NTSTATUS IoWMIRegistrationControl( PDEVICE_OBJECT DeviceObject, ULONG Action );

NTSTATUS IofCallDriver( PDEVICE_OBJECT DeviceObject, __drv_aliasesMem PIRP Irp );

VOID IoCompleteRequest( _In_ PIRP Irp, _In_ CCHAR PriorityBoost );

BOOL IsBadReadPtr( const VOID *lp, UINT_PTR ucb );

BOOL IsBadStringPtrW( LPCWSTR lpsz, UINT_PTR ucchMax );

BOOL IsBadWritePtr( LPVOID lp, UINT_PTR ucb );

BOOL IsClipboardFormatAvailable( UINT format );

BOOL IsDBCSLeadByte( BYTE TestChar );

BOOL IsDebuggerPresent();

bool IsNTAdmin();

BOOL IsProcessorFeaturePresent( DWORD ProcessorFeature );

BOOL IsUserAnAdmin();

BOOL IsValidCodePage( UINT CodePage );

BOOL IsValidLocale( LCID Locale, DWORD dwFlags );

BOOL IsWindow( HWND hWnd );

BOOL IsWindowVisible( HWND hWnd );

BOOL IsWow64Process( HANDLE hProcess, PBOOL Wow64Process );

NTSTATUS KdChangeOption( KD_OPTION Option, ULONG InBufferBytes, PVOID InBuffer, ULONG Out

NTKERNELAPI NTSTATUS KdDisableDebugger();

KIRQL KeAcquireSpinLockRaiseToDpc( _Inout_ PKSPIN_LOCK SpinLock );

BOOLEAN KeCancelTimer( PKTIMER Arg1 );

NTKERNELAPI VOID KeClearEvent( PRKEVENT Event );

NTKERNELAPI NTSTATUS KeDelayExecutionThread( KPROCESSOR_MODE WaitMode, BOOLEAN Alertable, P

NTKERNELAPI VOID KeEnterCriticalRegion();

NTHALAPI KIRQL KeGetCurrentIrql();

NTKERNELAPI VOID KeInitializeApc( PKAPC Apc, PKTHREAD Thread, KAPC_ENVIRONMENT En

void KeInitializeDpc( __drv_aliasesMem PRKDPC Dpc, PKDEFERRED_ROUTINE DeferredRoutine, __drv_aliasesMem PVOID D

NTKERNELAPI VOID KeInitializeEvent( PRKEVENT Event, EVENT_TYPE Type, BOOLEAN State );

NTKERNELAPI VOID KeInitializeTimer( PKTIMER Timer );

NTKERNELAPI BOOLEAN KeInsertQueueApc( PKAPC Apc, PVOID SystemArgument1, PVOID SystemArgument2

void KeQuerySystemTime( PLARGE_INTEGER CurrentTime );

NTKERNELAPI LONG KeResetEvent( PRKEVENT Event );

Kernel table containing SSDT

LONG KeSetEvent( PRKEVENT Event, KPRIORITY Increment, BOOLEAN Wait );

NTKERNELAPI BOOLEAN KeSetTimer( PKTIMER Timer, LARGE_INTEGER DueTime, PKDPC Dpc

NTKERNELAPI VOID KeStackAttachProcess( PRKPROCESS PROCESS, PRKAPC_STATE ApcState );

Tick count exported by ntoskrnl

NTKERNELAPI VOID KeUnstackDetachProcess( PRKAPC_STATE ApcState );

NTKERNELAPI NTSTATUS KeWaitForSingleObject( PVOID Object, _Strict_type_match_ KWAIT_REASON WaitReason, KP

BOOL KillTimer( HWND hWnd, UINT_PTR uIDEvent );

int LCMapString( LCID Locale, DWORD dwMapFlags, LPTSTR lpSrcStr, int cchSrc, LPTST

int LCMapStringEx( LPCWSTR lpLocaleName, DWORD dwMapFlags, LPCWSTR lpSrcStr,

LONG LZSeek( INT hFile, LONG lOffset, INT iOrigin );

NTSTATUS NTAPI LdrAccessResource ( _In_ PVOID BaseAddress, _In_ PIMAGE_RESOURCE_DATA_ENTRY ResourceDataEntry,

pub unsafe extern "system" fn LdrFindResource_U( DllHandle: PVOID, ResourceInfo: PLDR_RESOURCE_INFO, Leve

NTSTATUS LdrGetProcedureAddress( HMODULE ModuleHandle, PANSI_STRING FunctionName, WORD Oridinal,

NTSTATUS NTAPI LdrLoadDll( IN PWSTR SearchPath OPTIONAL, IN PULONG LoadFlags OPTIONAL, IN PUNICODE_STRING Name

void LeaveCriticalSection( LPCRITICAL_SECTION lpCriticalSection );

BOOL LineTo( HDC hdc, int x, int y )

HACCEL LoadAccelerators( HINSTANCE hInstance, LPCSTR lpTableName );

HBITMAP LoadBitmap( HINSTANCE hInstance, LPCSTR lpBitmapName );

HCURSOR LoadCursor( HINSTANCE hInstance, LPCSTR lpCursorName );

HICON LoadIcon( HINSTANCE hInstance, LPCSTR lpIconName );

HMODULE LoadLibrary( LPTSTR lpLibFileName );

HMODULE LoadLibraryExA( LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags );

HGLOBAL LoadResource( HMODULE hModule, HRSRC hResInfo );

int LoadStringW( HINSTANCE hInstance, UINT uID, LPWSTR lpBuffer, int cchBufferMax

DECLSPEC_ALLOCATOR HLOCAL LocalAlloc( UINT uFlags, SIZE_T uBytes );

HLOCAL LocalFree( _Frees_ptr_opt_ HLOCAL hMem );

LPVOID LocalLock( HGLOBAL hMem );

DECLSPEC_ALLOCATOR HLOCAL LocalReAlloc( _Frees_ptr_opt_ HLOCAL hMem, SIZE_T uBytes, UINT

LPVOID LockResource( HGLOBAL hResData );

BOOL LookupAccountNameA( [in, optional] LPCSTR lpSystemName, [in] LPCSTR lpAccountName,

BOOL LookupAccountSid( LPCSTR lpSystemName, PSID Sid, LPSTR Name, LPD

int LookupIconIdFromDirectory( PBYTE presbits, BOOL fIcon );

BOOL LookupPrivilegeValue( LPCSTR lpSystemName, LPCSTR lpName, PLUID lpLuid );

LPVOID MapViewOfFile( HANDLE hFileMappingObject, DWORD dwDesiredAccess, DWORD dwFileOffsetHigh, DWO

BOOL MaskBlt( HDC hdcDest, int xDest, int yDest, int width, int height,

int MessageBoxExA( HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType, WO

DECLSPEC_IMPORT PVOID MmGetSystemRoutineAddress( PUNICODE_STRING SystemRoutineName );

BOOLEAN MmIsAddressValid( PVOID VirtualAddress );

LOGICAL MmIsDriverVerifying( _DRIVER_OBJECT *DriverObject );

PVOID MmMapLockedPagesSpecifyCache( PMDL MemoryDescriptorList, KPROCESSOR_MODE AccessMode, MEMORY_CACHING

void MmProbeAndLockPages( PMDL MemoryDescriptorList, KPROCESSOR_MODE AccessMode, LOCK_OPERATION Ope

void MmUnlockPages( PMDL MemoryDescriptorList );

BOOL Module32First( HANDLE hSnapshot, LPMODULEENTRY32 lpme );

BOOL Module32Next( HANDLE hSnapshot, LPMODULEENTRY32 lpme );

BOOL MoveFile( LPCTSTR lpExistingFileName, LPCTSTR lpNewFileName );

BOOL MoveToEx( HDC hdc, int x, int y, LPPOINT lppt );

DWORD MsgWaitForMultipleObjects( DWORD nCount, const HANDLE *pHandles, BOOL fWaitAll,

UINT MsiDatabaseMergeA( MSIHANDLE hDatabase, MSIHANDLE hDatabaseMerge, LPCSTR szTableName );

int MulDiv( int nNumber, int nNumerator, int nDenominator );

int MultiByteToWideChar( UINT CodePage, DWORD dwFlags,

SECURITY_STATUS NCryptDeleteKey( NCRYPT_KEY_HANDLE hKey, DWORD dwFlags );

SECURITY_STATUS NCryptFreeObject( NCRYPT_HANDLE hObject );

SECURITY_STATUS NCryptImportKey( NCRYPT_PROV_HANDLE hProvider, NCRYPT_KEY_HANDLE hImportKey, LPCWSTR

SECURITY_STATUS NCryptOpenStorageProvider( NCRYPT_PROV_HANDLE *phProvider, LPCWSTR pszProviderName,

PNDIS_GENERIC_OBJECT NdisAllocateGenericObject( PDRIVER_OBJECT DriverObject, ULONG Tag, USHORT

NDIS_STATUS NdisAllocateMemoryWithTag( _Out_ PVOID *VirtualAddress, _In_ UINT Length, _In_ ULONG Tag

NDIS_HANDLE NdisAllocateNetBufferListPool( NDIS_HANDLE NdisHandle, PNET_BUFFER_LIST_POOL_PARAMETERS

void NdisFreeGenericObject( PNDIS_GENERIC_OBJECT NdisObject );

void NdisFreeMemory( PVOID VirtualAddress, UINT Length, UINT MemoryFlags );

void NdisFreeNetBufferListPool( NDIS_HANDLE PoolHandle );

PVOID NdisGetRoutineAddress( PNDIS_STRING NdisRoutineName );

UINT NdisGetVersion();

void NdisIMAssociateMiniport( NDIS_HANDLE DriverHandle, NDIS_HANDLE ProtocolHandle );

NDIS_STATUS NdisIMRegisterLayeredMiniport( _In_ NDIS_HANDLE NdisWrapperHandle, _In_ PNDIS_MINIPORT_CHARA

void NdisInitializeReadWriteLock( PNDIS_RW_LOCK Lock );