571 lines
12 KiB
Plaintext
571 lines
12 KiB
Plaintext
KiIdleLoop
|
||
MmZeroPageThread
|
||
KiSwapThread
|
||
ExReleaseResourceLite
|
||
ExAcquireResourceExclusiveLite
|
||
ExInterlockedPopEntrySList
|
||
ExAllocatePoolWithTag
|
||
IopParseDevice
|
||
KeWaitForSingleObject
|
||
ExFreePoolWithTag
|
||
IofCompleteRequest
|
||
KiDispatchInterrupt
|
||
CcMapData
|
||
Exfi386InterlockedDecrementLong
|
||
ExInterlockedPushEntrySList
|
||
KefAcquireSpinLockAtDpcLevel
|
||
InterlockedDecrement
|
||
IoAllocateIrp
|
||
memmove
|
||
ExfInterlockedAddUlong
|
||
CcGetVirtualAddress
|
||
CcFastCopyRead
|
||
RtlFindClearBits
|
||
ExfInterlockedPushEntryList
|
||
ExAcquireResourceSharedLite
|
||
RtlSplay
|
||
CcPinFileData
|
||
KeRemoveQueue
|
||
MmCopyToCachedPage
|
||
ObpCaptureObjectCreateInformation
|
||
CcFindBcb
|
||
IopAllocateIrp
|
||
RtlCompareMemory
|
||
CcFastCopyWrite
|
||
KeSynchronizeExecution
|
||
FsRtlDissectName
|
||
ObReferenceObjectByHandle
|
||
FsRtlIsNameInExpressionPrivate
|
||
MiZeroPhysicalPage
|
||
InterlockedIncrement
|
||
PsImpersonateClient
|
||
RtlCompareUnicodeString
|
||
RtlUpcaseUnicodeToOemN
|
||
IoGetRelatedDeviceObject
|
||
ObOpenObjectByName
|
||
MiFlushSectionInternal
|
||
ExpFindCurrentThread
|
||
IoFreeIrp
|
||
RtlTimeToTimeFields
|
||
CcSetDirtyPinnedData
|
||
FsRtlLookupLargeMcbEntry
|
||
ObfDereferenceObject
|
||
CcCanIWrite
|
||
CcFreeVirtualAddress
|
||
IopDeleteFile
|
||
SeCreateAccessState
|
||
KefReleaseSpinLockFromDpcLevel
|
||
CcMapAndCopy
|
||
ExInterlockedCompareExchange64
|
||
RtlCopyUnicodeString
|
||
ExAcquireHandleTableShared
|
||
KeInsertQueueDpc
|
||
MmProbeAndLockPages
|
||
ObpLookupObjectName
|
||
CcMapAndRead
|
||
IopCompleteRequest
|
||
MiRemovePageByColor
|
||
KeFlushSingleTb
|
||
IoCreateFile
|
||
CcUnpinFileData
|
||
ObpCaptureObjectName
|
||
KeInsertQueue
|
||
MmCheckCachedPageState
|
||
CcInitializeCacheMap
|
||
ExInterlockedAddLargeStatistic
|
||
RtlEqualUnicodeString
|
||
ObpAllocateObject
|
||
FsRtlIsFatDbcsLegal
|
||
CcFlushCache
|
||
ExAcquireFastMutexUnsafe
|
||
RtlFillMemoryUlong
|
||
IopCheckDeviceAndDriver
|
||
MmSetAddressRangeModified
|
||
CcPinMappedData
|
||
KeLeaveCriticalRegion
|
||
CcUninitializeCacheMap
|
||
MiCleanSection
|
||
MmUnmapViewInSystemCache
|
||
CcPrepareMdlWrite
|
||
PsReferenceImpersonationToken
|
||
MiInsertPageInList
|
||
CcWriteBehind
|
||
ExAllocatePool
|
||
FsRtlFindLargeIndex
|
||
IoFastQueryNetworkAttributes
|
||
CcSetDirtyInMask
|
||
KeSetEventBoostPriority
|
||
IofCallDriver
|
||
RtlpCaptureContext
|
||
ObpAllocateObjectNameBuffer
|
||
CcLazyWriteScan
|
||
MiLocateAndReserveWsle
|
||
RtlIsNameLegalDOS8Dot3
|
||
ExCreateHandle
|
||
ExFreePool
|
||
ElapsedDaysToYears
|
||
ObpIncrementHandleCount
|
||
FsRtlAddToTunnelCache
|
||
IoFreeController
|
||
CcAcquireByteRangeForWrite
|
||
FsRtlCheckOplock
|
||
CcPreparePinWrite
|
||
IoAllocateMdl
|
||
KiSetCR0Bits
|
||
ObReferenceObjectByPointer
|
||
CcMdlRead
|
||
ExQueueWorkItem
|
||
IopCloseFile
|
||
FsRtlFindInTunnelCache
|
||
ObCreateObject
|
||
PsReferencePrimaryToken
|
||
CcAllocateInitializeBcb
|
||
ExTryToAcquireResourceExclusiveLite
|
||
ExReleaseHandleTableShared
|
||
RtlExtendedMagicDivide
|
||
CcPinRead
|
||
Exfi386InterlockedExchangeUlong
|
||
CcCopyRead
|
||
NtSetInformationFile
|
||
ObpFreeObjectNameBuffer
|
||
ExInterlockedExchangeAddLargeInteger
|
||
NtClose
|
||
KeEnterCriticalRegion
|
||
MiDecrementShareCount2
|
||
ExReleaseHandleTableExclusive
|
||
ObpCreateHandle
|
||
KiDeliverApc
|
||
IopCompletePageWrite
|
||
RtlUpcaseUnicodeChar
|
||
KeQuerySystemTime
|
||
CcGetFileObjectFromBcb
|
||
RtlNtStatusToDosErrorNoTeb
|
||
ExIsResourceAcquiredExclusiveLite
|
||
IopParseFile
|
||
MiWaitForInPageComplete
|
||
_NLG_Return2
|
||
CcGetVirtualAddressIfMapped
|
||
MiCheckProtoPtePageState
|
||
MmCreateSection
|
||
MiLocateWsle
|
||
MmUnlockPages
|
||
KiInterruptDispatch
|
||
RtlUnicodeToOemN
|
||
IoGetRequestorProcess
|
||
MiReserveSystemPtes
|
||
IoBuildSynchronousFsdRequest
|
||
MiReleaseSystemPtes
|
||
ObpDecrementHandleCount
|
||
ObpFreeObject
|
||
CcSetFileSizes
|
||
FsRtlDoesNameContainWildCards
|
||
FsRtlOplockFsctrl
|
||
IoSetThreadHardErrorMode
|
||
MiDecrementReferenceCount
|
||
CcUnpinData
|
||
ExAcquireSharedStarveExclusive
|
||
CcWorkerThread
|
||
IoFreeMdl
|
||
ExAllocateFromPagedLookasideList
|
||
MiAllocatePoolPages
|
||
MmMapViewInSystemCache
|
||
RtlMapGenericMask
|
||
ExInitializeResourceLite
|
||
FsRtlOplockCleanup
|
||
MiFreePoolPages
|
||
ExAcquireHandleTableExclusive
|
||
PsAssignImpersonationToken
|
||
MmAccessFault
|
||
SeDeleteAccessState
|
||
IoCheckFunctionAccess
|
||
MmPurgeSection
|
||
RtlInsertElementGenericTable
|
||
ExpAcquireResourceExclusiveLite
|
||
ExGetSharedWaiterCount
|
||
IopCheckBackupRestorePrivilege
|
||
MiUpdateWsle
|
||
MmMapLockedPages
|
||
ExpWaitForResource
|
||
FsRtlOplockBreakToII
|
||
MiCreateDataFileMap
|
||
MmFlushSection
|
||
SeAssignSecurity
|
||
IoAllocateErrorLogEntry
|
||
KeReadStateQueue
|
||
IoBuildPartialMdl
|
||
_abnormal_termination
|
||
CcMdlWriteComplete2
|
||
ExDestroyHandle
|
||
FsRtlRemoveMcbEntryPrivate
|
||
KeFlushMultipleTb
|
||
KeSetEvent
|
||
KiRetireDpcList
|
||
KiTrap0E
|
||
ObpRemoveObjectRoutine
|
||
FsRtlGetNextLargeMcbEntry
|
||
IopErrorLogRequeueEntry
|
||
SeCaptureSubjectContext
|
||
IoCancelIrp
|
||
IopDereferenceVpbAndFree
|
||
FsRtlFastCheckLockForRead
|
||
FsRtlRequestExclusiveOplock
|
||
ExFreeToPagedLookasideList
|
||
IoIsOperationSynchronous
|
||
MiRemoveMappedPtes
|
||
RtlUpcaseUnicodeString
|
||
SepFilterPrivilegeAudits
|
||
DebugService
|
||
KeSetTimer
|
||
RtlCompressChunks
|
||
RtlpDidUnicodeToOemWork
|
||
RtlUpcaseUnicodeStringToOemString
|
||
SeSetAccessStateGenericMapping
|
||
SeTokenType
|
||
CcFreeActiveVacb
|
||
ExfInterlockedInsertTailList
|
||
ExMapHandleToPointer
|
||
KeGetCurrentPrcb
|
||
MiUnlinkPageFromList
|
||
RtlOemStringToUnicodeString
|
||
ExReleaseFastMutexUnsafe
|
||
FsRtlTruncateLargeMcb
|
||
KeWaitForMultipleObjects
|
||
RtlUnicodeStringToOemString
|
||
CcDeleteSharedCacheMap
|
||
CcGetVacbMiss
|
||
IopReportResourceUsage
|
||
KiAcquireSpinLock
|
||
RtlAreAnyAccessesGranted
|
||
SeUnlockSubjectContext
|
||
CcGetDirtyPages
|
||
IoSetShareAccess
|
||
MiRemoveAnyPage
|
||
ExSystemTimeToLocalTime
|
||
FsRtlAreNamesEqual
|
||
ObGetObjectPointerCount
|
||
ObpIncrementUnnamedHandleCount
|
||
ObWaitForSingleObject
|
||
RtlOemToUnicodeN
|
||
RtlUpcaseUnicodeStringToCountedOemString
|
||
CcUnpinRepinnedBcb
|
||
FsRtlIsNameInExpression
|
||
KiTimerListExpire
|
||
ObSetSecurityDescriptorInfo
|
||
FsRtlFastCheckLockForWrite
|
||
KeResetEvent
|
||
MiSetDirtyBit
|
||
PsChargeSharedPoolQuota
|
||
PsOpenTokenOfProcess
|
||
RtlTimeToSecondsSince1970
|
||
ExDeleteResourceLite
|
||
FsRtlRemoveLargeMcbEntry
|
||
IoSynchronousPageWrite
|
||
MiDispatchFault
|
||
MmIsAddressValid
|
||
IopIsDeviceInstanceEnabled
|
||
KeInitializeDpc
|
||
PsReturnSharedPoolQuota
|
||
RtlExtendedLargeIntegerDivide
|
||
RtlpGetStackLimits
|
||
SeComputeQuotaInformationSize
|
||
SeValidSecurityDescriptor
|
||
ExpWorkerThread
|
||
FsRtlAddLargeMcbEntry
|
||
ObpDeleteNameCheck
|
||
ExDisableResourceBoostLite
|
||
FsRtlPruneTunnelCache
|
||
FsRtlRemoveAndCompleteWaitIrp
|
||
MiGetInPageSupportBlock
|
||
MiRemoveZeroPage
|
||
PspDeleteThreadSecurity
|
||
RtlpGenerateInheritedAce
|
||
VdmpDelayIntApcRoutine
|
||
CcPerformReadAhead
|
||
CcPostWorkQueue
|
||
ExReinitializeResourceLite
|
||
FsRtlUninitializeOplock
|
||
IoSetTopLevelIrp
|
||
MiCheckControlArea
|
||
MmUnmapLockedPages
|
||
SepGetDefaultsSubjectContext
|
||
ExNotifyCallback
|
||
FsRtlOplockIsFastIoPossible
|
||
FsRtlPrivateFastUnlockAll
|
||
FsRtlWaitOnIrp
|
||
IoGetTopLevelIrp
|
||
IoInitializeIrp
|
||
IoPageRead
|
||
IoStartPacket
|
||
MiGetEventCounter
|
||
MiInitializePfn
|
||
ObpChargeQuotaForObject
|
||
RtlDelete
|
||
SeAuditingFileEvents
|
||
SeFastTraverseCheck
|
||
FsRtlAcknowledgeOplockBreak
|
||
FsRtlPrivateLimitFreeLockList
|
||
IoCheckShareAccess
|
||
IoCreateStreamFileObject
|
||
MiReleaseWsle
|
||
MiRemoveWsle
|
||
MiResolveMappedFileFault
|
||
ObDereferenceObject
|
||
SeTokenImpersonationLevel
|
||
CcReleaseByteRangeFromWrite
|
||
FsRtlAcquireFileForCcFlush
|
||
FsRtlCurrentBatchOplock
|
||
FsRtlInitializeLargeMcb
|
||
FsRtlPrivateLock
|
||
IoBuildDeviceIoControlRequest
|
||
KeInsertByKeyDeviceQueue
|
||
MiEnsureAvailablePageOrWait
|
||
MiInsertFrontModifiedNoWrite
|
||
PsWatchWorkingSet
|
||
RawCheckForDismount
|
||
RtlDeleteElementGenericTable
|
||
RtlSetBits
|
||
SeReleaseSubjectContext
|
||
CcCopyWrite
|
||
FsRtlFindFirstOverlappingExclusiveNode
|
||
IoStartNextPacket
|
||
KeInitializeSpinLock
|
||
KeSetTimerEx
|
||
NtQueryVolumeInformationFile
|
||
ObpLookupDirectoryEntry
|
||
RtlxOemStringToUnicodeSize
|
||
_allmul
|
||
CcScheduleReadAhead
|
||
CcUnmapVacbArray
|
||
FsRtlUninitializeLargeMcb
|
||
IoCheckDesiredAccess
|
||
KeInitializeEventPair
|
||
MiMakeSystemAddressValidPfnWs
|
||
MiRemoveUnusedSegments
|
||
MiSegmentDelete
|
||
RtlNumberOfSetBits
|
||
RtlpLengthInheritedAce
|
||
RtlUnicodeStringToCountedOemString
|
||
_wcsicmp
|
||
ExEnumHandleTable
|
||
FsRtlLookupLastLargeMcbEntry
|
||
IoRemoveShareAccess
|
||
KeReleaseSemaphore
|
||
MiInitializeReadInProgressPfn
|
||
MiRemovePageFromList
|
||
MiResolveProtoPteFault
|
||
ObpIncrementHandleDataBase
|
||
SwapSplayLinks
|
||
CcDeallocateBcb
|
||
FsRtlPrivateResetLowestLockOffset
|
||
IopCheckVpbMounted
|
||
KeInsertDeviceQueue
|
||
KeRemoveDeviceQueue
|
||
MiAddValidPageToWorkingSet
|
||
MiCheckForControlAreaDeletion
|
||
MiCompleteProtoPteFault
|
||
MiRestoreTransitionPte
|
||
NtWaitForSingleObject
|
||
xHalGetConventionalCylinders
|
||
CcSetValidData
|
||
ExAcquireSharedWaitForExclusive
|
||
ExIsResourceAcquiredSharedLite
|
||
FsRtlAllocateOplock
|
||
FsRtlCheckNoExclusiveConflict
|
||
FsRtlDeregisterUncProvider
|
||
IopQueryName
|
||
IoRegisterShutdownNotification
|
||
LpcpClosePort
|
||
MiCheckControlAreaStatus
|
||
RtlAreBitsClear
|
||
RtlCreateSecurityDescriptor
|
||
SepAccessCheck
|
||
SepInheritAcl
|
||
DaysAndFractionToTime
|
||
FsRtlFastUnlockSingle
|
||
FsRtlFastUnlockSingleExclusive
|
||
FsRtlReleaseFileForCcFlush
|
||
IoCancelThreadIo
|
||
KeInsertHeadQueue
|
||
KeRemoveByKeyDeviceQueue
|
||
KeTryToAcquireSpinLock
|
||
KiReleaseSpinLock
|
||
RtlpLengthInheritAcl
|
||
SeLockSubjectContext
|
||
SepSidInToken
|
||
CcMdlReadComplete
|
||
CcMdlReadComplete2
|
||
FsRtlCheckLockForReadAccess
|
||
FsRtlPrivateInsertLock
|
||
IoAcquireCancelSpinLock
|
||
IopOpenLinkOrRenameTarget
|
||
KeFlushQueueApc
|
||
KeInitializeApc
|
||
MiInitializeCopyOnWritePfn
|
||
MiMakeProtectionMask
|
||
MiMakeSystemAddressValidPfn
|
||
MiResolveDemandZeroFault
|
||
MiSectionDelete
|
||
MmCreateMdl
|
||
ObpCreateUnnamedHandle
|
||
ObReferenceObjectByName
|
||
RtlSubtreePredecessor
|
||
SepCheckAcl
|
||
CcGetLsnForFileObject
|
||
CcMdlWriteComplete
|
||
ExAllocatePoolWithQuotaTag
|
||
FsRtlCheckLockForWriteAccess
|
||
FsRtlNumberOfRunsInLargeMcb
|
||
FsRtlOplockBreakNotify
|
||
FsRtlPrivateCheckForExclusiveLockAccess
|
||
FsRtlPrivateRemoveLock
|
||
FsRtlReleaseFileForModWrite
|
||
IoAllocateAdapterChannel
|
||
IoGetCurrentProcess
|
||
IoQueueThreadIrp
|
||
IoRaiseInformationalHardError
|
||
IoStartNextPacketByKey
|
||
KeInitializeDeviceQueue
|
||
KeInsertQueueApc
|
||
KiQuantumEnd
|
||
KiSystemService
|
||
MiChargeCommitmentCantExpand
|
||
MiCheckPdeForPagedPool
|
||
MiDetermineUserGlobalPteMask
|
||
MiRemoveWsleFromFreeList
|
||
MiResolveTransitionFault
|
||
MiVerifyImageHeader
|
||
MmCanFileBeTruncatedInternal
|
||
NtDeleteFile
|
||
ObDeleteCapturedInsertInfo
|
||
ObInsertObject
|
||
RtlAllocateAndInitializeSid
|
||
RtlDeleteNoSplay
|
||
RtlEqualPrefixSid
|
||
RtlInitializeSid
|
||
RtlLookupElementGenericTable
|
||
RtlUpcaseUnicodeToMultiByteN
|
||
CcCreateVacbArray
|
||
FsRtlAllocateFirstMapping
|
||
FsRtlCancelExclusiveIrp
|
||
FsRtlPrivateCheckWaitingLocks
|
||
FsRtlPrivateInitializeFileLock
|
||
Ke386GetGdtEntryThread
|
||
KeInitializeEvent
|
||
KiExceptionExit
|
||
MiAccessCheck
|
||
MiBuildKernelMap
|
||
MiDeleteSystemPagableVm
|
||
MiFindActualFaultingPte
|
||
MiFreeInPageSupportBlock
|
||
MiGetSystemCacheSubsection
|
||
MiInsertWsle
|
||
MiMapPageToZeroInHyperSpace
|
||
MiReleasePageFileSpace
|
||
MiReserveSystemPtes2
|
||
MmBuildMdlForNonPagedPool
|
||
ObpValidateAccessMask
|
||
RtlClearBits
|
||
RtlConvertUlongToLargeInteger
|
||
RtlEnumerateGenericTable
|
||
RtlFirstFreeAce
|
||
RtlIsGenericTableEmpty
|
||
RtlLargeIntegerDivide
|
||
RtlLengthSecurityDescriptor
|
||
CcAllocateObcb
|
||
CcUnpinDataForThread
|
||
ExCreateHandleTable
|
||
ExecuteHandler
|
||
ExReleaseResourceForThreadLite
|
||
FsRtlCheckForMatchingFileObject
|
||
FsRtlDeleteTunnelCache
|
||
FsRtlInitializeFileLock
|
||
FsRtlMdlReadComplete
|
||
FsRtlMdlWriteCompleteDev
|
||
FsRtlPrivateCancelFileLockIrp
|
||
FsRtlPrivateInsertExclusiveLock
|
||
FsRtlSplitLargeMcb
|
||
FsRtlSyncVolumes
|
||
FsRtlUninitializeFileLock
|
||
IoGetFileObjectGenericMapping
|
||
IopSynchronousApiServiceTail
|
||
KeBoostCurrentThread
|
||
KeContextToKframes
|
||
KeReadStateSemaphore
|
||
KiContinue
|
||
MiFlushEventCounter
|
||
MiInitializeTransitionPfn
|
||
MiMapPageInHyperSpace
|
||
MiRemovePageFromWorkingSet
|
||
MmCanFileBeTruncated
|
||
MmGetFileNameForSection
|
||
RtlAreBitsSet
|
||
RtlFindClearBitsAndSet
|
||
RtlFindFirstRunSet
|
||
RtlFindSetBits
|
||
RtlInitializeBitMap
|
||
RtlSetAllBits
|
||
SeAccessCheck
|
||
CcExtendVacbArray
|
||
CcPurgeCacheSection
|
||
CcUnmapVacb
|
||
ExAllocatePoolWithQuota
|
||
ExLocalTimeToSystemTime
|
||
ExpAllocateHandleTableEntries
|
||
FsRtlAddLargeEntry
|
||
FsRtlFastUnlockAll
|
||
FsRtlFastUnlockSingleShared
|
||
FsRtlMdlReadCompleteDev
|
||
FsRtlPrivateInsertSharedLock
|
||
FsRtlRemoveAndCompleteIrp
|
||
IoAcquireVpbSpinLock
|
||
IopMountVolume
|
||
IopSynchronousServiceTail
|
||
IopTimerDispatch
|
||
IoUpdateShareAccess
|
||
KeFlushEntireTb
|
||
KeInitializeThread
|
||
KeSetKernelStackSwapEnable
|
||
KiComputeWaitInterval
|
||
KiEspToTrapFrame
|
||
KiScanReadyQueues
|
||
KiServiceExit2
|
||
KiTimerExpiration
|
||
KiUnwaitThread
|
||
main
|
||
MiAddMappedPtes
|
||
MiChargeCommitment
|
||
MiDeleteFreeVm
|
||
MiFindEmptyAddressRangeDownTree
|
||
MiFlushInPageSupportBlock
|
||
MiFlushPteList
|
||
MiLocateSubsection
|
||
MiReturnCommitment
|
||
MiUnlockPagedAddress
|
||
MiUnmapImageHeaderInHyperSpace
|
||
MiUpForkPageShareCount
|
||
MmFlushImageSection
|
||
MmGetPhysicalAddress
|
||
MmOutSwapProcess
|
||
MmUnlockCachedPage
|
||
MmWorkingSetManager
|
||
NtCancelIoFile
|
||
NtProtectVirtualMemory
|
||
NtStartProfile
|
||
ObpInsertHandleCount
|
||
PspSystemThreadStartup
|
||
RtlCreateAcl
|
||
RtlEqualSid
|
||
RtlExtendedIntegerMultiply
|
||
RtlInitUnicodeString
|
||
RtlOemStringToCountedUnicodeString
|
||
RtlSecondsSince1970ToTime
|
||
RtlSubAuthoritySid
|
||
RtlUnwind
|
||
RtlUpcaseUnicodeStringToAnsiString
|
||
RtlValidSecurityDescriptor
|
||
SeDeassignSecurity
|
||
SeFreeCapturedSecurityQos
|
||
SeFreePrivileges
|
||
SeQueryAuthenticationIdToken
|
||
|
||
|