-#ifndef WITH_NTDLL
-/* Pointers to functions that are not available on all targetted versions of
- * Windows (XP and later). NOTE: The WINAPI annotations seem to be important; I
- * assume it specifies a certain calling convention. */
-
-/* Vista and later */
-HANDLE (WINAPI *win32func_FindFirstStreamW)(LPCWSTR lpFileName,
- STREAM_INFO_LEVELS InfoLevel,
- LPVOID lpFindStreamData,
- DWORD dwFlags) = NULL;
-
-/* Vista and later */
-BOOL (WINAPI *win32func_FindNextStreamW)(HANDLE hFindStream,
- LPVOID lpFindStreamData) = NULL;
-#endif /* !WITH_NTDLL */
-
-/* Vista and later */
-BOOL (WINAPI *win32func_CreateSymbolicLinkW)(const wchar_t *lpSymlinkFileName,
- const wchar_t *lpTargetFileName,
- DWORD dwFlags) = NULL;
+/* Pointers to dynamically loaded functions */
+
+/* kernel32.dll: Vista and later */
+BOOL (WINAPI *func_CreateSymbolicLinkW)(const wchar_t *lpSymlinkFileName,
+ const wchar_t *lpTargetFileName,
+ DWORD dwFlags);
+
+/* ntdll.dll */
+
+NTSTATUS (WINAPI *func_NtOpenFile) (PHANDLE FileHandle,
+ ACCESS_MASK DesiredAccess,
+ POBJECT_ATTRIBUTES ObjectAttributes,
+ PIO_STATUS_BLOCK IoStatusBlock,
+ ULONG ShareAccess,
+ ULONG OpenOptions);
+
+NTSTATUS (WINAPI *func_NtReadFile) (HANDLE FileHandle,
+ HANDLE Event,
+ PIO_APC_ROUTINE ApcRoutine,
+ PVOID ApcContext,
+ PIO_STATUS_BLOCK IoStatusBlock,
+ PVOID Buffer,
+ ULONG Length,
+ PLARGE_INTEGER ByteOffset,
+ PULONG Key);
+
+NTSTATUS (WINAPI *func_NtOpenFile) (PHANDLE FileHandle,
+ ACCESS_MASK DesiredAccess,
+ POBJECT_ATTRIBUTES ObjectAttributes,
+ PIO_STATUS_BLOCK IoStatusBlock,
+ ULONG ShareAccess,
+ ULONG OpenOptions);
+
+NTSTATUS (WINAPI *func_NtQueryInformationFile)(HANDLE FileHandle,
+ PIO_STATUS_BLOCK IoStatusBlock,
+ PVOID FileInformation,
+ ULONG Length,
+ FILE_INFORMATION_CLASS FileInformationClass);
+
+NTSTATUS (WINAPI *func_NtQuerySecurityObject)(HANDLE handle,
+ SECURITY_INFORMATION SecurityInformation,
+ PSECURITY_DESCRIPTOR SecurityDescriptor,
+ ULONG Length,
+ PULONG LengthNeeded);
+
+NTSTATUS (WINAPI *func_NtQueryDirectoryFile) (HANDLE FileHandle,
+ HANDLE Event,
+ PIO_APC_ROUTINE ApcRoutine,
+ PVOID ApcContext,
+ PIO_STATUS_BLOCK IoStatusBlock,
+ PVOID FileInformation,
+ ULONG Length,
+ FILE_INFORMATION_CLASS FileInformationClass,
+ BOOLEAN ReturnSingleEntry,
+ PUNICODE_STRING FileName,
+ BOOLEAN RestartScan);
+
+NTSTATUS (WINAPI *func_NtQueryVolumeInformationFile) (HANDLE FileHandle,
+ PIO_STATUS_BLOCK IoStatusBlock,
+ PVOID FsInformation,
+ ULONG Length,
+ FS_INFORMATION_CLASS FsInformationClass);
+
+NTSTATUS (WINAPI *func_NtSetSecurityObject)(HANDLE Handle,
+ SECURITY_INFORMATION SecurityInformation,
+ PSECURITY_DESCRIPTOR SecurityDescriptor);
+
+NTSTATUS (WINAPI *func_NtClose) (HANDLE Handle);
+
+DWORD (WINAPI *func_RtlNtStatusToDosError)(NTSTATUS status);
+
+NTSTATUS (WINAPI *func_RtlCreateSystemVolumeInformationFolder)
+ (PCUNICODE_STRING VolumeRootPath);