- sorted API by groups
- new stubs:  NtQueryDirectoryFile,  ZwQueryDirectoryFile
- impl.: RtlAllocateHeap, RtlCreateHeap, RtlDestroyHeap, RtlFreeHeap,
  RtlGetDaclSecurityDescriptor, RtlGetSaclSecurityDescriptor
- impl. by Rex Jolliff (rex@lvcablemodem.com): RtlTimeToTimeFields,
  RtlTimeFieldsToTime

diff --git a/dlls/ntdll/Makefile.in b/dlls/ntdll/Makefile.in
index 648a6e3..db4002d 100644
--- a/dlls/ntdll/Makefile.in
+++ b/dlls/ntdll/Makefile.in
@@ -6,9 +6,15 @@
 MODULE    = ntdll
 
 C_SRCS = \
+	file.c \
 	nt.c \
+	om.c \
 	reg.c \
-	rtl.c
+	rtl.c \
+	rtlstr.c \
+	sec.c \
+	sync.c \
+	time.c
 
 all: $(MODULE).o
 
diff --git a/dlls/ntdll/file.c b/dlls/ntdll/file.c
new file mode 100644
index 0000000..fdceac1
--- /dev/null
+++ b/dlls/ntdll/file.c
@@ -0,0 +1,212 @@
+#include <stdlib.h>
+#include <string.h>
+#include "debug.h"
+
+#include "ntddk.h"
+
+/**************************************************************************
+ *                 NtOpenFile				[NTDLL.127]
+ * FUNCTION: Opens a file
+ * ARGUMENTS:
+ *  FileHandle		Variable that receives the file handle on return
+ *  DesiredAccess	Access desired by the caller to the file
+ *  ObjectAttributes	Structue describing the file to be opened
+ *  IoStatusBlock	Receives details about the result of the operation
+ *  ShareAccess		Type of shared access the caller requires
+ *  OpenOptions		Options for the file open
+ */
+NTSTATUS WINAPI NtOpenFile(
+	OUT PHANDLE FileHandle,
+	ACCESS_MASK DesiredAccess,
+	POBJECT_ATTRIBUTES ObjectAttributes,
+	OUT PIO_STATUS_BLOCK IoStatusBlock,
+	ULONG ShareAccess,
+	ULONG OpenOptions)
+{
+	FIXME(ntdll,"(%p,0x%08lx,%p(%s),%p,0x%08lx,0x%08lx) stub\n",
+	FileHandle, DesiredAccess, ObjectAttributes, 
+	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL,
+	IoStatusBlock, ShareAccess, OpenOptions);
+	return 0;
+}
+
+/**************************************************************************
+ *		NtCreateFile				[NTDLL.73]
+ * FUNCTION: Either causes a new file or directory to be created, or it opens
+ *  an existing file, device, directory or volume, giving the caller a handle
+ *  for the file object. This handle can be used by subsequent calls to
+ *  manipulate data within the file or the file object's state of attributes.
+ * ARGUMENTS:
+ *	FileHandle		Points to a variable which receives the file handle on return
+ *	DesiredAccess		Desired access to the file
+ *	ObjectAttributes	Structure describing the file
+ *	IoStatusBlock		Receives information about the operation on return
+ *	AllocationSize		Initial size of the file in bytes
+ *	FileAttributes		Attributes to create the file with
+ *	ShareAccess		Type of shared access the caller would like to the file
+ *	CreateDisposition	Specifies what to do, depending on whether the file already exists
+ *	CreateOptions		Options for creating a new file
+ *	EaBuffer		Undocumented
+ *	EaLength		Undocumented
+ */
+NTSTATUS WINAPI NtCreateFile(
+	OUT PHANDLE FileHandle,
+	ACCESS_MASK DesiredAccess,
+	POBJECT_ATTRIBUTES ObjectAttributes,
+	OUT PIO_STATUS_BLOCK IoStatusBlock,
+	PLARGE_INTEGER AllocateSize,
+	ULONG FileAttributes,
+	ULONG ShareAccess,
+	ULONG CreateDisposition,
+	ULONG CreateOptions,
+	PVOID EaBuffer,
+	ULONG EaLength)  
+{
+	FIXME(ntdll,"(%p,0x%08lx,%p(%s),%p,%p,0x%08lx,0x%08lx,0x%08lx,0x%08lx,%p,0x%08lx) stub\n",
+	FileHandle,DesiredAccess,ObjectAttributes,
+	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL,
+	IoStatusBlock,AllocateSize,FileAttributes,
+	ShareAccess,CreateDisposition,CreateOptions,EaBuffer,EaLength);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtReadFile					[NTDLL] 
+ *  ZwReadFile
+ *
+ * Parameters
+ *   HANDLE32 		FileHandle
+ *   HANDLE32 		Event 		OPTIONAL
+ *   PIO_APC_ROUTINE 	ApcRoutine 	OPTIONAL
+ *   PVOID 		ApcContext 	OPTIONAL
+ *   PIO_STATUS_BLOCK 	IoStatusBlock
+ *   PVOID 		Buffer
+ *   ULONG 		Length
+ *   PLARGE_INTEGER 	ByteOffset 	OPTIONAL
+ *   PULONG 		Key 		OPTIONAL
+ */
+NTSTATUS WINAPI NtReadFile (
+	HANDLE FileHandle,
+	HANDLE EventHandle,
+	PIO_APC_ROUTINE ApcRoutine,
+	PVOID ApcContext,
+	PIO_STATUS_BLOCK IoStatusBlock,
+	PVOID Buffer,
+	ULONG Length,
+	PLARGE_INTEGER ByteOffset,
+	PULONG Key)
+{
+	FIXME(ntdll,"(0x%08x,0x%08x,%p,%p,%p,%p,0x%08lx,%p,%p),stub!\n",
+	FileHandle,EventHandle,ApcRoutine,ApcContext,IoStatusBlock,Buffer,Length,ByteOffset,Key);
+	return 0;
+}
+
+/**************************************************************************
+ *		NtDeviceIoControlFile			[NTDLL.94]
+ */
+NTSTATUS WINAPI NtDeviceIoControlFile(
+	IN HANDLE DeviceHandle,
+	IN HANDLE Event OPTIONAL,
+	IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
+	IN PVOID UserApcContext OPTIONAL,
+	OUT PIO_STATUS_BLOCK IoStatusBlock,
+	IN ULONG IoControlCode,
+	IN PVOID InputBuffer,
+	IN ULONG InputBufferSize,
+	OUT PVOID OutputBuffer,
+	IN ULONG OutputBufferSize)
+{
+	FIXME(ntdll,"(0x%08x,0x%08x,%p,%p,%p,0x%08lx,%p,0x%08lx,%p,0x%08lx): empty stub\n",
+	DeviceHandle, Event, UserApcRoutine, UserApcContext,
+	IoStatusBlock, IoControlCode, InputBuffer, InputBufferSize, OutputBuffer, OutputBufferSize);
+	return 0;
+}
+
+/******************************************************************************
+ * NtFsControlFile [NTDLL.108]
+ */
+NTSTATUS WINAPI NtFsControlFile(
+	IN HANDLE DeviceHandle,
+	IN HANDLE Event OPTIONAL,
+	IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+	IN PVOID ApcContext OPTIONAL,
+	OUT PIO_STATUS_BLOCK IoStatusBlock,
+	IN ULONG IoControlCode,
+	IN PVOID InputBuffer,
+	IN ULONG InputBufferSize,
+	OUT PVOID OutputBuffer,
+	IN ULONG OutputBufferSize)
+{
+	FIXME(ntdll,"(0x%08x,0x%08x,%p,%p,%p,0x%08lx,%p,0x%08lx,%p,0x%08lx): stub\n",
+	DeviceHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,IoControlCode,
+	InputBuffer,InputBufferSize,OutputBuffer,OutputBufferSize);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtSetVolumeInformationFile		[NTDLL] 
+ */
+NTSTATUS WINAPI NtSetVolumeInformationFile(
+	IN HANDLE FileHandle,
+	IN PVOID VolumeInformationClass,
+	PVOID VolumeInformation,
+	ULONG Length) 
+{
+	FIXME(ntdll,"(0x%08x,%p,%p,0x%08lx) stub\n",
+	FileHandle,VolumeInformationClass,VolumeInformation,Length);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtQueryInformationFile		[NTDLL] 
+ */
+NTSTATUS WINAPI NtQueryInformationFile(
+	HANDLE FileHandle,
+	PIO_STATUS_BLOCK IoStatusBlock,
+	PVOID FileInformation,
+	ULONG Length,
+	FILE_INFORMATION_CLASS FileInformationClass)
+{
+	FIXME(ntdll,"(0x%08x,%p,%p,0x%08lx,0x%08x),stub!\n",
+	FileHandle,IoStatusBlock,FileInformation,Length,FileInformationClass);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtSetInformationFile		[NTDLL] 
+ */
+NTSTATUS WINAPI NtSetInformationFile(
+	HANDLE FileHandle,
+	PIO_STATUS_BLOCK IoStatusBlock,
+	PVOID FileInformation,
+	ULONG Length,
+	FILE_INFORMATION_CLASS FileInformationClass)
+{
+	FIXME(ntdll,"(0x%08x,%p,%p,0x%08lx,0x%08x)\n",
+	FileHandle,IoStatusBlock,FileInformation,Length,FileInformationClass);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtQueryDirectoryFile	[NTDLL]
+ *  ZwQueryDirectoryFile
+ */
+NTSTATUS WINAPI NtQueryDirectoryFile(
+	IN HANDLE FileHandle,
+	IN HANDLE Event OPTIONAL,
+	IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+	IN PVOID ApcContext OPTIONAL,
+	OUT PIO_STATUS_BLOCK IoStatusBlock,
+	OUT PVOID FileInformation,
+	IN ULONG Length,
+	IN FILE_INFORMATION_CLASS FileInformationClass,
+	IN BOOLEAN ReturnSingleEntry,
+	IN PUNICODE_STRING FileName OPTIONAL,
+	IN BOOLEAN RestartScan)
+{
+	FIXME (ntdll,"(0x%08x 0x%08x %p %p %p %p 0x%08lx 0x%08x 0x%08x %p 0x%08x\n",
+	FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, FileInformation,
+	Length, FileInformationClass, ReturnSingleEntry, 
+	debugstr_w(FileName->Buffer),RestartScan);
+	return 0;
+}
diff --git a/dlls/ntdll/nt.c b/dlls/ntdll/nt.c
index 10b3602..9d2bc22 100644
--- a/dlls/ntdll/nt.c
+++ b/dlls/ntdll/nt.c
@@ -10,84 +10,18 @@
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
-#include "wintypes.h"
-#include "windef.h"
-#include "ntdll.h"
-#include "ntdef.h"
-#include "ntddk.h"
 #include "debugstr.h"
 #include "debug.h"
 
+#include "ntddk.h"
+
 /* move to winbase.h */
 typedef VOID (CALLBACK *PTIMERAPCROUTINE)(LPVOID lpArgToCompletionRoutine,DWORD dwTimerLowValue,DWORD dwTimerHighValue);   
 
-/* move to somewhere */
-typedef void * POBJDIR_INFORMATION;
-
-/**************************************************************************
- *                 NtOpenFile				[NTDLL.127]
- * FUNCTION: Opens a file
- * ARGUMENTS:
- *  FileHandle		Variable that receives the file handle on return
- *  DesiredAccess	Access desired by the caller to the file
- *  ObjectAttributes	Structue describing the file to be opened
- *  IoStatusBlock	Receives details about the result of the operation
- *  ShareAccess		Type of shared access the caller requires
- *  OpenOptions		Options for the file open
+/*
+ *	Timer object
  */
-NTSTATUS WINAPI NtOpenFile(
-	OUT PHANDLE FileHandle,
-	ACCESS_MASK DesiredAccess,
-	POBJECT_ATTRIBUTES ObjectAttributes,
-	OUT PIO_STATUS_BLOCK IoStatusBlock,
-	ULONG ShareAccess,
-	ULONG OpenOptions)
-{
-	FIXME(ntdll,"(%p,0x%08lx,%p(%s),%p,0x%08lx,0x%08lx) stub\n",
-	FileHandle, DesiredAccess, ObjectAttributes, 
-	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL,
-	IoStatusBlock, ShareAccess, OpenOptions);
-	return 0;
-}
-/**************************************************************************
- *		NtCreateFile				[NTDLL.73]
- * FUNCTION: Either causes a new file or directory to be created, or it opens
- *  an existing file, device, directory or volume, giving the caller a handle
- *  for the file object. This handle can be used by subsequent calls to
- *  manipulate data within the file or the file object's state of attributes.
- * ARGUMENTS:
- *	FileHandle		Points to a variable which receives the file handle on return
- *	DesiredAccess		Desired access to the file
- *	ObjectAttributes	Structure describing the file
- *	IoStatusBlock		Receives information about the operation on return
- *	AllocationSize		Initial size of the file in bytes
- *	FileAttributes		Attributes to create the file with
- *	ShareAccess		Type of shared access the caller would like to the file
- *	CreateDisposition	Specifies what to do, depending on whether the file already exists
- *	CreateOptions		Options for creating a new file
- *	EaBuffer		Undocumented
- *	EaLength		Undocumented
- */
-NTSTATUS WINAPI NtCreateFile(
-	OUT PHANDLE FileHandle,
-	ACCESS_MASK DesiredAccess,
-	POBJECT_ATTRIBUTES ObjectAttributes,
-	OUT PIO_STATUS_BLOCK IoStatusBlock,
-	PLARGE_INTEGER AllocateSize,
-	ULONG FileAttributes,
-	ULONG ShareAccess,
-	ULONG CreateDisposition,
-	ULONG CreateOptions,
-	PVOID EaBuffer,
-	ULONG EaLength)  
-{
-	FIXME(ntdll,"(%p,0x%08lx,%p(%s),%p,%p,0x%08lx,0x%08lx,0x%08lx,0x%08lx,%p,0x%08lx) stub\n",
-	FileHandle,DesiredAccess,ObjectAttributes,
-	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL,
-	IoStatusBlock,AllocateSize,FileAttributes,
-	ShareAccess,CreateDisposition,CreateOptions,EaBuffer,EaLength);
-	return 0;
-}
+ 
 /**************************************************************************
  *		NtCreateTimer				[NTDLL.87]
  */
@@ -120,172 +54,6 @@
 	return 0;
 }
 
-/**************************************************************************
- *		NtCreateEvent				[NTDLL.71]
- */
-NTSTATUS WINAPI NtCreateEvent(
-	OUT PHANDLE EventHandle,
-	IN ACCESS_MASK DesiredAccess,
-	IN POBJECT_ATTRIBUTES ObjectAttributes,
-	IN BOOLEAN ManualReset,
-	IN BOOLEAN InitialState)
-{
-	FIXME(ntdll,"(%p,0x%08lx,%p(%s),%08x,%08x): empty stub\n",
-	EventHandle,DesiredAccess,ObjectAttributes,
-	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL,
-	ManualReset,InitialState);
-	return 0;
-}
-/**************************************************************************
- *		NtDeviceIoControlFile			[NTDLL.94]
- */
-NTSTATUS WINAPI NtDeviceIoControlFile(
-	IN HANDLE DeviceHandle,
-	IN HANDLE Event OPTIONAL,
-	IN PIO_APC_ROUTINE UserApcRoutine OPTIONAL,
-	IN PVOID UserApcContext OPTIONAL,
-	OUT PIO_STATUS_BLOCK IoStatusBlock,
-	IN ULONG IoControlCode,
-	IN PVOID InputBuffer,
-	IN ULONG InputBufferSize,
-	OUT PVOID OutputBuffer,
-	IN ULONG OutputBufferSize)
-{
-	FIXME(ntdll,"(0x%08x,0x%08x,%p,%p,%p,0x%08lx,%p,0x%08lx,%p,0x%08lx): empty stub\n",
-	DeviceHandle, Event, UserApcRoutine, UserApcContext,
-	IoStatusBlock, IoControlCode, InputBuffer, InputBufferSize, OutputBuffer, OutputBufferSize);
-	return 0;
-}
-
-/**************************************************************************
- * NtOpenDirectoryObject [NTDLL.124]
- * FUNCTION: Opens a namespace directory object
- * ARGUMENTS:
- *  DirectoryHandle	Variable which receives the directory handle
- *  DesiredAccess	Desired access to the directory
- *  ObjectAttributes	Structure describing the directory
- * RETURNS: Status
- */
-NTSTATUS WINAPI NtOpenDirectoryObject(
-	PHANDLE DirectoryHandle,
-	ACCESS_MASK DesiredAccess,
-	POBJECT_ATTRIBUTES ObjectAttributes)
-{
-    FIXME(ntdll,"(%p,0x%08lx,%p(%s)): stub\n", 
-    DirectoryHandle, DesiredAccess, ObjectAttributes,
-    ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL);
-    return 0;
-}
-
-
-/******************************************************************************
- * NtQueryDirectoryObject [NTDLL.149] 
- * FUNCTION: Reads information from a namespace directory
- * ARGUMENTS:
- *  DirObjInformation	Buffer to hold the data read
- *  BufferLength	Size of the buffer in bytes
- *  GetNextIndex	If TRUE then set ObjectIndex to the index of the next object
- *			If FALSE then set ObjectIndex to the number of objects in the directory
- *  IgnoreInputIndex	If TRUE start reading at index 0
- *			If FALSE start reading at the index specified by object index
- *  ObjectIndex		Zero based index into the directory, interpretation depends on IgnoreInputIndex and GetNextIndex
- *  DataWritten		Caller supplied storage for the number of bytes written (or NULL)
- */
-NTSTATUS WINAPI NtQueryDirectoryObject(
-	IN HANDLE DirObjHandle,
-	OUT POBJDIR_INFORMATION DirObjInformation,
-	IN ULONG BufferLength,
-	IN BOOLEAN GetNextIndex,
-	IN BOOLEAN IgnoreInputIndex,
-	IN OUT PULONG ObjectIndex,
-	OUT PULONG DataWritten OPTIONAL)
-{
-	FIXME(ntdll,"(0x%08x,%p,0x%08lx,0x%08x,0x%08x,%p,%p) stub\n",
-		DirObjHandle, DirObjInformation, BufferLength, GetNextIndex,
-		IgnoreInputIndex, ObjectIndex, DataWritten);
-    return 0xc0000000; /* We don't have any. Whatever. (Yet.) */
-}
-
-/******************************************************************************
- * NtQuerySystemInformation [NTDLL.168]
- *
- * ARGUMENTS:
- *  SystemInformationClass	Index to a certain information structure
- *	SystemTimeAdjustmentInformation       SYSTEM_TIME_ADJUSTMENT
- *	SystemCacheInformation                SYSTEM_CACHE_INFORMATION
- *	SystemConfigurationInformation        CONFIGURATION_INFORMATION
- *	observed (class/len): 
- *		0x0/0x2c
- *		0x12/0x18
- *		0x2/0x138
- *		0x8/0x600
- *  SystemInformation	caller supplies storage for the information structure
- *  Length		size of the structure
- *  ResultLength	Data written
- */
-NTSTATUS WINAPI NtQuerySystemInformation(
-	IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
-	OUT PVOID SystemInformation,
-	IN ULONG Length,
-	OUT PULONG ResultLength)
-{
-	FIXME(ntdll,"(0x%08x,%p,0x%08lx,%p) stub\n",
-	SystemInformationClass,SystemInformation,Length,ResultLength);
-	ZeroMemory (SystemInformation, Length);
-	return 0;
-}
-
-/******************************************************************************
- * NtQueryObject [NTDLL.161]
- */
-NTSTATUS WINAPI NtQueryObject(
-	IN HANDLE ObjectHandle,
-	IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
-	OUT PVOID ObjectInformation,
-	IN ULONG Length,
-	OUT PULONG ResultLength)
-{
-	FIXME(ntdll,"(0x%08x,0x%08x,%p,0x%08lx,%p): stub\n",
-	ObjectHandle, ObjectInformationClass, ObjectInformation, Length, ResultLength);
-	return 0;
-}
-
-
-/******************************************************************************
- * NtSetInformationProcess [NTDLL.207]
- */
-NTSTATUS WINAPI NtSetInformationProcess(
-	IN HANDLE ProcessHandle,
-	IN PROCESSINFOCLASS ProcessInformationClass,
-	IN PVOID ProcessInformation,
-	IN ULONG ProcessInformationLength)
-{
-	FIXME(ntdll,"(0x%08x,0x%08x,%p,0x%08lx) stub\n",
-	ProcessHandle,ProcessInformationClass,ProcessInformation,ProcessInformationLength);
-    return 0;
-}
-
-/******************************************************************************
- * NtFsControlFile [NTDLL.108]
- */
-NTSTATUS WINAPI NtFsControlFile(
-	IN HANDLE DeviceHandle,
-	IN HANDLE Event OPTIONAL,
-	IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
-	IN PVOID ApcContext OPTIONAL,
-	OUT PIO_STATUS_BLOCK IoStatusBlock,
-	IN ULONG IoControlCode,
-	IN PVOID InputBuffer,
-	IN ULONG InputBufferSize,
-	OUT PVOID OutputBuffer,
-	IN ULONG OutputBufferSize)
-{
-	FIXME(ntdll,"(0x%08x,0x%08x,%p,%p,%p,0x%08lx,%p,0x%08lx,%p,0x%08lx): stub\n",
-	DeviceHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,IoControlCode,
-	InputBuffer,InputBufferSize,OutputBuffer,OutputBufferSize);
-	return 0;
-}
-
 /******************************************************************************
  * NtQueryTimerResolution [NTDLL.129]
  */
@@ -294,18 +62,11 @@
 	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx), stub!\n",x1,x2,x3);
 	return 1;
 }
-/**************************************************************************
- *                 NtClose				[NTDLL.65]
- * FUNCTION: Closes a handle reference to an object
- * ARGUMENTS:
- *	Handle	handle to close
+
+/*
+ *	Process object
  */
-NTSTATUS WINAPI NtClose(
-	HANDLE Handle) 
-{
-	FIXME(ntdll,"(0x%08x),stub!\n",Handle);
-	return 1;
-}
+
 /******************************************************************************
 *  NtQueryInformationProcess		[NTDLL.] 
 *
@@ -321,6 +82,50 @@
 	ProcessHandle,ProcessInformationClass,ProcessInformation,ProcessInformationLength,ReturnLength);
 	return 0;
 }
+
+/******************************************************************************
+ * NtSetInformationProcess [NTDLL.207]
+ */
+NTSTATUS WINAPI NtSetInformationProcess(
+	IN HANDLE ProcessHandle,
+	IN PROCESSINFOCLASS ProcessInformationClass,
+	IN PVOID ProcessInformation,
+	IN ULONG ProcessInformationLength)
+{
+	FIXME(ntdll,"(0x%08x,0x%08x,%p,0x%08lx) stub\n",
+	ProcessHandle,ProcessInformationClass,ProcessInformation,ProcessInformationLength);
+	return 0;
+}
+
+/*
+ *	Thread
+ */
+
+/******************************************************************************
+ *  NtResumeThread	[NTDLL] 
+ */
+NTSTATUS WINAPI NtResumeThread(
+	IN HANDLE ThreadHandle,
+	IN PULONG SuspendCount) 
+{
+	FIXME(ntdll,"(0x%08x,%p),stub!\n",
+	ThreadHandle,SuspendCount);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtTerminateThread	[NTDLL] 
+ */
+NTSTATUS WINAPI NtTerminateThread(
+	IN HANDLE ThreadHandle,
+	IN NTSTATUS ExitStatus)
+{
+	if ( TerminateThread(ThreadHandle,ExitStatus) )
+	  return 0;
+
+	return 0xc0000000; /* FIXME: lasterror->ntstatus */
+}
+
 /******************************************************************************
 *  NtQueryInformationThread		[NTDLL.] 
 *
@@ -337,57 +142,68 @@
 		ThreadInformationLength, ReturnLength);
 	return 0;
 }
+
 /******************************************************************************
-*  NtQueryInformationToken		[NTDLL.156] 
-*
-*/
-NTSTATUS WINAPI NtQueryInformationToken(DWORD x1,DWORD x2,DWORD x3,DWORD x4,DWORD x5) 
+ *  NtSetInformationThread		[NTDLL] 
+ */
+NTSTATUS WINAPI NtSetInformationThread(
+	HANDLE ThreadHandle,
+	THREADINFOCLASS ThreadInformationClass,
+	PVOID ThreadInformation,
+	ULONG ThreadInformationLength)
 {
-	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",
-		x1,x2,x3,x4,x5);
+	FIXME(ntdll,"(0x%08x,0x%08x,%p,0x%08lx),stub!\n",
+	ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength);
 	return 0;
 }
 
-/******************************************************************************
- *  NtCreatePagingFile		[NTDLL] 
+/*
+ *	Token
  */
-NTSTATUS WINAPI NtCreatePagingFile(
-	IN PUNICODE_STRING PageFileName,
-	IN ULONG MiniumSize,
-	IN ULONG MaxiumSize,
-	OUT PULONG ActualSize)
-{
-	FIXME(ntdll,"(%p,0x%08lx,0x%08lx,%p),stub!\n",
-	PageFileName,MiniumSize,MaxiumSize,ActualSize);
-	return 0;
-}
-
-/******************************************************************************
- *  NtDuplicateObject		[NTDLL] 
- */
-NTSTATUS WINAPI NtDuplicateObject(
-	IN HANDLE SourceProcessHandle,
-	IN PHANDLE SourceHandle,
-	IN HANDLE TargetProcessHandle,
-	OUT PHANDLE TargetHandle,
-	IN ACCESS_MASK DesiredAccess,
-	IN BOOLEAN InheritHandle,
-	ULONG Options)
-{
-	FIXME(ntdll,"(0x%08x,%p,0x%08x,%p,0x%08lx,0x%08x,0x%08lx) stub!\n",
-	SourceProcessHandle,SourceHandle,TargetProcessHandle,TargetHandle,
-	DesiredAccess,InheritHandle,Options);
-	*TargetHandle = 0;
-	return 0;
-}
 
 /******************************************************************************
  *  NtDuplicateToken		[NTDLL] 
  */
 NTSTATUS WINAPI NtDuplicateToken(
-	DWORD x1,DWORD x2,DWORD x3,DWORD x4,DWORD x5,DWORD x6
-) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4,x5,x6);
+        IN HANDLE ExistingToken,
+        IN ACCESS_MASK DesiredAccess,
+        IN POBJECT_ATTRIBUTES ObjectAttributes,
+        IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel,
+        IN TOKEN_TYPE TokenType,
+        OUT PHANDLE NewToken)
+{
+	FIXME(ntdll,"(0x%08x,0x%08lx,%p,0x%08x,0x%08x,%p),stub!\n",
+	ExistingToken, DesiredAccess, ObjectAttributes, ImpersonationLevel,
+	TokenType, NewToken);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtOpenProcessToken		[NTDLL] 
+ */
+NTSTATUS WINAPI NtOpenProcessToken(
+	HANDLE ProcessHandle,
+	DWORD DesiredAccess, 
+	HANDLE *TokenHandle) 
+{
+	FIXME(ntdll,"(0x%08x,0x%08lx,%p): stub\n",
+	ProcessHandle,DesiredAccess, TokenHandle);
+	*TokenHandle = 0xcafe;
+	return 0;
+}
+
+/******************************************************************************
+ *  NtOpenThreadToken		[NTDLL] 
+ */
+NTSTATUS WINAPI NtOpenThreadToken(
+	HANDLE ThreadHandle,
+	DWORD DesiredAccess, 
+	BOOLEAN OpenAsSelf,
+	HANDLE *TokenHandle) 
+{
+	FIXME(ntdll,"(0x%08x,0x%08lx,0x%08x,%p): stub\n",
+	ThreadHandle,DesiredAccess, OpenAsSelf, TokenHandle);
+	*TokenHandle = 0xcafe;
 	return 0;
 }
 
@@ -410,167 +226,90 @@
 }
 
 /******************************************************************************
- *  NtOpenProcessToken		[NTDLL] 
- */
-NTSTATUS WINAPI NtOpenProcessToken(DWORD x1,DWORD x2,DWORD x3) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3);
-	return 0;
-}
-
-/******************************************************************************
- *  NtSetInformationThread		[NTDLL] 
- */
-NTSTATUS WINAPI NtSetInformationThread(
-	HANDLE ThreadHandle,
-	THREADINFOCLASS ThreadInformationClass,
-	PVOID ThreadInformation,
-	ULONG ThreadInformationLength)
+*  NtQueryInformationToken		[NTDLL.156] 
+*
+*/
+NTSTATUS WINAPI NtQueryInformationToken(
+	HANDLE token,
+	DWORD tokeninfoclass, 
+	LPVOID tokeninfo,
+	DWORD tokeninfolength,
+	LPDWORD retlen ) 
 {
-	FIXME(ntdll,"(0x%08x,0x%08x,%p,0x%08lx),stub!\n",
-	ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength);
+	FIXME(ntdll,"(%08x,%ld,%p,%ld,%p): stub\n",
+	      token,tokeninfoclass,tokeninfo,tokeninfolength,retlen);
+
+	switch (tokeninfoclass)
+	{ case TokenGroups:	/* 2 */
+		*retlen = sizeof (TOKEN_GROUPS);	
+	  case TokenUser:	/* 1 */
+	  case TokenPrivileges:
+	  case TokenOwner:
+	  case TokenPrimaryGroup:
+	  case TokenDefaultDacl:
+	  case TokenSource:
+	  case TokenType:
+	  case TokenImpersonationLevel:
+	  case TokenStatistics:
+
+	}
+
 	return 0;
 }
 
-/******************************************************************************
- *  NtOpenThreadToken		[NTDLL] 
+/*
+ *	Section
  */
-NTSTATUS WINAPI NtOpenThreadToken(DWORD x1,DWORD x2,DWORD x3,DWORD x4) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx) stub\n",x1,x2,x3,x4);
-	return 0;
-}
-
+ 
 /******************************************************************************
- *  NtSetVolumeInformationFile		[NTDLL] 
+ *  NtCreateSection	[NTDLL] 
  */
-NTSTATUS WINAPI NtSetVolumeInformationFile(
-	IN HANDLE FileHandle,
-	IN PVOID VolumeInformationClass,
-	PVOID VolumeInformation,
-	ULONG Length) 
-{
-	FIXME(ntdll,"(0x%08x,%p,%p,0x%08lx) stub\n",
-	FileHandle,VolumeInformationClass,VolumeInformation,Length);
-	return 0;
-}
-
-/******************************************************************************
- *  NtCreatePort		[NTDLL] 
- */
-NTSTATUS WINAPI NtCreatePort(DWORD x1,DWORD x2,DWORD x3,DWORD x4,DWORD x5) 
-{
-	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4,x5);
-	return 0;
-}
-
-/******************************************************************************
- *  NtSetInformationFile		[NTDLL] 
- */
-NTSTATUS WINAPI NtSetInformationFile(
-	HANDLE FileHandle,
-	PIO_STATUS_BLOCK IoStatusBlock,
-	PVOID FileInformation,
-	ULONG Length,
-	FILE_INFORMATION_CLASS FileInformationClass)
-{
-	FIXME(ntdll,"(0x%08x,%p,%p,0x%08lx,0x%08x)\n",
-	FileHandle,IoStatusBlock,FileInformation,Length,FileInformationClass);
-	return 0;
-}
-
-/******************************************************************************
- *  NtSetEvent		[NTDLL] 
- */
-NTSTATUS WINAPI NtSetEvent(
-	IN HANDLE EventHandle,
-	PULONG NumberOfThreadsReleased)
-{
-	FIXME(ntdll,"(0x%08x,%p)\n",
-	EventHandle, NumberOfThreadsReleased);
-	return 0;
-}
-
-
-/******************************************************************************
- *  NtQueryInformationFile		[NTDLL] 
- */
-NTSTATUS WINAPI NtQueryInformationFile(
-	HANDLE FileHandle,
-	PIO_STATUS_BLOCK IoStatusBlock,
-	PVOID FileInformation,
-	ULONG Length,
-	FILE_INFORMATION_CLASS FileInformationClass)
-{
-	FIXME(ntdll,"(0x%08x,%p,%p,0x%08lx,0x%08x),stub!\n",
-	FileHandle,IoStatusBlock,FileInformation,Length,FileInformationClass);
-	return 0;
-}
-
-/******************************************************************************
- *  NtOpenEvent		[NTDLL] 
- */
-NTSTATUS WINAPI NtOpenEvent(
-	OUT PHANDLE EventHandle,
+NTSTATUS WINAPI NtCreateSection(
+	OUT PHANDLE SectionHandle,
 	IN ACCESS_MASK DesiredAccess,
-	IN POBJECT_ATTRIBUTES ObjectAttributes)
+	IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
+	IN PLARGE_INTEGER MaximumSize OPTIONAL,
+	IN ULONG SectionPageProtection OPTIONAL,
+	IN ULONG AllocationAttributes,
+	IN HANDLE FileHandle OPTIONAL)
 {
-	FIXME(ntdll,"(%p,0x%08lx,%p(%s)),stub!\n",
-	EventHandle,DesiredAccess,ObjectAttributes,
-	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL);
+	FIXME(ntdll,"(%p,0x%08lx,%p(%s),%p,0x%08lx,0x%08lx,0x%08x) stub\n",
+	SectionHandle,DesiredAccess,ObjectAttributes,
+	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL,
+	MaximumSize,SectionPageProtection,AllocationAttributes,FileHandle);
 	return 0;
 }
 
 /******************************************************************************
- *  NtWaitForSingleObject		[NTDLL] 
+ *  NtOpenSection	[NTDLL] 
  */
-NTSTATUS WINAPI NtWaitForSingleObject(
-	IN PHANDLE Object,
-	IN BOOLEAN Alertable,
-	IN PLARGE_INTEGER Time)
-{
-	FIXME(ntdll,"(%p,0x%08x,%p),stub!\n",Object,Alertable,Time);
-	return 0;
-}
-
-/******************************************************************************
- *  NtConnectPort		[NTDLL] 
- */
-NTSTATUS WINAPI NtConnectPort(DWORD x1,PUNICODE_STRING uni,DWORD x3,DWORD x4,DWORD x5,DWORD x6,DWORD x7,DWORD x8) {
-	FIXME(ntdll,"(0x%08lx,%s,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",
-	x1,debugstr_w(uni->Buffer),x3,x4,x5,x6,x7,x8);
-	return 0;
-}
-
-/******************************************************************************
- *  NtListenPort		[NTDLL] 
- */
-NTSTATUS WINAPI NtListenPort(DWORD x1,DWORD x2) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx),stub!\n",x1,x2);
-	return 0;
-}
-
-/******************************************************************************
- *  NtRequestWaitReplyPort		[NTDLL] 
- */
-NTSTATUS WINAPI NtRequestWaitReplyPort(DWORD x1,DWORD x2,DWORD x3) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3);
-	return 0;
-}
-
-/******************************************************************************
- *  NtCreateDirectoryObject	[NTDLL] 
- */
-NTSTATUS WINAPI NtCreateDirectoryObject(
-	PHANDLE DirectoryHandle,
+NTSTATUS WINAPI NtOpenSection(
+	PHANDLE SectionHandle,
 	ACCESS_MASK DesiredAccess,
-	POBJECT_ATTRIBUTES ObjectAttributes) 
+	POBJECT_ATTRIBUTES ObjectAttributes)
 {
 	FIXME(ntdll,"(%p,0x%08lx,%p(%s)),stub!\n",
-	DirectoryHandle,DesiredAccess,ObjectAttributes,
+	SectionHandle,DesiredAccess,ObjectAttributes,
 	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL);
 	return 0;
 }
 
 /******************************************************************************
+ *  NtQuerySection	[NTDLL] 
+ */
+NTSTATUS WINAPI NtQuerySection(
+	IN HANDLE SectionHandle,
+	IN PVOID SectionInformationClass,
+	OUT PVOID SectionInformation,
+	IN ULONG Length,
+	OUT PULONG ResultLength)
+{
+	FIXME(ntdll,"(0x%08x,%p,%p,0x%08lx,%p) stub!\n",
+	SectionHandle,SectionInformationClass,SectionInformation,Length,ResultLength);
+	return 0;
+}
+
+/******************************************************************************
  * NtMapViewOfSection	[NTDLL] 
  * FUNCTION: Maps a view of a section into the virtual address space of a process
  *
@@ -607,88 +346,43 @@
 	return 0;
 }
 
-/******************************************************************************
- *  NtCreateMailSlotFile	[NTDLL] 
+/*
+ *	ports
  */
-NTSTATUS WINAPI NtCreateMailslotFile(DWORD x1,DWORD x2,DWORD x3,DWORD x4,DWORD x5,DWORD x6,DWORD x7,DWORD x8) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4,x5,x6,x7,x8);
-	return 0;
-}
 
 /******************************************************************************
- *  NtReadFile/ZwReadFile			[NTDLL] 
- *
- * Parameters
- *   HANDLE32 		FileHandle
- *   HANDLE32 		Event 		OPTIONAL
- *   PIO_APC_ROUTINE 	ApcRoutine 	OPTIONAL
- *   PVOID 		ApcContext 	OPTIONAL
- *   PIO_STATUS_BLOCK 	IoStatusBlock
- *   PVOID 		Buffer
- *   ULONG 		Length
- *   PLARGE_INTEGER 	ByteOffset 	OPTIONAL
- *   PULONG 		Key 		OPTIONAL
+ *  NtCreatePort		[NTDLL] 
  */
-NTSTATUS WINAPI NtReadFile (
-	HANDLE FileHandle,
-	HANDLE EventHandle,
-	PIO_APC_ROUTINE ApcRoutine,
-	PVOID ApcContext,
-	PIO_STATUS_BLOCK IoStatusBlock,
-	PVOID Buffer,
-	ULONG Length,
-	PLARGE_INTEGER ByteOffset,
-	PULONG Key)
+NTSTATUS WINAPI NtCreatePort(DWORD x1,DWORD x2,DWORD x3,DWORD x4,DWORD x5) 
 {
-	FIXME(ntdll,"(0x%08x,0x%08x,%p,%p,%p,%p,0x%08lx,%p,%p),stub!\n",
-	FileHandle,EventHandle,ApcRoutine,ApcContext,IoStatusBlock,Buffer,Length,ByteOffset,Key);
+	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4,x5);
 	return 0;
 }
 
-
 /******************************************************************************
- *  NtCreateSection	[NTDLL] 
+ *  NtConnectPort		[NTDLL] 
  */
-NTSTATUS WINAPI NtCreateSection(
-	OUT PHANDLE SectionHandle,
-	IN ACCESS_MASK DesiredAccess,
-	IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
-	IN PLARGE_INTEGER MaximumSize OPTIONAL,
-	IN ULONG SectionPageProtection OPTIONAL,
-	IN ULONG AllocationAttributes,
-	IN HANDLE FileHandle OPTIONAL)
+NTSTATUS WINAPI NtConnectPort(DWORD x1,PUNICODE_STRING uni,DWORD x3,DWORD x4,DWORD x5,DWORD x6,DWORD x7,DWORD x8) 
 {
-	FIXME(ntdll,"(%p,0x%08lx,%p(%s),%p,0x%08lx,0x%08lx,0x%08x) stub\n",
-	SectionHandle,DesiredAccess,ObjectAttributes,
-	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL,
-	MaximumSize,SectionPageProtection,AllocationAttributes,FileHandle);
+	FIXME(ntdll,"(0x%08lx,%s,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",
+	x1,debugstr_w(uni->Buffer),x3,x4,x5,x6,x7,x8);
 	return 0;
 }
 
 /******************************************************************************
- *  NtResumeThread	[NTDLL] 
+ *  NtListenPort		[NTDLL] 
  */
-NTSTATUS WINAPI NtResumeThread(
-	IN HANDLE ThreadHandle,
-	IN PULONG SuspendCount) 
+NTSTATUS WINAPI NtListenPort(DWORD x1,DWORD x2) 
 {
-	FIXME(ntdll,"(0x%08x,%p),stub!\n",
-	ThreadHandle,SuspendCount);
-	return 0;
-}
-
-/******************************************************************************
- *  NtReplyWaitReceivePort	[NTDLL] 
- */
-NTSTATUS WINAPI NtReplyWaitReceivePort(DWORD x1,DWORD x2,DWORD x3,DWORD x4) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4);
+	FIXME(ntdll,"(0x%08lx,0x%08lx),stub!\n",x1,x2);
 	return 0;
 }
 
 /******************************************************************************
  *  NtAcceptConnectPort	[NTDLL] 
  */
-NTSTATUS WINAPI NtAcceptConnectPort(DWORD x1,DWORD x2,DWORD x3,DWORD x4,DWORD x5,DWORD x6) {
+NTSTATUS WINAPI NtAcceptConnectPort(DWORD x1,DWORD x2,DWORD x3,DWORD x4,DWORD x5,DWORD x6) 
+{
 	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4,x5,x6);
 	return 0;
 }
@@ -696,7 +390,8 @@
 /******************************************************************************
  *  NtCompleteConnectPort	[NTDLL] 
  */
-NTSTATUS WINAPI NtCompleteConnectPort(DWORD x1) {
+NTSTATUS WINAPI NtCompleteConnectPort(DWORD x1) 
+{
 	FIXME(ntdll,"(0x%08lx),stub!\n",x1);
 	return 0;
 }
@@ -704,25 +399,35 @@
 /******************************************************************************
  *  NtRegisterThreadTerminatePort	[NTDLL] 
  */
-NTSTATUS WINAPI NtRegisterThreadTerminatePort(DWORD x1) {
+NTSTATUS WINAPI NtRegisterThreadTerminatePort(DWORD x1) 
+{
 	FIXME(ntdll,"(0x%08lx),stub!\n",x1);
 	return 0;
 }
 
 /******************************************************************************
- *  NtTerminateThread	[NTDLL] 
+ *  NtRequestWaitReplyPort		[NTDLL] 
  */
-NTSTATUS WINAPI NtTerminateThread(
-	IN HANDLE ThreadHandle,
-	IN NTSTATUS ExitStatus)
+NTSTATUS WINAPI NtRequestWaitReplyPort(DWORD x1,DWORD x2,DWORD x3) 
 {
-	if ( TerminateThread(ThreadHandle,ExitStatus) )
-	  return 0;
-
-	return 0xc0000000; /* FIXME: lasterror->ntstatus */
+	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3);
+	return 0;
 }
 
 /******************************************************************************
+ *  NtReplyWaitReceivePort	[NTDLL] 
+ */
+NTSTATUS WINAPI NtReplyWaitReceivePort(DWORD x1,DWORD x2,DWORD x3,DWORD x4) 
+{
+	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4);
+	return 0;
+}
+
+/*
+ *	Misc
+ */
+
+ /******************************************************************************
  *  NtSetIntervalProfile	[NTDLL] 
  */
 NTSTATUS WINAPI NtSetIntervalProfile(DWORD x1,DWORD x2) {
@@ -731,19 +436,6 @@
 }
 
 /******************************************************************************
- *  NtOpenSection	[NTDLL] 
- */
-NTSTATUS WINAPI NtOpenSection(
-	PHANDLE SectionHandle,
-	ACCESS_MASK DesiredAccess,
-	POBJECT_ATTRIBUTES ObjectAttributes)
-{
-	FIXME(ntdll,"(%p,0x%08lx,%p(%s)),stub!\n",
-	SectionHandle,DesiredAccess,ObjectAttributes,
-	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL);
-	return 0;
-}
-/******************************************************************************
  *  NtQueryPerformanceCounter	[NTDLL] 
  */
 NTSTATUS WINAPI NtQueryPerformanceCounter(
@@ -754,123 +446,57 @@
 	Counter, Frequency);
 	return 0;
 }
+
 /******************************************************************************
- *  NtQuerySection	[NTDLL] 
+ *  NtCreateMailSlotFile	[NTDLL] 
  */
-NTSTATUS WINAPI NtQuerySection(
-	IN HANDLE SectionHandle,
-	IN PVOID SectionInformationClass,
-	OUT PVOID SectionInformation,
+NTSTATUS WINAPI NtCreateMailslotFile(DWORD x1,DWORD x2,DWORD x3,DWORD x4,DWORD x5,DWORD x6,DWORD x7,DWORD x8) 
+{
+	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4,x5,x6,x7,x8);
+	return 0;
+}
+
+/******************************************************************************
+ * NtQuerySystemInformation [NTDLL.168]
+ *
+ * ARGUMENTS:
+ *  SystemInformationClass	Index to a certain information structure
+ *	SystemTimeAdjustmentInformation	SYSTEM_TIME_ADJUSTMENT
+ *	SystemCacheInformation		SYSTEM_CACHE_INFORMATION
+ *	SystemConfigurationInformation	CONFIGURATION_INFORMATION
+ *	observed (class/len): 
+ *		0x0/0x2c
+ *		0x12/0x18
+ *		0x2/0x138
+ *		0x8/0x600
+ *  SystemInformation	caller supplies storage for the information structure
+ *  Length		size of the structure
+ *  ResultLength	Data written
+ */
+NTSTATUS WINAPI NtQuerySystemInformation(
+	IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
+	OUT PVOID SystemInformation,
 	IN ULONG Length,
 	OUT PULONG ResultLength)
 {
-	FIXME(ntdll,"(0x%08x,%p,%p,0x%08lx,%p) stub!\n",
-	SectionHandle,SectionInformationClass,SectionInformation,Length,ResultLength);
+	FIXME(ntdll,"(0x%08x,%p,0x%08lx,%p) stub\n",
+	SystemInformationClass,SystemInformation,Length,ResultLength);
+	ZeroMemory (SystemInformation, Length);
 	return 0;
 }
 
+
 /******************************************************************************
- *  NtQuerySecurityObject	[NTDLL] 
+ *  NtCreatePagingFile		[NTDLL] 
  */
-NTSTATUS WINAPI NtQuerySecurityObject(DWORD x1,DWORD x2,DWORD x3,DWORD x4,DWORD x5) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx) stub!\n",x1,x2,x3,x4,x5);
-	return 0;
-}
-/******************************************************************************
- *  NtCreateSemaphore	[NTDLL] 
- */
-NTSTATUS WINAPI NtCreateSemaphore(
-	OUT PHANDLE SemaphoreHandle,
-	IN ACCESS_MASK DesiredAccess,
-	IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
-	IN ULONG InitialCount,
-	IN ULONG MaximumCount) 
+NTSTATUS WINAPI NtCreatePagingFile(
+	IN PUNICODE_STRING PageFileName,
+	IN ULONG MiniumSize,
+	IN ULONG MaxiumSize,
+	OUT PULONG ActualSize)
 {
-	FIXME(ntdll,"(%p,0x%08lx,%p(%s),0x%08lx,0x%08lx) stub!\n",
-	SemaphoreHandle, DesiredAccess, ObjectAttributes, 
-	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL,
-	InitialCount, MaximumCount);
-	return 0;
-}
-/******************************************************************************
- *  NtOpenSemaphore	[NTDLL] 
- */
-NTSTATUS WINAPI NtOpenSemaphore(
-	IN HANDLE SemaphoreHandle,
-	IN ACCESS_MASK DesiredAcces,
-	IN POBJECT_ATTRIBUTES ObjectAttributes)
-{
-	FIXME(ntdll,"(0x%08x,0x%08lx,%p(%s)) stub!\n",
-	SemaphoreHandle, DesiredAcces, ObjectAttributes,
-	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL);
+	FIXME(ntdll,"(%p,0x%08lx,0x%08lx,%p),stub!\n",
+	debugstr_w(PageFileName->Buffer),MiniumSize,MaxiumSize,ActualSize);
 	return 0;
 }
 
-/******************************************************************************
- *  NtQuerySemaphore	[NTDLL] 
- */
-NTSTATUS WINAPI NtQuerySemaphore(
-	HANDLE SemaphoreHandle,
-	PVOID SemaphoreInformationClass,
-	OUT PVOID SemaphoreInformation,
-	ULONG Length,
-	PULONG ReturnLength) 
-{
-	FIXME(ntdll,"(0x%08x,%p,%p,0x%08lx,%p) stub!\n",
-	SemaphoreHandle, SemaphoreInformationClass, SemaphoreInformation, Length, ReturnLength);
-	return 0;
-}
-/******************************************************************************
- *  NtQuerySemaphore	[NTDLL] 
- */
-NTSTATUS WINAPI NtReleaseSemaphore(
-	IN HANDLE SemaphoreHandle,
-	IN ULONG ReleaseCount,
-	IN PULONG PreviousCount)
-{
-	FIXME(ntdll,"(0x%08x,0x%08lx,%p,) stub!\n",
-	SemaphoreHandle, ReleaseCount, PreviousCount);
-	return 0;
-}
-
-/******************************************************************************
- *  NtCreateSymbolicLinkObject	[NTDLL] 
- */
-NTSTATUS WINAPI NtCreateSymbolicLinkObject(
-	OUT PHANDLE SymbolicLinkHandle,
-	IN ACCESS_MASK DesiredAccess,
-	IN POBJECT_ATTRIBUTES ObjectAttributes,
-	IN PUNICODE_STRING Name)
-{
-	FIXME(ntdll,"(%p,0x%08lx,%p(%s), %p) stub\n",
-	SymbolicLinkHandle, DesiredAccess, ObjectAttributes, 
-	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL, Name);
-	return 0;
-}
-
-/******************************************************************************
- *  NtOpenSymbolicLinkObject	[NTDLL] 
- */
-NTSTATUS WINAPI NtOpenSymbolicLinkObject(
-	OUT PHANDLE LinkHandle,
-	IN ACCESS_MASK DesiredAccess,
-	IN POBJECT_ATTRIBUTES ObjectAttributes)
-{
-	FIXME(ntdll,"(%p,0x%08lx,%p(%s)) stub\n",
-	LinkHandle, DesiredAccess, ObjectAttributes,
-	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL);
-	return 0;
-}
-/******************************************************************************
- *  NtQuerySymbolicLinkObject	[NTDLL] 
- */
-NTSTATUS NtQuerySymbolicLinkObject(
-	IN HANDLE LinkHandle,
-	IN OUT PUNICODE_STRING LinkTarget,
-	OUT PULONG ReturnedLength OPTIONAL)
-{
-	FIXME(ntdll,"(0x%08x,%p,%p) stub\n",
-	LinkHandle, LinkTarget, ReturnedLength);
-
-	return 0;
-}
diff --git a/dlls/ntdll/om.c b/dlls/ntdll/om.c
new file mode 100644
index 0000000..dc9a3b0
--- /dev/null
+++ b/dlls/ntdll/om.c
@@ -0,0 +1,198 @@
+/*
+ *	Object management functions
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include "debug.h"
+
+#include "ntddk.h"
+
+/* move to somewhere */
+typedef void * POBJDIR_INFORMATION;
+
+/*
+ *	Generic object functions
+ */
+ 
+/******************************************************************************
+ * NtQueryObject [NTDLL.161]
+ */
+NTSTATUS WINAPI NtQueryObject(
+	IN HANDLE ObjectHandle,
+	IN OBJECT_INFORMATION_CLASS ObjectInformationClass,
+	OUT PVOID ObjectInformation,
+	IN ULONG Length,
+	OUT PULONG ResultLength)
+{
+	FIXME(ntdll,"(0x%08x,0x%08x,%p,0x%08lx,%p): stub\n",
+	ObjectHandle, ObjectInformationClass, ObjectInformation, Length, ResultLength);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtQuerySecurityObject	[NTDLL] 
+ */
+NTSTATUS WINAPI NtQuerySecurityObject(DWORD x1,DWORD x2,DWORD x3,DWORD x4,DWORD x5) 
+{
+	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx) stub!\n",x1,x2,x3,x4,x5);
+	return 0;
+}
+/******************************************************************************
+ *  NtDuplicateObject		[NTDLL] 
+ */
+NTSTATUS WINAPI NtDuplicateObject(
+	IN HANDLE SourceProcessHandle,
+	IN PHANDLE SourceHandle,
+	IN HANDLE TargetProcessHandle,
+	OUT PHANDLE TargetHandle,
+	IN ACCESS_MASK DesiredAccess,
+	IN BOOLEAN InheritHandle,
+	ULONG Options)
+{
+	FIXME(ntdll,"(0x%08x,%p,0x%08x,%p,0x%08lx,0x%08x,0x%08lx) stub!\n",
+	SourceProcessHandle,SourceHandle,TargetProcessHandle,TargetHandle,
+	DesiredAccess,InheritHandle,Options);
+	*TargetHandle = 0;
+	return 0;
+}
+
+/**************************************************************************
+ *                 NtClose				[NTDLL.65]
+ * FUNCTION: Closes a handle reference to an object
+ * ARGUMENTS:
+ *	Handle	handle to close
+ */
+NTSTATUS WINAPI NtClose(
+	HANDLE Handle) 
+{
+	FIXME(ntdll,"(0x%08x),stub!\n",Handle);
+	return 1;
+}
+
+/******************************************************************************
+ *  NtWaitForSingleObject		[NTDLL] 
+ */
+NTSTATUS WINAPI NtWaitForSingleObject(
+	IN PHANDLE Object,
+	IN BOOLEAN Alertable,
+	IN PLARGE_INTEGER Time)
+{
+	FIXME(ntdll,"(%p,0x%08x,%p),stub!\n",Object,Alertable,Time);
+	return 0;
+}
+
+/*
+ *	Directory functions
+ */
+
+/**************************************************************************
+ * NtOpenDirectoryObject [NTDLL.124]
+ * FUNCTION: Opens a namespace directory object
+ * ARGUMENTS:
+ *  DirectoryHandle	Variable which receives the directory handle
+ *  DesiredAccess	Desired access to the directory
+ *  ObjectAttributes	Structure describing the directory
+ * RETURNS: Status
+ */
+NTSTATUS WINAPI NtOpenDirectoryObject(
+	PHANDLE DirectoryHandle,
+	ACCESS_MASK DesiredAccess,
+	POBJECT_ATTRIBUTES ObjectAttributes)
+{
+    FIXME(ntdll,"(%p,0x%08lx,%p(%s)): stub\n", 
+    DirectoryHandle, DesiredAccess, ObjectAttributes,
+    ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL);
+    return 0;
+}
+
+/******************************************************************************
+ *  NtCreateDirectoryObject	[NTDLL] 
+ */
+NTSTATUS WINAPI NtCreateDirectoryObject(
+	PHANDLE DirectoryHandle,
+	ACCESS_MASK DesiredAccess,
+	POBJECT_ATTRIBUTES ObjectAttributes) 
+{
+	FIXME(ntdll,"(%p,0x%08lx,%p(%s)),stub!\n",
+	DirectoryHandle,DesiredAccess,ObjectAttributes,
+	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL);
+	return 0;
+}
+
+/******************************************************************************
+ * NtQueryDirectoryObject [NTDLL.149] 
+ * FUNCTION: Reads information from a namespace directory
+ * ARGUMENTS:
+ *  DirObjInformation	Buffer to hold the data read
+ *  BufferLength	Size of the buffer in bytes
+ *  GetNextIndex	If TRUE then set ObjectIndex to the index of the next object
+ *			If FALSE then set ObjectIndex to the number of objects in the directory
+ *  IgnoreInputIndex	If TRUE start reading at index 0
+ *			If FALSE start reading at the index specified by object index
+ *  ObjectIndex		Zero based index into the directory, interpretation depends on IgnoreInputIndex and GetNextIndex
+ *  DataWritten		Caller supplied storage for the number of bytes written (or NULL)
+ */
+NTSTATUS WINAPI NtQueryDirectoryObject(
+	IN HANDLE DirObjHandle,
+	OUT POBJDIR_INFORMATION DirObjInformation,
+	IN ULONG BufferLength,
+	IN BOOLEAN GetNextIndex,
+	IN BOOLEAN IgnoreInputIndex,
+	IN OUT PULONG ObjectIndex,
+	OUT PULONG DataWritten OPTIONAL)
+{
+	FIXME(ntdll,"(0x%08x,%p,0x%08lx,0x%08x,0x%08x,%p,%p) stub\n",
+		DirObjHandle, DirObjInformation, BufferLength, GetNextIndex,
+		IgnoreInputIndex, ObjectIndex, DataWritten);
+    return 0xc0000000; /* We don't have any. Whatever. (Yet.) */
+}
+
+/*
+ *	Link objects
+ */
+ 
+/******************************************************************************
+ *  NtOpenSymbolicLinkObject	[NTDLL] 
+ */
+NTSTATUS WINAPI NtOpenSymbolicLinkObject(
+	OUT PHANDLE LinkHandle,
+	IN ACCESS_MASK DesiredAccess,
+	IN POBJECT_ATTRIBUTES ObjectAttributes)
+{
+	FIXME(ntdll,"(%p,0x%08lx,%p(%s)) stub\n",
+	LinkHandle, DesiredAccess, ObjectAttributes,
+	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtCreateSymbolicLinkObject	[NTDLL] 
+ */
+NTSTATUS WINAPI NtCreateSymbolicLinkObject(
+	OUT PHANDLE SymbolicLinkHandle,
+	IN ACCESS_MASK DesiredAccess,
+	IN POBJECT_ATTRIBUTES ObjectAttributes,
+	IN PUNICODE_STRING Name)
+{
+	FIXME(ntdll,"(%p,0x%08lx,%p(%s), %p) stub\n",
+	SymbolicLinkHandle, DesiredAccess, ObjectAttributes, 
+	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL,
+	debugstr_w(Name->Buffer));
+	return 0;
+}
+
+/******************************************************************************
+ *  NtQuerySymbolicLinkObject	[NTDLL] 
+ */
+NTSTATUS WINAPI NtQuerySymbolicLinkObject(
+	IN HANDLE LinkHandle,
+	IN OUT PUNICODE_STRING LinkTarget,
+	OUT PULONG ReturnedLength OPTIONAL)
+{
+	FIXME(ntdll,"(0x%08x,%p,%p) stub\n",
+	LinkHandle, debugstr_w(LinkTarget->Buffer), ReturnedLength);
+
+	return 0;
+}
+
diff --git a/dlls/ntdll/reg.c b/dlls/ntdll/reg.c
index 5d5be5d..542dcf9 100644
--- a/dlls/ntdll/reg.c
+++ b/dlls/ntdll/reg.c
@@ -1,10 +1,12 @@
-#include "windef.h"
-#include "wintypes.h"
-#include "winreg.h"
-#include "ntdll.h"
-#include "ntddk.h"
+/*
+ *	registry functions
+ */
 
 #include "debug.h"
+#include "winreg.h"
+
+#include "ntddk.h"
+
 
 /******************************************************************************
  * NtCreateKey [NTDLL]
diff --git a/dlls/ntdll/rtl.c b/dlls/ntdll/rtl.c
index 2d67362..1b2aa48 100644
--- a/dlls/ntdll/rtl.c
+++ b/dlls/ntdll/rtl.c
@@ -9,758 +9,20 @@
 
 #include <stdlib.h>
 #include <string.h>
-#include <time.h>
-#include <ctype.h>
-#include <math.h>
-#include "windef.h"
-#include "winbase.h"
-#include "winuser.h"
-#include "wine/winestring.h"
-#include "file.h"
 #include "heap.h"
-#include "winnls.h"
-#include "debugstr.h"
 #include "debug.h"
 #include "winuser.h"
 #include "winerror.h"
 #include "stackframe.h"
 
-#include "ntdll.h"
-#include "ntdef.h"
+#include "ntddk.h"
 #include "winreg.h"
 
 
-/*	##############################
-	######	SID FUNCTIONS	######
-	##############################
-*/
-/******************************************************************************
- *  RtlAllocateAndInitializeSid		[NTDLL.265] 
- *
- */
-BOOLEAN WINAPI RtlAllocateAndInitializeSid (PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
-	DWORD nSubAuthorityCount,DWORD x3,DWORD x4,DWORD x5,DWORD x6,DWORD x7,DWORD x8,DWORD x9,DWORD x10, PSID pSid) 
-{
-	FIXME(ntdll,"(%p,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,%p),stub!\n",
-		pIdentifierAuthority,nSubAuthorityCount,x3,x4,x5,x6,x7,x8,x9,x10,pSid);
-	return 0;
-}
-/******************************************************************************
- *  RtlEqualSid		[NTDLL.352] 
- *
- */
-DWORD WINAPI RtlEqualSid(DWORD x1,DWORD x2) 
-{	
-	FIXME(ntdll,"(0x%08lx,0x%08lx),stub!\n", x1,x2);
-	return TRUE;
-}
-
-/******************************************************************************
- *  RtlFreeSid		[NTDLL.376] 
- */
-DWORD WINAPI RtlFreeSid(DWORD x1) 
-{
-	FIXME(ntdll,"(0x%08lx),stub!\n", x1);
-	return TRUE;
-}
-
-/**************************************************************************
- *                 RtlLengthRequiredSid			[NTDLL.427]
- */
-DWORD WINAPI RtlLengthRequiredSid(DWORD nrofsubauths)
-{
-	return sizeof(DWORD)*nrofsubauths+sizeof(SID);
-}
-
-/**************************************************************************
- *                 RtlLengthSid				[NTDLL.429]
- */
-DWORD WINAPI RtlLengthSid(PSID sid)
-{
-	TRACE(ntdll,"sid=%p\n",sid);
-	if (!sid)
-	  return FALSE; 
-	return sizeof(DWORD)*sid->SubAuthorityCount+sizeof(SID);
-}
-
-/**************************************************************************
- *                 RtlInitializeSid			[NTDLL.410]
- */
-DWORD WINAPI RtlInitializeSid(PSID PSID,PSID_IDENTIFIER_AUTHORITY PSIDauth,
-                              DWORD c)
-{
-	BYTE	a = c&0xff;
-
-	if (a>=SID_MAX_SUB_AUTHORITIES)
-		return a;
-	PSID->SubAuthorityCount = a;
-	PSID->Revision		 = SID_REVISION;
-	memcpy(&(PSID->IdentifierAuthority),PSIDauth,sizeof(SID_IDENTIFIER_AUTHORITY));
-	return STATUS_SUCCESS;
-}
-
-/**************************************************************************
- *                 RtlSubAuthoritySid			[NTDLL.497]
- */
-LPDWORD WINAPI RtlSubAuthoritySid(PSID PSID,DWORD nr)
-{
-	return &(PSID->SubAuthority[nr]);
-}
-
-/**************************************************************************
- *                 RtlSubAuthorityCountSid		[NTDLL.496]
+/*
+ *	resource functions
  */
 
-LPBYTE WINAPI RtlSubAuthorityCountSid(PSID PSID)
-{
-	return ((LPBYTE)PSID)+1;
-}
-
-/**************************************************************************
- *                 RtlCopySid				[NTDLL.302]
- */
-DWORD WINAPI RtlCopySid(DWORD len,PSID to,PSID from)
-{	if (!from)
-		return 0;
-	if (len<(from->SubAuthorityCount*4+8))
-		return STATUS_BUFFER_TOO_SMALL;
-	memmove(to,from,from->SubAuthorityCount*4+8);
-	return STATUS_SUCCESS;
-}
-
-/*	##############################################
-	######	SECURITY DESCRIPTOR FUNCTIONS	######
-	##############################################
-*/
-/**************************************************************************
- * RtlCreateSecurityDescriptor			[NTDLL.313]
- *
- * RETURNS:
- *  0 success, 
- *  STATUS_INVALID_OWNER, STATUS_PRIVILEGE_NOT_HELD, STATUS_NO_INHERITANCE,
- *  STATUS_NO_MEMORY 
- */
-NTSTATUS WINAPI RtlCreateSecurityDescriptor(
-	PSECURITY_DESCRIPTOR lpsd,
-	DWORD rev)
-{
-	if (rev!=SECURITY_DESCRIPTOR_REVISION)
-		return STATUS_UNKNOWN_REVISION;
-	memset(lpsd,'\0',sizeof(*lpsd));
-	lpsd->Revision = SECURITY_DESCRIPTOR_REVISION;
-	return STATUS_SUCCESS;
-}
-/**************************************************************************
- * RtlValidSecurityDescriptor			[NTDLL.313]
- *
- */
-NTSTATUS WINAPI RtlValidSecurityDescriptor(
-	PSECURITY_DESCRIPTOR SecurityDescriptor)
-{
-	if ( ! SecurityDescriptor )
-		return STATUS_INVALID_SECURITY_DESCR;
-	if ( SecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION )
-		return STATUS_UNKNOWN_REVISION;
-
-	return STATUS_SUCCESS;
-}
-
-/******************************************************************************
- *  RtlGetDaclSecurityDescriptor		[NTDLL] 
- *
- */
-DWORD WINAPI RtlGetDaclSecurityDescriptor(
-	IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
-	OUT PBOOLEAN lpbDaclPresent,
-	OUT PACL *pDacl,
-	OUT PBOOLEAN lpbDaclDefaulted)
-{
-	TRACE(ntdll,"(%p,%p,%p,%p)\n",
-	pSecurityDescriptor, lpbDaclPresent, *pDacl, lpbDaclDefaulted);
-
-	if (pSecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION)
-	  return STATUS_UNKNOWN_REVISION ;
-
-	if ( (*lpbDaclPresent = (SE_DACL_PRESENT & pSecurityDescriptor->Control) ? 1 : 0) )
-	{
-	  if ( SE_SELF_RELATIVE & pSecurityDescriptor->Control)
-	  { *pDacl = (PACL) ((LPBYTE)pSecurityDescriptor + (DWORD)pSecurityDescriptor->Dacl);
-	  }
-	  else
-	  { *pDacl = pSecurityDescriptor->Dacl;
-	  }
-	}
-
-	*lpbDaclDefaulted = (( SE_DACL_DEFAULTED & pSecurityDescriptor->Control ) ? 1 : 0);
-	
-	return STATUS_SUCCESS;
-}
-
-/**************************************************************************
- *  RtlSetDaclSecurityDescriptor		[NTDLL.483]
- */
-NTSTATUS WINAPI RtlSetDaclSecurityDescriptor (
-	PSECURITY_DESCRIPTOR lpsd,
-	BOOLEAN daclpresent,
-	PACL dacl,
-	BOOLEAN dacldefaulted )
-{
-	if (lpsd->Revision!=SECURITY_DESCRIPTOR_REVISION)
-		return STATUS_UNKNOWN_REVISION;
-	if (lpsd->Control & SE_SELF_RELATIVE)
-		return STATUS_INVALID_SECURITY_DESCR;
-
-	if (!daclpresent) 
-	{	lpsd->Control &= ~SE_DACL_PRESENT;
-		return TRUE;
-	}
-
-	lpsd->Control |= SE_DACL_PRESENT;
-	lpsd->Dacl = dacl;
-
-	if (dacldefaulted)
-		lpsd->Control |= SE_DACL_DEFAULTED;
-	else
-		lpsd->Control &= ~SE_DACL_DEFAULTED;
-
-	return STATUS_SUCCESS;
-}
-/**************************************************************************
- *  RtlLengthSecurityDescriptor			[NTDLL]
- */
-ULONG WINAPI RtlLengthSecurityDescriptor(
-	PSECURITY_DESCRIPTOR SecurityDescriptor)
-{
-	ULONG Size;
-	Size = SECURITY_DESCRIPTOR_MIN_LENGTH;
-	if ( SecurityDescriptor == NULL )
-		return 0;
-
-	if ( SecurityDescriptor->Owner != NULL )
-		Size += SecurityDescriptor->Owner->SubAuthorityCount;
-	if ( SecurityDescriptor->Group != NULL )
-		Size += SecurityDescriptor->Group->SubAuthorityCount;
-
-
-	if ( SecurityDescriptor->Sacl != NULL )
-		Size += SecurityDescriptor->Sacl->AclSize;
-	if ( SecurityDescriptor->Dacl != NULL )
-		Size += SecurityDescriptor->Dacl->AclSize;
-
-	return Size;
-}
-/**************************************************************************
- * RtlSetSaclSecurityDescriptor			[NTDLL.488]
- */
-DWORD  WINAPI RtlSetSaclSecurityDescriptor (
-	PSECURITY_DESCRIPTOR lpsd,
-	BOOLEAN saclpresent,
-	PACL sacl,
-	BOOLEAN sacldefaulted)
-{
-	if (lpsd->Revision!=SECURITY_DESCRIPTOR_REVISION)
-		return STATUS_UNKNOWN_REVISION;
-	if (lpsd->Control & SE_SELF_RELATIVE)
-		return STATUS_INVALID_SECURITY_DESCR;
-	if (!saclpresent) {
-		lpsd->Control &= ~SE_SACL_PRESENT;
-		return 0;
-	}
-	lpsd->Control |= SE_SACL_PRESENT;
-	lpsd->Sacl = sacl;
-	if (sacldefaulted)
-		lpsd->Control |= SE_SACL_DEFAULTED;
-	else
-		lpsd->Control &= ~SE_SACL_DEFAULTED;
-	return STATUS_SUCCESS;
-}
-
-/**************************************************************************
- * RtlGetOwnerSecurityDescriptor		[NTDLL.488]
- */
-NTSTATUS WINAPI RtlGetOwnerSecurityDescriptor(
-	PSECURITY_DESCRIPTOR SecurityDescriptor,
-	PSID *Owner,
-	PBOOLEAN OwnerDefaulted)
-{
-	if ( !SecurityDescriptor  || !Owner || !OwnerDefaulted )
-		return STATUS_INVALID_PARAMETER;
-
-	*Owner = SecurityDescriptor->Owner;
-	if ( *Owner != NULL )  {
-		if ( SecurityDescriptor->Control & SE_OWNER_DEFAULTED )
-			*OwnerDefaulted = TRUE;
-		else
-			*OwnerDefaulted = FALSE;
-	}
-	return STATUS_SUCCESS;
-}
-
-/**************************************************************************
- *                 RtlSetOwnerSecurityDescriptor		[NTDLL.487]
- */
-NTSTATUS WINAPI RtlSetOwnerSecurityDescriptor(
-	PSECURITY_DESCRIPTOR lpsd,
-	PSID owner,
-	BOOLEAN ownerdefaulted)
-{
-	if (lpsd->Revision!=SECURITY_DESCRIPTOR_REVISION)
-		return STATUS_UNKNOWN_REVISION;
-	if (lpsd->Control & SE_SELF_RELATIVE)
-		return STATUS_INVALID_SECURITY_DESCR;
-
-	lpsd->Owner = owner;
-	if (ownerdefaulted)
-		lpsd->Control |= SE_OWNER_DEFAULTED;
-	else
-		lpsd->Control &= ~SE_OWNER_DEFAULTED;
-	return STATUS_SUCCESS;
-}
-
-/**************************************************************************
- *                 RtlSetGroupSecurityDescriptor		[NTDLL.485]
- */
-NTSTATUS WINAPI RtlSetGroupSecurityDescriptor (
-	PSECURITY_DESCRIPTOR lpsd,
-	PSID group,
-	BOOLEAN groupdefaulted)
-{
-	if (lpsd->Revision!=SECURITY_DESCRIPTOR_REVISION)
-		return STATUS_UNKNOWN_REVISION;
-	if (lpsd->Control & SE_SELF_RELATIVE)
-		return STATUS_INVALID_SECURITY_DESCR;
-
-	lpsd->Group = group;
-	if (groupdefaulted)
-		lpsd->Control |= SE_GROUP_DEFAULTED;
-	else
-		lpsd->Control &= ~SE_GROUP_DEFAULTED;
-	return STATUS_SUCCESS;
-}
-/**************************************************************************
- *                 RtlGetGroupSecurityDescriptor		[NTDLL]
- */
-NTSTATUS WINAPI RtlGetGroupSecurityDescriptor(
-	PSECURITY_DESCRIPTOR SecurityDescriptor,
-	PSID *Group,
-	PBOOLEAN GroupDefaulted)
-{
-	if ( !SecurityDescriptor || !Group || !GroupDefaulted )
-		return STATUS_INVALID_PARAMETER;
-
-	*Group = SecurityDescriptor->Group;
-	if ( *Group != NULL )  {
-		if ( SecurityDescriptor->Control & SE_GROUP_DEFAULTED )
-			*GroupDefaulted = TRUE;
-		else
-			*GroupDefaulted = FALSE;
-	}
-	return STATUS_SUCCESS;
-} 
-
-/*	##############################
-	######	ACL FUNCTIONS	######
-	##############################
-*/
-
-/**************************************************************************
- *                 RtlCreateAcl				[NTDLL.306]
- *
- * NOTES
- *    This should return NTSTATUS
- */
-DWORD WINAPI RtlCreateAcl(PACL acl,DWORD size,DWORD rev)
-{
-	if (rev!=ACL_REVISION)
-		return STATUS_INVALID_PARAMETER;
-	if (size<sizeof(ACL))
-		return STATUS_BUFFER_TOO_SMALL;
-	if (size>0xFFFF)
-		return STATUS_INVALID_PARAMETER;
-
-	memset(acl,'\0',sizeof(ACL));
-	acl->AclRevision	= rev;
-	acl->AclSize		= size;
-	acl->AceCount		= 0;
-	return 0;
-}
-
-/**************************************************************************
- *                 RtlFirstFreeAce			[NTDLL.370]
- * looks for the AceCount+1 ACE, and if it is still within the alloced
- * ACL, return a pointer to it
- */
-BOOLEAN WINAPI RtlFirstFreeAce(
-	PACL acl,
-	LPACE_HEADER *x)
-{
-	LPACE_HEADER	ace;
-	int		i;
-
-	*x = 0;
-	ace = (LPACE_HEADER)(acl+1);
-	for (i=0;i<acl->AceCount;i++) {
-		if ((DWORD)ace>=(((DWORD)acl)+acl->AclSize))
-			return 0;
-		ace = (LPACE_HEADER)(((BYTE*)ace)+ace->AceSize);
-	}
-	if ((DWORD)ace>=(((DWORD)acl)+acl->AclSize))
-		return 0;
-	*x = ace;
-	return 1;
-}
-
-/**************************************************************************
- *                 RtlAddAce				[NTDLL.260]
- */
-NTSTATUS WINAPI RtlAddAce(
-	PACL acl,
-	DWORD rev,
-	DWORD xnrofaces,
-	LPACE_HEADER acestart,
-	DWORD acelen)
-{
-	LPACE_HEADER	ace,targetace;
-	int		nrofaces;
-
-	if (acl->AclRevision != ACL_REVISION)
-		return STATUS_INVALID_PARAMETER;
-	if (!RtlFirstFreeAce(acl,&targetace))
-		return STATUS_INVALID_PARAMETER;
-	nrofaces=0;ace=acestart;
-	while (((DWORD)ace-(DWORD)acestart)<acelen) {
-		nrofaces++;
-		ace = (LPACE_HEADER)(((BYTE*)ace)+ace->AceSize);
-	}
-	if ((DWORD)targetace+acelen>(DWORD)acl+acl->AclSize) /* too much aces */
-		return STATUS_INVALID_PARAMETER;
-	memcpy((LPBYTE)targetace,acestart,acelen);
-	acl->AceCount+=nrofaces;
-	return STATUS_SUCCESS;
-}
-
-/******************************************************************************
- *  RtlAddAccessAllowedAce		[NTDLL] 
- */
-DWORD WINAPI RtlAddAccessAllowedAce(DWORD x1,DWORD x2,DWORD x3,DWORD x4) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4);
-	return 0;
-}
-
-/******************************************************************************
- *  RtlGetAce		[NTDLL] 
- */
-DWORD WINAPI RtlGetAce(PACL pAcl,DWORD dwAceIndex,LPVOID *pAce ) {
-	FIXME(ntdll,"(%p,%ld,%p),stub!\n",pAcl,dwAceIndex,pAce);
-	return 0;
-}
-
-/*	######################################
-	######	STRING FUNCTIONS	######
-	######################################
-*/
-
-/**************************************************************************
- *                 RtlAnsiStringToUnicodeString		[NTDLL.269]
- */
-DWORD /* NTSTATUS */ 
-WINAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING uni,PANSI_STRING ansi,BOOLEAN doalloc)
-{
-	DWORD	unilen = (ansi->Length+1)*sizeof(WCHAR);
-
-	if (unilen>0xFFFF)
-		return STATUS_INVALID_PARAMETER_2;
-	uni->Length = unilen;
-	if (doalloc) {
-		uni->MaximumLength = unilen;
-		uni->Buffer = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,unilen);
-		if (!uni->Buffer)
-			return STATUS_NO_MEMORY;
-	}
-	if (unilen>uni->MaximumLength)
-		return STATUS_BUFFER_OVERFLOW;
-	lstrcpynAtoW(uni->Buffer,ansi->Buffer,unilen/2);
-	return STATUS_SUCCESS;
-}
-
-/**************************************************************************
- *                 RtlOemStringToUnicodeString		[NTDLL.447]
- */
-DWORD /* NTSTATUS */ 
-WINAPI RtlOemStringToUnicodeString(PUNICODE_STRING uni,PSTRING ansi,BOOLEAN doalloc)
-{
-	DWORD	unilen = (ansi->Length+1)*sizeof(WCHAR);
-
-	if (unilen>0xFFFF)
-		return STATUS_INVALID_PARAMETER_2;
-	uni->Length = unilen;
-	if (doalloc) {
-		uni->MaximumLength = unilen;
-		uni->Buffer = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,unilen);
-		if (!uni->Buffer)
-			return STATUS_NO_MEMORY;
-	}
-	if (unilen>uni->MaximumLength)
-		return STATUS_BUFFER_OVERFLOW;
-	lstrcpynAtoW(uni->Buffer,ansi->Buffer,unilen/2);
-	return STATUS_SUCCESS;
-}
-/**************************************************************************
- *                 RtlMultiByteToUnicodeN		[NTDLL.436]
- * FIXME: multibyte support
- */
-DWORD /* NTSTATUS */ 
-WINAPI RtlMultiByteToUnicodeN(LPWSTR unistr,DWORD unilen,LPDWORD reslen,LPSTR oemstr,DWORD oemlen)
-{
-	DWORD	len;
-	LPWSTR	x;
-
-	len = oemlen;
-	if (unilen/2 < len)
-		len = unilen/2;
-	x=(LPWSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,(len+1)*sizeof(WCHAR));
-	lstrcpynAtoW(x,oemstr,len+1);
-	memcpy(unistr,x,len*2);
-	if (reslen) *reslen = len*2;
-	return 0;
-}
-
-/**************************************************************************
- *                 RtlOemToUnicodeN			[NTDLL.448]
- */
-DWORD /* NTSTATUS */ 
-WINAPI RtlOemToUnicodeN(LPWSTR unistr,DWORD unilen,LPDWORD reslen,LPSTR oemstr,DWORD oemlen)
-{
-	DWORD	len;
-	LPWSTR	x;
-
-	len = oemlen;
-	if (unilen/2 < len)
-		len = unilen/2;
-	x=(LPWSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,(len+1)*sizeof(WCHAR));
-	lstrcpynAtoW(x,oemstr,len+1);
-	memcpy(unistr,x,len*2);
-	if (reslen) *reslen = len*2;
-	return 0;
-}
-
-/**************************************************************************
- *                 RtlInitAnsiString			[NTDLL.399]
- */
-VOID WINAPI RtlInitAnsiString(PANSI_STRING target,LPCSTR source)
-{
-	target->Length = target->MaximumLength = 0;
-	target->Buffer = (LPSTR)source;
-	if (!source)
-		return;
-	target->MaximumLength = lstrlenA(target->Buffer);
-	target->Length = target->MaximumLength+1;
-}
-/**************************************************************************
- *                 RtlInitString			[NTDLL.402]
- */
-VOID WINAPI RtlInitString(PSTRING target,LPCSTR source)
-{
-	target->Length = target->MaximumLength = 0;
-	target->Buffer = (LPSTR)source;
-	if (!source)
-		return;
-	target->MaximumLength = lstrlenA(target->Buffer);
-	target->Length = target->MaximumLength+1;
-}
-
-/**************************************************************************
- *                 RtlInitUnicodeString			[NTDLL.403]
- */
-VOID WINAPI RtlInitUnicodeString(PUNICODE_STRING target,LPCWSTR source)
-{
-	target->Length = target->MaximumLength = 0;
-	target->Buffer = (LPWSTR)source;
-	if (!source)
-		return;
-	target->MaximumLength = lstrlenW(target->Buffer)*2;
-	target->Length = target->MaximumLength+2;
-}
-
-/**************************************************************************
- *                 RtlFreeUnicodeString			[NTDLL.377]
- */
-VOID WINAPI RtlFreeUnicodeString(PUNICODE_STRING str)
-{
-	if (str->Buffer)
-		HeapFree(GetProcessHeap(),0,str->Buffer);
-}
-
-/**************************************************************************
- * RtlFreeAnsiString [NTDLL.373]
- */
-VOID WINAPI RtlFreeAnsiString(PANSI_STRING AnsiString)
-{
-    if( AnsiString->Buffer )
-        HeapFree( GetProcessHeap(),0,AnsiString->Buffer );
-}
-
-
-/**************************************************************************
- *                 RtlUnicodeToOemN			[NTDLL.515]
- */
-DWORD /* NTSTATUS */ 
-WINAPI RtlUnicodeToOemN(LPSTR oemstr,DWORD oemlen,LPDWORD reslen,LPWSTR unistr,DWORD unilen)
-{
-	DWORD	len;
-	LPSTR	x;
-
-	len = oemlen;
-	if (unilen/2 < len)
-		len = unilen/2;
-	x=(LPSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,len+1);
-	lstrcpynWtoA(x,unistr,len+1);
-	memcpy(oemstr,x,len);
-	if (reslen) *reslen = len;
-	return 0;
-}
-
-/**************************************************************************
- *                 RtlUnicodeStringToOemString		[NTDLL.511]
- */
-DWORD /* NTSTATUS */ 
-WINAPI RtlUnicodeStringToOemString(PANSI_STRING oem,PUNICODE_STRING uni,BOOLEAN alloc)
-{
-	if (alloc) {
-		oem->Buffer = (LPSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,uni->Length/2)+1;
-		oem->MaximumLength = uni->Length/2+1;
-	}
-	oem->Length = uni->Length/2;
-	lstrcpynWtoA(oem->Buffer,uni->Buffer,uni->Length/2+1);
-	return 0;
-}
-
-/**************************************************************************
- *                 RtlUnicodeStringToAnsiString		[NTDLL.507]
- */
-DWORD /* NTSTATUS */ 
-WINAPI RtlUnicodeStringToAnsiString(PANSI_STRING oem,PUNICODE_STRING uni,BOOLEAN alloc)
-{
-	if (alloc) {
-		oem->Buffer = (LPSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,uni->Length/2)+1;
-		oem->MaximumLength = uni->Length/2+1;
-	}
-	oem->Length = uni->Length/2;
-	lstrcpynWtoA(oem->Buffer,uni->Buffer,uni->Length/2+1);
-	return 0;
-}
-
-/**************************************************************************
- *                 RtlEqualUnicodeString		[NTDLL]
- */
-DWORD WINAPI RtlEqualUnicodeString(PUNICODE_STRING s1,PUNICODE_STRING s2,DWORD x) {
-	FIXME(ntdll,"(%s,%s,%ld),stub!\n",debugstr_w(s1->Buffer),debugstr_w(s2->Buffer),x);
-	return 0;
-	if (s1->Length != s2->Length)
-		return 1;
-	return !lstrncmpW(s1->Buffer,s2->Buffer,s1->Length/2);
-}
-
-/**************************************************************************
- *                 RtlUpcaseUnicodeString		[NTDLL.520]
- */
-DWORD WINAPI RtlUpcaseUnicodeString(PUNICODE_STRING dest,PUNICODE_STRING src,BOOLEAN doalloc)
-{
-	LPWSTR	s,t;
-	DWORD	i,len;
-
-	len = src->Length;
-	if (doalloc) {
-		dest->MaximumLength = len; 
-		dest->Buffer = (LPWSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,len);
-		if (!dest->Buffer)
-			return STATUS_NO_MEMORY;
-
-	}
-	if (dest->MaximumLength < len)
-		return STATUS_BUFFER_OVERFLOW;
-	s=dest->Buffer;t=src->Buffer;
-	/* len is in bytes */
-	for (i=0;i<len/2;i++)
-		s[i] = towupper(t[i]);
-	return STATUS_SUCCESS;
-}
-
-/**************************************************************************
- *                 RtlxOemStringToUnicodeSize		[NTDLL.549]
- */
-UINT WINAPI RtlxOemStringToUnicodeSize(PSTRING str)
-{
-	return str->Length*2+2;
-}
-
-/**************************************************************************
- *                 RtlxAnsiStringToUnicodeSize		[NTDLL.548]
- */
-UINT WINAPI RtlxAnsiStringToUnicodeSize(PANSI_STRING str)
-{
-	return str->Length*2+2;
-}
-
-/**************************************************************************
- *                 RtlIsTextUnicode			[NTDLL.417]
- *
- *	Apply various feeble heuristics to guess whether
- *	the text buffer contains Unicode.
- *	FIXME: should implement more tests.
- */
-DWORD WINAPI RtlIsTextUnicode(LPVOID buf, DWORD len, DWORD *pf)
-{
-	LPWSTR s = buf;
-	DWORD flags = -1, out_flags = 0;
-
-	if (!len)
-		goto out;
-	if (pf)
-		flags = *pf;
-	/*
-	 * Apply various tests to the text string. According to the
-	 * docs, each test "passed" sets the corresponding flag in
-	 * the output flags. But some of the tests are mutually
-	 * exclusive, so I don't see how you could pass all tests ...
-	 */
-
-	/* Check for an odd length ... pass if even. */
-	if (!(len & 1))
-		out_flags |= IS_TEXT_UNICODE_ODD_LENGTH;
-
-	/* Check for the special unicode marker byte. */
-	if (*s == 0xFEFF)
-		out_flags |= IS_TEXT_UNICODE_SIGNATURE;
-
-	/*
-	 * Check whether the string passed all of the tests.
-	 */
-	flags &= ITU_IMPLEMENTED_TESTS;
-	if ((out_flags & flags) != flags)
-		len = 0;
-out:
-	if (pf)
-		*pf = out_flags;
-	return len;
-}
-
-
-/******************************************************************************
- *	RtlCompareUnicodeString	[NTDLL] 
- */
-NTSTATUS WINAPI RtlCompareUnicodeString(
-	PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive) 
-{
-	FIXME(ntdll,"(%s,%s,0x%08x),stub!\n",debugstr_w(String1->Buffer),debugstr_w(String1->Buffer),CaseInSensitive);
-	return 0;
-}
-
-
-/*	######################################
-	######	RESOURCE FUNCTIONS	######
-	######################################
-*/
 /***********************************************************************
  *           RtlInitializeResource	(NTDLL.409)
  *
@@ -946,10 +208,68 @@
     }
 }
 
-/*	##############################
-	######	MISC FUNCTIONS	######
-	##############################
-*/
+/*
+ *	heap functions
+ */
+
+/******************************************************************************
+ *  RtlCreateHeap		[NTDLL] 
+ */
+HANDLE WINAPI RtlCreateHeap(
+	ULONG Flags,
+	PVOID BaseAddress,
+	ULONG SizeToReserve,
+	ULONG SizeToCommit,
+	PVOID Unknown,
+	PRTL_HEAP_DEFINITION Definition)
+{
+	FIXME (ntdll,"(0x%08lx, %p, 0x%08lx, 0x%08lx, %p, %p) semi-stub\n",
+	Flags, BaseAddress, SizeToReserve, SizeToCommit, Unknown, Definition);
+	
+	return HeapCreate ( Flags, SizeToCommit, SizeToReserve);
+
+}	
+/******************************************************************************
+ *  RtlAllocateHeap		[NTDLL] 
+ */
+PVOID WINAPI RtlAllocateHeap(
+	HANDLE Heap,
+	ULONG Flags,
+	ULONG Size)
+{
+	FIXME(ntdll,"(0x%08x, 0x%08lx, 0x%08lx) semi stub\n",
+	Heap, Flags, Size);
+	return HeapAlloc(Heap, Flags, Size);
+}
+
+/******************************************************************************
+ *  RtlFreeHeap		[NTDLL] 
+ */
+BOOLEAN WINAPI RtlFreeHeap(
+	HANDLE Heap,
+	ULONG Flags,
+	PVOID Address)
+{
+	FIXME(ntdll,"(0x%08x, 0x%08lx, %p) semi stub\n",
+	Heap, Flags, Address);
+	return HeapFree(Heap, Flags, Address);
+}
+	
+/******************************************************************************
+ *  RtlDestroyHeap		[NTDLL] 
+ *
+ * FIXME: prototype guessed
+ */
+BOOLEAN WINAPI RtlDestroyHeap(
+	HANDLE Heap)
+{
+	FIXME(ntdll,"(0x%08x) semi stub\n", Heap);
+	return HeapDestroy(Heap);
+}
+	
+/*
+ *	misc functions
+ */
 
 /******************************************************************************
  *	DbgPrint	[NTDLL] 
@@ -987,14 +307,6 @@
 }
 
 /******************************************************************************
- *  RtlAdjustPrivilege		[NTDLL] 
- */
-DWORD WINAPI RtlAdjustPrivilege(DWORD x1,DWORD x2,DWORD x3,DWORD x4) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4);
-	return 0;
-}
-
-/******************************************************************************
  *  RtlIntegerToChar	[NTDLL] 
  */
 DWORD WINAPI RtlIntegerToChar(DWORD x1,DWORD x2,DWORD x3,DWORD x4) {
@@ -1002,20 +314,6 @@
 	return 0;
 }
 /******************************************************************************
- *  RtlSystemTimeToLocalTime 	[NTDLL] 
- */
-DWORD WINAPI RtlSystemTimeToLocalTime(DWORD x1,DWORD x2) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx),stub!\n",x1,x2);
-	return 0;
-}
-/******************************************************************************
- *  RtlTimeToTimeFields 	[NTDLL] 
- */
-DWORD WINAPI RtlTimeToTimeFields(DWORD x1,DWORD x2) {
-	FIXME(ntdll,"(0x%08lx,0x%08lx),stub!\n",x1,x2);
-	return 0;
-}
-/******************************************************************************
  *  RtlSetEnvironmentVariable		[NTDLL] 
  */
 DWORD WINAPI RtlSetEnvironmentVariable(DWORD x1,PUNICODE_STRING key,PUNICODE_STRING val) {
@@ -1039,22 +337,6 @@
 	return 0;
 }
 
-/******************************************************************************
- *  RtlToTimeInSecondsSince1980		[NTDLL] 
- */
-BOOLEAN WINAPI RtlTimeToSecondsSince1980(LPFILETIME ft,LPDWORD timeret) {
-	/* 1980 = 1970+10*365 days +  29. februar 1972 + 29.februar 1976 */
-	*timeret = DOSFS_FileTimeToUnixTime(ft,NULL) - (10*365+2)*24*3600;
-	return 1;
-}
-
-/******************************************************************************
- *  RtlToTimeInSecondsSince1970		[NTDLL] 
- */
-BOOLEAN WINAPI RtlTimeToSecondsSince1970(LPFILETIME ft,LPDWORD timeret) {
-	*timeret = DOSFS_FileTimeToUnixTime(ft,NULL);
-	return 1;
-}
 /**************************************************************************
  *                 RtlNormalizeProcessParams		[NTDLL.441]
  */
@@ -1108,16 +390,6 @@
 }
 
 /******************************************************************************
- * RtlTimeToElapsedTimeFields [NTDLL.502]
- */
-DWORD WINAPI RtlTimeToElapsedTimeFields( DWORD x1, DWORD x2 )
-{
-    FIXME(ntdll,"(%lx,%lx): stub\n",x1,x2);
-    return 0;
-}
-
-
-/******************************************************************************
  * RtlExtendedLargeIntegerDivide [NTDLL.359]
  */
 INT WINAPI RtlExtendedLargeIntegerDivide(
@@ -1142,12 +414,12 @@
  * Note: This even works, since gcc returns 64bit values in eax/edx just like
  * the caller expects. However... The relay code won't grok this I think.
  */
-long long /*LARGE_INTEGER*/ 
-WINAPI RtlExtendedIntegerMultiply(
-	LARGE_INTEGER factor1,INT factor2
-) {
+long long WINAPI RtlExtendedIntegerMultiply(
+	LARGE_INTEGER factor1,
+	INT factor2) 
+{
 #if SIZEOF_LONG_LONG==8
-	return (*(long long*)&factor1)*factor2;
+	return (*(long long*)&factor1) * factor2;
 #else
 	FIXME(ntdll,"((%d<<32)+%d,%ld), implement this using normal integer arithmetic!\n",factor1.HighPart,factor1.LowPart,factor2);
 	return 0;
@@ -1218,4 +490,3 @@
 	FIXME(ntdll,"(0x%08lx,%s,%p),stub!\n",x1,debugstr_w(key->Buffer),val);
 	return 0;
 }
-
diff --git a/dlls/ntdll/rtlstr.c b/dlls/ntdll/rtlstr.c
new file mode 100644
index 0000000..2ddc404
--- /dev/null
+++ b/dlls/ntdll/rtlstr.c
@@ -0,0 +1,317 @@
+/*
+ *	Rtl string functions
+ *
+ *	Copyright 1996-1998 Marcus Meissner
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <wctype.h>
+#include "wine/winestring.h"
+#include "heap.h"
+#include "winnls.h"
+#include "debug.h"
+
+#include "ntddk.h"
+/*
+ *	STRING FUNCTIONS
+ */
+
+/**************************************************************************
+ *                 RtlAnsiStringToUnicodeString		[NTDLL.269]
+ */
+DWORD /* NTSTATUS */ 
+WINAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING uni,PANSI_STRING ansi,BOOLEAN doalloc)
+{
+	DWORD	unilen = (ansi->Length+1)*sizeof(WCHAR);
+
+	if (unilen>0xFFFF)
+		return STATUS_INVALID_PARAMETER_2;
+	uni->Length = unilen;
+	if (doalloc) {
+		uni->MaximumLength = unilen;
+		uni->Buffer = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,unilen);
+		if (!uni->Buffer)
+			return STATUS_NO_MEMORY;
+	}
+	if (unilen>uni->MaximumLength)
+		return STATUS_BUFFER_OVERFLOW;
+	lstrcpynAtoW(uni->Buffer,ansi->Buffer,unilen/2);
+	return STATUS_SUCCESS;
+}
+
+/**************************************************************************
+ *                 RtlOemStringToUnicodeString		[NTDLL.447]
+ */
+DWORD /* NTSTATUS */ 
+WINAPI RtlOemStringToUnicodeString(PUNICODE_STRING uni,PSTRING ansi,BOOLEAN doalloc)
+{
+	DWORD	unilen = (ansi->Length+1)*sizeof(WCHAR);
+
+	if (unilen>0xFFFF)
+		return STATUS_INVALID_PARAMETER_2;
+	uni->Length = unilen;
+	if (doalloc) {
+		uni->MaximumLength = unilen;
+		uni->Buffer = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,unilen);
+		if (!uni->Buffer)
+			return STATUS_NO_MEMORY;
+	}
+	if (unilen>uni->MaximumLength)
+		return STATUS_BUFFER_OVERFLOW;
+	lstrcpynAtoW(uni->Buffer,ansi->Buffer,unilen/2);
+	return STATUS_SUCCESS;
+}
+/**************************************************************************
+ *                 RtlMultiByteToUnicodeN		[NTDLL.436]
+ * FIXME: multibyte support
+ */
+DWORD /* NTSTATUS */ 
+WINAPI RtlMultiByteToUnicodeN(LPWSTR unistr,DWORD unilen,LPDWORD reslen,LPSTR oemstr,DWORD oemlen)
+{
+	DWORD	len;
+	LPWSTR	x;
+
+	len = oemlen;
+	if (unilen/2 < len)
+		len = unilen/2;
+	x=(LPWSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,(len+1)*sizeof(WCHAR));
+	lstrcpynAtoW(x,oemstr,len+1);
+	memcpy(unistr,x,len*2);
+	if (reslen) *reslen = len*2;
+	return 0;
+}
+
+/**************************************************************************
+ *                 RtlOemToUnicodeN			[NTDLL.448]
+ */
+DWORD /* NTSTATUS */ 
+WINAPI RtlOemToUnicodeN(LPWSTR unistr,DWORD unilen,LPDWORD reslen,LPSTR oemstr,DWORD oemlen)
+{
+	DWORD	len;
+	LPWSTR	x;
+
+	len = oemlen;
+	if (unilen/2 < len)
+		len = unilen/2;
+	x=(LPWSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,(len+1)*sizeof(WCHAR));
+	lstrcpynAtoW(x,oemstr,len+1);
+	memcpy(unistr,x,len*2);
+	if (reslen) *reslen = len*2;
+	return 0;
+}
+
+/**************************************************************************
+ *                 RtlInitAnsiString			[NTDLL.399]
+ */
+VOID WINAPI RtlInitAnsiString(PANSI_STRING target,LPCSTR source)
+{
+	target->Length = target->MaximumLength = 0;
+	target->Buffer = (LPSTR)source;
+	if (!source)
+		return;
+	target->MaximumLength = lstrlenA(target->Buffer);
+	target->Length = target->MaximumLength+1;
+}
+/**************************************************************************
+ *                 RtlInitString			[NTDLL.402]
+ */
+VOID WINAPI RtlInitString(PSTRING target,LPCSTR source)
+{
+	target->Length = target->MaximumLength = 0;
+	target->Buffer = (LPSTR)source;
+	if (!source)
+		return;
+	target->MaximumLength = lstrlenA(target->Buffer);
+	target->Length = target->MaximumLength+1;
+}
+
+/**************************************************************************
+ *                 RtlInitUnicodeString			[NTDLL.403]
+ */
+VOID WINAPI RtlInitUnicodeString(PUNICODE_STRING target,LPCWSTR source)
+{
+	target->Length = target->MaximumLength = 0;
+	target->Buffer = (LPWSTR)source;
+	if (!source)
+		return;
+	target->MaximumLength = lstrlenW(target->Buffer)*2;
+	target->Length = target->MaximumLength+2;
+}
+
+/**************************************************************************
+ *                 RtlFreeUnicodeString			[NTDLL.377]
+ */
+VOID WINAPI RtlFreeUnicodeString(PUNICODE_STRING str)
+{
+	if (str->Buffer)
+		HeapFree(GetProcessHeap(),0,str->Buffer);
+}
+
+/**************************************************************************
+ * RtlFreeAnsiString [NTDLL.373]
+ */
+VOID WINAPI RtlFreeAnsiString(PANSI_STRING AnsiString)
+{
+    if( AnsiString->Buffer )
+        HeapFree( GetProcessHeap(),0,AnsiString->Buffer );
+}
+
+
+/**************************************************************************
+ *                 RtlUnicodeToOemN			[NTDLL.515]
+ */
+DWORD /* NTSTATUS */ 
+WINAPI RtlUnicodeToOemN(LPSTR oemstr,DWORD oemlen,LPDWORD reslen,LPWSTR unistr,DWORD unilen)
+{
+	DWORD	len;
+	LPSTR	x;
+
+	len = oemlen;
+	if (unilen/2 < len)
+		len = unilen/2;
+	x=(LPSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,len+1);
+	lstrcpynWtoA(x,unistr,len+1);
+	memcpy(oemstr,x,len);
+	if (reslen) *reslen = len;
+	return 0;
+}
+
+/**************************************************************************
+ *                 RtlUnicodeStringToOemString		[NTDLL.511]
+ */
+DWORD /* NTSTATUS */ 
+WINAPI RtlUnicodeStringToOemString(PANSI_STRING oem,PUNICODE_STRING uni,BOOLEAN alloc)
+{
+	if (alloc) {
+		oem->Buffer = (LPSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,uni->Length/2)+1;
+		oem->MaximumLength = uni->Length/2+1;
+	}
+	oem->Length = uni->Length/2;
+	lstrcpynWtoA(oem->Buffer,uni->Buffer,uni->Length/2+1);
+	return 0;
+}
+
+/**************************************************************************
+ *                 RtlUnicodeStringToAnsiString		[NTDLL.507]
+ */
+DWORD /* NTSTATUS */ 
+WINAPI RtlUnicodeStringToAnsiString(PANSI_STRING oem,PUNICODE_STRING uni,BOOLEAN alloc)
+{
+	if (alloc) {
+		oem->Buffer = (LPSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,uni->Length/2)+1;
+		oem->MaximumLength = uni->Length/2+1;
+	}
+	oem->Length = uni->Length/2;
+	lstrcpynWtoA(oem->Buffer,uni->Buffer,uni->Length/2+1);
+	return 0;
+}
+
+/**************************************************************************
+ *                 RtlEqualUnicodeString		[NTDLL]
+ */
+DWORD WINAPI RtlEqualUnicodeString(PUNICODE_STRING s1,PUNICODE_STRING s2,DWORD x) {
+	FIXME(ntdll,"(%s,%s,%ld),stub!\n",debugstr_w(s1->Buffer),debugstr_w(s2->Buffer),x);
+	return 0;
+	if (s1->Length != s2->Length)
+		return 1;
+	return !lstrncmpW(s1->Buffer,s2->Buffer,s1->Length/2);
+}
+
+/**************************************************************************
+ *                 RtlUpcaseUnicodeString		[NTDLL.520]
+ */
+DWORD WINAPI RtlUpcaseUnicodeString(PUNICODE_STRING dest,PUNICODE_STRING src,BOOLEAN doalloc)
+{
+	LPWSTR	s,t;
+	DWORD	i,len;
+
+	len = src->Length;
+	if (doalloc) {
+		dest->MaximumLength = len; 
+		dest->Buffer = (LPWSTR)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,len);
+		if (!dest->Buffer)
+			return STATUS_NO_MEMORY;
+
+	}
+	if (dest->MaximumLength < len)
+		return STATUS_BUFFER_OVERFLOW;
+	s=dest->Buffer;t=src->Buffer;
+	/* len is in bytes */
+	for (i=0;i<len/2;i++)
+		s[i] = towupper(t[i]);
+	return STATUS_SUCCESS;
+}
+
+/**************************************************************************
+ *                 RtlxOemStringToUnicodeSize		[NTDLL.549]
+ */
+UINT WINAPI RtlxOemStringToUnicodeSize(PSTRING str)
+{
+	return str->Length*2+2;
+}
+
+/**************************************************************************
+ *                 RtlxAnsiStringToUnicodeSize		[NTDLL.548]
+ */
+UINT WINAPI RtlxAnsiStringToUnicodeSize(PANSI_STRING str)
+{
+	return str->Length*2+2;
+}
+
+/**************************************************************************
+ *                 RtlIsTextUnicode			[NTDLL.417]
+ *
+ *	Apply various feeble heuristics to guess whether
+ *	the text buffer contains Unicode.
+ *	FIXME: should implement more tests.
+ */
+DWORD WINAPI RtlIsTextUnicode(LPVOID buf, DWORD len, DWORD *pf)
+{
+	LPWSTR s = buf;
+	DWORD flags = -1, out_flags = 0;
+
+	if (!len)
+		goto out;
+	if (pf)
+		flags = *pf;
+	/*
+	 * Apply various tests to the text string. According to the
+	 * docs, each test "passed" sets the corresponding flag in
+	 * the output flags. But some of the tests are mutually
+	 * exclusive, so I don't see how you could pass all tests ...
+	 */
+
+	/* Check for an odd length ... pass if even. */
+	if (!(len & 1))
+		out_flags |= IS_TEXT_UNICODE_ODD_LENGTH;
+
+	/* Check for the special unicode marker byte. */
+	if (*s == 0xFEFF)
+		out_flags |= IS_TEXT_UNICODE_SIGNATURE;
+
+	/*
+	 * Check whether the string passed all of the tests.
+	 */
+	flags &= ITU_IMPLEMENTED_TESTS;
+	if ((out_flags & flags) != flags)
+		len = 0;
+out:
+	if (pf)
+		*pf = out_flags;
+	return len;
+}
+
+
+/******************************************************************************
+ *	RtlCompareUnicodeString	[NTDLL] 
+ */
+NTSTATUS WINAPI RtlCompareUnicodeString(
+	PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive) 
+{
+	FIXME(ntdll,"(%s,%s,0x%08x),stub!\n",debugstr_w(String1->Buffer),debugstr_w(String1->Buffer),CaseInSensitive);
+	return 0;
+}
+
+
diff --git a/dlls/ntdll/sec.c b/dlls/ntdll/sec.c
new file mode 100644
index 0000000..89bbea1
--- /dev/null
+++ b/dlls/ntdll/sec.c
@@ -0,0 +1,499 @@
+/*
+ *	Security functions
+ *
+ *	Copyright 1996-1998 Marcus Meissner
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <ctype.h>
+#include <math.h>
+#include "windef.h"
+#include "winbase.h"
+#include "winuser.h"
+#include "wine/winestring.h"
+#include "file.h"
+#include "heap.h"
+#include "winnls.h"
+#include "debugstr.h"
+#include "debug.h"
+#include "winuser.h"
+#include "winerror.h"
+#include "stackframe.h"
+
+#include "ntddk.h"
+#include "winreg.h"
+
+/*
+ *	SID FUNCTIONS
+ */
+
+/******************************************************************************
+ *  RtlAllocateAndInitializeSid		[NTDLL.265] 
+ *
+ */
+BOOLEAN WINAPI RtlAllocateAndInitializeSid (PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,
+	DWORD nSubAuthorityCount,DWORD x3,DWORD x4,DWORD x5,DWORD x6,DWORD x7,DWORD x8,DWORD x9,DWORD x10, PSID pSid) 
+{
+	FIXME(ntdll,"(%p,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,0x%08lx,%p),stub!\n",
+		pIdentifierAuthority,nSubAuthorityCount,x3,x4,x5,x6,x7,x8,x9,x10,pSid);
+	return 0;
+}
+/******************************************************************************
+ *  RtlEqualSid		[NTDLL.352] 
+ *
+ */
+DWORD WINAPI RtlEqualSid(DWORD x1,DWORD x2) 
+{	
+	FIXME(ntdll,"(0x%08lx,0x%08lx),stub!\n", x1,x2);
+	return TRUE;
+}
+
+/******************************************************************************
+ *  RtlFreeSid		[NTDLL.376] 
+ */
+DWORD WINAPI RtlFreeSid(DWORD x1) 
+{
+	FIXME(ntdll,"(0x%08lx),stub!\n", x1);
+	return TRUE;
+}
+
+/**************************************************************************
+ *                 RtlLengthRequiredSid			[NTDLL.427]
+ */
+DWORD WINAPI RtlLengthRequiredSid(DWORD nrofsubauths)
+{
+	return sizeof(DWORD)*nrofsubauths+sizeof(SID);
+}
+
+/**************************************************************************
+ *                 RtlLengthSid				[NTDLL.429]
+ */
+DWORD WINAPI RtlLengthSid(PSID sid)
+{
+	TRACE(ntdll,"sid=%p\n",sid);
+	if (!sid)
+	  return FALSE; 
+	return sizeof(DWORD)*sid->SubAuthorityCount+sizeof(SID);
+}
+
+/**************************************************************************
+ *                 RtlInitializeSid			[NTDLL.410]
+ */
+DWORD WINAPI RtlInitializeSid(PSID PSID,PSID_IDENTIFIER_AUTHORITY PSIDauth,
+                              DWORD c)
+{
+	BYTE	a = c&0xff;
+
+	if (a>=SID_MAX_SUB_AUTHORITIES)
+		return a;
+	PSID->SubAuthorityCount = a;
+	PSID->Revision		 = SID_REVISION;
+	memcpy(&(PSID->IdentifierAuthority),PSIDauth,sizeof(SID_IDENTIFIER_AUTHORITY));
+	return STATUS_SUCCESS;
+}
+
+/**************************************************************************
+ *                 RtlSubAuthoritySid			[NTDLL.497]
+ */
+LPDWORD WINAPI RtlSubAuthoritySid(PSID PSID,DWORD nr)
+{
+	return &(PSID->SubAuthority[nr]);
+}
+
+/**************************************************************************
+ *                 RtlSubAuthorityCountSid		[NTDLL.496]
+ */
+
+LPBYTE WINAPI RtlSubAuthorityCountSid(PSID PSID)
+{
+	return ((LPBYTE)PSID)+1;
+}
+
+/**************************************************************************
+ *                 RtlCopySid				[NTDLL.302]
+ */
+DWORD WINAPI RtlCopySid(DWORD len,PSID to,PSID from)
+{	if (!from)
+		return 0;
+	if (len<(from->SubAuthorityCount*4+8))
+		return STATUS_BUFFER_TOO_SMALL;
+	memmove(to,from,from->SubAuthorityCount*4+8);
+	return STATUS_SUCCESS;
+}
+
+/*
+ *	security descriptor functions
+ */
+
+/**************************************************************************
+ * RtlCreateSecurityDescriptor			[NTDLL.313]
+ *
+ * RETURNS:
+ *  0 success, 
+ *  STATUS_INVALID_OWNER, STATUS_PRIVILEGE_NOT_HELD, STATUS_NO_INHERITANCE,
+ *  STATUS_NO_MEMORY 
+ */
+NTSTATUS WINAPI RtlCreateSecurityDescriptor(
+	PSECURITY_DESCRIPTOR lpsd,
+	DWORD rev)
+{
+	if (rev!=SECURITY_DESCRIPTOR_REVISION)
+		return STATUS_UNKNOWN_REVISION;
+	memset(lpsd,'\0',sizeof(*lpsd));
+	lpsd->Revision = SECURITY_DESCRIPTOR_REVISION;
+	return STATUS_SUCCESS;
+}
+/**************************************************************************
+ * RtlValidSecurityDescriptor			[NTDLL.313]
+ *
+ */
+NTSTATUS WINAPI RtlValidSecurityDescriptor(
+	PSECURITY_DESCRIPTOR SecurityDescriptor)
+{
+	if ( ! SecurityDescriptor )
+		return STATUS_INVALID_SECURITY_DESCR;
+	if ( SecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION )
+		return STATUS_UNKNOWN_REVISION;
+
+	return STATUS_SUCCESS;
+}
+
+/**************************************************************************
+ *  RtlLengthSecurityDescriptor			[NTDLL]
+ */
+ULONG WINAPI RtlLengthSecurityDescriptor(
+	PSECURITY_DESCRIPTOR SecurityDescriptor)
+{
+	ULONG Size;
+	Size = SECURITY_DESCRIPTOR_MIN_LENGTH;
+	if ( SecurityDescriptor == NULL )
+		return 0;
+
+	if ( SecurityDescriptor->Owner != NULL )
+		Size += SecurityDescriptor->Owner->SubAuthorityCount;
+	if ( SecurityDescriptor->Group != NULL )
+		Size += SecurityDescriptor->Group->SubAuthorityCount;
+
+
+	if ( SecurityDescriptor->Sacl != NULL )
+		Size += SecurityDescriptor->Sacl->AclSize;
+	if ( SecurityDescriptor->Dacl != NULL )
+		Size += SecurityDescriptor->Dacl->AclSize;
+
+	return Size;
+}
+
+/******************************************************************************
+ *  RtlGetDaclSecurityDescriptor		[NTDLL] 
+ *
+ */
+NTSTATUS WINAPI RtlGetDaclSecurityDescriptor(
+	IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
+	OUT PBOOLEAN lpbDaclPresent,
+	OUT PACL *pDacl,
+	OUT PBOOLEAN lpbDaclDefaulted)
+{
+	TRACE(ntdll,"(%p,%p,%p,%p)\n",
+	pSecurityDescriptor, lpbDaclPresent, *pDacl, lpbDaclDefaulted);
+
+	if (pSecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION)
+	  return STATUS_UNKNOWN_REVISION ;
+
+	if ( (*lpbDaclPresent = (SE_DACL_PRESENT & pSecurityDescriptor->Control) ? 1 : 0) )
+	{
+	  if ( SE_SELF_RELATIVE & pSecurityDescriptor->Control)
+	  { *pDacl = (PACL) ((LPBYTE)pSecurityDescriptor + (DWORD)pSecurityDescriptor->Dacl);
+	  }
+	  else
+	  { *pDacl = pSecurityDescriptor->Dacl;
+	  }
+	}
+
+	*lpbDaclDefaulted = (( SE_DACL_DEFAULTED & pSecurityDescriptor->Control ) ? 1 : 0);
+	
+	return STATUS_SUCCESS;
+}
+
+/**************************************************************************
+ *  RtlSetDaclSecurityDescriptor		[NTDLL.483]
+ */
+NTSTATUS WINAPI RtlSetDaclSecurityDescriptor (
+	PSECURITY_DESCRIPTOR lpsd,
+	BOOLEAN daclpresent,
+	PACL dacl,
+	BOOLEAN dacldefaulted )
+{
+	if (lpsd->Revision!=SECURITY_DESCRIPTOR_REVISION)
+		return STATUS_UNKNOWN_REVISION;
+	if (lpsd->Control & SE_SELF_RELATIVE)
+		return STATUS_INVALID_SECURITY_DESCR;
+
+	if (!daclpresent) 
+	{	lpsd->Control &= ~SE_DACL_PRESENT;
+		return TRUE;
+	}
+
+	lpsd->Control |= SE_DACL_PRESENT;
+	lpsd->Dacl = dacl;
+
+	if (dacldefaulted)
+		lpsd->Control |= SE_DACL_DEFAULTED;
+	else
+		lpsd->Control &= ~SE_DACL_DEFAULTED;
+
+	return STATUS_SUCCESS;
+}
+
+/******************************************************************************
+ *  RtlGetSaclSecurityDescriptor		[NTDLL] 
+ *
+ */
+NTSTATUS WINAPI RtlGetSaclSecurityDescriptor(
+	IN PSECURITY_DESCRIPTOR pSecurityDescriptor,
+	OUT PBOOLEAN lpbSaclPresent,
+	OUT PACL *pSacl,
+	OUT PBOOLEAN lpbSaclDefaulted)
+{
+	TRACE(ntdll,"(%p,%p,%p,%p)\n",
+	pSecurityDescriptor, lpbSaclPresent, *pSacl, lpbSaclDefaulted);
+
+	if (pSecurityDescriptor->Revision != SECURITY_DESCRIPTOR_REVISION)
+	  return STATUS_UNKNOWN_REVISION ;
+
+	if ( (*lpbSaclPresent = (SE_SACL_PRESENT & pSecurityDescriptor->Control) ? 1 : 0) )
+	{
+	  if ( SE_SELF_RELATIVE & pSecurityDescriptor->Control)
+	  { *pSacl = (PACL) ((LPBYTE)pSecurityDescriptor + (DWORD)pSecurityDescriptor->Sacl);
+	  }
+	  else
+	  { *pSacl = pSecurityDescriptor->Sacl;
+	  }
+	}
+
+	*lpbSaclDefaulted = (( SE_SACL_DEFAULTED & pSecurityDescriptor->Control ) ? 1 : 0);
+	
+	return STATUS_SUCCESS;
+}
+
+/**************************************************************************
+ * RtlSetSaclSecurityDescriptor			[NTDLL.488]
+ */
+NTSTATUS WINAPI RtlSetSaclSecurityDescriptor (
+	PSECURITY_DESCRIPTOR lpsd,
+	BOOLEAN saclpresent,
+	PACL sacl,
+	BOOLEAN sacldefaulted)
+{
+	if (lpsd->Revision!=SECURITY_DESCRIPTOR_REVISION)
+		return STATUS_UNKNOWN_REVISION;
+	if (lpsd->Control & SE_SELF_RELATIVE)
+		return STATUS_INVALID_SECURITY_DESCR;
+	if (!saclpresent) {
+		lpsd->Control &= ~SE_SACL_PRESENT;
+		return 0;
+	}
+	lpsd->Control |= SE_SACL_PRESENT;
+	lpsd->Sacl = sacl;
+	if (sacldefaulted)
+		lpsd->Control |= SE_SACL_DEFAULTED;
+	else
+		lpsd->Control &= ~SE_SACL_DEFAULTED;
+	return STATUS_SUCCESS;
+}
+
+/**************************************************************************
+ * RtlGetOwnerSecurityDescriptor		[NTDLL.488]
+ */
+NTSTATUS WINAPI RtlGetOwnerSecurityDescriptor(
+	PSECURITY_DESCRIPTOR SecurityDescriptor,
+	PSID *Owner,
+	PBOOLEAN OwnerDefaulted)
+{
+	if ( !SecurityDescriptor  || !Owner || !OwnerDefaulted )
+		return STATUS_INVALID_PARAMETER;
+
+	*Owner = SecurityDescriptor->Owner;
+	if ( *Owner != NULL )  {
+		if ( SecurityDescriptor->Control & SE_OWNER_DEFAULTED )
+			*OwnerDefaulted = TRUE;
+		else
+			*OwnerDefaulted = FALSE;
+	}
+	return STATUS_SUCCESS;
+}
+
+/**************************************************************************
+ *                 RtlSetOwnerSecurityDescriptor		[NTDLL.487]
+ */
+NTSTATUS WINAPI RtlSetOwnerSecurityDescriptor(
+	PSECURITY_DESCRIPTOR lpsd,
+	PSID owner,
+	BOOLEAN ownerdefaulted)
+{
+	if (lpsd->Revision!=SECURITY_DESCRIPTOR_REVISION)
+		return STATUS_UNKNOWN_REVISION;
+	if (lpsd->Control & SE_SELF_RELATIVE)
+		return STATUS_INVALID_SECURITY_DESCR;
+
+	lpsd->Owner = owner;
+	if (ownerdefaulted)
+		lpsd->Control |= SE_OWNER_DEFAULTED;
+	else
+		lpsd->Control &= ~SE_OWNER_DEFAULTED;
+	return STATUS_SUCCESS;
+}
+
+/**************************************************************************
+ *                 RtlSetGroupSecurityDescriptor		[NTDLL.485]
+ */
+NTSTATUS WINAPI RtlSetGroupSecurityDescriptor (
+	PSECURITY_DESCRIPTOR lpsd,
+	PSID group,
+	BOOLEAN groupdefaulted)
+{
+	if (lpsd->Revision!=SECURITY_DESCRIPTOR_REVISION)
+		return STATUS_UNKNOWN_REVISION;
+	if (lpsd->Control & SE_SELF_RELATIVE)
+		return STATUS_INVALID_SECURITY_DESCR;
+
+	lpsd->Group = group;
+	if (groupdefaulted)
+		lpsd->Control |= SE_GROUP_DEFAULTED;
+	else
+		lpsd->Control &= ~SE_GROUP_DEFAULTED;
+	return STATUS_SUCCESS;
+}
+/**************************************************************************
+ *                 RtlGetGroupSecurityDescriptor		[NTDLL]
+ */
+NTSTATUS WINAPI RtlGetGroupSecurityDescriptor(
+	PSECURITY_DESCRIPTOR SecurityDescriptor,
+	PSID *Group,
+	PBOOLEAN GroupDefaulted)
+{
+	if ( !SecurityDescriptor || !Group || !GroupDefaulted )
+		return STATUS_INVALID_PARAMETER;
+
+	*Group = SecurityDescriptor->Group;
+	if ( *Group != NULL )  {
+		if ( SecurityDescriptor->Control & SE_GROUP_DEFAULTED )
+			*GroupDefaulted = TRUE;
+		else
+			*GroupDefaulted = FALSE;
+	}
+	return STATUS_SUCCESS;
+} 
+
+/*
+ *	access control list's
+ */
+
+/**************************************************************************
+ *                 RtlCreateAcl				[NTDLL.306]
+ *
+ * NOTES
+ *    This should return NTSTATUS
+ */
+DWORD WINAPI RtlCreateAcl(PACL acl,DWORD size,DWORD rev)
+{
+	if (rev!=ACL_REVISION)
+		return STATUS_INVALID_PARAMETER;
+	if (size<sizeof(ACL))
+		return STATUS_BUFFER_TOO_SMALL;
+	if (size>0xFFFF)
+		return STATUS_INVALID_PARAMETER;
+
+	memset(acl,'\0',sizeof(ACL));
+	acl->AclRevision	= rev;
+	acl->AclSize		= size;
+	acl->AceCount		= 0;
+	return 0;
+}
+
+/**************************************************************************
+ *                 RtlFirstFreeAce			[NTDLL.370]
+ * looks for the AceCount+1 ACE, and if it is still within the alloced
+ * ACL, return a pointer to it
+ */
+BOOLEAN WINAPI RtlFirstFreeAce(
+	PACL acl,
+	PACE_HEADER *x)
+{
+	PACE_HEADER	ace;
+	int		i;
+
+	*x = 0;
+	ace = (PACE_HEADER)(acl+1);
+	for (i=0;i<acl->AceCount;i++) {
+		if ((DWORD)ace>=(((DWORD)acl)+acl->AclSize))
+			return 0;
+		ace = (PACE_HEADER)(((BYTE*)ace)+ace->AceSize);
+	}
+	if ((DWORD)ace>=(((DWORD)acl)+acl->AclSize))
+		return 0;
+	*x = ace;
+	return 1;
+}
+
+/**************************************************************************
+ *                 RtlAddAce				[NTDLL.260]
+ */
+NTSTATUS WINAPI RtlAddAce(
+	PACL acl,
+	DWORD rev,
+	DWORD xnrofaces,
+	PACE_HEADER acestart,
+	DWORD acelen)
+{
+	PACE_HEADER	ace,targetace;
+	int		nrofaces;
+
+	if (acl->AclRevision != ACL_REVISION)
+		return STATUS_INVALID_PARAMETER;
+	if (!RtlFirstFreeAce(acl,&targetace))
+		return STATUS_INVALID_PARAMETER;
+	nrofaces=0;ace=acestart;
+	while (((DWORD)ace-(DWORD)acestart)<acelen) {
+		nrofaces++;
+		ace = (PACE_HEADER)(((BYTE*)ace)+ace->AceSize);
+	}
+	if ((DWORD)targetace+acelen>(DWORD)acl+acl->AclSize) /* too much aces */
+		return STATUS_INVALID_PARAMETER;
+	memcpy((LPBYTE)targetace,acestart,acelen);
+	acl->AceCount+=nrofaces;
+	return STATUS_SUCCESS;
+}
+
+/******************************************************************************
+ *  RtlAddAccessAllowedAce		[NTDLL] 
+ */
+DWORD WINAPI RtlAddAccessAllowedAce(DWORD x1,DWORD x2,DWORD x3,DWORD x4) 
+{
+	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4);
+	return 0;
+}
+
+/******************************************************************************
+ *  RtlGetAce		[NTDLL] 
+ */
+DWORD WINAPI RtlGetAce(PACL pAcl,DWORD dwAceIndex,LPVOID *pAce ) 
+{
+	FIXME(ntdll,"(%p,%ld,%p),stub!\n",pAcl,dwAceIndex,pAce);
+	return 0;
+}
+
+/*
+ *	misc
+ */
+
+/******************************************************************************
+ *  RtlAdjustPrivilege		[NTDLL] 
+ */
+DWORD WINAPI RtlAdjustPrivilege(DWORD x1,DWORD x2,DWORD x3,DWORD x4) 
+{
+	FIXME(ntdll,"(0x%08lx,0x%08lx,0x%08lx,0x%08lx),stub!\n",x1,x2,x3,x4);
+	return 0;
+}
+
diff --git a/dlls/ntdll/sync.c b/dlls/ntdll/sync.c
new file mode 100644
index 0000000..af6c1e9
--- /dev/null
+++ b/dlls/ntdll/sync.c
@@ -0,0 +1,121 @@
+/*
+ *	Process synchronisation
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include "debugstr.h"
+#include "debug.h"
+
+#include "ntddk.h"
+
+/*
+ *	Semaphore
+ */
+
+/******************************************************************************
+ *  NtCreateSemaphore	[NTDLL] 
+ */
+NTSTATUS WINAPI NtCreateSemaphore(
+	OUT PHANDLE SemaphoreHandle,
+	IN ACCESS_MASK DesiredAccess,
+	IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
+	IN ULONG InitialCount,
+	IN ULONG MaximumCount) 
+{
+	FIXME(ntdll,"(%p,0x%08lx,%p(%s),0x%08lx,0x%08lx) stub!\n",
+	SemaphoreHandle, DesiredAccess, ObjectAttributes, 
+	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL,
+	InitialCount, MaximumCount);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtOpenSemaphore	[NTDLL] 
+ */
+NTSTATUS WINAPI NtOpenSemaphore(
+	IN HANDLE SemaphoreHandle,
+	IN ACCESS_MASK DesiredAcces,
+	IN POBJECT_ATTRIBUTES ObjectAttributes)
+{
+	FIXME(ntdll,"(0x%08x,0x%08lx,%p(%s)) stub!\n",
+	SemaphoreHandle, DesiredAcces, ObjectAttributes,
+	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtQuerySemaphore	[NTDLL] 
+ */
+NTSTATUS WINAPI NtQuerySemaphore(
+	HANDLE SemaphoreHandle,
+	PVOID SemaphoreInformationClass,
+	OUT PVOID SemaphoreInformation,
+	ULONG Length,
+	PULONG ReturnLength) 
+{
+	FIXME(ntdll,"(0x%08x,%p,%p,0x%08lx,%p) stub!\n",
+	SemaphoreHandle, SemaphoreInformationClass, SemaphoreInformation, Length, ReturnLength);
+	return 0;
+}
+/******************************************************************************
+ *  NtReleaseSemaphore	[NTDLL] 
+ */
+NTSTATUS WINAPI NtReleaseSemaphore(
+	IN HANDLE SemaphoreHandle,
+	IN ULONG ReleaseCount,
+	IN PULONG PreviousCount)
+{
+	FIXME(ntdll,"(0x%08x,0x%08lx,%p,) stub!\n",
+	SemaphoreHandle, ReleaseCount, PreviousCount);
+	return 0;
+}
+
+/*
+ *	Event
+ */
+ 
+/**************************************************************************
+ *		NtCreateEvent				[NTDLL.71]
+ */
+NTSTATUS WINAPI NtCreateEvent(
+	OUT PHANDLE EventHandle,
+	IN ACCESS_MASK DesiredAccess,
+	IN POBJECT_ATTRIBUTES ObjectAttributes,
+	IN BOOLEAN ManualReset,
+	IN BOOLEAN InitialState)
+{
+	FIXME(ntdll,"(%p,0x%08lx,%p(%s),%08x,%08x): empty stub\n",
+	EventHandle,DesiredAccess,ObjectAttributes,
+	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL,
+	ManualReset,InitialState);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtOpenEvent		[NTDLL] 
+ */
+NTSTATUS WINAPI NtOpenEvent(
+	OUT PHANDLE EventHandle,
+	IN ACCESS_MASK DesiredAccess,
+	IN POBJECT_ATTRIBUTES ObjectAttributes)
+{
+	FIXME(ntdll,"(%p,0x%08lx,%p(%s)),stub!\n",
+	EventHandle,DesiredAccess,ObjectAttributes,
+	ObjectAttributes ? debugstr_w(ObjectAttributes->ObjectName->Buffer) : NULL);
+	return 0;
+}
+
+/******************************************************************************
+ *  NtSetEvent		[NTDLL] 
+ */
+NTSTATUS WINAPI NtSetEvent(
+	IN HANDLE EventHandle,
+	PULONG NumberOfThreadsReleased)
+{
+	FIXME(ntdll,"(0x%08x,%p)\n",
+	EventHandle, NumberOfThreadsReleased);
+	return 0;
+}
+
diff --git a/dlls/ntdll/time.c b/dlls/ntdll/time.c
new file mode 100644
index 0000000..8a7296c
--- /dev/null
+++ b/dlls/ntdll/time.c
@@ -0,0 +1,211 @@
+/*
+ * Conversion between Time and TimeFields
+ *
+ * RtlTimeToTimeFields, RtlTimeFieldsToTime and defines are taken from ReactOS and 
+ * adapted to wine with special permissions of the author  
+ * Rex Jolliff (rex@lvcablemodem.com)
+ * 
+ * 
+ */
+
+#include <ntddk.h>
+
+#include <debug.h>
+#include <file.h>
+
+#define TICKSPERSEC        10000000
+#define TICKSPERMSEC       10000
+#define SECSPERDAY         86400
+#define SECSPERHOUR        3600
+#define SECSPERMIN         60
+#define MINSPERHOUR        60
+#define HOURSPERDAY        24
+#define EPOCHWEEKDAY       0
+#define DAYSPERWEEK        7
+#define EPOCHYEAR          1601
+#define DAYSPERNORMALYEAR  365
+#define DAYSPERLEAPYEAR    366
+#define MONSPERYEAR        12
+
+static const int YearLengths[2] = {DAYSPERNORMALYEAR, DAYSPERLEAPYEAR};
+static const int MonthLengths[2][MONSPERYEAR] =
+{
+	{ 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 },
+	{ 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 }
+};
+
+static __inline int IsLeapYear(int Year)
+{
+	return Year % 4 == 0 && (Year % 100 != 0 || Year % 400 == 0) ? 1 : 0;
+}
+
+static __inline void NormalizeTimeFields(CSHORT *FieldToNormalize, CSHORT *CarryField,int Modulus)
+{
+	*FieldToNormalize = (CSHORT) (*FieldToNormalize - Modulus);
+	*CarryField = (CSHORT) (*CarryField + 1);
+}
+
+/******************************************************************************
+ *  RtlTimeToTimeFields		[NTDLL.265] 
+ *
+ */
+
+VOID WINAPI RtlTimeToTimeFields(
+	PLARGE_INTEGER liTime,
+	PTIME_FIELDS TimeFields)
+{
+	const int *Months;
+	int LeapSecondCorrections, SecondsInDay, CurYear;
+	int LeapYear, CurMonth, GMTOffset;
+	long int Days;
+	long long int Time = *(long long int *)&liTime;
+
+	/* Extract millisecond from time and convert time into seconds */
+	TimeFields->Milliseconds = (CSHORT) ((Time % TICKSPERSEC) / TICKSPERMSEC);
+	Time = Time / TICKSPERSEC;
+
+	/* FIXME: Compute the number of leap second corrections here */
+	LeapSecondCorrections = 0;
+
+	/* FIXME: get the GMT offset here */
+	GMTOffset = 0;
+
+	/* Split the time into days and seconds within the day */
+	Days = Time / SECSPERDAY;
+	SecondsInDay = Time % SECSPERDAY;
+
+	/* Adjust the values for GMT and leap seconds */
+	SecondsInDay += (GMTOffset - LeapSecondCorrections);
+	while (SecondsInDay < 0) 
+	{ SecondsInDay += SECSPERDAY;
+	  Days--;
+	}
+	while (SecondsInDay >= SECSPERDAY) 
+	{ SecondsInDay -= SECSPERDAY;
+	  Days++;
+	}
+
+	/* compute time of day */
+	TimeFields->Hour = (CSHORT) (SecondsInDay / SECSPERHOUR);
+	SecondsInDay = SecondsInDay % SECSPERHOUR;
+	TimeFields->Minute = (CSHORT) (SecondsInDay / SECSPERMIN);
+	TimeFields->Second = (CSHORT) (SecondsInDay % SECSPERMIN);
+
+	/* FIXME: handle the possibility that we are on a leap second (i.e. Second = 60) */
+
+	/* compute day of week */
+	TimeFields->Weekday = (CSHORT) ((EPOCHWEEKDAY + Days) % DAYSPERWEEK);
+
+	/* compute year */
+	CurYear = EPOCHYEAR;
+	/* FIXME: handle calendar modifications */
+	while (1)
+	{ LeapYear = IsLeapYear(CurYear);
+	  if (Days < (long) YearLengths[LeapYear])
+	  { break;
+	  }
+	  CurYear++;
+	  Days = Days - (long) YearLengths[LeapYear];
+	}
+	TimeFields->Year = (CSHORT) CurYear;
+
+	/* Compute month of year */
+	Months = MonthLengths[LeapYear];
+	for (CurMonth = 0; Days >= (long) Months[CurMonth]; CurMonth++)
+	  Days = Days - (long) Months[CurMonth];
+	TimeFields->Month = (CSHORT) (CurMonth + 1);
+	TimeFields->Day = (CSHORT) (Days + 1);
+}
+/******************************************************************************
+ *  RtlTimeFieldsToTime		[NTDLL.265] 
+ *
+ */
+BOOLEAN WINAPI RtlTimeFieldsToTime(
+	PTIME_FIELDS tfTimeFields,
+	PLARGE_INTEGER Time)
+{
+	int CurYear, CurMonth;
+	long long int rcTime;
+	TIME_FIELDS TimeFields = *tfTimeFields;
+
+	rcTime = 0;
+
+	/* FIXME: normalize the TIME_FIELDS structure here */
+	while (TimeFields.Second >= SECSPERMIN)
+	{ NormalizeTimeFields(&TimeFields.Second, &TimeFields.Minute, SECSPERMIN);
+	}
+	while (TimeFields.Minute >= MINSPERHOUR)
+	{ NormalizeTimeFields(&TimeFields.Minute, &TimeFields.Hour, MINSPERHOUR);
+	}
+	while (TimeFields.Hour >= HOURSPERDAY)
+	{ NormalizeTimeFields(&TimeFields.Hour, &TimeFields.Day, HOURSPERDAY);
+	}
+	while (TimeFields.Day > MonthLengths[IsLeapYear(TimeFields.Year)][TimeFields.Month - 1])
+	{ NormalizeTimeFields(&TimeFields.Day, &TimeFields.Month, SECSPERMIN);
+	}
+	while (TimeFields.Month > MONSPERYEAR)
+	{ NormalizeTimeFields(&TimeFields.Month, &TimeFields.Year, MONSPERYEAR);
+	}
+
+	/* FIXME: handle calendar corrections here */
+	for (CurYear = EPOCHYEAR; CurYear < TimeFields.Year; CurYear++)
+	{ rcTime += YearLengths[IsLeapYear(CurYear)];
+	}
+	for (CurMonth = 1; CurMonth < TimeFields.Month; CurMonth++)
+	{ rcTime += MonthLengths[IsLeapYear(CurYear)][CurMonth - 1];
+	}
+	rcTime += TimeFields.Day - 1;
+	rcTime *= SECSPERDAY;
+	rcTime += TimeFields.Hour * SECSPERHOUR + TimeFields.Minute * SECSPERMIN + TimeFields.Second;
+	rcTime *= TICKSPERSEC;
+	rcTime += TimeFields.Milliseconds * TICKSPERMSEC;
+	*Time = *(LARGE_INTEGER *)&rcTime;
+
+	return TRUE;
+}
+/************* end of code by Rex Jolliff (rex@lvcablemodem.com) *******************/
+
+/******************************************************************************
+ *  RtlSystemTimeToLocalTime 	[NTDLL] 
+ */
+VOID WINAPI RtlSystemTimeToLocalTime(
+	IN  PLARGE_INTEGER SystemTime,
+	OUT PLARGE_INTEGER LocalTime)
+{
+	FIXME(ntdll,"(%p, %p),stub!\n",SystemTime,LocalTime);
+
+	memcpy (LocalTime, SystemTime, sizeof (PLARGE_INTEGER));
+}
+/******************************************************************************
+ *  RtlToTimeInSecondsSince1980		[NTDLL] 
+ */
+BOOLEAN WINAPI RtlTimeToSecondsSince1980(
+	LPFILETIME ft,
+	LPDWORD timeret) 
+{
+	/* 1980 = 1970+10*365 days +  29. februar 1972 + 29.februar 1976 */
+	*timeret = DOSFS_FileTimeToUnixTime(ft,NULL) - (10*365+2)*24*3600;
+	return 1;
+}
+
+/******************************************************************************
+ *  RtlToTimeInSecondsSince1970		[NTDLL] 
+ */
+BOOLEAN WINAPI RtlTimeToSecondsSince1970(
+	LPFILETIME ft,
+	LPDWORD timeret) 
+{
+	*timeret = DOSFS_FileTimeToUnixTime(ft,NULL);
+	return 1;
+}
+
+/******************************************************************************
+ * RtlTimeToElapsedTimeFields [NTDLL.502]
+ * FIXME: prototype guessed
+ */
+VOID WINAPI RtlTimeToElapsedTimeFields(
+	PLARGE_INTEGER liTime,
+	PTIME_FIELDS TimeFields)
+{
+	FIXME(ntdll,"(%p,%p): stub\n",liTime,TimeFields);
+}