434 lines
8.9 KiB
Plaintext
434 lines
8.9 KiB
Plaintext
|
KiIdleLoop
|
|||
|
|
KeAcquireSpinLockRaiseToSynch
|
|||
|
|
KiSwapThreadExit
|
|||
|
|
KiUnlockDispatcherDatabase
|
|||
|
|
OtsMove
|
|||
|
|
RtlCopyBytes
|
|||
|
|
KeReleaseSpinLock
|
|||
|
|
IopParseDevice
|
|||
|
|
ExAcquireResourceExclusiveLite
|
|||
|
|
KeAcquireSpinLockAtDpcLevel
|
|||
|
|
KeSynchronizeExecution
|
|||
|
|
ExAllocatePoolWithTag
|
|||
|
|
ExReleaseResourceLite
|
|||
|
|
KiRetireDpcList
|
|||
|
|
ExpInterlockedPopEntrySList
|
|||
|
|
ExAcquireFastMutex
|
|||
|
|
ExInterlockedAddUlong
|
|||
|
|
ExpInterlockedPushEntrySList
|
|||
|
|
OtsZero
|
|||
|
|
ExFreePoolWithTag
|
|||
|
|
ExReleaseFastMutex
|
|||
|
|
KiDispatchInterrupt
|
|||
|
|
KiInterruptException
|
|||
|
|
RtlFindClearBits
|
|||
|
|
KiReleaseSpinLock
|
|||
|
|
ExAcquireResourceSharedLite
|
|||
|
|
IofCompleteRequest
|
|||
|
|
CcMapData
|
|||
|
|
RtlUpcaseUnicodeToOemN
|
|||
|
|
RtlCompareMemory
|
|||
|
|
RtlSplay
|
|||
|
|
CcGetVirtualAddress
|
|||
|
|
ExpInterlockedPopEntrySListFault
|
|||
|
|
ObReferenceObjectByHandle
|
|||
|
|
ExpFindCurrentThread
|
|||
|
|
ObfDereferenceObject
|
|||
|
|
KeFlushIoBuffers
|
|||
|
|
IoGetRelatedDeviceObject
|
|||
|
|
PsImpersonateClient
|
|||
|
|
CcFindBcb
|
|||
|
|
FsRtlDissectName
|
|||
|
|
FsRtlIsNameInExpressionPrivate
|
|||
|
|
KeWaitForSingleObject
|
|||
|
|
IofCallDriver
|
|||
|
|
ObOpenObjectByName
|
|||
|
|
ObpCaptureObjectCreateInformation
|
|||
|
|
ObpLookupObjectName
|
|||
|
|
ExAcquireFastMutexUnsafe
|
|||
|
|
KeRemoveQueue
|
|||
|
|
IoAllocateIrp
|
|||
|
|
PsReferenceImpersonationToken
|
|||
|
|
ObpAllocateObject
|
|||
|
|
CcPinFileData
|
|||
|
|
IoFreeIrp
|
|||
|
|
IoCreateFile
|
|||
|
|
IopAllocateIrp
|
|||
|
|
ExpInterlockedCompareExchange64
|
|||
|
|
OtsFieldInsert
|
|||
|
|
RtlCompareUnicodeString
|
|||
|
|
ObCreateObject
|
|||
|
|
OtsStringCompareEql
|
|||
|
|
SeCreateAccessState
|
|||
|
|
CcCanIWrite
|
|||
|
|
CcFreeVirtualAddress
|
|||
|
|
KeLeaveCriticalRegion
|
|||
|
|
CcUnpinFileData
|
|||
|
|
CcFastCopyRead
|
|||
|
|
PsReferencePrimaryToken
|
|||
|
|
MmProbeAndLockPages
|
|||
|
|
CcFlushCache
|
|||
|
|
ExAcquireHandleTableShared
|
|||
|
|
FsRtlIsFatDbcsLegal
|
|||
|
|
KeInsertQueue
|
|||
|
|
KiInterruptDistribution
|
|||
|
|
ObpCaptureObjectName
|
|||
|
|
RtlpGetStackLimits
|
|||
|
|
MmCheckCachedPageState
|
|||
|
|
CcMapAndRead
|
|||
|
|
NtSetInformationFile
|
|||
|
|
FsRtlCheckOplock
|
|||
|
|
IopCloseFile
|
|||
|
|
ExReleaseFastMutexUnsafe
|
|||
|
|
RtlEqualUnicodeString
|
|||
|
|
RtlUpcaseUnicodeChar
|
|||
|
|
CcWriteBehind
|
|||
|
|
ExTryToAcquireFastMutex
|
|||
|
|
IopParseFile
|
|||
|
|
MmUnlockPages
|
|||
|
|
RtlUnicodeToOemN
|
|||
|
|
IoSetTopLevelIrp
|
|||
|
|
ObpCreateHandle
|
|||
|
|
FsRtlLookupLargeMcbEntry
|
|||
|
|
CcMapAndCopy
|
|||
|
|
OtsStringCompareEqlSameLen
|
|||
|
|
RtlCopyUnicodeString
|
|||
|
|
KeEnterCriticalRegion
|
|||
|
|
CcUnpinData
|
|||
|
|
IopCheckDeviceAndDriver
|
|||
|
|
CcFastCopyWrite
|
|||
|
|
SeCaptureSubjectContext
|
|||
|
|
CcPinMappedData
|
|||
|
|
ExInterlockedInsertTailList
|
|||
|
|
MiFlushSectionInternal
|
|||
|
|
RtlIsNameLegalDOS8Dot3
|
|||
|
|
CcLazyWriteScan
|
|||
|
|
ExCreateHandle
|
|||
|
|
KiInsertQueue
|
|||
|
|
RtlTimeToTimeFields
|
|||
|
|
ObpIncrementHandleCount
|
|||
|
|
CcInitializeCacheMap
|
|||
|
|
FsRtlAddToTunnelCache
|
|||
|
|
IoAllocateMdl
|
|||
|
|
IopDeleteFile
|
|||
|
|
ObpFreeObject
|
|||
|
|
ExpInterlockedExchangeAddLargeInteger
|
|||
|
|
IopCheckBackupRestorePrivilege
|
|||
|
|
ObpRemoveObjectRoutine
|
|||
|
|
ExIsResourceAcquiredExclusiveLite
|
|||
|
|
FsRtlFindLargeIndex
|
|||
|
|
FsRtlGetNextLargeMcbEntry
|
|||
|
|
KeQuerySystemTime
|
|||
|
|
KiSaveVolatileIntegerState
|
|||
|
|
CcUninitializeCacheMap
|
|||
|
|
ExpWaitForResource
|
|||
|
|
FsRtlFindInTunnelCache
|
|||
|
|
IoIsOperationSynchronous
|
|||
|
|
KeFlushSingleTb
|
|||
|
|
SeDeleteAccessState
|
|||
|
|
CcAcquireByteRangeForWrite
|
|||
|
|
CcSetDirtyPinnedData
|
|||
|
|
ExReleaseHandleTableShared
|
|||
|
|
FsRtlOplockFsctrl
|
|||
|
|
memcmp
|
|||
|
|
ObpChargeQuotaForObject
|
|||
|
|
CcSetDirtyInMask
|
|||
|
|
MiDecrementReferenceCount
|
|||
|
|
ObpAllocateObjectNameBuffer
|
|||
|
|
CcPinRead
|
|||
|
|
CcPrepareMdlWrite
|
|||
|
|
IopCompleteRequest
|
|||
|
|
ObpDecrementHandleCount
|
|||
|
|
ExAcquireHandleTableExclusive
|
|||
|
|
FsRtlRequestExclusiveOplock
|
|||
|
|
IoBuildPartialMdl
|
|||
|
|
MiLocateAndReserveWsle
|
|||
|
|
MmIsAddressValid
|
|||
|
|
PsChargeSharedPoolQuota
|
|||
|
|
RtlSetBits
|
|||
|
|
KiRestoreVolatileIntegerState
|
|||
|
|
PsAssignImpersonationToken
|
|||
|
|
RtlNtStatusToDosErrorNoTeb
|
|||
|
|
RtlOemToUnicodeN
|
|||
|
|
SeAssignSecurity
|
|||
|
|
ExAcquireSharedStarveExclusive
|
|||
|
|
ExpAcquireResourceExclusiveLite
|
|||
|
|
KiMb
|
|||
|
|
MmUnmapViewInSystemCache
|
|||
|
|
CcMdlRead
|
|||
|
|
CcMdlWriteComplete2
|
|||
|
|
ExDestroyHandle
|
|||
|
|
FsRtlDoesNameContainWildCards
|
|||
|
|
MiInsertPageInList
|
|||
|
|
MmMapViewInSystemCache
|
|||
|
|
ObpFreeObjectNameBuffer
|
|||
|
|
RtlUpcaseUnicodeString
|
|||
|
|
IoFastQueryNetworkAttributes
|
|||
|
|
RtlMapGenericMask
|
|||
|
|
SeTokenImpersonationLevel
|
|||
|
|
ExReleaseHandleTableExclusive
|
|||
|
|
IoFreeMdl
|
|||
|
|
ExFreePool
|
|||
|
|
IoGetTopLevelIrp
|
|||
|
|
ObpDeleteNameCheck
|
|||
|
|
ObpIncrementHandleDataBase
|
|||
|
|
KeSetEvent
|
|||
|
|
OtsFill
|
|||
|
|
CcAllocateInitializeBcb
|
|||
|
|
NtClose
|
|||
|
|
ExInterlockedAddLargeStatistic
|
|||
|
|
RtlUpcaseUnicodeStringToOemString
|
|||
|
|
IopDereferenceVpbAndFree
|
|||
|
|
MiUpdateWsle
|
|||
|
|
CcSetFileSizes
|
|||
|
|
CcWorkerThread
|
|||
|
|
FsRtlFastCheckLockForRead
|
|||
|
|
MiLocateWsle
|
|||
|
|
MiModifiedPageWriterWorker
|
|||
|
|
MmMapLockedPages
|
|||
|
|
FsRtlAreNamesEqual
|
|||
|
|
FsRtlOplockIsFastIoPossible
|
|||
|
|
MiDecrementShareCount2
|
|||
|
|
MmCreateSection
|
|||
|
|
MmFlushSection
|
|||
|
|
FsRtlOplockBreakToII
|
|||
|
|
IoAcquireCancelSpinLock
|
|||
|
|
MiCheckControlArea
|
|||
|
|
RtlExtendedMagicDivide
|
|||
|
|
RtlOemStringToUnicodeString
|
|||
|
|
CcGetDirtyPages
|
|||
|
|
ElapsedDaysToYears
|
|||
|
|
ExMapHandleToPointer
|
|||
|
|
IoCheckFunctionAccess
|
|||
|
|
IoRemoveShareAccess
|
|||
|
|
MiUnlinkPageFromList
|
|||
|
|
ObpValidateAccessMask
|
|||
|
|
MiReserveSystemPtes
|
|||
|
|
RtlpDidUnicodeToOemWork
|
|||
|
|
SeAuditingFileEvents
|
|||
|
|
FsRtlOplockCleanup
|
|||
|
|
MmAccessFault
|
|||
|
|
MmPurgeSection
|
|||
|
|
SeReleaseSubjectContext
|
|||
|
|
ExSystemTimeToLocalTime
|
|||
|
|
IoSetShareAccess
|
|||
|
|
IoSynchronousPageWrite
|
|||
|
|
KeSetEventBoostPriority
|
|||
|
|
MiRemoveZeroPage
|
|||
|
|
ObpIncrementUnnamedHandleCount
|
|||
|
|
CcCopyWrite
|
|||
|
|
FsRtlCurrentBatchOplock
|
|||
|
|
FsRtlRemoveAndCompleteWaitIrp
|
|||
|
|
MiCheckProtoPtePageState
|
|||
|
|
MiReleaseSystemPtes
|
|||
|
|
MmSetAddressRangeModified
|
|||
|
|
RtlSecondsSince1980ToTime
|
|||
|
|
SeLockSubjectContext
|
|||
|
|
CcMdlReadComplete2
|
|||
|
|
FsRtlFastCheckLockForWrite
|
|||
|
|
FsRtlPruneTunnelCache
|
|||
|
|
KeFlushMultipleTb
|
|||
|
|
MiFreePoolPages
|
|||
|
|
MmCopyToCachedPage
|
|||
|
|
ObpCreateUnnamedHandle
|
|||
|
|
RtlUpcaseUnicodeStringToCountedOemString
|
|||
|
|
CcReleaseByteRangeFromWrite
|
|||
|
|
FsRtlMdlWriteCompleteDev
|
|||
|
|
FsRtlWaitOnIrp
|
|||
|
|
IopErrorLogRequeueEntry
|
|||
|
|
MiDispatchFault
|
|||
|
|
MiInitializePfn
|
|||
|
|
MiRestoreTransitionPte
|
|||
|
|
SeSetAccessStateGenericMapping
|
|||
|
|
CcGetVacbMiss
|
|||
|
|
ExDeleteResourceLite
|
|||
|
|
ExpWorkerThread
|
|||
|
|
FsRtlAddLargeMcbEntry
|
|||
|
|
FsRtlFindFirstOverlappingExclusiveNode
|
|||
|
|
IoCheckShareAccess
|
|||
|
|
KeInitializeEvent
|
|||
|
|
KeInsertDeviceQueue
|
|||
|
|
MiRemoveAnyPage
|
|||
|
|
MmUnmapLockedPages
|
|||
|
|
RtlUnicodeStringToOemString
|
|||
|
|
ExInitializeResourceLite
|
|||
|
|
IopOpenLinkOrRenameTarget
|
|||
|
|
IoStartNextPacket
|
|||
|
|
KeInitializeApc
|
|||
|
|
KiMemoryManagementDispatch
|
|||
|
|
MiCreateDataFileMap
|
|||
|
|
MiGatherMappedPages
|
|||
|
|
SeValidSecurityDescriptor
|
|||
|
|
SwapSplayLinks
|
|||
|
|
CcCopyRead
|
|||
|
|
ExAcquireSharedWaitForExclusive
|
|||
|
|
FsRtlInitializeLargeMcb
|
|||
|
|
FsRtlTruncateLargeMcb
|
|||
|
|
IoCreateStreamFileObject
|
|||
|
|
IoGetCurrentProcess
|
|||
|
|
KeInitializeSpinLock
|
|||
|
|
MiRemovePageByColor
|
|||
|
|
MiResolveProtoPteFault
|
|||
|
|
RtlDelete
|
|||
|
|
RtlFillMemoryUlong
|
|||
|
|
CcSetValidData
|
|||
|
|
CcUnmapVacbArray
|
|||
|
|
FsRtlAcknowledgeOplockBreak
|
|||
|
|
IoAllocateAdapterChannel
|
|||
|
|
IoStartPacket
|
|||
|
|
KeRemoveDeviceQueue
|
|||
|
|
KiSaveVolatileFloatState
|
|||
|
|
MiMakeProtectionMask
|
|||
|
|
MiReleaseWsle
|
|||
|
|
MiRemovePageFromList
|
|||
|
|
PsReturnSharedPoolQuota
|
|||
|
|
RtlFindClearBitsAndSet
|
|||
|
|
RtlpLengthInheritedAce
|
|||
|
|
RtlTimeToSecondsSince1970
|
|||
|
|
SepGetDefaultsSubjectContext
|
|||
|
|
ExQueueWorkItem
|
|||
|
|
ExReinitializeResourceLite
|
|||
|
|
FsRtlCheckLockForReadAccess
|
|||
|
|
FsRtlFastUnlockAll
|
|||
|
|
FsRtlIsNameInExpression
|
|||
|
|
IoReleaseCancelSpinLock
|
|||
|
|
KeInsertByKeyDeviceQueue
|
|||
|
|
KiDeliverApc
|
|||
|
|
MiCheckControlAreaStatus
|
|||
|
|
MiMakeSystemAddressValidPfn
|
|||
|
|
MiRemoveWsle
|
|||
|
|
MiResolveMappedFileFault
|
|||
|
|
OtsRemainder32Unsigned
|
|||
|
|
RtlClearBits
|
|||
|
|
RtlNumberGenericTableElements
|
|||
|
|
RtlpGenerateInheritedAce
|
|||
|
|
SepAccessCheck
|
|||
|
|
CcDeallocateBcb
|
|||
|
|
CcFreeActiveVacb
|
|||
|
|
CcIsThereDirtyData
|
|||
|
|
CcPostWorkQueue
|
|||
|
|
FsRtlPrivateFastUnlockAll
|
|||
|
|
FsRtlPrivateInsertLock
|
|||
|
|
KeRemoveByKeyDeviceQueue
|
|||
|
|
KiApcInterrupt
|
|||
|
|
MiAllocatePoolPages
|
|||
|
|
MiGetInPageSupportBlock
|
|||
|
|
MiInitializeReadInProgressPfn
|
|||
|
|
SepInheritAcl
|
|||
|
|
CcDeleteSharedCacheMap
|
|||
|
|
CcGetVirtualAddressIfMapped
|
|||
|
|
CcPerformReadAhead
|
|||
|
|
CcPreparePinWrite
|
|||
|
|
CcSetReadAheadGranularity
|
|||
|
|
ExAllocatePoolWithQuotaTag
|
|||
|
|
FsRtlAllocateOplock
|
|||
|
|
FsRtlFastUnlockSingleExclusive
|
|||
|
|
FsRtlLookupLastLargeMcbEntry
|
|||
|
|
FsRtlPrivateLock
|
|||
|
|
FsRtlUninitializeOplock
|
|||
|
|
IoCheckDesiredAccess
|
|||
|
|
KeGetCurrentIrql
|
|||
|
|
KeInsertHeadQueue
|
|||
|
|
KeInsertQueueApc
|
|||
|
|
MiAddValidPageToWorkingSet
|
|||
|
|
MiEnsureAvailablePageOrWait
|
|||
|
|
RtlAreBitsClear
|
|||
|
|
RtlInsertElementGenericTable
|
|||
|
|
RtlLengthSecurityDescriptor
|
|||
|
|
SepSidInToken
|
|||
|
|
SeUnlockSubjectContext
|
|||
|
|
wcsicmp
|
|||
|
|
FsRtlAllocateFirstMapping
|
|||
|
|
FsRtlFastUnlockSingle
|
|||
|
|
FsRtlOplockBreakNotify
|
|||
|
|
FsRtlPrivateResetLowestLockOffset
|
|||
|
|
FsRtlRemoveMcbEntryPrivate
|
|||
|
|
IoPageRead
|
|||
|
|
IopSynchronousServiceTail
|
|||
|
|
IoQueueThreadIrp
|
|||
|
|
MiCheckForControlAreaDeletion
|
|||
|
|
MiGetEventCounter
|
|||
|
|
MiResolveTransitionFault
|
|||
|
|
MiSectionDelete
|
|||
|
|
MiSegmentDelete
|
|||
|
|
ObInsertObject
|
|||
|
|
OtsDivide32Unsigned
|
|||
|
|
RtlCreateAcl
|
|||
|
|
RtlInitializeSid
|
|||
|
|
RtlVirtualUnwind
|
|||
|
|
SepCheckAcl
|
|||
|
|
CcScheduleReadAhead
|
|||
|
|
ExDisableResourceBoostLite
|
|||
|
|
ExExtendZone
|
|||
|
|
ExLocalTimeToSystemTime
|
|||
|
|
ExReleaseResourceForThreadLite
|
|||
|
|
FsRtlMdlReadCompleteDev
|
|||
|
|
FsRtlPrivateInsertExclusiveLock
|
|||
|
|
FsRtlPrivateLimitFreeLockList
|
|||
|
|
FsRtlReleaseFileForCcFlush
|
|||
|
|
IoGetFileObjectGenericMapping
|
|||
|
|
IoUpdateShareAccess
|
|||
|
|
KeClearEvent
|
|||
|
|
KeSetTimerEx
|
|||
|
|
KeTryToAcquireSpinLock
|
|||
|
|
KiSystemServiceExit
|
|||
|
|
MiAccessCheck
|
|||
|
|
MiFreeEventCounter
|
|||
|
|
MiInitializeTransitionPfn
|
|||
|
|
MmCanFileBeTruncatedInternal
|
|||
|
|
MmUnlockCachedPage
|
|||
|
|
NtDeleteFile
|
|||
|
|
RtlConvertUlongToLargeInteger
|
|||
|
|
RtlDeleteElementGenericTable
|
|||
|
|
RtlEqualPrefixSid
|
|||
|
|
RtlLookupFunctionEntry
|
|||
|
|
RtlUnicodeStringToCountedOemString
|
|||
|
|
_C_ExecuteExceptionFilter
|
|||
|
|
CcCreateVacbArray
|
|||
|
|
CcPurgeAndClearCacheSection
|
|||
|
|
CcPurgeCacheSection
|
|||
|
|
CcSetLogHandleForFile
|
|||
|
|
CcUnmapAndPurge
|
|||
|
|
CcUnpinDataForThread
|
|||
|
|
ExpRaiseStatus
|
|||
|
|
FsRtlAcquireFileForCcFlush
|
|||
|
|
FsRtlFreeFirstMapping
|
|||
|
|
FsRtlPrivateCheckForExclusiveLockAccess
|
|||
|
|
FsRtlReleaseFile
|
|||
|
|
FsRtlUninitializeFileLock
|
|||
|
|
IopTimerDispatch
|
|||
|
|
KeWaitForMultipleObjects
|
|||
|
|
KiAlternateExit
|
|||
|
|
KiIpiSendPacket
|
|||
|
|
KiMemoryManagementException
|
|||
|
|
KiRestoreVolatileFloatState
|
|||
|
|
KiSystemServiceDispatch
|
|||
|
|
KiSystemServiceException
|
|||
|
|
KiTimerExpiration
|
|||
|
|
MiCompleteProtoPteFault
|
|||
|
|
MiFindActualFaultingPte
|
|||
|
|
MiFreeInPageSupportBlock
|
|||
|
|
MiInsertFrontModifiedNoWrite
|
|||
|
|
MiInsertWsle
|
|||
|
|
MiResolveDemandZeroFault
|
|||
|
|
MiSetDirtyBit
|
|||
|
|
MiTrimWorkingSet
|
|||
|
|
MiWaitForInPageComplete
|
|||
|
|
MmBuildMdlForNonPagedPool
|
|||
|
|
MmFlushImageSection
|
|||
|
|
MmZeroPageThread
|
|||
|
|
NtQueryVolumeInformationFile
|
|||
|
|
ObDeleteCapturedInsertInfo
|
|||
|
|
RtlAreBitsSet
|
|||
|
|
RtlDeleteNoSplay
|
|||
|
|
RtlExtendedIntegerMultiply
|
|||
|
|
RtlFillBytes
|
|||
|
|
RtlFirstFreeAce
|
|||
|
|
RtlInitializeBitMap
|
|||
|
|
RtlPcToFileHeader
|
|||
|
|
RtlpLengthInheritAcl
|
|||
|
|
RtlSecondsSince1970ToTime
|
|||
|
|
RtlSubtreePredecessor
|
|||
|
|
SeAccessCheck
|
|||
|
|
SeDeassignSecurity
|
|||
|
|
|