; ; Generated from: ntoskrnl.exe ; Size file: 0x54e2f0 (5563120) ; Format: PE ; Size of image: 0x58e000 (5824512) ; Architecture: X86 ; Timestamp: 0x5010adf0 - 2012-07-26T02:39:44 ; #1 #2 ExAcquireFastMutex ExAcquireFastMutexUnsafe ExAcquireRundownProtection ExAcquireRundownProtectionCacheAware ExAcquireRundownProtectionCacheAwareEx ExAcquireRundownProtectionEx ExBlockOnAddressPushLock ExBlockPushLock ExEnterCriticalRegionAndAcquireFastMutexUnsafe ExInitializeRundownProtection ExInterlockedAddLargeStatistic ExInterlockedAddUlong ExInterlockedCompareExchange64 ExInterlockedFlushSList ExInterlockedInsertHeadList ExInterlockedInsertTailList ExInterlockedPopEntryList ExInterlockedPopEntrySList ExInterlockedPushEntryList ExInterlockedPushEntrySList ExInterlockedRemoveHeadList ExReInitializeRundownProtection ExReInitializeRundownProtectionCacheAware ExReleaseFastMutex ExReleaseFastMutexUnsafe ExReleaseFastMutexUnsafeAndLeaveCriticalRegion ExReleaseResourceAndLeaveCriticalRegion ExReleaseResourceAndLeavePriorityRegion ExReleaseResourceLite ExReleaseRundownProtection ExReleaseRundownProtectionCacheAware ExReleaseRundownProtectionCacheAwareEx ExReleaseRundownProtectionEx ExRundownCompleted ExRundownCompletedCacheAware ExTimedWaitForUnblockPushLock ExTryToAcquireFastMutex ExWaitForRundownProtectionRelease ExWaitForRundownProtectionReleaseCacheAware ExWaitForUnblockPushLock ExfAcquirePushLockExclusive ExfAcquirePushLockShared ExfInterlockedAddUlong ExfInterlockedCompareExchange64 ExfInterlockedInsertHeadList ExfInterlockedInsertTailList ExfInterlockedPopEntryList ExfInterlockedPushEntryList ExfInterlockedRemoveHeadList ExfReleasePushLock ExfReleasePushLockExclusive ExfReleasePushLockShared ExfTryAcquirePushLockShared ExfTryToWakePushLock ExfUnblockPushLock Exfi386InterlockedDecrementLong Exfi386InterlockedExchangeUlong Exfi386InterlockedIncrementLong ExiAcquireFastMutex ExiReleaseFastMutex ExiTryToAcquireFastMutex HalExamineMBR InterlockedCompareExchange InterlockedDecrement InterlockedExchange InterlockedExchangeAdd InterlockedIncrement InterlockedPopEntrySList InterlockedPushEntrySList IoGetPagingIoPriority IoReadPartitionTable IoSetPartitionInformation IoWritePartitionTable IofCallDriver IofCompleteRequest KeAcquireGuardedMutex KeAcquireGuardedMutexUnsafe KeAcquireInStackQueuedSpinLock KeAcquireInStackQueuedSpinLockAtDpcLevel KeAcquireInStackQueuedSpinLockForDpc KeAcquireInStackQueuedSpinLockRaiseToSynch KeAcquireQueuedSpinLock KeAcquireQueuedSpinLockRaiseToSynch KeAcquireSpinLockForDpc KeAcquireSpinLockRaiseToSynch KeInitializeGuardedMutex KeInvalidateRangeAllCaches KeReleaseGuardedMutex KeReleaseGuardedMutexUnsafe KeReleaseInStackQueuedSpinLock KeReleaseInStackQueuedSpinLockForDpc KeReleaseInStackQueuedSpinLockFromDpcLevel KeReleaseQueuedSpinLock KeReleaseSpinLockForDpc KeTestSpinLock KeTryToAcquireGuardedMutex KeTryToAcquireQueuedSpinLock KeTryToAcquireQueuedSpinLockRaiseToSynch KeTryToAcquireSpinLockAtDpcLevel KeUpdateRunTime KeUpdateTime KefAcquireSpinLockAtDpcLevel KefReleaseSpinLockFromDpcLevel KfAcquireSpinLock KfReleaseSpinLock KiAcquireSpinLock KiCheckForSListAddress KiEndThreadAccountingPeriod KiEntropyQueueDpc KiReleaseSpinLock ObReferenceObjectSafe ObReferenceObjectSafeWithTag ObfDereferenceObject ObfDereferenceObjectWithTag ObfReferenceObject ObfReferenceObjectWithTag PoNotifyVSyncChange RtlPrefetchMemoryNonTemporal RtlUlongByteSwap RtlUlonglongByteSwap RtlUshortByteSwap SeAuditingWithTokenForSubcategory WmiGetClock Kei386EoiHelper AlpcGetHeaderSize AlpcGetMessageAttribute AlpcInitializeMessageAttribute BgkDisplayCharacter BgkGetConsoleState BgkGetCursorState BgkSetCursor CcAddDirtyPagesToExternalCache CcCanIWrite CcCoherencyFlushAndPurgeCache CcCopyRead CcCopyReadEx CcCopyWrite CcCopyWriteEx CcCopyWriteWontFlush CcDeductDirtyPagesFromExternalCache CcDeferWrite CcFastCopyRead CcFastCopyWrite CcFastMdlReadWait CcFlushCache CcFlushCacheToLsn CcGetDirtyPages CcGetFileObjectFromBcb CcGetFileObjectFromSectionPtrs CcGetFileObjectFromSectionPtrsRef CcGetFlushedValidData CcGetLsnForFileObject CcInitializeCacheMap CcIsThereDirtyData CcIsThereDirtyDataEx CcIsThereDirtyLoggedPages CcMapData CcMdlRead CcMdlReadComplete CcMdlWriteAbort CcMdlWriteComplete CcPinMappedData CcPinRead CcPrepareMdlWrite CcPreparePinWrite CcPurgeCacheSection CcRegisterExternalCache CcRemapBcb CcRepinBcb CcScheduleReadAhead CcScheduleReadAheadEx CcSetAdditionalCacheAttributes CcSetAdditionalCacheAttributesEx CcSetBcbOwnerPointer CcSetDirtyPageThreshold CcSetDirtyPinnedData CcSetFileSizes CcSetFileSizesEx CcSetLogHandleForFile CcSetLogHandleForFileEx CcSetLoggedDataThreshold CcSetParallelFlushFile CcSetReadAheadGranularity CcSetReadAheadGranularityEx CcTestControl CcUninitializeCacheMap CcUnmapFileOffsetFromSystemCache CcUnpinData CcUnpinDataForThread CcUnpinRepinnedBcb CcUnregisterExternalCache CcWaitForCurrentLazyWriterActivity CcZeroData CcZeroDataOnDisk CmCallbackGetKeyObjectID CmCallbackGetKeyObjectIDEx CmCallbackReleaseKeyObjectIDEx CmGetBoundTransaction CmGetCallbackVersion CmKeyObjectType CmRegisterCallback CmRegisterCallbackEx CmSetCallbackObjectContext CmUnRegisterCallback DbgBreakPoint DbgBreakPointWithStatus DbgCommandString DbgLoadImageSymbols DbgPrint DbgPrintEx DbgPrintReturnControlC DbgPrompt DbgQueryDebugFilterState DbgSetDebugFilterState DbgSetDebugPrintCallback DbgkLkmdRegisterCallback DbgkLkmdUnregisterCallback EmClientQueryRuleState EmClientRuleDeregisterNotification EmClientRuleEvaluate EmClientRuleRegisterNotification EmProviderDeregister EmProviderDeregisterEntry EmProviderRegister EmProviderRegisterEntry EmpProviderRegister EtwActivityIdControl EtwEnableTrace EtwEventEnabled EtwProviderEnabled EtwRegister EtwRegisterClassicProvider EtwSendTraceBuffer EtwUnregister EtwWrite EtwWriteEndScenario EtwWriteEx EtwWriteStartScenario EtwWriteString EtwWriteTransfer ExAcquireCacheAwarePushLockExclusive ExAcquireResourceExclusiveLite ExAcquireResourceSharedLite ExAcquireSharedStarveExclusive ExAcquireSharedWaitForExclusive ExAcquireSpinLockExclusive ExAcquireSpinLockExclusiveAtDpcLevel ExAcquireSpinLockShared ExAcquireSpinLockSharedAtDpcLevel ExAllocateCacheAwarePushLock ExAllocateCacheAwareRundownProtection ExAllocateFromPagedLookasideList ExAllocatePool ExAllocatePoolWithQuota ExAllocatePoolWithQuotaTag ExAllocatePoolWithTag ExAllocatePoolWithTagPriority ExCompositionSurfaceObjectType ExConvertExclusiveToSharedLite ExCreateCallback ExDeleteLookasideListEx ExDeleteNPagedLookasideList ExDeletePagedLookasideList ExDeleteResourceLite ExDesktopObjectType ExDisableResourceBoostLite ExEnterCriticalRegionAndAcquireResourceExclusive ExEnterCriticalRegionAndAcquireResourceShared ExEnterCriticalRegionAndAcquireSharedWaitForExclusive ExEnterPriorityRegionAndAcquireResourceExclusive ExEnterPriorityRegionAndAcquireResourceShared ExEnumHandleTable ExEventObjectType ExExtendZone ExFetchLicenseData ExFlushLookasideListEx ExFreeCacheAwarePushLock ExFreeCacheAwareRundownProtection ExFreePool ExFreePoolWithTag ExFreeToPagedLookasideList ExGetCurrentProcessorCounts ExGetCurrentProcessorCpuUsage ExGetExclusiveWaiterCount ExGetFirmwareEnvironmentVariable ExGetLicenseTamperState ExGetPreviousMode ExGetSharedWaiterCount ExInitializeLookasideListEx ExInitializeNPagedLookasideList ExInitializePagedLookasideList ExInitializePushLock ExInitializeResourceLite ExInitializeRundownProtectionCacheAware ExInitializeZone ExInterlockedAddLargeInteger ExInterlockedDecrementLong ExInterlockedExchangeUlong ExInterlockedExtendZone ExInterlockedIncrementLong ExIsProcessorFeaturePresent ExIsResourceAcquiredExclusiveLite ExIsResourceAcquiredSharedLite ExLocalTimeToSystemTime ExNotifyBootDeviceRemoval ExNotifyCallback ExQueryAttributeInformation ExQueryFastCacheAppOrigin ExQueryFastCacheDevLicense ExQueryPoolBlockSize ExQueryTimerResolution ExQueryWnfStateData ExQueueWorkItem ExRaiseAccessViolation ExRaiseDatatypeMisalignment ExRaiseException ExRaiseHardError ExRaiseStatus ExRealTimeIsUniversal ExRegisterAttributeInformationCallback ExRegisterBootDevice ExRegisterCallback ExRegisterExtension ExReinitializeResourceLite ExReleaseCacheAwarePushLockExclusive ExReleaseResourceForThreadLite ExReleaseSpinLockExclusive ExReleaseSpinLockExclusiveFromDpcLevel ExReleaseSpinLockShared ExReleaseSpinLockSharedFromDpcLevel ExSemaphoreObjectType ExSetFirmwareEnvironmentVariable ExSetLicenseTamperState ExSetResourceOwnerPointer ExSetResourceOwnerPointerEx ExSetTimerResolution ExSizeOfRundownProtectionCacheAware ExSubscribeWnfStateChange ExSystemExceptionFilter ExSystemTimeToLocalTime ExTryConvertSharedSpinLockExclusive ExTryQueueWorkItem ExUnregisterAttributeInformationCallback ExUnregisterCallback ExUnregisterExtension ExUnsubscribeWnfStateChange ExUuidCreate ExVerifySuite ExWindowStationObjectType Exi386InterlockedDecrementLong Exi386InterlockedExchangeUlong Exi386InterlockedIncrementLong FirstEntrySList FsRtlAcknowledgeEcp FsRtlAcquireEofLock FsRtlAcquireFileExclusive FsRtlAcquireHeaderMutex FsRtlAddBaseMcbEntry FsRtlAddBaseMcbEntryEx FsRtlAddLargeMcbEntry FsRtlAddMcbEntry FsRtlAddToTunnelCache FsRtlAllocateExtraCreateParameter FsRtlAllocateExtraCreateParameterFromLookasideList FsRtlAllocateExtraCreateParameterList FsRtlAllocateFileLock FsRtlAllocatePool FsRtlAllocatePoolWithQuota FsRtlAllocatePoolWithQuotaTag FsRtlAllocatePoolWithTag FsRtlAllocateResource FsRtlAreNamesEqual FsRtlAreThereCurrentOrInProgressFileLocks FsRtlAreThereWaitingFileLocks FsRtlAreVolumeStartupApplicationsComplete FsRtlBalanceReads FsRtlCancellableWaitForMultipleObjects FsRtlCancellableWaitForSingleObject FsRtlChangeBackingFileObject FsRtlCheckLockForOplockRequest FsRtlCheckLockForReadAccess FsRtlCheckLockForWriteAccess FsRtlCheckOplock FsRtlCheckOplockEx FsRtlCopyRead FsRtlCopyWrite FsRtlCreateSectionForDataScan FsRtlCurrentBatchOplock FsRtlCurrentOplock FsRtlCurrentOplockH FsRtlDeleteExtraCreateParameterLookasideList FsRtlDeleteKeyFromTunnelCache FsRtlDeleteTunnelCache FsRtlDeregisterUncProvider FsRtlDismountComplete FsRtlDissectDbcs FsRtlDissectName FsRtlDoesDbcsContainWildCards FsRtlDoesNameContainWildCards FsRtlFastCheckLockForRead FsRtlFastCheckLockForWrite FsRtlFastUnlockAll FsRtlFastUnlockAllByKey FsRtlFastUnlockSingle FsRtlFindExtraCreateParameter FsRtlFindInTunnelCache FsRtlFreeExtraCreateParameter FsRtlFreeExtraCreateParameterList FsRtlFreeFileLock FsRtlGetEcpListFromIrp FsRtlGetFileNameInformation FsRtlGetFileSize FsRtlGetIoAtEof FsRtlGetNextBaseMcbEntry FsRtlGetNextExtraCreateParameter FsRtlGetNextFileLock FsRtlGetNextLargeMcbEntry FsRtlGetNextMcbEntry FsRtlGetSectorSizeInformation FsRtlGetSupportedFeatures FsRtlGetVirtualDiskNestingLevel FsRtlIncrementCcFastMdlReadWait FsRtlIncrementCcFastReadNoWait FsRtlIncrementCcFastReadNotPossible FsRtlIncrementCcFastReadResourceMiss FsRtlIncrementCcFastReadWait FsRtlInitExtraCreateParameterLookasideList FsRtlInitializeBaseMcb FsRtlInitializeBaseMcbEx FsRtlInitializeEofLock FsRtlInitializeExtraCreateParameter FsRtlInitializeExtraCreateParameterList FsRtlInitializeFileLock FsRtlInitializeLargeMcb FsRtlInitializeMcb FsRtlInitializeOplock FsRtlInitializeTunnelCache FsRtlInsertExtraCreateParameter FsRtlInsertPerFileContext FsRtlInsertPerFileObjectContext FsRtlInsertPerStreamContext FsRtlIsDbcsInExpression FsRtlIsEcpAcknowledged FsRtlIsEcpFromUserMode FsRtlIsFatDbcsLegal FsRtlIsHpfsDbcsLegal FsRtlIsNameInExpression FsRtlIsNtstatusExpected FsRtlIsPagingFile FsRtlIsSystemPagingFile FsRtlIsTotalDeviceFailure FsRtlIssueDeviceIoControl FsRtlKernelFsControlFile FsRtlLegalAnsiCharacterArray FsRtlLogCcFlushError FsRtlLookupBaseMcbEntry FsRtlLookupLargeMcbEntry FsRtlLookupLastBaseMcbEntry FsRtlLookupLastBaseMcbEntryAndIndex FsRtlLookupLastLargeMcbEntry FsRtlLookupLastLargeMcbEntryAndIndex FsRtlLookupLastMcbEntry FsRtlLookupMcbEntry FsRtlLookupPerFileContext FsRtlLookupPerFileObjectContext FsRtlLookupPerStreamContextInternal FsRtlMdlRead FsRtlMdlReadComplete FsRtlMdlReadCompleteDev FsRtlMdlReadDev FsRtlMdlReadEx FsRtlMdlWriteComplete FsRtlMdlWriteCompleteDev FsRtlMupGetProviderIdFromName FsRtlMupGetProviderInfoFromFileObject FsRtlNormalizeNtstatus FsRtlNotifyChangeDirectory FsRtlNotifyCleanup FsRtlNotifyCleanupAll FsRtlNotifyFilterChangeDirectory FsRtlNotifyFilterReportChange FsRtlNotifyFullChangeDirectory FsRtlNotifyFullReportChange FsRtlNotifyInitializeSync FsRtlNotifyReportChange FsRtlNotifyUninitializeSync FsRtlNotifyVolumeEvent FsRtlNotifyVolumeEventEx FsRtlNumberOfRunsInBaseMcb FsRtlNumberOfRunsInLargeMcb FsRtlNumberOfRunsInMcb FsRtlOplockBreakH FsRtlOplockBreakToNone FsRtlOplockBreakToNoneEx FsRtlOplockFsctrl FsRtlOplockFsctrlEx FsRtlOplockIsFastIoPossible FsRtlOplockIsSharedRequest FsRtlOplockKeysEqual FsRtlPostPagingFileStackOverflow FsRtlPostStackOverflow FsRtlPrepareMdlWrite FsRtlPrepareMdlWriteDev FsRtlPrepareMdlWriteEx FsRtlPrepareToReuseEcp FsRtlPrivateLock FsRtlProcessFileLock FsRtlQueryCachedVdl FsRtlQueryKernelEaFile FsRtlQueryMaximumVirtualDiskNestingLevel FsRtlRegisterFileSystemFilterCallbacks FsRtlRegisterFltMgrCalls FsRtlRegisterMupCalls FsRtlRegisterUncProvider FsRtlRegisterUncProviderEx FsRtlReleaseEofLock FsRtlReleaseFile FsRtlReleaseFileNameInformation FsRtlReleaseHeaderMutex FsRtlRemoveBaseMcbEntry FsRtlRemoveDotsFromPath FsRtlRemoveExtraCreateParameter FsRtlRemoveLargeMcbEntry FsRtlRemoveMcbEntry FsRtlRemovePerFileContext FsRtlRemovePerFileObjectContext FsRtlRemovePerStreamContext FsRtlResetBaseMcb FsRtlResetLargeMcb FsRtlSetEcpListIntoIrp FsRtlSetKernelEaFile FsRtlSplitBaseMcb FsRtlSplitLargeMcb FsRtlSyncVolumes FsRtlTeardownPerFileContexts FsRtlTeardownPerStreamContexts FsRtlTruncateBaseMcb FsRtlTruncateLargeMcb FsRtlTruncateMcb FsRtlTryToAcquireHeaderMutex FsRtlUninitializeBaseMcb FsRtlUninitializeFileLock FsRtlUninitializeLargeMcb FsRtlUninitializeMcb FsRtlUninitializeOplock FsRtlUpdateDiskCounters FsRtlValidateReparsePointBuffer HalDispatchTable HalPrivateDispatchTable HeadlessDispatch HvlGetLpIndexFromApicId HvlQueryActiveHypervisorProcessorCount HvlQueryActiveProcessors HvlQueryConnection HvlQueryHypervisorProcessorNodeNumber HvlQueryProcessorTopology HvlQueryProcessorTopologyCount HvlQueryProcessorTopologyHighestId HvlRegisterInterruptCallback HvlRegisterWheaErrorNotification HvlUnregisterInterruptCallback HvlUnregisterWheaErrorNotification InbvAcquireDisplayOwnership InbvCheckDisplayOwnership InbvDisplayString InbvEnableBootDriver InbvEnableDisplayString InbvInstallDisplayStringFilter InbvIsBootDriverInstalled InbvNotifyDisplayOwnershipChange InbvNotifyDisplayOwnershipLost InbvResetDisplay InbvSetScrollRegion InbvSetTextColor InbvSolidColorFill InitSafeBootMode IoAcquireCancelSpinLock IoAcquireRemoveLockEx IoAcquireVpbSpinLock IoAdapterObjectType IoAdjustStackSizeForRedirection IoAllocateAdapterChannel IoAllocateController IoAllocateDriverObjectExtension IoAllocateErrorLogEntry IoAllocateIrp IoAllocateMdl IoAllocateMiniCompletionPacket IoAllocateSfioStreamIdentifier IoAllocateWorkItem IoApplyPriorityInfoThread IoAssignResources IoAttachDevice IoAttachDeviceByPointer IoAttachDeviceToDeviceStack IoAttachDeviceToDeviceStackSafe IoBoostThreadIo IoBuildAsynchronousFsdRequest IoBuildDeviceIoControlRequest IoBuildPartialMdl IoBuildSynchronousFsdRequest IoCallDriver IoCancelFileOpen IoCancelIrp IoCheckDesiredAccess IoCheckEaBufferValidity IoCheckFunctionAccess IoCheckQuerySetFileInformation IoCheckQuerySetVolumeInformation IoCheckQuotaBufferValidity IoCheckShareAccess IoCheckShareAccessEx IoClearActivityIdThread IoClearDependency IoClearIrpExtraCreateParameter IoClearReservedDependency IoCompleteRequest IoCompletionObjectType IoConnectInterrupt IoConnectInterruptEx IoCopyDeviceObjectHint IoCreateArcName IoCreateController IoCreateDevice IoCreateDisk IoCreateDriver IoCreateFile IoCreateFileEx IoCreateFileSpecifyDeviceObjectHint IoCreateNotificationEvent IoCreateStreamFileObject IoCreateStreamFileObjectEx2 IoCreateStreamFileObjectEx IoCreateStreamFileObjectLite IoCreateSymbolicLink IoCreateSynchronizationEvent IoCreateSystemThread IoCreateUnprotectedSymbolicLink IoCsqInitialize IoCsqInitializeEx IoCsqInsertIrp IoCsqInsertIrpEx IoCsqRemoveIrp IoCsqRemoveNextIrp IoDecrementKeepAliveCount IoDeleteAllDependencyRelations IoDeleteController IoDeleteDevice IoDeleteDriver IoDeleteSymbolicLink IoDetachDevice IoDeviceHandlerObjectSize IoDeviceHandlerObjectType IoDeviceObjectType IoDisconnectInterrupt IoDisconnectInterruptEx IoDriverObjectType IoDuplicateDependency IoEnqueueIrp IoEnumerateDeviceObjectList IoEnumerateRegisteredFiltersList IoFastQueryNetworkAttributes IoFileObjectType IoForwardAndCatchIrp IoForwardIrpSynchronously IoFreeController IoFreeErrorLogEntry IoFreeIrp IoFreeMdl IoFreeMiniCompletionPacket IoFreeSfioStreamIdentifier IoFreeWorkItem IoGetActivityIdIrp IoGetActivityIdThread IoGetAffinityInterrupt IoGetAttachedDevice IoGetAttachedDeviceReference IoGetBaseFileSystemDeviceObject IoGetBootDiskInformation IoGetBootDiskInformationLite IoGetConfigurationInformation IoGetContainerInformation IoGetCurrentProcess IoGetDeviceAttachmentBaseRef IoGetDeviceInterfaceAlias IoGetDeviceInterfacePropertyData IoGetDeviceInterfaces IoGetDeviceNumaNode IoGetDeviceObjectPointer IoGetDeviceProperty IoGetDevicePropertyData IoGetDeviceToVerify IoGetDiskDeviceObject IoGetDmaAdapter IoGetDriverObjectExtension IoGetFileObjectGenericMapping IoGetInitialStack IoGetInitiatorProcess IoGetIoPriorityHint IoGetIrpExtraCreateParameter IoGetLowerDeviceObject IoGetOplockKeyContext IoGetOplockKeyContextEx IoGetRelatedDeviceObject IoGetRequestorProcess IoGetRequestorProcessId IoGetRequestorSessionId IoGetSfioStreamIdentifier IoGetStackLimits IoGetSymlinkSupportInformation IoGetTopLevelIrp IoGetTransactionParameterBlock IoIncrementKeepAliveCount IoInitializeIrp IoInitializeMiniCompletionPacket IoInitializeRemoveLockEx IoInitializeTimer IoInitializeWorkItem IoInvalidateDeviceRelations IoInvalidateDeviceState IoIsActivityTracingEnabled IoIsFileObjectIgnoringSharing IoIsFileOriginRemote IoIsOperationSynchronous IoIsSystemThread IoIsValidIrpStatus IoIsValidNameGraftingBuffer IoIsWdmVersionAvailable IoMakeAssociatedIrp IoOpenDeviceInterfaceRegistryKey IoOpenDeviceRegistryKey IoPageRead IoPropagateActivityIdToThread IoQueryDeviceDescription IoQueryFileDosDeviceName IoQueryFileInformation IoQueryVolumeInformation IoQueueThreadIrp IoQueueWorkItem IoQueueWorkItemEx IoQueueWorkItemToNode IoRaiseHardError IoRaiseInformationalHardError IoReadDiskSignature IoReadOperationCount IoReadPartitionTableEx IoReadTransferCount IoRegisterBootDriverCallback IoRegisterBootDriverReinitialization IoRegisterContainerNotification IoRegisterDeviceInterface IoRegisterDriverReinitialization IoRegisterFileSystem IoRegisterFsRegistrationChange IoRegisterFsRegistrationChangeMountAware IoRegisterIoTracking IoRegisterLastChanceShutdownNotification IoRegisterPlugPlayNotification IoRegisterPriorityCallback IoRegisterShutdownNotification IoReleaseCancelSpinLock IoReleaseRemoveLockAndWaitEx IoReleaseRemoveLockEx IoReleaseVpbSpinLock IoRemoveShareAccess IoReplaceFileObjectName IoReplacePartitionUnit IoReportDetectedDevice IoReportHalResourceUsage IoReportInterruptActive IoReportInterruptInactive IoReportResourceForDetection IoReportResourceUsage IoReportRootDevice IoReportTargetDeviceChange IoReportTargetDeviceChangeAsynchronous IoRequestDeviceEject IoRequestDeviceEjectEx IoReserveDependency IoResolveDependency IoRetrievePriorityInfo IoReuseIrp IoSetActivityIdIrp IoSetActivityIdThread IoSetCompletionRoutineEx IoSetDependency IoSetDeviceInterfacePropertyData IoSetDeviceInterfaceState IoSetDevicePropertyData IoSetDeviceToVerify IoSetFileObjectIgnoreSharing IoSetFileOrigin IoSetHardErrorOrVerifyDevice IoSetInformation IoSetIoCompletion IoSetIoCompletionEx IoSetIoPriorityHint IoSetIoPriorityHintIntoFileObject IoSetIoPriorityHintIntoThread IoSetIrpExtraCreateParameter IoSetMasterIrpStatus IoSetPartitionInformationEx IoSetShareAccess IoSetShareAccessEx IoSetStartIoAttributes IoSetSystemPartition IoSetThreadHardErrorMode IoSetTopLevelIrp IoSizeofWorkItem IoStartNextPacket IoStartNextPacketByKey IoStartPacket IoStartTimer IoStatisticsLock IoStopTimer IoSynchronousCallDriver IoSynchronousInvalidateDeviceRelations IoSynchronousPageWrite IoThreadToProcess IoTransferActivityId IoTranslateBusAddress IoTryQueueWorkItem IoUninitializeWorkItem IoUnregisterBootDriverCallback IoUnregisterContainerNotification IoUnregisterFileSystem IoUnregisterFsRegistrationChange IoUnregisterIoTracking IoUnregisterPlugPlayNotification IoUnregisterPlugPlayNotificationEx IoUnregisterPriorityCallback IoUnregisterShutdownNotification IoUpdateShareAccess IoValidateDeviceIoControlAccess IoVerifyPartitionTable IoVerifyVolume IoVolumeDeviceToDosName IoVolumeDeviceToGuid IoVolumeDeviceToGuidPath IoWMIAllocateInstanceIds IoWMIDeviceObjectToInstanceName IoWMIExecuteMethod IoWMIHandleToInstanceName IoWMIOpenBlock IoWMIQueryAllData IoWMIQueryAllDataMultiple IoWMIQuerySingleInstance IoWMIQuerySingleInstanceMultiple IoWMIRegistrationControl IoWMISetNotificationCallback IoWMISetSingleInstance IoWMISetSingleItem IoWMISuggestInstanceName IoWMIWriteEvent IoWithinStackLimits IoWriteErrorLogEntry IoWriteOperationCount IoWritePartitionTableEx IoWriteTransferCount KdChangeOption KdDebuggerEnabled KdDebuggerNotPresent KdDisableDebugger KdEnableDebugger KdEnteredDebugger KdLogDbgPrint KdPollBreakIn KdPowerTransition KdRefreshDebuggerNotPresent KdSystemDebugControl Ke386IoSetAccessProcess Ke386QueryIoAccessMap Ke386SetIoAccessMap KeAcquireInterruptSpinLock KeAcquireSpinLock KeAcquireSpinLockAtDpcLevel KeAddGroupAffinityEx KeAddProcessorAffinityEx KeAddProcessorGroupAffinity KeAddSystemServiceTable KeAlertThread KeAllocateCalloutStack KeAllocateCalloutStackEx KeAndAffinityEx KeAndGroupAffinityEx KeAreAllApcsDisabled KeAreApcsDisabled KeAttachProcess KeBugCheck KeBugCheckEx KeCancelTimer KeCapturePersistentThreadState KeCheckProcessorAffinityEx KeCheckProcessorGroupAffinity KeClearEvent KeComplementAffinityEx KeCopyAffinityEx KeCountSetBitsAffinityEx KeCountSetBitsGroupAffinity KeDelayExecutionThread KeDeregisterBugCheckCallback KeDeregisterBugCheckReasonCallback KeDeregisterNmiCallback KeDeregisterProcessorChangeCallback KeDetachProcess KeDispatchSecondaryInterrupt KeEnterCriticalRegion KeEnterGuardedRegion KeEnterKernelDebugger KeEnumerateNextProcessor KeExpandKernelStackAndCallout KeExpandKernelStackAndCalloutEx KeFindConfigurationEntry KeFindConfigurationNextEntry KeFindFirstSetLeftAffinityEx KeFindFirstSetLeftGroupAffinity KeFindFirstSetRightGroupAffinity KeFirstGroupAffinityEx KeFlushEntireTb KeFlushQueuedDpcs KeForceEnableNx KeFreeCalloutStack KeGenericCallDpc KeGetCurrentNodeNumber KeGetCurrentProcessorNumberEx KeGetCurrentThread KeGetNextTimerExpirationDueTime KeGetPreviousMode KeGetProcessorIndexFromNumber KeGetProcessorNumberFromIndex KeGetRecommendedSharedDataAlignment KeGetXSaveFeatureFlags KeHwPolicyLocateResource KeI386MachineType KeInitializeAffinityEx KeInitializeApc KeInitializeCrashDumpHeader KeInitializeDeviceQueue KeInitializeDpc KeInitializeEnumerationContext KeInitializeEnumerationContextFromGroup KeInitializeEvent KeInitializeInterrupt KeInitializeMutant KeInitializeMutex KeInitializeQueue KeInitializeSecondaryInterruptServices KeInitializeSemaphore KeInitializeSpinLock KeInitializeThreadedDpc KeInitializeTimer KeInitializeTimerEx KeInsertByKeyDeviceQueue KeInsertDeviceQueue KeInsertHeadQueue KeInsertQueue KeInsertQueueApc KeInsertQueueDpc KeInterlockedClearProcessorAffinityEx KeInterlockedSetProcessorAffinityEx KeInvalidateAllCaches KeIpiGenericCall KeIsAttachedProcess KeIsEmptyAffinityEx KeIsEqualAffinityEx KeIsExecutingDpc KeIsSingleGroupAffinityEx KeIsSubsetAffinityEx KeIsWaitListEmpty KeLeaveCriticalRegion KeLeaveGuardedRegion KeLoadMTRR KeLoaderBlock KeNumberProcessors KeOrAffinityEx KePollFreezeExecution KeProcessorGroupAffinity KeProfileInterruptWithSource KePulseEvent KeQueryActiveGroupCount KeQueryActiveProcessorAffinity KeQueryActiveProcessorCount KeQueryActiveProcessorCountEx KeQueryActiveProcessors KeQueryDpcWatchdogInformation KeQueryEffectivePriorityThread KeQueryGroupAffinity KeQueryGroupAffinityEx KeQueryHardwareCounterConfiguration KeQueryHighestNodeNumber KeQueryInterruptTime KeQueryInterruptTimePrecise KeQueryLogicalProcessorRelationship KeQueryMaximumGroupCount KeQueryMaximumProcessorCount KeQueryMaximumProcessorCountEx KeQueryNodeActiveAffinity KeQueryNodeMaximumProcessorCount KeQueryPriorityThread KeQueryRuntimeThread KeQuerySystemTime KeQuerySystemTimePrecise KeQueryTickCount KeQueryTimeIncrement KeQueryTotalCycleTimeThread KeQueryUnbiasedInterruptTime KeRaiseUserException KeReadStateEvent KeReadStateMutant KeReadStateMutex KeReadStateQueue KeReadStateSemaphore KeReadStateTimer KeRegisterBugCheckCallback KeRegisterBugCheckReasonCallback KeRegisterNmiCallback KeRegisterProcessorChangeCallback KeReleaseInterruptSpinLock KeReleaseMutant KeReleaseMutex KeReleaseSemaphore KeReleaseSpinLock KeReleaseSpinLockFromDpcLevel KeRemoveByKeyDeviceQueue KeRemoveByKeyDeviceQueueIfBusy KeRemoveDeviceQueue KeRemoveEntryDeviceQueue KeRemoveGroupAffinityEx KeRemoveProcessorAffinityEx KeRemoveProcessorGroupAffinity KeRemoveQueue KeRemoveQueueDpc KeRemoveQueueEx KeRemoveSystemServiceTable KeResetEvent KeRestoreExtendedProcessorState KeRestoreFloatingPointState KeRevertToUserAffinityThread KeRevertToUserAffinityThreadEx KeRevertToUserGroupAffinityThread KeRundownQueue KeSaveExtendedProcessorState KeSaveFloatingPointState KeSaveStateForHibernate KeServiceDescriptorTable KeSetActualBasePriorityThread KeSetAffinityThread KeSetBasePriorityThread KeSetCoalescableTimer KeSetDmaIoCoherency KeSetEvent KeSetEventBoostPriority KeSetHardwareCounterConfiguration KeSetIdealProcessorThread KeSetImportanceDpc KeSetKernelStackSwapEnable KeSetPriorityThread KeSetProfileIrql KeSetSystemAffinityThread KeSetSystemAffinityThreadEx KeSetSystemGroupAffinityThread KeSetTargetProcessorDpc KeSetTargetProcessorDpcEx KeSetTimeIncrement KeSetTimer KeSetTimerEx KeSignalCallDpcDone KeSignalCallDpcSynchronize KeStackAttachProcess KeStallWhileFrozen KeStartDynamicProcessor KeSubtractAffinityEx KeSweepLocalCaches KeSynchronizeExecution KeTestAlertThread KeTickCount KeUnstackDetachProcess KeUpdateTimeAssist KeUserModeCallback KeWaitForMultipleObjects KeWaitForMutexObject KeWaitForSingleObject KeWriteProtectPAT KiBugCheckData KiCheckForKernelApcDelivery KiCoprocessorError KiCpuId KiDeliverApc KiDispatchInterrupt KiIpiServiceRoutine KiUnexpectedInterrupt KseQueryDeviceData KseQueryDeviceDataList KseQueryDeviceFlags KseRegisterShim KseRegisterShimEx KseSetDeviceFlags KseUnregisterShim LdrAccessResource LdrEnumResources LdrFindResourceDirectory_U LdrFindResourceEx_U LdrFindResource_U LdrResFindResource LdrResFindResourceDirectory LdrResSearchResource LpcPortObjectType LpcReplyWaitReplyPort LpcRequestPort LpcRequestWaitReplyPort LpcRequestWaitReplyPortEx LpcSendWaitReceivePort LsaCallAuthenticationPackage LsaDeregisterLogonProcess LsaFreeReturnBuffer LsaLogonUser LsaLookupAuthenticationPackage LsaRegisterLogonProcess Mm64BitPhysicalAddress MmAddPhysicalMemory MmAddVerifierThunks MmAdjustWorkingSetSize MmAdvanceMdl MmAllocateContiguousMemory MmAllocateContiguousMemorySpecifyCache MmAllocateContiguousMemorySpecifyCacheNode MmAllocateContiguousNodeMemory MmAllocateMappingAddress MmAllocateMdlForIoSpace MmAllocateNodePagesForMdlEx MmAllocateNonCachedMemory MmAllocatePagesForMdl MmAllocatePagesForMdlEx MmAreMdlPagesCached MmBadPointer MmBuildMdlForNonPagedPool MmCanFileBeTruncated MmCommitSessionMappedView MmCopyVirtualMemory MmCreateMdl MmCreateMirror MmCreateSection MmDisableModifiedWriteOfSection MmDoesFileHaveUserWritableReferences MmFlushImageSection MmForceSectionClosed MmFreeContiguousMemory MmFreeContiguousMemorySpecifyCache MmFreeMappingAddress MmFreeNonCachedMemory MmFreePagesFromMdl MmGetMaximumFileSectionSize MmGetPhysicalAddress MmGetPhysicalMemoryRanges MmGetSystemRoutineAddress MmGetVirtualForPhysical MmGrowKernelStack MmHighestUserAddress MmIsAddressValid MmIsDriverSuspectForVerifier MmIsDriverVerifying MmIsDriverVerifyingByAddress MmIsIoSpaceActive MmIsNonPagedSystemAddressValid MmIsRecursiveIoFault MmIsThisAnNtAsSystem MmIsVerifierEnabled MmLockPagableDataSection MmLockPagableImageSection MmLockPagableSectionByHandle MmMapIoSpace MmMapLockedPages MmMapLockedPagesSpecifyCache MmMapLockedPagesWithReservedMapping MmMapMemoryDumpMdl MmMapUserAddressesToPage MmMapVideoDisplay MmMapViewInSessionSpace MmMapViewInSessionSpaceEx MmMapViewInSystemSpace MmMapViewInSystemSpaceEx MmMapViewOfSection MmMarkPhysicalMemoryAsBad MmMarkPhysicalMemoryAsGood MmMdlPageContentsState MmPageEntireDriver MmPrefetchPages MmPrefetchVirtualAddresses MmProbeAndLockPages MmProbeAndLockProcessPages MmProbeAndLockSelectedPages MmProtectMdlSystemAddress MmQuerySystemSize MmRemovePhysicalMemory MmResetDriverPaging MmRotatePhysicalView MmSectionObjectType MmSecureVirtualMemory MmSetAddressRangeModified MmSetBankedSection MmSizeOfMdl MmSystemRangeStart MmTrimAllSystemPagableMemory MmUnlockPagableImageSection MmUnlockPages MmUnmapIoSpace MmUnmapLockedPages MmUnmapReservedMapping MmUnmapVideoDisplay MmUnmapViewInSessionSpace MmUnmapViewInSystemSpace MmUnmapViewOfSection MmUnsecureVirtualMemory MmUserProbeAddress NlsAnsiCodePage NlsLeadByteInfo NlsMbCodePageTag NlsMbOemCodePageTag NlsOemCodePage NlsOemLeadByteInfo NtAddAtom NtAdjustPrivilegesToken NtAllocateLocallyUniqueId NtAllocateUuids NtAllocateVirtualMemory NtBuildGUID NtBuildLab NtBuildNumber NtClose NtCommitComplete NtCommitEnlistment NtCommitTransaction NtConnectPort NtCreateEnlistment NtCreateEvent NtCreateFile NtCreateResourceManager NtCreateSection NtCreateTransaction NtCreateTransactionManager NtDeleteAtom NtDeleteFile NtDeviceIoControlFile NtDuplicateObject NtDuplicateToken NtEnumerateTransactionObject NtFindAtom NtFreeVirtualMemory NtFreezeTransactions NtFsControlFile NtGetEnvironmentVariableEx NtGetNotificationResourceManager NtGlobalFlag NtLockFile NtMakePermanentObject NtMapViewOfSection NtNotifyChangeDirectoryFile NtOpenEnlistment NtOpenFile NtOpenProcess NtOpenProcessToken NtOpenProcessTokenEx NtOpenResourceManager NtOpenThread NtOpenThreadToken NtOpenThreadTokenEx NtOpenTransaction NtOpenTransactionManager NtPrePrepareComplete NtPrePrepareEnlistment NtPrepareComplete NtPrepareEnlistment NtPropagationComplete NtPropagationFailed NtQueryDirectoryFile NtQueryEaFile NtQueryEnvironmentVariableInfoEx NtQueryInformationAtom NtQueryInformationEnlistment NtQueryInformationFile NtQueryInformationProcess NtQueryInformationResourceManager NtQueryInformationThread NtQueryInformationToken NtQueryInformationTransaction NtQueryInformationTransactionManager NtQueryQuotaInformationFile NtQuerySecurityAttributesToken NtQuerySecurityObject NtQuerySystemInformation NtQuerySystemInformationEx NtQueryVolumeInformationFile NtReadFile NtReadOnlyEnlistment NtRecoverEnlistment NtRecoverResourceManager NtRecoverTransactionManager NtRequestPort NtRequestWaitReplyPort NtRollbackComplete NtRollbackEnlistment NtRollbackTransaction NtSetCachedSigningLevel NtSetEaFile NtSetEvent NtSetInformationEnlistment NtSetInformationFile NtSetInformationProcess NtSetInformationResourceManager NtSetInformationThread NtSetInformationToken NtSetInformationTransaction NtSetInformationVirtualMemory NtSetQuotaInformationFile NtSetSecurityObject NtSetVolumeInformationFile NtShutdownSystem NtThawTransactions NtTraceControl NtTraceEvent NtUnlockFile NtVdmControl NtWaitForSingleObject NtWriteFile ObAssignSecurity ObCheckCreateObjectAccess ObCheckObjectAccess ObCloseHandle ObCreateObject ObCreateObjectType ObDeleteCapturedInsertInfo ObDereferenceObject ObDereferenceObjectDeferDelete ObDereferenceObjectDeferDeleteWithTag ObDereferenceSecurityDescriptor ObDuplicateObject ObFindHandleForObject ObGetFilterVersion ObGetObjectSecurity ObGetObjectType ObInsertObject ObIsDosDeviceLocallyMapped ObIsKernelHandle ObLogSecurityDescriptor ObMakeTemporaryObject ObOpenObjectByName ObOpenObjectByPointer ObOpenObjectByPointerWithTag ObQueryNameInfo ObQueryNameString ObQueryObjectAuditingByHandle ObReferenceObjectByHandle ObReferenceObjectByHandleWithTag ObReferenceObjectByName ObReferenceObjectByPointer ObReferenceObjectByPointerWithTag ObReferenceSecurityDescriptor ObRegisterCallbacks ObReleaseObjectSecurity ObSetHandleAttributes ObSetSecurityDescriptorInfo ObSetSecurityObjectByPointer ObUnRegisterCallbacks ObWaitForMultipleObjects ObWaitForSingleObject POGOBuffer PcwAddInstance PcwCloseInstance PcwCreateInstance PcwRegister PcwUnregister PfFileInfoNotify PfxFindPrefix PfxInitialize PfxInsertPrefix PfxRemovePrefix PoAllProcessorsDeepIdle PoCallDriver PoCancelDeviceNotify PoClearPowerRequest PoCreatePowerRequest PoDeletePowerRequest PoDisableSleepStates PoEndDeviceBusy PoFxActivateComponent PoFxCompleteDevicePowerNotRequired PoFxCompleteIdleCondition PoFxCompleteIdleState PoFxIdleComponent PoFxNotifySurprisePowerOn PoFxPowerControl PoFxProcessorNotification PoFxRegisterCoreDevice PoFxRegisterDevice PoFxRegisterPlugin PoFxRegisterPluginEx PoFxRegisterPrimaryDevice PoFxReportDevicePoweredOn PoFxSetComponentLatency PoFxSetComponentResidency PoFxSetComponentWake PoFxSetDeviceIdleTimeout PoFxStartDevicePowerManagement PoFxUnregisterDevice PoGetProcessorIdleAccounting PoGetSystemWake PoInitiateProcessorWake PoLatencySensitivityHint PoNotifyDisableDynamicTick PoQueryWatchdogTime PoQueueShutdownWorkItem PoReenableSleepStates PoRegisterCoalescingCallback PoRegisterDeviceForIdleDetection PoRegisterDeviceNotify PoRegisterPowerSettingCallback PoRegisterSystemState PoRequestPowerIrp PoRequestShutdownEvent PoSetDeviceBusyEx PoSetFixedWakeSource PoSetHiberRange PoSetPowerRequest PoSetPowerState PoSetSystemState PoSetSystemWake PoSetUserPresent PoShutdownBugCheck PoStartDeviceBusy PoStartNextPowerIrp PoUnregisterCoalescingCallback PoUnregisterPowerSettingCallback PoUnregisterSystemState PoUserShutdownCancelled PoUserShutdownInitiated ProbeForRead ProbeForWrite PsAcquireProcessExitSynchronization PsAssignImpersonationToken PsChargePoolQuota PsChargeProcessNonPagedPoolQuota PsChargeProcessPagedPoolQuota PsChargeProcessPoolQuota PsChargeProcessWakeCounter PsCreateSystemThread PsCreateSystemThreadEx PsDereferenceImpersonationToken PsDereferenceKernelStack PsDereferencePrimaryToken PsDisableImpersonation PsEnterPriorityRegion PsEstablishWin32Callouts PsGetContextThread PsGetCurrentProcess PsGetCurrentProcessId PsGetCurrentProcessSessionId PsGetCurrentProcessWin32Process PsGetCurrentThread PsGetCurrentThreadId PsGetCurrentThreadPreviousMode PsGetCurrentThreadProcess PsGetCurrentThreadProcessId PsGetCurrentThreadStackBase PsGetCurrentThreadStackLimit PsGetCurrentThreadTeb PsGetCurrentThreadWin32Thread PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion PsGetJobLock PsGetJobSessionId PsGetJobUIRestrictionsClass PsGetProcessCommonJob PsGetProcessCreateTimeQuadPart PsGetProcessDebugPort PsGetProcessExitProcessCalled PsGetProcessExitStatus PsGetProcessExitTime PsGetProcessId PsGetProcessImageFileName PsGetProcessInheritedFromUniqueProcessId PsGetProcessJob PsGetProcessPeb PsGetProcessPriorityClass PsGetProcessSectionBaseAddress PsGetProcessSecurityPort PsGetProcessSessionId PsGetProcessSessionIdEx PsGetProcessSignatureLevel PsGetProcessWin32Process PsGetProcessWin32WindowStation PsGetThreadExitStatus PsGetThreadFreezeCount PsGetThreadHardErrorsAreDisabled PsGetThreadId PsGetThreadProcess PsGetThreadProcessId PsGetThreadSessionId PsGetThreadTeb PsGetThreadWin32Thread PsGetVersion PsImpersonateClient PsInitialSystemProcess PsIsCurrentThreadPrefetching PsIsDiskCountersEnabled PsIsProcessBeingDebugged PsIsProtectedProcess PsIsSystemProcess PsIsSystemThread PsIsThreadImpersonating PsIsThreadTerminating PsJobType PsLeavePriorityRegion PsLookupProcessByProcessId PsLookupProcessThreadByCid PsLookupThreadByThreadId PsProcessType PsQueryProcessAttributesByToken PsQueryProcessExceptionFlags PsQueryTotalCycleTimeProcess PsReferenceImpersonationToken PsReferenceKernelStack PsReferencePrimaryToken PsReferenceProcessFilePointer PsReleaseProcessExitSynchronization PsReleaseProcessWakeCounter PsRemoveCreateThreadNotifyRoutine PsRemoveLoadImageNotifyRoutine PsRestoreImpersonation PsResumeProcess PsReturnPoolQuota PsReturnProcessNonPagedPoolQuota PsReturnProcessPagedPoolQuota PsRevertThreadToSelf PsRevertToSelf PsSetContextThread PsSetCreateProcessNotifyRoutine PsSetCreateProcessNotifyRoutineEx PsSetCreateThreadNotifyRoutine PsSetCurrentThreadPrefetching PsSetLegoNotifyRoutine PsSetLoadImageNotifyRoutine PsSetProcessPriorityByClass PsSetProcessPriorityClass PsSetProcessSecurityPort PsSetProcessWin32Process PsSetProcessWindowStation PsSetThreadHardErrorsAreDisabled PsSetThreadWin32Thread PsSuspendProcess PsTerminateSystemThread PsThreadType PsUILanguageComitted PsUpdateDiskCounters PsWrapApcWow64Thread READ_REGISTER_BUFFER_UCHAR READ_REGISTER_BUFFER_ULONG READ_REGISTER_BUFFER_USHORT READ_REGISTER_UCHAR READ_REGISTER_ULONG READ_REGISTER_USHORT RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlAddAccessAllowedAceEx RtlAddAce RtlAddAtomToAtomTable RtlAddAtomToAtomTableEx RtlAddRange RtlAddResourceAttributeAce RtlAllocateHeap RtlAnsiCharToUnicodeChar RtlAnsiStringToUnicodeSize RtlAnsiStringToUnicodeString RtlAppendAsciizToString RtlAppendStringToString RtlAppendUnicodeStringToString RtlAppendUnicodeToString RtlAreAllAccessesGranted RtlAreAnyAccessesGranted RtlAreBitsClear RtlAreBitsSet RtlAssert RtlCaptureContext RtlCaptureStackBackTrace RtlCharToInteger RtlCheckPortableOperatingSystem RtlCheckRegistryKey RtlCheckTokenCapability RtlCheckTokenMembership RtlCheckTokenMembershipEx RtlClearAllBits RtlClearBit RtlClearBits RtlCmDecodeMemIoResource RtlCmEncodeMemIoResource RtlCompareAltitudes RtlCompareMemory RtlCompareMemoryUlong RtlCompareString RtlCompareUnicodeString RtlCompareUnicodeStrings RtlCompressBuffer RtlCompressChunks RtlComputeCrc32 RtlContractHashTable RtlConvertLongToLargeInteger RtlConvertSidToUnicodeString RtlConvertUlongToLargeInteger RtlCopyBitMap RtlCopyLuid RtlCopyLuidAndAttributesArray RtlCopyRangeList RtlCopySid RtlCopySidAndAttributesArray RtlCopyString RtlCopyUnicodeString RtlCrc32 RtlCrc64 RtlCreateAcl RtlCreateAtomTable RtlCreateAtomTableEx RtlCreateHashTable RtlCreateHashTableEx RtlCreateHeap RtlCreateRegistryKey RtlCreateSecurityDescriptor RtlCreateSystemVolumeInformationFolder RtlCreateUnicodeString RtlCreateUserThread RtlCultureNameToLCID RtlCustomCPToUnicodeN RtlDecompressBuffer RtlDecompressBufferEx RtlDecompressChunks RtlDecompressFragment RtlDelete RtlDeleteAce RtlDeleteAtomFromAtomTable RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl RtlDeleteElementGenericTableAvlEx RtlDeleteHashTable RtlDeleteNoSplay RtlDeleteOwnersRanges RtlDeleteRange RtlDeleteRegistryValue RtlDescribeChunk RtlDestroyAtomTable RtlDestroyHeap RtlDowncaseUnicodeChar RtlDowncaseUnicodeString RtlDuplicateUnicodeString RtlEmptyAtomTable RtlEndEnumerationHashTable RtlEndWeakEnumerationHashTable RtlEnlargedIntegerMultiply RtlEnlargedUnsignedDivide RtlEnlargedUnsignedMultiply RtlEnumerateEntryHashTable RtlEnumerateGenericTable RtlEnumerateGenericTableAvl RtlEnumerateGenericTableLikeADirectory RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl RtlEqualLuid RtlEqualSid RtlEqualString RtlEqualUnicodeString RtlEqualWnfChangeStamps RtlEthernetAddressToStringA RtlEthernetAddressToStringW RtlEthernetStringToAddressA RtlEthernetStringToAddressW RtlExpandHashTable RtlExtendedIntegerMultiply RtlExtendedLargeIntegerDivide RtlExtendedMagicDivide RtlExtractBitMap RtlFillMemory RtlFillMemoryUlong RtlFillMemoryUlonglong RtlFindAceByType RtlFindClearBits RtlFindClearBitsAndSet RtlFindClearRuns RtlFindClosestEncodableLength RtlFindFirstRunClear RtlFindLastBackwardRunClear RtlFindLeastSignificantBit RtlFindLongestRunClear RtlFindMessage RtlFindMostSignificantBit RtlFindNextForwardRunClear RtlFindRange RtlFindSetBits RtlFindSetBitsAndClear RtlFindUnicodePrefix RtlFormatCurrentUserKeyPath RtlFormatMessage RtlFreeAnsiString RtlFreeHeap RtlFreeOemString RtlFreeRangeList RtlFreeUnicodeString RtlGUIDFromString RtlGenerate8dot3Name RtlGenerateClass5Guid RtlGetAce RtlGetAppContainerNamedObjectPath RtlGetCallersAddress RtlGetCompressionWorkSpaceSize RtlGetDaclSecurityDescriptor RtlGetDefaultCodePage RtlGetElementGenericTable RtlGetElementGenericTableAvl RtlGetEnabledExtendedFeatures RtlGetFirstRange RtlGetGroupSecurityDescriptor RtlGetIntegerAtom RtlGetLastRange RtlGetNextEntryHashTable RtlGetNextRange RtlGetNtGlobalFlags RtlGetOwnerSecurityDescriptor RtlGetProductInfo RtlGetSaclSecurityDescriptor RtlGetSetBootStatusData RtlGetThreadLangIdByIndex RtlGetVersion RtlHashUnicodeString RtlIdnToAscii RtlIdnToNameprepUnicode RtlIdnToUnicode RtlImageDirectoryEntryToData RtlImageNtHeader RtlInitAnsiString RtlInitAnsiStringEx RtlInitCodePageTable RtlInitEnumerationHashTable RtlInitString RtlInitUnicodeString RtlInitUnicodeStringEx RtlInitWeakEnumerationHashTable RtlInitializeBitMap RtlInitializeGenericTable RtlInitializeGenericTableAvl RtlInitializeRangeList RtlInitializeSid RtlInitializeUnicodePrefix RtlInsertElementGenericTable RtlInsertElementGenericTableAvl RtlInsertElementGenericTableFull RtlInsertElementGenericTableFullAvl RtlInsertEntryHashTable RtlInsertUnicodePrefix RtlInt64ToUnicodeString RtlIntegerToChar RtlIntegerToUnicode RtlIntegerToUnicodeString RtlInvertRangeList RtlInvertRangeListEx RtlIoDecodeMemIoResource RtlIoEncodeMemIoResource RtlIpv4AddressToStringA RtlIpv4AddressToStringExA RtlIpv4AddressToStringExW RtlIpv4AddressToStringW RtlIpv4StringToAddressA RtlIpv4StringToAddressExA RtlIpv4StringToAddressExW RtlIpv4StringToAddressW RtlIpv6AddressToStringA RtlIpv6AddressToStringExA RtlIpv6AddressToStringExW RtlIpv6AddressToStringW RtlIpv6StringToAddressA RtlIpv6StringToAddressExA RtlIpv6StringToAddressExW RtlIpv6StringToAddressW RtlIsGenericTableEmpty RtlIsGenericTableEmptyAvl RtlIsNameLegalDOS8Dot3 RtlIsNormalizedString RtlIsNtDdiVersionAvailable RtlIsRangeAvailable RtlIsServicePackVersionInstalled RtlIsUntrustedObject RtlIsValidOemCharacter RtlLCIDToCultureName RtlLargeIntegerAdd RtlLargeIntegerArithmeticShift RtlLargeIntegerDivide RtlLargeIntegerNegate RtlLargeIntegerShiftLeft RtlLargeIntegerShiftRight RtlLargeIntegerSubtract RtlLengthRequiredSid RtlLengthSecurityDescriptor RtlLengthSid RtlLoadString RtlLocalTimeToSystemTime RtlLockBootStatusData RtlLookupAtomInAtomTable RtlLookupElementGenericTable RtlLookupElementGenericTableAvl RtlLookupElementGenericTableFull RtlLookupElementGenericTableFullAvl RtlLookupEntryHashTable RtlLookupFirstMatchingElementGenericTableAvl RtlMapGenericMask RtlMapSecurityErrorToNtStatus RtlMergeRangeLists RtlMoveMemory RtlMultiByteToUnicodeN RtlMultiByteToUnicodeSize RtlNextUnicodePrefix RtlNormalizeString RtlNtStatusToDosError RtlNtStatusToDosErrorNoTeb RtlNumberGenericTableElements RtlNumberGenericTableElementsAvl RtlNumberOfClearBits RtlNumberOfClearBitsInRange RtlNumberOfSetBits RtlNumberOfSetBitsInRange RtlNumberOfSetBitsUlongPtr RtlOemStringToCountedUnicodeString RtlOemStringToUnicodeSize RtlOemStringToUnicodeString RtlOemToUnicodeN RtlOpenCurrentUser RtlOwnerAcesPresent RtlPinAtomInAtomTable RtlPrefixString RtlPrefixUnicodeString RtlQueryAtomInAtomTable RtlQueryDynamicTimeZoneInformation RtlQueryElevationFlags RtlQueryInformationAcl RtlQueryModuleInformation RtlQueryPackageIdentity RtlQueryRegistryValues RtlQueryRegistryValuesEx RtlQueryTimeZoneInformation RtlQueryValidationRunlevel RtlRaiseException RtlRandom RtlRandomEx RtlRbInsertNodeEx RtlRbRemoveNode RtlRealPredecessor RtlRealSuccessor RtlRemoveEntryHashTable RtlRemoveUnicodePrefix RtlReplaceSidInSd RtlReserveChunk RtlRunOnceBeginInitialize RtlRunOnceComplete RtlRunOnceExecuteOnce RtlRunOnceInitialize RtlSecondsSince1970ToTime RtlSecondsSince1980ToTime RtlSelfRelativeToAbsoluteSD2 RtlSelfRelativeToAbsoluteSD RtlSetAllBits RtlSetBit RtlSetBits RtlSetControlSecurityDescriptor RtlSetDaclSecurityDescriptor RtlSetDynamicTimeZoneInformation RtlSetGroupSecurityDescriptor RtlSetOwnerSecurityDescriptor RtlSetPortableOperatingSystem RtlSetSaclSecurityDescriptor RtlSetTimeZoneInformation RtlSidHashInitialize RtlSidHashLookup RtlSizeHeap RtlSplay RtlStringFromGUID RtlSubAuthorityCountSid RtlSubAuthoritySid RtlSubtreePredecessor RtlSubtreeSuccessor RtlSystemTimeToLocalTime RtlTestBit RtlTimeFieldsToTime RtlTimeToElapsedTimeFields RtlTimeToSecondsSince1970 RtlTimeToSecondsSince1980 RtlTimeToTimeFields RtlTraceDatabaseAdd RtlTraceDatabaseCreate RtlTraceDatabaseDestroy RtlTraceDatabaseEnumerate RtlTraceDatabaseFind RtlTraceDatabaseLock RtlTraceDatabaseUnlock RtlTraceDatabaseValidate RtlUTF8ToUnicodeN RtlUnicodeStringToAnsiSize RtlUnicodeStringToAnsiString RtlUnicodeStringToCountedOemString RtlUnicodeStringToInteger RtlUnicodeStringToOemSize RtlUnicodeStringToOemString RtlUnicodeToCustomCPN RtlUnicodeToMultiByteN RtlUnicodeToMultiByteSize RtlUnicodeToOemN RtlUnicodeToUTF8N RtlUnlockBootStatusData RtlUnwind RtlUpcaseUnicodeChar RtlUpcaseUnicodeString RtlUpcaseUnicodeStringToAnsiString RtlUpcaseUnicodeStringToCountedOemString RtlUpcaseUnicodeStringToOemString RtlUpcaseUnicodeToCustomCPN RtlUpcaseUnicodeToMultiByteN RtlUpcaseUnicodeToOemN RtlUpperChar RtlUpperString RtlValidRelativeSecurityDescriptor RtlValidSecurityDescriptor RtlValidSid RtlValidateUnicodeString RtlVerifyVersionInfo RtlVolumeDeviceToDosName RtlWalkFrameChain RtlWeaklyEnumerateEntryHashTable RtlWriteRegistryValue RtlZeroHeap RtlZeroMemory RtlxAnsiStringToUnicodeSize RtlxOemStringToUnicodeSize RtlxUnicodeStringToAnsiSize RtlxUnicodeStringToOemSize SeAccessCheck SeAccessCheckEx SeAccessCheckFromState SeAccessCheckFromStateEx SeAccessCheckWithHint SeAppendPrivileges SeAssignSecurity SeAssignSecurityEx SeAuditHardLinkCreation SeAuditHardLinkCreationWithTransaction SeAuditTransactionStateChange SeAuditingAnyFileEventsWithContext SeAuditingAnyFileEventsWithContextEx SeAuditingFileEvents SeAuditingFileEventsWithContext SeAuditingFileEventsWithContextEx SeAuditingFileOrGlobalEvents SeAuditingHardLinkEvents SeAuditingHardLinkEventsWithContext SeCaptureSecurityDescriptor SeCaptureSubjectContext SeCaptureSubjectContextEx SeCloseObjectAuditAlarm SeCloseObjectAuditAlarmForNonObObject SeComputeAutoInheritByObjectType SeCreateAccessState SeCreateAccessStateEx SeCreateClientSecurity SeCreateClientSecurityEx SeCreateClientSecurityFromSubjectContext SeCreateClientSecurityFromSubjectContextEx SeDeassignSecurity SeDeleteAccessState SeDeleteObjectAuditAlarm SeDeleteObjectAuditAlarmWithTransaction SeExamineSacl SeExports SeFilterToken SeFreePrivileges SeGetLinkedToken SeGetLogonSessionToken SeImpersonateClient SeImpersonateClientEx SeLocateProcessImageName SeLockSubjectContext SeMarkLogonSessionForTerminationNotification SeOpenObjectAuditAlarm SeOpenObjectAuditAlarmForNonObObject SeOpenObjectAuditAlarmWithTransaction SeOpenObjectForDeleteAuditAlarm SeOpenObjectForDeleteAuditAlarmWithTransaction SePrivilegeCheck SePrivilegeObjectAuditAlarm SePublicDefaultDacl SeQueryAuthenticationIdToken SeQueryInformationToken SeQuerySecureBootPolicyValue SeQuerySecurityAttributesToken SeQuerySecurityDescriptorInfo SeQuerySessionIdToken SeRegisterLogonSessionTerminatedRoutine SeReleaseSecurityDescriptor SeReleaseSubjectContext SeReportSecurityEvent SeReportSecurityEventWithSubCategory SeSecurityAttributePresent SeSetAccessStateGenericMapping SeSetAuditParameter SeSetSecurityAttributesToken SeSetSecurityDescriptorInfo SeSetSecurityDescriptorInfoEx SeSinglePrivilegeCheck SeSrpAccessCheck SeSystemDefaultDacl SeSystemDefaultSd SeTokenFromAccessInformation SeTokenImpersonationLevel SeTokenIsAdmin SeTokenIsRestricted SeTokenIsWriteRestricted SeTokenObjectType SeTokenType SeUnlockSubjectContext SeUnregisterLogonSessionTerminatedRoutine SeValidSecurityDescriptor TmCancelPropagationRequest TmCommitComplete TmCommitEnlistment TmCommitTransaction TmCreateEnlistment TmCurrentTransaction TmDereferenceEnlistmentKey TmEnableCallbacks TmEndPropagationRequest TmEnlistmentObjectType TmFreezeTransactions TmGetTransactionId TmInitSystem TmInitSystemPhase2 TmInitializeTransactionManager TmIsKTMCommitCoordinator TmIsTransactionActive TmPrePrepareComplete TmPrePrepareEnlistment TmPrepareComplete TmPrepareEnlistment TmPropagationComplete TmPropagationFailed TmReadOnlyEnlistment TmRecoverEnlistment TmRecoverResourceManager TmRecoverTransactionManager TmReferenceEnlistmentKey TmRenameTransactionManager TmRequestOutcomeEnlistment TmResourceManagerObjectType TmRollbackComplete TmRollbackEnlistment TmRollbackTransaction TmSetCurrentTransaction TmSinglePhaseReject TmThawTransactions TmTransactionManagerObjectType TmTransactionObjectType VerSetConditionMask VfFailDeviceNode VfFailDriver VfFailSystemBIOS VfIsVerificationEnabled WRITE_REGISTER_BUFFER_UCHAR WRITE_REGISTER_BUFFER_ULONG WRITE_REGISTER_BUFFER_USHORT WRITE_REGISTER_UCHAR WRITE_REGISTER_ULONG WRITE_REGISTER_USHORT WheaAddErrorSource WheaConfigureErrorSource WheaGetErrorSource WheaInitializeRecordHeader WheaReportHwError WmiQueryTraceInformation WmiTraceMessage WmiTraceMessageVa XIPDispatch ZwAccessCheckAndAuditAlarm ZwAddBootEntry ZwAddDriverEntry ZwAdjustPrivilegesToken ZwAlertThread ZwAllocateLocallyUniqueId ZwAllocateVirtualMemory ZwAlpcAcceptConnectPort ZwAlpcCancelMessage ZwAlpcConnectPort ZwAlpcConnectPortEx ZwAlpcCreatePort ZwAlpcCreatePortSection ZwAlpcCreateResourceReserve ZwAlpcCreateSectionView ZwAlpcCreateSecurityContext ZwAlpcDeletePortSection ZwAlpcDeleteResourceReserve ZwAlpcDeleteSectionView ZwAlpcDeleteSecurityContext ZwAlpcDisconnectPort ZwAlpcQueryInformation ZwAlpcSendWaitReceivePort ZwAlpcSetInformation ZwAssignProcessToJobObject ZwCancelIoFile ZwCancelTimer ZwClearEvent ZwClose ZwCloseObjectAuditAlarm ZwCommitComplete ZwCommitEnlistment ZwCommitTransaction ZwConnectPort ZwCreateDirectoryObject ZwCreateEnlistment ZwCreateEvent ZwCreateFile ZwCreateIoCompletion ZwCreateJobObject ZwCreateKey ZwCreateKeyTransacted ZwCreateResourceManager ZwCreateSection ZwCreateSymbolicLinkObject ZwCreateTimer ZwCreateTransaction ZwCreateTransactionManager ZwCreateWnfStateName ZwDeleteBootEntry ZwDeleteDriverEntry ZwDeleteFile ZwDeleteKey ZwDeleteValueKey ZwDeleteWnfStateData ZwDeleteWnfStateName ZwDeviceIoControlFile ZwDisplayString ZwDuplicateObject ZwDuplicateToken ZwEnumerateBootEntries ZwEnumerateDriverEntries ZwEnumerateKey ZwEnumerateTransactionObject ZwEnumerateValueKey ZwFlushBuffersFile ZwFlushBuffersFileEx ZwFlushInstructionCache ZwFlushKey ZwFlushVirtualMemory ZwFreeVirtualMemory ZwFsControlFile ZwGetNotificationResourceManager ZwImpersonateAnonymousToken ZwInitiatePowerAction ZwIsProcessInJob ZwLoadDriver ZwLoadKey ZwLoadKeyEx ZwLockFile ZwLockProductActivationKeys ZwMakeTemporaryObject ZwMapViewOfSection ZwModifyBootEntry ZwModifyDriverEntry ZwNotifyChangeKey ZwNotifyChangeSession ZwOpenDirectoryObject ZwOpenEnlistment ZwOpenEvent ZwOpenFile ZwOpenJobObject ZwOpenKey ZwOpenKeyEx ZwOpenKeyTransacted ZwOpenKeyTransactedEx ZwOpenProcess ZwOpenProcessToken ZwOpenProcessTokenEx ZwOpenResourceManager ZwOpenSection ZwOpenSession ZwOpenSymbolicLinkObject ZwOpenThread ZwOpenThreadToken ZwOpenThreadTokenEx ZwOpenTimer ZwOpenTransaction ZwOpenTransactionManager ZwPowerInformation ZwPrePrepareComplete ZwPrePrepareEnlistment ZwPrepareComplete ZwPrepareEnlistment ZwPropagationComplete ZwPropagationFailed ZwPulseEvent ZwQueryBootEntryOrder ZwQueryBootOptions ZwQueryDefaultLocale ZwQueryDefaultUILanguage ZwQueryDirectoryFile ZwQueryDirectoryObject ZwQueryDriverEntryOrder ZwQueryEaFile ZwQueryFullAttributesFile ZwQueryInformationEnlistment ZwQueryInformationFile ZwQueryInformationJobObject ZwQueryInformationProcess ZwQueryInformationResourceManager ZwQueryInformationThread ZwQueryInformationToken ZwQueryInformationTransaction ZwQueryInformationTransactionManager ZwQueryInstallUILanguage ZwQueryKey ZwQueryLicenseValue ZwQueryObject ZwQueryQuotaInformationFile ZwQuerySection ZwQuerySecurityAttributesToken ZwQuerySecurityObject ZwQuerySymbolicLinkObject ZwQuerySystemEnvironmentValueEx ZwQuerySystemInformation ZwQueryValueKey ZwQueryVirtualMemory ZwQueryVolumeInformationFile ZwQueryWnfStateData ZwQueryWnfStateNameInformation ZwReadFile ZwReadOnlyEnlistment ZwRecoverEnlistment ZwRecoverResourceManager ZwRecoverTransactionManager ZwRemoveIoCompletion ZwRemoveIoCompletionEx ZwRenameKey ZwReplaceKey ZwRequestPort ZwRequestWaitReplyPort ZwResetEvent ZwRestoreKey ZwRollbackComplete ZwRollbackEnlistment ZwRollbackTransaction ZwSaveKey ZwSaveKeyEx ZwSecureConnectPort ZwSetBootEntryOrder ZwSetBootOptions ZwSetCachedSigningLevel ZwSetDefaultLocale ZwSetDefaultUILanguage ZwSetDriverEntryOrder ZwSetEaFile ZwSetEvent ZwSetInformationEnlistment ZwSetInformationFile ZwSetInformationJobObject ZwSetInformationKey ZwSetInformationObject ZwSetInformationProcess ZwSetInformationResourceManager ZwSetInformationThread ZwSetInformationToken ZwSetInformationTransaction ZwSetInformationVirtualMemory ZwSetQuotaInformationFile ZwSetSecurityObject ZwSetSystemEnvironmentValueEx ZwSetSystemInformation ZwSetSystemTime ZwSetTimer ZwSetTimerEx ZwSetValueKey ZwSetVolumeInformationFile ZwTerminateJobObject ZwTerminateProcess ZwTraceEvent ZwTranslateFilePath ZwUnloadDriver ZwUnloadKey ZwUnloadKeyEx ZwUnlockFile ZwUnlockVirtualMemory ZwUnmapViewOfSection ZwUpdateWnfStateData ZwWaitForMultipleObjects ZwWaitForSingleObject ZwWriteFile ZwYieldExecution _CIcos _CIsin _CIsqrt _abnormal_termination _alldiv _alldvrm _allmul _alloca_probe _alloca_probe_16 _alloca_probe_8 _allrem _allshl _allshr _aulldiv _aulldvrm _aullrem _aullshr _chkstk _except_handler2 _except_handler3 _global_unwind2 _i64toa_s _i64tow_s _itoa _itoa_s _itow _itow_s _local_unwind2 _ltoa_s _ltow_s _makepath_s _purecall _snprintf _snprintf_s _snscanf_s _snwprintf _snwprintf_s _snwscanf_s _splitpath_s _stricmp _strlwr _strnicmp _strnset _strnset_s _strrev _strset _strset_s _strtoui64 _strupr _swprintf _ui64toa_s _ui64tow_s _ultoa_s _ultow_s _vsnprintf _vsnprintf_s _vsnwprintf _vsnwprintf_s _vswprintf _wcsicmp _wcslwr _wcsnicmp _wcsnset _wcsnset_s _wcsrev _wcsset_s _wcsupr _wmakepath_s _wsplitpath_s _wtoi _wtol atoi atol bsearch bsearch_s isdigit islower isprint isspace isupper isxdigit mbstowcs mbtowc memchr memcmp memcpy memcpy_s memmove memmove_s memset psMUITest qsort rand sprintf sprintf_s srand sscanf_s strcat strcat_s strchr strcmp strcpy strcpy_s strlen strncat strncat_s strncmp strncpy strncpy_s strnlen strrchr strspn strstr strtok_s swprintf swprintf_s swscanf_s tolower toupper towlower towupper vDbgPrintEx vDbgPrintExWithPrefix vsprintf vsprintf_s vswprintf_s wcscat wcscat_s wcschr wcscmp wcscpy wcscpy_s wcscspn wcslen wcsncat wcsncat_s wcsncmp wcsncpy wcsncpy_s wcsnlen wcsrchr wcsspn wcsstr wcstombs wcstoul wctomb