; ; Generated from: :iprtvfs:file(vd,d:\VMs\xp64\w2k3.vdi):vfs(dvm):file(open,vol0):vfs(mount):/windows/system32/ntoskrnl.exe ; Size file: 0x43ce00 (4443648) ; Format: PE ; Size of image: 0x473000 (4665344) ; Architecture: AMD64 ; Timestamp: 0x42436096 - 2005-03-25T00:51:34 ; CcCanIWrite CcCopyRead CcCopyWrite CcDeferWrite CcFastCopyRead CcFastCopyWrite CcFastMdlReadWait CcFastReadNotPossible CcFastReadWait CcFlushCache CcGetDirtyPages CcGetFileObjectFromBcb CcGetFileObjectFromSectionPtrs CcGetFlushedValidData CcGetLsnForFileObject CcInitializeCacheMap CcIsThereDirtyData CcMapData CcMdlRead CcMdlReadComplete CcMdlWriteAbort CcMdlWriteComplete CcPinMappedData CcPinRead CcPrepareMdlWrite CcPreparePinWrite CcPurgeCacheSection CcRemapBcb CcRepinBcb CcScheduleReadAhead CcSetAdditionalCacheAttributes CcSetBcbOwnerPointer CcSetDirtyPageThreshold CcSetDirtyPinnedData CcSetFileSizes CcSetLogHandleForFile CcSetReadAheadGranularity CcUninitializeCacheMap CcUnpinData CcUnpinDataForThread CcUnpinRepinnedBcb CcWaitForCurrentLazyWriterActivity CcZeroData CmRegisterCallback CmUnRegisterCallback DbgBreakPoint DbgBreakPointWithStatus DbgCommandString DbgLoadImageSymbols DbgPrint DbgPrintEx DbgPrintReturnControlC DbgPrompt DbgQueryDebugFilterState DbgSetDebugFilterState ExAcquireFastMutex ExAcquireFastMutexUnsafe ExAcquireResourceExclusiveLite ExAcquireResourceSharedLite ExAcquireRundownProtection ExAcquireRundownProtectionCacheAware ExAcquireRundownProtectionCacheAwareEx ExAcquireRundownProtectionEx ExAcquireSharedStarveExclusive ExAcquireSharedWaitForExclusive ExAllocateCacheAwareRundownProtection ExAllocateFromPagedLookasideList ExAllocatePool ExAllocatePoolWithQuota ExAllocatePoolWithQuotaTag ExAllocatePoolWithTag ExAllocatePoolWithTagPriority ExConvertExclusiveToSharedLite ExCreateCallback ExDeleteNPagedLookasideList ExDeletePagedLookasideList ExDeleteResourceLite ExDesktopObjectType ExDisableResourceBoostLite ExEnterCriticalRegionAndAcquireFastMutexUnsafe ExEnterCriticalRegionAndAcquireResourceExclusive ExEnterCriticalRegionAndAcquireResourceShared ExEnterCriticalRegionAndAcquireSharedWaitForExclusive ExEnumHandleTable ExEventObjectType ExExtendZone ExFreeCacheAwareRundownProtection ExFreePool ExFreePoolWithTag ExFreeToPagedLookasideList ExGetCurrentProcessorCounts ExGetCurrentProcessorCpuUsage ExGetExclusiveWaiterCount ExGetPreviousMode ExGetSharedWaiterCount ExInitializeNPagedLookasideList ExInitializePagedLookasideList ExInitializeResourceLite ExInitializeRundownProtection ExInitializeRundownProtectionCacheAware ExInitializeZone ExInterlockedAddLargeInteger ExInterlockedAddUlong ExInterlockedExtendZone ExInterlockedInsertHeadList ExInterlockedInsertTailList ExInterlockedPopEntryList ExInterlockedPushEntryList ExInterlockedRemoveHeadList ExIsProcessorFeaturePresent ExIsResourceAcquiredExclusiveLite ExIsResourceAcquiredSharedLite ExLocalTimeToSystemTime ExNotifyCallback ExQueryDepthSList ExQueryPoolBlockSize ExQueueWorkItem ExRaiseAccessViolation ExRaiseDatatypeMisalignment ExRaiseException ExRaiseHardError ExRaiseStatus ExReInitializeRundownProtection ExReInitializeRundownProtectionCacheAware ExRegisterCallback ExReinitializeResourceLite ExReleaseFastMutex ExReleaseFastMutexUnsafe ExReleaseFastMutexUnsafeAndLeaveCriticalRegion ExReleaseResourceAndLeaveCriticalRegion ExReleaseResourceForThreadLite ExReleaseResourceLite ExReleaseRundownProtection ExReleaseRundownProtectionCacheAware ExReleaseRundownProtectionCacheAwareEx ExReleaseRundownProtectionEx ExRundownCompleted ExRundownCompletedCacheAware ExSemaphoreObjectType ExSetResourceOwnerPointer ExSetTimerResolution ExSizeOfRundownProtectionCacheAware ExSystemExceptionFilter ExSystemTimeToLocalTime ExTryToAcquireFastMutex ExUnregisterCallback ExUuidCreate ExVerifySuite ExWaitForRundownProtectionRelease ExWaitForRundownProtectionReleaseCacheAware ExWindowStationObjectType ExfAcquirePushLockExclusive ExfAcquirePushLockShared ExfReleasePushLock ExfReleasePushLockExclusive ExfReleasePushLockShared ExfTryToWakePushLock ExfUnblockPushLock ExpInterlockedFlushSList ExpInterlockedPopEntrySList ExpInterlockedPushEntrySList FsRtlAcquireFileExclusive FsRtlAddBaseMcbEntry FsRtlAddLargeMcbEntry FsRtlAddMcbEntry FsRtlAddToTunnelCache FsRtlAllocateFileLock FsRtlAllocatePool FsRtlAllocatePoolWithQuota FsRtlAllocatePoolWithQuotaTag FsRtlAllocatePoolWithTag FsRtlAllocateResource FsRtlAreNamesEqual FsRtlBalanceReads FsRtlCheckLockForReadAccess FsRtlCheckLockForWriteAccess FsRtlCheckOplock FsRtlCopyRead FsRtlCopyWrite FsRtlCreateSectionForDataScan FsRtlCurrentBatchOplock FsRtlDeleteKeyFromTunnelCache FsRtlDeleteTunnelCache FsRtlDeregisterUncProvider FsRtlDissectDbcs FsRtlDissectName FsRtlDoesDbcsContainWildCards FsRtlDoesNameContainWildCards FsRtlFastCheckLockForRead FsRtlFastCheckLockForWrite FsRtlFastUnlockAll FsRtlFastUnlockAllByKey FsRtlFastUnlockSingle FsRtlFindInTunnelCache FsRtlFreeFileLock FsRtlGetFileSize FsRtlGetNextBaseMcbEntry FsRtlGetNextFileLock FsRtlGetNextLargeMcbEntry FsRtlGetNextMcbEntry FsRtlIncrementCcFastReadNoWait FsRtlIncrementCcFastReadNotPossible FsRtlIncrementCcFastReadResourceMiss FsRtlIncrementCcFastReadWait FsRtlInitializeBaseMcb FsRtlInitializeFileLock FsRtlInitializeLargeMcb FsRtlInitializeMcb FsRtlInitializeOplock FsRtlInitializeTunnelCache FsRtlInsertPerFileObjectContext FsRtlInsertPerStreamContext FsRtlIsDbcsInExpression FsRtlIsFatDbcsLegal FsRtlIsHpfsDbcsLegal FsRtlIsNameInExpression FsRtlIsNtstatusExpected FsRtlIsPagingFile FsRtlIsTotalDeviceFailure FsRtlLegalAnsiCharacterArray FsRtlLookupBaseMcbEntry FsRtlLookupLargeMcbEntry FsRtlLookupLastBaseMcbEntry FsRtlLookupLastBaseMcbEntryAndIndex FsRtlLookupLastLargeMcbEntry FsRtlLookupLastLargeMcbEntryAndIndex FsRtlLookupLastMcbEntry FsRtlLookupMcbEntry FsRtlLookupPerFileObjectContext FsRtlLookupPerStreamContextInternal FsRtlMdlRead FsRtlMdlReadComplete FsRtlMdlReadCompleteDev FsRtlMdlReadDev FsRtlMdlWriteComplete FsRtlMdlWriteCompleteDev FsRtlNormalizeNtstatus FsRtlNotifyChangeDirectory FsRtlNotifyCleanup FsRtlNotifyFilterChangeDirectory FsRtlNotifyFilterReportChange FsRtlNotifyFullChangeDirectory FsRtlNotifyFullReportChange FsRtlNotifyInitializeSync FsRtlNotifyReportChange FsRtlNotifyUninitializeSync FsRtlNotifyVolumeEvent FsRtlNumberOfRunsInBaseMcb FsRtlNumberOfRunsInLargeMcb FsRtlNumberOfRunsInMcb FsRtlOplockFsctrl FsRtlOplockIsFastIoPossible FsRtlPostPagingFileStackOverflow FsRtlPostStackOverflow FsRtlPrepareMdlWrite FsRtlPrepareMdlWriteDev FsRtlPrivateLock FsRtlProcessFileLock FsRtlRegisterFileSystemFilterCallbacks FsRtlRegisterUncProvider FsRtlReleaseFile FsRtlRemoveBaseMcbEntry FsRtlRemoveLargeMcbEntry FsRtlRemoveMcbEntry FsRtlRemovePerFileObjectContext FsRtlRemovePerStreamContext FsRtlResetBaseMcb FsRtlResetLargeMcb FsRtlSplitBaseMcb FsRtlSplitLargeMcb FsRtlSyncVolumes FsRtlTeardownPerStreamContexts FsRtlTruncateBaseMcb FsRtlTruncateLargeMcb FsRtlTruncateMcb FsRtlUninitializeBaseMcb FsRtlUninitializeFileLock FsRtlUninitializeLargeMcb FsRtlUninitializeMcb FsRtlUninitializeOplock HalDispatchTable HalExamineMBR HalPrivateDispatchTable HeadlessDispatch InbvAcquireDisplayOwnership InbvCheckDisplayOwnership InbvDisplayString InbvEnableBootDriver InbvEnableDisplayString InbvInstallDisplayStringFilter InbvIsBootDriverInstalled InbvNotifyDisplayOwnershipLost InbvResetDisplay InbvSetScrollRegion InbvSetTextColor InbvSolidColorFill InitSafeBootMode InitializeSListHead IoAcquireCancelSpinLock IoAcquireRemoveLockEx IoAcquireVpbSpinLock IoAdapterObjectType IoAllocateAdapterChannel IoAllocateController IoAllocateDriverObjectExtension IoAllocateErrorLogEntry IoAllocateIrp IoAllocateMdl IoAllocateWorkItem IoAssignDriveLetters IoAssignResources IoAttachDevice IoAttachDeviceByPointer IoAttachDeviceToDeviceStack IoAttachDeviceToDeviceStackSafe IoBuildAsynchronousFsdRequest IoBuildDeviceIoControlRequest IoBuildPartialMdl IoBuildSynchronousFsdRequest IoCallDriver IoCancelFileOpen IoCancelIrp IoCheckDesiredAccess IoCheckEaBufferValidity IoCheckFunctionAccess IoCheckQuerySetFileInformation IoCheckQuerySetVolumeInformation IoCheckQuotaBufferValidity IoCheckShareAccess IoCompleteRequest IoConnectInterrupt IoCreateController IoCreateDevice IoCreateDisk IoCreateDriver IoCreateFile IoCreateFileSpecifyDeviceObjectHint IoCreateNotificationEvent IoCreateStreamFileObject IoCreateStreamFileObjectEx IoCreateStreamFileObjectLite IoCreateSymbolicLink IoCreateSynchronizationEvent IoCreateUnprotectedSymbolicLink IoCsqInitialize IoCsqInitializeEx IoCsqInsertIrp IoCsqInsertIrpEx IoCsqRemoveIrp IoCsqRemoveNextIrp IoDeleteController IoDeleteDevice IoDeleteDriver IoDeleteSymbolicLink IoDetachDevice IoDeviceHandlerObjectSize IoDeviceHandlerObjectType IoDeviceObjectType IoDisconnectInterrupt IoDriverObjectType IoEnqueueIrp IoEnumerateDeviceObjectList IoEnumerateRegisteredFiltersList IoFastQueryNetworkAttributes IoFileObjectType IoForwardAndCatchIrp IoForwardIrpSynchronously IoFreeController IoFreeErrorLogEntry IoFreeIrp IoFreeMdl IoFreeWorkItem IoGetAttachedDevice IoGetAttachedDeviceReference IoGetBaseFileSystemDeviceObject IoGetBootDiskInformation IoGetConfigurationInformation IoGetCurrentProcess IoGetDeviceAttachmentBaseRef IoGetDeviceInterfaceAlias IoGetDeviceInterfaces IoGetDeviceObjectPointer IoGetDeviceProperty IoGetDeviceToVerify IoGetDiskDeviceObject IoGetDmaAdapter IoGetDriverObjectExtension IoGetFileObjectGenericMapping IoGetInitialStack IoGetLowerDeviceObject IoGetPagingIoPriority IoGetRelatedDeviceObject IoGetRequestorProcess IoGetRequestorProcessId IoGetRequestorSessionId IoGetStackLimits IoGetTopLevelIrp IoInitializeIrp IoInitializeRemoveLockEx IoInitializeTimer IoInvalidateDeviceRelations IoInvalidateDeviceState IoIs32bitProcess IoIsFileOriginRemote IoIsOperationSynchronous IoIsSystemThread IoIsValidNameGraftingBuffer IoIsWdmVersionAvailable IoMakeAssociatedIrp IoOpenDeviceInterfaceRegistryKey IoOpenDeviceRegistryKey IoPageRead IoPnPDeliverServicePowerNotification IoQueryDeviceDescription IoQueryFileDosDeviceName IoQueryFileInformation IoQueryVolumeInformation IoQueueThreadIrp IoQueueWorkItem IoRaiseHardError IoRaiseInformationalHardError IoReadDiskSignature IoReadOperationCount IoReadPartitionTable IoReadPartitionTableEx IoReadTransferCount IoRegisterBootDriverReinitialization IoRegisterDeviceInterface IoRegisterDriverReinitialization IoRegisterFileSystem IoRegisterFsRegistrationChange IoRegisterLastChanceShutdownNotification IoRegisterPlugPlayNotification IoRegisterShutdownNotification IoReleaseCancelSpinLock IoReleaseRemoveLockAndWaitEx IoReleaseRemoveLockEx IoReleaseVpbSpinLock IoRemoveShareAccess IoReportDetectedDevice IoReportHalResourceUsage IoReportResourceForDetection IoReportResourceUsage IoReportTargetDeviceChange IoReportTargetDeviceChangeAsynchronous IoRequestDeviceEject IoReuseIrp IoSetCompletionRoutineEx IoSetDeviceInterfaceState IoSetDeviceToVerify IoSetFileOrigin IoSetHardErrorOrVerifyDevice IoSetInformation IoSetIoCompletion IoSetPartitionInformation IoSetPartitionInformationEx IoSetShareAccess IoSetStartIoAttributes IoSetSystemPartition IoSetThreadHardErrorMode IoSetTopLevelIrp IoStartNextPacket IoStartNextPacketByKey IoStartPacket IoStartTimer IoStatisticsLock IoStopTimer IoSynchronousInvalidateDeviceRelations IoSynchronousPageWrite IoThreadToProcess IoTranslateBusAddress IoUnregisterFileSystem IoUnregisterFsRegistrationChange IoUnregisterPlugPlayNotification IoUnregisterShutdownNotification IoUpdateShareAccess IoValidateDeviceIoControlAccess IoVerifyPartitionTable IoVerifyVolume IoVolumeDeviceToDosName IoWMIAllocateInstanceIds IoWMIDeviceObjectToInstanceName IoWMIDeviceObjectToProviderId IoWMIExecuteMethod IoWMIHandleToInstanceName IoWMIOpenBlock IoWMIQueryAllData IoWMIQueryAllDataMultiple IoWMIQuerySingleInstance IoWMIQuerySingleInstanceMultiple IoWMIRegistrationControl IoWMISetNotificationCallback IoWMISetSingleInstance IoWMISetSingleItem IoWMISuggestInstanceName IoWMIWriteEvent IoWriteErrorLogEntry IoWriteOperationCount IoWritePartitionTable IoWritePartitionTableEx IoWriteTransferCount IofCallDriver IofCompleteRequest KdChangeOption KdDebuggerEnabled KdDebuggerNotPresent KdDisableDebugger KdEnableDebugger KdEnteredDebugger KdPollBreakIn KdPowerTransition KdRefreshDebuggerNotPresent KdSystemDebugControl KeAcquireGuardedMutex KeAcquireGuardedMutexUnsafe KeAcquireInStackQueuedSpinLock KeAcquireInStackQueuedSpinLockAtDpcLevel KeAcquireInStackQueuedSpinLockForDpc KeAcquireInStackQueuedSpinLockRaiseToSynch KeAcquireInterruptSpinLock KeAcquireQueuedSpinLock KeAcquireQueuedSpinLockRaiseToSynch KeAcquireSpinLockAtDpcLevel KeAcquireSpinLockForDpc KeAcquireSpinLockRaiseToDpc KeAcquireSpinLockRaiseToSynch KeAddSystemServiceTable KeAreAllApcsDisabled KeAreApcsDisabled KeAttachProcess KeBugCheck KeBugCheckEx KeCancelTimer KeCapturePersistentThreadState KeClearEvent KeConnectInterrupt KeDelayExecutionThread KeDeregisterBugCheckCallback KeDeregisterBugCheckReasonCallback KeDeregisterNmiCallback KeDetachProcess KeDisconnectInterrupt KeEnterCriticalRegion KeEnterGuardedRegion KeEnterKernelDebugger KeExpandKernelStackAndCallout KeFindConfigurationEntry KeFindConfigurationNextEntry KeFlushEntireTb KeFlushQueuedDpcs KeGenericCallDpc KeGetCurrentIrql KeGetCurrentThread KeGetRecommendedSharedDataAlignment KeInitializeApc KeInitializeCrashDumpHeader KeInitializeDeviceQueue KeInitializeDpc KeInitializeEvent KeInitializeGuardedMutex KeInitializeInterrupt KeInitializeMutant KeInitializeMutex KeInitializeQueue KeInitializeSemaphore KeInitializeThreadedDpc KeInitializeTimer KeInitializeTimerEx KeInsertByKeyDeviceQueue KeInsertDeviceQueue KeInsertHeadQueue KeInsertQueue KeInsertQueueApc KeInsertQueueDpc KeInvalidateAllCaches KeIpiGenericCall KeIsAttachedProcess KeIsWaitListEmpty KeLastBranchMSR KeLeaveCriticalRegion KeLeaveGuardedRegion KeLoaderBlock KeLowerIrql KeNumberProcessors KeProfileInterruptWithSource KePulseEvent KeQueryActiveProcessors KeQueryMultiThreadProcessorSet KeQueryPrcbAddress KeQueryPriorityThread KeQueryRuntimeThread KeQueryTimeIncrement KeRaiseIrqlToDpcLevel KeRaiseUserException KeReadStateEvent KeReadStateMutant KeReadStateMutex KeReadStateQueue KeReadStateSemaphore KeReadStateTimer KeRegisterBugCheckCallback KeRegisterBugCheckReasonCallback KeRegisterNmiCallback KeReleaseGuardedMutex KeReleaseGuardedMutexUnsafe KeReleaseInStackQueuedSpinLock KeReleaseInStackQueuedSpinLockForDpc KeReleaseInStackQueuedSpinLockFromDpcLevel KeReleaseInterruptSpinLock KeReleaseMutant KeReleaseMutex KeReleaseQueuedSpinLock KeReleaseSemaphore KeReleaseSpinLock KeReleaseSpinLockForDpc KeReleaseSpinLockFromDpcLevel KeRemoveByKeyDeviceQueue KeRemoveByKeyDeviceQueueIfBusy KeRemoveDeviceQueue KeRemoveEntryDeviceQueue KeRemoveQueue KeRemoveQueueDpc KeRemoveSystemServiceTable KeResetEvent KeRestoreFloatingPointState KeRevertToUserAffinityThread KeRundownQueue KeSaveFloatingPointState KeSaveStateForHibernate KeServiceDescriptorTable KeSetAffinityThread KeSetBasePriorityThread KeSetDmaIoCoherency KeSetEvent KeSetEventBoostPriority KeSetIdealProcessorThread KeSetImportanceDpc KeSetKernelStackSwapEnable KeSetPriorityThread KeSetProfileIrql KeSetSystemAffinityThread KeSetTargetProcessorDpc KeSetTimeIncrement KeSetTimer KeSetTimerEx KeSignalCallDpcDone KeSignalCallDpcSynchronize KeStackAttachProcess KeSynchronizeExecution KeTerminateThread KeTestSpinLock KeTryToAcquireGuardedMutex KeTryToAcquireQueuedSpinLock KeTryToAcquireQueuedSpinLockRaiseToSynch KeTryToAcquireSpinLockAtDpcLevel KeUnstackDetachProcess KeUpdateRunTime KeUpdateSystemTime KeUserModeCallback KeWaitForMultipleObjects KeWaitForMutexObject KeWaitForSingleObject KfRaiseIrql KiBugCheckData KiCheckForKernelApcDelivery KiCpuId LdrAccessResource LdrEnumResources LdrFindResourceDirectory_U LdrFindResource_U LpcPortObjectType LpcRequestPort LpcRequestWaitReplyPort LsaCallAuthenticationPackage LsaDeregisterLogonProcess LsaFreeReturnBuffer LsaLogonUser LsaLookupAuthenticationPackage LsaRegisterLogonProcess Mm64BitPhysicalAddress MmAddPhysicalMemory MmAddVerifierThunks MmAdjustWorkingSetSize MmAdvanceMdl MmAllocateContiguousMemory MmAllocateContiguousMemorySpecifyCache MmAllocateMappingAddress MmAllocateNonCachedMemory MmAllocatePagesForMdl MmAllocatePagesForMdlEx MmBuildMdlForNonPagedPool MmCanFileBeTruncated MmCommitSessionMappedView MmCreateMdl MmCreateMirror MmCreateSection MmDisableModifiedWriteOfSection MmFlushImageSection MmForceSectionClosed MmFreeContiguousMemory MmFreeContiguousMemorySpecifyCache MmFreeMappingAddress MmFreeNonCachedMemory MmFreePagesFromMdl MmGetPhysicalAddress MmGetPhysicalMemoryRanges MmGetSystemRoutineAddress MmGetVirtualForPhysical MmGrowKernelStack MmHighestUserAddress MmIsAddressValid MmIsDriverVerifying MmIsIoSpaceActive MmIsNonPagedSystemAddressValid MmIsRecursiveIoFault MmIsThisAnNtAsSystem MmIsVerifierEnabled MmLockPagableDataSection MmLockPagableImageSection MmLockPagableSectionByHandle MmMapIoSpace MmMapLockedPages MmMapLockedPagesSpecifyCache MmMapLockedPagesWithReservedMapping MmMapMemoryDumpMdl MmMapUserAddressesToPage MmMapVideoDisplay MmMapViewInSessionSpace MmMapViewInSystemSpace MmMapViewOfSection MmMarkPhysicalMemoryAsBad MmMarkPhysicalMemoryAsGood MmPageEntireDriver MmPrefetchPages MmProbeAndLockPages MmProbeAndLockProcessPages MmProbeAndLockSelectedPages MmProtectMdlSystemAddress MmQuerySystemSize MmRemovePhysicalMemory MmResetDriverPaging MmSectionObjectType MmSecureVirtualMemory MmSetAddressRangeModified MmSetBankedSection MmSizeOfMdl MmSystemRangeStart MmTrimAllSystemPagableMemory MmUnlockPagableImageSection MmUnlockPages MmUnmapIoSpace MmUnmapLockedPages MmUnmapReservedMapping MmUnmapVideoDisplay MmUnmapViewInSessionSpace MmUnmapViewInSystemSpace MmUnmapViewOfSection MmUnsecureVirtualMemory MmUserProbeAddress NlsAnsiCodePage NlsLeadByteInfo NlsMbCodePageTag NlsMbOemCodePageTag NlsOemCodePage NlsOemLeadByteInfo NtAddAtom NtAdjustPrivilegesToken NtAllocateLocallyUniqueId NtAllocateUuids NtAllocateVirtualMemory NtBuildNumber NtClose NtConnectPort NtCreateEvent NtCreateFile NtCreateSection NtDeleteAtom NtDeleteFile NtDeviceIoControlFile NtDuplicateObject NtDuplicateToken NtFindAtom NtFreeVirtualMemory NtFsControlFile NtGlobalFlag NtLockFile NtMakePermanentObject NtMapViewOfSection NtNotifyChangeDirectoryFile NtOpenFile NtOpenProcess NtOpenProcessToken NtOpenProcessTokenEx NtOpenThread NtOpenThreadToken NtOpenThreadTokenEx NtQueryDirectoryFile NtQueryEaFile NtQueryInformationAtom NtQueryInformationFile NtQueryInformationProcess NtQueryInformationThread NtQueryInformationToken NtQueryQuotaInformationFile NtQuerySecurityObject NtQuerySystemInformation NtQueryVolumeInformationFile NtReadFile NtRequestPort NtRequestWaitReplyPort NtSetEaFile NtSetEvent NtSetInformationFile NtSetInformationProcess NtSetInformationThread NtSetQuotaInformationFile NtSetSecurityObject NtSetVolumeInformationFile NtShutdownSystem NtTraceEvent NtUnlockFile NtVdmControl NtWaitForSingleObject NtWriteFile ObAssignSecurity ObCheckCreateObjectAccess ObCheckObjectAccess ObCloseHandle ObCreateObject ObCreateObjectType ObDeleteCapturedInsertInfo ObDereferenceObject ObDereferenceSecurityDescriptor ObFindHandleForObject ObGetObjectSecurity ObInsertObject ObLogSecurityDescriptor ObMakeTemporaryObject ObOpenObjectByName ObOpenObjectByPointer ObQueryNameString ObQueryObjectAuditingByHandle ObReferenceObjectByHandle ObReferenceObjectByName ObReferenceObjectByPointer ObReferenceSecurityDescriptor ObReleaseObjectSecurity ObSetHandleAttributes ObSetSecurityDescriptorInfo ObSetSecurityObjectByPointer ObfDereferenceObject ObfReferenceObject PfxFindPrefix PfxInitialize PfxInsertPrefix PfxRemovePrefix PoCallDriver PoCancelDeviceNotify PoQueueShutdownWorkItem PoRegisterDeviceForIdleDetection PoRegisterDeviceNotify PoRegisterSystemState PoRequestPowerIrp PoRequestShutdownEvent PoSetHiberRange PoSetPowerState PoSetSystemState PoShutdownBugCheck PoStartNextPowerIrp PoUnregisterSystemState ProbeForRead ProbeForWrite PsAssignImpersonationToken PsChargePoolQuota PsChargeProcessNonPagedPoolQuota PsChargeProcessPagedPoolQuota PsChargeProcessPoolQuota PsCreateSystemProcess PsCreateSystemThread PsDereferenceImpersonationToken PsDereferencePrimaryToken PsDisableImpersonation PsEstablishWin32Callouts PsGetContextThread PsGetCurrentProcess PsGetCurrentProcessId PsGetCurrentProcessSessionId PsGetCurrentProcessWin32Process PsGetCurrentProcessWow64Process PsGetCurrentThread PsGetCurrentThreadId PsGetCurrentThreadPreviousMode PsGetCurrentThreadProcess PsGetCurrentThreadProcessId PsGetCurrentThreadStackBase PsGetCurrentThreadStackLimit PsGetCurrentThreadTeb PsGetCurrentThreadWin32Thread PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion PsGetJobLock PsGetJobSessionId PsGetJobUIRestrictionsClass PsGetProcessCreateTimeQuadPart PsGetProcessDebugPort PsGetProcessExitProcessCalled PsGetProcessExitStatus PsGetProcessExitTime PsGetProcessId PsGetProcessImageFileName PsGetProcessInheritedFromUniqueProcessId PsGetProcessJob PsGetProcessPeb PsGetProcessPriorityClass PsGetProcessSectionBaseAddress PsGetProcessSecurityPort PsGetProcessSessionId PsGetProcessSessionIdEx PsGetProcessWin32Process PsGetProcessWin32WindowStation PsGetProcessWow64Process PsGetThreadFreezeCount PsGetThreadHardErrorsAreDisabled PsGetThreadId PsGetThreadProcess PsGetThreadProcessId PsGetThreadSessionId PsGetThreadTeb PsGetThreadWin32Thread PsGetVersion PsImpersonateClient PsInitialSystemProcess PsIsProcessBeingDebugged PsIsSystemProcess PsIsSystemThread PsIsThreadImpersonating PsIsThreadTerminating PsJobType PsLookupProcessByProcessId PsLookupProcessThreadByCid PsLookupThreadByThreadId PsProcessType PsReferenceImpersonationToken PsReferencePrimaryToken PsRemoveCreateThreadNotifyRoutine PsRemoveLoadImageNotifyRoutine PsRestoreImpersonation PsReturnPoolQuota PsReturnProcessNonPagedPoolQuota PsReturnProcessPagedPoolQuota PsRevertThreadToSelf PsRevertToSelf PsSetContextThread PsSetCreateProcessNotifyRoutine PsSetCreateThreadNotifyRoutine PsSetJobUIRestrictionsClass PsSetLegoNotifyRoutine PsSetLoadImageNotifyRoutine PsSetProcessPriorityByClass PsSetProcessPriorityClass PsSetProcessSecurityPort PsSetProcessWin32Process PsSetProcessWindowStation PsSetThreadHardErrorsAreDisabled PsSetThreadWin32Thread PsTerminateSystemThread PsThreadType PsWrapApcWow64Thread RtlAbsoluteToSelfRelativeSD RtlAddAccessAllowedAce RtlAddAccessAllowedAceEx RtlAddAce RtlAddAtomToAtomTable RtlAddRange RtlAllocateHeap RtlAnsiCharToUnicodeChar RtlAnsiStringToUnicodeSize RtlAnsiStringToUnicodeString RtlAppendAsciizToString RtlAppendStringToString RtlAppendUnicodeStringToString RtlAppendUnicodeToString RtlAreAllAccessesGranted RtlAreAnyAccessesGranted RtlAreBitsClear RtlAreBitsSet RtlAssert RtlCaptureContext RtlCaptureStackBackTrace RtlCharToInteger RtlCheckRegistryKey RtlClearAllBits RtlClearBit RtlClearBits RtlCompareMemory RtlCompareMemoryUlong RtlCompareString RtlCompareUnicodeString RtlCompressBuffer RtlCompressChunks RtlConvertSidToUnicodeString RtlCopyLuid RtlCopyMemory RtlCopyMemoryNonTemporal RtlCopyRangeList RtlCopySid RtlCopyString RtlCopyUnicodeString RtlCreateAcl RtlCreateAtomTable RtlCreateHeap RtlCreateRegistryKey RtlCreateSecurityDescriptor RtlCreateSystemVolumeInformationFolder RtlCreateUnicodeString RtlCustomCPToUnicodeN RtlDecompressBuffer RtlDecompressChunks RtlDecompressFragment RtlDelete RtlDeleteAce RtlDeleteAtomFromAtomTable RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl RtlDeleteNoSplay RtlDeleteOwnersRanges RtlDeleteRange RtlDeleteRegistryValue RtlDescribeChunk RtlDestroyAtomTable RtlDestroyHeap RtlDowncaseUnicodeString RtlEmptyAtomTable RtlEnumerateGenericTable RtlEnumerateGenericTableAvl RtlEnumerateGenericTableLikeADirectory RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl RtlEqualLuid RtlEqualSid RtlEqualString RtlEqualUnicodeString RtlFillMemory RtlFindClearBits RtlFindClearBitsAndSet RtlFindClearRuns RtlFindFirstRunClear RtlFindLastBackwardRunClear RtlFindLeastSignificantBit RtlFindLongestRunClear RtlFindMessage RtlFindMostSignificantBit RtlFindNextForwardRunClear RtlFindRange RtlFindSetBits RtlFindSetBitsAndClear RtlFindUnicodePrefix RtlFormatCurrentUserKeyPath RtlFreeAnsiString RtlFreeHeap RtlFreeOemString RtlFreeRangeList RtlFreeUnicodeString RtlGUIDFromString RtlGenerate8dot3Name RtlGetAce RtlGetCallersAddress RtlGetCompressionWorkSpaceSize RtlGetDaclSecurityDescriptor RtlGetDefaultCodePage RtlGetElementGenericTable RtlGetElementGenericTableAvl RtlGetFirstRange RtlGetGroupSecurityDescriptor RtlGetNextRange RtlGetNtGlobalFlags RtlGetOwnerSecurityDescriptor RtlGetSaclSecurityDescriptor RtlGetSetBootStatusData RtlGetVersion RtlHashUnicodeString RtlImageDirectoryEntryToData RtlImageNtHeader RtlInitAnsiString RtlInitAnsiStringEx RtlInitCodePageTable RtlInitString RtlInitUnicodeString RtlInitUnicodeStringEx RtlInitializeBitMap RtlInitializeGenericTable RtlInitializeGenericTableAvl RtlInitializeRangeList RtlInitializeSid RtlInitializeUnicodePrefix RtlInsertElementGenericTable RtlInsertElementGenericTableAvl RtlInsertElementGenericTableFull RtlInsertElementGenericTableFullAvl RtlInsertUnicodePrefix RtlInt64ToUnicodeString RtlIntegerToChar RtlIntegerToUnicode RtlIntegerToUnicodeString RtlInvertRangeList RtlIpv4AddressToStringA RtlIpv4AddressToStringExA RtlIpv4AddressToStringExW RtlIpv4AddressToStringW RtlIpv4StringToAddressA RtlIpv4StringToAddressExA RtlIpv4StringToAddressExW RtlIpv4StringToAddressW RtlIpv6AddressToStringA RtlIpv6AddressToStringExA RtlIpv6AddressToStringExW RtlIpv6AddressToStringW RtlIpv6StringToAddressA RtlIpv6StringToAddressExA RtlIpv6StringToAddressExW RtlIpv6StringToAddressW RtlIsGenericTableEmpty RtlIsGenericTableEmptyAvl RtlIsNameLegalDOS8Dot3 RtlIsRangeAvailable RtlIsValidOemCharacter RtlLengthRequiredSid RtlLengthSecurityDescriptor RtlLengthSid RtlLockBootStatusData RtlLookupAtomInAtomTable RtlLookupElementGenericTable RtlLookupElementGenericTableAvl RtlLookupElementGenericTableFull RtlLookupElementGenericTableFullAvl RtlLookupFunctionEntry RtlMapGenericMask RtlMapSecurityErrorToNtStatus RtlMergeRangeLists RtlMoveMemory RtlMultiByteToUnicodeN RtlMultiByteToUnicodeSize RtlNextUnicodePrefix RtlNtStatusToDosError RtlNtStatusToDosErrorNoTeb RtlNumberGenericTableElements RtlNumberGenericTableElementsAvl RtlNumberOfClearBits RtlNumberOfSetBits RtlOemStringToCountedUnicodeString RtlOemStringToUnicodeSize RtlOemStringToUnicodeString RtlOemToUnicodeN RtlPcToFileHeader RtlPinAtomInAtomTable RtlPrefetchMemoryNonTemporal RtlPrefixString RtlPrefixUnicodeString RtlQueryAtomInAtomTable RtlQueryRegistryValues RtlQueryTimeZoneInformation RtlRaiseException RtlRandom RtlRandomEx RtlRealPredecessor RtlRealSuccessor RtlRemoveUnicodePrefix RtlReserveChunk RtlRestoreContext RtlSecondsSince1970ToTime RtlSecondsSince1980ToTime RtlSelfRelativeToAbsoluteSD RtlSelfRelativeToAbsoluteSD2 RtlSetAllBits RtlSetBit RtlSetBits RtlSetDaclSecurityDescriptor RtlSetGroupSecurityDescriptor RtlSetOwnerSecurityDescriptor RtlSetSaclSecurityDescriptor RtlSetTimeZoneInformation RtlSizeHeap RtlSplay RtlStringFromGUID RtlSubAuthorityCountSid RtlSubAuthoritySid RtlSubtreePredecessor RtlSubtreeSuccessor RtlTestBit RtlTimeFieldsToTime RtlTimeToElapsedTimeFields RtlTimeToSecondsSince1970 RtlTimeToSecondsSince1980 RtlTimeToTimeFields RtlTraceDatabaseAdd RtlTraceDatabaseCreate RtlTraceDatabaseDestroy RtlTraceDatabaseEnumerate RtlTraceDatabaseFind RtlTraceDatabaseLock RtlTraceDatabaseUnlock RtlTraceDatabaseValidate RtlUnicodeStringToAnsiSize RtlUnicodeStringToAnsiString RtlUnicodeStringToCountedOemString RtlUnicodeStringToInteger RtlUnicodeStringToOemSize RtlUnicodeStringToOemString RtlUnicodeToCustomCPN RtlUnicodeToMultiByteN RtlUnicodeToMultiByteSize RtlUnicodeToOemN RtlUnlockBootStatusData RtlUnwind RtlUnwindEx RtlUpcaseUnicodeChar RtlUpcaseUnicodeString RtlUpcaseUnicodeStringToAnsiString RtlUpcaseUnicodeStringToCountedOemString RtlUpcaseUnicodeStringToOemString RtlUpcaseUnicodeToCustomCPN RtlUpcaseUnicodeToMultiByteN RtlUpcaseUnicodeToOemN RtlUpperChar RtlUpperString RtlValidRelativeSecurityDescriptor RtlValidSecurityDescriptor RtlValidSid RtlVerifyVersionInfo RtlVirtualUnwind RtlVolumeDeviceToDosName RtlWalkFrameChain RtlWriteRegistryValue RtlZeroHeap RtlZeroMemory RtlxAnsiStringToUnicodeSize RtlxOemStringToUnicodeSize RtlxUnicodeStringToAnsiSize RtlxUnicodeStringToOemSize SeAccessCheck SeAppendPrivileges SeAssignSecurity SeAssignSecurityEx SeAuditHardLinkCreation SeAuditingFileEvents SeAuditingFileEventsWithContext SeAuditingFileOrGlobalEvents SeAuditingHardLinkEvents SeAuditingHardLinkEventsWithContext SeCaptureSecurityDescriptor SeCaptureSubjectContext SeCloseObjectAuditAlarm SeCreateAccessState SeCreateClientSecurity SeCreateClientSecurityFromSubjectContext SeDeassignSecurity SeDeleteAccessState SeDeleteObjectAuditAlarm SeExports SeFilterToken SeFreePrivileges SeImpersonateClient SeImpersonateClientEx SeLockSubjectContext SeMarkLogonSessionForTerminationNotification SeOpenObjectAuditAlarm SeOpenObjectForDeleteAuditAlarm SePrivilegeCheck SePrivilegeObjectAuditAlarm SePublicDefaultDacl SeQueryAuthenticationIdToken SeQueryInformationToken SeQuerySecurityDescriptorInfo SeQuerySessionIdToken SeRegisterLogonSessionTerminatedRoutine SeReleaseSecurityDescriptor SeReleaseSubjectContext SeReportSecurityEvent SeSetAccessStateGenericMapping SeSetAuditParameter SeSetSecurityDescriptorInfo SeSetSecurityDescriptorInfoEx SeSinglePrivilegeCheck SeSystemDefaultDacl SeTokenImpersonationLevel SeTokenIsAdmin SeTokenIsRestricted SeTokenObjectType SeTokenType SeUnlockSubjectContext SeUnregisterLogonSessionTerminatedRoutine SeValidSecurityDescriptor VerSetConditionMask VfFailDeviceNode VfFailDriver VfFailSystemBIOS VfIsVerificationEnabled WmiFlushTrace WmiGetClock WmiQueryTrace WmiQueryTraceInformation WmiStartTrace WmiStopTrace WmiTraceFastEvent WmiTraceMessage WmiTraceMessageVa WmiUpdateTrace XIPDispatch ZwAccessCheckAndAuditAlarm ZwAddBootEntry ZwAddDriverEntry ZwAdjustPrivilegesToken ZwAlertThread ZwAllocateVirtualMemory ZwAssignProcessToJobObject ZwCancelIoFile ZwCancelTimer ZwClearEvent ZwClose ZwCloseObjectAuditAlarm ZwConnectPort ZwCreateDirectoryObject ZwCreateEvent ZwCreateFile ZwCreateJobObject ZwCreateKey ZwCreateSection ZwCreateSymbolicLinkObject ZwCreateTimer ZwDeleteBootEntry ZwDeleteDriverEntry ZwDeleteFile ZwDeleteKey ZwDeleteValueKey ZwDeviceIoControlFile ZwDisplayString ZwDuplicateObject ZwDuplicateToken ZwEnumerateBootEntries ZwEnumerateDriverEntries ZwEnumerateKey ZwEnumerateValueKey ZwFlushInstructionCache ZwFlushKey ZwFlushVirtualMemory ZwFreeVirtualMemory ZwFsControlFile ZwInitiatePowerAction ZwIsProcessInJob ZwLoadDriver ZwLoadKey ZwMakeTemporaryObject ZwMapViewOfSection ZwModifyBootEntry ZwModifyDriverEntry ZwNotifyChangeKey ZwOpenDirectoryObject ZwOpenEvent ZwOpenFile ZwOpenJobObject ZwOpenKey ZwOpenProcess ZwOpenProcessToken ZwOpenProcessTokenEx ZwOpenSection ZwOpenSymbolicLinkObject ZwOpenThread ZwOpenThreadToken ZwOpenThreadTokenEx ZwOpenTimer ZwPowerInformation ZwPulseEvent ZwQueryBootEntryOrder ZwQueryBootOptions ZwQueryDefaultLocale ZwQueryDefaultUILanguage ZwQueryDirectoryFile ZwQueryDirectoryObject ZwQueryDriverEntryOrder ZwQueryEaFile ZwQueryFullAttributesFile ZwQueryInformationFile ZwQueryInformationJobObject ZwQueryInformationProcess ZwQueryInformationThread ZwQueryInformationToken ZwQueryInstallUILanguage ZwQueryKey ZwQueryObject ZwQuerySection ZwQuerySecurityObject ZwQuerySymbolicLinkObject ZwQuerySystemInformation ZwQueryValueKey ZwQueryVolumeInformationFile ZwReadFile ZwReplaceKey ZwRequestWaitReplyPort ZwResetEvent ZwRestoreKey ZwSaveKey ZwSaveKeyEx ZwSecureConnectPort ZwSetBootEntryOrder ZwSetBootOptions ZwSetDefaultLocale ZwSetDefaultUILanguage ZwSetDriverEntryOrder ZwSetEaFile ZwSetEvent ZwSetInformationFile ZwSetInformationJobObject ZwSetInformationObject ZwSetInformationProcess ZwSetInformationThread ZwSetSecurityObject ZwSetSystemInformation ZwSetSystemTime ZwSetTimer ZwSetValueKey ZwSetVolumeInformationFile ZwTerminateJobObject ZwTerminateProcess ZwTranslateFilePath ZwUnloadDriver ZwUnloadKey ZwUnmapViewOfSection ZwWaitForMultipleObjects ZwWaitForSingleObject ZwWriteFile ZwYieldExecution __C_specific_handler __chkstk __misaligned_access _itoa _itow _local_unwind _purecall _setjmp _setjmpex _snprintf _snwprintf _stricmp _strlwr _strnicmp _strnset _strrev _strset _strupr _vsnprintf _vsnwprintf _wcsicmp _wcslwr _wcsnicmp _wcsnset _wcsrev _wcsupr atoi atol isdigit islower isprint isspace isupper isxdigit longjmp mbstowcs mbtowc memchr memcmp memcpy memmove memset qsort rand sprintf srand strcat strchr strcmp strcpy strlen strncat strncmp strncpy strrchr strspn strstr swprintf tolower toupper towlower towupper vDbgPrintEx vDbgPrintExWithPrefix vsprintf wcscat wcschr wcscmp wcscpy wcscspn wcslen wcsncat wcsncmp wcsncpy wcsrchr wcsspn wcsstr wcstombs wctomb