Last active
September 5, 2016 06:48
-
-
Save lomomike/bc84814b527d2a0e1eafed5efb961775 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| lkd> .for(r $t0=0; @$t0<dwo(nt!KiServiceLimit); r $t0=@$t0+1){.printf "%y\n", nt!KiServiceTable+(dwo(nt!KiServiceTable+@$t0*4)>>4)} | |
| fffff800`2bf27ff8 | |
| fffff800`2bf788e4 | |
| nt!NtAcceptConnectPort (fffff800`1c3a0e3c) | |
| nt!NtMapUserPhysicalPagesScatter (fffff800`1c525bd4) | |
| nt!NtWaitForSingleObject (fffff800`1c2a55c0) | |
| fffff800`2bfd7030 | |
| nt!NtReadFile (fffff800`1c2a00c0) | |
| nt!NtDeviceIoControlFile (fffff800`1c2d3d60) | |
| nt!NtWriteFile (fffff800`1c29f4b0) | |
| nt!NtRemoveIoCompletion (fffff800`1c377bb0) | |
| nt!NtReleaseSemaphore (fffff800`1c378440) | |
| nt!NtReplyWaitReceivePort (fffff800`1c338dc4) | |
| nt!NtReplyPort (fffff800`1c387a54) | |
| nt!NtSetInformationThread (fffff800`1c29d0f0) | |
| nt!NtSetEvent (fffff800`1c2a14f0) | |
| nt!NtClose (fffff800`1c2acdc0) | |
| nt!NtQueryObject (fffff800`1c340010) | |
| nt!NtQueryInformationFile (fffff800`1c2a2440) | |
| nt!NtOpenKey (fffff800`1c2def98) | |
| nt!NtEnumerateValueKey (fffff800`1c341a20) | |
| nt!NtFindAtom (fffff800`1c33beac) | |
| nt!NtQueryDefaultLocale (fffff800`1c38fc68) | |
| nt!NtQueryKey (fffff800`1c2c49b0) | |
| nt!NtQueryValueKey (fffff800`1c2c5310) | |
| nt!NtAllocateVirtualMemory (fffff800`1c2cfb40) | |
| nt!NtQueryInformationProcess (fffff800`1c300d60) | |
| nt!NtWaitForMultipleObjects32 (fffff800`1c3776d0) | |
| nt!NtWriteFileGather (fffff800`1c39289c) | |
| nt!NtSetInformationProcess (fffff800`1c374210) | |
| nt!NtCreateKey (fffff800`1c382728) | |
| nt!NtFreeVirtualMemory (fffff800`1c2cf180) | |
| nt!NtImpersonateClientOfPort (fffff800`1c51d078) | |
| nt!NtReleaseMutant (fffff800`1c377d50) | |
| nt!NtQueryInformationToken (fffff800`1c2b5170) | |
| nt!NtRequestWaitReplyPort (fffff800`1c38c2c8) | |
| nt!NtQueryVirtualMemory (fffff800`1c2cdcac) | |
| nt!NtOpenThreadToken (fffff800`1c32b0e8) | |
| nt!NtQueryInformationThread (fffff800`1c2acf60) | |
| nt!NtOpenProcess (fffff800`1c32d470) | |
| fffff800`2bf42700 | |
| nt!NtMapViewOfSection (fffff800`1c2cd5a0) | |
| nt!NtAccessCheckAndAuditAlarm (fffff800`1c395394) | |
| nt!NtUnmapViewOfSection (fffff800`1c2ca608) | |
| nt!NtReplyWaitReceivePortEx (fffff800`1c338de0) | |
| nt!NtTerminateProcess (fffff800`1c2f65e0) | |
| nt!NtSetEventBoostPriority (fffff800`1c56daa4) | |
| nt!NtReadFileScatter (fffff800`1c39ab1c) | |
| nt!NtOpenThreadTokenEx (fffff800`1c32b100) | |
| nt!NtOpenProcessTokenEx (fffff800`1c32cdf0) | |
| nt!NtQueryPerformanceCounter (fffff800`1c3877e8) | |
| nt!NtEnumerateKey (fffff800`1c2c02e0) | |
| nt!NtOpenFile (fffff800`1c30f9f4) | |
| nt!NtDelayExecution (fffff800`1c3278c0) | |
| nt!NtQueryDirectoryFile (fffff800`1c29f3d0) | |
| nt!NtQuerySystemInformation (fffff800`1c32d4d0) | |
| nt!NtOpenSection (fffff800`1c385580) | |
| nt!NtQueryTimer (fffff800`1c56d948) | |
| nt!NtFsControlFile (fffff800`1c2e32d4) | |
| nt!NtWriteVirtualMemory (fffff800`1c399b4c) | |
| nt!NtCloseObjectAuditAlarm (fffff800`1c38fe58) | |
| nt!NtDuplicateObject (fffff800`1c33dce0) | |
| nt!NtQueryAttributesFile (fffff800`1c382330) | |
| nt!NtClearEvent (fffff800`1c378cc0) | |
| nt!NtReadVirtualMemory (fffff800`1c2d8714) | |
| nt!NtOpenEvent (fffff800`1c38d44c) | |
| nt!NtAdjustPrivilegesToken (fffff800`1c299648) | |
| nt!NtDuplicateToken (fffff800`1c32aca8) | |
| fffff800`2bfd4b00 | |
| nt!NtQueryDefaultUILanguage (fffff800`1c3cef08) | |
| nt!NtQueueApcThread (fffff800`1c346f08) | |
| fffff800`2bf68e30 | |
| nt!NtAddAtom (fffff800`1c5756fc) | |
| nt!NtCreateEvent (fffff800`1c2b8630) | |
| nt!NtQueryVolumeInformationFile (fffff800`1c29c280) | |
| nt!NtCreateSection (fffff800`1c2c7f50) | |
| nt!NtFlushBuffersFile (fffff800`1c391b34) | |
| nt!NtApphelpCacheControl (fffff800`1c363ea4) | |
| nt!NtCreateProcessEx (fffff800`1c3a96b8) | |
| nt!NtCreateThread (fffff800`1c53d0f8) | |
| nt!NtIsProcessInJob (fffff800`1c3905b8) | |
| nt!NtProtectVirtualMemory (fffff800`1c2ce890) | |
| nt!NtQuerySection (fffff800`1c393d8c) | |
| nt!NtResumeThread (fffff800`1c339ff0) | |
| nt!NtTerminateThread (fffff800`1c346708) | |
| nt!NtReadRequestData (fffff800`1c51d154) | |
| nt!NtCreateFile (fffff800`1c30fa60) | |
| nt!NtQueryEvent (fffff800`1c3935f4) | |
| nt!NtWriteRequestData (fffff800`1c51d278) | |
| nt!NtOpenDirectoryObject (fffff800`1c38803c) | |
| nt!NtAccessCheckByTypeAndAuditAlarm (fffff800`1c33397c) | |
| nt!NtQuerySystemTime (fffff800`1c56ad5c) | |
| nt!NtWaitForMultipleObjects (fffff800`1c36ba10) | |
| nt!NtSetInformationObject (fffff800`1c371fa0) | |
| nt!NtCancelIoFile (fffff800`1c367c68) | |
| fffff800`2bf0ced0 | |
| nt!NtPowerInformation (fffff800`1c2828b8) | |
| nt!NtSetValueKey (fffff800`1c342e00) | |
| fffff800`2bf80c24 | |
| fffff800`2bf8cae4 | |
| fffff800`2bf7bfa0 | |
| fffff800`2c0c0eec | |
| nt!NtAccessCheckByTypeResultListAndAuditAlarm (fffff800`1c3e8760) | |
| nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle (fffff800`1c552484) | |
| nt!NtAddAtomEx (fffff800`1c38d9b4) | |
| nt!NtAddBootEntry (fffff800`1c571368) | |
| nt!NtAddDriverEntry (fffff800`1c571388) | |
| nt!NtAdjustGroupsToken (fffff800`1c3ae5b8) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff800`1c427a14) | |
| nt!NtAlertResumeThread (fffff800`1c544268) | |
| nt!NtAlertThread (fffff800`1c544374) | |
| nt!NtAlertThreadByThreadId (fffff800`1c35a260) | |
| nt!NtAllocateLocallyUniqueId (fffff800`1c384c10) | |
| nt!NtAllocateReserveObject (fffff800`1c53d7ec) | |
| nt!NtAllocateUserPhysicalPages (fffff800`1c524ab0) | |
| nt!NtAllocateUuids (fffff800`1c3a4188) | |
| nt!NtAlpcAcceptConnectPort (fffff800`1c333d88) | |
| nt!NtAlpcCancelMessage (fffff800`1c3a56dc) | |
| nt!NtAlpcConnectPort (fffff800`1c333e4c) | |
| nt!NtAlpcConnectPortEx (fffff800`1c3986f0) | |
| nt!NtAlpcCreatePort (fffff800`1c395418) | |
| nt!NtAlpcCreatePortSection (fffff800`1c388b30) | |
| nt!NtAlpcCreateResourceReserve (fffff800`1c3161b4) | |
| nt!NtAlpcCreateSectionView (fffff800`1c33650c) | |
| nt!NtAlpcCreateSecurityContext (fffff800`1c337f6c) | |
| nt!NtAlpcDeletePortSection (fffff800`1c392224) | |
| nt!NtAlpcDeleteResourceReserve (fffff800`1c51e094) | |
| nt!NtAlpcDeleteSectionView (fffff800`1c38f4b8) | |
| nt!NtAlpcDeleteSecurityContext (fffff800`1c337e34) | |
| nt!NtAlpcDisconnectPort (fffff800`1c3183d4) | |
| nt!NtAlpcImpersonateClientContainerOfPort (fffff800`1c51e2c0) | |
| nt!NtAlpcImpersonateClientOfPort (fffff800`1c29cca0) | |
| nt!NtAlpcOpenSenderProcess (fffff800`1c38f048) | |
| nt!NtAlpcOpenSenderThread (fffff800`1c393f30) | |
| nt!NtAlpcQueryInformation (fffff800`1c36b460) | |
| nt!NtAlpcQueryInformationMessage (fffff800`1c389048) | |
| nt!NtAlpcRevokeSecurityContext (fffff800`1c51e740) | |
| nt!NtAlpcSendWaitReceivePort (fffff800`1c2afea0) | |
| nt!NtAlpcSetInformation (fffff800`1c31bbe8) | |
| nt!NtAreMappedFilesTheSame (fffff800`1c3a0fa0) | |
| nt!NtAssignProcessToJobObject (fffff800`1c3160dc) | |
| fffff800`2bf12fc0 | |
| nt!NtCancelIoFileEx (fffff800`1c367e30) | |
| nt!NtCancelSynchronousIoFile (fffff800`1c4f3bf4) | |
| fffff800`2bf8386c | |
| fffff800`2bf12c74 | |
| fffff800`2be86018 | |
| fffff800`2be86020 | |
| fffff800`2be86028 | |
| nt!NtCompactKeys (fffff800`1c4d00f0) | |
| nt!NtCompareObjects (fffff800`1c52afd0) | |
| nt!NtCompareTokens (fffff800`1c3afb10) | |
| nt!ArbPreprocessEntry (fffff800`1c3a1fa0) | |
| nt!NtCompressKey (fffff800`1c4d030c) | |
| nt!NtConnectPort (fffff800`1c385600) | |
| nt!NtCreateDebugObject (fffff800`1c4e7410) | |
| nt!NtCreateDirectoryObject (fffff800`1c3926ec) | |
| nt!NtCreateDirectoryObjectEx (fffff800`1c3926e4) | |
| fffff800`2be86030 | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff800`1c427a14) | |
| nt!NtCreateIRTimer (fffff800`1c3e588c) | |
| nt!NtCreateIoCompletion (fffff800`1c390018) | |
| nt!NtCreateJobObject (fffff800`1c362818) | |
| nt!ArbAddReserved (fffff800`1c427a0c) | |
| nt!NtCreateKeyTransacted (fffff800`1c3825cc) | |
| nt!NtCreateKeyedEvent (fffff800`1c41a844) | |
| nt!NtCreateLowBoxToken (fffff800`1c3adf48) | |
| nt!NtCreateMailslotFile (fffff800`1c3a620c) | |
| nt!NtCreateMutant (fffff800`1c3b4340) | |
| nt!NtCreateNamedPipeFile (fffff800`1c3141e0) | |
| nt!NtCreatePagingFile (fffff800`1c41682c) | |
| nt!NtCreatePartition (fffff800`1c522e48) | |
| nt!NtCreatePort (fffff800`1c3e4bf8) | |
| nt!NtCreatePrivateNamespace (fffff800`1c38add0) | |
| nt!NtCreateProcess (fffff800`1c53d07c) | |
| nt!NtCreateProfile (fffff800`1c576f44) | |
| nt!NtCreateProfileEx (fffff800`1c577018) | |
| fffff800`2be86038 | |
| nt!NtCreateSemaphore (fffff800`1c2d7b10) | |
| nt!NtCreateSymbolicLinkObject (fffff800`1c3b0484) | |
| nt!NtCreateThreadEx (fffff800`1c33ae3c) | |
| nt!NtCreateTimer (fffff800`1c2d8e50) | |
| nt!NtCreateTimer2 (fffff800`1c333ec0) | |
| nt!NtCreateToken (fffff800`1c552f40) | |
| nt!NtCreateTokenEx (fffff800`1c3aed40) | |
| fffff800`2be86040 | |
| fffff800`2be86048 | |
| nt!NtCreateUserProcess (fffff800`1c30eb5c) | |
| nt!NtCreateWaitCompletionPacket (fffff800`1c38837c) | |
| nt!NtCreateWaitablePort (fffff800`1c3e5674) | |
| nt!NtCreateWnfStateName (fffff800`1c3270cc) | |
| nt!NtCreateWorkerFactory (fffff800`1c31c4d0) | |
| nt!NtDebugActiveProcess (fffff800`1c4e75d8) | |
| nt!NtDebugContinue (fffff800`1c4e77d0) | |
| nt!NtDeleteAtom (fffff800`1c2f7a9c) | |
| nt!NtDeleteBootEntry (fffff800`1c5713a8) | |
| nt!NtDeleteDriverEntry (fffff800`1c5715c4) | |
| nt!NtDeleteFile (fffff800`1c41efb4) | |
| nt!NtDeleteKey (fffff800`1c34a9f0) | |
| nt!NtDeleteObjectAuditAlarm (fffff800`1c28237c) | |
| nt!NtDeletePrivateNamespace (fffff800`1c52cbb4) | |
| nt!NtDeleteValueKey (fffff800`1c37d35c) | |
| nt!NtDeleteWnfStateData (fffff800`1c41fef8) | |
| nt!NtDeleteWnfStateName (fffff800`1c2f5998) | |
| nt!NtDisableLastKnownGood (fffff800`1c3ef8d8) | |
| nt!NtDisplayString (fffff800`1c56cdfc) | |
| fffff800`2c0d4980 | |
| nt!NtEnableLastKnownGood (fffff800`1c3ee0bc) | |
| nt!NtEnumerateBootEntries (fffff800`1c5717e0) | |
| nt!NtEnumerateDriverEntries (fffff800`1c571e14) | |
| nt!NtEnumerateSystemEnvironmentValuesEx (fffff800`1c572364) | |
| fffff800`2be86050 | |
| nt!NtExtendSection (fffff800`1c52319c) | |
| nt!NtFilterBootOption (fffff800`1c55411c) | |
| nt!NtFilterToken (fffff800`1c3aca38) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff800`1c427a14) | |
| nt!NtFlushBuffersFileEx (fffff800`1c391b50) | |
| nt!NtFlushInstallUILanguage (fffff800`1c421d40) | |
| nt!ArbPreprocessEntry (fffff800`1c3a1fa0) | |
| nt!NtFlushKey (fffff800`1c379634) | |
| fffff800`2bf0bb40 | |
| nt!NtFlushVirtualMemory (fffff800`1c2f3ffc) | |
| nt!NtFlushWriteBuffer (fffff800`1c52630c) | |
| nt!NtFreeUserPhysicalPages (fffff800`1c5251d8) | |
| fffff800`2c056f30 | |
| fffff800`2be86058 | |
| nt!NtGetCachedSigningLevel (fffff800`1c54e380) | |
| nt!NtGetCompleteWnfStateSubscription (fffff800`1c2fbd18) | |
| nt!NtGetContextThread (fffff800`1c3a089c) | |
| nt!NtGetCurrentProcessorNumber (fffff800`1c53d93c) | |
| nt!NtGetCurrentProcessorNumberEx (fffff800`1c53d96c) | |
| nt!NtGetDevicePowerState (fffff800`1c5363d8) | |
| nt!NtGetMUIRegistryInfo (fffff800`1c38db68) | |
| nt!NtGetNextProcess (fffff800`1c3c74e8) | |
| nt!NtGetNextThread (fffff800`1c3a2cd0) | |
| nt!NtGetNlsSectionPtr (fffff800`1c39e6ac) | |
| fffff800`2be86060 | |
| fffff800`2bebf7e0 | |
| nt!NtImpersonateAnonymousToken (fffff800`1c3aff44) | |
| nt!NtImpersonateThread (fffff800`1c3bff48) | |
| nt!NtInitializeNlsFiles (fffff800`1c321324) | |
| nt!NtInitializeRegistry (fffff800`1c3e4a54) | |
| nt!NtInitiatePowerAction (fffff800`1c3ca400) | |
| nt!NtIsSystemResumeAutomatic (fffff800`1c3c9168) | |
| nt!NtIsUILanguageComitted (fffff800`1c3a9540) | |
| nt!NtListenPort (fffff800`1c422fe8) | |
| nt!NtLoadDriver (fffff800`1c3d31ec) | |
| nt!NtLoadKey (fffff800`1c3abb58) | |
| nt!NtLoadKey2 (fffff800`1c3e5864) | |
| nt!NtLoadKeyEx (fffff800`1c34d580) | |
| nt!NtLockFile (fffff800`1c364bcc) | |
| nt!NtLockProductActivationKeys (fffff800`1c40f030) | |
| nt!NtLockRegistryKey (fffff800`1c4196d4) | |
| fffff800`2bf37680 | |
| nt!NtMakePermanentObject (fffff800`1c3c6ad0) | |
| nt!NtMakeTemporaryObject (fffff800`1c2f28e4) | |
| nt!NtManagePartition (fffff800`1c523040) | |
| nt!NtMapCMFModule (fffff800`1c38df20) | |
| nt!NtMapUserPhysicalPages (fffff800`1c5256f0) | |
| nt!NtModifyBootEntry (fffff800`1c572748) | |
| nt!NtModifyDriverEntry (fffff800`1c572764) | |
| nt!NtNotifyChangeDirectoryFile (fffff800`1c391f24) | |
| nt!NtNotifyChangeKey (fffff800`1c3798f8) | |
| nt!NtNotifyChangeMultipleKeys (fffff800`1c379960) | |
| nt!NtNotifyChangeSession (fffff800`1c3a7790) | |
| fffff800`2be86068 | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff800`1c427a14) | |
| nt!NtOpenIoCompletion (fffff800`1c4f39b4) | |
| nt!NtOpenJobObject (fffff800`1c541f94) | |
| nt!NtOpenKeyEx (fffff800`1c2defb0) | |
| nt!NtOpenKeyTransacted (fffff800`1c4d048c) | |
| nt!NtOpenKeyTransactedEx (fffff800`1c2de530) | |
| nt!NtOpenKeyedEvent (fffff800`1c5773c0) | |
| nt!NtOpenMutant (fffff800`1c386908) | |
| nt!NtOpenObjectAuditAlarm (fffff800`1c39eea0) | |
| nt!NtOpenPartition (fffff800`1c5230a8) | |
| nt!NtOpenPrivateNamespace (fffff800`1c38b220) | |
| nt!NtOpenProcessToken (fffff800`1c32c6d0) | |
| fffff800`2be86070 | |
| nt!NtOpenSemaphore (fffff800`1c39d3d4) | |
| nt!NtOpenSession (fffff800`1c3c65f8) | |
| nt!NtOpenSymbolicLinkObject (fffff800`1c3852dc) | |
| nt!NtOpenThread (fffff800`1c32d4a0) | |
| nt!NtOpenTimer (fffff800`1c56d8a4) | |
| fffff800`2be86078 | |
| fffff800`2be86080 | |
| nt!NtPlugPlayControl (fffff800`1c3041e0) | |
| fffff800`2be86088 | |
| fffff800`2be86090 | |
| fffff800`2be86098 | |
| fffff800`2be860a0 | |
| nt!NtPrivilegeCheck (fffff800`1c3aeb20) | |
| nt!NtPrivilegeObjectAuditAlarm (fffff800`1c3e1978) | |
| nt!NtPrivilegedServiceAuditAlarm (fffff800`1c3a05d0) | |
| fffff800`2be860a8 | |
| fffff800`2be860b0 | |
| nt!NtPulseEvent (fffff800`1c31d1a4) | |
| nt!NtQueryBootEntryOrder (fffff800`1c572780) | |
| nt!NtQueryBootOptions (fffff800`1c572a7c) | |
| fffff800`2bf89770 | |
| nt!NtQueryDirectoryObject (fffff800`1c373090) | |
| nt!NtQueryDriverEntryOrder (fffff800`1c572e08) | |
| nt!NtQueryEaFile (fffff800`1c38cd5c) | |
| nt!NtQueryFullAttributesFile (fffff800`1c381f40) | |
| nt!NtQueryInformationAtom (fffff800`1c2f7ae0) | |
| fffff800`2be860b8 | |
| nt!NtQueryInformationJobObject (fffff800`1c31a118) | |
| nt!NtQueryInformationPort (fffff800`1c51d098) | |
| fffff800`2be860c0 | |
| fffff800`2be860c8 | |
| fffff800`2be860d0 | |
| fffff800`2c0d7318 | |
| nt!NtQueryInstallUILanguage (fffff800`1c39c668) | |
| nt!NtQueryIntervalProfile (fffff800`1c3c2b80) | |
| nt!NtQueryIoCompletion (fffff800`1c3e5ad0) | |
| nt!NtQueryLicenseValue (fffff800`1c35339c) | |
| nt!NtQueryMultipleValueKey (fffff800`1c394e58) | |
| nt!NtQueryMutant (fffff800`1c280060) | |
| nt!NtQueryOpenSubKeys (fffff800`1c4d0684) | |
| nt!NtQueryOpenSubKeysEx (fffff800`1c4d08cc) | |
| nt!NtQueryPortInformationProcess (fffff800`1c53d9f8) | |
| nt!NtQueryQuotaInformationFile (fffff800`1c4f5120) | |
| nt!NtQuerySecurityAttributesToken (fffff800`1c2b4e30) | |
| nt!NtQuerySecurityObject (fffff800`1c29c0c0) | |
| nt!NtQuerySemaphore (fffff800`1c280480) | |
| nt!NtQuerySymbolicLinkObject (fffff800`1c384e00) | |
| nt!NtQuerySystemEnvironmentValue (fffff800`1c57325c) | |
| nt!NtQuerySystemEnvironmentValueEx (fffff800`1c3e54bc) | |
| nt!NtQuerySystemInformationEx (fffff800`1c391e74) | |
| nt!NtQueryTimerResolution (fffff800`1c3a3ba0) | |
| nt!NtQueryWnfStateData (fffff800`1c300774) | |
| nt!NtQueryWnfStateNameInformation (fffff800`1c39b82c) | |
| nt!NtQueueApcThreadEx (fffff800`1c346db0) | |
| fffff800`2bfd4d40 | |
| nt!NtRaiseHardError (fffff800`1c574ee8) | |
| fffff800`2be860d8 | |
| fffff800`2be860e0 | |
| fffff800`2be860e8 | |
| fffff800`2be860f0 | |
| fffff800`2be86238 | |
| nt!NtRegisterThreadTerminatePort (fffff800`1c3a8288) | |
| nt!NtReleaseKeyedEvent (fffff800`1c3a1a28) | |
| fffff800`2bf11850 | |
| nt!NtRemoveIoCompletionEx (fffff800`1c39480c) | |
| nt!NtRemoveProcessDebug (fffff800`1c4e7a38) | |
| nt!NtRenameKey (fffff800`1c4d0d68) | |
| fffff800`2be86240 | |
| nt!NtReplaceKey (fffff800`1c4d1360) | |
| fffff800`2c0e3d8c | |
| nt!NtReplyWaitReplyPort (fffff800`1c51d1d8) | |
| nt!NtRequestPort (fffff800`1c393c84) | |
| nt!NtResetEvent (fffff800`1c2e46d8) | |
| fffff800`2beb8260 | |
| nt!NtRestoreKey (fffff800`1c4d1830) | |
| nt!NtResumeProcess (fffff800`1c282208) | |
| fffff800`2c0b6060 | |
| fffff800`2be860f8 | |
| fffff800`2be86100 | |
| fffff800`2be86108 | |
| fffff800`2be86248 | |
| nt!NtSaveKey (fffff800`1c4d1ca4) | |
| nt!NtSaveKeyEx (fffff800`1c4d2078) | |
| nt!NtSaveMergedKeys (fffff800`1c4d24b4) | |
| nt!NtSecureConnectPort (fffff800`1c385648) | |
| nt!NtSerializeBoot (fffff800`1c422010) | |
| nt!NtSetBootEntryOrder (fffff800`1c57362c) | |
| nt!NtSetBootOptions (fffff800`1c5738b8) | |
| nt!NtSetCachedSigningLevel (fffff800`1c3ede7c) | |
| nt!NtSetContextThread (fffff800`1c541e68) | |
| nt!NtSetDebugFilterState (fffff800`1c4099b0) | |
| nt!NtSetDefaultHardErrorPort (fffff800`1c4221a0) | |
| nt!NtSetDefaultLocale (fffff800`1c3ce798) | |
| nt!NtSetDefaultUILanguage (fffff800`1c3ce784) | |
| nt!NtSetDriverEntryOrder (fffff800`1c573b4c) | |
| nt!NtSetEaFile (fffff800`1c4f4974) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff800`1c427a14) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff800`1c427a14) | |
| fffff800`2bf87bf8 | |
| nt!NtSetInformationDebugObject (fffff800`1c4e7b80) | |
| fffff800`2be86110 | |
| nt!NtSetInformationJobObject (fffff800`1c31682c) | |
| nt!NtSetInformationKey (fffff800`1c341e50) | |
| fffff800`2be86118 | |
| nt!NtSetInformationSymbolicLink (fffff800`1c528f60) | |
| nt!NtSetInformationToken (fffff800`1c332d14) | |
| fffff800`2be86120 | |
| fffff800`2be86250 | |
| nt!NtSetInformationVirtualMemory (fffff800`1c3240cc) | |
| fffff800`2bf12320 | |
| nt!NtSetIntervalProfile (fffff800`1c3c2c20) | |
| nt!NtSetIoCompletion (fffff800`1c31c828) | |
| nt!NtSetIoCompletionEx (fffff800`1c4f3ac4) | |
| fffff800`2bfc28bc | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff800`1c427a14) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff800`1c427a14) | |
| nt!NtSetQuotaInformationFile (fffff800`1c4f59fc) | |
| nt!NtSetSecurityObject (fffff800`1c389500) | |
| nt!NtSetSystemEnvironmentValue (fffff800`1c573dd8) | |
| nt!NtSetSystemEnvironmentValueEx (fffff800`1c5741a4) | |
| nt!NtSetSystemInformation (fffff800`1c36f70c) | |
| nt!NtSetSystemPowerState (fffff800`1c26bc74) | |
| nt!NtSetSystemTime (fffff800`1c56adc8) | |
| nt!NtSetThreadExecutionState (fffff800`1c3c5bbc) | |
| fffff800`2bf33340 | |
| fffff800`2beff970 | |
| nt!NtSetTimerResolution (fffff800`1c38f6d0) | |
| nt!NtSetUuidSeed (fffff800`1c41ac20) | |
| nt!NtSetVolumeInformationFile (fffff800`1c3c1960) | |
| nt!NtSetWnfProcessNotificationEvent (fffff800`1c3974dc) | |
| nt!NtShutdownSystem (fffff800`1c56cfa0) | |
| fffff800`2bf1045c | |
| fffff800`2c0a4f44 | |
| fffff800`2be86258 | |
| nt!NtStartProfile (fffff800`1c577074) | |
| nt!NtStopProfile (fffff800`1c5772d8) | |
| nt!NtSubscribeWnfStateChange (fffff800`1c2fe7e4) | |
| nt!NtSuspendProcess (fffff800`1c281684) | |
| nt!NtSuspendThread (fffff800`1c398b48) | |
| nt!NtSystemDebugControl (fffff800`1c578a44) | |
| nt!NtTerminateJobObject (fffff800`1c39d5fc) | |
| nt!NtTestAlert (fffff800`1c29b2e4) | |
| fffff800`2c056f84 | |
| fffff800`2be86128 | |
| nt!NtTraceControl (fffff800`1c327aa0) | |
| nt!NtTranslateFilePath (fffff800`1c574410) | |
| nt!NtUmsThreadYield (fffff800`1c518fec) | |
| nt!NtUnloadDriver (fffff800`1c4f8ef0) | |
| nt!NtUnloadKey (fffff800`1c423530) | |
| nt!NtUnloadKey2 (fffff800`1c3e1e5c) | |
| nt!NtUnloadKeyEx (fffff800`1c37adf8) | |
| nt!NtUnlockFile (fffff800`1c390218) | |
| fffff800`2bf38e30 | |
| nt!NtUnmapViewOfSectionEx (fffff800`1c2ca640) | |
| nt!NtUnsubscribeWnfStateChange (fffff800`1c2f706c) | |
| nt!NtUpdateWnfStateData (fffff800`1c2fe3c8) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff800`1c427a14) | |
| nt!NtWaitForAlertByThreadId (fffff800`1c3788a8) | |
| nt!NtWaitForDebugEvent (fffff800`1c4e7d78) | |
| nt!NtWaitForKeyedEvent (fffff800`1c3a1848) | |
| fffff800`2be9ba40 | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff800`1c427a14) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff800`1c427a14) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment