Geoff Chappell, Software Analyst
It never was Microsoft’s practice to have the kernel export anything only by ordinal, rather than by name. That changed with Windows 8. An ExAllocateTimerInternal was added as an ordinal-only export for Windows 8.1 and it should not surprise that an eventual elaboration as ExAllocateTimerInternal2 is also exported only by ordinal.
| Ordinal | Function | Remarks |
|---|---|---|
| 4 | ExAllocateTimerInternal2 | 1703 and higher |
| 5 | VslTestRoutine | 1709 and higher |
| 6 | KeYieldExecution | 1809 and higher |
| 7 | KeExpandKernelStackAndCalloutInternal | 1903 and higher |
| 9 | VslCapturePgoData | 1903 and higher |
| 12 | MmGetNumberOfPhysicalPages | 2004 and higher |
| 13 | PnpFreeSystemPdoList | 2004 and higher |
| 14 | PnpGetDeviceInstancePropertyData | 2004 and higher |
| 15 | PnpGetDeviceInstanceRegistryValue | 2004 and higher |
| 16 | PnpGetSystemPdoList | 2004 and higher |
| 17 | RtlGetHostNtSystemRoot | 2004 and higher |
| 19 | ZwPlugPlayControl | 2004 and higher |
| 20 | ExpSetKernelDataProtection | 2004 and higher |
| 21 | ExpGetKernelDataProtection | 2004 and higher |
| 22 | ExpReducedLicenseData | 2004 and higher |
| 23 | SeCodeIntegrityGetBuildExpiryTime | 2004 and higher |
| 24 | ExpEtwTraceLicensingCacheChange | 2004 and higher |
| 25 | ClipInitHandles | 2004 and higher |
| 27 | unknown | 2004 and higher |
| 28 | ExUpdateOsPfnInRegistry | 2004 and higher |