Last active
January 12, 2017 03:03
-
-
Save ntddk/38af5c3fdc5dc4178b1e to your computer and use it in GitHub Desktop.
KiServiceTable of Windows 10 Build 10074 x64
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| kd> .for(r $t0=0; @$t0<dwo(nt!KiServiceLimit); r $t0=@$t0+1){.printf "%y\n", nt!KiServiceTable+(dwo(nt!KiServiceTable+@$t0*4)>>4)} | |
| *** ERROR: Module load completed but symbols could not be loaded for LiveKdD.SYS | |
| fffff801`ad0f1a20 | |
| fffff801`ad0f4878 | |
| nt!NtAcceptConnectPort (fffff801`9d4fd8a8) | |
| nt!NtMapUserPhysicalPagesScatter (fffff801`9d6a2b10) | |
| nt!NtWaitForSingleObject (fffff801`9d4325e0) | |
| fffff801`ad14ef90 | |
| nt!NtReadFile (fffff801`9d426190) | |
| nt!NtDeviceIoControlFile (fffff801`9d4d5590) | |
| nt!NtWriteFile (fffff801`9d410910) | |
| nt!NtRemoveIoCompletion (fffff801`9d4d4c90) | |
| nt!NtReleaseSemaphore (fffff801`9d4d6380) | |
| nt!NtReplyWaitReceivePort (fffff801`9d4588cc) | |
| nt!NtReplyPort (fffff801`9d4f4fd0) | |
| nt!NtSetInformationThread (fffff801`9d499b20) | |
| nt!NtSetEvent (fffff801`9d41ab00) | |
| nt!NtClose (fffff801`9d428130) | |
| nt!NtQueryObject (fffff801`9d491b50) | |
| nt!NtQueryInformationFile (fffff801`9d4295e0) | |
| nt!NtOpenKey (fffff801`9d4e7df0) | |
| nt!NtEnumerateValueKey (fffff801`9d493c30) | |
| nt!NtFindAtom (fffff801`9d49b7a0) | |
| nt!NtQueryDefaultLocale (fffff801`9d4ee794) | |
| nt!NtQueryKey (fffff801`9d414d30) | |
| nt!NtQueryValueKey (fffff801`9d414400) | |
| nt!NtAllocateVirtualMemory (fffff801`9d422b70) | |
| nt!NtQueryInformationProcess (fffff801`9d4796d0) | |
| nt!NtWaitForMultipleObjects32 (fffff801`9d4d4860) | |
| nt!NtWriteFileGather (fffff801`9d4f02b4) | |
| nt!NtSetInformationProcess (fffff801`9d4bbe80) | |
| nt!NtCreateKey (fffff801`9d4e33cc) | |
| nt!NtFreeVirtualMemory (fffff801`9d451da0) | |
| nt!NtImpersonateClientOfPort (fffff801`9d699e68) | |
| nt!NtReleaseMutant (fffff801`9d41abd0) | |
| nt!NtQueryInformationToken (fffff801`9d4357e0) | |
| nt!NtRequestWaitReplyPort (fffff801`9d4e8980) | |
| nt!NtQueryVirtualMemory (fffff801`9d420b40) | |
| nt!NtOpenThreadToken (fffff801`9d4416dc) | |
| nt!NtQueryInformationThread (fffff801`9d469560) | |
| nt!NtOpenProcess (fffff801`9d442360) | |
| fffff801`ad01ca00 | |
| nt!NtMapViewOfSection (fffff801`9d451040) | |
| nt!NtAccessCheckAndAuditAlarm (fffff801`9d445928) | |
| nt!NtUnmapViewOfSection (fffff801`9d44ee64) | |
| nt!NtReplyWaitReceivePortEx (fffff801`9d4588e0) | |
| nt!NtTerminateProcess (fffff801`9d467c40) | |
| nt!NtSetEventBoostPriority (fffff801`9d6f2d70) | |
| nt!NtReadFileScatter (fffff801`9d4f8d38) | |
| nt!NtOpenThreadTokenEx (fffff801`9d441700) | |
| nt!NtOpenProcessTokenEx (fffff801`9d441fb0) | |
| nt!NtQueryPerformanceCounter (fffff801`9d4e7194) | |
| nt!NtEnumerateKey (fffff801`9d433e40) | |
| nt!NtOpenFile (fffff801`9d4770d0) | |
| nt!NtDelayExecution (fffff801`9d412610) | |
| nt!NtQueryDirectoryFile (fffff801`9d4d3480) | |
| nt!NtQuerySystemInformation (fffff801`9d423e30) | |
| nt!NtOpenSection (fffff801`9d4e68cc) | |
| nt!NtQueryTimer (fffff801`9d6f2c14) | |
| nt!NtFsControlFile (fffff801`9d40da94) | |
| nt!NtWriteVirtualMemory (fffff801`9d4f9498) | |
| nt!NtCloseObjectAuditAlarm (fffff801`9d4ed158) | |
| nt!NtDuplicateObject (fffff801`9d49ddf0) | |
| nt!NtQueryAttributesFile (fffff801`9d4d6c20) | |
| nt!NtClearEvent (fffff801`9d4e1650) | |
| nt!NtReadVirtualMemory (fffff801`9d449a70) | |
| nt!NtOpenEvent (fffff801`9d4eac28) | |
| nt!NtAdjustPrivilegesToken (fffff801`9d4603a8) | |
| nt!NtDuplicateToken (fffff801`9d45d1a0) | |
| fffff801`ad14ca60 | |
| nt!NtQueryDefaultUILanguage (fffff801`9d5874b8) | |
| nt!NtQueueApcThread (fffff801`9d468020) | |
| fffff801`ad027a20 | |
| nt!NtAddAtom (fffff801`9d6fae04) | |
| nt!NtCreateEvent (fffff801`9d4397f0) | |
| nt!NtQueryVolumeInformationFile (fffff801`9d40fdc0) | |
| nt!NtCreateSection (fffff801`9d44d590) | |
| nt!NtFlushBuffersFile (fffff801`9d4f7a3c) | |
| nt!NtApphelpCacheControl (fffff801`9d5085cc) | |
| nt!NtCreateProcessEx (fffff801`9d406cac) | |
| nt!NtCreateThread (fffff801`9d6bfc84) | |
| nt!NtIsProcessInJob (fffff801`9d4c59ec) | |
| nt!NtProtectVirtualMemory (fffff801`9d421780) | |
| nt!NtQuerySection (fffff801`9d478a08) | |
| nt!NtResumeThread (fffff801`9d4686c8) | |
| nt!NtTerminateThread (fffff801`9d46858c) | |
| nt!NtReadRequestData (fffff801`9d699f44) | |
| nt!NtCreateFile (fffff801`9d477130) | |
| nt!NtQueryEvent (fffff801`9d4f2780) | |
| nt!NtWriteRequestData (fffff801`9d69a068) | |
| nt!NtOpenDirectoryObject (fffff801`9d4e78cc) | |
| nt!NtAccessCheckByTypeAndAuditAlarm (fffff801`9d445700) | |
| nt!NtQuerySystemTime (fffff801`9d6efe18) | |
| nt!NtWaitForMultipleObjects (fffff801`9d4d32b0) | |
| nt!NtSetInformationObject (fffff801`9d4e8cd0) | |
| nt!NtCancelIoFile (fffff801`9d542428) | |
| fffff801`ad0b2330 | |
| nt!NtPowerInformation (fffff801`9d4adbfc) | |
| nt!NtSetValueKey (fffff801`9d48ec30) | |
| fffff801`ad0babd4 | |
| fffff801`ad105da4 | |
| fffff801`ad0f8d10 | |
| fffff801`ad23bbec | |
| nt!NtAccessCheckByTypeResultListAndAuditAlarm (fffff801`9d54ea78) | |
| nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle (fffff801`9d6d5120) | |
| nt!NtAddAtomEx (fffff801`9d4eada8) | |
| nt!NtAddBootEntry (fffff801`9d6f6634) | |
| nt!NtAddDriverEntry (fffff801`9d6f6654) | |
| nt!NtAdjustGroupsToken (fffff801`9d4ee930) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtAlertResumeThread (fffff801`9d6c6d2c) | |
| nt!NtAlertThread (fffff801`9d6c6e38) | |
| nt!NtAlertThreadByThreadId (fffff801`9d441f48) | |
| nt!NtAllocateLocallyUniqueId (fffff801`9d4e3200) | |
| nt!NtAllocateReserveObject (fffff801`9d6c2ed4) | |
| nt!NtAllocateUserPhysicalPages (fffff801`9d6a19ec) | |
| nt!NtAllocateUuids (fffff801`9d4ddc18) | |
| nt!NtAlpcAcceptConnectPort (fffff801`9d45e348) | |
| nt!NtAlpcCancelMessage (fffff801`9d501330) | |
| nt!NtAlpcConnectPort (fffff801`9d45af0c) | |
| nt!NtAlpcConnectPortEx (fffff801`9d4f9744) | |
| nt!NtAlpcCreatePort (fffff801`9d4f41f0) | |
| nt!NtAlpcCreatePortSection (fffff801`9d4e54fc) | |
| nt!NtAlpcCreateResourceReserve (fffff801`9d4e9768) | |
| nt!NtAlpcCreateSectionView (fffff801`9d459a14) | |
| nt!NtAlpcCreateSecurityContext (fffff801`9d456bf0) | |
| nt!NtAlpcDeletePortSection (fffff801`9d4f003c) | |
| nt!NtAlpcDeleteResourceReserve (fffff801`9d69ae84) | |
| nt!NtAlpcDeleteSectionView (fffff801`9d4ed594) | |
| nt!NtAlpcDeleteSecurityContext (fffff801`9d457ffc) | |
| nt!NtAlpcDisconnectPort (fffff801`9d4de754) | |
| nt!NtAlpcImpersonateClientContainerOfPort (fffff801`9d4f5dfc) | |
| nt!NtAlpcImpersonateClientOfPort (fffff801`9d4996e0) | |
| nt!NtAlpcOpenSenderProcess (fffff801`9d4f1678) | |
| nt!NtAlpcOpenSenderThread (fffff801`9d4f357c) | |
| nt!NtAlpcQueryInformation (fffff801`9d4d2710) | |
| nt!NtAlpcQueryInformationMessage (fffff801`9d4ec558) | |
| nt!NtAlpcRevokeSecurityContext (fffff801`9d69b0b0) | |
| nt!NtAlpcSendWaitReceivePort (fffff801`9d432740) | |
| nt!NtAlpcSetInformation (fffff801`9d4de124) | |
| nt!NtAreMappedFilesTheSame (fffff801`9d4c4f00) | |
| nt!NtAssignProcessToJobObject (fffff801`9d4c4144) | |
| nt!NtAssignProcessToSiloObject (fffff801`9d6c0490) | |
| fffff801`ad06a9e0 | |
| nt!NtCancelIoFileEx (fffff801`9d4e0e8c) | |
| nt!NtCancelSynchronousIoFile (fffff801`9d6751a4) | |
| fffff801`ad024d20 | |
| fffff801`ad0f6ca4 | |
| fffff801`ad017018 | |
| fffff801`ad017020 | |
| fffff801`ad017028 | |
| nt!NtCompactKeys (fffff801`9d651e38) | |
| nt!NtCompareObjects (fffff801`9d6a8778) | |
| nt!NtCompareTokens (fffff801`9d50f630) | |
| nt!ArbPreprocessEntry (fffff801`9d4fcd28) | |
| nt!NtCompressKey (fffff801`9d652054) | |
| nt!NtConnectPort (fffff801`9d4e3bdc) | |
| nt!NtCreateDebugObject (fffff801`9d6684a0) | |
| nt!NtCreateDirectoryObject (fffff801`9d45f4f0) | |
| nt!NtCreateDirectoryObjectEx (fffff801`9d503634) | |
| fffff801`ad017030 | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtCreateIRTimer (fffff801`9d59d32c) | |
| nt!NtCreateIoCompletion (fffff801`9d4ed9f8) | |
| nt!NtCreateJobObject (fffff801`9d4dd498) | |
| nt!ArbAddReserved (fffff801`9d5a1cf4) | |
| nt!NtCreateKeyTransacted (fffff801`9d4e3278) | |
| nt!NtCreateKeyedEvent (fffff801`9d592dc8) | |
| nt!NtCreateLowBoxToken (fffff801`9d50aa44) | |
| nt!NtCreateMailslotFile (fffff801`9d5015fc) | |
| nt!NtCreateMutant (fffff801`9d44d870) | |
| nt!NtCreateNamedPipeFile (fffff801`9d4f9bbc) | |
| nt!NtCreatePagingFile (fffff801`9d571a44) | |
| nt!NtCreatePartition (fffff801`9d69f984) | |
| nt!NtCreatePort (fffff801`9d599924) | |
| nt!NtCreatePrivateNamespace (fffff801`9d4f3bd4) | |
| nt!NtCreateProcess (fffff801`9d6bfc08) | |
| nt!NtCreateProfile (fffff801`9d6fc660) | |
| nt!NtCreateProfileEx (fffff801`9d6fc734) | |
| fffff801`ad017038 | |
| nt!NtCreateSemaphore (fffff801`9d4496bc) | |
| nt!NtCreateSiloObject (fffff801`9d6c06d4) | |
| nt!NtCreateSymbolicLinkObject (fffff801`9d4f65b8) | |
| nt!NtCreateThreadEx (fffff801`9d448ca4) | |
| nt!NtCreateTimer (fffff801`9d45cd7c) | |
| nt!NtCreateTimer2 (fffff801`9d45c9a0) | |
| nt!NtCreateToken (fffff801`9d6d5cd8) | |
| nt!NtCreateTokenEx (fffff801`9d45e9f0) | |
| fffff801`ad017040 | |
| fffff801`ad017048 | |
| nt!NtCreateUserProcess (fffff801`9d4761c4) | |
| nt!NtCreateWaitCompletionPacket (fffff801`9d4e7cf4) | |
| nt!NtCreateWaitablePort (fffff801`9d59c6a4) | |
| nt!NtCreateWnfStateName (fffff801`9d46d960) | |
| nt!NtCreateWorkerFactory (fffff801`9d4459ac) | |
| nt!NtDebugActiveProcess (fffff801`9d668668) | |
| nt!NtDebugContinue (fffff801`9d668860) | |
| nt!NtDeleteAtom (fffff801`9d45f5c0) | |
| nt!NtDeleteBootEntry (fffff801`9d6f6674) | |
| nt!NtDeleteDriverEntry (fffff801`9d6f6890) | |
| nt!NtDeleteFile (fffff801`9d598298) | |
| nt!NtDeleteKey (fffff801`9d4880e8) | |
| nt!NtDeleteObjectAuditAlarm (fffff801`9d6d51d0) | |
| nt!NtDeletePrivateNamespace (fffff801`9d406afc) | |
| nt!NtDeleteValueKey (fffff801`9d4e9dbc) | |
| nt!NtDeleteWnfStateData (fffff801`9d598d28) | |
| nt!NtDeleteWnfStateName (fffff801`9d46cd40) | |
| nt!NtDisableLastKnownGood (fffff801`9d55372c) | |
| nt!NtDisplayString (fffff801`9d6f1ed0) | |
| fffff801`ad25e55c | |
| nt!NtEnableLastKnownGood (fffff801`9d5525a4) | |
| nt!NtEnumerateBootEntries (fffff801`9d6f6aac) | |
| nt!NtEnumerateDriverEntries (fffff801`9d6f7110) | |
| nt!NtEnumerateSystemEnvironmentValuesEx (fffff801`9d6f7660) | |
| fffff801`ad017050 | |
| nt!NtExtendSection (fffff801`9d69fc58) | |
| nt!NtFilterBootOption (fffff801`9d6d7294) | |
| nt!NtFilterToken (fffff801`9d50a2c4) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtFlushBuffersFileEx (fffff801`9d4f7a58) | |
| nt!NtFlushInstallUILanguage (fffff801`9d59ba84) | |
| nt!ArbPreprocessEntry (fffff801`9d4fcd28) | |
| nt!NtFlushKey (fffff801`9d4fd9a4) | |
| fffff801`ad0a11d0 | |
| nt!NtFlushVirtualMemory (fffff801`9d4affc4) | |
| nt!NtFlushWriteBuffer (fffff801`9d6a3248) | |
| nt!NtFreeUserPhysicalPages (fffff801`9d6a2114) | |
| fffff801`ad1c776c | |
| fffff801`ad017058 | |
| nt!NtGetCachedSigningLevel (fffff801`9d6d10bc) | |
| nt!NtGetCompleteWnfStateSubscription (fffff801`9d46e35c) | |
| nt!NtGetContextThread (fffff801`9d4fb0ac) | |
| nt!NtGetCurrentProcessorNumber (fffff801`9d6c3024) | |
| nt!NtGetCurrentProcessorNumberEx (fffff801`9d6c3054) | |
| nt!NtGetDevicePowerState (fffff801`9d6b62c8) | |
| nt!NtGetMUIRegistryInfo (fffff801`9d4eb804) | |
| nt!NtGetNextProcess (fffff801`9d6c6f8c) | |
| nt!NtGetNextThread (fffff801`9d4062bc) | |
| nt!NtGetNlsSectionPtr (fffff801`9d50a68c) | |
| fffff801`ad017060 | |
| fffff801`ad082b30 | |
| nt!NtImpersonateAnonymousToken (fffff801`9d50fa24) | |
| nt!NtImpersonateThread (fffff801`9d50e7e4) | |
| nt!NtInitializeNlsFiles (fffff801`9d407384) | |
| nt!NtInitializeRegistry (fffff801`9d57d60c) | |
| nt!NtInitiatePowerAction (fffff801`9d6b6390) | |
| nt!NtIsSystemResumeAutomatic (fffff801`9d6b65a8) | |
| nt!NtIsUILanguageComitted (fffff801`9d5024b8) | |
| nt!NtListenPort (fffff801`9d59cf00) | |
| nt!NtLoadDriver (fffff801`9d572e9c) | |
| nt!NtLoadKey (fffff801`9d4da648) | |
| nt!NtLoadKey2 (fffff801`9d59d2c0) | |
| nt!NtLoadKeyEx (fffff801`9d4da880) | |
| nt!NtLockFile (fffff801`9d4117cc) | |
| nt!NtLockProductActivationKeys (fffff801`9d58905c) | |
| nt!NtLockRegistryKey (fffff801`9d5757b0) | |
| fffff801`ad10f40c | |
| nt!NtMakePermanentObject (fffff801`9d51daec) | |
| nt!NtMakeTemporaryObject (fffff801`9d544e5c) | |
| nt!NtManagePartition (fffff801`9d69faec) | |
| nt!NtMapCMFModule (fffff801`9d4ebbbc) | |
| nt!NtMapUserPhysicalPages (fffff801`9d6a262c) | |
| nt!NtModifyBootEntry (fffff801`9d6f7a44) | |
| nt!NtModifyDriverEntry (fffff801`9d6f7a60) | |
| nt!NtNotifyChangeDirectoryFile (fffff801`9d4f5af4) | |
| nt!NtNotifyChangeKey (fffff801`9d48cb6c) | |
| nt!NtNotifyChangeMultipleKeys (fffff801`9d48cbd4) | |
| nt!NtNotifyChangeSession (fffff801`9d59312c) | |
| fffff801`ad017068 | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtOpenIoCompletion (fffff801`9d674f64) | |
| nt!NtOpenJobObject (fffff801`9d6c4ce8) | |
| nt!NtOpenKeyEx (fffff801`9d423e10) | |
| nt!NtOpenKeyTransacted (fffff801`9d6521e4) | |
| nt!NtOpenKeyTransactedEx (fffff801`9d4f97bc) | |
| nt!NtOpenKeyedEvent (fffff801`9d6fcadc) | |
| nt!NtOpenMutant (fffff801`9d4e5ea0) | |
| nt!NtOpenObjectAuditAlarm (fffff801`9d5401c4) | |
| nt!NtOpenPartition (fffff801`9d69fb64) | |
| nt!NtOpenPrivateNamespace (fffff801`9d45e6c0) | |
| nt!NtOpenProcessToken (fffff801`9d441f3c) | |
| fffff801`ad017070 | |
| nt!NtOpenSemaphore (fffff801`9d4fcaec) | |
| nt!NtOpenSession (fffff801`9d500bec) | |
| nt!NtOpenSiloObject (fffff801`9d6c0b78) | |
| nt!NtOpenSymbolicLinkObject (fffff801`9d4e5f50) | |
| nt!NtOpenThread (fffff801`9d4439c8) | |
| nt!NtOpenTimer (fffff801`9d6f2b70) | |
| fffff801`ad017078 | |
| fffff801`ad017080 | |
| nt!NtPlugPlayControl (fffff801`9d49fffc) | |
| fffff801`ad017088 | |
| fffff801`ad017090 | |
| fffff801`ad017098 | |
| fffff801`ad0170a0 | |
| nt!NtPrivilegeCheck (fffff801`9d4f2150) | |
| nt!NtPrivilegeObjectAuditAlarm (fffff801`9d58fcf0) | |
| nt!NtPrivilegedServiceAuditAlarm (fffff801`9d4fc5d0) | |
| fffff801`ad0170a8 | |
| fffff801`ad0170b0 | |
| nt!NtPulseEvent (fffff801`9d445dd0) | |
| nt!NtQueryBootEntryOrder (fffff801`9d6f7a7c) | |
| nt!NtQueryBootOptions (fffff801`9d6f7d78) | |
| fffff801`ad104d54 | |
| nt!NtQueryDirectoryObject (fffff801`9d4d41a0) | |
| nt!NtQueryDriverEntryOrder (fffff801`9d6f8104) | |
| nt!NtQueryEaFile (fffff801`9d4eca2c) | |
| nt!NtQueryFullAttributesFile (fffff801`9d4d5ea0) | |
| nt!NtQueryInformationAtom (fffff801`9d45f604) | |
| fffff801`ad0170b8 | |
| nt!NtQueryInformationJobObject (fffff801`9d4b1020) | |
| nt!NtQueryInformationPort (fffff801`9d699e88) | |
| fffff801`ad0170c0 | |
| nt!NtQueryInformationSiloObject (fffff801`9d4f8b94) | |
| fffff801`ad0170c8 | |
| fffff801`ad0170d0 | |
| fffff801`ad2612dc | |
| nt!NtQueryInstallUILanguage (fffff801`9d4fcc04) | |
| nt!NtQueryIntervalProfile (fffff801`9d51df2c) | |
| nt!NtQueryIoCompletion (fffff801`9d54c320) | |
| nt!NtQueryLicenseValue (fffff801`9d4d034c) | |
| nt!NtQueryMultipleValueKey (fffff801`9d4f2370) | |
| nt!NtQueryMutant (fffff801`9d405f74) | |
| nt!NtQueryOpenSubKeys (fffff801`9d6523dc) | |
| nt!NtQueryOpenSubKeysEx (fffff801`9d652624) | |
| nt!NtQueryPortInformationProcess (fffff801`9d6c30e0) | |
| nt!NtQueryQuotaInformationFile (fffff801`9d6766d0) | |
| nt!NtQuerySecurityAttributesToken (fffff801`9d435500) | |
| nt!NtQuerySecurityObject (fffff801`9d4102b0) | |
| nt!NtQuerySemaphore (fffff801`9d4065ec) | |
| nt!NtQuerySymbolicLinkObject (fffff801`9d490e90) | |
| nt!NtQuerySystemEnvironmentValue (fffff801`9d6f8558) | |
| nt!NtQuerySystemEnvironmentValueEx (fffff801`9d59adf0) | |
| nt!NtQuerySystemInformationEx (fffff801`9d4f0ba4) | |
| nt!NtQueryTimerResolution (fffff801`9d4fe664) | |
| nt!NtQueryWnfStateData (fffff801`9d46debc) | |
| nt!NtQueryWnfStateNameInformation (fffff801`9d46c590) | |
| nt!NtQueueApcThreadEx (fffff801`9d468048) | |
| fffff801`ad14cca0 | |
| nt!NtRaiseHardError (fffff801`9d6fa5f0) | |
| fffff801`ad0170d8 | |
| fffff801`ad0170e0 | |
| fffff801`ad0170e8 | |
| fffff801`ad0170f0 | |
| fffff801`ad017238 | |
| nt!NtRegisterThreadTerminatePort (fffff801`9d547620) | |
| nt!NtReleaseKeyedEvent (fffff801`9d4fb9c0) | |
| fffff801`ad057f90 | |
| nt!NtRemoveIoCompletionEx (fffff801`9d4f7eb4) | |
| nt!NtRemoveProcessDebug (fffff801`9d668ac8) | |
| nt!NtRenameKey (fffff801`9d652ac0) | |
| fffff801`ad017240 | |
| nt!NtReplaceKey (fffff801`9d6530b8) | |
| fffff801`ad26ed80 | |
| nt!NtReplyWaitReplyPort (fffff801`9d699fc8) | |
| nt!NtRequestPort (fffff801`9d4f0f20) | |
| nt!NtResetEvent (fffff801`9d4efda8) | |
| fffff801`ad095a20 | |
| nt!NtRestoreKey (fffff801`9d653588) | |
| nt!NtResumeProcess (fffff801`9d6c6ea0) | |
| fffff801`ad0fc8f4 | |
| fffff801`ad0170f8 | |
| fffff801`ad017100 | |
| fffff801`ad017108 | |
| fffff801`ad017248 | |
| nt!NtSaveKey (fffff801`9d6539fc) | |
| nt!NtSaveKeyEx (fffff801`9d653dd0) | |
| nt!NtSaveMergedKeys (fffff801`9d65420c) | |
| nt!NtSecureConnectPort (fffff801`9d4e3c24) | |
| nt!NtSerializeBoot (fffff801`9d59c024) | |
| nt!NtSetBootEntryOrder (fffff801`9d6f8928) | |
| nt!NtSetBootOptions (fffff801`9d6f8bb4) | |
| nt!NtSetCachedSigningLevel (fffff801`9d5520a4) | |
| nt!NtSetContextThread (fffff801`9d6c4bbc) | |
| nt!NtSetDebugFilterState (fffff801`9d58380c) | |
| nt!NtSetDefaultHardErrorPort (fffff801`9d57423c) | |
| nt!NtSetDefaultLocale (fffff801`9d586d4c) | |
| nt!NtSetDefaultUILanguage (fffff801`9d586d38) | |
| nt!NtSetDriverEntryOrder (fffff801`9d6f8e48) | |
| nt!NtSetEaFile (fffff801`9d675f24) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| fffff801`ad2601e4 | |
| nt!NtSetInformationDebugObject (fffff801`9d668c10) | |
| fffff801`ad017110 | |
| nt!NtSetInformationJobObject (fffff801`9d4b3ca8) | |
| nt!NtSetInformationKey (fffff801`9d493890) | |
| fffff801`ad017118 | |
| nt!NtSetInformationSiloObject (fffff801`9d6c0cd4) | |
| nt!NtSetInformationToken (fffff801`9d45b93c) | |
| fffff801`ad017120 | |
| fffff801`ad017250 | |
| nt!NtSetInformationVirtualMemory (fffff801`9d446714) | |
| fffff801`ad100ce0 | |
| nt!NtSetIntervalProfile (fffff801`9d51e330) | |
| nt!NtSetIoCompletion (fffff801`9d445e68) | |
| nt!NtSetIoCompletionEx (fffff801`9d675074) | |
| fffff801`ad138434 | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtSetQuotaInformationFile (fffff801`9d676fac) | |
| nt!NtSetSecurityObject (fffff801`9d40d688) | |
| nt!NtSetSystemEnvironmentValue (fffff801`9d6f90d4) | |
| nt!NtSetSystemEnvironmentValueEx (fffff801`9d6f94a0) | |
| nt!NtSetSystemInformation (fffff801`9d4ca44c) | |
| nt!NtSetSystemPowerState (fffff801`9d400bb8) | |
| nt!NtSetSystemTime (fffff801`9d6efe84) | |
| nt!NtSetThreadExecutionState (fffff801`9d54497c) | |
| fffff801`ad026aa8 | |
| fffff801`ad0ace90 | |
| nt!NtSetTimerResolution (fffff801`9d519ae4) | |
| nt!NtSetUuidSeed (fffff801`9d593a84) | |
| nt!NtSetVolumeInformationFile (fffff801`9d51b718) | |
| nt!NtSetWnfProcessNotificationEvent (fffff801`9d46a19c) | |
| nt!NtShutdownSystem (fffff801`9d6f2074) | |
| fffff801`ad0f4e2c | |
| fffff801`ad21e158 | |
| fffff801`ad017258 | |
| nt!NtStartProfile (fffff801`9d6fc790) | |
| nt!NtStopProfile (fffff801`9d6fc9f4) | |
| nt!NtSubscribeWnfStateChange (fffff801`9d46eb04) | |
| nt!NtSuspendProcess (fffff801`9d4067f0) | |
| nt!NtSuspendThread (fffff801`9d53f0cc) | |
| nt!NtSystemDebugControl (fffff801`9d6fe160) | |
| nt!NtTerminateJobObject (fffff801`9d4b0e78) | |
| nt!NtTerminateSiloObject (fffff801`9d6c0e38) | |
| nt!NtTestAlert (fffff801`9d4484a4) | |
| fffff801`ad1c77c0 | |
| fffff801`ad017128 | |
| nt!NtTraceControl (fffff801`9d4408b0) | |
| nt!NtTranslateFilePath (fffff801`9d6f970c) | |
| nt!NtUmsThreadYield (fffff801`9d695ddc) | |
| nt!NtUnloadDriver (fffff801`9d67a458) | |
| nt!NtUnloadKey (fffff801`9d591f50) | |
| nt!NtUnloadKey2 (fffff801`9d591f58) | |
| nt!NtUnloadKeyEx (fffff801`9d4d83b4) | |
| nt!NtUnlockFile (fffff801`9d4e7954) | |
| fffff801`ad094410 | |
| nt!NtUnmapViewOfSectionEx (fffff801`9d44fc10) | |
| nt!NtUnsubscribeWnfStateChange (fffff801`9d46d47c) | |
| nt!NtUpdateWnfStateData (fffff801`9d46f02c) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtWaitForAlertByThreadId (fffff801`9d4d5944) | |
| nt!NtWaitForDebugEvent (fffff801`9d668e08) | |
| nt!NtWaitForKeyedEvent (fffff801`9d4fbb94) | |
| fffff801`ad061ad0 | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| kd> fffff801`ad0f1a20 | |
| fffff801`ad0f4878 | |
| nt!NtAcceptConnectPort (fffff801`9d4fd8a8) | |
| nt!NtMapUserPhysicalPagesScatter (fffff801`9d6a2b10) | |
| nt!NtWaitForSingleObject (fffff801`9d4325e0) | |
| fffff801`ad14ef90 | |
| nt!NtReadFile (fffff801`9d426190) | |
| nt!NtDeviceIoControlFile (fffff801`9d4d5590) | |
| nt!NtWriteFile (fffff801`9d410910) | |
| nt!NtRemoveIoCompletion (fffff801`9d4d4c90) | |
| nt!NtReleaseSemaphore (fffff801`9d4d6380) | |
| nt!NtReplyWaitReceivePort (fffff801`9d4588cc) | |
| nt!NtReplyPort (fffff801`9d4f4fd0) | |
| nt!NtSetInformationThread (fffff801`9d499b20) | |
| nt!NtSetEvent (fffff801`9d41ab00) | |
| nt!NtClose (fffff801`9d428130) | |
| nt!NtQueryObject (fffff801`9d491b50) | |
| nt!NtQueryInformationFile (fffff801`9d4295e0) | |
| nt!NtOpenKey (fffff801`9d4e7df0) | |
| nt!NtEnumerateValueKey (fffff801`9d493c30) | |
| nt!NtFindAtom (fffff801`9d49b7a0) | |
| nt!NtQueryDefaultLocale (fffff801`9d4ee794) | |
| nt!NtQueryKey (fffff801`9d414d30) | |
| nt!NtQueryValueKey (fffff801`9d414400) | |
| nt!NtAllocateVirtualMemory (fffff801`9d422b70) | |
| nt!NtQueryInformationProcess (fffff801`9d4796d0) | |
| nt!NtWaitForMultipleObjects32 (fffff801`9d4d4860) | |
| nt!NtWriteFileGather (fffff801`9d4f02b4) | |
| nt!NtSetInformationProcess (fffff801`9d4bbe80) | |
| nt!NtCreateKey (fffff801`9d4e33cc) | |
| nt!NtFreeVirtualMemory (fffff801`9d451da0) | |
| nt!NtImpersonateClientOfPort (fffff801`9d699e68) | |
| nt!NtReleaseMutant (fffff801`9d41abd0) | |
| nt!NtQueryInformationToken (fffff801`9d4357e0) | |
| nt!NtRequestWaitReplyPort (fffff801`9d4e8980) | |
| nt!NtQueryVirtualMemory (fffff801`9d420b40) | |
| nt!NtOpenThreadToken (fffff801`9d4416dc) | |
| nt!NtQueryInformationThread (fffff801`9d469560) | |
| nt!NtOpenProcess (fffff801`9d442360) | |
| fffff801`ad01ca00 | |
| nt!NtMapViewOfSection (fffff801`9d451040) | |
| nt!NtAccessCheckAndAuditAlarm (fffff801`9d445928) | |
| nt!NtUnmapViewOfSection (fffff801`9d44ee64) | |
| nt!NtReplyWaitReceivePortEx (fffff801`9d4588e0) | |
| nt!NtTerminateProcess (fffff801`9d467c40) | |
| nt!NtSetEventBoostPriority (fffff801`9d6f2d70) | |
| nt!NtReadFileScatter (fffff801`9d4f8d38) | |
| nt!NtOpenThreadTokenEx (fffff801`9d441700) | |
| nt!NtOpenProcessTokenEx (fffff801`9d441fb0) | |
| nt!NtQueryPerformanceCounter (fffff801`9d4e7194) | |
| nt!NtEnumerateKey (fffff801`9d433e40) | |
| nt!NtOpenFile (fffff801`9d4770d0) | |
| nt!NtDelayExecution (fffff801`9d412610) | |
| nt!NtQueryDirectoryFile (fffff801`9d4d3480) | |
| nt!NtQuerySystemInformation (fffff801`9d423e30) | |
| nt!NtOpenSection (fffff801`9d4e68cc) | |
| nt!NtQueryTimer (fffff801`9d6f2c14) | |
| nt!NtFsControlFile (fffff801`9d40da94) | |
| nt!NtWriteVirtualMemory (fffff801`9d4f9498) | |
| nt!NtCloseObjectAuditAlarm (fffff801`9d4ed158) | |
| nt!NtDuplicateObject (fffff801`9d49ddf0) | |
| nt!NtQueryAttributesFile (fffff801`9d4d6c20) | |
| nt!NtClearEvent (fffff801`9d4e1650) | |
| nt!NtReadVirtualMemory (fffff801`9d449a70) | |
| nt!NtOpenEvent (fffff801`9d4eac28) | |
| nt!NtAdjustPrivilegesToken (fffff801`9d4603a8) | |
| nt!NtDuplicateToken (fffff801`9d45d1a0) | |
| fffff801`ad14ca60 | |
| nt!NtQueryDefaultUILanguage (fffff801`9d5874b8) | |
| nt!NtQueueApcThread (fffff801`9d468020) | |
| fffff801`ad027a20 | |
| nt!NtAddAtom (fffff801`9d6fae04) | |
| nt!NtCreateEvent (fffff801`9d4397f0) | |
| nt!NtQueryVolumeInformationFile (fffff801`9d40fdc0) | |
| nt!NtCreateSection (fffff801`9d44d590) | |
| nt!NtFlushBuffersFile (fffff801`9d4f7a3c) | |
| nt!NtApphelpCacheControl (fffff801`9d5085cc) | |
| nt!NtCreateProcessEx (fffff801`9d406cac) | |
| nt!NtCreateThread (fffff801`9d6bfc84) | |
| nt!NtIsProcessInJob (fffff801`9d4c59ec) | |
| nt!NtProtectVirtualMemory (fffff801`9d421780) | |
| nt!NtQuerySection (fffff801`9d478a08) | |
| nt!NtResumeThread (fffff801`9d4686c8) | |
| nt!NtTerminateThread (fffff801`9d46858c) | |
| nt!NtReadRequestData (fffff801`9d699f44) | |
| nt!NtCreateFile (fffff801`9d477130) | |
| nt!NtQueryEvent (fffff801`9d4f2780) | |
| nt!NtWriteRequestData (fffff801`9d69a068) | |
| nt!NtOpenDirectoryObject (fffff801`9d4e78cc) | |
| nt!NtAccessCheckByTypeAndAuditAlarm (fffff801`9d445700) | |
| nt!NtQuerySystemTime (fffff801`9d6efe18) | |
| nt!NtWaitForMultipleObjects (fffff801`9d4d32b0) | |
| nt!NtSetInformationObject (fffff801`9d4e8cd0) | |
| nt!NtCancelIoFile (fffff801`9d542428) | |
| fffff801`ad0b2330 | |
| nt!NtPowerInformation (fffff801`9d4adbfc) | |
| nt!NtSetValueKey (fffff801`9d48ec30) | |
| fffff801`ad0babd4 | |
| fffff801`ad105da4 | |
| fffff801`ad0f8d10 | |
| fffff801`ad23bbec | |
| nt!NtAccessCheckByTypeResultListAndAuditAlarm (fffff801`9d54ea78) | |
| nt!NtAccessCheckByTypeResultListAndAuditAlarmByHandle (fffff801`9d6d5120) | |
| nt!NtAddAtomEx (fffff801`9d4eada8) | |
| nt!NtAddBootEntry (fffff801`9d6f6634) | |
| nt!NtAddDriverEntry (fffff801`9d6f6654) | |
| nt!NtAdjustGroupsToken (fffff801`9d4ee930) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtAlertResumeThread (fffff801`9d6c6d2c) | |
| nt!NtAlertThread (fffff801`9d6c6e38) | |
| nt!NtAlertThreadByThreadId (fffff801`9d441f48) | |
| nt!NtAllocateLocallyUniqueId (fffff801`9d4e3200) | |
| nt!NtAllocateReserveObject (fffff801`9d6c2ed4) | |
| nt!NtAllocateUserPhysicalPages (fffff801`9d6a19ec) | |
| nt!NtAllocateUuids (fffff801`9d4ddc18) | |
| nt!NtAlpcAcceptConnectPort (fffff801`9d45e348) | |
| nt!NtAlpcCancelMessage (fffff801`9d501330) | |
| nt!NtAlpcConnectPort (fffff801`9d45af0c) | |
| nt!NtAlpcConnectPortEx (fffff801`9d4f9744) | |
| nt!NtAlpcCreatePort (fffff801`9d4f41f0) | |
| nt!NtAlpcCreatePortSection (fffff801`9d4e54fc) | |
| nt!NtAlpcCreateResourceReserve (fffff801`9d4e9768) | |
| nt!NtAlpcCreateSectionView (fffff801`9d459a14) | |
| nt!NtAlpcCreateSecurityContext (fffff801`9d456bf0) | |
| nt!NtAlpcDeletePortSection (fffff801`9d4f003c) | |
| nt!NtAlpcDeleteResourceReserve (fffff801`9d69ae84) | |
| nt!NtAlpcDeleteSectionView (fffff801`9d4ed594) | |
| nt!NtAlpcDeleteSecurityContext (fffff801`9d457ffc) | |
| nt!NtAlpcDisconnectPort (fffff801`9d4de754) | |
| nt!NtAlpcImpersonateClientContainerOfPort (fffff801`9d4f5dfc) | |
| nt!NtAlpcImpersonateClientOfPort (fffff801`9d4996e0) | |
| nt!NtAlpcOpenSenderProcess (fffff801`9d4f1678) | |
| nt!NtAlpcOpenSenderThread (fffff801`9d4f357c) | |
| nt!NtAlpcQueryInformation (fffff801`9d4d2710) | |
| nt!NtAlpcQueryInformationMessage (fffff801`9d4ec558) | |
| nt!NtAlpcRevokeSecurityContext (fffff801`9d69b0b0) | |
| nt!NtAlpcSendWaitReceivePort (fffff801`9d432740) | |
| nt!NtAlpcSetInformation (fffff801`9d4de124) | |
| nt!NtAreMappedFilesTheSame (fffff801`9d4c4f00) | |
| nt!NtAssignProcessToJobObject (fffff801`9d4c4144) | |
| nt!NtAssignProcessToSiloObject (fffff801`9d6c0490) | |
| fffff801`ad06a9e0 | |
| nt!NtCancelIoFileEx (fffff801`9d4e0e8c) | |
| nt!NtCancelSynchronousIoFile (fffff801`9d6751a4) | |
| fffff801`ad024d20 | |
| fffff801`ad0f6ca4 | |
| fffff801`ad017018 | |
| fffff801`ad017020 | |
| fffff801`ad017028 | |
| nt!NtCompactKeys (fffff801`9d651e38) | |
| nt!NtCompareObjects (fffff801`9d6a8778) | |
| nt!NtCompareTokens (fffff801`9d50f630) | |
| nt!ArbPreprocessEntry (fffff801`9d4fcd28) | |
| nt!NtCompressKey (fffff801`9d652054) | |
| nt!NtConnectPort (fffff801`9d4e3bdc) | |
| nt!NtCreateDebugObject (fffff801`9d6684a0) | |
| nt!NtCreateDirectoryObject (fffff801`9d45f4f0) | |
| nt!NtCreateDirectoryObjectEx (fffff801`9d503634) | |
| fffff801`ad017030 | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtCreateIRTimer (fffff801`9d59d32c) | |
| nt!NtCreateIoCompletion (fffff801`9d4ed9f8) | |
| nt!NtCreateJobObject (fffff801`9d4dd498) | |
| nt!ArbAddReserved (fffff801`9d5a1cf4) | |
| nt!NtCreateKeyTransacted (fffff801`9d4e3278) | |
| nt!NtCreateKeyedEvent (fffff801`9d592dc8) | |
| nt!NtCreateLowBoxToken (fffff801`9d50aa44) | |
| nt!NtCreateMailslotFile (fffff801`9d5015fc) | |
| nt!NtCreateMutant (fffff801`9d44d870) | |
| nt!NtCreateNamedPipeFile (fffff801`9d4f9bbc) | |
| nt!NtCreatePagingFile (fffff801`9d571a44) | |
| nt!NtCreatePartition (fffff801`9d69f984) | |
| nt!NtCreatePort (fffff801`9d599924) | |
| nt!NtCreatePrivateNamespace (fffff801`9d4f3bd4) | |
| nt!NtCreateProcess (fffff801`9d6bfc08) | |
| nt!NtCreateProfile (fffff801`9d6fc660) | |
| nt!NtCreateProfileEx (fffff801`9d6fc734) | |
| fffff801`ad017038 | |
| nt!NtCreateSemaphore (fffff801`9d4496bc) | |
| nt!NtCreateSiloObject (fffff801`9d6c06d4) | |
| nt!NtCreateSymbolicLinkObject (fffff801`9d4f65b8) | |
| nt!NtCreateThreadEx (fffff801`9d448ca4) | |
| nt!NtCreateTimer (fffff801`9d45cd7c) | |
| nt!NtCreateTimer2 (fffff801`9d45c9a0) | |
| nt!NtCreateToken (fffff801`9d6d5cd8) | |
| nt!NtCreateTokenEx (fffff801`9d45e9f0) | |
| fffff801`ad017040 | |
| fffff801`ad017048 | |
| nt!NtCreateUserProcess (fffff801`9d4761c4) | |
| nt!NtCreateWaitCompletionPacket (fffff801`9d4e7cf4) | |
| nt!NtCreateWaitablePort (fffff801`9d59c6a4) | |
| nt!NtCreateWnfStateName (fffff801`9d46d960) | |
| nt!NtCreateWorkerFactory (fffff801`9d4459ac) | |
| nt!NtDebugActiveProcess (fffff801`9d668668) | |
| nt!NtDebugContinue (fffff801`9d668860) | |
| nt!NtDeleteAtom (fffff801`9d45f5c0) | |
| nt!NtDeleteBootEntry (fffff801`9d6f6674) | |
| nt!NtDeleteDriverEntry (fffff801`9d6f6890) | |
| nt!NtDeleteFile (fffff801`9d598298) | |
| nt!NtDeleteKey (fffff801`9d4880e8) | |
| nt!NtDeleteObjectAuditAlarm (fffff801`9d6d51d0) | |
| nt!NtDeletePrivateNamespace (fffff801`9d406afc) | |
| nt!NtDeleteValueKey (fffff801`9d4e9dbc) | |
| nt!NtDeleteWnfStateData (fffff801`9d598d28) | |
| nt!NtDeleteWnfStateName (fffff801`9d46cd40) | |
| nt!NtDisableLastKnownGood (fffff801`9d55372c) | |
| nt!NtDisplayString (fffff801`9d6f1ed0) | |
| fffff801`ad25e55c | |
| nt!NtEnableLastKnownGood (fffff801`9d5525a4) | |
| nt!NtEnumerateBootEntries (fffff801`9d6f6aac) | |
| nt!NtEnumerateDriverEntries (fffff801`9d6f7110) | |
| nt!NtEnumerateSystemEnvironmentValuesEx (fffff801`9d6f7660) | |
| fffff801`ad017050 | |
| nt!NtExtendSection (fffff801`9d69fc58) | |
| nt!NtFilterBootOption (fffff801`9d6d7294) | |
| nt!NtFilterToken (fffff801`9d50a2c4) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtFlushBuffersFileEx (fffff801`9d4f7a58) | |
| nt!NtFlushInstallUILanguage (fffff801`9d59ba84) | |
| nt!ArbPreprocessEntry (fffff801`9d4fcd28) | |
| nt!NtFlushKey (fffff801`9d4fd9a4) | |
| fffff801`ad0a11d0 | |
| nt!NtFlushVirtualMemory (fffff801`9d4affc4) | |
| nt!NtFlushWriteBuffer (fffff801`9d6a3248) | |
| nt!NtFreeUserPhysicalPages (fffff801`9d6a2114) | |
| fffff801`ad1c776c | |
| fffff801`ad017058 | |
| nt!NtGetCachedSigningLevel (fffff801`9d6d10bc) | |
| nt!NtGetCompleteWnfStateSubscription (fffff801`9d46e35c) | |
| nt!NtGetContextThread (fffff801`9d4fb0ac) | |
| nt!NtGetCurrentProcessorNumber (fffff801`9d6c3024) | |
| nt!NtGetCurrentProcessorNumberEx (fffff801`9d6c3054) | |
| nt!NtGetDevicePowerState (fffff801`9d6b62c8) | |
| nt!NtGetMUIRegistryInfo (fffff801`9d4eb804) | |
| nt!NtGetNextProcess (fffff801`9d6c6f8c) | |
| nt!NtGetNextThread (fffff801`9d4062bc) | |
| nt!NtGetNlsSectionPtr (fffff801`9d50a68c) | |
| fffff801`ad017060 | |
| fffff801`ad082b30 | |
| nt!NtImpersonateAnonymousToken (fffff801`9d50fa24) | |
| nt!NtImpersonateThread (fffff801`9d50e7e4) | |
| nt!NtInitializeNlsFiles (fffff801`9d407384) | |
| nt!NtInitializeRegistry (fffff801`9d57d60c) | |
| nt!NtInitiatePowerAction (fffff801`9d6b6390) | |
| nt!NtIsSystemResumeAutomatic (fffff801`9d6b65a8) | |
| nt!NtIsUILanguageComitted (fffff801`9d5024b8) | |
| nt!NtListenPort (fffff801`9d59cf00) | |
| nt!NtLoadDriver (fffff801`9d572e9c) | |
| nt!NtLoadKey (fffff801`9d4da648) | |
| nt!NtLoadKey2 (fffff801`9d59d2c0) | |
| nt!NtLoadKeyEx (fffff801`9d4da880) | |
| nt!NtLockFile (fffff801`9d4117cc) | |
| nt!NtLockProductActivationKeys (fffff801`9d58905c) | |
| nt!NtLockRegistryKey (fffff801`9d5757b0) | |
| fffff801`ad10f40c | |
| nt!NtMakePermanentObject (fffff801`9d51daec) | |
| nt!NtMakeTemporaryObject (fffff801`9d544e5c) | |
| nt!NtManagePartition (fffff801`9d69faec) | |
| nt!NtMapCMFModule (fffff801`9d4ebbbc) | |
| nt!NtMapUserPhysicalPages (fffff801`9d6a262c) | |
| nt!NtModifyBootEntry (fffff801`9d6f7a44) | |
| nt!NtModifyDriverEntry (fffff801`9d6f7a60) | |
| nt!NtNotifyChangeDirectoryFile (fffff801`9d4f5af4) | |
| nt!NtNotifyChangeKey (fffff801`9d48cb6c) | |
| nt!NtNotifyChangeMultipleKeys (fffff801`9d48cbd4) | |
| nt!NtNotifyChangeSession (fffff801`9d59312c) | |
| fffff801`ad017068 | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtOpenIoCompletion (fffff801`9d674f64) | |
| nt!NtOpenJobObject (fffff801`9d6c4ce8) | |
| nt!NtOpenKeyEx (fffff801`9d423e10) | |
| nt!NtOpenKeyTransacted (fffff801`9d6521e4) | |
| nt!NtOpenKeyTransactedEx (fffff801`9d4f97bc) | |
| nt!NtOpenKeyedEvent (fffff801`9d6fcadc) | |
| nt!NtOpenMutant (fffff801`9d4e5ea0) | |
| nt!NtOpenObjectAuditAlarm (fffff801`9d5401c4) | |
| nt!NtOpenPartition (fffff801`9d69fb64) | |
| nt!NtOpenPrivateNamespace (fffff801`9d45e6c0) | |
| nt!NtOpenProcessToken (fffff801`9d441f3c) | |
| fffff801`ad017070 | |
| nt!NtOpenSemaphore (fffff801`9d4fcaec) | |
| nt!NtOpenSession (fffff801`9d500bec) | |
| nt!NtOpenSiloObject (fffff801`9d6c0b78) | |
| nt!NtOpenSymbolicLinkObject (fffff801`9d4e5f50) | |
| nt!NtOpenThread (fffff801`9d4439c8) | |
| nt!NtOpenTimer (fffff801`9d6f2b70) | |
| fffff801`ad017078 | |
| fffff801`ad017080 | |
| nt!NtPlugPlayControl (fffff801`9d49fffc) | |
| fffff801`ad017088 | |
| fffff801`ad017090 | |
| fffff801`ad017098 | |
| fffff801`ad0170a0 | |
| nt!NtPrivilegeCheck (fffff801`9d4f2150) | |
| nt!NtPrivilegeObjectAuditAlarm (fffff801`9d58fcf0) | |
| nt!NtPrivilegedServiceAuditAlarm (fffff801`9d4fc5d0) | |
| fffff801`ad0170a8 | |
| fffff801`ad0170b0 | |
| nt!NtPulseEvent (fffff801`9d445dd0) | |
| nt!NtQueryBootEntryOrder (fffff801`9d6f7a7c) | |
| nt!NtQueryBootOptions (fffff801`9d6f7d78) | |
| fffff801`ad104d54 | |
| nt!NtQueryDirectoryObject (fffff801`9d4d41a0) | |
| nt!NtQueryDriverEntryOrder (fffff801`9d6f8104) | |
| nt!NtQueryEaFile (fffff801`9d4eca2c) | |
| nt!NtQueryFullAttributesFile (fffff801`9d4d5ea0) | |
| nt!NtQueryInformationAtom (fffff801`9d45f604) | |
| fffff801`ad0170b8 | |
| nt!NtQueryInformationJobObject (fffff801`9d4b1020) | |
| nt!NtQueryInformationPort (fffff801`9d699e88) | |
| fffff801`ad0170c0 | |
| nt!NtQueryInformationSiloObject (fffff801`9d4f8b94) | |
| fffff801`ad0170c8 | |
| fffff801`ad0170d0 | |
| fffff801`ad2612dc | |
| nt!NtQueryInstallUILanguage (fffff801`9d4fcc04) | |
| nt!NtQueryIntervalProfile (fffff801`9d51df2c) | |
| nt!NtQueryIoCompletion (fffff801`9d54c320) | |
| nt!NtQueryLicenseValue (fffff801`9d4d034c) | |
| nt!NtQueryMultipleValueKey (fffff801`9d4f2370) | |
| nt!NtQueryMutant (fffff801`9d405f74) | |
| nt!NtQueryOpenSubKeys (fffff801`9d6523dc) | |
| nt!NtQueryOpenSubKeysEx (fffff801`9d652624) | |
| nt!NtQueryPortInformationProcess (fffff801`9d6c30e0) | |
| nt!NtQueryQuotaInformationFile (fffff801`9d6766d0) | |
| nt!NtQuerySecurityAttributesToken (fffff801`9d435500) | |
| nt!NtQuerySecurityObject (fffff801`9d4102b0) | |
| nt!NtQuerySemaphore (fffff801`9d4065ec) | |
| nt!NtQuerySymbolicLinkObject (fffff801`9d490e90) | |
| nt!NtQuerySystemEnvironmentValue (fffff801`9d6f8558) | |
| nt!NtQuerySystemEnvironmentValueEx (fffff801`9d59adf0) | |
| nt!NtQuerySystemInformationEx (fffff801`9d4f0ba4) | |
| nt!NtQueryTimerResolution (fffff801`9d4fe664) | |
| nt!NtQueryWnfStateData (fffff801`9d46debc) | |
| nt!NtQueryWnfStateNameInformation (fffff801`9d46c590) | |
| nt!NtQueueApcThreadEx (fffff801`9d468048) | |
| fffff801`ad14cca0 | |
| nt!NtRaiseHardError (fffff801`9d6fa5f0) | |
| fffff801`ad0170d8 | |
| fffff801`ad0170e0 | |
| fffff801`ad0170e8 | |
| fffff801`ad0170f0 | |
| fffff801`ad017238 | |
| nt!NtRegisterThreadTerminatePort (fffff801`9d547620) | |
| nt!NtReleaseKeyedEvent (fffff801`9d4fb9c0) | |
| fffff801`ad057f90 | |
| nt!NtRemoveIoCompletionEx (fffff801`9d4f7eb4) | |
| nt!NtRemoveProcessDebug (fffff801`9d668ac8) | |
| nt!NtRenameKey (fffff801`9d652ac0) | |
| fffff801`ad017240 | |
| nt!NtReplaceKey (fffff801`9d6530b8) | |
| fffff801`ad26ed80 | |
| nt!NtReplyWaitReplyPort (fffff801`9d699fc8) | |
| nt!NtRequestPort (fffff801`9d4f0f20) | |
| nt!NtResetEvent (fffff801`9d4efda8) | |
| fffff801`ad095a20 | |
| nt!NtRestoreKey (fffff801`9d653588) | |
| nt!NtResumeProcess (fffff801`9d6c6ea0) | |
| fffff801`ad0fc8f4 | |
| fffff801`ad0170f8 | |
| fffff801`ad017100 | |
| fffff801`ad017108 | |
| fffff801`ad017248 | |
| nt!NtSaveKey (fffff801`9d6539fc) | |
| nt!NtSaveKeyEx (fffff801`9d653dd0) | |
| nt!NtSaveMergedKeys (fffff801`9d65420c) | |
| nt!NtSecureConnectPort (fffff801`9d4e3c24) | |
| nt!NtSerializeBoot (fffff801`9d59c024) | |
| nt!NtSetBootEntryOrder (fffff801`9d6f8928) | |
| nt!NtSetBootOptions (fffff801`9d6f8bb4) | |
| nt!NtSetCachedSigningLevel (fffff801`9d5520a4) | |
| nt!NtSetContextThread (fffff801`9d6c4bbc) | |
| nt!NtSetDebugFilterState (fffff801`9d58380c) | |
| nt!NtSetDefaultHardErrorPort (fffff801`9d57423c) | |
| nt!NtSetDefaultLocale (fffff801`9d586d4c) | |
| nt!NtSetDefaultUILanguage (fffff801`9d586d38) | |
| nt!NtSetDriverEntryOrder (fffff801`9d6f8e48) | |
| nt!NtSetEaFile (fffff801`9d675f24) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| fffff801`ad2601e4 | |
| nt!NtSetInformationDebugObject (fffff801`9d668c10) | |
| fffff801`ad017110 | |
| nt!NtSetInformationJobObject (fffff801`9d4b3ca8) | |
| nt!NtSetInformationKey (fffff801`9d493890) | |
| fffff801`ad017118 | |
| nt!NtSetInformationSiloObject (fffff801`9d6c0cd4) | |
| nt!NtSetInformationToken (fffff801`9d45b93c) | |
| fffff801`ad017120 | |
| fffff801`ad017250 | |
| nt!NtSetInformationVirtualMemory (fffff801`9d446714) | |
| fffff801`ad100ce0 | |
| nt!NtSetIntervalProfile (fffff801`9d51e330) | |
| nt!NtSetIoCompletion (fffff801`9d445e68) | |
| nt!NtSetIoCompletionEx (fffff801`9d675074) | |
| fffff801`ad138434 | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtSetQuotaInformationFile (fffff801`9d676fac) | |
| nt!NtSetSecurityObject (fffff801`9d40d688) | |
| nt!NtSetSystemEnvironmentValue (fffff801`9d6f90d4) | |
| nt!NtSetSystemEnvironmentValueEx (fffff801`9d6f94a0) | |
| nt!NtSetSystemInformation (fffff801`9d4ca44c) | |
| nt!NtSetSystemPowerState (fffff801`9d400bb8) | |
| nt!NtSetSystemTime (fffff801`9d6efe84) | |
| nt!NtSetThreadExecutionState (fffff801`9d54497c) | |
| fffff801`ad026aa8 | |
| fffff801`ad0ace90 | |
| nt!NtSetTimerResolution (fffff801`9d519ae4) | |
| nt!NtSetUuidSeed (fffff801`9d593a84) | |
| nt!NtSetVolumeInformationFile (fffff801`9d51b718) | |
| nt!NtSetWnfProcessNotificationEvent (fffff801`9d46a19c) | |
| nt!NtShutdownSystem (fffff801`9d6f2074) | |
| fffff801`ad0f4e2c | |
| fffff801`ad21e158 | |
| fffff801`ad017258 | |
| nt!NtStartProfile (fffff801`9d6fc790) | |
| nt!NtStopProfile (fffff801`9d6fc9f4) | |
| nt!NtSubscribeWnfStateChange (fffff801`9d46eb04) | |
| nt!NtSuspendProcess (fffff801`9d4067f0) | |
| nt!NtSuspendThread (fffff801`9d53f0cc) | |
| nt!NtSystemDebugControl (fffff801`9d6fe160) | |
| nt!NtTerminateJobObject (fffff801`9d4b0e78) | |
| nt!NtTerminateSiloObject (fffff801`9d6c0e38) | |
| nt!NtTestAlert (fffff801`9d4484a4) | |
| fffff801`ad1c77c0 | |
| fffff801`ad017128 | |
| nt!NtTraceControl (fffff801`9d4408b0) | |
| nt!NtTranslateFilePath (fffff801`9d6f970c) | |
| nt!NtUmsThreadYield (fffff801`9d695ddc) | |
| nt!NtUnloadDriver (fffff801`9d67a458) | |
| nt!NtUnloadKey (fffff801`9d591f50) | |
| nt!NtUnloadKey2 (fffff801`9d591f58) | |
| nt!NtUnloadKeyEx (fffff801`9d4d83b4) | |
| nt!NtUnlockFile (fffff801`9d4e7954) | |
| fffff801`ad094410 | |
| nt!NtUnmapViewOfSectionEx (fffff801`9d44fc10) | |
| nt!NtUnsubscribeWnfStateChange (fffff801`9d46d47c) | |
| nt!NtUpdateWnfStateData (fffff801`9d46f02c) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtWaitForAlertByThreadId (fffff801`9d4d5944) | |
| nt!NtWaitForDebugEvent (fffff801`9d668e08) | |
| nt!NtWaitForKeyedEvent (fffff801`9d4fbb94) | |
| fffff801`ad061ad0 | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) | |
| nt!NtAdjustTokenClaimsAndDeviceGroups (fffff801`9d5a1d08) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
シンボル入れないものは何をやってもだめ