2391 lines
47 KiB
Plaintext
2391 lines
47 KiB
Plaintext
KeRaiseIrql
|
|
KeFlushIoBuffers
|
|
KeSynchronizeExecution
|
|
KeLeaveCriticalRegion
|
|
MiReleaseSystemPtes
|
|
KeInsertQueue
|
|
ExQueueWorkItem
|
|
CcPostWorkQueue
|
|
CcGetVirtualAddress
|
|
CcMdlRead
|
|
CcMapAndRead
|
|
KeRemoveQueue
|
|
ExpWorkerThread
|
|
KeSetEvent
|
|
MiInsertPageInList
|
|
CcFreeVirtualAddress
|
|
CcPinMappedData
|
|
CcFreeActiveVacb
|
|
CcPrepareMdlWrite
|
|
MmUnmapLockedPages
|
|
KeFlushSingleTb
|
|
MiDeleteSystemPagableVm
|
|
PspDereferenceEventPair
|
|
KeInsertHeadQueue
|
|
IofCompleteRequest
|
|
FsRtlProcessFileLock
|
|
KeWaitForSingleObject
|
|
CcCanIWrite
|
|
ExAcquireFastMutexUnsafe
|
|
MmProbeAndLockPages
|
|
CcUnpinFileData
|
|
CcReleaseByteRangeFromWrite
|
|
CcUnpinDataForThread
|
|
ExpAcquireResourceSharedLite
|
|
PsChargePoolQuota
|
|
MiInsertVad
|
|
IopDeleteFile
|
|
FsRtlPrivateCheckWaitingLocks
|
|
CmpInitializeMachineDependentConfiguration
|
|
_amsg_exit
|
|
_isctype
|
|
PspDeleteVdmObjects
|
|
PspDeleteLdt
|
|
PspInitializeThreadSecurity
|
|
PsIsThreadTerminating
|
|
PoRegisterDeviceForIdleDetection
|
|
PoQueryPowerSequence
|
|
RtlNumberGenericTableElements
|
|
RtlCaptureStackBackTrace
|
|
RtlAssert
|
|
MmUnsecureVirtualMemory
|
|
MmIsThisAnNtAsSystem
|
|
MmQuerySystemSize
|
|
KiSuspendNop
|
|
KeSwitchFrozenProcessor
|
|
KiFreezeTargetExecution
|
|
KiRestoreProcessorState
|
|
ZwWriteVirtualMemory
|
|
ZwWriteFile
|
|
ZwWaitForSingleObject
|
|
ZwUnmapViewOfSection
|
|
ZwUnloadDriver
|
|
ZwTerminateProcess
|
|
ZwShutdownSystem
|
|
ZwSetValueKey
|
|
ZwSetTimerResolution
|
|
ZwSetTimer
|
|
ZwSetSystemTime
|
|
ZwSetSystemInformation
|
|
ZwSetSecurityObject
|
|
ZwSetInformationThread
|
|
ZwSetInformationProcess
|
|
ZwSetInformationFile
|
|
ZwSetEvent
|
|
ZwSetDefaultLocale
|
|
ZwSaveKey
|
|
ZwResumeThread
|
|
ZwRestoreKey
|
|
ZwResetEvent
|
|
ZwRequestWaitReplyPort
|
|
ZwReplyWaitReceivePort
|
|
ZwReadFile
|
|
ZwRaiseHardError
|
|
ZwRaiseException
|
|
ZwQueryVolumeInformationFile
|
|
ZwQueryValueKey
|
|
ZwQuerySystemInformation
|
|
ZwQuerySymbolicLinkObject
|
|
ZwQuerySecurityObject
|
|
ZwQuerySection
|
|
ZwQueryObject
|
|
ZwQueryKey
|
|
ZwQueryInformationToken
|
|
ZwQueryInformationProcess
|
|
PsChargeSharedPoolQuota
|
|
ObpChargeQuotaForObject
|
|
IoAllocateMdl
|
|
KeCancelTimer
|
|
PsReturnSharedPoolQuota
|
|
PsReturnPoolQuota
|
|
MiRemoveVad
|
|
KeInsertQueueApc
|
|
MmMapViewInSystemCache
|
|
KeResetEvent
|
|
CcSetDirtyPinnedData
|
|
CcPreparePinWrite
|
|
FsRtlFastUnlockSingle
|
|
MmUnlockPages
|
|
ExDeleteResourceLite
|
|
MmSetAddressRangeModified
|
|
FsRtlPrivateCancelFileLockIrp
|
|
FsRtlFastCheckLockForRead
|
|
FsRtlCheckLockForReadAccess
|
|
MiUnlockPagedAddress
|
|
MmUnmapViewInSystemCache
|
|
CcUnmapVacb
|
|
IoAcquireCancelSpinLock
|
|
CcPinFileData
|
|
CcPinRead
|
|
FsRtlPrivateLock
|
|
CcUninitializeCacheMap
|
|
MmFlushSection
|
|
IoStartPacket
|
|
ExpAcquireResourceExclusiveLite
|
|
MmCheckCachedPageState
|
|
MiFlushSectionInternal
|
|
KiDeliverApc
|
|
KiApcInterrupt
|
|
ZwQueryInformationFile
|
|
ZwQueryDirectoryFile
|
|
ZwPulseEvent
|
|
ZwProtectVirtualMemory
|
|
ZwOpenThreadToken
|
|
ZwOpenThread
|
|
ZwOpenSymbolicLinkObject
|
|
ZwOpenSection
|
|
ZwOpenProcessToken
|
|
ZwOpenProcess
|
|
ZwOpenKey
|
|
ZwOpenFile
|
|
ZwOpenEvent
|
|
ZwOpenDirectoryObject
|
|
ZwNotifyChangeKey
|
|
ZwMapViewOfSection
|
|
ZwMakeTemporaryObject
|
|
ZwLoadDriver
|
|
ZwListenPort
|
|
ZwInitializeRegistry
|
|
ZwFsControlFile
|
|
ZwFreeVirtualMemory
|
|
ZwFlushKey
|
|
ZwFlushInstructionCache
|
|
CcSetDirtyInMask
|
|
MiGetInPageSupportBlock
|
|
KeSetEventBoostPriority
|
|
CcScheduleReadAhead
|
|
CcFreeWorkQueueEntry
|
|
KeSetTimer
|
|
CcScheduleLazyWriteScan
|
|
CcInitializeCacheMap
|
|
MiFreePoolPages
|
|
MiMakeSystemAddressValidPfn
|
|
CcFlushCache
|
|
CcWriteBehind
|
|
CcLazyWriteScan
|
|
MmAccessFault
|
|
KiVirtualMemoryDispatch
|
|
CcSetFileSizes
|
|
CcGetDirtyPages
|
|
CcMdlWriteComplete
|
|
MiCheckForControlAreaDeletion
|
|
ZwFlushBuffersFile
|
|
ZwEnumerateValueKey
|
|
ZwEnumerateKey
|
|
ZwDuplicateToken
|
|
ZwDuplicateObject
|
|
ZwDisplayString
|
|
ZwDeviceIoControlFile
|
|
ZwDeleteValueKey
|
|
ZwDeleteKey
|
|
ZwDeleteFile
|
|
ZwCreateTimer
|
|
ZwCreateThread
|
|
ZwCreateSymbolicLinkObject
|
|
ZwCreateSection
|
|
ZwCreateProcess
|
|
ZwCreatePort
|
|
ZwCreateKey
|
|
ZwCreateFile
|
|
ZwCreateEvent
|
|
ZwCreateDirectoryObject
|
|
ZwContinue
|
|
ZwConnectPort
|
|
ZwCompleteConnectPort
|
|
ZwCloseObjectAuditAlarm
|
|
ZwClose
|
|
CcAcquireByteRangeForWrite
|
|
MiGetEventCounter
|
|
MiAccessCheck
|
|
CcAllocateWorkQueueEntry
|
|
RtlPcToFileHeader
|
|
KePulseEvent
|
|
MiWaitForInPageComplete
|
|
MiAllocatePoolPages
|
|
MiEnsureAvailablePageOrWait
|
|
MiFlushInPageSupportBlock
|
|
KeWaitForMultipleObjects
|
|
FsRtlPrivateFastUnlockAll
|
|
FsRtlFastUnlockAll
|
|
KeReleaseSemaphore
|
|
MiChargeCommitmentCantExpand
|
|
CcGetVacbMiss
|
|
MmPurgeSection
|
|
CcUnmapAndPurge
|
|
FsRtlFastCheckLockForWrite
|
|
FsRtlCheckLockForWriteAccess
|
|
CcUnmapVacbArray
|
|
FsRtlAllocateFirstMapping
|
|
KeTestAlertThread
|
|
MmFlushImageSection
|
|
CcPerformReadAhead
|
|
MiSegmentDelete
|
|
ZwClearEvent
|
|
ZwAllocateVirtualMemory
|
|
ZwAlertThread
|
|
ZwAcceptConnectPort
|
|
KeReadStateSemaphore
|
|
KeReadStateQueue
|
|
KeReadStateEvent
|
|
KeSetDmaIoCoherency
|
|
KiAcquireSpinLock
|
|
KeFlushCurrentTb
|
|
KiSystemStartup
|
|
KdpGetStateChange
|
|
KdpSetLoadState
|
|
KdpPortUnlock
|
|
IoSetDeviceToVerify
|
|
IoGetFileObjectGenericMapping
|
|
xHalHandlerForBus
|
|
ExPostSystemEvent
|
|
ExNotifyCallback
|
|
ExUnregisterCallback
|
|
ExRegisterCallback
|
|
ExGetSharedWaiterCount
|
|
ExGetExclusiveWaiterCount
|
|
KeReadStateThread
|
|
ZwAccessCheckAndAuditAlarm
|
|
KeSetImportanceDpc
|
|
KeInitializeSpinLock
|
|
KeClearEvent
|
|
ZwQueryVirtualMemory
|
|
KiPassiveRelease
|
|
KeQueryTimeIncrement
|
|
FsRtlSyncVolumes
|
|
FsRtlInitializeOplock
|
|
IoGetConfigurationInformation
|
|
RtlSubAuthorityCountSid
|
|
RtlGetNtGlobalFlags
|
|
ObGetObjectPointerCount
|
|
SepRmSendCommandToLsaWrkr
|
|
ExSetHandleTableOwner
|
|
ExSetHandleTableOrdering
|
|
SeTraverseAuditAlarm
|
|
srand
|
|
NtSetLdtEntries
|
|
ExpAcquireSharedStarveExclusive
|
|
FsRtlFreeFastMutex
|
|
MiSectionDelete
|
|
MmCreateSection
|
|
ExInterlockedExtendZone
|
|
CcDeleteSharedCacheMap
|
|
KeFlushEntireTb
|
|
KeAttachProcess
|
|
ExpWaitForResource
|
|
KeReleaseWaitForSemaphore
|
|
MiMapPageInHyperSpace
|
|
MiProcessValidPteList
|
|
MmCopyToCachedPage
|
|
NtSetTimer
|
|
FsRtlAllocateFastMutex
|
|
MiCleanSection
|
|
MiDeleteVirtualAddresses
|
|
CcGetLsnForFileObject
|
|
MiDereferenceSegmentThread
|
|
KiOutSwapKernelStacks
|
|
KeDetachProcess
|
|
KeAlertResumeThread
|
|
FsRtlFreeFirstMapping
|
|
MiResolveDemandZeroFault
|
|
MiRemoveMappedView
|
|
KeStartProfile
|
|
MmCanFileBeTruncatedInternal
|
|
PspQueryDescriptorThread
|
|
PspSetLdtInformation
|
|
PspSetLdtSize
|
|
PspQueryLdtInformation
|
|
PspMarkCidInvalid
|
|
DebugUnLoadImageSymbols
|
|
DebugLoadImageSymbols
|
|
KiTryToAcquireSpinLock
|
|
KiFlushFixedTb
|
|
IoSetHardErrorOrVerifyDevice
|
|
IoGetTopLevelIrp
|
|
xHalSuspendHibernateSystem
|
|
CcGetFileObjectFromBcb
|
|
PoRequestPowerChange
|
|
IoSetTopLevelIrp
|
|
ExpGetPoolInformation
|
|
ExCreateCallback
|
|
xHalQuerySystemInformation
|
|
xHalSetSystemInformation
|
|
xHalQueryBusSlots
|
|
RtlLengthRequiredSid
|
|
RtlCompressWorkSpaceSizeNS
|
|
RtlCompressBufferNS
|
|
RtlDecompressBufferNS
|
|
RtlDecompressFragmentNS
|
|
NtEnumerateBus
|
|
NtGetPlugPlayEvent
|
|
NtPlugPlayControl
|
|
NtRegisterNewDevice
|
|
CmpSetGlobalQuotaAllowed
|
|
NtSetSystemPowerState
|
|
xHalRegisterBusHandler
|
|
KiGetUserModeStackAddress
|
|
KiInterruptTemplate
|
|
FsRtlInitProcessorLockQueue
|
|
RtlAreAllAccessesGranted
|
|
CmSetRegistryQuotaInformation
|
|
CmpCompressedNameSize
|
|
_flswbuf
|
|
_flsbuf
|
|
RtlConvertLongToLargeInteger
|
|
MmCreateKernelStack
|
|
MiCheckControlAreaStatus
|
|
KeConnectInterrupt
|
|
KiScanReadyQueues
|
|
MiRemoveUnusedSegments
|
|
KiContinueClientWait
|
|
KeInitializeThread
|
|
FsRtlUninitializeFileLock
|
|
KeSwapProcessOrStack
|
|
IopTimerDispatch
|
|
MmUnlockCachedPage
|
|
KiInSwapKernelStacks
|
|
MiDoesPdeExistAndMakeValid
|
|
MmAllowWorkingSetExpansion
|
|
KeSetPriorityThread
|
|
KiReleaseSpinLock
|
|
DebugPrint
|
|
MmGetCrashDumpStateInformation
|
|
KeSetCacheErrorRoutine
|
|
CcSetLogHandleForFile
|
|
PfxInitialize
|
|
RtlCopyLuid
|
|
PspSetProcessIoHandlers
|
|
RtlInitializeUnicodePrefix
|
|
_fptrap
|
|
atoi
|
|
_stricmp
|
|
ObDereferenceObject
|
|
RtlRaiseStatus
|
|
RtlRaiseException
|
|
RtlEnlargedUnsignedMultiply
|
|
RtlEnlargedIntegerMultiply
|
|
DebugPrompt
|
|
MiRemoveBasedSection
|
|
MiInsertBasedSection
|
|
MmFreeContiguousMemory
|
|
IoCallDriver
|
|
IoReleaseVpbSpinLock
|
|
FsRtlPostPagingFileStackOverflow
|
|
FsRtlPostStackOverflow
|
|
FsRtlNumberOfRunsInMcb
|
|
ExRaiseStatus
|
|
ExRaiseException
|
|
IoDeleteController
|
|
IopUserRundown
|
|
LdrAccessResource
|
|
SeFreePrivileges
|
|
CmQueryRegistryQuotaInformation
|
|
FsRtlUninitializeMcb
|
|
CmpLazyFlushDpcRoutine
|
|
ObDestroyHandleProcedure
|
|
RtlLargeIntegerNegate
|
|
MiFindEmptySectionBaseDown
|
|
KiCopyInformation
|
|
KiRestoreInterrupts
|
|
KiDisableInterrupts
|
|
KiCacheError
|
|
IoCompleteRequest
|
|
_purecall
|
|
ExAllocatePool
|
|
ExOkayToLockRoutine
|
|
ExReleaseResourceStub
|
|
ExRaiseAccessViolation
|
|
ExRaiseDatatypeMisalignment
|
|
NtSetIntervalProfile
|
|
FsRtlCompletionRoutinePriv
|
|
RtlpDestroyUnCommittedRange
|
|
PsGetProcessExitTime
|
|
SeDeassignPrimaryToken
|
|
ExUnlockUserBuffer
|
|
ObpValidateDesiredAccess
|
|
KeReleaseMutex
|
|
KeSweepDcache
|
|
IoIsSystemThread
|
|
IoGetAttachedDevice
|
|
ExpDeleteMutant
|
|
ExSystemExceptionFilter
|
|
KeReturnToFirmware
|
|
IoQueryVolumeInformation
|
|
IopDeallocateApc
|
|
KdpComputeChecksum
|
|
strchr
|
|
SepInitializePrivilegeFilter
|
|
RtlpExecuteEmHandlerForUnwind
|
|
RtlpExecuteEmHandlerForException
|
|
RtlLargeIntegerSubtract
|
|
RtlLargeIntegerAdd
|
|
MmSizeOfMdl
|
|
KiSquareRootSingle
|
|
KeFreezeExecution
|
|
KeBugCheck
|
|
KeSetTimeIncrement
|
|
KeQueryTickCount
|
|
KdpReboot
|
|
KdpQueryPerformanceCounter
|
|
FsRtlFastUnlockAllByKey
|
|
ExInterlockedIncrementLong
|
|
ExInterlockedDecrementLong
|
|
ExpAllocatePoolWithQuotaHandler
|
|
IoQueryFileInformation
|
|
IopDeleteDriver
|
|
NtFlushWriteBuffer
|
|
LdrFindResource_U
|
|
RtlpInitUpcaseTable
|
|
ObMakeTemporaryObject
|
|
SepRmComponentTestCommandWrkr
|
|
SepAdtInitializePhase1
|
|
CmpFree
|
|
KdpQuickMoveMemory
|
|
NtSetHighWaitLowThread
|
|
ObDeassignSecurity
|
|
DbgUnLoadImageSymbols
|
|
MmReturnPoolQuota
|
|
IopFreeDosDevicesProtection
|
|
ExAcquireResourceStub
|
|
NtSetLowWaitHighThread
|
|
ExpTimeZoneWork
|
|
IopUserCompletion
|
|
RtlFreeAnsiString
|
|
RtlpGetTimeZoneInfoHandle
|
|
RtlNtStatusToDosError
|
|
RtlAcquirePebLock
|
|
RtlReleasePebLock
|
|
PsCreateSystemProcess
|
|
wcslen
|
|
LsaFreeReturnBuffer
|
|
PspDeleteProcessSecurity
|
|
RtlpGetStackLimits
|
|
RtlpGetExtraStuffPointer
|
|
MmIsNonPagedSystemAddressValid
|
|
KiInterruptHandler
|
|
IoAcquireVpbSpinLock
|
|
FsRtlNormalizeNtstatus
|
|
ExpTimeZoneDpcRoutine
|
|
ExpTimeRefreshDpcRoutine
|
|
KiSquareRootDouble
|
|
KiSuspendThread
|
|
IopReadyDeviceObjects
|
|
RtlxUnicodeStringToAnsiSize
|
|
RtlxUnicodeStringToOemSize
|
|
RtlxAnsiStringToUnicodeSize
|
|
RtlxOemStringToUnicodeSize
|
|
SepIdAssignableAsOwner
|
|
HvpGetCellFlat
|
|
KdpCauseBugCheck
|
|
ObInitProcess2
|
|
RtlInitializeGenericTable
|
|
RtlSetAllBits
|
|
RtlClearAllBits
|
|
MiDownPfnReferenceCount
|
|
MiRemoveImageHeaderPage
|
|
KeProfileInterrupt
|
|
KeReadyThread
|
|
KeInitializeMutex
|
|
KeSweepIcache
|
|
IopApcHardError
|
|
FsRtlNotifyUninitializeSync
|
|
HvGetCellSize
|
|
wcscpy
|
|
rand
|
|
ObpAcquireDescriptorCacheReadLock
|
|
KiSaveProcessorState
|
|
IopInvalidDeviceRequest
|
|
KeInitializeTimer
|
|
FsRtlCheckForMatchingFileObject
|
|
MiChangeNoAccessForkPte
|
|
PspNullSpecialApc
|
|
ObDupHandleProcedure
|
|
MiUpForkPageShareCount
|
|
MiGetFirstNode
|
|
MmSetMemoryPriorityProcess
|
|
KiDisplayString
|
|
IopExceptionFilter
|
|
FsRtlIsTotalDeviceFailure
|
|
FsRtlAllocatePoolWithQuotaTag
|
|
CcCopyReadExceptionFilter
|
|
RtlAbsoluteToSelfRelativeSD
|
|
RtlCheckRegistryKey
|
|
RtlCreateRegistryKey
|
|
CmpLazyFlushWorker
|
|
CmpTryLockRegistryExclusive
|
|
PspUnhandledExceptionInSystemThread
|
|
RtlCreateUnicodeStringFromAsciiz
|
|
LpcpClosePort
|
|
KeDisableApcQueuingThread
|
|
KdpPageInData
|
|
FsRtlAllocatePoolWithQuota
|
|
PspDeleteThreadSecurity
|
|
IopAbortRequest
|
|
ChkSum
|
|
SeReleaseSid
|
|
SeReleaseAcl
|
|
SeReleaseLuidAndAttributesArray
|
|
SeReleaseSidAndAttributesArray
|
|
CmpFileSetSize
|
|
CmpDestroyTemporaryHive
|
|
strcmp
|
|
_strupr
|
|
_strlwr
|
|
RtlpUnwindHandler
|
|
RtlFindSetBitsAndClear
|
|
MiDeleteFreeVm
|
|
MiTakePageFromWorkingSet
|
|
IopChecksum
|
|
IopErrorLogDpc
|
|
KeEnableApcQueuingThread
|
|
FsRtlpSetSymbolicLink
|
|
FsRtlNotifyReportChange
|
|
MiGetImageProtection
|
|
SepRmCreateLogonSessionWrkr
|
|
SepRmDeleteLogonSessionWrkr
|
|
SepAdtValidateAuditBounds
|
|
CmShutdownSystem
|
|
CmpQuotaWarningWorker
|
|
KdpSendControlPacket
|
|
ObpReferenceSecurityDescriptor
|
|
iswctype
|
|
RtlInitAnsiString
|
|
RtlInitString
|
|
KeSetAutoAlignmentThread
|
|
KeSetAutoAlignmentProcess
|
|
KeBusError
|
|
KeInitializeDeviceQueue
|
|
KdpWriteControlSpace
|
|
FsRtlIsNtstatusExpected
|
|
MiUnloadSystemImageByForce
|
|
RtlInitNlsTables
|
|
CmpRefreshWorkerRoutine
|
|
fputwc
|
|
wcschr
|
|
memchr
|
|
ObAuditInheritedHandleProcedure
|
|
RtlLargeIntegerShiftRight
|
|
RtlLargeIntegerShiftLeft
|
|
DbgPrint
|
|
MiUpControlAreaRefs
|
|
MiRemovePageFromWslNoPfn
|
|
MiMapCacheExceptionFilter
|
|
KiInterruptDispatchRaise
|
|
KiTrapDispatch
|
|
KiIntegerOverflowDispatch
|
|
KiInstructionBusErrorDispatch
|
|
KiIllegalInstructionDispatch
|
|
KiDataBusErrorDispatch
|
|
KiCoprocessorUnusableDispatch
|
|
FsRtlStackOverflowRead
|
|
KeLowerIrql
|
|
MiDispatchFault
|
|
MiDecrementShareCount2
|
|
MiRestoreTransitionPte
|
|
MiRemovePageFromList
|
|
MiRemoveZeroPage
|
|
MiCheckControlArea
|
|
MiResolveTransitionFault
|
|
IoReleaseCancelSpinLock
|
|
MmZeroPageThread
|
|
MmCanFileBeTruncated
|
|
ExUnlockPool
|
|
KiInterruptDispatchSame
|
|
ExInterlockedRemoveHeadList
|
|
ExInterlockedInsertHeadList
|
|
CcGetFileObjectFromSectionPtrs
|
|
CmpFreePostBlock
|
|
CmpSearchOpenWorker
|
|
CmpReleaseGlobalQuota
|
|
MiGetExceptionInfo
|
|
NtOpenFile
|
|
CmpCreateTemporaryHive
|
|
mblen
|
|
isprint
|
|
isspace
|
|
isxdigit
|
|
isdigit
|
|
islower
|
|
isupper
|
|
_itoa
|
|
RtlAddressInSectionTable
|
|
MiDownShareCountFlushEntireTb
|
|
MiUpCloneProtoRefCount
|
|
KiComputeWaitInterval
|
|
KiBugCheckDispatch
|
|
KiBreakpointDispatch
|
|
KdpStub
|
|
IopErrorLogRequeueEntry
|
|
ExLockPool
|
|
NtDeviceIoControlFile
|
|
KeAddSystemServiceTable
|
|
NtReadRequestData
|
|
NtWriteRequestData
|
|
RtlpDestroyHeapSegment
|
|
RtlCompressWorkSpaceSizeLZNT1
|
|
NtVdmControl
|
|
CmpFindKeyControlBlock
|
|
SeImpersonateClient
|
|
PspInitializeProcessSecurity
|
|
KiSelectNextThread
|
|
KeThawExecution
|
|
KdpSwitchProcessor
|
|
IoStopTimer
|
|
ExpTimerDpcRoutine
|
|
ExDeleteResource
|
|
RtlMoveMemory
|
|
CcFastCopyRead
|
|
IopCompleteRequest
|
|
ExpFindCurrentThread
|
|
CcFastCopyWrite
|
|
CcMapAndCopy
|
|
RtlCopyUnicodeString
|
|
CcCopyRead
|
|
CcCopyWrite
|
|
RtlInsertElementGenericTable
|
|
FsRtlTruncateLargeMcb
|
|
FsRtlTruncateMcb
|
|
KeContextToKframes
|
|
RtlAppendStringToString
|
|
FsRtlAddLargeEntry
|
|
KeContextFromKframes
|
|
RtlpVirtualUnwind
|
|
ObpCompareSecurityDescriptors
|
|
IoEnqueueIrp
|
|
SeQuerySecurityAccessMask
|
|
CmpFileFlush
|
|
DbgkUnMapViewOfSection
|
|
KdpSendString
|
|
wctomb
|
|
wcscat
|
|
PspInheritQuota
|
|
ObEnumNewHandleProcedure
|
|
ObpSetHandleBit
|
|
MiUpPfnReferenceCount
|
|
CacheImageSymbols
|
|
KiSaveProcessorControlState
|
|
KeInitializeQueue
|
|
KeBugCheckUnicodeToAnsi
|
|
IoFreeController
|
|
IopRemoveTimerFromTimerList
|
|
FsRtlNotifySetCancelRoutine
|
|
CcSetDirtyPageThreshold
|
|
FsRtlNotifyChangeDirectory
|
|
RtlDeleteRegistryValue
|
|
PsCreateSystemThread
|
|
NtDeleteKey
|
|
CmpLazyFlush
|
|
NtWaitForProcessMutant
|
|
DbgLoadImageSymbols
|
|
MiRemoveWsleFromFreeList
|
|
MiGetSystemCacheSubsection
|
|
KiIpiGenericCall
|
|
KiTbMiss
|
|
IopGetMountFlag
|
|
FsRtlNotifyInitializeSync
|
|
IopGetModeInformation
|
|
MmPageEntireDriver
|
|
RtlValidAcl
|
|
RtlIntegerToUnicodeString
|
|
NtMakeTemporaryObject
|
|
SepSinglePrivilegeCheck
|
|
CmpDoFileSetSize
|
|
DbgkpResumeProcess
|
|
MiCaptureSystemPte
|
|
KeRemoveEntryDeviceQueue
|
|
KeTryToAttachProcess
|
|
KiFloatDispatch
|
|
IopErrorLogGetEntry
|
|
IopSetAttachedDevicePointer
|
|
IoRegisterDriverReinitialization
|
|
IopAllocateIrpCleanup
|
|
LpcpPrepareToWakeClient
|
|
PsEstablishWin32Callouts
|
|
NtAlertThread
|
|
RawInitializeVcb
|
|
SeAssignPrimaryToken
|
|
CmpDestroyHive
|
|
CmpNameSize
|
|
CmFlushKey
|
|
KdpRestoreBreakpoint
|
|
wcscmp
|
|
tolower
|
|
PsOpenTokenOfProcess
|
|
MiCheckPageFileMapping
|
|
MiUpdateImageHeaderPage
|
|
KiGetPhysicalAddress
|
|
KeRemoveQueueDpc
|
|
IopAllocateIrpMustSucceed
|
|
IopDecrementDeviceObjectRef
|
|
ExpProfileDelete
|
|
PsSetProcessPriorityByClass
|
|
RawQueryFsVolumeInfo
|
|
SeSetSecurityAccessMask
|
|
SepAppendDefaultDacl
|
|
CmpDoFlushAll
|
|
KdpWriteBreakpoint
|
|
wcscspn
|
|
MmDbgReadCheck
|
|
KeQueryIntervalProfile
|
|
KeInitializeMutant
|
|
KeDeregisterBugCheckCallback
|
|
IoStartTimer
|
|
IoDetachDevice
|
|
FsRtlRemoveLargeEntry
|
|
NtSetHighEventPair
|
|
IoRegisterShutdownNotification
|
|
RtlZeroMemory
|
|
ExInterlockedAddUlong
|
|
IopCheckVpbMounted
|
|
KeReleaseSpinLock
|
|
ObfDereferenceObject
|
|
FsRtlRemoveAndCompleteIrp
|
|
FsRtlOplockCleanup
|
|
FsRtlOplockBreakToII
|
|
PsRestoreImpersonation
|
|
ObpFreeObjectCreateInfo
|
|
ObpAllocateCreateInfoFromLookaside
|
|
MmGetCrashDumpInformation
|
|
RtlGetCompressionWorkSpaceSize
|
|
SePrivilegeObjectAuditAlarm
|
|
SepFreePrimaryGroup
|
|
CmpConfigureProcessors
|
|
CmpCloseKeyObject
|
|
CmpAllocate
|
|
CmpAllocateTag
|
|
SePrivilegeCheck
|
|
NtSetLowEventPair
|
|
strncmp
|
|
RtlSecondsSince1980ToTime
|
|
RtlEnlargedUnsignedDivide
|
|
MiInsertFrontModifiedNoWrite
|
|
MiIsPteDecommittedPage
|
|
KeQueryBasePriorityThread
|
|
KeFillFixedEntryTb
|
|
FsRtlGetNextMcbEntry
|
|
FsRtlRemoveMcbEntry
|
|
wcsncmp
|
|
RtlSetGroupSecurityDescriptor
|
|
HvpFillFileName
|
|
ExCreateHandleTable
|
|
NtReleaseProcessMutant
|
|
MiObtainFreePages
|
|
KeInitializeProfile
|
|
KiInstructionBusError
|
|
KdpPollBreakInWithPortLock
|
|
PspSystemThreadStartup
|
|
KiIdleLoop
|
|
IoCreateSymbolicLink
|
|
IoDeleteSymbolicLink
|
|
IoDisconnectInterrupt
|
|
NtListenPort
|
|
RtlSetOwnerSecurityDescriptor
|
|
RtlUpperString
|
|
PspThreadDelete
|
|
SeCopyClientToken
|
|
SeQueryAuthenticationIdToken
|
|
SepFreeDefaultDacl
|
|
HvpHeaderCheckSum
|
|
KdpReceiveString
|
|
CmpGetObjectSecurity
|
|
vsprintf
|
|
toupper
|
|
_strcmpi
|
|
RtlpRaiseException
|
|
MiWaitForForkToComplete
|
|
IopStartApcHardError
|
|
FsRtlPrivateInsertLockFind
|
|
LpcpFreePortClientSecurity
|
|
RtlMultiByteToUnicodeSize
|
|
ObGetHandleInformation
|
|
ObpInitSecurityDescriptorCache
|
|
RawQueryFsAttributeInfo
|
|
SepAppendPrimaryGroup
|
|
NtInitializeRegistry
|
|
CmpRemoveSecurityCellList
|
|
wcsrchr
|
|
RtlExtendedLargeIntegerDivide
|
|
KiFloatingDispatch
|
|
KeForceResumeThread
|
|
IopDeleteIoCompletion
|
|
IoInitializeIrp
|
|
IoAllocateController
|
|
NtWaitLowEventPair
|
|
NtWaitHighEventPair
|
|
NtSetLowWaitHighEventPair
|
|
NtSetHighWaitLowEventPair
|
|
IopOpenRegistryKey
|
|
KeInitializeProcess
|
|
LpcpInitializePortQueue
|
|
MiCrashDumpWorker
|
|
RtlCreateUnicodeString
|
|
RtlRandom
|
|
RawCleanup
|
|
SepQueryTypeString
|
|
NtQuerySystemTime
|
|
RtlSectionTableFromVirtualAddress
|
|
MiUnmapImageHeaderInHyperSpace
|
|
MmForceSectionClosed
|
|
KeSetIntervalProfile
|
|
KeFlushQueueApc
|
|
IopErrorLogQueueRequest
|
|
RtlUnicodeToMultiByteSize
|
|
RtlAnsiCharToUnicodeChar
|
|
RtlDecompressBuffer
|
|
ObKillProcess
|
|
SepQueryNameString
|
|
SepDequeueWorkItem
|
|
HvpGetCellMap
|
|
CmpFreeValue
|
|
KdpWriteVirtualMemory
|
|
KdpPageIn
|
|
_vsnprintf
|
|
RawCheckForDismount
|
|
RtlAppendAsciizToString
|
|
MmUnmapViewInSystemSpace
|
|
ExAcquireResourceExclusiveLite
|
|
FsRtlCopyWrite
|
|
FsRtlPrepareMdlWrite
|
|
ObpAcquireDescriptorCacheWriteLock
|
|
ObCheckObjectAccess
|
|
KiInterruptDistribution
|
|
ExIsResourceAcquiredSharedLite
|
|
RawQueryFsDeviceInfo
|
|
CmpCopyTree
|
|
MmDeleteTeb
|
|
_mbstrlen
|
|
_snprintf
|
|
KiProcessProfileList
|
|
IoBuildSynchronousFsdRequest
|
|
IoWriteErrorLogEntry
|
|
NtUnmapViewOfSection
|
|
RtlCompressBuffer
|
|
SepAssemblePrivileges
|
|
CmpValidateAlternate
|
|
NtQueryDefaultLocale
|
|
wcsstr
|
|
sprintf
|
|
_strnicmp
|
|
LsaCallAuthenticationPackage
|
|
PsSetCreateProcessNotifyRoutine
|
|
MmDisableModifiedWriteOfSection
|
|
MiGetPageForHeader
|
|
FsRtlWorkerThread
|
|
KeResumeThread
|
|
FsRtlCheckNotifyForDelete
|
|
CmpAllocatePoolWithQuota
|
|
CmpFlushNotify
|
|
CmpFreeKeyBody
|
|
CmpCheckCreateAccess
|
|
DbgkExitProcess
|
|
ExpGetHandleInformation
|
|
PspSetEventPair
|
|
RtlTimeToSecondsSince1980
|
|
KeRundownQueue
|
|
KiAddressErrorDispatch
|
|
LpcExitThread
|
|
RtlDecompressFragment
|
|
PspMapSystemDll
|
|
SepConcatenatePrivileges
|
|
CmpFreeSecurityDescriptor
|
|
CmpRemoveFromHiveFileList
|
|
HvAllocateCell
|
|
DbgkpSendApiMessage
|
|
ExpGetObjectInformation
|
|
KdEnterDebugger
|
|
KdExitDebugger
|
|
SeCheckAuditPrivilege
|
|
PspDereferenceQuota
|
|
ObValidateSecurityQuota
|
|
KiPcToFileHeader
|
|
IopRaiseInformationalHardError
|
|
ExExtendZone
|
|
RtlSetSaclSecurityDescriptor
|
|
RtlWriteRegistryValue
|
|
SepValidateAce
|
|
SeExchangePrimaryToken
|
|
SepInformLsaOfDeletedLogon
|
|
DbgkMapViewOfSection
|
|
RtlSetDaclSecurityDescriptor
|
|
PspAssignPrimaryToken
|
|
MmIsSystemAddressAccessable
|
|
MiMakePdeExistAndMakeValid
|
|
KeBoostPriorityThread
|
|
KeRemoveQueueApc
|
|
IoAttachDeviceByPointer
|
|
CcSetAdditionalCacheAttributes
|
|
ExConvertExclusiveToSharedLite
|
|
ExpCopyThreadInfo
|
|
LdrVerifyMappedImageMatchesChecksum
|
|
HvpDiscardBins
|
|
CmpCopyCompressedName
|
|
KdpDeleteBreakpoint
|
|
wcsncpy
|
|
LsaDeregisterLogonProcess
|
|
MmDbgWriteCheck
|
|
NtContinue
|
|
FsRtlpPostStackOverflow
|
|
CcIsThereDirtyData
|
|
ExpGetLockInformation
|
|
NtAllocateLocallyUniqueId
|
|
IoUnregisterFileSystem
|
|
CmpWorkerCommand
|
|
CmpCheckNotifyAccess
|
|
CmCheckRegistry
|
|
CmpCopyCell
|
|
KdpPrintString
|
|
SePrivilegedServiceAuditAlarm
|
|
strstr
|
|
ObSetSecurityDescriptorInfo
|
|
KeSetProcess
|
|
KdIsThisAKdTrap
|
|
NtSetDefaultHardErrorPort
|
|
NtQueryIntervalProfile
|
|
FsRtlpOpenDev
|
|
CmpClaimGlobalQuota
|
|
HvpGrowLog1
|
|
RawQueryInformation
|
|
mbtowc
|
|
strncpy
|
|
KeAcquireSpinLock
|
|
ExInterlockedPopEntryList
|
|
IoMakeAssociatedIrp
|
|
__ll_mul
|
|
KeInsertQueueDpc
|
|
ExReleaseResourceLite
|
|
ObReferenceObjectByHandle
|
|
PsOpenTokenOfThread
|
|
FsRtlCopyRead
|
|
FsRtlMdlRead
|
|
NtClose
|
|
NtWaitForMultipleObjects
|
|
PsLookupProcessThreadByCid
|
|
ObpReleaseDescriptorCacheLock
|
|
KiSaveVolatileFloatState
|
|
RtlCompareMemoryUlong
|
|
MiDoneWithThisPageGetAnother
|
|
MiInitializeSystemSpaceMap
|
|
KiThreadDispatch
|
|
KeSwitchKernelStack
|
|
IoCreateSynchronizationEvent
|
|
CmpCreatePredefined
|
|
KdpGetVersion
|
|
ObpCaptureHandleInformation
|
|
RtlEnumerateGenericTable
|
|
RtlCopyString
|
|
KeAlertThread
|
|
KeEnterKernelDebugger
|
|
IopCompletePageWrite
|
|
ExReleaseResourceForThread
|
|
CcWaitOnActiveCount
|
|
MiMakeSystemAddressValid
|
|
KeSuspendThread
|
|
FsRtlBalanceReads
|
|
IoInitializeTimer
|
|
IopErrorLogConnectPort
|
|
LpcpFreeConMsg
|
|
RawSetInformation
|
|
SeSinglePrivilegeCheck
|
|
CmpPostApc
|
|
HvpGrowLog2
|
|
strcpy
|
|
RawCompletionRoutine
|
|
ObpProcessRemoveObjectQueue
|
|
MmCreateMdl
|
|
KeThawAllThreads
|
|
KeRegisterBugCheckCallback
|
|
IopLoadFileSystemDriver
|
|
RtlComputeLfnChecksum
|
|
RawClose
|
|
SepFilterPrivilegeAudits
|
|
NtSaveKey
|
|
CmpPostApcRunDown
|
|
LsaLookupAuthenticationPackage
|
|
KiProbeEntryTb
|
|
ExpUuidSaveSequenceNumber
|
|
IoRegisterFsRegistrationChange
|
|
IoUnregisterFsRegistrationChange
|
|
MiLookupDataTableEntry
|
|
LZNT1FindMatchMaximum
|
|
VdmIsLegalFatName
|
|
KdpReadVirtualMemory
|
|
KdpSetContext
|
|
KdpReportExceptionStateChange
|
|
HvpAllocateMap
|
|
MiHandleBankedSection
|
|
KiInvalidCompareSingle
|
|
KiInvalidCompareDouble
|
|
FsRtlNotifyCompleteIrpList
|
|
FsRtlReleaseFile
|
|
ExpRaiseException
|
|
IoCreateUnprotectedSymbolicLink
|
|
IopGetRegistryValues
|
|
ExAcquireResourceSharedLite
|
|
KiDispatchInterrupt
|
|
IoGetDeviceToVerify
|
|
KiRetireDpcList
|
|
IoGetInitialStack
|
|
KiInsertQueue
|
|
ComputeNameLength
|
|
RtlGetAce
|
|
SeCheckPrivilegedObject
|
|
SepRmSetAuditEventWrkr
|
|
SepAdtCopyToLsaSharedMemory
|
|
NtFlushKey
|
|
CmSetLastWriteTimeKey
|
|
KdpMoveMemory
|
|
KdpDeleteBreakpointRange
|
|
swprintf
|
|
_snwprintf
|
|
RtlAppendUnicodeToString
|
|
MmAllocateContiguousMemory
|
|
FsRtlAcquireFileExclusive
|
|
RtlpAddData
|
|
SeGetTokenControlInformation
|
|
CmQueryKey
|
|
PsLookupProcessByProcessId
|
|
RtlAppendUnicodeStringToString
|
|
KeIpiInterrupt
|
|
KeSweepIcacheRange
|
|
NtDeleteFile
|
|
ExpTimerApcRoutine
|
|
IoUnregisterShutdownNotification
|
|
strcat
|
|
mbstowcs
|
|
KiWaitSatisfy
|
|
KiDataBusError
|
|
FsRtlCancelWaitIrp
|
|
IoGetDeviceObjectPointer
|
|
IopGetRegistryKeyInformation
|
|
RtlOpenCurrentUser
|
|
CmpDoFindSubKeyByNumber
|
|
KdpGetContext
|
|
NtDelayExecution
|
|
_wcsnicmp
|
|
PsLookupThreadByThreadId
|
|
MiCheckForContiguousMemory
|
|
KdPollBreakIn
|
|
IopFreeResourceDir
|
|
NtOpenDirectoryObject
|
|
NtOpenSymbolicLinkObject
|
|
CmpCopyName
|
|
DbgkpSectionHandleToFileHandle
|
|
ObpInsertDirectoryEntry
|
|
RtlLargeIntegerDivide
|
|
MmSecureVirtualMemory
|
|
MiLockPagedAddress
|
|
MiInitializeCopyOnWritePfn
|
|
MmGetPhysicalAddress
|
|
KiSystemServiceHandler
|
|
NtQueryTimerResolution
|
|
LdrpCompareResourceNames_U
|
|
RtlSetActiveTimeBias
|
|
CmpPostNotify
|
|
CmpSearchForOpenSubKeys
|
|
MmUnmapIoSpace
|
|
KiInvalidOperationLongword
|
|
NtCallbackReturn
|
|
IopExceptionCleanup
|
|
NtOpenSection
|
|
NtCreateProcess
|
|
RawFileSystemControl
|
|
CmpSearchKeyControlBlockTree
|
|
CmpDeleteTree
|
|
MmMapMemoryDumpMdl
|
|
KiDivideByZeroSingle
|
|
KiInSwapProcesses
|
|
NtQueryInformationPort
|
|
KiUnlockDispatcherDatabase
|
|
KeFlushMultipleTb
|
|
KiAttachProcess
|
|
RtlUnwind
|
|
__jump_unwind
|
|
HvSyncHive
|
|
HvpTruncateBins
|
|
NtRestoreKey
|
|
MmRaisePoolQuota
|
|
MiSetProtectionOnTransitionPte
|
|
MiGetProtoPteAddressExtended
|
|
MiMakeSystemAddressValidPfnWs
|
|
MiFlushEventCounter
|
|
IoReportResourceUsage
|
|
IoGetRelatedDeviceObject
|
|
IoSynchronousPageWrite
|
|
CcSetValidData
|
|
IoPageRead
|
|
ExInterlockedPushEntryList
|
|
IoFreeIrp
|
|
IoFreeMdl
|
|
CcMdlReadComplete
|
|
KeQuerySystemTime
|
|
MiLocateAndReserveWsle
|
|
MiAddValidPageToWorkingSet
|
|
IoGetCurrentProcess
|
|
PspExitNormalApc
|
|
RawQueryVolumeInformation
|
|
SeCloseObjectAuditAlarm
|
|
CmpAllocatePostBlock
|
|
CmpFindSubKeyByNumber
|
|
NtRegisterThreadTerminatePort
|
|
RtlNumberOfClearBits
|
|
MiFlushTbAndCapture
|
|
MiLocateSubsection
|
|
FsRtlCancelOplockIIIrp
|
|
PspReaper
|
|
IopCancelAlertedRequest
|
|
IopGetRegistryValue
|
|
LdrRelocateImage
|
|
NtQueryPerformanceCounter
|
|
NtCompleteConnectPort
|
|
PspTerminateThreadByPointer
|
|
SepAdtLogAuditRecord
|
|
ExChangeHandle
|
|
KiLookupFunctionEntry
|
|
KiChainedDispatch
|
|
ExInitializeZone
|
|
CcDeferWrite
|
|
ExpUuidLoadSequenceNumber
|
|
NtStopProfile
|
|
IopWriteResourceList
|
|
NtFlushInstructionCache
|
|
CmpFindChildByNumber
|
|
CmEnumerateKey
|
|
CmEnumerateValueKey
|
|
KeRundownThread
|
|
ExpAddTagForBigPages
|
|
RawReadWriteDeviceControl
|
|
CmUnloadKey
|
|
KeUserModeCallback
|
|
ExInitializeResource
|
|
KiOutSwapProcesses
|
|
NtOpenEvent
|
|
NtOpenEventPair
|
|
NtOpenMutant
|
|
NtOpenSemaphore
|
|
NtOpenTimer
|
|
IoAttachDevice
|
|
NtOpenIoCompletion
|
|
NtSetIoCompletion
|
|
NtAlertResumeThread
|
|
NtResumeThread
|
|
KdpSetStateChange
|
|
ExpFindAndRemoveTagBigPages
|
|
IopCatagorizeDescriptors
|
|
SeSubProcessToken
|
|
IopCheckUnloadDriver
|
|
SeAuditHandleCreation
|
|
DbgkForwardException
|
|
KdpRestoreBreakPointEx
|
|
RtlEqualString
|
|
NtW32Call
|
|
IopCompleteDriverUnload
|
|
KeInitializeEvent
|
|
ExReinitializeResourceLite
|
|
MiChargeCommitment
|
|
FsRtlWaitOnIrp
|
|
FsRtlInitializeLargeMcb
|
|
KiReadEntryTb
|
|
SwapContext
|
|
KxUnlockDispatcherDatabase
|
|
KiSetServerWaitClientEvent
|
|
NtQueryAttributesFile
|
|
FsRtlDeregisterUncProvider
|
|
SepMakeTokenEffectiveOnly
|
|
PsWatchWorkingSet
|
|
MiCauseOverCommitPopup
|
|
KiCallUserMode
|
|
IopFreeIrpAndMdls
|
|
FsRtlpRegisterProviderWithMUP
|
|
RtlInitCodePageTable
|
|
NtQueryKey
|
|
ExpCopyProcessInfo
|
|
RtlPrefixString
|
|
MiLookupWsleHashIndex
|
|
MiRemoveFromSystemSpace
|
|
KiIpiProcessRequests
|
|
KiSwapProcess
|
|
NtOpenProcessToken
|
|
CmpCreatePerfKeys
|
|
PfxRemovePrefix
|
|
RtlCopySidAndAttributesArray
|
|
RtlNumberOfSetBits
|
|
KeFreezeAllThreads
|
|
ExQueryPoolUsage
|
|
KiDivideByZeroDouble
|
|
IoCheckEaBufferValidity
|
|
IoCreateController
|
|
IopLoadUnloadDriver
|
|
SeObjectReferenceAuditAlarm
|
|
NtEnumerateKey
|
|
NtEnumerateValueKey
|
|
HvMarkCellDirty
|
|
IoCancelThreadIo
|
|
KiUnpackSingle
|
|
FsRtlDissectDbcs
|
|
CmpLinkKeyToHive
|
|
CmpCheckRegistry2
|
|
RtlGetCallersAddress
|
|
FsRtlCancelExclusiveIrp
|
|
NtPulseEvent
|
|
IopGetResourceReqRegistryValue
|
|
CmpQueryKeyName
|
|
KiContinue
|
|
RawMountVolume
|
|
CmpValidateHiveSecurityDescriptors
|
|
ExLockUserBuffer
|
|
RtlFindFirstRunClear
|
|
FsRtlSetFileSize
|
|
IopFindCollisionInTList
|
|
SepRmCommandServerThread
|
|
MiPageFileFull
|
|
RtlFindMessage
|
|
NtCreateDirectoryObject
|
|
IofCallDriver
|
|
SepDeleteLogonSessionTrack
|
|
KeSetBasePriorityThread
|
|
CmBootLastKnownGood
|
|
NtSetInformationKey
|
|
CmpReportNotify
|
|
ExpGetPoolTagInfo
|
|
__ull_divrem_6416
|
|
__ull_rem
|
|
MiFreeInitializationCode
|
|
SepDeReferenceLogonSession
|
|
SepQueueWorkItem
|
|
CmpInitHiveFromFile
|
|
__ull_div
|
|
KeSetSystemTime
|
|
IoAsynchronousPageWrite
|
|
KiInitializeUserApc
|
|
NtCreateEventPair
|
|
IoDeleteDevice
|
|
RtlNextUnicodePrefix
|
|
RtlAllocateAndInitializeSid
|
|
CmpLinkHiveToMaster
|
|
CmpRefreshHive
|
|
PspProcessDelete
|
|
RtlCompareString
|
|
MiInitializeTransitionPfn
|
|
CcUnpinRepinnedBcb
|
|
NtShutdownSystem
|
|
NtCreateMutant
|
|
NtCreateIoCompletion
|
|
MmCheckSystemImage
|
|
RtlResetRtlTranslations
|
|
RtlDestroyHeap
|
|
HvpIsFreeNeighbor
|
|
HvMarkClean
|
|
MiEmptyWorkingSet
|
|
NtReplaceKey
|
|
CmNotifyRunDown
|
|
MmDbgTranslatePhysicalAddress
|
|
IopDropIrp
|
|
RtlUpcaseUnicodeStringToAnsiString
|
|
RtlUnicodeStringToOemString
|
|
LdrProcessRelocationBlock
|
|
NtSetInformationObject
|
|
SepAdtInitializeBounds
|
|
NtSystemDebugControl
|
|
RtlFindFirstRunSet
|
|
KiInitializeContextThread
|
|
ExpTimeRefreshWork
|
|
CmpFileRead
|
|
HvpGetLogHeader
|
|
ExAllocatePoolWithTag
|
|
IoAllocateIrp
|
|
PsImpersonateClient
|
|
ObGetObjectSecurity
|
|
ExAllocatePoolWithQuota
|
|
CcAllocateInitializeBcb
|
|
FsRtlAllocatePoolWithTag
|
|
CcCreateVacbArray
|
|
ExpAllocateStringRoutine
|
|
ExAllocatePoolWithQuotaTag
|
|
FsRtlAllocatePool
|
|
FsRtlPrivateInitializeFileLock
|
|
NtExtendSection
|
|
RtlAnsiStringToUnicodeString
|
|
RtlOemStringToCountedUnicodeString
|
|
RtlpQueryRegistryDirect
|
|
ObQueryTypeInfo
|
|
MiSetPageModified
|
|
MiExtendPagingFiles
|
|
MiRemovePageFromWorkingSet
|
|
FsRtlPrivateCheckForSharedLockAccess
|
|
MmUnlockPagableImageSection
|
|
MmCopyVirtualMemory
|
|
PspQueryPooledQuotaLimits
|
|
IoQueryDeviceDescription
|
|
PfxFindPrefix
|
|
RtlCopyLuidAndAttributesArray
|
|
RtlDowncaseUnicodeString
|
|
SepCheckAcl
|
|
MiMapImageHeaderInHyperSpace
|
|
KiScanBugCheckCallbackList
|
|
ExTimerRundown
|
|
RtlCaptureContext
|
|
IoRegisterFileSystem
|
|
IopAcquireFileObjectLock
|
|
SepCreateLogonSessionTrack
|
|
CmpReportNotifyHelper
|
|
CmpFileWrite
|
|
HvpEnlistFreeCells
|
|
KdSetOwedBreakpoints
|
|
KeTerminateThread
|
|
NtReleaseMutant
|
|
SeAssignWorldSecurityDescriptor
|
|
CmpInsertSecurityCellList
|
|
ExEnumHandleTable
|
|
RtlpInsertUnCommittedPages
|
|
CcPostDeferredWrites
|
|
__ull_divrem_5353
|
|
NtCreateTimer
|
|
NtQueryIoCompletion
|
|
LpcpDeletePort
|
|
RawUserFsCtrl
|
|
SepValidOwnerSubjectContext
|
|
CmpCopyTree2
|
|
NtCreateEvent
|
|
NtQuerySecurityObject
|
|
RtlFormatCurrentUserKeyPath
|
|
CcZeroEndOfLastPage
|
|
RtlAddAuditAccessAce
|
|
NtSuspendThread
|
|
ExAcquireFastMutex
|
|
FsRtlLookupLargeMcbEntry
|
|
FsRtlLookupMcbEntry
|
|
PsReferenceImpersonationToken
|
|
FsRtlAddLargeMcbEntry
|
|
FsRtlAddMcbEntry
|
|
PsReferencePrimaryToken
|
|
FsRtlNumberOfRunsInLargeMcb
|
|
FsRtlGetNextLargeMcbEntry
|
|
FsRtlLookupLastLargeMcbEntry
|
|
FsRtlLookupLastMcbEntry
|
|
FsRtlRemoveLargeMcbEntry
|
|
PsReferenceEffectiveToken
|
|
PsDisableImpersonation
|
|
NtDeleteValueKey
|
|
NtUnloadKey
|
|
KdpPromptString
|
|
KdpAddBreakpoint
|
|
LsaLogonUser
|
|
NtQueryEvent
|
|
NtCreateMailslotFile
|
|
PspExitProcess
|
|
SepAdtGenerateDiscardAudit
|
|
MiAddMappedPtes
|
|
MiContractPagingFiles
|
|
KeStopProfile
|
|
KdpReadIoSpace
|
|
KdpReadControlSpace
|
|
NtCreateSemaphore
|
|
LpcpDestroyPortQueue
|
|
NtWriteVirtualMemory
|
|
RtlAddAce
|
|
KdpWriteBreakPointEx
|
|
LsaRegisterLogonProcess
|
|
ExAcquireResourceExclusive
|
|
NtQuerySemaphore
|
|
SeAppendPrivileges
|
|
CmpFreeKeyByCell
|
|
KdpReportLoadSymbolsStateChange
|
|
ObInitProcess
|
|
KiUnpackDouble
|
|
MmInPageKernelStack
|
|
KeReleaseMutant
|
|
IopGenNextValidResourceList
|
|
IopLookupBusStringFromID
|
|
SeCaptureSecurityQos
|
|
IopDisassociateThreadIrp
|
|
MmFreeNonCachedMemory
|
|
ExFreePool
|
|
IopHardErrorThread
|
|
FsRtlPrivateLimitFreeLockList
|
|
FsRtlUninitializeOplock
|
|
CcDeallocateBcb
|
|
IopDereferenceVpbAndFree
|
|
FsRtlRemoveAndCompleteWaitIrp
|
|
FsRtlUninitializeLargeMcb
|
|
ObReleaseObjectSecurity
|
|
ObpDeleteDirectoryEntry
|
|
RtlTimeToTimeFields
|
|
CcFindBcb
|
|
ElapsedDaysToYears
|
|
KiRestoreVolatileFloatState
|
|
NtCloseObjectAuditAlarm
|
|
HvReallocateCell
|
|
ExSetHandleExtraBit
|
|
IoRaiseHardError
|
|
HalpCreateDosLink
|
|
IopAssignResourcesPhase1
|
|
CmpRemoveKeyControlBlockWithLock
|
|
CmLoadKey
|
|
MmUnmapViewOfSection
|
|
MiIsEntireRangeCommitted
|
|
SepAdtInitializeCrashOnFail
|
|
KeSetPriorityProcess
|
|
FsRtlPrivateRemoveLock
|
|
ExpRemovePoolTracker
|
|
MiEnablePagingOfDriver
|
|
MmCreatePeb
|
|
KdpReceivePacketLeader
|
|
ObCheckCreateObjectAccess
|
|
NtSetSecurityObject
|
|
MiUpdateModifiedWriterMdls
|
|
MiUnlinkFreeOrZeroedPage
|
|
HvWriteHive
|
|
CmpAddToLeaf
|
|
MmFreeDriverInitialization
|
|
HalpCalculateChsValues
|
|
RtlCompressBufferLZNT1
|
|
MiCheckPurgeAndUpMapCount
|
|
NtQueryMutant
|
|
MmGetPageFileInformation
|
|
RtlQueryTimeZoneInformation
|
|
CmpSecurityMethod
|
|
KeBalanceSetManager
|
|
FsRtlGetFileSize
|
|
ExReleaseFastMutex
|
|
FsRtlOplockIsFastIoPossible
|
|
ObReferenceObjectByName
|
|
CmpAssignSecurityDescriptor
|
|
HvFreeHive
|
|
xHalExamineMBR
|
|
IopGetFileName
|
|
ExpInsertPoolTracker
|
|
SepAdtInitializePrivilegeAuditing
|
|
KeDisconnectInterrupt
|
|
PspQueryWorkingSetWatch
|
|
HalpGetRegistryCdromInformation
|
|
GetNextWchar
|
|
RtlMakeSelfRelativeSD
|
|
RtlFindLongestRunSet
|
|
RtlPrefixUnicodeString
|
|
MiFindEmptyAddressRangeInTree
|
|
MiDeleteAddressesInWorkingSet
|
|
MiReserveSystemPtes
|
|
MmMapLockedPages
|
|
KeEnterCriticalRegion
|
|
FsRtlPrivateCheckForExclusiveLockAccess
|
|
CcMapData
|
|
IoIsOperationSynchronous
|
|
FsRtlAcknowledgeOplockBreak
|
|
CcPurgeAndClearCacheSection
|
|
MmResetDriverPaging
|
|
PspQueryQuotaLimits
|
|
MmLockPagableDataSection
|
|
KiInvalidOperationSingle
|
|
CmpCopyValue
|
|
IopSortDescriptors
|
|
RtlpGetRegistryHandle
|
|
KdpWritePhysicalMemory
|
|
MiFlushDirtyBitsToPfn
|
|
PfxInsertPrefix
|
|
CmpFindMatchingDescriptorCell
|
|
NtReadVirtualMemory
|
|
__ll_rem
|
|
IopAssignResourcesPhase4
|
|
LdrpAccessResourceData
|
|
RtlValidSecurityDescriptor
|
|
HvFreeHivePartial
|
|
ObReferenceObjectByPointer
|
|
FsRtlRequestExclusiveOplock
|
|
FsRtlDoesNameContainWildCards
|
|
ExSystemTimeToLocalTime
|
|
SeTokenImpersonationLevel
|
|
PspAssignImpersonationToken
|
|
SeTokenType
|
|
RtlExtendedMagicDivide
|
|
RtlTimeToSecondsSince1970
|
|
ExQueryPoolBlockSize
|
|
RtlEqualUnicodeString
|
|
ObpLookupDirectoryEntry
|
|
ObpDeleteNameCheck
|
|
RtlCompareMemory
|
|
MiFlushPteList
|
|
KdpWriteIoSpace
|
|
KiRaiseException
|
|
MmDeleteProcessAddressSpace
|
|
NtSetValueKey
|
|
MmGetFileNameForSection
|
|
MiModifiedPageWriter
|
|
RtlUpperChar
|
|
HvCheckHive
|
|
__ll_div
|
|
MiTrimWorkingSet
|
|
RtlpInitializeHeapSegment
|
|
HvpDelistFreeCell
|
|
HvIsCellAllocated
|
|
RtlGetElementGenericTable
|
|
MmAllocateNonCachedMemory
|
|
atol
|
|
ObCheckTraverseAccess
|
|
MiMappedPageWriter
|
|
NtQueryTimer
|
|
IoPageFileCreated
|
|
RtlpQuerySecurityDescriptor
|
|
ObCheckObjectReference
|
|
MmMapIoSpace
|
|
LpcpExtendPortZone
|
|
RtlSetTimeZoneInformation
|
|
MiCreatePebOrTeb
|
|
NtCancelTimer
|
|
MmUnloadSystemImage
|
|
CcExceptionFilter
|
|
CcWorkerThread
|
|
IoBuildPartialMdl
|
|
strlen
|
|
FsRtlDissectName
|
|
KiUnwaitThread
|
|
KiInsertQueueApc
|
|
KiWaitTest
|
|
KiActivateWaiterQueue
|
|
CcUnpinData
|
|
RtlConvertUlongToLargeInteger
|
|
KiSwapThreadExit
|
|
CmpInterlockedFunction
|
|
KeSetAffinityThread
|
|
FsRtlRequestOplockII
|
|
SeCaptureLuidAndAttributesArray
|
|
CmpAddToHiveFileList
|
|
HvMarkDirty
|
|
KiReadyThread
|
|
KiSetPriorityThread
|
|
RtlNtStatusToDosErrorNoTeb
|
|
ExInterlockedInsertTailList
|
|
ExInitializeResourceLite
|
|
SepSidInToken
|
|
SepTokenIsOwner
|
|
FsRtlAreNamesEqual
|
|
CmpGetSymbolicLink
|
|
NtQueryValueKey
|
|
NtImpersonateThread
|
|
IoBuildAsynchronousFsdRequest
|
|
RawDispatch
|
|
ExReleaseFastMutexUnsafe
|
|
RtlOemToUnicodeN
|
|
RtlOemStringToUnicodeString
|
|
ObCreateObject
|
|
CmpDoOpen
|
|
IoCreateStreamFileObject
|
|
RtlUpcaseUnicodeChar
|
|
CmpCompareCompressedName
|
|
CmpDoCompareKeyName
|
|
CmpFindSubKeyInLeaf
|
|
CmpFindNameInList
|
|
FsRtlFindLargeIndex
|
|
FsRtlRemoveMcbEntryPrivate
|
|
RtlFindClearBits
|
|
RtlFindClearBitsAndSet
|
|
SepAuditFailed
|
|
MiHandleForkTransitionPte
|
|
IoGetRequestorProcess
|
|
RtlMapGenericMask
|
|
SeCreateAccessState
|
|
IoCheckDesiredAccess
|
|
ObpIncrementUnnamedHandleCount
|
|
SepApplyAclToObject
|
|
RtlpGenerateInheritedAce
|
|
RtlpGenerateInheritAcl
|
|
RtlpLengthInheritedAce
|
|
KiFlushSingleTb
|
|
RtlFreeUnicodeString
|
|
FsRtlIsNameInExpression
|
|
SeLockSubjectContext
|
|
SeAssignSecurity
|
|
ExCreateHandle
|
|
ObpCreateUnnamedHandle
|
|
ObpInsertUnnamedObject
|
|
SeReleaseSubjectContext
|
|
ObpFreeObject
|
|
ObpDecrementHandleCount
|
|
ObpCreateHandle
|
|
ObInsertObject
|
|
NtOpenThreadToken
|
|
ObOpenObjectByPointer
|
|
ExInterlockedAddLargeInteger
|
|
ExMapHandleToPointer
|
|
ExAcquireSharedStarveExclusive
|
|
FsRtlDoesDbcsContainWildCards
|
|
SeCaptureSubjectContext
|
|
IoRemoveShareAccess
|
|
CcSetReadAheadGranularity
|
|
KiUnexpectedInterrupt
|
|
IoAllocateAdapterChannel
|
|
SeUnlockSubjectContext
|
|
ExTryToAcquireResourceExclusiveLite
|
|
ObOpenObjectByName
|
|
IoCreateFile
|
|
NtCreateFile
|
|
IopOpenLinkOrRenameTarget
|
|
NtCreateNamedPipeFile
|
|
NtOpenKey
|
|
ObpCaptureObjectCreateInfo
|
|
RtlFreeOemString
|
|
ObpAllocateObject
|
|
SeAuditingFileEvents
|
|
ExIsResourceAcquiredExclusiveLite
|
|
IopParseDevice
|
|
IopParseFile
|
|
ObpRemoveObjectRoutine
|
|
FsRtlCheckOplock
|
|
MiDeleteValidAddress
|
|
RtlConvertSidToUnicodeString
|
|
MiCheckForUserStackOverflow
|
|
LZNT1FindMatchStandard
|
|
SeAuditProcessExit
|
|
CmSaveKey
|
|
IsValidOemCharacter
|
|
MmGrowKernelStack
|
|
MiFreeInPageSupportBlock
|
|
KeSetTargetProcessorDpc
|
|
ObpInsertHandleCount
|
|
ObpIncrementHandleDataBase
|
|
KeInsertDeviceQueue
|
|
xHalSlotControl
|
|
ExDestroyHandle
|
|
KeGetBugMessageText
|
|
MiUnmapLockedPagesInUserSpace
|
|
RtlpCreateUnCommittedRange
|
|
RtlExpandEnvironmentStrings_U
|
|
HvFreeCell
|
|
IoShutdownSystem
|
|
IopSlotResourceOwner
|
|
CmReplaceKey
|
|
MiGetSubsectionAndProtoFromPte
|
|
KiInvalidOperationDouble
|
|
KiTrapExit
|
|
CmpNotifyChangeKey
|
|
HvCheckBin
|
|
CcExtendVacbArray
|
|
MmIsAddressValid
|
|
MiLocateWsle
|
|
MiDecrementReferenceCount
|
|
RtlSplay
|
|
RtlDelete
|
|
RtlDeleteElementGenericTable
|
|
RtlLookupElementGenericTable
|
|
KeUpdateRunTime
|
|
KeUpdateSystemTime
|
|
SeDeleteAccessState
|
|
ObpCaptureObjectName
|
|
MmDeterminePoolType
|
|
KiComputeTimerTableIndex
|
|
KiInsertTreeTimer
|
|
FsRtlIsFatDbcsLegal
|
|
FsRtlCurrentBatchOplock
|
|
RtlLargeIntegerArithmeticShift
|
|
KiFlushMultipleTb
|
|
IopCloseFile
|
|
KeInitializeDpc
|
|
KeReadStateTimer
|
|
MiSetDirtyBit
|
|
_wcsicmp
|
|
FsRtlNotifyUpdateBuffer
|
|
NtFlushVirtualMemory
|
|
RawCreate
|
|
FsRtlNotifyCompleteIrp
|
|
RtlCharToInteger
|
|
KdpSendPacket
|
|
PspGetSetContextSpecialApc
|
|
MiCheckDosCalls
|
|
NtTerminateProcess
|
|
RtlpRestoreContext
|
|
RtlInsertUnicodePrefix
|
|
MiInsertPageFileInList
|
|
MmLockPagableSectionByHandle
|
|
NtSetTimerResolution
|
|
CmpMarkKeyDirty
|
|
KeInitializeApc
|
|
RtlRealSuccessor
|
|
IoCheckShareAccess
|
|
RtlFillMemoryUlong
|
|
CcGetVirtualAddressIfMapped
|
|
FsRtlIsNotifyOnList
|
|
ExInterlockedAddLargeStatistic
|
|
RtlUnicodeToMultiByteN
|
|
RtlUnicodeStringToAnsiString
|
|
RtlUpcaseUnicodeStringToOemString
|
|
ObpValidateAccessMask
|
|
HvpFreeMap
|
|
KiSystemServiceEventPair
|
|
RtlpInsertFreeBlock
|
|
CmpGetHiveName
|
|
RtlDecompressBufferLZNT1
|
|
PspGetContext
|
|
SepExamineSacl
|
|
KdpReadPhysicalMemory
|
|
IopPickupCollisionInTList
|
|
NtPrivilegeCheck
|
|
NtLoadDriver
|
|
KiEmulateBranch
|
|
HvpCoalesceDiscardedBins
|
|
RtlInitializeContext
|
|
HvpGetHiveHeader
|
|
MiInsertWsle
|
|
DbgkCreateThread
|
|
ObpIncrementHandleCount
|
|
SeAccessCheck
|
|
IoSetShareAccess
|
|
ExTryToAcquireFastMutex
|
|
NtSetInformationThread
|
|
SepAccessCheck
|
|
IoCancelIrp
|
|
ExLocalTimeToSystemTime
|
|
KeInitializeEventPair
|
|
FsRtlNotifyCleanup
|
|
KeFillEntryTb
|
|
MiCheckPdeForPagedPool
|
|
KiTimerExpiration
|
|
KiQuantumEnd
|
|
RtlUpcaseUnicodeToOemN
|
|
RtlUpcaseUnicodeStringToCountedOemString
|
|
KeRemoveDeviceQueue
|
|
MiUnlinkPageFromList
|
|
RtlSecondsSince1970ToTime
|
|
MiCheckProtoPtePageState
|
|
IoStartNextPacketByKey
|
|
LpcRequestPort
|
|
qsort
|
|
MiSetPagingOfDriver
|
|
CompareNamesCaseSensitive
|
|
SeCaptureSid
|
|
KiSetRegisterValue
|
|
ExSnapShotHandleTables
|
|
SePrivilegePolicyCheck
|
|
SepAdtCloseObjectAuditAlarm
|
|
CmpSplitLeaf
|
|
MiInsertInSystemSpace
|
|
MiResolvePageFileFault
|
|
IoVerifyVolume
|
|
IoConnectInterrupt
|
|
RtlRemoveUnicodePrefix
|
|
SepRmCallLsa
|
|
AllocateHandleTableEntries
|
|
MmDeleteKernelStack
|
|
NtCreateSection
|
|
MiSwapWslEntries
|
|
KiGetRegisterValue
|
|
MiUpdateWsle
|
|
SeCaptureAcl
|
|
KiFindReadyThread
|
|
ObpLookupObjectName
|
|
IoUpdateShareAccess
|
|
RtlSubAuthoritySid
|
|
RtlpContainsCreatorOwnerSid
|
|
RtlpContainsCreatorGroupSid
|
|
IoCheckFunctionAccess
|
|
IoStartNextPacket
|
|
RtlExtendedIntegerMultiply
|
|
DaysAndFractionToTime
|
|
CmpFindSubKeyInRoot
|
|
RtlDispatchException
|
|
CmpCheckValueList
|
|
CmpMarkIndexDirty
|
|
RtlUnicodeToCustomCPN
|
|
RtlZeroHeap
|
|
RtlLargeIntegerToChar
|
|
PspSetContext
|
|
MiEliminateWorkingSetEntry
|
|
NtDisplayString
|
|
SepAdtObjectReferenceAuditAlarm
|
|
HvLoadHive
|
|
MiGetPageProtection
|
|
RawQueryFsSizeInfo
|
|
MiCalculatePageCommitment
|
|
MiDecrementCloneBlockReference
|
|
ExpRaiseHardError
|
|
KiGeneralException
|
|
IoAllocateErrorLogEntry
|
|
KiNormalizeLongword
|
|
KiRequestSoftwareInterrupt
|
|
MiReleaseWsle
|
|
ExRaiseHardError
|
|
NtGetContextThread
|
|
ExInterlockedExchangeUlong
|
|
MiFindActualFaultingPte
|
|
MiCompleteProtoPteFault
|
|
IopCheckDeviceAndDriver
|
|
FsRtlIsNameInExpressionPrivate
|
|
NtSetContextThread
|
|
SepRmCommandServerThreadInit
|
|
FsRtlAcquireFileForModWrite
|
|
FsRtlGetNextFileLock
|
|
IopCheckBackupRestorePrivilege
|
|
RtlGetDaclSecurityDescriptor
|
|
ObpHashSecurityDescriptor
|
|
IopCheckAndLogConflict
|
|
RtlUnicodeStringToInteger
|
|
NtCreateSymbolicLinkObject
|
|
AllocateHandleTable
|
|
MiGrowWorkingSet
|
|
NtQuerySymbolicLinkObject
|
|
SeAuditHandleDuplication
|
|
RtlpExtendHeap
|
|
ExpWaitForResourceDdk
|
|
MiReorderTree
|
|
MmOutSwapProcess
|
|
IopRaiseHardError
|
|
IopQueryName
|
|
MmMapViewOfSection
|
|
CmpSelectLeaf
|
|
NtCreateKey
|
|
MiRemoveAnyPage
|
|
MiResolveMappedFileFault
|
|
MiResolveProtoPteFault
|
|
RtlSubtreePredecessor
|
|
ObpHashBuffer
|
|
MiRemovePageByColor
|
|
RtlClearBits
|
|
MiReleasePageFileSpace
|
|
MiRemoveWsle
|
|
MiFreeWsle
|
|
KeInsertByKeyDeviceQueue
|
|
ExAcquireSharedWaitForExclusive
|
|
CcPurgeCacheSection
|
|
HalpGetRegistryPartitionInformation
|
|
NtDuplicateToken
|
|
DbgBreakPoint
|
|
ZwWaitForMultipleObjects
|
|
IoThreadToProcess
|
|
MiInitializeReadInProgressPfn
|
|
NtSetInformationFile
|
|
MmBuildMdlForNonPagedPool
|
|
FsRtlOplockFsctrl
|
|
CmSetValueKey
|
|
HvpRecoverData
|
|
MiAttemptPageFileExtension
|
|
NtImpersonateClientOfPort
|
|
MiLockCode
|
|
IoBuildDeviceIoControlRequest
|
|
ExQuerySystemLockInformation
|
|
NtRemoveIoCompletion
|
|
MiAttemptPageFileReduction
|
|
CmpCreateLinkNode
|
|
RtlSetBits
|
|
RtlEnumerateGenericTableWithoutSplaying
|
|
MiFreeEventCounter
|
|
NtCreateThread
|
|
NtPrivilegeObjectAuditAlarm
|
|
KdInitSystem
|
|
FsRtlIsHpfsDbcsLegal
|
|
NtSetSystemTime
|
|
IopGetDriverNameFromKeyNode
|
|
HvpFindNextDirtyBlock
|
|
NtQuerySection
|
|
MiRemoveMappedPtes
|
|
FsRtlOplockBreakToNone
|
|
SeAuditProcessCreation
|
|
NtCancelIoFile
|
|
CmpSaveKeyByFileCopy
|
|
FsRtlRegisterUncProvider
|
|
IopTranslateResourceList
|
|
CmpInitializeHive
|
|
MmSetBankedSection
|
|
RtlCustomCPToUnicodeN
|
|
MiResolveImageReferences
|
|
KdpTrap
|
|
IopGetDosDevicesProtection
|
|
MmOutPageKernelStack
|
|
MiInitializePfn
|
|
KeRemoveByKeyDeviceQueue
|
|
NtSetEvent
|
|
RtlLookupFunctionEntry
|
|
ExpRaiseStatus
|
|
RtlLengthSid
|
|
RtlpDidUnicodeToOemWork
|
|
RtlUnicodeStringToCountedOemString
|
|
RtlEqualSid
|
|
ProbeForWrite
|
|
NtQueryVolumeInformationFile
|
|
NtClearEvent
|
|
NtWaitForSingleObject
|
|
KiExceptionDispatch
|
|
NtRaiseException
|
|
RtlFindLongestRunClear
|
|
MiLocateAddress
|
|
MmIsRecursiveIoFault
|
|
KeReadStateProcess
|
|
KeReadStateMutant
|
|
IopSynchronousServiceTail
|
|
NtFlushBuffersFile
|
|
MiMakeProtectionMask
|
|
MiIsProtectionCompatible
|
|
LpcpMoveMessage
|
|
RtlCompareUnicodeString
|
|
SwapSplayLinks
|
|
RtlIntegerToChar
|
|
CmDeleteKey
|
|
KeInitializeInterrupt
|
|
CmpFindKeyControlBlockWithLock
|
|
CmpCreateKeyControlBlock
|
|
SepGetDefaultsSubjectContext
|
|
NtCreatePort
|
|
ExpQueryModuleInformation
|
|
NtCreateProfile
|
|
RtlpFindAndCommitPages
|
|
MmMapViewInSystemSpace
|
|
NtProtectVirtualMemory
|
|
ExDupHandleTable
|
|
CmpRemoveSubKey
|
|
NtPrivilegedServiceAuditAlarm
|
|
CmpDoCreate
|
|
KeDelayExecutionThread
|
|
RtlDecompressFragmentLZNT1
|
|
CmpUnlockRegistry
|
|
CmQueryValueKey
|
|
CmpDeleteKeyObject
|
|
ExReleaseResourceForThreadLite
|
|
SeFastTraverseCheck
|
|
ObpParseSymbolicLink
|
|
LpcpAllocateFromPortZone
|
|
NtReplyPort
|
|
RtlIsGenericTableEmpty
|
|
FsRtlAllocateOplock
|
|
__ll_lshift
|
|
KeChangeColorPage
|
|
RtlInitializeBitMap
|
|
SeValidSecurityDescriptor
|
|
IopQueryXxxInformation
|
|
MiGetPreviousNode
|
|
CmpStepThroughExit
|
|
NtFsControlFile
|
|
ExDisableResourceBoostLite
|
|
SeDeassignSecurity
|
|
ObAssignSecurity
|
|
FsRtlNotifyCompletion
|
|
NtSetDefaultLocale
|
|
SepAdjustPrivileges
|
|
HvpWriteLog
|
|
KeBugCheckEx
|
|
MiDoPoolCopy
|
|
CmDeleteValueKey
|
|
HvpBuildMap
|
|
SepAdtMarshallAuditRecord
|
|
MiQueryAddressState
|
|
NtStartProfile
|
|
MiDoMappedCopy
|
|
MiCopyOnWrite
|
|
CmpCopyKeyPartial
|
|
MiRemoveNode
|
|
RtlCutoverTimeToSystemTime
|
|
SeOpenObjectAuditAlarm
|
|
MiMapLockedPagesInUserSpace
|
|
KeInitializeSemaphore
|
|
FsRtlInitializeMcb
|
|
MiCreateDataFileMap
|
|
RtlpLengthInheritAcl
|
|
SepInheritAcl
|
|
HvpGetCellPaged
|
|
RtlInitializeSid
|
|
__ull_rshift
|
|
MmInitializeProcessAddressSpace
|
|
FsRtlNotifyFullReportChange
|
|
RtlAreBitsSet
|
|
RtlAreBitsClear
|
|
NtQuerySystemEnvironmentValue
|
|
NtNotifyChangeKey
|
|
HvpDoWriteHive
|
|
IopBuildResourceDir
|
|
CmpNameFromAttributes
|
|
FsRtlOplockBreakNotify
|
|
MiGetNextNode
|
|
MiFindEmptyAddressRange
|
|
ObDeleteCapturedInsertInfo
|
|
SeCreateClientSecurity
|
|
ObpDereferenceSecurityDescriptor
|
|
DbgPrompt
|
|
FsRtlAllocateResource
|
|
strrchr
|
|
RtlEqualLuid
|
|
SepReferenceLogonSession
|
|
FsRtlInitializeFileLock
|
|
PsConvertToGuiThread
|
|
CmpSetValueKeyExisting
|
|
MiPurgeImageSection
|
|
CmpParseKey
|
|
CmpSetValueKeyNew
|
|
MmExtendSection
|
|
ExQueryHandleExtraBit
|
|
RtlLengthSecurityDescriptor
|
|
OpbCreateCacheEntry
|
|
CmpFindChildByName
|
|
RtlImageDirectoryEntryToData
|
|
KeFillLargeEntryTb
|
|
RtlValidSid
|
|
CmpDereferenceKeyControlBlock
|
|
ObAssignObjectSecurityDescriptor
|
|
NtTestAlert
|
|
NtLoadKey
|
|
IopXxxControlFile
|
|
NtReplyWaitReceivePort
|
|
RtlUnicodeToOemN
|
|
NtRaiseHardError
|
|
memcmp
|
|
MiGrowWsleHash
|
|
FsRtlSplitLargeMcb
|
|
MiCreatePagingFileMap
|
|
RtlUnwind2
|
|
MiInitializeWorkingSetList
|
|
NtUnloadDriver
|
|
RtlFindSetBits
|
|
HvpBuildMapAndCopy
|
|
MiCheckVirtualAddress
|
|
MiInsertNode
|
|
IopErrorLogThread
|
|
MiGetWorkingSetInfo
|
|
KdpSendWaitContinue
|
|
CmpWorker
|
|
KdpReceivePacket
|
|
MiCheckForCrashDump
|
|
CmpAddSubKey
|
|
NtRequestPort
|
|
LpcpFreeToPortZone
|
|
LpcpFindDataInfoMessage
|
|
RtlCreateAcl
|
|
MiCheckForConflictingNode
|
|
NtAllocateUuids
|
|
RtlFreeHeap
|
|
SepDuplicateToken
|
|
NtSetSystemEnvironmentValue
|
|
MmFlushVirtualMemory
|
|
NtOpenThread
|
|
LpcpCopyRequestData
|
|
xHalIoSetPartitionInformation
|
|
pIoQueryBusDescription
|
|
SepAdtPrivilegedServiceAuditAlarm
|
|
HvpDoAllocateCell
|
|
MmInSwapProcess
|
|
SepAdjustGroups
|
|
CmpSetVersionData
|
|
CmpSetSecurityDescriptorInfo
|
|
IoRaiseInformationalHardError
|
|
MiRemoveWorkingSetPages
|
|
NtOpenProcess
|
|
MiSnapThunk
|
|
LdrEnumResources
|
|
CmpQueryKeyData
|
|
CmpLoadHiveVolatile
|
|
MmCleanProcessAddressSpace
|
|
MiVerifyImageHeader
|
|
CmpOpenHiveFiles
|
|
IopAssignResourcesPhase3
|
|
CmpQueryKeyValueData
|
|
MiReturnCommitment
|
|
MiReturnPageTablePageCommitment
|
|
CmpLockRegistry
|
|
MiZeroPhysicalPage
|
|
SepFreeCapturedString
|
|
SepDefaultDeleteMethod
|
|
NtQueryInformationFile
|
|
NtRequestWaitReplyPort
|
|
RtlVirtualUnwind
|
|
RtlTimeFieldsToTime
|
|
ExDestroyHandleTable
|
|
NtReleaseSemaphore
|
|
RtlUpcaseUnicodeString
|
|
SepCreateImpersonationTokenDacl
|
|
PspUserThreadStartup
|
|
CmpFindSubKeyByName
|
|
RtlAddAccessAllowedAce
|
|
MiChargePageFileQuota
|
|
ObQueryTypeName
|
|
IopSynchronousApiServiceTail
|
|
MiLocateAddressInTree
|
|
KiMoveApcState
|
|
RtlImageNtHeader
|
|
RtlpRaiseStatus
|
|
KiFlushRandomTb
|
|
RtlMultiByteToUnicodeN
|
|
RtlpCallQueryRegistryRoutine
|
|
PsUnlockProcess
|
|
NtTerminateThread
|
|
DbgkpSuspendProcess
|
|
KeTryToAcquireSpinLock
|
|
RtlCopySid
|
|
RtlCreateSecurityDescriptor
|
|
CmpRemoveKeyControlBlock
|
|
NtGetTickCount
|
|
RtlpExceptionHandler
|
|
NtWriteFile
|
|
SeQuerySecurityDescriptorInfo
|
|
SeDefaultObjectMethod
|
|
CmpQuerySecurityDescriptorInfo
|
|
CompareUnicodeStrings
|
|
RtlFindUnicodePrefix
|
|
PsLockProcess
|
|
MiFindEmptyAddressRangeDownTree
|
|
__C_specific_handler
|
|
ObpLogSecurityDescriptor
|
|
MiWriteComplete
|
|
SepAdtPrivilegeObjectAuditAlarm
|
|
MiDecommitPages
|
|
ObQueryNameString
|
|
CmpHiveRootSecurityDescriptor
|
|
NtReplyWaitReplyPort
|
|
HvpEnlistFreeCell
|
|
FsRtlOpBatchBreakClosePending
|
|
SepPrivilegeCheck
|
|
SepProbeAndCaptureString_U
|
|
NtResetEvent
|
|
CmpGetNextName
|
|
MmCreateTeb
|
|
SeComputeQuotaInformationSize
|
|
MiModifiedPageWriterWorker
|
|
FsRtlCancelNotify
|
|
PspExitThread
|
|
MiReturnPageFileQuota
|
|
MiInitializePfnForOtherProcess
|
|
RtlGetSaclSecurityDescriptor
|
|
DbgkExitThread
|
|
RtlGetGroupSecurityDescriptor
|
|
RtlFirstFreeAce
|
|
RtlGetOwnerSecurityDescriptor
|
|
SepAdtAuditThisEvent
|
|
ObpDestroySecurityDescriptorHeader
|
|
CcScanDpc
|
|
RtlInitUnicodeString
|
|
ComputeUnicodeNameLength
|
|
SeReleaseSecurityDescriptor
|
|
PsTerminateSystemThread
|
|
PsExitSpecialApc
|
|
CcRepinBcb
|
|
__ll_rshift
|
|
SepTokenDeleteMethod
|
|
KiEmulateFloating
|
|
MiInitMachineDependent
|
|
RtlAllocateHeap
|
|
MiCloneProcessAddressSpace
|
|
NtQuerySystemInformation
|
|
IopGenNextValidDescriptor
|
|
RtlpCoalesceFreeBlocks
|
|
IopGetSetSecurityObject
|
|
NtNotifyChangeDirectoryFile
|
|
ExRefreshTimeZoneInformation
|
|
FsRtlNotifyFullChangeDirectory
|
|
MiCreateImageFileMap
|
|
NtQueryInformationToken
|
|
NtAllocateVirtualMemory
|
|
IopReportResourceUsage
|
|
RtlUpcaseUnicodeToCustomCPN
|
|
NtSetInformationProcess
|
|
RtlUpcaseUnicodeToMultiByteN
|
|
KeDumpMachineState
|
|
xHalIoAssignDriveLetters
|
|
MiSetProtectionOnSection
|
|
IopAssignResourcesPhase2
|
|
NtConnectPort
|
|
PspCreateProcess
|
|
SeCaptureSecurityDescriptor
|
|
MmWorkingSetManager
|
|
_output
|
|
_woutput
|
|
NtCreatePagingFile
|
|
MiMapViewOfImageSection
|
|
NtAcceptConnectPort
|
|
NtFreeVirtualMemory
|
|
MiMapViewOfDataSection
|
|
NtReadFile
|
|
FsRtlIsDbcsInExpression
|
|
LZNT1DecompressChunk
|
|
NtSetInformationToken
|
|
IoAssignResources
|
|
CcZeroData
|
|
MiMapViewOfPhysicalSection
|
|
IoWriteCrashDump
|
|
MiProtectVirtualMemory
|
|
NtAccessCheckAndAuditAlarm
|
|
NtCreateToken
|
|
NtQueryEaFile
|
|
KiNormalizeDouble
|
|
MiGatherMappedPages
|
|
RtlCreateHeap
|
|
MmLoadSystemImage
|
|
IopLoadDriver
|
|
PspCreateThread
|
|
NtDuplicateObject
|
|
NtLockVirtualMemory
|
|
NtAccessCheck
|
|
NtQueryVirtualMemory
|
|
NtQueryInformationProcess
|
|
RtlIsTextUnicode
|
|
NtQueryDirectoryFile
|
|
NtQueryObject
|
|
MiFindContiguousMemory
|
|
HvpAddBin
|
|
SeSetSecurityDescriptorInfo
|
|
MmAdjustWorkingSetSize
|
|
SepAdtOpenObjectAuditAlarm
|
|
SeCaptureSidAndAttributesArray
|
|
HvInitializeHive
|
|
KiDispatchException
|
|
NtOpenObjectAuditAlarm
|
|
LdrpSearchResourceSection_U
|
|
SepCreateToken
|
|
NtMapViewOfSection
|
|
MmShutdownSystem
|
|
KiNormalizeSingle
|
|
xHalIoWritePartitionTable
|
|
NtQueryInformationThread
|
|
VdmQueryDirectoryFile
|
|
MiDeletePte
|
|
xHalIoReadPartitionTable
|
|
CmpDoCreateChild
|
|
NtLockFile
|
|
MiLoadImageSection
|
|
MiMakeOutswappedPageResident
|
|
LZNT1CompressChunk
|
|
LpcRequestWaitReplyPort
|
|
NtSetSystemInformation
|
|
pIoQueryDeviceDescription
|
|
RtlConsoleMultiByteToUnicodeN
|
|
MmCreateProcessAddressSpace
|
|
IoCreateDevice
|
|
NtAdjustGroupsToken
|
|
NtAdjustPrivilegesToken
|
|
NtUnlockVirtualMemory
|
|
ExpSystemErrorHandler
|
|
CmpCheckKey
|
|
RtlGenerate8dot3Name
|
|
IopMountVolume
|
|
ObGetObjectInformation
|
|
CmRestoreKey
|
|
RtlpDeCommitFreeBlock
|
|
ExpGetProcessInformation
|
|
PspSetQuotaLimits
|
|
HvRefreshHive
|
|
NtQueryDirectoryObject
|
|
NtUnlockFile
|
|
KiEmulateReference
|
|
CmpInitializeHiveList
|
|
RtlQueryRegistryValues
|
|
NtSetEaFile
|
|
MiGatherPagefilePages
|
|
IoSetInformation
|
|
NtSetVolumeInformationFile
|
|
IopInitializeDumpDrivers
|
|
SepVariableInitialization
|
|
MmInitSystem
|
|
Phase1Initialization
|
|
IopCreateArcNames
|
|
IopInitializeDoubleSpace
|
|
ExpInitializeExecutive
|
|
RtlCreateUserProcess
|
|
IoInitSystem
|
|
IopAssignDoubleSpaceDriveLetters
|
|
ObInitSystem
|
|
PspInitPhase0
|
|
ObCreateObjectType
|
|
CmpAddDriverToList
|
|
KiSystemBegin
|
|
SeMakeSystemToken
|
|
KiInitializeKernel
|
|
CmInitSystem1
|
|
CmpInitializeRegistryNode
|
|
IopInitializeResourceMap
|
|
CcInitializeCacheManager
|
|
MiInitializeSystemCache
|
|
MiBuildPagedPool
|
|
CmGetSystemControlValues
|
|
MiSectionInitialization
|
|
RtlQueryEnvironmentVariable_U
|
|
CmpFindControlSet
|
|
CmGetSystemDriverList
|
|
IopCreateObjectTypes
|
|
IopInitializeBootDrivers
|
|
IopReassignSystemRoot
|
|
CreateSystemRootLink
|
|
CmpCloneControlSet
|
|
ExpWorkerInitialization
|
|
RtlpCreateStack
|
|
CmpSetupConfigurationTree
|
|
CmpFindDrivers
|
|
PsLocateSystemDll
|
|
KiInitSystem
|
|
IopApplySystemPartitionProt
|
|
SeRmInitPhase1
|
|
MmFreeLoaderBlock
|
|
CmpCreateControlSet
|
|
SepInitSystemDacls
|
|
InitializePool
|
|
MiFindInitializationCode
|
|
IopInitializeBuiltinDriver
|
|
CmpInitializeSystemHive
|
|
FsRtlGetCompatibilityModeValue
|
|
CmpSortDriverList
|
|
RawInitialize
|
|
FsRtlInitSystem
|
|
ExBurnMemory
|
|
IopMarkBootPartition
|
|
KeFindConfigurationNextEntry
|
|
CmpFindTagIndex
|
|
IopLookupGroupName
|
|
MiInitializeNonPagedPool
|
|
CmpCreateRegistryRoot
|
|
IopCreateRootDirectories
|
|
CmpInitializeHardwareConfiguration
|
|
MiMergeMemoryLimit
|
|
CmpCreateObjectTypes
|
|
MmInitializeMemoryLimits
|
|
CmpCreateRootNode
|
|
CmpInitializeRegistryNames
|
|
IopInitializeSystemDrivers
|
|
CmpDoSort
|
|
RtlCreateUserThread
|
|
LpcInitSystem
|
|
MiInitializeSystemPtes
|
|
SepInitializationPhase1
|
|
CmpIsLastKnownGoodBoot
|
|
LpcpInitializePortZone
|
|
SepInitializePrivilegeSets
|
|
LookupEntryPoint
|
|
IoReportHalResourceUsage
|
|
ExpInitSystemPhase1
|
|
CmpIsLoadType
|
|
CmpWalkPath
|
|
KiComputeReciprocal
|
|
RtlDeNormalizeProcessParams
|
|
IopProtectSystemPartition
|
|
SepTokenInitialization
|
|
IopCheckDependencies
|
|
CmpOrderGroup
|
|
ExpProfileInitialization
|
|
ExInitializeTimeRefresh
|
|
SepRmDbInitialization
|
|
ExpMutantInitialization
|
|
ExpTimerInitialization
|
|
ExpEventPairInitialization
|
|
CmpComputeGlobalQuotaAllowed
|
|
ExpInitializePoolDescriptor
|
|
ExpEventInitialization
|
|
ExpSemaphoreInitialization
|
|
IopCreateEntry
|
|
RtlpOpenImageFile
|
|
SepInitializationPhase0
|
|
FsRtlInitializeWorkerThread
|
|
CmpResolveDriverDependencies
|
|
PspInitializeSystemDll
|
|
IopInitializeAttributesAndCreateObject
|
|
IopRevertModuleList
|
|
PspLookupKernelUserEntryPoints
|
|
CcInitializeVacbs
|
|
ExInitializeHandleTablePackage
|
|
IopFreeGroupTree
|
|
CmpFreeDriverList
|
|
PsInitSystem
|
|
ExInitSystem
|
|
SeInitSystem
|
|
ExComputeTickCountMultiplier
|
|
ExpInitSystemPhase0
|
|
RtlpFreeStack
|
|
ExpResourceInitialization
|
|
ExLuidInitialization
|
|
ExpUuidInitialization
|
|
SepInitializeWorkList
|
|
PspInitPhase1
|
|
PspLookupSystemDllEntryPoint
|
|
KeFindConfigurationEntry
|
|
SepRmInitPhase0
|
|
ExInitSystemPhase2
|
|
MiEnablePagingTheExecutive
|