ntoskrnl.exe - ntkrnlmp.exe - NT Kernel & System

filename	ntoskrnl.exe
size	12068328 (0xb825e8)
md5	42a130909c358ce63f80c1a9dd0a061d

type	PE32+ executable (native) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x110

Rich Header

lib id	version	times used
262	30795	47
257	30795	12
1	0	55
260	30095	1
259	30095	14
0	0	133
147	30729	27
269	30795	1640
261	30795	27
260	30795	126
259	30795	70
256	30795	1
255	30795	1
258	30795	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	0x22
TimeDateStamp	0xec7c6578
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.30
SizeOfCode	0x9c8000
SizeOfInitializedData	0x1d3000
SizeOfUninitializedData	0x348000
AddressOfEntryPoint	0xa85010
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x1047000
SizeOfHeaders	0x1000
CheckSum	0xb87e6c
Subsystem	1
DllCharacteristics	0x4160
SizeOfStackReserve	0x80000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.rdata	0x1000	0xcfbe0	0xd0000	R-- IDATA
.pdata	0xd1000	0x71f88	0x72000	R-- IDATA
.idata	0x143000	0x21ec	0x3000	R-- IDATA
.edata	0x146000	0x1a662	0x1b000	R-- IDATA
PROTDATA	0x161000	1	0x1000	R-- IDATA
GFIDS	0x162000	0xa1b4	0xb000	R-- IDATA DISCARDABLE
Pad1	0x16d000	0x93000	0	R-- UDATA DISCARDABLE
.text	0x200000	0x47bf3d	0x47c000	R-X CODE
PAGE	0x67c000	0x408586	0x409000	R-X CODE
PAGELK	0xa85000	0x26ea4	0x27000	R-X CODE
POOLCODE	0xaac000	0x10a9	0x2000	R-X CODE
PAGEKD	0xaae000	0x5ee8	0x6000	R-X CODE
PAGEVRFY	0xab4000	0x327fb	0x33000	R-X CODE
PAGEHDLS	0xae7000	0x2713	0x3000	R-X CODE
PAGEBGFX	0xaea000	0x6b0d	0x7000	R-X CODE
TRACESUP	0xaf1000	0x1903	0x2000	R-X CODE
PAGECMRC	0xaf3000	0xf77	0x1000	R-X CODE
KVASCODE	0xaf4000	0x243b	0x3000	R-X CODE
RETPOL	0xaf7000	0x760	0x1000	R-X CODE
INITKDBG	0xaf8000	0x19982	0x1a000	R-X CODE
MINIEX	0xb12000	0x25ae	0x3000	R-X CODE DISCARDABLE
INIT	0xb15000	0x95d34	0x96000	R-X CODE DISCARDABLE
Pad2	0xbab000	0x55000	0	R-X UDATA DISCARDABLE
.data	0xc00000	0x11bf18	0xe000	RW- IDATA
ALMOSTRO	0xd1c000	0x2b9b0	0x2000	RW- IDATA
CACHEALI	0xd48000	0x9040	0x1000	RW- IDATA
PAGEDATA	0xd52000	0x13120	0x2000	RW- IDATA
PAGEVRFD	0xd66000	0x19650	0xa000	RW- IDATA
INITDATA	0xd80000	0x1c5b4	0x1000	RW- CODE DISCARDABLE
Pad3	0xd9d000	0x63000	0	RW- UDATA DISCARDABLE
CFGRO	0xe00000	0x2030	0x3000	RW- IDATA
Pad4	0xe03000	0x1fd000	0	RW- UDATA DISCARDABLE
.rsrc	0x1000000	0x3be70	0x3c000	R-- IDATA DISCARDABLE
.reloc	0x103c000	0xa54c	0xb000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x146000	0x1a662
IMPORT	0x143678	0x190
RESOURCE	0x1000000	0x3be70
EXCEPTION	0xd1000	0x71f88
SECURITY	0xb80000	0x25e8
BASERELOC	0x103c000	0x59c8
DEBUG	0x159c8	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x6230	0x140
Bound_IAT	0	0
IAT	0x143000	0x648
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
BITMAP	#1	153706	1252
BITMAP	#2	554	1252
BITMAP	#3	1294	1252
BITMAP	#4	214	1252
BITMAP	#5	15982	1252
BITMAP	#6	17704	1252
BITMAP	#7	1066	1252
RCDATA	FUNCTIONEXTENTLIST	34842	1252
MESSAGETABLE	#1	18428	1252
VERSION	#1	924	1252

module_name	hint	function_name
ext-ms-win-ntos-processparameters-l1-1-0.dll		PsDestroyProcessParameterOverrides
ext-ms-win-ntos-processparameters-l1-1-0.dll	1	PsGetProcessParameterOverrides
ext-ms-win-ntos-tm-l1-1-0.dll	54	TmIsKTMCommitCoordinator
ext-ms-win-ntos-tm-l1-1-0.dll	53	TmInitializeTransactionManager
ext-ms-win-ntos-tm-l1-1-0.dll	50	TmGetTransactionId
ext-ms-win-ntos-tm-l1-1-0.dll	49	TmFreezeTransactions
ext-ms-win-ntos-tm-l1-1-0.dll	48	TmEndPropagationRequest
ext-ms-win-ntos-tm-l1-1-0.dll	47	TmEnableCallbacks
ext-ms-win-ntos-tm-l1-1-0.dll	46	TmDereferenceEnlistmentKey
ext-ms-win-ntos-tm-l1-1-0.dll	45	TmCurrentTransaction
ext-ms-win-ntos-tm-l1-1-0.dll	44	TmCreateEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	43	TmCommitTransaction
ext-ms-win-ntos-tm-l1-1-0.dll	42	TmCommitEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	41	TmCommitComplete
ext-ms-win-ntos-tm-l1-1-0.dll	40	TmCancelPropagationRequest
ext-ms-win-ntos-tm-l1-1-0.dll	39	NtThawTransactions
ext-ms-win-ntos-tm-l1-1-0.dll	36	NtSetInformationTransaction
ext-ms-win-ntos-tm-l1-1-0.dll	35	NtSetInformationResourceManager
ext-ms-win-ntos-tm-l1-1-0.dll	34	NtSetInformationEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	32	NtRollbackTransaction
ext-ms-win-ntos-tm-l1-1-0.dll	31	NtRollbackEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	30	NtRollbackComplete
ext-ms-win-ntos-tm-l1-1-0.dll	27	NtRecoverTransactionManager
ext-ms-win-ntos-tm-l1-1-0.dll	26	NtRecoverResourceManager
ext-ms-win-ntos-tm-l1-1-0.dll	25	NtRecoverEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	28	NtRegisterProtocolAddressInformation
ext-ms-win-ntos-tm-l1-1-0.dll	55	TmIsTransactionActive
ext-ms-win-ntos-tm-l1-1-0.dll	52	TmInitSystemPhase2
ext-ms-win-ntos-tm-l1-1-0.dll	51	TmInitSystem
ext-ms-win-ntos-tm-l1-1-0.dll		NtCommitComplete
ext-ms-win-ntos-tm-l1-1-0.dll	1	NtCommitEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	56	TmPrePrepareComplete
ext-ms-win-ntos-tm-l1-1-0.dll	63	TmRecoverEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	64	TmRecoverResourceManager
ext-ms-win-ntos-tm-l1-1-0.dll	65	TmRecoverTransactionManager
ext-ms-win-ntos-tm-l1-1-0.dll	66	TmReferenceEnlistmentKey
ext-ms-win-ntos-tm-l1-1-0.dll	67	TmRenameTransactionManager
ext-ms-win-ntos-tm-l1-1-0.dll	68	TmRequestOutcomeEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	69	TmRollbackComplete
ext-ms-win-ntos-tm-l1-1-0.dll	70	TmRollbackEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	71	TmRollbackTransaction
ext-ms-win-ntos-tm-l1-1-0.dll	72	TmSetCurrentTransaction
ext-ms-win-ntos-tm-l1-1-0.dll	74	TmSinglePhaseReject
ext-ms-win-ntos-tm-l1-1-0.dll	2	NtCommitTransaction
ext-ms-win-ntos-tm-l1-1-0.dll	73	TmShutdownSystem
ext-ms-win-ntos-tm-l1-1-0.dll	33	NtRollforwardTransactionManager
ext-ms-win-ntos-tm-l1-1-0.dll	38	NtSinglePhaseReject
ext-ms-win-ntos-tm-l1-1-0.dll	3	NtCreateEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	4	NtCreateResourceManager
ext-ms-win-ntos-tm-l1-1-0.dll	37	NtSetInformationTransactionManager
ext-ms-win-ntos-tm-l1-1-0.dll	29	NtRenameTransactionManager
ext-ms-win-ntos-tm-l1-1-0.dll	5	NtCreateTransaction
ext-ms-win-ntos-tm-l1-1-0.dll	75	TmThawTransactions
ext-ms-win-ntos-tm-l1-1-0.dll	6	NtCreateTransactionManager
ext-ms-win-ntos-tm-l1-1-0.dll	7	NtEnumerateTransactionObject
ext-ms-win-ntos-tm-l1-1-0.dll	8	NtFreezeTransactions
ext-ms-win-ntos-tm-l1-1-0.dll	9	NtGetNotificationResourceManager
ext-ms-win-ntos-tm-l1-1-0.dll	10	NtOpenEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	11	NtOpenResourceManager
ext-ms-win-ntos-tm-l1-1-0.dll	12	NtOpenTransaction
ext-ms-win-ntos-tm-l1-1-0.dll	13	NtOpenTransactionManager
ext-ms-win-ntos-tm-l1-1-0.dll	14	NtPrePrepareComplete
ext-ms-win-ntos-tm-l1-1-0.dll	57	TmPrePrepareEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	58	TmPrepareComplete
ext-ms-win-ntos-tm-l1-1-0.dll	59	TmPrepareEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	60	TmPropagationComplete
ext-ms-win-ntos-tm-l1-1-0.dll	62	TmReadOnlyEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	61	TmPropagationFailed
ext-ms-win-ntos-tm-l1-1-0.dll	24	NtReadOnlyEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	23	NtQueryInformationTransactionManager
ext-ms-win-ntos-tm-l1-1-0.dll	22	NtQueryInformationTransaction
ext-ms-win-ntos-tm-l1-1-0.dll	21	NtQueryInformationResourceManager
ext-ms-win-ntos-tm-l1-1-0.dll	20	NtQueryInformationEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	19	NtPropagationFailed
ext-ms-win-ntos-tm-l1-1-0.dll	18	NtPropagationComplete
ext-ms-win-ntos-tm-l1-1-0.dll	17	NtPrepareEnlistment
ext-ms-win-ntos-tm-l1-1-0.dll	16	NtPrepareComplete
ext-ms-win-ntos-tm-l1-1-0.dll	15	NtPrePrepareEnlistment
PSHED.dll	12	PshedGetBootErrorPacket
PSHED.dll	19	PshedInitialize
PSHED.dll	11	PshedGetAllErrorSources
PSHED.dll	2	PshedAttemptErrorRecovery
PSHED.dll	30	PshedWriteErrorRecord
PSHED.dll	3	PshedBugCheckSystem
PSHED.dll	10	PshedFreeMemory
PSHED.dll	7	PshedDoPluginCtl
PSHED.dll		PshedAllocateMemory
PSHED.dll	6	PshedDoPfa
PSHED.dll	8	PshedEnableErrorSource
PSHED.dll	15	PshedGetInjectionCapabilities
PSHED.dll	20	PshedInjectError
PSHED.dll	26	PshedSetErrorSourceInfo
PSHED.dll	27	PshedSetHalEnlightenments
PSHED.dll	22	PshedMarkHiberPhase
PSHED.dll	18	PshedInitProc
PSHED.dll	21	PshedIsSystemWheaEnabled
PSHED.dll	4	PshedClearErrorRecord
PSHED.dll	1	PshedArePluginsPresent
PSHED.dll	23	PshedReadErrorRecord
PSHED.dll	17	PshedInitGlobal
PSHED.dll	5	PshedDisableErrorSource
PSHED.dll	16	PshedInitAvailable
PSHED.dll	13	PshedGetErrorSourceInfo
PSHED.dll	9	PshedFinalizeErrorRecord
PSHED.dll	25	PshedRetrieveErrorInfo
BOOTVID.dll	6	VidInitialize
BOOTVID.dll	1	VidBitBltEx
BOOTVID.dll	4	VidDisplayString
BOOTVID.dll	9	VidSetScrollRegion
BOOTVID.dll	10	VidSetTextColor
BOOTVID.dll	3	VidCleanUp
BOOTVID.dll		VidBitBlt
BOOTVID.dll	8	VidScreenToBufferBlt
BOOTVID.dll	2	VidBufferToScreenBlt
BOOTVID.dll	11	VidSolidColorFill
BOOTVID.dll	7	VidResetDisplay
ext-ms-win-ntos-clipsp-l1-1-0.dll		ClipSpInitialize
kdcom.dll	4	KdSetHiberRange
kdcom.dll		KdInitialize
kdcom.dll	3	KdSendPacket
kdcom.dll	2	KdReceivePacket
kdcom.dll	1	KdPower
ext-ms-win-ntos-kcminitcfg-l1-1-0.dll		CmCompleteInitMachineConfig
ext-ms-win-ntos-kcminitcfg-l1-1-0.dll	1	CmSetInitMachineConfig
ext-ms-win-ntos-ksr-l1-1-4.dll	1	KsrCleanupPageDatabase
ext-ms-win-ntos-ksr-l1-1-4.dll	9	KsrInitPageDatabase
ext-ms-win-ntos-ksr-l1-1-4.dll	5	KsrFreePersistedMemory
ext-ms-win-ntos-ksr-l1-1-4.dll	10	KsrInitSystem
ext-ms-win-ntos-ksr-l1-1-4.dll	11	KsrMdlToMemoryRuns
ext-ms-win-ntos-ksr-l1-1-4.dll	6	KsrFreePersistedMemoryBlock
ext-ms-win-ntos-ksr-l1-1-4.dll	22	KsrQueryMetadata
ext-ms-win-ntos-ksr-l1-1-4.dll	3	KsrEnumeratePersistedMemory
ext-ms-win-ntos-ksr-l1-1-4.dll	7	KsrGetFirmwareInformation
ext-ms-win-ntos-ksr-l1-1-4.dll		KsrClaimPersistedMemory
ext-ms-win-ntos-ksr-l1-1-4.dll	20	KsrPersistMemoryWithMetadata
ext-ms-win-ntos-trace-l1-1-0.dll	3	TraceInitSystem
ext-ms-win-ntos-ksecurity-l1-1-1.dll		QueryUpdateFileEaAllowedExt
ext-ms-win-ntos-werkernel-l1-1-1.dll		WerLiveKernelCancelReport
ext-ms-win-ntos-werkernel-l1-1-1.dll	5	WerLiveKernelSubmitReport
ext-ms-win-ntos-werkernel-l1-1-1.dll	3	WerLiveKernelInitSystem
ext-ms-win-ntos-werkernel-l1-1-1.dll	2	WerLiveKernelCreateReport
ext-ms-win-ntos-werkernel-l1-1-1.dll	1	WerLiveKernelCloseHandle
ext-ms-win-ntos-werkernel-l1-1-1.dll	4	WerLiveKernelOpenDumpFile
ext-ms-win-ntos-ucode-l1-1-0.dll		ExpMicrocodeInformationLoad
ext-ms-win-ntos-ucode-l1-1-0.dll	1	ExpMicrocodeInformationUnload
ext-ms-win-ntos-ucode-l1-1-0.dll	2	ExpMicrocodeInitialization
ext-ms-win-ntos-runlevels-l1-1-0.dll		ExpInitializeRunLevel0
ext-ms-win-ntos-stateseparation-l1-1-0.dll	1	ExpInitializeStateSeparationPhase1
ext-ms-win-ntos-stateseparation-l1-1-0.dll		ExpInitializeStateSeparationPhase0
ext-ms-win-ntos-stateseparation-l1-1-0.dll	2	ExpInitializeStateSeparationPhase2
ext-ms-win-fs-clfs-l1-1-0.dll	35	ClfsMgmtInstallPolicy
ext-ms-win-fs-clfs-l1-1-0.dll	6	ClfsCloseLogFileObject
ext-ms-win-fs-clfs-l1-1-0.dll	33	ClfsMgmtDeregisterManagedClient
ext-ms-win-fs-clfs-l1-1-0.dll	37	ClfsMgmtRegisterManagedClient
ext-ms-win-fs-clfs-l1-1-0.dll	7	ClfsCreateLogFile
ext-ms-win-fs-clfs-l1-1-0.dll	20	ClfsGetLogFileInformation
ext-ms-win-fs-clfs-l1-1-0.dll	48	ClfsReadRestartArea
ext-ms-win-fs-clfs-l1-1-0.dll	27	ClfsLsnEqual
ext-ms-win-fs-clfs-l1-1-0.dll	45	ClfsReadLogRecord
ext-ms-win-fs-clfs-l1-1-0.dll	46	ClfsReadNextLogRecord
ext-ms-win-fs-clfs-l1-1-0.dll	57	ClfsTerminateReadLog
ext-ms-win-fs-clfs-l1-1-0.dll	58	ClfsWriteRestartArea
ext-ms-win-fs-clfs-l1-1-0.dll	10	ClfsDeleteLogByPointer
ext-ms-win-fs-clfs-l1-1-0.dll	12	ClfsDeleteMarshallingArea
ext-ms-win-fs-clfs-l1-1-0.dll	51	ClfsReserveAndAppendLog
ext-ms-win-fs-clfs-l1-1-0.dll	29	ClfsLsnInvalid
ext-ms-win-fs-clfs-l1-1-0.dll	16	ClfsFlushToLsn
ext-ms-win-fs-clfs-l1-1-0.dll	24	ClfsLsnContainer
ext-ms-win-fs-clfs-l1-1-0.dll	30	ClfsLsnLess
ext-ms-win-fs-clfs-l1-1-0.dll	8	ClfsCreateMarshallingArea
ext-ms-win-fs-clfs-l1-1-0.dll		ClfsAddLogContainer
ext-ms-win-fs-clfs-l1-1-0.dll	26	ClfsLsnDifference
CI.dll		CiInitialize
msrpc.sys	17	MesIncrementalHandleReset
msrpc.sys	45	NdrMesTypeDecode3
msrpc.sys	15	MesEncodeIncrementalHandleCreate
msrpc.sys	48	NdrMesTypeEncode3
msrpc.sys	11	MesDecodeBufferHandleCreate
msrpc.sys	16	MesHandleFree
msrpc.sys	64	RpcExceptionFilter
cng.sys	16	BCryptExportKey
ext-ms-win-ntos-globmerger-l1-1-0.dll		CimfsMountBootVolume

ord	entry_va	function_name
1	0x7572a0
2	0x4160d0
3	0x609a70
4	0x25bd70
5	0x54a550
6	0x241750
7	0x229460
8	0x976b70	AlpcCreateSecurityContext
9	0x93fc10
10	0x260dd0	AlpcGetHeaderSize
11	0x260d30	AlpcGetMessageAttribute
12	0x725590
13	0x740340
14	0x955b80
15	0x955cb0
16	0x7400e0
17	0x758580
18	0x260d70	AlpcInitializeMessageAttribute
19	0x416e50
20	0x71b0d0
21	0x71b2c0
22	0x758610
23	0x859200
24	0x9f7d30
25	0x38ae80
26	0x562b00	AsanWrapperMemcmp
27	0x71bb00
28	0x9f7b70
29	0xd1df78
30	0x9483e0
31	0x948bc0
32	0x557370
33	0x415d10
34	0x417290
35	0x418010
36	0x2d44c0
37	0x948c50
38	0x417b90
39	0x40e940
40	0xaeef90	BgkDisplayCharacter
41	0xaef060	BgkGetConsoleState
42	0xaef0b0	BgkGetCursorState
43	0xaef140	BgkSetCursor
44	0x5d1cb0	CarCopyRuleViolationDetails
45	0x5d1ef0	CarCreateRuleViolationDetails
46	0x5d2040	CarDeleteRuleViolationDetails
47	0x5d20a0	CarDeregisterRuleClassConfiguration
48	0x5d2140	CarDeregisterRuleOverride
49	0x5d2280	CarInitializeRuleViolationDetails
50	0x5d2450	CarQueryReportAction
51	0x5d2480	CarQueryReportActionForTriage
52	0x5d2560	CarRegisterDefaultRuleClassConfiguration
53	0x5d25c0	CarRegisterRuleClassConfiguration
54	0x5d2690	CarRegisterRuleOverride
55	0x5d2780	CarRegisterRuleOverrideAllContexts
56	0x5d2850	CarRegisterRuleOverridesAllContexts
57	0x5d28a0	CarReportRuleViolation
58	0x5d28e0	CarReportRuleViolationForTriage
59	0x5d2b30	CarSetCustomIdInRuleOverride
60	0x5d2b80	CarSetCustomRuleIdRange
61	0x3cd520	CcAddDirtyPagesToExternalCache
62	0x2d0600	CcAsyncCopyRead
63	0x2540b0	CcCanIWrite
64	0x205f10	CcCoherencyFlushAndPurgeCache
65	0x755900	CcCopyRead
66	0x2f9060	CcCopyReadEx
67	0x3a6ef0	CcCopyWrite
68	0x3326c0	CcCopyWriteEx
69	0x2741d0	CcCopyWriteWontFlush
70	0x3cd3b0	CcDeductDirtyPagesFromExternalCache
71	0x534d40	CcDeferWrite
72	0x534fd0	CcErrorCallbackRoutine
73	0x934e80	CcFastCopyRead
74	0x534ff0	CcFastCopyWrite
75	0xc5f648	CcFastMdlReadWait
76	0x2a1880	CcFlushCache
77	0x3d21f0	CcFlushCacheToLsn
78	0x535250	CcGetCachedDirtyPageCountForFile
79	0x2c7540	CcGetDirtyPages
80	0x533070	CcGetFileObjectFromBcb
81	0x533090	CcGetFileObjectFromSectionPtrs
82	0x533160	CcGetFileObjectFromSectionPtrsRef
83	0x2071a0	CcGetFlushedValidData
84	0x535270	CcGetLsnForFileObject
85	0x3d4330	CcGetNumberOfMappedPages
86	0x2b57e0	CcInitializeCacheMap
87	0x533230	CcInitializeCacheMapEx
88	0x29d5b0	CcInitializeCacheMapEx2
89	0x288a50	CcIsCacheManagerCallbackNeeded
90	0x3aaa60	CcIsThereDirtyData
91	0x535330	CcIsThereDirtyDataEx
92	0x28f0e0	CcIsThereDirtyLoggedPages
93	0x784030	CcMapData
94	0x781b10	CcMdlRead
95	0x74c4e0	CcMdlReadComplete
96	0x5362b0	CcMdlWriteAbort
97	0x7574c0	CcMdlWriteComplete
98	0x783e70	CcPinMappedData
99	0x7838e0	CcPinRead
100	0x2b4380	CcPrepareMdlWrite
101	0x68a4c0	CcPreparePinWrite
102	0x206f20	CcPurgeCacheSection
103	0x3d4870	CcRegisterExternalCache
104	0x279580	CcRemapBcb
105	0x3a6f20	CcRepinBcb
106	0x5351e0	CcScheduleReadAhead
107	0x26c1b0	CcScheduleReadAheadEx
108	0x29a0f0	CcSetAdditionalCacheAttributes
109	0x299fe0	CcSetAdditionalCacheAttributesEx
110	0x934f10	CcSetBcbOwnerPointer
111	0x533260	CcSetDirtyPageThreshold
112	0x2190c0	CcSetDirtyPinnedData
113	0x204910	CcSetFileSizes
114	0x205a30	CcSetFileSizesEx
115	0x535480	CcSetLogHandleForFile
116	0x29d2a0	CcSetLogHandleForFileEx
117	0x3c43b0	CcSetLoggedDataThreshold
118	0x2956d0	CcSetParallelFlushFile
119	0x2a05d0	CcSetReadAheadGranularity
120	0x535200	CcSetReadAheadGranularityEx
121	0x3b5300	CcTestControl
122	0x2d2ad0	CcUninitializeCacheMap
123	0x3c1a00	CcUnmapFileOffsetFromSystemCache
124	0x783860	CcUnpinData
125	0x934f70	CcUnpinDataForThread
126	0x392a90	CcUnpinRepinnedBcb
127	0x534cb0	CcUnregisterExternalCache
128	0x3d4b00	CcWaitForCurrentLazyWriterActivity
129	0x218240	CcZeroData
130	0x3bf150	CcZeroDataOnDisk
131	0x8a0470	CmCallbackGetKeyObjectID
132	0x6b2720	CmCallbackGetKeyObjectIDEx
133	0x6b2870	CmCallbackReleaseKeyObjectIDEx
134	0x7522c0	CmGetBoundTransaction
135	0xa0d390	CmGetCallbackVersion
136	0xd1da70	CmKeyObjectType
137	0x846640	CmRegisterCallback
138	0x8465a0	CmRegisterCallbackEx
139	0x811880	CmRegisterMachineHiveLoadedNotification
140	0x6fde60	CmSetCallbackObjectContext
141	0xa0d3b0	CmUnRegisterCallback
142	0xa0d7b0	CmUnregisterMachineHiveLoadedNotification
143	0x422790	DbgBreakPoint
144	0x4227b0	DbgBreakPointWithStatus
145	0x5a5bd0	DbgCommandString
146	0x2bac60	DbgLoadImageSymbols
147	0x262450	DbgPrint
148	0x2624a0	DbgPrintEx
149	0x5a5c70	DbgPrintReturnControlC
150	0x5a5cc0	DbgPrompt
151	0x5a5d10	DbgQueryDebugFilterState
152	0x391b80	DbgSetDebugFilterState
153	0x5a5d30	DbgSetDebugPrintCallback
154	0x838a90	DbgkLkmdRegisterCallback
155	0x938ff0	DbgkLkmdUnregisterCallback
156	0x877f90	DbgkWerCaptureLiveKernelDump
157	0x878010	DbgkWerCaptureLiveKernelDump2
158	0x5d2bc0	DifFindThreadContextData
159	0x5d2f70	DifGetPluginPerDriverData
160	0x5d2fc0	DifPluginSimplePerfControl
161	0x5d2c20	DifPopThreadContextData
162	0x5d2d10	DifPushThreadContextData
163	0x5d3590	DifRegisterPlugin
164	0x5d3060	DifUtilDbgPrint
165	0xa856b0	EmClientQueryRuleState
166	0x93a6c0	EmClientRuleDeregisterNotification
167	0xa857a0	EmClientRuleEvaluate
168	0x93a7a0	EmClientRuleRegisterNotification
169	0x93aa10	EmProviderDeregister
170	0x93abc0	EmProviderDeregisterEntry
171	0x810810	EmProviderRegister
172	0x93ac20	EmProviderRegisterEntry
173	0x810880	EmpProviderRegister
174	0x25e8a0	EtwActivityIdControl
175	0x80d4a0	EtwEnableTrace
176	0x2dd660	EtwEventEnabled
177	0x2218b0	EtwProviderEnabled
178	0x6ddaf0	EtwRegister
179	0x6ddaa0	EtwRegisterClassicProvider
180	0x5fd720	EtwSendTraceBuffer
181	0x743080	EtwSetInformation
182	0x2af5e0	EtwTelemetryCoverageReport
183	0x72e5a0	EtwUnregister
184	0x2dcad0	EtwWrite
185	0x839e40	EtwWriteEndScenario
186	0x2dd420	EtwWriteEx
187	0x852f10	EtwWriteStartScenario
188	0x5fd3c0	EtwWriteString
189	0x299970	EtwWriteTransfer
190	0x2b8610	EtwpDisableStackWalkApc
191	0x2b86d0	EtwpReenableStackWalkApc
192	0x22a4d0	ExAcquireAutoExpandPushLockExclusive
193	0x22b580	ExAcquireAutoExpandPushLockShared
194	0x2eaa60	ExAcquireCacheAwarePushLockExclusive
195	0x40eff0	ExAcquireCacheAwarePushLockExclusiveEx
196	0x22b900	ExAcquireCacheAwarePushLockSharedEx
197	0x22b3e0	ExAcquireFastMutex
198	0x21f110	ExAcquireFastMutexUnsafe
199	0x3c8210	ExAcquireFastResourceExclusive
200	0x3c75d0	ExAcquireFastResourceShared
201	0x3c7d30	ExAcquireFastResourceSharedStarveExclusive
202	0x40f100	ExAcquireFastResourceWithFlags
203	0x22bcf0	ExAcquirePushLockExclusiveEx
204	0x22ba50	ExAcquirePushLockSharedEx
205	0x233dd0	ExAcquireResourceExclusiveLite
206	0x238370	ExAcquireResourceSharedLite
207	0x26c180	ExAcquireRundownProtection
208	0x26c130	ExAcquireRundownProtectionCacheAware
209	0x25a0f0	ExAcquireRundownProtectionCacheAwareEx
210	0x36fda0	ExAcquireRundownProtectionEx
211	0x295270	ExAcquireSharedStarveExclusive
212	0x3c6da0	ExAcquireSharedWaitForExclusive
213	0x248140	ExAcquireSpinLockExclusive
214	0x31ec20	ExAcquireSpinLockExclusiveAtDpcLevel
215	0x2c3c80	ExAcquireSpinLockShared
216	0x2f2070	ExAcquireSpinLockSharedAtDpcLevel
217	0xd1de50	ExActivationObjectType
218	0x3cd350	ExAllocateAutoExpandPushLock
219	0x3a5e00	ExAllocateCacheAwarePushLock
220	0x6e1b90	ExAllocateCacheAwareRundownProtection
221	0x227e10	ExAllocateFromLookasideListEx
222	0x21f510	ExAllocateFromNPagedLookasideList
223	0x21f510	ExAllocateFromPagedLookasideList
224	0x2665c0	ExAllocatePool
225	0xaac7a0	ExAllocatePool2
226	0xaac520	ExAllocatePool3
227	0x6051b0	ExAllocatePoolWithQuota
228	0x278070	ExAllocatePoolWithQuotaTag
229	0xaac010	ExAllocatePoolWithTag
230	0x29a790	ExAllocatePoolWithTagPriority
231	0x25bd40	ExAllocateTimer
232	0x260980	ExBlockOnAddressPushLock
233	0x260a40	ExBlockPushLock
234	0x60a430	ExCancelDpcEventWait
235	0x25c490	ExCancelTimer
236	0x219ef0	ExCleanupAutoExpandPushLock
237	0x2b9030	ExCleanupRundownProtectionCacheAware
238	0xd1de38	ExCompositionObjectType
239	0x293670	ExConvertExclusiveToSharedLite
240	0x6080e0	ExConvertFastResourceExclusiveToShared
241	0x40efd0	ExConvertPushLockExclusiveToShared
242	0xd1de58	ExCoreMessagingObjectType
243	0x748bb0	ExCreateCallback
244	0x60a450	ExCreateDpcEvent
245	0x6051e0	ExCreatePool
246	0x60a560	ExDeleteDpcEvent
247	0x3d2430	ExDeleteFastResource
248	0x2a2ad0	ExDeleteLookasideListEx
249	0x3c4710	ExDeleteNPagedLookasideList
250	0x2a2a50	ExDeletePagedLookasideList
251	0x32b030	ExDeleteResourceLite
252	0x25c0c0	ExDeleteTimer
253	0xd1de40	ExDesktopObjectType
254	0x6053d0	ExDestroyPool
255	0x3c0af0	ExDisableResourceBoostLite
256	0x3ca850	ExDisownFastResource
257	0x21f0e0	ExEnterCriticalRegionAndAcquireFastMutexUnsafe
258	0x27b000	ExEnterCriticalRegionAndAcquireResourceExclusive
259	0x2843d0	ExEnterCriticalRegionAndAcquireResourceShared
260	0x4652b0	ExEnterCriticalRegionAndAcquireSharedWaitForExclusive
261	0x608f20	ExEnterPriorityRegionAndAcquireResourceExclusive
262	0x284a00	ExEnterPriorityRegionAndAcquireResourceShared
263	0x71a810	ExEnumHandleTable
264	0x9f4000	ExEnumerateSystemFirmwareTables
265	0xd1db18	ExEventObjectType
266	0x60a5d0	ExExtendZone
267	0x9f7820	ExFetchLicenseData
268	0x2a2b10	ExFlushLookasideListEx
269	0x3cd4c0	ExFreeAutoExpandPushLock
270	0x607e80	ExFreeCacheAwarePushLock
271	0x25a080	ExFreeCacheAwareRundownProtection
272	0xaac050	ExFreePool
273	0x6053f0	ExFreePool2
274	0xaac200	ExFreePoolWithTag
275	0x261a30	ExFreeToLookasideListEx
276	0x325920	ExFreeToNPagedLookasideList
277	0x325920	ExFreeToPagedLookasideList
278	0x290670	ExGetCurrentProcessorCounts
279	0x465070	ExGetCurrentProcessorCpuUsage
280	0x3bcf30	ExGetExclusiveWaiterCount
281	0x746690	ExGetFirmwareEnvironmentVariable
282	0x3b4d90	ExGetFirmwareType
283	0x9f7990	ExGetLicenseTamperState
284	0x25ea20	ExGetPreviousMode
285	0x3be4b0	ExGetSharedWaiterCount
286	0x855ed0	ExGetSystemFirmwareTable
287	0x284870	ExInitializeAutoExpandPushLock
288	0x60a7e0	ExInitializeDeviceAts
289	0x28b520	ExInitializeFastOwnerEntry
290	0x3c2930	ExInitializeFastResource
291	0x40f690	ExInitializeFastResourceAcquired
292	0x216120	ExInitializeLookasideListEx
293	0x3c0cd0	ExInitializeNPagedLookasideList
294	0x7428b0	ExInitializePagedLookasideList
295	0x2d6d70	ExInitializePushLock
296	0x368e70	ExInitializeResourceLite
297	0x2d6d70	ExInitializeRundownProtection
298	0x6e1af0	ExInitializeRundownProtectionCacheAware
299	0x2b9030	ExInitializeRundownProtectionCacheAwareEx
300	0x60a640	ExInitializeZone
301	0x60af80	ExInterlockedAddLargeInteger
302	0x3ccbd0	ExInterlockedAddUlong
303	0x60a6c0	ExInterlockedExtendZone
304	0x29c250	ExInterlockedInsertHeadList
305	0x2776d0	ExInterlockedInsertTailList
306	0x60b010	ExInterlockedPopEntryList
307	0x60b0a0	ExInterlockedPushEntryList
308	0x26c990	ExInterlockedRemoveHeadList
309	0x608270	ExIsFastResourceContended
310	0x3c88e0	ExIsFastResourceHeld
311	0x3c8770	ExIsFastResourceHeldExclusive
312	0x747640	ExIsManufacturingModeEnabled
313	0x2af950	ExIsProcessorFeaturePresent
314	0x26b8e0	ExIsResourceAcquiredExclusiveLite
315	0x34cd90	ExIsResourceAcquiredSharedLite
316	0x382c40	ExIsSoftBoot
317	0x2890d0	ExLocalTimeToSystemTime
318	0x40f6d0	ExMoveFastResourceOwnershipWithFlags
319	0x6079d0	ExNotifyBootDeviceRemoval
320	0x28afb0	ExNotifyCallback
321	0x27b1b0	ExQueryDepthSList
322	0x74ead0	ExQueryFastCacheDevLicense
323	0x605ef0	ExQueryPoolBlockSize
324	0x3b4ff0	ExQueryTimerResolution
325	0x74eee0	ExQueryWnfStateData
326	0x60a590	ExQueueDpcEventWait
327	0x3269e0	ExQueueWorkItem
328	0x86ab90	ExRaiseAccessViolation
329	0x9fedf0	ExRaiseDatatypeMisalignment
330	0x2ec100	ExRaiseException
331	0x9fee10	ExRaiseHardError
332	0x259c40	ExRaiseStatus
333	0xd1de60	ExRawInputManagerObjectType
334	0x2aa6b0	ExReInitializeRundownProtection
335	0x25a560	ExReInitializeRundownProtectionCacheAware
336	0x2890b0	ExRealTimeIsUniversal
337	0x607a20	ExRegisterBootDevice
338	0x2b1fa0	ExRegisterCallback
339	0x804790	ExRegisterExtension
340	0x3d3c50	ExReinitializeFastResource
341	0x27fbd0	ExReinitializeResourceLite
342	0x22a620	ExReleaseAutoExpandPushLockExclusive
343	0x22b770	ExReleaseAutoExpandPushLockShared
344	0x2eb8f0	ExReleaseCacheAwarePushLockExclusive
345	0x40f040	ExReleaseCacheAwarePushLockExclusiveEx
346	0x2eba00	ExReleaseCacheAwarePushLockSharedEx
347	0x3c8da0	ExReleaseDisownedFastResource
348	0x6082f0	ExReleaseDisownedFastResourceExclusive
349	0x608410	ExReleaseDisownedFastResourceShared
350	0x22b520	ExReleaseFastMutex
351	0x21f0a0	ExReleaseFastMutexUnsafe
352	0x21f070	ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
353	0x3c92a0	ExReleaseFastResource
354	0x608540	ExReleaseFastResourceExclusive
355	0x608690	ExReleaseFastResourceShared
356	0x22be50	ExReleasePushLockEx
357	0x22bec0	ExReleasePushLockExclusiveEx
358	0x22afa0	ExReleasePushLockSharedEx
359	0x2f7790	ExReleaseResourceAndLeaveCriticalRegion
360	0x608f80	ExReleaseResourceAndLeavePriorityRegion
361	0x2f7070	ExReleaseResourceForThreadLite
362	0x238100	ExReleaseResourceLite
363	0x279c90	ExReleaseRundownProtection
364	0x26d6b0	ExReleaseRundownProtectionCacheAware
365	0x2deed0	ExReleaseRundownProtectionCacheAwareEx
366	0x4652f0	ExReleaseRundownProtectionEx
367	0x284340	ExReleaseSpinLockExclusive
368	0x320ab0	ExReleaseSpinLockExclusiveFromDpcLevel
369	0x282c60	ExReleaseSpinLockShared
370	0x2f0fe0	ExReleaseSpinLockSharedFromDpcLevel
371	0x25f410	ExRundownCompleted
372	0x25a5b0	ExRundownCompletedCacheAware
373	0x60b450	ExSecurePoolUpdate
374	0x60b4a0	ExSecurePoolValidate
375	0xd1c298	ExSemaphoreObjectType
376	0x9f9ca0	ExSetFirmwareEnvironmentVariable
377	0x9f7a50	ExSetLicenseTamperState
378	0x20e9e0	ExSetResourceOwnerPointer
379	0x20e9a0	ExSetResourceOwnerPointerEx
380	0x25c400	ExSetTimer
381	0x3b3380	ExSetTimerResolution
382	0x9ff8f0	ExShareAddressSpaceWithDevice
383	0x9ff910	ExShareUltraSpaceWithDevice
384	0x2843a0	ExSizeOfAutoExpandPushLock
385	0x86b0a0	ExSizeOfRundownProtectionCacheAware
386	0x7472a0	ExSubscribeWnfStateChange
387	0x60b620	ExSvmBeginDeviceReset
388	0x60b7f0	ExSvmFinalizeDeviceReset
389	0x85af80	ExSystemExceptionFilter
390	0x289120	ExSystemTimeToLocalTime
391	0x260a60	ExTimedWaitForUnblockPushLock
392	0xd1dd10	ExTimerObjectType
393	0x3ccc60	ExTryAcquireAutoExpandPushLockExclusive
394	0x3cbed0	ExTryAcquireAutoExpandPushLockShared
395	0x607ef0	ExTryAcquireCacheAwarePushLockExclusiveEx
396	0x607fc0	ExTryAcquireCacheAwarePushLockSharedEx
397	0x26ce80	ExTryAcquirePushLockExclusiveEx
398	0x26cd30	ExTryAcquirePushLockSharedEx
399	0x2c16d0	ExTryAcquireSpinLockExclusiveAtDpcLevel
400	0x465360	ExTryAcquireSpinLockSharedAtDpcLevel
401	0x2923e0	ExTryConvertPushLockSharedToExclusiveEx
402	0x3c5170	ExTryConvertSharedSpinLockExclusive
403	0x2d4210	ExTryQueueWorkItem
404	0x28c420	ExTryToAcquireFastMutex
405	0x609000	ExTryToAcquireResourceExclusiveLite
406	0x6087f0	ExTryToConvertFastResourceSharedToExclusive
407	0x3d3210	ExUnblockOnAddressPushLockEx
408	0x22a430	ExUnblockPushLockEx
409	0x2b93c0	ExUnregisterCallback
410	0x9ff690	ExUnregisterExtension
411	0x74df50	ExUnsubscribeWnfStateChange
412	0x7585c0	ExUpdateLicenseData
413	0x7d1720	ExUuidCreate
414	0x3a4730	ExVerifySuite
415	0x2d62e0	ExWaitForRundownProtectionRelease
416	0x25a4a0	ExWaitForRundownProtectionReleaseCacheAware
417	0x608080	ExWaitForUnblockPushLock
418	0xd1de48	ExWindowStationObjectType
419	0x219940	ExfAcquirePushLockExclusive
420	0x219b70	ExfAcquirePushLockShared
421	0x2ebca0	ExfReleasePushLock
422	0x2ebd80	ExfReleasePushLockExclusive
423	0x2ebcd0	ExfReleasePushLockShared
424	0x6080a0	ExfTryAcquirePushLockShared
425	0x2ebdd0	ExfTryToWakePushLock
426	0x40f0e0	ExfUnblockPushLock
427	0x4228b0	ExpInterlockedFlushSList
428	0x422830	ExpInterlockedPopEntrySList
429	0x422870	ExpInterlockedPushEntrySList
430	0x422820	FirstEntrySList
431	0x68a850	FsRtlAcknowledgeEcp
432	0x221250	FsRtlAcquireEofLock
433	0x7a4820	FsRtlAcquireFileExclusive
434	0x22af00	FsRtlAcquireHeaderMutex
435	0x288380	FsRtlAddBaseMcbEntry
436	0x2883a0	FsRtlAddBaseMcbEntryEx
437	0x287d90	FsRtlAddLargeMcbEntry
438	0x53a3a0	FsRtlAddMcbEntry
439	0x93bd70	FsRtlAddToTunnelCache
440	0x712df0	FsRtlAddToTunnelCacheEx
441	0x53a860	FsRtlAllocateAePushLock
442	0x69b420	FsRtlAllocateExtraCreateParameter
443	0x7911d0	FsRtlAllocateExtraCreateParameterFromLookasideList
444	0x791170	FsRtlAllocateExtraCreateParameterList
445	0x2b4330	FsRtlAllocateFileLock
446	0x53b480	FsRtlAllocatePool
447	0x53b4b0	FsRtlAllocatePoolWithQuota
448	0x53b4e0	FsRtlAllocatePoolWithQuotaTag
449	0x53b510	FsRtlAllocatePoolWithTag
450	0x93b060	FsRtlAllocateResource
451	0x267cb0	FsRtlAreNamesEqual
452	0x53ab50	FsRtlAreThereCurrentOrInProgressFileLocks
453	0x4591a0	FsRtlAreThereWaitingFileLocks
454	0x752080	FsRtlAreVolumeStartupApplicationsComplete
455	0x86baa0	FsRtlBalanceReads
456	0x7600c0	FsRtlCancellableWaitForMultipleObjects
457	0x75fe70	FsRtlCancellableWaitForSingleObject
458	0x3d4230	FsRtlChangeBackingFileObject
459	0x53ab80	FsRtlCheckLockForOplockRequest
460	0x274b20	FsRtlCheckLockForReadAccess
461	0x274bb0	FsRtlCheckLockForWriteAccess
462	0x21af50	FsRtlCheckOplock
463	0x21a240	FsRtlCheckOplockEx
464	0x21a290	FsRtlCheckOplockEx2
465	0x67c390	FsRtlCheckOplockForFsFilterCallback
466	0x93bf30	FsRtlCheckUpperOplock
467	0x93b0c0	FsRtlCopyRead
468	0x845400	FsRtlCopyWrite
469	0x2205b0	FsRtlCreateSectionForDataScan
470	0x725520	FsRtlCurrentBatchOplock
471	0x3d4210	FsRtlCurrentOplock
472	0x879bc0	FsRtlCurrentOplockH
473	0x93c960	FsRtlDedupChangeInit
474	0x93ca50	FsRtlDedupChangeLogOverwriteOrFree
475	0x93ca90	FsRtlDedupChangeLogWrite
476	0x93cae0	FsRtlDedupChangeUninit
477	0x93b090	FsRtlDeleteExtraCreateParameterLookasideList
478	0x712850	FsRtlDeleteKeyFromTunnelCache
479	0x869a10	FsRtlDeleteTunnelCache
480	0x93bdf0	FsRtlDeregisterUncProvider
481	0x40d520	FsRtlDisallowLegacyFilterOnDevice
482	0x87a6a0	FsRtlDismountComplete
483	0x93d2b0	FsRtlDissectDbcs
484	0x26caf0	FsRtlDissectName
485	0x899820	FsRtlDoesDbcsContainWildCards
486	0x28e8c0	FsRtlDoesNameContainWildCards
487	0x274e00	FsRtlFastCheckLockForRead
488	0x274ca0	FsRtlFastCheckLockForWrite
489	0x269c10	FsRtlFastUnlockAll
490	0x53acf0	FsRtlFastUnlockAllByKey
491	0x26a290	FsRtlFastUnlockSingle
492	0x68a880	FsRtlFindExtraCreateParameter
493	0x93bdb0	FsRtlFindInTunnelCache
494	0x713120	FsRtlFindInTunnelCacheEx
495	0x53a8a0	FsRtlFreeAePushLock
496	0x7b3bb0	FsRtlFreeExtraCreateParameter
497	0x7b3b30	FsRtlFreeExtraCreateParameterList
498	0x2b60a0	FsRtlFreeFileLock
499	0x93d000	FsRtlGetCurrentProcessLoaderList
500	0x68a860	FsRtlGetEcpListFromIrp
501	0x7478d0	FsRtlGetFileNameInformation
502	0x6833b0	FsRtlGetFileSize
503	0x220b70	FsRtlGetIoAtEof
504	0x28dc50	FsRtlGetNextBaseMcbEntry
505	0x876ba0	FsRtlGetNextExtraCreateParameter
506	0x53ad60	FsRtlGetNextFileLock
507	0x3a4520	FsRtlGetNextLargeMcbEntry
508	0x53a3c0	FsRtlGetNextMcbEntry
509	0x8647d0	FsRtlGetSectorSizeInformation
510	0x282cf0	FsRtlGetSupportedFeatures
511	0x3c1ae0	FsRtlGetVirtualDiskNestingLevel
512	0x93dbe0	FsRtlHeatInit
513	0x93dd20	FsRtlHeatLogIo
514	0x93de00	FsRtlHeatLogTierMove
515	0x93de60	FsRtlHeatUninit
516	0x3d1da0	FsRtlIncrementCcFastMdlReadWait
517	0x53a2f0	FsRtlIncrementCcFastReadNoWait
518	0x7588b0	FsRtlIncrementCcFastReadNotPossible
519	0x53a300	FsRtlIncrementCcFastReadResourceMiss
520	0x72c890	FsRtlIncrementCcFastReadWait
521	0x84e320	FsRtlInitExtraCreateParameterLookasideList
522	0x53a440	FsRtlInitializeBaseMcb
523	0x296b90	FsRtlInitializeBaseMcbEx
524	0x2910e0	FsRtlInitializeEofLock
525	0x753d80	FsRtlInitializeExtraCreateParameter
526	0x755640	FsRtlInitializeExtraCreateParameterList
527	0x3c5320	FsRtlInitializeFileLock
528	0x296b20	FsRtlInitializeLargeMcb
529	0x93bd30	FsRtlInitializeMcb
530	0x7f26e0	FsRtlInitializeOplock
531	0x869760	FsRtlInitializeTunnelCache
532	0x7b1770	FsRtlInsertExtraCreateParameter
533	0x2ae2b0	FsRtlInsertPerFileContext
534	0x21a010	FsRtlInsertPerFileObjectContext
535	0x279750	FsRtlInsertPerStreamContext
536	0x93d030	FsRtlIs32BitProcess
537	0x53a310	FsRtlIsDaxVolume
538	0x93d390	FsRtlIsDbcsInExpression
539	0x723f10	FsRtlIsEcpAcknowledged
540	0x72e920	FsRtlIsEcpFromUserMode
541	0x93d060	FsRtlIsExtentDangling
542	0x722d20	FsRtlIsFatDbcsLegal
543	0x93da00	FsRtlIsHpfsDbcsLegal
544	0x8017d0	FsRtlIsMobileOS
545	0x2d4910	FsRtlIsNameInExpression
546	0x2d4a90	FsRtlIsNameInUnUpcasedExpression
547	0x2abb00	FsRtlIsNonEmptyDirectoryReparsePointAllowed
548	0x2a36f0	FsRtlIsNtstatusExpected
549	0x28bfa0	FsRtlIsPagingFile
550	0x53a8d0	FsRtlIsSystemPagingFile
551	0x28cd80	FsRtlIsTotalDeviceFailure
552	0x864be0	FsRtlIssueDeviceIoControl
553	0x75dbc0	FsRtlKernelFsControlFile
554	0xac30	FsRtlLegalAnsiCharacterArray
555	0x93b440	FsRtlLogCcFlushError
556	0x26cbb0	FsRtlLookupBaseMcbEntry
557	0x3a09c0	FsRtlLookupLargeMcbEntry
558	0x291050	FsRtlLookupLastBaseMcbEntry
559	0x2a9f50	FsRtlLookupLastBaseMcbEntryAndIndex
560	0x53a460	FsRtlLookupLastLargeMcbEntry
561	0x3aa890	FsRtlLookupLastLargeMcbEntryAndIndex
562	0x53a4e0	FsRtlLookupLastMcbEntry
563	0x53a540	FsRtlLookupMcbEntry
564	0x2b3ea0	FsRtlLookupPerFileContext
565	0x268ff0	FsRtlLookupPerFileObjectContext
566	0x22b000	FsRtlLookupPerStreamContextInternal
567	0x756cf0	FsRtlMdlRead
568	0x53a340	FsRtlMdlReadComplete
569	0x29f620	FsRtlMdlReadCompleteDev
570	0x93b6b0	FsRtlMdlReadDev
571	0x756c70	FsRtlMdlReadEx
572	0x93b8a0	FsRtlMdlWriteComplete
573	0x755680	FsRtlMdlWriteCompleteDev
574	0x93be50	FsRtlMupGetProviderIdFromName
575	0x93be80	FsRtlMupGetProviderInfoFromFileObject
576	0x53b540	FsRtlNormalizeNtstatus
577	0x93e2a0	FsRtlNotifyChangeDirectory
578	0x692c50	FsRtlNotifyCleanup
579	0x93e300	FsRtlNotifyCleanupAll
580	0x847a50	FsRtlNotifyFilterChangeDirectory
581	0x691c40	FsRtlNotifyFilterChangeDirectoryLite
582	0x8409f0	FsRtlNotifyFilterReportChange
583	0x93e3d0	FsRtlNotifyFilterReportChangeLite
584	0x6925b0	FsRtlNotifyFilterReportChangeLiteEx
585	0x8479e0	FsRtlNotifyFullChangeDirectory
586	0x840990	FsRtlNotifyFullReportChange
587	0x7451a0	FsRtlNotifyInitializeSync
588	0x93e430	FsRtlNotifyReportChange
589	0x86a340	FsRtlNotifyUninitializeSync
590	0x86ba40	FsRtlNotifyVolumeEvent
591	0x6e2d90	FsRtlNotifyVolumeEventEx
592	0x282c00	FsRtlNumberOfRunsInBaseMcb
593	0x3ae850	FsRtlNumberOfRunsInLargeMcb
594	0x53a5d0	FsRtlNumberOfRunsInMcb
595	0x67c670	FsRtlOpenFileSystemRegistryKeyFromFsGuid
596	0x93c440	FsRtlOplockBreakH
597	0x74f120	FsRtlOplockBreakH2
598	0x53b5f0	FsRtlOplockBreakToNone
599	0x53b650	FsRtlOplockBreakToNoneEx
600	0x68c560	FsRtlOplockFsctrl
601	0x68bd40	FsRtlOplockFsctrlEx
602	0x53b810	FsRtlOplockGetAnyBreakOwnerProcess
603	0x7215e0	FsRtlOplockIsFastIoPossible
604	0x72e560	FsRtlOplockIsSharedRequest
605	0x53b890	FsRtlOplockKeysEqual
606	0x53ccc0	FsRtlPostPagingFileStackOverflow
607	0x53cce0	FsRtlPostStackOverflow
608	0x756bd0	FsRtlPrepareMdlWrite
609	0x93b910	FsRtlPrepareMdlWriteDev
610	0x756b50	FsRtlPrepareMdlWriteEx
611	0x87a450	FsRtlPrepareToReuseEcp
612	0x26a730	FsRtlPrivateLock
613	0x53b2f0	FsRtlProcessFileLock
614	0x745300	FsRtlQueryCachedVdl
615	0x93d080	FsRtlQueryInformationFile
616	0x75feb0	FsRtlQueryKernelEaFile
617	0x3c1c80	FsRtlQueryMaximumVirtualDiskNestingLevel
618	0x3c4e30	FsRtlRegisterFileSystemFilterCallbacks
619	0x85b480	FsRtlRegisterFltMgrCalls
620	0x85b470	FsRtlRegisterMupCalls
621	0x93beb0	FsRtlRegisterUncProvider
622	0x93bef0	FsRtlRegisterUncProviderEx
623	0x8471e0	FsRtlRegisterUncProviderEx2
624	0x26ba10	FsRtlReleaseEofLock
625	0x7a4850	FsRtlReleaseFile
626	0x74ab60	FsRtlReleaseFileNameInformation
627	0x22ae80	FsRtlReleaseHeaderMutex
628	0x287f40	FsRtlRemoveBaseMcbEntry
629	0x873c90	FsRtlRemoveDotsFromPath
630	0x68a910	FsRtlRemoveExtraCreateParameter
631	0x3aa130	FsRtlRemoveLargeMcbEntry
632	0x53a5f0	FsRtlRemoveMcbEntry
633	0x53a8f0	FsRtlRemovePerFileContext
634	0x219f20	FsRtlRemovePerFileObjectContext
635	0x53a9f0	FsRtlRemovePerStreamContext
636	0x2b8b70	FsRtlResetBaseMcb
637	0x53a610	FsRtlResetLargeMcb
638	0x2a5f10	FsRtlSendModernAppTermination
639	0x8691c0	FsRtlSetDriverBacking
640	0x720620	FsRtlSetEcpListIntoIrp
641	0x7416f0	FsRtlSetKernelEaFile
642	0x53a650	FsRtlSplitBaseMcb
643	0x53a7c0	FsRtlSplitLargeMcb
644	0x750090	FsRtlSyncVolumes
645	0x726a70	FsRtlTeardownPerFileContexts
646	0x6e0cf0	FsRtlTeardownPerStreamContexts
647	0x287e40	FsRtlTruncateBaseMcb
648	0x287e00	FsRtlTruncateLargeMcb
649	0x53a840	FsRtlTruncateMcb
650	0x53a190	FsRtlTryToAcquireHeaderMutex
651	0x35ecf0	FsRtlUninitializeBaseMcb
652	0x2b60d0	FsRtlUninitializeFileLock
653	0x35ead0	FsRtlUninitializeLargeMcb
654	0x93bd50	FsRtlUninitializeMcb
655	0x297d90	FsRtlUninitializeOplock
656	0x2984b0	FsRtlUpdateDiskCounters
657	0x93c480	FsRtlUpperOplockFsctrl
658	0x25d420	FsRtlValidateReparsePointBuffer
659	0x864740	FsRtlVolumeDeviceToCorrelationId
660	0x4fe620	HalAcpiGetTableEx
661	0x2b9030	HalAcquireDisplayOwnership
662	0x2ab9a0	HalAdjustResourceList
663	0xb730a0	HalAllProcessorsStarted
664	0x455340	HalAllocateAdapterChannel
665	0x4fec10	HalAllocateCommonBuffer
666	0x4fede0	HalAllocateCrashDumpRegisters
667	0x931620	HalAllocateHardwareCounters
668	0x931590	HalAssignSlotResources
669	0x4ff980	HalBugCheckSystem
670	0x4fb9a0	HalCalibratePerformanceCounter
671	0x2b9030	HalClearSoftwareInterrupt
672	0x81b150	HalConvertDeviceIdtToIrql
673	0x257eb0	HalDisableInterrupt
674	0xc020e0	HalDispatchTable
675	0x2b9030	HalDisplayString
676	0x3ad420	HalDmaAllocateCrashDumpRegistersEx
677	0x4feee0	HalDmaFreeCrashDumpRegistersEx
678	0x258bc0	HalEnableInterrupt
679	0x502460	HalEnumerateEnvironmentVariablesEx
680	0x373260	HalEnumerateProcessors
681	0x93e910	HalExamineMBR
682	0x370820	HalFlushCommonBuffer
683	0x4fec30	HalFreeCommonBuffer
684	0x931760	HalFreeHardwareCounters
685	0x931600	HalGetAdapter
686	0x3952e0	HalGetBusData
687	0x395310	HalGetBusDataByOffset
688	0x502480	HalGetEnvironmentVariable
689	0x2a81b0	HalGetEnvironmentVariableEx
690	0x37f1d0	HalGetInterruptTargetInformation
691	0x501c50	HalGetInterruptVector
692	0x2af250	HalGetMemoryCachingRequirements
693	0x2587e0	HalGetMessageRoutingInfo
694	0x3835f0	HalGetProcessorIdByNtNumber
695	0x3abbd0	HalGetVectorInput
696	0x503360	HalHandleMcheck
697	0x503f70	HalHandleNMI
698	0xa89370	HalInitSystem
699	0x39d510	HalInitializeBios
700	0x504280	HalInitializeOnResume
701	0x37fa20	HalInitializeProcessor
702	0x381290	HalIsHyperThreadingEnabled
703	0x5042a0	HalMakeBeep
704	0x26d660	HalPerformEndOfInterrupt
705	0xc019a0	HalPrivateDispatchTable
706	0x414010	HalProcessorIdle
707	0x2b9030	HalQueryDisplayParameters
708	0x502520	HalQueryEnvironmentVariableInfoEx
709	0x377740	HalQueryMaximumProcessorCount
710	0x288f60	HalQueryRealTimeClock
711	0x4fec60	HalReadDmaCounter
712	0x504590	HalRegisterDynamicProcessor
713	0xb4a910	HalRegisterErrataCallbacks
714	0xb43d50	HalReportResourceUsage
715	0x2af4e0	HalRequestClockInterrupt
716	0x5045c0	HalRequestDeferredRecoveryServiceInterrupt
717	0x2a5dc0	HalRequestIpi
718	0x2e5540	HalRequestIpiSpecifyVector
719	0x2e50e0	HalRequestSoftwareInterrupt
720	0x504600	HalReturnToFirmware
721	0x2bcb90	HalSendNMI
722	0x2e4b00	HalSendSoftwareInterrupt
723	0x4febe0	HalSetBusData
724	0x395140	HalSetBusDataByOffset
725	0x2b9030	HalSetDisplayParameters
726	0x502620	HalSetEnvironmentVariable
727	0x502700	HalSetEnvironmentVariableEx
728	0x504b30	HalSetProfileInterval
729	0x4fc490	HalSetRealTimeClock
730	0x502890	HalStartDynamicProcessor
731	0x373ce0	HalStartNextProcessor
732	0x504b70	HalStartProfileInterrupt
733	0x504b90	HalStopProfileInterrupt
734	0x2ab9a0	HalSystemVectorDispatchEntry
735	0x372620	HalTranslateBusAddress
736	0x3ab580	HalWheaUpdateCmciPolicy
737	0x374480	HeadlessDispatch
738	0x6138e0	HviGetHardwareFeatures
739	0x381730	HviGetHypervisorFeatures
740	0x381060	HviIsAnyHypervisorPresent
741	0x382230	HviIsHypervisorVendorMicrosoft
742	0x53d8a0	HvlGetApicIdFromLpIndex
743	0x53d8d0	HvlGetLpIndexFromApicId
744	0x459490	HvlGetLpIndexFromProcessorIndex
745	0x3ca600	HvlInvokeFastExtendedHypercall
746	0x3cb7b0	HvlInvokeHypercall
747	0x540070	HvlIsSchedulerAssistAvailable
748	0x542220	HvlLpReadMultipleMsr
749	0x542370	HvlLpWriteMultipleMsr
750	0x4594e0	HvlPerformEndOfInterrupt
751	0x53d900	HvlQueryActiveHypervisorProcessorCount
752	0x53d930	HvlQueryActiveProcessors
753	0x382180	HvlQueryConnection
754	0x53d9c0	HvlQueryHypervisorProcessorNodeNumber
755	0x53db80	HvlQueryNumaDistance
756	0x53dc80	HvlQueryProcessorTopology
757	0x53dca0	HvlQueryProcessorTopologyCount
758	0x53dce0	HvlQueryProcessorTopologyEx
759	0x53dd70	HvlQueryProcessorTopologyHighestId
760	0x53ddb0	HvlQueryStartedProcessors
761	0x3cc380	HvlReadPerformanceStateCounters
762	0x53d520	HvlRegisterInterruptCallback
763	0x93f460	HvlRegisterWheaErrorNotification
764	0x540090	HvlSchedulerAssistAcknowledgeEvents
765	0x53d6e0	HvlUnregisterInterruptCallback
766	0x93f4a0	HvlUnregisterWheaErrorNotification
767	0x3cb770	HvlUpdatePerformanceStateCountersForLp
768	0x54be00	InbvAcquireDisplayOwnership
769	0x54be60	InbvCheckDisplayOwnership
770	0x383120	InbvDisplayString
771	0x54be90	InbvEnableBootDriver
772	0x3b5260	InbvEnableDisplayString
773	0x3b52d0	InbvInstallDisplayStringFilter
774	0x3a7dd0	InbvIsBootDriverInstalled
775	0x3b4f10	InbvNotifyDisplayOwnershipChange
776	0x54bf30	InbvNotifyDisplayOwnershipLost
777	0x54bf90	InbvResetDisplay
778	0x54bfc0	InbvSetScrollRegion
779	0x54bff0	InbvSetTextColor
780	0x3b4ed0	InbvSetVirtualFrameBuffer
781	0x54c020	InbvSolidColorFill
782	0xc641e4	InitSafeBootMode
783	0x216720	InitializeSListHead
784	0x4228e0	InterlockedPushListSList
785	0x287450	IoAcquireCancelSpinLock
786	0x9507a0	IoAcquireKsrPersistentMemory
787	0x9507d0	IoAcquireKsrPersistentMemoryEx
788	0x2c1ba0	IoAcquireRemoveLockEx
789	0x2ae0e0	IoAcquireVpbSpinLock
790	0xd1e408	IoAdapterObjectType
791	0x54d000	IoAddBugcheckTriageThread
792	0x553f80	IoAdjustStackSizeForRedirection
793	0x554040	IoAllocateAdapterChannel
794	0x554070	IoAllocateController
795	0x3a3290	IoAllocateDriverObjectExtension
796	0x3c4b20	IoAllocateErrorLogEntry
797	0x2293a0	IoAllocateIrp
798	0x2bfbc0	IoAllocateIrpEx
799	0x229030	IoAllocateMdl
800	0x6e7650	IoAllocateMiniCompletionPacket
801	0x554110	IoAllocateSfioStreamIdentifier
802	0x25e6e0	IoAllocateWorkItem
803	0x2715d0	IoApplyPriorityInfoThread
804	0x951eb0	IoAssignResources
805	0x944f30	IoAttachDevice
806	0x554160	IoAttachDeviceByPointer
807	0x2a8cc0	IoAttachDeviceToDeviceStack
808	0x2a8ce0	IoAttachDeviceToDeviceStackSafe
809	0x372280	IoBoostThreadIo
810	0x3665d0	IoBuildAsynchronousFsdRequest
811	0x24c9b0	IoBuildDeviceIoControlRequest
812	0x267fb0	IoBuildPartialMdl
813	0x7cc7b0	IoBuildSynchronousFsdRequest
814	0x554190	IoCallDriver
815	0x945030	IoCancelFileOpen
816	0x29c140	IoCancelIrp
817	0x555770	IoCancelMiniCompletionPacket
818	0x945180	IoCheckDesiredAccess
819	0x73c430	IoCheckEaBufferValidity
820	0x9451d0	IoCheckFileObjectOpenedAsCopyDestination
821	0x9451f0	IoCheckFileObjectOpenedAsCopySource
822	0x873fc0	IoCheckFunctionAccess
823	0x68bac0	IoCheckLinkShareAccess
824	0x874790	IoCheckQuerySetFileInformation
825	0x874b20	IoCheckQuerySetVolumeInformation
826	0x945210	IoCheckQuotaBufferValidity
827	0x3cea00	IoCheckRedirectionTrustLevel
828	0x74e8f0	IoCheckShareAccess
829	0x87a6c0	IoCheckShareAccessEx
830	0x3ce9d0	IoCleanupIrp
831	0x25bac0	IoClearActivityIdThread
832	0x556620	IoClearAdapterCryptoEngineExtension
833	0x556670	IoClearFsTrackOffsetState
834	0x5541b0	IoClearIrpExtraCreateParameter
835	0x5541d0	IoCompleteRequest
836	0xd1dc40	IoCompletionObjectType
837	0x5564e0	IoComputeRedirectionTrustLevel
838	0x850390	IoConnectInterrupt
839	0x6dec70	IoConnectInterruptEx
840	0x9452d0	IoConvertFileHandleToKernelHandle
841	0x945430	IoCopyDeviceObjectHint
842	0x866f60	IoCreateArcName
843	0x9454c0	IoCreateController
844	0x6940b0	IoCreateDevice
845	0x8326d0	IoCreateDeviceSecure
846	0x93e920	IoCreateDisk
847	0x8134a0	IoCreateDriver
848	0x73d050	IoCreateFile
849	0x7b2470	IoCreateFileEx
850	0x74e670	IoCreateFileSpecifyDeviceObjectHint
851	0x756830	IoCreateNotificationEvent
852	0x86a370	IoCreateStreamFileObject
853	0x86c250	IoCreateStreamFileObjectEx
854	0x68db40	IoCreateStreamFileObjectEx2
855	0x68daf0	IoCreateStreamFileObjectLite
856	0x8673b0	IoCreateSymbolicLink
857	0x8673f0	IoCreateSymbolicLink2
858	0x859cb0	IoCreateSynchronizationEvent
859	0x8693f0	IoCreateSystemThread
860	0x9455d0	IoCreateUnprotectedSymbolicLink
861	0x2af820	IoCsqInitialize
862	0x2b69a0	IoCsqInitializeEx
863	0x284bd0	IoCsqInsertIrp
864	0x284bf0	IoCsqInsertIrpEx
865	0x3d4b30	IoCsqRemoveIrp
866	0x2869e0	IoCsqRemoveNextIrp
867	0x555960	IoDecrementKeepAliveCount
868	0x6caf80	IoDeleteController
869	0x2207b0	IoDeleteDevice
870	0x945650	IoDeleteDriver
871	0x86aa30	IoDeleteSymbolicLink
872	0x2b0930	IoDetachDevice
873	0xd1eeb8	IoDeviceHandlerObjectSize
874	0xd23f98	IoDeviceHandlerObjectType
875	0xd1de10	IoDeviceObjectType
876	0x6de3a0	IoDisconnectInterrupt
877	0x6ddec0	IoDisconnectInterruptEx
878	0xd1dc00	IoDriverObjectType
879	0x9524a0	IoDuplicateDependency
880	0x945680	IoEnqueueIrp
881	0x3c4550	IoEnumerateDeviceObjectList
882	0x55d2e0	IoEnumerateKsrPersistentMemoryEx
883	0x748570	IoEnumerateRegisteredFiltersList
884	0x9456a0	IoFastQueryNetworkAttributes
885	0xd1da90	IoFileObjectType
886	0x4fed30	IoFlushAdapterBuffers
887	0x732100	IoForwardAndCatchIrp
888	0x732100	IoForwardIrpSynchronously
889	0x4554c0	IoFreeAdapterChannel
890	0x5541f0	IoFreeController
891	0x554240	IoFreeErrorLogEntry
892	0x331480	IoFreeIrp
893	0x9509d0	IoFreeKsrPersistentMemory
894	0x4554e0	IoFreeMapRegisters
895	0x32f250	IoFreeMdl
896	0x7d02a0	IoFreeMiniCompletionPacket
897	0x5542a0	IoFreeSfioStreamIdentifier
898	0x25b150	IoFreeWorkItem
899	0x269bd0	IoGetActivityIdIrp
900	0x25bc30	IoGetActivityIdThread
901	0x5566a0	IoGetAdapterCryptoEngineExtension
902	0x3b45b0	IoGetAffinityInterrupt
903	0x331680	IoGetAttachedDevice
904	0x2f1460	IoGetAttachedDeviceReference
905	0x34e810	IoGetBaseFileSystemDeviceObject
906	0x9456e0	IoGetBootDiskInformation
907	0x810850	IoGetBootDiskInformationLite
908	0x86c630	IoGetConfigurationInformation
909	0x946480	IoGetContainerInformation
910	0x5566e0	IoGetCopyInformationExtension
911	0x262700	IoGetCurrentProcess
912	0x2200b0	IoGetDeviceAttachmentBaseRef
913	0x953340	IoGetDeviceDirectory
914	0x749a10	IoGetDeviceInterfaceAlias
915	0x7487e0	IoGetDeviceInterfacePropertyData
916	0x6f4350	IoGetDeviceInterfaces
917	0x859430	IoGetDeviceNumaNode
918	0x6d8730	IoGetDeviceObjectPointer
919	0x6ee760	IoGetDeviceProperty
920	0x6e0af0	IoGetDevicePropertyData
921	0x40d6c0	IoGetDeviceToVerify
922	0x3c4740	IoGetDiskDeviceObject
923	0x81a170	IoGetDmaAdapter
924	0x953730	IoGetDriverDirectory
925	0x2afbc0	IoGetDriverObjectExtension
926	0x707d40	IoGetFileObjectGenericMapping
927	0x36b540	IoGetFsTrackOffsetState
928	0x3aa780	IoGetFsZeroingOffset
929	0x27b3c0	IoGetGenericIrpExtension
930	0x945710	IoGetInitialStack
931	0x2b9250	IoGetInitiatorProcess
932	0x27ae70	IoGetIoAttributionHandle
933	0x2f0e40	IoGetIoPriorityHint
934	0x954920	IoGetIommuInterface
935	0x85abc0	IoGetIommuInterfaceEx
936	0x68a860	IoGetIrpExtraCreateParameter
937	0x2b0ca0	IoGetLowerDeviceObject
938	0x5543c0	IoGetOplockKeyContext
939	0x21dff0	IoGetOplockKeyContextEx
940	0x28b5e0	IoGetPagingIoPriority
941	0x22a2a0	IoGetRelatedDeviceObject
942	0x274c50	IoGetRequestorProcess
943	0x274f10	IoGetRequestorProcessId
944	0x2b7030	IoGetRequestorSessionId
945	0x4597b0	IoGetSfioStreamIdentifier
946	0x554400	IoGetShadowFileInformation
947	0x369380	IoGetSilo
948	0x28b590	IoGetSiloParameters
949	0x2296c0	IoGetStackLimits
950	0x946860	IoGetSymlinkSupportInformation
951	0x34e7d0	IoGetTopLevelIrp
952	0x26cac0	IoGetTransactionParameterBlock
953	0x555ac0	IoIncrementKeepAliveCount
954	0x27b320	IoInitializeIrp
955	0x3ce420	IoInitializeIrpEx
956	0x945f40	IoInitializeMiniCompletionPacket
957	0x3c2ae0	IoInitializeRemoveLockEx
958	0x857b40	IoInitializeTimer
959	0x2b0d60	IoInitializeWorkItem
960	0x2b2a10	IoInvalidateDeviceRelations
961	0x3a5a10	IoInvalidateDeviceState
962	0x2842d0	IoIrpHasFsTrackOffsetExtensionType
963	0x227020	IoIs32bitProcess
964	0x2871c0	IoIsActivityTracingEnabled
965	0x86c710	IoIsFileObjectIgnoringSharing
966	0x2b47b0	IoIsFileOriginRemote
967	0x3b4e90	IoIsInitiator32bitProcess
968	0x21f030	IoIsOperationSynchronous
969	0x29d950	IoIsSystemThread
970	0xac0f50	IoIsValidIrpStatus
971	0x9468b0	IoIsValidNameGraftingBuffer
972	0x899bb0	IoIsWdmVersionAvailable
973	0x54e140	IoLoadCrashDumpDriver
974	0x3ab020	IoMakeAssociatedIrp
975	0x36b220	IoMakeAssociatedIrpEx
976	0x4feda0	IoMapTransfer
977	0x83f120	IoOpenDeviceInterfaceRegistryKey
978	0x731900	IoOpenDeviceRegistryKey
979	0x6fe180	IoOpenDriverRegistryKey
980	0x3d3430	IoPageRead
981	0x36b570	IoPropagateActivityIdToThread
982	0x2ec2b0	IoPropagateIrpExtension
983	0x2ec570	IoPropagateIrpExtensionEx
984	0x73b540	IoQueryDeviceDescription
985	0x6d7d90	IoQueryFileDosDeviceName
986	0x7f0240	IoQueryFileInformation
987	0x3a4cd0	IoQueryFullDriverPath
988	0x72c220	IoQueryInformationByName
989	0x81a8b0	IoQueryInterface
990	0x950a70	IoQueryKsrPersistentMemorySize
991	0x950aa0	IoQueryKsrPersistentMemorySizeEx
992	0x7efe00	IoQueryVolumeInformation
993	0x3c51c0	IoQueueThreadIrp
994	0x2969e0	IoQueueWorkItem
995	0x328180	IoQueueWorkItemEx
996	0x555c30	IoQueueWorkItemToNode
997	0x554420	IoRaiseHardError
998	0x554700	IoRaiseInformationalHardError
999	0x93e9d0	IoReadDiskSignature
1000	0xc5d2c8	IoReadOperationCount
1001	0x93ead0	IoReadPartitionTable
1002	0x93eca0	IoReadPartitionTableEx
1003	0xc5d2d8	IoReadTransferCount
1004	0x2c7350	IoRecordIoAttribution
1005	0x858d60	IoRegisterBootDriverCallback
1006	0x845310	IoRegisterBootDriverReinitialization
1007	0x946500	IoRegisterContainerNotification
1008	0x85b690	IoRegisterDeviceInterface
1009	0x845390	IoRegisterDriverReinitialization
1010	0x869000	IoRegisterFileSystem
1011	0x945730	IoRegisterFsRegistrationChange
1012	0x84c2d0	IoRegisterFsRegistrationChangeMountAware
1013	0x9472a0	IoRegisterIoTracking
1014	0x811d50	IoRegisterLastChanceShutdownNotification
1015	0x7d0d00	IoRegisterPlugPlayNotification
1016	0x39e260	IoRegisterPriorityCallback
1017	0x811dd0	IoRegisterShutdownNotification
1018	0x292370	IoReleaseCancelSpinLock
1019	0x3d45e0	IoReleaseRemoveLockAndWaitEx
1020	0x290b30	IoReleaseRemoveLockEx
1021	0x2aee10	IoReleaseVpbSpinLock
1022	0x32bfd0	IoRemoveIoCompletion
1023	0x945750	IoRemoveLinkShareAccess
1024	0x6e1630	IoRemoveLinkShareAccessEx
1025	0x6e1610	IoRemoveShareAccess
1026	0x858c10	IoReplaceFileObjectName
1027	0x952f70	IoReplacePartitionUnit
1028	0x82c470	IoReportDetectedDevice
1029	0xb34970	IoReportHalResourceUsage
1030	0x3d5480	IoReportInterruptActive
1031	0x3b20a0	IoReportInterruptInactive
1032	0x954e90	IoReportResourceForDetection
1033	0x955080	IoReportResourceUsage
1034	0x82c910	IoReportRootDevice
1035	0x8767b0	IoReportTargetDeviceChange
1036	0x25c8c0	IoReportTargetDeviceChangeAsynchronous
1037	0x55d750	IoRequestDeviceEject
1038	0x55d770	IoRequestDeviceEjectEx
1039	0x955560	IoRequestDeviceRemovalForReset
1040	0x82f350	IoReserveDependency
1041	0x950cb0	IoReserveKsrPersistentMemory
1042	0x950cf0	IoReserveKsrPersistentMemoryEx
1043	0x396980	IoResolveDependency
1044	0x277bc0	IoRetrievePriorityInfo
1045	0x2eb660	IoReuseIrp
1046	0x2eb830	IoSetActivityIdIrp
1047	0x25baa0	IoSetActivityIdThread
1048	0x556720	IoSetAdapterCryptoEngineExtension
1049	0x2a67b0	IoSetCompletionRoutineEx
1050	0x9525d0	IoSetDependency
1051	0x864fb0	IoSetDeviceInterfacePropertyData
1052	0x6ec3e0	IoSetDeviceInterfaceState
1053	0x85b490	IoSetDevicePropertyData
1054	0x40d6d0	IoSetDeviceToVerify
1055	0x899aa0	IoSetFileObjectIgnoreSharing
1056	0x3cd140	IoSetFileOrigin
1057	0x556780	IoSetFsTrackOffsetState
1058	0x5567e0	IoSetFsZeroingOffset
1059	0x556820	IoSetFsZeroingOffsetRequired
1060	0x392a20	IoSetGenericIrpExtension
1061	0x4597f0	IoSetHardErrorOrVerifyDevice
1062	0x877ca0	IoSetInformation
1063	0x554a90	IoSetIoAttributionIrp
1064	0x7570a0	IoSetIoCompletion
1065	0x3670f0	IoSetIoCompletionEx
1066	0x367140	IoSetIoCompletionEx3
1067	0x2845e0	IoSetIoPriorityHint
1068	0x554ad0	IoSetIoPriorityHintIntoFileObject
1069	0x271960	IoSetIoPriorityHintIntoThread
1070	0x720620	IoSetIrpExtraCreateParameter
1071	0x6e16c0	IoSetLinkShareAccess
1072	0x27c520	IoSetMasterIrpStatus
1073	0x93ed50	IoSetPartitionInformation
1074	0x93ee30	IoSetPartitionInformationEx
1075	0x554b10	IoSetShadowFileInformation
1076	0x6e1040	IoSetShareAccess
1077	0x879250	IoSetShareAccessEx
1078	0x3b4fc0	IoSetStartIoAttributes
1079	0x945770	IoSetSystemPartition
1080	0x25ea40	IoSetThreadHardErrorMode
1081	0x34e7f0	IoSetTopLevelIrp
1082	0x554ba0	IoSizeOfIrpEx
1083	0x40d6e0	IoSizeofGenericIrpExtension
1084	0x2aea10	IoSizeofWorkItem
1085	0x554be0	IoStartNextPacket
1086	0x554c30	IoStartNextPacketByKey
1087	0x554c80	IoStartPacket
1088	0x554e30	IoStartTimer
1089	0xd48900	IoStatisticsLock
1090	0x9521a0	IoSteerInterrupt
1091	0x554e60	IoStopTimer
1092	0x29f6e0	IoSynchronousCallDriver
1093	0x2a66c0	IoSynchronousPageWrite
1094	0x3b1820	IoTestDependency
1095	0x28b510	IoThreadToProcess
1096	0x3c0a80	IoTransferActivityId
1097	0x55dd00	IoTranslateBusAddress
1098	0x2b6d50	IoTryQueueWorkItem
1099	0x2b8ca0	IoUninitializeWorkItem
1100	0xb73290	IoUnregisterBootDriverCallback
1101	0x946740	IoUnregisterContainerNotification
1102	0x86c090	IoUnregisterFileSystem
1103	0x945910	IoUnregisterFsRegistrationChange
1104	0x9473c0	IoUnregisterIoTracking
1105	0x754ec0	IoUnregisterPlugPlayNotification
1106	0x754ef0	IoUnregisterPlugPlayNotificationEx
1107	0x554e80	IoUnregisterPriorityCallback
1108	0xa97d60	IoUnregisterShutdownNotification
1109	0x9459c0	IoUpdateLinkShareAccess
1110	0x68b510	IoUpdateLinkShareAccessEx
1111	0x86c160	IoUpdateShareAccess
1112	0x2b5f40	IoValidateDeviceIoControlAccess
1113	0x93eef0	IoVerifyPartitionTable
1114	0x9459e0	IoVerifyVolume
1115	0x948df0	IoVolumeDeviceNameToGuid
1116	0x7dc440	IoVolumeDeviceNameToGuidPath
1117	0x6d8460	IoVolumeDeviceToDosName
1118	0x7dc240	IoVolumeDeviceToGuid
1119	0x7dc2d0	IoVolumeDeviceToGuidPath
1120	0x9dcdf0	IoWMIAllocateInstanceIds
1121	0x732160	IoWMIDeviceObjectToInstanceName
1122	0x3bffa0	IoWMIDeviceObjectToProviderId
1123	0x9dcf40	IoWMIExecuteMethod
1124	0x731f90	IoWMIHandleToInstanceName
1125	0x6a0f90	IoWMIOpenBlock
1126	0x852a30	IoWMIQueryAllData
1127	0x9dd0c0	IoWMIQueryAllDataMultiple
1128	0x6a1c20	IoWMIQuerySingleInstance
1129	0x9dd1b0	IoWMIQuerySingleInstanceMultiple
1130	0x863600	IoWMIRegistrationControl
1131	0x857ed0	IoWMISetNotificationCallback
1132	0x9dd2b0	IoWMISetSingleInstance
1133	0x9dd3e0	IoWMISetSingleItem
1134	0x9dd510	IoWMISuggestInstanceName
1135	0x3a62d0	IoWMIWriteEvent
1136	0x2680b0	IoWithinStackLimits
1137	0x3c4d50	IoWriteErrorLogEntry
1138	0x9511e0	IoWriteKsrPersistentMemory
1139	0xc5d2c0	IoWriteOperationCount
1140	0x93efa0	IoWritePartitionTable
1141	0x93f110	IoWritePartitionTableEx
1142	0xc5d2e0	IoWriteTransferCount
1143	0x229c80	IofCallDriver
1144	0x333350	IofCompleteRequest
1145	0x562b60	KasanMarkAddressInvalid
1146	0x3aa900	KasanMarkAddressRedZone
1147	0x562c40	KasanMarkAddressValid
1148	0x2a0830	KasanTrackAddress
1149	0x562d50	KasanValidateAddress
1150	0x3b1a50	KdAcquireDebuggerLock
1151	0x564e40	KdChangeOption
1152	0xd17a78	KdComPortInUse
1153	0xc5aa7a	KdDebuggerEnabled
1154	0xc5aa49	KdDebuggerNotPresent
1155	0x564b70	KdDeregisterPowerHandler
1156	0x564eb0	KdDisableDebugger
1157	0x5650e0	KdEnableDebugger
1158	0xc56948	KdEnteredDebugger
1159	0xc5aa78	KdEventLoggingEnabled
1160	0x395110	KdGetDebugDevice
1161	0xd17a70	KdHvComPortInUse
1162	0xab2ff0	KdLogDbgPrint
1163	0x274930	KdPollBreakIn
1164	0x565350	KdPowerTransition
1165	0x3abc40	KdPowerTransitionEx
1166	0x3b03d0	KdRefreshDebuggerNotPresent
1167	0x3b1170	KdRegisterPowerHandler
1168	0x3b3b10	KdReleaseDebuggerLock
1169	0xab1ee0	KdSetEventLoggingPresent
1170	0x970420	KdSystemDebugControl
1171	0x2197b0	KeAcquireGuardedMutex
1172	0x459dd0	KeAcquireGuardedMutexUnsafe
1173	0x2f8170	KeAcquireInStackQueuedSpinLock
1174	0x3490e0	KeAcquireInStackQueuedSpinLockAtDpcLevel
1175	0x56f790	KeAcquireInStackQueuedSpinLockForDpc
1176	0x56f390	KeAcquireInStackQueuedSpinLockRaiseToSynch
1177	0x28d0e0	KeAcquireInterruptSpinLock
1178	0x34cd00	KeAcquireQueuedSpinLock
1179	0x56f420	KeAcquireQueuedSpinLockRaiseToSynch
1180	0x26b9e0	KeAcquireSpinLockAtDpcLevel
1181	0x56f7d0	KeAcquireSpinLockForDpc
1182	0x24bb40	KeAcquireSpinLockRaiseToDpc
1183	0x56f950	KeAcquireSpinLockRaiseToSynch
1184	0x213280	KeAddGroupAffinityEx
1185	0x2dc5d0	KeAddProcessorAffinityEx
1186	0x37d320	KeAddProcessorGroupAffinity
1187	0x830f20	KeAddSystemServiceTable
1188	0x3a5f10	KeAddTriageDumpDataBlock
1189	0x36dd40	KeAlertThread
1190	0x845db0	KeAllocateCalloutStack
1191	0x868cf0	KeAllocateCalloutStackEx
1192	0x3a7e00	KeAllocateProcessorProfileStructures
1193	0x56d4b0	KeAndAffinityEx
1194	0x56d4d0	KeAndAffinityEx2
1195	0x2e5a40	KeAndGroupAffinityEx
1196	0x2c9ec0	KeAreAllApcsDisabled
1197	0x25cb30	KeAreApcsDisabled
1198	0x2aea20	KeAttachProcess
1199	0x4183c0	KeBugCheck
1200	0x4183e0	KeBugCheckEx
1201	0x2e5f30	KeCancelTimer
1202	0x25c4f0	KeCancelTimer2
1203	0x551bf0	KeCapturePersistentThreadState
1204	0x2dc590	KeCheckProcessorAffinityEx
1205	0x3c3c60	KeCheckProcessorGroupAffinity
1206	0x21e120	KeClearEvent
1207	0x2e06d0	KeClockInterruptNotify
1208	0x56da00	KeClockTimerPowerChange
1209	0x56d500	KeComplementAffinityEx
1210	0x56d520	KeComplementAffinityEx2
1211	0x37bf10	KeConnectInterruptForHal
1212	0x459e30	KeConvertAuxiliaryCounterToPerformanceCounter
1213	0x569c80	KeConvertPerformanceCounterToAuxiliaryCounter
1214	0x56d540	KeCopyAffinityEx
1215	0x35ee80	KeCopyAffinityEx2
1216	0x2d9a80	KeCountSetBitsAffinityEx
1217	0x3b3df0	KeCountSetBitsGroupAffinity
1218	0x241570	KeDelayExecutionThread
1219	0x569ca0	KeDeregisterBoundCallback
1220	0x566bc0	KeDeregisterBugCheckCallback
1221	0x2b5a80	KeDeregisterBugCheckReasonCallback
1222	0x569d80	KeDeregisterNmiCallback
1223	0x972a10	KeDeregisterProcessorChangeCallback
1224	0x2b5400	KeDetachProcess
1225	0x3a1460	KeDispatchSecondaryInterrupt
1226	0xd1da6d	KeDynamicPartitioningSupported
1227	0x220340	KeEnterCriticalRegion
1228	0x26c970	KeEnterGuardedRegion
1229	0x566d10	KeEnterKernelDebugger
1230	0x2dc4e0	KeEnumerateNextProcessor
1231	0x3d43b0	KeExpandKernelStackAndCallout
1232	0x229430	KeExpandKernelStackAndCalloutEx
1233	0xb94380	KeFindConfigurationEntry
1234	0xb6cb30	KeFindConfigurationNextEntry
1235	0x284580	KeFindFirstSetLeftAffinityEx
1236	0x29fcf0	KeFindFirstSetLeftGroupAffinity
1237	0x56d560	KeFindFirstSetRightAffinityEx
1238	0x2d86b0	KeFindFirstSetRightGroupAffinity
1239	0x214710	KeFirstGroupAffinityEx
1240	0x399280	KeFlushCurrentTbImmediately
1241	0x3b0ee0	KeFlushEntireTb
1242	0x2935c0	KeFlushIoBuffers
1243	0x294860	KeFlushQueuedDpcs
1244	0x2b9030	KeFlushWriteBuffer
1245	0xa874b0	KeForceEnableNx
1246	0x879510	KeFreeCalloutStack
1247	0x2b6d10	KeGenericCallDpc
1248	0x40d7f0	KeGetClockOwner
1249	0x56da10	KeGetClockTimerResolution
1250	0x32af90	KeGetCurrentIrql
1251	0x26c8b0	KeGetCurrentNodeNumber
1252	0x268e90	KeGetCurrentProcessorNumberEx
1253	0x2502c0	KeGetCurrentThread
1254	0x2ecab0	KeGetEffectiveIrql
1255	0x56da90	KeGetNextClockTickDuration
1256	0x2e7550	KeGetProcessorIndexFromNumber
1257	0x36db70	KeGetProcessorNumberFromIndex
1258	0x25a5f0	KeGetRecommendedSharedDataAlignment
1259	0x37fc00	KeGetXSaveFeatureFlags
1260	0xb5c290	KeHwPolicyLocateResource
1261	0x459f60	KeInitializeAffinityEx
1262	0x2d9b30	KeInitializeAffinityEx2
1263	0x2c0a80	KeInitializeApc
1264	0x5521f0	KeInitializeCrashDumpHeader
1265	0x2af220	KeInitializeDeviceQueue
1266	0x2d82f0	KeInitializeDpc
1267	0x2d98c0	KeInitializeEnumerationContext
1268	0x2b9be0	KeInitializeEnumerationContextFromAffinity
1269	0x2b9bc0	KeInitializeEnumerationContextFromGroup
1270	0x331ae0	KeInitializeEvent
1271	0x25c890	KeInitializeGuardedMutex
1272	0x37bf80	KeInitializeInterrupt
1273	0x3d4c60	KeInitializeMutant
1274	0x288be0	KeInitializeMutex
1275	0x3653f0	KeInitializeQueue
1276	0x83a020	KeInitializeSecondaryInterruptServices
1277	0x3220e0	KeInitializeSemaphore
1278	0x2845d0	KeInitializeSpinLock
1279	0x382410	KeInitializeThreadedDpc
1280	0x2c09e0	KeInitializeTimer
1281	0x25bee0	KeInitializeTimer2
1282	0x2c0a10	KeInitializeTimerEx
1283	0x3a6280	KeInitializeTriageDumpDataArray
1284	0x45a5f0	KeInsertByKeyDeviceQueue
1285	0x5713d0	KeInsertDeviceQueue
1286	0x5719d0	KeInsertHeadQueue
1287	0x365110	KeInsertQueue
1288	0x335cb0	KeInsertQueueApc
1289	0x2e4b40	KeInsertQueueDpc
1290	0x290fe0	KeInterlockedClearProcessorAffinityEx
1291	0x2947f0	KeInterlockedSetProcessorAffinityEx
1292	0x2b8850	KeInvalidateAllCaches
1293	0x45a6b0	KeInvalidateRangeAllCaches
1294	0x251710	KeInvalidateRangeAllCachesNoIpi
1295	0x3990e0	KeIpiGenericCall
1296	0x2d79a0	KeIsAttachedProcess
1297	0x2e5c50	KeIsEmptyAffinityEx
1298	0x2d80f0	KeIsEqualAffinityEx
1299	0x28d1c0	KeIsExecutingDpc
1300	0x3696c0	KeIsSingleGroupAffinityEx
1301	0x27d850	KeIsSubsetAffinityEx
1302	0x970c00	KeIsWaitListEmpty
1303	0xd1e244	KeLastBranchMSR
1304	0x22c120	KeLeaveCriticalRegion
1305	0x2bd260	KeLeaveGuardedRegion
1306	0xa8d4e0	KeLoadMTRR
1307	0xd23e88	KeLoaderBlock
1308	0x239180	KeLowerIrql
1309	0x2b9030	KeNotifyProcessorFreezeSupported
1310	0xd1dc11	KeNumberProcessors
1311	0x56d5b0	KeOrAffinityEx
1312	0x56d5d0	KeOrAffinityEx2
1313	0x45a7f0	KePrepareToDispatchVirtualProcessor
1314	0x2d86e0	KeProcessorGroupAffinity
1315	0x572160	KeProfileInterruptWithSource
1316	0x28ee20	KePulseEvent
1317	0x220c90	KeQueryActiveGroupCount
1318	0x56e920	KeQueryActiveProcessorAffinity
1319	0x391850	KeQueryActiveProcessorAffinity2
1320	0x3b4f90	KeQueryActiveProcessorCount
1321	0x2d91b0	KeQueryActiveProcessorCountEx
1322	0x45a130	KeQueryActiveProcessors
1323	0x56a100	KeQueryAuxiliaryCounterFrequency
1324	0x267c20	KeQueryDpcWatchdogInformation
1325	0x3ad390	KeQueryEffectivePriorityThread
1326	0x35ed40	KeQueryGroupAffinity
1327	0x390220	KeQueryGroupAffinityEx
1328	0x9732b0	KeQueryHardwareCounterConfiguration
1329	0x56cf80	KeQueryHeteroCpuPolicyThread
1330	0x214dd0	KeQueryHighestNodeNumber
1331	0x258b80	KeQueryInterruptPartitionCount
1332	0x258b10	KeQueryInterruptPartitionInformation
1333	0x2e0310	KeQueryInterruptTimePrecise
1334	0x210510	KeQueryLogicalProcessorRelationship
1335	0x2d6d80	KeQueryMaximumGroupCount
1336	0x56e970	KeQueryMaximumProcessorCount
1337	0x288dd0	KeQueryMaximumProcessorCountEx
1338	0x2146a0	KeQueryNodeActiveAffinity
1339	0x2b6b70	KeQueryNodeActiveAffinity2
1340	0x3b2830	KeQueryNodeActiveProcessorCount
1341	0x3b1d80	KeQueryNodeMaximumProcessorCount
1342	0x2df7d0	KeQueryPerformanceCounter
1343	0x56a120	KeQueryPrcbAddress
1344	0x221630	KeQueryPriorityThread
1345	0x2b9d40	KeQueryRuntimeThread
1346	0x3ac5b0	KeQuerySystemCpuPartitionAffinity
1347	0x2d6000	KeQuerySystemTimePrecise
1348	0x2c06e0	KeQueryTimeIncrement
1349	0x27c050	KeQueryTotalCycleTimeThread
1350	0x56fa00	KeQueryTypeEvent
1351	0x360b50	KeQueryUnbiasedInterruptTime
1352	0x369ae0	KeQueryUnbiasedInterruptTimePrecise
1353	0x32aef0	KeRaiseIrqlToDpcLevel
1354	0x56f010	KeRaiseUserException
1355	0x282c00	KeReadStateEvent
1356	0x282c00	KeReadStateMutant
1357	0x282c00	KeReadStateMutex
1358	0x282c00	KeReadStateQueue
1359	0x282c00	KeReadStateSemaphore
1360	0x45a140	KeReadStateTimer
1361	0x40dc70	KeReenterRetpolinedCode
1362	0x56a390	KeRegisterBoundCallback
1363	0x3aceb0	KeRegisterBugCheckCallback
1364	0x29ef30	KeRegisterBugCheckReasonCallback
1365	0x56a400	KeRegisterNmiCallback
1366	0x805a30	KeRegisterProcessorChangeCallback
1367	0x2d7ef0	KeReinitializeAffinityEx
1368	0x282e80	KeReleaseGuardedMutex
1369	0x459df0	KeReleaseGuardedMutexUnsafe
1370	0x2378a0	KeReleaseInStackQueuedSpinLock
1371	0x56f810	KeReleaseInStackQueuedSpinLockForDpc
1372	0x20fc70	KeReleaseInStackQueuedSpinLockFromDpcLevel
1373	0x290ba0	KeReleaseInterruptSpinLock
1374	0x32aeb0	KeReleaseMutant
1375	0x32ae90	KeReleaseMutex
1376	0x21f2c0	KeReleaseQueuedSpinLock
1377	0x2598c0	KeReleaseSemaphore
1378	0x239140	KeReleaseSpinLock
1379	0x56f8b0	KeReleaseSpinLockForDpc
1380	0x26d0b0	KeReleaseSpinLockFromDpcLevel
1381	0x571460	KeRemoveByKeyDeviceQueue
1382	0x571540	KeRemoveByKeyDeviceQueueIfBusy
1383	0x571610	KeRemoveDeviceQueue
1384	0x5716b0	KeRemoveEntryDeviceQueue
1385	0x56d600	KeRemoveGroupAffinityEx
1386	0x2d9b70	KeRemoveProcessorAffinityEx
1387	0x2118e0	KeRemoveProcessorGroupAffinity
1388	0x3650d0	KeRemoveQueue
1389	0x2ac010	KeRemoveQueueApc
1390	0x257670	KeRemoveQueueDpc
1391	0x257690	KeRemoveQueueDpcEx
1392	0x32c2b0	KeRemoveQueueEx
1393	0x9720c0	KeRemoveSystemServiceTable
1394	0x5702f0	KeReportCacheIncoherentDevice
1395	0x21e120	KeResetEvent
1396	0x2a2be0	KeRestoreExtendedProcessorState
1397	0x2ab9a0	KeRestoreFloatingPointState
1398	0x56d0f0	KeRevertToUserAffinityThread
1399	0x459f00	KeRevertToUserAffinityThreadEx
1400	0x210360	KeRevertToUserGroupAffinityThread
1401	0x291ad0	KeRundownQueue
1402	0x2a1930	KeSaveExtendedProcessorState
1403	0x2ab9a0	KeSaveFloatingPointState
1404	0x419480	KeSaveStateForHibernate
1405	0x271710	KeSetActualBasePriorityThread
1406	0x56d170	KeSetAffinityThread
1407	0x20dad0	KeSetBasePriorityThread
1408	0x2e7700	KeSetCoalescableTimer
1409	0x2b9030	KeSetDmaIoCoherency
1410	0x2372d0	KeSetEvent
1411	0x56fa10	KeSetEventBoostPriority
1412	0x973370	KeSetHardwareCounterConfiguration
1413	0x56d190	KeSetHeteroCpuPolicyThread
1414	0x3cc760	KeSetIdealProcessorThread
1415	0x2b90d0	KeSetImportanceDpc
1416	0x3322d0	KeSetKernelStackSwapEnable
1417	0x972150	KeSetLastBranchRecordInUse
1418	0x3298b0	KeSetPriorityThread
1419	0xb93b00	KeSetProfileIrql
1420	0x573e00	KeSetSelectedCpuSetsThread
1421	0x56d1a0	KeSetSystemAffinityThread
1422	0x56d1c0	KeSetSystemAffinityThreadEx
1423	0x211950	KeSetSystemGroupAffinityThread
1424	0x570520	KeSetTargetProcessorDpc
1425	0x2b6cc0	KeSetTargetProcessorDpcEx
1426	0x2e5c90	KeSetTimer
1427	0x24af30	KeSetTimer2
1428	0x2e6a20	KeSetTimerEx
1429	0x279600	KeShouldYieldProcessor
1430	0x3c46e0	KeSignalCallDpcDone
1431	0x570590	KeSignalCallDpcSynchronize
1432	0x56fa70	KeSizeOfAffinityEx
1433	0x2996b0	KeStackAttachProcess
1434	0x2df590	KeStallExecutionProcessor
1435	0x574e40	KeStallWhileFrozen
1436	0x972a30	KeStartDynamicProcessor
1437	0x459f90	KeSubtractAffinityEx
1438	0x56d620	KeSubtractAffinityEx2
1439	0x370cb0	KeSweepLocalCaches
1440	0x419bb0	KeSynchronizeExecution
1441	0x568920	KeSynchronizeTimeToQpc
1442	0x570310	KeSystemFullyCacheCoherent
1443	0x2e9440	KeTestAlertThread
1444	0x222760	KeTestSpinLock
1445	0x28c400	KeTryToAcquireGuardedMutex
1446	0x56f4b0	KeTryToAcquireQueuedSpinLock
1447	0x56f5c0	KeTryToAcquireQueuedSpinLockRaiseToSynch
1448	0x3cb4e0	KeTryToAcquireSpinLockAtDpcLevel
1449	0x29a9d0	KeUnstackDetachProcess
1450	0x2b1430	KeUpdateThreadTag
1451	0x775c70	KeUserModeCallback
1452	0x2bfdb0	KeWaitForMultipleObjects
1453	0x23ea40	KeWaitForMutexObject
1454	0x23ea40	KeWaitForSingleObject
1455	0xa9dbd0	KeWriteProtectPAT
1456	0x32af60	KfRaiseIrql
1457	0xc422e0	KiBugCheckData
1458	0x2be650	KiCheckForKernelApcDelivery
1459	0x60d110	KitLogFeatureUsage
1460	0x7f7120	KseQueryDeviceData
1461	0x974bb0	KseQueryDeviceDataList
1462	0x7f7000	KseQueryDeviceFlags
1463	0x7f7830	KseRegisterShim
1464	0x7f7850	KseRegisterShimEx
1465	0x974de0	KseSetDeviceFlags
1466	0x975350	KseUnregisterShim
1467	0x805d00	LdrAccessResource
1468	0x9b7810	LdrEnumResources
1469	0x9b7ae0	LdrFindResourceDirectory_U
1470	0x9b7b00	LdrFindResourceEx_U
1471	0x805d20	LdrFindResource_U
1472	0x75db40	LdrResFindResource
1473	0x757360	LdrResFindResourceDirectory
1474	0x75e0b0	LdrResSearchResource
1475	0xd1c2a8	LpcPortObjectType
1476	0x7f26b0	LpcReplyWaitReplyPort
1477	0x72c960	LpcRequestPort
1478	0x899c60	LpcRequestWaitReplyPort
1479	0x9764b0	LpcRequestWaitReplyPortEx
1480	0x752d80	LpcSendWaitReceivePort
1481	0x9c7450	LsaCallAuthenticationPackage
1482	0x9c7500	LsaDeregisterLogonProcess
1483	0x87a580	LsaFreeReturnBuffer
1484	0x9c7560	LsaLogonUser
1485	0x85a8a0	LsaLookupAuthenticationPackage
1486	0x85a820	LsaRegisterLogonProcess
1487	0xd1dc13	Mm64BitPhysicalAddress
1488	0xa2b450	MmAddPhysicalMemory
1489	0xa2b730	MmAddVerifierSpecialThunks
1490	0xa2b840	MmAddVerifierThunks
1491	0x61aa00	MmAdjustWorkingSetSize
1492	0x61b650	MmAdvanceMdl
1493	0x61c630	MmAllocateContiguousMemory
1494	0x38edf0	MmAllocateContiguousMemoryEx
1495	0x61c6a0	MmAllocateContiguousMemorySpecifyCache
1496	0x61c6d0	MmAllocateContiguousMemorySpecifyCacheNode
1497	0x3b82a0	MmAllocateContiguousNodeMemory
1498	0x863bb0	MmAllocateMappingAddress
1499	0x863bd0	MmAllocateMappingAddressEx
1500	0x61d090	MmAllocateMdlForIoSpace
1501	0xa2c5c0	MmAllocateMemoryRanges
1502	0x3c1a40	MmAllocateNodePagesForMdlEx
1503	0xa2bc10	MmAllocateNonCachedMemory
1504	0x3a8a10	MmAllocatePagesForMdl
1505	0x264170	MmAllocatePagesForMdlEx
1506	0x2641d0	MmAllocatePartitionNodePagesForMdlEx
1507	0x3d5690	MmAreMdlPagesCached
1508	0xd1dba8	MmBadPointer
1509	0x20b2e0	MmBuildMdlForNonPagedPool
1510	0x28d970	MmCanFileBeTruncated
1511	0x7a4d80	MmChangeImageProtection
1512	0x680990	MmCommitSessionMappedView
1513	0x7f26b0	MmConfigureGraphicsPtes
1514	0x207c60	MmCopyMemory
1515	0x7858f0	MmCopyVirtualMemory
1516	0x2846a0	MmCreateMdl
1517	0xa2d440	MmCreateMirror
1518	0x6930d0	MmCreateSection
1519	0x2a46f0	MmDisableModifiedWriteOfSection
1520	0x31eed0	MmDoesFileHaveUserWritableReferences
1521	0x299b60	MmFlushImageSection
1522	0x2a8ba0	MmForceSectionClosed
1523	0x6248d0	MmForceSectionClosedEx
1524	0x3c1040	MmFreeContiguousMemory
1525	0x3b52b0	MmFreeContiguousMemorySpecifyCache
1526	0x864ec0	MmFreeMappingAddress
1527	0xa2c7c0	MmFreeMemoryRanges
1528	0xa2be00	MmFreeNonCachedMemory
1529	0x268a40	MmFreePagesFromMdl
1530	0x3b5030	MmFreePagesFromMdlEx
1531	0x61d1c0	MmGetCacheAttribute
1532	0x61d1e0	MmGetCacheAttributeEx
1533	0x87a680	MmGetMaximumFileSectionSize
1534	0x629a00	MmGetPageBadStatus
1535	0x35c720	MmGetPhysicalAddress
1536	0x82ba90	MmGetPhysicalMemoryRanges
1537	0x82ba70	MmGetPhysicalMemoryRangesEx
1538	0x82bab0	MmGetPhysicalMemoryRangesEx2
1539	0x6d8cc0	MmGetSectionInformation
1540	0x763f10	MmGetSystemRoutineAddress
1541	0x3b4880	MmGetVirtualForPhysical
1542	0x62bc20	MmGrowKernelStack
1543	0x23950	MmHighestUserAddress
1544	0x3ad370	MmIsAddressValid
1545	0xac0060	MmIsDriverSuspectForVerifier
1546	0x2baab0	MmIsDriverVerifying
1547	0x76fbb0	MmIsDriverVerifyingByAddress
1548	0x3c3390	MmIsFileSectionActive
1549	0x62d030	MmIsIoSpaceActive
1550	0x465ad0	MmIsNonPagedSystemAddressValid
1551	0x62d580	MmIsRecursiveIoFault
1552	0x36b650	MmIsThisAnNtAsSystem
1553	0xabae10	MmIsVerifierEnabled
1554	0x7da890	MmLoadSystemImage
1555	0x76fc40	MmLockPagableDataSection
1556	0x76fc40	MmLockPagableImageSection
1557	0x783770	MmLockPagableSectionByHandle
1558	0xa2ec50	MmLockPreChargedPagedPool
1559	0x280c20	MmMapIoSpace
1560	0x281080	MmMapIoSpaceEx
1561	0x61ce20	MmMapLockedPages
1562	0x3142c0	MmMapLockedPagesSpecifyCache
1563	0x3a51c0	MmMapLockedPagesWithReservedMapping
1564	0x62d610	MmMapMdl
1565	0x62ebb0	MmMapMemoryDumpMdl
1566	0x62ebf0	MmMapMemoryDumpMdlEx
1567	0xa86b00	MmMapUserAddressesToPage
1568	0x280c20	MmMapVideoDisplay
1569	0x74b1e0	MmMapViewInSessionSpace
1570	0x74db40	MmMapViewInSessionSpaceEx
1571	0x74b1e0	MmMapViewInSystemSpace
1572	0x74db40	MmMapViewInSystemSpaceEx
1573	0x7b2380	MmMapViewOfSection
1574	0x629b20	MmMarkPhysicalMemoryAsBad
1575	0x62aac0	MmMarkPhysicalMemoryAsGood
1576	0x28b170	MmMdlPageContentsState
1577	0x3d23c0	MmMdlPagesAreZero
1578	0x855c30	MmObtainChargesToLockPagedPool
1579	0x7262b0	MmPageEntireDriver
1580	0x781830	MmPrefetchPages
1581	0x67e140	MmPrefetchVirtualAddresses
1582	0x233460	MmProbeAndLockPages
1583	0x782060	MmProbeAndLockProcessPages
1584	0x3d2e20	MmProbeAndLockSelectedPages
1585	0x2b9610	MmProtectDriverSection
1586	0x61d310	MmProtectMdlSystemAddress
1587	0x852890	MmQueryMemoryRanges
1588	0x3b5060	MmQuerySystemSize
1589	0xa2b510	MmRemovePhysicalMemory
1590	0x725aa0	MmResetDriverPaging
1591	0xa2eca0	MmReturnChargesToLockPagedPool
1592	0xa2fed0	MmRotatePhysicalView
1593	0xd1db70	MmSectionObjectType
1594	0x7264e0	MmSecureVirtualMemory
1595	0x726510	MmSecureVirtualMemoryEx
1596	0x2ae1d0	MmSetAddressRangeModified
1597	0x370620	MmSetBankedSection
1598	0xa2cdf0	MmSetGraphicsPtes
1599	0xa2ea90	MmSetPermanentCacheAttribute
1600	0x25e260	MmSizeOfMdl
1601	0x23958	MmSystemRangeStart
1602	0x633bf0	MmTrimAllSystemPagableMemory
1603	0x75c650	MmUnloadSystemImage
1604	0x2f17a0	MmUnlockPagableImageSection
1605	0x334180	MmUnlockPages
1606	0xa2ed30	MmUnlockPreChargedPagedPool
1607	0x2813a0	MmUnmapIoSpace
1608	0x334d70	MmUnmapLockedPages
1609	0x61ce50	MmUnmapReservedMapping
1610	0x2813a0	MmUnmapVideoDisplay
1611	0x74d600	MmUnmapViewInSessionSpace
1612	0x74d600	MmUnmapViewInSystemSpace
1613	0x743880	MmUnmapViewOfSection
1614	0x772910	MmUnsecureVirtualMemory
1615	0x23948	MmUserProbeAddress
1616	0xd520c4	NlsAnsiCodePage
1617	0xd522e8	NlsLeadByteInfo
1618	0xd52036	NlsMbCodePageTag
1619	0xd52000	NlsMbOemCodePageTag
1620	0xd520c0	NlsOemCodePage
1621	0xd52090	NlsOemLeadByteInfo
1622	0x9ff970	NtAddAtom
1623	0x765e00	NtAdjustPrivilegesToken
1624	0x718c40	NtAllocateLocallyUniqueId
1625	0x67e640	NtAllocateUuids
1626	0x718df0	NtAllocateVirtualMemory
1627	0x3b790	NtBuildGUID
1628	0xc64300	NtBuildLab
1629	0xc0cb60	NtBuildNumber
1630	0x6c2480	NtClose
1631	0x3d5a40	NtCommitComplete
1632	0x3d5a60	NtCommitEnlistment
1633	0x3d5a80	NtCommitTransaction
1634	0x754260	NtCompareSigningLevels
1635	0x733400	NtConnectPort
1636	0x7ef370	NtCopyFileChunk
1637	0x9f9b70	NtCreateCrossVmEvent
1638	0x3d5aa0	NtCreateEnlistment
1639	0x789ca0	NtCreateEvent
1640	0x793a60	NtCreateFile
1641	0x3d5ac0	NtCreateResourceManager
1642	0x7a35e0	NtCreateSection
1643	0x3d5ae0	NtCreateTransaction
1644	0x3d5b00	NtCreateTransactionManager
1645	0x756b00	NtDeleteAtom
1646	0x86b0e0	NtDeleteFile
1647	0x6c3430	NtDeviceIoControlFile
1648	0x6d1530	NtDuplicateObject
1649	0x78c810	NtDuplicateToken
1650	0x3d5b20	NtEnumerateTransactionObject
1651	0x764340	NtFindAtom
1652	0x7a0730	NtFreeVirtualMemory
1653	0x3d5b40	NtFreezeTransactions
1654	0x726b80	NtFsControlFile
1655	0x8578e0	NtGetEnvironmentVariableEx
1656	0x3d5b60	NtGetNotificationResourceManager
1657	0xc642e0	NtGlobalFlag
1658	0xa7c348	NtImageInfo
1659	0x68a9c0	NtLockFile
1660	0x978f40	NtMakePermanentObject
1661	0x7a1d90	NtMapViewOfSection
1662	0x738840	NtNotifyChangeDirectoryFile
1663	0x7388a0	NtNotifyChangeDirectoryFileEx
1664	0x3d5b80	NtOpenEnlistment
1665	0x7eb990	NtOpenFile
1666	0x779c70	NtOpenProcess
1667	0x734960	NtOpenProcessToken
1668	0x78eb20	NtOpenProcessTokenEx
1669	0x3d5ba0	NtOpenResourceManager
1670	0x7274b0	NtOpenThread
1671	0x7654a0	NtOpenThreadToken
1672	0x7654c0	NtOpenThreadTokenEx
1673	0x3d5bc0	NtOpenTransaction
1674	0x3d5be0	NtOpenTransactionManager
1675	0x3d5c00	NtPrePrepareComplete
1676	0x3d5c20	NtPrePrepareEnlistment
1677	0x3d5c40	NtPrepareComplete
1678	0x3d5c60	NtPrepareEnlistment
1679	0x3d5c80	NtPropagationComplete
1680	0x3d5ca0	NtPropagationFailed
1681	0x73c350	NtQueryDirectoryFile
1682	0x68ad10	NtQueryDirectoryFileEx
1683	0x72ca20	NtQueryEaFile
1684	0x9fd7f0	NtQueryEnvironmentVariableInfoEx
1685	0x747ab0	NtQueryInformationAtom
1686	0x72c1f0	NtQueryInformationByName
1687	0x3d5cc0	NtQueryInformationEnlistment
1688	0x79eef0	NtQueryInformationFile
1689	0x6d9790	NtQueryInformationProcess
1690	0x3d5ce0	NtQueryInformationResourceManager
1691	0x715f70	NtQueryInformationThread
1692	0x795390	NtQueryInformationToken
1693	0x3d5d00	NtQueryInformationTransaction
1694	0x3d5d20	NtQueryInformationTransactionManager
1695	0x9495a0	NtQueryQuotaInformationFile
1696	0x6b59f0	NtQuerySecurityAttributesToken
1697	0x7197e0	NtQuerySecurityObject
1698	0x77ceb0	NtQuerySystemInformation
1699	0x72fad0	NtQuerySystemInformationEx
1700	0x68b5a0	NtQueryVolumeInformationFile
1701	0x7ec030	NtReadFile
1702	0x754310	NtReadFileScatter
1703	0x3d5d40	NtReadOnlyEnlistment
1704	0x3d5d60	NtRecoverEnlistment
1705	0x3d5d80	NtRecoverResourceManager
1706	0x3d5da0	NtRecoverTransactionManager
1707	0x7382d0	NtRequestPort
1708	0x76c310	NtRequestWaitReplyPort
1709	0x3d5dc0	NtRollbackComplete
1710	0x3d5de0	NtRollbackEnlistment
1711	0x3d5e00	NtRollbackTransaction
1712	0x7f4680	NtSetCachedSigningLevel
1713	0x948f90	NtSetEaFile
1714	0x71a1f0	NtSetEvent
1715	0x3d5e20	NtSetInformationEnlistment
1716	0x2effd0	NtSetInformationFile
1717	0x6d2120	NtSetInformationProcess
1718	0x3d5e40	NtSetInformationResourceManager
1719	0x78aa00	NtSetInformationThread
1720	0x7b9090	NtSetInformationToken
1721	0x3d5e60	NtSetInformationTransaction
1722	0x7c1800	NtSetInformationVirtualMemory
1723	0x949d00	NtSetQuotaInformationFile
1724	0x727a30	NtSetSecurityObject
1725	0x876370	NtSetVolumeInformationFile
1726	0x604e10	NtShutdownSystem
1727	0x3d5e80	NtThawTransactions
1728	0x698680	NtTraceControl
1729	0x2dcb20	NtTraceEvent
1730	0x7213d0	NtUnlockFile
1731	0x7f2760	NtVdmControl
1732	0x6c17d0	NtWaitForSingleObject
1733	0x68c580	NtWriteFile
1734	0x7556b0	NtWriteFileGather
1735	0x7292d0	ObAssignSecurity
1736	0x69f480	ObCheckCreateObjectAccess
1737	0x7226f0	ObCheckObjectAccess
1738	0x694070	ObCloseHandle
1739	0x7b7480	ObCreateObject
1740	0x802080	ObCreateObjectType
1741	0x8020a0	ObCreateObjectTypeEx
1742	0x703f90	ObDeleteCapturedInsertInfo
1743	0x2b5360	ObDereferenceObject
1744	0x3668c0	ObDereferenceObjectDeferDelete
1745	0x332300	ObDereferenceObjectDeferDeleteWithTag
1746	0x797aa0	ObDereferenceSecurityDescriptor
1747	0x6d16f0	ObDuplicateObject
1748	0x71a760	ObFindHandleForObject
1749	0x97a530	ObGetFilterVersion
1750	0x78d650	ObGetObjectSecurity
1751	0x741920	ObGetObjectType
1752	0x694670	ObInsertObject
1753	0x869bc0	ObIsDosDeviceLocallyMapped
1754	0x2b9ee0	ObIsKernelHandle
1755	0x797d10	ObLogSecurityDescriptor
1756	0x74dae0	ObMakeTemporaryObject
1757	0x6fa270	ObOpenObjectByName
1758	0x6cafa0	ObOpenObjectByNameEx
1759	0x78e920	ObOpenObjectByPointer
1760	0x97a390	ObOpenObjectByPointerWithTag
1761	0x73b300	ObQueryNameInfo
1762	0x766ac0	ObQueryNameString
1763	0x778500	ObQueryObjectAuditingByHandle
1764	0x6c4280	ObReferenceObjectByHandle
1765	0x797a60	ObReferenceObjectByHandleWithTag
1766	0x69d1c0	ObReferenceObjectByName
1767	0x225830	ObReferenceObjectByPointer
1768	0x325630	ObReferenceObjectByPointerWithTag
1769	0x282e30	ObReferenceObjectSafe
1770	0x2dfbb0	ObReferenceObjectSafeWithTag
1771	0x7463e0	ObReferenceSecurityDescriptor
1772	0x84d7b0	ObRegisterCallbacks
1773	0x78d880	ObReleaseObjectSecurity
1774	0x7782f0	ObSetHandleAttributes
1775	0x7bebe0	ObSetSecurityDescriptorInfo
1776	0x78daf0	ObSetSecurityObjectByPointer
1777	0x97a540	ObUnRegisterCallbacks
1778	0x6c19a0	ObWaitForMultipleObjects
1779	0x6c1850	ObWaitForSingleObject
1780	0x22c230	ObfDereferenceObject
1781	0x22a340	ObfDereferenceObjectWithTag
1782	0x22e8e0	ObfReferenceObject
1783	0x3256b0	ObfReferenceObjectWithTag
1784	0xc641b8	POGOBuffer
1785	0x864e30	PcwAddInstance
1786	0x753a30	PcwCloseInstance
1787	0x74b210	PcwCreateInstance
1788	0x86ab30	PcwRegister
1789	0x9ffa50	PcwUnregister
1790	0x24f1f0	PfFileInfoNotify
1791	0x9b8c50	PfxFindPrefix
1792	0x9b8d30	PfxInitialize
1793	0x9b8d50	PfxInsertPrefix
1794	0x9b8e70	PfxRemovePrefix
1795	0x2b8ea0	PoCallDriver
1796	0x370620	PoCancelDeviceNotify
1797	0x262230	PoClearPowerRequest
1798	0x2a9d00	PoCpuIdledSinceLastCallImprecise
1799	0x3c4320	PoCreatePowerRequest
1800	0x843260	PoCreateThermalRequest
1801	0x86c400	PoDeletePowerRequest
1802	0x980eb0	PoDeleteThermalRequest
1803	0x585370	PoDirectedDripsClearDeviceFlags
1804	0x3aa620	PoDirectedDripsSetDeviceFlags
1805	0x982260	PoDisableSleepStates
1806	0x585920	PoEndDeviceBusy
1807	0x2d6d50	PoEnergyEstimationEnabled
1808	0x2c1900	PoFxActivateComponent
1809	0x585ba0	PoFxAddComponentRelation
1810	0x585fc0	PoFxAddDeviceRelation
1811	0x2b94c0	PoFxCompleteDevicePowerNotRequired
1812	0x5863e0	PoFxCompleteDirectedPowerDown
1813	0x2a14f0	PoFxCompleteIdleCondition
1814	0x2a5fb0	PoFxCompleteIdleState
1815	0x9829c0	PoFxEnableDStateReporting
1816	0x2c2630	PoFxIdleComponent
1817	0x586400	PoFxIssueComponentPerfStateChange
1818	0x586430	PoFxIssueComponentPerfStateChangeMultiple
1819	0x5864e0	PoFxNotifySurprisePowerOn
1820	0x290a90	PoFxPowerControl
1821	0x586580	PoFxPowerOnCrashdumpDevice
1822	0x3b1700	PoFxProcessorNotification
1823	0x5865e0	PoFxQueryCurrentComponentPerfState
1824	0x982ac0	PoFxRegisterComponentPerfStates
1825	0x82d6b0	PoFxRegisterCoreDevice
1826	0x857290	PoFxRegisterCrashdumpDevice
1827	0x82d970	PoFxRegisterDevice
1828	0x3b28c0	PoFxRegisterDripsWatchdogCallback
1829	0x982b40	PoFxRegisterPlugin
1830	0x3a6b50	PoFxRegisterPluginEx
1831	0x82d580	PoFxRegisterPrimaryDevice
1832	0x586640	PoFxRemoveComponentRelation
1833	0x586a30	PoFxRemoveDeviceRelation
1834	0x2760c0	PoFxReportDevicePoweredOn
1835	0x2a4f40	PoFxSetComponentLatency
1836	0x3b2280	PoFxSetComponentResidency
1837	0x586dc0	PoFxSetComponentWake
1838	0x2b61b0	PoFxSetDeviceIdleTimeout
1839	0x982b60	PoFxSetTargetDripsDevicePowerState
1840	0x396200	PoFxStartDevicePowerManagement
1841	0x982e00	PoFxUnregisterDevice
1842	0x582220	PoGetProcessorIdleAccounting
1843	0x582000	PoGetSystemWake
1844	0x856140	PoGetThermalRequestSupport
1845	0x582250	PoInitiateProcessorWake
1846	0x28aaa0	PoLatencySensitivityHint
1847	0x3adb50	PoNotifyMediaBuffering
1848	0x289cd0	PoNotifyVSyncChange
1849	0x280150	PoQueryWatchdogTime
1850	0x985070	PoQueueShutdownWorkItem
1851	0x982320	PoReenableSleepStates
1852	0x838d70	PoRegisterCoalescingCallback
1853	0x2209e0	PoRegisterDeviceForIdleDetection
1854	0x370620	PoRegisterDeviceNotify
1855	0x6eb0e0	PoRegisterPowerSettingCallback
1856	0x58c1d0	PoRegisterSystemState
1857	0x274f70	PoRequestPowerIrp
1858	0x81d990	PoRequestShutdownEvent
1859	0x45cc90	PoSetDeviceBusyEx
1860	0xa9ecc0	PoSetFixedWakeSource
1861	0x58cdd0	PoSetHiberRange
1862	0x585670	PoSetPowerButtonHoldState
1863	0x261a70	PoSetPowerRequest
1864	0x2afa20	PoSetPowerState
1865	0x58c2a0	PoSetSystemState
1866	0x582030	PoSetSystemWake
1867	0x582060	PoSetSystemWakeDevice
1868	0x980ef0	PoSetThermalActiveCooling
1869	0x980fa0	PoSetThermalPassiveCooling
1870	0x58c2f0	PoSetUserPresent
1871	0x987860	PoShutdownBugCheck
1872	0x585930	PoStartDeviceBusy
1873	0x2b9030	PoStartNextPowerIrp
1874	0x9850f0	PoUnregisterCoalescingCallback
1875	0x985320	PoUnregisterPowerSettingCallback
1876	0x58c390	PoUnregisterSystemState
1877	0x67fae0	PoUserShutdownCancelled
1878	0x67fab0	PoUserShutdownInitiated
1879	0x725550	ProbeForRead
1880	0x7983d0	ProbeForWrite
1881	0x6d20d0	PsAcquireProcessExitSynchronization
1882	0x367cd0	PsAcquireSiloHardReference
1883	0x801d20	PsAllocSiloContextSlot
1884	0x2b9730	PsAllocateAffinityToken
1885	0x873db0	PsAssignImpersonationToken
1886	0x7d3040	PsAssignProcessToJobObject
1887	0x35e060	PsAttachSiloToCurrentThread
1888	0x277eb0	PsChargePoolQuota
1889	0x3219c0	PsChargeProcessNonPagedPoolQuota
1890	0x71d0a0	PsChargeProcessPagedPoolQuota
1891	0x278180	PsChargeProcessPoolQuota
1892	0x7c96a0	PsChargeProcessWakeCounter
1893	0x9aeb00	PsCheckProcessFileSigningLevel
1894	0x711950	PsCreateSiloContext
1895	0x6936d0	PsCreateSystemThread
1896	0x693720	PsCreateSystemThreadEx
1897	0x726a50	PsDereferenceImpersonationToken
1898	0x757a40	PsDereferenceKernelStack
1899	0x6caf80	PsDereferencePrimaryToken
1900	0x2b5360	PsDereferenceSiloContext
1901	0x35e080	PsDetachSiloFromCurrentThread
1902	0x7659b0	PsDisableImpersonation
1903	0x28b1c0	PsEnterPriorityRegion
1904	0x838b50	PsEstablishWin32Callouts
1905	0x2b9ea0	PsFreeAffinityToken
1906	0x9aa880	PsFreeSiloContextSlot
1907	0x89a960	PsGetContextThread
1908	0x262700	PsGetCurrentProcess
1909	0x331b10	PsGetCurrentProcessId
1910	0x34e380	PsGetCurrentProcessSessionId
1911	0x287580	PsGetCurrentProcessWin32Process
1912	0x2923b0	PsGetCurrentProcessWow64Process
1913	0x321e10	PsGetCurrentServerSilo
1914	0x9aa910	PsGetCurrentServerSiloName
1915	0x228f90	PsGetCurrentSilo
1916	0x2502c0	PsGetCurrentThread
1917	0x28af30	PsGetCurrentThreadId
1918	0x29b6a0	PsGetCurrentThreadPreviousMode
1919	0x2a2e90	PsGetCurrentThreadProcess
1920	0x331b10	PsGetCurrentThreadProcessId
1921	0x5a21f0	PsGetCurrentThreadStackBase
1922	0x5a2210	PsGetCurrentThreadStackLimit
1923	0x2a3390	PsGetCurrentThreadTeb
1924	0x284380	PsGetCurrentThreadWin32Thread
1925	0x282c30	PsGetCurrentThreadWin32ThreadAndEnterCriticalRegion
1926	0x28bbc0	PsGetEffectiveContainerId
1927	0x3694e0	PsGetEffectiveServerSilo
1928	0x2ab9a0	PsGetHostSilo
1929	0x5a2240	PsGetJobLock
1930	0x277a30	PsGetJobProperty
1931	0x2b9c70	PsGetJobServerSilo
1932	0x2b9c20	PsGetJobSessionId
1933	0x266600	PsGetJobSilo
1934	0x2b8e90	PsGetJobUIRestrictionsClass
1935	0x67f7b0	PsGetParentSilo
1936	0x266660	PsGetPermanentSiloContext
1937	0x5a2250	PsGetProcessCommonJob
1938	0x292360	PsGetProcessCreateTimeQuadPart
1939	0x2b6600	PsGetProcessDebugPort
1940	0x730750	PsGetProcessDxgProcess
1941	0x2b0d40	PsGetProcessExitProcessCalled
1942	0x67fb40	PsGetProcessExitStatus
1943	0x749310	PsGetProcessExitTime
1944	0x2e87b0	PsGetProcessId
1945	0x299c70	PsGetProcessImageFileName
1946	0x325910	PsGetProcessInheritedFromUniqueProcessId
1947	0x2aa3a0	PsGetProcessJob
1948	0x7b7ac0	PsGetProcessMachine
1949	0x2a33c0	PsGetProcessPeb
1950	0x5a2290	PsGetProcessPriorityClass
1951	0x2b5810	PsGetProcessProtection
1952	0x20d020	PsGetProcessSectionBaseAddress
1953	0x864730	PsGetProcessSecurityPort
1954	0x2b03a0	PsGetProcessSequenceNumber
1955	0x256f70	PsGetProcessServerSilo
1956	0x36cc20	PsGetProcessSessionId
1957	0x2626d0	PsGetProcessSessionIdEx
1958	0x3d4c10	PsGetProcessSignatureLevel
1959	0x5a22a0	PsGetProcessSilo
1960	0x299c50	PsGetProcessStartKey
1961	0x2a4670	PsGetProcessWin32Process
1962	0x2ae110	PsGetProcessWin32WindowStation
1963	0x282c10	PsGetProcessWow64Process
1964	0x226620	PsGetServerSiloServiceSessionId
1965	0x9aa940	PsGetSiloContainerId
1966	0x2ad830	PsGetSiloContext
1967	0x85aff0	PsGetSiloIdentifier
1968	0x86c5d0	PsGetSiloMonitorContextSlot
1969	0x5a22c0	PsGetThreadCreateTime
1970	0x7169f0	PsGetThreadExitStatus
1971	0x2b9470	PsGetThreadFreezeCount
1972	0x3c5300	PsGetThreadHardErrorsAreDisabled
1973	0x2929e0	PsGetThreadId
1974	0x28b510	PsGetThreadProcess
1975	0x2ab0d0	PsGetThreadProcessId
1976	0x277800	PsGetThreadProperty
1977	0x256f80	PsGetThreadServerSilo
1978	0x7831a0	PsGetThreadSessionId
1979	0x27c2d0	PsGetThreadTeb
1980	0x28d0d0	PsGetThreadWin32Thread
1981	0x2b47c0	PsGetVersion
1982	0x299600	PsGetWin32KFilterSet
1983	0x78be80	PsImpersonateClient
1984	0xd1da60	PsInitialSystemProcess
1985	0x85a1a0	PsInsertPermanentSiloContext
1986	0x711650	PsInsertSiloContext
1987	0x2b6440	PsIsComponentEnabled
1988	0x2270e0	PsIsCurrentThreadInServerSilo
1989	0x293650	PsIsCurrentThreadPrefetching
1990	0x3aa670	PsIsDiskCountersEnabled
1991	0x331b70	PsIsHostSilo
1992	0x89a920	PsIsProcessBeingDebugged
1993	0x9ac4f0	PsIsProcessCommitRelinquished
1994	0x9aa960	PsIsProcessInAppSilo
1995	0x20c480	PsIsProtectedProcess
1996	0x35eea0	PsIsProtectedProcessLight
1997	0x2efbd0	PsIsSystemProcess
1998	0x29d950	PsIsSystemThread
1999	0x8745a0	PsIsThreadImpersonating
2000	0x321b90	PsIsThreadTerminating
2001	0x2b2810	PsIsWin32KFilterAuditEnabled
2002	0x2b2840	PsIsWin32KFilterAuditEnabledForProcess
2003	0x2a68b0	PsIsWin32KFilterEnabled
2004	0x2a68e0	PsIsWin32KFilterEnabledForProcess
2005	0xd1dbd8	PsJobType
2006	0x287500	PsLeavePriorityRegion
2007	0xc13110	PsLoadedModuleList
2008	0xc130a0	PsLoadedModuleResource
2009	0x779ca0	PsLookupProcessByProcessId
2010	0x7278b0	PsLookupProcessThreadByCid
2011	0x78a120	PsLookupThreadByThreadId
2012	0x9aa990	PsMakeSiloContextPermanent
2013	0xd1ddf8	PsPartitionType
2014	0xd1da58	PsProcessType
2015	0x765440	PsQueryProcessAttributesByToken
2016	0x29ebb0	PsQueryProcessCommandLine
2017	0x9ac510	PsQueryProcessExceptionFlags
2018	0x9b27f0	PsQuerySyscallProviderInformation
2019	0x715eb0	PsQueryTotalCycleTimeProcess
2020	0x78f170	PsReferenceImpersonationToken
2021	0x758600	PsReferenceKernelStack
2022	0x6cd3e0	PsReferencePrimaryToken
2023	0x7e5fc0	PsReferenceProcessFilePointer
2024	0x3c46f0	PsReferenceSiloContext
2025	0x9b35d0	PsRegisterAltSystemCallHandler
2026	0x9b36c0	PsRegisterPicoProvider
2027	0x801d40	PsRegisterSiloMonitor
2028	0x9b2850	PsRegisterSyscallProvider
2029	0x6d2100	PsReleaseProcessExitSynchronization
2030	0x7686c0	PsReleaseProcessWakeCounter
2031	0x29e660	PsReleaseSiloHardReference
2032	0x9b3f00	PsRemoveCreateThreadNotifyRoutine
2033	0x9b3ff0	PsRemoveLoadImageNotifyRoutine
2034	0x9aa9c0	PsRemoveSiloContext
2035	0x9aaa00	PsReplaceSiloContext
2036	0x765af0	PsRestoreImpersonation
2037	0x72b320	PsResumeProcess
2038	0x277f10	PsReturnPoolQuota
2039	0x31e200	PsReturnProcessNonPagedPoolQuota
2040	0x25f420	PsReturnProcessPagedPoolQuota
2041	0x9aff70	PsRevertThreadToSelf
2042	0x9affa0	PsRevertToSelf
2043	0x5a25e0	PsRevertToUserMultipleGroupAffinityThread
2044	0x9b22e0	PsSetContextThread
2045	0x838d20	PsSetCreateProcessNotifyRoutine
2046	0x838d00	PsSetCreateProcessNotifyRoutineEx
2047	0x838d40	PsSetCreateProcessNotifyRoutineEx2
2048	0x838bc0	PsSetCreateThreadNotifyRoutine
2049	0x838a40	PsSetCreateThreadNotifyRoutineEx
2050	0x7ee2d0	PsSetCurrentThreadPrefetching
2051	0x5a23b0	PsSetJobProperty
2052	0x9b1820	PsSetLegoNotifyRoutine
2053	0x838ba0	PsSetLoadImageNotifyRoutine
2054	0x838be0	PsSetLoadImageNotifyRoutineEx
2055	0x755670	PsSetProcessDxgProcess
2056	0x67f600	PsSetProcessFaultInformation
2057	0x7d09e0	PsSetProcessPriorityByClass
2058	0x5a2420	PsSetProcessPriorityClass
2059	0x9ac730	PsSetProcessSecurityPort
2060	0x73f1f0	PsSetProcessWin32Process
2061	0x756740	PsSetProcessWindowStation
2062	0x5a2600	PsSetSystemMultipleGroupAffinityThread
2063	0x3c5150	PsSetThreadHardErrorsAreDisabled
2064	0x3c25d0	PsSetThreadProperty
2065	0x73d730	PsSetThreadWin32Thread
2066	0xc37dd0	PsSiloContextNonPagedType
2067	0xc37dd8	PsSiloContextPagedType
2068	0x840770	PsStartSiloMonitor
2069	0x9b4390	PsSuspendProcess
2070	0x9aab90	PsTerminateServerSilo
2071	0x7144e0	PsTerminateSystemThread
2072	0xd1da80	PsThreadType
2073	0x8414b0	PsTlsAlloc
2074	0x9b4460	PsTlsFree
2075	0x715460	PsTlsGetValue
2076	0x72a0d0	PsTlsSetValue
2077	0xd53b38	PsUILanguageComitted
2078	0x9b2300	PsUnregisterSiloMonitor
2079	0x9b2b40	PsUnregisterSyscallProvider
2080	0x20d300	PsUpdateComponentPower
2081	0x295d70	PsUpdateDiskCounters
2082	0x7812c0	PsWow64GetProcessMachine
2083	0x7e58e0	PsWow64IsMachineSupported
2084	0x5a30d0	PsWrapApcWow64Thread
2085	0x7bd170	RtlAbsoluteToSelfRelativeSD
2086	0x70bc30	RtlAddAccessAllowedAce
2087	0x86ba10	RtlAddAccessAllowedAceEx
2088	0x9b90d0	RtlAddAccessAllowedObjectAce
2089	0x8167d0	RtlAddAccessDeniedAceEx
2090	0x9b9130	RtlAddAccessDeniedObjectAce
2091	0x9b9190	RtlAddAccessFilterAce
2092	0x78db90	RtlAddAce
2093	0x751140	RtlAddAtomToAtomTable
2094	0x2c8260	RtlAddAtomToAtomTableEx
2095	0x9b93d0	RtlAddAuditAccessAceEx
2096	0x9b9420	RtlAddAuditAccessObjectAce
2097	0x70c1b0	RtlAddMandatoryAce
2098	0x78de20	RtlAddProcessTrustLabelAce
2099	0x817b90	RtlAddRange
2100	0x9b94b0	RtlAddResourceAttributeAce
2101	0x298240	RtlAllocateHeap
2102	0x6b8280	RtlAnsiCharToUnicodeChar
2103	0x7605d0	RtlAnsiStringToUnicodeSize
2104	0x760500	RtlAnsiStringToUnicodeString
2105	0x9b77a0	RtlAppendAsciizToString
2106	0x74a030	RtlAppendStringToString
2107	0x25e800	RtlAppendUnicodeStringToString
2108	0x225710	RtlAppendUnicodeToString
2109	0x7395e0	RtlAreAllAccessesGranted
2110	0x74ff60	RtlAreAnyAccessesGranted
2111	0x36ad00	RtlAreBitsClear
2112	0x29bc30	RtlAreBitsClearEx
2113	0x36ac30	RtlAreBitsSet
2114	0x45dbe0	RtlAreBitsSetEx
2115	0x5a85c0	RtlAssert
2116	0x31f6b0	RtlAvlInsertNodeEx
2117	0x31e230	RtlAvlRemoveNode
2118	0x709e20	RtlCapabilityCheck
2119	0x9ba2a0	RtlCapabilityCheckForSingleSessionSku
2120	0x422950	RtlCaptureContext
2121	0x2ec8c0	RtlCaptureStackBackTrace
2122	0x810b40	RtlCharToInteger
2123	0x2b4280	RtlCheckPortableOperatingSystem
2124	0x752280	RtlCheckRegistryKey
2125	0x8515b0	RtlCheckSystemBootStatusIntegrity
2126	0x262720	RtlCheckTokenCapability
2127	0x262b10	RtlCheckTokenMembership
2128	0x262cb0	RtlCheckTokenMembershipEx
2129	0x36a290	RtlClearAllBits
2130	0x2169f0	RtlClearAllBitsEx
2131	0x29bec0	RtlClearBit
2132	0x2a1610	RtlClearBitEx
2133	0x228790	RtlClearBits
2134	0x356f70	RtlClearBitsEx
2135	0x3724f0	RtlCmDecodeMemIoResource
2136	0x372580	RtlCmEncodeMemIoResource
2137	0x29af00	RtlCompareAltitudes
2138	0x5a87f0	RtlCompareExchangePointerMapping
2139	0x5a89b0	RtlCompareExchangePropertyStore
2140	0x4231a0	RtlCompareMemory
2141	0x423220	RtlCompareMemoryUlong
2142	0x6b5c60	RtlCompareString
2143	0x6b7fc0	RtlCompareUnicodeString
2144	0x6b7e60	RtlCompareUnicodeStrings
2145	0x2ae050	RtlCompressBuffer
2146	0x9b7280	RtlCompressChunks
2147	0x261d40	RtlComputeCrc32
2148	0x9bbec0	RtlConstructCrossVmEventPath
2149	0x9bbec0	RtlConstructCrossVmMutexPath
2150	0x287420	RtlContractHashTable
2151	0x5a5a70	RtlConvertHostPerfCounterToPerfCounter
2152	0x6e3750	RtlConvertSidToUnicodeString
2153	0x2ab2a0	RtlCopyBitMap
2154	0x28db70	RtlCopyBitMapEx
2155	0x782110	RtlCopyContext
2156	0x5a92c0	RtlCopyExtendedContext
2157	0x87a710	RtlCopyLuid
2158	0x9ba310	RtlCopyLuidAndAttributesArray
2159	0x42f000	RtlCopyMemory
2160	0x423250	RtlCopyMemoryNonTemporal
2161	0x818120	RtlCopyRangeList
2162	0x768510	RtlCopySid
2163	0x768450	RtlCopySidAndAttributesArray
2164	0x45da60	RtlCopyString
2165	0x331240	RtlCopyUnicodeString
2166	0x45e270	RtlCrc32
2167	0x3bc090	RtlCrc64
2168	0x78da70	RtlCreateAcl
2169	0x71c680	RtlCreateAtomTable
2170	0x287c60	RtlCreateAtomTableEx
2171	0x263f70	RtlCreateHashTable
2172	0x3c5380	RtlCreateHashTableEx
2173	0x7457b0	RtlCreateHeap
2174	0x859790	RtlCreateRegistryKey
2175	0x78d9d0	RtlCreateSecurityDescriptor
2176	0x9bc5d0	RtlCreateSystemVolumeInformationFolder
2177	0x6e3a70	RtlCreateUnicodeString
2178	0x806f60	RtlCreateUnicodeStringFromAsciiz
2179	0x9b7050	RtlCreateUserThread
2180	0x80f730	RtlCultureNameToLCID
2181	0x760760	RtlCustomCPToUnicodeN
2182	0x45d9e0	RtlDecompressBuffer
2183	0x36ffe0	RtlDecompressBufferEx
2184	0x370130	RtlDecompressBufferEx2
2185	0x9b73f0	RtlDecompressChunks
2186	0x9b7650	RtlDecompressFragment
2187	0x2b5b60	RtlDecompressFragmentEx
2188	0x26aec0	RtlDelete
2189	0x70dc70	RtlDeleteAce
2190	0x7dcc10	RtlDeleteAtomFromAtomTable
2191	0x26ae30	RtlDeleteElementGenericTable
2192	0x225eb0	RtlDeleteElementGenericTableAvl
2193	0x5aca50	RtlDeleteElementGenericTableAvlEx
2194	0x3bf550	RtlDeleteHashTable
2195	0x26a130	RtlDeleteNoSplay
2196	0x8187c0	RtlDeleteOwnersRanges
2197	0x8186f0	RtlDeleteRange
2198	0x86aab0	RtlDeleteRegistryValue
2199	0x262b30	RtlDeriveCapabilitySidsFromName
2200	0x9b76e0	RtlDescribeChunk
2201	0x7dff70	RtlDestroyAtomTable
2202	0x756970	RtlDestroyHeap
2203	0x89ad20	RtlDowncaseUnicodeChar
2204	0x72ad20	RtlDowncaseUnicodeString
2205	0x5a6110	RtlDrainNonVolatileFlush
2206	0x723510	RtlDuplicateUnicodeString
2207	0x9ba000	RtlEmptyAtomTable
2208	0x2abfc0	RtlEndEnumerationHashTable
2209	0x2b9030	RtlEndStrongEnumerationHashTable
2210	0x3d5670	RtlEndWeakEnumerationHashTable
2211	0x3637b0	RtlEnumerateEntryHashTable
2212	0x3b3aa0	RtlEnumerateGenericTable
2213	0x291110	RtlEnumerateGenericTableAvl
2214	0x2911a0	RtlEnumerateGenericTableLikeADirectory
2215	0x2b1de0	RtlEnumerateGenericTableWithoutSplaying
2216	0x291140	RtlEnumerateGenericTableWithoutSplayingAvl
2217	0x9ba340	RtlEqualLuid
2218	0x225620	RtlEqualSid
2219	0x297cf0	RtlEqualString
2220	0x6b8170	RtlEqualUnicodeString
2221	0x9bcf50	RtlEqualWnfChangeStamps
2222	0x5acbe0	RtlEthernetAddressToStringA
2223	0x3b4260	RtlEthernetAddressToStringW
2224	0x5ad0c0	RtlEthernetStringToAddressA
2225	0x5adae0	RtlEthernetStringToAddressW
2226	0x263d70	RtlExpandHashTable
2227	0x9bcf60	RtlExtendCorrelationVector
2228	0x5a61d0	RtlExtractBitMap
2229	0x5a6370	RtlExtractBitMapEx
2230	0x5adcc0	RtlFillMemory
2231	0x423390	RtlFillMemoryNonTemporal
2232	0x5adce0	RtlFillNonVolatileMemory
2233	0x32f460	RtlFindAceByType
2234	0x35d470	RtlFindClearBits
2235	0x35cdb0	RtlFindClearBitsAndSet
2236	0x356830	RtlFindClearBitsAndSetEx
2237	0x2cca60	RtlFindClearBitsEx
2238	0x2571f0	RtlFindClearRuns
2239	0x5a8740	RtlFindClosestEncodableLength
2240	0x76fa80	RtlFindExportedRoutineByName
2241	0x3a07a0	RtlFindFirstRunClear
2242	0x35bc20	RtlFindLastBackwardRunClear
2243	0x2a6420	RtlFindLeastSignificantBit
2244	0x5a6530	RtlFindLongestRunClear
2245	0x7ca330	RtlFindMessage
2246	0x2a07a0	RtlFindMostSignificantBit
2247	0x36a180	RtlFindNextForwardRunClear
2248	0x5a67e0	RtlFindNextForwardRunClearCapped
2249	0x45dcc0	RtlFindNextForwardRunClearEx
2250	0x81b9f0	RtlFindRange
2251	0x35d800	RtlFindSetBits
2252	0x5a69f0	RtlFindSetBitsAndClear
2253	0x356bc0	RtlFindSetBitsAndClearEx
2254	0x290700	RtlFindSetBitsEx
2255	0x712b40	RtlFindUnicodePrefix
2256	0x6b71b0	RtlFindUnicodeSubstring
2257	0x70c330	RtlFirstFreeAce
2258	0x5a6140	RtlFlushNonVolatileMemory
2259	0x5add90	RtlFlushNonVolatileMemoryRanges
2260	0x6e34e0	RtlFormatCurrentUserKeyPath
2261	0x9b7d30	RtlFormatMessage
2262	0x763fa0	RtlFreeAnsiString
2263	0x298160	RtlFreeHeap
2264	0x5ade20	RtlFreeNonVolatileToken
2265	0x8572d0	RtlFreeOemString
2266	0x8188a0	RtlFreeRangeList
2267	0x763fa0	RtlFreeUTF8String
2268	0x774470	RtlFreeUnicodeString
2269	0x6ad140	RtlGUIDFromString
2270	0x724f80	RtlGenerate8dot3Name
2271	0x813a80	RtlGenerateClass5Guid
2272	0x222920	RtlGetAce
2273	0x2b03b0	RtlGetActiveConsoleId
2274	0x5a8390	RtlGetAppContainerNamedObjectPath
2275	0x9ba360	RtlGetAppContainerParent
2276	0x709450	RtlGetAppContainerSidType
2277	0x3c0640	RtlGetCallersAddress
2278	0x36ff80	RtlGetCompressionWorkSpaceSize
2279	0x9bd490	RtlGetConsoleSessionForegroundProcessId
2280	0x7bcbc0	RtlGetControlSecurityDescriptor
2281	0x2b90e0	RtlGetCurrentServiceSessionId
2282	0x35e000	RtlGetDaclSecurityDescriptor
2283	0x757540	RtlGetDefaultCodePage
2284	0x2a3870	RtlGetElementGenericTable
2285	0x5acab0	RtlGetElementGenericTableAvl
2286	0x5adf20	RtlGetEnabledExtendedAndSupervisorFeatures
2287	0x3b2cc0	RtlGetEnabledExtendedFeatures
2288	0x2e9be0	RtlGetExtendedContextLength
2289	0x81b8c0	RtlGetFirstRange
2290	0x7bcc80	RtlGetGroupSecurityDescriptor
2291	0x7647b0	RtlGetIntegerAtom
2292	0x81bcd0	RtlGetLastRange
2293	0x2aef70	RtlGetMultiTimePrecise
2294	0x284300	RtlGetNextEntryHashTable
2295	0x81bc20	RtlGetNextRange
2296	0x5ade40	RtlGetNonVolatileToken
2297	0x9bb920	RtlGetNtGlobalFlags
2298	0x2c81d0	RtlGetNtProductType
2299	0x75c470	RtlGetNtSystemRoot
2300	0x7bcc40	RtlGetOwnerSecurityDescriptor
2301	0x69f940	RtlGetPersistedStateLocation
2302	0x2b5820	RtlGetProductInfo
2303	0x7aef10	RtlGetSaclSecurityDescriptor
2304	0x9ba430	RtlGetSessionProperties
2305	0x70dd20	RtlGetSetBootStatusData
2306	0x762fd0	RtlGetSuiteMask
2307	0x858fc0	RtlGetSystemBootStatus
2308	0x851580	RtlGetSystemBootStatusEx
2309	0x290bf0	RtlGetSystemGlobalData
2310	0x2b1b90	RtlGetThreadLangIdByIndex
2311	0x9ba540	RtlGetTokenNamedObjectPath
2312	0x762f10	RtlGetVersion
2313	0x6b72b0	RtlHashUnicodeString
2314	0x9bd520	RtlIdnToAscii
2315	0x9bd550	RtlIdnToNameprepUnicode
2316	0x9bd580	RtlIdnToUnicode
2317	0x2c9910	RtlImageDirectoryEntryToData
2318	0x2c9a20	RtlImageNtHeader
2319	0x2c9a50	RtlImageNtHeaderEx
2320	0x9bcfb0	RtlIncrementCorrelationVector
2321	0x20cfe0	RtlInitAnsiString
2322	0x386df0	RtlInitAnsiStringEx
2323	0x804670	RtlInitCodePageTable
2324	0x263c60	RtlInitEnumerationHashTable
2325	0x20cfe0	RtlInitString
2326	0x5a5b90	RtlInitStringEx
2327	0x3d3a90	RtlInitStrongEnumerationHashTable
2328	0x5a5bb0	RtlInitUTF8String
2329	0x5a5b90	RtlInitUTF8StringEx
2330	0x228f40	RtlInitUnicodeString
2331	0x226cc0	RtlInitUnicodeStringEx
2332	0x3d5650	RtlInitWeakEnumerationHashTable
2333	0x29a9f0	RtlInitializeBitMap
2334	0x3b32b0	RtlInitializeBitMapEx
2335	0x9bd0a0	RtlInitializeCorrelationVector
2336	0x2e9b60	RtlInitializeExtendedContext
2337	0x2b0130	RtlInitializeGenericTable
2338	0x225e50	RtlInitializeGenericTableAvl
2339	0x816d00	RtlInitializeRangeList
2340	0x70bc00	RtlInitializeSid
2341	0x262ab0	RtlInitializeSidEx
2342	0x858360	RtlInitializeUnicodePrefix
2343	0x26af60	RtlInsertElementGenericTable
2344	0x226110	RtlInsertElementGenericTableAvl
2345	0x26afd0	RtlInsertElementGenericTableFull
2346	0x2261d0	RtlInsertElementGenericTableFullAvl
2347	0x363380	RtlInsertEntryHashTable
2348	0x712a00	RtlInsertUnicodePrefix
2349	0x7ae650	RtlInt64ToUnicodeString
2350	0x73c230	RtlIntegerToChar
2351	0x6e3930	RtlIntegerToUnicode
2352	0x73c1a0	RtlIntegerToUnicodeString
2353	0x2c90e0	RtlInterlockedClearBitRun
2354	0x45ddc0	RtlInterlockedClearBitRunEx
2355	0x5a6dc0	RtlInterlockedSetBitRun
2356	0x45de80	RtlInterlockedSetBitRunEx
2357	0x35cc80	RtlInterlockedSetClearRun
2358	0x5a6e80	RtlIntersectBitMaps
2359	0x293e60	RtlIntersectBitMapsEx
2360	0x817860	RtlInvertRangeList
2361	0x817a50	RtlInvertRangeListEx
2362	0x372520	RtlIoDecodeMemIoResource
2363	0x3a3200	RtlIoEncodeMemIoResource
2364	0x3cc210	RtlIpv4AddressToStringA
2365	0x5acc50	RtlIpv4AddressToStringExA
2366	0x3bd0b0	RtlIpv4AddressToStringExW
2367	0x3bd180	RtlIpv4AddressToStringW
2368	0x3cce30	RtlIpv4StringToAddressA
2369	0x5ad200	RtlIpv4StringToAddressExA
2370	0x3c4660	RtlIpv4StringToAddressExW
2371	0x2a6320	RtlIpv4StringToAddressW
2372	0x5acd10	RtlIpv6AddressToStringA
2373	0x5acfa0	RtlIpv6AddressToStringExA
2374	0x3a2240	RtlIpv6AddressToStringExW
2375	0x3a2320	RtlIpv6AddressToStringW
2376	0x5ad3d0	RtlIpv6StringToAddressA
2377	0x5ad830	RtlIpv6StringToAddressExA
2378	0x2a2eb0	RtlIpv6StringToAddressExW
2379	0x2a2f50	RtlIpv6StringToAddressW
2380	0x73f460	RtlIsApiSetImplemented
2381	0x45e290	RtlIsCloudFilesPlaceholder
2382	0x765190	RtlIsElevatedRid
2383	0x3c4620	RtlIsGenericTableEmpty
2384	0x225d70	RtlIsGenericTableEmptyAvl
2385	0x7082e0	RtlIsMultiSessionSku
2386	0x9ba570	RtlIsMultiUsersInSessionSku
2387	0x72bc00	RtlIsNameLegalDOS8Dot3
2388	0x2abb20	RtlIsNonEmptyDirectoryReparsePointAllowed
2389	0x9bfda0	RtlIsNormalizedString
2390	0x3b4300	RtlIsNtDdiVersionAvailable
2391	0x89ae10	RtlIsPartialPlaceholder
2392	0x9be450	RtlIsPartialPlaceholderFileHandle
2393	0x9be4b0	RtlIsPartialPlaceholderFileInfo
2394	0x2af950	RtlIsProcessorFeaturePresent
2395	0x81b800	RtlIsRangeAvailable
2396	0x7093a0	RtlIsSandboxedToken
2397	0x5ae060	RtlIsServicePackVersionInstalled
2398	0x74ed40	RtlIsStateSeparationEnabled
2399	0x200ee0	RtlIsUntrustedObject
2400	0x9bd390	RtlIsValidOemCharacter
2401	0x5ae820	RtlIsZeroMemory
2402	0x9bced0	RtlLCIDToCultureName
2403	0x7ae700	RtlLargeIntegerToChar
2404	0x73dee0	RtlLengthRequiredSid
2405	0x7ae830	RtlLengthSecurityDescriptor
2406	0x222900	RtlLengthSid
2407	0x9b85b0	RtlLoadString
2408	0x9b7150	RtlLocalTimeToSystemTime
2409	0x5adf50	RtlLocateSupervisorFeature
2410	0x70d200	RtlLockBootStatusData
2411	0x7644b0	RtlLookupAtomInAtomTable
2412	0x26ada0	RtlLookupElementGenericTable
2413	0x227ca0	RtlLookupElementGenericTableAvl
2414	0x5ac9f0	RtlLookupElementGenericTableFull
2415	0x225d80	RtlLookupElementGenericTableFullAvl
2416	0x2638f0	RtlLookupEntryHashTable
2417	0x3d2b30	RtlLookupFirstMatchingElementGenericTableAvl
2418	0x2ee870	RtlLookupFunctionEntry
2419	0x7312b0	RtlMapGenericMask
2420	0x3cd610	RtlMapSecurityErrorToNtStatus
2421	0x36b080	RtlMergeBitMaps
2422	0x3a28f0	RtlMergeBitMapsEx
2423	0x9b6f40	RtlMergeRangeLists
2424	0x42f000	RtlMoveMemory
2425	0x760690	RtlMultiByteToUnicodeN
2426	0x760600	RtlMultiByteToUnicodeSize
2427	0x85afa0	RtlNextUnicodePrefix
2428	0x3c1fb0	RtlNormalizeSecurityDescriptor
2429	0x9bfe30	RtlNormalizeString
2430	0x5af0a0	RtlNotifyFeatureUsage
2431	0x7145a0	RtlNtStatusToDosError
2432	0x279b20	RtlNtStatusToDosErrorNoTeb
2433	0x2ae120	RtlNumberGenericTableElements
2434	0x2ba040	RtlNumberGenericTableElementsAvl
2435	0x369e90	RtlNumberOfClearBits
2436	0x5a7060	RtlNumberOfClearBitsEx
2437	0x5a7090	RtlNumberOfClearBitsInRange
2438	0x369ec0	RtlNumberOfSetBits
2439	0x5a70c0	RtlNumberOfSetBitsEx
2440	0x5a7260	RtlNumberOfSetBitsInRange
2441	0x5a74e0	RtlNumberOfSetBitsInRangeEx
2442	0x3b06e0	RtlNumberOfSetBitsUlongPtr
2443	0x7471d0	RtlOemStringToCountedUnicodeString
2444	0x7605d0	RtlOemStringToUnicodeSize
2445	0x862de0	RtlOemStringToUnicodeString
2446	0x760c30	RtlOemToUnicodeN
2447	0x7cb980	RtlOpenCurrentUser
2448	0x7b4c00	RtlOpenImageFileOptionsKey
2449	0x9c0040	RtlOsDeploymentState
2450	0x282d20	RtlOwnerAcesPresent
2451	0x3c1a80	RtlPcToFileHeader
2452	0x3a8390	RtlPcToFileName
2453	0x89ae80	RtlPcToFilePath
2454	0x73d5d0	RtlPinAtomInAtomTable
2455	0x423370	RtlPrefetchMemoryNonTemporal
2456	0x731860	RtlPrefixString
2457	0x6b7ca0	RtlPrefixUnicodeString
2458	0x9bff60	RtlQueryAllFeatureConfigurations
2459	0x7640a0	RtlQueryAtomInAtomTable
2460	0x9bb930	RtlQueryDynamicTimeZoneInformation
2461	0x740090	RtlQueryElevationFlags
2462	0x2a6900	RtlQueryFeatureConfiguration
2463	0x2b6c70	RtlQueryFeatureConfigurationChangeStamp
2464	0x7b71a0	RtlQueryImageFileKeyOption
2465	0x78d590	RtlQueryInformationAcl
2466	0x72c550	RtlQueryModuleInformation
2467	0x362d40	RtlQueryPackageClaims
2468	0x362c90	RtlQueryPackageIdentity
2469	0x5a8cf0	RtlQueryPointerMapping
2470	0x9be530	RtlQueryProcessPlaceholderCompatibilityMode
2471	0x5a8e30	RtlQueryPropertyStore
2472	0x69b260	RtlQueryRegistryValueWithFallback
2473	0x756ee0	RtlQueryRegistryValues
2474	0x6a1fd0	RtlQueryRegistryValuesEx
2475	0x9be560	RtlQueryThreadPlaceholderCompatibilityMode
2476	0x9bb950	RtlQueryTimeZoneInformation
2477	0x5af3e0	RtlQueryValidationRunlevel
2478	0x5af4c0	RtlRaiseCustomSystemEventTrigger
2479	0x2ec100	RtlRaiseException
2480	0x259c40	RtlRaiseStatus
2481	0x753300	RtlRandom
2482	0x360610	RtlRandomEx
2483	0x247aa0	RtlRbInsertNodeEx
2484	0x246710	RtlRbRemoveNode
2485	0x295160	RtlRbReplaceNode
2486	0x5ac970	RtlRealPredecessor
2487	0x269ef0	RtlRealSuccessor
2488	0x38ab90	RtlRegisterFeatureConfigurationChangeNotification
2489	0x3638d0	RtlRemoveEntryHashTable
2490	0x5a8f20	RtlRemovePointerMapping
2491	0x5a9080	RtlRemovePropertyStore
2492	0x712920	RtlRemoveUnicodePrefix
2493	0x9ba620	RtlReplaceSidInSd
2494	0x9b7740	RtlReserveChunk
2495	0x422c50	RtlRestoreContext
2496	0x9bbe50	RtlRestoreSystemBootStatusDefaults
2497	0x762440	RtlRunOnceBeginInitialize
2498	0x7211a0	RtlRunOnceComplete
2499	0x762360	RtlRunOnceExecuteOnce
2500	0x801270	RtlRunOnceInitialize
2501	0x3aeba0	RtlSecondsSince1970ToTime
2502	0x5a5b20	RtlSecondsSince1980ToTime
2503	0x869590	RtlSelfRelativeToAbsoluteSD
2504	0x9b8f30	RtlSelfRelativeToAbsoluteSD2
2505	0x758270	RtlSetActiveConsoleId
2506	0x24eff0	RtlSetAllBits
2507	0x3b3490	RtlSetAllBitsEx
2508	0x29a7d0	RtlSetBit
2509	0x29d9f0	RtlSetBitEx
2510	0x24da40	RtlSetBits
2511	0x355dc0	RtlSetBitsEx
2512	0x7572e0	RtlSetConsoleSessionForegroundProcessId
2513	0x851f30	RtlSetControlSecurityDescriptor
2514	0x696e10	RtlSetDaclSecurityDescriptor
2515	0x9bb970	RtlSetDynamicTimeZoneInformation
2516	0x70bc60	RtlSetGroupSecurityDescriptor
2517	0x70bcc0	RtlSetOwnerSecurityDescriptor
2518	0x5a86f0	RtlSetPortableOperatingSystem
2519	0x9be5a0	RtlSetProcessPlaceholderCompatibilityMode
2520	0x78da00	RtlSetSaclSecurityDescriptor
2521	0x750130	RtlSetSystemBootStatus
2522	0x9bbe90	RtlSetSystemBootStatusEx
2523	0x2a5c50	RtlSetSystemGlobalData
2524	0x89ae30	RtlSetThreadPlaceholderCompatibilityMode
2525	0x9bb990	RtlSetTimeZoneInformation
2526	0x5a7760	RtlShiftLeftBitMap
2527	0x5a77d0	RtlShiftLeftBitMapEx
2528	0x2232d0	RtlSidHashInitialize
2529	0x296a10	RtlSidHashLookup
2530	0x5a8260	RtlSizeHeap
2531	0x26b0d0	RtlSplay
2532	0x7cefe0	RtlStringFromGUID
2533	0x7cf000	RtlStringFromGUIDEx
2534	0x3ca140	RtlStronglyEnumerateEntryHashTable
2535	0x2c8650	RtlSubAuthorityCountSid
2536	0x2c8660	RtlSubAuthoritySid
2537	0x26b390	RtlSubtreePredecessor
2538	0x5ac9c0	RtlSubtreeSuccessor
2539	0x9b6d60	RtlSuffixUnicodeString
2540	0x84eb80	RtlSystemTimeToLocalTime
2541	0x295dd0	RtlTestBit
2542	0x40e920	RtlTestBitEx
2543	0x289180	RtlTimeFieldsToTime
2544	0x9b71d0	RtlTimeToElapsedTimeFields
2545	0x45d9a0	RtlTimeToSecondsSince1970
2546	0x5a5b50	RtlTimeToSecondsSince1980
2547	0x2894e0	RtlTimeToTimeFields
2548	0x5af740	RtlTraceDatabaseAdd
2549	0x5af7a0	RtlTraceDatabaseCreate
2550	0x5af910	RtlTraceDatabaseDestroy
2551	0x5af960	RtlTraceDatabaseEnumerate
2552	0x5afa20	RtlTraceDatabaseFind
2553	0x5afa90	RtlTraceDatabaseLock
2554	0x5afab0	RtlTraceDatabaseUnlock
2555	0x5afad0	RtlTraceDatabaseValidate
2556	0x9c05f0	RtlUTF8StringToUnicodeString
2557	0x6b8450	RtlUTF8ToUnicodeN
2558	0x3a3df0	RtlUdiv128
2559	0x72beb0	RtlUnicodeStringToAnsiSize
2560	0x761160	RtlUnicodeStringToAnsiString
2561	0x72bb20	RtlUnicodeStringToCountedOemString
2562	0x9bb800	RtlUnicodeStringToInt64
2563	0x712670	RtlUnicodeStringToInteger
2564	0x72beb0	RtlUnicodeStringToOemSize
2565	0x856450	RtlUnicodeStringToOemString
2566	0x9c0700	RtlUnicodeStringToUTF8String
2567	0x72c0b0	RtlUnicodeToCustomCPN
2568	0x6b7d60	RtlUnicodeToMultiByteN
2569	0x761250	RtlUnicodeToMultiByteSize
2570	0x72c050	RtlUnicodeToOemN
2571	0x7612e0	RtlUnicodeToUTF8N
2572	0x70e400	RtlUnlockBootStatusData
2573	0x9c0020	RtlUnregisterFeatureConfigurationChangeNotification
2574	0x40ee30	RtlUnsignedMultiplyHigh
2575	0x3c2130	RtlUnwind
2576	0x2ee120	RtlUnwindEx
2577	0x6b8100	RtlUpcaseUnicodeChar
2578	0x7603f0	RtlUpcaseUnicodeString
2579	0x9b6e20	RtlUpcaseUnicodeStringToAnsiString
2580	0x72bdd0	RtlUpcaseUnicodeStringToCountedOemString
2581	0x86ae80	RtlUpcaseUnicodeStringToOemString
2582	0x9b7bc0	RtlUpcaseUnicodeToCustomCPN
2583	0x6b7c00	RtlUpcaseUnicodeToMultiByteN
2584	0x72bee0	RtlUpcaseUnicodeToOemN
2585	0x6b6360	RtlUpperChar
2586	0x6b7f40	RtlUpperString
2587	0x78dcd0	RtlValidAcl
2588	0x7ad170	RtlValidRelativeSecurityDescriptor
2589	0x721610	RtlValidSecurityDescriptor
2590	0x78e7f0	RtlValidSid
2591	0x9bd120	RtlValidateCorrelationVector
2592	0x2906b0	RtlValidateUnicodeString
2593	0x382cc0	RtlVerifyVersionInfo
2594	0x2ec230	RtlVirtualUnwind
2595	0x2eedc0	RtlVirtualUnwind2
2596	0x6d8460	RtlVolumeDeviceToDosName
2597	0x2ec940	RtlWalkFrameChain
2598	0x3d5630	RtlWeaklyEnumerateEntryHashTable
2599	0x5ade60	RtlWriteNonVolatileMemory
2600	0x73f550	RtlWriteRegistryValue
2601	0x9bc040	RtlZeroHeap
2602	0x563f80	RtlZeroMemory
2603	0x7605d0	RtlxAnsiStringToUnicodeSize
2604	0x7605d0	RtlxOemStringToUnicodeSize
2605	0x72beb0	RtlxUnicodeStringToAnsiSize
2606	0x72beb0	RtlxUnicodeStringToOemSize
2607	0x22c2f0	SeAccessCheck
2608	0x3cd960	SeAccessCheckEx
2609	0x223510	SeAccessCheckFromState
2610	0x223610	SeAccessCheckFromStateEx
2611	0x22c360	SeAccessCheckWithHint
2612	0x718290	SeAdjustAccessStateForAccessConstraints
2613	0x9c7e10	SeAdjustAccessStateForTrustLabel
2614	0x7f2760	SeAdjustObjectSecurity
2615	0x722870	SeAppendPrivileges
2616	0x72f420	SeAssignSecurity
2617	0x72c9d0	SeAssignSecurityEx
2618	0x9c88e0	SeAuditFipsCryptoSelftests
2619	0x9c8c80	SeAuditHardLinkCreation
2620	0x9c8ca0	SeAuditHardLinkCreationWithTransaction
2621	0x9c9570	SeAuditTransactionStateChange
2622	0x9cb7a0	SeAuditingAnyFileEventsWithContext
2623	0x224510	SeAuditingAnyFileEventsWithContextEx
2624	0x9cb7c0	SeAuditingFileEvents
2625	0x9cb800	SeAuditingFileEventsWithContext
2626	0x5b72a0	SeAuditingFileEventsWithContextEx
2627	0x9cb820	SeAuditingFileOrGlobalEvents
2628	0x9cb910	SeAuditingHardLinkEvents
2629	0x86c750	SeAuditingHardLinkEventsWithContext
2630	0x7669e0	SeAuditingWithTokenForSubcategory
2631	0x78dfa0	SeCaptureSecurityDescriptor
2632	0x78f010	SeCaptureSubjectContext
2633	0x78f040	SeCaptureSubjectContextEx
2634	0x7ae170	SeCheckForCriticalAceRemoval
2635	0x9cc2e0	SeCloseObjectAuditAlarm
2636	0x9cc350	SeCloseObjectAuditAlarmForNonObObject
2637	0x756f20	SeCompareSigningLevels
2638	0x2a0770	SeComputeAutoInheritByObjectType
2639	0x363930	SeConvertSecurityDescriptorToStringSecurityDescriptor
2640	0x5b7f90	SeConvertSidToStringSid
2641	0x3639c0	SeConvertStringSecurityDescriptorToSecurityDescriptor
2642	0x2b92e0	SeConvertStringSidToSid
2643	0x69d3d0	SeCreateAccessState
2644	0x69d410	SeCreateAccessStateEx
2645	0x5b5e00	SeCreateAndRegisterAccessCheckDebugContext
2646	0x788f50	SeCreateClientSecurity
2647	0x788ae0	SeCreateClientSecurityEx
2648	0x752c70	SeCreateClientSecurityFromSubjectContext
2649	0x5b7580	SeCreateClientSecurityFromSubjectContextEx
2650	0x72c790	SeDeassignSecurity
2651	0x7473b0	SeDeleteAccessState
2652	0x700e60	SeDeleteClientSecurity
2653	0x9cc380	SeDeleteObjectAuditAlarm
2654	0x9cc3a0	SeDeleteObjectAuditAlarmWithTransaction
2655	0x5fd2d0	SeEtwWriteKMCveEvent
2656	0x89b040	SeExamineSacl
2657	0xd53a38	SeExports
2658	0x809d70	SeFilterToken
2659	0x25f140	SeFreePrivileges
2660	0x736550	SeGetCachedSigningLevel
2661	0x9cd400	SeGetLinkedToken
2662	0x74bb60	SeGetLogonSessionToken
2663	0xc09300	SeILSigningPolicyPtr
2664	0x9cd250	SeImpersonateClient
2665	0x700d20	SeImpersonateClientEx
2666	0x9c78a0	SeIsParentOfChildAppContainer
2667	0x7e69a0	SeLocateProcessImageName
2668	0x69d6e0	SeLockSubjectContext
2669	0x879e90	SeMarkLogonSessionForTerminationNotification
2670	0x879eb0	SeMarkLogonSessionForTerminationNotificationEx
2671	0x69a6a0	SeOpenObjectAuditAlarm
2672	0x857dc0	SeOpenObjectAuditAlarmForNonObObject
2673	0x69a700	SeOpenObjectAuditAlarmWithTransaction
2674	0x9cc410	SeOpenObjectForDeleteAuditAlarm
2675	0x9cc470	SeOpenObjectForDeleteAuditAlarmWithTransaction
2676	0x79d970	SePrivilegeCheck
2677	0x69d880	SePrivilegeObjectAuditAlarm
2678	0xd53b98	SePublicDefaultDacl
2679	0x729490	SeQueryAuthenticationIdToken
2680	0x764860	SeQueryInformationToken
2681	0x9ceb80	SeQuerySecureBootPlatformManifest
2682	0x85b070	SeQuerySecureBootPolicyValue
2683	0x7b8f30	SeQuerySecurityAttributesToken
2684	0x2a8680	SeQuerySecurityAttributesTokenAccessInformation
2685	0x6b3750	SeQuerySecurityDescriptorInfo
2686	0x74b290	SeQueryServerSiloToken
2687	0x765220	SeQuerySessionIdToken
2688	0x6aacd0	SeQuerySessionIdTokenEx
2689	0x85a470	SeRegisterImageVerificationCallback
2690	0x9cded0	SeRegisterLogonSessionTerminatedRoutine
2691	0x855fc0	SeRegisterLogonSessionTerminatedRoutineEx
2692	0x78e820	SeReleaseSecurityDescriptor
2693	0x78f290	SeReleaseSubjectContext
2694	0x5b7150	SeReportSecurityEvent
2695	0x2c8a20	SeReportSecurityEventWithSubCategory
2696	0x2c86b0	SeSecurityAttributePresent
2697	0x9c8310	SeSetAccessStateGenericMapping
2698	0x284890	SeSetAuditParameter
2699	0x74dc00	SeSetSecurityAttributesToken
2700	0x3a0360	SeSetSecurityAttributesTokenEx
2701	0x7bd880	SeSetSecurityDescriptorInfo
2702	0x74cc90	SeSetSecurityDescriptorInfoEx
2703	0x9c7970	SeSetSessionIdTokenWithLinked
2704	0x78e850	SeShouldCheckForAccessRightsFromParent
2705	0x78ef50	SeSinglePrivilegeCheck
2706	0x2b4bd0	SeSrpAccessCheck
2707	0xd53b90	SeSystemDefaultDacl
2708	0xd53e68	SeSystemDefaultSd
2709	0x2b37c0	SeTokenFromAccessInformation
2710	0x874130	SeTokenImpersonationLevel
2711	0x7e5b10	SeTokenIsAdmin
2712	0x2236b0	SeTokenIsRestricted
2713	0x264150	SeTokenIsWriteRestricted
2714	0xd52020	SeTokenObjectType
2715	0x86c740	SeTokenType
2716	0x3b5300	SeUnRegisterAndFreeAccessCheckDebugContext
2717	0x69d6a0	SeUnlockSubjectContext
2718	0x9c6ff0	SeUnregisterImageVerificationCallback
2719	0x9cdf70	SeUnregisterLogonSessionTerminatedRoutine
2720	0x9ce040	SeUnregisterLogonSessionTerminatedRoutineEx
2721	0x720740	SeValidSecurityDescriptor
2722	0x5a3390	SkAcquirePushLockExclusive
2723	0x5a3390	SkAllocatePool
2724	0x5a3390	SkFreePool
2725	0x5a3390	SkInitializePushLock
2726	0x3b5300	SkIsSecureKernel
2727	0x5a3390	SkQuerySecureKernelInformation
2728	0x5a3390	SkReleasePushLockExclusive
2729	0x3d5ea0	TmCancelPropagationRequest
2730	0x3d5ec0	TmCommitComplete
2731	0x3d5ee0	TmCommitEnlistment
2732	0x3d5f00	TmCommitTransaction
2733	0x3d5f20	TmCreateEnlistment
2734	0x3d5f40	TmCurrentTransaction
2735	0x3d5f60	TmDereferenceEnlistmentKey
2736	0x3d5f80	TmEnableCallbacks
2737	0x3d5fa0	TmEndPropagationRequest
2738	0xd1e410	TmEnlistmentObjectType
2739	0x3d5fc0	TmFreezeTransactions
2740	0x3d5fe0	TmGetTransactionId
2741	0x3d5a20	TmInitSystem
2742	0x3d5a00	TmInitSystemPhase2
2743	0x3d6000	TmInitializeTransactionManager
2744	0x3d6020	TmIsKTMCommitCoordinator
2745	0x3d6040	TmIsTransactionActive
2746	0x3d6060	TmPrePrepareComplete
2747	0x3d6080	TmPrePrepareEnlistment
2748	0x3d60a0	TmPrepareComplete
2749	0x3d60c0	TmPrepareEnlistment
2750	0x3d60e0	TmPropagationComplete
2751	0x3d6100	TmPropagationFailed
2752	0x3d6120	TmReadOnlyEnlistment
2753	0x3d6140	TmRecoverEnlistment
2754	0x3d6160	TmRecoverResourceManager
2755	0x3d6180	TmRecoverTransactionManager
2756	0x3d61a0	TmReferenceEnlistmentKey
2757	0x3d61c0	TmRenameTransactionManager
2758	0x3d61e0	TmRequestOutcomeEnlistment
2759	0xd1e1f0	TmResourceManagerObjectType
2760	0x3d6200	TmRollbackComplete
2761	0x3d6220	TmRollbackEnlistment
2762	0x3d6240	TmRollbackTransaction
2763	0x3d6260	TmSetCurrentTransaction
2764	0x3d6280	TmSinglePhaseReject
2765	0x3d62a0	TmThawTransactions
2766	0xd1e1e8	TmTransactionManagerObjectType
2767	0xd1de20	TmTransactionObjectType
2768	0x9a0850	TtmNotifyDeviceArrival
2769	0x9a0b50	TtmNotifyDeviceDeparture
2770	0x9a0c10	TtmNotifyDeviceInput
2771	0x3a2aa0	VerSetConditionMask
2772	0x5cc890	VfCheckNxPagePriority
2773	0x5cc8b0	VfCheckNxPageProtection
2774	0x5cc8d0	VfCheckNxPoolType
2775	0x3b2680	VfFailDeviceNode
2776	0x5cc8f0	VfFailDriver
2777	0x5cc920	VfFailSystemBIOS
2778	0x5cc960	VfInsertContext
2779	0xabb5f0	VfIsRuleClassEnabled
2780	0x3b26c0	VfIsVerificationEnabled
2781	0x5cca30	VfQueryDeviceContext
2782	0x5ccbf0	VfQueryDispatchTable
2783	0x5cca70	VfQueryDriverContext
2784	0x5ccab0	VfQueryIrpContext
2785	0x5ccaf0	VfRemoveContext
2786	0x93ff50	VslCreateSecureSection
2787	0x940370	VslDeleteSecureSection
2788	0x3c47e0	VslExchangeEntropy
2789	0x548c00	VslGetSecurePciDeviceAlternateFunctionNumberForVtl0Dma
2790	0x548ca0	VslGetSecurePciDeviceBootConfiguration
2791	0x3b4be0	VslGetSecurePciEnabled
2792	0x84ddd0	VslQuerySecureDevice
2793	0x549d70	VslRetrieveMailbox
2794	0x8019d0	WheaAddErrorSource
2795	0x801800	WheaAddErrorSourceDeviceDriver
2796	0x3b3710	WheaAddErrorSourceDeviceDriverV1
2797	0x60f6d0	WheaAddHwErrorReportSectionDeviceDriver
2798	0xa05e80	WheaAttemptClearPoison
2799	0xa05f50	WheaAttemptPhysicalPageOffline
2800	0xa8e120	WheaConfigureErrorSource
2801	0x60f7e0	WheaCreateHwErrorReportDeviceDriver
2802	0x611230	WheaDeferredRecoveryService
2803	0x60eb00	WheaEnterCriticalState
2804	0x60eb10	WheaErrorSourceGetState
2805	0x60eb50	WheaExitCriticalState
2806	0x610210	WheaGetCurrentProcessName
2807	0x60eb60	WheaGetErrorSource
2808	0x413810	WheaGetNotifyAllOfflinesPolicy
2809	0x611620	WheaHighIrqlLogSelEventHandlerRegister
2810	0x611690	WheaHighIrqlLogSelEventHandlerUnregister
2811	0x60f810	WheaHwErrorReportAbandonDeviceDriver
2812	0x60f840	WheaHwErrorReportGetLogDataBufferDeviceDriver
2813	0x60f890	WheaHwErrorReportMarkAsCriticalDeviceDriver
2814	0x60f8c0	WheaHwErrorReportSetFatalSeverityDeviceDriver
2815	0x60f920	WheaHwErrorReportSetSectionNameDeviceDriver
2816	0x60f970	WheaHwErrorReportSetSeverityDeviceDriver
2817	0x60f9b0	WheaHwErrorReportSubmitDeviceDriver
2818	0x611270	WheaInitializeDeferredRecoveryObject
2819	0x610ac0	WheaInitializeRecordHeader
2820	0x6102b0	WheaIsAltContextAllocPossible
2821	0x37f560	WheaIsCriticalState
2822	0x37f440	WheaLogInternalEvent
2823	0x6116d0	WheaProcessWaitingETWEvents
2824	0x60eb90	WheaRecoveryBugCheck
2825	0x611aa0	WheaRegisterErrorSourceOverride
2826	0xa060f0	WheaRegisterInUsePageOfflineNotification
2827	0xa05a90	WheaRemoveErrorSource
2828	0xa05c70	WheaRemoveErrorSourceDeviceDriver
2829	0x60fad0	WheaReportFatalHwErrorDeviceDriverEx
2830	0x60ec00	WheaReportHwError
2831	0xa05db0	WheaReportHwErrorDeviceDriver
2832	0x60fbf0	WheaReportHwErrorDeviceDriverEx
2833	0x611290	WheaRequestDeferredRecovery
2834	0x3b4b00	WheaSignalHandlerOverride
2835	0xa061f0	WheaTerminateProcess
2836	0xaa9780	WheaUnconfigureErrorSource
2837	0x611d90	WheaUnregisterErrorSourceOverride
2838	0xa06270	WheaUnregisterInUsePageOfflineNotification
2839	0x5fdca0	WmiGetClock
2840	0x80b090	WmiQueryTraceInformation
2841	0x2853b0	WmiTraceMessage
2842	0x4627c0	WmiTraceMessageVa
2843	0x60d2c0	XIPDispatch
2844	0x414c10	ZwAccessCheckAndAuditAlarm
2845	0x415430	ZwAddBootEntry
2846	0x415450	ZwAddDriverEntry
2847	0x414f10	ZwAdjustPrivilegesToken
2848	0x4154d0	ZwAlertThread
2849	0x415510	ZwAllocateLocallyUniqueId
2850	0x415530	ZwAllocateReserveObject
2851	0x4149f0	ZwAllocateVirtualMemory
2852	0x4155b0	ZwAllocateVirtualMemoryEx
2853	0x4155d0	ZwAlpcAcceptConnectPort
2854	0x4155f0	ZwAlpcCancelMessage
2855	0x415610	ZwAlpcConnectPort
2856	0x415630	ZwAlpcConnectPortEx
2857	0x415650	ZwAlpcCreatePort
2858	0x415670	ZwAlpcCreatePortSection
2859	0x415690	ZwAlpcCreateResourceReserve
2860	0x4156b0	ZwAlpcCreateSectionView
2861	0x4156d0	ZwAlpcCreateSecurityContext
2862	0x4156f0	ZwAlpcDeletePortSection
2863	0x415710	ZwAlpcDeleteResourceReserve
2864	0x415730	ZwAlpcDeleteSectionView
2865	0x415750	ZwAlpcDeleteSecurityContext
2866	0x415770	ZwAlpcDisconnectPort
2867	0x4157d0	ZwAlpcOpenSenderProcess
2868	0x4157f0	ZwAlpcOpenSenderThread
2869	0x415810	ZwAlpcQueryInformation
2870	0x415830	ZwAlpcQueryInformationMessage
2871	0x415870	ZwAlpcSendWaitReceivePort
2872	0x415890	ZwAlpcSetInformation
2873	0x4158d0	ZwAssignProcessToJobObject
2874	0x4158f0	ZwAssociateWaitCompletionPacket
2875	0x415290	ZwCancelIoFile
2876	0x415930	ZwCancelIoFileEx
2877	0x415310	ZwCancelTimer
2878	0x415990	ZwCancelWaitCompletionPacket
2879	0x414eb0	ZwClearEvent
2880	0x4148d0	ZwClose
2881	0x414e50	ZwCloseObjectAuditAlarm
2882	0x4159f0	ZwCommitComplete
2883	0x415a10	ZwCommitEnlistment
2884	0x415a30	ZwCommitRegistryTransaction
2885	0x415a50	ZwCommitTransaction
2886	0x415ad0	ZwCompareTokens
2887	0x415b30	ZwConnectPort
2888	0x415bd0	ZwCreateCrossVmEvent
2889	0x415c30	ZwCreateDirectoryObject
2890	0x415c90	ZwCreateEnlistment
2891	0x414ff0	ZwCreateEvent
2892	0x415190	ZwCreateFile
2893	0x415cf0	ZwCreateIoCompletion
2894	0x415d30	ZwCreateJobObject
2895	0x414a90	ZwCreateKey
2896	0x415d70	ZwCreateKeyTransacted
2897	0x415e50	ZwCreatePartition
2898	0x415090	ZwCreateProcessEx
2899	0x415f10	ZwCreateProfileEx
2900	0x415f30	ZwCreateRegistryTransaction
2901	0x415f50	ZwCreateResourceManager
2902	0x415030	ZwCreateSection
2903	0x415f70	ZwCreateSectionEx
2904	0x415f90	ZwCreateSemaphore
2905	0x415fb0	ZwCreateSymbolicLinkObject
2906	0x416010	ZwCreateTimer
2907	0x416090	ZwCreateTransaction
2908	0x4160b0	ZwCreateTransactionManager
2909	0x4160f0	ZwCreateWaitCompletionPacket
2910	0x416130	ZwCreateWnfStateName
2911	0x4161d0	ZwDeleteBootEntry
2912	0x4161f0	ZwDeleteDriverEntry
2913	0x416210	ZwDeleteFile
2914	0x416230	ZwDeleteKey
2915	0x416290	ZwDeleteValueKey
2916	0x4162b0	ZwDeleteWnfStateData
2917	0x4162d0	ZwDeleteWnfStateName
2918	0x4147d0	ZwDeviceIoControlFile
2919	0x416330	ZwDisplayString
2920	0x414e70	ZwDuplicateObject
2921	0x414f30	ZwDuplicateToken
2922	0x416390	ZwEnumerateBootEntries
2923	0x4163b0	ZwEnumerateDriverEntries
2924	0x414d30	ZwEnumerateKey
2925	0x4163f0	ZwEnumerateTransactionObject
2926	0x414950	ZwEnumerateValueKey
2927	0x415050	ZwFlushBuffersFile
2928	0x416490	ZwFlushBuffersFileEx
2929	0x4164d0	ZwFlushInstructionCache
2930	0x4164f0	ZwFlushKey
2931	0x416530	ZwFlushVirtualMemory
2932	0x414ab0	ZwFreeVirtualMemory
2933	0x414e10	ZwFsControlFile
2934	0x4165d0	ZwGetCachedSigningLevel
2935	0x4166b0	ZwGetNextProcess
2936	0x4166d0	ZwGetNextThread
2937	0x416710	ZwGetNotificationResourceManager
2938	0x416730	ZwGetWriteWatch
2939	0x416750	ZwImpersonateAnonymousToken
2940	0x4167f0	ZwInitiatePowerAction
2941	0x4150d0	ZwIsProcessInJob
2942	0x416870	ZwLoadDriver
2943	0x4168b0	ZwLoadKey
2944	0x416910	ZwLoadKeyEx
2945	0x416930	ZwLockFile
2946	0x416950	ZwLockProductActivationKeys
2947	0x416990	ZwLockVirtualMemory
2948	0x4169d0	ZwMakeTemporaryObject
2949	0x416a10	ZwManagePartition
2950	0x414bf0	ZwMapViewOfSection
2951	0x416a90	ZwModifyBootEntry
2952	0x416ab0	ZwModifyDriverEntry
2953	0x416ad0	ZwNotifyChangeDirectoryFile
2954	0x416af0	ZwNotifyChangeDirectoryFileEx
2955	0x416b10	ZwNotifyChangeKey
2956	0x416b50	ZwNotifyChangeSession
2957	0x4151f0	ZwOpenDirectoryObject
2958	0x416b90	ZwOpenEnlistment
2959	0x414ef0	ZwOpenEvent
2960	0x414d50	ZwOpenFile
2961	0x416bf0	ZwOpenJobObject
2962	0x414930	ZwOpenKey
2963	0x416c10	ZwOpenKeyEx
2964	0x416c30	ZwOpenKeyTransacted
2965	0x416c50	ZwOpenKeyTransactedEx
2966	0x416cd0	ZwOpenPartition
2967	0x414bb0	ZwOpenProcess
2968	0x416d10	ZwOpenProcessToken
2969	0x414cf0	ZwOpenProcessTokenEx
2970	0x416d30	ZwOpenRegistryTransaction
2971	0x416d50	ZwOpenResourceManager
2972	0x414dd0	ZwOpenSection
2973	0x416d90	ZwOpenSession
2974	0x416db0	ZwOpenSymbolicLinkObject
2975	0x416dd0	ZwOpenThread
2976	0x414b70	ZwOpenThreadToken
2977	0x414cd0	ZwOpenThreadTokenEx
2978	0x416df0	ZwOpenTimer
2979	0x416e10	ZwOpenTransaction
2980	0x416e30	ZwOpenTransactionManager
2981	0x4152d0	ZwPowerInformation
2982	0x416e70	ZwPrePrepareComplete
2983	0x416e90	ZwPrePrepareEnlistment
2984	0x416eb0	ZwPrepareComplete
2985	0x416ed0	ZwPrepareEnlistment
2986	0x416f50	ZwPropagationComplete
2987	0x416f70	ZwPropagationFailed
2988	0x4150f0	ZwProtectVirtualMemory
2989	0x416fb0	ZwPulseEvent
2990	0x416ff0	ZwQueryBootEntryOrder
2991	0x417010	ZwQueryBootOptions
2992	0x414990	ZwQueryDefaultLocale
2993	0x414f70	ZwQueryDefaultUILanguage
2994	0x414d90	ZwQueryDirectoryFile
2995	0x417050	ZwQueryDirectoryFileEx
2996	0x417070	ZwQueryDirectoryObject
2997	0x417090	ZwQueryDriverEntryOrder
2998	0x4170b0	ZwQueryEaFile
2999	0x4170d0	ZwQueryFullAttributesFile
3000	0x417110	ZwQueryInformationByName
3001	0x417150	ZwQueryInformationEnlistment
3002	0x414910	ZwQueryInformationFile
3003	0x417170	ZwQueryInformationJobObject
3004	0x414a10	ZwQueryInformationProcess
3005	0x4171b0	ZwQueryInformationResourceManager
3006	0x414b90	ZwQueryInformationThread
3007	0x414b10	ZwQueryInformationToken
3008	0x4171d0	ZwQueryInformationTransaction
3009	0x4171f0	ZwQueryInformationTransactionManager
3010	0x417230	ZwQueryInstallUILanguage
3011	0x417250	ZwQueryIntervalProfile
3012	0x4149b0	ZwQueryKey
3013	0x4172b0	ZwQueryLicenseValue
3014	0x4148f0	ZwQueryObject
3015	0x417370	ZwQueryQuotaInformationFile
3016	0x415110	ZwQuerySection
3017	0x417390	ZwQuerySecurityAttributesToken
3018	0x4173b0	ZwQuerySecurityObject
3019	0x4173d0	ZwQuerySecurityPolicy
3020	0x417410	ZwQuerySymbolicLinkObject
3021	0x417450	ZwQuerySystemEnvironmentValueEx
3022	0x414db0	ZwQuerySystemInformation
3023	0x417470	ZwQuerySystemInformationEx
3024	0x417490	ZwQueryTimerResolution
3025	0x4149d0	ZwQueryValueKey
3026	0x414b50	ZwQueryVirtualMemory
3027	0x415010	ZwQueryVolumeInformationFile
3028	0x4174b0	ZwQueryWnfStateData
3029	0x4174d0	ZwQueryWnfStateNameInformation
3030	0x4147b0	ZwReadFile
3031	0x417570	ZwReadOnlyEnlistment
3032	0x4175b0	ZwRecoverEnlistment
3033	0x4175d0	ZwRecoverResourceManager
3034	0x4175f0	ZwRecoverTransactionManager
3035	0x414830	ZwReleaseSemaphore
3036	0x414810	ZwRemoveIoCompletion
3037	0x417690	ZwRemoveIoCompletionEx
3038	0x4176d0	ZwRenameKey
3039	0x417710	ZwReplaceKey
3040	0x417770	ZwRequestPort
3041	0x414b30	ZwRequestWaitReplyPort
3042	0x417790	ZwResetEvent
3043	0x4177b0	ZwResetWriteWatch
3044	0x4177d0	ZwRestoreKey
3045	0x417830	ZwRollbackComplete
3046	0x417850	ZwRollbackEnlistment
3047	0x417870	ZwRollbackRegistryTransaction
3048	0x417890	ZwRollbackTransaction
3049	0x4178d0	ZwSaveKey
3050	0x4178f0	ZwSaveKeyEx
3051	0x417930	ZwSecureConnectPort
3052	0x417970	ZwSetBootEntryOrder
3053	0x417990	ZwSetBootOptions
3054	0x4179b0	ZwSetCachedSigningLevel
3055	0x417a50	ZwSetDefaultLocale
3056	0x417a70	ZwSetDefaultUILanguage
3057	0x417a90	ZwSetDriverEntryOrder
3058	0x417ab0	ZwSetEaFile
3059	0x4148b0	ZwSetEvent
3060	0x417b70	ZwSetInformationEnlistment
3061	0x414bd0	ZwSetInformationFile
3062	0x417bb0	ZwSetInformationJobObject
3063	0x417bd0	ZwSetInformationKey
3064	0x415270	ZwSetInformationObject
3065	0x414a70	ZwSetInformationProcess
3066	0x417bf0	ZwSetInformationResourceManager
3067	0x414890	ZwSetInformationThread
3068	0x417c30	ZwSetInformationToken
3069	0x417c50	ZwSetInformationTransaction
3070	0x417c90	ZwSetInformationVirtualMemory
3071	0x417cd0	ZwSetIntervalProfile
3072	0x417cf0	ZwSetIoCompletion
3073	0x417d10	ZwSetIoCompletionEx
3074	0x417d90	ZwSetQuotaInformationFile
3075	0x417db0	ZwSetSecurityObject
3076	0x417df0	ZwSetSystemEnvironmentValueEx
3077	0x417e10	ZwSetSystemInformation
3078	0x417e50	ZwSetSystemTime
3079	0x415330	ZwSetTimer
3080	0x417eb0	ZwSetTimerEx
3081	0x417ed0	ZwSetTimerResolution
3082	0x4152f0	ZwSetValueKey
3083	0x417f10	ZwSetVolumeInformationFile
3084	0x417fd0	ZwStartProfile
3085	0x417ff0	ZwStopProfile
3086	0x418090	ZwSystemDebugControl
3087	0x4180d0	ZwTerminateJobObject
3088	0x414c70	ZwTerminateProcess
3089	0x418150	ZwTraceControl
3090	0x4152b0	ZwTraceEvent
3091	0x418170	ZwTranslateFilePath
3092	0x4181b0	ZwUnloadDriver
3093	0x4181d0	ZwUnloadKey
3094	0x4181f0	ZwUnloadKey2
3095	0x418210	ZwUnloadKeyEx
3096	0x418230	ZwUnlockFile
3097	0x418250	ZwUnlockVirtualMemory
3098	0x414c30	ZwUnmapViewOfSection
3099	0x4182b0	ZwUpdateWnfStateData
3100	0x415250	ZwWaitForMultipleObjects
3101	0x414770	ZwWaitForSingleObject
3102	0x4147f0	ZwWriteFile
3103	0x414fb0	ZwYieldExecution
3104	0x3d57e0	__C_specific_handler
3105	0x562e50	__asan_alloca_poison
3106	0x563110	__asan_allocas_unpoison
3107	0x5631f0	__asan_load1
3108	0x563270	__asan_load16
3109	0x563270	__asan_load16_noabort
3110	0x5631f0	__asan_load1_noabort
3111	0x563720	__asan_load2
3112	0x563720	__asan_load2_noabort
3113	0x5637e0	__asan_load4
3114	0x5637e0	__asan_load4_noabort
3115	0x563950	__asan_load8
3116	0x563950	__asan_load8_noabort
3117	0x563be0	__asan_loadN
3118	0x563be0	__asan_loadN_noabort
3119	0x563c80	__asan_memcpy
3120	0x563c80	__asan_memmove
3121	0x563cf0	__asan_memset
3122	0x563d40	__asan_report_load1
3123	0x563d70	__asan_report_load16
3124	0x563da0	__asan_report_load2
3125	0x563dd0	__asan_report_load4
3126	0x563e00	__asan_report_load8
3127	0x563e30	__asan_report_load_n
3128	0x563e60	__asan_report_store1
3129	0x563e90	__asan_report_store16
3130	0x563ec0	__asan_report_store2
3131	0x563ef0	__asan_report_store4
3132	0x563f20	__asan_report_store8
3133	0x563f50	__asan_report_store_n
3134	0x563f80	__asan_set_shadow_00
3135	0x563fa0	__asan_set_shadow_f8
3136	0x563fc0	__asan_store1
3137	0x564040	__asan_store16
3138	0x564040	__asan_store16_noabort
3139	0x563fc0	__asan_store1_noabort
3140	0x5644f0	__asan_store2
3141	0x5644f0	__asan_store2_noabort
3142	0x5645c0	__asan_store4
3143	0x5645c0	__asan_store4_noabort
3144	0x564730	__asan_store8
3145	0x564730	__asan_store8_noabort
3146	0x5649d0	__asan_storeN
3147	0x5649d0	__asan_storeN_noabort
3148	0x423490	__chkstk
3149	0x2b9030	__misaligned_access
3150	0x3d6d00	_atoi64
3151	0x3d6de0	_finite
3152	0x3dbf20	_i64toa_s
3153	0x3dc240	_i64tow_s
3154	0x3d6e20	_itoa
3155	0x3dbf50	_itoa_s
3156	0x3d6ee0	_itow
3157	0x3dc270	_itow_s
3158	0x3d6fe0	_local_unwind
3159	0x3dbf50	_ltoa_s
3160	0x3dc270	_ltow_s
3161	0x3dc580	_makepath_s
3162	0x60b430	_purecall
3163	0x424850	_setjmp
3164	0x424910	_setjmpex
3165	0x3d7020	_snprintf
3166	0x3dc6e0	_snprintf_s
3167	0x3dc7b0	_snscanf_s
3168	0x3d70e0	_snwprintf
3169	0x3dc7f0	_snwprintf_s
3170	0x3dc8d0	_snwscanf_s
3171	0x3dc910	_splitpath_s
3172	0x3d7220	_stricmp
3173	0x3d7240	_strlwr
3174	0x3d72d0	_strnicmp
3175	0x3d72f0	_strnset
3176	0x3dcbb0	_strnset_s
3177	0x3d7310	_strrev
3178	0x3d7350	_strset
3179	0x3dcc40	_strset_s
3180	0x3d6c70	_strtoui64
3181	0x3d6430	_strupr
3182	0x3d7370	_swprintf
3183	0x3dbf80	_ui64toa_s
3184	0x3dc2a0	_ui64tow_s
3185	0x3dbfa0	_ultoa_s
3186	0x3dc2c0	_ultow_s
3187	0x3d65a0	_vsnprintf
3188	0x3dc710	_vsnprintf_s
3189	0x3d6480	_vsnwprintf
3190	0x3dc820	_vsnwprintf_s
3191	0x3d7440	_vswprintf
3192	0x3d7520	_wcsicmp
3193	0x3d7580	_wcslwr
3194	0x3d75e0	_wcslwr_s
3195	0x3d7660	_wcsnicmp
3196	0x3d76d0	_wcsnset
3197	0x3d7700	_wcsnset_s
3198	0x3d7790	_wcsrev
3199	0x3d77e0	_wcsset_s
3200	0x3d7840	_wcsupr
3201	0x3dcca0	_wmakepath_s
3202	0x3dce30	_wsplitpath_s
3203	0x3d7880	_wtoi
3204	0x3d78a0	_wtol
3205	0x3d6d30	atoi
3206	0x3d6d50	atol
3207	0x3d78d0	bsearch
3208	0x3d79e0	bsearch_s
3209	0x3d7b20	isdigit
3210	0x3d7b50	islower
3211	0x3d7b80	isprint
3212	0x3d7bb0	isspace
3213	0x3d7be0	isupper
3214	0x3d7c40	iswalnum
3215	0x3d7c80	iswdigit
3216	0x3d7ca0	iswspace
3217	0x3d7c10	isxdigit
3218	0x3d59b0	longjmp
3219	0x3d7cc0	mbstowcs
3220	0x3d7d80	mbtowc
3221	0x3d7de0	memchr
3222	0x3d7e20	memcmp
3223	0x42f000	memcpy
3224	0x3dd0f0	memcpy_s
3225	0x42f000	memmove
3226	0x3dd190	memmove_s
3227	0x42f300	memset
3228	0xd53f00	psMUITest
3229	0x3d7f00	qsort
3230	0x3d82e0	qsort_s
3231	0x3d86f0	rand
3232	0x3d8730	sprintf
3233	0x3dd1f0	sprintf_s
3234	0x3d87d0	sqrt
3235	0x3d88e0	sqrtf
3236	0x3d8720	srand
3237	0x3dd270	sscanf_s
3238	0x3d89f0	strcat
3239	0x3dd2d0	strcat_s
3240	0x3d8b70	strchr
3241	0x3d8bc0	strcmp
3242	0x3d8ab0	strcpy
3243	0x3dd360	strcpy_s
3244	0x3d8c90	strlen
3245	0x3d8d60	strncat
3246	0x3dd3f0	strncat_s
3247	0x3d6960	strncmp
3248	0x3d8f20	strncpy
3249	0x3dd4f0	strncpy_s
3250	0x3d9090	strnlen
3251	0x3d90b0	strrchr
3252	0x3d90f0	strspn
3253	0x3d6ca0	strstr
3254	0x3dd5f0	strtok_s
3255	0x3d7370	swprintf
3256	0x3dbe90	swprintf_s
3257	0x3dd760	swscanf_s
3258	0x3d91c0	tolower
3259	0x3d9200	toupper
3260	0x3d9270	towlower
3261	0x3d92a0	towupper
3262	0x2624e0	vDbgPrintEx
3263	0x45daa0	vDbgPrintExWithPrefix
3264	0x3d9350	vsprintf
3265	0x3dd220	vsprintf_s
3266	0x3dbec0	vswprintf_s
3267	0x3d9370	wcscat
3268	0x3dd7c0	wcscat_s
3269	0x3d93e0	wcschr
3270	0x3d9420	wcscmp
3271	0x3d93b0	wcscpy
3272	0x3dd860	wcscpy_s
3273	0x3d9460	wcscspn
3274	0x3d94b0	wcslen
3275	0x3d94d0	wcsncat
3276	0x3dd8f0	wcsncat_s
3277	0x3d9520	wcsncmp
3278	0x3d9560	wcsncpy
3279	0x3dda00	wcsncpy_s
3280	0x3d95b0	wcsnlen
3281	0x3d95e0	wcsrchr
3282	0x3d9620	wcsspn
3283	0x3d9670	wcsstr
3284	0x3d96d0	wcstombs
3285	0x3d99c0	wcstoul
3286	0x3d9ab0	wctomb
3287	0x3aba40	x86BiosAllocateBuffer
3288	0x3bbda0	x86BiosCall
3289	0x3abed0	x86BiosFreeBuffer
3290	0x396d80	x86BiosReadMemory
3291	0x39ee20	x86BiosWriteMemory

module_name	ntoskrnl.exe
flags	0
timestamp	2095-09-23 00:16:56
version	0.0
ordinal_base	1
nFunctions	3291
nNames	3257
Names(3257)	0x149394
Functions(3291)	0x146028
NameOrdinals(3257)	0x14c678

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	NT Kernel & System
FileVersion	10.0.22621.3447 (WinBuild.160101.0800)
InternalName	ntkrnlmp.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	ntkrnlmp.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.22621.3447

VS_FIXEDFILEINFO

FileVersion	10.0.22621.3447
ProductVersion	10.0.22621.3447
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Production PCA 2011

serial: 330000045FF3C96C1A7FF7DA1D00000000045F

Certificates (2)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011
        Validity
            Not Before: Nov 16 19:20:08 2023 GMT
            Not After : Nov 14 19:20:08 2024 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b1:cb:c5:1d:94:43:fb:60:43:25:8f:23:b0:3c:
                    11:7b:5f:09:b2:bb:6a:1e:21:fd:fe:f6:58:07:73:
                    e9:4e:d7:c4:a7:33:99:fc:b5:07:2d:5a:ed:a4:d7:
                    5d:c2:5f:31:15:a5:61:d9:34:99:46:28:2a:66:0c:
                    6d:4b:9a:24:2f:5b:fe:ce:e2:89:15:cf:cb:dc:6e:
                    7e:31:8b:e5:6c:25:ef:c8:e4:fe:e2:c4:be:4d:b8:
                    3c:2a:ca:66:32:be:28:8d:f2:ea:5a:32:7d:6b:4e:
                    53:09:b5:16:3c:04:d8:24:55:54:ea:34:39:01:d7:
                    69:27:b6:54:c2:0b:c2:a5:65:cc:5c:97:6e:45:69:
                    57:fe:65:3b:18:49:3c:67:7b:65:41:a6:f4:b5:28:
                    9e:fe:5e:02:36:52:e2:4e:9c:fb:07:a8:c2:a6:91:
                    1b:30:e8:d9:bc:08:72:b7:2d:b5:47:d4:b4:55:02:
                    a8:08:e5:97:31:05:8b:32:01:fb:45:8b:e1:66:73:
                    16:e5:58:f2:32:d3:1f:bb:37:8a:ff:53:f6:4f:b8:
                    34:93:0f:ad:13:d0:b6:7c:3d:16:c9:10:7c:61:1e:
                    a3:e4:2d:46:45:e0:b7:ec:17:5f:fe:fb:9c:cf:f2:
                    19:fa:2c:84:59:4f:1d:3c:b8:cd:4e:e7:20:5b:c2:
                    5d:73
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                1.3.6.1.4.1.311.10.3.6, Code Signing
            X509v3 Subject Key Identifier: 
                27:85:17:4A:51:3C:35:98:08:FE:76:6E:91:85:A5:44:7B:B2:D2:0F
            X509v3 Subject Alternative Name: 
                DirName:/OU=Microsoft Ireland Operations Limited/serialNumber=229879\+501835
            X509v3 Authority Key Identifier: 
                A9:29:02:39:8E:16:C4:97:78:CD:90:F9:9E:4F:9A:E1:7C:55:AF:53
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt
            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        7b:bb:c6:bf:88:b9:b7:b3:1a:db:3d:6e:9e:4c:7a:71:25:7f:
        d9:61:7a:9d:8c:76:34:af:b5:76:16:05:a0:41:7a:d4:c9:5d:
        8b:cd:fc:7f:f5:6f:07:53:55:22:53:c2:0d:35:4a:46:47:8a:
        97:47:39:b3:bc:a5:cb:8d:6c:5f:ba:d3:bf:6e:3a:48:8c:f6:
        e8:df:6b:a1:39:82:33:eb:1c:c0:37:04:3a:86:ec:eb:6b:5e:
        26:e6:92:71:e1:c6:4f:48:39:48:8a:59:e9:c2:e6:d0:47:02:
        f7:81:48:a0:68:67:aa:c5:b7:be:95:e9:fe:47:76:78:77:a8:
        73:36:cf:db:d4:78:22:1b:6c:c7:c3:9f:cd:83:b3:bd:7c:f5:
        b4:99:9c:c6:9b:4c:b2:4d:40:1c:4a:f6:5a:df:84:47:3d:2f:
        44:ac:cb:9e:8b:f6:e1:e7:65:bc:27:99:e4:c1:0d:88:4f:7e:
        0e:04:0c:82:d7:21:a8:16:d7:6e:a8:77:8d:56:20:01:18:bb:
        28:b0:c5:43:a5:8f:d9:ab:0d:45:46:4d:6f:7e:51:7a:d2:27:
        33:b2:6d:85:e8:20:8d:c9:6f:a7:62:db:a4:23:e9:db:7f:fe:
        75:99:37:61:46:50:b6:19:d7:74:a7:29:28:41:6a:b5:bf:fc:
        ce:e4:94:e8

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:07:76:56:00:00:00:00:00:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
        Validity
            Not Before: Oct 19 18:41:42 2011 GMT
            Not After : Oct 19 18:51:42 2026 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:dd:0c:bb:a2:e4:2e:09:e3:e7:c5:f7:96:69:bc:
                    00:21:bd:69:33:33:ef:ad:04:cb:54:80:ee:06:83:
                    bb:c5:20:84:d9:f7:d2:8b:f3:38:b0:ab:a4:ad:2d:
                    7c:62:79:05:ff:e3:4a:3f:04:35:20:70:e3:c4:e7:
                    6b:e0:9c:c0:36:75:e9:8a:31:dd:8d:70:e5:dc:37:
                    b5:74:46:96:28:5b:87:60:23:2c:bf:dc:47:a5:67:
                    f7:51:27:9e:72:eb:07:a6:c9:b9:1e:3b:53:35:7c:
                    e5:d3:ec:27:b9:87:1c:fe:b9:c9:23:09:6f:a8:46:
                    91:c1:6e:96:3c:41:d3:cb:a3:3f:5d:02:6a:4d:ec:
                    69:1f:25:28:5c:36:ff:fd:43:15:0a:94:e0:19:b4:
                    cf:df:c2:12:e2:c2:5b:27:ee:27:78:30:8b:5b:2a:
                    09:6b:22:89:53:60:16:2c:c0:68:1d:53:ba:ec:49:
                    f3:9d:61:8c:85:68:09:73:44:5d:7d:a2:54:2b:dd:
                    79:f7:15:cf:35:5d:6c:1c:2b:5c:ce:bc:9c:23:8b:
                    6f:6e:b5:26:d9:36:13:c3:4f:d6:27:ae:b9:32:3b:
                    41:92:2c:e1:c7:cd:77:e8:aa:54:4e:f7:5c:0b:04:
                    87:65:b4:43:18:a8:b2:e0:6d:19:77:ec:5a:24:fa:
                    48:03
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Subject Key Identifier: 
                A9:29:02:39:8E:16:C4:97:78:CD:90:F9:9E:4F:9A:E1:7C:55:AF:53
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                D5:F6:56:CB:8F:E8:A2:5C:62:68:D1:3D:94:90:5B:D7:CE:9A:18:C4
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        14:fc:7c:71:51:a5:79:c2:6e:b2:ef:39:3e:bc:3c:52:0f:6e:
        2b:3f:10:13:73:fe:a8:68:d0:48:a6:34:4d:8a:96:05:26:ee:
        31:46:90:61:79:d6:ff:38:2e:45:6b:f4:c0:e5:28:b8:da:1d:
        8f:8a:db:09:d7:1a:c7:4c:0a:36:66:6a:8c:ec:1b:d7:04:90:
        a8:18:17:a4:9b:b9:e2:40:32:36:76:c4:c1:5a:c6:bf:e4:04:
        c0:ea:16:d3:ac:c3:68:ef:62:ac:dd:54:6c:50:30:58:a6:eb:
        7c:fe:94:a7:4e:8e:f4:ec:7c:86:73:57:c2:52:21:73:34:5a:
        f3:a3:8a:56:c8:04:da:07:09:ed:f8:8b:e3:ce:f4:7e:8e:ae:
        f0:f6:0b:8a:08:fb:3f:c9:1d:72:7f:53:b8:eb:be:63:e0:e3:
        3d:31:65:b0:81:e5:f2:ac:cd:16:a4:9f:3d:a8:b1:9b:c2:42:
        d0:90:84:5f:54:1d:ff:89:ea:ba:1d:47:90:6f:b0:73:4e:41:
        9f:40:9f:5f:e5:a1:2a:b2:11:91:73:8a:21:28:f0:ce:de:73:
        39:5f:3e:ab:5c:60:ec:df:03:10:a8:d3:09:e9:f4:f6:96:85:
        b6:7f:51:88:66:47:19:8d:a2:b0:12:3d:81:2a:68:05:77:bb:
        91:4c:62:7b:b6:c1:07:c7:ba:7a:87:34:03:0e:4b:62:7a:99:
        e9:ca:fc:ce:4a:37:c9:2d:a4:57:7c:1c:fe:3d:dc:b8:0f:5a:
        fa:d6:c4:b3:02:85:02:3a:ea:b3:d9:6e:e4:69:21:37:de:81:
        d1:f6:75:19:05:67:d3:93:57:5e:29:1b:39:c8:ee:2d:e1:cd:
        e4:45:73:5b:d0:d2:ce:7a:ab:16:19:82:46:58:d0:5e:9d:81:
        b3:67:af:6c:35:f2:bc:e5:3f:24:e2:35:a2:0a:75:06:f6:18:
        56:99:d4:78:2c:d1:05:1b:eb:d0:88:01:9d:aa:10:f1:05:df:
        ba:7e:2c:63:b7:06:9b:23:21:c4:f9:78:6c:e2:58:17:06:36:
        2b:91:12:03:cc:a4:d9:f2:2d:ba:f9:94:9d:40:ed:18:45:f1:
        ce:8a:5c:6b:3e:ab:03:d3:70:18:2a:0a:6a:e0:5f:47:d1:d5:
        63:0a:32:f2:af:d7:36:1f:2a:70:5a:e5:42:59:08:71:4b:57:
        ba:7e:83:81:f0:21:3c:f4:1c:c1:c5:b9:90:93:0e:88:45:93:
        86:e9:b1:20:99:be:98:cb:c5:95:a4:5d:62:d6:a0:63:08:20:
        bd:75:10:77:7d:3d:f3:45:b9:9f:97:9f:cb:57:80:6f:33:a9:
        04:cf:77:a4:62:1c:59:7e

undefined method `first' for #

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	12062744	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi	Support Me on Ko-fi
Yandex.Money
Thank you!

everything is OK

ntoskrnl.exe-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

Signers (1)

Certificates (2)

ntoskrnl.exe
-