2391 lines
47 KiB
Plaintext
2391 lines
47 KiB
Plaintext
|
KeRaiseIrql
|
||
|
|
KeFlushIoBuffers
|
||
|
|
KeSynchronizeExecution
|
||
|
|
KeLeaveCriticalRegion
|
||
|
|
MiReleaseSystemPtes
|
||
|
|
KeInsertQueue
|
||
|
|
ExQueueWorkItem
|
||
|
|
CcPostWorkQueue
|
||
|
|
CcGetVirtualAddress
|
||
|
|
CcMdlRead
|
||
|
|
CcMapAndRead
|
||
|
|
KeRemoveQueue
|
||
|
|
ExpWorkerThread
|
||
|
|
KeSetEvent
|
||
|
|
MiInsertPageInList
|
||
|
|
CcFreeVirtualAddress
|
||
|
|
CcPinMappedData
|
||
|
|
CcFreeActiveVacb
|
||
|
|
CcPrepareMdlWrite
|
||
|
|
MmUnmapLockedPages
|
||
|
|
KeFlushSingleTb
|
||
|
|
MiDeleteSystemPagableVm
|
||
|
|
PspDereferenceEventPair
|
||
|
|
KeInsertHeadQueue
|
||
|
|
IofCompleteRequest
|
||
|
|
FsRtlProcessFileLock
|
||
|
|
KeWaitForSingleObject
|
||
|
|
CcCanIWrite
|
||
|
|
ExAcquireFastMutexUnsafe
|
||
|
|
MmProbeAndLockPages
|
||
|
|
CcUnpinFileData
|
||
|
|
CcReleaseByteRangeFromWrite
|
||
|
|
CcUnpinDataForThread
|
||
|
|
ExpAcquireResourceSharedLite
|
||
|
|
PsChargePoolQuota
|
||
|
|
MiInsertVad
|
||
|
|
IopDeleteFile
|
||
|
|
FsRtlPrivateCheckWaitingLocks
|
||
|
|
CmpInitializeMachineDependentConfiguration
|
||
|
|
_amsg_exit
|
||
|
|
_isctype
|
||
|
|
PspDeleteVdmObjects
|
||
|
|
PspDeleteLdt
|
||
|
|
PspInitializeThreadSecurity
|
||
|
|
PsIsThreadTerminating
|
||
|
|
PoRegisterDeviceForIdleDetection
|
||
|
|
PoQueryPowerSequence
|
||
|
|
RtlNumberGenericTableElements
|
||
|
|
RtlCaptureStackBackTrace
|
||
|
|
RtlAssert
|
||
|
|
MmUnsecureVirtualMemory
|
||
|
|
MmIsThisAnNtAsSystem
|
||
|
|
MmQuerySystemSize
|
||
|
|
KiSuspendNop
|
||
|
|
KeSwitchFrozenProcessor
|
||
|
|
KiFreezeTargetExecution
|
||
|
|
KiRestoreProcessorState
|
||
|
|
ZwWriteVirtualMemory
|
||
|
|
ZwWriteFile
|
||
|
|
ZwWaitForSingleObject
|
||
|
|
ZwUnmapViewOfSection
|
||
|
|
ZwUnloadDriver
|
||
|
|
ZwTerminateProcess
|
||
|
|
ZwShutdownSystem
|
||
|
|
ZwSetValueKey
|
||
|
|
ZwSetTimerResolution
|
||
|
|
ZwSetTimer
|
||
|
|
ZwSetSystemTime
|
||
|
|
ZwSetSystemInformation
|
||
|
|
ZwSetSecurityObject
|
||
|
|
ZwSetInformationThread
|
||
|
|
ZwSetInformationProcess
|
||
|
|
ZwSetInformationFile
|
||
|
|
ZwSetEvent
|
||
|
|
ZwSetDefaultLocale
|
||
|
|
ZwSaveKey
|
||
|
|
ZwResumeThread
|
||
|
|
ZwRestoreKey
|
||
|
|
ZwResetEvent
|
||
|
|
ZwRequestWaitReplyPort
|
||
|
|
ZwReplyWaitReceivePort
|
||
|
|
ZwReadFile
|
||
|
|
ZwRaiseHardError
|
||
|
|
ZwRaiseException
|
||
|
|
ZwQueryVolumeInformationFile
|
||
|
|
ZwQueryValueKey
|
||
|
|
ZwQuerySystemInformation
|
||
|
|
ZwQuerySymbolicLinkObject
|
||
|
|
ZwQuerySecurityObject
|
||
|
|
ZwQuerySection
|
||
|
|
ZwQueryObject
|
||
|
|
ZwQueryKey
|
||
|
|
ZwQueryInformationToken
|
||
|
|
ZwQueryInformationProcess
|
||
|
|
PsChargeSharedPoolQuota
|
||
|
|
ObpChargeQuotaForObject
|
||
|
|
IoAllocateMdl
|
||
|
|
KeCancelTimer
|
||
|
|
PsReturnSharedPoolQuota
|
||
|
|
PsReturnPoolQuota
|
||
|
|
MiRemoveVad
|
||
|
|
KeInsertQueueApc
|
||
|
|
MmMapViewInSystemCache
|
||
|
|
KeResetEvent
|
||
|
|
CcSetDirtyPinnedData
|
||
|
|
CcPreparePinWrite
|
||
|
|
FsRtlFastUnlockSingle
|
||
|
|
MmUnlockPages
|
||
|
|
ExDeleteResourceLite
|
||
|
|
MmSetAddressRangeModified
|
||
|
|
FsRtlPrivateCancelFileLockIrp
|
||
|
|
FsRtlFastCheckLockForRead
|
||
|
|
FsRtlCheckLockForReadAccess
|
||
|
|
MiUnlockPagedAddress
|
||
|
|
MmUnmapViewInSystemCache
|
||
|
|
CcUnmapVacb
|
||
|
|
IoAcquireCancelSpinLock
|
||
|
|
CcPinFileData
|
||
|
|
CcPinRead
|
||
|
|
FsRtlPrivateLock
|
||
|
|
CcUninitializeCacheMap
|
||
|
|
MmFlushSection
|
||
|
|
IoStartPacket
|
||
|
|
ExpAcquireResourceExclusiveLite
|
||
|
|
MmCheckCachedPageState
|
||
|
|
MiFlushSectionInternal
|
||
|
|
KiDeliverApc
|
||
|
|
KiApcInterrupt
|
||
|
|
ZwQueryInformationFile
|
||
|
|
ZwQueryDirectoryFile
|
||
|
|
ZwPulseEvent
|
||
|
|
ZwProtectVirtualMemory
|
||
|
|
ZwOpenThreadToken
|
||
|
|
ZwOpenThread
|
||
|
|
ZwOpenSymbolicLinkObject
|
||
|
|
ZwOpenSection
|
||
|
|
ZwOpenProcessToken
|
||
|
|
ZwOpenProcess
|
||
|
|
ZwOpenKey
|
||
|
|
ZwOpenFile
|
||
|
|
ZwOpenEvent
|
||
|
|
ZwOpenDirectoryObject
|
||
|
|
ZwNotifyChangeKey
|
||
|
|
ZwMapViewOfSection
|
||
|
|
ZwMakeTemporaryObject
|
||
|
|
ZwLoadDriver
|
||
|
|
ZwListenPort
|
||
|
|
ZwInitializeRegistry
|
||
|
|
ZwFsControlFile
|
||
|
|
ZwFreeVirtualMemory
|
||
|
|
ZwFlushKey
|
||
|
|
ZwFlushInstructionCache
|
||
|
|
CcSetDirtyInMask
|
||
|
|
MiGetInPageSupportBlock
|
||
|
|
KeSetEventBoostPriority
|
||
|
|
CcScheduleReadAhead
|
||
|
|
CcFreeWorkQueueEntry
|
||
|
|
KeSetTimer
|
||
|
|
CcScheduleLazyWriteScan
|
||
|
|
CcInitializeCacheMap
|
||
|
|
MiFreePoolPages
|
||
|
|
MiMakeSystemAddressValidPfn
|
||
|
|
CcFlushCache
|
||
|
|
CcWriteBehind
|
||
|
|
CcLazyWriteScan
|
||
|
|
MmAccessFault
|
||
|
|
KiVirtualMemoryDispatch
|
||
|
|
CcSetFileSizes
|
||
|
|
CcGetDirtyPages
|
||
|
|
CcMdlWriteComplete
|
||
|
|
MiCheckForControlAreaDeletion
|
||
|
|
ZwFlushBuffersFile
|
||
|
|
ZwEnumerateValueKey
|
||
|
|
ZwEnumerateKey
|
||
|
|
ZwDuplicateToken
|
||
|
|
ZwDuplicateObject
|
||
|
|
ZwDisplayString
|
||
|
|
ZwDeviceIoControlFile
|
||
|
|
ZwDeleteValueKey
|
||
|
|
ZwDeleteKey
|
||
|
|
ZwDeleteFile
|
||
|
|
ZwCreateTimer
|
||
|
|
ZwCreateThread
|
||
|
|
ZwCreateSymbolicLinkObject
|
||
|
|
ZwCreateSection
|
||
|
|
ZwCreateProcess
|
||
|
|
ZwCreatePort
|
||
|
|
ZwCreateKey
|
||
|
|
ZwCreateFile
|
||
|
|
ZwCreateEvent
|
||
|
|
ZwCreateDirectoryObject
|
||
|
|
ZwContinue
|
||
|
|
ZwConnectPort
|
||
|
|
ZwCompleteConnectPort
|
||
|
|
ZwCloseObjectAuditAlarm
|
||
|
|
ZwClose
|
||
|
|
CcAcquireByteRangeForWrite
|
||
|
|
MiGetEventCounter
|
||
|
|
MiAccessCheck
|
||
|
|
CcAllocateWorkQueueEntry
|
||
|
|
RtlPcToFileHeader
|
||
|
|
KePulseEvent
|
||
|
|
MiWaitForInPageComplete
|
||
|
|
MiAllocatePoolPages
|
||
|
|
MiEnsureAvailablePageOrWait
|
||
|
|
MiFlushInPageSupportBlock
|
||
|
|
KeWaitForMultipleObjects
|
||
|
|
FsRtlPrivateFastUnlockAll
|
||
|
|
FsRtlFastUnlockAll
|
||
|
|
KeReleaseSemaphore
|
||
|
|
MiChargeCommitmentCantExpand
|
||
|
|
CcGetVacbMiss
|
||
|
|
MmPurgeSection
|
||
|
|
CcUnmapAndPurge
|
||
|
|
FsRtlFastCheckLockForWrite
|
||
|
|
FsRtlCheckLockForWriteAccess
|
||
|
|
CcUnmapVacbArray
|
||
|
|
FsRtlAllocateFirstMapping
|
||
|
|
KeTestAlertThread
|
||
|
|
MmFlushImageSection
|
||
|
|
CcPerformReadAhead
|
||
|
|
MiSegmentDelete
|
||
|
|
ZwClearEvent
|
||
|
|
ZwAllocateVirtualMemory
|
||
|
|
ZwAlertThread
|
||
|
|
ZwAcceptConnectPort
|
||
|
|
KeReadStateSemaphore
|
||
|
|
KeReadStateQueue
|
||
|
|
KeReadStateEvent
|
||
|
|
KeSetDmaIoCoherency
|
||
|
|
KiAcquireSpinLock
|
||
|
|
KeFlushCurrentTb
|
||
|
|
KiSystemStartup
|
||
|
|
KdpGetStateChange
|
||
|
|
KdpSetLoadState
|
||
|
|
KdpPortUnlock
|
||
|
|
IoSetDeviceToVerify
|
||
|
|
IoGetFileObjectGenericMapping
|
||
|
|
xHalHandlerForBus
|
||
|
|
ExPostSystemEvent
|
||
|
|
ExNotifyCallback
|
||
|
|
ExUnregisterCallback
|
||
|
|
ExRegisterCallback
|
||
|
|
ExGetSharedWaiterCount
|
||
|
|
ExGetExclusiveWaiterCount
|
||
|
|
KeReadStateThread
|
||
|
|
ZwAccessCheckAndAuditAlarm
|
||
|
|
KeSetImportanceDpc
|
||
|
|
KeInitializeSpinLock
|
||
|
|
KeClearEvent
|
||
|
|
ZwQueryVirtualMemory
|
||
|
|
KiPassiveRelease
|
||
|
|
KeQueryTimeIncrement
|
||
|
|
FsRtlSyncVolumes
|
||
|
|
FsRtlInitializeOplock
|
||
|
|
IoGetConfigurationInformation
|
||
|
|
RtlSubAuthorityCountSid
|
||
|
|
RtlGetNtGlobalFlags
|
||
|
|
ObGetObjectPointerCount
|
||
|
|
SepRmSendCommandToLsaWrkr
|
||
|
|
ExSetHandleTableOwner
|
||
|
|
ExSetHandleTableOrdering
|
||
|
|
SeTraverseAuditAlarm
|
||
|
|
srand
|
||
|
|
NtSetLdtEntries
|
||
|
|
ExpAcquireSharedStarveExclusive
|
||
|
|
FsRtlFreeFastMutex
|
||
|
|
MiSectionDelete
|
||
|
|
MmCreateSection
|
||
|
|
ExInterlockedExtendZone
|
||
|
|
CcDeleteSharedCacheMap
|
||
|
|
KeFlushEntireTb
|
||
|
|
KeAttachProcess
|
||
|
|
ExpWaitForResource
|
||
|
|
KeReleaseWaitForSemaphore
|
||
|
|
MiMapPageInHyperSpace
|
||
|
|
MiProcessValidPteList
|
||
|
|
MmCopyToCachedPage
|
||
|
|
NtSetTimer
|
||
|
|
FsRtlAllocateFastMutex
|
||
|
|
MiCleanSection
|
||
|
|
MiDeleteVirtualAddresses
|
||
|
|
CcGetLsnForFileObject
|
||
|
|
MiDereferenceSegmentThread
|
||
|
|
KiOutSwapKernelStacks
|
||
|
|
KeDetachProcess
|
||
|
|
KeAlertResumeThread
|
||
|
|
FsRtlFreeFirstMapping
|
||
|
|
MiResolveDemandZeroFault
|
||
|
|
MiRemoveMappedView
|
||
|
|
KeStartProfile
|
||
|
|
MmCanFileBeTruncatedInternal
|
||
|
|
PspQueryDescriptorThread
|
||
|
|
PspSetLdtInformation
|
||
|
|
PspSetLdtSize
|
||
|
|
PspQueryLdtInformation
|
||
|
|
PspMarkCidInvalid
|
||
|
|
DebugUnLoadImageSymbols
|
||
|
|
DebugLoadImageSymbols
|
||
|
|
KiTryToAcquireSpinLock
|
||
|
|
KiFlushFixedTb
|
||
|
|
IoSetHardErrorOrVerifyDevice
|
||
|
|
IoGetTopLevelIrp
|
||
|
|
xHalSuspendHibernateSystem
|
||
|
|
CcGetFileObjectFromBcb
|
||
|
|
PoRequestPowerChange
|
||
|
|
IoSetTopLevelIrp
|
||
|
|
ExpGetPoolInformation
|
||
|
|
ExCreateCallback
|
||
|
|
xHalQuerySystemInformation
|
||
|
|
xHalSetSystemInformation
|
||
|
|
xHalQueryBusSlots
|
||
|
|
RtlLengthRequiredSid
|
||
|
|
RtlCompressWorkSpaceSizeNS
|
||
|
|
RtlCompressBufferNS
|
||
|
|
RtlDecompressBufferNS
|
||
|
|
RtlDecompressFragmentNS
|
||
|
|
NtEnumerateBus
|
||
|
|
NtGetPlugPlayEvent
|
||
|
|
NtPlugPlayControl
|
||
|
|
NtRegisterNewDevice
|
||
|
|
CmpSetGlobalQuotaAllowed
|
||
|
|
NtSetSystemPowerState
|
||
|
|
xHalRegisterBusHandler
|
||
|
|
KiGetUserModeStackAddress
|
||
|
|
KiInterruptTemplate
|
||
|
|
FsRtlInitProcessorLockQueue
|
||
|
|
RtlAreAllAccessesGranted
|
||
|
|
CmSetRegistryQuotaInformation
|
||
|
|
CmpCompressedNameSize
|
||
|
|
_flswbuf
|
||
|
|
_flsbuf
|
||
|
|
RtlConvertLongToLargeInteger
|
||
|
|
MmCreateKernelStack
|
||
|
|
MiCheckControlAreaStatus
|
||
|
|
KeConnectInterrupt
|
||
|
|
KiScanReadyQueues
|
||
|
|
MiRemoveUnusedSegments
|
||
|
|
KiContinueClientWait
|
||
|
|
KeInitializeThread
|
||
|
|
FsRtlUninitializeFileLock
|
||
|
|
KeSwapProcessOrStack
|
||
|
|
IopTimerDispatch
|
||
|
|
MmUnlockCachedPage
|
||
|
|
KiInSwapKernelStacks
|
||
|
|
MiDoesPdeExistAndMakeValid
|
||
|
|
MmAllowWorkingSetExpansion
|
||
|
|
KeSetPriorityThread
|
||
|
|
KiReleaseSpinLock
|
||
|
|
DebugPrint
|
||
|
|
MmGetCrashDumpStateInformation
|
||
|
|
KeSetCacheErrorRoutine
|
||
|
|
CcSetLogHandleForFile
|
||
|
|
PfxInitialize
|
||
|
|
RtlCopyLuid
|
||
|
|
PspSetProcessIoHandlers
|
||
|
|
RtlInitializeUnicodePrefix
|
||
|
|
_fptrap
|
||
|
|
atoi
|
||
|
|
_stricmp
|
||
|
|
ObDereferenceObject
|
||
|
|
RtlRaiseStatus
|
||
|
|
RtlRaiseException
|
||
|
|
RtlEnlargedUnsignedMultiply
|
||
|
|
RtlEnlargedIntegerMultiply
|
||
|
|
DebugPrompt
|
||
|
|
MiRemoveBasedSection
|
||
|
|
MiInsertBasedSection
|
||
|
|
MmFreeContiguousMemory
|
||
|
|
IoCallDriver
|
||
|
|
IoReleaseVpbSpinLock
|
||
|
|
FsRtlPostPagingFileStackOverflow
|
||
|
|
FsRtlPostStackOverflow
|
||
|
|
FsRtlNumberOfRunsInMcb
|
||
|
|
ExRaiseStatus
|
||
|
|
ExRaiseException
|
||
|
|
IoDeleteController
|
||
|
|
IopUserRundown
|
||
|
|
LdrAccessResource
|
||
|
|
SeFreePrivileges
|
||
|
|
CmQueryRegistryQuotaInformation
|
||
|
|
FsRtlUninitializeMcb
|
||
|
|
CmpLazyFlushDpcRoutine
|
||
|
|
ObDestroyHandleProcedure
|
||
|
|
RtlLargeIntegerNegate
|
||
|
|
MiFindEmptySectionBaseDown
|
||
|
|
KiCopyInformation
|
||
|
|
KiRestoreInterrupts
|
||
|
|
KiDisableInterrupts
|
||
|
|
KiCacheError
|
||
|
|
IoCompleteRequest
|
||
|
|
_purecall
|
||
|
|
ExAllocatePool
|
||
|
|
ExOkayToLockRoutine
|
||
|
|
ExReleaseResourceStub
|
||
|
|
ExRaiseAccessViolation
|
||
|
|
ExRaiseDatatypeMisalignment
|
||
|
|
NtSetIntervalProfile
|
||
|
|
FsRtlCompletionRoutinePriv
|
||
|
|
RtlpDestroyUnCommittedRange
|
||
|
|
PsGetProcessExitTime
|
||
|
|
SeDeassignPrimaryToken
|
||
|
|
ExUnlockUserBuffer
|
||
|
|
ObpValidateDesiredAccess
|
||
|
|
KeReleaseMutex
|
||
|
|
KeSweepDcache
|
||
|
|
IoIsSystemThread
|
||
|
|
IoGetAttachedDevice
|
||
|
|
ExpDeleteMutant
|
||
|
|
ExSystemExceptionFilter
|
||
|
|
KeReturnToFirmware
|
||
|
|
IoQueryVolumeInformation
|
||
|
|
IopDeallocateApc
|
||
|
|
KdpComputeChecksum
|
||
|
|
strchr
|
||
|
|
SepInitializePrivilegeFilter
|
||
|
|
RtlpExecuteEmHandlerForUnwind
|
||
|
|
RtlpExecuteEmHandlerForException
|
||
|
|
RtlLargeIntegerSubtract
|
||
|
|
RtlLargeIntegerAdd
|
||
|
|
MmSizeOfMdl
|
||
|
|
KiSquareRootSingle
|
||
|
|
KeFreezeExecution
|
||
|
|
KeBugCheck
|
||
|
|
KeSetTimeIncrement
|
||
|
|
KeQueryTickCount
|
||
|
|
KdpReboot
|
||
|
|
KdpQueryPerformanceCounter
|
||
|
|
FsRtlFastUnlockAllByKey
|
||
|
|
ExInterlockedIncrementLong
|
||
|
|
ExInterlockedDecrementLong
|
||
|
|
ExpAllocatePoolWithQuotaHandler
|
||
|
|
IoQueryFileInformation
|
||
|
|
IopDeleteDriver
|
||
|
|
NtFlushWriteBuffer
|
||
|
|
LdrFindResource_U
|
||
|
|
RtlpInitUpcaseTable
|
||
|
|
ObMakeTemporaryObject
|
||
|
|
SepRmComponentTestCommandWrkr
|
||
|
|
SepAdtInitializePhase1
|
||
|
|
CmpFree
|
||
|
|
KdpQuickMoveMemory
|
||
|
|
NtSetHighWaitLowThread
|
||
|
|
ObDeassignSecurity
|
||
|
|
DbgUnLoadImageSymbols
|
||
|
|
MmReturnPoolQuota
|
||
|
|
IopFreeDosDevicesProtection
|
||
|
|
ExAcquireResourceStub
|
||
|
|
NtSetLowWaitHighThread
|
||
|
|
ExpTimeZoneWork
|
||
|
|
IopUserCompletion
|
||
|
|
RtlFreeAnsiString
|
||
|
|
RtlpGetTimeZoneInfoHandle
|
||
|
|
RtlNtStatusToDosError
|
||
|
|
RtlAcquirePebLock
|
||
|
|
RtlReleasePebLock
|
||
|
|
PsCreateSystemProcess
|
||
|
|
wcslen
|
||
|
|
LsaFreeReturnBuffer
|
||
|
|
PspDeleteProcessSecurity
|
||
|
|
RtlpGetStackLimits
|
||
|
|
RtlpGetExtraStuffPointer
|
||
|
|
MmIsNonPagedSystemAddressValid
|
||
|
|
KiInterruptHandler
|
||
|
|
IoAcquireVpbSpinLock
|
||
|
|
FsRtlNormalizeNtstatus
|
||
|
|
ExpTimeZoneDpcRoutine
|
||
|
|
ExpTimeRefreshDpcRoutine
|
||
|
|
KiSquareRootDouble
|
||
|
|
KiSuspendThread
|
||
|
|
IopReadyDeviceObjects
|
||
|
|
RtlxUnicodeStringToAnsiSize
|
||
|
|
RtlxUnicodeStringToOemSize
|
||
|
|
RtlxAnsiStringToUnicodeSize
|
||
|
|
RtlxOemStringToUnicodeSize
|
||
|
|
SepIdAssignableAsOwner
|
||
|
|
HvpGetCellFlat
|
||
|
|
KdpCauseBugCheck
|
||
|
|
ObInitProcess2
|
||
|
|
RtlInitializeGenericTable
|
||
|
|
RtlSetAllBits
|
||
|
|
RtlClearAllBits
|
||
|
|
MiDownPfnReferenceCount
|
||
|
|
MiRemoveImageHeaderPage
|
||
|
|
KeProfileInterrupt
|
||
|
|
KeReadyThread
|
||
|
|
KeInitializeMutex
|
||
|
|
KeSweepIcache
|
||
|
|
IopApcHardError
|
||
|
|
FsRtlNotifyUninitializeSync
|
||
|
|
HvGetCellSize
|
||
|
|
wcscpy
|
||
|
|
rand
|
||
|
|
ObpAcquireDescriptorCacheReadLock
|
||
|
|
KiSaveProcessorState
|
||
|
|
IopInvalidDeviceRequest
|
||
|
|
KeInitializeTimer
|
||
|
|
FsRtlCheckForMatchingFileObject
|
||
|
|
MiChangeNoAccessForkPte
|
||
|
|
PspNullSpecialApc
|
||
|
|
ObDupHandleProcedure
|
||
|
|
MiUpForkPageShareCount
|
||
|
|
MiGetFirstNode
|
||
|
|
MmSetMemoryPriorityProcess
|
||
|
|
KiDisplayString
|
||
|
|
IopExceptionFilter
|
||
|
|
FsRtlIsTotalDeviceFailure
|
||
|
|
FsRtlAllocatePoolWithQuotaTag
|
||
|
|
CcCopyReadExceptionFilter
|
||
|
|
RtlAbsoluteToSelfRelativeSD
|
||
|
|
RtlCheckRegistryKey
|
||
|
|
RtlCreateRegistryKey
|
||
|
|
CmpLazyFlushWorker
|
||
|
|
CmpTryLockRegistryExclusive
|
||
|
|
PspUnhandledExceptionInSystemThread
|
||
|
|
RtlCreateUnicodeStringFromAsciiz
|
||
|
|
LpcpClosePort
|
||
|
|
KeDisableApcQueuingThread
|
||
|
|
KdpPageInData
|
||
|
|
FsRtlAllocatePoolWithQuota
|
||
|
|
PspDeleteThreadSecurity
|
||
|
|
IopAbortRequest
|
||
|
|
ChkSum
|
||
|
|
SeReleaseSid
|
||
|
|
SeReleaseAcl
|
||
|
|
SeReleaseLuidAndAttributesArray
|
||
|
|
SeReleaseSidAndAttributesArray
|
||
|
|
CmpFileSetSize
|
||
|
|
CmpDestroyTemporaryHive
|
||
|
|
strcmp
|
||
|
|
_strupr
|
||
|
|
_strlwr
|
||
|
|
RtlpUnwindHandler
|
||
|
|
RtlFindSetBitsAndClear
|
||
|
|
MiDeleteFreeVm
|
||
|
|
MiTakePageFromWorkingSet
|
||
|
|
IopChecksum
|
||
|
|
IopErrorLogDpc
|
||
|
|
KeEnableApcQueuingThread
|
||
|
|
FsRtlpSetSymbolicLink
|
||
|
|
FsRtlNotifyReportChange
|
||
|
|
MiGetImageProtection
|
||
|
|
SepRmCreateLogonSessionWrkr
|
||
|
|
SepRmDeleteLogonSessionWrkr
|
||
|
|
SepAdtValidateAuditBounds
|
||
|
|
CmShutdownSystem
|
||
|
|
CmpQuotaWarningWorker
|
||
|
|
KdpSendControlPacket
|
||
|
|
ObpReferenceSecurityDescriptor
|
||
|
|
iswctype
|
||
|
|
RtlInitAnsiString
|
||
|
|
RtlInitString
|
||
|
|
KeSetAutoAlignmentThread
|
||
|
|
KeSetAutoAlignmentProcess
|
||
|
|
KeBusError
|
||
|
|
KeInitializeDeviceQueue
|
||
|
|
KdpWriteControlSpace
|
||
|
|
FsRtlIsNtstatusExpected
|
||
|
|
MiUnloadSystemImageByForce
|
||
|
|
RtlInitNlsTables
|
||
|
|
CmpRefreshWorkerRoutine
|
||
|
|
fputwc
|
||
|
|
wcschr
|
||
|
|
memchr
|
||
|
|
ObAuditInheritedHandleProcedure
|
||
|
|
RtlLargeIntegerShiftRight
|
||
|
|
RtlLargeIntegerShiftLeft
|
||
|
|
DbgPrint
|
||
|
|
MiUpControlAreaRefs
|
||
|
|
MiRemovePageFromWslNoPfn
|
||
|
|
MiMapCacheExceptionFilter
|
||
|
|
KiInterruptDispatchRaise
|
||
|
|
KiTrapDispatch
|
||
|
|
KiIntegerOverflowDispatch
|
||
|
|
KiInstructionBusErrorDispatch
|
||
|
|
KiIllegalInstructionDispatch
|
||
|
|
KiDataBusErrorDispatch
|
||
|
|
KiCoprocessorUnusableDispatch
|
||
|
|
FsRtlStackOverflowRead
|
||
|
|
KeLowerIrql
|
||
|
|
MiDispatchFault
|
||
|
|
MiDecrementShareCount2
|
||
|
|
MiRestoreTransitionPte
|
||
|
|
MiRemovePageFromList
|
||
|
|
MiRemoveZeroPage
|
||
|
|
MiCheckControlArea
|
||
|
|
MiResolveTransitionFault
|
||
|
|
IoReleaseCancelSpinLock
|
||
|
|
MmZeroPageThread
|
||
|
|
MmCanFileBeTruncated
|
||
|
|
ExUnlockPool
|
||
|
|
KiInterruptDispatchSame
|
||
|
|
ExInterlockedRemoveHeadList
|
||
|
|
ExInterlockedInsertHeadList
|
||
|
|
CcGetFileObjectFromSectionPtrs
|
||
|
|
CmpFreePostBlock
|
||
|
|
CmpSearchOpenWorker
|
||
|
|
CmpReleaseGlobalQuota
|
||
|
|
MiGetExceptionInfo
|
||
|
|
NtOpenFile
|
||
|
|
CmpCreateTemporaryHive
|
||
|
|
mblen
|
||
|
|
isprint
|
||
|
|
isspace
|
||
|
|
isxdigit
|
||
|
|
isdigit
|
||
|
|
islower
|
||
|
|
isupper
|
||
|
|
_itoa
|
||
|
|
RtlAddressInSectionTable
|
||
|
|
MiDownShareCountFlushEntireTb
|
||
|
|
MiUpCloneProtoRefCount
|
||
|
|
KiComputeWaitInterval
|
||
|
|
KiBugCheckDispatch
|
||
|
|
KiBreakpointDispatch
|
||
|
|
KdpStub
|
||
|
|
IopErrorLogRequeueEntry
|
||
|
|
ExLockPool
|
||
|
|
NtDeviceIoControlFile
|
||
|
|
KeAddSystemServiceTable
|
||
|
|
NtReadRequestData
|
||
|
|
NtWriteRequestData
|
||
|
|
RtlpDestroyHeapSegment
|
||
|
|
RtlCompressWorkSpaceSizeLZNT1
|
||
|
|
NtVdmControl
|
||
|
|
CmpFindKeyControlBlock
|
||
|
|
SeImpersonateClient
|
||
|
|
PspInitializeProcessSecurity
|
||
|
|
KiSelectNextThread
|
||
|
|
KeThawExecution
|
||
|
|
KdpSwitchProcessor
|
||
|
|
IoStopTimer
|
||
|
|
ExpTimerDpcRoutine
|
||
|
|
ExDeleteResource
|
||
|
|
RtlMoveMemory
|
||
|
|
CcFastCopyRead
|
||
|
|
IopCompleteRequest
|
||
|
|
ExpFindCurrentThread
|
||
|
|
CcFastCopyWrite
|
||
|
|
CcMapAndCopy
|
||
|
|
RtlCopyUnicodeString
|
||
|
|
CcCopyRead
|
||
|
|
CcCopyWrite
|
||
|
|
RtlInsertElementGenericTable
|
||
|
|
FsRtlTruncateLargeMcb
|
||
|
|
FsRtlTruncateMcb
|
||
|
|
KeContextToKframes
|
||
|
|
RtlAppendStringToString
|
||
|
|
FsRtlAddLargeEntry
|
||
|
|
KeContextFromKframes
|
||
|
|
RtlpVirtualUnwind
|
||
|
|
ObpCompareSecurityDescriptors
|
||
|
|
IoEnqueueIrp
|
||
|
|
SeQuerySecurityAccessMask
|
||
|
|
CmpFileFlush
|
||
|
|
DbgkUnMapViewOfSection
|
||
|
|
KdpSendString
|
||
|
|
wctomb
|
||
|
|
wcscat
|
||
|
|
PspInheritQuota
|
||
|
|
ObEnumNewHandleProcedure
|
||
|
|
ObpSetHandleBit
|
||
|
|
MiUpPfnReferenceCount
|
||
|
|
CacheImageSymbols
|
||
|
|
KiSaveProcessorControlState
|
||
|
|
KeInitializeQueue
|
||
|
|
KeBugCheckUnicodeToAnsi
|
||
|
|
IoFreeController
|
||
|
|
IopRemoveTimerFromTimerList
|
||
|
|
FsRtlNotifySetCancelRoutine
|
||
|
|
CcSetDirtyPageThreshold
|
||
|
|
FsRtlNotifyChangeDirectory
|
||
|
|
RtlDeleteRegistryValue
|
||
|
|
PsCreateSystemThread
|
||
|
|
NtDeleteKey
|
||
|
|
CmpLazyFlush
|
||
|
|
NtWaitForProcessMutant
|
||
|
|
DbgLoadImageSymbols
|
||
|
|
MiRemoveWsleFromFreeList
|
||
|
|
MiGetSystemCacheSubsection
|
||
|
|
KiIpiGenericCall
|
||
|
|
KiTbMiss
|
||
|
|
IopGetMountFlag
|
||
|
|
FsRtlNotifyInitializeSync
|
||
|
|
IopGetModeInformation
|
||
|
|
MmPageEntireDriver
|
||
|
|
RtlValidAcl
|
||
|
|
RtlIntegerToUnicodeString
|
||
|
|
NtMakeTemporaryObject
|
||
|
|
SepSinglePrivilegeCheck
|
||
|
|
CmpDoFileSetSize
|
||
|
|
DbgkpResumeProcess
|
||
|
|
MiCaptureSystemPte
|
||
|
|
KeRemoveEntryDeviceQueue
|
||
|
|
KeTryToAttachProcess
|
||
|
|
KiFloatDispatch
|
||
|
|
IopErrorLogGetEntry
|
||
|
|
IopSetAttachedDevicePointer
|
||
|
|
IoRegisterDriverReinitialization
|
||
|
|
IopAllocateIrpCleanup
|
||
|
|
LpcpPrepareToWakeClient
|
||
|
|
PsEstablishWin32Callouts
|
||
|
|
NtAlertThread
|
||
|
|
RawInitializeVcb
|
||
|
|
SeAssignPrimaryToken
|
||
|
|
CmpDestroyHive
|
||
|
|
CmpNameSize
|
||
|
|
CmFlushKey
|
||
|
|
KdpRestoreBreakpoint
|
||
|
|
wcscmp
|
||
|
|
tolower
|
||
|
|
PsOpenTokenOfProcess
|
||
|
|
MiCheckPageFileMapping
|
||
|
|
MiUpdateImageHeaderPage
|
||
|
|
KiGetPhysicalAddress
|
||
|
|
KeRemoveQueueDpc
|
||
|
|
IopAllocateIrpMustSucceed
|
||
|
|
IopDecrementDeviceObjectRef
|
||
|
|
ExpProfileDelete
|
||
|
|
PsSetProcessPriorityByClass
|
||
|
|
RawQueryFsVolumeInfo
|
||
|
|
SeSetSecurityAccessMask
|
||
|
|
SepAppendDefaultDacl
|
||
|
|
CmpDoFlushAll
|
||
|
|
KdpWriteBreakpoint
|
||
|
|
wcscspn
|
||
|
|
MmDbgReadCheck
|
||
|
|
KeQueryIntervalProfile
|
||
|
|
KeInitializeMutant
|
||
|
|
KeDeregisterBugCheckCallback
|
||
|
|
IoStartTimer
|
||
|
|
IoDetachDevice
|
||
|
|
FsRtlRemoveLargeEntry
|
||
|
|
NtSetHighEventPair
|
||
|
|
IoRegisterShutdownNotification
|
||
|
|
RtlZeroMemory
|
||
|
|
ExInterlockedAddUlong
|
||
|
|
IopCheckVpbMounted
|
||
|
|
KeReleaseSpinLock
|
||
|
|
ObfDereferenceObject
|
||
|
|
FsRtlRemoveAndCompleteIrp
|
||
|
|
FsRtlOplockCleanup
|
||
|
|
FsRtlOplockBreakToII
|
||
|
|
PsRestoreImpersonation
|
||
|
|
ObpFreeObjectCreateInfo
|
||
|
|
ObpAllocateCreateInfoFromLookaside
|
||
|
|
MmGetCrashDumpInformation
|
||
|
|
RtlGetCompressionWorkSpaceSize
|
||
|
|
SePrivilegeObjectAuditAlarm
|
||
|
|
SepFreePrimaryGroup
|
||
|
|
CmpConfigureProcessors
|
||
|
|
CmpCloseKeyObject
|
||
|
|
CmpAllocate
|
||
|
|
CmpAllocateTag
|
||
|
|
SePrivilegeCheck
|
||
|
|
NtSetLowEventPair
|
||
|
|
strncmp
|
||
|
|
RtlSecondsSince1980ToTime
|
||
|
|
RtlEnlargedUnsignedDivide
|
||
|
|
MiInsertFrontModifiedNoWrite
|
||
|
|
MiIsPteDecommittedPage
|
||
|
|
KeQueryBasePriorityThread
|
||
|
|
KeFillFixedEntryTb
|
||
|
|
FsRtlGetNextMcbEntry
|
||
|
|
FsRtlRemoveMcbEntry
|
||
|
|
wcsncmp
|
||
|
|
RtlSetGroupSecurityDescriptor
|
||
|
|
HvpFillFileName
|
||
|
|
ExCreateHandleTable
|
||
|
|
NtReleaseProcessMutant
|
||
|
|
MiObtainFreePages
|
||
|
|
KeInitializeProfile
|
||
|
|
KiInstructionBusError
|
||
|
|
KdpPollBreakInWithPortLock
|
||
|
|
PspSystemThreadStartup
|
||
|
|
KiIdleLoop
|
||
|
|
IoCreateSymbolicLink
|
||
|
|
IoDeleteSymbolicLink
|
||
|
|
IoDisconnectInterrupt
|
||
|
|
NtListenPort
|
||
|
|
RtlSetOwnerSecurityDescriptor
|
||
|
|
RtlUpperString
|
||
|
|
PspThreadDelete
|
||
|
|
SeCopyClientToken
|
||
|
|
SeQueryAuthenticationIdToken
|
||
|
|
SepFreeDefaultDacl
|
||
|
|
HvpHeaderCheckSum
|
||
|
|
KdpReceiveString
|
||
|
|
CmpGetObjectSecurity
|
||
|
|
vsprintf
|
||
|
|
toupper
|
||
|
|
_strcmpi
|
||
|
|
RtlpRaiseException
|
||
|
|
MiWaitForForkToComplete
|
||
|
|
IopStartApcHardError
|
||
|
|
FsRtlPrivateInsertLockFind
|
||
|
|
LpcpFreePortClientSecurity
|
||
|
|
RtlMultiByteToUnicodeSize
|
||
|
|
ObGetHandleInformation
|
||
|
|
ObpInitSecurityDescriptorCache
|
||
|
|
RawQueryFsAttributeInfo
|
||
|
|
SepAppendPrimaryGroup
|
||
|
|
NtInitializeRegistry
|
||
|
|
CmpRemoveSecurityCellList
|
||
|
|
wcsrchr
|
||
|
|
RtlExtendedLargeIntegerDivide
|
||
|
|
KiFloatingDispatch
|
||
|
|
KeForceResumeThread
|
||
|
|
IopDeleteIoCompletion
|
||
|
|
IoInitializeIrp
|
||
|
|
IoAllocateController
|
||
|
|
NtWaitLowEventPair
|
||
|
|
NtWaitHighEventPair
|
||
|
|
NtSetLowWaitHighEventPair
|
||
|
|
NtSetHighWaitLowEventPair
|
||
|
|
IopOpenRegistryKey
|
||
|
|
KeInitializeProcess
|
||
|
|
LpcpInitializePortQueue
|
||
|
|
MiCrashDumpWorker
|
||
|
|
RtlCreateUnicodeString
|
||
|
|
RtlRandom
|
||
|
|
RawCleanup
|
||
|
|
SepQueryTypeString
|
||
|
|
NtQuerySystemTime
|
||
|
|
RtlSectionTableFromVirtualAddress
|
||
|
|
MiUnmapImageHeaderInHyperSpace
|
||
|
|
MmForceSectionClosed
|
||
|
|
KeSetIntervalProfile
|
||
|
|
KeFlushQueueApc
|
||
|
|
IopErrorLogQueueRequest
|
||
|
|
RtlUnicodeToMultiByteSize
|
||
|
|
RtlAnsiCharToUnicodeChar
|
||
|
|
RtlDecompressBuffer
|
||
|
|
ObKillProcess
|
||
|
|
SepQueryNameString
|
||
|
|
SepDequeueWorkItem
|
||
|
|
HvpGetCellMap
|
||
|
|
CmpFreeValue
|
||
|
|
KdpWriteVirtualMemory
|
||
|
|
KdpPageIn
|
||
|
|
_vsnprintf
|
||
|
|
RawCheckForDismount
|
||
|
|
RtlAppendAsciizToString
|
||
|
|
MmUnmapViewInSystemSpace
|
||
|
|
ExAcquireResourceExclusiveLite
|
||
|
|
FsRtlCopyWrite
|
||
|
|
FsRtlPrepareMdlWrite
|
||
|
|
ObpAcquireDescriptorCacheWriteLock
|
||
|
|
ObCheckObjectAccess
|
||
|
|
KiInterruptDistribution
|
||
|
|
ExIsResourceAcquiredSharedLite
|
||
|
|
RawQueryFsDeviceInfo
|
||
|
|
CmpCopyTree
|
||
|
|
MmDeleteTeb
|
||
|
|
_mbstrlen
|
||
|
|
_snprintf
|
||
|
|
KiProcessProfileList
|
||
|
|
IoBuildSynchronousFsdRequest
|
||
|
|
IoWriteErrorLogEntry
|
||
|
|
NtUnmapViewOfSection
|
||
|
|
RtlCompressBuffer
|
||
|
|
SepAssemblePrivileges
|
||
|
|
CmpValidateAlternate
|
||
|
|
NtQueryDefaultLocale
|
||
|
|
wcsstr
|
||
|
|
sprintf
|
||
|
|
_strnicmp
|
||
|
|
LsaCallAuthenticationPackage
|
||
|
|
PsSetCreateProcessNotifyRoutine
|
||
|
|
MmDisableModifiedWriteOfSection
|
||
|
|
MiGetPageForHeader
|
||
|
|
FsRtlWorkerThread
|
||
|
|
KeResumeThread
|
||
|
|
FsRtlCheckNotifyForDelete
|
||
|
|
CmpAllocatePoolWithQuota
|
||
|
|
CmpFlushNotify
|
||
|
|
CmpFreeKeyBody
|
||
|
|
CmpCheckCreateAccess
|
||
|
|
DbgkExitProcess
|
||
|
|
ExpGetHandleInformation
|
||
|
|
PspSetEventPair
|
||
|
|
RtlTimeToSecondsSince1980
|
||
|
|
KeRundownQueue
|
||
|
|
KiAddressErrorDispatch
|
||
|
|
LpcExitThread
|
||
|
|
RtlDecompressFragment
|
||
|
|
PspMapSystemDll
|
||
|
|
SepConcatenatePrivileges
|
||
|
|
CmpFreeSecurityDescriptor
|
||
|
|
CmpRemoveFromHiveFileList
|
||
|
|
HvAllocateCell
|
||
|
|
DbgkpSendApiMessage
|
||
|
|
ExpGetObjectInformation
|
||
|
|
KdEnterDebugger
|
||
|
|
KdExitDebugger
|
||
|
|
SeCheckAuditPrivilege
|
||
|
|
PspDereferenceQuota
|
||
|
|
ObValidateSecurityQuota
|
||
|
|
KiPcToFileHeader
|
||
|
|
IopRaiseInformationalHardError
|
||
|
|
ExExtendZone
|
||
|
|
RtlSetSaclSecurityDescriptor
|
||
|
|
RtlWriteRegistryValue
|
||
|
|
SepValidateAce
|
||
|
|
SeExchangePrimaryToken
|
||
|
|
SepInformLsaOfDeletedLogon
|
||
|
|
DbgkMapViewOfSection
|
||
|
|
RtlSetDaclSecurityDescriptor
|
||
|
|
PspAssignPrimaryToken
|
||
|
|
MmIsSystemAddressAccessable
|
||
|
|
MiMakePdeExistAndMakeValid
|
||
|
|
KeBoostPriorityThread
|
||
|
|
KeRemoveQueueApc
|
||
|
|
IoAttachDeviceByPointer
|
||
|
|
CcSetAdditionalCacheAttributes
|
||
|
|
ExConvertExclusiveToSharedLite
|
||
|
|
ExpCopyThreadInfo
|
||
|
|
LdrVerifyMappedImageMatchesChecksum
|
||
|
|
HvpDiscardBins
|
||
|
|
CmpCopyCompressedName
|
||
|
|
KdpDeleteBreakpoint
|
||
|
|
wcsncpy
|
||
|
|
LsaDeregisterLogonProcess
|
||
|
|
MmDbgWriteCheck
|
||
|
|
NtContinue
|
||
|
|
FsRtlpPostStackOverflow
|
||
|
|
CcIsThereDirtyData
|
||
|
|
ExpGetLockInformation
|
||
|
|
NtAllocateLocallyUniqueId
|
||
|
|
IoUnregisterFileSystem
|
||
|
|
CmpWorkerCommand
|
||
|
|
CmpCheckNotifyAccess
|
||
|
|
CmCheckRegistry
|
||
|
|
CmpCopyCell
|
||
|
|
KdpPrintString
|
||
|
|
SePrivilegedServiceAuditAlarm
|
||
|
|
strstr
|
||
|
|
ObSetSecurityDescriptorInfo
|
||
|
|
KeSetProcess
|
||
|
|
KdIsThisAKdTrap
|
||
|
|
NtSetDefaultHardErrorPort
|
||
|
|
NtQueryIntervalProfile
|
||
|
|
FsRtlpOpenDev
|
||
|
|
CmpClaimGlobalQuota
|
||
|
|
HvpGrowLog1
|
||
|
|
RawQueryInformation
|
||
|
|
mbtowc
|
||
|
|
strncpy
|
||
|
|
KeAcquireSpinLock
|
||
|
|
ExInterlockedPopEntryList
|
||
|
|
IoMakeAssociatedIrp
|
||
|
|
__ll_mul
|
||
|
|
KeInsertQueueDpc
|
||
|
|
ExReleaseResourceLite
|
||
|
|
ObReferenceObjectByHandle
|
||
|
|
PsOpenTokenOfThread
|
||
|
|
FsRtlCopyRead
|
||
|
|
FsRtlMdlRead
|
||
|
|
NtClose
|
||
|
|
NtWaitForMultipleObjects
|
||
|
|
PsLookupProcessThreadByCid
|
||
|
|
ObpReleaseDescriptorCacheLock
|
||
|
|
KiSaveVolatileFloatState
|
||
|
|
RtlCompareMemoryUlong
|
||
|
|
MiDoneWithThisPageGetAnother
|
||
|
|
MiInitializeSystemSpaceMap
|
||
|
|
KiThreadDispatch
|
||
|
|
KeSwitchKernelStack
|
||
|
|
IoCreateSynchronizationEvent
|
||
|
|
CmpCreatePredefined
|
||
|
|
KdpGetVersion
|
||
|
|
ObpCaptureHandleInformation
|
||
|
|
RtlEnumerateGenericTable
|
||
|
|
RtlCopyString
|
||
|
|
KeAlertThread
|
||
|
|
KeEnterKernelDebugger
|
||
|
|
IopCompletePageWrite
|
||
|
|
ExReleaseResourceForThread
|
||
|
|
CcWaitOnActiveCount
|
||
|
|
MiMakeSystemAddressValid
|
||
|
|
KeSuspendThread
|
||
|
|
FsRtlBalanceReads
|
||
|
|
IoInitializeTimer
|
||
|
|
IopErrorLogConnectPort
|
||
|
|
LpcpFreeConMsg
|
||
|
|
RawSetInformation
|
||
|
|
SeSinglePrivilegeCheck
|
||
|
|
CmpPostApc
|
||
|
|
HvpGrowLog2
|
||
|
|
strcpy
|
||
|
|
RawCompletionRoutine
|
||
|
|
ObpProcessRemoveObjectQueue
|
||
|
|
MmCreateMdl
|
||
|
|
KeThawAllThreads
|
||
|
|
KeRegisterBugCheckCallback
|
||
|
|
IopLoadFileSystemDriver
|
||
|
|
RtlComputeLfnChecksum
|
||
|
|
RawClose
|
||
|
|
SepFilterPrivilegeAudits
|
||
|
|
NtSaveKey
|
||
|
|
CmpPostApcRunDown
|
||
|
|
LsaLookupAuthenticationPackage
|
||
|
|
KiProbeEntryTb
|
||
|
|
ExpUuidSaveSequenceNumber
|
||
|
|
IoRegisterFsRegistrationChange
|
||
|
|
IoUnregisterFsRegistrationChange
|
||
|
|
MiLookupDataTableEntry
|
||
|
|
LZNT1FindMatchMaximum
|
||
|
|
VdmIsLegalFatName
|
||
|
|
KdpReadVirtualMemory
|
||
|
|
KdpSetContext
|
||
|
|
KdpReportExceptionStateChange
|
||
|
|
HvpAllocateMap
|
||
|
|
MiHandleBankedSection
|
||
|
|
KiInvalidCompareSingle
|
||
|
|
KiInvalidCompareDouble
|
||
|
|
FsRtlNotifyCompleteIrpList
|
||
|
|
FsRtlReleaseFile
|
||
|
|
ExpRaiseException
|
||
|
|
IoCreateUnprotectedSymbolicLink
|
||
|
|
IopGetRegistryValues
|
||
|
|
ExAcquireResourceSharedLite
|
||
|
|
KiDispatchInterrupt
|
||
|
|
IoGetDeviceToVerify
|
||
|
|
KiRetireDpcList
|
||
|
|
IoGetInitialStack
|
||
|
|
KiInsertQueue
|
||
|
|
ComputeNameLength
|
||
|
|
RtlGetAce
|
||
|
|
SeCheckPrivilegedObject
|
||
|
|
SepRmSetAuditEventWrkr
|
||
|
|
SepAdtCopyToLsaSharedMemory
|
||
|
|
NtFlushKey
|
||
|
|
CmSetLastWriteTimeKey
|
||
|
|
KdpMoveMemory
|
||
|
|
KdpDeleteBreakpointRange
|
||
|
|
swprintf
|
||
|
|
_snwprintf
|
||
|
|
RtlAppendUnicodeToString
|
||
|
|
MmAllocateContiguousMemory
|
||
|
|
FsRtlAcquireFileExclusive
|
||
|
|
RtlpAddData
|
||
|
|
SeGetTokenControlInformation
|
||
|
|
CmQueryKey
|
||
|
|
PsLookupProcessByProcessId
|
||
|
|
RtlAppendUnicodeStringToString
|
||
|
|
KeIpiInterrupt
|
||
|
|
KeSweepIcacheRange
|
||
|
|
NtDeleteFile
|
||
|
|
ExpTimerApcRoutine
|
||
|
|
IoUnregisterShutdownNotification
|
||
|
|
strcat
|
||
|
|
mbstowcs
|
||
|
|
KiWaitSatisfy
|
||
|
|
KiDataBusError
|
||
|
|
FsRtlCancelWaitIrp
|
||
|
|
IoGetDeviceObjectPointer
|
||
|
|
IopGetRegistryKeyInformation
|
||
|
|
RtlOpenCurrentUser
|
||
|
|
CmpDoFindSubKeyByNumber
|
||
|
|
KdpGetContext
|
||
|
|
NtDelayExecution
|
||
|
|
_wcsnicmp
|
||
|
|
PsLookupThreadByThreadId
|
||
|
|
MiCheckForContiguousMemory
|
||
|
|
KdPollBreakIn
|
||
|
|
IopFreeResourceDir
|
||
|
|
NtOpenDirectoryObject
|
||
|
|
NtOpenSymbolicLinkObject
|
||
|
|
CmpCopyName
|
||
|
|
DbgkpSectionHandleToFileHandle
|
||
|
|
ObpInsertDirectoryEntry
|
||
|
|
RtlLargeIntegerDivide
|
||
|
|
MmSecureVirtualMemory
|
||
|
|
MiLockPagedAddress
|
||
|
|
MiInitializeCopyOnWritePfn
|
||
|
|
MmGetPhysicalAddress
|
||
|
|
KiSystemServiceHandler
|
||
|
|
NtQueryTimerResolution
|
||
|
|
LdrpCompareResourceNames_U
|
||
|
|
RtlSetActiveTimeBias
|
||
|
|
CmpPostNotify
|
||
|
|
CmpSearchForOpenSubKeys
|
||
|
|
MmUnmapIoSpace
|
||
|
|
KiInvalidOperationLongword
|
||
|
|
NtCallbackReturn
|
||
|
|
IopExceptionCleanup
|
||
|
|
NtOpenSection
|
||
|
|
NtCreateProcess
|
||
|
|
RawFileSystemControl
|
||
|
|
CmpSearchKeyControlBlockTree
|
||
|
|
CmpDeleteTree
|
||
|
|
MmMapMemoryDumpMdl
|
||
|
|
KiDivideByZeroSingle
|
||
|
|
KiInSwapProcesses
|
||
|
|
NtQueryInformationPort
|
||
|
|
KiUnlockDispatcherDatabase
|
||
|
|
KeFlushMultipleTb
|
||
|
|
KiAttachProcess
|
||
|
|
RtlUnwind
|
||
|
|
__jump_unwind
|
||
|
|
HvSyncHive
|
||
|
|
HvpTruncateBins
|
||
|
|
NtRestoreKey
|
||
|
|
MmRaisePoolQuota
|
||
|
|
MiSetProtectionOnTransitionPte
|
||
|
|
MiGetProtoPteAddressExtended
|
||
|
|
MiMakeSystemAddressValidPfnWs
|
||
|
|
MiFlushEventCounter
|
||
|
|
IoReportResourceUsage
|
||
|
|
IoGetRelatedDeviceObject
|
||
|
|
IoSynchronousPageWrite
|
||
|
|
CcSetValidData
|
||
|
|
IoPageRead
|
||
|
|
ExInterlockedPushEntryList
|
||
|
|
IoFreeIrp
|
||
|
|
IoFreeMdl
|
||
|
|
CcMdlReadComplete
|
||
|
|
KeQuerySystemTime
|
||
|
|
MiLocateAndReserveWsle
|
||
|
|
MiAddValidPageToWorkingSet
|
||
|
|
IoGetCurrentProcess
|
||
|
|
PspExitNormalApc
|
||
|
|
RawQueryVolumeInformation
|
||
|
|
SeCloseObjectAuditAlarm
|
||
|
|
CmpAllocatePostBlock
|
||
|
|
CmpFindSubKeyByNumber
|
||
|
|
NtRegisterThreadTerminatePort
|
||
|
|
RtlNumberOfClearBits
|
||
|
|
MiFlushTbAndCapture
|
||
|
|
MiLocateSubsection
|
||
|
|
FsRtlCancelOplockIIIrp
|
||
|
|
PspReaper
|
||
|
|
IopCancelAlertedRequest
|
||
|
|
IopGetRegistryValue
|
||
|
|
LdrRelocateImage
|
||
|
|
NtQueryPerformanceCounter
|
||
|
|
NtCompleteConnectPort
|
||
|
|
PspTerminateThreadByPointer
|
||
|
|
SepAdtLogAuditRecord
|
||
|
|
ExChangeHandle
|
||
|
|
KiLookupFunctionEntry
|
||
|
|
KiChainedDispatch
|
||
|
|
ExInitializeZone
|
||
|
|
CcDeferWrite
|
||
|
|
ExpUuidLoadSequenceNumber
|
||
|
|
NtStopProfile
|
||
|
|
IopWriteResourceList
|
||
|
|
NtFlushInstructionCache
|
||
|
|
CmpFindChildByNumber
|
||
|
|
CmEnumerateKey
|
||
|
|
CmEnumerateValueKey
|
||
|
|
KeRundownThread
|
||
|
|
ExpAddTagForBigPages
|
||
|
|
RawReadWriteDeviceControl
|
||
|
|
CmUnloadKey
|
||
|
|
KeUserModeCallback
|
||
|
|
ExInitializeResource
|
||
|
|
KiOutSwapProcesses
|
||
|
|
NtOpenEvent
|
||
|
|
NtOpenEventPair
|
||
|
|
NtOpenMutant
|
||
|
|
NtOpenSemaphore
|
||
|
|
NtOpenTimer
|
||
|
|
IoAttachDevice
|
||
|
|
NtOpenIoCompletion
|
||
|
|
NtSetIoCompletion
|
||
|
|
NtAlertResumeThread
|
||
|
|
NtResumeThread
|
||
|
|
KdpSetStateChange
|
||
|
|
ExpFindAndRemoveTagBigPages
|
||
|
|
IopCatagorizeDescriptors
|
||
|
|
SeSubProcessToken
|
||
|
|
IopCheckUnloadDriver
|
||
|
|
SeAuditHandleCreation
|
||
|
|
DbgkForwardException
|
||
|
|
KdpRestoreBreakPointEx
|
||
|
|
RtlEqualString
|
||
|
|
NtW32Call
|
||
|
|
IopCompleteDriverUnload
|
||
|
|
KeInitializeEvent
|
||
|
|
ExReinitializeResourceLite
|
||
|
|
MiChargeCommitment
|
||
|
|
FsRtlWaitOnIrp
|
||
|
|
FsRtlInitializeLargeMcb
|
||
|
|
KiReadEntryTb
|
||
|
|
SwapContext
|
||
|
|
KxUnlockDispatcherDatabase
|
||
|
|
KiSetServerWaitClientEvent
|
||
|
|
NtQueryAttributesFile
|
||
|
|
FsRtlDeregisterUncProvider
|
||
|
|
SepMakeTokenEffectiveOnly
|
||
|
|
PsWatchWorkingSet
|
||
|
|
MiCauseOverCommitPopup
|
||
|
|
KiCallUserMode
|
||
|
|
IopFreeIrpAndMdls
|
||
|
|
FsRtlpRegisterProviderWithMUP
|
||
|
|
RtlInitCodePageTable
|
||
|
|
NtQueryKey
|
||
|
|
ExpCopyProcessInfo
|
||
|
|
RtlPrefixString
|
||
|
|
MiLookupWsleHashIndex
|
||
|
|
MiRemoveFromSystemSpace
|
||
|
|
KiIpiProcessRequests
|
||
|
|
KiSwapProcess
|
||
|
|
NtOpenProcessToken
|
||
|
|
CmpCreatePerfKeys
|
||
|
|
PfxRemovePrefix
|
||
|
|
RtlCopySidAndAttributesArray
|
||
|
|
RtlNumberOfSetBits
|
||
|
|
KeFreezeAllThreads
|
||
|
|
ExQueryPoolUsage
|
||
|
|
KiDivideByZeroDouble
|
||
|
|
IoCheckEaBufferValidity
|
||
|
|
IoCreateController
|
||
|
|
IopLoadUnloadDriver
|
||
|
|
SeObjectReferenceAuditAlarm
|
||
|
|
NtEnumerateKey
|
||
|
|
NtEnumerateValueKey
|
||
|
|
HvMarkCellDirty
|
||
|
|
IoCancelThreadIo
|
||
|
|
KiUnpackSingle
|
||
|
|
FsRtlDissectDbcs
|
||
|
|
CmpLinkKeyToHive
|
||
|
|
CmpCheckRegistry2
|
||
|
|
RtlGetCallersAddress
|
||
|
|
FsRtlCancelExclusiveIrp
|
||
|
|
NtPulseEvent
|
||
|
|
IopGetResourceReqRegistryValue
|
||
|
|
CmpQueryKeyName
|
||
|
|
KiContinue
|
||
|
|
RawMountVolume
|
||
|
|
CmpValidateHiveSecurityDescriptors
|
||
|
|
ExLockUserBuffer
|
||
|
|
RtlFindFirstRunClear
|
||
|
|
FsRtlSetFileSize
|
||
|
|
IopFindCollisionInTList
|
||
|
|
SepRmCommandServerThread
|
||
|
|
MiPageFileFull
|
||
|
|
RtlFindMessage
|
||
|
|
NtCreateDirectoryObject
|
||
|
|
IofCallDriver
|
||
|
|
SepDeleteLogonSessionTrack
|
||
|
|
KeSetBasePriorityThread
|
||
|
|
CmBootLastKnownGood
|
||
|
|
NtSetInformationKey
|
||
|
|
CmpReportNotify
|
||
|
|
ExpGetPoolTagInfo
|
||
|
|
__ull_divrem_6416
|
||
|
|
__ull_rem
|
||
|
|
MiFreeInitializationCode
|
||
|
|
SepDeReferenceLogonSession
|
||
|
|
SepQueueWorkItem
|
||
|
|
CmpInitHiveFromFile
|
||
|
|
__ull_div
|
||
|
|
KeSetSystemTime
|
||
|
|
IoAsynchronousPageWrite
|
||
|
|
KiInitializeUserApc
|
||
|
|
NtCreateEventPair
|
||
|
|
IoDeleteDevice
|
||
|
|
RtlNextUnicodePrefix
|
||
|
|
RtlAllocateAndInitializeSid
|
||
|
|
CmpLinkHiveToMaster
|
||
|
|
CmpRefreshHive
|
||
|
|
PspProcessDelete
|
||
|
|
RtlCompareString
|
||
|
|
MiInitializeTransitionPfn
|
||
|
|
CcUnpinRepinnedBcb
|
||
|
|
NtShutdownSystem
|
||
|
|
NtCreateMutant
|
||
|
|
NtCreateIoCompletion
|
||
|
|
MmCheckSystemImage
|
||
|
|
RtlResetRtlTranslations
|
||
|
|
RtlDestroyHeap
|
||
|
|
HvpIsFreeNeighbor
|
||
|
|
HvMarkClean
|
||
|
|
MiEmptyWorkingSet
|
||
|
|
NtReplaceKey
|
||
|
|
CmNotifyRunDown
|
||
|
|
MmDbgTranslatePhysicalAddress
|
||
|
|
IopDropIrp
|
||
|
|
RtlUpcaseUnicodeStringToAnsiString
|
||
|
|
RtlUnicodeStringToOemString
|
||
|
|
LdrProcessRelocationBlock
|
||
|
|
NtSetInformationObject
|
||
|
|
SepAdtInitializeBounds
|
||
|
|
NtSystemDebugControl
|
||
|
|
RtlFindFirstRunSet
|
||
|
|
KiInitializeContextThread
|
||
|
|
ExpTimeRefreshWork
|
||
|
|
CmpFileRead
|
||
|
|
HvpGetLogHeader
|
||
|
|
ExAllocatePoolWithTag
|
||
|
|
IoAllocateIrp
|
||
|
|
PsImpersonateClient
|
||
|
|
ObGetObjectSecurity
|
||
|
|
ExAllocatePoolWithQuota
|
||
|
|
CcAllocateInitializeBcb
|
||
|
|
FsRtlAllocatePoolWithTag
|
||
|
|
CcCreateVacbArray
|
||
|
|
ExpAllocateStringRoutine
|
||
|
|
ExAllocatePoolWithQuotaTag
|
||
|
|
FsRtlAllocatePool
|
||
|
|
FsRtlPrivateInitializeFileLock
|
||
|
|
NtExtendSection
|
||
|
|
RtlAnsiStringToUnicodeString
|
||
|
|
RtlOemStringToCountedUnicodeString
|
||
|
|
RtlpQueryRegistryDirect
|
||
|
|
ObQueryTypeInfo
|
||
|
|
MiSetPageModified
|
||
|
|
MiExtendPagingFiles
|
||
|
|
MiRemovePageFromWorkingSet
|
||
|
|
FsRtlPrivateCheckForSharedLockAccess
|
||
|
|
MmUnlockPagableImageSection
|
||
|
|
MmCopyVirtualMemory
|
||
|
|
PspQueryPooledQuotaLimits
|
||
|
|
IoQueryDeviceDescription
|
||
|
|
PfxFindPrefix
|
||
|
|
RtlCopyLuidAndAttributesArray
|
||
|
|
RtlDowncaseUnicodeString
|
||
|
|
SepCheckAcl
|
||
|
|
MiMapImageHeaderInHyperSpace
|
||
|
|
KiScanBugCheckCallbackList
|
||
|
|
ExTimerRundown
|
||
|
|
RtlCaptureContext
|
||
|
|
IoRegisterFileSystem
|
||
|
|
IopAcquireFileObjectLock
|
||
|
|
SepCreateLogonSessionTrack
|
||
|
|
CmpReportNotifyHelper
|
||
|
|
CmpFileWrite
|
||
|
|
HvpEnlistFreeCells
|
||
|
|
KdSetOwedBreakpoints
|
||
|
|
KeTerminateThread
|
||
|
|
NtReleaseMutant
|
||
|
|
SeAssignWorldSecurityDescriptor
|
||
|
|
CmpInsertSecurityCellList
|
||
|
|
ExEnumHandleTable
|
||
|
|
RtlpInsertUnCommittedPages
|
||
|
|
CcPostDeferredWrites
|
||
|
|
__ull_divrem_5353
|
||
|
|
NtCreateTimer
|
||
|
|
NtQueryIoCompletion
|
||
|
|
LpcpDeletePort
|
||
|
|
RawUserFsCtrl
|
||
|
|
SepValidOwnerSubjectContext
|
||
|
|
CmpCopyTree2
|
||
|
|
NtCreateEvent
|
||
|
|
NtQuerySecurityObject
|
||
|
|
RtlFormatCurrentUserKeyPath
|
||
|
|
CcZeroEndOfLastPage
|
||
|
|
RtlAddAuditAccessAce
|
||
|
|
NtSuspendThread
|
||
|
|
ExAcquireFastMutex
|
||
|
|
FsRtlLookupLargeMcbEntry
|
||
|
|
FsRtlLookupMcbEntry
|
||
|
|
PsReferenceImpersonationToken
|
||
|
|
FsRtlAddLargeMcbEntry
|
||
|
|
FsRtlAddMcbEntry
|
||
|
|
PsReferencePrimaryToken
|
||
|
|
FsRtlNumberOfRunsInLargeMcb
|
||
|
|
FsRtlGetNextLargeMcbEntry
|
||
|
|
FsRtlLookupLastLargeMcbEntry
|
||
|
|
FsRtlLookupLastMcbEntry
|
||
|
|
FsRtlRemoveLargeMcbEntry
|
||
|
|
PsReferenceEffectiveToken
|
||
|
|
PsDisableImpersonation
|
||
|
|
NtDeleteValueKey
|
||
|
|
NtUnloadKey
|
||
|
|
KdpPromptString
|
||
|
|
KdpAddBreakpoint
|
||
|
|
LsaLogonUser
|
||
|
|
NtQueryEvent
|
||
|
|
NtCreateMailslotFile
|
||
|
|
PspExitProcess
|
||
|
|
SepAdtGenerateDiscardAudit
|
||
|
|
MiAddMappedPtes
|
||
|
|
MiContractPagingFiles
|
||
|
|
KeStopProfile
|
||
|
|
KdpReadIoSpace
|
||
|
|
KdpReadControlSpace
|
||
|
|
NtCreateSemaphore
|
||
|
|
LpcpDestroyPortQueue
|
||
|
|
NtWriteVirtualMemory
|
||
|
|
RtlAddAce
|
||
|
|
KdpWriteBreakPointEx
|
||
|
|
LsaRegisterLogonProcess
|
||
|
|
ExAcquireResourceExclusive
|
||
|
|
NtQuerySemaphore
|
||
|
|
SeAppendPrivileges
|
||
|
|
CmpFreeKeyByCell
|
||
|
|
KdpReportLoadSymbolsStateChange
|
||
|
|
ObInitProcess
|
||
|
|
KiUnpackDouble
|
||
|
|
MmInPageKernelStack
|
||
|
|
KeReleaseMutant
|
||
|
|
IopGenNextValidResourceList
|
||
|
|
IopLookupBusStringFromID
|
||
|
|
SeCaptureSecurityQos
|
||
|
|
IopDisassociateThreadIrp
|
||
|
|
MmFreeNonCachedMemory
|
||
|
|
ExFreePool
|
||
|
|
IopHardErrorThread
|
||
|
|
FsRtlPrivateLimitFreeLockList
|
||
|
|
FsRtlUninitializeOplock
|
||
|
|
CcDeallocateBcb
|
||
|
|
IopDereferenceVpbAndFree
|
||
|
|
FsRtlRemoveAndCompleteWaitIrp
|
||
|
|
FsRtlUninitializeLargeMcb
|
||
|
|
ObReleaseObjectSecurity
|
||
|
|
ObpDeleteDirectoryEntry
|
||
|
|
RtlTimeToTimeFields
|
||
|
|
CcFindBcb
|
||
|
|
ElapsedDaysToYears
|
||
|
|
KiRestoreVolatileFloatState
|
||
|
|
NtCloseObjectAuditAlarm
|
||
|
|
HvReallocateCell
|
||
|
|
ExSetHandleExtraBit
|
||
|
|
IoRaiseHardError
|
||
|
|
HalpCreateDosLink
|
||
|
|
IopAssignResourcesPhase1
|
||
|
|
CmpRemoveKeyControlBlockWithLock
|
||
|
|
CmLoadKey
|
||
|
|
MmUnmapViewOfSection
|
||
|
|
MiIsEntireRangeCommitted
|
||
|
|
SepAdtInitializeCrashOnFail
|
||
|
|
KeSetPriorityProcess
|
||
|
|
FsRtlPrivateRemoveLock
|
||
|
|
ExpRemovePoolTracker
|
||
|
|
MiEnablePagingOfDriver
|
||
|
|
MmCreatePeb
|
||
|
|
KdpReceivePacketLeader
|
||
|
|
ObCheckCreateObjectAccess
|
||
|
|
NtSetSecurityObject
|
||
|
|
MiUpdateModifiedWriterMdls
|
||
|
|
MiUnlinkFreeOrZeroedPage
|
||
|
|
HvWriteHive
|
||
|
|
CmpAddToLeaf
|
||
|
|
MmFreeDriverInitialization
|
||
|
|
HalpCalculateChsValues
|
||
|
|
RtlCompressBufferLZNT1
|
||
|
|
MiCheckPurgeAndUpMapCount
|
||
|
|
NtQueryMutant
|
||
|
|
MmGetPageFileInformation
|
||
|
|
RtlQueryTimeZoneInformation
|
||
|
|
CmpSecurityMethod
|
||
|
|
KeBalanceSetManager
|
||
|
|
FsRtlGetFileSize
|
||
|
|
ExReleaseFastMutex
|
||
|
|
FsRtlOplockIsFastIoPossible
|
||
|
|
ObReferenceObjectByName
|
||
|
|
CmpAssignSecurityDescriptor
|
||
|
|
HvFreeHive
|
||
|
|
xHalExamineMBR
|
||
|
|
IopGetFileName
|
||
|
|
ExpInsertPoolTracker
|
||
|
|
SepAdtInitializePrivilegeAuditing
|
||
|
|
KeDisconnectInterrupt
|
||
|
|
PspQueryWorkingSetWatch
|
||
|
|
HalpGetRegistryCdromInformation
|
||
|
|
GetNextWchar
|
||
|
|
RtlMakeSelfRelativeSD
|
||
|
|
RtlFindLongestRunSet
|
||
|
|
RtlPrefixUnicodeString
|
||
|
|
MiFindEmptyAddressRangeInTree
|
||
|
|
MiDeleteAddressesInWorkingSet
|
||
|
|
MiReserveSystemPtes
|
||
|
|
MmMapLockedPages
|
||
|
|
KeEnterCriticalRegion
|
||
|
|
FsRtlPrivateCheckForExclusiveLockAccess
|
||
|
|
CcMapData
|
||
|
|
IoIsOperationSynchronous
|
||
|
|
FsRtlAcknowledgeOplockBreak
|
||
|
|
CcPurgeAndClearCacheSection
|
||
|
|
MmResetDriverPaging
|
||
|
|
PspQueryQuotaLimits
|
||
|
|
MmLockPagableDataSection
|
||
|
|
KiInvalidOperationSingle
|
||
|
|
CmpCopyValue
|
||
|
|
IopSortDescriptors
|
||
|
|
RtlpGetRegistryHandle
|
||
|
|
KdpWritePhysicalMemory
|
||
|
|
MiFlushDirtyBitsToPfn
|
||
|
|
PfxInsertPrefix
|
||
|
|
CmpFindMatchingDescriptorCell
|
||
|
|
NtReadVirtualMemory
|
||
|
|
__ll_rem
|
||
|
|
IopAssignResourcesPhase4
|
||
|
|
LdrpAccessResourceData
|
||
|
|
RtlValidSecurityDescriptor
|
||
|
|
HvFreeHivePartial
|
||
|
|
ObReferenceObjectByPointer
|
||
|
|
FsRtlRequestExclusiveOplock
|
||
|
|
FsRtlDoesNameContainWildCards
|
||
|
|
ExSystemTimeToLocalTime
|
||
|
|
SeTokenImpersonationLevel
|
||
|
|
PspAssignImpersonationToken
|
||
|
|
SeTokenType
|
||
|
|
RtlExtendedMagicDivide
|
||
|
|
RtlTimeToSecondsSince1970
|
||
|
|
ExQueryPoolBlockSize
|
||
|
|
RtlEqualUnicodeString
|
||
|
|
ObpLookupDirectoryEntry
|
||
|
|
ObpDeleteNameCheck
|
||
|
|
RtlCompareMemory
|
||
|
|
MiFlushPteList
|
||
|
|
KdpWriteIoSpace
|
||
|
|
KiRaiseException
|
||
|
|
MmDeleteProcessAddressSpace
|
||
|
|
NtSetValueKey
|
||
|
|
MmGetFileNameForSection
|
||
|
|
MiModifiedPageWriter
|
||
|
|
RtlUpperChar
|
||
|
|
HvCheckHive
|
||
|
|
__ll_div
|
||
|
|
MiTrimWorkingSet
|
||
|
|
RtlpInitializeHeapSegment
|
||
|
|
HvpDelistFreeCell
|
||
|
|
HvIsCellAllocated
|
||
|
|
RtlGetElementGenericTable
|
||
|
|
MmAllocateNonCachedMemory
|
||
|
|
atol
|
||
|
|
ObCheckTraverseAccess
|
||
|
|
MiMappedPageWriter
|
||
|
|
NtQueryTimer
|
||
|
|
IoPageFileCreated
|
||
|
|
RtlpQuerySecurityDescriptor
|
||
|
|
ObCheckObjectReference
|
||
|
|
MmMapIoSpace
|
||
|
|
LpcpExtendPortZone
|
||
|
|
RtlSetTimeZoneInformation
|
||
|
|
MiCreatePebOrTeb
|
||
|
|
NtCancelTimer
|
||
|
|
MmUnloadSystemImage
|
||
|
|
CcExceptionFilter
|
||
|
|
CcWorkerThread
|
||
|
|
IoBuildPartialMdl
|
||
|
|
strlen
|
||
|
|
FsRtlDissectName
|
||
|
|
KiUnwaitThread
|
||
|
|
KiInsertQueueApc
|
||
|
|
KiWaitTest
|
||
|
|
KiActivateWaiterQueue
|
||
|
|
CcUnpinData
|
||
|
|
RtlConvertUlongToLargeInteger
|
||
|
|
KiSwapThreadExit
|
||
|
|
CmpInterlockedFunction
|
||
|
|
KeSetAffinityThread
|
||
|
|
FsRtlRequestOplockII
|
||
|
|
SeCaptureLuidAndAttributesArray
|
||
|
|
CmpAddToHiveFileList
|
||
|
|
HvMarkDirty
|
||
|
|
KiReadyThread
|
||
|
|
KiSetPriorityThread
|
||
|
|
RtlNtStatusToDosErrorNoTeb
|
||
|
|
ExInterlockedInsertTailList
|
||
|
|
ExInitializeResourceLite
|
||
|
|
SepSidInToken
|
||
|
|
SepTokenIsOwner
|
||
|
|
FsRtlAreNamesEqual
|
||
|
|
CmpGetSymbolicLink
|
||
|
|
NtQueryValueKey
|
||
|
|
NtImpersonateThread
|
||
|
|
IoBuildAsynchronousFsdRequest
|
||
|
|
RawDispatch
|
||
|
|
ExReleaseFastMutexUnsafe
|
||
|
|
RtlOemToUnicodeN
|
||
|
|
RtlOemStringToUnicodeString
|
||
|
|
ObCreateObject
|
||
|
|
CmpDoOpen
|
||
|
|
IoCreateStreamFileObject
|
||
|
|
RtlUpcaseUnicodeChar
|
||
|
|
CmpCompareCompressedName
|
||
|
|
CmpDoCompareKeyName
|
||
|
|
CmpFindSubKeyInLeaf
|
||
|
|
CmpFindNameInList
|
||
|
|
FsRtlFindLargeIndex
|
||
|
|
FsRtlRemoveMcbEntryPrivate
|
||
|
|
RtlFindClearBits
|
||
|
|
RtlFindClearBitsAndSet
|
||
|
|
SepAuditFailed
|
||
|
|
MiHandleForkTransitionPte
|
||
|
|
IoGetRequestorProcess
|
||
|
|
RtlMapGenericMask
|
||
|
|
SeCreateAccessState
|
||
|
|
IoCheckDesiredAccess
|
||
|
|
ObpIncrementUnnamedHandleCount
|
||
|
|
SepApplyAclToObject
|
||
|
|
RtlpGenerateInheritedAce
|
||
|
|
RtlpGenerateInheritAcl
|
||
|
|
RtlpLengthInheritedAce
|
||
|
|
KiFlushSingleTb
|
||
|
|
RtlFreeUnicodeString
|
||
|
|
FsRtlIsNameInExpression
|
||
|
|
SeLockSubjectContext
|
||
|
|
SeAssignSecurity
|
||
|
|
ExCreateHandle
|
||
|
|
ObpCreateUnnamedHandle
|
||
|
|
ObpInsertUnnamedObject
|
||
|
|
SeReleaseSubjectContext
|
||
|
|
ObpFreeObject
|
||
|
|
ObpDecrementHandleCount
|
||
|
|
ObpCreateHandle
|
||
|
|
ObInsertObject
|
||
|
|
NtOpenThreadToken
|
||
|
|
ObOpenObjectByPointer
|
||
|
|
ExInterlockedAddLargeInteger
|
||
|
|
ExMapHandleToPointer
|
||
|
|
ExAcquireSharedStarveExclusive
|
||
|
|
FsRtlDoesDbcsContainWildCards
|
||
|
|
SeCaptureSubjectContext
|
||
|
|
IoRemoveShareAccess
|
||
|
|
CcSetReadAheadGranularity
|
||
|
|
KiUnexpectedInterrupt
|
||
|
|
IoAllocateAdapterChannel
|
||
|
|
SeUnlockSubjectContext
|
||
|
|
ExTryToAcquireResourceExclusiveLite
|
||
|
|
ObOpenObjectByName
|
||
|
|
IoCreateFile
|
||
|
|
NtCreateFile
|
||
|
|
IopOpenLinkOrRenameTarget
|
||
|
|
NtCreateNamedPipeFile
|
||
|
|
NtOpenKey
|
||
|
|
ObpCaptureObjectCreateInfo
|
||
|
|
RtlFreeOemString
|
||
|
|
ObpAllocateObject
|
||
|
|
SeAuditingFileEvents
|
||
|
|
ExIsResourceAcquiredExclusiveLite
|
||
|
|
IopParseDevice
|
||
|
|
IopParseFile
|
||
|
|
ObpRemoveObjectRoutine
|
||
|
|
FsRtlCheckOplock
|
||
|
|
MiDeleteValidAddress
|
||
|
|
RtlConvertSidToUnicodeString
|
||
|
|
MiCheckForUserStackOverflow
|
||
|
|
LZNT1FindMatchStandard
|
||
|
|
SeAuditProcessExit
|
||
|
|
CmSaveKey
|
||
|
|
IsValidOemCharacter
|
||
|
|
MmGrowKernelStack
|
||
|
|
MiFreeInPageSupportBlock
|
||
|
|
KeSetTargetProcessorDpc
|
||
|
|
ObpInsertHandleCount
|
||
|
|
ObpIncrementHandleDataBase
|
||
|
|
KeInsertDeviceQueue
|
||
|
|
xHalSlotControl
|
||
|
|
ExDestroyHandle
|
||
|
|
KeGetBugMessageText
|
||
|
|
MiUnmapLockedPagesInUserSpace
|
||
|
|
RtlpCreateUnCommittedRange
|
||
|
|
RtlExpandEnvironmentStrings_U
|
||
|
|
HvFreeCell
|
||
|
|
IoShutdownSystem
|
||
|
|
IopSlotResourceOwner
|
||
|
|
CmReplaceKey
|
||
|
|
MiGetSubsectionAndProtoFromPte
|
||
|
|
KiInvalidOperationDouble
|
||
|
|
KiTrapExit
|
||
|
|
CmpNotifyChangeKey
|
||
|
|
HvCheckBin
|
||
|
|
CcExtendVacbArray
|
||
|
|
MmIsAddressValid
|
||
|
|
MiLocateWsle
|
||
|
|
MiDecrementReferenceCount
|
||
|
|
RtlSplay
|
||
|
|
RtlDelete
|
||
|
|
RtlDeleteElementGenericTable
|
||
|
|
RtlLookupElementGenericTable
|
||
|
|
KeUpdateRunTime
|
||
|
|
KeUpdateSystemTime
|
||
|
|
SeDeleteAccessState
|
||
|
|
ObpCaptureObjectName
|
||
|
|
MmDeterminePoolType
|
||
|
|
KiComputeTimerTableIndex
|
||
|
|
KiInsertTreeTimer
|
||
|
|
FsRtlIsFatDbcsLegal
|
||
|
|
FsRtlCurrentBatchOplock
|
||
|
|
RtlLargeIntegerArithmeticShift
|
||
|
|
KiFlushMultipleTb
|
||
|
|
IopCloseFile
|
||
|
|
KeInitializeDpc
|
||
|
|
KeReadStateTimer
|
||
|
|
MiSetDirtyBit
|
||
|
|
_wcsicmp
|
||
|
|
FsRtlNotifyUpdateBuffer
|
||
|
|
NtFlushVirtualMemory
|
||
|
|
RawCreate
|
||
|
|
FsRtlNotifyCompleteIrp
|
||
|
|
RtlCharToInteger
|
||
|
|
KdpSendPacket
|
||
|
|
PspGetSetContextSpecialApc
|
||
|
|
MiCheckDosCalls
|
||
|
|
NtTerminateProcess
|
||
|
|
RtlpRestoreContext
|
||
|
|
RtlInsertUnicodePrefix
|
||
|
|
MiInsertPageFileInList
|
||
|
|
MmLockPagableSectionByHandle
|
||
|
|
NtSetTimerResolution
|
||
|
|
CmpMarkKeyDirty
|
||
|
|
KeInitializeApc
|
||
|
|
RtlRealSuccessor
|
||
|
|
IoCheckShareAccess
|
||
|
|
RtlFillMemoryUlong
|
||
|
|
CcGetVirtualAddressIfMapped
|
||
|
|
FsRtlIsNotifyOnList
|
||
|
|
ExInterlockedAddLargeStatistic
|
||
|
|
RtlUnicodeToMultiByteN
|
||
|
|
RtlUnicodeStringToAnsiString
|
||
|
|
RtlUpcaseUnicodeStringToOemString
|
||
|
|
ObpValidateAccessMask
|
||
|
|
HvpFreeMap
|
||
|
|
KiSystemServiceEventPair
|
||
|
|
RtlpInsertFreeBlock
|
||
|
|
CmpGetHiveName
|
||
|
|
RtlDecompressBufferLZNT1
|
||
|
|
PspGetContext
|
||
|
|
SepExamineSacl
|
||
|
|
KdpReadPhysicalMemory
|
||
|
|
IopPickupCollisionInTList
|
||
|
|
NtPrivilegeCheck
|
||
|
|
NtLoadDriver
|
||
|
|
KiEmulateBranch
|
||
|
|
HvpCoalesceDiscardedBins
|
||
|
|
RtlInitializeContext
|
||
|
|
HvpGetHiveHeader
|
||
|
|
MiInsertWsle
|
||
|
|
DbgkCreateThread
|
||
|
|
ObpIncrementHandleCount
|
||
|
|
SeAccessCheck
|
||
|
|
IoSetShareAccess
|
||
|
|
ExTryToAcquireFastMutex
|
||
|
|
NtSetInformationThread
|
||
|
|
SepAccessCheck
|
||
|
|
IoCancelIrp
|
||
|
|
ExLocalTimeToSystemTime
|
||
|
|
KeInitializeEventPair
|
||
|
|
FsRtlNotifyCleanup
|
||
|
|
KeFillEntryTb
|
||
|
|
MiCheckPdeForPagedPool
|
||
|
|
KiTimerExpiration
|
||
|
|
KiQuantumEnd
|
||
|
|
RtlUpcaseUnicodeToOemN
|
||
|
|
RtlUpcaseUnicodeStringToCountedOemString
|
||
|
|
KeRemoveDeviceQueue
|
||
|
|
MiUnlinkPageFromList
|
||
|
|
RtlSecondsSince1970ToTime
|
||
|
|
MiCheckProtoPtePageState
|
||
|
|
IoStartNextPacketByKey
|
||
|
|
LpcRequestPort
|
||
|
|
qsort
|
||
|
|
MiSetPagingOfDriver
|
||
|
|
CompareNamesCaseSensitive
|
||
|
|
SeCaptureSid
|
||
|
|
KiSetRegisterValue
|
||
|
|
ExSnapShotHandleTables
|
||
|
|
SePrivilegePolicyCheck
|
||
|
|
SepAdtCloseObjectAuditAlarm
|
||
|
|
CmpSplitLeaf
|
||
|
|
MiInsertInSystemSpace
|
||
|
|
MiResolvePageFileFault
|
||
|
|
IoVerifyVolume
|
||
|
|
IoConnectInterrupt
|
||
|
|
RtlRemoveUnicodePrefix
|
||
|
|
SepRmCallLsa
|
||
|
|
AllocateHandleTableEntries
|
||
|
|
MmDeleteKernelStack
|
||
|
|
NtCreateSection
|
||
|
|
MiSwapWslEntries
|
||
|
|
KiGetRegisterValue
|
||
|
|
MiUpdateWsle
|
||
|
|
SeCaptureAcl
|
||
|
|
KiFindReadyThread
|
||
|
|
ObpLookupObjectName
|
||
|
|
IoUpdateShareAccess
|
||
|
|
RtlSubAuthoritySid
|
||
|
|
RtlpContainsCreatorOwnerSid
|
||
|
|
RtlpContainsCreatorGroupSid
|
||
|
|
IoCheckFunctionAccess
|
||
|
|
IoStartNextPacket
|
||
|
|
RtlExtendedIntegerMultiply
|
||
|
|
DaysAndFractionToTime
|
||
|
|
CmpFindSubKeyInRoot
|
||
|
|
RtlDispatchException
|
||
|
|
CmpCheckValueList
|
||
|
|
CmpMarkIndexDirty
|
||
|
|
RtlUnicodeToCustomCPN
|
||
|
|
RtlZeroHeap
|
||
|
|
RtlLargeIntegerToChar
|
||
|
|
PspSetContext
|
||
|
|
MiEliminateWorkingSetEntry
|
||
|
|
NtDisplayString
|
||
|
|
SepAdtObjectReferenceAuditAlarm
|
||
|
|
HvLoadHive
|
||
|
|
MiGetPageProtection
|
||
|
|
RawQueryFsSizeInfo
|
||
|
|
MiCalculatePageCommitment
|
||
|
|
MiDecrementCloneBlockReference
|
||
|
|
ExpRaiseHardError
|
||
|
|
KiGeneralException
|
||
|
|
IoAllocateErrorLogEntry
|
||
|
|
KiNormalizeLongword
|
||
|
|
KiRequestSoftwareInterrupt
|
||
|
|
MiReleaseWsle
|
||
|
|
ExRaiseHardError
|
||
|
|
NtGetContextThread
|
||
|
|
ExInterlockedExchangeUlong
|
||
|
|
MiFindActualFaultingPte
|
||
|
|
MiCompleteProtoPteFault
|
||
|
|
IopCheckDeviceAndDriver
|
||
|
|
FsRtlIsNameInExpressionPrivate
|
||
|
|
NtSetContextThread
|
||
|
|
SepRmCommandServerThreadInit
|
||
|
|
FsRtlAcquireFileForModWrite
|
||
|
|
FsRtlGetNextFileLock
|
||
|
|
IopCheckBackupRestorePrivilege
|
||
|
|
RtlGetDaclSecurityDescriptor
|
||
|
|
ObpHashSecurityDescriptor
|
||
|
|
IopCheckAndLogConflict
|
||
|
|
RtlUnicodeStringToInteger
|
||
|
|
NtCreateSymbolicLinkObject
|
||
|
|
AllocateHandleTable
|
||
|
|
MiGrowWorkingSet
|
||
|
|
NtQuerySymbolicLinkObject
|
||
|
|
SeAuditHandleDuplication
|
||
|
|
RtlpExtendHeap
|
||
|
|
ExpWaitForResourceDdk
|
||
|
|
MiReorderTree
|
||
|
|
MmOutSwapProcess
|
||
|
|
IopRaiseHardError
|
||
|
|
IopQueryName
|
||
|
|
MmMapViewOfSection
|
||
|
|
CmpSelectLeaf
|
||
|
|
NtCreateKey
|
||
|
|
MiRemoveAnyPage
|
||
|
|
MiResolveMappedFileFault
|
||
|
|
MiResolveProtoPteFault
|
||
|
|
RtlSubtreePredecessor
|
||
|
|
ObpHashBuffer
|
||
|
|
MiRemovePageByColor
|
||
|
|
RtlClearBits
|
||
|
|
MiReleasePageFileSpace
|
||
|
|
MiRemoveWsle
|
||
|
|
MiFreeWsle
|
||
|
|
KeInsertByKeyDeviceQueue
|
||
|
|
ExAcquireSharedWaitForExclusive
|
||
|
|
CcPurgeCacheSection
|
||
|
|
HalpGetRegistryPartitionInformation
|
||
|
|
NtDuplicateToken
|
||
|
|
DbgBreakPoint
|
||
|
|
ZwWaitForMultipleObjects
|
||
|
|
IoThreadToProcess
|
||
|
|
MiInitializeReadInProgressPfn
|
||
|
|
NtSetInformationFile
|
||
|
|
MmBuildMdlForNonPagedPool
|
||
|
|
FsRtlOplockFsctrl
|
||
|
|
CmSetValueKey
|
||
|
|
HvpRecoverData
|
||
|
|
MiAttemptPageFileExtension
|
||
|
|
NtImpersonateClientOfPort
|
||
|
|
MiLockCode
|
||
|
|
IoBuildDeviceIoControlRequest
|
||
|
|
ExQuerySystemLockInformation
|
||
|
|
NtRemoveIoCompletion
|
||
|
|
MiAttemptPageFileReduction
|
||
|
|
CmpCreateLinkNode
|
||
|
|
RtlSetBits
|
||
|
|
RtlEnumerateGenericTableWithoutSplaying
|
||
|
|
MiFreeEventCounter
|
||
|
|
NtCreateThread
|
||
|
|
NtPrivilegeObjectAuditAlarm
|
||
|
|
KdInitSystem
|
||
|
|
FsRtlIsHpfsDbcsLegal
|
||
|
|
NtSetSystemTime
|
||
|
|
IopGetDriverNameFromKeyNode
|
||
|
|
HvpFindNextDirtyBlock
|
||
|
|
NtQuerySection
|
||
|
|
MiRemoveMappedPtes
|
||
|
|
FsRtlOplockBreakToNone
|
||
|
|
SeAuditProcessCreation
|
||
|
|
NtCancelIoFile
|
||
|
|
CmpSaveKeyByFileCopy
|
||
|
|
FsRtlRegisterUncProvider
|
||
|
|
IopTranslateResourceList
|
||
|
|
CmpInitializeHive
|
||
|
|
MmSetBankedSection
|
||
|
|
RtlCustomCPToUnicodeN
|
||
|
|
MiResolveImageReferences
|
||
|
|
KdpTrap
|
||
|
|
IopGetDosDevicesProtection
|
||
|
|
MmOutPageKernelStack
|
||
|
|
MiInitializePfn
|
||
|
|
KeRemoveByKeyDeviceQueue
|
||
|
|
NtSetEvent
|
||
|
|
RtlLookupFunctionEntry
|
||
|
|
ExpRaiseStatus
|
||
|
|
RtlLengthSid
|
||
|
|
RtlpDidUnicodeToOemWork
|
||
|
|
RtlUnicodeStringToCountedOemString
|
||
|
|
RtlEqualSid
|
||
|
|
ProbeForWrite
|
||
|
|
NtQueryVolumeInformationFile
|
||
|
|
NtClearEvent
|
||
|
|
NtWaitForSingleObject
|
||
|
|
KiExceptionDispatch
|
||
|
|
NtRaiseException
|
||
|
|
RtlFindLongestRunClear
|
||
|
|
MiLocateAddress
|
||
|
|
MmIsRecursiveIoFault
|
||
|
|
KeReadStateProcess
|
||
|
|
KeReadStateMutant
|
||
|
|
IopSynchronousServiceTail
|
||
|
|
NtFlushBuffersFile
|
||
|
|
MiMakeProtectionMask
|
||
|
|
MiIsProtectionCompatible
|
||
|
|
LpcpMoveMessage
|
||
|
|
RtlCompareUnicodeString
|
||
|
|
SwapSplayLinks
|
||
|
|
RtlIntegerToChar
|
||
|
|
CmDeleteKey
|
||
|
|
KeInitializeInterrupt
|
||
|
|
CmpFindKeyControlBlockWithLock
|
||
|
|
CmpCreateKeyControlBlock
|
||
|
|
SepGetDefaultsSubjectContext
|
||
|
|
NtCreatePort
|
||
|
|
ExpQueryModuleInformation
|
||
|
|
NtCreateProfile
|
||
|
|
RtlpFindAndCommitPages
|
||
|
|
MmMapViewInSystemSpace
|
||
|
|
NtProtectVirtualMemory
|
||
|
|
ExDupHandleTable
|
||
|
|
CmpRemoveSubKey
|
||
|
|
NtPrivilegedServiceAuditAlarm
|
||
|
|
CmpDoCreate
|
||
|
|
KeDelayExecutionThread
|
||
|
|
RtlDecompressFragmentLZNT1
|
||
|
|
CmpUnlockRegistry
|
||
|
|
CmQueryValueKey
|
||
|
|
CmpDeleteKeyObject
|
||
|
|
ExReleaseResourceForThreadLite
|
||
|
|
SeFastTraverseCheck
|
||
|
|
ObpParseSymbolicLink
|
||
|
|
LpcpAllocateFromPortZone
|
||
|
|
NtReplyPort
|
||
|
|
RtlIsGenericTableEmpty
|
||
|
|
FsRtlAllocateOplock
|
||
|
|
__ll_lshift
|
||
|
|
KeChangeColorPage
|
||
|
|
RtlInitializeBitMap
|
||
|
|
SeValidSecurityDescriptor
|
||
|
|
IopQueryXxxInformation
|
||
|
|
MiGetPreviousNode
|
||
|
|
CmpStepThroughExit
|
||
|
|
NtFsControlFile
|
||
|
|
ExDisableResourceBoostLite
|
||
|
|
SeDeassignSecurity
|
||
|
|
ObAssignSecurity
|
||
|
|
FsRtlNotifyCompletion
|
||
|
|
NtSetDefaultLocale
|
||
|
|
SepAdjustPrivileges
|
||
|
|
HvpWriteLog
|
||
|
|
KeBugCheckEx
|
||
|
|
MiDoPoolCopy
|
||
|
|
CmDeleteValueKey
|
||
|
|
HvpBuildMap
|
||
|
|
SepAdtMarshallAuditRecord
|
||
|
|
MiQueryAddressState
|
||
|
|
NtStartProfile
|
||
|
|
MiDoMappedCopy
|
||
|
|
MiCopyOnWrite
|
||
|
|
CmpCopyKeyPartial
|
||
|
|
MiRemoveNode
|
||
|
|
RtlCutoverTimeToSystemTime
|
||
|
|
SeOpenObjectAuditAlarm
|
||
|
|
MiMapLockedPagesInUserSpace
|
||
|
|
KeInitializeSemaphore
|
||
|
|
FsRtlInitializeMcb
|
||
|
|
MiCreateDataFileMap
|
||
|
|
RtlpLengthInheritAcl
|
||
|
|
SepInheritAcl
|
||
|
|
HvpGetCellPaged
|
||
|
|
RtlInitializeSid
|
||
|
|
__ull_rshift
|
||
|
|
MmInitializeProcessAddressSpace
|
||
|
|
FsRtlNotifyFullReportChange
|
||
|
|
RtlAreBitsSet
|
||
|
|
RtlAreBitsClear
|
||
|
|
NtQuerySystemEnvironmentValue
|
||
|
|
NtNotifyChangeKey
|
||
|
|
HvpDoWriteHive
|
||
|
|
IopBuildResourceDir
|
||
|
|
CmpNameFromAttributes
|
||
|
|
FsRtlOplockBreakNotify
|
||
|
|
MiGetNextNode
|
||
|
|
MiFindEmptyAddressRange
|
||
|
|
ObDeleteCapturedInsertInfo
|
||
|
|
SeCreateClientSecurity
|
||
|
|
ObpDereferenceSecurityDescriptor
|
||
|
|
DbgPrompt
|
||
|
|
FsRtlAllocateResource
|
||
|
|
strrchr
|
||
|
|
RtlEqualLuid
|
||
|
|
SepReferenceLogonSession
|
||
|
|
FsRtlInitializeFileLock
|
||
|
|
PsConvertToGuiThread
|
||
|
|
CmpSetValueKeyExisting
|
||
|
|
MiPurgeImageSection
|
||
|
|
CmpParseKey
|
||
|
|
CmpSetValueKeyNew
|
||
|
|
MmExtendSection
|
||
|
|
ExQueryHandleExtraBit
|
||
|
|
RtlLengthSecurityDescriptor
|
||
|
|
OpbCreateCacheEntry
|
||
|
|
CmpFindChildByName
|
||
|
|
RtlImageDirectoryEntryToData
|
||
|
|
KeFillLargeEntryTb
|
||
|
|
RtlValidSid
|
||
|
|
CmpDereferenceKeyControlBlock
|
||
|
|
ObAssignObjectSecurityDescriptor
|
||
|
|
NtTestAlert
|
||
|
|
NtLoadKey
|
||
|
|
IopXxxControlFile
|
||
|
|
NtReplyWaitReceivePort
|
||
|
|
RtlUnicodeToOemN
|
||
|
|
NtRaiseHardError
|
||
|
|
memcmp
|
||
|
|
MiGrowWsleHash
|
||
|
|
FsRtlSplitLargeMcb
|
||
|
|
MiCreatePagingFileMap
|
||
|
|
RtlUnwind2
|
||
|
|
MiInitializeWorkingSetList
|
||
|
|
NtUnloadDriver
|
||
|
|
RtlFindSetBits
|
||
|
|
HvpBuildMapAndCopy
|
||
|
|
MiCheckVirtualAddress
|
||
|
|
MiInsertNode
|
||
|
|
IopErrorLogThread
|
||
|
|
MiGetWorkingSetInfo
|
||
|
|
KdpSendWaitContinue
|
||
|
|
CmpWorker
|
||
|
|
KdpReceivePacket
|
||
|
|
MiCheckForCrashDump
|
||
|
|
CmpAddSubKey
|
||
|
|
NtRequestPort
|
||
|
|
LpcpFreeToPortZone
|
||
|
|
LpcpFindDataInfoMessage
|
||
|
|
RtlCreateAcl
|
||
|
|
MiCheckForConflictingNode
|
||
|
|
NtAllocateUuids
|
||
|
|
RtlFreeHeap
|
||
|
|
SepDuplicateToken
|
||
|
|
NtSetSystemEnvironmentValue
|
||
|
|
MmFlushVirtualMemory
|
||
|
|
NtOpenThread
|
||
|
|
LpcpCopyRequestData
|
||
|
|
xHalIoSetPartitionInformation
|
||
|
|
pIoQueryBusDescription
|
||
|
|
SepAdtPrivilegedServiceAuditAlarm
|
||
|
|
HvpDoAllocateCell
|
||
|
|
MmInSwapProcess
|
||
|
|
SepAdjustGroups
|
||
|
|
CmpSetVersionData
|
||
|
|
CmpSetSecurityDescriptorInfo
|
||
|
|
IoRaiseInformationalHardError
|
||
|
|
MiRemoveWorkingSetPages
|
||
|
|
NtOpenProcess
|
||
|
|
MiSnapThunk
|
||
|
|
LdrEnumResources
|
||
|
|
CmpQueryKeyData
|
||
|
|
CmpLoadHiveVolatile
|
||
|
|
MmCleanProcessAddressSpace
|
||
|
|
MiVerifyImageHeader
|
||
|
|
CmpOpenHiveFiles
|
||
|
|
IopAssignResourcesPhase3
|
||
|
|
CmpQueryKeyValueData
|
||
|
|
MiReturnCommitment
|
||
|
|
MiReturnPageTablePageCommitment
|
||
|
|
CmpLockRegistry
|
||
|
|
MiZeroPhysicalPage
|
||
|
|
SepFreeCapturedString
|
||
|
|
SepDefaultDeleteMethod
|
||
|
|
NtQueryInformationFile
|
||
|
|
NtRequestWaitReplyPort
|
||
|
|
RtlVirtualUnwind
|
||
|
|
RtlTimeFieldsToTime
|
||
|
|
ExDestroyHandleTable
|
||
|
|
NtReleaseSemaphore
|
||
|
|
RtlUpcaseUnicodeString
|
||
|
|
SepCreateImpersonationTokenDacl
|
||
|
|
PspUserThreadStartup
|
||
|
|
CmpFindSubKeyByName
|
||
|
|
RtlAddAccessAllowedAce
|
||
|
|
MiChargePageFileQuota
|
||
|
|
ObQueryTypeName
|
||
|
|
IopSynchronousApiServiceTail
|
||
|
|
MiLocateAddressInTree
|
||
|
|
KiMoveApcState
|
||
|
|
RtlImageNtHeader
|
||
|
|
RtlpRaiseStatus
|
||
|
|
KiFlushRandomTb
|
||
|
|
RtlMultiByteToUnicodeN
|
||
|
|
RtlpCallQueryRegistryRoutine
|
||
|
|
PsUnlockProcess
|
||
|
|
NtTerminateThread
|
||
|
|
DbgkpSuspendProcess
|
||
|
|
KeTryToAcquireSpinLock
|
||
|
|
RtlCopySid
|
||
|
|
RtlCreateSecurityDescriptor
|
||
|
|
CmpRemoveKeyControlBlock
|
||
|
|
NtGetTickCount
|
||
|
|
RtlpExceptionHandler
|
||
|
|
NtWriteFile
|
||
|
|
SeQuerySecurityDescriptorInfo
|
||
|
|
SeDefaultObjectMethod
|
||
|
|
CmpQuerySecurityDescriptorInfo
|
||
|
|
CompareUnicodeStrings
|
||
|
|
RtlFindUnicodePrefix
|
||
|
|
PsLockProcess
|
||
|
|
MiFindEmptyAddressRangeDownTree
|
||
|
|
__C_specific_handler
|
||
|
|
ObpLogSecurityDescriptor
|
||
|
|
MiWriteComplete
|
||
|
|
SepAdtPrivilegeObjectAuditAlarm
|
||
|
|
MiDecommitPages
|
||
|
|
ObQueryNameString
|
||
|
|
CmpHiveRootSecurityDescriptor
|
||
|
|
NtReplyWaitReplyPort
|
||
|
|
HvpEnlistFreeCell
|
||
|
|
FsRtlOpBatchBreakClosePending
|
||
|
|
SepPrivilegeCheck
|
||
|
|
SepProbeAndCaptureString_U
|
||
|
|
NtResetEvent
|
||
|
|
CmpGetNextName
|
||
|
|
MmCreateTeb
|
||
|
|
SeComputeQuotaInformationSize
|
||
|
|
MiModifiedPageWriterWorker
|
||
|
|
FsRtlCancelNotify
|
||
|
|
PspExitThread
|
||
|
|
MiReturnPageFileQuota
|
||
|
|
MiInitializePfnForOtherProcess
|
||
|
|
RtlGetSaclSecurityDescriptor
|
||
|
|
DbgkExitThread
|
||
|
|
RtlGetGroupSecurityDescriptor
|
||
|
|
RtlFirstFreeAce
|
||
|
|
RtlGetOwnerSecurityDescriptor
|
||
|
|
SepAdtAuditThisEvent
|
||
|
|
ObpDestroySecurityDescriptorHeader
|
||
|
|
CcScanDpc
|
||
|
|
RtlInitUnicodeString
|
||
|
|
ComputeUnicodeNameLength
|
||
|
|
SeReleaseSecurityDescriptor
|
||
|
|
PsTerminateSystemThread
|
||
|
|
PsExitSpecialApc
|
||
|
|
CcRepinBcb
|
||
|
|
__ll_rshift
|
||
|
|
SepTokenDeleteMethod
|
||
|
|
KiEmulateFloating
|
||
|
|
MiInitMachineDependent
|
||
|
|
RtlAllocateHeap
|
||
|
|
MiCloneProcessAddressSpace
|
||
|
|
NtQuerySystemInformation
|
||
|
|
IopGenNextValidDescriptor
|
||
|
|
RtlpCoalesceFreeBlocks
|
||
|
|
IopGetSetSecurityObject
|
||
|
|
NtNotifyChangeDirectoryFile
|
||
|
|
ExRefreshTimeZoneInformation
|
||
|
|
FsRtlNotifyFullChangeDirectory
|
||
|
|
MiCreateImageFileMap
|
||
|
|
NtQueryInformationToken
|
||
|
|
NtAllocateVirtualMemory
|
||
|
|
IopReportResourceUsage
|
||
|
|
RtlUpcaseUnicodeToCustomCPN
|
||
|
|
NtSetInformationProcess
|
||
|
|
RtlUpcaseUnicodeToMultiByteN
|
||
|
|
KeDumpMachineState
|
||
|
|
xHalIoAssignDriveLetters
|
||
|
|
MiSetProtectionOnSection
|
||
|
|
IopAssignResourcesPhase2
|
||
|
|
NtConnectPort
|
||
|
|
PspCreateProcess
|
||
|
|
SeCaptureSecurityDescriptor
|
||
|
|
MmWorkingSetManager
|
||
|
|
_output
|
||
|
|
_woutput
|
||
|
|
NtCreatePagingFile
|
||
|
|
MiMapViewOfImageSection
|
||
|
|
NtAcceptConnectPort
|
||
|
|
NtFreeVirtualMemory
|
||
|
|
MiMapViewOfDataSection
|
||
|
|
NtReadFile
|
||
|
|
FsRtlIsDbcsInExpression
|
||
|
|
LZNT1DecompressChunk
|
||
|
|
NtSetInformationToken
|
||
|
|
IoAssignResources
|
||
|
|
CcZeroData
|
||
|
|
MiMapViewOfPhysicalSection
|
||
|
|
IoWriteCrashDump
|
||
|
|
MiProtectVirtualMemory
|
||
|
|
NtAccessCheckAndAuditAlarm
|
||
|
|
NtCreateToken
|
||
|
|
NtQueryEaFile
|
||
|
|
KiNormalizeDouble
|
||
|
|
MiGatherMappedPages
|
||
|
|
RtlCreateHeap
|
||
|
|
MmLoadSystemImage
|
||
|
|
IopLoadDriver
|
||
|
|
PspCreateThread
|
||
|
|
NtDuplicateObject
|
||
|
|
NtLockVirtualMemory
|
||
|
|
NtAccessCheck
|
||
|
|
NtQueryVirtualMemory
|
||
|
|
NtQueryInformationProcess
|
||
|
|
RtlIsTextUnicode
|
||
|
|
NtQueryDirectoryFile
|
||
|
|
NtQueryObject
|
||
|
|
MiFindContiguousMemory
|
||
|
|
HvpAddBin
|
||
|
|
SeSetSecurityDescriptorInfo
|
||
|
|
MmAdjustWorkingSetSize
|
||
|
|
SepAdtOpenObjectAuditAlarm
|
||
|
|
SeCaptureSidAndAttributesArray
|
||
|
|
HvInitializeHive
|
||
|
|
KiDispatchException
|
||
|
|
NtOpenObjectAuditAlarm
|
||
|
|
LdrpSearchResourceSection_U
|
||
|
|
SepCreateToken
|
||
|
|
NtMapViewOfSection
|
||
|
|
MmShutdownSystem
|
||
|
|
KiNormalizeSingle
|
||
|
|
xHalIoWritePartitionTable
|
||
|
|
NtQueryInformationThread
|
||
|
|
VdmQueryDirectoryFile
|
||
|
|
MiDeletePte
|
||
|
|
xHalIoReadPartitionTable
|
||
|
|
CmpDoCreateChild
|
||
|
|
NtLockFile
|
||
|
|
MiLoadImageSection
|
||
|
|
MiMakeOutswappedPageResident
|
||
|
|
LZNT1CompressChunk
|
||
|
|
LpcRequestWaitReplyPort
|
||
|
|
NtSetSystemInformation
|
||
|
|
pIoQueryDeviceDescription
|
||
|
|
RtlConsoleMultiByteToUnicodeN
|
||
|
|
MmCreateProcessAddressSpace
|
||
|
|
IoCreateDevice
|
||
|
|
NtAdjustGroupsToken
|
||
|
|
NtAdjustPrivilegesToken
|
||
|
|
NtUnlockVirtualMemory
|
||
|
|
ExpSystemErrorHandler
|
||
|
|
CmpCheckKey
|
||
|
|
RtlGenerate8dot3Name
|
||
|
|
IopMountVolume
|
||
|
|
ObGetObjectInformation
|
||
|
|
CmRestoreKey
|
||
|
|
RtlpDeCommitFreeBlock
|
||
|
|
ExpGetProcessInformation
|
||
|
|
PspSetQuotaLimits
|
||
|
|
HvRefreshHive
|
||
|
|
NtQueryDirectoryObject
|
||
|
|
NtUnlockFile
|
||
|
|
KiEmulateReference
|
||
|
|
CmpInitializeHiveList
|
||
|
|
RtlQueryRegistryValues
|
||
|
|
NtSetEaFile
|
||
|
|
MiGatherPagefilePages
|
||
|
|
IoSetInformation
|
||
|
|
NtSetVolumeInformationFile
|
||
|
|
IopInitializeDumpDrivers
|
||
|
|
SepVariableInitialization
|
||
|
|
MmInitSystem
|
||
|
|
Phase1Initialization
|
||
|
|
IopCreateArcNames
|
||
|
|
IopInitializeDoubleSpace
|
||
|
|
ExpInitializeExecutive
|
||
|
|
RtlCreateUserProcess
|
||
|
|
IoInitSystem
|
||
|
|
IopAssignDoubleSpaceDriveLetters
|
||
|
|
ObInitSystem
|
||
|
|
PspInitPhase0
|
||
|
|
ObCreateObjectType
|
||
|
|
CmpAddDriverToList
|
||
|
|
KiSystemBegin
|
||
|
|
SeMakeSystemToken
|
||
|
|
KiInitializeKernel
|
||
|
|
CmInitSystem1
|
||
|
|
CmpInitializeRegistryNode
|
||
|
|
IopInitializeResourceMap
|
||
|
|
CcInitializeCacheManager
|
||
|
|
MiInitializeSystemCache
|
||
|
|
MiBuildPagedPool
|
||
|
|
CmGetSystemControlValues
|
||
|
|
MiSectionInitialization
|
||
|
|
RtlQueryEnvironmentVariable_U
|
||
|
|
CmpFindControlSet
|
||
|
|
CmGetSystemDriverList
|
||
|
|
IopCreateObjectTypes
|
||
|
|
IopInitializeBootDrivers
|
||
|
|
IopReassignSystemRoot
|
||
|
|
CreateSystemRootLink
|
||
|
|
CmpCloneControlSet
|
||
|
|
ExpWorkerInitialization
|
||
|
|
RtlpCreateStack
|
||
|
|
CmpSetupConfigurationTree
|
||
|
|
CmpFindDrivers
|
||
|
|
PsLocateSystemDll
|
||
|
|
KiInitSystem
|
||
|
|
IopApplySystemPartitionProt
|
||
|
|
SeRmInitPhase1
|
||
|
|
MmFreeLoaderBlock
|
||
|
|
CmpCreateControlSet
|
||
|
|
SepInitSystemDacls
|
||
|
|
InitializePool
|
||
|
|
MiFindInitializationCode
|
||
|
|
IopInitializeBuiltinDriver
|
||
|
|
CmpInitializeSystemHive
|
||
|
|
FsRtlGetCompatibilityModeValue
|
||
|
|
CmpSortDriverList
|
||
|
|
RawInitialize
|
||
|
|
FsRtlInitSystem
|
||
|
|
ExBurnMemory
|
||
|
|
IopMarkBootPartition
|
||
|
|
KeFindConfigurationNextEntry
|
||
|
|
CmpFindTagIndex
|
||
|
|
IopLookupGroupName
|
||
|
|
MiInitializeNonPagedPool
|
||
|
|
CmpCreateRegistryRoot
|
||
|
|
IopCreateRootDirectories
|
||
|
|
CmpInitializeHardwareConfiguration
|
||
|
|
MiMergeMemoryLimit
|
||
|
|
CmpCreateObjectTypes
|
||
|
|
MmInitializeMemoryLimits
|
||
|
|
CmpCreateRootNode
|
||
|
|
CmpInitializeRegistryNames
|
||
|
|
IopInitializeSystemDrivers
|
||
|
|
CmpDoSort
|
||
|
|
RtlCreateUserThread
|
||
|
|
LpcInitSystem
|
||
|
|
MiInitializeSystemPtes
|
||
|
|
SepInitializationPhase1
|
||
|
|
CmpIsLastKnownGoodBoot
|
||
|
|
LpcpInitializePortZone
|
||
|
|
SepInitializePrivilegeSets
|
||
|
|
LookupEntryPoint
|
||
|
|
IoReportHalResourceUsage
|
||
|
|
ExpInitSystemPhase1
|
||
|
|
CmpIsLoadType
|
||
|
|
CmpWalkPath
|
||
|
|
KiComputeReciprocal
|
||
|
|
RtlDeNormalizeProcessParams
|
||
|
|
IopProtectSystemPartition
|
||
|
|
SepTokenInitialization
|
||
|
|
IopCheckDependencies
|
||
|
|
CmpOrderGroup
|
||
|
|
ExpProfileInitialization
|
||
|
|
ExInitializeTimeRefresh
|
||
|
|
SepRmDbInitialization
|
||
|
|
ExpMutantInitialization
|
||
|
|
ExpTimerInitialization
|
||
|
|
ExpEventPairInitialization
|
||
|
|
CmpComputeGlobalQuotaAllowed
|
||
|
|
ExpInitializePoolDescriptor
|
||
|
|
ExpEventInitialization
|
||
|
|
ExpSemaphoreInitialization
|
||
|
|
IopCreateEntry
|
||
|
|
RtlpOpenImageFile
|
||
|
|
SepInitializationPhase0
|
||
|
|
FsRtlInitializeWorkerThread
|
||
|
|
CmpResolveDriverDependencies
|
||
|
|
PspInitializeSystemDll
|
||
|
|
IopInitializeAttributesAndCreateObject
|
||
|
|
IopRevertModuleList
|
||
|
|
PspLookupKernelUserEntryPoints
|
||
|
|
CcInitializeVacbs
|
||
|
|
ExInitializeHandleTablePackage
|
||
|
|
IopFreeGroupTree
|
||
|
|
CmpFreeDriverList
|
||
|
|
PsInitSystem
|
||
|
|
ExInitSystem
|
||
|
|
SeInitSystem
|
||
|
|
ExComputeTickCountMultiplier
|
||
|
|
ExpInitSystemPhase0
|
||
|
|
RtlpFreeStack
|
||
|
|
ExpResourceInitialization
|
||
|
|
ExLuidInitialization
|
||
|
|
ExpUuidInitialization
|
||
|
|
SepInitializeWorkList
|
||
|
|
PspInitPhase1
|
||
|
|
PspLookupSystemDllEntryPoint
|
||
|
|
KeFindConfigurationEntry
|
||
|
|
SepRmInitPhase0
|
||
|
|
ExInitSystemPhase2
|
||
|
|
MiEnablePagingTheExecutive
|