434 lines
12 KiB
Plaintext
434 lines
12 KiB
Plaintext
|
14248 KiIdleLoop
|
|||
|
3851 KeAcquireSpinLockRaiseToSynch
|
|||
|
2413 KiSwapThreadExit
|
|||
|
2319 KiUnlockDispatcherDatabase
|
|||
|
1947 OtsMove
|
|||
|
1258 RtlCopyBytes
|
|||
|
1153 KeReleaseSpinLock
|
|||
|
810 IopParseDevice
|
|||
|
730 ExAcquireResourceExclusiveLite
|
|||
|
717 KeAcquireSpinLockAtDpcLevel
|
|||
|
683 KeSynchronizeExecution
|
|||
|
612 ExAllocatePoolWithTag
|
|||
|
610 ExReleaseResourceLite
|
|||
|
554 KiRetireDpcList
|
|||
|
553 ExpInterlockedPopEntrySList
|
|||
|
541 ExAcquireFastMutex
|
|||
|
533 ExInterlockedAddUlong
|
|||
|
520 ExpInterlockedPushEntrySList
|
|||
|
488 OtsZero
|
|||
|
395 ExFreePoolWithTag
|
|||
|
356 ExReleaseFastMutex
|
|||
|
342 KiDispatchInterrupt
|
|||
|
332 KiInterruptException
|
|||
|
304 RtlFindClearBits
|
|||
|
259 KiReleaseSpinLock
|
|||
|
250 ExAcquireResourceSharedLite
|
|||
|
247 IofCompleteRequest
|
|||
|
244 CcMapData
|
|||
|
242 RtlUpcaseUnicodeToOemN
|
|||
|
235 RtlCompareMemory
|
|||
|
235 RtlSplay
|
|||
|
229 CcGetVirtualAddress
|
|||
|
227 ExpInterlockedPopEntrySListFault
|
|||
|
225 ObReferenceObjectByHandle
|
|||
|
215 ExpFindCurrentThread
|
|||
|
215 ObfDereferenceObject
|
|||
|
212 KeFlushIoBuffers
|
|||
|
208 IoGetRelatedDeviceObject
|
|||
|
206 PsImpersonateClient
|
|||
|
182 CcFindBcb
|
|||
|
168 FsRtlDissectName
|
|||
|
159 FsRtlIsNameInExpressionPrivate
|
|||
|
143 KeWaitForSingleObject
|
|||
|
139 IofCallDriver
|
|||
|
138 ObOpenObjectByName
|
|||
|
134 ObpCaptureObjectCreateInformation
|
|||
|
134 ObpLookupObjectName
|
|||
|
132 ExAcquireFastMutexUnsafe
|
|||
|
130 KeRemoveQueue
|
|||
|
128 IoAllocateIrp
|
|||
|
127 PsReferenceImpersonationToken
|
|||
|
126 ObpAllocateObject
|
|||
|
122 CcPinFileData
|
|||
|
118 IoFreeIrp
|
|||
|
117 IoCreateFile
|
|||
|
116 IopAllocateIrp
|
|||
|
110 ExpInterlockedCompareExchange64
|
|||
|
110 OtsFieldInsert
|
|||
|
107 RtlCompareUnicodeString
|
|||
|
106 ObCreateObject
|
|||
|
106 OtsStringCompareEql
|
|||
|
106 SeCreateAccessState
|
|||
|
102 CcCanIWrite
|
|||
|
93 CcFreeVirtualAddress
|
|||
|
91 KeLeaveCriticalRegion
|
|||
|
86 CcUnpinFileData
|
|||
|
85 CcFastCopyRead
|
|||
|
83 PsReferencePrimaryToken
|
|||
|
77 MmProbeAndLockPages
|
|||
|
76 CcFlushCache
|
|||
|
75 ExAcquireHandleTableShared
|
|||
|
75 FsRtlIsFatDbcsLegal
|
|||
|
74 KeInsertQueue
|
|||
|
74 KiInterruptDistribution
|
|||
|
73 ObpCaptureObjectName
|
|||
|
73 RtlpGetStackLimits
|
|||
|
69 MmCheckCachedPageState
|
|||
|
68 CcMapAndRead
|
|||
|
68 NtSetInformationFile
|
|||
|
66 FsRtlCheckOplock
|
|||
|
66 IopCloseFile
|
|||
|
65 ExReleaseFastMutexUnsafe
|
|||
|
65 RtlEqualUnicodeString
|
|||
|
62 RtlUpcaseUnicodeChar
|
|||
|
60 CcWriteBehind
|
|||
|
60 ExTryToAcquireFastMutex
|
|||
|
59 IopParseFile
|
|||
|
58 MmUnlockPages
|
|||
|
58 RtlUnicodeToOemN
|
|||
|
57 IoSetTopLevelIrp
|
|||
|
57 ObpCreateHandle
|
|||
|
56 FsRtlLookupLargeMcbEntry
|
|||
|
52 CcMapAndCopy
|
|||
|
52 OtsStringCompareEqlSameLen
|
|||
|
52 RtlCopyUnicodeString
|
|||
|
50 KeEnterCriticalRegion
|
|||
|
49 CcUnpinData
|
|||
|
49 IopCheckDeviceAndDriver
|
|||
|
48 CcFastCopyWrite
|
|||
|
48 SeCaptureSubjectContext
|
|||
|
47 CcPinMappedData
|
|||
|
46 ExInterlockedInsertTailList
|
|||
|
46 MiFlushSectionInternal
|
|||
|
46 RtlIsNameLegalDOS8Dot3
|
|||
|
45 CcLazyWriteScan
|
|||
|
45 ExCreateHandle
|
|||
|
45 KiInsertQueue
|
|||
|
45 RtlTimeToTimeFields
|
|||
|
44 ObpIncrementHandleCount
|
|||
|
43 CcInitializeCacheMap
|
|||
|
43 FsRtlAddToTunnelCache
|
|||
|
43 IoAllocateMdl
|
|||
|
43 IopDeleteFile
|
|||
|
43 ObpFreeObject
|
|||
|
41 ExpInterlockedExchangeAddLargeInteger
|
|||
|
41 IopCheckBackupRestorePrivilege
|
|||
|
41 ObpRemoveObjectRoutine
|
|||
|
40 ExIsResourceAcquiredExclusiveLite
|
|||
|
40 FsRtlFindLargeIndex
|
|||
|
40 FsRtlGetNextLargeMcbEntry
|
|||
|
40 KeQuerySystemTime
|
|||
|
40 KiSaveVolatileIntegerState
|
|||
|
39 CcUninitializeCacheMap
|
|||
|
39 ExpWaitForResource
|
|||
|
39 FsRtlFindInTunnelCache
|
|||
|
39 IoIsOperationSynchronous
|
|||
|
39 KeFlushSingleTb
|
|||
|
39 SeDeleteAccessState
|
|||
|
38 CcAcquireByteRangeForWrite
|
|||
|
38 CcSetDirtyPinnedData
|
|||
|
38 ExReleaseHandleTableShared
|
|||
|
38 FsRtlOplockFsctrl
|
|||
|
38 memcmp
|
|||
|
38 ObpChargeQuotaForObject
|
|||
|
37 CcSetDirtyInMask
|
|||
|
37 MiDecrementReferenceCount
|
|||
|
37 ObpAllocateObjectNameBuffer
|
|||
|
36 CcPinRead
|
|||
|
36 CcPrepareMdlWrite
|
|||
|
36 IopCompleteRequest
|
|||
|
36 ObpDecrementHandleCount
|
|||
|
34 ExAcquireHandleTableExclusive
|
|||
|
33 FsRtlRequestExclusiveOplock
|
|||
|
33 IoBuildPartialMdl
|
|||
|
33 MiLocateAndReserveWsle
|
|||
|
33 MmIsAddressValid
|
|||
|
33 PsChargeSharedPoolQuota
|
|||
|
33 RtlSetBits
|
|||
|
32 KiRestoreVolatileIntegerState
|
|||
|
32 PsAssignImpersonationToken
|
|||
|
32 RtlNtStatusToDosErrorNoTeb
|
|||
|
32 RtlOemToUnicodeN
|
|||
|
32 SeAssignSecurity
|
|||
|
31 ExAcquireSharedStarveExclusive
|
|||
|
31 ExpAcquireResourceExclusiveLite
|
|||
|
31 KiMb
|
|||
|
31 MmUnmapViewInSystemCache
|
|||
|
30 CcMdlRead
|
|||
|
29 CcMdlWriteComplete2
|
|||
|
29 ExDestroyHandle
|
|||
|
29 FsRtlDoesNameContainWildCards
|
|||
|
29 MiInsertPageInList
|
|||
|
29 MmMapViewInSystemCache
|
|||
|
29 ObpFreeObjectNameBuffer
|
|||
|
29 RtlUpcaseUnicodeString
|
|||
|
28 IoFastQueryNetworkAttributes
|
|||
|
28 RtlMapGenericMask
|
|||
|
28 SeTokenImpersonationLevel
|
|||
|
27 ExReleaseHandleTableExclusive
|
|||
|
27 IoFreeMdl
|
|||
|
26 ExFreePool
|
|||
|
26 IoGetTopLevelIrp
|
|||
|
26 ObpDeleteNameCheck
|
|||
|
26 ObpIncrementHandleDataBase
|
|||
|
25 KeSetEvent
|
|||
|
24 OtsFill
|
|||
|
23 CcAllocateInitializeBcb
|
|||
|
23 NtClose
|
|||
|
22 ExInterlockedAddLargeStatistic
|
|||
|
22 RtlUpcaseUnicodeStringToOemString
|
|||
|
21 IopDereferenceVpbAndFree
|
|||
|
21 MiUpdateWsle
|
|||
|
20 CcSetFileSizes
|
|||
|
20 CcWorkerThread
|
|||
|
20 FsRtlFastCheckLockForRead
|
|||
|
20 MiLocateWsle
|
|||
|
20 MiModifiedPageWriterWorker
|
|||
|
20 MmMapLockedPages
|
|||
|
19 FsRtlAreNamesEqual
|
|||
|
19 FsRtlOplockIsFastIoPossible
|
|||
|
19 MiDecrementShareCount2
|
|||
|
19 MmCreateSection
|
|||
|
19 MmFlushSection
|
|||
|
18 FsRtlOplockBreakToII
|
|||
|
18 IoAcquireCancelSpinLock
|
|||
|
18 MiCheckControlArea
|
|||
|
18 RtlExtendedMagicDivide
|
|||
|
18 RtlOemStringToUnicodeString
|
|||
|
17 CcGetDirtyPages
|
|||
|
17 ElapsedDaysToYears
|
|||
|
17 ExMapHandleToPointer
|
|||
|
17 IoCheckFunctionAccess
|
|||
|
17 IoRemoveShareAccess
|
|||
|
17 MiUnlinkPageFromList
|
|||
|
17 ObpValidateAccessMask
|
|||
|
16 MiReserveSystemPtes
|
|||
|
16 RtlpDidUnicodeToOemWork
|
|||
|
16 SeAuditingFileEvents
|
|||
|
15 FsRtlOplockCleanup
|
|||
|
15 MmAccessFault
|
|||
|
15 MmPurgeSection
|
|||
|
15 SeReleaseSubjectContext
|
|||
|
14 ExSystemTimeToLocalTime
|
|||
|
14 IoSetShareAccess
|
|||
|
14 IoSynchronousPageWrite
|
|||
|
14 KeSetEventBoostPriority
|
|||
|
14 MiRemoveZeroPage
|
|||
|
14 ObpIncrementUnnamedHandleCount
|
|||
|
13 CcCopyWrite
|
|||
|
13 FsRtlCurrentBatchOplock
|
|||
|
13 FsRtlRemoveAndCompleteWaitIrp
|
|||
|
13 MiCheckProtoPtePageState
|
|||
|
13 MiReleaseSystemPtes
|
|||
|
13 MmSetAddressRangeModified
|
|||
|
13 RtlSecondsSince1980ToTime
|
|||
|
13 SeLockSubjectContext
|
|||
|
12 CcMdlReadComplete2
|
|||
|
12 FsRtlFastCheckLockForWrite
|
|||
|
12 FsRtlPruneTunnelCache
|
|||
|
12 KeFlushMultipleTb
|
|||
|
12 MiFreePoolPages
|
|||
|
12 MmCopyToCachedPage
|
|||
|
12 ObpCreateUnnamedHandle
|
|||
|
12 RtlUpcaseUnicodeStringToCountedOemString
|
|||
|
11 CcReleaseByteRangeFromWrite
|
|||
|
11 FsRtlMdlWriteCompleteDev
|
|||
|
11 FsRtlWaitOnIrp
|
|||
|
11 IopErrorLogRequeueEntry
|
|||
|
11 MiDispatchFault
|
|||
|
11 MiInitializePfn
|
|||
|
11 MiRestoreTransitionPte
|
|||
|
11 SeSetAccessStateGenericMapping
|
|||
|
10 CcGetVacbMiss
|
|||
|
10 ExDeleteResourceLite
|
|||
|
10 ExpWorkerThread
|
|||
|
10 FsRtlAddLargeMcbEntry
|
|||
|
10 FsRtlFindFirstOverlappingExclusiveNode
|
|||
|
10 IoCheckShareAccess
|
|||
|
10 KeInitializeEvent
|
|||
|
10 KeInsertDeviceQueue
|
|||
|
10 MiRemoveAnyPage
|
|||
|
10 MmUnmapLockedPages
|
|||
|
10 RtlUnicodeStringToOemString
|
|||
|
9 ExInitializeResourceLite
|
|||
|
9 IopOpenLinkOrRenameTarget
|
|||
|
9 IoStartNextPacket
|
|||
|
9 KeInitializeApc
|
|||
|
9 KiMemoryManagementDispatch
|
|||
|
9 MiCreateDataFileMap
|
|||
|
9 MiGatherMappedPages
|
|||
|
9 SeValidSecurityDescriptor
|
|||
|
9 SwapSplayLinks
|
|||
|
8 CcCopyRead
|
|||
|
8 ExAcquireSharedWaitForExclusive
|
|||
|
8 FsRtlInitializeLargeMcb
|
|||
|
8 FsRtlTruncateLargeMcb
|
|||
|
8 IoCreateStreamFileObject
|
|||
|
8 IoGetCurrentProcess
|
|||
|
8 KeInitializeSpinLock
|
|||
|
8 MiRemovePageByColor
|
|||
|
8 MiResolveProtoPteFault
|
|||
|
8 RtlDelete
|
|||
|
8 RtlFillMemoryUlong
|
|||
|
7 CcSetValidData
|
|||
|
7 CcUnmapVacbArray
|
|||
|
7 FsRtlAcknowledgeOplockBreak
|
|||
|
7 IoAllocateAdapterChannel
|
|||
|
7 IoStartPacket
|
|||
|
7 KeRemoveDeviceQueue
|
|||
|
7 KiSaveVolatileFloatState
|
|||
|
7 MiMakeProtectionMask
|
|||
|
7 MiReleaseWsle
|
|||
|
7 MiRemovePageFromList
|
|||
|
7 PsReturnSharedPoolQuota
|
|||
|
7 RtlFindClearBitsAndSet
|
|||
|
7 RtlpLengthInheritedAce
|
|||
|
7 RtlTimeToSecondsSince1970
|
|||
|
7 SepGetDefaultsSubjectContext
|
|||
|
6 ExQueueWorkItem
|
|||
|
6 ExReinitializeResourceLite
|
|||
|
6 FsRtlCheckLockForReadAccess
|
|||
|
6 FsRtlFastUnlockAll
|
|||
|
6 FsRtlIsNameInExpression
|
|||
|
6 IoReleaseCancelSpinLock
|
|||
|
6 KeInsertByKeyDeviceQueue
|
|||
|
6 KiDeliverApc
|
|||
|
6 MiCheckControlAreaStatus
|
|||
|
6 MiMakeSystemAddressValidPfn
|
|||
|
6 MiRemoveWsle
|
|||
|
6 MiResolveMappedFileFault
|
|||
|
6 OtsRemainder32Unsigned
|
|||
|
6 RtlClearBits
|
|||
|
6 RtlNumberGenericTableElements
|
|||
|
6 RtlpGenerateInheritedAce
|
|||
|
6 SepAccessCheck
|
|||
|
5 CcDeallocateBcb
|
|||
|
5 CcFreeActiveVacb
|
|||
|
5 CcIsThereDirtyData
|
|||
|
5 CcPostWorkQueue
|
|||
|
5 FsRtlPrivateFastUnlockAll
|
|||
|
5 FsRtlPrivateInsertLock
|
|||
|
5 KeRemoveByKeyDeviceQueue
|
|||
|
5 KiApcInterrupt
|
|||
|
5 MiAllocatePoolPages
|
|||
|
5 MiGetInPageSupportBlock
|
|||
|
5 MiInitializeReadInProgressPfn
|
|||
|
5 SepInheritAcl
|
|||
|
4 CcDeleteSharedCacheMap
|
|||
|
4 CcGetVirtualAddressIfMapped
|
|||
|
4 CcPerformReadAhead
|
|||
|
4 CcPreparePinWrite
|
|||
|
4 CcSetReadAheadGranularity
|
|||
|
4 ExAllocatePoolWithQuotaTag
|
|||
|
4 FsRtlAllocateOplock
|
|||
|
4 FsRtlFastUnlockSingleExclusive
|
|||
|
4 FsRtlLookupLastLargeMcbEntry
|
|||
|
4 FsRtlPrivateLock
|
|||
|
4 FsRtlUninitializeOplock
|
|||
|
4 IoCheckDesiredAccess
|
|||
|
4 KeGetCurrentIrql
|
|||
|
4 KeInsertHeadQueue
|
|||
|
4 KeInsertQueueApc
|
|||
|
4 MiAddValidPageToWorkingSet
|
|||
|
4 MiEnsureAvailablePageOrWait
|
|||
|
4 RtlAreBitsClear
|
|||
|
4 RtlInsertElementGenericTable
|
|||
|
4 RtlLengthSecurityDescriptor
|
|||
|
4 SepSidInToken
|
|||
|
4 SeUnlockSubjectContext
|
|||
|
4 wcsicmp
|
|||
|
3 FsRtlAllocateFirstMapping
|
|||
|
3 FsRtlFastUnlockSingle
|
|||
|
3 FsRtlOplockBreakNotify
|
|||
|
3 FsRtlPrivateResetLowestLockOffset
|
|||
|
3 FsRtlRemoveMcbEntryPrivate
|
|||
|
3 IoPageRead
|
|||
|
3 IopSynchronousServiceTail
|
|||
|
3 IoQueueThreadIrp
|
|||
|
3 MiCheckForControlAreaDeletion
|
|||
|
3 MiGetEventCounter
|
|||
|
3 MiResolveTransitionFault
|
|||
|
3 MiSectionDelete
|
|||
|
3 MiSegmentDelete
|
|||
|
3 ObInsertObject
|
|||
|
3 OtsDivide32Unsigned
|
|||
|
3 RtlCreateAcl
|
|||
|
3 RtlInitializeSid
|
|||
|
3 RtlVirtualUnwind
|
|||
|
3 SepCheckAcl
|
|||
|
2 CcScheduleReadAhead
|
|||
|
2 ExDisableResourceBoostLite
|
|||
|
2 ExExtendZone
|
|||
|
2 ExLocalTimeToSystemTime
|
|||
|
2 ExReleaseResourceForThreadLite
|
|||
|
2 FsRtlMdlReadCompleteDev
|
|||
|
2 FsRtlPrivateInsertExclusiveLock
|
|||
|
2 FsRtlPrivateLimitFreeLockList
|
|||
|
2 FsRtlReleaseFileForCcFlush
|
|||
|
2 IoGetFileObjectGenericMapping
|
|||
|
2 IoUpdateShareAccess
|
|||
|
2 KeClearEvent
|
|||
|
2 KeSetTimerEx
|
|||
|
2 KeTryToAcquireSpinLock
|
|||
|
2 KiSystemServiceExit
|
|||
|
2 MiAccessCheck
|
|||
|
2 MiFreeEventCounter
|
|||
|
2 MiInitializeTransitionPfn
|
|||
|
2 MmCanFileBeTruncatedInternal
|
|||
|
2 MmUnlockCachedPage
|
|||
|
2 NtDeleteFile
|
|||
|
2 RtlConvertUlongToLargeInteger
|
|||
|
2 RtlDeleteElementGenericTable
|
|||
|
2 RtlEqualPrefixSid
|
|||
|
2 RtlLookupFunctionEntry
|
|||
|
2 RtlUnicodeStringToCountedOemString
|
|||
|
1 _C_ExecuteExceptionFilter
|
|||
|
1 CcCreateVacbArray
|
|||
|
1 CcPurgeAndClearCacheSection
|
|||
|
1 CcPurgeCacheSection
|
|||
|
1 CcSetLogHandleForFile
|
|||
|
1 CcUnmapAndPurge
|
|||
|
1 CcUnpinDataForThread
|
|||
|
1 ExpRaiseStatus
|
|||
|
1 FsRtlAcquireFileForCcFlush
|
|||
|
1 FsRtlFreeFirstMapping
|
|||
|
1 FsRtlPrivateCheckForExclusiveLockAccess
|
|||
|
1 FsRtlReleaseFile
|
|||
|
1 FsRtlUninitializeFileLock
|
|||
|
1 IopTimerDispatch
|
|||
|
1 KeWaitForMultipleObjects
|
|||
|
1 KiAlternateExit
|
|||
|
1 KiIpiSendPacket
|
|||
|
1 KiMemoryManagementException
|
|||
|
1 KiRestoreVolatileFloatState
|
|||
|
1 KiSystemServiceDispatch
|
|||
|
1 KiSystemServiceException
|
|||
|
1 KiTimerExpiration
|
|||
|
1 MiCompleteProtoPteFault
|
|||
|
1 MiFindActualFaultingPte
|
|||
|
1 MiFreeInPageSupportBlock
|
|||
|
1 MiInsertFrontModifiedNoWrite
|
|||
|
1 MiInsertWsle
|
|||
|
1 MiResolveDemandZeroFault
|
|||
|
1 MiSetDirtyBit
|
|||
|
1 MiTrimWorkingSet
|
|||
|
1 MiWaitForInPageComplete
|
|||
|
1 MmBuildMdlForNonPagedPool
|
|||
|
1 MmFlushImageSection
|
|||
|
1 MmZeroPageThread
|
|||
|
1 NtQueryVolumeInformationFile
|
|||
|
1 ObDeleteCapturedInsertInfo
|
|||
|
1 RtlAreBitsSet
|
|||
|
1 RtlDeleteNoSplay
|
|||
|
1 RtlExtendedIntegerMultiply
|
|||
|
1 RtlFillBytes
|
|||
|
1 RtlFirstFreeAce
|
|||
|
1 RtlInitializeBitMap
|
|||
|
1 RtlPcToFileHeader
|
|||
|
1 RtlpLengthInheritAcl
|
|||
|
1 RtlSecondsSince1970ToTime
|
|||
|
1 RtlSubtreePredecessor
|
|||
|
1 SeAccessCheck
|
|||
|
1 SeDeassignSecurity
|
|||
|
|