#define ERROR_NOT_ENOUGH_MEMORY
#define NT_SUCCESS(StatCode)
#define PsGetCurrentThread()
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
_Must_inspect_result_ _In_ PLARGE_INTEGER _In_ PLARGE_INTEGER _In_ ULONG _In_ PFILE_OBJECT _In_ PVOID Process
NTSTATUS(NTAPI * PKWIN32_SESSION_CALLOUT)(_In_ PVOID Parameter)
NTSTATUS(NTAPI * PKWIN32_PROCESS_CALLOUT)(_In_ struct _EPROCESS *Process, _In_ BOOLEAN Create)
@ PsW32ThreadCalloutInitialize
NTSTATUS(NTAPI * PKWIN32_POWEREVENT_CALLOUT)(_In_ struct _WIN32_POWEREVENT_PARAMETERS *Parameters)
NTSTATUS(NTAPI * PGDI_BATCHFLUSH_ROUTINE)(VOID)
NTSTATUS(NTAPI * PKWIN32_THREAD_CALLOUT)(_In_ struct _ETHREAD *Thread, _In_ PSW32THREADCALLOUTTYPE Type)
#define KeLeaveGuardedRegion()
#define KeEnterGuardedRegion()
#define KeGetPreviousMode()
PVOID NTAPI KeSwitchKernelStack(IN PVOID StackBase, IN PVOID StackLimit)
VOID NTAPI MmDeleteKernelStack(PVOID Stack, BOOLEAN GuiStack)
PVOID NTAPI MmCreateKernelStack(BOOLEAN GuiStack, UCHAR Node)
PKWIN32_SESSION_CALLOUT ExpWindowStationObjectDelete
NTSTATUS NTAPI PsConvertToGuiThread(VOID)
PKWIN32_SESSION_CALLOUT ExpWindowStationObjectParse
PKWIN32_THREAD_CALLOUT PspW32ThreadCallout
PKWIN32_SESSION_CALLOUT ExpDesktopObjectDelete
PKWIN32_SESSION_CALLOUT ExpDesktopObjectClose
PKWIN32_PROCESS_CALLOUT PspW32ProcessCallout
PKWIN32_SESSION_CALLOUT ExpWindowStationObjectOkToClose
PKWIN32_SESSION_CALLOUT ExpDesktopObjectOpen
PKWIN32_SESSION_CALLOUT ExpDesktopObjectOkToClose
PKWIN32_POWEREVENT_CALLOUT PopEventCallout
VOID NTAPI PsEstablishWin32Callouts(IN PWIN32_CALLOUTS_FPNS CalloutData)
PGDI_BATCHFLUSH_ROUTINE KeGdiFlushUserBatch
#define STATUS_ALREADY_WIN32
KSERVICE_TABLE_DESCRIPTOR KeServiceDescriptorTable[SSDT_MAX_ENTRIES]
KSERVICE_TABLE_DESCRIPTOR KeServiceDescriptorTableShadow[SSDT_MAX_ENTRIES]
#define KERNEL_STACK_SIZE
#define STATUS_ACCESS_DENIED
#define STATUS_INVALID_PARAMETER
#define PsGetCurrentProcess