36 files changed, 16299 insertions, 0 deletions

diff --git a/private/ntos/init/alphadef.src b/private/ntos/init/alphadef.src
new file mode 100644
index 000000000..0c72a393e
--- /dev/null
+++ b/private/ntos/init/alphadef.src
@@ -0,0 +1,117 @@
+    ExAcquireFastMutex
+    ExReleaseFastMutex
+    ExTryToAcquireFastMutex
+
+    ExAlphaInterlockedDecrementLong
+    ExAlphaInterlockedIncrementLong
+    ExAlphaInterlockedExchangeUlong
+
+    ExpInterlockedCompareExchange64
+    ExpInterlockedPopEntrySList
+    ExpInterlockedPushEntrySList
+
+    InterlockedCompareExchange
+    InterlockedExchangeAdd
+
+    KeAcquireSpinLock
+    KeAcquireSpinLockRaiseToDpc
+    KeReleaseSpinLock
+    KeRaiseIrql
+    KeLowerIrql
+    KeSetSynchIrql
+    KeGetCurrentIrql
+    KeGetCurrentPrcb
+    KeGetCurrentThread
+    KeGetPcr
+    KeFlushCurrentTb
+    KeFlushIoBuffers
+    KeIpiInterrupt
+    KiIpiGenericCall
+    KiIpiSend
+    KiIpiSendPacket
+    KiRequestSoftwareInterrupt
+    KeIsExecutingDpc
+
+    MmLockPagableImageSection=MmLockPagableDataSection
+
+    __C_specific_handler
+    __jump_unwind
+
+    RtlpExecuteExceptionFilter
+    RtlpExecuteTerminationHandler
+    __2divl
+    __2divlu
+    __2divq
+    __2divqu
+    longjmp
+    _OtsCSpecificHandler
+    _OtsDivide32
+    _OtsDivide32Overflow
+    _OtsDivide32Unsigned
+    _OtsDivide64
+    _OtsDivide64Overflow
+    _OtsDivide64Unsigned
+    _OtsFieldExtractSigned
+    _OtsFieldExtractSignedVolatile
+    _OtsFieldExtractUnsigned
+    _OtsFieldExtractUnsignedVolatile
+    _OtsFieldInsert
+    _OtsFieldInsertVolatile
+    _OtsFill
+    _OtsLocalFinallyUnwind
+    _OtsModulus32
+    _OtsModulus64
+    _OtsMove
+    _OtsMoveMinimum
+    _OtsRemainder32
+    _OtsRemainder32Unsigned
+    _OtsRemainder64
+    _OtsRemainder64Unsigned
+    _Otssetjmp3
+    _Otssetjmpex3
+    _Otsstrcmp
+    _Otsstrcpy
+    _Otsstrlen
+    _OtsStringCompareEql
+    _OtsStringCompareEqlPadded
+    _OtsStringCompareEqlSameLen
+    _OtsStringCompareLeq
+    _OtsStringCompareLeqPadded
+    _OtsStringCompareLeqSameLen
+    _OtsStringCompareLss
+    _OtsStringCompareLssPadded
+    _OtsStringCompareLssSameLen
+    _OtsStringIndex
+    _OtsStringIndexChar
+    _OtsStringSearch
+    _OtsStringSearchChar
+    _OtsStringSearchMask
+    _OtsStringTranslate
+    _OtsStringVerify
+    _OtsStringVerifyChar
+    _OtsStringVerifyMask
+    _OtsUnwindRfp
+    _OtsZero
+    __2reml
+    __2remlu
+    __2remq
+    __2remqu
+    RtlCaptureContext
+    RtlLookupFunctionEntry
+    RtlVirtualUnwind
+    RtlUnwindRfp
+    RtlUnwindReturn
+    setjmp
+    _setjmpex
+
+    memcmp
+    memcpy
+    memmove
+    memset
+
+    strcat
+    strcmp
+    strcpy
+    strlen
+
+    RtlCopyBytes
diff --git a/private/ntos/init/dirs b/private/ntos/init/dirs
new file mode 100644
index 000000000..a2a38f0fd
--- /dev/null
+++ b/private/ntos/init/dirs
@@ -0,0 +1,24 @@
+!IF 0
+
+Copyright (c) 1989  Microsoft Corporation
+
+Module Name:
+
+    dirs.
+
+Abstract:
+
+    This file specifies the subdirectories of the current directory that
+    contain component makefiles.
+
+
+Author:
+
+
+NOTE:   Commented description of this file is in \nt\bak\bin\dirs.tpl
+
+!ENDIF
+
+DIRS=up
+
+OPTIONAL_DIRS=mp
diff --git a/private/ntos/init/hello.c b/private/ntos/init/hello.c
new file mode 100644
index 000000000..02f1f7ec3
--- /dev/null
+++ b/private/ntos/init/hello.c
@@ -0,0 +1,8 @@
+
+#include <nt.h>
+
+main()
+{
+    DbgPrint("Hisssssssssssssssss, Viper Lives\n");
+    DbgBreakPoint();
+}
diff --git a/private/ntos/init/i386/sources b/private/ntos/init/i386/sources
new file mode 100644
index 000000000..8fd35ada0
--- /dev/null
+++ b/private/ntos/init/i386/sources
@@ -0,0 +1 @@
+LINKER_FLAGS = $(LINKER_FLAGS) -calltree
diff --git a/private/ntos/init/i386def.src b/private/ntos/init/i386def.src
new file mode 100644
index 000000000..192f0c90f
--- /dev/null
+++ b/private/ntos/init/i386def.src
@@ -0,0 +1,111 @@
+    Exi386InterlockedDecrementLong
+    Exi386InterlockedIncrementLong
+    Exi386InterlockedExchangeUlong
+
+    ExfInterlockedAddUlong
+    ExfInterlockedInsertHeadList
+    ExfInterlockedInsertTailList
+    ExfInterlockedRemoveHeadList
+    ExfInterlockedPopEntryList
+    ExfInterlockedPushEntryList
+    Exfi386InterlockedDecrementLong
+    Exfi386InterlockedIncrementLong
+    Exfi386InterlockedExchangeUlong
+
+    ExInterlockedCompareExchange64
+    ExInterlockedPopEntrySList
+    ExInterlockedPushEntrySList
+
+    ExAllocateFromPagedLookasideList
+    ExFreeToPagedLookasideList
+
+    InterlockedIncrement
+    InterlockedDecrement
+    InterlockedExchange
+    InterlockedCompareExchange
+    InterlockedExchangeAdd
+
+    KeSetProfileIrql
+    KeIsExecutingDpc
+    KeI386MachineType CONSTANT
+    KeI386SetGdtSelector
+    KeI386Call16BitFunction
+    KeI386Call16BitCStyleFunction
+
+    KefAcquireSpinLockAtDpcLevel
+    KefReleaseSpinLockFromDpcLevel
+
+#if NT_INST
+
+    KiInst_AcquireSpinLock
+    KiInst_SpinOnSpinLock
+    KiInst_ReleaseSpinLock
+
+#endif  // NT_INST
+
+    Kii386SpinOnSpinLock                // debug only
+
+    MmLockPagableImageSection=MmLockPagableDataSection
+
+//
+// The following are macros on MIPS, but real procedures on the x86
+//
+
+    KeGetCurrentThread
+    KeGetPreviousMode
+    READ_REGISTER_UCHAR
+    READ_REGISTER_ULONG
+    READ_REGISTER_USHORT
+    READ_REGISTER_BUFFER_UCHAR
+    READ_REGISTER_BUFFER_ULONG
+    READ_REGISTER_BUFFER_USHORT
+    WRITE_REGISTER_UCHAR
+    WRITE_REGISTER_ULONG
+    WRITE_REGISTER_USHORT
+    WRITE_REGISTER_BUFFER_UCHAR
+    WRITE_REGISTER_BUFFER_ULONG
+    WRITE_REGISTER_BUFFER_USHORT
+
+//
+// The following are 386 architecture specific
+//
+
+    KiIpiServiceRoutine
+    KiCoprocessorError
+    KiDeliverApc
+    KiDispatchInterrupt
+    KiUnexpectedInterrupt
+    Kei386EoiHelper
+
+    Ke386IoSetAccessProcess
+    Ke386QueryIoAccessMap
+    Ke386SetIoAccessMap
+
+    KeI386AbiosCall
+    KeI386AllocateGdtSelectors
+    KeI386ReleaseGdtSelectors
+    KeI386FlatToGdtSelector
+    KeI386GetLid
+    KeI386ReleaseLid
+    Ke386CallBios
+    KeSaveFloatingPointState
+    KeRestoreFloatingPointState
+
+    memcpy
+    memmove
+    memset
+
+    _abnormal_termination
+    _except_handler2
+    _global_unwind2
+    _local_unwind2
+// Int64 helper functions (currently linked in from int64.lib)
+
+    _aullrem
+    _aulldiv
+    _aullshr
+    _allshr
+    _allshl
+    _allrem
+    _allmul
+    _alldiv
diff --git a/private/ntos/init/init.c b/private/ntos/init/init.c
new file mode 100644
index 000000000..ffcd4423d
--- /dev/null
+++ b/private/ntos/init/init.c
@@ -0,0 +1,2067 @@
+/*++
+
+Copyright (c) 1989  Microsoft Corporation
+
+Module Name:
+
+    init.c
+
+Abstract:
+
+    Main source file the NTOS system initialization subcomponent.
+
+Author:
+
+    Steve Wood (stevewo) 31-Mar-1989
+
+Revision History:
+
+--*/
+
+
+#include "ntos.h"
+#include "ntimage.h"
+#include <zwapi.h>
+#include <ntdddisk.h>
+#include <fsrtl.h>
+#include <ntverp.h>
+
+#include "stdlib.h"
+#include "stdio.h"
+#include <string.h>
+
+UNICODE_STRING NtSystemRoot;
+PVOID ExPageLockHandle;
+
+VOID
+ExpInitializeExecutive(
+    IN ULONG Number,
+    IN PLOADER_PARAMETER_BLOCK LoaderBlock
+    );
+
+NTSTATUS
+CreateSystemRootLink(
+    IN PLOADER_PARAMETER_BLOCK LoaderBlock
+    );
+
+static USHORT
+NameToOrdinal (
+    IN PSZ NameOfEntryPoint,
+    IN ULONG DllBase,
+    IN ULONG NumberOfNames,
+    IN PULONG NameTableBase,
+    IN PUSHORT NameOrdinalTableBase
+    );
+
+NTSTATUS
+LookupEntryPoint (
+    IN PVOID DllBase,
+    IN PSZ NameOfEntryPoint,
+    OUT PVOID *AddressOfEntryPoint
+    );
+
+#if i386
+VOID
+KiRestoreInterrupts (
+    IN BOOLEAN  Restore
+    );
+#endif
+
+VOID
+ExBurnMemory(
+    IN PLOADER_PARAMETER_BLOCK LoaderBlock
+    );
+
+#ifdef ALLOC_PRAGMA
+#pragma alloc_text(INIT,ExpInitializeExecutive)
+#pragma alloc_text(INIT,Phase1Initialization)
+#pragma alloc_text(INIT,CreateSystemRootLink)
+#pragma alloc_text(INIT,NameToOrdinal)
+#pragma alloc_text(INIT,LookupEntryPoint)
+#pragma alloc_text(INIT,ExBurnMemory)
+#endif
+
+
+//
+// Define global static data used during initialization.
+//
+
+
+ULONG NtGlobalFlag;
+extern PMESSAGE_RESOURCE_BLOCK KiBugCheckMessages;
+
+ULONG NtMajorVersion;
+ULONG NtMinorVersion;
+
+#if DBG
+ULONG NtBuildNumber = VER_PRODUCTBUILD | 0xC0000000;
+#else
+ULONG NtBuildNumber = VER_PRODUCTBUILD | 0xF0000000;
+#endif
+
+ULONG InitializationPhase;  // bss 0
+
+extern LIST_ENTRY PsLoadedModuleList;
+extern KiServiceLimit;
+extern PMESSAGE_RESOURCE_DATA  KiBugCodeMessages;
+
+extern CM_SYSTEM_CONTROL_VECTOR CmControlVector[];
+ULONG CmNtGlobalFlag;
+ULONG CmNtCSDVersion;
+UNICODE_STRING CmVersionString;
+UNICODE_STRING CmCSDVersionString;
+
+//
+// Define working set watch enabled.
+//
+BOOLEAN PsWatchEnabled = FALSE;
+
+#if i386
+
+typedef struct _EXLOCK {
+    KSPIN_LOCK SpinLock;
+    KIRQL Irql;
+} EXLOCK, *PEXLOCK;
+
+BOOLEAN
+ExpOkayToLockRoutine(
+    IN PEXLOCK Lock
+    )
+{
+    return TRUE;
+}
+
+NTSTATUS
+ExpInitializeLockRoutine(
+    PEXLOCK Lock
+    )
+{
+    KeInitializeSpinLock(&Lock->SpinLock);
+    return STATUS_SUCCESS;
+}
+
+NTSTATUS
+ExpAcquireLockRoutine(
+    PEXLOCK Lock
+    )
+{
+    ExAcquireSpinLock(&Lock->SpinLock,&Lock->Irql);
+    return STATUS_SUCCESS;
+}
+
+NTSTATUS
+ExpReleaseLockRoutine(
+    PEXLOCK Lock
+    )
+{
+    ExReleaseSpinLock(&Lock->SpinLock,Lock->Irql);
+    return STATUS_SUCCESS;
+}
+
+NTSTATUS
+ExpDeleteLockRoutine(
+    PEXLOCK Lock
+    )
+{
+    return STATUS_SUCCESS;
+}
+
+#endif // i386
+
+
+
+NLSTABLEINFO InitTableInfo;
+ULONG InitNlsTableSize;
+PVOID InitNlsTableBase;
+ULONG InitAnsiCodePageDataOffset;
+ULONG InitOemCodePageDataOffset;
+ULONG InitUnicodeCaseTableDataOffset;
+PVOID InitNlsSectionPointer;
+
+VOID
+ExBurnMemory(
+    IN PLOADER_PARAMETER_BLOCK LoaderBlock
+    )
+{
+    PLIST_ENTRY ListHead;
+    PMEMORY_ALLOCATION_DESCRIPTOR MemoryDescriptor;
+    PLIST_ENTRY NextEntry;
+    PCHAR TypeOfMemory;
+    PCHAR Options;
+    PCHAR BurnMemoryOption;
+    PCHAR NumProcOption;
+    ULONG BurnMemoryAmount;
+    ULONG PagesToBurn;
+    ULONG PagesBurned;
+    ULONG NewRegisteredProcessors;
+#if !defined(NT_UP)
+    extern ULONG KeRegisteredProcessors;
+#endif
+
+    if (LoaderBlock->LoadOptions == NULL) {
+        return;
+        }
+
+    Options = LoaderBlock->LoadOptions;
+    _strupr(Options);
+
+#if !defined(NT_UP)
+    NumProcOption = strstr(Options, "NUMPROC");
+    if (NumProcOption != NULL) {
+        NumProcOption = strstr(NumProcOption,"=");
+    }
+    if (NumProcOption != NULL) {
+        NewRegisteredProcessors = atol(NumProcOption+1);
+        if (NewRegisteredProcessors < KeRegisteredProcessors) {
+            KeRegisteredProcessors = NewRegisteredProcessors;
+            DbgPrint("INIT: NumProcessors = %d\n",KeRegisteredProcessors);
+        }
+    }
+#endif
+
+    BurnMemoryOption = strstr(Options, "BURNMEMORY");
+    if (BurnMemoryOption == NULL ) {
+        return;
+        }
+
+    BurnMemoryOption = strstr(BurnMemoryOption,"=");
+    if (BurnMemoryOption == NULL ) {
+        return;
+        }
+    BurnMemoryAmount = atol(BurnMemoryOption+1);
+    PagesToBurn = (BurnMemoryAmount*(1024*1024))/PAGE_SIZE;
+
+    DbgPrint("INIT: BurnAmount %dmb -> %d pages\n",BurnMemoryAmount,PagesToBurn);
+
+    ListHead = &LoaderBlock->MemoryDescriptorListHead;
+    NextEntry = ListHead->Flink;
+    PagesBurned = 0;
+    do {
+        MemoryDescriptor = CONTAINING_RECORD(NextEntry,
+                                             MEMORY_ALLOCATION_DESCRIPTOR,
+                                             ListEntry);
+
+        if (MemoryDescriptor->MemoryType == LoaderFree ||
+            MemoryDescriptor->MemoryType == LoaderFirmwareTemporary ) {
+
+            if ( PagesBurned < PagesToBurn ) {
+
+                //
+                // We still need to chew up some memory
+                //
+
+                if ( MemoryDescriptor->PageCount > (PagesToBurn - PagesBurned) ) {
+
+                    //
+                    // This block has more than enough pages to satisfy us...
+                    // simply change its page count
+                    //
+
+                    DbgPrint("INIT: BasePage %5lx PageCount %5d ReducedBy %5d to %5d\n",
+                        MemoryDescriptor->BasePage,
+                        MemoryDescriptor->PageCount,
+                        (PagesToBurn - PagesBurned),
+                        MemoryDescriptor->PageCount - (PagesToBurn - PagesBurned)
+                        );
+
+                    MemoryDescriptor->PageCount = MemoryDescriptor->PageCount - (PagesToBurn - PagesBurned);
+                    PagesBurned = PagesToBurn;
+                    }
+                else {
+
+                    //
+                    // This block is not big enough. Take all of its pages and convert
+                    // it to LoaderBad
+                    //
+
+                    DbgPrint("INIT: BasePage %5lx PageCount %5d Turned to LoaderBad\n",
+                        MemoryDescriptor->BasePage,
+                        MemoryDescriptor->PageCount
+                        );
+
+                    PagesBurned += MemoryDescriptor->PageCount;
+                    MemoryDescriptor->MemoryType = LoaderBad;
+                    }
+                }
+            else {
+                return;
+                }
+            }
+
+        NextEntry = NextEntry->Flink;
+
+        } while (NextEntry != ListHead);
+
+}
+
+extern BOOLEAN ExpInTextModeSetup;
+
+
+VOID
+ExpInitializeExecutive(
+    IN ULONG Number,
+    IN PLOADER_PARAMETER_BLOCK LoaderBlock
+    )
+
+/*++
+
+Routine Description:
+
+    This routine is called from the kernel initialization routine during
+    bootstrap to initialize the executive and all of its subcomponents.
+    Each subcomponent is potentially called twice to perform phase 0, and
+    then phase 1 initialization. During phase 0 initialization, the only
+    activity that may be performed is the initialization of subcomponent
+    specific data. Phase 0 initilaization is performed in the context of
+    the kernel start up routine with initerrupts disabled. During phase 1
+    initialization, the system is fully operational and subcomponents may
+    do any initialization that is necessary.
+
+Arguments:
+
+    LoaderBlock - Supplies a pointer to a loader parameter block.
+
+Return Value:
+
+    None.
+
+--*/
+
+{
+    NTSTATUS Status;
+    PLDR_DATA_TABLE_ENTRY DataTableEntry;
+    PMESSAGE_RESOURCE_ENTRY MessageEntry;
+    PLIST_ENTRY NextEntry;
+    ANSI_STRING AnsiString;
+    STRING NameString;
+    CHAR Buffer[ 256 ];
+    CHAR VersionBuffer[ 64 ];
+    PCHAR s, sMajor, sMinor;
+    ULONG ImageCount, i;
+    BOOLEAN IncludeType[LoaderMaximum];
+    ULONG MemoryAlloc[(sizeof(PHYSICAL_MEMORY_DESCRIPTOR) +
+            sizeof(PHYSICAL_MEMORY_RUN)*MAX_PHYSICAL_MEMORY_FRAGMENTS) /
+              sizeof(ULONG)];
+    PPHYSICAL_MEMORY_DESCRIPTOR Memory;
+    ULONG   ResourceIdPath[3];
+    PIMAGE_RESOURCE_DATA_ENTRY ResourceDataEntry;
+    PIMAGE_NT_HEADERS NtHeaders;
+    PMESSAGE_RESOURCE_DATA  MessageData;
+
+    if (Number == 0) {
+
+        ExpInTextModeSetup = LoaderBlock->SetupLoaderBlock ? TRUE : FALSE;
+
+        InitializationPhase = 0L;
+
+        //
+        // Compute PhysicalMemoryBlock
+        //
+
+        Memory = (PPHYSICAL_MEMORY_DESCRIPTOR)&MemoryAlloc;
+        Memory->NumberOfRuns = MAX_PHYSICAL_MEMORY_FRAGMENTS;
+
+        // include all memory types ...
+        for (i=0; i < LoaderMaximum; i++) {
+            IncludeType[i] = TRUE;
+        }
+
+        // ... expect these..
+        IncludeType[LoaderBad] = FALSE;
+        IncludeType[LoaderFirmwarePermanent] = FALSE;
+        IncludeType[LoaderSpecialMemory] = FALSE;
+
+        MmInitializeMemoryLimits(LoaderBlock, IncludeType, Memory);
+
+        //
+        // Initialize the translation tables using the loader
+        // loaded tables
+        //
+
+        InitNlsTableBase = LoaderBlock->NlsData->AnsiCodePageData;
+        InitAnsiCodePageDataOffset = 0;
+        InitOemCodePageDataOffset = ((PUCHAR)LoaderBlock->NlsData->OemCodePageData - (PUCHAR)LoaderBlock->NlsData->AnsiCodePageData);
+        InitUnicodeCaseTableDataOffset = ((PUCHAR)LoaderBlock->NlsData->UnicodeCaseTableData - (PUCHAR)LoaderBlock->NlsData->AnsiCodePageData);
+
+        RtlInitNlsTables(
+            (PVOID)((PUCHAR)InitNlsTableBase+InitAnsiCodePageDataOffset),
+            (PVOID)((PUCHAR)InitNlsTableBase+InitOemCodePageDataOffset),
+            (PVOID)((PUCHAR)InitNlsTableBase+InitUnicodeCaseTableDataOffset),
+            &InitTableInfo
+            );
+
+        RtlResetRtlTranslations(&InitTableInfo);
+
+        //
+        // Initialize the Hardware Architecture Layer (HAL).
+        //
+
+        if (HalInitSystem(InitializationPhase, LoaderBlock) == FALSE) {
+            KeBugCheck(HAL_INITIALIZATION_FAILED);
+        }
+
+#if i386
+        //
+        // Interrupts can now be enabled
+        //
+
+        KiRestoreInterrupts (TRUE);
+#endif
+
+        //
+        // Initialize the crypto exponent...  Set to 0 when systems leave ms!
+        //
+#ifdef TEST_BUILD_EXPONENT
+#pragma message("WARNING: building kernel with TESTKEY enabled!")
+#else
+#define TEST_BUILD_EXPONENT 0
+#endif
+        SharedUserData->CryptoExponent = TEST_BUILD_EXPONENT;
+
+#if DBG
+        NtGlobalFlag |= FLG_ENABLE_CLOSE_EXCEPTIONS |
+                        FLG_ENABLE_KDEBUG_SYMBOL_LOAD |
+                        FLG_IGNORE_DEBUG_PRIV;
+#endif
+        sprintf( Buffer, "C:%s", LoaderBlock->NtBootPathName );
+        RtlInitString( &AnsiString, Buffer );
+        Buffer[ --AnsiString.Length ] = '\0';
+        NtSystemRoot.Buffer = SharedUserData->NtSystemRoot;
+        NtSystemRoot.MaximumLength = sizeof( SharedUserData->NtSystemRoot ) / sizeof( WCHAR );
+        NtSystemRoot.Length = 0;
+        Status = RtlAnsiStringToUnicodeString( &NtSystemRoot,
+                                               &AnsiString,
+                                               FALSE
+                                             );
+        if (!NT_SUCCESS( Status )) {
+            KeBugCheck(SESSION3_INITIALIZATION_FAILED);
+            }
+
+        //
+        // Find the address of BugCheck message block resource and put it
+        // in KiBugCodeMessages.
+        //
+        // WARNING: This code assumes that the LDR_DATA_TABLE_ENTRY for
+        // ntoskrnl.exe is always the first in the loaded module list.
+        //
+        DataTableEntry = CONTAINING_RECORD(
+                            LoaderBlock->LoadOrderListHead.Flink,
+                            LDR_DATA_TABLE_ENTRY,
+                            InLoadOrderLinks);
+
+        ResourceIdPath[0] = 11;
+        ResourceIdPath[1] = 1;
+        ResourceIdPath[2] = 0;
+
+        Status = LdrFindResource_U(
+            DataTableEntry->DllBase,
+            ResourceIdPath,
+            3,
+            (VOID *) &ResourceDataEntry);
+
+        if (NT_SUCCESS(Status)) {
+            Status = LdrAccessResource(
+                DataTableEntry->DllBase,
+                ResourceDataEntry,
+                &MessageData,
+                NULL);
+
+            if (NT_SUCCESS(Status)) {
+                KiBugCodeMessages = MessageData;
+            }
+        }
+
+        //
+        // Scan the loaded module list and load the image symbols via the
+        // kernel debugger for the system, the HAL, the boot file system, and
+        // the boot drivers.
+        //
+
+        ImageCount = 0;
+        NextEntry = LoaderBlock->LoadOrderListHead.Flink;
+        while (NextEntry != &LoaderBlock->LoadOrderListHead) {
+
+            //
+            // Get the address of the data table entry for the next component.
+            //
+
+            DataTableEntry = CONTAINING_RECORD(NextEntry,
+                                               LDR_DATA_TABLE_ENTRY,
+                                               InLoadOrderLinks);
+
+            //
+            // Load the symbols via the kernel debugger for the next component.
+            //
+
+            sprintf( Buffer, "%ws\\System32\\%s%wZ",
+                     &SharedUserData->NtSystemRoot[2],
+                     ImageCount++ < 2 ? "" : "Drivers\\",
+                     &DataTableEntry->BaseDllName
+                   );
+            RtlInitString( &NameString, Buffer );
+            DbgLoadImageSymbols(&NameString, DataTableEntry->DllBase, (ULONG)-1);
+
+#if !defined(NT_UP)
+            if ( !MmVerifyImageIsOkForMpUse(DataTableEntry->DllBase) ) {
+                KeBugCheckEx(UP_DRIVER_ON_MP_SYSTEM,(ULONG)DataTableEntry->DllBase,0,0,0);
+                }
+#endif // NT_UP
+
+            NextEntry = NextEntry->Flink;
+        }
+
+
+    } else {
+
+        //
+        // Initialize the Hardware Architecture Layer (HAL).
+        //
+
+        if (HalInitSystem(InitializationPhase, LoaderBlock) == FALSE) {
+            KeBugCheck(HAL_INITIALIZATION_FAILED);
+        }
+    }
+
+    if (Number == 0) {
+//        DbgBreakPoint();
+
+        //
+        // get system control values out of the registry
+        //
+
+        CmGetSystemControlValues(LoaderBlock->RegistryBase, &CmControlVector[0]);
+        if (CmNtGlobalFlag & ~FLG_VALID_BITS) {
+#if DBG
+            CmNtGlobalFlag = 0x000F4400;
+#else
+            CmNtGlobalFlag = 0x00000000;
+#endif
+            }
+
+#ifdef VER_PRODUCTRCVERSION
+        if ((CmNtCSDVersion & 0xFFFF0000) == 0) {
+            CmNtCSDVersion |= VER_PRODUCTRCVERSION << 16;
+        }
+#endif
+
+        NtGlobalFlag |= CmNtGlobalFlag;
+#if !DBG
+        if (!(CmNtGlobalFlag & FLG_ENABLE_KDEBUG_SYMBOL_LOAD)) {
+            NtGlobalFlag &= ~FLG_ENABLE_KDEBUG_SYMBOL_LOAD;
+            }
+#endif
+
+        //
+        // Initialize the ExResource package.
+        //
+
+        if (!ExInitSystem()) {
+            KeBugCheck(PHASE0_INITIALIZATION_FAILED);
+        }
+
+        //
+        // Initialize memory managment and the memory allocation pools.
+        //
+
+        ExBurnMemory(LoaderBlock);
+
+        MmInitSystem(0, LoaderBlock, Memory);
+
+        //
+        // Snapshot the NLS tables into paged pool and then
+        // reset the translation tables
+        //
+
+        {
+            PLIST_ENTRY NextMd;
+            PMEMORY_ALLOCATION_DESCRIPTOR MemoryDescriptor;
+
+            //
+            //
+            // Walk through the memory descriptors and size the nls data
+            //
+
+            NextMd = LoaderBlock->MemoryDescriptorListHead.Flink;
+
+            while (NextMd != &LoaderBlock->MemoryDescriptorListHead) {
+
+                MemoryDescriptor = CONTAINING_RECORD(NextMd,
+                                                     MEMORY_ALLOCATION_DESCRIPTOR,
+                                                     ListEntry);
+
+
+                switch (MemoryDescriptor->MemoryType) {
+                    case LoaderNlsData:
+                        InitNlsTableSize += MemoryDescriptor->PageCount*PAGE_SIZE;
+                        break;
+
+                    default:
+                        break;
+                }
+
+                NextMd = MemoryDescriptor->ListEntry.Flink;
+            }
+
+            InitNlsTableBase = ExAllocatePoolWithTag(NonPagedPool,InitNlsTableSize,' slN');
+            if ( !InitNlsTableBase ) {
+                KeBugCheck(PHASE0_INITIALIZATION_FAILED);
+                }
+
+            //
+            // Copy the NLS data into the dynamic buffer so that we can
+            // free the buffers allocated by the loader. The loader garuntees
+            // contiguous buffers and the base of all the tables is the ANSI
+            // code page data
+            //
+
+
+            RtlMoveMemory(
+                InitNlsTableBase,
+                LoaderBlock->NlsData->AnsiCodePageData,
+                InitNlsTableSize
+                );
+
+            RtlInitNlsTables(
+                (PVOID)((PUCHAR)InitNlsTableBase+InitAnsiCodePageDataOffset),
+                (PVOID)((PUCHAR)InitNlsTableBase+InitOemCodePageDataOffset),
+                (PVOID)((PUCHAR)InitNlsTableBase+InitUnicodeCaseTableDataOffset),
+                &InitTableInfo
+                );
+
+            RtlResetRtlTranslations(&InitTableInfo);
+
+        }
+
+        //
+        // Now that the HAL is available and memory management has sized
+        // memory, Display Version number
+        //
+
+        DataTableEntry = CONTAINING_RECORD(LoaderBlock->LoadOrderListHead.Flink,
+                                            LDR_DATA_TABLE_ENTRY,
+                                            InLoadOrderLinks);
+        if (CmNtCSDVersion & 0xFFFF) {
+            Status = RtlFindMessage (DataTableEntry->DllBase, 11, 0,
+                                WINDOWS_NT_CSD_STRING, &MessageEntry);
+            if (NT_SUCCESS( Status )) {
+                RtlInitAnsiString( &AnsiString, MessageEntry->Text );
+                AnsiString.Length -= 2;
+                sprintf( Buffer,
+                         "%Z %u%c",
+                         &AnsiString,
+                         (CmNtCSDVersion & 0xFF00) >> 8,
+                         (CmNtCSDVersion & 0xFF) ? 'A' + (CmNtCSDVersion & 0xFF) - 1 : '\0'
+                       );
+                }
+            else {
+                sprintf( Buffer, "CSD %04x", CmNtCSDVersion );
+                }
+            }
+        else {
+            CmCSDVersionString.MaximumLength = sprintf( Buffer, VER_PRODUCTBETA_STR );
+            }
+
+        //
+        // High-order 16-bits of CSDVersion contain RC number.  If non-zero
+        // display it after Service Pack number
+        //
+        if (CmNtCSDVersion & 0xFFFF0000) {
+            s = Buffer + strlen( Buffer );
+            if (s != Buffer) {
+                *s++ = ',';
+                *s++ = ' ';
+                }
+            Status = RtlFindMessage (DataTableEntry->DllBase, 11, 0,
+                                WINDOWS_NT_RC_STRING, &MessageEntry);
+
+            if (NT_SUCCESS(Status)) {
+                RtlInitAnsiString( &AnsiString, MessageEntry->Text );
+                AnsiString.Length -= 2;
+                }
+            else {
+                RtlInitAnsiString( &AnsiString, "RC" );
+                }
+            s += sprintf( s,
+                          "%Z %u",
+                          &AnsiString,
+                          (CmNtCSDVersion & 0xFF000000) >> 24
+                        );
+            if (CmNtCSDVersion & 0x00FF0000) {
+                s += sprintf( s, ".%u", (CmNtCSDVersion & 0x00FF0000) >> 16 );
+                }
+            *s++ = '\0';
+        }
+
+        RtlInitAnsiString( &AnsiString, Buffer );
+        RtlAnsiStringToUnicodeString( &CmCSDVersionString, &AnsiString, TRUE );
+
+        Status = RtlFindMessage (DataTableEntry->DllBase, 11, 0,
+                            WINDOWS_NT_BANNER, &MessageEntry);
+
+        s = Buffer;
+        if (CmCSDVersionString.Length != 0) {
+            s += sprintf( s, ": %wZ", &CmCSDVersionString );
+            }
+        *s++ = '\0';
+
+        sMajor = strcpy( VersionBuffer, VER_PRODUCTVERSION_STR );
+        sMinor = strchr( sMajor, '.' );
+        *sMinor++ = '\0';
+        NtMajorVersion = atoi( sMajor );
+        NtMinorVersion = atoi( sMinor );
+        *--sMinor = '.';
+
+        NtHeaders = RtlImageNtHeader( DataTableEntry->DllBase );
+        if (NtHeaders->OptionalHeader.MajorSubsystemVersion != NtMajorVersion ||
+            NtHeaders->OptionalHeader.MinorSubsystemVersion != NtMinorVersion
+           ) {
+            NtMajorVersion = NtHeaders->OptionalHeader.MajorSubsystemVersion;
+            NtMinorVersion = NtHeaders->OptionalHeader.MinorSubsystemVersion;
+            }
+
+        sprintf( VersionBuffer, "%u.%u", NtMajorVersion, NtMinorVersion );
+        RtlCreateUnicodeStringFromAsciiz( &CmVersionString, VersionBuffer );
+        sprintf( s,
+                 NT_SUCCESS(Status) ? MessageEntry->Text : "MICROSOFT (R) WINDOWS NT (TM)\n",
+                 VersionBuffer,
+                 NtBuildNumber & 0xFFFF,
+                 Buffer
+               );
+        HalDisplayString(s);
+
+#if i386 && !FPO
+        if (NtGlobalFlag & FLG_KERNEL_STACK_TRACE_DB) {
+            PVOID StackTraceDataBase;
+            ULONG StackTraceDataBaseLength;
+            NTSTATUS Status;
+
+            StackTraceDataBaseLength =  512 * 1024;
+            switch ( MmQuerySystemSize() ) {
+                case MmMediumSystem :
+                    StackTraceDataBaseLength = 1024 * 1024;
+                    break;
+
+                case MmLargeSystem :
+                    StackTraceDataBaseLength = 2048 * 1024;
+                    break;
+                }
+
+            StackTraceDataBase = ExAllocatePoolWithTag( NonPagedPool,
+                                         StackTraceDataBaseLength,'catS'
+                                       );
+            if (StackTraceDataBase != NULL) {
+                KdPrint(( "INIT: Kernel mode stack back trace enabled with %u KB buffer.\n", StackTraceDataBaseLength / 1024 ));
+                Status = RtlInitStackTraceDataBaseEx( StackTraceDataBase,
+                                                    StackTraceDataBaseLength,
+                                                    StackTraceDataBaseLength,
+                                                    (PRTL_INITIALIZE_LOCK_ROUTINE) ExpInitializeLockRoutine,
+                                                    (PRTL_ACQUIRE_LOCK_ROUTINE) ExpAcquireLockRoutine,
+                                                    (PRTL_RELEASE_LOCK_ROUTINE) ExpReleaseLockRoutine,
+                                                    (PRTL_OKAY_TO_LOCK_ROUTINE) ExpOkayToLockRoutine
+                                                  );
+            } else {
+                Status = STATUS_NO_MEMORY;
+            }
+
+            if (!NT_SUCCESS( Status )) {
+                KdPrint(( "INIT: Unable to initialize stack trace data base - Status == %lx\n", Status ));
+            }
+        }
+#endif // i386 && !FPO
+
+        if (NtGlobalFlag & FLG_ENABLE_EXCEPTION_LOGGING) {
+            RtlInitializeExceptionLog(MAX_EXCEPTION_LOG);
+        }
+
+        ExInitializeHandleTablePackage();
+
+#if DBG
+        //
+        // Allocate and zero the system service count table.
+        //
+
+        KeServiceDescriptorTable[0].Count =
+                    (PULONG)ExAllocatePoolWithTag(NonPagedPool,
+                                           KiServiceLimit * sizeof(ULONG),
+                                           'llac');
+        KeServiceDescriptorTableShadow[0].Count = KeServiceDescriptorTable[0].Count;
+        if (KeServiceDescriptorTable[0].Count != NULL ) {
+            RtlZeroMemory((PVOID)KeServiceDescriptorTable[0].Count,
+                          KiServiceLimit * sizeof(ULONG));
+        }
+#endif
+
+        if (!ObInitSystem()) {
+            KeBugCheck(OBJECT_INITIALIZATION_FAILED);
+        }
+
+        if (!SeInitSystem()) {
+            KeBugCheck(SECURITY_INITIALIZATION_FAILED);
+        }
+
+        if (PsInitSystem(0, LoaderBlock) == FALSE) {
+            KeBugCheck(PROCESS_INITIALIZATION_FAILED);
+        }
+
+//#ifdef _PNP_POWER_
+
+        if (!PpInitSystem()) {
+            KeBugCheck(PP0_INITIALIZATION_FAILED);
+        }
+
+//#endif // _PNP_POWER_
+
+        //
+        // Compute the tick count multiplier that is used for computing the
+        // windows millisecond tick count and copy the resultant value to
+        // the memory that is shared between user and kernel mode.
+        //
+
+        ExpTickCountMultiplier = ExComputeTickCountMultiplier(KeMaximumIncrement);
+        SharedUserData->TickCountMultiplier = ExpTickCountMultiplier;
+
+        //
+        // Set the base os version into shared memory
+        //
+
+        SharedUserData->NtMajorVersion = NtMajorVersion;
+        SharedUserData->NtMinorVersion = NtMinorVersion;
+
+        //
+        // Set the supported image number range used to determine by the
+        // loader if a particular image can be executed on the host system.
+        // Eventually this will need to be dynamically computed. Also set
+        // the architecture specific feature bits.
+        //
+
+#if defined(_X86_)
+
+        SharedUserData->ImageNumberLow = IMAGE_FILE_MACHINE_I386;
+        SharedUserData->ImageNumberHigh = IMAGE_FILE_MACHINE_I386;
+
+#elif defined(_ALPHA_)
+
+        SharedUserData->ImageNumberLow = IMAGE_FILE_MACHINE_ALPHA;
+        SharedUserData->ImageNumberHigh = IMAGE_FILE_MACHINE_ALPHA;
+        SharedUserData->ProcessorFeatures[PF_COMPARE_EXCHANGE_DOUBLE] = TRUE;
+
+#elif defined(_MIPS_)
+
+        SharedUserData->ImageNumberLow = IMAGE_FILE_MACHINE_R3000;
+        if (((PCR->ProcessorId >> 8) & 0xff)== 0x09) {
+            SharedUserData->ImageNumberHigh = IMAGE_FILE_MACHINE_R10000;
+
+        } else {
+            SharedUserData->ImageNumberHigh = IMAGE_FILE_MACHINE_R4000;
+        }
+
+        SharedUserData->ProcessorFeatures[PF_COMPARE_EXCHANGE_DOUBLE] = TRUE;
+
+#elif defined(_PPC_)
+
+        SharedUserData->ImageNumberLow = IMAGE_FILE_MACHINE_POWERPC;
+        SharedUserData->ImageNumberHigh = IMAGE_FILE_MACHINE_POWERPC;
+
+#elif
+#error "must define target machine architecture"
+#endif
+
+    }
+}
+
+
+VOID
+Phase1Initialization(
+    IN PVOID Context
+    )
+
+{
+
+    PLOADER_PARAMETER_BLOCK LoaderBlock;
+    PETHREAD Thread;
+    PKPRCB Prcb;
+    KPRIORITY Priority;
+    NTSTATUS Status;
+    UNICODE_STRING SessionManager;
+    PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
+    PVOID Address;
+    ULONG Size;
+    ULONG Index;
+    RTL_USER_PROCESS_INFORMATION ProcessInformation;
+    LARGE_INTEGER UniversalTime;
+    LARGE_INTEGER CmosTime;
+    LARGE_INTEGER OldTime;
+    TIME_FIELDS TimeFields;
+    UNICODE_STRING UnicodeDebugString;
+    ANSI_STRING AnsiDebugString;
+    UNICODE_STRING EnvString, NullString, UnicodeSystemDriveString;
+    CHAR DebugBuffer[256];
+    PWSTR Src, Dst;
+    BOOLEAN ResetActiveTimeBias;
+    HANDLE NlsSection;
+    LARGE_INTEGER SectionSize;
+    LARGE_INTEGER SectionOffset;
+    PVOID SectionBase;
+    PVOID ViewBase;
+    ULONG CapturedViewSize;
+    ULONG SavedViewSize;
+    LONG BootTimeZoneBias;
+    PLDR_DATA_TABLE_ENTRY DataTableEntry;
+    PMESSAGE_RESOURCE_ENTRY MessageEntry;
+#ifndef NT_UP
+    PMESSAGE_RESOURCE_ENTRY MessageEntry1;
+#endif
+    PCHAR MPKernelString;
+
+    //
+    //  Set handle for PAGELK section.
+    //
+
+    ExPageLockHandle = MmLockPagableCodeSection ((PVOID)NtQuerySystemEnvironmentValue);
+    MmUnlockPagableImageSection(ExPageLockHandle);
+
+    //
+    // Set the phase number and raise the priority of current thread to
+    // a high priority so it will not be prempted during initialization.
+    //
+
+    ResetActiveTimeBias = FALSE;
+    InitializationPhase = 1;
+    Thread = PsGetCurrentThread();
+    Priority = KeSetPriorityThread( &Thread->Tcb,MAXIMUM_PRIORITY - 1 );
+
+    //
+    // Put phase 1 initialization calls here
+    //
+
+    LoaderBlock = (PLOADER_PARAMETER_BLOCK)Context;
+    if (HalInitSystem(InitializationPhase, LoaderBlock) == FALSE) {
+        KeBugCheck(HAL1_INITIALIZATION_FAILED);
+    }
+
+#ifdef _PNP_POWER_
+    if (!PoInitSystem(0)) {
+        KeBugCheck(IO1_INITIALIZATION_FAILED);
+    }
+#endif // _PNP_POWER_
+
+    //
+    // Initialize the system time and set the time the system was booted.
+    //
+    // N.B. This cannot be done until after the phase one initialization
+    //      of the HAL Layer.
+    //
+
+    if (HalQueryRealTimeClock(&TimeFields) != FALSE) {
+        RtlTimeFieldsToTime(&TimeFields, &CmosTime);
+        UniversalTime = CmosTime;
+        if ( !ExpRealTimeIsUniversal ) {
+
+            //
+            // If the system stores time in local time. This is converted to
+            // universal time before going any further
+            //
+            // If we have previously set the time through NT, then
+            // ExpLastTimeZoneBias should contain the timezone bias in effect
+            // when the clock was set.  Otherwise, we will have to resort to
+            // our next best guess which would be the programmed bias stored in
+            // the registry
+            //
+
+            if ( ExpLastTimeZoneBias == -1 ) {
+                ResetActiveTimeBias = TRUE;
+                ExpLastTimeZoneBias = ExpAltTimeZoneBias;
+                }
+
+            ExpTimeZoneBias.QuadPart = Int32x32To64(
+                                ExpLastTimeZoneBias*60,   // Bias in seconds
+                                10000000
+                                );
+#ifdef _ALPHA_
+            SharedUserData->TimeZoneBias = ExpTimeZoneBias.QuadPart;
+#else
+            SharedUserData->TimeZoneBias.High2Time = ExpTimeZoneBias.HighPart;
+            SharedUserData->TimeZoneBias.LowPart = ExpTimeZoneBias.LowPart;
+            SharedUserData->TimeZoneBias.High1Time = ExpTimeZoneBias.HighPart;
+#endif
+            UniversalTime.QuadPart = CmosTime.QuadPart + ExpTimeZoneBias.QuadPart;
+        }
+        KeSetSystemTime(&UniversalTime, &OldTime, NULL);
+
+        KeBootTime = UniversalTime;
+
+    }
+
+    MPKernelString = "";
+    DataTableEntry = CONTAINING_RECORD(LoaderBlock->LoadOrderListHead.Flink,
+                                        LDR_DATA_TABLE_ENTRY,
+                                        InLoadOrderLinks);
+
+#ifndef NT_UP
+
+    //
+    // If this is an MP build of the kernel start any other processors now
+    //
+
+    //
+    // enforce the processor licensing stuff
+    //
+
+    if ( KeLicensedProcessors ) {
+        if ( KeRegisteredProcessors > KeLicensedProcessors ) {
+            KeRegisteredProcessors = KeLicensedProcessors;
+        }
+    }
+    KeStartAllProcessors();
+
+    //
+    // Set the affinity of the boot processes and initialization thread
+    // for all processors
+    //
+
+    KeGetCurrentThread()->ApcState.Process->Affinity = KeActiveProcessors;
+    KeSetAffinityThread (KeGetCurrentThread(), KeActiveProcessors);
+    Status = RtlFindMessage (DataTableEntry->DllBase, 11, 0,
+                        WINDOWS_NT_MP_STRING, &MessageEntry1);
+
+    if (NT_SUCCESS( Status )) {
+        MPKernelString = MessageEntry1->Text;
+        }
+    else {
+        MPKernelString = "MultiProcessor Kernel\r\n";
+        }
+#endif
+
+    //
+    // Signifiy to the HAL that all processors have been started and any
+    // post initialization should be performed.
+    //
+
+    if (!HalAllProcessorsStarted()) {
+        KeBugCheck(HAL1_INITIALIZATION_FAILED);
+    }
+
+    RtlInitAnsiString( &AnsiDebugString, MPKernelString );
+    if (AnsiDebugString.Length >= 2) {
+        AnsiDebugString.Length -= 2;
+        }
+
+    //
+    // Now that the processors have started, display number of processors
+    // and size of memory.
+    //
+
+    Status = RtlFindMessage( DataTableEntry->DllBase,
+                             11,
+                             0,
+                             KeNumberProcessors > 1 ? WINDOWS_NT_INFO_STRING_PLURAL
+                                                    : WINDOWS_NT_INFO_STRING,
+                             &MessageEntry
+                           );
+
+    Size = 0;
+    for (Index=0; Index < MmPhysicalMemoryBlock->NumberOfRuns; Index++) {
+        Size += MmPhysicalMemoryBlock->Run[Index].PageCount;
+    }
+
+    sprintf( DebugBuffer,
+             NT_SUCCESS(Status) ? MessageEntry->Text : "%u System Processor [%u MB Memory] %Z\n",
+             KeNumberProcessors,
+             (Size + (1 << 20 - PAGE_SHIFT) - 1) >> (20 - PAGE_SHIFT),
+             &AnsiDebugString
+           );
+    HalDisplayString(DebugBuffer);
+
+    //
+    // Display the memory configuration of the host system.
+    //
+
+#if 0
+
+    {
+        CHAR DisplayBuffer[256];
+        PLIST_ENTRY ListHead;
+        PMEMORY_ALLOCATION_DESCRIPTOR MemoryDescriptor;
+        PLIST_ENTRY NextEntry;
+        PCHAR TypeOfMemory;
+
+        //
+        // Output display headings and enumerate memory types.
+        //
+
+        HalDisplayString("\nStart  End  Page  Type Of Memory\n Pfn   Pfn  Count\n\n");
+        ListHead = &LoaderBlock->MemoryDescriptorListHead;
+        NextEntry = ListHead->Flink;
+        do {
+            MemoryDescriptor = CONTAINING_RECORD(NextEntry,
+                                                 MEMORY_ALLOCATION_DESCRIPTOR,
+                                                 ListEntry);
+
+            //
+            // Switch on the memory type.
+            //
+
+            switch(MemoryDescriptor->MemoryType) {
+            case LoaderExceptionBlock:
+                TypeOfMemory = "Exception block";
+                break;
+
+            case LoaderSystemBlock:
+                TypeOfMemory = "System block";
+                break;
+
+            case LoaderFree:
+                TypeOfMemory = "Free memory";
+                break;
+
+            case LoaderBad:
+                TypeOfMemory = "Bad memory";
+                break;
+
+            case LoaderLoadedProgram:
+                TypeOfMemory = "Os Loader Program";
+                break;
+
+            case LoaderFirmwareTemporary:
+                TypeOfMemory = "Firmware temporary";
+                break;
+
+            case LoaderFirmwarePermanent:
+                TypeOfMemory = "Firmware permanent";
+                break;
+
+            case LoaderOsloaderHeap:
+                TypeOfMemory = "Os Loader heap";
+                break;
+
+            case LoaderOsloaderStack:
+                TypeOfMemory = "Os Loader stack";
+                break;
+
+            case LoaderSystemCode:
+                TypeOfMemory = "Operating system code";
+                break;
+
+            case LoaderHalCode:
+                TypeOfMemory = "HAL code";
+                break;
+
+            case LoaderBootDriver:
+                TypeOfMemory = "Boot disk/file system driver";
+                break;
+
+            case LoaderConsoleInDriver:
+                TypeOfMemory = "Console input driver";
+                break;
+
+            case LoaderConsoleOutDriver:
+                TypeOfMemory = "Console output driver";
+                break;
+
+            case LoaderStartupDpcStack:
+                TypeOfMemory = "DPC stack";
+                break;
+
+            case LoaderStartupKernelStack:
+                TypeOfMemory = "Idle process stack";
+                break;
+
+            case LoaderStartupPanicStack:
+                TypeOfMemory = "Panic stack";
+                break;
+
+            case LoaderStartupPcrPage:
+                TypeOfMemory = "PCR Page";
+                break;
+
+            case LoaderStartupPdrPage:
+                TypeOfMemory = "PDR Pages";
+                break;
+
+            case LoaderRegistryData:
+                TypeOfMemory = "Registry data";
+                break;
+
+            case LoaderMemoryData:
+                TypeOfMemory = "Memory data";
+                break;
+
+            case LoaderNlsData:
+                TypeOfMemory = "Nls data";
+                break;
+
+            case LoaderSpecialMemory:
+                TypeOfMemory = "Special memory";
+                break;
+
+            default :
+                TypeOfMemory = "Unknown memory";
+                break;
+            }
+
+            //
+            // Display memory descriptor information.
+            //
+
+            sprintf(&DisplayBuffer[0], "%5lx %5lx %5lx %s\n",
+                    MemoryDescriptor->BasePage,
+                    MemoryDescriptor->BasePage + MemoryDescriptor->PageCount - 1,
+                    MemoryDescriptor->PageCount,
+                    TypeOfMemory);
+
+            HalDisplayString(&DisplayBuffer[0]);
+            NextEntry = NextEntry->Flink;
+        } while (NextEntry != ListHead);
+
+        HalDisplayString("\n");
+    }
+#endif
+
+    if (!ObInitSystem())
+        KeBugCheck(OBJECT1_INITIALIZATION_FAILED);
+
+    if (!ExInitSystem())
+        KeBugCheckEx(PHASE1_INITIALIZATION_FAILED,0,0,0,0);
+
+    if (!KeInitSystem())
+        KeBugCheckEx(PHASE1_INITIALIZATION_FAILED,0,0,0,0);
+
+    //
+    // SE expects directory and executive objects to be available, but
+    // must be before device drivers are initialized.
+    //
+
+    if (!SeInitSystem())
+            KeBugCheck(SECURITY1_INITIALIZATION_FAILED);
+
+    //
+    // Create the symbolic link to \SystemRoot.
+    //
+
+    Status = CreateSystemRootLink(LoaderBlock);
+    if ( !NT_SUCCESS(Status) ) {
+        KeBugCheckEx(SYMBOLIC_INITIALIZATION_FAILED,Status,0,0,0);
+    }
+
+    if (MmInitSystem(1, (PLOADER_PARAMETER_BLOCK)Context, NULL) == FALSE)
+        KeBugCheck(MEMORY1_INITIALIZATION_FAILED);
+
+    //
+    // Snapshot the NLS tables into a page file backed section, and then
+    // reset the translation tables
+    //
+
+    SectionSize.HighPart = 0;
+    SectionSize.LowPart = InitNlsTableSize;
+
+    Status = ZwCreateSection(
+                &NlsSection,
+                SECTION_ALL_ACCESS,
+                NULL,
+                &SectionSize,
+                PAGE_READWRITE,
+                SEC_COMMIT,
+                NULL
+                );
+
+    if (!NT_SUCCESS(Status)) {
+        KdPrint(("INIT: Nls Section Creation Failed %x\n",Status));
+        KeBugCheckEx(PHASE1_INITIALIZATION_FAILED,Status,1,0,0);
+    }
+
+    Status = ObReferenceObjectByHandle(
+                NlsSection,
+                SECTION_ALL_ACCESS,
+                MmSectionObjectType,
+                KernelMode,
+                &InitNlsSectionPointer,
+                NULL
+                );
+
+    ZwClose(NlsSection);
+
+    if ( !NT_SUCCESS(Status) ) {
+        KdPrint(("INIT: Nls Section Reference Failed %x\n",Status));
+        KeBugCheckEx(PHASE1_INITIALIZATION_FAILED,Status,2,0,0);
+    }
+
+    SectionBase = NULL;
+    CapturedViewSize = SectionSize.LowPart;
+    SavedViewSize = CapturedViewSize;
+    SectionSize.LowPart = 0;
+
+    Status = MmMapViewInSystemCache(
+                InitNlsSectionPointer,
+                &SectionBase,
+                &SectionSize,
+                &CapturedViewSize
+                );
+
+    if ( !NT_SUCCESS(Status) ) {
+        KdPrint(("INIT: Map In System Cache Failed %x\n",Status));
+        KeBugCheckEx(PHASE1_INITIALIZATION_FAILED,Status,3,0,0);
+    }
+
+    //
+    // Copy the NLS data into the dynamic buffer so that we can
+    // free the buffers allocated by the loader. The loader garuntees
+    // contiguous buffers and the base of all the tables is the ANSI
+    // code page data
+    //
+
+    RtlMoveMemory(
+        SectionBase,
+        InitNlsTableBase,
+        InitNlsTableSize
+        );
+
+    //
+    // Unmap the view to remove all pages from memory.  This prevents
+    // these tables from consuming memory in the system cache while
+    // the system cache is under utilized during bootup.
+    //
+
+    MmUnmapViewInSystemCache (SectionBase, InitNlsSectionPointer, FALSE);
+
+    SectionBase = NULL;
+
+    //
+    // Map it back into the system cache, but now the pages will no
+    // longer be valid.
+    //
+
+    Status = MmMapViewInSystemCache(
+                InitNlsSectionPointer,
+                &SectionBase,
+                &SectionSize,
+                &SavedViewSize
+                );
+
+    if ( !NT_SUCCESS(Status) ) {
+        KdPrint(("INIT: Map In System Cache Failed %x\n",Status));
+        KeBugCheckEx(PHASE1_INITIALIZATION_FAILED,Status,4,0,0);
+    }
+
+    ExFreePool(InitNlsTableBase);
+
+    InitNlsTableBase = SectionBase;
+
+    RtlInitNlsTables(
+        (PVOID)((PUCHAR)InitNlsTableBase+InitAnsiCodePageDataOffset),
+        (PVOID)((PUCHAR)InitNlsTableBase+InitOemCodePageDataOffset),
+        (PVOID)((PUCHAR)InitNlsTableBase+InitUnicodeCaseTableDataOffset),
+        &InitTableInfo
+        );
+
+    RtlResetRtlTranslations(&InitTableInfo);
+
+    ViewBase = NULL;
+    SectionOffset.LowPart = 0;
+    SectionOffset.HighPart = 0;
+    CapturedViewSize = 0;
+
+    //
+    // Map the system dll into the user part of the address space
+    //
+
+    Status = MmMapViewOfSection(
+                InitNlsSectionPointer,
+                PsGetCurrentProcess(),
+                &ViewBase,
+                0L,
+                0L,
+                &SectionOffset,
+                &CapturedViewSize,
+                ViewShare,
+                0L,
+                PAGE_READWRITE
+                );
+
+    if ( !NT_SUCCESS(Status) ) {
+        KdPrint(("INIT: Map In User Portion Failed %x\n",Status));
+        KeBugCheckEx(PHASE1_INITIALIZATION_FAILED,Status,5,0,0);
+    }
+
+    RtlMoveMemory(
+        ViewBase,
+        InitNlsTableBase,
+        InitNlsTableSize
+        );
+
+    InitNlsTableBase = ViewBase;
+
+    //
+    // Initialize the cache manager.
+    //
+
+    if (!CcInitializeCacheManager())
+        KeBugCheck(CACHE_INITIALIZATION_FAILED);
+
+    //
+    // Config management (particularly the registry) gets inited in
+    // two parts.  Part 1 makes \REGISTRY\MACHINE\SYSTEM and
+    // \REGISTRY\MACHINE\HARDWARE available.  These are needed to
+    // complete IO init.
+    //
+
+    if (!CmInitSystem1(LoaderBlock))
+      KeBugCheck(CONFIG_INITIALIZATION_FAILED);
+
+    //
+    // Compute timezone bias and next cutover date
+    //
+
+    BootTimeZoneBias = ExpLastTimeZoneBias;
+
+    ExRefreshTimeZoneInformation(&CmosTime);
+
+    if ( ResetActiveTimeBias ) {
+        ExLocalTimeToSystemTime(&CmosTime,&UniversalTime);
+        KeBootTime = UniversalTime;
+        KeSetSystemTime(&UniversalTime, &OldTime, NULL);
+        }
+    else {
+
+        //
+        // check to see if a timezone switch occured prior to boot...
+        //
+
+        if ( BootTimeZoneBias != ExpLastTimeZoneBias ) {
+            ZwSetSystemTime(NULL,NULL);
+            }
+        }
+
+    if (!FsRtlInitSystem())
+        KeBugCheck(FILE_INITIALIZATION_FAILED);
+
+    HalReportResourceUsage();
+
+//#ifdef _PNP_POWER_
+
+    //
+    // Perform phase1 initialization of the Plug and Play manager.  This
+    // must be done before the I/O system initializes.
+    //
+    if (!PpInitSystem()) {
+        KeBugCheck(PP1_INITIALIZATION_FAILED);
+    }
+
+//#endif // _PNP_POWER_
+
+    //
+    // LPC needs to be initialized before the I/O system, since
+    // some drivers may create system threads that will terminate
+    // and cause LPC to be called.
+    //
+    if (!LpcInitSystem())
+        KeBugCheck(LPC_INITIALIZATION_FAILED);
+
+    //
+    // Now that the system time is running, initialize more of the
+    // Executive
+    //
+
+    ExInitSystemPhase2();
+
+    if (!IoInitSystem(LoaderBlock))
+        KeBugCheck(IO1_INITIALIZATION_FAILED);
+
+#if i386
+    //
+    // Initialize Vdm specific stuff
+    //
+    // Note:  If this fails, vdms may not be able to run, but it doesn't
+    //        seem neceesary to bugcheck the system because of this.
+    //
+    KeI386VdmInitialize();
+#endif
+
+#ifdef _PNP_POWER_
+    if (!PoInitSystem(1)) {
+        KeBugCheck(IO1_INITIALIZATION_FAILED);
+    }
+#endif // _PNP_POWER_
+
+    //
+    // Okay to call PsInitSystem now that \SystemRoot is defined so it can
+    // locate NTDLL.DLL and SMSS.EXE
+    //
+
+    if (PsInitSystem(1, (PLOADER_PARAMETER_BLOCK)Context) == FALSE)
+        KeBugCheck(PROCESS1_INITIALIZATION_FAILED);
+
+    //
+    // Force KeBugCheck to look at PsLoadedModuleList now that it is
+    // setup.
+    //
+    if (LoaderBlock == KeLoaderBlock) {
+        KeLoaderBlock = NULL;
+    }
+
+    //
+    // Free loader block.
+    //
+    MmFreeLoaderBlock (LoaderBlock);
+    LoaderBlock = NULL;
+    Context = NULL;
+
+    //
+    // Perform Phase 1 Reference Monitor Initialization.  This includes
+    // creating the Reference Monitor Command Server Thread, a permanent
+    // thread of the System Init process.  That thread will create an LPC
+    // port called the Reference Monitor Command Port through which
+    // commands sent by the Local Security Authority Subsystem will be
+    // received.  These commands (e.g. Enable Auditing) change the Reference
+    // Monitor State.
+    //
+
+    if (!SeRmInitPhase1()) {
+        KeBugCheck(REFMON_INITIALIZATION_FAILED);
+    }
+
+    //
+    // Set up process parameters for the Session Manager Subsystem
+    //
+
+    Size = sizeof( *ProcessParameters ) +
+           ((DOS_MAX_PATH_LENGTH * 4) * sizeof( WCHAR ));
+    ProcessParameters = NULL;
+    Status = ZwAllocateVirtualMemory( NtCurrentProcess(),
+                                      (PVOID *)&ProcessParameters,
+                                      0,
+                                      &Size,
+                                      MEM_COMMIT,
+                                      PAGE_READWRITE
+                                    );
+    if (!NT_SUCCESS( Status )) {
+#if DBG
+        sprintf(DebugBuffer,
+                "INIT: Unable to allocate Process Parameters. 0x%lx\n",
+                Status);
+
+        RtlInitAnsiString(&AnsiDebugString, DebugBuffer);
+        if (NT_SUCCESS(RtlAnsiStringToUnicodeString(&UnicodeDebugString,
+                                              &AnsiDebugString,
+                                          TRUE)) == FALSE) {
+            KeBugCheck(SESSION1_INITIALIZATION_FAILED);
+        }
+        ZwDisplayString(&UnicodeDebugString);
+#endif // DBG
+        KeBugCheckEx(SESSION1_INITIALIZATION_FAILED,Status,0,0,0);
+    }
+
+    ProcessParameters->Length = Size;
+    ProcessParameters->MaximumLength = Size;
+    //
+    // Reserve the low 1 MB of address space in the session manager.
+    // Setup gets started using a replacement for the session manager
+    // and that process needs to be able to use the vga driver on x86,
+    // which uses int10 and thus requires the low 1 meg to be reserved
+    // in the process. The cost is so low that we just do this all the
+    // time, even when setup isn't running.
+    //
+    ProcessParameters->Flags = RTL_USER_PROC_PARAMS_NORMALIZED | RTL_USER_PROC_RESERVE_1MB;
+
+    Size = PAGE_SIZE;
+    Status = ZwAllocateVirtualMemory( NtCurrentProcess(),
+                                      (PVOID *)&ProcessParameters->Environment,
+                                      0,
+                                      &Size,
+                                      MEM_COMMIT,
+                                      PAGE_READWRITE
+                                    );
+    if (!NT_SUCCESS( Status )) {
+#if DBG
+        sprintf(DebugBuffer,
+                "INIT: Unable to allocate Process Environment 0x%lx\n",
+                Status);
+
+        RtlInitAnsiString(&AnsiDebugString, DebugBuffer);
+        if (NT_SUCCESS(RtlAnsiStringToUnicodeString(&UnicodeDebugString,
+                                              &AnsiDebugString,
+                                          TRUE)) == FALSE) {
+            KeBugCheck(SESSION2_INITIALIZATION_FAILED);
+        }
+        ZwDisplayString(&UnicodeDebugString);
+#endif // DBG
+        KeBugCheckEx(SESSION2_INITIALIZATION_FAILED,Status,0,0,0);
+    }
+
+    Dst = (PWSTR)(ProcessParameters + 1);
+    ProcessParameters->CurrentDirectory.DosPath.Buffer = Dst;
+    ProcessParameters->CurrentDirectory.DosPath.MaximumLength = DOS_MAX_PATH_LENGTH * sizeof( WCHAR );
+    RtlCopyUnicodeString( &ProcessParameters->CurrentDirectory.DosPath,
+                          &NtSystemRoot
+                        );
+
+    Dst = (PWSTR)((PCHAR)ProcessParameters->CurrentDirectory.DosPath.Buffer +
+                  ProcessParameters->CurrentDirectory.DosPath.MaximumLength
+                 );
+    ProcessParameters->DllPath.Buffer = Dst;
+    ProcessParameters->DllPath.MaximumLength = DOS_MAX_PATH_LENGTH * sizeof( WCHAR );
+    RtlCopyUnicodeString( &ProcessParameters->DllPath,
+                          &ProcessParameters->CurrentDirectory.DosPath
+                        );
+    RtlAppendUnicodeToString( &ProcessParameters->DllPath, L"\\System32" );
+
+    Dst = (PWSTR)((PCHAR)ProcessParameters->DllPath.Buffer +
+                  ProcessParameters->DllPath.MaximumLength
+                 );
+    ProcessParameters->ImagePathName.Buffer = Dst;
+    ProcessParameters->ImagePathName.MaximumLength = DOS_MAX_PATH_LENGTH * sizeof( WCHAR );
+    RtlAppendUnicodeToString( &ProcessParameters->ImagePathName,
+                              L"\\SystemRoot\\System32"
+                            );
+    RtlAppendUnicodeToString( &ProcessParameters->ImagePathName,
+                              L"\\smss.exe"
+                            );
+
+    NullString.Buffer = L"";
+    NullString.Length = sizeof(WCHAR);
+    NullString.MaximumLength = sizeof(WCHAR);
+
+    EnvString.Buffer = ProcessParameters->Environment;
+    EnvString.Length = 0;
+    EnvString.MaximumLength = (USHORT)Size;
+
+    RtlAppendUnicodeToString( &EnvString, L"Path=" );
+    RtlAppendUnicodeStringToString( &EnvString, &ProcessParameters->DllPath );
+    RtlAppendUnicodeStringToString( &EnvString, &NullString );
+
+    UnicodeSystemDriveString = NtSystemRoot;
+    UnicodeSystemDriveString.Length = 2 * sizeof( WCHAR );
+    RtlAppendUnicodeToString( &EnvString, L"SystemDrive=" );
+    RtlAppendUnicodeStringToString( &EnvString, &UnicodeSystemDriveString );
+    RtlAppendUnicodeStringToString( &EnvString, &NullString );
+
+    RtlAppendUnicodeToString( &EnvString, L"SystemRoot=" );
+    RtlAppendUnicodeStringToString( &EnvString, &NtSystemRoot );
+    RtlAppendUnicodeStringToString( &EnvString, &NullString );
+
+
+#if 0
+    KdPrint(( "ProcessParameters at %lx\n", ProcessParameters ));
+    KdPrint(( "    CurDir:    %wZ\n", &ProcessParameters->CurrentDirectory.DosPath ));
+    KdPrint(( "    DllPath:   %wZ\n", &ProcessParameters->DllPath ));
+    KdPrint(( "    ImageFile: %wZ\n", &ProcessParameters->ImagePathName ));
+    KdPrint(( "    Environ:   %lx\n", ProcessParameters->Environment ));
+    Src = ProcessParameters->Environment;
+    while (*Src) {
+        KdPrint(( "        %ws\n", Src ));
+        while (*Src++) ;
+        }
+    }
+#endif
+
+    ProcessParameters->CommandLine = ProcessParameters->ImagePathName;
+    SessionManager = ProcessParameters->ImagePathName;
+    Status = RtlCreateUserProcess(
+                &SessionManager,
+                OBJ_CASE_INSENSITIVE,
+                RtlDeNormalizeProcessParams( ProcessParameters ),
+                NULL,
+                NULL,
+                NULL,
+                FALSE,
+                NULL,
+                NULL,
+                &ProcessInformation
+                );
+    if ( !NT_SUCCESS(Status) ) {
+#if DBG
+        sprintf(DebugBuffer,
+                "INIT: Unable to create Session Manager. 0x%lx\n",
+                Status);
+
+        RtlInitAnsiString(&AnsiDebugString, DebugBuffer);
+        if (NT_SUCCESS(RtlAnsiStringToUnicodeString(&UnicodeDebugString,
+                                              &AnsiDebugString,
+                                          TRUE)) == FALSE) {
+            KeBugCheck(SESSION3_INITIALIZATION_FAILED);
+        }
+        ZwDisplayString(&UnicodeDebugString);
+#endif // DBG
+        KeBugCheckEx(SESSION3_INITIALIZATION_FAILED,Status,0,0,0);
+    }
+
+    Status = ZwResumeThread(ProcessInformation.Thread,NULL);
+
+    if ( !NT_SUCCESS(Status) ) {
+#if DBG
+        sprintf(DebugBuffer,
+                "INIT: Unable to resume Session Manager. 0x%lx\n",
+                Status);
+
+        RtlInitAnsiString(&AnsiDebugString, DebugBuffer);
+        if (NT_SUCCESS(RtlAnsiStringToUnicodeString(&UnicodeDebugString,
+                                              &AnsiDebugString,
+                                          TRUE)) == FALSE) {
+            KeBugCheck(SESSION4_INITIALIZATION_FAILED);
+        }
+        ZwDisplayString(&UnicodeDebugString);
+#endif // DBG
+        KeBugCheckEx(SESSION4_INITIALIZATION_FAILED,Status,0,0,0);
+    }
+
+    //
+    // Wait five seconds for the session manager to get started or
+    // terminate. If the wait times out, then the session manager
+    // is assumed to be healthy and the zero page thread is called.
+    //
+
+    OldTime.QuadPart = Int32x32To64(5, -(10 * 1000 * 1000));
+    Status = ZwWaitForSingleObject(
+                ProcessInformation.Process,
+                FALSE,
+                &OldTime
+                );
+
+    if (Status == STATUS_SUCCESS) {
+
+#if DBG
+
+        sprintf(DebugBuffer, "INIT: Session Manager terminated.\n");
+        RtlInitAnsiString(&AnsiDebugString, DebugBuffer);
+        RtlAnsiStringToUnicodeString(&UnicodeDebugString,
+                                     &AnsiDebugString,
+                                     TRUE);
+
+        ZwDisplayString(&UnicodeDebugString);
+
+#endif // DBG
+
+        KeBugCheck(SESSION5_INITIALIZATION_FAILED);
+
+    } else {
+        //
+        // Dont need these handles anymore.
+        //
+
+        ZwClose( ProcessInformation.Thread );
+        ZwClose( ProcessInformation.Process );
+
+        //
+        // Free up memory used to pass arguments to session manager.
+        //
+
+        Size = 0;
+        Address = ProcessParameters->Environment;
+        ZwFreeVirtualMemory( NtCurrentProcess(),
+                             (PVOID *)&Address,
+                             &Size,
+                             MEM_RELEASE
+                           );
+
+        Size = 0;
+        Address = ProcessParameters;
+        ZwFreeVirtualMemory( NtCurrentProcess(),
+                             (PVOID *)&Address,
+                             &Size,
+                             MEM_RELEASE
+                           );
+
+        InitializationPhase += 1;
+        MmZeroPageThread();
+    }
+}
+
+
+NTSTATUS
+CreateSystemRootLink(
+    IN PLOADER_PARAMETER_BLOCK LoaderBlock
+    )
+
+{
+    HANDLE handle;
+    UNICODE_STRING nameString;
+    OBJECT_ATTRIBUTES objectAttributes;
+    STRING linkString;
+    UNICODE_STRING linkUnicodeString;
+    NTSTATUS status;
+    UCHAR deviceNameBuffer[256];
+    STRING deviceNameString;
+    UNICODE_STRING deviceNameUnicodeString;
+    HANDLE linkHandle;
+
+#if DBG
+
+    UCHAR debugBuffer[256];
+    STRING debugString;
+    UNICODE_STRING debugUnicodeString;
+
+#endif
+
+    //
+    // Create the root directory object for the \ArcName directory.
+    //
+
+    RtlInitUnicodeString( &nameString, L"\\ArcName" );
+
+    InitializeObjectAttributes( &objectAttributes,
+                                &nameString,
+                                OBJ_CASE_INSENSITIVE | OBJ_PERMANENT,
+                                NULL,
+                                SePublicDefaultSd );
+
+    status = NtCreateDirectoryObject( &handle,
+                                      DIRECTORY_ALL_ACCESS,
+                                      &objectAttributes );
+    if (!NT_SUCCESS( status )) {
+        KeBugCheckEx(SYMBOLIC_INITIALIZATION_FAILED,status,1,0,0);
+        return status;
+    } else {
+        (VOID) NtClose( handle );
+    }
+
+    //
+    // Create the root directory object for the \Device directory.
+    //
+
+    RtlInitUnicodeString( &nameString, L"\\Device" );
+
+
+    InitializeObjectAttributes( &objectAttributes,
+                                &nameString,
+                                OBJ_CASE_INSENSITIVE | OBJ_PERMANENT,
+                                NULL,
+                                SePublicDefaultSd );
+
+    status = NtCreateDirectoryObject( &handle,
+                                      DIRECTORY_ALL_ACCESS,
+                                      &objectAttributes );
+    if (!NT_SUCCESS( status )) {
+        KeBugCheckEx(SYMBOLIC_INITIALIZATION_FAILED,status,2,0,0);
+        return status;
+    } else {
+        (VOID) NtClose( handle );
+    }
+
+    //
+    // Create the symbolic link to the root of the system directory.
+    //
+
+    RtlInitAnsiString( &linkString, INIT_SYSTEMROOT_LINKNAME );
+
+    status = RtlAnsiStringToUnicodeString( &linkUnicodeString,
+                                           &linkString,
+                                           TRUE);
+
+    if (!NT_SUCCESS( status )) {
+        KeBugCheckEx(SYMBOLIC_INITIALIZATION_FAILED,status,3,0,0);
+        return status;
+    }
+
+    InitializeObjectAttributes( &objectAttributes,
+                                &linkUnicodeString,
+                                OBJ_CASE_INSENSITIVE | OBJ_PERMANENT,
+                                NULL,
+                                SePublicDefaultSd );
+
+    //
+    // Use ARC device name and system path from loader.
+    //
+
+    sprintf( deviceNameBuffer,
+             "\\ArcName\\%s%s",
+             LoaderBlock->ArcBootDeviceName,
+             LoaderBlock->NtBootPathName);
+
+    deviceNameBuffer[strlen(deviceNameBuffer)-1] = '\0';
+
+    RtlInitString( &deviceNameString, deviceNameBuffer );
+
+    status = RtlAnsiStringToUnicodeString( &deviceNameUnicodeString,
+                                           &deviceNameString,
+                                           TRUE );
+
+    if (!NT_SUCCESS(status)) {
+        RtlFreeUnicodeString( &linkUnicodeString );
+        KeBugCheckEx(SYMBOLIC_INITIALIZATION_FAILED,status,4,0,0);
+        return status;
+    }
+
+    status = NtCreateSymbolicLinkObject( &linkHandle,
+                                         SYMBOLIC_LINK_ALL_ACCESS,
+                                         &objectAttributes,
+                                         &deviceNameUnicodeString );
+
+    RtlFreeUnicodeString( &linkUnicodeString );
+    RtlFreeUnicodeString( &deviceNameUnicodeString );
+
+    if (!NT_SUCCESS(status)) {
+        KeBugCheckEx(SYMBOLIC_INITIALIZATION_FAILED,status,5,0,0);
+        return status;
+    }
+
+#if DBG
+
+    sprintf( debugBuffer, "INIT: %s => %s\n",
+             INIT_SYSTEMROOT_LINKNAME,
+             deviceNameBuffer );
+
+    RtlInitAnsiString( &debugString, debugBuffer );
+
+    status = RtlAnsiStringToUnicodeString( &debugUnicodeString,
+                                           &debugString,
+                                           TRUE );
+
+    if (NT_SUCCESS(status)) {
+        ZwDisplayString( &debugUnicodeString );
+        RtlFreeUnicodeString( &debugUnicodeString );
+    }
+
+#endif // DBG
+
+    NtClose( linkHandle );
+
+    return STATUS_SUCCESS;
+}
+
+#if 0
+
+PVOID
+LookupImageBaseByName (
+    IN PLIST_ENTRY ListHead,
+    IN PSZ         Name
+    )
+/*++
+
+    Lookups BaseAddress of ImageName - returned value can be used
+    to find entry points via LookupEntryPoint
+
+--*/
+{
+    PLDR_DATA_TABLE_ENTRY Entry;
+    PLIST_ENTRY         Next;
+    PVOID               Base;
+    ANSI_STRING         ansiString;
+    UNICODE_STRING      unicodeString;
+    NTSTATUS            status;
+
+    Next = ListHead->Flink;
+    if (!Next) {
+        return NULL;
+    }
+
+    RtlInitAnsiString(&ansiString, Name);
+    status = RtlAnsiStringToUnicodeString( &unicodeString, &ansiString, TRUE );
+    if (!NT_SUCCESS (status)) {
+        return NULL;
+    }
+
+    Base = NULL;
+    while (Next != ListHead) {
+        Entry = CONTAINING_RECORD(Next, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
+        Next = Next->Flink;
+
+        if (RtlEqualUnicodeString (&unicodeString, &Entry->BaseDllName, TRUE)) {
+            Base = Entry->DllBase;
+            break;
+        }
+    }
+
+    RtlFreeUnicodeString( &unicodeString );
+    return Base;
+}
+
+#endif
+
+NTSTATUS
+LookupEntryPoint (
+    IN PVOID DllBase,
+    IN PSZ NameOfEntryPoint,
+    OUT PVOID *AddressOfEntryPoint
+    )
+/*++
+
+Routine Description:
+
+    Returns the address of an entry point given the DllBase and PSZ
+    name of the entry point in question
+
+--*/
+
+{
+    PIMAGE_EXPORT_DIRECTORY ExportDirectory;
+    ULONG ExportSize;
+    USHORT Ordinal;
+    PULONG Addr;
+    CHAR NameBuffer[64];
+
+    ExportDirectory = (PIMAGE_EXPORT_DIRECTORY)
+        RtlImageDirectoryEntryToData(
+            DllBase,
+            TRUE,
+            IMAGE_DIRECTORY_ENTRY_EXPORT,
+            &ExportSize);
+
+#if DBG
+    if (!ExportDirectory) {
+        DbgPrint("LookupENtryPoint: Can't locate system Export Directory\n");
+    }
+#endif
+
+    if ( strlen(NameOfEntryPoint) > sizeof(NameBuffer)-2 ) {
+        return STATUS_INVALID_PARAMETER;
+    }
+
+    strcpy(NameBuffer,NameOfEntryPoint);
+
+    Ordinal = NameToOrdinal(
+                NameBuffer,
+                (ULONG)DllBase,
+                ExportDirectory->NumberOfNames,
+                (PULONG)((ULONG)DllBase + (ULONG)ExportDirectory->AddressOfNames),
+                (PUSHORT)((ULONG)DllBase + (ULONG)ExportDirectory->AddressOfNameOrdinals)
+                );
+
+    //
+    // If Ordinal is not within the Export Address Table,
+    // then DLL does not implement function.
+    //
+
+    if ( (ULONG)Ordinal >= ExportDirectory->NumberOfFunctions ) {
+        return STATUS_PROCEDURE_NOT_FOUND;
+    }
+
+    Addr = (PULONG)((ULONG)DllBase + (ULONG)ExportDirectory->AddressOfFunctions);
+    *AddressOfEntryPoint = (PVOID)((ULONG)DllBase + Addr[Ordinal]);
+    return STATUS_SUCCESS;
+}
+
+static USHORT
+NameToOrdinal (
+    IN PSZ NameOfEntryPoint,
+    IN ULONG DllBase,
+    IN ULONG NumberOfNames,
+    IN PULONG NameTableBase,
+    IN PUSHORT NameOrdinalTableBase
+    )
+{
+
+    ULONG SplitIndex;
+    LONG CompareResult;
+
+    SplitIndex = NumberOfNames >> 1;
+
+    CompareResult = strcmp(NameOfEntryPoint, (PSZ)(DllBase + NameTableBase[SplitIndex]));
+
+    if ( CompareResult == 0 ) {
+        return NameOrdinalTableBase[SplitIndex];
+    }
+
+    if ( NumberOfNames == 1 ) {
+        return (USHORT)-1;
+    }
+
+    if ( CompareResult < 0 ) {
+        NumberOfNames = SplitIndex;
+    } else {
+        NameTableBase = &NameTableBase[SplitIndex+1];
+        NameOrdinalTableBase = &NameOrdinalTableBase[SplitIndex+1];
+        NumberOfNames = NumberOfNames - SplitIndex - 1;
+    }
+
+    return NameToOrdinal(NameOfEntryPoint,DllBase,NumberOfNames,NameTableBase,NameOrdinalTableBase);
+
+}
diff --git a/private/ntos/init/mips/sources b/private/ntos/init/mips/sources
new file mode 100644
index 000000000..ce02e1c1a
--- /dev/null
+++ b/private/ntos/init/mips/sources
@@ -0,0 +1 @@
+LINKER_FLAGS = $(LINKER_FLAGS) -calltree -nopagecode
diff --git a/private/ntos/init/mipsdef.src b/private/ntos/init/mipsdef.src
new file mode 100644
index 000000000..e7bc7ee29
--- /dev/null
+++ b/private/ntos/init/mipsdef.src
@@ -0,0 +1,62 @@
+    ExAcquireFastMutex
+    ExReleaseFastMutex
+    ExTryToAcquireFastMutex
+
+    ExMipsInterlockedDecrementLong
+    ExMipsInterlockedIncrementLong
+    ExMipsInterlockedExchangeUlong
+
+    ExpInterlockedCompareExchange64
+    ExpInterlockedPopEntrySList
+    ExpInterlockedPushEntrySList
+
+    KeAcquireSpinLock
+    KeAcquireSpinLockRaiseToDpc
+    KeReleaseSpinLock
+    KeChangeColorPage
+    KeFillFixedEntryTb
+    KeFlushCurrentTb
+    KeFlushIoBuffers
+    KeLowerIrql
+    KeRaiseIrql
+    KeRaiseIrqlToDpcLevel
+    KeSetSynchIrql;
+    KeSwapIrql
+    KiRequestSoftwareInterrupt
+
+    MmLockPagableImageSection=MmLockPagableDataSection
+
+    RtlCaptureContext
+    RtlEqualMemory
+    RtlLookupFunctionEntry
+    RtlUnwind2
+    RtlVirtualUnwind
+    __C_specific_handler
+    __C_ExecuteExceptionFilter
+    __C_ExecuteTerminationHandler
+    __jump_unwind
+
+    KeNumberProcessIds CONSTANT         // Data - use pointer for access
+    KeNumberTbEntries CONSTANT          // Data - use pointer for access
+
+    KeIpiInterrupt
+    KeSetCacheErrorRoutine
+
+    memcmp
+    memcpy
+    memmove
+    memset
+
+    strcat
+    strcmp
+    strcpy
+    strlen
+
+    __ll_div
+    __ull_div
+    __ll_lshift
+    __ull_rshift
+    __ll_rshift
+    __ll_mul
+    __ll_rem
+    __ull_rem
diff --git a/private/ntos/init/mp/alpha.prf b/private/ntos/init/mp/alpha.prf
new file mode 100644
index 000000000..3552f4cd3
--- /dev/null
+++ b/private/ntos/init/mp/alpha.prf
@@ -0,0 +1,434 @@
+KiIdleLoop
+KeAcquireSpinLockRaiseToSynch
+KiSwapThreadExit
+KiUnlockDispatcherDatabase
+OtsMove
+RtlCopyBytes
+KeReleaseSpinLock
+IopParseDevice
+ExAcquireResourceExclusiveLite
+KeAcquireSpinLockAtDpcLevel
+KeSynchronizeExecution
+ExAllocatePoolWithTag
+ExReleaseResourceLite
+KiRetireDpcList
+ExpInterlockedPopEntrySList
+ExAcquireFastMutex
+ExInterlockedAddUlong
+ExpInterlockedPushEntrySList
+OtsZero
+ExFreePoolWithTag
+ExReleaseFastMutex
+KiDispatchInterrupt
+KiInterruptException
+RtlFindClearBits
+KiReleaseSpinLock
+ExAcquireResourceSharedLite
+IofCompleteRequest
+CcMapData
+RtlUpcaseUnicodeToOemN
+RtlCompareMemory
+RtlSplay
+CcGetVirtualAddress
+ExpInterlockedPopEntrySListFault
+ObReferenceObjectByHandle
+ExpFindCurrentThread
+ObfDereferenceObject
+KeFlushIoBuffers
+IoGetRelatedDeviceObject
+PsImpersonateClient
+CcFindBcb
+FsRtlDissectName
+FsRtlIsNameInExpressionPrivate
+KeWaitForSingleObject
+IofCallDriver
+ObOpenObjectByName
+ObpCaptureObjectCreateInformation
+ObpLookupObjectName
+ExAcquireFastMutexUnsafe
+KeRemoveQueue
+IoAllocateIrp
+PsReferenceImpersonationToken
+ObpAllocateObject
+CcPinFileData
+IoFreeIrp
+IoCreateFile
+IopAllocateIrp
+ExpInterlockedCompareExchange64
+OtsFieldInsert
+RtlCompareUnicodeString
+ObCreateObject
+OtsStringCompareEql
+SeCreateAccessState
+CcCanIWrite
+CcFreeVirtualAddress
+KeLeaveCriticalRegion
+CcUnpinFileData
+CcFastCopyRead
+PsReferencePrimaryToken
+MmProbeAndLockPages
+CcFlushCache
+ExAcquireHandleTableShared
+FsRtlIsFatDbcsLegal
+KeInsertQueue
+KiInterruptDistribution
+ObpCaptureObjectName
+RtlpGetStackLimits
+MmCheckCachedPageState
+CcMapAndRead
+NtSetInformationFile
+FsRtlCheckOplock
+IopCloseFile
+ExReleaseFastMutexUnsafe
+RtlEqualUnicodeString
+RtlUpcaseUnicodeChar
+CcWriteBehind
+ExTryToAcquireFastMutex
+IopParseFile
+MmUnlockPages
+RtlUnicodeToOemN
+IoSetTopLevelIrp
+ObpCreateHandle
+FsRtlLookupLargeMcbEntry
+CcMapAndCopy
+OtsStringCompareEqlSameLen
+RtlCopyUnicodeString
+KeEnterCriticalRegion
+CcUnpinData
+IopCheckDeviceAndDriver
+CcFastCopyWrite
+SeCaptureSubjectContext
+CcPinMappedData
+ExInterlockedInsertTailList
+MiFlushSectionInternal
+RtlIsNameLegalDOS8Dot3
+CcLazyWriteScan
+ExCreateHandle
+KiInsertQueue
+RtlTimeToTimeFields
+ObpIncrementHandleCount
+CcInitializeCacheMap
+FsRtlAddToTunnelCache
+IoAllocateMdl
+IopDeleteFile
+ObpFreeObject
+ExpInterlockedExchangeAddLargeInteger
+IopCheckBackupRestorePrivilege
+ObpRemoveObjectRoutine
+ExIsResourceAcquiredExclusiveLite
+FsRtlFindLargeIndex
+FsRtlGetNextLargeMcbEntry
+KeQuerySystemTime
+KiSaveVolatileIntegerState
+CcUninitializeCacheMap
+ExpWaitForResource
+FsRtlFindInTunnelCache
+IoIsOperationSynchronous
+KeFlushSingleTb
+SeDeleteAccessState
+CcAcquireByteRangeForWrite
+CcSetDirtyPinnedData
+ExReleaseHandleTableShared
+FsRtlOplockFsctrl
+memcmp
+ObpChargeQuotaForObject
+CcSetDirtyInMask
+MiDecrementReferenceCount
+ObpAllocateObjectNameBuffer
+CcPinRead
+CcPrepareMdlWrite
+IopCompleteRequest
+ObpDecrementHandleCount
+ExAcquireHandleTableExclusive
+FsRtlRequestExclusiveOplock
+IoBuildPartialMdl
+MiLocateAndReserveWsle
+MmIsAddressValid
+PsChargeSharedPoolQuota
+RtlSetBits
+KiRestoreVolatileIntegerState
+PsAssignImpersonationToken
+RtlNtStatusToDosErrorNoTeb
+RtlOemToUnicodeN
+SeAssignSecurity
+ExAcquireSharedStarveExclusive
+ExpAcquireResourceExclusiveLite
+KiMb
+MmUnmapViewInSystemCache
+CcMdlRead
+CcMdlWriteComplete2
+ExDestroyHandle
+FsRtlDoesNameContainWildCards
+MiInsertPageInList
+MmMapViewInSystemCache
+ObpFreeObjectNameBuffer
+RtlUpcaseUnicodeString
+IoFastQueryNetworkAttributes
+RtlMapGenericMask
+SeTokenImpersonationLevel
+ExReleaseHandleTableExclusive
+IoFreeMdl
+ExFreePool
+IoGetTopLevelIrp
+ObpDeleteNameCheck
+ObpIncrementHandleDataBase
+KeSetEvent
+OtsFill
+CcAllocateInitializeBcb
+NtClose
+ExInterlockedAddLargeStatistic
+RtlUpcaseUnicodeStringToOemString
+IopDereferenceVpbAndFree
+MiUpdateWsle
+CcSetFileSizes
+CcWorkerThread
+FsRtlFastCheckLockForRead
+MiLocateWsle
+MiModifiedPageWriterWorker
+MmMapLockedPages
+FsRtlAreNamesEqual
+FsRtlOplockIsFastIoPossible
+MiDecrementShareCount2
+MmCreateSection
+MmFlushSection
+FsRtlOplockBreakToII
+IoAcquireCancelSpinLock
+MiCheckControlArea
+RtlExtendedMagicDivide
+RtlOemStringToUnicodeString
+CcGetDirtyPages
+ElapsedDaysToYears
+ExMapHandleToPointer
+IoCheckFunctionAccess
+IoRemoveShareAccess
+MiUnlinkPageFromList
+ObpValidateAccessMask
+MiReserveSystemPtes
+RtlpDidUnicodeToOemWork
+SeAuditingFileEvents
+FsRtlOplockCleanup
+MmAccessFault
+MmPurgeSection
+SeReleaseSubjectContext
+ExSystemTimeToLocalTime
+IoSetShareAccess
+IoSynchronousPageWrite
+KeSetEventBoostPriority
+MiRemoveZeroPage
+ObpIncrementUnnamedHandleCount
+CcCopyWrite
+FsRtlCurrentBatchOplock
+FsRtlRemoveAndCompleteWaitIrp
+MiCheckProtoPtePageState
+MiReleaseSystemPtes
+MmSetAddressRangeModified
+RtlSecondsSince1980ToTime
+SeLockSubjectContext
+CcMdlReadComplete2
+FsRtlFastCheckLockForWrite
+FsRtlPruneTunnelCache
+KeFlushMultipleTb
+MiFreePoolPages
+MmCopyToCachedPage
+ObpCreateUnnamedHandle
+RtlUpcaseUnicodeStringToCountedOemString
+CcReleaseByteRangeFromWrite
+FsRtlMdlWriteCompleteDev
+FsRtlWaitOnIrp
+IopErrorLogRequeueEntry
+MiDispatchFault
+MiInitializePfn
+MiRestoreTransitionPte
+SeSetAccessStateGenericMapping
+CcGetVacbMiss
+ExDeleteResourceLite
+ExpWorkerThread
+FsRtlAddLargeMcbEntry
+FsRtlFindFirstOverlappingExclusiveNode
+IoCheckShareAccess
+KeInitializeEvent
+KeInsertDeviceQueue
+MiRemoveAnyPage
+MmUnmapLockedPages
+RtlUnicodeStringToOemString
+ExInitializeResourceLite
+IopOpenLinkOrRenameTarget
+IoStartNextPacket
+KeInitializeApc
+KiMemoryManagementDispatch
+MiCreateDataFileMap
+MiGatherMappedPages
+SeValidSecurityDescriptor
+SwapSplayLinks
+CcCopyRead
+ExAcquireSharedWaitForExclusive
+FsRtlInitializeLargeMcb
+FsRtlTruncateLargeMcb
+IoCreateStreamFileObject
+IoGetCurrentProcess
+KeInitializeSpinLock
+MiRemovePageByColor
+MiResolveProtoPteFault
+RtlDelete
+RtlFillMemoryUlong
+CcSetValidData
+CcUnmapVacbArray
+FsRtlAcknowledgeOplockBreak
+IoAllocateAdapterChannel
+IoStartPacket
+KeRemoveDeviceQueue
+KiSaveVolatileFloatState
+MiMakeProtectionMask
+MiReleaseWsle
+MiRemovePageFromList
+PsReturnSharedPoolQuota
+RtlFindClearBitsAndSet
+RtlpLengthInheritedAce
+RtlTimeToSecondsSince1970
+SepGetDefaultsSubjectContext
+ExQueueWorkItem
+ExReinitializeResourceLite
+FsRtlCheckLockForReadAccess
+FsRtlFastUnlockAll
+FsRtlIsNameInExpression
+IoReleaseCancelSpinLock
+KeInsertByKeyDeviceQueue
+KiDeliverApc
+MiCheckControlAreaStatus
+MiMakeSystemAddressValidPfn
+MiRemoveWsle
+MiResolveMappedFileFault
+OtsRemainder32Unsigned
+RtlClearBits
+RtlNumberGenericTableElements
+RtlpGenerateInheritedAce
+SepAccessCheck
+CcDeallocateBcb
+CcFreeActiveVacb
+CcIsThereDirtyData
+CcPostWorkQueue
+FsRtlPrivateFastUnlockAll
+FsRtlPrivateInsertLock
+KeRemoveByKeyDeviceQueue
+KiApcInterrupt
+MiAllocatePoolPages
+MiGetInPageSupportBlock
+MiInitializeReadInProgressPfn
+SepInheritAcl
+CcDeleteSharedCacheMap
+CcGetVirtualAddressIfMapped
+CcPerformReadAhead
+CcPreparePinWrite
+CcSetReadAheadGranularity
+ExAllocatePoolWithQuotaTag
+FsRtlAllocateOplock
+FsRtlFastUnlockSingleExclusive
+FsRtlLookupLastLargeMcbEntry
+FsRtlPrivateLock
+FsRtlUninitializeOplock
+IoCheckDesiredAccess
+KeGetCurrentIrql
+KeInsertHeadQueue
+KeInsertQueueApc
+MiAddValidPageToWorkingSet
+MiEnsureAvailablePageOrWait
+RtlAreBitsClear
+RtlInsertElementGenericTable
+RtlLengthSecurityDescriptor
+SepSidInToken
+SeUnlockSubjectContext
+wcsicmp
+FsRtlAllocateFirstMapping
+FsRtlFastUnlockSingle
+FsRtlOplockBreakNotify
+FsRtlPrivateResetLowestLockOffset
+FsRtlRemoveMcbEntryPrivate
+IoPageRead
+IopSynchronousServiceTail
+IoQueueThreadIrp
+MiCheckForControlAreaDeletion
+MiGetEventCounter
+MiResolveTransitionFault
+MiSectionDelete
+MiSegmentDelete
+ObInsertObject
+OtsDivide32Unsigned
+RtlCreateAcl
+RtlInitializeSid
+RtlVirtualUnwind
+SepCheckAcl
+CcScheduleReadAhead
+ExDisableResourceBoostLite
+ExExtendZone
+ExLocalTimeToSystemTime
+ExReleaseResourceForThreadLite
+FsRtlMdlReadCompleteDev
+FsRtlPrivateInsertExclusiveLock
+FsRtlPrivateLimitFreeLockList
+FsRtlReleaseFileForCcFlush
+IoGetFileObjectGenericMapping
+IoUpdateShareAccess
+KeClearEvent
+KeSetTimerEx
+KeTryToAcquireSpinLock
+KiSystemServiceExit
+MiAccessCheck
+MiFreeEventCounter
+MiInitializeTransitionPfn
+MmCanFileBeTruncatedInternal
+MmUnlockCachedPage
+NtDeleteFile
+RtlConvertUlongToLargeInteger
+RtlDeleteElementGenericTable
+RtlEqualPrefixSid
+RtlLookupFunctionEntry
+RtlUnicodeStringToCountedOemString
+_C_ExecuteExceptionFilter
+CcCreateVacbArray
+CcPurgeAndClearCacheSection
+CcPurgeCacheSection
+CcSetLogHandleForFile
+CcUnmapAndPurge
+CcUnpinDataForThread
+ExpRaiseStatus
+FsRtlAcquireFileForCcFlush
+FsRtlFreeFirstMapping
+FsRtlPrivateCheckForExclusiveLockAccess
+FsRtlReleaseFile
+FsRtlUninitializeFileLock
+IopTimerDispatch
+KeWaitForMultipleObjects
+KiAlternateExit
+KiIpiSendPacket
+KiMemoryManagementException
+KiRestoreVolatileFloatState
+KiSystemServiceDispatch
+KiSystemServiceException
+KiTimerExpiration
+MiCompleteProtoPteFault
+MiFindActualFaultingPte
+MiFreeInPageSupportBlock
+MiInsertFrontModifiedNoWrite
+MiInsertWsle
+MiResolveDemandZeroFault
+MiSetDirtyBit
+MiTrimWorkingSet
+MiWaitForInPageComplete
+MmBuildMdlForNonPagedPool
+MmFlushImageSection
+MmZeroPageThread
+NtQueryVolumeInformationFile
+ObDeleteCapturedInsertInfo
+RtlAreBitsSet
+RtlDeleteNoSplay
+RtlExtendedIntegerMultiply
+RtlFillBytes
+RtlFirstFreeAce
+RtlInitializeBitMap
+RtlPcToFileHeader
+RtlpLengthInheritAcl
+RtlSecondsSince1970ToTime
+RtlSubtreePredecessor
+SeAccessCheck
+SeDeassignSecurity
+
\ No newline at end of file
diff --git a/private/ntos/init/mp/i386.prf b/private/ntos/init/mp/i386.prf
new file mode 100644
index 000000000..fb1cf6150
--- /dev/null
+++ b/private/ntos/init/mp/i386.prf
@@ -0,0 +1,571 @@
+KiIdleLoop
+MmZeroPageThread
+KiSwapThread
+ExReleaseResourceLite
+ExAcquireResourceExclusiveLite
+ExInterlockedPopEntrySList
+ExAllocatePoolWithTag
+IopParseDevice
+KeWaitForSingleObject
+ExFreePoolWithTag
+IofCompleteRequest
+KiDispatchInterrupt
+CcMapData
+Exfi386InterlockedDecrementLong
+ExInterlockedPushEntrySList
+KefAcquireSpinLockAtDpcLevel
+InterlockedDecrement
+IoAllocateIrp
+memmove
+ExfInterlockedAddUlong
+CcGetVirtualAddress
+CcFastCopyRead
+RtlFindClearBits
+ExfInterlockedPushEntryList
+ExAcquireResourceSharedLite
+RtlSplay
+CcPinFileData
+KeRemoveQueue
+MmCopyToCachedPage
+ObpCaptureObjectCreateInformation
+CcFindBcb
+IopAllocateIrp
+RtlCompareMemory
+CcFastCopyWrite
+KeSynchronizeExecution
+FsRtlDissectName
+ObReferenceObjectByHandle
+FsRtlIsNameInExpressionPrivate
+MiZeroPhysicalPage
+InterlockedIncrement
+PsImpersonateClient
+RtlCompareUnicodeString
+RtlUpcaseUnicodeToOemN
+IoGetRelatedDeviceObject
+ObOpenObjectByName
+MiFlushSectionInternal
+ExpFindCurrentThread
+IoFreeIrp
+RtlTimeToTimeFields
+CcSetDirtyPinnedData
+FsRtlLookupLargeMcbEntry
+ObfDereferenceObject
+CcCanIWrite
+CcFreeVirtualAddress
+IopDeleteFile
+SeCreateAccessState
+KefReleaseSpinLockFromDpcLevel
+CcMapAndCopy
+ExInterlockedCompareExchange64
+RtlCopyUnicodeString
+ExAcquireHandleTableShared
+KeInsertQueueDpc
+MmProbeAndLockPages
+ObpLookupObjectName
+CcMapAndRead
+IopCompleteRequest
+MiRemovePageByColor
+KeFlushSingleTb
+IoCreateFile
+CcUnpinFileData
+ObpCaptureObjectName
+KeInsertQueue
+MmCheckCachedPageState
+CcInitializeCacheMap
+ExInterlockedAddLargeStatistic
+RtlEqualUnicodeString
+ObpAllocateObject
+FsRtlIsFatDbcsLegal
+CcFlushCache
+ExAcquireFastMutexUnsafe
+RtlFillMemoryUlong
+IopCheckDeviceAndDriver
+MmSetAddressRangeModified
+CcPinMappedData
+KeLeaveCriticalRegion
+CcUninitializeCacheMap
+MiCleanSection
+MmUnmapViewInSystemCache
+CcPrepareMdlWrite
+PsReferenceImpersonationToken
+MiInsertPageInList
+CcWriteBehind
+ExAllocatePool
+FsRtlFindLargeIndex
+IoFastQueryNetworkAttributes
+CcSetDirtyInMask
+KeSetEventBoostPriority
+IofCallDriver
+RtlpCaptureContext
+ObpAllocateObjectNameBuffer
+CcLazyWriteScan
+MiLocateAndReserveWsle
+RtlIsNameLegalDOS8Dot3
+ExCreateHandle
+ExFreePool
+ElapsedDaysToYears
+ObpIncrementHandleCount
+FsRtlAddToTunnelCache
+IoFreeController
+CcAcquireByteRangeForWrite
+FsRtlCheckOplock
+CcPreparePinWrite
+IoAllocateMdl
+KiSetCR0Bits
+ObReferenceObjectByPointer
+CcMdlRead
+ExQueueWorkItem
+IopCloseFile
+FsRtlFindInTunnelCache
+ObCreateObject
+PsReferencePrimaryToken
+CcAllocateInitializeBcb
+ExTryToAcquireResourceExclusiveLite
+ExReleaseHandleTableShared
+RtlExtendedMagicDivide
+CcPinRead
+Exfi386InterlockedExchangeUlong
+CcCopyRead
+NtSetInformationFile
+ObpFreeObjectNameBuffer
+ExInterlockedExchangeAddLargeInteger
+NtClose
+KeEnterCriticalRegion
+MiDecrementShareCount2
+ExReleaseHandleTableExclusive
+ObpCreateHandle
+KiDeliverApc
+IopCompletePageWrite
+RtlUpcaseUnicodeChar
+KeQuerySystemTime
+CcGetFileObjectFromBcb
+RtlNtStatusToDosErrorNoTeb
+ExIsResourceAcquiredExclusiveLite
+IopParseFile
+MiWaitForInPageComplete
+_NLG_Return2
+CcGetVirtualAddressIfMapped
+MiCheckProtoPtePageState
+MmCreateSection
+MiLocateWsle
+MmUnlockPages
+KiInterruptDispatch
+RtlUnicodeToOemN
+IoGetRequestorProcess
+MiReserveSystemPtes
+IoBuildSynchronousFsdRequest
+MiReleaseSystemPtes
+ObpDecrementHandleCount
+ObpFreeObject
+CcSetFileSizes
+FsRtlDoesNameContainWildCards
+FsRtlOplockFsctrl
+IoSetThreadHardErrorMode
+MiDecrementReferenceCount
+CcUnpinData
+ExAcquireSharedStarveExclusive
+CcWorkerThread
+IoFreeMdl
+ExAllocateFromPagedLookasideList
+MiAllocatePoolPages
+MmMapViewInSystemCache
+RtlMapGenericMask
+ExInitializeResourceLite
+FsRtlOplockCleanup
+MiFreePoolPages
+ExAcquireHandleTableExclusive
+PsAssignImpersonationToken
+MmAccessFault
+SeDeleteAccessState
+IoCheckFunctionAccess
+MmPurgeSection
+RtlInsertElementGenericTable
+ExpAcquireResourceExclusiveLite
+ExGetSharedWaiterCount
+IopCheckBackupRestorePrivilege
+MiUpdateWsle
+MmMapLockedPages
+ExpWaitForResource
+FsRtlOplockBreakToII
+MiCreateDataFileMap
+MmFlushSection
+SeAssignSecurity
+IoAllocateErrorLogEntry
+KeReadStateQueue
+IoBuildPartialMdl
+_abnormal_termination
+CcMdlWriteComplete2
+ExDestroyHandle
+FsRtlRemoveMcbEntryPrivate
+KeFlushMultipleTb
+KeSetEvent
+KiRetireDpcList
+KiTrap0E
+ObpRemoveObjectRoutine
+FsRtlGetNextLargeMcbEntry
+IopErrorLogRequeueEntry
+SeCaptureSubjectContext
+IoCancelIrp
+IopDereferenceVpbAndFree
+FsRtlFastCheckLockForRead
+FsRtlRequestExclusiveOplock
+ExFreeToPagedLookasideList
+IoIsOperationSynchronous
+MiRemoveMappedPtes
+RtlUpcaseUnicodeString
+SepFilterPrivilegeAudits
+DebugService
+KeSetTimer
+RtlCompressChunks
+RtlpDidUnicodeToOemWork
+RtlUpcaseUnicodeStringToOemString
+SeSetAccessStateGenericMapping
+SeTokenType
+CcFreeActiveVacb
+ExfInterlockedInsertTailList
+ExMapHandleToPointer
+KeGetCurrentPrcb
+MiUnlinkPageFromList
+RtlOemStringToUnicodeString
+ExReleaseFastMutexUnsafe
+FsRtlTruncateLargeMcb
+KeWaitForMultipleObjects
+RtlUnicodeStringToOemString
+CcDeleteSharedCacheMap
+CcGetVacbMiss
+IopReportResourceUsage
+KiAcquireSpinLock
+RtlAreAnyAccessesGranted
+SeUnlockSubjectContext
+CcGetDirtyPages
+IoSetShareAccess
+MiRemoveAnyPage
+ExSystemTimeToLocalTime
+FsRtlAreNamesEqual
+ObGetObjectPointerCount
+ObpIncrementUnnamedHandleCount
+ObWaitForSingleObject
+RtlOemToUnicodeN
+RtlUpcaseUnicodeStringToCountedOemString
+CcUnpinRepinnedBcb
+FsRtlIsNameInExpression
+KiTimerListExpire
+ObSetSecurityDescriptorInfo
+FsRtlFastCheckLockForWrite
+KeResetEvent
+MiSetDirtyBit
+PsChargeSharedPoolQuota
+PsOpenTokenOfProcess
+RtlTimeToSecondsSince1970
+ExDeleteResourceLite
+FsRtlRemoveLargeMcbEntry
+IoSynchronousPageWrite
+MiDispatchFault
+MmIsAddressValid
+IopIsDeviceInstanceEnabled
+KeInitializeDpc
+PsReturnSharedPoolQuota
+RtlExtendedLargeIntegerDivide
+RtlpGetStackLimits
+SeComputeQuotaInformationSize
+SeValidSecurityDescriptor
+ExpWorkerThread
+FsRtlAddLargeMcbEntry
+ObpDeleteNameCheck
+ExDisableResourceBoostLite
+FsRtlPruneTunnelCache
+FsRtlRemoveAndCompleteWaitIrp
+MiGetInPageSupportBlock
+MiRemoveZeroPage
+PspDeleteThreadSecurity
+RtlpGenerateInheritedAce
+VdmpDelayIntApcRoutine
+CcPerformReadAhead
+CcPostWorkQueue
+ExReinitializeResourceLite
+FsRtlUninitializeOplock
+IoSetTopLevelIrp
+MiCheckControlArea
+MmUnmapLockedPages
+SepGetDefaultsSubjectContext
+ExNotifyCallback
+FsRtlOplockIsFastIoPossible
+FsRtlPrivateFastUnlockAll
+FsRtlWaitOnIrp
+IoGetTopLevelIrp
+IoInitializeIrp
+IoPageRead
+IoStartPacket
+MiGetEventCounter
+MiInitializePfn
+ObpChargeQuotaForObject
+RtlDelete
+SeAuditingFileEvents
+SeFastTraverseCheck
+FsRtlAcknowledgeOplockBreak
+FsRtlPrivateLimitFreeLockList
+IoCheckShareAccess
+IoCreateStreamFileObject
+MiReleaseWsle
+MiRemoveWsle
+MiResolveMappedFileFault
+ObDereferenceObject
+SeTokenImpersonationLevel
+CcReleaseByteRangeFromWrite
+FsRtlAcquireFileForCcFlush
+FsRtlCurrentBatchOplock
+FsRtlInitializeLargeMcb
+FsRtlPrivateLock
+IoBuildDeviceIoControlRequest
+KeInsertByKeyDeviceQueue
+MiEnsureAvailablePageOrWait
+MiInsertFrontModifiedNoWrite
+PsWatchWorkingSet
+RawCheckForDismount
+RtlDeleteElementGenericTable
+RtlSetBits
+SeReleaseSubjectContext
+CcCopyWrite
+FsRtlFindFirstOverlappingExclusiveNode
+IoStartNextPacket
+KeInitializeSpinLock
+KeSetTimerEx
+NtQueryVolumeInformationFile
+ObpLookupDirectoryEntry
+RtlxOemStringToUnicodeSize
+_allmul
+CcScheduleReadAhead
+CcUnmapVacbArray
+FsRtlUninitializeLargeMcb
+IoCheckDesiredAccess
+KeInitializeEventPair
+MiMakeSystemAddressValidPfnWs
+MiRemoveUnusedSegments
+MiSegmentDelete
+RtlNumberOfSetBits
+RtlpLengthInheritedAce
+RtlUnicodeStringToCountedOemString
+_wcsicmp
+ExEnumHandleTable
+FsRtlLookupLastLargeMcbEntry
+IoRemoveShareAccess
+KeReleaseSemaphore
+MiInitializeReadInProgressPfn
+MiRemovePageFromList
+MiResolveProtoPteFault
+ObpIncrementHandleDataBase
+SwapSplayLinks
+CcDeallocateBcb
+FsRtlPrivateResetLowestLockOffset
+IopCheckVpbMounted
+KeInsertDeviceQueue
+KeRemoveDeviceQueue
+MiAddValidPageToWorkingSet
+MiCheckForControlAreaDeletion
+MiCompleteProtoPteFault
+MiRestoreTransitionPte
+NtWaitForSingleObject
+xHalGetConventionalCylinders
+CcSetValidData
+ExAcquireSharedWaitForExclusive
+ExIsResourceAcquiredSharedLite
+FsRtlAllocateOplock
+FsRtlCheckNoExclusiveConflict
+FsRtlDeregisterUncProvider
+IopQueryName
+IoRegisterShutdownNotification
+LpcpClosePort
+MiCheckControlAreaStatus
+RtlAreBitsClear
+RtlCreateSecurityDescriptor
+SepAccessCheck
+SepInheritAcl
+DaysAndFractionToTime
+FsRtlFastUnlockSingle
+FsRtlFastUnlockSingleExclusive
+FsRtlReleaseFileForCcFlush
+IoCancelThreadIo
+KeInsertHeadQueue
+KeRemoveByKeyDeviceQueue
+KeTryToAcquireSpinLock
+KiReleaseSpinLock
+RtlpLengthInheritAcl
+SeLockSubjectContext
+SepSidInToken
+CcMdlReadComplete
+CcMdlReadComplete2
+FsRtlCheckLockForReadAccess
+FsRtlPrivateInsertLock
+IoAcquireCancelSpinLock
+IopOpenLinkOrRenameTarget
+KeFlushQueueApc
+KeInitializeApc
+MiInitializeCopyOnWritePfn
+MiMakeProtectionMask
+MiMakeSystemAddressValidPfn
+MiResolveDemandZeroFault
+MiSectionDelete
+MmCreateMdl
+ObpCreateUnnamedHandle
+ObReferenceObjectByName
+RtlSubtreePredecessor
+SepCheckAcl
+CcGetLsnForFileObject
+CcMdlWriteComplete
+ExAllocatePoolWithQuotaTag
+FsRtlCheckLockForWriteAccess
+FsRtlNumberOfRunsInLargeMcb
+FsRtlOplockBreakNotify
+FsRtlPrivateCheckForExclusiveLockAccess
+FsRtlPrivateRemoveLock
+FsRtlReleaseFileForModWrite
+IoAllocateAdapterChannel
+IoGetCurrentProcess
+IoQueueThreadIrp
+IoRaiseInformationalHardError
+IoStartNextPacketByKey
+KeInitializeDeviceQueue
+KeInsertQueueApc
+KiQuantumEnd
+KiSystemService
+MiChargeCommitmentCantExpand
+MiCheckPdeForPagedPool
+MiDetermineUserGlobalPteMask
+MiRemoveWsleFromFreeList
+MiResolveTransitionFault
+MiVerifyImageHeader
+MmCanFileBeTruncatedInternal
+NtDeleteFile
+ObDeleteCapturedInsertInfo
+ObInsertObject
+RtlAllocateAndInitializeSid
+RtlDeleteNoSplay
+RtlEqualPrefixSid
+RtlInitializeSid
+RtlLookupElementGenericTable
+RtlUpcaseUnicodeToMultiByteN
+CcCreateVacbArray
+FsRtlAllocateFirstMapping
+FsRtlCancelExclusiveIrp
+FsRtlPrivateCheckWaitingLocks
+FsRtlPrivateInitializeFileLock
+Ke386GetGdtEntryThread
+KeInitializeEvent
+KiExceptionExit
+MiAccessCheck
+MiBuildKernelMap
+MiDeleteSystemPagableVm
+MiFindActualFaultingPte
+MiFreeInPageSupportBlock
+MiGetSystemCacheSubsection
+MiInsertWsle
+MiMapPageToZeroInHyperSpace
+MiReleasePageFileSpace
+MiReserveSystemPtes2
+MmBuildMdlForNonPagedPool
+ObpValidateAccessMask
+RtlClearBits
+RtlConvertUlongToLargeInteger
+RtlEnumerateGenericTable
+RtlFirstFreeAce
+RtlIsGenericTableEmpty
+RtlLargeIntegerDivide
+RtlLengthSecurityDescriptor
+CcAllocateObcb
+CcUnpinDataForThread
+ExCreateHandleTable
+ExecuteHandler
+ExReleaseResourceForThreadLite
+FsRtlCheckForMatchingFileObject
+FsRtlDeleteTunnelCache
+FsRtlInitializeFileLock
+FsRtlMdlReadComplete
+FsRtlMdlWriteCompleteDev
+FsRtlPrivateCancelFileLockIrp
+FsRtlPrivateInsertExclusiveLock
+FsRtlSplitLargeMcb
+FsRtlSyncVolumes
+FsRtlUninitializeFileLock
+IoGetFileObjectGenericMapping
+IopSynchronousApiServiceTail
+KeBoostCurrentThread
+KeContextToKframes
+KeReadStateSemaphore
+KiContinue
+MiFlushEventCounter
+MiInitializeTransitionPfn
+MiMapPageInHyperSpace
+MiRemovePageFromWorkingSet
+MmCanFileBeTruncated
+MmGetFileNameForSection
+RtlAreBitsSet
+RtlFindClearBitsAndSet
+RtlFindFirstRunSet
+RtlFindSetBits
+RtlInitializeBitMap
+RtlSetAllBits
+SeAccessCheck
+CcExtendVacbArray
+CcPurgeCacheSection
+CcUnmapVacb
+ExAllocatePoolWithQuota
+ExLocalTimeToSystemTime
+ExpAllocateHandleTableEntries
+FsRtlAddLargeEntry
+FsRtlFastUnlockAll
+FsRtlFastUnlockSingleShared
+FsRtlMdlReadCompleteDev
+FsRtlPrivateInsertSharedLock
+FsRtlRemoveAndCompleteIrp
+IoAcquireVpbSpinLock
+IopMountVolume
+IopSynchronousServiceTail
+IopTimerDispatch
+IoUpdateShareAccess
+KeFlushEntireTb
+KeInitializeThread
+KeSetKernelStackSwapEnable
+KiComputeWaitInterval
+KiEspToTrapFrame
+KiScanReadyQueues
+KiServiceExit2
+KiTimerExpiration
+KiUnwaitThread
+main
+MiAddMappedPtes
+MiChargeCommitment
+MiDeleteFreeVm
+MiFindEmptyAddressRangeDownTree
+MiFlushInPageSupportBlock
+MiFlushPteList
+MiLocateSubsection
+MiReturnCommitment
+MiUnlockPagedAddress
+MiUnmapImageHeaderInHyperSpace
+MiUpForkPageShareCount
+MmFlushImageSection
+MmGetPhysicalAddress
+MmOutSwapProcess
+MmUnlockCachedPage
+MmWorkingSetManager
+NtCancelIoFile
+NtProtectVirtualMemory
+NtStartProfile
+ObpInsertHandleCount
+PspSystemThreadStartup
+RtlCreateAcl
+RtlEqualSid
+RtlExtendedIntegerMultiply
+RtlInitUnicodeString
+RtlOemStringToCountedUnicodeString
+RtlSecondsSince1970ToTime
+RtlSubAuthoritySid
+RtlUnwind
+RtlUpcaseUnicodeStringToAnsiString
+RtlValidSecurityDescriptor
+SeDeassignSecurity
+SeFreeCapturedSecurityQos
+SeFreePrivileges
+SeQueryAuthenticationIdToken
+
+
\ No newline at end of file
diff --git a/private/ntos/init/mp/makefile b/private/ntos/init/mp/makefile
new file mode 100644
index 000000000..6ee4f43fa
--- /dev/null
+++ b/private/ntos/init/mp/makefile
@@ -0,0 +1,6 @@
+#
+# DO NOT EDIT THIS FILE!!!  Edit .\sources. if you want to add a new source
+# file to this component.  This file merely indirects to the real make file
+# that is shared by all the components of NT OS/2
+#
+!INCLUDE $(NTMAKEENV)\makefile.def
diff --git a/private/ntos/init/mp/makefile.inc b/private/ntos/init/mp/makefile.inc
new file mode 100644
index 000000000..51ea15fc3
--- /dev/null
+++ b/private/ntos/init/mp/makefile.inc
@@ -0,0 +1,11 @@
+obj\$(TARGET_DIRECTORY)\ntoskrnl.prf: $(TARGET_DIRECTORY).prf
+    copy $(TARGET_DIRECTORY).prf ..\ntkrnlmp.prf
+
+!INCLUDE ..\up\makefile.inc
+
+obj\alpha\ntkrnlmp.obj: ..\ntoskrnl.c
+
+obj\i386\ntkrnlmp.obj: ..\ntoskrnl.c
+
+obj\mips\ntkrnlmp.obj: ..\ntoskrnl.c
+
diff --git a/private/ntos/init/mp/mips.prf b/private/ntos/init/mp/mips.prf
new file mode 100644
index 000000000..a6ab715ac
--- /dev/null
+++ b/private/ntos/init/mp/mips.prf
@@ -0,0 +1,2657 @@
+KiAcquireSpinLockRaiseIrql
+CcFreeVirtualAddress
+CcPinMappedData
+KeInsertQueue
+ExQueueWorkItem
+ExIsResourceAcquiredExclusiveLite
+ExDisableResourceBoostLite
+IopCheckDeviceAndDriver
+KeSetEvent
+IoAcquireCancelSpinLock
+IoStartNextPacket
+IoCancelIrp
+CcUnpinFileData
+CcReleaseByteRangeFromWrite
+CcCanIWrite
+CcSetDirtyPinnedData
+MmUnlockPages
+CcMdlReadComplete2
+ExpAcquireResourceExclusiveLite
+MmProbeAndLockPages
+IopDereferenceVpbAndFree
+CcMdlWriteComplete2
+MmCheckCachedPageState
+CcSetDirtyInMask
+MmMapLockedPages
+MiProcessValidPteList
+KeInsertQueueApc
+MiReleaseSystemPtes
+MmUnmapLockedPages
+CcMdlRead
+MmUnmapViewInSystemCache
+CcUnmapVacb
+ExDeleteResourceLite
+CcPinFileData
+CcPinRead
+IopDeleteFile
+ExAcquireSharedStarveExclusive
+KiQuantumEnd
+PspSetEventPair
+CmpInitializeMachineDependentConfiguration
+_amsg_exit
+_isctype
+__C_ExecuteTerminationHandler
+__C_ExecuteExceptionFilter
+PspDeleteLdt
+PsIsThreadTerminating
+PoSetDeviceIdleDetection
+PoQueryPowerSequence
+RtlNumberGenericTableElements
+RtlCaptureStackBackTrace
+RtlAssert
+RtlpDestroyLockAtomTable
+MmIsThisAnNtAsSystem
+MmQuerySystemSize
+KiSuspendNop
+ZwYieldExecution
+ZwWriteVirtualMemory
+ZwWriteFile
+ZwWaitForSingleObject
+ZwWaitForMultipleObjects
+ZwUnmapViewOfSection
+ZwUnloadKey
+ZwUnloadDriver
+ZwTerminateProcess
+ZwShutdownSystem
+ZwSetValueKey
+ZwSetTimerResolution
+ZwSetSystemTime
+ZwSetSystemInformation
+ZwSetSecurityObject
+ZwSetInformationThread
+ZwSetInformationProcess
+ZwSetInformationObject
+ZwSetInformationFile
+ZwSetEvent
+ZwSetDefaultLocale
+ZwSaveKey
+ZwResumeThread
+ZwRestoreKey
+ZwResetEvent
+ZwRequestWaitReplyPort
+ZwReplyWaitReceivePort
+ZwReplaceKey
+ZwReleaseSemaphore
+ZwReadFile
+ZwRaiseHardError
+ZwRaiseException
+CcPrepareMdlWrite
+MmMapViewInSystemCache
+MmSetAddressRangeModified
+KiInSwapProcesses
+CcUninitializeCacheMap
+KeUpdateRunTime
+FsRtlFastCheckLockForRead
+FsRtlCheckLockForReadAccess
+MiGetEventCounter
+ExpWaitForResource
+KiDeliverApc
+KiApcInterrupt
+CcWorkerThread
+CcFlushCache
+MiCleanSection
+MiFreePoolPages
+CcWriteBehind
+CcLazyWriteScan
+CcFreeActiveVacb
+CcGetVirtualAddressIfMapped
+ZwQueryVolumeInformationFile
+ZwQueryVirtualMemory
+ZwQueryValueKey
+ZwQuerySystemInformation
+ZwQuerySymbolicLinkObject
+ZwQuerySecurityObject
+ZwQuerySection
+ZwQueryObject
+ZwQueryKey
+ZwQueryInformationToken
+ZwQueryInformationProcess
+ZwQueryInformationFile
+ZwQueryDirectoryFile
+ZwQueryDefaultLocale
+ZwQueryAttributesFile
+ZwPulseEvent
+ZwProtectVirtualMemory
+ZwOpenThreadToken
+ZwOpenThread
+ZwOpenSymbolicLinkObject
+ZwOpenSection
+ZwOpenProcessToken
+ZwOpenProcess
+ZwOpenKey
+ZwOpenFile
+ZwOpenEvent
+ZwOpenDirectoryObject
+ZwNotifyChangeKey
+ZwMapViewOfSection
+ZwLoadKey
+ZwLoadDriver
+ZwListenPort
+ZwInitializeRegistry
+ZwFsControlFile
+ZwFreeVirtualMemory
+ZwFlushKey
+ZwFlushInstructionCache
+ZwFlushBuffersFile
+ZwEnumerateValueKey
+ZwEnumerateKey
+ZwDuplicateToken
+ZwDuplicateObject
+ZwDisplayString
+ZwDeviceIoControlFile
+ZwDeleteValueKey
+ZwDeleteKey
+ZwDeleteFile
+ZwCreateThread
+ZwCreateSymbolicLinkObject
+ZwCreateProcess
+ZwCreatePort
+ZwCreateKey
+ZwCreateFile
+ZwCreateEvent
+ZwCreateDirectoryObject
+ZwContinue
+ZwConnectPort
+ZwCompleteConnectPort
+ZwCloseObjectAuditAlarm
+ZwClose
+ZwClearEvent
+ZwAllocateVirtualMemory
+ZwAlertThread
+ZwAccessCheckAndAuditAlarm
+ZwAcceptConnectPort
+KiUnexpectedInterrupt
+KeReadStateThread
+KeReadStateSemaphore
+KeReadStateQueue
+KeReadStateMutant
+KeSetImportanceDpc
+KeReadStateEvent
+KeClearEvent
+KeReadStateProcess
+KeSetDmaIoCoherency
+KeQueryTimeIncrement
+KiReleaseSpinLock
+KiPassiveRelease
+KiSystemStartup
+KdpGetStateChange
+KdpSetLoadState
+IoGetDeviceToVerify
+IoSetDeviceToVerify
+IoThreadToProcess
+xHalReferenceHandler
+xHalHandlerForBus
+ExPostSystemEvent
+ExpDummyAllocate
+ExNotifyCallback
+ExUnregisterCallback
+ExRegisterCallback
+ExGetSharedWaiterCount
+ExGetExclusiveWaiterCount
+FsRtlSyncVolumes
+IoGetConfigurationInformation
+KeSetSwapContextNotifyRoutine
+KeSetThreadSelectNotifyRoutine
+KeSetTimeUpdateNotifyRoutine
+RtlSubAuthorityCountSid
+RtlGetNtGlobalFlags
+ObGetObjectPointerCount
+SeTraverseAuditAlarm
+SeTokenType
+SeTokenImpersonationLevel
+srand
+__jump_unwind
+PspDeleteVdmObjects
+NtSetLdtEntries
+PspQueryDescriptorThread
+PspSetLdtInformation
+PspSetLdtSize
+PspQueryLdtInformation
+PspMarkCidInvalid
+PsGetCurrentThreadId
+PsGetCurrentProcessId
+PspInitializeThreadSecurity
+PoRequestPowerChange
+RtlInitializeAtomPackage
+DebugUnLoadImageSymbols
+DebugLoadImageSymbols
+DbgBreakPointWithStatus
+DbgBreakPoint
+NtSendWaitReplyChannel
+NtReplyWaitSendChannel
+KeSetSynchIrql
+KeQueryTickCount
+IoGetInitialStack
+xHalSuspendHibernateSystem
+CcGetFileObjectFromBcb
+ExpGetPoolInformation
+ExCreateCallback
+xHalQuerySystemInformation
+xHalSetSystemInformation
+xHalQueryBusSlots
+xHalRegisterBusHandler
+NtCreateChannel
+NtListenChannel
+NtOpenChannel
+NtSetContextChannel
+RtlAreAnyAccessesGranted
+RtlLengthRequiredSid
+RtlInitializeBitMap
+RtlCompressWorkSpaceSizeNS
+RtlCompressBufferNS
+RtlDecompressBufferNS
+RtlDecompressFragmentNS
+RtlDescribeChunkNS
+RtlReserveChunkNS
+NtGetPlugPlayEvent
+PsSetLegoNotifyRoutine
+CmpSetGlobalQuotaAllowed
+HalProcessorIdle
+HalSweepDcache
+CcFastCopyRead
+CcAcquireByteRangeForWrite
+CcFastCopyWrite
+PsChargeSharedPoolQuota
+MmFlushSection
+FsRtlFastCheckLockForWrite
+KeFlushEntireTb
+MiFlushPteList
+PsReturnSharedPoolQuota
+MiDoneWithThisPageGetAnother
+KeResetEvent
+MmCreateSection
+CcInitializeCacheMap
+HalSweepIcache
+HalAllProcessorsStarted
+RtlConvertUlongToLargeInteger
+CcSetReadAheadGranularity
+RtlSubAuthoritySid
+RtlLengthSid
+CmpCompressedNameSize
+_flswbuf
+_flsbuf
+RtlConvertLongToLargeInteger
+DebugPrint
+MmGetCrashDumpStateInformation
+KeSetCacheErrorRoutine
+KeSetKernelStackSwapEnable
+KeSetTargetProcessorDpc
+FsRtlInitializeFileLock
+ExLocalTimeToSystemTime
+CcSetLogHandleForFile
+RtlGetDefaultCodePage
+PfxInitialize
+RtlCopyLuid
+PspSetProcessIoHandlers
+KeRaiseUserException
+RtlInitializeUnicodePrefix
+PsGetProcessExitTime
+_fptrap
+strlen
+atoi
+_stricmp
+ObDereferenceObject
+RtlRaiseStatus
+RtlRaiseException
+RtlEnlargedUnsignedMultiply
+RtlEnlargedIntegerMultiply
+RtlpFreeAtom
+DebugPrompt
+MiRemoveBasedSection
+MiInsertBasedSection
+MmFreeContiguousMemory
+KeInitializeTimer
+KdpPortUnlock
+IoSetThreadHardErrorMode
+FsRtlPostPagingFileStackOverflow
+FsRtlPostStackOverflow
+FsRtlNumberOfRunsInMcb
+ExRaiseStatus
+ExRaiseException
+ExInterlockedExchangeUlong
+FsRtlUninitializeMcb
+FsRtlInitializeMcb
+IoDeleteController
+LdrAccessResource
+RtlAddAccessAllowedAce
+PspQueueApcSpecialApc
+SeFreePrivileges
+SepFreeCapturedString
+SepDefaultDeleteMethod
+CmQueryRegistryQuotaInformation
+NtLoadKey
+CmpLazyFlushDpcRoutine
+towupper
+ObInitProcess2
+RtlUnwind
+RtlLargeIntegerNegate
+RtlpUnlockAtomTable
+MiFindEmptySectionBaseDown
+MmIsRecursiveIoFault
+KiCopyInformation
+KiRestoreInterrupts
+KiDisableInterrupts
+KiCacheError
+IoReleaseVpbSpinLock
+_purecall
+ExAllocatePoolWithQuota
+ExAllocatePool
+ExRaiseAccessViolation
+CcMapAndCopy
+MiAllocatePoolPages
+MmPurgeSection
+CcDeleteSharedCacheMap
+FsRtlFastUnlockSingleExclusive
+FsRtlFastUnlockSingle
+MiEnsureAvailablePageOrWait
+CcUnmapVacbArray
+KeFlushSingleTb
+MiGetInPageSupportBlock
+ExIsResourceAcquiredSharedLite
+FsRtlAllocateFirstMapping
+MmCopyToCachedPage
+MiDispatchFault
+CcSetFileSizes
+FsRtlPrivateLock
+MiResolveTransitionFault
+CcGetDirtyPages
+KeConnectInterrupt
+ExRaiseDatatypeMisalignment
+NtSetIntervalProfile
+FsRtlCompletionRoutinePriv
+IopUserRundown
+RtlpDestroyUnCommittedRange
+ObDestroyHandleProcedure
+ObpValidateDesiredAccess
+RtlpDestroyHandleTableForAtomTable
+RtlpAllocateAtom
+KeReturnToFirmware
+KeReleaseMutex
+KeInitializeDpc
+KiFlushEntireTbTarget
+IoIsSystemThread
+MiAccessCheck
+KiTimerListExpire
+KeTerminateThread
+KeSetTimerEx
+KeFlushMultipleTb
+KiTimerExpiration
+MiSectionDelete
+CcPostWorkQueue
+KeSetPriorityThread
+IopErrorLogRequeueEntry
+KeInsertHeadQueue
+IoCompleteRequest
+IoGetAttachedDevice
+ExpDeleteMutant
+ExSystemExceptionFilter
+SeDeassignPrimaryToken
+KdpComputeChecksum
+strchr
+SepInitializePrivilegeFilter
+RtlLargeIntegerSubtract
+RtlLargeIntegerAdd
+RtlpExecuteHandlerForUnwind
+RtlpExecuteHandlerForException
+MmSizeOfMdl
+KiSquareRootSingle
+KiSquareRootDouble
+KiIpiGenericCallTarget
+KeInitializeSemaphore
+KeBugCheck
+KeSetTimeIncrement
+KdpReboot
+KdpQueryPerformanceCounter
+IoAcquireVpbSpinLock
+FsRtlOplockDpc
+FsRtlFastUnlockAllByKey
+FsRtlTruncateMcb
+ExUnlockUserBuffer
+ExInterlockedIncrementLong
+ExInterlockedDecrementLong
+ExpAllocateStringRoutine
+CcExceptionFilter
+FsRtlAllocateResource
+IopDeallocateApc
+NtFlushWriteBuffer
+LdrFindResource_U
+LdrFindResourceDirectory_U
+RtlpInitUpcaseTable
+ObMakeTemporaryObject
+SepRmComponentTestCommandWrkr
+SepAdtInitializePhase1
+CmpFree
+KdpQuickMoveMemory
+NtSetHighWaitLowThread
+NtSetLowWaitHighThread
+_strset
+ObfReferenceObject
+RtlpExceptionHandler
+KiRestoreProcessorState
+KeAttachProcess
+FsRtlFastUnlockAll
+IoQueryVolumeInformation
+RtlpGetTimeZoneInfoHandle
+RtlNtStatusToDosError
+RtlAcquirePebLock
+RtlReleasePebLock
+PsCreateSystemProcess
+NtTestAlert
+NtGetTickCount
+LsaFreeReturnBuffer
+PspDeleteProcessSecurity
+ObDeassignSecurity
+RtlpFreeHandleForAtom
+DbgUnLoadImageSymbols
+MmReturnPoolQuota
+KiSweepDcacheTarget
+KiTryToAcquireSpinLock
+KiInterruptHandler
+ExpTimeRefreshDpcRoutine
+IoQueryFileInformation
+IopReadyDeviceObjects
+IopUserCompletion
+RtlEqualLuid
+RtlFreeAnsiString
+RtlFreeOemString
+RtlxUnicodeStringToAnsiSize
+RtlxUnicodeStringToOemSize
+RtlxAnsiStringToUnicodeSize
+RtlxOemStringToUnicodeSize
+SepIdAssignableAsOwner
+CmpRemoveKeyControlBlock
+HvpGetCellFlat
+RtlpLogLastExceptionDisposition
+RtlSetAllBits
+RtlClearAllBits
+RtlpInitializeLockAtomTable
+MiZeroPhysicalPage
+MiFlushTb
+KiCalibratePerformanceCounterTarget
+KiStartProfileInterrupt
+KiStopProfileInterrupt
+KeReadyThread
+KiComputeWaitInterval
+KeSetTimer
+KeInitializeTimerEx
+IopApcHardError
+FsRtlNormalizeNtstatus
+ExpGetGlobalAtomTable
+FsRtlNotifyUninitializeSync
+HvGetCellSize
+KdpCauseBugCheck
+CmpLockRegistry
+wcscpy
+rand
+__ll_mul
+PspSetSavedValue
+PspGetSavedValue
+ObpAcquireDescriptorCacheReadLock
+ObpAcquireDescriptorCacheWriteLock
+RtlInitializeGenericTable
+MiDownPfnReferenceCount
+MiRemoveImageHeaderPage
+KiSaveProcessorState
+ExpTimeZoneWork
+MiChangeNoAccessForkPte
+RtlAbsoluteToSelfRelativeSD
+ObpHashBuffer
+PspNullSpecialApc
+NtVdmControl
+towlower
+__ll_rshift
+__ull_rshift
+__ll_lshift
+MiUpForkPageShareCount
+MiGetFirstNode
+MiReturnCommitment
+KeDisableApcQueuingThread
+KeInitializeMutex
+IopInvalidDeviceRequest
+IopExceptionFilter
+FsRtlIsTotalDeviceFailure
+FsRtlAllocatePoolWithQuotaTag
+FsRtlAllocatePoolWithTag
+ExpAllocatePoolWithQuotaHandler
+CcRepinBcb
+CcCopyReadExceptionFilter
+NtDeleteAtom
+RtlCheckRegistryKey
+RtlCreateRegistryKey
+SeDeassignSecurity
+SepRmCreateLogonSessionWrkr
+SepRmDeleteLogonSessionWrkr
+CmpLazyFlushWorker
+PspUnhandledExceptionInSystemThread
+PsRestoreImpersonation
+ObReleaseObjectSecurity
+RtlCreateUnicodeStringFromAsciiz
+DbgPrompt
+MiCheckForConflictingNode
+KiRequestSoftwareInterrupt
+KeEnableApcQueuingThread
+KiFlushIoBuffersTarget
+KiSweepIcacheTarget
+FsRtlAllocatePoolWithQuota
+FsRtlAllocatePool
+FsRtlAddMcbEntry
+ExUnlockPool
+ExpExpirationThread
+FsRtlCheckForMatchingFileObject
+FsRtlIsNotifyOnList
+ChkSum
+PsExitSpecialApc
+SepFreeProxyData
+CmpDestroyTemporaryHive
+CmpLockRegistryExclusive
+strcmp
+_wcslwr
+_strupr
+_strnset
+_strlwr
+PsSetCreateThreadNotifyRoutine
+RtlpUnwindHandler
+KeSetAutoAlignmentThread
+KeSetAutoAlignmentProcess
+KeSetDisableBoostThread
+IopChecksum
+IopErrorLogDpc
+NtAddAtom
+NtFindAtom
+FsRtlpSetSymbolicLink
+IopAbortRequest
+MiGetImageProtection
+MmVerifyImageIsOkForMpUse
+SeReleaseSid
+SeReleaseAcl
+SeReleaseLuidAndAttributesArray
+SeReleaseSidAndAttributesArray
+CmShutdownSystem
+CmpQuotaWarningWorker
+CmpFileSetSize
+CmpCopyCompressedName
+CmpRefreshWorkerRoutine
+KdpSendControlPacket
+memchr
+_wcsupr
+_wcsnset
+SeFreeCapturedSecurityQos
+PsTerminateSystemThread
+RtlInitAnsiString
+RtlInitString
+RtlpInitializeHandleTableForAtomTable
+RtlpLockAtomTable
+MiDeleteFreeVm
+MiIsProtectionCompatible
+KeInitializeDeviceQueue
+FsRtlIsNtstatusExpected
+FsRtlNotifyReportChange
+IopDeleteDriver
+MiUnloadSystemImageByForce
+RtlInitNlsTables
+ObpReferenceSecurityDescriptor
+ObpDereferenceSecurityDescriptor
+SepAdtValidateAuditBounds
+CmpGetKeySecurity
+fputwc
+iswctype
+wcschr
+ObpCompareSecurityDescriptors
+ObAuditInheritedHandleProcedure
+RtlLargeIntegerShiftRight
+KiAcquireSpinLock
+KeInsertQueueDpc
+KeDeregisterBugCheckCallback
+KeInsertDeviceQueue
+KeRemoveDeviceQueue
+KeInsertByKeyDeviceQueue
+KeRemoveByKeyDeviceQueue
+ExpInterlockedPopEntrySList
+IopAllocateIrp
+IoAllocateIrp
+IoAllocateMdl
+ObpAllocateObjectNameBuffer
+FsRtlInitializeLargeMcb
+IoSetHardErrorOrVerifyDevice
+RtlLargeIntegerShiftLeft
+RtlFindSetBitsAndClear
+RtlInitUnicodeString
+MiUpControlAreaRefs
+MiMapCacheExceptionFilter
+KeBusError
+KdpWriteControlSpace
+ExLockPool
+FsRtlInitializeTunnelCache
+NtFsControlFile
+NtOpenFile
+MmUnmapIoSpace
+MiGetExceptionInfo
+ComputeUnicodeNameLength
+RtlCopyLuidAndAttributesArray
+ObpDestroySecurityDescriptorHeader
+SeReleaseSecurityDescriptor
+CmpCreateTemporaryHive
+isprint
+isspace
+isxdigit
+isdigit
+islower
+isupper
+PspInheritQuota
+ObpReleaseDescriptorCacheLock
+RtlAddressInSectionTable
+RtlLargeIntegerArithmeticShift
+MmCanFileBeTruncated
+KiIpiServiceRoutine
+KdpStub
+IoGetBaseFileSystemDeviceObject
+CcGetFileObjectFromSectionPtrs
+IoEnqueueIrp
+NtDeviceIoControlFile
+KeAddSystemServiceTable
+NtReadRequestData
+NtWriteRequestData
+SeImpersonateClient
+CmpReleaseGlobalQuota
+CmpUnlockRegistry
+CmpFindKeyControlBlock
+CmpDeleteKeyObject
+mblen
+PspDereferenceEventPair
+PsGetVersion
+PspDeleteThreadSecurity
+PspInitializeProcessSecurity
+DbgLoadImageSymbols
+MiDownShareCountFlushEntireTb
+MiUpCloneProtoRefCount
+IopFreeIrpAndMdls
+IopDescriptorSortingWeight
+IoStopTimer
+FsRtlCheckNoSharedConflict
+ExInterlockedExtendZone
+ExDeleteResource
+CacheImageSymbols
+RtlCopySid
+RtlCompressWorkSpaceSizeLZNT1
+PsEstablishWin32Callouts
+SeQuerySecurityAccessMask
+CmpConfigureProcessors
+CmpSearchOpenWorker
+CmpQuerySecurityDescriptorInfo
+CmpFileFlush
+wctomb
+wcscat
+RtlpCreateHandleForAtom
+LpcpClosePort
+KiSaveProcessorControlState
+KeCancelTimer
+KeBugCheckUnicodeToAnsi
+KdpSwitchProcessor
+IoFreeController
+xHalDeviceControl
+FsRtlLookupLastMcbEntry
+ExpTimeZoneDpcRoutine
+CcSetDirtyPageThreshold
+NtClearEvent
+FsRtlNotifyChangeDirectory
+RtlValidSid
+RtlpDestroyHeapSegment
+CmpLazyFlush
+KdpSendString
+_wcsrev
+_strrev
+_strcmpi
+ObpDeleteDirectoryEntry
+ObAssignObjectSecurityDescriptor
+RtlInitializeExceptionLog
+RtlpVirtualUnwind
+MiUpPfnReferenceCount
+MiRemoveWsleFromFreeList
+KeTryToAttachProcess
+NtCreateFile
+IopGetModeInformation
+RtlIntegerToUnicodeString
+RtlDeleteRegistryValue
+PsCreateSystemThread
+SepSinglePrivilegeCheck
+CmpDoFileSetSize
+DbgkpSuspendProcess
+DbgkpResumeProcess
+tolower
+ObReferenceObjectByPointer
+MiGetSystemCacheSubsection
+KiGetPhysicalAddress
+KdpPageInData
+IopDecrementDeviceObjectRef
+IopGetMountFlag
+IopRemoveTimerFromTimerList
+IoStartTimer
+IoRegisterDriverReinitialization
+RtlpAddData
+NtAlertThread
+SeAssignPrimaryToken
+SepFreePrimaryGroup
+SepAppendDefaultDacl
+CmpNameSize
+CmFlushKey
+KdpRestoreBreakpoint
+wcscmp
+PsOpenTokenOfProcess
+RtlSecondsSince1980ToTime
+RtlSectionTableFromVirtualAddress
+RtlEnlargedUnsignedDivide
+DbgPrint
+MiCaptureSystemPte
+KeInitializeQueue
+IopErrorLogGetEntry
+IoDetachDevice
+ExpProfileDelete
+IopAllocateIrpCleanup
+NtListenPort
+LpcpAllocateFromPortZone
+RawQueryFsVolumeInfo
+SepInformFileSystemsOfDeletedLogon
+SeSetSecurityAccessMask
+SepTokenDeleteMethod
+CmpFreePostBlock
+CmpDereferenceKeyControlBlock
+CmpDestroyHive
+CmpCloseKeyObject
+CmpDoFlushAll
+KdpWriteBreakpoint
+wcscspn
+PsRevertToSelf
+ObpSetHandleAttributes
+MmAllowWorkingSetExpansion
+MiUpdateImageHeaderPage
+KeQueryBasePriorityThread
+KeRemoveEntryDeviceQueue
+ExpTimerDpcRoutine
+CcUnmapAndPurge
+NtSetLowEventPair
+KeReleaseSpinLock
+ExReleaseResourceLite
+MiReserveSystemPtes
+ExFreePoolWithTag
+ExFreePool
+CcDeallocateBcb
+CcUnpinDataForThread
+FsRtlStackOverflowRead
+CcGetVirtualAddress
+CcMapAndRead
+ExAcquireResourceSharedLite
+ObfDereferenceObject
+NtClose
+FsRtlOplockCleanup
+FsRtlOplockBreakToII
+IofCompleteRequest
+MiFlushSectionInternal
+MiDecrementShareCount2
+MiCheckControlArea
+MmZeroPageThread
+MiResolveProtoPteFault
+MiRestoreTransitionPte
+MiRemovePageFromList
+MiCompleteProtoPteFault
+IoReleaseCancelSpinLock
+NtSetHighEventPair
+IoRegisterShutdownNotification
+LpcpPrepareToWakeClient
+LpcpSaveDataInfoMessage
+RtlValidAcl
+RtlGetGroupSecurityDescriptor
+RtlGetOwnerSecurityDescriptor
+RawInitializeVcb
+SePrivilegeCheck
+SepFreeDefaultDacl
+DbgkUnMapViewOfSection
+wcsspn
+_wcsicmp
+MiWaitForForkToComplete
+MiLocateAddress
+MiFlushRangeFilter
+MiUnlockPagedAddress
+MiIsPteDecommittedPage
+MiCheckPageFileMapping
+MmDbgReadCheck
+KeQueryIntervalProfile
+KiInstructionBusError
+KeFillFixedEntryTb
+KiTrapDispatch
+KiIntegerOverflowDispatch
+KiInstructionBusErrorDispatch
+KiIllegalInstructionDispatch
+KiDataBusErrorDispatch
+KiCoprocessorUnusableDispatch
+IopSetAttachedDevicePointer
+FsRtlRemoveMcbEntry
+RtlZeroMemory
+ExInitializeResourceLite
+CcAllocateInitializeBcb
+CcPreparePinWrite
+ExInterlockedAddUlong
+FsRtlGetNextMcbEntry
+ExInterlockedPushEntryList
+ExQueryPoolBlockSize
+KeInitializeMutant
+NtQuerySystemTime
+MmGetCrashDumpInformation
+RtlGetCompressionWorkSpaceSize
+SePrivilegeObjectAuditAlarm
+CmpFindKeyControlBlockWithLock
+wcsncmp
+wcsncat
+strncmp
+strncat
+RtlTimeToSecondsSince1980
+RtlImageNtHeader
+MiGetPreviousNode
+MiGetNextNode
+MiInsertFrontModifiedNoWrite
+KeInitializeProfile
+KiInterruptDispatchRaise
+KiFlushRandomTb
+KiBugCheckDispatch
+CcMdlReadComplete
+SeCopyClientToken
+CmpAllocate
+CmpAllocateTag
+HvpFillFileName
+CmpDoCompareKeyName
+HvpHeaderCheckSum
+KdpReceiveString
+vsprintf
+toupper
+KiSelectNextThread
+KiReadEntryTb
+KdpPollBreakInWithPortLock
+IopStartApcHardError
+IO_DESC_MAX
+FsRtlRemoveLargeEntry
+CcScheduleLazyWriteScan
+FsRtlNotifyInitializeSync
+IoDisconnectInterrupt
+IoDeleteSymbolicLink
+IoCreateSymbolicLink
+MiFlushAllPages
+RtlMultiByteToUnicodeSize
+RtlSetGroupSecurityDescriptor
+RtlSetOwnerSecurityDescriptor
+ObpInitSecurityDescriptorCache
+RawQueryFsAttributeInfo
+SepAppendPrimaryGroup
+NtInitializeRegistry
+KdEnterDebugger
+RtlExtendedLargeIntegerDivide
+RtlNumberOfClearBits
+MiObtainFreePages
+KeSetIdealProcessorThread
+IopDeleteIoCompletion
+FsRtlFreeFirstMapping
+CcMdlWriteComplete
+KeIpiInterrupt
+NtWaitLowEventPair
+NtWaitHighEventPair
+NtSetLowWaitHighEventPair
+NtSetHighWaitLowEventPair
+IopOpenRegistryKey
+LpcpFreePortClientSecurity
+MiCrashDumpWorker
+MmPageEntireDriver
+RtlCreateUnicodeString
+RtlDescribeChunk
+RtlReserveChunk
+RtlRandom
+ObGetHandleInformation
+ObKillProcess
+SeDeleteObjectAuditAlarm
+CmpRemoveSecurityCellList
+KdExitDebugger
+wcsrchr
+_strnicmp
+_itoa
+RtlpRaiseException
+RtlRealSuccessor
+MmForceSectionClosed
+KeSetIntervalProfile
+NtRaiseException
+KeSweepDcache
+IoInitializeIrp
+ExInitializeZone
+FsRtlRemoveLargeMcbEntry
+FsRtlReleaseFile
+RtlMoveMemory
+ExpFindCurrentThread
+IopCompleteRequest
+RtlInsertElementGenericTable
+RtlCopyUnicodeString
+FsRtlTruncateLargeMcb
+FsRtlAddLargeEntry
+KiSaveVolatileFloatState
+KiChainedDispatch
+KiInterruptDistribution
+IopErrorLogQueueRequest
+LpcpInitializePortQueue
+RtlUnicodeToMultiByteSize
+RtlAnsiCharToUnicodeChar
+RawCleanup
+SepQueryTypeString
+HvpGetCellPaged
+HvpGetCellMap
+KdpWriteVirtualMemory
+KdpPageIn
+FsRtlAcquireFileExclusive
+RawCheckForDismount
+RtlNumberOfSetBits
+RtlAppendAsciizToString
+MiUnmapImageHeaderInHyperSpace
+KeForceResumeThread
+KiFloatDispatch
+IoAllocateController
+IoAttachDeviceToDeviceStack
+IoBuildSynchronousFsdRequest
+ExInterlockedRemoveHeadList
+ExInterlockedInsertHeadList
+RtlDecompressBuffer
+RawQueryFsDeviceInfo
+SeCloseObjectAuditAlarm
+CmpCopyTree
+DbgkExitThread
+_mbstrlen
+_vsnprintf
+ObpEnumFindHandleProcedure
+RtlAppendStringToString
+MiFeedSysPtePool
+KiReinsertTreeTimer
+KeRevertToUserAffinityThread
+KiProcessProfileList
+KeAcquireSpinLock
+ExpScanPoolLookasideList
+MiDoesPdeExistAndMakeValid
+NtQueryDefaultLocale
+FsRtlReleaseFileForModWrite
+MmDeleteTeb
+OpbCreateCacheEntry
+SepDequeueWorkItem
+CmpValidateAlternate
+NtDeleteKey
+CmpFreeValue
+wcsstr
+_wcsnicmp
+_snprintf
+PsSetCreateProcessNotifyRoutine
+DaysAndFractionToTime
+RtlpAtomMapAtomToHandleEntry
+MmDisableModifiedWriteOfSection
+LpcpMoveMessage
+KiPcToFileHeader
+KeResumeThread
+IopAllocateIrpMustSucceed
+IoAttachDeviceByPointer
+ExReturnPoolQuota
+ExConvertExclusiveToSharedLite
+CcSetBcbOwnerPointer
+FsRtlDeleteTunnelCache
+FsRtlCheckNotifyForDelete
+RtlEqualSid
+RtlCompressBuffer
+PsUnlockProcess
+SepAssemblePrivileges
+SeExchangePrimaryToken
+CmpCheckCreateAccess
+HvpFreeMap
+DbgkExitProcess
+sprintf
+LsaCallAuthenticationPackage
+RtlEnumerateGenericTableWithoutSplaying
+MiMakePdeExistAndMakeValid
+MiInitializePfnForOtherProcess
+KiThreadDispatch
+KeSetSystemAffinityThread
+KeSweepIcache
+ExpGetHandleInformation
+ProbeForWrite
+NtUnmapViewOfSection
+PspMapSystemDll
+SeCheckAuditPrivilege
+HvAllocateCell
+CmSetLastWriteTimeKey
+DbgkpSendApiMessage
+RawCompletionRoutine
+PspSystemThreadStartup
+ObValidateSecurityQuota
+RtlpRaiseStatus
+KeTestAlertThread
+KeRundownQueue
+IopRaiseInformationalHardError
+ExAdjustLookasideDepth
+MmUnmapViewInSystemSpace
+ExCreateHandleTable
+ExpGetObjectInformation
+KeInitializeProcess
+LpcpFreeDataInfoMessage
+RtlFirstFreeAce
+RtlSetSaclSecurityDescriptor
+RtlSetDaclSecurityDescriptor
+RtlDecompressFragment
+PsSetProcessPriorityByClass
+SepConcatenatePrivileges
+KeInitializeSpinLock
+ExReinitializeResourceLite
+FsRtlPrivateInitializeFileLock
+ExAcquireResourceExclusiveLite
+RtlFreeHeapSlowly
+KiIpiStallOnPacketTargets
+SwapContext
+KiDispatchInterrupt
+KxUnlockDispatcherDatabase
+ExAcquireFastMutex
+PsReferenceImpersonationToken
+PsImpersonateClient
+PsAssignImpersonationToken
+PsReferencePrimaryToken
+FsRtlLookupLargeMcbEntry
+FsRtlGetNextLargeMcbEntry
+FsRtlLookupLastLargeMcbEntry
+FsRtlNumberOfRunsInLargeMcb
+SepInformLsaOfDeletedLogon
+CmpFlushNotify
+CmpFreeKeyBody
+CmpFreeSecurityDescriptor
+CmpRemoveFromHiveFileList
+PspDereferenceQuota
+ObDupHandleProcedure
+KiTbMiss
+IoWriteErrorLogEntry
+ExExtendZone
+RtlExtendedIntegerMultiply
+NtAllocateLocallyUniqueId
+NtQueryIntervalProfile
+RtlGetSaclSecurityDescriptor
+RtlGetDaclSecurityDescriptor
+LdrVerifyMappedImageMatchesChecksum
+RawQueryInformation
+SepQueryNameString
+HvpDiscardBins
+KdpDeleteBreakpoint
+PspAssignPrimaryToken
+PsDisableImpersonation
+KiCalibratePerformanceCounter
+KeRemoveQueueDpc
+KeFlushQueueApc
+FsRtlLookupMcbEntry
+RtlWriteRegistryValue
+ExpInterlockedPushEntrySList
+IoFreeIrp
+ObpFreeObjectNameBuffer
+IoFreeMdl
+KiUnwaitThread
+KiActivateWaiterQueue
+KeSetEventBoostPriority
+ExReleaseFastMutex
+ExReleaseFastMutexUnsafe
+KiRaiseIrqlToXxxLevel
+IoStartPacket
+IoQueueThreadIrp
+FsRtlRequestExclusiveOplock
+FsRtlAcknowledgeOplockBreak
+FsRtlUninitializeOplock
+ExReleaseHandleTableShared
+ExReleaseHandleTableExclusive
+KiWaitTest
+KiInsertQueueApc
+KiSwapThread
+KeWaitForSingleObject
+ExAcquireFastMutexUnsafe
+ExAcquireHandleTableShared
+KiSuspendThread
+ExAcquireHandleTableExclusive
+FsRtlWaitOnIrp
+KeRemoveQueue
+ExpWorkerThread
+KiInsertQueue
+KiFlushFixedTb
+IoSetTopLevelIrp
+KeRaiseIrql
+KeSynchronizeExecution
+IoGetRelatedDeviceObject
+IoSynchronousPageWrite
+IoPageRead
+KiInterruptStackSwitch
+KiExceptionDispatch
+ExpInterlockedExchangeAddLargeInteger
+KiReadyThread
+KeEnterCriticalRegion
+KeLeaveCriticalRegion
+IoCallDriver
+ExpInterlockedCompareExchange64
+KiInterruptDispatchSame
+IoGetTopLevelIrp
+PsCreateWin32Process
+SeQueryAuthenticationIdToken
+CmCheckRegistry
+CmpCopyCell
+KdpPrintString
+strstr
+LsaDeregisterLogonProcess
+ObpProcessRemoveObjectQueue
+MmIsSystemAddressAccessable
+KeBoostPriorityThread
+KeEnterKernelDebugger
+FsRtlpPostStackOverflow
+FsRtlPrivateRemoveLock
+ExpScanGeneralLookasideList
+CcSetAdditionalCacheAttributes
+ExpGetLockInformation
+NtSetDefaultHardErrorPort
+FsRtlpOpenDev
+IoUnregisterFileSystem
+NtMakeTemporaryObject
+RawSetInformation
+SepFilterPrivilegeAudits
+CmpClaimGlobalQuota
+HvpGrowLog1
+SeUnlockSubjectContext
+KeSwitchKernelStack
+NtContinue
+KiFloatingDispatch
+KeChangeColorPage
+IopCompletePageWrite
+CmpCreatePredefined
+CmpPostApc
+strncpy
+RtlCompareMemoryUlong
+RtlCopyString
+MmDbgWriteCheck
+MmCreateMdl
+KeSuspendThread
+KePulseEvent
+KeSetProcess
+KdIsThisAKdTrap
+CcAllocateObcb
+IoInitializeTimer
+IopErrorLogConnectPort
+PspThreadDelete
+NtRegisterThreadTerminatePort
+SeSinglePrivilegeCheck
+CmpPostApcRunDown
+CmpCheckNotifyAccess
+HvpGrowLog2
+KiInSwapKernelStacks
+strcpy
+mbtowc
+RtlEnumerateGenericTable
+IoStartNextPacketByKey
+ExpRaiseStatus
+ExInitializeNPagedLookasideList
+FsRtlDoesDbcsContainWildCards
+IoCreateSynchronizationEvent
+IoCreateNotificationEvent
+RawClose
+NtSaveKey
+KdpSetContext
+LsaLookupAuthenticationPackage
+ObpCaptureHandleInformation
+MiMakeSystemAddressValid
+MmGetPhysicalAddress
+KeSwitchFrozenProcessor
+KiMoveApcState
+KiProbeEntryTb
+KiAddressErrorDispatch
+FsRtlWorkerThread
+FsRtlNotifySetCancelRoutine
+ExpCopyThreadInfo
+ExRemoveHandleTable
+ExpUuidSaveSequenceNumber
+IoUnregisterFsRegistrationChange
+IoRegisterFsRegistrationChange
+IopSynchronousApiServiceTail
+LpcpFreeConMsg
+ObQueryObjectAuditingByHandle
+KiUnlockDispatcherDatabase
+KeReadStateTimer
+CcMapData
+KdpReadVirtualMemory
+KdpReportExceptionStateChange
+RtlPcToFileHeader
+RtlPinAtomInAtomTable
+MiLocateAddressInTree
+MiGetPageForHeader
+KiInvalidCompareSingle
+KiInvalidCompareDouble
+KiIpiGenericCall
+FsRtlRemoveAndCompleteIrp
+MmUnlockCachedPage
+ExTryToAcquireResourceExclusiveLite
+ExShutdownSystem
+FsRtlInitializeOpFilter
+IopFindCollisionInTList
+IopGetRegistryValues
+RtlComputeLfnChecksum
+LZNT1FindMatchMaximum
+NtFlushKey
+HvpAllocateMap
+DbgkMapViewOfSection
+NtDelayExecution
+KdpDeleteBreakpointRange
+RtlAppendUnicodeToString
+MiHandleBankedSection
+MiCheckPdeForPagedPool
+KeRemoveQueueApc
+KiSweepIcacheRangeTarget
+FsRtlCheckLockForWriteAccess
+FsRtlBalanceReads
+IoCreateUnprotectedSymbolicLink
+ComputeNameLength
+SeCheckPrivilegedObject
+SeDefaultObjectMethod
+KdpMoveMemory
+SeAuditingFileOrGlobalEvents
+MiInitializeCopyOnWritePfn
+MmBuildMdlForNonPagedPool
+KiDataBusError
+KeAlertThread
+FsRtlMdlReadComplete
+ExpRaiseException
+ExpComputeLookasideDepth
+CcScanDpc
+LdrpCompareResourceNames_U
+RtlGetAce
+NtOpenDirectoryObject
+NtOpenSymbolicLinkObject
+SepAdtCopyToLsaSharedMemory
+SepRmSetAuditEventWrkr
+strcat
+RtlAppendUnicodeStringToString
+KeRegisterBugCheckCallback
+IopTimerDispatch
+NtQueryDirectoryFile
+NtQueryOleDirectoryFile
+SePrivilegedServiceAuditAlarm
+CmpCompareCompressedName
+CmpFindSubKeyByNumber
+KdpGetContext
+RtlImageDirectoryEntryToData
+MiInsertNode
+KeInitializeInterrupt
+ExSetResourceOwnerPointer
+ExReleaseResourceForThread
+NtQueryTimerResolution
+IopFreeResourceDir
+IopGetRegistryKeyInformation
+IopLoadFileSystemDriver
+IopMarkDuplicateDevice
+MiSetImageProtectWrite
+RtlOpenCurrentUser
+SepNotifyFileSystems
+CmpDeleteTree
+IoUnregisterShutdownNotification
+PsLookupThreadByThreadId
+PsLookupProcessByProcessId
+PsReferenceEffectiveToken
+ObFindHandleForObject
+ObAssignSecurity
+RtlLargeIntegerDivide
+MiLockPagedAddress
+MiCheckForContiguousMemory
+KiSystemServiceHandler
+FsRtlInitProcessorLockQueue
+FsRtlMdlWriteComplete
+IoGetDeviceObjectPointer
+KeLowerIrql
+CcFindBcb
+FsRtlDissectName
+ZwMakeTemporaryObject
+SeSetAccessStateGenericMapping
+KeFlushIoBuffers
+SeCaptureSubjectContext
+IopGetDeviceInstanceCsConfigFlags
+NtOpenSection
+CmpSearchForOpenSubKeys
+CmpSearchKeyControlBlockTree
+CmpCopyName
+DbgkpSectionHandleToFileHandle
+wcstombs
+swprintf
+mbstowcs
+_snwprintf
+MiReturnPageFileQuota
+NtCallbackReturn
+KiWaitSatisfyAll
+FsRtlFreeTunnelNode
+ObpInsertDirectoryEntry
+IopExceptionCleanup
+NtCreateProcess
+RawFileSystemControl
+MmMapMemoryDumpMdl
+KiInvalidOperationLongword
+KiDivideByZeroSingle
+FsRtlNotifyCompleteIrpList
+MiFindEmptyAddressRange
+NtQueryInformationPort
+RtlSetActiveTimeBias
+NtRestoreKey
+HvSyncHive
+HvpTruncateBins
+MiSetProtectionOnTransitionPte
+MmRaisePoolQuota
+MiGetProtoPteAddressExtended
+MiFlushInPageSupportBlock
+MiFlushEventCounter
+KeThawAllThreads
+KiXTbMiss
+IopDropIrp
+NtQueryPerformanceCounter
+IopCancelAlertedRequest
+LpcpFreeToPortZone
+PspExitNormalApc
+FsRtlDeregisterUncProvider
+MiLocateSubsection
+KeBoostCurrentThread
+FsRtlUninitializeLargeMcb
+ExInitializePagedLookasideList
+CcWaitOnActiveCount
+FsRtlPrivateInsertExclusiveLock
+IopGetRegistryValue
+SeRegisterLogonSessionTerminatedRoutine
+SepSidInToken
+RtlCreateAtomTable
+MiBuildKernelMap
+KeAlertResumeThread
+FsRtlCancelWaitIrp
+ExpTimerApcRoutine
+ExChangeHandle
+NtCompleteConnectPort
+SeComputeQuotaInformationSize
+SepAdtLogAuditRecord
+MiFlushTbAndCapture
+KiSwapProcess
+CcDeferWrite
+KeReleaseSemaphore
+MmFlushImageSection
+IopWriteResourceList
+PspTerminateThreadByPointer
+SeGetTokenControlInformation
+strspn
+IofCallDriver
+RtlSplay
+RtlLookupElementGenericTable
+RtlDelete
+RtlDeleteElementGenericTable
+FsRtlRemoveNodeFromTunnel
+FsRtlPrivateCheckForExclusiveLockAccess
+SeCreateAccessState
+ObOpenObjectByPointer
+CmSetRegistryQuotaInformation
+MiRemovePageByColor
+MiRemoveAnyPage
+MiResolveMappedFileFault
+MiRemoveZeroPage
+ObpDeleteSymbolicLink
+RtlLookupFunctionEntry
+KeRundownThread
+NtStopProfile
+NtSetIoCompletion
+RtlpGenerateInheritAcl
+LdrRelocateImage
+NtAlertResumeThread
+RawQueryVolumeInformation
+KiLookupFunctionEntry
+KdpSetStateChange
+FsRtlPrivateResetLowestLockOffset
+NtOpenEvent
+NtOpenEventPair
+NtOpenMutant
+NtOpenSemaphore
+NtOpenTimer
+IoCancelThreadIo
+NtOpenIoCompletion
+PiRegSzToString
+CmQueryValueKey
+MiMakeSystemAddressValidPfnWs
+NtW32Call
+ExpUuidLoadSequenceNumber
+IoAttachDevice
+MiLookupDataTableEntry
+SeSubProcessToken
+KdpGetVersion
+IopCheckUnloadDriver
+ObSetSecurityDescriptorInfo
+MiInsertStandbyListAtFront
+IopCatagorizeDescriptors
+RtlInitCodePageTable
+SeUnregisterLogonSessionTerminatedRoutine
+CmDeleteKey
+KdpRestoreBreakPointEx
+RtlEqualPrefixSid
+KiOutSwapProcesses
+PspReaper
+MiCauseOverCommitPopup
+MmDbgTranslatePhysicalAddress
+ExpFindAndRemoveTagBigPages
+FsRtlMdlRead
+ExAllocatePoolWithTag
+ExAllocatePoolWithQuotaTag
+FsRtlPrivateInsertLock
+IopParseFile
+ExTryToAcquireFastMutex
+SepRmSendCommandToLsaWrkr
+KiRetireDpcList
+FsRtlOplockIsFastIoPossible
+wcslen
+RtlpGetStackLimits
+KiIpiProcessRequests
+FsRtlPrepareMdlWrite
+IopConcatenateUnicodeStrings
+PfxRemovePrefix
+SeAuditHandleCreation
+SepCopyProxyData
+MiLookupWsleHashIndex
+MiCheckForControlAreaDeletion
+ExpAddTagForBigPages
+MmUnmapVideoDisplay
+MmCreateTeb
+CmEnumerateKey
+MiRemoveFromSystemSpace
+FsRtlpRegisterProviderWithMUP
+PsWatchWorkingSet
+RtlPrefixString
+RtlEqualString
+KiCallUserMode
+FsRtlPrivateCheckForSharedLockAccess
+KiIdleLoop
+NtQueryAttributesFile
+RawReadWriteDeviceControl
+SepMakeTokenEffectiveOnly
+CmpLinkKeyToHive
+NtQueryKey
+NtSetInformationKey
+CmpOpenFileWithExtremePrejudice
+CmUnloadKey
+CmpCreatePerfKeys
+MiReturnPageTablePageCommitment
+KiContinue
+KiDivideByZeroDouble
+KiSetServerWaitClientEvent
+IopCompleteDriverUnload
+FsRtlpIsDfsEnabled
+ExDeleteNPagedLookasideList
+ExDeletePagedLookasideList
+ExInitializeResource
+FsRtlDissectDbcs
+IoCreateController
+RtlCopySidAndAttributesArray
+CmpGetNextName
+MiPageFileFull
+KiInvalidOperationQuadword
+ObQueryTypeName
+NtEnumerateKey
+NtEnumerateValueKey
+CmpDoFindSubKeyByNumber
+PsOpenTokenOfThread
+RtlCaptureContext
+RtlDestroyAtomTable
+KiUnpackSingle
+KeDetachProcess
+IoCheckEaBufferValidity
+IopGetResourceReqRegistryValue
+NtOpenProcessToken
+SeMarkLogonSessionForTerminationNotification
+HvMarkCellDirty
+FsRtlFindLargeIndex
+RtlCompareMemory
+KeFlushCurrentTb
+ZwCreateSection
+KiIpiSendPacket
+IoFastQueryNetworkAttributes
+ElapsedDaysToYears
+CcUnpinData
+RtlpGetExtraStuffPointer
+KeQuerySystemTime
+MiTakePageFromWorkingSet
+RtlEqualMemory
+CmpQueryKeyName
+CmEnumerateValueKey
+DbgkForwardException
+RtlGetCallersAddress
+KeFreezeAllThreads
+ExDestroyHandleTable
+NtResetEvent
+IopLoadUnloadDriver
+IopLookupBusStringFromID
+RtlNextUnicodePrefix
+RawMountVolume
+SepRmCommandServerThread
+RtlCompareString
+MiChargePageFileQuota
+FsRtlCancelOplockIIIrp
+FsRtlCheckNoExclusiveConflict
+ExpCopyProcessInfo
+NtWaitForSingleObject
+NtCreateDirectoryObject
+CmpValidateHiveSecurityDescriptors
+MmAllocateContiguousMemory
+KeUserModeCallback
+KeSetBasePriorityThread
+FsRtlFindFirstOverlappingSharedNode
+KiInitializeUserApc
+MmFreeNonCachedMemory
+NtPulseEvent
+NtSetEvent
+NtSetInformationObject
+ObpHashSecurityDescriptor
+__ull_rem
+__ull_div
+NtYieldExecution
+ExpGetPoolTagInfo
+FsRtlSetFileSize
+NtExtendSection
+CmBootLastKnownGood
+CmpCheckRegistry2
+__ull_divrem_6416
+RtlpGetIntegerAtom
+NtQueueApcThread
+SepQueueWorkItem
+PsLookupProcessThreadByCid
+RtlDeleteAtomFromAtomTable
+KiInitializeContextThread
+KeSweepIcacheRange
+IoAsynchronousPageWrite
+FsRtlPrivateCancelFileLockIrp
+NtCreateEventPair
+RtlAllocateAndInitializeSid
+KiIpiSend
+MiFreeInPageSupportBlock
+KiRestoreVolatileFloatState
+ExSystemTimeToLocalTime
+RtlFindClearBits
+RtlFindClearBitsAndSet
+ExInterlockedInsertTailList
+PspProcessDelete
+SepProbeAndCaptureString_U
+CmpInitHiveFromFile
+ObOpenObjectByName
+IoCreateFile
+IopOpenLinkOrRenameTarget
+NtDeleteFile
+NtOpenKey
+SepAdtInitializePrivilegeAuditing
+CmpRefreshHive
+CcSetValidData
+IoReportResourceUsage
+IopAcquireFileObjectLock
+RtlFindMessage
+PspUserThreadStartup
+CmpLinkHiveToMaster
+CmpFileRead
+KeSwapProcessOrStack
+RtlEmptyAtomTable
+FsRtlCancelExclusiveIrp
+MiFreeInitializationCode
+NtCreateMutant
+NtCreateIoCompletion
+RtlDestroyHeap
+SeObjectReferenceAuditAlarm
+NtQueryMultipleValueKey
+KeReleaseWaitForSemaphore
+SepReferenceLogonSession
+CmpReportNotifyHelper
+HvMarkClean
+CmpFindSubKeyInLeaf
+KiOutSwapKernelStacks
+LsaLogonUser
+RtlLookupAtomInAtomTable
+RtlpAddKnownAce
+MmUnlockPagableImageSection
+MmFreeDriverInitialization
+MmUnsecureVirtualMemory
+LdrProcessRelocationBlock
+SepCreateImpersonationTokenDacl
+CmpAllocatePostBlock
+CmpFileWrite
+MiDecrementReferenceCount
+KdPollBreakIn
+ObReferenceObjectByHandle
+RtlTimeToTimeFields
+RtlExtendedMagicDivide
+RtlTimeToSecondsSince1970
+KiComputeTimerTableIndex
+RtlCompareUnicodeString
+RtlFillMemoryUlong
+IoGetRequestorProcess
+KiInterruptTemplate
+NtSetSystemPowerState
+ExGetPreviousMode
+IoGetCurrentProcess
+IoGetFileObjectGenericMapping
+RtlMapGenericMask
+IoCheckDesiredAccess
+KeProfileInterrupt
+FsRtlCurrentBatchOplock
+RtlUpcaseUnicodeChar
+KiScanBugCheckCallbackList
+CcUnpinRepinnedBcb
+SeDeleteAccessState
+FsRtlMdlWriteCompleteDev
+RtlIsGenericTableEmpty
+ObpCaptureObjectCreateInformation
+ObCreateObject
+ObpCaptureObjectName
+IoIsOperationSynchronous
+SeReleaseSubjectContext
+RtlQueryAtomsInAtomTable
+MmCanFileBeTruncatedInternal
+NtShutdownSystem
+IopSortDescriptors
+IopOpenServiceEnumKeys
+RtlResetRtlTranslations
+PfxFindPrefix
+RtlUpcaseUnicodeStringToAnsiString
+MiSetPageModified
+MmSetMemoryPriorityProcess
+KiUserAddressErrorDispatch
+HalpCalculateChsValues
+NtCreateMailslotFile
+SepAdtInitializeBounds
+HvpGetLogHeader
+ObInitProcess
+CcIsThereDirtyData
+ExEnumHandleTable
+FsRtlInitializeTunnel
+IoDeleteDevice
+IoQueryDeviceEnumInfo
+MmCheckSystemImage
+RtlAnsiStringToUnicodeString
+RtlpQueryRegistryDirect
+ObQueryTypeInfo
+HvpEnlistFreeCells
+RtlFindFirstRunSet
+KdSetOwedBreakpoints
+IoQueryDeviceDescription
+RtlOemStringToCountedUnicodeString
+RtlDowncaseUnicodeString
+CmpReportNotify
+HvpIsFreeNeighbor
+MiExtendPagingFiles
+KiSetRegisterValue
+MiInsertPageInList
+MmIsAddressValid
+ExCreateHandle
+ObpCreateHandle
+ObpCreateUnnamedHandle
+FsRtlPrivateLimitFreeLockList
+ExDestroyHandle
+IoBuildPartialMdl
+RtlNtStatusToDosErrorNoTeb
+MiCheckProtoPtePageState
+ObpChargeQuotaForObject
+IoRegisterFileSystem
+RtlDescribeChunkLZNT1
+SeAssignWorldSecurityDescriptor
+CmpFindNameInList
+MiRemoveVad
+MiChargeCommitmentCantExpand
+FsRtlOpFilterWorkerRoutine
+IopOpenCurrentHwProfileDeviceInstanceKey
+RtlpInsertUnCommittedPages
+SepApplyAclToObject
+NtUnloadKey
+CmpInsertSecurityCellList
+RtlFormatCurrentUserKeyPath
+ExpRemovePoolTracker
+CcGetLsnForFileObject
+MiEnablePagingOfDriver
+RtlAddAuditAccessAce
+RawUserFsCtrl
+NtDeleteValueKey
+CmpFindSubKeyByName
+KdpPromptString
+RtlCompressChunks
+MmCopyVirtualMemory
+KiGetRegisterValue
+ExLockUserBuffer
+SepAdtGenerateDiscardAudit
+MiMakeSystemAddressValidPfn
+ObpValidateAccessMask
+RtlEqualUnicodeString
+KiInsertTimerTable
+KiInsertTreeTimer
+MiSetDirtyBit
+SeAuditingFileEvents
+MiInitializePfn
+FsRtlDoesNameContainWildCards
+RtlFreeUnicodeString
+KiIpiSignalPacketDone
+KiFlushSingleTbTarget
+KiChangeColorPageTarget
+KiFlushMultipleTbTarget
+MiLocateAndReserveWsle
+MiAddValidPageToWorkingSet
+KdpReadIoSpace
+KdpReadControlSpace
+MiUnlinkPageFromList
+ExMapHandleToPointer
+FsRtlIsNameInExpressionPrivate
+FsRtlIsNameInExpression
+ObpAllocateObject
+FsRtlCheckOplock
+ObpRemoveObjectRoutine
+FsRtlRemoveAndCompleteWaitIrp
+KeInitializeEvent
+ExAcquireResourceExclusive
+CcPurgeAndClearCacheSection
+PspQueryPooledQuotaLimits
+NtReleaseMutant
+IopParseDevice
+KeUpdateSystemTime
+NtQueryFullAttributesFile
+NtQueryIoCompletion
+NtWriteVirtualMemory
+PspExitProcess
+SeFastTraverseCheck
+CmpCopyTree2
+__ull_divrem_5353
+MiFreeWsle
+CcPostDeferredWrites
+RtlClearBits
+MiReleasePageFileSpace
+ExInterlockedPopEntryList
+IO_DESC_MIN
+SepGetDefaultsSubjectContext
+FsRtlMdlReadCompleteDev
+RtlIsNameLegalDOS8Dot3
+RtlUnicodeToOemN
+RtlUnicodeStringToOemString
+RtlUnicodeStringToCountedOemString
+ObpDecrementHandleCount
+MiLocateWsle
+RtlUpcaseUnicodeString
+FsRtlAreNamesEqual
+IoAllocateAdapterChannel
+MmDeterminePoolType
+FsRtlInitializeOplock
+RtlUpcaseUnicodeToOemN
+RtlUpcaseUnicodeStringToOemString
+RtlUpcaseUnicodeStringToCountedOemString
+ObpLookupObjectName
+RtlSetBits
+ExInterlockedAddLargeStatistic
+IopCloseFile
+FsRtlIsFatDbcsLegal
+FsRtlOplockFsctrl
+FsRtlFindInTunnelCache
+IopCheckBackupRestorePrivilege
+FsRtlPruneTunnelCache
+IoRemoveShareAccess
+KeTryToAcquireSpinLock
+FsRtlAcquireFileForCcFlush
+FsRtlReleaseFileForCcFlush
+SeLockSubjectContext
+KeInitializeEventPair
+MiReleaseWsle
+RtlAreAllAccessesGranted
+RtlOemToUnicodeN
+RtlOemStringToUnicodeString
+ObpFreeObject
+NtQueryEvent
+NtCreateSemaphore
+FsRtlDeleteKeyFromTunnelCache
+MiUpdateWsle
+RtlFindFirstRunClear
+SepTokenIsOwner
+RtlSubtreePredecessor
+IoCheckFunctionAccess
+MiRemoveWsle
+IoSetShareAccess
+KeFillEntryTb
+KiFlushSingleTb
+KiBreakpointDispatch
+ObpIncrementHandleCount
+FsRtlAddToTunnelCache
+RtlpDidUnicodeToOemWork
+NtResumeThread
+wcsncpy
+LpcExitThread
+RtlCreateAcl
+ExIsProcessorFeaturePresent
+NtSetInformationFile
+ObpDeleteNameCheck
+ObpIncrementHandleDataBase
+IoCheckShareAccess
+SwapSplayLinks
+RtlDeleteNoSplay
+NtCreateNamedPipeFile
+FsRtlAllocateOplock
+RtlAreBitsSet
+RtlAreBitsClear
+ObDeleteCapturedInsertInfo
+CmQueryKey
+IoUpdateShareAccess
+ExInterlockedAddLargeInteger
+LpcpDeletePort
+MiCheckDosCalls
+MiFreeEventCounter
+LpcpFindDataInfoMessage
+RtlSecondsSince1970ToTime
+MmIsNonPagedSystemAddressValid
+FsRtlNotifyCompletion
+strrchr
+SeAssignSecurity
+MiCreateDataFileMap
+SeValidSecurityDescriptor
+SepCheckAcl
+ExpAllocateHandleTableEntries
+MiInitializeReadInProgressPfn
+SepInheritAcl
+RtlLengthSecurityDescriptor
+KdpReportLoadSymbolsStateChange
+KdpWriteBreakPointEx
+FsRtlNotifyCleanup
+LsaRegisterLogonProcess
+NtQuerySecurityObject
+MiRemovePageFromWorkingSet
+KeReleaseMutant
+IopHardErrorThread
+PspQueryQuotaLimits
+IopGenNextValidResourceList
+MiContractPagingFiles
+KiUnpackDouble
+IopCheckVpbMounted
+MiUnlinkFreeOrZeroedPage
+CmpPostNotify
+FsRtlFindFirstOverlappingExclusiveNode
+RtlpLengthInheritAcl
+MiMakeProtectionMask
+MiInitializeTransitionPfn
+FsRtlOplockBreakNotify
+MiFindActualFaultingPte
+NtSystemDebugControl
+ObpHandleDosDeviceName
+MiAddMappedPtes
+KeSetPriorityProcess
+IoRaiseHardError
+HalpCreateDosLink
+IopAssignResourcesPhase1
+CmpRemoveKeyControlBlockWithLock
+CmpFreeKeyByCell
+SepAdtInitializeCrashOnFail
+ObGetObjectSecurity
+NtQuerySemaphore
+RtlUnicodeStringToAnsiString
+CmNotifyRunDown
+KiFlushMultipleTb
+CmpWorkerCommand
+KeFillLargeEntryTb
+RtlUpperString
+KdpReceivePacketLeader
+KdpAddBreakpoint
+KeInitializeApc
+RtlInitializeSid
+RtlCreateSecurityDescriptor
+KiDisplayString
+KiEmulateFloating
+MiInitMachineDependent
+NtQueryInformationToken
+MiCloneProcessAddressSpace
+NtQuerySystemInformation
+MiCheckSecuredVad
+NtCreateTimer
+NtSuspendThread
+CmpSecurityMethod
+CmpAssignSecurityDescriptor
+NtSetSecurityObject
+RtlFindLongestRunClear
+MiCreateImageFileMap
+RtlAllocateHeapSlowly
+NtAllocateVirtualMemory
+NtSetInformationProcess
+MmAccessFault
+IopReportResourceUsage
+RtlUpcaseUnicodeToCustomCPN
+xHalIoAssignDriveLetters
+KeDumpMachineState
+RtlUpcaseUnicodeToMultiByteN
+FsRtlAddLargeMcbEntry
+FsRtlCopyWrite
+CcCopyRead
+MmMemoryUsage
+MiSetProtectionOnSection
+IopAssignResourcesPhase2
+IopGenNextValidDescriptor
+NtConnectPort
+FsRtlNotifyFullReportChange
+MmWorkingSetManager
+PspCreateProcess
+NtWriteFile
+_output
+_woutput
+IopXxxControlFile
+IopPrepareDriverLoading
+NtFreeVirtualMemory
+NtSetInformationThread
+MiMapViewOfImageSection
+NtQueryInformationFile
+IopCreateMadeupNode
+NtSetInformationToken
+SeCaptureSecurityDescriptor
+MiMapViewOfDataSection
+NtQueryInformationProcess
+RtlAllocateHeap
+NtReadFile
+NtCreatePagingFile
+NtAcceptConnectPort
+IoAssignResources
+MmLoadSystemImage
+LZNT1DecompressChunk
+IopLoadDriver
+NtAccessCheckAndAuditAlarm
+NtDuplicateObject
+CcCopyWrite
+MiMapViewOfPhysicalSection
+MiProtectVirtualMemory
+PspCreateThread
+NtRequestWaitReplyPort
+NtCreateToken
+NtQueryEaFile
+FsRtlIsDbcsInExpression
+KiNormalizeDouble
+CcGetVacbMiss
+NtQueryVirtualMemory
+CcZeroData
+IoWriteCrashDump
+RtlCreateHeap
+IopDriverLoadingFailed
+KiDispatchException
+RtlGenerate8dot3Name
+NtAccessCheck
+HvInitializeHive
+FsRtlRemoveMcbEntryPrivate
+BuildQueryDirectoryIrp
+SeSetSecurityDescriptorInfo
+NtLockVirtualMemory
+SepCreateToken
+MiGatherMappedPages
+IoOpenDeviceInstanceKey
+xHalIoReadPartitionTable
+FsRtlPrepareMdlWriteDev
+MiFindContiguousMemory
+NtOpenObjectAuditAlarm
+PspExitThread
+MmExtendSection
+ObInsertObject
+NtQueryInformationThread
+HvpAddBin
+SepAdtOpenObjectForDeleteAuditAlarm
+SepAdtOpenObjectAuditAlarm
+NtQueryObject
+PpDeviceRegistration
+NtLockFile
+RtlVirtualUnwind
+SepAccessCheck
+MmShutdownSystem
+FsRtlPrivateFastUnlockAll
+NtAdjustGroupsToken
+LZNT1CompressChunk
+KiNormalizeSingle
+VdmQueryDirectoryFile
+NtAdjustPrivilegesToken
+LpcRequestWaitReplyPort
+NtReplyWaitReceivePort
+CmpDoCreateChild
+SeCaptureSidAndAttributesArray
+NtSetSystemInformation
+NtQueryVolumeInformationFile
+IoCreateDevice
+MmCreateProcessAddressSpace
+RtlpGenerateInheritedAce
+LdrpSearchResourceSection_U
+MiLoadImageSection
+pIoQueryDeviceDescription
+KeWaitForMultipleObjects
+MiUpdateModifiedWriterMdls
+NtReleaseSemaphore
+MiIsEntireRangeCommitted
+ObpInsertHandleCount
+MiReserveSystemPtes2
+KiEmulateReference
+MiMakeOutswappedPageResident
+MiDeletePte
+NtWaitForMultipleObjects
+CmRestoreKey
+NtMapViewOfSection
+CcPerformReadAhead
+NtUnlockVirtualMemory
+RtlpVirtualUnwind32
+CmpCheckKey
+IopMountVolume
+FsRtlGetNextFileLock
+xHalIoWritePartitionTable
+MmAdjustWorkingSetSize
+CmpOpenHiveFiles
+ObGetObjectInformation
+NtSetEaFile
+IopQueryDeviceConfiguration
+RtlpCoalesceFreeBlocks
+NtSetVolumeInformationFile
+PspSetQuotaLimits
+RtlpLengthInheritedAce
+HvRefreshHive
+CmpInitializeHiveList
+SeAppendPrivileges
+RtlpDeCommitFreeBlock
+MiGatherPagefilePages
+RtlQueryRegistryValues
+SeQuerySecurityDescriptorInfo
+FsRtlCancelNotify
+NtQueryDirectoryObject
+NtUnlockFile
+SepDuplicateToken
+IoSetInformation
+ExpGetProcessInformation
+MmCleanProcessAddressSpace
+IopGetSetSecurityObject
+ExRefreshTimeZoneInformation
+ExpSystemErrorHandler
+SeOpenObjectForDeleteAuditAlarm
+HvpEnlistFreeCell
+FsRtlCopyRead
+NtNotifyChangeDirectoryFile
+MmSecureVirtualMemory
+MiDecommitPages
+MiWaitForInPageComplete
+SepPrivilegeCheck
+HvReallocateCell
+HvFreeHive
+RtlpLogExceptionHandler
+ExTimerRundown
+NtCreateEvent
+RtlCompressBufferLZNT1
+NtCloseObjectAuditAlarm
+NtDeleteObjectAuditAlarm
+RtlpHashStringToAtom
+NtQueryInformationAtom
+CcScheduleReadAhead
+MiModifiedPageWriterWorker
+SepAdtPrivilegeObjectAuditAlarm
+CmpHiveRootSecurityDescriptor
+NtPlugPlayControl
+ObpParseSymbolicLink
+MiRemoveWorkingSetPages
+NtNotifyChangeKey
+MiWriteComplete
+PspSetContext
+ObpIncrementUnnamedHandleCount
+NtLoadKey2
+RtlpCallQueryRegistryRoutine
+MiResolveImageReferences
+MmGetPageFileInformation
+SeOpenObjectAuditAlarm
+CmpAddSubKey
+ObQueryNameString
+RtlMultiByteToUnicodeN
+FsRtlNotifyFullChangeDirectory
+MiSegmentDelete
+CmpQueryKeyValueData
+MiResetVirtualMemory
+IopIsDeviceInstanceEnabled
+KiVirtualMemoryDispatch
+NtReplyWaitReplyPort
+MmInSwapProcess
+CmpParseKey
+MmFlushVirtualMemory
+IopAssignResourcesPhase3
+ObpProcessDosDeviceSymbolicLink
+PspGetContext
+CmpLoadHiveVolatile
+SepAdtPrivilegedServiceAuditAlarm
+IoRaiseInformationalHardError
+MiDeleteVirtualAddresses
+CmpSetSecurityDescriptorInfo
+CmpSetVersionData
+SepAdjustGroups
+NtOpenProcess
+pIoQueryBusDescription
+NtRequestPort
+NtSetSystemEnvironmentValue
+CcExtendVacbArray
+HvpDoAllocateCell
+CmpQueryKeyData
+PsConvertToGuiThread
+NtOpenThread
+FsRtlSplitLargeMcb
+MiInitializeWorkingSetList
+MiLockCode
+MiCheckForCrashDump
+xHalIoSetPartitionInformation
+HvpBuildMapAndCopy
+MiSnapThunk
+LpcpCopyRequestData
+CmQueryMultipleValueKey
+RtlUnwind2
+KdpReceivePacket
+NtUnloadDriver
+CmpWorker
+MiGetWorkingSetInfo
+NtSetTimer
+MiDeleteSystemPagableVm
+MiGrowWsleHash
+RtlFindSetBits
+KdpSendWaitContinue
+IopErrorLogThread
+MmMapViewInSystemSpace
+RtlDecompressFragmentLZNT1
+LdrpAccessResourceData
+MiPurgeImageSection
+NtRaiseHardError
+memcmp
+CmpSetValueKeyNew
+CcPurgeCacheSection
+MmOutPageKernelStack
+RtlQueryTimeZoneInformation
+CcCreateVacbArray
+KeBugCheckEx
+LdrEnumResources
+MiRemoveMappedPtes
+MiVerifyImageHeader
+HvpBuildMap
+CmpSetValueKeyExisting
+MmInitializeProcessAddressSpace
+CmpRemoveSubKey
+MiCreatePagingFileMap
+HvpDoWriteHive
+IopBuildResourceDir
+FsRtlMdlReadDev
+CmpNameFromAttributes
+MiCopyOnWrite
+NtQuerySystemEnvironmentValue
+CmpCopyKeyPartial
+MiDoMappedCopy
+MmMapVideoDisplay
+MiMapLockedPagesInUserSpace
+NtCreateSymbolicLinkObject
+MiRemoveNode
+SepAdtMarshallAuditRecord
+MiQueryAddressState
+NtStartProfile
+FsRtlFastUnlockSingleShared
+MiAddWorkingSetPage
+ExpGetLookasideInformation
+CmpDoCreate
+SepAdjustPrivileges
+NtSetDefaultLocale
+HvpWriteLog
+MiDoPoolCopy
+ExpRaiseHardError
+KiSwitchToThread
+CmDeleteValueKey
+NtFlushBuffersFile
+SepCreateServerAcl
+SeCaptureSecurityQos
+NtPrivilegedServiceAuditAlarm
+NtReplyPort
+IopQueryXxxInformation
+FsRtlOplockBreakToNone
+KdpTrap
+NtSignalAndWaitForSingleObject
+NtImpersonateClientOfPort
+RtlFreeHeap
+NtOpenThreadToken
+NtQuerySection
+ExAcquireSharedWaitForExclusive
+RtlCutoverTimeToSystemTime
+CmpInitializeHive
+PiFindDevInstMatch
+CmpAddToLeaf
+NtDuplicateToken
+RtlCustomCPToUnicodeN
+NtCreatePort
+NtCreateProfile
+CmpCreateLinkNode
+NtProtectVirtualMemory
+MmResetDriverPaging
+KeDelayExecutionThread
+RtlpFindAndCommitPages
+ExpQueryModuleInformation
+MiResolveDemandZeroFault
+MmCreatePeb
+CmpSaveKeyByFileCopy
+MmSetBankedSection
+HalpGetRegistryPartitionInformation
+SeAuditProcessCreation
+IopGetDriverNameFromKeyNode
+NtPrivilegeObjectAuditAlarm
+MmCreateKernelStack
+HvpFindNextDirtyBlock
+PsLockProcess
+NtCreateThread
+NtAllocateUuids
+RtlReserveChunkLZNT1
+IopOpenRegistryKeyPersist
+FsRtlProcessFileLock
+MiInsertVad
+HvpRecoverData
+CmpSelectLeaf
+IopTranslateResourceList
+NtSetSystemTime
+IoBuildDeviceIoControlRequest
+MmOutSwapProcess
+KdInitSystem
+CompareUnicodeStrings
+NtCreateSection
+MiAttemptPageFileReduction
+IopRaiseHardError
+CmSetValueKey
+FsRtlIsHpfsDbcsLegal
+RtlDispatchException
+NtCreateKey
+IopQueryName
+ExpWaitForResourceDdk
+KeStartProfile
+MiReorderTree
+LpcRequestPort
+KiNormalizeQuadword
+NtQuerySymbolicLinkObject
+NtRemoveIoCompletion
+qsort
+ExRaiseHardError
+MiCheckControlAreaStatus
+HvLoadHive
+SepRmCommandServerThreadInit
+IopCheckAndLogConflict
+KiFindReadyThread
+KeFreezeExecution
+MiChargeCommitment
+SeAuditHandleDuplication
+RtlUnicodeStringToInteger
+MmMapViewOfSection
+KiGetRegisterValue64
+SepAdtObjectReferenceAuditAlarm
+MiCalculatePageCommitment
+HvpGetHiveHeader
+RtlpExtendHeap
+NtDisplayString
+KiSetRegisterValue64
+SeAccessCheck
+MiRemoveUnusedSegments
+KiNormalizeLongword
+ExSnapShotHandleTables
+ExReleaseResourceForThreadLite
+RtlTimeFieldsToTime
+ObCheckObjectAccess
+PiDetectResourceConflict
+MiResolvePageFileFault
+MiDecrementCloneBlockReference
+CmpMarkIndexDirty
+RawQueryFsSizeInfo
+FsRtlRegisterUncProvider
+FsRtlUninitializeFileLock
+FsRtlPrivateCheckWaitingLocks
+RtlDecompressBufferLZNT1
+MiSetPagingOfDriver
+CmpDoOpen
+RtlUnicodeToCustomCPN
+FsRtlAcquireFileForModWrite
+KiGeneralException
+CmpGetSymbolicLink
+MiRemoveMappedView
+CmpCheckValueList
+MiCreatePebOrTeb
+RtlDecompressChunks
+RtlInitializeContext
+SeCaptureAcl
+IoConnectInterrupt
+MiEliminateWorkingSetEntry
+NtSetContextThread
+IoVerifyVolume
+KeInitializeThread
+CmpSplitLeaf
+CmpFindSubKeyInRoot
+MiSwapWslEntries
+NtGetContextThread
+MiAttemptPageFileExtension
+SepAdtCloseObjectAuditAlarm
+SepAdtDeleteObjectAuditAlarm
+SePrivilegePolicyCheck
+IopAppendStringToValueKey
+CmpCreateKeyControlBlock
+SepRmCallLsa
+RtlUnicodeToMultiByteN
+MiInsertInSystemSpace
+FsRtlPrivateInsertSharedLock
+ObpCheckObjectReference
+DbgkCreateThread
+CompareNamesCaseSensitive
+MiGetPageProtection
+ExQuerySystemLockInformation
+RtlQueryAtomInAtomTable
+NtLoadDriver
+HvpCoalesceDiscardedBins
+NtQueryValueKey
+IopServiceInstanceToDeviceInstance
+IoAllocateErrorLogEntry
+KiSystemServiceDispatch
+MiInsertWsle
+RtlRemoveUnicodePrefix
+NtCancelIoFile
+SeCaptureSid
+ObpCheckTraverseAccess
+KdpReadPhysicalMemory
+CmpGetHiveName
+NtPrivilegeCheck
+SeCreateClientSecurity
+RtlZeroHeap
+IopIsDuplicatedDevices
+ExpTimeRefreshWork
+KiScanReadyQueues
+KiEmulateBranch
+RtlValidSecurityDescriptor
+MiCheckVirtualAddress
+CmpMarkKeyDirty
+IopApplyFunctionToSubKeys
+CcZeroEndOfLastPage
+FsRtlSplitLocks
+RawDispatch
+KeContextToKframes
+MmLockPagableSectionByHandle
+MmDeleteKernelStack
+HvFreeCell
+NtTerminateProcess
+KeSetAffinityThread
+MiInsertPageFileInList
+PsChargePoolQuota
+FsRtlNotifyCompleteIrp
+IoShutdownSystem
+MmInPageKernelStack
+HvCheckBin
+RtlInsertUnicodePrefix
+KeSetSystemTime
+KdpSendPacket
+SepExamineSacl
+RtlCharToInteger
+MiModifiedPageWriter
+MiEmptyWorkingSet
+RtlAddAtomToAtomTable
+LZNT1FindMatchStandard
+PspGetSetContextSpecialApc
+xHalGetPartialGeometry
+KiInvalidOperationDouble
+SepProbeAndCaptureQosData
+MiEmptyAllWorkingSets
+MiUnmapLockedPagesInUserSpace
+KiAttachProcess
+CmReplaceKey
+SepDeReferenceLogonSession
+RawCreate
+RtlExpandEnvironmentStrings_U
+IopSlotResourceOwner
+FsRtlNotifyUpdateBuffer
+ExQueryPoolUsage
+RtlpCreateUnCommittedRange
+ExpAllocateHandleTable
+MmGrowKernelStack
+SepAuditFailed
+HvWriteHive
+CmpNotifyChangeKey
+SeAuditProcessExit
+RtlpInsertFreeBlock
+NtFlushVirtualMemory
+MmUnloadSystemImage
+FsRtlRequestOplockII
+KeStopProfile
+MiCheckForUserStackOverflow
+SepValidOwnerSubjectContext
+ObpLookupDirectoryEntry
+NtSetTimerResolution
+ExDupHandleTable
+IoMakeAssociatedIrp
+MmMapIoSpace
+IsValidOemCharacter
+RtlConvertSidToUnicodeString
+KeBalanceSetManager
+MmDeleteProcessAddressSpace
+NtQueryTimer
+FsRtlOpBatchBreakClosePending
+ObCheckCreateObjectAccess
+NtImpersonateThread
+CmSaveKey
+CmpAddToHiveFileList
+PspQueryWorkingSetWatch
+MiMappedPageWriter
+HvMarkDirty
+SeCaptureLuidAndAttributesArray
+PiGenerateLegacyDeviceInstance
+LpcpExtendPortZone
+NtCancelTimer
+IoBuildAsynchronousFsdRequest
+CmpInterlockedFunction
+KeGetBugMessageText
+KiContinueClientWait
+MmLockPagableDataSection
+RtlMakeSelfRelativeSD
+IoCreateStreamFileObject
+MiHandleForkTransitionPte
+MiMapImageHeaderInHyperSpace
+HalpGetRegistryCdromInformation
+GetNextWchar
+KiSetPriorityThread
+MiCheckPurgeAndUpMapCount
+RtlSetTimeZoneInformation
+HvpDelistFreeCell
+NtFlushInstructionCache
+MmGetFileNameForSection
+IopRemoveStringFromValueKey
+MiGetSubsectionAndProtoFromPte
+atol
+HvIsCellAllocated
+KeContextFromKframes
+MiFlushDirtyBitsToPfn
+MiDeleteValidAddress
+HvCheckHive
+ObpLogSecurityDescriptor
+MiFindEmptyAddressRangeDownTree
+RtlGetElementGenericTable
+__C_specific_handler
+__ll_div
+RtlpInitializeHeapSegment
+RtlpQuerySecurityDescriptor
+KeDisconnectInterrupt
+KiFreezeTargetExecution
+MiTrimWorkingSet
+__ll_rem
+NtSetValueKey
+ObReferenceObjectByName
+RtlpGetRegistryHandle
+RtlUpperChar
+LpcpDestroyPortQueue
+IopPickupCollisionInTList
+MmAllocateNonCachedMemory
+MiMapPageInHyperSpace
+MmUnmapViewOfSection
+IopAssignResourcesPhase4
+NtReplaceKey
+RtlAddAce
+RtlFindUnicodePrefix
+KdpWriteIoSpace
+IopSynchronousServiceTail
+HvFreeHivePartial
+FsRtlGetTunnelParameterValue
+ExpInsertPoolTracker
+KeThawExecution
+MiDereferenceSegmentThread
+RtlFindLongestRunSet
+KdpWritePhysicalMemory
+CmpCompareInIndex
+SepDeleteLogonSessionTrack
+PfxInsertPrefix
+NtReadVirtualMemory
+MiDeleteAddressesInWorkingSet
+SepCreateLogonSessionTrack
+IoPageFileCreated
+KiInvalidUserAddress
+KiInvalidOperationSingle
+CmpCopyValue
+IopGetFileName
+RtlPrefixUnicodeString
+KiRaiseException
+RtlpRestoreContext
+PsReturnPoolQuota
+CmpFindMatchingDescriptorCell
+RtlIntegerToChar
+NtTerminateThread
+CmLoadKey
+MiFindEmptyAddressRangeInTree
+IopDisassociateThreadIrp
+xHalExamineMBR
+NtQueryMutant
+FsRtlGetFileSize
+SepVariableInitialization
+MmInitSystem
+IopInitializeDumpDrivers
+Phase1Initialization
+IopCreateArcNames
+ExpInitializeExecutive
+RtlCreateUserProcess
+ObInitSystem
+ObCreateObjectType
+PspInitPhase0
+KiSystemBegin
+IoInitSystem
+CmpAddDriverToList
+SeMakeSystemToken
+KiInitializeKernel
+CmInitSystem1
+CmpInitializeRegistryNode
+IopInitializeDeviceInstanceKey
+CcInitializeCacheManager
+CmGetSystemControlValues
+CmpCreateControlSet
+MiBuildPagedPool
+MiSectionInitialization
+IopInitializeBuiltinDriver
+RtlQueryEnvironmentVariable_U
+CmGetSystemDriverList
+CmpFindControlSet
+MiInitializeSystemCache
+MiInitializeSystemPtes
+IopCreateObjectTypes
+ObpGetDosDevicesProtection
+IopReassignSystemRoot
+ExpWorkerInitialization
+CmpCloneControlSet
+CreateSystemRootLink
+IopStoreSystemPartitionInformation
+KeStartAllProcessors
+MiFindInitializationCode
+IopInitializePlugPlayServices
+KiInitSystem
+InitializePool
+IopInitializeBootDrivers
+CmpSetupConfigurationTree
+RtlpCreateStack
+PsLocateSystemDll
+IopInitializeResourceMap
+IopApplySystemPartitionProt
+CmpFindDrivers
+ExInitializeTimeRefresh
+SeRmInitPhase1
+MmFreeLoaderBlock
+SepInitSystemDacls
+ExBurnMemory
+FsRtlInitSystem
+CmpInitializeSystemHive
+FsRtlGetCompatibilityModeValue
+CmpSortDriverList
+RawInitialize
+CmpInitializeRegistryNames
+PiInitializeSystemEnumSubKeys
+IopMarkBootPartition
+ObpCreateDosDevicesDirectory
+KeFindConfigurationNextEntry
+CmpCreateRegistryRoot
+ExpInitSystemPhase0
+CmpFindTagIndex
+IopLookupGroupName
+MiInitializeNonPagedPool
+CmpInitializeHardwareConfiguration
+MmInitializeMemoryLimits
+CmpDoSort
+LpcInitSystem
+MiMergeMemoryLimit
+CmpCreateObjectTypes
+LpcpInitializePortZone
+CmpCreateRootNode
+IopInitializeSystemDrivers
+RtlCreateUserThread
+ExpWin32Initialization
+SepInitializationPhase1
+CmpIsLastKnownGoodBoot
+ExpInitSystemPhase1
+SepInitializePrivilegeSets
+FsRtlInitializeWorkerThread
+IoReportHalResourceUsage
+LookupEntryPoint
+CmpIsLoadType
+IopInitServiceEnumList
+RtlDeNormalizeProcessParams
+SepTokenInitialization
+ExpProfileInitialization
+IopCheckDependencies
+IopProtectSystemPartition
+KiComputeReciprocal
+CmpOrderGroup
+CmpWalkPath
+IopCreateRootDirectories
+MiInitializeSystemSpaceMap
+ExpMutantInitialization
+SepRmDbInitialization
+ExpTimerInitialization
+ExpInitializePoolDescriptor
+PiInitPhase1
+ExpEventInitialization
+ExpEventPairInitialization
+ExpSemaphoreInitialization
+CmpComputeGlobalQuotaAllowed
+CmpResolveDriverDependencies
+RtlpOpenImageFile
+PspLookupKernelUserEntryPoints
+SepInitializationPhase0
+IopInitializeDeviceKey
+IopCreateEntry
+MiAdjustWorkingSetManagerParameters
+PspInitializeSystemDll
+IopRevertModuleList
+IopInitializeAttributesAndCreateObject
+PiInitializeSystemEnum
+CcInitializeVacbs
+IopFreeGroupTree
+CmpFreeDriverList
+ExInitializeHandleTablePackage
+PsInitSystem
+ExInitSystem
+ExComputeTickCountMultiplier
+PpInitSystem
+SeInitSystem
+RtlpFreeStack
+ExpResourceInitialization
+ExpUuidInitialization
+ExLuidInitialization
+SepInitializeWorkList
+ObpFreeDosDevicesProtection
+PspInitPhase1
+PspLookupSystemDllEntryPoint
+ExInitSystemPhase2
+KeFindConfigurationEntry
+PiInitPhase0
+SepRmInitPhase0
+KeInitSystem
+MiEnablePagingTheExecutive
diff --git a/private/ntos/init/mp/ntkrnlmp.alp b/private/ntos/init/mp/ntkrnlmp.alp
new file mode 100644
index 000000000..b432d0376
--- /dev/null
+++ b/private/ntos/init/mp/ntkrnlmp.alp
@@ -0,0 +1,434 @@
+14248  KiIdleLoop
+ 3851  KeAcquireSpinLockRaiseToSynch
+ 2413  KiSwapThreadExit
+ 2319  KiUnlockDispatcherDatabase
+ 1947  OtsMove
+ 1258  RtlCopyBytes
+ 1153  KeReleaseSpinLock
+  810  IopParseDevice
+  730  ExAcquireResourceExclusiveLite
+  717  KeAcquireSpinLockAtDpcLevel
+  683  KeSynchronizeExecution
+  612  ExAllocatePoolWithTag
+  610  ExReleaseResourceLite
+  554  KiRetireDpcList
+  553  ExpInterlockedPopEntrySList
+  541  ExAcquireFastMutex
+  533  ExInterlockedAddUlong
+  520  ExpInterlockedPushEntrySList
+  488  OtsZero
+  395  ExFreePoolWithTag
+  356  ExReleaseFastMutex
+  342  KiDispatchInterrupt
+  332  KiInterruptException
+  304  RtlFindClearBits
+  259  KiReleaseSpinLock
+  250  ExAcquireResourceSharedLite
+  247  IofCompleteRequest
+  244  CcMapData
+  242  RtlUpcaseUnicodeToOemN
+  235  RtlCompareMemory
+  235  RtlSplay
+  229  CcGetVirtualAddress
+  227  ExpInterlockedPopEntrySListFault
+  225  ObReferenceObjectByHandle
+  215  ExpFindCurrentThread
+  215  ObfDereferenceObject
+  212  KeFlushIoBuffers
+  208  IoGetRelatedDeviceObject
+  206  PsImpersonateClient
+  182  CcFindBcb
+  168  FsRtlDissectName
+  159  FsRtlIsNameInExpressionPrivate
+  143  KeWaitForSingleObject
+  139  IofCallDriver
+  138  ObOpenObjectByName
+  134  ObpCaptureObjectCreateInformation
+  134  ObpLookupObjectName
+  132  ExAcquireFastMutexUnsafe
+  130  KeRemoveQueue
+  128  IoAllocateIrp
+  127  PsReferenceImpersonationToken
+  126  ObpAllocateObject
+  122  CcPinFileData
+  118  IoFreeIrp
+  117  IoCreateFile
+  116  IopAllocateIrp
+  110  ExpInterlockedCompareExchange64
+  110  OtsFieldInsert
+  107  RtlCompareUnicodeString
+  106  ObCreateObject
+  106  OtsStringCompareEql
+  106  SeCreateAccessState
+  102  CcCanIWrite
+   93  CcFreeVirtualAddress
+   91  KeLeaveCriticalRegion
+   86  CcUnpinFileData
+   85  CcFastCopyRead
+   83  PsReferencePrimaryToken
+   77  MmProbeAndLockPages
+   76  CcFlushCache
+   75  ExAcquireHandleTableShared
+   75  FsRtlIsFatDbcsLegal
+   74  KeInsertQueue
+   74  KiInterruptDistribution
+   73  ObpCaptureObjectName
+   73  RtlpGetStackLimits
+   69  MmCheckCachedPageState
+   68  CcMapAndRead
+   68  NtSetInformationFile
+   66  FsRtlCheckOplock
+   66  IopCloseFile
+   65  ExReleaseFastMutexUnsafe
+   65  RtlEqualUnicodeString
+   62  RtlUpcaseUnicodeChar
+   60  CcWriteBehind
+   60  ExTryToAcquireFastMutex
+   59  IopParseFile
+   58  MmUnlockPages
+   58  RtlUnicodeToOemN
+   57  IoSetTopLevelIrp
+   57  ObpCreateHandle
+   56  FsRtlLookupLargeMcbEntry
+   52  CcMapAndCopy
+   52  OtsStringCompareEqlSameLen
+   52  RtlCopyUnicodeString
+   50  KeEnterCriticalRegion
+   49  CcUnpinData
+   49  IopCheckDeviceAndDriver
+   48  CcFastCopyWrite
+   48  SeCaptureSubjectContext
+   47  CcPinMappedData
+   46  ExInterlockedInsertTailList
+   46  MiFlushSectionInternal
+   46  RtlIsNameLegalDOS8Dot3
+   45  CcLazyWriteScan
+   45  ExCreateHandle
+   45  KiInsertQueue
+   45  RtlTimeToTimeFields
+   44  ObpIncrementHandleCount
+   43  CcInitializeCacheMap
+   43  FsRtlAddToTunnelCache
+   43  IoAllocateMdl
+   43  IopDeleteFile
+   43  ObpFreeObject
+   41  ExpInterlockedExchangeAddLargeInteger
+   41  IopCheckBackupRestorePrivilege
+   41  ObpRemoveObjectRoutine
+   40  ExIsResourceAcquiredExclusiveLite
+   40  FsRtlFindLargeIndex
+   40  FsRtlGetNextLargeMcbEntry
+   40  KeQuerySystemTime
+   40  KiSaveVolatileIntegerState
+   39  CcUninitializeCacheMap
+   39  ExpWaitForResource
+   39  FsRtlFindInTunnelCache
+   39  IoIsOperationSynchronous
+   39  KeFlushSingleTb
+   39  SeDeleteAccessState
+   38  CcAcquireByteRangeForWrite
+   38  CcSetDirtyPinnedData
+   38  ExReleaseHandleTableShared
+   38  FsRtlOplockFsctrl
+   38  memcmp
+   38  ObpChargeQuotaForObject
+   37  CcSetDirtyInMask
+   37  MiDecrementReferenceCount
+   37  ObpAllocateObjectNameBuffer
+   36  CcPinRead
+   36  CcPrepareMdlWrite
+   36  IopCompleteRequest
+   36  ObpDecrementHandleCount
+   34  ExAcquireHandleTableExclusive
+   33  FsRtlRequestExclusiveOplock
+   33  IoBuildPartialMdl
+   33  MiLocateAndReserveWsle
+   33  MmIsAddressValid
+   33  PsChargeSharedPoolQuota
+   33  RtlSetBits
+   32  KiRestoreVolatileIntegerState
+   32  PsAssignImpersonationToken
+   32  RtlNtStatusToDosErrorNoTeb
+   32  RtlOemToUnicodeN
+   32  SeAssignSecurity
+   31  ExAcquireSharedStarveExclusive
+   31  ExpAcquireResourceExclusiveLite
+   31  KiMb
+   31  MmUnmapViewInSystemCache
+   30  CcMdlRead
+   29  CcMdlWriteComplete2
+   29  ExDestroyHandle
+   29  FsRtlDoesNameContainWildCards
+   29  MiInsertPageInList
+   29  MmMapViewInSystemCache
+   29  ObpFreeObjectNameBuffer
+   29  RtlUpcaseUnicodeString
+   28  IoFastQueryNetworkAttributes
+   28  RtlMapGenericMask
+   28  SeTokenImpersonationLevel
+   27  ExReleaseHandleTableExclusive
+   27  IoFreeMdl
+   26  ExFreePool
+   26  IoGetTopLevelIrp
+   26  ObpDeleteNameCheck
+   26  ObpIncrementHandleDataBase
+   25  KeSetEvent
+   24  OtsFill
+   23  CcAllocateInitializeBcb
+   23  NtClose
+   22  ExInterlockedAddLargeStatistic
+   22  RtlUpcaseUnicodeStringToOemString
+   21  IopDereferenceVpbAndFree
+   21  MiUpdateWsle
+   20  CcSetFileSizes
+   20  CcWorkerThread
+   20  FsRtlFastCheckLockForRead
+   20  MiLocateWsle
+   20  MiModifiedPageWriterWorker
+   20  MmMapLockedPages
+   19  FsRtlAreNamesEqual
+   19  FsRtlOplockIsFastIoPossible
+   19  MiDecrementShareCount2
+   19  MmCreateSection
+   19  MmFlushSection
+   18  FsRtlOplockBreakToII
+   18  IoAcquireCancelSpinLock
+   18  MiCheckControlArea
+   18  RtlExtendedMagicDivide
+   18  RtlOemStringToUnicodeString
+   17  CcGetDirtyPages
+   17  ElapsedDaysToYears
+   17  ExMapHandleToPointer
+   17  IoCheckFunctionAccess
+   17  IoRemoveShareAccess
+   17  MiUnlinkPageFromList
+   17  ObpValidateAccessMask
+   16  MiReserveSystemPtes
+   16  RtlpDidUnicodeToOemWork
+   16  SeAuditingFileEvents
+   15  FsRtlOplockCleanup
+   15  MmAccessFault
+   15  MmPurgeSection
+   15  SeReleaseSubjectContext
+   14  ExSystemTimeToLocalTime
+   14  IoSetShareAccess
+   14  IoSynchronousPageWrite
+   14  KeSetEventBoostPriority
+   14  MiRemoveZeroPage
+   14  ObpIncrementUnnamedHandleCount
+   13  CcCopyWrite
+   13  FsRtlCurrentBatchOplock
+   13  FsRtlRemoveAndCompleteWaitIrp
+   13  MiCheckProtoPtePageState
+   13  MiReleaseSystemPtes
+   13  MmSetAddressRangeModified
+   13  RtlSecondsSince1980ToTime
+   13  SeLockSubjectContext
+   12  CcMdlReadComplete2
+   12  FsRtlFastCheckLockForWrite
+   12  FsRtlPruneTunnelCache
+   12  KeFlushMultipleTb
+   12  MiFreePoolPages
+   12  MmCopyToCachedPage
+   12  ObpCreateUnnamedHandle
+   12  RtlUpcaseUnicodeStringToCountedOemString
+   11  CcReleaseByteRangeFromWrite
+   11  FsRtlMdlWriteCompleteDev
+   11  FsRtlWaitOnIrp
+   11  IopErrorLogRequeueEntry
+   11  MiDispatchFault
+   11  MiInitializePfn
+   11  MiRestoreTransitionPte
+   11  SeSetAccessStateGenericMapping
+   10  CcGetVacbMiss
+   10  ExDeleteResourceLite
+   10  ExpWorkerThread
+   10  FsRtlAddLargeMcbEntry
+   10  FsRtlFindFirstOverlappingExclusiveNode
+   10  IoCheckShareAccess
+   10  KeInitializeEvent
+   10  KeInsertDeviceQueue
+   10  MiRemoveAnyPage
+   10  MmUnmapLockedPages
+   10  RtlUnicodeStringToOemString
+    9  ExInitializeResourceLite
+    9  IopOpenLinkOrRenameTarget
+    9  IoStartNextPacket
+    9  KeInitializeApc
+    9  KiMemoryManagementDispatch
+    9  MiCreateDataFileMap
+    9  MiGatherMappedPages
+    9  SeValidSecurityDescriptor
+    9  SwapSplayLinks
+    8  CcCopyRead
+    8  ExAcquireSharedWaitForExclusive
+    8  FsRtlInitializeLargeMcb
+    8  FsRtlTruncateLargeMcb
+    8  IoCreateStreamFileObject
+    8  IoGetCurrentProcess
+    8  KeInitializeSpinLock
+    8  MiRemovePageByColor
+    8  MiResolveProtoPteFault
+    8  RtlDelete
+    8  RtlFillMemoryUlong
+    7  CcSetValidData
+    7  CcUnmapVacbArray
+    7  FsRtlAcknowledgeOplockBreak
+    7  IoAllocateAdapterChannel
+    7  IoStartPacket
+    7  KeRemoveDeviceQueue
+    7  KiSaveVolatileFloatState
+    7  MiMakeProtectionMask
+    7  MiReleaseWsle
+    7  MiRemovePageFromList
+    7  PsReturnSharedPoolQuota
+    7  RtlFindClearBitsAndSet
+    7  RtlpLengthInheritedAce
+    7  RtlTimeToSecondsSince1970
+    7  SepGetDefaultsSubjectContext
+    6  ExQueueWorkItem
+    6  ExReinitializeResourceLite
+    6  FsRtlCheckLockForReadAccess
+    6  FsRtlFastUnlockAll
+    6  FsRtlIsNameInExpression
+    6  IoReleaseCancelSpinLock
+    6  KeInsertByKeyDeviceQueue
+    6  KiDeliverApc
+    6  MiCheckControlAreaStatus
+    6  MiMakeSystemAddressValidPfn
+    6  MiRemoveWsle
+    6  MiResolveMappedFileFault
+    6  OtsRemainder32Unsigned
+    6  RtlClearBits
+    6  RtlNumberGenericTableElements
+    6  RtlpGenerateInheritedAce
+    6  SepAccessCheck
+    5  CcDeallocateBcb
+    5  CcFreeActiveVacb
+    5  CcIsThereDirtyData
+    5  CcPostWorkQueue
+    5  FsRtlPrivateFastUnlockAll
+    5  FsRtlPrivateInsertLock
+    5  KeRemoveByKeyDeviceQueue
+    5  KiApcInterrupt
+    5  MiAllocatePoolPages
+    5  MiGetInPageSupportBlock
+    5  MiInitializeReadInProgressPfn
+    5  SepInheritAcl
+    4  CcDeleteSharedCacheMap
+    4  CcGetVirtualAddressIfMapped
+    4  CcPerformReadAhead
+    4  CcPreparePinWrite
+    4  CcSetReadAheadGranularity
+    4  ExAllocatePoolWithQuotaTag
+    4  FsRtlAllocateOplock
+    4  FsRtlFastUnlockSingleExclusive
+    4  FsRtlLookupLastLargeMcbEntry
+    4  FsRtlPrivateLock
+    4  FsRtlUninitializeOplock
+    4  IoCheckDesiredAccess
+    4  KeGetCurrentIrql
+    4  KeInsertHeadQueue
+    4  KeInsertQueueApc
+    4  MiAddValidPageToWorkingSet
+    4  MiEnsureAvailablePageOrWait
+    4  RtlAreBitsClear
+    4  RtlInsertElementGenericTable
+    4  RtlLengthSecurityDescriptor
+    4  SepSidInToken
+    4  SeUnlockSubjectContext
+    4  wcsicmp
+    3  FsRtlAllocateFirstMapping
+    3  FsRtlFastUnlockSingle
+    3  FsRtlOplockBreakNotify
+    3  FsRtlPrivateResetLowestLockOffset
+    3  FsRtlRemoveMcbEntryPrivate
+    3  IoPageRead
+    3  IopSynchronousServiceTail
+    3  IoQueueThreadIrp
+    3  MiCheckForControlAreaDeletion
+    3  MiGetEventCounter
+    3  MiResolveTransitionFault
+    3  MiSectionDelete
+    3  MiSegmentDelete
+    3  ObInsertObject
+    3  OtsDivide32Unsigned
+    3  RtlCreateAcl
+    3  RtlInitializeSid
+    3  RtlVirtualUnwind
+    3  SepCheckAcl
+    2  CcScheduleReadAhead
+    2  ExDisableResourceBoostLite
+    2  ExExtendZone
+    2  ExLocalTimeToSystemTime
+    2  ExReleaseResourceForThreadLite
+    2  FsRtlMdlReadCompleteDev
+    2  FsRtlPrivateInsertExclusiveLock
+    2  FsRtlPrivateLimitFreeLockList
+    2  FsRtlReleaseFileForCcFlush
+    2  IoGetFileObjectGenericMapping
+    2  IoUpdateShareAccess
+    2  KeClearEvent
+    2  KeSetTimerEx
+    2  KeTryToAcquireSpinLock
+    2  KiSystemServiceExit
+    2  MiAccessCheck
+    2  MiFreeEventCounter
+    2  MiInitializeTransitionPfn
+    2  MmCanFileBeTruncatedInternal
+    2  MmUnlockCachedPage
+    2  NtDeleteFile
+    2  RtlConvertUlongToLargeInteger
+    2  RtlDeleteElementGenericTable
+    2  RtlEqualPrefixSid
+    2  RtlLookupFunctionEntry
+    2  RtlUnicodeStringToCountedOemString
+    1  _C_ExecuteExceptionFilter
+    1  CcCreateVacbArray
+    1  CcPurgeAndClearCacheSection
+    1  CcPurgeCacheSection
+    1  CcSetLogHandleForFile
+    1  CcUnmapAndPurge
+    1  CcUnpinDataForThread
+    1  ExpRaiseStatus
+    1  FsRtlAcquireFileForCcFlush
+    1  FsRtlFreeFirstMapping
+    1  FsRtlPrivateCheckForExclusiveLockAccess
+    1  FsRtlReleaseFile
+    1  FsRtlUninitializeFileLock
+    1  IopTimerDispatch
+    1  KeWaitForMultipleObjects
+    1  KiAlternateExit
+    1  KiIpiSendPacket
+    1  KiMemoryManagementException
+    1  KiRestoreVolatileFloatState
+    1  KiSystemServiceDispatch
+    1  KiSystemServiceException
+    1  KiTimerExpiration
+    1  MiCompleteProtoPteFault
+    1  MiFindActualFaultingPte
+    1  MiFreeInPageSupportBlock
+    1  MiInsertFrontModifiedNoWrite
+    1  MiInsertWsle
+    1  MiResolveDemandZeroFault
+    1  MiSetDirtyBit
+    1  MiTrimWorkingSet
+    1  MiWaitForInPageComplete
+    1  MmBuildMdlForNonPagedPool
+    1  MmFlushImageSection
+    1  MmZeroPageThread
+    1  NtQueryVolumeInformationFile
+    1  ObDeleteCapturedInsertInfo
+    1  RtlAreBitsSet
+    1  RtlDeleteNoSplay
+    1  RtlExtendedIntegerMultiply
+    1  RtlFillBytes
+    1  RtlFirstFreeAce
+    1  RtlInitializeBitMap
+    1  RtlPcToFileHeader
+    1  RtlpLengthInheritAcl
+    1  RtlSecondsSince1970ToTime
+    1  RtlSubtreePredecessor
+    1  SeAccessCheck
+    1  SeDeassignSecurity
+
\ No newline at end of file
diff --git a/private/ntos/init/mp/ntkrnlmp.mip b/private/ntos/init/mp/ntkrnlmp.mip
new file mode 100644
index 000000000..73d866543
--- /dev/null
+++ b/private/ntos/init/mp/ntkrnlmp.mip
@@ -0,0 +1,550 @@
+6137  RtlMoveMemory
+4950  KeAcquireSpinLockRaiseToSynch
+1617  RtlFillMemory
+1262  KiReadyThread
+1189  KiSwapThread
+1085  KiUnwaitThread
+ 983  KeWaitForSingleObject
+ 959  ExAllocatePoolWithTag
+ 908  KeRemoveQueue
+ 875  SwapFromIdle
+ 818  KiAcquireSpinLock
+ 777  KiSwitchStacks
+ 760  ExAcquireResourceExclusiveLite
+ 644  ExAcquireFastMutex
+ 621  KeReleaseSpinLock
+ 605  ExReleaseResourceLite
+ 579  KiInsertQueue
+ 561  ExInterlockedAddUlong
+ 552  MiReserveSystemPtes
+ 552  SwapContext
+ 551  ExFreePoolWithTag
+ 463  ExpInterlockedPopEntrySListFault
+ 459  CcMapData
+ 447  IopParseDevice
+ 393  CcGetVirtualAddress
+ 392  PsImpersonateClient
+ 331  KeInsertQueueDpc
+ 314  RtlCompareMemory
+ 313  KiActivateWaiterQueue
+ 307  ExpInterlockedPopEntrySList
+ 307  RtlSplay
+ 287  KeSetEventBoostPriority
+ 268  KiDispatchInterrupt
+ 265  ExAcquireResourceSharedLite
+ 254  CcFindBcb
+ 254  ObfDereferenceObject
+ 249  ObOpenObjectByName
+ 246  PsReferenceImpersonationToken
+ 237  RtlFindClearBits
+ 233  ExReleaseFastMutex
+ 228  ObReferenceObjectByHandle
+ 228  RtlUpcaseUnicodeToOemN
+ 227  ExpInterlockedPushEntrySList
+ 223  IofCompleteRequest
+ 217  MiFlushSectionInternal
+ 206  KiUnlockDispatcherDatabase
+ 194  KiAcquireSpinLockRaiseIrql
+ 188  ObpLookupObjectName
+ 185  IoGetRelatedDeviceObject
+ 182  KiSaveVolatileFloatState
+ 177  KeFlushIoBuffers
+ 177  KeSwapIrql
+ 176  CcPinFileData
+ 168  mbstrlen
+ 166  FsRtlIsNameInExpressionPrivate
+ 162  IopAllocateIrp
+ 161  CcMapAndRead
+ 161  MiRemovePageByColor
+ 161  MmProbeAndLockPages
+ 159  SeCreateAccessState
+ 156  ExpFindCurrentThread
+ 155  IoAllocateIrp
+ 154  FsRtlDissectName
+ 149  KeRaiseIrql
+ 143  CcCanIWrite
+ 141  KiSwapThreadExit
+ 140  CcFreeVirtualAddress
+ 139  IoFreeIrp
+ 138  ObpCaptureObjectCreateInformation
+ 137  RtlEqualMemory
+ 136  CcUnpinFileData
+ 135  MmCheckCachedPageState
+ 134  MiInsertPageInList
+ 117  ExAcquireFastMutexUnsafe
+ 115  KeSynchronizeExecution
+ 113  ExAcquireHandleTableShared
+ 110  KiRetireDpcList
+ 108  RtlTimeToTimeFields
+ 103  CcSetDirtyPinnedData
+ 103  IoAllocateMdl
+ 103  IoSetHardErrorOrVerifyDevice
+ 103  MiLocateAndReserveWsle
+ 103  RtlCompareUnicodeString
+  99  CcSetDirtyInMask
+  93  ObpAllocateObject
+  93  PsReferencePrimaryToken
+  92  ObpCaptureObjectName
+  90  CcFastCopyRead
+  90  IopParseFile
+  90  KiIpiStallOnPacketTargets
+  89  CcMdlRead
+  89  KiInterruptDispatchSame
+  89  MiReleaseSystemPtes
+  86  CcFlushCache
+  86  IofCallDriver
+  86  KeLeaveCriticalRegion
+  86  KiInterruptException
+  86  KiIpiProcessRequests
+  84  IoCreateFile
+  81  CcAcquireByteRangeForWrite
+  81  MiCleanSection
+  78  FsRtlLookupLargeMcbEntry
+  77  CcPrepareMdlWrite
+  76  IoFastQueryNetworkAttributes
+  76  IopCheckDeviceAndDriver
+  73  FsRtlFindLargeIndex
+  73  IopCloseFile
+  73  SepAdtInitializePrivilegeAuditing
+  72  CcMdlWriteComplete2
+  72  ExpInterlockedExchangeAddLargeInteger
+  72  MmUnlockPages
+  72  MmUnmapViewInSystemCache
+  70  ElapsedDaysToYears
+  70  IopCompleteRequest
+  69  NtSetInformationFile
+  67  ExReleaseFastMutexUnsafe
+  66  CcInitializeCacheMap
+  66  ExTryToAcquireFastMutex
+  65  FsRtlCheckOplock
+  65  RtlExtendedMagicDivide
+  64  ExReleaseHandleTableShared
+  63  MiDecrementReferenceCount
+  62  KeLowerIrql
+  61  IopDeleteFile
+  60  KeInsertQueue
+  60  MmCreateSection
+  59  KeSetEvent
+  59  MmMapLockedPages
+  59  SeCaptureSubjectContext
+  58  FsRtlIsFatDbcsLegal
+  58  ObpFreeObjectNameBuffer
+  57  CcFastCopyWrite
+  57  ExIsResourceAcquiredExclusiveLite
+  57  MiFreePoolPages
+  56  CcUninitializeCacheMap
+  56  CcUnpinData
+  56  ObpAllocateObjectNameBuffer
+  56  RtlEqualUnicodeString
+  55  CcWriteBehind
+  55  ExCreateHandle
+  54  KdPollBreakIn
+  53  ObpIncrementHandleCount
+  52  ExpInterlockedCompareExchange64
+  52  RtlIsNameLegalDOS8Dot3
+  51  CcLazyWriteScan
+  50  CcMapAndCopy
+  50  CcPinMappedData
+  50  KiSuspendThread
+  48  KeDeregisterBugCheckCallback
+  48  RtlZeroMemory
+  47  ExDestroyHandle
+  47  ExpWaitForResource
+  47  IoBuildPartialMdl
+  47  MiDecrementShareCount2
+  47  RtlQueryAtomsInAtomTable
+  46  RtlFillMemoryUlong
+  46  RtlUnicodeToOemN
+  45  ExAcquireHandleTableExclusive
+  45  MiUnlinkPageFromList
+  45  NtClose
+  45  PsAssignImpersonationToken
+  44  ExpAcquireResourceExclusiveLite
+  44  KiInsertTimerTable
+  44  KiIpiSendPacket
+  44  ObpDecrementHandleCount
+  44  RtlNtStatusToDosErrorNoTeb
+  43  FsRtlOplockFsctrl
+  43  MmMapViewInSystemCache
+  42  ExAcquireSharedStarveExclusive
+  42  MiRemoveAnyPage
+  41  KiModifyException
+  41  ObpRemoveObjectRoutine
+  40  MmSetAddressRangeModified
+  40  RtlOemToUnicodeN
+  39  KiDeliverApc
+  39  MmPurgeSection
+  38  CcPinRead
+  38  ExInterlockedInsertTailList
+  38  MiAllocatePoolPages
+  38  MiProcessValidPteList
+  37  FsRtlAddToTunnelCache
+  37  FsRtlFindInTunnelCache
+  37  MiRemoveZeroPage
+  37  ObCreateObject
+  37  SeAssignSecurity
+  36  ExInitializeResourceLite
+  36  ExMapHandleToPointer
+  36  IoFreeMdl
+  36  KeInitializeSpinLock
+  36  KiRaiseIrqlToXxxLevel
+  35  FsRtlOplockCleanup
+  35  KeUpdateSystemTime
+  35  ObpFreeObject
+  34  IopCheckBackupRestorePrivilege
+  34  MmAccessFault
+  33  CcAllocateInitializeBcb
+  33  MiUpdateWsle
+  33  RtlLookupElementGenericTable
+  33  RtlMapGenericMask
+  32  KeEnterCriticalRegion
+  31  IoCallDriver
+  31  MiCheckProtoPtePageState
+  30  CcWorkerThread
+  30  MiInitializePfn
+  30  MiSetDirtyBit
+  29  ExDisableResourceBoostLite
+  29  MiLocateWsle
+  29  RtlUpcaseUnicodeChar
+  29  SeSetAccessStateGenericMapping
+  28  ObpChargeQuotaForObject
+  28  RtlUpcaseUnicodeString
+  27  KiWaitTest
+  27  RtlInsertElementGenericTable
+  27  RtlUnicodeStringToOemString
+  26  KeUpdateRunTime
+  26  MiMakeSystemAddressValidPfn
+  26  ObpCreateHandle
+  25  KiFlushFixedTb
+  25  KiInsertQueueApc
+  25  KiInterruptExit
+  25  RtlCopyUnicodeString
+  24  ExReleaseHandleTableExclusive
+  24  IopDereferenceVpbAndFree
+  24  KiInsertTreeTimer
+  24  MiCheckControlArea
+  24  MmFlushSection
+  24  RtlTimeToSecondsSince1970
+  24  SeDeleteAccessState
+  23  CcSetFileSizes
+  23  FsRtlGetNextLargeMcbEntry
+  23  FsRtlRequestExclusiveOplock
+  23  IoSetTopLevelIrp
+  23  KiIpiSend
+  23  MiDispatchFault
+  23  MmIsAddressValid
+  23  PsChargeSharedPoolQuota
+  23  RtlUpcaseUnicodeStringToOemString
+  22  FsRtlOplockBreakToII
+  22  IoCheckFunctionAccess
+  22  KiQuantumEnd
+  22  MmZeroPageThread
+  22  RtlClearBits
+  22  RtlUpcaseUnicodeStringToCountedOemString
+  21  CcDeleteSharedCacheMap
+  21  MiFreeInPageSupportBlock
+  21  wcslen
+  20  FsRtlOplockIsFastIoPossible
+  20  FsRtlWaitOnIrp
+  20  MiCreateDataFileMap
+  20  MiRemoveWsle
+  20  RtlpGetStackLimits
+  19  FsRtlRemoveAndCompleteWaitIrp
+  19  IoIsOperationSynchronous
+  19  KeProfileInterruptWithSource
+  18  FsRtlAddLargeMcbEntry
+  18  FsRtlFastCheckLockForRead
+  18  FsRtlPrivateLimitFreeLockList
+  18  KiComputeTimerTableIndex
+  18  MmCopyToCachedPage
+  18  ObpDeleteNameCheck
+  18  RtlSetBits
+  17  CcCopyRead
+  17  FsRtlDoesNameContainWildCards
+  17  FsRtlPruneTunnelCache
+  17  MiResolveMappedFileFault
+  16  ExFreePool
+  16  FsRtlAcknowledgeOplockBreak
+  16  IoStartPacket
+  16  KiChainedDispatch
+  16  MmUnmapLockedPages
+  16  RtlFindFirstRunClear
+  16  RtlpGetExtraStuffPointer
+  15  CcFreeActiveVacb
+  15  ExReinitializeResourceLite
+  15  FsRtlCheckLockForReadAccess
+  15  FsRtlPrivateLock
+  15  KiInSwapProcesses
+  15  MiResolveProtoPteFault
+  14  CcGetVacbMiss
+  14  IoAcquireCancelSpinLock
+  14  KeInsertQueueApc
+  14  MiResolveTransitionFault
+  14  RtlFreeHeapSlowly
+  14  RtlOemStringToUnicodeString
+  13  FsRtlFastCheckLockForWrite
+  13  FsRtlFastUnlockSingleExclusive
+  13  IoRemoveShareAccess
+  13  ObpCreateUnnamedHandle
+  13  RtlpGenerateInheritedAce
+  13  SepTokenIsOwner
+  12  CcGetDirtyPages
+  12  CcGetVirtualAddressIfMapped
+  12  CcPerformReadAhead
+  12  ExDeleteResourceLite
+  12  FsRtlTruncateLargeMcb
+  12  IoGetTopLevelIrp
+  12  KeTryToAcquireSpinLock
+  12  KiRestoreVolatileFloatState
+  12  PspSetEventPair
+  12  RtlpDidUnicodeToOemWork
+  12  RtlUnicodeStringToCountedOemString
+  12  SeAuditingFileEvents
+  12  SeReleaseSubjectContext
+  11  ExInterlockedPopEntryList
+  11  ExpWorkerThread
+  11  IO_DESC_MIN
+  11  IoSynchronousPageWrite
+  11  KiApcInterrupt
+  11  MiEnsureAvailablePageOrWait
+  11  MiGetEventCounter
+  11  ObpIncrementHandleDataBase
+  11  SwapSplayLinks
+  10  ExAllocatePoolWithQuotaTag
+  10  FsRtlAcquireFileForCcFlush
+  10  FsRtlCurrentBatchOplock
+  10  IoQueueThreadIrp
+  10  ObpIncrementUnnamedHandleCount
+  10  ObpValidateAccessMask
+  10  RtlDelete
+  10  RtlDeleteElementGenericTable
+  10  SepGetDefaultsSubjectContext
+   9  CcUnmapVacbArray
+   9  CmSetRegistryQuotaInformation
+   9  FsRtlInitializeLargeMcb
+   9  FsRtlIsNameInExpression
+   9  FsRtlReleaseFileForCcFlush
+   9  FsRtlUninitializeOplock
+   9  KeInsertDeviceQueue
+   9  MiRestoreTransitionPte
+   9  MiTakePageFromWorkingSet
+   9  RtlpLengthInheritedAce
+   8  CcReleaseByteRangeFromWrite
+   8  FsRtlAreNamesEqual
+   8  IoCheckShareAccess
+   8  IoGetRequestorProcess
+   8  IoSetShareAccess
+   8  KeFillEntryTb
+   8  KiContinueInterrupt
+   8  KiTimerListExpire
+   8  MiSegmentDelete
+   8  MiWaitForInPageComplete
+   8  NtResumeThread
+   7  FsRtlAllocateOplock
+   7  FsRtlMdlWriteCompleteDev
+   7  FsRtlRemoveMcbEntryPrivate
+   7  KeFlushSingleTb
+   7  KeReadStateTimer
+   7  MiAccessCheck
+   7  MiGetInPageSupportBlock
+   7  MiInitializeReadInProgressPfn
+   7  NtQueryVolumeInformationFile
+   7  PsReturnSharedPoolQuota
+   7  RtlIsGenericTableEmpty
+   7  SeLockSubjectContext
+   7  SepAccessCheck
+   7  SeValidSecurityDescriptor
+   6  CcCopyWrite
+   6  CcScheduleReadAhead
+   6  ExSystemTimeToLocalTime
+   6  FsRtlLookupLastLargeMcbEntry
+   6  FsRtlPrivateCheckForExclusiveLockAccess
+   6  FsRtlPrivateFastUnlockAll
+   6  FsRtlProcessFileLock
+   6  FsRtlRemoveNodeFromTunnel
+   6  IoAllocateAdapterChannel
+   6  IoStartNextPacket
+   6  KeConnectInterrupt
+   6  KeFlushEntireTb
+   6  KiFlushSingleTb
+   6  KxUnlockDispatcherDatabase
+   6  MiAddValidPageToWorkingSet
+   6  MiCompleteProtoPteFault
+   6  ObInsertObject
+   6  RtlAreBitsClear
+   6  RtlAreBitsSet
+   6  RtlFreeUnicodeString
+   6  ZwMakeTemporaryObject
+   5  CcDeallocateBcb
+   5  CcPreparePinWrite
+   5  CmQueryKey
+   5  ExIsResourceAcquiredSharedLite
+   5  ExpAllocateHandleTableEntries
+   5  IopOpenLinkOrRenameTarget
+   5  KeInitializeEventPair
+   5  KeInsertByKeyDeviceQueue
+   5  KeRemoveDeviceQueue
+   5  KeTerminateThread
+   5  KeWaitForMultipleObjects
+   5  KiBreakpointException
+   5  LpcExitThread
+   5  MiDoneWithThisPageGetAnother
+   5  MiInitializeTransitionPfn
+   5  MiReleaseWsle
+   5  MiRemovePageFromList
+   5  MiRemoveUnusedSegments
+   5  MiResolveDemandZeroFault
+   5  NtDeleteFile
+   5  NtOpenKey
+   5  ObDeleteCapturedInsertInfo
+   5  ObOpenObjectByPointer
+   5  RtlDeleteNoSplay
+   5  RtlFindClearBitsAndSet
+   5  SepCheckAcl
+   5  SepInheritAcl
+   5  wcsicmp
+   5  wcsncpy
+   4  CcUnpinDataForThread
+   4  ExAcquireSharedWaitForExclusive
+   4  ExQueueWorkItem
+   4  FsRtlFastUnlockSingle
+   4  FsRtlPrivateInsertLock
+   4  IoCheckDesiredAccess
+   4  IoPageRead
+   4  IoUpdateShareAccess
+   4  KeFlushMultipleTb
+   4  KeInitializeEvent
+   4  KeQuerySystemTime
+   4  KeRemoveByKeyDeviceQueue
+   4  KiInterruptTemplate
+   4  KiIpiSignalPacketDone
+   4  MiDeleteSystemPagableVm
+   4  MmDeterminePoolType
+   4  PspGetSetContextSpecialApc
+   4  RtlCreateAcl
+   4  RtlLengthSecurityDescriptor
+   4  SeAccessCheck
+   4  SepRmSendCommandToLsaWrkr
+   3  CcPostWorkQueue
+   3  CcPurgeAndClearCacheSection
+   3  ExGetPreviousMode
+   3  ExInterlockedAddLargeInteger
+   3  FsRtlAddLargeEntry
+   3  FsRtlAllocateFirstMapping
+   3  FsRtlFindFirstOverlappingExclusiveNode
+   3  FsRtlMdlReadCompleteDev
+   3  FsRtlNotifyCleanup
+   3  FsRtlNotifyFullReportChange
+   3  FsRtlOplockBreakNotify
+   3  FsRtlOplockBreakToNone
+   3  FsRtlPrivateInitializeFileLock
+   3  FsRtlUninitializeFileLock
+   3  IoGetCurrentProcess
+   3  KeFlushCurrentTb
+   3  KeSetTimerEx
+   3  KiDecrementQuantum
+   3  KiTimerExpiration
+   3  MiFindActualFaultingPte
+   3  MiFlushPteList
+   3  MiFreeEventCounter
+   3  MiMakeProtectionMask
+   3  MiReleasePageFileSpace
+   3  NtSetSystemPowerState
+   3  RtlpLengthInheritAcl
+   3  RtlSubtreePredecessor
+   3  ZwCreateSection
+   2  _ull_divrem_6416
+   2  CcCreateVacbArray
+   2  CcGetLsnForFileObject
+   2  CcMdlReadComplete2
+   2  CcPurgeCacheSection
+   2  CcSetValidData
+   2  CmpCreatePerfKeys
+   2  CmpRefreshHive
+   2  CmpWorkerCommand
+   2  ExInterlockedAddLargeStatistic
+   2  ExReleaseResourceForThreadLite
+   2  FsRtlDeregisterUncProvider
+   2  FsRtlpRegisterProviderWithMUP
+   2  FsRtlPrivateInsertExclusiveLock
+   2  FsRtlRequestOplockII
+   2  FsRtlStackOverflowRead
+   2  IoCancelIrp
+   2  IoCreateStreamFileObject
+   2  IoGetFileObjectGenericMapping
+   2  IoReleaseCancelSpinLock
+   2  KeFillLargeEntryTb
+   2  KeInitializeApc
+   2  KeResetEvent
+   2  KeSetSystemTime
+   2  KiExceptionExit
+   2  KiFlushMultipleTb
+   2  KiFlushSingleTbTarget
+   2  KiInitializeUserApc
+   2  KiSystemServiceRepeat
+   2  LpcpFindDataInfoMessage
+   2  MiFindEmptyAddressRange
+   2  MiReserveSystemPtes2
+   2  MiSectionDelete
+   2  MmCanFileBeTruncatedInternal
+   2  MmFlushImageSection
+   2  MmInPageKernelStack
+   2  RtlSecondsSince1970ToTime
+   2  RtlUpperString
+   2  SepSidInToken
+   1  BuildQueryDirectoryIrp
+   1  CcUnmapAndPurge
+   1  CcUnmapVacb
+   1  CmpFreeKeyByCell
+   1  ExAcquireResourceExclusive
+   1  ExIsProcessorFeaturePresent
+   1  ExTryToAcquireResourceExclusiveLite
+   1  FsRtlAcquireFileExclusive
+   1  FsRtlInitializeOplock
+   1  FsRtlNotifyCompleteIrpList
+   1  FsRtlNotifyCompletion
+   1  FsRtlNumberOfRunsInLargeMcb
+   1  FsRtlPrivateResetLowestLockOffset
+   1  FsRtlRemoveLargeMcbEntry
+   1  IopErrorLogRequeueEntry
+   1  IopSynchronousServiceTail
+   1  IopTimerDispatch
+   1  IoUnregisterShutdownNotification
+   1  KdpWriteIoSpace
+   1  KeInitializeMutant
+   1  KeInsertHeadQueue
+   1  KeIpiInterrupt
+   1  KeReleaseSemaphore
+   1  KeSetPriorityThread
+   1  KiChangeColorPageTarget
+   1  KiDisplayString
+   1  KiFindReadyThread
+   1  KiFlushMultipleTbTarget
+   1  KiFlushTb
+   1  KiScanReadyQueues
+   1  MiChargeCommitmentCantExpand
+   1  MiCheckControlAreaStatus
+   1  MiDoesPdeExistAndMakeValid
+   1  MiGatherPagefilePages
+   1  MiMapPageInHyperSpace
+   1  MiModifiedPageWriterWorker
+   1  MiRemoveFromSystemSpace
+   1  MiRemoveMappedView
+   1  MmIsNonPagedSystemAddressValid
+   1  MmUnlockCachedPage
+   1  MmWorkingSetManager
+   1  NtRequestWaitReplyPort
+   1  NtStartProfile
+   1  ObpInsertDirectoryEntry
+   1  RtlAreAllAccessesGranted
+   1  RtlCreateSecurityDescriptor
+   1  RtlDecompressChunks
+   1  RtlEqualPrefixSid
+   1  RtlExtendedIntegerMultiply
+   1  RtlInitializeSid
+   1  RtlPrefixUnicodeString
+   1  RtlSetTimeZoneInformation
+   1  SepCreateServerAcl
+   1  SeUnlockSubjectContext
+   1  strrchr
+   1  xHalExamineMBR
diff --git a/private/ntos/init/mp/ntkrnlmp.ppc b/private/ntos/init/mp/ntkrnlmp.ppc
new file mode 100644
index 000000000..728d094bb
--- /dev/null
+++ b/private/ntos/init/mp/ntkrnlmp.ppc
@@ -0,0 +1,571 @@
+8272  KiIdleLoop
+2954  MmZeroPageThread
+2419  KiSwapThread
+2165  ExReleaseResourceLite
+1295  ExAcquireResourceExclusiveLite
+1177  ExInterlockedPopEntrySList
+1168  ExAllocatePoolWithTag
+ 904  IopParseDevice
+ 870  KeWaitForSingleObject
+ 832  ExFreePoolWithTag
+ 768  IofCompleteRequest
+ 660  KiDispatchInterrupt
+ 622  CcMapData
+ 601  Exfi386InterlockedDecrementLong
+ 592  ExInterlockedPushEntrySList
+ 543  KefAcquireSpinLockAtDpcLevel
+ 537  InterlockedDecrement
+ 500  IoAllocateIrp
+ 500  memmove
+ 488  ExfInterlockedAddUlong
+ 442  CcGetVirtualAddress
+ 421  CcFastCopyRead
+ 413  RtlFindClearBits
+ 377  ExfInterlockedPushEntryList
+ 362  ExAcquireResourceSharedLite
+ 362  RtlSplay
+ 360  CcPinFileData
+ 360  KeRemoveQueue
+ 354  MmCopyToCachedPage
+ 348  ObpCaptureObjectCreateInformation
+ 347  CcFindBcb
+ 342  IopAllocateIrp
+ 340  RtlCompareMemory
+ 335  CcFastCopyWrite
+ 335  KeSynchronizeExecution
+ 319  FsRtlDissectName
+ 319  ObReferenceObjectByHandle
+ 297  FsRtlIsNameInExpressionPrivate
+ 277  MiZeroPhysicalPage
+ 264  InterlockedIncrement
+ 255  PsImpersonateClient
+ 246  RtlCompareUnicodeString
+ 246  RtlUpcaseUnicodeToOemN
+ 244  IoGetRelatedDeviceObject
+ 243  ObOpenObjectByName
+ 240  MiFlushSectionInternal
+ 217  ExpFindCurrentThread
+ 214  IoFreeIrp
+ 197  RtlTimeToTimeFields
+ 196  CcSetDirtyPinnedData
+ 188  FsRtlLookupLargeMcbEntry
+ 188  ObfDereferenceObject
+ 187  CcCanIWrite
+ 187  CcFreeVirtualAddress
+ 187  IopDeleteFile
+ 185  SeCreateAccessState
+ 182  KefReleaseSpinLockFromDpcLevel
+ 176  CcMapAndCopy
+ 174  ExInterlockedCompareExchange64
+ 174  RtlCopyUnicodeString
+ 173  ExAcquireHandleTableShared
+ 171  KeInsertQueueDpc
+ 168  MmProbeAndLockPages
+ 168  ObpLookupObjectName
+ 166  CcMapAndRead
+ 163  IopCompleteRequest
+ 153  MiRemovePageByColor
+ 150  KeFlushSingleTb
+ 145  IoCreateFile
+ 143  CcUnpinFileData
+ 143  ObpCaptureObjectName
+ 132  KeInsertQueue
+ 130  MmCheckCachedPageState
+ 128  CcInitializeCacheMap
+ 122  ExInterlockedAddLargeStatistic
+ 118  RtlEqualUnicodeString
+ 116  ObpAllocateObject
+ 115  FsRtlIsFatDbcsLegal
+ 109  CcFlushCache
+ 109  ExAcquireFastMutexUnsafe
+ 109  RtlFillMemoryUlong
+ 106  IopCheckDeviceAndDriver
+ 106  MmSetAddressRangeModified
+ 104  CcPinMappedData
+ 104  KeLeaveCriticalRegion
+ 102  CcUninitializeCacheMap
+  99  MiCleanSection
+  99  MmUnmapViewInSystemCache
+  98  CcPrepareMdlWrite
+  98  PsReferenceImpersonationToken
+  97  MiInsertPageInList
+  96  CcWriteBehind
+  95  ExAllocatePool
+  95  FsRtlFindLargeIndex
+  95  IoFastQueryNetworkAttributes
+  94  CcSetDirtyInMask
+  93  KeSetEventBoostPriority
+  92  IofCallDriver
+  92  RtlpCaptureContext
+  91  ObpAllocateObjectNameBuffer
+  89  CcLazyWriteScan
+  89  MiLocateAndReserveWsle
+  87  RtlIsNameLegalDOS8Dot3
+  86  ExCreateHandle
+  86  ExFreePool
+  85  ElapsedDaysToYears
+  84  ObpIncrementHandleCount
+  82  FsRtlAddToTunnelCache
+  82  IoFreeController
+  81  CcAcquireByteRangeForWrite
+  81  FsRtlCheckOplock
+  80  CcPreparePinWrite
+  79  IoAllocateMdl
+  77  KiSetCR0Bits
+  76  ObReferenceObjectByPointer
+  75  CcMdlRead
+  75  ExQueueWorkItem
+  74  IopCloseFile
+  73  FsRtlFindInTunnelCache
+  73  ObCreateObject
+  73  PsReferencePrimaryToken
+  72  CcAllocateInitializeBcb
+  71  ExTryToAcquireResourceExclusiveLite
+  70  ExReleaseHandleTableShared
+  69  RtlExtendedMagicDivide
+  68  CcPinRead
+  66  Exfi386InterlockedExchangeUlong
+  65  CcCopyRead
+  65  NtSetInformationFile
+  65  ObpFreeObjectNameBuffer
+  64  ExInterlockedExchangeAddLargeInteger
+  64  NtClose
+  63  KeEnterCriticalRegion
+  63  MiDecrementShareCount2
+  62  ExReleaseHandleTableExclusive
+  62  ObpCreateHandle
+  61  KiDeliverApc
+  59  IopCompletePageWrite
+  59  RtlUpcaseUnicodeChar
+  58  KeQuerySystemTime
+  56  CcGetFileObjectFromBcb
+  56  RtlNtStatusToDosErrorNoTeb
+  55  ExIsResourceAcquiredExclusiveLite
+  55  IopParseFile
+  55  MiWaitForInPageComplete
+  54  _NLG_Return2
+  54  CcGetVirtualAddressIfMapped
+  54  MiCheckProtoPtePageState
+  54  MmCreateSection
+  53  MiLocateWsle
+  53  MmUnlockPages
+  52  KiInterruptDispatch
+  52  RtlUnicodeToOemN
+  51  IoGetRequestorProcess
+  51  MiReserveSystemPtes
+  50  IoBuildSynchronousFsdRequest
+  50  MiReleaseSystemPtes
+  50  ObpDecrementHandleCount
+  50  ObpFreeObject
+  49  CcSetFileSizes
+  49  FsRtlDoesNameContainWildCards
+  48  FsRtlOplockFsctrl
+  48  IoSetThreadHardErrorMode
+  48  MiDecrementReferenceCount
+  46  CcUnpinData
+  46  ExAcquireSharedStarveExclusive
+  45  CcWorkerThread
+  45  IoFreeMdl
+  44  ExAllocateFromPagedLookasideList
+  44  MiAllocatePoolPages
+  44  MmMapViewInSystemCache
+  44  RtlMapGenericMask
+  43  ExInitializeResourceLite
+  43  FsRtlOplockCleanup
+  43  MiFreePoolPages
+  42  ExAcquireHandleTableExclusive
+  42  PsAssignImpersonationToken
+  41  MmAccessFault
+  41  SeDeleteAccessState
+  40  IoCheckFunctionAccess
+  40  MmPurgeSection
+  40  RtlInsertElementGenericTable
+  39  ExpAcquireResourceExclusiveLite
+  38  ExGetSharedWaiterCount
+  38  IopCheckBackupRestorePrivilege
+  38  MiUpdateWsle
+  38  MmMapLockedPages
+  37  ExpWaitForResource
+  37  FsRtlOplockBreakToII
+  37  MiCreateDataFileMap
+  37  MmFlushSection
+  36  SeAssignSecurity
+  35  IoAllocateErrorLogEntry
+  35  KeReadStateQueue
+  34  IoBuildPartialMdl
+  33  _abnormal_termination
+  33  CcMdlWriteComplete2
+  33  ExDestroyHandle
+  33  FsRtlRemoveMcbEntryPrivate
+  33  KeFlushMultipleTb
+  33  KeSetEvent
+  33  KiRetireDpcList
+  33  KiTrap0E
+  33  ObpRemoveObjectRoutine
+  32  FsRtlGetNextLargeMcbEntry
+  32  IopErrorLogRequeueEntry
+  32  SeCaptureSubjectContext
+  31  IoCancelIrp
+  31  IopDereferenceVpbAndFree
+  30  FsRtlFastCheckLockForRead
+  30  FsRtlRequestExclusiveOplock
+  29  ExFreeToPagedLookasideList
+  29  IoIsOperationSynchronous
+  29  MiRemoveMappedPtes
+  29  RtlUpcaseUnicodeString
+  29  SepFilterPrivilegeAudits
+  27  DebugService
+  27  KeSetTimer
+  27  RtlCompressChunks
+  27  RtlpDidUnicodeToOemWork
+  27  RtlUpcaseUnicodeStringToOemString
+  27  SeSetAccessStateGenericMapping
+  27  SeTokenType
+  26  CcFreeActiveVacb
+  26  ExfInterlockedInsertTailList
+  26  ExMapHandleToPointer
+  26  KeGetCurrentPrcb
+  26  MiUnlinkPageFromList
+  26  RtlOemStringToUnicodeString
+  25  ExReleaseFastMutexUnsafe
+  25  FsRtlTruncateLargeMcb
+  25  KeWaitForMultipleObjects
+  25  RtlUnicodeStringToOemString
+  24  CcDeleteSharedCacheMap
+  24  CcGetVacbMiss
+  24  IopReportResourceUsage
+  24  KiAcquireSpinLock
+  24  RtlAreAnyAccessesGranted
+  24  SeUnlockSubjectContext
+  23  CcGetDirtyPages
+  23  IoSetShareAccess
+  23  MiRemoveAnyPage
+  22  ExSystemTimeToLocalTime
+  22  FsRtlAreNamesEqual
+  22  ObGetObjectPointerCount
+  22  ObpIncrementUnnamedHandleCount
+  22  ObWaitForSingleObject
+  22  RtlOemToUnicodeN
+  22  RtlUpcaseUnicodeStringToCountedOemString
+  21  CcUnpinRepinnedBcb
+  21  FsRtlIsNameInExpression
+  21  KiTimerListExpire
+  21  ObSetSecurityDescriptorInfo
+  20  FsRtlFastCheckLockForWrite
+  20  KeResetEvent
+  20  MiSetDirtyBit
+  20  PsChargeSharedPoolQuota
+  20  PsOpenTokenOfProcess
+  20  RtlTimeToSecondsSince1970
+  19  ExDeleteResourceLite
+  19  FsRtlRemoveLargeMcbEntry
+  19  IoSynchronousPageWrite
+  19  MiDispatchFault
+  19  MmIsAddressValid
+  18  IopIsDeviceInstanceEnabled
+  18  KeInitializeDpc
+  18  PsReturnSharedPoolQuota
+  18  RtlExtendedLargeIntegerDivide
+  18  RtlpGetStackLimits
+  18  SeComputeQuotaInformationSize
+  18  SeValidSecurityDescriptor
+  17  ExpWorkerThread
+  17  FsRtlAddLargeMcbEntry
+  17  ObpDeleteNameCheck
+  16  ExDisableResourceBoostLite
+  16  FsRtlPruneTunnelCache
+  16  FsRtlRemoveAndCompleteWaitIrp
+  16  MiGetInPageSupportBlock
+  16  MiRemoveZeroPage
+  16  PspDeleteThreadSecurity
+  16  RtlpGenerateInheritedAce
+  16  VdmpDelayIntApcRoutine
+  15  CcPerformReadAhead
+  15  CcPostWorkQueue
+  15  ExReinitializeResourceLite
+  15  FsRtlUninitializeOplock
+  15  IoSetTopLevelIrp
+  15  MiCheckControlArea
+  15  MmUnmapLockedPages
+  15  SepGetDefaultsSubjectContext
+  14  ExNotifyCallback
+  14  FsRtlOplockIsFastIoPossible
+  14  FsRtlPrivateFastUnlockAll
+  14  FsRtlWaitOnIrp
+  14  IoGetTopLevelIrp
+  14  IoInitializeIrp
+  14  IoPageRead
+  14  IoStartPacket
+  14  MiGetEventCounter
+  14  MiInitializePfn
+  14  ObpChargeQuotaForObject
+  14  RtlDelete
+  14  SeAuditingFileEvents
+  14  SeFastTraverseCheck
+  13  FsRtlAcknowledgeOplockBreak
+  13  FsRtlPrivateLimitFreeLockList
+  13  IoCheckShareAccess
+  13  IoCreateStreamFileObject
+  13  MiReleaseWsle
+  13  MiRemoveWsle
+  13  MiResolveMappedFileFault
+  13  ObDereferenceObject
+  13  SeTokenImpersonationLevel
+  12  CcReleaseByteRangeFromWrite
+  12  FsRtlAcquireFileForCcFlush
+  12  FsRtlCurrentBatchOplock
+  12  FsRtlInitializeLargeMcb
+  12  FsRtlPrivateLock
+  12  IoBuildDeviceIoControlRequest
+  12  KeInsertByKeyDeviceQueue
+  12  MiEnsureAvailablePageOrWait
+  12  MiInsertFrontModifiedNoWrite
+  12  PsWatchWorkingSet
+  12  RawCheckForDismount
+  12  RtlDeleteElementGenericTable
+  12  RtlSetBits
+  12  SeReleaseSubjectContext
+  11  CcCopyWrite
+  11  FsRtlFindFirstOverlappingExclusiveNode
+  11  IoStartNextPacket
+  11  KeInitializeSpinLock
+  11  KeSetTimerEx
+  11  NtQueryVolumeInformationFile
+  11  ObpLookupDirectoryEntry
+  11  RtlxOemStringToUnicodeSize
+  10  _allmul
+  10  CcScheduleReadAhead
+  10  CcUnmapVacbArray
+  10  FsRtlUninitializeLargeMcb
+  10  IoCheckDesiredAccess
+  10  KeInitializeEventPair
+  10  MiMakeSystemAddressValidPfnWs
+  10  MiRemoveUnusedSegments
+  10  MiSegmentDelete
+  10  RtlNumberOfSetBits
+  10  RtlpLengthInheritedAce
+  10  RtlUnicodeStringToCountedOemString
+   9  _wcsicmp
+   9  ExEnumHandleTable
+   9  FsRtlLookupLastLargeMcbEntry
+   9  IoRemoveShareAccess
+   9  KeReleaseSemaphore
+   9  MiInitializeReadInProgressPfn
+   9  MiRemovePageFromList
+   9  MiResolveProtoPteFault
+   9  ObpIncrementHandleDataBase
+   9  SwapSplayLinks
+   8  CcDeallocateBcb
+   8  FsRtlPrivateResetLowestLockOffset
+   8  IopCheckVpbMounted
+   8  KeInsertDeviceQueue
+   8  KeRemoveDeviceQueue
+   8  MiAddValidPageToWorkingSet
+   8  MiCheckForControlAreaDeletion
+   8  MiCompleteProtoPteFault
+   8  MiRestoreTransitionPte
+   8  NtWaitForSingleObject
+   8  xHalGetConventionalCylinders
+   7  CcSetValidData
+   7  ExAcquireSharedWaitForExclusive
+   7  ExIsResourceAcquiredSharedLite
+   7  FsRtlAllocateOplock
+   7  FsRtlCheckNoExclusiveConflict
+   7  FsRtlDeregisterUncProvider
+   7  IopQueryName
+   7  IoRegisterShutdownNotification
+   7  LpcpClosePort
+   7  MiCheckControlAreaStatus
+   7  RtlAreBitsClear
+   7  RtlCreateSecurityDescriptor
+   7  SepAccessCheck
+   7  SepInheritAcl
+   6  DaysAndFractionToTime
+   6  FsRtlFastUnlockSingle
+   6  FsRtlFastUnlockSingleExclusive
+   6  FsRtlReleaseFileForCcFlush
+   6  IoCancelThreadIo
+   6  KeInsertHeadQueue
+   6  KeRemoveByKeyDeviceQueue
+   6  KeTryToAcquireSpinLock
+   6  KiReleaseSpinLock
+   6  RtlpLengthInheritAcl
+   6  SeLockSubjectContext
+   6  SepSidInToken
+   5  CcMdlReadComplete
+   5  CcMdlReadComplete2
+   5  FsRtlCheckLockForReadAccess
+   5  FsRtlPrivateInsertLock
+   5  IoAcquireCancelSpinLock
+   5  IopOpenLinkOrRenameTarget
+   5  KeFlushQueueApc
+   5  KeInitializeApc
+   5  MiInitializeCopyOnWritePfn
+   5  MiMakeProtectionMask
+   5  MiMakeSystemAddressValidPfn
+   5  MiResolveDemandZeroFault
+   5  MiSectionDelete
+   5  MmCreateMdl
+   5  ObpCreateUnnamedHandle
+   5  ObReferenceObjectByName
+   5  RtlSubtreePredecessor
+   5  SepCheckAcl
+   4  CcGetLsnForFileObject
+   4  CcMdlWriteComplete
+   4  ExAllocatePoolWithQuotaTag
+   4  FsRtlCheckLockForWriteAccess
+   4  FsRtlNumberOfRunsInLargeMcb
+   4  FsRtlOplockBreakNotify
+   4  FsRtlPrivateCheckForExclusiveLockAccess
+   4  FsRtlPrivateRemoveLock
+   4  FsRtlReleaseFileForModWrite
+   4  IoAllocateAdapterChannel
+   4  IoGetCurrentProcess
+   4  IoQueueThreadIrp
+   4  IoRaiseInformationalHardError
+   4  IoStartNextPacketByKey
+   4  KeInitializeDeviceQueue
+   4  KeInsertQueueApc
+   4  KiQuantumEnd
+   4  KiSystemService
+   4  MiChargeCommitmentCantExpand
+   4  MiCheckPdeForPagedPool
+   4  MiDetermineUserGlobalPteMask
+   4  MiRemoveWsleFromFreeList
+   4  MiResolveTransitionFault
+   4  MiVerifyImageHeader
+   4  MmCanFileBeTruncatedInternal
+   4  NtDeleteFile
+   4  ObDeleteCapturedInsertInfo
+   4  ObInsertObject
+   4  RtlAllocateAndInitializeSid
+   4  RtlDeleteNoSplay
+   4  RtlEqualPrefixSid
+   4  RtlInitializeSid
+   4  RtlLookupElementGenericTable
+   4  RtlUpcaseUnicodeToMultiByteN
+   3  CcCreateVacbArray
+   3  FsRtlAllocateFirstMapping
+   3  FsRtlCancelExclusiveIrp
+   3  FsRtlPrivateCheckWaitingLocks
+   3  FsRtlPrivateInitializeFileLock
+   3  Ke386GetGdtEntryThread
+   3  KeInitializeEvent
+   3  KiExceptionExit
+   3  MiAccessCheck
+   3  MiBuildKernelMap
+   3  MiDeleteSystemPagableVm
+   3  MiFindActualFaultingPte
+   3  MiFreeInPageSupportBlock
+   3  MiGetSystemCacheSubsection
+   3  MiInsertWsle
+   3  MiMapPageToZeroInHyperSpace
+   3  MiReleasePageFileSpace
+   3  MiReserveSystemPtes2
+   3  MmBuildMdlForNonPagedPool
+   3  ObpValidateAccessMask
+   3  RtlClearBits
+   3  RtlConvertUlongToLargeInteger
+   3  RtlEnumerateGenericTable
+   3  RtlFirstFreeAce
+   3  RtlIsGenericTableEmpty
+   3  RtlLargeIntegerDivide
+   3  RtlLengthSecurityDescriptor
+   2  CcAllocateObcb
+   2  CcUnpinDataForThread
+   2  ExCreateHandleTable
+   2  ExecuteHandler
+   2  ExReleaseResourceForThreadLite
+   2  FsRtlCheckForMatchingFileObject
+   2  FsRtlDeleteTunnelCache
+   2  FsRtlInitializeFileLock
+   2  FsRtlMdlReadComplete
+   2  FsRtlMdlWriteCompleteDev
+   2  FsRtlPrivateCancelFileLockIrp
+   2  FsRtlPrivateInsertExclusiveLock
+   2  FsRtlSplitLargeMcb
+   2  FsRtlSyncVolumes
+   2  FsRtlUninitializeFileLock
+   2  IoGetFileObjectGenericMapping
+   2  IopSynchronousApiServiceTail
+   2  KeBoostCurrentThread
+   2  KeContextToKframes
+   2  KeReadStateSemaphore
+   2  KiContinue
+   2  MiFlushEventCounter
+   2  MiInitializeTransitionPfn
+   2  MiMapPageInHyperSpace
+   2  MiRemovePageFromWorkingSet
+   2  MmCanFileBeTruncated
+   2  MmGetFileNameForSection
+   2  RtlAreBitsSet
+   2  RtlFindClearBitsAndSet
+   2  RtlFindFirstRunSet
+   2  RtlFindSetBits
+   2  RtlInitializeBitMap
+   2  RtlSetAllBits
+   2  SeAccessCheck
+   1  CcExtendVacbArray
+   1  CcPurgeCacheSection
+   1  CcUnmapVacb
+   1  ExAllocatePoolWithQuota
+   1  ExLocalTimeToSystemTime
+   1  ExpAllocateHandleTableEntries
+   1  FsRtlAddLargeEntry
+   1  FsRtlFastUnlockAll
+   1  FsRtlFastUnlockSingleShared
+   1  FsRtlMdlReadCompleteDev
+   1  FsRtlPrivateInsertSharedLock
+   1  FsRtlRemoveAndCompleteIrp
+   1  IoAcquireVpbSpinLock
+   1  IopMountVolume
+   1  IopSynchronousServiceTail
+   1  IopTimerDispatch
+   1  IoUpdateShareAccess
+   1  KeFlushEntireTb
+   1  KeInitializeThread
+   1  KeSetKernelStackSwapEnable
+   1  KiComputeWaitInterval
+   1  KiEspToTrapFrame
+   1  KiScanReadyQueues
+   1  KiServiceExit2
+   1  KiTimerExpiration
+   1  KiUnwaitThread
+   1  main
+   1  MiAddMappedPtes
+   1  MiChargeCommitment
+   1  MiDeleteFreeVm
+   1  MiFindEmptyAddressRangeDownTree
+   1  MiFlushInPageSupportBlock
+   1  MiFlushPteList
+   1  MiLocateSubsection
+   1  MiReturnCommitment
+   1  MiUnlockPagedAddress
+   1  MiUnmapImageHeaderInHyperSpace
+   1  MiUpForkPageShareCount
+   1  MmFlushImageSection
+   1  MmGetPhysicalAddress
+   1  MmOutSwapProcess
+   1  MmUnlockCachedPage
+   1  MmWorkingSetManager
+   1  NtCancelIoFile
+   1  NtProtectVirtualMemory
+   1  NtStartProfile
+   1  ObpInsertHandleCount
+   1  PspSystemThreadStartup
+   1  RtlCreateAcl
+   1  RtlEqualSid
+   1  RtlExtendedIntegerMultiply
+   1  RtlInitUnicodeString
+   1  RtlOemStringToCountedUnicodeString
+   1  RtlSecondsSince1970ToTime
+   1  RtlSubAuthoritySid
+   1  RtlUnwind
+   1  RtlUpcaseUnicodeStringToAnsiString
+   1  RtlValidSecurityDescriptor
+   1  SeDeassignSecurity
+   1  SeFreeCapturedSecurityQos
+   1  SeFreePrivileges
+   1  SeQueryAuthenticationIdToken
+
+
\ No newline at end of file
diff --git a/private/ntos/init/mp/ntkrnlmp.x86 b/private/ntos/init/mp/ntkrnlmp.x86
new file mode 100644
index 000000000..728d094bb
--- /dev/null
+++ b/private/ntos/init/mp/ntkrnlmp.x86
@@ -0,0 +1,571 @@
+8272  KiIdleLoop
+2954  MmZeroPageThread
+2419  KiSwapThread
+2165  ExReleaseResourceLite
+1295  ExAcquireResourceExclusiveLite
+1177  ExInterlockedPopEntrySList
+1168  ExAllocatePoolWithTag
+ 904  IopParseDevice
+ 870  KeWaitForSingleObject
+ 832  ExFreePoolWithTag
+ 768  IofCompleteRequest
+ 660  KiDispatchInterrupt
+ 622  CcMapData
+ 601  Exfi386InterlockedDecrementLong
+ 592  ExInterlockedPushEntrySList
+ 543  KefAcquireSpinLockAtDpcLevel
+ 537  InterlockedDecrement
+ 500  IoAllocateIrp
+ 500  memmove
+ 488  ExfInterlockedAddUlong
+ 442  CcGetVirtualAddress
+ 421  CcFastCopyRead
+ 413  RtlFindClearBits
+ 377  ExfInterlockedPushEntryList
+ 362  ExAcquireResourceSharedLite
+ 362  RtlSplay
+ 360  CcPinFileData
+ 360  KeRemoveQueue
+ 354  MmCopyToCachedPage
+ 348  ObpCaptureObjectCreateInformation
+ 347  CcFindBcb
+ 342  IopAllocateIrp
+ 340  RtlCompareMemory
+ 335  CcFastCopyWrite
+ 335  KeSynchronizeExecution
+ 319  FsRtlDissectName
+ 319  ObReferenceObjectByHandle
+ 297  FsRtlIsNameInExpressionPrivate
+ 277  MiZeroPhysicalPage
+ 264  InterlockedIncrement
+ 255  PsImpersonateClient
+ 246  RtlCompareUnicodeString
+ 246  RtlUpcaseUnicodeToOemN
+ 244  IoGetRelatedDeviceObject
+ 243  ObOpenObjectByName
+ 240  MiFlushSectionInternal
+ 217  ExpFindCurrentThread
+ 214  IoFreeIrp
+ 197  RtlTimeToTimeFields
+ 196  CcSetDirtyPinnedData
+ 188  FsRtlLookupLargeMcbEntry
+ 188  ObfDereferenceObject
+ 187  CcCanIWrite
+ 187  CcFreeVirtualAddress
+ 187  IopDeleteFile
+ 185  SeCreateAccessState
+ 182  KefReleaseSpinLockFromDpcLevel
+ 176  CcMapAndCopy
+ 174  ExInterlockedCompareExchange64
+ 174  RtlCopyUnicodeString
+ 173  ExAcquireHandleTableShared
+ 171  KeInsertQueueDpc
+ 168  MmProbeAndLockPages
+ 168  ObpLookupObjectName
+ 166  CcMapAndRead
+ 163  IopCompleteRequest
+ 153  MiRemovePageByColor
+ 150  KeFlushSingleTb
+ 145  IoCreateFile
+ 143  CcUnpinFileData
+ 143  ObpCaptureObjectName
+ 132  KeInsertQueue
+ 130  MmCheckCachedPageState
+ 128  CcInitializeCacheMap
+ 122  ExInterlockedAddLargeStatistic
+ 118  RtlEqualUnicodeString
+ 116  ObpAllocateObject
+ 115  FsRtlIsFatDbcsLegal
+ 109  CcFlushCache
+ 109  ExAcquireFastMutexUnsafe
+ 109  RtlFillMemoryUlong
+ 106  IopCheckDeviceAndDriver
+ 106  MmSetAddressRangeModified
+ 104  CcPinMappedData
+ 104  KeLeaveCriticalRegion
+ 102  CcUninitializeCacheMap
+  99  MiCleanSection
+  99  MmUnmapViewInSystemCache
+  98  CcPrepareMdlWrite
+  98  PsReferenceImpersonationToken
+  97  MiInsertPageInList
+  96  CcWriteBehind
+  95  ExAllocatePool
+  95  FsRtlFindLargeIndex
+  95  IoFastQueryNetworkAttributes
+  94  CcSetDirtyInMask
+  93  KeSetEventBoostPriority
+  92  IofCallDriver
+  92  RtlpCaptureContext
+  91  ObpAllocateObjectNameBuffer
+  89  CcLazyWriteScan
+  89  MiLocateAndReserveWsle
+  87  RtlIsNameLegalDOS8Dot3
+  86  ExCreateHandle
+  86  ExFreePool
+  85  ElapsedDaysToYears
+  84  ObpIncrementHandleCount
+  82  FsRtlAddToTunnelCache
+  82  IoFreeController
+  81  CcAcquireByteRangeForWrite
+  81  FsRtlCheckOplock
+  80  CcPreparePinWrite
+  79  IoAllocateMdl
+  77  KiSetCR0Bits
+  76  ObReferenceObjectByPointer
+  75  CcMdlRead
+  75  ExQueueWorkItem
+  74  IopCloseFile
+  73  FsRtlFindInTunnelCache
+  73  ObCreateObject
+  73  PsReferencePrimaryToken
+  72  CcAllocateInitializeBcb
+  71  ExTryToAcquireResourceExclusiveLite
+  70  ExReleaseHandleTableShared
+  69  RtlExtendedMagicDivide
+  68  CcPinRead
+  66  Exfi386InterlockedExchangeUlong
+  65  CcCopyRead
+  65  NtSetInformationFile
+  65  ObpFreeObjectNameBuffer
+  64  ExInterlockedExchangeAddLargeInteger
+  64  NtClose
+  63  KeEnterCriticalRegion
+  63  MiDecrementShareCount2
+  62  ExReleaseHandleTableExclusive
+  62  ObpCreateHandle
+  61  KiDeliverApc
+  59  IopCompletePageWrite
+  59  RtlUpcaseUnicodeChar
+  58  KeQuerySystemTime
+  56  CcGetFileObjectFromBcb
+  56  RtlNtStatusToDosErrorNoTeb
+  55  ExIsResourceAcquiredExclusiveLite
+  55  IopParseFile
+  55  MiWaitForInPageComplete
+  54  _NLG_Return2
+  54  CcGetVirtualAddressIfMapped
+  54  MiCheckProtoPtePageState
+  54  MmCreateSection
+  53  MiLocateWsle
+  53  MmUnlockPages
+  52  KiInterruptDispatch
+  52  RtlUnicodeToOemN
+  51  IoGetRequestorProcess
+  51  MiReserveSystemPtes
+  50  IoBuildSynchronousFsdRequest
+  50  MiReleaseSystemPtes
+  50  ObpDecrementHandleCount
+  50  ObpFreeObject
+  49  CcSetFileSizes
+  49  FsRtlDoesNameContainWildCards
+  48  FsRtlOplockFsctrl
+  48  IoSetThreadHardErrorMode
+  48  MiDecrementReferenceCount
+  46  CcUnpinData
+  46  ExAcquireSharedStarveExclusive
+  45  CcWorkerThread
+  45  IoFreeMdl
+  44  ExAllocateFromPagedLookasideList
+  44  MiAllocatePoolPages
+  44  MmMapViewInSystemCache
+  44  RtlMapGenericMask
+  43  ExInitializeResourceLite
+  43  FsRtlOplockCleanup
+  43  MiFreePoolPages
+  42  ExAcquireHandleTableExclusive
+  42  PsAssignImpersonationToken
+  41  MmAccessFault
+  41  SeDeleteAccessState
+  40  IoCheckFunctionAccess
+  40  MmPurgeSection
+  40  RtlInsertElementGenericTable
+  39  ExpAcquireResourceExclusiveLite
+  38  ExGetSharedWaiterCount
+  38  IopCheckBackupRestorePrivilege
+  38  MiUpdateWsle
+  38  MmMapLockedPages
+  37  ExpWaitForResource
+  37  FsRtlOplockBreakToII
+  37  MiCreateDataFileMap
+  37  MmFlushSection
+  36  SeAssignSecurity
+  35  IoAllocateErrorLogEntry
+  35  KeReadStateQueue
+  34  IoBuildPartialMdl
+  33  _abnormal_termination
+  33  CcMdlWriteComplete2
+  33  ExDestroyHandle
+  33  FsRtlRemoveMcbEntryPrivate
+  33  KeFlushMultipleTb
+  33  KeSetEvent
+  33  KiRetireDpcList
+  33  KiTrap0E
+  33  ObpRemoveObjectRoutine
+  32  FsRtlGetNextLargeMcbEntry
+  32  IopErrorLogRequeueEntry
+  32  SeCaptureSubjectContext
+  31  IoCancelIrp
+  31  IopDereferenceVpbAndFree
+  30  FsRtlFastCheckLockForRead
+  30  FsRtlRequestExclusiveOplock
+  29  ExFreeToPagedLookasideList
+  29  IoIsOperationSynchronous
+  29  MiRemoveMappedPtes
+  29  RtlUpcaseUnicodeString
+  29  SepFilterPrivilegeAudits
+  27  DebugService
+  27  KeSetTimer
+  27  RtlCompressChunks
+  27  RtlpDidUnicodeToOemWork
+  27  RtlUpcaseUnicodeStringToOemString
+  27  SeSetAccessStateGenericMapping
+  27  SeTokenType
+  26  CcFreeActiveVacb
+  26  ExfInterlockedInsertTailList
+  26  ExMapHandleToPointer
+  26  KeGetCurrentPrcb
+  26  MiUnlinkPageFromList
+  26  RtlOemStringToUnicodeString
+  25  ExReleaseFastMutexUnsafe
+  25  FsRtlTruncateLargeMcb
+  25  KeWaitForMultipleObjects
+  25  RtlUnicodeStringToOemString
+  24  CcDeleteSharedCacheMap
+  24  CcGetVacbMiss
+  24  IopReportResourceUsage
+  24  KiAcquireSpinLock
+  24  RtlAreAnyAccessesGranted
+  24  SeUnlockSubjectContext
+  23  CcGetDirtyPages
+  23  IoSetShareAccess
+  23  MiRemoveAnyPage
+  22  ExSystemTimeToLocalTime
+  22  FsRtlAreNamesEqual
+  22  ObGetObjectPointerCount
+  22  ObpIncrementUnnamedHandleCount
+  22  ObWaitForSingleObject
+  22  RtlOemToUnicodeN
+  22  RtlUpcaseUnicodeStringToCountedOemString
+  21  CcUnpinRepinnedBcb
+  21  FsRtlIsNameInExpression
+  21  KiTimerListExpire
+  21  ObSetSecurityDescriptorInfo
+  20  FsRtlFastCheckLockForWrite
+  20  KeResetEvent
+  20  MiSetDirtyBit
+  20  PsChargeSharedPoolQuota
+  20  PsOpenTokenOfProcess
+  20  RtlTimeToSecondsSince1970
+  19  ExDeleteResourceLite
+  19  FsRtlRemoveLargeMcbEntry
+  19  IoSynchronousPageWrite
+  19  MiDispatchFault
+  19  MmIsAddressValid
+  18  IopIsDeviceInstanceEnabled
+  18  KeInitializeDpc
+  18  PsReturnSharedPoolQuota
+  18  RtlExtendedLargeIntegerDivide
+  18  RtlpGetStackLimits
+  18  SeComputeQuotaInformationSize
+  18  SeValidSecurityDescriptor
+  17  ExpWorkerThread
+  17  FsRtlAddLargeMcbEntry
+  17  ObpDeleteNameCheck
+  16  ExDisableResourceBoostLite
+  16  FsRtlPruneTunnelCache
+  16  FsRtlRemoveAndCompleteWaitIrp
+  16  MiGetInPageSupportBlock
+  16  MiRemoveZeroPage
+  16  PspDeleteThreadSecurity
+  16  RtlpGenerateInheritedAce
+  16  VdmpDelayIntApcRoutine
+  15  CcPerformReadAhead
+  15  CcPostWorkQueue
+  15  ExReinitializeResourceLite
+  15  FsRtlUninitializeOplock
+  15  IoSetTopLevelIrp
+  15  MiCheckControlArea
+  15  MmUnmapLockedPages
+  15  SepGetDefaultsSubjectContext
+  14  ExNotifyCallback
+  14  FsRtlOplockIsFastIoPossible
+  14  FsRtlPrivateFastUnlockAll
+  14  FsRtlWaitOnIrp
+  14  IoGetTopLevelIrp
+  14  IoInitializeIrp
+  14  IoPageRead
+  14  IoStartPacket
+  14  MiGetEventCounter
+  14  MiInitializePfn
+  14  ObpChargeQuotaForObject
+  14  RtlDelete
+  14  SeAuditingFileEvents
+  14  SeFastTraverseCheck
+  13  FsRtlAcknowledgeOplockBreak
+  13  FsRtlPrivateLimitFreeLockList
+  13  IoCheckShareAccess
+  13  IoCreateStreamFileObject
+  13  MiReleaseWsle
+  13  MiRemoveWsle
+  13  MiResolveMappedFileFault
+  13  ObDereferenceObject
+  13  SeTokenImpersonationLevel
+  12  CcReleaseByteRangeFromWrite
+  12  FsRtlAcquireFileForCcFlush
+  12  FsRtlCurrentBatchOplock
+  12  FsRtlInitializeLargeMcb
+  12  FsRtlPrivateLock
+  12  IoBuildDeviceIoControlRequest
+  12  KeInsertByKeyDeviceQueue
+  12  MiEnsureAvailablePageOrWait
+  12  MiInsertFrontModifiedNoWrite
+  12  PsWatchWorkingSet
+  12  RawCheckForDismount
+  12  RtlDeleteElementGenericTable
+  12  RtlSetBits
+  12  SeReleaseSubjectContext
+  11  CcCopyWrite
+  11  FsRtlFindFirstOverlappingExclusiveNode
+  11  IoStartNextPacket
+  11  KeInitializeSpinLock
+  11  KeSetTimerEx
+  11  NtQueryVolumeInformationFile
+  11  ObpLookupDirectoryEntry
+  11  RtlxOemStringToUnicodeSize
+  10  _allmul
+  10  CcScheduleReadAhead
+  10  CcUnmapVacbArray
+  10  FsRtlUninitializeLargeMcb
+  10  IoCheckDesiredAccess
+  10  KeInitializeEventPair
+  10  MiMakeSystemAddressValidPfnWs
+  10  MiRemoveUnusedSegments
+  10  MiSegmentDelete
+  10  RtlNumberOfSetBits
+  10  RtlpLengthInheritedAce
+  10  RtlUnicodeStringToCountedOemString
+   9  _wcsicmp
+   9  ExEnumHandleTable
+   9  FsRtlLookupLastLargeMcbEntry
+   9  IoRemoveShareAccess
+   9  KeReleaseSemaphore
+   9  MiInitializeReadInProgressPfn
+   9  MiRemovePageFromList
+   9  MiResolveProtoPteFault
+   9  ObpIncrementHandleDataBase
+   9  SwapSplayLinks
+   8  CcDeallocateBcb
+   8  FsRtlPrivateResetLowestLockOffset
+   8  IopCheckVpbMounted
+   8  KeInsertDeviceQueue
+   8  KeRemoveDeviceQueue
+   8  MiAddValidPageToWorkingSet
+   8  MiCheckForControlAreaDeletion
+   8  MiCompleteProtoPteFault
+   8  MiRestoreTransitionPte
+   8  NtWaitForSingleObject
+   8  xHalGetConventionalCylinders
+   7  CcSetValidData
+   7  ExAcquireSharedWaitForExclusive
+   7  ExIsResourceAcquiredSharedLite
+   7  FsRtlAllocateOplock
+   7  FsRtlCheckNoExclusiveConflict
+   7  FsRtlDeregisterUncProvider
+   7  IopQueryName
+   7  IoRegisterShutdownNotification
+   7  LpcpClosePort
+   7  MiCheckControlAreaStatus
+   7  RtlAreBitsClear
+   7  RtlCreateSecurityDescriptor
+   7  SepAccessCheck
+   7  SepInheritAcl
+   6  DaysAndFractionToTime
+   6  FsRtlFastUnlockSingle
+   6  FsRtlFastUnlockSingleExclusive
+   6  FsRtlReleaseFileForCcFlush
+   6  IoCancelThreadIo
+   6  KeInsertHeadQueue
+   6  KeRemoveByKeyDeviceQueue
+   6  KeTryToAcquireSpinLock
+   6  KiReleaseSpinLock
+   6  RtlpLengthInheritAcl
+   6  SeLockSubjectContext
+   6  SepSidInToken
+   5  CcMdlReadComplete
+   5  CcMdlReadComplete2
+   5  FsRtlCheckLockForReadAccess
+   5  FsRtlPrivateInsertLock
+   5  IoAcquireCancelSpinLock
+   5  IopOpenLinkOrRenameTarget
+   5  KeFlushQueueApc
+   5  KeInitializeApc
+   5  MiInitializeCopyOnWritePfn
+   5  MiMakeProtectionMask
+   5  MiMakeSystemAddressValidPfn
+   5  MiResolveDemandZeroFault
+   5  MiSectionDelete
+   5  MmCreateMdl
+   5  ObpCreateUnnamedHandle
+   5  ObReferenceObjectByName
+   5  RtlSubtreePredecessor
+   5  SepCheckAcl
+   4  CcGetLsnForFileObject
+   4  CcMdlWriteComplete
+   4  ExAllocatePoolWithQuotaTag
+   4  FsRtlCheckLockForWriteAccess
+   4  FsRtlNumberOfRunsInLargeMcb
+   4  FsRtlOplockBreakNotify
+   4  FsRtlPrivateCheckForExclusiveLockAccess
+   4  FsRtlPrivateRemoveLock
+   4  FsRtlReleaseFileForModWrite
+   4  IoAllocateAdapterChannel
+   4  IoGetCurrentProcess
+   4  IoQueueThreadIrp
+   4  IoRaiseInformationalHardError
+   4  IoStartNextPacketByKey
+   4  KeInitializeDeviceQueue
+   4  KeInsertQueueApc
+   4  KiQuantumEnd
+   4  KiSystemService
+   4  MiChargeCommitmentCantExpand
+   4  MiCheckPdeForPagedPool
+   4  MiDetermineUserGlobalPteMask
+   4  MiRemoveWsleFromFreeList
+   4  MiResolveTransitionFault
+   4  MiVerifyImageHeader
+   4  MmCanFileBeTruncatedInternal
+   4  NtDeleteFile
+   4  ObDeleteCapturedInsertInfo
+   4  ObInsertObject
+   4  RtlAllocateAndInitializeSid
+   4  RtlDeleteNoSplay
+   4  RtlEqualPrefixSid
+   4  RtlInitializeSid
+   4  RtlLookupElementGenericTable
+   4  RtlUpcaseUnicodeToMultiByteN
+   3  CcCreateVacbArray
+   3  FsRtlAllocateFirstMapping
+   3  FsRtlCancelExclusiveIrp
+   3  FsRtlPrivateCheckWaitingLocks
+   3  FsRtlPrivateInitializeFileLock
+   3  Ke386GetGdtEntryThread
+   3  KeInitializeEvent
+   3  KiExceptionExit
+   3  MiAccessCheck
+   3  MiBuildKernelMap
+   3  MiDeleteSystemPagableVm
+   3  MiFindActualFaultingPte
+   3  MiFreeInPageSupportBlock
+   3  MiGetSystemCacheSubsection
+   3  MiInsertWsle
+   3  MiMapPageToZeroInHyperSpace
+   3  MiReleasePageFileSpace
+   3  MiReserveSystemPtes2
+   3  MmBuildMdlForNonPagedPool
+   3  ObpValidateAccessMask
+   3  RtlClearBits
+   3  RtlConvertUlongToLargeInteger
+   3  RtlEnumerateGenericTable
+   3  RtlFirstFreeAce
+   3  RtlIsGenericTableEmpty
+   3  RtlLargeIntegerDivide
+   3  RtlLengthSecurityDescriptor
+   2  CcAllocateObcb
+   2  CcUnpinDataForThread
+   2  ExCreateHandleTable
+   2  ExecuteHandler
+   2  ExReleaseResourceForThreadLite
+   2  FsRtlCheckForMatchingFileObject
+   2  FsRtlDeleteTunnelCache
+   2  FsRtlInitializeFileLock
+   2  FsRtlMdlReadComplete
+   2  FsRtlMdlWriteCompleteDev
+   2  FsRtlPrivateCancelFileLockIrp
+   2  FsRtlPrivateInsertExclusiveLock
+   2  FsRtlSplitLargeMcb
+   2  FsRtlSyncVolumes
+   2  FsRtlUninitializeFileLock
+   2  IoGetFileObjectGenericMapping
+   2  IopSynchronousApiServiceTail
+   2  KeBoostCurrentThread
+   2  KeContextToKframes
+   2  KeReadStateSemaphore
+   2  KiContinue
+   2  MiFlushEventCounter
+   2  MiInitializeTransitionPfn
+   2  MiMapPageInHyperSpace
+   2  MiRemovePageFromWorkingSet
+   2  MmCanFileBeTruncated
+   2  MmGetFileNameForSection
+   2  RtlAreBitsSet
+   2  RtlFindClearBitsAndSet
+   2  RtlFindFirstRunSet
+   2  RtlFindSetBits
+   2  RtlInitializeBitMap
+   2  RtlSetAllBits
+   2  SeAccessCheck
+   1  CcExtendVacbArray
+   1  CcPurgeCacheSection
+   1  CcUnmapVacb
+   1  ExAllocatePoolWithQuota
+   1  ExLocalTimeToSystemTime
+   1  ExpAllocateHandleTableEntries
+   1  FsRtlAddLargeEntry
+   1  FsRtlFastUnlockAll
+   1  FsRtlFastUnlockSingleShared
+   1  FsRtlMdlReadCompleteDev
+   1  FsRtlPrivateInsertSharedLock
+   1  FsRtlRemoveAndCompleteIrp
+   1  IoAcquireVpbSpinLock
+   1  IopMountVolume
+   1  IopSynchronousServiceTail
+   1  IopTimerDispatch
+   1  IoUpdateShareAccess
+   1  KeFlushEntireTb
+   1  KeInitializeThread
+   1  KeSetKernelStackSwapEnable
+   1  KiComputeWaitInterval
+   1  KiEspToTrapFrame
+   1  KiScanReadyQueues
+   1  KiServiceExit2
+   1  KiTimerExpiration
+   1  KiUnwaitThread
+   1  main
+   1  MiAddMappedPtes
+   1  MiChargeCommitment
+   1  MiDeleteFreeVm
+   1  MiFindEmptyAddressRangeDownTree
+   1  MiFlushInPageSupportBlock
+   1  MiFlushPteList
+   1  MiLocateSubsection
+   1  MiReturnCommitment
+   1  MiUnlockPagedAddress
+   1  MiUnmapImageHeaderInHyperSpace
+   1  MiUpForkPageShareCount
+   1  MmFlushImageSection
+   1  MmGetPhysicalAddress
+   1  MmOutSwapProcess
+   1  MmUnlockCachedPage
+   1  MmWorkingSetManager
+   1  NtCancelIoFile
+   1  NtProtectVirtualMemory
+   1  NtStartProfile
+   1  ObpInsertHandleCount
+   1  PspSystemThreadStartup
+   1  RtlCreateAcl
+   1  RtlEqualSid
+   1  RtlExtendedIntegerMultiply
+   1  RtlInitUnicodeString
+   1  RtlOemStringToCountedUnicodeString
+   1  RtlSecondsSince1970ToTime
+   1  RtlSubAuthoritySid
+   1  RtlUnwind
+   1  RtlUpcaseUnicodeStringToAnsiString
+   1  RtlValidSecurityDescriptor
+   1  SeDeassignSecurity
+   1  SeFreeCapturedSecurityQos
+   1  SeFreePrivileges
+   1  SeQueryAuthenticationIdToken
+
+
\ No newline at end of file
diff --git a/private/ntos/init/mp/ppc.prf b/private/ntos/init/mp/ppc.prf
new file mode 100644
index 000000000..fb1cf6150
--- /dev/null
+++ b/private/ntos/init/mp/ppc.prf
@@ -0,0 +1,571 @@
+KiIdleLoop
+MmZeroPageThread
+KiSwapThread
+ExReleaseResourceLite
+ExAcquireResourceExclusiveLite
+ExInterlockedPopEntrySList
+ExAllocatePoolWithTag
+IopParseDevice
+KeWaitForSingleObject
+ExFreePoolWithTag
+IofCompleteRequest
+KiDispatchInterrupt
+CcMapData
+Exfi386InterlockedDecrementLong
+ExInterlockedPushEntrySList
+KefAcquireSpinLockAtDpcLevel
+InterlockedDecrement
+IoAllocateIrp
+memmove
+ExfInterlockedAddUlong
+CcGetVirtualAddress
+CcFastCopyRead
+RtlFindClearBits
+ExfInterlockedPushEntryList
+ExAcquireResourceSharedLite
+RtlSplay
+CcPinFileData
+KeRemoveQueue
+MmCopyToCachedPage
+ObpCaptureObjectCreateInformation
+CcFindBcb
+IopAllocateIrp
+RtlCompareMemory
+CcFastCopyWrite
+KeSynchronizeExecution
+FsRtlDissectName
+ObReferenceObjectByHandle
+FsRtlIsNameInExpressionPrivate
+MiZeroPhysicalPage
+InterlockedIncrement
+PsImpersonateClient
+RtlCompareUnicodeString
+RtlUpcaseUnicodeToOemN
+IoGetRelatedDeviceObject
+ObOpenObjectByName
+MiFlushSectionInternal
+ExpFindCurrentThread
+IoFreeIrp
+RtlTimeToTimeFields
+CcSetDirtyPinnedData
+FsRtlLookupLargeMcbEntry
+ObfDereferenceObject
+CcCanIWrite
+CcFreeVirtualAddress
+IopDeleteFile
+SeCreateAccessState
+KefReleaseSpinLockFromDpcLevel
+CcMapAndCopy
+ExInterlockedCompareExchange64
+RtlCopyUnicodeString
+ExAcquireHandleTableShared
+KeInsertQueueDpc
+MmProbeAndLockPages
+ObpLookupObjectName
+CcMapAndRead
+IopCompleteRequest
+MiRemovePageByColor
+KeFlushSingleTb
+IoCreateFile
+CcUnpinFileData
+ObpCaptureObjectName
+KeInsertQueue
+MmCheckCachedPageState
+CcInitializeCacheMap
+ExInterlockedAddLargeStatistic
+RtlEqualUnicodeString
+ObpAllocateObject
+FsRtlIsFatDbcsLegal
+CcFlushCache
+ExAcquireFastMutexUnsafe
+RtlFillMemoryUlong
+IopCheckDeviceAndDriver
+MmSetAddressRangeModified
+CcPinMappedData
+KeLeaveCriticalRegion
+CcUninitializeCacheMap
+MiCleanSection
+MmUnmapViewInSystemCache
+CcPrepareMdlWrite
+PsReferenceImpersonationToken
+MiInsertPageInList
+CcWriteBehind
+ExAllocatePool
+FsRtlFindLargeIndex
+IoFastQueryNetworkAttributes
+CcSetDirtyInMask
+KeSetEventBoostPriority
+IofCallDriver
+RtlpCaptureContext
+ObpAllocateObjectNameBuffer
+CcLazyWriteScan
+MiLocateAndReserveWsle
+RtlIsNameLegalDOS8Dot3
+ExCreateHandle
+ExFreePool
+ElapsedDaysToYears
+ObpIncrementHandleCount
+FsRtlAddToTunnelCache
+IoFreeController
+CcAcquireByteRangeForWrite
+FsRtlCheckOplock
+CcPreparePinWrite
+IoAllocateMdl
+KiSetCR0Bits
+ObReferenceObjectByPointer
+CcMdlRead
+ExQueueWorkItem
+IopCloseFile
+FsRtlFindInTunnelCache
+ObCreateObject
+PsReferencePrimaryToken
+CcAllocateInitializeBcb
+ExTryToAcquireResourceExclusiveLite
+ExReleaseHandleTableShared
+RtlExtendedMagicDivide
+CcPinRead
+Exfi386InterlockedExchangeUlong
+CcCopyRead
+NtSetInformationFile
+ObpFreeObjectNameBuffer
+ExInterlockedExchangeAddLargeInteger
+NtClose
+KeEnterCriticalRegion
+MiDecrementShareCount2
+ExReleaseHandleTableExclusive
+ObpCreateHandle
+KiDeliverApc
+IopCompletePageWrite
+RtlUpcaseUnicodeChar
+KeQuerySystemTime
+CcGetFileObjectFromBcb
+RtlNtStatusToDosErrorNoTeb
+ExIsResourceAcquiredExclusiveLite
+IopParseFile
+MiWaitForInPageComplete
+_NLG_Return2
+CcGetVirtualAddressIfMapped
+MiCheckProtoPtePageState
+MmCreateSection
+MiLocateWsle
+MmUnlockPages
+KiInterruptDispatch
+RtlUnicodeToOemN
+IoGetRequestorProcess
+MiReserveSystemPtes
+IoBuildSynchronousFsdRequest
+MiReleaseSystemPtes
+ObpDecrementHandleCount
+ObpFreeObject
+CcSetFileSizes
+FsRtlDoesNameContainWildCards
+FsRtlOplockFsctrl
+IoSetThreadHardErrorMode
+MiDecrementReferenceCount
+CcUnpinData
+ExAcquireSharedStarveExclusive
+CcWorkerThread
+IoFreeMdl
+ExAllocateFromPagedLookasideList
+MiAllocatePoolPages
+MmMapViewInSystemCache
+RtlMapGenericMask
+ExInitializeResourceLite
+FsRtlOplockCleanup
+MiFreePoolPages
+ExAcquireHandleTableExclusive
+PsAssignImpersonationToken
+MmAccessFault
+SeDeleteAccessState
+IoCheckFunctionAccess
+MmPurgeSection
+RtlInsertElementGenericTable
+ExpAcquireResourceExclusiveLite
+ExGetSharedWaiterCount
+IopCheckBackupRestorePrivilege
+MiUpdateWsle
+MmMapLockedPages
+ExpWaitForResource
+FsRtlOplockBreakToII
+MiCreateDataFileMap
+MmFlushSection
+SeAssignSecurity
+IoAllocateErrorLogEntry
+KeReadStateQueue
+IoBuildPartialMdl
+_abnormal_termination
+CcMdlWriteComplete2
+ExDestroyHandle
+FsRtlRemoveMcbEntryPrivate
+KeFlushMultipleTb
+KeSetEvent
+KiRetireDpcList
+KiTrap0E
+ObpRemoveObjectRoutine
+FsRtlGetNextLargeMcbEntry
+IopErrorLogRequeueEntry
+SeCaptureSubjectContext
+IoCancelIrp
+IopDereferenceVpbAndFree
+FsRtlFastCheckLockForRead
+FsRtlRequestExclusiveOplock
+ExFreeToPagedLookasideList
+IoIsOperationSynchronous
+MiRemoveMappedPtes
+RtlUpcaseUnicodeString
+SepFilterPrivilegeAudits
+DebugService
+KeSetTimer
+RtlCompressChunks
+RtlpDidUnicodeToOemWork
+RtlUpcaseUnicodeStringToOemString
+SeSetAccessStateGenericMapping
+SeTokenType
+CcFreeActiveVacb
+ExfInterlockedInsertTailList
+ExMapHandleToPointer
+KeGetCurrentPrcb
+MiUnlinkPageFromList
+RtlOemStringToUnicodeString
+ExReleaseFastMutexUnsafe
+FsRtlTruncateLargeMcb
+KeWaitForMultipleObjects
+RtlUnicodeStringToOemString
+CcDeleteSharedCacheMap
+CcGetVacbMiss
+IopReportResourceUsage
+KiAcquireSpinLock
+RtlAreAnyAccessesGranted
+SeUnlockSubjectContext
+CcGetDirtyPages
+IoSetShareAccess
+MiRemoveAnyPage
+ExSystemTimeToLocalTime
+FsRtlAreNamesEqual
+ObGetObjectPointerCount
+ObpIncrementUnnamedHandleCount
+ObWaitForSingleObject
+RtlOemToUnicodeN
+RtlUpcaseUnicodeStringToCountedOemString
+CcUnpinRepinnedBcb
+FsRtlIsNameInExpression
+KiTimerListExpire
+ObSetSecurityDescriptorInfo
+FsRtlFastCheckLockForWrite
+KeResetEvent
+MiSetDirtyBit
+PsChargeSharedPoolQuota
+PsOpenTokenOfProcess
+RtlTimeToSecondsSince1970
+ExDeleteResourceLite
+FsRtlRemoveLargeMcbEntry
+IoSynchronousPageWrite
+MiDispatchFault
+MmIsAddressValid
+IopIsDeviceInstanceEnabled
+KeInitializeDpc
+PsReturnSharedPoolQuota
+RtlExtendedLargeIntegerDivide
+RtlpGetStackLimits
+SeComputeQuotaInformationSize
+SeValidSecurityDescriptor
+ExpWorkerThread
+FsRtlAddLargeMcbEntry
+ObpDeleteNameCheck
+ExDisableResourceBoostLite
+FsRtlPruneTunnelCache
+FsRtlRemoveAndCompleteWaitIrp
+MiGetInPageSupportBlock
+MiRemoveZeroPage
+PspDeleteThreadSecurity
+RtlpGenerateInheritedAce
+VdmpDelayIntApcRoutine
+CcPerformReadAhead
+CcPostWorkQueue
+ExReinitializeResourceLite
+FsRtlUninitializeOplock
+IoSetTopLevelIrp
+MiCheckControlArea
+MmUnmapLockedPages
+SepGetDefaultsSubjectContext
+ExNotifyCallback
+FsRtlOplockIsFastIoPossible
+FsRtlPrivateFastUnlockAll
+FsRtlWaitOnIrp
+IoGetTopLevelIrp
+IoInitializeIrp
+IoPageRead
+IoStartPacket
+MiGetEventCounter
+MiInitializePfn
+ObpChargeQuotaForObject
+RtlDelete
+SeAuditingFileEvents
+SeFastTraverseCheck
+FsRtlAcknowledgeOplockBreak
+FsRtlPrivateLimitFreeLockList
+IoCheckShareAccess
+IoCreateStreamFileObject
+MiReleaseWsle
+MiRemoveWsle
+MiResolveMappedFileFault
+ObDereferenceObject
+SeTokenImpersonationLevel
+CcReleaseByteRangeFromWrite
+FsRtlAcquireFileForCcFlush
+FsRtlCurrentBatchOplock
+FsRtlInitializeLargeMcb
+FsRtlPrivateLock
+IoBuildDeviceIoControlRequest
+KeInsertByKeyDeviceQueue
+MiEnsureAvailablePageOrWait
+MiInsertFrontModifiedNoWrite
+PsWatchWorkingSet
+RawCheckForDismount
+RtlDeleteElementGenericTable
+RtlSetBits
+SeReleaseSubjectContext
+CcCopyWrite
+FsRtlFindFirstOverlappingExclusiveNode
+IoStartNextPacket
+KeInitializeSpinLock
+KeSetTimerEx
+NtQueryVolumeInformationFile
+ObpLookupDirectoryEntry
+RtlxOemStringToUnicodeSize
+_allmul
+CcScheduleReadAhead
+CcUnmapVacbArray
+FsRtlUninitializeLargeMcb
+IoCheckDesiredAccess
+KeInitializeEventPair
+MiMakeSystemAddressValidPfnWs
+MiRemoveUnusedSegments
+MiSegmentDelete
+RtlNumberOfSetBits
+RtlpLengthInheritedAce
+RtlUnicodeStringToCountedOemString
+_wcsicmp
+ExEnumHandleTable
+FsRtlLookupLastLargeMcbEntry
+IoRemoveShareAccess
+KeReleaseSemaphore
+MiInitializeReadInProgressPfn
+MiRemovePageFromList
+MiResolveProtoPteFault
+ObpIncrementHandleDataBase
+SwapSplayLinks
+CcDeallocateBcb
+FsRtlPrivateResetLowestLockOffset
+IopCheckVpbMounted
+KeInsertDeviceQueue
+KeRemoveDeviceQueue
+MiAddValidPageToWorkingSet
+MiCheckForControlAreaDeletion
+MiCompleteProtoPteFault
+MiRestoreTransitionPte
+NtWaitForSingleObject
+xHalGetConventionalCylinders
+CcSetValidData
+ExAcquireSharedWaitForExclusive
+ExIsResourceAcquiredSharedLite
+FsRtlAllocateOplock
+FsRtlCheckNoExclusiveConflict
+FsRtlDeregisterUncProvider
+IopQueryName
+IoRegisterShutdownNotification
+LpcpClosePort
+MiCheckControlAreaStatus
+RtlAreBitsClear
+RtlCreateSecurityDescriptor
+SepAccessCheck
+SepInheritAcl
+DaysAndFractionToTime
+FsRtlFastUnlockSingle
+FsRtlFastUnlockSingleExclusive
+FsRtlReleaseFileForCcFlush
+IoCancelThreadIo
+KeInsertHeadQueue
+KeRemoveByKeyDeviceQueue
+KeTryToAcquireSpinLock
+KiReleaseSpinLock
+RtlpLengthInheritAcl
+SeLockSubjectContext
+SepSidInToken
+CcMdlReadComplete
+CcMdlReadComplete2
+FsRtlCheckLockForReadAccess
+FsRtlPrivateInsertLock
+IoAcquireCancelSpinLock
+IopOpenLinkOrRenameTarget
+KeFlushQueueApc
+KeInitializeApc
+MiInitializeCopyOnWritePfn
+MiMakeProtectionMask
+MiMakeSystemAddressValidPfn
+MiResolveDemandZeroFault
+MiSectionDelete
+MmCreateMdl
+ObpCreateUnnamedHandle
+ObReferenceObjectByName
+RtlSubtreePredecessor
+SepCheckAcl
+CcGetLsnForFileObject
+CcMdlWriteComplete
+ExAllocatePoolWithQuotaTag
+FsRtlCheckLockForWriteAccess
+FsRtlNumberOfRunsInLargeMcb
+FsRtlOplockBreakNotify
+FsRtlPrivateCheckForExclusiveLockAccess
+FsRtlPrivateRemoveLock
+FsRtlReleaseFileForModWrite
+IoAllocateAdapterChannel
+IoGetCurrentProcess
+IoQueueThreadIrp
+IoRaiseInformationalHardError
+IoStartNextPacketByKey
+KeInitializeDeviceQueue
+KeInsertQueueApc
+KiQuantumEnd
+KiSystemService
+MiChargeCommitmentCantExpand
+MiCheckPdeForPagedPool
+MiDetermineUserGlobalPteMask
+MiRemoveWsleFromFreeList
+MiResolveTransitionFault
+MiVerifyImageHeader
+MmCanFileBeTruncatedInternal
+NtDeleteFile
+ObDeleteCapturedInsertInfo
+ObInsertObject
+RtlAllocateAndInitializeSid
+RtlDeleteNoSplay
+RtlEqualPrefixSid
+RtlInitializeSid
+RtlLookupElementGenericTable
+RtlUpcaseUnicodeToMultiByteN
+CcCreateVacbArray
+FsRtlAllocateFirstMapping
+FsRtlCancelExclusiveIrp
+FsRtlPrivateCheckWaitingLocks
+FsRtlPrivateInitializeFileLock
+Ke386GetGdtEntryThread
+KeInitializeEvent
+KiExceptionExit
+MiAccessCheck
+MiBuildKernelMap
+MiDeleteSystemPagableVm
+MiFindActualFaultingPte
+MiFreeInPageSupportBlock
+MiGetSystemCacheSubsection
+MiInsertWsle
+MiMapPageToZeroInHyperSpace
+MiReleasePageFileSpace
+MiReserveSystemPtes2
+MmBuildMdlForNonPagedPool
+ObpValidateAccessMask
+RtlClearBits
+RtlConvertUlongToLargeInteger
+RtlEnumerateGenericTable
+RtlFirstFreeAce
+RtlIsGenericTableEmpty
+RtlLargeIntegerDivide
+RtlLengthSecurityDescriptor
+CcAllocateObcb
+CcUnpinDataForThread
+ExCreateHandleTable
+ExecuteHandler
+ExReleaseResourceForThreadLite
+FsRtlCheckForMatchingFileObject
+FsRtlDeleteTunnelCache
+FsRtlInitializeFileLock
+FsRtlMdlReadComplete
+FsRtlMdlWriteCompleteDev
+FsRtlPrivateCancelFileLockIrp
+FsRtlPrivateInsertExclusiveLock
+FsRtlSplitLargeMcb
+FsRtlSyncVolumes
+FsRtlUninitializeFileLock
+IoGetFileObjectGenericMapping
+IopSynchronousApiServiceTail
+KeBoostCurrentThread
+KeContextToKframes
+KeReadStateSemaphore
+KiContinue
+MiFlushEventCounter
+MiInitializeTransitionPfn
+MiMapPageInHyperSpace
+MiRemovePageFromWorkingSet
+MmCanFileBeTruncated
+MmGetFileNameForSection
+RtlAreBitsSet
+RtlFindClearBitsAndSet
+RtlFindFirstRunSet
+RtlFindSetBits
+RtlInitializeBitMap
+RtlSetAllBits
+SeAccessCheck
+CcExtendVacbArray
+CcPurgeCacheSection
+CcUnmapVacb
+ExAllocatePoolWithQuota
+ExLocalTimeToSystemTime
+ExpAllocateHandleTableEntries
+FsRtlAddLargeEntry
+FsRtlFastUnlockAll
+FsRtlFastUnlockSingleShared
+FsRtlMdlReadCompleteDev
+FsRtlPrivateInsertSharedLock
+FsRtlRemoveAndCompleteIrp
+IoAcquireVpbSpinLock
+IopMountVolume
+IopSynchronousServiceTail
+IopTimerDispatch
+IoUpdateShareAccess
+KeFlushEntireTb
+KeInitializeThread
+KeSetKernelStackSwapEnable
+KiComputeWaitInterval
+KiEspToTrapFrame
+KiScanReadyQueues
+KiServiceExit2
+KiTimerExpiration
+KiUnwaitThread
+main
+MiAddMappedPtes
+MiChargeCommitment
+MiDeleteFreeVm
+MiFindEmptyAddressRangeDownTree
+MiFlushInPageSupportBlock
+MiFlushPteList
+MiLocateSubsection
+MiReturnCommitment
+MiUnlockPagedAddress
+MiUnmapImageHeaderInHyperSpace
+MiUpForkPageShareCount
+MmFlushImageSection
+MmGetPhysicalAddress
+MmOutSwapProcess
+MmUnlockCachedPage
+MmWorkingSetManager
+NtCancelIoFile
+NtProtectVirtualMemory
+NtStartProfile
+ObpInsertHandleCount
+PspSystemThreadStartup
+RtlCreateAcl
+RtlEqualSid
+RtlExtendedIntegerMultiply
+RtlInitUnicodeString
+RtlOemStringToCountedUnicodeString
+RtlSecondsSince1970ToTime
+RtlSubAuthoritySid
+RtlUnwind
+RtlUpcaseUnicodeStringToAnsiString
+RtlValidSecurityDescriptor
+SeDeassignSecurity
+SeFreeCapturedSecurityQos
+SeFreePrivileges
+SeQueryAuthenticationIdToken
+
+
\ No newline at end of file
diff --git a/private/ntos/init/mp/sources b/private/ntos/init/mp/sources
new file mode 100644
index 000000000..27e0a8401
--- /dev/null
+++ b/private/ntos/init/mp/sources
@@ -0,0 +1,30 @@
+!IF 0
+
+Copyright (c) 1989  Microsoft Corporation
+
+Module Name:
+
+    sources.
+
+Abstract:
+
+    This file specifies the target component being built and the list of
+    sources files needed to build that component.  Also specifies optional
+    compiler switches and libraries that are unique for the component being
+    built.
+
+
+Author:
+
+    Steve Wood (stevewo) 12-Apr-1990
+
+NOTE:   Commented description of this file is in \nt\bak\bin\sources.tpl
+
+!ENDIF
+
+!include ..\up\sources
+
+NT_UP=0
+
+TARGETPATH=..\..\mpobj
+NTTEST=ntkrnlmp
diff --git a/private/ntos/init/ntkrnlmp.c b/private/ntos/init/ntkrnlmp.c
new file mode 100644
index 000000000..24bdd3d4a
--- /dev/null
+++ b/private/ntos/init/ntkrnlmp.c
@@ -0,0 +1 @@
+#include "ntoskrnl.c"
diff --git a/private/ntos/init/ntoskrnl.c b/private/ntos/init/ntoskrnl.c
new file mode 100644
index 000000000..27b36da03
--- /dev/null
+++ b/private/ntos/init/ntoskrnl.c
@@ -0,0 +1,44 @@
+/*++
+
+Copyright (c) 1989  Microsoft Corporation
+
+Module Name:
+
+    ntoskrnl.c
+
+Abstract:
+
+    Test program for the INIT subcomponent of the NTOS project
+
+Author:
+
+    Steve Wood (stevewo) 31-Mar-1989
+
+Revision History:
+
+--*/
+
+#include "ntos.h"
+
+#if !defined(_MIPS_) && !defined(_ALPHA_) && !defined(_PPC_)
+
+int
+cdecl
+main(
+    IN PLOADER_PARAMETER_BLOCK LoaderBlock
+    )
+{
+#ifdef i386
+
+    KiSystemStartup(LoaderBlock);
+
+#else
+
+    KiSystemStartup();
+
+#endif
+
+    return 0;
+}
+
+#endif // _MIPS_ && _ALPHA_ && _PPC_
diff --git a/private/ntos/init/ntoskrnl.rc b/private/ntos/init/ntoskrnl.rc
new file mode 100644
index 000000000..8c7ce68ed
--- /dev/null
+++ b/private/ntos/init/ntoskrnl.rc
@@ -0,0 +1,12 @@
+#include <windows.h>
+
+#include <ntverp.h>
+
+#define	VER_FILETYPE	VFT_APP
+#define	VER_FILESUBTYPE	VFT2_UNKNOWN
+#define VER_FILEDESCRIPTION_STR     "NT Kernel & System"
+#define VER_INTERNALNAME_STR        "ntoskrnl.exe"
+
+#include "common.ver"
+
+#include "bugcodes.rc"
diff --git a/private/ntos/init/ntoskrnl.src b/private/ntos/init/ntoskrnl.src
new file mode 100644
index 000000000..a71148abb
--- /dev/null
+++ b/private/ntos/init/ntoskrnl.src
@@ -0,0 +1,1002 @@
+#undef RtlMoveMemory
+#undef RtlCopyMemory
+#undef RtlFillMemory
+#undef RtlZeroMemory
+NAME ntoskrnl.exe
+
+DESCRIPTION 'Windows NT Kernel'
+
+EXPORTS
+    CcCanIWrite
+    CcCopyRead
+    CcFastCopyRead
+    CcCopyWrite
+    CcFastCopyWrite
+    CcDeferWrite
+    CcFlushCache
+    CcGetDirtyPages
+    CcGetFileObjectFromBcb
+    CcGetFileObjectFromSectionPtrs
+    CcGetLsnForFileObject
+    CcInitializeCacheMap
+    CcIsThereDirtyData
+    CcMapData
+    CcMdlRead
+    CcMdlReadComplete
+    CcMdlWriteComplete
+    CcPinMappedData
+    CcPinRead
+    CcPrepareMdlWrite
+    CcPreparePinWrite
+    CcPurgeCacheSection
+    CcRepinBcb
+    CcScheduleReadAhead
+    CcSetAdditionalCacheAttributes
+    CcSetBcbOwnerPointer
+    CcSetDirtyPageThreshold
+    CcSetDirtyPinnedData
+    CcSetFileSizes
+    CcSetLogHandleForFile
+    CcSetReadAheadGranularity
+    CcUninitializeCacheMap
+    CcUnpinData
+    CcUnpinDataForThread
+    CcUnpinRepinnedBcb
+    CcZeroData
+    CcFastReadNotPossible CONSTANT      // Data - use pointer for access
+    CcFastReadWait CONSTANT             // Data - use pointer for access
+    CcFastMdlReadWait CONSTANT          // Data - use pointer for access
+    DbgBreakPoint
+    DbgBreakPointWithStatus
+    DbgLoadImageSymbols
+    DbgPrint
+    DbgPrompt
+    ExAcquireFastMutexUnsafe
+    ExAcquireResourceExclusive
+    ExAcquireResourceExclusiveLite
+    ExAcquireResourceSharedLite
+    ExAcquireSharedStarveExclusive
+    ExAcquireSharedWaitForExclusive
+    ExAllocatePool
+    ExAllocatePoolWithQuota
+    ExAllocatePoolWithQuotaTag
+    ExAllocatePoolWithTag
+    ExConvertExclusiveToSharedLite
+    ExCreateCallback
+    ExDeleteResource
+    ExDeleteResourceLite
+    ExDesktopObjectType CONSTANT        // Data - use pointer for access
+    ExDisableResourceBoostLite
+    ExEnumHandleTable
+    ExEventObjectType CONSTANT          // Data - use pointer for access
+    ExExtendZone
+    ExFreePool
+    ExGetExclusiveWaiterCount
+    ExGetPreviousMode
+    ExGetSharedWaiterCount
+    ExInitializeNPagedLookasideList
+    ExIsProcessorFeaturePresent
+    ExDeleteNPagedLookasideList
+    ExInitializePagedLookasideList
+    ExDeletePagedLookasideList
+    ExInitializeResource
+    ExInitializeResourceLite
+    ExReinitializeResourceLite
+    ExInitializeZone
+    ExInterlockedAddLargeInteger
+    ExInterlockedAddLargeStatistic
+    ExInterlockedAddUlong
+    ExInterlockedDecrementLong
+    ExInterlockedExchangeUlong
+    ExInterlockedExtendZone
+    ExInterlockedIncrementLong
+    ExInterlockedInsertHeadList
+    ExInterlockedInsertTailList
+    ExInterlockedPopEntryList
+    ExInterlockedPushEntryList
+    ExInterlockedRemoveHeadList
+    ExIsResourceAcquiredExclusiveLite
+    ExIsResourceAcquiredSharedLite
+    ExLocalTimeToSystemTime
+    ExNotifyCallback
+    ExPostSystemEvent
+    ExQueryPoolBlockSize
+    ExQueueWorkItem
+    ExRaiseAccessViolation
+    ExRaiseDatatypeMisalignment
+    ExRaiseException
+    ExRaiseStatus
+    ExRaiseHardError
+    ExRegisterCallback
+    ExReleaseFastMutexUnsafe
+    ExReleaseResourceLite
+    ExReleaseResourceForThread
+    ExReleaseResourceForThreadLite
+    ExSetResourceOwnerPointer
+    ExSystemExceptionFilter
+    ExSystemTimeToLocalTime
+//    ExTryToAcquireFastMutexUnsafe
+    ExUnregisterCallback
+    ExWindowStationObjectType CONSTANT  // Data - use pointer for access
+    FsRtlAddLargeMcbEntry
+    FsRtlAddMcbEntry
+    FsRtlAllocatePool
+    FsRtlAllocatePoolWithTag
+    FsRtlAllocatePoolWithQuota
+    FsRtlAllocatePoolWithQuotaTag
+    FsRtlAllocateResource
+    FsRtlAreNamesEqual
+    FsRtlBalanceReads
+    FsRtlCheckLockForReadAccess
+    FsRtlCheckLockForWriteAccess
+    FsRtlCheckOplock
+    FsRtlCopyRead
+    FsRtlCopyWrite
+    FsRtlGetFileSize
+    FsRtlMdlReadDev
+    FsRtlMdlReadComplete
+    FsRtlMdlReadCompleteDev
+    FsRtlPrepareMdlWriteDev
+    FsRtlMdlWriteComplete
+    FsRtlMdlWriteCompleteDev
+    FsRtlCurrentBatchOplock
+    FsRtlDeregisterUncProvider
+    FsRtlDissectDbcs
+    FsRtlDissectName
+    FsRtlDoesDbcsContainWildCards
+    FsRtlDoesNameContainWildCards
+    FsRtlFastCheckLockForRead
+    FsRtlFastCheckLockForWrite
+    FsRtlFastUnlockSingle
+    FsRtlFastUnlockAll
+    FsRtlFastUnlockAllByKey
+    FsRtlGetNextFileLock
+    FsRtlGetNextLargeMcbEntry
+    FsRtlGetNextMcbEntry
+    FsRtlInitializeFileLock
+    FsRtlInitializeLargeMcb
+    FsRtlInitializeMcb
+    FsRtlInitializeOplock
+    FsRtlIsDbcsInExpression
+    FsRtlIsFatDbcsLegal
+    FsRtlIsHpfsDbcsLegal
+    FsRtlIsNameInExpression
+    FsRtlIsNtstatusExpected
+    FsRtlIsTotalDeviceFailure
+    FsRtlLegalAnsiCharacterArray CONSTANT // Data - use pointer for access
+    FsRtlLookupLargeMcbEntry
+    FsRtlLookupLastLargeMcbEntry
+    FsRtlLookupLastMcbEntry
+    FsRtlLookupMcbEntry
+    FsRtlMdlRead
+    FsRtlNormalizeNtstatus
+    FsRtlNotifyInitializeSync
+    FsRtlNotifyUninitializeSync
+    FsRtlNotifyChangeDirectory
+    FsRtlNotifyReportChange
+    FsRtlNotifyCleanup
+    FsRtlNotifyFullChangeDirectory
+    FsRtlNotifyFullReportChange
+    FsRtlNumberOfRunsInLargeMcb
+    FsRtlNumberOfRunsInMcb
+    FsRtlOplockFsctrl
+    FsRtlOplockIsFastIoPossible
+    FsRtlPostStackOverflow
+    FsRtlPostPagingFileStackOverflow
+    FsRtlPrepareMdlWrite
+    FsRtlPrivateLock
+    FsRtlProcessFileLock
+    FsRtlRegisterUncProvider
+    FsRtlRemoveLargeMcbEntry
+    FsRtlRemoveMcbEntry
+    FsRtlSplitLargeMcb
+    FsRtlSyncVolumes
+    FsRtlTruncateMcb
+    FsRtlTruncateLargeMcb
+    FsRtlUninitializeFileLock
+    FsRtlUninitializeLargeMcb
+    FsRtlUninitializeMcb
+    FsRtlUninitializeOplock
+    FsRtlInitializeTunnelCache
+    FsRtlAddToTunnelCache
+    FsRtlFindInTunnelCache
+    FsRtlDeleteKeyFromTunnelCache
+    FsRtlDeleteTunnelCache
+    HalDispatchTable CONSTANT           // Data - use pointer for access
+    HalPrivateDispatchTable CONSTANT    // Data - use pointer for access
+    IoAcquireCancelSpinLock
+    IoAcquireVpbSpinLock
+    IoAdapterObjectType CONSTANT        // Data - use pointer for access
+    IoDeviceHandlerObjectType CONSTANT  // Data - use pointer for access
+    IoDeviceHandlerObjectSize CONSTANT  // Data - use pointer for access
+    IoAllocateAdapterChannel
+    IoAllocateController
+    IoAllocateErrorLogEntry
+    IoAllocateIrp
+    IoAllocateMdl
+    IoAssignResources
+    IoAttachDevice
+    IoAttachDeviceByPointer
+    IoAttachDeviceToDeviceStack
+    IoBuildAsynchronousFsdRequest
+    IoBuildDeviceIoControlRequest
+    IoBuildPartialMdl
+    IoBuildSynchronousFsdRequest
+    IoCallDriver
+    IofCallDriver
+    IoCancelIrp
+    IoCheckDesiredAccess
+    IoCheckEaBufferValidity
+    IoCheckFunctionAccess
+    IoCheckShareAccess
+    IoCompleteRequest
+    IofCompleteRequest
+    IoConnectInterrupt
+    IoCreateController
+    IoCreateDevice
+    IoCreateFile
+    IoCreateNotificationEvent
+    IoCreateStreamFileObject
+    IoCreateSymbolicLink
+    IoCreateSynchronizationEvent
+    IoCreateUnprotectedSymbolicLink
+    IoDeleteController
+    IoDeleteDevice
+    IoDeleteSymbolicLink
+    IoDetachDevice
+    IoDeviceObjectType CONSTANT         // Data - use pointer for access
+    IoDisconnectInterrupt
+    IoDriverObjectType CONSTANT         // Data - use pointer for access
+    IoEnqueueIrp
+    IoFastQueryNetworkAttributes
+    IoFileObjectType CONSTANT           // Data - use pointer for access
+    IoFreeController
+    IoFreeIrp
+    IoFreeMdl
+    IoGetAttachedDevice
+    IoGetBaseFileSystemDeviceObject
+    IoGetConfigurationInformation
+    IoGetCurrentProcess
+    IoGetDeviceObjectPointer
+#if _PNP_POWER_STUB_ENABLED_
+    IoGetDeviceProperty
+#endif
+    IoGetDeviceToVerify
+    IoGetFileObjectGenericMapping
+    IoGetInitialStack
+    IoGetRelatedDeviceObject
+    IoGetRequestorProcess
+    IoGetStackLimits=RtlpGetStackLimits
+    IoGetTopLevelIrp
+    IoInitializeIrp
+    IoInitializeTimer
+    IoIsOperationSynchronous
+    IoIsSystemThread
+    IoMakeAssociatedIrp
+    IoOpenDeviceInstanceKey
+    IoPageRead
+    IoQueryDeviceDescription
+    IoQueryDeviceEnumInfo
+    IoQueryFileInformation
+#if _PNP_POWER_STUB_ENABLED_
+    IoQuerySystemInformation
+#endif
+    IoQueryVolumeInformation
+    IoQueueThreadIrp
+    IoRaiseHardError
+    IoRaiseInformationalHardError
+    IoReadOperationCount CONSTANT       // Data - use pointer for access
+    IoReadTransferCount CONSTANT        // Data - use pointer for access
+    IoRegisterDriverReinitialization
+    IoRegisterFileSystem
+    IoRegisterFsRegistrationChange
+#if _PNP_POWER_STUB_ENABLED_
+    IoRegisterPlugPlayNotification
+#endif
+    IoRegisterShutdownNotification
+    IoReleaseCancelSpinLock
+    IoReleaseVpbSpinLock
+    IoRemoveShareAccess
+#if _PNP_POWER_STUB_ENABLED_
+    IoReportDeviceStatus
+#endif
+    IoReportHalResourceUsage
+    IoReportResourceUsage
+#if _PNP_POWER_STUB_ENABLED_
+    IoSetDeviceProperty
+#endif
+    IoSetDeviceToVerify
+    IoSetHardErrorOrVerifyDevice
+    IoSetInformation
+    IoSetShareAccess
+    IoSetThreadHardErrorMode
+    IoSetTopLevelIrp
+    IoStartNextPacket
+    IoStartNextPacketByKey
+    IoStartPacket
+    IoStartTimer
+    IoStatisticsLock CONSTANT           // Data - use pointer for access
+    IoStopTimer
+    IoSynchronousPageWrite
+    IoThreadToProcess
+    IoUnregisterFileSystem
+    IoUnregisterFsRegistrationChange
+#if _PNP_POWER_STUB_ENABLED_
+    IoUnregisterPlugPlayNotification
+#endif
+    IoUnregisterShutdownNotification
+    IoUpdateShareAccess
+    IoVerifyVolume
+    IoWriteErrorLogEntry
+    IoWriteOperationCount CONSTANT      // Data - use pointer for access
+    IoWriteTransferCount CONSTANT       // Data - use pointer for access
+    KdDebuggerEnabled    CONSTANT       // Data - use pointer for access
+    KdDebuggerNotPresent CONSTANT       // Data - use pointer for access
+    KdPollBreakIn
+    KeAddSystemServiceTable
+    KeAttachProcess
+    KeBoostCurrentThread
+    KeBugCheck
+    KeBugCheckEx
+    KeCancelTimer
+    KeClearEvent
+    KeConnectInterrupt
+    KeDcacheFlushCount CONSTANT         // Data - use pointer for access
+    KeDelayExecutionThread
+    KeDetachProcess
+    KeDeregisterBugCheckCallback
+    KeDisconnectInterrupt
+    KeEnterCriticalRegion
+    KeEnterKernelDebugger
+    KeFindConfigurationEntry
+    KeFindConfigurationNextEntry
+    KeFlushEntireTb
+    KeIcacheFlushCount CONSTANT         // Data - use pointer for access
+    KeInitializeDeviceQueue
+    KeInitializeApc
+    KeInitializeDpc
+    KeInitializeEvent
+    KeInitializeInterrupt
+    KeInitializeMutant
+    KeInitializeMutex
+    KeInitializeQueue
+    KeInitializeSemaphore
+    KeInitializeTimer
+    KeInitializeTimerEx
+    KeInsertByKeyDeviceQueue
+    KeInsertDeviceQueue
+    KeInsertQueue
+    KeInsertHeadQueue
+    KeInsertQueueApc
+    KeInsertQueueDpc
+    KeLeaveCriticalRegion
+    KeLoaderBlock CONSTANT              // Data - use pointer for access
+    KeNumberProcessors CONSTANT         // Data - use pointer for access
+    KeProfileInterrupt
+    KeProfileInterruptWithSource
+    KePulseEvent
+    KeQuerySystemTime
+    KeQueryTickCount
+    KeQueryTimeIncrement
+    KeRaiseUserException
+    KeReadStateTimer
+    KeReadStateEvent
+    KeReadStateMutant
+    KeReadStateMutex=KeReadStateMutant
+    KeReadStateQueue
+    KeReadStateSemaphore
+    KeRegisterBugCheckCallback
+    KeReleaseMutant
+    KeReleaseMutex
+    KeReleaseSemaphore
+    KeRemoveByKeyDeviceQueue
+    KeRemoveDeviceQueue
+    KeRemoveEntryDeviceQueue
+    KeRemoveQueue
+    KeRemoveQueueDpc
+    KeResetEvent
+    KeRundownQueue
+    KeServiceDescriptorTable CONSTANT   // Data - use pointer for access
+    KeSetAffinityThread
+    KeSetDmaIoCoherency
+    KeSetEvent
+    KeSetEventBoostPriority
+    KeSetBasePriorityThread
+    KeSetIdealProcessorThread
+    KeSetImportanceDpc
+    KeSetPriorityThread
+    KeSetSwapContextNotifyRoutine;
+    KeSetTargetProcessorDpc
+    KeSetTimeIncrement
+    KeSetTimer
+    KeSetTimerEx
+    KeSetTimeUpdateNotifyRoutine;
+    KeSetThreadSelectNotifyRoutine;
+    KeSynchronizeExecution
+    KeTerminateThread
+    KeTickCount CONSTANT                // Data - use pointer for access
+    KeUserModeCallback
+    KeUpdateRunTime
+    KeUpdateSystemTime
+    KeWaitForMultipleObjects
+    KeWaitForSingleObject
+    KeWaitForMutexObject=KeWaitForSingleObject
+    KiAcquireSpinLock
+    KiBugCheckData                  // Data - use pointer for access
+    KiReleaseSpinLock
+    KeInitializeSpinLock
+    KeAcquireSpinLockAtDpcLevel
+    KeReleaseSpinLockFromDpcLevel
+    KeSetKernelStackSwapEnable
+    LdrEnumResources
+    LdrAccessResource
+    LdrFindResource_U
+    LdrFindResourceDirectory_U
+    LpcRequestPort
+    LsaCallAuthenticationPackage
+    LsaDeregisterLogonProcess
+    LsaFreeReturnBuffer
+    LsaLogonUser
+    LsaLookupAuthenticationPackage
+    LsaRegisterLogonProcess
+    MmAdjustWorkingSetSize
+    MmAllocateContiguousMemory
+#ifdef MEMPRINT
+    MemPrint
+    MemPrintInitialize
+#endif
+    MmAllocateNonCachedMemory
+    MmBuildMdlForNonPagedPool
+    MmCanFileBeTruncated
+    MmCreateMdl
+    MmCreateSection
+    MmDbgTranslatePhysicalAddress
+    MmDisableModifiedWriteOfSection
+    MmFlushImageSection
+    MmForceSectionClosed
+    MmFreeContiguousMemory
+    MmFreeNonCachedMemory
+    MmGetPhysicalAddress
+    MmGrowKernelStack
+    MmIsAddressValid
+    MmIsNonPagedSystemAddressValid
+    MmIsRecursiveIoFault
+    MmIsThisAnNtAsSystem
+    MmLockPagableDataSection
+    MmLockPagableSectionByHandle
+    MmMapIoSpace
+    MmMapLockedPages
+    MmMapMemoryDumpMdl
+    MmMapVideoDisplay
+    MmMapViewOfSection
+    MmMapViewInSystemSpace
+    MmPageEntireDriver
+    MmProbeAndLockPages
+    MmQuerySystemSize
+    MmResetDriverPaging
+    MmSectionObjectType CONSTANT
+    MmSecureVirtualMemory
+    MmSetAddressRangeModified
+    MmSetBankedSection
+    MmSizeOfMdl
+    MmUnlockPagableImageSection
+    MmUnlockPages
+    MmUnmapIoSpace
+    MmUnmapLockedPages
+    MmUnmapVideoDisplay
+    MmUnmapViewOfSection
+    MmUnmapViewInSystemSpace
+    MmUnsecureVirtualMemory
+    NlsAnsiCodePage CONSTANT            // Data - use pointer for access
+    NlsLeadByteInfo CONSTANT            // Data - use pointer for access
+    NlsOemLeadByteInfo CONSTANT         // Data - use pointer for access
+    NlsMbCodePageTag CONSTANT           // Data - use pointer for access
+    NlsMbOemCodePageTag CONSTANT        // Data - use pointer for access
+    NtAddAtom
+    NtAdjustPrivilegesToken
+    NtAllocateLocallyUniqueId
+    NtAllocateUuids
+    NtAllocateVirtualMemory
+    NtClose
+    NtConnectPort
+    NtCreateEvent
+    NtCreateFile
+    NtCreateSection
+    NtDeleteAtom
+    NtDeleteFile
+    NtDeviceIoControlFile
+    NtDuplicateObject
+    NtDuplicateToken
+    NtFindAtom
+    NtFreeVirtualMemory
+    NtFsControlFile
+    NtGlobalFlag CONSTANT               // Data - use pointer for access
+    NtLockFile
+    NtMapViewOfSection
+    NtNotifyChangeDirectoryFile
+    NtOpenFile
+    NtOpenProcess
+    NtOpenProcessToken
+    NtQueryDirectoryFile
+    NtQueryEaFile
+    NtQueryInformationAtom
+    NtQueryInformationFile
+    NtQueryInformationProcess
+    NtQueryInformationToken
+    NtQueryOleDirectoryFile
+    //NtQueryQuotaInformationFile
+    NtQuerySecurityObject
+    NtQueryVolumeInformationFile
+    NtReadFile
+    NtRequestPort
+    NtRequestWaitReplyPort
+    NtSetEvent
+    NtSetInformationFile
+    NtSetInformationProcess
+    NtSetInformationThread
+    //NtSetQuotaInformationFile
+    NtSetSecurityObject
+    NtUnlockFile
+    NtVdmControl
+    NtWaitForSingleObject
+    NtWriteFile
+    ObAssignSecurity
+    ObCheckCreateObjectAccess
+    ObCheckObjectAccess
+    ObCreateObject
+    ObDereferenceObject
+    ObfDereferenceObject
+    ObFindHandleForObject
+    ObGetObjectPointerCount
+    ObGetObjectSecurity
+    ObInsertObject
+    ObMakeTemporaryObject
+    ObOpenObjectByName
+    ObOpenObjectByPointer
+    ObQueryObjectAuditingByHandle
+    ObQueryNameString
+    ObReferenceObjectByHandle
+    ObReferenceObjectByName
+    ObReferenceObjectByPointer
+    ObReleaseObjectSecurity
+    ObSetSecurityDescriptorInfo
+    ObfReferenceObject
+    PfxFindPrefix
+    PfxInitialize
+    PfxInsertPrefix
+    PfxRemovePrefix
+    PoQueryPowerSequence
+    PoSetDeviceIdleDetection
+    PoRequestPowerChange
+    ProbeForWrite
+    PsAssignImpersonationToken
+    PsChargePoolQuota
+    PsCreateSystemProcess
+    PsCreateSystemThread
+    PsCreateWin32Process
+    PsGetCurrentProcessId
+    PsGetCurrentThreadId
+    PsGetProcessExitTime
+    PsGetVersion
+    PsImpersonateClient
+    PsInitialSystemProcess
+    PsIsThreadTerminating
+    PsEstablishWin32Callouts
+    PsLookupProcessThreadByCid
+    PsLookupProcessByProcessId
+    PsLookupThreadByThreadId
+    PsProcessType CONSTANT
+    PsReferenceImpersonationToken
+    PsReferencePrimaryToken
+    PsReturnPoolQuota
+    PsRevertToSelf
+    PsSetCreateProcessNotifyRoutine
+    PsSetCreateThreadNotifyRoutine
+    PsSetLegoNotifyRoutine
+    PsSetProcessPriorityByClass
+    PsTerminateSystemThread
+    PsThreadType CONSTANT
+    RtlAddAce
+    RtlAllocateAndInitializeSid
+    RtlAllocateHeap
+    RtlAddAccessAllowedAce
+    RtlAddAtomToAtomTable
+    RtlAnsiCharToUnicodeChar
+    RtlAnsiStringToUnicodeSize=RtlxAnsiStringToUnicodeSize
+    RtlAnsiStringToUnicodeString
+    RtlAppendAsciizToString
+    RtlAppendStringToString
+    RtlAppendUnicodeStringToString
+    RtlAppendUnicodeToString
+    RtlAreAllAccessesGranted
+    RtlAreAnyAccessesGranted
+    RtlAreBitsClear
+    RtlAreBitsSet
+    RtlAssert
+    RtlCaptureStackBackTrace
+    RtlCharToInteger
+    RtlCheckRegistryKey
+    RtlClearAllBits
+    RtlClearBits
+    RtlCompareMemory
+    RtlCompareMemoryUlong
+    RtlCompareString
+    RtlCompareUnicodeString
+    RtlCompressBuffer
+    RtlCompressChunks
+    RtlConvertLongToLargeInteger
+    RtlConvertUlongToLargeInteger
+    RtlCopyLuid
+    RtlCopyString
+    RtlCopyUnicodeString
+    RtlCreateAtomTable
+    RtlCreateAcl
+    RtlCreateHeap
+    RtlCreateRegistryKey
+    RtlCreateSecurityDescriptor
+    RtlCreateUnicodeString
+    RtlDecompressBuffer
+    RtlDecompressChunks
+    RtlDecompressFragment
+    RtlDelete
+    RtlDeleteAtomFromAtomTable
+    RtlDeleteNoSplay
+    RtlDeleteElementGenericTable
+    RtlDeleteRegistryValue
+    RtlDescribeChunk
+    RtlDestroyAtomTable
+    RtlDestroyHeap
+    RtlDowncaseUnicodeString
+    RtlEmptyAtomTable
+    RtlEnlargedIntegerMultiply
+    RtlEnlargedUnsignedDivide
+    RtlEnlargedUnsignedMultiply
+    RtlEnumerateGenericTable
+    RtlEnumerateGenericTableWithoutSplaying
+    RtlEqualLuid
+    RtlEqualString
+    RtlEqualUnicodeString
+    RtlExtendedIntegerMultiply
+    RtlExtendedLargeIntegerDivide
+    RtlExtendedMagicDivide
+    RtlFillMemory
+    RtlFillMemoryUlong
+    RtlFindClearBits
+    RtlFindClearBitsAndSet
+    RtlFindFirstRunClear
+    RtlFindFirstRunSet
+    RtlFindLongestRunClear
+    RtlFindLongestRunSet
+    RtlFindMessage
+    RtlFindSetBits
+    RtlFindSetBitsAndClear
+    RtlFindUnicodePrefix
+    RtlFormatCurrentUserKeyPath
+    RtlFreeAnsiString
+    RtlFreeHeap
+    RtlFreeOemString
+    RtlFreeUnicodeString
+    RtlGenerate8dot3Name
+    RtlGetCallersAddress
+    RtlGetCompressionWorkSpaceSize
+    RtlGetDefaultCodePage
+    RtlGetElementGenericTable
+    RtlImageNtHeader
+    RtlInitAnsiString
+    RtlInitString
+    RtlInitUnicodeString
+    RtlInitializeBitMap
+    RtlInitializeGenericTable
+    RtlInitializeUnicodePrefix
+    RtlInsertElementGenericTable
+    RtlInsertUnicodePrefix
+    RtlIntegerToChar
+    RtlIntegerToUnicodeString
+    RtlIsNameLegalDOS8Dot3
+    RtlLargeIntegerAdd
+    RtlLargeIntegerArithmeticShift
+    RtlLargeIntegerDivide
+    RtlLargeIntegerNegate
+    RtlLargeIntegerShiftLeft
+    RtlLargeIntegerShiftRight
+    RtlLargeIntegerSubtract
+    RtlLengthSecurityDescriptor
+    RtlLookupAtomInAtomTable
+    RtlLookupElementGenericTable
+    RtlMapGenericMask
+    RtlMoveMemory
+    RtlMultiByteToUnicodeN
+    RtlMultiByteToUnicodeSize
+    RtlNextUnicodePrefix
+    RtlNtStatusToDosError
+    RtlNtStatusToDosErrorNoTeb
+    RtlNumberGenericTableElements
+    RtlNumberOfClearBits
+    RtlNumberOfSetBits
+    RtlOemStringToCountedUnicodeString
+    RtlOemStringToUnicodeSize=RtlxOemStringToUnicodeSize
+    RtlOemStringToUnicodeString
+    RtlOemToUnicodeN
+    RtlPinAtomInAtomTable
+    RtlPrefixString
+    RtlPrefixUnicodeString
+    RtlQueryAtomInAtomTable
+    RtlQueryRegistryValues
+    RtlQueryTimeZoneInformation
+    RtlRaiseException
+    RtlRemoveUnicodePrefix
+    RtlReserveChunk
+    RtlRandom
+    RtlSecondsSince1970ToTime
+    RtlSecondsSince1980ToTime
+    RtlSetAllBits
+    RtlSetBits
+    RtlSetDaclSecurityDescriptor
+    RtlSetSaclSecurityDescriptor
+    RtlSetTimeZoneInformation
+    RtlSplay
+    RtlTimeFieldsToTime
+    RtlTimeToSecondsSince1970
+    RtlTimeToSecondsSince1980
+    RtlTimeToTimeFields
+    RtlUnicodeStringToAnsiSize=RtlxUnicodeStringToAnsiSize
+    RtlUnicodeStringToAnsiString
+    RtlUnicodeToMultiByteN
+    RtlUnicodeToMultiByteSize
+    RtlUnicodeToOemN
+    RtlUnicodeStringToOemSize=RtlxUnicodeStringToOemSize
+    RtlUnicodeStringToOemString
+    RtlUnicodeStringToCountedOemString
+    RtlCustomCPToUnicodeN
+    RtlUnicodeToCustomCPN
+    RtlInitCodePageTable
+    RtlUnicodeStringToInteger
+    RtlUnwind
+    RtlUpcaseUnicodeChar
+    RtlUpcaseUnicodeString
+    RtlUpcaseUnicodeStringToAnsiString
+    RtlUpcaseUnicodeToMultiByteN
+    RtlUpcaseUnicodeToOemN
+    RtlUpcaseUnicodeStringToOemString
+    RtlUpcaseUnicodeStringToCountedOemString
+    RtlUpcaseUnicodeToCustomCPN
+    RtlUpperChar
+    RtlUpperString
+    RtlValidSecurityDescriptor
+    RtlWriteRegistryValue
+    RtlxAnsiStringToUnicodeSize
+    RtlxOemStringToUnicodeSize
+    RtlxUnicodeStringToAnsiSize
+    RtlxUnicodeStringToOemSize
+    RtlZeroHeap
+    RtlZeroMemory
+    SeAccessCheck
+    SeAssignSecurity
+    SeCaptureSecurityDescriptor
+    SeCaptureSubjectContext
+    SeCloseObjectAuditAlarm
+    SeCreateAccessState
+    SeCreateClientSecurity
+    SeDeassignSecurity
+    SeDeleteAccessState
+    SeDeleteObjectAuditAlarm
+    SeImpersonateClient
+    SeLockSubjectContext
+    SeOpenObjectAuditAlarm
+    SeOpenObjectForDeleteAuditAlarm
+    SePrivilegeCheck
+    SePrivilegeObjectAuditAlarm
+    SeQuerySecurityDescriptorInfo
+    SeReleaseSecurityDescriptor
+    SeReleaseSubjectContext
+    SeSetSecurityDescriptorInfo
+    SeSinglePrivilegeCheck
+    SeTokenType
+    SeTokenImpersonationLevel
+    SeUnlockSubjectContext
+    SeAppendPrivileges
+    SeFreePrivileges
+    SeAuditingFileEvents
+    SeAuditingFileOrGlobalEvents
+    SeSetAccessStateGenericMapping
+    SeQueryAuthenticationIdToken
+    SeValidSecurityDescriptor
+    SeRegisterLogonSessionTerminatedRoutine
+    SeUnregisterLogonSessionTerminatedRoutine
+    SeMarkLogonSessionForTerminationNotification
+
+    //
+    // System default DACLs
+    //
+    //          SePublicDefaultDacl - is for protecting things so that
+    //              normal users can use it.
+    //
+    //          SeSystemDefaultDacl - is for protecting things so that
+    //              only the system (and administrators) can get to it.
+    //
+
+    SePublicDefaultDacl CONSTANT
+    SeSystemDefaultDacl CONSTANT
+
+    //
+    // Pointer to structure containing security
+    // exports
+    //
+
+    //
+    // Use SeEnableAccessToExports() before
+    // using (see se.h)
+    //
+
+    SeExports CONSTANT
+
+
+    ZwAccessCheckAndAuditAlarm
+    ZwAlertThread
+    ZwAllocateVirtualMemory
+    ZwConnectPort
+    ZwClearEvent
+    ZwClose
+    ZwCloseObjectAuditAlarm
+    ZwCreateDirectoryObject
+    ZwCreateEvent
+    ZwCreateFile
+    ZwCreateKey
+    ZwCreateSection
+    ZwCreateSymbolicLinkObject
+    ZwDeleteFile
+    ZwDeleteKey
+    ZwDeleteValueKey
+    ZwDeviceIoControlFile
+    ZwDisplayString
+    ZwDuplicateObject
+    ZwDuplicateToken
+    ZwEnumerateKey
+    ZwEnumerateValueKey
+    ZwFlushInstructionCache
+    ZwFlushKey
+    ZwFreeVirtualMemory
+    ZwFsControlFile
+    ZwLoadDriver
+    ZwLoadKey
+    ZwMakeTemporaryObject
+    ZwMapViewOfSection
+    ZwNotifyChangeKey
+    ZwOpenDirectoryObject
+    ZwOpenEvent
+    ZwOpenFile
+    ZwOpenKey
+    ZwOpenProcess
+    ZwOpenProcessToken
+    ZwOpenThread
+    ZwOpenThreadToken
+    ZwOpenSection
+    ZwOpenSymbolicLinkObject
+    ZwPulseEvent
+    ZwQueryDefaultLocale
+    ZwQueryDirectoryFile
+    ZwQueryInformationFile
+    ZwQueryInformationProcess
+    ZwQueryInformationToken
+    ZwQueryKey
+    ZwQueryObject
+    ZwQuerySection
+    ZwQuerySecurityObject
+    ZwQuerySymbolicLinkObject
+    ZwQuerySystemInformation
+    ZwQueryInformationToken
+    ZwQueryVolumeInformationFile
+    ZwQueryValueKey
+    ZwReadFile
+    ZwReplaceKey
+    ZwRequestWaitReplyPort
+    ZwResetEvent
+    ZwSaveKey
+    ZwSetDefaultLocale
+    ZwSetEvent
+    ZwSetInformationFile
+    ZwSetInformationObject
+    ZwSetInformationProcess
+    ZwSetInformationThread
+    ZwSetSystemInformation
+    ZwSetSystemTime
+    ZwSetValueKey
+    ZwTerminateProcess
+    ZwUnmapViewOfSection
+    ZwUnloadDriver
+    ZwUnloadKey
+    ZwWaitForMultipleObjects
+    ZwWaitForSingleObject
+    ZwWriteFile
+    ZwYieldExecution
+
+    RtlAbsoluteToSelfRelativeSD
+    RtlConvertSidToUnicodeString
+    RtlCopySid
+    RtlEqualSid
+    RtlGetDaclSecurityDescriptor
+    RtlGetGroupSecurityDescriptor
+    RtlGetOwnerSecurityDescriptor
+    RtlInitializeSid
+    RtlLengthRequiredSid
+    RtlLengthSid
+    RtlSetGroupSecurityDescriptor
+    RtlSetOwnerSecurityDescriptor
+    RtlSubAuthorityCountSid
+    RtlSubAuthoritySid
+    RtlValidSid
+
+    NtBuildNumber CONSTANT
+
+//
+// ntcrt.lib
+//
+    _itoa
+    _purecall
+    _snprintf
+    _snwprintf
+    _stricmp
+    _strlwr
+    _strnicmp
+    _strnset
+    _strrev
+    _strset
+    _strupr
+    _vsnprintf
+    _wcsicmp
+    _wcslwr
+    _wcsnicmp
+    _wcsnset
+    _wcsrev
+    _wcsupr
+    isdigit
+    islower
+    isprint
+    isspace
+    isupper
+    isxdigit
+    mbstowcs
+    mbtowc
+    memchr
+    qsort
+    rand
+    sprintf
+    srand
+    strcat
+    strchr
+    strcmp
+    strcpy
+    strlen
+    strncat
+    strncmp
+    strncpy
+    strrchr
+    strspn
+    strstr
+    swprintf
+    tolower
+    towlower
+    toupper
+    towupper
+    vsprintf
+    wcscat
+    wcschr
+    wcscmp
+    wcscpy
+    wcscspn
+    wcslen
+    wcsncat
+    wcsncmp
+    wcsncpy
+    wcsrchr
+    wcsspn
+    wcsstr
+    wcstombs
+    wctomb
+
+//
+// Hack-o-rama to support the stupid ATI miniport driver.
+// Get rid of these if we can someday.
+//
+    atol
+    atoi
diff --git a/private/ntos/init/ppcdef.src b/private/ntos/init/ppcdef.src
new file mode 100644
index 000000000..0491e2582
--- /dev/null
+++ b/private/ntos/init/ppcdef.src
@@ -0,0 +1,65 @@
+    ExAcquireFastMutex
+    ExReleaseFastMutex
+    ExTryToAcquireFastMutex
+
+    ExPpcInterlockedDecrementLong
+    ExPpcInterlockedIncrementLong
+    ExPpcInterlockedExchangeUlong
+
+    ExInterlockedCompareExchange64
+    ExInterlockedPopEntrySList
+    ExInterlockedPushEntrySList
+
+    ExAllocateFromPagedLookasideList
+    ExFreeToPagedLookasideList
+
+    InterlockedIncrement
+    InterlockedDecrement
+    InterlockedExchange
+    InterlockedCompareExchange
+    InterlockedExchangeAdd
+
+    KeGetCurrentIrql
+    KeGetCurrentThread
+    KeRaiseIrqlToDpcLevel
+    KfRaiseIrqlToDpcLevel
+
+    KeAcquireSpinLock
+    KeAcquireSpinLockRaiseToDpc
+    KeReleaseSpinLock
+    KeFlushCurrentTb
+    KeFlushIoBuffers
+    KeIsExecutingDpc
+    KePhase0MapIo
+    KePhase0DeleteIoMap
+    KeIpiInterrupt
+
+    KiGetPcr
+
+    KiDeliverApc
+    KiDispatchInterrupt
+    KiGetPcr
+    KiDispatchSoftwareInterrupt
+    KiRequestSoftwareInterrupt
+
+    RtlCaptureContext
+    RtlCopyMemory
+    RtlCopyMemory32
+    RtlEqualMemory
+    RtlLookupFunctionEntry
+    RtlUnwind2
+    RtlVirtualUnwind
+    __C_specific_handler
+    __C_ExecuteExceptionFilter
+    __C_ExecuteTerminationHandler
+    __jump_unwind
+
+    memcmp
+    memcpy
+    memmove
+    memset
+
+    strcat
+    strcmp
+    strcpy
+    strlen
diff --git a/private/ntos/init/up/alpha.prf b/private/ntos/init/up/alpha.prf
new file mode 100644
index 000000000..bf69531f7
--- /dev/null
+++ b/private/ntos/init/up/alpha.prf
@@ -0,0 +1,423 @@
+KiIdleLoop
+KiInterruptException
+OtsMove
+RtlCopyBytes
+KiUnlockDispatcherDatabase
+ExReleaseResourceLite
+KeSynchronizeExecution
+ExAcquireResourceExclusiveLite
+ExAllocatePoolWithTag
+IopParseDevice
+RtlFindClearBits
+ExAcquireFastMutex
+KiSwapThreadExit
+ExpInterlockedPopEntrySListFault
+OtsZero
+IofCompleteRequest
+RtlCompareMemory
+ExReleaseFastMutex
+ExpInterlockedPushEntrySList
+KiRetireDpcList
+KiDispatchInterrupt
+RtlUpcaseUnicodeToOemN
+CcMapData
+ExFreePoolWithTag
+FsRtlDissectName
+FsRtlIsNameInExpressionPrivate
+CcGetVirtualAddress
+ExAcquireResourceSharedLite
+KeFlushIoBuffers
+KeReleaseSpinLock
+KeAcquireSpinLockRaiseToDpc
+CcPinFileData
+ObReferenceObjectByHandle
+OtsFieldInsert
+PsImpersonateClient
+ObfDereferenceObject
+IoGetRelatedDeviceObject
+CcFindBcb
+RtlSplay
+IoAllocateIrp
+ObOpenObjectByName
+KeRemoveQueue
+ExInterlockedAddUlong
+ExpFindCurrentThread
+IofCallDriver
+RtlpGetStackLimits
+ObpLookupObjectName
+ExpInterlockedPopEntrySList
+MmProbeAndLockPages
+CcFreeVirtualAddress
+RtlCompareUnicodeString
+KeInsertQueue
+IoSetTopLevelIrp
+IoFreeIrp
+IopCheckBackupRestorePrivilege
+ObpCaptureObjectCreateInformation
+PsReferencePrimaryToken
+CcFlushCache
+CcUnpinFileData
+KeAcquireSpinLockAtDpcLevel
+KeLeaveCriticalRegion
+CcSetDirtyPinnedData
+FsRtlLookupLargeMcbEntry
+CcCanIWrite
+MmCheckCachedPageState
+CcSetDirtyInMask
+ExReleaseFastMutexUnsafe
+IopAllocateIrp
+CcFastCopyRead
+ObpAllocateObject
+IoAllocateMdl
+ExAcquireFastMutexUnsafe
+ExIsResourceAcquiredExclusiveLite
+FsRtlFindLargeIndex
+IoGetTopLevelIrp
+CcAcquireByteRangeForWrite
+ExpInterlockedCompareExchange64
+KeQuerySystemTime
+KiReleaseSpinLock
+MmUnlockPages
+RtlTimeToTimeFields
+MiFlushSectionInternal
+FsRtlIsFatDbcsLegal
+memcmp
+PsReferenceImpersonationToken
+CcFastCopyWrite
+KiRestoreVolatileIntegerState
+RtlEqualUnicodeString
+CcInitializeCacheMap
+CcUninitializeCacheMap
+CcWriteBehind
+IopCloseFile
+ObpFreeObjectNameBuffer
+SeCreateAccessState
+IoCreateFile
+ObpIncrementHandleCount
+OtsStringCompareEql
+CcMapAndRead
+FsRtlCheckOplock
+IopDeleteFile
+IopParseFile
+RtlIsNameLegalDOS8Dot3
+CcMapAndCopy
+IoBuildPartialMdl
+IoFreeMdl
+MmUnmapViewInSystemCache
+CcPrepareMdlWrite
+RtlMapGenericMask
+RtlNtStatusToDosErrorNoTeb
+FsRtlOplockFsctrl
+IopCompleteRequest
+ObpCaptureObjectName
+RtlCopyUnicodeString
+CcUnpinData
+ExpAcquireResourceSharedLite
+MmCreateSection
+ExAcquireSharedStarveExclusive
+MmMapLockedPages
+ObpAllocateObjectNameBuffer
+ObpCreateHandle
+RtlUpcaseUnicodeChar
+ExAcquireHandleTableShared
+MiDecrementReferenceCount
+MmIsAddressValid
+MmFlushSection
+CcPinMappedData
+FsRtlRequestExclusiveOplock
+ObCreateObject
+RtlUnicodeToOemN
+CcMdlWriteComplete2
+ElapsedDaysToYears
+ExTryToAcquireFastMutex
+IopCheckDeviceAndDriver
+KeWaitForSingleObject
+MiReserveSystemPtes
+RtlUpcaseUnicodeStringToOemString
+KeEnterCriticalRegion
+PsAssignImpersonationToken
+SeReleaseSubjectContext
+CcLazyWriteScan
+ExFreePool
+FsRtlDoesNameContainWildCards
+IoCheckFunctionAccess
+IoIsOperationSynchronous
+KiMb
+NtClose
+PsChargeSharedPoolQuota
+SeAuditingFileEvents
+KiDeliverApc
+MiLocateAndReserveWsle
+SeAssignSecurity
+SeCaptureSubjectContext
+SeDeleteAccessState
+CcMdlRead
+ExCreateHandle
+ExDestroyHandle
+IoFastQueryNetworkAttributes
+MiDecrementShareCount2
+MmSetAddressRangeModified
+ObpDecrementHandleCount
+RtlOemToUnicodeN
+ExReleaseHandleTableShared
+FsRtlAddToTunnelCache
+KiInterruptDistribution
+CcSetFileSizes
+FsRtlGetNextLargeMcbEntry
+KeSetEvent
+MiInsertPageInList
+MiRestoreTransitionPte
+SeSetAccessStateGenericMapping
+CcGetVacbMiss
+ExAcquireHandleTableExclusive
+FsRtlFastCheckLockForRead
+FsRtlFindInTunnelCache
+IoRemoveShareAccess
+MiCheckControlArea
+RtlUpcaseUnicodeString
+IoSetShareAccess
+MiUpdateWsle
+NtSetInformationFile
+ObpChargeQuotaForObject
+OtsStringCompareEqlSameLen
+CcPinRead
+CcWorkerThread
+ExpAcquireSharedStarveExclusive
+ExReleaseHandleTableExclusive
+FsRtlOplockCleanup
+FsRtlOplockIsFastIoPossible
+MmAccessFault
+ObpIncrementHandleDataBase
+OtsFill
+RtlOemStringToUnicodeString
+FsRtlAddLargeMcbEntry
+FsRtlCurrentBatchOplock
+MiCreateDataFileMap
+ObpFreeObject
+ObpRemoveObjectRoutine
+ObpValidateAccessMask
+RtlSetBits
+RtlUpcaseUnicodeStringToCountedOemString
+SeTokenImpersonationLevel
+ExpWorkerThread
+MiLocateWsle
+MiRemoveZeroPage
+MmCopyToCachedPage
+RtlUnicodeStringToOemString
+CcAllocateInitializeBcb
+ExInitializeResourceLite
+ExInterlockedAddLargeStatistic
+ExpInterlockedExchangeAddLargeInteger
+FsRtlIsNameInExpression
+FsRtlPruneTunnelCache
+IoAcquireCancelSpinLock
+MmMapViewInSystemCache
+RtlpDidUnicodeToOemWork
+CcDeleteSharedCacheMap
+ExMapHandleToPointer
+FsRtlPrivateFastUnlockAll
+IoCheckDesiredAccess
+IoSynchronousPageWrite
+KeInsertByKeyDeviceQueue
+KiSaveVolatileIntegerState
+MmUnmapLockedPages
+ObpDeleteNameCheck
+RtlpGenerateInheritedAce
+SepInheritAcl
+ExSystemTimeToLocalTime
+FsRtlMdlWriteCompleteDev
+IoCheckShareAccess
+KeInsertDeviceQueue
+MiDispatchFault
+MiReleaseSystemPtes
+MiRemovePageFromList
+MmPurgeSection
+RtlClearBits
+CcUnmapVacbArray
+ExDeleteResourceLite
+FsRtlFastCheckLockForWrite
+IoAllocateAdapterChannel
+IoStartPacket
+KiMemoryManagementDispatch
+MiCheckProtoPtePageState
+MiMakeSystemAddressValidPfn
+ObpIncrementUnnamedHandleCount
+RtlVirtualUnwind
+CcCopyWrite
+CcDeallocateBcb
+CcFreeActiveVacb
+ExAcquireSharedWaitForExclusive
+ExpWaitForResource
+FsRtlAreNamesEqual
+FsRtlFastUnlockSingleExclusive
+FsRtlOplockBreakToII
+FsRtlPrivateLock
+FsRtlRemoveAndCompleteWaitIrp
+FsRtlRemoveMcbEntryPrivate
+FsRtlWaitOnIrp
+KeRemoveByKeyDeviceQueue
+KiMemoryManagementException
+MiFreePoolPages
+MiInitializePfn
+MiRemoveWsle
+ObpCreateUnnamedHandle
+RtlDelete
+RtlExtendedMagicDivide
+RtlFillMemoryUlong
+RtlpLengthInheritedAce
+RtlSecondsSince1980ToTime
+CcMdlReadComplete2
+ExAllocatePoolWithQuotaTag
+ExInterlockedInsertTailList
+ExReinitializeResourceLite
+FsRtlAllocateOplock
+IoCreateStreamFileObject
+IoGetCurrentProcess
+IoStartNextPacket
+KeInitializeApc
+KeInsertHeadQueue
+MiAllocatePoolPages
+MiCheckForControlAreaDeletion
+MiGetInPageSupportBlock
+MiRemovePageByColor
+MiResolveProtoPteFault
+MiUnlinkPageFromList
+MmCanFileBeTruncatedInternal
+RtlLengthSecurityDescriptor
+RtlNumberGenericTableElements
+RtlpGenerateInheritAcl
+SepCheckAcl
+CcCreateVacbArray
+CcGetDirtyPages
+CcGetVirtualAddressIfMapped
+CcPerformReadAhead
+CcReleaseByteRangeFromWrite
+CcUnmapAndPurge
+FsRtlCheckLockForReadAccess
+FsRtlFastUnlockSingle
+FsRtlInitializeLargeMcb
+FsRtlLookupLastLargeMcbEntry
+IopDereferenceVpbAndFree
+KeInitializeSpinLock
+KeInsertQueueApc
+KiActivateWaiterQueue
+KiApcInterrupt
+MiGetEventCounter
+MiRemoveAnyPage
+MiResolveMappedFileFault
+OtsDivide
+PsReturnSharedPoolQuota
+RtlAreBitsClear
+RtlFillBytes
+RtlInsertElementGenericTable
+RtlLookupFunctionEntry
+CcCopyRead
+CcIsThereDirtyData
+CcPreparePinWrite
+CcSetReadAheadGranularity
+CcSetValidData
+ExIsResourceAcquiredSharedLite
+ExpAcquireResourceExclusiveLite
+ExReleaseResourceForThreadLite
+FsRtlFindFirstOverlappingExclusiveNode
+FsRtlTruncateLargeMcb
+FsRtlUninitializeOplock
+KeInitializeEvent
+KeRemoveDeviceQueue
+KeSetEventBoostPriority
+KiAlternateExit
+KiGenerateTrapFrame
+KiSaveVolatileFloatState
+MiFindActualFaultingPte
+MiFreeInPageSupportBlock
+MiModifiedPageWriterWorker
+MiResolveTransitionFault
+MiSectionDelete
+MiSetDirtyBit
+MmDeterminePoolType
+ObDeleteCapturedInsertInfo
+RtlAreBitsSet
+RtlConvertUlongToLargeInteger
+RtlCreateAcl
+RtlEqualPrefixSid
+RtlFindClearBitsAndSet
+RtlTimeToSecondsSince1970
+SepGetDefaultsSubjectContext
+SeUnlockSubjectContext
+SeValidSecurityDescriptor
+ExDisableResourceBoostLite
+FsRtlAcquireFileForCcFlush
+FsRtlAddLargeEntry
+FsRtlPrivateCheckForExclusiveLockAccess
+FsRtlPrivateInitializeFileLock
+FsRtlPrivateLimitFreeLockList
+FsRtlPrivateResetLowestLockOffset
+FsRtlUninitializeLargeMcb
+IoPageRead
+IoQueueThreadIrp
+KiExceptionExit
+MiCompleteProtoPteFault
+MmCanFileBeTruncated
+NtDeleteFile
+ObInsertObject
+RtlInitializeBitMap
+RtlpLengthInheritAcl
+RtlpRestoreContext
+RtlSecondsSince1970ToTime
+RtlUnicodeStringToCountedOemString
+SepAccessCheck
+SepSidInToken
+CcPostWorkQueue
+CcScheduleReadAhead
+CcUnpinDataForThread
+ExQueueWorkItem
+FsRtlAcknowledgeOplockBreak
+FsRtlCheckLockForWriteAccess
+FsRtlInitializeOplock
+FsRtlMdlReadCompleteDev
+FsRtlNotifyCompletion
+FsRtlNumberOfRunsInLargeMcb
+FsRtlOplockBreakNotify
+FsRtlPrivateInsertLock
+FsRtlUninitializeFileLock
+IoGetFileObjectGenericMapping
+IoGetInitialStack
+IoGetRequestorProcess
+IopErrorLogRequeueEntry
+IopSynchronousServiceTail
+IopTimerDispatch
+IoUpdateShareAccess
+KeClearEvent
+KeGetCurrentIrql
+KiFlushMultipleTb
+KiRestoreVolatileFloatState
+KiSystemServiceExit
+KiTimerExpiration
+MiAccessCheck
+MiAddValidPageToWorkingSet
+MiCheckControlAreaStatus
+MiDeleteSystemPagableVm
+MiFlushInPageSupportBlock
+MiFreeEventCounter
+MiInitializeReadInProgressPfn
+MiMakeProtectionMask
+MiMapPageInHyperSpace
+MiReleasePageFileSpace
+MiReleaseWsle
+MiWaitForInPageComplete
+MmBuildMdlForNonPagedPool
+MmFlushImageSection
+NtQueryVolumeInformationFile
+OtsDivide32Unsigned
+RtlCreateSecurityDescriptor
+RtlFirstFreeAce
+RtlImageDirectoryEntryToData
+RtlInitializeSid
+RtlLookupElementGenericTable
+RtlNumberOfClearBits
+RtlPcToFileHeader
+RtlRealSuccessor
+RtlSubtreePredecessor
+SeLockSubjectContext
+wcsicmp
+
\ No newline at end of file
diff --git a/private/ntos/init/up/i386.prf b/private/ntos/init/up/i386.prf
new file mode 100644
index 000000000..dc01569d7
--- /dev/null
+++ b/private/ntos/init/up/i386.prf
@@ -0,0 +1,542 @@
+MiZeroPhysicalPage
+ExReleaseResourceLite
+MmZeroPageThread
+IopParseDevice
+ExAllocatePoolWithTag
+ExInterlockedPopEntrySList
+ExFreePoolWithTag
+CcMapData
+RtlFindClearBits
+memmove
+CcFindBcb
+IoAllocateIrp
+FsRtlDissectName
+KiInterruptDispatch
+CcFastCopyRead
+FsRtlIsNameInExpressionPrivate
+RtlCompareMemory
+MmCopyToCachedPage
+RtlUpcaseUnicodeToOemN
+CcPinFileData
+ObpCaptureObjectCreateInformation
+CcGetVirtualAddress
+KiDispatchInterrupt
+RtlCompareUnicodeString
+Exfi386InterlockedDecrementLong
+ExpAcquireResourceExclusiveLite
+IofCompleteRequest
+CcFastCopyWrite
+MiFlushSectionInternal
+RtlTimeToTimeFields
+PsImpersonateClient
+RtlSplay
+IopAllocateIrp
+ObOpenObjectByName
+Exfi386InterlockedExchangeUlong
+ExAcquireSharedWaitForExclusive
+ObReferenceObjectByHandle
+ExAcquireResourceSharedLite
+ExInterlockedPushEntrySList
+CcMapAndRead
+FsRtlLookupLargeMcbEntry
+InterlockedDecrement
+SeCreateAccessState
+ObpLookupObjectName
+FsRtlIsFatDbcsLegal
+ExfInterlockedAddUlong
+MmProbeAndLockPages
+CcUnpinFileData
+ObpCaptureObjectName
+ExAcquireHandleTableShared
+IoCreateFile
+ObfDereferenceObject
+InterlockedIncrement
+CcSetDirtyPinnedData
+KeLeaveCriticalRegion
+ExFreePool
+CcUnpinData
+IoFreeIrp
+MmCheckCachedPageState
+RtlEqualUnicodeString
+RtlIsNameLegalDOS8Dot3
+MiCleanSection
+CcInitializeCacheMap
+FsRtlFindLargeIndex
+CcMapAndCopy
+CcPinMappedData
+MiRemovePageByColor
+MmUnmapViewInSystemCache
+RtlpCaptureContext
+RtlFillMemoryUlong
+ObpAllocateObject
+RtlCopyUnicodeString
+CcFreeVirtualAddress
+ExAcquireFastMutexUnsafe
+IopDeleteFile
+FsRtlAllocateResource
+KiSetCR0Bits
+ExInterlockedCompareExchange64
+ExAllocatePool
+IoGetRelatedDeviceObject
+KeRemoveQueue
+ExReleaseHandleTableShared
+CcAcquireByteRangeForWrite
+IofCallDriver
+FsRtlCheckOplock
+ElapsedDaysToYears
+IopCloseFile
+KefAcquireSpinLockAtDpcLevel
+ObpIncrementHandleCount
+ExTryToAcquireResourceExclusiveLite
+FsRtlAddToTunnelCache
+IopCompleteRequest
+CcFlushCache
+CcGetVirtualAddressIfMapped
+IoSetThreadHardErrorMode
+ObCreateObject
+IoFastQueryNetworkAttributes
+CcPrepareMdlWrite
+CcCanIWrite
+CcWriteBehind
+RtlExtendedMagicDivide
+MiLocateAndReserveWsle
+NtSetInformationFile
+ObpAllocateObjectNameBuffer
+CcLazyWriteScan
+RtlNtStatusToDosErrorNoTeb
+KeReadStateQueue
+MiCheckProtoPtePageState
+ObReferenceObjectByPointer
+CcAllocateInitializeBcb
+PsReferencePrimaryToken
+CcSetDirtyInMask
+FsRtlFindInTunnelCache
+IopParseFile
+KeSynchronizeExecution
+_NLG_Return2
+KeQuerySystemTime
+CcGetVacbMiss
+NtClose
+ObpDecrementHandleCount
+IoGetInitialStack
+ObpCreateHandle
+MiInsertPageInList
+MiWaitForInPageComplete
+FsRtlGetNextLargeMcbEntry
+IopCheckDeviceAndDriver
+KeInsertHeadQueue
+MiDecrementShareCount2
+RtlUpcaseUnicodeStringToOemString
+ExAcquireSharedStarveExclusive
+ExpFindCurrentThread
+_abnormal_termination
+CcMdlRead
+CcUninitializeCacheMap
+RtlUnicodeToOemN
+FsRtlOplockFsctrl
+IoAllocateMdl
+ExReleaseHandleTableExclusive
+MmSetAddressRangeModified
+CcSetFileSizes
+ExCreateHandle
+KeEnterCriticalRegion
+MiDecrementReferenceCount
+MmUnlockPages
+ObpFreeObject
+PsAssignImpersonationToken
+RtlMapGenericMask
+CcCopyRead
+PsReferenceImpersonationToken
+IoGetRequestorProcess
+SeTokenType
+ObpFreeObjectNameBuffer
+RtlUpcaseUnicodeString
+IopCheckBackupRestorePrivilege
+MmMapViewInSystemCache
+RtlCompressChunks
+RtlInsertElementGenericTable
+CcPinRead
+IoBuildSynchronousFsdRequest
+MmFlushSection
+IoAllocateErrorLogEntry
+MiAllocatePoolPages
+RtlUpcaseUnicodeChar
+MmPurgeSection
+FsRtlFastCheckLockForRead
+MiReserveSystemPtes
+PsOpenTokenOfProcess
+FsRtlOplockCleanup
+IoIsOperationSynchronous
+MiFreePoolPages
+SeAssignSecurity
+SeDeleteAccessState
+FsRtlRequestExclusiveOplock
+IoBuildPartialMdl
+IoCheckFunctionAccess
+PsChargeSharedPoolQuota
+RtlAreAnyAccessesGranted
+FsRtlUninitializeOplock
+IoEnqueueIrp
+MmCreateSection
+ObpDeleteNameCheck
+IoCancelIrp
+RtlpDidUnicodeToOemWork
+CcFreeActiveVacb
+ExAllocateFromPagedLookasideList
+ExIsResourceAcquiredExclusiveLite
+SeCaptureSubjectContext
+DebugService
+KeGetCurrentThread
+MiCreateDataFileMap
+RtlpGetStackLimits
+CcMdlWriteComplete2
+IoSetShareAccess
+KeResetEvent
+MiLocateWsle
+MiUnlinkPageFromList
+ObpRemoveObjectRoutine
+ObWaitForSingleObject
+CcPreparePinWrite
+PspDeleteThreadSecurity
+SeComputeQuotaInformationSize
+ExDestroyHandle
+FsRtlDoesNameContainWildCards
+MiRemoveMappedPtes
+MiUpdateWsle
+RawCheckForDismount
+RtlOemToUnicodeN
+SeUnlockSubjectContext
+CcWorkerThread
+ExInitializeResourceLite
+ExpAcquireResourceSharedLite
+ExpWaitForResource
+FsRtlIsNameInExpression
+FsRtlOplockBreakToII
+FsRtlPruneTunnelCache
+MiDispatchFault
+IoFreeMdl
+IoInitializeIrp
+KefReleaseSpinLockFromDpcLevel
+KeInsertQueue
+KeWaitForSingleObject
+MiCheckControlArea
+ObpIncrementUnnamedHandleCount
+RtlDowncaseUnicodeString
+RtlUnicodeStringToOemString
+SepFilterPrivilegeAudits
+ExAcquireHandleTableExclusive
+FsRtlAreNamesEqual
+IopDereferenceVpbAndFree
+KeInitializeDpc
+ObpLookupDirectoryEntry
+CcDeallocateBcb
+ExMapHandleToPointer
+FsRtlRemoveMcbEntryPrivate
+IopQueryName
+IoSetTopLevelIrp
+CcCopyReadExceptionFilter
+ExGetSharedWaiterCount
+ExInterlockedAddLargeInteger
+ExpWorkerThread
+ExReinitializeResourceLite
+FsRtlFastCheckLockForWrite
+FsRtlFastUnlockSingleExclusive
+MmAccessFault
+MmMapLockedPages
+RtlOemStringToUnicodeString
+RtlTimeToSecondsSince1970
+RtlUpcaseUnicodeStringToCountedOemString
+FsRtlRemoveLargeMcbEntry
+IoGetTopLevelIrp
+KeInsertDeviceQueue
+MiRemoveZeroPage
+RtlDelete
+SeTokenImpersonationLevel
+CcGetDirtyPages
+ExDeletePagedLookasideList
+FsRtlAddLargeMcbEntry
+FsRtlFindFirstOverlappingExclusiveNode
+IopErrorLogRequeueEntry
+MiReleaseSystemPtes
+ObpChargeQuotaForObject
+RtlpLengthInheritedAce
+SeSetAccessStateGenericMapping
+CcPerformReadAhead
+FsRtlRemoveAndCompleteWaitIrp
+IoAcquireCancelSpinLock
+IoBuildDeviceIoControlRequest
+IoCheckShareAccess
+IoSynchronousPageWrite
+MiInitializeReadInProgressPfn
+RtlUnicodeStringToCountedOemString
+CcDeleteSharedCacheMap
+ExSystemTimeToLocalTime
+FsRtlAllocateOplock
+FsRtlDeregisterUncProvider
+FsRtlTruncateLargeMcb
+FsRtlWaitOnIrp
+IopCheckVpbMounted
+KeInsertQueueDpc
+KiSwapThread
+MiInitializePfn
+MmIsAddressValid
+ObGetObjectPointerCount
+RtlPrefixUnicodeString
+VdmpDelayIntApcRoutine
+ExFreeToPagedLookasideList
+ExpAcquireSharedStarveExclusive
+FsRtlOplockIsFastIoPossible
+MiReleaseWsle
+MiRemoveUnusedSegments
+MiReserveSystemPtes2
+ObSetSecurityDescriptorInfo
+_allmul
+ExAllocatePoolWithQuotaTag
+FsRtlAcquireFileForCcFlush
+IoStartPacket
+KeInitializeEvent
+KeWaitForMultipleObjects
+MiInitializeCopyOnWritePfn
+MiRemovePageFromList
+MiSegmentDelete
+MmBuildMdlForNonPagedPool
+MmUnmapLockedPages
+SeAuditingFileEvents
+SwapSplayLinks
+FsRtlLookupLastLargeMcbEntry
+IopIsDeviceInstanceEnabled
+KeInitializeSpinLock
+KiAcquireSpinLock
+MiRemoveAnyPage
+MiRemoveWsleFromFreeList
+MiResolveProtoPteFault
+NtWaitForSingleObject
+ObpInsertHandleCount
+RtlpGetExtraStuffPointer
+RtlSetBits
+SeReleaseSubjectContext
+SeValidSecurityDescriptor
+DaysAndFractionToTime
+ExInterlockedExchangeAddLargeInteger
+FsRtlCurrentBatchOplock
+FsRtlPrivateLock
+IoCreateStreamFileObject
+IopReportResourceUsage
+KiDeliverApc
+LpcpClosePort
+MiAccessCheck
+MiMakeProtectionMask
+MiResolveMappedFileFault
+ObInsertObject
+ObpIncrementHandleDataBase
+ObpValidateAccessMask
+PsReturnSharedPoolQuota
+PsWatchWorkingSet
+RtlDeleteElementGenericTable
+CcReleaseByteRangeFromWrite
+ExCreateHandleTable
+FsRtlPrivateFastUnlockAll
+IoCheckDesiredAccess
+IoCreateDevice
+MiCompleteProtoPteFault
+MiMakeSystemAddressValidPfnWs
+MiMapPageInHyperSpace
+ObpCreateUnnamedHandle
+RtlExtendedLargeIntegerDivide
+RtlSubtreePredecessor
+SepAccessCheck
+CcCopyWrite
+CcUnmapVacbArray
+CcUnpinDataForThread
+ExNotifyCallback
+ExReleaseResourceForThreadLite
+FsRtlAcknowledgeOplockBreak
+FsRtlAddLargeEntry
+FsRtlInitializeLargeMcb
+FsRtlMdlWriteCompleteDev
+FsRtlPrivateCheckForExclusiveLockAccess
+IoAllocateAdapterChannel
+IoGetAttachedDevice
+IoRaiseInformationalHardError
+IoRemoveShareAccess
+MiCheckControlAreaStatus
+MiMakeSystemAddressValidPfn
+MiRemoveWsle
+ObDeleteCapturedInsertInfo
+ObReferenceObjectByName
+RtlClearBits
+RtlpGenerateInheritedAce
+RtlxOemStringToUnicodeSize
+SepCheckAcl
+CcPostWorkQueue
+CcScheduleReadAhead
+CcSetValidData
+ExEnumHandleTable
+ExQueueWorkItem
+FsRtlReleaseFileForCcFlush
+KeSetEvent
+MiChargeCommitmentCantExpand
+MiFindActualFaultingPte
+MiGetEventCounter
+NtDeleteFile
+RtlAreBitsClear
+RtlDeleteNoSplay
+RtlInitializeSid
+RtlLookupElementGenericTable
+RtlpGenerateInheritAcl
+CcMdlWriteComplete
+ExAcquireResourceExclusiveLite
+ExDeleteResourceLite
+ExfInterlockedInsertTailList
+ExIsResourceAcquiredSharedLite
+FsRtlOplockBreakNotify
+IoCheckEaBufferValidity
+IopOpenLinkOrRenameTarget
+IoQueueThreadIrp
+IoRegisterShutdownNotification
+Ke386GetGdtEntryThread
+KeReadStateTimer
+KeRemoveDeviceQueue
+KiRetireDpcList
+MiDeletePte
+MiEnsureAvailablePageOrWait
+MiGetInPageSupportBlock
+MiSectionDelete
+RtlLengthSecurityDescriptor
+RtlRealSuccessor
+RtlUpcaseUnicodeStringToAnsiString
+SepAdtGenerateDiscardAudit
+SepInheritAcl
+SepSidInToken
+CcCreateVacbArray
+CcMdlReadComplete2
+ExInterlockedAddLargeStatistic
+FsRtlCheckForMatchingFileObject
+FsRtlCheckLockForWriteAccess
+FsRtlPrivateInsertLock
+FsRtlPrivateLimitFreeLockList
+FsRtlPrivateResetLowestLockOffset
+IoCancelThreadIo
+IoPageRead
+IoReleaseCancelSpinLock
+IoSetInformation
+IoStartNextPacket
+IoStopTimer
+KeClearEvent
+KeInitializeApc
+KeInsertByKeyDeviceQueue
+KeRemoveByKeyDeviceQueue
+KiQuantumEnd
+MiAddValidPageToWorkingSet
+MiDeleteSystemPagableVm
+MiInsertFrontModifiedNoWrite
+MiLocateSubsection
+MiRemoveWorkingSetPages
+MiRestoreTransitionPte
+MiTrimWorkingSet
+RtlAreBitsSet
+RtlConvertUlongToLargeInteger
+RtlCopyLuidAndAttributesArray
+RtlCreateAcl
+RtlLargeIntegerDivide
+RtlpLengthInheritAcl
+SeAccessCheck
+_wcsicmp
+CcExtendVacbArray
+CcSetReadAheadGranularity
+CcUnmapVacb
+ExfInterlockedInsertHeadList
+FsRtlCheckLockForReadAccess
+FsRtlFreeFirstMapping
+FsRtlMdlReadComplete
+FsRtlNumberOfRunsInLargeMcb
+FsRtlOpBatchBreakClosePending
+FsRtlPrivateCheckWaitingLocks
+FsRtlPrivateInitializeFileLock
+FsRtlPrivateInsertExclusiveLock
+FsRtlReleaseFileForModWrite
+FsRtlRemoveAndCompleteIrp
+FsRtlUninitializeFileLock
+IoCreateNotificationEvent
+IoGetDeviceToVerify
+IopMountVolume
+IoUpdateShareAccess
+KeReleaseWaitForSemaphore
+KiTrap0E
+MiCheckForControlAreaDeletion
+MiDetermineUserGlobalPteMask
+MiFlushInPageSupportBlock
+MiFreeEventCounter
+MiInitializeTransitionPfn
+MiInsertWsle
+MiMapPageToZeroInHyperSpace
+MiModifiedPageWriterWorker
+MiResolveDemandZeroFault
+MiResolveTransitionFault
+MmCanFileBeTruncated
+MmCanFileBeTruncatedInternal
+MmDeterminePoolType
+MmFlushImageSection
+RtlAllocateAndInitializeSid
+RtlEnumerateGenericTable
+RtlEqualPrefixSid
+RtlEqualSid
+RtlExtendedIntegerMultiply
+RtlFirstFreeAce
+RtlIsGenericTableEmpty
+RtlOemStringToCountedUnicodeString
+RtlUpperString
+SeFreeCapturedSecurityQos
+SeLockSubjectContext
+_vsnprintf
+CcGetLsnForFileObject
+CcPurgeAndClearCacheSection
+CcZeroData
+ExecuteHandler
+ExLocalTimeToSystemTime
+ExRaiseException
+ExReleaseFastMutexUnsafe
+FsRtlCancelExclusiveIrp
+FsRtlFastUnlockAll
+FsRtlFastUnlockAllByKey
+FsRtlFastUnlockSingleShared
+FsRtlFindFirstOverlappingSharedNode
+FsRtlGetNextMcbEntry
+FsRtlPrivateInsertSharedLock
+FsRtlPrivateRemoveLock
+FsRtlRequestOplockII
+FsRtlSyncVolumes
+FsRtlUninitializeLargeMcb
+IopTimerDispatch
+IoUnregisterFsRegistrationChange
+KeContextToKframes
+KeFlushQueueApc
+KeSetEventBoostPriority
+KiReleaseSpinLock
+KiSystemService
+KiTimerExpiration
+KiTimerListExpire
+MiAddMappedPtes
+MiCheckPdeForPagedPool
+MiFlushPteList
+MiFreeInPageSupportBlock
+MiInitializePfnForOtherProcess
+MiInsertVad
+MiMakeOutswappedPageResident
+MiReleasePageFileSpace
+MiResolvePageFileFault
+MmWorkingSetManager
+PsReturnPoolQuota
+RtlAddAuditAccessAce
+RtlDispatchException
+RtlInitializeGenericTable
+RtlNumberOfClearBits
+RtlpGetReturnAddress
+RtlSecondsSince1970ToTime
+RtlSetAllBits
+RtlValidSecurityDescriptor
+SepApplyAclToObject
+SepConcatenatePrivileges
+SepGetDefaultsSubjectContext
+
+
\ No newline at end of file
diff --git a/private/ntos/init/up/makefile b/private/ntos/init/up/makefile
new file mode 100644
index 000000000..6ee4f43fa
--- /dev/null
+++ b/private/ntos/init/up/makefile
@@ -0,0 +1,6 @@
+#
+# DO NOT EDIT THIS FILE!!!  Edit .\sources. if you want to add a new source
+# file to this component.  This file merely indirects to the real make file
+# that is shared by all the components of NT OS/2
+#
+!INCLUDE $(NTMAKEENV)\makefile.def
diff --git a/private/ntos/init/up/makefile.inc b/private/ntos/init/up/makefile.inc
new file mode 100644
index 000000000..d043c64d4
--- /dev/null
+++ b/private/ntos/init/up/makefile.inc
@@ -0,0 +1,78 @@
+!if exist($(TARGET_DIRECTORY).inc)
+!include $(TARGET_DIRECTORY).inc
+!endif
+
+obj\$(TARGET_DIRECTORY)\$(NTTEST).def: ..\ntoskrnl.src ..\$(TARGET_DIRECTORY)def.src
+    copy ..\ntoskrnl.src+..\$(TARGET_DIRECTORY)def.src obj\$(TARGET_DIRECTORY)\$(NTTEST).pp
+    $(TARGET_CPP) -nologo -EP $(TARGET_DEFINES) $(TARGET_DBG_DEFINES) $(C_DEFINES) obj\$(TARGET_DIRECTORY)\$(NTTEST).pp > obj\$(TARGET_DIRECTORY)\$(NTTEST).def
+    -del obj\$(TARGET_DIRECTORY)\$(NTTEST).pp
+
+$(NTTEST).prf: $(TARGET_DIRECTORY).prf
+    copy $** $@
+
+$(BASEDIR)\public\sdk\lib\$(TARGET_DIRECTORY)\$(NTTEST).lib $(BASEDIR)\public\sdk\lib\$(TARGET_DIRECTORY)\$(NTTEST).exp: obj\$(TARGET_DIRECTORY)\$(NTTEST).def \
+        $(NTTEST).prf \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\cache.lib  \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\config.lib \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\dbgk.lib   \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\ex.lib     \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\FsRtl.lib  \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\FStub.lib  \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\init.lib   \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\io.lib     \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\kd.lib     \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\ke.lib     \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\lpc.lib    \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\mm.lib     \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\ob.lib     \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\po.lib     \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\ps.lib     \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\raw.lib    \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\ntosrtl.lib\
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\se.lib     \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\vdm.lib    \
+        $(TARGETPATH)\$(TARGET_DIRECTORY)\pnp.lib
+    -lib @<<
+$(LINK_LIB_IGNORE_FLAG)
+-def:obj\$(TARGET_DIRECTORY)\$(NTTEST).def
+-debugtype:cv
+-out:$(@D)\$(NTTEST).tmp
+-machine:$(TARGET_DIRECTORY)
+!IF $(386)
+$(TARGETPATH)\$(TARGET_DIRECTORY)\cache.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\config.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\dbgk.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\ex.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\FsRtl.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\FStub.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\init.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\io.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\kd.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\ke.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\lpc.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\mm.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\ob.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\po.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\ps.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\raw.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\ntosrtl.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\se.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\vdm.lib
+$(TARGETPATH)\$(TARGET_DIRECTORY)\pnp.lib
+$(BASEDIR)\public\sdk\lib\$(TARGET_DIRECTORY)\lsakrnlp.lib
+$(BASEDIR)\public\sdk\lib\$(TARGET_DIRECTORY)\libcntpr.lib
+!ENDIF
+<<NOKEEP
+    -lib -out:$(@R).lib @<<
+-machine:$(TARGET_DIRECTORY)
+$(LINK_LIB_IGNORE_FLAG)
+!if exist($(BASEDIR)\public\sdk\lib\$(TARGET_DIRECTORY)\exsup.lib)
+$(BASEDIR)\public\sdk\lib\$(TARGET_DIRECTORY)\exsup.lib
+!endif
+$(@D)\$(NTTEST).tmp
+<<NOKEEP
+    -erase $(@D)\$(NTTEST).tmp
+
+..\init.c: $(BASEDIR)\public\sdk\inc\ntverp.h
+
+..\ntoskrnl.rc: ..\msg00001.bin
diff --git a/private/ntos/init/up/mips.prf b/private/ntos/init/up/mips.prf
new file mode 100644
index 000000000..bf3422ed0
--- /dev/null
+++ b/private/ntos/init/up/mips.prf
@@ -0,0 +1,2638 @@
+KiRaiseIrqlToXxxLevel
+CcPinFileData
+CcPinRead
+CcFreeVirtualAddress
+CcFastCopyRead
+CcPinMappedData
+CcMdlRead
+CcPrepareMdlWrite
+CcMapAndCopy
+CcFreeActiveVacb
+ObfDereferenceObject
+PsAssignImpersonationToken
+NtClose
+MmCheckCachedPageState
+MmProbeAndLockPages
+MiFlushSectionInternal
+CcSetDirtyPinnedData
+CcPreparePinWrite
+CcReleaseByteRangeFromWrite
+CmpInitializeMachineDependentConfiguration
+_amsg_exit
+_isctype
+__C_ExecuteTerminationHandler
+__C_ExecuteExceptionFilter
+PspDeleteLdt
+PsIsThreadTerminating
+PoSetDeviceIdleDetection
+PoQueryPowerSequence
+RtlNumberGenericTableElements
+RtlCaptureStackBackTrace
+RtlAssert
+RtlpDestroyLockAtomTable
+MmIsThisAnNtAsSystem
+MmQuerySystemSize
+KiSuspendNop
+KeSwitchFrozenProcessor
+KiFreezeTargetExecution
+ZwYieldExecution
+ZwWriteVirtualMemory
+ZwWriteFile
+ZwWaitForSingleObject
+ZwWaitForMultipleObjects
+ZwUnmapViewOfSection
+ZwUnloadKey
+ZwUnloadDriver
+ZwTerminateProcess
+ZwShutdownSystem
+ZwSetValueKey
+ZwSetTimerResolution
+ZwSetSystemTime
+ZwSetSystemInformation
+ZwSetSecurityObject
+ZwSetInformationThread
+ZwSetInformationProcess
+ZwSetInformationObject
+ZwSetInformationFile
+ZwSetEvent
+ZwSetDefaultLocale
+ZwSaveKey
+ZwResumeThread
+ZwRestoreKey
+ZwResetEvent
+ZwRequestWaitReplyPort
+ZwReplyWaitReceivePort
+ZwReplaceKey
+ZwReleaseSemaphore
+ZwReadFile
+ZwRaiseHardError
+CcUnpinFileData
+CcGetDirtyPages
+KeWaitForSingleObject
+CcCanIWrite
+ExAcquireFastMutexUnsafe
+ExAcquireHandleTableShared
+ExAcquireHandleTableExclusive
+KdPollBreakIn
+KeInsertQueue
+IopCompleteRequest
+ExQueueWorkItem
+KiSwapThread
+CcFlushCache
+IopDeleteFile
+CcInitializeCacheMap
+CcSetDirtyInMask
+MiFreePoolPages
+MiReleaseSystemPtes
+MmUnmapLockedPages
+MmUnmapViewInSystemCache
+ZwRaiseException
+ZwQueryVolumeInformationFile
+ZwQueryVirtualMemory
+ZwQueryValueKey
+ZwQuerySystemInformation
+ZwQuerySymbolicLinkObject
+ZwQuerySecurityObject
+ZwQuerySection
+ZwQueryObject
+ZwQueryKey
+ZwQueryInformationToken
+ZwQueryInformationProcess
+ZwQueryInformationFile
+ZwQueryDirectoryFile
+ZwQueryDefaultLocale
+ZwQueryAttributesFile
+ZwPulseEvent
+ZwProtectVirtualMemory
+ZwOpenThreadToken
+ZwOpenThread
+ZwOpenSymbolicLinkObject
+ZwOpenSection
+ZwOpenProcessToken
+ZwOpenProcess
+ZwOpenKey
+ZwOpenFile
+ZwOpenEvent
+ZwOpenDirectoryObject
+ZwNotifyChangeKey
+ZwMapViewOfSection
+ZwMakeTemporaryObject
+ZwLoadKey
+ZwLoadDriver
+ZwListenPort
+ZwInitializeRegistry
+ZwFsControlFile
+ZwFreeVirtualMemory
+ZwFlushKey
+ZwFlushInstructionCache
+ZwFlushBuffersFile
+ZwEnumerateValueKey
+ZwEnumerateKey
+ZwDuplicateToken
+ZwDuplicateObject
+ZwDisplayString
+ZwDeviceIoControlFile
+ZwDeleteValueKey
+ZwDeleteKey
+ZwDeleteFile
+ZwCreateThread
+ZwCreateSymbolicLinkObject
+ZwCreateSection
+ZwCreateProcess
+ZwCreatePort
+ZwCreateKey
+ZwCreateFile
+ZwCreateEvent
+ZwCreateDirectoryObject
+ZwContinue
+ZwConnectPort
+ZwCompleteConnectPort
+ZwCloseObjectAuditAlarm
+ZwClose
+ZwClearEvent
+ZwAllocateVirtualMemory
+ZwAlertThread
+ZwAccessCheckAndAuditAlarm
+ZwAcceptConnectPort
+KiUnexpectedInterrupt
+KeReadStateThread
+KeReadStateSemaphore
+KeReadStateMutant
+KeSetImportanceDpc
+KeReadStateEvent
+KeReadStateProcess
+KeSetDmaIoCoherency
+KeQueryTimeIncrement
+KiReleaseSpinLock
+KeInitializeSpinLock
+KeFlushCurrentTb
+KiSystemStartup
+KdpGetStateChange
+KdpSetLoadState
+KdpPortUnlock
+IoGetFileObjectGenericMapping
+IoSetDeviceToVerify
+IoThreadToProcess
+xHalReferenceHandler
+xHalHandlerForBus
+ExPostSystemEvent
+ExpDummyAllocate
+ExNotifyCallback
+ExUnregisterCallback
+ExRegisterCallback
+ExGetSharedWaiterCount
+ExGetExclusiveWaiterCount
+FsRtlSyncVolumes
+IoGetConfigurationInformation
+KeSetSwapContextNotifyRoutine
+KeSetThreadSelectNotifyRoutine
+KeSetTimeUpdateNotifyRoutine
+RtlSubAuthorityCountSid
+RtlGetNtGlobalFlags
+ObGetObjectPointerCount
+SeTokenType
+SeTokenImpersonationLevel
+srand
+__jump_unwind
+PspDeleteVdmObjects
+NtSetLdtEntries
+PspQueryDescriptorThread
+PspSetLdtInformation
+PspQueryLdtInformation
+PspMarkCidInvalid
+PsGetCurrentThreadId
+PsGetCurrentProcessId
+PspInitializeThreadSecurity
+PoRequestPowerChange
+RtlInitializeAtomPackage
+DebugUnLoadImageSymbols
+DebugLoadImageSymbols
+DbgBreakPointWithStatus
+DbgBreakPoint
+NtSendWaitReplyChannel
+NtReplyWaitSendChannel
+KeSetSynchIrql
+KiTryToAcquireSpinLock
+KiFlushFixedTb
+IoGetInitialStack
+IoSetTopLevelIrp
+CcGetFileObjectFromBcb
+ExpGetPoolInformation
+ExCreateCallback
+FsRtlInitializeOplock
+xHalQuerySystemInformation
+xHalSetSystemInformation
+xHalQueryBusSlots
+xHalRegisterBusHandler
+NtCreateChannel
+NtListenChannel
+NtOpenChannel
+NtSetContextChannel
+RtlAreAnyAccessesGranted
+RtlLengthRequiredSid
+CcAcquireByteRangeForWrite
+KeSetEvent
+MmUnlockPages
+CcMdlWriteComplete2
+CcSetFileSizes
+MmMapLockedPages
+MmSetAddressRangeModified
+IoAcquireCancelSpinLock
+FsRtlOplockBreakToII
+FsRtlRequestExclusiveOplock
+FsRtlOplockCleanup
+SwapContext
+KxUnlockDispatcherDatabase
+FsRtlNotifySetCancelRoutine
+IoStartNextPacket
+FsRtlWaitOnIrp
+FsRtlRemoveAndCompleteIrp
+MiCleanSection
+CcUninitializeCacheMap
+CcLazyWriteScan
+CcWriteBehind
+MiDecrementShareCount2
+MiRestoreTransitionPte
+MmFlushSection
+MmMapViewInSystemCache
+ExpAcquireResourceSharedLite
+RtlInitializeBitMap
+RtlCompressBufferNS
+RtlDecompressBufferNS
+RtlDecompressFragmentNS
+RtlDescribeChunkNS
+RtlReserveChunkNS
+NtGetPlugPlayEvent
+PsSetLegoNotifyRoutine
+CmpSetGlobalQuotaAllowed
+NtSetSystemPowerState
+HalProcessorIdle
+HalSweepDcache
+HalSweepIcache
+KiInterruptTemplate
+RtlLengthSid
+RtlAreAllAccessesGranted
+CmSetRegistryQuotaInformation
+CmpCompressedNameSize
+_flswbuf
+_flsbuf
+RtlConvertLongToLargeInteger
+DebugPrint
+MmGetCrashDumpStateInformation
+KeSetCacheErrorRoutine
+KeSetKernelStackSwapEnable
+MmPurgeSection
+MiWaitForInPageComplete
+CcGetVacbMiss
+FsRtlFastCheckLockForRead
+FsRtlCheckLockForReadAccess
+KiDeliverApc
+KiApcInterrupt
+ExLockPool
+MiCheckControlArea
+MiResolveProtoPteFault
+PsWatchWorkingSet
+KiInterruptStackSwitch
+KiExceptionDispatch
+IoStartPacket
+MiMakeSystemAddressValidPfn
+PsChargeSharedPoolQuota
+ExpAcquireSharedStarveExclusive
+MiSectionDelete
+FsRtlFastCheckLockForWrite
+CcUnmapVacbArray
+CcUnmapAndPurge
+IoQueueThreadIrp
+KeResetEvent
+KeSetEventBoostPriority
+KeAlertResumeThread
+MiGetEventCounter
+PsReturnSharedPoolQuota
+KeInsertQueueApc
+KiTimerExpiration
+MiGetInPageSupportBlock
+ExDeleteResourceLite
+ExpAcquireResourceExclusiveLite
+IoReleaseCancelSpinLock
+KeInsertHeadQueue
+KeSetAutoAlignmentThread
+KeAttachProcess
+PspSetLdtSize
+ExpInterlockedPopEntrySList
+IopAllocateIrp
+IoAllocateIrp
+IoAllocateMdl
+ObpAllocateObjectNameBuffer
+KeSetTargetProcessorDpc
+FsRtlInitializeFileLock
+ExLocalTimeToSystemTime
+ExSystemTimeToLocalTime
+CcSetLogHandleForFile
+RtlGetDefaultCodePage
+PfxInitialize
+RtlCopyLuid
+PspSetProcessIoHandlers
+KeRaiseUserException
+PsGetProcessExitTime
+_fptrap
+strlen
+atoi
+_stricmp
+ObDereferenceObject
+RtlRaiseStatus
+RtlRaiseException
+RtlEnlargedUnsignedMultiply
+RtlEnlargedIntegerMultiply
+RtlpFreeAtom
+DebugPrompt
+MiRemoveBasedSection
+MiInsertBasedSection
+MmFreeContiguousMemory
+MiTakePageFromWorkingSet
+KeInitializeTimer
+IoSetThreadHardErrorMode
+IoCallDriver
+FsRtlPostPagingFileStackOverflow
+FsRtlPostStackOverflow
+FsRtlNumberOfRunsInMcb
+ExRaiseStatus
+ExRaiseException
+ExIsProcessorFeaturePresent
+ExInterlockedExchangeUlong
+FsRtlUninitializeMcb
+FsRtlInitializeMcb
+IoDeleteController
+LdrAccessResource
+RtlZeroMemory
+RtlMoveMemory
+RtlAddAccessAllowedAce
+PspQueueApcSpecialApc
+SeFreePrivileges
+SepFreeCapturedString
+SepDefaultDeleteMethod
+CmQueryRegistryQuotaInformation
+NtLoadKey
+CmpLazyFlushDpcRoutine
+towupper
+ObInitProcess2
+RtlUnwind
+RtlLargeIntegerNegate
+RtlpUnlockAtomTable
+MiFindEmptySectionBaseDown
+MmIsRecursiveIoFault
+KiCopyInformation
+KiRestoreInterrupts
+KiDisableInterrupts
+IoReleaseVpbSpinLock
+FsRtlMdlReadCompleteDev
+_purecall
+ExAllocatePool
+ExRaiseAccessViolation
+ExRaiseDatatypeMisalignment
+NtSetIntervalProfile
+FsRtlCompletionRoutinePriv
+IopUserRundown
+RtlpDestroyUnCommittedRange
+ObDestroyHandleProcedure
+ObpValidateDesiredAccess
+RtlpDestroyHandleTableForAtomTable
+RtlpAllocateAtom
+KeReturnToFirmware
+KeReleaseMutex
+KeInitializeDpc
+KeSweepDcache
+IoIsSystemThread
+IoCompleteRequest
+IoGetAttachedDevice
+ExpDeleteMutant
+ExSystemExceptionFilter
+SeDeassignPrimaryToken
+KdpComputeChecksum
+strrchr
+strchr
+SepInitializePrivilegeFilter
+RtlLargeIntegerSubtract
+RtlLargeIntegerAdd
+RtlpExecuteHandlerForUnwind
+RtlpExecuteHandlerForException
+MmSizeOfMdl
+KiSquareRootSingle
+KiSquareRootDouble
+KeFreezeExecution
+KeInitializeSemaphore
+KeBugCheck
+KeSetTimeIncrement
+KdpReboot
+KdpQueryPerformanceCounter
+IoAcquireVpbSpinLock
+FsRtlOplockDpc
+FsRtlFastUnlockAllByKey
+FsRtlTruncateMcb
+ExInterlockedIncrementLong
+ExInterlockedDecrementLong
+ExpAllocateStringRoutine
+CcExceptionFilter
+FsRtlAllocateResource
+IopDeallocateApc
+NtFlushWriteBuffer
+LdrFindResource_U
+LdrFindResourceDirectory_U
+RtlpInitUpcaseTable
+ObMakeTemporaryObject
+SepRmComponentTestCommandWrkr
+SepAdtInitializePhase1
+CmpFree
+KdpQuickMoveMemory
+NtSetLowWaitHighThread
+_strset
+ObfReferenceObject
+RtlpExceptionHandler
+MmReturnPoolQuota
+KiRestoreProcessorState
+KeFlushEntireTb
+IoQueryVolumeInformation
+RtlpGetTimeZoneInfoHandle
+RtlNtStatusToDosError
+RtlAcquirePebLock
+RtlReleasePebLock
+PsCreateSystemProcess
+NtTestAlert
+NtSetHighWaitLowThread
+NtGetTickCount
+wcslen
+LsaFreeReturnBuffer
+PspDeleteProcessSecurity
+ObDeassignSecurity
+RtlpFreeHandleForAtom
+DbgUnLoadImageSymbols
+MmIsNonPagedSystemAddressValid
+KiInterruptHandler
+ExpTimeRefreshDpcRoutine
+IoQueryFileInformation
+IopReadyDeviceObjects
+IopUserCompletion
+RtlEqualLuid
+RtlFreeUnicodeString
+RtlFreeAnsiString
+RtlFreeOemString
+RtlxUnicodeStringToAnsiSize
+RtlxUnicodeStringToOemSize
+RtlxAnsiStringToUnicodeSize
+RtlxOemStringToUnicodeSize
+SepIdAssignableAsOwner
+CmpRemoveKeyControlBlock
+HvpGetCellFlat
+RtlpLogLastExceptionDisposition
+RtlSetAllBits
+RtlClearAllBits
+RtlpInitializeLockAtomTable
+MiDownPfnReferenceCount
+MiZeroPhysicalPage
+MiRemoveImageHeaderPage
+MiFlushTb
+KiSuspendThread
+KeReadyThread
+KeProfileInterrupt
+KiComputeWaitInterval
+KeSweepIcache
+KeSetTimer
+KeInitializeTimerEx
+IopApcHardError
+FsRtlNormalizeNtstatus
+ExpGetGlobalAtomTable
+FsRtlNotifyUninitializeSync
+HvGetCellSize
+KdpCauseBugCheck
+CmpLockRegistry
+wcscpy
+rand
+__ll_mul
+PspSetSavedValue
+PspGetSavedValue
+ObpAcquireDescriptorCacheReadLock
+ObpAcquireDescriptorCacheWriteLock
+RtlInitializeGenericTable
+MiUpForkPageShareCount
+KiSaveProcessorState
+ExpTimeZoneWork
+MiChangeNoAccessForkPte
+RtlAbsoluteToSelfRelativeSD
+ObpHashBuffer
+PspNullSpecialApc
+SeDeassignSecurity
+NtVdmControl
+towlower
+__ll_rshift
+__ull_rshift
+__ll_lshift
+MiGetFirstNode
+KiDisplayString
+KeDisableApcQueuingThread
+KeInitializeMutex
+IopInvalidDeviceRequest
+IopExceptionFilter
+FsRtlIsTotalDeviceFailure
+FsRtlAllocatePoolWithQuotaTag
+FsRtlAllocatePoolWithTag
+ExpAllocatePoolWithQuotaHandler
+CcUnmapVacb
+CcCopyReadExceptionFilter
+NtDeleteAtom
+RtlCheckRegistryKey
+RtlCreateRegistryKey
+SepRmCreateLogonSessionWrkr
+SepRmDeleteLogonSessionWrkr
+CmpLazyFlushWorker
+PspUnhandledExceptionInSystemThread
+PsRestoreImpersonation
+ObReleaseObjectSecurity
+RtlCreateUnicodeStringFromAsciiz
+DbgPrompt
+MiCheckForConflictingNode
+KeEnableApcQueuingThread
+FsRtlAllocatePoolWithQuota
+FsRtlAllocatePool
+FsRtlAddMcbEntry
+ExInterlockedPopEntryList
+ExUnlockPool
+ExpExpirationThread
+FsRtlCheckForMatchingFileObject
+FsRtlIsNotifyOnList
+IopAbortRequest
+ChkSum
+PsExitSpecialApc
+SepFreeProxyData
+CmpDestroyTemporaryHive
+CmpLockRegistryExclusive
+strcmp
+_wcslwr
+_strupr
+_strnset
+_strlwr
+PsSetCreateThreadNotifyRoutine
+RtlpUnwindHandler
+MiUpControlAreaRefs
+MiDeleteFreeVm
+KeSetAutoAlignmentProcess
+KeSetDisableBoostThread
+IopChecksum
+IopErrorLogDpc
+NtAddAtom
+NtFindAtom
+FsRtlpSetSymbolicLink
+MiGetImageProtection
+SeReleaseSid
+SeReleaseAcl
+SeReleaseLuidAndAttributesArray
+SeReleaseSidAndAttributesArray
+CmShutdownSystem
+CmpQuotaWarningWorker
+CmpFileSetSize
+CmpCopyCompressedName
+CmpRefreshWorkerRoutine
+KdpSendControlPacket
+memchr
+_wcsupr
+_wcsnset
+SeFreeCapturedSecurityQos
+PsTerminateSystemThread
+RtlInitAnsiString
+RtlInitString
+RtlpInitializeHandleTableForAtomTable
+RtlpLockAtomTable
+MiReturnCommitment
+MiIsProtectionCompatible
+KeInitializeDeviceQueue
+IopErrorLogRequeueEntry
+FsRtlIsNtstatusExpected
+CcRepinBcb
+FsRtlNotifyReportChange
+IopDeleteDriver
+MiUnloadSystemImageByForce
+RtlInitNlsTables
+ObpReferenceSecurityDescriptor
+ObpDereferenceSecurityDescriptor
+SepAdtValidateAuditBounds
+CmpGetKeySecurity
+fputwc
+iswctype
+wcschr
+ObpCompareSecurityDescriptors
+ObAuditInheritedHandleProcedure
+RtlLargeIntegerShiftRight
+RtlLargeIntegerShiftLeft
+RtlFindSetBitsAndClear
+RtlInitUnicodeString
+MiMapCacheExceptionFilter
+KiInterruptDispatchRaise
+KeBusError
+KeRemoveDeviceQueue
+KdpWriteControlSpace
+FsRtlStackOverflowRead
+ExInterlockedRemoveHeadList
+ExInterlockedInsertHeadList
+ExInterlockedExtendZone
+ExAcquireResourceExclusiveLite
+KeReadStateTimer
+KiAcquireSpinLock
+ExpInterlockedPushEntrySList
+IoFreeIrp
+ObpFreeObjectNameBuffer
+IoFreeMdl
+CcMdlReadComplete2
+CcWorkerThread
+FsRtlUninitializeLargeMcb
+FsRtlFreeTunnelNode
+KeReleaseSpinLock
+IoSetHardErrorOrVerifyDevice
+KeEnterCriticalRegion
+FsRtlInitializeTunnelCache
+NtOpenFile
+MmUnmapIoSpace
+MiGetExceptionInfo
+ComputeUnicodeNameLength
+RtlCopyLuidAndAttributesArray
+ObpDestroySecurityDescriptorHeader
+SeReleaseSecurityDescriptor
+CmpCreateTemporaryHive
+isprint
+isspace
+isxdigit
+isdigit
+isupper
+PspInheritQuota
+ObpReleaseDescriptorCacheLock
+RtlAddressInSectionTable
+RtlLargeIntegerArithmeticShift
+MiDownShareCountFlushEntireTb
+MiUpCloneProtoRefCount
+MiUpPfnReferenceCount
+MmCanFileBeTruncated
+KeInitializeEventPair
+KeTryToAttachProcess
+KdpStub
+IoGetBaseFileSystemDeviceObject
+ExDeleteResource
+IoEnqueueIrp
+NtDeviceIoControlFile
+KeAddSystemServiceTable
+NtReadRequestData
+NtWriteRequestData
+SeImpersonateClient
+CmpReleaseGlobalQuota
+CmpUnlockRegistry
+CmpFindKeyControlBlock
+CmpDeleteKeyObject
+mblen
+PspDereferenceEventPair
+PsGetVersion
+PspDeleteThreadSecurity
+PspInitializeProcessSecurity
+RtlLookupElementGenericTable
+DbgLoadImageSymbols
+KeRemoveEntryDeviceQueue
+KeCancelTimer
+IopFreeIrpAndMdls
+IopDescriptorSortingWeight
+FsRtlCheckNoSharedConflict
+ExpTimerDpcRoutine
+CacheImageSymbols
+RtlCopySid
+RtlCompressWorkSpaceSizeLZNT1
+PsEstablishWin32Callouts
+SeQuerySecurityAccessMask
+CmpConfigureProcessors
+CmpSearchOpenWorker
+CmpQuerySecurityDescriptorInfo
+CmpFileFlush
+wctomb
+wcscat
+RtlpCreateHandleForAtom
+LpcpClosePort
+KiSelectNextThread
+KeThawExecution
+KiSaveProcessorControlState
+KeBugCheckUnicodeToAnsi
+KdpSwitchProcessor
+IopDecrementDeviceObjectRef
+IoFreeController
+xHalDeviceControl
+FsRtlLookupLastMcbEntry
+ExpTimeZoneDpcRoutine
+ExInterlockedAddLargeInteger
+CcGetFileObjectFromSectionPtrs
+NtClearEvent
+FsRtlNotifyChangeDirectory
+RtlValidSid
+RtlpDestroyHeapSegment
+CmpLazyFlush
+KdpSendString
+_wcsrev
+_strrev
+_strcmpi
+ObpDeleteDirectoryEntry
+ObAssignObjectSecurityDescriptor
+RtlInitializeExceptionLog
+RtlpVirtualUnwind
+MiRemoveWsleFromFreeList
+MiGetSystemCacheSubsection
+KeSetPriorityThread
+IoDetachDevice
+IoStopTimer
+IopGetModeInformation
+RtlIntegerToUnicodeString
+RtlDeleteRegistryValue
+PsCreateSystemThread
+SepSinglePrivilegeCheck
+CmpDoFileSetSize
+DbgkpSuspendProcess
+DbgkpResumeProcess
+tolower
+ObReferenceObjectByPointer
+MiCaptureSystemPte
+MmAllowWorkingSetExpansion
+KiGetPhysicalAddress
+KdpPageInData
+IoRegisterDriverReinitialization
+RtlpAddData
+NtAlertThread
+SeAssignPrimaryToken
+SepFreePrimaryGroup
+SepAppendDefaultDacl
+CmpNameSize
+CmFlushKey
+KdpRestoreBreakpoint
+PsOpenTokenOfProcess
+RtlSecondsSince1970ToTime
+RtlSecondsSince1980ToTime
+RtlSectionTableFromVirtualAddress
+RtlEnlargedUnsignedDivide
+DbgPrint
+MiCheckPageFileMapping
+MiUpdateImageHeaderPage
+KiIpiGenericCall
+KeQueryBasePriorityThread
+KeInitializeQueue
+KeDeregisterBugCheckCallback
+IopErrorLogGetEntry
+CcSetDirtyPageThreshold
+ExpProfileDelete
+IopAllocateIrpCleanup
+NtListenPort
+LpcpAllocateFromPortZone
+LpcpFindDataInfoMessage
+RawQueryFsVolumeInfo
+SepInformFileSystemsOfDeletedLogon
+SeSetSecurityAccessMask
+SepTokenDeleteMethod
+CmpFreePostBlock
+CmpDereferenceKeyControlBlock
+CmpDestroyHive
+CmpCloseKeyObject
+CmpDoFlushAll
+KdpWriteBreakpoint
+wcscspn
+PsRevertToSelf
+ObpSetHandleAttributes
+MiWaitForForkToComplete
+IopGetMountFlag
+IopRemoveTimerFromTimerList
+NtSetLowEventPair
+NtSetHighEventPair
+IoRegisterShutdownNotification
+LpcpPrepareToWakeClient
+LpcpSaveDataInfoMessage
+RtlValidAcl
+KiAcquireSpinLockRaiseIrql
+KeSynchronizeExecution
+KeReadStateQueue
+xHalSuspendHibernateSystem
+KeRaiseIrql
+KiChainedDispatch
+ExAcquireFastMutex
+PsImpersonateClient
+FsRtlLookupLargeMcbEntry
+FsRtlLookupMcbEntry
+PsReferenceImpersonationToken
+PsReferencePrimaryToken
+FsRtlGetNextLargeMcbEntry
+FsRtlLookupLastLargeMcbEntry
+FsRtlTruncateLargeMcb
+FsRtlNumberOfRunsInLargeMcb
+ExInterlockedAddUlong
+RtlGetGroupSecurityDescriptor
+RtlGetOwnerSecurityDescriptor
+SePrivilegeCheck
+SepFreeDefaultDacl
+DbgkUnMapViewOfSection
+wcsspn
+_wcsicmp
+MiLocateAddress
+MiFlushRangeFilter
+MiUnlockPagedAddress
+MiIsPteDecommittedPage
+MmDbgReadCheck
+KeQueryIntervalProfile
+KiInstructionBusError
+KeInitializeMutant
+KeFillFixedEntryTb
+KiTrapDispatch
+KiIntegerOverflowDispatch
+KiInstructionBusErrorDispatch
+KiIllegalInstructionDispatch
+KiDataBusErrorDispatch
+KiCoprocessorUnusableDispatch
+IoStartTimer
+FsRtlRemoveMcbEntry
+FsRtlGetNextMcbEntry
+ExQueryPoolBlockSize
+KeFlushSingleTb
+NtQuerySystemTime
+MmGetCrashDumpInformation
+RtlGetCompressionWorkSpaceSize
+SePrivilegeObjectAuditAlarm
+CmpFindKeyControlBlockWithLock
+RtlCreateAcl
+wcsncmp
+wcsncat
+strncmp
+strncat
+RtlTimeToSecondsSince1980
+RtlImageNtHeader
+MiGetPreviousNode
+MiGetNextNode
+MiInsertFrontModifiedNoWrite
+KeInitializeProfile
+KiFlushRandomTb
+KiBugCheckDispatch
+KiBreakpointDispatch
+IopSetAttachedDevicePointer
+CcMdlReadComplete
+SeCopyClientToken
+CmpAllocate
+CmpAllocateTag
+HvpFillFileName
+CmpDoCompareKeyName
+HvpHeaderCheckSum
+KdpReceiveString
+vsprintf
+toupper
+KeSetIdealProcessorThread
+KeInsertByKeyDeviceQueue
+KiReadEntryTb
+KdpPollBreakInWithPortLock
+IopStartApcHardError
+IO_DESC_MAX
+FsRtlRemoveLargeEntry
+FsRtlFreeFirstMapping
+CcScheduleLazyWriteScan
+FsRtlNotifyInitializeSync
+IoDisconnectInterrupt
+IoDeleteSymbolicLink
+IoCreateSymbolicLink
+MiFlushAllPages
+RtlMultiByteToUnicodeSize
+RtlSetGroupSecurityDescriptor
+RtlSetOwnerSecurityDescriptor
+ObpInitSecurityDescriptorCache
+RawQueryFsAttributeInfo
+SepAppendPrimaryGroup
+NtInitializeRegistry
+KdEnterDebugger
+RtlExtendedLargeIntegerDivide
+RtlNumberOfClearBits
+MiUnmapImageHeaderInHyperSpace
+MiObtainFreePages
+MmForceSectionClosed
+KiFloatingDispatch
+KeIpiInterrupt
+CcMdlWriteComplete
+NtWaitLowEventPair
+NtWaitHighEventPair
+NtSetLowWaitHighEventPair
+NtSetHighWaitLowEventPair
+IopOpenRegistryKey
+LpcpFreePortClientSecurity
+MiCrashDumpWorker
+MmPageEntireDriver
+RtlCreateUnicodeString
+RtlDescribeChunk
+RtlReserveChunk
+RtlRandom
+ObGetHandleInformation
+ObKillProcess
+SeDeleteObjectAuditAlarm
+CmpRemoveSecurityCellList
+KdExitDebugger
+wcsrchr
+_strnicmp
+_itoa
+RtlRealSuccessor
+KeSetIntervalProfile
+NtRaiseException
+KeTestAlertThread
+KeRevertToUserAffinityThread
+KeForceResumeThread
+IoInitializeIrp
+ExInitializeZone
+RtlpRaiseException
+FsRtlRemoveLargeMcbEntry
+ExReleaseResourceLite
+KeClearEvent
+KeInsertQueueDpc
+FsRtlInitProcessorLockQueue
+KiRetireDpcList
+SepRmSendCommandToLsaWrkr
+ExReleaseFastMutex
+ExGetPreviousMode
+KeQuerySystemTime
+KiSaveVolatileFloatState
+KiInterruptDistribution
+KiInterruptDispatchSame
+CcGetVirtualAddress
+CcMapAndRead
+KeFlushIoBuffers
+FsRtlAcquireFileExclusive
+FsRtlReleaseFile
+IopErrorLogQueueRequest
+LpcpInitializePortQueue
+RtlUnicodeToMultiByteSize
+RtlAnsiCharToUnicodeChar
+RawCleanup
+SepQueryTypeString
+HvpGetCellPaged
+HvpGetCellMap
+KdpWriteVirtualMemory
+KdpPageIn
+RawCheckForDismount
+RtlNumberOfSetBits
+RtlAppendAsciizToString
+MiDoesPdeExistAndMakeValid
+KeFlushQueueApc
+KeFlushMultipleTb
+KiFloatDispatch
+IoAllocateController
+IoBuildSynchronousFsdRequest
+FsRtlAllocateFirstMapping
+RtlDecompressBuffer
+RawQueryFsDeviceInfo
+SeCloseObjectAuditAlarm
+CmpCopyTree
+DbgkExitThread
+_mbstrlen
+_vsnprintf
+PspSetEventPair
+ObpEnumFindHandleProcedure
+RtlAppendStringToString
+MiFeedSysPtePool
+MmDisableModifiedWriteOfSection
+KiReinsertTreeTimer
+KeResumeThread
+KiProcessProfileList
+KiTbMiss
+ExpScanPoolLookasideList
+NtQueryDefaultLocale
+FsRtlReleaseFileForModWrite
+MmDeleteTeb
+OpbCreateCacheEntry
+SepDequeueWorkItem
+CmpValidateAlternate
+NtDeleteKey
+CmpFreeValue
+wcsstr
+_wcsnicmp
+_snprintf
+PsSetCreateProcessNotifyRoutine
+ObpProcessRemoveObjectQueue
+DaysAndFractionToTime
+RtlpAtomMapAtomToHandleEntry
+MiMakePdeExistAndMakeValid
+LpcpMoveMessage
+KiPcToFileHeader
+KeSetSystemAffinityThread
+IopAllocateIrpMustSucceed
+IoAttachDeviceToDeviceStack
+ExReturnPoolQuota
+CcSetBcbOwnerPointer
+FsRtlCheckNotifyForDelete
+RtlEqualSid
+RtlCompressBuffer
+PsUnlockProcess
+SepAssemblePrivileges
+SeExchangePrimaryToken
+CmpCheckCreateAccess
+HvpFreeMap
+DbgkExitProcess
+sprintf
+LsaCallAuthenticationPackage
+RtlEnumerateGenericTableWithoutSplaying
+MiInitializePfnForOtherProcess
+KiThreadDispatch
+KeRundownQueue
+ExpGetHandleInformation
+ProbeForWrite
+NtUnmapViewOfSection
+PspMapSystemDll
+SeCheckAuditPrivilege
+HvAllocateCell
+CmSetLastWriteTimeKey
+DbgkpSendApiMessage
+KiUnlockDispatcherDatabase
+islower
+KiDispatchInterrupt
+IoGetRelatedDeviceObject
+CcSetValidData
+IoSynchronousPageWrite
+KeLeaveCriticalRegion
+IofCallDriver
+IoGetCurrentProcess
+KeQueryTickCount
+RawCompletionRoutine
+PspSystemThreadStartup
+RtlpRaiseStatus
+KeBoostPriorityThread
+KiUserAddressErrorDispatch
+IopRaiseInformationalHardError
+IoWriteErrorLogEntry
+ExAdjustLookasideDepth
+ExpScanGeneralLookasideList
+MmUnmapViewInSystemSpace
+ExCreateHandleTable
+ExpGetObjectInformation
+ExFreePool
+FsRtlRemoveAndCompleteWaitIrp
+FsRtlPrivateLimitFreeLockList
+IopDeleteIoCompletion
+CcDeallocateBcb
+ExUnlockUserBuffer
+SeTraverseAuditAlarm
+KiInsertQueue
+ExAcquireResourceSharedLite
+KeLowerIrql
+FsRtlDissectName
+MiReserveSystemPtes
+IoIsOperationSynchronous
+CcMapData
+KeInitializeProcess
+CcFindBcb
+KeRemoveQueue
+FsRtlOplockIsFastIoPossible
+LpcpFreeDataInfoMessage
+LpcExitThread
+RtlFirstFreeAce
+RtlSetSaclSecurityDescriptor
+RtlSetDaclSecurityDescriptor
+RtlDecompressFragment
+PsSetProcessPriorityByClass
+SepInformLsaOfDeletedLogon
+CmpFlushNotify
+CmpFreeKeyBody
+CmpFreeSecurityDescriptor
+CmpRemoveFromHiveFileList
+PspDereferenceQuota
+ObDupHandleProcedure
+KeRemoveQueueApc
+KeFillLargeEntryTb
+IoAttachDeviceByPointer
+ExExtendZone
+RtlExtendedIntegerMultiply
+NtAllocateLocallyUniqueId
+NtQueryIntervalProfile
+RtlGetSaclSecurityDescriptor
+RtlGetDaclSecurityDescriptor
+LdrVerifyMappedImageMatchesChecksum
+RawQueryInformation
+SepQueryNameString
+HvpDiscardBins
+KdpDeleteBreakpoint
+PspAssignPrimaryToken
+PsDisableImpersonation
+KeAlertThread
+RtlWriteRegistryValue
+PsCreateWin32Process
+SeQueryAuthenticationIdToken
+CmpWorkerCommand
+CmCheckRegistry
+CmpCopyCell
+KdpPrintString
+IoUpdateShareAccess
+KiInSwapKernelStacks
+wcsncpy
+strstr
+LsaDeregisterLogonProcess
+RtlPcToFileHeader
+MmIsSystemAddressAccessable
+KeEnterKernelDebugger
+KeSetProcess
+FsRtlpPostStackOverflow
+FsRtlPrivateRemoveLock
+ExpGetLockInformation
+NtSetDefaultHardErrorPort
+FsRtlpOpenDev
+NtMakeTemporaryObject
+RawSetInformation
+SepFilterPrivilegeAudits
+CmpClaimGlobalQuota
+HvpGrowLog1
+MiDoneWithThisPageGetAnother
+KiSwapProcess
+KeSwitchKernelStack
+NtContinue
+IopCompletePageWrite
+CmpPostApc
+RtlCompareMemoryUlong
+RtlCopyString
+MmUnlockCachedPage
+MmDbgWriteCheck
+MmCreateMdl
+KeSuspendThread
+KePulseEvent
+KeRegisterBugCheckCallback
+CcAllocateObcb
+CcSetAdditionalCacheAttributes
+strncpy
+IoInitializeTimer
+IopErrorLogConnectPort
+PspThreadDelete
+KiRestoreVolatileFloatState
+KiPassiveRelease
+KeInitializeEvent
+NtRegisterThreadTerminatePort
+SeSinglePrivilegeCheck
+CmpPostApcRunDown
+CmpCheckNotifyAccess
+HvpGrowLog2
+FsRtlFindLargeIndex
+IoGetTopLevelIrp
+SeReleaseSubjectContext
+ExpInterlockedCompareExchange64
+RtlSubAuthoritySid
+RtlEqualMemory
+RtlCompareMemory
+wcscmp
+RtlpGetExtraStuffPointer
+ExReleaseFastMutexUnsafe
+RtlpGetStackLimits
+SeSetAccessStateGenericMapping
+ExAllocatePoolWithTag
+ExpFindCurrentThread
+CcAllocateInitializeBcb
+CcCreateVacbArray
+ExAllocatePoolWithQuotaTag
+ExAllocatePoolWithQuota
+ElapsedDaysToYears
+SeDeleteAccessState
+IoGetDeviceToVerify
+RtlTimeToTimeFields
+RtlSplay
+KeUpdateRunTime
+RtlDelete
+RtlDeleteElementGenericTable
+SeCaptureSubjectContext
+RtlFindClearBitsAndSet
+ExReleaseHandleTableShared
+IopParseFile
+RtlFindClearBits
+ExpInterlockedExchangeAddLargeInteger
+RtlCompareUnicodeString
+RtlMapGenericMask
+IoCheckDesiredAccess
+CcUnpinData
+strcpy
+mbtowc
+RtlEnumerateGenericTable
+MiGetPageForHeader
+KiFlushMultipleTb
+IoStartNextPacketByKey
+ExpRaiseStatus
+ExInitializeNPagedLookasideList
+ExConvertExclusiveToSharedLite
+KeRemoveByKeyDeviceQueue
+FsRtlDoesDbcsContainWildCards
+IoCreateSynchronizationEvent
+IoCreateNotificationEvent
+RawClose
+NtSaveKey
+CmQueryKey
+KdpSetContext
+LsaLookupAuthenticationPackage
+ObpCaptureHandleInformation
+MiMakeSystemAddressValid
+MmGetPhysicalAddress
+KiMoveApcState
+KiProbeEntryTb
+KiReadyThread
+KiUnwaitThread
+KiWaitTest
+KiActivateWaiterQueue
+KiInsertQueueApc
+RtlQueryAtomsInAtomTable
+IoFastQueryNetworkAttributes
+RtlCopyUnicodeString
+IofCompleteRequest
+ObReferenceObjectByHandle
+ObpCaptureObjectCreateInformation
+ObCreateObject
+IoCreateStreamFileObject
+IopDereferenceVpbAndFree
+RtlUpcaseUnicodeChar
+ExFreePoolWithTag
+ObpCaptureObjectName
+RtlEqualUnicodeString
+RtlFillMemoryUlong
+SeAuditingFileEvents
+SeCreateAccessState
+RtlExtendedMagicDivide
+RtlTimeToSecondsSince1970
+KiAddressErrorDispatch
+FsRtlWorkerThread
+ExReleaseResourceForThread
+ExpCopyThreadInfo
+ExRemoveHandleTable
+ExpUuidSaveSequenceNumber
+IoUnregisterFileSystem
+LpcpFreeConMsg
+ObQueryObjectAuditingByHandle
+KdpReadVirtualMemory
+KdpReportExceptionStateChange
+RtlPinAtomInAtomTable
+MiLocateAddressInTree
+KiInvalidCompareSingle
+KiInvalidCompareDouble
+ExShutdownSystem
+FsRtlInitializeOpFilter
+IopFindCollisionInTList
+IopGetRegistryValues
+RtlComputeLfnChecksum
+LZNT1FindMatchMaximum
+NtFlushKey
+HvpAllocateMap
+DbgkMapViewOfSection
+NtDelayExecution
+KdpDeleteBreakpointRange
+MiHandleBankedSection
+MiCheckPdeForPagedPool
+FsRtlCheckLockForWriteAccess
+ExTryToAcquireResourceExclusiveLite
+CcPostWorkQueue
+FsRtlBalanceReads
+IoUnregisterFsRegistrationChange
+IoRegisterFsRegistrationChange
+IoCreateUnprotectedSymbolicLink
+ComputeNameLength
+SeCheckPrivilegedObject
+SeDefaultObjectMethod
+KdpMoveMemory
+SeAuditingFileOrGlobalEvents
+MiInitializeCopyOnWritePfn
+KiDataBusError
+FsRtlMdlReadComplete
+MiCheckProtoPtePageState
+ObOpenObjectByName
+IoCreateFile
+NtCreateFile
+CmpCreatePredefined
+NtDeleteFile
+MiDecrementReferenceCount
+ExpTimerApcRoutine
+ExpRaiseException
+ExpComputeLookasideDepth
+CcScanDpc
+IopTimerDispatch
+LdrpCompareResourceNames_U
+RtlGetAce
+NtOpenDirectoryObject
+NtOpenSymbolicLinkObject
+SepAdtCopyToLsaSharedMemory
+SepRmSetAuditEventWrkr
+strcat
+RtlAppendUnicodeStringToString
+MiLockPagedAddress
+KiIdleLoop
+KeSweepIcacheRange
+IoUnregisterShutdownNotification
+NtQueryDirectoryFile
+NtQueryOleDirectoryFile
+SePrivilegedServiceAuditAlarm
+ExAcquireSharedStarveExclusive
+KeAcquireSpinLock
+MmDeterminePoolType
+CcSetReadAheadGranularity
+RtlConvertUlongToLargeInteger
+RtlIsNameLegalDOS8Dot3
+FsRtlRemoveNodeFromTunnel
+FsRtlDoesNameContainWildCards
+MmIsAddressValid
+ExInterlockedInsertTailList
+ExInitializeResourceLite
+IoAllocateAdapterChannel
+FsRtlCurrentBatchOplock
+FsRtlNotifyCompletion
+ExCreateHandle
+ObpCreateHandle
+ObpCreateUnnamedHandle
+RtlUpcaseUnicodeStringToOemString
+ExTryToAcquireFastMutex
+ExInterlockedAddLargeStatistic
+RtlNtStatusToDosErrorNoTeb
+MiRemovePageByColor
+MiRemoveAnyPage
+RawInitializeVcb
+FsRtlMdlWriteCompleteDev
+IopParseDevice
+FsRtlIsNameInExpressionPrivate
+FsRtlIsNameInExpression
+ExReleaseHandleTableExclusive
+ObpValidateAccessMask
+RtlInitializeUnicodePrefix
+RtlCompressWorkSpaceSizeNS
+ObpDecrementHandleCount
+MiRemovePageFromList
+RtlpDidUnicodeToOemWork
+RtlUpcaseUnicodeStringToCountedOemString
+RtlUnicodeStringToCountedOemString
+IoBuildPartialMdl
+MiInitializePfn
+CmpCompareCompressedName
+CmpFindSubKeyByNumber
+KdpGetContext
+RtlImageDirectoryEntryToData
+MiInsertNode
+KeInitializeInterrupt
+IopFreeResourceDir
+IopGetRegistryKeyInformation
+IopLoadFileSystemDriver
+IopMarkDuplicateDevice
+MiSetImageProtectWrite
+RtlOpenCurrentUser
+SepNotifyFileSystems
+CmpDeleteTree
+NtQueryTimerResolution
+PsLookupThreadByThreadId
+PsLookupProcessByProcessId
+PsReferenceEffectiveToken
+ObFindHandleForObject
+ObAssignSecurity
+RtlLargeIntegerDivide
+MiCheckForContiguousMemory
+KiWaitSatisfyAll
+KiSystemServiceHandler
+KiXTbMiss
+FsRtlMdlWriteComplete
+IoGetDeviceObjectPointer
+IopGetDeviceInstanceCsConfigFlags
+RtlUpcaseUnicodeToOemN
+ObpAllocateObject
+FsRtlFindInTunnelCache
+ExMapHandleToPointer
+RtlUpcaseUnicodeString
+FsRtlAreNamesEqual
+NtOpenSection
+CmpSearchForOpenSubKeys
+CmpSearchKeyControlBlockTree
+CmpCopyName
+IopCheckDeviceAndDriver
+ObpChargeQuotaForObject
+ObValidateSecurityQuota
+SeLockSubjectContext
+FsRtlAddToTunnelCache
+FsRtlIsFatDbcsLegal
+DbgkpSectionHandleToFileHandle
+wcstombs
+swprintf
+mbstowcs
+_snwprintf
+ObpInsertDirectoryEntry
+MiSetProtectionOnTransitionPte
+NtCallbackReturn
+IoCancelIrp
+CcWaitOnActiveCount
+KeBoostCurrentThread
+CcUnpinDataForThread
+IopExceptionCleanup
+NtCreateProcess
+RawFileSystemControl
+KiInSwapProcesses
+MiFindEmptyAddressRange
+MiFlushEventCounter
+MmMapMemoryDumpMdl
+KiInvalidOperationLongword
+KiDivideByZeroSingle
+FsRtlNotifyCompleteIrpList
+MiFlushInPageSupportBlock
+KeThawAllThreads
+NtQueryInformationPort
+RtlSetActiveTimeBias
+NtRestoreKey
+HvSyncHive
+HvpTruncateBins
+PspReaper
+MiGetProtoPteAddressExtended
+MmFlushImageSection
+IopDropIrp
+MmRaisePoolQuota
+NtQueryPerformanceCounter
+FsRtlDeregisterUncProvider
+IopCancelAlertedRequest
+LpcpFreeToPortZone
+PspExitNormalApc
+MiLocateSubsection
+FsRtlPrivateInsertExclusiveLock
+ExInitializePagedLookasideList
+IopGetRegistryValue
+MiInsertPageInList
+FsRtlCheckOplock
+MiLocateWsle
+KeUpdateSystemTime
+MiSetDirtyBit
+IoSetShareAccess
+ExSetResourceOwnerPointer
+KiInsertTreeTimer
+ExIsResourceAcquiredExclusiveLite
+IO_DESC_MIN
+NtFsControlFile
+RtlSubtreePredecessor
+MiLocateAndReserveWsle
+MiAddValidPageToWorkingSet
+RtlUnicodeToOemN
+RtlUnicodeStringToOemString
+MiUnlinkPageFromList
+IoCheckShareAccess
+KdpReadControlSpace
+ExDestroyHandle
+KdIsThisAKdTrap
+FsRtlDeleteTunnelCache
+KeRemoveQueueDpc
+KeTryToAcquireSpinLock
+KeInsertDeviceQueue
+KiComputeTimerTableIndex
+SeRegisterLogonSessionTerminatedRoutine
+SepSidInToken
+RtlCreateAtomTable
+MiFlushTbAndCapture
+MiFreeInPageSupportBlock
+KeChangeColorPage
+ObpLookupObjectName
+CcFastCopyWrite
+IopCloseFile
+MiRemoveZeroPage
+MiResolveMappedFileFault
+RtlOemToUnicodeN
+RtlOemStringToUnicodeString
+ObpFreeObject
+ObpRemoveObjectRoutine
+MiBuildKernelMap
+MiMakeSystemAddressValidPfnWs
+KiIpiProcessRequests
+FsRtlCancelWaitIrp
+NtCompleteConnectPort
+SeComputeQuotaInformationSize
+SepAdtLogAuditRecord
+ObDeleteCapturedInsertInfo
+KeRundownThread
+KeReleaseSemaphore
+ExpFindAndRemoveTagBigPages
+CcDeferWrite
+IopWriteResourceList
+MiUpdateWsle
+IopCheckBackupRestorePrivilege
+IoCheckFunctionAccess
+FsRtlPruneTunnelCache
+KeFillEntryTb
+PspTerminateThreadByPointer
+SeGetTokenControlInformation
+KdpGetVersion
+IopCheckUnloadDriver
+strspn
+ObpDeleteSymbolicLink
+RtlLookupFunctionEntry
+KiFindReadyThread
+NtStopProfile
+NtSetIoCompletion
+LdrRelocateImage
+NtResumeThread
+NtAlertResumeThread
+RawQueryVolumeInformation
+KiOutSwapProcesses
+KiLookupFunctionEntry
+KdpSetStateChange
+FsRtlPrivateResetLowestLockOffset
+MiReturnPageFileQuota
+NtOpenEvent
+ExpUuidLoadSequenceNumber
+NtOpenEventPair
+NtOpenMutant
+NtOpenSemaphore
+NtOpenTimer
+IoCancelThreadIo
+NtOpenIoCompletion
+PiRegSzToString
+CmQueryValueKey
+SepTokenIsOwner
+NtW32Call
+IoAttachDevice
+MiLookupDataTableEntry
+SeSubProcessToken
+ObSetSecurityDescriptorInfo
+MiInsertStandbyListAtFront
+MiFindActualFaultingPte
+IopCatagorizeDescriptors
+RtlInitCodePageTable
+SeUnregisterLogonSessionTerminatedRoutine
+CmDeleteKey
+KdpRestoreBreakPointEx
+RtlEqualPrefixSid
+MmDbgTranslatePhysicalAddress
+ExpAddTagForBigPages
+MiCheckForControlAreaDeletion
+FsRtlMdlRead
+FsRtlPrepareMdlWrite
+IopConcatenateUnicodeStrings
+PfxRemovePrefix
+SeAuditHandleCreation
+SepCopyProxyData
+FsRtlOplockBreakNotify
+MiLookupWsleHashIndex
+MiRemoveFromSystemSpace
+FsRtlpRegisterProviderWithMUP
+MmUnmapVideoDisplay
+MmCreateTeb
+CmEnumerateKey
+RtlPrefixString
+RtlEqualString
+KiCallUserMode
+FsRtlPrivateCheckForSharedLockAccess
+ExDeleteNPagedLookasideList
+ExDeletePagedLookasideList
+KiSetServerWaitClientEvent
+KiRequestSoftwareInterrupt
+RtlCreateSecurityDescriptor
+ExInterlockedPushEntryList
+IoGetRequestorProcess
+KiCacheError
+RtlIsGenericTableEmpty
+ObpDeleteNameCheck
+FsRtlOplockFsctrl
+MiRemoveWsle
+SwapSplayLinks
+RtlDeleteNoSplay
+KiInsertTimerTable
+RtlClearBits
+MiReleasePageFileSpace
+ExReinitializeResourceLite
+IoRemoveShareAccess
+MmBuildMdlForNonPagedPool
+FsRtlAcquireFileForCcFlush
+KiFlushSingleTb
+SepConcatenatePrivileges
+RtlUpperString
+SepGetDefaultsSubjectContext
+NtQueryAttributesFile
+RawReadWriteDeviceControl
+SepMakeTokenEffectiveOnly
+CmpLinkKeyToHive
+CmpCreatePerfKeys
+NtQueryKey
+NtSetInformationKey
+CmpOpenFileWithExtremePrejudice
+CmUnloadKey
+MiReturnPageTablePageCommitment
+MiPageFileFull
+KiContinue
+KiDivideByZeroDouble
+KiQuantumEnd
+IopCompleteDriverUnload
+FsRtlpIsDfsEnabled
+ExInitializeResource
+RtlAreBitsClear
+CcGetVirtualAddressIfMapped
+FsRtlDissectDbcs
+IoCreateController
+RtlCopySidAndAttributesArray
+CmpGetNextName
+KiInvalidOperationQuadword
+KeFreezeAllThreads
+KeDetachProcess
+FsRtlPrivateCheckForExclusiveLockAccess
+ObQueryTypeName
+NtEnumerateKey
+NtEnumerateValueKey
+CmpDoFindSubKeyByNumber
+PsOpenTokenOfThread
+RtlDestroyAtomTable
+MiCauseOverCommitPopup
+KiUnpackSingle
+FsRtlPrivateInitializeFileLock
+KeSetBasePriorityThread
+RtlCaptureContext
+IoCheckEaBufferValidity
+IopGetResourceReqRegistryValue
+NtOpenProcessToken
+SeMarkLogonSessionForTerminationNotification
+HvMarkCellDirty
+CmpQueryKeyName
+CmEnumerateValueKey
+DbgkForwardException
+RtlGetCallersAddress
+KeInitializeApc
+RtlInitializeSid
+MiReleaseWsle
+ExDisableResourceBoostLite
+FsRtlFastUnlockAll
+NtSetInformationFile
+SeAssignSecurity
+ObpIncrementHandleCount
+MiCreateDataFileMap
+SeValidSecurityDescriptor
+RtlInsertElementGenericTable
+ExDestroyHandleTable
+NtResetEvent
+IopLoadUnloadDriver
+IopLookupBusStringFromID
+RtlNextUnicodePrefix
+MiInitializeReadInProgressPfn
+FsRtlAllocateOplock
+FsRtlFindFirstOverlappingExclusiveNode
+MiMakeProtectionMask
+RtlSetBits
+RtlpGenerateInheritAcl
+ExChangeHandle
+ExIsResourceAcquiredSharedLite
+MiFlushPteList
+FsRtlFastUnlockSingle
+RtlAppendUnicodeToString
+IopSynchronousApiServiceTail
+RawMountVolume
+SepRmCommandServerThread
+RtlCompareString
+FsRtlCancelOplockIIIrp
+FsRtlCheckNoExclusiveConflict
+RtlAreBitsSet
+MmFreeNonCachedMemory
+ExpCopyProcessInfo
+NtWaitForSingleObject
+NtCreateDirectoryObject
+SeUnlockSubjectContext
+FsRtlReleaseFileForCcFlush
+MiFreeEventCounter
+KiEmulateFloating
+MiInitMachineDependent
+NtQueryInformationToken
+MiCloneProcessAddressSpace
+MiCreateImageFileMap
+NtQuerySystemInformation
+RtlAllocateHeapSlowly
+NtAllocateVirtualMemory
+NtSetInformationProcess
+CmpValidateHiveSecurityDescriptors
+MiInitializeTransitionPfn
+MmAllocateContiguousMemory
+NtYieldExecution
+KiInitializeUserApc
+KeUserModeCallback
+FsRtlFindFirstOverlappingSharedNode
+IoPageRead
+NtPulseEvent
+NtSetEvent
+NtSetInformationObject
+MmAccessFault
+IopReportResourceUsage
+RtlUpcaseUnicodeToCustomCPN
+xHalIoAssignDriveLetters
+KeDumpMachineState
+RtlUpcaseUnicodeToMultiByteN
+FsRtlAddLargeMcbEntry
+FsRtlCopyWrite
+MmCreateSection
+MmMemoryUsage
+CcCopyRead
+MiSetProtectionOnSection
+IopAssignResourcesPhase2
+IopGenNextValidDescriptor
+NtConnectPort
+FsRtlNotifyFullReportChange
+MmWorkingSetManager
+PspCreateProcess
+NtWriteFile
+_output
+_woutput
+IopXxxControlFile
+IopPrepareDriverLoading
+NtFreeVirtualMemory
+NtSetInformationThread
+NtQueryInformationFile
+IopCreateMadeupNode
+MiMapViewOfImageSection
+NtSetInformationToken
+SeCaptureSecurityDescriptor
+NtQueryInformationProcess
+MiMapViewOfDataSection
+RtlAllocateHeap
+NtReadFile
+NtCreatePagingFile
+NtAcceptConnectPort
+IoAssignResources
+LZNT1DecompressChunk
+MmLoadSystemImage
+IopLoadDriver
+NtAccessCheckAndAuditAlarm
+NtDuplicateObject
+CcCopyWrite
+MiProtectVirtualMemory
+MiMapViewOfPhysicalSection
+PspCreateThread
+NtCreateToken
+NtRequestWaitReplyPort
+NtQueryEaFile
+FsRtlIsDbcsInExpression
+KiNormalizeDouble
+MiAllocatePoolPages
+NtQueryVirtualMemory
+CcZeroData
+IoWriteCrashDump
+RtlCreateHeap
+IopDriverLoadingFailed
+KiDispatchException
+RtlGenerate8dot3Name
+NtAccessCheck
+HvInitializeHive
+FsRtlRemoveMcbEntryPrivate
+BuildQueryDirectoryIrp
+SeSetSecurityDescriptorInfo
+NtLockVirtualMemory
+SepCreateToken
+MmCopyToCachedPage
+MiGatherMappedPages
+IoOpenDeviceInstanceKey
+xHalIoReadPartitionTable
+FsRtlPrepareMdlWriteDev
+NtOpenObjectAuditAlarm
+MiFindContiguousMemory
+PspExitThread
+ObpHashSecurityDescriptor
+__ull_rem
+__ull_div
+MmExtendSection
+ObInsertObject
+NtQueryInformationThread
+HvpAddBin
+SepAdtOpenObjectForDeleteAuditAlarm
+SepAdtOpenObjectAuditAlarm
+NtQueryObject
+PpDeviceRegistration
+NtLockFile
+RtlVirtualUnwind
+SepAccessCheck
+FsRtlPrivateFastUnlockAll
+NtAdjustGroupsToken
+LZNT1CompressChunk
+MmShutdownSystem
+KiNormalizeSingle
+VdmQueryDirectoryFile
+NtAdjustPrivilegesToken
+LpcRequestWaitReplyPort
+NtReplyWaitReceivePort
+IopMountVolume
+CmpDoCreateChild
+SeCaptureSidAndAttributesArray
+NtSetSystemInformation
+NtQueryVolumeInformationFile
+IoCreateDevice
+RtlpGenerateInheritedAce
+LdrpSearchResourceSection_U
+MiDispatchFault
+pIoQueryDeviceDescription
+KeWaitForMultipleObjects
+KiEmulateReference
+MiMakeOutswappedPageResident
+MiDeletePte
+MiLoadImageSection
+MiReserveSystemPtes2
+MmCreateProcessAddressSpace
+NtWaitForMultipleObjects
+CmRestoreKey
+NtMapViewOfSection
+NtUnlockVirtualMemory
+RtlpVirtualUnwind32
+CmpCheckKey
+xHalIoWritePartitionTable
+FsRtlGetNextFileLock
+CmpOpenHiveFiles
+ObGetObjectInformation
+CcPerformReadAhead
+NtSetEaFile
+IopQueryDeviceConfiguration
+RtlpCoalesceFreeBlocks
+NtSetVolumeInformationFile
+MmAdjustWorkingSetSize
+RtlpLengthInheritedAce
+HvRefreshHive
+RtlpDeCommitFreeBlock
+CmpInitializeHiveList
+RtlQueryRegistryValues
+SeQuerySecurityDescriptorInfo
+MiGatherPagefilePages
+FsRtlCancelNotify
+NtQueryDirectoryObject
+NtUnlockFile
+PspSetQuotaLimits
+SepDuplicateToken
+IoSetInformation
+ExpGetProcessInformation
+IopGetSetSecurityObject
+ExRefreshTimeZoneInformation
+ExpSystemErrorHandler
+SeOpenObjectForDeleteAuditAlarm
+ExpGetPoolTagInfo
+FsRtlSetFileSize
+NtExtendSection
+CmBootLastKnownGood
+CmpCheckRegistry2
+KeSwapProcessOrStack
+CcScheduleReadAhead
+HvpEnlistFreeCell
+NtNotifyChangeDirectoryFile
+MmSecureVirtualMemory
+MmCleanProcessAddressSpace
+SepAdtPrivilegeObjectAuditAlarm
+FsRtlCopyRead
+MiModifiedPageWriterWorker
+CmpHiveRootSecurityDescriptor
+NtPlugPlayControl
+MiDecommitPages
+ObpParseSymbolicLink
+NtNotifyChangeKey
+IopErrorLogThread
+MiRemoveWorkingSetPages
+PspSetContext
+ObpIncrementUnnamedHandleCount
+MiWriteComplete
+NtLoadKey2
+RtlpCallQueryRegistryRoutine
+MiResolveImageReferences
+__ull_divrem_6416
+RtlFindFirstRunClear
+RtlpGetIntegerAtom
+KeSetTimerEx
+NtQueueApcThread
+SepQueueWorkItem
+RtlpLengthInheritAcl
+PsLookupProcessThreadByCid
+RtlDeleteAtomFromAtomTable
+KiInitializeContextThread
+IoAsynchronousPageWrite
+NtCreateEventPair
+SeOpenObjectAuditAlarm
+CmpAddSubKey
+ObQueryNameString
+RtlMultiByteToUnicodeN
+FsRtlNotifyFullChangeDirectory
+CmpQueryKeyValueData
+FsRtlPrivateLock
+IopIsDeviceInstanceEnabled
+NtReplyWaitReplyPort
+CmpParseKey
+MmFlushVirtualMemory
+RtlAllocateAndInitializeSid
+PspProcessDelete
+SepProbeAndCaptureString_U
+MiSegmentDelete
+IopAssignResourcesPhase3
+ObpProcessDosDeviceSymbolicLink
+PspGetContext
+CmpLoadHiveVolatile
+SepAdtPrivilegedServiceAuditAlarm
+MiResetVirtualMemory
+CmpSetSecurityDescriptorInfo
+MiDeleteVirtualAddresses
+ExpWaitForResource
+MmInSwapProcess
+CmpSetVersionData
+SepAdjustGroups
+IoRaiseInformationalHardError
+NtOpenProcess
+pIoQueryBusDescription
+NtRequestPort
+NtSetSystemEnvironmentValue
+HvpDoAllocateCell
+CmpQueryKeyData
+PsConvertToGuiThread
+NtOpenThread
+CcExtendVacbArray
+FsRtlSplitLargeMcb
+MiCheckForCrashDump
+MiInitializeWorkingSetList
+xHalIoSetPartitionInformation
+HvpBuildMapAndCopy
+MiSnapThunk
+LpcpCopyRequestData
+MiLockCode
+CmQueryMultipleValueKey
+RtlUnwind2
+KdpReceivePacket
+NtUnloadDriver
+CmpWorker
+MiGetWorkingSetInfo
+RtlFindSetBits
+KdpSendWaitContinue
+RtlDecompressFragmentLZNT1
+MiGrowWsleHash
+NtRaiseHardError
+memcmp
+CmpSetValueKeyNew
+NtSetTimer
+MiPurgeImageSection
+LdrEnumResources
+FsRtlAcknowledgeOplockBreak
+MiResolveTransitionFault
+MmOutPageKernelStack
+MiDeleteSystemPagableVm
+MiVerifyImageHeader
+CmpInitHiveFromFile
+CmpRefreshHive
+FsRtlPrivateCancelFileLockIrp
+MiFreeInitializationCode
+IoReportResourceUsage
+IopAcquireFileObjectLock
+MmCheckSystemImage
+RtlFindMessage
+PspUserThreadStartup
+CmpLinkHiveToMaster
+CmpFileRead
+RtlEmptyAtomTable
+MmUnlockPagableImageSection
+KeReleaseWaitForSemaphore
+FsRtlCancelExclusiveIrp
+CcPurgeCacheSection
+MiRemoveMappedPtes
+HvpBuildMap
+CmpSetValueKeyExisting
+MmMapViewInSystemSpace
+CmpRemoveSubKey
+MiCreatePagingFileMap
+MmInitializeProcessAddressSpace
+HvpDoWriteHive
+IopBuildResourceDir
+FsRtlMdlReadDev
+CmpNameFromAttributes
+NtQuerySystemEnvironmentValue
+CmpCopyKeyPartial
+MiDoMappedCopy
+MmMapVideoDisplay
+MiMapLockedPagesInUserSpace
+NtCreateSymbolicLinkObject
+MiRemoveNode
+SepAdtMarshallAuditRecord
+MiQueryAddressState
+NtStartProfile
+ExpWorkerThread
+NtCreateMutant
+NtCreateIoCompletion
+RtlDestroyHeap
+NtOpenKey
+NtQueryMultipleValueKey
+SeObjectReferenceAuditAlarm
+KeBugCheckEx
+MiCopyOnWrite
+MiAddWorkingSetPage
+CmpDoCreate
+SepAdjustPrivileges
+NtSetDefaultLocale
+FsRtlFastUnlockSingleShared
+HvpWriteLog
+MiDoPoolCopy
+ExpGetLookasideInformation
+ExpRaiseHardError
+CmDeleteValueKey
+NtFlushBuffersFile
+SepCreateServerAcl
+SeCaptureSecurityQos
+NtPrivilegedServiceAuditAlarm
+NtReplyPort
+IopQueryXxxInformation
+FsRtlOplockBreakToNone
+KdpTrap
+NtSignalAndWaitForSingleObject
+NtImpersonateClientOfPort
+RtlFreeHeap
+NtOpenThreadToken
+NtQuerySection
+RtlCutoverTimeToSystemTime
+CmpInitializeHive
+NtDuplicateToken
+PiFindDevInstMatch
+CmpAddToLeaf
+RtlCustomCPToUnicodeN
+NtCreatePort
+NtCreateProfile
+CcDeleteSharedCacheMap
+CmpCreateLinkNode
+NtProtectVirtualMemory
+KeDelayExecutionThread
+RtlpFindAndCommitPages
+ExpQueryModuleInformation
+MmCreatePeb
+CmpSaveKeyByFileCopy
+MmSetBankedSection
+HalpGetRegistryPartitionInformation
+MiResolveDemandZeroFault
+SeAuditProcessCreation
+IopGetDriverNameFromKeyNode
+MiChargeCommitment
+NtPrivilegeObjectAuditAlarm
+HvpFindNextDirtyBlock
+PsLockProcess
+MmCreateKernelStack
+RtlFreeHeapSlowly
+NtCreateThread
+NtAllocateUuids
+ExAcquireSharedWaitForExclusive
+RtlReserveChunkLZNT1
+IopOpenRegistryKeyPersist
+MiInsertVad
+FsRtlProcessFileLock
+KdInitSystem
+HvpRecoverData
+CmpSelectLeaf
+IopTranslateResourceList
+NtSetSystemTime
+FsRtlUninitializeOplock
+IoBuildDeviceIoControlRequest
+CompareUnicodeStrings
+NtCreateSection
+IopRaiseHardError
+KiSwitchToThread
+CmSetValueKey
+FsRtlIsHpfsDbcsLegal
+RtlDispatchException
+NtCreateKey
+MiAttemptPageFileReduction
+IopQueryName
+MiReorderTree
+LpcRequestPort
+ExpWaitForResourceDdk
+KiNormalizeQuadword
+ExReleaseResourceForThreadLite
+NtQuerySymbolicLinkObject
+NtRemoveIoCompletion
+qsort
+ExRaiseHardError
+MmOutSwapProcess
+HvLoadHive
+SepRmCommandServerThreadInit
+IopCheckAndLogConflict
+SeAuditHandleDuplication
+RtlUnicodeStringToInteger
+MmMapViewOfSection
+KiGetRegisterValue64
+SepAdtObjectReferenceAuditAlarm
+MiCalculatePageCommitment
+HvpGetHiveHeader
+RtlpExtendHeap
+NtDisplayString
+KiSetRegisterValue64
+SepReferenceLogonSession
+CmpReportNotifyHelper
+HvMarkClean
+CmpFindSubKeyInLeaf
+KiOutSwapKernelStacks
+SeAccessCheck
+KiNormalizeLongword
+ExSnapShotHandleTables
+MiRemoveUnusedSegments
+RtlTimeFieldsToTime
+ObCheckObjectAccess
+PiDetectResourceConflict
+MiCheckControlAreaStatus
+CmpMarkIndexDirty
+RawQueryFsSizeInfo
+FsRtlRegisterUncProvider
+FsRtlPrivateCheckWaitingLocks
+RtlDecompressBufferLZNT1
+MiDecrementCloneBlockReference
+CmpDoOpen
+RtlUnicodeToCustomCPN
+FsRtlAcquireFileForModWrite
+MiResolvePageFileFault
+KiGeneralException
+CmpGetSymbolicLink
+MiSetPagingOfDriver
+CmpCheckValueList
+MiCreatePebOrTeb
+LsaLogonUser
+FsRtlFastUnlockSingleExclusive
+FsRtlUninitializeFileLock
+MiRemoveMappedView
+RtlDecompressChunks
+RtlInitializeContext
+SeCaptureAcl
+IoConnectInterrupt
+MiEliminateWorkingSetEntry
+NtSetContextThread
+IoVerifyVolume
+CmpSplitLeaf
+CmpFindSubKeyInRoot
+KeInitializeThread
+MiSwapWslEntries
+NtGetContextThread
+SepAdtCloseObjectAuditAlarm
+SepAdtDeleteObjectAuditAlarm
+SePrivilegePolicyCheck
+IopAppendStringToValueKey
+KeStartProfile
+CmpCreateKeyControlBlock
+SepRmCallLsa
+RtlUnicodeToMultiByteN
+MiInsertInSystemSpace
+FsRtlPrivateInsertSharedLock
+MiAttemptPageFileExtension
+ObpCheckObjectReference
+DbgkCreateThread
+CompareNamesCaseSensitive
+MiGetPageProtection
+FsRtlInitializeLargeMcb
+RtlQueryAtomInAtomTable
+NtLoadDriver
+HvpCoalesceDiscardedBins
+ExQuerySystemLockInformation
+KeConnectInterrupt
+NtQueryValueKey
+IopServiceInstanceToDeviceInstance
+KiSystemServiceDispatch
+MiInsertWsle
+RtlRemoveUnicodePrefix
+NtCancelIoFile
+SeCaptureSid
+IoAllocateErrorLogEntry
+RtlLookupAtomInAtomTable
+RtlpAddKnownAce
+MiSetPageModified
+FsRtlAddLargeEntry
+MmCanFileBeTruncatedInternal
+ObpCheckTraverseAccess
+KdpReadPhysicalMemory
+CmpGetHiveName
+NtPrivilegeCheck
+SeCreateClientSecurity
+RtlZeroHeap
+IopIsDuplicatedDevices
+ExpTimeRefreshWork
+KiEmulateBranch
+MiCheckVirtualAddress
+KiScanReadyQueues
+CmpMarkKeyDirty
+IopApplyFunctionToSubKeys
+FsRtlSplitLocks
+SepCheckAcl
+RawDispatch
+KeContextToKframes
+HvFreeCell
+NtTerminateProcess
+FsRtlNotifyCompleteIrp
+IoShutdownSystem
+MiInsertPageFileInList
+HvCheckBin
+RtlInsertUnicodePrefix
+KeSetSystemTime
+MmDeleteKernelStack
+KdpSendPacket
+SepExamineSacl
+RtlCharToInteger
+MiModifiedPageWriter
+MiEmptyWorkingSet
+CcZeroEndOfLastPage
+MmInPageKernelStack
+RtlAddAtomToAtomTable
+LZNT1FindMatchStandard
+MiCompleteProtoPteFault
+xHalGetPartialGeometry
+KiInvalidOperationDouble
+PspGetSetContextSpecialApc
+SepProbeAndCaptureQosData
+CmReplaceKey
+SepDeReferenceLogonSession
+RawCreate
+RtlExpandEnvironmentStrings_U
+IopSlotResourceOwner
+FsRtlNotifyUpdateBuffer
+MiUnmapLockedPagesInUserSpace
+ExQueryPoolUsage
+MmLockPagableSectionByHandle
+RtlpCreateUnCommittedRange
+ExpAllocateHandleTable
+MiAccessCheck
+SepAuditFailed
+HvWriteHive
+CmpNotifyChangeKey
+SeAuditProcessExit
+RtlpInsertFreeBlock
+NtFlushVirtualMemory
+MiEnsureAvailablePageOrWait
+KiTimerListExpire
+MmFreeDriverInitialization
+FsRtlRequestOplockII
+PsChargePoolQuota
+SepValidOwnerSubjectContext
+MmUnsecureVirtualMemory
+LdrProcessRelocationBlock
+SepCreateImpersonationTokenDacl
+CmpAllocatePostBlock
+CmpFileWrite
+MmSetMemoryPriorityProcess
+MiExtendPagingFiles
+ObpLookupDirectoryEntry
+NtSetTimerResolution
+ExDupHandleTable
+IoMakeAssociatedIrp
+MmMapIoSpace
+MmGrowKernelStack
+IsValidOemCharacter
+RtlConvertSidToUnicodeString
+MiEmptyAllWorkingSets
+ObCheckCreateObjectAccess
+NtImpersonateThread
+IopOpenLinkOrRenameTarget
+CmSaveKey
+MmUnloadSystemImage
+HvMarkDirty
+CmpAddToHiveFileList
+SeCaptureLuidAndAttributesArray
+PiGenerateLegacyDeviceInstance
+LpcpExtendPortZone
+IoBuildAsynchronousFsdRequest
+KiContinueClientWait
+MiCheckForUserStackOverflow
+CmpInterlockedFunction
+KeGetBugMessageText
+KeSetAffinityThread
+MiMappedPageWriter
+HvpDelistFreeCell
+RtlSetTimeZoneInformation
+NtFlushInstructionCache
+MmGetFileNameForSection
+IopRemoveStringFromValueKey
+KiAttachProcess
+MiGetSubsectionAndProtoFromPte
+atol
+HvIsCellAllocated
+KeContextFromKframes
+MiDeleteValidAddress
+HvCheckHive
+ObpLogSecurityDescriptor
+MiFindEmptyAddressRangeDownTree
+RtlGetElementGenericTable
+__C_specific_handler
+__ll_div
+RtlpInitializeHeapSegment
+RtlpQuerySecurityDescriptor
+KeDisconnectInterrupt
+MiTrimWorkingSet
+MiFlushDirtyBitsToPfn
+__ll_rem
+NtSetValueKey
+ObReferenceObjectByName
+RtlUpperChar
+LpcpDestroyPortQueue
+IopPickupCollisionInTList
+NtCancelTimer
+RtlpGetRegistryHandle
+MmUnmapViewOfSection
+IopAssignResourcesPhase4
+PspQueryWorkingSetWatch
+MmAllocateNonCachedMemory
+MiCheckPurgeAndUpMapCount
+NtReplaceKey
+RtlAddAce
+RtlFindUnicodePrefix
+FsRtlGetTunnelParameterValue
+KdpWriteIoSpace
+HvFreeHivePartial
+IopSynchronousServiceTail
+MmZeroPageThread
+RtlFindLongestRunSet
+KdpWritePhysicalMemory
+CmpCompareInIndex
+SepDeleteLogonSessionTrack
+PfxInsertPrefix
+NtReadVirtualMemory
+SepCreateLogonSessionTrack
+IoPageFileCreated
+ExpInsertPoolTracker
+KiInvalidUserAddress
+KiInvalidOperationSingle
+CmpCopyValue
+IopGetFileName
+IopCheckVpbMounted
+KiRaiseException
+CcUnpinRepinnedBcb
+KiScanBugCheckCallbackList
+NtShutdownSystem
+IopSortDescriptors
+IopOpenServiceEnumKeys
+RtlResetRtlTranslations
+PfxFindPrefix
+RtlUpcaseUnicodeStringToAnsiString
+ExAcquireResourceExclusive
+HalpCalculateChsValues
+NtCreateMailslotFile
+SepAdtInitializeBounds
+HvpGetLogHeader
+RtlLengthSecurityDescriptor
+ObInitProcess
+MiProcessValidPteList
+KeTerminateThread
+FsRtlInitializeTunnel
+IoDeleteDevice
+RtlAnsiStringToUnicodeString
+RtlpQueryRegistryDirect
+MiMapPageInHyperSpace
+RtlPrefixUnicodeString
+RtlpRestoreContext
+SepAdtInitializePrivilegeAuditing
+CmpFindMatchingDescriptorCell
+RtlIntegerToChar
+FsRtlGetFileSize
+NtQueryMutant
+xHalExamineMBR
+MiDeleteAddressesInWorkingSet
+MiFindEmptyAddressRangeInTree
+ObpIncrementHandleDataBase
+CmLoadKey
+NtTerminateThread
+GetNextWchar
+HalpGetRegistryCdromInformation
+ExpAllocateHandleTableEntries
+MiDereferenceSegmentThread
+RtlMakeSelfRelativeSD
+MmLockPagableDataSection
+FsRtlOpBatchBreakClosePending
+NtQueryTimer
+RtlValidSecurityDescriptor
+IopDisassociateThreadIrp
+RtlQueryTimeZoneInformation
+LdrpAccessResourceData
+MmGetPageFileInformation
+NtQueryInformationAtom
+MiChargeCommitmentCantExpand
+MmDeleteProcessAddressSpace
+MiHandleForkTransitionPte
+RtlpHashStringToAtom
+NtDeleteObjectAuditAlarm
+NtCloseObjectAuditAlarm
+RtlCompressBufferLZNT1
+NtCreateEvent
+MmResetDriverPaging
+PsReturnPoolQuota
+RtlpLogExceptionHandler
+KeBalanceSetManager
+HvFreeHive
+HvReallocateCell
+SepPrivilegeCheck
+ObQueryTypeInfo
+HvpEnlistFreeCells
+SepInheritAcl
+ExEnumHandleTable
+RtlFindFirstRunSet
+KiVirtualMemoryDispatch
+SeAppendPrivileges
+ObOpenObjectByPointer
+ObpInsertHandleCount
+MiIsEntireRangeCommitted
+NtReleaseSemaphore
+KeStopProfile
+MiUpdateModifiedWriterMdls
+RtlFindLongestRunClear
+NtSetSecurityObject
+CmpAssignSecurityDescriptor
+CmpSecurityMethod
+NtSuspendThread
+NtCreateTimer
+MiCheckSecuredVad
+KdpAddBreakpoint
+KdpReceivePacketLeader
+CmNotifyRunDown
+RtlUnicodeStringToAnsiString
+NtQuerySemaphore
+KiSetPriorityThread
+MiMapImageHeaderInHyperSpace
+ObGetObjectSecurity
+SepAdtInitializeCrashOnFail
+CmpFreeKeyByCell
+CmpRemoveKeyControlBlockWithLock
+IopAssignResourcesPhase1
+HalpCreateDosLink
+FsRtlPrivateInsertLock
+IoRaiseHardError
+ObpHandleDosDeviceName
+NtSystemDebugControl
+CmpPostNotify
+MiUnlinkFreeOrZeroedPage
+KeSetPriorityProcess
+KiUnpackDouble
+IopGenNextValidResourceList
+KeReleaseMutant
+MiAddMappedPtes
+NtQuerySecurityObject
+LsaRegisterLogonProcess
+FsRtlNotifyCleanup
+KdpWriteBreakPointEx
+KdpReportLoadSymbolsStateChange
+MiCheckDosCalls
+LpcpDeletePort
+NtCreateNamedPipeFile
+FsRtlDeleteKeyFromTunnelCache
+NtCreateSemaphore
+NtQueryEvent
+PspQueryQuotaLimits
+CcGetLsnForFileObject
+MiContractPagingFiles
+__ull_divrem_5353
+CmpCopyTree2
+SeFastTraverseCheck
+PspExitProcess
+NtWriteVirtualMemory
+NtQueryIoCompletion
+NtQueryFullAttributesFile
+IoRegisterFileSystem
+NtReleaseMutant
+PspQueryPooledQuotaLimits
+CcPurgeAndClearCacheSection
+IopHardErrorThread
+KdpReadIoSpace
+MiRemovePageFromWorkingSet
+SepAdtGenerateDiscardAudit
+ExLockUserBuffer
+KiGetRegisterValue
+RtlCompressChunks
+KdpPromptString
+CmpFindSubKeyByName
+NtDeleteValueKey
+RawUserFsCtrl
+RtlAddAuditAccessAce
+MiEnablePagingOfDriver
+RtlFormatCurrentUserKeyPath
+CmpInsertSecurityCellList
+NtUnloadKey
+SepApplyAclToObject
+RtlpInsertUnCommittedPages
+IopOpenCurrentHwProfileDeviceInstanceKey
+FsRtlOpFilterWorkerRoutine
+MiFreeWsle
+CcIsThereDirtyData
+ExTimerRundown
+MiRemoveVad
+CmpFindNameInList
+SeAssignWorldSecurityDescriptor
+RtlDescribeChunkLZNT1
+CcPostDeferredWrites
+ExpRemovePoolTracker
+KiSetRegisterValue
+MiChargePageFileQuota
+MmCopyVirtualMemory
+HvpIsFreeNeighbor
+CmpReportNotify
+RtlDowncaseUnicodeString
+RtlOemStringToCountedUnicodeString
+IoQueryDeviceDescription
+IoQueryDeviceEnumInfo
+KdSetOwedBreakpoints
+SepVariableInitialization
+MmInitSystem
+IopInitializeDumpDrivers
+Phase1Initialization
+IopCreateArcNames
+ExpInitializeExecutive
+RtlCreateUserProcess
+ObInitSystem
+ObCreateObjectType
+PspInitPhase0
+KiSystemBegin
+IoInitSystem
+CmpAddDriverToList
+SeMakeSystemToken
+KiInitializeKernel
+CmInitSystem1
+CmpInitializeRegistryNode
+IopInitializeDeviceInstanceKey
+CcInitializeCacheManager
+CmGetSystemControlValues
+CmpCreateControlSet
+MiSectionInitialization
+IopInitializeBuiltinDriver
+RtlQueryEnvironmentVariable_U
+MiBuildPagedPool
+CmGetSystemDriverList
+CmpFindControlSet
+MiInitializeSystemCache
+MiInitializeSystemPtes
+IopCreateObjectTypes
+ObpGetDosDevicesProtection
+IopReassignSystemRoot
+ExpWorkerInitialization
+CmpCloneControlSet
+CreateSystemRootLink
+IopStoreSystemPartitionInformation
+MiFindInitializationCode
+IopInitializePlugPlayServices
+KiInitSystem
+InitializePool
+IopInitializeBootDrivers
+CmpSetupConfigurationTree
+RtlpCreateStack
+PsLocateSystemDll
+IopInitializeResourceMap
+IopApplySystemPartitionProt
+CmpFindDrivers
+ExInitializeTimeRefresh
+SeRmInitPhase1
+MmFreeLoaderBlock
+SepInitSystemDacls
+FsRtlInitSystem
+CmpInitializeSystemHive
+FsRtlGetCompatibilityModeValue
+CmpSortDriverList
+RawInitialize
+CmpInitializeRegistryNames
+PiInitializeSystemEnumSubKeys
+IopMarkBootPartition
+ObpCreateDosDevicesDirectory
+ExBurnMemory
+KeFindConfigurationNextEntry
+CmpCreateRegistryRoot
+ExpInitSystemPhase0
+CmpFindTagIndex
+IopLookupGroupName
+MiInitializeNonPagedPool
+CmpInitializeHardwareConfiguration
+MmInitializeMemoryLimits
+CmpDoSort
+LpcInitSystem
+MiMergeMemoryLimit
+CmpCreateObjectTypes
+LpcpInitializePortZone
+CmpCreateRootNode
+IopInitializeSystemDrivers
+RtlCreateUserThread
+ExpWin32Initialization
+SepInitializationPhase1
+CmpIsLastKnownGoodBoot
+ExpInitSystemPhase1
+SepInitializePrivilegeSets
+FsRtlInitializeWorkerThread
+IoReportHalResourceUsage
+LookupEntryPoint
+CmpIsLoadType
+IopInitServiceEnumList
+RtlDeNormalizeProcessParams
+SepTokenInitialization
+ExpProfileInitialization
+IopCheckDependencies
+IopProtectSystemPartition
+KiComputeReciprocal
+CmpOrderGroup
+CmpWalkPath
+IopCreateRootDirectories
+MiInitializeSystemSpaceMap
+ExpMutantInitialization
+SepRmDbInitialization
+ExpTimerInitialization
+ExpInitializePoolDescriptor
+PiInitPhase1
+ExpEventInitialization
+ExpEventPairInitialization
+ExpSemaphoreInitialization
+CmpComputeGlobalQuotaAllowed
+CmpResolveDriverDependencies
+RtlpOpenImageFile
+PspLookupKernelUserEntryPoints
+SepInitializationPhase0
+IopInitializeDeviceKey
+IopCreateEntry
+MiAdjustWorkingSetManagerParameters
+PspInitializeSystemDll
+IopRevertModuleList
+IopInitializeAttributesAndCreateObject
+PiInitializeSystemEnum
+CcInitializeVacbs
+IopFreeGroupTree
+CmpFreeDriverList
+ExInitializeHandleTablePackage
+PsInitSystem
+ExInitSystem
+ExComputeTickCountMultiplier
+PpInitSystem
+SeInitSystem
+RtlpFreeStack
+ExpResourceInitialization
+ExpUuidInitialization
+ExLuidInitialization
+SepInitializeWorkList
+ObpFreeDosDevicesProtection
+PspInitPhase1
+PspLookupSystemDllEntryPoint
+ExInitSystemPhase2
+KeFindConfigurationEntry
+PiInitPhase0
+SepRmInitPhase0
+KeInitSystem
+MiEnablePagingTheExecutive
diff --git a/private/ntos/init/up/ntoskrnl.alp b/private/ntos/init/up/ntoskrnl.alp
new file mode 100644
index 000000000..5ac6dd00f
--- /dev/null
+++ b/private/ntos/init/up/ntoskrnl.alp
@@ -0,0 +1,423 @@
+4589  KiIdleLoop
+1887  KiInterruptException
+1556  OtsMove
+ 914  RtlCopyBytes
+ 522  KiUnlockDispatcherDatabase
+ 501  ExReleaseResourceLite
+ 435  KeSynchronizeExecution
+ 405  ExAcquireResourceExclusiveLite
+ 325  ExAllocatePoolWithTag
+ 273  IopParseDevice
+ 271  RtlFindClearBits
+ 257  ExAcquireFastMutex
+ 257  KiSwapThreadExit
+ 237  ExpInterlockedPopEntrySListFault
+ 235  OtsZero
+ 210  IofCompleteRequest
+ 197  RtlCompareMemory
+ 195  ExReleaseFastMutex
+ 190  ExpInterlockedPushEntrySList
+ 190  KiRetireDpcList
+ 180  KiDispatchInterrupt
+ 175  RtlUpcaseUnicodeToOemN
+ 173  CcMapData
+ 170  ExFreePoolWithTag
+ 153  FsRtlDissectName
+ 146  FsRtlIsNameInExpressionPrivate
+ 142  CcGetVirtualAddress
+ 128  ExAcquireResourceSharedLite
+ 118  KeFlushIoBuffers
+ 118  KeReleaseSpinLock
+ 117  KeAcquireSpinLockRaiseToDpc
+ 115  CcPinFileData
+ 105  ObReferenceObjectByHandle
+ 105  OtsFieldInsert
+  91  PsImpersonateClient
+  88  ObfDereferenceObject
+  85  IoGetRelatedDeviceObject
+  84  CcFindBcb
+  80  RtlSplay
+  77  IoAllocateIrp
+  77  ObOpenObjectByName
+  76  KeRemoveQueue
+  75  ExInterlockedAddUlong
+  74  ExpFindCurrentThread
+  73  IofCallDriver
+  73  RtlpGetStackLimits
+  71  ObpLookupObjectName
+  69  ExpInterlockedPopEntrySList
+  67  MmProbeAndLockPages
+  66  CcFreeVirtualAddress
+  66  RtlCompareUnicodeString
+  61  KeInsertQueue
+  60  IoSetTopLevelIrp
+  58  IoFreeIrp
+  57  IopCheckBackupRestorePrivilege
+  57  ObpCaptureObjectCreateInformation
+  54  PsReferencePrimaryToken
+  53  CcFlushCache
+  53  CcUnpinFileData
+  53  KeAcquireSpinLockAtDpcLevel
+  52  KeLeaveCriticalRegion
+  51  CcSetDirtyPinnedData
+  51  FsRtlLookupLargeMcbEntry
+  50  CcCanIWrite
+  50  MmCheckCachedPageState
+  48  CcSetDirtyInMask
+  47  ExReleaseFastMutexUnsafe
+  46  IopAllocateIrp
+  45  CcFastCopyRead
+  44  ObpAllocateObject
+  43  IoAllocateMdl
+  42  ExAcquireFastMutexUnsafe
+  42  ExIsResourceAcquiredExclusiveLite
+  42  FsRtlFindLargeIndex
+  42  IoGetTopLevelIrp
+  41  CcAcquireByteRangeForWrite
+  41  ExpInterlockedCompareExchange64
+  41  KeQuerySystemTime
+  41  KiReleaseSpinLock
+  41  MmUnlockPages
+  41  RtlTimeToTimeFields
+  40  MiFlushSectionInternal
+  39  FsRtlIsFatDbcsLegal
+  38  memcmp
+  38  PsReferenceImpersonationToken
+  37  CcFastCopyWrite
+  37  KiRestoreVolatileIntegerState
+  37  RtlEqualUnicodeString
+  36  CcInitializeCacheMap
+  36  CcUninitializeCacheMap
+  36  CcWriteBehind
+  36  IopCloseFile
+  36  ObpFreeObjectNameBuffer
+  36  SeCreateAccessState
+  35  IoCreateFile
+  35  ObpIncrementHandleCount
+  35  OtsStringCompareEql
+  34  CcMapAndRead
+  34  FsRtlCheckOplock
+  34  IopDeleteFile
+  33  IopParseFile
+  33  RtlIsNameLegalDOS8Dot3
+  32  CcMapAndCopy
+  32  IoBuildPartialMdl
+  32  IoFreeMdl
+  32  MmUnmapViewInSystemCache
+  31  CcPrepareMdlWrite
+  31  RtlMapGenericMask
+  31  RtlNtStatusToDosErrorNoTeb
+  30  FsRtlOplockFsctrl
+  30  IopCompleteRequest
+  30  ObpCaptureObjectName
+  30  RtlCopyUnicodeString
+  29  CcUnpinData
+  29  ExpAcquireResourceSharedLite
+  28  MmCreateSection
+  27  ExAcquireSharedStarveExclusive
+  27  MmMapLockedPages
+  27  ObpAllocateObjectNameBuffer
+  27  ObpCreateHandle
+  27  RtlUpcaseUnicodeChar
+  26  ExAcquireHandleTableShared
+  26  MiDecrementReferenceCount
+  26  MmIsAddressValid
+  25  MmFlushSection
+  24  CcPinMappedData
+  24  FsRtlRequestExclusiveOplock
+  24  ObCreateObject
+  24  RtlUnicodeToOemN
+  23  CcMdlWriteComplete2
+  23  ElapsedDaysToYears
+  23  ExTryToAcquireFastMutex
+  23  IopCheckDeviceAndDriver
+  23  KeWaitForSingleObject
+  23  MiReserveSystemPtes
+  23  RtlUpcaseUnicodeStringToOemString
+  22  KeEnterCriticalRegion
+  22  PsAssignImpersonationToken
+  22  SeReleaseSubjectContext
+  21  CcLazyWriteScan
+  21  ExFreePool
+  21  FsRtlDoesNameContainWildCards
+  21  IoCheckFunctionAccess
+  21  IoIsOperationSynchronous
+  21  KiMb
+  21  NtClose
+  21  PsChargeSharedPoolQuota
+  21  SeAuditingFileEvents
+  20  KiDeliverApc
+  20  MiLocateAndReserveWsle
+  20  SeAssignSecurity
+  20  SeCaptureSubjectContext
+  20  SeDeleteAccessState
+  19  CcMdlRead
+  19  ExCreateHandle
+  19  ExDestroyHandle
+  19  IoFastQueryNetworkAttributes
+  19  MiDecrementShareCount2
+  19  MmSetAddressRangeModified
+  19  ObpDecrementHandleCount
+  19  RtlOemToUnicodeN
+  17  ExReleaseHandleTableShared
+  17  FsRtlAddToTunnelCache
+  17  KiInterruptDistribution
+  16  CcSetFileSizes
+  16  FsRtlGetNextLargeMcbEntry
+  16  KeSetEvent
+  16  MiInsertPageInList
+  16  MiRestoreTransitionPte
+  16  SeSetAccessStateGenericMapping
+  15  CcGetVacbMiss
+  15  ExAcquireHandleTableExclusive
+  15  FsRtlFastCheckLockForRead
+  15  FsRtlFindInTunnelCache
+  15  IoRemoveShareAccess
+  15  MiCheckControlArea
+  15  RtlUpcaseUnicodeString
+  14  IoSetShareAccess
+  14  MiUpdateWsle
+  14  NtSetInformationFile
+  14  ObpChargeQuotaForObject
+  14  OtsStringCompareEqlSameLen
+  13  CcPinRead
+  13  CcWorkerThread
+  13  ExpAcquireSharedStarveExclusive
+  13  ExReleaseHandleTableExclusive
+  13  FsRtlOplockCleanup
+  13  FsRtlOplockIsFastIoPossible
+  13  MmAccessFault
+  13  ObpIncrementHandleDataBase
+  13  OtsFill
+  13  RtlOemStringToUnicodeString
+  12  FsRtlAddLargeMcbEntry
+  12  FsRtlCurrentBatchOplock
+  12  MiCreateDataFileMap
+  12  ObpFreeObject
+  12  ObpRemoveObjectRoutine
+  12  ObpValidateAccessMask
+  12  RtlSetBits
+  12  RtlUpcaseUnicodeStringToCountedOemString
+  12  SeTokenImpersonationLevel
+  11  ExpWorkerThread
+  11  MiLocateWsle
+  11  MiRemoveZeroPage
+  11  MmCopyToCachedPage
+  11  RtlUnicodeStringToOemString
+  10  CcAllocateInitializeBcb
+  10  ExInitializeResourceLite
+  10  ExInterlockedAddLargeStatistic
+  10  ExpInterlockedExchangeAddLargeInteger
+  10  FsRtlIsNameInExpression
+  10  FsRtlPruneTunnelCache
+  10  IoAcquireCancelSpinLock
+  10  MmMapViewInSystemCache
+  10  RtlpDidUnicodeToOemWork
+   9  CcDeleteSharedCacheMap
+   9  ExMapHandleToPointer
+   9  FsRtlPrivateFastUnlockAll
+   9  IoCheckDesiredAccess
+   9  IoSynchronousPageWrite
+   9  KeInsertByKeyDeviceQueue
+   9  KiSaveVolatileIntegerState
+   9  MmUnmapLockedPages
+   9  ObpDeleteNameCheck
+   9  RtlpGenerateInheritedAce
+   9  SepInheritAcl
+   8  ExSystemTimeToLocalTime
+   8  FsRtlMdlWriteCompleteDev
+   8  IoCheckShareAccess
+   8  KeInsertDeviceQueue
+   8  MiDispatchFault
+   8  MiReleaseSystemPtes
+   8  MiRemovePageFromList
+   8  MmPurgeSection
+   8  RtlClearBits
+   7  CcUnmapVacbArray
+   7  ExDeleteResourceLite
+   7  FsRtlFastCheckLockForWrite
+   7  IoAllocateAdapterChannel
+   7  IoStartPacket
+   7  KiMemoryManagementDispatch
+   7  MiCheckProtoPtePageState
+   7  MiMakeSystemAddressValidPfn
+   7  ObpIncrementUnnamedHandleCount
+   7  RtlVirtualUnwind
+   6  CcCopyWrite
+   6  CcDeallocateBcb
+   6  CcFreeActiveVacb
+   6  ExAcquireSharedWaitForExclusive
+   6  ExpWaitForResource
+   6  FsRtlAreNamesEqual
+   6  FsRtlFastUnlockSingleExclusive
+   6  FsRtlOplockBreakToII
+   6  FsRtlPrivateLock
+   6  FsRtlRemoveAndCompleteWaitIrp
+   6  FsRtlRemoveMcbEntryPrivate
+   6  FsRtlWaitOnIrp
+   6  KeRemoveByKeyDeviceQueue
+   6  KiMemoryManagementException
+   6  MiFreePoolPages
+   6  MiInitializePfn
+   6  MiRemoveWsle
+   6  ObpCreateUnnamedHandle
+   6  RtlDelete
+   6  RtlExtendedMagicDivide
+   6  RtlFillMemoryUlong
+   6  RtlpLengthInheritedAce
+   6  RtlSecondsSince1980ToTime
+   5  CcMdlReadComplete2
+   5  ExAllocatePoolWithQuotaTag
+   5  ExInterlockedInsertTailList
+   5  ExReinitializeResourceLite
+   5  FsRtlAllocateOplock
+   5  IoCreateStreamFileObject
+   5  IoGetCurrentProcess
+   5  IoStartNextPacket
+   5  KeInitializeApc
+   5  KeInsertHeadQueue
+   5  MiAllocatePoolPages
+   5  MiCheckForControlAreaDeletion
+   5  MiGetInPageSupportBlock
+   5  MiRemovePageByColor
+   5  MiResolveProtoPteFault
+   5  MiUnlinkPageFromList
+   5  MmCanFileBeTruncatedInternal
+   5  RtlLengthSecurityDescriptor
+   5  RtlNumberGenericTableElements
+   5  RtlpGenerateInheritAcl
+   5  SepCheckAcl
+   4  CcCreateVacbArray
+   4  CcGetDirtyPages
+   4  CcGetVirtualAddressIfMapped
+   4  CcPerformReadAhead
+   4  CcReleaseByteRangeFromWrite
+   4  CcUnmapAndPurge
+   4  FsRtlCheckLockForReadAccess
+   4  FsRtlFastUnlockSingle
+   4  FsRtlInitializeLargeMcb
+   4  FsRtlLookupLastLargeMcbEntry
+   4  IopDereferenceVpbAndFree
+   4  KeInitializeSpinLock
+   4  KeInsertQueueApc
+   4  KiActivateWaiterQueue
+   4  KiApcInterrupt
+   4  MiGetEventCounter
+   4  MiRemoveAnyPage
+   4  MiResolveMappedFileFault
+   4  OtsDivide
+   4  PsReturnSharedPoolQuota
+   4  RtlAreBitsClear
+   4  RtlFillBytes
+   4  RtlInsertElementGenericTable
+   4  RtlLookupFunctionEntry
+   3  CcCopyRead
+   3  CcIsThereDirtyData
+   3  CcPreparePinWrite
+   3  CcSetReadAheadGranularity
+   3  CcSetValidData
+   3  ExIsResourceAcquiredSharedLite
+   3  ExpAcquireResourceExclusiveLite
+   3  ExReleaseResourceForThreadLite
+   3  FsRtlFindFirstOverlappingExclusiveNode
+   3  FsRtlTruncateLargeMcb
+   3  FsRtlUninitializeOplock
+   3  KeInitializeEvent
+   3  KeRemoveDeviceQueue
+   3  KeSetEventBoostPriority
+   3  KiAlternateExit
+   3  KiGenerateTrapFrame
+   3  KiSaveVolatileFloatState
+   3  MiFindActualFaultingPte
+   3  MiFreeInPageSupportBlock
+   3  MiModifiedPageWriterWorker
+   3  MiResolveTransitionFault
+   3  MiSectionDelete
+   3  MiSetDirtyBit
+   3  MmDeterminePoolType
+   3  ObDeleteCapturedInsertInfo
+   3  RtlAreBitsSet
+   3  RtlConvertUlongToLargeInteger
+   3  RtlCreateAcl
+   3  RtlEqualPrefixSid
+   3  RtlFindClearBitsAndSet
+   3  RtlTimeToSecondsSince1970
+   3  SepGetDefaultsSubjectContext
+   3  SeUnlockSubjectContext
+   3  SeValidSecurityDescriptor
+   2  ExDisableResourceBoostLite
+   2  FsRtlAcquireFileForCcFlush
+   2  FsRtlAddLargeEntry
+   2  FsRtlPrivateCheckForExclusiveLockAccess
+   2  FsRtlPrivateInitializeFileLock
+   2  FsRtlPrivateLimitFreeLockList
+   2  FsRtlPrivateResetLowestLockOffset
+   2  FsRtlUninitializeLargeMcb
+   2  IoPageRead
+   2  IoQueueThreadIrp
+   2  KiExceptionExit
+   2  MiCompleteProtoPteFault
+   2  MmCanFileBeTruncated
+   2  NtDeleteFile
+   2  ObInsertObject
+   2  RtlInitializeBitMap
+   2  RtlpLengthInheritAcl
+   2  RtlpRestoreContext
+   2  RtlSecondsSince1970ToTime
+   2  RtlUnicodeStringToCountedOemString
+   2  SepAccessCheck
+   2  SepSidInToken
+   1  CcPostWorkQueue
+   1  CcScheduleReadAhead
+   1  CcUnpinDataForThread
+   1  ExQueueWorkItem
+   1  FsRtlAcknowledgeOplockBreak
+   1  FsRtlCheckLockForWriteAccess
+   1  FsRtlInitializeOplock
+   1  FsRtlMdlReadCompleteDev
+   1  FsRtlNotifyCompletion
+   1  FsRtlNumberOfRunsInLargeMcb
+   1  FsRtlOplockBreakNotify
+   1  FsRtlPrivateInsertLock
+   1  FsRtlUninitializeFileLock
+   1  IoGetFileObjectGenericMapping
+   1  IoGetInitialStack
+   1  IoGetRequestorProcess
+   1  IopErrorLogRequeueEntry
+   1  IopSynchronousServiceTail
+   1  IopTimerDispatch
+   1  IoUpdateShareAccess
+   1  KeClearEvent
+   1  KeGetCurrentIrql
+   1  KiFlushMultipleTb
+   1  KiRestoreVolatileFloatState
+   1  KiSystemServiceExit
+   1  KiTimerExpiration
+   1  MiAccessCheck
+   1  MiAddValidPageToWorkingSet
+   1  MiCheckControlAreaStatus
+   1  MiDeleteSystemPagableVm
+   1  MiFlushInPageSupportBlock
+   1  MiFreeEventCounter
+   1  MiInitializeReadInProgressPfn
+   1  MiMakeProtectionMask
+   1  MiMapPageInHyperSpace
+   1  MiReleasePageFileSpace
+   1  MiReleaseWsle
+   1  MiWaitForInPageComplete
+   1  MmBuildMdlForNonPagedPool
+   1  MmFlushImageSection
+   1  NtQueryVolumeInformationFile
+   1  OtsDivide32Unsigned
+   1  RtlCreateSecurityDescriptor
+   1  RtlFirstFreeAce
+   1  RtlImageDirectoryEntryToData
+   1  RtlInitializeSid
+   1  RtlLookupElementGenericTable
+   1  RtlNumberOfClearBits
+   1  RtlPcToFileHeader
+   1  RtlRealSuccessor
+   1  RtlSubtreePredecessor
+   1  SeLockSubjectContext
+   1  wcsicmp
+
\ No newline at end of file
diff --git a/private/ntos/init/up/ntoskrnl.mip b/private/ntos/init/up/ntoskrnl.mip
new file mode 100644
index 000000000..fe0340ece
--- /dev/null
+++ b/private/ntos/init/up/ntoskrnl.mip
@@ -0,0 +1,511 @@
+3259  memmove
+ 795  RtlFillMemory
+ 621  ExReleaseResourceLite
+ 566  ExAcquireResourceExclusiveLite
+ 519  KiSwitchStacks
+ 482  ExAllocatePoolWithTag
+ 421  KeSwapIrql
+ 393  IopParseDevice
+ 345  KeRemoveQueue
+ 324  MiReserveSystemPtes
+ 300  KeInsertQueueDpc
+ 284  ExFreePoolWithTag
+ 240  CcMapData
+ 235  RtlCompareMemory
+ 233  ExAcquireFastMutex
+ 227  KiDispatchInterrupt
+ 196  RtlUpcaseUnicodeToOemN
+ 194  CcGetVirtualAddress
+ 179  IofCompleteRequest
+ 170  RtlFindClearBits
+ 164  KiRetireDpcList
+ 160  KiInsertQueue
+ 149  CcFindBcb
+ 147  KiUnlockDispatcherDatabase
+ 145  KeFlushIoBuffers
+ 143  KeAcquireSpinLockRaiseToSynch
+ 140  ObReferenceObjectByHandle
+ 137  RtlEqualMemory
+ 136  ExpInterlockedPushEntrySList
+ 133  ExpInterlockedPopEntrySListFault
+ 132  FsRtlIsNameInExpressionPrivate
+ 128  KeReleaseSpinLock
+ 127  RtlSplay
+ 123  ExReleaseFastMutex
+ 122  KiRaiseIrqlToXxxLevel
+ 121  ExAcquireResourceSharedLite
+ 119  CcPinFileData
+ 116  SwapFromIdle
+ 114  KeSynchronizeExecution
+ 113  FsRtlDissectName
+ 109  ObOpenObjectByName
+ 103  CcFreeVirtualAddress
+ 102  IoFreeIrp
+ 101  ObpCaptureObjectCreateInformation
+ 101  PsImpersonateClient
+ 100  ObfDereferenceObject
+ 100  ObpLookupObjectName
+  96  IofCallDriver
+  96  RtlTimeToTimeFields
+  93  KeRaiseIrql
+  88  KiReadyThread
+  87  MmCheckCachedPageState
+  84  MmProbeAndLockPages
+  81  FsRtlLookupLargeMcbEntry
+  81  MiFlushSectionInternal
+  80  ExpInterlockedPopEntrySList
+  80  IopAllocateIrp
+  80  RtlCompareUnicodeString
+  76  IoAllocateIrp
+  75  CcSetDirtyPinnedData
+  74  PspSetLdtSize
+  73  IoGetRelatedDeviceObject
+  69  CcUnpinFileData
+  67  KeWaitForSingleObject
+  66  CcMapAndRead
+  66  RtlIsNameLegalDOS8Dot3
+  65  ObpCaptureObjectName
+  63  ExReleaseHandleTableShared
+  63  KdPollBreakIn
+  62  CcFastCopyRead
+  62  FsRtlAddToTunnelCache
+  62  KiInterruptException
+  61  CcPinMappedData
+  61  FsRtlFindLargeIndex
+  60  ExInterlockedAddUlong
+  59  CcCanIWrite
+  59  RtlEqualUnicodeString
+  58  islower
+  58  KeInsertQueue
+  57  KiChainedDispatch
+  57  ObpAllocateObject
+  56  ElapsedDaysToYears
+  56  FsRtlIsFatDbcsLegal
+  53  ExAcquireFastMutexUnsafe
+  51  KiSwapThread
+  51  memset
+  50  CcFlushCache
+  48  ExAcquireHandleTableShared
+  48  IopDeleteFile
+  48  KeLeaveCriticalRegion
+  47  CcMdlRead
+  47  CcPrepareMdlWrite
+  46  CcFastCopyWrite
+  44  CcInitializeCacheMap
+  44  CcSetDirtyInMask
+  44  MiFreePoolPages
+  44  MiReleaseSystemPtes
+  44  RtlQueryAtomsInAtomTable
+  43  IoIsOperationSynchronous
+  43  KeLowerIrql
+  40  IoFastQueryNetworkAttributes
+  40  PsReferenceImpersonationToken
+  39  MiInsertPageInList
+  39  MmUnmapViewInSystemCache
+  39  ObCreateObject
+  39  ObpDecrementHandleCount
+  38  CcAcquireByteRangeForWrite
+  38  IopParseFile
+  38  KeSetEvent
+  38  MiLocateAndReserveWsle
+  38  MmUnlockPages
+  38  SeCreateAccessState
+  37  FsRtlFindInTunnelCache
+  37  IoCreateFile
+  36  CcMdlWriteComplete2
+  36  KeEnterCriticalRegion
+  35  CcMapAndCopy
+  35  ExCreateHandle
+  35  ExpFindCurrentThread
+  35  FsRtlCheckOplock
+  35  IopCloseFile
+  35  IopCompleteRequest
+  33  KiSaveVolatileFloatState
+  33  KiSwapThreadExit
+  33  ObpFreeObjectNameBuffer
+  32  CcSetFileSizes
+  32  RtlExtendedMagicDivide
+  31  CcUnpinData
+  31  MmMapLockedPages
+  31  MmSetAddressRangeModified
+  31  NtSetInformationFile
+  31  RtlUpcaseUnicodeStringToOemString
+  30  IoAcquireCancelSpinLock
+  30  IoAllocateMdl
+  30  IoFreeMdl
+  30  MiCheckProtoPtePageState
+  30  MiCleanSection
+  30  MiRemoveZeroPage
+  30  ObpCreateHandle
+  30  PsAssignImpersonationToken
+  29  ExAcquireHandleTableExclusive
+  29  FsRtlOplockBreakToII
+  29  MiRemovePageByColor
+  29  RtlNtStatusToDosErrorNoTeb
+  29  SeAssignSecurity
+  29  wcscmp
+  28  CcUninitializeCacheMap
+  28  FsRtlRequestExclusiveOplock
+  28  KiModifyException
+  28  RtlCopyUnicodeString
+  28  SeDeleteAccessState
+  27  CcLazyWriteScan
+  27  ExAcquireSharedStarveExclusive
+  27  KiUnwaitThread
+  27  MiDecrementReferenceCount
+  27  MiRemovePageFromList
+  27  ObpIncrementHandleCount
+  26  CcWriteBehind
+  26  MmAccessFault
+  26  ObpAllocateObjectNameBuffer
+  26  RtlFillMemoryUlong
+  26  RtlMapGenericMask
+  25  ExReleaseHandleTableExclusive
+  25  RtlUnicodeToOemN
+  24  FsRtlOplockCleanup
+  24  MiDecrementShareCount2
+  24  MiUpdateWsle
+  24  NtClose
+  23  FsRtlInitProcessorLockQueue
+  23  IoBuildPartialMdl
+  23  MiRestoreTransitionPte
+  23  MmFlushSection
+  23  RtlpDidUnicodeToOemWork
+  22  _ull_rshift
+  22  IopCheckBackupRestorePrivilege
+  22  IopDereferenceVpbAndFree
+  22  MmMapViewInSystemCache
+  22  SeCaptureSubjectContext
+  21  ExpAcquireResourceSharedLite
+  21  MmPurgeSection
+  21  RtlOemToUnicodeN
+  21  RtlUpcaseUnicodeString
+  20  ExMapHandleToPointer
+  20  MiCreateDataFileMap
+  20  MiLocateWsle
+  20  MiRemoveAnyPage
+  20  MiUnlinkPageFromList
+  20  RtlUpcaseUnicodeChar
+  19  IoSetHardErrorOrVerifyDevice
+  19  KeUpdateSystemTime
+  19  MiWaitForInPageComplete
+  19  MmCreateSection
+  19  ObpDeleteNameCheck
+  19  ObpFreeObject
+  19  PsReferencePrimaryToken
+  19  SeReleaseSubjectContext
+  18  CcGetVacbMiss
+  18  ExFreePool
+  18  FsRtlOplockIsFastIoPossible
+  18  RtlFindClearBitsAndSet
+  17  ExReleaseFastMutexUnsafe
+  17  FsRtlGetNextLargeMcbEntry
+  17  FsRtlRemoveNodeFromTunnel
+  17  KeReadStateTimer
+  17  KiAcquireSpinLock
+  17  MiInitializePfn
+  16  CcPinRead
+  16  CcWorkerThread
+  16  FsRtlDoesNameContainWildCards
+  16  FsRtlFastCheckLockForRead
+  16  FsRtlOplockFsctrl
+  16  IoCheckFunctionAccess
+  16  IoCheckShareAccess
+  16  KdpReadControlSpace
+  16  KiDeliverApc
+  16  KiRestoreVolatileFloatState
+  16  MiResolveMappedFileFault
+  16  ObpRemoveObjectRoutine
+  15  CcAllocateInitializeBcb
+  15  ExLockPool
+  15  ExpInterlockedCompareExchange64
+  15  MiCheckControlArea
+  15  MmCopyToCachedPage
+  15  MmIsAddressValid
+  15  RtlUpcaseUnicodeStringToCountedOemString
+  15  xHalSuspendHibernateSystem
+  14  CcPreparePinWrite
+  14  ExTryToAcquireFastMutex
+  14  IopCheckDeviceAndDriver
+  14  KeInitializeEvent
+  14  RtlpGetExtraStuffPointer
+  14  SwapContext
+  13  ExDestroyHandle
+  13  FsRtlRemoveAndCompleteWaitIrp
+  13  IoCheckDesiredAccess
+  13  KiInterruptDispatchSame
+  13  KxUnlockDispatcherDatabase
+  13  MiDispatchFault
+  13  MmUnmapLockedPages
+  13  ObpChargeQuotaForObject
+  13  RtlpGetStackLimits
+  13  SeAuditingFileEvents
+  12  KiInterruptExit
+  12  MiSetDirtyBit
+  11  CcFreeActiveVacb
+  11  ExSetResourceOwnerPointer
+  11  FsRtlLookupLastLargeMcbEntry
+  11  FsRtlPrivateFastUnlockAll
+  11  FsRtlTruncateLargeMcb
+  11  KeReadStateQueue
+  11  KiWaitTest
+  11  MiRemoveWsle
+  11  MiResolveProtoPteFault
+  11  PsWatchWorkingSet
+  11  RtlOemStringToUnicodeString
+  11  SeSetAccessStateGenericMapping
+  10  CmpCreatePredefined
+  10  ExGetPreviousMode
+  10  ExpInterlockedExchangeAddLargeInteger
+  10  FsRtlNotifySetCancelRoutine
+  10  IoSetShareAccess
+  10  IoStartPacket
+  10  KeAcquireSpinLock
+  10  KeQuerySystemTime
+  10  MiMakeSystemAddressValidPfn
+  10  PsChargeSharedPoolQuota
+  10  RawInitializeVcb
+  10  RtlpGenerateInheritedAce
+   9  CcCopyRead
+   9  CcGetDirtyPages
+   9  ExInterlockedInsertTailList
+   9  FsRtlPruneTunnelCache
+   9  IoStartNextPacket
+   9  KiActivateWaiterQueue
+   9  KiInsertTreeTimer
+   9  ObValidateSecurityQuota
+   9  RtlTimeToSecondsSince1970
+   8  CcCreateVacbArray
+   8  CcReleaseByteRangeFromWrite
+   8  ExpAcquireSharedStarveExclusive
+   8  FsRtlPrivateLimitFreeLockList
+   8  FsRtlWaitOnIrp
+   8  IoAllocateAdapterChannel
+   8  IoGetCurrentProcess
+   8  IopDeleteIoCompletion
+   8  KdIsThisAKdTrap
+   8  KeClearEvent
+   8  KeQueryTickCount
+   8  KiInsertQueueApc
+   8  KiInsertTimerTable
+   8  MiAllocatePoolPages
+   8  MiSectionDelete
+   8  RtlpLengthInheritedAce
+   8  SeValidSecurityDescriptor
+   8  SwapSplayLinks
+   7  FsRtlFastCheckLockForWrite
+   7  FsRtlUninitializeLargeMcb
+   7  KeUpdateRunTime
+   7  ObpCreateUnnamedHandle
+   7  RtlInsertElementGenericTable
+   7  SeLockSubjectContext
+   7  SepRmSendCommandToLsaWrkr
+   7  wcsicmp
+   6  CcPurgeCacheSection
+   6  CcUnmapVacbArray
+   6  ExAllocatePoolWithQuotaTag
+   6  ExIsResourceAcquiredExclusiveLite
+   6  FsRtlAddLargeMcbEntry
+   6  FsRtlAreNamesEqual
+   6  FsRtlDeleteTunnelCache
+   6  FsRtlPrivateLock
+   6  FsRtlRemoveMcbEntryPrivate
+   6  IO_DESC_MIN
+   6  IoCreateStreamFileObject
+   6  IoQueueThreadIrp
+   6  KeResetEvent
+   6  KeSetEventBoostPriority
+   6  KiContinueInterrupt
+   6  MiInitializeReadInProgressPfn
+   6  MiResolveDemandZeroFault
+   6  MmDeterminePoolType
+   6  ObpValidateAccessMask
+   6  RtlDelete
+   5  CcSetValidData
+   5  ExAcquireSharedWaitForExclusive
+   5  ExInitializeResourceLite
+   5  ExQueueWorkItem
+   5  ExReinitializeResourceLite
+   5  FsRtlAllocateOplock
+   5  FsRtlCurrentBatchOplock
+   5  FsRtlFastUnlockSingleExclusive
+   5  FsRtlInitializeLargeMcb
+   5  FsRtlLookupMcbEntry
+   5  FsRtlNotifyCompletion
+   5  IoRemoveShareAccess
+   5  IoSynchronousPageWrite
+   5  KeAlertResumeThread
+   5  KeFillEntryTb
+   5  KeRemoveQueueDpc
+   5  MiGetEventCounter
+   5  MmBuildMdlForNonPagedPool
+   5  ObInsertObject
+   5  PsReturnSharedPoolQuota
+   5  RtlClearBits
+   5  RtlSubAuthoritySid
+   5  SeTraverseAuditAlarm
+   4  CcCopyWrite
+   4  CcDeallocateBcb
+   4  CcMdlReadComplete2
+   4  ExpWaitForResource
+   4  FsRtlAcknowledgeOplockBreak
+   4  FsRtlAcquireFileForCcFlush
+   4  FsRtlUninitializeOplock
+   4  IoGetTopLevelIrp
+   4  KeInsertQueueApc
+   4  KeTryToAcquireSpinLock
+   4  KiAlternateExit
+   4  KiApcInterrupt
+   4  KiFlushSingleTb
+   4  KiTimerExpiration
+   4  MiAccessCheck
+   4  MiAddValidPageToWorkingSet
+   4  MiEnsureAvailablePageOrWait
+   4  MiGetInPageSupportBlock
+   4  MiReleasePageFileSpace
+   4  MiResolveTransitionFault
+   4  NtDeleteFile
+   4  NtFsControlFile
+   4  NtQueryVolumeInformationFile
+   4  RtlpGenerateInheritAcl
+   4  RtlSetBits
+   4  RtlUnicodeStringToCountedOemString
+   4  RtlUnicodeStringToOemString
+   4  SepCheckAcl
+   3  CcUnmapAndPurge
+   3  ExChangeHandle
+   3  ExDeleteResourceLite
+   3  ExInterlockedAddLargeStatistic
+   3  ExpAcquireResourceExclusiveLite
+   3  FsRtlCheckLockForReadAccess
+   3  FsRtlFastUnlockSingle
+   3  FsRtlFindFirstOverlappingExclusiveNode
+   3  FsRtlMdlWriteCompleteDev
+   3  FsRtlNotifyCleanup
+   3  FsRtlNumberOfRunsInLargeMcb
+   3  FsRtlPrivateInsertLock
+   3  FsRtlRemoveAndCompleteIrp
+   3  IopOpenLinkOrRenameTarget
+   3  IoReleaseCancelSpinLock
+   3  KeInitializeApc
+   3  KeInsertDeviceQueue
+   3  KeInsertHeadQueue
+   3  KeSetAutoAlignmentThread
+   3  KiComputeTimerTableIndex
+   3  KiPassiveRelease
+   3  KiSystemServiceRepeat
+   3  MiCheckControlAreaStatus
+   3  MiFreeInPageSupportBlock
+   3  MiMakeProtectionMask
+   3  ObpIncrementHandleDataBase
+   3  RtlDeleteElementGenericTable
+   3  RtlDeleteNoSplay
+   3  RtlSubtreePredecessor
+   3  RtlUpperString
+   3  SepAccessCheck
+   3  SepConcatenatePrivileges
+   3  SepGetDefaultsSubjectContext
+   2  CcGetVirtualAddressIfMapped
+   2  CcScheduleReadAhead
+   2  CcSetReadAheadGranularity
+   2  ExDisableResourceBoostLite
+   2  ExEnumHandleTable
+   2  ExInterlockedPushEntryList
+   2  ExIsResourceAcquiredSharedLite
+   2  ExpWorkerThread
+   2  FsRtlFreeTunnelNode
+   2  FsRtlIsNameInExpression
+   2  FsRtlOplockBreakNotify
+   2  FsRtlReleaseFileForCcFlush
+   2  IoGetDeviceToVerify
+   2  IopSynchronousApiServiceTail
+   2  KeChangeColorPage
+   2  KeSetTimerEx
+   2  KeWaitForMultipleObjects
+   2  KiDecrementQuantum
+   2  KiRequestSoftwareInterrupt
+   2  KiSetServerWaitClientEvent
+   2  MiAddWorkingSetPage
+   2  MiChargeCommitmentCantExpand
+   2  MiCheckForControlAreaDeletion
+   2  MiCompleteProtoPteFault
+   2  MiDereferenceSegmentThread
+   2  MiFlushPteList
+   2  MiFreeEventCounter
+   2  MiReleaseWsle
+   2  MmCanFileBeTruncatedInternal
+   2  NtCancelTimer
+   2  ObDeleteCapturedInsertInfo
+   2  ObpIncrementUnnamedHandleCount
+   2  PsReturnPoolQuota
+   2  RtlAppendUnicodeToString
+   2  RtlAreBitsSet
+   2  RtlCaptureContext
+   2  RtlConvertUlongToLargeInteger
+   2  RtlCreateSecurityDescriptor
+   2  RtlEqualPrefixSid
+   2  RtlInitializeSid
+   2  RtlInitializeUnicodePrefix
+   2  RtlVirtualUnwind
+   2  SepInheritAcl
+   2  SeUnlockSubjectContext
+   1  CcDeleteSharedCacheMap
+   1  CcPerformReadAhead
+   1  CcPostWorkQueue
+   1  CcUnpinDataForThread
+   1  CcZeroEndOfLastPage
+   1  ExAllocatePoolWithQuota
+   1  ExReleaseResourceForThreadLite
+   1  ExUnlockUserBuffer
+   1  FsRtlAllocateFirstMapping
+   1  FsRtlFastUnlockAll
+   1  FsRtlFastUnlockSingleShared
+   1  FsRtlPrivateCheckForExclusiveLockAccess
+   1  FsRtlRemoveLargeMcbEntry
+   1  FsRtlUninitializeFileLock
+   1  IoBuildAsynchronousFsdRequest
+   1  IoGetRequestorProcess
+   1  IoPageRead
+   1  IopTimerDispatch
+   1  IoUpdateShareAccess
+   1  KeAttachProcess
+   1  KeBoostCurrentThread
+   1  KeContextFromKframes
+   1  KeFlushSingleTb
+   1  KeRemoveByKeyDeviceQueue
+   1  KeSetBasePriorityThread
+   1  KeThawAllThreads
+   1  KiCacheError
+   1  KiCacheErrorEndAddress
+   1  KiExceptionExit
+   1  KiFindReadyThread
+   1  KiScanBugCheckCallbackList
+   1  KiTimerListExpire
+   1  MiFindActualFaultingPte
+   1  MiFlushInPageSupportBlock
+   1  MiFreeWsle
+   1  MiGatherPagefilePages
+   1  MiInsertPageFileInList
+   1  MiInsertVad
+   1  MiRemoveUnusedSegments
+   1  MiReserveSystemPtes2
+   1  MiResolvePageFileFault
+   1  MiReturnPageFileQuota
+   1  MiSegmentDelete
+   1  MiWriteComplete
+   1  MmRaisePoolQuota
+   1  NtCreateFile
+   1  NtQueryTimerResolution
+   1  RtlAreBitsClear
+   1  RtlCompressWorkSpaceSizeNS
+   1  RtlCreateAcl
+   1  RtlExtendedIntegerMultiply
+   1  RtlIsGenericTableEmpty
+   1  RtlLengthSecurityDescriptor
+   1  RtlpLengthInheritAcl
+   1  RtlpRaiseException
+   1  SeObjectReferenceAuditAlarm
+   1  SepSidInToken
+   1  SepTokenIsOwner
+   1  strncpy
+
\ No newline at end of file
diff --git a/private/ntos/init/up/ntoskrnl.ppc b/private/ntos/init/up/ntoskrnl.ppc
new file mode 100644
index 000000000..e3177d515
--- /dev/null
+++ b/private/ntos/init/up/ntoskrnl.ppc
@@ -0,0 +1,542 @@
+916  MiZeroPhysicalPage
+749  ExReleaseResourceLite
+712  MmZeroPageThread
+671  IopParseDevice
+535  ExAllocatePoolWithTag
+498  ExInterlockedPopEntrySList
+459  ExFreePoolWithTag
+390  CcMapData
+379  RtlFindClearBits
+349  memmove
+327  CcFindBcb
+326  IoAllocateIrp
+293  FsRtlDissectName
+280  KiInterruptDispatch
+277  CcFastCopyRead
+272  FsRtlIsNameInExpressionPrivate
+269  RtlCompareMemory
+254  MmCopyToCachedPage
+251  RtlUpcaseUnicodeToOemN
+242  CcPinFileData
+240  ObpCaptureObjectCreateInformation
+232  CcGetVirtualAddress
+232  KiDispatchInterrupt
+227  RtlCompareUnicodeString
+208  Exfi386InterlockedDecrementLong
+205  ExpAcquireResourceExclusiveLite
+204  IofCompleteRequest
+187  CcFastCopyWrite
+184  MiFlushSectionInternal
+180  RtlTimeToTimeFields
+178  PsImpersonateClient
+170  RtlSplay
+169  IopAllocateIrp
+164  ObOpenObjectByName
+160  Exfi386InterlockedExchangeUlong
+159  ExAcquireSharedWaitForExclusive
+159  ObReferenceObjectByHandle
+153  ExAcquireResourceSharedLite
+148  ExInterlockedPushEntrySList
+145  CcMapAndRead
+139  FsRtlLookupLargeMcbEntry
+137  InterlockedDecrement
+133  SeCreateAccessState
+125  ObpLookupObjectName
+123  FsRtlIsFatDbcsLegal
+120  ExfInterlockedAddUlong
+120  MmProbeAndLockPages
+113  CcUnpinFileData
+112  ObpCaptureObjectName
+106  ExAcquireHandleTableShared
+105  IoCreateFile
+104  ObfDereferenceObject
+103  InterlockedIncrement
+102  CcSetDirtyPinnedData
+ 96  KeLeaveCriticalRegion
+ 95  ExFreePool
+ 92  CcUnpinData
+ 92  IoFreeIrp
+ 91  MmCheckCachedPageState
+ 91  RtlEqualUnicodeString
+ 91  RtlIsNameLegalDOS8Dot3
+ 90  MiCleanSection
+ 89  CcInitializeCacheMap
+ 88  FsRtlFindLargeIndex
+ 87  CcMapAndCopy
+ 85  CcPinMappedData
+ 85  MiRemovePageByColor
+ 85  MmUnmapViewInSystemCache
+ 85  RtlpCaptureContext
+ 84  RtlFillMemoryUlong
+ 82  ObpAllocateObject
+ 81  RtlCopyUnicodeString
+ 80  CcFreeVirtualAddress
+ 79  ExAcquireFastMutexUnsafe
+ 77  IopDeleteFile
+ 75  FsRtlAllocateResource
+ 75  KiSetCR0Bits
+ 74  ExInterlockedCompareExchange64
+ 72  ExAllocatePool
+ 72  IoGetRelatedDeviceObject
+ 71  KeRemoveQueue
+ 70  ExReleaseHandleTableShared
+ 68  CcAcquireByteRangeForWrite
+ 68  IofCallDriver
+ 67  FsRtlCheckOplock
+ 66  ElapsedDaysToYears
+ 65  IopCloseFile
+ 65  KefAcquireSpinLockAtDpcLevel
+ 64  ObpIncrementHandleCount
+ 63  ExTryToAcquireResourceExclusiveLite
+ 63  FsRtlAddToTunnelCache
+ 62  IopCompleteRequest
+ 61  CcFlushCache
+ 61  CcGetVirtualAddressIfMapped
+ 61  IoSetThreadHardErrorMode
+ 61  ObCreateObject
+ 60  IoFastQueryNetworkAttributes
+ 59  CcPrepareMdlWrite
+ 57  CcCanIWrite
+ 57  CcWriteBehind
+ 56  RtlExtendedMagicDivide
+ 55  MiLocateAndReserveWsle
+ 55  NtSetInformationFile
+ 55  ObpAllocateObjectNameBuffer
+ 53  CcLazyWriteScan
+ 53  RtlNtStatusToDosErrorNoTeb
+ 52  KeReadStateQueue
+ 52  MiCheckProtoPtePageState
+ 52  ObReferenceObjectByPointer
+ 51  CcAllocateInitializeBcb
+ 51  PsReferencePrimaryToken
+ 50  CcSetDirtyInMask
+ 50  FsRtlFindInTunnelCache
+ 50  IopParseFile
+ 50  KeSynchronizeExecution
+ 49  _NLG_Return2
+ 49  KeQuerySystemTime
+ 48  CcGetVacbMiss
+ 48  NtClose
+ 48  ObpDecrementHandleCount
+ 47  IoGetInitialStack
+ 47  ObpCreateHandle
+ 46  MiInsertPageInList
+ 46  MiWaitForInPageComplete
+ 44  FsRtlGetNextLargeMcbEntry
+ 44  IopCheckDeviceAndDriver
+ 43  KeInsertHeadQueue
+ 43  MiDecrementShareCount2
+ 43  RtlUpcaseUnicodeStringToOemString
+ 42  ExAcquireSharedStarveExclusive
+ 42  ExpFindCurrentThread
+ 41  _abnormal_termination
+ 41  CcMdlRead
+ 41  CcUninitializeCacheMap
+ 41  RtlUnicodeToOemN
+ 40  FsRtlOplockFsctrl
+ 40  IoAllocateMdl
+ 39  ExReleaseHandleTableExclusive
+ 39  MmSetAddressRangeModified
+ 38  CcSetFileSizes
+ 38  ExCreateHandle
+ 38  KeEnterCriticalRegion
+ 38  MiDecrementReferenceCount
+ 38  MmUnlockPages
+ 38  ObpFreeObject
+ 38  PsAssignImpersonationToken
+ 38  RtlMapGenericMask
+ 37  CcCopyRead
+ 37  PsReferenceImpersonationToken
+ 36  IoGetRequestorProcess
+ 36  SeTokenType
+ 35  ObpFreeObjectNameBuffer
+ 35  RtlUpcaseUnicodeString
+ 34  IopCheckBackupRestorePrivilege
+ 34  MmMapViewInSystemCache
+ 34  RtlCompressChunks
+ 34  RtlInsertElementGenericTable
+ 33  CcPinRead
+ 33  IoBuildSynchronousFsdRequest
+ 33  MmFlushSection
+ 32  IoAllocateErrorLogEntry
+ 32  MiAllocatePoolPages
+ 32  RtlUpcaseUnicodeChar
+ 31  MmPurgeSection
+ 30  FsRtlFastCheckLockForRead
+ 30  MiReserveSystemPtes
+ 30  PsOpenTokenOfProcess
+ 29  FsRtlOplockCleanup
+ 29  IoIsOperationSynchronous
+ 29  MiFreePoolPages
+ 29  SeAssignSecurity
+ 29  SeDeleteAccessState
+ 28  FsRtlRequestExclusiveOplock
+ 28  IoBuildPartialMdl
+ 28  IoCheckFunctionAccess
+ 28  PsChargeSharedPoolQuota
+ 28  RtlAreAnyAccessesGranted
+ 27  FsRtlUninitializeOplock
+ 27  IoEnqueueIrp
+ 27  MmCreateSection
+ 27  ObpDeleteNameCheck
+ 26  IoCancelIrp
+ 26  RtlpDidUnicodeToOemWork
+ 25  CcFreeActiveVacb
+ 25  ExAllocateFromPagedLookasideList
+ 25  ExIsResourceAcquiredExclusiveLite
+ 25  SeCaptureSubjectContext
+ 24  DebugService
+ 24  KeGetCurrentThread
+ 24  MiCreateDataFileMap
+ 24  RtlpGetStackLimits
+ 23  CcMdlWriteComplete2
+ 23  IoSetShareAccess
+ 23  KeResetEvent
+ 23  MiLocateWsle
+ 23  MiUnlinkPageFromList
+ 23  ObpRemoveObjectRoutine
+ 23  ObWaitForSingleObject
+ 22  CcPreparePinWrite
+ 22  PspDeleteThreadSecurity
+ 22  SeComputeQuotaInformationSize
+ 21  ExDestroyHandle
+ 21  FsRtlDoesNameContainWildCards
+ 21  MiRemoveMappedPtes
+ 21  MiUpdateWsle
+ 21  RawCheckForDismount
+ 21  RtlOemToUnicodeN
+ 21  SeUnlockSubjectContext
+ 20  CcWorkerThread
+ 20  ExInitializeResourceLite
+ 20  ExpAcquireResourceSharedLite
+ 20  ExpWaitForResource
+ 20  FsRtlIsNameInExpression
+ 20  FsRtlOplockBreakToII
+ 20  FsRtlPruneTunnelCache
+ 20  MiDispatchFault
+ 19  IoFreeMdl
+ 19  IoInitializeIrp
+ 19  KefReleaseSpinLockFromDpcLevel
+ 19  KeInsertQueue
+ 19  KeWaitForSingleObject
+ 19  MiCheckControlArea
+ 19  ObpIncrementUnnamedHandleCount
+ 19  RtlDowncaseUnicodeString
+ 19  RtlUnicodeStringToOemString
+ 19  SepFilterPrivilegeAudits
+ 18  ExAcquireHandleTableExclusive
+ 18  FsRtlAreNamesEqual
+ 18  IopDereferenceVpbAndFree
+ 18  KeInitializeDpc
+ 18  ObpLookupDirectoryEntry
+ 17  CcDeallocateBcb
+ 17  ExMapHandleToPointer
+ 17  FsRtlRemoveMcbEntryPrivate
+ 17  IopQueryName
+ 17  IoSetTopLevelIrp
+ 16  CcCopyReadExceptionFilter
+ 16  ExGetSharedWaiterCount
+ 16  ExInterlockedAddLargeInteger
+ 16  ExpWorkerThread
+ 16  ExReinitializeResourceLite
+ 16  FsRtlFastCheckLockForWrite
+ 16  FsRtlFastUnlockSingleExclusive
+ 16  MmAccessFault
+ 16  MmMapLockedPages
+ 16  RtlOemStringToUnicodeString
+ 16  RtlTimeToSecondsSince1970
+ 16  RtlUpcaseUnicodeStringToCountedOemString
+ 15  FsRtlRemoveLargeMcbEntry
+ 15  IoGetTopLevelIrp
+ 15  KeInsertDeviceQueue
+ 15  MiRemoveZeroPage
+ 15  RtlDelete
+ 15  SeTokenImpersonationLevel
+ 14  CcGetDirtyPages
+ 14  ExDeletePagedLookasideList
+ 14  FsRtlAddLargeMcbEntry
+ 14  FsRtlFindFirstOverlappingExclusiveNode
+ 14  IopErrorLogRequeueEntry
+ 14  MiReleaseSystemPtes
+ 14  ObpChargeQuotaForObject
+ 14  RtlpLengthInheritedAce
+ 14  SeSetAccessStateGenericMapping
+ 13  CcPerformReadAhead
+ 13  FsRtlRemoveAndCompleteWaitIrp
+ 13  IoAcquireCancelSpinLock
+ 13  IoBuildDeviceIoControlRequest
+ 13  IoCheckShareAccess
+ 13  IoSynchronousPageWrite
+ 13  MiInitializeReadInProgressPfn
+ 13  RtlUnicodeStringToCountedOemString
+ 12  CcDeleteSharedCacheMap
+ 12  ExSystemTimeToLocalTime
+ 12  FsRtlAllocateOplock
+ 12  FsRtlDeregisterUncProvider
+ 12  FsRtlTruncateLargeMcb
+ 12  FsRtlWaitOnIrp
+ 12  IopCheckVpbMounted
+ 12  KeInsertQueueDpc
+ 12  KiSwapThread
+ 12  MiInitializePfn
+ 12  MmIsAddressValid
+ 12  ObGetObjectPointerCount
+ 12  RtlPrefixUnicodeString
+ 12  VdmpDelayIntApcRoutine
+ 11  ExFreeToPagedLookasideList
+ 11  ExpAcquireSharedStarveExclusive
+ 11  FsRtlOplockIsFastIoPossible
+ 11  MiReleaseWsle
+ 11  MiRemoveUnusedSegments
+ 11  MiReserveSystemPtes2
+ 11  ObSetSecurityDescriptorInfo
+ 10  _allmul
+ 10  ExAllocatePoolWithQuotaTag
+ 10  FsRtlAcquireFileForCcFlush
+ 10  IoStartPacket
+ 10  KeInitializeEvent
+ 10  KeWaitForMultipleObjects
+ 10  MiInitializeCopyOnWritePfn
+ 10  MiRemovePageFromList
+ 10  MiSegmentDelete
+ 10  MmBuildMdlForNonPagedPool
+ 10  MmUnmapLockedPages
+ 10  SeAuditingFileEvents
+ 10  SwapSplayLinks
+  9  FsRtlLookupLastLargeMcbEntry
+  9  IopIsDeviceInstanceEnabled
+  9  KeInitializeSpinLock
+  9  KiAcquireSpinLock
+  9  MiRemoveAnyPage
+  9  MiRemoveWsleFromFreeList
+  9  MiResolveProtoPteFault
+  9  NtWaitForSingleObject
+  9  ObpInsertHandleCount
+  9  RtlpGetExtraStuffPointer
+  9  RtlSetBits
+  9  SeReleaseSubjectContext
+  9  SeValidSecurityDescriptor
+  8  DaysAndFractionToTime
+  8  ExInterlockedExchangeAddLargeInteger
+  8  FsRtlCurrentBatchOplock
+  8  FsRtlPrivateLock
+  8  IoCreateStreamFileObject
+  8  IopReportResourceUsage
+  8  KiDeliverApc
+  8  LpcpClosePort
+  8  MiAccessCheck
+  8  MiMakeProtectionMask
+  8  MiResolveMappedFileFault
+  8  ObInsertObject
+  8  ObpIncrementHandleDataBase
+  8  ObpValidateAccessMask
+  8  PsReturnSharedPoolQuota
+  8  PsWatchWorkingSet
+  8  RtlDeleteElementGenericTable
+  7  CcReleaseByteRangeFromWrite
+  7  ExCreateHandleTable
+  7  FsRtlPrivateFastUnlockAll
+  7  IoCheckDesiredAccess
+  7  IoCreateDevice
+  7  MiCompleteProtoPteFault
+  7  MiMakeSystemAddressValidPfnWs
+  7  MiMapPageInHyperSpace
+  7  ObpCreateUnnamedHandle
+  7  RtlExtendedLargeIntegerDivide
+  7  RtlSubtreePredecessor
+  7  SepAccessCheck
+  6  CcCopyWrite
+  6  CcUnmapVacbArray
+  6  CcUnpinDataForThread
+  6  ExNotifyCallback
+  6  ExReleaseResourceForThreadLite
+  6  FsRtlAcknowledgeOplockBreak
+  6  FsRtlAddLargeEntry
+  6  FsRtlInitializeLargeMcb
+  6  FsRtlMdlWriteCompleteDev
+  6  FsRtlPrivateCheckForExclusiveLockAccess
+  6  IoAllocateAdapterChannel
+  6  IoGetAttachedDevice
+  6  IoRaiseInformationalHardError
+  6  IoRemoveShareAccess
+  6  MiCheckControlAreaStatus
+  6  MiMakeSystemAddressValidPfn
+  6  MiRemoveWsle
+  6  ObDeleteCapturedInsertInfo
+  6  ObReferenceObjectByName
+  6  RtlClearBits
+  6  RtlpGenerateInheritedAce
+  6  RtlxOemStringToUnicodeSize
+  6  SepCheckAcl
+  5  CcPostWorkQueue
+  5  CcScheduleReadAhead
+  5  CcSetValidData
+  5  ExEnumHandleTable
+  5  ExQueueWorkItem
+  5  FsRtlReleaseFileForCcFlush
+  5  KeSetEvent
+  5  MiChargeCommitmentCantExpand
+  5  MiFindActualFaultingPte
+  5  MiGetEventCounter
+  5  NtDeleteFile
+  5  RtlAreBitsClear
+  5  RtlDeleteNoSplay
+  5  RtlInitializeSid
+  5  RtlLookupElementGenericTable
+  5  RtlpGenerateInheritAcl
+  4  CcMdlWriteComplete
+  4  ExAcquireResourceExclusiveLite
+  4  ExDeleteResourceLite
+  4  ExfInterlockedInsertTailList
+  4  ExIsResourceAcquiredSharedLite
+  4  FsRtlOplockBreakNotify
+  4  IoCheckEaBufferValidity
+  4  IopOpenLinkOrRenameTarget
+  4  IoQueueThreadIrp
+  4  IoRegisterShutdownNotification
+  4  Ke386GetGdtEntryThread
+  4  KeReadStateTimer
+  4  KeRemoveDeviceQueue
+  4  KiRetireDpcList
+  4  MiDeletePte
+  4  MiEnsureAvailablePageOrWait
+  4  MiGetInPageSupportBlock
+  4  MiSectionDelete
+  4  RtlLengthSecurityDescriptor
+  4  RtlRealSuccessor
+  4  RtlUpcaseUnicodeStringToAnsiString
+  4  SepAdtGenerateDiscardAudit
+  4  SepInheritAcl
+  4  SepSidInToken
+  3  CcCreateVacbArray
+  3  CcMdlReadComplete2
+  3  ExInterlockedAddLargeStatistic
+  3  FsRtlCheckForMatchingFileObject
+  3  FsRtlCheckLockForWriteAccess
+  3  FsRtlPrivateInsertLock
+  3  FsRtlPrivateLimitFreeLockList
+  3  FsRtlPrivateResetLowestLockOffset
+  3  IoCancelThreadIo
+  3  IoPageRead
+  3  IoReleaseCancelSpinLock
+  3  IoSetInformation
+  3  IoStartNextPacket
+  3  IoStopTimer
+  3  KeClearEvent
+  3  KeInitializeApc
+  3  KeInsertByKeyDeviceQueue
+  3  KeRemoveByKeyDeviceQueue
+  3  KiQuantumEnd
+  3  MiAddValidPageToWorkingSet
+  3  MiDeleteSystemPagableVm
+  3  MiInsertFrontModifiedNoWrite
+  3  MiLocateSubsection
+  3  MiRemoveWorkingSetPages
+  3  MiRestoreTransitionPte
+  3  MiTrimWorkingSet
+  3  RtlAreBitsSet
+  3  RtlConvertUlongToLargeInteger
+  3  RtlCopyLuidAndAttributesArray
+  3  RtlCreateAcl
+  3  RtlLargeIntegerDivide
+  3  RtlpLengthInheritAcl
+  3  SeAccessCheck
+  2  _wcsicmp
+  2  CcExtendVacbArray
+  2  CcSetReadAheadGranularity
+  2  CcUnmapVacb
+  2  ExfInterlockedInsertHeadList
+  2  FsRtlCheckLockForReadAccess
+  2  FsRtlFreeFirstMapping
+  2  FsRtlMdlReadComplete
+  2  FsRtlNumberOfRunsInLargeMcb
+  2  FsRtlOpBatchBreakClosePending
+  2  FsRtlPrivateCheckWaitingLocks
+  2  FsRtlPrivateInitializeFileLock
+  2  FsRtlPrivateInsertExclusiveLock
+  2  FsRtlReleaseFileForModWrite
+  2  FsRtlRemoveAndCompleteIrp
+  2  FsRtlUninitializeFileLock
+  2  IoCreateNotificationEvent
+  2  IoGetDeviceToVerify
+  2  IopMountVolume
+  2  IoUpdateShareAccess
+  2  KeReleaseWaitForSemaphore
+  2  KiTrap0E
+  2  MiCheckForControlAreaDeletion
+  2  MiDetermineUserGlobalPteMask
+  2  MiFlushInPageSupportBlock
+  2  MiFreeEventCounter
+  2  MiInitializeTransitionPfn
+  2  MiInsertWsle
+  2  MiMapPageToZeroInHyperSpace
+  2  MiModifiedPageWriterWorker
+  2  MiResolveDemandZeroFault
+  2  MiResolveTransitionFault
+  2  MmCanFileBeTruncated
+  2  MmCanFileBeTruncatedInternal
+  2  MmDeterminePoolType
+  2  MmFlushImageSection
+  2  RtlAllocateAndInitializeSid
+  2  RtlEnumerateGenericTable
+  2  RtlEqualPrefixSid
+  2  RtlEqualSid
+  2  RtlExtendedIntegerMultiply
+  2  RtlFirstFreeAce
+  2  RtlIsGenericTableEmpty
+  2  RtlOemStringToCountedUnicodeString
+  2  RtlUpperString
+  2  SeFreeCapturedSecurityQos
+  2  SeLockSubjectContext
+  1  _vsnprintf
+  1  CcGetLsnForFileObject
+  1  CcPurgeAndClearCacheSection
+  1  CcZeroData
+  1  ExecuteHandler
+  1  ExLocalTimeToSystemTime
+  1  ExRaiseException
+  1  ExReleaseFastMutexUnsafe
+  1  FsRtlCancelExclusiveIrp
+  1  FsRtlFastUnlockAll
+  1  FsRtlFastUnlockAllByKey
+  1  FsRtlFastUnlockSingleShared
+  1  FsRtlFindFirstOverlappingSharedNode
+  1  FsRtlGetNextMcbEntry
+  1  FsRtlPrivateInsertSharedLock
+  1  FsRtlPrivateRemoveLock
+  1  FsRtlRequestOplockII
+  1  FsRtlSyncVolumes
+  1  FsRtlUninitializeLargeMcb
+  1  IopTimerDispatch
+  1  IoUnregisterFsRegistrationChange
+  1  KeContextToKframes
+  1  KeFlushQueueApc
+  1  KeSetEventBoostPriority
+  1  KiReleaseSpinLock
+  1  KiSystemService
+  1  KiTimerExpiration
+  1  KiTimerListExpire
+  1  MiAddMappedPtes
+  1  MiCheckPdeForPagedPool
+  1  MiFlushPteList
+  1  MiFreeInPageSupportBlock
+  1  MiInitializePfnForOtherProcess
+  1  MiInsertVad
+  1  MiMakeOutswappedPageResident
+  1  MiReleasePageFileSpace
+  1  MiResolvePageFileFault
+  1  MmWorkingSetManager
+  1  PsReturnPoolQuota
+  1  RtlAddAuditAccessAce
+  1  RtlDispatchException
+  1  RtlInitializeGenericTable
+  1  RtlNumberOfClearBits
+  1  RtlpGetReturnAddress
+  1  RtlSecondsSince1970ToTime
+  1  RtlSetAllBits
+  1  RtlValidSecurityDescriptor
+  1  SepApplyAclToObject
+  1  SepConcatenatePrivileges
+  1  SepGetDefaultsSubjectContext
+
+
\ No newline at end of file
diff --git a/private/ntos/init/up/ntoskrnl.x86 b/private/ntos/init/up/ntoskrnl.x86
new file mode 100644
index 000000000..e3177d515
--- /dev/null
+++ b/private/ntos/init/up/ntoskrnl.x86
@@ -0,0 +1,542 @@
+916  MiZeroPhysicalPage
+749  ExReleaseResourceLite
+712  MmZeroPageThread
+671  IopParseDevice
+535  ExAllocatePoolWithTag
+498  ExInterlockedPopEntrySList
+459  ExFreePoolWithTag
+390  CcMapData
+379  RtlFindClearBits
+349  memmove
+327  CcFindBcb
+326  IoAllocateIrp
+293  FsRtlDissectName
+280  KiInterruptDispatch
+277  CcFastCopyRead
+272  FsRtlIsNameInExpressionPrivate
+269  RtlCompareMemory
+254  MmCopyToCachedPage
+251  RtlUpcaseUnicodeToOemN
+242  CcPinFileData
+240  ObpCaptureObjectCreateInformation
+232  CcGetVirtualAddress
+232  KiDispatchInterrupt
+227  RtlCompareUnicodeString
+208  Exfi386InterlockedDecrementLong
+205  ExpAcquireResourceExclusiveLite
+204  IofCompleteRequest
+187  CcFastCopyWrite
+184  MiFlushSectionInternal
+180  RtlTimeToTimeFields
+178  PsImpersonateClient
+170  RtlSplay
+169  IopAllocateIrp
+164  ObOpenObjectByName
+160  Exfi386InterlockedExchangeUlong
+159  ExAcquireSharedWaitForExclusive
+159  ObReferenceObjectByHandle
+153  ExAcquireResourceSharedLite
+148  ExInterlockedPushEntrySList
+145  CcMapAndRead
+139  FsRtlLookupLargeMcbEntry
+137  InterlockedDecrement
+133  SeCreateAccessState
+125  ObpLookupObjectName
+123  FsRtlIsFatDbcsLegal
+120  ExfInterlockedAddUlong
+120  MmProbeAndLockPages
+113  CcUnpinFileData
+112  ObpCaptureObjectName
+106  ExAcquireHandleTableShared
+105  IoCreateFile
+104  ObfDereferenceObject
+103  InterlockedIncrement
+102  CcSetDirtyPinnedData
+ 96  KeLeaveCriticalRegion
+ 95  ExFreePool
+ 92  CcUnpinData
+ 92  IoFreeIrp
+ 91  MmCheckCachedPageState
+ 91  RtlEqualUnicodeString
+ 91  RtlIsNameLegalDOS8Dot3
+ 90  MiCleanSection
+ 89  CcInitializeCacheMap
+ 88  FsRtlFindLargeIndex
+ 87  CcMapAndCopy
+ 85  CcPinMappedData
+ 85  MiRemovePageByColor
+ 85  MmUnmapViewInSystemCache
+ 85  RtlpCaptureContext
+ 84  RtlFillMemoryUlong
+ 82  ObpAllocateObject
+ 81  RtlCopyUnicodeString
+ 80  CcFreeVirtualAddress
+ 79  ExAcquireFastMutexUnsafe
+ 77  IopDeleteFile
+ 75  FsRtlAllocateResource
+ 75  KiSetCR0Bits
+ 74  ExInterlockedCompareExchange64
+ 72  ExAllocatePool
+ 72  IoGetRelatedDeviceObject
+ 71  KeRemoveQueue
+ 70  ExReleaseHandleTableShared
+ 68  CcAcquireByteRangeForWrite
+ 68  IofCallDriver
+ 67  FsRtlCheckOplock
+ 66  ElapsedDaysToYears
+ 65  IopCloseFile
+ 65  KefAcquireSpinLockAtDpcLevel
+ 64  ObpIncrementHandleCount
+ 63  ExTryToAcquireResourceExclusiveLite
+ 63  FsRtlAddToTunnelCache
+ 62  IopCompleteRequest
+ 61  CcFlushCache
+ 61  CcGetVirtualAddressIfMapped
+ 61  IoSetThreadHardErrorMode
+ 61  ObCreateObject
+ 60  IoFastQueryNetworkAttributes
+ 59  CcPrepareMdlWrite
+ 57  CcCanIWrite
+ 57  CcWriteBehind
+ 56  RtlExtendedMagicDivide
+ 55  MiLocateAndReserveWsle
+ 55  NtSetInformationFile
+ 55  ObpAllocateObjectNameBuffer
+ 53  CcLazyWriteScan
+ 53  RtlNtStatusToDosErrorNoTeb
+ 52  KeReadStateQueue
+ 52  MiCheckProtoPtePageState
+ 52  ObReferenceObjectByPointer
+ 51  CcAllocateInitializeBcb
+ 51  PsReferencePrimaryToken
+ 50  CcSetDirtyInMask
+ 50  FsRtlFindInTunnelCache
+ 50  IopParseFile
+ 50  KeSynchronizeExecution
+ 49  _NLG_Return2
+ 49  KeQuerySystemTime
+ 48  CcGetVacbMiss
+ 48  NtClose
+ 48  ObpDecrementHandleCount
+ 47  IoGetInitialStack
+ 47  ObpCreateHandle
+ 46  MiInsertPageInList
+ 46  MiWaitForInPageComplete
+ 44  FsRtlGetNextLargeMcbEntry
+ 44  IopCheckDeviceAndDriver
+ 43  KeInsertHeadQueue
+ 43  MiDecrementShareCount2
+ 43  RtlUpcaseUnicodeStringToOemString
+ 42  ExAcquireSharedStarveExclusive
+ 42  ExpFindCurrentThread
+ 41  _abnormal_termination
+ 41  CcMdlRead
+ 41  CcUninitializeCacheMap
+ 41  RtlUnicodeToOemN
+ 40  FsRtlOplockFsctrl
+ 40  IoAllocateMdl
+ 39  ExReleaseHandleTableExclusive
+ 39  MmSetAddressRangeModified
+ 38  CcSetFileSizes
+ 38  ExCreateHandle
+ 38  KeEnterCriticalRegion
+ 38  MiDecrementReferenceCount
+ 38  MmUnlockPages
+ 38  ObpFreeObject
+ 38  PsAssignImpersonationToken
+ 38  RtlMapGenericMask
+ 37  CcCopyRead
+ 37  PsReferenceImpersonationToken
+ 36  IoGetRequestorProcess
+ 36  SeTokenType
+ 35  ObpFreeObjectNameBuffer
+ 35  RtlUpcaseUnicodeString
+ 34  IopCheckBackupRestorePrivilege
+ 34  MmMapViewInSystemCache
+ 34  RtlCompressChunks
+ 34  RtlInsertElementGenericTable
+ 33  CcPinRead
+ 33  IoBuildSynchronousFsdRequest
+ 33  MmFlushSection
+ 32  IoAllocateErrorLogEntry
+ 32  MiAllocatePoolPages
+ 32  RtlUpcaseUnicodeChar
+ 31  MmPurgeSection
+ 30  FsRtlFastCheckLockForRead
+ 30  MiReserveSystemPtes
+ 30  PsOpenTokenOfProcess
+ 29  FsRtlOplockCleanup
+ 29  IoIsOperationSynchronous
+ 29  MiFreePoolPages
+ 29  SeAssignSecurity
+ 29  SeDeleteAccessState
+ 28  FsRtlRequestExclusiveOplock
+ 28  IoBuildPartialMdl
+ 28  IoCheckFunctionAccess
+ 28  PsChargeSharedPoolQuota
+ 28  RtlAreAnyAccessesGranted
+ 27  FsRtlUninitializeOplock
+ 27  IoEnqueueIrp
+ 27  MmCreateSection
+ 27  ObpDeleteNameCheck
+ 26  IoCancelIrp
+ 26  RtlpDidUnicodeToOemWork
+ 25  CcFreeActiveVacb
+ 25  ExAllocateFromPagedLookasideList
+ 25  ExIsResourceAcquiredExclusiveLite
+ 25  SeCaptureSubjectContext
+ 24  DebugService
+ 24  KeGetCurrentThread
+ 24  MiCreateDataFileMap
+ 24  RtlpGetStackLimits
+ 23  CcMdlWriteComplete2
+ 23  IoSetShareAccess
+ 23  KeResetEvent
+ 23  MiLocateWsle
+ 23  MiUnlinkPageFromList
+ 23  ObpRemoveObjectRoutine
+ 23  ObWaitForSingleObject
+ 22  CcPreparePinWrite
+ 22  PspDeleteThreadSecurity
+ 22  SeComputeQuotaInformationSize
+ 21  ExDestroyHandle
+ 21  FsRtlDoesNameContainWildCards
+ 21  MiRemoveMappedPtes
+ 21  MiUpdateWsle
+ 21  RawCheckForDismount
+ 21  RtlOemToUnicodeN
+ 21  SeUnlockSubjectContext
+ 20  CcWorkerThread
+ 20  ExInitializeResourceLite
+ 20  ExpAcquireResourceSharedLite
+ 20  ExpWaitForResource
+ 20  FsRtlIsNameInExpression
+ 20  FsRtlOplockBreakToII
+ 20  FsRtlPruneTunnelCache
+ 20  MiDispatchFault
+ 19  IoFreeMdl
+ 19  IoInitializeIrp
+ 19  KefReleaseSpinLockFromDpcLevel
+ 19  KeInsertQueue
+ 19  KeWaitForSingleObject
+ 19  MiCheckControlArea
+ 19  ObpIncrementUnnamedHandleCount
+ 19  RtlDowncaseUnicodeString
+ 19  RtlUnicodeStringToOemString
+ 19  SepFilterPrivilegeAudits
+ 18  ExAcquireHandleTableExclusive
+ 18  FsRtlAreNamesEqual
+ 18  IopDereferenceVpbAndFree
+ 18  KeInitializeDpc
+ 18  ObpLookupDirectoryEntry
+ 17  CcDeallocateBcb
+ 17  ExMapHandleToPointer
+ 17  FsRtlRemoveMcbEntryPrivate
+ 17  IopQueryName
+ 17  IoSetTopLevelIrp
+ 16  CcCopyReadExceptionFilter
+ 16  ExGetSharedWaiterCount
+ 16  ExInterlockedAddLargeInteger
+ 16  ExpWorkerThread
+ 16  ExReinitializeResourceLite
+ 16  FsRtlFastCheckLockForWrite
+ 16  FsRtlFastUnlockSingleExclusive
+ 16  MmAccessFault
+ 16  MmMapLockedPages
+ 16  RtlOemStringToUnicodeString
+ 16  RtlTimeToSecondsSince1970
+ 16  RtlUpcaseUnicodeStringToCountedOemString
+ 15  FsRtlRemoveLargeMcbEntry
+ 15  IoGetTopLevelIrp
+ 15  KeInsertDeviceQueue
+ 15  MiRemoveZeroPage
+ 15  RtlDelete
+ 15  SeTokenImpersonationLevel
+ 14  CcGetDirtyPages
+ 14  ExDeletePagedLookasideList
+ 14  FsRtlAddLargeMcbEntry
+ 14  FsRtlFindFirstOverlappingExclusiveNode
+ 14  IopErrorLogRequeueEntry
+ 14  MiReleaseSystemPtes
+ 14  ObpChargeQuotaForObject
+ 14  RtlpLengthInheritedAce
+ 14  SeSetAccessStateGenericMapping
+ 13  CcPerformReadAhead
+ 13  FsRtlRemoveAndCompleteWaitIrp
+ 13  IoAcquireCancelSpinLock
+ 13  IoBuildDeviceIoControlRequest
+ 13  IoCheckShareAccess
+ 13  IoSynchronousPageWrite
+ 13  MiInitializeReadInProgressPfn
+ 13  RtlUnicodeStringToCountedOemString
+ 12  CcDeleteSharedCacheMap
+ 12  ExSystemTimeToLocalTime
+ 12  FsRtlAllocateOplock
+ 12  FsRtlDeregisterUncProvider
+ 12  FsRtlTruncateLargeMcb
+ 12  FsRtlWaitOnIrp
+ 12  IopCheckVpbMounted
+ 12  KeInsertQueueDpc
+ 12  KiSwapThread
+ 12  MiInitializePfn
+ 12  MmIsAddressValid
+ 12  ObGetObjectPointerCount
+ 12  RtlPrefixUnicodeString
+ 12  VdmpDelayIntApcRoutine
+ 11  ExFreeToPagedLookasideList
+ 11  ExpAcquireSharedStarveExclusive
+ 11  FsRtlOplockIsFastIoPossible
+ 11  MiReleaseWsle
+ 11  MiRemoveUnusedSegments
+ 11  MiReserveSystemPtes2
+ 11  ObSetSecurityDescriptorInfo
+ 10  _allmul
+ 10  ExAllocatePoolWithQuotaTag
+ 10  FsRtlAcquireFileForCcFlush
+ 10  IoStartPacket
+ 10  KeInitializeEvent
+ 10  KeWaitForMultipleObjects
+ 10  MiInitializeCopyOnWritePfn
+ 10  MiRemovePageFromList
+ 10  MiSegmentDelete
+ 10  MmBuildMdlForNonPagedPool
+ 10  MmUnmapLockedPages
+ 10  SeAuditingFileEvents
+ 10  SwapSplayLinks
+  9  FsRtlLookupLastLargeMcbEntry
+  9  IopIsDeviceInstanceEnabled
+  9  KeInitializeSpinLock
+  9  KiAcquireSpinLock
+  9  MiRemoveAnyPage
+  9  MiRemoveWsleFromFreeList
+  9  MiResolveProtoPteFault
+  9  NtWaitForSingleObject
+  9  ObpInsertHandleCount
+  9  RtlpGetExtraStuffPointer
+  9  RtlSetBits
+  9  SeReleaseSubjectContext
+  9  SeValidSecurityDescriptor
+  8  DaysAndFractionToTime
+  8  ExInterlockedExchangeAddLargeInteger
+  8  FsRtlCurrentBatchOplock
+  8  FsRtlPrivateLock
+  8  IoCreateStreamFileObject
+  8  IopReportResourceUsage
+  8  KiDeliverApc
+  8  LpcpClosePort
+  8  MiAccessCheck
+  8  MiMakeProtectionMask
+  8  MiResolveMappedFileFault
+  8  ObInsertObject
+  8  ObpIncrementHandleDataBase
+  8  ObpValidateAccessMask
+  8  PsReturnSharedPoolQuota
+  8  PsWatchWorkingSet
+  8  RtlDeleteElementGenericTable
+  7  CcReleaseByteRangeFromWrite
+  7  ExCreateHandleTable
+  7  FsRtlPrivateFastUnlockAll
+  7  IoCheckDesiredAccess
+  7  IoCreateDevice
+  7  MiCompleteProtoPteFault
+  7  MiMakeSystemAddressValidPfnWs
+  7  MiMapPageInHyperSpace
+  7  ObpCreateUnnamedHandle
+  7  RtlExtendedLargeIntegerDivide
+  7  RtlSubtreePredecessor
+  7  SepAccessCheck
+  6  CcCopyWrite
+  6  CcUnmapVacbArray
+  6  CcUnpinDataForThread
+  6  ExNotifyCallback
+  6  ExReleaseResourceForThreadLite
+  6  FsRtlAcknowledgeOplockBreak
+  6  FsRtlAddLargeEntry
+  6  FsRtlInitializeLargeMcb
+  6  FsRtlMdlWriteCompleteDev
+  6  FsRtlPrivateCheckForExclusiveLockAccess
+  6  IoAllocateAdapterChannel
+  6  IoGetAttachedDevice
+  6  IoRaiseInformationalHardError
+  6  IoRemoveShareAccess
+  6  MiCheckControlAreaStatus
+  6  MiMakeSystemAddressValidPfn
+  6  MiRemoveWsle
+  6  ObDeleteCapturedInsertInfo
+  6  ObReferenceObjectByName
+  6  RtlClearBits
+  6  RtlpGenerateInheritedAce
+  6  RtlxOemStringToUnicodeSize
+  6  SepCheckAcl
+  5  CcPostWorkQueue
+  5  CcScheduleReadAhead
+  5  CcSetValidData
+  5  ExEnumHandleTable
+  5  ExQueueWorkItem
+  5  FsRtlReleaseFileForCcFlush
+  5  KeSetEvent
+  5  MiChargeCommitmentCantExpand
+  5  MiFindActualFaultingPte
+  5  MiGetEventCounter
+  5  NtDeleteFile
+  5  RtlAreBitsClear
+  5  RtlDeleteNoSplay
+  5  RtlInitializeSid
+  5  RtlLookupElementGenericTable
+  5  RtlpGenerateInheritAcl
+  4  CcMdlWriteComplete
+  4  ExAcquireResourceExclusiveLite
+  4  ExDeleteResourceLite
+  4  ExfInterlockedInsertTailList
+  4  ExIsResourceAcquiredSharedLite
+  4  FsRtlOplockBreakNotify
+  4  IoCheckEaBufferValidity
+  4  IopOpenLinkOrRenameTarget
+  4  IoQueueThreadIrp
+  4  IoRegisterShutdownNotification
+  4  Ke386GetGdtEntryThread
+  4  KeReadStateTimer
+  4  KeRemoveDeviceQueue
+  4  KiRetireDpcList
+  4  MiDeletePte
+  4  MiEnsureAvailablePageOrWait
+  4  MiGetInPageSupportBlock
+  4  MiSectionDelete
+  4  RtlLengthSecurityDescriptor
+  4  RtlRealSuccessor
+  4  RtlUpcaseUnicodeStringToAnsiString
+  4  SepAdtGenerateDiscardAudit
+  4  SepInheritAcl
+  4  SepSidInToken
+  3  CcCreateVacbArray
+  3  CcMdlReadComplete2
+  3  ExInterlockedAddLargeStatistic
+  3  FsRtlCheckForMatchingFileObject
+  3  FsRtlCheckLockForWriteAccess
+  3  FsRtlPrivateInsertLock
+  3  FsRtlPrivateLimitFreeLockList
+  3  FsRtlPrivateResetLowestLockOffset
+  3  IoCancelThreadIo
+  3  IoPageRead
+  3  IoReleaseCancelSpinLock
+  3  IoSetInformation
+  3  IoStartNextPacket
+  3  IoStopTimer
+  3  KeClearEvent
+  3  KeInitializeApc
+  3  KeInsertByKeyDeviceQueue
+  3  KeRemoveByKeyDeviceQueue
+  3  KiQuantumEnd
+  3  MiAddValidPageToWorkingSet
+  3  MiDeleteSystemPagableVm
+  3  MiInsertFrontModifiedNoWrite
+  3  MiLocateSubsection
+  3  MiRemoveWorkingSetPages
+  3  MiRestoreTransitionPte
+  3  MiTrimWorkingSet
+  3  RtlAreBitsSet
+  3  RtlConvertUlongToLargeInteger
+  3  RtlCopyLuidAndAttributesArray
+  3  RtlCreateAcl
+  3  RtlLargeIntegerDivide
+  3  RtlpLengthInheritAcl
+  3  SeAccessCheck
+  2  _wcsicmp
+  2  CcExtendVacbArray
+  2  CcSetReadAheadGranularity
+  2  CcUnmapVacb
+  2  ExfInterlockedInsertHeadList
+  2  FsRtlCheckLockForReadAccess
+  2  FsRtlFreeFirstMapping
+  2  FsRtlMdlReadComplete
+  2  FsRtlNumberOfRunsInLargeMcb
+  2  FsRtlOpBatchBreakClosePending
+  2  FsRtlPrivateCheckWaitingLocks
+  2  FsRtlPrivateInitializeFileLock
+  2  FsRtlPrivateInsertExclusiveLock
+  2  FsRtlReleaseFileForModWrite
+  2  FsRtlRemoveAndCompleteIrp
+  2  FsRtlUninitializeFileLock
+  2  IoCreateNotificationEvent
+  2  IoGetDeviceToVerify
+  2  IopMountVolume
+  2  IoUpdateShareAccess
+  2  KeReleaseWaitForSemaphore
+  2  KiTrap0E
+  2  MiCheckForControlAreaDeletion
+  2  MiDetermineUserGlobalPteMask
+  2  MiFlushInPageSupportBlock
+  2  MiFreeEventCounter
+  2  MiInitializeTransitionPfn
+  2  MiInsertWsle
+  2  MiMapPageToZeroInHyperSpace
+  2  MiModifiedPageWriterWorker
+  2  MiResolveDemandZeroFault
+  2  MiResolveTransitionFault
+  2  MmCanFileBeTruncated
+  2  MmCanFileBeTruncatedInternal
+  2  MmDeterminePoolType
+  2  MmFlushImageSection
+  2  RtlAllocateAndInitializeSid
+  2  RtlEnumerateGenericTable
+  2  RtlEqualPrefixSid
+  2  RtlEqualSid
+  2  RtlExtendedIntegerMultiply
+  2  RtlFirstFreeAce
+  2  RtlIsGenericTableEmpty
+  2  RtlOemStringToCountedUnicodeString
+  2  RtlUpperString
+  2  SeFreeCapturedSecurityQos
+  2  SeLockSubjectContext
+  1  _vsnprintf
+  1  CcGetLsnForFileObject
+  1  CcPurgeAndClearCacheSection
+  1  CcZeroData
+  1  ExecuteHandler
+  1  ExLocalTimeToSystemTime
+  1  ExRaiseException
+  1  ExReleaseFastMutexUnsafe
+  1  FsRtlCancelExclusiveIrp
+  1  FsRtlFastUnlockAll
+  1  FsRtlFastUnlockAllByKey
+  1  FsRtlFastUnlockSingleShared
+  1  FsRtlFindFirstOverlappingSharedNode
+  1  FsRtlGetNextMcbEntry
+  1  FsRtlPrivateInsertSharedLock
+  1  FsRtlPrivateRemoveLock
+  1  FsRtlRequestOplockII
+  1  FsRtlSyncVolumes
+  1  FsRtlUninitializeLargeMcb
+  1  IopTimerDispatch
+  1  IoUnregisterFsRegistrationChange
+  1  KeContextToKframes
+  1  KeFlushQueueApc
+  1  KeSetEventBoostPriority
+  1  KiReleaseSpinLock
+  1  KiSystemService
+  1  KiTimerExpiration
+  1  KiTimerListExpire
+  1  MiAddMappedPtes
+  1  MiCheckPdeForPagedPool
+  1  MiFlushPteList
+  1  MiFreeInPageSupportBlock
+  1  MiInitializePfnForOtherProcess
+  1  MiInsertVad
+  1  MiMakeOutswappedPageResident
+  1  MiReleasePageFileSpace
+  1  MiResolvePageFileFault
+  1  MmWorkingSetManager
+  1  PsReturnPoolQuota
+  1  RtlAddAuditAccessAce
+  1  RtlDispatchException
+  1  RtlInitializeGenericTable
+  1  RtlNumberOfClearBits
+  1  RtlpGetReturnAddress
+  1  RtlSecondsSince1970ToTime
+  1  RtlSetAllBits
+  1  RtlValidSecurityDescriptor
+  1  SepApplyAclToObject
+  1  SepConcatenatePrivileges
+  1  SepGetDefaultsSubjectContext
+
+
\ No newline at end of file
diff --git a/private/ntos/init/up/ppc.prf b/private/ntos/init/up/ppc.prf
new file mode 100644
index 000000000..dc01569d7
--- /dev/null
+++ b/private/ntos/init/up/ppc.prf
@@ -0,0 +1,542 @@
+MiZeroPhysicalPage
+ExReleaseResourceLite
+MmZeroPageThread
+IopParseDevice
+ExAllocatePoolWithTag
+ExInterlockedPopEntrySList
+ExFreePoolWithTag
+CcMapData
+RtlFindClearBits
+memmove
+CcFindBcb
+IoAllocateIrp
+FsRtlDissectName
+KiInterruptDispatch
+CcFastCopyRead
+FsRtlIsNameInExpressionPrivate
+RtlCompareMemory
+MmCopyToCachedPage
+RtlUpcaseUnicodeToOemN
+CcPinFileData
+ObpCaptureObjectCreateInformation
+CcGetVirtualAddress
+KiDispatchInterrupt
+RtlCompareUnicodeString
+Exfi386InterlockedDecrementLong
+ExpAcquireResourceExclusiveLite
+IofCompleteRequest
+CcFastCopyWrite
+MiFlushSectionInternal
+RtlTimeToTimeFields
+PsImpersonateClient
+RtlSplay
+IopAllocateIrp
+ObOpenObjectByName
+Exfi386InterlockedExchangeUlong
+ExAcquireSharedWaitForExclusive
+ObReferenceObjectByHandle
+ExAcquireResourceSharedLite
+ExInterlockedPushEntrySList
+CcMapAndRead
+FsRtlLookupLargeMcbEntry
+InterlockedDecrement
+SeCreateAccessState
+ObpLookupObjectName
+FsRtlIsFatDbcsLegal
+ExfInterlockedAddUlong
+MmProbeAndLockPages
+CcUnpinFileData
+ObpCaptureObjectName
+ExAcquireHandleTableShared
+IoCreateFile
+ObfDereferenceObject
+InterlockedIncrement
+CcSetDirtyPinnedData
+KeLeaveCriticalRegion
+ExFreePool
+CcUnpinData
+IoFreeIrp
+MmCheckCachedPageState
+RtlEqualUnicodeString
+RtlIsNameLegalDOS8Dot3
+MiCleanSection
+CcInitializeCacheMap
+FsRtlFindLargeIndex
+CcMapAndCopy
+CcPinMappedData
+MiRemovePageByColor
+MmUnmapViewInSystemCache
+RtlpCaptureContext
+RtlFillMemoryUlong
+ObpAllocateObject
+RtlCopyUnicodeString
+CcFreeVirtualAddress
+ExAcquireFastMutexUnsafe
+IopDeleteFile
+FsRtlAllocateResource
+KiSetCR0Bits
+ExInterlockedCompareExchange64
+ExAllocatePool
+IoGetRelatedDeviceObject
+KeRemoveQueue
+ExReleaseHandleTableShared
+CcAcquireByteRangeForWrite
+IofCallDriver
+FsRtlCheckOplock
+ElapsedDaysToYears
+IopCloseFile
+KefAcquireSpinLockAtDpcLevel
+ObpIncrementHandleCount
+ExTryToAcquireResourceExclusiveLite
+FsRtlAddToTunnelCache
+IopCompleteRequest
+CcFlushCache
+CcGetVirtualAddressIfMapped
+IoSetThreadHardErrorMode
+ObCreateObject
+IoFastQueryNetworkAttributes
+CcPrepareMdlWrite
+CcCanIWrite
+CcWriteBehind
+RtlExtendedMagicDivide
+MiLocateAndReserveWsle
+NtSetInformationFile
+ObpAllocateObjectNameBuffer
+CcLazyWriteScan
+RtlNtStatusToDosErrorNoTeb
+KeReadStateQueue
+MiCheckProtoPtePageState
+ObReferenceObjectByPointer
+CcAllocateInitializeBcb
+PsReferencePrimaryToken
+CcSetDirtyInMask
+FsRtlFindInTunnelCache
+IopParseFile
+KeSynchronizeExecution
+_NLG_Return2
+KeQuerySystemTime
+CcGetVacbMiss
+NtClose
+ObpDecrementHandleCount
+IoGetInitialStack
+ObpCreateHandle
+MiInsertPageInList
+MiWaitForInPageComplete
+FsRtlGetNextLargeMcbEntry
+IopCheckDeviceAndDriver
+KeInsertHeadQueue
+MiDecrementShareCount2
+RtlUpcaseUnicodeStringToOemString
+ExAcquireSharedStarveExclusive
+ExpFindCurrentThread
+_abnormal_termination
+CcMdlRead
+CcUninitializeCacheMap
+RtlUnicodeToOemN
+FsRtlOplockFsctrl
+IoAllocateMdl
+ExReleaseHandleTableExclusive
+MmSetAddressRangeModified
+CcSetFileSizes
+ExCreateHandle
+KeEnterCriticalRegion
+MiDecrementReferenceCount
+MmUnlockPages
+ObpFreeObject
+PsAssignImpersonationToken
+RtlMapGenericMask
+CcCopyRead
+PsReferenceImpersonationToken
+IoGetRequestorProcess
+SeTokenType
+ObpFreeObjectNameBuffer
+RtlUpcaseUnicodeString
+IopCheckBackupRestorePrivilege
+MmMapViewInSystemCache
+RtlCompressChunks
+RtlInsertElementGenericTable
+CcPinRead
+IoBuildSynchronousFsdRequest
+MmFlushSection
+IoAllocateErrorLogEntry
+MiAllocatePoolPages
+RtlUpcaseUnicodeChar
+MmPurgeSection
+FsRtlFastCheckLockForRead
+MiReserveSystemPtes
+PsOpenTokenOfProcess
+FsRtlOplockCleanup
+IoIsOperationSynchronous
+MiFreePoolPages
+SeAssignSecurity
+SeDeleteAccessState
+FsRtlRequestExclusiveOplock
+IoBuildPartialMdl
+IoCheckFunctionAccess
+PsChargeSharedPoolQuota
+RtlAreAnyAccessesGranted
+FsRtlUninitializeOplock
+IoEnqueueIrp
+MmCreateSection
+ObpDeleteNameCheck
+IoCancelIrp
+RtlpDidUnicodeToOemWork
+CcFreeActiveVacb
+ExAllocateFromPagedLookasideList
+ExIsResourceAcquiredExclusiveLite
+SeCaptureSubjectContext
+DebugService
+KeGetCurrentThread
+MiCreateDataFileMap
+RtlpGetStackLimits
+CcMdlWriteComplete2
+IoSetShareAccess
+KeResetEvent
+MiLocateWsle
+MiUnlinkPageFromList
+ObpRemoveObjectRoutine
+ObWaitForSingleObject
+CcPreparePinWrite
+PspDeleteThreadSecurity
+SeComputeQuotaInformationSize
+ExDestroyHandle
+FsRtlDoesNameContainWildCards
+MiRemoveMappedPtes
+MiUpdateWsle
+RawCheckForDismount
+RtlOemToUnicodeN
+SeUnlockSubjectContext
+CcWorkerThread
+ExInitializeResourceLite
+ExpAcquireResourceSharedLite
+ExpWaitForResource
+FsRtlIsNameInExpression
+FsRtlOplockBreakToII
+FsRtlPruneTunnelCache
+MiDispatchFault
+IoFreeMdl
+IoInitializeIrp
+KefReleaseSpinLockFromDpcLevel
+KeInsertQueue
+KeWaitForSingleObject
+MiCheckControlArea
+ObpIncrementUnnamedHandleCount
+RtlDowncaseUnicodeString
+RtlUnicodeStringToOemString
+SepFilterPrivilegeAudits
+ExAcquireHandleTableExclusive
+FsRtlAreNamesEqual
+IopDereferenceVpbAndFree
+KeInitializeDpc
+ObpLookupDirectoryEntry
+CcDeallocateBcb
+ExMapHandleToPointer
+FsRtlRemoveMcbEntryPrivate
+IopQueryName
+IoSetTopLevelIrp
+CcCopyReadExceptionFilter
+ExGetSharedWaiterCount
+ExInterlockedAddLargeInteger
+ExpWorkerThread
+ExReinitializeResourceLite
+FsRtlFastCheckLockForWrite
+FsRtlFastUnlockSingleExclusive
+MmAccessFault
+MmMapLockedPages
+RtlOemStringToUnicodeString
+RtlTimeToSecondsSince1970
+RtlUpcaseUnicodeStringToCountedOemString
+FsRtlRemoveLargeMcbEntry
+IoGetTopLevelIrp
+KeInsertDeviceQueue
+MiRemoveZeroPage
+RtlDelete
+SeTokenImpersonationLevel
+CcGetDirtyPages
+ExDeletePagedLookasideList
+FsRtlAddLargeMcbEntry
+FsRtlFindFirstOverlappingExclusiveNode
+IopErrorLogRequeueEntry
+MiReleaseSystemPtes
+ObpChargeQuotaForObject
+RtlpLengthInheritedAce
+SeSetAccessStateGenericMapping
+CcPerformReadAhead
+FsRtlRemoveAndCompleteWaitIrp
+IoAcquireCancelSpinLock
+IoBuildDeviceIoControlRequest
+IoCheckShareAccess
+IoSynchronousPageWrite
+MiInitializeReadInProgressPfn
+RtlUnicodeStringToCountedOemString
+CcDeleteSharedCacheMap
+ExSystemTimeToLocalTime
+FsRtlAllocateOplock
+FsRtlDeregisterUncProvider
+FsRtlTruncateLargeMcb
+FsRtlWaitOnIrp
+IopCheckVpbMounted
+KeInsertQueueDpc
+KiSwapThread
+MiInitializePfn
+MmIsAddressValid
+ObGetObjectPointerCount
+RtlPrefixUnicodeString
+VdmpDelayIntApcRoutine
+ExFreeToPagedLookasideList
+ExpAcquireSharedStarveExclusive
+FsRtlOplockIsFastIoPossible
+MiReleaseWsle
+MiRemoveUnusedSegments
+MiReserveSystemPtes2
+ObSetSecurityDescriptorInfo
+_allmul
+ExAllocatePoolWithQuotaTag
+FsRtlAcquireFileForCcFlush
+IoStartPacket
+KeInitializeEvent
+KeWaitForMultipleObjects
+MiInitializeCopyOnWritePfn
+MiRemovePageFromList
+MiSegmentDelete
+MmBuildMdlForNonPagedPool
+MmUnmapLockedPages
+SeAuditingFileEvents
+SwapSplayLinks
+FsRtlLookupLastLargeMcbEntry
+IopIsDeviceInstanceEnabled
+KeInitializeSpinLock
+KiAcquireSpinLock
+MiRemoveAnyPage
+MiRemoveWsleFromFreeList
+MiResolveProtoPteFault
+NtWaitForSingleObject
+ObpInsertHandleCount
+RtlpGetExtraStuffPointer
+RtlSetBits
+SeReleaseSubjectContext
+SeValidSecurityDescriptor
+DaysAndFractionToTime
+ExInterlockedExchangeAddLargeInteger
+FsRtlCurrentBatchOplock
+FsRtlPrivateLock
+IoCreateStreamFileObject
+IopReportResourceUsage
+KiDeliverApc
+LpcpClosePort
+MiAccessCheck
+MiMakeProtectionMask
+MiResolveMappedFileFault
+ObInsertObject
+ObpIncrementHandleDataBase
+ObpValidateAccessMask
+PsReturnSharedPoolQuota
+PsWatchWorkingSet
+RtlDeleteElementGenericTable
+CcReleaseByteRangeFromWrite
+ExCreateHandleTable
+FsRtlPrivateFastUnlockAll
+IoCheckDesiredAccess
+IoCreateDevice
+MiCompleteProtoPteFault
+MiMakeSystemAddressValidPfnWs
+MiMapPageInHyperSpace
+ObpCreateUnnamedHandle
+RtlExtendedLargeIntegerDivide
+RtlSubtreePredecessor
+SepAccessCheck
+CcCopyWrite
+CcUnmapVacbArray
+CcUnpinDataForThread
+ExNotifyCallback
+ExReleaseResourceForThreadLite
+FsRtlAcknowledgeOplockBreak
+FsRtlAddLargeEntry
+FsRtlInitializeLargeMcb
+FsRtlMdlWriteCompleteDev
+FsRtlPrivateCheckForExclusiveLockAccess
+IoAllocateAdapterChannel
+IoGetAttachedDevice
+IoRaiseInformationalHardError
+IoRemoveShareAccess
+MiCheckControlAreaStatus
+MiMakeSystemAddressValidPfn
+MiRemoveWsle
+ObDeleteCapturedInsertInfo
+ObReferenceObjectByName
+RtlClearBits
+RtlpGenerateInheritedAce
+RtlxOemStringToUnicodeSize
+SepCheckAcl
+CcPostWorkQueue
+CcScheduleReadAhead
+CcSetValidData
+ExEnumHandleTable
+ExQueueWorkItem
+FsRtlReleaseFileForCcFlush
+KeSetEvent
+MiChargeCommitmentCantExpand
+MiFindActualFaultingPte
+MiGetEventCounter
+NtDeleteFile
+RtlAreBitsClear
+RtlDeleteNoSplay
+RtlInitializeSid
+RtlLookupElementGenericTable
+RtlpGenerateInheritAcl
+CcMdlWriteComplete
+ExAcquireResourceExclusiveLite
+ExDeleteResourceLite
+ExfInterlockedInsertTailList
+ExIsResourceAcquiredSharedLite
+FsRtlOplockBreakNotify
+IoCheckEaBufferValidity
+IopOpenLinkOrRenameTarget
+IoQueueThreadIrp
+IoRegisterShutdownNotification
+Ke386GetGdtEntryThread
+KeReadStateTimer
+KeRemoveDeviceQueue
+KiRetireDpcList
+MiDeletePte
+MiEnsureAvailablePageOrWait
+MiGetInPageSupportBlock
+MiSectionDelete
+RtlLengthSecurityDescriptor
+RtlRealSuccessor
+RtlUpcaseUnicodeStringToAnsiString
+SepAdtGenerateDiscardAudit
+SepInheritAcl
+SepSidInToken
+CcCreateVacbArray
+CcMdlReadComplete2
+ExInterlockedAddLargeStatistic
+FsRtlCheckForMatchingFileObject
+FsRtlCheckLockForWriteAccess
+FsRtlPrivateInsertLock
+FsRtlPrivateLimitFreeLockList
+FsRtlPrivateResetLowestLockOffset
+IoCancelThreadIo
+IoPageRead
+IoReleaseCancelSpinLock
+IoSetInformation
+IoStartNextPacket
+IoStopTimer
+KeClearEvent
+KeInitializeApc
+KeInsertByKeyDeviceQueue
+KeRemoveByKeyDeviceQueue
+KiQuantumEnd
+MiAddValidPageToWorkingSet
+MiDeleteSystemPagableVm
+MiInsertFrontModifiedNoWrite
+MiLocateSubsection
+MiRemoveWorkingSetPages
+MiRestoreTransitionPte
+MiTrimWorkingSet
+RtlAreBitsSet
+RtlConvertUlongToLargeInteger
+RtlCopyLuidAndAttributesArray
+RtlCreateAcl
+RtlLargeIntegerDivide
+RtlpLengthInheritAcl
+SeAccessCheck
+_wcsicmp
+CcExtendVacbArray
+CcSetReadAheadGranularity
+CcUnmapVacb
+ExfInterlockedInsertHeadList
+FsRtlCheckLockForReadAccess
+FsRtlFreeFirstMapping
+FsRtlMdlReadComplete
+FsRtlNumberOfRunsInLargeMcb
+FsRtlOpBatchBreakClosePending
+FsRtlPrivateCheckWaitingLocks
+FsRtlPrivateInitializeFileLock
+FsRtlPrivateInsertExclusiveLock
+FsRtlReleaseFileForModWrite
+FsRtlRemoveAndCompleteIrp
+FsRtlUninitializeFileLock
+IoCreateNotificationEvent
+IoGetDeviceToVerify
+IopMountVolume
+IoUpdateShareAccess
+KeReleaseWaitForSemaphore
+KiTrap0E
+MiCheckForControlAreaDeletion
+MiDetermineUserGlobalPteMask
+MiFlushInPageSupportBlock
+MiFreeEventCounter
+MiInitializeTransitionPfn
+MiInsertWsle
+MiMapPageToZeroInHyperSpace
+MiModifiedPageWriterWorker
+MiResolveDemandZeroFault
+MiResolveTransitionFault
+MmCanFileBeTruncated
+MmCanFileBeTruncatedInternal
+MmDeterminePoolType
+MmFlushImageSection
+RtlAllocateAndInitializeSid
+RtlEnumerateGenericTable
+RtlEqualPrefixSid
+RtlEqualSid
+RtlExtendedIntegerMultiply
+RtlFirstFreeAce
+RtlIsGenericTableEmpty
+RtlOemStringToCountedUnicodeString
+RtlUpperString
+SeFreeCapturedSecurityQos
+SeLockSubjectContext
+_vsnprintf
+CcGetLsnForFileObject
+CcPurgeAndClearCacheSection
+CcZeroData
+ExecuteHandler
+ExLocalTimeToSystemTime
+ExRaiseException
+ExReleaseFastMutexUnsafe
+FsRtlCancelExclusiveIrp
+FsRtlFastUnlockAll
+FsRtlFastUnlockAllByKey
+FsRtlFastUnlockSingleShared
+FsRtlFindFirstOverlappingSharedNode
+FsRtlGetNextMcbEntry
+FsRtlPrivateInsertSharedLock
+FsRtlPrivateRemoveLock
+FsRtlRequestOplockII
+FsRtlSyncVolumes
+FsRtlUninitializeLargeMcb
+IopTimerDispatch
+IoUnregisterFsRegistrationChange
+KeContextToKframes
+KeFlushQueueApc
+KeSetEventBoostPriority
+KiReleaseSpinLock
+KiSystemService
+KiTimerExpiration
+KiTimerListExpire
+MiAddMappedPtes
+MiCheckPdeForPagedPool
+MiFlushPteList
+MiFreeInPageSupportBlock
+MiInitializePfnForOtherProcess
+MiInsertVad
+MiMakeOutswappedPageResident
+MiReleasePageFileSpace
+MiResolvePageFileFault
+MmWorkingSetManager
+PsReturnPoolQuota
+RtlAddAuditAccessAce
+RtlDispatchException
+RtlInitializeGenericTable
+RtlNumberOfClearBits
+RtlpGetReturnAddress
+RtlSecondsSince1970ToTime
+RtlSetAllBits
+RtlValidSecurityDescriptor
+SepApplyAclToObject
+SepConcatenatePrivileges
+SepGetDefaultsSubjectContext
+
+
\ No newline at end of file
diff --git a/private/ntos/init/up/sources b/private/ntos/init/up/sources
new file mode 100644
index 000000000..80a52d6fa
--- /dev/null
+++ b/private/ntos/init/up/sources
@@ -0,0 +1,62 @@
+!IF 0
+
+Copyright (c) 1989  Microsoft Corporation
+
+Module Name:
+
+    sources.
+
+Abstract:
+
+    This file specifies the target component being built and the list of
+    sources files needed to build that component.  Also specifies optional
+    compiler switches and libraries that are unique for the component being
+    built.
+
+
+Author:
+
+    Steve Wood (stevewo) 12-Apr-1990
+
+NOTE:   Commented description of this file is in \nt\bak\bin\sources.tpl
+
+!ENDIF
+
+MAJORCOMP=ntos
+MINORCOMP=init
+
+TARGETNAME=init
+TARGETPATH=..\..\obj
+TARGETTYPE=LIBRARY
+
+SYNCHRONIZE_DRAIN=1
+SYNCHRONIZE_BLOCK=1
+
+INCLUDES=..;..\..\inc
+GPSIZE=32
+
+NTPROFILEINPUT=yes
+
+MSC_WARNING_LEVEL=/W3 /WX
+
+C_DEFINES=$(C_DEFINES) -D_NTSYSTEM_
+
+SOURCES=\
+        ..\init.c      \
+        ..\ntoskrnl.rc
+
+!IF "$(NTTEST)"==""
+NTTEST=ntoskrnl
+!ENDIF
+
+!ifdef TEST_BUILD_EXPONENT
+!  if "$(TEST_BUILD_EXPONENT)" == "$(TEST_BUILD_EXPONENT:0x=)"
+!    error TEST_BUILD_EXPONENT value must start with 0x
+!  endif
+C_DEFINES=$(C_DEFINES) -DTEST_BUILD_EXPONENT=$(TEST_BUILD_EXPONENT)
+!endif
+
+NTRES=obj\*\ntoskrnl.res
+UMRES=obj\*\ntoskrnl.res
+
+NTTARGETFILE1=$(BASEDIR)\public\sdk\lib\*\$(NTTEST).lib
diff --git a/private/ntos/init/w32kexps.txt b/private/ntos/init/w32kexps.txt
new file mode 100644
index 000000000..5190722d7
--- /dev/null
+++ b/private/ntos/init/w32kexps.txt
@@ -0,0 +1,69 @@
+DbgPrompt
+ExDesktopObjectType CONSTANT        // Data - use pointer for access
+ExEnumHandleTable
+ExEventObjectType CONSTANT          // Data - use pointer for access
+ExWindowStationObjectType CONSTANT  // Data - use pointer for access
+KePulseEvent
+KeRaiseUserException
+KeServiceDescriptorTable CONSTANT   // Data - use pointer for access
+KeSetKernelStackSwapEnable
+KeUserModeCallback
+LdrAccessResource
+LdrFindResource_U
+LdrFindResourceDirectory_U
+LpcRequestPort
+MmAdjustWorkingSetSize
+MmCreateSection
+MmGrowKernelStack
+MmMapViewOfSection
+MmSectionObjectType CONSTANT
+MmUnmapViewOfSection
+NlsAnsiCodePage CONSTANT            // Data - use pointer for access
+ObAssignSecurity
+ObCheckCreateObjectAccess
+ObCheckObjectAccess
+ObOpenObjectByName
+ObReferenceObjectByName
+ObSetSecurityDescriptorInfo
+PsCreateWin32Process
+PsLookupProcessByProcessId
+PsLookupThreadByThreadId
+PsReferenceImpersonationToken
+PsReferencePrimaryToken
+PsRevertToSelf
+RtlAddAce
+RtlAllocateAndInitializeSid
+RtlAreAllAccessesGranted
+RtlAreAnyAccessesGranted
+RtlCreateUnicodeString
+RtlFindMessage
+RtlFormatCurrentUserKeyPath
+RtlGetDefaultCodePage
+RtlImageNtHeader
+RtlIntegerToChar
+RtlRaiseException
+RtlSetSaclSecurityDescriptor
+RtlZeroHeap
+SeCaptureSecurityDescriptor
+SeCloseObjectAuditAlarm
+SeCreateAccessState
+SeDeleteAccessState
+SePrivilegeCheck
+SePrivilegeObjectAuditAlarm
+SeReleaseSecurityDescriptor
+ZwAlertThread
+ZwClearEvent
+ZwCreateTimer
+ZwDuplicateToken
+ZwOpenProcess
+ZwOpenThread
+ZwPulseEvent
+ZwQueryInformationProcess
+ZwQueryObject
+ZwQuerySecurityObject
+ZwResetEvent
+ZwSetDefaultLocale
+ZwSetInformationObject
+ZwSetTimer
+ZwWaitForMultipleObjects
+ZwTerminateProcess