KiRaiseIrqlToXxxLevel CcPinFileData CcPinRead CcFreeVirtualAddress CcFastCopyRead CcPinMappedData CcMdlRead CcPrepareMdlWrite CcMapAndCopy CcFreeActiveVacb ObfDereferenceObject PsAssignImpersonationToken NtClose MmCheckCachedPageState MmProbeAndLockPages MiFlushSectionInternal CcSetDirtyPinnedData CcPreparePinWrite CcReleaseByteRangeFromWrite CmpInitializeMachineDependentConfiguration _amsg_exit _isctype __C_ExecuteTerminationHandler __C_ExecuteExceptionFilter PspDeleteLdt PsIsThreadTerminating PoSetDeviceIdleDetection PoQueryPowerSequence RtlNumberGenericTableElements RtlCaptureStackBackTrace RtlAssert RtlpDestroyLockAtomTable MmIsThisAnNtAsSystem MmQuerySystemSize KiSuspendNop KeSwitchFrozenProcessor KiFreezeTargetExecution ZwYieldExecution ZwWriteVirtualMemory ZwWriteFile ZwWaitForSingleObject ZwWaitForMultipleObjects ZwUnmapViewOfSection ZwUnloadKey ZwUnloadDriver ZwTerminateProcess ZwShutdownSystem ZwSetValueKey ZwSetTimerResolution ZwSetSystemTime ZwSetSystemInformation ZwSetSecurityObject ZwSetInformationThread ZwSetInformationProcess ZwSetInformationObject ZwSetInformationFile ZwSetEvent ZwSetDefaultLocale ZwSaveKey ZwResumeThread ZwRestoreKey ZwResetEvent ZwRequestWaitReplyPort ZwReplyWaitReceivePort ZwReplaceKey ZwReleaseSemaphore ZwReadFile ZwRaiseHardError CcUnpinFileData CcGetDirtyPages KeWaitForSingleObject CcCanIWrite ExAcquireFastMutexUnsafe ExAcquireHandleTableShared ExAcquireHandleTableExclusive KdPollBreakIn KeInsertQueue IopCompleteRequest ExQueueWorkItem KiSwapThread CcFlushCache IopDeleteFile CcInitializeCacheMap CcSetDirtyInMask MiFreePoolPages MiReleaseSystemPtes MmUnmapLockedPages MmUnmapViewInSystemCache ZwRaiseException ZwQueryVolumeInformationFile ZwQueryVirtualMemory ZwQueryValueKey ZwQuerySystemInformation ZwQuerySymbolicLinkObject ZwQuerySecurityObject ZwQuerySection ZwQueryObject ZwQueryKey ZwQueryInformationToken ZwQueryInformationProcess ZwQueryInformationFile ZwQueryDirectoryFile ZwQueryDefaultLocale ZwQueryAttributesFile ZwPulseEvent ZwProtectVirtualMemory ZwOpenThreadToken ZwOpenThread ZwOpenSymbolicLinkObject ZwOpenSection ZwOpenProcessToken ZwOpenProcess ZwOpenKey ZwOpenFile ZwOpenEvent ZwOpenDirectoryObject ZwNotifyChangeKey ZwMapViewOfSection ZwMakeTemporaryObject ZwLoadKey ZwLoadDriver ZwListenPort ZwInitializeRegistry ZwFsControlFile ZwFreeVirtualMemory ZwFlushKey ZwFlushInstructionCache ZwFlushBuffersFile ZwEnumerateValueKey ZwEnumerateKey ZwDuplicateToken ZwDuplicateObject ZwDisplayString ZwDeviceIoControlFile ZwDeleteValueKey ZwDeleteKey ZwDeleteFile ZwCreateThread ZwCreateSymbolicLinkObject ZwCreateSection ZwCreateProcess ZwCreatePort ZwCreateKey ZwCreateFile ZwCreateEvent ZwCreateDirectoryObject ZwContinue ZwConnectPort ZwCompleteConnectPort ZwCloseObjectAuditAlarm ZwClose ZwClearEvent ZwAllocateVirtualMemory ZwAlertThread ZwAccessCheckAndAuditAlarm ZwAcceptConnectPort KiUnexpectedInterrupt KeReadStateThread KeReadStateSemaphore KeReadStateMutant KeSetImportanceDpc KeReadStateEvent KeReadStateProcess KeSetDmaIoCoherency KeQueryTimeIncrement KiReleaseSpinLock KeInitializeSpinLock KeFlushCurrentTb KiSystemStartup KdpGetStateChange KdpSetLoadState KdpPortUnlock IoGetFileObjectGenericMapping IoSetDeviceToVerify IoThreadToProcess xHalReferenceHandler xHalHandlerForBus ExPostSystemEvent ExpDummyAllocate ExNotifyCallback ExUnregisterCallback ExRegisterCallback ExGetSharedWaiterCount ExGetExclusiveWaiterCount FsRtlSyncVolumes IoGetConfigurationInformation KeSetSwapContextNotifyRoutine KeSetThreadSelectNotifyRoutine KeSetTimeUpdateNotifyRoutine RtlSubAuthorityCountSid RtlGetNtGlobalFlags ObGetObjectPointerCount SeTokenType SeTokenImpersonationLevel srand __jump_unwind PspDeleteVdmObjects NtSetLdtEntries PspQueryDescriptorThread PspSetLdtInformation PspQueryLdtInformation PspMarkCidInvalid PsGetCurrentThreadId PsGetCurrentProcessId PspInitializeThreadSecurity PoRequestPowerChange RtlInitializeAtomPackage DebugUnLoadImageSymbols DebugLoadImageSymbols DbgBreakPointWithStatus DbgBreakPoint NtSendWaitReplyChannel NtReplyWaitSendChannel KeSetSynchIrql KiTryToAcquireSpinLock KiFlushFixedTb IoGetInitialStack IoSetTopLevelIrp CcGetFileObjectFromBcb ExpGetPoolInformation ExCreateCallback FsRtlInitializeOplock xHalQuerySystemInformation xHalSetSystemInformation xHalQueryBusSlots xHalRegisterBusHandler NtCreateChannel NtListenChannel NtOpenChannel NtSetContextChannel RtlAreAnyAccessesGranted RtlLengthRequiredSid CcAcquireByteRangeForWrite KeSetEvent MmUnlockPages CcMdlWriteComplete2 CcSetFileSizes MmMapLockedPages MmSetAddressRangeModified IoAcquireCancelSpinLock FsRtlOplockBreakToII FsRtlRequestExclusiveOplock FsRtlOplockCleanup SwapContext KxUnlockDispatcherDatabase FsRtlNotifySetCancelRoutine IoStartNextPacket FsRtlWaitOnIrp FsRtlRemoveAndCompleteIrp MiCleanSection CcUninitializeCacheMap CcLazyWriteScan CcWriteBehind MiDecrementShareCount2 MiRestoreTransitionPte MmFlushSection MmMapViewInSystemCache ExpAcquireResourceSharedLite RtlInitializeBitMap RtlCompressBufferNS RtlDecompressBufferNS RtlDecompressFragmentNS RtlDescribeChunkNS RtlReserveChunkNS NtGetPlugPlayEvent PsSetLegoNotifyRoutine CmpSetGlobalQuotaAllowed NtSetSystemPowerState HalProcessorIdle HalSweepDcache HalSweepIcache KiInterruptTemplate RtlLengthSid RtlAreAllAccessesGranted CmSetRegistryQuotaInformation CmpCompressedNameSize _flswbuf _flsbuf RtlConvertLongToLargeInteger DebugPrint MmGetCrashDumpStateInformation KeSetCacheErrorRoutine KeSetKernelStackSwapEnable MmPurgeSection MiWaitForInPageComplete CcGetVacbMiss FsRtlFastCheckLockForRead FsRtlCheckLockForReadAccess KiDeliverApc KiApcInterrupt ExLockPool MiCheckControlArea MiResolveProtoPteFault PsWatchWorkingSet KiInterruptStackSwitch KiExceptionDispatch IoStartPacket MiMakeSystemAddressValidPfn PsChargeSharedPoolQuota ExpAcquireSharedStarveExclusive MiSectionDelete FsRtlFastCheckLockForWrite CcUnmapVacbArray CcUnmapAndPurge IoQueueThreadIrp KeResetEvent KeSetEventBoostPriority KeAlertResumeThread MiGetEventCounter PsReturnSharedPoolQuota KeInsertQueueApc KiTimerExpiration MiGetInPageSupportBlock ExDeleteResourceLite ExpAcquireResourceExclusiveLite IoReleaseCancelSpinLock KeInsertHeadQueue KeSetAutoAlignmentThread KeAttachProcess PspSetLdtSize ExpInterlockedPopEntrySList IopAllocateIrp IoAllocateIrp IoAllocateMdl ObpAllocateObjectNameBuffer KeSetTargetProcessorDpc FsRtlInitializeFileLock ExLocalTimeToSystemTime ExSystemTimeToLocalTime CcSetLogHandleForFile RtlGetDefaultCodePage PfxInitialize RtlCopyLuid PspSetProcessIoHandlers KeRaiseUserException PsGetProcessExitTime _fptrap strlen atoi _stricmp ObDereferenceObject RtlRaiseStatus RtlRaiseException RtlEnlargedUnsignedMultiply RtlEnlargedIntegerMultiply RtlpFreeAtom DebugPrompt MiRemoveBasedSection MiInsertBasedSection MmFreeContiguousMemory MiTakePageFromWorkingSet KeInitializeTimer IoSetThreadHardErrorMode IoCallDriver FsRtlPostPagingFileStackOverflow FsRtlPostStackOverflow FsRtlNumberOfRunsInMcb ExRaiseStatus ExRaiseException ExIsProcessorFeaturePresent ExInterlockedExchangeUlong FsRtlUninitializeMcb FsRtlInitializeMcb IoDeleteController LdrAccessResource RtlZeroMemory RtlMoveMemory RtlAddAccessAllowedAce PspQueueApcSpecialApc SeFreePrivileges SepFreeCapturedString SepDefaultDeleteMethod CmQueryRegistryQuotaInformation NtLoadKey CmpLazyFlushDpcRoutine towupper ObInitProcess2 RtlUnwind RtlLargeIntegerNegate RtlpUnlockAtomTable MiFindEmptySectionBaseDown MmIsRecursiveIoFault KiCopyInformation KiRestoreInterrupts KiDisableInterrupts IoReleaseVpbSpinLock FsRtlMdlReadCompleteDev _purecall ExAllocatePool ExRaiseAccessViolation ExRaiseDatatypeMisalignment NtSetIntervalProfile FsRtlCompletionRoutinePriv IopUserRundown RtlpDestroyUnCommittedRange ObDestroyHandleProcedure ObpValidateDesiredAccess RtlpDestroyHandleTableForAtomTable RtlpAllocateAtom KeReturnToFirmware KeReleaseMutex KeInitializeDpc KeSweepDcache IoIsSystemThread IoCompleteRequest IoGetAttachedDevice ExpDeleteMutant ExSystemExceptionFilter SeDeassignPrimaryToken KdpComputeChecksum strrchr strchr SepInitializePrivilegeFilter RtlLargeIntegerSubtract RtlLargeIntegerAdd RtlpExecuteHandlerForUnwind RtlpExecuteHandlerForException MmSizeOfMdl KiSquareRootSingle KiSquareRootDouble KeFreezeExecution KeInitializeSemaphore KeBugCheck KeSetTimeIncrement KdpReboot KdpQueryPerformanceCounter IoAcquireVpbSpinLock FsRtlOplockDpc FsRtlFastUnlockAllByKey FsRtlTruncateMcb ExInterlockedIncrementLong ExInterlockedDecrementLong ExpAllocateStringRoutine CcExceptionFilter FsRtlAllocateResource IopDeallocateApc NtFlushWriteBuffer LdrFindResource_U LdrFindResourceDirectory_U RtlpInitUpcaseTable ObMakeTemporaryObject SepRmComponentTestCommandWrkr SepAdtInitializePhase1 CmpFree KdpQuickMoveMemory NtSetLowWaitHighThread _strset ObfReferenceObject RtlpExceptionHandler MmReturnPoolQuota KiRestoreProcessorState KeFlushEntireTb IoQueryVolumeInformation RtlpGetTimeZoneInfoHandle RtlNtStatusToDosError RtlAcquirePebLock RtlReleasePebLock PsCreateSystemProcess NtTestAlert NtSetHighWaitLowThread NtGetTickCount wcslen LsaFreeReturnBuffer PspDeleteProcessSecurity ObDeassignSecurity RtlpFreeHandleForAtom DbgUnLoadImageSymbols MmIsNonPagedSystemAddressValid KiInterruptHandler ExpTimeRefreshDpcRoutine IoQueryFileInformation IopReadyDeviceObjects IopUserCompletion RtlEqualLuid RtlFreeUnicodeString RtlFreeAnsiString RtlFreeOemString RtlxUnicodeStringToAnsiSize RtlxUnicodeStringToOemSize RtlxAnsiStringToUnicodeSize RtlxOemStringToUnicodeSize SepIdAssignableAsOwner CmpRemoveKeyControlBlock HvpGetCellFlat RtlpLogLastExceptionDisposition RtlSetAllBits RtlClearAllBits RtlpInitializeLockAtomTable MiDownPfnReferenceCount MiZeroPhysicalPage MiRemoveImageHeaderPage MiFlushTb KiSuspendThread KeReadyThread KeProfileInterrupt KiComputeWaitInterval KeSweepIcache KeSetTimer KeInitializeTimerEx IopApcHardError FsRtlNormalizeNtstatus ExpGetGlobalAtomTable FsRtlNotifyUninitializeSync HvGetCellSize KdpCauseBugCheck CmpLockRegistry wcscpy rand __ll_mul PspSetSavedValue PspGetSavedValue ObpAcquireDescriptorCacheReadLock ObpAcquireDescriptorCacheWriteLock RtlInitializeGenericTable MiUpForkPageShareCount KiSaveProcessorState ExpTimeZoneWork MiChangeNoAccessForkPte RtlAbsoluteToSelfRelativeSD ObpHashBuffer PspNullSpecialApc SeDeassignSecurity NtVdmControl towlower __ll_rshift __ull_rshift __ll_lshift MiGetFirstNode KiDisplayString KeDisableApcQueuingThread KeInitializeMutex IopInvalidDeviceRequest IopExceptionFilter FsRtlIsTotalDeviceFailure FsRtlAllocatePoolWithQuotaTag FsRtlAllocatePoolWithTag ExpAllocatePoolWithQuotaHandler CcUnmapVacb CcCopyReadExceptionFilter NtDeleteAtom RtlCheckRegistryKey RtlCreateRegistryKey SepRmCreateLogonSessionWrkr SepRmDeleteLogonSessionWrkr CmpLazyFlushWorker PspUnhandledExceptionInSystemThread PsRestoreImpersonation ObReleaseObjectSecurity RtlCreateUnicodeStringFromAsciiz DbgPrompt MiCheckForConflictingNode KeEnableApcQueuingThread FsRtlAllocatePoolWithQuota FsRtlAllocatePool FsRtlAddMcbEntry ExInterlockedPopEntryList ExUnlockPool ExpExpirationThread FsRtlCheckForMatchingFileObject FsRtlIsNotifyOnList IopAbortRequest ChkSum PsExitSpecialApc SepFreeProxyData CmpDestroyTemporaryHive CmpLockRegistryExclusive strcmp _wcslwr _strupr _strnset _strlwr PsSetCreateThreadNotifyRoutine RtlpUnwindHandler MiUpControlAreaRefs MiDeleteFreeVm KeSetAutoAlignmentProcess KeSetDisableBoostThread IopChecksum IopErrorLogDpc NtAddAtom NtFindAtom FsRtlpSetSymbolicLink MiGetImageProtection SeReleaseSid SeReleaseAcl SeReleaseLuidAndAttributesArray SeReleaseSidAndAttributesArray CmShutdownSystem CmpQuotaWarningWorker CmpFileSetSize CmpCopyCompressedName CmpRefreshWorkerRoutine KdpSendControlPacket memchr _wcsupr _wcsnset SeFreeCapturedSecurityQos PsTerminateSystemThread RtlInitAnsiString RtlInitString RtlpInitializeHandleTableForAtomTable RtlpLockAtomTable MiReturnCommitment MiIsProtectionCompatible KeInitializeDeviceQueue IopErrorLogRequeueEntry FsRtlIsNtstatusExpected CcRepinBcb FsRtlNotifyReportChange IopDeleteDriver MiUnloadSystemImageByForce RtlInitNlsTables ObpReferenceSecurityDescriptor ObpDereferenceSecurityDescriptor SepAdtValidateAuditBounds CmpGetKeySecurity fputwc iswctype wcschr ObpCompareSecurityDescriptors ObAuditInheritedHandleProcedure RtlLargeIntegerShiftRight RtlLargeIntegerShiftLeft RtlFindSetBitsAndClear RtlInitUnicodeString MiMapCacheExceptionFilter KiInterruptDispatchRaise KeBusError KeRemoveDeviceQueue KdpWriteControlSpace FsRtlStackOverflowRead ExInterlockedRemoveHeadList ExInterlockedInsertHeadList ExInterlockedExtendZone ExAcquireResourceExclusiveLite KeReadStateTimer KiAcquireSpinLock ExpInterlockedPushEntrySList IoFreeIrp ObpFreeObjectNameBuffer IoFreeMdl CcMdlReadComplete2 CcWorkerThread FsRtlUninitializeLargeMcb FsRtlFreeTunnelNode KeReleaseSpinLock IoSetHardErrorOrVerifyDevice KeEnterCriticalRegion FsRtlInitializeTunnelCache NtOpenFile MmUnmapIoSpace MiGetExceptionInfo ComputeUnicodeNameLength RtlCopyLuidAndAttributesArray ObpDestroySecurityDescriptorHeader SeReleaseSecurityDescriptor CmpCreateTemporaryHive isprint isspace isxdigit isdigit isupper PspInheritQuota ObpReleaseDescriptorCacheLock RtlAddressInSectionTable RtlLargeIntegerArithmeticShift MiDownShareCountFlushEntireTb MiUpCloneProtoRefCount MiUpPfnReferenceCount MmCanFileBeTruncated KeInitializeEventPair KeTryToAttachProcess KdpStub IoGetBaseFileSystemDeviceObject ExDeleteResource IoEnqueueIrp NtDeviceIoControlFile KeAddSystemServiceTable NtReadRequestData NtWriteRequestData SeImpersonateClient CmpReleaseGlobalQuota CmpUnlockRegistry CmpFindKeyControlBlock CmpDeleteKeyObject mblen PspDereferenceEventPair PsGetVersion PspDeleteThreadSecurity PspInitializeProcessSecurity RtlLookupElementGenericTable DbgLoadImageSymbols KeRemoveEntryDeviceQueue KeCancelTimer IopFreeIrpAndMdls IopDescriptorSortingWeight FsRtlCheckNoSharedConflict ExpTimerDpcRoutine CacheImageSymbols RtlCopySid RtlCompressWorkSpaceSizeLZNT1 PsEstablishWin32Callouts SeQuerySecurityAccessMask CmpConfigureProcessors CmpSearchOpenWorker CmpQuerySecurityDescriptorInfo CmpFileFlush wctomb wcscat RtlpCreateHandleForAtom LpcpClosePort KiSelectNextThread KeThawExecution KiSaveProcessorControlState KeBugCheckUnicodeToAnsi KdpSwitchProcessor IopDecrementDeviceObjectRef IoFreeController xHalDeviceControl FsRtlLookupLastMcbEntry ExpTimeZoneDpcRoutine ExInterlockedAddLargeInteger CcGetFileObjectFromSectionPtrs NtClearEvent FsRtlNotifyChangeDirectory RtlValidSid RtlpDestroyHeapSegment CmpLazyFlush KdpSendString _wcsrev _strrev _strcmpi ObpDeleteDirectoryEntry ObAssignObjectSecurityDescriptor RtlInitializeExceptionLog RtlpVirtualUnwind MiRemoveWsleFromFreeList MiGetSystemCacheSubsection KeSetPriorityThread IoDetachDevice IoStopTimer IopGetModeInformation RtlIntegerToUnicodeString RtlDeleteRegistryValue PsCreateSystemThread SepSinglePrivilegeCheck CmpDoFileSetSize DbgkpSuspendProcess DbgkpResumeProcess tolower ObReferenceObjectByPointer MiCaptureSystemPte MmAllowWorkingSetExpansion KiGetPhysicalAddress KdpPageInData IoRegisterDriverReinitialization RtlpAddData NtAlertThread SeAssignPrimaryToken SepFreePrimaryGroup SepAppendDefaultDacl CmpNameSize CmFlushKey KdpRestoreBreakpoint PsOpenTokenOfProcess RtlSecondsSince1970ToTime RtlSecondsSince1980ToTime RtlSectionTableFromVirtualAddress RtlEnlargedUnsignedDivide DbgPrint MiCheckPageFileMapping MiUpdateImageHeaderPage KiIpiGenericCall KeQueryBasePriorityThread KeInitializeQueue KeDeregisterBugCheckCallback IopErrorLogGetEntry CcSetDirtyPageThreshold ExpProfileDelete IopAllocateIrpCleanup NtListenPort LpcpAllocateFromPortZone LpcpFindDataInfoMessage RawQueryFsVolumeInfo SepInformFileSystemsOfDeletedLogon SeSetSecurityAccessMask SepTokenDeleteMethod CmpFreePostBlock CmpDereferenceKeyControlBlock CmpDestroyHive CmpCloseKeyObject CmpDoFlushAll KdpWriteBreakpoint wcscspn PsRevertToSelf ObpSetHandleAttributes MiWaitForForkToComplete IopGetMountFlag IopRemoveTimerFromTimerList NtSetLowEventPair NtSetHighEventPair IoRegisterShutdownNotification LpcpPrepareToWakeClient LpcpSaveDataInfoMessage RtlValidAcl KiAcquireSpinLockRaiseIrql KeSynchronizeExecution KeReadStateQueue xHalSuspendHibernateSystem KeRaiseIrql KiChainedDispatch ExAcquireFastMutex PsImpersonateClient FsRtlLookupLargeMcbEntry FsRtlLookupMcbEntry PsReferenceImpersonationToken PsReferencePrimaryToken FsRtlGetNextLargeMcbEntry FsRtlLookupLastLargeMcbEntry FsRtlTruncateLargeMcb FsRtlNumberOfRunsInLargeMcb ExInterlockedAddUlong RtlGetGroupSecurityDescriptor RtlGetOwnerSecurityDescriptor SePrivilegeCheck SepFreeDefaultDacl DbgkUnMapViewOfSection wcsspn _wcsicmp MiLocateAddress MiFlushRangeFilter MiUnlockPagedAddress MiIsPteDecommittedPage MmDbgReadCheck KeQueryIntervalProfile KiInstructionBusError KeInitializeMutant KeFillFixedEntryTb KiTrapDispatch KiIntegerOverflowDispatch KiInstructionBusErrorDispatch KiIllegalInstructionDispatch KiDataBusErrorDispatch KiCoprocessorUnusableDispatch IoStartTimer FsRtlRemoveMcbEntry FsRtlGetNextMcbEntry ExQueryPoolBlockSize KeFlushSingleTb NtQuerySystemTime MmGetCrashDumpInformation RtlGetCompressionWorkSpaceSize SePrivilegeObjectAuditAlarm CmpFindKeyControlBlockWithLock RtlCreateAcl wcsncmp wcsncat strncmp strncat RtlTimeToSecondsSince1980 RtlImageNtHeader MiGetPreviousNode MiGetNextNode MiInsertFrontModifiedNoWrite KeInitializeProfile KiFlushRandomTb KiBugCheckDispatch KiBreakpointDispatch IopSetAttachedDevicePointer CcMdlReadComplete SeCopyClientToken CmpAllocate CmpAllocateTag HvpFillFileName CmpDoCompareKeyName HvpHeaderCheckSum KdpReceiveString vsprintf toupper KeSetIdealProcessorThread KeInsertByKeyDeviceQueue KiReadEntryTb KdpPollBreakInWithPortLock IopStartApcHardError IO_DESC_MAX FsRtlRemoveLargeEntry FsRtlFreeFirstMapping CcScheduleLazyWriteScan FsRtlNotifyInitializeSync IoDisconnectInterrupt IoDeleteSymbolicLink IoCreateSymbolicLink MiFlushAllPages RtlMultiByteToUnicodeSize RtlSetGroupSecurityDescriptor RtlSetOwnerSecurityDescriptor ObpInitSecurityDescriptorCache RawQueryFsAttributeInfo SepAppendPrimaryGroup NtInitializeRegistry KdEnterDebugger RtlExtendedLargeIntegerDivide RtlNumberOfClearBits MiUnmapImageHeaderInHyperSpace MiObtainFreePages MmForceSectionClosed KiFloatingDispatch KeIpiInterrupt CcMdlWriteComplete NtWaitLowEventPair NtWaitHighEventPair NtSetLowWaitHighEventPair NtSetHighWaitLowEventPair IopOpenRegistryKey LpcpFreePortClientSecurity MiCrashDumpWorker MmPageEntireDriver RtlCreateUnicodeString RtlDescribeChunk RtlReserveChunk RtlRandom ObGetHandleInformation ObKillProcess SeDeleteObjectAuditAlarm CmpRemoveSecurityCellList KdExitDebugger wcsrchr _strnicmp _itoa RtlRealSuccessor KeSetIntervalProfile NtRaiseException KeTestAlertThread KeRevertToUserAffinityThread KeForceResumeThread IoInitializeIrp ExInitializeZone RtlpRaiseException FsRtlRemoveLargeMcbEntry ExReleaseResourceLite KeClearEvent KeInsertQueueDpc FsRtlInitProcessorLockQueue KiRetireDpcList SepRmSendCommandToLsaWrkr ExReleaseFastMutex ExGetPreviousMode KeQuerySystemTime KiSaveVolatileFloatState KiInterruptDistribution KiInterruptDispatchSame CcGetVirtualAddress CcMapAndRead KeFlushIoBuffers FsRtlAcquireFileExclusive FsRtlReleaseFile IopErrorLogQueueRequest LpcpInitializePortQueue RtlUnicodeToMultiByteSize RtlAnsiCharToUnicodeChar RawCleanup SepQueryTypeString HvpGetCellPaged HvpGetCellMap KdpWriteVirtualMemory KdpPageIn RawCheckForDismount RtlNumberOfSetBits RtlAppendAsciizToString MiDoesPdeExistAndMakeValid KeFlushQueueApc KeFlushMultipleTb KiFloatDispatch IoAllocateController IoBuildSynchronousFsdRequest FsRtlAllocateFirstMapping RtlDecompressBuffer RawQueryFsDeviceInfo SeCloseObjectAuditAlarm CmpCopyTree DbgkExitThread _mbstrlen _vsnprintf PspSetEventPair ObpEnumFindHandleProcedure RtlAppendStringToString MiFeedSysPtePool MmDisableModifiedWriteOfSection KiReinsertTreeTimer KeResumeThread KiProcessProfileList KiTbMiss ExpScanPoolLookasideList NtQueryDefaultLocale FsRtlReleaseFileForModWrite MmDeleteTeb OpbCreateCacheEntry SepDequeueWorkItem CmpValidateAlternate NtDeleteKey CmpFreeValue wcsstr _wcsnicmp _snprintf PsSetCreateProcessNotifyRoutine ObpProcessRemoveObjectQueue DaysAndFractionToTime RtlpAtomMapAtomToHandleEntry MiMakePdeExistAndMakeValid LpcpMoveMessage KiPcToFileHeader KeSetSystemAffinityThread IopAllocateIrpMustSucceed IoAttachDeviceToDeviceStack ExReturnPoolQuota CcSetBcbOwnerPointer FsRtlCheckNotifyForDelete RtlEqualSid RtlCompressBuffer PsUnlockProcess SepAssemblePrivileges SeExchangePrimaryToken CmpCheckCreateAccess HvpFreeMap DbgkExitProcess sprintf LsaCallAuthenticationPackage RtlEnumerateGenericTableWithoutSplaying MiInitializePfnForOtherProcess KiThreadDispatch KeRundownQueue ExpGetHandleInformation ProbeForWrite NtUnmapViewOfSection PspMapSystemDll SeCheckAuditPrivilege HvAllocateCell CmSetLastWriteTimeKey DbgkpSendApiMessage KiUnlockDispatcherDatabase islower KiDispatchInterrupt IoGetRelatedDeviceObject CcSetValidData IoSynchronousPageWrite KeLeaveCriticalRegion IofCallDriver IoGetCurrentProcess KeQueryTickCount RawCompletionRoutine PspSystemThreadStartup RtlpRaiseStatus KeBoostPriorityThread KiUserAddressErrorDispatch IopRaiseInformationalHardError IoWriteErrorLogEntry ExAdjustLookasideDepth ExpScanGeneralLookasideList MmUnmapViewInSystemSpace ExCreateHandleTable ExpGetObjectInformation ExFreePool FsRtlRemoveAndCompleteWaitIrp FsRtlPrivateLimitFreeLockList IopDeleteIoCompletion CcDeallocateBcb ExUnlockUserBuffer SeTraverseAuditAlarm KiInsertQueue ExAcquireResourceSharedLite KeLowerIrql FsRtlDissectName MiReserveSystemPtes IoIsOperationSynchronous CcMapData KeInitializeProcess CcFindBcb KeRemoveQueue FsRtlOplockIsFastIoPossible LpcpFreeDataInfoMessage LpcExitThread RtlFirstFreeAce RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlDecompressFragment PsSetProcessPriorityByClass SepInformLsaOfDeletedLogon CmpFlushNotify CmpFreeKeyBody CmpFreeSecurityDescriptor CmpRemoveFromHiveFileList PspDereferenceQuota ObDupHandleProcedure KeRemoveQueueApc KeFillLargeEntryTb IoAttachDeviceByPointer ExExtendZone RtlExtendedIntegerMultiply NtAllocateLocallyUniqueId NtQueryIntervalProfile RtlGetSaclSecurityDescriptor RtlGetDaclSecurityDescriptor LdrVerifyMappedImageMatchesChecksum RawQueryInformation SepQueryNameString HvpDiscardBins KdpDeleteBreakpoint PspAssignPrimaryToken PsDisableImpersonation KeAlertThread RtlWriteRegistryValue PsCreateWin32Process SeQueryAuthenticationIdToken CmpWorkerCommand CmCheckRegistry CmpCopyCell KdpPrintString IoUpdateShareAccess KiInSwapKernelStacks wcsncpy strstr LsaDeregisterLogonProcess RtlPcToFileHeader MmIsSystemAddressAccessable KeEnterKernelDebugger KeSetProcess FsRtlpPostStackOverflow FsRtlPrivateRemoveLock ExpGetLockInformation NtSetDefaultHardErrorPort FsRtlpOpenDev NtMakeTemporaryObject RawSetInformation SepFilterPrivilegeAudits CmpClaimGlobalQuota HvpGrowLog1 MiDoneWithThisPageGetAnother KiSwapProcess KeSwitchKernelStack NtContinue IopCompletePageWrite CmpPostApc RtlCompareMemoryUlong RtlCopyString MmUnlockCachedPage MmDbgWriteCheck MmCreateMdl KeSuspendThread KePulseEvent KeRegisterBugCheckCallback CcAllocateObcb CcSetAdditionalCacheAttributes strncpy IoInitializeTimer IopErrorLogConnectPort PspThreadDelete KiRestoreVolatileFloatState KiPassiveRelease KeInitializeEvent NtRegisterThreadTerminatePort SeSinglePrivilegeCheck CmpPostApcRunDown CmpCheckNotifyAccess HvpGrowLog2 FsRtlFindLargeIndex IoGetTopLevelIrp SeReleaseSubjectContext ExpInterlockedCompareExchange64 RtlSubAuthoritySid RtlEqualMemory RtlCompareMemory wcscmp RtlpGetExtraStuffPointer ExReleaseFastMutexUnsafe RtlpGetStackLimits SeSetAccessStateGenericMapping ExAllocatePoolWithTag ExpFindCurrentThread CcAllocateInitializeBcb CcCreateVacbArray ExAllocatePoolWithQuotaTag ExAllocatePoolWithQuota ElapsedDaysToYears SeDeleteAccessState IoGetDeviceToVerify RtlTimeToTimeFields RtlSplay KeUpdateRunTime RtlDelete RtlDeleteElementGenericTable SeCaptureSubjectContext RtlFindClearBitsAndSet ExReleaseHandleTableShared IopParseFile RtlFindClearBits ExpInterlockedExchangeAddLargeInteger RtlCompareUnicodeString RtlMapGenericMask IoCheckDesiredAccess CcUnpinData strcpy mbtowc RtlEnumerateGenericTable MiGetPageForHeader KiFlushMultipleTb IoStartNextPacketByKey ExpRaiseStatus ExInitializeNPagedLookasideList ExConvertExclusiveToSharedLite KeRemoveByKeyDeviceQueue FsRtlDoesDbcsContainWildCards IoCreateSynchronizationEvent IoCreateNotificationEvent RawClose NtSaveKey CmQueryKey KdpSetContext LsaLookupAuthenticationPackage ObpCaptureHandleInformation MiMakeSystemAddressValid MmGetPhysicalAddress KiMoveApcState KiProbeEntryTb KiReadyThread KiUnwaitThread KiWaitTest KiActivateWaiterQueue KiInsertQueueApc RtlQueryAtomsInAtomTable IoFastQueryNetworkAttributes RtlCopyUnicodeString IofCompleteRequest ObReferenceObjectByHandle ObpCaptureObjectCreateInformation ObCreateObject IoCreateStreamFileObject IopDereferenceVpbAndFree RtlUpcaseUnicodeChar ExFreePoolWithTag ObpCaptureObjectName RtlEqualUnicodeString RtlFillMemoryUlong SeAuditingFileEvents SeCreateAccessState RtlExtendedMagicDivide RtlTimeToSecondsSince1970 KiAddressErrorDispatch FsRtlWorkerThread ExReleaseResourceForThread ExpCopyThreadInfo ExRemoveHandleTable ExpUuidSaveSequenceNumber IoUnregisterFileSystem LpcpFreeConMsg ObQueryObjectAuditingByHandle KdpReadVirtualMemory KdpReportExceptionStateChange RtlPinAtomInAtomTable MiLocateAddressInTree KiInvalidCompareSingle KiInvalidCompareDouble ExShutdownSystem FsRtlInitializeOpFilter IopFindCollisionInTList IopGetRegistryValues RtlComputeLfnChecksum LZNT1FindMatchMaximum NtFlushKey HvpAllocateMap DbgkMapViewOfSection NtDelayExecution KdpDeleteBreakpointRange MiHandleBankedSection MiCheckPdeForPagedPool FsRtlCheckLockForWriteAccess ExTryToAcquireResourceExclusiveLite CcPostWorkQueue FsRtlBalanceReads IoUnregisterFsRegistrationChange IoRegisterFsRegistrationChange IoCreateUnprotectedSymbolicLink ComputeNameLength SeCheckPrivilegedObject SeDefaultObjectMethod KdpMoveMemory SeAuditingFileOrGlobalEvents MiInitializeCopyOnWritePfn KiDataBusError FsRtlMdlReadComplete MiCheckProtoPtePageState ObOpenObjectByName IoCreateFile NtCreateFile CmpCreatePredefined NtDeleteFile MiDecrementReferenceCount ExpTimerApcRoutine ExpRaiseException ExpComputeLookasideDepth CcScanDpc IopTimerDispatch LdrpCompareResourceNames_U RtlGetAce NtOpenDirectoryObject NtOpenSymbolicLinkObject SepAdtCopyToLsaSharedMemory SepRmSetAuditEventWrkr strcat RtlAppendUnicodeStringToString MiLockPagedAddress KiIdleLoop KeSweepIcacheRange IoUnregisterShutdownNotification NtQueryDirectoryFile NtQueryOleDirectoryFile SePrivilegedServiceAuditAlarm ExAcquireSharedStarveExclusive KeAcquireSpinLock MmDeterminePoolType CcSetReadAheadGranularity RtlConvertUlongToLargeInteger RtlIsNameLegalDOS8Dot3 FsRtlRemoveNodeFromTunnel FsRtlDoesNameContainWildCards MmIsAddressValid ExInterlockedInsertTailList ExInitializeResourceLite IoAllocateAdapterChannel FsRtlCurrentBatchOplock FsRtlNotifyCompletion ExCreateHandle ObpCreateHandle ObpCreateUnnamedHandle RtlUpcaseUnicodeStringToOemString ExTryToAcquireFastMutex ExInterlockedAddLargeStatistic RtlNtStatusToDosErrorNoTeb MiRemovePageByColor MiRemoveAnyPage RawInitializeVcb FsRtlMdlWriteCompleteDev IopParseDevice FsRtlIsNameInExpressionPrivate FsRtlIsNameInExpression ExReleaseHandleTableExclusive ObpValidateAccessMask RtlInitializeUnicodePrefix RtlCompressWorkSpaceSizeNS ObpDecrementHandleCount MiRemovePageFromList RtlpDidUnicodeToOemWork RtlUpcaseUnicodeStringToCountedOemString RtlUnicodeStringToCountedOemString IoBuildPartialMdl MiInitializePfn CmpCompareCompressedName CmpFindSubKeyByNumber KdpGetContext RtlImageDirectoryEntryToData MiInsertNode KeInitializeInterrupt IopFreeResourceDir IopGetRegistryKeyInformation IopLoadFileSystemDriver IopMarkDuplicateDevice MiSetImageProtectWrite RtlOpenCurrentUser SepNotifyFileSystems CmpDeleteTree NtQueryTimerResolution PsLookupThreadByThreadId PsLookupProcessByProcessId PsReferenceEffectiveToken ObFindHandleForObject ObAssignSecurity RtlLargeIntegerDivide MiCheckForContiguousMemory KiWaitSatisfyAll KiSystemServiceHandler KiXTbMiss FsRtlMdlWriteComplete IoGetDeviceObjectPointer IopGetDeviceInstanceCsConfigFlags RtlUpcaseUnicodeToOemN ObpAllocateObject FsRtlFindInTunnelCache ExMapHandleToPointer RtlUpcaseUnicodeString FsRtlAreNamesEqual NtOpenSection CmpSearchForOpenSubKeys CmpSearchKeyControlBlockTree CmpCopyName IopCheckDeviceAndDriver ObpChargeQuotaForObject ObValidateSecurityQuota SeLockSubjectContext FsRtlAddToTunnelCache FsRtlIsFatDbcsLegal DbgkpSectionHandleToFileHandle wcstombs swprintf mbstowcs _snwprintf ObpInsertDirectoryEntry MiSetProtectionOnTransitionPte NtCallbackReturn IoCancelIrp CcWaitOnActiveCount KeBoostCurrentThread CcUnpinDataForThread IopExceptionCleanup NtCreateProcess RawFileSystemControl KiInSwapProcesses MiFindEmptyAddressRange MiFlushEventCounter MmMapMemoryDumpMdl KiInvalidOperationLongword KiDivideByZeroSingle FsRtlNotifyCompleteIrpList MiFlushInPageSupportBlock KeThawAllThreads NtQueryInformationPort RtlSetActiveTimeBias NtRestoreKey HvSyncHive HvpTruncateBins PspReaper MiGetProtoPteAddressExtended MmFlushImageSection IopDropIrp MmRaisePoolQuota NtQueryPerformanceCounter FsRtlDeregisterUncProvider IopCancelAlertedRequest LpcpFreeToPortZone PspExitNormalApc MiLocateSubsection FsRtlPrivateInsertExclusiveLock ExInitializePagedLookasideList IopGetRegistryValue MiInsertPageInList FsRtlCheckOplock MiLocateWsle KeUpdateSystemTime MiSetDirtyBit IoSetShareAccess ExSetResourceOwnerPointer KiInsertTreeTimer ExIsResourceAcquiredExclusiveLite IO_DESC_MIN NtFsControlFile RtlSubtreePredecessor MiLocateAndReserveWsle MiAddValidPageToWorkingSet RtlUnicodeToOemN RtlUnicodeStringToOemString MiUnlinkPageFromList IoCheckShareAccess KdpReadControlSpace ExDestroyHandle KdIsThisAKdTrap FsRtlDeleteTunnelCache KeRemoveQueueDpc KeTryToAcquireSpinLock KeInsertDeviceQueue KiComputeTimerTableIndex SeRegisterLogonSessionTerminatedRoutine SepSidInToken RtlCreateAtomTable MiFlushTbAndCapture MiFreeInPageSupportBlock KeChangeColorPage ObpLookupObjectName CcFastCopyWrite IopCloseFile MiRemoveZeroPage MiResolveMappedFileFault RtlOemToUnicodeN RtlOemStringToUnicodeString ObpFreeObject ObpRemoveObjectRoutine MiBuildKernelMap MiMakeSystemAddressValidPfnWs KiIpiProcessRequests FsRtlCancelWaitIrp NtCompleteConnectPort SeComputeQuotaInformationSize SepAdtLogAuditRecord ObDeleteCapturedInsertInfo KeRundownThread KeReleaseSemaphore ExpFindAndRemoveTagBigPages CcDeferWrite IopWriteResourceList MiUpdateWsle IopCheckBackupRestorePrivilege IoCheckFunctionAccess FsRtlPruneTunnelCache KeFillEntryTb PspTerminateThreadByPointer SeGetTokenControlInformation KdpGetVersion IopCheckUnloadDriver strspn ObpDeleteSymbolicLink RtlLookupFunctionEntry KiFindReadyThread NtStopProfile NtSetIoCompletion LdrRelocateImage NtResumeThread NtAlertResumeThread RawQueryVolumeInformation KiOutSwapProcesses KiLookupFunctionEntry KdpSetStateChange FsRtlPrivateResetLowestLockOffset MiReturnPageFileQuota NtOpenEvent ExpUuidLoadSequenceNumber NtOpenEventPair NtOpenMutant NtOpenSemaphore NtOpenTimer IoCancelThreadIo NtOpenIoCompletion PiRegSzToString CmQueryValueKey SepTokenIsOwner NtW32Call IoAttachDevice MiLookupDataTableEntry SeSubProcessToken ObSetSecurityDescriptorInfo MiInsertStandbyListAtFront MiFindActualFaultingPte IopCatagorizeDescriptors RtlInitCodePageTable SeUnregisterLogonSessionTerminatedRoutine CmDeleteKey KdpRestoreBreakPointEx RtlEqualPrefixSid MmDbgTranslatePhysicalAddress ExpAddTagForBigPages MiCheckForControlAreaDeletion FsRtlMdlRead FsRtlPrepareMdlWrite IopConcatenateUnicodeStrings PfxRemovePrefix SeAuditHandleCreation SepCopyProxyData FsRtlOplockBreakNotify MiLookupWsleHashIndex MiRemoveFromSystemSpace FsRtlpRegisterProviderWithMUP MmUnmapVideoDisplay MmCreateTeb CmEnumerateKey RtlPrefixString RtlEqualString KiCallUserMode FsRtlPrivateCheckForSharedLockAccess ExDeleteNPagedLookasideList ExDeletePagedLookasideList KiSetServerWaitClientEvent KiRequestSoftwareInterrupt RtlCreateSecurityDescriptor ExInterlockedPushEntryList IoGetRequestorProcess KiCacheError RtlIsGenericTableEmpty ObpDeleteNameCheck FsRtlOplockFsctrl MiRemoveWsle SwapSplayLinks RtlDeleteNoSplay KiInsertTimerTable RtlClearBits MiReleasePageFileSpace ExReinitializeResourceLite IoRemoveShareAccess MmBuildMdlForNonPagedPool FsRtlAcquireFileForCcFlush KiFlushSingleTb SepConcatenatePrivileges RtlUpperString SepGetDefaultsSubjectContext NtQueryAttributesFile RawReadWriteDeviceControl SepMakeTokenEffectiveOnly CmpLinkKeyToHive CmpCreatePerfKeys NtQueryKey NtSetInformationKey CmpOpenFileWithExtremePrejudice CmUnloadKey MiReturnPageTablePageCommitment MiPageFileFull KiContinue KiDivideByZeroDouble KiQuantumEnd IopCompleteDriverUnload FsRtlpIsDfsEnabled ExInitializeResource RtlAreBitsClear CcGetVirtualAddressIfMapped FsRtlDissectDbcs IoCreateController RtlCopySidAndAttributesArray CmpGetNextName KiInvalidOperationQuadword KeFreezeAllThreads KeDetachProcess FsRtlPrivateCheckForExclusiveLockAccess ObQueryTypeName NtEnumerateKey NtEnumerateValueKey CmpDoFindSubKeyByNumber PsOpenTokenOfThread RtlDestroyAtomTable MiCauseOverCommitPopup KiUnpackSingle FsRtlPrivateInitializeFileLock KeSetBasePriorityThread RtlCaptureContext IoCheckEaBufferValidity IopGetResourceReqRegistryValue NtOpenProcessToken SeMarkLogonSessionForTerminationNotification HvMarkCellDirty CmpQueryKeyName CmEnumerateValueKey DbgkForwardException RtlGetCallersAddress KeInitializeApc RtlInitializeSid MiReleaseWsle ExDisableResourceBoostLite FsRtlFastUnlockAll NtSetInformationFile SeAssignSecurity ObpIncrementHandleCount MiCreateDataFileMap SeValidSecurityDescriptor RtlInsertElementGenericTable ExDestroyHandleTable NtResetEvent IopLoadUnloadDriver IopLookupBusStringFromID RtlNextUnicodePrefix MiInitializeReadInProgressPfn FsRtlAllocateOplock FsRtlFindFirstOverlappingExclusiveNode MiMakeProtectionMask RtlSetBits RtlpGenerateInheritAcl ExChangeHandle ExIsResourceAcquiredSharedLite MiFlushPteList FsRtlFastUnlockSingle RtlAppendUnicodeToString IopSynchronousApiServiceTail RawMountVolume SepRmCommandServerThread RtlCompareString FsRtlCancelOplockIIIrp FsRtlCheckNoExclusiveConflict RtlAreBitsSet MmFreeNonCachedMemory ExpCopyProcessInfo NtWaitForSingleObject NtCreateDirectoryObject SeUnlockSubjectContext FsRtlReleaseFileForCcFlush MiFreeEventCounter KiEmulateFloating MiInitMachineDependent NtQueryInformationToken MiCloneProcessAddressSpace MiCreateImageFileMap NtQuerySystemInformation RtlAllocateHeapSlowly NtAllocateVirtualMemory NtSetInformationProcess CmpValidateHiveSecurityDescriptors MiInitializeTransitionPfn MmAllocateContiguousMemory NtYieldExecution KiInitializeUserApc KeUserModeCallback FsRtlFindFirstOverlappingSharedNode IoPageRead NtPulseEvent NtSetEvent NtSetInformationObject MmAccessFault IopReportResourceUsage RtlUpcaseUnicodeToCustomCPN xHalIoAssignDriveLetters KeDumpMachineState RtlUpcaseUnicodeToMultiByteN FsRtlAddLargeMcbEntry FsRtlCopyWrite MmCreateSection MmMemoryUsage CcCopyRead MiSetProtectionOnSection IopAssignResourcesPhase2 IopGenNextValidDescriptor NtConnectPort FsRtlNotifyFullReportChange MmWorkingSetManager PspCreateProcess NtWriteFile _output _woutput IopXxxControlFile IopPrepareDriverLoading NtFreeVirtualMemory NtSetInformationThread NtQueryInformationFile IopCreateMadeupNode MiMapViewOfImageSection NtSetInformationToken SeCaptureSecurityDescriptor NtQueryInformationProcess MiMapViewOfDataSection RtlAllocateHeap NtReadFile NtCreatePagingFile NtAcceptConnectPort IoAssignResources LZNT1DecompressChunk MmLoadSystemImage IopLoadDriver NtAccessCheckAndAuditAlarm NtDuplicateObject CcCopyWrite MiProtectVirtualMemory MiMapViewOfPhysicalSection PspCreateThread NtCreateToken NtRequestWaitReplyPort NtQueryEaFile FsRtlIsDbcsInExpression KiNormalizeDouble MiAllocatePoolPages NtQueryVirtualMemory CcZeroData IoWriteCrashDump RtlCreateHeap IopDriverLoadingFailed KiDispatchException RtlGenerate8dot3Name NtAccessCheck HvInitializeHive FsRtlRemoveMcbEntryPrivate BuildQueryDirectoryIrp SeSetSecurityDescriptorInfo NtLockVirtualMemory SepCreateToken MmCopyToCachedPage MiGatherMappedPages IoOpenDeviceInstanceKey xHalIoReadPartitionTable FsRtlPrepareMdlWriteDev NtOpenObjectAuditAlarm MiFindContiguousMemory PspExitThread ObpHashSecurityDescriptor __ull_rem __ull_div MmExtendSection ObInsertObject NtQueryInformationThread HvpAddBin SepAdtOpenObjectForDeleteAuditAlarm SepAdtOpenObjectAuditAlarm NtQueryObject PpDeviceRegistration NtLockFile RtlVirtualUnwind SepAccessCheck FsRtlPrivateFastUnlockAll NtAdjustGroupsToken LZNT1CompressChunk MmShutdownSystem KiNormalizeSingle VdmQueryDirectoryFile NtAdjustPrivilegesToken LpcRequestWaitReplyPort NtReplyWaitReceivePort IopMountVolume CmpDoCreateChild SeCaptureSidAndAttributesArray NtSetSystemInformation NtQueryVolumeInformationFile IoCreateDevice RtlpGenerateInheritedAce LdrpSearchResourceSection_U MiDispatchFault pIoQueryDeviceDescription KeWaitForMultipleObjects KiEmulateReference MiMakeOutswappedPageResident MiDeletePte MiLoadImageSection MiReserveSystemPtes2 MmCreateProcessAddressSpace NtWaitForMultipleObjects CmRestoreKey NtMapViewOfSection NtUnlockVirtualMemory RtlpVirtualUnwind32 CmpCheckKey xHalIoWritePartitionTable FsRtlGetNextFileLock CmpOpenHiveFiles ObGetObjectInformation CcPerformReadAhead NtSetEaFile IopQueryDeviceConfiguration RtlpCoalesceFreeBlocks NtSetVolumeInformationFile MmAdjustWorkingSetSize RtlpLengthInheritedAce HvRefreshHive RtlpDeCommitFreeBlock CmpInitializeHiveList RtlQueryRegistryValues SeQuerySecurityDescriptorInfo MiGatherPagefilePages FsRtlCancelNotify NtQueryDirectoryObject NtUnlockFile PspSetQuotaLimits SepDuplicateToken IoSetInformation ExpGetProcessInformation IopGetSetSecurityObject ExRefreshTimeZoneInformation ExpSystemErrorHandler SeOpenObjectForDeleteAuditAlarm ExpGetPoolTagInfo FsRtlSetFileSize NtExtendSection CmBootLastKnownGood CmpCheckRegistry2 KeSwapProcessOrStack CcScheduleReadAhead HvpEnlistFreeCell NtNotifyChangeDirectoryFile MmSecureVirtualMemory MmCleanProcessAddressSpace SepAdtPrivilegeObjectAuditAlarm FsRtlCopyRead MiModifiedPageWriterWorker CmpHiveRootSecurityDescriptor NtPlugPlayControl MiDecommitPages ObpParseSymbolicLink NtNotifyChangeKey IopErrorLogThread MiRemoveWorkingSetPages PspSetContext ObpIncrementUnnamedHandleCount MiWriteComplete NtLoadKey2 RtlpCallQueryRegistryRoutine MiResolveImageReferences __ull_divrem_6416 RtlFindFirstRunClear RtlpGetIntegerAtom KeSetTimerEx NtQueueApcThread SepQueueWorkItem RtlpLengthInheritAcl PsLookupProcessThreadByCid RtlDeleteAtomFromAtomTable KiInitializeContextThread IoAsynchronousPageWrite NtCreateEventPair SeOpenObjectAuditAlarm CmpAddSubKey ObQueryNameString RtlMultiByteToUnicodeN FsRtlNotifyFullChangeDirectory CmpQueryKeyValueData FsRtlPrivateLock IopIsDeviceInstanceEnabled NtReplyWaitReplyPort CmpParseKey MmFlushVirtualMemory RtlAllocateAndInitializeSid PspProcessDelete SepProbeAndCaptureString_U MiSegmentDelete IopAssignResourcesPhase3 ObpProcessDosDeviceSymbolicLink PspGetContext CmpLoadHiveVolatile SepAdtPrivilegedServiceAuditAlarm MiResetVirtualMemory CmpSetSecurityDescriptorInfo MiDeleteVirtualAddresses ExpWaitForResource MmInSwapProcess CmpSetVersionData SepAdjustGroups IoRaiseInformationalHardError NtOpenProcess pIoQueryBusDescription NtRequestPort NtSetSystemEnvironmentValue HvpDoAllocateCell CmpQueryKeyData PsConvertToGuiThread NtOpenThread CcExtendVacbArray FsRtlSplitLargeMcb MiCheckForCrashDump MiInitializeWorkingSetList xHalIoSetPartitionInformation HvpBuildMapAndCopy MiSnapThunk LpcpCopyRequestData MiLockCode CmQueryMultipleValueKey RtlUnwind2 KdpReceivePacket NtUnloadDriver CmpWorker MiGetWorkingSetInfo RtlFindSetBits KdpSendWaitContinue RtlDecompressFragmentLZNT1 MiGrowWsleHash NtRaiseHardError memcmp CmpSetValueKeyNew NtSetTimer MiPurgeImageSection LdrEnumResources FsRtlAcknowledgeOplockBreak MiResolveTransitionFault MmOutPageKernelStack MiDeleteSystemPagableVm MiVerifyImageHeader CmpInitHiveFromFile CmpRefreshHive FsRtlPrivateCancelFileLockIrp MiFreeInitializationCode IoReportResourceUsage IopAcquireFileObjectLock MmCheckSystemImage RtlFindMessage PspUserThreadStartup CmpLinkHiveToMaster CmpFileRead RtlEmptyAtomTable MmUnlockPagableImageSection KeReleaseWaitForSemaphore FsRtlCancelExclusiveIrp CcPurgeCacheSection MiRemoveMappedPtes HvpBuildMap CmpSetValueKeyExisting MmMapViewInSystemSpace CmpRemoveSubKey MiCreatePagingFileMap MmInitializeProcessAddressSpace HvpDoWriteHive IopBuildResourceDir FsRtlMdlReadDev CmpNameFromAttributes NtQuerySystemEnvironmentValue CmpCopyKeyPartial MiDoMappedCopy MmMapVideoDisplay MiMapLockedPagesInUserSpace NtCreateSymbolicLinkObject MiRemoveNode SepAdtMarshallAuditRecord MiQueryAddressState NtStartProfile ExpWorkerThread NtCreateMutant NtCreateIoCompletion RtlDestroyHeap NtOpenKey NtQueryMultipleValueKey SeObjectReferenceAuditAlarm KeBugCheckEx MiCopyOnWrite MiAddWorkingSetPage CmpDoCreate SepAdjustPrivileges NtSetDefaultLocale FsRtlFastUnlockSingleShared HvpWriteLog MiDoPoolCopy ExpGetLookasideInformation ExpRaiseHardError CmDeleteValueKey NtFlushBuffersFile SepCreateServerAcl SeCaptureSecurityQos NtPrivilegedServiceAuditAlarm NtReplyPort IopQueryXxxInformation FsRtlOplockBreakToNone KdpTrap NtSignalAndWaitForSingleObject NtImpersonateClientOfPort RtlFreeHeap NtOpenThreadToken NtQuerySection RtlCutoverTimeToSystemTime CmpInitializeHive NtDuplicateToken PiFindDevInstMatch CmpAddToLeaf RtlCustomCPToUnicodeN NtCreatePort NtCreateProfile CcDeleteSharedCacheMap CmpCreateLinkNode NtProtectVirtualMemory KeDelayExecutionThread RtlpFindAndCommitPages ExpQueryModuleInformation MmCreatePeb CmpSaveKeyByFileCopy MmSetBankedSection HalpGetRegistryPartitionInformation MiResolveDemandZeroFault SeAuditProcessCreation IopGetDriverNameFromKeyNode MiChargeCommitment NtPrivilegeObjectAuditAlarm HvpFindNextDirtyBlock PsLockProcess MmCreateKernelStack RtlFreeHeapSlowly NtCreateThread NtAllocateUuids ExAcquireSharedWaitForExclusive RtlReserveChunkLZNT1 IopOpenRegistryKeyPersist MiInsertVad FsRtlProcessFileLock KdInitSystem HvpRecoverData CmpSelectLeaf IopTranslateResourceList NtSetSystemTime FsRtlUninitializeOplock IoBuildDeviceIoControlRequest CompareUnicodeStrings NtCreateSection IopRaiseHardError KiSwitchToThread CmSetValueKey FsRtlIsHpfsDbcsLegal RtlDispatchException NtCreateKey MiAttemptPageFileReduction IopQueryName MiReorderTree LpcRequestPort ExpWaitForResourceDdk KiNormalizeQuadword ExReleaseResourceForThreadLite NtQuerySymbolicLinkObject NtRemoveIoCompletion qsort ExRaiseHardError MmOutSwapProcess HvLoadHive SepRmCommandServerThreadInit IopCheckAndLogConflict SeAuditHandleDuplication RtlUnicodeStringToInteger MmMapViewOfSection KiGetRegisterValue64 SepAdtObjectReferenceAuditAlarm MiCalculatePageCommitment HvpGetHiveHeader RtlpExtendHeap NtDisplayString KiSetRegisterValue64 SepReferenceLogonSession CmpReportNotifyHelper HvMarkClean CmpFindSubKeyInLeaf KiOutSwapKernelStacks SeAccessCheck KiNormalizeLongword ExSnapShotHandleTables MiRemoveUnusedSegments RtlTimeFieldsToTime ObCheckObjectAccess PiDetectResourceConflict MiCheckControlAreaStatus CmpMarkIndexDirty RawQueryFsSizeInfo FsRtlRegisterUncProvider FsRtlPrivateCheckWaitingLocks RtlDecompressBufferLZNT1 MiDecrementCloneBlockReference CmpDoOpen RtlUnicodeToCustomCPN FsRtlAcquireFileForModWrite MiResolvePageFileFault KiGeneralException CmpGetSymbolicLink MiSetPagingOfDriver CmpCheckValueList MiCreatePebOrTeb LsaLogonUser FsRtlFastUnlockSingleExclusive FsRtlUninitializeFileLock MiRemoveMappedView RtlDecompressChunks RtlInitializeContext SeCaptureAcl IoConnectInterrupt MiEliminateWorkingSetEntry NtSetContextThread IoVerifyVolume CmpSplitLeaf CmpFindSubKeyInRoot KeInitializeThread MiSwapWslEntries NtGetContextThread SepAdtCloseObjectAuditAlarm SepAdtDeleteObjectAuditAlarm SePrivilegePolicyCheck IopAppendStringToValueKey KeStartProfile CmpCreateKeyControlBlock SepRmCallLsa RtlUnicodeToMultiByteN MiInsertInSystemSpace FsRtlPrivateInsertSharedLock MiAttemptPageFileExtension ObpCheckObjectReference DbgkCreateThread CompareNamesCaseSensitive MiGetPageProtection FsRtlInitializeLargeMcb RtlQueryAtomInAtomTable NtLoadDriver HvpCoalesceDiscardedBins ExQuerySystemLockInformation KeConnectInterrupt NtQueryValueKey IopServiceInstanceToDeviceInstance KiSystemServiceDispatch MiInsertWsle RtlRemoveUnicodePrefix NtCancelIoFile SeCaptureSid IoAllocateErrorLogEntry RtlLookupAtomInAtomTable RtlpAddKnownAce MiSetPageModified FsRtlAddLargeEntry MmCanFileBeTruncatedInternal ObpCheckTraverseAccess KdpReadPhysicalMemory CmpGetHiveName NtPrivilegeCheck SeCreateClientSecurity RtlZeroHeap IopIsDuplicatedDevices ExpTimeRefreshWork KiEmulateBranch MiCheckVirtualAddress KiScanReadyQueues CmpMarkKeyDirty IopApplyFunctionToSubKeys FsRtlSplitLocks SepCheckAcl RawDispatch KeContextToKframes HvFreeCell NtTerminateProcess FsRtlNotifyCompleteIrp IoShutdownSystem MiInsertPageFileInList HvCheckBin RtlInsertUnicodePrefix KeSetSystemTime MmDeleteKernelStack KdpSendPacket SepExamineSacl RtlCharToInteger MiModifiedPageWriter MiEmptyWorkingSet CcZeroEndOfLastPage MmInPageKernelStack RtlAddAtomToAtomTable LZNT1FindMatchStandard MiCompleteProtoPteFault xHalGetPartialGeometry KiInvalidOperationDouble PspGetSetContextSpecialApc SepProbeAndCaptureQosData CmReplaceKey SepDeReferenceLogonSession RawCreate RtlExpandEnvironmentStrings_U IopSlotResourceOwner FsRtlNotifyUpdateBuffer MiUnmapLockedPagesInUserSpace ExQueryPoolUsage MmLockPagableSectionByHandle RtlpCreateUnCommittedRange ExpAllocateHandleTable MiAccessCheck SepAuditFailed HvWriteHive CmpNotifyChangeKey SeAuditProcessExit RtlpInsertFreeBlock NtFlushVirtualMemory MiEnsureAvailablePageOrWait KiTimerListExpire MmFreeDriverInitialization FsRtlRequestOplockII PsChargePoolQuota SepValidOwnerSubjectContext MmUnsecureVirtualMemory LdrProcessRelocationBlock SepCreateImpersonationTokenDacl CmpAllocatePostBlock CmpFileWrite MmSetMemoryPriorityProcess MiExtendPagingFiles ObpLookupDirectoryEntry NtSetTimerResolution ExDupHandleTable IoMakeAssociatedIrp MmMapIoSpace MmGrowKernelStack IsValidOemCharacter RtlConvertSidToUnicodeString MiEmptyAllWorkingSets ObCheckCreateObjectAccess NtImpersonateThread IopOpenLinkOrRenameTarget CmSaveKey MmUnloadSystemImage HvMarkDirty CmpAddToHiveFileList SeCaptureLuidAndAttributesArray PiGenerateLegacyDeviceInstance LpcpExtendPortZone IoBuildAsynchronousFsdRequest KiContinueClientWait MiCheckForUserStackOverflow CmpInterlockedFunction KeGetBugMessageText KeSetAffinityThread MiMappedPageWriter HvpDelistFreeCell RtlSetTimeZoneInformation NtFlushInstructionCache MmGetFileNameForSection IopRemoveStringFromValueKey KiAttachProcess MiGetSubsectionAndProtoFromPte atol HvIsCellAllocated KeContextFromKframes MiDeleteValidAddress HvCheckHive ObpLogSecurityDescriptor MiFindEmptyAddressRangeDownTree RtlGetElementGenericTable __C_specific_handler __ll_div RtlpInitializeHeapSegment RtlpQuerySecurityDescriptor KeDisconnectInterrupt MiTrimWorkingSet MiFlushDirtyBitsToPfn __ll_rem NtSetValueKey ObReferenceObjectByName RtlUpperChar LpcpDestroyPortQueue IopPickupCollisionInTList NtCancelTimer RtlpGetRegistryHandle MmUnmapViewOfSection IopAssignResourcesPhase4 PspQueryWorkingSetWatch MmAllocateNonCachedMemory MiCheckPurgeAndUpMapCount NtReplaceKey RtlAddAce RtlFindUnicodePrefix FsRtlGetTunnelParameterValue KdpWriteIoSpace HvFreeHivePartial IopSynchronousServiceTail MmZeroPageThread RtlFindLongestRunSet KdpWritePhysicalMemory CmpCompareInIndex SepDeleteLogonSessionTrack PfxInsertPrefix NtReadVirtualMemory SepCreateLogonSessionTrack IoPageFileCreated ExpInsertPoolTracker KiInvalidUserAddress KiInvalidOperationSingle CmpCopyValue IopGetFileName IopCheckVpbMounted KiRaiseException CcUnpinRepinnedBcb KiScanBugCheckCallbackList NtShutdownSystem IopSortDescriptors IopOpenServiceEnumKeys RtlResetRtlTranslations PfxFindPrefix RtlUpcaseUnicodeStringToAnsiString ExAcquireResourceExclusive HalpCalculateChsValues NtCreateMailslotFile SepAdtInitializeBounds HvpGetLogHeader RtlLengthSecurityDescriptor ObInitProcess MiProcessValidPteList KeTerminateThread FsRtlInitializeTunnel IoDeleteDevice RtlAnsiStringToUnicodeString RtlpQueryRegistryDirect MiMapPageInHyperSpace RtlPrefixUnicodeString RtlpRestoreContext SepAdtInitializePrivilegeAuditing CmpFindMatchingDescriptorCell RtlIntegerToChar FsRtlGetFileSize NtQueryMutant xHalExamineMBR MiDeleteAddressesInWorkingSet MiFindEmptyAddressRangeInTree ObpIncrementHandleDataBase CmLoadKey NtTerminateThread GetNextWchar HalpGetRegistryCdromInformation ExpAllocateHandleTableEntries MiDereferenceSegmentThread RtlMakeSelfRelativeSD MmLockPagableDataSection FsRtlOpBatchBreakClosePending NtQueryTimer RtlValidSecurityDescriptor IopDisassociateThreadIrp RtlQueryTimeZoneInformation LdrpAccessResourceData MmGetPageFileInformation NtQueryInformationAtom MiChargeCommitmentCantExpand MmDeleteProcessAddressSpace MiHandleForkTransitionPte RtlpHashStringToAtom NtDeleteObjectAuditAlarm NtCloseObjectAuditAlarm RtlCompressBufferLZNT1 NtCreateEvent MmResetDriverPaging PsReturnPoolQuota RtlpLogExceptionHandler KeBalanceSetManager HvFreeHive HvReallocateCell SepPrivilegeCheck ObQueryTypeInfo HvpEnlistFreeCells SepInheritAcl ExEnumHandleTable RtlFindFirstRunSet KiVirtualMemoryDispatch SeAppendPrivileges ObOpenObjectByPointer ObpInsertHandleCount MiIsEntireRangeCommitted NtReleaseSemaphore KeStopProfile MiUpdateModifiedWriterMdls RtlFindLongestRunClear NtSetSecurityObject CmpAssignSecurityDescriptor CmpSecurityMethod NtSuspendThread NtCreateTimer MiCheckSecuredVad KdpAddBreakpoint KdpReceivePacketLeader CmNotifyRunDown RtlUnicodeStringToAnsiString NtQuerySemaphore KiSetPriorityThread MiMapImageHeaderInHyperSpace ObGetObjectSecurity SepAdtInitializeCrashOnFail CmpFreeKeyByCell CmpRemoveKeyControlBlockWithLock IopAssignResourcesPhase1 HalpCreateDosLink FsRtlPrivateInsertLock IoRaiseHardError ObpHandleDosDeviceName NtSystemDebugControl CmpPostNotify MiUnlinkFreeOrZeroedPage KeSetPriorityProcess KiUnpackDouble IopGenNextValidResourceList KeReleaseMutant MiAddMappedPtes NtQuerySecurityObject LsaRegisterLogonProcess FsRtlNotifyCleanup KdpWriteBreakPointEx KdpReportLoadSymbolsStateChange MiCheckDosCalls LpcpDeletePort NtCreateNamedPipeFile FsRtlDeleteKeyFromTunnelCache NtCreateSemaphore NtQueryEvent PspQueryQuotaLimits CcGetLsnForFileObject MiContractPagingFiles __ull_divrem_5353 CmpCopyTree2 SeFastTraverseCheck PspExitProcess NtWriteVirtualMemory NtQueryIoCompletion NtQueryFullAttributesFile IoRegisterFileSystem NtReleaseMutant PspQueryPooledQuotaLimits CcPurgeAndClearCacheSection IopHardErrorThread KdpReadIoSpace MiRemovePageFromWorkingSet SepAdtGenerateDiscardAudit ExLockUserBuffer KiGetRegisterValue RtlCompressChunks KdpPromptString CmpFindSubKeyByName NtDeleteValueKey RawUserFsCtrl RtlAddAuditAccessAce MiEnablePagingOfDriver RtlFormatCurrentUserKeyPath CmpInsertSecurityCellList NtUnloadKey SepApplyAclToObject RtlpInsertUnCommittedPages IopOpenCurrentHwProfileDeviceInstanceKey FsRtlOpFilterWorkerRoutine MiFreeWsle CcIsThereDirtyData ExTimerRundown MiRemoveVad CmpFindNameInList SeAssignWorldSecurityDescriptor RtlDescribeChunkLZNT1 CcPostDeferredWrites ExpRemovePoolTracker KiSetRegisterValue MiChargePageFileQuota MmCopyVirtualMemory HvpIsFreeNeighbor CmpReportNotify RtlDowncaseUnicodeString RtlOemStringToCountedUnicodeString IoQueryDeviceDescription IoQueryDeviceEnumInfo KdSetOwedBreakpoints SepVariableInitialization MmInitSystem IopInitializeDumpDrivers Phase1Initialization IopCreateArcNames ExpInitializeExecutive RtlCreateUserProcess ObInitSystem ObCreateObjectType PspInitPhase0 KiSystemBegin IoInitSystem CmpAddDriverToList SeMakeSystemToken KiInitializeKernel CmInitSystem1 CmpInitializeRegistryNode IopInitializeDeviceInstanceKey CcInitializeCacheManager CmGetSystemControlValues CmpCreateControlSet MiSectionInitialization IopInitializeBuiltinDriver RtlQueryEnvironmentVariable_U MiBuildPagedPool CmGetSystemDriverList CmpFindControlSet MiInitializeSystemCache MiInitializeSystemPtes IopCreateObjectTypes ObpGetDosDevicesProtection IopReassignSystemRoot ExpWorkerInitialization CmpCloneControlSet CreateSystemRootLink IopStoreSystemPartitionInformation MiFindInitializationCode IopInitializePlugPlayServices KiInitSystem InitializePool IopInitializeBootDrivers CmpSetupConfigurationTree RtlpCreateStack PsLocateSystemDll IopInitializeResourceMap IopApplySystemPartitionProt CmpFindDrivers ExInitializeTimeRefresh SeRmInitPhase1 MmFreeLoaderBlock SepInitSystemDacls FsRtlInitSystem CmpInitializeSystemHive FsRtlGetCompatibilityModeValue CmpSortDriverList RawInitialize CmpInitializeRegistryNames PiInitializeSystemEnumSubKeys IopMarkBootPartition ObpCreateDosDevicesDirectory ExBurnMemory KeFindConfigurationNextEntry CmpCreateRegistryRoot ExpInitSystemPhase0 CmpFindTagIndex IopLookupGroupName MiInitializeNonPagedPool CmpInitializeHardwareConfiguration MmInitializeMemoryLimits CmpDoSort LpcInitSystem MiMergeMemoryLimit CmpCreateObjectTypes LpcpInitializePortZone CmpCreateRootNode IopInitializeSystemDrivers RtlCreateUserThread ExpWin32Initialization SepInitializationPhase1 CmpIsLastKnownGoodBoot ExpInitSystemPhase1 SepInitializePrivilegeSets FsRtlInitializeWorkerThread IoReportHalResourceUsage LookupEntryPoint CmpIsLoadType IopInitServiceEnumList RtlDeNormalizeProcessParams SepTokenInitialization ExpProfileInitialization IopCheckDependencies IopProtectSystemPartition KiComputeReciprocal CmpOrderGroup CmpWalkPath IopCreateRootDirectories MiInitializeSystemSpaceMap ExpMutantInitialization SepRmDbInitialization ExpTimerInitialization ExpInitializePoolDescriptor PiInitPhase1 ExpEventInitialization ExpEventPairInitialization ExpSemaphoreInitialization CmpComputeGlobalQuotaAllowed CmpResolveDriverDependencies RtlpOpenImageFile PspLookupKernelUserEntryPoints SepInitializationPhase0 IopInitializeDeviceKey IopCreateEntry MiAdjustWorkingSetManagerParameters PspInitializeSystemDll IopRevertModuleList IopInitializeAttributesAndCreateObject PiInitializeSystemEnum CcInitializeVacbs IopFreeGroupTree CmpFreeDriverList ExInitializeHandleTablePackage PsInitSystem ExInitSystem ExComputeTickCountMultiplier PpInitSystem SeInitSystem RtlpFreeStack ExpResourceInitialization ExpUuidInitialization ExLuidInitialization SepInitializeWorkList ObpFreeDosDevicesProtection PspInitPhase1 PspLookupSystemDllEntryPoint ExInitSystemPhase2 KeFindConfigurationEntry PiInitPhase0 SepRmInitPhase0 KeInitSystem MiEnablePagingTheExecutive