Create Interactive Tour

Windows Analysis Report
ntoskrnl.exe

Overview

General Information

Sample Name:ntoskrnl.exe
Analysis ID:576332
MD5:199605859b1306a64e9a157e36868c5a
SHA1:dde082294ff0e15989fb84749989f3af867f420d
SHA256:a779978161299ccbb2df1616f7bb5f74d7aec2070e22d76825a03341be10676a
Errors
  • Corrupt sample or wrongly selected analyzer. Details: The %1 application cannot be run in Win32 mode.

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

PE file contains more sections than normal
Sample file is different than original file name gathered from version info
Program does not show much activity (idle)
Entry point lies outside standard sections
PE file contains sections with non-standard names

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • ntoskrnl.exe (PID: 3744 cmdline: "C:\Users\user\Desktop\ntoskrnl.exe" MD5: 199605859B1306A64E9A157E36868C5A)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: ntoskrnl.exeStatic PE information: certificate valid
Source: ntoskrnl.exeStatic PE information: GUARD_CF, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: ntkrnlmp.pdbUGP source: ntoskrnl.exe
Source: Binary string: ntkrnlmp.pdb source: ntoskrnl.exe
Source: ntoskrnl.exeString found in binary or memory: https://www.windows.com/stopcode
Source: ntoskrnl.exeString found in binary or memory: https://www.windows.com/stopcodeFor
Source: ntoskrnl.exeStatic PE information: Number of sections : 33 > 10
Source: ntoskrnl.exeBinary or memory string: OriginalFilename vs ntoskrnl.exe
Source: ntoskrnl.exe, 00000001.00000000.298418603.00007FF65CA5E000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamentkrnlmp.exej% vs ntoskrnl.exe
Source: ntoskrnl.exe, 00000001.00000000.295241135.00007FF65BA30000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: DefaultCapDefaultCapeLeapSecondsEnabledKVF_HotPatchSimulationCompanyNameFileDescriptionProductVersionInternalNameOriginalFilenameFileVersionProductNameLegalCopyright\StringFileInfo\040904B0\\StringFileInfo\000004E4\\StringFileInfo\000004B0\\StringFileInfo\040904E4\\REGISTRY\USER vs ntoskrnl.exe
Source: ntoskrnl.exeBinary or memory string: DefaultCapDefaultCapeLeapSecondsEnabledKVF_HotPatchSimulationCompanyNameFileDescriptionProductVersionInternalNameOriginalFilenameFileVersionProductNameLegalCopyright\StringFileInfo\040904B0\\StringFileInfo\000004E4\\StringFileInfo\000004B0\\StringFileInfo\040904E4\\REGISTRY\USER vs ntoskrnl.exe
Source: ntoskrnl.exeBinary or memory string: OriginalFilenamentkrnlmp.exej% vs ntoskrnl.exe
Source: ntoskrnl.exeString found in binary or memory: https://www.windows.com/stopcode
Source: ntoskrnl.exeString found in binary or memory: https://www.windows.com/stopcode
Source: ntoskrnl.exeString found in binary or memory: If you call a support person, give them this info:Your device ran into a problem and needs to restart.You can restart.We'll restart for you.We're just collecting some error info, and then you can restart.We're just collecting some error info, and then we'll restart for you.Stop Code:What failed:1%1% completePlease release the power button.Your Windows Insider Build ran into a problem and needs to restart.https://www.windows.com/stopcodeFor more information about this issue and possible fixes, visit It is now safe to power off the system.We just need a few more seconds to shut down.
Source: ntoskrnl.exeString found in binary or memory: If you call a support person, give them this info:Your device ran into a problem and needs to restart.You can restart.We'll restart for you.We're just collecting some error info, and then you can restart.We're just collecting some error info, and then we'll restart for you.Stop Code:What failed:1%1% completePlease release the power button.Your Windows Insider Build ran into a problem and needs to restart.https://www.windows.com/stopcodeFor more information about this issue and possible fixes, visit It is now safe to power off the system.We just need a few more seconds to shut down.
Source: ntoskrnl.exeBinary string: \Device\Unknownnt!store memory compression
Source: ntoskrnl.exeBinary string: \Device\FileInfo
Source: ntoskrnl.exeBinary string: \Registry\Machine\System\SetupProductType\Registry\Machine\System\CurrentControlSet\Control\ProductOptionsSystemPrefixSetupTypeProductSuiteWinNTServerNTLanmanNTEnterpriseSmall BusinessConcurrentLimit\Registry\Machine\System\CurrentControlSet\Services\LicenseInfoSuitesTerminal ServerSmall Business(Restricted)BackOfficeCommunicationServerBladePersonalDataCenterEmbeddedNTCompute ServerStorage ServerSecurity ApplianceEmbedded(Restricted)Kernel-ProductTypePhoneNTSystemSetupInProgressWH Server\Callback\EnlightenmentState\Callback\ProcessorAdd\Callback\PowerState\Callback\SetSystemState\Callback\SetSystemTime\Callback\SeImageVerificationDriverInfo\Callback\Phase1InitComplete\Callback\LicensingDataOSProductContentIdOSProductPfnProductPolicyConsumeAddonPolicySetSecurity-SPP-IgnoreDeferredActivationCloudbookDeviceLockedCloudbookDeviceIDClip-SubscriptionPFN\Registry\Machine\SYSTEM\CurrentControlSet\Control\Nls\NLSTableVersion\SystemRoot\System32\locale.nls\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Notifications\Registry\Machine\System\CurrentControlSet\Control\Notifications\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\VolatileNotifications\REGISTRY\MACHINE\OSDATA\NotificationsDisableOfflineMemPfaThresholdMemPfaPageCountMemPfaDisableMemPersistOfflineRestoreCmciMaxAttemptsRestoreCmciEnabledIgnoreDummyWriteMemPfaTimeoutCMCPollingLimitCMCThresholdSecondsCMCThresholdCountRestoreCmciErrorLimitKernel-NonGenuineNotificationType\Registry\Machine\System\CurrentControlSet\Control\7503491f-4a39-4f84-b231-8aca3e203b94$Kernel.Purge.AppxFICacheSecurity-SPP-GenuineLocalStatusKernel-NonGenuineNotificationStringIdsInfPathDriverDescDriverVersionDriverDateDataProviderNameMatchingDeviceIdInfSectionExtInfSectionResourcePickerExceptionsResourcePickerTagsCoInstallers32EnumPropPages32NoInstallClassInstaller32IconIncludedInfsDefault ServiceNoUseClassSilentInstallNoDisplayClassLastDeleteDateDHPRebalanceOptOutLowerLogoVersionIconPathInstallFlagsDeviceReportedFSFilterClass\Device\VMBus\{4d12e519-17a0-4ae4-8eaa-5270fc6abdb7}-{dcc079ae-60ba-4d07-847c-3493609c0870}-0000\Device\LanmanRedirector\Device\vmsmb\Silos
Source: ntoskrnl.exeBinary string: \Device\Harddisk%d\Partition0
Source: ntoskrnl.exeBinary string: \\Device\Ramdisk%wZ
Source: ntoskrnl.exeBinary string: \KernelObjects\MemoryPartition0\Device\RawCdRom
Source: ntoskrnl.exeBinary string: \Device\NamedPipe
Source: ntoskrnl.exeBinary string: \Device\VRegDriver
Source: ntoskrnl.exeBinary string: \Device\HarddiskVolume
Source: ntoskrnl.exeBinary string: \Device\Mup
Source: ntoskrnl.exeBinary string: \Device\ahcacheDisableLKG
Source: ntoskrnl.exeBinary string: \Device\PhysicalMemory
Source: ntoskrnl.exeBinary string: \Registry\Machine\SYSTEM\CurrentControlSet\Control\WindowsFullProcessInformationSID\Device\UwfvolControl
Source: ntoskrnl.exeBinary string: \Registry\Machine\System\CurrentControlSet\Control\Compatibility\Device\Registry\Machine\System\CurrentControlSet\Control\Compatibility
Source: ntoskrnl.exeBinary string: \Device\Harddisk%lu\Partition%lu
Source: ntoskrnl.exeBinary string: \Device\%08lx
Source: ntoskrnl.exeBinary string: \Device\RdyBoost
Source: ntoskrnl.exeBinary string: \Device\CdRom%d\Device\Harddisk%d\Partition0
Source: ntoskrnl.exeBinary string: Eventlog-System\Device\WindowsTrustedRT\{699AA2F1-A42E-40DF-BABE-3AAAD2BB6A47}\Device\SysEnv
Source: ntoskrnl.exeBinary string: \Device\CdRom%d\ArcName\%s
Source: ntoskrnl.exeBinary string: \Device\RawDisk\Device\RawTapelpacAppExperience
Source: ntoskrnl.exeBinary string: \Device\DeviceApi
Source: ntoskrnl.exeBinary string: \Device\Harddisk%u\Partition%u
Source: ntoskrnl.exeBinary string: \Device\Harddisk%lu\Partition0
Source: ntoskrnl.exeBinary string: \\Device\HarddiskVolume%lu
Source: ntoskrnl.exeBinary string: \Device\Device\BootDevice
Source: ntoskrnl.exeBinary string: \Device\VolumesSafeForWriteAccess
Source: ntoskrnl.exeBinary string: \Device\OSDataDevice
Source: ntoskrnl.exeBinary string: \??\C:\Device\MountPointManager
Source: ntoskrnl.exeBinary string: \Device\Ramdisk%wZ
Source: ntoskrnl.exeBinary string: \Device\Harddisk%d\Partition%d
Source: ntoskrnl.exeBinary string: \Driver\WMIxWDM\Device\WMIDataDevice
Source: ntoskrnl.exeBinary string: \Device\CdRom%d
Source: ntoskrnl.exeBinary string: \Device\MountPointManager
Source: ntoskrnl.exeBinary string: \Device\Ramdisk
Source: ntoskrnl.exeBinary string: \Device\%s\Partition%lu\DeviceDirectory
Source: classification engineClassification label: unknown1.winEXE@1/0@0/0
Source: ntoskrnl.exeStatic file information: File size 10849616 > 1048576
Source: ntoskrnl.exeStatic PE information: More than 3063 > 100 exports found
Source: initial sampleStatic PE information: Valid certificate with Microsoft Issuer
Source: ntoskrnl.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: ntoskrnl.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: ntoskrnl.exeStatic PE information: certificate valid
Source: ntoskrnl.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x3c6c00
Source: ntoskrnl.exeStatic PE information: Raw size of PAGE is bigger than: 0x100000 < 0x3c5800
Source: ntoskrnl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ntoskrnl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ntoskrnl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ntoskrnl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ntoskrnl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ntoskrnl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: ntoskrnl.exeStatic PE information: GUARD_CF, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: ntoskrnl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: ntkrnlmp.pdbUGP source: ntoskrnl.exe
Source: Binary string: ntkrnlmp.pdb source: ntoskrnl.exe
Source: initial sampleStatic PE information: section where entry point is pointing to: PAGELK
Source: ntoskrnl.exeStatic PE information: section name: PROTDATA
Source: ntoskrnl.exeStatic PE information: section name: GFIDS
Source: ntoskrnl.exeStatic PE information: section name: Pad1
Source: ntoskrnl.exeStatic PE information: section name: PAGELK
Source: ntoskrnl.exeStatic PE information: section name: POOLCODE
Source: ntoskrnl.exeStatic PE information: section name: PAGEKD
Source: ntoskrnl.exeStatic PE information: section name: PAGEVRFY
Source: ntoskrnl.exeStatic PE information: section name: PAGEHDLS
Source: ntoskrnl.exeStatic PE information: section name: PAGEBGFX
Source: ntoskrnl.exeStatic PE information: section name: INITKDBG
Source: ntoskrnl.exeStatic PE information: section name: TRACESUP
Source: ntoskrnl.exeStatic PE information: section name: KVASCODE
Source: ntoskrnl.exeStatic PE information: section name: RETPOL
Source: ntoskrnl.exeStatic PE information: section name: MINIEX
Source: ntoskrnl.exeStatic PE information: section name: Pad2
Source: ntoskrnl.exeStatic PE information: section name: ALMOSTRO
Source: ntoskrnl.exeStatic PE information: section name: CACHEALI
Source: ntoskrnl.exeStatic PE information: section name: PAGEDATA
Source: ntoskrnl.exeStatic PE information: section name: PAGEVRFD
Source: ntoskrnl.exeStatic PE information: section name: INITDATA
Source: ntoskrnl.exeStatic PE information: section name: Pad3
Source: ntoskrnl.exeStatic PE information: section name: CFGRO
Source: ntoskrnl.exeStatic PE information: section name: Pad4
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid Accounts2
Command and Scripting Interpreter
Path InterceptionPath InterceptionDirect Volume AccessOS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 576332 Sample: ntoskrnl.exe Startdate: 22/02/2022 Architecture: WINDOWS Score: 1 4 ntoskrnl.exe 2->4         started       

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
ntoskrnl.exe0%VirustotalBrowse
No Antivirus matches
No Antivirus matches
No Antivirus matches
No Antivirus matches
No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
https://www.windows.com/stopcodentoskrnl.exefalse
    high
    https://www.windows.com/stopcodeForntoskrnl.exefalse
      high
      No contacted IP infos
      Joe Sandbox Version:34.0.0 Boulder Opal
      Analysis ID:576332
      Start date:22.02.2022
      Start time:11:42:35
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 3m 55s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:ntoskrnl.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:4
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:UNKNOWN
      Classification:unknown1.winEXE@1/0@0/0
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 9.7% (good quality ratio 8.1%)
      • Quality average: 68%
      • Quality standard deviation: 35.5%
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 0
      • Number of non-executed functions: 0
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI
      • Found application associated with file extension: .exe
      • Unable to launch sample, stop analysis
      • Corrupt sample or wrongly selected analyzer. Details: The %1 application cannot be run in Win32 mode.
      • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe
      • Execution Graph export aborted for target ntoskrnl.exe, PID 3744 because there are no executed function
      No simulations
      No context
      No context
      No context
      No context
      No context
      No created / dropped files found
      File type:PE32+ executable (native) x86-64, for MS Windows
      Entropy (8bit):6.518428121841467
      TrID:
      • Win64 Device Driver (generic) (12004/3) 43.57%
      • OS/2 Executable (generic) (11537/16) 41.87%
      • Generic Win/DOS Executable (2004/3) 7.27%
      • DOS Executable Generic (2002/1) 7.27%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.03%
      File name:ntoskrnl.exe
      File size:10849616
      MD5:199605859b1306a64e9a157e36868c5a
      SHA1:dde082294ff0e15989fb84749989f3af867f420d
      SHA256:a779978161299ccbb2df1616f7bb5f74d7aec2070e22d76825a03341be10676a
      SHA512:59426e98e2f9e555e3a1759323b18f5770647561eb9f2cf40111bdfdec943a0ca5e7c0dc1988fd9793ebe75a17738b06825bac439f0ec82a10ca57a508089c27
      SSDEEP:196608:ZboLzAJ1qf2fKnwLDfXpTNRhOuxFmHa/da/YslV:Z8MJMfeKnwLDvpTNPO/a/oHV
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l.. (~.s(~.s(~.s<..r!~.s<..r$~.s(~.s.~.ss..r)~.ss..r&~.s(~.s.~.s!.Ds?~.s<..r.{.s<..r3~.s<..rR~.s<..r.~.s<..r)~.s<.(s)~.s<..r)~.
      Icon Hash:00828e8e8686b000
      Entrypoint:0x14098d010
      Entrypoint Section:PAGELK
      Digitally signed:true
      Imagebase:0x140000000
      Subsystem:native
      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
      DLL Characteristics:GUARD_CF, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
      Time Stamp:0xBD43350 [Thu Apr 15 22:42:24 1976 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:10
      OS Version Minor:0
      File Version Major:10
      File Version Minor:0
      Subsystem Version Major:10
      Subsystem Version Minor:0
      Import Hash:e0e869bbd92f59b58e146ba81eee3f6d
      Signature Valid:true
      Signature Issuer:CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
      Signature Validation Error:The operation completed successfully
      Error Number:0
      Not Before, Not After
      • 9/2/2021 11:23:41 AM 9/1/2022 11:23:41 AM
      Subject Chain
      • CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
      Version:3
      Thumbprint MD5:2E3EBA78DC0A3799E3C893E397672C3F
      Thumbprint SHA-1:FE51E838A087BB561BBB2DD9BA20143384A03B3F
      Thumbprint SHA-256:A6A3D72F444AA7A05587ED6C275F07CC13949A6D3D6B8BB311CFB704DD4F9E14
      Serial:330000033C89C66A7B45BB1FBD00000000033C
      Instruction
      dec eax
      sub esp, 38h
      dec esp
      mov dword ptr [esp+30h], edi
      dec esp
      mov edi, esp
      dec eax
      mov dword ptr [0036E43Dh], ecx
      mov ecx, FFFFFFFFh
      dec eax
      mov edx, dword ptr [0036E431h]
      dec esp
      mov edx, dword ptr [edx+00000088h]
      inc ecx
      cmp dword ptr [edx+24h], 00000000h
      jne 00007FD714D05E07h
      call 00007FD714D2BF23h
      dec eax
      mov ecx, dword ptr [0036E417h]
      dec eax
      mov edx, dword ptr [ecx+00000088h]
      dec esp
      mov edx, edx
      dec eax
      sub edx, 00000180h
      dec eax
      mov dword ptr [edx+18h], edx
      dec esp
      mov dword ptr [edx+20h], edx
      inc ecx
      mov eax, cr0
      dec esp
      mov dword ptr [edx+00000280h], eax
      inc ecx
      mov eax, cr2
      dec esp
      mov dword ptr [edx+00000288h], eax
      inc ecx
      mov eax, cr3
      dec esp
      mov dword ptr [edx+00000290h], eax
      inc ecx
      mov eax, cr4
      dec esp
      mov dword ptr [edx+00000298h], eax
      sgdt fword ptr [edx+000002D6h]
      dec esp
      mov eax, dword ptr [edx+000002D8h]
      dec esp
      mov dword ptr [edx], eax
      sidt fword ptr [edx+000002E6h]
      dec esp
      mov ecx, dword ptr [edx+000002E8h]
      dec esp
      mov dword ptr [edx+38h], ecx
      str word ptr [edx+000002F0h]
      sldt word ptr [edx+000002F2h]
      mov dword ptr [edx+00000180h], 00001F80h
      ldmxcsr dword ptr [edx+00000180h]
      inc ecx
      cmp dword ptr [edx+24h], 00000000h
      jne 00007FD714D05E0Bh
      Programming Language:
      • [IMP] VS2008 SP1 build 30729
      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x1340000x18c86.edata
      IMAGE_DIRECTORY_ENTRY_IMPORT0x1316300x168.idata
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x10000000x3b298.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0xc90000x67b84.pdata
      IMAGE_DIRECTORY_ENTRY_SECURITY0xa568000x2550INIT
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x103c0000x508c.reloc
      IMAGE_DIRECTORY_ENTRY_DEBUG0x108a00x54.rdata
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x5b600x118.rdata
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IAT0x1310000x620.idata
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .rdata0x10000xc7c800xc7e00False0.406809431676Targa image data 1 x 65536 x 8 +7696 +16385 ""5.89033571463IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      .pdata0xc90000x67b840x67c00False0.515584996235data6.54007124698IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      .idata0x1310000x20c20x2200False0.302734375data4.75794250398IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      .edata0x1340000x18c860x18e00False0.376835348618data6.01949840587IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      PROTDATA0x14d0000x10x200False0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      GFIDS0x14e0000x8bfc0x8c00False0.454994419643Targa image data - Color 32 x 40960 x 1 +512 +176 - top ""5.43626041388IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      Pad10x1570000xa90000x0False0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      .text0x2000000x3c6a590x3c6c00unknownunknownunknownunknownIMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      PAGE0x5c70000x3c561e0x3c5800unknownunknownunknownunknownIMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      PAGELK0x98d0000x24e940x25000False0.618480785473data6.53500936387IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      POOLCODE0x9b20000x48b0x600False0.576822916667data5.16238435135IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      PAGEKD0x9b30000x5b920x5c00False0.625806725543data6.50379092561IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      PAGEVRFY0x9b90000x3210c0x32200False0.456982543641data6.402428204IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      PAGEHDLS0x9ec0000x25d60x2600False0.556846217105data6.26237644246IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      PAGEBGFX0x9ef0000x69ea0x6a00False0.595187205189data6.55919835084IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      INITKDBG0x9f60000x195ba0x19600False0.460321736453data6.29191868154IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      TRACESUP0xa100000x175b0x1800False0.593912760417data6.20998217871IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      KVASCODE0xa120000x23de0x2400False0.241536458333data5.55115463252IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      RETPOL0xa150000x7400x800False0.30126953125data4.68031703314IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      MINIEX0xa160000x25ae0x2600False0.315275493421data5.92637813691IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      INIT0xa190000x8aae80x8ac00False0.508423071509data6.39970356195IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      Pad20xaa40000x15c0000x0False0empty0.0IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      .data0xc000000xf9ff80x13000False0.103438527961data1.27209677264IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      ALMOSTRO0xcfa0000x272e00x1400False0.3095703125data2.83687590642IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      CACHEALI0xd220000x92c00x200False0.048828125data0.162990075305IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      PAGEDATA0xd2c0000x121500x1800False0.191080729167data2.17687582369IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      PAGEVRFD0xd3f0000x15d000x8000False0.202056884766data2.88447105989IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      INITDATA0xd550000x17c440x800False0.2626953125data2.35927730438IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      Pad30xd6d0000x930000x0False0empty0.0IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      CFGRO0xe000000x1cc80x1e00False0.0138020833333data0.104990093055IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      Pad40xe020000x1fe0000x0unknownunknownunknownunknownIMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_READ
      .rsrc0x10000000x3b2980x3b400False0.15956289557data2.20663784201IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      .reloc0x103c0000x9a2c0x9c00False0.441481370192data5.81823612329IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
      NameRVASizeTypeLanguageCountry
      RT_BITMAP0x10002780x2586adataEnglishUnited States
      RT_BITMAP0x1025ae40x22adataEnglishUnited States
      RT_BITMAP0x1025d100x50edataEnglishUnited States
      RT_BITMAP0x10262200xd6dataEnglishUnited States
      RT_BITMAP0x10262f80x3e6edataEnglishUnited States
      RT_BITMAP0x102a1680x4528dataEnglishUnited States
      RT_BITMAP0x102e6900x42adataEnglishUnited States
      RT_RCDATA0x102eabc0x80c6data
      RT_MESSAGETABLE0x1036b840x4378dataEnglishUnited States
      RT_VERSION0x103aefc0x39cdataEnglishUnited States
      DLLImport
      ext-ms-win-ntos-processparameters-l1-1-0.dllPsDestroyProcessParameterOverrides, PsGetProcessParameterOverrides
      ext-ms-win-ntos-tm-l1-1-0.dllNtReadOnlyEnlistment, NtQueryInformationTransactionManager, NtQueryInformationTransaction, NtQueryInformationResourceManager, NtQueryInformationEnlistment, NtPropagationFailed, NtPropagationComplete, NtPrepareEnlistment, NtPrepareComplete, NtPrePrepareEnlistment, NtPrePrepareComplete, NtOpenTransactionManager, NtOpenTransaction, NtRollbackTransaction, NtOpenEnlistment, NtGetNotificationResourceManager, NtFreezeTransactions, NtEnumerateTransactionObject, NtCreateTransactionManager, NtCreateTransaction, NtCreateResourceManager, NtCreateEnlistment, NtCommitTransaction, NtCommitEnlistment, NtCommitComplete, TmInitSystem, NtSetInformationEnlistment, NtSetInformationResourceManager, TmCommitTransaction, NtRecoverEnlistment, TmInitSystemPhase2, NtRecoverResourceManager, NtThawTransactions, TmCancelPropagationRequest, TmCommitComplete, TmCommitEnlistment, TmShutdownSystem, NtRollforwardTransactionManager, NtSinglePhaseReject, NtSetInformationTransactionManager, NtRenameTransactionManager, NtRegisterProtocolAddressInformation, TmThawTransactions, TmSinglePhaseReject, TmSetCurrentTransaction, TmRollbackTransaction, TmRollbackEnlistment, TmRollbackComplete, TmRequestOutcomeEnlistment, TmRenameTransactionManager, TmReferenceEnlistmentKey, TmRecoverTransactionManager, TmRecoverResourceManager, TmRecoverEnlistment, TmReadOnlyEnlistment, TmPropagationFailed, TmPropagationComplete, TmPrepareEnlistment, TmPrepareComplete, TmPrePrepareEnlistment, TmPrePrepareComplete, TmIsTransactionActive, TmIsKTMCommitCoordinator, TmInitializeTransactionManager, NtRecoverTransactionManager, NtRollbackComplete, NtSetInformationTransaction, NtRollbackEnlistment, TmGetTransactionId, TmFreezeTransactions, TmEndPropagationRequest, TmEnableCallbacks, TmDereferenceEnlistmentKey, TmCurrentTransaction, TmCreateEnlistment, NtOpenResourceManager
      PSHED.dllPshedDoPfa, PshedGetErrorSourceInfo, PshedInitAvailable, PshedSetErrorSourceInfo, PshedInjectError, PshedGetInjectionCapabilities, PshedDisableErrorSource, PshedEnableErrorSource, PshedInitGlobal, PshedArePluginsPresent, PshedFinalizeErrorRecord, PshedBugCheckSystem, PshedWriteErrorRecord, PshedAttemptErrorRecovery, PshedGetAllErrorSources, PshedInitialize, PshedGetBootErrorPacket, PshedAllocateMemory, PshedClearErrorRecord, PshedReadErrorRecord, PshedFreeMemory, PshedSetHalEnlightenments, PshedMarkHiberPhase, PshedInitProc, PshedIsSystemWheaEnabled, PshedRetrieveErrorInfo
      BOOTVID.dllVidInitialize, VidBufferToScreenBlt, VidScreenToBufferBlt, VidBitBlt, VidResetDisplay, VidCleanUp, VidSetTextColor, VidSetScrollRegion, VidSolidColorFill, VidDisplayString, VidBitBltEx
      ext-ms-win-ntos-clipsp-l1-1-0.dllClipSpInitialize
      kdcom.dllKdSetHiberRange, KdPower, KdReceivePacket, KdSendPacket, KdInitialize
      ext-ms-win-ntos-kcminitcfg-l1-1-0.dllCmCompleteInitMachineConfig, CmSetInitMachineConfig
      ext-ms-win-ntos-ksr-l1-1-3.dllKsrQueryMetadata, KsrClaimPersistedMemory, KsrGetFirmwareInformation, KsrInitSystem, KsrFreePersistedMemoryBlock, KsrMdlToMemoryRuns, KsrPersistMemoryWithMetadata, KsrFreePersistedMemory, KsrCleanupPageDatabase, KsrInitPageDatabase, KsrEnumeratePersistedMemory
      ext-ms-win-ntos-trace-l1-1-0.dllTraceInitSystem
      ext-ms-win-ntos-ksecurity-l1-1-1.dllQueryUpdateFileEaAllowedExt
      ext-ms-win-ntos-werkernel-l1-1-1.dllWerLiveKernelCancelReport, WerLiveKernelCreateReport, WerLiveKernelSubmitReport, WerLiveKernelInitSystem, WerLiveKernelOpenDumpFile, WerLiveKernelCloseHandle
      ext-ms-win-ntos-ucode-l1-1-0.dllExpMicrocodeInformationLoad, ExpMicrocodeInformationUnload, ExpMicrocodeInitialization
      ext-ms-win-ntos-stateseparation-l1-1-0.dllExpInitializeStateSeparationPhase1, ExpInitializeStateSeparationPhase0, ExpInitializeStateSeparationPhase2
      ext-ms-win-fs-clfs-l1-1-0.dllClfsLsnEqual, ClfsReadRestartArea, ClfsGetLogFileInformation, ClfsMgmtDeregisterManagedClient, ClfsCloseLogFileObject, ClfsMgmtInstallPolicy, ClfsMgmtRegisterManagedClient, ClfsCreateLogFile, ClfsReadLogRecord, ClfsReadNextLogRecord, ClfsTerminateReadLog, ClfsWriteRestartArea, ClfsDeleteLogByPointer, ClfsDeleteMarshallingArea, ClfsReserveAndAppendLog, ClfsLsnInvalid, ClfsFlushToLsn, ClfsLsnContainer, ClfsLsnLess, ClfsLsnDifference, ClfsCreateMarshallingArea, ClfsAddLogContainer
      CI.dllCiInitialize
      msrpc.sysMesHandleFree, MesEncodeIncrementalHandleCreate, MesIncrementalHandleReset, RpcExceptionFilter, NdrMesTypeEncode3, NdrMesTypeDecode3, MesDecodeBufferHandleCreate
      cng.sysBCryptExportKey
      NameOrdinalAddress
      AlpcCreateSecurityContext80x1408bf830
      AlpcGetHeaderSize100x1402decc0
      AlpcGetMessageAttribute110x1402dec20
      AlpcInitializeMessageAttribute180x1402dec60
      BgkDisplayCharacter260x1409f4340
      BgkGetConsoleState290x1409f4410
      BgkGetCursorState300x1409f4460
      BgkSetCursor310x1409f44f0
      CcAddDirtyPagesToExternalCache320x14038ff70
      CcAsyncCopyRead330x1402c8000
      CcCanIWrite340x1402c1040
      CcCoherencyFlushAndPurgeCache350x14031e670
      CcCopyRead360x140710a10
      CcCopyReadEx370x14022ebc0
      CcCopyWrite380x1404e52a0
      CcCopyWriteEx390x1402220d0
      CcCopyWriteWontFlush400x140222020
      CcDeductDirtyPagesFromExternalCache410x14038fc40
      CcDeferWrite420x1404e52d0
      CcErrorCallbackRoutine430x1404e5530
      CcFastCopyRead440x140864c30
      CcFastCopyWrite450x1404e5550
      CcFastMdlReadWait460x140c48648
      CcFlushCache470x14034f000
      CcFlushCacheToLsn480x14035aef0
      CcGetCachedDirtyPageCountForFile490x1404e5b80
      CcGetDirtyPages500x140343e30
      CcGetFileObjectFromBcb510x1404e4bd0
      CcGetFileObjectFromSectionPtrs520x1404e4bf0
      CcGetFileObjectFromSectionPtrsRef530x1404e4cc0
      CcGetFlushedValidData540x140345e50
      CcGetLsnForFileObject550x1404e5ba0
      CcGetNumberOfMappedPages560x140392470
      CcInitializeCacheMap570x14035f660
      CcInitializeCacheMapEx580x1402c0690
      CcIsCacheManagerCallbackNeeded590x14033a950
      CcIsThereDirtyData600x1404e5c60
      CcIsThereDirtyDataEx610x1404e5ca0
      CcIsThereDirtyLoggedPages620x140340080
      CcMapData630x1405fda60
      CcMdlRead640x14060c2b0
      CcMdlReadComplete650x14070b9d0
      CcMdlWriteAbort660x1404e6e00
      CcMdlWriteComplete670x140710a40
      CcPinMappedData680x1405fd5d0
      CcPinRead690x1405fd090
      CcPrepareMdlWrite700x14035a710
      CcPreparePinWrite710x1406e5010
      CcPurgeCacheSection720x14031fa40
      CcRegisterExternalCache730x140392a30
      CcRemapBcb740x140326e80
      CcRepinBcb750x1404e5910
      CcScheduleReadAhead760x1404e5980
      CcScheduleReadAheadEx770x1402c86d0
      CcSetAdditionalCacheAttributes780x1402c48b0
      CcSetAdditionalCacheAttributesEx790x1402c4960
      CcSetBcbOwnerPointer800x140864cc0
      CcSetDirtyPageThreshold810x1404e4d90
      CcSetDirtyPinnedData820x1402c29b0
      CcSetFileSizes830x140360560
      CcSetFileSizesEx840x1402c0350
      CcSetLogHandleForFile850x1404e6050
      CcSetLogHandleForFileEx860x140346150
      CcSetLoggedDataThreshold870x14035f9a0
      CcSetParallelFlushFile880x1402c4700
      CcSetReadAheadGranularity890x140349b70
      CcSetReadAheadGranularityEx900x1404e59a0
      CcTestControl910x1403cd000
      CcUninitializeCacheMap920x1402c4250
      CcUnmapFileOffsetFromSystemCache930x140346580
      CcUnpinData940x140698440
      CcUnpinDataForThread950x140864d20
      CcUnpinRepinnedBcb960x1404e59f0
      CcUnregisterExternalCache970x1404e5230
      CcWaitForCurrentLazyWriterActivity980x14037fdd0
      CcZeroData990x140267d10
      CcZeroDataOnDisk1000x14034d8f0
      CmCallbackGetKeyObjectID1010x140866ef0
      CmCallbackGetKeyObjectIDEx1020x1405e6300
      CmCallbackReleaseKeyObjectIDEx1030x1405e6440
      CmGetBoundTransaction1040x14070c680
      CmGetCallbackVersion1050x140867020
      CmKeyObjectType1060x140cfb430
      CmRegisterCallback1070x1407c4090
      CmRegisterCallbackEx1080x140867040
      CmRegisterMachineHiveLoadedNotification1090x1407840f0
      CmSetCallbackObjectContext1100x1405cd080
      CmUnRegisterCallback1110x140867090
      CmUnregisterMachineHiveLoadedNotification1120x140867520
      DbgBreakPoint1130x1403ff490
      DbgBreakPointWithStatus1140x1403ff4b0
      DbgCommandString1150x140580400
      DbgLoadImageSymbols1160x14036fa90
      DbgPrint1170x140361410
      DbgPrintEx1180x14037d380
      DbgPrintReturnControlC1190x140580470
      DbgPrompt1200x1405804c0
      DbgQueryDebugFilterState1210x140580510
      DbgSetDebugFilterState1220x1403b4630
      DbgSetDebugPrintCallback1230x140580530
      DbgkLkmdRegisterCallback1240x140783b00
      DbgkLkmdUnregisterCallback1250x140885b50
      DbgkWerCaptureLiveKernelDump1260x140886510
      EmClientQueryRuleState1270x14098d2e0
      EmClientRuleDeregisterNotification1280x1408876d0
      EmClientRuleEvaluate1290x14098e340
      EmClientRuleRegisterNotification1300x1408877b0
      EmProviderDeregister1310x140887a40
      EmProviderDeregisterEntry1320x140887bf0
      EmProviderRegister1330x1407875a0
      EmProviderRegisterEntry1340x140887c50
      EmpProviderRegister1350x140787610
      EtwActivityIdControl1360x140277dd0
      EtwEnableTrace1370x140779070
      EtwEventEnabled1380x140212640
      EtwProviderEnabled1390x1402fbb10
      EtwRegister1400x140751110
      EtwRegisterClassicProvider1410x1407510c0
      EtwSendTraceBuffer1420x1405a0df0
      EtwSetInformation1430x14076e110
      EtwTelemetryCoverageReport1440x1403569b0
      EtwUnregister1450x14074e790
      EtwWrite1460x1402934d0
      EtwWriteEndScenario1470x140777820
      EtwWriteEx1480x140293550
      EtwWriteStartScenario1490x1407778e0
      EtwWriteString1500x1405a07a0
      EtwWriteTransfer1510x140293510
      EtwpDisableStackWalkApc1520x14035ff60
      EtwpReenableStackWalkApc1530x14035ffa0
      ExAcquireAutoExpandPushLockExclusive1540x140332fa0
      ExAcquireAutoExpandPushLockShared1550x140273b20
      ExAcquireCacheAwarePushLockExclusive1560x140273fe0
      ExAcquireCacheAwarePushLockExclusiveEx1570x1403f30c0
      ExAcquireCacheAwarePushLockSharedEx1580x140207520
      ExAcquireFastMutex1590x1402071b0
      ExAcquireFastMutexUnsafe1600x140202d60
      ExAcquireFastResourceExclusive1610x14038c4d0
      ExAcquireFastResourceShared1620x14038cbb0
      ExAcquireFastResourceSharedStarveExclusive1630x14038c8b0
      ExAcquirePushLockExclusiveEx1640x140207ac0
      ExAcquirePushLockSharedEx1650x140207c80
      ExAcquireResourceExclusiveLite1660x140208cf0
      ExAcquireResourceSharedLite1670x1402090b0
      ExAcquireRundownProtection1680x1403246a0
      ExAcquireRundownProtectionCacheAware1690x140324650
      ExAcquireRundownProtectionCacheAwareEx1700x1402ff060
      ExAcquireRundownProtectionEx1710x1402ff0b0
      ExAcquireSharedStarveExclusive1720x14022a8a0
      ExAcquireSharedWaitForExclusive1730x1405afba0
      ExAcquireSpinLockExclusive1740x1402cf5e0
      ExAcquireSpinLockExclusiveAtDpcLevel1750x14024a7a0
      ExAcquireSpinLockShared1760x140228470
      ExAcquireSpinLockSharedAtDpcLevel1770x140224840
      ExActivationObjectType1780x140cfb7d8
      ExAllocateAutoExpandPushLock1790x14038fd30
      ExAllocateCacheAwarePushLock1800x1403c5130
      ExAllocateCacheAwareRundownProtection1810x140635910
      ExAllocatePool1820x14035ff40
      ExAllocatePool21830x1409b2280
      ExAllocatePool31840x1409b2340
      ExAllocatePoolWithQuota1850x1405ae410
      ExAllocatePoolWithQuotaTag1860x140297e70
      ExAllocatePoolWithTag1870x1409b2160
      ExAllocatePoolWithTagPriority1880x14028c6d0
      ExAllocateTimer1890x140275af0
      ExBlockOnAddressPushLock1900x140325650
      ExBlockPushLock1910x140325710
      ExCancelTimer1920x140275200
      ExCleanupAutoExpandPushLock1930x14026b440
      ExCleanupRundownProtectionCacheAware1940x140398330
      ExCompositionObjectType1950x140cfb7b0
      ExConvertExclusiveToSharedLite1960x1403408a0
      ExConvertFastResourceExclusiveToShared1970x1405aee80
      ExConvertPushLockExclusiveToShared1980x1403f30a0
      ExCoreMessagingObjectType1990x140cfb7d0
      ExCreateCallback2000x14070c930
      ExDeleteFastResource2010x140391420
      ExDeleteLookasideListEx2020x14034c1c0
      ExDeleteNPagedLookasideList2030x140398420
      ExDeletePagedLookasideList2040x14034c140
      ExDeleteResourceLite2050x1402c3f40
      ExDeleteTimer2060x140275280
      ExDesktopObjectType2070x140cfb7c8
      ExDisableResourceBoostLite2080x140353190
      ExDisownFastResource2090x14038cf90
      ExEnterCriticalRegionAndAcquireFastMutexUnsafe2100x14032f050
      ExEnterCriticalRegionAndAcquireResourceExclusive2110x140208ff0
      ExEnterCriticalRegionAndAcquireResourceShared2120x1403244c0
      ExEnterCriticalRegionAndAcquireSharedWaitForExclusive2130x1405b0180
      ExEnterPriorityRegionAndAcquireResourceExclusive2140x1405b01c0
      ExEnterPriorityRegionAndAcquireResourceShared2150x140327930
      ExEnumHandleTable2160x1406d88f0
      ExEnumerateSystemFirmwareTables2170x1409474f0
      ExEventObjectType2180x140cfb4a0
      ExExtendZone2190x1405b19b0
      ExFetchLicenseData2200x14094a730
      ExFlushLookasideListEx2210x14034c200
      ExFreeAutoExpandPushLock2220x14038fe00
      ExFreeCacheAwarePushLock2230x1405aec60
      ExFreeCacheAwareRundownProtection2240x140330010
      ExFreePool2250x1409b2140
      ExFreePoolWithTag2260x1409b2140
      ExGetCurrentProcessorCounts2270x14033a040
      ExGetCurrentProcessorCpuUsage2280x1405aca70
      ExGetExclusiveWaiterCount2290x1405b0210
      ExGetFirmwareEnvironmentVariable2300x14070fa50
      ExGetFirmwareType2310x1403ccf80
      ExGetLicenseTamperState2320x14094a890
      ExGetPreviousMode2330x14027d5d0
      ExGetSharedWaiterCount2340x1405b0250
      ExGetSystemFirmwareTable2350x1407bfc80
      ExInitializeAutoExpandPushLock2360x140333a80
      ExInitializeFastOwnerEntry2370x14038e4c0
      ExInitializeFastResource2380x1403974e0
      ExInitializeLookasideListEx2390x1402fd8d0
      ExInitializeNPagedLookasideList2400x140378860
      ExInitializePagedLookasideList2410x140702b80
      ExInitializePushLock2420x140267800
      ExInitializeResourceLite2430x140213470
      ExInitializeRundownProtection2440x140267800
      ExInitializeRundownProtectionCacheAware2450x140635870
      ExInitializeRundownProtectionCacheAwareEx2460x140398330
      ExInitializeZone2470x1405b1a20
      ExInterlockedAddLargeInteger2480x1405b1c60
      ExInterlockedAddUlong2490x140377a80
      ExInterlockedExtendZone2500x1405b1a90
      ExInterlockedInsertHeadList2510x140330b60
      ExInterlockedInsertTailList2520x140330be0
      ExInterlockedPopEntryList2530x1405b1cc0
      ExInterlockedPushEntryList2540x1405b1d10
      ExInterlockedRemoveHeadList2550x140330c90
      ExIsFastResourceContended2560x1405aefd0
      ExIsFastResourceHeld2570x14038c800
      ExIsFastResourceHeldExclusive2580x14038e600
      ExIsManufacturingModeEnabled2590x14072a410
      ExIsProcessorFeaturePresent2600x14035efc0
      ExIsResourceAcquiredExclusiveLite2610x140322b20
      ExIsResourceAcquiredSharedLite2620x14029bcb0
      ExIsSoftBoot2630x1403a5630
      ExLocalTimeToSystemTime2640x140341480
      ExNotifyBootDeviceRemoval2650x1405adf10
      ExNotifyCallback2660x14033cfa0
      ExQueryDepthSList2670x140327a50
      ExQueryFastCacheDevLicense2680x1407080e0
      ExQueryPoolBlockSize2690x1403ca8d0
      ExQueryTimerResolution2700x1403ccb10
      ExQueryWnfStateData2710x14070a8e0
      ExQueueWorkItem2720x1402b9c90
      ExRaiseAccessViolation2730x140953770
      ExRaiseDatatypeMisalignment2740x14076b060
      ExRaiseException2750x1402e6900
      ExRaiseHardError2760x140953790
      ExRaiseStatus2770x140328270
      ExRawInputManagerObjectType2780x140cfb7b8
      ExReInitializeRundownProtection2790x14037ca30
      ExReInitializeRundownProtectionCacheAware2800x14026fdd0
      ExRealTimeIsUniversal2810x140341830
      ExRegisterBootDevice2820x1405adf60
      ExRegisterCallback2830x14037cd00
      ExRegisterExtension2840x14079b160
      ExReinitializeFastResource2850x140392230
      ExReinitializeResourceLite2860x140278850
      ExReleaseAutoExpandPushLockExclusive2870x140331e90
      ExReleaseAutoExpandPushLockShared2880x140324210
      ExReleaseCacheAwarePushLockExclusive2890x140274840
      ExReleaseCacheAwarePushLockExclusiveEx2900x1403f3110
      ExReleaseCacheAwarePushLockSharedEx2910x1402076e0
      ExReleaseDisownedFastResource2920x14038bd70
      ExReleaseDisownedFastResourceExclusive2930x1405af040
      ExReleaseDisownedFastResourceShared2940x1405af150
      ExReleaseFastMutex2950x14020ac90
      ExReleaseFastMutexUnsafe2960x140202ef0
      ExReleaseFastMutexUnsafeAndLeaveCriticalRegion2970x14032ff70
      ExReleaseFastResource2980x14038c0f0
      ExReleaseFastResourceExclusive2990x1405af270
      ExReleaseFastResourceShared3000x1405af3a0
      ExReleasePushLockEx3010x140207fc0
      ExReleasePushLockExclusiveEx3020x140207850
      ExReleasePushLockSharedEx3030x14020ac30
      ExReleaseResourceAndLeaveCriticalRegion3040x14020a1c0
      ExReleaseResourceAndLeavePriorityRegion3050x1405b0290
      ExReleaseResourceForThreadLite3060x140328480
      ExReleaseResourceLite3070x140208540
      ExReleaseRundownProtection3080x1403282d0
      ExReleaseRundownProtectionCacheAware3090x140326f00
      ExReleaseRundownProtectionCacheAwareEx3100x140311e80
      ExReleaseRundownProtectionEx3110x1405b08c0
      ExReleaseSpinLockExclusive3120x14032eff0
      ExReleaseSpinLockExclusiveFromDpcLevel3130x140212700
      ExReleaseSpinLockShared3140x140326fd0
      ExReleaseSpinLockSharedFromDpcLevel3150x140224640
      ExRundownCompleted3160x14027be20
      ExRundownCompletedCacheAware3170x14026fe20
      ExSemaphoreObjectType3180x140cfa258
      ExSetFirmwareEnvironmentVariable3190x14094cb20
      ExSetLicenseTamperState3200x14094a950
      ExSetResourceOwnerPointer3210x1405b02d0
      ExSetResourceOwnerPointerEx3220x140279710
      ExSetTimer3230x140275960
      ExSetTimerResolution3240x1405ad1c0
      ExShareAddressSpaceWithDevice3250x1405b2080
      ExSizeOfAutoExpandPushLock3260x1405aec50
      ExSizeOfRundownProtectionCacheAware3270x140770d40
      ExSubscribeWnfStateChange3280x140701ef0
      ExSvmBeginDeviceReset3290x1405b2d00
      ExSvmFinalizeDeviceReset3300x1405b3130
      ExSystemExceptionFilter3310x1407c3a20
      ExSystemTimeToLocalTime3320x140360460
      ExTimedWaitForUnblockPushLock3330x140325730
      ExTimerObjectType3340x140cfb688
      ExTryAcquireAutoExpandPushLockExclusive3350x14038e9e0
      ExTryAcquireAutoExpandPushLockShared3360x14038e270
      ExTryAcquireCacheAwarePushLockExclusiveEx3370x1405aecd0
      ExTryAcquireCacheAwarePushLockSharedEx3380x1405aeda0
      ExTryAcquirePushLockExclusiveEx3390x140272c60
      ExTryAcquirePushLockSharedEx3400x140323e60
      ExTryAcquireSpinLockExclusiveAtDpcLevel3410x1402e4280
      ExTryAcquireSpinLockSharedAtDpcLevel3420x1405b0930
      ExTryConvertPushLockSharedToExclusiveEx3430x1403463d0
      ExTryConvertSharedSpinLockExclusive3440x14037f7b0
      ExTryQueueWorkItem3450x1402bce30
      ExTryToAcquireFastMutex3460x140272bc0
      ExTryToAcquireResourceExclusiveLite3470x1405b0350
      ExTryToConvertFastResourceSharedToExclusive3480x1405af4e0
      ExUnblockOnAddressPushLockEx3490x1403f31b0
      ExUnblockPushLockEx3500x140272700
      ExUnregisterCallback3510x14037f610
      ExUnregisterExtension3520x140953fd0
      ExUnsubscribeWnfStateChange3530x1407030a0
      ExUpdateLicenseData3540x140712ea0
      ExUuidCreate3550x140658210
      ExVerifySuite3560x1403b0f90
      ExWaitForRundownProtectionRelease3570x1402fa190
      ExWaitForRundownProtectionReleaseCacheAware3580x14026fd10
      ExWaitForUnblockPushLock3590x1405aee60
      ExWindowStationObjectType3600x140cfb7c0
      ExfAcquirePushLockExclusive3610x140274170
      ExfAcquirePushLockShared3620x1402743a0
      ExfReleasePushLock3630x1402748b0
      ExfReleasePushLockExclusive3640x140274990
      ExfReleasePushLockShared3650x1402748e0
      ExfTryAcquirePushLockShared3660x140324010
      ExfTryToWakePushLock3670x1402749e0
      ExfUnblockPushLock3680x1403f3200
      ExpInterlockedFlushSList3690x1403ff5b0
      ExpInterlockedPopEntrySList3700x1403ff530
      ExpInterlockedPushEntrySList3710x1403ff570
      FirstEntrySList3720x1403ff520
      FsRtlAcknowledgeEcp3730x1406e9950
      FsRtlAcquireEofLock3740x140324760
      FsRtlAcquireFileExclusive3750x1405fc9a0
      FsRtlAcquireHeaderMutex3760x1402061e0
      FsRtlAddBaseMcbEntry3770x14032c890
      FsRtlAddBaseMcbEntryEx3780x14032c8b0
      FsRtlAddLargeMcbEntry3790x14032c320
      FsRtlAddMcbEntry3800x1404ea140
      FsRtlAddToTunnelCache3810x1408890d0
      FsRtlAddToTunnelCacheEx3820x1406dc500
      FsRtlAllocateExtraCreateParameter3830x14066bd40
      FsRtlAllocateExtraCreateParameterFromLookasideList3840x140630180
      FsRtlAllocateExtraCreateParameterList3850x140618020
      FsRtlAllocateFileLock3860x14035e8c0
      FsRtlAllocatePool3870x1404eb0a0
      FsRtlAllocatePoolWithQuota3880x1404eb0d0
      FsRtlAllocatePoolWithQuotaTag3890x1404eb100
      FsRtlAllocatePoolWithTag3900x1404eb130
      FsRtlAllocateResource3910x140887f90
      FsRtlAreNamesEqual3920x140322ba0
      FsRtlAreThereCurrentOrInProgressFileLocks3930x1404ea860
      FsRtlAreThereWaitingFileLocks3940x1404ea890
      FsRtlAreVolumeStartupApplicationsComplete3950x1406bcf70
      FsRtlBalanceReads3960x140712100
      FsRtlCancellableWaitForMultipleObjects3970x1406704b0
      FsRtlCancellableWaitForSingleObject3980x140703260
      FsRtlChangeBackingFileObject3990x140392790
      FsRtlCheckLockForOplockRequest4000x14036a9c0
      FsRtlCheckLockForReadAccess4010x1402d62a0
      FsRtlCheckLockForWriteAccess4020x140349d30
      FsRtlCheckOplock4030x140292250
      FsRtlCheckOplockEx4040x1402933d0
      FsRtlCheckOplockEx24050x140291270
      FsRtlCheckUpperOplock4060x140889290
      FsRtlCopyRead4070x140887ff0
      FsRtlCopyWrite4080x140888270
      FsRtlCreateSectionForDataScan4090x140266e80
      FsRtlCurrentBatchOplock4100x1406e4fe0
      FsRtlCurrentOplock4110x140392660
      FsRtlCurrentOplockH4120x140712d70
      FsRtlDeleteExtraCreateParameterLookasideList4130x140887fc0
      FsRtlDeleteKeyFromTunnelCache4140x1406dc2c0
      FsRtlDeleteTunnelCache4150x14075daa0
      FsRtlDeregisterUncProvider4160x140889150
      FsRtlDismountComplete4170x140762ee0
      FsRtlDissectDbcs4180x140889e90
      FsRtlDissectName4190x140324590
      FsRtlDoesDbcsContainWildCards4200x140889f80
      FsRtlDoesNameContainWildCards4210x1402fc560
      FsRtlFastCheckLockForRead4220x1402d6330
      FsRtlFastCheckLockForWrite4230x140349dd0
      FsRtlFastUnlockAll4240x1403301d0
      FsRtlFastUnlockAllByKey4250x1404ea910
      FsRtlFastUnlockSingle4260x1402d64f0
      FsRtlFindExtraCreateParameter4270x14067a120
      FsRtlFindInTunnelCache4280x140889110
      FsRtlFindInTunnelCacheEx4290x1406dc390
      FsRtlFreeExtraCreateParameter4300x140617b10
      FsRtlFreeExtraCreateParameterList4310x140617a50
      FsRtlFreeFileLock4320x14032c2f0
      FsRtlGetCurrentProcessLoaderList4330x140889640
      FsRtlGetEcpListFromIrp4340x140678e30
      FsRtlGetFileNameInformation4350x14070f950
      FsRtlGetFileSize4360x14060f6f0
      FsRtlGetIoAtEof4370x1403246d0
      FsRtlGetNextBaseMcbEntry4380x140331700
      FsRtlGetNextExtraCreateParameter4390x14070c2d0
      FsRtlGetNextFileLock4400x1404ea980
      FsRtlGetNextLargeMcbEntry4410x1404ea160
      FsRtlGetNextMcbEntry4420x1404ea1d0
      FsRtlGetSectorSizeInformation4430x140702500
      FsRtlGetSupportedFeatures4440x1403301a0
      FsRtlGetVirtualDiskNestingLevel4450x140359fa0
      FsRtlHeatInit4460x14088a810
      FsRtlHeatLogIo4470x14088a950
      FsRtlHeatLogTierMove4480x14088aa30
      FsRtlHeatUninit4490x14088aa90
      FsRtlIncrementCcFastMdlReadWait4500x140391350
      FsRtlIncrementCcFastReadNoWait4510x1404ea090
      FsRtlIncrementCcFastReadNotPossible4520x14070bb10
      FsRtlIncrementCcFastReadResourceMiss4530x1404ea0a0
      FsRtlIncrementCcFastReadWait4540x1406ec2f0
      FsRtlInitExtraCreateParameterLookasideList4550x1407ba450
      FsRtlInitializeBaseMcb4560x14026dfc0
      FsRtlInitializeBaseMcbEx4570x14026dfe0
      FsRtlInitializeEofLock4580x1403390a0
      FsRtlInitializeExtraCreateParameter4590x14070ecb0
      FsRtlInitializeExtraCreateParameterList4600x14070fd20
      FsRtlInitializeFileLock4610x1402017e0
      FsRtlInitializeLargeMcb4620x14026e1c0
      FsRtlInitializeMcb4630x140889090
      FsRtlInitializeOplock4640x140715450
      FsRtlInitializeTunnelCache4650x14070de30
      FsRtlInsertExtraCreateParameter4660x140617fb0
      FsRtlInsertPerFileContext4670x14034d070
      FsRtlInsertPerFileObjectContext4680x140333220
      FsRtlInsertPerStreamContext4690x140334070
      FsRtlIs32BitProcess4700x140889670
      FsRtlIsDaxVolume4710x1404ea0b0
      FsRtlIsDbcsInExpression4720x140889ff0
      FsRtlIsEcpAcknowledged4730x1406e61b0
      FsRtlIsEcpFromUserMode4740x1406ed400
      FsRtlIsExtentDangling4750x140889c40
      FsRtlIsFatDbcsLegal4760x1406f7520
      FsRtlIsHpfsDbcsLegal4770x14088a610
      FsRtlIsMobileOS4780x140712bb0
      FsRtlIsNameInExpression4790x1402fbf90
      FsRtlIsNameInUnUpcasedExpression4800x1402fc010
      FsRtlIsNonEmptyDirectoryReparsePointAllowed4810x140357460
      FsRtlIsNtstatusExpected4820x1403503c0
      FsRtlIsPagingFile4830x1403387d0
      FsRtlIsSystemPagingFile4840x14036a440
      FsRtlIsTotalDeviceFailure4850x1402f82f0
      FsRtlIssueDeviceIoControl4860x140702900
      FsRtlKernelFsControlFile4870x1406dd890
      FsRtlLegalAnsiCharacterArray4880x140009640
      FsRtlLogCcFlushError4890x1408887d0
      FsRtlLookupBaseMcbEntry4900x140326000
      FsRtlLookupLargeMcbEntry4910x1404ea250
      FsRtlLookupLastBaseMcbEntry4920x140333770
      FsRtlLookupLastBaseMcbEntryAndIndex4930x140351110
      FsRtlLookupLastLargeMcbEntry4940x1404ea300
      FsRtlLookupLastLargeMcbEntryAndIndex4950x1404ea380
      FsRtlLookupLastMcbEntry4960x1404ea410
      FsRtlLookupMcbEntry4970x1404ea470
      FsRtlLookupPerFileContext4980x140352b80
      FsRtlLookupPerFileObjectContext4990x140325ed0
      FsRtlLookupPerStreamContextInternal5000x1402070d0
      FsRtlMdlRead5010x14070f740
      FsRtlMdlReadComplete5020x1404ea0e0
      FsRtlMdlReadCompleteDev5030x140267a30
      FsRtlMdlReadDev5040x140888a30
      FsRtlMdlReadEx5050x14070f6c0
      FsRtlMdlWriteComplete5060x140888c20
      FsRtlMdlWriteCompleteDev5070x14070ddb0
      FsRtlMupGetProviderIdFromName5080x1408891b0
      FsRtlMupGetProviderInfoFromFileObject5090x1408891e0
      FsRtlNormalizeNtstatus5100x14036ac50
      FsRtlNotifyChangeDirectory5110x14088aec0
      FsRtlNotifyCleanup5120x1406e2540
      FsRtlNotifyCleanupAll5130x14088af20
      FsRtlNotifyFilterChangeDirectory5140x1406e1a50
      FsRtlNotifyFilterChangeDirectoryLite5150x1406e25d0
      FsRtlNotifyFilterReportChange5160x1406e10f0
      FsRtlNotifyFilterReportChangeLite5170x14088aff0
      FsRtlNotifyFilterReportChangeLiteEx5180x1406e1db0
      FsRtlNotifyFullChangeDirectory5190x14088b050
      FsRtlNotifyFullReportChange5200x14088b0c0
      FsRtlNotifyInitializeSync5210x1406e29e0
      FsRtlNotifyReportChange5220x14088b120
      FsRtlNotifyUninitializeSync5230x14070f450
      FsRtlNotifyVolumeEvent5240x14075cf70
      FsRtlNotifyVolumeEventEx5250x140638290
      FsRtlNumberOfRunsInBaseMcb5260x1402736c0
      FsRtlNumberOfRunsInLargeMcb5270x1404ea500
      FsRtlNumberOfRunsInMcb5280x1404ea540
      FsRtlOplockBreakH5290x1406e5310
      FsRtlOplockBreakToNone5300x1404eb1d0
      FsRtlOplockBreakToNoneEx5310x1404eb230
      FsRtlOplockFsctrl5320x1406fb420
      FsRtlOplockFsctrlEx5330x1406fd2a0
      FsRtlOplockGetAnyBreakOwnerProcess5340x1404eb3d0
      FsRtlOplockIsFastIoPossible5350x1406e08e0
      FsRtlOplockIsSharedRequest5360x1406ebb60
      FsRtlOplockKeysEqual5370x140392e60
      FsRtlPostPagingFileStackOverflow5380x1404ec5a0
      FsRtlPostStackOverflow5390x1404ec5c0
      FsRtlPrepareMdlWrite5400x14070f620
      FsRtlPrepareMdlWriteDev5410x140888c90
      FsRtlPrepareMdlWriteEx5420x14070f5a0
      FsRtlPrepareToReuseEcp5430x14076c6e0
      FsRtlPrivateLock5440x1402d6cc0
      FsRtlProcessFileLock5450x1404eaf10
      FsRtlQueryCachedVdl5460x14070d870
      FsRtlQueryInformationFile5470x140889c60
      FsRtlQueryKernelEaFile5480x1406dd690
      FsRtlQueryMaximumVirtualDiskNestingLevel5490x1403984f0
      FsRtlRegisterFileSystemFilterCallbacks5500x1403987b0
      FsRtlRegisterFltMgrCalls5510x1407c42c0
      FsRtlRegisterMupCalls5520x1407c42b0
      FsRtlRegisterUncProvider5530x140889210
      FsRtlRegisterUncProviderEx5540x140889250
      FsRtlRegisterUncProviderEx25550x1407b6540
      FsRtlReleaseEofLock5560x140273750
      FsRtlReleaseFile5570x1405fc9d0
      FsRtlReleaseFileNameInformation5580x140710150
      FsRtlReleaseHeaderMutex5590x14020abb0
      FsRtlRemoveBaseMcbEntry5600x14032c4e0
      FsRtlRemoveDotsFromPath5610x14074bdd0
      FsRtlRemoveExtraCreateParameter5620x14067a1b0
      FsRtlRemoveLargeMcbEntry5630x1404ea560
      FsRtlRemoveMcbEntry5640x1404ea5e0
      FsRtlRemovePerFileContext5650x1404ec380
      FsRtlRemovePerFileObjectContext5660x140333130
      FsRtlRemovePerStreamContext5670x1404ec480
      FsRtlResetBaseMcb5680x14035f870
      FsRtlResetLargeMcb5690x1404ea600
      FsRtlSendModernAppTermination5700x1403787c0
      FsRtlSetDriverBacking5710x14076fa80
      FsRtlSetEcpListIntoIrp5720x1406dddb0
      FsRtlSetKernelEaFile5730x1406dd4f0
      FsRtlSplitBaseMcb5740x1404ea640
      FsRtlSplitLargeMcb5750x1404ea7c0
      FsRtlSyncVolumes5760x14070c2c0
      FsRtlTeardownPerFileContexts5770x1406e8220
      FsRtlTeardownPerStreamContexts5780x1406dbdb0
      FsRtlTruncateBaseMcb5790x14032c3d0
      FsRtlTruncateLargeMcb5800x14032c390
      FsRtlTruncateMcb5810x1404ea840
      FsRtlTryToAcquireHeaderMutex5820x1403609c0
      FsRtlUninitializeBaseMcb5830x14032d060
      FsRtlUninitializeFileLock5840x14032d0b0
      FsRtlUninitializeLargeMcb5850x14032d020
      FsRtlUninitializeMcb5860x1408890b0
      FsRtlUninitializeOplock5870x14033c030
      FsRtlUpdateDiskCounters5880x140343240
      FsRtlUpperOplockFsctrl5890x1408896a0
      FsRtlValidateReparsePointBuffer5900x140340a00
      FsRtlVolumeDeviceToCorrelationId5910x140702470
      HalAcpiGetTableEx5920x1404b3ae0
      HalAcquireDisplayOwnership5930x140398330
      HalAdjustResourceList5940x14026ba30
      HalAllProcessorsStarted5950x140a71f20
      HalAllocateAdapterChannel5960x1404b3cb0
      HalAllocateCommonBuffer5970x14037f350
      HalAllocateCrashDumpRegisters5980x1404b3f50
      HalAllocateHardwareCounters5990x140861730
      HalAssignSlotResources6000x1408616a0
      HalBugCheckSystem6010x1404b4360
      HalCalibratePerformanceCounter6020x140381d30
      HalClearSoftwareInterrupt6030x140398330
      HalConvertDeviceIdtToIrql6040x14075e220
      HalDisableInterrupt6050x140374f30
      HalDispatchTable6060x140c00a60
      HalDisplayString6070x140398330
      HalDmaAllocateCrashDumpRegistersEx6080x1403a3920
      HalDmaFreeCrashDumpRegistersEx6090x1403a45c0
      HalEnableInterrupt6100x1403757e0
      HalEnumerateEnvironmentVariablesEx6110x1404b6d00
      HalEnumerateProcessors6120x1403b10e0
      HalExamineMBR6130x14088b460
      HalFlushCommonBuffer6140x1403631d0
      HalFreeCommonBuffer6150x14037fe40
      HalFreeHardwareCounters6160x140861880
      HalGetAdapter6170x140861710
      HalGetBusData6180x1403c4d60
      HalGetBusDataByOffset6190x14039be20
      HalGetEnvironmentVariable6200x1404b6d20
      HalGetEnvironmentVariableEx6210x1403b79a0
      HalGetInterruptTargetInformation6220x1403c6620
      HalGetInterruptVector6230x1404b6430
      HalGetMemoryCachingRequirements6240x1403a1c70
      HalGetMessageRoutingInfo6250x140375030
      HalGetProcessorIdByNtNumber6260x140375200
      HalGetVectorInput6270x1403c74b0
      HalHandleMcheck6280x1404b7c70
      HalHandleNMI6290x1404b8950
      HalInitSystem6300x140999680
      HalInitializeBios6310x1403c1dd0
      HalInitializeOnResume6320x14038a380
      HalInitializeProcessor6330x1403a5db0
      HalIsHyperThreadingEnabled6340x1403a6330
      HalMakeBeep6350x1404b8c30
      HalPerformEndOfInterrupt6360x140325fb0
      HalPrivateDispatchTable6370x140c00590
      HalProcessorIdle6380x1403f3400
      HalQueryDisplayParameters6390x140398330
      HalQueryEnvironmentVariableInfoEx6400x1404b6dc0
      HalQueryMaximumProcessorCount6410x140379450
      HalQueryRealTimeClock6420x1403414c0
      HalReadDmaCounter6430x1404b4050
      HalRegisterDynamicProcessor6440x1404b8f10
      HalRegisterErrataCallbacks6450x140a415c0
      HalReportResourceUsage6460x140a3a2d0
      HalRequestClockInterrupt6470x14034bb50
      HalRequestDeferredRecoveryServiceInterrupt6480x1404b8f40
      HalRequestIpi6490x1402fd810
      HalRequestIpiSpecifyVector6500x140212190
      HalRequestSoftwareInterrupt6510x140273de0
      HalReturnToFirmware6520x1404b93b0
      HalSendNMI6530x1404b8f80
      HalSendSoftwareInterrupt6540x14033f5a0
      HalSetBusData6550x1404b3c80
      HalSetBusDataByOffset6560x14039bd00
      HalSetDisplayParameters6570x140398330
      HalSetEnvironmentVariable6580x1404b6ec0
      HalSetEnvironmentVariableEx6590x1404b6fa0
      HalSetProfileInterval6600x1404b99d0
      HalSetRealTimeClock6610x1404b1d50
      HalStartDynamicProcessor6620x1404b74f0
      HalStartNextProcessor6630x14039e940
      HalStartProfileInterrupt6640x1404b9a10
      HalStopProfileInterrupt6650x1404b9a40
      HalSystemVectorDispatchEntry6660x14026ba30
      HalTranslateBusAddress6670x1403a3010
      HalWheaUpdateCmciPolicy6680x1403b77d0
      HeadlessDispatch6690x1403b9bd0
      HviGetDebugDeviceOptions6700x1405b9d10
      HviGetEnlightenmentInformation6710x1403a6170
      HviGetHardwareFeatures6720x1405b9d50
      HviGetHypervisorFeatures6730x1403a61b0
      HviGetHypervisorInterface6740x1403a6240
      HviGetHypervisorVendorAndMaxFunction6750x1405b9dd0
      HviGetHypervisorVersion6760x1405b9e20
      HviGetImplementationLimits6770x1405b9e70
      HviIsAnyHypervisorPresent6780x1403a2fc0
      HviIsHypervisorMicrosoftCompatible6790x1403a61f0
      HviIsHypervisorVendorMicrosoft6800x1403b9c40
      HviIsIommuInUse6810x1405b9f60
      HvlGetLpIndexFromApicId6820x1404ed0e0
      HvlGetLpIndexFromProcessorIndex6830x1404ed110
      HvlInvokeFastExtendedHypercall6840x14038db70
      HvlInvokeHypercall6850x14038dd30
      HvlPerformEndOfInterrupt6860x1404f0ec0
      HvlQueryActiveHypervisorProcessorCount6870x1404ed160
      HvlQueryActiveProcessors6880x1404ed190
      HvlQueryConnection6890x1403a7410
      HvlQueryHypervisorProcessorNodeNumber6900x1404ed220
      HvlQueryNumaDistance6910x1404ed260
      HvlQueryProcessorTopology6920x1404ed370
      HvlQueryProcessorTopologyCount6930x1404ed390
      HvlQueryProcessorTopologyEx6940x1404ed3d0
      HvlQueryProcessorTopologyHighestId6950x1404ed460
      HvlQueryStartedProcessors6960x1404ed4a0
      HvlReadPerformanceStateCounters6970x14038e510
      HvlRegisterInterruptCallback6980x1404eccb0
      HvlRegisterWheaErrorNotification6990x14088bf50
      HvlUnregisterInterruptCallback7000x1404ecf40
      HvlUnregisterWheaErrorNotification7010x14088bfd0
      HvlUpdatePerformanceStateCountersForLp7020x14038d9e0
      InbvAcquireDisplayOwnership7030x1404f9e30
      InbvCheckDisplayOwnership7040x1404f9e90
      InbvDisplayString7050x1403a5840
      InbvEnableBootDriver7060x1404f9ec0
      InbvEnableDisplayString7070x1403ccf40
      InbvInstallDisplayStringFilter7080x1403ccfc0
      InbvIsBootDriverInstalled7090x1403b10b0
      InbvNotifyDisplayOwnershipChange7100x1403a5080
      InbvNotifyDisplayOwnershipLost7110x1404f9f60
      InbvResetDisplay7120x1404f9fc0
      InbvSetScrollRegion7130x1404f9ff0
      InbvSetTextColor7140x1404fa020
      InbvSetVirtualFrameBuffer7150x1403ccb40
      InbvSolidColorFill7160x1404fa050
      InitSafeBootMode7170x140c4bffc
      InitializeSListHead7180x1402fdb20
      InterlockedPushListSList7190x1403ff5e0
      IoAcquireCancelSpinLock7200x14032c030
      IoAcquireKsrPersistentMemory7210x1408995a0
      IoAcquireRemoveLockEx7220x1402ca650
      IoAcquireVpbSpinLock7230x1402ff380
      IoAdapterObjectType7240x140cfbc58
      IoAdjustStackSizeForRedirection7250x140500650
      IoAllocateAdapterChannel7260x140500720
      IoAllocateController7270x140500750
      IoAllocateDriverObjectExtension7280x14037d520
      IoAllocateErrorLogEntry7290x14037e110
      IoAllocateIrp7300x140271820
      IoAllocateIrpEx7310x140333600
      IoAllocateMdl7320x1402656a0
      IoAllocateMiniCompletionPacket7330x14060fa90
      IoAllocateSfioStreamIdentifier7340x1405007f0
      IoAllocateWorkItem7350x140341430
      IoApplyPriorityInfoThread7360x1402c7bf0
      IoAssignResources7370x14089aa00
      IoAttachDevice7380x140890f30
      IoAttachDeviceByPointer7390x140500840
      IoAttachDeviceToDeviceStack7400x14037edf0
      IoAttachDeviceToDeviceStackSafe7410x140277230
      IoBoostThreadIo7420x140500870
      IoBuildAsynchronousFsdRequest7430x14033d2b0
      IoBuildDeviceIoControlRequest7440x14027d5f0
      IoBuildPartialMdl7450x140324ec0
      IoBuildSynchronousFsdRequest7460x1406e6110
      IoCallDriver7470x140398230
      IoCancelFileOpen7480x140891030
      IoCancelIrp7490x1403476d0
      IoCheckDesiredAccess7500x140891180
      IoCheckEaBufferValidity7510x140617be0
      IoCheckFunctionAccess7520x140751580
      IoCheckLinkShareAccess7530x1406e09c0
      IoCheckQuerySetFileInformation7540x140756a50
      IoCheckQuerySetVolumeInformation7550x14076a380
      IoCheckQuotaBufferValidity7560x1408911c0
      IoCheckRedirectionTrustLevel7570x1403ed590
      IoCheckShareAccess7580x1406e0990
      IoCheckShareAccessEx7590x14076c8e0
      IoCleanupIrp7600x14038fc10
      IoClearActivityIdThread7610x140201b10
      IoClearAdapterCryptoEngineExtension7620x140502a30
      IoClearFsTrackOffsetState7630x140502a80
      IoClearIrpExtraCreateParameter7640x1405008d0
      IoCompleteRequest7650x1405008f0
      IoCompletionObjectType7660x140cfb5d8
      IoComputeRedirectionTrustLevel7670x1403ed6e0
      IoConnectInterrupt7680x1407ba8c0
      IoConnectInterruptEx7690x140750030
      IoConvertFileHandleToKernelHandle7700x14071a1f0
      IoCopyDeviceObjectHint7710x140891280
      IoCreateArcName7720x14076f320
      IoCreateController7730x140891310
      IoCreateDevice7740x140635040
      IoCreateDeviceSecure7750x14074e080
      IoCreateDisk7760x14088b470
      IoCreateDriver7770x14078fad0
      IoCreateFile7780x140616740
      IoCreateFileEx7790x1406167e0
      IoCreateFileSpecifyDeviceObjectHint7800x14070bd80
      IoCreateNotificationEvent7810x14077ca40
      IoCreateStreamFileObject7820x14076b0b0
      IoCreateStreamFileObjectEx7830x140762430
      IoCreateStreamFileObjectEx27840x140636010
      IoCreateStreamFileObjectLite7850x140635fc0
      IoCreateSymbolicLink7860x14075cb20
      IoCreateSynchronizationEvent7870x140891420
      IoCreateSystemThread7880x14075cc90
      IoCreateUnprotectedSymbolicLink7890x1408914d0
      IoCsqInitialize7900x140357cc0
      IoCsqInitializeEx7910x14035fc40
      IoCsqInsertIrp7920x1403348d0
      IoCsqInsertIrpEx7930x1403348f0
      IoCsqRemoveIrp7940x140397700
      IoCsqRemoveNextIrp7950x140338800
      IoDecrementKeepAliveCount7960x140501df0
      IoDeleteController7970x140704910
      IoDeleteDevice7980x14026f700
      IoDeleteDriver7990x140891540
      IoDeleteSymbolicLink8000x1407612b0
      IoDetachDevice8010x14026f670
      IoDeviceHandlerObjectSize8020x140cfbde4
      IoDeviceHandlerObjectType8030x140d000c8
      IoDeviceObjectType8040x140cfb810
      IoDisconnectInterrupt8050x14074fe70
      IoDisconnectInterruptEx8060x14074fdd0
      IoDriverObjectType8070x140cfb5a0
      IoDuplicateDependency8080x14089b050
      IoEnqueueIrp8090x140891570
      IoEnumerateDeviceObjectList8100x140398520
      IoEnumerateRegisteredFiltersList8110x14075b4b0
      IoFastQueryNetworkAttributes8120x140891590
      IoFileObjectType8130x140cfb448
      IoFlushAdapterBuffers8140x1403875e0
      IoForwardAndCatchIrp8150x1406f8560
      IoForwardIrpSynchronously8160x1406f8560
      IoFreeAdapterChannel8170x1404b3f20
      IoFreeController8180x140500930
      IoFreeErrorLogEntry8190x140500980
      IoFreeIrp8200x140290a90
      IoFreeKsrPersistentMemory8210x140899780
      IoFreeMapRegisters8220x1403a0140
      IoFreeMdl8230x140267a50
      IoFreeMiniCompletionPacket8240x1406576f0
      IoFreeSfioStreamIdentifier8250x1405009e0
      IoFreeWorkItem8260x14034ca80
      IoGetActivityIdIrp8270x1403240f0
      IoGetActivityIdThread8280x1402751e0
      IoGetAdapterCryptoEngineExtension8290x140502ab0
      IoGetAffinityInterrupt8300x14037fa60
      IoGetAttachedDevice8310x140290c90
      IoGetAttachedDeviceReference8320x1402244d0
      IoGetBaseFileSystemDeviceObject8330x1402293c0
      IoGetBootDiskInformation8340x1408915d0
      IoGetBootDiskInformationLite8350x1407875e0
      IoGetConfigurationInformation8360x140770f60
      IoGetContainerInformation8370x1408923d0
      IoGetCurrentProcess8380x14023a4b0
      IoGetDeviceAttachmentBaseRef8390x140277450
      IoGetDeviceDirectory8400x14089c1f0
      IoGetDeviceInterfaceAlias8410x14071af70
      IoGetDeviceInterfacePropertyData8420x14089bd90
      IoGetDeviceInterfaces8430x1406bf190
      IoGetDeviceNumaNode8440x140762a30
      IoGetDeviceObjectPointer8450x140662770
      IoGetDeviceProperty8460x1405dd8e0
      IoGetDevicePropertyData8470x140713090
      IoGetDeviceToVerify8480x140500b00
      IoGetDiskDeviceObject8490x140392330
      IoGetDmaAdapter8500x140754720
      IoGetDriverDirectory8510x14089c5f0
      IoGetDriverObjectExtension8520x14035c870
      IoGetFileObjectGenericMapping8530x1406e4d50
      IoGetFsTrackOffsetState8540x140326ac0
      IoGetFsZeroingOffset8550x140502af0
      IoGetGenericIrpExtension8560x14036e9c0
      IoGetInitialStack8570x140891600
      IoGetInitiatorProcess8580x140360440
      IoGetIoAttributionHandle8590x1403299a0
      IoGetIoPriorityHint8600x140327a10
      IoGetIommuInterface8610x1407c38a0
      IoGetIrpExtraCreateParameter8620x140678e30
      IoGetLowerDeviceObject8630x14035afd0
      IoGetOplockKeyContext8640x140500b10
      IoGetOplockKeyContextEx8650x14033c980
      IoGetPagingIoPriority8660x14033a0e0
      IoGetRelatedDeviceObject8670x14028f730
      IoGetRequestorProcess8680x1402d7cd0
      IoGetRequestorProcessId8690x1403cc630
      IoGetRequestorSessionId8700x14035fd70
      IoGetSfioStreamIdentifier8710x140500b50
      IoGetSilo8720x14027b350
      IoGetSiloParameters8730x140339800
      IoGetStackLimits8740x14029aec0
      IoGetSymlinkSupportInformation8750x1408927b0
      IoGetTopLevelIrp8760x140228f40
      IoGetTransactionParameterBlock8770x140323e30
      IoIncrementKeepAliveCount8780x140501f50
      IoInitializeIrp8790x140334120
      IoInitializeIrpEx8800x14038fbc0
      IoInitializeMiniCompletionPacket8810x140891e50
      IoInitializeRemoveLockEx8820x14037cf00
      IoInitializeTimer8830x1407c2940
      IoInitializeWorkItem8840x1403771a0
      IoInvalidateDeviceRelations8850x14036db00
      IoInvalidateDeviceState8860x1403a25e0
      IoIrpHasFsTrackOffsetExtensionType8870x140332f70
      IoIs32bitProcess8880x1402021f0
      IoIsActivityTracingEnabled8890x140333aa0
      IoIsFileObjectIgnoringSharing8900x140712b30
      IoIsFileOriginRemote8910x14035ab10
      IoIsInitiator32bitProcess8920x14036a800
      IoIsOperationSynchronous8930x14032aa70
      IoIsSystemThread8940x140340660
      IoIsValidIrpStatus8950x1409c53d0
      IoIsValidNameGraftingBuffer8960x140892800
      IoIsWdmVersionAvailable8970x14089bde0
      IoLoadCrashDumpDriver8980x1404fd630
      IoMakeAssociatedIrp8990x140500b90
      IoMakeAssociatedIrpEx9000x140326770
      IoMapTransfer9010x140386440
      IoOpenDeviceInterfaceRegistryKey9020x1407bba00
      IoOpenDeviceRegistryKey9030x1406f6790
      IoOpenDriverRegistryKey9040x1407b3c50
      IoPageRead9050x14037d450
      IoPropagateActivityIdToThread9060x140326a80
      IoPropagateIrpExtension9070x140326bf0
      IoPropagateIrpExtensionEx9080x140326c10
      IoQueryDeviceDescription9090x14077a440
      IoQueryFileDosDeviceName9100x140661c10
      IoQueryFileInformation9110x140711d10
      IoQueryFullDriverPath9120x1403a4330
      IoQueryInformationByName9130x1405d0350
      IoQueryInterface9140x140754f10
      IoQueryKsrPersistentMemorySize9150x140899810
      IoQueryVolumeInformation9160x140710d60
      IoQueueThreadIrp9170x14037f5b0
      IoQueueWorkItem9180x140342ad0
      IoQueueWorkItemEx9190x140342b00
      IoQueueWorkItemToNode9200x1405020c0
      IoRaiseHardError9210x140500bb0
      IoRaiseInformationalHardError9220x140500e70
      IoReadDiskSignature9230x14088b520
      IoReadOperationCount9240x140c456d8
      IoReadPartitionTable9250x14088b620
      IoReadPartitionTableEx9260x14088b7f0
      IoReadTransferCount9270x140c456e0
      IoRecordIoAttribution9280x14027a150
      IoRegisterBootDriverCallback9290x1407c2400
      IoRegisterBootDriverReinitialization9300x1407b5890
      IoRegisterContainerNotification9310x140892450
      IoRegisterDeviceInterface9320x1407366c0
      IoRegisterDriverReinitialization9330x1407b5910
      IoRegisterFileSystem9340x14076f8e0
      IoRegisterFsRegistrationChange9350x140891620
      IoRegisterFsRegistrationChangeMountAware9360x1407b8890
      IoRegisterIoTracking9370x140893060
      IoRegisterLastChanceShutdownNotification9380x1407ad7c0
      IoRegisterPlugPlayNotification9390x1406c67c0
      IoRegisterPriorityCallback9400x1403aba50
      IoRegisterShutdownNotification9410x1407ad840
      IoReleaseCancelSpinLock9420x140278d80
      IoReleaseRemoveLockAndWaitEx9430x140398740
      IoReleaseRemoveLockEx9440x14033a540
      IoReleaseVpbSpinLock9450x1402ff360
      IoRemoveLinkShareAccess9460x140891640
      IoRemoveLinkShareAccessEx9470x1406bd520
      IoRemoveShareAccess9480x1406bdaa0
      IoReplaceFileObjectName9490x140724280
      IoReplacePartitionUnit9500x14089be20
      IoReportDetectedDevice9510x140797f60
      IoReportHalResourceUsage9520x140a37c80
      IoReportInterruptActive9530x140389d00
      IoReportInterruptInactive9540x14038a6a0
      IoReportResourceForDetection9550x14089d8c0
      IoReportResourceUsage9560x14089dab0
      IoReportRootDevice9570x1407b6ab0
      IoReportTargetDeviceChange9580x14075c6f0
      IoReportTargetDeviceChangeAsynchronous9590x140273570
      IoRequestDeviceEject9600x1405078c0
      IoRequestDeviceEjectEx9610x1405078e0
      IoRequestDeviceRemovalForReset9620x14089df90
      IoReserveDependency9630x14089b180
      IoReserveKsrPersistentMemory9640x1408999e0
      IoResolveDependency9650x1403bc9c0
      IoRetrievePriorityInfo9660x1402bc950
      IoReuseIrp9670x140324ba0
      IoSetActivityIdIrp9680x140377140
      IoSetActivityIdThread9690x140273430
      IoSetAdapterCryptoEngineExtension9700x140502b30
      IoSetCompletionRoutineEx9710x140352ef0
      IoSetDependency9720x14089b220
      IoSetDeviceInterfacePropertyData9730x14076caf0
      IoSetDeviceInterfaceState9740x140735ce0
      IoSetDevicePropertyData9750x14072a8d0
      IoSetDeviceToVerify9760x140201800
      IoSetFileObjectIgnoreSharing9770x140891660
      IoSetFileOrigin9780x140377530
      IoSetFsTrackOffsetState9790x140502b90
      IoSetFsZeroingOffset9800x140502bf0
      IoSetFsZeroingOffsetRequired9810x140502c30
      IoSetGenericIrpExtension9820x140378150
      IoSetHardErrorOrVerifyDevice9830x140501200
      IoSetInformation9840x14076b340
      IoSetIoAttributionIrp9850x140501220
      IoSetIoCompletion9860x1406577a0
      IoSetIoCompletionEx9870x1402837b0
      IoSetIoPriorityHint9880x1403320f0
      IoSetIoPriorityHintIntoFileObject9890x140501260
      IoSetIoPriorityHintIntoThread9900x1402c7fd0
      IoSetIrpExtraCreateParameter9910x1406dddb0
      IoSetLinkShareAccess9920x1406bd5b0
      IoSetMasterIrpStatus9930x14032eee0
      IoSetPartitionInformation9940x14088b8a0
      IoSetPartitionInformationEx9950x14088b980
      IoSetShareAccess9960x1406bdb30
      IoSetShareAccessEx9970x14076b560
      IoSetStartIoAttributes9980x1403ccc40
      IoSetSystemPartition9990x140891680
      IoSetThreadHardErrorMode10000x14027c5f0
      IoSetTopLevelIrp10010x140228f20
      IoSizeOfIrpEx10020x1405012a0
      IoSizeofGenericIrpExtension10030x140502c90
      IoSizeofWorkItem10040x140350800
      IoStartNextPacket10050x1405012e0
      IoStartNextPacketByKey10060x140501330
      IoStartPacket10070x140501380
      IoStartTimer10080x140501520
      IoStatisticsLock10090x140d22980
      IoSteerInterrupt10100x14089acf0
      IoStopTimer10110x1403cb6e0
      IoSynchronousCallDriver10120x14034c620
      IoSynchronousPageWrite10130x1403507d0
      IoTestDependency10140x140388660
      IoThreadToProcess10150x140296c80
      IoTransferActivityId10160x140396c60
      IoTranslateBusAddress10170x140507c70
      IoTryQueueWorkItem10180x14037aac0
      IoUninitializeWorkItem10190x140355b00
      IoUnregisterBootDriverCallback10200x140a72130
      IoUnregisterContainerNotification10210x140892690
      IoUnregisterFileSystem10220x14076c550
      IoUnregisterFsRegistrationChange10230x140891820
      IoUnregisterIoTracking10240x140893170
      IoUnregisterPlugPlayNotification10250x140760aa0
      IoUnregisterPlugPlayNotificationEx10260x14077df80
      IoUnregisterPriorityCallback10270x140501550
      IoUnregisterShutdownNotification10280x1409a91a0
      IoUpdateLinkShareAccess10290x1408918d0
      IoUpdateLinkShareAccessEx10300x14068d0b0
      IoUpdateShareAccess10310x140762900
      IoValidateDeviceIoControlAccess10320x14037b270
      IoVerifyPartitionTable10330x14088ba40
      IoVerifyVolume10340x1408918f0
      IoVolumeDeviceNameToGuid10350x140893230
      IoVolumeDeviceNameToGuidPath10360x14063b380
      IoVolumeDeviceToDosName10370x1406624a0
      IoVolumeDeviceToGuid10380x14063b180
      IoVolumeDeviceToGuidPath10390x14063b210
      IoWMIAllocateInstanceIds10400x14092e3b0
      IoWMIDeviceObjectToInstanceName10410x14077c600
      IoWMIDeviceObjectToProviderId10420x14036ea10
      IoWMIExecuteMethod10430x14092e500
      IoWMIHandleToInstanceName10440x14077c580
      IoWMIOpenBlock10450x140746ab0
      IoWMIQueryAllData10460x1407bd4b0
      IoWMIQueryAllDataMultiple10470x14092e680
      IoWMIQuerySingleInstance10480x140742fc0
      IoWMIQuerySingleInstanceMultiple10490x14092e770
      IoWMIRegistrationControl10500x140740d20
      IoWMISetNotificationCallback10510x1407c2740
      IoWMISetSingleInstance10520x14092e870
      IoWMISetSingleItem10530x14092e9a0
      IoWMISuggestInstanceName10540x14092ead0
      IoWMIWriteEvent10550x14037c650
      IoWithinStackLimits10560x140323c20
      IoWriteErrorLogEntry10570x14037e5e0
      IoWriteKsrPersistentMemory10580x140899e80
      IoWriteOperationCount10590x140c456f0
      IoWritePartitionTable10600x14088baf0
      IoWritePartitionTableEx10610x14088bc60
      IoWriteTransferCount10620x140c456e8
      IofCallDriver10630x14028f7d0
      IofCompleteRequest10640x140284eb0
      KdAcquireDebuggerLock10650x14050ba40
      KdChangeOption10660x14050bc00
      KdComPortInUse10670x140cf4c10
      KdDebuggerEnabled10680x140c42eb9
      KdDebuggerNotPresent10690x140c42e81
      KdDeregisterPowerHandler10700x14050b760
      KdDisableDebugger10710x1403cc680
      KdEnableDebugger10720x14050bc70
      KdEnteredDebugger10730x140c4059c
      KdEventLoggingEnabled10740x140c42e82
      KdGetDebugDevice10750x1403c74e0
      KdHvComPortInUse10760x140cf4c38
      KdLogDbgPrint10770x1409b7380
      KdPollBreakIn10780x14050ca50
      KdPowerTransition10790x14050bed0
      KdPowerTransitionEx10800x14050bef0
      KdRefreshDebuggerNotPresent10810x1403ccad0
      KdRegisterPowerHandler10820x14050b8d0
      KdReleaseDebuggerLock10830x14050c0f0
      KdSetEventLoggingPresent10840x1409b5420
      KdSystemDebugControl10850x1408b7540
      KeAcquireGuardedMutex10860x140273ef0
      KeAcquireGuardedMutexUnsafe10870x1403b1930
      KeAcquireInStackQueuedSpinLock10880x1402c0ee0
      KeAcquireInStackQueuedSpinLockAtDpcLevel10890x1402bedf0
      KeAcquireInStackQueuedSpinLockForDpc10900x140511570
      KeAcquireInStackQueuedSpinLockRaiseToSynch10910x140510fc0
      KeAcquireInterruptSpinLock10920x1403542f0
      KeAcquireQueuedSpinLock10930x1402be6b0
      KeAcquireQueuedSpinLockRaiseToSynch10940x140511050
      KeAcquireSpinLockAtDpcLevel10950x14021e350
      KeAcquireSpinLockForDpc10960x1405115c0
      KeAcquireSpinLockRaiseToDpc10970x1402d7ac0
      KeAcquireSpinLockRaiseToSynch10980x140511730
      KeAddGroupAffinityEx10990x14050e420
      KeAddProcessorAffinityEx11000x14021e120
      KeAddProcessorGroupAffinity11010x14050e440
      KeAddSystemServiceTable11020x1407a51e0
      KeAddTriageDumpDataBlock11030x1403c6c90
      KeAlertThread11040x1402fbe60
      KeAllocateCalloutStack11050x1407b6370
      KeAllocateCalloutStackEx11060x14076f1c0
      KeAllocateProcessorProfileStructures11070x1403b26f0
      KeAndAffinityEx11080x14021ebb0
      KeAndGroupAffinityEx11090x140372690
      KeAreAllApcsDisabled11100x14024cd10
      KeAreApcsDisabled11110x1402dd5b0
      KeAttachProcess11120x1403511d0
      KeBugCheck11130x1403f75f0
      KeBugCheckEx11140x1403f7610
      KeCancelTimer11150x1402c93d0
      KeCancelTimer211160x1402754b0
      KeCapturePersistentThreadState11170x1404fff80
      KeCheckProcessorAffinityEx11180x14021e170
      KeCheckProcessorGroupAffinity11190x140397120
      KeClearEvent11200x140297ce0
      KeClockInterruptNotify11210x140216500
      KeClockTimerPowerChange11220x14050eab0
      KeComplementAffinityEx11230x14021ed60
      KeConnectInterruptForHal11240x14039fc40
      KeConvertAuxiliaryCounterToPerformanceCounter11250x14050f010
      KeConvertPerformanceCounterToAuxiliaryCounter11260x14050f030
      KeCopyAffinityEx11270x14021e8e0
      KeCountSetBitsAffinityEx11280x1402fd760
      KeCountSetBitsGroupAffinity11290x140513be0
      KeDelayExecutionThread11300x1402bc300
      KeDeregisterBoundCallback11310x14050f050
      KeDeregisterBugCheckCallback11320x140512800
      KeDeregisterBugCheckReasonCallback11330x1403a2460
      KeDeregisterNmiCallback11340x14050f130
      KeDeregisterProcessorChangeCallback11350x1408b9180
      KeDetachProcess11360x14035ab60
      KeDispatchSecondaryInterrupt11370x140513dd0
      KeDynamicPartitioningSupported11380x140cfb40b
      KeEnterCriticalRegion11390x140205e40
      KeEnterGuardedRegion11400x1403241f0
      KeEnterKernelDebugger11410x140512940
      KeEnumerateNextProcessor11420x14021e1a0
      KeExpandKernelStackAndCallout11430x140360530
      KeExpandKernelStackAndCalloutEx11440x1402f8560
      KeFindConfigurationEntry11450x140a903f0
      KeFindConfigurationNextEntry11460x140a5cc20
      KeFindFirstSetLeftAffinityEx11470x14050e470
      KeFindFirstSetLeftGroupAffinity11480x140350250
      KeFindFirstSetRightAffinityEx11490x14050e4b0
      KeFindFirstSetRightGroupAffinity11500x1402de4c0
      KeFirstGroupAffinityEx11510x140350810
      KeFlushCurrentTbImmediately11520x14039df20
      KeFlushEntireTb11530x1403b3350
      KeFlushIoBuffers11540x140338750
      KeFlushQueuedDpcs11550x1402e1790
      KeFlushWriteBuffer11560x140398330
      KeForceEnableNx11570x140997b10
      KeFreeCalloutStack11580x14076be40
      KeGenericCallDpc11590x140340040
      KeGetClockOwner11600x1403edaa0
      KeGetClockTimerResolution11610x14050ebe0
      KeGetCurrentIrql11620x140228560
      KeGetCurrentNodeNumber11630x140329c70
      KeGetCurrentProcessorNumberEx11640x1402c9c20
      KeGetCurrentThread11650x14023a4d0
      KeGetEffectiveIrql11660x1402c9040
      KeGetNextClockTickDuration11670x14050ec00
      KeGetProcessorIndexFromNumber11680x1402982a0
      KeGetProcessorNumberFromIndex11690x1402fdec0
      KeGetRecommendedSharedDataAlignment11700x14026fe60
      KeGetXSaveFeatureFlags11710x1403a62d0
      KeHwPolicyLocateResource11720x140a5dab0
      KeInitializeAffinityEx11730x14021e0f0
      KeInitializeApc11740x1402f9580
      KeInitializeCrashDumpHeader11750x1405005d0
      KeInitializeDeviceQueue11760x140377880
      KeInitializeDpc11770x1402e3b90
      KeInitializeEnumerationContext11780x1402e3d80
      KeInitializeEnumerationContextFromAffinity11790x140513c50
      KeInitializeEnumerationContextFromGroup11800x140513c70
      KeInitializeEvent11810x140290e40
      KeInitializeGuardedMutex11820x140273520
      KeInitializeInterrupt11830x14039fcb0
      KeInitializeMutant11840x140392e40
      KeInitializeMutex11850x1402ff830
      KeInitializeQueue11860x1402de5d0
      KeInitializeSecondaryInterruptServices11870x1408b9250
      KeInitializeSemaphore11880x1402f9600
      KeInitializeSpinLock11890x140267800
      KeInitializeThreadedDpc11900x1403b1270
      KeInitializeTimer11910x1402ff000
      KeInitializeTimer211920x1402676a0
      KeInitializeTimerEx11930x1402f9200
      KeInitializeTriageDumpDataArray11940x1403c6ea0
      KeInsertByKeyDeviceQueue11950x1405157e0
      KeInsertDeviceQueue11960x1405158a0
      KeInsertHeadQueue11970x140515ea0
      KeInsertQueue11980x14035ad90
      KeInsertQueueApc11990x1402fb6b0
      KeInsertQueueDpc12000x140214c00
      KeInterlockedClearProcessorAffinityEx12010x14050e500
      KeInterlockedSetProcessorAffinityEx12020x1403a6280
      KeInvalidateAllCaches12030x1403a22a0
      KeInvalidateRangeAllCaches12040x140516010
      KeInvalidateRangeAllCachesNoIpi12050x1402f74e0
      KeIpiGenericCall12060x1403a1fc0
      KeIsAttachedProcess12070x1402b8fb0
      KeIsEmptyAffinityEx12080x14021d300
      KeIsEqualAffinityEx12090x1403c0570
      KeIsExecutingDpc12100x14033ada0
      KeIsSingleGroupAffinityEx12110x140353130
      KeIsSubsetAffinityEx12120x14050e560
      KeIsWaitListEmpty12130x1408b7d20
      KeLastBranchMSR12140x140cfbb4c
      KeLeaveCriticalRegion12150x140208500
      KeLeaveGuardedRegion12160x140273d00
      KeLoadMTRR12170x140997130
      KeLoaderBlock12180x140d000c0
      KeLowerIrql12190x14023a220
      KeNotifyProcessorFreezeSupported12200x140398330
      KeNumberProcessors12210x140cfb5b1
      KeOrAffinityEx12220x1402204e0
      KePrepareToDispatchVirtualProcessor12230x140516390
      KeProcessorGroupAffinity12240x14035a690
      KeProfileInterruptWithSource12250x140516a60
      KePulseEvent12260x1402f2fc0
      KeQueryActiveGroupCount12270x14030b9d0
      KeQueryActiveProcessorAffinity12280x1403c0620
      KeQueryActiveProcessorCount12290x1405103e0
      KeQueryActiveProcessorCountEx12300x1402de630
      KeQueryActiveProcessors12310x140510470
      KeQueryAuxiliaryCounterFrequency12320x14050f3c0
      KeQueryDpcWatchdogInformation12330x140327eb0
      KeQueryEffectivePriorityThread12340x140376d10
      KeQueryGroupAffinity12350x14027b860
      KeQueryGroupAffinityEx12360x14050e5e0
      KeQueryHardwareCounterConfiguration12370x1408b97a0
      KeQueryHeteroCpuPolicyThread12380x14050e130
      KeQueryHighestNodeNumber12390x1402de4f0
      KeQueryInterruptTimePrecise12400x14034cab0
      KeQueryLogicalProcessorRelationship12410x1402dd5d0
      KeQueryMaximumGroupCount12420x1402f9630
      KeQueryMaximumProcessorCount12430x140510480
      KeQueryMaximumProcessorCountEx12440x1402de720
      KeQueryNodeActiveAffinity12450x1402de510
      KeQueryNodeMaximumProcessorCount12460x1403cb1d0
      KeQueryPerformanceCounter12470x1402f4070
      KeQueryPrcbAddress12480x14050f3e0
      KeQueryPriorityThread12490x1402d1b20
      KeQueryRuntimeThread12500x140360d10
      KeQuerySystemTimePrecise12510x1402f9640
      KeQueryTimeIncrement12520x140280aa0
      KeQueryTotalCycleTimeThread12530x140296cb0
      KeQueryUnbiasedInterruptTime12540x140268150
      KeQueryUnbiasedInterruptTimePrecise12550x14027a5b0
      KeRaiseIrqlToDpcLevel12560x140280ca0
      KeRaiseUserException12570x140510e40
      KeReadStateEvent12580x1402736c0
      KeReadStateMutant12590x1402736c0
      KeReadStateMutex12600x1402736c0
      KeReadStateQueue12610x1402736c0
      KeReadStateSemaphore12620x1402736c0
      KeReadStateTimer12630x140510e30
      KeReenterRetpolinedCode12640x1403ede40
      KeRegisterBoundCallback12650x14050f7c0
      KeRegisterBugCheckCallback12660x1403ca400
      KeRegisterBugCheckReasonCallback12670x14039bb00
      KeRegisterNmiCallback12680x14050f830
      KeRegisterProcessorChangeCallback12690x1407b7450
      KeReleaseGuardedMutex12700x14020ac90
      KeReleaseGuardedMutexUnsafe12710x1403b1380
      KeReleaseInStackQueuedSpinLock12720x1402bf8d0
      KeReleaseInStackQueuedSpinLockForDpc12730x140511600
      KeReleaseInStackQueuedSpinLockFromDpcLevel12740x14020a870
      KeReleaseInterruptSpinLock12750x140356cb0
      KeReleaseMutant12760x140285bf0
      KeReleaseMutex12770x140284e90
      KeReleaseQueuedSpinLock12780x1402be610
      KeReleaseSemaphore12790x140327f60
      KeReleaseSpinLock12800x140322c30
      KeReleaseSpinLockForDpc12810x1405116a0
      KeReleaseSpinLockFromDpcLevel12820x14021e3c0
      KeRemoveByKeyDeviceQueue12830x140515930
      KeRemoveByKeyDeviceQueueIfBusy12840x140515a10
      KeRemoveDeviceQueue12850x140515af0
      KeRemoveEntryDeviceQueue12860x140515b90
      KeRemoveGroupAffinityEx12870x14050e600
      KeRemoveProcessorAffinityEx12880x14021e8a0
      KeRemoveProcessorGroupAffinity12890x14027e8b0
      KeRemoveQueue12900x140346f10
      KeRemoveQueueDpc12910x1402ffcd0
      KeRemoveQueueDpcEx12920x1402ffcf0
      KeRemoveQueueEx12930x14020f400
      KeRemoveSystemServiceTable12940x1408b8790
      KeReportCacheIncoherentDevice12950x140514a60
      KeResetEvent12960x140297ce0
      KeRestoreExtendedProcessorState12970x140350d00
      KeRestoreFloatingPointState12980x14026ba30
      KeRevertToUserAffinityThread12990x14050e160
      KeRevertToUserAffinityThreadEx13000x14050e1a0
      KeRevertToUserGroupAffinityThread13010x1402e4570
      KeRundownQueue13020x1403388c0
      KeSaveExtendedProcessorState13030x14034ece0
      KeSaveFloatingPointState13040x14026ba30
      KeSaveStateForHibernate13050x1403f8320
      KeSetActualBasePriorityThread13060x140213990
      KeSetAffinityThread13070x14030b9e0
      KeSetBasePriorityThread13080x1402ed3e0
      KeSetCoalescableTimer13090x1402c9070
      KeSetDmaIoCoherency13100x140398330
      KeSetEvent13110x140286b20
      KeSetEventBoostPriority13120x140513b80
      KeSetHardwareCounterConfiguration13130x1408b97f0
      KeSetHeteroCpuPolicyThread13140x14050e240
      KeSetIdealProcessorThread13150x1403789c0
      KeSetImportanceDpc13160x14037f600
      KeSetKernelStackSwapEnable13170x140339040
      KeSetLastBranchRecordInUse13180x1408b8820
      KeSetPriorityThread13190x1402ec060
      KeSetProfileIrql13200x140a40b90
      KeSetSelectedCpuSetsThread13210x140517ac0
      KeSetSystemAffinityThread13220x1403cc360
      KeSetSystemAffinityThreadEx13230x1403cc380
      KeSetSystemGroupAffinityThread13240x1402f1d10
      KeSetTargetProcessorDpc13250x140514c90
      KeSetTargetProcessorDpcEx13260x14035ea70
      KeSetTimer13270x1402c9150
      KeSetTimer213280x14027edc0
      KeSetTimerEx13290x140210f50
      KeSetTracepoint13300x1408b9950
      KeShouldYieldProcessor13310x140327c80
      KeSignalCallDpcDone13320x14035e910
      KeSignalCallDpcSynchronize13330x140514d00
      KeStackAttachProcess13340x14024c170
      KeStallExecutionProcessor13350x14021f3b0
      KeStallWhileFrozen13360x1405189c0
      KeStartDynamicProcessor13370x1408b91a0
      KeSubtractAffinityEx13380x1402201a0
      KeSweepLocalCaches13390x14037fe00
      KeSynchronizeExecution13400x1403f8830
      KeSynchronizeTimeToQpc13410x140383c60
      KeSystemFullyCacheCoherent13420x140514a80
      KeTestAlertThread13430x1402eac20
      KeTestSpinLock13440x14032d500
      KeTryToAcquireGuardedMutex13450x140272ba0
      KeTryToAcquireQueuedSpinLock13460x1405110e0
      KeTryToAcquireQueuedSpinLockRaiseToSynch13470x1405111f0
      KeTryToAcquireSpinLockAtDpcLevel13480x14035e150
      KeUnstackDetachProcess13490x140205990
      KeUpdateThreadTag13500x140369d20
      KeUserModeCallback13510x1406b0690
      KeWaitForMultipleObjects13520x1402801a0
      KeWaitForMutexObject13530x14020b3a0
      KeWaitForSingleObject13540x14020b3a0
      KeWriteProtectPAT13550x1409adcf0
      KfRaiseIrql13560x140228530
      KiBugCheckData13570x140c31380
      KiCheckForKernelApcDelivery13580x140273d40
      KitLogFeatureUsage13590x1405b4430
      KseQueryDeviceData13600x14074b1b0
      KseQueryDeviceDataList13610x1408bc9a0
      KseQueryDeviceFlags13620x14074b770
      KseRegisterShim13630x1407aca80
      KseRegisterShimEx13640x1407acaa0
      KseSetDeviceFlags13650x1408bcba0
      KseUnregisterShim13660x1408bd3e0
      LdrAccessResource13670x1407b4c00
      LdrEnumResources13680x14090de30
      LdrFindResourceDirectory_U13690x14090e100
      LdrFindResourceEx_U13700x14090e120
      LdrFindResource_U13710x1407b4c20
      LdrResFindResource13720x14077ba80
      LdrResFindResourceDirectory13730x14077d3c0
      LdrResSearchResource13740x14065bd70
      LpcPortObjectType13750x140cfa260
      LpcReplyWaitReplyPort13760x140715420
      LpcRequestPort13770x1406b28e0
      LpcRequestWaitReplyPort13780x1408bf170
      LpcRequestWaitReplyPortEx13790x1408bf190
      LpcSendWaitReceivePort13800x140700190
      LsaCallAuthenticationPackage13810x140919af0
      LsaDeregisterLogonProcess13820x140919ba0
      LsaFreeReturnBuffer13830x1406d9eb0
      LsaLogonUser13840x140919c00
      LsaLookupAuthenticationPackage13850x1407c3450
      LsaRegisterLogonProcess13860x1407c33d0
      Mm64BitPhysicalAddress13870x140cfb5b5
      MmAddPhysicalMemory13880x1408c3800
      MmAddVerifierSpecialThunks13890x1408c3970
      MmAddVerifierThunks13900x1408c3a90
      MmAdjustWorkingSetSize13910x1403aba20
      MmAdvanceMdl13920x14052bf90
      MmAllocateContiguousMemory13930x14052c5a0
      MmAllocateContiguousMemorySpecifyCache13940x1403cc3d0
      MmAllocateContiguousMemorySpecifyCacheNode13950x1403cc400
      MmAllocateContiguousNodeMemory13960x140336060
      MmAllocateMappingAddress13970x1406fe460
      MmAllocateMappingAddressEx13980x1406fe480
      MmAllocateMdlForIoSpace13990x14052cd90
      MmAllocateMemoryRanges14000x140715420
      MmAllocateNodePagesForMdlEx14010x1403cb540
      MmAllocateNonCachedMemory14020x1408c3bd0
      MmAllocatePagesForMdl14030x1403a3a50
      MmAllocatePagesForMdlEx14040x140313400
      MmAllocatePartitionNodePagesForMdlEx14050x1403134e0
      MmAreMdlPagesCached14060x14033adc0
      MmBadPointer14070x140cfb538
      MmBuildMdlForNonPagedPool14080x1402cd330
      MmCanFileBeTruncated14090x140320290
      MmChangeImageProtection14100x1406a9ca0
      MmCommitSessionMappedView14110x1406f6940
      MmConfigureGraphicsPtes14120x140715420
      MmCopyMemory14130x14033f7a0
      MmCopyVirtualMemory14140x1405eb5a0
      MmCreateMdl14150x140346b40
      MmCreateMirror14160x1408c47f0
      MmCreateSection14170x14060e970
      MmDisableModifiedWriteOfSection14180x14034cee0
      MmDoesFileHaveUserWritableReferences14190x140330040
      MmFlushImageSection14200x140344d60
      MmForceSectionClosed14210x140344e90
      MmForceSectionClosedEx14220x140525f30
      MmFreeContiguousMemory14230x1403370e0
      MmFreeContiguousMemorySpecifyCache14240x14036aa90
      MmFreeMappingAddress14250x140758080
      MmFreeMemoryRanges14260x140715420
      MmFreeNonCachedMemory14270x1408c3dc0
      MmFreePagesFromMdl14280x14035d830
      MmFreePagesFromMdlEx14290x14037fce0
      MmGetCacheAttribute14300x14052cec0
      MmGetCacheAttributeEx14310x14052cee0
      MmGetMaximumFileSectionSize14320x14076c830
      MmGetPageBadStatus14330x14052a6d0
      MmGetPhysicalAddress14340x1403618a0
      MmGetPhysicalMemoryRanges14350x1407bb9e0
      MmGetPhysicalMemoryRangesEx14360x1407c4230
      MmGetPhysicalMemoryRangesEx214370x14075e870
      MmGetSectionInformation14380x140662880
      MmGetSystemRoutineAddress14390x140706e00
      MmGetVirtualForPhysical14400x14052d020
      MmGrowKernelStack14410x140531570
      MmHighestUserAddress14420x140021490
      MmIsAddressValid14430x140531a30
      MmIsDriverSuspectForVerifier14440x1409c3f70
      MmIsDriverVerifying14450x14037bfe0
      MmIsDriverVerifyingByAddress14460x1407c1690
      MmIsIoSpaceActive14470x140531e10
      MmIsNonPagedSystemAddressValid14480x140531a50
      MmIsRecursiveIoFault14490x140227da0
      MmIsThisAnNtAsSystem14500x14026ff10
      MmIsVerifierEnabled14510x1409c0610
      MmLoadSystemImage14520x140747830
      MmLockPagableDataSection14530x1406a9ba0
      MmLockPagableImageSection14540x1406a9ba0
      MmLockPagableSectionByHandle14550x1406f7b40
      MmLockPreChargedPagedPool14560x140765f90
      MmMapIoSpace14570x140335bb0
      MmMapIoSpaceEx14580x140336010
      MmMapLockedPages14590x14052cb20
      MmMapLockedPagesSpecifyCache14600x14021ba60
      MmMapLockedPagesWithReservedMapping14610x1403c56d0
      MmMapMdl14620x140532470
      MmMapMemoryDumpMdl14630x140533a10
      MmMapMemoryDumpMdlEx14640x140381380
      MmMapUserAddressesToPage14650x14098e310
      MmMapVideoDisplay14660x140335bb0
      MmMapViewInSessionSpace14670x140702d00
      MmMapViewInSessionSpaceEx14680x140702d30
      MmMapViewInSystemSpace14690x14070eb90
      MmMapViewInSystemSpaceEx14700x14070f520
      MmMapViewOfSection14710x14065ed50
      MmMarkPhysicalMemoryAsBad14720x14052a7f0
      MmMarkPhysicalMemoryAsGood14730x14052b320
      MmMdlPageContentsState14740x14033b5c0
      MmMdlPagesAreZero14750x140357bd0
      MmObtainChargesToLockPagedPool14760x140785e20
      MmPageEntireDriver14770x1406a9af0
      MmPrefetchPages14780x14060a7d0
      MmPrefetchVirtualAddresses14790x1406d1800
      MmProbeAndLockPages14800x14024d8a0
      MmProbeAndLockProcessPages14810x140604360
      MmProbeAndLockSelectedPages14820x140345940
      MmProtectDriverSection14830x14036b250
      MmProtectMdlSystemAddress14840x14052d070
      MmQueryMemoryRanges14850x140715420
      MmQuerySystemSize14860x1403a5190
      MmRemovePhysicalMemory14870x1408c3850
      MmResetDriverPaging14880x1406a9960
      MmReturnChargesToLockPagedPool14890x1408c59c0
      MmRotatePhysicalView14900x1406dfc50
      MmSectionObjectType14910x140cfb510
      MmSecureVirtualMemory14920x1406dd110
      MmSecureVirtualMemoryEx14930x1406dd140
      MmSetAddressRangeModified14940x140358470
      MmSetBankedSection14950x14036b250
      MmSetGraphicsPtes14960x1408c4390
      MmSetPermanentCacheAttribute14970x1408c57d0
      MmSizeOfMdl14980x140338660
      MmSystemRangeStart14990x140021498
      MmTrimAllSystemPagableMemory15000x140537850
      MmUnloadSystemImage15010x140761150
      MmUnlockPagableImageSection15020x14034b8a0
      MmUnlockPages15030x140283990
      MmUnlockPreChargedPagedPool15040x1407694d0
      MmUnmapIoSpace15050x1403374b0
      MmUnmapLockedPages15060x140224b70
      MmUnmapReservedMapping15070x14052cb50
      MmUnmapVideoDisplay15080x1403374b0
      MmUnmapViewInSessionSpace15090x14070f190
      MmUnmapViewInSystemSpace15100x140606950
      MmUnmapViewOfSection15110x1406fe440
      MmUnsecureVirtualMemory15120x1406013e0
      MmUserProbeAddress15130x140021488
      NlsAnsiCodePage15140x140d2c088
      NlsLeadByteInfo15150x140980c40
      NlsMbCodePageTag15160x140d2c001
      NlsMbOemCodePageTag15170x140d2c000
      NlsOemCodePage15180x140d2c06c
      NlsOemLeadByteInfo15190x140980c38
      NtAddAtom15200x140954270
      NtAdjustPrivilegesToken15210x140619460
      NtAllocateLocallyUniqueId15220x1406dbf00
      NtAllocateUuids15230x1407096e0
      NtAllocateVirtualMemory15240x1406b7a80
      NtBuildGUID15250x14002dd50
      NtBuildLab15260x140c4c120
      NtBuildNumber15270x140c11f68
      NtClose15280x1405f8550
      NtCommitComplete15290x1403cd2c0
      NtCommitEnlistment15300x1403cd2e0
      NtCommitTransaction15310x1403cd300
      NtCompareSigningLevels15320x14070c8c0
      NtConnectPort15330x14062f730
      NtCreateCrossVmEvent15340x14094c9f0
      NtCreateEnlistment15350x1403cd320
      NtCreateEvent15360x14067a410
      NtCreateFile15370x1406169a0
      NtCreateResourceManager15380x1403cd340
      NtCreateSection15390x1405fb860
      NtCreateTransaction15400x1403cd360
      NtCreateTransactionManager15410x1403cd380
      NtDeleteAtom15420x1406f3320
      NtDeleteFile15430x14076bec0
      NtDeviceIoControlFile15440x140675a90
      NtDuplicateObject15450x1405e8e90
      NtDuplicateToken15460x14062c8b0
      NtEnumerateTransactionObject15470x1403cd3a0
      NtFindAtom15480x1406032f0
      NtFreeVirtualMemory15490x1405f9d40
      NtFreezeTransactions15500x1403cd3c0
      NtFsControlFile15510x1406e4110
      NtGetEnvironmentVariableEx15520x1409516a0
      NtGetNotificationResourceManager15530x1403cd3e0
      NtGlobalFlag15540x140c4c100
      NtImageInfo15550x140986418
      NtLockFile15560x1406a02e0
      NtMakePermanentObject15570x140721050
      NtMapViewOfSection15580x1405ff900
      NtNotifyChangeDirectoryFile15590x1406fe6f0
      NtNotifyChangeDirectoryFileEx15600x1406fe750
      NtOpenEnlistment15610x1403cd400
      NtOpenFile15620x140616930
      NtOpenProcess15630x1406d3bf0
      NtOpenProcessToken15640x140667e50
      NtOpenProcessTokenEx15650x140667e70
      NtOpenResourceManager15660x1403cd420
      NtOpenThread15670x1406675a0
      NtOpenThreadToken15680x140667690
      NtOpenThreadTokenEx15690x1406676b0
      NtOpenTransaction15700x1403cd440
      NtOpenTransactionManager15710x1403cd460
      NtPrePrepareComplete15720x1403cd480
      NtPrePrepareEnlistment15730x1403cd4a0
      NtPrepareComplete15740x1403cd4c0
      NtPrepareEnlistment15750x1403cd4e0
      NtPropagationComplete15760x1403cd500
      NtPropagationFailed15770x1403cd520
      NtQueryDirectoryFile15780x1406f42a0
      NtQueryDirectoryFileEx15790x14068dd70
      NtQueryEaFile15800x1406ebba0
      NtQueryEnvironmentVariableInfoEx15810x140951fc0
      NtQueryInformationAtom15820x1406f1980
      NtQueryInformationByName15830x140892210
      NtQueryInformationEnlistment15840x1403cd540
      NtQueryInformationFile15850x140679040
      NtQueryInformationProcess15860x140662bf0
      NtQueryInformationResourceManager15870x1403cd560
      NtQueryInformationThread15880x140689900
      NtQueryInformationToken15890x14067fc00
      NtQueryInformationTransaction15900x1403cd580
      NtQueryInformationTransactionManager15910x1403cd5a0
      NtQueryQuotaInformationFile15920x140893550
      NtQuerySecurityAttributesToken15930x140682b40
      NtQuerySecurityObject15940x1406dcf00
      NtQuerySystemInformation15950x140690000
      NtQuerySystemInformationEx15960x1406eb790
      NtQueryVolumeInformationFile15970x14068f9e0
      NtReadFile15980x14068d140
      NtReadFileScatter15990x1406ed480
      NtReadOnlyEnlistment16000x1403cd5c0
      NtRecoverEnlistment16010x1403cd5e0
      NtRecoverResourceManager16020x1403cd600
      NtRecoverTransactionManager16030x1403cd620
      NtRequestPort16040x1407021b0
      NtRequestWaitReplyPort16050x1406eecd0
      NtRollbackComplete16060x1403cd640
      NtRollbackEnlistment16070x1403cd660
      NtRollbackTransaction16080x1403cd680
      NtSetCachedSigningLevel16090x14071a330
      NtSetEaFile16100x140720330
      NtSetEvent16110x140674060
      NtSetInformationEnlistment16120x1403cd6a0
      NtSetInformationFile16130x14028fd60
      NtSetInformationProcess16140x1406a1490
      NtSetInformationResourceManager16150x1403cd6c0
      NtSetInformationThread16160x140674970
      NtSetInformationToken16170x1406bae00
      NtSetInformationTransaction16180x1403cd6e0
      NtSetInformationVirtualMemory16190x1406075a0
      NtSetQuotaInformationFile16200x140893c60
      NtSetSecurityObject16210x140627af0
      NtSetVolumeInformationFile16220x14075c2a0
      NtShutdownSystem16230x1405ad6f0
      NtThawTransactions16240x1403cd700
      NtTraceControl16250x14068e820
      NtTraceEvent16260x14026c620
      NtUnlockFile16270x1406e0680
      NtVdmControl16280x140715520
      NtWaitForSingleObject16290x1405f8820
      NtWriteFile16300x14068c510
      NtWriteFileGather16310x1406eda90
      ObAssignSecurity16320x1407624c0
      ObCheckCreateObjectAccess16330x140669140
      ObCheckObjectAccess16340x1406de2c0
      ObCloseHandle16350x1406031a0
      ObCreateObject16360x14060f970
      ObCreateObjectType16370x14077f640
      ObCreateObjectTypeEx16380x14077f660
      ObDeleteCapturedInsertInfo16390x1406532d0
      ObDereferenceObject16400x140208270
      ObDereferenceObjectDeferDelete16410x140286ac0
      ObDereferenceObjectDeferDeleteWithTag16420x1402898b0
      ObDereferenceSecurityDescriptor16430x140669e10
      ObDuplicateObject16440x1405ea350
      ObFindHandleForObject16450x1406d8840
      ObGetFilterVersion16460x1408db110
      ObGetObjectSecurity16470x14070f880
      ObGetObjectType16480x1406fe6c0
      ObInsertObject16490x14060e360
      ObIsDosDeviceLocallyMapped16500x1407bcfc0
      ObIsKernelHandle16510x140310b80
      ObLogSecurityDescriptor16520x14066a620
      ObMakeTemporaryObject16530x14070c810
      ObOpenObjectByName16540x1406954c0
      ObOpenObjectByNameEx16550x140695540
      ObOpenObjectByPointer16560x140668030
      ObOpenObjectByPointerWithTag16570x1408d9f70
      ObQueryNameInfo16580x1406f81a0
      ObQueryNameString16590x140660650
      ObQueryObjectAuditingByHandle16600x1406d5900
      ObReferenceObjectByHandle16610x1405f6920
      ObReferenceObjectByHandleWithTag16620x1405f68e0
      ObReferenceObjectByName16630x140669570
      ObReferenceObjectByPointer16640x14026e130
      ObReferenceObjectByPointerWithTag16650x14027d9c0
      ObReferenceObjectSafe16660x140328430
      ObReferenceObjectSafeWithTag16670x14020af40
      ObReferenceSecurityDescriptor16680x140704930
      ObRegisterCallbacks16690x1407b9460
      ObReleaseObjectSecurity16700x140669b80
      ObSetHandleAttributes16710x1406e2f60
      ObSetSecurityDescriptorInfo16720x140669a20
      ObSetSecurityObjectByPointer16730x14066b6b0
      ObUnRegisterCallbacks16740x1408db120
      ObWaitForMultipleObjects16750x140670710
      ObWaitForSingleObject16760x1405f8750
      ObfDereferenceObject16770x140208270
      ObfDereferenceObjectWithTag16780x140208290
      ObfReferenceObject16790x140208380
      ObfReferenceObjectWithTag16800x140296c20
      POGOBuffer16810x140c4bfd0
      PcwAddInstance16820x1406db420
      PcwCloseInstance16830x1406da2c0
      PcwCreateInstance16840x1406da300
      PcwRegister16850x140770d80
      PcwUnregister16860x140954360
      PfFileInfoNotify16870x14025c410
      PfxFindPrefix16880x14090f3e0
      PfxInitialize16890x14090f4c0
      PfxInsertPrefix16900x14090f4e0
      PfxRemovePrefix16910x14090f600
      PoCallDriver16920x140398230
      PoCancelDeviceNotify16930x14036b250
      PoClearPowerRequest16940x140275f60
      PoCpuIdledSinceLastCallImprecise16950x140369fa0
      PoCreatePowerRequest16960x140761790
      PoCreateThermalRequest16970x140784ff0
      PoDeletePowerRequest16980x14064fbe0
      PoDeleteThermalRequest16990x1408dfe70
      PoDirectedDripsClearDeviceFlags17000x1405636a0
      PoDirectedDripsSetDeviceFlags17010x1403c6a00
      PoDisableSleepStates17020x1408e10c0
      PoEndDeviceBusy17030x140563e20
      PoEnergyEstimationEnabled17040x140296c90
      PoFxActivateComponent17050x1402ca3c0
      PoFxCompleteDevicePowerNotRequired17060x1403a4c30
      PoFxCompleteDirectedPowerDown17070x140563f00
      PoFxCompleteIdleCondition17080x140352800
      PoFxCompleteIdleState17090x1403a3c40
      PoFxEnableDStateReporting17100x1408e1710
      PoFxIdleComponent17110x1402ca050
      PoFxIssueComponentPerfStateChange17120x140563f20
      PoFxIssueComponentPerfStateChangeMultiple17130x140563f50
      PoFxNotifySurprisePowerOn17140x1403892f0
      PoFxPowerControl17150x14038a580
      PoFxPowerOnCrashdumpDevice17160x140564000
      PoFxProcessorNotification17170x1403cb1a0
      PoFxQueryCurrentComponentPerfState17180x140564060
      PoFxRegisterComponentPerfStates17190x1408e1810
      PoFxRegisterCoreDevice17200x1407a1dd0
      PoFxRegisterCrashdumpDevice17210x14077e0d0
      PoFxRegisterDevice17220x1407a1f00
      PoFxRegisterDripsWatchdogCallback17230x1403c8130
      PoFxRegisterPlugin17240x1408e1890
      PoFxRegisterPluginEx17250x1405640c0
      PoFxRegisterPrimaryDevice17260x1408e18b0
      PoFxReportDevicePoweredOn17270x14039d120
      PoFxSetComponentLatency17280x1405640e0
      PoFxSetComponentResidency17290x140564130
      PoFxSetComponentWake17300x140564180
      PoFxSetDeviceIdleTimeout17310x1403c5070
      PoFxSetTargetDripsDevicePowerState17320x1408e19f0
      PoFxStartDevicePowerManagement17330x1403bb280
      PoFxUnregisterDevice17340x1407c3c70
      PoGetProcessorIdleAccounting17350x1405603c0
      PoGetSystemWake17360x1403a4ca0
      PoGetThermalRequestSupport17370x1407b6e60
      PoInitiateProcessorWake17380x1405603f0
      PoLatencySensitivityHint17390x14037bc70
      PoNotifyMediaBuffering17400x14036a3b0
      PoNotifyVSyncChange17410x1402df0d0
      PoQueryWatchdogTime17420x1402c4a90
      PoQueueShutdownWorkItem17430x1408e3b30
      PoReenableSleepStates17440x1408e1180
      PoRegisterCoalescingCallback17450x140783df0
      PoRegisterDeviceForIdleDetection17460x14026fb70
      PoRegisterDeviceNotify17470x14036b250
      PoRegisterPowerSettingCallback17480x1407132d0
      PoRegisterSystemState17490x140569e60
      PoRequestPowerIrp17500x14036cb80
      PoRequestShutdownEvent17510x140796d50
      PoSetDeviceBusyEx17520x140563e30
      PoSetFixedWakeSource17530x1409af3f0
      PoSetHiberRange17540x140385830
      PoSetPowerButtonHoldState17550x140563b30
      PoSetPowerRequest17560x140275f90
      PoSetPowerState17570x14037a9b0
      PoSetSystemState17580x140569f40
      PoSetSystemWake17590x140560280
      PoSetSystemWakeDevice17600x1405602b0
      PoSetThermalActiveCooling17610x1407b6d10
      PoSetThermalPassiveCooling17620x1408dfeb0
      PoSetUserPresent17630x1403a3400
      PoShutdownBugCheck17640x1408e4c90
      PoStartDeviceBusy17650x140563e40
      PoStartNextPowerIrp17660x140398330
      PoUnregisterCoalescingCallback17670x1408e3bb0
      PoUnregisterPowerSettingCallback17680x1407616d0
      PoUnregisterSystemState17690x140569f90
      PoUserShutdownCancelled17700x1407686a0
      PoUserShutdownInitiated17710x1407648b0
      ProbeForRead17720x1406ddd70
      ProbeForWrite17730x1406938b0
      PsAcquireProcessExitSynchronization17740x1406217a0
      PsAcquireSiloHardReference17750x1402009f0
      PsAllocSiloContextSlot17760x14077f490
      PsAssignImpersonationToken17770x140682010
      PsAssignProcessToJobObject17780x140658de0
      PsAttachSiloToCurrentThread17790x1402720a0
      PsChargePoolQuota17800x140339a30
      PsChargeProcessNonPagedPoolQuota17810x14024a060
      PsChargeProcessPagedPoolQuota17820x1405d1bc0
      PsChargeProcessPoolQuota17830x140339a60
      PsChargeProcessWakeCounter17840x14070e3b0
      PsCreateSiloContext17850x140711980
      PsCreateSystemThread17860x1406d1060
      PsCreateSystemThreadEx17870x1406d10b0
      PsDereferenceImpersonationToken17880x1406ff9c0
      PsDereferenceKernelStack17890x140711ec0
      PsDereferencePrimaryToken17900x140704910
      PsDereferenceSiloContext17910x140208270
      PsDetachSiloFromCurrentThread17920x140272080
      PsDisableImpersonation17930x140667bc0
      PsEnterPriorityRegion17940x1403288a0
      PsEstablishWin32Callouts17950x140783bd0
      PsFreeSiloContextSlot17960x140903150
      PsGetContextThread17970x140908bb0
      PsGetCurrentProcess17980x14023a4b0
      PsGetCurrentProcessId17990x140205dd0
      PsGetCurrentProcessSessionId18000x14026d6d0
      PsGetCurrentProcessWin32Process18010x140327c30
      PsGetCurrentProcessWow64Process18020x14032efc0
      PsGetCurrentServerSilo18030x14027d7e0
      PsGetCurrentServerSiloName18040x1409031e0
      PsGetCurrentSilo18050x140299440
      PsGetCurrentThread18060x14023a4d0
      PsGetCurrentThreadId18070x140339080
      PsGetCurrentThreadPreviousMode18080x14033c860
      PsGetCurrentThreadProcess18090x14034b880
      PsGetCurrentThreadProcessId18100x140205dd0
      PsGetCurrentThreadStackBase18110x14057c290
      PsGetCurrentThreadStackLimit18120x14057c2b0
      PsGetCurrentThreadTeb18130x140277fd0
      PsGetCurrentThreadWin32Thread18140x140324b80
      PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion18150x1403240c0
      PsGetEffectiveContainerId18160x140343160
      PsGetEffectiveServerSilo18170x14027b2e0
      PsGetHostSilo18180x14026ba30
      PsGetJobLock18190x140360cb0
      PsGetJobProperty18200x1403274b0
      PsGetJobServerSilo18210x1402017b0
      PsGetJobSessionId18220x140201750
      PsGetJobSilo18230x140200050
      PsGetJobUIRestrictionsClass18240x14035e030
      PsGetParentSilo18250x140903210
      PsGetPermanentSiloContext18260x1402056b0
      PsGetProcessCommonJob18270x14036a6a0
      PsGetProcessCreateTimeQuadPart18280x140342d50
      PsGetProcessDebugPort18290x140358200
      PsGetProcessDxgProcess18300x1406e3700
      PsGetProcessExitProcessCalled18310x140359510
      PsGetProcessExitStatus18320x140768eb0
      PsGetProcessExitTime18330x140705380
      PsGetProcessId18340x14026ab30
      PsGetProcessImageFileName18350x14034aca0
      PsGetProcessInheritedFromUniqueProcessId18360x140296b40
      PsGetProcessJob18370x14034a4b0
      PsGetProcessPeb18380x140346f00
      PsGetProcessPriorityClass18390x14057c2e0
      PsGetProcessProtection18400x140357ad0
      PsGetProcessSectionBaseAddress18410x14027c630
      PsGetProcessSecurityPort18420x140703560
      PsGetProcessSequenceNumber18430x140357d00
      PsGetProcessServerSilo18440x14027d870
      PsGetProcessSessionId18450x14026c600
      PsGetProcessSessionIdEx18460x140347da0
      PsGetProcessSignatureLevel18470x140392dc0
      PsGetProcessSilo18480x14057c2f0
      PsGetProcessStartKey18490x14026d6b0
      PsGetProcessWin32Process18500x140342f90
      PsGetProcessWin32WindowStation18510x14034f700
      PsGetProcessWow64Process18520x140330180
      PsGetServerSiloServiceSessionId18530x140202160
      PsGetSiloContainerId18540x140903240
      PsGetSiloContext18550x140200580
      PsGetSiloIdentifier18560x1407c3cc0
      PsGetSiloMonitorContextSlot18570x140712cd0
      PsGetThreadCreateTime18580x14057c310
      PsGetThreadExitStatus18590x14070c5b0
      PsGetThreadFreezeCount18600x14035ab90
      PsGetThreadHardErrorsAreDisabled18610x1403988d0
      PsGetThreadId18620x140342230
      PsGetThreadProcess18630x140296c80
      PsGetThreadProcessId18640x140347870
      PsGetThreadProperty18650x1403272b0
      PsGetThreadServerSilo18660x1402be9d0
      PsGetThreadSessionId18670x1406619e0
      PsGetThreadTeb18680x14033f5f0
      PsGetThreadWin32Thread18690x140328a10
      PsGetVersion18700x14037d600
      PsGetWin32KFilterSet18710x14027c640
      PsImpersonateClient18720x1406820e0
      PsInitialSystemProcess18730x140cfb420
      PsInsertPermanentSiloContext18740x1407c30d0
      PsInsertSiloContext18750x1405ce1f0
      PsIsComponentEnabled18760x1403f27c0
      PsIsCurrentThreadInServerSilo18770x140205df0
      PsIsCurrentThreadPrefetching18780x140333ca0
      PsIsDiskCountersEnabled18790x1403c7790
      PsIsHostSilo18800x140291fd0
      PsIsProcessBeingDebugged18810x140904b90
      PsIsProcessCommitRelinquished18820x14070f560
      PsIsProcessInAppSilo18830x140903260
      PsIsProtectedProcess18840x14027c720
      PsIsProtectedProcessLight18850x14026ab10
      PsIsSystemProcess18860x14024c150
      PsIsSystemThread18870x140340660
      PsIsThreadImpersonating18880x140756a30
      PsIsThreadTerminating18890x1402fdeb0
      PsIsWin32KFilterAuditEnabled18900x140350860
      PsIsWin32KFilterAuditEnabledForProcess18910x140350890
      PsIsWin32KFilterEnabled18920x140345360
      PsIsWin32KFilterEnabledForProcess18930x140345390
      PsJobType18940x140cfb568
      PsLeavePriorityRegion18950x140327c50
      PsLoadedModuleList18960x140c2a2d0
      PsLoadedModuleResource18970x140c2a260
      PsLookupProcessByProcessId18980x140667180
      PsLookupProcessThreadByCid18990x1406f1500
      PsLookupThreadByThreadId19000x140666f50
      PsMakeSiloContextPermanent19010x1405caa00
      PsPartitionType19020x140cfb7e0
      PsProcessType19030x140cfb410
      PsQueryProcessAttributesByToken19040x140667630
      PsQueryProcessCommandLine19050x14034c770
      PsQueryProcessExceptionFlags19060x140904bd0
      PsQueryTotalCycleTimeProcess19070x140904fd0
      PsReferenceImpersonationToken19080x1406ea210
      PsReferenceKernelStack19090x140712b20
      PsReferencePrimaryToken19100x1406684b0
      PsReferenceProcessFilePointer19110x1406b89b0
      PsReferenceSiloContext19120x14035a470
      PsRegisterAltSystemCallHandler19130x140909200
      PsRegisterPicoProvider19140x1409092f0
      PsRegisterSiloMonitor19150x14077f4b0
      PsReleaseProcessExitSynchronization19160x1406eecb0
      PsReleaseProcessWakeCounter19170x14062ea00
      PsReleaseSiloHardReference19180x140200940
      PsRemoveCreateThreadNotifyRoutine19190x140909ac0
      PsRemoveLoadImageNotifyRoutine19200x140909bb0
      PsRemoveSiloContext19210x140903290
      PsReplaceSiloContext19220x1409032c0
      PsRestoreImpersonation19230x140667cf0
      PsResumeProcess19240x14070e770
      PsReturnPoolQuota19250x14033bcb0
      PsReturnProcessNonPagedPoolQuota19260x140220980
      PsReturnProcessPagedPoolQuota19270x140220940
      PsRevertThreadToSelf19280x140905fa0
      PsRevertToSelf19290x1406cbeb0
      PsSetContextThread19300x140908bd0
      PsSetCreateProcessNotifyRoutine19310x140783dd0
      PsSetCreateProcessNotifyRoutineEx19320x140783c20
      PsSetCreateProcessNotifyRoutineEx219330x140783c80
      PsSetCreateThreadNotifyRoutine19340x140783c40
      PsSetCreateThreadNotifyRoutineEx19350x140783a80
      PsSetCurrentThreadPrefetching19360x140605b60
      PsSetJobProperty19370x14057c400
      PsSetLegoNotifyRoutine19380x1409080f0
      PsSetLoadImageNotifyRoutine19390x140783c60
      PsSetLoadImageNotifyRoutineEx19400x140783cb0
      PsSetProcessDxgProcess19410x14070e5b0
      PsSetProcessFaultInformation19420x140761dd0
      PsSetProcessPriorityByClass19430x1406f8eb0
      PsSetProcessPriorityClass19440x14057c470
      PsSetProcessSecurityPort19450x140904df0
      PsSetProcessWin32Process19460x1406fb4f0
      PsSetProcessWindowStation19470x14070fce0
      PsSetThreadHardErrorsAreDisabled19480x140398720
      PsSetThreadProperty19490x140327100
      PsSetThreadWin32Thread19500x140703470
      PsSiloContextNonPagedType19510x140c1dfd0
      PsSiloContextPagedType19520x140c1dfd8
      PsStartSiloMonitor19530x1407b3060
      PsSuspendProcess19540x140909f30
      PsTerminateServerSilo19550x140903420
      PsTerminateSystemThread19560x1406cc930
      PsThreadType19570x140cfb440
      PsUILanguageComitted19580x140d2d7b8
      PsUnregisterSiloMonitor19590x140908bf0
      PsUpdateComponentPower19600x14027b610
      PsUpdateDiskCounters19610x1403434d0
      PsWow64GetProcessMachine19620x1406af090
      PsWow64IsMachineSupported19630x1406b6d00
      PsWrapApcWow64Thread19640x14057da30
      RtlAbsoluteToSelfRelativeSD19650x140757a30
      RtlAddAccessAllowedAce19660x1406bc860
      RtlAddAccessAllowedAceEx19670x140770e10
      RtlAddAccessAllowedObjectAce19680x14090f890
      RtlAddAccessDeniedAceEx19690x14078dd20
      RtlAddAccessDeniedObjectAce19700x14090f8f0
      RtlAddAccessFilterAce19710x14090f950
      RtlAddAce19720x14066b7c0
      RtlAddAtomToAtomTable19730x14070e170
      RtlAddAtomToAtomTableEx19740x14024ff20
      RtlAddAuditAccessAceEx19750x14090fb90
      RtlAddAuditAccessObjectAce19760x14090fbe0
      RtlAddProcessTrustLabelAce19770x14079b6f0
      RtlAddRange19780x140752c40
      RtlAddResourceAttributeAce19790x14090fc70
      RtlAllocateHeap19800x1402db530
      RtlAnsiCharToUnicodeChar19810x1405e74f0
      RtlAnsiStringToUnicodeSize19820x14063dfb0
      RtlAnsiStringToUnicodeString19830x14063de20
      RtlAppendAsciizToString19840x14090ddc0
      RtlAppendStringToString19850x14075cac0
      RtlAppendUnicodeStringToString19860x1402721f0
      RtlAppendUnicodeToString19870x140202b70
      RtlAreAllAccessesGranted19880x1406e3d40
      RtlAreAnyAccessesGranted19890x1407125f0
      RtlAreBitsClear19900x140271530
      RtlAreBitsClearEx19910x1403322a0
      RtlAreBitsSet19920x14033bb70
      RtlAreBitsSetEx19930x140581c20
      RtlAssert19940x140583760
      RtlAvlInsertNodeEx19950x140249bf0
      RtlAvlRemoveNode19960x14023dc90
      RtlCapabilityCheck19970x140910a50
      RtlCapabilityCheckForSingleSessionSku19980x140910e30
      RtlCaptureContext19990x1403ff650
      RtlCaptureStackBackTrace20000x1402e7880
      RtlCharToInteger20010x1407878e0
      RtlCheckPortableOperatingSystem20020x14035b2e0
      RtlCheckRegistryKey20030x14070b600
      RtlCheckSystemBootStatusIntegrity20040x140912c40
      RtlCheckTokenCapability20050x140581680
      RtlCheckTokenMembership20060x1402feab0
      RtlCheckTokenMembershipEx20070x1402fead0
      RtlClearAllBits20080x140271930
      RtlClearAllBitsEx20090x14034f380
      RtlClearBit20100x1403396c0
      RtlClearBitEx20110x140347080
      RtlClearBits20120x140281070
      RtlClearBitsEx20130x140250fd0
      RtlCmDecodeMemIoResource20140x14035e920
      RtlCmEncodeMemIoResource20150x1403a5780
      RtlCompareAltitudes20160x140347120
      RtlCompareMemory20170x1403ffdb0
      RtlCompareMemoryUlong20180x1403ffe30
      RtlCompareString20190x1405e53b0
      RtlCompareUnicodeString20200x1405e7360
      RtlCompareUnicodeStrings20210x1406cd1b0
      RtlCompressBuffer20220x1402cd900
      RtlCompressChunks20230x14090d8a0
      RtlComputeCrc3220240x140332e00
      RtlConstructCrossVmEventPath20250x140912eb0
      RtlConstructCrossVmMutexPath20260x140912eb0
      RtlContractHashTable20270x1403314f0
      RtlConvertSidToUnicodeString20280x140643880
      RtlCopyBitMap20290x140347dc0
      RtlCopyBitMapEx20300x140339f50
      RtlCopyLuid20310x14075a0f0
      RtlCopyLuidAndAttributesArray20320x1406de910
      RtlCopyMemory20330x14040a4c0
      RtlCopyMemoryNonTemporal20340x1403ffe60
      RtlCopyRangeList20350x14074f7c0
      RtlCopySid20360x140626850
      RtlCopySidAndAttributesArray20370x140681f40
      RtlCopyString20380x140580380
      RtlCopyUnicodeString20390x140290a10
      RtlCrc3220400x140583a60
      RtlCrc6420410x14033b610
      RtlCreateAcl20420x14066b8f0
      RtlCreateAtomTable20430x1405d1020
      RtlCreateAtomTableEx20440x140201810
      RtlCreateHashTable20450x140373fc0
      RtlCreateHashTableEx20460x140398910
      RtlCreateHeap20470x1407584b0
      RtlCreateRegistryKey20480x1407bf900
      RtlCreateSecurityDescriptor20490x14065f420
      RtlCreateSystemVolumeInformationFolder20500x140721240
      RtlCreateUnicodeString20510x140643ba0
      RtlCreateUnicodeStringFromAsciiz20520x140791e00
      RtlCreateUserThread20530x14090d6c0
      RtlCultureNameToLCID20540x14078c6a0
      RtlCustomCPToUnicodeN20550x14090e160
      RtlDecompressBuffer20560x1405802c0
      RtlDecompressBufferEx20570x1403065f0
      RtlDecompressBufferEx220580x14035f690
      RtlDecompressChunks20590x14090da10
      RtlDecompressFragment20600x14090dc70
      RtlDecompressFragmentEx20610x14035dc10
      RtlDelete20620x1402d8100
      RtlDeleteAce20630x140701660
      RtlDeleteAtomFromAtomTable20640x1406f34b0
      RtlDeleteElementGenericTable20650x140344a30
      RtlDeleteElementGenericTableAvl20660x140201b40
      RtlDeleteElementGenericTableAvlEx20670x14037efe0
      RtlDeleteHashTable20680x1403772f0
      RtlDeleteNoSplay20690x140330750
      RtlDeleteOwnersRanges20700x14074fa70
      RtlDeleteRange20710x14074f9c0
      RtlDeleteRegistryValue20720x140770cc0
      RtlDeriveCapabilitySidsFromName20730x14034a7e0
      RtlDescribeChunk20740x14090dd00
      RtlDestroyAtomTable20750x1406f3370
      RtlDestroyHeap20760x140761bd0
      RtlDowncaseUnicodeChar20770x14090d1e0
      RtlDowncaseUnicodeString20780x1406e8190
      RtlDrainNonVolatileFlush20790x140580b30
      RtlDuplicateUnicodeString20800x1406c6350
      RtlEmptyAtomTable20810x1409107b0
      RtlEndEnumerationHashTable20820x14032ae40
      RtlEndStrongEnumerationHashTable20830x140398330
      RtlEndWeakEnumerationHashTable20840x140583a00
      RtlEnumerateEntryHashTable20850x14032acc0
      RtlEnumerateGenericTable20860x14037fda0
      RtlEnumerateGenericTableAvl20870x1403581d0
      RtlEnumerateGenericTableLikeADirectory20880x1402022a0
      RtlEnumerateGenericTableWithoutSplaying20890x1403583d0
      RtlEnumerateGenericTableWithoutSplayingAvl20900x140202190
      RtlEqualLuid20910x140910ea0
      RtlEqualSid20920x140298f20
      RtlEqualString20930x140202cc0
      RtlEqualUnicodeString20940x140682d90
      RtlEqualWnfChangeStamps20950x1409137a0
      RtlEthernetAddressToStringA20960x140586d60
      RtlEthernetAddressToStringW20970x140586fb0
      RtlEthernetStringToAddressA20980x140587020
      RtlEthernetStringToAddressW20990x140587a20
      RtlExpandHashTable21000x14034c2d0
      RtlExtendCorrelationVector21010x1409137b0
      RtlExtractBitMap21020x140581cf0
      RtlExtractBitMapEx21030x140581ea0
      RtlFillMemory21040x140587c00
      RtlFillMemoryNonTemporal21050x1403fffa0
      RtlFillNonVolatileMemory21060x140587c20
      RtlFindAceByType21070x1402947e0
      RtlFindClearBits21080x1402d74a0
      RtlFindClearBitsAndSet21090x140269270
      RtlFindClearBitsAndSetEx21100x1402502c0
      RtlFindClearBitsEx21110x14021d340
      RtlFindClearRuns21120x140361090
      RtlFindClosestEncodableLength21130x140583950
      RtlFindExportedRoutineByName21140x14065ee40
      RtlFindFirstRunClear21150x1402d5580
      RtlFindLastBackwardRunClear21160x140349470
      RtlFindLeastSignificantBit21170x14034dc80
      RtlFindLongestRunClear21180x140582060
      RtlFindMessage21190x140714150
      RtlFindMostSignificantBit21200x140343140
      RtlFindNextForwardRunClear21210x1402d4620
      RtlFindNextForwardRunClearCapped21220x140582300
      RtlFindNextForwardRunClearEx21230x140582440
      RtlFindRange21240x14074e920
      RtlFindSetBits21250x1402d70e0
      RtlFindSetBitsAndClear21260x140582590
      RtlFindSetBitsAndClearEx21270x14035b390
      RtlFindSetBitsEx21280x14021d6b0
      RtlFindUnicodePrefix21290x1406e4ac0
      RtlFindUnicodeSubstring21300x1405e69d0
      RtlFirstFreeAce21310x14067e940
      RtlFlushNonVolatileMemory21320x140580b60
      RtlFlushNonVolatileMemoryRanges21330x140587cd0
      RtlFormatCurrentUserKeyPath21340x14063ff10
      RtlFormatMessage21350x14090e540
      RtlFreeAnsiString21360x14065f840
      RtlFreeHeap21370x1402db440
      RtlFreeNonVolatileToken21380x140587d60
      RtlFreeOemString21390x140762c10
      RtlFreeRangeList21400x14074fb50
      RtlFreeUTF8String21410x14090d200
      RtlFreeUnicodeString21420x14065f840
      RtlGUIDFromString21430x1405de060
      RtlGenerate8dot3Name21440x1406e00a0
      RtlGenerateClass5Guid21450x14078d350
      RtlGetAce21460x14027db50
      RtlGetActiveConsoleId21470x1402dccd0
      RtlGetAppContainerNamedObjectPath21480x140581a00
      RtlGetAppContainerParent21490x140910ec0
      RtlGetAppContainerSidType21500x1406bc180
      RtlGetCallersAddress21510x140583890
      RtlGetCompressionWorkSpaceSize21520x1403053a0
      RtlGetConsoleSessionForegroundProcessId21530x14090d730
      RtlGetControlSecurityDescriptor21540x14063fa00
      RtlGetCurrentServiceSessionId21550x1403a3620
      RtlGetDaclSecurityDescriptor21560x1402720c0
      RtlGetDefaultCodePage21570x140760e80
      RtlGetElementGenericTable21580x140349ae0
      RtlGetElementGenericTableAvl21590x140586c40
      RtlGetEnabledExtendedAndSupervisorFeatures21600x140587ee0
      RtlGetEnabledExtendedFeatures21610x1403a49b0
      RtlGetFirstRange21620x14074ecd0
      RtlGetGroupSecurityDescriptor21630x14074e3b0
      RtlGetIntegerAtom21640x140603d00
      RtlGetLastRange21650x14074ed30
      RtlGetMultiTimePrecise21660x1402ff9a0
      RtlGetNextEntryHashTable21670x140332330
      RtlGetNextRange21680x14074ec20
      RtlGetNonVolatileToken21690x140587d80
      RtlGetNtGlobalFlags21700x1409127a0
      RtlGetNtProductType21710x1403501e0
      RtlGetNtSystemRoot21720x14070b9a0
      RtlGetOwnerSecurityDescriptor21730x1406eea80
      RtlGetPersistedStateLocation21740x1405dd610
      RtlGetProductInfo21750x14035e350
      RtlGetSaclSecurityDescriptor21760x14063e650
      RtlGetSessionProperties21770x140910f90
      RtlGetSetBootStatusData21780x140779620
      RtlGetSuiteMask21790x1406fd560
      RtlGetSystemBootStatus21800x140784c50
      RtlGetSystemBootStatusEx21810x140784c90
      RtlGetThreadLangIdByIndex21820x140277c10
      RtlGetTokenNamedObjectPath21830x140910ff0
      RtlGetVersion21840x1406fd4a0
      RtlHashUnicodeString21850x1405db280
      RtlIdnToAscii21860x140913c90
      RtlIdnToNameprepUnicode21870x140913cc0
      RtlIdnToUnicode21880x140913cf0
      RtlImageDirectoryEntryToData21890x14027c310
      RtlImageNtHeader21900x140224a90
      RtlImageNtHeaderEx21910x140224ac0
      RtlIncrementCorrelationVector21920x140913800
      RtlInitAnsiString21930x1402770e0
      RtlInitAnsiStringEx21940x1403b5930
      RtlInitCodePageTable21950x1407bb470
      RtlInitEnumerationHashTable21960x14032ae90
      RtlInitString21970x1402770e0
      RtlInitStringEx21980x1405803c0
      RtlInitStrongEnumerationHashTable21990x1403921e0
      RtlInitUTF8String22000x1405803e0
      RtlInitUTF8StringEx22010x1405803c0
      RtlInitUnicodeString22020x140299030
      RtlInitUnicodeStringEx22030x140202c20
      RtlInitWeakEnumerationHashTable22040x140583a20
      RtlInitializeBitMap22050x140340db0
      RtlInitializeBitMapEx22060x14035e6c0
      RtlInitializeCorrelationVector22070x1409138e0
      RtlInitializeGenericTable22080x140357fb0
      RtlInitializeGenericTableAvl22090x140202100
      RtlInitializeRangeList22100x1407aaeb0
      RtlInitializeSid22110x1406f5a40
      RtlInitializeSidEx22120x1403c69a0
      RtlInitializeUnicodePrefix22130x1407c18c0
      RtlInsertElementGenericTable22140x140344ac0
      RtlInsertElementGenericTableAvl22150x140201da0
      RtlInsertElementGenericTableFull22160x140344b30
      RtlInsertElementGenericTableFullAvl22170x140201e10
      RtlInsertEntryHashTable22180x140269700
      RtlInsertUnicodePrefix22190x1406e4960
      RtlInt64ToUnicodeString22200x14063dd70
      RtlIntegerToChar22210x140700ed0
      RtlIntegerToUnicode22220x140643a60
      RtlIntegerToUnicodeString22230x140700e40
      RtlInterlockedClearBitRun22240x1403bcae0
      RtlInterlockedClearBitRunEx22250x140582970
      RtlInterlockedSetBitRun22260x140582a30
      RtlInterlockedSetBitRunEx22270x140582af0
      RtlInterlockedSetClearRun22280x1402d4f10
      RtlIntersectBitMaps22290x140582bb0
      RtlIntersectBitMapsEx22300x14033b370
      RtlInvertRangeList22310x1407a50c0
      RtlInvertRangeListEx22320x1407a50f0
      RtlIoDecodeMemIoResource22330x14037b360
      RtlIoEncodeMemIoResource22340x1403c2e80
      RtlIpv4AddressToStringA22350x14038e660
      RtlIpv4AddressToStringExA22360x140586dd0
      RtlIpv4AddressToStringExW22370x14037f8c0
      RtlIpv4AddressToStringW22380x14037f960
      RtlIpv4StringToAddressA22390x14038e7d0
      RtlIpv4StringToAddressExA22400x140587160
      RtlIpv4StringToAddressExW22410x140353990
      RtlIpv4StringToAddressW22420x140353a10
      RtlIpv6AddressToStringA22430x14036a460
      RtlIpv6AddressToStringExA22440x140586e90
      RtlIpv6AddressToStringExW22450x14037c360
      RtlIpv6AddressToStringW22460x14037c440
      RtlIpv6StringToAddressA22470x140587340
      RtlIpv6StringToAddressExA22480x140587760
      RtlIpv6StringToAddressExW22490x140351530
      RtlIpv6StringToAddressW22500x1403515d0
      RtlIsCloudFilesPlaceholder22510x140588810
      RtlIsElevatedRid22520x1406bc060
      RtlIsGenericTableEmpty22530x1403927c0
      RtlIsGenericTableEmptyAvl22540x140201b30
      RtlIsMultiSessionSku22550x1406ef260
      RtlIsMultiUsersInSessionSku22560x140911020
      RtlIsNameLegalDOS8Dot322570x1406e56e0
      RtlIsNonEmptyDirectoryReparsePointAllowed22580x140357480
      RtlIsNormalizedString22590x1409164e0
      RtlIsNtDdiVersionAvailable22600x1403c98c0
      RtlIsPartialPlaceholder22610x140914b80
      RtlIsPartialPlaceholderFileHandle22620x140914ba0
      RtlIsPartialPlaceholderFileInfo22630x140914c00
      RtlIsRangeAvailable22640x14074ea80
      RtlIsSandboxedToken22650x14062cc20
      RtlIsServicePackVersionInstalled22660x140588020
      RtlIsStateSeparationEnabled22670x140708130
      RtlIsUntrustedObject22680x140350500
      RtlIsValidOemCharacter22690x140913bc0
      RtlIsZeroMemory22700x140588840
      RtlLCIDToCultureName22710x140913720
      RtlLargeIntegerToChar22720x14063e050
      RtlLengthRequiredSid22730x1406304e0
      RtlLengthSecurityDescriptor22740x14066a840
      RtlLengthSid22750x14027dbb0
      RtlLoadString22760x14090edc0
      RtlLocalTimeToSystemTime22770x14090d770
      RtlLocateSupervisorFeature22780x140587f10
      RtlLockBootStatusData22790x14076e590
      RtlLookupAtomInAtomTable22800x140603ba0
      RtlLookupElementGenericTable22810x1402d7e90
      RtlLookupElementGenericTableAvl22820x140202510
      RtlLookupElementGenericTableFull22830x140586be0
      RtlLookupElementGenericTableFullAvl22840x140202410
      RtlLookupEntryHashTable22850x14026f450
      RtlLookupFirstMatchingElementGenericTableAvl22860x140392290
      RtlLookupFunctionEntry22870x1402e95f0
      RtlMapGenericMask22880x140678de0
      RtlMapSecurityErrorToNtStatus22890x140351fe0
      RtlMergeRangeLists22900x14090d4f0
      RtlMoveMemory22910x14040a4c0
      RtlMultiByteToUnicodeN22920x14063df10
      RtlMultiByteToUnicodeSize22930x14063dfe0
      RtlNextUnicodePrefix22940x140762aa0
      RtlNormalizeSecurityDescriptor22950x14026ee00
      RtlNormalizeString22960x140916570
      RtlNotifyFeatureUsage22970x140589080
      RtlNtStatusToDosError22980x1406dceb0
      RtlNtStatusToDosErrorNoTeb22990x140331dc0
      RtlNumberGenericTableElements23000x140353490
      RtlNumberGenericTableElementsAvl23010x14033b5b0
      RtlNumberOfClearBits23020x1402f2550
      RtlNumberOfClearBitsEx23030x140582da0
      RtlNumberOfClearBitsInRange23040x140582dd0
      RtlNumberOfSetBits23050x1402f2580
      RtlNumberOfSetBitsEx23060x140582e00
      RtlNumberOfSetBitsInRange23070x140582fa0
      RtlNumberOfSetBitsInRangeEx23080x140583220
      RtlNumberOfSetBitsUlongPtr23090x140346400
      RtlOemStringToCountedUnicodeString23100x14090d230
      RtlOemStringToUnicodeSize23110x14074f4b0
      RtlOemStringToUnicodeString23120x14074f310
      RtlOemToUnicodeN23130x14074f400
      RtlOpenCurrentUser23140x14077b9d0
      RtlOpenImageFileOptionsKey23150x14070a160
      RtlOsDeploymentState23160x140916790
      RtlOwnerAcesPresent23170x14032aab0
      RtlPcToFileHeader23180x14034f530
      RtlPcToFileName23190x1403c9210
      RtlPcToFilePath23200x1409168f0
      RtlPinAtomInAtomTable23210x140701420
      RtlPrefetchMemoryNonTemporal23220x1403fff80
      RtlPrefixString23230x1406e6270
      RtlPrefixUnicodeString23240x1405e6d40
      RtlQueryAllFeatureConfigurations23250x1409166a0
      RtlQueryAtomInAtomTable23260x140603db0
      RtlQueryDynamicTimeZoneInformation23270x1406c7500
      RtlQueryElevationFlags23280x1406f9110
      RtlQueryFeatureConfiguration23290x140389fe0
      RtlQueryFeatureConfigurationChangeStamp23300x1405890a0
      RtlQueryImageFileKeyOption23310x1406fedd0
      RtlQueryInformationAcl23320x14066a210
      RtlQueryModuleInformation23330x1407775e0
      RtlQueryPackageClaims23340x14026a160
      RtlQueryPackageIdentity23350x14026a0b0
      RtlQueryProcessPlaceholderCompatibilityMode23360x140914c60
      RtlQueryRegistryValueWithFallback23370x14066bc30
      RtlQueryRegistryValues23380x140709aa0
      RtlQueryRegistryValuesEx23390x14070b5e0
      RtlQueryThreadPlaceholderCompatibilityMode23400x140914c90
      RtlQueryTimeZoneInformation23410x1409127b0
      RtlQueryValidationRunlevel23420x140589450
      RtlRaiseCustomSystemEventTrigger23430x140589530
      RtlRaiseException23440x1402e6900
      RtlRaiseStatus23450x140328270
      RtlRandom23460x14070c760
      RtlRandomEx23470x1402e2220
      RtlRbInsertNodeEx23480x14028c0e0
      RtlRbRemoveNode23490x14028b3c0
      RtlRbReplaceNode23500x140273390
      RtlRealPredecessor23510x140201770
      RtlRealSuccessor23520x140330500
      RtlRegisterFeatureConfigurationChangeNotification23530x1405890b0
      RtlRemoveEntryHashTable23540x14032ade0
      RtlRemoveUnicodePrefix23550x14070a180
      RtlReplaceSidInSd23560x140911040
      RtlReserveChunk23570x14090dd60
      RtlRestoreContext23580x1403ff900
      RtlRestoreSystemBootStatusDefaults23590x140912e70
      RtlRunOnceBeginInitialize23600x1406a5b20
      RtlRunOnceComplete23610x1406a5bd0
      RtlRunOnceExecuteOnce23620x1406a5a40
      RtlRunOnceInitialize23630x14077f480
      RtlSecondsSince1970ToTime23640x1403ca1c0
      RtlSecondsSince1980ToTime23650x140580250
      RtlSelfRelativeToAbsoluteSD23660x140757670
      RtlSelfRelativeToAbsoluteSD223670x14090f6d0
      RtlSetActiveConsoleId23680x14077dec0
      RtlSetAllBits23690x14030ca60
      RtlSetAllBitsEx23700x1403c81d0
      RtlSetBit23710x14033ad90
      RtlSetBitEx23720x140343530
      RtlSetBits23730x1402d6440
      RtlSetBitsEx23740x14024a0a0
      RtlSetConsoleSessionForegroundProcessId23750x140703440
      RtlSetControlSecurityDescriptor23760x140762bc0
      RtlSetDaclSecurityDescriptor23770x14066b750
      RtlSetDynamicTimeZoneInformation23780x1409127d0
      RtlSetGroupSecurityDescriptor23790x1406bc890
      RtlSetOwnerSecurityDescriptor23800x1406bc8f0
      RtlSetPortableOperatingSystem23810x140583900
      RtlSetProcessPlaceholderCompatibilityMode23820x140914cd0
      RtlSetSaclSecurityDescriptor23830x1406349f0
      RtlSetSystemBootStatus23840x140784d60
      RtlSetSystemBootStatusEx23850x140712aa0
      RtlSetThreadPlaceholderCompatibilityMode23860x140914d10
      RtlSetTimeZoneInformation23870x1409127f0
      RtlShiftLeftBitMap23880x1405834a0
      RtlShiftLeftBitMapEx23890x140583510
      RtlSidHashInitialize23900x140293420
      RtlSidHashLookup23910x14026d960
      RtlSizeHeap23920x140581550
      RtlSplay23930x1402d7f10
      RtlStringFromGUID23940x1406a8ea0
      RtlStronglyEnumerateEntryHashTable23950x14038d710
      RtlSubAuthorityCountSid23960x1402fea80
      RtlSubAuthoritySid23970x1402fea90
      RtlSubtreePredecessor23980x140330990
      RtlSubtreeSuccessor23990x140586bb0
      RtlSuffixUnicodeString24000x14090d340
      RtlSystemTimeToLocalTime24010x1407bc710
      RtlTestBit24020x140333630
      RtlTestBitEx24030x14036b1d0
      RtlTimeFieldsToTime24040x140341850
      RtlTimeToElapsedTimeFields24050x14090d7f0
      RtlTimeToSecondsSince197024060x140580280
      RtlTimeToSecondsSince198024070x140392d60
      RtlTimeToTimeFields24080x14036c790
      RtlTraceDatabaseAdd24090x1405897b0
      RtlTraceDatabaseCreate24100x140589810
      RtlTraceDatabaseDestroy24110x140589980
      RtlTraceDatabaseEnumerate24120x1405899d0
      RtlTraceDatabaseFind24130x140589aa0
      RtlTraceDatabaseLock24140x140589b10
      RtlTraceDatabaseUnlock24150x140589b30
      RtlTraceDatabaseValidate24160x140589b50
      RtlUTF8StringToUnicodeString24170x140916e70
      RtlUTF8ToUnicodeN24180x140705ae0
      RtlUdiv12824190x1403ad4d0
      RtlUnicodeStringToAnsiSize24200x140749920
      RtlUnicodeStringToAnsiString24210x1405e6c60
      RtlUnicodeStringToCountedOemString24220x1406e5620
      RtlUnicodeStringToInt6424230x140912680
      RtlUnicodeStringToInteger24240x1406d6f10
      RtlUnicodeStringToOemSize24250x1406e5a80
      RtlUnicodeStringToOemString24260x1406e5470
      RtlUnicodeStringToUTF8String24270x140916f70
      RtlUnicodeToCustomCPN24280x14090e2c0
      RtlUnicodeToMultiByteN24290x1405e6fa0
      RtlUnicodeToMultiByteSize24300x1405e6de0
      RtlUnicodeToOemN24310x1406e5ab0
      RtlUnicodeToUTF8N24320x140709260
      RtlUnlockBootStatusData24330x14077bb00
      RtlUnregisterFeatureConfigurationChangeNotification24340x140916760
      RtlUnsignedMultiplyHigh24350x1403f2a70
      RtlUnwind24360x14035e220
      RtlUnwindEx24370x1402e71b0
      RtlUpcaseUnicodeChar24380x140609dc0
      RtlUpcaseUnicodeString24390x1406b9230
      RtlUpcaseUnicodeStringToAnsiString24400x14090d3e0
      RtlUpcaseUnicodeStringToCountedOemString24410x1406e5890
      RtlUpcaseUnicodeStringToOemString24420x1406e5530
      RtlUpcaseUnicodeToCustomCPN24430x14090e3f0
      RtlUpcaseUnicodeToMultiByteN24440x1405e7040
      RtlUpcaseUnicodeToOemN24450x1406e59e0
      RtlUpperChar24460x1405e6770
      RtlUpperString24470x1405e7470
      RtlValidAcl24480x14067f680
      RtlValidRelativeSecurityDescriptor24490x14063f710
      RtlValidSecurityDescriptor24500x1406ddde0
      RtlValidSid24510x14067f7e0
      RtlValidateCorrelationVector24520x140913960
      RtlValidateUnicodeString24530x1402ff5b0
      RtlVerifyVersionInfo24540x14037b8d0
      RtlVirtualUnwind24550x1402e7140
      RtlVolumeDeviceToDosName24560x1406624a0
      RtlWalkFrameChain24570x1402e7910
      RtlWeaklyEnumerateEntryHashTable24580x140583a40
      RtlWriteNonVolatileMemory24590x140587da0
      RtlWriteRegistryValue24600x140705130
      RtlZeroHeap24610x140913030
      RtlZeroMemory24620x14036b1b0
      RtlxAnsiStringToUnicodeSize24630x14063dfb0
      RtlxOemStringToUnicodeSize24640x14074f4b0
      RtlxUnicodeStringToAnsiSize24650x140749920
      RtlxUnicodeStringToOemSize24660x1406e5a80
      SeAccessCheck24670x14029ab60
      SeAccessCheckEx24680x140370e20
      SeAccessCheckFromState24690x14027dc60
      SeAccessCheckFromStateEx24700x14027dd70
      SeAccessCheckWithHint24710x14029be30
      SeAdjustAccessStateForAccessConstraints24720x1406294e0
      SeAdjustAccessStateForTrustLabel24730x14091a3f0
      SeAdjustObjectSecurity24740x140715520
      SeAppendPrivileges24750x1406de4a0
      SeAssignSecurity24760x14069d9d0
      SeAssignSecurityEx24770x1406f2aa0
      SeAuditFipsCryptoSelftests24780x14091afa0
      SeAuditHardLinkCreation24790x14091b340
      SeAuditHardLinkCreationWithTransaction24800x14091b360
      SeAuditTransactionStateChange24810x14091bc20
      SeAuditingAnyFileEventsWithContext24820x14091de40
      SeAuditingAnyFileEventsWithContextEx24830x140297db0
      SeAuditingFileEvents24840x14091de60
      SeAuditingFileEventsWithContext24850x14091dea0
      SeAuditingFileEventsWithContextEx24860x140591cb0
      SeAuditingFileOrGlobalEvents24870x14091dec0
      SeAuditingHardLinkEvents24880x14091dfb0
      SeAuditingHardLinkEventsWithContext24890x140702410
      SeAuditingWithTokenForSubcategory24900x140619e80
      SeCaptureSecurityDescriptor24910x14067ec20
      SeCaptureSubjectContext24920x1406953a0
      SeCaptureSubjectContextEx24930x14067be40
      SeCheckForCriticalAceRemoval24940x14063f950
      SeCloseObjectAuditAlarm24950x14091e980
      SeCloseObjectAuditAlarmForNonObObject24960x14091e9f0
      SeCompareSigningLevels24970x14076e260
      SeComputeAutoInheritByObjectType24980x14034d8c0
      SeConvertSecurityDescriptorToStringSecurityDescriptor24990x140271fb0
      SeConvertSidToStringSid25000x140592ed0
      SeConvertStringSecurityDescriptorToSecurityDescriptor25010x14039bab0
      SeConvertStringSidToSid25020x1403bd8a0
      SeCreateAccessState25030x140669830
      SeCreateAccessStateEx25040x140669880
      SeCreateClientSecurity25050x1406830b0
      SeCreateClientSecurityEx25060x1406832a0
      SeCreateClientSecurityFromSubjectContext25070x14070dad0
      SeCreateClientSecurityFromSubjectContextEx25080x140591f80
      SeDeassignSecurity25090x1406f1d70
      SeDeleteAccessState25100x14067b180
      SeDeleteObjectAuditAlarm25110x14091ea20
      SeDeleteObjectAuditAlarmWithTransaction25120x14091ea40
      SeEtwWriteKMCveEvent25130x1405a5370
      SeExamineSacl25140x14091eab0
      SeExports25150x140d2d6b8
      SeFilterToken25160x140783180
      SeFreePrivileges25170x1402029c0
      SeGetCachedSigningLevel25180x1406f1290
      SeGetLinkedToken25190x14091ff20
      SeGetLogonSessionToken25200x140920040
      SeILSigningPolicyPtr25210x140c0eef8
      SeImpersonateClient25220x14091fce0
      SeImpersonateClientEx25230x1406cc050
      SeIsParentOfChildAppContainer25240x140919f00
      SeLocateProcessImageName25250x1406b9330
      SeLockSubjectContext25260x1405f4910
      SeMarkLogonSessionForTerminationNotification25270x140712350
      SeMarkLogonSessionForTerminationNotificationEx25280x140712370
      SeOpenObjectAuditAlarm25290x1406de440
      SeOpenObjectAuditAlarmForNonObObject25300x1407c1340
      SeOpenObjectAuditAlarmWithTransaction25310x1405ed7b0
      SeOpenObjectForDeleteAuditAlarm25320x14091ee40
      SeOpenObjectForDeleteAuditAlarmWithTransaction25330x14091eea0
      SePrivilegeCheck25340x140694050
      SePrivilegeObjectAuditAlarm25350x14068e430
      SePublicDefaultDacl25360x140d2d808
      SeQueryAuthenticationIdToken25370x1406ecf20
      SeQueryInformationToken25380x140694350
      SeQuerySecureBootPlatformManifest25390x140921780
      SeQuerySecureBootPolicyValue25400x1407c3e60
      SeQuerySecurityAttributesToken25410x140618780
      SeQuerySecurityAttributesTokenAccessInformation25420x140350440
      SeQuerySecurityDescriptorInfo25430x1405e5860
      SeQueryServerSiloToken25440x140700840
      SeQuerySessionIdToken25450x1406e3c20
      SeQuerySessionIdTokenEx25460x1405d8a60
      SeRegisterImageVerificationCallback25470x1407c3280
      SeRegisterLogonSessionTerminatedRoutine25480x140920b10
      SeRegisterLogonSessionTerminatedRoutineEx25490x1407bfb90
      SeReleaseSecurityDescriptor25500x140629420
      SeReleaseSubjectContext25510x140696160
      SeReportSecurityEvent25520x140591b60
      SeReportSecurityEventWithSubCategory25530x14026a880
      SeSecurityAttributePresent25540x1402965f0
      SeSetAccessStateGenericMapping25550x140679020
      SeSetAuditParameter25560x14033b3f0
      SeSetSecurityAttributesToken25570x140919fd0
      SeSetSecurityAttributesTokenEx25580x140592440
      SeSetSecurityDescriptorInfo25590x14066a9b0
      SeSetSecurityDescriptorInfoEx25600x140703210
      SeSetSessionIdTokenWithLinked25610x140919ff0
      SeShouldCheckForAccessRightsFromParent25620x140629630
      SeSinglePrivilegeCheck25630x1406689b0
      SeSrpAccessCheck25640x140590e00
      SeSystemDefaultDacl25650x140d2d818
      SeSystemDefaultSd25660x140d2daf0
      SeTokenFromAccessInformation25670x14035c5d0
      SeTokenImpersonationLevel25680x140755b60
      SeTokenIsAdmin25690x140627a60
      SeTokenIsRestricted25700x14026d760
      SeTokenIsWriteRestricted25710x14026d740
      SeTokenObjectType25720x140d2c028
      SeTokenType25730x140650670
      SeUnlockSubjectContext25740x1405f4970
      SeUnregisterImageVerificationCallback25750x140919650
      SeUnregisterLogonSessionTerminatedRoutine25760x140920bb0
      SeUnregisterLogonSessionTerminatedRoutineEx25770x140920c80
      SeValidSecurityDescriptor25780x1406e3790
      SkAcquirePushLockExclusive25790x14057dc20
      SkAllocatePool25800x14057dc20
      SkFreePool25810x14057dc20
      SkInitializePushLock25820x14057dc20
      SkIsSecureKernel25830x1403cd000
      SkQuerySecureKernelInformation25840x14057dc20
      SkReleasePushLockExclusive25850x14057dc20
      TmCancelPropagationRequest25860x1403cd720
      TmCommitComplete25870x1403cd740
      TmCommitEnlistment25880x1403cd760
      TmCommitTransaction25890x1403cd780
      TmCreateEnlistment25900x1403cd7a0
      TmCurrentTransaction25910x1403cd7c0
      TmDereferenceEnlistmentKey25920x1403cd7e0
      TmEnableCallbacks25930x1403cd800
      TmEndPropagationRequest25940x1403cd820
      TmEnlistmentObjectType25950x140cfbc60
      TmFreezeTransactions25960x1403cd840
      TmGetTransactionId25970x1403cd860
      TmInitSystem25980x1403cd2a0
      TmInitSystemPhase225990x1403cd280
      TmInitializeTransactionManager26000x1403cd880
      TmIsKTMCommitCoordinator26010x1403cd8a0
      TmIsTransactionActive26020x1403cd8c0
      TmPrePrepareComplete26030x1403cd8e0
      TmPrePrepareEnlistment26040x1403cd900
      TmPrepareComplete26050x1403cd920
      TmPrepareEnlistment26060x1403cd940
      TmPropagationComplete26070x1403cd960
      TmPropagationFailed26080x1403cd980
      TmReadOnlyEnlistment26090x1403cd9a0
      TmRecoverEnlistment26100x1403cd9c0
      TmRecoverResourceManager26110x1403cd9e0
      TmRecoverTransactionManager26120x1403cda00
      TmReferenceEnlistmentKey26130x1403cda20
      TmRenameTransactionManager26140x1403cda40
      TmRequestOutcomeEnlistment26150x1403cda60
      TmResourceManagerObjectType26160x140cfbb20
      TmRollbackComplete26170x1403cda80
      TmRollbackEnlistment26180x1403cdaa0
      TmRollbackTransaction26190x1403cdac0
      TmSetCurrentTransaction26200x1403cdae0
      TmSinglePhaseReject26210x1403cdb00
      TmThawTransactions26220x1403cdb20
      TmTransactionManagerObjectType26230x140cfbb18
      TmTransactionObjectType26240x140cfb790
      TtmNotifyDeviceArrival26250x1408f9320
      TtmNotifyDeviceDeparture26260x1408f9620
      TtmNotifyDeviceInput26270x1408f96e0
      VerSetConditionMask26280x14037d3c0
      VfCheckNxPagePriority26290x14059b640
      VfCheckNxPageProtection26300x14059b660
      VfCheckNxPoolType26310x14059b680
      VfFailDeviceNode26320x1403a4720
      VfFailDriver26330x14059b6a0
      VfFailSystemBIOS26340x14059b6d0
      VfInsertContext26350x14059b710
      VfIsRuleClassEnabled26360x1409c4020
      VfIsVerificationEnabled26370x1403a4760
      VfQueryDeviceContext26380x14059b7e0
      VfQueryDispatchTable26390x14059ba80
      VfQueryDriverContext26400x14059b820
      VfQueryIrpContext26410x14059b860
      VfQueryThreadContext26420x14059b8a0
      VfRemoveContext26430x14059b8e0
      VslCreateSecureSection26440x14088cb30
      VslDeleteSecureSection26450x14088cf50
      VslExchangeEntropy26460x140398450
      VslGetSecurePciDeviceAlternateFunctionNumberForVtl0Dma26470x1404f76d0
      VslGetSecurePciEnabled26480x1403cc810
      VslQuerySecureDevice26490x1407b7ca0
      VslRetrieveMailbox26500x1404f8560
      WheaAddErrorSource26510x140798910
      WheaAddErrorSourceDeviceDriver26520x140798740
      WheaAddErrorSourceDeviceDriverV126530x1403b7a20
      WheaAddHwErrorReportSectionDeviceDriver26540x1405b6a90
      WheaAttemptClearPoison26550x14095a860
      WheaAttemptPhysicalPageOffline26560x14095a920
      WheaConfigureErrorSource26570x14099dab0
      WheaCreateHwErrorReportDeviceDriver26580x1405b6b90
      WheaDeferredRecoveryService26590x1405b7e30
      WheaGetErrorSource26600x1405b5ed0
      WheaHighIrqlLogSelEventHandlerRegister26610x1405b8140
      WheaHighIrqlLogSelEventHandlerUnregister26620x1405b81b0
      WheaHwErrorReportAbandonDeviceDriver26630x1405b6bc0
      WheaHwErrorReportGetLogDataBufferDeviceDriver26640x1405b6bf0
      WheaHwErrorReportMarkAsCriticalDeviceDriver26650x1405b6c40
      WheaHwErrorReportSetFatalSeverityDeviceDriver26660x1405b6c70
      WheaHwErrorReportSetSectionNameDeviceDriver26670x1405b6cd0
      WheaHwErrorReportSetSeverityDeviceDriver26680x1405b6d20
      WheaHwErrorReportSubmitDeviceDriver26690x1405b6d60
      WheaInitializeDeferredRecoveryObject26700x1405b7e70
      WheaInitializeRecordHeader26710x1405b77e0
      WheaLogInternalEvent26720x1403b7aa0
      WheaRegisterInUsePageOfflineNotification26730x14095a9f0
      WheaRemoveErrorSource26740x14095a510
      WheaRemoveErrorSourceDeviceDriver26750x14095a6e0
      WheaReportFatalHwErrorDeviceDriverEx26760x1405b6e70
      WheaReportHwError26770x1405b5f00
      WheaReportHwErrorDeviceDriver26780x14095a810
      WheaReportHwErrorDeviceDriverEx26790x1405b6f90
      WheaRequestDeferredRecovery26800x1405b7e90
      WheaUnconfigureErrorSource26810x1409b1900
      WheaUnregisterInUsePageOfflineNotification26820x14095ab70
      WmiGetClock26830x1405a1620
      WmiQueryTraceInformation26840x140777ed0
      WmiTraceMessage26850x14035d6f0
      WmiTraceMessageVa26860x1405a1690
      XIPDispatch26870x1405b45e0
      ZwAccessCheckAndAuditAlarm26880x1403f4020
      ZwAddBootEntry26890x1403f4840
      ZwAddDriverEntry26900x1403f4860
      ZwAdjustPrivilegesToken26910x1403f4320
      ZwAlertThread26920x1403f48e0
      ZwAllocateLocallyUniqueId26930x1403f4920
      ZwAllocateReserveObject26940x1403f4940
      ZwAllocateVirtualMemory26950x1403f3e00
      ZwAllocateVirtualMemoryEx26960x1403f49c0
      ZwAlpcAcceptConnectPort26970x1403f49e0
      ZwAlpcCancelMessage26980x1403f4a00
      ZwAlpcConnectPort26990x1403f4a20
      ZwAlpcConnectPortEx27000x1403f4a40
      ZwAlpcCreatePort27010x1403f4a60
      ZwAlpcCreatePortSection27020x1403f4a80
      ZwAlpcCreateResourceReserve27030x1403f4aa0
      ZwAlpcCreateSectionView27040x1403f4ac0
      ZwAlpcCreateSecurityContext27050x1403f4ae0
      ZwAlpcDeletePortSection27060x1403f4b00
      ZwAlpcDeleteResourceReserve27070x1403f4b20
      ZwAlpcDeleteSectionView27080x1403f4b40
      ZwAlpcDeleteSecurityContext27090x1403f4b60
      ZwAlpcDisconnectPort27100x1403f4b80
      ZwAlpcOpenSenderProcess27110x1403f4be0
      ZwAlpcOpenSenderThread27120x1403f4c00
      ZwAlpcQueryInformation27130x1403f4c20
      ZwAlpcQueryInformationMessage27140x1403f4c40
      ZwAlpcSendWaitReceivePort27150x1403f4c80
      ZwAlpcSetInformation27160x1403f4ca0
      ZwAssignProcessToJobObject27170x1403f4ce0
      ZwAssociateWaitCompletionPacket27180x1403f4d00
      ZwCancelIoFile27190x1403f46a0
      ZwCancelIoFileEx27200x1403f4d40
      ZwCancelTimer27210x1403f4720
      ZwCancelWaitCompletionPacket27220x1403f4da0
      ZwClearEvent27230x1403f42c0
      ZwClose27240x1403f3ce0
      ZwCloseObjectAuditAlarm27250x1403f4260
      ZwCommitComplete27260x1403f4dc0
      ZwCommitEnlistment27270x1403f4de0
      ZwCommitRegistryTransaction27280x1403f4e00
      ZwCommitTransaction27290x1403f4e20
      ZwCompareTokens27300x1403f4ea0
      ZwConnectPort27310x1403f4f00
      ZwCreateCrossVmEvent27320x1403f4f60
      ZwCreateDirectoryObject27330x1403f4fc0
      ZwCreateEnlistment27340x1403f5020
      ZwCreateEvent27350x1403f4400
      ZwCreateFile27360x1403f45a0
      ZwCreateIoCompletion27370x1403f5080
      ZwCreateJobObject27380x1403f50a0
      ZwCreateKey27390x1403f3ea0
      ZwCreateKeyTransacted27400x1403f50e0
      ZwCreatePartition27410x1403f51c0
      ZwCreateProcessEx27420x1403f44a0
      ZwCreateProfileEx27430x1403f5260
      ZwCreateRegistryTransaction27440x1403f5280
      ZwCreateResourceManager27450x1403f52a0
      ZwCreateSection27460x1403f4440
      ZwCreateSymbolicLinkObject27470x1403f5300
      ZwCreateTimer27480x1403f5340
      ZwCreateTransaction27490x1403f53c0
      ZwCreateTransactionManager27500x1403f53e0
      ZwCreateWaitCompletionPacket27510x1403f5420
      ZwCreateWnfStateName27520x1403f5460
      ZwDeleteBootEntry27530x1403f5500
      ZwDeleteDriverEntry27540x1403f5520
      ZwDeleteFile27550x1403f5540
      ZwDeleteKey27560x1403f5560
      ZwDeleteValueKey27570x1403f55c0
      ZwDeleteWnfStateData27580x1403f55e0
      ZwDeleteWnfStateName27590x1403f5600
      ZwDeviceIoControlFile27600x1403f3be0
      ZwDisplayString27610x1403f5660
      ZwDuplicateObject27620x1403f4280
      ZwDuplicateToken27630x1403f4340
      ZwEnumerateBootEntries27640x1403f56c0
      ZwEnumerateDriverEntries27650x1403f56e0
      ZwEnumerateKey27660x1403f4140
      ZwEnumerateTransactionObject27670x1403f5720
      ZwEnumerateValueKey27680x1403f3d60
      ZwFlushBuffersFile27690x1403f4460
      ZwFlushBuffersFileEx27700x1403f57c0
      ZwFlushInstructionCache27710x1403f5800
      ZwFlushKey27720x1403f5820
      ZwFlushVirtualMemory27730x1403f5860
      ZwFreeVirtualMemory27740x1403f3ec0
      ZwFsControlFile27750x1403f4220
      ZwGetCachedSigningLevel27760x1403f5900
      ZwGetNextProcess27770x1403f59e0
      ZwGetNextThread27780x1403f5a00
      ZwGetNotificationResourceManager27790x1403f5a40
      ZwGetWriteWatch27800x1403f5a60
      ZwImpersonateAnonymousToken27810x1403f5a80
      ZwInitiatePowerAction27820x1403f5b20
      ZwIsProcessInJob27830x1403f44e0
      ZwLoadDriver27840x1403f5ba0
      ZwLoadKey27850x1403f5be0
      ZwLoadKeyEx27860x1403f5c20
      ZwLockFile27870x1403f5c40
      ZwLockProductActivationKeys27880x1403f5c60
      ZwLockVirtualMemory27890x1403f5ca0
      ZwMakeTemporaryObject27900x1403f5ce0
      ZwManagePartition27910x1403f5d20
      ZwMapViewOfSection27920x1403f4000
      ZwModifyBootEntry27930x1403f5da0
      ZwModifyDriverEntry27940x1403f5dc0
      ZwNotifyChangeDirectoryFile27950x1403f5de0
      ZwNotifyChangeDirectoryFileEx27960x1403f5e00
      ZwNotifyChangeKey27970x1403f5e20
      ZwNotifyChangeSession27980x1403f5e60
      ZwOpenDirectoryObject27990x1403f4600
      ZwOpenEnlistment28000x1403f5e80
      ZwOpenEvent28010x1403f4300
      ZwOpenFile28020x1403f4160
      ZwOpenJobObject28030x1403f5ee0
      ZwOpenKey28040x1403f3d40
      ZwOpenKeyEx28050x1403f5f00
      ZwOpenKeyTransacted28060x1403f5f20
      ZwOpenKeyTransactedEx28070x1403f5f40
      ZwOpenPartition28080x1403f5fc0
      ZwOpenProcess28090x1403f3fc0
      ZwOpenProcessToken28100x1403f6000
      ZwOpenProcessTokenEx28110x1403f4100
      ZwOpenRegistryTransaction28120x1403f6020
      ZwOpenResourceManager28130x1403f6040
      ZwOpenSection28140x1403f41e0
      ZwOpenSession28150x1403f6080
      ZwOpenSymbolicLinkObject28160x1403f60a0
      ZwOpenThread28170x1403f60c0
      ZwOpenThreadToken28180x1403f3f80
      ZwOpenThreadTokenEx28190x1403f40e0
      ZwOpenTimer28200x1403f60e0
      ZwOpenTransaction28210x1403f6100
      ZwOpenTransactionManager28220x1403f6120
      ZwPowerInformation28230x1403f46e0
      ZwPrePrepareComplete28240x1403f6160
      ZwPrePrepareEnlistment28250x1403f6180
      ZwPrepareComplete28260x1403f61a0
      ZwPrepareEnlistment28270x1403f61c0
      ZwPropagationComplete28280x1403f6240
      ZwPropagationFailed28290x1403f6260
      ZwProtectVirtualMemory28300x1403f4500
      ZwPulseEvent28310x1403f62a0
      ZwQueryBootEntryOrder28320x1403f62e0
      ZwQueryBootOptions28330x1403f6300
      ZwQueryDefaultLocale28340x1403f3da0
      ZwQueryDefaultUILanguage28350x1403f4380
      ZwQueryDirectoryFile28360x1403f41a0
      ZwQueryDirectoryFileEx28370x1403f6340
      ZwQueryDirectoryObject28380x1403f6360
      ZwQueryDriverEntryOrder28390x1403f6380
      ZwQueryEaFile28400x1403f63a0
      ZwQueryFullAttributesFile28410x1403f63c0
      ZwQueryInformationByName28420x1403f6400
      ZwQueryInformationEnlistment28430x1403f6420
      ZwQueryInformationFile28440x1403f3d20
      ZwQueryInformationJobObject28450x1403f6440
      ZwQueryInformationProcess28460x1403f3e20
      ZwQueryInformationResourceManager28470x1403f6480
      ZwQueryInformationThread28480x1403f3fa0
      ZwQueryInformationToken28490x1403f3f20
      ZwQueryInformationTransaction28500x1403f64a0
      ZwQueryInformationTransactionManager28510x1403f64c0
      ZwQueryInstallUILanguage28520x1403f6500
      ZwQueryIntervalProfile28530x1403f6520
      ZwQueryKey28540x1403f3dc0
      ZwQueryLicenseValue28550x1403f6560
      ZwQueryObject28560x1403f3d00
      ZwQueryQuotaInformationFile28570x1403f6620
      ZwQuerySection28580x1403f4520
      ZwQuerySecurityAttributesToken28590x1403f6640
      ZwQuerySecurityObject28600x1403f6660
      ZwQuerySymbolicLinkObject28610x1403f66c0
      ZwQuerySystemEnvironmentValueEx28620x1403f6700
      ZwQuerySystemInformation28630x1403f41c0
      ZwQuerySystemInformationEx28640x1403f6720
      ZwQueryTimerResolution28650x1403f6740
      ZwQueryValueKey28660x1403f3de0
      ZwQueryVirtualMemory28670x1403f3f60
      ZwQueryVolumeInformationFile28680x1403f4420
      ZwQueryWnfStateData28690x1403f6760
      ZwQueryWnfStateNameInformation28700x1403f6780
      ZwReadFile28710x1403f3bc0
      ZwReadOnlyEnlistment28720x1403f6800
      ZwRecoverEnlistment28730x1403f6820
      ZwRecoverResourceManager28740x1403f6840
      ZwRecoverTransactionManager28750x1403f6860
      ZwRemoveIoCompletion28760x1403f3c20
      ZwRemoveIoCompletionEx28770x1403f6900
      ZwRenameKey28780x1403f6940
      ZwReplaceKey28790x1403f6980
      ZwRequestPort28800x1403f69e0
      ZwRequestWaitReplyPort28810x1403f3f40
      ZwResetEvent28820x1403f6a00
      ZwResetWriteWatch28830x1403f6a20
      ZwRestoreKey28840x1403f6a40
      ZwRollbackComplete28850x1403f6aa0
      ZwRollbackEnlistment28860x1403f6ac0
      ZwRollbackRegistryTransaction28870x1403f6ae0
      ZwRollbackTransaction28880x1403f6b00
      ZwSaveKey28890x1403f6b40
      ZwSaveKeyEx28900x1403f6b60
      ZwSecureConnectPort28910x1403f6ba0
      ZwSetBootEntryOrder28920x1403f6be0
      ZwSetBootOptions28930x1403f6c00
      ZwSetCachedSigningLevel28940x1403f6c20
      ZwSetDefaultLocale28950x1403f6cc0
      ZwSetDefaultUILanguage28960x1403f6ce0
      ZwSetDriverEntryOrder28970x1403f6d00
      ZwSetEaFile28980x1403f6d20
      ZwSetEvent28990x1403f3cc0
      ZwSetInformationEnlistment29000x1403f6dc0
      ZwSetInformationFile29010x1403f3fe0
      ZwSetInformationJobObject29020x1403f6de0
      ZwSetInformationKey29030x1403f6e00
      ZwSetInformationObject29040x1403f4680
      ZwSetInformationProcess29050x1403f3e80
      ZwSetInformationResourceManager29060x1403f6e20
      ZwSetInformationThread29070x1403f3ca0
      ZwSetInformationToken29080x1403f6e60
      ZwSetInformationTransaction29090x1403f6e80
      ZwSetInformationVirtualMemory29100x1403f6ec0
      ZwSetIntervalProfile29110x1403f6f00
      ZwSetIoCompletion29120x1403f6f20
      ZwSetIoCompletionEx29130x1403f6f40
      ZwSetQuotaInformationFile29140x1403f6fc0
      ZwSetSecurityObject29150x1403f6fe0
      ZwSetSystemEnvironmentValueEx29160x1403f7020
      ZwSetSystemInformation29170x1403f7040
      ZwSetSystemTime29180x1403f7080
      ZwSetTimer29190x1403f4740
      ZwSetTimerEx29200x1403f70e0
      ZwSetTimerResolution29210x1403f7100
      ZwSetValueKey29220x1403f4700
      ZwSetVolumeInformationFile29230x1403f7140
      ZwStartProfile29240x1403f7200
      ZwStopProfile29250x1403f7220
      ZwSystemDebugControl29260x1403f72a0
      ZwTerminateJobObject29270x1403f72e0
      ZwTerminateProcess29280x1403f4080
      ZwTraceControl29290x1403f7360
      ZwTraceEvent29300x1403f46c0
      ZwTranslateFilePath29310x1403f7380
      ZwUnloadDriver29320x1403f73c0
      ZwUnloadKey29330x1403f73e0
      ZwUnloadKey229340x1403f7400
      ZwUnloadKeyEx29350x1403f7420
      ZwUnlockFile29360x1403f7440
      ZwUnlockVirtualMemory29370x1403f7460
      ZwUnmapViewOfSection29380x1403f4040
      ZwUpdateWnfStateData29390x1403f74c0
      ZwWaitForMultipleObjects29400x1403f4660
      ZwWaitForSingleObject29410x1403f3b80
      ZwWriteFile29420x1403f3c00
      ZwYieldExecution29430x1403f43c0
      __C_specific_handler29440x1403cd050
      __chkstk29450x1404000a0
      __misaligned_access29460x140398330
      _finite29470x1403ce570
      _i64toa_s29480x1403d3540
      _i64tow_s29490x1403d3840
      _itoa29500x1403ce5b0
      _itoa_s29510x1403d3570
      _itow29520x1403ce660
      _itow_s29530x1403d3870
      _local_unwind29540x1403ce750
      _ltoa_s29550x1403d3570
      _ltow_s29560x1403d3870
      _makepath_s29570x1403d3b60
      _purecall29580x1405b2000
      _setjmp29590x1404012a0
      _setjmpex29600x140401360
      _snprintf29610x1403ce790
      _snprintf_s29620x1403d3cb0
      _snscanf_s29630x1403d3d80
      _snwprintf29640x1403ce850
      _snwprintf_s29650x1403d3dc0
      _snwscanf_s29660x1403d3ea0
      _splitpath_s29670x1403d3ee0
      _stricmp29680x1403ce990
      _strlwr29690x1403ce9b0
      _strnicmp29700x1403cea40
      _strnset29710x1403cea60
      _strnset_s29720x1403d4180
      _strrev29730x1403cea80
      _strset29740x1403ceac0
      _strset_s29750x1403d4210
      _strtoui6429760x1403ce410
      _strupr29770x1403cdbe0
      _swprintf29780x1403ceae0
      _ui64toa_s29790x1403d35a0
      _ui64tow_s29800x1403d38a0
      _ultoa_s29810x1403d35c0
      _ultow_s29820x1403d38c0
      _vsnprintf29830x1403cdd50
      _vsnprintf_s29840x1403d3ce0
      _vsnwprintf29850x1403cdc30
      _vsnwprintf_s29860x1403d3df0
      _vswprintf29870x1403cebb0
      _wcsicmp29880x1403cec90
      _wcslwr29890x1403cecf0
      _wcslwr_s29900x1403ced50
      _wcsnicmp29910x1403cedd0
      _wcsnset29920x1403cee40
      _wcsnset_s29930x1403cee70
      _wcsrev29940x1403cef00
      _wcsset_s29950x1403cef50
      _wcsupr29960x1403cefb0
      _wmakepath_s29970x1403d4270
      _wsplitpath_s29980x1403d43f0
      _wtoi29990x1403ceff0
      _wtol30000x1403cf010
      atoi30010x1403ce4c0
      atol30020x1403ce4e0
      bsearch30030x1403cf040
      bsearch_s30040x1403cf150
      isdigit30050x1403cf290
      islower30060x1403cf2c0
      isprint30070x1403cf2f0
      isspace30080x1403cf320
      isupper30090x1403cf350
      iswalnum30100x1403cf3b0
      iswdigit30110x1403cf3f0
      iswspace30120x1403cf410
      isxdigit30130x1403cf380
      longjmp30140x1403cd230
      mbstowcs30150x1403cf430
      mbtowc30160x1403cf510
      memchr30170x1403cf570
      memcmp30180x1403cf5a0
      memcpy30190x14040a4c0
      memcpy_s30200x1403d46b0
      memmove30210x14040a4c0
      memmove_s30220x1403d4750
      memset30230x14040a780
      psMUITest30240x140d2db80
      qsort30250x1403cf680
      qsort_s30260x1403cfa60
      rand30270x1403cfe70
      sprintf30280x1403cfeb0
      sprintf_s30290x1403d47b0
      sqrt30300x1403cff50
      sqrtf30310x1403d0060
      srand30320x1403cfea0
      sscanf_s30330x1403d4830
      strcat30340x1403d0150
      strcat_s30350x1403d4890
      strchr30360x1403d02b0
      strcmp30370x1403d02f0
      strcpy30380x1403d01f0
      strcpy_s30390x1403d4930
      strlen30400x1403d03b0
      strncat30410x1403d0470
      strncat_s30420x1403d49c0
      strncmp30430x1403ce100
      strncpy30440x1403d0620
      strncpy_s30450x1403d4ad0
      strnlen30460x1403d0790
      strrchr30470x1403d07b0
      strspn30480x1403d07e0
      strstr30490x1403ce440
      strtok_s30500x1403d4bc0
      swprintf30510x1403ceae0
      swprintf_s30520x1403d34b0
      swscanf_s30530x1403d4d30
      tolower30540x1403d08b0
      toupper30550x1403d08f0
      towlower30560x1403d0960
      towupper30570x1403d0990
      vDbgPrintEx30580x140361460
      vDbgPrintExWithPrefix30590x1405808f0
      vsprintf30600x1403d0a40
      vsprintf_s30610x1403d47e0
      vswprintf_s30620x1403d34e0
      wcscat30630x1403d0a60
      wcscat_s30640x1403d4d90
      wcschr30650x1403d0ad0
      wcscmp30660x1403d0b00
      wcscpy30670x1403d0aa0
      wcscpy_s30680x1403d4e30
      wcscspn30690x1403d0b40
      wcslen30700x1403d0b90
      wcsncat30710x1403d0bb0
      wcsncat_s30720x1403d4ec0
      wcsncmp30730x1403d0c00
      wcsncpy30740x1403d0c40
      wcsncpy_s30750x1403d4fe0
      wcsnlen30760x1403d0c90
      wcsrchr30770x1403d0cc0
      wcsspn30780x1403d0d00
      wcsstr30790x1403d0d50
      wcstombs30800x1403d0dc0
      wcstoul30810x1403d10c0
      wctomb30820x1403d11b0
      x86BiosAllocateBuffer30830x1403c8490
      x86BiosCall30840x140393c90
      x86BiosFreeBuffer30850x1403c84e0
      x86BiosReadMemory30860x1403bc930
      x86BiosWriteMemory30870x1403c1d40
      DescriptionData
      LegalCopyright Microsoft Corporation. All rights reserved.
      InternalNamentkrnlmp.exe
      FileVersion10.0.19041.1566 (WinBuild.160101.0800)
      CompanyNameMicrosoft Corporation
      ProductNameMicrosoft Windows Operating System
      ProductVersion10.0.19041.1566
      FileDescriptionNT Kernel & System
      OriginalFilenamentkrnlmp.exe
      Translation0x0409 0x04b0
      Language of compilation systemCountry where language is spokenMap
      EnglishUnited States
      No network behavior found
      051015s020406080100

      Click to jump to process

      051015sMB

      Click to jump to process

      Target ID:1
      Start time:11:43:35
      Start date:22/02/2022
      Path:C:\Users\user\Desktop\ntoskrnl.exe
      Wow64 process (32bit):false
      Commandline:"C:\Users\user\Desktop\ntoskrnl.exe"
      Imagebase:0x7ff65ba30000
      File size:10849616 bytes
      MD5 hash:199605859B1306A64E9A157E36868C5A
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:C, C++ or other language
      Reputation:low

      No disassembly