adding draft of decompiled windows kernel functions