 |
ExRaiseStatus | 168 |
ExRegisterCallback | 169 |
ExReleaseFastMutexUnsafe | 11 |
ExReleaseResourceLite | 12 |
ExReleaseRundownProtectionEx | 14 |
ExSemaphoreObjectType | 172 |
ExSetTimerResolution | 174 |
ExSystemTimeToLocalTime | 176 |
ExUuidCreate | 178 |
ExWaitForRundownProtectionRelease | 16 |
ExfAcquirePushLockExclusive | 17 |
ExfInterlockedAddUlong | 19 |
ExfInterlockedInsertHeadList | 21 |
ExfInterlockedPopEntryList | 23 |
ExfInterlockedRemoveHeadList | 25 |
Exfi386InterlockedDecrementLong | 27 |
Exfi386InterlockedIncrementLong | 29 |
Exi386InterlockedExchangeUlong | 182 |
FsRtlAcquireFileExclusive | 184 |
FsRtlAddMcbEntry | 186 |
FsRtlAllocateFileLock | 188 |
FsRtlAllocatePoolWithQuota | 190 |
FsRtlAllocatePoolWithTag | 192 |
FsRtlAreNamesEqual | 194 |
FsRtlCheckLockForReadAccess | 196 |
FsRtlCheckOplock | 198 |
FsRtlCopyWrite | 200 |
FsRtlDeleteKeyFromTunnelCache | 202 |
FsRtlDeregisterUncProvider | 204 |
FsRtlDissectName | 206 |
FsRtlDoesNameContainWildCards | 208 |
FsRtlFastCheckLockForWrite | 210 |
FsRtlFastUnlockAllByKey | 212 |
FsRtlFindInTunnelCache | 214 |
FsRtlGetFileSize | 216 |
FsRtlGetNextLargeMcbEntry | 218 |
FsRtlIncrementCcFastReadNoWait | 220 |
FsRtlIncrementCcFastReadResourceMiss | 222 |
FsRtlInitializeFileLock | 224 |
FsRtlInitializeMcb | 226 |
FsRtlInitializeTunnelCache | 228 |
FsRtlInsertPerStreamContext | 230 |
FsRtlIsFatDbcsLegal | 232 |
FsRtlIsNameInExpression | 234 |
FsRtlIsPagingFile | 236 |
FsRtlLegalAnsiCharacterArray | 238 |
FsRtlLookupLastLargeMcbEntry | 240 |
FsRtlLookupLastMcbEntry | 242 |
FsRtlLookupPerFileObjectContext | 244 |
FsRtlMdlRead | 246 |
FsRtlMdlReadCompleteDev | 248 |
FsRtlMdlWriteComplete | 250 |
FsRtlNormalizeNtstatus | 252 |
FsRtlNotifyCleanup | 254 |
FsRtlNotifyFilterReportChange | 256 |
FsRtlNotifyFullReportChange | 258 |
FsRtlNotifyReportChange | 260 |
FsRtlNotifyVolumeEvent | 262 |
FsRtlNumberOfRunsInMcb | 264 |
FsRtlOplockIsFastIoPossible | 266 |
FsRtlPostStackOverflow | 268 |
FsRtlPrepareMdlWriteDev | 270 |
FsRtlProcessFileLock | 272 |
FsRtlRegisterUncProvider | 274 |
FsRtlRemoveLargeMcbEntry | 276 |
FsRtlRemovePerFileObjectContext | 278 |
FsRtlResetLargeMcb | 280 |
FsRtlSyncVolumes | 282 |
FsRtlTruncateLargeMcb | 284 |
FsRtlUninitializeFileLock | 286 |
FsRtlUninitializeMcb | 288 |
HalDispatchTable | 290 |
HalPrivateDispatchTable | 291 |
InbvAcquireDisplayOwnership | 293 |
InbvDisplayString | 295 |
InbvEnableDisplayString | 297 |
InbvIsBootDriverInstalled | 299 |
InbvResetDisplay | 301 |
InbvSetTextColor | 303 |
InitSafeBootMode | 305 |
InterlockedDecrement | 32 |
InterlockedExchangeAdd | 34 |
InterlockedPopEntrySList | 36 |
IoAcquireCancelSpinLock | 306 |
IoAcquireVpbSpinLock | 308 |
IoAllocateAdapterChannel | 310 |
IoAllocateDriverObjectExtension | 312 |
IoAllocateIrp | 314 |
IoAllocateWorkItem | 316 |
IoAssignResources | 317 |
IoAttachDeviceByPointer | 319 |
IoAttachDeviceToDeviceStackSafe | 321 |
IoBuildDeviceIoControlRequest | 323 |
IoBuildSynchronousFsdRequest | 325 |
IoCancelFileOpen | 327 |
IoCheckDesiredAccess | 329 |
IoCheckFunctionAccess | 331 |
IoCheckQuerySetVolumeInformation | 333 |
IoCheckShareAccess | 335 |
IoConnectInterrupt | 337 |
IoCreateDevice | 339 |
IoCreateDriver | 341 |
IoCreateFileSpecifyDeviceObjectHint | 343 |
IoCreateStreamFileObject | 345 |
IoCreateStreamFileObjectLite | 347 |
IoCreateSynchronizationEvent | 349 |
IoCsqInitialize | 351 |
IoCsqRemoveIrp | 353 |
IoDeleteController | 355 |
IoDeleteDriver | 357 |
IoDetachDevice | 359 |
IoDeviceHandlerObjectType | 361 |
IoDisconnectInterrupt | 363 |
IoEnqueueIrp | 365 |
IoFastQueryNetworkAttributes | 367 |
IoForwardAndCatchIrp | 369 |
IoFreeController | 371 |
IoFreeIrp | 373 |
IoFreeWorkItem | 375 |
IoGetAttachedDeviceReference | 377 |
IoGetBootDiskInformation | 379 |
IoGetCurrentProcess | 381 |
IoGetDeviceInterfaceAlias | 383 |
IoGetDeviceObjectPointer | 385 |
IoGetDeviceToVerify | 387 |
IoGetDmaAdapter | 389 |
IoGetFileObjectGenericMapping | 391 |
IoGetLowerDeviceObject | 393 |
IoGetRequestorProcess | 395 |
IoGetRequestorSessionId | 397 |
IoGetTopLevelIrp | 399 |
IoInitializeRemoveLockEx | 401 |
IoInvalidateDeviceRelations | 403 |
IoIsFileOriginRemote | 405 |
IoIsSystemThread | 407 |
IoIsWdmVersionAvailable | 409 |
IoOpenDeviceInterfaceRegistryKey | 411 |
IoPageRead | 413 |
IoQueryDeviceDescription | 415 |
IoQueryFileInformation | 417 |
IoQueueThreadIrp | 419 |
IoRaiseHardError | 421 |
IoReadDiskSignature | 423 |
IoReadPartitionTable | 39 |
IoReadTransferCount | 426 |
IoRegisterDeviceInterface | 428 |
IoRegisterFileSystem | 430 |
IoRegisterLastChanceShutdownNotification | 432 |
IoRegisterShutdownNotification | 434 |
IoReleaseRemoveLockAndWaitEx | 436 |
IoReleaseVpbSpinLock | 438 |
IoReportDetectedDevice | 440 |
IoReportResourceForDetection | 442 |
IoReportTargetDeviceChange | 444 |
IoRequestDeviceEject | 446 |
IoSetCompletionRoutineEx | 448 |
IoSetDeviceToVerify | 450 |
IoSetHardErrorOrVerifyDevice | 452 |
IoSetIoCompletion | 454 |
IoSetPartitionInformationEx | 455 |
IoSetStartIoAttributes | 457 |
IoSetThreadHardErrorMode | 459 |
IoStartNextPacket | 461 |
IoStartPacket | 463 |
IoStatisticsLock | 465 |
IoSynchronousInvalidateDeviceRelations | 467 |
IoThreadToProcess | 469 |
IoUnregisterFsRegistrationChange | 471 |
IoUnregisterShutdownNotification | 473 |
IoValidateDeviceIoControlAccess | 475 |
IoVerifyVolume | 477 |
IoWMIAllocateInstanceIds | 479 |
IoWMIExecuteMethod | 481 |
IoWMIOpenBlock | 483 |
IoWMIQueryAllDataMultiple | 485 |
IoWMIQuerySingleInstanceMultiple | 487 |
IoWMISetNotificationCallback | 489 |
IoWMISetSingleItem | 491 |
IoWMIWriteEvent | 493 |
IoWriteOperationCount | 495 |
IoWritePartitionTableEx | 496 |
IofCallDriver | 42 |
KdDebuggerEnabled | 498 |
KdDisableDebugger | 500 |
KdEnteredDebugger | 502 |
KdPowerTransition | 504 |
Ke386IoSetAccessProcess | 506 |
Ke386SetIoAccessMap | 508 |
KeAcquireInterruptSpinLock | 509 |
KeAddSystemServiceTable | 511 |
KeAttachProcess | 513 |
KeBugCheckEx | 515 |
KeCapturePersistentThreadState | 517 |
KeConnectInterrupt | 519 |
KeDelayExecutionThread | 521 |
KeDeregisterBugCheckReasonCallback | 523 |
KeDisconnectInterrupt | 525 |
KeEnterKernelDebugger | 527 |
KeFindConfigurationNextEntry | 529 |
KeFlushQueuedDpcs | 531 |
KeGetPreviousMode | 533 |
KeI386AbiosCall | 535 |
KeI386Call16BitCStyleFunction | 537 |
KeI386FlatToGdtSelector | 539 |
KeI386MachineType | 541 |
KeI386ReleaseLid | 543 |
KeIcacheFlushCount | 545 |
KeInitializeDeviceQueue | 547 |
KeInitializeEvent | 549 |
KeInitializeMutant | 551 |
KeInitializeQueue | 553 |
KeInitializeSpinLock | 555 |
KeInitializeTimerEx | 557 |
KeInsertDeviceQueue | 559 |
KeInsertQueue | 561 |
KeInsertQueueDpc | 563 |
KeIsExecutingDpc | 565 |
KeLoaderBlock | 567 |
KeProfileInterrupt | 569 |
KePulseEvent | 571 |
KeQueryInterruptTime | 573 |
KeQueryRuntimeThread | 575 |
KeQueryTickCount | 577 |
KeRaiseUserException | 579 |
KeReadStateMutant | 581 |
KeReadStateQueue | 583 |
KeReadStateTimer | 585 |
KeRegisterBugCheckReasonCallback | 587 |
KeReleaseInterruptSpinLock | 588 |
KeReleaseMutex | 590 |
KeReleaseSpinLockFromDpcLevel | 592 |
KeRemoveByKeyDeviceQueueIfBusy | 594 |
KeRemoveEntryDeviceQueue | 596 |
KeRemoveQueueDpc | 598 |
KeResetEvent | 600 |
KeRevertToUserAffinityThread | 602 |
KeSaveFloatingPointState | 604 |
KeServiceDescriptorTable | 606 |
KeSetBasePriorityThread | 608 |
KeSetEvent | 610 |
KeSetIdealProcessorThread | 612 |
KeSetKernelStackSwapEnable | 614 |
KeSetProfileIrql | 616 |
KeSetTargetProcessorDpc | 618 |
KeSetTimeUpdateNotifyRoutine | 46 |
KeSetTimerEx | 621 |
KeSynchronizeExecution | 623 |
KeTickCount | 625 |
KeUpdateRunTime | 627 |
KeUserModeCallback | 629 |
KeWaitForMutexObject | 631 |
KefAcquireSpinLockAtDpcLevel | 47 |
Kei386EoiHelper | 58 |
KiBugCheckData | 633 |
KiDeliverApc | 635 |
KiEnableTimerWatchdog | 637 |
KiReleaseSpinLock | 50 |
Kii386SpinOnSpinLock | 59 |
LdrEnumResources | 641 |
LdrFindResource_U | 643 |
LpcRequestPort | 645 |
LsaCallAuthenticationPackage | 647 |
LsaFreeReturnBuffer | 649 |
LsaLookupAuthenticationPackage | 651 |
Mm64BitPhysicalAddress | 653 |
MmAddVerifierThunks | 655 |
MmAdvanceMdl | 657 |
MmAllocateContiguousMemorySpecifyCache | 659 |
MmAllocateNonCachedMemory | 661 |
MmBuildMdlForNonPagedPool | 663 |
MmCommitSessionMappedView | 665 |
MmCreateSection | 667 |
MmFlushImageSection | 669 |
MmFreeContiguousMemory | 671 |
MmFreeMappingAddress | 673 |
MmFreePagesFromMdl | 675 |
MmGetPhysicalMemoryRanges | 677 |
MmGetVirtualForPhysical | 679 |
MmHighestUserAddress | 681 |
MmIsDriverVerifying | 683 |
MmIsRecursiveIoFault | 685 |
MmIsVerifierEnabled | 687 |
MmLockPagableImageSection | 689 |
MmMapIoSpace | 691 |
MmMapLockedPagesSpecifyCache | 693 |
MmMapMemoryDumpMdl | 695 |
MmMapVideoDisplay | 697 |
MmMapViewInSystemSpace | 699 |
MmMarkPhysicalMemoryAsBad | 701 |
MmPageEntireDriver | 703 |
MmProbeAndLockPages | 705 |
MmProbeAndLockSelectedPages | 707 |
MmQuerySystemSize | 709 |
MmResetDriverPaging | 711 |
MmSecureVirtualMemory | 713 |
MmSetBankedSection | 715 |
MmSystemRangeStart | 717 |
MmUnlockPagableImageSection | 719 |
MmUnmapIoSpace | 721 |
MmUnmapReservedMapping | 723 |
MmUnmapViewInSessionSpace | 725 |
MmUnmapViewOfSection | 727 |
MmUserProbeAddress | 729 |
NlsLeadByteInfo | 731 |
NlsMbOemCodePageTag | 733 |
NlsOemLeadByteInfo | 735 |
NtAdjustPrivilegesToken | 737 |
NtAllocateUuids | 739 |
NtBuildNumber | 741 |
NtConnectPort | 743 |
NtCreateFile | 745 |
NtDeleteAtom | 747 |
NtDeviceIoControlFile | 749 |
NtDuplicateToken | 751 |
NtFreeVirtualMemory | 753 |
NtGlobalFlag | 755 |
NtMakePermanentObject | 757 |
NtNotifyChangeDirectoryFile | 759 |
NtOpenProcess | 761 |
NtOpenProcessTokenEx | 763 |
NtOpenThreadToken | 765 |
NtQueryDirectoryFile | 767 |
NtQueryInformationAtom | 769 |
NtQueryInformationProcess | 771 |
NtQueryInformationToken | 773 |
NtQuerySecurityObject | 775 |
NtQueryVolumeInformationFile | 777 |
NtRequestPort | 779 |
NtSetEaFile | 781 |
NtSetInformationFile | 783 |
NtSetInformationThread | 785 |
NtSetSecurityObject | 787 |
NtShutdownSystem | 789 |
NtUnlockFile | 791 |
NtWaitForSingleObject | 793 |
ObAssignSecurity | 795 |
ObCheckObjectAccess | 797 |
ObCreateObject | 799 |
ObDereferenceObject | 801 |
ObFindHandleForObject | 803 |
ObInsertObject | 805 |
ObMakeTemporaryObject | 807 |
ObOpenObjectByPointer | 809 |
ObQueryObjectAuditingByHandle | 811 |
ObReferenceObjectByName | 813 |
ObReferenceSecurityDescriptor | 815 |
ObSetHandleAttributes | 817 |
ObSetSecurityObjectByPointer | 819 |
ObfReferenceObject | 52 |
PfxInitialize | 821 |
PfxRemovePrefix | 823 |
PoCancelDeviceNotify | 825 |
PoRegisterDeviceForIdleDetection | 827 |
PoRegisterSystemState | 829 |
PoRequestShutdownEvent | 831 |
PoSetPowerState | 833 |
PoShutdownBugCheck | 835 |
PoUnregisterSystemState | 837 |
ProbeForWrite | 839 |
PsChargePoolQuota | 841 |
PsChargeProcessPagedPoolQuota | 843 |
PsCreateSystemProcess | 845 |
PsDereferenceImpersonationToken | 847 |
PsDisableImpersonation | 849 |
PsGetContextThread | 851 |
PsGetCurrentProcessId | 853 |
PsGetCurrentThread | 855 |
PsGetCurrentThreadPreviousMode | 857 |
PsGetCurrentThreadStackLimit | 859 |
PsGetJobSessionId | 861 |
PsGetProcessCreateTimeQuadPart | 863 |
PsGetProcessExitProcessCalled | 865 |
PsGetProcessExitTime | 867 |
PsGetProcessImageFileName | 869 |
PsGetProcessJob | 871 |
PsGetProcessPriorityClass | 873 |
PsGetProcessSecurityPort | 875 |
PsGetProcessWin32Process | 877 |
PsGetThreadFreezeCount | 879 |
PsGetThreadId | 881 |
PsGetThreadProcessId | 883 |
PsGetThreadTeb | 885 |
PsGetVersion | 887 |
PsInitialSystemProcess | 889 |
PsIsSystemThread | 891 |
PsIsThreadTerminating | 893 |
PsLookupProcessByProcessId | 895 |
PsLookupThreadByThreadId | 897 |
PsReferenceImpersonationToken | 899 |
PsRemoveCreateThreadNotifyRoutine | 901 |
PsRestoreImpersonation | 903 |
PsReturnProcessNonPagedPoolQuota | 905 |
PsRevertThreadToSelf | 907 |
PsSetContextThread | 909 |
PsSetCreateThreadNotifyRoutine | 911 |
PsSetLegoNotifyRoutine | 913 |
PsSetProcessPriorityByClass | 915 |
PsSetProcessSecurityPort | 917 |
PsSetProcessWindowStation | 919 |
PsSetThreadWin32Thread | 921 |
PsThreadType | 923 |
READ_REGISTER_BUFFER_ULONG | 925 |
READ_REGISTER_UCHAR | 927 |
READ_REGISTER_USHORT | 929 |
RtlAddAccessAllowedAce | 931 |
RtlAddAce | 933 |
RtlAddRange | 935 |
RtlAnsiCharToUnicodeChar | 937 |
RtlAnsiStringToUnicodeString | 939 |
RtlAppendStringToString | 941 |
RtlAppendUnicodeToString | 943 |
RtlAreAnyAccessesGranted | 945 |
RtlAreBitsSet | 947 |
RtlCaptureContext | 949 |
RtlCharToInteger | 951 |
RtlClearAllBits | 953 |
RtlClearBits | 955 |
RtlCompareMemoryUlong | 957 |
RtlCompareUnicodeString | 959 |
RtlCompressChunks | 961 |
RtlConvertSidToUnicodeString | 963 |
RtlCopyLuid | 965 |
RtlCopySid | 967 |
RtlCopyUnicodeString | 969 |
RtlCreateAtomTable | 971 |
RtlCreateRegistryKey | 973 |
RtlCreateSystemVolumeInformationFolder | 975 |
RtlCustomCPToUnicodeN | 977 |
RtlDecompressChunks | 979 |
RtlDelete | 981 |
RtlDeleteAtomFromAtomTable | 983 |
RtlDeleteElementGenericTableAvl | 985 |
RtlDeleteOwnersRanges | 987 |
RtlDeleteRegistryValue | 989 |
RtlDestroyAtomTable | 991 |
RtlDowncaseUnicodeString | 993 |
RtlEnlargedIntegerMultiply | 995 |
RtlEnlargedUnsignedMultiply | 997 |
RtlEnumerateGenericTableAvl | 999 |
RtlEnumerateGenericTableWithoutSplaying | 1001 |
RtlEqualLuid | 1003 |
RtlEqualString | 1005 |
RtlExtendedIntegerMultiply | 1007 |
RtlExtendedMagicDivide | 1009 |
RtlFillMemoryUlong | 1011 |
RtlFindClearBitsAndSet | 1013 |
RtlFindFirstRunClear | 1015 |
RtlFindLeastSignificantBit | 1017 |
RtlFindMessage | 1019 |
RtlFindNextForwardRunClear | 1021 |
RtlFindSetBits | 1023 |
RtlFindUnicodePrefix | 1025 |
RtlFreeAnsiString | 1027 |
RtlFreeOemString | 1029 |
RtlFreeUnicodeString | 1031 |
RtlGenerate8dot3Name | 1033 |
RtlGetCallersAddress | 1035 |
RtlGetDaclSecurityDescriptor | 1037 |
RtlGetElementGenericTable | 1039 |
RtlGetFirstRange | 1041 |
RtlGetNextRange | 1043 |
RtlGetOwnerSecurityDescriptor | 1045 |
RtlGetSetBootStatusData | 1047 |
RtlHashUnicodeString | 1049 |
RtlImageNtHeader | 1051 |
RtlInitCodePageTable | 1053 |
RtlInitUnicodeString | 1055 |
RtlInitializeGenericTable | 1057 |
RtlInitializeRangeList | 1059 |
RtlInitializeUnicodePrefix | 1061 |
RtlInsertElementGenericTableAvl | 1063 |
RtlInsertElementGenericTableFullAvl | 1065 |
RtlInt64ToUnicodeString | 1067 |
RtlIntegerToUnicode | 1069 |
RtlInvertRangeList | 1071 |
RtlIpv4AddressToStringExA | 1073 |
RtlIpv4AddressToStringW | 1075 |
RtlIpv4StringToAddressExA | 1077 |
RtlIpv4StringToAddressW | 1079 |
RtlIpv6AddressToStringExA | 1081 |
RtlIpv6AddressToStringW | 1083 |
RtlIpv6StringToAddressExA | 1085 |
RtlIpv6StringToAddressW | 1087 |
RtlIsGenericTableEmptyAvl | 1089 |
RtlIsRangeAvailable | 1091 |
RtlLargeIntegerAdd | 1093 |
RtlLargeIntegerDivide | 1095 |
RtlLargeIntegerShiftLeft | 1097 |
RtlLargeIntegerSubtract | 1099 |
RtlLengthSecurityDescriptor | 1101 |
RtlLockBootStatusData | 1103 |
RtlLookupElementGenericTable | 1105 |
RtlLookupElementGenericTableFull | 1107 |
RtlMapGenericMask | 1109 |
RtlMergeRangeLists | 1111 |
RtlMultiByteToUnicodeN | 1113 |
RtlNextUnicodePrefix | 1115 |
RtlNtStatusToDosErrorNoTeb | 1117 |
RtlNumberGenericTableElementsAvl | 1119 |
RtlNumberOfSetBits | 1121 |
RtlOemStringToUnicodeSize | 1123 |
RtlOemToUnicodeN | 1125 |
RtlPrefetchMemoryNonTemporal | 53 |
RtlPrefixUnicodeString | 1128 |
RtlQueryRegistryValues | 1130 |
RtlRaiseException | 1132 |
RtlRandomEx | 1134 |
RtlRealSuccessor | 1136 |
RtlReserveChunk | 1138 |
RtlSecondsSince1980ToTime | 1140 |
RtlSelfRelativeToAbsoluteSD2 | 1141 |
RtlSetBit | 1144 |
RtlSetDaclSecurityDescriptor | 1146 |
RtlSetOwnerSecurityDescriptor | 1148 |
RtlSetTimeZoneInformation | 1150 |
RtlSplay | 1152 |
RtlSubAuthorityCountSid | 1154 |
RtlSubtreePredecessor | 1156 |
RtlTestBit | 1158 |
RtlTimeToElapsedTimeFields | 1160 |
RtlTimeToSecondsSince1980 | 1162 |
RtlTraceDatabaseAdd | 1164 |
RtlTraceDatabaseDestroy | 1166 |
RtlTraceDatabaseFind | 1168 |
RtlTraceDatabaseUnlock | 1170 |
RtlUlongByteSwap | 54 |
RtlUnicodeStringToAnsiSize | 1172 |
RtlUnicodeStringToCountedOemString | 1174 |
RtlUnicodeStringToOemSize | 1176 |
RtlUnicodeToCustomCPN | 1178 |
RtlUnicodeToMultiByteSize | 1180 |
RtlUnlockBootStatusData | 1182 |
RtlUpcaseUnicodeChar | 1184 |
RtlUpcaseUnicodeStringToAnsiString | 1186 |
RtlUpcaseUnicodeStringToOemString | 1188 |
RtlUpcaseUnicodeToMultiByteN | 1190 |
RtlUpperChar | 1192 |
RtlUshortByteSwap | 56 |
RtlValidSecurityDescriptor | 1195 |
RtlVerifyVersionInfo | 1197 |
RtlWalkFrameChain | 1199 |
RtlZeroHeap | 1201 |
RtlxAnsiStringToUnicodeSize | 1203 |
RtlxUnicodeStringToAnsiSize | 1205 |
SeAccessCheck | 1207 |
SeAssignSecurity | 1209 |
SeAuditHardLinkCreation | 1211 |
SeAuditingFileEventsWithContext | 1213 |
SeAuditingHardLinkEvents | 1215 |
SeCaptureSecurityDescriptor | 1217 |
SeCloseObjectAuditAlarm | 1219 |
SeCreateClientSecurity | 1221 |
SeDeassignSecurity | 1223 |
SeDeleteObjectAuditAlarm | 1225 |
SeFilterToken | 1227 |
SeImpersonateClient | 1229 |
SeLockSubjectContext | 1231 |
SeOpenObjectAuditAlarm | 1233 |
SePrivilegeCheck | 1235 |
SePublicDefaultDacl | 1237 |
SeQueryInformationToken | 1239 |
SeQuerySessionIdToken | 1241 |
SeReleaseSecurityDescriptor | 1243 |
SeSetAccessStateGenericMapping | 1245 |
SeSetSecurityDescriptorInfoEx | 1247 |
SeSystemDefaultDacl | 1249 |
SeTokenIsAdmin | 1251 |
SeTokenIsWriteRestricted | 1253 |
SeTokenType | 1255 |
SeUnregisterLogonSessionTerminatedRoutine | 1257 |
VerSetConditionMask | 1259 |
VfFailDriver | 1261 |
VfIsVerificationEnabled | 1263 |
WRITE_REGISTER_BUFFER_ULONG | 1265 |
WRITE_REGISTER_UCHAR | 1267 |
WRITE_REGISTER_USHORT | 1269 |
WmiGetClock | 57 |
WmiQueryTraceInformation | 1272 |
WmiStopTrace | 1274 |
WmiTraceMessageVa | 1276 |
XIPDispatch | 1278 |
ZwAddBootEntry | 1280 |
ZwAlertThread | 1282 |
ZwAssignProcessToJobObject | 1284 |
ZwCancelTimer | 1286 |
ZwClose | 1288 |
ZwConnectPort | 1290 |
ZwCreateEvent | 1292 |
ZwCreateJobObject | 1294 |
ZwCreateSection | 1296 |
ZwCreateTimer | 1298 |
ZwDeleteFile | 1300 |
ZwDeleteValueKey | 1302 |
ZwDisplayString | 1304 |
ZwDuplicateToken | 1306 |
ZwEnumerateKey | 1308 |
ZwFlushInstructionCache | 1310 |
ZwFlushVirtualMemory | 1312 |
ZwFsControlFile | 1314 |
ZwIsProcessInJob | 1316 |
ZwLoadKey | 1318 |
ZwMapViewOfSection | 1320 |
ZwOpenDirectoryObject | 1322 |
ZwOpenFile | 1324 |
ZwOpenKey | 1326 |
ZwOpenProcessToken | 1328 |
ZwOpenSection | 1330 |
ZwOpenThread | 1332 |
ZwOpenThreadTokenEx | 1334 |
ZwPowerInformation | 1336 |
ZwQueryBootEntryOrder | 1338 |
ZwQueryDefaultLocale | 1340 |
ZwQueryDirectoryFile | 1342 |
ZwQueryEaFile | 1344 |
ZwQueryInformationFile | 1346 |
ZwQueryInformationProcess | 1348 |
ZwQueryInformationToken | 1350 |
ZwQueryKey | 1352 |
ZwQuerySection | 1354 |
ZwQuerySymbolicLinkObject | 1356 |
ZwQueryValueKey | 1358 |
ZwReadFile | 1360 |
ZwRequestWaitReplyPort | 1362 |
ZwRestoreKey | 1364 |
ZwSaveKeyEx | 1366 |
ZwSetBootOptions | 1368 |
ZwSetDefaultUILanguage | 1370 |
ZwSetEvent | 1372 |
ZwSetInformationJobObject | 1374 |
ZwSetInformationProcess | 1376 |
ZwSetSecurityObject | 1378 |
ZwSetSystemTime | 1380 |
ZwSetValueKey | 1382 |
ZwTerminateJobObject | 1384 |
ZwTranslateFilePath | 1386 |
ZwUnloadKey | 1388 |
ZwWaitForMultipleObjects | 1390 |
ZwWriteFile | 1392 |
_CIcos | 1394 |
_CIsqrt | 1396 |
_alldiv | 1398 |
_allmul | 1400 |
_allrem | 1402 |
_allshr | 1404 |
_aulldvrm | 1406 |
_aullshr | 1408 |
_except_handler3 | 1410 |
_itoa | 1412 |
_local_unwind2 | 1414 |
_snprintf | 1416 |
_stricmp | 1418 |
_strnicmp | 1420 |
_strrev | 1422 |
_strupr | 1424 |
_vsnwprintf | 1426 |
_wcslwr | 1428 |
_wcsnset | 1430 |
_wcsupr | 1432 |
atol | 1434 |
islower | 1436 |
isspace | 1438 |
isxdigit | 1440 |
mbtowc | 1442 |
memcpy | 1444 |
memset | 1446 |
rand | 1448 |
srand | 1450 |
strchr | 1452 |
strcpy | 1454 |
strncat | 1456 |
strncpy | 1458 |
strspn | 1460 |
swprintf | 1462 |
toupper | 1464 |
towupper | 1466 |
vDbgPrintExWithPrefix | 1468 |
wcscat | 1470 |
wcscmp | 1472 |
wcscspn | 1474 |
wcsncat | 1476 |
wcsncpy | 1478 |
wcsspn | 1480 |
wcstombs | 1482 |