ntoskrnl.exe.10.0.22621.2361-ntoskrnl.exe.10.0.22621.2428 Diff
flowchart LR
VrpPostOpenOrCreate-0-old<--Match 78%-->VrpPostOpenOrCreate-0-new
VrpAddNamespaceNodeToList-0-old<--Match 94%-->VrpAddNamespaceNodeToList-0-new
VrpPreOpenOrCreate-0-old<--Match 40%-->VrpPreOpenOrCreate-0-new
VrpHandleIoctlInitializeJobForVreg-6-old<--Match 66%-->VrpHandleIoctlInitializeJobForVreg-6-new
KiIpiProcessRequests-0-old<--Match 96%-->KiIpiProcessRequests-0-new
NtSetInformationWorkerFactory-0-old<--Match 98%-->NtSetInformationWorkerFactory-0-new
VrpBuildKeyPath-0-old<--Match 87%-->VrpBuildKeyPath-0-new
WbCreateHeapExecutedBlockfilt0-0-old<--Match 93%-->WbCreateHeapExecutedBlockfilt0-0-new
CmSetValueKey-7-old<--Match 37%-->CmSetValueKey-7-new
WbCreateHeapExecutedBlock-0-old<--Match 60%-->FUN_14070897c-0-new
subgraph ntoskrnl.exe.10.0.22621.2428
VrpPostOpenOrCreate-0-new
VrpAddNamespaceNodeToList-0-new
VrpPreOpenOrCreate-0-new
VrpHandleIoctlInitializeJobForVreg-6-new
KiIpiProcessRequests-0-new
NtSetInformationWorkerFactory-0-new
VrpBuildKeyPath-0-new
WbCreateHeapExecutedBlockfilt0-0-new
CmSetValueKey-7-new
FUN_14070897c-0-new
subgraph Added
direction LR
Feature_4256151870__private_IsEnabled
Feature_1171241279__private_IsEnabled
wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache
wil_details_FeatureReporting_RecordUsageInCache
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_GetCurrentFeatureEnabledState
wil_details_MapReportingKind
wil_RtlStagingConfig_QueryFeatureState
end
end
subgraph ntoskrnl.exe.10.0.22621.2361
VrpPostOpenOrCreate-0-old
VrpAddNamespaceNodeToList-0-old
VrpPreOpenOrCreate-0-old
VrpHandleIoctlInitializeJobForVreg-6-old
KiIpiProcessRequests-0-old
NtSetInformationWorkerFactory-0-old
VrpBuildKeyPath-0-old
WbCreateHeapExecutedBlockfilt0-0-old
CmSetValueKey-7-old
WbCreateHeapExecutedBlock-0-old
end
Loading
pie showData
title Function Matches - 99.9803%
"unmatched_funcs_len" : 12
"matched_funcs_len" : 61040
Loading
pie showData
title Matched Function Similarity - 99.9214%
"matched_funcs_with_code_changes_len" : 10
"matched_funcs_with_non_code_changes_len" : 38
"matched_funcs_no_changes_len" : 60992
Loading
ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --max-ram-percent 60.0 --max-section-funcs 200 ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
--old ['bins/ntoskrnl.exe.10.0.22621.2361'] --new [['bins/ntoskrnl.exe.10.0.22621.2428']] --engine VersionTrackingDiff --output-path ghidriffs --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None
wget https://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/AACD0D1D1047000/ntkrnlmp.exe -O ntkrnlmp.exe.x64.10.0.22621.2361
wget https://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/7D02613E1047000/ntkrnlmp.exe -O ntkrnlmp.exe.x64.10.0.22621.2428
--- ntoskrnl.exe.10.0.22621.2361 Meta
+++ ntoskrnl.exe.10.0.22621.2428 Meta
@@ -1,44 +1,44 @@
- Program Name: ntoskrnl.exe.10.0.22621.2361
+ Program Name: ntoskrnl.exe.10.0.22621.2428
Language ID: x86:LE:64:default (2.14)
Compiler ID: windows
Processor: x86
Endian: Little
Address Size: 64
Minimum Address: 140000000
Maximum Address: ff0000184f
- # of Bytes: 17066100
+ # of Bytes: 17062268
# of Memory Blocks: 42
- # of Instructions: 2426511
- # of Defined Data: 76235
- # of Functions: 30520
- # of Symbols: 246381
- # of Data Types: 6143
+ # of Instructions: 2427380
+ # of Defined Data: 76258
+ # of Functions: 30532
+ # of Symbols: 246511
+ # of Data Types: 6145
# of Data Type Categories: 581
Analyzed: true
Compiler: visualstudio:unknown
Created With Ghidra Version: 10.4
- Date Created: Wed Oct 11 15:20:22 UTC 2023
+ Date Created: Wed Oct 11 15:20:35 UTC 2023
Executable Format: Portable Executable (PE)
- Executable Location: /workspaces/ghidriff/bins/ntoskrnl.exe.10.0.22621.2361
- Executable MD5: d4c09c7f5cfd0974439f84f693dcaa8c
- Executable SHA256: ae09a8d4fcfdc9fdafbdb834e671fef5e037aac5b99799037c0d546985873453
- FSRL: file:///workspaces/ghidriff/bins/ntoskrnl.exe.10.0.22621.2361?MD5=d4c09c7f5cfd0974439f84f693dcaa8c
+ Executable Location: /workspaces/ghidriff/bins/ntoskrnl.exe.10.0.22621.2428
+ Executable MD5: 4deb2ade24b8ebb2088bd76283b48be9
+ Executable SHA256: bf8489d981ea5d73dfb29b883405d68590f2b0b74dc2e9796e35cc1849c56826
+ FSRL: file:///workspaces/ghidriff/bins/ntoskrnl.exe.10.0.22621.2428?MD5=4deb2ade24b8ebb2088bd76283b48be9
PDB Age: 1
PDB File: ntkrnlmp.pdb
- PDB GUID: 70335560-1a9d-b486-aa51-33ed68f97076
+ PDB GUID: cf32de2e-4a33-4c7c-06fb-63fcb6fafb5c
PDB Loaded: true
PDB Version: RSDS
PE Property[CompanyName]: Microsoft Corporation
PE Property[FileDescription]: NT Kernel & System
- PE Property[FileVersion]: 10.0.22621.2361 (WinBuild.160101.0800)
+ PE Property[FileVersion]: 10.0.22621.2428 (WinBuild.160101.0800)
PE Property[InternalName]: ntkrnlmp.exe
PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
PE Property[OriginalFilename]: ntkrnlmp.exe
PE Property[ProductName]: Microsoft® Windows® Operating System
- PE Property[ProductVersion]: 10.0.22621.2361
+ PE Property[ProductVersion]: 10.0.22621.2428
PE Property[Translation]: 4b00409
Preferred Root Namespace Category:
RTTI Found: false
Relocatable: true
SectionAlignment: 4096
Should Ask To Analyze: false
Ghidra ntoskrnl.exe.10.0.22621.2361 Decompiler Options
Decompiler Option
Value
Prototype Evaluation
__fastcall
Ghidra ntoskrnl.exe.10.0.22621.2361 Specification extensions Options
Specification extensions Option
Value
FormatVersion
0
VersionCounter
0
Ghidra ntoskrnl.exe.10.0.22621.2361 Analyzers Options
Analyzers Option
Value
ASCII Strings
true
ASCII Strings.Create Strings Containing Existing Strings
true
ASCII Strings.Create Strings Containing References
true
ASCII Strings.Force Model Reload
false
ASCII Strings.Minimum String Length
LEN_5
ASCII Strings.Model File
StringModel.sng
ASCII Strings.Require Null Termination for String
true
ASCII Strings.Search Only in Accessible Memory Blocks
true
ASCII Strings.String Start Alignment
ALIGN_1
ASCII Strings.String end alignment
4
Aggressive Instruction Finder
false
Aggressive Instruction Finder.Create Analysis Bookmarks
true
Apply Data Archives
true
Apply Data Archives.Archive Chooser
[Auto-Detect]
Apply Data Archives.Create Analysis Bookmarks
true
Apply Data Archives.GDT User File Archive Path
None
Apply Data Archives.User Project Archive Path
None
Call Convention ID
true
Call Convention ID.Analysis Decompiler Timeout (sec)
60
Call-Fixup Installer
true
Condense Filler Bytes
false
Condense Filler Bytes.Filler Value
Auto
Condense Filler Bytes.Minimum number of sequential bytes
1
Create Address Tables
true
Create Address Tables.Allow Offcut References
false
Create Address Tables.Auto Label Table
false
Create Address Tables.Create Analysis Bookmarks
true
Create Address Tables.Maxmimum Pointer Distance
16777215
Create Address Tables.Minimum Pointer Address
4132
Create Address Tables.Minimum Table Size
2
Create Address Tables.Pointer Alignment
1
Create Address Tables.Relocation Table Guide
true
Create Address Tables.Table Alignment
4
Data Reference
true
Data Reference.Address Table Alignment
1
Data Reference.Address Table Minimum Size
2
Data Reference.Align End of Strings
false
Data Reference.Ascii String References
true
Data Reference.Create Address Tables
true
Data Reference.Minimum String Length
5
Data Reference.References to Pointers
true
Data Reference.Relocation Table Guide
true
Data Reference.Respect Execute Flag
true
Data Reference.Subroutine References
true
Data Reference.Switch Table References
false
Data Reference.Unicode String References
true
Decompiler Parameter ID
false
Decompiler Parameter ID.Analysis Clear Level
ANALYSIS
Decompiler Parameter ID.Analysis Decompiler Timeout (sec)
60
Decompiler Parameter ID.Commit Data Types
true
Decompiler Parameter ID.Commit Void Return Values
false
Decompiler Parameter ID.Prototype Evaluation
__fastcall
Decompiler Switch Analysis
true
Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)
60
Demangler Microsoft
true
Demangler Microsoft.Apply Function Calling Conventions
true
Demangler Microsoft.Apply Function Signatures
true
Disassemble Entry Points
true
Disassemble Entry Points.Respect Execute Flag
true
Embedded Media
true
Embedded Media.Create Analysis Bookmarks
true
External Entry References
true
Function ID
true
Function ID.Always Apply FID Labels
false
Function ID.Create Analysis Bookmarks
true
Function ID.Instruction Count Threshold
14.6
Function ID.Multiple Match Threshold
30.0
Function Start Search
true
Function Start Search.Bookmark Functions
false
Function Start Search.Search Data Blocks
false
Non-Returning Functions - Discovered
true
Non-Returning Functions - Discovered.Create Analysis Bookmarks
true
Non-Returning Functions - Discovered.Function Non-return Threshold
3
Non-Returning Functions - Discovered.Repair Flow Damage
true
Non-Returning Functions - Known
true
Non-Returning Functions - Known.Create Analysis Bookmarks
true
PDB MSDIA
false
PDB MSDIA.Search remote symbol servers
false
PDB Universal
true
PDB Universal.Search remote symbol servers
false
Reference
true
Reference.Address Table Alignment
1
Reference.Address Table Minimum Size
2
Reference.Align End of Strings
false
Reference.Ascii String References
true
Reference.Create Address Tables
true
Reference.Minimum String Length
5
Reference.References to Pointers
true
Reference.Relocation Table Guide
true
Reference.Respect Execute Flag
true
Reference.Subroutine References
true
Reference.Switch Table References
false
Reference.Unicode String References
true
Scalar Operand References
true
Scalar Operand References.Relocation Table Guide
true
Shared Return Calls
true
Shared Return Calls.Allow Conditional Jumps
false
Shared Return Calls.Assume Contiguous Functions Only
false
Stack
true
Stack.Create Local Variables
true
Stack.Create Param Variables
true
Stack.useNewFunctionStackAnalysis
true
Subroutine References
true
Subroutine References.Create Thunks Early
true
Variadic Function Signature Override
false
Variadic Function Signature Override.Create Analysis Bookmarks
false
Windows x86 PE Exception Handling
true
Windows x86 PE RTTI Analyzer
true
Windows x86 Thread Environment Block (TEB) Analyzer
true
Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB
Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version
Windows 7
WindowsPE x86 Propagate External Parameters
false
WindowsResourceReference
true
WindowsResourceReference.Create Analysis Bookmarks
true
x86 Constant Reference Analyzer
true
x86 Constant Reference Analyzer.Create Data from pointer
false
x86 Constant Reference Analyzer.Function parameter/return Pointer analysis
true
x86 Constant Reference Analyzer.Max Threads
2
x86 Constant Reference Analyzer.Min absolute reference
4
x86 Constant Reference Analyzer.Require pointer param data type
false
x86 Constant Reference Analyzer.Speculative reference max
512
x86 Constant Reference Analyzer.Speculative reference min
1024
x86 Constant Reference Analyzer.Stored Value Pointer analysis
true
x86 Constant Reference Analyzer.Trust values read from writable memory
true
Ghidra ntoskrnl.exe.10.0.22621.2428 Decompiler Options
Decompiler Option
Value
Prototype Evaluation
__fastcall
Ghidra ntoskrnl.exe.10.0.22621.2428 Specification extensions Options
Specification extensions Option
Value
FormatVersion
0
VersionCounter
0
Ghidra ntoskrnl.exe.10.0.22621.2428 Analyzers Options
Analyzers Option
Value
ASCII Strings
true
ASCII Strings.Create Strings Containing Existing Strings
true
ASCII Strings.Create Strings Containing References
true
ASCII Strings.Force Model Reload
false
ASCII Strings.Minimum String Length
LEN_5
ASCII Strings.Model File
StringModel.sng
ASCII Strings.Require Null Termination for String
true
ASCII Strings.Search Only in Accessible Memory Blocks
true
ASCII Strings.String Start Alignment
ALIGN_1
ASCII Strings.String end alignment
4
Aggressive Instruction Finder
false
Aggressive Instruction Finder.Create Analysis Bookmarks
true
Apply Data Archives
true
Apply Data Archives.Archive Chooser
[Auto-Detect]
Apply Data Archives.Create Analysis Bookmarks
true
Apply Data Archives.GDT User File Archive Path
None
Apply Data Archives.User Project Archive Path
None
Call Convention ID
true
Call Convention ID.Analysis Decompiler Timeout (sec)
60
Call-Fixup Installer
true
Condense Filler Bytes
false
Condense Filler Bytes.Filler Value
Auto
Condense Filler Bytes.Minimum number of sequential bytes
1
Create Address Tables
true
Create Address Tables.Allow Offcut References
false
Create Address Tables.Auto Label Table
false
Create Address Tables.Create Analysis Bookmarks
true
Create Address Tables.Maxmimum Pointer Distance
16777215
Create Address Tables.Minimum Pointer Address
4132
Create Address Tables.Minimum Table Size
2
Create Address Tables.Pointer Alignment
1
Create Address Tables.Relocation Table Guide
true
Create Address Tables.Table Alignment
4
Data Reference
true
Data Reference.Address Table Alignment
1
Data Reference.Address Table Minimum Size
2
Data Reference.Align End of Strings
false
Data Reference.Ascii String References
true
Data Reference.Create Address Tables
true
Data Reference.Minimum String Length
5
Data Reference.References to Pointers
true
Data Reference.Relocation Table Guide
true
Data Reference.Respect Execute Flag
true
Data Reference.Subroutine References
true
Data Reference.Switch Table References
false
Data Reference.Unicode String References
true
Decompiler Parameter ID
false
Decompiler Parameter ID.Analysis Clear Level
ANALYSIS
Decompiler Parameter ID.Analysis Decompiler Timeout (sec)
60
Decompiler Parameter ID.Commit Data Types
true
Decompiler Parameter ID.Commit Void Return Values
false
Decompiler Parameter ID.Prototype Evaluation
__fastcall
Decompiler Switch Analysis
true
Decompiler Switch Analysis.Analysis Decompiler Timeout (sec)
60
Demangler Microsoft
true
Demangler Microsoft.Apply Function Calling Conventions
true
Demangler Microsoft.Apply Function Signatures
true
Disassemble Entry Points
true
Disassemble Entry Points.Respect Execute Flag
true
Embedded Media
true
Embedded Media.Create Analysis Bookmarks
true
External Entry References
true
Function ID
true
Function ID.Always Apply FID Labels
false
Function ID.Create Analysis Bookmarks
true
Function ID.Instruction Count Threshold
14.6
Function ID.Multiple Match Threshold
30.0
Function Start Search
true
Function Start Search.Bookmark Functions
false
Function Start Search.Search Data Blocks
false
Non-Returning Functions - Discovered
true
Non-Returning Functions - Discovered.Create Analysis Bookmarks
true
Non-Returning Functions - Discovered.Function Non-return Threshold
3
Non-Returning Functions - Discovered.Repair Flow Damage
true
Non-Returning Functions - Known
true
Non-Returning Functions - Known.Create Analysis Bookmarks
true
PDB MSDIA
false
PDB MSDIA.Search remote symbol servers
false
PDB Universal
true
PDB Universal.Search remote symbol servers
false
Reference
true
Reference.Address Table Alignment
1
Reference.Address Table Minimum Size
2
Reference.Align End of Strings
false
Reference.Ascii String References
true
Reference.Create Address Tables
true
Reference.Minimum String Length
5
Reference.References to Pointers
true
Reference.Relocation Table Guide
true
Reference.Respect Execute Flag
true
Reference.Subroutine References
true
Reference.Switch Table References
false
Reference.Unicode String References
true
Scalar Operand References
true
Scalar Operand References.Relocation Table Guide
true
Shared Return Calls
true
Shared Return Calls.Allow Conditional Jumps
false
Shared Return Calls.Assume Contiguous Functions Only
false
Stack
true
Stack.Create Local Variables
true
Stack.Create Param Variables
true
Stack.useNewFunctionStackAnalysis
true
Subroutine References
true
Subroutine References.Create Thunks Early
true
Variadic Function Signature Override
false
Variadic Function Signature Override.Create Analysis Bookmarks
false
Windows x86 PE Exception Handling
true
Windows x86 PE RTTI Analyzer
true
Windows x86 Thread Environment Block (TEB) Analyzer
true
Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB
Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version
Windows 7
WindowsPE x86 Propagate External Parameters
false
WindowsResourceReference
true
WindowsResourceReference.Create Analysis Bookmarks
true
x86 Constant Reference Analyzer
true
x86 Constant Reference Analyzer.Create Data from pointer
false
x86 Constant Reference Analyzer.Function parameter/return Pointer analysis
true
x86 Constant Reference Analyzer.Max Threads
2
x86 Constant Reference Analyzer.Min absolute reference
4
x86 Constant Reference Analyzer.Require pointer param data type
false
x86 Constant Reference Analyzer.Speculative reference max
512
x86 Constant Reference Analyzer.Speculative reference min
1024
x86 Constant Reference Analyzer.Stored Value Pointer analysis
true
x86 Constant Reference Analyzer.Trust values read from writable memory
true
Stat
Value
added_funcs_len
12
deleted_funcs_len
0
modified_funcs_len
48
added_symbols_len
17
deleted_symbols_len
12
diff_time
183.8970673084259
deleted_strings_len
1
added_strings_len
0
match_types
Counter({'SymbolsHash': 28075, 'StructuralGraphHash': 696, 'ExactInstructionsFunctionHasher': 146, 'ExactBytesFunctionHasher': 81, 'BulkInstructionHash': 1, 'SigCallingCalledHasher': 1, 'Implied Match': 1})
items_to_process
89
diff_types
Counter({'refcount': 43, 'address': 42, 'calling': 26, 'length': 12, 'code': 10, 'called': 6, 'sig': 4, 'name': 2, 'fullname': 2})
unmatched_funcs_len
12
total_funcs_len
61052
matched_funcs_len
61040
matched_funcs_with_code_changes_len
10
matched_funcs_with_non_code_changes_len
38
matched_funcs_no_changes_len
60992
match_func_similarity_percent
99.9214%
func_match_overall_percent
99.9803%
pie showData
title Match Types
"SymbolsHash" : 28075
"ExactBytesFunctionHasher" : 81
"ExactInstructionsFunctionHasher" : 146
"BulkInstructionHash" : 1
"SigCallingCalledHasher" : 1
"StructuralGraphHash" : 696
"Implied-Match" : 1
Loading
pie showData
title Diff Stats
"added_funcs_len" : 12
"deleted_funcs_len" : 0
"modified_funcs_len" : 48
Loading
pie showData
title Symbols
"added_symbols_len" : 17
"deleted_symbols_len" : 12
Loading
pie showData
title Strings
"deleted_strings_len" : 1
"added_strings_len" : 0
Loading
--- deleted strings
+++ added strings
@@ -1 +0,0 @@
- s_Parameters_%Ix_%Ix_%Ix_%Ix_140a93201
Feature_4256151870__private_IsEnabled
Key
ntoskrnl.exe.10.0.22621.2428
name
Feature_4256151870__private_IsEnabled
fullname
Feature_4256151870__private_IsEnabled
refcount
4
length
102
called
wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureStateCache_GetCachedFeatureEnabledState
calling
CmSetValueKey
paramcount
0
address
14040dce0
sig
undefined Feature_4256151870__private_IsEnabled(void)
sym_type
Function
sym_source
IMPORTED
external
False
--- Feature_4256151870__private_IsEnabled
+++ Feature_4256151870__private_IsEnabled
@@ -0,0 +1,17 @@
+
+ uint Feature_4256151870__private_IsEnabled(void)
+
+ {
+ uint uVar1;
+ uint uVar2;
+
+ uVar1 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+ (&Feature_4256151870__private_featureState,
+ &Feature_4256151870__private_descriptor);
+ uVar2 = uVar1 >> 3 & 1;
+ wil_details_FeatureReporting_ReportUsageToService
+ (&Feature_4256151870__private_reporting,0x2b235e1,uVar1 >> 8 & 1,uVar1 >> 9 & 1,
+ &Feature_Servicing_RevalidateNoUMCI_42288025_logged_traits,uVar2,3);
+ return uVar2;
+ }
+
Feature_1171241279__private_IsEnabled
Key
ntoskrnl.exe.10.0.22621.2428
name
Feature_1171241279__private_IsEnabled
fullname
Feature_1171241279__private_IsEnabled
refcount
6
length
94
called
wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureStateCache_GetCachedFeatureEnabledState
calling
FUN_14070897c
paramcount
0
address
14040dfe8
sig
int __cdecl Feature_1171241279__private_IsEnabled(void)
sym_type
Function
sym_source
ANALYSIS
external
False
--- Feature_1171241279__private_IsEnabled
+++ Feature_1171241279__private_IsEnabled
@@ -0,0 +1,23 @@
+
+ /* int __cdecl Feature_1171241279__private_IsEnabled(void) */
+
+ int __cdecl Feature_1171241279__private_IsEnabled(void)
+
+ {
+ wil_details_FeatureStateCache wVar1;
+ uint uVar2;
+ wil_ReportingKind in_stack_ffffffffffffffe8;
+ __uint64 in_stack_fffffffffffffff0;
+
+ wVar1 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+ ((wil_details_FeatureStateCache *)&Feature_1171241279__private_featureState,
+ (wil_details_FeatureDescriptor *)&Feature_1171241279__private_descriptor);
+ uVar2 = (uint)(wVar1.exchange64 >> 3) & 1;
+ wil_details_FeatureReporting_ReportUsageToService
+ ((wil_details_FeatureReportingCache *)&Feature_1171241279__private_reporting,0x2b22d8f,
+ wVar1.exchange >> 8 & 1,(uint)(wVar1.exchange64 >> 9) & 1,
+ (FEATURE_LOGGED_TRAITS *)&Feature_Servicing_RevalidateNoUMCI_42288025_logged_traits,
+ uVar2,in_stack_ffffffffffffffe8,in_stack_fffffffffffffff0);
+ return uVar2;
+ }
+
wil_details_FeatureReporting_IncrementOpportunityInCache
Key
ntoskrnl.exe.10.0.22621.2428
name
wil_details_FeatureReporting_IncrementOpportunityInCache
fullname
wil_details_FeatureReporting_IncrementOpportunityInCache
refcount
2
length
231
called
calling
wil_details_FeatureReporting_RecordUsageInCache
paramcount
4
address
14066c95c
sig
void __cdecl wil_details_FeatureReporting_IncrementOpportunityInCache(wil_details_FeatureReportingCache * param_1, wil_details_ServiceReportingKind param_2, uint param_3, wil_details_RecordUsageResult * param_4)
sym_type
Function
sym_source
ANALYSIS
external
False
--- wil_details_FeatureReporting_IncrementOpportunityInCache
+++ wil_details_FeatureReporting_IncrementOpportunityInCache
@@ -0,0 +1,62 @@
+
+ /* void __cdecl wil_details_FeatureReporting_IncrementOpportunityInCache(struct
+ wil_details_FeatureReportingCache * __ptr64,enum wil_details_ServiceReportingKind,unsigned
+ int,struct wil_details_RecordUsageResult * __ptr64) */
+
+ void __cdecl
+ wil_details_FeatureReporting_IncrementOpportunityInCache
+ (wil_details_FeatureReportingCache *param_1,wil_details_ServiceReportingKind param_2,
+ uint param_3,wil_details_RecordUsageResult *param_4)
+
+ {
+ uint uVar1;
+ wil_details_ServiceReportingKind wVar2;
+ uint uVar3;
+ uint uVar4;
+ uint uVar5;
+ bool bVar6;
+
+ uVar3 = (param_1->reported).exchange;
+ do {
+ uVar5 = uVar3;
+ param_4->countImmediate = 0;
+ uVar1 = uVar5 | 1;
+ if ((uVar5 & 0x400000) >> 0x16 !=
+ (uint)(param_2 == wil_details_ServiceReportingKind_PotentialUniqueOpportunity)) {
+ uVar3 = (uVar5 & 0x3f8000) >> 0xf;
+ if (uVar3 != 0) {
+ param_4->countImmediate = uVar3;
+ wVar2 = wil_details_ServiceReportingKind_PotentialUniqueOpportunity;
+ if (param_2 != wil_details_ServiceReportingKind_UniqueOpportunity) {
+ wVar2 = wil_details_ServiceReportingKind_UniqueOpportunity;
+ }
+ uVar1 = uVar5 & 0xffc07fff | 1;
+ param_4->kindImmediate = wVar2;
+ }
+ uVar3 = 0;
+ if (param_2 == wil_details_ServiceReportingKind_PotentialUniqueOpportunity) {
+ uVar3 = 0x400000;
+ }
+ uVar1 = uVar3 | uVar1 & 0xffbfffff;
+ }
+ uVar3 = uVar1 >> 0xf & 0x7f;
+ uVar4 = uVar3 + 1;
+ if ((0x7f < uVar4) || (uVar4 < (uVar1 >> 0xf & 0x7f))) {
+ uVar4 = 1;
+ param_4->kindImmediate = param_2;
+ param_4->countImmediate = uVar3;
+ }
+ LOCK();
+ uVar3 = (param_1->reported).exchange;
+ bVar6 = uVar5 == uVar3;
+ if (bVar6) {
+ (param_1->reported).exchange = (uVar4 << 0xf ^ uVar1) & 0x3f8000 ^ uVar1;
+ uVar3 = uVar5;
+ }
+ UNLOCK();
+ } while (!bVar6);
+ param_4->ignoredUse = 0;
+ param_4->queueBackground = ~uVar5 & 1;
+ return;
+ }
+
wil_details_FeatureReporting_IncrementUsageInCache
Key
ntoskrnl.exe.10.0.22621.2428
name
wil_details_FeatureReporting_IncrementUsageInCache
fullname
wil_details_FeatureReporting_IncrementUsageInCache
refcount
2
length
238
called
calling
wil_details_FeatureReporting_RecordUsageInCache
paramcount
4
address
14066ca4c
sig
void __cdecl wil_details_FeatureReporting_IncrementUsageInCache(wil_details_FeatureReportingCache * param_1, wil_details_ServiceReportingKind param_2, uint param_3, wil_details_RecordUsageResult * param_4)
sym_type
Function
sym_source
ANALYSIS
external
False
--- wil_details_FeatureReporting_IncrementUsageInCache
+++ wil_details_FeatureReporting_IncrementUsageInCache
@@ -0,0 +1,58 @@
+
+ /* void __cdecl wil_details_FeatureReporting_IncrementUsageInCache(struct
+ wil_details_FeatureReportingCache * __ptr64,enum wil_details_ServiceReportingKind,unsigned
+ int,struct wil_details_RecordUsageResult * __ptr64) */
+
+ void __cdecl
+ wil_details_FeatureReporting_IncrementUsageInCache
+ (wil_details_FeatureReportingCache *param_1,wil_details_ServiceReportingKind param_2,
+ uint param_3,wil_details_RecordUsageResult *param_4)
+
+ {
+ uint uVar1;
+ uint uVar2;
+ uint uVar3;
+ uint uVar4;
+ bool bVar5;
+
+ uVar4 = (param_1->reported).exchange;
+ do {
+ uVar3 = uVar4;
+ param_4->countImmediate = 0;
+ uVar1 = uVar3 | 1;
+ if ((uVar3 & 0x4000) >> 0xe !=
+ (uint)(param_2 == wil_details_ServiceReportingKind_PotentialUniqueUsage)) {
+ uVar4 = (uVar3 & 0x3fe0) >> 5;
+ if (uVar4 != 0) {
+ param_4->countImmediate = uVar4;
+ param_4->kindImmediate =
+ ~-(uint)(param_2 != wil_details_ServiceReportingKind_UniqueUsage) & 4;
+ uVar1 = uVar3 & 0xffffc01f | 1;
+ }
+ uVar4 = 0;
+ if (param_2 == wil_details_ServiceReportingKind_PotentialUniqueUsage) {
+ uVar4 = 0x4000;
+ }
+ uVar1 = uVar4 | uVar1 & 0xffffbfff;
+ }
+ uVar4 = uVar1 >> 5 & 0x1ff;
+ uVar2 = uVar4 + 1;
+ if ((0x1ff < uVar2) || (uVar2 < (uVar1 >> 5 & 0x1ff))) {
+ uVar2 = 1;
+ param_4->kindImmediate = param_2;
+ param_4->countImmediate = uVar4;
+ }
+ LOCK();
+ uVar4 = (param_1->reported).exchange;
+ bVar5 = uVar3 == uVar4;
+ if (bVar5) {
+ (param_1->reported).exchange = (uVar2 << 5 ^ uVar1) & 0x3fe0 ^ uVar1;
+ uVar4 = uVar3;
+ }
+ UNLOCK();
+ } while (!bVar5);
+ param_4->ignoredUse = 0;
+ param_4->queueBackground = ~uVar3 & 1;
+ return;
+ }
+
wil_details_FeatureReporting_RecordUsageInCache
Key
ntoskrnl.exe.10.0.22621.2428
name
wil_details_FeatureReporting_RecordUsageInCache
fullname
wil_details_FeatureReporting_RecordUsageInCache
refcount
2
length
345
called
wil_details_FeatureReporting_IncrementOpportunityInCache wil_details_FeatureReporting_IncrementUsageInCache
calling
wil_details_FeatureReporting_ReportUsageToServiceDirect
paramcount
5
address
14066cb44
sig
wil_details_RecordUsageResult __cdecl wil_details_FeatureReporting_RecordUsageInCache(wil_details_RecordUsageResult * return_storage_ptr , wil_details_FeatureReportingCache * param_1, wil_details_ServiceReportingKind param_2, uint param_3, uint param_4)
sym_type
Function
sym_source
ANALYSIS
external
False
--- wil_details_FeatureReporting_RecordUsageInCache
+++ wil_details_FeatureReporting_RecordUsageInCache
@@ -0,0 +1,99 @@
+
+ /* struct wil_details_RecordUsageResult __cdecl
+ wil_details_FeatureReporting_RecordUsageInCache(struct wil_details_FeatureReportingCache *
+ __ptr64,enum wil_details_ServiceReportingKind,unsigned int,unsigned int) */
+
+ wil_details_RecordUsageResult * __cdecl
+ wil_details_FeatureReporting_RecordUsageInCache
+ (wil_details_RecordUsageResult *__return_storage_ptr__,
+ wil_details_FeatureReportingCache *param_1,wil_details_ServiceReportingKind param_2,
+ uint param_3,uint param_4)
+
+ {
+ uint uVar1;
+ uint uVar2;
+ uint uVar3;
+ uint uVar4;
+ bool bVar5;
+
+ __return_storage_ptr__->queueBackground = 0;
+ __return_storage_ptr__->countImmediate = 0;
+ __return_storage_ptr__->kindImmediate = 0;
+ __return_storage_ptr__->payloadId = 0;
+ __return_storage_ptr__->ignoredUse = 0;
+ __return_storage_ptr__->isWexpConfiguration = 0;
+ if (param_2 == wil_details_ServiceReportingKind_UniqueUsage) {
+ LAB_14066cc81:
+ wil_details_FeatureReporting_IncrementUsageInCache
+ (param_1,param_2,param_2,__return_storage_ptr__);
+ }
+ else {
+ if (param_2 == wil_details_ServiceReportingKind_UniqueOpportunity) {
+ LAB_14066cc71:
+ wil_details_FeatureReporting_IncrementOpportunityInCache
+ (param_1,param_2,param_2,__return_storage_ptr__);
+ return __return_storage_ptr__;
+ }
+ uVar4 = 0;
+ if ((param_2 != wil_details_ServiceReportingKind_DeviceUsage) &&
+ (param_2 != wil_details_ServiceReportingKind_DeviceOpportunity)) {
+ if (param_2 == wil_details_ServiceReportingKind_PotentialUniqueUsage) goto LAB_14066cc81;
+ if (param_2 == wil_details_ServiceReportingKind_PotentialUniqueOpportunity)
+ goto LAB_14066cc71;
+ if ((param_2 != wil_details_ServiceReportingKind_PotentialDeviceUsage) &&
+ (param_2 != wil_details_ServiceReportingKind_PotentialDeviceOpportunity)) {
+ uVar3 = param_2 + 0xfffffec0;
+ if (uVar3 < 0x40) {
+ uVar1 = (param_1->recorded).exchange;
+ do {
+ if (((uVar1 & 0x10) == 0) || (uVar2 = 1, (uVar1 >> 5 & 0x3f) != uVar3)) {
+ uVar2 = uVar4;
+ }
+ __return_storage_ptr__->ignoredUse = uVar2;
+ LOCK();
+ uVar2 = (param_1->recorded).exchange;
+ bVar5 = uVar1 == uVar2;
+ if (bVar5) {
+ (param_1->recorded).exchange = uVar1 & 0xfffff81f | (uVar3 & 0x3f) << 5 | 0x10;
+ uVar2 = uVar1;
+ }
+ uVar1 = uVar2;
+ UNLOCK();
+ } while (!bVar5);
+ }
+ __return_storage_ptr__->kindImmediate = param_2;
+ __return_storage_ptr__->countImmediate = 1;
+ __return_storage_ptr__->payloadId = 0;
+ return __return_storage_ptr__;
+ }
+ }
+ if (param_2 == wil_details_ServiceReportingKind_DeviceUsage) {
+ uVar4 = 2;
+ }
+ else if (param_2 == wil_details_ServiceReportingKind_DeviceOpportunity) {
+ uVar4 = 8;
+ }
+ else if (param_2 == wil_details_ServiceReportingKind_PotentialDeviceUsage) {
+ uVar4 = 4;
+ }
+ else if (param_2 == wil_details_ServiceReportingKind_PotentialDeviceOpportunity) {
+ uVar4 = 0x10;
+ }
+ uVar3 = (param_1->reported).exchange;
+ do {
+ LOCK();
+ uVar1 = (param_1->reported).exchange;
+ bVar5 = uVar3 == uVar1;
+ if (bVar5) {
+ (param_1->reported).exchange = uVar3 | uVar4 | 1;
+ uVar1 = uVar3;
+ }
+ uVar3 = uVar1;
+ UNLOCK();
+ } while (!bVar5);
+ __return_storage_ptr__->queueBackground = ~uVar3 & 1;
+ __return_storage_ptr__->ignoredUse = (uint)((uVar4 & uVar3) == uVar4);
+ }
+ return __return_storage_ptr__;
+ }
+
wil_details_FeatureReporting_ReportUsageToService
Key
ntoskrnl.exe.10.0.22621.2428
name
wil_details_FeatureReporting_ReportUsageToService
fullname
wil_details_FeatureReporting_ReportUsageToService
refcount
2
length
134
called
_guard_dispatch_icall wil_details_FeatureReporting_ReportUsageToServiceDirect wil_details_MapReportingKind
calling
Feature_1171241279__private_IsEnabled
paramcount
8
address
14066cca4
sig
void __cdecl wil_details_FeatureReporting_ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)
sym_type
Function
sym_source
ANALYSIS
external
False
--- wil_details_FeatureReporting_ReportUsageToService
+++ wil_details_FeatureReporting_ReportUsageToService
@@ -0,0 +1,34 @@
+
+ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+ /* void __cdecl wil_details_FeatureReporting_ReportUsageToService(struct
+ wil_details_FeatureReportingCache * __ptr64,unsigned int,int,int,struct FEATURE_LOGGED_TRAITS
+ const * __ptr64,int,enum wil_ReportingKind,unsigned __int64) */
+
+ void __cdecl
+ wil_details_FeatureReporting_ReportUsageToService
+ (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4,
+ FEATURE_LOGGED_TRAITS *param_5,int param_6,wil_ReportingKind param_7,__uint64 param_8)
+
+ {
+ wil_details_ServiceReportingKind wVar1;
+ int iVar2;
+ uint in_stack_ffffffffffffffd0;
+ undefined in_stack_ffffffffffffffd8;
+ undefined7 in_stack_ffffffffffffffd9;
+
+ param_7 = wil_ReportingKind_DeviceUsage;
+ wVar1 = wil_details_MapReportingKind(wil_ReportingKind_DeviceUsage,param_6);
+ iVar2 = wil_details_FeatureReporting_ReportUsageToServiceDirect
+ (param_1,param_2,param_3,param_4,wVar1,in_stack_ffffffffffffffd0,
+ CONCAT71(in_stack_ffffffffffffffd9,in_stack_ffffffffffffffd8));
+ if ((iVar2 != 0) &&
+ (g_wil_details_pfnFeatureLoggingHook !=
+ (_func_void_uint_FEATURE_LOGGED_TRAITS_ptr_FEATURE_ERROR_ptr_int_wil_ReportingKind_ptr_wil_VariantReportingKind_ptr_uchar___uint64
+ *)0x0)) {
+ (*g_wil_details_pfnFeatureLoggingHook)
+ (param_2,param_5,(FEATURE_ERROR *)0x0,param_6,¶m_7,(wil_VariantReportingKind *)0x0
+ ,'\0',1);
+ }
+ return;
+ }
+
wil_details_FeatureReporting_ReportUsageToServiceDirect
Key
ntoskrnl.exe.10.0.22621.2428
name
wil_details_FeatureReporting_ReportUsageToServiceDirect
fullname
wil_details_FeatureReporting_ReportUsageToServiceDirect
refcount
2
length
229
called
CmFcManagerNotifyFeatureUsage __security_check_cookie _guard_dispatch_icall wil_details_FeatureReporting_RecordUsageInCache
calling
wil_details_FeatureReporting_ReportUsageToService
paramcount
7
address
14066cd34
sig
int __cdecl wil_details_FeatureReporting_ReportUsageToServiceDirect(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, wil_details_ServiceReportingKind param_5, uint param_6, __uint64 param_7)
sym_type
Function
sym_source
ANALYSIS
external
False
--- wil_details_FeatureReporting_ReportUsageToServiceDirect
+++ wil_details_FeatureReporting_ReportUsageToServiceDirect
@@ -0,0 +1,53 @@
+
+ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+ /* int __cdecl wil_details_FeatureReporting_ReportUsageToServiceDirect(struct
+ wil_details_FeatureReportingCache * __ptr64,unsigned int,int,int,enum
+ wil_details_ServiceReportingKind,unsigned int,unsigned __int64) */
+
+ int __cdecl
+ wil_details_FeatureReporting_ReportUsageToServiceDirect
+ (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4,
+ wil_details_ServiceReportingKind param_5,uint param_6,__uint64 param_7)
+
+ {
+ uint6 uVar1;
+ int extraout_EAX;
+ wil_details_RecordUsageResult *pwVar2;
+ undefined8 uVar3;
+ undefined auStackY_98 [32];
+ uint in_stack_ffffffffffffff88;
+ ulonglong local_68;
+ wil_details_RecordUsageResult local_60;
+ int local_48;
+ uint uStack_44;
+ wil_details_ServiceReportingKind wStack_40;
+ uint uStack_3c;
+ undefined8 local_38;
+ ulonglong local_30;
+
+ local_30 = __security_cookie ^ (ulonglong)auStackY_98;
+ pwVar2 = wil_details_FeatureReporting_RecordUsageInCache
+ (&local_60,param_1,param_5,param_4,in_stack_ffffffffffffff88);
+ local_48 = pwVar2->queueBackground;
+ uStack_44 = pwVar2->countImmediate;
+ wStack_40 = pwVar2->kindImmediate;
+ uStack_3c = pwVar2->payloadId;
+ uVar3._0_4_ = pwVar2->ignoredUse;
+ uVar3._4_4_ = pwVar2->isWexpConfiguration;
+ local_38 = uVar3;
+ if (g_wil_details_recordFeatureUsage != (code *)0x0) {
+ uVar3 = (*g_wil_details_recordFeatureUsage)(param_2,param_5,1,param_1);
+ }
+ if ((param_3 != 0) && (param_5 != wil_details_ServiceReportingKind_Store)) {
+ local_68._0_6_ = CONCAT24((short)param_5,param_2);
+ uVar1 = (uint6)local_68;
+ local_68 = (ulonglong)(uint6)local_68;
+ if (param_4 != 0) {
+ local_68 = CONCAT26(1,uVar1);
+ }
+ CmFcManagerNotifyFeatureUsage(uVar3,&local_68);
+ }
+ __security_check_cookie(local_30 ^ (ulonglong)auStackY_98);
+ return extraout_EAX;
+ }
+
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
Key
ntoskrnl.exe.10.0.22621.2428
name
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
fullname
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
refcount
3
length
45
called
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
calling
Feature_1171241279__private_IsEnabled wil_details_GetCurrentFeatureEnabledState
paramcount
2
address
14066ce20
sig
wil_details_FeatureStateCache __cdecl wil_details_FeatureStateCache_GetCachedFeatureEnabledState(wil_details_FeatureStateCache * param_1, wil_details_FeatureDescriptor * param_2)
sym_type
Function
sym_source
ANALYSIS
external
False
--- wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+++ wil_details_FeatureStateCache_GetCachedFeatureEnabledState
@@ -0,0 +1,21 @@
+
+ /* union wil_details_FeatureStateCache __cdecl
+ wil_details_FeatureStateCache_GetCachedFeatureEnabledState(union wil_details_FeatureStateCache *
+ __ptr64,struct wil_details_FeatureDescriptor const * __ptr64) */
+
+ wil_details_FeatureStateCache __cdecl
+ wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+ (wil_details_FeatureStateCache *param_1,wil_details_FeatureDescriptor *param_2)
+
+ {
+ wil_details_FeatureStateCache local_res8;
+
+ local_res8._s_1.payloadId = 0;
+ local_res8.exchange = param_1->exchange;
+ if ((param_1->exchange & 1) == 0) {
+ local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+ (param_1,local_res8,param_2);
+ }
+ return (wil_details_FeatureStateCache)local_res8.exchange64;
+ }
+
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
Key
ntoskrnl.exe.10.0.22621.2428
name
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
fullname
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
refcount
2
length
247
called
_guard_dispatch_icall wil_details_GetCurrentFeatureEnabledState
calling
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
paramcount
3
address
14066ce54
sig
wil_details_FeatureStateCache __cdecl wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(wil_details_FeatureStateCache * param_1, wil_details_FeatureStateCache param_2, wil_details_FeatureDescriptor * param_3)
sym_type
Function
sym_source
ANALYSIS
external
False
--- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
@@ -0,0 +1,75 @@
+
+ /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+ /* union wil_details_FeatureStateCache __cdecl
+ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(union
+ wil_details_FeatureStateCache * __ptr64,union wil_details_FeatureStateCache,struct
+ wil_details_FeatureDescriptor const * __ptr64) */
+
+ wil_details_FeatureStateCache __cdecl
+ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+ (wil_details_FeatureStateCache *param_1,wil_details_FeatureStateCache param_2,
+ wil_details_FeatureDescriptor *param_3)
+
+ {
+ int iVar1;
+ wil_details_FeatureStateCache wVar2;
+ wil_details_FeatureStateCache wVar3;
+ uint uVar4;
+ uint uVar5;
+ uint uVar6;
+ wil_details_FeatureStateCache wVar7;
+ bool bVar8;
+ uint local_res8 [2];
+ undefined8 local_res10;
+
+ iVar1 = 0;
+ local_res8[0] = 0;
+ local_res10 = param_2;
+ if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) {
+ iVar1 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)();
+ }
+ wVar2 = wil_details_GetCurrentFeatureEnabledState(param_3,(int *)local_res8);
+ if (param_3->changeTime == '\0') {
+ local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0);
+ }
+ wVar3.exchange64 = param_2.exchange64 & 0xffffffff;
+ do {
+ wVar7 = param_2;
+ uVar6 = wVar3.exchange;
+ local_res10._0_4_ = uVar6;
+ uVar4 = wVar2.exchange;
+ if ((local_res8[0] != 0) && ((wVar3.exchange64 & 1) == 0)) {
+ uVar5 = (uVar6 ^ uVar4) & 0x278 ^ uVar6;
+ uVar6 = uVar5 | 1;
+ local_res10 = CONCAT44(local_res10._4_4_,uVar5) | 1;
+ }
+ if ((wVar7.exchange64 & 2) == 0) {
+ uVar5 = uVar6 ^ (uVar4 ^ uVar6) & 0x100;
+ uVar6 = uVar5 | 2;
+ local_res10 = CONCAT44(local_res10._4_4_,uVar5) | 2;
+ }
+ wVar3.exchange64 = wVar7.exchange64 & 0xffffffff;
+ LOCK();
+ uVar5 = param_1->exchange;
+ bVar8 = wVar7.exchange == uVar5;
+ if (bVar8) {
+ param_1->exchange = uVar6;
+ }
+ else {
+ wVar3._s_1.payloadId = 0;
+ wVar3.exchange = uVar5;
+ }
+ UNLOCK();
+ param_2 = wVar3;
+ } while (!bVar8);
+ if (((wVar7.exchange64 & 2) == 0) &&
+ (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) {
+ (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges)
+ (param_1,param_3->changeTime,iVar1);
+ }
+ if (local_res8[0] == 0) {
+ local_res10._0_4_ = uVar6 ^ (uVar4 ^ uVar6) & 0x278;
+ }
+ return (wil_details_FeatureStateCache)local_res10;
+ }
+
wil_details_GetCurrentFeatureEnabledState
Key
ntoskrnl.exe.10.0.22621.2428
name
wil_details_GetCurrentFeatureEnabledState
fullname
wil_details_GetCurrentFeatureEnabledState
refcount
2
length
309
called
wil_RtlStagingConfig_QueryFeatureState wil_details_FeatureStateCache_GetCachedFeatureEnabledState
calling
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
paramcount
2
address
14066cf54
sig
wil_details_FeatureStateCache __cdecl wil_details_GetCurrentFeatureEnabledState(wil_details_FeatureDescriptor * param_1, int * param_2)
sym_type
Function
sym_source
ANALYSIS
external
False
--- wil_details_GetCurrentFeatureEnabledState
+++ wil_details_GetCurrentFeatureEnabledState
@@ -0,0 +1,76 @@
+
+ /* union wil_details_FeatureStateCache __cdecl wil_details_GetCurrentFeatureEnabledState(struct
+ wil_details_FeatureDescriptor const * __ptr64,int * __ptr64) */
+
+ wil_details_FeatureStateCache __cdecl
+ wil_details_GetCurrentFeatureEnabledState(wil_details_FeatureDescriptor *param_1,int *param_2)
+
+ {
+ uchar uVar1;
+ wil_details_FeatureDescriptor *pwVar2;
+ int iVar3;
+ uint uVar4;
+ wil_details_FeatureStateCache wVar5;
+ uint uVar6;
+ wil_details_FeatureDescriptor **ppwVar7;
+ bool bVar8;
+ wil_details_FeatureStateCache local_res8;
+ undefined local_28 [16];
+ undefined8 local_18;
+
+ uVar1 = param_1->changeTime;
+ uVar6 = param_1->featureId;
+ *param_2 = 1;
+ local_18._0_4_ = 0;
+ local_18._4_4_ = 0;
+ local_28 = ZEXT816(0);
+ iVar3 = wil_RtlStagingConfig_QueryFeatureState
+ ((wil_FeatureState *)local_28,uVar6,(uint)((byte)(uVar1 - 2) < 2),param_2);
+ uVar6 = (-(uint)(iVar3 != 0) & local_28._0_4_ &
+ (wil_FeatureEnabledState_Disabled|wil_FeatureEnabledState_Enabled)) << 5 ^
+ (-(uint)((int)local_18 != 0) & 0x100 | -(uint)(local_18._4_4_ != 0) & 0x200);
+ if ((uVar6 & 0x60) == 0) {
+ uVar4 = -(uint)(param_1->isEnabledByDefault != '\0') & 0x10;
+ }
+ else {
+ uVar4 = 0;
+ if (local_28._0_4_ == wil_FeatureEnabledState_Enabled) {
+ uVar4 = 0x10;
+ }
+ }
+ uVar6 = (uVar4 | uVar6) ^ uVar4 >> 1;
+ local_res8._s_1.payloadId = 0;
+ local_res8.exchange = uVar6;
+ if (((uVar6 & 8) != 0) &&
+ (ppwVar7 = param_1->requiresFeatures, ppwVar7 != (wil_details_FeatureDescriptor **)0x0)) {
+ do {
+ pwVar2 = *ppwVar7;
+ if (pwVar2 == (wil_details_FeatureDescriptor *)0x0) {
+ return (wil_details_FeatureStateCache)local_res8._s_1;
+ }
+ if ((pwVar2->isAlwaysEnabled == '\0') && (pwVar2->isAlwaysDisabled == '\0')) {
+ wVar5 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+ (pwVar2->featureStateCache,pwVar2);
+ if ((uVar6 & 8) == 0) goto LAB_14066d062;
+ bVar8 = (wVar5.exchange64 & 8) == 0;
+ LAB_14066d059:
+ if (bVar8) goto LAB_14066d062;
+ uVar4 = 8;
+ }
+ else {
+ if ((uVar6 & 8) != 0) {
+ bVar8 = pwVar2->isEnabledByDefault == '\0';
+ goto LAB_14066d059;
+ }
+ LAB_14066d062:
+ uVar4 = 0;
+ }
+ ppwVar7 = ppwVar7 + 1;
+ uVar6 = uVar6 & 0xfffffff7 | uVar4;
+ local_res8._s_1.payloadId = 0;
+ local_res8.exchange = uVar6;
+ } while (uVar4 != 0);
+ }
+ return (wil_details_FeatureStateCache)local_res8.exchange64;
+ }
+
wil_details_MapReportingKind
Key
ntoskrnl.exe.10.0.22621.2428
name
wil_details_MapReportingKind
fullname
wil_details_MapReportingKind
refcount
2
length
144
called
calling
wil_details_FeatureReporting_ReportUsageToService
paramcount
2
address
14066d090
sig
wil_details_ServiceReportingKind __cdecl wil_details_MapReportingKind(wil_ReportingKind param_1, int param_2)
sym_type
Function
sym_source
ANALYSIS
external
False
--- wil_details_MapReportingKind
+++ wil_details_MapReportingKind
@@ -0,0 +1,42 @@
+
+ /* enum wil_details_ServiceReportingKind __cdecl wil_details_MapReportingKind(enum
+ wil_ReportingKind,int) */
+
+ wil_details_ServiceReportingKind __cdecl
+ wil_details_MapReportingKind(wil_ReportingKind param_1,int param_2)
+
+ {
+ byte bVar1;
+
+ if (param_1 != wil_ReportingKind_None) {
+ if (param_1 == wil_ReportingKind_UniqueUsage) {
+ return ~-(uint)(param_2 != 0) & 4;
+ }
+ if (param_1 == wil_ReportingKind_UniqueOpportunity) {
+ return (-(uint)(param_2 != 0) & 0xfffffffc) +
+ wil_details_ServiceReportingKind_PotentialUniqueOpportunity;
+ }
+ if (param_1 == wil_ReportingKind_DeviceUsage) {
+ return (-(uint)(param_2 != 0) & 0xfffffffc) +
+ wil_details_ServiceReportingKind_PotentialDeviceUsage;
+ }
+ if (param_1 == wil_ReportingKind_DeviceOpportunity) {
+ return (-(uint)(param_2 != 0) & 0xfffffffc) +
+ wil_details_ServiceReportingKind_PotentialDeviceOpportunity;
+ }
+ if (param_1 == wil_ReportingKind_TotalDuration) {
+ return (-(uint)(param_2 != 0) & 0xfffffffe) +
+ wil_details_ServiceReportingKind_DisabledTotalDuration;
+ }
+ if (param_1 == wil_ReportingKind_PausedDuration) {
+ return (-(uint)(param_2 != 0) & 0xfffffffe) +
+ wil_details_ServiceReportingKind_DisabledPausedDuration;
+ }
+ bVar1 = (char)param_1 + 0x9c;
+ if (bVar1 < 0x32) {
+ return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1;
+ }
+ }
+ return wil_details_ServiceReportingKind_None;
+ }
+
wil_RtlStagingConfig_QueryFeatureState
Key
ntoskrnl.exe.10.0.22621.2428
name
wil_RtlStagingConfig_QueryFeatureState
fullname
wil_RtlStagingConfig_QueryFeatureState
refcount
2
length
152
called
RtlQueryFeatureConfiguration
calling
wil_details_GetCurrentFeatureEnabledState
paramcount
4
address
140a4f280
sig
int __cdecl wil_RtlStagingConfig_QueryFeatureState(wil_FeatureState * param_1, uint param_2, int param_3, int * param_4)
sym_type
Function
sym_source
ANALYSIS
external
False
--- wil_RtlStagingConfig_QueryFeatureState
+++ wil_RtlStagingConfig_QueryFeatureState
@@ -0,0 +1,34 @@
+
+ /* int __cdecl wil_RtlStagingConfig_QueryFeatureState(struct wil_FeatureState * __ptr64,unsigned
+ int,int,int * __ptr64) */
+
+ int __cdecl
+ wil_RtlStagingConfig_QueryFeatureState
+ (wil_FeatureState *param_1,uint param_2,int param_3,int *param_4)
+
+ {
+ int iVar1;
+ undefined local_res20 [8];
+ undefined8 local_18;
+ uint local_10;
+
+ local_18 = 0;
+ local_10 = 0;
+ iVar1 = RtlQueryFeatureConfiguration(param_2,param_3 == 0,local_res20,&local_18);
+ if (iVar1 == 0) {
+ param_1->enabledState =
+ local_18._4_4_ >> 4 & (wil_FeatureEnabledState_Disabled|wil_FeatureEnabledState_Enabled);
+ param_1->variant = (byte)((ulonglong)local_18 >> 0x28) & 0x3f;
+ param_1->payload = local_10;
+ param_1->payloadKind =
+ local_18._4_4_ >> 0xe &
+ (wil_FeatureVariantPayloadKind_Resident|wil_FeatureVariantPayloadKind_External);
+ param_1->isWexpConfiguration = local_18._4_4_ >> 6 & 1;
+ }
+ else if (iVar1 != 0x117) {
+ return 0;
+ }
+ param_1->hasNotification = local_18._4_4_ >> 7 & 1;
+ return 1;
+ }
+
Modified functions contain code changes
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
code,refcount,length,address
ratio
0.22
i_ratio
0.3
m_ratio
0.28
b_ratio
0.78
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
VrpPostOpenOrCreate
VrpPostOpenOrCreate
fullname
VrpPostOpenOrCreate
VrpPostOpenOrCreate
refcount
3
2
length
1048
1003
called
Expand for full list: CmAllocateExtraParameter CmRetrieveExtraParameter CmSetCallbackObjectContext CmpFindExtraParameterInBlock CmpFreeExtraParameter EtwActivityIdControl ExFreePoolWithTag ObfDereferenceObject ObfReferenceObjectWithTag VrpAllocateKeyContext VrpBuildKeyPath VrpCountPathComponents VrpFreeCallbackContext VrpFreeKeyContext __security_check_cookie _tlgWriteTransfer_EtwWriteTransfer
Expand for full list: CmAllocateExtraParameter CmRetrieveExtraParameter CmSetCallbackObjectContext CmpFindExtraParameterInBlock CmpFreeExtraParameter EtwActivityIdControl ExFreePoolWithTag ObfDereferenceObject ObfReferenceObjectWithTag VrpAllocateKeyContext VrpBuildKeyPath VrpCountPathComponents VrpFreeCallbackContext VrpFreeKeyContext __security_check_cookie _tlgWriteTransfer_EtwWriteTransfer
calling
VrpRegistryCallback
VrpRegistryCallback
paramcount
0
0
address
1406cc198
1406cc7e4
sig
undefined VrpPostOpenOrCreate(void)
undefined VrpPostOpenOrCreate(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
--- VrpPostOpenOrCreate
+++ VrpPostOpenOrCreate
@@ -1,225 +1,244 @@
void VrpPostOpenOrCreate(longlong *param_1,undefined8 param_2)
{
- longlong lVar1;
+ ushort **ppuVar1;
ushort **ppuVar2;
- ushort **ppuVar3;
- undefined4 *puVar4;
- longlong *plVar5;
- longlong **pplVar6;
- code *pcVar7;
+ longlong *plVar3;
+ longlong **pplVar4;
+ undefined4 *puVar5;
+ code *pcVar6;
+ undefined4 uVar7;
undefined4 uVar8;
- undefined4 uVar9;
- undefined8 *puVar10;
- undefined2 uVar11;
- int iVar12;
- undefined4 uVar13;
+ undefined8 *puVar9;
+ undefined2 uVar10;
+ int iVar11;
+ undefined4 uVar12;
+ ushort **ppuVar13;
longlong lVar14;
- ushort **ppuVar15;
+ longlong *plVar15;
ushort *puVar16;
- longlong *plVar17;
+ undefined *puVar17;
undefined *puVar18;
undefined *puVar19;
- ushort **ppuVar20;
+ longlong lVar20;
+ ushort **in_R11;
+ ushort **ppuVar21;
undefined auStack_e8 [8];
undefined auStack_e0 [24];
undefined4 local_c8;
undefined *local_c0;
undefined8 local_b8;
longlong local_b0;
undefined local_a8 [16];
undefined local_98 [32];
uint *local_78;
undefined8 local_70;
undefined8 local_68;
uint local_60;
undefined4 local_5c;
undefined8 *local_58;
undefined8 local_50;
ulonglong local_48;
+ puVar17 = auStack_e8;
puVar19 = auStack_e8;
puVar18 = auStack_e8;
local_48 = __security_cookie ^ (ulonglong)auStack_e8;
local_a8 = ZEXT816(0);
EtwActivityIdControl(3,local_a8);
local_b0 = *param_1;
lVar14 = 0;
- lVar1 = param_1[1];
- ppuVar15 = (ushort **)0x0;
+ lVar20 = param_1[1];
+ ppuVar13 = (ushort **)0x0;
+ ppuVar21 = (ushort **)0x0;
local_b8 = (undefined8 *)0x0;
- iVar12 = *(int *)(local_b0 + 8);
- ppuVar2 = *(ushort ***)(local_b0 + 0x20);
- ppuVar3 = *(ushort ***)(local_b0 + 0x10);
- if (iVar12 < 0) goto LAB_0;
- CmRetrieveExtraParameter(*(undefined8 *)(lVar1 + 0x10));
- puVar10 = local_b8;
- if (iVar12 == 0x104) {
+ iVar11 = *(int *)(local_b0 + 8);
+ ppuVar1 = *(ushort ***)(local_b0 + 0x20);
+ ppuVar2 = *(ushort ***)(local_b0 + 0x10);
+ if (iVar11 < 0) goto LAB_0;
+ CmRetrieveExtraParameter(*(undefined8 *)(lVar20 + 0x10));
+ puVar9 = local_b8;
+ if (iVar11 == 0x104) {
if (local_b8 == (undefined8 *)0x0) {
LAB_0:
- iVar12 = 0;
+ iVar11 = 0;
goto LAB_1;
}
- plVar17 = local_b8 + -6;
- plVar5 = (longlong *)*plVar17;
- iVar12 = 0x104;
- if (((longlong *)plVar5[1] == plVar17) &&
- (pplVar6 = (longlong **)local_b8[-5], *pplVar6 == plVar17)) {
- *pplVar6 = plVar5;
- plVar5[1] = (longlong)pplVar6;
- *plVar17 = 0;
+ plVar15 = local_b8 + -6;
+ plVar3 = (longlong *)*plVar15;
+ if (((longlong *)plVar3[1] == plVar15) &&
+ (pplVar4 = (longlong **)local_b8[-5], *pplVar4 == plVar15)) {
+ *pplVar4 = plVar3;
+ plVar3[1] = (longlong)pplVar4;
+ *plVar15 = 0;
local_b8[-5] = 0;
CmpFreeExtraParameter();
goto LAB_0;
}
LAB_2:
- pcVar7 = (code *)swi(0x29);
- (*pcVar7)(3);
- puVar19 = auStack_e0;
+ puVar16 = (ushort *)0x3;
+ pcVar6 = (code *)swi(0x29);
+ ppuVar21 = (ushort **)(*pcVar6)();
+ puVar17 = auStack_e0;
LAB_3:
+ iVar11 = 0;
+ *in_R11 = puVar16;
+ in_R11[1] = (ushort *)ppuVar21;
+ *ppuVar21 = (ushort *)in_R11;
+ *(ushort ***)(puVar16 + 4) = in_R11;
+ puVar19 = puVar17;
+ LAB_4:
puVar18 = puVar19;
- puVar16 = &EmptyUnicodeString;
- if (*(longlong *)(*ppuVar3 + 4) != 0) {
- puVar16 = *ppuVar3;
- }
- local_68 = *(undefined8 *)(puVar16 + 4);
- local_78 = &local_60;
- local_58 = &local_b8;
- local_60 = (uint)*puVar16;
- *(undefined **)(puVar18 + 0x28) = local_98;
- *(undefined4 *)(puVar18 + 0x20) = 5;
- local_70 = 2;
- local_5c = 0;
- local_b8 = (undefined8 *)CONCAT44(local_b8._4_4_,iVar12);
- local_50 = 4;
- *(undefined8 *)(puVar18 + -8) = 0x1408b800e;
- _tlgWriteTransfer_EtwWriteTransfer(&DAT_4,&DAT_140039dea,local_a8,0);
+ if (ppuVar2[1] != (ushort *)0x0) {
+ *(undefined8 *)(puVar18 + -8) = 0x1406ccabe;
+ ObfDereferenceObject();
+ }
+ lVar20 = local_b0;
+ ppuVar2[1] = *ppuVar1;
+ *ppuVar1 = (ushort *)0x0;
+ if ((*(int *)(local_b0 + 8) == 0x104) || (*(int *)(local_b0 + 8) == 0x368)) {
+ if (5 < DAT_5) {
+ puVar16 = &EmptyUnicodeString;
+ if (*(longlong *)(*ppuVar2 + 4) != 0) {
+ puVar16 = *ppuVar2;
+ }
+ local_68 = *(undefined8 *)(puVar16 + 4);
+ local_78 = &local_60;
+ local_58 = &local_b8;
+ local_60 = (uint)*puVar16;
+ *(undefined **)(puVar18 + 0x28) = local_98;
+ *(undefined4 *)(puVar18 + 0x20) = 5;
+ local_70 = 2;
+ local_5c = 0;
+ local_b8 = (undefined8 *)CONCAT44(local_b8._4_4_,iVar11);
+ local_50 = 4;
+ *(undefined8 *)(puVar18 + -8) = 0x1406ccb8c;
+ _tlgWriteTransfer_EtwWriteTransfer(&DAT_5,&DAT_140039e13,local_a8,0);
+ }
+ }
+ else {
+ lVar14 = *(longlong *)(*ppuVar2 + 4);
+ if (lVar14 != 0) {
+ *(undefined8 *)(puVar18 + -8) = 0x1406ccaf0;
+ ExFreePoolWithTag(lVar14,0);
+ }
+ puVar5 = (undefined4 *)*ppuVar2;
+ uVar12 = *(undefined4 *)((longlong)ppuVar1 + 0x14);
+ uVar7 = *(undefined4 *)(ppuVar1 + 3);
+ uVar8 = *(undefined4 *)((longlong)ppuVar1 + 0x1c);
+ *puVar5 = *(undefined4 *)(ppuVar1 + 2);
+ puVar5[1] = uVar12;
+ puVar5[2] = uVar7;
+ puVar5[3] = uVar8;
+ puVar5 = (undefined4 *)ppuVar2[0xe];
+ uVar12 = *(undefined4 *)((longlong)ppuVar1 + 0x24);
+ uVar7 = *(undefined4 *)(ppuVar1 + 5);
+ uVar8 = *(undefined4 *)((longlong)ppuVar1 + 0x2c);
+ *puVar5 = *(undefined4 *)(ppuVar1 + 4);
+ puVar5[1] = uVar12;
+ puVar5[2] = uVar7;
+ puVar5[3] = uVar8;
+ ppuVar1[3] = (ushort *)0x0;
+ ppuVar1[5] = (ushort *)0x0;
+ }
+ *(undefined8 *)(puVar18 + -8) = 0x1406ccb94;
+ VrpFreeCallbackContext(ppuVar1);
}
else {
- if (iVar12 == 0x368) {
+ if (iVar11 == 0x368) {
if (local_b8 != (undefined8 *)0x0) goto LAB_0;
- if (ppuVar2 == (ushort **)0x0) goto LAB_5;
- ppuVar15 = (ushort **)CmAllocateExtraParameter();
- if (ppuVar15 == (ushort **)0x0) goto LAB_6;
- iVar12 = VrpBuildKeyPath(0,ppuVar2 + 6,ppuVar15 + 2);
- if (iVar12 < 0) goto LAB_7;
- ObfReferenceObjectWithTag(ppuVar2[1],0x67655256);
- ppuVar20 = ppuVar15 + -6;
- *ppuVar15 = ppuVar2[1];
- *(undefined4 *)(ppuVar15 + 1) = *(undefined4 *)(ppuVar2 + 8);
- puVar16 = *(ushort **)(lVar1 + 0x10);
- iVar12 = CmpFindExtraParameterInBlock(puVar16,ppuVar15 + -4,&local_b8);
- lVar14 = 0;
- if (-1 < iVar12) {
- iVar12 = -0x3fffffcb;
+ if (ppuVar1 == (ushort **)0x0) goto LAB_6;
+ ppuVar13 = (ushort **)CmAllocateExtraParameter();
+ if (ppuVar13 != (ushort **)0x0) {
+ iVar11 = VrpBuildKeyPath(0,ppuVar1 + 6,ppuVar13 + 2);
+ ppuVar21 = ppuVar13;
+ if (-1 < iVar11) {
+ ObfReferenceObjectWithTag(ppuVar1[1],0x67655256);
+ in_R11 = ppuVar13 + -6;
+ *ppuVar13 = ppuVar1[1];
+ *(undefined4 *)(ppuVar13 + 1) = *(undefined4 *)(ppuVar1 + 8);
+ puVar16 = *(ushort **)(lVar20 + 0x10);
+ iVar11 = CmpFindExtraParameterInBlock(puVar16,ppuVar13 + -4,&local_b8);
+ if (iVar11 < 0) {
+ if (iVar11 == -0x3fffffcc) {
+ ppuVar21 = *(ushort ***)(puVar16 + 4);
+ if (*ppuVar21 != puVar16) goto LAB_2;
+ goto LAB_3;
+ }
+ }
+ else {
+ iVar11 = -0x3fffffcb;
+ }
+ }
goto LAB_7;
}
- if (iVar12 != -0x3fffffcc) goto LAB_7;
- ppuVar15 = *(ushort ***)(puVar16 + 4);
- if (*ppuVar15 != puVar16) goto LAB_2;
- *ppuVar20 = puVar16;
- iVar12 = 0;
- ppuVar20[1] = (ushort *)ppuVar15;
- *ppuVar15 = (ushort *)ppuVar20;
- *(ushort ***)(puVar16 + 4) = ppuVar20;
+ LAB_8:
+ iVar11 = -0x3fffff66;
+ ppuVar21 = ppuVar13;
+ LAB_7:
+ if (2 < DAT_5) {
+ puVar16 = &EmptyUnicodeString;
+ if (*(longlong *)(*ppuVar2 + 4) != 0) {
+ puVar16 = *ppuVar2;
+ }
+ local_68 = *(undefined8 *)(puVar16 + 4);
+ local_78 = &local_60;
+ local_58 = &local_b8;
+ local_c0 = local_98;
+ local_60 = (uint)*puVar16;
+ local_c8 = 5;
+ local_70 = 2;
+ local_5c = 0;
+ local_b8 = (undefined8 *)CONCAT44(local_b8._4_4_,iVar11);
+ local_50 = 4;
+ _tlgWriteTransfer_EtwWriteTransfer(&DAT_5,&DAT_140039f3d,local_a8,0);
+ }
+ if (lVar14 != 0) {
+ VrpFreeKeyContext(lVar14);
+ }
+ if (ppuVar21 != (ushort **)0x0) {
+ CmpFreeExtraParameter(ppuVar21 + -6);
+ }
}
else {
if (local_b8 == (undefined8 *)0x0) {
lVar14 = VrpAllocateKeyContext(param_2);
- if (lVar14 == 0) goto LAB_6;
- iVar12 = VrpBuildKeyPath(0,ppuVar2 + 6,lVar14 + 0x10);
- if (iVar12 < 0) goto LAB_7;
- uVar13 = *(undefined4 *)(ppuVar2 + 8);
- LAB_8:
- *(undefined4 *)(lVar14 + 0x24) = uVar13;
- uVar11 = VrpCountPathComponents(lVar14 + 0x10);
- *(undefined2 *)(lVar14 + 0x20) = uVar11;
- iVar12 = CmSetCallbackObjectContext
- (*(undefined8 *)ppuVar3[9],&VrpCallbackCookie,lVar14,&local_b8);
- if (iVar12 < 0) goto LAB_7;
- }
- else {
- lVar14 = VrpAllocateKeyContext(*local_b8);
if (lVar14 != 0) {
- iVar12 = VrpBuildKeyPath(0,puVar10 + 2,lVar14 + 0x10);
- if (-1 < iVar12) {
- uVar13 = *(undefined4 *)(puVar10 + 1);
- goto LAB_8;
+ iVar11 = VrpBuildKeyPath(0,ppuVar1 + 6,lVar14 + 0x10);
+ if (-1 < iVar11) {
+ uVar12 = *(undefined4 *)(ppuVar1 + 8);
+ goto LAB_9;
}
goto LAB_7;
}
+ goto LAB_8;
+ }
+ lVar14 = VrpAllocateKeyContext(*local_b8);
+ if (lVar14 == 0) goto LAB_8;
+ iVar11 = VrpBuildKeyPath(0,puVar9 + 2,lVar14 + 0x10);
+ if (iVar11 < 0) goto LAB_7;
+ uVar12 = *(undefined4 *)(puVar9 + 1);
+ LAB_9:
+ *(undefined4 *)(lVar14 + 0x24) = uVar12;
+ uVar10 = VrpCountPathComponents(lVar14 + 0x10);
+ *(undefined2 *)(lVar14 + 0x20) = uVar10;
+ iVar11 = CmSetCallbackObjectContext
+ (*(undefined8 *)ppuVar2[9],&VrpCallbackCookie,lVar14,&local_b8);
+ if (iVar11 < 0) goto LAB_7;
+ }
+ LAB_1:
+ puVar19 = auStack_e8;
+ lVar20 = local_b0;
+ if (ppuVar1 != (ushort **)0x0) goto LAB_4;
+ }
+ puVar19 = puVar18;
+ if (iVar11 < 0) {
+ *(int *)(lVar20 + 0x18) = iVar11;
+ }
LAB_6:
- iVar12 = -0x3fffff66;
- LAB_7:
- if (2 < DAT_4) {
- puVar16 = &EmptyUnicodeString;
- if (*(longlong *)(*ppuVar3 + 4) != 0) {
- puVar16 = *ppuVar3;
- }
- local_68 = *(undefined8 *)(puVar16 + 4);
- local_78 = &local_60;
- local_58 = &local_b8;
- local_c0 = local_98;
- local_60 = (uint)*puVar16;
- local_c8 = 5;
- local_70 = 2;
- local_5c = 0;
- local_b8 = (undefined8 *)CONCAT44(local_b8._4_4_,iVar12);
- local_50 = 4;
- _tlgWriteTransfer_EtwWriteTransfer(&DAT_4,&DAT_14003a104,local_a8,0);
- }
- if (lVar14 != 0) {
- VrpFreeKeyContext(lVar14);
- }
- if (ppuVar15 != (ushort **)0x0) {
- CmpFreeExtraParameter(ppuVar15 + -6);
- }
- }
- LAB_1:
- puVar19 = auStack_e8;
- if (ppuVar2 == (ushort **)0x0) goto LAB_5;
- }
- if (ppuVar3[1] != (ushort *)0x0) {
- ObfDereferenceObject();
- }
- ppuVar3[1] = *ppuVar2;
- *ppuVar2 = (ushort *)0x0;
- if ((*(int *)(local_b0 + 8) == 0x104) || (*(int *)(local_b0 + 8) == 0x368)) {
- puVar19 = auStack_e8;
- if (5 < DAT_4) goto LAB_1408b7f9c;
- }
- else {
- if (*(longlong *)(*ppuVar3 + 4) != 0) {
- ExFreePoolWithTag(*(longlong *)(*ppuVar3 + 4),0);
- }
- puVar4 = (undefined4 *)*ppuVar3;
- uVar13 = *(undefined4 *)((longlong)ppuVar2 + 0x14);
- uVar8 = *(undefined4 *)(ppuVar2 + 3);
- uVar9 = *(undefined4 *)((longlong)ppuVar2 + 0x1c);
- *puVar4 = *(undefined4 *)(ppuVar2 + 2);
- puVar4[1] = uVar13;
- puVar4[2] = uVar8;
- puVar4[3] = uVar9;
- puVar4 = (undefined4 *)ppuVar3[0xe];
- uVar13 = *(undefined4 *)((longlong)ppuVar2 + 0x24);
- uVar8 = *(undefined4 *)(ppuVar2 + 5);
- uVar9 = *(undefined4 *)((longlong)ppuVar2 + 0x2c);
- *puVar4 = *(undefined4 *)(ppuVar2 + 4);
- puVar4[1] = uVar13;
- puVar4[2] = uVar8;
- puVar4[3] = uVar9;
- ppuVar2[3] = (ushort *)0x0;
- ppuVar2[5] = (ushort *)0x0;
- puVar18 = auStack_e8;
- }
- }
- *(undefined8 *)(puVar18 + -8) = 0x1406cc311;
- VrpFreeCallbackContext(ppuVar2);
- puVar19 = puVar18;
- LAB_5:
- *(undefined8 *)(puVar19 + -8) = 0x1406cc31f;
+ *(undefined8 *)(puVar19 + -8) = 0x1406ccbb4;
__security_check_cookie(local_48 ^ (ulonglong)puVar19);
return;
}
VrpAddNamespaceNodeToList
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
code,refcount,length,address,calling
ratio
0.86
i_ratio
0.73
m_ratio
0.94
b_ratio
0.94
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
VrpAddNamespaceNodeToList
VrpAddNamespaceNodeToList
fullname
VrpAddNamespaceNodeToList
VrpAddNamespaceNodeToList
refcount
6
5
length
756
739
called
ExAllocatePoolWithTag ExFreePoolWithTag RtlCopyMemory VrpFindExactNamespaceNode memset
ExAllocatePoolWithTag ExFreePoolWithTag RtlCopyMemory VrpFindExactNamespaceNode memset
calling
VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlInitializeJobForVreg VrpPreLoadKey
VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpPreLoadKey
paramcount
0
0
address
14075ade0
14075b810
sig
undefined VrpAddNamespaceNodeToList(void)
undefined VrpAddNamespaceNodeToList(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
VrpAddNamespaceNodeToList Calling Diff
--- VrpAddNamespaceNodeToList calling
+++ VrpAddNamespaceNodeToList calling
@@ -3 +2,0 @@
- VrpHandleIoctlInitializeJobForVreg
VrpAddNamespaceNodeToList Diff
--- VrpAddNamespaceNodeToList
+++ VrpAddNamespaceNodeToList
@@ -1,187 +1,187 @@
int VrpAddNamespaceNodeToList(longlong param_1,undefined8 param_2)
{
void *pvVar1;
undefined auVar2 [16];
undefined auVar3 [16];
undefined auVar4 [16];
undefined auVar5 [16];
undefined auVar6 [16];
undefined auVar7 [16];
undefined auVar8 [16];
undefined auVar9 [16];
undefined auVar10 [16];
undefined auVar11 [16];
undefined auVar12 [16];
undefined auVar13 [16];
undefined auVar14 [16];
undefined auVar15 [16];
undefined auVar16 [16];
undefined auVar17 [16];
int iVar18;
longlong lVar19;
ulonglong uVar20;
ulonglong uVar21;
void *pvVar22;
undefined8 *puVar23;
ulonglong uVar24;
ulonglong uVar25;
ulonglong uVar26;
ulonglong local_res18 [2];
local_res18[0] = 0;
lVar19 = VrpFindExactNamespaceNode(param_1,param_2,local_res18);
uVar20 = local_res18[0];
if (lVar19 != 0) {
return -0x3fffffcb;
}
uVar24 = *(ulonglong *)(param_1 + 0x30);
uVar21 = *(ulonglong *)(param_1 + 0x38);
if (uVar24 <= local_res18[0]) {
if (uVar21 <= uVar24) {
uVar20 = uVar24 + 1;
if (uVar20 <= uVar21) {
return -0x3ffffff3;
}
uVar25 = *(longlong *)(param_1 + 0x40) - 1;
uVar26 = uVar25 + uVar20;
if (uVar26 < uVar20) {
return -0x3fffff6b;
}
uVar26 = ~uVar25 & uVar26;
- auVar6._8_8_ = 0;
- auVar6._0_8_ = *(ulonglong *)(param_1 + 0x28);
- auVar14._8_8_ = 0;
- auVar14._0_8_ = uVar21;
- uVar20 = SUB168(auVar6 * auVar14,0);
- if ((SUB168(auVar6 * auVar14,8) == 0) &&
- (auVar7._8_8_ = 0, auVar7._0_8_ = *(ulonglong *)(param_1 + 0x28), auVar15._8_8_ = 0,
- auVar15._0_8_ = uVar26, uVar21 = SUB168(auVar7 * auVar15,0),
- SUB168(auVar7 * auVar15,8) == 0)) {
+ auVar5._8_8_ = 0;
+ auVar5._0_8_ = *(ulonglong *)(param_1 + 0x28);
+ auVar13._8_8_ = 0;
+ auVar13._0_8_ = uVar21;
+ uVar20 = SUB168(auVar5 * auVar13,0);
+ if ((SUB168(auVar5 * auVar13,8) == 0) &&
+ (auVar6._8_8_ = 0, auVar6._0_8_ = *(ulonglong *)(param_1 + 0x28), auVar14._8_8_ = 0,
+ auVar14._0_8_ = uVar26, uVar21 = SUB168(auVar6 * auVar14,0),
+ SUB168(auVar6 * auVar14,8) == 0)) {
pvVar1 = *(void **)(param_1 + 0x48);
pvVar22 = (void *)ExAllocatePoolWithTag(1,uVar21,0x72615452);
if (pvVar1 == (void *)0x0) {
if (pvVar22 == (void *)0x0) {
LAB_0:
iVar18 = -0x3fffffe9;
goto LAB_1;
}
memset(pvVar22,0,uVar21);
}
else {
if (pvVar22 == (void *)0x0) goto LAB_0;
memset(pvVar22,0,uVar21);
if (uVar21 <= uVar20) {
uVar20 = uVar21;
}
RtlCopyMemory(pvVar22,pvVar1,uVar20);
ExFreePoolWithTag(pvVar1,0x72615452);
}
*(void **)(param_1 + 0x48) = pvVar22;
iVar18 = 0;
*(ulonglong *)(param_1 + 0x38) = uVar26;
}
else {
iVar18 = -0x3fffff6b;
}
LAB_1:
if (iVar18 != 0) {
return iVar18;
}
}
- auVar5._8_8_ = 0;
- auVar5._0_8_ = uVar24;
- auVar13._8_8_ = 0;
- auVar13._0_8_ = *(ulonglong *)(param_1 + 0x28);
- if (SUB168(auVar5 * auVar13,8) != 0) {
+ auVar7._8_8_ = 0;
+ auVar7._0_8_ = uVar24;
+ auVar15._8_8_ = 0;
+ auVar15._0_8_ = *(ulonglong *)(param_1 + 0x28);
+ if (SUB168(auVar7 * auVar15,8) != 0) {
return -0x3fffff6b;
}
puVar23 = (undefined8 *)
- (SUB168(auVar5 * auVar13,0) + (longlong)*(undefined8 **)(param_1 + 0x48));
+ (SUB168(auVar7 * auVar15,0) + (longlong)*(undefined8 **)(param_1 + 0x48));
if (puVar23 < *(undefined8 **)(param_1 + 0x48)) {
return -0x3fffff6b;
}
*puVar23 = param_2;
goto LAB_2;
}
if (uVar21 <= uVar24) {
uVar24 = uVar24 + 1;
if (uVar24 <= uVar21) {
return -0x3ffffff3;
}
uVar25 = *(longlong *)(param_1 + 0x40) - 1;
uVar26 = uVar25 + uVar24;
if (uVar26 < uVar24) {
return -0x3fffff6b;
}
uVar26 = ~uVar25 & uVar26;
auVar8._8_8_ = 0;
auVar8._0_8_ = *(ulonglong *)(param_1 + 0x28);
auVar16._8_8_ = 0;
auVar16._0_8_ = uVar21;
uVar24 = SUB168(auVar8 * auVar16,0);
if ((SUB168(auVar8 * auVar16,8) == 0) &&
(auVar9._8_8_ = 0, auVar9._0_8_ = *(ulonglong *)(param_1 + 0x28), auVar17._8_8_ = 0,
auVar17._0_8_ = uVar26, uVar21 = SUB168(auVar9 * auVar17,0), SUB168(auVar9 * auVar17,8) == 0)
) {
pvVar1 = *(void **)(param_1 + 0x48);
pvVar22 = (void *)ExAllocatePoolWithTag(1,uVar21,0x72615452);
if (pvVar1 == (void *)0x0) {
if (pvVar22 == (void *)0x0) {
LAB_3:
iVar18 = -0x3fffffe9;
goto LAB_4;
}
memset(pvVar22,0,uVar21);
}
else {
if (pvVar22 == (void *)0x0) goto LAB_3;
memset(pvVar22,0,uVar21);
if (uVar21 <= uVar24) {
uVar24 = uVar21;
}
RtlCopyMemory(pvVar22,pvVar1,uVar24);
ExFreePoolWithTag(pvVar1,0x72615452);
}
*(void **)(param_1 + 0x48) = pvVar22;
iVar18 = 0;
*(ulonglong *)(param_1 + 0x38) = uVar26;
}
else {
iVar18 = -0x3fffff6b;
}
LAB_4:
if (iVar18 != 0) {
return iVar18;
}
}
uVar24 = *(ulonglong *)(param_1 + 0x28);
auVar2._8_8_ = 0;
auVar2._0_8_ = uVar20;
auVar10._8_8_ = 0;
auVar10._0_8_ = uVar24;
if ((((SUB168(auVar2 * auVar10,8) != 0) ||
(puVar23 = (undefined8 *)
((longlong)*(undefined8 **)(param_1 + 0x48) + SUB168(auVar2 * auVar10,0)),
puVar23 < *(undefined8 **)(param_1 + 0x48))) ||
(auVar3._8_8_ = 0, auVar3._0_8_ = uVar20 + 1, auVar11._8_8_ = 0, auVar11._0_8_ = uVar24,
SUB168(auVar3 * auVar11,8) != 0)) ||
(pvVar1 = (void *)((longlong)*(void **)(param_1 + 0x48) + SUB168(auVar3 * auVar11,0)),
pvVar1 < *(void **)(param_1 + 0x48))) {
return -0x3fffff6b;
}
auVar4._8_8_ = 0;
auVar4._0_8_ = uVar24;
auVar12._8_8_ = 0;
auVar12._0_8_ = *(longlong *)(param_1 + 0x30) - uVar20;
if (SUB168(auVar4 * auVar12,8) != 0) {
return -0x7ffffff5;
}
RtlCopyMemory(pvVar1,puVar23,SUB168(auVar4 * auVar12,0));
*puVar23 = param_2;
LAB_2:
*(longlong *)(param_1 + 0x30) = *(longlong *)(param_1 + 0x30) + 1;
return 0;
}
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
code,refcount,length,address,called
ratio
0.18
i_ratio
0.31
m_ratio
0.29
b_ratio
0.4
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
VrpPreOpenOrCreate
VrpPreOpenOrCreate
fullname
VrpPreOpenOrCreate
VrpPreOpenOrCreate
refcount
3
2
length
1017
1106
called
Expand for full list: CmAllocateExtraParameter CmpFindExtraParameterInBlock CmpFreeExtraParameter EtwActivityIdControl ExAllocatePool2 ExFreePoolWithTag ObfDereferenceObject ObfReferenceObjectWithTag RtlInitUnicodeString VrpBuildKeyPath VrpTranslatePath __security_check_cookie _tlgWriteTransfer_EtwWriteTransfer
Expand for full list: CmAllocateExtraParameter CmpFindExtraParameterInBlock CmpFreeExtraParameter EtwActivityIdControl ExAllocatePool2 ExFreePoolWithTag ObfDereferenceObject ObfReferenceObjectWithTag RtlEqualUnicodeString RtlInitUnicodeString VrpBuildKeyPath VrpGetNextToken VrpTranslatePath __security_check_cookie _tlgWriteTransfer_EtwWriteTransfer
calling
VrpRegistryCallback
VrpRegistryCallback
paramcount
0
0
address
1406cb4f0
1406cb8b0
sig
undefined VrpPreOpenOrCreate(void)
undefined VrpPreOpenOrCreate(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
VrpPreOpenOrCreate Called Diff
--- VrpPreOpenOrCreate called
+++ VrpPreOpenOrCreate called
@@ -8,0 +9 @@
+ RtlEqualUnicodeString
@@ -10,0 +12 @@
+ VrpGetNextToken
--- VrpPreOpenOrCreate
+++ VrpPreOpenOrCreate
@@ -1,257 +1,271 @@
void VrpPreOpenOrCreate(undefined8 *param_1,ushort *param_2)
{
ushort uVar1;
ushort **ppuVar2;
ushort *puVar3;
- undefined4 *puVar4;
- longlong lVar5;
+ longlong lVar4;
+ undefined4 *puVar5;
code *pcVar6;
undefined4 uVar7;
undefined4 uVar8;
undefined4 uVar9;
undefined4 uVar10;
uint uVar11;
- int iVar12;
- ushort **ppuVar13;
+ char cVar12;
+ int iVar13;
ushort **ppuVar14;
ushort **ppuVar15;
- ulonglong uVar16;
- ushort *puVar17;
- undefined *puVar18;
+ ushort **ppuVar16;
+ ulonglong uVar17;
+ ushort *puVar18;
undefined *puVar19;
- ushort **ppuVar20;
- undefined auStack_148 [8];
- undefined auStack_140 [24];
+ undefined *puVar20;
+ undefined *puVar21;
+ ushort **ppuVar22;
+ undefined auStack_158 [8];
+ undefined auStack_150 [24];
+ undefined *local_138;
+ ushort **local_130;
undefined *local_128;
- ushort **local_120;
- undefined *local_118;
- uint *local_110;
- int *local_108;
- int local_f8;
- uint local_f4;
- ushort *local_f0;
- ushort *local_e8;
- undefined local_e0 [8];
- undefined4 uStack_d8;
- undefined4 uStack_d4;
- undefined local_d0 [8];
- undefined8 uStack_c8;
- undefined local_c0 [8];
- undefined4 uStack_b8;
- undefined4 uStack_b4;
- undefined local_b0 [16];
+ uint *local_120;
+ undefined8 *local_118;
+ undefined8 local_108;
+ uint local_100 [2];
+ ushort *local_f8;
+ undefined local_f0 [8];
+ undefined4 uStack_e8;
+ undefined4 uStack_e4;
+ ushort *local_e0;
+ undefined local_d8 [8];
+ undefined8 uStack_d0;
+ undefined local_c8 [16];
+ undefined local_b8 [8];
+ undefined4 uStack_b0;
+ undefined4 uStack_ac;
+ undefined local_a8 [16];
undefined local_98 [32];
uint *local_78;
undefined8 local_70;
undefined8 local_68;
uint local_60;
undefined4 local_5c;
undefined *local_58;
undefined8 local_50;
ulonglong local_48;
- puVar19 = auStack_148;
- local_48 = __security_cookie ^ (ulonglong)auStack_148;
+ puVar21 = auStack_158;
+ puVar20 = auStack_158;
+ local_48 = __security_cookie ^ (ulonglong)auStack_158;
ppuVar2 = (ushort **)*param_1;
- ppuVar15 = (ushort **)0x0;
- local_f4 = 0;
- local_e8 = ppuVar2[1];
- puVar17 = *ppuVar2;
- ppuVar20 = (ushort **)0x0;
+ ppuVar16 = (ushort **)0x0;
+ local_100[0] = 0;
+ local_e0 = ppuVar2[1];
+ puVar18 = *ppuVar2;
+ ppuVar22 = (ushort **)0x0;
puVar3 = ppuVar2[0xb];
- local_f0 = (ushort *)0x0;
- _local_e0 = ZEXT816(0);
- _local_d0 = ZEXT816(0);
- _local_c0 = ZEXT816(0);
- local_b0 = ZEXT816(0);
- EtwActivityIdControl(3,local_b0);
- if (((*puVar17 == 0) || (uVar16 = 0, **(short **)(puVar17 + 4) != 0x5c)) &&
- (uVar16 = -(ulonglong)(puVar3 != (ushort *)0x0) & (ulonglong)(puVar3 + 8),
- puVar18 = auStack_148, puVar3 == (ushort *)0x0)) goto LAB_0;
- iVar12 = VrpBuildKeyPath(uVar16,*ppuVar2,local_e0);
- ppuVar14 = ppuVar15;
- if (iVar12 < 0) {
+ local_f8 = (ushort *)0x0;
+ _local_f0 = ZEXT816(0);
+ _local_d8 = ZEXT816(0);
+ _local_b8 = ZEXT816(0);
+ local_a8 = ZEXT816(0);
+ EtwActivityIdControl(3,local_a8);
+ if (((*puVar18 == 0) || (uVar17 = 0, **(short **)(puVar18 + 4) != 0x5c)) &&
+ (uVar17 = -(ulonglong)(puVar3 != (ushort *)0x0) & (ulonglong)(puVar3 + 8),
+ puVar19 = auStack_158, puVar3 == (ushort *)0x0)) goto LAB_0;
+ iVar13 = VrpBuildKeyPath(uVar17,*ppuVar2,local_f0);
+ ppuVar14 = ppuVar16;
+ if (iVar13 < 0) {
LAB_1:
- if (iVar12 != -0x3ffffafd) goto LAB_2;
+ ppuVar22 = ppuVar16;
+ if (iVar13 != -0x3ffffafd) goto LAB_2;
LAB_3:
+ puVar21 = puVar20;
+ ppuVar22 = ppuVar16;
if (5 < DAT_4) {
- puVar17 = &EmptyUnicodeString;
+ puVar18 = &EmptyUnicodeString;
if (*(longlong *)(*ppuVar2 + 4) != 0) {
- puVar17 = *ppuVar2;
- }
- uVar1 = *puVar17;
- local_68 = *(undefined8 *)(puVar17 + 4);
- puVar18 = &DAT_5;
- *(undefined4 *)(puVar19 + 0x50) = 0xc0000503;
+ puVar18 = *ppuVar2;
+ }
+ uVar1 = *puVar18;
+ local_68 = *(undefined8 *)(puVar18 + 4);
+ puVar19 = &DAT_5;
+ *(undefined4 *)(puVar20 + 0x50) = 0xc0000503;
goto LAB_6;
}
}
else {
- local_108 = &local_f8;
- local_f8 = 0;
- local_110 = &local_f4;
- local_118 = local_c0;
- local_120 = &local_f0;
- local_128 = local_d0;
- iVar12 = VrpTranslatePath(param_2,local_e8,puVar3,local_e0);
- uVar11 = local_f4;
- puVar18 = auStack_148;
- if (iVar12 == -0x3fffffcc) goto LAB_0;
- ppuVar14 = (ushort **)0x0;
- if (iVar12 < 0) goto LAB_1;
- if ((local_f4 & 4) == 0) {
- local_f0[0x19] = local_e8[0x19];
- ppuVar13 = (ushort **)ExAllocatePool2(0x100,0x48,0x67655256);
- ppuVar14 = ppuVar15;
- if (ppuVar13 != (ushort **)0x0) {
- ppuVar2[10] = (ushort *)ppuVar13;
- *ppuVar13 = ppuVar2[1];
- puVar4 = (undefined4 *)*ppuVar2;
- uVar7 = puVar4[1];
- uVar8 = puVar4[2];
- uVar9 = puVar4[3];
- *(undefined4 *)(ppuVar13 + 2) = *puVar4;
- *(undefined4 *)((longlong)ppuVar13 + 0x14) = uVar7;
- *(undefined4 *)(ppuVar13 + 3) = uVar8;
- *(undefined4 *)((longlong)ppuVar13 + 0x1c) = uVar9;
- puVar4 = (undefined4 *)ppuVar2[0xe];
- uVar7 = *puVar4;
- uVar8 = puVar4[1];
- uVar9 = puVar4[2];
- uVar10 = puVar4[3];
- *(undefined4 *)(ppuVar13 + 6) = local_e0._0_4_;
- *(undefined4 *)((longlong)ppuVar13 + 0x34) = local_e0._4_4_;
- *(undefined4 *)(ppuVar13 + 7) = uStack_d8;
- *(undefined4 *)((longlong)ppuVar13 + 0x3c) = uStack_d4;
- *(uint *)(ppuVar13 + 8) = uVar11;
- *(undefined4 *)(ppuVar13 + 4) = uVar7;
- *(undefined4 *)((longlong)ppuVar13 + 0x24) = uVar8;
- *(undefined4 *)(ppuVar13 + 5) = uVar9;
- *(undefined4 *)((longlong)ppuVar13 + 0x2c) = uVar10;
- *(int *)(param_1 + 1) = local_f8;
- ppuVar13[1] = param_2;
- ppuVar2[1] = local_f0;
- puVar4 = (undefined4 *)*ppuVar2;
- *puVar4 = local_d0._0_4_;
- puVar4[1] = local_d0._4_4_;
- puVar4[2] = (undefined4)uStack_c8;
- puVar4[3] = uStack_c8._4_4_;
- puVar4 = (undefined4 *)ppuVar2[0xe];
- *puVar4 = local_c0._0_4_;
- puVar4[1] = local_c0._4_4_;
- puVar4[2] = uStack_b8;
- puVar4[3] = uStack_b4;
- puVar18 = auStack_148;
- goto LAB_0;
- }
- }
- else {
- ppuVar14 = (ushort **)CmAllocateExtraParameter();
- ppuVar13 = ppuVar15;
- if (ppuVar14 != (ushort **)0x0) {
- ObfReferenceObjectWithTag(param_2,0x67655256);
- *ppuVar14 = param_2;
- *(uint *)(ppuVar14 + 1) = uVar11 & 0xfffffffb;
- *(undefined4 *)(ppuVar14 + 2) = local_e0._0_4_;
- *(undefined4 *)((longlong)ppuVar14 + 0x14) = local_e0._4_4_;
- *(undefined4 *)(ppuVar14 + 3) = uStack_d8;
- *(undefined4 *)((longlong)ppuVar14 + 0x1c) = uStack_d4;
- RtlInitUnicodeString(local_e0,0);
- puVar17 = (ushort *)param_1[2];
- ppuVar13 = ppuVar14 + -6;
- iVar12 = CmpFindExtraParameterInBlock(puVar17,ppuVar14 + -4,&local_e8);
- if (iVar12 < 0) {
- if (iVar12 != -0x3fffffcc) goto LAB_1;
- ppuVar20 = *(ushort ***)(puVar17 + 4);
- puVar19 = auStack_148;
- if (*ppuVar20 != puVar17) {
- puVar17 = (ushort *)0x3;
+ local_108 = 0;
+ local_c8 = ZEXT816(0);
+ VrpGetNextToken(local_f0,&local_108,local_c8);
+ cVar12 = RtlEqualUnicodeString(local_c8,&VrpRegistryString,1);
+ if (cVar12 == '\0') {
+ LAB_7:
+ local_118 = &local_108;
+ local_120 = local_100;
+ local_108 = local_108 & 0xffffffff00000000;
+ local_128 = local_b8;
+ local_130 = &local_f8;
+ local_138 = local_d8;
+ iVar13 = VrpTranslatePath(param_2,local_e0,puVar3,local_f0);
+ uVar11 = local_100[0];
+ puVar19 = auStack_158;
+ if (iVar13 == -0x3fffffcc) goto LAB_0;
+ ppuVar14 = (ushort **)0x0;
+ if (iVar13 < 0) goto LAB_1;
+ if ((local_100[0] & 4) == 0) {
+ local_f8[0x19] = local_e0[0x19];
+ ppuVar15 = (ushort **)ExAllocatePool2(0x100,0x48,0x67655256);
+ ppuVar14 = ppuVar16;
+ if (ppuVar15 != (ushort **)0x0) {
+ ppuVar2[10] = (ushort *)ppuVar15;
+ *ppuVar15 = ppuVar2[1];
+ puVar5 = (undefined4 *)*ppuVar2;
+ uVar7 = puVar5[1];
+ uVar8 = puVar5[2];
+ uVar9 = puVar5[3];
+ *(undefined4 *)(ppuVar15 + 2) = *puVar5;
+ *(undefined4 *)((longlong)ppuVar15 + 0x14) = uVar7;
+ *(undefined4 *)(ppuVar15 + 3) = uVar8;
+ *(undefined4 *)((longlong)ppuVar15 + 0x1c) = uVar9;
+ puVar5 = (undefined4 *)ppuVar2[0xe];
+ uVar7 = *puVar5;
+ uVar8 = puVar5[1];
+ uVar9 = puVar5[2];
+ uVar10 = puVar5[3];
+ *(undefined4 *)(ppuVar15 + 6) = local_f0._0_4_;
+ *(undefined4 *)((longlong)ppuVar15 + 0x34) = local_f0._4_4_;
+ *(undefined4 *)(ppuVar15 + 7) = uStack_e8;
+ *(undefined4 *)((longlong)ppuVar15 + 0x3c) = uStack_e4;
+ *(uint *)(ppuVar15 + 8) = uVar11;
+ *(undefined4 *)(ppuVar15 + 4) = uVar7;
+ *(undefined4 *)((longlong)ppuVar15 + 0x24) = uVar8;
+ *(undefined4 *)(ppuVar15 + 5) = uVar9;
+ *(undefined4 *)((longlong)ppuVar15 + 0x2c) = uVar10;
+ *(undefined4 *)(param_1 + 1) = (undefined4)local_108;
+ ppuVar15[1] = param_2;
+ ppuVar2[1] = local_f8;
+ puVar5 = (undefined4 *)*ppuVar2;
+ *puVar5 = local_d8._0_4_;
+ puVar5[1] = local_d8._4_4_;
+ puVar5[2] = (undefined4)uStack_d0;
+ puVar5[3] = uStack_d0._4_4_;
+ puVar5 = (undefined4 *)ppuVar2[0xe];
+ *puVar5 = local_b8._0_4_;
+ puVar5[1] = local_b8._4_4_;
+ puVar5[2] = uStack_b0;
+ puVar5[3] = uStack_ac;
+ puVar19 = auStack_158;
+ goto LAB_0;
+ }
+ }
+ else {
+ ppuVar14 = (ushort **)CmAllocateExtraParameter();
+ ppuVar15 = ppuVar16;
+ if (ppuVar14 != (ushort **)0x0) {
+ ObfReferenceObjectWithTag(param_2,0x67655256);
+ *ppuVar14 = param_2;
+ *(uint *)(ppuVar14 + 1) = uVar11 & 0xfffffffb;
+ *(undefined4 *)(ppuVar14 + 2) = local_f0._0_4_;
+ *(undefined4 *)((longlong)ppuVar14 + 0x14) = local_f0._4_4_;
+ *(undefined4 *)(ppuVar14 + 3) = uStack_e8;
+ *(undefined4 *)((longlong)ppuVar14 + 0x1c) = uStack_e4;
+ RtlInitUnicodeString(local_f0,0);
+ puVar18 = (ushort *)param_1[2];
+ ppuVar15 = ppuVar14 + -6;
+ iVar13 = CmpFindExtraParameterInBlock(puVar18,ppuVar14 + -4,&local_e0);
+ if (-1 < iVar13) {
+ iVar13 = -0x3fffffcb;
+ goto LAB_2;
+ }
+ if (iVar13 != -0x3fffffcc) goto LAB_1;
+ ppuVar22 = *(ushort ***)(puVar18 + 4);
+ puVar20 = auStack_158;
+ if (*ppuVar22 != puVar18) {
+ puVar18 = (ushort *)0x3;
pcVar6 = (code *)swi(0x29);
- ppuVar20 = (ushort **)(*pcVar6)();
- puVar19 = auStack_140;
+ ppuVar22 = (ushort **)(*pcVar6)();
+ puVar20 = auStack_150;
}
- *ppuVar13 = puVar17;
+ *ppuVar15 = puVar18;
ppuVar14 = (ushort **)0x0;
- ppuVar13[1] = (ushort *)ppuVar20;
- *ppuVar20 = (ushort *)ppuVar13;
- *(ushort ***)(puVar17 + 4) = ppuVar13;
- lVar5 = *(longlong *)(*ppuVar2 + 4);
- if (lVar5 != 0) {
- *(undefined8 *)(puVar19 + -8) = 0x1408b7d76;
- ExFreePoolWithTag(lVar5,0x67655256);
+ ppuVar15[1] = (ushort *)ppuVar22;
+ *ppuVar22 = (ushort *)ppuVar15;
+ *(ushort ***)(puVar18 + 4) = ppuVar15;
+ lVar4 = *(longlong *)(*ppuVar2 + 4);
+ if (lVar4 != 0) {
+ *(undefined8 *)(puVar20 + -8) = 0x1406cbc45;
+ ExFreePoolWithTag(lVar4,0x67655256);
}
- puVar4 = (undefined4 *)*ppuVar2;
- uVar7 = *(undefined4 *)(puVar19 + 0x7c);
- uVar8 = *(undefined4 *)(puVar19 + 0x80);
- uVar9 = *(undefined4 *)(puVar19 + 0x84);
- *puVar4 = *(undefined4 *)(puVar19 + 0x78);
- puVar4[1] = uVar7;
- puVar4[2] = uVar8;
- puVar4[3] = uVar9;
- *(undefined8 *)(puVar19 + -8) = 0x1408b7d8e;
- RtlInitUnicodeString(puVar19 + 0x78,0);
+ puVar5 = (undefined4 *)*ppuVar2;
+ *puVar5 = local_d8._0_4_;
+ puVar5[1] = local_d8._4_4_;
+ puVar5[2] = (undefined4)uStack_d0;
+ puVar5[3] = uStack_d0._4_4_;
+ *(undefined8 *)(puVar20 + -8) = 0x1406cbc5b;
+ RtlInitUnicodeString(local_d8,0);
*(undefined4 *)((longlong)param_1 + 0xc) = 0x368;
goto LAB_3;
}
- iVar12 = -0x3fffffcb;
- ppuVar20 = ppuVar15;
- goto LAB_2;
- }
- }
- iVar12 = -0x3fffff66;
- ppuVar20 = ppuVar13;
+ }
+ iVar13 = -0x3fffff66;
+ ppuVar22 = ppuVar15;
+ }
+ else {
+ VrpGetNextToken(local_f0,&local_108,local_c8);
+ cVar12 = RtlEqualUnicodeString(local_c8,&VrpWcString,1);
+ if (cVar12 == '\0') goto LAB_7;
+ iVar13 = -0x3fffffde;
+ }
LAB_2:
- puVar19 = auStack_148;
- ppuVar15 = ppuVar20;
if (2 < DAT_4) {
- puVar17 = &EmptyUnicodeString;
+ puVar18 = &EmptyUnicodeString;
if (*(longlong *)(*ppuVar2 + 4) != 0) {
- puVar17 = *ppuVar2;
- }
- uVar1 = *puVar17;
- local_68 = *(undefined8 *)(puVar17 + 4);
- puVar18 = &DAT_7;
- puVar19 = auStack_148;
- local_f8 = iVar12;
+ puVar18 = *ppuVar2;
+ }
+ uVar1 = *puVar18;
+ local_68 = *(undefined8 *)(puVar18 + 4);
+ puVar19 = &DAT_8;
+ local_108 = CONCAT44(local_108._4_4_,iVar13);
+ puVar21 = auStack_158;
LAB_6:
local_78 = &local_60;
local_60 = (uint)uVar1;
- local_58 = puVar19 + 0x50;
+ local_58 = puVar21 + 0x50;
local_70 = 2;
- *(undefined **)(puVar19 + 0x28) = local_98;
- *(undefined4 *)(puVar19 + 0x20) = 5;
+ *(undefined **)(puVar21 + 0x28) = local_98;
+ *(undefined4 *)(puVar21 + 0x20) = 5;
local_5c = 0;
local_50 = 4;
- *(undefined8 *)(puVar19 + -8) = 0x1408b7cce;
- _tlgWriteTransfer_EtwWriteTransfer(&DAT_4,puVar18,local_b0,0);
- }
- }
- if (ppuVar15 != (ushort **)0x0) {
- *(undefined8 *)(puVar19 + -8) = 0x1408b7ce0;
- ExFreePoolWithTag(ppuVar15,0x67655256);
- }
- if (uStack_c8 != 0) {
- *(undefined8 *)(puVar19 + -8) = 0x1408b7cf3;
- ExFreePoolWithTag(uStack_c8,0x67655256);
- }
- if (*(longlong *)(puVar19 + 0x58) != 0) {
- *(undefined8 *)(puVar19 + -8) = 0x1408b7d02;
+ *(undefined8 *)(puVar21 + -8) = 0x1406cbaa9;
+ _tlgWriteTransfer_EtwWriteTransfer(&DAT_4,puVar19,local_a8,0);
+ }
+ }
+ if (ppuVar22 != (ushort **)0x0) {
+ *(undefined8 *)(puVar21 + -8) = 0x1406cbabb;
+ ExFreePoolWithTag(ppuVar22,0x67655256);
+ }
+ if (uStack_d0 != 0) {
+ *(undefined8 *)(puVar21 + -8) = 0x1406cbace;
+ ExFreePoolWithTag(uStack_d0,0x67655256);
+ }
+ if (*(longlong *)(puVar21 + 0x60) != 0) {
+ *(undefined8 *)(puVar21 + -8) = 0x1406cbadd;
ObfDereferenceObject();
}
- if (*(longlong *)(puVar19 + 0x70) != 0) {
- *(undefined8 *)(puVar19 + -8) = 0x1408b7d16;
- ExFreePoolWithTag(*(longlong *)(puVar19 + 0x70),0x67655256);
- }
- puVar18 = puVar19;
+ if (*(longlong *)(puVar21 + 0x70) != 0) {
+ *(undefined8 *)(puVar21 + -8) = 0x1406cbaf1;
+ ExFreePoolWithTag(*(longlong *)(puVar21 + 0x70),0x67655256);
+ }
+ puVar19 = puVar21;
if (ppuVar14 != (ushort **)0x0) {
- *(undefined8 *)(puVar19 + -8) = 0x1408b7d28;
+ *(undefined8 *)(puVar21 + -8) = 0x1406cbaff;
CmpFreeExtraParameter(ppuVar14 + -6);
}
LAB_0:
- *(undefined8 *)(puVar18 + -8) = 0x1406cb6b5;
- __security_check_cookie(local_48 ^ (ulonglong)puVar18);
+ *(undefined8 *)(puVar19 + -8) = 0x1406cbb0d;
+ __security_check_cookie(local_48 ^ (ulonglong)puVar19);
return;
}
VrpHandleIoctlInitializeJobForVreg
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
code,refcount,length,sig,address,called
ratio
0.12
i_ratio
0.13
m_ratio
0.18
b_ratio
0.66
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
VrpHandleIoctlInitializeJobForVreg
VrpHandleIoctlInitializeJobForVreg
fullname
VrpHandleIoctlInitializeJobForVreg
VrpHandleIoctlInitializeJobForVreg
refcount
3
2
length
1328
863
called
Expand for full list: CmGetRootKeyObjectForSilo CmInitSiloNamespace CmSetCallbackObjectContext ExAllocatePool2 ExAllocatePoolWithTag ExFreePoolWithTag ExfAcquirePushLockExclusiveEx ExfTryToWakePushLock KeAbPostRelease KeAbPreAcquire KiLeaveCriticalRegionUnsafe ObCreateObjectEx ObfDereferenceObject ObfDereferenceObjectWithTag ObpReferenceObjectByHandleWithTag PsGetJobSilo PsInsertSiloContext PsIsThreadInSilo PsRemoveSiloContext PspStorageMakeSlotReadOnly RtlUnicodeStringCopy VrpAddNamespaceNodeToList VrpAllocateKeyContext VrpCreateNamespaceNode VrpDestroyNamespaceNode VrpFreeKeyContext VrpIncrementSiloCount memset
Expand for full list: CmGetRootKeyObjectForSilo CmInitSiloNamespace CmSetCallbackObjectContext ExAllocatePool2 ExAllocatePoolWithTag ExFreePoolWithTag ObCreateObjectEx ObfDereferenceObject ObfDereferenceObjectWithTag ObpReferenceObjectByHandleWithTag PsGetJobSilo PsInsertSiloContext PsIsThreadInSilo PsRemoveSiloContext PspStorageMakeSlotReadOnly RtlUnicodeStringCopy VrpAllocateKeyContext VrpFreeKeyContext VrpIncrementSiloCount memset
calling
VrpIoctlDeviceDispatch
VrpIoctlDeviceDispatch
paramcount
6
6
address
1407598c8
14075a308
sig
undefined VrpHandleIoctlInitializeJobForVreg(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined param_5, undefined8 param_6)
undefined VrpHandleIoctlInitializeJobForVreg(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5, undefined8 param_6)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
VrpHandleIoctlInitializeJobForVreg Called Diff
--- VrpHandleIoctlInitializeJobForVreg called
+++ VrpHandleIoctlInitializeJobForVreg called
@@ -7,5 +6,0 @@
- ExfAcquirePushLockExclusiveEx
- ExfTryToWakePushLock
- KeAbPostRelease
- KeAbPreAcquire
- KiLeaveCriticalRegionUnsafe
@@ -22 +16,0 @@
- VrpAddNamespaceNodeToList
@@ -24,2 +17,0 @@
- VrpCreateNamespaceNode
- VrpDestroyNamespaceNode
VrpHandleIoctlInitializeJobForVreg Diff
--- VrpHandleIoctlInitializeJobForVreg
+++ VrpHandleIoctlInitializeJobForVreg
@@ -1,242 +1,152 @@
+
+ /* WARNING: Removing unreachable block (ram,0x00014075a613) */
+ /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
int VrpHandleIoctlInitializeJobForVreg(undefined8 *param_1,uint param_2,undefined param_3)
{
- longlong *plVar1;
- ulonglong uVar2;
+ undefined4 uVar1;
+ undefined4 uVar2;
undefined4 uVar3;
undefined4 uVar4;
- undefined4 uVar5;
- bool bVar6;
- bool bVar7;
- char cVar8;
- int iVar9;
+ bool bVar5;
+ undefined4 *puVar6;
+ char cVar7;
+ int iVar8;
+ size_t _Size;
+ void *_Dst;
+ undefined4 *puVar9;
longlong lVar10;
undefined4 *puVar11;
undefined4 *puVar12;
- void *_Dst;
undefined4 *puVar13;
undefined4 *puVar14;
undefined4 *puVar15;
- ulonglong *puVar16;
- undefined4 *puVar17;
- undefined4 *puVar18;
- undefined4 *param_6;
- undefined8 in_stack_ffffffffffffff60;
- undefined4 uVar19;
- undefined4 *local_78;
- longlong local_70;
- longlong local_68;
- longlong local_60;
- longlong local_58;
+ undefined4 *param_5;
+ longlong param_6;
- puVar14 = (undefined4 *)0x0;
- local_68 = 0;
- param_6 = (undefined4 *)0x0;
- puVar18 = (undefined4 *)0x0;
- bVar6 = false;
+ puVar9 = (undefined4 *)0x0;
+ param_6 = 0;
+ puVar12 = (undefined4 *)0x0;
+ bVar5 = false;
puVar15 = (undefined4 *)0x0;
- bVar7 = false;
- local_78 = (undefined4 *)0x0;
- local_70 = 0;
+ param_5 = (undefined4 *)0x0;
+ puVar13 = (undefined4 *)0x0;
if (param_2 < 8) {
LAB_0:
- iVar9 = -0x3ffffff3;
- puVar13 = param_6;
+ iVar8 = -0x3ffffff3;
+ puVar11 = puVar9;
goto LAB_1;
}
- uVar19 = (undefined4)((ulonglong)in_stack_ffffffffffffff60 >> 0x20);
- iVar9 = ObCreateObjectEx(0,VrpJobContextType,0,1);
- puVar13 = param_6;
- puVar17 = puVar14;
- if (iVar9 < 0) {
- LAB_2:
- bVar6 = false;
- puVar13 = param_6;
- puVar12 = puVar15;
- puVar11 = puVar18;
- }
- else {
- memset(param_6,0,0x60);
- *(undefined8 *)(puVar13 + 4) = 0;
- *(undefined (*) [16])(puVar13 + 8) = ZEXT816(0);
- *(undefined (*) [16])(puVar13 + 0xc) = ZEXT816(0);
- *(undefined (*) [16])(puVar13 + 0x10) = ZEXT816(0);
- *(undefined8 *)(puVar13 + 8) = 0;
- local_60 = SUB168(ZEXT816(8) * ZEXT816(0),8);
- *(undefined8 *)(puVar13 + 0x10) = 0x10;
- *(undefined8 *)(puVar13 + 0xc) = 0;
- *(undefined8 *)(puVar13 + 0xe) = 0;
- *(undefined8 *)(puVar13 + 0x12) = 0;
- *(undefined8 *)(puVar13 + 10) = 8;
- if (local_60 == 0) {
- local_58 = SUB168(ZEXT816(8) * ZEXT816(0x20),8);
- if (local_58 == 0) {
- _Dst = (void *)ExAllocatePoolWithTag(1);
- if (_Dst != (void *)0x0) {
- memset(_Dst,0,SUB168(ZEXT816(8) * ZEXT816(0x20),0));
+ iVar8 = ObCreateObjectEx(0,VrpJobContextType,0,1);
+ puVar6 = puVar12;
+ puVar14 = puVar13;
+ puVar11 = puVar15;
+ if (-1 < iVar8) {
+ memset((void *)0x0,0,0x60);
+ _DAT_2 = 0;
+ auRam0000000000000030 = ZEXT816(0);
+ auRam0000000000000040 = ZEXT816(0x10);
+ _DAT_3 = ZEXT816(8) << 0x40;
+ if (SUB168(ZEXT816(8) * ZEXT816(0),8) == 0) {
+ _Size = SUB168(ZEXT816(8) * ZEXT816(0x20),0);
+ if (SUB168(ZEXT816(8) * ZEXT816(0x20),8) != 0) {
+ iVar8 = -0x3fffff6b;
+ goto LAB_4;
+ }
+ _Dst = (void *)ExAllocatePoolWithTag(1,_Size,0x72615452);
+ if (_Dst == (void *)0x0) {
+ iVar8 = -0x3fffffe9;
+ goto LAB_4;
+ }
+ memset(_Dst,0,_Size);
+ _DAT_5 = (longlong)_Dst;
+ _DAT_6 = 0x20;
+ }
+ else {
+ iVar8 = -0x3fffff6b;
+ LAB_4:
+ if (_DAT_5 != 0) {
+ ExFreePoolWithTag(_DAT_5,0x72615452);
+ }
+ _DAT_3 = ZEXT816(0);
+ auRam0000000000000030 = ZEXT816(0);
+ auRam0000000000000040 = ZEXT816(0);
+ puVar6 = puVar9;
+ puVar14 = puVar9;
+ puVar11 = puVar9;
+ if (iVar8 < 0) goto LAB_7;
+ }
+ iVar8 = VrpIncrementSiloCount();
+ puVar6 = puVar12;
+ puVar14 = puVar13;
+ puVar11 = puVar15;
+ if (-1 < iVar8) {
+ uRam0000000000000058 = 1;
+ iVar8 = ObpReferenceObjectByHandleWithTag
+ (*param_1,6,PsJobType,param_3,0x52566d43,&stack0x00000030,0,0);
+ if ((-1 < iVar8) &&
+ (iVar8 = PsGetJobSilo(param_6,&stack0x00000028), puVar14 = param_5, -1 < iVar8)) {
+ cVar7 = PsIsThreadInSilo(SystemReserved1[15],param_5);
+ if (cVar7 != '\0') goto LAB_0;
+ uRam0000000000000000 = puVar14[0x16a];
+ _DAT_8 = puVar14[0x16b];
+ _DAT_9 = puVar14[0x16c];
+ uRam000000000000000c = puVar14[0x16d];
+ puVar9 = (undefined4 *)VrpAllocateKeyContext(0);
+ if (puVar9 != (undefined4 *)0x0) {
+ uVar1 = puVar14[0x16a];
+ uVar2 = puVar14[0x16b];
+ uVar3 = puVar14[0x16c];
+ uVar4 = puVar14[0x16d];
+ *(undefined2 *)(puVar9 + 8) = 1;
+ *puVar9 = uVar1;
+ puVar9[1] = uVar2;
+ puVar9[2] = uVar3;
+ puVar9[3] = uVar4;
+ lVar10 = ExAllocatePool2(0x100,CmRegistryRootName,0x67655256);
+ *(longlong *)(puVar9 + 6) = lVar10;
+ if (lVar10 != 0) {
+ *(undefined2 *)(puVar9 + 4) = 0;
+ *(undefined2 *)((longlong)puVar9 + 0x12) = CmRegistryRootName;
+ RtlUnicodeStringCopy(puVar9 + 4,&CmRegistryRootName);
+ iVar8 = CmInitSiloNamespace();
+ puVar6 = puVar9;
+ if ((-1 < iVar8) &&
+ (iVar8 = PsInsertSiloContext(puVar14,VrpSiloContextSlot,0), -1 < iVar8)) {
+ bVar5 = true;
+ puVar11 = (undefined4 *)CmGetRootKeyObjectForSilo(puVar14);
+ iVar8 = CmSetCallbackObjectContext(puVar11,&VrpCallbackCookie,puVar9,0);
+ if (-1 < iVar8) {
+ puVar9 = (undefined4 *)0x0;
+ PspStorageMakeSlotReadOnly(*(undefined8 *)(puVar14 + 0x17a),VrpSiloContextSlot);
+ iVar8 = 0;
+ goto LAB_1;
+ }
+ }
+ goto LAB_7;
+ }
}
- iVar9 = 0;
- if (_Dst == (void *)0x0) {
- iVar9 = -0x3fffffe9;
- }
- else {
- *(void **)(puVar13 + 0x12) = _Dst;
- *(undefined8 *)(puVar13 + 0xe) = 0x20;
- }
- }
- else {
- iVar9 = -0x3fffff6b;
+ iVar8 = -0x3fffff66;
+ goto LAB_1;
}
}
- else {
- iVar9 = -0x3fffff6b;
- }
- if (iVar9 == 0) {
- LAB_3:
- iVar9 = VrpIncrementSiloCount();
- puVar12 = puVar15;
- puVar17 = (undefined4 *)0x0;
- puVar11 = puVar18;
- if (-1 < iVar9) {
- puVar13[0x16] = 1;
- puVar16 = (ulonglong *)(param_6 + 4);
- *(short *)((longlong)SystemReserved1[15] + 0x1e4) =
- *(short *)((longlong)SystemReserved1[15] + 0x1e4) + -1;
- lVar10 = KeAbPreAcquire(puVar16,0);
- LOCK();
- uVar2 = *puVar16;
- *puVar16 = *puVar16 | 1;
- UNLOCK();
- if ((uVar2 & 1) != 0) {
- ExfAcquirePushLockExclusiveEx(puVar16,lVar10);
- }
- puVar13 = param_6;
- if (lVar10 != 0) {
- *(undefined *)(lVar10 + 0x12) = 1;
- }
- bVar6 = true;
- iVar9 = VrpCreateNamespaceNode
- (param_6,&CmRegistryContainersName,0,&CmRegistryContainersName,0,
- CONCAT44(uVar19,0xffffffff),&local_70);
- puVar17 = local_78;
- if ((-1 < iVar9) &&
- (iVar9 = VrpAddNamespaceNodeToList(puVar13,local_70), puVar17 = local_78, -1 < iVar9)) {
- local_70 = 0;
- LOCK();
- uVar2 = *puVar16;
- *puVar16 = *puVar16 - 1;
- UNLOCK();
- if (((uVar2 & 2) != 0) && ((uVar2 & 4) == 0)) {
- ExfTryToWakePushLock(puVar16);
- }
- KeAbPostRelease(puVar16);
- KiLeaveCriticalRegionUnsafe(SystemReserved1[15]);
- bVar6 = false;
- iVar9 = ObpReferenceObjectByHandleWithTag
- (*param_1,6,PsJobType,param_3,0x52566d43,&local_68,0,0);
- puVar17 = local_78;
- if ((-1 < iVar9) &&
- (iVar9 = PsGetJobSilo(local_68,&local_78), puVar17 = local_78, -1 < iVar9)) {
- cVar8 = PsIsThreadInSilo(SystemReserved1[15],local_78);
- puVar13 = param_6;
- if (cVar8 != '\0') goto LAB_0;
- uVar19 = puVar17[0x16b];
- uVar3 = puVar17[0x16c];
- uVar4 = puVar17[0x16d];
- *param_6 = puVar17[0x16a];
- param_6[1] = uVar19;
- param_6[2] = uVar3;
- param_6[3] = uVar4;
- puVar11 = (undefined4 *)VrpAllocateKeyContext(param_6);
- if (puVar11 != (undefined4 *)0x0) {
- uVar19 = puVar17[0x16a];
- uVar3 = puVar17[0x16b];
- uVar4 = puVar17[0x16c];
- uVar5 = puVar17[0x16d];
- *(undefined2 *)(puVar11 + 8) = 1;
- *puVar11 = uVar19;
- puVar11[1] = uVar3;
- puVar11[2] = uVar4;
- puVar11[3] = uVar5;
- lVar10 = ExAllocatePool2(0x100,CmRegistryRootName);
- *(longlong *)(puVar11 + 6) = lVar10;
- if (lVar10 != 0) {
- *(undefined2 *)(puVar11 + 4) = 0;
- *(undefined2 *)((longlong)puVar11 + 0x12) = CmRegistryRootName;
- RtlUnicodeStringCopy(puVar11 + 4,&CmRegistryRootName);
- iVar9 = CmInitSiloNamespace(puVar17);
- if ((-1 < iVar9) &&
- (iVar9 = PsInsertSiloContext(puVar17,VrpSiloContextSlot), -1 < iVar9)) {
- bVar7 = true;
- puVar12 = (undefined4 *)CmGetRootKeyObjectForSilo(puVar17);
- iVar9 = CmSetCallbackObjectContext(puVar12,&VrpCallbackCookie,puVar11,0);
- if (-1 < iVar9) {
- PspStorageMakeSlotReadOnly(*(undefined8 *)(puVar17 + 0x17a),VrpSiloContextSlot);
- iVar9 = 0;
- puVar11 = (undefined4 *)0x0;
- }
- }
- goto LAB_4;
- }
- }
- iVar9 = -0x3fffff66;
- puVar15 = puVar14;
- puVar14 = puVar11;
- goto LAB_1;
- }
- goto LAB_2;
- }
- }
- }
- else {
- if (*(longlong *)(puVar13 + 0x12) != 0) {
- ExFreePoolWithTag(*(longlong *)(puVar13 + 0x12),0x72615452);
- }
- *(undefined (*) [16])(puVar13 + 8) = ZEXT816(0);
- *(undefined (*) [16])(puVar13 + 0xc) = ZEXT816(0);
- *(undefined (*) [16])(puVar13 + 0x10) = ZEXT816(0);
- puVar12 = puVar14;
- puVar11 = puVar14;
- if (-1 < iVar9) goto LAB_3;
- }
}
- LAB_4:
- if (local_70 != 0) {
- VrpDestroyNamespaceNode(puVar13);
- }
- if (bVar6) {
- LOCK();
- plVar1 = (longlong *)(puVar13 + 4);
- lVar10 = *plVar1;
- *plVar1 = *plVar1 + -1;
- UNLOCK();
- if (((byte)lVar10 & 6) == 2) {
- ExfTryToWakePushLock(puVar13 + 4);
- }
- KeAbPostRelease(puVar13 + 4);
- KiLeaveCriticalRegionUnsafe(SystemReserved1[15]);
- puVar13 = param_6;
- puVar17 = local_78;
- }
- puVar15 = puVar12;
- puVar14 = puVar11;
- if ((iVar9 < 0) && (bVar7)) {
- PsRemoveSiloContext(puVar17,VrpSiloContextSlot,0);
+ LAB_7:
+ puVar9 = puVar6;
+ if ((iVar8 < 0) && (bVar5)) {
+ PsRemoveSiloContext(puVar14,VrpSiloContextSlot,0);
}
LAB_1:
- if (puVar13 != (undefined4 *)0x0) {
- ObfDereferenceObjectWithTag(puVar13,0x67655256);
+ if (puVar11 != (undefined4 *)0x0) {
+ ObfDereferenceObject(puVar11);
}
- if (puVar15 != (undefined4 *)0x0) {
- ObfDereferenceObject(puVar15);
+ if (puVar9 != (undefined4 *)0x0) {
+ VrpFreeKeyContext(puVar9);
}
- if (puVar14 != (undefined4 *)0x0) {
- VrpFreeKeyContext(puVar14);
+ if (param_6 != 0) {
+ ObfDereferenceObjectWithTag(param_6,0x52566d43);
}
- if (local_68 != 0) {
- ObfDereferenceObjectWithTag(local_68,0x52566d43);
- }
- return iVar9;
+ return iVar8;
}
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
code,length,address
ratio
0.6
i_ratio
0.73
m_ratio
0.96
b_ratio
0.96
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
KiIpiProcessRequests
KiIpiProcessRequests
fullname
KiIpiProcessRequests
KiIpiProcessRequests
refcount
4
4
length
829
801
called
EtwGetKernelTraceTimestampSilo KiFlushRangeTb KiSetUserTbFlushPending PerfInfoLogIpiReceive __security_check_cookie _guard_dispatch_icall
EtwGetKernelTraceTimestampSilo KiFlushRangeTb KiSetUserTbFlushPending PerfInfoLogIpiReceive __security_check_cookie _guard_dispatch_icall
calling
KiIpiInterruptSubDispatch
KiIpiInterruptSubDispatch
paramcount
0
0
address
1402c0870
1402c0610
sig
undefined KiIpiProcessRequests(void)
undefined KiIpiProcessRequests(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
KiIpiProcessRequests Diff
--- KiIpiProcessRequests
+++ KiIpiProcessRequests
@@ -1,164 +1,156 @@
+ /* WARNING: Control flow encountered bad instruction data */
/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
- /* WARNING: Control flow encountered bad instruction data */
void KiIpiProcessRequests(void)
{
- undefined8 *puVar1;
- int iVar2;
- undefined4 uVar3;
- char **ppcVar4;
- int *piVar5;
- longlong lVar6;
- code *pcVar7;
- undefined auVar8 [16];
- void *pvVar9;
- char cVar10;
- uint uVar11;
+ uint uVar1;
+ undefined8 *puVar2;
+ int iVar3;
+ undefined4 uVar4;
+ char **ppcVar5;
+ int *piVar6;
+ longlong lVar7;
+ code *pcVar8;
+ undefined auVar9 [16];
+ void *pvVar10;
+ char cVar11;
+ char *pcVar12;
longlong *plVar13;
char *pcVar14;
char **ppcVar15;
uint uVar16;
undefined8 *puVar17;
bool bVar18;
- undefined auStack_a8 [8];
- char **ppcStack_a0;
+ undefined auStack_a8 [48];
longlong local_78;
char *local_70;
undefined8 local_68;
longlong lStack_60;
undefined local_58 [16];
undefined local_48 [16];
ulonglong local_38;
- char *pcVar12;
- pvVar9 = FiberData;
+ pvVar10 = FiberData;
local_38 = __security_cookie ^ (ulonglong)auStack_a8;
if (*(longlong *)((longlong)FiberData + 0x9340) != 0) {
LOCK();
ppcVar15 = *(char ***)(char **)((longlong)FiberData + 0x9340);
*(char **)((longlong)FiberData + 0x9340) = (char *)0x0;
UNLOCK();
while (ppcVar15 != (char **)0x0) {
do {
local_70 = (char *)0x0;
- ppcVar4 = (char **)*ppcVar15;
+ ppcVar5 = (char **)*ppcVar15;
bVar18 = (DAT_0 & 0x400000) != 0;
local_58 = ZEXT816(0);
local_48 = ZEXT816(0);
local_78 = (&KiProcessorBlock)
- [(longlong)((longlong)ppcVar15 + (-0xbec0 - (longlong)pvVar9)) >> 6 & 0xffffffff]
- ;
+ [(longlong)((longlong)ppcVar15 + (-0xbec0 - (longlong)pvVar10)) >> 6 & 0xffffffff
+ ];
if (bVar18) {
EtwGetKernelTraceTimestampSilo(local_58,0x40400000,0);
}
pcVar14 = ppcVar15[1];
uVar16 = (uint)pcVar14 & 0xf;
if (uVar16 == 5) {
(*(code *)ppcVar15[5])(local_78,ppcVar15[2],ppcVar15[3]);
pcVar14 = ppcVar15[5];
}
else {
- uVar11 = uVar16 - 1;
- pcVar12 = (char *)(ulonglong)uVar11;
- if (6 < uVar11) {
- pcVar7 = (code *)swi(0x29);
- pcVar12 = local_70;
- (*pcVar7)(0x25);
- *(uint *)((longlong)ppcStack_a0 * 2) = *(uint *)((longlong)ppcStack_a0 * 2) | uVar16;
- *pcVar12 = *pcVar12 + (char)ppcStack_a0;
- *(char *)ppcStack_a0 = *(char *)ppcStack_a0 + (char)ppcStack_a0;
- pcVar12 = (char *)((ulonglong)uVar16 + 10);
- *pcVar12 = *pcVar12 + (char)((ulonglong)pcVar14 >> 8);
- pcVar7 = (code *)swi(3);
- ppcStack_a0 = ppcVar4;
- (*pcVar7)();
- return;
+ uVar1 = uVar16 - 1;
+ pcVar12 = (char *)(ulonglong)uVar1;
+ if (6 < uVar1) {
+ pcVar8 = (code *)swi(0x29);
+ (*pcVar8)(0x25,pcVar14,local_70);
+ in((short)pcVar14);
+ /* WARNING: Bad instruction - Truncating control flow here */
+ halt_baddata();
}
plVar13 = (longlong *)((longlong)pcVar14 >> 7);
pcVar14 = local_70;
switch(pcVar12) {
case (char *)0x1:
- lVar6 = *plVar13;
+ lVar7 = *plVar13;
if ((((1 << ((byte)*(undefined4 *)(plVar13 + 1) & 0x1f) & 10U) != 0) &&
(KiFlushPcid != 0)) &&
(*(char *)(*(longlong *)((longlong)SystemReserved1[15] + 0xb8) + 0x390) == '\0')) {
if ((KiFlushPcid & 2) == 0) {
KiSetUserTbFlushPending();
}
else {
local_68 = 1;
- auVar8._8_8_ = lVar6;
- auVar8._0_8_ = 1;
- invpcid(auStack_a8,auVar8);
- lStack_60 = lVar6;
+ auVar9._8_8_ = lVar7;
+ auVar9._0_8_ = 1;
+ invpcid(auStack_a8,auVar9);
+ lStack_60 = lVar7;
}
}
- invlpg(lVar6);
+ invlpg(lVar7);
pcVar14 = local_70;
break;
case (char *)0x2:
if ((KiFlushPcid != 0) &&
(*(char *)(*(longlong *)((longlong)SystemReserved1[15] + 0xb8) + 0x390) == '\0')) {
KiSetUserTbFlushPending();
pcVar14 = local_70;
}
break;
case (char *)0x3:
puVar17 = (undefined8 *)*plVar13;
- uVar3 = *(undefined4 *)((longlong)plVar13 + 0xc);
- puVar1 = puVar17 + *(uint *)(plVar13 + 1);
+ uVar4 = *(undefined4 *)((longlong)plVar13 + 0xc);
+ puVar2 = puVar17 + *(uint *)(plVar13 + 1);
do {
- KiFlushRangeTb(*puVar17,uVar3);
+ KiFlushRangeTb(*puVar17,uVar4);
puVar17 = puVar17 + 1;
pcVar14 = local_70;
- } while (puVar17 < puVar1);
+ } while (puVar17 < puVar2);
break;
case (char *)0x4:
- cVar10 = (char)uVar11;
- *(char *)ppcVar4 = *(char *)ppcVar4 + cVar10;
- *pcVar12 = *pcVar12 + cVar10;
- *(char *)((longlong)pcVar12 * 2) = *(char *)((longlong)pcVar12 * 2) + cVar10;
- *pcVar12 = *pcVar12 + cVar10;
+ cVar11 = (char)uVar1;
+ *(char *)ppcVar5 = *(char *)ppcVar5 + cVar11;
+ *pcVar12 = *pcVar12 + cVar11;
+ *(char *)((longlong)pcVar12 * 2) = *(char *)((longlong)pcVar12 * 2) + cVar11;
+ *pcVar12 = *pcVar12 + cVar11;
/* WARNING: Bad instruction - Truncating control flow here */
halt_baddata();
case (char *)0x5:
}
}
- piVar5 = (int *)ppcVar15[6];
+ piVar6 = (int *)ppcVar15[6];
LOCK();
- iVar2 = *piVar5;
- *piVar5 = *piVar5 + -1;
+ iVar3 = *piVar6;
+ *piVar6 = *piVar6 + -1;
UNLOCK();
- if (iVar2 == 1) {
+ if (iVar3 == 1) {
LOCK();
- piVar5 = (int *)(local_78 + 0x2d84);
- iVar2 = *piVar5;
- *piVar5 = *piVar5 + -1;
+ piVar6 = (int *)(local_78 + 0x2d84);
+ iVar3 = *piVar6;
+ *piVar6 = *piVar6 + -1;
UNLOCK();
- if (iVar2 == 1) {
+ if (iVar3 == 1) {
*(undefined4 *)(local_78 + 0x2d80) = 0;
}
}
if (bVar18) {
- PerfInfoLogIpiReceive(local_58,(ulonglong)uVar16,pcVar14);
+ PerfInfoLogIpiReceive(local_58,uVar16,pcVar14);
}
- if (*(longlong *)((longlong)pvVar9 + 35000) != 0) {
+ if (*(longlong *)((longlong)pvVar10 + 35000) != 0) {
LOCK();
- piVar5 = (int *)(*(longlong *)((longlong)pvVar9 + 35000) + 0x20);
- *piVar5 = *piVar5 + -1;
+ piVar6 = (int *)(*(longlong *)((longlong)pvVar10 + 35000) + 0x20);
+ *piVar6 = *piVar6 + -1;
UNLOCK();
}
- ppcVar15 = ppcVar4;
- } while (ppcVar4 != (char **)0x0);
+ ppcVar15 = ppcVar5;
+ } while (ppcVar5 != (char **)0x0);
LOCK();
- ppcVar15 = *(char ***)(char **)((longlong)pvVar9 + 0x9340);
- *(char **)((longlong)pvVar9 + 0x9340) = (char *)0x0;
+ ppcVar15 = *(char ***)(char **)((longlong)pvVar10 + 0x9340);
+ *(char **)((longlong)pvVar10 + 0x9340) = (char *)0x0;
UNLOCK();
}
}
__security_check_cookie(local_38 ^ (ulonglong)auStack_a8);
return;
}
NtSetInformationWorkerFactory
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
code,length,address
ratio
0.33
i_ratio
0.66
m_ratio
0.98
b_ratio
0.98
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
NtSetInformationWorkerFactory
NtSetInformationWorkerFactory
fullname
NtSetInformationWorkerFactory
NtSetInformationWorkerFactory
refcount
3
3
length
4050
3986
called
Expand for full list: ExRaiseDatatypeMisalignment ExpLeaveWorkerFactoryAwayMode ExpRemoveCurrentThreadFromThreadHistory ExpTryEnterWorkerFactoryAwayMode ExpWorkerFactoryCheckCreate ExpWorkerFactoryCreateThread KeAcquireInStackQueuedSpinLock KeAreAllApcsDisabled KeBugCheckEx KeSetTimer2 KeTimeOutQueueWaiters KiAcquireQueuedSpinLockInstrumented KiHaltOnAddressWakeEntireList KiReleaseQueuedSpinLockInstrumented KiRemoveSystemWorkPriorityKick KiValidateCpuSetMasks KxReleaseQueuedSpinLock KxWaitForLockChainValid KxWaitForLockOwnerShip OBJECT_HEADER_TO_HANDLE_REVOCATION_INFO ObReferenceObjectByHandle ObfDereferenceObjectWithTag ObpDeferObjectDeletion ObpDeregisterObject ObpHandleRevocationBlockRemoveObject ObpPushStackInfo ObpRemoveObjectRoutine RtlCopyMemory __security_check_cookie memset
Expand for full list: ExRaiseDatatypeMisalignment ExpLeaveWorkerFactoryAwayMode ExpRemoveCurrentThreadFromThreadHistory ExpTryEnterWorkerFactoryAwayMode ExpWorkerFactoryCheckCreate ExpWorkerFactoryCreateThread KeAcquireInStackQueuedSpinLock KeAreAllApcsDisabled KeBugCheckEx KeSetTimer2 KeTimeOutQueueWaiters KiAcquireQueuedSpinLockInstrumented KiHaltOnAddressWakeEntireList KiReleaseQueuedSpinLockInstrumented KiRemoveSystemWorkPriorityKick KiValidateCpuSetMasks KxReleaseQueuedSpinLock KxWaitForLockChainValid KxWaitForLockOwnerShip OBJECT_HEADER_TO_HANDLE_REVOCATION_INFO ObReferenceObjectByHandle ObfDereferenceObjectWithTag ObpDeferObjectDeletion ObpDeregisterObject ObpHandleRevocationBlockRemoveObject ObpPushStackInfo ObpRemoveObjectRoutine RtlCopyMemory __security_check_cookie memset
calling
paramcount
0
0
address
140271930
1402716d0
sig
undefined NtSetInformationWorkerFactory(void)
undefined NtSetInformationWorkerFactory(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
NtSetInformationWorkerFactory Diff
--- NtSetInformationWorkerFactory
+++ NtSetInformationWorkerFactory
@@ -1,724 +1,683 @@
/* WARNING: Control flow encountered bad instruction data */
- /* WARNING: Removing unreachable block (ram,0x0001404898c4) */
+ /* WARNING: Removing unreachable block (ram,0x000140489918) */
void NtSetInformationWorkerFactory(undefined8 param_1,int param_2,undefined8 *param_3,uint param_4)
{
uint *puVar1;
int *piVar2;
- byte *pbVar3;
- longlong lVar4;
- undefined8 uVar5;
- code *pcVar6;
- void *pvVar7;
- char cVar8;
- uint uVar9;
- int iVar10;
+ longlong lVar3;
+ byte bVar4;
+ uint uVar5;
+ undefined8 uVar6;
+ undefined8 uVar7;
+ code *pcVar8;
+ void *pvVar9;
+ char cVar10;
uint uVar11;
- byte bVar18;
- undefined8 *puVar12;
- undefined4 *puVar13;
- char *pcVar14;
- undefined8 uVar15;
- byte bVar19;
- undefined6 uVar22;
+ int iVar12;
+ uint uVar13;
+ undefined8 *puVar14;
+ undefined4 *puVar15;
char *pcVar16;
- char cVar21;
longlong lVar17;
- byte bVar23;
- undefined *puVar24;
- undefined *puVar25;
- undefined4 *puVar26;
- longlong unaff_RBP;
- longlong lVar27;
- uint uVar28;
- longlong *plVar29;
- bool bVar30;
+ undefined2 uVar18;
+ char *pcVar19;
+ undefined *puVar20;
+ undefined *puVar21;
+ undefined4 *puVar22;
+ longlong lVar23;
+ char cVar24;
+ uint uVar25;
+ longlong *plVar26;
byte in_CR8;
- byte bVar31;
- ulonglong uVar32;
+ byte bVar27;
+ ulonglong uVar28;
undefined local_1d8 [8];
undefined auStack_1d0 [72];
uint local_188;
undefined local_180 [16];
undefined8 local_170;
undefined local_160 [16];
uint local_148;
uint uStack_144;
uint uStack_140;
uint uStack_13c;
ulonglong local_48;
- byte bVar20;
- puVar24 = local_1d8;
- puVar25 = local_1d8;
- puVar26 = (undefined4 *)local_1d8;
+ puVar20 = local_1d8;
+ puVar21 = local_1d8;
+ puVar22 = (undefined4 *)local_1d8;
local_48 = __security_cookie ^ (ulonglong)local_1d8;
- pcVar16 = (char *)(ulonglong)param_4;
+ pcVar19 = (char *)(ulonglong)param_4;
local_180 = ZEXT816(0);
local_170 = 0;
local_160 = ZEXT816(0);
- cVar8 = *(char *)((longlong)SystemReserved1[15] + 0x232);
+ cVar10 = *(char *)((longlong)SystemReserved1[15] + 0x232);
memset(&local_148,0,0x100);
switch(param_2) {
case 0:
case 1:
case 7:
case 9:
goto LAB_0;
case 2:
local_188 = 8;
break;
default:
local_188 = 4;
LAB_1:
break;
case 6:
- puVar26 = (undefined4 *)local_1d8;
+ puVar22 = (undefined4 *)local_1d8;
goto LAB_0;
case 10:
local_188 = 0x10;
break;
case 0xf:
if (0xff < param_4) {
local_188 = 0x100;
goto LAB_1;
}
local_188 = (param_4 & 7) + param_4;
}
- uVar28 = 4;
- puVar26 = (undefined4 *)local_1d8;
+ uVar25 = 4;
+ puVar22 = (undefined4 *)local_1d8;
if (param_4 != local_188) goto LAB_0;
if (param_2 == 9) {
- if (cVar8 != '\0') {
+ if (cVar10 != '\0') {
if (((ulonglong)param_3 & 3) != 0) {
/* WARNING: Subroutine does not return */
ExRaiseDatatypeMisalignment();
}
if ((&DAT_2 < (undefined8 *)((longlong)param_3 + 4)) ||
((undefined8 *)((longlong)param_3 + 4) < param_3)) {
DAT_2 = 0;
}
}
LAB_3:
+ puVar22 = (undefined4 *)local_1d8;
+ uVar13 = *(uint *)param_3;
local_148 = *(uint *)param_3;
- pcVar14 = (char *)(ulonglong)local_148;
- puVar26 = (undefined4 *)local_1d8;
goto LAB_4;
}
switch(param_2) {
case 2:
- puVar24 = local_1d8;
- if (cVar8 != '\0') {
+ puVar20 = local_1d8;
+ if (cVar10 != '\0') {
if (((ulonglong)param_3 & 3) != 0) goto LAB_5;
- puVar24 = local_1d8;
+ puVar20 = local_1d8;
if ((undefined8 *)0x7ffffffeffff < param_3) goto LAB_6;
}
goto LAB_7;
case 3:
case 4:
case 5:
case 8:
case 0xb:
case 0xd:
case 0xe:
- if (cVar8 == '\0') goto LAB_3;
- puVar12 = param_3;
+ if (cVar10 == '\0') goto LAB_3;
+ puVar14 = param_3;
if ((undefined8 *)0x7ffffffeffff < param_3) {
- puVar12 = (undefined8 *)&DAT_2;
- }
- local_148 = *(uint *)puVar12;
- pcVar14 = (char *)(ulonglong)local_148;
- puVar26 = (undefined4 *)local_1d8;
+ puVar14 = (undefined8 *)&DAT_2;
+ }
+ puVar22 = (undefined4 *)local_1d8;
+ uVar13 = *(uint *)puVar14;
+ local_148 = *(uint *)puVar14;
break;
case 6:
case 7:
case 9:
- goto switchD_140271e3f_caseD_6;
+ goto switchD_140271bdf_caseD_6;
case 10:
- if ((cVar8 != '\0') && (((ulonglong)param_3 & 3) != 0)) {
+ if ((cVar10 != '\0') && (((ulonglong)param_3 & 3) != 0)) {
LAB_5:
/* WARNING: Subroutine does not return */
ExRaiseDatatypeMisalignment();
}
- local_148 = *(uint *)param_3;
+ uVar13 = *(uint *)param_3;
uStack_144 = *(uint *)((longlong)param_3 + 4);
uStack_140 = *(uint *)(param_3 + 1);
uStack_13c = *(uint *)((longlong)param_3 + 0xc);
- pcVar14 = (char *)(ulonglong)local_148;
- puVar26 = (undefined4 *)local_1d8;
+ puVar22 = (undefined4 *)local_1d8;
+ local_148 = uVar13;
break;
case 0xc:
- if (cVar8 != '\0') {
- puVar12 = param_3;
+ if (cVar10 != '\0') {
+ puVar14 = param_3;
if ((undefined8 *)0x7ffffffeffff < param_3) {
- puVar12 = (undefined8 *)&DAT_2;
- }
- *(uint *)puVar12 = *(uint *)puVar12;
- pcVar14 = (char *)(ulonglong)local_148;
- puVar26 = (undefined4 *)local_1d8;
+ puVar14 = (undefined8 *)&DAT_2;
+ }
+ *(uint *)puVar14 = *(uint *)puVar14;
+ puVar22 = (undefined4 *)local_1d8;
+ uVar13 = local_148;
break;
}
goto LAB_8;
case 0xf:
- if ((cVar8 != '\0') && (local_188 != 0)) {
+ if ((cVar10 != '\0') && (local_188 != 0)) {
if (((ulonglong)param_3 & 3) != 0) {
/* WARNING: Subroutine does not return */
ExRaiseDatatypeMisalignment();
}
if ((&DAT_2 < (undefined8 *)((longlong)param_3 + (ulonglong)local_188)) ||
((undefined8 *)((longlong)param_3 + (ulonglong)local_188) < param_3)) {
DAT_2 = 0;
}
}
RtlCopyMemory(&local_148,param_3,(ulonglong)local_188);
- pcVar14 = (char *)(ulonglong)local_148;
- puVar26 = (undefined4 *)local_1d8;
+ puVar22 = (undefined4 *)local_1d8;
+ uVar13 = local_148;
break;
default:
- pcVar6 = (code *)swi(0x29);
- (*pcVar6)();
- puVar25 = auStack_1d0;
+ pcVar8 = (code *)swi(0x29);
+ (*pcVar8)();
+ puVar21 = auStack_1d0;
LAB_6:
- puVar24 = puVar25;
+ puVar20 = puVar21;
LAB_7:
- *(undefined8 *)(puVar24 + 0x90) = *param_3;
+ *(undefined8 *)(puVar20 + 0x90) = *param_3;
LAB_8:
- pcVar14 = (char *)(ulonglong)*(uint *)(puVar24 + 0x90);
- puVar26 = (undefined4 *)puVar24;
+ puVar22 = (undefined4 *)puVar20;
+ uVar13 = *(uint *)(puVar20 + 0x90);
}
LAB_4:
- pcVar16 = (char *)0x0;
- *(undefined8 *)(puVar26 + 0x10) = 0;
- *(undefined8 *)(puVar26 + 10) = 0;
- *(undefined4 **)(puVar26 + 8) = puVar26 + 0x10;
- *(undefined8 *)(puVar26 + -2) = 0x140271bcb;
- uVar9 = ObReferenceObjectByHandle(param_1,4,ExpWorkerFactoryObjectType);
- if ((int)uVar9 < 0) goto LAB_0;
+ pcVar19 = (char *)0x0;
+ *(undefined8 *)(puVar22 + 0x10) = 0;
+ *(undefined8 *)(puVar22 + 10) = 0;
+ *(undefined4 **)(puVar22 + 8) = puVar22 + 0x10;
+ *(undefined8 *)(puVar22 + -2) = 0x14027196b;
+ uVar11 = ObReferenceObjectByHandle(param_1,4,ExpWorkerFactoryObjectType);
+ if ((int)uVar11 < 0) goto LAB_0;
if (param_2 == 8) {
- lVar17 = *(longlong *)(puVar26 + 0x10);
- plVar29 = (longlong *)(lVar17 + 0x10);
- if ((int)pcVar14 == 0) {
- pcVar14 = (char *)(ulonglong)KeNumberProcessors;
- lVar17 = *(longlong *)(puVar26 + 0x10);
- }
- *(int *)(*(longlong *)(*plVar29 + 8) + 0x2c) = (int)pcVar14;
- *(undefined8 *)(puVar26 + -2) = 0x1404897f5;
+ lVar17 = *(longlong *)(puVar22 + 0x10);
+ plVar26 = (longlong *)(lVar17 + 0x10);
+ if (uVar13 == 0) {
+ lVar17 = *(longlong *)(puVar22 + 0x10);
+ uVar13 = KeNumberProcessors;
+ }
+ *(uint *)(*(longlong *)(*plVar26 + 8) + 0x2c) = uVar13;
+ *(undefined8 *)(puVar22 + -2) = 0x140489849;
ObfDereferenceObjectWithTag(lVar17,0x746c6644);
goto LAB_0;
}
- uVar11 = 0;
- puVar26[0xd] = 0;
- *(undefined *)(puVar26 + 0xc) = 0;
- puVar26[0xe] = uVar9 & 0xffffff00;
- *(undefined *)((longlong)puVar26 + 0x4a) = 0;
- lVar17 = *(longlong *)(puVar26 + 0x10);
- plVar29 = *(longlong **)(lVar17 + 0x10);
- *(longlong **)(puVar26 + 0x18) = plVar29;
- *(undefined8 *)(puVar26 + 0x16) = 0;
- uVar32 = 2;
+ puVar22[0xd] = 0;
+ *(undefined *)(puVar22 + 0xc) = 0;
+ puVar22[0xe] = uVar11 & 0xffffff00;
+ *(undefined *)((longlong)puVar22 + 0x4a) = 0;
+ lVar17 = *(longlong *)(puVar22 + 0x10);
+ plVar26 = *(longlong **)(lVar17 + 0x10);
+ *(longlong **)(puVar22 + 0x18) = plVar26;
+ *(undefined8 *)(puVar22 + 0x16) = 0;
+ uVar28 = 2;
if (((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (in_CR8 < 0x10)) {
if (in_CR8 != 2) {
- uVar28 = (uint)(-1L << (in_CR8 + 1 & 0x3f)) & 4;
+ uVar25 = (uint)(-1L << (in_CR8 + 1 & 0x3f)) & 4;
}
*(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) =
- *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) | uVar28;
- pcVar14 = (char *)(ulonglong)(uint)puVar26[0x24];
- lVar17 = *(longlong *)(puVar26 + 0x10);
- }
- *(byte *)(puVar26 + 0x1a) = in_CR8;
+ *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) | uVar25;
+ uVar13 = puVar22[0x24];
+ lVar17 = *(longlong *)(puVar22 + 0x10);
+ }
+ *(byte *)(puVar22 + 0x1a) = in_CR8;
if ((DAT_9._2_1_ & 0x21) == 0) {
LOCK();
- lVar17 = *plVar29;
- *plVar29 = (longlong)(puVar26 + 0x16);
+ lVar17 = *plVar26;
+ *plVar26 = (longlong)(puVar22 + 0x16);
UNLOCK();
if (lVar17 != 0) {
- *(undefined8 *)(puVar26 + -2) = 0x140271fb5;
- KxWaitForLockOwnerShip(puVar26 + 0x16);
- }
- bVar31 = (byte)((ulonglong)lVar17 >> 8);
- lVar17 = *(longlong *)(puVar26 + 0x10);
- pcVar14 = (char *)(ulonglong)(uint)puVar26[0x24];
+ *(undefined8 *)(puVar22 + -2) = 0x140271d55;
+ KxWaitForLockOwnerShip(puVar22 + 0x16);
+ }
+ uVar18 = (undefined2)lVar17;
+ lVar17 = *(longlong *)(puVar22 + 0x10);
+ uVar13 = puVar22[0x24];
}
else {
- *(undefined8 *)(puVar26 + -2) = 0x140489809;
- KiAcquireQueuedSpinLockInstrumented(puVar26 + 0x16,plVar29);
- bVar31 = (byte)((ulonglong)plVar29 >> 8);
- }
- bVar20 = (byte)uVar32;
- uVar28 = (uint)pcVar14;
+ *(undefined8 *)(puVar22 + -2) = 0x14048985d;
+ KiAcquireQueuedSpinLockInstrumented(puVar22 + 0x16,plVar26);
+ uVar18 = SUB82(plVar26,0);
+ }
+ bVar27 = (byte)uVar28;
if (param_2 == 9) {
- if (uVar28 == 0) {
+ if (uVar13 == 0) {
if (*(int *)(lVar17 + 0x180) != *(int *)(lVar17 + 0x184)) {
*(int *)(lVar17 + 0x180) = *(int *)(lVar17 + 0x180) + 1;
goto LAB_10;
}
goto LAB_11;
}
- if (uVar28 == 1) {
- *(undefined *)(puVar26 + 0xc) = 0;
- cVar8 = '\x01';
- cVar21 = cVar8;
- }
- else if (uVar28 == 2) {
+ if (uVar13 == 1) {
+ *(undefined *)(puVar22 + 0xc) = 0;
+ cVar10 = '\x01';
+ cVar24 = cVar10;
+ }
+ else if (uVar13 == 2) {
if ((*(int *)(lVar17 + 0x180) == 0) ||
- (iVar10 = *(int *)(lVar17 + 0x180) + -1, *(int *)(lVar17 + 0x180) = iVar10, iVar10 != 0)) {
- cVar8 = (char)puVar26[0xe];
+ (iVar12 = *(int *)(lVar17 + 0x180) + -1, *(int *)(lVar17 + 0x180) = iVar12, iVar12 != 0)) {
+ cVar10 = (char)puVar22[0xe];
}
else {
- cVar8 = '\x01';
- }
- *(undefined *)(puVar26 + 0xc) = 0;
- cVar21 = '\x01';
+ cVar10 = '\x01';
+ }
+ *(undefined *)(puVar22 + 0xc) = 0;
+ cVar24 = '\x01';
}
else {
- if (uVar28 != 3) goto LAB_11;
+ if (uVar13 != 3) goto LAB_11;
if (*(int *)(lVar17 + 0x180) == 0) {
- cVar8 = (char)puVar26[0xe];
+ cVar10 = (char)puVar22[0xe];
}
else {
- *(undefined8 *)(puVar26 + -2) = 0x140489a85;
+ *(undefined8 *)(puVar22 + -2) = 0x140489ad9;
ExpRemoveCurrentThreadFromThreadHistory(lVar17);
- iVar10 = *(int *)(lVar17 + 0x180) + -1;
- *(int *)(lVar17 + 0x180) = iVar10;
+ iVar12 = *(int *)(lVar17 + 0x180) + -1;
+ *(int *)(lVar17 + 0x180) = iVar12;
*(int *)(lVar17 + 0x184) = *(int *)(lVar17 + 0x184) + -1;
- cVar8 = (char)puVar26[0xe];
- if (iVar10 == 0) {
- cVar8 = '\x01';
+ cVar10 = (char)puVar22[0xe];
+ if (iVar12 == 0) {
+ cVar10 = '\x01';
}
}
- *(undefined *)(puVar26 + 0xc) = 0;
- cVar21 = '\x01';
+ *(undefined *)(puVar22 + 0xc) = 0;
+ cVar24 = '\x01';
}
goto LAB_12;
}
+ if (0xd < param_2 - 2U) {
+ pcVar8 = (code *)swi(0x29);
+ (*pcVar8)(0x25);
+ in(uVar18);
+ /* WARNING: Bad instruction - Truncating control flow here */
+ halt_baddata();
+ }
+ uVar25 = 0;
switch(param_2) {
case 2:
- if (*(longlong *)(puVar26 + 0x24) < 0) {
- if (-10000000 < *(longlong *)(puVar26 + 0x24)) {
- *(undefined8 *)(puVar26 + 0x24) = 0xffffffffff676980;
- }
- if (*(longlong *)(puVar26 + 0x24) < -6000000000) {
- *(undefined8 *)(puVar26 + 0x24) = 0xfffffffe9a5f4400;
- }
- lVar4 = *(longlong *)(puVar26 + 0x24);
- *(longlong *)(lVar17 + 0x70) = lVar4;
- *(undefined8 *)(puVar26 + 0x20) = 0xffffffffffffffff;
- *(undefined8 *)(puVar26 + -2) = 0x14027204b;
- KeSetTimer2(lVar17 + 0x1a8,lVar4,-lVar4);
+ if (*(longlong *)(puVar22 + 0x24) < 0) {
+ if (-10000000 < *(longlong *)(puVar22 + 0x24)) {
+ *(undefined8 *)(puVar22 + 0x24) = 0xffffffffff676980;
+ }
+ if (*(longlong *)(puVar22 + 0x24) < -6000000000) {
+ *(undefined8 *)(puVar22 + 0x24) = 0xfffffffe9a5f4400;
+ }
+ lVar3 = *(longlong *)(puVar22 + 0x24);
+ *(longlong *)(lVar17 + 0x70) = lVar3;
+ *(undefined8 *)(puVar22 + 0x20) = 0xffffffffffffffff;
+ *(undefined8 *)(puVar22 + -2) = 0x140271deb;
+ KeSetTimer2(lVar17 + 0x1a8,lVar3,-lVar3);
goto LAB_10;
}
goto LAB_11;
case 3:
- uVar9 = *(uint *)(lVar17 + 0x194);
- if ((int)uVar28 < 0) {
- if (-uVar28 < uVar9) {
- uVar11 = uVar9 + uVar28;
- *(uint *)(lVar17 + 0x194) = uVar11;
+ uVar11 = *(uint *)(lVar17 + 0x194);
+ if ((int)uVar13 < 0) {
+ if (-uVar13 < uVar11) {
+ uVar25 = uVar11 + uVar13;
+ *(uint *)(lVar17 + 0x194) = uVar25;
}
else {
*(undefined4 *)(lVar17 + 0x194) = 0;
}
}
else {
- uVar11 = uVar9 + uVar28;
- if (uVar9 < uVar11) {
- *(uint *)(lVar17 + 0x194) = uVar11;
+ uVar25 = uVar11 + uVar13;
+ if (uVar11 < uVar25) {
+ *(uint *)(lVar17 + 0x194) = uVar25;
}
else {
*(undefined4 *)(lVar17 + 0x194) = 0xffffffff;
- uVar11 = 0xffffffff;
- }
- }
- if (uVar9 == 0) {
- if (uVar11 == 0) goto LAB_13;
- *(undefined8 *)(puVar26 + -2) = 0x140271f7e;
- cVar8 = ExpTryEnterWorkerFactoryAwayMode(lVar17);
- if (cVar8 == '\0') goto LAB_10;
- *(undefined8 *)(puVar26 + -2) = 0x1402722ba;
- ExpWorkerFactoryCheckCreate(lVar17,puVar26 + 0x16,0);
- cVar21 = '\0';
- }
- else if ((uVar11 == 0) && ((*(uint *)(lVar17 + 0x198) & 0x200) != 0)) {
- *(undefined8 *)(puVar26 + -2) = 0x14027232d;
+ uVar25 = 0xffffffff;
+ }
+ }
+ if (uVar11 == 0) {
+ if (uVar25 == 0) goto LAB_13;
+ *(undefined8 *)(puVar22 + -2) = 0x140271d1e;
+ cVar10 = ExpTryEnterWorkerFactoryAwayMode(lVar17);
+ if (cVar10 == '\0') goto LAB_10;
+ *(undefined8 *)(puVar22 + -2) = 0x14027205a;
+ ExpWorkerFactoryCheckCreate(lVar17,puVar22 + 0x16,0);
+ cVar24 = '\0';
+ }
+ else if ((uVar25 == 0) && ((*(uint *)(lVar17 + 0x198) & 0x200) != 0)) {
+ *(undefined8 *)(puVar22 + -2) = 0x1402720cd;
ExpLeaveWorkerFactoryAwayMode(lVar17);
- cVar21 = '\x01';
+ cVar24 = '\x01';
}
else {
LAB_13:
- cVar21 = '\x01';
+ cVar24 = '\x01';
}
goto LAB_14;
case 4:
- *(longlong **)(puVar26 + 0x14) = (longlong *)(lVar17 + 0x10);
- cVar8 = (char)puVar26[0xe];
+ *(longlong **)(puVar22 + 0x14) = (longlong *)(lVar17 + 0x10);
+ cVar10 = (char)puVar22[0xe];
if (*(char *)(*(longlong *)(lVar17 + 0x10) + 0x21) == '\0') {
puVar1 = (uint *)(lVar17 + 0x178);
- if (*puVar1 < uVar28) {
- cVar8 = '\x01';
- }
- *puVar1 = uVar28;
- if (*(uint *)(lVar17 + 0x17c) < uVar28) {
- *(uint *)(lVar17 + 0x17c) = uVar28;
- }
- if (cVar8 == '\0') {
- cVar21 = '\x01';
- cVar8 = '\0';
+ if (*puVar1 < uVar13) {
+ cVar10 = '\x01';
+ }
+ *puVar1 = uVar13;
+ if (*(uint *)(lVar17 + 0x17c) < uVar13) {
+ *(uint *)(lVar17 + 0x17c) = uVar13;
+ }
+ if (cVar10 == '\0') {
+ cVar24 = '\x01';
+ cVar10 = '\0';
}
else {
- cVar8 = '\0';
+ cVar10 = '\0';
if ((*(uint *)(lVar17 + 0x198) & 0x200) != 0) {
- *(undefined8 *)(puVar26 + -2) = 0x140272367;
+ *(undefined8 *)(puVar22 + -2) = 0x140272107;
ExpLeaveWorkerFactoryAwayMode(lVar17);
}
- bVar20 = (byte)uVar32;
- *(int **)(puVar26 + 0xe) = (int *)(lVar17 + 0x188);
- *(int **)(puVar26 + 0x1c) = (int *)(lVar17 + 0x180);
+ bVar27 = (byte)uVar28;
+ *(int **)(puVar22 + 0xe) = (int *)(lVar17 + 0x188);
+ *(int **)(puVar22 + 0x1c) = (int *)(lVar17 + 0x180);
if ((uint)(*(int *)(lVar17 + 0x180) + *(int *)(lVar17 + 0x188)) < *puVar1) {
piVar2 = (int *)(lVar17 + 400);
do {
- bVar31 = (byte)uVar32;
+ bVar27 = (byte)uVar28;
*piVar2 = *piVar2 + 1;
- *(undefined8 *)(puVar26 + -2) = 0x140272155;
- KxReleaseQueuedSpinLock(puVar26 + 0x16);
- pvVar7 = FiberData;
- uVar32 = (ulonglong)*(byte *)(puVar26 + 0x1a);
- if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar31 < 0x10)) &&
- ((*(byte *)(puVar26 + 0x1a) < 0x10 && (1 < bVar31)))) {
- uVar28 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
- ~((uint)(-1L << (*(char *)(puVar26 + 0x1a) + 1U & 0x3f)) & 0xffff);
- *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar28;
- if (uVar28 == 0) {
- *(undefined8 *)(puVar26 + -2) = 0x140489934;
- KiRemoveSystemWorkPriorityKick(pvVar7);
+ *(undefined8 *)(puVar22 + -2) = 0x140271ef5;
+ KxReleaseQueuedSpinLock(puVar22 + 0x16);
+ pvVar9 = FiberData;
+ uVar28 = (ulonglong)*(byte *)(puVar22 + 0x1a);
+ if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar27 < 0x10)) &&
+ ((*(byte *)(puVar22 + 0x1a) < 0x10 && (1 < bVar27)))) {
+ uVar25 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
+ ~((uint)(-1L << (*(char *)(puVar22 + 0x1a) + 1U & 0x3f)) & 0xffff);
+ *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar25;
+ if (uVar25 == 0) {
+ *(undefined8 *)(puVar22 + -2) = 0x140489988;
+ KiRemoveSystemWorkPriorityKick(pvVar9);
}
- lVar17 = *(longlong *)(puVar26 + 0x10);
+ lVar17 = *(longlong *)(puVar22 + 0x10);
}
- *(undefined8 *)(puVar26 + -2) = 0x140272175;
- iVar10 = ExpWorkerFactoryCreateThread(lVar17);
- uVar15 = **(undefined8 **)(puVar26 + 0x14);
- *(undefined8 *)(puVar26 + -2) = 0x14027218a;
- KeAcquireInStackQueuedSpinLock(uVar15,puVar26 + 0x16);
- bVar20 = (byte)uVar32;
- if (iVar10 < 0) {
+ *(undefined8 *)(puVar22 + -2) = 0x140271f15;
+ iVar12 = ExpWorkerFactoryCreateThread(lVar17);
+ uVar7 = **(undefined8 **)(puVar22 + 0x14);
+ *(undefined8 *)(puVar22 + -2) = 0x140271f2a;
+ KeAcquireInStackQueuedSpinLock(uVar7,puVar22 + 0x16);
+ bVar27 = (byte)uVar28;
+ if (iVar12 < 0) {
*(int *)(lVar17 + 400) = *(int *)(lVar17 + 400) + -1;
break;
}
- } while ((uint)(**(int **)(puVar26 + 0xe) + **(int **)(puVar26 + 0x1c)) < *puVar1);
+ } while ((uint)(**(int **)(puVar22 + 0xe) + **(int **)(puVar22 + 0x1c)) < *puVar1);
}
LAB_15:
- cVar21 = '\x01';
+ cVar24 = '\x01';
}
}
else {
- cVar21 = '\x01';
+ cVar24 = '\x01';
}
break;
case 5:
- lVar4 = *(longlong *)(lVar17 + 0x10);
- if (*(char *)(lVar4 + 0x21) != '\0') goto LAB_11;
- *(undefined *)(puVar26 + 0xc) = 1;
- if ((uVar28 == 0) ||
- (((*(int *)(lVar17 + 0x17c) != 0 || (*(int *)(lVar4 + 0x18) == 0)) &&
- (*(int *)(*(longlong *)(lVar4 + 8) + 4) < 1)))) {
- cVar8 = (char)puVar26[0xe];
+ lVar3 = *(longlong *)(lVar17 + 0x10);
+ if (*(char *)(lVar3 + 0x21) != '\0') goto LAB_11;
+ *(undefined *)(puVar22 + 0xc) = 1;
+ if ((uVar13 == 0) ||
+ (((*(int *)(lVar17 + 0x17c) != 0 || (*(int *)(lVar3 + 0x18) == 0)) &&
+ (*(int *)(*(longlong *)(lVar3 + 8) + 4) < 1)))) {
+ cVar10 = (char)puVar22[0xe];
}
else {
- cVar8 = '\x01';
- }
- *(uint *)(lVar17 + 0x17c) = uVar28;
- if (*(uint *)(lVar17 + 0x178) <= uVar28) goto LAB_15;
- *(uint *)(lVar17 + 0x178) = uVar28;
- cVar21 = '\x01';
- break;
- case 6:
- case 7:
- case 8:
- case 9:
- switchD_140271e3f_caseD_6:
- pcVar14 = (char *)(longlong)(param_2 + -2);
- cVar8 = (char)(param_2 + -2);
- *pcVar16 = *pcVar16 + cVar8;
- *pcVar14 = *pcVar14 + cVar8;
- *(char *)((longlong)pcVar14 * 2) = *(char *)((longlong)pcVar14 * 2) + cVar8;
- *pcVar14 = *pcVar14 + cVar8;
+ cVar10 = '\x01';
+ }
+ *(uint *)(lVar17 + 0x17c) = uVar13;
+ if (*(uint *)(lVar17 + 0x178) <= uVar13) goto LAB_15;
+ *(uint *)(lVar17 + 0x178) = uVar13;
+ cVar24 = '\x01';
+ break;
+ default:
+ switchD_140271bdf_caseD_6:
+ pcVar16 = (char *)(longlong)(param_2 + -2);
+ cVar10 = (char)(param_2 + -2);
+ *pcVar19 = *pcVar19 + cVar10;
+ *pcVar16 = *pcVar16 + cVar10;
+ *(char *)((longlong)pcVar16 * 2) = *(char *)((longlong)pcVar16 * 2) + cVar10;
+ *pcVar16 = *pcVar16 + cVar10;
/* WARNING: Bad instruction - Truncating control flow here */
halt_baddata();
case 10:
- cVar8 = (char)puVar26[0xe];
- cVar21 = '\x01';
+ cVar10 = (char)puVar22[0xe];
+ cVar24 = '\x01';
if (*(char *)(*(longlong *)(lVar17 + 0x10) + 0x21) == '\0') {
- *(undefined8 *)(lVar17 + 0x40) = *(undefined8 *)(puVar26 + 0x26);
- *(undefined8 *)(lVar17 + 0x38) = *(undefined8 *)(puVar26 + 0x24);
+ *(undefined8 *)(lVar17 + 0x40) = *(undefined8 *)(puVar22 + 0x26);
+ *(undefined8 *)(lVar17 + 0x38) = *(undefined8 *)(puVar22 + 0x24);
}
break;
case 0xb:
- *(uint *)(lVar17 + 0x19c) = uVar28;
+ *(uint *)(lVar17 + 0x19c) = uVar13;
goto LAB_11;
case 0xc:
+ uVar13 = 0;
if (*(int *)(lVar17 + 400) == 0) {
- uVar28 = *(uint *)(lVar17 + 0x180);
- uVar9 = *(uint *)(lVar17 + 0x178);
- if (uVar9 < uVar28) {
- uVar15 = *(undefined8 *)(*(longlong *)(lVar17 + 0x10) + 8);
- *(undefined8 *)(puVar26 + -2) = 0x140272240;
- uVar11 = KeTimeOutQueueWaiters(uVar15,0,uVar28 - uVar9);
- }
- }
- *(undefined8 *)(puVar26 + -2) = 0x14027224d;
- KxReleaseQueuedSpinLock(puVar26 + 0x16);
- pvVar7 = FiberData;
- bVar31 = *(byte *)(puVar26 + 0x1a);
- if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar20 < 0x10)) &&
- ((bVar31 < 0x10 && (1 < bVar20)))) {
- uVar28 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
- ~((uint)(-1L << (*(char *)(puVar26 + 0x1a) + 1U & 0x3f)) & 0xffff);
- *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar28;
- if (uVar28 == 0) {
- *(undefined8 *)(puVar26 + -2) = 0x140489870;
- KiRemoveSystemWorkPriorityKick(pvVar7);
- }
- lVar17 = *(longlong *)(puVar26 + 0x10);
- }
- cVar21 = '\0';
- *(uint *)param_3 = uVar11;
- cVar8 = (char)puVar26[0xe];
- bVar20 = bVar31;
+ uVar11 = *(uint *)(lVar17 + 0x180);
+ uVar5 = *(uint *)(lVar17 + 0x178);
+ uVar13 = uVar25;
+ if (uVar5 < uVar11) {
+ uVar7 = *(undefined8 *)(*(longlong *)(lVar17 + 0x10) + 8);
+ *(undefined8 *)(puVar22 + -2) = 0x140271fe0;
+ uVar13 = KeTimeOutQueueWaiters(uVar7,0,uVar11 - uVar5);
+ }
+ }
+ *(undefined8 *)(puVar22 + -2) = 0x140271fed;
+ KxReleaseQueuedSpinLock(puVar22 + 0x16);
+ pvVar9 = FiberData;
+ bVar4 = *(byte *)(puVar22 + 0x1a);
+ if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar27 < 0x10)) &&
+ ((bVar4 < 0x10 && (1 < bVar27)))) {
+ uVar25 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
+ ~((uint)(-1L << (*(char *)(puVar22 + 0x1a) + 1U & 0x3f)) & 0xffff);
+ *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar25;
+ if (uVar25 == 0) {
+ *(undefined8 *)(puVar22 + -2) = 0x1404898c4;
+ KiRemoveSystemWorkPriorityKick(pvVar9);
+ }
+ lVar17 = *(longlong *)(puVar22 + 0x10);
+ }
+ cVar24 = '\0';
+ *(uint *)param_3 = uVar13;
+ cVar10 = (char)puVar22[0xe];
+ bVar27 = bVar4;
break;
case 0xd:
- if (((ulonglong)pcVar14 & 1) == 0) {
- uVar28 = 0;
- }
- else {
- uVar28 = 0x800;
- }
- *(uint *)(lVar17 + 0x198) = *(uint *)(lVar17 + 0x198) & 0xfffff7ff | uVar28;
+ if ((uVar13 & 1) != 0) {
+ uVar25 = 0x800;
+ }
+ *(uint *)(lVar17 + 0x198) = *(uint *)(lVar17 + 0x198) & 0xfffff7ff | uVar25;
LAB_10:
- cVar21 = '\x01';
+ cVar24 = '\x01';
goto LAB_14;
case 0xe:
if ((*(char *)(*(longlong *)(lVar17 + 0x10) + 0x21) != '\0') ||
- (*(uint *)(lVar17 + 0x18c) = uVar28, uVar28 == 0)) goto LAB_11;
- if (uVar28 < *(uint *)(lVar17 + 0x178)) {
+ (*(uint *)(lVar17 + 0x18c) = uVar13, uVar13 == 0)) goto LAB_11;
+ if (uVar13 < *(uint *)(lVar17 + 0x178)) {
*(uint *)(lVar17 + 0x18c) = *(uint *)(lVar17 + 0x178);
goto LAB_13;
}
- cVar8 = (char)puVar26[0xe];
- if (uVar28 <= *(uint *)(lVar17 + 0x17c)) goto LAB_15;
+ cVar10 = (char)puVar22[0xe];
+ if (uVar13 <= *(uint *)(lVar17 + 0x17c)) goto LAB_15;
*(uint *)(lVar17 + 0x18c) = *(uint *)(lVar17 + 0x17c);
- cVar21 = '\x01';
+ cVar24 = '\x01';
break;
case 0xf:
if ((*(char *)(*(longlong *)(lVar17 + 0x10) + 0x21) == '\0') &&
((*(uint *)(lVar17 + 0x198) & 0x8000) == 0)) {
- uVar28 = puVar26[0x14];
- *(undefined8 *)(puVar26 + -2) = 0x1404899f4;
- iVar10 = KiValidateCpuSetMasks(puVar26 + 0x24);
- if (-1 < iVar10) {
- *(undefined8 *)(puVar26 + -2) = 0x140489a0c;
+ uVar25 = puVar22[0x14];
+ *(undefined8 *)(puVar22 + -2) = 0x140489a48;
+ iVar12 = KiValidateCpuSetMasks(puVar22 + 0x24);
+ if (-1 < iVar12) {
+ *(undefined8 *)(puVar22 + -2) = 0x140489a60;
memset((void *)(lVar17 + 0x78),0,0x100);
- *(undefined8 *)(puVar26 + -2) = 0x140489a20;
- RtlCopyMemory((void *)(lVar17 + 0x78),puVar26 + 0x24,(ulonglong)uVar28);
+ *(undefined8 *)(puVar22 + -2) = 0x140489a74;
+ RtlCopyMemory((void *)(lVar17 + 0x78),puVar22 + 0x24,(ulonglong)uVar25);
*(uint *)(lVar17 + 0x198) = *(uint *)(lVar17 + 0x198) | 0x4000;
- cVar21 = '\x01';
+ cVar24 = '\x01';
goto LAB_14;
}
}
LAB_11:
- cVar21 = '\x01';
+ cVar24 = '\x01';
LAB_14:
- cVar8 = (char)puVar26[0xe];
- break;
- default:
- bVar23 = 0x25;
- pcVar6 = (code *)swi(0x29);
- uVar15 = (*pcVar6)();
- bVar19 = (byte)((ulonglong)uVar15 >> 8);
- uVar22 = (undefined6)((ulonglong)uVar15 >> 0x10);
- cVar8 = (char)uVar15;
- bVar18 = (bVar19 - *pcVar14) - CARRY1(bRam0000000000000000,bVar19);
- bVar20 = bRam0000000000000000 + bVar19 + bVar18;
- bVar19 = (bVar18 - *pcVar14) - CARRY1(bRam0000000000000000 + bVar19,bVar18);
- bRam0000000000000000 = bVar20 + bVar19;
- bVar20 = (bVar19 - *pcVar14) - CARRY1(bVar20,bVar19);
- pcVar16 = (char *)CONCAT62(uVar22,CONCAT11(bVar20,cVar8));
- *pcVar16 = *pcVar16 + cVar8;
- *pcVar16 = *pcVar16 + cVar8;
- *pcVar16 = *pcVar16 + cVar8;
- *pcVar16 = *pcVar16 + cVar8;
- bVar30 = CARRY1(bRam0000000000000000,bVar20);
- bRam0000000000000000 = bRam0000000000000000 + bVar20;
- cVar21 = (bVar20 - *pcVar14) - bVar30;
- pcVar16 = (char *)CONCAT62(uVar22,CONCAT11(cVar21,cVar8));
- *pcVar16 = *pcVar16 + cVar8;
- *pcVar16 = *pcVar16 + cVar8;
- pbVar3 = (byte *)(unaff_RBP + 0x2300271a);
- bVar20 = *pbVar3;
- *pbVar3 = *pbVar3 + bVar23;
- bVar20 = (((cVar21 - *pcVar14) - CARRY1(bVar20,bVar23)) - *pcVar14) - CARRY1(bVar31,bVar23);
- bVar31 = bRam0000000000000000 + bVar20;
- bVar20 = (bVar20 - *pcVar14) - CARRY1(bRam0000000000000000,bVar20);
- bRam0000000000000000 = bVar31 + bVar20;
- pcVar16 = (char *)CONCAT62(uVar22,CONCAT11((bVar20 - *pcVar14) - CARRY1(bVar31,bVar20),cVar8));
- *pcVar16 = *pcVar16 + bVar23;
- pcVar16[-0x47ffb769] = pcVar16[-0x47ffb769];
- *(char *)((ulonglong)pcVar16 & 0xffffffff) =
- *(char *)((ulonglong)pcVar16 & 0xffffffff) + (char)pcVar14;
- /* WARNING: Bad instruction - Truncating control flow here */
- halt_baddata();
+ cVar10 = (char)puVar22[0xe];
}
LAB_12:
- if (cVar8 != '\0') {
+ if (cVar10 != '\0') {
if ((((*(char *)(*(longlong *)(lVar17 + 0x10) + 0x21) == '\0') &&
(*(uint *)(lVar17 + 0x180) < *(uint *)(lVar17 + 0x17c))) && (*(int *)(lVar17 + 400) == 0))
&& (*(int *)(lVar17 + 0x188) + *(uint *)(lVar17 + 0x180) < *(uint *)(lVar17 + 0x17c))) {
if ((*(uint *)(lVar17 + 0x198) & 0x200) != 0) {
- *(undefined8 *)(puVar26 + -2) = 0x140271f02;
+ *(undefined8 *)(puVar22 + -2) = 0x140271ca2;
ExpLeaveWorkerFactoryAwayMode(lVar17);
}
*(int *)(lVar17 + 400) = *(int *)(lVar17 + 400) + 1;
- *(undefined8 *)(puVar26 + -2) = 0x140271f13;
- KxReleaseQueuedSpinLock(puVar26 + 0x16);
- pvVar7 = FiberData;
- bVar31 = *(byte *)(puVar26 + 0x1a);
+ *(undefined8 *)(puVar22 + -2) = 0x140271cb3;
+ KxReleaseQueuedSpinLock(puVar22 + 0x16);
+ pvVar9 = FiberData;
+ bVar4 = *(byte *)(puVar22 + 0x1a);
if (((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) &&
- ((bVar20 < 0x10 && ((bVar31 < 0x10 && (1 < bVar20)))))) {
- uVar28 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
- ~((uint)(-1L << (*(char *)(puVar26 + 0x1a) + 1U & 0x3f)) & 0xffff);
- *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar28;
- if (uVar28 == 0) {
- *(undefined8 *)(puVar26 + -2) = 0x140489b58;
- KiRemoveSystemWorkPriorityKick(pvVar7);
+ ((bVar27 < 0x10 && ((bVar4 < 0x10 && (1 < bVar27)))))) {
+ uVar25 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
+ ~((uint)(-1L << (*(char *)(puVar22 + 0x1a) + 1U & 0x3f)) & 0xffff);
+ *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar25;
+ if (uVar25 == 0) {
+ *(undefined8 *)(puVar22 + -2) = 0x140489bac;
+ KiRemoveSystemWorkPriorityKick(pvVar9);
}
- lVar17 = *(longlong *)(puVar26 + 0x10);
- }
- cVar21 = '\0';
- *(undefined8 *)(puVar26 + -2) = 0x140271f35;
- bVar20 = bVar31;
- iVar10 = ExpWorkerFactoryCreateThread(lVar17);
- if (iVar10 < 0) {
- cVar21 = '\x01';
- uVar15 = *(undefined8 *)(lVar17 + 0x10);
- *(undefined8 *)(puVar26 + -2) = 0x140489b73;
- KeAcquireInStackQueuedSpinLock(uVar15,puVar26 + 0x16);
+ lVar17 = *(longlong *)(puVar22 + 0x10);
+ }
+ cVar24 = '\0';
+ *(undefined8 *)(puVar22 + -2) = 0x140271cd5;
+ bVar27 = bVar4;
+ iVar12 = ExpWorkerFactoryCreateThread(lVar17);
+ if (iVar12 < 0) {
+ cVar24 = '\x01';
+ uVar7 = *(undefined8 *)(lVar17 + 0x10);
+ *(undefined8 *)(puVar22 + -2) = 0x140489bc7;
+ KeAcquireInStackQueuedSpinLock(uVar7,puVar22 + 0x16);
*(int *)(lVar17 + 400) = *(int *)(lVar17 + 400) + -1;
}
}
}
- if (cVar21 != '\0') {
+ if (cVar24 != '\0') {
if ((DAT_9._2_1_ & 1) == 0) {
- lVar17 = *(longlong *)(puVar26 + 0x16);
+ lVar17 = *(longlong *)(puVar22 + 0x16);
if (lVar17 == 0) {
LOCK();
- puVar13 = (undefined4 *)**(longlong **)(puVar26 + 0x18);
- if (puVar26 + 0x16 == puVar13) {
- **(longlong **)(puVar26 + 0x18) = 0;
- puVar13 = puVar26 + 0x16;
+ puVar15 = (undefined4 *)**(longlong **)(puVar22 + 0x18);
+ if (puVar22 + 0x16 == puVar15) {
+ **(longlong **)(puVar22 + 0x18) = 0;
+ puVar15 = puVar22 + 0x16;
}
UNLOCK();
- if (puVar13 != puVar26 + 0x16) {
- *(undefined8 *)(puVar26 + -2) = 0x140271fc7;
- lVar17 = KxWaitForLockChainValid(puVar26 + 0x16);
+ if (puVar15 != puVar22 + 0x16) {
+ *(undefined8 *)(puVar22 + -2) = 0x140271d67;
+ lVar17 = KxWaitForLockChainValid(puVar22 + 0x16);
goto LAB_16;
}
}
else {
LAB_16:
- *(undefined8 *)(puVar26 + 0x16) = 0;
- uVar5 = *(undefined8 *)(puVar26 + 0x18);
- puVar12 = (undefined8 *)(lVar17 + 8);
+ *(undefined8 *)(puVar22 + 0x16) = 0;
+ uVar6 = *(undefined8 *)(puVar22 + 0x18);
+ puVar14 = (undefined8 *)(lVar17 + 8);
LOCK();
- uVar15 = *puVar12;
- *puVar12 = uVar5;
+ uVar7 = *puVar14;
+ *puVar14 = uVar6;
UNLOCK();
- if ((((byte)uVar15 ^ (byte)uVar5) & 4) != 0) {
+ if ((((byte)uVar7 ^ (byte)uVar6) & 4) != 0) {
LOCK();
- *puVar26 = *puVar26;
+ *puVar22 = *puVar22;
UNLOCK();
LOCK();
- uVar15 = *(undefined8 *)
- (&KiHaltOnAddressHashTable +
- (ulonglong)((uint)((ulonglong)puVar12 >> 5) & 0x7f) * 8);
+ uVar7 = *(undefined8 *)
+ (&KiHaltOnAddressHashTable +
+ (ulonglong)((uint)((ulonglong)puVar14 >> 5) & 0x7f) * 8);
*(undefined8 *)
- (&KiHaltOnAddressHashTable + (ulonglong)((uint)((ulonglong)puVar12 >> 5) & 0x7f) * 8) = 0
+ (&KiHaltOnAddressHashTable + (ulonglong)((uint)((ulonglong)puVar14 >> 5) & 0x7f) * 8) = 0
;
UNLOCK();
- *(undefined8 *)(puVar26 + -2) = 0x140489bc5;
- KiHaltOnAddressWakeEntireList(uVar15);
+ *(undefined8 *)(puVar22 + -2) = 0x140489c19;
+ KiHaltOnAddressWakeEntireList(uVar7);
}
}
- lVar17 = *(longlong *)(puVar26 + 0x10);
+ lVar17 = *(longlong *)(puVar22 + 0x10);
}
else {
- *(undefined8 *)(puVar26 + -2) = 0x140489b9c;
- KiReleaseQueuedSpinLockInstrumented(puVar26 + 0x16,*(undefined8 *)(puVar26 + 0x76));
- }
- pvVar7 = FiberData;
- if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar20 < 0x10)) &&
- ((*(byte *)(puVar26 + 0x1a) < 0x10 && (1 < bVar20)))) {
- uVar28 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
- ~((uint)(-1L << (*(char *)(puVar26 + 0x1a) + 1U & 0x3f)) & 0xffff);
- *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar28;
- if (uVar28 == 0) {
- *(undefined8 *)(puVar26 + -2) = 0x140489c29;
- KiRemoveSystemWorkPriorityKick(pvVar7);
- }
- lVar17 = *(longlong *)(puVar26 + 0x10);
- }
- }
- plVar29 = (longlong *)(lVar17 + -0x30);
+ *(undefined8 *)(puVar22 + -2) = 0x140489bf0;
+ KiReleaseQueuedSpinLockInstrumented(puVar22 + 0x16,*(undefined8 *)(puVar22 + 0x76));
+ }
+ pvVar9 = FiberData;
+ if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar27 < 0x10)) &&
+ ((*(byte *)(puVar22 + 0x1a) < 0x10 && (1 < bVar27)))) {
+ uVar25 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
+ ~((uint)(-1L << (*(char *)(puVar22 + 0x1a) + 1U & 0x3f)) & 0xffff);
+ *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar25;
+ if (uVar25 == 0) {
+ *(undefined8 *)(puVar22 + -2) = 0x140489c7d;
+ KiRemoveSystemWorkPriorityKick(pvVar9);
+ }
+ lVar17 = *(longlong *)(puVar22 + 0x10);
+ }
+ }
+ plVar26 = (longlong *)(lVar17 + -0x30);
if (ObpTraceFlags != 0) {
- *(undefined8 *)(puVar26 + -2) = 0x140489c46;
- ObpPushStackInfo(plVar29,0,1,0x746c6644);
+ *(undefined8 *)(puVar22 + -2) = 0x140489c9a;
+ ObpPushStackInfo(plVar26,0,1,0x746c6644);
}
LOCK();
- lVar4 = *plVar29;
- *plVar29 = *plVar29 + -1;
+ lVar3 = *plVar26;
+ *plVar26 = *plVar26 + -1;
UNLOCK();
- lVar27 = lVar4 + -1;
- if (lVar27 == 0 || lVar4 < 1) {
+ lVar23 = lVar3 + -1;
+ if (lVar23 == 0 || lVar3 < 1) {
if (*(longlong *)(lVar17 + -0x28) != 0) {
- bVar31 = *(byte *)(lVar17 + -0x18);
- *(longlong *)(puVar26 + 8) = *(longlong *)(lVar17 + -0x28);
- uVar15 = *(undefined8 *)
- (&ObTypeIndexTable +
- ((ulonglong)plVar29 >> 8 & 0xff ^ (ulonglong)bVar31 ^ (ulonglong)ObHeaderCookie) * 8
- );
+ bVar27 = *(byte *)(lVar17 + -0x18);
+ *(longlong *)(puVar22 + 8) = *(longlong *)(lVar17 + -0x28);
+ uVar7 = *(undefined8 *)
+ (&ObTypeIndexTable +
+ ((ulonglong)plVar26 >> 8 & 0xff ^ (ulonglong)bVar27 ^ (ulonglong)ObHeaderCookie) * 8)
+ ;
/* WARNING: Subroutine does not return */
- *(undefined **)(puVar26 + -2) = &UNK_17;
- KeBugCheckEx(0x18,uVar15,*(undefined8 *)(puVar26 + 0x10),1);
- }
- if (lVar27 < 0) {
- *(longlong *)(puVar26 + 8) = lVar27;
+ *(undefined **)(puVar22 + -2) = &UNK_17;
+ KeBugCheckEx(0x18,uVar7,*(undefined8 *)(puVar22 + 0x10),1);
+ }
+ if (lVar23 < 0) {
+ *(longlong *)(puVar22 + 8) = lVar23;
/* WARNING: Subroutine does not return */
- *(undefined **)(puVar26 + -2) = &UNK_18;
- KeBugCheckEx(0x18,0,*(undefined8 *)(puVar26 + 0x10),2);
- }
- *(undefined8 *)(puVar26 + -2) = 0x140489cbd;
- cVar8 = KeAreAllApcsDisabled();
- if (cVar8 == '\0') {
- *(undefined8 *)(puVar26 + -2) = 0x140489cc9;
+ *(undefined **)(puVar22 + -2) = &UNK_18;
+ KeBugCheckEx(0x18,0,*(undefined8 *)(puVar22 + 0x10),2);
+ }
+ *(undefined8 *)(puVar22 + -2) = 0x140489d11;
+ cVar10 = KeAreAllApcsDisabled();
+ if (cVar10 == '\0') {
+ *(undefined8 *)(puVar22 + -2) = 0x140489d1d;
lVar17 = OBJECT_HEADER_TO_HANDLE_REVOCATION_INFO();
if (lVar17 != 0) {
- *(undefined8 *)(puVar26 + -2) = 0x140489cd6;
+ *(undefined8 *)(puVar22 + -2) = 0x140489d2a;
ObpHandleRevocationBlockRemoveObject(lVar17);
}
if (ObpTraceFlags != 0) {
- *(undefined8 *)(puVar26 + -2) = 0x140489ce7;
- ObpDeregisterObject(plVar29);
- }
- *(undefined8 *)(puVar26 + -2) = 0x140489cf1;
- ObpRemoveObjectRoutine(plVar29,0);
+ *(undefined8 *)(puVar22 + -2) = 0x140489d3b;
+ ObpDeregisterObject(plVar26);
+ }
+ *(undefined8 *)(puVar22 + -2) = 0x140489d45;
+ ObpRemoveObjectRoutine(plVar26,0);
}
else {
- *(undefined8 *)(puVar26 + -2) = 0x140489cfc;
- ObpDeferObjectDeletion(plVar29);
+ *(undefined8 *)(puVar22 + -2) = 0x140489d50;
+ ObpDeferObjectDeletion(plVar26);
}
}
LAB_0:
- *(undefined8 *)((longlong)puVar26 + -8) = 0x140271d79;
- __security_check_cookie(*(ulonglong *)((longlong)puVar26 + 400) ^ (ulonglong)puVar26);
+ *(undefined8 *)((longlong)puVar22 + -8) = 0x140271b19;
+ __security_check_cookie(*(ulonglong *)((longlong)puVar22 + 400) ^ (ulonglong)puVar22);
return;
}
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
code,length,address,called
ratio
0.37
i_ratio
0.43
m_ratio
0.8
b_ratio
0.87
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
VrpBuildKeyPath
VrpBuildKeyPath
fullname
VrpBuildKeyPath
VrpBuildKeyPath
refcount
10
10
length
201
242
called
ExAllocatePool2 RtlAppendUnicodeStringToString RtlAppendUnicodeToString RtlCopyUnicodeString
ExAllocatePool2 RtlAppendUnicodeStringToString RtlAppendUnicodeToString RtlCopyUnicodeString RtlUShortAdd
calling
VrpCreateNamespaceNode VrpPostEnumerateKey VrpPostOpenOrCreate VrpPreLoadKey VrpPreOpenOrCreate VrpTranslatePath
VrpCreateNamespaceNode VrpPostEnumerateKey VrpPostOpenOrCreate VrpPreLoadKey VrpPreOpenOrCreate VrpTranslatePath
paramcount
0
0
address
1406cc0c8
1406cc6e8
sig
undefined VrpBuildKeyPath(void)
undefined VrpBuildKeyPath(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
VrpBuildKeyPath Called Diff
--- VrpBuildKeyPath called
+++ VrpBuildKeyPath called
@@ -4,0 +5 @@
+ RtlUShortAdd
--- VrpBuildKeyPath
+++ VrpBuildKeyPath
@@ -1,39 +1,43 @@
- undefined8 VrpBuildKeyPath(undefined8 *param_1,short *param_2,undefined2 *param_3)
+ int VrpBuildKeyPath(undefined8 *param_1,short *param_2,undefined2 *param_3)
{
- longlong lVar1;
- short sVar2;
- undefined8 uVar3;
+ ushort uVar1;
+ int iVar2;
+ longlong lVar3;
undefined8 *puVar4;
+ ushort *puVar5;
undefined8 local_18;
undefined8 local_10;
- uVar3 = 0;
+ *param_3 = 0;
local_18 = 0;
- local_10 = 0;
puVar4 = &local_18;
if (param_1 != (undefined8 *)0x0) {
puVar4 = param_1;
}
- *param_3 = 0;
- sVar2 = *(ushort *)((longlong)puVar4 + 2) + *param_2 + 2;
- param_3[1] = sVar2;
- lVar1 = ExAllocatePool2(0x100,sVar2,0x67655256);
- *(longlong *)(param_3 + 4) = lVar1;
- if (lVar1 == 0) {
- uVar3 = 0xc000009a;
+ local_10 = 0;
+ puVar5 = param_3 + 1;
+ uVar1 = *(ushort *)puVar4;
+ *puVar5 = uVar1;
+ iVar2 = RtlUShortAdd(uVar1,*param_2);
+ if ((iVar2 < 0) || (iVar2 = RtlUShortAdd(*puVar5,2), iVar2 < 0)) {
+ return -0x3ffffff3;
}
- else {
- RtlCopyUnicodeString(param_3,puVar4);
- if (*param_2 != 0) {
- if ((**(short **)(param_2 + 4) != 0x5c) &&
- (*(short *)(puVar4[1] + -2 + (ulonglong)(*(ushort *)puVar4 >> 1) * 2) != 0x5c)) {
- RtlAppendUnicodeToString(param_3,&u__);
- }
- RtlAppendUnicodeStringToString(param_3,param_2);
- }
+ lVar3 = ExAllocatePool2(0x100,*puVar5,0x67655256);
+ *(longlong *)(param_3 + 4) = lVar3;
+ if (lVar3 == 0) {
+ return -0x3fffff66;
}
- return uVar3;
+ RtlCopyUnicodeString(param_3,puVar4);
+ if (*param_2 == 0) {
+ return iVar2;
+ }
+ if ((**(short **)(param_2 + 4) != 0x5c) &&
+ (*(short *)(puVar4[1] + -2 + (ulonglong)(*(ushort *)puVar4 >> 1) * 2) != 0x5c)) {
+ RtlAppendUnicodeToString(param_3,&u__);
+ }
+ RtlAppendUnicodeStringToString(param_3,param_2);
+ return iVar2;
}
WbCreateHeapExecutedBlock$filt$0
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
code,length,address
ratio
0.55
i_ratio
0.79
m_ratio
0.93
b_ratio
0.93
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
WbCreateHeapExecutedBlock$filt$0
WbCreateHeapExecutedBlock$filt$0
fullname
WbCreateHeapExecutedBlock$filt$0
WbCreateHeapExecutedBlock$filt$0
refcount
1
1
length
57
43
called
calling
paramcount
0
0
address
14088b4e7
14088bef7
sig
undefined WbCreateHeapExecutedBlock$filt$0(void)
undefined WbCreateHeapExecutedBlock$filt$0(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
WbCreateHeapExecutedBlock$filt$0 Diff
--- WbCreateHeapExecutedBlock$filt$0
+++ WbCreateHeapExecutedBlock$filt$0
@@ -1,9 +1,8 @@
bool WbCreateHeapExecutedBlock_filt_0(undefined8 param_1,longlong param_2)
{
- *(void **)(param_2 + 0x80) = SystemReserved1[15];
- *(undefined *)(param_2 + 0x50) = *(undefined *)(*(longlong *)(param_2 + 0x80) + 0x232);
- return *(char *)(param_2 + 0x50) != '\0';
+ *(undefined *)(param_2 + 0x54) = *(undefined *)((longlong)SystemReserved1[15] + 0x232);
+ return *(char *)(param_2 + 0x54) != '\0';
}
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
code,refcount,length,address,called
ratio
0.12
i_ratio
0.1
m_ratio
0.07
b_ratio
0.37
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
CmSetValueKey
CmSetValueKey
fullname
CmSetValueKey
CmSetValueKey
refcount
3
4
length
3502
3278
called
Expand for full list: CmAddLogForAction CmpAddValueKeyNew CmpAddValueToListEx CmpAllocateUnitOfWork CmpAttachToRegistryProcess CmpCleanUpKcbCachedSymlink CmpCloneKCBValueListForTrans CmpCompareNewValueDataAgainstKCBCache CmpDetachFromRegistryProcess CmpDrainDelayDerefContext CmpFindNameInListWithStatus CmpFreePoolWithTag CmpFreeValue CmpGetValueForAudit CmpInitializeDelayDerefContext CmpIsKeyDeletedForKeyBody CmpIsKeyStackSymlink CmpIsShutdownRundownActive CmpIsValueTombstone CmpLockIXLockExclusive CmpLockIXLockIntent CmpLockKcbStackShared CmpLockKcbStackTopExclusiveRestShared CmpLockRegistry CmpLogTransactionAbortedWithChildName CmpPromoteKey CmpRemoveValueFromList CmpReportNotifyForKcbStack CmpRollbackTransactionArray CmpRundownUnitOfWork CmpSetValueKeyExisting CmpSetValueKeyNew CmpSignalDeferredPosts CmpSnapshotKcbStackSecurity CmpSnapshotTxOwnerArray CmpStartKcbStackForTopLayerKcb CmpSwapValueInList CmpTransEnlistUowInCmTrans CmpTransEnlistUowInKcb CmpTransSearchAddTransFromKeyBody CmpTryConvertKcbLockSharedToExclusive CmpUnlockKcbStack CmpUnlockRegistry CmpUpdateKeyNodeAccessBits ExFreePoolWithTag ExfAcquirePushLockSharedEx ExfReleasePushLockShared HvFreeCell HvpGetCellContextReinitialize HvpGetCellFlat HvpGetCellPaged HvpMarkCellDirty HvpReleaseCellFlat HvpReleaseCellPaged KeAbPostRelease KeAbPreAcquire RtlEqualUnicodeString RtlIsSandboxedToken SeAdtRegistryValueChangedAuditAlarm SmFreeWrapper __security_check_cookie
Expand for full list: CmAddLogForAction CmpAddValueKeyNew CmpAddValueToListEx CmpAllocateUnitOfWork CmpAttachToRegistryProcess CmpCleanUpKcbCachedSymlink CmpCloneKCBValueListForTrans CmpCompareNewValueDataAgainstKCBCache CmpDetachFromRegistryProcess CmpDrainDelayDerefContext CmpFindNameInListWithStatus CmpFreePoolWithTag CmpFreeValue CmpGetValueForAudit CmpInitializeDelayDerefContext CmpIsKeyDeletedForKeyBody CmpIsKeyStackSymlink CmpIsShutdownRundownActive CmpIsValueTombstone CmpLockIXLockExclusive CmpLockIXLockIntent CmpLockKcbStackShared CmpLockKcbStackTopExclusiveRestShared CmpLockRegistry CmpLogTransactionAbortedWithChildName CmpPromoteKey CmpRemoveValueFromList CmpReportNotifyForKcbStack CmpRollbackTransactionArray CmpRundownUnitOfWork CmpSetValueKeyExisting CmpSetValueKeyNew CmpSignalDeferredPosts CmpSnapshotKcbStackSecurity CmpSnapshotTxOwnerArray CmpStartKcbStackForTopLayerKcb CmpSwapValueInList CmpTransEnlistUowInCmTrans CmpTransEnlistUowInKcb CmpTransSearchAddTransFromKeyBody CmpTryConvertKcbLockSharedToExclusive CmpUnlockKcbStack CmpUnlockRegistry CmpUpdateKeyNodeAccessBits ExFreePoolWithTag ExfAcquirePushLockSharedEx ExfReleasePushLockShared Feature_4256151870__private_IsEnabled HvFreeCell HvpGetBinContextInitialize HvpGetCellFlat HvpGetCellPaged HvpMarkCellDirty HvpReleaseCellFlat HvpReleaseCellPaged KeAbPostRelease KeAbPreAcquire RtlEqualUnicodeString RtlIsSandboxedToken SeAdtRegistryValueChangedAuditAlarm SeCaptureSubjectContext SeReleaseSubjectContext SmFreeWrapper __security_check_cookie
calling
NtSetValueKey
NtSetValueKey
paramcount
7
7
address
1406b44e0
1406b44d0
sig
undefined CmSetValueKey(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5, undefined8 param_6, undefined1 param_7)
undefined CmSetValueKey(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5, undefined8 param_6, undefined1 param_7)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
CmSetValueKey Called Diff
--- CmSetValueKey called
+++ CmSetValueKey called
@@ -47,0 +48 @@
+ Feature_4256151870__private_IsEnabled
@@ -49 +50 @@
- HvpGetCellContextReinitialize
+ HvpGetBinContextInitialize
@@ -59,0 +61,2 @@
+ SeCaptureSubjectContext
+ SeReleaseSubjectContext
--- CmSetValueKey
+++ CmSetValueKey
@@ -1,647 +1,672 @@
+ /* WARNING: Type propagation algorithm not settling */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
void CmSetValueKey(int *param_1,ushort *param_2,int param_3,int *param_4,uint param_5,int *param_6,
char param_7)
{
- int *piVar1;
- undefined8 uVar2;
+ char cVar1;
+ char cVar2;
int iVar3;
- void *pvVar4;
- char cVar5;
- char cVar6;
- int iVar7;
- undefined4 uVar8;
+ undefined4 uVar4;
+ int iVar5;
+ void *pvVar6;
+ longlong lVar7;
+ undefined8 uVar8;
longlong lVar9;
- undefined8 uVar10;
- longlong lVar11;
+ int *piVar10;
+ void *pvVar11;
void *pvVar12;
- longlong lVar13;
- longlong *plVar14;
- longlong lVar15;
- char cVar16;
- char cVar17;
- uint uVar18;
- uint uVar19;
- bool bVar20;
+ longlong *plVar13;
+ uint uVar14;
+ uint uVar15;
+ longlong lVar16;
+ bool bVar17;
+ bool bVar18;
undefined4 extraout_XMM0_Da;
- undefined auStack_1a8 [32];
- undefined8 local_188;
- undefined8 local_180;
- undefined8 local_178;
+ undefined8 uVar19;
+ undefined4 extraout_XMM0_Dc;
+ undefined4 extraout_XMM0_Dd;
+ undefined auStack_1c8 [32];
+ undefined8 local_1a8;
+ undefined8 local_1a0;
+ undefined8 local_198;
+ uint local_190;
+ char local_188;
+ char local_187;
+ char local_186;
+ char local_185 [5];
+ int *local_180;
+ char local_178;
+ int local_174;
uint local_170;
- char local_168;
- char local_167;
- char local_166;
- char local_165;
+ int local_16c;
+ int local_168;
int local_164;
- uint local_160;
- int local_15c;
- int local_158;
- int local_154;
- uint local_150;
- undefined4 local_14c;
- undefined8 local_148;
+ undefined8 local_160;
+ undefined4 local_158;
+ uint local_154;
+ undefined8 local_150;
+ ushort *local_148;
longlong local_140;
- int *local_138;
- ushort *local_130;
- longlong local_128;
- undefined8 local_120 [2];
- undefined local_110 [16];
- undefined local_100 [16];
- undefined4 local_f0;
- int *local_e8;
- undefined8 local_e0;
- undefined8 ****local_d8;
- undefined8 ****local_d0;
- void *local_c8;
- int *local_c0;
- undefined local_b8 [16];
- undefined local_a8 [16];
- undefined local_98 [8];
- undefined8 uStack_90;
- undefined local_88 [16];
- undefined local_78 [16];
- undefined local_68 [16];
- ulonglong local_58;
+ void *local_130;
+ undefined local_128 [16];
+ undefined local_118 [16];
+ undefined4 local_108;
+ int *local_100;
+ undefined8 local_f8;
+ undefined8 *******local_f0;
+ undefined8 *******local_e8;
+ void *local_e0;
+ int *local_d8;
+ undefined local_d0 [16];
+ undefined local_c0 [16];
+ undefined local_b0 [8];
+ undefined8 uStack_a8;
+ undefined local_a0 [16];
+ undefined local_90 [16];
+ undefined local_80 [16];
+ undefined local_70 [16];
+ undefined local_60 [16];
+ ulonglong local_50;
- local_58 = __security_cookie ^ (ulonglong)auStack_1a8;
- lVar13 = 0;
- local_c0 = param_6;
- local_d0 = &local_d8;
- local_d8 = &local_d8;
- local_14c = 0;
- local_e0 = 0;
- local_120[0] = 0;
- local_164 = 0;
- local_148 = 0;
- local_88 = ZEXT816(0);
- local_110._4_12_ = SUB1612(ZEXT816(0),4);
- local_110._0_4_ = 0xffff0000;
- local_78 = ZEXT816(0);
+ local_50 = __security_cookie ^ (ulonglong)auStack_1c8;
+ local_d8 = param_6;
+ local_e8 = &local_f0;
+ local_f0 = &local_f0;
+ pvVar12 = (void *)0x0;
+ local_128._4_12_ = SUB1612(ZEXT816(0),4);
+ local_128._0_4_ = 0xffff0000;
+ local_158 = 0;
+ local_f8 = 0;
+ local_174 = 0;
+ local_80 = ZEXT816(0);
+ local_130 = (void *)0x0;
+ local_70 = ZEXT816(0);
+ local_185[0] = '\0';
+ local_60 = ZEXT816(0);
+ local_108 = 0;
+ local_d0 = ZEXT816(0);
local_140 = 0;
- local_68 = ZEXT816(0);
- local_165 = '\0';
- local_b8 = ZEXT816(0);
- local_f0 = 0;
- local_100 = ZEXT816(0);
- local_128 = 0;
- local_158 = param_3;
- local_138 = param_1;
- local_130 = param_2;
- local_e8 = param_4;
- HvpGetCellContextReinitialize(local_120);
- HvpGetCellContextReinitialize(&local_148);
- CmpInitializeDelayDerefContext(local_b8);
- local_154 = -1;
- local_a8 = ZEXT816(0);
- local_15c = -1;
- _local_98 = ZEXT816(0);
- local_c8 = (void *)0x0;
- local_150 = 0;
- local_166 = *(char *)((longlong)SystemReserved1[15] + 0x232);
- CmpAttachToRegistryProcess(local_88);
- cVar5 = CmpIsShutdownRundownActive();
- local_160 = param_5;
- uVar2 = _DAT_0;
- joined_r0x0001406b45f4:
- _DAT_0 = uVar2;
- if (cVar5 == '\0') {
+ local_a0 = ZEXT816(0);
+ local_150 = 0xffffffff;
+ local_90 = ZEXT816(0);
+ local_118 = ZEXT816(0);
+ pvVar6 = pvVar12;
+ local_180 = param_1;
+ local_168 = param_3;
+ local_148 = param_2;
+ local_100 = param_4;
+ HvpGetBinContextInitialize((longlong)&local_150 + 4);
+ local_160 = CONCAT44((int)((ulonglong)pvVar6 >> 0x20),0xffffffff);
+ HvpGetBinContextInitialize((longlong)&local_160 + 4);
+ uVar19 = CmpInitializeDelayDerefContext(local_d0);
+ local_c0._8_4_ = extraout_XMM0_Dc;
+ local_c0._0_8_ = uVar19;
+ local_c0._12_4_ = extraout_XMM0_Dd;
+ local_164 = -1;
+ unique0x100004a3 = extraout_XMM0_Dc;
+ local_b0 = (undefined [8])uVar19;
+ unique0x100004a7 = extraout_XMM0_Dd;
+ local_16c = -1;
+ local_154 = (uint)pvVar6;
+ local_187 = *(char *)((longlong)SystemReserved1[15] + 0x232);
+ local_178 = (char)pvVar6;
+ local_e0 = pvVar6;
+ iVar3 = Feature_4256151870__private_IsEnabled();
+ if (iVar3 != 0) {
+ local_a0 = ZEXT816(0);
+ local_90 = ZEXT816(0);
+ SeCaptureSubjectContext(local_a0);
+ local_178 = '\x01';
+ }
+ CmpAttachToRegistryProcess(local_80);
+ cVar1 = CmpIsShutdownRundownActive();
+ local_170 = param_5;
+ pvVar6 = pvVar12;
+ do {
+ uVar19 = _DAT_0;
+ if (cVar1 != '\0') {
+ local_186 = '\0';
+ cVar2 = '\0';
+ iVar3 = -0x3ffffe77;
+ cVar1 = '\0';
+ LAB_1:
+ piVar10 = local_180;
+ if (pvVar6 != (void *)0x0) {
+ LAB_2:
+ piVar10 = local_180;
+ CmpRundownUnitOfWork(pvVar6);
+ ExFreePoolWithTag();
+ }
+ LAB_3:
+ if (local_185[0] != '\0') {
+ if (*(int *)((longlong)pvVar12 + 0x11c) != -1) {
+ HvFreeCell();
+ }
+ *(undefined4 *)((longlong)pvVar12 + 0x11c) = 0xffffffff;
+ *(undefined4 *)((longlong)pvVar12 + 0x118) = 0;
+ *(undefined8 *)((longlong)pvVar12 + 0x120) = 0;
+ }
+ if (cVar2 != '\0') {
+ lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
+ LOCK();
+ bVar18 = *(longlong *)(lVar16 + 0x48) == 0x11;
+ if (bVar18) {
+ *(longlong *)(lVar16 + 0x48) = 0;
+ }
+ UNLOCK();
+ if (!bVar18) {
+ ExfReleasePushLockShared(lVar16 + 0x48);
+ }
+ KeAbPostRelease(lVar16 + 0x48);
+ }
+ if (cVar1 != '\0') {
+ CmpUnlockKcbStack(local_128);
+ }
+ pvVar12 = (void *)0x0;
+ CmpDrainDelayDerefContext(local_d0);
+ if (local_186 != '\0') {
+ CmpUnlockRegistry();
+ }
+ if ((undefined8 ********)local_f0 != &local_f0) {
+ CmpSignalDeferredPosts(&local_f0);
+ }
+ iVar5 = Feature_4256151870__private_IsEnabled();
+ if (iVar5 == 0) {
+ CmpDetachFromRegistryProcess(local_80);
+ }
+ else {
+ CmpDetachFromRegistryProcess(local_80);
+ if (local_178 != '\0') {
+ SeReleaseSubjectContext(local_a0);
+ }
+ }
+ pvVar6 = local_e0;
+ if (((-1 < iVar3) && (param_7 != '\0')) && (local_e0 != (void *)0x0)) {
+ local_b0._4_4_ = local_170;
+ local_b0._0_4_ = local_168;
+ uStack_a8 = local_100;
+ local_190 = local_154;
+ local_198 = (int *)local_c0;
+ local_1a0 = local_d8;
+ pvVar12 = local_e0;
+ local_1a8 = piVar10;
+ SeAdtRegistryValueChangedAuditAlarm(0,local_e0,0,local_148);
+ }
+ if (local_c0._8_8_ != 0) {
+ pvVar12 = (void *)0x34414d43;
+ CmpFreePoolWithTag();
+ }
+ if (pvVar6 != (void *)0x0) {
+ pvVar12 = (void *)0x33414d43;
+ CmpFreePoolWithTag(pvVar6);
+ }
+ if ((void *)local_118._8_8_ != (void *)0x0) {
+ SmFreeWrapper((void *)local_118._8_8_,pvVar12);
+ }
+ __security_check_cookie(local_50 ^ (ulonglong)auStack_1c8);
+ return;
+ }
CmpLockRegistry();
- lVar13 = *(longlong *)(param_1 + 2);
- cVar5 = '\x01';
- local_167 = '\x01';
- if ((*(uint *)(*(longlong *)(lVar13 + 0x20) + 0xa0) & 0x100000) != 0) {
- iVar7 = -0x3fffffde;
+ pvVar12 = *(void **)(param_1 + 2);
+ local_186 = '\x01';
+ if ((*(uint *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0xa0) & 0x100000) != 0) {
+ iVar3 = -0x3fffffde;
+ LAB_4:
+ cVar2 = '\0';
+ cVar1 = '\0';
goto LAB_1;
}
- iVar7 = CmpStartKcbStackForTopLayerKcb(local_110);
- if (iVar7 < 0) goto LAB_1;
+ iVar3 = CmpStartKcbStackForTopLayerKcb();
+ if (iVar3 < 0) goto LAB_4;
if ((*(longlong *)(param_1 + 0xe) == 0) && (*(longlong *)(param_1 + 0x10) == 0)) {
- CmpLockKcbStackShared(local_110);
- cVar5 = '\0';
+ CmpLockKcbStackShared(local_128);
+ bVar18 = false;
}
else {
- CmpLockKcbStackTopExclusiveRestShared(local_110);
- }
- local_168 = '\x01';
- if ((*(longlong *)(param_1 + 0xe) == 0) &&
- (lVar15 = local_128, *(longlong *)(param_1 + 0x10) == 0)) {
- LAB_2:
- do {
- cVar6 = CmpIsKeyDeletedForKeyBody(param_1);
- if (cVar6 != '\0') goto LAB_3;
- if (*(char *)(lVar13 + 0x41) == '\x01') {
- iVar7 = -0x3fffffde;
- goto LAB_4;
- }
- if (lVar15 != 0) {
- lVar9 = CmpAllocateUnitOfWork();
- local_140 = lVar9;
- if (lVar9 == 0) {
- iVar7 = -0x3fffff66;
- cVar17 = '\0';
- cVar6 = local_168;
- cVar5 = local_167;
- goto LAB_5;
- }
- CmpTransEnlistUowInKcb(lVar9,lVar13);
- iVar7 = CmpTransEnlistUowInCmTrans(lVar9,lVar15);
- if (-1 < iVar7) {
- cVar6 = CmpLockIXLockIntent(lVar13 + 0xf8,lVar9);
- if ((cVar6 != '\0') &&
- (cVar6 = CmpLockIXLockExclusive(lVar13 + 0x108,lVar9,1), cVar6 != '\0')) {
- plVar14 = (longlong *)(*(longlong *)(lVar13 + 0x20) + 0x48);
- lVar9 = KeAbPreAcquire(plVar14,0,0);
+ CmpLockKcbStackTopExclusiveRestShared(local_128);
+ bVar18 = true;
+ }
+ cVar1 = '\x01';
+ local_188 = '\x01';
+ if ((*(longlong *)(param_1 + 0xe) != 0) ||
+ (lVar16 = local_140, *(longlong *)(param_1 + 0x10) != 0)) {
+ cVar2 = CmpIsKeyDeletedForKeyBody();
+ if (cVar2 == '\0') {
+ iVar3 = CmpTransSearchAddTransFromKeyBody();
+ if (-1 < iVar3) {
+ lVar16 = local_140;
+ if ((*(uint *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0xa0) & 2) == 0)
+ goto LAB_5;
+ iVar3 = -0x3fe6ffff;
+ }
+ LAB_6:
+ cVar2 = '\0';
+ }
+ else {
+ cVar2 = '\0';
+ iVar3 = -0x3ffffbdb;
+ if ((*(byte *)(local_180 + 0xc) & 1) == 0) {
+ iVar3 = -0x3ffffe84;
+ }
+ }
+ goto LAB_1;
+ }
+ LAB_5:
+ while( true ) {
+ cVar1 = CmpIsKeyDeletedForKeyBody();
+ if (cVar1 != '\0') {
+ cVar2 = '\0';
+ iVar3 = -0x3ffffbdb;
+ cVar1 = local_188;
+ if ((*(byte *)(local_180 + 0xc) & 1) == 0) {
+ iVar3 = -0x3ffffe84;
+ }
+ goto LAB_1;
+ }
+ if (*(char *)((longlong)pvVar12 + 0x41) == '\x01') {
+ iVar3 = -0x3fffffde;
+ goto LAB_7;
+ }
+ if (lVar16 != 0) {
+ pvVar6 = (void *)CmpAllocateUnitOfWork();
+ local_130 = pvVar6;
+ if (pvVar6 == (void *)0x0) {
+ iVar3 = -0x3fffff66;
+ cVar2 = '\0';
+ piVar10 = local_180;
+ cVar1 = local_188;
+ goto LAB_3;
+ }
+ CmpTransEnlistUowInKcb(pvVar6,pvVar12);
+ iVar3 = CmpTransEnlistUowInCmTrans(pvVar6,lVar16);
+ if (-1 < iVar3) {
+ cVar1 = CmpLockIXLockIntent((longlong)pvVar12 + 0xf8,pvVar6);
+ if ((cVar1 != '\0') &&
+ (cVar1 = CmpLockIXLockExclusive((longlong)pvVar12 + 0x108,pvVar6,1), cVar1 != '\0')) {
+ plVar13 = (longlong *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x48);
+ lVar7 = KeAbPreAcquire(plVar13,0,0);
+ LOCK();
+ lVar16 = *plVar13;
+ if (lVar16 == 0) {
+ *plVar13 = 0x11;
+ }
+ UNLOCK();
+ if (lVar16 != 0) {
+ ExfAcquirePushLockSharedEx(plVar13,0,lVar7,plVar13);
+ }
+ if (lVar7 != 0) {
+ *(undefined *)(lVar7 + 0x12) = 1;
+ }
+ cVar2 = '\x01';
+ iVar3 = CmpCloneKCBValueListForTrans(pvVar12,local_140,local_185);
+ cVar1 = local_188;
+ if (-1 < iVar3) {
+ lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
LOCK();
- lVar15 = *plVar14;
- if (lVar15 == 0) {
- *plVar14 = 0x11;
+ bVar17 = *(longlong *)(lVar16 + 0x48) == 0x11;
+ if (bVar17) {
+ *(longlong *)(lVar16 + 0x48) = 0;
}
UNLOCK();
- if (lVar15 != 0) {
- ExfAcquirePushLockSharedEx(plVar14,0,lVar9,plVar14);
+ if (!bVar17) {
+ ExfReleasePushLockShared(lVar16 + 0x48);
}
- if (lVar9 != 0) {
- *(undefined *)(lVar9 + 0x12) = 1;
- }
- cVar17 = '\x01';
- iVar7 = CmpCloneKCBValueListForTrans(lVar13,local_128,&local_165);
- if (-1 < iVar7) {
- lVar15 = *(longlong *)(lVar13 + 0x20);
- LOCK();
- bVar20 = *(longlong *)(lVar15 + 0x48) == 0x11;
- if (bVar20) {
- *(longlong *)(lVar15 + 0x48) = 0;
- }
- UNLOCK();
- if (!bVar20) {
- ExfReleasePushLockShared(lVar15 + 0x48);
- }
- KeAbPostRelease(lVar15 + 0x48);
- lVar15 = local_128;
- goto LAB_6;
- }
- cVar5 = '\x01';
- cVar6 = local_168;
- goto LAB_7;
- }
- iVar7 = -0x3fe6ffff;
- }
- cVar17 = '\0';
- cVar5 = local_167;
- cVar6 = local_168;
- goto LAB_7;
- }
- if (*(int *)(lVar13 + 0xf8) < 0) {
- iVar7 = CmpSnapshotTxOwnerArray((int *)(lVar13 + 0xf8),&local_14c,&local_e0);
- uVar8 = local_14c;
- if (iVar7 < 0) goto LAB_4;
- pvVar12 = (void *)0x0;
- local_188 = (int *)CONCAT44(local_188._4_4_,local_14c);
- CmpLogTransactionAbortedWithChildName(lVar13,0,1);
- CmpUnlockKcbStack(local_110);
- if ((void *)local_100._8_8_ != (void *)0x0) {
- SmFreeWrapper((void *)local_100._8_8_,pvVar12);
- }
- local_110._4_12_ = SUB1612(ZEXT816(0),4);
- local_110._0_4_ = 0xffff0000;
- local_100 = ZEXT816(0);
- CmpUnlockRegistry();
- cVar5 = '\0';
- iVar7 = CmpRollbackTransactionArray(uVar8);
- if (-1 < iVar7) goto LAB_8;
- goto LAB_1;
- }
- if (*(int *)(lVar13 + 0x108) != 0) goto LAB_9;
- LAB_6:
- cVar17 = '\0';
- cVar6 = CmpIsKeyStackSymlink(local_110);
- if (cVar6 != '\0') {
- if ((((local_158 == 6) && ((local_160 & 1) == 0)) && (local_160 < 0x10000)) &&
- (local_130 != (ushort *)0x0)) {
- cVar6 = RtlEqualUnicodeString(&CmSymbolicLinkValueName,local_130,1);
- if ((cVar6 != '\0') && (cVar6 = RtlIsSandboxedToken(0), cVar6 == '\0'))
- goto LAB_10;
- }
- iVar7 = -0x3fffffde;
- cVar5 = local_167;
- cVar6 = local_168;
- goto LAB_11;
- }
+ KeAbPostRelease(lVar16 + 0x48);
+ lVar16 = local_140;
+ goto LAB_8;
+ }
+ goto LAB_2;
+ }
+ iVar3 = -0x3fe6ffff;
+ }
+ cVar2 = '\0';
+ cVar1 = local_188;
+ goto LAB_2;
+ }
+ piVar10 = (int *)((longlong)pvVar12 + 0xf8);
+ if ((*piVar10 < 0) || (piVar10 = (int *)((longlong)pvVar12 + 0x108), *piVar10 != 0)) break;
+ LAB_8:
+ cVar2 = '\0';
+ cVar1 = CmpIsKeyStackSymlink();
+ uVar14 = local_170;
+ if (cVar1 != '\0') {
+ if ((((local_168 == 6) && ((local_170 & 1) == 0)) && (local_170 < 0x10000)) &&
+ ((local_148 != (ushort *)0x0 &&
+ (cVar1 = RtlEqualUnicodeString(&CmSymbolicLinkValueName,local_148,1), cVar1 != '\0'))))
+ {
+ iVar3 = Feature_4256151870__private_IsEnabled();
+ if (iVar3 == 0) {
+ cVar1 = RtlIsSandboxedToken();
+ }
+ else {
+ cVar1 = RtlIsSandboxedToken();
+ }
+ if (cVar1 == '\0') goto LAB_9;
+ }
+ iVar3 = -0x3fffffde;
+ cVar1 = local_188;
+ goto LAB_1;
+ }
+ LAB_9:
+ if (*(int *)((longlong)pvVar12 + 0x28) == -1) {
+ CmpUnlockKcbStack(local_128);
+ local_188 = '\0';
+ iVar3 = CmpPromoteKey();
+ cVar1 = local_188;
+ if (iVar3 < 0) goto LAB_1;
+ bVar18 = true;
+ local_188 = '\x01';
+ param_1 = local_180;
+ }
+ else {
+ if (bVar18) {
LAB_10:
- if (*(int *)(lVar13 + 0x28) != -1) {
- if (cVar5 == '\0') {
- local_188 = (int *)CONCAT44(local_188._4_4_,local_160);
- iVar7 = CmpCompareNewValueDataAgainstKCBCache(lVar13,local_130,local_158,local_e8);
- if (iVar7 == 1) {
- CmpUnlockKcbStack(local_110);
- CmpLockKcbStackTopExclusiveRestShared(local_110);
- goto LAB_2;
- }
- if (iVar7 == 0) {
- iVar7 = 0;
- cVar5 = local_167;
- cVar6 = local_168;
- goto LAB_11;
- }
- cVar5 = '\x01';
- if ((*(void **)(lVar13 + 0x38) != SystemReserved1[15]) &&
- (cVar6 = CmpTryConvertKcbLockSharedToExclusive(lVar13), cVar6 == '\0')) {
- CmpUnlockKcbStack(local_110);
- CmpLockKcbStackTopExclusiveRestShared(local_110);
- lVar15 = local_128;
- goto LAB_2;
- }
- }
- *(longlong *)(lVar13 + 0x130) = *(longlong *)(lVar13 + 0x130) + 1;
- plVar14 = (longlong *)(*(longlong *)(lVar13 + 0x20) + 0x48);
- lVar9 = KeAbPreAcquire(plVar14,0,0);
+ *(longlong *)((longlong)pvVar12 + 0x130) = *(longlong *)((longlong)pvVar12 + 0x130) + 1;
+ plVar13 = (longlong *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x48);
+ lVar7 = KeAbPreAcquire(plVar13,0,0);
LOCK();
- lVar15 = *plVar14;
- if (lVar15 == 0) {
- *plVar14 = 0x11;
+ lVar16 = *plVar13;
+ if (lVar16 == 0) {
+ *plVar13 = 0x11;
}
UNLOCK();
- if (lVar15 != 0) {
- ExfAcquirePushLockSharedEx(plVar14,0,lVar9,plVar14);
- }
- lVar15 = local_128;
- if (lVar9 != 0) {
- *(undefined *)(lVar9 + 0x12) = 1;
- }
- cVar16 = '\x01';
- cVar17 = '\x01';
- local_166 = '\x01';
- if ((local_128 != 0) ||
- (iVar7 = HvpMarkCellDirty(*(undefined8 *)(lVar13 + 0x20),*(undefined4 *)(lVar13 + 0x28)
- ,0,0), cVar5 = local_167, cVar6 = local_168, -1 < iVar7)) {
- if ((*(byte *)(*(longlong *)(lVar13 + 0x20) + 0x8c) & 1) == 0) {
- lVar9 = HvpGetCellPaged();
+ if (lVar16 != 0) {
+ ExfAcquirePushLockSharedEx(plVar13,0,lVar7,plVar13);
+ }
+ lVar16 = local_140;
+ if (lVar7 != 0) {
+ *(undefined *)(lVar7 + 0x12) = 1;
+ }
+ cVar2 = '\x01';
+ local_187 = '\x01';
+ if ((local_140 != 0) ||
+ (iVar3 = HvpMarkCellDirty(*(undefined8 *)((longlong)pvVar12 + 0x20),
+ *(undefined4 *)((longlong)pvVar12 + 0x28),0,0),
+ cVar1 = local_188, -1 < iVar3)) {
+ if ((*(byte *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x8c) & 1) == 0) {
+ lVar7 = HvpGetCellPaged(*(longlong *)((longlong)pvVar12 + 0x20),
+ *(undefined4 *)((longlong)pvVar12 + 0x28),&local_150);
}
else {
- lVar9 = HvpGetCellFlat(*(longlong *)(lVar13 + 0x20),*(undefined4 *)(lVar13 + 0x28),
- local_120);
+ lVar7 = HvpGetCellFlat();
}
CmpUpdateKeyNodeAccessBits
- (*(undefined8 *)(lVar13 + 0x20),lVar9,*(undefined4 *)(lVar13 + 0x28));
- local_180 = &local_154;
- local_188 = &local_164;
- cVar17 = cVar16;
- if (lVar15 == 0) {
- iVar7 = CmpFindNameInListWithStatus
- (*(undefined8 *)(lVar13 + 0x20),lVar9 + 0x24,local_130,0);
- if ((iVar7 + 0x80000000U & 0x80000000) != 0) goto LAB_12;
- LAB_13:
- if (iVar7 == -0x3fffffcc) goto LAB_12;
- }
- else {
- iVar7 = CmpFindNameInListWithStatus
- (*(undefined8 *)(lVar13 + 0x20),lVar13 + 0x118,local_130,0);
- if ((iVar7 + 0x80000000U & 0x80000000) == 0) goto LAB_13;
- LAB_12:
- iVar3 = local_154;
+ (*(undefined8 *)((longlong)pvVar12 + 0x20),lVar7,
+ *(undefined4 *)((longlong)pvVar12 + 0x28));
+ local_1a0 = &local_164;
+ lVar9 = (longlong)pvVar12 + 0x118;
+ local_1a8 = &local_174;
+ if (lVar16 == 0) {
+ lVar9 = lVar7 + 0x24;
+ }
+ iVar3 = CmpFindNameInListWithStatus
+ (*(undefined8 *)((longlong)pvVar12 + 0x20),lVar9,local_148,0);
+ iVar5 = local_164;
+ if (((iVar3 + 0x80000000U & 0x80000000) != 0) || (iVar3 == -0x3fffffcc)) {
+ uVar14 = local_154;
if (param_7 != '\0') {
- iVar7 = CmpSnapshotKcbStackSecurity(local_110,lVar15,0x33414d43,&local_c8);
- param_1 = local_138;
- if (iVar7 < 0) goto LAB_14;
- if (iVar3 == -1) {
- local_150 = 0;
+ iVar3 = CmpSnapshotKcbStackSecurity(local_128,lVar16,0x33414d43,&local_e0);
+ cVar2 = local_187;
+ if (iVar3 < 0) goto LAB_11;
+ if (iVar5 == -1) {
+ local_154 = 0;
+ uVar14 = local_154;
}
else {
- if ((*(byte *)(*(longlong *)(lVar13 + 0x20) + 0x8c) & 1) == 0) {
- uVar10 = HvpGetCellPaged(*(longlong *)(lVar13 + 0x20),iVar3,&local_148);
+ if ((*(byte *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x8c) & 1) == 0) {
+ uVar8 = HvpGetCellPaged(*(longlong *)((longlong)pvVar12 + 0x20),iVar5,&local_160
+ );
}
else {
- uVar10 = HvpGetCellFlat();
- }
- lVar11 = *(longlong *)(lVar13 + 0x20);
- cVar5 = CmpIsValueTombstone(lVar11,uVar10);
- local_150 = (uint)(cVar5 == '\0');
- if ((*(byte *)(lVar11 + 0x8c) & 1) == 0) {
- HvpReleaseCellPaged(extraout_XMM0_Da,&local_148);
+ uVar8 = HvpGetCellFlat();
+ }
+ lVar9 = *(longlong *)((longlong)pvVar12 + 0x20);
+ cVar1 = CmpIsValueTombstone(lVar9,uVar8);
+ uVar14 = (uint)(cVar1 == '\0');
+ local_154 = uVar14;
+ if ((*(byte *)(lVar9 + 0x8c) & 1) == 0) {
+ HvpReleaseCellPaged(extraout_XMM0_Da,&local_160);
}
else {
HvpReleaseCellFlat();
}
- if ((cVar5 == '\0') &&
- (iVar7 = CmpGetValueForAudit(*(undefined8 *)(lVar13 + 0x20),iVar3,local_a8,
- 0x34414d43), param_1 = local_138, iVar7 < 0))
- goto LAB_14;
+ if ((cVar1 == '\0') &&
+ (iVar3 = CmpGetValueForAudit(*(undefined8 *)((longlong)pvVar12 + 0x20),iVar5,
+ local_c0,0x34414d43), cVar2 = local_187, iVar3 < 0
+ )) goto LAB_11;
}
}
- uVar19 = local_160;
- lVar11 = *(longlong *)(lVar13 + 0x20);
- uVar18 = *(uint *)(lVar13 + 0x28) >> 0x1f;
- if (lVar15 == 0) {
- if (iVar3 == -1) {
- local_178 = (int *)CONCAT44(local_178._4_4_,local_160);
- local_180 = local_e8;
- local_188 = (int *)CONCAT44(local_188._4_4_,local_158);
- local_170 = uVar18;
- iVar7 = CmpSetValueKeyNew(lVar11,lVar9,local_130,local_164);
+ local_154 = uVar14;
+ uVar14 = local_170;
+ uVar15 = *(uint *)((longlong)pvVar12 + 0x28) >> 0x1f;
+ if (lVar16 == 0) {
+ lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
+ if (iVar5 == -1) {
+ local_198 = (int *)CONCAT44(local_198._4_4_,local_170);
+ local_1a0 = local_100;
+ local_1a8 = (int *)CONCAT44(local_1a8._4_4_,local_168);
+ local_190 = uVar15;
+ iVar3 = CmpSetValueKeyNew(lVar16,lVar7,local_148,local_174);
}
else {
- if ((*(byte *)(lVar11 + 0x8c) & 1) == 0) {
- uVar10 = HvpGetCellPaged();
+ if ((*(byte *)(lVar16 + 0x8c) & 1) == 0) {
+ uVar8 = HvpGetCellPaged(lVar16,iVar5,&local_160);
}
else {
- uVar10 = HvpGetCellFlat(lVar11,iVar3,&local_148);
- }
- uVar19 = local_160;
- local_178 = (int *)CONCAT44(local_178._4_4_,uVar18);
- local_180 = (int *)CONCAT44(local_180._4_4_,local_160);
- local_188 = local_e8;
- iVar7 = CmpSetValueKeyExisting
- (*(undefined8 *)(lVar13 + 0x20),iVar3,uVar10,local_158);
- if ((*(byte *)(*(longlong *)(lVar13 + 0x20) + 0x8c) & 1) == 0) {
- HvpReleaseCellPaged();
+ uVar8 = HvpGetCellFlat();
+ }
+ local_198 = (int *)CONCAT44(local_198._4_4_,uVar15);
+ local_1a0 = (int *)CONCAT44(local_1a0._4_4_,local_170);
+ local_1a8 = local_100;
+ iVar3 = CmpSetValueKeyExisting
+ (*(undefined8 *)((longlong)pvVar12 + 0x20),iVar5,uVar8,local_168
+ );
+ if ((*(byte *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x8c) & 1) == 0) {
+ HvpReleaseCellPaged(*(longlong *)((longlong)pvVar12 + 0x20),&local_160);
+ uVar14 = local_170;
}
else {
- HvpReleaseCellFlat(*(longlong *)(lVar13 + 0x20),&local_148);
+ HvpReleaseCellFlat();
+ uVar14 = local_170;
}
}
- param_1 = local_138;
- cVar17 = local_166;
- if (-1 < iVar7) {
- if (*(uint *)(lVar9 + 0x3c) < (uint)*local_130) {
- *(uint *)(lVar9 + 0x3c) = (uint)*local_130;
- *(ushort *)(lVar13 + 0xb2) = *local_130;
- }
- if (*(uint *)(lVar9 + 0x40) < uVar19) {
- *(uint *)(lVar9 + 0x40) = uVar19;
- *(uint *)(lVar13 + 0xb4) = uVar19;
- }
- *(undefined8 *)(lVar9 + 4) = uVar2;
- *(undefined8 *)(lVar13 + 0xa8) = uVar2;
- CmpCleanUpKcbCachedSymlink(lVar13,local_b8);
- uVar8 = *(undefined4 *)(lVar9 + 0x28);
- lVar15 = *(longlong *)(lVar13 + 0x20);
- *(undefined4 *)(lVar13 + 0x60) = *(undefined4 *)(lVar9 + 0x24);
- *(undefined4 *)(lVar13 + 100) = uVar8;
+ cVar2 = local_187;
+ if (-1 < iVar3) {
+ if (*(uint *)(lVar7 + 0x3c) < (uint)*local_148) {
+ *(uint *)(lVar7 + 0x3c) = (uint)*local_148;
+ *(ushort *)((longlong)pvVar12 + 0xb2) = *local_148;
+ }
+ if (*(uint *)(lVar7 + 0x40) < uVar14) {
+ *(uint *)(lVar7 + 0x40) = uVar14;
+ *(uint *)((longlong)pvVar12 + 0xb4) = uVar14;
+ }
+ *(undefined8 *)(lVar7 + 4) = uVar19;
+ *(undefined8 *)((longlong)pvVar12 + 0xa8) = uVar19;
+ CmpCleanUpKcbCachedSymlink(pvVar12,local_d0);
+ uVar4 = *(undefined4 *)(lVar7 + 0x28);
+ lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
+ *(undefined4 *)((longlong)pvVar12 + 0x60) = *(undefined4 *)(lVar7 + 0x24);
+ *(undefined4 *)((longlong)pvVar12 + 100) = uVar4;
LOCK();
- bVar20 = *(longlong *)(lVar15 + 0x48) == 0x11;
- if (bVar20) {
- *(longlong *)(lVar15 + 0x48) = 0;
+ bVar18 = *(longlong *)(lVar16 + 0x48) == 0x11;
+ if (bVar18) {
+ *(longlong *)(lVar16 + 0x48) = 0;
}
UNLOCK();
- if (!bVar20) {
- ExfReleasePushLockShared(lVar15 + 0x48);
- }
- KeAbPostRelease(lVar15 + 0x48);
- LAB_15:
- iVar7 = 0;
- local_15c = -1;
- local_140 = 0;
- local_165 = '\0';
- CmpReportNotifyForKcbStack(local_110,local_128,4,&local_d8);
- param_1 = local_138;
- cVar17 = '\0';
+ if (!bVar18) {
+ ExfReleasePushLockShared(lVar16 + 0x48);
+ }
+ KeAbPostRelease(lVar16 + 0x48);
+ LAB_12:
+ iVar3 = 0;
+ local_16c = -1;
+ local_130 = (void *)0x0;
+ local_185[0] = '\0';
+ CmpReportNotifyForKcbStack(local_128,local_140,4,&local_f0);
+ cVar2 = '\0';
}
}
else {
- local_178 = &local_15c;
- local_180 = (int *)CONCAT44(local_180._4_4_,1);
- local_188 = (int *)CONCAT44(local_188._4_4_,local_160);
- iVar7 = CmpAddValueKeyNew(lVar11,local_130,local_158,local_e8);
- param_1 = local_138;
- cVar17 = local_166;
- if (-1 < iVar7) {
- piVar1 = (int *)(lVar13 + 0x118);
- if (iVar3 == -1) {
- local_164 = *piVar1;
- local_180 = (int *)CONCAT44(local_180._4_4_,1);
- local_188 = piVar1;
- iVar7 = CmpAddValueToListEx(*(undefined8 *)(lVar13 + 0x20),local_15c,local_164,1
- );
- param_1 = local_138;
- cVar17 = local_166;
- if (iVar7 < 0) goto LAB_14;
+ local_198 = &local_16c;
+ local_1a0 = (int *)CONCAT44(local_1a0._4_4_,1);
+ local_1a8 = (int *)CONCAT44(local_1a8._4_4_,local_170);
+ iVar3 = CmpAddValueKeyNew(*(undefined8 *)((longlong)pvVar12 + 0x20),local_148,
+ local_168,local_100);
+ cVar2 = local_187;
+ if (-1 < iVar3) {
+ piVar10 = (int *)((longlong)pvVar12 + 0x118);
+ if (iVar5 == -1) {
+ local_174 = *piVar10;
+ local_1a0 = (int *)CONCAT44(local_1a0._4_4_,1);
+ local_1a8 = piVar10;
+ iVar3 = CmpAddValueToListEx(*(undefined8 *)((longlong)pvVar12 + 0x20),local_16c,
+ local_174,1);
+ cVar2 = local_187;
+ if (iVar3 < 0) goto LAB_11;
}
else {
- CmpSwapValueInList(*(undefined8 *)(lVar13 + 0x20),local_15c,local_164,piVar1);
- }
- lVar15 = *(longlong *)(lVar13 + 0x20);
+ CmpSwapValueInList(*(undefined8 *)((longlong)pvVar12 + 0x20),local_16c,local_174
+ ,piVar10);
+ }
+ lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
LOCK();
- bVar20 = *(longlong *)(lVar15 + 0x48) == 0x11;
- if (bVar20) {
- *(longlong *)(lVar15 + 0x48) = 0;
+ bVar18 = *(longlong *)(lVar16 + 0x48) == 0x11;
+ if (bVar18) {
+ *(longlong *)(lVar16 + 0x48) = 0;
}
UNLOCK();
- if (!bVar20) {
- ExfReleasePushLockShared(lVar15 + 0x48);
- }
- KeAbPostRelease(lVar15 + 0x48);
- if (local_154 == -1) {
- uVar8 = 4;
+ if (!bVar18) {
+ ExfReleasePushLockShared(lVar16 + 0x48);
+ }
+ KeAbPostRelease(lVar16 + 0x48);
+ if (local_164 == -1) {
+ uVar4 = 4;
}
else {
- *(int *)(local_140 + 0x58) = local_154;
- uVar8 = 5;
- }
- *(undefined4 *)(local_140 + 0x44) = uVar8;
- *(int *)(local_140 + 0x5c) = local_15c;
- *(uint *)(local_140 + 0x48) = uVar18;
- iVar7 = CmAddLogForAction(local_140,1);
- if (-1 < iVar7) goto LAB_15;
- if (lVar9 != 0) {
- if ((*(byte *)(*(longlong *)(lVar13 + 0x20) + 0x8c) & 1) == 0) {
- HvpReleaseCellPaged(*(longlong *)(lVar13 + 0x20),local_120);
+ *(int *)((longlong)local_130 + 0x58) = local_164;
+ uVar4 = 5;
+ }
+ *(undefined4 *)((longlong)local_130 + 0x44) = uVar4;
+ *(int *)((longlong)local_130 + 0x5c) = local_16c;
+ *(uint *)((longlong)local_130 + 0x48) = uVar15;
+ iVar3 = CmAddLogForAction(local_130,1);
+ if (-1 < iVar3) goto LAB_12;
+ if (lVar7 != 0) {
+ lVar7 = 0;
+ if ((*(byte *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x8c) & 1) == 0) {
+ HvpReleaseCellPaged(*(longlong *)((longlong)pvVar12 + 0x20),&local_150);
}
else {
HvpReleaseCellFlat();
}
- lVar9 = 0;
- }
- plVar14 = (longlong *)(*(longlong *)(lVar13 + 0x20) + 0x48);
- lVar11 = KeAbPreAcquire(plVar14,0,0);
+ }
+ plVar13 = (longlong *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x48);
+ lVar9 = KeAbPreAcquire(plVar13,0,0);
LOCK();
- lVar15 = *plVar14;
- if (lVar15 == 0) {
- *plVar14 = 0x11;
+ lVar16 = *plVar13;
+ if (lVar16 == 0) {
+ *plVar13 = 0x11;
}
UNLOCK();
- if (lVar15 != 0) {
- ExfAcquirePushLockSharedEx(plVar14,0,lVar11,plVar14);
- }
- if (lVar11 != 0) {
- *(undefined *)(lVar11 + 0x12) = 1;
- }
- if (local_154 == -1) {
- CmpRemoveValueFromList(*(undefined8 *)(lVar13 + 0x20),local_164,piVar1);
+ if (lVar16 != 0) {
+ ExfAcquirePushLockSharedEx(plVar13,0,lVar9,plVar13);
+ }
+ if (lVar9 != 0) {
+ *(undefined *)(lVar9 + 0x12) = 1;
+ }
+ if (local_164 == -1) {
+ CmpRemoveValueFromList
+ (*(undefined8 *)((longlong)pvVar12 + 0x20),local_174,piVar10);
}
else {
- CmpSwapValueInList(*(undefined8 *)(lVar13 + 0x20),local_154,local_164,piVar1);
- }
- lVar15 = *(longlong *)(lVar13 + 0x20);
+ CmpSwapValueInList(*(undefined8 *)((longlong)pvVar12 + 0x20),local_164,local_174
+ ,piVar10);
+ }
+ lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
+ plVar13 = (longlong *)(lVar16 + 0x48);
LOCK();
- bVar20 = *(longlong *)(lVar15 + 0x48) == 0x11;
- if (bVar20) {
- *(longlong *)(lVar15 + 0x48) = 0;
+ bVar18 = *plVar13 == 0x11;
+ if (bVar18) {
+ *plVar13 = 0;
}
UNLOCK();
- if (!bVar20) {
- ExfReleasePushLockShared(lVar15 + 0x48);
- }
- KeAbPostRelease(lVar15 + 0x48);
- param_1 = local_138;
- cVar17 = '\0';
+ if (!bVar18) {
+ ExfReleasePushLockShared(lVar16 + 0x48);
+ }
+ KeAbPostRelease();
+ cVar2 = '\0';
}
}
}
- LAB_14:
- if (lVar9 != 0) {
- if ((*(byte *)(*(longlong *)(lVar13 + 0x20) + 0x8c) & 1) == 0) {
- HvpReleaseCellPaged();
+ LAB_11:
+ if (lVar7 != 0) {
+ if ((*(byte *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x8c) & 1) == 0) {
+ HvpReleaseCellPaged(*(longlong *)((longlong)pvVar12 + 0x20),&local_150);
}
else {
- HvpReleaseCellFlat(*(longlong *)(lVar13 + 0x20),local_120);
+ HvpReleaseCellFlat();
}
}
- cVar5 = local_167;
- cVar6 = local_168;
- if (local_15c != -1) {
- CmpFreeValue(*(undefined8 *)(lVar13 + 0x20));
- cVar5 = local_167;
- cVar6 = local_168;
- }
- }
- goto LAB_11;
- }
- CmpUnlockKcbStack(local_110);
- local_168 = '\0';
- iVar7 = CmpPromoteKey(local_110,0,1);
- cVar5 = local_167;
- cVar6 = local_168;
- if (iVar7 < 0) goto LAB_11;
- local_168 = '\x01';
- cVar5 = '\x01';
- } while( true );
- }
- cVar6 = CmpIsKeyDeletedForKeyBody(param_1);
- if (cVar6 == '\0') {
- iVar7 = CmpTransSearchAddTransFromKeyBody(param_1);
- if (-1 < iVar7) {
- lVar15 = local_128;
- if ((*(uint *)(*(longlong *)(lVar13 + 0x20) + 0xa0) & 2) == 0) goto LAB_2;
- iVar7 = -0x3fe6ffff;
- }
- goto LAB_4;
- }
- LAB_3:
- cVar17 = '\0';
- iVar7 = -0x3ffffbdb;
- cVar5 = local_167;
- cVar6 = local_168;
- if ((*(byte *)(param_1 + 0xc) & 1) == 0) {
- iVar7 = -0x3ffffe84;
- }
- }
- else {
- cVar17 = '\0';
- iVar7 = -0x3ffffe77;
- cVar5 = '\0';
- cVar6 = '\0';
- }
- goto LAB_11;
- LAB_9:
- iVar7 = CmpSnapshotTxOwnerArray((int *)(lVar13 + 0x108),&local_14c,&local_e0);
- uVar8 = local_14c;
- if (iVar7 < 0) {
- LAB_4:
- cVar17 = '\0';
- cVar5 = local_167;
- cVar6 = local_168;
- goto LAB_11;
- }
- pvVar12 = (void *)0x0;
- local_188 = (int *)CONCAT44(local_188._4_4_,local_14c);
- CmpLogTransactionAbortedWithChildName(lVar13,0,1);
- CmpUnlockKcbStack(local_110);
- if ((void *)local_100._8_8_ != (void *)0x0) {
- SmFreeWrapper((void *)local_100._8_8_,pvVar12);
- }
- local_110._4_12_ = SUB1612(ZEXT816(0),4);
- local_110._0_4_ = 0xffff0000;
- local_100 = ZEXT816(0);
- CmpUnlockRegistry();
- cVar5 = '\0';
- iVar7 = CmpRollbackTransactionArray(uVar8);
- if (iVar7 < 0) {
- LAB_1:
- cVar17 = '\0';
- cVar6 = '\0';
- LAB_11:
- if (local_140 != 0) {
+ pvVar6 = local_130;
+ cVar1 = local_188;
+ if (local_16c != -1) {
+ CmpFreeValue();
+ pvVar6 = local_130;
+ cVar1 = local_188;
+ }
+ }
+ goto LAB_1;
+ }
+ local_1a8 = (int *)CONCAT44(local_1a8._4_4_,uVar14);
+ iVar3 = CmpCompareNewValueDataAgainstKCBCache(pvVar12,local_148,local_168,local_100);
+ if (iVar3 == 1) {
+ CmpUnlockKcbStack(local_128);
+ CmpLockKcbStackTopExclusiveRestShared(local_128);
+ param_1 = local_180;
+ }
+ else {
+ if (iVar3 == 0) {
+ iVar3 = 0;
+ cVar1 = local_188;
+ goto LAB_1;
+ }
+ bVar18 = true;
+ if ((*(void **)((longlong)pvVar12 + 0x38) == SystemReserved1[15]) ||
+ (cVar1 = CmpTryConvertKcbLockSharedToExclusive(pvVar12), cVar1 != '\0'))
+ goto LAB_10;
+ CmpUnlockKcbStack(local_128);
+ CmpLockKcbStackTopExclusiveRestShared(local_128);
+ param_1 = local_180;
+ lVar16 = local_140;
+ }
+ }
+ }
+ iVar3 = CmpSnapshotTxOwnerArray(piVar10,&local_158,&local_f8);
+ if (iVar3 < 0) {
LAB_7:
- lVar15 = local_140;
- CmpRundownUnitOfWork(local_140);
- ExFreePoolWithTag(lVar15);
- }
- LAB_5:
- if (local_165 != '\0') {
- if (*(int *)(lVar13 + 0x11c) != -1) {
- HvFreeCell(*(undefined8 *)(lVar13 + 0x20));
- }
- *(undefined4 *)(lVar13 + 0x11c) = 0xffffffff;
- *(undefined4 *)(lVar13 + 0x118) = 0;
- *(undefined8 *)(lVar13 + 0x120) = 0;
- }
- if (cVar17 != '\0') {
- lVar13 = *(longlong *)(lVar13 + 0x20);
- LOCK();
- bVar20 = *(longlong *)(lVar13 + 0x48) == 0x11;
- if (bVar20) {
- *(longlong *)(lVar13 + 0x48) = 0;
- }
- UNLOCK();
- if (!bVar20) {
- ExfReleasePushLockShared(lVar13 + 0x48);
- }
- KeAbPostRelease(lVar13 + 0x48);
- }
- if (cVar6 != '\0') {
- CmpUnlockKcbStack(local_110);
- }
- pvVar12 = (void *)0x0;
- CmpDrainDelayDerefContext(local_b8);
- if (cVar5 != '\0') {
- CmpUnlockRegistry();
- }
- if ((undefined8 *****)local_d8 != &local_d8) {
- CmpSignalDeferredPosts(&local_d8);
- }
- CmpDetachFromRegistryProcess(local_88);
- pvVar4 = local_c8;
- if (((-1 < iVar7) && (param_7 != '\0')) && (local_c8 != (void *)0x0)) {
- local_98._4_4_ = local_160;
- local_98._0_4_ = local_158;
- uStack_90 = local_e8;
- local_170 = local_150;
- local_180 = local_c0;
- pvVar12 = local_c8;
- local_188 = param_1;
- local_178 = (int *)local_a8;
- SeAdtRegistryValueChangedAuditAlarm(0,local_c8,0,local_130);
- }
- if (local_a8._8_8_ != 0) {
- pvVar12 = (void *)0x34414d43;
- CmpFreePoolWithTag();
- }
- if (pvVar4 != (void *)0x0) {
- pvVar12 = (void *)0x33414d43;
- CmpFreePoolWithTag(pvVar4);
- }
- if ((void *)local_100._8_8_ != (void *)0x0) {
- SmFreeWrapper((void *)local_100._8_8_,pvVar12);
- }
- __security_check_cookie(local_58 ^ (ulonglong)auStack_1a8);
- return;
- }
- LAB_8:
- cVar5 = CmpIsShutdownRundownActive();
- uVar2 = _DAT_0;
- goto joined_r0x0001406b45f4;
+ cVar2 = '\0';
+ cVar1 = local_188;
+ goto LAB_1;
+ }
+ pvVar11 = (void *)0x0;
+ local_1a8 = (int *)CONCAT44(local_1a8._4_4_,local_158);
+ CmpLogTransactionAbortedWithChildName(pvVar12);
+ CmpUnlockKcbStack(local_128);
+ cVar1 = '\0';
+ if ((void *)local_118._8_8_ != (void *)0x0) {
+ SmFreeWrapper((void *)local_118._8_8_,pvVar11);
+ }
+ local_128._4_12_ = SUB1612(ZEXT816(0),4);
+ local_128._0_4_ = 0xffff0000;
+ local_118 = ZEXT816(0);
+ CmpUnlockRegistry();
+ local_186 = '\0';
+ iVar3 = CmpRollbackTransactionArray();
+ if (iVar3 < 0) goto LAB_6;
+ cVar1 = CmpIsShutdownRundownActive();
+ } while( true );
}
WbCreateHeapExecutedBlock
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
code,name,fullname,refcount,length,sig,address,called
ratio
0.36
i_ratio
0.32
m_ratio
0.26
b_ratio
0.6
match_types
Implied Match
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
WbCreateHeapExecutedBlock
FUN_14070897c
fullname
WbCreateHeapExecutedBlock
FUN_14070897c
refcount
3
2
length
1273
1818
called
ExFreePoolWithTag FUN_140707cb0 FUN_14070881c FUN_140709974 FUN_140709bb0 RtlCopyMemory WbAlloc WbAllocateUserMemory ZwFlushInstructionCache memset
Expand for full list: ExFreePoolWithTag FUN_140708564 FUN_140709388 FUN_14070a4d4 FUN_14070a710 Feature_1171241279__private_IsEnabled IoAllocateMdl IoFreeMdl MmProbeAndLockPagesPrivate MmUnlockPages RtlCopyMemory WbAlloc WbAllocateUserMemory ZwFlushInstructionCache memset
calling
WbGetHeapExecutedBlock
WbGetHeapExecutedBlock
paramcount
0
0
address
1407080c8
14070897c
sig
undefined WbCreateHeapExecutedBlock(void)
undefined FUN_14070897c(void)
sym_type
Function
Function
sym_source
IMPORTED
DEFAULT
external
False
False
WbCreateHeapExecutedBlock Called Diff
--- WbCreateHeapExecutedBlock called
+++ FUN_14070897c called
@@ -2,4 +2,9 @@
- FUN_140707cb0
- FUN_14070881c
- FUN_140709974
- FUN_140709bb0
+ FUN_140708564
+ FUN_140709388
+ FUN_14070a4d4
+ FUN_14070a710
+ Feature_1171241279__private_IsEnabled
+ IoAllocateMdl
+ IoFreeMdl
+ MmProbeAndLockPagesPrivate
+ MmUnlockPages
WbCreateHeapExecutedBlock Diff
--- WbCreateHeapExecutedBlock
+++ FUN_14070897c
@@ -1,145 +1,242 @@
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
- int WbCreateHeapExecutedBlock(undefined8 param_1,longlong *param_2,undefined8 *param_3)
+ int FUN_14070897c(undefined8 param_1,longlong *param_2,undefined8 *param_3)
{
ulonglong uVar1;
ulonglong uVar2;
short sVar3;
bool bVar4;
- longlong *plVar5;
- int iVar6;
- undefined8 uVar7;
- void *local_58;
- longlong local_50;
- longlong *local_48;
- ulonglong local_40;
+ bool bVar5;
+ longlong *plVar6;
+ bool bVar7;
+ int iVar8;
+ int iVar9;
+ longlong lVar10;
+ undefined8 uVar11;
+ longlong lVar12;
+ longlong lVar13;
+ void *local_88;
+ undefined4 local_80;
+ int local_7c;
+ int local_78;
+ longlong local_70;
+ longlong local_68;
+ longlong local_60;
+ longlong local_58;
+ longlong *local_50;
+ ulonglong local_48;
- local_48 = (longlong *)0x0;
- local_50 = 0;
- local_58 = (void *)0x0;
- local_40 = (ulonglong)DAT_0;
- iVar6 = WbAlloc(0x58);
- if (iVar6 < 0) goto LAB_1;
+ lVar10 = 0;
+ local_50 = (longlong *)0x0;
+ local_60 = 0;
+ local_88 = (void *)0x0;
+ lVar12 = 0;
+ local_58 = 0;
+ local_70 = 0;
+ local_68 = 0;
+ bVar5 = false;
+ local_80 = 0;
+ local_7c = 0;
+ local_78 = 0;
+ local_48 = (ulonglong)DAT_0;
+ iVar8 = WbAlloc(0x58);
+ lVar13 = lVar10;
+ if (iVar8 < 0) goto LAB_1;
memset((void *)0x0,0,0x58);
_DAT_2 = _DAT_2 & 0xfffffffe;
bVar4 = true;
_DAT_3 = 1;
+ lVar13 = lVar12;
if (*(int *)(param_2 + 1) == 1) {
- uVar7 = 0xf8;
+ iVar8 = FUN_140708564(param_2 + 2,0xf8);
+ if (iVar8 < 0) goto LAB_1;
+ iVar8 = Feature_1171241279__private_IsEnabled();
+ bVar7 = false;
+ if (iVar8 != 0) {
+ lVar10 = IoAllocateMdl(param_2[0x29],0xf8,0,0,0);
+ if (lVar10 == 0) {
+ LAB_4:
+ iVar8 = -0x3fffffe9;
+ lVar13 = lVar10;
+ local_58 = lVar10;
+ goto LAB_1;
+ }
+ local_58 = lVar10;
+ MmProbeAndLockPagesPrivate(lVar10);
+ local_80 = 1;
+ bVar7 = true;
+ }
+ bVar5 = bVar7;
+ uVar11 = 0xf8;
}
else {
if (*(int *)(param_2 + 1) != 0) {
- iVar6 = -0x3ffffff3;
- goto LAB_1;
- }
- uVar7 = 0xf0;
- }
- iVar6 = FUN_140707cb0(param_2 + 2,uVar7);
- if ((((iVar6 < 0) || (iVar6 = FUN_140709974(param_2[0x29],uVar7,1), iVar6 < 0)) ||
- (iVar6 = WbAllocateUserMemory(param_1,*(undefined4 *)(param_2 + 0x28),&local_48,&local_50),
- iVar6 < 0)) || (iVar6 = WbAlloc(*(undefined4 *)(param_2 + 0x28),&local_58), iVar6 < 0))
+ iVar8 = -0x3ffffff3;
+ goto LAB_1;
+ }
+ iVar8 = FUN_140708564(param_2 + 2,0xf0);
+ if (iVar8 < 0) goto LAB_1;
+ iVar8 = Feature_1171241279__private_IsEnabled();
+ bVar7 = false;
+ if (iVar8 != 0) {
+ lVar10 = IoAllocateMdl(param_2[0x29],0xf0,0,0,0);
+ if (lVar10 == 0) goto LAB_4;
+ local_58 = lVar10;
+ MmProbeAndLockPagesPrivate(lVar10);
+ local_80 = 1;
+ bVar7 = true;
+ }
+ bVar5 = bVar7;
+ uVar11 = 0xf0;
+ }
+ iVar8 = FUN_14070a4d4(param_2[0x29],uVar11,1);
+ lVar13 = lVar10;
+ if (((iVar8 < 0) ||
+ (iVar8 = WbAllocateUserMemory(param_1,*(undefined4 *)(param_2 + 0x28),&local_50,&local_60),
+ iVar8 < 0)) || (iVar8 = WbAlloc(*(undefined4 *)(param_2 + 0x28),&local_88), iVar8 < 0))
goto LAB_1;
if (*(uint *)((longlong)param_2 + 0x11c) != 0) {
uVar1 = param_2[0x22] + (ulonglong)*(uint *)((longlong)param_2 + 0x11c);
if ((0x7fffffff0000 < uVar1) || (uVar1 < (ulonglong)param_2[0x22])) {
- DAT_4 = 0;
- }
- }
- RtlCopyMemory((void *)((ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_58),
+ DAT_5 = 0;
+ }
+ }
+ RtlCopyMemory((void *)((ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_88),
(void *)param_2[0x22],(ulonglong)*(uint *)((longlong)param_2 + 0x11c));
if (*(int *)(param_2 + 1) == 1) {
if (*(uint *)((longlong)param_2 + 0x11c) < 4) {
- iVar6 = -0x3ffffff3;
- goto LAB_1;
- }
- *(undefined4 *)((ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_58) =
+ iVar8 = -0x3ffffff3;
+ goto LAB_1;
+ }
+ *(undefined4 *)((ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_88) =
*(undefined4 *)((longlong)param_2 + 0x124);
}
else if (*(int *)(param_2 + 1) != 0) {
- iVar6 = -0x3ffffff3;
+ iVar8 = -0x3ffffff3;
goto LAB_1;
}
- iVar6 = FUN_140709bb0(0,(ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_58,
- (ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_58,
+ iVar8 = Feature_1171241279__private_IsEnabled();
+ if (iVar8 != 0) {
+ local_70 = IoAllocateMdl(param_2[0x22],*(undefined4 *)((longlong)param_2 + 0x11c),0,0,0);
+ if (local_70 == 0) {
+ iVar8 = -0x3fffffe9;
+ goto LAB_1;
+ }
+ MmProbeAndLockPagesPrivate(local_70);
+ local_7c = 1;
+ }
+ iVar8 = FUN_14070a710(0,(ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_88,
+ (ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_88,
*(undefined4 *)((longlong)param_2 + 0x11c),param_2 + 0xb,
*(undefined4 *)(param_2 + 0x23),param_2 + 0xc);
- if ((iVar6 < 0) ||
- (iVar6 = FUN_140709974(param_2[0x22],*(undefined4 *)((longlong)param_2 + 0x11c),1), iVar6 < 0))
+ if ((iVar8 < 0) ||
+ (iVar8 = FUN_14070a4d4(param_2[0x22],*(undefined4 *)((longlong)param_2 + 0x11c),1), iVar8 < 0))
goto LAB_1;
uVar1 = param_2[0x25];
if (uVar1 != 0) {
if ((*(uint *)((longlong)param_2 + 0x134) != 0) &&
((uVar2 = uVar1 + *(uint *)((longlong)param_2 + 0x134), 0x7fffffff0000 < uVar2 ||
(uVar2 < uVar1)))) {
- DAT_4 = 0;
- }
- RtlCopyMemory((void *)((ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_58),
+ DAT_5 = 0;
+ }
+ RtlCopyMemory((void *)((ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_88),
(void *)param_2[0x25],(ulonglong)*(uint *)((longlong)param_2 + 0x134));
if (*(int *)(param_2 + 1) == 1) {
if (*(uint *)((longlong)param_2 + 0x134) < 4) {
- iVar6 = -0x3ffffff3;
+ iVar8 = -0x3ffffff3;
goto LAB_1;
}
- *(undefined4 *)((ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_58) =
+ *(undefined4 *)((ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_88) =
*(undefined4 *)((longlong)param_2 + 0x13c);
}
else if (*(int *)(param_2 + 1) != 0) {
- iVar6 = -0x3ffffff3;
- goto LAB_1;
- }
- iVar6 = FUN_140709bb0(0,(ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_58,
- (ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_58,
+ iVar8 = -0x3ffffff3;
+ goto LAB_1;
+ }
+ iVar8 = Feature_1171241279__private_IsEnabled();
+ if (iVar8 != 0) {
+ local_68 = IoAllocateMdl(param_2[0x25],*(undefined4 *)((longlong)param_2 + 0x134),0,0,0);
+ if (local_68 == 0) {
+ iVar8 = -0x3fffffe9;
+ goto LAB_1;
+ }
+ MmProbeAndLockPagesPrivate(local_68);
+ local_78 = 1;
+ }
+ iVar8 = FUN_14070a710(0,(ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_88,
+ (ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_88,
*(undefined4 *)((longlong)param_2 + 0x134),param_2 + 0xb,
*(undefined4 *)(param_2 + 0x26),param_2 + 0xc);
- if ((iVar6 < 0) ||
- (iVar6 = FUN_140709974(param_2[0x25],*(undefined4 *)((longlong)param_2 + 0x134),1), iVar6 < 0
+ if ((iVar8 < 0) ||
+ (iVar8 = FUN_14070a4d4(param_2[0x25],*(undefined4 *)((longlong)param_2 + 0x134),1), iVar8 < 0
)) goto LAB_1;
}
- plVar5 = local_48;
- RtlCopyMemory(local_48,local_58,(ulonglong)*(uint *)(param_2 + 0x28));
+ plVar6 = local_50;
+ RtlCopyMemory(local_50,local_88,(ulonglong)*(uint *)(param_2 + 0x28));
lRam0000000000000040 = *param_2;
- _DAT_5 = plVar5;
- lRam0000000000000018 = (ulonglong)*(uint *)(param_2 + 0x24) + local_50;
+ _DAT_6 = plVar6;
+ lRam0000000000000018 = (ulonglong)*(uint *)(param_2 + 0x24) + local_60;
if (*(uint *)(param_2 + 0x27) == 0) {
- _DAT_6 = 0;
+ _DAT_7 = 0;
}
else {
- _DAT_6 = (ulonglong)*(uint *)(param_2 + 0x27) + local_50;
- }
- _DAT_7 = *(undefined4 *)(param_2 + 0x28);
+ _DAT_7 = (ulonglong)*(uint *)(param_2 + 0x27) + local_60;
+ }
+ _DAT_8 = *(undefined4 *)(param_2 + 0x28);
lRam0000000000000030 = param_2[0x22];
- _DAT_8 = param_2[0x22] - lRam0000000000000018;
+ _DAT_9 = param_2[0x22] - lRam0000000000000018;
if (*(longlong *)(*(longlong *)((longlong)SystemReserved1[15] + 0xb8) + 0x580) == 0) {
- LAB_9:
- *plVar5 = _DAT_8;
+ LAB_10:
+ *plVar6 = _DAT_9;
}
else {
sVar3 = *(short *)(*(longlong *)((longlong)SystemReserved1[15] + 0xb8) + 0x96c);
if ((sVar3 != 0x14c) && (sVar3 != 0x1c4)) {
bVar4 = false;
}
- if (!bVar4) goto LAB_9;
- *plVar5 = lRam0000000000000040;
- }
- _DAT_5[1] = local_40;
- iVar6 = ZwFlushInstructionCache
+ if (!bVar4) goto LAB_10;
+ *plVar6 = lRam0000000000000040;
+ }
+ _DAT_6[1] = local_48;
+ iVar8 = ZwFlushInstructionCache
(0xffffffffffffffff,lRam0000000000000018,
*(undefined4 *)((longlong)param_2 + 0x11c));
- if ((-1 < iVar6) &&
+ if ((-1 < iVar8) &&
(((param_2[0x25] == 0 ||
- (iVar6 = ZwFlushInstructionCache
- (0xffffffffffffffff,_DAT_6,
- *(undefined4 *)((longlong)param_2 + 0x134)), -1 < iVar6)) &&
+ (iVar8 = ZwFlushInstructionCache
+ (0xffffffffffffffff,_DAT_7,
+ *(undefined4 *)((longlong)param_2 + 0x134)), -1 < iVar8)) &&
(param_3 != (undefined8 *)0x0)))) {
*param_3 = 0;
}
LAB_1:
- FUN_14070881c(param_1,0);
- if (local_58 != (void *)0x0) {
- ExFreePoolWithTag(local_58,0);
- }
- return iVar6;
+ iVar9 = Feature_1171241279__private_IsEnabled();
+ if (iVar9 != 0) {
+ if (lVar13 != 0) {
+ if (bVar5) {
+ MmUnlockPages(lVar13);
+ }
+ IoFreeMdl(lVar13);
+ }
+ if (local_70 != 0) {
+ if (local_7c != 0) {
+ MmUnlockPages(local_70);
+ }
+ IoFreeMdl(local_70);
+ }
+ if (local_68 != 0) {
+ if (local_78 != 0) {
+ MmUnlockPages(local_68);
+ }
+ IoFreeMdl(local_68);
+ }
+ }
+ FUN_140709388(param_1,0);
+ if (local_88 != (void *)0x0) {
+ ExFreePoolWithTag(local_88,0);
+ }
+ return iVar8;
}
Modified (No Code Changes)
Slightly modified functions have no code changes, rather differnces in:
refcount
length
called
calling
name
fullname
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address
ratio
0.93
i_ratio
0.68
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
VfDriverUnloadImage
VfDriverUnloadImage
fullname
VfDriverUnloadImage
VfDriverUnloadImage
refcount
6
4
length
313
313
called
ExFreePoolWithTag VfDeadlockDeleteMemoryRange VfIsVerifierEnabled VfRemLockDeleteMemoryRange VfSuspectDriversUnloadCallback VfTargetDriversRemove VfVolatileClearDifRuleClass ViThunkRemoveImportEntry
ExFreePoolWithTag VfDeadlockDeleteMemoryRange VfIsVerifierEnabled VfRemLockDeleteMemoryRange VfSuspectDriversUnloadCallback VfTargetDriversRemove VfVolatileClearDifRuleClass ViThunkRemoveImportEntry
calling
MiUnloadSystemImage
MiUnloadSystemImage
paramcount
0
0
address
140abde3c
140abe200
sig
undefined VfDriverUnloadImage(void)
undefined VfDriverUnloadImage(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address
ratio
0.83
i_ratio
1.0
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
SmFreeWrapper
SmFreeWrapper
fullname
SmFreeWrapper
SmFreeWrapper
refcount
200
199
length
16
16
called
ExFreePoolWithTag
ExFreePoolWithTag
calling
Expand for full list: CMFCheckAccess CmCallbackGetKeyObjectID CmCallbackGetKeyObjectIDEx CmCreateKey CmDeleteKey CmDeleteValueKey CmEnumerateValueFromLayeredKey CmInitSystem1 CmLoadAppKey CmLoadDifferencingKey CmLoadKey CmQueryMultipleValueForLayeredKey CmQueryValueKey CmRenameKey CmReplaceKey CmSaveKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmUnloadKey CmUpdateFeatureConfiguration CmUpdateFeatureUsageSubscription CmpAddToHiveFileList CmpAssignKeySecurity CmpBounceContextCleanup CmpCaptureKeyValueArray CmpCheckAdminAccess CmpCheckKeyBodyAccess CmpCleanupKcbStack CmpCleanupKeyNodeStack CmpCleanupLightWeightUoWData CmpCleanupRollbackPacket CmpConstructNameFromKeyNodes CmpConstructNameWithStatus CmpCopySyncTree CmpCreateRegistryProcessToken CmpDoBuildVirtualStack CmpDoFileWrite CmpDoParseKey CmpDoReadTxRBigLogRecord CmpDoWritethroughReparse CmpEnumerateLayeredKey CmpFinishSystemHivesLoad CmpGetSymbolicLinkTarget CmpInitializeRegistryProcess CmpIsKeyDeleted CmpKeyEnumStackCleanup CmpKeyEnumStackFreeResumeContext CmpLightWeightCommitDeleteKeyUoW CmpLightWeightPrepareDeleteKeyUoW CmpLoadHiveVolatile CmpLockKeyBodyIntoMemory CmpLogTransactionAbortedWithChildName CmpMarkIndexDirty CmpMergeKeyValues CmpOpenHiveFile CmpOpenHiveFiles CmpParseKey CmpPartialPromoteSubkeys CmpPerformUnloadKey CmpPromoteKey CmpQueryFileSecurityDescriptor CmpQueryKeySecurity CmpReadBuildVersion CmpRecordShutdownStopTime CmpRefreshHive CmpReorganizeHive CmpReportNotify CmpReserveRollbackPacketSpace CmpRmReDoPhase CmpSaveBootControlSet CmpSetKeySecurity CmpSetSecurityDescriptorInfo CmpSortedValueEnumStackCleanup CmpSortedValueEnumStackEntryStart CmpStartSiloRegistryNamespace CmpSubtreeEnumeratorCleanup CmpUnlockKeyBodyFromMemory CmpValueEnumStackCleanup CmpVolumeContextCreate CmpVolumeContextDecrementRefCount CmpVolumeManagerGetContextForFile ExInitializeLookasideListExInternal HvLoadHive HvRecoverFlushProtocolStateFromFiles HvpPerformLogFileRecovery HvpRecoverDataReadRoutine HvpViewMapCreateView HvpViewMapCreateViewsForRegion HvpViewMapDeleteViewTreeNode HvpViewMapPromoteRangeToMapping HvpViewMapShrinkStorage IopParseDevice KiInitializeSingleDpcRuntimeHistoryHashTable MiDeletePagefile MiExtendSection NtCompactKeys NtDeleteValueKey NtQueryKey NtQueryMultipleValueKey NtQueryOpenSubKeysEx NtQueryValueKey NtRenameKey NtSetValueKey ObCheckCreateObjectAccess ObCheckObjectAccess ObpCheckTraverseAccess ObpCreateHandle PfSnCleanupTrace SmCrEncCleanup SmCreatePartition SmDeletePartition SmKmCleanup SmKmFileInfoCleanup SmKmKeyGenKeyDelete SmKmKeyGenNewKey SmKmStoreAdd SmKmStoreFileGetExtents SmKmStoreFileWriteHeader SmPartitionCleanup SmProcessCreateRequest SmProcessListRequest SmProcessStatsRequest SmcCacheCleanup SmcCacheDelete SmcProcessCreateRequest SmcStoreCreate SmcStoreDelete SmcStoreResize SmcStoreSlotAbort SmcStoreSlotReserve SmpKeyedStoreCreate SmpKeyedStoreDeleteInitiate SmpKeyedStoreEntryGet VerifierExInitializeLookasideListEx
Expand for full list: CMFCheckAccess CmCallbackGetKeyObjectID CmCallbackGetKeyObjectIDEx CmCreateKey CmDeleteKey CmDeleteValueKey CmEnumerateValueFromLayeredKey CmInitSystem1 CmLoadAppKey CmLoadDifferencingKey CmLoadKey CmQueryMultipleValueForLayeredKey CmQueryValueKey CmRenameKey CmReplaceKey CmSaveKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmUnloadKey CmUpdateFeatureConfiguration CmUpdateFeatureUsageSubscription CmpAddToHiveFileList CmpAssignKeySecurity CmpBounceContextCleanup CmpCaptureKeyValueArray CmpCheckAdminAccess CmpCheckKeyBodyAccess CmpCleanupKcbStack CmpCleanupKeyNodeStack CmpCleanupLightWeightUoWData CmpCleanupRollbackPacket CmpConstructNameFromKeyNodes CmpConstructNameWithStatus CmpCopySyncTree CmpCreateRegistryProcessToken CmpDoBuildVirtualStack CmpDoFileWrite CmpDoParseKey CmpDoReadTxRBigLogRecord CmpDoWritethroughReparse CmpEnumerateLayeredKey CmpFinishSystemHivesLoad CmpGetSymbolicLinkTarget CmpInitializeRegistryProcess CmpIsKeyDeleted CmpKeyEnumStackCleanup CmpKeyEnumStackFreeResumeContext CmpLightWeightCommitDeleteKeyUoW CmpLightWeightPrepareDeleteKeyUoW CmpLoadHiveVolatile CmpLockKeyBodyIntoMemory CmpLogTransactionAbortedWithChildName CmpMarkIndexDirty CmpMergeKeyValues CmpOpenHiveFile CmpOpenHiveFiles CmpParseKey CmpPartialPromoteSubkeys CmpPerformUnloadKey CmpPromoteKey CmpQueryFileSecurityDescriptor CmpQueryKeySecurity CmpReadBuildVersion CmpRecordShutdownStopTime CmpRefreshHive CmpReorganizeHive CmpReportNotify CmpReserveRollbackPacketSpace CmpRmReDoPhase CmpSaveBootControlSet CmpSetKeySecurity CmpSetSecurityDescriptorInfo CmpSortedValueEnumStackCleanup CmpSortedValueEnumStackEntryStart CmpStartSiloRegistryNamespace CmpSubtreeEnumeratorCleanup CmpUnlockKeyBodyFromMemory CmpValueEnumStackCleanup CmpVolumeContextCreate CmpVolumeContextDecrementRefCount CmpVolumeManagerGetContextForFile ExInitializeLookasideListExInternal HvLoadHive HvRecoverFlushProtocolStateFromFiles HvpPerformLogFileRecovery HvpRecoverDataReadRoutine HvpViewMapCreateView HvpViewMapCreateViewsForRegion HvpViewMapDeleteViewTreeNode HvpViewMapPromoteRangeToMapping HvpViewMapShrinkStorage IopParseDevice KiInitializeSingleDpcRuntimeHistoryHashTable MiDeletePagefile MiExtendSection NtCompactKeys NtDeleteValueKey NtQueryKey NtQueryMultipleValueKey NtQueryOpenSubKeysEx NtQueryValueKey NtRenameKey NtSetValueKey ObCheckCreateObjectAccess ObCheckObjectAccess ObpCheckTraverseAccess ObpCreateHandle PfSnCleanupTrace SmCrEncCleanup SmCreatePartition SmDeletePartition SmKmCleanup SmKmFileInfoCleanup SmKmKeyGenKeyDelete SmKmKeyGenNewKey SmKmStoreAdd SmKmStoreFileGetExtents SmKmStoreFileWriteHeader SmPartitionCleanup SmProcessCreateRequest SmProcessListRequest SmProcessStatsRequest SmcCacheCleanup SmcCacheDelete SmcProcessCreateRequest SmcStoreCreate SmcStoreDelete SmcStoreResize SmcStoreSlotAbort SmcStoreSlotReserve SmpKeyedStoreCreate SmpKeyedStoreDeleteInitiate SmpKeyedStoreEntryGet VerifierExInitializeLookasideListEx
paramcount
2
2
address
140283ae0
140283880
sig
void __cdecl SmFreeWrapper(void * param_1, void * param_2)
void __cdecl SmFreeWrapper(void * param_1, void * param_2)
sym_type
Function
Function
sym_source
ANALYSIS
ANALYSIS
external
False
False
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address
ratio
1.0
i_ratio
0.88
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
__GSHandlerCheck
__GSHandlerCheck
fullname
__GSHandlerCheck
__GSHandlerCheck
refcount
2625
2626
length
29
29
called
__GSHandlerCheckCommon
__GSHandlerCheckCommon
calling
paramcount
0
0
address
1403d6494
1403d6484
sig
undefined __GSHandlerCheck(void)
undefined __GSHandlerCheck(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
1.0
i_ratio
0.85
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
VrpGetNextToken
VrpGetNextToken
fullname
VrpGetNextToken
VrpGetNextToken
refcount
12
14
length
233
233
called
calling
VrpComparePath VrpCountPathComponents VrpCreateNamespaceNode VrpPreLoadKey VrpTranslatePath
VrpComparePath VrpCountPathComponents VrpCreateNamespaceNode VrpPreLoadKey VrpPreOpenOrCreate VrpTranslatePath
paramcount
0
0
address
1406cbd44
1406cc364
sig
undefined VrpGetNextToken(void)
undefined VrpGetNextToken(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
VrpGetNextToken Calling Diff
--- VrpGetNextToken calling
+++ VrpGetNextToken calling
@@ -4,0 +5 @@
+ VrpPreOpenOrCreate
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.92
i_ratio
0.83
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
IoAllocateMdl
IoAllocateMdl
fullname
IoAllocateMdl
IoAllocateMdl
refcount
45
49
length
400
400
called
ExAllocatePool2 ExpInterlockedPopEntrySList _guard_dispatch_icall
ExAllocatePool2 ExpInterlockedPopEntrySList _guard_dispatch_icall
calling
Expand for full list: AlpcpInitializeCompletionList BuildQueryDirectoryIrp CcMdlRead EtwpBuildMdlForTraceBuffer EtwpSavePersistedLogger FUN_140a4ecb0 FsRtlKernelFsControlFile HalGetAdapterV2 HalGetAdapterV3 HvlpDynamicUpdateMicrocode IopAllocateAndLockMdl IopLiveDumpAllocateMappingResources IopReadFile IopSetEaOrQuotaInformationFile IopSetFileObjectIosbRange IopXxxControlFile IovAllocateMdl MiApplyImageHotPatch MiCreateMdl MiLockAndMapEntireDriver MiMapHotPatchImageInSystemSpace NtFreeUserPhysicalPages NtNotifyChangeDirectoryFileEx NtPssCaptureVaSpaceBulk NtQueryEaFile NtQueryQuotaInformationFile NtReadFileScatter NtSetEaFile NtWriteFileGather PnprInitializeMappingReserve PopReadPagesFromHiberFile VerifierPortIoAllocateMdl VfBuildMdlFromScatterGatherList ViAllocateMapRegisterFile WbMakeUserExecutablePagesKernelWritable
Expand for full list: AlpcpInitializeCompletionList BuildQueryDirectoryIrp CcMdlRead EtwpBuildMdlForTraceBuffer EtwpSavePersistedLogger FUN_14070897c FUN_140a4ec40 FsRtlKernelFsControlFile HalGetAdapterV2 HalGetAdapterV3 HvlpDynamicUpdateMicrocode IopAllocateAndLockMdl IopLiveDumpAllocateMappingResources IopReadFile IopSetEaOrQuotaInformationFile IopSetFileObjectIosbRange IopXxxControlFile IovAllocateMdl MiApplyImageHotPatch MiCreateMdl MiLockAndMapEntireDriver MiMapHotPatchImageInSystemSpace NtFreeUserPhysicalPages NtNotifyChangeDirectoryFileEx NtPssCaptureVaSpaceBulk NtQueryEaFile NtQueryQuotaInformationFile NtReadFileScatter NtSetEaFile NtWriteFileGather PnprInitializeMappingReserve PopReadPagesFromHiberFile VerifierPortIoAllocateMdl VfBuildMdlFromScatterGatherList ViAllocateMapRegisterFile WbMakeUserExecutablePagesKernelWritable
paramcount
5
5
address
140313c30
140313c20
sig
undefined IoAllocateMdl(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5)
undefined IoAllocateMdl(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
IoAllocateMdl Calling Diff
--- IoAllocateMdl calling
+++ IoAllocateMdl calling
@@ -6 +6,2 @@
- FUN_140a4ecb0
+ FUN_14070897c
+ FUN_140a4ec40
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address
ratio
0.97
i_ratio
0.83
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
RtlIsSandboxedToken
RtlIsSandboxedToken
fullname
RtlIsSandboxedToken
RtlIsSandboxedToken
refcount
16
17
length
155
155
called
SeCaptureSubjectContext SeQueryInformationToken SeReleaseSubjectContext
SeCaptureSubjectContext SeQueryInformationToken SeReleaseSubjectContext
calling
Expand for full list: CmSetValueKey CmpCheckCreateAccess IopCheckInitiatorHint IopXxxControlFile NtDuplicateToken NtSetInformationFile ObCreateSymbolicLink ObpCreateDirectoryObject ObpGetShadowDirectory ObpParseSymbolicLinkEx SepFilterToken
Expand for full list: CmSetValueKey CmpCheckCreateAccess IopCheckInitiatorHint IopXxxControlFile NtDuplicateToken NtSetInformationFile ObCreateSymbolicLink ObpCreateDirectoryObject ObpGetShadowDirectory ObpParseSymbolicLinkEx SepFilterToken
paramcount
0
0
address
140712d60
1407137a0
sig
undefined RtlIsSandboxedToken(void)
undefined RtlIsSandboxedToken(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.97
i_ratio
0.76
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
IoFreeMdl
IoFreeMdl
fullname
IoFreeMdl
IoFreeMdl
refcount
66
69
length
182
182
called
ExFreePoolWithTag ExpInterlockedPushEntrySList MmUnmapLockedPages _guard_dispatch_icall
ExFreePoolWithTag ExpInterlockedPushEntrySList MmUnmapLockedPages _guard_dispatch_icall
calling
Expand for full list: AlpcpFreeCompletionList AlpcpInitializeCompletionList CcCopyBytesToUserBuffer CcLockSystemCacheBuffer CcMapAndCopyInToCache CcMdlRead$fin$0 CcMdlReadComplete2 CcMdlWriteAbort CcMdlWriteComplete2 CcPrepareMdlWrite$fin$0 CcZeroDataInCache CcZeroDataInCache$fin$0 DifIoFreeMdlWrapper FUN_14070752c FUN_140a4ecb0 FsRtlpFreeMdlChain HalBuildMdlFromScatterGatherListV2 HalBuildMdlFromScatterGatherListV3 HalFlushAdapterBuffersEx HalMapTransferEx HalPutScatterGatherListV2 HalPutScatterGatherListV3 HalpDmaCheckMdlAccessibility HalpDmaFreeChildAdapter HvlGetCoverageData HvlpDynamicUpdateMicrocode IoWriteCapturedPristineTriageDumpToDedicatedDumpFile IopCleanupFileObjectIosbRange IopCompleteRequest IopDropIrp IopExceptionCleanupEx IopLiveDumpFreeMappingResources IopMcReleaseMdl IopSetFileObjectIosbRange IopUnlockAndFreeMdl IopfCompleteRequest MiApplyImageHotPatch MiDeleteImageCreationMdls MiLockAndMapEntireDriver MiMapHotPatchImageInSystemSpace MiPrepareImagePagesForHotPatch MiReleaseHotPatchResources MiUnlockAndFreeDvPatchImage MiUnlockEntireDriver MiZeroPageWrite NT_DISK::Read NT_DISK::Write NtFreeUserPhysicalPages NtPssCaptureVaSpaceBulk PnprFreeMappingReserve PopReadPagesFromHiberFile PsDispatchIumService ViAllocateMapRegisterFile ViFreeMapRegisterFile WbMakeUserExecutablePagesKernelWritable
Expand for full list: AlpcpFreeCompletionList AlpcpInitializeCompletionList CcCopyBytesToUserBuffer CcLockSystemCacheBuffer CcMapAndCopyInToCache CcMdlRead$fin$0 CcMdlReadComplete2 CcMdlWriteAbort CcMdlWriteComplete2 CcPrepareMdlWrite$fin$0 CcZeroDataInCache CcZeroDataInCache$fin$0 DifIoFreeMdlWrapper FUN_140707cbc FUN_14070897c FUN_140a4ec40 FsRtlpFreeMdlChain HalBuildMdlFromScatterGatherListV2 HalBuildMdlFromScatterGatherListV3 HalFlushAdapterBuffersEx HalMapTransferEx HalPutScatterGatherListV2 HalPutScatterGatherListV3 HalpDmaCheckMdlAccessibility HalpDmaFreeChildAdapter HvlGetCoverageData HvlpDynamicUpdateMicrocode IoWriteCapturedPristineTriageDumpToDedicatedDumpFile IopCleanupFileObjectIosbRange IopCompleteRequest IopDropIrp IopExceptionCleanupEx IopLiveDumpFreeMappingResources IopMcReleaseMdl IopSetFileObjectIosbRange IopUnlockAndFreeMdl IopfCompleteRequest MiApplyImageHotPatch MiDeleteImageCreationMdls MiLockAndMapEntireDriver MiMapHotPatchImageInSystemSpace MiPrepareImagePagesForHotPatch MiReleaseHotPatchResources MiUnlockAndFreeDvPatchImage MiUnlockEntireDriver MiZeroPageWrite NT_DISK::Read NT_DISK::Write NtFreeUserPhysicalPages NtPssCaptureVaSpaceBulk PnprFreeMappingReserve PopReadPagesFromHiberFile PsDispatchIumService ViAllocateMapRegisterFile ViFreeMapRegisterFile WbMakeUserExecutablePagesKernelWritable
paramcount
0
0
address
140316ef0
140316ee0
sig
undefined IoFreeMdl(void)
undefined IoFreeMdl(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
--- IoFreeMdl calling
+++ IoFreeMdl calling
@@ -14,2 +14,3 @@
- FUN_14070752c
- FUN_140a4ecb0
+ FUN_140707cbc
+ FUN_14070897c
+ FUN_140a4ec40
ExfAcquirePushLockExclusiveEx
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.98
i_ratio
0.81
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
ExfAcquirePushLockExclusiveEx
ExfAcquirePushLockExclusiveEx
fullname
ExfAcquirePushLockExclusiveEx
ExfAcquirePushLockExclusiveEx
refcount
352
351
length
600
600
called
ExpOptimizePushLockList KeAbPreAcquire KeAbPreWait KeWaitForMutexObject RtlBackoff memset
ExpOptimizePushLockList KeAbPreAcquire KeAbPreWait KeWaitForMutexObject RtlBackoff memset
calling
Expand for full list: CmFcManagerDrainAllFeatureUsageNotifications CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerRegisterFeatureConfigurationChangeNotification CmFcManagerUnregisterFeatureConfigurationChangeNotification CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpManagerDrainUsageNotificationsWorker CmFcpManagerRetryUsageNotificationsWorker CmFcpManagerSoftwareHiveReady CmFreezeRegistry CmLockHive CmLockHiveSecurityExclusive CmRegisterMachineHiveLoadedNotification CmSiRWLockAcquireExclusive CmThawRegistry CmUnregisterMachineHiveLoadedNotification CmpAssignKeySecurity CmpCloseKeyObject CmpCopyMergeOfLayeredKeyNode CmpCreateChild CmpCreateHive CmpCreateHiveRootCell CmpDeleteHive CmpDeleteKeyObject CmpDereferenceNameControlBlockWithLock CmpDoParseKey CmpDoQueueLateUnloadWorker CmpFinishSystemHivesLoad CmpFlushHive CmpFlushNotify CmpFreeKeyByCell CmpGetNameControlBlock CmpInitCmRM CmpLoadHiveVolatile CmpLockAppHiveLoadList CmpLockCallbackListExclusive CmpLockContextListExclusive CmpLockDeletedHashEntryExclusiveByKcb CmpLockGlobalKeyLockTrackerExclusive CmpLockHashEntryByIndexExclusive CmpLockHashEntryExclusive CmpLockHashEntryExclusiveByKcb CmpLockHiveListExclusive CmpLockKcbExclusive CmpLockRegistryFreezeAware CmpLockSiloKeyLockTrackerExclusive CmpLockTwoSecurityCachesExclusiveShared CmpMarkEntireIndexDirty CmpNotifyMachineHiveLoaded CmpRecoverFlushProtocolStateFromFiles CmpRefreshHive CmpReorganizeHive CmpReportNotifyHelper CmpSetKeySecurity CmpTransMgrPrepare CmpTransMgrSyncHive CmpTrimHive CmpVolumeContextDecrementRefCount CmpVolumeContextSendDeviceUsageNotification CmpVolumeManagerGetContextForFile CmpWalkOneLevel DifExfAcquirePushLockExclusiveWrapper ExAcquireAutoExpandPushLockExclusive ExAcquirePushLockExclusiveEx ExGetWakeTimerList ExInitializeDeviceAts ExRegisterExtension ExRegisterHost ExSvmBeginDeviceReset ExSvmFinalizeDeviceReset ExUninitializeDeviceAts ExUnregisterExtension ExUuidCreate ExWakeTimersPause ExfAcquireCacheAwarePushLockExclusiveEx ExfAcquirePushLockExclusive ExfAcquireReleasePushLockExclusive ExpAcquireFannedOutPushLockExclusive ExpDeleteTimer ExpKdPullRemoteFileForUser ExpSaAllocatorFree ExpSaPageGroupAllocateMemory ExpSaPageGroupDescriptorAllocate ExpSaPageGroupDescriptorFree ExpSaPageGroupFreeMemory ExpSetTimerObject ExpShareAddressSpaceWithDevice ExpSvmDereferenceDevice ExpWnfAcquirePermanentDataStoreHandle ExpWnfAllocateNextPersistentNameSequence ExpWnfCompleteThreadSubscriptions ExpWnfCreateNameInstance ExpWnfCreateProcessContext ExpWnfDeleteNameInstance ExpWnfDeleteProcessContext ExpWnfDeleteScopeById ExpWnfDeleteScopeInstances ExpWnfDeleteStateData ExpWnfDeleteSubscription ExpWnfDeliverThreadNotifications ExpWnfDestroyPermanentDataStore ExpWnfDispatchKernelSubscription ExpWnfGetPermanentDataStore ExpWnfInsertSubscriptionInPendingQueue ExpWnfInvalidateDataStores ExpWnfResolveScopeInstance ExpWnfSubscribeNameInstance ExpWnfUpdateSubscription ExpWnfWriteStateData ExpWorkerInitialization FlushLookUpTableBucket FsRtlInsertPerStreamContext HvFoldBackDirtyData HvFreeCell HvHiveConvertLockedPagesToCowByPolicy HvIsRangeDirty HvpDoAllocateCell HvpMarkCellDirty LOCK_ADDRESS_SPACE LOCK_HIVE_LOAD LOCK_PAGE_TABLE_COMMITMENT MI_LOCK_RELOCATIONS_EXCLUSIVE MiAcquireKernelCfgLock MiAddSpecialPurposeMemoryPrepare MiAddViewsForSection MiAllocatePartitionId MiApplyImageHotPatchRequest MiCaptureRetpolineImportInfo MiChargeSegmentCommit MiClearPartitionPageBitMap MiCommitExistingVad MiCommitPageTableRangesForVad MiContractWsSwapPageFileWorker MiCopyLargeVad MiCreateFileOnlyImageFixupList MiCreateHardwareEnclave MiCreatePagingFile MiCreatePagingFileMap MiCreatePerSessionProtos MiCreatePrototypePtes MiDecommitHardwareEnclavePages MiDeleteAllHardwareEnclaves MiDeleteEmptyPageTables MiDeleteEnclavePages MiDeleteHotPatchEntry MiDeleteHotPatchRecord MiDeletePartitionResources MiDereferenceExtendInfo MiDereferencePerSessionProtos MiFindSpecialPurposeMemoryTypeByPartition MiFinishCreateSection MiFinishResume MiFreePartitionId MiFreeRetpolineImportInfo MiFreeSessionId MiFreeUnusedPfnPages MiGetChannelInformation MiGetNewSessionId MiGetPartitionNodeInformation MiInitializeMirroring MiInitializePagedPoolEvents MiInitializePartialVad MiInitializePartition MiInitializePartitionSpecialPurposeMemory MiInitializeSessionGlobals MiInsertChildVads MiInsertHotPatchRecord MiInsertInSystemSpace MiInsertPageFileInList MiInsertPartitionPages MiInsertSharedCommitNode MiInsertVad MiLateInitializeSystemCache MiLoadHotPatchForUserSid MiLockAddressSpaceToo MiLockDriverMappings MiLockDynamicMemoryExclusive MiLockDynamicMemoryNestedExclusive MiLockDynamicMemoryNestedParentExclusive MiLockFileExtentsExclusive MiLockLoaderEntry MiLockNestedVad MiLockPartitionSystemThreads MiLockVad MiLockVadRange MiMakeDriverPagesPrivate MiManageSubsectionView MiMapViewOfDataSection MiMarkHugePfnBad MiMarkSharedImageCfgBits MiObtainReferencedVadEx MiObtainRelocationBits MiPerformVadSplitting MiPersistMdl MiPopulateCfgBitMap MiRemoveFromSystemSpace MiRemoveSharedCommitNode MiRemoveVad MiReserveUserMemory MiReturnImageBase MiSectionDelete MiSelectOverflowDllBase MiSelectRelocationStartHint MiSendParkedCoreUpdateToAllChildPartitions MiSetPagesModified MiSetProtectionOnSection MiSetVadDeleted MiShutdownSystem MiSplitPrivatePage MiSplitReducedCommitClonePage MiTransferFileExtent MiTrimUnusedPageFileRegionsWorker MiUnloadHotPatchForUserSid MiUnmapViewOfSection MiUpControlAreaRefs MiZeroAllPageFiles MmAcquireLoadLock MmCommitSessionMappedView MmCreateShadowMapping MmDecodeExportSection MmDeleteShadowMapping MmDuplicateMemory MmEncodeExportSection MmEnumerateBadPages MmExtendSection MmGetPageFileForCrashDump MmOutSwapVirtualAddresses MmOutSwapWorkingSet MmResourcesAvailable NtAllocateUuids NtCancelTimer NtNotifyChangeMultipleKeys NtReleaseKeyedEvent NtSetUuidSeed NtWaitForKeyedEvent PdcAcquireRwLockExclusive TlgRegisterAggregateProviderEx VrpDecrementSiloCount VrpDereferenceDiffHiveEntry VrpFindOrCreateDiffHiveEntryForMountPoint VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlInitializeJobForVreg VrpHandleIoctlLoadDifferencingHive VrpHandleIoctlLoadDifferencingHiveForHost VrpHandleIoctlModifyFlags VrpHandleIoctlUnloadDifferencingHiveForHost VrpHandleIoctlUnloadDynamicallyLoadedHives VrpIncrementSiloCount VrpLoadDifferencingHive VrpPreLoadKey VrpPreUnloadKey VrpUnloadDifferencingHive VrpWaitForDiffHiveEntryTransitionOwnerToLeave WbAddHeapExecutedBlockToCache WbAddHeapExecutedBlockToLRU WbAddWarbirdEncryptionSegment WbAllocateSlots WbAllocateUserMemory WbDecryptEncryptionSegment WbFreeMemoryBlockRegion WbGetInitializedEncryptionSegment WbGetWarbirdProcess WbGetWarbirdThread WbHeapExecutionUnloadModule WbInPlaceEncryptionUnloadModule WbMoveHeapExecutedBlockToBackOfLRU WbReEncryptEncryptionSegment WbRemoveWarbirdProcess WheaConfigureErrorSource WheaExecuteRowFailureCheck WheaInitialize WheaRegisterErrorSourceOverride WheaRegisterInUsePageOfflineNotification WheaSelLogCheckPoint WheaSelLogSetNtSchedulerAvailability WheaUnconfigureErrorSource WheaUnregisterErrorSourceOverride WheaUnregisterInUsePageOfflineNotification WheapCallInUsePageNotificationCallbacks WheapPfaReset WheapPredictiveFailureAnalysis
Expand for full list: CmFcManagerDrainAllFeatureUsageNotifications CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerRegisterFeatureConfigurationChangeNotification CmFcManagerUnregisterFeatureConfigurationChangeNotification CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpManagerDrainUsageNotificationsWorker CmFcpManagerRetryUsageNotificationsWorker CmFcpManagerSoftwareHiveReady CmFreezeRegistry CmLockHive CmLockHiveSecurityExclusive CmRegisterMachineHiveLoadedNotification CmSiRWLockAcquireExclusive CmThawRegistry CmUnregisterMachineHiveLoadedNotification CmpAssignKeySecurity CmpCloseKeyObject CmpCopyMergeOfLayeredKeyNode CmpCreateChild CmpCreateHive CmpCreateHiveRootCell CmpDeleteHive CmpDeleteKeyObject CmpDereferenceNameControlBlockWithLock CmpDoParseKey CmpDoQueueLateUnloadWorker CmpFinishSystemHivesLoad CmpFlushHive CmpFlushNotify CmpFreeKeyByCell CmpGetNameControlBlock CmpInitCmRM CmpLoadHiveVolatile CmpLockAppHiveLoadList CmpLockCallbackListExclusive CmpLockContextListExclusive CmpLockDeletedHashEntryExclusiveByKcb CmpLockGlobalKeyLockTrackerExclusive CmpLockHashEntryByIndexExclusive CmpLockHashEntryExclusive CmpLockHashEntryExclusiveByKcb CmpLockHiveListExclusive CmpLockKcbExclusive CmpLockRegistryFreezeAware CmpLockSiloKeyLockTrackerExclusive CmpLockTwoSecurityCachesExclusiveShared CmpMarkEntireIndexDirty CmpNotifyMachineHiveLoaded CmpRecoverFlushProtocolStateFromFiles CmpRefreshHive CmpReorganizeHive CmpReportNotifyHelper CmpSetKeySecurity CmpTransMgrPrepare CmpTransMgrSyncHive CmpTrimHive CmpVolumeContextDecrementRefCount CmpVolumeContextSendDeviceUsageNotification CmpVolumeManagerGetContextForFile CmpWalkOneLevel DifExfAcquirePushLockExclusiveWrapper ExAcquireAutoExpandPushLockExclusive ExAcquirePushLockExclusiveEx ExGetWakeTimerList ExInitializeDeviceAts ExRegisterExtension ExRegisterHost ExSvmBeginDeviceReset ExSvmFinalizeDeviceReset ExUninitializeDeviceAts ExUnregisterExtension ExUuidCreate ExWakeTimersPause ExfAcquireCacheAwarePushLockExclusiveEx ExfAcquirePushLockExclusive ExfAcquireReleasePushLockExclusive ExpAcquireFannedOutPushLockExclusive ExpDeleteTimer ExpKdPullRemoteFileForUser ExpSaAllocatorFree ExpSaPageGroupAllocateMemory ExpSaPageGroupDescriptorAllocate ExpSaPageGroupDescriptorFree ExpSaPageGroupFreeMemory ExpSetTimerObject ExpShareAddressSpaceWithDevice ExpSvmDereferenceDevice ExpWnfAcquirePermanentDataStoreHandle ExpWnfAllocateNextPersistentNameSequence ExpWnfCompleteThreadSubscriptions ExpWnfCreateNameInstance ExpWnfCreateProcessContext ExpWnfDeleteNameInstance ExpWnfDeleteProcessContext ExpWnfDeleteScopeById ExpWnfDeleteScopeInstances ExpWnfDeleteStateData ExpWnfDeleteSubscription ExpWnfDeliverThreadNotifications ExpWnfDestroyPermanentDataStore ExpWnfDispatchKernelSubscription ExpWnfGetPermanentDataStore ExpWnfInsertSubscriptionInPendingQueue ExpWnfInvalidateDataStores ExpWnfResolveScopeInstance ExpWnfSubscribeNameInstance ExpWnfUpdateSubscription ExpWnfWriteStateData ExpWorkerInitialization FlushLookUpTableBucket FsRtlInsertPerStreamContext HvFoldBackDirtyData HvFreeCell HvHiveConvertLockedPagesToCowByPolicy HvIsRangeDirty HvpDoAllocateCell HvpMarkCellDirty LOCK_ADDRESS_SPACE LOCK_HIVE_LOAD LOCK_PAGE_TABLE_COMMITMENT MI_LOCK_RELOCATIONS_EXCLUSIVE MiAcquireKernelCfgLock MiAddSpecialPurposeMemoryPrepare MiAddViewsForSection MiAllocatePartitionId MiApplyImageHotPatchRequest MiCaptureRetpolineImportInfo MiChargeSegmentCommit MiClearPartitionPageBitMap MiCommitExistingVad MiCommitPageTableRangesForVad MiContractWsSwapPageFileWorker MiCopyLargeVad MiCreateFileOnlyImageFixupList MiCreateHardwareEnclave MiCreatePagingFile MiCreatePagingFileMap MiCreatePerSessionProtos MiCreatePrototypePtes MiDecommitHardwareEnclavePages MiDeleteAllHardwareEnclaves MiDeleteEmptyPageTables MiDeleteEnclavePages MiDeleteHotPatchEntry MiDeleteHotPatchRecord MiDeletePartitionResources MiDereferenceExtendInfo MiDereferencePerSessionProtos MiFindSpecialPurposeMemoryTypeByPartition MiFinishCreateSection MiFinishResume MiFreePartitionId MiFreeRetpolineImportInfo MiFreeSessionId MiFreeUnusedPfnPages MiGetChannelInformation MiGetNewSessionId MiGetPartitionNodeInformation MiInitializeMirroring MiInitializePagedPoolEvents MiInitializePartialVad MiInitializePartition MiInitializePartitionSpecialPurposeMemory MiInitializeSessionGlobals MiInsertChildVads MiInsertHotPatchRecord MiInsertInSystemSpace MiInsertPageFileInList MiInsertPartitionPages MiInsertSharedCommitNode MiInsertVad MiLateInitializeSystemCache MiLoadHotPatchForUserSid MiLockAddressSpaceToo MiLockDriverMappings MiLockDynamicMemoryExclusive MiLockDynamicMemoryNestedExclusive MiLockDynamicMemoryNestedParentExclusive MiLockFileExtentsExclusive MiLockLoaderEntry MiLockNestedVad MiLockPartitionSystemThreads MiLockVad MiLockVadRange MiMakeDriverPagesPrivate MiManageSubsectionView MiMapViewOfDataSection MiMarkHugePfnBad MiMarkSharedImageCfgBits MiObtainReferencedVadEx MiObtainRelocationBits MiPerformVadSplitting MiPersistMdl MiPopulateCfgBitMap MiRemoveFromSystemSpace MiRemoveSharedCommitNode MiRemoveVad MiReserveUserMemory MiReturnImageBase MiSectionDelete MiSelectOverflowDllBase MiSelectRelocationStartHint MiSendParkedCoreUpdateToAllChildPartitions MiSetPagesModified MiSetProtectionOnSection MiSetVadDeleted MiShutdownSystem MiSplitPrivatePage MiSplitReducedCommitClonePage MiTransferFileExtent MiTrimUnusedPageFileRegionsWorker MiUnloadHotPatchForUserSid MiUnmapViewOfSection MiUpControlAreaRefs MiZeroAllPageFiles MmAcquireLoadLock MmCommitSessionMappedView MmCreateShadowMapping MmDecodeExportSection MmDeleteShadowMapping MmDuplicateMemory MmEncodeExportSection MmEnumerateBadPages MmExtendSection MmGetPageFileForCrashDump MmOutSwapVirtualAddresses MmOutSwapWorkingSet MmResourcesAvailable NtAllocateUuids NtCancelTimer NtNotifyChangeMultipleKeys NtReleaseKeyedEvent NtSetUuidSeed NtWaitForKeyedEvent PdcAcquireRwLockExclusive TlgRegisterAggregateProviderEx VrpDecrementSiloCount VrpDereferenceDiffHiveEntry VrpFindOrCreateDiffHiveEntryForMountPoint VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlLoadDifferencingHive VrpHandleIoctlLoadDifferencingHiveForHost VrpHandleIoctlModifyFlags VrpHandleIoctlUnloadDifferencingHiveForHost VrpHandleIoctlUnloadDynamicallyLoadedHives VrpIncrementSiloCount VrpLoadDifferencingHive VrpPreLoadKey VrpPreUnloadKey VrpUnloadDifferencingHive VrpWaitForDiffHiveEntryTransitionOwnerToLeave WbAddHeapExecutedBlockToCache WbAddHeapExecutedBlockToLRU WbAddWarbirdEncryptionSegment WbAllocateSlots WbAllocateUserMemory WbDecryptEncryptionSegment WbFreeMemoryBlockRegion WbGetInitializedEncryptionSegment WbGetWarbirdProcess WbGetWarbirdThread WbHeapExecutionUnloadModule WbInPlaceEncryptionUnloadModule WbMoveHeapExecutedBlockToBackOfLRU WbReEncryptEncryptionSegment WbRemoveWarbirdProcess WheaConfigureErrorSource WheaExecuteRowFailureCheck WheaInitialize WheaRegisterErrorSourceOverride WheaRegisterInUsePageOfflineNotification WheaSelLogCheckPoint WheaSelLogSetNtSchedulerAvailability WheaUnconfigureErrorSource WheaUnregisterErrorSourceOverride WheaUnregisterInUsePageOfflineNotification WheapCallInUsePageNotificationCallbacks WheapPfaReset WheapPredictiveFailureAnalysis
paramcount
0
0
address
14026b630
14026b3d0
sig
undefined ExfAcquirePushLockExclusiveEx(void)
undefined ExfAcquirePushLockExclusiveEx(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
ExfAcquirePushLockExclusiveEx Calling Diff
--- ExfAcquirePushLockExclusiveEx calling
+++ ExfAcquirePushLockExclusiveEx calling
@@ -243 +242,0 @@
- VrpHandleIoctlInitializeJobForVreg
KiLeaveCriticalRegionUnsafe
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
1.0
i_ratio
0.71
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
KiLeaveCriticalRegionUnsafe
KiLeaveCriticalRegionUnsafe
fullname
KiLeaveCriticalRegionUnsafe
KiLeaveCriticalRegionUnsafe
refcount
900
898
length
50
50
called
KiCheckForKernelApcDelivery
KiCheckForKernelApcDelivery
calling
Expand for full list: AlpcCreateSecurityContext AlpciDestroyDeferredMessageContext AlpciSendDeferredMessageBeforeWait AlpcpClosePort AlpcpConnectPort AlpcpDeletePort AlpcpFreeMessageFunction AlpcpInitSystem AlpcpOpenPort ArbArbiterHandler ArbBuildAssignmentOrdering BgkpLockBgfxCodeSection BgkpUnlockBgfxCodeSection CmFcManagerDrainAllFeatureUsageNotifications CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerQueryFeatureConfigurationSectionInformation CmFcManagerRegisterFeatureConfigurationChangeNotification CmFcManagerStartRuntimePhase CmFcManagerUnregisterFeatureConfigurationChangeNotification CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpManagerDrainUsageNotificationsWorker CmFcpManagerRetryUsageNotificationsWorker CmFcpManagerSoftwareHiveReady CmFreezeRegistry CmKeyBodyRemapToVirtualForEnum CmLoadDifferencingKey CmLockKeyForWrite CmSaveKeyToBuffer CmUnloadKey CmpCloseKeyObject CmpCoalescingCallback CmpCompleteUnloadKey CmpDoQueryKeyName CmpInitCmRM CmpIsCmRm CmpRunDownCmRM CmpSecurityMethod CmpStartSiloKeyLockTracker CmpStopSiloKeyLockTracker CmpUnlockAppHiveLoadList CmpUnlockGlobalKeyLockTracker DbgkCaptureLiveKernelDump DbgkFlushErrorPort DbgkRegisterErrorPort DbgkpRemoveErrorPort DbgkpSendErrorMessage DbgkpSuspendProcess DbgkpWerDeferredWriteRoutine DifExReleaseResourceAndLeaveCriticalRegionWrapper DifKeLeaveCriticalRegionWrapper DrvDbAcquireDatabaseNodeBaseKey DrvDbOpenDriverDatabaseRegKey DrvDbReleaseDatabaseNodeBaseKey DrvDbSetDriverDatabaseMappedProperty EtwQueryPerformanceTraceInformation EtwQueryProcessTelemetryCoverage EtwRegisterEventCallback EtwSendTraceBuffer EtwSetPerformanceTraceInformation EtwTraceEvent EtwTraceRaw EtwpBufferingModeFlush EtwpClearSessionAndUnreferenceEntry EtwpCloseLogger EtwpCovSampCaptureContextStop EtwpCovSampContextAddSamples EtwpCovSampContextCleanup EtwpCovSampContextGetModule EtwpCovSampContextPruneModules EtwpCovSampHashMakeRoomAndAcquireLock EtwpCovSampProcessAddModule EtwpCoverageCheckCP EtwpCoverageEnsureUserModeView EtwpCoverageFlushWorkItemCallback EtwpCoverageProvEnableCallback EtwpCoverageReset EtwpCoverageResetCP EtwpCoverageSamplerClose EtwpCoverageSamplerQuery EtwpCoverageSamplerSetBloomFilter EtwpCoverageSamplerStart EtwpCoverageSamplerStop EtwpDeleteRegistrationObject EtwpDeleteSessionDemuxObject EtwpEventWriteFull EtwpFlushCoverage EtwpFlushTrace EtwpGetPmcSessions EtwpGetPrivateSessionTraceHandle EtwpGetSoftRestartInformation EtwpGetTraceGroupInfo EtwpGetTraceGuidInfo EtwpIncrementTraceFile EtwpInitializeSiloState EtwpNotifyDisallowedGuidChange EtwpNotifyGuid EtwpQueryReferenceTime EtwpQueryTrace EtwpReceiveNotification EtwpRegisterPrivateSession EtwpRegisterUMProvider EtwpRundownNotifications EtwpSendReplyDataBlock EtwpSetSoftRestartInformation EtwpStartTrace EtwpStopLoggerInstance EtwpStopTrace EtwpTraceMessageVa EtwpTracingProvEnableCallback EtwpTrackGuidEntryRegistrations EtwpTrackProviderBinary EtwpTransitionToRealtime EtwpUpdateLoggerSecurityDescriptor EtwpUpdateTrace ExCreateHandleEx ExCreateHandleTable ExDisableHandleTracing ExDupHandleTable ExEnableHandleExceptions ExEnableHandleTracing ExEnableRaiseUMExceptionOnInvalidHandleClose ExEnumHandleTable ExFetchLicenseData ExFetchLicenseData$fin$0 ExGetLicenseTamperState ExGetWakeTimerList ExInitLicenseData ExNotifyPlatformBinaryExecuted ExQueryHandleExceptionsPermanency ExQueryWnfStateData ExReferenceHandleDebugInfo ExRegisterExtension ExRegisterHost ExReleaseFastMutexUnsafeAndLeaveCriticalRegion ExReleaseResourceAndLeavePriorityRegion ExSetLicenseTamperState ExSweepHandleTable ExUnregisterExtension ExUnsubscribeWnfStateChange ExUuidCreate ExWnfCleanupServerSiloState ExWnfHiveUnloaded ExpCovQueryInformation ExpCovResetInformation ExpDeleteTimer ExpGetFirmwareEnvironmentVariable ExpGetGlobalLocaleSection ExpGetProcessInformation ExpGetSystemFirmwareTableInformation ExpGetSystemPlatformBinary ExpKdPullRemoteFileForUser ExpLoadAndSortLicensingCacheDescriptors ExpLoadAndSortLicensingCacheDescriptors$fin$0 ExpLoadAndSortLicensingCacheDescriptors$fin$1 ExpNtDeleteWnfStateData ExpNtUpdateWnfStateData ExpPrmInitialization ExpPutLicenseDataIntoRegistry$fin$0 ExpQueryBootLoaderMetadata ExpQueryLicenseValueFromBlobHelper$fin$0 ExpQuerySingleModuleInformation ExpQuerySystemInformation ExpReadLeapSecondData ExpRegisterFirmwareTableInformationHandler ExpRemoveHandleTable ExpSetBootEntry ExpSetBootLoaderMetadata ExpSetDriverEntry ExpSetFirmwareEnvironmentVariable ExpSetTimerObject ExpSnapShotHandleTables ExpWnfWorkItemRoutine ExpWorkerFactoryCreateThread FUN_14036f764 FUN_1409fa77c FsRtlCancelNotify FsRtlCancelNotify$fin$1 FsRtlCopyRead FsRtlCopyWrite FsRtlCreateSectionForDataScan FsRtlInsertPerFileContext FsRtlInsertPerFileObjectContext FsRtlInsertPerStreamContext FsRtlLookupPerFileContext FsRtlLookupPerStreamContextInternal FsRtlMdlReadDev FsRtlPrepareMdlWriteDev FsRtlRemovePerFileContext FsRtlRemovePerFileObjectContext FsRtlRemovePerStreamContext FsRtlTeardownPerFileContexts FsRtlTeardownPerFileContexts$fin$0 FsRtlTeardownPerStreamContexts FsRtlTeardownPerStreamContexts$fin$0 HvlQuerySetBootPagesInfo IoConfigureCrashDump IoDisconnectInterrupt IoEnumerateRegisteredFiltersList IoFillTriageDumpBuffer IoGetDeviceInterfaceAlias IoInitializeCrashDump IoOpenDeviceInterfaceRegistryKey IoOpenDeviceRegistryKey IoRegisterContainerNotification IoRegisterFileSystem IoRegisterFsRegistrationChangeMountAware IoReportDetectedDevice IoReportRootDevice IoUnregisterContainerNotification IoUnregisterFileSystem IoUnregisterFsRegistrationChange IoUnregisterPriorityCallback IoUpdateDumpPhysicalRanges IoVerifyVolume IopAcquireReleaseConnectLockInternal IopAcquireReleaseDispatcherLock IopBootLogToFile IopCopyBootLogRegistryToFile IopCreateSecurityCheck IopDestroyActiveConnectBlock IopGetDeviceInterfaces IopGetRootDevices IopGetSetSecurityObject IopInvalidateVolumesForDevice IopMountVolume IopParseDevice IopSetDeviceSecurityDescriptor KeDeleteMutant KeDeregisterBoundCallback KeQueryDpcWatchdogConfiguration KeReleaseMutant KeRundownApcQueues KeSetSystemServiceCallback KeSetTracepoint KeUpdateDpcWatchdogConfiguration KiConnectSecondaryInterrupt KiDisconnectSecondaryInterrupt KiHandleBound KiInvokeInterruptServiceRoutine KiShouldLogUserModeReturnMismatch KiStartSavingSupervisorState KiSynchronizePassiveInterruptExecution KiTpIsExcludedKernelTracepointLocation KseRegisterShimEx KseUnregisterShim KsepShimDbChanged LdrpKrnGetDataTableEntry LpcpRequestWaitReplyPort MiCancelPhase0Locking MiCombineIdenticalPages MiCreateImageOrDataSection MiDeleteBootRange MiFinishHardFault MiFinishVadDeletion MiFlushAllPagesWorker MiFlushSectionInternal MiForceCrashForInvalidAccess MiGatherPagefilePages MiInitializeDriverImages MiIssueHardFault MiLockImageSection MiLogPinDriverAddress MiLookupDataTableEntry MiPrefetchControlArea MiPrefetchVirtualMemory MiProcessLoaderEntry MiRememberUnloadedDriver MiReplenishSlabAllocator MiSharePages MiStoreWriteModifiedPages MiUnlockBootPageSections MiUnlockControlAreaSectionExtend MiUnlockImageSection MiWriteProtectSystemImages MmChangeImageProtection MmEnumerateSystemImages MmFreeBootDriverInitializationCode MmGetSectionRange MmIsDriverVerifyingByAddress MmLockPagableDataSection MmLockRegistryRecoverySections MmPrefetchPagesEx MmReleaseLoadLock MmVerifyCallbackFunctionCheckFlags NormalizationList__Unlock NtAcceptConnectPort NtAdjustGroupsToken NtAdjustPrivilegesToken NtAllocateUuids NtAlpcAcceptConnectPort NtAlpcCancelMessage NtAlpcCreatePort NtAlpcCreatePortSection NtAlpcCreateResourceReserve NtAlpcCreateSectionView NtAlpcCreateSecurityContext NtAlpcDeletePortSection NtAlpcDeleteResourceReserve NtAlpcDeleteSectionView NtAlpcDeleteSecurityContext NtAlpcDisconnectPort NtAlpcImpersonateClientContainerOfPort NtAlpcImpersonateClientOfPort NtAlpcOpenSenderProcess NtAlpcOpenSenderThread NtAlpcQueryInformationMessage NtAlpcRevokeSecurityContext NtAlpcSetInformation NtCancelTimer NtChangeProcessState NtChangeThreadState NtCreateLowBoxToken NtCreatePort NtCreatePrivateNamespace NtCreateUserProcess NtCreateWaitablePort NtCreateWnfStateName NtDeleteBootEntry NtDeleteDriverEntry NtDeleteKey NtDeleteValueKey NtDeleteWnfStateName NtDuplicateToken NtEnumerateBootEntries NtEnumerateDriverEntries NtEnumerateSystemEnvironmentValuesEx NtEnumerateValueKey NtFlushInstallUILanguage NtFlushKey NtGetCompleteWnfStateSubscription NtGetEnvironmentVariableEx NtGetMUIRegistryInfo NtMakePermanentObject NtMapCMFModule NtMapCMFModule$fin$0 NtMapCMFModule$fin$1 NtOpenPrivateNamespace NtOpenProcessTokenEx NtOpenThreadTokenEx NtQueryBootEntryOrder NtQueryBootOptions NtQueryDriverEntryOrder NtQueryEnvironmentVariableInfoEx NtQueryInformationProcess NtQueryInformationThread NtQueryInformationThread$fin$3 NtQueryInformationToken NtQueryMultipleValueKey NtQuerySecurityAttributesToken NtQuerySystemEnvironmentValue NtQueryWnfStateData NtQueryWnfStateNameInformation NtReadRequestData NtReleaseKeyedEvent NtRenameKey NtReplaceKey NtReplyPort NtReplyWaitReceivePortEx NtReplyWaitReplyPort NtRequestPort NtRequestWaitReplyPort NtRestoreKey NtSaveKeyEx NtSaveMergedKeys NtSecureConnectPort NtSetBootEntryOrder NtSetBootOptions NtSetDriverEntryOrder NtSetInformationKey NtSetInformationThread NtSetInformationThread$fin$1 NtSetInformationToken NtSetSystemEnvironmentValue NtSetUuidSeed NtSetValueKey NtSetWnfProcessNotificationEvent NtSubscribeWnfStateChange NtTerminateProcess NtTraceEvent NtUnsubscribeWnfStateChange NtWaitForKeyedEvent NtWriteRequestData ObDereferenceSecurityDescriptor ObDuplicateObject ObInsertObjectEx ObLogSecurityDescriptor ObOpenObjectByNameEx ObQueryObjectAuditingByHandle ObReferenceFileObjectForWrite ObReleaseObjectSecurity ObRevokeHandles ObSetHandleAttributes ObSetSecurityDescriptorInfo ObShutdownSystem ObWaitForMultipleObjects ObpAuditObjectAccess ObpCloseHandle ObpCreateHandle ObpDeleteDirectoryObject ObpLookupObjectName ObpReferenceObjectByHandleWithTag ObpReferenceProcessObjectByHandle ObpRegisterPrivateNamespace ObpRemoveNamespaceFromTable Ordinal_15 PerfDiagpProxyWorker PfSnCheckActionsNeeded PfSnPopulateReadList PfSnPrefetchCacheEntryUpdate PfSnSectionInfoCleanupWorkItem PfpPrefetchSharedCleanup PfpRpCHashDeleteEntries PfpScenCtxQueryScenarioInformation PfpScenCtxServiceThreadSet PiCMCreateDevice PiCMDeleteDevice PiCMGenerateDeviceInstance PiCMUnregisterDeviceInterface PiDcHandleCustomDeviceEvent PiDqDispatch PiDqIrpQueryCreate PiDqIrpQueryGetResult PiDqObjectManagerEnumerateAndRegisterQuery PiDqObjectManagerServiceActionQueue PiDqQueryApplyObjectEvent PiDqQuerySerializeActionQueue PiDqQueryUnlock PiDrvDbLoadNode PiDrvDbUnloadNode PiDrvDbUnloadNodeWaitWorkerCallback PiDrvDbUnloadNodeWorkerCallback PiGetRelatedDevice PiInitializeDevice PiPnpRtlObjectEventWorker PipKsrNotifyDrivers PipResetDevices PnpCancelDeviceActionRequest PnpNotifyDeviceClassChange PnpNotifyTargetDeviceChange PnpNotifyTargetDeviceChangeNotifyEntry PnpQueuePendingSurpriseRemoval PnpShutdownDevices PnpUnregisterPlugPlayNotification PoFxStartDevicePowerManagement PoUnregisterCoalescingCallback PopDiagTraceFxRundown PopDripsWatchdogCallbackWorker PopDripsWatchdogDiagnosticWorker PopDripsWatchdogStartWatchdog PopDripsWatchdogStopWatchdog PopFxAcpiPrepareDevice PopFxActivateDevicesForSx PopFxDestroyDirectedDripsCandidateDeviceList PopFxDestroyDripsBlockingDeviceList PopFxDisableBasicAccountingWorker PopFxIdleDevicesFromSx PopFxInsertAcpiDevice PopFxInsertDevice PopFxLowPowerEpochCallback PopFxPauseDeviceAccounting PopFxPrepareDevicesForShutdown PopFxRegisterDeviceWithPep PopFxRegisterPluginEx PopFxRemoveAcpiDevice PopFxResidentTimeoutRoutine PopFxResumeDeviceAccounting PopFxStartDeviceAccounting PopFxStopDeviceAccounting PopPepIdleTimeoutRoutine PopPepInsertDevice PopPepPlatformStateRegistered PopPepWork PopPowerAggregatorEngageModernStandby PopPowerButtonBugcheckConfigure PopReleaseAwaymodeLock PpDevCfgProcessDevices PsCallEnclave PsCallImageNotifyRoutines PsCaptureExceptionPort PsCreateVsmEnclave PsDisableImpersonation PsFreezeProcess PsGetNextProcessThread PsGetProcessDeepFreezeStats PsGetProcessEnclaveModuleInfo PsImpersonateClient PsInitializeVsmEnclave PsLoadVsmEnclaveData PsMultiResumeProcess PsQueryProcessEnergyValues PsQueryProcessExceptionFlags PsQueryRuntimeProcess PsQueryStatisticsProcess PsQueryTotalCycleTimeProcess PsReferenceImpersonationToken PsReferenceImpersonationTokenEx PsReferencePartitionSystemProcess PsReferencePrimaryTokenWithTag PsRegisterAltSystemCallHandler PsRemoveCreateThreadNotifyRoutine PsRemoveLoadImageNotifyRoutine PsRestoreImpersonation PsSetProcessFaultInformation PsSetProcessTelemetryAppState PsSetProcessWin32Process PsShutdownSystem PsStartSiloMonitor PsSuspendProcess PsSuspendThread PsSwapImpersonationToken PsSwapProcessWorkingSet PsSynchronizeWithThreadInsertion PsTerminateMinimalProcess PsTerminateProcess PsThawMultiProcess PsUnregisterSiloMonitor PsUpdateActiveProcessAffinity PsWatchWorkingSet PspAllocateAndQueryProcessNotificationChannel PspApplyCoreIsolationPolicy PspAssignPrimaryToken PspAssignProcessToJob PspAttachProcessToSyscallProvider PspChargeProcessWakeCounter PspCreatePicoProcess PspCreatePicoThread PspCreateThread PspDeleteProcessStateChange PspDestroySyscallProvider PspDetachProcessFromSyscallProvider PspEnableProcessOptionalXStateFeatures PspExitProcess PspExitThread PspGetNextSyscallProviderProcess PspGetPreviousProcessThread PspInheritSyscallProvider PspInsertProcess PspInsertSyscallProvider PspJobDelete PspLockUnlockProcessExclusive PspLookupSyscallProviderById PspMarkServerSiloAsTerminating PspNotifyProcessEffectiveIoLimitChanged PspNotifyServerSiloCreation PspNotifyServerSiloTermination PspProcessClose PspProcessDynamicEHContinuationTargets PspProcessDynamicEnforcedAddressRanges PspQueryWorkingSetWatch PspReferenceSystemDll PspRemoveEnclaveThreadWait PspRemoveProcessFromJobChain PspRundownSingleProcess PspSelectVsmEnclaveByNumber PspSetCreateProcessNotifyRoutine PspSetJobIoRateControl PspSetProcessAffinityUpdateMode PspSetProcessDefaultHardErrorMode PspSetProcessForegroundBackgroundRequest PspSetProcessPriorityClass PspStorageAllocSlot PspStorageEmptyArray PspStorageEmptyArrayNonReadonly PspStorageFreeSlot PspStorageGetObject PspStorageInsertObject PspStorageMakeSlotReadOnly PspStorageRemoveObject PspStorageReplaceObject PspSyscallProviderOptIn PspTeardownPartition PspTerminatePicoProcess PspThreadDelete PspUnlockProcessExclusive PspUnlockQuotaListExclusive PspUnlockQuotaListShared PspWow64ReadOrWriteThreadCpuArea RawDispatch RtlFindDynamicEnforcedAddressInRanges RtlRunOnceExecuteOnce RtlpFindDynamicEHContinuationTarget RtlpInsertStringAtom RtlpSetSecurityObject SLGetSubscriptionPfn SLGetSubscriptionPfn$fin$0 SLGetSubscriptionPfn$fin$1 SLQueryLicenseValueInternal SLUpdateLicenseDataInternal SLUpdateLicenseDataInternal$fin$0 SLUpdateLicenseDataInternal$fin$1 SMKM_STORE<SM_TRAITS>::SmStCleanup SeAccessCheckByType SeCaptureSubjectContextEx SeDefaultObjectMethod SeExchangePrimaryToken SeIsTokenAssignableToProcess SeMarkLogonSessionForTerminationNotificationEx SeQuerySessionIdTokenEx SeRegisterLogonSessionTerminatedRoutine SeRegisterLogonSessionTerminatedRoutineEx SeRegisterObjectTypeMandatoryPolicy SeSetMandatoryPolicyToken SeSetPrivateNameSpaceToken SeSetSecurityAttributesTokenEx SeSetSessionIdTokenWithLinked SeSetVirtualizationToken SeTokenGetNoChildProcessRestricted SeTokenGetRedirectionTrustPolicy SeTokenIsNoChildProcessRestrictionEnforced SeTokenSetNoChildProcessRestricted SeTokenSetRedirectionTrustPolicy SeUnregisterLogonSessionTerminatedRoutine SeUnregisterLogonSessionTerminatedRoutineEx SendCaptureStateNotificationsWorker SepAccessCheckAndAuditAlarm SepAddLuidToIndexEntry SepAppendAceToTokenObjectAcl SepBlockAccessForLogonSession SepCreateLogonSessionTrack SepDeleteLogonSessionTrack SepDeleteUnreferencedLogonSessionsInSilo SepDereferenceCachedHandlesEntry SepDesktopAppxSubProcessToken SepFilterToken SepIdAssignableAsGroup SepInternalSetSecurityAttributesToken SepIsParentOfChildAppContainer SepIsValidProcUniqueLuid SepMakeLogonSessionsSiblings SepNotifyFileSystems SepRmCallLsa SepRmCapUpdateWrkr SepRmCommandServerThread SepSetTokenCachedHandles SepSetTokenClaims SepSetTokenUserAndGroups SepUpdateLogonSessionTrack UNLOCK_HIVE_LOAD ViPendingQueuePassiveLevelCompletion VmPinMemoryRange VmUnpinMemoryRange VmpPauseResumeNotify VrpDecrementSiloCount VrpDereferenceDiffHiveEntry VrpFindDiffHiveEntryForMountPoint VrpFindOrCreateDiffHiveEntryForMountPoint VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlInitializeJobForVreg VrpHandleIoctlLoadDifferencingHive VrpHandleIoctlModifyFlags VrpHandleIoctlUnloadDynamicallyLoadedHives VrpIncrementSiloCount VrpLoadDifferencingHive VrpPostEnumerateKey VrpPostUnloadKey VrpPreLoadKey VrpPreUnloadKey VrpRelinquishDiffHiveEntryTransitionOwner VrpTranslatePath VrpUnloadDifferencingHive VrpWaitForDiffHiveEntryTransitionOwnerToLeave VslRegisterBootDrivers VslpEnterIumSecureMode WdipSemInitialize WdipSemMarkNextTimedOutInstanceForDeletion WdipSemSqmLogInflightLimitExceededDataPoints WdipSemUpdate WdipTimeoutCheckRoutine WheaRegisterErrorSourceOverride WheaSelLogCheckPoint WheaSelLogSetNtSchedulerAvailability WheaUnregisterErrorSourceOverride WmipFindSMBiosStructure WmipGetSMBiosEventlog WmipGetSMBiosTableData WmipGetSysIds WmipReleaseSmbiosLockShared _PnpCtxCloseMachine
Expand for full list: AlpcCreateSecurityContext AlpciDestroyDeferredMessageContext AlpciSendDeferredMessageBeforeWait AlpcpClosePort AlpcpConnectPort AlpcpDeletePort AlpcpFreeMessageFunction AlpcpInitSystem AlpcpOpenPort ArbArbiterHandler ArbBuildAssignmentOrdering BgkpLockBgfxCodeSection BgkpUnlockBgfxCodeSection CmFcManagerDrainAllFeatureUsageNotifications CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerQueryFeatureConfigurationSectionInformation CmFcManagerRegisterFeatureConfigurationChangeNotification CmFcManagerStartRuntimePhase CmFcManagerUnregisterFeatureConfigurationChangeNotification CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpManagerDrainUsageNotificationsWorker CmFcpManagerRetryUsageNotificationsWorker CmFcpManagerSoftwareHiveReady CmFreezeRegistry CmKeyBodyRemapToVirtualForEnum CmLoadDifferencingKey CmLockKeyForWrite CmSaveKeyToBuffer CmUnloadKey CmpCloseKeyObject CmpCoalescingCallback CmpCompleteUnloadKey CmpDoQueryKeyName CmpInitCmRM CmpIsCmRm CmpRunDownCmRM CmpSecurityMethod CmpStartSiloKeyLockTracker CmpStopSiloKeyLockTracker CmpUnlockAppHiveLoadList CmpUnlockGlobalKeyLockTracker DbgkCaptureLiveKernelDump DbgkFlushErrorPort DbgkRegisterErrorPort DbgkpRemoveErrorPort DbgkpSendErrorMessage DbgkpSuspendProcess DbgkpWerDeferredWriteRoutine DifExReleaseResourceAndLeaveCriticalRegionWrapper DifKeLeaveCriticalRegionWrapper DrvDbAcquireDatabaseNodeBaseKey DrvDbOpenDriverDatabaseRegKey DrvDbReleaseDatabaseNodeBaseKey DrvDbSetDriverDatabaseMappedProperty EtwQueryPerformanceTraceInformation EtwQueryProcessTelemetryCoverage EtwRegisterEventCallback EtwSendTraceBuffer EtwSetPerformanceTraceInformation EtwTraceEvent EtwTraceRaw EtwpBufferingModeFlush EtwpClearSessionAndUnreferenceEntry EtwpCloseLogger EtwpCovSampCaptureContextStop EtwpCovSampContextAddSamples EtwpCovSampContextCleanup EtwpCovSampContextGetModule EtwpCovSampContextPruneModules EtwpCovSampHashMakeRoomAndAcquireLock EtwpCovSampProcessAddModule EtwpCoverageCheckCP EtwpCoverageEnsureUserModeView EtwpCoverageFlushWorkItemCallback EtwpCoverageProvEnableCallback EtwpCoverageReset EtwpCoverageResetCP EtwpCoverageSamplerClose EtwpCoverageSamplerQuery EtwpCoverageSamplerSetBloomFilter EtwpCoverageSamplerStart EtwpCoverageSamplerStop EtwpDeleteRegistrationObject EtwpDeleteSessionDemuxObject EtwpEventWriteFull EtwpFlushCoverage EtwpFlushTrace EtwpGetPmcSessions EtwpGetPrivateSessionTraceHandle EtwpGetSoftRestartInformation EtwpGetTraceGroupInfo EtwpGetTraceGuidInfo EtwpIncrementTraceFile EtwpInitializeSiloState EtwpNotifyDisallowedGuidChange EtwpNotifyGuid EtwpQueryReferenceTime EtwpQueryTrace EtwpReceiveNotification EtwpRegisterPrivateSession EtwpRegisterUMProvider EtwpRundownNotifications EtwpSendReplyDataBlock EtwpSetSoftRestartInformation EtwpStartTrace EtwpStopLoggerInstance EtwpStopTrace EtwpTraceMessageVa EtwpTracingProvEnableCallback EtwpTrackGuidEntryRegistrations EtwpTrackProviderBinary EtwpTransitionToRealtime EtwpUpdateLoggerSecurityDescriptor EtwpUpdateTrace ExCreateHandleEx ExCreateHandleTable ExDisableHandleTracing ExDupHandleTable ExEnableHandleExceptions ExEnableHandleTracing ExEnableRaiseUMExceptionOnInvalidHandleClose ExEnumHandleTable ExFetchLicenseData ExFetchLicenseData$fin$0 ExGetLicenseTamperState ExGetWakeTimerList ExInitLicenseData ExNotifyPlatformBinaryExecuted ExQueryHandleExceptionsPermanency ExQueryWnfStateData ExReferenceHandleDebugInfo ExRegisterExtension ExRegisterHost ExReleaseFastMutexUnsafeAndLeaveCriticalRegion ExReleaseResourceAndLeavePriorityRegion ExSetLicenseTamperState ExSweepHandleTable ExUnregisterExtension ExUnsubscribeWnfStateChange ExUuidCreate ExWnfCleanupServerSiloState ExWnfHiveUnloaded ExpCovQueryInformation ExpCovResetInformation ExpDeleteTimer ExpGetFirmwareEnvironmentVariable ExpGetGlobalLocaleSection ExpGetProcessInformation ExpGetSystemFirmwareTableInformation ExpGetSystemPlatformBinary ExpKdPullRemoteFileForUser ExpLoadAndSortLicensingCacheDescriptors ExpLoadAndSortLicensingCacheDescriptors$fin$0 ExpLoadAndSortLicensingCacheDescriptors$fin$1 ExpNtDeleteWnfStateData ExpNtUpdateWnfStateData ExpPrmInitialization ExpPutLicenseDataIntoRegistry$fin$0 ExpQueryBootLoaderMetadata ExpQueryLicenseValueFromBlobHelper$fin$0 ExpQuerySingleModuleInformation ExpQuerySystemInformation ExpReadLeapSecondData ExpRegisterFirmwareTableInformationHandler ExpRemoveHandleTable ExpSetBootEntry ExpSetBootLoaderMetadata ExpSetDriverEntry ExpSetFirmwareEnvironmentVariable ExpSetTimerObject ExpSnapShotHandleTables ExpWnfWorkItemRoutine ExpWorkerFactoryCreateThread FUN_14036f754 FUN_1409fa70c FsRtlCancelNotify FsRtlCancelNotify$fin$1 FsRtlCopyRead FsRtlCopyWrite FsRtlCreateSectionForDataScan FsRtlInsertPerFileContext FsRtlInsertPerFileObjectContext FsRtlInsertPerStreamContext FsRtlLookupPerFileContext FsRtlLookupPerStreamContextInternal FsRtlMdlReadDev FsRtlPrepareMdlWriteDev FsRtlRemovePerFileContext FsRtlRemovePerFileObjectContext FsRtlRemovePerStreamContext FsRtlTeardownPerFileContexts FsRtlTeardownPerFileContexts$fin$0 FsRtlTeardownPerStreamContexts FsRtlTeardownPerStreamContexts$fin$0 HvlQuerySetBootPagesInfo IoConfigureCrashDump IoDisconnectInterrupt IoEnumerateRegisteredFiltersList IoFillTriageDumpBuffer IoGetDeviceInterfaceAlias IoInitializeCrashDump IoOpenDeviceInterfaceRegistryKey IoOpenDeviceRegistryKey IoRegisterContainerNotification IoRegisterFileSystem IoRegisterFsRegistrationChangeMountAware IoReportDetectedDevice IoReportRootDevice IoUnregisterContainerNotification IoUnregisterFileSystem IoUnregisterFsRegistrationChange IoUnregisterPriorityCallback IoUpdateDumpPhysicalRanges IoVerifyVolume IopAcquireReleaseConnectLockInternal IopAcquireReleaseDispatcherLock IopBootLogToFile IopCopyBootLogRegistryToFile IopCreateSecurityCheck IopDestroyActiveConnectBlock IopGetDeviceInterfaces IopGetRootDevices IopGetSetSecurityObject IopInvalidateVolumesForDevice IopMountVolume IopParseDevice IopSetDeviceSecurityDescriptor KeDeleteMutant KeDeregisterBoundCallback KeQueryDpcWatchdogConfiguration KeReleaseMutant KeRundownApcQueues KeSetSystemServiceCallback KeSetTracepoint KeUpdateDpcWatchdogConfiguration KiConnectSecondaryInterrupt KiDisconnectSecondaryInterrupt KiHandleBound KiInvokeInterruptServiceRoutine KiShouldLogUserModeReturnMismatch KiStartSavingSupervisorState KiSynchronizePassiveInterruptExecution KiTpIsExcludedKernelTracepointLocation KseRegisterShimEx KseUnregisterShim KsepShimDbChanged LdrpKrnGetDataTableEntry LpcpRequestWaitReplyPort MiCancelPhase0Locking MiCombineIdenticalPages MiCreateImageOrDataSection MiDeleteBootRange MiFinishHardFault MiFinishVadDeletion MiFlushAllPagesWorker MiFlushSectionInternal MiForceCrashForInvalidAccess MiGatherPagefilePages MiInitializeDriverImages MiIssueHardFault MiLockImageSection MiLogPinDriverAddress MiLookupDataTableEntry MiPrefetchControlArea MiPrefetchVirtualMemory MiProcessLoaderEntry MiRememberUnloadedDriver MiReplenishSlabAllocator MiSharePages MiStoreWriteModifiedPages MiUnlockBootPageSections MiUnlockControlAreaSectionExtend MiUnlockImageSection MiWriteProtectSystemImages MmChangeImageProtection MmEnumerateSystemImages MmFreeBootDriverInitializationCode MmGetSectionRange MmIsDriverVerifyingByAddress MmLockPagableDataSection MmLockRegistryRecoverySections MmPrefetchPagesEx MmReleaseLoadLock MmVerifyCallbackFunctionCheckFlags NormalizationList__Unlock NtAcceptConnectPort NtAdjustGroupsToken NtAdjustPrivilegesToken NtAllocateUuids NtAlpcAcceptConnectPort NtAlpcCancelMessage NtAlpcCreatePort NtAlpcCreatePortSection NtAlpcCreateResourceReserve NtAlpcCreateSectionView NtAlpcCreateSecurityContext NtAlpcDeletePortSection NtAlpcDeleteResourceReserve NtAlpcDeleteSectionView NtAlpcDeleteSecurityContext NtAlpcDisconnectPort NtAlpcImpersonateClientContainerOfPort NtAlpcImpersonateClientOfPort NtAlpcOpenSenderProcess NtAlpcOpenSenderThread NtAlpcQueryInformationMessage NtAlpcRevokeSecurityContext NtAlpcSetInformation NtCancelTimer NtChangeProcessState NtChangeThreadState NtCreateLowBoxToken NtCreatePort NtCreatePrivateNamespace NtCreateUserProcess NtCreateWaitablePort NtCreateWnfStateName NtDeleteBootEntry NtDeleteDriverEntry NtDeleteKey NtDeleteValueKey NtDeleteWnfStateName NtDuplicateToken NtEnumerateBootEntries NtEnumerateDriverEntries NtEnumerateSystemEnvironmentValuesEx NtEnumerateValueKey NtFlushInstallUILanguage NtFlushKey NtGetCompleteWnfStateSubscription NtGetEnvironmentVariableEx NtGetMUIRegistryInfo NtMakePermanentObject NtMapCMFModule NtMapCMFModule$fin$0 NtMapCMFModule$fin$1 NtOpenPrivateNamespace NtOpenProcessTokenEx NtOpenThreadTokenEx NtQueryBootEntryOrder NtQueryBootOptions NtQueryDriverEntryOrder NtQueryEnvironmentVariableInfoEx NtQueryInformationProcess NtQueryInformationThread NtQueryInformationThread$fin$3 NtQueryInformationToken NtQueryMultipleValueKey NtQuerySecurityAttributesToken NtQuerySystemEnvironmentValue NtQueryWnfStateData NtQueryWnfStateNameInformation NtReadRequestData NtReleaseKeyedEvent NtRenameKey NtReplaceKey NtReplyPort NtReplyWaitReceivePortEx NtReplyWaitReplyPort NtRequestPort NtRequestWaitReplyPort NtRestoreKey NtSaveKeyEx NtSaveMergedKeys NtSecureConnectPort NtSetBootEntryOrder NtSetBootOptions NtSetDriverEntryOrder NtSetInformationKey NtSetInformationThread NtSetInformationThread$fin$1 NtSetInformationToken NtSetSystemEnvironmentValue NtSetUuidSeed NtSetValueKey NtSetWnfProcessNotificationEvent NtSubscribeWnfStateChange NtTerminateProcess NtTraceEvent NtUnsubscribeWnfStateChange NtWaitForKeyedEvent NtWriteRequestData ObDereferenceSecurityDescriptor ObDuplicateObject ObInsertObjectEx ObLogSecurityDescriptor ObOpenObjectByNameEx ObQueryObjectAuditingByHandle ObReferenceFileObjectForWrite ObReleaseObjectSecurity ObRevokeHandles ObSetHandleAttributes ObSetSecurityDescriptorInfo ObShutdownSystem ObWaitForMultipleObjects ObpAuditObjectAccess ObpCloseHandle ObpCreateHandle ObpDeleteDirectoryObject ObpLookupObjectName ObpReferenceObjectByHandleWithTag ObpReferenceProcessObjectByHandle ObpRegisterPrivateNamespace ObpRemoveNamespaceFromTable Ordinal_15 PerfDiagpProxyWorker PfSnCheckActionsNeeded PfSnPopulateReadList PfSnPrefetchCacheEntryUpdate PfSnSectionInfoCleanupWorkItem PfpPrefetchSharedCleanup PfpRpCHashDeleteEntries PfpScenCtxQueryScenarioInformation PfpScenCtxServiceThreadSet PiCMCreateDevice PiCMDeleteDevice PiCMGenerateDeviceInstance PiCMUnregisterDeviceInterface PiDcHandleCustomDeviceEvent PiDqDispatch PiDqIrpQueryCreate PiDqIrpQueryGetResult PiDqObjectManagerEnumerateAndRegisterQuery PiDqObjectManagerServiceActionQueue PiDqQueryApplyObjectEvent PiDqQuerySerializeActionQueue PiDqQueryUnlock PiDrvDbLoadNode PiDrvDbUnloadNode PiDrvDbUnloadNodeWaitWorkerCallback PiDrvDbUnloadNodeWorkerCallback PiGetRelatedDevice PiInitializeDevice PiPnpRtlObjectEventWorker PipKsrNotifyDrivers PipResetDevices PnpCancelDeviceActionRequest PnpNotifyDeviceClassChange PnpNotifyTargetDeviceChange PnpNotifyTargetDeviceChangeNotifyEntry PnpQueuePendingSurpriseRemoval PnpShutdownDevices PnpUnregisterPlugPlayNotification PoFxStartDevicePowerManagement PoUnregisterCoalescingCallback PopDiagTraceFxRundown PopDripsWatchdogCallbackWorker PopDripsWatchdogDiagnosticWorker PopDripsWatchdogStartWatchdog PopDripsWatchdogStopWatchdog PopFxAcpiPrepareDevice PopFxActivateDevicesForSx PopFxDestroyDirectedDripsCandidateDeviceList PopFxDestroyDripsBlockingDeviceList PopFxDisableBasicAccountingWorker PopFxIdleDevicesFromSx PopFxInsertAcpiDevice PopFxInsertDevice PopFxLowPowerEpochCallback PopFxPauseDeviceAccounting PopFxPrepareDevicesForShutdown PopFxRegisterDeviceWithPep PopFxRegisterPluginEx PopFxRemoveAcpiDevice PopFxResidentTimeoutRoutine PopFxResumeDeviceAccounting PopFxStartDeviceAccounting PopFxStopDeviceAccounting PopPepIdleTimeoutRoutine PopPepInsertDevice PopPepPlatformStateRegistered PopPepWork PopPowerAggregatorEngageModernStandby PopPowerButtonBugcheckConfigure PopReleaseAwaymodeLock PpDevCfgProcessDevices PsCallEnclave PsCallImageNotifyRoutines PsCaptureExceptionPort PsCreateVsmEnclave PsDisableImpersonation PsFreezeProcess PsGetNextProcessThread PsGetProcessDeepFreezeStats PsGetProcessEnclaveModuleInfo PsImpersonateClient PsInitializeVsmEnclave PsLoadVsmEnclaveData PsMultiResumeProcess PsQueryProcessEnergyValues PsQueryProcessExceptionFlags PsQueryRuntimeProcess PsQueryStatisticsProcess PsQueryTotalCycleTimeProcess PsReferenceImpersonationToken PsReferenceImpersonationTokenEx PsReferencePartitionSystemProcess PsReferencePrimaryTokenWithTag PsRegisterAltSystemCallHandler PsRemoveCreateThreadNotifyRoutine PsRemoveLoadImageNotifyRoutine PsRestoreImpersonation PsSetProcessFaultInformation PsSetProcessTelemetryAppState PsSetProcessWin32Process PsShutdownSystem PsStartSiloMonitor PsSuspendProcess PsSuspendThread PsSwapImpersonationToken PsSwapProcessWorkingSet PsSynchronizeWithThreadInsertion PsTerminateMinimalProcess PsTerminateProcess PsThawMultiProcess PsUnregisterSiloMonitor PsUpdateActiveProcessAffinity PsWatchWorkingSet PspAllocateAndQueryProcessNotificationChannel PspApplyCoreIsolationPolicy PspAssignPrimaryToken PspAssignProcessToJob PspAttachProcessToSyscallProvider PspChargeProcessWakeCounter PspCreatePicoProcess PspCreatePicoThread PspCreateThread PspDeleteProcessStateChange PspDestroySyscallProvider PspDetachProcessFromSyscallProvider PspEnableProcessOptionalXStateFeatures PspExitProcess PspExitThread PspGetNextSyscallProviderProcess PspGetPreviousProcessThread PspInheritSyscallProvider PspInsertProcess PspInsertSyscallProvider PspJobDelete PspLockUnlockProcessExclusive PspLookupSyscallProviderById PspMarkServerSiloAsTerminating PspNotifyProcessEffectiveIoLimitChanged PspNotifyServerSiloCreation PspNotifyServerSiloTermination PspProcessClose PspProcessDynamicEHContinuationTargets PspProcessDynamicEnforcedAddressRanges PspQueryWorkingSetWatch PspReferenceSystemDll PspRemoveEnclaveThreadWait PspRemoveProcessFromJobChain PspRundownSingleProcess PspSelectVsmEnclaveByNumber PspSetCreateProcessNotifyRoutine PspSetJobIoRateControl PspSetProcessAffinityUpdateMode PspSetProcessDefaultHardErrorMode PspSetProcessForegroundBackgroundRequest PspSetProcessPriorityClass PspStorageAllocSlot PspStorageEmptyArray PspStorageEmptyArrayNonReadonly PspStorageFreeSlot PspStorageGetObject PspStorageInsertObject PspStorageMakeSlotReadOnly PspStorageRemoveObject PspStorageReplaceObject PspSyscallProviderOptIn PspTeardownPartition PspTerminatePicoProcess PspThreadDelete PspUnlockProcessExclusive PspUnlockQuotaListExclusive PspUnlockQuotaListShared PspWow64ReadOrWriteThreadCpuArea RawDispatch RtlFindDynamicEnforcedAddressInRanges RtlRunOnceExecuteOnce RtlpFindDynamicEHContinuationTarget RtlpInsertStringAtom RtlpSetSecurityObject SLGetSubscriptionPfn SLGetSubscriptionPfn$fin$0 SLGetSubscriptionPfn$fin$1 SLQueryLicenseValueInternal SLUpdateLicenseDataInternal SLUpdateLicenseDataInternal$fin$0 SLUpdateLicenseDataInternal$fin$1 SMKM_STORE<SM_TRAITS>::SmStCleanup SeAccessCheckByType SeCaptureSubjectContextEx SeDefaultObjectMethod SeExchangePrimaryToken SeIsTokenAssignableToProcess SeMarkLogonSessionForTerminationNotificationEx SeQuerySessionIdTokenEx SeRegisterLogonSessionTerminatedRoutine SeRegisterLogonSessionTerminatedRoutineEx SeRegisterObjectTypeMandatoryPolicy SeSetMandatoryPolicyToken SeSetPrivateNameSpaceToken SeSetSecurityAttributesTokenEx SeSetSessionIdTokenWithLinked SeSetVirtualizationToken SeTokenGetNoChildProcessRestricted SeTokenGetRedirectionTrustPolicy SeTokenIsNoChildProcessRestrictionEnforced SeTokenSetNoChildProcessRestricted SeTokenSetRedirectionTrustPolicy SeUnregisterLogonSessionTerminatedRoutine SeUnregisterLogonSessionTerminatedRoutineEx SendCaptureStateNotificationsWorker SepAccessCheckAndAuditAlarm SepAddLuidToIndexEntry SepAppendAceToTokenObjectAcl SepBlockAccessForLogonSession SepCreateLogonSessionTrack SepDeleteLogonSessionTrack SepDeleteUnreferencedLogonSessionsInSilo SepDereferenceCachedHandlesEntry SepDesktopAppxSubProcessToken SepFilterToken SepIdAssignableAsGroup SepInternalSetSecurityAttributesToken SepIsParentOfChildAppContainer SepIsValidProcUniqueLuid SepMakeLogonSessionsSiblings SepNotifyFileSystems SepRmCallLsa SepRmCapUpdateWrkr SepRmCommandServerThread SepSetTokenCachedHandles SepSetTokenClaims SepSetTokenUserAndGroups SepUpdateLogonSessionTrack UNLOCK_HIVE_LOAD ViPendingQueuePassiveLevelCompletion VmPinMemoryRange VmUnpinMemoryRange VmpPauseResumeNotify VrpDecrementSiloCount VrpDereferenceDiffHiveEntry VrpFindDiffHiveEntryForMountPoint VrpFindOrCreateDiffHiveEntryForMountPoint VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlLoadDifferencingHive VrpHandleIoctlModifyFlags VrpHandleIoctlUnloadDynamicallyLoadedHives VrpIncrementSiloCount VrpLoadDifferencingHive VrpPostEnumerateKey VrpPostUnloadKey VrpPreLoadKey VrpPreUnloadKey VrpRelinquishDiffHiveEntryTransitionOwner VrpTranslatePath VrpUnloadDifferencingHive VrpWaitForDiffHiveEntryTransitionOwnerToLeave VslRegisterBootDrivers VslpEnterIumSecureMode WdipSemInitialize WdipSemMarkNextTimedOutInstanceForDeletion WdipSemSqmLogInflightLimitExceededDataPoints WdipSemUpdate WdipTimeoutCheckRoutine WheaRegisterErrorSourceOverride WheaSelLogCheckPoint WheaSelLogSetNtSchedulerAvailability WheaUnregisterErrorSourceOverride WmipFindSMBiosStructure WmipGetSMBiosEventlog WmipGetSMBiosTableData WmipGetSysIds WmipReleaseSmbiosLockShared _PnpCtxCloseMachine
paramcount
0
0
address
14030f820
14030f810
sig
undefined KiLeaveCriticalRegionUnsafe(void)
undefined KiLeaveCriticalRegionUnsafe(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
KiLeaveCriticalRegionUnsafe Calling Diff
--- KiLeaveCriticalRegionUnsafe calling
+++ KiLeaveCriticalRegionUnsafe calling
@@ -175,2 +175,2 @@
- FUN_14036f764
- FUN_1409fa77c
+ FUN_14036f754
+ FUN_1409fa70c
@@ -650 +649,0 @@
- VrpHandleIoctlInitializeJobForVreg
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.96
i_ratio
0.64
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
ExfTryToWakePushLock
ExfTryToWakePushLock
fullname
ExfTryToWakePushLock
ExfTryToWakePushLock
refcount
1007
1005
length
40
40
called
ExpWakePushLock
ExpWakePushLock
calling
Expand for full list: AlpcAddHandleTableEntry AlpcConnectionDestroyProcedure AlpcDeleteBlobByHandle AlpcRegisterLogRoutine AlpcUnregisterLogRoutine AlpcViewDestroyProcedure AlpcpAcceptConnectPort AlpcpAssociateIoCompletionPort AlpcpCancelMessage AlpcpCancelMessagesByRequestor AlpcpCleanupProcessViews AlpcpCompleteDispatchMessage AlpcpCreateClientPort AlpcpCreateView AlpcpDeleteBlob AlpcpDeletePort AlpcpDestroyBlob AlpcpDestroyPort AlpcpDisconnectPort AlpcpDispatchReplyToPort AlpcpDispatchReplyToWaitingThread AlpcpDoPortCleanup AlpcpEndInitialization AlpcpEnterAllocationEventMessageLog AlpcpEnterFreeEventMessageLog AlpcpEnterStateChangeEventMessageLog AlpcpFlushCancelQueue AlpcpFlushMessagesByRequestor AlpcpFlushQueue AlpcpFlushResourcesPort AlpcpImpersonateMessage AlpcpInitializeCompletionList AlpcpInitializePort AlpcpInsertCompletionListEntry AlpcpInsertMessageCanceledQueue AlpcpInsertMessageDirectQueue AlpcpInsertMessageLargeMessageQueue AlpcpInsertMessageMainQueue AlpcpInsertMessagePendingQueue AlpcpInsertResourcePort AlpcpReceiveDirectMessagePort AlpcpReceiveMessagePort AlpcpReferenceMessageByWaitingThread AlpcpReferenceMessageByWaitingThreadPort AlpcpRegisterCompletionListDatabase AlpcpRemoveMessageFromPendingQueue AlpcpRemoveResourcePort AlpcpSendLegacySynchronousRequest AlpcpSignalPortAndUnlock AlpcpTrackPortReferences AlpcpUnlockBlob AlpcpUnregisterCompletionListDatabase AlpcpWaitForPortReferences AlpcpWalkConnectionList BgkpLockBgfxCodeSection BgkpUnlockBgfxCodeSection CcAmILowPriorityWriter CcApplyLowIoPriorityToThread CcBoostLowPriorityWorkerThread CcChangeBackingFileObject CmFcManagerDrainAllFeatureUsageNotifications CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerRegisterFeatureConfigurationChangeNotification CmFcManagerUnregisterFeatureConfigurationChangeNotification CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpManagerDrainUsageNotificationsWorker CmFcpManagerRetryUsageNotificationsWorker CmFcpManagerSoftwareHiveReady CmFreezeRegistry CmSiRWLockReleaseExclusive CmThawRegistry CmUnlockHive CmpCloseKeyObject CmpCreateHive CmpCreateHiveRootCell CmpDoQueueLateUnloadWorker CmpFlushHive CmpFlushNotify CmpInitCmRM CmpMarkEntireIndexDirty CmpRecoverFlushProtocolStateFromFiles CmpRefreshHive CmpReorganizeHive CmpReportNotifyHelper CmpTransMgrPrepare CmpTransMgrSyncHive CmpTrimHive CmpVolumeContextDecrementRefCount CmpVolumeContextSendDeviceUsageNotification CmpVolumeManagerGetContextForFile DbgkRegisterErrorPort DbgkpRemoveErrorPort DifExfTryToWakePushLockWrapper EmClientQueryRuleState EmClientRuleDeregisterNotification EmClientRuleEvaluate EmPowerPagingEnabled EmProviderDeregister EmProviderDeregisterEntry EmProviderRegisterEntry EmpAcquirePagingReference EmpClientRuleRegisterNotification EmpParseInfDatabase EmpProviderRegister EmpQueueRuleUpdateState EmpReleasePagingReference EmpRuleUpdateWorkerThread EtwQueryProcessTelemetryCoverage EtwpAcquireTokenAccessInformation EtwpAddBinaryInfoEvents EtwpAddDebugInfoEvents EtwpAddGuidEntry EtwpBufferingModeCompressionFlush EtwpCompressPendingBuffers EtwpCompressionProc EtwpCovSampContextAddSamples EtwpCovSampContextCleanup EtwpCovSampContextGetModule EtwpCovSampContextPruneModules EtwpCovSampHashMakeRoomAndAcquireLock EtwpCovSampProcessAddModule EtwpCovSampProcessMapAddresses EtwpCoverageCheckCP EtwpCoverageEnsureContext EtwpCoverageEnsureUserModeView EtwpCoverageFlushWorkItemCallback EtwpCoverageProvEnableCallback EtwpCoverageRecord EtwpCoverageReset EtwpCoverageResetCP EtwpCoverageSamplerClose EtwpCoverageSamplerQuery EtwpCoverageSamplerSetBloomFilter EtwpCoverageSamplerStart EtwpCoverageSamplerStop EtwpCoverageSamplerUnloadImage EtwpCreateLogFile EtwpCreateUmReplyObject EtwpDeleteRegistrationObject EtwpDisableCompression EtwpFlushCoverage EtwpFreeCompression EtwpGetLoggerInfoFromContext EtwpRealtimeNotifyConsumers EtwpSendDbgId EtwpSetCompressionSettings EtwpTrackBinaryForSession EtwpTrackDebugIdForSession EtwpTrackDecodeGuidForSession EtwpUnreferenceGuidEntry EtwpUpdateDisallowedGuids EtwpUpdatePeriodicCaptureState EtwpUpdateSelectedGroupMasks ExCreateHandleTable ExDisableHandleTracing ExDupHandleTable ExEnableHandleExceptions ExEnableHandleTracing ExEnableRaiseUMExceptionOnInvalidHandleClose ExGetWakeTimerList ExInitLicenseData ExInitializeDeviceAts ExNotifyPlatformBinaryExecuted ExQueryHandleExceptionsPermanency ExReferenceHandleDebugInfo ExRegisterExtension ExRegisterHost ExReleaseCacheAwarePushLockExclusive ExReleaseCacheAwarePushLockExclusiveEx ExReleasePushLockExclusiveEx ExSetLicenseTamperState ExSvmBeginDeviceReset ExSvmFinalizeDeviceReset ExSweepHandleTable ExTryAcquireAutoExpandPushLockExclusive ExTryAcquireCacheAwarePushLockExclusiveEx ExUninitializeDeviceAts ExUnregisterExtension ExUuidCreate ExWakeTimersResume ExpAllocateHandleTableEntry ExpDeleteTimer ExpFreeHandleTableEntry ExpGetGlobalLocaleSection ExpGetSystemPlatformBinary ExpInsertLowLevelTableIntoFreeList ExpKdPullRemoteFileForUser ExpLoadAndSortLicensingCacheDescriptors ExpLoadAndSortLicensingCacheDescriptors$fin$1 ExpQueryBootLoaderMetadata ExpReadLeapSecondData ExpReleaseFannedOutPushLockExclusive ExpRemoveHandleTable ExpSaAllocatorAllocate ExpSaAllocatorFree ExpSaPageGroupAllocateMemory ExpSaPageGroupDescriptorAllocate ExpSaPageGroupDescriptorFree ExpSaPageGroupFreeMemory ExpSetBootLoaderMetadata ExpSetKernelDataProtection$fin$0 ExpSetTimerObject ExpShareAddressSpaceWithDevice ExpSvmDereferenceDevice ExpTryAcquireFannedOutPushLockExclusive ExpWnfAcquirePermanentDataStoreHandle ExpWnfAllocateNextPersistentNameSequence ExpWnfCompleteThreadSubscriptions ExpWnfCreateNameInstance ExpWnfCreateProcessContext ExpWnfDeleteNameInstance ExpWnfDeleteProcessContext ExpWnfDeleteScopeById ExpWnfDeleteScopeInstances ExpWnfDeleteStateData ExpWnfDeleteSubscription ExpWnfDeliverThreadNotifications ExpWnfDestroyPermanentDataStore ExpWnfDispatchKernelSubscription ExpWnfGetPermanentDataStore ExpWnfInsertSubscriptionInPendingQueue ExpWnfInvalidateDataStores ExpWnfResolveScopeInstance ExpWnfSubscribeNameInstance ExpWnfUpdateSubscription ExpWnfWriteStateData ExpWnfWriteStateData$fin$0 FUN_1409fa120 FlushLookUpTableBucket HalpDmaAllocateChildAdapterV3 HalpIommuBlockDevice HalpIommuCreateDevice HalpIommuDeleteDevice HalpIommuInvokeInterfaceStateChangeCallbacks HalpIommuUnblockDevice HalpLeaveDmaDomain HvFoldBackDirtyData HvFreeCell HvHiveConvertLockedPagesToCowByPolicy HvIsRangeDirty HvlQuerySetBootPagesInfo HvpDoAllocateCell HvpMarkCellDirty IoRegisterIoTracking IoUnregisterIoTracking IommuBeginDeviceReset IommuDeviceDelete IommuFinalizeDeviceReset IommuRegisterInterfaceStateChangeCallback IommuUnregisterInterfaceStateChangeCallback IommupDeviceDisableSvm IommupDeviceGetPasidDevice IommupFreeSystemContext IommupGetSystemContext IommupHvAttachPasidDevice IommupHvAttachPasidDeviceDomain IommupHvCreateSvmPasidSpace IommupHvDetachPasidDeviceDomain IommupPasidDeviceCreate IommupPasidDeviceDelete KeCleanupImageTracepoints KeGenericCallDpcEx KeSetSystemServiceCallback KeSetTracepoint KeUpdateDpcWatchdogConfiguration KiGenericCallDpcInitiatorWorker KiShouldLogUserModeReturnMismatch KiStartSavingSupervisorState KiTpIsExcludedKernelTracepointLocation KseAddHardwareId KseDriverUnloadImage KseLookupHardwareId KseQueryDeviceDataList KseRegisterShimEx KseResetDeviceCache KseShimDatabaseBootRelease KseShimDatabaseClose KseShimDatabaseOpen KseUnregisterShim KsepDbCacheInsertDevice KsepDbCacheQueryDevice KsepGetShimsForDriver KsepIsModuleShimmed KsepResolveApplicableShimsForDriver KsepShimDbChanged MI_UNLOCK_RELOCATIONS_EXCLUSIVE MiAddSpecialPurposeMemoryCleanup MiAddSpecialPurposeMemoryComplete MiAddSpecialPurposeMemoryPrepare MiAddViewsForSection MiAllocatePartitionId MiApplyImageHotPatchRequest MiCaptureRetpolineImportInfo MiChargeSegmentCommit MiCoalescePlaceholderAllocations MiCommitExistingVad MiCommitPageTableRangesForVad MiContractWsSwapPageFileWorker MiCopyLargeVad MiCreateFileOnlyImageFixupList MiCreateHardwareEnclave MiCreatePagingFile MiCreatePagingFileMap MiCreatePerSessionProtos MiCreatePrototypePtes MiDecommitHardwareEnclavePages MiDeleteAllHardwareEnclaves MiDeleteEmptyPageTables MiDeleteEnclavePages MiDeleteHotPatchEntry MiDeleteHotPatchRecord MiDeletePartitionResources MiDeleteVad MiDereferenceExtendInfo MiDereferencePerSessionProtos MiFindSpecialPurposeMemoryTypeByPartition MiFinishCreateSection MiFinishResume MiFinishVadDeletion MiFreePartitionId MiFreeRetpolineImportInfo MiFreeSessionId MiFreeUnusedPfnPages MiGetChannelInformation MiGetNewSessionId MiGetPartitionNodeInformation MiInitializeMirroring MiInitializePagedPoolEvents MiInitializePartialVad MiInitializePartition MiInitializePartitionSpecialPurposeMemory MiInitializeSessionGlobals MiInsertChildVads MiInsertHotPatchRecord MiInsertInSystemSpace MiInsertPageFileInList MiInsertSharedCommitNode MiInsertVad MiLateInitializeSystemCache MiLoadHotPatchForUserSid MiLockVadRange MiMakeDriverPagesPrivate MiManageSubsectionView MiMapViewOfDataSection MiMarkHugePfnBad MiMarkSharedImageCfgBits MiObtainRelocationBits MiPerformVadSplitting MiPersistMdl MiPopulateCfgBitMap MiReleaseKernelCfgLock MiRemoveFromSystemSpace MiRemoveSharedCommitNode MiRemoveVad MiReserveUserMemory MiReturnImageBase MiSectionDelete MiSelectOverflowDllBase MiSelectRelocationStartHint MiSendParkedCoreUpdateToAllChildPartitions MiSetPagesModified MiSetProtectionOnSection MiSetVadDeleted MiShutdownSystem MiSpecialPurposeMemoryRemoved MiSplitPrivatePage MiSplitReducedCommitClonePage MiTransferFileExtent MiTrimUnusedPageFileRegionsWorker MiUnloadHotPatchForUserSid MiUnlockAndDereferenceVad MiUnlockDriverMappings MiUnlockDynamicMemoryExclusive MiUnlockDynamicMemoryNestedExclusive MiUnlockFileExtentsExclusive MiUnlockLoaderEntry MiUnlockNestedVad MiUnlockPartitionSystemThreads MiUnlockVad MiUnlockVadRange MiUpControlAreaRefs MiUpdateSpecialPurposeMemoryCacheEligibility MiZeroAllPageFiles MmCommitSessionMappedView MmCreateShadowMapping MmDecodeExportSection MmDeleteShadowMapping MmDuplicateMemory MmEncodeExportSection MmEnumerateBadPages MmExtendSection MmGetPageFileForCrashDump MmLinkJobProcess MmOutSwapVirtualAddresses MmOutSwapWorkingSet MmReleaseLoadLock MmResourcesAvailable NormalizationList__Unlock NtAllocateUuids NtAlpcRevokeSecurityContext NtAlpcSetInformation NtCancelTimer NtChangeProcessState NtChangeThreadState NtCreateUserProcess NtNotifyChangeMultipleKeys NtReleaseKeyedEvent NtSetInformationThread NtSetInformationThread$fin$1 NtSetSystemInformation NtSetUuidSeed NtTerminateProcess NtWaitForKeyedEvent ObCheckRefTraceProcess ObClearProcessDeviceMap ObDereferenceDeviceMap ObDereferenceSecurityDescriptor ObDisableEtwReferenceTrace ObDuplicateObject ObEnableEtwReferenceTrace ObQueryRefTraceInformation ObReleaseObjectSecurity ObpCloseHandle ObpCreateHandle ObpCreateSymbolicLinkName ObpDeleteSymbolicLinkName ObpDeregisterObject ObpFreeWorkItemBlock ObpLookupObjectName ObpPushRefDerefInfo ObpRegisterObject ObpSetCurrentProcessDeviceMap ObpSetDeviceMap ObpStartRuntimeStackTrace ObpStopRuntimeStackTrace Ordinal_20 PerfDiagpProxyWorker PfFileInfoNotify PfGenerateTrace PfProcessExitNotification PfSetSuperfetchInformation PfSnSetAltPrefetchParam PfTAccessTracingCleanup PfTAccessTracingStart PfTSetTraceWorkerPriority PfTSetTracingPriority PfpParametersPropagate PfpParametersWatcher PfpPrefetchSharedCleanup PfpPrefetchSharedStart PfpRpCHashAddEntries PfpRpCHashDeleteEntries PfpRpCHashEmpty PfpRpCHashGrow PfpRpFileKeyUpdate PfpRpShutdown PfpScenCtxPrefetchAbortSet PfpScenCtxPrefetchStateSet PfpScenCtxPrefetchWait PfpScenCtxQueryScenarioInformation PfpScenCtxScenarioSet PfpScenCtxServiceThreadSet PoFxAbandonDevice PopBlackBoxDirectAccess PopBlackBoxUpdate PopBootStatCheckIntegrity PopBootStatGet PopBootStatRestoreDefaults PopBootStatSet PopBootStatUnlock PopDirectedDripsDiagBroadcastTreeBegin PopDirectedDripsDiagBroadcastTreeEnd PopDirectedDripsDiagNotifySessionStart PopDirectedDripsDiagNotifySessionStop PopDirectedDripsDiagTraceBroadcastFailureDevice PopDirectedDripsDiagTraceBroadcastVisit PopDirectedDripsDiagTraceMarkDevice PopDirectedDripsDiagTraceNotifyDevices PopDirectedDripsDiagTraceProblemDevice PopDirectedDripsHandleResiliencyNotification PopDirectedDripsIdleResiliencyCallback PopDirectedDripsNotify PopDirectedDripsNotifyResiliencyCompletionWorker PopFxBuildDirectedDripsCandidateDeviceList PopFxBuildDripsBlockingDeviceList PopFxClearDirectedDripsCandidateDeviceList PopFxInsertAcpiDevice PopFxInsertDevice PopFxNotifySxTransitionState PopFxPrepareDevicesForShutdown PopFxRegisterPluginEx PopFxRemoveAcpiDevice PopFxRemoveDevice PopFxUpdateVetoMaskWork PopPdcCsDeviceNotification PopPepInsertDevice PopPepRemoveDevice PopPowerButtonBugcheckConfigure PsAdjustBasicEnclaveThreadList PsCallEnclave PsCreateVsmEnclave PsDeleteVsmEnclave PsDisableImpersonation PsFreezeProcess PsGetProcessEnclaveModuleInfo PsImpersonateClient PsInitializeVsmEnclave PsIsVsmEnclaveTerminated PsLoadVsmEnclaveData PsRestoreImpersonation PsSetProcessFaultInformation PsSetProcessTelemetryAppState PsSetProcessWin32Process PsStartSiloMonitor PsSwapImpersonationToken PsTerminateMinimalProcess PsTerminateVsmEnclave PsThawMultiProcess PsUnregisterSiloMonitor PsUpdateActiveProcessAffinity PspAllocateAndQueryProcessNotificationChannel PspAllocateThread PspApplyWorkingSetLimits PspApplyWorkingSetLimitsToProcess PspAssignProcessToJob PspAttachProcessToSyscallProvider PspChangeJobMemoryUsageByProcess PspCreatePicoProcess PspDestroySyscallProvider PspDetachProcessFromSyscallProvider PspEnableProcessOptionalXStateFeatures PspExitThread PspInsertProcess PspInsertSyscallProvider PspInsertThread PspProcessClose PspProcessDynamicEHContinuationTargets PspProcessDynamicEnforcedAddressRanges PspRemoveEnclaveThreadWait PspRundownSingleProcess PspSetJobIoRateControl PspSetProcessDefaultHardErrorMode PspSetProcessForegroundBackgroundRequest PspSetQuotaLimits PspStorageAllocSlot PspStorageEmptyArray PspStorageEmptyArrayNonReadonly PspStorageFreeSlot PspStorageInsertObject PspStorageMakeSlotReadOnly PspStorageRemoveObject PspStorageReplaceObject PspSyscallProviderOptIn PspTeardownPartition PspTerminateProcess PspThreadDelete PspUnlockJobAssignment PspUnlockJobListExclusive PspUnlockJobMemoryLimitsExclusive PspUnlockJobsAndProcessExclusive PspUnlockProcessExclusive PspUnlockProcessListExclusive PspUnlockQuotaExpansion PspUnlockQuotaListExclusive RtlDeleteAtomFromAtomTable RtlDestroyAtomTable RtlEmptyAtomTable RtlInsertDynamicFunctionTable RtlLockBootStatusData RtlLookupAtomInAtomTable RtlPinAtomInAtomTable RtlQueryAtomInAtomTable RtlQueryAtomsInAtomTable RtlRemoveDynamicFunctionTable RtlUnlockBootStatusData RtlpCSparseBitmapUnlock RtlpFlsAlloc RtlpFlsDataCleanup RtlpFlsFree RtlpFlsSetValueSlot RtlpHpAcquireReleaseLockExclusive RtlpHpCustomVaCallbacksRegistrarRegister RtlpHpCustomVaCallbacksRegistrarUnregister RtlpHpFixedVsAllocate RtlpHpFixedVsFree RtlpHpHeapExtendContext RtlpHpLargeAlloc RtlpHpLargeFree RtlpHpLfhBucketAddSubsegment RtlpHpLfhBucketGetSubsegment RtlpHpLfhBucketUpdateAffinityMapping RtlpHpLfhSlotAllocate RtlpHpLfhSubsegmentDecommitPages RtlpHpLfhSubsegmentFreeBlock RtlpHpLfhSubsegmentIncBlockCounts RtlpHpReleaseQueuedLockExclusive RtlpHpSegContextCompact RtlpHpSegMgrCommitComplete RtlpHpSegMgrCommitInitiate RtlpHpSegMgrVaCtxAlloc RtlpHpSegMgrVaCtxFree RtlpHpSegMgrVaCtxInsert RtlpHpSegPageRangeAllocate RtlpHpSegPageRangeCoalesce RtlpHpSegPageRangeShrink RtlpHpVaMgrAlloc RtlpHpVaMgrCtxFree RtlpHpVsChunkSplit RtlpHpVsSubsegmentCommitPages RtlpUnlockAtomTable SLGetSubscriptionPfn SLGetSubscriptionPfn$fin$0 SLQueryLicenseValueInternal SLUpdateLicenseDataInternal SMKM_STORE<SM_TRAITS>::SmStCleanup SMKM_STORE<SM_TRAITS>::SmStWorker SMKM_STORE<struct_SM_TRAITS>::SmStHelperSendCommand SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEmpty SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys SSHSupportReleasePushLockExclusive ST_STORE<struct_SM_TRAITS>::StDmPageRemove ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd SeDefaultObjectMethod SeRegisterObjectTypeMandatoryPolicy SendCaptureStateNotificationsWorker SepAddLuidToIndexEntry SepAppendAceToTokenObjectAcl SepDeReferenceSharedSidEntries SepDeleteSessionLowboxEntries SepDereferenceCachedHandlesEntry SepDereferenceLowBoxNumberEntry SepInsertOrReferenceSharedSidEntries SepIsParentOfChildAppContainer SepRmCapUpdateWrkr SepSetTokenCachedHandles SepSetTokenClaims SepSetTokenLowboxNumber SepSetTokenUserAndGroups SmCreatePartition SmDeletePartition SmFirstTimeInit SmGetRegistrationInfo SmKmKeyGenKeyDelete SmKmKeyGenNewKey SmKmStoreAdd SmKmStoreDelete SmKmVirtualLockContextIncreaseWsMin SmKmVirtualLockCtxMemoryUnlocked SmPartitionJobPaired SmProcessCompressionInfoRequest SmcCacheAdd SmcCacheCreatePrepare SmcCacheRemove SmcStoreDelete SmcStoreResize SmcStoreSlotAbort SmcStoreSlotCommit SmcStoreSlotReserve SmpKeyedStoreEntryGet SmpKeyedStoreSetVaRanges SmpSystemStoreCreate SshpSetCollectionActive TlgAggregateInternalProviderCallback TlgRegisterAggregateProviderEx UNLOCK_ADDRESS_SPACE_UNORDERED UNLOCK_PAGE_TABLE_COMMITMENT VmCreateMemoryRange VmDeleteMemoryRange VmMergeMemoryRanges VmSplitMemoryRange VmpCleanProcessAddressSpace VmpPauseResumeNotify VrpDecrementSiloCount VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlInitializeJobForVreg VrpHandleIoctlLoadDifferencingHive VrpHandleIoctlLoadDifferencingHiveForHost VrpHandleIoctlModifyFlags VrpHandleIoctlUnloadDifferencingHiveForHost VrpHandleIoctlUnloadDynamicallyLoadedHives VrpIncrementSiloCount VrpLoadDifferencingHive VrpPostUnloadKey VrpPreLoadKey VrpPreUnloadKey VrpUnloadDifferencingHive VrpWaitForDiffHiveEntryTransitionOwnerToLeave VslpLockPagesForTransfer VslpUnlockPagesForTransfer WbAddHeapExecutedBlockToCache WbAddHeapExecutedBlockToLRU WbAddWarbirdEncryptionSegment WbAllocateSlots WbAllocateUserMemory WbDecryptEncryptionSegment WbFreeMemoryBlockRegion WbGetInitializedEncryptionSegment WbGetWarbirdProcess WbGetWarbirdThread WbHeapExecutionUnloadModule WbInPlaceEncryptionUnloadModule WbMoveHeapExecutedBlockToBackOfLRU WbReEncryptEncryptionSegment WbRemoveWarbirdProcess WheaConfigureErrorSource WheaExecuteRowFailureCheck WheaInitialize WheaRegisterErrorSourceOverride WheaRegisterInUsePageOfflineNotification WheaSelLogCheckPoint WheaSelLogSetNtSchedulerAvailability WheaUnconfigureErrorSource WheaUnregisterErrorSourceOverride WheaUnregisterInUsePageOfflineNotification WheapCallInUsePageNotificationCallbacks WheapPfaReset WheapPredictiveFailureAnalysis
Expand for full list: AlpcAddHandleTableEntry AlpcConnectionDestroyProcedure AlpcDeleteBlobByHandle AlpcRegisterLogRoutine AlpcUnregisterLogRoutine AlpcViewDestroyProcedure AlpcpAcceptConnectPort AlpcpAssociateIoCompletionPort AlpcpCancelMessage AlpcpCancelMessagesByRequestor AlpcpCleanupProcessViews AlpcpCompleteDispatchMessage AlpcpCreateClientPort AlpcpCreateView AlpcpDeleteBlob AlpcpDeletePort AlpcpDestroyBlob AlpcpDestroyPort AlpcpDisconnectPort AlpcpDispatchReplyToPort AlpcpDispatchReplyToWaitingThread AlpcpDoPortCleanup AlpcpEndInitialization AlpcpEnterAllocationEventMessageLog AlpcpEnterFreeEventMessageLog AlpcpEnterStateChangeEventMessageLog AlpcpFlushCancelQueue AlpcpFlushMessagesByRequestor AlpcpFlushQueue AlpcpFlushResourcesPort AlpcpImpersonateMessage AlpcpInitializeCompletionList AlpcpInitializePort AlpcpInsertCompletionListEntry AlpcpInsertMessageCanceledQueue AlpcpInsertMessageDirectQueue AlpcpInsertMessageLargeMessageQueue AlpcpInsertMessageMainQueue AlpcpInsertMessagePendingQueue AlpcpInsertResourcePort AlpcpReceiveDirectMessagePort AlpcpReceiveMessagePort AlpcpReferenceMessageByWaitingThread AlpcpReferenceMessageByWaitingThreadPort AlpcpRegisterCompletionListDatabase AlpcpRemoveMessageFromPendingQueue AlpcpRemoveResourcePort AlpcpSendLegacySynchronousRequest AlpcpSignalPortAndUnlock AlpcpTrackPortReferences AlpcpUnlockBlob AlpcpUnregisterCompletionListDatabase AlpcpWaitForPortReferences AlpcpWalkConnectionList BgkpLockBgfxCodeSection BgkpUnlockBgfxCodeSection CcAmILowPriorityWriter CcApplyLowIoPriorityToThread CcBoostLowPriorityWorkerThread CcChangeBackingFileObject CmFcManagerDrainAllFeatureUsageNotifications CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerRegisterFeatureConfigurationChangeNotification CmFcManagerUnregisterFeatureConfigurationChangeNotification CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpManagerDrainUsageNotificationsWorker CmFcpManagerRetryUsageNotificationsWorker CmFcpManagerSoftwareHiveReady CmFreezeRegistry CmSiRWLockReleaseExclusive CmThawRegistry CmUnlockHive CmpCloseKeyObject CmpCreateHive CmpCreateHiveRootCell CmpDoQueueLateUnloadWorker CmpFlushHive CmpFlushNotify CmpInitCmRM CmpMarkEntireIndexDirty CmpRecoverFlushProtocolStateFromFiles CmpRefreshHive CmpReorganizeHive CmpReportNotifyHelper CmpTransMgrPrepare CmpTransMgrSyncHive CmpTrimHive CmpVolumeContextDecrementRefCount CmpVolumeContextSendDeviceUsageNotification CmpVolumeManagerGetContextForFile DbgkRegisterErrorPort DbgkpRemoveErrorPort DifExfTryToWakePushLockWrapper EmClientQueryRuleState EmClientRuleDeregisterNotification EmClientRuleEvaluate EmPowerPagingEnabled EmProviderDeregister EmProviderDeregisterEntry EmProviderRegisterEntry EmpAcquirePagingReference EmpClientRuleRegisterNotification EmpParseInfDatabase EmpProviderRegister EmpQueueRuleUpdateState EmpReleasePagingReference EmpRuleUpdateWorkerThread EtwQueryProcessTelemetryCoverage EtwpAcquireTokenAccessInformation EtwpAddBinaryInfoEvents EtwpAddDebugInfoEvents EtwpAddGuidEntry EtwpBufferingModeCompressionFlush EtwpCompressPendingBuffers EtwpCompressionProc EtwpCovSampContextAddSamples EtwpCovSampContextCleanup EtwpCovSampContextGetModule EtwpCovSampContextPruneModules EtwpCovSampHashMakeRoomAndAcquireLock EtwpCovSampProcessAddModule EtwpCovSampProcessMapAddresses EtwpCoverageCheckCP EtwpCoverageEnsureContext EtwpCoverageEnsureUserModeView EtwpCoverageFlushWorkItemCallback EtwpCoverageProvEnableCallback EtwpCoverageRecord EtwpCoverageReset EtwpCoverageResetCP EtwpCoverageSamplerClose EtwpCoverageSamplerQuery EtwpCoverageSamplerSetBloomFilter EtwpCoverageSamplerStart EtwpCoverageSamplerStop EtwpCoverageSamplerUnloadImage EtwpCreateLogFile EtwpCreateUmReplyObject EtwpDeleteRegistrationObject EtwpDisableCompression EtwpFlushCoverage EtwpFreeCompression EtwpGetLoggerInfoFromContext EtwpRealtimeNotifyConsumers EtwpSendDbgId EtwpSetCompressionSettings EtwpTrackBinaryForSession EtwpTrackDebugIdForSession EtwpTrackDecodeGuidForSession EtwpUnreferenceGuidEntry EtwpUpdateDisallowedGuids EtwpUpdatePeriodicCaptureState EtwpUpdateSelectedGroupMasks ExCreateHandleTable ExDisableHandleTracing ExDupHandleTable ExEnableHandleExceptions ExEnableHandleTracing ExEnableRaiseUMExceptionOnInvalidHandleClose ExGetWakeTimerList ExInitLicenseData ExInitializeDeviceAts ExNotifyPlatformBinaryExecuted ExQueryHandleExceptionsPermanency ExReferenceHandleDebugInfo ExRegisterExtension ExRegisterHost ExReleaseCacheAwarePushLockExclusive ExReleaseCacheAwarePushLockExclusiveEx ExReleasePushLockExclusiveEx ExSetLicenseTamperState ExSvmBeginDeviceReset ExSvmFinalizeDeviceReset ExSweepHandleTable ExTryAcquireAutoExpandPushLockExclusive ExTryAcquireCacheAwarePushLockExclusiveEx ExUninitializeDeviceAts ExUnregisterExtension ExUuidCreate ExWakeTimersResume ExpAllocateHandleTableEntry ExpDeleteTimer ExpFreeHandleTableEntry ExpGetGlobalLocaleSection ExpGetSystemPlatformBinary ExpInsertLowLevelTableIntoFreeList ExpKdPullRemoteFileForUser ExpLoadAndSortLicensingCacheDescriptors ExpLoadAndSortLicensingCacheDescriptors$fin$1 ExpQueryBootLoaderMetadata ExpReadLeapSecondData ExpReleaseFannedOutPushLockExclusive ExpRemoveHandleTable ExpSaAllocatorAllocate ExpSaAllocatorFree ExpSaPageGroupAllocateMemory ExpSaPageGroupDescriptorAllocate ExpSaPageGroupDescriptorFree ExpSaPageGroupFreeMemory ExpSetBootLoaderMetadata ExpSetKernelDataProtection$fin$0 ExpSetTimerObject ExpShareAddressSpaceWithDevice ExpSvmDereferenceDevice ExpTryAcquireFannedOutPushLockExclusive ExpWnfAcquirePermanentDataStoreHandle ExpWnfAllocateNextPersistentNameSequence ExpWnfCompleteThreadSubscriptions ExpWnfCreateNameInstance ExpWnfCreateProcessContext ExpWnfDeleteNameInstance ExpWnfDeleteProcessContext ExpWnfDeleteScopeById ExpWnfDeleteScopeInstances ExpWnfDeleteStateData ExpWnfDeleteSubscription ExpWnfDeliverThreadNotifications ExpWnfDestroyPermanentDataStore ExpWnfDispatchKernelSubscription ExpWnfGetPermanentDataStore ExpWnfInsertSubscriptionInPendingQueue ExpWnfInvalidateDataStores ExpWnfResolveScopeInstance ExpWnfSubscribeNameInstance ExpWnfUpdateSubscription ExpWnfWriteStateData ExpWnfWriteStateData$fin$0 FUN_1409fa0b0 FlushLookUpTableBucket HalpDmaAllocateChildAdapterV3 HalpIommuBlockDevice HalpIommuCreateDevice HalpIommuDeleteDevice HalpIommuInvokeInterfaceStateChangeCallbacks HalpIommuUnblockDevice HalpLeaveDmaDomain HvFoldBackDirtyData HvFreeCell HvHiveConvertLockedPagesToCowByPolicy HvIsRangeDirty HvlQuerySetBootPagesInfo HvpDoAllocateCell HvpMarkCellDirty IoRegisterIoTracking IoUnregisterIoTracking IommuBeginDeviceReset IommuDeviceDelete IommuFinalizeDeviceReset IommuRegisterInterfaceStateChangeCallback IommuUnregisterInterfaceStateChangeCallback IommupDeviceDisableSvm IommupDeviceGetPasidDevice IommupFreeSystemContext IommupGetSystemContext IommupHvAttachPasidDevice IommupHvAttachPasidDeviceDomain IommupHvCreateSvmPasidSpace IommupHvDetachPasidDeviceDomain IommupPasidDeviceCreate IommupPasidDeviceDelete KeCleanupImageTracepoints KeGenericCallDpcEx KeSetSystemServiceCallback KeSetTracepoint KeUpdateDpcWatchdogConfiguration KiGenericCallDpcInitiatorWorker KiShouldLogUserModeReturnMismatch KiStartSavingSupervisorState KiTpIsExcludedKernelTracepointLocation KseAddHardwareId KseDriverUnloadImage KseLookupHardwareId KseQueryDeviceDataList KseRegisterShimEx KseResetDeviceCache KseShimDatabaseBootRelease KseShimDatabaseClose KseShimDatabaseOpen KseUnregisterShim KsepDbCacheInsertDevice KsepDbCacheQueryDevice KsepGetShimsForDriver KsepIsModuleShimmed KsepResolveApplicableShimsForDriver KsepShimDbChanged MI_UNLOCK_RELOCATIONS_EXCLUSIVE MiAddSpecialPurposeMemoryCleanup MiAddSpecialPurposeMemoryComplete MiAddSpecialPurposeMemoryPrepare MiAddViewsForSection MiAllocatePartitionId MiApplyImageHotPatchRequest MiCaptureRetpolineImportInfo MiChargeSegmentCommit MiCoalescePlaceholderAllocations MiCommitExistingVad MiCommitPageTableRangesForVad MiContractWsSwapPageFileWorker MiCopyLargeVad MiCreateFileOnlyImageFixupList MiCreateHardwareEnclave MiCreatePagingFile MiCreatePagingFileMap MiCreatePerSessionProtos MiCreatePrototypePtes MiDecommitHardwareEnclavePages MiDeleteAllHardwareEnclaves MiDeleteEmptyPageTables MiDeleteEnclavePages MiDeleteHotPatchEntry MiDeleteHotPatchRecord MiDeletePartitionResources MiDeleteVad MiDereferenceExtendInfo MiDereferencePerSessionProtos MiFindSpecialPurposeMemoryTypeByPartition MiFinishCreateSection MiFinishResume MiFinishVadDeletion MiFreePartitionId MiFreeRetpolineImportInfo MiFreeSessionId MiFreeUnusedPfnPages MiGetChannelInformation MiGetNewSessionId MiGetPartitionNodeInformation MiInitializeMirroring MiInitializePagedPoolEvents MiInitializePartialVad MiInitializePartition MiInitializePartitionSpecialPurposeMemory MiInitializeSessionGlobals MiInsertChildVads MiInsertHotPatchRecord MiInsertInSystemSpace MiInsertPageFileInList MiInsertSharedCommitNode MiInsertVad MiLateInitializeSystemCache MiLoadHotPatchForUserSid MiLockVadRange MiMakeDriverPagesPrivate MiManageSubsectionView MiMapViewOfDataSection MiMarkHugePfnBad MiMarkSharedImageCfgBits MiObtainRelocationBits MiPerformVadSplitting MiPersistMdl MiPopulateCfgBitMap MiReleaseKernelCfgLock MiRemoveFromSystemSpace MiRemoveSharedCommitNode MiRemoveVad MiReserveUserMemory MiReturnImageBase MiSectionDelete MiSelectOverflowDllBase MiSelectRelocationStartHint MiSendParkedCoreUpdateToAllChildPartitions MiSetPagesModified MiSetProtectionOnSection MiSetVadDeleted MiShutdownSystem MiSpecialPurposeMemoryRemoved MiSplitPrivatePage MiSplitReducedCommitClonePage MiTransferFileExtent MiTrimUnusedPageFileRegionsWorker MiUnloadHotPatchForUserSid MiUnlockAndDereferenceVad MiUnlockDriverMappings MiUnlockDynamicMemoryExclusive MiUnlockDynamicMemoryNestedExclusive MiUnlockFileExtentsExclusive MiUnlockLoaderEntry MiUnlockNestedVad MiUnlockPartitionSystemThreads MiUnlockVad MiUnlockVadRange MiUpControlAreaRefs MiUpdateSpecialPurposeMemoryCacheEligibility MiZeroAllPageFiles MmCommitSessionMappedView MmCreateShadowMapping MmDecodeExportSection MmDeleteShadowMapping MmDuplicateMemory MmEncodeExportSection MmEnumerateBadPages MmExtendSection MmGetPageFileForCrashDump MmLinkJobProcess MmOutSwapVirtualAddresses MmOutSwapWorkingSet MmReleaseLoadLock MmResourcesAvailable NormalizationList__Unlock NtAllocateUuids NtAlpcRevokeSecurityContext NtAlpcSetInformation NtCancelTimer NtChangeProcessState NtChangeThreadState NtCreateUserProcess NtNotifyChangeMultipleKeys NtReleaseKeyedEvent NtSetInformationThread NtSetInformationThread$fin$1 NtSetSystemInformation NtSetUuidSeed NtTerminateProcess NtWaitForKeyedEvent ObCheckRefTraceProcess ObClearProcessDeviceMap ObDereferenceDeviceMap ObDereferenceSecurityDescriptor ObDisableEtwReferenceTrace ObDuplicateObject ObEnableEtwReferenceTrace ObQueryRefTraceInformation ObReleaseObjectSecurity ObpCloseHandle ObpCreateHandle ObpCreateSymbolicLinkName ObpDeleteSymbolicLinkName ObpDeregisterObject ObpFreeWorkItemBlock ObpLookupObjectName ObpPushRefDerefInfo ObpRegisterObject ObpSetCurrentProcessDeviceMap ObpSetDeviceMap ObpStartRuntimeStackTrace ObpStopRuntimeStackTrace Ordinal_20 PerfDiagpProxyWorker PfFileInfoNotify PfGenerateTrace PfProcessExitNotification PfSetSuperfetchInformation PfSnSetAltPrefetchParam PfTAccessTracingCleanup PfTAccessTracingStart PfTSetTraceWorkerPriority PfTSetTracingPriority PfpParametersPropagate PfpParametersWatcher PfpPrefetchSharedCleanup PfpPrefetchSharedStart PfpRpCHashAddEntries PfpRpCHashDeleteEntries PfpRpCHashEmpty PfpRpCHashGrow PfpRpFileKeyUpdate PfpRpShutdown PfpScenCtxPrefetchAbortSet PfpScenCtxPrefetchStateSet PfpScenCtxPrefetchWait PfpScenCtxQueryScenarioInformation PfpScenCtxScenarioSet PfpScenCtxServiceThreadSet PoFxAbandonDevice PopBlackBoxDirectAccess PopBlackBoxUpdate PopBootStatCheckIntegrity PopBootStatGet PopBootStatRestoreDefaults PopBootStatSet PopBootStatUnlock PopDirectedDripsDiagBroadcastTreeBegin PopDirectedDripsDiagBroadcastTreeEnd PopDirectedDripsDiagNotifySessionStart PopDirectedDripsDiagNotifySessionStop PopDirectedDripsDiagTraceBroadcastFailureDevice PopDirectedDripsDiagTraceBroadcastVisit PopDirectedDripsDiagTraceMarkDevice PopDirectedDripsDiagTraceNotifyDevices PopDirectedDripsDiagTraceProblemDevice PopDirectedDripsHandleResiliencyNotification PopDirectedDripsIdleResiliencyCallback PopDirectedDripsNotify PopDirectedDripsNotifyResiliencyCompletionWorker PopFxBuildDirectedDripsCandidateDeviceList PopFxBuildDripsBlockingDeviceList PopFxClearDirectedDripsCandidateDeviceList PopFxInsertAcpiDevice PopFxInsertDevice PopFxNotifySxTransitionState PopFxPrepareDevicesForShutdown PopFxRegisterPluginEx PopFxRemoveAcpiDevice PopFxRemoveDevice PopFxUpdateVetoMaskWork PopPdcCsDeviceNotification PopPepInsertDevice PopPepRemoveDevice PopPowerButtonBugcheckConfigure PsAdjustBasicEnclaveThreadList PsCallEnclave PsCreateVsmEnclave PsDeleteVsmEnclave PsDisableImpersonation PsFreezeProcess PsGetProcessEnclaveModuleInfo PsImpersonateClient PsInitializeVsmEnclave PsIsVsmEnclaveTerminated PsLoadVsmEnclaveData PsRestoreImpersonation PsSetProcessFaultInformation PsSetProcessTelemetryAppState PsSetProcessWin32Process PsStartSiloMonitor PsSwapImpersonationToken PsTerminateMinimalProcess PsTerminateVsmEnclave PsThawMultiProcess PsUnregisterSiloMonitor PsUpdateActiveProcessAffinity PspAllocateAndQueryProcessNotificationChannel PspAllocateThread PspApplyWorkingSetLimits PspApplyWorkingSetLimitsToProcess PspAssignProcessToJob PspAttachProcessToSyscallProvider PspChangeJobMemoryUsageByProcess PspCreatePicoProcess PspDestroySyscallProvider PspDetachProcessFromSyscallProvider PspEnableProcessOptionalXStateFeatures PspExitThread PspInsertProcess PspInsertSyscallProvider PspInsertThread PspProcessClose PspProcessDynamicEHContinuationTargets PspProcessDynamicEnforcedAddressRanges PspRemoveEnclaveThreadWait PspRundownSingleProcess PspSetJobIoRateControl PspSetProcessDefaultHardErrorMode PspSetProcessForegroundBackgroundRequest PspSetQuotaLimits PspStorageAllocSlot PspStorageEmptyArray PspStorageEmptyArrayNonReadonly PspStorageFreeSlot PspStorageInsertObject PspStorageMakeSlotReadOnly PspStorageRemoveObject PspStorageReplaceObject PspSyscallProviderOptIn PspTeardownPartition PspTerminateProcess PspThreadDelete PspUnlockJobAssignment PspUnlockJobListExclusive PspUnlockJobMemoryLimitsExclusive PspUnlockJobsAndProcessExclusive PspUnlockProcessExclusive PspUnlockProcessListExclusive PspUnlockQuotaExpansion PspUnlockQuotaListExclusive RtlDeleteAtomFromAtomTable RtlDestroyAtomTable RtlEmptyAtomTable RtlInsertDynamicFunctionTable RtlLockBootStatusData RtlLookupAtomInAtomTable RtlPinAtomInAtomTable RtlQueryAtomInAtomTable RtlQueryAtomsInAtomTable RtlRemoveDynamicFunctionTable RtlUnlockBootStatusData RtlpCSparseBitmapUnlock RtlpFlsAlloc RtlpFlsDataCleanup RtlpFlsFree RtlpFlsSetValueSlot RtlpHpAcquireReleaseLockExclusive RtlpHpCustomVaCallbacksRegistrarRegister RtlpHpCustomVaCallbacksRegistrarUnregister RtlpHpFixedVsAllocate RtlpHpFixedVsFree RtlpHpHeapExtendContext RtlpHpLargeAlloc RtlpHpLargeFree RtlpHpLfhBucketAddSubsegment RtlpHpLfhBucketGetSubsegment RtlpHpLfhBucketUpdateAffinityMapping RtlpHpLfhSlotAllocate RtlpHpLfhSubsegmentDecommitPages RtlpHpLfhSubsegmentFreeBlock RtlpHpLfhSubsegmentIncBlockCounts RtlpHpReleaseQueuedLockExclusive RtlpHpSegContextCompact RtlpHpSegMgrCommitComplete RtlpHpSegMgrCommitInitiate RtlpHpSegMgrVaCtxAlloc RtlpHpSegMgrVaCtxFree RtlpHpSegMgrVaCtxInsert RtlpHpSegPageRangeAllocate RtlpHpSegPageRangeCoalesce RtlpHpSegPageRangeShrink RtlpHpVaMgrAlloc RtlpHpVaMgrCtxFree RtlpHpVsChunkSplit RtlpHpVsSubsegmentCommitPages RtlpUnlockAtomTable SLGetSubscriptionPfn SLGetSubscriptionPfn$fin$0 SLQueryLicenseValueInternal SLUpdateLicenseDataInternal SMKM_STORE<SM_TRAITS>::SmStCleanup SMKM_STORE<SM_TRAITS>::SmStWorker SMKM_STORE<struct_SM_TRAITS>::SmStHelperSendCommand SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEmpty SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys SSHSupportReleasePushLockExclusive ST_STORE<struct_SM_TRAITS>::StDmPageRemove ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd SeDefaultObjectMethod SeRegisterObjectTypeMandatoryPolicy SendCaptureStateNotificationsWorker SepAddLuidToIndexEntry SepAppendAceToTokenObjectAcl SepDeReferenceSharedSidEntries SepDeleteSessionLowboxEntries SepDereferenceCachedHandlesEntry SepDereferenceLowBoxNumberEntry SepInsertOrReferenceSharedSidEntries SepIsParentOfChildAppContainer SepRmCapUpdateWrkr SepSetTokenCachedHandles SepSetTokenClaims SepSetTokenLowboxNumber SepSetTokenUserAndGroups SmCreatePartition SmDeletePartition SmFirstTimeInit SmGetRegistrationInfo SmKmKeyGenKeyDelete SmKmKeyGenNewKey SmKmStoreAdd SmKmStoreDelete SmKmVirtualLockContextIncreaseWsMin SmKmVirtualLockCtxMemoryUnlocked SmPartitionJobPaired SmProcessCompressionInfoRequest SmcCacheAdd SmcCacheCreatePrepare SmcCacheRemove SmcStoreDelete SmcStoreResize SmcStoreSlotAbort SmcStoreSlotCommit SmcStoreSlotReserve SmpKeyedStoreEntryGet SmpKeyedStoreSetVaRanges SmpSystemStoreCreate SshpSetCollectionActive TlgAggregateInternalProviderCallback TlgRegisterAggregateProviderEx UNLOCK_ADDRESS_SPACE_UNORDERED UNLOCK_PAGE_TABLE_COMMITMENT VmCreateMemoryRange VmDeleteMemoryRange VmMergeMemoryRanges VmSplitMemoryRange VmpCleanProcessAddressSpace VmpPauseResumeNotify VrpDecrementSiloCount VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlLoadDifferencingHive VrpHandleIoctlLoadDifferencingHiveForHost VrpHandleIoctlModifyFlags VrpHandleIoctlUnloadDifferencingHiveForHost VrpHandleIoctlUnloadDynamicallyLoadedHives VrpIncrementSiloCount VrpLoadDifferencingHive VrpPostUnloadKey VrpPreLoadKey VrpPreUnloadKey VrpUnloadDifferencingHive VrpWaitForDiffHiveEntryTransitionOwnerToLeave VslpLockPagesForTransfer VslpUnlockPagesForTransfer WbAddHeapExecutedBlockToCache WbAddHeapExecutedBlockToLRU WbAddWarbirdEncryptionSegment WbAllocateSlots WbAllocateUserMemory WbDecryptEncryptionSegment WbFreeMemoryBlockRegion WbGetInitializedEncryptionSegment WbGetWarbirdProcess WbGetWarbirdThread WbHeapExecutionUnloadModule WbInPlaceEncryptionUnloadModule WbMoveHeapExecutedBlockToBackOfLRU WbReEncryptEncryptionSegment WbRemoveWarbirdProcess WheaConfigureErrorSource WheaExecuteRowFailureCheck WheaInitialize WheaRegisterErrorSourceOverride WheaRegisterInUsePageOfflineNotification WheaSelLogCheckPoint WheaSelLogSetNtSchedulerAvailability WheaUnconfigureErrorSource WheaUnregisterErrorSourceOverride WheaUnregisterInUsePageOfflineNotification WheapCallInUsePageNotificationCallbacks WheapPfaReset WheapPredictiveFailureAnalysis
paramcount
0
0
address
140302c50
140302c40
sig
undefined ExfTryToWakePushLock(void)
undefined ExfTryToWakePushLock(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
ExfTryToWakePushLock Calling Diff
--- ExfTryToWakePushLock calling
+++ ExfTryToWakePushLock calling
@@ -229 +229 @@
- FUN_1409fa120
+ FUN_1409fa0b0
@@ -683 +682,0 @@
- VrpHandleIoctlInitializeJobForVreg
XpressBuildHuffmanDecodingTable
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
length,sig,address
ratio
0.3
i_ratio
0.67
m_ratio
0.75
b_ratio
0.7
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
XpressBuildHuffmanDecodingTable
XpressBuildHuffmanDecodingTable
fullname
XpressBuildHuffmanDecodingTable
XpressBuildHuffmanDecodingTable
refcount
4
4
length
815
1189
called
calling
RtlDecompressBufferXpressHuff RtlDecompressBufferXpressHuffProgress
RtlDecompressBufferXpressHuff RtlDecompressBufferXpressHuffProgress
paramcount
5
0
address
1402a8270
1402a8010
sig
undefined XpressBuildHuffmanDecodingTable(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5)
undefined XpressBuildHuffmanDecodingTable(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,calling
ratio
1.0
i_ratio
1.0
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
SeCaptureSubjectContext
SeCaptureSubjectContext
fullname
SeCaptureSubjectContext
SeCaptureSubjectContext
refcount
82
83
length
36
36
called
SeCaptureSubjectContextEx
SeCaptureSubjectContextEx
calling
Expand for full list: CmFcInitSystem2 CmUpdateFeatureConfiguration CmUpdateFeatureUsageSubscription CmpCheckHivePrimaryFileReadWriteAccess CmpLogHiveFileInaccessible CmpNotifyChangeKey CmpSetKeySecurity EtwpAccessCheck EtwpCoverageUserIsAdmin EtwpFindOrCreateGuidEntry ExIsRestrictedCaller ExpWnfCheckCallerAccess FUN_140687e40 IoCheckRedirectionTrustLevel IoComputeRedirectionTrustLevel IoGetDeviceInterfaceAlias IopGetDeviceInterfaces NtCloseObjectAuditAlarm NtDeleteKey NtDeleteObjectAuditAlarm NtDeleteValueKey NtImpersonateAnonymousToken NtOpenObjectAuditAlarm NtPrivilegeObjectAuditAlarm NtPrivilegedServiceAuditAlarm NtRenameKey NtSetInformationKey NtSetUuidSeed NtSetValueKey ObpGetIntegrityLevel PiAuCheckTokenMembership PiAuDoesClientHavePrivilege PiAuVerifyAccessToObject PiCMGetDeviceIdList PiCMValidateDeviceInstance PiDqOpenUserObjectRegKey PiDqQueryCreate PiPnpRtlObjectEventWorker PiUEventHandleRegistration PnpGetCallerSessionId PopBootStatAccessCheck PspIsContextAdmin PspIumVerifyParentSd PspSinglePrivCheck RtlCheckTokenCapability RtlCheckTokenMembershipEx RtlIsSandboxedToken SeAccessCheckByType SeAdtRegistryValueChangedAuditAlarm SeAuditBootConfiguration SeAuditFipsCryptoSelftests SeAuditHandleDuplication SeAuditHardLinkCreationWithTransaction SeAuditPlugAndPlay SeAuditProcessCreation SeAuditSystemTimeChange SeAuditTransactionStateChange SeAuditingWithTokenForSubcategory SeCheckPrivilegedObject SeCloseObjectAuditAlarm SeDeleteObjectAuditAlarmWithTransaction SeIsAppContainerOrIdentifyLevelContext SeOpenObjectAuditAlarmWithTransaction SeOperationAuditAlarm SeReportSecurityEventWithSubCategory SeSecurityDescriptorChangedAuditAlarm SeTokenDefaultDaclChangedAuditAlarm SepAccessCheckAndAuditAlarm SepAdtAuditThisEventByCategoryWithContext SepAdtAuditThisEventWithContext SepAdtTokenRightAdjusted SepAuditAssignPrimaryToken SepCheckCreateLowBox SepFilterToken WdipAccessCheck WmipInitializeSecurity
Expand for full list: CmFcInitSystem2 CmSetValueKey CmUpdateFeatureConfiguration CmUpdateFeatureUsageSubscription CmpCheckHivePrimaryFileReadWriteAccess CmpLogHiveFileInaccessible CmpNotifyChangeKey CmpSetKeySecurity EtwpAccessCheck EtwpCoverageUserIsAdmin EtwpFindOrCreateGuidEntry ExIsRestrictedCaller ExpWnfCheckCallerAccess FUN_140687e40 IoCheckRedirectionTrustLevel IoComputeRedirectionTrustLevel IoGetDeviceInterfaceAlias IopGetDeviceInterfaces NtCloseObjectAuditAlarm NtDeleteKey NtDeleteObjectAuditAlarm NtDeleteValueKey NtImpersonateAnonymousToken NtOpenObjectAuditAlarm NtPrivilegeObjectAuditAlarm NtPrivilegedServiceAuditAlarm NtRenameKey NtSetInformationKey NtSetUuidSeed NtSetValueKey ObpGetIntegrityLevel PiAuCheckTokenMembership PiAuDoesClientHavePrivilege PiAuVerifyAccessToObject PiCMGetDeviceIdList PiCMValidateDeviceInstance PiDqOpenUserObjectRegKey PiDqQueryCreate PiPnpRtlObjectEventWorker PiUEventHandleRegistration PnpGetCallerSessionId PopBootStatAccessCheck PspIsContextAdmin PspIumVerifyParentSd PspSinglePrivCheck RtlCheckTokenCapability RtlCheckTokenMembershipEx RtlIsSandboxedToken SeAccessCheckByType SeAdtRegistryValueChangedAuditAlarm SeAuditBootConfiguration SeAuditFipsCryptoSelftests SeAuditHandleDuplication SeAuditHardLinkCreationWithTransaction SeAuditPlugAndPlay SeAuditProcessCreation SeAuditSystemTimeChange SeAuditTransactionStateChange SeAuditingWithTokenForSubcategory SeCheckPrivilegedObject SeCloseObjectAuditAlarm SeDeleteObjectAuditAlarmWithTransaction SeIsAppContainerOrIdentifyLevelContext SeOpenObjectAuditAlarmWithTransaction SeOperationAuditAlarm SeReportSecurityEventWithSubCategory SeSecurityDescriptorChangedAuditAlarm SeTokenDefaultDaclChangedAuditAlarm SepAccessCheckAndAuditAlarm SepAdtAuditThisEventByCategoryWithContext SepAdtAuditThisEventWithContext SepAdtTokenRightAdjusted SepAuditAssignPrimaryToken SepCheckCreateLowBox SepFilterToken WdipAccessCheck WmipInitializeSecurity
paramcount
0
0
address
1406adc60
1406adc60
sig
undefined SeCaptureSubjectContext(void)
undefined SeCaptureSubjectContext(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
SeCaptureSubjectContext Calling Diff
--- SeCaptureSubjectContext calling
+++ SeCaptureSubjectContext calling
@@ -1,0 +2 @@
+ CmSetValueKey
RtlQueryFeatureConfiguration
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.97
i_ratio
0.73
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
RtlQueryFeatureConfiguration
RtlQueryFeatureConfiguration
fullname
RtlQueryFeatureConfiguration
RtlQueryFeatureConfiguration
refcount
8
9
length
221
221
called
KeGetEffectiveIrql RtlpFcBufferManagerDereferenceBuffers RtlpFcBufferManagerReferenceBuffers RtlpFcGetBufferManager RtlpFcQueryFeatureConfigurationFromBufferSet
KeGetEffectiveIrql RtlpFcBufferManagerDereferenceBuffers RtlpFcBufferManagerReferenceBuffers RtlpFcGetBufferManager RtlpFcQueryFeatureConfigurationFromBufferSet
calling
CmQuerySingleFeatureConfiguration wil_RtlStagingConfig_QueryFeatureState wil_details_OnFeatureConfigurationChange
CmQuerySingleFeatureConfiguration wil_RtlStagingConfig_QueryFeatureState wil_RtlStagingConfig_QueryFeatureState wil_details_OnFeatureConfigurationChange
paramcount
0
0
address
1402e7a80
1402e7820
sig
undefined RtlQueryFeatureConfiguration(void)
undefined RtlQueryFeatureConfiguration(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
RtlQueryFeatureConfiguration Calling Diff
--- RtlQueryFeatureConfiguration calling
+++ RtlQueryFeatureConfiguration calling
@@ -2,0 +3 @@
+ wil_RtlStagingConfig_QueryFeatureState
CmFcManagerNotifyFeatureUsage
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.76
i_ratio
0.61
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
CmFcManagerNotifyFeatureUsage
CmFcManagerNotifyFeatureUsage
fullname
CmFcManagerNotifyFeatureUsage
CmFcManagerNotifyFeatureUsage
refcount
3
4
length
232
232
called
CmpWorkItemQueueWork KeGetEffectiveIrql KeLeaveCriticalRegion KiInsertQueueDpc RtlAcquireSwapReference RtlReleaseSwapReference RtlpFcAddDelayedUsageReportToBuffer
CmpWorkItemQueueWork KeGetEffectiveIrql KeLeaveCriticalRegion KiInsertQueueDpc RtlAcquireSwapReference RtlReleaseSwapReference RtlpFcAddDelayedUsageReportToBuffer
calling
RtlNotifyFeatureUsage wil_details_FeatureReporting_ReportUsageToService
RtlNotifyFeatureUsage wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToServiceDirect
paramcount
0
0
address
140615470
140615570
sig
undefined CmFcManagerNotifyFeatureUsage(void)
undefined CmFcManagerNotifyFeatureUsage(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
CmFcManagerNotifyFeatureUsage Calling Diff
--- CmFcManagerNotifyFeatureUsage calling
+++ CmFcManagerNotifyFeatureUsage calling
@@ -2,0 +3 @@
+ wil_details_FeatureReporting_ReportUsageToServiceDirect
KiInitializeKernel$filt$0
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address
ratio
1.0
i_ratio
0.9
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
KiInitializeKernel$filt$0
KiInitializeKernel$filt$0
fullname
KiInitializeKernel$filt$0
KiInitializeKernel$filt$0
refcount
2
1
length
29
29
called
KiFatalFilter
KiFatalFilter
calling
paramcount
0
0
address
140a93246
140a93242
sig
undefined KiInitializeKernel$filt$0(void)
undefined KiInitializeKernel$filt$0(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,calling
ratio
0.98
i_ratio
0.92
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
MmUnlockPages
MmUnlockPages
fullname
MmUnlockPages
MmUnlockPages
refcount
74
77
length
2008
2008
called
Expand for full list: KeBugCheckEx KeShouldYieldProcessor KeYieldProcessorEx KiRemoveSystemWorkPriorityKick MiDereferenceIoPages MiFreeMdlTracker MiPfnShareCountIsZero MiProbeUnlockPage MiRetardMdl MiReturnCommit MmUnmapLockedPages
Expand for full list: KeBugCheckEx KeShouldYieldProcessor KeYieldProcessorEx KiRemoveSystemWorkPriorityKick MiDereferenceIoPages MiFreeMdlTracker MiPfnShareCountIsZero MiProbeUnlockPage MiRetardMdl MiReturnCommit MmUnmapLockedPages
calling
Expand for full list: AlpcpFreeCompletionList AlpcpInitializeCompletionList CcCopyBytesToUserBuffer CcLockSystemCacheBuffer CcMapAndCopyInToCache CcMdlRead$fin$0 CcMdlReadComplete2 CcMdlWriteAbort CcMdlWriteComplete2 CcPrepareMdlWrite$fin$0 CcZeroDataInCache CmpLockKeyBodyIntoMemory CmpUnlockKeyBodyFromMemory ExUnlockUserBuffer ExpGetLookasideInformation ExpProfileDelete FUN_14070752c FUN_140a4ecb0 FUN_140b1a730 FsRtlpFreeMdlChain IopCleanupFileObjectIosbRange IopSetFileObjectIosbRange IopUnlockAndFreeMdl IopfCompleteRequest KiOpPatchCode MiAllocatePerSessionProtos MiApplyImageHotPatch MiCopyPagesIntoEnclave MiCopyVirtualMemory MiGetWorkingSetInfo MiGetWorkingSetInfoList MiLoadDataIntoVsmEnclave MiProbeAndLockComplete MiQueryMemoryPhysicalContiguity MiReleaseHotPatchResources MiReplaceRotateWithDemandZero MiRotateToFrameBuffer NT_DISK::Read NT_DISK::Write NtPssCaptureVaSpaceBulk NtStartProfile NtStopProfile PopReadPagesFromHiberFile PsDispatchIumService PspCreateSecureThread PspExitThread PspGetSetContextInternal PspIumAllocatePartitionState PspIumFreePartitionState SmPrepareForFatalPageError SmProcessStatsRequest VmProbeAndLockPages VmUnlockPages VslCallEnclave VslFinalizeSecureImageHash VslObtainHotPatchUndoTable VslValidateDynamicCodePages VslpLockPagesForTransfer VslpUnlockPagesForTransfer WbMakeUserExecutablePagesKernelWritable
Expand for full list: AlpcpFreeCompletionList AlpcpInitializeCompletionList CcCopyBytesToUserBuffer CcLockSystemCacheBuffer CcMapAndCopyInToCache CcMdlRead$fin$0 CcMdlReadComplete2 CcMdlWriteAbort CcMdlWriteComplete2 CcPrepareMdlWrite$fin$0 CcZeroDataInCache CmpLockKeyBodyIntoMemory CmpUnlockKeyBodyFromMemory ExUnlockUserBuffer ExpGetLookasideInformation ExpProfileDelete FUN_140707cbc FUN_14070897c FUN_140a4ec40 FUN_140b1a730 FsRtlpFreeMdlChain IopCleanupFileObjectIosbRange IopSetFileObjectIosbRange IopUnlockAndFreeMdl IopfCompleteRequest KiOpPatchCode MiAllocatePerSessionProtos MiApplyImageHotPatch MiCopyPagesIntoEnclave MiCopyVirtualMemory MiGetWorkingSetInfo MiGetWorkingSetInfoList MiLoadDataIntoVsmEnclave MiProbeAndLockComplete MiQueryMemoryPhysicalContiguity MiReleaseHotPatchResources MiReplaceRotateWithDemandZero MiRotateToFrameBuffer NT_DISK::Read NT_DISK::Write NtPssCaptureVaSpaceBulk NtStartProfile NtStopProfile PopReadPagesFromHiberFile PsDispatchIumService PspCreateSecureThread PspExitThread PspGetSetContextInternal PspIumAllocatePartitionState PspIumFreePartitionState SmPrepareForFatalPageError SmProcessStatsRequest VmProbeAndLockPages VmUnlockPages VslCallEnclave VslFinalizeSecureImageHash VslObtainHotPatchUndoTable VslValidateDynamicCodePages VslpLockPagesForTransfer VslpUnlockPagesForTransfer WbMakeUserExecutablePagesKernelWritable
paramcount
0
0
address
140233fa0
140233fa0
sig
undefined MmUnlockPages(void)
undefined MmUnlockPages(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
MmUnlockPages Calling Diff
--- MmUnlockPages calling
+++ MmUnlockPages calling
@@ -17,2 +17,3 @@
- FUN_14070752c
- FUN_140a4ecb0
+ FUN_140707cbc
+ FUN_14070897c
+ FUN_140a4ec40
HvpGetBinContextInitialize
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,calling
ratio
1.0
i_ratio
1.0
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
HvpGetBinContextInitialize
HvpGetBinContextInitialize
fullname
HvpGetBinContextInitialize
HvpGetBinContextInitialize
refcount
36
38
length
6
6
called
calling
Expand for full list: CmEnumerateValueFromLayeredKey CmRenameKey CmpCheckLeaf CmpCheckValueList CmpReferenceSecurityNode HvCheckAndUpdateHiveBackupTimeStamp HvCheckHive HvFreeCell HvIsCellAllocated HvWriteExternal HvpAddFreeCellHint HvpCopyModifiedData HvpDropPagedBins HvpFindFreeCell HvpFindNextDirtyBlock HvpGetCellContextMove HvpGetCellContextReinitialize HvpReleaseCellFlat HvpRemapAndEnlistHiveBins HvpRemoveFreeCellHint HvpSetRangeProtection
Expand for full list: CmEnumerateValueFromLayeredKey CmRenameKey CmSetValueKey CmpCheckLeaf CmpCheckValueList CmpReferenceSecurityNode HvCheckAndUpdateHiveBackupTimeStamp HvCheckHive HvFreeCell HvIsCellAllocated HvWriteExternal HvpAddFreeCellHint HvpCopyModifiedData HvpDropPagedBins HvpFindFreeCell HvpFindNextDirtyBlock HvpGetCellContextMove HvpGetCellContextReinitialize HvpReleaseCellFlat HvpRemapAndEnlistHiveBins HvpRemoveFreeCellHint HvpSetRangeProtection
paramcount
0
0
address
140af6454
140af6454
sig
undefined HvpGetBinContextInitialize(void)
undefined HvpGetBinContextInitialize(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
HvpGetBinContextInitialize Calling Diff
--- HvpGetBinContextInitialize calling
+++ HvpGetBinContextInitialize calling
@@ -2,0 +3 @@
+ CmSetValueKey
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.95
i_ratio
0.81
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
KeAbPreAcquire
KeAbPreAcquire
fullname
KeAbPreAcquire
KeAbPreAcquire
refcount
474
473
length
335
335
called
KiAbEntryFreeAndEnableInterrupts KiAbThreadRemoveBoostsSlow KiAbTryReclaimOrphanedEntries KiRemoveSystemWorkPriorityKick MmGetSessionIdEx
KiAbEntryFreeAndEnableInterrupts KiAbThreadRemoveBoostsSlow KiAbTryReclaimOrphanedEntries KiRemoveSystemWorkPriorityKick MmGetSessionIdEx
calling
Expand for full list: AlpcpReceiveMessagePort AlpcpTryLockForCachedReferenceBlob BuildQueryDirectoryIrp CmDeleteKey CmDeleteValueKey CmEnumerateKey CmFcManagerDrainAllFeatureUsageNotifications CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerQueryFeatureConfigurationSectionInformation CmFcManagerRegisterFeatureConfigurationChangeNotification CmFcManagerUnregisterFeatureConfigurationChangeNotification CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpManagerDrainUsageNotificationsWorker CmFcpManagerPublishChangeNotifications CmFcpManagerRetryUsageNotificationsWorker CmFcpManagerSoftwareHiveReady CmFreezeRegistry CmLockHive CmLockHiveSecurityExclusive CmLockHiveSecurityShared CmQueryMultipleValueKey CmRegisterMachineHiveLoadedNotification CmRestoreKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmSiRWLockAcquireExclusive CmThawRegistry CmUnregisterMachineHiveLoadedNotification CmpAcquireWriteQueue CmpAssignKeySecurity CmpCallCallBacksEx CmpCloseKeyObject CmpCopyMergeOfLayeredKeyNode CmpCreateChild CmpCreateHive CmpCreateHiveRootCell CmpCreateKeyControlBlock CmpDeleteHive CmpDeleteKeyObject CmpDereferenceNameControlBlockWithLock CmpDoParseKey CmpDoQueueLateUnloadWorker CmpDumpKeyToBuffer CmpFinishSystemHivesLoad CmpFlushHive CmpFlushNotify CmpFreeKeyByCell CmpGetKeyNodeForKcb CmpGetLastHive CmpGetNameControlBlock CmpGetNextActiveHive CmpGetNextHive CmpGlobalLockKeyForWrite CmpInitCmRM CmpLoadHiveThread CmpLoadHiveVolatile CmpLockAppHiveLoadList CmpLockCallbackListExclusive CmpLockCallbackListShared CmpLockContextListExclusive CmpLockContextListShared CmpLockDeletedHashEntryExclusiveByKcb CmpLockGlobalKeyLockTrackerExclusive CmpLockHashEntryByIndexExclusive CmpLockHashEntryExclusive CmpLockHashEntryExclusiveByKcb CmpLockHashEntryShared CmpLockHashEntrySharedByKcb CmpLockHiveListExclusive CmpLockKcbExclusive CmpLockKcbShared CmpLockRegistryFreezeAware CmpLockSiloKeyLockTrackerExclusive CmpLockSiloKeyLockTrackerShared CmpLockTwoSecurityCachesExclusiveShared CmpMarkEntireIndexDirty CmpPerformCompleteKcbCacheLookup CmpPromoteKey CmpRecoverFlushProtocolStateFromFiles CmpRefreshHive CmpReorganizeHive CmpReportNotifyHelper CmpSetKeySecurity CmpTransMgrCommitUoW CmpTransMgrPrepare CmpTransMgrSyncHive CmpTrimHive CmpTryToLockHashEntryExclusive CmpTryToLockKcbExclusive CmpUpdateHiveRootCellFlags CmpVEExecuteOpenLogic CmpVolumeContextDecrementRefCount CmpVolumeContextMustHiveFilePagesBeKeptLocal CmpVolumeContextSendDeviceUsageNotification CmpVolumeManagerGetContextForFile CmpWaitOnHiveWriteQueue CmpWalkOneLevel ExAcquireCacheAwarePushLockExclusive ExAcquireCacheAwarePushLockExclusiveEx ExAcquireFastResourceExclusive ExAcquireFastResourceExclusive2 ExAcquireFastResourceShared ExAcquireFastResourceShared2 ExAcquireFastResourceSharedStarveExclusive ExAcquireFastResourceSharedStarveExclusive2 ExAcquireFastResourceWithFlags ExInitializeFastResourceAcquired2 ExRegisterExtension ExRegisterHost ExTryAcquireAutoExpandPushLockExclusive ExTryAcquireAutoExpandPushLockShared ExTryAcquireCacheAwarePushLockExclusiveEx ExTryAcquireCacheAwarePushLockSharedEx ExTryToAcquireFastMutex ExUnregisterExtension ExUuidCreate ExfAcquirePushLockExclusiveEx ExfAcquirePushLockSharedEx ExfAcquireReleasePushLockExclusive ExpAcquireFastMutexContended ExpAcquireFastResourceExclusiveSlow ExpAcquireFastResourceSharedSlow ExpKdPullRemoteFileForUser ExpNtUpdateWnfStateData ExpWnfAcquirePermanentDataStoreHandle ExpWnfAcquireSubscriptionByName ExpWnfAcquireSubscriptionNameInstance ExpWnfAllocateNextPersistentNameSequence ExpWnfCompleteThreadSubscriptions ExpWnfCreateNameInstance ExpWnfCreateProcessContext ExpWnfDeleteNameInstance ExpWnfDeleteProcessContext ExpWnfDeleteScopeById ExpWnfDeleteScopeInstances ExpWnfDeleteStateData ExpWnfDeleteSubscription ExpWnfDeliverThreadNotifications ExpWnfDestroyPermanentDataStore ExpWnfDispatchKernelSubscription ExpWnfEnumerateScopeInstances ExpWnfGetPermanentDataStore ExpWnfInsertSubscriptionInPendingQueue ExpWnfInvalidateDataStores ExpWnfLookupNameInstance ExpWnfNotifyNameSubscribers ExpWnfNotifySubscription ExpWnfReadStateData ExpWnfResolveScopeInstance ExpWnfSubscribeNameInstance ExpWnfUpdateSubscription ExpWnfWriteStateData FUN_140707984 FsRtlAcquireHeaderMutex HvFoldBackDirtyData HvFreeCell HvHiveConvertLockedPagesToCowByPolicy HvIsRangeDirty HvLockHiveFlusherShared HvpDoAllocateCell HvpMarkCellDirty IoSetInformation IopCloseFile IopFlushBuffersFile IopGetSetSecurityObject IopQueryXxxInformation IopReadFile IopSetEaOrQuotaInformationFile IopValidateAndGetWriteParameters IopWaitAndAcquireFileObjectLock IopXxxControlFile KeAcquireGuardedMutex KeWaitForMultipleObjects KeWaitForMutexObject KiInitializeMutant KiSatisfyThreadWait KiWaitForAllObjects LOCK_HIVE_LOAD MiAcquireKernelCfgLock MiAddSpecialPurposeMemoryPrepare MiAllocatePartitionId MiApplyImageHotPatchRequest MiCaptureRetpolineImportInfo MiChangingSubsectionProtos MiChargeSegmentCommit MiCopyLargeVad MiCreateFileOnlyImageFixupList MiCreateHardwareEnclave MiCreatePagingFile MiCreatePagingFileMap MiCreatePerSessionProtos MiDeleteAllHardwareEnclaves MiDeleteEnclavePages MiDeleteExtentPfns MiDeleteHotPatchEntry MiDeleteHotPatchRecord MiDereferencePerSessionProtos MiFindHotPatchRecord MiFindProcessImageHotPatchRecord MiFindSpecialPurposeMemoryTypeByPartition MiFinishCreateSection MiFreePartitionId MiFreeRetpolineImportInfo MiFreeSessionId MiGetAllRegisteredPatches MiGetNewSessionId MiInitializeInPageSupport MiInitializePartialVad MiInitializePartition MiInitializePartitionSpecialPurposeMemory MiInitializeSessionGlobals MiInsertChildVads MiInsertHotPatchRecord MiInsertPageFileInList MiInsertSharedCommitNode MiIsExtentDangling MiIsRangeFullyCommitted MiLoadHotPatchForUserSid MiLockControlAreaSectionExtend MiLockFileExtentsExclusive MiLockNestedVad MiLockVadRange MiLogHotPatchRundown MiMapViewOfDataSection MiMarkSharedImageCfgBits MiObtainRelocationBits MiOpenSpecialPurposeMemory MiPopulateCfgBitMap MiPrefetchControlArea MiPrefetchVirtualMemory MiQueryLoadedPatches MiQueryProcessActivePatches MiQuerySpecialPurposeMemoryInformation MiRebuildLargePages MiReferenceControlArea MiRelocateImagePfn MiRemoveSharedCommitNode MiReserveUserMemory MiReturnImageBase MiSectionDelete MiSelectOverflowDllBase MiSelectRelocationStartHint MiShutdownSystem MiUnloadHotPatchForUserSid MiUnmapViewOfSection MiWaitForCollidedFaultComplete MiWaitForExtentDeletions MiZeroAllPageFiles MmAcquireLoadLock MmCommitSessionMappedView MmCreateShadowMapping MmDeleteShadowMapping MmDuplicateMemory MmEnumerateBadPages MmExtendSection MmGetPageFileForCrashDump MmLinkJobProcess MmPrefetchPagesEx NtAllocateUuids NtAreMappedFilesTheSame NtDeleteKey NtLockFile NtNotifyChangeDirectoryFileEx NtNotifyChangeMultipleKeys NtQueryEaFile NtQueryInformationFile NtQueryQuotaInformationFile NtQueryVolumeInformationFile NtReadFileScatter NtReleaseKeyedEvent NtSetEaFile NtSetInformationFile NtSetUuidSeed NtSetVolumeInformationFile NtUnlockFile NtWaitForKeyedEvent NtWriteFileGather ObpCloseHandle ObpDeleteNameCheck ObpLockUnrelatedDirectoryShared PdcAcquireRwLockExclusive PfpPrefetchSharedConflictNotifyEnd PfpPrefetchSharedConflictNotifyStart PfpPrefetchSharedStart TlgAggregateInternalProviderCallback TlgRegisterAggregateProviderEx VrpBecomeDiffHiveEntryTransitionOwner VrpDecrementSiloCount VrpDereferenceDiffHiveEntry VrpFindDiffHiveEntryForMountPoint VrpFindOrCreateDiffHiveEntryForMountPoint VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlInitializeJobForVreg VrpHandleIoctlLoadDifferencingHive VrpHandleIoctlLoadDifferencingHiveForHost VrpHandleIoctlModifyFlags VrpHandleIoctlUnloadDifferencingHiveForHost VrpHandleIoctlUnloadDynamicallyLoadedHives VrpIncrementSiloCount VrpLoadDifferencingHive VrpPostEnumerateKey VrpPreLoadKey VrpPreUnloadKey VrpTranslatePath VrpUnloadDifferencingHive VrpWaitForDiffHiveEntryTransitionOwnerToLeave WbAddHeapExecutedBlockToCache WbAddHeapExecutedBlockToLRU WbAddWarbirdEncryptionSegment WbAllocateSlots WbAllocateUserMemory WbDecryptEncryptionSegment WbFreeMemoryBlockRegion WbGetHeapExecutedBlock WbGetInitializedEncryptionSegment WbGetWarbirdEncryptionSegment WbGetWarbirdProcess WbGetWarbirdThread WbHeapExecutionUnloadModule WbInPlaceEncryptionUnloadModule WbMoveHeapExecutedBlockToBackOfLRU WbReEncryptEncryptionSegment WbReleaseLeastRecentlyUsedHeapExecutedBlocks WbRemoveWarbirdProcess WheaConfigureErrorSource WheaExecuteRowFailureCheck WheaRegisterInUsePageOfflineNotification WheaSelLogCheckPoint WheaUnconfigureErrorSource WheaUnregisterInUsePageOfflineNotification WheapCallInUsePageNotificationCallbacks WheapPfaReset WheapPredictiveFailureAnalysis
Expand for full list: AlpcpReceiveMessagePort AlpcpTryLockForCachedReferenceBlob BuildQueryDirectoryIrp CmDeleteKey CmDeleteValueKey CmEnumerateKey CmFcManagerDrainAllFeatureUsageNotifications CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerQueryFeatureConfigurationSectionInformation CmFcManagerRegisterFeatureConfigurationChangeNotification CmFcManagerUnregisterFeatureConfigurationChangeNotification CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpManagerDrainUsageNotificationsWorker CmFcpManagerPublishChangeNotifications CmFcpManagerRetryUsageNotificationsWorker CmFcpManagerSoftwareHiveReady CmFreezeRegistry CmLockHive CmLockHiveSecurityExclusive CmLockHiveSecurityShared CmQueryMultipleValueKey CmRegisterMachineHiveLoadedNotification CmRestoreKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmSiRWLockAcquireExclusive CmThawRegistry CmUnregisterMachineHiveLoadedNotification CmpAcquireWriteQueue CmpAssignKeySecurity CmpCallCallBacksEx CmpCloseKeyObject CmpCopyMergeOfLayeredKeyNode CmpCreateChild CmpCreateHive CmpCreateHiveRootCell CmpCreateKeyControlBlock CmpDeleteHive CmpDeleteKeyObject CmpDereferenceNameControlBlockWithLock CmpDoParseKey CmpDoQueueLateUnloadWorker CmpDumpKeyToBuffer CmpFinishSystemHivesLoad CmpFlushHive CmpFlushNotify CmpFreeKeyByCell CmpGetKeyNodeForKcb CmpGetLastHive CmpGetNameControlBlock CmpGetNextActiveHive CmpGetNextHive CmpGlobalLockKeyForWrite CmpInitCmRM CmpLoadHiveThread CmpLoadHiveVolatile CmpLockAppHiveLoadList CmpLockCallbackListExclusive CmpLockCallbackListShared CmpLockContextListExclusive CmpLockContextListShared CmpLockDeletedHashEntryExclusiveByKcb CmpLockGlobalKeyLockTrackerExclusive CmpLockHashEntryByIndexExclusive CmpLockHashEntryExclusive CmpLockHashEntryExclusiveByKcb CmpLockHashEntryShared CmpLockHashEntrySharedByKcb CmpLockHiveListExclusive CmpLockKcbExclusive CmpLockKcbShared CmpLockRegistryFreezeAware CmpLockSiloKeyLockTrackerExclusive CmpLockSiloKeyLockTrackerShared CmpLockTwoSecurityCachesExclusiveShared CmpMarkEntireIndexDirty CmpPerformCompleteKcbCacheLookup CmpPromoteKey CmpRecoverFlushProtocolStateFromFiles CmpRefreshHive CmpReorganizeHive CmpReportNotifyHelper CmpSetKeySecurity CmpTransMgrCommitUoW CmpTransMgrPrepare CmpTransMgrSyncHive CmpTrimHive CmpTryToLockHashEntryExclusive CmpTryToLockKcbExclusive CmpUpdateHiveRootCellFlags CmpVEExecuteOpenLogic CmpVolumeContextDecrementRefCount CmpVolumeContextMustHiveFilePagesBeKeptLocal CmpVolumeContextSendDeviceUsageNotification CmpVolumeManagerGetContextForFile CmpWaitOnHiveWriteQueue CmpWalkOneLevel ExAcquireCacheAwarePushLockExclusive ExAcquireCacheAwarePushLockExclusiveEx ExAcquireFastResourceExclusive ExAcquireFastResourceExclusive2 ExAcquireFastResourceShared ExAcquireFastResourceShared2 ExAcquireFastResourceSharedStarveExclusive ExAcquireFastResourceSharedStarveExclusive2 ExAcquireFastResourceWithFlags ExInitializeFastResourceAcquired2 ExRegisterExtension ExRegisterHost ExTryAcquireAutoExpandPushLockExclusive ExTryAcquireAutoExpandPushLockShared ExTryAcquireCacheAwarePushLockExclusiveEx ExTryAcquireCacheAwarePushLockSharedEx ExTryToAcquireFastMutex ExUnregisterExtension ExUuidCreate ExfAcquirePushLockExclusiveEx ExfAcquirePushLockSharedEx ExfAcquireReleasePushLockExclusive ExpAcquireFastMutexContended ExpAcquireFastResourceExclusiveSlow ExpAcquireFastResourceSharedSlow ExpKdPullRemoteFileForUser ExpNtUpdateWnfStateData ExpWnfAcquirePermanentDataStoreHandle ExpWnfAcquireSubscriptionByName ExpWnfAcquireSubscriptionNameInstance ExpWnfAllocateNextPersistentNameSequence ExpWnfCompleteThreadSubscriptions ExpWnfCreateNameInstance ExpWnfCreateProcessContext ExpWnfDeleteNameInstance ExpWnfDeleteProcessContext ExpWnfDeleteScopeById ExpWnfDeleteScopeInstances ExpWnfDeleteStateData ExpWnfDeleteSubscription ExpWnfDeliverThreadNotifications ExpWnfDestroyPermanentDataStore ExpWnfDispatchKernelSubscription ExpWnfEnumerateScopeInstances ExpWnfGetPermanentDataStore ExpWnfInsertSubscriptionInPendingQueue ExpWnfInvalidateDataStores ExpWnfLookupNameInstance ExpWnfNotifyNameSubscribers ExpWnfNotifySubscription ExpWnfReadStateData ExpWnfResolveScopeInstance ExpWnfSubscribeNameInstance ExpWnfUpdateSubscription ExpWnfWriteStateData FUN_140708238 FsRtlAcquireHeaderMutex HvFoldBackDirtyData HvFreeCell HvHiveConvertLockedPagesToCowByPolicy HvIsRangeDirty HvLockHiveFlusherShared HvpDoAllocateCell HvpMarkCellDirty IoSetInformation IopCloseFile IopFlushBuffersFile IopGetSetSecurityObject IopQueryXxxInformation IopReadFile IopSetEaOrQuotaInformationFile IopValidateAndGetWriteParameters IopWaitAndAcquireFileObjectLock IopXxxControlFile KeAcquireGuardedMutex KeWaitForMultipleObjects KeWaitForMutexObject KiInitializeMutant KiSatisfyThreadWait KiWaitForAllObjects LOCK_HIVE_LOAD MiAcquireKernelCfgLock MiAddSpecialPurposeMemoryPrepare MiAllocatePartitionId MiApplyImageHotPatchRequest MiCaptureRetpolineImportInfo MiChangingSubsectionProtos MiChargeSegmentCommit MiCopyLargeVad MiCreateFileOnlyImageFixupList MiCreateHardwareEnclave MiCreatePagingFile MiCreatePagingFileMap MiCreatePerSessionProtos MiDeleteAllHardwareEnclaves MiDeleteEnclavePages MiDeleteExtentPfns MiDeleteHotPatchEntry MiDeleteHotPatchRecord MiDereferencePerSessionProtos MiFindHotPatchRecord MiFindProcessImageHotPatchRecord MiFindSpecialPurposeMemoryTypeByPartition MiFinishCreateSection MiFreePartitionId MiFreeRetpolineImportInfo MiFreeSessionId MiGetAllRegisteredPatches MiGetNewSessionId MiInitializeInPageSupport MiInitializePartialVad MiInitializePartition MiInitializePartitionSpecialPurposeMemory MiInitializeSessionGlobals MiInsertChildVads MiInsertHotPatchRecord MiInsertPageFileInList MiInsertSharedCommitNode MiIsExtentDangling MiIsRangeFullyCommitted MiLoadHotPatchForUserSid MiLockControlAreaSectionExtend MiLockFileExtentsExclusive MiLockNestedVad MiLockVadRange MiLogHotPatchRundown MiMapViewOfDataSection MiMarkSharedImageCfgBits MiObtainRelocationBits MiOpenSpecialPurposeMemory MiPopulateCfgBitMap MiPrefetchControlArea MiPrefetchVirtualMemory MiQueryLoadedPatches MiQueryProcessActivePatches MiQuerySpecialPurposeMemoryInformation MiRebuildLargePages MiReferenceControlArea MiRelocateImagePfn MiRemoveSharedCommitNode MiReserveUserMemory MiReturnImageBase MiSectionDelete MiSelectOverflowDllBase MiSelectRelocationStartHint MiShutdownSystem MiUnloadHotPatchForUserSid MiUnmapViewOfSection MiWaitForCollidedFaultComplete MiWaitForExtentDeletions MiZeroAllPageFiles MmAcquireLoadLock MmCommitSessionMappedView MmCreateShadowMapping MmDeleteShadowMapping MmDuplicateMemory MmEnumerateBadPages MmExtendSection MmGetPageFileForCrashDump MmLinkJobProcess MmPrefetchPagesEx NtAllocateUuids NtAreMappedFilesTheSame NtDeleteKey NtLockFile NtNotifyChangeDirectoryFileEx NtNotifyChangeMultipleKeys NtQueryEaFile NtQueryInformationFile NtQueryQuotaInformationFile NtQueryVolumeInformationFile NtReadFileScatter NtReleaseKeyedEvent NtSetEaFile NtSetInformationFile NtSetUuidSeed NtSetVolumeInformationFile NtUnlockFile NtWaitForKeyedEvent NtWriteFileGather ObpCloseHandle ObpDeleteNameCheck ObpLockUnrelatedDirectoryShared PdcAcquireRwLockExclusive PfpPrefetchSharedConflictNotifyEnd PfpPrefetchSharedConflictNotifyStart PfpPrefetchSharedStart TlgAggregateInternalProviderCallback TlgRegisterAggregateProviderEx VrpBecomeDiffHiveEntryTransitionOwner VrpDecrementSiloCount VrpDereferenceDiffHiveEntry VrpFindDiffHiveEntryForMountPoint VrpFindOrCreateDiffHiveEntryForMountPoint VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlLoadDifferencingHive VrpHandleIoctlLoadDifferencingHiveForHost VrpHandleIoctlModifyFlags VrpHandleIoctlUnloadDifferencingHiveForHost VrpHandleIoctlUnloadDynamicallyLoadedHives VrpIncrementSiloCount VrpLoadDifferencingHive VrpPostEnumerateKey VrpPreLoadKey VrpPreUnloadKey VrpTranslatePath VrpUnloadDifferencingHive VrpWaitForDiffHiveEntryTransitionOwnerToLeave WbAddHeapExecutedBlockToCache WbAddHeapExecutedBlockToLRU WbAddWarbirdEncryptionSegment WbAllocateSlots WbAllocateUserMemory WbDecryptEncryptionSegment WbFreeMemoryBlockRegion WbGetHeapExecutedBlock WbGetInitializedEncryptionSegment WbGetWarbirdEncryptionSegment WbGetWarbirdProcess WbGetWarbirdThread WbHeapExecutionUnloadModule WbInPlaceEncryptionUnloadModule WbMoveHeapExecutedBlockToBackOfLRU WbReEncryptEncryptionSegment WbReleaseLeastRecentlyUsedHeapExecutedBlocks WbRemoveWarbirdProcess WheaConfigureErrorSource WheaExecuteRowFailureCheck WheaRegisterInUsePageOfflineNotification WheaSelLogCheckPoint WheaUnconfigureErrorSource WheaUnregisterInUsePageOfflineNotification WheapCallInUsePageNotificationCallbacks WheapPfaReset WheapPredictiveFailureAnalysis
paramcount
11
11
address
140327730
140327720
sig
undefined KeAbPreAcquire(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined param_5, undefined param_6, undefined param_7, undefined8 param_8, undefined4 param_9, undefined8 param_10, undefined8 param_11)
undefined KeAbPreAcquire(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined param_5, undefined param_6, undefined param_7, undefined8 param_8, undefined4 param_9, undefined8 param_10, undefined8 param_11)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
KeAbPreAcquire Calling Diff
--- KeAbPreAcquire calling
+++ KeAbPreAcquire calling
@@ -155 +155 @@
- FUN_140707984
+ FUN_140708238
@@ -296 +295,0 @@
- VrpHandleIoctlInitializeJobForVreg
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.99
i_ratio
0.77
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
KeAbPostRelease
KeAbPostRelease
fullname
KeAbPostRelease
KeAbPostRelease
refcount
1537
1535
length
515
515
called
KeBugCheckEx KiAbEntryRemoveFromTree KiAbThreadRemoveBoostsSlow KiRemoveSystemWorkPriorityKick MmGetSessionIdEx
KeBugCheckEx KiAbEntryRemoveFromTree KiAbThreadRemoveBoostsSlow KiRemoveSystemWorkPriorityKick MmGetSessionIdEx
calling
Expand for full list: AlpcAddHandleTableEntry AlpcConnectionDestroyProcedure AlpcDeleteBlobByHandle AlpcReferenceBlobByHandle AlpcRegisterLogRoutine AlpcUnregisterLogRoutine AlpcViewDestroyProcedure AlpcpAcceptConnectPort AlpcpAssociateIoCompletionPort AlpcpCancelMessage AlpcpCancelMessagesByRequestor AlpcpCleanupProcessViews AlpcpCompleteDispatchMessage AlpcpCreateClientPort AlpcpCreateReserve AlpcpCreateSection AlpcpCreateSectionView AlpcpCreateSecurityContext AlpcpCreateView AlpcpDeleteBlob AlpcpDeletePort AlpcpDestroyBlob AlpcpDestroyPort AlpcpDisconnectPort AlpcpDispatchCloseMessage AlpcpDispatchConnectionRequest AlpcpDispatchNewMessage AlpcpDispatchReplyToPort AlpcpDispatchReplyToWaitingThread AlpcpDoPortCleanup AlpcpEndInitialization AlpcpEnterAllocationEventMessageLog AlpcpEnterFreeEventMessageLog AlpcpEnterStateChangeEventMessageLog AlpcpEnumerateResourcesPort AlpcpFlushCancelQueue AlpcpFlushMessagesByRequestor AlpcpFlushMessagesPort AlpcpFlushQueue AlpcpFlushResourcesPort AlpcpImpersonateMessage AlpcpInitializeCompletionList AlpcpInitializePort AlpcpInsertCompletionListEntry AlpcpInsertMessageCanceledQueue AlpcpInsertMessageDirectQueue AlpcpInsertMessageLargeMessageQueue AlpcpInsertMessageMainQueue AlpcpInsertMessagePendingQueue AlpcpInsertResourcePort AlpcpInvokeLogCallbacks AlpcpLocateSectionView AlpcpMapLegacyPortRemoteView AlpcpPortQueryConnectedSidInfo AlpcpPortQueryServerInfo AlpcpPortQueryServerSessionInfo AlpcpProcessSynchronousRequest AlpcpQueryRemoteView AlpcpQueueIoCompletionPort AlpcpReceiveDirectMessagePort AlpcpReceiveLegacyMessage AlpcpReceiveMessagePort AlpcpReceiveSynchronousReply AlpcpReferenceAndLockTargetPortsAndCommunicationInfo AlpcpReferenceConnectedPort AlpcpReferenceMessageByWaitingThread AlpcpReferenceMessageByWaitingThreadPort AlpcpRegisterCompletionListDatabase AlpcpRemoveMessageFromPendingQueue AlpcpRemoveResourcePort AlpcpReplyLegacySynchronousRequest AlpcpReturnMessageOnInsufficientBuffer AlpcpSendLegacySynchronousRequest AlpcpSendMessage AlpcpSignal AlpcpSignalPortAndUnlock AlpcpTrackPortReferences AlpcpUnlockAndDereferenceTargetPortsAndCommunicationInfo AlpcpUnlockBlob AlpcpUnregisterCompletionListDatabase AlpcpWaitForPortReferences AlpcpWalkConnectionList BgkpLockBgfxCodeSection BgkpUnlockBgfxCodeSection CcAmILowPriorityWriter CcApplyLowIoPriorityToThread CcBoostLowPriorityWorkerThread CcChangeBackingFileObject CcPinFileData CcSetDirtyInMask CcSetDirtyPinnedData CcSlowReferenceSharedCacheMapFileObject CcUnpinFileDataEx CmDeleteKey CmDeleteValueKey CmEnumerateKey CmFcManagerDrainAllFeatureUsageNotifications CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerQueryFeatureConfigurationSectionInformation CmFcManagerRegisterFeatureConfigurationChangeNotification CmFcManagerUnregisterFeatureConfigurationChangeNotification CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpManagerDrainUsageNotificationsWorker CmFcpManagerPublishChangeNotifications CmFcpManagerRetryUsageNotificationsWorker CmFcpManagerSoftwareHiveReady CmFreezeRegistry CmKeyBodyRemapToVirtualForEnum CmLockKeyForWrite CmQueryMultipleValueKey CmRegisterMachineHiveLoadedNotification CmRestoreKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmSiRWLockReleaseExclusive CmThawRegistry CmUnlockHive CmUnlockHiveSecurity CmUnregisterMachineHiveLoadedNotification CmpAssignKeySecurity CmpCallCallBacksEx CmpCloseKeyObject CmpCreateChild CmpCreateHive CmpCreateHiveRootCell CmpCreateKeyControlBlock CmpDeleteHive CmpDeleteKeyObject CmpDereferenceNameControlBlockWithLock CmpDoParseKey CmpDoQueueLateUnloadWorker CmpDumpKeyToBuffer CmpFinishSystemHivesLoad CmpFlushHive CmpFlushNotify CmpGetKeyNodeForKcb CmpGetLastHive CmpGetNameControlBlock CmpGetNextActiveHive CmpGetNextHive CmpInitCmRM CmpLoadHiveThread CmpLoadHiveVolatile CmpLockRegistryFreezeAware CmpMarkEntireIndexDirty CmpNotifyMachineHiveLoaded CmpPerformCompleteKcbCacheLookup CmpPromoteKey CmpRecoverFlushProtocolStateFromFiles CmpRefreshHive CmpReorganizeHive CmpReportNotifyHelper CmpSetKeySecurity CmpStartSiloKeyLockTracker CmpStopSiloKeyLockTracker CmpTransMgrCommitUoW CmpTransMgrPrepare CmpTransMgrSyncHive CmpTrimHive CmpUnlockAppHiveLoadList CmpUnlockCallbackList CmpUnlockContextList CmpUnlockDeletedHashEntryByKcb CmpUnlockGlobalKeyLockTracker CmpUnlockHashEntry CmpUnlockHashEntryByIndex CmpUnlockHashEntryByKcb CmpUnlockHiveList CmpUnlockKcb CmpUnlockNameHashEntry CmpUpdateHiveRootCellFlags CmpVEExecuteOpenLogic CmpVolumeContextDecrementRefCount CmpVolumeContextMustHiveFilePagesBeKeptLocal CmpVolumeContextSendDeviceUsageNotification CmpVolumeManagerGetContextForFile CmpWakeWriteQueueWaiters CmpWalkOneLevel DbgkFlushErrorPort DbgkRegisterErrorPort DbgkpRemoveErrorPort DbgkpSendErrorMessage EmClientQueryRuleState EmClientRuleDeregisterNotification EmClientRuleEvaluate EmPowerPagingEnabled EmProviderDeregister EmProviderDeregisterEntry EmProviderRegisterEntry EmpAcquirePagingReference EmpClientRuleRegisterNotification EmpParseInfDatabase EmpProviderRegister EmpQueueRuleUpdateState EmpReleasePagingReference EmpRuleUpdateWorkerThread EtwCleanupSiloState EtwQueryProcessTelemetryCoverage EtwpAcquireTokenAccessInformation EtwpAddBinaryInfoEvents EtwpAddDebugInfoEvents EtwpAddGuidEntry EtwpAddRegEntryToGroup EtwpBufferingModeCompressionFlush EtwpCompressPendingBuffers EtwpCompressionProc EtwpCovSampContextAddSamples EtwpCovSampContextCleanup EtwpCovSampContextGetModule EtwpCovSampContextPruneModules EtwpCovSampHashMakeRoomAndAcquireLock EtwpCovSampProcessAddModule EtwpCovSampProcessMapAddresses EtwpCoverageCheckCP EtwpCoverageEnsureContext EtwpCoverageEnsureUserModeView EtwpCoverageFlushWorkItemCallback EtwpCoverageProvEnableCallback EtwpCoverageRecord EtwpCoverageReset EtwpCoverageResetCP EtwpCoverageSamplerClose EtwpCoverageSamplerQuery EtwpCoverageSamplerSetBloomFilter EtwpCoverageSamplerStart EtwpCoverageSamplerStop EtwpCoverageSamplerUnloadImage EtwpCreateLogFile EtwpCreateUmReplyObject EtwpDeleteRegistrationObject EtwpDisableCompression EtwpFindGuidEntryByGuid EtwpFlushCoverage EtwpFreeCompression EtwpGetCompressionSettings EtwpGetDisallowList EtwpGetLoggerInfoFromContext EtwpGetNextGuidEntry EtwpIsGuidAllowed EtwpRealtimeNotifyConsumers EtwpReferenceLoggerSecurityDescriptor EtwpSendDbgId EtwpSetCompressionSettings EtwpTrackBinaryForSession EtwpTrackDebugIdForSession EtwpTrackDecodeGuidForSession EtwpUnreferenceGuidEntry EtwpUpdateDisallowedGuids EtwpUpdatePeriodicCaptureState EtwpUpdateSelectedGroupMasks ExCreateHandleTable ExDisableHandleTracing ExDupHandleTable ExEnableHandleExceptions ExEnableHandleTracing ExEnableRaiseUMExceptionOnInvalidHandleClose ExFetchLicenseData ExFetchLicenseData$fin$0 ExGetLicenseTamperState ExGetWakeTimerList ExInitLicenseData ExInitializeDeviceAts ExNotifyPlatformBinaryExecuted ExQueryHandleExceptionsPermanency ExReferenceHandleDebugInfo ExRegisterExtension ExRegisterHost ExReleaseAutoExpandPushLockShared ExReleaseCacheAwarePushLockExclusive ExReleaseCacheAwarePushLockExclusiveEx ExReleaseFastMutex ExReleaseFastMutexUnsafe ExReleasePushLockEx ExReleasePushLockExclusiveEx ExReleasePushLockSharedEx ExSetLicenseTamperState ExSvmBeginDeviceReset ExSvmFinalizeDeviceReset ExSweepHandleTable ExUninitializeDeviceAts ExUnregisterExtension ExUuidCreate ExfAcquireReleasePushLockExclusive ExpAllocateHandleTableEntry ExpDeleteTimer ExpFreeHandleTableEntry ExpGetGlobalLocaleSection ExpGetKernelDataProtection$fin$0 ExpGetProcessInformation ExpGetSystemPlatformBinary ExpInsertLowLevelTableIntoFreeList ExpKdPullRemoteFileForUser ExpLoadAndSortLicensingCacheDescriptors ExpLoadAndSortLicensingCacheDescriptors$fin$0 ExpLoadAndSortLicensingCacheDescriptors$fin$1 ExpNtUpdateWnfStateData ExpPutLicenseDataIntoRegistry$fin$0 ExpQueryBootLoaderMetadata ExpQueryLicenseValueFromBlobHelper$fin$0 ExpReadLeapSecondData ExpRemoveHandleTable ExpSaAllocatorAllocate ExpSaAllocatorFree ExpSaPageGroupAllocateMemory ExpSaPageGroupDescriptorAllocate ExpSaPageGroupDescriptorFree ExpSaPageGroupFreeMemory ExpSetBootLoaderMetadata ExpSetKernelDataProtection$fin$0 ExpSetTimerObject ExpShareAddressSpaceWithDevice ExpSnapShotHandleTables ExpSvmDereferenceDevice ExpWnfAcquirePermanentDataStoreHandle ExpWnfAcquireSubscriptionByName ExpWnfAcquireSubscriptionNameInstance ExpWnfAllocateNextPersistentNameSequence ExpWnfCompleteThreadSubscriptions ExpWnfCreateNameInstance ExpWnfCreateProcessContext ExpWnfDeleteNameInstance ExpWnfDeletePermanentStateData ExpWnfDeleteProcessContext ExpWnfDeleteScopeById ExpWnfDeleteScopeInstances ExpWnfDeleteStateData ExpWnfDeleteSubscription ExpWnfDeliverThreadNotifications ExpWnfDestroyPermanentDataStore ExpWnfDispatchKernelSubscription ExpWnfEnumerateScopeInstances ExpWnfGetPermanentDataStore ExpWnfInsertSubscriptionInPendingQueue ExpWnfInvalidateDataStores ExpWnfLookupNameInstance ExpWnfNotifyNameSubscribers ExpWnfNotifySubscription ExpWnfPopulateStateData ExpWnfReadStateData ExpWnfReadStateData$fin$0 ExpWnfResolveScopeInstance ExpWnfSubscribeNameInstance ExpWnfUpdateSubscription ExpWnfWriteStateData ExpWnfWriteStateData$fin$0 ExpWorkerInitialization FUN_14036f764 FUN_140707984 FUN_1409fa120 FUN_1409fa77c FlushLookUpTableBucket FsRtlAcquireEofLock FsRtlCheckOplockEx2 FsRtlInsertPerStreamContext FsRtlLookupPerFileObjectContext FsRtlLookupPerStreamContextInternal FsRtlReleaseEofLock FsRtlReleaseHeaderMutex HalpDmaAllocateChildAdapterV3 HalpIommuBlockDevice HalpIommuCreateDevice HalpIommuDeleteDevice HalpIommuInvokeInterfaceStateChangeCallbacks HalpIommuUnblockDevice HalpLeaveDmaDomain HvFoldBackDirtyData HvFreeCell HvHiveConvertLockedPagesToCowByPolicy HvIsRangeDirty HvUnlockHiveFlusherShared HvlQuerySetBootPagesInfo HvpDoAllocateCell HvpMarkCellDirty InsertEventEntryInLookUpTable IoRegisterIoTracking IoUnregisterIoTracking IommuBeginDeviceReset IommuDeviceDelete IommuFinalizeDeviceReset IommuProcessPageRequestQueue IommuRegisterInterfaceStateChangeCallback IommuUnregisterInterfaceStateChangeCallback IommupDeviceDisableSvm IommupDeviceGetPasidDevice IommupFreeSystemContext IommupGetSystemContext IommupHvAttachPasidDevice IommupHvAttachPasidDeviceDomain IommupHvCreateSvmPasidSpace IommupHvDetachPasidDeviceDomain IommupPasidDeviceCreate IommupPasidDeviceDelete IopProcessIoTracking IopReleaseFileObjectLock KeCleanupImageTracepoints KeDeleteMutant KeGenericCallDpcEx KeQueryDpcWatchdogConfiguration KeReleaseGuardedMutex KeReleaseMutant KeSetSystemServiceCallback KeSetTracepoint KeUpdateDpcWatchdogConfiguration KiGenericCallDpcInitiatorWorker KiRundownMutants KiShouldLogUserModeReturnMismatch KiStartSavingSupervisorState KiTpIsExcludedKernelTracepointLocation KseAddHardwareId KseDriverUnloadImage KseLookupHardwareId KseQueryDeviceDataList KseRegisterShimEx KseResetDeviceCache KseShimDatabaseBootRelease KseShimDatabaseClose KseShimDatabaseOpen KseUnregisterShim KsepDbCacheInsertDevice KsepDbCacheQueryDevice KsepGetShimsForDriver KsepIsModuleShimmed KsepResolveApplicableShimsForDriver KsepShimDbChanged MI_UNLOCK_RELOCATIONS_EXCLUSIVE MiAddPartitionHugeRange MiAddSpecialPurposeMemoryCleanup MiAddSpecialPurposeMemoryComplete MiAddSpecialPurposeMemoryPrepare MiAddViewsForSection MiAllocatePartitionId MiApplyImageHotPatchRequest MiCaptureRetpolineImportInfo MiChargeSegmentCommit MiCoalesceFreeLargePages MiCoalesceFreePages MiCoalescePlaceholderAllocations MiCommitExistingVad MiCommitPageTableRangesForVad MiContractWsSwapPageFileWorker MiCopyLargeVad MiCreateFileOnlyImageFixupList MiCreateHardwareEnclave MiCreatePagingFile MiCreatePagingFileMap MiCreatePerSessionProtos MiCreatePrototypePtes MiDecommitHardwareEnclavePages MiDeleteAllHardwareEnclaves MiDeleteEmptyPageTables MiDeleteEnclavePages MiDeleteExtentPfns MiDeleteHotPatchEntry MiDeleteHotPatchRecord MiDeletePartitionResources MiDeleteVad MiDereferenceExtendInfo MiDereferencePerSessionProtos MiFindHotPatchRecord MiFindProcessImageHotPatchRecord MiFindSpecialPurposeMemoryTypeByPartition MiFinishCreateSection MiFinishResume MiFinishVadDeletion MiFreeInPageSupportBlock MiFreePartitionId MiFreeRetpolineImportInfo MiFreeSessionId MiFreeUnusedPfnPages MiGetAllRegisteredPatches MiGetChannelInformation MiGetNewSessionId MiGetPartitionNodeInformation MiGetSpecialPurposeMemoryPartitionForCaching MiInitializeMirroring MiInitializePagedPoolEvents MiInitializePartialVad MiInitializePartition MiInitializePartitionSpecialPurposeMemory MiInitializeSessionGlobals MiInsertChildVads MiInsertHotPatchRecord MiInsertInSystemSpace MiInsertPageFileInList MiInsertSharedCommitNode MiInsertVad MiIsExtentDangling MiIsRangeFullyCommitted MiLateInitializeSystemCache MiLoadHotPatchForUserSid MiLocateSharedPageViews MiLockVadRange MiLogHotPatchRundown MiMakeDriverPagesPrivate MiManageSubsectionView MiMapViewOfDataSection MiMarkHugePfnBad MiMarkSharedImageCfgBits MiObtainRelocationBits MiOpenSpecialPurposeMemory MiPerformVadSplitting MiPersistMdl MiPopulateCfgBitMap MiProcessTransitionHeatBatch MiQueryLoadedPatches MiQueryProcessActivePatches MiQuerySpecialPurposeMemoryInformation MiRebuildLargePages MiReferenceRemovePartition MiReleaseImageSection MiReleaseKernelCfgLock MiRelocateImagePfn MiRemoveBadPages MiRemoveFromSystemSpace MiRemoveSharedCommitNode MiRemoveVad MiReserveUserMemory MiReturnImageBase MiSectionCreated MiSectionDelete MiSelectOverflowDllBase MiSelectRelocationStartHint MiSendParkedCoreUpdateToAllChildPartitions MiSetPagesModified MiSetProtectionOnSection MiSetVadDeleted MiShutdownSystem MiSpecialPurposeMemoryRemoved MiSplitPrivatePage MiSplitReducedCommitClonePage MiSubsectionProtosCreated MiTransferFileExtent MiTrimSharedPageFromViews MiTrimUnusedPageFileRegionsWorker MiUnloadHotPatchForUserSid MiUnlockAndDereferenceVad MiUnlockAndDereferenceVadShared MiUnlockControlAreaFileObjectShared MiUnlockControlAreaSectionExtend MiUnlockDriverMappings MiUnlockDynamicMemoryExclusive MiUnlockDynamicMemoryNestedExclusive MiUnlockDynamicMemoryShared MiUnlockFileExtentsExclusive MiUnlockLoaderEntry MiUnlockNestedVad MiUnlockPartitionSystemThreads MiUnlockVad MiUnlockVadRange MiUnlockVadShared MiUpControlAreaRefs MiUpdateImagePfnImportRelocations MiUpdateSpecialPurposeMemoryCacheEligibility MiWalkEntireImage MiZeroAllPageFiles MiZeroPage MiZeroPageMakeHot MiZeroSectionObjectPointer MmCheckProcessShadow MmCommitSessionMappedView MmCreateShadowMapping MmDecodeExportSection MmDeleteShadowMapping MmDuplicateMemory MmEncodeExportSection MmEnumerateBadPages MmExtendSection MmGetPageFileForCrashDump MmLinkJobProcess MmMarkPhysicalMemoryAsBad MmOutSwapVirtualAddresses MmOutSwapWorkingSet MmReleaseLoadLock MmResourcesAvailable MmSetPfnListInfo NormalizationList__Unlock NtAllocateUuids NtAlpcDeleteSectionView NtAlpcOpenSenderProcess NtAlpcRevokeSecurityContext NtAlpcSetInformation NtAreMappedFilesTheSame NtCancelTimer NtChangeProcessState NtChangeThreadState NtCreateUserProcess NtDeleteKey NtDuplicateToken NtNotifyChangeMultipleKeys NtOpenProcessTokenEx NtOpenThreadTokenEx NtQueryInformationProcess NtQueryInformationThread NtQueryInformationThread$fin$3 NtQueryObject NtReleaseKeyedEvent NtSetInformationThread NtSetInformationThread$fin$1 NtSetSystemInformation NtSetUuidSeed NtTerminateProcess NtWaitForKeyedEvent ObCheckRefTraceProcess ObClearProcessDeviceMap ObDereferenceDeviceMap ObDereferenceSecurityDescriptor ObDisableEtwReferenceTrace ObDuplicateObject ObEnableEtwReferenceTrace ObInsertObjectEx ObIsDosDeviceLocallyMapped ObLogSecurityDescriptor ObOpenObjectByNameEx ObQueryDeviceMapInformation ObQueryNameStringMode ObQueryRefTraceInformation ObReleaseObjectSecurity ObpCloseHandle ObpCreateHandle ObpCreateSymbolicLinkName ObpDeleteSymbolicLinkName ObpDeregisterObject ObpFreeWorkItemBlock ObpGetShadowDirectory ObpLockChildDirectory ObpLockUnrelatedDirectoryShared ObpLookupObjectName ObpPushRefDerefInfo ObpReferenceSecurityDescriptorSlow ObpRegisterObject ObpSetCurrentProcessDeviceMap ObpSetDeviceMap ObpSlowReferenceDeviceMap ObpStartRuntimeStackTrace ObpStopRuntimeStackTrace Ordinal_20 Ordinal_21 PdcTaskClientRequest PerfDiagpProxyWorker PfCheckDeprioritizeFile PfCheckDeprioritizeImage PfFileInfoNotify PfGenerateTrace PfProcessExitNotification PfQuerySuperfetchInformation PfSetSuperfetchInformation PfSnBeginAppLaunch PfSnGetPrefetchInstructions PfSnIsHostingApplication PfSnQueryPrefetcherInformation PfSnSetAltPrefetchParam PfTAccessTracingCleanup PfTAccessTracingStart PfTSetTraceWorkerPriority PfTSetTracingPriority PfpParametersPropagate PfpParametersWatcher PfpPrefetchSharedCleanup PfpPrefetchSharedStart PfpRpCHashAddEntries PfpRpCHashDeleteEntries PfpRpCHashEmpty PfpRpCHashGrow PfpRpFileKeyUpdate PfpRpShutdown PfpScenCtxPrefetchAbortSet PfpScenCtxPrefetchStateSet PfpScenCtxPrefetchWait PfpScenCtxQueryScenarioInformation PfpScenCtxScenarioSet PfpScenCtxServiceThreadSet PoFxAbandonDevice PoFxPrepareDevice PoFxStartDevicePowerManagement PoFxSystemLatencyNotify PopBlackBoxDirectAccess PopBlackBoxUpdate PopBootStatCheckIntegrity PopBootStatGet PopBootStatRestoreDefaults PopBootStatSet PopBootStatUnlock PopDiagTraceFxRundown PopDirectedDripsDiagBroadcastTreeBegin PopDirectedDripsDiagBroadcastTreeEnd PopDirectedDripsDiagNotifySessionStart PopDirectedDripsDiagNotifySessionStop PopDirectedDripsDiagTraceBroadcastFailureDevice PopDirectedDripsDiagTraceBroadcastVisit PopDirectedDripsDiagTraceMarkDevice PopDirectedDripsDiagTraceNotifyDevices PopDirectedDripsDiagTraceProblemDevice PopDirectedDripsHandleResiliencyNotification PopDirectedDripsIdleResiliencyCallback PopDirectedDripsNotify PopDirectedDripsNotifyResiliencyCompletionWorker PopFxAcpiPrepareDevice PopFxActivateDevicesForSx PopFxBuildDirectedDripsCandidateDeviceList PopFxBuildDripsBlockingDeviceList PopFxClearDirectedDripsCandidateDeviceList PopFxDisableBasicAccountingWorker PopFxFindAcpiDeviceByUniqueId PopFxFindAndReferenceAcpiDevice PopFxIdleDevicesFromSx PopFxInsertAcpiDevice PopFxInsertDevice PopFxLowPowerEpochCallback PopFxNotifySxTransitionState PopFxPauseDeviceAccounting PopFxPrepareDevicesForShutdown PopFxRegisterDeviceWithPep PopFxRegisterPluginEx PopFxRemoveAcpiDevice PopFxRemoveDevice PopFxResidentTimeoutRoutine PopFxResumeDeviceAccounting PopFxStartDeviceAccounting PopFxStopDeviceAccounting PopFxUpdateVetoMaskWork PopPdcCsDeviceNotification PopPepIdleTimeoutRoutine PopPepInsertDevice PopPepIterateDeviceList PopPepPlatformStateRegistered PopPepRemoveDevice PopPepWork PopPowerButtonBugcheckConfigure PopQueryPowerButtonBugcheckEnabled PsAdjustBasicEnclaveThreadList PsCallEnclave PsCaptureExceptionPort PsCreateVsmEnclave PsDeleteVsmEnclave PsDisableImpersonation PsFreezeProcess PsGetNextProcess PsGetNextProcessThread PsGetProcessDeepFreezeStats PsGetProcessEnclaveModuleInfo PsImpersonateClient PsInitializeVsmEnclave PsIsVsmEnclaveTerminated PsLoadVsmEnclaveData PsQueryProcessEnergyValues PsQueryRuntimeProcess PsQueryStatisticsProcess PsQueryTotalCycleTimeProcess PsReferenceImpersonationToken PsReferenceImpersonationTokenEx PsReferencePartitionSystemProcess PsReferencePrimaryTokenWithTag PsRestoreImpersonation PsSetProcessFaultInformation PsSetProcessTelemetryAppState PsSetProcessWin32Process PsStartSiloMonitor PsSwapImpersonationToken PsSwapProcessWorkingSet PsTerminateMinimalProcess PsTerminateVsmEnclave PsThawMultiProcess PsUnregisterSiloMonitor PsUpdateActiveProcessAffinity PspAllocateAndQueryProcessNotificationChannel PspAllocateThread PspApplyCoreIsolationPolicy PspApplyWorkingSetLimits PspApplyWorkingSetLimitsToProcess PspAssignPrimaryToken PspAssignProcessToJob PspAttachProcessToSyscallProvider PspChangeJobMemoryUsageByProcess PspChargeProcessWakeCounter PspCreatePicoProcess PspDestroySyscallProvider PspDetachProcessFromSyscallProvider PspEnableProcessOptionalXStateFeatures PspExitThread PspGetNextSyscallProviderProcess PspGetPreviousProcessThread PspInheritSyscallProvider PspInsertProcess PspInsertSyscallProvider PspInsertThread PspLookupSyscallProviderById PspMarkServerSiloAsTerminating PspNotifyProcessEffectiveIoLimitChanged PspNotifyServerSiloCreation PspNotifyServerSiloTermination PspProcessClose PspProcessDynamicEHContinuationTargets PspProcessDynamicEnforcedAddressRanges PspReferenceSystemDll PspRemoveEnclaveThreadWait PspRundownSingleProcess PspSelectVsmEnclaveByNumber PspSetJobIoRateControl PspSetProcessAffinityUpdateMode PspSetProcessDefaultHardErrorMode PspSetProcessForegroundBackgroundRequest PspSetProcessTimerDelayForWin32 PspSetQuotaLimits PspStorageAllocSlot PspStorageEmptyArray PspStorageEmptyArrayNonReadonly PspStorageFreeSlot PspStorageGetObject PspStorageInsertObject PspStorageMakeSlotReadOnly PspStorageRemoveObject PspStorageReplaceObject PspSyscallProviderOptIn PspTeardownPartition PspTerminateProcess PspThreadDelete PspUnlockJobAssignment PspUnlockJobListExclusive PspUnlockJobListShared PspUnlockJobMemoryLimitsExclusive PspUnlockJobMemoryLimitsShared PspUnlockJobsAndProcessExclusive PspUnlockProcessExclusive PspUnlockProcessListExclusive PspUnlockProcessListShared PspUnlockQuotaExpansion PspUnlockQuotaListExclusive PspUnlockQuotaListShared PspUpdateSingleProcessAffinity PspWow64ReadOrWriteThreadCpuArea RtlDeleteAtomFromAtomTable RtlDestroyAtomTable RtlEmptyAtomTable RtlFindDynamicEnforcedAddressInRanges RtlInsertDynamicFunctionTable RtlLockBootStatusData RtlLookupAtomInAtomTable RtlPinAtomInAtomTable RtlQueryAtomInAtomTable RtlQueryAtomsInAtomTable RtlRemoveDynamicFunctionTable RtlUnlockBootStatusData RtlpCSparseBitmapUnlock RtlpFindDynamicEHContinuationTarget RtlpFlsAlloc RtlpFlsDataCleanup RtlpFlsFree RtlpFlsSetValueSlot RtlpHpAcquireReleaseLockExclusive RtlpHpCustomVaCallbacksRegistrarRegister RtlpHpCustomVaCallbacksRegistrarUnregister RtlpHpFixedVsAllocate RtlpHpFixedVsFree RtlpHpHeapExtendContext RtlpHpLargeAlloc RtlpHpLargeAllocSetExtraPresent RtlpHpLargeAllocSize RtlpHpLargeFree RtlpHpLfhBucketAddSubsegment RtlpHpLfhBucketGetSubsegment RtlpHpLfhBucketUpdateAffinityMapping RtlpHpLfhContextCompact RtlpHpLfhOwnerCompact RtlpHpLfhSlotAllocate RtlpHpLfhSubsegmentCreate RtlpHpLfhSubsegmentDecommitPages RtlpHpLfhSubsegmentFreeBlock RtlpHpLfhSubsegmentIncBlockCounts RtlpHpReleaseQueuedLockExclusive RtlpHpSegContextCompact RtlpHpSegMgrCommitComplete RtlpHpSegMgrCommitInitiate RtlpHpSegMgrVaCtxAlloc RtlpHpSegMgrVaCtxFree RtlpHpSegMgrVaCtxInsert RtlpHpSegPageRangeAllocate RtlpHpSegPageRangeCoalesce RtlpHpSegPageRangeShrink RtlpHpVaMgrAlloc RtlpHpVaMgrCtxFree RtlpHpVsChunkSplit RtlpHpVsSubsegmentCommitPages RtlpLookupDynamicUserFunctionTable RtlpSetSecurityObject RtlpUnlockAtomTable SLGetSubscriptionPfn SLGetSubscriptionPfn$fin$0 SLGetSubscriptionPfn$fin$1 SLQueryLicenseValueInternal SLUpdateLicenseDataInternal SLUpdateLicenseDataInternal$fin$0 SLUpdateLicenseDataInternal$fin$1 SMKM_STORE<SM_TRAITS>::SmStCleanup SMKM_STORE<SM_TRAITS>::SmStSwapStore SMKM_STORE<SM_TRAITS>::SmStWorker SMKM_STORE<struct_SM_TRAITS>::SmStDirectReadIssue SMKM_STORE<struct_SM_TRAITS>::SmStHelperSendCommand SMKM_STORE<struct_SM_TRAITS>::SmStMapVirtualRegion SMKM_STORE<struct_SM_TRAITS>::SmStOutSwapStore SMKM_STORE<struct_SM_TRAITS>::SmStPrioritizeRegionsStore SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStore SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStoreBatch SMKM_STORE<struct_SM_TRAITS>::SmStUnmapVirtualRegion SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEmpty SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeReadInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys SSHSupportReleasePushLockExclusive ST_STORE<struct_SM_TRAITS>::StDmHandleDecompressionFailure ST_STORE<struct_SM_TRAITS>::StDmPageRemove ST_STORE<struct_SM_TRAITS>::StDmSinglePageCopy ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd SeCaptureSubjectContextEx SeComputeAutoInheritByObjectTypeEx SeDefaultObjectMethod SeRegisterObjectTypeMandatoryPolicy SendCaptureStateNotificationsWorker SepAddLuidToIndexEntry SepAppendAceToTokenObjectAcl SepDeReferenceSharedSidEntries SepDeleteSessionLowboxEntries SepDereferenceCachedHandlesEntry SepDereferenceLowBoxNumberEntry SepInsertOrReferenceSharedSidEntries SepIsParentOfChildAppContainer SepIsValidProcUniqueLuid SepRmCapUpdateWrkr SepRmReferenceFindCap SepSetTokenCachedHandles SepSetTokenClaims SepSetTokenLowboxNumber SepSetTokenUserAndGroups SmCreatePartition SmDeletePartition SmEtwEnableCallback SmFirstTimeInit SmGetRegistrationInfo SmKmKeyGenGenerate SmKmKeyGenKeyDelete SmKmKeyGenNewKey SmKmStoreAdd SmKmStoreDelete SmKmVirtualLockContextIncreaseWsMin SmKmVirtualLockCtxLockMemory SmKmVirtualLockCtxMemoryUnlocked SmPartitionJobPaired SmProcessCompressionInfoRequest SmcCacheAdd SmcCacheCreatePrepare SmcCacheRemove SmcGetCacheStats SmcStoreDelete SmcStoreResize SmcStoreSlotAbort SmcStoreSlotCommit SmcStoreSlotReserve SmpKeyedStoreEntryGet SmpKeyedStoreReference SmpKeyedStoreSetVaRanges SmpSystemStoreCreate SshpSetCollectionActive TlgAggregateInternalProviderCallback TlgRegisterAggregateProviderEx UNLOCK_ADDRESS_SPACE_SHARED UNLOCK_ADDRESS_SPACE_SHARED_UNORDERED UNLOCK_ADDRESS_SPACE_UNORDERED UNLOCK_HIVE_LOAD UNLOCK_PAGE_TABLE_COMMITMENT VmCreateMemoryRange VmDeleteMemoryRange VmMergeMemoryRanges VmPinMemoryRange VmSplitMemoryRange VmUnpinMemoryRange VmpCleanProcessAddressSpace VmpPauseResumeNotify VrpDecrementSiloCount VrpDereferenceDiffHiveEntry VrpFindDiffHiveEntryForMountPoint VrpFindOrCreateDiffHiveEntryForMountPoint VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlInitializeJobForVreg VrpHandleIoctlLoadDifferencingHive VrpHandleIoctlLoadDifferencingHiveForHost VrpHandleIoctlModifyFlags VrpHandleIoctlUnloadDifferencingHiveForHost VrpHandleIoctlUnloadDynamicallyLoadedHives VrpIncrementSiloCount VrpLoadDifferencingHive VrpPostEnumerateKey VrpPostUnloadKey VrpPreLoadKey VrpPreUnloadKey VrpRelinquishDiffHiveEntryTransitionOwner VrpTranslatePath VrpUnloadDifferencingHive VrpWaitForDiffHiveEntryTransitionOwnerToLeave VslpLockPagesForTransfer VslpUnlockPagesForTransfer WbAddHeapExecutedBlockToCache WbAddHeapExecutedBlockToLRU WbAddWarbirdEncryptionSegment WbAllocateSlots WbAllocateUserMemory WbDecryptEncryptionSegment WbFreeMemoryBlockRegion WbGetHeapExecutedBlock WbGetInitializedEncryptionSegment WbGetWarbirdEncryptionSegment WbGetWarbirdProcess WbGetWarbirdThread WbHeapExecutionUnloadModule WbInPlaceEncryptionUnloadModule WbMoveHeapExecutedBlockToBackOfLRU WbReEncryptEncryptionSegment WbReleaseLeastRecentlyUsedHeapExecutedBlocks WbRemoveWarbirdProcess WheaConfigureErrorSource WheaExecuteRowFailureCheck WheaInitialize WheaRegisterErrorSourceOverride WheaRegisterInUsePageOfflineNotification WheaSelLogCheckPoint WheaSelLogSetNtSchedulerAvailability WheaUnconfigureErrorSource WheaUnregisterErrorSourceOverride WheaUnregisterInUsePageOfflineNotification WheapCallInUsePageNotificationCallbacks WheapPfaReset WheapPredictiveFailureAnalysis
Expand for full list: AlpcAddHandleTableEntry AlpcConnectionDestroyProcedure AlpcDeleteBlobByHandle AlpcReferenceBlobByHandle AlpcRegisterLogRoutine AlpcUnregisterLogRoutine AlpcViewDestroyProcedure AlpcpAcceptConnectPort AlpcpAssociateIoCompletionPort AlpcpCancelMessage AlpcpCancelMessagesByRequestor AlpcpCleanupProcessViews AlpcpCompleteDispatchMessage AlpcpCreateClientPort AlpcpCreateReserve AlpcpCreateSection AlpcpCreateSectionView AlpcpCreateSecurityContext AlpcpCreateView AlpcpDeleteBlob AlpcpDeletePort AlpcpDestroyBlob AlpcpDestroyPort AlpcpDisconnectPort AlpcpDispatchCloseMessage AlpcpDispatchConnectionRequest AlpcpDispatchNewMessage AlpcpDispatchReplyToPort AlpcpDispatchReplyToWaitingThread AlpcpDoPortCleanup AlpcpEndInitialization AlpcpEnterAllocationEventMessageLog AlpcpEnterFreeEventMessageLog AlpcpEnterStateChangeEventMessageLog AlpcpEnumerateResourcesPort AlpcpFlushCancelQueue AlpcpFlushMessagesByRequestor AlpcpFlushMessagesPort AlpcpFlushQueue AlpcpFlushResourcesPort AlpcpImpersonateMessage AlpcpInitializeCompletionList AlpcpInitializePort AlpcpInsertCompletionListEntry AlpcpInsertMessageCanceledQueue AlpcpInsertMessageDirectQueue AlpcpInsertMessageLargeMessageQueue AlpcpInsertMessageMainQueue AlpcpInsertMessagePendingQueue AlpcpInsertResourcePort AlpcpInvokeLogCallbacks AlpcpLocateSectionView AlpcpMapLegacyPortRemoteView AlpcpPortQueryConnectedSidInfo AlpcpPortQueryServerInfo AlpcpPortQueryServerSessionInfo AlpcpProcessSynchronousRequest AlpcpQueryRemoteView AlpcpQueueIoCompletionPort AlpcpReceiveDirectMessagePort AlpcpReceiveLegacyMessage AlpcpReceiveMessagePort AlpcpReceiveSynchronousReply AlpcpReferenceAndLockTargetPortsAndCommunicationInfo AlpcpReferenceConnectedPort AlpcpReferenceMessageByWaitingThread AlpcpReferenceMessageByWaitingThreadPort AlpcpRegisterCompletionListDatabase AlpcpRemoveMessageFromPendingQueue AlpcpRemoveResourcePort AlpcpReplyLegacySynchronousRequest AlpcpReturnMessageOnInsufficientBuffer AlpcpSendLegacySynchronousRequest AlpcpSendMessage AlpcpSignal AlpcpSignalPortAndUnlock AlpcpTrackPortReferences AlpcpUnlockAndDereferenceTargetPortsAndCommunicationInfo AlpcpUnlockBlob AlpcpUnregisterCompletionListDatabase AlpcpWaitForPortReferences AlpcpWalkConnectionList BgkpLockBgfxCodeSection BgkpUnlockBgfxCodeSection CcAmILowPriorityWriter CcApplyLowIoPriorityToThread CcBoostLowPriorityWorkerThread CcChangeBackingFileObject CcPinFileData CcSetDirtyInMask CcSetDirtyPinnedData CcSlowReferenceSharedCacheMapFileObject CcUnpinFileDataEx CmDeleteKey CmDeleteValueKey CmEnumerateKey CmFcManagerDrainAllFeatureUsageNotifications CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerQueryFeatureConfigurationSectionInformation CmFcManagerRegisterFeatureConfigurationChangeNotification CmFcManagerUnregisterFeatureConfigurationChangeNotification CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpManagerDrainUsageNotificationsWorker CmFcpManagerPublishChangeNotifications CmFcpManagerRetryUsageNotificationsWorker CmFcpManagerSoftwareHiveReady CmFreezeRegistry CmKeyBodyRemapToVirtualForEnum CmLockKeyForWrite CmQueryMultipleValueKey CmRegisterMachineHiveLoadedNotification CmRestoreKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmSiRWLockReleaseExclusive CmThawRegistry CmUnlockHive CmUnlockHiveSecurity CmUnregisterMachineHiveLoadedNotification CmpAssignKeySecurity CmpCallCallBacksEx CmpCloseKeyObject CmpCreateChild CmpCreateHive CmpCreateHiveRootCell CmpCreateKeyControlBlock CmpDeleteHive CmpDeleteKeyObject CmpDereferenceNameControlBlockWithLock CmpDoParseKey CmpDoQueueLateUnloadWorker CmpDumpKeyToBuffer CmpFinishSystemHivesLoad CmpFlushHive CmpFlushNotify CmpGetKeyNodeForKcb CmpGetLastHive CmpGetNameControlBlock CmpGetNextActiveHive CmpGetNextHive CmpInitCmRM CmpLoadHiveThread CmpLoadHiveVolatile CmpLockRegistryFreezeAware CmpMarkEntireIndexDirty CmpNotifyMachineHiveLoaded CmpPerformCompleteKcbCacheLookup CmpPromoteKey CmpRecoverFlushProtocolStateFromFiles CmpRefreshHive CmpReorganizeHive CmpReportNotifyHelper CmpSetKeySecurity CmpStartSiloKeyLockTracker CmpStopSiloKeyLockTracker CmpTransMgrCommitUoW CmpTransMgrPrepare CmpTransMgrSyncHive CmpTrimHive CmpUnlockAppHiveLoadList CmpUnlockCallbackList CmpUnlockContextList CmpUnlockDeletedHashEntryByKcb CmpUnlockGlobalKeyLockTracker CmpUnlockHashEntry CmpUnlockHashEntryByIndex CmpUnlockHashEntryByKcb CmpUnlockHiveList CmpUnlockKcb CmpUnlockNameHashEntry CmpUpdateHiveRootCellFlags CmpVEExecuteOpenLogic CmpVolumeContextDecrementRefCount CmpVolumeContextMustHiveFilePagesBeKeptLocal CmpVolumeContextSendDeviceUsageNotification CmpVolumeManagerGetContextForFile CmpWakeWriteQueueWaiters CmpWalkOneLevel DbgkFlushErrorPort DbgkRegisterErrorPort DbgkpRemoveErrorPort DbgkpSendErrorMessage EmClientQueryRuleState EmClientRuleDeregisterNotification EmClientRuleEvaluate EmPowerPagingEnabled EmProviderDeregister EmProviderDeregisterEntry EmProviderRegisterEntry EmpAcquirePagingReference EmpClientRuleRegisterNotification EmpParseInfDatabase EmpProviderRegister EmpQueueRuleUpdateState EmpReleasePagingReference EmpRuleUpdateWorkerThread EtwCleanupSiloState EtwQueryProcessTelemetryCoverage EtwpAcquireTokenAccessInformation EtwpAddBinaryInfoEvents EtwpAddDebugInfoEvents EtwpAddGuidEntry EtwpAddRegEntryToGroup EtwpBufferingModeCompressionFlush EtwpCompressPendingBuffers EtwpCompressionProc EtwpCovSampContextAddSamples EtwpCovSampContextCleanup EtwpCovSampContextGetModule EtwpCovSampContextPruneModules EtwpCovSampHashMakeRoomAndAcquireLock EtwpCovSampProcessAddModule EtwpCovSampProcessMapAddresses EtwpCoverageCheckCP EtwpCoverageEnsureContext EtwpCoverageEnsureUserModeView EtwpCoverageFlushWorkItemCallback EtwpCoverageProvEnableCallback EtwpCoverageRecord EtwpCoverageReset EtwpCoverageResetCP EtwpCoverageSamplerClose EtwpCoverageSamplerQuery EtwpCoverageSamplerSetBloomFilter EtwpCoverageSamplerStart EtwpCoverageSamplerStop EtwpCoverageSamplerUnloadImage EtwpCreateLogFile EtwpCreateUmReplyObject EtwpDeleteRegistrationObject EtwpDisableCompression EtwpFindGuidEntryByGuid EtwpFlushCoverage EtwpFreeCompression EtwpGetCompressionSettings EtwpGetDisallowList EtwpGetLoggerInfoFromContext EtwpGetNextGuidEntry EtwpIsGuidAllowed EtwpRealtimeNotifyConsumers EtwpReferenceLoggerSecurityDescriptor EtwpSendDbgId EtwpSetCompressionSettings EtwpTrackBinaryForSession EtwpTrackDebugIdForSession EtwpTrackDecodeGuidForSession EtwpUnreferenceGuidEntry EtwpUpdateDisallowedGuids EtwpUpdatePeriodicCaptureState EtwpUpdateSelectedGroupMasks ExCreateHandleTable ExDisableHandleTracing ExDupHandleTable ExEnableHandleExceptions ExEnableHandleTracing ExEnableRaiseUMExceptionOnInvalidHandleClose ExFetchLicenseData ExFetchLicenseData$fin$0 ExGetLicenseTamperState ExGetWakeTimerList ExInitLicenseData ExInitializeDeviceAts ExNotifyPlatformBinaryExecuted ExQueryHandleExceptionsPermanency ExReferenceHandleDebugInfo ExRegisterExtension ExRegisterHost ExReleaseAutoExpandPushLockShared ExReleaseCacheAwarePushLockExclusive ExReleaseCacheAwarePushLockExclusiveEx ExReleaseFastMutex ExReleaseFastMutexUnsafe ExReleasePushLockEx ExReleasePushLockExclusiveEx ExReleasePushLockSharedEx ExSetLicenseTamperState ExSvmBeginDeviceReset ExSvmFinalizeDeviceReset ExSweepHandleTable ExUninitializeDeviceAts ExUnregisterExtension ExUuidCreate ExfAcquireReleasePushLockExclusive ExpAllocateHandleTableEntry ExpDeleteTimer ExpFreeHandleTableEntry ExpGetGlobalLocaleSection ExpGetKernelDataProtection$fin$0 ExpGetProcessInformation ExpGetSystemPlatformBinary ExpInsertLowLevelTableIntoFreeList ExpKdPullRemoteFileForUser ExpLoadAndSortLicensingCacheDescriptors ExpLoadAndSortLicensingCacheDescriptors$fin$0 ExpLoadAndSortLicensingCacheDescriptors$fin$1 ExpNtUpdateWnfStateData ExpPutLicenseDataIntoRegistry$fin$0 ExpQueryBootLoaderMetadata ExpQueryLicenseValueFromBlobHelper$fin$0 ExpReadLeapSecondData ExpRemoveHandleTable ExpSaAllocatorAllocate ExpSaAllocatorFree ExpSaPageGroupAllocateMemory ExpSaPageGroupDescriptorAllocate ExpSaPageGroupDescriptorFree ExpSaPageGroupFreeMemory ExpSetBootLoaderMetadata ExpSetKernelDataProtection$fin$0 ExpSetTimerObject ExpShareAddressSpaceWithDevice ExpSnapShotHandleTables ExpSvmDereferenceDevice ExpWnfAcquirePermanentDataStoreHandle ExpWnfAcquireSubscriptionByName ExpWnfAcquireSubscriptionNameInstance ExpWnfAllocateNextPersistentNameSequence ExpWnfCompleteThreadSubscriptions ExpWnfCreateNameInstance ExpWnfCreateProcessContext ExpWnfDeleteNameInstance ExpWnfDeletePermanentStateData ExpWnfDeleteProcessContext ExpWnfDeleteScopeById ExpWnfDeleteScopeInstances ExpWnfDeleteStateData ExpWnfDeleteSubscription ExpWnfDeliverThreadNotifications ExpWnfDestroyPermanentDataStore ExpWnfDispatchKernelSubscription ExpWnfEnumerateScopeInstances ExpWnfGetPermanentDataStore ExpWnfInsertSubscriptionInPendingQueue ExpWnfInvalidateDataStores ExpWnfLookupNameInstance ExpWnfNotifyNameSubscribers ExpWnfNotifySubscription ExpWnfPopulateStateData ExpWnfReadStateData ExpWnfReadStateData$fin$0 ExpWnfResolveScopeInstance ExpWnfSubscribeNameInstance ExpWnfUpdateSubscription ExpWnfWriteStateData ExpWnfWriteStateData$fin$0 ExpWorkerInitialization FUN_14036f754 FUN_140708238 FUN_1409fa0b0 FUN_1409fa70c FlushLookUpTableBucket FsRtlAcquireEofLock FsRtlCheckOplockEx2 FsRtlInsertPerStreamContext FsRtlLookupPerFileObjectContext FsRtlLookupPerStreamContextInternal FsRtlReleaseEofLock FsRtlReleaseHeaderMutex HalpDmaAllocateChildAdapterV3 HalpIommuBlockDevice HalpIommuCreateDevice HalpIommuDeleteDevice HalpIommuInvokeInterfaceStateChangeCallbacks HalpIommuUnblockDevice HalpLeaveDmaDomain HvFoldBackDirtyData HvFreeCell HvHiveConvertLockedPagesToCowByPolicy HvIsRangeDirty HvUnlockHiveFlusherShared HvlQuerySetBootPagesInfo HvpDoAllocateCell HvpMarkCellDirty InsertEventEntryInLookUpTable IoRegisterIoTracking IoUnregisterIoTracking IommuBeginDeviceReset IommuDeviceDelete IommuFinalizeDeviceReset IommuProcessPageRequestQueue IommuRegisterInterfaceStateChangeCallback IommuUnregisterInterfaceStateChangeCallback IommupDeviceDisableSvm IommupDeviceGetPasidDevice IommupFreeSystemContext IommupGetSystemContext IommupHvAttachPasidDevice IommupHvAttachPasidDeviceDomain IommupHvCreateSvmPasidSpace IommupHvDetachPasidDeviceDomain IommupPasidDeviceCreate IommupPasidDeviceDelete IopProcessIoTracking IopReleaseFileObjectLock KeCleanupImageTracepoints KeDeleteMutant KeGenericCallDpcEx KeQueryDpcWatchdogConfiguration KeReleaseGuardedMutex KeReleaseMutant KeSetSystemServiceCallback KeSetTracepoint KeUpdateDpcWatchdogConfiguration KiGenericCallDpcInitiatorWorker KiRundownMutants KiShouldLogUserModeReturnMismatch KiStartSavingSupervisorState KiTpIsExcludedKernelTracepointLocation KseAddHardwareId KseDriverUnloadImage KseLookupHardwareId KseQueryDeviceDataList KseRegisterShimEx KseResetDeviceCache KseShimDatabaseBootRelease KseShimDatabaseClose KseShimDatabaseOpen KseUnregisterShim KsepDbCacheInsertDevice KsepDbCacheQueryDevice KsepGetShimsForDriver KsepIsModuleShimmed KsepResolveApplicableShimsForDriver KsepShimDbChanged MI_UNLOCK_RELOCATIONS_EXCLUSIVE MiAddPartitionHugeRange MiAddSpecialPurposeMemoryCleanup MiAddSpecialPurposeMemoryComplete MiAddSpecialPurposeMemoryPrepare MiAddViewsForSection MiAllocatePartitionId MiApplyImageHotPatchRequest MiCaptureRetpolineImportInfo MiChargeSegmentCommit MiCoalesceFreeLargePages MiCoalesceFreePages MiCoalescePlaceholderAllocations MiCommitExistingVad MiCommitPageTableRangesForVad MiContractWsSwapPageFileWorker MiCopyLargeVad MiCreateFileOnlyImageFixupList MiCreateHardwareEnclave MiCreatePagingFile MiCreatePagingFileMap MiCreatePerSessionProtos MiCreatePrototypePtes MiDecommitHardwareEnclavePages MiDeleteAllHardwareEnclaves MiDeleteEmptyPageTables MiDeleteEnclavePages MiDeleteExtentPfns MiDeleteHotPatchEntry MiDeleteHotPatchRecord MiDeletePartitionResources MiDeleteVad MiDereferenceExtendInfo MiDereferencePerSessionProtos MiFindHotPatchRecord MiFindProcessImageHotPatchRecord MiFindSpecialPurposeMemoryTypeByPartition MiFinishCreateSection MiFinishResume MiFinishVadDeletion MiFreeInPageSupportBlock MiFreePartitionId MiFreeRetpolineImportInfo MiFreeSessionId MiFreeUnusedPfnPages MiGetAllRegisteredPatches MiGetChannelInformation MiGetNewSessionId MiGetPartitionNodeInformation MiGetSpecialPurposeMemoryPartitionForCaching MiInitializeMirroring MiInitializePagedPoolEvents MiInitializePartialVad MiInitializePartition MiInitializePartitionSpecialPurposeMemory MiInitializeSessionGlobals MiInsertChildVads MiInsertHotPatchRecord MiInsertInSystemSpace MiInsertPageFileInList MiInsertSharedCommitNode MiInsertVad MiIsExtentDangling MiIsRangeFullyCommitted MiLateInitializeSystemCache MiLoadHotPatchForUserSid MiLocateSharedPageViews MiLockVadRange MiLogHotPatchRundown MiMakeDriverPagesPrivate MiManageSubsectionView MiMapViewOfDataSection MiMarkHugePfnBad MiMarkSharedImageCfgBits MiObtainRelocationBits MiOpenSpecialPurposeMemory MiPerformVadSplitting MiPersistMdl MiPopulateCfgBitMap MiProcessTransitionHeatBatch MiQueryLoadedPatches MiQueryProcessActivePatches MiQuerySpecialPurposeMemoryInformation MiRebuildLargePages MiReferenceRemovePartition MiReleaseImageSection MiReleaseKernelCfgLock MiRelocateImagePfn MiRemoveBadPages MiRemoveFromSystemSpace MiRemoveSharedCommitNode MiRemoveVad MiReserveUserMemory MiReturnImageBase MiSectionCreated MiSectionDelete MiSelectOverflowDllBase MiSelectRelocationStartHint MiSendParkedCoreUpdateToAllChildPartitions MiSetPagesModified MiSetProtectionOnSection MiSetVadDeleted MiShutdownSystem MiSpecialPurposeMemoryRemoved MiSplitPrivatePage MiSplitReducedCommitClonePage MiSubsectionProtosCreated MiTransferFileExtent MiTrimSharedPageFromViews MiTrimUnusedPageFileRegionsWorker MiUnloadHotPatchForUserSid MiUnlockAndDereferenceVad MiUnlockAndDereferenceVadShared MiUnlockControlAreaFileObjectShared MiUnlockControlAreaSectionExtend MiUnlockDriverMappings MiUnlockDynamicMemoryExclusive MiUnlockDynamicMemoryNestedExclusive MiUnlockDynamicMemoryShared MiUnlockFileExtentsExclusive MiUnlockLoaderEntry MiUnlockNestedVad MiUnlockPartitionSystemThreads MiUnlockVad MiUnlockVadRange MiUnlockVadShared MiUpControlAreaRefs MiUpdateImagePfnImportRelocations MiUpdateSpecialPurposeMemoryCacheEligibility MiWalkEntireImage MiZeroAllPageFiles MiZeroPage MiZeroPageMakeHot MiZeroSectionObjectPointer MmCheckProcessShadow MmCommitSessionMappedView MmCreateShadowMapping MmDecodeExportSection MmDeleteShadowMapping MmDuplicateMemory MmEncodeExportSection MmEnumerateBadPages MmExtendSection MmGetPageFileForCrashDump MmLinkJobProcess MmMarkPhysicalMemoryAsBad MmOutSwapVirtualAddresses MmOutSwapWorkingSet MmReleaseLoadLock MmResourcesAvailable MmSetPfnListInfo NormalizationList__Unlock NtAllocateUuids NtAlpcDeleteSectionView NtAlpcOpenSenderProcess NtAlpcRevokeSecurityContext NtAlpcSetInformation NtAreMappedFilesTheSame NtCancelTimer NtChangeProcessState NtChangeThreadState NtCreateUserProcess NtDeleteKey NtDuplicateToken NtNotifyChangeMultipleKeys NtOpenProcessTokenEx NtOpenThreadTokenEx NtQueryInformationProcess NtQueryInformationThread NtQueryInformationThread$fin$3 NtQueryObject NtReleaseKeyedEvent NtSetInformationThread NtSetInformationThread$fin$1 NtSetSystemInformation NtSetUuidSeed NtTerminateProcess NtWaitForKeyedEvent ObCheckRefTraceProcess ObClearProcessDeviceMap ObDereferenceDeviceMap ObDereferenceSecurityDescriptor ObDisableEtwReferenceTrace ObDuplicateObject ObEnableEtwReferenceTrace ObInsertObjectEx ObIsDosDeviceLocallyMapped ObLogSecurityDescriptor ObOpenObjectByNameEx ObQueryDeviceMapInformation ObQueryNameStringMode ObQueryRefTraceInformation ObReleaseObjectSecurity ObpCloseHandle ObpCreateHandle ObpCreateSymbolicLinkName ObpDeleteSymbolicLinkName ObpDeregisterObject ObpFreeWorkItemBlock ObpGetShadowDirectory ObpLockChildDirectory ObpLockUnrelatedDirectoryShared ObpLookupObjectName ObpPushRefDerefInfo ObpReferenceSecurityDescriptorSlow ObpRegisterObject ObpSetCurrentProcessDeviceMap ObpSetDeviceMap ObpSlowReferenceDeviceMap ObpStartRuntimeStackTrace ObpStopRuntimeStackTrace Ordinal_20 Ordinal_21 PdcTaskClientRequest PerfDiagpProxyWorker PfCheckDeprioritizeFile PfCheckDeprioritizeImage PfFileInfoNotify PfGenerateTrace PfProcessExitNotification PfQuerySuperfetchInformation PfSetSuperfetchInformation PfSnBeginAppLaunch PfSnGetPrefetchInstructions PfSnIsHostingApplication PfSnQueryPrefetcherInformation PfSnSetAltPrefetchParam PfTAccessTracingCleanup PfTAccessTracingStart PfTSetTraceWorkerPriority PfTSetTracingPriority PfpParametersPropagate PfpParametersWatcher PfpPrefetchSharedCleanup PfpPrefetchSharedStart PfpRpCHashAddEntries PfpRpCHashDeleteEntries PfpRpCHashEmpty PfpRpCHashGrow PfpRpFileKeyUpdate PfpRpShutdown PfpScenCtxPrefetchAbortSet PfpScenCtxPrefetchStateSet PfpScenCtxPrefetchWait PfpScenCtxQueryScenarioInformation PfpScenCtxScenarioSet PfpScenCtxServiceThreadSet PoFxAbandonDevice PoFxPrepareDevice PoFxStartDevicePowerManagement PoFxSystemLatencyNotify PopBlackBoxDirectAccess PopBlackBoxUpdate PopBootStatCheckIntegrity PopBootStatGet PopBootStatRestoreDefaults PopBootStatSet PopBootStatUnlock PopDiagTraceFxRundown PopDirectedDripsDiagBroadcastTreeBegin PopDirectedDripsDiagBroadcastTreeEnd PopDirectedDripsDiagNotifySessionStart PopDirectedDripsDiagNotifySessionStop PopDirectedDripsDiagTraceBroadcastFailureDevice PopDirectedDripsDiagTraceBroadcastVisit PopDirectedDripsDiagTraceMarkDevice PopDirectedDripsDiagTraceNotifyDevices PopDirectedDripsDiagTraceProblemDevice PopDirectedDripsHandleResiliencyNotification PopDirectedDripsIdleResiliencyCallback PopDirectedDripsNotify PopDirectedDripsNotifyResiliencyCompletionWorker PopFxAcpiPrepareDevice PopFxActivateDevicesForSx PopFxBuildDirectedDripsCandidateDeviceList PopFxBuildDripsBlockingDeviceList PopFxClearDirectedDripsCandidateDeviceList PopFxDisableBasicAccountingWorker PopFxFindAcpiDeviceByUniqueId PopFxFindAndReferenceAcpiDevice PopFxIdleDevicesFromSx PopFxInsertAcpiDevice PopFxInsertDevice PopFxLowPowerEpochCallback PopFxNotifySxTransitionState PopFxPauseDeviceAccounting PopFxPrepareDevicesForShutdown PopFxRegisterDeviceWithPep PopFxRegisterPluginEx PopFxRemoveAcpiDevice PopFxRemoveDevice PopFxResidentTimeoutRoutine PopFxResumeDeviceAccounting PopFxStartDeviceAccounting PopFxStopDeviceAccounting PopFxUpdateVetoMaskWork PopPdcCsDeviceNotification PopPepIdleTimeoutRoutine PopPepInsertDevice PopPepIterateDeviceList PopPepPlatformStateRegistered PopPepRemoveDevice PopPepWork PopPowerButtonBugcheckConfigure PopQueryPowerButtonBugcheckEnabled PsAdjustBasicEnclaveThreadList PsCallEnclave PsCaptureExceptionPort PsCreateVsmEnclave PsDeleteVsmEnclave PsDisableImpersonation PsFreezeProcess PsGetNextProcess PsGetNextProcessThread PsGetProcessDeepFreezeStats PsGetProcessEnclaveModuleInfo PsImpersonateClient PsInitializeVsmEnclave PsIsVsmEnclaveTerminated PsLoadVsmEnclaveData PsQueryProcessEnergyValues PsQueryRuntimeProcess PsQueryStatisticsProcess PsQueryTotalCycleTimeProcess PsReferenceImpersonationToken PsReferenceImpersonationTokenEx PsReferencePartitionSystemProcess PsReferencePrimaryTokenWithTag PsRestoreImpersonation PsSetProcessFaultInformation PsSetProcessTelemetryAppState PsSetProcessWin32Process PsStartSiloMonitor PsSwapImpersonationToken PsSwapProcessWorkingSet PsTerminateMinimalProcess PsTerminateVsmEnclave PsThawMultiProcess PsUnregisterSiloMonitor PsUpdateActiveProcessAffinity PspAllocateAndQueryProcessNotificationChannel PspAllocateThread PspApplyCoreIsolationPolicy PspApplyWorkingSetLimits PspApplyWorkingSetLimitsToProcess PspAssignPrimaryToken PspAssignProcessToJob PspAttachProcessToSyscallProvider PspChangeJobMemoryUsageByProcess PspChargeProcessWakeCounter PspCreatePicoProcess PspDestroySyscallProvider PspDetachProcessFromSyscallProvider PspEnableProcessOptionalXStateFeatures PspExitThread PspGetNextSyscallProviderProcess PspGetPreviousProcessThread PspInheritSyscallProvider PspInsertProcess PspInsertSyscallProvider PspInsertThread PspLookupSyscallProviderById PspMarkServerSiloAsTerminating PspNotifyProcessEffectiveIoLimitChanged PspNotifyServerSiloCreation PspNotifyServerSiloTermination PspProcessClose PspProcessDynamicEHContinuationTargets PspProcessDynamicEnforcedAddressRanges PspReferenceSystemDll PspRemoveEnclaveThreadWait PspRundownSingleProcess PspSelectVsmEnclaveByNumber PspSetJobIoRateControl PspSetProcessAffinityUpdateMode PspSetProcessDefaultHardErrorMode PspSetProcessForegroundBackgroundRequest PspSetProcessTimerDelayForWin32 PspSetQuotaLimits PspStorageAllocSlot PspStorageEmptyArray PspStorageEmptyArrayNonReadonly PspStorageFreeSlot PspStorageGetObject PspStorageInsertObject PspStorageMakeSlotReadOnly PspStorageRemoveObject PspStorageReplaceObject PspSyscallProviderOptIn PspTeardownPartition PspTerminateProcess PspThreadDelete PspUnlockJobAssignment PspUnlockJobListExclusive PspUnlockJobListShared PspUnlockJobMemoryLimitsExclusive PspUnlockJobMemoryLimitsShared PspUnlockJobsAndProcessExclusive PspUnlockProcessExclusive PspUnlockProcessListExclusive PspUnlockProcessListShared PspUnlockQuotaExpansion PspUnlockQuotaListExclusive PspUnlockQuotaListShared PspUpdateSingleProcessAffinity PspWow64ReadOrWriteThreadCpuArea RtlDeleteAtomFromAtomTable RtlDestroyAtomTable RtlEmptyAtomTable RtlFindDynamicEnforcedAddressInRanges RtlInsertDynamicFunctionTable RtlLockBootStatusData RtlLookupAtomInAtomTable RtlPinAtomInAtomTable RtlQueryAtomInAtomTable RtlQueryAtomsInAtomTable RtlRemoveDynamicFunctionTable RtlUnlockBootStatusData RtlpCSparseBitmapUnlock RtlpFindDynamicEHContinuationTarget RtlpFlsAlloc RtlpFlsDataCleanup RtlpFlsFree RtlpFlsSetValueSlot RtlpHpAcquireReleaseLockExclusive RtlpHpCustomVaCallbacksRegistrarRegister RtlpHpCustomVaCallbacksRegistrarUnregister RtlpHpFixedVsAllocate RtlpHpFixedVsFree RtlpHpHeapExtendContext RtlpHpLargeAlloc RtlpHpLargeAllocSetExtraPresent RtlpHpLargeAllocSize RtlpHpLargeFree RtlpHpLfhBucketAddSubsegment RtlpHpLfhBucketGetSubsegment RtlpHpLfhBucketUpdateAffinityMapping RtlpHpLfhContextCompact RtlpHpLfhOwnerCompact RtlpHpLfhSlotAllocate RtlpHpLfhSubsegmentCreate RtlpHpLfhSubsegmentDecommitPages RtlpHpLfhSubsegmentFreeBlock RtlpHpLfhSubsegmentIncBlockCounts RtlpHpReleaseQueuedLockExclusive RtlpHpSegContextCompact RtlpHpSegMgrCommitComplete RtlpHpSegMgrCommitInitiate RtlpHpSegMgrVaCtxAlloc RtlpHpSegMgrVaCtxFree RtlpHpSegMgrVaCtxInsert RtlpHpSegPageRangeAllocate RtlpHpSegPageRangeCoalesce RtlpHpSegPageRangeShrink RtlpHpVaMgrAlloc RtlpHpVaMgrCtxFree RtlpHpVsChunkSplit RtlpHpVsSubsegmentCommitPages RtlpLookupDynamicUserFunctionTable RtlpSetSecurityObject RtlpUnlockAtomTable SLGetSubscriptionPfn SLGetSubscriptionPfn$fin$0 SLGetSubscriptionPfn$fin$1 SLQueryLicenseValueInternal SLUpdateLicenseDataInternal SLUpdateLicenseDataInternal$fin$0 SLUpdateLicenseDataInternal$fin$1 SMKM_STORE<SM_TRAITS>::SmStCleanup SMKM_STORE<SM_TRAITS>::SmStSwapStore SMKM_STORE<SM_TRAITS>::SmStWorker SMKM_STORE<struct_SM_TRAITS>::SmStDirectReadIssue SMKM_STORE<struct_SM_TRAITS>::SmStHelperSendCommand SMKM_STORE<struct_SM_TRAITS>::SmStMapVirtualRegion SMKM_STORE<struct_SM_TRAITS>::SmStOutSwapStore SMKM_STORE<struct_SM_TRAITS>::SmStPrioritizeRegionsStore SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStore SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStoreBatch SMKM_STORE<struct_SM_TRAITS>::SmStUnmapVirtualRegion SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEmpty SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeReadInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys SSHSupportReleasePushLockExclusive ST_STORE<struct_SM_TRAITS>::StDmHandleDecompressionFailure ST_STORE<struct_SM_TRAITS>::StDmPageRemove ST_STORE<struct_SM_TRAITS>::StDmSinglePageCopy ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd SeCaptureSubjectContextEx SeComputeAutoInheritByObjectTypeEx SeDefaultObjectMethod SeRegisterObjectTypeMandatoryPolicy SendCaptureStateNotificationsWorker SepAddLuidToIndexEntry SepAppendAceToTokenObjectAcl SepDeReferenceSharedSidEntries SepDeleteSessionLowboxEntries SepDereferenceCachedHandlesEntry SepDereferenceLowBoxNumberEntry SepInsertOrReferenceSharedSidEntries SepIsParentOfChildAppContainer SepIsValidProcUniqueLuid SepRmCapUpdateWrkr SepRmReferenceFindCap SepSetTokenCachedHandles SepSetTokenClaims SepSetTokenLowboxNumber SepSetTokenUserAndGroups SmCreatePartition SmDeletePartition SmEtwEnableCallback SmFirstTimeInit SmGetRegistrationInfo SmKmKeyGenGenerate SmKmKeyGenKeyDelete SmKmKeyGenNewKey SmKmStoreAdd SmKmStoreDelete SmKmVirtualLockContextIncreaseWsMin SmKmVirtualLockCtxLockMemory SmKmVirtualLockCtxMemoryUnlocked SmPartitionJobPaired SmProcessCompressionInfoRequest SmcCacheAdd SmcCacheCreatePrepare SmcCacheRemove SmcGetCacheStats SmcStoreDelete SmcStoreResize SmcStoreSlotAbort SmcStoreSlotCommit SmcStoreSlotReserve SmpKeyedStoreEntryGet SmpKeyedStoreReference SmpKeyedStoreSetVaRanges SmpSystemStoreCreate SshpSetCollectionActive TlgAggregateInternalProviderCallback TlgRegisterAggregateProviderEx UNLOCK_ADDRESS_SPACE_SHARED UNLOCK_ADDRESS_SPACE_SHARED_UNORDERED UNLOCK_ADDRESS_SPACE_UNORDERED UNLOCK_HIVE_LOAD UNLOCK_PAGE_TABLE_COMMITMENT VmCreateMemoryRange VmDeleteMemoryRange VmMergeMemoryRanges VmPinMemoryRange VmSplitMemoryRange VmUnpinMemoryRange VmpCleanProcessAddressSpace VmpPauseResumeNotify VrpDecrementSiloCount VrpDereferenceDiffHiveEntry VrpFindDiffHiveEntryForMountPoint VrpFindOrCreateDiffHiveEntryForMountPoint VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlLoadDifferencingHive VrpHandleIoctlLoadDifferencingHiveForHost VrpHandleIoctlModifyFlags VrpHandleIoctlUnloadDifferencingHiveForHost VrpHandleIoctlUnloadDynamicallyLoadedHives VrpIncrementSiloCount VrpLoadDifferencingHive VrpPostEnumerateKey VrpPostUnloadKey VrpPreLoadKey VrpPreUnloadKey VrpRelinquishDiffHiveEntryTransitionOwner VrpTranslatePath VrpUnloadDifferencingHive VrpWaitForDiffHiveEntryTransitionOwnerToLeave VslpLockPagesForTransfer VslpUnlockPagesForTransfer WbAddHeapExecutedBlockToCache WbAddHeapExecutedBlockToLRU WbAddWarbirdEncryptionSegment WbAllocateSlots WbAllocateUserMemory WbDecryptEncryptionSegment WbFreeMemoryBlockRegion WbGetHeapExecutedBlock WbGetInitializedEncryptionSegment WbGetWarbirdEncryptionSegment WbGetWarbirdProcess WbGetWarbirdThread WbHeapExecutionUnloadModule WbInPlaceEncryptionUnloadModule WbMoveHeapExecutedBlockToBackOfLRU WbReEncryptEncryptionSegment WbReleaseLeastRecentlyUsedHeapExecutedBlocks WbRemoveWarbirdProcess WheaConfigureErrorSource WheaExecuteRowFailureCheck WheaInitialize WheaRegisterErrorSourceOverride WheaRegisterInUsePageOfflineNotification WheaSelLogCheckPoint WheaSelLogSetNtSchedulerAvailability WheaUnconfigureErrorSource WheaUnregisterErrorSourceOverride WheaUnregisterInUsePageOfflineNotification WheapCallInUsePageNotificationCallbacks WheapPfaReset WheapPredictiveFailureAnalysis
paramcount
0
0
address
140327ab0
140327aa0
sig
undefined KeAbPostRelease(void)
undefined KeAbPostRelease(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
KeAbPostRelease Calling Diff
--- KeAbPostRelease calling
+++ KeAbPostRelease calling
@@ -349,4 +349,4 @@
- FUN_14036f764
- FUN_140707984
- FUN_1409fa120
- FUN_1409fa77c
+ FUN_14036f754
+ FUN_140708238
+ FUN_1409fa0b0
+ FUN_1409fa70c
@@ -990 +989,0 @@
- VrpHandleIoctlInitializeJobForVreg
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
1.0
i_ratio
0.8
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
RtlUShortAdd
RtlUShortAdd
fullname
RtlUShortAdd
RtlUShortAdd
refcount
19
21
length
30
30
called
calling
AslPathWildcardFindFirst AslpPathWildcardAllocMatchNode FsRtlValidateReparsePointBuffer IopAllocateUnicodeString PspSiloInitializeSystemRootSymlink RtlAddResourceAttributeAce RtlpCreateServerAcl SepAddTokenOriginClaim VfSuspectDriversAllocateEntry _SysCtxRegOpenCurrentUserKey
Expand for full list: AslPathWildcardFindFirst AslpPathWildcardAllocMatchNode FsRtlValidateReparsePointBuffer IopAllocateUnicodeString PspSiloInitializeSystemRootSymlink RtlAddResourceAttributeAce RtlpCreateServerAcl SepAddTokenOriginClaim VfSuspectDriversAllocateEntry VrpBuildKeyPath _SysCtxRegOpenCurrentUserKey
paramcount
0
0
address
1402a68c4
1402a6664
sig
undefined RtlUShortAdd(void)
undefined RtlUShortAdd(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
RtlUShortAdd Calling Diff
--- RtlUShortAdd calling
+++ RtlUShortAdd calling
@@ -9,0 +10 @@
+ VrpBuildKeyPath
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.93
i_ratio
0.76
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
RtlEqualUnicodeString
RtlEqualUnicodeString
fullname
RtlEqualUnicodeString
RtlEqualUnicodeString
refcount
140
142
length
382
382
called
PsGetCurrentServerSiloGlobals
PsGetCurrentServerSiloGlobals
calling
Expand for full list: AdtpBuildAccessesString AdtpLookupDriveLetter AuthzBasepCompareUnicodeStringOperands AuthzBasepEqualUnicodeString AuthzBasepFindSecurityAttribute CmGetSystemDriverList CmLoadAppKey CmSetValueKey CmpCreateHardwareProfiles CmpDoSort CmpFindHiveSubKey CmpFindMachineHiveByMountPoint CmpGetKnownHivePathNode DrvDbFindDatabaseNode EtwpAcquireLoggerContextByLoggerName EtwpGetLoggerInfoFromContext EtwpLookupLoggerIdByName ExpFindArcName ExpPrmInitialization FUN_140b1a730 IopCreateSecureDeviceClassSettings IopDeviceInterfaceFilterCallback IopGetDeviceInterfaces IopIsReportedAlready IopParseDevice IopQueryRegistryKeySystemPath KseHookQueryValueKey KsepCacheDeviceQueryData MiInsertPreviouslyRegisteredHotPatchRecord MiObtainSectionForDriver MiResolveImageReferences MiUseLargeDriverPage ObpLookupDirectoryUsingHash PiDevCfgCheckDeviceNeedsUpdate PiDevCfgConfigureDevice PiDevCfgLogDeviceConfigured PiDevCfgQueryIncludedDriverConfigurations PiDevCfgResolveMultiSzValue PiDevCfgResolveVariable PiDrvDbFindNode PiDrvDbResolveFilePathKeyValues PiDrvDbResolveSystemFilePath PiFindDevInstMatch PiPnpRtlInit PiPnpRtlServiceFilterCallback PiRemoveDeferredSetInterfaceState PiUEventQueueBroadcastEventEntry PipAddRequestToEdge PipDeleteBindingId PipFindDeviceOverrideEntry PipLookupGroupName PipQueryBindingResolution PnpLoadBootFilterDriver PnpMultiSzContainsString PopBatteryDeviceState PopEmModuleAddressMatchCallback PopEmUpdateDeviceConstraintCallback PpInitGetGroupOrderIndex PspIdentityBasedJobBreakaway RtlDeriveCapabilitySidsFromName RtlpGetNtProductTypeFromRegistry SLQueryLicenseValueInternal SepGetCachedHandlesEntry SepIsImageInMinTcbList SepIsNgenImage SepValidateReferencedCachedHandles VfAddVerifierEntry VfCheckUserHandle VfDriverApplyDifVerification VfDriverEnableVerifier VfDriverLoadImage VfDriverLoadSucceeded VfDriverRemoveAllDifVerification VfDriverRemoveDifVerification VfFilterAttach VfInitBootDriversLoaded VfSuspectDriversLoadCallback VfSuspectDriversUnloadCallback ViDriverReApplyVerifierForAll ViInitSystemPhase0 ViIsDriverSuspectForVerifier ViLogAndLoadXdv ViSuspectDriversLookupEntry VrpCreateNamespaceNode VrpFindDiffHiveEntryForMountPointWithLock VrpHandleIoctlUnloadDifferencingHiveForHost VrpPreLoadKey _CmClassFilterCallback _CmDeviceClassesSubkeyCallback _CmIsRootDevice _CmServiceFilterCallback _PnpCtxFindNode
Expand for full list: AdtpBuildAccessesString AdtpLookupDriveLetter AuthzBasepCompareUnicodeStringOperands AuthzBasepEqualUnicodeString AuthzBasepFindSecurityAttribute CmGetSystemDriverList CmLoadAppKey CmSetValueKey CmpCreateHardwareProfiles CmpDoSort CmpFindHiveSubKey CmpFindMachineHiveByMountPoint CmpGetKnownHivePathNode DrvDbFindDatabaseNode EtwpAcquireLoggerContextByLoggerName EtwpGetLoggerInfoFromContext EtwpLookupLoggerIdByName ExpFindArcName ExpPrmInitialization FUN_140b1a730 IopCreateSecureDeviceClassSettings IopDeviceInterfaceFilterCallback IopGetDeviceInterfaces IopIsReportedAlready IopParseDevice IopQueryRegistryKeySystemPath KseHookQueryValueKey KsepCacheDeviceQueryData MiInsertPreviouslyRegisteredHotPatchRecord MiObtainSectionForDriver MiResolveImageReferences MiUseLargeDriverPage ObpLookupDirectoryUsingHash PiDevCfgCheckDeviceNeedsUpdate PiDevCfgConfigureDevice PiDevCfgLogDeviceConfigured PiDevCfgQueryIncludedDriverConfigurations PiDevCfgResolveMultiSzValue PiDevCfgResolveVariable PiDrvDbFindNode PiDrvDbResolveFilePathKeyValues PiDrvDbResolveSystemFilePath PiFindDevInstMatch PiPnpRtlInit PiPnpRtlServiceFilterCallback PiRemoveDeferredSetInterfaceState PiUEventQueueBroadcastEventEntry PipAddRequestToEdge PipDeleteBindingId PipFindDeviceOverrideEntry PipLookupGroupName PipQueryBindingResolution PnpLoadBootFilterDriver PnpMultiSzContainsString PopBatteryDeviceState PopEmModuleAddressMatchCallback PopEmUpdateDeviceConstraintCallback PpInitGetGroupOrderIndex PspIdentityBasedJobBreakaway RtlDeriveCapabilitySidsFromName RtlpGetNtProductTypeFromRegistry SLQueryLicenseValueInternal SepGetCachedHandlesEntry SepIsImageInMinTcbList SepIsNgenImage SepValidateReferencedCachedHandles VfAddVerifierEntry VfCheckUserHandle VfDriverApplyDifVerification VfDriverEnableVerifier VfDriverLoadImage VfDriverLoadSucceeded VfDriverRemoveAllDifVerification VfDriverRemoveDifVerification VfFilterAttach VfInitBootDriversLoaded VfSuspectDriversLoadCallback VfSuspectDriversUnloadCallback ViDriverReApplyVerifierForAll ViInitSystemPhase0 ViIsDriverSuspectForVerifier ViLogAndLoadXdv ViSuspectDriversLookupEntry VrpCreateNamespaceNode VrpFindDiffHiveEntryForMountPointWithLock VrpHandleIoctlUnloadDifferencingHiveForHost VrpPreLoadKey VrpPreOpenOrCreate _CmClassFilterCallback _CmDeviceClassesSubkeyCallback _CmIsRootDevice _CmServiceFilterCallback _PnpCtxFindNode
paramcount
0
0
address
1407cf480
1407cfe90
sig
undefined RtlEqualUnicodeString(void)
undefined RtlEqualUnicodeString(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
RtlEqualUnicodeString Calling Diff
--- RtlEqualUnicodeString calling
+++ RtlEqualUnicodeString calling
@@ -87,0 +88 @@
+ VrpPreOpenOrCreate
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,length,calling
ratio
1.0
i_ratio
0.74
m_ratio
0.95
b_ratio
0.99
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
SeReleaseSubjectContext
SeReleaseSubjectContext
fullname
SeReleaseSubjectContext
SeReleaseSubjectContext
refcount
160
161
length
287
274
called
ObfDereferenceObjectWithTag ObpPushStackInfo
ObfDereferenceObjectWithTag ObpPushStackInfo
calling
Expand for full list: AlpcpCheckConnectionSecurity CMFCheckAccess CmFcInitSystem2 CmKeyBodyRemapToVirtual CmKeyBodyRemapToVirtualForEnum CmKeyBodyReplicateToVirtual CmQueryKey CmQueryLayeredKey CmUpdateFeatureConfiguration CmUpdateFeatureUsageSubscription CmpCheckHivePrimaryFileReadWriteAccess CmpCheckKeySecurityDescriptorAccess CmpDoAccessCheckOnKCB CmpDoBuildVirtualStack CmpDoParseKey CmpFlushNotify CmpIsSystemEntity CmpLogHiveFileInaccessible CmpSetKeySecurity EtwpAccessCheck EtwpCheckProviderLoggingAccess EtwpCoverageUserIsAdmin EtwpFindOrCreateGuidEntry ExCheckFullProcessInformationAccess ExCpuSetResourceManagerAccessCheck ExIsRestrictedCaller ExpCheckWakeTimerAccess ExpWnfCheckCallerAccess FUN_140687e40 FsRtlCancelNotify FsRtlCancelNotify$fin$1 FsRtlNotifyCleanup FsRtlNotifyCleanup$fin$0 FsRtlNotifyCleanupAll FsRtlNotifyFilterChangeDirectory FsRtlNotifyFilterChangeDirectory$fin$0 FsRtlNotifyFilterChangeDirectoryLite FsRtlNotifyFilterChangeDirectoryLite$fin$0 IoCheckRedirectionTrustLevel IoComputeRedirectionTrustLevel IoGetDeviceInterfaceAlias IopGetDeviceInterfaces IopXxxControlFile NtCloseObjectAuditAlarm NtCreateUserProcess NtDeleteKey NtDeleteObjectAuditAlarm NtDeleteValueKey NtGetNextProcess NtGetNextThread NtImpersonateAnonymousToken NtOpenObjectAuditAlarm NtPrivilegeObjectAuditAlarm NtPrivilegedServiceAuditAlarm NtRenameKey NtSetInformationFile NtSetInformationJobObject NtSetInformationKey NtSetUuidSeed NtSetValueKey ObDuplicateObject ObInsertObjectEx ObOpenObjectByPointer ObReferenceObjectByName ObReferenceObjectByNameEx ObpCaptureBoundaryDescriptor ObpGetIntegrityLevel ObpVerifyCreatorAccessCheck PiAuCheckTokenMembership PiAuDoesClientHavePrivilege PiAuVerifyAccessToObject PiCMGetDeviceIdList PiCMValidateDeviceInstance PiDqOpenUserObjectRegKey PiDqQueryRelease PiPnpRtlObjectEventRelease PiUEventFreeClientRegistrationContext PnpGetCallerSessionId PopBootStatAccessCheck PsCreateMinimalProcess PsOpenProcess PsOpenThread PspCombineSecurityDomains PspCreateProcess PspInsertProcess PspInsertThread PspIsContextAdmin PspIumVerifyParentSd PspOneDirectionSecurityDomainCombine PspSetQuotaLimits RtlCheckTokenCapability RtlCheckTokenMembershipEx RtlIsSandboxedToken SeAccessCheckByType SeAdtRegistryValueChangedAuditAlarm SeAuditBootConfiguration SeAuditFipsCryptoSelftests SeAuditHandleDuplication SeAuditHardLinkCreationWithTransaction SeAuditPlugAndPlay SeAuditProcessCreation SeAuditSystemTimeChange SeAuditTransactionStateChange SeAuditingWithTokenForSubcategory SeCheckPrivilegedObject SeCloseObjectAuditAlarm SeDeleteAccessState SeDeleteObjectAuditAlarmWithTransaction SeIsAppContainerOrIdentifyLevelContext SeOpenObjectAuditAlarmWithTransaction SeOperationAuditAlarm SeReportSecurityEventWithSubCategory SeSecurityDescriptorChangedAuditAlarm SeSinglePrivilegeCheck SeSubProcessToken SeTokenDefaultDaclChangedAuditAlarm SepAccessCheckAndAuditAlarm SepAdtAuditThisEventByCategoryWithContext SepAdtAuditThisEventWithContext SepAdtTokenRightAdjusted SepAuditAssignPrimaryToken SepCheckCreateLowBox SepCopyAnonymousTokenAndSetSilo SepFilterToken VfUtilIsLocalSystem WdipAccessCheck WmipCreateGuidObject
Expand for full list: AlpcpCheckConnectionSecurity CMFCheckAccess CmFcInitSystem2 CmKeyBodyRemapToVirtual CmKeyBodyRemapToVirtualForEnum CmKeyBodyReplicateToVirtual CmQueryKey CmQueryLayeredKey CmSetValueKey CmUpdateFeatureConfiguration CmUpdateFeatureUsageSubscription CmpCheckHivePrimaryFileReadWriteAccess CmpCheckKeySecurityDescriptorAccess CmpDoAccessCheckOnKCB CmpDoBuildVirtualStack CmpDoParseKey CmpFlushNotify CmpIsSystemEntity CmpLogHiveFileInaccessible CmpSetKeySecurity EtwpAccessCheck EtwpCheckProviderLoggingAccess EtwpCoverageUserIsAdmin EtwpFindOrCreateGuidEntry ExCheckFullProcessInformationAccess ExCpuSetResourceManagerAccessCheck ExIsRestrictedCaller ExpCheckWakeTimerAccess ExpWnfCheckCallerAccess FUN_140687e40 FsRtlCancelNotify FsRtlCancelNotify$fin$1 FsRtlNotifyCleanup FsRtlNotifyCleanup$fin$0 FsRtlNotifyCleanupAll FsRtlNotifyFilterChangeDirectory FsRtlNotifyFilterChangeDirectory$fin$0 FsRtlNotifyFilterChangeDirectoryLite FsRtlNotifyFilterChangeDirectoryLite$fin$0 IoCheckRedirectionTrustLevel IoComputeRedirectionTrustLevel IoGetDeviceInterfaceAlias IopGetDeviceInterfaces IopXxxControlFile NtCloseObjectAuditAlarm NtCreateUserProcess NtDeleteKey NtDeleteObjectAuditAlarm NtDeleteValueKey NtGetNextProcess NtGetNextThread NtImpersonateAnonymousToken NtOpenObjectAuditAlarm NtPrivilegeObjectAuditAlarm NtPrivilegedServiceAuditAlarm NtRenameKey NtSetInformationFile NtSetInformationJobObject NtSetInformationKey NtSetUuidSeed NtSetValueKey ObDuplicateObject ObInsertObjectEx ObOpenObjectByPointer ObReferenceObjectByName ObReferenceObjectByNameEx ObpCaptureBoundaryDescriptor ObpGetIntegrityLevel ObpVerifyCreatorAccessCheck PiAuCheckTokenMembership PiAuDoesClientHavePrivilege PiAuVerifyAccessToObject PiCMGetDeviceIdList PiCMValidateDeviceInstance PiDqOpenUserObjectRegKey PiDqQueryRelease PiPnpRtlObjectEventRelease PiUEventFreeClientRegistrationContext PnpGetCallerSessionId PopBootStatAccessCheck PsCreateMinimalProcess PsOpenProcess PsOpenThread PspCombineSecurityDomains PspCreateProcess PspInsertProcess PspInsertThread PspIsContextAdmin PspIumVerifyParentSd PspOneDirectionSecurityDomainCombine PspSetQuotaLimits RtlCheckTokenCapability RtlCheckTokenMembershipEx RtlIsSandboxedToken SeAccessCheckByType SeAdtRegistryValueChangedAuditAlarm SeAuditBootConfiguration SeAuditFipsCryptoSelftests SeAuditHandleDuplication SeAuditHardLinkCreationWithTransaction SeAuditPlugAndPlay SeAuditProcessCreation SeAuditSystemTimeChange SeAuditTransactionStateChange SeAuditingWithTokenForSubcategory SeCheckPrivilegedObject SeCloseObjectAuditAlarm SeDeleteAccessState SeDeleteObjectAuditAlarmWithTransaction SeIsAppContainerOrIdentifyLevelContext SeOpenObjectAuditAlarmWithTransaction SeOperationAuditAlarm SeReportSecurityEventWithSubCategory SeSecurityDescriptorChangedAuditAlarm SeSinglePrivilegeCheck SeSubProcessToken SeTokenDefaultDaclChangedAuditAlarm SepAccessCheckAndAuditAlarm SepAdtAuditThisEventByCategoryWithContext SepAdtAuditThisEventWithContext SepAdtTokenRightAdjusted SepAuditAssignPrimaryToken SepCheckCreateLowBox SepCopyAnonymousTokenAndSetSilo SepFilterToken VfUtilIsLocalSystem WdipAccessCheck WmipCreateGuidObject
paramcount
0
0
address
1406adee0
1406adee0
sig
undefined SeReleaseSubjectContext(void)
undefined SeReleaseSubjectContext(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
SeReleaseSubjectContext Calling Diff
--- SeReleaseSubjectContext calling
+++ SeReleaseSubjectContext calling
@@ -8,0 +9 @@
+ CmSetValueKey
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.96
i_ratio
0.79
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
VrpDestroyNamespaceNode
VrpDestroyNamespaceNode
fullname
VrpDestroyNamespaceNode
VrpDestroyNamespaceNode
refcount
9
8
length
690
690
called
ExAllocatePoolWithTag ExFreePoolWithTag ObDereferenceObjectDeferDeleteWithTag RtlCopyMemory VrpFindExactNamespaceNode ZwClose ZwDeleteKey ZwOpenKey memset
ExAllocatePoolWithTag ExFreePoolWithTag ObDereferenceObjectDeferDeleteWithTag RtlCopyMemory VrpFindExactNamespaceNode ZwClose ZwDeleteKey ZwOpenKey memset
calling
VrpCleanupNamespace VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlInitializeJobForVreg VrpHandleIoctlUnloadDynamicallyLoadedHives VrpPostUnloadKey VrpPreLoadKey
VrpCleanupNamespace VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlUnloadDynamicallyLoadedHives VrpPostUnloadKey VrpPreLoadKey
paramcount
0
0
address
14075aee4
14075b8f4
sig
undefined VrpDestroyNamespaceNode(void)
undefined VrpDestroyNamespaceNode(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
VrpDestroyNamespaceNode Calling Diff
--- VrpDestroyNamespaceNode calling
+++ VrpDestroyNamespaceNode calling
@@ -4 +3,0 @@
- VrpHandleIoctlInitializeJobForVreg
CmpDetachFromRegistryProcess
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount
ratio
1.0
i_ratio
0.8
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
CmpDetachFromRegistryProcess
CmpDetachFromRegistryProcess
fullname
CmpDetachFromRegistryProcess
CmpDetachFromRegistryProcess
refcount
76
77
length
16
16
called
KiUnstackDetachProcess
KiUnstackDetachProcess
calling
Expand for full list: CmCallbackGetKeyObjectID CmCallbackGetKeyObjectIDEx CmDeleteKey CmDeleteValueKey CmEnumerateKey CmEnumerateValueKey CmEtwRunDown CmGetSystemDriverList CmInitSystem1 CmKeyBodyRemapToVirtual CmKeyBodyRemapToVirtualForEnum CmKeyBodyReplicateToVirtual CmLoadAppKey CmLoadKey CmQueryKey CmQueryKey$fin$0 CmQueryValueKey CmReconcileAndValidateAllHives CmReplaceKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmShutdownSystem1 CmShutdownSystem2 CmpCleanUpKCBCacheTable CmpCleanupLightWeightTransaction CmpCleanupTransactionState CmpCreateHive CmpDelayCloseWorker CmpDoBuildVirtualStack CmpDoParseKey CmpDoQueryKeyName CmpEtwDumpKcb CmpFlushBackupHive CmpForceFlushWorker CmpFreeAllMemory CmpHandlePageFileOpenNotification CmpInitHiveFromFile CmpLateUnloadHiveWorker CmpLinkHiveToMaster CmpLoadKeyCommon CmpPerformUnloadKey CmpPublishEventForPcaResolver CmpRmUnDoPhase CmpSaveBootControlSet CmpSearchKeyControlBlockTreeEx CmpSetKeySecurity CmpTransMgrCommit CmpTransMgrPrepare NtCommitRegistryTransaction NtCompressKey NtEnumerateValueKey NtFlushKey NtFreezeRegistry NtQueryMultipleValueKey NtQueryOpenSubKeys NtQueryOpenSubKeysEx NtRenameKey NtRestoreKey NtRollbackRegistryTransaction NtSaveKeyEx NtSaveMergedKeys NtThawRegistry
Expand for full list: CmCallbackGetKeyObjectID CmCallbackGetKeyObjectIDEx CmDeleteKey CmDeleteValueKey CmEnumerateKey CmEnumerateValueKey CmEtwRunDown CmGetSystemDriverList CmInitSystem1 CmKeyBodyRemapToVirtual CmKeyBodyRemapToVirtualForEnum CmKeyBodyReplicateToVirtual CmLoadAppKey CmLoadKey CmQueryKey CmQueryKey$fin$0 CmQueryValueKey CmReconcileAndValidateAllHives CmReplaceKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmShutdownSystem1 CmShutdownSystem2 CmpCleanUpKCBCacheTable CmpCleanupLightWeightTransaction CmpCleanupTransactionState CmpCreateHive CmpDelayCloseWorker CmpDoBuildVirtualStack CmpDoParseKey CmpDoQueryKeyName CmpEtwDumpKcb CmpFlushBackupHive CmpForceFlushWorker CmpFreeAllMemory CmpHandlePageFileOpenNotification CmpInitHiveFromFile CmpLateUnloadHiveWorker CmpLinkHiveToMaster CmpLoadKeyCommon CmpPerformUnloadKey CmpPublishEventForPcaResolver CmpRmUnDoPhase CmpSaveBootControlSet CmpSearchKeyControlBlockTreeEx CmpSetKeySecurity CmpTransMgrCommit CmpTransMgrPrepare NtCommitRegistryTransaction NtCompressKey NtEnumerateValueKey NtFlushKey NtFreezeRegistry NtQueryMultipleValueKey NtQueryOpenSubKeys NtQueryOpenSubKeysEx NtRenameKey NtRestoreKey NtRollbackRegistryTransaction NtSaveKeyEx NtSaveMergedKeys NtThawRegistry
paramcount
0
0
address
140af63f0
140af63f0
sig
undefined CmpDetachFromRegistryProcess(void)
undefined CmpDetachFromRegistryProcess(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
CmpRollbackTransactionArray
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address
ratio
1.0
i_ratio
0.78
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
CmpRollbackTransactionArray
CmpRollbackTransactionArray
fullname
CmpRollbackTransactionArray
CmpRollbackTransactionArray
refcount
7
6
length
190
190
called
CmpRetryBackOff CmpRollbackLightWeightTransaction CmpTransDereferenceTransaction ExFreePoolWithTag ObfDereferenceObject TmRollbackEnlistment
CmpRetryBackOff CmpRollbackLightWeightTransaction CmpTransDereferenceTransaction ExFreePoolWithTag ObfDereferenceObject TmRollbackEnlistment
calling
CmDeleteKey CmDeleteValueKey CmSetValueKey CmpParseKey CmpSetKeySecurity
CmDeleteKey CmDeleteValueKey CmSetValueKey CmpParseKey CmpSetKeySecurity
paramcount
0
0
address
140a1f2c4
140a1f254
sig
undefined CmpRollbackTransactionArray(void)
undefined CmpRollbackTransactionArray(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.98
i_ratio
0.81
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
VrpCreateNamespaceNode
VrpCreateNamespaceNode
fullname
VrpCreateNamespaceNode
VrpCreateNamespaceNode
refcount
6
5
length
745
745
called
ExAllocatePool2 ExFreePoolWithTag ObfReferenceObjectWithTag RtlCopyMemory RtlEqualUnicodeString VrpBuildKeyPath VrpCountPathComponents VrpFindBestMatchNamespaceNode VrpGetNextToken VrpStripTrailingCharacters
ExAllocatePool2 ExFreePoolWithTag ObfReferenceObjectWithTag RtlCopyMemory RtlEqualUnicodeString VrpBuildKeyPath VrpCountPathComponents VrpFindBestMatchNamespaceNode VrpGetNextToken VrpStripTrailingCharacters
calling
VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpHandleIoctlInitializeJobForVreg VrpPreLoadKey
VrpHandleIoctlCreateMultipleNamespaceNodes VrpHandleIoctlCreateNamespaceNode VrpPreLoadKey
paramcount
7
7
address
14075b0f8
14075bb08
sig
undefined VrpCreateNamespaceNode(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5, undefined4 param_6, undefined8 param_7)
undefined VrpCreateNamespaceNode(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5, undefined4 param_6, undefined8 param_7)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
VrpCreateNamespaceNode Calling Diff
--- VrpCreateNamespaceNode calling
+++ VrpCreateNamespaceNode calling
@@ -3 +2,0 @@
- VrpHandleIoctlInitializeJobForVreg
CmpFindNameInListWithStatus
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address
ratio
1.0
i_ratio
0.78
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
CmpFindNameInListWithStatus
CmpFindNameInListWithStatus
fullname
CmpFindNameInListWithStatus
CmpFindNameInListWithStatus
refcount
12
11
length
190
190
called
CmpFindNameInListCellWithStatus HvpGetCellContextReinitialize HvpGetCellFlat HvpGetCellPaged HvpReleaseCellFlat HvpReleaseCellPaged
CmpFindNameInListCellWithStatus HvpGetCellContextReinitialize HvpGetCellFlat HvpGetCellPaged HvpReleaseCellFlat HvpReleaseCellPaged
calling
CmDeleteValueKey CmQueryMultipleValueForLayeredKey CmSetValueKey CmpCompareNewValueDataAgainstKCBCache CmpFindNameInList CmpGetSymbolicLinkTarget CmpMergeKeyValues
CmDeleteValueKey CmQueryMultipleValueForLayeredKey CmSetValueKey CmpCompareNewValueDataAgainstKCBCache CmpFindNameInList CmpGetSymbolicLinkTarget CmpMergeKeyValues
paramcount
6
6
address
1406b5cc4
1406b6084
sig
undefined CmpFindNameInListWithStatus(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5, undefined8 param_6)
undefined CmpFindNameInListWithStatus(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5, undefined8 param_6)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
CmpLogTransactionAbortedWithChildName
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address
ratio
0.91
i_ratio
0.77
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
CmpLogTransactionAbortedWithChildName
CmpLogTransactionAbortedWithChildName
fullname
CmpLogTransactionAbortedWithChildName
CmpLogTransactionAbortedWithChildName
refcount
19
18
length
470
470
called
CmpAllocatePool CmpConstructNameFromKcbNameBlocks CmpFreePoolWithTag CmpLogTransactionAbortedByName RtlInitUnicodeString RtlUnicodeStringCat RtlUnicodeStringCopy RtlUnicodeStringValidateDestWorker SmFreeWrapper _tlgKeywordOn
CmpAllocatePool CmpConstructNameFromKcbNameBlocks CmpFreePoolWithTag CmpLogTransactionAbortedByName RtlInitUnicodeString RtlUnicodeStringCat RtlUnicodeStringCopy RtlUnicodeStringValidateDestWorker SmFreeWrapper _tlgKeywordOn
calling
CmDeleteValueKey CmRenameKey CmRestoreKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmpCreateChild CmpLogTransactionAbortedForRollbackPacket CmpPerformUnloadKey CmpSaveBootControlSet
CmDeleteValueKey CmRenameKey CmRestoreKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmpCreateChild CmpLogTransactionAbortedForRollbackPacket CmpPerformUnloadKey CmpSaveBootControlSet
paramcount
5
5
address
1407a3f38
1407a4948
sig
undefined CmpLogTransactionAbortedWithChildName(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5)
undefined CmpLogTransactionAbortedWithChildName(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
MmProbeAndLockPagesPrivate
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
1.0
i_ratio
0.83
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
MmProbeAndLockPagesPrivate
MmProbeAndLockPagesPrivate
fullname
MmProbeAndLockPagesPrivate
MmProbeAndLockPagesPrivate
refcount
2
6
length
22
22
called
MiProbeAndLockPages
MiProbeAndLockPages
calling
WbMakeUserExecutablePagesKernelWritable
FUN_14070897c WbMakeUserExecutablePagesKernelWritable
paramcount
0
0
address
140269d00
140269aa0
sig
undefined MmProbeAndLockPagesPrivate(void)
undefined MmProbeAndLockPagesPrivate(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
MmProbeAndLockPagesPrivate Calling Diff
--- MmProbeAndLockPagesPrivate calling
+++ MmProbeAndLockPagesPrivate calling
@@ -0,0 +1 @@
+ FUN_14070897c
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address
ratio
1.0
i_ratio
0.82
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
CmpUnlockKcbStack
CmpUnlockKcbStack
fullname
CmpUnlockKcbStack
CmpUnlockKcbStack
refcount
73
72
length
79
79
called
CmpUnlockKcb
CmpUnlockKcb
calling
Expand for full list: CmCallbackGetKeyObjectID CmCallbackGetKeyObjectIDEx CmDeleteKey CmDeleteLayeredKey CmDeleteValueKey CmEnumerateValueFromLayeredKey CmOpenKeyForBugCheckRecovery CmQueryLayeredKey CmQueryMultipleValueForLayeredKey CmQueryValueKey CmSaveKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmpAssignKeySecurity CmpDoBuildVirtualStack CmpDoParseKey CmpEnumerateLayeredKey CmpGetSymbolicLinkTarget CmpPromoteKey CmpQueryKeySecurity CmpSetKeySecurity CmpStartSiloRegistryNamespace
Expand for full list: CmCallbackGetKeyObjectID CmCallbackGetKeyObjectIDEx CmDeleteKey CmDeleteLayeredKey CmDeleteValueKey CmEnumerateValueFromLayeredKey CmOpenKeyForBugCheckRecovery CmQueryLayeredKey CmQueryMultipleValueForLayeredKey CmQueryValueKey CmSaveKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmpAssignKeySecurity CmpDoBuildVirtualStack CmpDoParseKey CmpEnumerateLayeredKey CmpGetSymbolicLinkTarget CmpPromoteKey CmpQueryKeySecurity CmpSetKeySecurity CmpStartSiloRegistryNamespace
paramcount
0
0
address
1406b58ec
1406b5cac
sig
undefined CmpUnlockKcbStack(void)
undefined CmpUnlockKcbStack(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount
ratio
1.0
i_ratio
0.5
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
CmpUnlockRegistry
CmpUnlockRegistry
fullname
CmpUnlockRegistry
CmpUnlockRegistry
refcount
214
213
length
56
56
called
CmpRecordRegistryLockRelease ExReleaseResourceLite KeLeaveCriticalRegion PsBoostThreadIo
CmpRecordRegistryLockRelease ExReleaseResourceLite KeLeaveCriticalRegion PsBoostThreadIo
calling
Expand for full list: CmCallbackGetKeyObjectID CmCallbackGetKeyObjectIDEx CmCompleteRegistryInitialization CmDeleteKey CmDeleteLayeredKey CmDeleteValueKey CmDumpKeyToFile CmEnumerateKey CmEnumerateValueKey CmEnumerateValueKeyFromMergedView CmEtwRunDown CmFreezeRegistry CmGetSystemDriverList CmInitSystem1 CmKeyBodyNeedsVirtualImage CmKeyBodyRemapToVirtual CmKeyBodyRemapToVirtualForEnum CmKeyBodyReplicateToVirtual CmLoadAppKey CmLoadDifferencingKey CmLockKeyForWrite CmNotifyRunDown CmOpenKey CmOpenKeyForBugCheckRecovery CmQueryKey CmQueryKey$fin$0 CmQueryMultipleValueKey CmQueryValueKey CmReleaseLoadKeyContext CmRenameKey CmReplaceKey CmRestoreKey CmSaveKey CmSaveMergedKeys CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmShutdownSystem1 CmShutdownSystem2 CmThawRegistry CmpAssignKeySecurity CmpBecomeActiveFlusherAndReconciler CmpCleanupLightWeightTransaction CmpCleanupParseContext CmpCleanupTransactionState CmpCloneHwProfile CmpCloseKeyObject CmpCommitLightWeightTransaction CmpCompleteUnloadKey CmpCreateHive CmpDelayCloseWorker CmpDelayFreeRMWorker CmpDeleteKeyObject CmpDoFlushNextHive CmpDoLocalizeNextHive CmpDoParseKey CmpDoQueryKeyName CmpDoReOpenTransKey CmpDumpKeyToBuffer CmpEnumerateLayeredKey CmpFinishBeingActiveFlusherAndReconciler CmpFinishSystemHivesLoad CmpFlushBackupHive CmpFlushHive CmpInitCmRM CmpLateUnloadHiveWorker CmpLinkHiveToMaster CmpLoadHiveThread CmpLoadHiveVolatile CmpLoadKeyCommon CmpLockRegistryFreezeAware CmpMarkCurrentProfileDirty CmpMountPreloadedHives CmpPerformUnloadKey CmpQueryKeySecurity CmpRecheckHiveVolumePolicy CmpRecoverFlushProtocolStateFromFiles CmpRefreshHive CmpReorganizeHive CmpResolveHiveLoadConflict CmpSaveBootControlSet CmpSetKeySecurity CmpStartRMLogs CmpStartSiloRegistryNamespace CmpStopRMLog CmpStopSiloKeyLockTracker CmpTransMgrCommit CmpTransMgrCommitUoW CmpTransMgrFreeVolatileData CmpTransMgrPrepare CmpTransMgrSyncHive CmpTrimHive CmpTryToRundownHive CmpWaitOnHiveWriteQueue ExpWatchProductTypeWork HvpFinishPrimaryWrite NtCompactKeys NtCompressKey NtDeleteKey NtFlushKey NtNotifyChangeMultipleKeys NtQueryOpenSubKeys NtQueryOpenSubKeysEx
Expand for full list: CmCallbackGetKeyObjectID CmCallbackGetKeyObjectIDEx CmCompleteRegistryInitialization CmDeleteKey CmDeleteLayeredKey CmDeleteValueKey CmDumpKeyToFile CmEnumerateKey CmEnumerateValueKey CmEnumerateValueKeyFromMergedView CmEtwRunDown CmFreezeRegistry CmGetSystemDriverList CmInitSystem1 CmKeyBodyNeedsVirtualImage CmKeyBodyRemapToVirtual CmKeyBodyRemapToVirtualForEnum CmKeyBodyReplicateToVirtual CmLoadAppKey CmLoadDifferencingKey CmLockKeyForWrite CmNotifyRunDown CmOpenKey CmOpenKeyForBugCheckRecovery CmQueryKey CmQueryKey$fin$0 CmQueryMultipleValueKey CmQueryValueKey CmReleaseLoadKeyContext CmRenameKey CmReplaceKey CmRestoreKey CmSaveKey CmSaveMergedKeys CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmShutdownSystem1 CmShutdownSystem2 CmThawRegistry CmpAssignKeySecurity CmpBecomeActiveFlusherAndReconciler CmpCleanupLightWeightTransaction CmpCleanupParseContext CmpCleanupTransactionState CmpCloneHwProfile CmpCloseKeyObject CmpCommitLightWeightTransaction CmpCompleteUnloadKey CmpCreateHive CmpDelayCloseWorker CmpDelayFreeRMWorker CmpDeleteKeyObject CmpDoFlushNextHive CmpDoLocalizeNextHive CmpDoParseKey CmpDoQueryKeyName CmpDoReOpenTransKey CmpDumpKeyToBuffer CmpEnumerateLayeredKey CmpFinishBeingActiveFlusherAndReconciler CmpFinishSystemHivesLoad CmpFlushBackupHive CmpFlushHive CmpInitCmRM CmpLateUnloadHiveWorker CmpLinkHiveToMaster CmpLoadHiveThread CmpLoadHiveVolatile CmpLoadKeyCommon CmpLockRegistryFreezeAware CmpMarkCurrentProfileDirty CmpMountPreloadedHives CmpPerformUnloadKey CmpQueryKeySecurity CmpRecheckHiveVolumePolicy CmpRecoverFlushProtocolStateFromFiles CmpRefreshHive CmpReorganizeHive CmpResolveHiveLoadConflict CmpSaveBootControlSet CmpSetKeySecurity CmpStartRMLogs CmpStartSiloRegistryNamespace CmpStopRMLog CmpStopSiloKeyLockTracker CmpTransMgrCommit CmpTransMgrCommitUoW CmpTransMgrFreeVolatileData CmpTransMgrPrepare CmpTransMgrSyncHive CmpTrimHive CmpTryToRundownHive CmpWaitOnHiveWriteQueue ExpWatchProductTypeWork HvpFinishPrimaryWrite NtCompactKeys NtCompressKey NtDeleteKey NtFlushKey NtNotifyChangeMultipleKeys NtQueryOpenSubKeys NtQueryOpenSubKeysEx
paramcount
0
0
address
140af6710
140af6710
sig
undefined CmpUnlockRegistry(void)
undefined CmpUnlockRegistry(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
1.0
i_ratio
0.5
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
__security_check_cookie
__security_check_cookie
fullname
__security_check_cookie
__security_check_cookie
refcount
3839
3840
length
30
30
called
__report_gsfailure
__report_gsfailure
calling
Expand for full list: AdtpBuildAccessReasonAuditString AdtpBuildAccessReasonAuditStringInternal AdtpBuildAccessesString AdtpBuildReplacementString AdtpBuildSecurityDescriptorUnicodeString AdtpBuildSidListString AdtpBuildStagingReasonAuditStringInternal AdtpBuildUserAccountControlString AdtpFormatPrefix AdtpInitializeDriveLetters AdtpWriteToEtw AdtpWriteToEtwEx AlpcViewDestroyProcedure AlpcpAcceptConnectPort AlpcpCheckConnectionSecurity AlpcpConnectPort AlpcpCreateConnectionPort AlpcpExposeViewAttributeInSenderContext AlpcpForceUnlinkSecureView AlpcpImpersonateMessage AlpcpInitSystem AlpcpLogClosePort AlpcpLogConnectFail AlpcpLogConnectRequest AlpcpLogConnectSuccess AlpcpLogReceiveMessage AlpcpLogSendMessage AlpcpLogUnwait AlpcpLogWaitForReply AlpcpPortQueryConnectedSidInfo AlpcpPrepareViewForDelivery AlpcpQuerySidToken AlpcpRestoreWriteAccess AlpcpValidateAndSetPortAttributes Amd64InitializeCacheStatus Amd64InitializeDataFabricStatus Amd64InitializeProfiling Amd64InitializeUncoreProfiling AnFwDisplayFade ApiSetpLoadSchemaExtension ApiSetpLoadSchemaExtensions AppendUlongAsHexadecimalW ArbBootAllocation ArbBuildAssignmentOrdering ArbInitializeOsInaccessibleRange ArbQueryConflict ArbRetestAllocation ArbShareDriverExclusive AslEnvGetProcessWowInfo AslEnvGetSysNativeDirPathForGuestBuf AslEnvGetSystem32DirPathBuf AslFileMappingCreate AslPathSplit AslPathToSystemPath AslRegistryEnumKey AslRegistryGetUInt32_UStr AslpFileGet16BitDescription AslpFileGet16BitModuleName AslpFileGetClrVersionAttribute AslpFileGetExportName AslpFileQueryVersionString AstLogDeviceCreated AstLogDeviceSDDLUpdated AuthzBasepDeviceMemberOf AuthzBasepEvaluateAceCondition AuthzBasepInitializeResourceClaimsFromSacl AuthzBasepMemberOf B_TREE<_SM_PAGE_KEY,ST_STORE<SM_TRAITS>::ST_PAGE_ENTRY,4096,NP_CONTEXT,B_TREE_KEY_COMPARATOR<SM_PAGE_KEY> >::BTreeSearchResultDeref B_TREE<union__SM_PAGE_KEY,struct_SMKM_STORE_MGR<struct_SM_TRAITS>::SMKM_FRONTEND_ENTRY,4096,struct_B_TREE_DUMMY_NODE_POOL,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY> >::BTreeSearchKey B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY> >::BTreeFindLeafSibling B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY> >::BTreeIteratorCleanup B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY> >::BTreeIteratorFromSearchResult B_TREE<unsigned_long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeSearchResultDeref B_TREE<unsigned_long,ST_STORE<SM_TRAITS>::_ST_REGION_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeSearchResultDeref B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeFindLeafSibling B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeIteratorCleanup B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeIteratorFromSearchResult B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeFindLeafSibling B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeIteratorCleanup B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeIteratorFromSearchResult BapdRecordFirmwareBootStats BapdWriteEtwEvents BapdpMarshallBootDataToRegistry BapdpProcessBCDCache BapdpProcessBitlockerStatus BapdpProcessBootMetadata BapdpProcessEDrvHintInfo BapdpProcessEtwEvents BapdpProcessFwUpdateResults BapdpProcessHSTIResults BapdpProcessResumeInformation BapdpProcessSpacesBootInformation BapdpProcessVsmKeyBlobs BapdpProcessWmdResults BapdpRecordIumStatus BapdpRegisterWbclData BcdGetElementDataWithFlags BcdSetElementDataWithFlags BcpDisplayErrorInformation BcpDisplayProgress BgkAcquireDisplayOwnership BgkNotifyDisplayOwnershipChange BgpGxDrawRectangle BgpRasPrintGlyph BiAddStoreFromFile BiAdjustPrivilege BiBindEfiBootManager BiBindEfiEntries BiBuildIdentifierList BiCreateObject BiCreatePartitionDevice BiDeleteEfiVariable BiDeleteElement BiDoesHiveExist BiEnumerateSubKeys BiExportEfiBootManager BiGetCurrentBootEntryIdentifier BiGetDefaultBootEntryIdentifier BiGetFirmwareType BiGetNtPartitionPath BiGetObjectReferenceFromEfiEntry BiGetPartitionInformation BiOpenStoreKeyFromObject BiResolveLocateDevice BiUpdateObjectReferenceInEfiEntry CMFCheckAccess CMFFlushHitsFile CMFGetFileSizeEx CMFRegisterEventTime CMFSystemThreadRoutine CarEtwCrashEvent CarEtwRegister CarEtwWriteBugCheckEvent CarEtwWriteLiveDumpEvent CarLiveDumpCallBack CarLoadImageHandler CarReadRegistry CarTipLogDriverLoad CcAsyncLazywriteWorker CcAsyncLazywriteWorkerMulti CcAsyncReadWorker CcCachemapUninitWorkerThread CcGetBcbListHeadLargeOffset CcGetDeviceGuidAsync CcPerfLogCanWriteFail CcPerfLogExtraWBThreadAction CcPerfLogFlushCache CcPerfLogFlushSection CcPerfLogLazyWriteScan CcPerfLogScheduleReadAhead CcPerfLogVolumeLogHandleInfo CcPerfLogWorkItemEnqueue CcPerformReadAhead CcPostVolumeTelemetry CcQueueLazyWriteScanThread CcQueueLazyWriteScanThreadForVolume CcSetVacbLargeOffset CcUpdateDynamicRegistrySettings CcWorkerThread CimfsInitialize CimfsInitializeBootDisk CmCallbackGetKeyObjectID CmCallbackGetKeyObjectIDEx CmCreateKey CmDeleteKey CmDeleteValueKey CmEnumerateKey CmEnumerateValueFromLayeredKey CmEnumerateValueKey CmEtwRunDown CmFcInitSystem3 CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerQueryFeatureConfigurationSectionInformation CmFcManagerStartBootPhase CmFcManagerStartRuntimePhase CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpChangeSubscriptionWrapper CmFcpManagerArmFeatureUsageRetryTimer CmGetSystemDriverList CmInitSystem1 CmInitializeProcessor CmIsLastKnownGoodBoot CmKeyBodyRemapToVirtual CmKeyBodyRemapToVirtualForEnum CmKeyBodyReplicateToVirtual CmKtmNotification CmLoadAppKey CmLoadDifferencingKey CmLoadKey CmLogMcUpdateStatus CmLogTmRmAction CmOpenKey CmQueryFeatureConfigurationSections CmQueryKey CmQueryLayeredKey CmQueryValueKey CmReconcileAndValidateAllHives CmRenameKey CmReplaceKey CmRestoreKey CmRmFinalizeRecovery CmSaveKey CmSaveKeyToBuffer CmSaveMergedKeys CmSelectQualifiedInstallLanguage CmSetAcpiHwProfile CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmShutdownSystem1 CmShutdownSystem2 CmSiAcquireProcessLockedPagesCharge CmSiProcessTupleStartFromHandle CmSiReleaseProcessLockedPagesCharge CmSiSetProcessWorkingSetMaximum CmUnloadKey CmpAbortLightWeightTransaction CmpAddAliasEntry CmpAddProcessorConfigurationEntry CmpAddRemoveContainerToCLFSLog CmpAddRemoveRMLogContainer CmpBounceContextStart CmpCheckKeySecurityDescriptorAccess CmpCheckValueList CmpCleanUpKCBCacheTable CmpCleanupLightWeightTransaction CmpCleanupTransactionState CmpCloneHwProfile CmpCloseKeyObject CmpCmdHiveClose CmpCmdHiveOpen CmpCommitPreparedLightWeightTransaction CmpCompleteUnloadKey CmpComputeLogFillLevel CmpCreateControlSet CmpCreateControlSetOverride CmpCreateHardwareProfiles CmpCreateHive CmpCreateHwProfileFriendlyName CmpCreatePerfKeys CmpCreatePredefined CmpCreateTemporaryHive CmpDelayCloseWorker CmpDoAccessCheckOnKCB CmpDoAccessCheckOnLayeredSubtree CmpDoBuildVirtualStack CmpDoParseKey CmpDoQueryKeyName CmpDoReOpenTransKey CmpEnumerateLayeredKey CmpEtwDumpKcb CmpFindControlSet CmpFindMachineHiveByMountPoint CmpFinishSystemHivesLoad CmpFlushBackupHive CmpFlushHive CmpForceFlushWorker CmpFreeAllMemory CmpFullPromoteHiveRootFromKcbStack CmpFullPromoteSingleKeyFromKeyNodeStacks CmpGenerateAppHiveSecurityDescriptor CmpGetAcpiProfileInformation CmpGetBiosDate CmpGetBiosVersion CmpGetFileSize CmpGetSubKeyCountForKcbStack CmpGetSubKeyCountForKeyNodeStack CmpGetSymbolicLinkTarget CmpGetSystemControlValues CmpGetValueCountForKeyNodeStack CmpGetVirtualizationID CmpGetVolumeClusterSize CmpGetVolumeLogFileSizeCap CmpHandlePageFileOpenNotification CmpHiveRootSecurityDescriptor CmpInitBackupHive CmpInitCmRM CmpInitHiveFromFile CmpInitializeMachineDependentConfiguration CmpInitializePreloadedHive CmpInitializeRegistryNode CmpInterlockedFunction CmpKeyEnumStackStartFromKcbStack CmpLateUnloadHiveWorker CmpLightWeightCommitDeleteKeyUoW CmpLinkHiveToMaster CmpLoadHiveThread CmpLoadHiveVolatile CmpLoadKeyCommon CmpLoadLayerVersions CmpLoadSystemVersionData CmpLogCheckpoint CmpLogClearAccessBitsEvent CmpLogEvent CmpLogFailureToGetFileSize CmpLogFlushPhaseEnd CmpLogFlushPhaseStart CmpLogHiveDestroyEvent CmpLogHiveFileInaccessible CmpLogHiveInitializeEvent CmpLogHiveLinkEvent CmpLogHiveRundownEvent CmpLogReorganizeEvent CmpLogTransactionAbortedByName CmpLogTxrInitEvent CmpLogUnsupportedOperation CmpMachineHiveListInitialize CmpMigrateOOBELanguageToInstallationLanguage CmpMountPreloadedHives CmpMoveBiosAliasTable CmpNameFromAttributes CmpNotifyChangeKey CmpOpenDevicesControlSet CmpOpenFileWithExtremePrejudice CmpOpenHiveFile CmpPartialPromoteSubkeys CmpPerformUnloadKey CmpPrepareLightWeightTransaction CmpPromoteSingleKeyFromKcbStacks CmpPromoteSingleKeyFromParentKcbAndChildKeyNode CmpPromoteSubtree CmpPublishEventForPcaResolver CmpQueryHiveRedirectionFileList CmpQueryLayerVersionString CmpQueryLayerVersionUlong CmpReadBuildVersion CmpReorganizeHive CmpReplicateKeyToVirtual CmpReportAuditVirtualizationEvent CmpResolveHiveLoadConflict CmpRestampVersion CmpRmUnDoPhase CmpSaveBootControlSet CmpSearchKeyControlBlockTreeEx CmpSecurityMethod CmpSendUnsupportedOperationTelemetryEvent CmpSetKeySecurity CmpSetSystemBiosInformation CmpSetSystemValues CmpSetVersionData CmpSetVideoBiosInformation CmpSetupConfigurationTree CmpStartCLFSLog CmpStartRMLogs CmpStartSiloRegistryNamespace CmpThreadInfoLogStack CmpTraceHiveFlushStop CmpTraceHiveFlushWroteLogFile CmpTraceHiveFlushWrotePrimaryFile CmpTraceHiveLoadStart CmpTraceHiveLoadStop CmpTraceHiveMountBaseFileMounted CmpTraceHiveMountStart CmpTraceHiveMountStop CmpTraceHiveRestoreStart CmpTraceHiveRestoreStop CmpTraceHiveSaveFileCopied CmpTraceHiveSaveStart CmpTraceHiveSaveStop CmpTraceHiveSaveTreeCopied CmpTraceSecurityChanging CmpTraceShutdownFlushStart CmpTraceShutdownFlushStop CmpTraceShutdownRundownComplete CmpTraceShutdownStart CmpTraceShutdownStop CmpTransMgrCommit CmpTransMgrCommitUoW CmpTransMgrPrepare CmpTransWriteLog CmpUpdateReorganizeRegistryValues CmpValueEnumStackStartFromKcbStack CmpVolumeManagerGetContextForFile CmpWaitOnHiveWriteQueue ComputeFlushPeriod ConstraintEval CreateSystemRootLink DbgkCaptureLiveDump DbgkCopyProcessDebugPort DbgkCreateMinimalProcess DbgkCreateMinimalThread DbgkCreateThread DbgkExitProcess DbgkExitThread DbgkForwardException DbgkMapViewOfSection DbgkPostModuleMessage DbgkQueueUserExceptionReport DbgkRegisterErrorPort DbgkSendSystemDllMessages DbgkUnMapViewOfSection DbgkUserReportWorkRoutine DbgkpCreateNotificationEvent DbgkpLkmdSnapKernelStack DbgkpLkmdSnapThreadInContext DbgkpLkmdSqmIncrementDword DbgkpLkmdSqmIsOptedIn DbgkpMarkProcessPeb DbgkpPostFakeProcessCreateMessages DbgkpPostFakeThreadMessages DbgkpQueueMessage DbgkpSendApiMessageLpc DbgkpSendErrorMessage DbgkpStartSystemErrorHandler DbgkpWerCaptureLiveTriageDump DbgkpWerIsFullLiveDumpDisabled DbgkpWerWriteSecondaryData DrvDbGetConfigurationSubKeyCallback DrvDbGetObjectSubKeyList EmInitSystem EmonInitializePebs EmonInitializeProfiling EmonReleaseProfileResourcesInternal EmpCacheBiosDate EmpInfParseGetGuidFromName EmpParseCallbacks EmpParseEntryTypes EmpParseRuleTerm EmpParseRules EmpParseTargetRules EnableFlushTimer EtwKernelMemoryRundown EtwLogPfnInfoRundown EtwQueryProcessTelemetryInfo EtwSetPerformanceTraceInformation EtwShutdown EtwStartAutoLogger EtwTelemetryCoverageReport EtwTiLogAllocExecVm EtwTiLogDeviceObjectLoadUnload EtwTiLogDriverObjectLoad EtwTiLogDriverObjectUnLoad EtwTiLogInsertQueueUserApc EtwTiLogMapExecView EtwTiLogProtectExecVm EtwTiLogReadWriteVm EtwTiLogSetContextThread EtwTiLogSuspendResumeProcess EtwTiLogSuspendResumeThread EtwTimLogBlockNonCetBinaries EtwTimLogControlProtectionKernelModeReturnMismatch EtwTimLogControlProtectionUserModeReturnMismatch EtwTimLogProhibitChildProcessCreation EtwTimLogProhibitLowILImageMap EtwTimLogProhibitNonMicrosoftBinaries EtwTimLogRedirectionTrustPolicy EtwTimLogUserCetSetContextIpValidationFailure EtwTraceAntiStarvationBoost EtwTraceAppStateChange EtwTraceAutoBoostClearFloor EtwTraceAutoBoostEntryExhaustion EtwTraceAutoBoostSetFloor EtwTraceContFreeEvent EtwTraceCumulativeDpcSoftTimeout EtwTraceDebuggerEvent EtwTraceDequeueWork EtwTraceDpcEnqueueEvent EtwTraceDpcProfilingStack EtwTraceDpcProfilingStackBegin EtwTraceDuplicateHandle EtwTraceEnqueueWork EtwTraceEvent EtwTraceFreezeThawProcess EtwTraceIdealProcessor EtwTraceInswapProcess EtwTraceIoTimerEvent EtwTraceJob EtwTraceJobAssignProcess EtwTraceJobRemoveProcess EtwTraceJobSendNotification EtwTraceJobServerSiloMonitorCallback EtwTraceJobServerSiloStateChange EtwTraceJobSetQuery EtwTraceLeapSecondDataParseFailure EtwTraceLeapSecondDataUpdate EtwTraceLongDpcDetectionEvent EtwTraceLongDpcMitigationEvent EtwTraceLpacAccessFailure EtwTraceMemoryAcg EtwTraceObject EtwTraceObjectOperation EtwTracePageFault EtwTracePool EtwTracePriority EtwTraceProcess EtwTraceProcessSetInPrivateMode EtwTraceProcessTerminate EtwTraceReadyThread EtwTraceRetpolineExit EtwTraceShouldYieldProcessor EtwTraceSiloTimedEvent EtwTraceSingleDpcSoftTimeout EtwTraceSystemTimeChange EtwTraceThread EtwTraceThreadAffinity EtwTraceThreadFeedbackRead EtwTraceThreadSetName EtwTraceThreadWorkItem EtwTraceThreadWorkOnBehalfUpdate EtwTraceTimeZoneBiasChange EtwTraceTimeZoneInformationRefresh EtwTraceTimedEvent EtwTraceWakeCounter EtwTraceWakeEvent EtwTraceWorkingSetInSwapStoreFail EtwTraceWorkingSetSwap EtwTraceWorkloadClassUpdate EtwTraceXSchedulerPriorityKickReceive EtwTraceXSchedulerPriorityUpdate EtwWmitraceWorker EtwWriteEndScenario EtwWriteErrorLogEntry EtwWriteEx EtwWriteStartScenario EtwWriteString EtwpAddLogHeader EtwpAddMicroarchitecturalPmcToRegistry EtwpAddRegEntryToGroup EtwpApplyEventNameFilter EtwpApplyPackageIdFilter EtwpApplyPayloadFilterInternal EtwpBufferingModeFlush EtwpCCSwapFlush EtwpCalculateUpdateNotification EtwpCheckGuidAccessAndDoRundown EtwpClearSessionAndUnreferenceEntry EtwpClockSourceRunDown EtwpCovSampCaptureContextStart EtwpCovSampContextAddAddresses EtwpCovSampContextPruneModules EtwpCovSampEnumerateProcess EtwpCoverageFlushPending EtwpCoverageRecord EtwpCoverageRecordAtHighIrql EtwpCoverageSamplerQuery EtwpCreateKeyTreeForPath EtwpCreateLogFile EtwpCreatePerfectHashFunction EtwpCrimsonProvEnableCallback EtwpDiskProvTraceDisk EtwpEnableAutoLoggerProvider EtwpEnableGuid EtwpEnableKernelTrace EtwpEnableKeyProviders EtwpEnableMetaProviderGuid EtwpEnumerateAddressSpace EtwpEnumerateAutologgerPath EtwpEventTracingCounterSetCallback EtwpEventWriteCaptureState EtwpEventWriteDebugLookupFailed EtwpEventWriteEnableInfo EtwpEventWriteFull EtwpEventWriteGuidEntry EtwpEventWriteProviderAccessCheckStatus EtwpEventWriteProviderEnabled EtwpEventWriteRegEntry EtwpEventWriteRegistrationStatus EtwpEventWriteTemplateAdmin EtwpEventWriteTemplateBackingFile EtwpEventWriteTemplateMaxFileSize EtwpEventWriteTemplateSessAndProv EtwpEventWriteTemplateSession EtwpEventWriteTemplateSessionEnd EtwpExecutiveResourceConfigRunDown EtwpFileModeCompress EtwpFinalizeHeader EtwpFindMatchingPmcRegistryGroup EtwpFixBootLoggers EtwpFlushActiveBuffers EtwpGetAutoLoggerEventNameFilter EtwpGetAutoLoggerLevelKwFilter EtwpGetAutoLoggerProviderFilter EtwpGetLoggerInfoFromContext EtwpGetMicroarchitecturalPmcAffinity EtwpGetPmcCpuHierarchyRegistry EtwpGetSecurityDescriptorByGuid EtwpGetSidExtendedHeaderItem EtwpInitializeActivityIdSeed EtwpInitializeAutoLoggers EtwpInitializeSecurity EtwpLoadMicroarchitecturalPmcs EtwpLoadMicroarchitecturalProfileGroup EtwpLoadMicroarchitecturalProfileSource EtwpLogGroupMask EtwpLogMemInfo EtwpLogMemInfoRundown EtwpLogMemInfoTimerCallback EtwpLogMemInfoWs EtwpLogMemInfoWsHelper EtwpLogMemNodeInfo EtwpLogProcessPerfCtrs EtwpLogRefSetAutoMark EtwpLogRegistryEvent EtwpLogSessionWorkingSetInfo EtwpLogTxREvent EtwpObjectHandleEnumCallback EtwpObjectTypeRundown EtwpPmcInterrupt EtwpPoolRunDown EtwpProcessEnumCallback EtwpProcessPerfCtrsRundown EtwpProcessorRundown EtwpProfileInterrupt EtwpProviderArrivalCallback EtwpPsProvCaptureState EtwpPsProvProcessEnumCallback EtwpPsProvTraceImage EtwpPsProvTraceJob EtwpPsProvTracePriority EtwpPsProvTraceProcess EtwpPsProvTraceThread EtwpQueryPartitionRegistryInformation EtwpQueryPsmKey EtwpReadConfigParameters EtwpRealtimeInjectEtwBuffer EtwpRealtimeRestoreState EtwpRealtimeSaveState EtwpRegTraceCallback EtwpRegisterKMProvider EtwpRemoveMicroarchitecturalPmcFromPmcGroup EtwpSampledProfileRunDown EtwpSavePersistedLogger EtwpSendDataBlock EtwpSendSessionNotification EtwpSetCoverageSamplerInformation EtwpSetMark EtwpSetProviderTraitsCommon EtwpSpinLockConfigRunDown EtwpStackRundown EtwpStackWalkApc EtwpStartLogger EtwpStopLoggerInstance EtwpSysModuleRunDown EtwpSystemTraceWdf EtwpTiQueryVad EtwpTimLogMitigationForProcess EtwpTraceALPC EtwpTraceCachedStack EtwpTraceDebugPrint EtwpTraceFileName EtwpTraceFltIo EtwpTraceHandle EtwpTraceImageRundown EtwpTraceImageUnload EtwpTraceIo EtwpTraceIoInit EtwpTraceLastBranchRecord EtwpTraceLostEvent EtwpTraceLostSystemEvent EtwpTraceLostWppEvent EtwpTraceMessageVa EtwpTraceNetwork EtwpTraceOpticalIo EtwpTraceOpticalIoInit EtwpTraceProcessRundown EtwpTraceProcessorTrace EtwpTraceRedirectedIo EtwpTraceSavePersistedLoggerStop EtwpTraceSplitIo EtwpTraceStackWalk EtwpTraceSystemInitialization EtwpTraceSystemShutdown EtwpTraceThreadRundown EtwpTraceWdf EtwpTrackGuidEntryRegistrations EtwpUMGLEnabled EtwpUpdateFileHeader EtwpUpdateGlobalGroupMasks EtwpUpdateGroupMasks EtwpUpdateLoggerGroupMasks EtwpUpdatePeriodicCaptureState EtwpUpdateProcessTracingCallback EtwpUpdateSelectedGroupMasks EtwpWriteAppStateChange EtwpWriteAppStateChangeSummary EtwpWriteAppStateChangeWithStats EtwpWriteProcessEvent EtwpWriteProcessStarted EtwpWriteProcessorTrace EtwpWriteUserEvent ExAllocateCacheAwarePushLock ExCallSessionCallBack ExCreatePool ExGetExpirationDate ExInitLicenseData ExInitializeUtcTimeZoneBias ExLogTimeZoneInformation ExProcessCounterSetCallback ExProcessorCounterSetCallback ExRaiseException ExRaiseHardError ExRngInitializeSystem ExSweepHandleTable ExUpdateSystemTimeFromCmos ExpAeThresholdInitialization ExpCheckThreadHistory ExpCloudbookHardwareIDProvider ExpCloudbookHardwareLockedProvider ExpConvertSignatureName ExpCovQueryInformation ExpCovResetInformation ExpCreateOutputEFI ExpDebuggerWorker ExpFindDiskSignature ExpFirmwareAccessAppContainerCheck ExpGenuinePolicyPostProcess ExpGetOriginalImageVersionRegistryValue ExpGetProcessInformation ExpGetSystemFirmwareTableInformation ExpGetSystemFlushInformation ExpGetSystemPlatformBinary ExpInitFullProcessSecurityInfo ExpKdPullRemoteFileForUser ExpKernelExpirationDateCacheProvider ExpLogRefreshTimeZoneInformationCutoverFail ExpLogRefreshTimeZoneInformationQueryFail ExpLogRefreshTimeZoneInformationSuccess ExpNodeCreateSystemThread ExpNtDeleteWnfStateData ExpNtUpdateWnfStateData ExpParseArcPathName ExpProfileCreate ExpQueryProcessorInformationCounters ExpQuerySystemInformation ExpRaiseHardError ExpReadComPlusPackage ExpReadLeapSecondData ExpRefreshTimeZoneInformation ExpSaPageGroupDescriptorAllocate ExpSecurePoolDestroy ExpSeedHotTags ExpSetBootEntry ExpSetDriverEntry ExpSetPendingUILanguage ExpSetSoftRebootFlags ExpSetTimeZoneInformation ExpSetTimer2 ExpStringCheck ExpSvmServicePageFault ExpSystemErrorHandler2 ExpTrackTableInsertLimit ExpTranslateEfiPath ExpTranslateHexStringToGUID ExpUpdateProductSuiteTypeInRegistry ExpUpdateTimerConfiguration ExpUuidLoadSequenceNumber ExpUuidSaveSequenceNumber ExpWatchLicenseInfoWork ExpWatchProductTypeInitialization ExpWatchProductTypeWork ExpWnfAllocateNextPersistentNameSequence ExpWnfDeletePermanentName ExpWnfDeletePermanentStateData ExpWnfDispatchKernelSubscription ExpWnfLookupPermanentName ExpWnfPopulateStateData ExpWnfRegisterPermanentName ExpWnfWriteStateData ExpWorkQueueManagerThread ExpWorkerThread ExtEnvRegisterIommu ExtEnvSetVpptTarget FUN_140687e40 FUN_14068ad70 FUN_140709bb0 FUN_140768f34 FUN_14084356c FUN_140a4b524 FUN_140a4e0ec FindBitmapResource FopReadCmapTable FopReadNamingTable FsRtlAcquireFileExclusiveCommon FsRtlAcquireFileForCcFlushEx FsRtlAcquireFileForModWriteEx FsRtlAcquireToCreateMappedSection FsRtlAddDiskIOCounterInstance FsRtlCheckOplockEx2 FsRtlCheckOplockForFsFilterCallback FsRtlCheckUpperOplock FsRtlDedupChangeInit FsRtlGetCompatibilityModeValue FsRtlGetFileExtents FsRtlGetFileSize FsRtlGetSectorSizeInformation FsRtlGetTunnelParameterValue FsRtlGetVirtualDiskNestingLevel FsRtlHeatInit FsRtlIsDbcsInExpression FsRtlIssueFileNotificationFsctl FsRtlNotifyVolumeEvent FsRtlOpenFileSystemRegistryKeyFromFsGuid FsRtlQueryCachedVdl FsRtlQueryOpen FsRtlReleaseFile FsRtlReleaseFileForCcFlush FsRtlReleaseFileForModWrite FsRtlSendModernAppTermination FsRtlVolumeDeviceToCorrelationId FsRtlpAcknowledgeOplockBreakByCacheFlags FsRtlpAttachOplockKey FsRtlpCancelOplockRHIrp FsRtlpCancelWaitingIrp FsRtlpComputeShareableOplockState FsRtlpGetMaxVirtualDiskNestingLevel FsRtlpGrantAnyOplockFromExclusive FsRtlpOplockBreakByCacheFlags FsRtlpOplockCleanup FsRtlpReleaseIrpsWaitingForRH FsRtlpRemoveAndCompleteRHIrp FsRtlpRemoveAndCompleteReadOnlyIrp FsRtlpRemoveAndCompleteWaitingIrp FsRtlpRequestExclusiveOplock FsRtlpRequestShareableOplock FsRtlpWaitOnIrp GetOperatorIndexByName GetPrintableOperandValue GxpWriteFrameBufferPixels HalAllocateHardwareCounters HalCreateCommonBufferFromMdl HalCreateCommonBufferFromMdlDmaThin HalCreateCommonBufferFromMdlDmarThin HalEfiGetTime HalEfiSetTime HalGetEnvironmentVariableEx HalMatchAcpiOemId HalMatchAcpiOemTableId HalQueryEnvironmentVariableInfoEx HalQueryRealTimeClock HalSendNMI HalSetEnvironmentVariableEx HalSetRealTimeClock HalSocRequestApi HalSocRequestConfigurationData HaliAcpiMachineStateInit HaliQuerySystemInformation HaliWheaInitProcessorGenericSection HalpAcpiPostSleep HalpAddMcaToProcessorSpecificSection HalpAllocatePmcCounterSetEx HalpArtDiscover HalpBiosDisplayReset HalpBuddyAllocatorAllocateLogicalAddress HalpCheckSratMemoryRanges HalpCmcLogPollingTimeoutEvent HalpCmcPollProcessor HalpCmcWorkerRoutine HalpCmciHandler HalpCmciInit HalpCmciLoadThresholdConfiguration HalpCpuID HalpCreateMachineCheckErrorRecord HalpDmaFinalizeDoubleBufferingDisposition HalpDmaInitPowerManagement HalpEnumerateEnvironmentVariablesWithFilter HalpExtBuildResourceIdString HalpExtRegisterResourceDescriptor HalpFreePmcCounterSet HalpGenInitialRead HalpGetNumaProcMemoryCount HalpGetPCIData HalpHandlePreviousMcaErrors HalpHpetDiscover HalpHvCpuid HalpHvEpCpuid HalpHvIsFrequencyAvailable HalpHvIsX2ApicRecommended HalpHvMapDeviceInterrupt HalpHvMapDeviceMsiRange HalpHvMceConsumedMemoryErrorRecovery HalpHvRetargetDeviceMsiInterrupt HalpHvRetargetIoApicDeviceInterrupt HalpHvStartProcessor HalpHvStartVirtualProcessor HalpHvUnmapDeviceInterrupt HalpHvUnmapDeviceMsiRange HalpHvWatchdogDiscover HalpInitChipHacks HalpInitGenericErrorSourceEntry HalpInitGenericErrorSourceEntryV2 HalpInitializeMce HalpInitializeProfiling HalpInterruptConnect HalpInterruptEnableNmi HalpInterruptGetIrtInfo HalpInterruptGetX2ApicPolicy HalpInterruptInitDiscard HalpInterruptInitPowerManagement HalpInterruptRegisterController HalpInterruptSendIpi HalpIommuAllocateDmaDomain HalpIommuCleanupPageTable HalpIommuConfigureInterrupt HalpIommuDmarPageTableMarkHiberPhase HalpIommuInitDiscard HalpIommuInitializeAll HalpIommuLogEarlyFault HalpIommuMapLogical HalpIommuMapLogicalRange HalpIommuTraceFault HalpIommuUnmapLogicalRange HalpIsHvIptSupported HalpIsHvPresent HalpIsHvUsedForReboot HalpIsMicrosoftCompatibleHvLoaded HalpIsPartitionCpuManager HalpIsXboxNanovisorPresent HalpIumGetTime HalpIumQueryVariableInfo HalpIumResetSystem HalpIumSetTime HalpLbrInitialize HalpLoadMicrocodeSerialized HalpMcEnumerateAndSetPatchConfig HalpMcaExtendedLogGetL1DirectoryBase HalpMcaInitializeErrorSection HalpMcaReadError HalpMcaReportError HalpMcaResumeProcessorConfig HalpMceInit HalpMceInitializeRecovery HalpNmiReboot HalpNumaAddRangeProximity HalpPciCheckAmdK8 HalpPciReadSecondaryBusNumber HalpPiix4Detect HalpPmTimerDiscover HalpProcGetFeatureBits HalpQueryCapsuleCapabilities HalpReadExtendedMcaRegistersAMD HalpRegisterDmaController HalpReportResourceUsage HalpRtcDiscover HalpSecondaryInterruptQueryPrimaryInformation HalpSetPCIData HalpSetShutdownResetHandler HalpStopLegacyUsbInterruptsInternal HalpTimerConfigureInterrupt HalpTimerEnableHypervisorTimer HalpTimerInitPowerManagement HalpTimerInitializeHypervisorTimer HalpTimerInitializeProfiling HalpTimerMeasureAllProcessorFrequencies HalpTimerQueryAndResetRtcErrors HalpTimerRegister HalpTimerStallExecutionProcessor HalpTimerTraceTimingHardware HalpTimerUnmapInterrupt HalpTimerWatchdogTriggerSystemReset HalpTscAdvSynchCalculateRemoteDeltas HalpTscAdvSynchLeader HalpTscCheckAdjustMsrCapability HalpTscFallbackToPlatformSource HalpTscReportSyncStatus HalpTscSynchronization HalpTscSynchronizationWorker HalpTscTraceProcessorSynchronization HalpTscTraceStatus HalpUpdateCapsule HalpUsbLegacyScanBusForHandoff HalpUsbLegacyStopOhciInterrupt HalpUsbLegacyStopUhciInterrupt HalpValidPCISlot HalpWdatDiscover HalpWheaNativeCpuid HashpVerifyPkcs1Signature HdlspAddLogEntry HdlspBugCheckProcessing HdlspDispatch HdlspKernelAddLogEntry HdlspPutMore HdlspSendBlueScreenInfo HeadlessInit HsaDismissPageFault HsaGetPageFault HsaInitializeIommu HsaUpdateDeviceTableEntry HsaUpdateRemappingTableEntry HvAnalyzeLogFiles HvLoadHive HvRecoverFlushProtocolStateFromFiles HvSwapLogFiles HviGetHardwareFeatures HviGetIptFeatures HviIsAnyHypervisorPresent HviIsHypervisorMicrosoftCompatible HviIsHypervisorVendorMicrosoft HviIsXboxNanovisorPresent HvipApertureDetectParameters HvlAttachPasidSpace HvlAttachPrQueue HvlCollectLivedump HvlCreatePasidSpace HvlCreatePrQueue HvlDebuggerSupportInitialize HvlDisablePasid HvlDmaAllocateDeviceDomain HvlDmaAttachDeviceDomain HvlDmaConfigureDeviceDomain HvlDmaDeleteDeviceDomain HvlDmaFlushDeviceDomain HvlDmaGetDmaGuardEnabled HvlDmaGetHybridPassthroughReservedRegions HvlDmaMapDeviceLogicalRange HvlDmaMapDeviceSparsePages HvlDmaReserveDeviceDomainAttachment HvlDmaUnmapDeviceLogicalRange HvlDmaUnmapDeviceSparsePages HvlEnablePasid HvlEnterSleepState HvlGetCoverageData HvlGetCoverageInfo HvlGetDeviceCapabilities HvlGetImplementedPhysicalBits HvlGetSystemPasidCapabilities HvlHvDebuggerPowerHandler HvlInvokeFastExtendedHypercall HvlInvokeHypercall HvlIsSingleGroupRequired HvlMapDeviceInterrupt HvlNotifyAllProcessorsStarted HvlNotifyDebugDeviceAvailable HvlNotifyHpetEnabled HvlNotifyRootCrashdump HvlParkedVirtualProcessors HvlPrepareForRootCrashdump HvlPrepareForSecureHibernate HvlQueryDetailInfo HvlQueryHypervisorTscAdjustment HvlQueryVsmProtectionInfo HvlResetCoverageVector HvlRestoreTime HvlResumeFromRootCrashdump HvlRetargetDeviceInterrupt HvlSendSyntheticClusterIpi HvlSetDeviceCapabilities HvlSetDeviceDmaEnabled HvlSetHpetConfig HvlSetPasidAddressSpace HvlSetQpcBias HvlSetRootFaultReportingReady HvlSetSystemMachineCheckProperty HvlSetSystemSleepProperty HvlUnblockDefaultDma HvlUnmapDeviceInterrupt HvlpCheckTscSync HvlpDetermineEnlightenments HvlpDiscoverTopologyAmd HvlpDiscoverTopologyIntel HvlpDynamicUpdateMicrocode HvlpFastFlushAddressSpaceTb HvlpFastFlushAddressSpaceTbEx HvlpFastFlushListTb HvlpFastFlushListTbEx HvlpFastFlushPasidAddressList HvlpFastSendSyntheticClusterIpiEx HvlpGetVtlCallVa HvlpInvokeGetPageListHypercall HvlpLogGuestStateScrubbingStatus HvlpLogHypervisorLaunchError HvlpLogHypervisorSchedulerType HvlpLogIommuInitStatus HvlpLogMicrocodeUpdateStatus HvlpLogProcessorStartupFailure HvlpMapStatisticsPage HvlpProcessIommu HvlpQueryExtendedCapabilities HvlpQueryHypervisorSchedulerType HvlpSelectLpSet HvlpSelectVpSet HvlpSlowFlushAddressSpaceTb HvlpSlowFlushAddressSpaceTbEx HvlpSlowFlushListTb HvlpSlowFlushListTbEx HvlpSlowSendSyntheticClusterIpiEx HvlpTryConfigureInterface HvlpWithdrawPages HvlpWritePerfRegister HvpApplyIncrementalLogFile HvpApplyLegacyLogFile HvpDetermineLogFileApplicationOrder HvpGenerateLogEntryChecksums HvpGenerateLogEntryHeader HvpIncrementalLogFileEnumeratorAdvance HvpIsReadErrorTransient HvpLogEntryCheckDataChecksum HvpLogEntryCheckHeaderChecksum HvpLogInvalidLogHeader HvpLogUnreadableLog HvpMarkDirty HvpSwapDual I_MinCryptCheckEKURequirements InitBootProcessor InitSafeBoot IoBoostThreadIoPriority IoCaptureLiveDump IoConfigureCrashDump IoCreateDevice IoCreateDisk IoCreateDriver IoEnumerateEnvironmentVariablesEx IoEnumerateKsrPersistentMemoryEx IoGetDeviceDirectory IoGetDeviceInterfaceAlias IoGetDeviceProperty IoGetDmaAdapter IoGetEnvironmentVariableEx IoInitSystemPreDrivers IoInitializeProcessor IoIsValidNameGraftingBuffer IoQueryEnvironmentVariableInfoEx IoQueryInformationByName IoRaiseHardError IoReadDiskSignature IoReadPartitionTable IoReadPartitionTableEx IoRegisterPlugPlayNotification IoRemoveIoCompletion IoReportDetectedDevice IoReportRootDevice IoReserveKsrPersistentMemoryEx IoReuseIrp IoSaveBugCheckProgress IoSaveBugCheckRecoveryStatus IoSetEnvironmentVariableEx IoSetPartitionInformation IoSetPartitionInformationEx IoSetSystemPartition IoStartIoRateControl IoTranslateBusAddress IoVerifyPartitionTable IoVolumeDeviceNameToGuidPath IoVolumeDeviceToDosName IoVolumeDeviceToGuidPath IoWMIOpenBlock IoWMIQueryAllData IoWMIQueryAllDataMultiple IoWMIQuerySingleInstanceMultiple IoWriteCapturedPristineTriageDumpToDedicatedDumpFile IoWriteCrashDump IoWriteDeferredLiveDumpData IoWritePartitionTable IoWritePartitionTableEx IommupHvAttachPasidDevice IommupHvAttachPasidDeviceDomain IommupHvDismissPageFault IommupHvGetDeviceAtsCapability IommupHvGetDeviceSvmCapabilities IommupHvInitializeLibrary IommupHvIsDmarStageCompatible IommupHvIsStage1DmarCompatible IommupHvValidatePageRequestGpa IopApplySystemPartitionProt IopAttachDeviceToDeviceStackSafe IopBootLog IopCachePreviousBootData IopCallDriverReference IopCaptureObjectName IopCollectTriageDumpData IopConnectInterruptFullySpecified IopConnectLinkTrackingPort IopConnectMessageBasedInterrupt IopCopyBootLogRegistryToFile IopCrashDumpPolicyChangeWnfCallback IopCreateArcName IopCreateArcNames IopCreateArcNamesCd IopCreateArcNamesDisk IopDumpTraceCrashDumpDisabled IopDumpTraceCrashDumpReconfiguration IopDumpTraceDisableCrashDumpFailure IopDumpTraceForceDumpDisabled IopDumpTraceFreeDumpStackFailure IopDumpTraceInitializeCrashDumpFailure IopDumpTraceInitializeDumpStackFailure IopDumpTraceLoadCrashDumpDriverFailure IopDumpTraceLoadDumpStackFailure IopErrorLogThread IopFastQueryNetworkAttributes IopFileUtilClearAttributes IopFileUtilWalkDirectoryTreeBottomUp IopFileUtilWalkDirectoryTreeTopDown IopFreeBandwidthContract IopGetBootDiskInformation IopGetBootDiskInformationLite IopGetDeviceInterfaces IopGetFileVolumeNameInformation IopGetNetworkOpenInformation IopGetVolumeId IopInitActivityIdIrp IopInitCrashDumpDuringSysInit IopInitializeBootDrivers IopInitializeDumpPolicySettings IopInitializeInMemoryDumpData IopInitializeOfflineCrashDump IopInitializePlugPlayServices IopInitializeResourceMap IopInitializeSystemVariableService IopIoRateStartRateControl IopIrpStackProfilerDpcRoutine IopIsNotNativeDriverImage IopIsReportedAlready IopIssueTrEERequest IopLiveDumpAllocAndInitResources IopLiveDumpAllocateExtraBuffers IopLiveDumpAllocateFromVMMemoryPartition IopLiveDumpCallRemovePagesCallbacks IopLiveDumpCaptureMemoryPages IopLiveDumpEstimateMemoryPages IopLiveDumpIsUnderMemoryPressure IopLiveDumpMarkImportantDumpData IopLiveDumpOpenVMMemoryPartition IopLiveDumpPolicyChangeWnfCallback IopLiveDumpRegisterWnfNotificationCallback IopLiveDumpTraceAllocationFromVMMemoryPartitionFailure IopLiveDumpTraceBufferAllocation IopLiveDumpTraceBufferEstimation IopLiveDumpTraceCaptureGenerateIptSecondaryDataDuration IopLiveDumpTraceCaptureMemoryPages IopLiveDumpTraceCaptureProcessorContextDuration IopLiveDumpTraceCorralProcessorsDuration IopLiveDumpTraceDumpDisabledOnBoot IopLiveDumpTraceDumpFileWriteEnd IopLiveDumpTraceEstimatedAndAllocatedPageCount IopLiveDumpTraceHvlPrepareLivedumpDescriptorFailure IopLiveDumpTraceInterfaceEnd IopLiveDumpTraceMarkImportantDumpDataDuration IopLiveDumpTraceMarkRequiredDumpDataDuration IopLiveDumpTraceMmDuplicateMemoryFailure IopLiveDumpTraceOpenVMMemoryPartitionFailure IopLiveDumpTracePopulateBitmapForDumpDuration IopLiveDumpTraceQueryHvlDumpSizeFailure IopLiveDumpTraceRemovePagesCallbackFailure IopLiveDumpTraceUncorralProcessorsDuration IopLiveDumpWriteDumpFile IopLiveDumpWriteDumpFileWithExtraPages IopLiveDumpWriteSecondaryData IopLoadDriver IopLogAuditIoRegisterNotificationEvent IopMarkBootPartition IopMountVolume IopOpenLinkOrRenameTarget IopParseDevice IopPassiveInterruptWorker IopPerfCompleteRequest IopPerfCompletionRoutine IopPerfLogCallEvent IopPerfLogCallReturnEvent IopProcessIoTracking IopProcessSetInterfaceState IopProcessWorkItem IopProtectSystemPartition IopQueryDockRemovalInterface IopQueryEnvironmentVariableInfoSysEnv IopQueryEnvironmentVariableInfoTrEE IopQueryPassiveInterruptRegistryOptions IopQueryResourceHandlerInterface IopRaiseHardError IopReassignSystemRoot IopRegisterDeviceInterface IopSendMessageToTrackService IopSetRemoteLink IopStoreSystemPartitionInformation IopSymlinkQueryEnabledClasses IopSynchronousServiceTail IopTimerDispatch IopTraceCrashDumpDisabledOnBoot IopTrackLink IopWriteCapsuleTriageDumpToFirmware IopXxxControlFile IovCompleteRequest IovpCallDriverWithStackBuffer IpmiLibAddSelRecord IpmiLibpAddSelRawData IpmiLibpKcsRequestAndReceive IvtDismissPageFault IvtDrainSvmPageRequests IvtFlushDeviceTbOnly IvtFlushTbInternal IvtInitializeIommu IvtInitializeScalableModePasidTables IvtInvalidateAllContextEntries IvtInvalidateContextEntry IvtInvalidateRemappingTableEntries IvtInvalidateScalableModePasidCache IvtIommuWaitCommand IvtSetPasidAddressSpace IvtUpdateRemappingTableEntry IvtUpdateScalableModeContextEntry IvtUpdateScalableModePasidTablesForPasid KGetUnlockSetting KdInitSystem KdSendTraceData KdpCloseRemoteFile KdpCreateRemoteFile KdpPrint KdpPrintString KdpPrompt KdpPromptString KdpReadRemoteFile KdpReportCommandStringStateChange KdpReportExceptionStateChange KdpReportLoadSymbolsStateChange KdpRestoreBreakPointEx KdpSearchMemory KdpSendWaitContinue KdpWriteBreakPointEx KeAddEnclavePage KeAdjustInterruptTime KeAndGroupAffinityEx KeBoostPriorityThread KeCanChangeEnclavePageProtection KeChangeEnclavePageProtection KeCommitSmtState KeCopyPrivilegedPage KeCopyXfdMaskToTeb KeCpuSetReportParkedProcessors KeCreateEnclave KeDeleteCpuPartition KeDisableTimer2 KeEnumerateKernelStackSegments KeFlushCurrentTbOnly KeFlushIoBuffers KeFlushMultipleRangeCurrentTb KeFlushQueuedDpcs KeFlushSingleCurrentTb KeFlushSingleTb KeForceAttachProcess KeForceDetachProcess KeFreezeExecution KeGenericProcessorCallback KeGetTbSize KeInitSystem KeInitializeClock KeIntSteerPeriodic KeIntSteerSnapPerf KeIsSubsetAffinityEx KeLoadMTRR KeMaskInterrupt KeOutPageEnclavePage KePrepareClockTimerForIdle KePrepareNonClockOwnerForIdle KeQueryCpuPartitionAffinity KeQueryTotalCycleTimeThread KeRebootSystemForRecovery KeRecomputeCpuSetAffinityProcess KeRegisterProcessorChangeCallback KeRemoveQueueDpcEx KeRemoveQueueEx KeRequestTerminationThread KeRestoreProcessorSpecificFeatures KeResumeClockTimerFromIdle KeRevertToUserAffinityThread KeRevertToUserAffinityThreadEx KeRevertToUserMultipleGroupAffinityThread KeSecureProcess KeSetAffinityProcess KeSetBasePriorityThread KeSetCpuSetsProcess KeSetIntervalProfile KeSetPagePrivilege KeSetPriorityThread KeSetSchedulingGroupRankBias KeSetSelectedCpuSetsThread KeSetSystemMultipleGroupAffinityThread KeSetThreadSchedulerAssist KeSetTracepoint KeSetUserAffinityThread KeSetUserCetAppcompatOptions KeSetUserGroupAffinityThread KeStartAllProcessors KeStartProfile KeStartThread KeStopProfile KeSupportedPhysicalAddressBits KeSynchronizeAddressPolicy KeSynchronizeSecurityDomain KeUnsecureProcess KeUpdateDpcWatchdogConfiguration KeUpdateSoftParkRankList KeUpdateThreadCpuSets KeUpdateThreadTag KeWaitForMultipleObjects KeWaitForMutexObject KeWriteProtectPAT KiAbThreadUnboostCpuPriority KiAdjustGroupConfiguration KiAndAffinityEx KiApplyForegroundBoostThread KiBugCheckProgress KiBugCheckProgressCpusFrozen KiBugCheckRecoveryFreezeOtherProcessors KiCalibrateTimeAdjustment KiCancelClockTimer KiCancelTimer KiCheckForThreadDispatch KiCheckForTimerExpiration KiCheckMicrocode KiChooseTargetProcessor KiComputeCpuSetAffinity KiComputeDispatchInterruptCost KiComputeNumaCosts KiComputeThreadAffinity KiComputeTopologyConstants KiConfigureHeteroMultiCoreProcessors KiConnectInterrupt KiContinuePreviousModeUser KiDeferGroupSchedulingPreemption KiDeferredBugcheckRecoveryWorker KiDeferredReadySingleThread KiDeregisterNmiSxCallback KiDetectAmdNonArchSsbdSupport KiDetectHardwareSpecControlFeatures KiDetectKvaLeakage KiDetectTsx KiDirectSwitchThread KiDisconnectInterruptCommon KiDispatchException KiDisplayBlueScreen KiDumpParameterImages KiDynamicProcessorAddNotification KiDynamicProcessorInitialization KiEnterLongDpcProcessing KiEventClockStateChange KiExecuteAllDpcs KiExitDispatcher KiExitThreadWait KiExpireTimer2 KiFinalizeTimer2Disablement KiFlushAddressSpaceTb KiFlushRangeTb KiFlushSingleTbWorker KiForceIdleUpdateSchedulerParkState KiForwardTick KiFreezeTargetExecution KiGetCpuVendor KiGetIptInfo KiGetProcessorInformation KiGetProcessorSignature KiGetTbLeafInfo KiGetXSaveSupportedFeatures KiGroupSchedulingGenerationEnd KiGroupSchedulingQuantumEnd KiHaltOnAddressWakeEntireList KiHandleDeferredPreemption KiHeteroComputeThreadImportance KiHeteroScanQueueForPreemptionSwapTarget KiHvEnlightenedGuestPriorityKick KiInitMachineDependent KiInitializeContextThread KiInitializeDynamicProcessorDpc KiInitializeHgsPlusWorkloadClasses KiInitializeHresetSupport KiInitializeIdleProcess KiInitializeKernel KiInitializeNxSupportDiscard KiInitializeReservedCpuSets KiInitializeTopologyStructures KiInitializeUserApc KiInitializeXSave KiIntRedirectQueueRequestOnProcessor KiIntSteerCalculatePriorityDistribution KiIntSteerLogState KiIntSteerLogStatus KiInterruptDispatchCommon KiIntersectFeaturesWithPolicy KiInvokeInterruptServiceRoutine KiIpiProcessRequests KiIpiSendRequest KiIsHyperVCr3RspErrataPresent KiIsNXSupported KiIsProcessTerminationRequested KiLogSingleDpcSoftTimeoutEvent KiLogUserCetSetContextIpValidationFailureWorker KiMcheckAlternateReturn KiOpPatchCode KiOrAffinityEx KiOutSwapKernelStacks KiParkCurrentProcessor KiPerformAutomaticGroupConfiguration KiPerformExplicitGroupAssignment KiPerformHeteroSoftParkElection KiPrepareUpdateCoresHeteroMask KiProcessControlProtection KiProcessDeferredReadyList KiProcessExpiredTimerList KiQuantumEnd KiRaiseException KiReadyOutSwappedThreads KiRemoveBoostThread KiRemoveSystemWorkPriorityKick KiRescheduleThreadAfterAffinityChange KiReselectIdealProcessorAfterAffinityChange KiRetireDpcList KiRundownMutants KiSchedulerApc KiSearchForNewThread KiSearchForNewThreadOnProcessor KiSearchForNewThreadsForRescheduleContext KiSelectProcessorToPreempt KiSendClockInterruptToClockOwner KiSendThawExecution KiSetCacheInformationAmd KiSetCacheInformationIntel KiSetClockTimer KiSetFeatureBits KiSetHeteroPolicyThread KiSetLegacyAffinityThread KiSetNextClockTickDueTime KiSetPageAttributesTable KiSetPriorityThread KiSetProcessorSignature KiSetStandardizedCacheInformation KiSetSystemAffinityThread KiShouldRearmClockTimer KiSoftParkElectionDpcRoutine KiStallBugcheckThread KiStartDpcThread KiStartDynamicProcessor KiStartPrcbThread KiSubtractAffinityEx KiSwapThread KiSynchCounterSetCallback KiSynchNumaCounterSetCallback KiSynchronizeStibpPairing KiTimer2Expiration KiTimerExpiration KiTimerExpirationDpc KiTpReadImageData KiTpWriteMemory KiTraceCancelTimer2 KiTraceLogControlCallback KiTraceLogHeteroRundown KiTraceSetTimer KiTraceSetTimer2 KiUnwindUserSspForApcContextCopyBypass KiUpdateGlobalCpuSetConfiguration KiUpdateNumberProcessors KiUpdateProcessConcurrencyCount KiUpdateRunTime KiUpdateTime KiUpdateVpBackingThreadPriorityDpcRoutine KiWaitForAllObjects KiXorAffinityEx KitLogFeatureUsage KitpReadUlongFromKey KseDsCallbackHookAddDevice KsepDbGetShimInfo KsepDsEventAddDevice KsepDsEventDataIrp KsepDsEventDevicePowerCompleted KsepDsEventDevicePowerIrp KsepDsEventDriverLoad KsepDsEventDriverStartIo KsepDsEventDriverUnload KsepDsEventIoCreateDevice KsepDsEventPnpIrp KsepDsEventPnpStartDevice KsepDsEventPnpStopDevice KsepDsEventPoolAllocate KsepDsEventPoolFree KsepDsEventRequestPowerIrp KsepDsEventSystemPowerIrp KsepEvntLogFlagsApplied KsepEvntLogShimsApplied KsepLogEtwMessage KsepMatchInitBiosInfo KsepRegistryQueryDWORD KsepShimDatabaseTime KsepSkipDriverUnloadEventDriverLoad KsepSkipDriverUnloadEventDriverUnload KyRaiseException LdrLoadAlternateResourceModuleEx LdrResGetRCConfig LdrResSearchResource LdrpGetParentLangId LdrpGetRcConfig LdrpGetResourceFileName LdrpResSearchResourceMappedFile LdrpSearchResourceSection_U LkmdTelCreateReport LocalGetAclForString LocalGetConditionForString LocalGetStringForControl LocalGetStringForRelativeAttribute LocalpConvertStringSidToSid LocalpGetStringForCondition LookUpTableFlushComplete MakeGdtReadOnly McTemplateK0_EtwWriteTransfer McTemplateK0d_EtwWriteTransfer McTemplateK0dszu_EtwWriteTransfer McTemplateK0dz_EtwWriteTransfer McTemplateK0dzd_EtwWriteTransfer McTemplateK0hzr0_EtwWriteTransfer McTemplateK0hzr0d_EtwWriteTransfer McTemplateK0hzr0hzr2_EtwWriteTransfer McTemplateK0hzr0qqhzr4_EtwWriteTransfer McTemplateK0izzx_EtwWriteTransfer McTemplateK0j_EtwWriteTransfer McTemplateK0jhzr1_EtwWriteTransfer McTemplateK0jhzr1d_EtwWriteTransfer McTemplateK0jq_EtwWriteTransfer McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer McTemplateK0jzt_EtwWriteTransfer McTemplateK0p_EtwWriteTransfer McTemplateK0pqzzzzzzz_EtwWriteTransfer McTemplateK0pz_EtwWriteTransfer McTemplateK0q_EtwWriteTransfer McTemplateK0qhzr1z_EtwWriteTransfer McTemplateK0xxq_EtwWriteTransfer McTemplateK0xxxqq_EtwWriteTransfer McTemplateK0xxxqqqq_EtwWriteTransfer McTemplateK0xxxxxxxxxxxxxxxxxq_EtwWriteTransfer McTemplateK0z_EtwWriteTransfer McTemplateK0zd_EtwWriteTransfer McTemplateK0zdq_EtwWriteTransfer McTemplateK0zjdd_EtwWriteTransfer McTemplateK0zq_EtwWriteTransfer McTemplateK0zqz_EtwWriteTransfer McTemplateK0zz_EtwWriteTransfer McTemplateK0zzjzitd_EtwWriteTransfer McTemplateK0zzjzzzdd_EtwWriteTransfer McTemplateK0zzjzzztzdzztdz_EtwWriteTransfer McTemplateK0zzq_EtwWriteTransfer McTemplateK0zzqq_EtwWriteTransfer McTemplateK0zzqqzttquqqzxt_EtwWriteTransfer McTemplateK0zzqqzttquxt_EtwWriteTransfer McTemplateK0zzt_EtwWriteTransfer McTemplateK0zztt_EtwWriteTransfer McTemplateK0zzz_EtwWriteTransfer McTemplateK0zzzd_EtwWriteTransfer McTemplateK0zzzdzzq_EtwWriteTransfer McTemplateK0zzzt_EtwWriteTransfer McTemplateK0zzztdd_EtwWriteTransfer McTemplateK0zzzzdd_EtwWriteTransfer McTemplateK0zzzzz_EtwWriteTransfer MfgInitSystem MiActOnLargeKernelHalPages MiAddLoaderHalIoMappings MiAddWorkingSetEntries MiAdjustPteBins MiAgeWorkingSet MiAllocateChildVads MiAllocateContiguousMemory MiAllocateFastAwePages MiAllocateFastLargePagesForMdl MiAllocateLargeProcessPagesFromCache MiAllocateLargeZeroPages MiAllocatePagesForMdl MiAllocateSlabEntry MiAllocateUserPhysicalPages MiAllocateVirtualMemory MiApplyBootLoadedDriversFixups MiApplyFunctionOverrideToBootDrivers MiApplyHotPatchToLoadedDriver MiApplyImportOptimizationToBootDrivers MiApplyRetpolineFixups MiApplyRetpolineFixupsToKernelAndHal MiApplyStraddleFixups MiAssignSessionRanges MiAssignSoftwareWsleRegion MiAssignTopLevelRanges MiAttachWorkingSet MiAttemptPageFileExtension MiAttemptPageFileReduction MiBuildMdlForMappedFileFault MiCaptureAndResetWorkingSetAccessBits MiChangePageHeatImmediate MiClearDriverHotPatchPtes MiClearNonPagedPtes MiClearPteAccessedBitRange MiClearSystemAccessBits MiCloneProcessAddressSpace MiCloneVads MiCoalesceFreeLargePages MiCoalesceFreePages MiCombineIdenticalPages MiCombineInitialInstance MiCombineWithExisting MiCombineWorkingSet MiCommitExistingVad MiComputeAgeDistribution MiComputeCacheAttributeSpeeds MiComputeIdealDpcGang MiComputeNodeMemory MiConvertHiberPhasePages MiCopyFromUntrustedMemory MiCopyLargeVad MiCopyOnWrite MiCopyPagesIntoEnclave MiCopyToCfgBitMap MiCopyToUntrustedMemory MiCopyVirtualMemory MiCountBootDriverRegions MiCountSharedPages MiCrcStillIntact MiCreateImageFileMap MiCreateInitialSystemWsles MiCreateNewSection MiCreatePagefile MiCreatePagingFileMap MiCreatePerNodeZeroingConductor MiCreateSessionDriverProtos MiCreateSlabAllocationsFromLoaderBlock MiDecayPfnFullyInitialized MiDecommitHardwareEnclavePages MiDecommitLargePoolVa MiDecommitPages MiDeleteAllHardwareEnclaves MiDeleteClusterPage MiDeleteClusterSection MiDeleteEmptyPageTables MiDeleteFinalPageTables MiDeleteInsertedCloneVads MiDeletePagablePteRange MiDeletePteRun MiDeletePteWsleCluster MiDeleteSystemPagableVm MiDeleteSystemPageTables MiDeleteVa MiDeliverPicoExceptionForProbedPage MiDemoteCombinedPte MiDemoteLocalLargePage MiDemoteSlabEntries MiDemoteValidLargePageOneLevel MiDeprioritizeVirtualAddresses MiDereferenceSegmentThread MiDetachAndUnlockWorkingSet MiDispatchFault MiEliminateZeroPages MiEmptyAccessLogs MiEmptyWorkingSetInitiate MiEnableNewPfns MiExamineHalVa MiFillHyperPtes MiFillPfnGaps MiFindActualFaultingPte MiFindContiguousPagesEx MiFindLargeMapping MiFindLargestLoaderDescriptor MiFindProcessImageHotPatchRecord MiFlushAllPages MiFlushCacheMdl MiFlushDirtyBitsToPfn MiFlushEntireTbDueToAttributeChange MiFlushSectionInternal MiFlushStaleCacheMap MiFlushStrongCodeDriverLoadFailures MiFlushTbAsNeeded MiFlushValidPteFromTb MiFlushWaitForReadInProgress MiFreeBootDriverPages MiFreeLargePageChain MiFreeLargePages MiFreeLargeProcessPagesToCache MiFreeLargeZeroPages MiFreePagesFromMdl MiFreePhysicalPageChain MiFreePhysicalPages MiFreeUnusedSlabPages MiFreeWsleList MiGetBaseResidentPage MiGetClusterPage MiGetLargePage MiGetLargePageChain MiGetNextAffinityWalker MiGetNextAffinityWalkerLegacy MiGetNextPageTable MiGetPage MiGetPageChain MiGetPerfectColorHeadPage MiGetPteFromCopyList MiGetSlabStandbyPage MiGetSystemAddressForImage MiGetTopLevelPfn MiGetWorkingSetInfoEx MiGetWorkingSetInfoList MiHotPatchAllProcesses MiHugePageOperation MiIdealClusterPage MiIdentifyPfn MiInPagePageTable MiInPageSingleKernelStack MiInSwapSharedWorkingSetWorker MiInSwapStoreWorker MiInitNucleus MiInitSystem MiInitializeCacheFlushing MiInitializeChannelRangesTemporary MiInitializeDriverImages MiInitializeDynamicPfns MiInitializeLargeMdlLeafPfns MiInitializeLargePageColorSizes MiInitializeNumaGraph MiInitializePartitionThreads MiInitializeProcessBottomUpEntropy MiInitializeSessionIds MiInitializeTbFlush MiInitializeZeroEngines MiInsertChildVads MiInsertLargePageChain MiInsertNewZeroThread MiInsertPageInList MiInsertPagesInList MiInvokePatchCallback MiIsCfgBitMapPageShared MiIssueHardFault MiLargePageFault MiLargePagePromote MiLoadDataIntoVsmEnclave MiLockCode MiLockDownWorkingSet MiLogAddPhysicalMemory MiLogAllocateWsleEvent MiLogBadMapper MiLogCombinedPteDelete MiLogCommitRequestFailed MiLogContinueTrim MiLogCreateImageFileMapFailure MiLogFailedDriverLoad MiLogHotPatchManagement MiLogHotPatchOperation MiLogHotPatchOperationStatus MiLogHotPatchPagesLocked MiLogHotPatchRundown MiLogKernelStackEvent MiLogMdlRangeEvent MiLogNonPagedPoolReleaseEvent MiLogNonRetpolineImageLoadEvent MiLogNotifyPageHeat MiLogOutswappedProcessCommitReacquire MiLogOutswappedProcessCommitRelease MiLogPerfMemoryEvent MiLogPerfMemoryRangeEvent MiLogPeriodicTelemetry MiLogPeriodicTelemetryForSlabAllocator MiLogPinDriverAddress MiLogPinDriverAddressesWorker MiLogProcessWorkingSetsStop MiLogRemoveWsleEvent MiLogReserveVaFailed MiLogResetPagesCommitRelease MiLogSectionCreate MiLogSlabEntriesDemote MiLogSlabEntryAllocateFailure MiLogStrongCodeDriverLoadFailure MiLogTrimWs MiLogWsEmptyControl MiMakeOutswappedPageResident MiMakePageAvoidRead MiMakeSystemCacheRangeValid MiMakeVaRangeNoAccess MiMakeZeroedPageTablesEx MiMapContiguousMemory MiMapImageForEnclaveUse MiMapMdlCommon MiMapMemoryDumpMdl MiMapUserLargePages MiMapViewOfSection MiMarkBootKernelStack MiMarkHiberNotCachedPages MiMarkHugeRangeTransition MiMarkKernelImageCfgBits MiMarkKernelPageTablePages MiMarkLargePageMappings MiMarkNonPagedHiberPhasePages MiMarkSharedImageCfgBits MiModifiedPageWriter MiMoveDirtyBitsToPfns MiMoveLargeFreePage MiNodeZeroConductor MiOpenHotPatchFile MiOrderTrimList MiOutSwapKernelStackPage MiOutSwapWorkingSet MiParseComAndCetHeaders MiParseImageLoadConfig MiPartitionWorkingSetManager MiPerformSafePdeWrite MiPersistMdl MiPfCompleteInPageSupport MiPfnRangeIsZero MiPopulateCfgBitMap MiProcessWorkingSets MiProtectAweRegion MiProtectDriverSectionPte MiProtectEnclavePages MiProtectLargeKernelHalRange MiProtectPrivateMemory MiProtectSharedUserPage MiProtectSystemImage MiPruneProcessLargePageCaches MiQueryAddressState MiQueryMemoryPhysicalContiguity MiQueryProcessActivePatches MiReadyReservedView MiRebuildPageTableLeafAges MiReferenceIoPages MiReferenceNonPagedMemoryProcessList MiReleaseLargePdeMappings MiReleaseProcessReferenceToSessionDataPage MiReleasePtes MiReleaseSmallPteMappings MiReloadBootLoadedDrivers MiRelocateImage MiRemoveLowestPriorityStandbyPage MiReplacePageOfProtoPool MiReplacePageTablePage MiReplacePfnWithGapMapping MiReplaceRotateWithDemandZero MiReplaceRotateWithDemandZeroNoCopy MiReplaceTransitionPage MiReturnSystemVa MiScrubActiveLargePage MiScrubLargeMappedPage MiSelectBestZeroingProcessor MiSelectBestZeroingProcessorLegacy MiSessionCreate MiSessionObjectCreate MiSetIdealProcessorThread MiSetPagesModified MiSetPagingOfDriver MiSetProtectionOnSection MiSetReadOnlyOnSectionView MiSetSystemCodeProtection MiSetVaAgeList MiSharePages MiShowBadMapper MiSimpleAging MiSnapDriverRange MiSoftFaultMappedView MiStealPage MiStoreEvictThread MiStoreLogFullPagefile MiStoreLogNotCandidate MiStoreLogWriteCompleteFailure MiStoreLogWriteDisabled MiStoreLogWriteIssueFailure MiStoreLogWriteIssueRetry MiSwitchToTransition MiSystemFault MiTerminateWsleCluster MiTradeBootImagePage MiTransferFileExtent MiTranslatePageForCopy MiTrimSharedPageFromViews MiTrimUnusedPageFileRegionsWorker MiTrimWorkingSet MiUnapplyDriverHotPatch MiUnlinkNodeLargePages MiUnlinkPageFromBadList MiUnlinkPageFromListEx MiUnmapImageForEnclaveUse MiUnmapMdlCommon MiUnmapRetpolineStubs MiUnmapViewOfSection MiUpdateCfgSystemWideBitmapWorker MiUpdatePageAttributeStamp MiUpdateRetpolineImportFixups MiValidatePagefilePageHash MiValidateSectionCreate MiVerifyLargeSectionLayout MiWaitForFreePage MiWalkEntireImage MiWalkResetCommitPages MiWalkVaRange MiWorkingSetManager MiWriteAwePtes MiWritePageFileHash MiWritePteHighLevel MiWritePteHighLevelIsr MiZeroAllPageFiles MiZeroAndFlushPtes MiZeroAndReleasePages MiZeroHugeRangeCore MiZeroInParallel MiZeroInParallelWorker MiZeroLargePage MiZeroPage MiZeroPageCalibrate MiZeroPageFile MiZeroPageFileFirstPage MiZeroPageWorkMapping MiZeroPageWrite MigrateOOBELanguageToInstallationLanguage MinAsn1DecodeGeneralizedTime MinAsn1ExtractParsedCertificatesFromSignedData MinAsn1ExtractValues MinAsn1ParseAndDecodeRDNComponent MinAsn1ParseSingleExtensionValue MinAsn1StringToOid MinCryptCheckCertsAndKeys MinCryptDecodeHashAlgorithmIdentifier MinCryptDecodeSignatureAlgorithmIdentifier MinCryptIsKeyPresent MinCryptVerifySignedHash2 MmAccessFault MmAddRangeToCrashDump MmAllocateContiguousMemoryEx MmAllocateContiguousNodeMemory MmAllocateMappingAddressEx MmAssignProcessToJob MmCheckCachedPageStates MmCopyMemory MmCreatePeb MmCreateShadowMapping MmCreateTeb MmDeleteShadowMapping MmDeleteTeb MmEnforceWorkingSetLimit MmEnumerateAddressSpaceAndReferenceImages MmEnumerateSystemImages MmFlushVirtualMemory MmFreeLoaderBlock MmFreeNonChargedSecurePages MmFreeSecureKernelPages MmFreeVirtualMemory MmGetChannelInformation MmIdentifyPhysicalMemory MmInSwapVirtualAddresses MmInSwapWorkingSet MmInitializeHandBuiltProcess2 MmInitializeProcessAddressSpace MmIsFileMapped MmLogQueryCombineStats MmLogSystemShareablePfnInfo MmManagePartitionMemoryInformation MmMarkPhysicalMemoryAsBad MmNotifyProcessInSwapTrigger MmOutPageKernelStack MmOutSwapVirtualAddresses MmOutSwapWorkingSet MmPerfLogSessionRundown MmPrefetchVirtualMemory MmProbeAndLockProcessPages MmProbeAndLockSelectedPages MmProcessWorkingSetControl MmProtectDriverSection MmProtectMdlSystemAddress MmProtectPool MmQueryBadAddresses MmQueryCommitReleaseState MmQueryMemoryListInformation MmQueryVirtualMemory MmReleaseCommitForMemResetPages MmRelocatePfnList MmRemoveExecuteGrants MmRemoveSystemCacheFromDump MmSecureVirtualMemoryAgainstWrites MmSetAddressRangeModifiedEx MmSetCommitReleaseEligibility MmSetPageProtection MmSetPfnListInfo MmStoreLogCorruptionFixed MmUnlockPhysicalPagesByVa MmUnmapIoSpace MmUnmapProtectedKernelPageRange MmUpdateOldWorkingSetPages MmWaitMultipleForCacheManagerPrefetch MmWriteSystemImageTracepoint MmZeroPageFileAtShutdown MxCreatePfns MxZeroPageTablePfns NtAddAtomEx NtAlpcSetInformation NtCommitRegistryTransaction NtCompressKey NtCreateEnclave NtCreateMailslotFile NtCreateNamedPipeFile NtCreateProfile NtCreateSymbolicLinkObject NtCreateThread NtCreateThreadEx NtCreateTokenEx NtCreateUserProcess NtCreateWnfStateName NtDebugActiveProcess NtDeleteBootEntry NtDeleteDriverEntry NtDeleteFile NtDeleteKey NtDeleteValueKey NtEnumerateKey NtEnumerateValueKey NtFindAtom NtFlushKey NtFreeUserPhysicalPages NtFreezeRegistry NtGetCachedSigningLevel NtGetCompleteWnfStateSubscription NtGetNextProcess NtGetNextThread NtGetNlsSectionPtr NtGetWriteWatch NtInitializeEnclave NtLoadEnclaveData NtLockProductActivationKeys NtLockVirtualMemory NtManageHotPatch NtManagePartition NtMapUserPhysicalPages NtMapUserPhysicalPagesScatter NtNotifyChangeMultipleKeys NtNotifyChangeSession NtOpenProcessTokenEx NtPowerInformation NtProtectVirtualMemory NtPssCaptureVaSpaceBulk NtQueryAttributesFile NtQueryFullAttributesFile NtQueryInformationFile NtQueryInformationJobObject NtQueryInformationProcess NtQueryInformationThread NtQueryKey NtQueryMultipleValueKey NtQueryOpenSubKeys NtQueryOpenSubKeysEx NtQuerySystemEnvironmentValueEx NtQueryValueKey NtQueryWnfStateData NtRaiseHardError NtRemoveIoCompletionEx NtRemoveProcessDebug NtRenameKey NtReplaceKey NtResetWriteWatch NtRestoreKey NtRollbackRegistryTransaction NtSaveKeyEx NtSaveMergedKeys NtSecureConnectPort NtSetContextThread NtSetDefaultLocale NtSetInformationJobObject NtSetInformationKey NtSetInformationProcess NtSetInformationThread NtSetInformationVirtualMemory NtSetInformationWorkerFactory NtSetSystemEnvironmentValueEx NtSetSystemInformation NtSetSystemPowerState NtSetSystemTime NtSetUuidSeed NtSetValueKey NtSetVolumeInformationFile NtThawRegistry NtTraceEvent NtUnlockVirtualMemory NtWaitForDebugEvent NtWaitForMultipleObjects NtWaitForMultipleObjects32 NtWaitForWorkViaWorkerFactory ObCloseHandleTableEntry ObCreateObjectTypeEx ObCreateSiloRootDirectory ObCreateSymbolicLink ObDuplicateObject ObGetSiloRootDirectoryPath ObInitSystem ObInsertObjectEx ObOpenObjectByPointer ObReferenceObjectByName ObSetHandleAttributes ObWaitForMultipleObjects ObpAdjustCreatorAccessState ObpCloseHandle ObpCreateHandle ObpDecrementHandleCount ObpIncrementHandleCountEx ObpInsertHandleCount ObpInsertOrLocateNamedObject ObpParseSymbolicLinkEx ObpProcessRemoveObjectQueue ObpStartRuntimeStackTrace ObpVerifyAccessToBoundaryEntry ObpVerifyCreatorAccessCheck OpenGlobalizationUserSettingsKey_ForMua Ordinal_14 Ordinal_30 Ordinal_5 Ordinal_6 Ordinal_9 PerfDiagInitialize PerfDiagpIsTracingAllowed PerfDiagpUpdatePerfDiagLoggerEnableFlags PerfInfoLogIpiSend PerfInfoLogSysCallEntry PerfInfoLogSysCallExit PerfInfoLogUnexpectedInterrupt PerfInfoLogVirtualAlloc PerfInfoLogVirtualFree PerfLogExecutiveResourceInitialize PerfLogExecutiveResourceRelease PerfLogExecutiveResourceSetOwnerPointer PerfLogExecutiveResourceWait PerfLogImageLoad PerfLogSpinLockRelease PfQuerySuperfetchInformation PfSnAppLaunchScenarioControl PfSnAsyncPrefetchWorker PfSnBeginAppLaunch PfSnCheckActionsNeeded PfSnCheckModernApp PfSnEndTrace PfSnGetPrefetchInstructions PfSnGetSectionObject PfSnLogAsyncWorker PfSnLogGetReadListsStart PfSnLogGetReadListsStop PfSnLogOpenVolumesForPrefetch PfSnLogPrefetchMetadata PfSnLogScenarioDecision PfSnOperationProcess PfSnParametersRead PfSnParsePrefetchParam PfSnPopulateReadList PfSnPrefetchSections PfSnQueryVolumeInfo PfSnSetAltPrefetchParam PfSnSetPrefetcherInformation PfSnVolumeCheckIsSdBus PfSnVolumeCheckSeekPenalty PfTLoggingWorker PfVerifyScenarioBuffer PfpFlushBuffers PfpGetParameter PfpLogApplicationEvent PfpParametersRead PfpPrefetchRequestPerform PfpPrivSourceEnum PfpQueryFileExtentsRequest PfpQueryGpuUtilization PfpRpControlRequest PfpRpControlRequestCopy PfpSourceGetPrefetchSupport PfpUpdateRepurposedByPrefetch PfpVolumeOpenAndVerify Phase1InitializationDiscard PiAuCheckTokenMembership PiAuCreateStandardSecurityObject PiAuDoesClientHavePrivilege PiAuditDeviceOperation PiCMDeleteDeviceKey PiCMGetDeviceInterfaceAlias PiCMGetDeviceInterfaceList PiCMGetObjectProperty PiCMRegisterDeviceInterface PiCMSetDeviceProblem PiCMSetObjectProperty PiControlGetDevicePowerData PiCreateDriverSwDeviceCallback PiDcHandleCustomDeviceEvent PiDcHandleDeviceEvent PiDcHandleInterfaceEvent PiDcInitUpdateProperties PiDcResetChildDeviceContainerCallback PiDcResetChildDeviceContainers PiDcUpdateDeviceContainerMembership PiDevCfgCheckDeviceNeedsUpdate PiDevCfgClearDeviceMigrationNode PiDevCfgConfigureDevice PiDevCfgConfigureDeviceInterfaces PiDevCfgConfigureDeviceLocation PiDevCfgCopyDeviceKey PiDevCfgEnumDeviceKeys PiDevCfgFindDeviceMigrationNode PiDevCfgGetKeySecurityDescriptor PiDevCfgInitDeviceContext PiDevCfgLogDeviceConfigured PiDevCfgLogDeviceStarted PiDevCfgParsePropertyKeyName PiDevCfgQueryDeviceMigrationNode PiDevCfgQueryDriverConfiguration PiDevCfgQueryDriverNode PiDevCfgQueryPolicyStringList PiDevCfgResetDeviceDriverSettings PiDevCfgResolveVariableDeviceProperty PiDevCfgResolveVariableExpression PiDevCfgResolveVariableFormatString PiDevCfgResolveVariableGenerateGuid PiDevCfgResolveVariableKeyHandle PiDevCfgResolveVariableSwitchCase PiDevCfgSplitDriverConfigurationId PiDmAddCacheReferenceForObject PiDmCacheDataEncode PiDmEnumObjectsWithCallback PiDmGetObject PiDmGetReferencedObjectFromProperty PiDmListInitEnumCallback PiDmLookupObject PiDmObjectGetCachedCmProperty PiDmObjectUpdateCachedCmProperty PiDqActionDataGetChangedProperties PiDqDeleteUserObjectFromLoadedHives PiDqIrpQueryCreate PiDqObjectManagerEnumerateAndRegisterQuery PiDqObjectManagerServiceActionQueue PiDqOpenUserObjectRegKey PiDqSameUserHive PiDrvDbOverlayCopyKeys PiDrvDbOverlayNodeHive PiGetDeviceRegProperty PiGetDeviceRegistryProperty PiIsDriverBlocked PiLastGoodRevertLastKnownDirectory PiLookupInDDBCache PiPnpRtlCmActionCallback PiPnpRtlGatherInstallerClassChangeInfo PiPnpRtlGatherInterfaceDeleteInfo PiPnpRtlGetFilteredDeviceInterfaceList PiPnpRtlInterfaceFilterCallback PiPnpRtlIsDeviceEnumerableForUser PiPnpRtlObjectEventCreate PiPnpRtlObjectEventWorker PiPnpRtlServiceFilterCallback PiPnpRtlSetObjectProperty PiProcessDriverInstance PiProcessNewDeviceNode PiQueryRemovableDeviceOverride PiRearrangeDeviceInstances PiRebalanceOptOut PiSwCompleteCreate PiSwFindSwDevice PiUEventApplyAdditionalFilters PiUEventBroadcastPortsChangedEvent PiUEventInitClientRegistrationContext PiUpdateDriverDBCache PipCallDriverAddDevice PipCallbackHasDeviceOverrides PipChangeDeviceObjectFromRegistryProperties PipCheckComputerSupported PipCreateComputerId PipCriticalDeviceWaitCallback PipDmgGetDeviceDmarPolicy PipGenerateContainerID PipGetPersistentMemory PipHardwareConfigClearStartOverrideCallback PipHardwareConfigClearStartOverrides PipHardwareConfigExists PipHardwareConfigInit PipInitComputerIds PipInitDeviceOverrideCache PipIs32bitKey PipKsrNotifyDrivers PipMakeGloballyUniqueId PipProcessPendingObjects PipResetDevice PipServiceInstanceToDeviceInstance PipUnprotectDevice PipUpdateDeviceProducts PnpBuildCmResourceList PnpCallAddDevice PnpCompareInterruptInformation PnpDeviceActionWorker PnpDeviceEventWorker PnpDiagRundownConnectionResourceForEachDevice PnpDiagRundownInterruptResourceForEachDevice PnpDiagRundownParentDevNodeForEachDevice PnpDiagRundownParentPdoForEachDevice PnpDiagnosticTraceAppVeto PnpDiagnosticTraceDeviceOperation PnpDiagnosticTraceDriverFullInfo PnpDiagnosticTraceElamDecision PnpDiagnosticTraceElamStatus PnpDiagnosticTraceObject PnpDiagnosticTraceObjectWithStatus PnpDriverLoadingFailed PnpGetDeviceInterfacePropertyData PnpGetDevicePropertyData PnpGetStableSystemBootTime PnpHardwareConfigCreateBootDriverFlags PnpInitializeNotifyEntry PnpIsValidGuidString PnpNotifyDeviceClassChange PnpNotifyDriverCallback PnpNotifyHwProfileChange PnpNotifyTargetDeviceChange PnpNotifyUserModeDeviceRemoval PnpPrepareDriverLoading PnpProcessDeferredRegistrations PnpQueryAndSaveDeviceNodeCapabilities PnpRebalance PnpRegistryValueExists PnpReplacePartitionUnit PnpSendIrp PnpSetDeviceAffinityThread PnpSetDeviceInterfacePropertyData PnpSetDevicePropertyData PnpShutdownDevices PnpTraceClearDevNodeProblem PnpTraceDeviceConfig PnpTraceDeviceRemovalForResetComplete PnpTraceDmaGuardDevicePolicy PnpTraceDmaGuardSystemPolicy PnpTraceDockDeviceEnumeration PnpTraceDriverBlocked PnpTraceInterruptConnection PnpTraceIommuDeviceProperties PnpTraceRebalanceResult PnpTraceRequestDeviceRemovalForReset PnpTraceSecureDeviceEnumeration PnpTraceSetDevNodeProblem PnpTraceWatchdogViolation PnprCopyReservedMapping PnprLogFailureEvent PnprLogStartEvent PnprLogSuccessEvent PnprQuiesceProcessors PnprQuiesceWorker PoBroadcastSystemState PoClearTransitionMarker PoDiagTraceDeviceRundown PoDiagTraceIRTimerSleepStudyRundown PoEnergyContextStart PoEnergyContextUpdateComponentPower PoExecuteIdleCheck PoFxEnableDStateReporting PoFxRegisterDebugger PoFxSetComponentLatency PoFxSetComponentResidency PoFxSetTargetDripsDevicePowerState PoGetIdleTimes PoGetLightestSystemStateForEject PoGetPerfStateAndParkingInfo PoIdle PoInitSystem PoInitiateProcessorWake PoLatencySensitivityHint PoPowerOffMonitor PoRegisterPowerSettingCallback PoRundownSystemTimer PoSetUserPresent PoThermalCounterSetCallback PoTraceDynamicTickDisabled PoTraceForceIdleReset PoTraceForceIdleStateChange PoTraceSystemTimerResolution PoTraceSystemTimerResolutionIgnore PoTraceSystemTimerResolutionKernel PoTraceSystemTimerResolutionUpdate PopAccountBatteryEnergyChange PopAccountCbEnergyChange PopAcquireAdaptiveLock PopAdaptiveGetSessionStateUnsafe PopAdaptivePersistSystemInitatedRebootState PopAdaptivePowerSettingCallback PopAdaptiveWnfCallback PopApplyAdminPolicy PopApplyPolicy PopAssessSystemIdleEvent PopBatteryApplyCompositeState PopBatteryCheckCompositeCapacity PopBatteryInitialize PopBatteryQueryEstimatedTime PopBatteryTracePercentageRemaining PopBatteryTraceSystemBatteryStatus PopBatteryUpdateAlarms PopBatteryWorker PopBcdEstablishResumeObject PopBcdRegenerateResumeObject PopBcdSetPendingResume PopBlockSessionSwitch PopBootBatteryStatusWorker PopCalculateHiberFileSize PopCallPowerSettingCallback PopCaptureSleepStudyStatistics PopCheckShutdownMarker PopClearHiberFileSignature PopCompressHiberBlocks PopConfigureHeteroPolicies PopCreateHiberFile PopCreateNotificationName PopDecompressHiberBlocks PopDiagTraceAbnormalReset PopDiagTraceAcDcStateChange PopDiagTraceActiveCooling PopDiagTraceAdaptiveBootOverride PopDiagTraceAdaptiveBootOverridePrepared PopDiagTraceAdaptiveOverrideClear PopDiagTraceAdaptiveOverrideTriggered PopDiagTraceAppPowerMessage PopDiagTraceAppPowerMessageEnd PopDiagTraceBatteryAlarmStatus PopDiagTraceBatteryCountChange PopDiagTraceBatteryTriggerFlags PopDiagTraceBatteryTriggerMet PopDiagTraceBsdWriteTime PopDiagTraceClearDeepSleepConstraint PopDiagTraceConsoleDisplayState PopDiagTraceControlCallback PopDiagTraceCoolingExtension PopDiagTraceCoolingExtensionActiveUpdate PopDiagTraceCoolingExtensionPassiveUpdate PopDiagTraceCsConsumption PopDiagTraceCsDeepSleepWatchdog PopDiagTraceCsDripsDivergence PopDiagTraceCsDripsWatchdog PopDiagTraceCsDripsWatchdogPerfTrack PopDiagTraceCsEnterReason PopDiagTraceCsExitReason PopDiagTraceCsFanPerfTrack PopDiagTraceCsResiliencyStats PopDiagTraceDIrpAfterSx PopDiagTraceDebuggerTransitionRequirements PopDiagTraceDeepSleepConstraintRundown PopDiagTraceDeviceAcquireIrp PopDiagTraceDeviceComplianceRundown PopDiagTraceDeviceComplianceUpdate PopDiagTraceDeviceIdleCheck PopDiagTraceDeviceReleaseIrp PopDiagTraceDeviceVerboseRundown PopDiagTraceDevicesLevel PopDiagTraceDevicesSuspend PopDiagTraceDirectedDripsInitialization PopDiagTraceDirectedDripsNotifyAppsAndServices PopDiagTraceDirtyTransition PopDiagTraceDiskIdleCheck PopDiagTraceDisplayBurstWin32kCallout PopDiagTraceDozeDeferralDecision PopDiagTraceDripsHistogram PopDiagTraceDriverVeto PopDiagTraceDynamicTickStatusRundown PopDiagTraceEsState PopDiagTraceExecutePowerAction PopDiagTraceFirmwareS3Stats PopDiagTraceFxComponentAccounting PopDiagTraceFxComponentIdleConstraints PopDiagTraceFxComponentIdleState PopDiagTraceFxComponentLogicalCondition PopDiagTraceFxComponentRegistration PopDiagTraceFxComponentWake PopDiagTraceFxDefaultPepWorkerEnd PopDiagTraceFxDeviceAccounting PopDiagTraceFxDeviceDirectedCompletion PopDiagTraceFxDeviceDirectedTransition PopDiagTraceFxDeviceIdleConstraints PopDiagTraceFxDevicePowerRequirement PopDiagTraceFxDevicePowerState PopDiagTraceFxDevicePowered PopDiagTraceFxDevicePreparation PopDiagTraceFxDeviceRegistration PopDiagTraceFxDeviceStartPowerManagement PopDiagTraceFxDeviceUnregistration PopDiagTraceFxGlobalDeviceAccounting PopDiagTraceFxPerfNominalChange PopDiagTraceFxPerfRegistration PopDiagTraceFxPerfRequest PopDiagTraceFxPerfRequestComplete PopDiagTraceFxPerfRequestProgress PopDiagTraceFxPerfSetRegistration PopDiagTraceFxPluginRegistration PopDiagTraceHiberStats PopDiagTraceHibernateErrorStatus PopDiagTraceIdleCheck PopDiagTraceIdleResiliencyEnd PopDiagTraceIdleResiliencyStart PopDiagTraceIllegalProcessorThrottle PopDiagTraceInvalidBootStat PopDiagTraceIoCoalescingDiskIdle PopDiagTraceIoCoalescingOn PopDiagTraceIrpFinish PopDiagTraceIrpFinishTelemetry PopDiagTraceIrpPended PopDiagTraceIrpStart PopDiagTraceKernelQueriesAllowed PopDiagTraceMonitorOnWithLidClosed PopDiagTraceMtrrError PopDiagTracePassiveCooling PopDiagTracePerfTrackData PopDiagTracePlatformRoleRundown PopDiagTracePolicyChange PopDiagTracePolicyInitiatePowerActionApiCall PopDiagTracePostSleepNotification PopDiagTracePowerButtonBugcheck PopDiagTracePowerRequestChange PopDiagTracePowerRequestCreate PopDiagTracePowerSetting PopDiagTracePowerSettingRegistration PopDiagTracePowerStateEvent PopDiagTracePowerStateEventRundown PopDiagTracePowerTransitionEnd PopDiagTracePowerTransitionStart PopDiagTracePowerTransitionTime PopDiagTracePreSleepNotification PopDiagTraceProcessorThrottleDurationPerfTrack PopDiagTraceProcessorThrottlePerfTrack PopDiagTraceRegisterSystemState PopDiagTraceRtcWakeInfo PopDiagTraceServiceNotification PopDiagTraceSessionDisplayStateChange PopDiagTraceSessionState PopDiagTraceSessionStateCounted PopDiagTraceSessionStates PopDiagTraceSetDeepSleepConstraint PopDiagTraceSetSystemState PopDiagTraceSetThreadExecutionState PopDiagTraceShutdownAction PopDiagTraceSkipTick PopDiagTraceSleepReliabilityDiagConfigUpdate PopDiagTraceSleepStudyStart PopDiagTraceSleepStudyStop PopDiagTraceStateTransitionFailurePoint PopDiagTraceSystemIdleContextUpdate PopDiagTraceSystemIdleRundown PopDiagTraceSystemLatencyUpdate PopDiagTraceThermalCoolingMode PopDiagTraceThermalRequest PopDiagTraceThermalRequestActiveUpdate PopDiagTraceThermalRequestPassiveUpdate PopDiagTraceThermalStateChange PopDiagTraceThermalZoneEnumeration PopDiagTraceThermalZoneRundown PopDiagTraceThermalZoneThrottleDurationPerfTrack PopDiagTraceThermalZoneThrottlePerfTrack PopDiagTraceTripPointExceeded PopDiagTraceUmpoAlpcProcessingError PopDiagTraceUsermodeThermalEvent PopDirectedDripsDiagNotifySessionStop PopDirectedDripsDiagRundownBroadcastTrees PopDirectedDripsDiagRundownDevices PopDirectedDripsDiagTraceBroadcastVisit PopDirectedDripsDiagTraceDfxPowerStateFailure PopDirectedDripsDiagTraceMarkDevice PopDirectedDripsDiagTraceNotifyDevices PopDirectedDripsDiagTraceProblemDevice PopDirectedDripsQueryRegistryValues PopDirectedDripsSendSuspendResumeNotification PopDispatchNotificationsToList PopDispatchStateCallout PopDripsWatchdogCheckHwDivergence PopDripsWatchdogDiagnosticWorker PopEnableHiberFile PopEsUpdateSetting PopEstimateChargeTime PopEtAppIdIntern PopEtEnergyContextProcessStateUpdate PopEtEnergyTrackerUpdateAggregate PopEtGetProcessAppId PopEtInit PopEtIsrDpcQuery PopEtProcessEnumSnapshotCallback PopEvaluateInputSuppressionAction PopEvaluateWeakChargerState PopEventCalloutDispatch PopExecutePowerAction PopExecuteSystemIdleAction PopFanReadFanNoiseInfo PopFanSetupRpmBuckets PopFanUpdateSpeed PopFanUpdateStatistics PopFanWorker PopFlushAndHold PopFlushVolumeWorker PopFxBuildDripsBlockingDeviceList PopFxInitializeSocSubsystemStaticInfo PopFxIsDevicePotentialDripsConstraint PopFxLogSocSubsystemBlockingTimes PopFxPlatformIdleVeto PopFxProcessorIdleVeto PopFxStopDeviceAccounting PopFxTraceDeviceRegistration PopFxUpdatePlatformIdleState PopFxUpdateProcessorIdleState PopGetBitlockerKeyLocation PopGetHwConfigurationSignature PopGetSettingNotificationName PopHiberCheckResume PopIdleWakeGenerateInterruptDescriptionString PopIdleWakeNotifyModernStandbyExitWorker PopIdleWakeSendDripsWakeSourceTelemetry PopIdleWakeTraceWakeSourceDiagnostic PopInitPlatformSettings PopInitSIdle PopInitializeHeteroProcessors PopInitializePowerButtonHold PopInitializePowerPolicySimulate PopInvokeStateHandlerTargetProcessor PopInvokeSystemStateHandler PopIsMktmeEnabled PopIsRemoteDesktopEnabled PopIsSystemIdle PopIssueActionRequest PopLidReliabilityInit PopLidSwitchChangeCallback PopLidSwitchReliabilityUpdateCallback PopLogNotifyDevice PopMarshalSettingValues PopMonitorProcessLoop PopNetWnfLowPowerEpochCallback PopOpenPersistedRegistryKey PopOpenThermalLoggingKey PopPdcCsCheckSystemVolumeDevice PopPepInitializeDebuggerMasks PopPepInitializeVetoMasks PopPepUpdateIdleStateRefCount PopPepWork PopPlNotifyDeviceDState PopPlNotifyDeviceFState PopPlPublishInitialPowerDraw PopPlPublishSystemPowerChange PopPlRegisterComponent PopPlRegisterDevice PopPlRegisterDeviceIterator PopPlRegisterPowerPlane PopPlTraceLogPowerPlane PopPlUnregisterComponent PopPlUnregisterDevice PopPolicyDeviceHandleWakeAlarmNotification PopPolicyWorkerAction PopPotsLogDirtyPowerTransition PopPotsLogPowerTransitionReliability PopPowerAggregatorDiagTraceHandleIntent PopPowerAggregatorDiagTracePdcSleepTransition PopPowerAggregatorInvokeStateMachine PopPowerAggregatorNotifySuspendResume PopPowerAggregatorSetCurrentState PopPowerButtonSettingCallback PopPowerButtonWorkCallback PopPowerInformationInternal PopPowerRequestDelete PopPowerRequestStatsInitialize PopPowerSourceChangeCallback PopQueryHiberPersistedRegValue PopQueryPowerButtonConfiguration PopReadHiberbootGroupPolicy PopReadHiberbootPolicy PopReadLegacySimulateProcessorClass PopReadShutdownPolicy PopReadSimulateProcessorClass PopReadSimulateProcessorClasses PopReadSystemAwayModePolicy PopRecordPoIrpBlackboxInformation PopReleaseAdaptiveLock PopResetCurrentPolicies PopSaveHiberContext PopSendSuspendResumeApplicationNotification PopSendSuspendResumeServiceNotification PopSetAwayModeStatus PopSetDevicesSystemState PopSetMemoryOverwriteRequestAction PopSleepstudyCaptureResiliencyStatistics PopSleepstudySendSessionChangeEvent PopSleepstudySendSessionChangeWnf PopSleepstudySendWnfNotification PopSleepstudyStartNextSession PopSpoilBatteryEstimate PopSqmAddToStream PopSqmFanEnumeration PopSqmThermalCriticalEvent PopSqmThermalUsermodeEvent PopSqmThermalZoneEnumeration PopSystemIrpCompletion PopThermalHandlePreviousShutdown PopThermalWorker PopTraceBootError PopTraceCr3Mitigated PopTraceCr3Tripped PopTraceEsBgActivityPolicyUpdate PopTraceEsSetting PopTraceEsState PopTraceHibernatePolicyUpdate PopTraceInputSuppressionActionUpdate PopTraceMonitorOnRequestUserInput PopTraceNetRefreshTimerArmed PopTracePowerReconfig PopTraceSleepCheckpointInitFailure PopTraceSmbiosChange PopTraceStandbyConnectivityRundown PopTraceStandbyConnectivityUpdate PopTraceSystemIdleS0LowPowerDoze PopTraceSystemIdleS0LowPowerDozeTimerArmed PopTraceSystemIdleS0LowPowerDozeTimerCancelled PopTraceThermalRequestActiveActivity PopTraceThermalRequestPassiveHistogram PopTraceThermalStandbyComplete PopTraceThermalStandbyInitiated PopTraceThermalZoneActiveActivity PopTraceThermalZonePassiveHistogram PopTraceZoneCr3Mitigated PopTraceZoneCr3Tripped PopTransitionTelemetryOsState PopTriggerDiagTraceAoAcCapability PopUmpoInitializeChannel PopUmpoInitializeMonitorChannel PopUmpoProcessMessage PopUmpoProcessMessages PopUmpoSendPowerMessage PopUpdateBackgroundCoolingStatus PopUpdateExternalDisplayState PopUpdateUpgradeInProgress PopUsbErrorWNFNotificationCallback PopValidateHiberFileSize PopWatchdogWorker PopWin32kPowerSettingCallback PopWnfAirplaneModeCallback PopWnfAudioCallback PopWnfFullscreenVideoCallback PopWnfMixedRealityCallback PopWnfMobileHotspotCallback PopWnfSprActiveSessionChangeCallback PopWriteBsdPoInfo PopWriteHiberImage PopWriteHiberPages PopZeroHiberFile PpDevCfgInit PpDevCfgProcessDeviceClass PpDevCfgProcessDeviceExtensions PpDevCfgProcessDeviceReset PpForEachDeviceInstanceDriver PpProcessClearProblem PpResetProblemDevices PpmCapturePerformanceDistribution PpmCheckComputeEnergy PpmCheckComputeHeteroResponse PpmCheckComputeMultiClassHeteroResponse PpmCheckContinueExecution PpmCheckInitProcessors PpmCheckInitProcessorsLegacy PpmCheckRun PpmCheckSnapAllDeliveredPerformance PpmCheckStart PpmClearSimulatedIdle PpmEstimateIdleDuration PpmEventAutonomousModeChange PpmEventBiosCapChange PpmEventCoordinatedIdleTransition PpmEventCoreParkingSoftParkedStateChange PpmEventCoreParkingStateChange PpmEventCoreParkingStateChangeEx PpmEventDomainPerfStateChange PpmEventEnergyEstimationRundown PpmEventEnterPlatformIdleState PpmEventHeteroFavoredCoreRotationChange PpmEventHeteroPolicy PpmEventHgsActiveWorkloadClass PpmEventHgsCoresUnparkedCount PpmEventHgsHardwareTable PpmEventHgsNormalizedTable PpmEventHiddenProcessorBiosCapChange PpmEventHiddenProcessorPerformance PpmEventHiddenProcessorThermalCapChange PpmEventIdleDurationExpiration PpmEventIdleStateChange PpmEventLPICoreParking PpmEventLegacyProcessorPerfStateChange PpmEventParkNodeCapChange PpmEventParkNodeClassRecordedStats PpmEventParkNodeParkHintChanged PpmEventParkNodePreference PpmEventParkingCountSelection PpmEventPerfSelectProcessorState PpmEventPlatformVetoRequest PpmEventPlatformVetoRundown PpmEventProcessorPerfStateChange PpmEventProcessorVetoRequest PpmEventProcessorVetoRundown PpmEventQosClassPolicy PpmEventQosSupport PpmEventSoftParkRankListChanged PpmEventStaticPolicyRundown PpmEventThermalCapChange PpmEventTraceAccountingBucketIntervalsRundown PpmEventTraceDeliveredPerfChange PpmEventTraceDripsAccountingSnapshot PpmEventTraceExpectedUtility PpmEventTraceFailedPerfCheckStart PpmEventTraceHeteroDistributeUtility PpmEventTraceHeteroResponse PpmEventTraceHeteroSets PpmEventTraceLPIState PpmEventTraceMultiClassHeteroResponse PpmEventTraceMultiClassHeteroResponseUpdate PpmEventTraceParkNodeRundown PpmEventTracePlatformIdleAccounting PpmEventTracePpmProfileStatusRundown PpmEventTracePreVetoAccounting PpmEventTraceProcessorIdleAccounting PpmEventTraceProcessorPerformance PpmEventTraceProcessorPerformanceDomainRundown PpmEventTraceProcessorPerformanceRundownHv PpmEventTraceProfileChange PpmEventTraceProfileEnable PpmEventTraceProfileSetting PpmEventTraceProfiles PpmEventTraceRecordedUtility PpmEventTraceSoftCoreParkingSelection PpmEventVetoReasonRundown PpmEventVpQosChange PpmHeteroComputeMultiClassUnparkCount PpmHeteroHgsProcessorInit PpmHeteroInitializeHgsSupport PpmHeteroUpdateHgsConfiguration PpmHvSnapPerformanceAccumulation PpmIdleCaptureCsVetoAccounting PpmIdleExecuteTransition PpmIdleInitializeConcurrency PpmIdleInstallNewVetoList PpmIdleSelectStates PpmInfoRegisterCallbacks PpmInfoTraceProfileSettings PpmInitIllegalThrottleLogging PpmInstallFeedbackCounters PpmInstallNewIdleStates PpmMediaBufferingWorker PpmParkComputeUnparkMask PpmParkRecordNodeStatistics PpmParkRegisterParking PpmParkReportParkedCores PpmParkSteerInterrupts PpmParkUpdateConcurrencyTracking PpmPerfApplyDomainState PpmPerfApplyProcessorStates PpmPerfArbitratorApplyProcessorState PpmPerfCalculateQosClassPolicies PpmPerfProcCapFloorSettingCallback PpmPerfRecordMostActiveWorkloadClass PpmPerfTelemetryWorker PpmPostProcessMediaBuffering PpmProcessSettingsFromQueryTable PpmRegisterPerfStates PpmRegisterSpmSettings PpmRemoveIdleStates PpmSetProfilePolicySetting PpmSetSimulatedIdle PpmSnapDripsAccountingSnapshot PpmSnapPerformanceAccumulation PpmTraceExitLatency PpmTracePerfIdleRundown PpmUnlockProcessors PpmUpdateIdleStates PpmUpdatePlatformIdleVeto PpmUpdateProcessorIdleVeto PpmUpdateProcessorPolicy PrpWriteTraceLoggingEvent PsBootPhaseComplete PsCreateMinimalProcess PsCreateSystemThreadEx PsDispatchIumService PsInitializeSyscallProviders PsMapSystemDlls PsOpenProcess PsOpenThread PsPicoWalkUserStack PsQueryProcessCommandLine PsQueryProcessExceptionFlags PsRegisterSyscallProvider PsRundownVsmEnclave PsSetLoadImageNotifyRoutineEx PsShutdownSystem PsStartSiloMonitor PsTerminateVsmEnclave PsUnregisterSiloMonitor PspAllocateAndQueryNotificationChannel PspAllocateAndQueryProcessNotificationChannel PspAllocatePartition PspAllocateProcess PspAllocateThread PspApplyMitigationOptions PspApplyWorkingSetLimits PspApplyWorkingSetLimitsToProcess PspAssignProcessQuotaBlock PspAssignProcessToJob PspBuildCreateProcessContext PspCatchCriticalBreak PspChangeProcessExecutionState PspCombineSecurityDomains PspCopyNodeRelativeMaskToAffinityEx PspCreatePicoThread PspCreateProcess PspCreateSecureThread PspCreateThread PspDeleteUserStack PspDestroySyscallProvider PspEnforceLimits PspEnforceLimitsJobPostCallback PspFoldProcessAccountingIntoJob PspFreeUserFiberShadowStack PspFreezeJobTree PspGetContextThreadInternal PspGetSetContextInternal PspHardenMitigationOptions PspIdentityBasedJobBreakaway PspInheritMitigationAuditOptions PspInheritMitigationOptions PspInitPhase0 PspInitPhase3 PspInitializeFullProcessImageName PspInitializeThunkContext PspIsDfssEnabled PspIsProcessReadyForRemoteThread PspIumAllocateSecurePool PspIumGetPhysicalPage PspIumWorker PspJobDelete PspLogAuditTerminateRemoteProcessEvent PspMapSystemDll PspOneDirectionSecurityDomainCombine PspProcessDelete PspProcessDynamicEHContinuationTargets PspProcessDynamicEnforcedAddressRanges PspQueryJobHierarchyAccountingInformation PspQueryProcessAccountingInformationCallback PspQueryQuotaLimits PspQueryRateControlHistory PspReadIFEOMitigationAuditOptions PspReadIFEOMitigationOptions PspReadIFEONodeOptions PspReadIFEOPerfOptions PspReadUserQuotaLimits PspReferenceCpuPartitionByHandle PspRundownSingleProcess PspSecureThreadStartup PspSetContextThreadInternal PspSetEffectiveJobLimits PspSetJobIoAttribution PspSetJobIoRateControl PspSetNetRateControl PspSetProcessAffinitySafe PspSetQuotaLimits PspSetupUserProcessAddressSpace PspSetupUserShadowStack PspSetupUserStack PspShutdownCsrProcess PspSyscallProviderServiceDispatchGeneric PspTrySetProcessPebThrottlingFlags PspValidateMitigationAuditOptions PspValidateMitigationOptions PspWow64GetContextThread PspWow64InitThread PspWow64ReadOrWriteThreadCpuArea PspWow64SetContextThread PspWow64SetupUserStack PspWritePebAffinityInfo PspWriteTebIdealProcessor PspWriteTebImpersonationInfo RaiseException RamdiskStart RawMountVolume RawQueryFileSystemInformation RawQueryFsSizeInfo ReadStringDelimited ReadStringDelimited RegistryOverwriteCentralProcessor RtlAddAccessFilterAce RtlAddMandatoryAce RtlAddResourceAttributeAce RtlApplyImportRelocationToImage RtlApplyImportRelocationToPage RtlApplyIndirectRelocationToPage RtlApplySwitchJumpRelocationToPage RtlAssert RtlCapabilityCheck RtlCheckTokenCapability RtlCheckTokenMembershipEx RtlContinueLongJump RtlConvertSidToUnicodeString RtlCreateHeap RtlCultureNameToLCID RtlDeriveCapabilitySidsFromName RtlDisableXfgOnTarget RtlDispatchException RtlEqualPrefixSid RtlEthernetStringToAddressA RtlEthernetStringToAddressW RtlFileMapMapView RtlFindMessage RtlFormatCurrentUserKeyPath RtlFormatMessageEx RtlGUIDFromString RtlGenerate8dot3Name RtlGenerateClass5Guid RtlGetCpuVendor RtlGetProcessorSignature RtlGetProductInfo RtlGetSetBootStatusData RtlImpersonateSelfEx RtlIncrementCorrelationVector RtlInitFunctionOverrideCapabilities RtlInitializeBootStatusDataBlackBox RtlInt64ToUnicodeString RtlIntegerToChar RtlIntegerToUnicode RtlIntegerToUnicodeString RtlIpv4AddressToStringExA RtlIpv4AddressToStringExW RtlIpv4StringToAddressA RtlIpv4StringToAddressW RtlIpv6AddressToStringExA RtlIpv6AddressToStringExW RtlIsNameLegalDOS8Dot3 RtlIsUntrustedObject RtlIsValidProcessTrustLabelSid RtlLargeIntegerToChar RtlLargeIntegerToUnicode RtlLoadString RtlLocalTimeToSystemTime RtlOsDeploymentState RtlPerformRetpolineRelocationsOnImageEx RtlQueryAtomInAtomTable RtlQueryImageFileKeyOption RtlQueryImageXfgFilter RtlQueryModuleInformation RtlQueryPackageClaims RtlQueryValidationRunlevel RtlRaiseCustomSystemEventTrigger RtlRestoreBootStatusDefaults RtlSidDominates RtlSystemTimeToLocalTime RtlUnicodeStringToInt64 RtlUnwind RtlUnwindEx RtlUpdateImportRelocationsInImage RtlUpdateSwapReference RtlVerifyVersionInfo RtlpAllocateHeapRaiseException RtlpAllowsLowBoxAccess RtlpCapabilityCheckSystemCapability RtlpCheckDynamicTimeZoneInformation RtlpCopyAces RtlpCopyEffectiveAce RtlpCreateUserProcess RtlpCreateUserThreadEx RtlpDynamicLookasideRebalance RtlpEtcIsValidFeatureId RtlpFcApplyUpdateAndAddFeature RtlpFcCalculateRequiredSizeForNewFeatureTable RtlpFcNotifyFeatureUsageTarget RtlpFcSectionTypeToBufferType RtlpFindRegTziForCurrentYear RtlpFlsFree RtlpGetDynamicTimeZoneInfoHandle RtlpGetNtProductTypeFromRegistry RtlpGetTimeZoneInfoHandle RtlpGetTokenNamedObjectPath RtlpHpAllocVA RtlpHpCustomVaCallbacksRegistrarRegister RtlpHpLfhBucketSubsegmentStatsUpdate RtlpHpLfhBucketUpdateAffinityMapping RtlpHpScheduleCompaction RtlpHpVaMgrAlloc RtlpInitNlsFileName RtlpInitializeNonVolatileFlush RtlpIsAppContainer RtlpIsNameInExpressionPrivate RtlpLogCapabilityCheckLatency RtlpMuiRegAddLanguageByName RtlpNewSecurityObject RtlpNormalizeAcl RtlpPopulateLanguageConfigList RtlpProcessIFEOKeyFilter RtlpQueryNlsSystemCodePages RtlpQueryTimeZoneInformationWorker RtlpReadExtendedContext RtlpSetSecurityObject RtlpSysVolCheckOwnerAndSecurity RtlpSysVolCreateSecurityDescriptor RtlpSysVolTakeOwnership RtlpUpdateDynamicTimeZones RtlpValidTrustSubjectContext RtlpVerCompare RtlpWalkFrameChain SC_DEVICE::GetStorageProperty SC_DEVICE::Initialize SC_DISK::GenerateId SC_DISK::Initialize SC_GPT::CreatePartitionTable SC_MBR::CreatePartitionTable SC_MBR::WritePartitionTable SLQueryLicenseValueInternal SMKM_STORE<SM_TRAITS>::SmStCleanup SMKM_STORE<SM_TRAITS>::SmStStart SMKM_STORE<SM_TRAITS>::SmStSwapStore SMKM_STORE<struct_SM_TRAITS>::SmStDirectRead SMKM_STORE<struct_SM_TRAITS>::SmStPrioritizeRegionsStore SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStore SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeCheckPresent SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogWorker SPCallServerHandleClepKdf SPCallServerHandleClepSign SPCallServerHandleIsAppLicensed ST_STORE<SM_TRAITS>::StDmStart ST_STORE<struct_SM_TRAITS>::StCompactRegions ST_STORE<struct_SM_TRAITS>::StCompactionPerformInMem ST_STORE<struct_SM_TRAITS>::StCompactionPickPriority ST_STORE<struct_SM_TRAITS>::StDmEtaPerformIo ST_STORE<struct_SM_TRAITS>::StDmPageRetrieve ST_STORE<struct_SM_TRAITS>::StDmRegionEvict ST_STORE<struct_SM_TRAITS>::StDmSinglePageCopy ST_STORE<struct_SM_TRAITS>::StDmSinglePageRetrieveSync ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd SaveNodeDistanceInformation SbpStartLanman ScExtractDeviceStrings SdbGetDatabaseMatch SdbGetEntryFlags SdbGetMergeRedirectPath SdbGetPathCustomSdb SdbMakeIndexKeyFromStringEx SdbReadEntryInformation SdbTagRefToTagID SdbpCheckMatchingRegistryEntry SdbpCheckMatchingWildcardFiles SdbpCreateSearchDBContext SdbpFindFirstIndexedWildCardTag SdbpFindNextIndexedWildCardTag SdbpGetExeEntryFlags SdbpGetFileTimestamp SdbpGetPathAppPatch SdbpGetPathAppPatchPreRS3 SdbpGetPathAppraiser SdbpGetPathCustomSdb SdbpGetPathCustomSdbPreRS3 SdbpMatchOsVersion SdbpOpenLocalDatabaseEx SddlAddAccessFilterAce SddlAddMandatoryAce SddlAddProcessTrustLabelAce SddlAddScopedPolicyIDAce SddlpUuidFromString SeAccessCheckByType SeAccessCheckFromState SeAccessCheckWithHint SeAdtRegistryValueChangedAuditAlarm SeAuditBootConfiguration SeAuditFipsCryptoSelftests SeAuditHandleDuplication SeAuditHardLinkCreationWithTransaction SeAuditPlugAndPlay SeAuditProcessCreation SeAuditProcessExit SeAuditSystemTimeChange SeAuditTransactionStateChange SeCaptureObjectTypeList SeCheckAuditPrivilege SeCheckForCriticalAceRemoval SeCheckPrivilegedObject SeEtwWriteKMCveEvent SeGetTokenDeviceMap SeLogAccessFailure SeMakeAnonymousLogonToken SeMakeAnonymousLogonTokenNoEveryone SeMakeSystemToken SeOperationAuditAlarm SePrivilegePolicyCheck SeQuerySecurityAttributesTokenAccessInformation SeReportSecurityEventWithSubCategory SeSinglePrivilegeCheck SeSinglePrivilegeCheckEx SeSubProcessToken SecureDump_ConvertBinaryToHexString SecureDump_ConvertToRsaBlob SecureDump_Encrypt_DmpData SecureDump_LoadCertAndProvisionKey SendCaptureStateNotificationsWorker SepAccessCheck SepAccessCheckAndAuditAlarm SepAccessCheckEx SepAdjustPrivileges SepAdtCloseObjectAuditAlarm SepAdtDeleteObjectAuditAlarm SepAdtGenerateDiscardAudit SepAdtInitializeBounds SepAdtLogAuditFailureEvent SepAdtLogAuditRecord SepAdtObjectReferenceAuditAlarm SepAdtOpenObjectAuditAlarm SepAdtOpenObjectForDeleteAuditAlarm SepAdtPrivilegeObjectAuditAlarm SepAdtPrivilegedServiceAuditAlarm SepAdtSecurityDescriptorChangedAuditAlarm SepAdtStagingEvent SepAdtTokenRightAdjusted SepAppendAceToTokenDefaultDacl SepAppendAceToTokenObjectAcl SepAuditAssignPrimaryToken SepCanTokenMatchAllPackageSid SepCleanupLUIDDeviceMapDirectory SepCommonAccessCheckEx SepCopyAnonymousTokenAndSetSilo SepCreateTokenEx SepDesktopAppxSubProcessToken SepGetProcUniqueLuidAndIndexFromAttributeInfo SepGetStackTraceHash SepInitializationPhase1 SepInitializeDebugOptions SepLoadNgenLocations SepLogTokenSidManagement SepLogUnmatchedSessionFlagImpersonationAttempt SepMandatoryIntegrityCheck SepMandatorySubProcessToken SepParseElamCertResources SepReadAndInsertCaps SepReadAndPopulateCapes SepRegQueryValue SepRmCallLsa SepRmCommandServerThread SepRmDispatchDataToLsa SepRmLsaConnectRequest SepRmVerifyLsaProtectionLevel SepSecureBootCheckForUpdates SepSetProcessTrustLabelAceForToken SepValidateReferencedCachedHandles SepVerifyDesktopAppPolicyOverrideCaller SepVerifyDesktopAppxImage SepVerifyDesktopAppxPackageName SetFailureLocation SiFindSystemPartition SiGetDeviceNumberInformation SiGetEfiSystemDevice SiGetSystemDeviceName SiIsWinPeHardDiskZeroUfdBoot SiQueryProperty SiValidateSystemPartition SmEtwEnabled SmEtwLogRegionOp SmEtwLogStoreCorruption SmEtwLogStoreOp SmEtwLogStoreStateChange SmFirstTimeInit SmFpPreAllocate SmKmEtwAppendObjectName SmKmEtwLogStoreChange SmKmEtwLogStoreStats SmKmFileInfoGetPath SmKmKeyGenLoadKey SmKmRegParamsLoad SmKmSqmAddToStream SmKmStoreFileCreate SmKmStoreFileGetExtents SmKmStoreFileOpenVolume SmKmStoreFileWriteHeader SmKmStoreTerminateWorker SmProcessCompressionInfoRequest SmProcessCreateRequest SmProcessQueryStoreStats SmProcessStoreMemoryPriorityRequest SmQueryStoreCommitUsage SmQuerySystemInformation SmStoreCreate SmStorePhysicalRequestIssue SmcProcessCreateRequest SmcProcessListRequest SmcProcessStatsRequest SmpDirtyStoreCreate SshSessionManagerTraceCsEnterReason SshSessionManagerTraceCsExitReason SshSessionManagerTraceDirtyTransition SshSessionManagerTracePostSleepNotification SshSessionManagerTracePreSleepNotification SshSessionManagerTraceShutdownAction SshSessionManagerTraceSystemStop SshpAlpcInitialize SshpAlpcProcessAlpcMessage SshpAlpcSendMessage SshpFlushBlockerDataCache SshpGenerateDeviceFriendlyName SshpSendSessionData SshpSessionManagerFlushControlEventBuffer SshpWnfCallback SshpWriteBlocker StEtaHelper::StartHelper SymCryptDetectCpuFeaturesByCpuid SymCryptEcpointMultiScalarMulWnafWithInterleaving SymCryptEcpointScalarMulFixedWindow SymCryptInitEnvWindowsKernelmodeWin8_1nLater SymCryptParallelSha256Append SymCryptParallelSha256Process SymCryptRsaCoreEnc SymCryptRsakeyCalculatePrivateFields SymCryptSha256 SymCryptSha384Result SymCryptSha512AppendBlocks_ull SymCryptShortWeierstrassAddDiffNonZero SymCryptShortWeierstrassAddSideChannelUnsafe SymCryptShortWeierstrassDouble SymCryptShortWeierstrassIsEqual SymCryptTwistedEdwardsAdd SymCryptTwistedEdwardsDouble SymCryptTwistedEdwardsOnCurve TraceLoggingRegisterEx_EtwRegister_EtwSetInformation TtmiLogCalloutStart TtmiLogCalloutStop TtmiLogCalloutWatchdogCrashSkipped TtmiLogCleanupCurrentSessionStart TtmiLogCleanupCurrentSessionStop TtmiLogConsoleUserPresent TtmiLogDeviceArrivalNotified TtmiLogDeviceArrivedTerminalEvent TtmiLogDeviceAssignedTerminalEvent TtmiLogDeviceDepartedTerminalEvent TtmiLogDeviceDepartureNotified TtmiLogDeviceEnumeratedTerminalEvent TtmiLogDeviceFromTerminalRemoved TtmiLogDeviceInputNotified TtmiLogDeviceRundown TtmiLogDeviceSetInputWakeCapability TtmiLogDeviceToTerminalAssigned TtmiLogDispatchApiStart TtmiLogDispatchApiStop TtmiLogDisplayPowerRequestSet TtmiLogEnterProximity TtmiLogError TtmiLogExitProximity TtmiLogInactivityTimerReset TtmiLogInactivityTimoutUpdate TtmiLogInitCurrentSessionStart TtmiLogInitCurrentSessionStop TtmiLogInitiateModernStandbyTransitionStart TtmiLogInitiateModernStandbyTransitionStop TtmiLogProximityBlockedRequest TtmiLogProximityPowerPress TtmiLogQueueCreated TtmiLogQueueDequeueEvent TtmiLogQueueDestroyed TtmiLogQueueEnqueueEvent TtmiLogQueueHandleClosed TtmiLogQueueHandleOpened TtmiLogSessionActivate TtmiLogSessionCsExitComplete TtmiLogSessionDeactivate TtmiLogSessionDeviceAssignmentPolicySet TtmiLogSessionDisplayRequiredDereference TtmiLogSessionDisplayRequiredPowerRequestUpdated TtmiLogSessionDisplayRequiredReference TtmiLogSessionMonitorControl TtmiLogSessionPowerControlStart TtmiLogSessionPowerControlStop TtmiLogSessionPowerRequestAcknowledged TtmiLogSessionPowerRequestCreated TtmiLogSessionPowerRequestDeleted TtmiLogSessionPowerStateChange TtmiLogSessionRundown TtmiLogSessionWorkerPass TtmiLogSessionWorkerStart TtmiLogSessionWorkerStop TtmiLogTerminalCleanup TtmiLogTerminalCreated TtmiLogTerminalDestroyed TtmiLogTerminalDisplayStateChangedEvent TtmiLogTerminalDisplayTimeouts TtmiLogTerminalHandleClosed TtmiLogTerminalHandleOpened TtmiLogTerminalOffRequest TtmiLogTerminalOnRequest TtmiLogTerminalRundown TtmiLogTerminalStateMachine TtmpCommitTerminalDisplayStateUpdateWorker TtmpGetConfigOverride TtmpSessionWorker UpcaseUnicodeToUTF8NHelper ValidFilter VerifierNtCreateFile VerifierNtReadFile VerifierNtWriteFile VfCheckImageCompliance VfCheckUserHandle VfDeadlockAcquireResource VfDeadlockInitializeResource VfDeadlockPluginEntry VfDeadlockReleaseResource VfDmaPluginEntry VfErrorReport7 VfErrorReport8 VfIoDeleteDevice VfIoDetachDevice VfIovPluginEntry VfIrpLogRecordEvent VfIrqlPluginEntry VfIsPCIBus VfLwSPEntry VfMiscPluginEntry VfPoolTrackingEntry VfSecurityEntry VfSpecialPoolEntry VfThunkApplyPristineToAllSession VfThunkApplyWdmThunkToAllSession VfUtilPrintCheckinString VhdAutoAttachVirtualDisks VhdiAutoAttachOneVhd VhdiGetVolumeNumber VhdiInitializeBootDisk VhdiMountVhdFile ViErrorReport1 ViErrorReport10 ViErrorReport4 ViErrorReport6 ViGenericVerifyIrpStackDownward ViGenericVerifyNewIrp ViIsBTSSupported ViPtLogStackCallout ViSetupBTSPerProcNoEnable VmAccessFault VmpAccessFaultBatchResolve VmpLogAccessFault VmpLogAccessFaultRange VmpLogColdHint VmpLogLargeSlatFill VmpLogSparseSlatFill VmpLogTbFlushSlatInvalidate VmpPinMemoryRange VmpPrefetchWorker VmpProcessAccessedBatch VmpProcessUpdateSlat VmpQueryAccessedState VrpIoctlDeviceDispatch VrpPostEnumerateKey VrpPostOpenOrCreate VrpPostQueryKey VrpPostUnloadKey VrpPreFlushKey VrpPreLoadKey VrpPreOpenOrCreate VrpPreQueryKeyName VrpRegistryCallback VrpRegistryUnload VslAbortLiveDump VslAccessPciDevice VslAllocateKernelShadowStack VslAllocateSecureHibernateResources VslApplyDynamicRelocations VslApplyHotPatch VslApplySecureImageFixups VslBindNtIum VslCallEnclave VslCaptureSecureImageIat VslCloseSecureHandle VslCollectLiveDumpInSk VslCompleteSecureDriverLoad VslConfigureDynamicMemory VslConfigureSecureAtsDevice VslConnectSwInterrupt VslCreateEnclave VslCreateSecureAllocation VslCreateSecureImageSection VslCreateSecureProcess VslCreateSecureSection VslCreateSecureThread VslDebugProtectSecureProcessMemory VslDebugReadWriteSecureProcess VslDeleteSecureSection VslDetermineHotPatchType VslDetermineHotPatchUndoTableSize VslEnableKernelCfgTarget VslEnableOnDemandDebugWithResponse VslEndSecurePageIteration VslExchangeEntropy VslFastFlushSecureRangeList VslFillSecureAllocation VslFinalizeLiveDumpInSk VslFinalizeSecureImageHash VslFinishSecureImageValidation VslFinishStartSecureProcessor VslFlushSecureAddressSpace VslFreeKernelShadowStack VslFreeSecureHibernateResources VslFreeSecureImageIat VslGetEtwDebugId VslGetNestedPageProtectionFlags VslGetOnDemandDebugChallenge VslGetSecurePageList VslGetSecurePciDeviceAlternateFunctionNumberForVtl0Dma VslGetSecurePciDeviceBootConfiguration VslGetSecurePciEnabled VslGetSecurePebAddress VslGetSecureSpeculationControlInformation VslGetSecureTebAddress VslGetSetSecureContext VslHandleKsrCall VslInitFunctionOverrideCapabilities VslInitializeEnclave VslInitializeSecureKernelCfg VslInitializeSecurePool VslInitializeSecureProcess VslIsEncryptionKeyAvailable VslIsTrustletRunning VslIumEfiRuntimeService VslIumEtwEnableCallback VslKernelShadowStackAssist VslLiveDumpQuerySecondaryDataSize VslLoadEnclaveData VslLoadEnclaveModule VslMakeCodeCatalog VslMakeProtectedPageExecutable VslMakeProtectedPageWritable VslNotifyShutdown VslObtainHotPatchUndoTable VslPrepareDriverForPatch VslPrepareSecureImageRelocations VslProvisionDumpEncryption VslPublishSyscallProviderServiceTables VslQuerySecureDevice VslQuerySecureKernelProfileInformation VslQueryVirtualMemory VslReapplyBootIndirectPatches VslReapplyImportOptimizationForDriverVerifier VslRegisterBootDrivers VslRegisterLogPages VslRegisterSecureSystemDlls VslRegisterSecureSystemProcess VslRegisterSyscallProviderServiceTableMetadata VslRelaxQuotas VslRelocateImage VslReportBugCheckProgress VslReserveProtectedPages VslResetKernelShadowStack VslRetrieveMailbox VslRevertHotPatch VslRundownSecureProcess VslSecurePoolAllocate VslSecurePoolFree VslSecurePoolUpdate VslSendDebugAttachNotifications VslSetCodeIntegrityPolicy VslSetPlaceholderPages VslSetupLiveDumpBufferInSk VslSlowFlushSecureRangeList VslStartSecurePageIteration VslStartSecureProcessor VslSvcEnterIumSecureMode VslTerminateSecureThread VslTransferSecureImageVersionResource VslTransformDumpKey VslUpdateFreezeTimeBias VslValidateDynamicCodePages VslValidateSecureImagePages VslVerifyPage VslVerifySessionSpace VslpAddLiveDumpBufferChunk VslpConnectedStandbyPoCallback VslpConnectedStandbyWnfCallback VslpEnterIumSecureMode VslpIumInitializeTelemetry VslpIumPhase0Initialize VslpIumPhase4Initialize VslpKsrEnterIumSecureMode VslpLiveDumpStart VslpSetupLiveDumpBuffer VslpVerifySessionSpace WarbirdCrypto::CCipherFeistel64::CallRoundFunction WbAddWarbirdEncryptionSegment WbGetInitializedEncryptionSegment WbHeapExecuteCall WdiDispatchControl WdipAccessCheck WdipSemLoadLocalGroupPolicy WdipSemLoadNextContextProvider WdipSemLoadNextEndEvent WdipSemLoadNextScenario WdipSemLoadScenarioTable WdipSemQueryValueFromRegistry WdipSemSqmAddToStream WdipSemSqmIncrementDword WdipSemSqmInit WdipSemSqmLogInflightLimitExceededDataPoints WdipSemWriteInflightLimitExceededEvent WdipSemWriteMisconfigEvent WdipSemWriteProviderLimitExceededEvent WdipSemWriteScenarioLimitExceededEvent WdipSemWriteSemActionsEvent WdipSemWriteSemFailureEvent WdipSemWriteTimeoutEvent WheaAddErrorSource WheaLogInternalEvent WheaPersistBadPageToRegistry WheaRemoveErrorSource WheaRemoveErrorSourceDeviceDriver WheaReportHwError WheaSelLogErrorPkt WheapAddToDefectListInPlugin WheapAttemptPhysicalPageOffline WheapClearPoison WheapCreateRecordFromGenericErrorData WheapExecuteRowFailureCheck WheapGenerateETWErrorRecord WheapGenerateETWErrorRecordLarge WheapInitErrorReportDeviceDriver WheapLogAddToDefectListFail WheapLogInitEvent WheapLogPageOfflineAttemptEvent WheapLogPolicyTelemetry WheapLogProcessTerminateEvent WheapPfaLogPageMonitorRemoval WheapProcessOfflineList WheapReverseAddressTranslateToPAInPlugin WheapTrackPendingPage WheapTranslateAddressInPlugin WheapWmiExecuteErrorSourceMethod WmipCreateGuidObject WmipDisableCollectionForRemovedGuid WmipEnableCollectionForNewGuid WmipGetGuidSecurityDescriptor WmipIncludeStaticNames WmipInitializeDataStructs WmipInsertStaticNames WmipIoControl WmipOpenGuidObject WmipPrepareWnodeSI WmipProcessLegacyEtwCallback WmipQueryAllData WmipQueryAllDataMultiple WmipQuerySetExecuteSI WmipQuerySingleMultiple WmipQueryWmiDataBlock WmipReceiveNotifications WmipSecurityMethod WmipSendEnableDisableRequest Xp10BuildAndWriteHuffmanTables Xp10Compute2Crc32 Xp10Compute2Crc64 _CmAddDeviceToContainer _CmAddPanelDevice _CmBuildDevicePanelId _CmClassFilterCallback _CmCreateDevice _CmCreateDeviceContainer _CmCreateDeviceInterface _CmCreateDeviceInterfaceWorker _CmCreateDevicePanel _CmCreateInstallerClass _CmCreateInterfaceClass _CmDeleteCommonClassRegKey _CmDeleteDevice _CmDeleteDeviceContainer _CmDeleteDeviceContainerRegKey _CmDeleteDeviceInterface _CmDeleteDeviceInterfaceRegKey _CmDeleteDeviceInterfaceWorker _CmDeleteDevicePanel _CmDeleteDevicePanelRegKey _CmDeleteDeviceRegKey _CmDeleteDeviceRegKeyWorker _CmDeleteDeviceWorker _CmDeleteInstallerClass _CmDeleteInstallerClassWorker _CmDeleteInterfaceClass _CmDeleteInterfaceClassWorker _CmDevicePanelEnumSubkeyCallback _CmEnumDevicesInContainerWithCallback _CmGetDeviceChildren _CmGetDeviceContainerIdFromBase _CmGetDeviceInterfaceClassGuid _CmGetDeviceInterfaceRegKeyPath _CmGetDeviceInterfaceSubkeyPath _CmGetDeviceMappedPropertyFromComposite _CmGetDeviceMappedPropertyFromRegProp _CmGetDeviceParent _CmGetDeviceRegProp _CmGetDeviceRegPropWorker _CmGetDeviceSiblings _CmGetDeviceSoftwareKey _CmGetDeviceSoftwareKeyPath _CmGetInstallerClassMappedPropertyFromRegValue _CmGetInstallerClassRegProp _CmGetMatchingCommonClassList _CmGetMatchingDeviceContainerList _CmGetMatchingDeviceInterfaceList _CmGetMatchingDeviceList _CmGetMatchingDevicePanelList _CmGetMatchingFilteredDeviceInterfaceList _CmGetMatchingFilteredDeviceList _CmGetRegKeySecurityDescriptor _CmIsDeviceSafeRemovalRequired _CmIsLocalMachineContainer _CmMatchLastKnownParentCallback _CmOpenCommonClassRegKey _CmOpenDeviceContainerRegKey _CmOpenDeviceInterfaceRegKey _CmOpenDevicePanelRegKey _CmRemoveDeviceFromContainer _CmRemovePanelDevice _CmServiceFilterCallback _CmSetDeviceMappedPropertyFromDriverKeyRegValue _CmSetDeviceMappedPropertyFromRegProp _CmSetDeviceRegProp _CmSetInstallerClassRegProp _CmSplitDevicePanelId _CmUpdateDevicePanel _CmUpdateDevicePanelInterface _CmValidateDeviceInterfaceName _CmValidateDevicePanelName _PnpDeletePropertyWorker _PnpDeviceRaisePropertyChangeEventWorker _PnpGetEnumSecurityDescriptor _PnpGetGenericStoreProperty _PnpGetGenericStorePropertyKeys _PnpGetGenericStorePropertyLocales _PnpGetPropertiesSecurityDescriptor _PnpIsValidGuidString _PnpOpenPropertiesKey _PnpSetPropertyWorker _RegRtlCopyTreeInternal _RegRtlEnumKey _RegRtlEnumKeyWithCallback _RegRtlQueryInfoKey _RegRtlQueryValue _RtlpMuiRegAddBaseLanguage _RtlpMuiRegInitLIPLanguage _RtlpMuiRegLoadInstalledFromKey _RtlpMuiRegPopulateBaseLanguages _RtlpMuiRegValidateInstalled _RtlpRemovePendingDeleteLanguages _SysCtxOpenControlSet _SysCtxOpenMachine _SysCtxRegOpenCurrentUserKey __GSHandlerCheckCommon _handle_error _handle_errorf _output_l _output_s _tlgWriteTemplate<long___cdecl(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),&long___cdecl__tlgWriteTransfer_EtwWriteTransfer(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),struct__GUID_const*___ptr64,struct__GUID_const*__ptr64>::Write<struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1> > _woutput_l _woutput_s pIoQueryBusDescription pIoQueryDeviceDescription qsort qsort_s strspn strtok_s vDbgPrintExWithPrefixInternal wil_details_FeatureReporting_ReportUsageToService
Expand for full list: AdtpBuildAccessReasonAuditString AdtpBuildAccessReasonAuditStringInternal AdtpBuildAccessesString AdtpBuildReplacementString AdtpBuildSecurityDescriptorUnicodeString AdtpBuildSidListString AdtpBuildStagingReasonAuditStringInternal AdtpBuildUserAccountControlString AdtpFormatPrefix AdtpInitializeDriveLetters AdtpWriteToEtw AdtpWriteToEtwEx AlpcViewDestroyProcedure AlpcpAcceptConnectPort AlpcpCheckConnectionSecurity AlpcpConnectPort AlpcpCreateConnectionPort AlpcpExposeViewAttributeInSenderContext AlpcpForceUnlinkSecureView AlpcpImpersonateMessage AlpcpInitSystem AlpcpLogClosePort AlpcpLogConnectFail AlpcpLogConnectRequest AlpcpLogConnectSuccess AlpcpLogReceiveMessage AlpcpLogSendMessage AlpcpLogUnwait AlpcpLogWaitForReply AlpcpPortQueryConnectedSidInfo AlpcpPrepareViewForDelivery AlpcpQuerySidToken AlpcpRestoreWriteAccess AlpcpValidateAndSetPortAttributes Amd64InitializeCacheStatus Amd64InitializeDataFabricStatus Amd64InitializeProfiling Amd64InitializeUncoreProfiling AnFwDisplayFade ApiSetpLoadSchemaExtension ApiSetpLoadSchemaExtensions AppendUlongAsHexadecimalW ArbBootAllocation ArbBuildAssignmentOrdering ArbInitializeOsInaccessibleRange ArbQueryConflict ArbRetestAllocation ArbShareDriverExclusive AslEnvGetProcessWowInfo AslEnvGetSysNativeDirPathForGuestBuf AslEnvGetSystem32DirPathBuf AslFileMappingCreate AslPathSplit AslPathToSystemPath AslRegistryEnumKey AslRegistryGetUInt32_UStr AslpFileGet16BitDescription AslpFileGet16BitModuleName AslpFileGetClrVersionAttribute AslpFileGetExportName AslpFileQueryVersionString AstLogDeviceCreated AstLogDeviceSDDLUpdated AuthzBasepDeviceMemberOf AuthzBasepEvaluateAceCondition AuthzBasepInitializeResourceClaimsFromSacl AuthzBasepMemberOf B_TREE<_SM_PAGE_KEY,ST_STORE<SM_TRAITS>::ST_PAGE_ENTRY,4096,NP_CONTEXT,B_TREE_KEY_COMPARATOR<SM_PAGE_KEY> >::BTreeSearchResultDeref B_TREE<union__SM_PAGE_KEY,struct_SMKM_STORE_MGR<struct_SM_TRAITS>::SMKM_FRONTEND_ENTRY,4096,struct_B_TREE_DUMMY_NODE_POOL,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY> >::BTreeSearchKey B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY> >::BTreeFindLeafSibling B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY> >::BTreeIteratorCleanup B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY> >::BTreeIteratorFromSearchResult B_TREE<unsigned_long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeSearchResultDeref B_TREE<unsigned_long,ST_STORE<SM_TRAITS>::_ST_REGION_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeSearchResultDeref B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeFindLeafSibling B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeIteratorCleanup B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeIteratorFromSearchResult B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeFindLeafSibling B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeIteratorCleanup B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeIteratorFromSearchResult BapdRecordFirmwareBootStats BapdWriteEtwEvents BapdpMarshallBootDataToRegistry BapdpProcessBCDCache BapdpProcessBitlockerStatus BapdpProcessBootMetadata BapdpProcessEDrvHintInfo BapdpProcessEtwEvents BapdpProcessFwUpdateResults BapdpProcessHSTIResults BapdpProcessResumeInformation BapdpProcessSpacesBootInformation BapdpProcessVsmKeyBlobs BapdpProcessWmdResults BapdpRecordIumStatus BapdpRegisterWbclData BcdGetElementDataWithFlags BcdSetElementDataWithFlags BcpDisplayErrorInformation BcpDisplayProgress BgkAcquireDisplayOwnership BgkNotifyDisplayOwnershipChange BgpGxDrawRectangle BgpRasPrintGlyph BiAddStoreFromFile BiAdjustPrivilege BiBindEfiBootManager BiBindEfiEntries BiBuildIdentifierList BiCreateObject BiCreatePartitionDevice BiDeleteEfiVariable BiDeleteElement BiDoesHiveExist BiEnumerateSubKeys BiExportEfiBootManager BiGetCurrentBootEntryIdentifier BiGetDefaultBootEntryIdentifier BiGetFirmwareType BiGetNtPartitionPath BiGetObjectReferenceFromEfiEntry BiGetPartitionInformation BiOpenStoreKeyFromObject BiResolveLocateDevice BiUpdateObjectReferenceInEfiEntry CMFCheckAccess CMFFlushHitsFile CMFGetFileSizeEx CMFRegisterEventTime CMFSystemThreadRoutine CarEtwCrashEvent CarEtwRegister CarEtwWriteBugCheckEvent CarEtwWriteLiveDumpEvent CarLiveDumpCallBack CarLoadImageHandler CarReadRegistry CarTipLogDriverLoad CcAsyncLazywriteWorker CcAsyncLazywriteWorkerMulti CcAsyncReadWorker CcCachemapUninitWorkerThread CcGetBcbListHeadLargeOffset CcGetDeviceGuidAsync CcPerfLogCanWriteFail CcPerfLogExtraWBThreadAction CcPerfLogFlushCache CcPerfLogFlushSection CcPerfLogLazyWriteScan CcPerfLogScheduleReadAhead CcPerfLogVolumeLogHandleInfo CcPerfLogWorkItemEnqueue CcPerformReadAhead CcPostVolumeTelemetry CcQueueLazyWriteScanThread CcQueueLazyWriteScanThreadForVolume CcSetVacbLargeOffset CcUpdateDynamicRegistrySettings CcWorkerThread CimfsInitialize CimfsInitializeBootDisk CmCallbackGetKeyObjectID CmCallbackGetKeyObjectIDEx CmCreateKey CmDeleteKey CmDeleteValueKey CmEnumerateKey CmEnumerateValueFromLayeredKey CmEnumerateValueKey CmEtwRunDown CmFcInitSystem3 CmFcManagerOverwriteFeatureConfigurationSection CmFcManagerQueryFeatureConfigurationSectionInformation CmFcManagerStartBootPhase CmFcManagerStartRuntimePhase CmFcManagerUpdateFeatureConfigurations CmFcManagerUpdateFeatureUsageSubscriptions CmFcpChangeSubscriptionWrapper CmFcpManagerArmFeatureUsageRetryTimer CmGetSystemDriverList CmInitSystem1 CmInitializeProcessor CmIsLastKnownGoodBoot CmKeyBodyRemapToVirtual CmKeyBodyRemapToVirtualForEnum CmKeyBodyReplicateToVirtual CmKtmNotification CmLoadAppKey CmLoadDifferencingKey CmLoadKey CmLogMcUpdateStatus CmLogTmRmAction CmOpenKey CmQueryFeatureConfigurationSections CmQueryKey CmQueryLayeredKey CmQueryValueKey CmReconcileAndValidateAllHives CmRenameKey CmReplaceKey CmRestoreKey CmRmFinalizeRecovery CmSaveKey CmSaveKeyToBuffer CmSaveMergedKeys CmSelectQualifiedInstallLanguage CmSetAcpiHwProfile CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmShutdownSystem1 CmShutdownSystem2 CmSiAcquireProcessLockedPagesCharge CmSiProcessTupleStartFromHandle CmSiReleaseProcessLockedPagesCharge CmSiSetProcessWorkingSetMaximum CmUnloadKey CmpAbortLightWeightTransaction CmpAddAliasEntry CmpAddProcessorConfigurationEntry CmpAddRemoveContainerToCLFSLog CmpAddRemoveRMLogContainer CmpBounceContextStart CmpCheckKeySecurityDescriptorAccess CmpCheckValueList CmpCleanUpKCBCacheTable CmpCleanupLightWeightTransaction CmpCleanupTransactionState CmpCloneHwProfile CmpCloseKeyObject CmpCmdHiveClose CmpCmdHiveOpen CmpCommitPreparedLightWeightTransaction CmpCompleteUnloadKey CmpComputeLogFillLevel CmpCreateControlSet CmpCreateControlSetOverride CmpCreateHardwareProfiles CmpCreateHive CmpCreateHwProfileFriendlyName CmpCreatePerfKeys CmpCreatePredefined CmpCreateTemporaryHive CmpDelayCloseWorker CmpDoAccessCheckOnKCB CmpDoAccessCheckOnLayeredSubtree CmpDoBuildVirtualStack CmpDoParseKey CmpDoQueryKeyName CmpDoReOpenTransKey CmpEnumerateLayeredKey CmpEtwDumpKcb CmpFindControlSet CmpFindMachineHiveByMountPoint CmpFinishSystemHivesLoad CmpFlushBackupHive CmpFlushHive CmpForceFlushWorker CmpFreeAllMemory CmpFullPromoteHiveRootFromKcbStack CmpFullPromoteSingleKeyFromKeyNodeStacks CmpGenerateAppHiveSecurityDescriptor CmpGetAcpiProfileInformation CmpGetBiosDate CmpGetBiosVersion CmpGetFileSize CmpGetSubKeyCountForKcbStack CmpGetSubKeyCountForKeyNodeStack CmpGetSymbolicLinkTarget CmpGetSystemControlValues CmpGetValueCountForKeyNodeStack CmpGetVirtualizationID CmpGetVolumeClusterSize CmpGetVolumeLogFileSizeCap CmpHandlePageFileOpenNotification CmpHiveRootSecurityDescriptor CmpInitBackupHive CmpInitCmRM CmpInitHiveFromFile CmpInitializeMachineDependentConfiguration CmpInitializePreloadedHive CmpInitializeRegistryNode CmpInterlockedFunction CmpKeyEnumStackStartFromKcbStack CmpLateUnloadHiveWorker CmpLightWeightCommitDeleteKeyUoW CmpLinkHiveToMaster CmpLoadHiveThread CmpLoadHiveVolatile CmpLoadKeyCommon CmpLoadLayerVersions CmpLoadSystemVersionData CmpLogCheckpoint CmpLogClearAccessBitsEvent CmpLogEvent CmpLogFailureToGetFileSize CmpLogFlushPhaseEnd CmpLogFlushPhaseStart CmpLogHiveDestroyEvent CmpLogHiveFileInaccessible CmpLogHiveInitializeEvent CmpLogHiveLinkEvent CmpLogHiveRundownEvent CmpLogReorganizeEvent CmpLogTransactionAbortedByName CmpLogTxrInitEvent CmpLogUnsupportedOperation CmpMachineHiveListInitialize CmpMigrateOOBELanguageToInstallationLanguage CmpMountPreloadedHives CmpMoveBiosAliasTable CmpNameFromAttributes CmpNotifyChangeKey CmpOpenDevicesControlSet CmpOpenFileWithExtremePrejudice CmpOpenHiveFile CmpPartialPromoteSubkeys CmpPerformUnloadKey CmpPrepareLightWeightTransaction CmpPromoteSingleKeyFromKcbStacks CmpPromoteSingleKeyFromParentKcbAndChildKeyNode CmpPromoteSubtree CmpPublishEventForPcaResolver CmpQueryHiveRedirectionFileList CmpQueryLayerVersionString CmpQueryLayerVersionUlong CmpReadBuildVersion CmpReorganizeHive CmpReplicateKeyToVirtual CmpReportAuditVirtualizationEvent CmpResolveHiveLoadConflict CmpRestampVersion CmpRmUnDoPhase CmpSaveBootControlSet CmpSearchKeyControlBlockTreeEx CmpSecurityMethod CmpSendUnsupportedOperationTelemetryEvent CmpSetKeySecurity CmpSetSystemBiosInformation CmpSetSystemValues CmpSetVersionData CmpSetVideoBiosInformation CmpSetupConfigurationTree CmpStartCLFSLog CmpStartRMLogs CmpStartSiloRegistryNamespace CmpThreadInfoLogStack CmpTraceHiveFlushStop CmpTraceHiveFlushWroteLogFile CmpTraceHiveFlushWrotePrimaryFile CmpTraceHiveLoadStart CmpTraceHiveLoadStop CmpTraceHiveMountBaseFileMounted CmpTraceHiveMountStart CmpTraceHiveMountStop CmpTraceHiveRestoreStart CmpTraceHiveRestoreStop CmpTraceHiveSaveFileCopied CmpTraceHiveSaveStart CmpTraceHiveSaveStop CmpTraceHiveSaveTreeCopied CmpTraceSecurityChanging CmpTraceShutdownFlushStart CmpTraceShutdownFlushStop CmpTraceShutdownRundownComplete CmpTraceShutdownStart CmpTraceShutdownStop CmpTransMgrCommit CmpTransMgrCommitUoW CmpTransMgrPrepare CmpTransWriteLog CmpUpdateReorganizeRegistryValues CmpValueEnumStackStartFromKcbStack CmpVolumeManagerGetContextForFile CmpWaitOnHiveWriteQueue ComputeFlushPeriod ConstraintEval CreateSystemRootLink DbgkCaptureLiveDump DbgkCopyProcessDebugPort DbgkCreateMinimalProcess DbgkCreateMinimalThread DbgkCreateThread DbgkExitProcess DbgkExitThread DbgkForwardException DbgkMapViewOfSection DbgkPostModuleMessage DbgkQueueUserExceptionReport DbgkRegisterErrorPort DbgkSendSystemDllMessages DbgkUnMapViewOfSection DbgkUserReportWorkRoutine DbgkpCreateNotificationEvent DbgkpLkmdSnapKernelStack DbgkpLkmdSnapThreadInContext DbgkpLkmdSqmIncrementDword DbgkpLkmdSqmIsOptedIn DbgkpMarkProcessPeb DbgkpPostFakeProcessCreateMessages DbgkpPostFakeThreadMessages DbgkpQueueMessage DbgkpSendApiMessageLpc DbgkpSendErrorMessage DbgkpStartSystemErrorHandler DbgkpWerCaptureLiveTriageDump DbgkpWerIsFullLiveDumpDisabled DbgkpWerWriteSecondaryData DrvDbGetConfigurationSubKeyCallback DrvDbGetObjectSubKeyList EmInitSystem EmonInitializePebs EmonInitializeProfiling EmonReleaseProfileResourcesInternal EmpCacheBiosDate EmpInfParseGetGuidFromName EmpParseCallbacks EmpParseEntryTypes EmpParseRuleTerm EmpParseRules EmpParseTargetRules EnableFlushTimer EtwKernelMemoryRundown EtwLogPfnInfoRundown EtwQueryProcessTelemetryInfo EtwSetPerformanceTraceInformation EtwShutdown EtwStartAutoLogger EtwTelemetryCoverageReport EtwTiLogAllocExecVm EtwTiLogDeviceObjectLoadUnload EtwTiLogDriverObjectLoad EtwTiLogDriverObjectUnLoad EtwTiLogInsertQueueUserApc EtwTiLogMapExecView EtwTiLogProtectExecVm EtwTiLogReadWriteVm EtwTiLogSetContextThread EtwTiLogSuspendResumeProcess EtwTiLogSuspendResumeThread EtwTimLogBlockNonCetBinaries EtwTimLogControlProtectionKernelModeReturnMismatch EtwTimLogControlProtectionUserModeReturnMismatch EtwTimLogProhibitChildProcessCreation EtwTimLogProhibitLowILImageMap EtwTimLogProhibitNonMicrosoftBinaries EtwTimLogRedirectionTrustPolicy EtwTimLogUserCetSetContextIpValidationFailure EtwTraceAntiStarvationBoost EtwTraceAppStateChange EtwTraceAutoBoostClearFloor EtwTraceAutoBoostEntryExhaustion EtwTraceAutoBoostSetFloor EtwTraceContFreeEvent EtwTraceCumulativeDpcSoftTimeout EtwTraceDebuggerEvent EtwTraceDequeueWork EtwTraceDpcEnqueueEvent EtwTraceDpcProfilingStack EtwTraceDpcProfilingStackBegin EtwTraceDuplicateHandle EtwTraceEnqueueWork EtwTraceEvent EtwTraceFreezeThawProcess EtwTraceIdealProcessor EtwTraceInswapProcess EtwTraceIoTimerEvent EtwTraceJob EtwTraceJobAssignProcess EtwTraceJobRemoveProcess EtwTraceJobSendNotification EtwTraceJobServerSiloMonitorCallback EtwTraceJobServerSiloStateChange EtwTraceJobSetQuery EtwTraceLeapSecondDataParseFailure EtwTraceLeapSecondDataUpdate EtwTraceLongDpcDetectionEvent EtwTraceLongDpcMitigationEvent EtwTraceLpacAccessFailure EtwTraceMemoryAcg EtwTraceObject EtwTraceObjectOperation EtwTracePageFault EtwTracePool EtwTracePriority EtwTraceProcess EtwTraceProcessSetInPrivateMode EtwTraceProcessTerminate EtwTraceReadyThread EtwTraceRetpolineExit EtwTraceShouldYieldProcessor EtwTraceSiloTimedEvent EtwTraceSingleDpcSoftTimeout EtwTraceSystemTimeChange EtwTraceThread EtwTraceThreadAffinity EtwTraceThreadFeedbackRead EtwTraceThreadSetName EtwTraceThreadWorkItem EtwTraceThreadWorkOnBehalfUpdate EtwTraceTimeZoneBiasChange EtwTraceTimeZoneInformationRefresh EtwTraceTimedEvent EtwTraceWakeCounter EtwTraceWakeEvent EtwTraceWorkingSetInSwapStoreFail EtwTraceWorkingSetSwap EtwTraceWorkloadClassUpdate EtwTraceXSchedulerPriorityKickReceive EtwTraceXSchedulerPriorityUpdate EtwWmitraceWorker EtwWriteEndScenario EtwWriteErrorLogEntry EtwWriteEx EtwWriteStartScenario EtwWriteString EtwpAddLogHeader EtwpAddMicroarchitecturalPmcToRegistry EtwpAddRegEntryToGroup EtwpApplyEventNameFilter EtwpApplyPackageIdFilter EtwpApplyPayloadFilterInternal EtwpBufferingModeFlush EtwpCCSwapFlush EtwpCalculateUpdateNotification EtwpCheckGuidAccessAndDoRundown EtwpClearSessionAndUnreferenceEntry EtwpClockSourceRunDown EtwpCovSampCaptureContextStart EtwpCovSampContextAddAddresses EtwpCovSampContextPruneModules EtwpCovSampEnumerateProcess EtwpCoverageFlushPending EtwpCoverageRecord EtwpCoverageRecordAtHighIrql EtwpCoverageSamplerQuery EtwpCreateKeyTreeForPath EtwpCreateLogFile EtwpCreatePerfectHashFunction EtwpCrimsonProvEnableCallback EtwpDiskProvTraceDisk EtwpEnableAutoLoggerProvider EtwpEnableGuid EtwpEnableKernelTrace EtwpEnableKeyProviders EtwpEnableMetaProviderGuid EtwpEnumerateAddressSpace EtwpEnumerateAutologgerPath EtwpEventTracingCounterSetCallback EtwpEventWriteCaptureState EtwpEventWriteDebugLookupFailed EtwpEventWriteEnableInfo EtwpEventWriteFull EtwpEventWriteGuidEntry EtwpEventWriteProviderAccessCheckStatus EtwpEventWriteProviderEnabled EtwpEventWriteRegEntry EtwpEventWriteRegistrationStatus EtwpEventWriteTemplateAdmin EtwpEventWriteTemplateBackingFile EtwpEventWriteTemplateMaxFileSize EtwpEventWriteTemplateSessAndProv EtwpEventWriteTemplateSession EtwpEventWriteTemplateSessionEnd EtwpExecutiveResourceConfigRunDown EtwpFileModeCompress EtwpFinalizeHeader EtwpFindMatchingPmcRegistryGroup EtwpFixBootLoggers EtwpFlushActiveBuffers EtwpGetAutoLoggerEventNameFilter EtwpGetAutoLoggerLevelKwFilter EtwpGetAutoLoggerProviderFilter EtwpGetLoggerInfoFromContext EtwpGetMicroarchitecturalPmcAffinity EtwpGetPmcCpuHierarchyRegistry EtwpGetSecurityDescriptorByGuid EtwpGetSidExtendedHeaderItem EtwpInitializeActivityIdSeed EtwpInitializeAutoLoggers EtwpInitializeSecurity EtwpLoadMicroarchitecturalPmcs EtwpLoadMicroarchitecturalProfileGroup EtwpLoadMicroarchitecturalProfileSource EtwpLogGroupMask EtwpLogMemInfo EtwpLogMemInfoRundown EtwpLogMemInfoTimerCallback EtwpLogMemInfoWs EtwpLogMemInfoWsHelper EtwpLogMemNodeInfo EtwpLogProcessPerfCtrs EtwpLogRefSetAutoMark EtwpLogRegistryEvent EtwpLogSessionWorkingSetInfo EtwpLogTxREvent EtwpObjectHandleEnumCallback EtwpObjectTypeRundown EtwpPmcInterrupt EtwpPoolRunDown EtwpProcessEnumCallback EtwpProcessPerfCtrsRundown EtwpProcessorRundown EtwpProfileInterrupt EtwpProviderArrivalCallback EtwpPsProvCaptureState EtwpPsProvProcessEnumCallback EtwpPsProvTraceImage EtwpPsProvTraceJob EtwpPsProvTracePriority EtwpPsProvTraceProcess EtwpPsProvTraceThread EtwpQueryPartitionRegistryInformation EtwpQueryPsmKey EtwpReadConfigParameters EtwpRealtimeInjectEtwBuffer EtwpRealtimeRestoreState EtwpRealtimeSaveState EtwpRegTraceCallback EtwpRegisterKMProvider EtwpRemoveMicroarchitecturalPmcFromPmcGroup EtwpSampledProfileRunDown EtwpSavePersistedLogger EtwpSendDataBlock EtwpSendSessionNotification EtwpSetCoverageSamplerInformation EtwpSetMark EtwpSetProviderTraitsCommon EtwpSpinLockConfigRunDown EtwpStackRundown EtwpStackWalkApc EtwpStartLogger EtwpStopLoggerInstance EtwpSysModuleRunDown EtwpSystemTraceWdf EtwpTiQueryVad EtwpTimLogMitigationForProcess EtwpTraceALPC EtwpTraceCachedStack EtwpTraceDebugPrint EtwpTraceFileName EtwpTraceFltIo EtwpTraceHandle EtwpTraceImageRundown EtwpTraceImageUnload EtwpTraceIo EtwpTraceIoInit EtwpTraceLastBranchRecord EtwpTraceLostEvent EtwpTraceLostSystemEvent EtwpTraceLostWppEvent EtwpTraceMessageVa EtwpTraceNetwork EtwpTraceOpticalIo EtwpTraceOpticalIoInit EtwpTraceProcessRundown EtwpTraceProcessorTrace EtwpTraceRedirectedIo EtwpTraceSavePersistedLoggerStop EtwpTraceSplitIo EtwpTraceStackWalk EtwpTraceSystemInitialization EtwpTraceSystemShutdown EtwpTraceThreadRundown EtwpTraceWdf EtwpTrackGuidEntryRegistrations EtwpUMGLEnabled EtwpUpdateFileHeader EtwpUpdateGlobalGroupMasks EtwpUpdateGroupMasks EtwpUpdateLoggerGroupMasks EtwpUpdatePeriodicCaptureState EtwpUpdateProcessTracingCallback EtwpUpdateSelectedGroupMasks EtwpWriteAppStateChange EtwpWriteAppStateChangeSummary EtwpWriteAppStateChangeWithStats EtwpWriteProcessEvent EtwpWriteProcessStarted EtwpWriteProcessorTrace EtwpWriteUserEvent ExAllocateCacheAwarePushLock ExCallSessionCallBack ExCreatePool ExGetExpirationDate ExInitLicenseData ExInitializeUtcTimeZoneBias ExLogTimeZoneInformation ExProcessCounterSetCallback ExProcessorCounterSetCallback ExRaiseException ExRaiseHardError ExRngInitializeSystem ExSweepHandleTable ExUpdateSystemTimeFromCmos ExpAeThresholdInitialization ExpCheckThreadHistory ExpCloudbookHardwareIDProvider ExpCloudbookHardwareLockedProvider ExpConvertSignatureName ExpCovQueryInformation ExpCovResetInformation ExpCreateOutputEFI ExpDebuggerWorker ExpFindDiskSignature ExpFirmwareAccessAppContainerCheck ExpGenuinePolicyPostProcess ExpGetOriginalImageVersionRegistryValue ExpGetProcessInformation ExpGetSystemFirmwareTableInformation ExpGetSystemFlushInformation ExpGetSystemPlatformBinary ExpInitFullProcessSecurityInfo ExpKdPullRemoteFileForUser ExpKernelExpirationDateCacheProvider ExpLogRefreshTimeZoneInformationCutoverFail ExpLogRefreshTimeZoneInformationQueryFail ExpLogRefreshTimeZoneInformationSuccess ExpNodeCreateSystemThread ExpNtDeleteWnfStateData ExpNtUpdateWnfStateData ExpParseArcPathName ExpProfileCreate ExpQueryProcessorInformationCounters ExpQuerySystemInformation ExpRaiseHardError ExpReadComPlusPackage ExpReadLeapSecondData ExpRefreshTimeZoneInformation ExpSaPageGroupDescriptorAllocate ExpSecurePoolDestroy ExpSeedHotTags ExpSetBootEntry ExpSetDriverEntry ExpSetPendingUILanguage ExpSetSoftRebootFlags ExpSetTimeZoneInformation ExpSetTimer2 ExpStringCheck ExpSvmServicePageFault ExpSystemErrorHandler2 ExpTrackTableInsertLimit ExpTranslateEfiPath ExpTranslateHexStringToGUID ExpUpdateProductSuiteTypeInRegistry ExpUpdateTimerConfiguration ExpUuidLoadSequenceNumber ExpUuidSaveSequenceNumber ExpWatchLicenseInfoWork ExpWatchProductTypeInitialization ExpWatchProductTypeWork ExpWnfAllocateNextPersistentNameSequence ExpWnfDeletePermanentName ExpWnfDeletePermanentStateData ExpWnfDispatchKernelSubscription ExpWnfLookupPermanentName ExpWnfPopulateStateData ExpWnfRegisterPermanentName ExpWnfWriteStateData ExpWorkQueueManagerThread ExpWorkerThread ExtEnvRegisterIommu ExtEnvSetVpptTarget FUN_140687e40 FUN_14068ad70 FUN_14070a710 FUN_140769944 FUN_140843f7c FUN_140a4b4b4 FUN_140a4e07c FindBitmapResource FopReadCmapTable FopReadNamingTable FsRtlAcquireFileExclusiveCommon FsRtlAcquireFileForCcFlushEx FsRtlAcquireFileForModWriteEx FsRtlAcquireToCreateMappedSection FsRtlAddDiskIOCounterInstance FsRtlCheckOplockEx2 FsRtlCheckOplockForFsFilterCallback FsRtlCheckUpperOplock FsRtlDedupChangeInit FsRtlGetCompatibilityModeValue FsRtlGetFileExtents FsRtlGetFileSize FsRtlGetSectorSizeInformation FsRtlGetTunnelParameterValue FsRtlGetVirtualDiskNestingLevel FsRtlHeatInit FsRtlIsDbcsInExpression FsRtlIssueFileNotificationFsctl FsRtlNotifyVolumeEvent FsRtlOpenFileSystemRegistryKeyFromFsGuid FsRtlQueryCachedVdl FsRtlQueryOpen FsRtlReleaseFile FsRtlReleaseFileForCcFlush FsRtlReleaseFileForModWrite FsRtlSendModernAppTermination FsRtlVolumeDeviceToCorrelationId FsRtlpAcknowledgeOplockBreakByCacheFlags FsRtlpAttachOplockKey FsRtlpCancelOplockRHIrp FsRtlpCancelWaitingIrp FsRtlpComputeShareableOplockState FsRtlpGetMaxVirtualDiskNestingLevel FsRtlpGrantAnyOplockFromExclusive FsRtlpOplockBreakByCacheFlags FsRtlpOplockCleanup FsRtlpReleaseIrpsWaitingForRH FsRtlpRemoveAndCompleteRHIrp FsRtlpRemoveAndCompleteReadOnlyIrp FsRtlpRemoveAndCompleteWaitingIrp FsRtlpRequestExclusiveOplock FsRtlpRequestShareableOplock FsRtlpWaitOnIrp GetOperatorIndexByName GetPrintableOperandValue GxpWriteFrameBufferPixels HalAllocateHardwareCounters HalCreateCommonBufferFromMdl HalCreateCommonBufferFromMdlDmaThin HalCreateCommonBufferFromMdlDmarThin HalEfiGetTime HalEfiSetTime HalGetEnvironmentVariableEx HalMatchAcpiOemId HalMatchAcpiOemTableId HalQueryEnvironmentVariableInfoEx HalQueryRealTimeClock HalSendNMI HalSetEnvironmentVariableEx HalSetRealTimeClock HalSocRequestApi HalSocRequestConfigurationData HaliAcpiMachineStateInit HaliQuerySystemInformation HaliWheaInitProcessorGenericSection HalpAcpiPostSleep HalpAddMcaToProcessorSpecificSection HalpAllocatePmcCounterSetEx HalpArtDiscover HalpBiosDisplayReset HalpBuddyAllocatorAllocateLogicalAddress HalpCheckSratMemoryRanges HalpCmcLogPollingTimeoutEvent HalpCmcPollProcessor HalpCmcWorkerRoutine HalpCmciHandler HalpCmciInit HalpCmciLoadThresholdConfiguration HalpCpuID HalpCreateMachineCheckErrorRecord HalpDmaFinalizeDoubleBufferingDisposition HalpDmaInitPowerManagement HalpEnumerateEnvironmentVariablesWithFilter HalpExtBuildResourceIdString HalpExtRegisterResourceDescriptor HalpFreePmcCounterSet HalpGenInitialRead HalpGetNumaProcMemoryCount HalpGetPCIData HalpHandlePreviousMcaErrors HalpHpetDiscover HalpHvCpuid HalpHvEpCpuid HalpHvIsFrequencyAvailable HalpHvIsX2ApicRecommended HalpHvMapDeviceInterrupt HalpHvMapDeviceMsiRange HalpHvMceConsumedMemoryErrorRecovery HalpHvRetargetDeviceMsiInterrupt HalpHvRetargetIoApicDeviceInterrupt HalpHvStartProcessor HalpHvStartVirtualProcessor HalpHvUnmapDeviceInterrupt HalpHvUnmapDeviceMsiRange HalpHvWatchdogDiscover HalpInitChipHacks HalpInitGenericErrorSourceEntry HalpInitGenericErrorSourceEntryV2 HalpInitializeMce HalpInitializeProfiling HalpInterruptConnect HalpInterruptEnableNmi HalpInterruptGetIrtInfo HalpInterruptGetX2ApicPolicy HalpInterruptInitDiscard HalpInterruptInitPowerManagement HalpInterruptRegisterController HalpInterruptSendIpi HalpIommuAllocateDmaDomain HalpIommuCleanupPageTable HalpIommuConfigureInterrupt HalpIommuDmarPageTableMarkHiberPhase HalpIommuInitDiscard HalpIommuInitializeAll HalpIommuLogEarlyFault HalpIommuMapLogical HalpIommuMapLogicalRange HalpIommuTraceFault HalpIommuUnmapLogicalRange HalpIsHvIptSupported HalpIsHvPresent HalpIsHvUsedForReboot HalpIsMicrosoftCompatibleHvLoaded HalpIsPartitionCpuManager HalpIsXboxNanovisorPresent HalpIumGetTime HalpIumQueryVariableInfo HalpIumResetSystem HalpIumSetTime HalpLbrInitialize HalpLoadMicrocodeSerialized HalpMcEnumerateAndSetPatchConfig HalpMcaExtendedLogGetL1DirectoryBase HalpMcaInitializeErrorSection HalpMcaReadError HalpMcaReportError HalpMcaResumeProcessorConfig HalpMceInit HalpMceInitializeRecovery HalpNmiReboot HalpNumaAddRangeProximity HalpPciCheckAmdK8 HalpPciReadSecondaryBusNumber HalpPiix4Detect HalpPmTimerDiscover HalpProcGetFeatureBits HalpQueryCapsuleCapabilities HalpReadExtendedMcaRegistersAMD HalpRegisterDmaController HalpReportResourceUsage HalpRtcDiscover HalpSecondaryInterruptQueryPrimaryInformation HalpSetPCIData HalpSetShutdownResetHandler HalpStopLegacyUsbInterruptsInternal HalpTimerConfigureInterrupt HalpTimerEnableHypervisorTimer HalpTimerInitPowerManagement HalpTimerInitializeHypervisorTimer HalpTimerInitializeProfiling HalpTimerMeasureAllProcessorFrequencies HalpTimerQueryAndResetRtcErrors HalpTimerRegister HalpTimerStallExecutionProcessor HalpTimerTraceTimingHardware HalpTimerUnmapInterrupt HalpTimerWatchdogTriggerSystemReset HalpTscAdvSynchCalculateRemoteDeltas HalpTscAdvSynchLeader HalpTscCheckAdjustMsrCapability HalpTscFallbackToPlatformSource HalpTscReportSyncStatus HalpTscSynchronization HalpTscSynchronizationWorker HalpTscTraceProcessorSynchronization HalpTscTraceStatus HalpUpdateCapsule HalpUsbLegacyScanBusForHandoff HalpUsbLegacyStopOhciInterrupt HalpUsbLegacyStopUhciInterrupt HalpValidPCISlot HalpWdatDiscover HalpWheaNativeCpuid HashpVerifyPkcs1Signature HdlspAddLogEntry HdlspBugCheckProcessing HdlspDispatch HdlspKernelAddLogEntry HdlspPutMore HdlspSendBlueScreenInfo HeadlessInit HsaDismissPageFault HsaGetPageFault HsaInitializeIommu HsaUpdateDeviceTableEntry HsaUpdateRemappingTableEntry HvAnalyzeLogFiles HvLoadHive HvRecoverFlushProtocolStateFromFiles HvSwapLogFiles HviGetHardwareFeatures HviGetIptFeatures HviIsAnyHypervisorPresent HviIsHypervisorMicrosoftCompatible HviIsHypervisorVendorMicrosoft HviIsXboxNanovisorPresent HvipApertureDetectParameters HvlAttachPasidSpace HvlAttachPrQueue HvlCollectLivedump HvlCreatePasidSpace HvlCreatePrQueue HvlDebuggerSupportInitialize HvlDisablePasid HvlDmaAllocateDeviceDomain HvlDmaAttachDeviceDomain HvlDmaConfigureDeviceDomain HvlDmaDeleteDeviceDomain HvlDmaFlushDeviceDomain HvlDmaGetDmaGuardEnabled HvlDmaGetHybridPassthroughReservedRegions HvlDmaMapDeviceLogicalRange HvlDmaMapDeviceSparsePages HvlDmaReserveDeviceDomainAttachment HvlDmaUnmapDeviceLogicalRange HvlDmaUnmapDeviceSparsePages HvlEnablePasid HvlEnterSleepState HvlGetCoverageData HvlGetCoverageInfo HvlGetDeviceCapabilities HvlGetImplementedPhysicalBits HvlGetSystemPasidCapabilities HvlHvDebuggerPowerHandler HvlInvokeFastExtendedHypercall HvlInvokeHypercall HvlIsSingleGroupRequired HvlMapDeviceInterrupt HvlNotifyAllProcessorsStarted HvlNotifyDebugDeviceAvailable HvlNotifyHpetEnabled HvlNotifyRootCrashdump HvlParkedVirtualProcessors HvlPrepareForRootCrashdump HvlPrepareForSecureHibernate HvlQueryDetailInfo HvlQueryHypervisorTscAdjustment HvlQueryVsmProtectionInfo HvlResetCoverageVector HvlRestoreTime HvlResumeFromRootCrashdump HvlRetargetDeviceInterrupt HvlSendSyntheticClusterIpi HvlSetDeviceCapabilities HvlSetDeviceDmaEnabled HvlSetHpetConfig HvlSetPasidAddressSpace HvlSetQpcBias HvlSetRootFaultReportingReady HvlSetSystemMachineCheckProperty HvlSetSystemSleepProperty HvlUnblockDefaultDma HvlUnmapDeviceInterrupt HvlpCheckTscSync HvlpDetermineEnlightenments HvlpDiscoverTopologyAmd HvlpDiscoverTopologyIntel HvlpDynamicUpdateMicrocode HvlpFastFlushAddressSpaceTb HvlpFastFlushAddressSpaceTbEx HvlpFastFlushListTb HvlpFastFlushListTbEx HvlpFastFlushPasidAddressList HvlpFastSendSyntheticClusterIpiEx HvlpGetVtlCallVa HvlpInvokeGetPageListHypercall HvlpLogGuestStateScrubbingStatus HvlpLogHypervisorLaunchError HvlpLogHypervisorSchedulerType HvlpLogIommuInitStatus HvlpLogMicrocodeUpdateStatus HvlpLogProcessorStartupFailure HvlpMapStatisticsPage HvlpProcessIommu HvlpQueryExtendedCapabilities HvlpQueryHypervisorSchedulerType HvlpSelectLpSet HvlpSelectVpSet HvlpSlowFlushAddressSpaceTb HvlpSlowFlushAddressSpaceTbEx HvlpSlowFlushListTb HvlpSlowFlushListTbEx HvlpSlowSendSyntheticClusterIpiEx HvlpTryConfigureInterface HvlpWithdrawPages HvlpWritePerfRegister HvpApplyIncrementalLogFile HvpApplyLegacyLogFile HvpDetermineLogFileApplicationOrder HvpGenerateLogEntryChecksums HvpGenerateLogEntryHeader HvpIncrementalLogFileEnumeratorAdvance HvpIsReadErrorTransient HvpLogEntryCheckDataChecksum HvpLogEntryCheckHeaderChecksum HvpLogInvalidLogHeader HvpLogUnreadableLog HvpMarkDirty HvpSwapDual I_MinCryptCheckEKURequirements InitBootProcessor InitSafeBoot IoBoostThreadIoPriority IoCaptureLiveDump IoConfigureCrashDump IoCreateDevice IoCreateDisk IoCreateDriver IoEnumerateEnvironmentVariablesEx IoEnumerateKsrPersistentMemoryEx IoGetDeviceDirectory IoGetDeviceInterfaceAlias IoGetDeviceProperty IoGetDmaAdapter IoGetEnvironmentVariableEx IoInitSystemPreDrivers IoInitializeProcessor IoIsValidNameGraftingBuffer IoQueryEnvironmentVariableInfoEx IoQueryInformationByName IoRaiseHardError IoReadDiskSignature IoReadPartitionTable IoReadPartitionTableEx IoRegisterPlugPlayNotification IoRemoveIoCompletion IoReportDetectedDevice IoReportRootDevice IoReserveKsrPersistentMemoryEx IoReuseIrp IoSaveBugCheckProgress IoSaveBugCheckRecoveryStatus IoSetEnvironmentVariableEx IoSetPartitionInformation IoSetPartitionInformationEx IoSetSystemPartition IoStartIoRateControl IoTranslateBusAddress IoVerifyPartitionTable IoVolumeDeviceNameToGuidPath IoVolumeDeviceToDosName IoVolumeDeviceToGuidPath IoWMIOpenBlock IoWMIQueryAllData IoWMIQueryAllDataMultiple IoWMIQuerySingleInstanceMultiple IoWriteCapturedPristineTriageDumpToDedicatedDumpFile IoWriteCrashDump IoWriteDeferredLiveDumpData IoWritePartitionTable IoWritePartitionTableEx IommupHvAttachPasidDevice IommupHvAttachPasidDeviceDomain IommupHvDismissPageFault IommupHvGetDeviceAtsCapability IommupHvGetDeviceSvmCapabilities IommupHvInitializeLibrary IommupHvIsDmarStageCompatible IommupHvIsStage1DmarCompatible IommupHvValidatePageRequestGpa IopApplySystemPartitionProt IopAttachDeviceToDeviceStackSafe IopBootLog IopCachePreviousBootData IopCallDriverReference IopCaptureObjectName IopCollectTriageDumpData IopConnectInterruptFullySpecified IopConnectLinkTrackingPort IopConnectMessageBasedInterrupt IopCopyBootLogRegistryToFile IopCrashDumpPolicyChangeWnfCallback IopCreateArcName IopCreateArcNames IopCreateArcNamesCd IopCreateArcNamesDisk IopDumpTraceCrashDumpDisabled IopDumpTraceCrashDumpReconfiguration IopDumpTraceDisableCrashDumpFailure IopDumpTraceForceDumpDisabled IopDumpTraceFreeDumpStackFailure IopDumpTraceInitializeCrashDumpFailure IopDumpTraceInitializeDumpStackFailure IopDumpTraceLoadCrashDumpDriverFailure IopDumpTraceLoadDumpStackFailure IopErrorLogThread IopFastQueryNetworkAttributes IopFileUtilClearAttributes IopFileUtilWalkDirectoryTreeBottomUp IopFileUtilWalkDirectoryTreeTopDown IopFreeBandwidthContract IopGetBootDiskInformation IopGetBootDiskInformationLite IopGetDeviceInterfaces IopGetFileVolumeNameInformation IopGetNetworkOpenInformation IopGetVolumeId IopInitActivityIdIrp IopInitCrashDumpDuringSysInit IopInitializeBootDrivers IopInitializeDumpPolicySettings IopInitializeInMemoryDumpData IopInitializeOfflineCrashDump IopInitializePlugPlayServices IopInitializeResourceMap IopInitializeSystemVariableService IopIoRateStartRateControl IopIrpStackProfilerDpcRoutine IopIsNotNativeDriverImage IopIsReportedAlready IopIssueTrEERequest IopLiveDumpAllocAndInitResources IopLiveDumpAllocateExtraBuffers IopLiveDumpAllocateFromVMMemoryPartition IopLiveDumpCallRemovePagesCallbacks IopLiveDumpCaptureMemoryPages IopLiveDumpEstimateMemoryPages IopLiveDumpIsUnderMemoryPressure IopLiveDumpMarkImportantDumpData IopLiveDumpOpenVMMemoryPartition IopLiveDumpPolicyChangeWnfCallback IopLiveDumpRegisterWnfNotificationCallback IopLiveDumpTraceAllocationFromVMMemoryPartitionFailure IopLiveDumpTraceBufferAllocation IopLiveDumpTraceBufferEstimation IopLiveDumpTraceCaptureGenerateIptSecondaryDataDuration IopLiveDumpTraceCaptureMemoryPages IopLiveDumpTraceCaptureProcessorContextDuration IopLiveDumpTraceCorralProcessorsDuration IopLiveDumpTraceDumpDisabledOnBoot IopLiveDumpTraceDumpFileWriteEnd IopLiveDumpTraceEstimatedAndAllocatedPageCount IopLiveDumpTraceHvlPrepareLivedumpDescriptorFailure IopLiveDumpTraceInterfaceEnd IopLiveDumpTraceMarkImportantDumpDataDuration IopLiveDumpTraceMarkRequiredDumpDataDuration IopLiveDumpTraceMmDuplicateMemoryFailure IopLiveDumpTraceOpenVMMemoryPartitionFailure IopLiveDumpTracePopulateBitmapForDumpDuration IopLiveDumpTraceQueryHvlDumpSizeFailure IopLiveDumpTraceRemovePagesCallbackFailure IopLiveDumpTraceUncorralProcessorsDuration IopLiveDumpWriteDumpFile IopLiveDumpWriteDumpFileWithExtraPages IopLiveDumpWriteSecondaryData IopLoadDriver IopLogAuditIoRegisterNotificationEvent IopMarkBootPartition IopMountVolume IopOpenLinkOrRenameTarget IopParseDevice IopPassiveInterruptWorker IopPerfCompleteRequest IopPerfCompletionRoutine IopPerfLogCallEvent IopPerfLogCallReturnEvent IopProcessIoTracking IopProcessSetInterfaceState IopProcessWorkItem IopProtectSystemPartition IopQueryDockRemovalInterface IopQueryEnvironmentVariableInfoSysEnv IopQueryEnvironmentVariableInfoTrEE IopQueryPassiveInterruptRegistryOptions IopQueryResourceHandlerInterface IopRaiseHardError IopReassignSystemRoot IopRegisterDeviceInterface IopSendMessageToTrackService IopSetRemoteLink IopStoreSystemPartitionInformation IopSymlinkQueryEnabledClasses IopSynchronousServiceTail IopTimerDispatch IopTraceCrashDumpDisabledOnBoot IopTrackLink IopWriteCapsuleTriageDumpToFirmware IopXxxControlFile IovCompleteRequest IovpCallDriverWithStackBuffer IpmiLibAddSelRecord IpmiLibpAddSelRawData IpmiLibpKcsRequestAndReceive IvtDismissPageFault IvtDrainSvmPageRequests IvtFlushDeviceTbOnly IvtFlushTbInternal IvtInitializeIommu IvtInitializeScalableModePasidTables IvtInvalidateAllContextEntries IvtInvalidateContextEntry IvtInvalidateRemappingTableEntries IvtInvalidateScalableModePasidCache IvtIommuWaitCommand IvtSetPasidAddressSpace IvtUpdateRemappingTableEntry IvtUpdateScalableModeContextEntry IvtUpdateScalableModePasidTablesForPasid KGetUnlockSetting KdInitSystem KdSendTraceData KdpCloseRemoteFile KdpCreateRemoteFile KdpPrint KdpPrintString KdpPrompt KdpPromptString KdpReadRemoteFile KdpReportCommandStringStateChange KdpReportExceptionStateChange KdpReportLoadSymbolsStateChange KdpRestoreBreakPointEx KdpSearchMemory KdpSendWaitContinue KdpWriteBreakPointEx KeAddEnclavePage KeAdjustInterruptTime KeAndGroupAffinityEx KeBoostPriorityThread KeCanChangeEnclavePageProtection KeChangeEnclavePageProtection KeCommitSmtState KeCopyPrivilegedPage KeCopyXfdMaskToTeb KeCpuSetReportParkedProcessors KeCreateEnclave KeDeleteCpuPartition KeDisableTimer2 KeEnumerateKernelStackSegments KeFlushCurrentTbOnly KeFlushIoBuffers KeFlushMultipleRangeCurrentTb KeFlushQueuedDpcs KeFlushSingleCurrentTb KeFlushSingleTb KeForceAttachProcess KeForceDetachProcess KeFreezeExecution KeGenericProcessorCallback KeGetTbSize KeInitSystem KeInitializeClock KeIntSteerPeriodic KeIntSteerSnapPerf KeIsSubsetAffinityEx KeLoadMTRR KeMaskInterrupt KeOutPageEnclavePage KePrepareClockTimerForIdle KePrepareNonClockOwnerForIdle KeQueryCpuPartitionAffinity KeQueryTotalCycleTimeThread KeRebootSystemForRecovery KeRecomputeCpuSetAffinityProcess KeRegisterProcessorChangeCallback KeRemoveQueueDpcEx KeRemoveQueueEx KeRequestTerminationThread KeRestoreProcessorSpecificFeatures KeResumeClockTimerFromIdle KeRevertToUserAffinityThread KeRevertToUserAffinityThreadEx KeRevertToUserMultipleGroupAffinityThread KeSecureProcess KeSetAffinityProcess KeSetBasePriorityThread KeSetCpuSetsProcess KeSetIntervalProfile KeSetPagePrivilege KeSetPriorityThread KeSetSchedulingGroupRankBias KeSetSelectedCpuSetsThread KeSetSystemMultipleGroupAffinityThread KeSetThreadSchedulerAssist KeSetTracepoint KeSetUserAffinityThread KeSetUserCetAppcompatOptions KeSetUserGroupAffinityThread KeStartAllProcessors KeStartProfile KeStartThread KeStopProfile KeSupportedPhysicalAddressBits KeSynchronizeAddressPolicy KeSynchronizeSecurityDomain KeUnsecureProcess KeUpdateDpcWatchdogConfiguration KeUpdateSoftParkRankList KeUpdateThreadCpuSets KeUpdateThreadTag KeWaitForMultipleObjects KeWaitForMutexObject KeWriteProtectPAT KiAbThreadUnboostCpuPriority KiAdjustGroupConfiguration KiAndAffinityEx KiApplyForegroundBoostThread KiBugCheckProgress KiBugCheckProgressCpusFrozen KiBugCheckRecoveryFreezeOtherProcessors KiCalibrateTimeAdjustment KiCancelClockTimer KiCancelTimer KiCheckForThreadDispatch KiCheckForTimerExpiration KiCheckMicrocode KiChooseTargetProcessor KiComputeCpuSetAffinity KiComputeDispatchInterruptCost KiComputeNumaCosts KiComputeThreadAffinity KiComputeTopologyConstants KiConfigureHeteroMultiCoreProcessors KiConnectInterrupt KiContinuePreviousModeUser KiDeferGroupSchedulingPreemption KiDeferredBugcheckRecoveryWorker KiDeferredReadySingleThread KiDeregisterNmiSxCallback KiDetectAmdNonArchSsbdSupport KiDetectHardwareSpecControlFeatures KiDetectKvaLeakage KiDetectTsx KiDirectSwitchThread KiDisconnectInterruptCommon KiDispatchException KiDisplayBlueScreen KiDumpParameterImages KiDynamicProcessorAddNotification KiDynamicProcessorInitialization KiEnterLongDpcProcessing KiEventClockStateChange KiExecuteAllDpcs KiExitDispatcher KiExitThreadWait KiExpireTimer2 KiFinalizeTimer2Disablement KiFlushAddressSpaceTb KiFlushRangeTb KiFlushSingleTbWorker KiForceIdleUpdateSchedulerParkState KiForwardTick KiFreezeTargetExecution KiGetCpuVendor KiGetIptInfo KiGetProcessorInformation KiGetProcessorSignature KiGetTbLeafInfo KiGetXSaveSupportedFeatures KiGroupSchedulingGenerationEnd KiGroupSchedulingQuantumEnd KiHaltOnAddressWakeEntireList KiHandleDeferredPreemption KiHeteroComputeThreadImportance KiHeteroScanQueueForPreemptionSwapTarget KiHvEnlightenedGuestPriorityKick KiInitMachineDependent KiInitializeContextThread KiInitializeDynamicProcessorDpc KiInitializeHgsPlusWorkloadClasses KiInitializeHresetSupport KiInitializeIdleProcess KiInitializeKernel KiInitializeNxSupportDiscard KiInitializeReservedCpuSets KiInitializeTopologyStructures KiInitializeUserApc KiInitializeXSave KiIntRedirectQueueRequestOnProcessor KiIntSteerCalculatePriorityDistribution KiIntSteerLogState KiIntSteerLogStatus KiInterruptDispatchCommon KiIntersectFeaturesWithPolicy KiInvokeInterruptServiceRoutine KiIpiProcessRequests KiIpiSendRequest KiIsHyperVCr3RspErrataPresent KiIsNXSupported KiIsProcessTerminationRequested KiLogSingleDpcSoftTimeoutEvent KiLogUserCetSetContextIpValidationFailureWorker KiMcheckAlternateReturn KiOpPatchCode KiOrAffinityEx KiOutSwapKernelStacks KiParkCurrentProcessor KiPerformAutomaticGroupConfiguration KiPerformExplicitGroupAssignment KiPerformHeteroSoftParkElection KiPrepareUpdateCoresHeteroMask KiProcessControlProtection KiProcessDeferredReadyList KiProcessExpiredTimerList KiQuantumEnd KiRaiseException KiReadyOutSwappedThreads KiRemoveBoostThread KiRemoveSystemWorkPriorityKick KiRescheduleThreadAfterAffinityChange KiReselectIdealProcessorAfterAffinityChange KiRetireDpcList KiRundownMutants KiSchedulerApc KiSearchForNewThread KiSearchForNewThreadOnProcessor KiSearchForNewThreadsForRescheduleContext KiSelectProcessorToPreempt KiSendClockInterruptToClockOwner KiSendThawExecution KiSetCacheInformationAmd KiSetCacheInformationIntel KiSetClockTimer KiSetFeatureBits KiSetHeteroPolicyThread KiSetLegacyAffinityThread KiSetNextClockTickDueTime KiSetPageAttributesTable KiSetPriorityThread KiSetProcessorSignature KiSetStandardizedCacheInformation KiSetSystemAffinityThread KiShouldRearmClockTimer KiSoftParkElectionDpcRoutine KiStallBugcheckThread KiStartDpcThread KiStartDynamicProcessor KiStartPrcbThread KiSubtractAffinityEx KiSwapThread KiSynchCounterSetCallback KiSynchNumaCounterSetCallback KiSynchronizeStibpPairing KiTimer2Expiration KiTimerExpiration KiTimerExpirationDpc KiTpReadImageData KiTpWriteMemory KiTraceCancelTimer2 KiTraceLogControlCallback KiTraceLogHeteroRundown KiTraceSetTimer KiTraceSetTimer2 KiUnwindUserSspForApcContextCopyBypass KiUpdateGlobalCpuSetConfiguration KiUpdateNumberProcessors KiUpdateProcessConcurrencyCount KiUpdateRunTime KiUpdateTime KiUpdateVpBackingThreadPriorityDpcRoutine KiWaitForAllObjects KiXorAffinityEx KitLogFeatureUsage KitpReadUlongFromKey KseDsCallbackHookAddDevice KsepDbGetShimInfo KsepDsEventAddDevice KsepDsEventDataIrp KsepDsEventDevicePowerCompleted KsepDsEventDevicePowerIrp KsepDsEventDriverLoad KsepDsEventDriverStartIo KsepDsEventDriverUnload KsepDsEventIoCreateDevice KsepDsEventPnpIrp KsepDsEventPnpStartDevice KsepDsEventPnpStopDevice KsepDsEventPoolAllocate KsepDsEventPoolFree KsepDsEventRequestPowerIrp KsepDsEventSystemPowerIrp KsepEvntLogFlagsApplied KsepEvntLogShimsApplied KsepLogEtwMessage KsepMatchInitBiosInfo KsepRegistryQueryDWORD KsepShimDatabaseTime KsepSkipDriverUnloadEventDriverLoad KsepSkipDriverUnloadEventDriverUnload KyRaiseException LdrLoadAlternateResourceModuleEx LdrResGetRCConfig LdrResSearchResource LdrpGetParentLangId LdrpGetRcConfig LdrpGetResourceFileName LdrpResSearchResourceMappedFile LdrpSearchResourceSection_U LkmdTelCreateReport LocalGetAclForString LocalGetConditionForString LocalGetStringForControl LocalGetStringForRelativeAttribute LocalpConvertStringSidToSid LocalpGetStringForCondition LookUpTableFlushComplete MakeGdtReadOnly McTemplateK0_EtwWriteTransfer McTemplateK0d_EtwWriteTransfer McTemplateK0dszu_EtwWriteTransfer McTemplateK0dz_EtwWriteTransfer McTemplateK0dzd_EtwWriteTransfer McTemplateK0hzr0_EtwWriteTransfer McTemplateK0hzr0d_EtwWriteTransfer McTemplateK0hzr0hzr2_EtwWriteTransfer McTemplateK0hzr0qqhzr4_EtwWriteTransfer McTemplateK0izzx_EtwWriteTransfer McTemplateK0j_EtwWriteTransfer McTemplateK0jhzr1_EtwWriteTransfer McTemplateK0jhzr1d_EtwWriteTransfer McTemplateK0jq_EtwWriteTransfer McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer McTemplateK0jzt_EtwWriteTransfer McTemplateK0p_EtwWriteTransfer McTemplateK0pqzzzzzzz_EtwWriteTransfer McTemplateK0pz_EtwWriteTransfer McTemplateK0q_EtwWriteTransfer McTemplateK0qhzr1z_EtwWriteTransfer McTemplateK0xxq_EtwWriteTransfer McTemplateK0xxxqq_EtwWriteTransfer McTemplateK0xxxqqqq_EtwWriteTransfer McTemplateK0xxxxxxxxxxxxxxxxxq_EtwWriteTransfer McTemplateK0z_EtwWriteTransfer McTemplateK0zd_EtwWriteTransfer McTemplateK0zdq_EtwWriteTransfer McTemplateK0zjdd_EtwWriteTransfer McTemplateK0zq_EtwWriteTransfer McTemplateK0zqz_EtwWriteTransfer McTemplateK0zz_EtwWriteTransfer McTemplateK0zzjzitd_EtwWriteTransfer McTemplateK0zzjzzzdd_EtwWriteTransfer McTemplateK0zzjzzztzdzztdz_EtwWriteTransfer McTemplateK0zzq_EtwWriteTransfer McTemplateK0zzqq_EtwWriteTransfer McTemplateK0zzqqzttquqqzxt_EtwWriteTransfer McTemplateK0zzqqzttquxt_EtwWriteTransfer McTemplateK0zzt_EtwWriteTransfer McTemplateK0zztt_EtwWriteTransfer McTemplateK0zzz_EtwWriteTransfer McTemplateK0zzzd_EtwWriteTransfer McTemplateK0zzzdzzq_EtwWriteTransfer McTemplateK0zzzt_EtwWriteTransfer McTemplateK0zzztdd_EtwWriteTransfer McTemplateK0zzzzdd_EtwWriteTransfer McTemplateK0zzzzz_EtwWriteTransfer MfgInitSystem MiActOnLargeKernelHalPages MiAddLoaderHalIoMappings MiAddWorkingSetEntries MiAdjustPteBins MiAgeWorkingSet MiAllocateChildVads MiAllocateContiguousMemory MiAllocateFastAwePages MiAllocateFastLargePagesForMdl MiAllocateLargeProcessPagesFromCache MiAllocateLargeZeroPages MiAllocatePagesForMdl MiAllocateSlabEntry MiAllocateUserPhysicalPages MiAllocateVirtualMemory MiApplyBootLoadedDriversFixups MiApplyFunctionOverrideToBootDrivers MiApplyHotPatchToLoadedDriver MiApplyImportOptimizationToBootDrivers MiApplyRetpolineFixups MiApplyRetpolineFixupsToKernelAndHal MiApplyStraddleFixups MiAssignSessionRanges MiAssignSoftwareWsleRegion MiAssignTopLevelRanges MiAttachWorkingSet MiAttemptPageFileExtension MiAttemptPageFileReduction MiBuildMdlForMappedFileFault MiCaptureAndResetWorkingSetAccessBits MiChangePageHeatImmediate MiClearDriverHotPatchPtes MiClearNonPagedPtes MiClearPteAccessedBitRange MiClearSystemAccessBits MiCloneProcessAddressSpace MiCloneVads MiCoalesceFreeLargePages MiCoalesceFreePages MiCombineIdenticalPages MiCombineInitialInstance MiCombineWithExisting MiCombineWorkingSet MiCommitExistingVad MiComputeAgeDistribution MiComputeCacheAttributeSpeeds MiComputeIdealDpcGang MiComputeNodeMemory MiConvertHiberPhasePages MiCopyFromUntrustedMemory MiCopyLargeVad MiCopyOnWrite MiCopyPagesIntoEnclave MiCopyToCfgBitMap MiCopyToUntrustedMemory MiCopyVirtualMemory MiCountBootDriverRegions MiCountSharedPages MiCrcStillIntact MiCreateImageFileMap MiCreateInitialSystemWsles MiCreateNewSection MiCreatePagefile MiCreatePagingFileMap MiCreatePerNodeZeroingConductor MiCreateSessionDriverProtos MiCreateSlabAllocationsFromLoaderBlock MiDecayPfnFullyInitialized MiDecommitHardwareEnclavePages MiDecommitLargePoolVa MiDecommitPages MiDeleteAllHardwareEnclaves MiDeleteClusterPage MiDeleteClusterSection MiDeleteEmptyPageTables MiDeleteFinalPageTables MiDeleteInsertedCloneVads MiDeletePagablePteRange MiDeletePteRun MiDeletePteWsleCluster MiDeleteSystemPagableVm MiDeleteSystemPageTables MiDeleteVa MiDeliverPicoExceptionForProbedPage MiDemoteCombinedPte MiDemoteLocalLargePage MiDemoteSlabEntries MiDemoteValidLargePageOneLevel MiDeprioritizeVirtualAddresses MiDereferenceSegmentThread MiDetachAndUnlockWorkingSet MiDispatchFault MiEliminateZeroPages MiEmptyAccessLogs MiEmptyWorkingSetInitiate MiEnableNewPfns MiExamineHalVa MiFillHyperPtes MiFillPfnGaps MiFindActualFaultingPte MiFindContiguousPagesEx MiFindLargeMapping MiFindLargestLoaderDescriptor MiFindProcessImageHotPatchRecord MiFlushAllPages MiFlushCacheMdl MiFlushDirtyBitsToPfn MiFlushEntireTbDueToAttributeChange MiFlushSectionInternal MiFlushStaleCacheMap MiFlushStrongCodeDriverLoadFailures MiFlushTbAsNeeded MiFlushValidPteFromTb MiFlushWaitForReadInProgress MiFreeBootDriverPages MiFreeLargePageChain MiFreeLargePages MiFreeLargeProcessPagesToCache MiFreeLargeZeroPages MiFreePagesFromMdl MiFreePhysicalPageChain MiFreePhysicalPages MiFreeUnusedSlabPages MiFreeWsleList MiGetBaseResidentPage MiGetClusterPage MiGetLargePage MiGetLargePageChain MiGetNextAffinityWalker MiGetNextAffinityWalkerLegacy MiGetNextPageTable MiGetPage MiGetPageChain MiGetPerfectColorHeadPage MiGetPteFromCopyList MiGetSlabStandbyPage MiGetSystemAddressForImage MiGetTopLevelPfn MiGetWorkingSetInfoEx MiGetWorkingSetInfoList MiHotPatchAllProcesses MiHugePageOperation MiIdealClusterPage MiIdentifyPfn MiInPagePageTable MiInPageSingleKernelStack MiInSwapSharedWorkingSetWorker MiInSwapStoreWorker MiInitNucleus MiInitSystem MiInitializeCacheFlushing MiInitializeChannelRangesTemporary MiInitializeDriverImages MiInitializeDynamicPfns MiInitializeLargeMdlLeafPfns MiInitializeLargePageColorSizes MiInitializeNumaGraph MiInitializePartitionThreads MiInitializeProcessBottomUpEntropy MiInitializeSessionIds MiInitializeTbFlush MiInitializeZeroEngines MiInsertChildVads MiInsertLargePageChain MiInsertNewZeroThread MiInsertPageInList MiInsertPagesInList MiInvokePatchCallback MiIsCfgBitMapPageShared MiIssueHardFault MiLargePageFault MiLargePagePromote MiLoadDataIntoVsmEnclave MiLockCode MiLockDownWorkingSet MiLogAddPhysicalMemory MiLogAllocateWsleEvent MiLogBadMapper MiLogCombinedPteDelete MiLogCommitRequestFailed MiLogContinueTrim MiLogCreateImageFileMapFailure MiLogFailedDriverLoad MiLogHotPatchManagement MiLogHotPatchOperation MiLogHotPatchOperationStatus MiLogHotPatchPagesLocked MiLogHotPatchRundown MiLogKernelStackEvent MiLogMdlRangeEvent MiLogNonPagedPoolReleaseEvent MiLogNonRetpolineImageLoadEvent MiLogNotifyPageHeat MiLogOutswappedProcessCommitReacquire MiLogOutswappedProcessCommitRelease MiLogPerfMemoryEvent MiLogPerfMemoryRangeEvent MiLogPeriodicTelemetry MiLogPeriodicTelemetryForSlabAllocator MiLogPinDriverAddress MiLogPinDriverAddressesWorker MiLogProcessWorkingSetsStop MiLogRemoveWsleEvent MiLogReserveVaFailed MiLogResetPagesCommitRelease MiLogSectionCreate MiLogSlabEntriesDemote MiLogSlabEntryAllocateFailure MiLogStrongCodeDriverLoadFailure MiLogTrimWs MiLogWsEmptyControl MiMakeOutswappedPageResident MiMakePageAvoidRead MiMakeSystemCacheRangeValid MiMakeVaRangeNoAccess MiMakeZeroedPageTablesEx MiMapContiguousMemory MiMapImageForEnclaveUse MiMapMdlCommon MiMapMemoryDumpMdl MiMapUserLargePages MiMapViewOfSection MiMarkBootKernelStack MiMarkHiberNotCachedPages MiMarkHugeRangeTransition MiMarkKernelImageCfgBits MiMarkKernelPageTablePages MiMarkLargePageMappings MiMarkNonPagedHiberPhasePages MiMarkSharedImageCfgBits MiModifiedPageWriter MiMoveDirtyBitsToPfns MiMoveLargeFreePage MiNodeZeroConductor MiOpenHotPatchFile MiOrderTrimList MiOutSwapKernelStackPage MiOutSwapWorkingSet MiParseComAndCetHeaders MiParseImageLoadConfig MiPartitionWorkingSetManager MiPerformSafePdeWrite MiPersistMdl MiPfCompleteInPageSupport MiPfnRangeIsZero MiPopulateCfgBitMap MiProcessWorkingSets MiProtectAweRegion MiProtectDriverSectionPte MiProtectEnclavePages MiProtectLargeKernelHalRange MiProtectPrivateMemory MiProtectSharedUserPage MiProtectSystemImage MiPruneProcessLargePageCaches MiQueryAddressState MiQueryMemoryPhysicalContiguity MiQueryProcessActivePatches MiReadyReservedView MiRebuildPageTableLeafAges MiReferenceIoPages MiReferenceNonPagedMemoryProcessList MiReleaseLargePdeMappings MiReleaseProcessReferenceToSessionDataPage MiReleasePtes MiReleaseSmallPteMappings MiReloadBootLoadedDrivers MiRelocateImage MiRemoveLowestPriorityStandbyPage MiReplacePageOfProtoPool MiReplacePageTablePage MiReplacePfnWithGapMapping MiReplaceRotateWithDemandZero MiReplaceRotateWithDemandZeroNoCopy MiReplaceTransitionPage MiReturnSystemVa MiScrubActiveLargePage MiScrubLargeMappedPage MiSelectBestZeroingProcessor MiSelectBestZeroingProcessorLegacy MiSessionCreate MiSessionObjectCreate MiSetIdealProcessorThread MiSetPagesModified MiSetPagingOfDriver MiSetProtectionOnSection MiSetReadOnlyOnSectionView MiSetSystemCodeProtection MiSetVaAgeList MiSharePages MiShowBadMapper MiSimpleAging MiSnapDriverRange MiSoftFaultMappedView MiStealPage MiStoreEvictThread MiStoreLogFullPagefile MiStoreLogNotCandidate MiStoreLogWriteCompleteFailure MiStoreLogWriteDisabled MiStoreLogWriteIssueFailure MiStoreLogWriteIssueRetry MiSwitchToTransition MiSystemFault MiTerminateWsleCluster MiTradeBootImagePage MiTransferFileExtent MiTranslatePageForCopy MiTrimSharedPageFromViews MiTrimUnusedPageFileRegionsWorker MiTrimWorkingSet MiUnapplyDriverHotPatch MiUnlinkNodeLargePages MiUnlinkPageFromBadList MiUnlinkPageFromListEx MiUnmapImageForEnclaveUse MiUnmapMdlCommon MiUnmapRetpolineStubs MiUnmapViewOfSection MiUpdateCfgSystemWideBitmapWorker MiUpdatePageAttributeStamp MiUpdateRetpolineImportFixups MiValidatePagefilePageHash MiValidateSectionCreate MiVerifyLargeSectionLayout MiWaitForFreePage MiWalkEntireImage MiWalkResetCommitPages MiWalkVaRange MiWorkingSetManager MiWriteAwePtes MiWritePageFileHash MiWritePteHighLevel MiWritePteHighLevelIsr MiZeroAllPageFiles MiZeroAndFlushPtes MiZeroAndReleasePages MiZeroHugeRangeCore MiZeroInParallel MiZeroInParallelWorker MiZeroLargePage MiZeroPage MiZeroPageCalibrate MiZeroPageFile MiZeroPageFileFirstPage MiZeroPageWorkMapping MiZeroPageWrite MigrateOOBELanguageToInstallationLanguage MinAsn1DecodeGeneralizedTime MinAsn1ExtractParsedCertificatesFromSignedData MinAsn1ExtractValues MinAsn1ParseAndDecodeRDNComponent MinAsn1ParseSingleExtensionValue MinAsn1StringToOid MinCryptCheckCertsAndKeys MinCryptDecodeHashAlgorithmIdentifier MinCryptDecodeSignatureAlgorithmIdentifier MinCryptIsKeyPresent MinCryptVerifySignedHash2 MmAccessFault MmAddRangeToCrashDump MmAllocateContiguousMemoryEx MmAllocateContiguousNodeMemory MmAllocateMappingAddressEx MmAssignProcessToJob MmCheckCachedPageStates MmCopyMemory MmCreatePeb MmCreateShadowMapping MmCreateTeb MmDeleteShadowMapping MmDeleteTeb MmEnforceWorkingSetLimit MmEnumerateAddressSpaceAndReferenceImages MmEnumerateSystemImages MmFlushVirtualMemory MmFreeLoaderBlock MmFreeNonChargedSecurePages MmFreeSecureKernelPages MmFreeVirtualMemory MmGetChannelInformation MmIdentifyPhysicalMemory MmInSwapVirtualAddresses MmInSwapWorkingSet MmInitializeHandBuiltProcess2 MmInitializeProcessAddressSpace MmIsFileMapped MmLogQueryCombineStats MmLogSystemShareablePfnInfo MmManagePartitionMemoryInformation MmMarkPhysicalMemoryAsBad MmNotifyProcessInSwapTrigger MmOutPageKernelStack MmOutSwapVirtualAddresses MmOutSwapWorkingSet MmPerfLogSessionRundown MmPrefetchVirtualMemory MmProbeAndLockProcessPages MmProbeAndLockSelectedPages MmProcessWorkingSetControl MmProtectDriverSection MmProtectMdlSystemAddress MmProtectPool MmQueryBadAddresses MmQueryCommitReleaseState MmQueryMemoryListInformation MmQueryVirtualMemory MmReleaseCommitForMemResetPages MmRelocatePfnList MmRemoveExecuteGrants MmRemoveSystemCacheFromDump MmSecureVirtualMemoryAgainstWrites MmSetAddressRangeModifiedEx MmSetCommitReleaseEligibility MmSetPageProtection MmSetPfnListInfo MmStoreLogCorruptionFixed MmUnlockPhysicalPagesByVa MmUnmapIoSpace MmUnmapProtectedKernelPageRange MmUpdateOldWorkingSetPages MmWaitMultipleForCacheManagerPrefetch MmWriteSystemImageTracepoint MmZeroPageFileAtShutdown MxCreatePfns MxZeroPageTablePfns NtAddAtomEx NtAlpcSetInformation NtCommitRegistryTransaction NtCompressKey NtCreateEnclave NtCreateMailslotFile NtCreateNamedPipeFile NtCreateProfile NtCreateSymbolicLinkObject NtCreateThread NtCreateThreadEx NtCreateTokenEx NtCreateUserProcess NtCreateWnfStateName NtDebugActiveProcess NtDeleteBootEntry NtDeleteDriverEntry NtDeleteFile NtDeleteKey NtDeleteValueKey NtEnumerateKey NtEnumerateValueKey NtFindAtom NtFlushKey NtFreeUserPhysicalPages NtFreezeRegistry NtGetCachedSigningLevel NtGetCompleteWnfStateSubscription NtGetNextProcess NtGetNextThread NtGetNlsSectionPtr NtGetWriteWatch NtInitializeEnclave NtLoadEnclaveData NtLockProductActivationKeys NtLockVirtualMemory NtManageHotPatch NtManagePartition NtMapUserPhysicalPages NtMapUserPhysicalPagesScatter NtNotifyChangeMultipleKeys NtNotifyChangeSession NtOpenProcessTokenEx NtPowerInformation NtProtectVirtualMemory NtPssCaptureVaSpaceBulk NtQueryAttributesFile NtQueryFullAttributesFile NtQueryInformationFile NtQueryInformationJobObject NtQueryInformationProcess NtQueryInformationThread NtQueryKey NtQueryMultipleValueKey NtQueryOpenSubKeys NtQueryOpenSubKeysEx NtQuerySystemEnvironmentValueEx NtQueryValueKey NtQueryWnfStateData NtRaiseHardError NtRemoveIoCompletionEx NtRemoveProcessDebug NtRenameKey NtReplaceKey NtResetWriteWatch NtRestoreKey NtRollbackRegistryTransaction NtSaveKeyEx NtSaveMergedKeys NtSecureConnectPort NtSetContextThread NtSetDefaultLocale NtSetInformationJobObject NtSetInformationKey NtSetInformationProcess NtSetInformationThread NtSetInformationVirtualMemory NtSetInformationWorkerFactory NtSetSystemEnvironmentValueEx NtSetSystemInformation NtSetSystemPowerState NtSetSystemTime NtSetUuidSeed NtSetValueKey NtSetVolumeInformationFile NtThawRegistry NtTraceEvent NtUnlockVirtualMemory NtWaitForDebugEvent NtWaitForMultipleObjects NtWaitForMultipleObjects32 NtWaitForWorkViaWorkerFactory ObCloseHandleTableEntry ObCreateObjectTypeEx ObCreateSiloRootDirectory ObCreateSymbolicLink ObDuplicateObject ObGetSiloRootDirectoryPath ObInitSystem ObInsertObjectEx ObOpenObjectByPointer ObReferenceObjectByName ObSetHandleAttributes ObWaitForMultipleObjects ObpAdjustCreatorAccessState ObpCloseHandle ObpCreateHandle ObpDecrementHandleCount ObpIncrementHandleCountEx ObpInsertHandleCount ObpInsertOrLocateNamedObject ObpParseSymbolicLinkEx ObpProcessRemoveObjectQueue ObpStartRuntimeStackTrace ObpVerifyAccessToBoundaryEntry ObpVerifyCreatorAccessCheck OpenGlobalizationUserSettingsKey_ForMua Ordinal_14 Ordinal_30 Ordinal_5 Ordinal_6 Ordinal_9 PerfDiagInitialize PerfDiagpIsTracingAllowed PerfDiagpUpdatePerfDiagLoggerEnableFlags PerfInfoLogIpiSend PerfInfoLogSysCallEntry PerfInfoLogSysCallExit PerfInfoLogUnexpectedInterrupt PerfInfoLogVirtualAlloc PerfInfoLogVirtualFree PerfLogExecutiveResourceInitialize PerfLogExecutiveResourceRelease PerfLogExecutiveResourceSetOwnerPointer PerfLogExecutiveResourceWait PerfLogImageLoad PerfLogSpinLockRelease PfQuerySuperfetchInformation PfSnAppLaunchScenarioControl PfSnAsyncPrefetchWorker PfSnBeginAppLaunch PfSnCheckActionsNeeded PfSnCheckModernApp PfSnEndTrace PfSnGetPrefetchInstructions PfSnGetSectionObject PfSnLogAsyncWorker PfSnLogGetReadListsStart PfSnLogGetReadListsStop PfSnLogOpenVolumesForPrefetch PfSnLogPrefetchMetadata PfSnLogScenarioDecision PfSnOperationProcess PfSnParametersRead PfSnParsePrefetchParam PfSnPopulateReadList PfSnPrefetchSections PfSnQueryVolumeInfo PfSnSetAltPrefetchParam PfSnSetPrefetcherInformation PfSnVolumeCheckIsSdBus PfSnVolumeCheckSeekPenalty PfTLoggingWorker PfVerifyScenarioBuffer PfpFlushBuffers PfpGetParameter PfpLogApplicationEvent PfpParametersRead PfpPrefetchRequestPerform PfpPrivSourceEnum PfpQueryFileExtentsRequest PfpQueryGpuUtilization PfpRpControlRequest PfpRpControlRequestCopy PfpSourceGetPrefetchSupport PfpUpdateRepurposedByPrefetch PfpVolumeOpenAndVerify Phase1InitializationDiscard PiAuCheckTokenMembership PiAuCreateStandardSecurityObject PiAuDoesClientHavePrivilege PiAuditDeviceOperation PiCMDeleteDeviceKey PiCMGetDeviceInterfaceAlias PiCMGetDeviceInterfaceList PiCMGetObjectProperty PiCMRegisterDeviceInterface PiCMSetDeviceProblem PiCMSetObjectProperty PiControlGetDevicePowerData PiCreateDriverSwDeviceCallback PiDcHandleCustomDeviceEvent PiDcHandleDeviceEvent PiDcHandleInterfaceEvent PiDcInitUpdateProperties PiDcResetChildDeviceContainerCallback PiDcResetChildDeviceContainers PiDcUpdateDeviceContainerMembership PiDevCfgCheckDeviceNeedsUpdate PiDevCfgClearDeviceMigrationNode PiDevCfgConfigureDevice PiDevCfgConfigureDeviceInterfaces PiDevCfgConfigureDeviceLocation PiDevCfgCopyDeviceKey PiDevCfgEnumDeviceKeys PiDevCfgFindDeviceMigrationNode PiDevCfgGetKeySecurityDescriptor PiDevCfgInitDeviceContext PiDevCfgLogDeviceConfigured PiDevCfgLogDeviceStarted PiDevCfgParsePropertyKeyName PiDevCfgQueryDeviceMigrationNode PiDevCfgQueryDriverConfiguration PiDevCfgQueryDriverNode PiDevCfgQueryPolicyStringList PiDevCfgResetDeviceDriverSettings PiDevCfgResolveVariableDeviceProperty PiDevCfgResolveVariableExpression PiDevCfgResolveVariableFormatString PiDevCfgResolveVariableGenerateGuid PiDevCfgResolveVariableKeyHandle PiDevCfgResolveVariableSwitchCase PiDevCfgSplitDriverConfigurationId PiDmAddCacheReferenceForObject PiDmCacheDataEncode PiDmEnumObjectsWithCallback PiDmGetObject PiDmGetReferencedObjectFromProperty PiDmListInitEnumCallback PiDmLookupObject PiDmObjectGetCachedCmProperty PiDmObjectUpdateCachedCmProperty PiDqActionDataGetChangedProperties PiDqDeleteUserObjectFromLoadedHives PiDqIrpQueryCreate PiDqObjectManagerEnumerateAndRegisterQuery PiDqObjectManagerServiceActionQueue PiDqOpenUserObjectRegKey PiDqSameUserHive PiDrvDbOverlayCopyKeys PiDrvDbOverlayNodeHive PiGetDeviceRegProperty PiGetDeviceRegistryProperty PiIsDriverBlocked PiLastGoodRevertLastKnownDirectory PiLookupInDDBCache PiPnpRtlCmActionCallback PiPnpRtlGatherInstallerClassChangeInfo PiPnpRtlGatherInterfaceDeleteInfo PiPnpRtlGetFilteredDeviceInterfaceList PiPnpRtlInterfaceFilterCallback PiPnpRtlIsDeviceEnumerableForUser PiPnpRtlObjectEventCreate PiPnpRtlObjectEventWorker PiPnpRtlServiceFilterCallback PiPnpRtlSetObjectProperty PiProcessDriverInstance PiProcessNewDeviceNode PiQueryRemovableDeviceOverride PiRearrangeDeviceInstances PiRebalanceOptOut PiSwCompleteCreate PiSwFindSwDevice PiUEventApplyAdditionalFilters PiUEventBroadcastPortsChangedEvent PiUEventInitClientRegistrationContext PiUpdateDriverDBCache PipCallDriverAddDevice PipCallbackHasDeviceOverrides PipChangeDeviceObjectFromRegistryProperties PipCheckComputerSupported PipCreateComputerId PipCriticalDeviceWaitCallback PipDmgGetDeviceDmarPolicy PipGenerateContainerID PipGetPersistentMemory PipHardwareConfigClearStartOverrideCallback PipHardwareConfigClearStartOverrides PipHardwareConfigExists PipHardwareConfigInit PipInitComputerIds PipInitDeviceOverrideCache PipIs32bitKey PipKsrNotifyDrivers PipMakeGloballyUniqueId PipProcessPendingObjects PipResetDevice PipServiceInstanceToDeviceInstance PipUnprotectDevice PipUpdateDeviceProducts PnpBuildCmResourceList PnpCallAddDevice PnpCompareInterruptInformation PnpDeviceActionWorker PnpDeviceEventWorker PnpDiagRundownConnectionResourceForEachDevice PnpDiagRundownInterruptResourceForEachDevice PnpDiagRundownParentDevNodeForEachDevice PnpDiagRundownParentPdoForEachDevice PnpDiagnosticTraceAppVeto PnpDiagnosticTraceDeviceOperation PnpDiagnosticTraceDriverFullInfo PnpDiagnosticTraceElamDecision PnpDiagnosticTraceElamStatus PnpDiagnosticTraceObject PnpDiagnosticTraceObjectWithStatus PnpDriverLoadingFailed PnpGetDeviceInterfacePropertyData PnpGetDevicePropertyData PnpGetStableSystemBootTime PnpHardwareConfigCreateBootDriverFlags PnpInitializeNotifyEntry PnpIsValidGuidString PnpNotifyDeviceClassChange PnpNotifyDriverCallback PnpNotifyHwProfileChange PnpNotifyTargetDeviceChange PnpNotifyUserModeDeviceRemoval PnpPrepareDriverLoading PnpProcessDeferredRegistrations PnpQueryAndSaveDeviceNodeCapabilities PnpRebalance PnpRegistryValueExists PnpReplacePartitionUnit PnpSendIrp PnpSetDeviceAffinityThread PnpSetDeviceInterfacePropertyData PnpSetDevicePropertyData PnpShutdownDevices PnpTraceClearDevNodeProblem PnpTraceDeviceConfig PnpTraceDeviceRemovalForResetComplete PnpTraceDmaGuardDevicePolicy PnpTraceDmaGuardSystemPolicy PnpTraceDockDeviceEnumeration PnpTraceDriverBlocked PnpTraceInterruptConnection PnpTraceIommuDeviceProperties PnpTraceRebalanceResult PnpTraceRequestDeviceRemovalForReset PnpTraceSecureDeviceEnumeration PnpTraceSetDevNodeProblem PnpTraceWatchdogViolation PnprCopyReservedMapping PnprLogFailureEvent PnprLogStartEvent PnprLogSuccessEvent PnprQuiesceProcessors PnprQuiesceWorker PoBroadcastSystemState PoClearTransitionMarker PoDiagTraceDeviceRundown PoDiagTraceIRTimerSleepStudyRundown PoEnergyContextStart PoEnergyContextUpdateComponentPower PoExecuteIdleCheck PoFxEnableDStateReporting PoFxRegisterDebugger PoFxSetComponentLatency PoFxSetComponentResidency PoFxSetTargetDripsDevicePowerState PoGetIdleTimes PoGetLightestSystemStateForEject PoGetPerfStateAndParkingInfo PoIdle PoInitSystem PoInitiateProcessorWake PoLatencySensitivityHint PoPowerOffMonitor PoRegisterPowerSettingCallback PoRundownSystemTimer PoSetUserPresent PoThermalCounterSetCallback PoTraceDynamicTickDisabled PoTraceForceIdleReset PoTraceForceIdleStateChange PoTraceSystemTimerResolution PoTraceSystemTimerResolutionIgnore PoTraceSystemTimerResolutionKernel PoTraceSystemTimerResolutionUpdate PopAccountBatteryEnergyChange PopAccountCbEnergyChange PopAcquireAdaptiveLock PopAdaptiveGetSessionStateUnsafe PopAdaptivePersistSystemInitatedRebootState PopAdaptivePowerSettingCallback PopAdaptiveWnfCallback PopApplyAdminPolicy PopApplyPolicy PopAssessSystemIdleEvent PopBatteryApplyCompositeState PopBatteryCheckCompositeCapacity PopBatteryInitialize PopBatteryQueryEstimatedTime PopBatteryTracePercentageRemaining PopBatteryTraceSystemBatteryStatus PopBatteryUpdateAlarms PopBatteryWorker PopBcdEstablishResumeObject PopBcdRegenerateResumeObject PopBcdSetPendingResume PopBlockSessionSwitch PopBootBatteryStatusWorker PopCalculateHiberFileSize PopCallPowerSettingCallback PopCaptureSleepStudyStatistics PopCheckShutdownMarker PopClearHiberFileSignature PopCompressHiberBlocks PopConfigureHeteroPolicies PopCreateHiberFile PopCreateNotificationName PopDecompressHiberBlocks PopDiagTraceAbnormalReset PopDiagTraceAcDcStateChange PopDiagTraceActiveCooling PopDiagTraceAdaptiveBootOverride PopDiagTraceAdaptiveBootOverridePrepared PopDiagTraceAdaptiveOverrideClear PopDiagTraceAdaptiveOverrideTriggered PopDiagTraceAppPowerMessage PopDiagTraceAppPowerMessageEnd PopDiagTraceBatteryAlarmStatus PopDiagTraceBatteryCountChange PopDiagTraceBatteryTriggerFlags PopDiagTraceBatteryTriggerMet PopDiagTraceBsdWriteTime PopDiagTraceClearDeepSleepConstraint PopDiagTraceConsoleDisplayState PopDiagTraceControlCallback PopDiagTraceCoolingExtension PopDiagTraceCoolingExtensionActiveUpdate PopDiagTraceCoolingExtensionPassiveUpdate PopDiagTraceCsConsumption PopDiagTraceCsDeepSleepWatchdog PopDiagTraceCsDripsDivergence PopDiagTraceCsDripsWatchdog PopDiagTraceCsDripsWatchdogPerfTrack PopDiagTraceCsEnterReason PopDiagTraceCsExitReason PopDiagTraceCsFanPerfTrack PopDiagTraceCsResiliencyStats PopDiagTraceDIrpAfterSx PopDiagTraceDebuggerTransitionRequirements PopDiagTraceDeepSleepConstraintRundown PopDiagTraceDeviceAcquireIrp PopDiagTraceDeviceComplianceRundown PopDiagTraceDeviceComplianceUpdate PopDiagTraceDeviceIdleCheck PopDiagTraceDeviceReleaseIrp PopDiagTraceDeviceVerboseRundown PopDiagTraceDevicesLevel PopDiagTraceDevicesSuspend PopDiagTraceDirectedDripsInitialization PopDiagTraceDirectedDripsNotifyAppsAndServices PopDiagTraceDirtyTransition PopDiagTraceDiskIdleCheck PopDiagTraceDisplayBurstWin32kCallout PopDiagTraceDozeDeferralDecision PopDiagTraceDripsHistogram PopDiagTraceDriverVeto PopDiagTraceDynamicTickStatusRundown PopDiagTraceEsState PopDiagTraceExecutePowerAction PopDiagTraceFirmwareS3Stats PopDiagTraceFxComponentAccounting PopDiagTraceFxComponentIdleConstraints PopDiagTraceFxComponentIdleState PopDiagTraceFxComponentLogicalCondition PopDiagTraceFxComponentRegistration PopDiagTraceFxComponentWake PopDiagTraceFxDefaultPepWorkerEnd PopDiagTraceFxDeviceAccounting PopDiagTraceFxDeviceDirectedCompletion PopDiagTraceFxDeviceDirectedTransition PopDiagTraceFxDeviceIdleConstraints PopDiagTraceFxDevicePowerRequirement PopDiagTraceFxDevicePowerState PopDiagTraceFxDevicePowered PopDiagTraceFxDevicePreparation PopDiagTraceFxDeviceRegistration PopDiagTraceFxDeviceStartPowerManagement PopDiagTraceFxDeviceUnregistration PopDiagTraceFxGlobalDeviceAccounting PopDiagTraceFxPerfNominalChange PopDiagTraceFxPerfRegistration PopDiagTraceFxPerfRequest PopDiagTraceFxPerfRequestComplete PopDiagTraceFxPerfRequestProgress PopDiagTraceFxPerfSetRegistration PopDiagTraceFxPluginRegistration PopDiagTraceHiberStats PopDiagTraceHibernateErrorStatus PopDiagTraceIdleCheck PopDiagTraceIdleResiliencyEnd PopDiagTraceIdleResiliencyStart PopDiagTraceIllegalProcessorThrottle PopDiagTraceInvalidBootStat PopDiagTraceIoCoalescingDiskIdle PopDiagTraceIoCoalescingOn PopDiagTraceIrpFinish PopDiagTraceIrpFinishTelemetry PopDiagTraceIrpPended PopDiagTraceIrpStart PopDiagTraceKernelQueriesAllowed PopDiagTraceMonitorOnWithLidClosed PopDiagTraceMtrrError PopDiagTracePassiveCooling PopDiagTracePerfTrackData PopDiagTracePlatformRoleRundown PopDiagTracePolicyChange PopDiagTracePolicyInitiatePowerActionApiCall PopDiagTracePostSleepNotification PopDiagTracePowerButtonBugcheck PopDiagTracePowerRequestChange PopDiagTracePowerRequestCreate PopDiagTracePowerSetting PopDiagTracePowerSettingRegistration PopDiagTracePowerStateEvent PopDiagTracePowerStateEventRundown PopDiagTracePowerTransitionEnd PopDiagTracePowerTransitionStart PopDiagTracePowerTransitionTime PopDiagTracePreSleepNotification PopDiagTraceProcessorThrottleDurationPerfTrack PopDiagTraceProcessorThrottlePerfTrack PopDiagTraceRegisterSystemState PopDiagTraceRtcWakeInfo PopDiagTraceServiceNotification PopDiagTraceSessionDisplayStateChange PopDiagTraceSessionState PopDiagTraceSessionStateCounted PopDiagTraceSessionStates PopDiagTraceSetDeepSleepConstraint PopDiagTraceSetSystemState PopDiagTraceSetThreadExecutionState PopDiagTraceShutdownAction PopDiagTraceSkipTick PopDiagTraceSleepReliabilityDiagConfigUpdate PopDiagTraceSleepStudyStart PopDiagTraceSleepStudyStop PopDiagTraceStateTransitionFailurePoint PopDiagTraceSystemIdleContextUpdate PopDiagTraceSystemIdleRundown PopDiagTraceSystemLatencyUpdate PopDiagTraceThermalCoolingMode PopDiagTraceThermalRequest PopDiagTraceThermalRequestActiveUpdate PopDiagTraceThermalRequestPassiveUpdate PopDiagTraceThermalStateChange PopDiagTraceThermalZoneEnumeration PopDiagTraceThermalZoneRundown PopDiagTraceThermalZoneThrottleDurationPerfTrack PopDiagTraceThermalZoneThrottlePerfTrack PopDiagTraceTripPointExceeded PopDiagTraceUmpoAlpcProcessingError PopDiagTraceUsermodeThermalEvent PopDirectedDripsDiagNotifySessionStop PopDirectedDripsDiagRundownBroadcastTrees PopDirectedDripsDiagRundownDevices PopDirectedDripsDiagTraceBroadcastVisit PopDirectedDripsDiagTraceDfxPowerStateFailure PopDirectedDripsDiagTraceMarkDevice PopDirectedDripsDiagTraceNotifyDevices PopDirectedDripsDiagTraceProblemDevice PopDirectedDripsQueryRegistryValues PopDirectedDripsSendSuspendResumeNotification PopDispatchNotificationsToList PopDispatchStateCallout PopDripsWatchdogCheckHwDivergence PopDripsWatchdogDiagnosticWorker PopEnableHiberFile PopEsUpdateSetting PopEstimateChargeTime PopEtAppIdIntern PopEtEnergyContextProcessStateUpdate PopEtEnergyTrackerUpdateAggregate PopEtGetProcessAppId PopEtInit PopEtIsrDpcQuery PopEtProcessEnumSnapshotCallback PopEvaluateInputSuppressionAction PopEvaluateWeakChargerState PopEventCalloutDispatch PopExecutePowerAction PopExecuteSystemIdleAction PopFanReadFanNoiseInfo PopFanSetupRpmBuckets PopFanUpdateSpeed PopFanUpdateStatistics PopFanWorker PopFlushAndHold PopFlushVolumeWorker PopFxBuildDripsBlockingDeviceList PopFxInitializeSocSubsystemStaticInfo PopFxIsDevicePotentialDripsConstraint PopFxLogSocSubsystemBlockingTimes PopFxPlatformIdleVeto PopFxProcessorIdleVeto PopFxStopDeviceAccounting PopFxTraceDeviceRegistration PopFxUpdatePlatformIdleState PopFxUpdateProcessorIdleState PopGetBitlockerKeyLocation PopGetHwConfigurationSignature PopGetSettingNotificationName PopHiberCheckResume PopIdleWakeGenerateInterruptDescriptionString PopIdleWakeNotifyModernStandbyExitWorker PopIdleWakeSendDripsWakeSourceTelemetry PopIdleWakeTraceWakeSourceDiagnostic PopInitPlatformSettings PopInitSIdle PopInitializeHeteroProcessors PopInitializePowerButtonHold PopInitializePowerPolicySimulate PopInvokeStateHandlerTargetProcessor PopInvokeSystemStateHandler PopIsMktmeEnabled PopIsRemoteDesktopEnabled PopIsSystemIdle PopIssueActionRequest PopLidReliabilityInit PopLidSwitchChangeCallback PopLidSwitchReliabilityUpdateCallback PopLogNotifyDevice PopMarshalSettingValues PopMonitorProcessLoop PopNetWnfLowPowerEpochCallback PopOpenPersistedRegistryKey PopOpenThermalLoggingKey PopPdcCsCheckSystemVolumeDevice PopPepInitializeDebuggerMasks PopPepInitializeVetoMasks PopPepUpdateIdleStateRefCount PopPepWork PopPlNotifyDeviceDState PopPlNotifyDeviceFState PopPlPublishInitialPowerDraw PopPlPublishSystemPowerChange PopPlRegisterComponent PopPlRegisterDevice PopPlRegisterDeviceIterator PopPlRegisterPowerPlane PopPlTraceLogPowerPlane PopPlUnregisterComponent PopPlUnregisterDevice PopPolicyDeviceHandleWakeAlarmNotification PopPolicyWorkerAction PopPotsLogDirtyPowerTransition PopPotsLogPowerTransitionReliability PopPowerAggregatorDiagTraceHandleIntent PopPowerAggregatorDiagTracePdcSleepTransition PopPowerAggregatorInvokeStateMachine PopPowerAggregatorNotifySuspendResume PopPowerAggregatorSetCurrentState PopPowerButtonSettingCallback PopPowerButtonWorkCallback PopPowerInformationInternal PopPowerRequestDelete PopPowerRequestStatsInitialize PopPowerSourceChangeCallback PopQueryHiberPersistedRegValue PopQueryPowerButtonConfiguration PopReadHiberbootGroupPolicy PopReadHiberbootPolicy PopReadLegacySimulateProcessorClass PopReadShutdownPolicy PopReadSimulateProcessorClass PopReadSimulateProcessorClasses PopReadSystemAwayModePolicy PopRecordPoIrpBlackboxInformation PopReleaseAdaptiveLock PopResetCurrentPolicies PopSaveHiberContext PopSendSuspendResumeApplicationNotification PopSendSuspendResumeServiceNotification PopSetAwayModeStatus PopSetDevicesSystemState PopSetMemoryOverwriteRequestAction PopSleepstudyCaptureResiliencyStatistics PopSleepstudySendSessionChangeEvent PopSleepstudySendSessionChangeWnf PopSleepstudySendWnfNotification PopSleepstudyStartNextSession PopSpoilBatteryEstimate PopSqmAddToStream PopSqmFanEnumeration PopSqmThermalCriticalEvent PopSqmThermalUsermodeEvent PopSqmThermalZoneEnumeration PopSystemIrpCompletion PopThermalHandlePreviousShutdown PopThermalWorker PopTraceBootError PopTraceCr3Mitigated PopTraceCr3Tripped PopTraceEsBgActivityPolicyUpdate PopTraceEsSetting PopTraceEsState PopTraceHibernatePolicyUpdate PopTraceInputSuppressionActionUpdate PopTraceMonitorOnRequestUserInput PopTraceNetRefreshTimerArmed PopTracePowerReconfig PopTraceSleepCheckpointInitFailure PopTraceSmbiosChange PopTraceStandbyConnectivityRundown PopTraceStandbyConnectivityUpdate PopTraceSystemIdleS0LowPowerDoze PopTraceSystemIdleS0LowPowerDozeTimerArmed PopTraceSystemIdleS0LowPowerDozeTimerCancelled PopTraceThermalRequestActiveActivity PopTraceThermalRequestPassiveHistogram PopTraceThermalStandbyComplete PopTraceThermalStandbyInitiated PopTraceThermalZoneActiveActivity PopTraceThermalZonePassiveHistogram PopTraceZoneCr3Mitigated PopTraceZoneCr3Tripped PopTransitionTelemetryOsState PopTriggerDiagTraceAoAcCapability PopUmpoInitializeChannel PopUmpoInitializeMonitorChannel PopUmpoProcessMessage PopUmpoProcessMessages PopUmpoSendPowerMessage PopUpdateBackgroundCoolingStatus PopUpdateExternalDisplayState PopUpdateUpgradeInProgress PopUsbErrorWNFNotificationCallback PopValidateHiberFileSize PopWatchdogWorker PopWin32kPowerSettingCallback PopWnfAirplaneModeCallback PopWnfAudioCallback PopWnfFullscreenVideoCallback PopWnfMixedRealityCallback PopWnfMobileHotspotCallback PopWnfSprActiveSessionChangeCallback PopWriteBsdPoInfo PopWriteHiberImage PopWriteHiberPages PopZeroHiberFile PpDevCfgInit PpDevCfgProcessDeviceClass PpDevCfgProcessDeviceExtensions PpDevCfgProcessDeviceReset PpForEachDeviceInstanceDriver PpProcessClearProblem PpResetProblemDevices PpmCapturePerformanceDistribution PpmCheckComputeEnergy PpmCheckComputeHeteroResponse PpmCheckComputeMultiClassHeteroResponse PpmCheckContinueExecution PpmCheckInitProcessors PpmCheckInitProcessorsLegacy PpmCheckRun PpmCheckSnapAllDeliveredPerformance PpmCheckStart PpmClearSimulatedIdle PpmEstimateIdleDuration PpmEventAutonomousModeChange PpmEventBiosCapChange PpmEventCoordinatedIdleTransition PpmEventCoreParkingSoftParkedStateChange PpmEventCoreParkingStateChange PpmEventCoreParkingStateChangeEx PpmEventDomainPerfStateChange PpmEventEnergyEstimationRundown PpmEventEnterPlatformIdleState PpmEventHeteroFavoredCoreRotationChange PpmEventHeteroPolicy PpmEventHgsActiveWorkloadClass PpmEventHgsCoresUnparkedCount PpmEventHgsHardwareTable PpmEventHgsNormalizedTable PpmEventHiddenProcessorBiosCapChange PpmEventHiddenProcessorPerformance PpmEventHiddenProcessorThermalCapChange PpmEventIdleDurationExpiration PpmEventIdleStateChange PpmEventLPICoreParking PpmEventLegacyProcessorPerfStateChange PpmEventParkNodeCapChange PpmEventParkNodeClassRecordedStats PpmEventParkNodeParkHintChanged PpmEventParkNodePreference PpmEventParkingCountSelection PpmEventPerfSelectProcessorState PpmEventPlatformVetoRequest PpmEventPlatformVetoRundown PpmEventProcessorPerfStateChange PpmEventProcessorVetoRequest PpmEventProcessorVetoRundown PpmEventQosClassPolicy PpmEventQosSupport PpmEventSoftParkRankListChanged PpmEventStaticPolicyRundown PpmEventThermalCapChange PpmEventTraceAccountingBucketIntervalsRundown PpmEventTraceDeliveredPerfChange PpmEventTraceDripsAccountingSnapshot PpmEventTraceExpectedUtility PpmEventTraceFailedPerfCheckStart PpmEventTraceHeteroDistributeUtility PpmEventTraceHeteroResponse PpmEventTraceHeteroSets PpmEventTraceLPIState PpmEventTraceMultiClassHeteroResponse PpmEventTraceMultiClassHeteroResponseUpdate PpmEventTraceParkNodeRundown PpmEventTracePlatformIdleAccounting PpmEventTracePpmProfileStatusRundown PpmEventTracePreVetoAccounting PpmEventTraceProcessorIdleAccounting PpmEventTraceProcessorPerformance PpmEventTraceProcessorPerformanceDomainRundown PpmEventTraceProcessorPerformanceRundownHv PpmEventTraceProfileChange PpmEventTraceProfileEnable PpmEventTraceProfileSetting PpmEventTraceProfiles PpmEventTraceRecordedUtility PpmEventTraceSoftCoreParkingSelection PpmEventVetoReasonRundown PpmEventVpQosChange PpmHeteroComputeMultiClassUnparkCount PpmHeteroHgsProcessorInit PpmHeteroInitializeHgsSupport PpmHeteroUpdateHgsConfiguration PpmHvSnapPerformanceAccumulation PpmIdleCaptureCsVetoAccounting PpmIdleExecuteTransition PpmIdleInitializeConcurrency PpmIdleInstallNewVetoList PpmIdleSelectStates PpmInfoRegisterCallbacks PpmInfoTraceProfileSettings PpmInitIllegalThrottleLogging PpmInstallFeedbackCounters PpmInstallNewIdleStates PpmMediaBufferingWorker PpmParkComputeUnparkMask PpmParkRecordNodeStatistics PpmParkRegisterParking PpmParkReportParkedCores PpmParkSteerInterrupts PpmParkUpdateConcurrencyTracking PpmPerfApplyDomainState PpmPerfApplyProcessorStates PpmPerfArbitratorApplyProcessorState PpmPerfCalculateQosClassPolicies PpmPerfProcCapFloorSettingCallback PpmPerfRecordMostActiveWorkloadClass PpmPerfTelemetryWorker PpmPostProcessMediaBuffering PpmProcessSettingsFromQueryTable PpmRegisterPerfStates PpmRegisterSpmSettings PpmRemoveIdleStates PpmSetProfilePolicySetting PpmSetSimulatedIdle PpmSnapDripsAccountingSnapshot PpmSnapPerformanceAccumulation PpmTraceExitLatency PpmTracePerfIdleRundown PpmUnlockProcessors PpmUpdateIdleStates PpmUpdatePlatformIdleVeto PpmUpdateProcessorIdleVeto PpmUpdateProcessorPolicy PrpWriteTraceLoggingEvent PsBootPhaseComplete PsCreateMinimalProcess PsCreateSystemThreadEx PsDispatchIumService PsInitializeSyscallProviders PsMapSystemDlls PsOpenProcess PsOpenThread PsPicoWalkUserStack PsQueryProcessCommandLine PsQueryProcessExceptionFlags PsRegisterSyscallProvider PsRundownVsmEnclave PsSetLoadImageNotifyRoutineEx PsShutdownSystem PsStartSiloMonitor PsTerminateVsmEnclave PsUnregisterSiloMonitor PspAllocateAndQueryNotificationChannel PspAllocateAndQueryProcessNotificationChannel PspAllocatePartition PspAllocateProcess PspAllocateThread PspApplyMitigationOptions PspApplyWorkingSetLimits PspApplyWorkingSetLimitsToProcess PspAssignProcessQuotaBlock PspAssignProcessToJob PspBuildCreateProcessContext PspCatchCriticalBreak PspChangeProcessExecutionState PspCombineSecurityDomains PspCopyNodeRelativeMaskToAffinityEx PspCreatePicoThread PspCreateProcess PspCreateSecureThread PspCreateThread PspDeleteUserStack PspDestroySyscallProvider PspEnforceLimits PspEnforceLimitsJobPostCallback PspFoldProcessAccountingIntoJob PspFreeUserFiberShadowStack PspFreezeJobTree PspGetContextThreadInternal PspGetSetContextInternal PspHardenMitigationOptions PspIdentityBasedJobBreakaway PspInheritMitigationAuditOptions PspInheritMitigationOptions PspInitPhase0 PspInitPhase3 PspInitializeFullProcessImageName PspInitializeThunkContext PspIsDfssEnabled PspIsProcessReadyForRemoteThread PspIumAllocateSecurePool PspIumGetPhysicalPage PspIumWorker PspJobDelete PspLogAuditTerminateRemoteProcessEvent PspMapSystemDll PspOneDirectionSecurityDomainCombine PspProcessDelete PspProcessDynamicEHContinuationTargets PspProcessDynamicEnforcedAddressRanges PspQueryJobHierarchyAccountingInformation PspQueryProcessAccountingInformationCallback PspQueryQuotaLimits PspQueryRateControlHistory PspReadIFEOMitigationAuditOptions PspReadIFEOMitigationOptions PspReadIFEONodeOptions PspReadIFEOPerfOptions PspReadUserQuotaLimits PspReferenceCpuPartitionByHandle PspRundownSingleProcess PspSecureThreadStartup PspSetContextThreadInternal PspSetEffectiveJobLimits PspSetJobIoAttribution PspSetJobIoRateControl PspSetNetRateControl PspSetProcessAffinitySafe PspSetQuotaLimits PspSetupUserProcessAddressSpace PspSetupUserShadowStack PspSetupUserStack PspShutdownCsrProcess PspSyscallProviderServiceDispatchGeneric PspTrySetProcessPebThrottlingFlags PspValidateMitigationAuditOptions PspValidateMitigationOptions PspWow64GetContextThread PspWow64InitThread PspWow64ReadOrWriteThreadCpuArea PspWow64SetContextThread PspWow64SetupUserStack PspWritePebAffinityInfo PspWriteTebIdealProcessor PspWriteTebImpersonationInfo RaiseException RamdiskStart RawMountVolume RawQueryFileSystemInformation RawQueryFsSizeInfo ReadStringDelimited ReadStringDelimited RegistryOverwriteCentralProcessor RtlAddAccessFilterAce RtlAddMandatoryAce RtlAddResourceAttributeAce RtlApplyImportRelocationToImage RtlApplyImportRelocationToPage RtlApplyIndirectRelocationToPage RtlApplySwitchJumpRelocationToPage RtlAssert RtlCapabilityCheck RtlCheckTokenCapability RtlCheckTokenMembershipEx RtlContinueLongJump RtlConvertSidToUnicodeString RtlCreateHeap RtlCultureNameToLCID RtlDeriveCapabilitySidsFromName RtlDisableXfgOnTarget RtlDispatchException RtlEqualPrefixSid RtlEthernetStringToAddressA RtlEthernetStringToAddressW RtlFileMapMapView RtlFindMessage RtlFormatCurrentUserKeyPath RtlFormatMessageEx RtlGUIDFromString RtlGenerate8dot3Name RtlGenerateClass5Guid RtlGetCpuVendor RtlGetProcessorSignature RtlGetProductInfo RtlGetSetBootStatusData RtlImpersonateSelfEx RtlIncrementCorrelationVector RtlInitFunctionOverrideCapabilities RtlInitializeBootStatusDataBlackBox RtlInt64ToUnicodeString RtlIntegerToChar RtlIntegerToUnicode RtlIntegerToUnicodeString RtlIpv4AddressToStringExA RtlIpv4AddressToStringExW RtlIpv4StringToAddressA RtlIpv4StringToAddressW RtlIpv6AddressToStringExA RtlIpv6AddressToStringExW RtlIsNameLegalDOS8Dot3 RtlIsUntrustedObject RtlIsValidProcessTrustLabelSid RtlLargeIntegerToChar RtlLargeIntegerToUnicode RtlLoadString RtlLocalTimeToSystemTime RtlOsDeploymentState RtlPerformRetpolineRelocationsOnImageEx RtlQueryAtomInAtomTable RtlQueryImageFileKeyOption RtlQueryImageXfgFilter RtlQueryModuleInformation RtlQueryPackageClaims RtlQueryValidationRunlevel RtlRaiseCustomSystemEventTrigger RtlRestoreBootStatusDefaults RtlSidDominates RtlSystemTimeToLocalTime RtlUnicodeStringToInt64 RtlUnwind RtlUnwindEx RtlUpdateImportRelocationsInImage RtlUpdateSwapReference RtlVerifyVersionInfo RtlpAllocateHeapRaiseException RtlpAllowsLowBoxAccess RtlpCapabilityCheckSystemCapability RtlpCheckDynamicTimeZoneInformation RtlpCopyAces RtlpCopyEffectiveAce RtlpCreateUserProcess RtlpCreateUserThreadEx RtlpDynamicLookasideRebalance RtlpEtcIsValidFeatureId RtlpFcApplyUpdateAndAddFeature RtlpFcCalculateRequiredSizeForNewFeatureTable RtlpFcNotifyFeatureUsageTarget RtlpFcSectionTypeToBufferType RtlpFindRegTziForCurrentYear RtlpFlsFree RtlpGetDynamicTimeZoneInfoHandle RtlpGetNtProductTypeFromRegistry RtlpGetTimeZoneInfoHandle RtlpGetTokenNamedObjectPath RtlpHpAllocVA RtlpHpCustomVaCallbacksRegistrarRegister RtlpHpLfhBucketSubsegmentStatsUpdate RtlpHpLfhBucketUpdateAffinityMapping RtlpHpScheduleCompaction RtlpHpVaMgrAlloc RtlpInitNlsFileName RtlpInitializeNonVolatileFlush RtlpIsAppContainer RtlpIsNameInExpressionPrivate RtlpLogCapabilityCheckLatency RtlpMuiRegAddLanguageByName RtlpNewSecurityObject RtlpNormalizeAcl RtlpPopulateLanguageConfigList RtlpProcessIFEOKeyFilter RtlpQueryNlsSystemCodePages RtlpQueryTimeZoneInformationWorker RtlpReadExtendedContext RtlpSetSecurityObject RtlpSysVolCheckOwnerAndSecurity RtlpSysVolCreateSecurityDescriptor RtlpSysVolTakeOwnership RtlpUpdateDynamicTimeZones RtlpValidTrustSubjectContext RtlpVerCompare RtlpWalkFrameChain SC_DEVICE::GetStorageProperty SC_DEVICE::Initialize SC_DISK::GenerateId SC_DISK::Initialize SC_GPT::CreatePartitionTable SC_MBR::CreatePartitionTable SC_MBR::WritePartitionTable SLQueryLicenseValueInternal SMKM_STORE<SM_TRAITS>::SmStCleanup SMKM_STORE<SM_TRAITS>::SmStStart SMKM_STORE<SM_TRAITS>::SmStSwapStore SMKM_STORE<struct_SM_TRAITS>::SmStDirectRead SMKM_STORE<struct_SM_TRAITS>::SmStPrioritizeRegionsStore SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStore SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeCheckPresent SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogWorker SPCallServerHandleClepKdf SPCallServerHandleClepSign SPCallServerHandleIsAppLicensed ST_STORE<SM_TRAITS>::StDmStart ST_STORE<struct_SM_TRAITS>::StCompactRegions ST_STORE<struct_SM_TRAITS>::StCompactionPerformInMem ST_STORE<struct_SM_TRAITS>::StCompactionPickPriority ST_STORE<struct_SM_TRAITS>::StDmEtaPerformIo ST_STORE<struct_SM_TRAITS>::StDmPageRetrieve ST_STORE<struct_SM_TRAITS>::StDmRegionEvict ST_STORE<struct_SM_TRAITS>::StDmSinglePageCopy ST_STORE<struct_SM_TRAITS>::StDmSinglePageRetrieveSync ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd SaveNodeDistanceInformation SbpStartLanman ScExtractDeviceStrings SdbGetDatabaseMatch SdbGetEntryFlags SdbGetMergeRedirectPath SdbGetPathCustomSdb SdbMakeIndexKeyFromStringEx SdbReadEntryInformation SdbTagRefToTagID SdbpCheckMatchingRegistryEntry SdbpCheckMatchingWildcardFiles SdbpCreateSearchDBContext SdbpFindFirstIndexedWildCardTag SdbpFindNextIndexedWildCardTag SdbpGetExeEntryFlags SdbpGetFileTimestamp SdbpGetPathAppPatch SdbpGetPathAppPatchPreRS3 SdbpGetPathAppraiser SdbpGetPathCustomSdb SdbpGetPathCustomSdbPreRS3 SdbpMatchOsVersion SdbpOpenLocalDatabaseEx SddlAddAccessFilterAce SddlAddMandatoryAce SddlAddProcessTrustLabelAce SddlAddScopedPolicyIDAce SddlpUuidFromString SeAccessCheckByType SeAccessCheckFromState SeAccessCheckWithHint SeAdtRegistryValueChangedAuditAlarm SeAuditBootConfiguration SeAuditFipsCryptoSelftests SeAuditHandleDuplication SeAuditHardLinkCreationWithTransaction SeAuditPlugAndPlay SeAuditProcessCreation SeAuditProcessExit SeAuditSystemTimeChange SeAuditTransactionStateChange SeCaptureObjectTypeList SeCheckAuditPrivilege SeCheckForCriticalAceRemoval SeCheckPrivilegedObject SeEtwWriteKMCveEvent SeGetTokenDeviceMap SeLogAccessFailure SeMakeAnonymousLogonToken SeMakeAnonymousLogonTokenNoEveryone SeMakeSystemToken SeOperationAuditAlarm SePrivilegePolicyCheck SeQuerySecurityAttributesTokenAccessInformation SeReportSecurityEventWithSubCategory SeSinglePrivilegeCheck SeSinglePrivilegeCheckEx SeSubProcessToken SecureDump_ConvertBinaryToHexString SecureDump_ConvertToRsaBlob SecureDump_Encrypt_DmpData SecureDump_LoadCertAndProvisionKey SendCaptureStateNotificationsWorker SepAccessCheck SepAccessCheckAndAuditAlarm SepAccessCheckEx SepAdjustPrivileges SepAdtCloseObjectAuditAlarm SepAdtDeleteObjectAuditAlarm SepAdtGenerateDiscardAudit SepAdtInitializeBounds SepAdtLogAuditFailureEvent SepAdtLogAuditRecord SepAdtObjectReferenceAuditAlarm SepAdtOpenObjectAuditAlarm SepAdtOpenObjectForDeleteAuditAlarm SepAdtPrivilegeObjectAuditAlarm SepAdtPrivilegedServiceAuditAlarm SepAdtSecurityDescriptorChangedAuditAlarm SepAdtStagingEvent SepAdtTokenRightAdjusted SepAppendAceToTokenDefaultDacl SepAppendAceToTokenObjectAcl SepAuditAssignPrimaryToken SepCanTokenMatchAllPackageSid SepCleanupLUIDDeviceMapDirectory SepCommonAccessCheckEx SepCopyAnonymousTokenAndSetSilo SepCreateTokenEx SepDesktopAppxSubProcessToken SepGetProcUniqueLuidAndIndexFromAttributeInfo SepGetStackTraceHash SepInitializationPhase1 SepInitializeDebugOptions SepLoadNgenLocations SepLogTokenSidManagement SepLogUnmatchedSessionFlagImpersonationAttempt SepMandatoryIntegrityCheck SepMandatorySubProcessToken SepParseElamCertResources SepReadAndInsertCaps SepReadAndPopulateCapes SepRegQueryValue SepRmCallLsa SepRmCommandServerThread SepRmDispatchDataToLsa SepRmLsaConnectRequest SepRmVerifyLsaProtectionLevel SepSecureBootCheckForUpdates SepSetProcessTrustLabelAceForToken SepValidateReferencedCachedHandles SepVerifyDesktopAppPolicyOverrideCaller SepVerifyDesktopAppxImage SepVerifyDesktopAppxPackageName SetFailureLocation SiFindSystemPartition SiGetDeviceNumberInformation SiGetEfiSystemDevice SiGetSystemDeviceName SiIsWinPeHardDiskZeroUfdBoot SiQueryProperty SiValidateSystemPartition SmEtwEnabled SmEtwLogRegionOp SmEtwLogStoreCorruption SmEtwLogStoreOp SmEtwLogStoreStateChange SmFirstTimeInit SmFpPreAllocate SmKmEtwAppendObjectName SmKmEtwLogStoreChange SmKmEtwLogStoreStats SmKmFileInfoGetPath SmKmKeyGenLoadKey SmKmRegParamsLoad SmKmSqmAddToStream SmKmStoreFileCreate SmKmStoreFileGetExtents SmKmStoreFileOpenVolume SmKmStoreFileWriteHeader SmKmStoreTerminateWorker SmProcessCompressionInfoRequest SmProcessCreateRequest SmProcessQueryStoreStats SmProcessStoreMemoryPriorityRequest SmQueryStoreCommitUsage SmQuerySystemInformation SmStoreCreate SmStorePhysicalRequestIssue SmcProcessCreateRequest SmcProcessListRequest SmcProcessStatsRequest SmpDirtyStoreCreate SshSessionManagerTraceCsEnterReason SshSessionManagerTraceCsExitReason SshSessionManagerTraceDirtyTransition SshSessionManagerTracePostSleepNotification SshSessionManagerTracePreSleepNotification SshSessionManagerTraceShutdownAction SshSessionManagerTraceSystemStop SshpAlpcInitialize SshpAlpcProcessAlpcMessage SshpAlpcSendMessage SshpFlushBlockerDataCache SshpGenerateDeviceFriendlyName SshpSendSessionData SshpSessionManagerFlushControlEventBuffer SshpWnfCallback SshpWriteBlocker StEtaHelper::StartHelper SymCryptDetectCpuFeaturesByCpuid SymCryptEcpointMultiScalarMulWnafWithInterleaving SymCryptEcpointScalarMulFixedWindow SymCryptInitEnvWindowsKernelmodeWin8_1nLater SymCryptParallelSha256Append SymCryptParallelSha256Process SymCryptRsaCoreEnc SymCryptRsakeyCalculatePrivateFields SymCryptSha256 SymCryptSha384Result SymCryptSha512AppendBlocks_ull SymCryptShortWeierstrassAddDiffNonZero SymCryptShortWeierstrassAddSideChannelUnsafe SymCryptShortWeierstrassDouble SymCryptShortWeierstrassIsEqual SymCryptTwistedEdwardsAdd SymCryptTwistedEdwardsDouble SymCryptTwistedEdwardsOnCurve TraceLoggingRegisterEx_EtwRegister_EtwSetInformation TtmiLogCalloutStart TtmiLogCalloutStop TtmiLogCalloutWatchdogCrashSkipped TtmiLogCleanupCurrentSessionStart TtmiLogCleanupCurrentSessionStop TtmiLogConsoleUserPresent TtmiLogDeviceArrivalNotified TtmiLogDeviceArrivedTerminalEvent TtmiLogDeviceAssignedTerminalEvent TtmiLogDeviceDepartedTerminalEvent TtmiLogDeviceDepartureNotified TtmiLogDeviceEnumeratedTerminalEvent TtmiLogDeviceFromTerminalRemoved TtmiLogDeviceInputNotified TtmiLogDeviceRundown TtmiLogDeviceSetInputWakeCapability TtmiLogDeviceToTerminalAssigned TtmiLogDispatchApiStart TtmiLogDispatchApiStop TtmiLogDisplayPowerRequestSet TtmiLogEnterProximity TtmiLogError TtmiLogExitProximity TtmiLogInactivityTimerReset TtmiLogInactivityTimoutUpdate TtmiLogInitCurrentSessionStart TtmiLogInitCurrentSessionStop TtmiLogInitiateModernStandbyTransitionStart TtmiLogInitiateModernStandbyTransitionStop TtmiLogProximityBlockedRequest TtmiLogProximityPowerPress TtmiLogQueueCreated TtmiLogQueueDequeueEvent TtmiLogQueueDestroyed TtmiLogQueueEnqueueEvent TtmiLogQueueHandleClosed TtmiLogQueueHandleOpened TtmiLogSessionActivate TtmiLogSessionCsExitComplete TtmiLogSessionDeactivate TtmiLogSessionDeviceAssignmentPolicySet TtmiLogSessionDisplayRequiredDereference TtmiLogSessionDisplayRequiredPowerRequestUpdated TtmiLogSessionDisplayRequiredReference TtmiLogSessionMonitorControl TtmiLogSessionPowerControlStart TtmiLogSessionPowerControlStop TtmiLogSessionPowerRequestAcknowledged TtmiLogSessionPowerRequestCreated TtmiLogSessionPowerRequestDeleted TtmiLogSessionPowerStateChange TtmiLogSessionRundown TtmiLogSessionWorkerPass TtmiLogSessionWorkerStart TtmiLogSessionWorkerStop TtmiLogTerminalCleanup TtmiLogTerminalCreated TtmiLogTerminalDestroyed TtmiLogTerminalDisplayStateChangedEvent TtmiLogTerminalDisplayTimeouts TtmiLogTerminalHandleClosed TtmiLogTerminalHandleOpened TtmiLogTerminalOffRequest TtmiLogTerminalOnRequest TtmiLogTerminalRundown TtmiLogTerminalStateMachine TtmpCommitTerminalDisplayStateUpdateWorker TtmpGetConfigOverride TtmpSessionWorker UpcaseUnicodeToUTF8NHelper ValidFilter VerifierNtCreateFile VerifierNtReadFile VerifierNtWriteFile VfCheckImageCompliance VfCheckUserHandle VfDeadlockAcquireResource VfDeadlockInitializeResource VfDeadlockPluginEntry VfDeadlockReleaseResource VfDmaPluginEntry VfErrorReport7 VfErrorReport8 VfIoDeleteDevice VfIoDetachDevice VfIovPluginEntry VfIrpLogRecordEvent VfIrqlPluginEntry VfIsPCIBus VfLwSPEntry VfMiscPluginEntry VfPoolTrackingEntry VfSecurityEntry VfSpecialPoolEntry VfThunkApplyPristineToAllSession VfThunkApplyWdmThunkToAllSession VfUtilPrintCheckinString VhdAutoAttachVirtualDisks VhdiAutoAttachOneVhd VhdiGetVolumeNumber VhdiInitializeBootDisk VhdiMountVhdFile ViErrorReport1 ViErrorReport10 ViErrorReport4 ViErrorReport6 ViGenericVerifyIrpStackDownward ViGenericVerifyNewIrp ViIsBTSSupported ViPtLogStackCallout ViSetupBTSPerProcNoEnable VmAccessFault VmpAccessFaultBatchResolve VmpLogAccessFault VmpLogAccessFaultRange VmpLogColdHint VmpLogLargeSlatFill VmpLogSparseSlatFill VmpLogTbFlushSlatInvalidate VmpPinMemoryRange VmpPrefetchWorker VmpProcessAccessedBatch VmpProcessUpdateSlat VmpQueryAccessedState VrpIoctlDeviceDispatch VrpPostEnumerateKey VrpPostOpenOrCreate VrpPostQueryKey VrpPostUnloadKey VrpPreFlushKey VrpPreLoadKey VrpPreOpenOrCreate VrpPreQueryKeyName VrpRegistryCallback VrpRegistryUnload VslAbortLiveDump VslAccessPciDevice VslAllocateKernelShadowStack VslAllocateSecureHibernateResources VslApplyDynamicRelocations VslApplyHotPatch VslApplySecureImageFixups VslBindNtIum VslCallEnclave VslCaptureSecureImageIat VslCloseSecureHandle VslCollectLiveDumpInSk VslCompleteSecureDriverLoad VslConfigureDynamicMemory VslConfigureSecureAtsDevice VslConnectSwInterrupt VslCreateEnclave VslCreateSecureAllocation VslCreateSecureImageSection VslCreateSecureProcess VslCreateSecureSection VslCreateSecureThread VslDebugProtectSecureProcessMemory VslDebugReadWriteSecureProcess VslDeleteSecureSection VslDetermineHotPatchType VslDetermineHotPatchUndoTableSize VslEnableKernelCfgTarget VslEnableOnDemandDebugWithResponse VslEndSecurePageIteration VslExchangeEntropy VslFastFlushSecureRangeList VslFillSecureAllocation VslFinalizeLiveDumpInSk VslFinalizeSecureImageHash VslFinishSecureImageValidation VslFinishStartSecureProcessor VslFlushSecureAddressSpace VslFreeKernelShadowStack VslFreeSecureHibernateResources VslFreeSecureImageIat VslGetEtwDebugId VslGetNestedPageProtectionFlags VslGetOnDemandDebugChallenge VslGetSecurePageList VslGetSecurePciDeviceAlternateFunctionNumberForVtl0Dma VslGetSecurePciDeviceBootConfiguration VslGetSecurePciEnabled VslGetSecurePebAddress VslGetSecureSpeculationControlInformation VslGetSecureTebAddress VslGetSetSecureContext VslHandleKsrCall VslInitFunctionOverrideCapabilities VslInitializeEnclave VslInitializeSecureKernelCfg VslInitializeSecurePool VslInitializeSecureProcess VslIsEncryptionKeyAvailable VslIsTrustletRunning VslIumEfiRuntimeService VslIumEtwEnableCallback VslKernelShadowStackAssist VslLiveDumpQuerySecondaryDataSize VslLoadEnclaveData VslLoadEnclaveModule VslMakeCodeCatalog VslMakeProtectedPageExecutable VslMakeProtectedPageWritable VslNotifyShutdown VslObtainHotPatchUndoTable VslPrepareDriverForPatch VslPrepareSecureImageRelocations VslProvisionDumpEncryption VslPublishSyscallProviderServiceTables VslQuerySecureDevice VslQuerySecureKernelProfileInformation VslQueryVirtualMemory VslReapplyBootIndirectPatches VslReapplyImportOptimizationForDriverVerifier VslRegisterBootDrivers VslRegisterLogPages VslRegisterSecureSystemDlls VslRegisterSecureSystemProcess VslRegisterSyscallProviderServiceTableMetadata VslRelaxQuotas VslRelocateImage VslReportBugCheckProgress VslReserveProtectedPages VslResetKernelShadowStack VslRetrieveMailbox VslRevertHotPatch VslRundownSecureProcess VslSecurePoolAllocate VslSecurePoolFree VslSecurePoolUpdate VslSendDebugAttachNotifications VslSetCodeIntegrityPolicy VslSetPlaceholderPages VslSetupLiveDumpBufferInSk VslSlowFlushSecureRangeList VslStartSecurePageIteration VslStartSecureProcessor VslSvcEnterIumSecureMode VslTerminateSecureThread VslTransferSecureImageVersionResource VslTransformDumpKey VslUpdateFreezeTimeBias VslValidateDynamicCodePages VslValidateSecureImagePages VslVerifyPage VslVerifySessionSpace VslpAddLiveDumpBufferChunk VslpConnectedStandbyPoCallback VslpConnectedStandbyWnfCallback VslpEnterIumSecureMode VslpIumInitializeTelemetry VslpIumPhase0Initialize VslpIumPhase4Initialize VslpKsrEnterIumSecureMode VslpLiveDumpStart VslpSetupLiveDumpBuffer VslpVerifySessionSpace WarbirdCrypto::CCipherFeistel64::CallRoundFunction WbAddWarbirdEncryptionSegment WbGetInitializedEncryptionSegment WbHeapExecuteCall WdiDispatchControl WdipAccessCheck WdipSemLoadLocalGroupPolicy WdipSemLoadNextContextProvider WdipSemLoadNextEndEvent WdipSemLoadNextScenario WdipSemLoadScenarioTable WdipSemQueryValueFromRegistry WdipSemSqmAddToStream WdipSemSqmIncrementDword WdipSemSqmInit WdipSemSqmLogInflightLimitExceededDataPoints WdipSemWriteInflightLimitExceededEvent WdipSemWriteMisconfigEvent WdipSemWriteProviderLimitExceededEvent WdipSemWriteScenarioLimitExceededEvent WdipSemWriteSemActionsEvent WdipSemWriteSemFailureEvent WdipSemWriteTimeoutEvent WheaAddErrorSource WheaLogInternalEvent WheaPersistBadPageToRegistry WheaRemoveErrorSource WheaRemoveErrorSourceDeviceDriver WheaReportHwError WheaSelLogErrorPkt WheapAddToDefectListInPlugin WheapAttemptPhysicalPageOffline WheapClearPoison WheapCreateRecordFromGenericErrorData WheapExecuteRowFailureCheck WheapGenerateETWErrorRecord WheapGenerateETWErrorRecordLarge WheapInitErrorReportDeviceDriver WheapLogAddToDefectListFail WheapLogInitEvent WheapLogPageOfflineAttemptEvent WheapLogPolicyTelemetry WheapLogProcessTerminateEvent WheapPfaLogPageMonitorRemoval WheapProcessOfflineList WheapReverseAddressTranslateToPAInPlugin WheapTrackPendingPage WheapTranslateAddressInPlugin WheapWmiExecuteErrorSourceMethod WmipCreateGuidObject WmipDisableCollectionForRemovedGuid WmipEnableCollectionForNewGuid WmipGetGuidSecurityDescriptor WmipIncludeStaticNames WmipInitializeDataStructs WmipInsertStaticNames WmipIoControl WmipOpenGuidObject WmipPrepareWnodeSI WmipProcessLegacyEtwCallback WmipQueryAllData WmipQueryAllDataMultiple WmipQuerySetExecuteSI WmipQuerySingleMultiple WmipQueryWmiDataBlock WmipReceiveNotifications WmipSecurityMethod WmipSendEnableDisableRequest Xp10BuildAndWriteHuffmanTables Xp10Compute2Crc32 Xp10Compute2Crc64 _CmAddDeviceToContainer _CmAddPanelDevice _CmBuildDevicePanelId _CmClassFilterCallback _CmCreateDevice _CmCreateDeviceContainer _CmCreateDeviceInterface _CmCreateDeviceInterfaceWorker _CmCreateDevicePanel _CmCreateInstallerClass _CmCreateInterfaceClass _CmDeleteCommonClassRegKey _CmDeleteDevice _CmDeleteDeviceContainer _CmDeleteDeviceContainerRegKey _CmDeleteDeviceInterface _CmDeleteDeviceInterfaceRegKey _CmDeleteDeviceInterfaceWorker _CmDeleteDevicePanel _CmDeleteDevicePanelRegKey _CmDeleteDeviceRegKey _CmDeleteDeviceRegKeyWorker _CmDeleteDeviceWorker _CmDeleteInstallerClass _CmDeleteInstallerClassWorker _CmDeleteInterfaceClass _CmDeleteInterfaceClassWorker _CmDevicePanelEnumSubkeyCallback _CmEnumDevicesInContainerWithCallback _CmGetDeviceChildren _CmGetDeviceContainerIdFromBase _CmGetDeviceInterfaceClassGuid _CmGetDeviceInterfaceRegKeyPath _CmGetDeviceInterfaceSubkeyPath _CmGetDeviceMappedPropertyFromComposite _CmGetDeviceMappedPropertyFromRegProp _CmGetDeviceParent _CmGetDeviceRegProp _CmGetDeviceRegPropWorker _CmGetDeviceSiblings _CmGetDeviceSoftwareKey _CmGetDeviceSoftwareKeyPath _CmGetInstallerClassMappedPropertyFromRegValue _CmGetInstallerClassRegProp _CmGetMatchingCommonClassList _CmGetMatchingDeviceContainerList _CmGetMatchingDeviceInterfaceList _CmGetMatchingDeviceList _CmGetMatchingDevicePanelList _CmGetMatchingFilteredDeviceInterfaceList _CmGetMatchingFilteredDeviceList _CmGetRegKeySecurityDescriptor _CmIsDeviceSafeRemovalRequired _CmIsLocalMachineContainer _CmMatchLastKnownParentCallback _CmOpenCommonClassRegKey _CmOpenDeviceContainerRegKey _CmOpenDeviceInterfaceRegKey _CmOpenDevicePanelRegKey _CmRemoveDeviceFromContainer _CmRemovePanelDevice _CmServiceFilterCallback _CmSetDeviceMappedPropertyFromDriverKeyRegValue _CmSetDeviceMappedPropertyFromRegProp _CmSetDeviceRegProp _CmSetInstallerClassRegProp _CmSplitDevicePanelId _CmUpdateDevicePanel _CmUpdateDevicePanelInterface _CmValidateDeviceInterfaceName _CmValidateDevicePanelName _PnpDeletePropertyWorker _PnpDeviceRaisePropertyChangeEventWorker _PnpGetEnumSecurityDescriptor _PnpGetGenericStoreProperty _PnpGetGenericStorePropertyKeys _PnpGetGenericStorePropertyLocales _PnpGetPropertiesSecurityDescriptor _PnpIsValidGuidString _PnpOpenPropertiesKey _PnpSetPropertyWorker _RegRtlCopyTreeInternal _RegRtlEnumKey _RegRtlEnumKeyWithCallback _RegRtlQueryInfoKey _RegRtlQueryValue _RtlpMuiRegAddBaseLanguage _RtlpMuiRegInitLIPLanguage _RtlpMuiRegLoadInstalledFromKey _RtlpMuiRegPopulateBaseLanguages _RtlpMuiRegValidateInstalled _RtlpRemovePendingDeleteLanguages _SysCtxOpenControlSet _SysCtxOpenMachine _SysCtxRegOpenCurrentUserKey __GSHandlerCheckCommon _handle_error _handle_errorf _output_l _output_s _tlgWriteTemplate<long___cdecl(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),&long___cdecl__tlgWriteTransfer_EtwWriteTransfer(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),struct__GUID_const*___ptr64,struct__GUID_const*__ptr64>::Write<struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1> > _woutput_l _woutput_s pIoQueryBusDescription pIoQueryDeviceDescription qsort qsort_s strspn strtok_s vDbgPrintExWithPrefixInternal wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToServiceDirect
paramcount
1
1
address
1403d0920
1403d0910
sig
void __cdecl __security_check_cookie(uintptr_t _StackCookie)
void __cdecl __security_check_cookie(uintptr_t _StackCookie)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
__security_check_cookie Calling Diff
--- __security_check_cookie calling
+++ __security_check_cookie calling
@@ -766,5 +766,5 @@
- FUN_140709bb0
- FUN_140768f34
- FUN_14084356c
- FUN_140a4b524
- FUN_140a4e0ec
+ FUN_14070a710
+ FUN_140769944
+ FUN_140843f7c
+ FUN_140a4b4b4
+ FUN_140a4e07c
@@ -3834,0 +3835 @@
+ wil_details_FeatureReporting_ReportUsageToServiceDirect
HvpGetCellContextReinitialize
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
1.0
i_ratio
1.0
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
HvpGetCellContextReinitialize
HvpGetCellContextReinitialize
fullname
HvpGetCellContextReinitialize
HvpGetCellContextReinitialize
refcount
115
113
length
26
26
called
HvpGetBinContextInitialize
HvpGetBinContextInitialize
calling
Expand for full list: CmDeleteKey CmDeleteLayeredKey CmDeleteValueKey CmEnumerateKey CmEnumerateValueKey CmQueryMultipleValueForLayeredKey CmQueryValueKey CmSetKeyFlags CmSetLastWriteTimeKey CmSetValueKey CmpAddSubKeyEx CmpAddSubKeyToList CmpAddToLeaf CmpAddValueKeyNew CmpAddValueKeyTombstone CmpAddValueToListEx CmpAssignKeySecurity CmpCheckAndFixSecurityCellsRefcount CmpCheckKeyNodeStackAccess CmpCheckLeaf CmpCheckRegistry2 CmpCheckSecurityCellAccess CmpCheckValueList CmpCloneKCBValueListForTrans CmpCommitAddKeyUoW CmpCommitDeleteKeyUoW CmpConcatenateValueLists CmpConstructNameFromKeyNodes CmpCopyCell CmpCopyMergeOfLayeredKeyNode CmpCopyValue CmpCreateChild CmpCreateHiveRootCell CmpCreateKeyControlBlock CmpCreateRootNode CmpCreateTombstone CmpDereferenceSecurityNode CmpDoBuildVirtualStack CmpDoParseKey CmpEnumerateLayeredKey CmpFindNameInListCellWithStatus CmpFindNameInListFromIndex CmpFindNameInListWithStatus CmpFreeKeyValueList CmpFullPromoteSingleKeyFromKeyNodeStacks CmpGetSecurityDescriptorNode CmpGetSymbolicLinkTarget CmpGetValueForAudit CmpInitializeKeyNodeStack CmpKeyEnumStackAdvanceInternal CmpKeyEnumStackEntryInitialize CmpKeyEnumStackNotifyPromotion CmpLightWeightDuplicateParentLists CmpLoadHiveVolatile CmpMarkAllChildrenDirty CmpMarkEntireIndexDirty CmpMarkIndexDirty CmpMarkIndexDirtyInStorageType CmpQueryKeyDataFromKeyNodeStack CmpQueryKeyDataFromNode CmpRefreshHive CmpResetKeyNodeStack CmpSetKeySecurity CmpSortedValueEnumStackEntryStart CmpStartKeyNodeStack CmpSyncKeyValues CmpUpdateHiveRootCellFlags CmpVEExecuteOpenLogic CmpVEExecuteRealStoreParseLogic CmpValidateHiveSecurityDescriptors CmpValueEnumStackAdvance CmpValueEnumStackEntryInitialize CmpWalkOneLevel HvDuplicateCell HvIsCellAllocated HvReallocateCell HvpDoAllocateCell HvpReleaseCellPaged
Expand for full list: CmDeleteKey CmDeleteLayeredKey CmDeleteValueKey CmEnumerateKey CmEnumerateValueKey CmQueryMultipleValueForLayeredKey CmQueryValueKey CmSetKeyFlags CmSetLastWriteTimeKey CmpAddSubKeyEx CmpAddSubKeyToList CmpAddToLeaf CmpAddValueKeyNew CmpAddValueKeyTombstone CmpAddValueToListEx CmpAssignKeySecurity CmpCheckAndFixSecurityCellsRefcount CmpCheckKeyNodeStackAccess CmpCheckLeaf CmpCheckRegistry2 CmpCheckSecurityCellAccess CmpCheckValueList CmpCloneKCBValueListForTrans CmpCommitAddKeyUoW CmpCommitDeleteKeyUoW CmpConcatenateValueLists CmpConstructNameFromKeyNodes CmpCopyCell CmpCopyMergeOfLayeredKeyNode CmpCopyValue CmpCreateChild CmpCreateHiveRootCell CmpCreateKeyControlBlock CmpCreateRootNode CmpCreateTombstone CmpDereferenceSecurityNode CmpDoBuildVirtualStack CmpDoParseKey CmpEnumerateLayeredKey CmpFindNameInListCellWithStatus CmpFindNameInListFromIndex CmpFindNameInListWithStatus CmpFreeKeyValueList CmpFullPromoteSingleKeyFromKeyNodeStacks CmpGetSecurityDescriptorNode CmpGetSymbolicLinkTarget CmpGetValueForAudit CmpInitializeKeyNodeStack CmpKeyEnumStackAdvanceInternal CmpKeyEnumStackEntryInitialize CmpKeyEnumStackNotifyPromotion CmpLightWeightDuplicateParentLists CmpLoadHiveVolatile CmpMarkAllChildrenDirty CmpMarkEntireIndexDirty CmpMarkIndexDirty CmpMarkIndexDirtyInStorageType CmpQueryKeyDataFromKeyNodeStack CmpQueryKeyDataFromNode CmpRefreshHive CmpResetKeyNodeStack CmpSetKeySecurity CmpSortedValueEnumStackEntryStart CmpStartKeyNodeStack CmpSyncKeyValues CmpUpdateHiveRootCellFlags CmpVEExecuteOpenLogic CmpVEExecuteRealStoreParseLogic CmpValidateHiveSecurityDescriptors CmpValueEnumStackAdvance CmpValueEnumStackEntryInitialize CmpWalkOneLevel HvDuplicateCell HvIsCellAllocated HvReallocateCell HvpDoAllocateCell HvpReleaseCellPaged
paramcount
0
0
address
1407c4aec
1407c54fc
sig
undefined HvpGetCellContextReinitialize(void)
undefined HvpGetCellContextReinitialize(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
HvpGetCellContextReinitialize Calling Diff
--- HvpGetCellContextReinitialize calling
+++ HvpGetCellContextReinitialize calling
@@ -10 +9,0 @@
- CmSetValueKey
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address
ratio
1.0
i_ratio
0.83
m_ratio
1.0
b_ratio
1.0
match_types
SymbolsHash
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
CmpSnapshotTxOwnerArray
CmpSnapshotTxOwnerArray
fullname
CmpSnapshotTxOwnerArray
CmpSnapshotTxOwnerArray
refcount
10
9
length
273
273
called
ExAllocatePool2 ObfReferenceObject
ExAllocatePool2 ObfReferenceObject
calling
CmDeleteKey CmDeleteValueKey CmSetValueKey CmpCreateChild CmpSetKeySecurity
CmDeleteKey CmDeleteValueKey CmSetValueKey CmpCreateChild CmpSetKeySecurity
paramcount
0
0
address
140a21974
140a21904
sig
undefined CmpSnapshotTxOwnerArray(void)
undefined CmpSnapshotTxOwnerArray(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling,called
ratio
0.9
i_ratio
0.66
m_ratio
1.0
b_ratio
1.0
match_types
ExactInstructionsFunctionHasher
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
_guard_dispatch_icall
_guard_dispatch_icall
fullname
_guard_dispatch_icall
_guard_dispatch_icall
refcount
4525
4529
length
141
141
called
FUN_14041d490 __guard_retpoline_exit_indirect_rax _guard_icall_bugcheck
FUN_14041d560 __guard_retpoline_exit_indirect_rax _guard_icall_bugcheck
calling
Expand for full list: AlpcpAllocateBlob AlpcpDeleteBlob AlpcpDestroyBlob AlpcpInvokeLogCallbacks AlpcpUnlockBlob Amd64OverflowHandler AnFwDisplayBackgroundUpdate AnFwpBackgroundUpdateTimer ArbAllocateEntry ArbArbiterHandler ArbBootAllocation ArbBuildAssignmentOrdering ArbFindSuitableRange ArbInitializeRangeList ArbQueryConflict ArbRetestAllocation ArbStartArbiter ArbTestAllocation ArbpBuildAlternative AslLogCallPrintf BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSetProperty B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeWalkPostOrderInternal BapdRecordFirmwareBootStats BapdpKsrCancelScenario BapdpKsrCompleteScenario BapdpKsrCompleteScenarioPhase0 BapdpKsrInitiateScenarioPhase0 BapdpKsrpInitiateScenario BcpDisplayEarlyBugCheckScreen BgkAcquireDisplayOwnership BgkDisplayCharacter BgkDisplayStringEx BgkGetConsoleState BgkGetCursorState BgkInitialize BgkNotifyDisplayOwnershipChange BgkSetCursor BgkSetTextColor BgkSolidColorFill BgkpResetDisplay BvgaAcquireDisplayOwnership CarLiveDumpCallBack CcAcquireByteRangeForWrite CcAllocateWorkQueueEntry CcCompleteAsyncRead CcCompleteAsyncRead$fin$1 CcDeferWrite CcForEachNumaNode CcForEachPartition CcForEachPrivateVolumeCacheMap CcFreeWorkQueueEntry CcGetDirtyPagesHelper CcMdlReadComplete CcMdlWriteComplete CcNotifyExternalCachesInternal CcPerformReadAhead CcPerformReadAhead$fin$1 CcPostDeferredWrites CcRegistryChangeCallback CcScanLogHandleList CcSetDirtyInMask CcUnmapInactiveViewsInternal CcWriteBehindPreProcess CcWriteBehindReleaseFile CmCheckRegistry CmFcpChangeSubscriptionWrapper CmKtmNotification CmOpenKey CmSetAcpiHwProfile CmUnRegisterCallback CmpAcceptBoot CmpAddDriverToList CmpAddSecurityCellToCache CmpAddSubKeyToList CmpAdjustSecurityCacheSize CmpCallCallBacksEx CmpCheckRegistry2 CmpCleanupPathInfo CmpCloseKeyObject CmpCreateKeyBody CmpDestroySecurityCache CmpDoParseKey CmpEnableLazyFlushDpcRoutine$fin$1 CmpEnumerateAllHigherLayerKcbs CmpEnumerateKcbCacheBucket CmpEtwDumpKcb CmpExpandPathInfo CmpFireCleanupNotifications CmpFreeDriverList CmpFreeExtraParameter CmpGetNodeName CmpGetSymbolicLinkTarget CmpIsLoadType CmpLazyFlushDpcRoutine$filt$1 CmpLazyWriteWorker CmpMachineHiveLoadedWorkItem CmpRemoveFromSecurityCache CmpReplicateKeyToVirtual CmpSearchKeyControlBlockTreeEx CmpSecurityMethod CmpSystemHiveHysteresisWorker CmpWorkItemWrapper DbgkCaptureLiveDump DbgkpLkmdEnumApcOrDpcDataCallback DbgkpLkmdFireCallbacks DbgkpLkmdIsMemoryBlockPresentFromCallback DbgkpLkmdSnapData DbgkpLkmdSnapDataEx DbgkpLkmdSnapGlobals DbgkpLkmdSnapKernelStack DbgkpLkmdSnapKernelStackSegmentCallback DbgkpLkmdSnapObject DbgkpWerInvokeCallbacks DefaultOverflowHandler DifAddDeviceWrapper DifCcCopyWriteExWrapper DifCcCopyWriteWrapper DifCcDeferWriteWrapper DifCcFastCopyWriteWrapper DifCmRegisterCallbackExWrapper DifCmRegisterCallbackWrapper DifCmUnRegisterCallbackWrapper DifDeregisterPlugin DifDriverCancelWrapper DifDriverEntryWrapper DifDriverStartIoWrapper DifDriverUnloadWrapper DifEtwRegisterWrapper DifEtwUnregisterWrapper DifExAcquireFastMutexUnsafeWrapper DifExAcquireFastMutexWrapper DifExAcquireResourceExclusiveLiteWrapper DifExAcquireResourceSharedLiteWrapper DifExAcquireSharedStarveExclusiveWrapper DifExAcquireSharedWaitForExclusiveWrapper DifExAllocatePool2Wrapper DifExAllocatePool3Wrapper DifExAllocatePoolWithQuotaTagWrapper DifExAllocatePoolWithQuotaWrapper DifExAllocatePoolWithTagPriorityWrapper DifExAllocatePoolWithTagWrapper DifExAllocatePoolWrapper DifExConvertExclusiveToSharedLiteWrapper DifExCreateCallbackWrapper DifExDeleteLookasideListExWrapper DifExDeleteNPagedLookasideListWrapper DifExDeletePagedLookasideListWrapper DifExDeleteResourceLiteWrapper DifExEnterCriticalRegionAndAcquireResourceExclusiveWrapper DifExEnterCriticalRegionAndAcquireResourceSharedWrapper DifExEnterCriticalRegionAndAcquireSharedWaitForExclusiveWrapper DifExEnterPriorityRegionAndAcquireResourceExclusiveWrapper DifExEnterPriorityRegionAndAcquireResourceSharedWrapper DifExFreePoolWithTagWrapper DifExFreePoolWrapper DifExInitializeLookasideListExWrapper DifExInitializeNPagedLookasideListWrapper DifExInitializePagedLookasideListWrapper DifExInitializeResourceLiteWrapper DifExIsProcessorFeaturePresentWrapper DifExRaiseAccessViolationWrapper DifExRaiseDatatypeMisalignmentWrapper DifExRaiseStatusWrapper DifExRegisterCallbackWrapper DifExReleaseFastMutexUnsafeWrapper DifExReleaseFastMutexWrapper DifExReleaseResourceAndLeaveCriticalRegionWrapper DifExReleaseResourceAndLeavePriorityRegionWrapper DifExReleaseResourceForThreadLiteWrapper DifExReleaseResourceLiteWrapper DifExSetTimerResolutionWrapper DifExTryToAcquireFastMutexWrapper DifExUnregisterCallbackWrapper DifExUuidCreateWrapper DifExfAcquirePushLockExclusiveWrapper DifExfAcquirePushLockSharedWrapper DifExfReleasePushLockSharedWrapper DifExfReleasePushLockWrapper DifExfTryAcquirePushLockSharedWrapper DifExfTryToWakePushLockWrapper DifHalAllocateCrashDumpRegistersWrapper DifHalDmaAllocateCrashDumpRegistersExWrapper DifHalDmaFreeCrashDumpRegistersExWrapper DifIRP_MJ_CLEANUPWrapper DifIRP_MJ_CLOSEWrapper DifIRP_MJ_CREATEWrapper DifIRP_MJ_CREATE_MAILSLOTWrapper DifIRP_MJ_CREATE_NAMED_PIPEWrapper DifIRP_MJ_DEVICE_CHANGEWrapper DifIRP_MJ_DEVICE_CONTROLWrapper DifIRP_MJ_DIRECTORY_CONTROLWrapper DifIRP_MJ_FILE_SYSTEM_CONTROLWrapper DifIRP_MJ_FLUSH_BUFFERSWrapper DifIRP_MJ_INTERNAL_DEVICE_CONTROLWrapper DifIRP_MJ_LOCK_CONTROLWrapper DifIRP_MJ_PNPWrapper DifIRP_MJ_POWERWrapper DifIRP_MJ_QUERY_EAWrapper DifIRP_MJ_QUERY_INFORMATIONWrapper DifIRP_MJ_QUERY_QUOTAWrapper DifIRP_MJ_QUERY_SECURITYWrapper DifIRP_MJ_QUERY_VOLUME_INFORMATIONWrapper DifIRP_MJ_READWrapper DifIRP_MJ_SET_EAWrapper DifIRP_MJ_SET_INFORMATIONWrapper DifIRP_MJ_SET_QUOTAWrapper DifIRP_MJ_SET_SECURITYWrapper DifIRP_MJ_SET_VOLUME_INFORMATIONWrapper DifIRP_MJ_SHUTDOWNWrapper DifIRP_MJ_SYSTEM_CONTROLWrapper DifIRP_MJ_WRITEWrapper DifIoAcquireRemoveLockExWrapper DifIoAllocateControllerWrapper DifIoAllocateIrpExWrapper DifIoAllocateIrpWrapper DifIoAllocateMdlWrapper DifIoAllocateWorkItemWrapper DifIoAttachDeviceWrapper DifIoBuildAsynchronousFsdRequestWrapper DifIoBuildDeviceIoControlRequestWrapper DifIoBuildSynchronousFsdRequestWrapper DifIoCheckShareAccessWrapper DifIoConnectInterruptExWrapper DifIoConnectInterruptWrapper DifIoCreateControllerWrapper DifIoCreateDeviceWrapper DifIoCreateFileExWrapper DifIoCreateFileSpecifyDeviceObjectHintWrapper DifIoCreateFileWrapper DifIoCreateNotificationEventWrapper DifIoCreateSymbolicLinkWrapper DifIoCreateSynchronizationEventWrapper DifIoCreateUnprotectedSymbolicLinkWrapper DifIoDeleteControllerWrapper DifIoDeleteDeviceWrapper DifIoDeleteSymbolicLinkWrapper DifIoDetachDeviceWrapper DifIoDisconnectInterruptExWrapper DifIoDisconnectInterruptWrapper DifIoFreeControllerWrapper DifIoFreeIrpWrapper DifIoFreeMdlWrapper DifIoGetConfigurationInformationWrapper DifIoGetDeviceDirectoryWrapper DifIoGetDeviceObjectPointerWrapper DifIoGetDeviceToVerifyWrapper DifIoGetDmaAdapterWrapper DifIoGetDriverDirectoryWrapper DifIoGetFileObjectGenericMappingWrapper DifIoGetInitialStackWrapper DifIoInitializeRemoveLockExWrapper DifIoInitializeTimerWrapper DifIoInitializeWorkItemWrapper DifIoIsWdmVersionAvailableWrapper DifIoOpenDeviceInterfaceRegistryKeyWrapper DifIoOpenDeviceRegistryKeyWrapper DifIoOpenDriverRegistryKeyWrapper DifIoRaiseHardErrorWrapper DifIoRaiseInformationalHardErrorWrapper DifIoReadPartitionTableWrapper DifIoRegisterDeviceInterfaceWrapper DifIoRegisterDriverReinitializationWrapper DifIoRegisterShutdownNotificationWrapper DifIoReleaseRemoveLockAndWaitExWrapper DifIoReleaseRemoveLockExWrapper DifIoRemoveShareAccessWrapper DifIoSetCompletionRoutineExWrapper DifIoSetDeviceInterfaceStateWrapper DifIoSetDeviceToVerifyWrapper DifIoSetPartitionInformationWrapper DifIoSetShareAccessWrapper DifIoStartNextPacketWrapper DifIoUnregisterShutdownNotificationWrapper DifIoUpdateShareAccessWrapper DifIoWMIAllocateInstanceIdsWrapper DifIoWMIRegistrationControlWrapper DifIoWriteErrorLogEntryWrapper DifIoWritePartitionTableWrapper DifIofCallDriverWrapper DifIofCompleteRequestWrapper DifKeAcquireGuardedMutexUnsafeWrapper DifKeAcquireGuardedMutexWrapper DifKeAcquireInStackQueuedSpinLockAtDpcLevelWrapper DifKeAcquireInStackQueuedSpinLockForDpcWrapper DifKeAcquireInStackQueuedSpinLockRaiseToSynchWrapper DifKeAcquireInStackQueuedSpinLockWrapper DifKeAcquireQueuedSpinLockRaiseToSynchWrapper DifKeAcquireQueuedSpinLockWrapper DifKeAcquireSpinLockAtDpcLevelWrapper DifKeAcquireSpinLockRaiseToDpcWrapper DifKeCancelTimerWrapper DifKeClearEventWrapper DifKeDelayExecutionThreadWrapper DifKeDeregisterNmiCallbackWrapper DifKeEnterCriticalRegionWrapper DifKeEnterGuardedRegionWrapper DifKeInitializeDeviceQueueWrapper DifKeInitializeEventWrapper DifKeInitializeMutantWrapper DifKeInitializeMutexWrapper DifKeInitializeSemaphoreWrapper DifKeInitializeTimerExWrapper DifKeInitializeTimerWrapper DifKeInsertByKeyDeviceQueueWrapper DifKeInsertDeviceQueueWrapper DifKeInsertQueueDpcWrapper DifKeLeaveCriticalRegionWrapper DifKeLeaveGuardedRegionWrapper DifKeLowerIrqlWrapper DifKePulseEventWrapper DifKeRaiseIrqlToDpcLevelWrapper DifKeReadStateEventWrapper DifKeReadStateTimerWrapper DifKeRegisterNmiCallbackWrapper DifKeReleaseGuardedMutexUnsafeWrapper DifKeReleaseGuardedMutexWrapper DifKeReleaseInStackQueuedSpinLockForDpcWrapper DifKeReleaseInStackQueuedSpinLockFromDpcLevelWrapper DifKeReleaseInStackQueuedSpinLockWrapper DifKeReleaseMutantWrapper DifKeReleaseMutexWrapper DifKeReleaseQueuedSpinLockWrapper DifKeReleaseSpinLockFromDpcLevelWrapper DifKeReleaseSpinLockWrapper DifKeRemoveByKeyDeviceQueueWrapper DifKeRemoveDeviceQueueWrapper DifKeRemoveEntryDeviceQueueWrapper DifKeRemoveQueueDpcWrapper DifKeResetEventWrapper DifKeRestoreExtendedProcessorStateWrapper DifKeSaveExtendedProcessorStateWrapper DifKeSetEventWrapper DifKeSetTimerExWrapper DifKeSetTimerWrapper DifKeSynchronizeExecutionWrapper DifKeTryToAcquireGuardedMutexWrapper DifKeTryToAcquireQueuedSpinLockRaiseToSynchWrapper DifKeTryToAcquireQueuedSpinLockWrapper DifKeTryToAcquireSpinLockAtDpcLevelWrapper DifKeWaitForMultipleObjectsWrapper DifKeWaitForSingleObjectWrapper DifKfRaiseIrqlWrapper DifMmAllocateContiguousMemoryExWrapper DifMmAllocateContiguousMemorySpecifyCacheWrapper DifMmAllocateContiguousMemoryWrapper DifMmAllocateNonCachedMemoryWrapper DifMmAllocatePagesForMdlExWrapper DifMmAllocatePagesForMdlWrapper DifMmBuildMdlForNonPagedPoolWrapper DifMmFreeContiguousMemoryWrapper DifMmFreeNonCachedMemoryWrapper DifMmFreePagesFromMdlWrapper DifMmLockPagableDataSectionWrapper DifMmLockPagableSectionByHandleWrapper DifMmMapIoSpaceWrapper DifMmMapLockedPagesSpecifyCacheWrapper DifMmPageEntireDriverWrapper DifMmResetDriverPagingWrapper DifMmSecureVirtualMemoryWrapper DifMmUnlockPagableImageSectionWrapper DifMmUnmapLockedPagesWrapper DifMmUnsecureVirtualMemoryWrapper DifNtCreateFileWrapper DifNtDeleteFileWrapper DifNtOpenFileWrapper DifNtSetInformationFileWrapper DifNtWriteFileWrapper DifObGetObjectSecurityWrapper DifObReferenceObjectByHandleWrapper DifObReferenceObjectByPointerWithTagWrapper DifObReferenceObjectByPointerWrapper DifObReleaseObjectSecurityWrapper DifObfDereferenceObjectWithTagWrapper DifObfDereferenceObjectWrapper DifObfReferenceObjectWithTagWrapper DifObfReferenceObjectWrapper DifPoCallDriverWrapper DifPoFxActivateComponentWrapper DifPoFxCompleteDevicePowerNotRequiredWrapper DifPoFxCompleteIdleConditionWrapper DifPoFxCompleteIdleStateWrapper DifPoFxIdleComponentWrapper DifPoFxNotifySurprisePowerOnWrapper DifPoFxPowerControlWrapper DifPoFxRegisterDeviceWrapper DifPoFxReportDevicePoweredOnWrapper DifPoFxSetComponentLatencyWrapper DifPoFxSetComponentResidencyWrapper DifPoFxSetComponentWakeWrapper DifPoFxSetDeviceIdleTimeoutWrapper DifPoFxStartDevicePowerManagementWrapper DifPoFxUnregisterDeviceWrapper DifPoRequestPowerIrpWrapper DifProbeForReadWrapper DifProbeForWriteWrapper DifPsCreateSystemThreadWrapper DifPsGetVersionWrapper DifPsSetCreateProcessNotifyRoutineWrapper DifPsSetCreateThreadNotifyRoutineWrapper DifPsSetLoadImageNotifyRoutineWrapper DifPsTerminateSystemThreadWrapper DifRtlAnsiStringToUnicodeStringWrapper DifRtlCheckRegistryKeyWrapper DifRtlCreateRegistryKeyWrapper DifRtlCreateSystemVolumeInformationFolderWrapper DifRtlCreateUnicodeStringWrapper DifRtlDeleteRegistryValueWrapper DifRtlDowncaseUnicodeStringWrapper DifRtlDuplicateUnicodeStringWrapper DifRtlOemStringToCountedUnicodeStringWrapper DifRtlOemStringToUnicodeStringWrapper DifRtlQueryRegistryValueWithFallbackWrapper DifRtlQueryRegistryValuesExWrapper DifRtlQueryRegistryValuesWrapper DifRtlUnicodeStringToAnsiStringWrapper DifRtlUnicodeStringToCountedOemStringWrapper DifRtlUnicodeStringToOemStringWrapper DifRtlUpcaseUnicodeStringToAnsiStringWrapper DifRtlUpcaseUnicodeStringToCountedOemStringWrapper DifRtlUpcaseUnicodeStringToOemStringWrapper DifRtlUpcaseUnicodeStringWrapper DifRtlWriteRegistryValueWrapper DifZwAccessCheckAndAuditAlarmWrapper DifZwAddBootEntryWrapper DifZwAddDriverEntryWrapper DifZwAdjustPrivilegesTokenWrapper DifZwAllocateVirtualMemoryWrapper DifZwAlpcAcceptConnectPortWrapper DifZwAlpcConnectPortWrapper DifZwAlpcCreatePortSectionWrapper DifZwAlpcCreatePortWrapper DifZwAlpcCreateResourceReserveWrapper DifZwAlpcCreateSectionViewWrapper DifZwAlpcCreateSecurityContextWrapper DifZwAlpcQueryInformationWrapper DifZwAlpcSendWaitReceivePortWrapper DifZwAlpcSetInformationWrapper DifZwCancelIoFileWrapper DifZwCancelTimerWrapper DifZwCloseObjectAuditAlarmWrapper DifZwCloseWrapper DifZwCommitEnlistmentWrapper DifZwConnectPortWrapper DifZwCreateDirectoryObjectWrapper DifZwCreateEnlistmentWrapper DifZwCreateEventWrapper DifZwCreateFileWrapper DifZwCreateJobObjectWrapper DifZwCreateKeyTransactedWrapper DifZwCreateKeyWrapper DifZwCreateResourceManagerWrapper DifZwCreateSectionWrapper DifZwCreateSymbolicLinkObjectWrapper DifZwCreateTimerWrapper DifZwCreateTransactionManagerWrapper DifZwCreateTransactionWrapper DifZwDeleteBootEntryWrapper DifZwDeleteFileWrapper DifZwDeleteKeyWrapper DifZwDeleteValueKeyWrapper DifZwDeviceIoControlFileWrapper DifZwDisplayStringWrapper DifZwDuplicateObjectWrapper DifZwDuplicateTokenWrapper DifZwEnumerateBootEntriesWrapper DifZwEnumerateDriverEntriesWrapper DifZwEnumerateKeyWrapper DifZwEnumerateValueKeyWrapper DifZwFlushBuffersFileExWrapper DifZwFlushBuffersFileWrapper DifZwFlushInstructionCacheWrapper DifZwFlushKeyWrapper DifZwFlushVirtualMemoryWrapper DifZwFreeVirtualMemoryWrapper DifZwFsControlFileWrapper DifZwGetNotificationResourceManagerWrapper DifZwLoadDriverWrapper DifZwLoadKeyWrapper DifZwMapViewOfSectionWrapper DifZwModifyBootEntryWrapper DifZwModifyDriverEntryWrapper DifZwNotifyChangeKeyWrapper DifZwOpenDirectoryObjectWrapper DifZwOpenEnlistmentWrapper DifZwOpenEventWrapper DifZwOpenFileWrapper DifZwOpenJobObjectWrapper DifZwOpenKeyExWrapper DifZwOpenKeyTransactedExWrapper DifZwOpenKeyTransactedWrapper DifZwOpenKeyWrapper DifZwOpenProcessTokenExWrapper DifZwOpenProcessTokenWrapper DifZwOpenProcessWrapper DifZwOpenResourceManagerWrapper DifZwOpenSectionWrapper DifZwOpenSymbolicLinkObjectWrapper DifZwOpenThreadTokenExWrapper DifZwOpenThreadTokenWrapper DifZwOpenThreadWrapper DifZwOpenTimerWrapper DifZwOpenTransactionManagerWrapper DifZwOpenTransactionWrapper DifZwPowerInformationWrapper DifZwPrePrepareEnlistmentWrapper DifZwPrepareCompleteWrapper DifZwPrepareEnlistmentWrapper DifZwProtectVirtualMemoryWrapper DifZwPulseEventWrapper DifZwQueryBootEntryOrderWrapper DifZwQueryBootOptionsWrapper DifZwQueryDefaultLocaleWrapper DifZwQueryDefaultUILanguageWrapper DifZwQueryDirectoryFileExWrapper DifZwQueryDirectoryFileWrapper DifZwQueryDirectoryObjectWrapper DifZwQueryDriverEntryOrderWrapper DifZwQueryEaFileWrapper DifZwQueryFullAttributesFileWrapper DifZwQueryInformationEnlistmentWrapper DifZwQueryInformationFileWrapper DifZwQueryInformationJobObjectWrapper DifZwQueryInformationProcessWrapper DifZwQueryInformationResourceManagerWrapper DifZwQueryInformationThreadWrapper DifZwQueryInformationTokenWrapper DifZwQueryInformationTransactionManagerWrapper DifZwQueryInformationTransactionWrapper DifZwQueryInstallUILanguageWrapper DifZwQueryKeyWrapper DifZwQueryLicenseValueWrapper DifZwQueryObjectWrapper DifZwQuerySectionWrapper DifZwQuerySecurityObjectWrapper DifZwQuerySymbolicLinkObjectWrapper DifZwQuerySystemInformationWrapper DifZwQueryValueKeyWrapper DifZwQueryVolumeInformationFileWrapper DifZwReadFileWrapper DifZwRemoveIoCompletionExWrapper DifZwRenameKeyWrapper DifZwReplaceKeyWrapper DifZwRequestWaitReplyPortWrapper DifZwResetEventWrapper DifZwRestoreKeyWrapper DifZwRollbackEnlistmentWrapper DifZwSetBootEntryOrderWrapper DifZwSetBootOptionsWrapper DifZwSetDriverEntryOrderWrapper DifZwSetEaFileWrapper DifZwSetEventWrapper DifZwSetInformationEnlistmentWrapper DifZwSetInformationFileWrapper DifZwSetInformationJobObjectWrapper DifZwSetInformationKeyWrapper DifZwSetInformationObjectWrapper DifZwSetInformationProcessWrapper DifZwSetInformationThreadWrapper DifZwSetInformationTransactionWrapper DifZwSetSecurityObjectWrapper DifZwSetSystemInformationWrapper DifZwSetSystemTimeWrapper DifZwSetTimerWrapper DifZwSetValueKeyWrapper DifZwSetVolumeInformationFileWrapper DifZwTranslateFilePathWrapper DifZwUnloadDriverWrapper DifZwUnloadKeyWrapper DifZwWaitForMultipleObjectsWrapper DifZwWaitForSingleObjectWrapper DifZwWriteFileWrapper DisplayBootBitmap DrvDbGetDriverDatabaseList DrvDbGetObjectSubKeyCallback DrvDbLoadDatabaseNode DrvDbUnloadDatabaseNode EmonOverflowHandler EmonPebsOverflowHandler EmpEvaluateNodeLink EmpEvaluateUpdateRuleEvalState EmpUpdateRuleState EtwGetKernelTraceTimestampSilo EtwQueryPerformanceTraceInformation EtwSetPerformanceTraceInformation EtwpAddLogHeader EtwpAddRegEntryToGroup EtwpCancelTraceImageUnloadApc EtwpClockSourceRunDown EtwpCompleteBuffer EtwpCovSampEnumerateProcess EtwpCovSampLookasideGrow EtwpCovSampModuleGetName EtwpCovSampModuleNameInfoCleanup EtwpCoverageSamplerStart EtwpEnumerateAddressSpace EtwpEventWriteFull EtwpFreeLoggerContext EtwpGetPmcOwnership EtwpInitialize EtwpInitializeLastBranchTracing EtwpInitializeTimeStamp EtwpInvokeEventCallback EtwpLoadMicroarchitecturalProfileSource EtwpLogContextSwapEvent EtwpLogPmcCounterRundown EtwpRegisterKMProvider EtwpReserveTraceBuffer EtwpReserveWithPmcCounters EtwpSampledProfileRunDown EtwpSendDataBlock EtwpTraceImageUnloadApc EtwpTraceLastBranchRecord EtwpTraceProcessorTrace EtwpUpdateLastBranchTracingConfiguration EtwpUpdatePmcCounters EtwpUpdateProcessorTraceConfiguration ExAllocateFromLookasideListEx ExAllocateFromNPagedLookasideList ExAllocateHeapPool ExAtsSvmDevicePowerCallback ExCallCallBack ExCallSessionCallBack ExEnumHandleTable ExFlushLookasideListEx ExFlushTb ExFreeHeapPool ExFreeToLookasideListEx ExFreeToNPagedLookasideList ExInitLicenseData ExInitializeDeviceAts ExNotifyWithProcessing ExRegisterExtension ExSetLicenseTamperState ExSvmBeginDeviceReset ExSvmFinalizeDeviceReset ExUnregisterExtension ExUpdateLicenseData ExpAcquireCrossVmMutant ExpApplyPriorityBoost ExpAtsDereferenceDevice ExpBoostIoAfterAcquire ExpCallProcessing ExpCenturyDpcRoutine$fin$0 ExpConvertSvmDevice ExpCreateCrossVmEvent ExpCreateCrossVmMutant ExpCrossVmIntHostCallback ExpCrossVmWnfPush ExpFinalizeTimerDeletion ExpFlushGeneralLookaside ExpGenuinePolicyPostProcess ExpGetSystemFirmwareTableInformation ExpInitializeMemoryMirroring ExpInitializeSessionDriver ExpInitializeSvm ExpLicenseWatchInitWorker ExpObCloseCrossVmEvent ExpObCloseCrossVmMutant ExpObDeleteCrossVmEvent ExpObDeleteCrossVmMutant ExpPrepareNewAtsDevice ExpPrepareNewSvmDevice ExpProfileCreate ExpPulseCrossVmEvent ExpQueryCodeIntegrityCertificateInfo ExpQueryCrossVmEvent ExpQueryElamCertInfo ExpQueryNumaProximityNode ExpQuerySystemInformation ExpReleaseCrossVmMutant ExpResetCrossVmEvent ExpSetCrossVmEvent ExpSetSoftRebootFlags ExpShareAddressSpaceWithDevice ExpSnapShotHandleTables ExpSvmDereferenceDevice ExpSvmWorkerThread ExpTimeRefreshDpcRoutine$filt$3 ExpTimeRefreshWork ExpTimeZoneDpcRoutine$fin$2 ExpTimerDpcRoutine$filt$1 ExpWaitForBootDevices ExpWaitForResource ExpWatchProductTypeWork ExpWnfDispatchKernelSubscription ExpWnfPopulateStateData ExpWorkerThread FUN_1404166db FUN_14066b630 FUN_14066c334 FUN_140687e40 FUN_14068ad70 FUN_140709640 FUN_140709974 FUN_140768f34 FUN_14084356c FUN_140a4b524 FUN_140a4b914 FUN_140a4c0d0 FUN_140a4c310 FUN_140a4c860 FUN_140a4ce10 FUN_140a4d1c4 FUN_140a4db54 FUN_140a4e0ec FUN_140a4e508 FilterEvalImpliedAnd FilterEvalStrict FindNodeOrParent FindNodeOrParent FsFilterPerformCallbacks FsFilterPerformCompletionCallbacks FsRtlAcquireFileExclusiveCommon FsRtlAcquireFileForCcFlushEx FsRtlAcquireFileForModWriteEx FsRtlCompleteLockIrpReal FsRtlCopyRead FsRtlCopyWrite FsRtlFastUnlockSingleExclusive FsRtlFastUnlockSingleShared FsRtlFreeExtraCreateParameter FsRtlGetFileNameInformation FsRtlGetFileSize FsRtlGetSupportedFeatures FsRtlMdlRead FsRtlMdlReadComplete FsRtlMdlReadDev FsRtlMdlWriteComplete FsRtlMupGetProviderIdFromName FsRtlMupGetProviderInfoFromFileObject FsRtlNotifyFilterReportChange FsRtlNotifyFilterReportChangeLiteEx FsRtlPrepareMdlWrite FsRtlPrepareMdlWriteDev FsRtlPrivateFastUnlockAll FsRtlReleaseFile FsRtlReleaseFileForCcFlush FsRtlReleaseFileForModWrite FsRtlReleaseFileNameInformation FsRtlStackOverflowRead FsRtlTeardownPerFileContexts FsRtlTeardownPerStreamContexts FsRtlUninitializeOplock FsRtlWorkerThread FsRtlpRemoveAndCompleteWaitingIrp FsRtlpWaitOnIrp GetBootSystemTime GxpReadFrameBufferPixels GxpWriteFrameBufferPixels HalAllocateAdapterChannelV2 HalAllocateCommonBuffer HalAllocateHardwareCounters HalAssignSlotResources HalBuildScatterGatherListV2 HalConfigureAdapterChannel HalCreateCommonBufferFromMdl HalCreateCommonBufferFromMdlDmaThin HalCreateCommonBufferFromMdlDmarThin HalDisableInterrupt HalDmaAllocateCrashDumpRegistersEx HalDmaFreeCrashDumpRegistersEx HalEnableInterrupt HalFreeCommonBuffer HalFreeCommonBufferDmaThin HalFreeCommonBufferDmarThin HalFreeCommonBufferV3 HalFreeCommonBufferVector HalFreeHardwareCounters HalGetAdapterV2 HalGetInterruptVector HalGetVectorInput HalJoinDmaDomain HalMapTransferEx HalMcFinishMicrocode HalPerformEndOfInterrupt HalReadDmaCounter HalReadDmaCounterV2 HalReturnToFirmware HalSendNMI HalSetProfileInterval HalStopProfileInterrupt HalTranslateBusAddress HaliAcpiSleep HaliLocateHiberRanges HaliRunPlatformDebugTriggers HalpAcpiDetectMachineSpecificActions HalpAcpiPmRegisterRead HalpAcpiPmRegisterWrite HalpAcpiPostSleep HalpAcpiPreSleep HalpAcquireCmosSpinLock HalpAddMcaToProcessorSpecificSection HalpAllocateAdapterCallbackV2 HalpAllocateAdapterCallbackV3 HalpAllocateCommonBufferDmaThin HalpAllocateCommonBufferDmarThin HalpAllocateCommonBufferVectorInternal HalpAllocateDmaResourcesInternal HalpAllocateDomainCommonBufferInternal HalpAllocatePmcCounterSetEx HalpApicClearLocalUnitError HalpApicConvertFromRte HalpApicGetCpuInfo HalpApicGetLocalUnitError HalpApicInitializeLocalUnit HalpApicIsCmciImplemented HalpApicQueryAndGetSource HalpApicReplaySendSelfIpi HalpApicRequestInterrupt HalpApicSaveLocalInterrupts HalpApicSetLineState HalpApicSetLogicalId HalpApicSetPriority HalpApicStartProcessor HalpApicTimerArm HalpApicTimerDiscover HalpApicTimerInitialize HalpApicTimerIsInvariant HalpApicTimerQueryCounter HalpApicTimerStop HalpApicWriteEndOfInterrupt HalpArtAvailable HalpBlkPoReadPerfIoPort HalpBlkPoReadPerfMsr HalpBlkPoRegisterIdleState HalpBlkPoWritePerfIoPort HalpBlkPoWritePerfMsr HalpCmciLoadThresholdConfiguration HalpCmciSetProcessorConfigAMD HalpCmciSetProcessorConfigIntel HalpCmciSetProcessorMiscConfigAMD HalpCmosRangeHandler HalpCompleteInitializeProfiling HalpConstructScatterGatherListDmaThin HalpConstructScatterGatherListDmarThin HalpCreateMcaMemoryErrorRecord HalpCreateMcaProcessorErrorRecord HalpCreateNMIErrorRecord HalpDisableSecondaryInterrupt HalpDmaAllocateChildAdapterV3 HalpDmaAllocateDomain HalpDmaControllerCancelTransfer HalpDmaControllerDpcRoutine HalpDmaControllerFlushChannel HalpDmaControllerInitializeController HalpDmaControllerInterruptRoutine HalpDmaControllerProgramChannel HalpDmaControllerQueryMaxFragments HalpDmaControllerReadDmaCounter HalpDmaControllerValidateRequestLineBinding HalpDmaDereferenceDomainObject HalpDmaFreeChildAdapter HalpDmaFreeLa HalpDmaGetIommuInterface HalpDmaGetReservedRegionsForHybridPassthroughDomain HalpDmaInitializeControllers HalpDmaInitializeDomainEarly HalpDmaPowerCriticalTransitionCallback HalpDmaProcessMapRegisterQueueV2 HalpDmaSyncMapBuffers HalpDmaSyncMapBuffersWithEmergencyResources HalpDpPostReplace HalpDpPreReplace HalpDpReplaceControl HalpDpReplaceTarget HalpDpReplayInterrupts HalpEnableSecondaryInterrupt HalpEnumerateEnvironmentVariablesWithFilter HalpExtInitExtensions HalpFreePmcCounterSet HalpGetCacheCoherency HalpGetMcaExtendedLogStatusBlock HalpGetMcaPcrContext HalpGetSetCmosData HalpHandleMachineCheck HalpHandleMaskUnmaskSecondaryInterrupt HalpHvCounterQueryCounter HalpHvEnterSleepState HalpHvEpCpuid HalpHvEpWriteMsr HalpHvGetMachineCheckContext HalpHvInitDiscard HalpHvInitMcaPcrContext HalpHvLpReadMultipleMsr HalpHvMapDeviceInterrupt HalpHvMapDeviceMsiRange HalpHvNotifyDebugDeviceAvailable HalpHvRetargetDeviceMsiInterrupt HalpHvRetargetIoApicDeviceInterrupt HalpHvSetMachineCheckHandlerState HalpHvSetMachineCheckRecoveryState HalpHvSetSleepStateProperty HalpHvStartProcessor HalpHvStartVirtualProcessor HalpHvTimerInitialize HalpHvUnmapDeviceInterrupt HalpHvUnmapDeviceMsiRange HalpHvVpStartEnabled HalpInitSystemHelper HalpInitializePnTimers HalpInitializeProfiling HalpInitializeTimers HalpInitializeUncoreProfiling HalpInterruptDpReplaceBegin HalpInterruptEnumerateUnmaskedInterrupts HalpInterruptEnumerateUnmaskedSecondaryInterrupts HalpInterruptGenerateMessage HalpInterruptGetHighestPriorityInterrupt HalpInterruptInitializeController HalpInterruptInitializeLocalUnit HalpInterruptLocalErrorService HalpInterruptOfflineProcessor HalpInterruptPerformDirectedEndOfInterrupt HalpInterruptRequestInterrupt HalpInterruptRequestSecondaryInterrupt HalpInterruptResetThisProcessor HalpInterruptRestoreClock HalpInterruptSaveReplayState HalpInterruptSendIpi HalpInterruptSetLineStateInternal HalpInterruptStandardEndOfInterrupt HalpInterruptStartProcessor HalpInterruptThermalService HalpInterruptUpdateLocalUnitIdentifier HalpIommuAcquireNewDomain HalpIommuAllocateDmaDomain HalpIommuAllocateRemappingTableEntry HalpIommuAttachDeviceDomain HalpIommuCreateDevice HalpIommuCreateDeviceInternal HalpIommuDeleteDevice HalpIommuDomainFreeLogicalAddressRange HalpIommuDomainGetLogicalAddressRange HalpIommuEnableInterrupts HalpIommuFlushDomainTB HalpIommuFreeDmaDomain HalpIommuFreeDomain HalpIommuFreeRemappingTableEntry HalpIommuGetAcpiDeviceMapCount HalpIommuGetDeviceId HalpIommuInitSystem HalpIommuInitializeAll HalpIommuInitializeDmaGuardPolicy HalpIommuInitializeDmarPageTable HalpIommuInterruptRoutine HalpIommuInvokeInterfaceStateChangeCallbacks HalpIommuJoinDmaDomain HalpIommuLeaveDmaDomain HalpIommuLocateFromDevice HalpIommuMapLogical HalpIommuMapLogicalRange HalpIommuMarkHiberPhase HalpIommuProcessReservationsInternal HalpIommuQueryAcpiDeviceMapping HalpIommuSetupMessageInterruptRouting HalpIommuUnblockDevice HalpIommuUpdateRemappingDestination HalpIommuUpdateRemappingTableEntry HalpIumGetNextVariableName HalpIumGetTime HalpIumGetVariable HalpIumQueryVariableInfo HalpIumResetSystem HalpIumSetTime HalpIumSetVariable HalpIvtProcessDrhdEntry HalpLeaveDmaDomain HalpLoadMicrocode HalpMapTransferV2 HalpMaskInterrupt HalpMcEnumerateAndSetPatchConfig HalpMcExportAllData HalpMcGetLoadConfiguration HalpMcUpdateInitialize HalpMcUpdateLock HalpMcUpdateMicrocode HalpMcUpdatePostUpdate HalpMcUpdateUnlock HalpMcaInitializeErrorSection HalpMcaPopulateErrorData HalpMcaProcessorBankClear HalpMcaProcessorBankConfigAmd HalpMcaQueueDpc HalpMcaSetProcessorConfig HalpMceHandlerCore HalpMemoryErrorDeferredHandler HalpMemoryErrorDeferredRecovery HalpPCIConfig HalpPCIPerformConfigAccess HalpPerfInterrupt HalpPmemErrorDeferredHandler HalpPmuProcessorCallbackDpcRoutine HalpPmuReservedResourcesProcessorCallback HalpPowerStateCallback HalpPowerWriteResetCommand HalpProcessorPrepareForIdle HalpProcessorResumeFromIdle HalpPutScatterGatherListDmarThin HalpQueryIommuReservedRegionInformation HalpQueryPrimaryInterruptInformation HalpQueryProfileInformation HalpReadExtendedMcaRegistersAMD HalpReadExtendedMcaRegistersIntel HalpReenableAcpi HalpRestartProfiling HalpRestoreDmaControllerState HalpRtcAcknowledgeInterrupt HalpRtcArmTimer HalpRtcFixedStall HalpRtcInitialize HalpRtcStop HalpScanForProfilingCorruption HalpSendPccCommand HalpSetMicrocodeSelfhostFlag HalpSetProfileSourceInterval HalpSetResumeTime HalpSetSystemInformation HalpSetTimer HalpShutdown HalpShutdownReset HalpStartPccCommand HalpStartProfileInterruptEx HalpStopLegacyUsbInterruptsInternal HalpTimerAlwaysOnClockInterrupt HalpTimerCalibratePerformanceCounter HalpTimerCaptureCloestAuxiliaryQpcPair HalpTimerCaptureCurrentAuxiliaryQpcPair HalpTimerClockActivate HalpTimerClockArm HalpTimerClockInitialize HalpTimerClockInterrupt HalpTimerClockInterruptStub HalpTimerClockIpiRoutine HalpTimerClockPowerChange HalpTimerClockStop HalpTimerConfigureInterrupt HalpTimerDelayedQueryCounter HalpTimerDetermineValidTimerPairReadLatency HalpTimerDpcRoutine HalpTimerEnableHypervisorTimer HalpTimerHypervisorInterruptStub HalpTimerInitialize HalpTimerInitializeClockPn HalpTimerInitializeHypervisorTimer HalpTimerInitializeProfiling HalpTimerMeasureFrequencies HalpTimerPerformanceCounterPowerChange HalpTimerProfileInterrupt HalpTimerProfilePowerChange HalpTimerPropagateQpcBiasUpdate HalpTimerQueryCycleCounter HalpTimerQueryHostPerformanceCounter HalpTimerReadTimerPairWithLatencyLimit HalpTimerRestartProfileInterrupt HalpTimerRestorePerformanceCounter HalpTimerRestoreProcessorCounter HalpTimerSavePerformanceCounter HalpTimerSetupMessageInterruptRouting HalpTimerStallCounterPowerChange HalpTimerStallExecutionProcessor HalpTimerStopAllTimers HalpTimerStopProfileInterrupt HalpTimerSwitchStallSource HalpTimerSwitchToNormalClock HalpTimerTestHypervisorTimer HalpTimerUpdateApiConsumers HalpTimerWatchdogPreResetInterrupt HalpTimerWatchdogStart HalpTimerWatchdogStop HalpTscDiscover HalpTscGetAttributes HalpUnmaskInterrupt HalpUsbLegacyScanBusForHandoff HalpUsbLegacyStopOhciInterrupt HalpUsbLegacyStopUhciInterrupt HalpVpptAcknowledgeInterrupt HalpVpptInitializePhysicalTimer HalpVpptStop HalpVpptUpdatePhysicalTimer HalpWdatProcessWdrtInternalData HalpWheaReadMsrAddress HalpWheaReadMsrMisc HalpWheaReadMsrStatus HalpWheaWriteMsrControl HalpWheaWriteMsrStatus HeadlessInit HsaInitializeInterruptRemapping HsaInitializeIommu HsaIommuSendCommand HvAnalyzeLogFiles HvExtendHivePrimaryFileValidDataLength HvFreeHivePartial HvHiveCleanup HvHiveStartEmptyClone HvHiveStartFileBacked HvHiveStartMemoryBacked HvLoadHive HvRecoverFlushProtocolStateFromFiles HvValidateOrInvalidatePrimaryFileHeader HvWriteExternal HvWriteHivePrimaryFile HvWriteLogFile HvlCrashdumpCallbackRoutine HvlDebuggerSupportInitialize HvlEnlightenProcessor HvlGetSharedPageVa HvlInvokeWheaErrorNotificationCallback HvlPrepareForRootCrashdump HvlResumeFromRootCrashdump HvlSkCrashdumpCallbackRoutine HvlStartBootLogicalProcessors HvlWheaInUsePageOfflineNotificationCallback HvlpComputeLpComparisonMetrics HvlpHandleIommuFaultMessage HvlpInitializeBootProcessor HvlpPhase0Enlightenments HvlpQueryApicIdAndNumaNode HvlpSelectLpSet HvlpSetupBootProcessorEarlyHypercallPages HvlpTryConfigureInterface HvpAddBin HvpAdjustBitmap HvpAllocateBin HvpAllocateMap HvpApplyLegacyLogFile HvpEnlistFreeCell HvpExpandMap HvpFreeBin HvpFreeHiveFreeDisplay HvpFreeMap HvpGetHiveHeader HvpGrowDirtyVectors HvpIncrementalLogFileEnumeratorAdvance HvpInitMap HvpReadHiveDataFromFile HvpReadLogEntryHeader HvpRecoverDataReadRoutine HvpShrinkMap IaLpssReadCmdStatus IaLpssReadPmcsr IaLpssSetPowerD0 IaLpssSetPowerD3 IaLpssWriteCmdStatus IaLpssWritePmcsr InbvAcquireDisplayOwnership InbvAcquireLock InbvCheckDisplayOwnership InbvDisplayString InbvEnableBootDriver InbvGetDisplayState InbvGetResourceAddress InbvIndicateProgress InbvIsBootDriverInstalled InbvNotifyDisplayOwnershipChange InbvNotifyDisplayOwnershipLost InbvPortGetByte InbvPortInitialize InbvPortPollOnly InbvPortPutByte InbvReleaseLock InbvReleaseResources InbvResetDisplay InbvSetFunction InbvSetProgressBarSubset InbvSetScrollRegion InbvSetTextColor InbvSetVirtualFrameBuffer InbvSolidColorFill InitBootProcessor IoAddProcessesToDump IoAllocateAdapterChannel IoAllocateController IoAllocateMdl IoAsynchronousPageWrite IoBoostThreadIoPriority IoCancelIrp IoCaptureLiveDump IoCreateDriver IoCreateStreamFileObjectEx2 IoCsqInsertIrpEx IoCsqRemoveIrp IoCsqRemoveNextIrp IoDemoteToTriageDump IoDumpStackResumeCapable IoEnumerateEnvironmentVariablesEx IoFlushAdapterBuffers IoFlushAdapterBuffersV2 IoFreeAdapterChannel IoFreeAdapterChannelV2 IoFreeController IoFreeMapRegisters IoFreeMdl IoGetDmaAdapter IoGetDumpStack IoGetDumpStackTransferSizes IoGetEnvironmentVariableEx IoGetIommuInterface IoGetIommuInterfaceEx IoInitSystemPreDrivers IoInitializeDumpStack IoMapTransfer IoNotifyDump IoProcessPassiveInterrupts IoPropagateIrpExtensionEx IoProvisionCrashDumpKey IoQueryEnvironmentVariableInfoEx IoRegisterFileSystem IoRevertFromDemotedDumpType IoSaveInitialBugCheckProgress IoSetEnvironmentVariableEx IoShutdownSystem IoStartPacket IoStopIoRateControl IoTranslateBusAddress IoUnregisterFileSystem IoUpdateBugCheckProgressEnvVariable IoUpdateDumpPhysicalRanges IoWriteCrashDump IofCallDriver IommuCreateAtsDevice IommuDeleteAtsDevice IommuDevicePowerChange IommuDisableDevicePasid IommuEnableDevicePasid IommuFinalizeDeviceReset IommuFlushAllPasid IommuFlushDomain IommuFlushTb IommuHvDevicePowerChange IommuHvFlushAllPasid IommuHvFlushTb IommuHvSetAddressSpace IommuProcessPageRequestQueue IommuRegisterInterfaceStateChangeCallback IommuSetAddressSpace IommupDeviceDisablePasidTaggedDma IommupDeviceDisableSvm IommupDeviceEnablePasidTaggedDma IommupDeviceEnableSvm IommupHvAttachPasidDevice IommupHvAttachPasidDeviceDomain IommupHvAttachPasidSubDeviceDomain IommupHvConfigureDeviceDomain IommupHvCreateSvmPasidSpace IommupHvDetachPasidDevice IommupHvDetachPasidDeviceDomain IommupHvDetachPasidSubDeviceDomain IommupHvDismissPageFault IommupHvFlushDeviceDomainVaList IommupHvFlushDomainTbs IommupHvGetDeviceAtsCapability IommupHvGetDeviceSvmCapabilities IommupHvGetPageFault IommupHvInitializeLibrary IommupHvInterruptRoutine IommupHvIsDmarStageCompatible IommupHvIsStage1DmarCompatible IommupHvMapDevice IommupHvMapDeviceIdentityRange IommupHvMapDeviceLogical IommupHvMapDeviceLogicalRange IommupHvRegisterDeviceId IommupHvSetRootFaultReportingReady IommupHvUnblockDefaultDma IommupHvUnmapDevice IommupHvUnmapDeviceIdentityRange IommupHvUnmapDeviceLogicalRange IommupHvUnregisterDeviceId IommupHvValidatePageRequestGpa IommupMapDeviceInternal IommupUnmapDeviceInternal IopAddRemoveReqDescs IopAllocRealFileObject IopAllocateMdl IopAllocatePassiveInterruptBlock IopAttachDeviceToDeviceStackSafe IopBoostThreadCallback IopBootAllocation IopBugCheckProgressEfiVariableServicesAvailable IopCallArbiter IopCallBootDriverReinitializationRoutines IopCallDriverReinitializationRoutines IopChildToRootTranslation IopCloseFile IopCommitConfiguration IopCompletePageWrite IopCompleteUnloadOrDelete IopConnectInterrupt IopConnectInterruptFullySpecified IopCreateFile IopCsqCancelRoutine IopDisableCrashDump IopDispatchSessionNotifications IopDumpCallAddPagesCallbacks IopDumpCallRemovePagesCallbacks IopDuplicateDetection IopEjectDevice IopEnumerateEnvironmentVariablesHal IopEnumerateEnvironmentVariablesTrEE IopFileUtilWalkDirectoryTreeHelper IopFreeMiniCompletionPacket IopGetBasicInformationFile IopInitializeBuiltinDriver IopInitializeCrashDump IopInitializeDeviceInstanceKey IopIoRateStartRateControl IopIrpStackProfilerDpcRoutine$fin$1 IopLiveDumpAddIptTraceBuffers IopLiveDumpAddTriageDumpData IopLiveDumpAllocateIptBuffers IopLiveDumpCallRemovePagesCallbacks IopLiveDumpGenerateIptSecondaryData IopLiveDumpMarkImportantDumpData IopLoadCrashdumpDriver IopLoadUnloadDriver IopMapTransfer IopNotifyAlreadyRegisteredFileSystems IopParentToRawTranslation IopParseDevice IopPassiveInterruptRealtimeWorker IopPassiveInterruptWorker IopPerfCompletionRoutine IopPoHandleIrp IopPortFindSuitableRange IopProcessIoTracking IopProcessWorkItem IopQueryInformation IopRaiseHardError IopReadFile IopRegistryCallback IopRegistryInitializeCallbacks IopReleaseDeviceResources IopRetestConfiguration IopRetrieveSystemDeviceName IopStartNextPacket IopStartNextPacketByKey IopSynchronousServiceTail IopTestConfiguration IopThreadStart IopTimerDispatch IopTimerDispatch$filt$2 IopTranslateAndAdjustReqDesc IopUncacheInterfaceInformation IopUnloadDriver IopUnloadSafeCompletion IopWriteFile IopWriteTriageDumpToFirmware IopXxxControlFile IopfCallDriver IopfCompleteRequest IovBuildDeviceIoControlRequest IovInitializeTimer IovpCancelRoutine IovpCompleteRequest2 IovpLocalCompletionRoutine IovpUnloadDriver IpmiLibpHandleErrorInterrupt IpmiLibpHandleReadInterrupt IpmiLibpHandleSendInterrupt IpmiLibpKcsBmcTransact IvtInitializeIdentityMappings IvtInitializeIommu IvtIommuSendCommand IvtIommuWaitCommand KdCallPowerHandlers KdEnterDebugger KdExitDebugger KdPowerTransitionEx KdPullRemoteFileEx KdpSendWaitContinue KdpSysReadBusData KdpSysWriteBusData KeBoostPriorityThread KeBugCheck2 KeCleanupImageTracepoints KeClockInterruptNotify KeConnectInterrupt KeConvertAuxiliaryCounterToPerformanceCounter KeConvertPerformanceCounterToAuxiliaryCounter KeCpuSetReportParkedProcessors KeEnumerateKernelStackSegments KeEnumerateProcessorDpcs KeEnumerateQueueApc KeFreezeExecution KeGenericProcessorCallback KeInitializeClock KeInitializeClockOtherProcessors KeInitializeEntropySystem KeInitializeTimerTable KeIpiGenericCall KeNumaInitialize KePrepareClockTimerForIdle KePrepareNonClockOwnerForIdle KeQueryAuxiliaryCounterFrequency KeQueryIntervalProfile KeQueryPerformanceCounter KeQueryWakeSource KeRecomputeCpuSetAffinityProcess KeRegisterProcessorChangeCallback KeRemoveQueueEx KeResumeClockTimerFromIdle KeRevertToUserMultipleGroupAffinityThread KeRundownApcQueues KeSetBasePriorityThread KeSetCpuSetsProcess KeSetSchedulingGroupRankBias KeSetSelectedCpuSetsThread KeSetSystemMultipleGroupAffinityThread KeSetThreadSchedulerAssist KeSetUserAffinityThread KeSetUserGroupAffinityThread KeSpecialUserApcKernelRoutine KeStallExecutionProcessor KeStartAllProcessors KeSuspendClockTimer KeSuspendClockTimerSafe KeSynchronizeExecution KeThawExecution KeUnmaskInterrupt KeUpdateThreadCpuSets KiAbProcessThreadLocks KiAbThreadUnboostCpuPriority KiAltReturnWorkerRoutine KiBalanceSetManagerDeferredRoutine$fin$0 KiBugCheckRecoveryCleanupFromCrashDump KiBugCheckRecoveryPrepareForCrashDump KiCallInterruptServiceRoutine KiCheckForThreadDispatch KiClearLastBranchRecordStack KiDeferredBugcheckRecoveryWorker KiDeliverApc KiDispatchCallout KiDispatchException KiDispatchInterrupt KiEntropyDpcRoutine KiExecuteAllDpcs KiExitDispatcher KiExpireTimer2 KiFinalizeTimer2Disablement KiFreezeTargetExecution KiGetNextTimerExpirationDueTime KiHandleBound KiHandleMultipleBugchecksDuringRecovery KiHvInterruptSubDispatch KiInitializeDynamicProcessorDpc KiInitiateGenericCallDpc KiIntSteerGetLineInformation KiIntSteerInit KiIntSteerSetDestination KiInterruptMessageDispatch KiInvokeBugCheckAddTriageDumpDataCallbacks KiInvokeBugCheckEntryCallbacks KiIpiGenericCallTarget KiIpiProcessRequests KiIpiSendRequestEx KiIsInterruptTypeSecondary KiLockServiceTable KiMaskInterruptInternal KiMaskSecondaryInterruptInternal KiOpGetPciConfigSpaceAccessInfoFromPhysicalAddress KiPerformExplicitGroupAssignment KiPopulateNodeInformation KiPreprocessFault KiProcessDeferredReadyList KiProcessExpiredTimerList KiProcessNMI KiProcessProfileList KiQueryProcessorNode KiQueryProximityNode KiReadyOutSwappedThreads KiRestoreClockTickRate KiResumeClockTimer KiRetireDpcList KiScanBugCheckCallbackList KiSetClockTickRate KiSetHeteroPolicyThread KiSetIntervalWorker KiSetLegacyAffinityThread KiSoftParkElectionDpcRoutine KiStartProfileTarget KiStopProfileTarget KiSwapThread KiSynchronizePassiveInterruptExecution KiTpHandleTrap KiTrackSystemCallEntry KiTrackSystemCallExit KiUnmaskSecondaryInterruptInternal KiUpdateProcessConcurrencyCounts KiUpdateTime KiUpdateVpBackingThreadPriorityDpcRoutine KiVmbusInterruptSubDispatch KseDriverUnloadImage KseDsCallbackHookAddDevice KseDsCallbackHookDriverStartIo KseDsCallbackHookDriverUnload KseDsCallbackHookIrpFunction KseDsCallbackHookIrpInternalDeviceControlFunction KseDsCallbackHookIrpPnpFunction KseDsCallbackHookIrpPowerFunction KseDsHookExAllocatePool KseDsHookExAllocatePoolWithTag KseDsHookExFreePool KseDsHookExFreePoolWithTag KseDsHookIoCreateDevice KseDsHookPoRequestPowerIrp KseHookExAllocatePoolWithTag KseHookMmGetVirtualForPhysical KseHookMmMapIoSpace KseHookQueryValueKey KsepApplyShimsToDriver KsepCacheInsert KsepCacheLookup KsepCacheReset KsepCacheUninitialize KsepCompletionSafeWrapper KxStartUserThread KyPlatformSwapStacksAndCall KySwitchKernelStackCallout LZNT1CompressChunk LsaCallAuthenticationPackage LsaDeregisterLogonProcess LsaFreeReturnBuffer LsaLogonUser LsaLookupAuthenticationPackage LsaRegisterLogonProcess MiActOnLargeKernelHalPages MiAddNonSecuredPagesToDump MiAddPhysicalPagesToCrashDump MiApplyImageHotPatchRequest MiCaptureSecureImageBaseAddress MiCrashdumpRemovePte MiCreateImageFileMap MiDeliverPicoExceptionForProbedPage MiDereferenceSessionFinal MiEnumerateBasePatches MiEnumerateSlabAllocators MiFilterCrashDumpPte MiGetNextPageTablePte MiGetSectionStrongImageReference MiImageRvaRawEnumFirst MiImageRvaRawEnumNext MiInitializeChannelRangesTemporary MiInitializeLargePageColorSizes MiInitializeNumaRangesTemporary MiInvokePatchCallback MiIterateOverPartitions MiMirrorPerformBlackWrites MiMirrorPerformBrownWrites MiMirrorVerify MiProcessKernelCfgImageLoadConfig MiProcessVmAccessedInfo MiRelocateImage MiRelocateImageAgain MiRemoveEnclavePagesFromDump MiRemovePendingBadPagesFromDump MiReplaceRotateWithDemandZero MiRotateToFrameBuffer MiValidateExistingImage MiValidateSectionCreate MiValidateSectionSigningPolicy MiWalkPageTablesRecursively MiWalkPageTablesRecursivelyNoSynch MiYieldPageTableWalk MmAddPrivateDataToCrashDump MmDuplicateMemory MmEnumerateSystemImages MmGetDumpRange MmMapMdl MmUpdateMdlTrackerForMdlSwitch NP_CONTEXT::NpLeafDerefInternal NP_CONTEXT::NpLeafRemoveInternal NP_CONTEXT::NpiLeafPageIn NP_CONTEXT::NpiPerformPageOut NtCompareSigningLevels NtConvertBetweenAuxiliaryCounterAndPerformanceCounter NtCreateKeyTransacted_Stub NtCreateUserProcess NtDeleteKey NtDeleteValueKey NtEnumerateKey NtEnumerateValueKey NtFlushKey NtLockFile NtOpenKeyTransactedEx_Stub NtPlugPlayControl NtPowerInformation NtQueryAuxiliaryCounterFrequency NtQueryInformationFile NtQueryInformationProcess NtQueryKey NtQueryMultipleValueKey NtQueryObject NtQuerySecurityObject NtQuerySecurityPolicy NtQueryValueKey NtQueueApcThreadEx2 NtSetCachedSigningLevel2 NtSetInformationKey NtSetSystemInformation NtSetValueKey NtUnlockFile ObCloseHandleTableEntry ObCreateObjectEx ObDeleteCapturedInsertInfo ObInsertObjectEx ObOpenObjectByNameEx ObQueryNameStringMode ObQuerySecurityObject ObReferenceObjectByNameEx ObSetSecurityObjectByPointer ObShutdownSystem ObpAllocateAndQuerySecurityDescriptorInfo ObpAssignSecurity ObpCallPostOperationCallbacks ObpCallPreOperationCallbacks ObpCaptureObjectName ObpCloseHandle ObpCreateHandle ObpDecrementHandleCount ObpFreeObject ObpFreeObjectNameBuffer ObpGetObjectSecurity ObpIncrementHandleCountEx ObpLookupObjectName ObpParseSymbolicLinkEx ObpRemoveObjectRoutine Ordinal_23 Ordinal_27 Ordinal_28 Ordinal_7 PcwAddInstance PcwCloseInstance PcwCreateInstance PcwRegister PcwUnregister PdcPortSendMessageSynchronously PdcpPortReleaseResources Pdcv2pActivationClientCallback PerfLogImageUnload PfFbBufferListFlushStandby PfFbLogEntryComplete PfFbLogEntryReserve PfFileInfoNotify PfSnNameQueryWorker PfSnVolumeKeyQuery PfpOpenHandleClose PfpOpenHandleCreate PiDaDispatch PiDaFastIoDispatch PiDevCfgCopyObjectProperties PiDevCfgEnumDeviceKeys PiDevCfgResolveVariable PiDmCmObjectMatchCallback PiDmEnumObjectsWithCallback PiDmGetObjectListCallback PiDmListEnumObjectsWithCallback PiDmPnpObjectMatchCallback PiDmaGuardProcessNewDeviceNode PiForEachDriverQueryRoutine PiGetDmaAdapterFromBusInterface PiIommuAllocateExtension PiIommuBlockDevice PiIommuGetInterface PiIommuUnblockDevice PiPnpRtlEnumDevicesCallback PiPnpRtlEnumeratorFilterCallback PiPnpRtlInterfaceFilterCallback PiPnpRtlServiceFilterCallback PiProcessDriversLoadedOnSecureDevice PiProcessNewDeviceNode PiQueryAndAllocateBootResources PiUpdateDeviceResourceLists PipCallDriverAddDevice PipCslUpdateState PipDmgInitPhaseZero PipDmgSaveDeviceDmarPolicy PipDmgSetIommuDomainPolicyAndNotifyHal PipEnumeratePersistedMemoryCallback PipForAllDeviceNodesCallback PipIommuRetrieveDeviceId PipProcessPendingObjects PipUnprotectDevice PnpBootDeviceWait PnpCallDriverEntry PnpCompleteDeviceEvent PnpGetDeviceLocationStrings PnpHandleProcessWalkWorker PnpNotifyDriverCallback PnpProcessCompletedEject PnpProcessQueryRemoveAndEject PnpReplacePartitionUnit PnpRequestDeviceEjectExWorker PnprEndMirroring PnprGetPageDestination PnprIdentifyUnits PnprInitiateReplaceOperation PnprLoadPluginDriver PnprMarkOrMirrorPages PnprMirrorMarkedPages PnprQueryReplaceFeatures PnprQuiesceProcessorDpc PnprQuiesceProcessors PnprReplaceStart PnprSwap PnprSwapFinalize PnprWakeProcessors PoFxPowerOnCrashdumpDevice PoFxProcessorNotification PoFxRegisterDebugger PoFxStartDevicePowerManagement PoFxSystemLatencyNotify PoInitHiberServices PoInitSystem PoInitiateProcessorWake PoIssueCoalescingNotification PopAllocateHiberContext PopCallPowerSettingCallback PopCaptureSleepStudyStatistics PopCheckpointSystemSleep PopCleanCoolingExtension PopCoalescingCallback PopConnectToPolicyDevice PopDecompressHiberBlocks PopDiagTraceFirmwareS3Stats PopDisableCoolingExtension PopDispatchShutdownEvent PopEvaluatePowerButtonSuppressionState PopExecuteProcessorCallback PopExternalMonitorUpdatedWorker PopFreeHiberContext PopFxAcpiForwardNotification PopFxAcpiForwardPepAcpiNotifyRequest PopFxAcpiForwardPepWorkRequest PopFxCompleteComponentPerfState PopFxDeliverDevicePowerRequired PopFxDispatchPluginWorkOnce PopFxHandleDirectedPowerTransition PopFxIdleTimeoutDpcRoutine PopFxIdleWorker PopFxIdleWorkerTail PopFxInvokeDripsWatchdogCallback PopFxLowPowerEpochCallback PopFxNotifySystemStateTransition PopFxPlatformIdleVeto PopFxProcessWork PopFxProcessWorkPool PopFxProcessorIdleVeto PopFxRequestCommon PopFxResetSocSubsystemAccounting PopFxTransitionCriticalResource PopFxUpdateDeviceIdleTimer PopFxUpdatePlatformIdleState PopFxUpdateProcessorIdleState PopGracefulShutdown PopHandleNextState PopHiberCheckResume PopHiberReadChecksums PopInitPlatformSettings PopInvokeSystemStateHandler PopIrpWorker PopMarkComponentsBootPhase PopNetSetResiliencyPhaseBias PopNotifyShutdownListener PopPdcAreAllPhasesDisengaged PopPdcCompleteResiliencyCallback PopPdcDisengagePhases PopPdcEngagePhases PopPdcInvocation PopPdcSnapDiagnosticContext PopPepCompleteActivity PopPepDeviceDState PopPepInitializeDebuggerMasks PopPepIterateDeviceList PopPepStartActivity PopPepTriggerActivity PopPlPublishSystemPowerChange PopPluginAbandonDevice PopPluginAcpiNotificationStrict PopPluginInitializeSocSubsystemStaticInfo PopPluginNotifyActive PopPluginNotifyIdleState PopPluginPrepareDevice PopPluginQueryComponentPerfCapabilities PopPluginQueryComponentPerfSet PopPluginQueryComponentPerfSetName PopPluginQueryComponentPerfStates PopPluginQueryCurrentComponentPerfState PopPluginQuerySocSubsystemBlockingTime PopPluginQuerySocSubsystemCount PopPluginQuerySocSubsystemMetadata PopPluginRegisterComponentPerfStates PopPluginRegisterCrashdumpDevice PopPluginRegisterDevice PopPluginRequestComponentIdleConstraints PopPluginRequestComponentPerfState PopPluginRequestDeviceIdleConstraints PopPluginRequestPowerControl PopPluginUnregisterDevice PopPolicyDeviceRemove PopPolicyWorkerAction PopPolicyWorkerNotify PopPolicyWorkerThread PopPowerAggregatorDisengageModernStandby PopPowerAggregatorEngageModernStandby PopPowerAggregatorHandleIntentUnsafe PopPowerAggregatorInvokeStateMachine PopPowerAggregatorNotifyDisplayPoweredOn PopPowerAggregatorSystemTransitionEnterStateHandler PopPowerAggregatorSystemTransitionExitStateHandler PopPowerButtonWorkCallback PopPowerInformationInternal PopPowerRequestCallbackExecutionRequired PopPowerRequestHandleRequestUpdate PopProcessorIdleSelectNotification PopProcessorNotifyLpiCoordinatedStatesNotification PopProcessorParkMaskNotification PopProcessorParkNotification PopProcessorQueryCoordinatedDependencyNotification PopProcessorQueryPlatformStateNotification PopPropogateCoolingChange PopQueryBootSessionStandbyActivationInfo PopRequestCompletion PopRequestRead PopRequestWrite PopRestoreHiberContext PopSaveHiberContext PopShutdownHandler PopSleepstudyCaptureResiliencyStatistics PopSleepstudyCaptureSessionStatistics PopSleepstudyRegisterSessionCallback PopSleepstudyStartNextSession PopSstDiagInitializeResumeTimer PopStateTransitionTimeoutDispatch PopSuspendResumeInvocation PopSwitchUpdateUserShutdownScenarioState PopThermalZoneDpc$filt$2 PopTransitionSystemPowerStateEx PopTriggerMonitorPowerEvent PopUmpoProcessPowerMessage PopUpdatePdcSystemIdleState PopWatchdogWorker PopWriteHiberPages PopWriteImageHeader PpmCheckComputeEnergy PpmCheckReportComplete PpmCheckRun PpmHvSnapPerformanceAccumulation PpmIdleCheckProcessorStateEligibility PpmIdleExecuteTransition PpmIdleGuestComplete PpmIdleGuestPreExecute PpmIdleGuestTest PpmIdlePrepare PpmIdleSelectStates PpmIdleWaitForDependentTransitions PpmInstallNewIdleStates PpmParkComputeUnparkMask PpmParkReportMask PpmParkSteerInterrupts PpmPdcNotifyMediaBufferingUpdate PpmPerfApplyDomainState PpmPerfApplyHiddenProcessorState PpmPerfApplyLatencyHint PpmPerfApplyProcessorState PpmPerfArbitratorApplyProcessorState PpmPerfCheckForIllegalProcessorThrottle PpmPerfControlExecuteAction PpmPerfFeedbackCounterRead PpmPerfFeedbackCounterUpdate PpmPerfGetVmPerfConfig PpmPerfQueryProcMeasurementValues PpmPerfSelectProcessorState PpmPerfUpdateHwDebugData PpmQueryPlatformStateResidency PpmRemoveIdleStates PpmResetPerfEngineForProcessor PpmSnapPerformanceAccumulation PpmUpdateProcessorPolicy PpmUpdateTargetProcessorPolicy PpvUtilCallAddDevice PrExtControlOperations PsCallImageNotifyRoutines PsCheckProcessFileSigningLevel PsConvertToGuiThread PsEnumProcessThreads PsEnumProcesses PsGetAllocatedFullProcessImageNameEx PsPicoSystemCallDispatch PsPicoWalkUserStack PsQueryActivityModerationUserSettings PsQueryProcessSignatureMitigationPolicy PsSetExeModerationState PsSetProcessFaultInformation PsSyscallProviderDispatch PsTestProtectedProcessIncompatibility PsUnregisterSiloMonitor PspAllocateProcess PspCallJobHierarchyCallbacks PspCallProcessNotifyRoutines PspCallThreadNotifyRoutines PspChangeProcessExecutionState PspDeferredWorkerRoutine PspDeleteSiloContext PspExitThread PspExpandLimit PspExpandQuota PspInvokeCreateCallback PspInvokeTerminateCallback PspNetRateControlDispatch PspProcessDelete PspReleaseReturnedQuota PspReturnResourceQuota PspSetRateControlJobPreCallback PspSetRateControlProcessCallback PspSyscallProviderOptIn PspSyscallProviderServiceDispatch PspSyscallProviderServiceDispatchGeneric PspSystemThreadStartup PspTerminateProcess PspThreadDelete RcConsolidateFrames ReadPortWithIndex16 ReadPortWithIndex32 ReadPortWithIndex8 ReadRegisterWithIndex16 ReadRegisterWithIndex32 ReadRegisterWithIndex64 ReadRegisterWithIndex8 RtlApplyHotPatch RtlCaptureRetpolineImportRvas RtlCompressBuffer RtlDecompressBuffer RtlDecompressBufferEx RtlDecompressBufferEx2 RtlDecompressFragment RtlDecompressFragmentEx RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl RtlDeleteElementGenericTableAvlEx RtlDescribeChunk RtlDestroyHeap RtlEnumerateBoundaryDescriptorEntries RtlEnumerateGenericTableLikeADirectory RtlEnumerateHotPatchPatches RtlFindLowerBoundInSortedArray RtlGetCompressionWorkSpaceSize RtlInsertElementGenericTableAvl RtlInsertElementGenericTableFull RtlInsertElementGenericTableFullAvl RtlInternEntryDereference RtlInternTableIntern RtlLookupElementGenericTable RtlLookupElementGenericTableAvl RtlLookupElementGenericTableFullAvl RtlLookupFirstMatchingElementGenericTableAvl RtlReserveChunk RtlRunOnceExecuteOnce RtlpAllocateHeapInternal RtlpCallQueryRegistryRoutine RtlpCompressRvaList RtlpConstructImportRelocationFixup RtlpFcLinearSearchInSortedArray RtlpFindAndCommitPages RtlpFlsDataCleanup RtlpFlsFree RtlpFreeHeapInternal RtlpGetRegistryHandle RtlpHpAllocateHeap RtlpHpFixedHeapCreate RtlpHpFixedVsCommit RtlpHpFreeHeap RtlpHpLfhBucketActivate RtlpHpLfhBucketAllocateSlot RtlpHpLfhSlotAllocate RtlpHpLfhSubsegmentCreate RtlpHpLfhSubsegmentDecommitPages RtlpHpLfhSubsegmentFree RtlpHpVsChunkFree RtlpHpVsChunkSplit RtlpHpVsSubsegmentCommitPages RtlpHpVsSubsegmentCreate RtlpHpVsSubsegmentFree RtlpInternEntryCreate RtlpInternHashBucketsAllocate RtlpInternHashBucketsFree RtlpIsRangeAvailable RtlpMakeXpressCallback RtlpQueryRegistryValues RtlpTraceDatabaseInternalAdd RtlpTraceDatabaseInternalFind SC_DEVICE::GetStorageProperty SC_DEVICE::Initialize SC_DEVICE::UpdateStorageProperty SC_DISK::GenerateId SC_DISK::Initialize SC_DISK::ReadSectors SC_DISK::WriteSectors SLQueryLicenseValueInternal SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogTimerCallback SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogWorker SMKM_STORE_MGR<struct_SM_TRAITS>::SmIoCtxQueueWork SMKM_STORE_MGR<struct_SM_TRAITS>::SmStoreMgrCallback SPCallServerHandleCheckLicense SPCallServerHandleClepKdf SPCallServerHandleClepSign SPCallServerHandleGetAppPolicyValue SPCallServerHandleGetCurrentHardwareID SPCallServerHandleGetLicenseChallenge SPCallServerHandleIsAppLicensed SPCallServerHandleRemoveLicense SPCallServerHandleUpdateLicense SPCallServerHandleUpdatePolicies SPCallServerHandleWaitForDisplayWindow SdbpCheckAllAttributes SdbpCheckMatchingDevice SdbpGetSystemSdbFilePath SdbpMatchList SdbpOpenCompressedDatabase SeCodeIntegrityInitializePolicy SeCodeIntegrityQueryInformation SeCodeIntegritySetInformationProcess SeCompareSigningLevels SeGetCachedSigningLevel SeGetImageRequiredSigningLevel SeQuerySigningPolicy SeReleaseImageValidationContext SeValidateImageData SeValidateImageHeader SepAppendAceToTokenObjectAcl SepDeleteAccessState SepDuplicateToken SepIsImageInMinTcbList SepNotifyFileSystems SepParseElamCertResources SepQueueWorkItem SepRmCallLsa SepRmCommandServerThread SiGetSystemDeviceName SmDecompressBuffer SmKmIssueFileIo SmKmStoreDelete SmKmStoreDeleteWhenEmpty SmKmStoreDeleteWhenEmptyWorker SmKmStoreHelperCommandCleanup SmKmStoreHelperCommandProcess SpiInit SpiSend16 SshpAlpcProcessMessage SshpSendSessionData TlgAggregateInternalRegisteredProviderEtwCallback TtmiSessionDeviceListWorker TtmpCallAssignedToTerminal TtmpCallSetDisplayState TtmpCallSetInputMode Uart16550GetByte Uart16550InitializePortCommon Uart16550PutByte Uart16550RxReady Uart16550SetBaudCommon VerifierCcCopyWrite VerifierCcCopyWriteEx VerifierCcDeferWrite VerifierCcFastCopyWrite VerifierCcWaitForCurrentLazyWriterActivity VerifierCmRegisterCallback VerifierCmRegisterCallbackEx VerifierCmUnRegisterCallback VerifierDbgBreakPointWithStatus VerifierEtwRegister VerifierEtwRegisterClassicProvider VerifierEtwUnregister VerifierExAcquireFastMutex VerifierExAcquireFastMutexUnsafe VerifierExAcquireResourceExclusiveLite VerifierExAcquireResourceSharedLite VerifierExAcquireRundownProtection VerifierExAcquireRundownProtectionCacheAware VerifierExAcquireRundownProtectionCacheAwareEx VerifierExAcquireRundownProtectionEx VerifierExAcquireSharedStarveExclusive VerifierExAcquireSharedWaitForExclusive VerifierExAllocateCacheAwareRundownProtection VerifierExAllocatePool VerifierExAllocatePool2 VerifierExAllocatePool3 VerifierExAllocatePoolEx VerifierExAllocatePoolWithQuota VerifierExAllocatePoolWithQuotaTag VerifierExAllocatePoolWithTag VerifierExAllocatePoolWithTagPriority VerifierExConvertExclusiveToSharedLite VerifierExCreateCallback VerifierExDeleteLookasideListEx VerifierExDeleteNPagedLookasideList VerifierExDeletePagedLookasideList VerifierExDeleteResourceLite VerifierExEnterCriticalRegionAndAcquireResourceExclusive VerifierExEnterCriticalRegionAndAcquireResourceShared VerifierExEnterCriticalRegionAndAcquireSharedWaitForExclusive VerifierExEnterPriorityRegionAndAcquireResourceExclusive VerifierExEnterPriorityRegionAndAcquireResourceShared VerifierExFreePool VerifierExFreePoolWithTag VerifierExGetExclusiveWaiterCount VerifierExGetSharedWaiterCount VerifierExInitializeLookasideListEx VerifierExInitializeNPagedLookasideList VerifierExInitializePagedLookasideList VerifierExInitializeResourceLite VerifierExInterlockedAddLargeInteger VerifierExInterlockedInsertHeadList VerifierExInterlockedInsertTailList VerifierExInterlockedPopEntryList VerifierExInterlockedPushEntryList VerifierExInterlockedRemoveHeadList VerifierExIsProcessorFeaturePresent VerifierExIsResourceAcquiredExclusiveLite VerifierExIsResourceAcquiredSharedLite VerifierExRaiseAccessViolation VerifierExRaiseDatatypeMisalignment VerifierExRaiseStatus VerifierExRegisterCallback VerifierExReinitializeResourceLite VerifierExReleaseFastMutex VerifierExReleaseFastMutexUnsafe VerifierExReleaseResourceAndLeaveCriticalRegion VerifierExReleaseResourceAndLeavePriorityRegion VerifierExReleaseResourceForThreadLite VerifierExReleaseResourceLite VerifierExReleaseRundownProtection VerifierExReleaseRundownProtectionCacheAware VerifierExReleaseRundownProtectionEx VerifierExSetResourceOwnerPointer VerifierExSetResourceOwnerPointerEx VerifierExSetTimerResolution VerifierExTryToAcquireFastMutex VerifierExUnregisterCallback VerifierExUuidCreate VerifierExWaitForRundownProtectionRelease VerifierExWaitForRundownProtectionReleaseCacheAware VerifierExfAcquirePushLockExclusive VerifierExfAcquirePushLockShared VerifierExfReleasePushLock VerifierExfReleasePushLockShared VerifierExfTryAcquirePushLockShared VerifierExfTryToWakePushLock VerifierExpInterlockedFlushSList VerifierExpInterlockedPopEntrySList VerifierExpInterlockedPushEntrySList VerifierFsRtlAllocateFileLock VerifierFsRtlAreNamesEqual VerifierFsRtlBalanceReads VerifierFsRtlCancellableWaitForMultipleObjects VerifierFsRtlCancellableWaitForSingleObject VerifierFsRtlCheckLockForReadAccess VerifierFsRtlCheckLockForWriteAccess VerifierFsRtlCopyWrite VerifierFsRtlDeregisterUncProvider VerifierFsRtlDissectName VerifierFsRtlDoesNameContainWildCards VerifierFsRtlFastCheckLockForRead VerifierFsRtlFastCheckLockForWrite VerifierFsRtlFastUnlockAll VerifierFsRtlFastUnlockAllByKey VerifierFsRtlFastUnlockSingle VerifierFsRtlFreeFileLock VerifierFsRtlGetFileSize VerifierFsRtlGetNextFileLock VerifierFsRtlIncrementCcFastReadNoWait VerifierFsRtlIncrementCcFastReadWait VerifierFsRtlInitializeFileLock VerifierFsRtlIsNameInExpression VerifierFsRtlMdlReadCompleteDev VerifierFsRtlMdlWriteCompleteDev VerifierFsRtlNotifyFilterChangeDirectory VerifierFsRtlNotifyFilterReportChange VerifierFsRtlNotifyFullChangeDirectory VerifierFsRtlNotifyFullReportChange VerifierFsRtlPrivateLock VerifierFsRtlProcessFileLock VerifierFsRtlRegisterUncProvider VerifierFsRtlRegisterUncProviderEx VerifierFsRtlRemoveDotsFromPath VerifierFsRtlUninitializeFileLock VerifierFsRtlValidateReparsePointBuffer VerifierHalExamineMBR VerifierIoAcquireCancelSpinLock VerifierIoAcquireRemoveLockEx VerifierIoAcquireVpbSpinLock VerifierIoAllocateController VerifierIoAllocateDriverObjectExtension VerifierIoAllocateErrorLogEntry VerifierIoAllocateIrp VerifierIoAllocateIrpEx VerifierIoAllocateMdl VerifierIoAllocateWorkItem VerifierIoAttachDevice VerifierIoAttachDeviceToDeviceStack VerifierIoAttachDeviceToDeviceStackSafe VerifierIoCancelIrp VerifierIoCheckShareAccess VerifierIoConnectInterrupt VerifierIoConnectInterruptEx VerifierIoCreateController VerifierIoCreateDevice VerifierIoCreateFile VerifierIoCreateFileEx VerifierIoCreateFileSpecifyDeviceObjectHint VerifierIoCreateNotificationEvent VerifierIoCreateSymbolicLink VerifierIoCreateSynchronizationEvent VerifierIoCreateUnprotectedSymbolicLink VerifierIoDeleteController VerifierIoDeleteDevice VerifierIoDeleteSymbolicLink VerifierIoDetachDevice VerifierIoDisconnectInterrupt VerifierIoDisconnectInterruptEx VerifierIoFreeController VerifierIoFreeMdl VerifierIoGetAttachedDeviceReference VerifierIoGetConfigurationInformation VerifierIoGetDeviceDirectory VerifierIoGetDeviceInterfaceAlias VerifierIoGetDeviceInterfaces VerifierIoGetDeviceNumaNode VerifierIoGetDeviceObjectPointer VerifierIoGetDeviceProperty VerifierIoGetDevicePropertyData VerifierIoGetDeviceToVerify VerifierIoGetDriverDirectory VerifierIoGetFileObjectGenericMapping VerifierIoGetInitialStack VerifierIoInitializeIrp VerifierIoInitializeRemoveLockEx VerifierIoInitializeWorkItem VerifierIoInvalidateDeviceRelations VerifierIoIsWdmVersionAvailable VerifierIoOpenDeviceInterfaceRegistryKey VerifierIoOpenDeviceRegistryKey VerifierIoOpenDriverRegistryKey VerifierIoRaiseHardError VerifierIoRaiseInformationalHardError VerifierIoReadPartitionTable VerifierIoReadPartitionTableEx VerifierIoRegisterBootDriverReinitialization VerifierIoRegisterDeviceInterface VerifierIoRegisterDriverReinitialization VerifierIoRegisterLastChanceShutdownNotification VerifierIoRegisterPlugPlayNotification VerifierIoRegisterShutdownNotification VerifierIoReleaseCancelSpinLock VerifierIoReleaseRemoveLockAndWaitEx VerifierIoReleaseRemoveLockEx VerifierIoReleaseVpbSpinLock VerifierIoRemoveShareAccess VerifierIoReplacePartitionUnit VerifierIoReportDetectedDevice VerifierIoReportTargetDeviceChange VerifierIoReportTargetDeviceChangeAsynchronous VerifierIoReuseIrp VerifierIoSetCompletionRoutineEx VerifierIoSetDeviceInterfaceState VerifierIoSetDevicePropertyData VerifierIoSetDeviceToVerify VerifierIoSetPartitionInformation VerifierIoSetPartitionInformationEx VerifierIoSetShareAccess VerifierIoSetStartIoAttributes VerifierIoStartNextPacket VerifierIoUnregisterPlugPlayNotification VerifierIoUnregisterPlugPlayNotificationEx VerifierIoUnregisterShutdownNotification VerifierIoUpdateShareAccess VerifierIoVolumeDeviceToDosName VerifierIoWMIAllocateInstanceIds VerifierIoWMIRegistrationControl VerifierIoWMIWriteEvent VerifierIoWriteErrorLogEntry VerifierIoWritePartitionTable VerifierIoWritePartitionTableEx VerifierIofCompleteRequest VerifierKeAcquireGuardedMutex VerifierKeAcquireGuardedMutexUnsafe VerifierKeAcquireInStackQueuedSpinLockAtDpcLevel VerifierKeAcquireInStackQueuedSpinLockCommon VerifierKeAcquireInStackQueuedSpinLockForDpc VerifierKeAcquireInStackQueuedSpinLockRaiseToSynch VerifierKeAcquireInterruptSpinLock VerifierKeAcquireQueuedSpinLock VerifierKeAcquireQueuedSpinLockRaiseToSynch VerifierKeAcquireSpinLockAtDpcLevel VerifierKeAcquireSpinLockForDpc VerifierKeAcquireSpinLockRaiseToDpc VerifierKeAreAllApcsDisabled VerifierKeAreApcsDisabled VerifierKeCancelTimer VerifierKeClearEvent VerifierKeDelayExecutionThread VerifierKeDeregisterNmiCallback VerifierKeEnterCriticalRegion VerifierKeEnterGuardedRegion VerifierKeFlushQueuedDpcs VerifierKeInitializeDeviceQueue VerifierKeInitializeEvent VerifierKeInitializeGuardedMutex VerifierKeInitializeMutant VerifierKeInitializeMutex VerifierKeInitializeSemaphore VerifierKeInitializeTimer VerifierKeInitializeTimerEx VerifierKeInsertByKeyDeviceQueue VerifierKeInsertDeviceQueue VerifierKeInsertHeadQueue VerifierKeInsertQueue VerifierKeInsertQueueDpc VerifierKeLeaveCriticalRegion VerifierKeLeaveGuardedRegion VerifierKeLowerIrql VerifierKePulseEvent VerifierKeQueryPriorityThread VerifierKeQueryRuntimeThread VerifierKeReadStateEvent VerifierKeReadStateMutex VerifierKeReadStateSemaphore VerifierKeReadStateTimer VerifierKeRegisterNmiCallback VerifierKeReleaseGuardedMutex VerifierKeReleaseGuardedMutexUnsafe VerifierKeReleaseInStackQueuedSpinLock VerifierKeReleaseInStackQueuedSpinLockForDpc VerifierKeReleaseInStackQueuedSpinLockFromDpcLevel VerifierKeReleaseInterruptSpinLock VerifierKeReleaseMutant VerifierKeReleaseMutex VerifierKeReleaseQueuedSpinLock VerifierKeReleaseSemaphore VerifierKeReleaseSpinLock VerifierKeReleaseSpinLockForDpc VerifierKeReleaseSpinLockFromDpcLevel VerifierKeRemoveByKeyDeviceQueue VerifierKeRemoveDeviceQueue VerifierKeRemoveEntryDeviceQueue VerifierKeRemoveQueue VerifierKeRemoveQueueDpc VerifierKeResetEvent VerifierKeRestoreExtendedProcessorState VerifierKeSaveExtendedProcessorState VerifierKeSetEvent VerifierKeSetSystemGroupAffinityThread VerifierKeSetTimer VerifierKeSetTimerEx VerifierKeSynchronizeExecution VerifierKeTestSpinLock VerifierKeTryToAcquireGuardedMutex VerifierKeTryToAcquireQueuedSpinLock VerifierKeTryToAcquireQueuedSpinLockRaiseToSynch VerifierKeTryToAcquireSpinLockAtDpcLevel VerifierKeWaitForMultipleObjects VerifierKeWaitForSingleObject VerifierMmAddPhysicalMemory VerifierMmAllocateContiguousMemory VerifierMmAllocateContiguousMemoryEx VerifierMmAllocateContiguousMemorySpecifyCache VerifierMmAllocateContiguousMemorySpecifyCacheNode VerifierMmAllocateContiguousNodeMemory VerifierMmAllocateMappingAddress VerifierMmAllocateNodePagesForMdlEx VerifierMmAllocateNonCachedMemory VerifierMmAllocatePagesForMdl VerifierMmAllocatePagesForMdlEx VerifierMmBuildMdlForNonPagedPool VerifierMmCreateMdl VerifierMmCreateMirror VerifierMmCreateSection VerifierMmDoesFileHaveUserWritableReferences VerifierMmFreeContiguousMemory VerifierMmFreeContiguousMemorySpecifyCache VerifierMmFreeNonCachedMemory VerifierMmFreePagesFromMdl VerifierMmGetPhysicalMemoryRanges VerifierMmGetSystemRoutineAddress VerifierMmLockPagableDataSection VerifierMmLockPagableSectionByHandle VerifierMmMapIoSpace VerifierMmMapLockedPages VerifierMmMapLockedPagesSpecifyCache VerifierMmMapLockedPagesWithReservedMapping VerifierMmMapViewOfSection VerifierMmPageEntireDriver VerifierMmPrefetchPages VerifierMmProbeAndLockPages VerifierMmProbeAndLockProcessPages VerifierMmProtectMdlSystemAddress VerifierMmRemovePhysicalMemory VerifierMmResetDriverPaging VerifierMmSecureVirtualMemory VerifierMmUnlockPagableImageSection VerifierMmUnlockPages VerifierMmUnmapIoSpace VerifierMmUnmapLockedPages VerifierMmUnsecureVirtualMemory VerifierNtCreateFile VerifierNtCreateSection VerifierNtDeleteFile VerifierNtLockFile VerifierNtMapViewOfSection VerifierNtOpenFile VerifierNtReadFile VerifierNtSetInformationFile VerifierNtUnlockFile VerifierNtWriteFile VerifierObGetObjectSecurity VerifierObReferenceObjectByHandle VerifierObReferenceObjectByHandleWithTag VerifierObReferenceObjectByPointer VerifierObReferenceObjectByPointerWithTag VerifierObReleaseObjectSecurity VerifierObfDereferenceObject VerifierObfDereferenceObjectWithTag VerifierObfReferenceObject VerifierObfReferenceObjectWithTag VerifierPoCallDriver VerifierPoFxActivateComponent VerifierPoFxCompleteDevicePowerNotRequired VerifierPoFxCompleteIdleCondition VerifierPoFxCompleteIdleState VerifierPoFxIdleComponent VerifierPoFxNotifySurprisePowerOn VerifierPoFxPowerControl VerifierPoFxRegisterDevice VerifierPoFxReportDevicePoweredOn VerifierPoFxSetComponentLatency VerifierPoFxSetComponentResidency VerifierPoFxSetComponentWake VerifierPoFxSetDeviceIdleTimeout VerifierPoFxStartDevicePowerManagement VerifierPoFxUnregisterDevice VerifierPoRequestPowerIrp VerifierPortExAllocatePoolWithQuotaTag VerifierPortExAllocatePoolWithTagPriority VerifierPortIoAllocateIrp VerifierPortIoAllocateMdl VerifierPortIoAllocateWorkItem VerifierPortKeReleaseSpinLock VerifierProbeForRead VerifierProbeForWrite VerifierPsAssignImpersonationToken VerifierPsCreateSystemThread VerifierPsDereferenceImpersonationToken VerifierPsDereferencePrimaryToken VerifierPsDisableImpersonation VerifierPsGetVersion VerifierPsImpersonateClient VerifierPsReferenceImpersonationToken VerifierPsReferencePrimaryToken VerifierPsRemoveLoadImageNotifyRoutine VerifierPsRestoreImpersonation VerifierPsRevertToSelf VerifierPsSetCreateProcessNotifyRoutine VerifierPsSetCreateProcessNotifyRoutineEx VerifierPsSetCreateThreadNotifyRoutine VerifierPsSetLoadImageNotifyRoutine VerifierPsTerminateSystemThread VerifierRtlAnsiStringToUnicodeString VerifierRtlCheckRegistryKey VerifierRtlCompareUnicodeString VerifierRtlCreateRegistryKey VerifierRtlCreateSystemVolumeInformationFolder VerifierRtlCreateUnicodeString VerifierRtlDeleteRegistryValue VerifierRtlDowncaseUnicodeChar VerifierRtlDowncaseUnicodeString VerifierRtlDuplicateUnicodeString VerifierRtlEqualUnicodeString VerifierRtlFreeUnicodeString VerifierRtlGUIDFromString VerifierRtlGenerateClass5Guid VerifierRtlHashUnicodeString VerifierRtlOemStringToCountedUnicodeString VerifierRtlOemStringToUnicodeString VerifierRtlQueryRegistryValueWithFallback VerifierRtlQueryRegistryValues VerifierRtlQueryRegistryValuesEx VerifierRtlStringFromGUID VerifierRtlUTF8ToUnicodeN VerifierRtlUnicodeStringToAnsiString VerifierRtlUnicodeStringToCountedOemString VerifierRtlUnicodeStringToOemString VerifierRtlUnicodeToUTF8N VerifierRtlUpcaseUnicodeChar VerifierRtlUpcaseUnicodeString VerifierRtlUpcaseUnicodeStringToAnsiString VerifierRtlUpcaseUnicodeStringToCountedOemString VerifierRtlUpcaseUnicodeStringToOemString VerifierRtlWriteRegistryValue VerifierRtlxAnsiStringToUnicodeSize VerifierRtlxUnicodeStringToAnsiSize VerifierSeAccessCheck VerifierSeAssignSecurity VerifierSeAssignSecurityEx VerifierSeDeassignSecurity VerifierSeLockSubjectContext VerifierSeReleaseSubjectContext VerifierSeSinglePrivilegeCheck VerifierSeUnlockSubjectContext VerifierSeValidSecurityDescriptor VerifierZwAccessCheckAndAuditAlarm VerifierZwAddBootEntry VerifierZwAddDriverEntry VerifierZwAdjustPrivilegesToken VerifierZwAllocateLocallyUniqueId VerifierZwAllocateVirtualMemory VerifierZwAlpcAcceptConnectPort VerifierZwAlpcConnectPort VerifierZwAlpcCreatePort VerifierZwAlpcCreatePortSection VerifierZwAlpcCreateResourceReserve VerifierZwAlpcCreateSectionView VerifierZwAlpcCreateSecurityContext VerifierZwAlpcQueryInformation VerifierZwAlpcSendWaitReceivePort VerifierZwAlpcSetInformation VerifierZwCancelIoFile VerifierZwCancelTimer VerifierZwClose VerifierZwCloseObjectAuditAlarm VerifierZwCommitComplete VerifierZwCommitEnlistment VerifierZwCommitTransaction VerifierZwConnectPort VerifierZwCreateDirectoryObject VerifierZwCreateEnlistment VerifierZwCreateEvent VerifierZwCreateFile VerifierZwCreateJobObject VerifierZwCreateKey VerifierZwCreateKeyTransacted VerifierZwCreateResourceManager VerifierZwCreateSection VerifierZwCreateSymbolicLinkObject VerifierZwCreateTimer VerifierZwCreateTransaction VerifierZwCreateTransactionManager VerifierZwDeleteBootEntry VerifierZwDeleteFile VerifierZwDeleteKey VerifierZwDeleteValueKey VerifierZwDeviceIoControlFile VerifierZwDisplayString VerifierZwDuplicateObject VerifierZwDuplicateToken VerifierZwEnumerateBootEntries VerifierZwEnumerateDriverEntries VerifierZwEnumerateKey VerifierZwEnumerateTransactionObject VerifierZwEnumerateValueKey VerifierZwFlushBuffersFile VerifierZwFlushBuffersFileEx VerifierZwFlushInstructionCache VerifierZwFlushKey VerifierZwFlushVirtualMemory VerifierZwFreeVirtualMemory VerifierZwFsControlFile VerifierZwGetNotificationResourceManager VerifierZwLoadDriver VerifierZwLoadKey VerifierZwLockFile VerifierZwMapViewOfSection VerifierZwModifyBootEntry VerifierZwModifyDriverEntry VerifierZwNotifyChangeKey VerifierZwOpenDirectoryObject VerifierZwOpenEnlistment VerifierZwOpenEvent VerifierZwOpenFile VerifierZwOpenJobObject VerifierZwOpenKey VerifierZwOpenKeyEx VerifierZwOpenKeyTransacted VerifierZwOpenKeyTransactedEx VerifierZwOpenProcess VerifierZwOpenProcessToken VerifierZwOpenProcessTokenEx VerifierZwOpenResourceManager VerifierZwOpenSection VerifierZwOpenSymbolicLinkObject VerifierZwOpenThread VerifierZwOpenThreadToken VerifierZwOpenThreadTokenEx VerifierZwOpenTimer VerifierZwOpenTransaction VerifierZwOpenTransactionManager VerifierZwPowerInformation VerifierZwPrePrepareComplete VerifierZwPrePrepareEnlistment VerifierZwPrepareComplete VerifierZwPrepareEnlistment VerifierZwProtectVirtualMemory VerifierZwPulseEvent VerifierZwQueryBootEntryOrder VerifierZwQueryBootOptions VerifierZwQueryDefaultLocale VerifierZwQueryDefaultUILanguage VerifierZwQueryDirectoryFile VerifierZwQueryDirectoryFileEx VerifierZwQueryDirectoryObject VerifierZwQueryDriverEntryOrder VerifierZwQueryEaFile VerifierZwQueryFullAttributesFile VerifierZwQueryInformationEnlistment VerifierZwQueryInformationFile VerifierZwQueryInformationJobObject VerifierZwQueryInformationProcess VerifierZwQueryInformationResourceManager VerifierZwQueryInformationThread VerifierZwQueryInformationToken VerifierZwQueryInformationTransaction VerifierZwQueryInformationTransactionManager VerifierZwQueryInstallUILanguage VerifierZwQueryKey VerifierZwQueryLicenseValue VerifierZwQueryObject VerifierZwQueryQuotaInformationFile VerifierZwQuerySection VerifierZwQuerySecurityObject VerifierZwQuerySymbolicLinkObject VerifierZwQuerySystemInformation VerifierZwQueryValueKey VerifierZwQueryVolumeInformationFile VerifierZwReadFile VerifierZwReadOnlyEnlistment VerifierZwRecoverEnlistment VerifierZwRecoverTransactionManager VerifierZwRemoveIoCompletionEx VerifierZwRenameKey VerifierZwReplaceKey VerifierZwRequestWaitReplyPort VerifierZwResetEvent VerifierZwRestoreKey VerifierZwRollbackComplete VerifierZwRollbackEnlistment VerifierZwRollbackTransaction VerifierZwSetBootEntryOrder VerifierZwSetBootOptions VerifierZwSetDriverEntryOrder VerifierZwSetEaFile VerifierZwSetEvent VerifierZwSetInformationEnlistment VerifierZwSetInformationFile VerifierZwSetInformationJobObject VerifierZwSetInformationKey VerifierZwSetInformationObject VerifierZwSetInformationProcess VerifierZwSetInformationResourceManager VerifierZwSetInformationThread VerifierZwSetInformationToken VerifierZwSetInformationTransaction VerifierZwSetQuotaInformationFile VerifierZwSetSecurityObject VerifierZwSetSystemInformation VerifierZwSetSystemTime VerifierZwSetTimer VerifierZwSetTimerEx VerifierZwSetValueKey VerifierZwSetVolumeInformationFile VerifierZwTerminateProcess VerifierZwTranslateFilePath VerifierZwUnloadDriver VerifierZwUnloadKey VerifierZwUnlockFile VerifierZwUnmapViewOfSection VerifierZwWaitForMultipleObjects VerifierZwWaitForSingleObject VerifierZwWriteFile VfAllocateAdapterChannel VfAllocateAdapterChannelEx VfAllocateCommonBuffer VfAllocateCommonBufferEx VfAllocateCommonBufferVector VfAllocateCommonBufferWithBounds VfAllocateCrashDumpRegisters VfAllocateCrashDumpRegistersEx VfAllocateDomainCommonBuffer VfAvlEnumerateNodes VfBuildMdlFromScatterGatherList VfBuildScatterGatherList VfBuildScatterGatherListEx VfCalculateScatterGatherListSize VfCancelAdapterChannel VfCancelMappedTransfer VfConfigureAdapterChannel VfCreateCommonBufferFromMdl VfExAllocPoolInternal VfFlushAdapterBuffers VfFlushAdapterBuffersEx VfFlushDmaBuffer VfFreeAdapterChannel VfFreeAdapterObject VfFreeCommonBuffer VfFreeCommonBufferFromVector VfFreeCommonBufferVector VfFreeCrashDumpRegistersEx VfFreeMapRegisters VfGetCommonBufferFromVectorByIndex VfGetDmaAdapter VfGetDmaAdapterInfo VfGetDmaAlignment VfGetDmaDomain VfGetDmaTransferInfo VfGetScatterGatherList VfGetScatterGatherListEx VfHalAllocateMapRegisters VfInitializeDmaTransferContext VfIoFreeIrp VfIrpDatabaseEntryReleaseLock VfJoinDmaDomain VfLeaveDmaDomain VfMajorAdvanceIrpStatus VfMajorBuildIrpLogEntry VfMajorIsNewRequest VfMajorIsValidIrpStatus VfMajorTestStartedPdoStack VfMajorVerifyFinalIrpStack VfMajorVerifyIrpStackDownward VfMajorVerifyIrpStackUpward VfMajorVerifyNewIrp VfMajorVerifyNewRequest VfMapTransfer VfMapTransferEx VfNotifyOfHibernate VfPendingMoreProcessingRequired VfPutDmaAdapter VfPutScatterGatherList VfQueryDispatchTable VfReadDmaCounter VfRemoveContext ViAdapterCallback ViCtxIsr ViCtxIsrMessageBased ViKeAcquireSpinLockCommon ViPendingCompleteAfterWait ViPtCaptureTraceInformationCallBack ViScatterGatherCallback ViSpecialAllocateCommonBuffer ViSpecialFreeCommonBuffer ViXdvDriverLoadImage ViXdvSetXdvKernelUtilities VmpCleanProcessAddressSpace VmpPrefetchVirtualAddresses VslHandleKsrCall VslpIumPhase0Initialize WdInstrExecuteInstruction WdtpBarkWorkerThread WdtpTimerCallback WheaFlushETWEventsWorkerRoutine WheaInitialize WheaReportHwError WheaSignalHandlerOverride WheapCallErrorSourceCorrect WheapCallErrorSourceInitialize WheapCallErrorSourceRecover WheapCallErrorSourceUninitialize WheapCallInUsePageNotificationCallbacks WheapDeferredRecoveryServiceDpcRoutine WheapDeferredRecoveryServiceWorker WheapGenericErrSrcRecover WheapLogIpmiSELEventHighIrql WheapReportBootError WheapWorkQueueWorkerRoutine WmipForwardWmiIrp WmipProcessEvent WmipUnreferenceEntry WritePortWithIndex16 WritePortWithIndex32 WritePortWithIndex8 WriteRegisterWithIndex16 WriteRegisterWithIndex32 WriteRegisterWithIndex64 WriteRegisterWithIndex8 XdvExInitializeLookasideListExInternal XdvExInitializeNPagedLookasideListInternal XdvIoAllocateIrp XdvIoAllocateMdl XdvIoAllocateWorkItem XdvIoBuildDeviceIoControlRequest XdvIoBuildSynchronousFsdRequest XdvIopBuildAsynchronousFsdRequest XmEmulateStream XmInt1aFindPciClassCode XmInt1aFindPciDevice XmInt1aReadConfigRegister XmInt1aWriteConfigRegister _CmAddDeviceToContainer _CmAddPanelDevice _CmClassFilterCallback _CmClassSubkeyCallback _CmContainerListGenericObjectCallback _CmCreateDevice _CmCreateDeviceContainer _CmCreateDeviceInterface _CmCreateDevicePanel _CmCreateInstallerClass _CmCreateInterfaceClass _CmDeleteCommonClassRegKey _CmDeleteDevice _CmDeleteDeviceContainer _CmDeleteDeviceContainerRegKey _CmDeleteDeviceInterface _CmDeleteDeviceInterfaceRegKey _CmDeleteDevicePanel _CmDeleteDevicePanelRegKey _CmDeleteDeviceRegKey _CmDeleteInstallerClass _CmDeleteInterfaceClass _CmDeviceClassesSubkeyCallback _CmDevicePanelEnumSubkeyCallback _CmEnumDevicesInContainerWithCallback _CmEnumDevicesInContainerWithCallbackWorker _CmEnumSubkeyCallback _CmGetDeviceRegProp _CmGetInstallerClassRegProp _CmGetMatchingCommonClassList _CmGetMatchingDeviceContainerList _CmGetMatchingDeviceInterfaceList _CmGetMatchingDeviceList _CmGetMatchingDevicePanelList _CmGetMatchingFilteredDeviceInterfaceList _CmGetMatchingFilteredDeviceList _CmIsDeviceInterfaceEnabled _CmOpenCommonClassRegKey _CmOpenDeviceContainerRegKey _CmOpenDeviceInterfaceRegKey _CmOpenDevicePanelRegKey _CmOpenDeviceRegKey _CmRaiseCreateEvent _CmRaiseDeleteEvent _CmRaisePropertyChangeEvent _CmRemoveDeviceFromContainer _CmRemovePanelDevice _CmServiceFilterCallback _CmSetDeviceRegProp _CmSetInstallerClassRegProp _NtPlugPlayGetDeviceProperty _NtPlugPlayGetDeviceRelatedDevice _NtPlugPlayGetDeviceRelationsList _NtPlugPlayGetDeviceStatus _PnpCmMatchCallbackRoutine _PnpContainerRaiseDevicesChangeEvent _PnpCreateObject _PnpCreateObjectDispatch _PnpCtxInternalEnumKeyCallback _PnpCtxRegQueryValueIndirect _PnpDeleteObject _PnpDeleteObjectDispatch _PnpDeviceRaisePropertyChangeEventWorker _PnpGetMappedPropertyDispatch _PnpGetMappedPropertyKeysDispatch _PnpGetMappedPropertyLocalesDispatch _PnpGetObjectList _PnpGetObjectListDispatch _PnpGetObjectProperty _PnpGetObjectPropertyKeys _PnpGetObjectPropertyLocales _PnpInstallerClassRaisePropertyChangeEventWorker _PnpInterfaceClassRaisePropertyChangeEventWorker _PnpInterfaceRaisePropertyChangeEventWorker _PnpNotifyDerivedKeys _PnpObjectListCallback _PnpObjectRaiseCreateEvent _PnpObjectRaiseDeleteEvent _PnpObjectRaiseDevicesChangeEvent _PnpObjectRaisePropertyChangeEvent _PnpOpenObjectRegKey _PnpOpenObjectRegKeyDispatch _PnpSetMappedPropertyDispatch _PnpSetObjectProperty _PnpUpdateInterfacesCallback _PnpValidateObjectName _PnpValidateObjectNameDispatch _RegRtlOpenKeyTransacted _SysCtxInternalEnumSubkeyCallback _tlgEnableCallback entry pIoQueryBusDescription pIoQueryDeviceDescription qsort qsort_s vDbgPrintExWithPrefixInternal wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState x86BiosGetPciBusData x86BiosReadPciDataPort x86BiosSetPciBusData x86BiosWritePciDataPort
Expand for full list: AlpcpAllocateBlob AlpcpDeleteBlob AlpcpDestroyBlob AlpcpInvokeLogCallbacks AlpcpUnlockBlob Amd64OverflowHandler AnFwDisplayBackgroundUpdate AnFwpBackgroundUpdateTimer ArbAllocateEntry ArbArbiterHandler ArbBootAllocation ArbBuildAssignmentOrdering ArbFindSuitableRange ArbInitializeRangeList ArbQueryConflict ArbRetestAllocation ArbStartArbiter ArbTestAllocation ArbpBuildAlternative AslLogCallPrintf BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSetProperty B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeWalkPostOrderInternal BapdRecordFirmwareBootStats BapdpKsrCancelScenario BapdpKsrCompleteScenario BapdpKsrCompleteScenarioPhase0 BapdpKsrInitiateScenarioPhase0 BapdpKsrpInitiateScenario BcpDisplayEarlyBugCheckScreen BgkAcquireDisplayOwnership BgkDisplayCharacter BgkDisplayStringEx BgkGetConsoleState BgkGetCursorState BgkInitialize BgkNotifyDisplayOwnershipChange BgkSetCursor BgkSetTextColor BgkSolidColorFill BgkpResetDisplay BvgaAcquireDisplayOwnership CarLiveDumpCallBack CcAcquireByteRangeForWrite CcAllocateWorkQueueEntry CcCompleteAsyncRead CcCompleteAsyncRead$fin$1 CcDeferWrite CcForEachNumaNode CcForEachPartition CcForEachPrivateVolumeCacheMap CcFreeWorkQueueEntry CcGetDirtyPagesHelper CcMdlReadComplete CcMdlWriteComplete CcNotifyExternalCachesInternal CcPerformReadAhead CcPerformReadAhead$fin$1 CcPostDeferredWrites CcRegistryChangeCallback CcScanLogHandleList CcSetDirtyInMask CcUnmapInactiveViewsInternal CcWriteBehindPreProcess CcWriteBehindReleaseFile CmCheckRegistry CmFcpChangeSubscriptionWrapper CmKtmNotification CmOpenKey CmSetAcpiHwProfile CmUnRegisterCallback CmpAcceptBoot CmpAddDriverToList CmpAddSecurityCellToCache CmpAddSubKeyToList CmpAdjustSecurityCacheSize CmpCallCallBacksEx CmpCheckRegistry2 CmpCleanupPathInfo CmpCloseKeyObject CmpCreateKeyBody CmpDestroySecurityCache CmpDoParseKey CmpEnableLazyFlushDpcRoutine$fin$1 CmpEnumerateAllHigherLayerKcbs CmpEnumerateKcbCacheBucket CmpEtwDumpKcb CmpExpandPathInfo CmpFireCleanupNotifications CmpFreeDriverList CmpFreeExtraParameter CmpGetNodeName CmpGetSymbolicLinkTarget CmpIsLoadType CmpLazyFlushDpcRoutine$filt$1 CmpLazyWriteWorker CmpMachineHiveLoadedWorkItem CmpRemoveFromSecurityCache CmpReplicateKeyToVirtual CmpSearchKeyControlBlockTreeEx CmpSecurityMethod CmpSystemHiveHysteresisWorker CmpWorkItemWrapper DbgkCaptureLiveDump DbgkpLkmdEnumApcOrDpcDataCallback DbgkpLkmdFireCallbacks DbgkpLkmdIsMemoryBlockPresentFromCallback DbgkpLkmdSnapData DbgkpLkmdSnapDataEx DbgkpLkmdSnapGlobals DbgkpLkmdSnapKernelStack DbgkpLkmdSnapKernelStackSegmentCallback DbgkpLkmdSnapObject DbgkpWerInvokeCallbacks DefaultOverflowHandler DifAddDeviceWrapper DifCcCopyWriteExWrapper DifCcCopyWriteWrapper DifCcDeferWriteWrapper DifCcFastCopyWriteWrapper DifCmRegisterCallbackExWrapper DifCmRegisterCallbackWrapper DifCmUnRegisterCallbackWrapper DifDeregisterPlugin DifDriverCancelWrapper DifDriverEntryWrapper DifDriverStartIoWrapper DifDriverUnloadWrapper DifEtwRegisterWrapper DifEtwUnregisterWrapper DifExAcquireFastMutexUnsafeWrapper DifExAcquireFastMutexWrapper DifExAcquireResourceExclusiveLiteWrapper DifExAcquireResourceSharedLiteWrapper DifExAcquireSharedStarveExclusiveWrapper DifExAcquireSharedWaitForExclusiveWrapper DifExAllocatePool2Wrapper DifExAllocatePool3Wrapper DifExAllocatePoolWithQuotaTagWrapper DifExAllocatePoolWithQuotaWrapper DifExAllocatePoolWithTagPriorityWrapper DifExAllocatePoolWithTagWrapper DifExAllocatePoolWrapper DifExConvertExclusiveToSharedLiteWrapper DifExCreateCallbackWrapper DifExDeleteLookasideListExWrapper DifExDeleteNPagedLookasideListWrapper DifExDeletePagedLookasideListWrapper DifExDeleteResourceLiteWrapper DifExEnterCriticalRegionAndAcquireResourceExclusiveWrapper DifExEnterCriticalRegionAndAcquireResourceSharedWrapper DifExEnterCriticalRegionAndAcquireSharedWaitForExclusiveWrapper DifExEnterPriorityRegionAndAcquireResourceExclusiveWrapper DifExEnterPriorityRegionAndAcquireResourceSharedWrapper DifExFreePoolWithTagWrapper DifExFreePoolWrapper DifExInitializeLookasideListExWrapper DifExInitializeNPagedLookasideListWrapper DifExInitializePagedLookasideListWrapper DifExInitializeResourceLiteWrapper DifExIsProcessorFeaturePresentWrapper DifExRaiseAccessViolationWrapper DifExRaiseDatatypeMisalignmentWrapper DifExRaiseStatusWrapper DifExRegisterCallbackWrapper DifExReleaseFastMutexUnsafeWrapper DifExReleaseFastMutexWrapper DifExReleaseResourceAndLeaveCriticalRegionWrapper DifExReleaseResourceAndLeavePriorityRegionWrapper DifExReleaseResourceForThreadLiteWrapper DifExReleaseResourceLiteWrapper DifExSetTimerResolutionWrapper DifExTryToAcquireFastMutexWrapper DifExUnregisterCallbackWrapper DifExUuidCreateWrapper DifExfAcquirePushLockExclusiveWrapper DifExfAcquirePushLockSharedWrapper DifExfReleasePushLockSharedWrapper DifExfReleasePushLockWrapper DifExfTryAcquirePushLockSharedWrapper DifExfTryToWakePushLockWrapper DifHalAllocateCrashDumpRegistersWrapper DifHalDmaAllocateCrashDumpRegistersExWrapper DifHalDmaFreeCrashDumpRegistersExWrapper DifIRP_MJ_CLEANUPWrapper DifIRP_MJ_CLOSEWrapper DifIRP_MJ_CREATEWrapper DifIRP_MJ_CREATE_MAILSLOTWrapper DifIRP_MJ_CREATE_NAMED_PIPEWrapper DifIRP_MJ_DEVICE_CHANGEWrapper DifIRP_MJ_DEVICE_CONTROLWrapper DifIRP_MJ_DIRECTORY_CONTROLWrapper DifIRP_MJ_FILE_SYSTEM_CONTROLWrapper DifIRP_MJ_FLUSH_BUFFERSWrapper DifIRP_MJ_INTERNAL_DEVICE_CONTROLWrapper DifIRP_MJ_LOCK_CONTROLWrapper DifIRP_MJ_PNPWrapper DifIRP_MJ_POWERWrapper DifIRP_MJ_QUERY_EAWrapper DifIRP_MJ_QUERY_INFORMATIONWrapper DifIRP_MJ_QUERY_QUOTAWrapper DifIRP_MJ_QUERY_SECURITYWrapper DifIRP_MJ_QUERY_VOLUME_INFORMATIONWrapper DifIRP_MJ_READWrapper DifIRP_MJ_SET_EAWrapper DifIRP_MJ_SET_INFORMATIONWrapper DifIRP_MJ_SET_QUOTAWrapper DifIRP_MJ_SET_SECURITYWrapper DifIRP_MJ_SET_VOLUME_INFORMATIONWrapper DifIRP_MJ_SHUTDOWNWrapper DifIRP_MJ_SYSTEM_CONTROLWrapper DifIRP_MJ_WRITEWrapper DifIoAcquireRemoveLockExWrapper DifIoAllocateControllerWrapper DifIoAllocateIrpExWrapper DifIoAllocateIrpWrapper DifIoAllocateMdlWrapper DifIoAllocateWorkItemWrapper DifIoAttachDeviceWrapper DifIoBuildAsynchronousFsdRequestWrapper DifIoBuildDeviceIoControlRequestWrapper DifIoBuildSynchronousFsdRequestWrapper DifIoCheckShareAccessWrapper DifIoConnectInterruptExWrapper DifIoConnectInterruptWrapper DifIoCreateControllerWrapper DifIoCreateDeviceWrapper DifIoCreateFileExWrapper DifIoCreateFileSpecifyDeviceObjectHintWrapper DifIoCreateFileWrapper DifIoCreateNotificationEventWrapper DifIoCreateSymbolicLinkWrapper DifIoCreateSynchronizationEventWrapper DifIoCreateUnprotectedSymbolicLinkWrapper DifIoDeleteControllerWrapper DifIoDeleteDeviceWrapper DifIoDeleteSymbolicLinkWrapper DifIoDetachDeviceWrapper DifIoDisconnectInterruptExWrapper DifIoDisconnectInterruptWrapper DifIoFreeControllerWrapper DifIoFreeIrpWrapper DifIoFreeMdlWrapper DifIoGetConfigurationInformationWrapper DifIoGetDeviceDirectoryWrapper DifIoGetDeviceObjectPointerWrapper DifIoGetDeviceToVerifyWrapper DifIoGetDmaAdapterWrapper DifIoGetDriverDirectoryWrapper DifIoGetFileObjectGenericMappingWrapper DifIoGetInitialStackWrapper DifIoInitializeRemoveLockExWrapper DifIoInitializeTimerWrapper DifIoInitializeWorkItemWrapper DifIoIsWdmVersionAvailableWrapper DifIoOpenDeviceInterfaceRegistryKeyWrapper DifIoOpenDeviceRegistryKeyWrapper DifIoOpenDriverRegistryKeyWrapper DifIoRaiseHardErrorWrapper DifIoRaiseInformationalHardErrorWrapper DifIoReadPartitionTableWrapper DifIoRegisterDeviceInterfaceWrapper DifIoRegisterDriverReinitializationWrapper DifIoRegisterShutdownNotificationWrapper DifIoReleaseRemoveLockAndWaitExWrapper DifIoReleaseRemoveLockExWrapper DifIoRemoveShareAccessWrapper DifIoSetCompletionRoutineExWrapper DifIoSetDeviceInterfaceStateWrapper DifIoSetDeviceToVerifyWrapper DifIoSetPartitionInformationWrapper DifIoSetShareAccessWrapper DifIoStartNextPacketWrapper DifIoUnregisterShutdownNotificationWrapper DifIoUpdateShareAccessWrapper DifIoWMIAllocateInstanceIdsWrapper DifIoWMIRegistrationControlWrapper DifIoWriteErrorLogEntryWrapper DifIoWritePartitionTableWrapper DifIofCallDriverWrapper DifIofCompleteRequestWrapper DifKeAcquireGuardedMutexUnsafeWrapper DifKeAcquireGuardedMutexWrapper DifKeAcquireInStackQueuedSpinLockAtDpcLevelWrapper DifKeAcquireInStackQueuedSpinLockForDpcWrapper DifKeAcquireInStackQueuedSpinLockRaiseToSynchWrapper DifKeAcquireInStackQueuedSpinLockWrapper DifKeAcquireQueuedSpinLockRaiseToSynchWrapper DifKeAcquireQueuedSpinLockWrapper DifKeAcquireSpinLockAtDpcLevelWrapper DifKeAcquireSpinLockRaiseToDpcWrapper DifKeCancelTimerWrapper DifKeClearEventWrapper DifKeDelayExecutionThreadWrapper DifKeDeregisterNmiCallbackWrapper DifKeEnterCriticalRegionWrapper DifKeEnterGuardedRegionWrapper DifKeInitializeDeviceQueueWrapper DifKeInitializeEventWrapper DifKeInitializeMutantWrapper DifKeInitializeMutexWrapper DifKeInitializeSemaphoreWrapper DifKeInitializeTimerExWrapper DifKeInitializeTimerWrapper DifKeInsertByKeyDeviceQueueWrapper DifKeInsertDeviceQueueWrapper DifKeInsertQueueDpcWrapper DifKeLeaveCriticalRegionWrapper DifKeLeaveGuardedRegionWrapper DifKeLowerIrqlWrapper DifKePulseEventWrapper DifKeRaiseIrqlToDpcLevelWrapper DifKeReadStateEventWrapper DifKeReadStateTimerWrapper DifKeRegisterNmiCallbackWrapper DifKeReleaseGuardedMutexUnsafeWrapper DifKeReleaseGuardedMutexWrapper DifKeReleaseInStackQueuedSpinLockForDpcWrapper DifKeReleaseInStackQueuedSpinLockFromDpcLevelWrapper DifKeReleaseInStackQueuedSpinLockWrapper DifKeReleaseMutantWrapper DifKeReleaseMutexWrapper DifKeReleaseQueuedSpinLockWrapper DifKeReleaseSpinLockFromDpcLevelWrapper DifKeReleaseSpinLockWrapper DifKeRemoveByKeyDeviceQueueWrapper DifKeRemoveDeviceQueueWrapper DifKeRemoveEntryDeviceQueueWrapper DifKeRemoveQueueDpcWrapper DifKeResetEventWrapper DifKeRestoreExtendedProcessorStateWrapper DifKeSaveExtendedProcessorStateWrapper DifKeSetEventWrapper DifKeSetTimerExWrapper DifKeSetTimerWrapper DifKeSynchronizeExecutionWrapper DifKeTryToAcquireGuardedMutexWrapper DifKeTryToAcquireQueuedSpinLockRaiseToSynchWrapper DifKeTryToAcquireQueuedSpinLockWrapper DifKeTryToAcquireSpinLockAtDpcLevelWrapper DifKeWaitForMultipleObjectsWrapper DifKeWaitForSingleObjectWrapper DifKfRaiseIrqlWrapper DifMmAllocateContiguousMemoryExWrapper DifMmAllocateContiguousMemorySpecifyCacheWrapper DifMmAllocateContiguousMemoryWrapper DifMmAllocateNonCachedMemoryWrapper DifMmAllocatePagesForMdlExWrapper DifMmAllocatePagesForMdlWrapper DifMmBuildMdlForNonPagedPoolWrapper DifMmFreeContiguousMemoryWrapper DifMmFreeNonCachedMemoryWrapper DifMmFreePagesFromMdlWrapper DifMmLockPagableDataSectionWrapper DifMmLockPagableSectionByHandleWrapper DifMmMapIoSpaceWrapper DifMmMapLockedPagesSpecifyCacheWrapper DifMmPageEntireDriverWrapper DifMmResetDriverPagingWrapper DifMmSecureVirtualMemoryWrapper DifMmUnlockPagableImageSectionWrapper DifMmUnmapLockedPagesWrapper DifMmUnsecureVirtualMemoryWrapper DifNtCreateFileWrapper DifNtDeleteFileWrapper DifNtOpenFileWrapper DifNtSetInformationFileWrapper DifNtWriteFileWrapper DifObGetObjectSecurityWrapper DifObReferenceObjectByHandleWrapper DifObReferenceObjectByPointerWithTagWrapper DifObReferenceObjectByPointerWrapper DifObReleaseObjectSecurityWrapper DifObfDereferenceObjectWithTagWrapper DifObfDereferenceObjectWrapper DifObfReferenceObjectWithTagWrapper DifObfReferenceObjectWrapper DifPoCallDriverWrapper DifPoFxActivateComponentWrapper DifPoFxCompleteDevicePowerNotRequiredWrapper DifPoFxCompleteIdleConditionWrapper DifPoFxCompleteIdleStateWrapper DifPoFxIdleComponentWrapper DifPoFxNotifySurprisePowerOnWrapper DifPoFxPowerControlWrapper DifPoFxRegisterDeviceWrapper DifPoFxReportDevicePoweredOnWrapper DifPoFxSetComponentLatencyWrapper DifPoFxSetComponentResidencyWrapper DifPoFxSetComponentWakeWrapper DifPoFxSetDeviceIdleTimeoutWrapper DifPoFxStartDevicePowerManagementWrapper DifPoFxUnregisterDeviceWrapper DifPoRequestPowerIrpWrapper DifProbeForReadWrapper DifProbeForWriteWrapper DifPsCreateSystemThreadWrapper DifPsGetVersionWrapper DifPsSetCreateProcessNotifyRoutineWrapper DifPsSetCreateThreadNotifyRoutineWrapper DifPsSetLoadImageNotifyRoutineWrapper DifPsTerminateSystemThreadWrapper DifRtlAnsiStringToUnicodeStringWrapper DifRtlCheckRegistryKeyWrapper DifRtlCreateRegistryKeyWrapper DifRtlCreateSystemVolumeInformationFolderWrapper DifRtlCreateUnicodeStringWrapper DifRtlDeleteRegistryValueWrapper DifRtlDowncaseUnicodeStringWrapper DifRtlDuplicateUnicodeStringWrapper DifRtlOemStringToCountedUnicodeStringWrapper DifRtlOemStringToUnicodeStringWrapper DifRtlQueryRegistryValueWithFallbackWrapper DifRtlQueryRegistryValuesExWrapper DifRtlQueryRegistryValuesWrapper DifRtlUnicodeStringToAnsiStringWrapper DifRtlUnicodeStringToCountedOemStringWrapper DifRtlUnicodeStringToOemStringWrapper DifRtlUpcaseUnicodeStringToAnsiStringWrapper DifRtlUpcaseUnicodeStringToCountedOemStringWrapper DifRtlUpcaseUnicodeStringToOemStringWrapper DifRtlUpcaseUnicodeStringWrapper DifRtlWriteRegistryValueWrapper DifZwAccessCheckAndAuditAlarmWrapper DifZwAddBootEntryWrapper DifZwAddDriverEntryWrapper DifZwAdjustPrivilegesTokenWrapper DifZwAllocateVirtualMemoryWrapper DifZwAlpcAcceptConnectPortWrapper DifZwAlpcConnectPortWrapper DifZwAlpcCreatePortSectionWrapper DifZwAlpcCreatePortWrapper DifZwAlpcCreateResourceReserveWrapper DifZwAlpcCreateSectionViewWrapper DifZwAlpcCreateSecurityContextWrapper DifZwAlpcQueryInformationWrapper DifZwAlpcSendWaitReceivePortWrapper DifZwAlpcSetInformationWrapper DifZwCancelIoFileWrapper DifZwCancelTimerWrapper DifZwCloseObjectAuditAlarmWrapper DifZwCloseWrapper DifZwCommitEnlistmentWrapper DifZwConnectPortWrapper DifZwCreateDirectoryObjectWrapper DifZwCreateEnlistmentWrapper DifZwCreateEventWrapper DifZwCreateFileWrapper DifZwCreateJobObjectWrapper DifZwCreateKeyTransactedWrapper DifZwCreateKeyWrapper DifZwCreateResourceManagerWrapper DifZwCreateSectionWrapper DifZwCreateSymbolicLinkObjectWrapper DifZwCreateTimerWrapper DifZwCreateTransactionManagerWrapper DifZwCreateTransactionWrapper DifZwDeleteBootEntryWrapper DifZwDeleteFileWrapper DifZwDeleteKeyWrapper DifZwDeleteValueKeyWrapper DifZwDeviceIoControlFileWrapper DifZwDisplayStringWrapper DifZwDuplicateObjectWrapper DifZwDuplicateTokenWrapper DifZwEnumerateBootEntriesWrapper DifZwEnumerateDriverEntriesWrapper DifZwEnumerateKeyWrapper DifZwEnumerateValueKeyWrapper DifZwFlushBuffersFileExWrapper DifZwFlushBuffersFileWrapper DifZwFlushInstructionCacheWrapper DifZwFlushKeyWrapper DifZwFlushVirtualMemoryWrapper DifZwFreeVirtualMemoryWrapper DifZwFsControlFileWrapper DifZwGetNotificationResourceManagerWrapper DifZwLoadDriverWrapper DifZwLoadKeyWrapper DifZwMapViewOfSectionWrapper DifZwModifyBootEntryWrapper DifZwModifyDriverEntryWrapper DifZwNotifyChangeKeyWrapper DifZwOpenDirectoryObjectWrapper DifZwOpenEnlistmentWrapper DifZwOpenEventWrapper DifZwOpenFileWrapper DifZwOpenJobObjectWrapper DifZwOpenKeyExWrapper DifZwOpenKeyTransactedExWrapper DifZwOpenKeyTransactedWrapper DifZwOpenKeyWrapper DifZwOpenProcessTokenExWrapper DifZwOpenProcessTokenWrapper DifZwOpenProcessWrapper DifZwOpenResourceManagerWrapper DifZwOpenSectionWrapper DifZwOpenSymbolicLinkObjectWrapper DifZwOpenThreadTokenExWrapper DifZwOpenThreadTokenWrapper DifZwOpenThreadWrapper DifZwOpenTimerWrapper DifZwOpenTransactionManagerWrapper DifZwOpenTransactionWrapper DifZwPowerInformationWrapper DifZwPrePrepareEnlistmentWrapper DifZwPrepareCompleteWrapper DifZwPrepareEnlistmentWrapper DifZwProtectVirtualMemoryWrapper DifZwPulseEventWrapper DifZwQueryBootEntryOrderWrapper DifZwQueryBootOptionsWrapper DifZwQueryDefaultLocaleWrapper DifZwQueryDefaultUILanguageWrapper DifZwQueryDirectoryFileExWrapper DifZwQueryDirectoryFileWrapper DifZwQueryDirectoryObjectWrapper DifZwQueryDriverEntryOrderWrapper DifZwQueryEaFileWrapper DifZwQueryFullAttributesFileWrapper DifZwQueryInformationEnlistmentWrapper DifZwQueryInformationFileWrapper DifZwQueryInformationJobObjectWrapper DifZwQueryInformationProcessWrapper DifZwQueryInformationResourceManagerWrapper DifZwQueryInformationThreadWrapper DifZwQueryInformationTokenWrapper DifZwQueryInformationTransactionManagerWrapper DifZwQueryInformationTransactionWrapper DifZwQueryInstallUILanguageWrapper DifZwQueryKeyWrapper DifZwQueryLicenseValueWrapper DifZwQueryObjectWrapper DifZwQuerySectionWrapper DifZwQuerySecurityObjectWrapper DifZwQuerySymbolicLinkObjectWrapper DifZwQuerySystemInformationWrapper DifZwQueryValueKeyWrapper DifZwQueryVolumeInformationFileWrapper DifZwReadFileWrapper DifZwRemoveIoCompletionExWrapper DifZwRenameKeyWrapper DifZwReplaceKeyWrapper DifZwRequestWaitReplyPortWrapper DifZwResetEventWrapper DifZwRestoreKeyWrapper DifZwRollbackEnlistmentWrapper DifZwSetBootEntryOrderWrapper DifZwSetBootOptionsWrapper DifZwSetDriverEntryOrderWrapper DifZwSetEaFileWrapper DifZwSetEventWrapper DifZwSetInformationEnlistmentWrapper DifZwSetInformationFileWrapper DifZwSetInformationJobObjectWrapper DifZwSetInformationKeyWrapper DifZwSetInformationObjectWrapper DifZwSetInformationProcessWrapper DifZwSetInformationThreadWrapper DifZwSetInformationTransactionWrapper DifZwSetSecurityObjectWrapper DifZwSetSystemInformationWrapper DifZwSetSystemTimeWrapper DifZwSetTimerWrapper DifZwSetValueKeyWrapper DifZwSetVolumeInformationFileWrapper DifZwTranslateFilePathWrapper DifZwUnloadDriverWrapper DifZwUnloadKeyWrapper DifZwWaitForMultipleObjectsWrapper DifZwWaitForSingleObjectWrapper DifZwWriteFileWrapper DisplayBootBitmap DrvDbGetDriverDatabaseList DrvDbGetObjectSubKeyCallback DrvDbLoadDatabaseNode DrvDbUnloadDatabaseNode EmonOverflowHandler EmonPebsOverflowHandler EmpEvaluateNodeLink EmpEvaluateUpdateRuleEvalState EmpUpdateRuleState EtwGetKernelTraceTimestampSilo EtwQueryPerformanceTraceInformation EtwSetPerformanceTraceInformation EtwpAddLogHeader EtwpAddRegEntryToGroup EtwpCancelTraceImageUnloadApc EtwpClockSourceRunDown EtwpCompleteBuffer EtwpCovSampEnumerateProcess EtwpCovSampLookasideGrow EtwpCovSampModuleGetName EtwpCovSampModuleNameInfoCleanup EtwpCoverageSamplerStart EtwpEnumerateAddressSpace EtwpEventWriteFull EtwpFreeLoggerContext EtwpGetPmcOwnership EtwpInitialize EtwpInitializeLastBranchTracing EtwpInitializeTimeStamp EtwpInvokeEventCallback EtwpLoadMicroarchitecturalProfileSource EtwpLogContextSwapEvent EtwpLogPmcCounterRundown EtwpRegisterKMProvider EtwpReserveTraceBuffer EtwpReserveWithPmcCounters EtwpSampledProfileRunDown EtwpSendDataBlock EtwpTraceImageUnloadApc EtwpTraceLastBranchRecord EtwpTraceProcessorTrace EtwpUpdateLastBranchTracingConfiguration EtwpUpdatePmcCounters EtwpUpdateProcessorTraceConfiguration ExAllocateFromLookasideListEx ExAllocateFromNPagedLookasideList ExAllocateHeapPool ExAtsSvmDevicePowerCallback ExCallCallBack ExCallSessionCallBack ExEnumHandleTable ExFlushLookasideListEx ExFlushTb ExFreeHeapPool ExFreeToLookasideListEx ExFreeToNPagedLookasideList ExInitLicenseData ExInitializeDeviceAts ExNotifyWithProcessing ExRegisterExtension ExSetLicenseTamperState ExSvmBeginDeviceReset ExSvmFinalizeDeviceReset ExUnregisterExtension ExUpdateLicenseData ExpAcquireCrossVmMutant ExpApplyPriorityBoost ExpAtsDereferenceDevice ExpBoostIoAfterAcquire ExpCallProcessing ExpCenturyDpcRoutine$fin$0 ExpConvertSvmDevice ExpCreateCrossVmEvent ExpCreateCrossVmMutant ExpCrossVmIntHostCallback ExpCrossVmWnfPush ExpFinalizeTimerDeletion ExpFlushGeneralLookaside ExpGenuinePolicyPostProcess ExpGetSystemFirmwareTableInformation ExpInitializeMemoryMirroring ExpInitializeSessionDriver ExpInitializeSvm ExpLicenseWatchInitWorker ExpObCloseCrossVmEvent ExpObCloseCrossVmMutant ExpObDeleteCrossVmEvent ExpObDeleteCrossVmMutant ExpPrepareNewAtsDevice ExpPrepareNewSvmDevice ExpProfileCreate ExpPulseCrossVmEvent ExpQueryCodeIntegrityCertificateInfo ExpQueryCrossVmEvent ExpQueryElamCertInfo ExpQueryNumaProximityNode ExpQuerySystemInformation ExpReleaseCrossVmMutant ExpResetCrossVmEvent ExpSetCrossVmEvent ExpSetSoftRebootFlags ExpShareAddressSpaceWithDevice ExpSnapShotHandleTables ExpSvmDereferenceDevice ExpSvmWorkerThread ExpTimeRefreshDpcRoutine$filt$3 ExpTimeRefreshWork ExpTimeZoneDpcRoutine$fin$2 ExpTimerDpcRoutine$filt$1 ExpWaitForBootDevices ExpWaitForResource ExpWatchProductTypeWork ExpWnfDispatchKernelSubscription ExpWnfPopulateStateData ExpWorkerThread FUN_1404167ab FUN_14066b730 FUN_14066c434 FUN_140687e40 FUN_14068ad70 FUN_14070a1a0 FUN_14070a4d4 FUN_140769944 FUN_140843f7c FUN_140a4b4b4 FUN_140a4b8a4 FUN_140a4c060 FUN_140a4c2a0 FUN_140a4c7f0 FUN_140a4cda0 FUN_140a4d154 FUN_140a4dae4 FUN_140a4e07c FUN_140a4e498 FilterEvalImpliedAnd FilterEvalStrict FindNodeOrParent FindNodeOrParent FsFilterPerformCallbacks FsFilterPerformCompletionCallbacks FsRtlAcquireFileExclusiveCommon FsRtlAcquireFileForCcFlushEx FsRtlAcquireFileForModWriteEx FsRtlCompleteLockIrpReal FsRtlCopyRead FsRtlCopyWrite FsRtlFastUnlockSingleExclusive FsRtlFastUnlockSingleShared FsRtlFreeExtraCreateParameter FsRtlGetFileNameInformation FsRtlGetFileSize FsRtlGetSupportedFeatures FsRtlMdlRead FsRtlMdlReadComplete FsRtlMdlReadDev FsRtlMdlWriteComplete FsRtlMupGetProviderIdFromName FsRtlMupGetProviderInfoFromFileObject FsRtlNotifyFilterReportChange FsRtlNotifyFilterReportChangeLiteEx FsRtlPrepareMdlWrite FsRtlPrepareMdlWriteDev FsRtlPrivateFastUnlockAll FsRtlReleaseFile FsRtlReleaseFileForCcFlush FsRtlReleaseFileForModWrite FsRtlReleaseFileNameInformation FsRtlStackOverflowRead FsRtlTeardownPerFileContexts FsRtlTeardownPerStreamContexts FsRtlUninitializeOplock FsRtlWorkerThread FsRtlpRemoveAndCompleteWaitingIrp FsRtlpWaitOnIrp GetBootSystemTime GxpReadFrameBufferPixels GxpWriteFrameBufferPixels HalAllocateAdapterChannelV2 HalAllocateCommonBuffer HalAllocateHardwareCounters HalAssignSlotResources HalBuildScatterGatherListV2 HalConfigureAdapterChannel HalCreateCommonBufferFromMdl HalCreateCommonBufferFromMdlDmaThin HalCreateCommonBufferFromMdlDmarThin HalDisableInterrupt HalDmaAllocateCrashDumpRegistersEx HalDmaFreeCrashDumpRegistersEx HalEnableInterrupt HalFreeCommonBuffer HalFreeCommonBufferDmaThin HalFreeCommonBufferDmarThin HalFreeCommonBufferV3 HalFreeCommonBufferVector HalFreeHardwareCounters HalGetAdapterV2 HalGetInterruptVector HalGetVectorInput HalJoinDmaDomain HalMapTransferEx HalMcFinishMicrocode HalPerformEndOfInterrupt HalReadDmaCounter HalReadDmaCounterV2 HalReturnToFirmware HalSendNMI HalSetProfileInterval HalStopProfileInterrupt HalTranslateBusAddress HaliAcpiSleep HaliLocateHiberRanges HaliRunPlatformDebugTriggers HalpAcpiDetectMachineSpecificActions HalpAcpiPmRegisterRead HalpAcpiPmRegisterWrite HalpAcpiPostSleep HalpAcpiPreSleep HalpAcquireCmosSpinLock HalpAddMcaToProcessorSpecificSection HalpAllocateAdapterCallbackV2 HalpAllocateAdapterCallbackV3 HalpAllocateCommonBufferDmaThin HalpAllocateCommonBufferDmarThin HalpAllocateCommonBufferVectorInternal HalpAllocateDmaResourcesInternal HalpAllocateDomainCommonBufferInternal HalpAllocatePmcCounterSetEx HalpApicClearLocalUnitError HalpApicConvertFromRte HalpApicGetCpuInfo HalpApicGetLocalUnitError HalpApicInitializeLocalUnit HalpApicIsCmciImplemented HalpApicQueryAndGetSource HalpApicReplaySendSelfIpi HalpApicRequestInterrupt HalpApicSaveLocalInterrupts HalpApicSetLineState HalpApicSetLogicalId HalpApicSetPriority HalpApicStartProcessor HalpApicTimerArm HalpApicTimerDiscover HalpApicTimerInitialize HalpApicTimerIsInvariant HalpApicTimerQueryCounter HalpApicTimerStop HalpApicWriteEndOfInterrupt HalpArtAvailable HalpBlkPoReadPerfIoPort HalpBlkPoReadPerfMsr HalpBlkPoRegisterIdleState HalpBlkPoWritePerfIoPort HalpBlkPoWritePerfMsr HalpCmciLoadThresholdConfiguration HalpCmciSetProcessorConfigAMD HalpCmciSetProcessorConfigIntel HalpCmciSetProcessorMiscConfigAMD HalpCmosRangeHandler HalpCompleteInitializeProfiling HalpConstructScatterGatherListDmaThin HalpConstructScatterGatherListDmarThin HalpCreateMcaMemoryErrorRecord HalpCreateMcaProcessorErrorRecord HalpCreateNMIErrorRecord HalpDisableSecondaryInterrupt HalpDmaAllocateChildAdapterV3 HalpDmaAllocateDomain HalpDmaControllerCancelTransfer HalpDmaControllerDpcRoutine HalpDmaControllerFlushChannel HalpDmaControllerInitializeController HalpDmaControllerInterruptRoutine HalpDmaControllerProgramChannel HalpDmaControllerQueryMaxFragments HalpDmaControllerReadDmaCounter HalpDmaControllerValidateRequestLineBinding HalpDmaDereferenceDomainObject HalpDmaFreeChildAdapter HalpDmaFreeLa HalpDmaGetIommuInterface HalpDmaGetReservedRegionsForHybridPassthroughDomain HalpDmaInitializeControllers HalpDmaInitializeDomainEarly HalpDmaPowerCriticalTransitionCallback HalpDmaProcessMapRegisterQueueV2 HalpDmaSyncMapBuffers HalpDmaSyncMapBuffersWithEmergencyResources HalpDpPostReplace HalpDpPreReplace HalpDpReplaceControl HalpDpReplaceTarget HalpDpReplayInterrupts HalpEnableSecondaryInterrupt HalpEnumerateEnvironmentVariablesWithFilter HalpExtInitExtensions HalpFreePmcCounterSet HalpGetCacheCoherency HalpGetMcaExtendedLogStatusBlock HalpGetMcaPcrContext HalpGetSetCmosData HalpHandleMachineCheck HalpHandleMaskUnmaskSecondaryInterrupt HalpHvCounterQueryCounter HalpHvEnterSleepState HalpHvEpCpuid HalpHvEpWriteMsr HalpHvGetMachineCheckContext HalpHvInitDiscard HalpHvInitMcaPcrContext HalpHvLpReadMultipleMsr HalpHvMapDeviceInterrupt HalpHvMapDeviceMsiRange HalpHvNotifyDebugDeviceAvailable HalpHvRetargetDeviceMsiInterrupt HalpHvRetargetIoApicDeviceInterrupt HalpHvSetMachineCheckHandlerState HalpHvSetMachineCheckRecoveryState HalpHvSetSleepStateProperty HalpHvStartProcessor HalpHvStartVirtualProcessor HalpHvTimerInitialize HalpHvUnmapDeviceInterrupt HalpHvUnmapDeviceMsiRange HalpHvVpStartEnabled HalpInitSystemHelper HalpInitializePnTimers HalpInitializeProfiling HalpInitializeTimers HalpInitializeUncoreProfiling HalpInterruptDpReplaceBegin HalpInterruptEnumerateUnmaskedInterrupts HalpInterruptEnumerateUnmaskedSecondaryInterrupts HalpInterruptGenerateMessage HalpInterruptGetHighestPriorityInterrupt HalpInterruptInitializeController HalpInterruptInitializeLocalUnit HalpInterruptLocalErrorService HalpInterruptOfflineProcessor HalpInterruptPerformDirectedEndOfInterrupt HalpInterruptRequestInterrupt HalpInterruptRequestSecondaryInterrupt HalpInterruptResetThisProcessor HalpInterruptRestoreClock HalpInterruptSaveReplayState HalpInterruptSendIpi HalpInterruptSetLineStateInternal HalpInterruptStandardEndOfInterrupt HalpInterruptStartProcessor HalpInterruptThermalService HalpInterruptUpdateLocalUnitIdentifier HalpIommuAcquireNewDomain HalpIommuAllocateDmaDomain HalpIommuAllocateRemappingTableEntry HalpIommuAttachDeviceDomain HalpIommuCreateDevice HalpIommuCreateDeviceInternal HalpIommuDeleteDevice HalpIommuDomainFreeLogicalAddressRange HalpIommuDomainGetLogicalAddressRange HalpIommuEnableInterrupts HalpIommuFlushDomainTB HalpIommuFreeDmaDomain HalpIommuFreeDomain HalpIommuFreeRemappingTableEntry HalpIommuGetAcpiDeviceMapCount HalpIommuGetDeviceId HalpIommuInitSystem HalpIommuInitializeAll HalpIommuInitializeDmaGuardPolicy HalpIommuInitializeDmarPageTable HalpIommuInterruptRoutine HalpIommuInvokeInterfaceStateChangeCallbacks HalpIommuJoinDmaDomain HalpIommuLeaveDmaDomain HalpIommuLocateFromDevice HalpIommuMapLogical HalpIommuMapLogicalRange HalpIommuMarkHiberPhase HalpIommuProcessReservationsInternal HalpIommuQueryAcpiDeviceMapping HalpIommuSetupMessageInterruptRouting HalpIommuUnblockDevice HalpIommuUpdateRemappingDestination HalpIommuUpdateRemappingTableEntry HalpIumGetNextVariableName HalpIumGetTime HalpIumGetVariable HalpIumQueryVariableInfo HalpIumResetSystem HalpIumSetTime HalpIumSetVariable HalpIvtProcessDrhdEntry HalpLeaveDmaDomain HalpLoadMicrocode HalpMapTransferV2 HalpMaskInterrupt HalpMcEnumerateAndSetPatchConfig HalpMcExportAllData HalpMcGetLoadConfiguration HalpMcUpdateInitialize HalpMcUpdateLock HalpMcUpdateMicrocode HalpMcUpdatePostUpdate HalpMcUpdateUnlock HalpMcaInitializeErrorSection HalpMcaPopulateErrorData HalpMcaProcessorBankClear HalpMcaProcessorBankConfigAmd HalpMcaQueueDpc HalpMcaSetProcessorConfig HalpMceHandlerCore HalpMemoryErrorDeferredHandler HalpMemoryErrorDeferredRecovery HalpPCIConfig HalpPCIPerformConfigAccess HalpPerfInterrupt HalpPmemErrorDeferredHandler HalpPmuProcessorCallbackDpcRoutine HalpPmuReservedResourcesProcessorCallback HalpPowerStateCallback HalpPowerWriteResetCommand HalpProcessorPrepareForIdle HalpProcessorResumeFromIdle HalpPutScatterGatherListDmarThin HalpQueryIommuReservedRegionInformation HalpQueryPrimaryInterruptInformation HalpQueryProfileInformation HalpReadExtendedMcaRegistersAMD HalpReadExtendedMcaRegistersIntel HalpReenableAcpi HalpRestartProfiling HalpRestoreDmaControllerState HalpRtcAcknowledgeInterrupt HalpRtcArmTimer HalpRtcFixedStall HalpRtcInitialize HalpRtcStop HalpScanForProfilingCorruption HalpSendPccCommand HalpSetMicrocodeSelfhostFlag HalpSetProfileSourceInterval HalpSetResumeTime HalpSetSystemInformation HalpSetTimer HalpShutdown HalpShutdownReset HalpStartPccCommand HalpStartProfileInterruptEx HalpStopLegacyUsbInterruptsInternal HalpTimerAlwaysOnClockInterrupt HalpTimerCalibratePerformanceCounter HalpTimerCaptureCloestAuxiliaryQpcPair HalpTimerCaptureCurrentAuxiliaryQpcPair HalpTimerClockActivate HalpTimerClockArm HalpTimerClockInitialize HalpTimerClockInterrupt HalpTimerClockInterruptStub HalpTimerClockIpiRoutine HalpTimerClockPowerChange HalpTimerClockStop HalpTimerConfigureInterrupt HalpTimerDelayedQueryCounter HalpTimerDetermineValidTimerPairReadLatency HalpTimerDpcRoutine HalpTimerEnableHypervisorTimer HalpTimerHypervisorInterruptStub HalpTimerInitialize HalpTimerInitializeClockPn HalpTimerInitializeHypervisorTimer HalpTimerInitializeProfiling HalpTimerMeasureFrequencies HalpTimerPerformanceCounterPowerChange HalpTimerProfileInterrupt HalpTimerProfilePowerChange HalpTimerPropagateQpcBiasUpdate HalpTimerQueryCycleCounter HalpTimerQueryHostPerformanceCounter HalpTimerReadTimerPairWithLatencyLimit HalpTimerRestartProfileInterrupt HalpTimerRestorePerformanceCounter HalpTimerRestoreProcessorCounter HalpTimerSavePerformanceCounter HalpTimerSetupMessageInterruptRouting HalpTimerStallCounterPowerChange HalpTimerStallExecutionProcessor HalpTimerStopAllTimers HalpTimerStopProfileInterrupt HalpTimerSwitchStallSource HalpTimerSwitchToNormalClock HalpTimerTestHypervisorTimer HalpTimerUpdateApiConsumers HalpTimerWatchdogPreResetInterrupt HalpTimerWatchdogStart HalpTimerWatchdogStop HalpTscDiscover HalpTscGetAttributes HalpUnmaskInterrupt HalpUsbLegacyScanBusForHandoff HalpUsbLegacyStopOhciInterrupt HalpUsbLegacyStopUhciInterrupt HalpVpptAcknowledgeInterrupt HalpVpptInitializePhysicalTimer HalpVpptStop HalpVpptUpdatePhysicalTimer HalpWdatProcessWdrtInternalData HalpWheaReadMsrAddress HalpWheaReadMsrMisc HalpWheaReadMsrStatus HalpWheaWriteMsrControl HalpWheaWriteMsrStatus HeadlessInit HsaInitializeInterruptRemapping HsaInitializeIommu HsaIommuSendCommand HvAnalyzeLogFiles HvExtendHivePrimaryFileValidDataLength HvFreeHivePartial HvHiveCleanup HvHiveStartEmptyClone HvHiveStartFileBacked HvHiveStartMemoryBacked HvLoadHive HvRecoverFlushProtocolStateFromFiles HvValidateOrInvalidatePrimaryFileHeader HvWriteExternal HvWriteHivePrimaryFile HvWriteLogFile HvlCrashdumpCallbackRoutine HvlDebuggerSupportInitialize HvlEnlightenProcessor HvlGetSharedPageVa HvlInvokeWheaErrorNotificationCallback HvlPrepareForRootCrashdump HvlResumeFromRootCrashdump HvlSkCrashdumpCallbackRoutine HvlStartBootLogicalProcessors HvlWheaInUsePageOfflineNotificationCallback HvlpComputeLpComparisonMetrics HvlpHandleIommuFaultMessage HvlpInitializeBootProcessor HvlpPhase0Enlightenments HvlpQueryApicIdAndNumaNode HvlpSelectLpSet HvlpSetupBootProcessorEarlyHypercallPages HvlpTryConfigureInterface HvpAddBin HvpAdjustBitmap HvpAllocateBin HvpAllocateMap HvpApplyLegacyLogFile HvpEnlistFreeCell HvpExpandMap HvpFreeBin HvpFreeHiveFreeDisplay HvpFreeMap HvpGetHiveHeader HvpGrowDirtyVectors HvpIncrementalLogFileEnumeratorAdvance HvpInitMap HvpReadHiveDataFromFile HvpReadLogEntryHeader HvpRecoverDataReadRoutine HvpShrinkMap IaLpssReadCmdStatus IaLpssReadPmcsr IaLpssSetPowerD0 IaLpssSetPowerD3 IaLpssWriteCmdStatus IaLpssWritePmcsr InbvAcquireDisplayOwnership InbvAcquireLock InbvCheckDisplayOwnership InbvDisplayString InbvEnableBootDriver InbvGetDisplayState InbvGetResourceAddress InbvIndicateProgress InbvIsBootDriverInstalled InbvNotifyDisplayOwnershipChange InbvNotifyDisplayOwnershipLost InbvPortGetByte InbvPortInitialize InbvPortPollOnly InbvPortPutByte InbvReleaseLock InbvReleaseResources InbvResetDisplay InbvSetFunction InbvSetProgressBarSubset InbvSetScrollRegion InbvSetTextColor InbvSetVirtualFrameBuffer InbvSolidColorFill InitBootProcessor IoAddProcessesToDump IoAllocateAdapterChannel IoAllocateController IoAllocateMdl IoAsynchronousPageWrite IoBoostThreadIoPriority IoCancelIrp IoCaptureLiveDump IoCreateDriver IoCreateStreamFileObjectEx2 IoCsqInsertIrpEx IoCsqRemoveIrp IoCsqRemoveNextIrp IoDemoteToTriageDump IoDumpStackResumeCapable IoEnumerateEnvironmentVariablesEx IoFlushAdapterBuffers IoFlushAdapterBuffersV2 IoFreeAdapterChannel IoFreeAdapterChannelV2 IoFreeController IoFreeMapRegisters IoFreeMdl IoGetDmaAdapter IoGetDumpStack IoGetDumpStackTransferSizes IoGetEnvironmentVariableEx IoGetIommuInterface IoGetIommuInterfaceEx IoInitSystemPreDrivers IoInitializeDumpStack IoMapTransfer IoNotifyDump IoProcessPassiveInterrupts IoPropagateIrpExtensionEx IoProvisionCrashDumpKey IoQueryEnvironmentVariableInfoEx IoRegisterFileSystem IoRevertFromDemotedDumpType IoSaveInitialBugCheckProgress IoSetEnvironmentVariableEx IoShutdownSystem IoStartPacket IoStopIoRateControl IoTranslateBusAddress IoUnregisterFileSystem IoUpdateBugCheckProgressEnvVariable IoUpdateDumpPhysicalRanges IoWriteCrashDump IofCallDriver IommuCreateAtsDevice IommuDeleteAtsDevice IommuDevicePowerChange IommuDisableDevicePasid IommuEnableDevicePasid IommuFinalizeDeviceReset IommuFlushAllPasid IommuFlushDomain IommuFlushTb IommuHvDevicePowerChange IommuHvFlushAllPasid IommuHvFlushTb IommuHvSetAddressSpace IommuProcessPageRequestQueue IommuRegisterInterfaceStateChangeCallback IommuSetAddressSpace IommupDeviceDisablePasidTaggedDma IommupDeviceDisableSvm IommupDeviceEnablePasidTaggedDma IommupDeviceEnableSvm IommupHvAttachPasidDevice IommupHvAttachPasidDeviceDomain IommupHvAttachPasidSubDeviceDomain IommupHvConfigureDeviceDomain IommupHvCreateSvmPasidSpace IommupHvDetachPasidDevice IommupHvDetachPasidDeviceDomain IommupHvDetachPasidSubDeviceDomain IommupHvDismissPageFault IommupHvFlushDeviceDomainVaList IommupHvFlushDomainTbs IommupHvGetDeviceAtsCapability IommupHvGetDeviceSvmCapabilities IommupHvGetPageFault IommupHvInitializeLibrary IommupHvInterruptRoutine IommupHvIsDmarStageCompatible IommupHvIsStage1DmarCompatible IommupHvMapDevice IommupHvMapDeviceIdentityRange IommupHvMapDeviceLogical IommupHvMapDeviceLogicalRange IommupHvRegisterDeviceId IommupHvSetRootFaultReportingReady IommupHvUnblockDefaultDma IommupHvUnmapDevice IommupHvUnmapDeviceIdentityRange IommupHvUnmapDeviceLogicalRange IommupHvUnregisterDeviceId IommupHvValidatePageRequestGpa IommupMapDeviceInternal IommupUnmapDeviceInternal IopAddRemoveReqDescs IopAllocRealFileObject IopAllocateMdl IopAllocatePassiveInterruptBlock IopAttachDeviceToDeviceStackSafe IopBoostThreadCallback IopBootAllocation IopBugCheckProgressEfiVariableServicesAvailable IopCallArbiter IopCallBootDriverReinitializationRoutines IopCallDriverReinitializationRoutines IopChildToRootTranslation IopCloseFile IopCommitConfiguration IopCompletePageWrite IopCompleteUnloadOrDelete IopConnectInterrupt IopConnectInterruptFullySpecified IopCreateFile IopCsqCancelRoutine IopDisableCrashDump IopDispatchSessionNotifications IopDumpCallAddPagesCallbacks IopDumpCallRemovePagesCallbacks IopDuplicateDetection IopEjectDevice IopEnumerateEnvironmentVariablesHal IopEnumerateEnvironmentVariablesTrEE IopFileUtilWalkDirectoryTreeHelper IopFreeMiniCompletionPacket IopGetBasicInformationFile IopInitializeBuiltinDriver IopInitializeCrashDump IopInitializeDeviceInstanceKey IopIoRateStartRateControl IopIrpStackProfilerDpcRoutine$fin$1 IopLiveDumpAddIptTraceBuffers IopLiveDumpAddTriageDumpData IopLiveDumpAllocateIptBuffers IopLiveDumpCallRemovePagesCallbacks IopLiveDumpGenerateIptSecondaryData IopLiveDumpMarkImportantDumpData IopLoadCrashdumpDriver IopLoadUnloadDriver IopMapTransfer IopNotifyAlreadyRegisteredFileSystems IopParentToRawTranslation IopParseDevice IopPassiveInterruptRealtimeWorker IopPassiveInterruptWorker IopPerfCompletionRoutine IopPoHandleIrp IopPortFindSuitableRange IopProcessIoTracking IopProcessWorkItem IopQueryInformation IopRaiseHardError IopReadFile IopRegistryCallback IopRegistryInitializeCallbacks IopReleaseDeviceResources IopRetestConfiguration IopRetrieveSystemDeviceName IopStartNextPacket IopStartNextPacketByKey IopSynchronousServiceTail IopTestConfiguration IopThreadStart IopTimerDispatch IopTimerDispatch$filt$2 IopTranslateAndAdjustReqDesc IopUncacheInterfaceInformation IopUnloadDriver IopUnloadSafeCompletion IopWriteFile IopWriteTriageDumpToFirmware IopXxxControlFile IopfCallDriver IopfCompleteRequest IovBuildDeviceIoControlRequest IovInitializeTimer IovpCancelRoutine IovpCompleteRequest2 IovpLocalCompletionRoutine IovpUnloadDriver IpmiLibpHandleErrorInterrupt IpmiLibpHandleReadInterrupt IpmiLibpHandleSendInterrupt IpmiLibpKcsBmcTransact IvtInitializeIdentityMappings IvtInitializeIommu IvtIommuSendCommand IvtIommuWaitCommand KdCallPowerHandlers KdEnterDebugger KdExitDebugger KdPowerTransitionEx KdPullRemoteFileEx KdpSendWaitContinue KdpSysReadBusData KdpSysWriteBusData KeBoostPriorityThread KeBugCheck2 KeCleanupImageTracepoints KeClockInterruptNotify KeConnectInterrupt KeConvertAuxiliaryCounterToPerformanceCounter KeConvertPerformanceCounterToAuxiliaryCounter KeCpuSetReportParkedProcessors KeEnumerateKernelStackSegments KeEnumerateProcessorDpcs KeEnumerateQueueApc KeFreezeExecution KeGenericProcessorCallback KeInitializeClock KeInitializeClockOtherProcessors KeInitializeEntropySystem KeInitializeTimerTable KeIpiGenericCall KeNumaInitialize KePrepareClockTimerForIdle KePrepareNonClockOwnerForIdle KeQueryAuxiliaryCounterFrequency KeQueryIntervalProfile KeQueryPerformanceCounter KeQueryWakeSource KeRecomputeCpuSetAffinityProcess KeRegisterProcessorChangeCallback KeRemoveQueueEx KeResumeClockTimerFromIdle KeRevertToUserMultipleGroupAffinityThread KeRundownApcQueues KeSetBasePriorityThread KeSetCpuSetsProcess KeSetSchedulingGroupRankBias KeSetSelectedCpuSetsThread KeSetSystemMultipleGroupAffinityThread KeSetThreadSchedulerAssist KeSetUserAffinityThread KeSetUserGroupAffinityThread KeSpecialUserApcKernelRoutine KeStallExecutionProcessor KeStartAllProcessors KeSuspendClockTimer KeSuspendClockTimerSafe KeSynchronizeExecution KeThawExecution KeUnmaskInterrupt KeUpdateThreadCpuSets KiAbProcessThreadLocks KiAbThreadUnboostCpuPriority KiAltReturnWorkerRoutine KiBalanceSetManagerDeferredRoutine$fin$0 KiBugCheckRecoveryCleanupFromCrashDump KiBugCheckRecoveryPrepareForCrashDump KiCallInterruptServiceRoutine KiCheckForThreadDispatch KiClearLastBranchRecordStack KiDeferredBugcheckRecoveryWorker KiDeliverApc KiDispatchCallout KiDispatchException KiDispatchInterrupt KiEntropyDpcRoutine KiExecuteAllDpcs KiExitDispatcher KiExpireTimer2 KiFinalizeTimer2Disablement KiFreezeTargetExecution KiGetNextTimerExpirationDueTime KiHandleBound KiHandleMultipleBugchecksDuringRecovery KiHvInterruptSubDispatch KiInitializeDynamicProcessorDpc KiInitiateGenericCallDpc KiIntSteerGetLineInformation KiIntSteerInit KiIntSteerSetDestination KiInterruptMessageDispatch KiInvokeBugCheckAddTriageDumpDataCallbacks KiInvokeBugCheckEntryCallbacks KiIpiGenericCallTarget KiIpiProcessRequests KiIpiSendRequestEx KiIsInterruptTypeSecondary KiLockServiceTable KiMaskInterruptInternal KiMaskSecondaryInterruptInternal KiOpGetPciConfigSpaceAccessInfoFromPhysicalAddress KiPerformExplicitGroupAssignment KiPopulateNodeInformation KiPreprocessFault KiProcessDeferredReadyList KiProcessExpiredTimerList KiProcessNMI KiProcessProfileList KiQueryProcessorNode KiQueryProximityNode KiReadyOutSwappedThreads KiRestoreClockTickRate KiResumeClockTimer KiRetireDpcList KiScanBugCheckCallbackList KiSetClockTickRate KiSetHeteroPolicyThread KiSetIntervalWorker KiSetLegacyAffinityThread KiSoftParkElectionDpcRoutine KiStartProfileTarget KiStopProfileTarget KiSwapThread KiSynchronizePassiveInterruptExecution KiTpHandleTrap KiTrackSystemCallEntry KiTrackSystemCallExit KiUnmaskSecondaryInterruptInternal KiUpdateProcessConcurrencyCounts KiUpdateTime KiUpdateVpBackingThreadPriorityDpcRoutine KiVmbusInterruptSubDispatch KseDriverUnloadImage KseDsCallbackHookAddDevice KseDsCallbackHookDriverStartIo KseDsCallbackHookDriverUnload KseDsCallbackHookIrpFunction KseDsCallbackHookIrpInternalDeviceControlFunction KseDsCallbackHookIrpPnpFunction KseDsCallbackHookIrpPowerFunction KseDsHookExAllocatePool KseDsHookExAllocatePoolWithTag KseDsHookExFreePool KseDsHookExFreePoolWithTag KseDsHookIoCreateDevice KseDsHookPoRequestPowerIrp KseHookExAllocatePoolWithTag KseHookMmGetVirtualForPhysical KseHookMmMapIoSpace KseHookQueryValueKey KsepApplyShimsToDriver KsepCacheInsert KsepCacheLookup KsepCacheReset KsepCacheUninitialize KsepCompletionSafeWrapper KxStartUserThread KxSwitchKernelStackCallout KyPlatformSwapStacksAndCall LZNT1CompressChunk LsaCallAuthenticationPackage LsaDeregisterLogonProcess LsaFreeReturnBuffer LsaLogonUser LsaLookupAuthenticationPackage LsaRegisterLogonProcess MiActOnLargeKernelHalPages MiAddNonSecuredPagesToDump MiAddPhysicalPagesToCrashDump MiApplyImageHotPatchRequest MiCaptureSecureImageBaseAddress MiCrashdumpRemovePte MiCreateImageFileMap MiDeliverPicoExceptionForProbedPage MiDereferenceSessionFinal MiEnumerateBasePatches MiEnumerateSlabAllocators MiFilterCrashDumpPte MiGetNextPageTablePte MiGetSectionStrongImageReference MiImageRvaRawEnumFirst MiImageRvaRawEnumNext MiInitializeChannelRangesTemporary MiInitializeLargePageColorSizes MiInitializeNumaRangesTemporary MiInvokePatchCallback MiIterateOverPartitions MiMirrorPerformBlackWrites MiMirrorPerformBrownWrites MiMirrorVerify MiProcessKernelCfgImageLoadConfig MiProcessVmAccessedInfo MiRelocateImage MiRelocateImageAgain MiRemoveEnclavePagesFromDump MiRemovePendingBadPagesFromDump MiReplaceRotateWithDemandZero MiRotateToFrameBuffer MiValidateExistingImage MiValidateSectionCreate MiValidateSectionSigningPolicy MiWalkPageTablesRecursively MiWalkPageTablesRecursivelyNoSynch MiYieldPageTableWalk MmAddPrivateDataToCrashDump MmDuplicateMemory MmEnumerateSystemImages MmGetDumpRange MmMapMdl MmUpdateMdlTrackerForMdlSwitch NP_CONTEXT::NpLeafDerefInternal NP_CONTEXT::NpLeafRemoveInternal NP_CONTEXT::NpiLeafPageIn NP_CONTEXT::NpiPerformPageOut NtCompareSigningLevels NtConvertBetweenAuxiliaryCounterAndPerformanceCounter NtCreateKeyTransacted_Stub NtCreateUserProcess NtDeleteKey NtDeleteValueKey NtEnumerateKey NtEnumerateValueKey NtFlushKey NtLockFile NtOpenKeyTransactedEx_Stub NtPlugPlayControl NtPowerInformation NtQueryAuxiliaryCounterFrequency NtQueryInformationFile NtQueryInformationProcess NtQueryKey NtQueryMultipleValueKey NtQueryObject NtQuerySecurityObject NtQuerySecurityPolicy NtQueryValueKey NtQueueApcThreadEx2 NtSetCachedSigningLevel2 NtSetInformationKey NtSetSystemInformation NtSetValueKey NtUnlockFile ObCloseHandleTableEntry ObCreateObjectEx ObDeleteCapturedInsertInfo ObInsertObjectEx ObOpenObjectByNameEx ObQueryNameStringMode ObQuerySecurityObject ObReferenceObjectByNameEx ObSetSecurityObjectByPointer ObShutdownSystem ObpAllocateAndQuerySecurityDescriptorInfo ObpAssignSecurity ObpCallPostOperationCallbacks ObpCallPreOperationCallbacks ObpCaptureObjectName ObpCloseHandle ObpCreateHandle ObpDecrementHandleCount ObpFreeObject ObpFreeObjectNameBuffer ObpGetObjectSecurity ObpIncrementHandleCountEx ObpLookupObjectName ObpParseSymbolicLinkEx ObpRemoveObjectRoutine Ordinal_23 Ordinal_27 Ordinal_28 Ordinal_7 PcwAddInstance PcwCloseInstance PcwCreateInstance PcwRegister PcwUnregister PdcPortSendMessageSynchronously PdcpPortReleaseResources Pdcv2pActivationClientCallback PerfLogImageUnload PfFbBufferListFlushStandby PfFbLogEntryComplete PfFbLogEntryReserve PfFileInfoNotify PfSnNameQueryWorker PfSnVolumeKeyQuery PfpOpenHandleClose PfpOpenHandleCreate PiDaDispatch PiDaFastIoDispatch PiDevCfgCopyObjectProperties PiDevCfgEnumDeviceKeys PiDevCfgResolveVariable PiDmCmObjectMatchCallback PiDmEnumObjectsWithCallback PiDmGetObjectListCallback PiDmListEnumObjectsWithCallback PiDmPnpObjectMatchCallback PiDmaGuardProcessNewDeviceNode PiForEachDriverQueryRoutine PiGetDmaAdapterFromBusInterface PiIommuAllocateExtension PiIommuBlockDevice PiIommuGetInterface PiIommuUnblockDevice PiPnpRtlEnumDevicesCallback PiPnpRtlEnumeratorFilterCallback PiPnpRtlInterfaceFilterCallback PiPnpRtlServiceFilterCallback PiProcessDriversLoadedOnSecureDevice PiProcessNewDeviceNode PiQueryAndAllocateBootResources PiUpdateDeviceResourceLists PipCallDriverAddDevice PipCslUpdateState PipDmgInitPhaseZero PipDmgSaveDeviceDmarPolicy PipDmgSetIommuDomainPolicyAndNotifyHal PipEnumeratePersistedMemoryCallback PipForAllDeviceNodesCallback PipIommuRetrieveDeviceId PipProcessPendingObjects PipUnprotectDevice PnpBootDeviceWait PnpCallDriverEntry PnpCompleteDeviceEvent PnpGetDeviceLocationStrings PnpHandleProcessWalkWorker PnpNotifyDriverCallback PnpProcessCompletedEject PnpProcessQueryRemoveAndEject PnpReplacePartitionUnit PnpRequestDeviceEjectExWorker PnprEndMirroring PnprGetPageDestination PnprIdentifyUnits PnprInitiateReplaceOperation PnprLoadPluginDriver PnprMarkOrMirrorPages PnprMirrorMarkedPages PnprQueryReplaceFeatures PnprQuiesceProcessorDpc PnprQuiesceProcessors PnprReplaceStart PnprSwap PnprSwapFinalize PnprWakeProcessors PoFxPowerOnCrashdumpDevice PoFxProcessorNotification PoFxRegisterDebugger PoFxStartDevicePowerManagement PoFxSystemLatencyNotify PoInitHiberServices PoInitSystem PoInitiateProcessorWake PoIssueCoalescingNotification PopAllocateHiberContext PopCallPowerSettingCallback PopCaptureSleepStudyStatistics PopCheckpointSystemSleep PopCleanCoolingExtension PopCoalescingCallback PopConnectToPolicyDevice PopDecompressHiberBlocks PopDiagTraceFirmwareS3Stats PopDisableCoolingExtension PopDispatchShutdownEvent PopEvaluatePowerButtonSuppressionState PopExecuteProcessorCallback PopExternalMonitorUpdatedWorker PopFreeHiberContext PopFxAcpiForwardNotification PopFxAcpiForwardPepAcpiNotifyRequest PopFxAcpiForwardPepWorkRequest PopFxCompleteComponentPerfState PopFxDeliverDevicePowerRequired PopFxDispatchPluginWorkOnce PopFxHandleDirectedPowerTransition PopFxIdleTimeoutDpcRoutine PopFxIdleWorker PopFxIdleWorkerTail PopFxInvokeDripsWatchdogCallback PopFxLowPowerEpochCallback PopFxNotifySystemStateTransition PopFxPlatformIdleVeto PopFxProcessWork PopFxProcessWorkPool PopFxProcessorIdleVeto PopFxRequestCommon PopFxResetSocSubsystemAccounting PopFxTransitionCriticalResource PopFxUpdateDeviceIdleTimer PopFxUpdatePlatformIdleState PopFxUpdateProcessorIdleState PopGracefulShutdown PopHandleNextState PopHiberCheckResume PopHiberReadChecksums PopInitPlatformSettings PopInvokeSystemStateHandler PopIrpWorker PopMarkComponentsBootPhase PopNetSetResiliencyPhaseBias PopNotifyShutdownListener PopPdcAreAllPhasesDisengaged PopPdcCompleteResiliencyCallback PopPdcDisengagePhases PopPdcEngagePhases PopPdcInvocation PopPdcSnapDiagnosticContext PopPepCompleteActivity PopPepDeviceDState PopPepInitializeDebuggerMasks PopPepIterateDeviceList PopPepStartActivity PopPepTriggerActivity PopPlPublishSystemPowerChange PopPluginAbandonDevice PopPluginAcpiNotificationStrict PopPluginInitializeSocSubsystemStaticInfo PopPluginNotifyActive PopPluginNotifyIdleState PopPluginPrepareDevice PopPluginQueryComponentPerfCapabilities PopPluginQueryComponentPerfSet PopPluginQueryComponentPerfSetName PopPluginQueryComponentPerfStates PopPluginQueryCurrentComponentPerfState PopPluginQuerySocSubsystemBlockingTime PopPluginQuerySocSubsystemCount PopPluginQuerySocSubsystemMetadata PopPluginRegisterComponentPerfStates PopPluginRegisterCrashdumpDevice PopPluginRegisterDevice PopPluginRequestComponentIdleConstraints PopPluginRequestComponentPerfState PopPluginRequestDeviceIdleConstraints PopPluginRequestPowerControl PopPluginUnregisterDevice PopPolicyDeviceRemove PopPolicyWorkerAction PopPolicyWorkerNotify PopPolicyWorkerThread PopPowerAggregatorDisengageModernStandby PopPowerAggregatorEngageModernStandby PopPowerAggregatorHandleIntentUnsafe PopPowerAggregatorInvokeStateMachine PopPowerAggregatorNotifyDisplayPoweredOn PopPowerAggregatorSystemTransitionEnterStateHandler PopPowerAggregatorSystemTransitionExitStateHandler PopPowerButtonWorkCallback PopPowerInformationInternal PopPowerRequestCallbackExecutionRequired PopPowerRequestHandleRequestUpdate PopProcessorIdleSelectNotification PopProcessorNotifyLpiCoordinatedStatesNotification PopProcessorParkMaskNotification PopProcessorParkNotification PopProcessorQueryCoordinatedDependencyNotification PopProcessorQueryPlatformStateNotification PopPropogateCoolingChange PopQueryBootSessionStandbyActivationInfo PopRequestCompletion PopRequestRead PopRequestWrite PopRestoreHiberContext PopSaveHiberContext PopShutdownHandler PopSleepstudyCaptureResiliencyStatistics PopSleepstudyCaptureSessionStatistics PopSleepstudyRegisterSessionCallback PopSleepstudyStartNextSession PopSstDiagInitializeResumeTimer PopStateTransitionTimeoutDispatch PopSuspendResumeInvocation PopSwitchUpdateUserShutdownScenarioState PopThermalZoneDpc$filt$2 PopTransitionSystemPowerStateEx PopTriggerMonitorPowerEvent PopUmpoProcessPowerMessage PopUpdatePdcSystemIdleState PopWatchdogWorker PopWriteHiberPages PopWriteImageHeader PpmCheckComputeEnergy PpmCheckReportComplete PpmCheckRun PpmHvSnapPerformanceAccumulation PpmIdleCheckProcessorStateEligibility PpmIdleExecuteTransition PpmIdleGuestComplete PpmIdleGuestPreExecute PpmIdleGuestTest PpmIdlePrepare PpmIdleSelectStates PpmIdleWaitForDependentTransitions PpmInstallNewIdleStates PpmParkComputeUnparkMask PpmParkReportMask PpmParkSteerInterrupts PpmPdcNotifyMediaBufferingUpdate PpmPerfApplyDomainState PpmPerfApplyHiddenProcessorState PpmPerfApplyLatencyHint PpmPerfApplyProcessorState PpmPerfArbitratorApplyProcessorState PpmPerfCheckForIllegalProcessorThrottle PpmPerfControlExecuteAction PpmPerfFeedbackCounterRead PpmPerfFeedbackCounterUpdate PpmPerfGetVmPerfConfig PpmPerfQueryProcMeasurementValues PpmPerfSelectProcessorState PpmPerfUpdateHwDebugData PpmQueryPlatformStateResidency PpmRemoveIdleStates PpmResetPerfEngineForProcessor PpmSnapPerformanceAccumulation PpmUpdateProcessorPolicy PpmUpdateTargetProcessorPolicy PpvUtilCallAddDevice PrExtControlOperations PsCallImageNotifyRoutines PsCheckProcessFileSigningLevel PsConvertToGuiThread PsEnumProcessThreads PsEnumProcesses PsGetAllocatedFullProcessImageNameEx PsPicoSystemCallDispatch PsPicoWalkUserStack PsQueryActivityModerationUserSettings PsQueryProcessSignatureMitigationPolicy PsSetExeModerationState PsSetProcessFaultInformation PsSyscallProviderDispatch PsTestProtectedProcessIncompatibility PsUnregisterSiloMonitor PspAllocateProcess PspCallJobHierarchyCallbacks PspCallProcessNotifyRoutines PspCallThreadNotifyRoutines PspChangeProcessExecutionState PspDeferredWorkerRoutine PspDeleteSiloContext PspExitThread PspExpandLimit PspExpandQuota PspInvokeCreateCallback PspInvokeTerminateCallback PspNetRateControlDispatch PspProcessDelete PspReleaseReturnedQuota PspReturnResourceQuota PspSetRateControlJobPreCallback PspSetRateControlProcessCallback PspSyscallProviderOptIn PspSyscallProviderServiceDispatch PspSyscallProviderServiceDispatchGeneric PspSystemThreadStartup PspTerminateProcess PspThreadDelete RcConsolidateFrames ReadPortWithIndex16 ReadPortWithIndex32 ReadPortWithIndex8 ReadRegisterWithIndex16 ReadRegisterWithIndex32 ReadRegisterWithIndex64 ReadRegisterWithIndex8 RtlApplyHotPatch RtlCaptureRetpolineImportRvas RtlCompressBuffer RtlDecompressBuffer RtlDecompressBufferEx RtlDecompressBufferEx2 RtlDecompressFragment RtlDecompressFragmentEx RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl RtlDeleteElementGenericTableAvlEx RtlDescribeChunk RtlDestroyHeap RtlEnumerateBoundaryDescriptorEntries RtlEnumerateGenericTableLikeADirectory RtlEnumerateHotPatchPatches RtlFindLowerBoundInSortedArray RtlGetCompressionWorkSpaceSize RtlInsertElementGenericTableAvl RtlInsertElementGenericTableFull RtlInsertElementGenericTableFullAvl RtlInternEntryDereference RtlInternTableIntern RtlLookupElementGenericTable RtlLookupElementGenericTableAvl RtlLookupElementGenericTableFullAvl RtlLookupFirstMatchingElementGenericTableAvl RtlReserveChunk RtlRunOnceExecuteOnce RtlpAllocateHeapInternal RtlpCallQueryRegistryRoutine RtlpCompressRvaList RtlpConstructImportRelocationFixup RtlpFcLinearSearchInSortedArray RtlpFindAndCommitPages RtlpFlsDataCleanup RtlpFlsFree RtlpFreeHeapInternal RtlpGetRegistryHandle RtlpHpAllocateHeap RtlpHpFixedHeapCreate RtlpHpFixedVsCommit RtlpHpFreeHeap RtlpHpLfhBucketActivate RtlpHpLfhBucketAllocateSlot RtlpHpLfhSlotAllocate RtlpHpLfhSubsegmentCreate RtlpHpLfhSubsegmentDecommitPages RtlpHpLfhSubsegmentFree RtlpHpVsChunkFree RtlpHpVsChunkSplit RtlpHpVsSubsegmentCommitPages RtlpHpVsSubsegmentCreate RtlpHpVsSubsegmentFree RtlpInternEntryCreate RtlpInternHashBucketsAllocate RtlpInternHashBucketsFree RtlpIsRangeAvailable RtlpMakeXpressCallback RtlpQueryRegistryValues RtlpTraceDatabaseInternalAdd RtlpTraceDatabaseInternalFind SC_DEVICE::GetStorageProperty SC_DEVICE::Initialize SC_DEVICE::UpdateStorageProperty SC_DISK::GenerateId SC_DISK::Initialize SC_DISK::ReadSectors SC_DISK::WriteSectors SLQueryLicenseValueInternal SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogTimerCallback SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogWorker SMKM_STORE_MGR<struct_SM_TRAITS>::SmIoCtxQueueWork SMKM_STORE_MGR<struct_SM_TRAITS>::SmStoreMgrCallback SPCallServerHandleCheckLicense SPCallServerHandleClepKdf SPCallServerHandleClepSign SPCallServerHandleGetAppPolicyValue SPCallServerHandleGetCurrentHardwareID SPCallServerHandleGetLicenseChallenge SPCallServerHandleIsAppLicensed SPCallServerHandleRemoveLicense SPCallServerHandleUpdateLicense SPCallServerHandleUpdatePolicies SPCallServerHandleWaitForDisplayWindow SdbpCheckAllAttributes SdbpCheckMatchingDevice SdbpGetSystemSdbFilePath SdbpMatchList SdbpOpenCompressedDatabase SeCodeIntegrityInitializePolicy SeCodeIntegrityQueryInformation SeCodeIntegritySetInformationProcess SeCompareSigningLevels SeGetCachedSigningLevel SeGetImageRequiredSigningLevel SeQuerySigningPolicy SeReleaseImageValidationContext SeValidateImageData SeValidateImageHeader SepAppendAceToTokenObjectAcl SepDeleteAccessState SepDuplicateToken SepIsImageInMinTcbList SepNotifyFileSystems SepParseElamCertResources SepQueueWorkItem SepRmCallLsa SepRmCommandServerThread SiGetSystemDeviceName SmDecompressBuffer SmKmIssueFileIo SmKmStoreDelete SmKmStoreDeleteWhenEmpty SmKmStoreDeleteWhenEmptyWorker SmKmStoreHelperCommandCleanup SmKmStoreHelperCommandProcess SpiInit SpiSend16 SshpAlpcProcessMessage SshpSendSessionData TlgAggregateInternalRegisteredProviderEtwCallback TtmiSessionDeviceListWorker TtmpCallAssignedToTerminal TtmpCallSetDisplayState TtmpCallSetInputMode Uart16550GetByte Uart16550InitializePortCommon Uart16550PutByte Uart16550RxReady Uart16550SetBaudCommon VerifierCcCopyWrite VerifierCcCopyWriteEx VerifierCcDeferWrite VerifierCcFastCopyWrite VerifierCcWaitForCurrentLazyWriterActivity VerifierCmRegisterCallback VerifierCmRegisterCallbackEx VerifierCmUnRegisterCallback VerifierDbgBreakPointWithStatus VerifierEtwRegister VerifierEtwRegisterClassicProvider VerifierEtwUnregister VerifierExAcquireFastMutex VerifierExAcquireFastMutexUnsafe VerifierExAcquireResourceExclusiveLite VerifierExAcquireResourceSharedLite VerifierExAcquireRundownProtection VerifierExAcquireRundownProtectionCacheAware VerifierExAcquireRundownProtectionCacheAwareEx VerifierExAcquireRundownProtectionEx VerifierExAcquireSharedStarveExclusive VerifierExAcquireSharedWaitForExclusive VerifierExAllocateCacheAwareRundownProtection VerifierExAllocatePool VerifierExAllocatePool2 VerifierExAllocatePool3 VerifierExAllocatePoolEx VerifierExAllocatePoolWithQuota VerifierExAllocatePoolWithQuotaTag VerifierExAllocatePoolWithTag VerifierExAllocatePoolWithTagPriority VerifierExConvertExclusiveToSharedLite VerifierExCreateCallback VerifierExDeleteLookasideListEx VerifierExDeleteNPagedLookasideList VerifierExDeletePagedLookasideList VerifierExDeleteResourceLite VerifierExEnterCriticalRegionAndAcquireResourceExclusive VerifierExEnterCriticalRegionAndAcquireResourceShared VerifierExEnterCriticalRegionAndAcquireSharedWaitForExclusive VerifierExEnterPriorityRegionAndAcquireResourceExclusive VerifierExEnterPriorityRegionAndAcquireResourceShared VerifierExFreePool VerifierExFreePoolWithTag VerifierExGetExclusiveWaiterCount VerifierExGetSharedWaiterCount VerifierExInitializeLookasideListEx VerifierExInitializeNPagedLookasideList VerifierExInitializePagedLookasideList VerifierExInitializeResourceLite VerifierExInterlockedAddLargeInteger VerifierExInterlockedInsertHeadList VerifierExInterlockedInsertTailList VerifierExInterlockedPopEntryList VerifierExInterlockedPushEntryList VerifierExInterlockedRemoveHeadList VerifierExIsProcessorFeaturePresent VerifierExIsResourceAcquiredExclusiveLite VerifierExIsResourceAcquiredSharedLite VerifierExRaiseAccessViolation VerifierExRaiseDatatypeMisalignment VerifierExRaiseStatus VerifierExRegisterCallback VerifierExReinitializeResourceLite VerifierExReleaseFastMutex VerifierExReleaseFastMutexUnsafe VerifierExReleaseResourceAndLeaveCriticalRegion VerifierExReleaseResourceAndLeavePriorityRegion VerifierExReleaseResourceForThreadLite VerifierExReleaseResourceLite VerifierExReleaseRundownProtection VerifierExReleaseRundownProtectionCacheAware VerifierExReleaseRundownProtectionEx VerifierExSetResourceOwnerPointer VerifierExSetResourceOwnerPointerEx VerifierExSetTimerResolution VerifierExTryToAcquireFastMutex VerifierExUnregisterCallback VerifierExUuidCreate VerifierExWaitForRundownProtectionRelease VerifierExWaitForRundownProtectionReleaseCacheAware VerifierExfAcquirePushLockExclusive VerifierExfAcquirePushLockShared VerifierExfReleasePushLock VerifierExfReleasePushLockShared VerifierExfTryAcquirePushLockShared VerifierExfTryToWakePushLock VerifierExpInterlockedFlushSList VerifierExpInterlockedPopEntrySList VerifierExpInterlockedPushEntrySList VerifierFsRtlAllocateFileLock VerifierFsRtlAreNamesEqual VerifierFsRtlBalanceReads VerifierFsRtlCancellableWaitForMultipleObjects VerifierFsRtlCancellableWaitForSingleObject VerifierFsRtlCheckLockForReadAccess VerifierFsRtlCheckLockForWriteAccess VerifierFsRtlCopyWrite VerifierFsRtlDeregisterUncProvider VerifierFsRtlDissectName VerifierFsRtlDoesNameContainWildCards VerifierFsRtlFastCheckLockForRead VerifierFsRtlFastCheckLockForWrite VerifierFsRtlFastUnlockAll VerifierFsRtlFastUnlockAllByKey VerifierFsRtlFastUnlockSingle VerifierFsRtlFreeFileLock VerifierFsRtlGetFileSize VerifierFsRtlGetNextFileLock VerifierFsRtlIncrementCcFastReadNoWait VerifierFsRtlIncrementCcFastReadWait VerifierFsRtlInitializeFileLock VerifierFsRtlIsNameInExpression VerifierFsRtlMdlReadCompleteDev VerifierFsRtlMdlWriteCompleteDev VerifierFsRtlNotifyFilterChangeDirectory VerifierFsRtlNotifyFilterReportChange VerifierFsRtlNotifyFullChangeDirectory VerifierFsRtlNotifyFullReportChange VerifierFsRtlPrivateLock VerifierFsRtlProcessFileLock VerifierFsRtlRegisterUncProvider VerifierFsRtlRegisterUncProviderEx VerifierFsRtlRemoveDotsFromPath VerifierFsRtlUninitializeFileLock VerifierFsRtlValidateReparsePointBuffer VerifierHalExamineMBR VerifierIoAcquireCancelSpinLock VerifierIoAcquireRemoveLockEx VerifierIoAcquireVpbSpinLock VerifierIoAllocateController VerifierIoAllocateDriverObjectExtension VerifierIoAllocateErrorLogEntry VerifierIoAllocateIrp VerifierIoAllocateIrpEx VerifierIoAllocateMdl VerifierIoAllocateWorkItem VerifierIoAttachDevice VerifierIoAttachDeviceToDeviceStack VerifierIoAttachDeviceToDeviceStackSafe VerifierIoCancelIrp VerifierIoCheckShareAccess VerifierIoConnectInterrupt VerifierIoConnectInterruptEx VerifierIoCreateController VerifierIoCreateDevice VerifierIoCreateFile VerifierIoCreateFileEx VerifierIoCreateFileSpecifyDeviceObjectHint VerifierIoCreateNotificationEvent VerifierIoCreateSymbolicLink VerifierIoCreateSynchronizationEvent VerifierIoCreateUnprotectedSymbolicLink VerifierIoDeleteController VerifierIoDeleteDevice VerifierIoDeleteSymbolicLink VerifierIoDetachDevice VerifierIoDisconnectInterrupt VerifierIoDisconnectInterruptEx VerifierIoFreeController VerifierIoFreeMdl VerifierIoGetAttachedDeviceReference VerifierIoGetConfigurationInformation VerifierIoGetDeviceDirectory VerifierIoGetDeviceInterfaceAlias VerifierIoGetDeviceInterfaces VerifierIoGetDeviceNumaNode VerifierIoGetDeviceObjectPointer VerifierIoGetDeviceProperty VerifierIoGetDevicePropertyData VerifierIoGetDeviceToVerify VerifierIoGetDriverDirectory VerifierIoGetFileObjectGenericMapping VerifierIoGetInitialStack VerifierIoInitializeIrp VerifierIoInitializeRemoveLockEx VerifierIoInitializeWorkItem VerifierIoInvalidateDeviceRelations VerifierIoIsWdmVersionAvailable VerifierIoOpenDeviceInterfaceRegistryKey VerifierIoOpenDeviceRegistryKey VerifierIoOpenDriverRegistryKey VerifierIoRaiseHardError VerifierIoRaiseInformationalHardError VerifierIoReadPartitionTable VerifierIoReadPartitionTableEx VerifierIoRegisterBootDriverReinitialization VerifierIoRegisterDeviceInterface VerifierIoRegisterDriverReinitialization VerifierIoRegisterLastChanceShutdownNotification VerifierIoRegisterPlugPlayNotification VerifierIoRegisterShutdownNotification VerifierIoReleaseCancelSpinLock VerifierIoReleaseRemoveLockAndWaitEx VerifierIoReleaseRemoveLockEx VerifierIoReleaseVpbSpinLock VerifierIoRemoveShareAccess VerifierIoReplacePartitionUnit VerifierIoReportDetectedDevice VerifierIoReportTargetDeviceChange VerifierIoReportTargetDeviceChangeAsynchronous VerifierIoReuseIrp VerifierIoSetCompletionRoutineEx VerifierIoSetDeviceInterfaceState VerifierIoSetDevicePropertyData VerifierIoSetDeviceToVerify VerifierIoSetPartitionInformation VerifierIoSetPartitionInformationEx VerifierIoSetShareAccess VerifierIoSetStartIoAttributes VerifierIoStartNextPacket VerifierIoUnregisterPlugPlayNotification VerifierIoUnregisterPlugPlayNotificationEx VerifierIoUnregisterShutdownNotification VerifierIoUpdateShareAccess VerifierIoVolumeDeviceToDosName VerifierIoWMIAllocateInstanceIds VerifierIoWMIRegistrationControl VerifierIoWMIWriteEvent VerifierIoWriteErrorLogEntry VerifierIoWritePartitionTable VerifierIoWritePartitionTableEx VerifierIofCompleteRequest VerifierKeAcquireGuardedMutex VerifierKeAcquireGuardedMutexUnsafe VerifierKeAcquireInStackQueuedSpinLockAtDpcLevel VerifierKeAcquireInStackQueuedSpinLockCommon VerifierKeAcquireInStackQueuedSpinLockForDpc VerifierKeAcquireInStackQueuedSpinLockRaiseToSynch VerifierKeAcquireInterruptSpinLock VerifierKeAcquireQueuedSpinLock VerifierKeAcquireQueuedSpinLockRaiseToSynch VerifierKeAcquireSpinLockAtDpcLevel VerifierKeAcquireSpinLockForDpc VerifierKeAcquireSpinLockRaiseToDpc VerifierKeAreAllApcsDisabled VerifierKeAreApcsDisabled VerifierKeCancelTimer VerifierKeClearEvent VerifierKeDelayExecutionThread VerifierKeDeregisterNmiCallback VerifierKeEnterCriticalRegion VerifierKeEnterGuardedRegion VerifierKeFlushQueuedDpcs VerifierKeInitializeDeviceQueue VerifierKeInitializeEvent VerifierKeInitializeGuardedMutex VerifierKeInitializeMutant VerifierKeInitializeMutex VerifierKeInitializeSemaphore VerifierKeInitializeTimer VerifierKeInitializeTimerEx VerifierKeInsertByKeyDeviceQueue VerifierKeInsertDeviceQueue VerifierKeInsertHeadQueue VerifierKeInsertQueue VerifierKeInsertQueueDpc VerifierKeLeaveCriticalRegion VerifierKeLeaveGuardedRegion VerifierKeLowerIrql VerifierKePulseEvent VerifierKeQueryPriorityThread VerifierKeQueryRuntimeThread VerifierKeReadStateEvent VerifierKeReadStateMutex VerifierKeReadStateSemaphore VerifierKeReadStateTimer VerifierKeRegisterNmiCallback VerifierKeReleaseGuardedMutex VerifierKeReleaseGuardedMutexUnsafe VerifierKeReleaseInStackQueuedSpinLock VerifierKeReleaseInStackQueuedSpinLockForDpc VerifierKeReleaseInStackQueuedSpinLockFromDpcLevel VerifierKeReleaseInterruptSpinLock VerifierKeReleaseMutant VerifierKeReleaseMutex VerifierKeReleaseQueuedSpinLock VerifierKeReleaseSemaphore VerifierKeReleaseSpinLock VerifierKeReleaseSpinLockForDpc VerifierKeReleaseSpinLockFromDpcLevel VerifierKeRemoveByKeyDeviceQueue VerifierKeRemoveDeviceQueue VerifierKeRemoveEntryDeviceQueue VerifierKeRemoveQueue VerifierKeRemoveQueueDpc VerifierKeResetEvent VerifierKeRestoreExtendedProcessorState VerifierKeSaveExtendedProcessorState VerifierKeSetEvent VerifierKeSetSystemGroupAffinityThread VerifierKeSetTimer VerifierKeSetTimerEx VerifierKeSynchronizeExecution VerifierKeTestSpinLock VerifierKeTryToAcquireGuardedMutex VerifierKeTryToAcquireQueuedSpinLock VerifierKeTryToAcquireQueuedSpinLockRaiseToSynch VerifierKeTryToAcquireSpinLockAtDpcLevel VerifierKeWaitForMultipleObjects VerifierKeWaitForSingleObject VerifierMmAddPhysicalMemory VerifierMmAllocateContiguousMemory VerifierMmAllocateContiguousMemoryEx VerifierMmAllocateContiguousMemorySpecifyCache VerifierMmAllocateContiguousMemorySpecifyCacheNode VerifierMmAllocateContiguousNodeMemory VerifierMmAllocateMappingAddress VerifierMmAllocateNodePagesForMdlEx VerifierMmAllocateNonCachedMemory VerifierMmAllocatePagesForMdl VerifierMmAllocatePagesForMdlEx VerifierMmBuildMdlForNonPagedPool VerifierMmCreateMdl VerifierMmCreateMirror VerifierMmCreateSection VerifierMmDoesFileHaveUserWritableReferences VerifierMmFreeContiguousMemory VerifierMmFreeContiguousMemorySpecifyCache VerifierMmFreeNonCachedMemory VerifierMmFreePagesFromMdl VerifierMmGetPhysicalMemoryRanges VerifierMmGetSystemRoutineAddress VerifierMmLockPagableDataSection VerifierMmLockPagableSectionByHandle VerifierMmMapIoSpace VerifierMmMapLockedPages VerifierMmMapLockedPagesSpecifyCache VerifierMmMapLockedPagesWithReservedMapping VerifierMmMapViewOfSection VerifierMmPageEntireDriver VerifierMmPrefetchPages VerifierMmProbeAndLockPages VerifierMmProbeAndLockProcessPages VerifierMmProtectMdlSystemAddress VerifierMmRemovePhysicalMemory VerifierMmResetDriverPaging VerifierMmSecureVirtualMemory VerifierMmUnlockPagableImageSection VerifierMmUnlockPages VerifierMmUnmapIoSpace VerifierMmUnmapLockedPages VerifierMmUnsecureVirtualMemory VerifierNtCreateFile VerifierNtCreateSection VerifierNtDeleteFile VerifierNtLockFile VerifierNtMapViewOfSection VerifierNtOpenFile VerifierNtReadFile VerifierNtSetInformationFile VerifierNtUnlockFile VerifierNtWriteFile VerifierObGetObjectSecurity VerifierObReferenceObjectByHandle VerifierObReferenceObjectByHandleWithTag VerifierObReferenceObjectByPointer VerifierObReferenceObjectByPointerWithTag VerifierObReleaseObjectSecurity VerifierObfDereferenceObject VerifierObfDereferenceObjectWithTag VerifierObfReferenceObject VerifierObfReferenceObjectWithTag VerifierPoCallDriver VerifierPoFxActivateComponent VerifierPoFxCompleteDevicePowerNotRequired VerifierPoFxCompleteIdleCondition VerifierPoFxCompleteIdleState VerifierPoFxIdleComponent VerifierPoFxNotifySurprisePowerOn VerifierPoFxPowerControl VerifierPoFxRegisterDevice VerifierPoFxReportDevicePoweredOn VerifierPoFxSetComponentLatency VerifierPoFxSetComponentResidency VerifierPoFxSetComponentWake VerifierPoFxSetDeviceIdleTimeout VerifierPoFxStartDevicePowerManagement VerifierPoFxUnregisterDevice VerifierPoRequestPowerIrp VerifierPortExAllocatePoolWithQuotaTag VerifierPortExAllocatePoolWithTagPriority VerifierPortIoAllocateIrp VerifierPortIoAllocateMdl VerifierPortIoAllocateWorkItem VerifierPortKeReleaseSpinLock VerifierProbeForRead VerifierProbeForWrite VerifierPsAssignImpersonationToken VerifierPsCreateSystemThread VerifierPsDereferenceImpersonationToken VerifierPsDereferencePrimaryToken VerifierPsDisableImpersonation VerifierPsGetVersion VerifierPsImpersonateClient VerifierPsReferenceImpersonationToken VerifierPsReferencePrimaryToken VerifierPsRemoveLoadImageNotifyRoutine VerifierPsRestoreImpersonation VerifierPsRevertToSelf VerifierPsSetCreateProcessNotifyRoutine VerifierPsSetCreateProcessNotifyRoutineEx VerifierPsSetCreateThreadNotifyRoutine VerifierPsSetLoadImageNotifyRoutine VerifierPsTerminateSystemThread VerifierRtlAnsiStringToUnicodeString VerifierRtlCheckRegistryKey VerifierRtlCompareUnicodeString VerifierRtlCreateRegistryKey VerifierRtlCreateSystemVolumeInformationFolder VerifierRtlCreateUnicodeString VerifierRtlDeleteRegistryValue VerifierRtlDowncaseUnicodeChar VerifierRtlDowncaseUnicodeString VerifierRtlDuplicateUnicodeString VerifierRtlEqualUnicodeString VerifierRtlFreeUnicodeString VerifierRtlGUIDFromString VerifierRtlGenerateClass5Guid VerifierRtlHashUnicodeString VerifierRtlOemStringToCountedUnicodeString VerifierRtlOemStringToUnicodeString VerifierRtlQueryRegistryValueWithFallback VerifierRtlQueryRegistryValues VerifierRtlQueryRegistryValuesEx VerifierRtlStringFromGUID VerifierRtlUTF8ToUnicodeN VerifierRtlUnicodeStringToAnsiString VerifierRtlUnicodeStringToCountedOemString VerifierRtlUnicodeStringToOemString VerifierRtlUnicodeToUTF8N VerifierRtlUpcaseUnicodeChar VerifierRtlUpcaseUnicodeString VerifierRtlUpcaseUnicodeStringToAnsiString VerifierRtlUpcaseUnicodeStringToCountedOemString VerifierRtlUpcaseUnicodeStringToOemString VerifierRtlWriteRegistryValue VerifierRtlxAnsiStringToUnicodeSize VerifierRtlxUnicodeStringToAnsiSize VerifierSeAccessCheck VerifierSeAssignSecurity VerifierSeAssignSecurityEx VerifierSeDeassignSecurity VerifierSeLockSubjectContext VerifierSeReleaseSubjectContext VerifierSeSinglePrivilegeCheck VerifierSeUnlockSubjectContext VerifierSeValidSecurityDescriptor VerifierZwAccessCheckAndAuditAlarm VerifierZwAddBootEntry VerifierZwAddDriverEntry VerifierZwAdjustPrivilegesToken VerifierZwAllocateLocallyUniqueId VerifierZwAllocateVirtualMemory VerifierZwAlpcAcceptConnectPort VerifierZwAlpcConnectPort VerifierZwAlpcCreatePort VerifierZwAlpcCreatePortSection VerifierZwAlpcCreateResourceReserve VerifierZwAlpcCreateSectionView VerifierZwAlpcCreateSecurityContext VerifierZwAlpcQueryInformation VerifierZwAlpcSendWaitReceivePort VerifierZwAlpcSetInformation VerifierZwCancelIoFile VerifierZwCancelTimer VerifierZwClose VerifierZwCloseObjectAuditAlarm VerifierZwCommitComplete VerifierZwCommitEnlistment VerifierZwCommitTransaction VerifierZwConnectPort VerifierZwCreateDirectoryObject VerifierZwCreateEnlistment VerifierZwCreateEvent VerifierZwCreateFile VerifierZwCreateJobObject VerifierZwCreateKey VerifierZwCreateKeyTransacted VerifierZwCreateResourceManager VerifierZwCreateSection VerifierZwCreateSymbolicLinkObject VerifierZwCreateTimer VerifierZwCreateTransaction VerifierZwCreateTransactionManager VerifierZwDeleteBootEntry VerifierZwDeleteFile VerifierZwDeleteKey VerifierZwDeleteValueKey VerifierZwDeviceIoControlFile VerifierZwDisplayString VerifierZwDuplicateObject VerifierZwDuplicateToken VerifierZwEnumerateBootEntries VerifierZwEnumerateDriverEntries VerifierZwEnumerateKey VerifierZwEnumerateTransactionObject VerifierZwEnumerateValueKey VerifierZwFlushBuffersFile VerifierZwFlushBuffersFileEx VerifierZwFlushInstructionCache VerifierZwFlushKey VerifierZwFlushVirtualMemory VerifierZwFreeVirtualMemory VerifierZwFsControlFile VerifierZwGetNotificationResourceManager VerifierZwLoadDriver VerifierZwLoadKey VerifierZwLockFile VerifierZwMapViewOfSection VerifierZwModifyBootEntry VerifierZwModifyDriverEntry VerifierZwNotifyChangeKey VerifierZwOpenDirectoryObject VerifierZwOpenEnlistment VerifierZwOpenEvent VerifierZwOpenFile VerifierZwOpenJobObject VerifierZwOpenKey VerifierZwOpenKeyEx VerifierZwOpenKeyTransacted VerifierZwOpenKeyTransactedEx VerifierZwOpenProcess VerifierZwOpenProcessToken VerifierZwOpenProcessTokenEx VerifierZwOpenResourceManager VerifierZwOpenSection VerifierZwOpenSymbolicLinkObject VerifierZwOpenThread VerifierZwOpenThreadToken VerifierZwOpenThreadTokenEx VerifierZwOpenTimer VerifierZwOpenTransaction VerifierZwOpenTransactionManager VerifierZwPowerInformation VerifierZwPrePrepareComplete VerifierZwPrePrepareEnlistment VerifierZwPrepareComplete VerifierZwPrepareEnlistment VerifierZwProtectVirtualMemory VerifierZwPulseEvent VerifierZwQueryBootEntryOrder VerifierZwQueryBootOptions VerifierZwQueryDefaultLocale VerifierZwQueryDefaultUILanguage VerifierZwQueryDirectoryFile VerifierZwQueryDirectoryFileEx VerifierZwQueryDirectoryObject VerifierZwQueryDriverEntryOrder VerifierZwQueryEaFile VerifierZwQueryFullAttributesFile VerifierZwQueryInformationEnlistment VerifierZwQueryInformationFile VerifierZwQueryInformationJobObject VerifierZwQueryInformationProcess VerifierZwQueryInformationResourceManager VerifierZwQueryInformationThread VerifierZwQueryInformationToken VerifierZwQueryInformationTransaction VerifierZwQueryInformationTransactionManager VerifierZwQueryInstallUILanguage VerifierZwQueryKey VerifierZwQueryLicenseValue VerifierZwQueryObject VerifierZwQueryQuotaInformationFile VerifierZwQuerySection VerifierZwQuerySecurityObject VerifierZwQuerySymbolicLinkObject VerifierZwQuerySystemInformation VerifierZwQueryValueKey VerifierZwQueryVolumeInformationFile VerifierZwReadFile VerifierZwReadOnlyEnlistment VerifierZwRecoverEnlistment VerifierZwRecoverTransactionManager VerifierZwRemoveIoCompletionEx VerifierZwRenameKey VerifierZwReplaceKey VerifierZwRequestWaitReplyPort VerifierZwResetEvent VerifierZwRestoreKey VerifierZwRollbackComplete VerifierZwRollbackEnlistment VerifierZwRollbackTransaction VerifierZwSetBootEntryOrder VerifierZwSetBootOptions VerifierZwSetDriverEntryOrder VerifierZwSetEaFile VerifierZwSetEvent VerifierZwSetInformationEnlistment VerifierZwSetInformationFile VerifierZwSetInformationJobObject VerifierZwSetInformationKey VerifierZwSetInformationObject VerifierZwSetInformationProcess VerifierZwSetInformationResourceManager VerifierZwSetInformationThread VerifierZwSetInformationToken VerifierZwSetInformationTransaction VerifierZwSetQuotaInformationFile VerifierZwSetSecurityObject VerifierZwSetSystemInformation VerifierZwSetSystemTime VerifierZwSetTimer VerifierZwSetTimerEx VerifierZwSetValueKey VerifierZwSetVolumeInformationFile VerifierZwTerminateProcess VerifierZwTranslateFilePath VerifierZwUnloadDriver VerifierZwUnloadKey VerifierZwUnlockFile VerifierZwUnmapViewOfSection VerifierZwWaitForMultipleObjects VerifierZwWaitForSingleObject VerifierZwWriteFile VfAllocateAdapterChannel VfAllocateAdapterChannelEx VfAllocateCommonBuffer VfAllocateCommonBufferEx VfAllocateCommonBufferVector VfAllocateCommonBufferWithBounds VfAllocateCrashDumpRegisters VfAllocateCrashDumpRegistersEx VfAllocateDomainCommonBuffer VfAvlEnumerateNodes VfBuildMdlFromScatterGatherList VfBuildScatterGatherList VfBuildScatterGatherListEx VfCalculateScatterGatherListSize VfCancelAdapterChannel VfCancelMappedTransfer VfConfigureAdapterChannel VfCreateCommonBufferFromMdl VfExAllocPoolInternal VfFlushAdapterBuffers VfFlushAdapterBuffersEx VfFlushDmaBuffer VfFreeAdapterChannel VfFreeAdapterObject VfFreeCommonBuffer VfFreeCommonBufferFromVector VfFreeCommonBufferVector VfFreeCrashDumpRegistersEx VfFreeMapRegisters VfGetCommonBufferFromVectorByIndex VfGetDmaAdapter VfGetDmaAdapterInfo VfGetDmaAlignment VfGetDmaDomain VfGetDmaTransferInfo VfGetScatterGatherList VfGetScatterGatherListEx VfHalAllocateMapRegisters VfInitializeDmaTransferContext VfIoFreeIrp VfIrpDatabaseEntryReleaseLock VfJoinDmaDomain VfLeaveDmaDomain VfMajorAdvanceIrpStatus VfMajorBuildIrpLogEntry VfMajorIsNewRequest VfMajorIsValidIrpStatus VfMajorTestStartedPdoStack VfMajorVerifyFinalIrpStack VfMajorVerifyIrpStackDownward VfMajorVerifyIrpStackUpward VfMajorVerifyNewIrp VfMajorVerifyNewRequest VfMapTransfer VfMapTransferEx VfNotifyOfHibernate VfPendingMoreProcessingRequired VfPutDmaAdapter VfPutScatterGatherList VfQueryDispatchTable VfReadDmaCounter VfRemoveContext ViAdapterCallback ViCtxIsr ViCtxIsrMessageBased ViKeAcquireSpinLockCommon ViPendingCompleteAfterWait ViPtCaptureTraceInformationCallBack ViScatterGatherCallback ViSpecialAllocateCommonBuffer ViSpecialFreeCommonBuffer ViXdvDriverLoadImage ViXdvSetXdvKernelUtilities VmpCleanProcessAddressSpace VmpPrefetchVirtualAddresses VslHandleKsrCall VslpIumPhase0Initialize WdInstrExecuteInstruction WdtpBarkWorkerThread WdtpTimerCallback WheaFlushETWEventsWorkerRoutine WheaInitialize WheaReportHwError WheaSignalHandlerOverride WheapCallErrorSourceCorrect WheapCallErrorSourceInitialize WheapCallErrorSourceRecover WheapCallErrorSourceUninitialize WheapCallInUsePageNotificationCallbacks WheapDeferredRecoveryServiceDpcRoutine WheapDeferredRecoveryServiceWorker WheapGenericErrSrcRecover WheapLogIpmiSELEventHighIrql WheapReportBootError WheapWorkQueueWorkerRoutine WmipForwardWmiIrp WmipProcessEvent WmipUnreferenceEntry WritePortWithIndex16 WritePortWithIndex32 WritePortWithIndex8 WriteRegisterWithIndex16 WriteRegisterWithIndex32 WriteRegisterWithIndex64 WriteRegisterWithIndex8 XdvExInitializeLookasideListExInternal XdvExInitializeNPagedLookasideListInternal XdvIoAllocateIrp XdvIoAllocateMdl XdvIoAllocateWorkItem XdvIoBuildDeviceIoControlRequest XdvIoBuildSynchronousFsdRequest XdvIopBuildAsynchronousFsdRequest XmEmulateStream XmInt1aFindPciClassCode XmInt1aFindPciDevice XmInt1aReadConfigRegister XmInt1aWriteConfigRegister _CmAddDeviceToContainer _CmAddPanelDevice _CmClassFilterCallback _CmClassSubkeyCallback _CmContainerListGenericObjectCallback _CmCreateDevice _CmCreateDeviceContainer _CmCreateDeviceInterface _CmCreateDevicePanel _CmCreateInstallerClass _CmCreateInterfaceClass _CmDeleteCommonClassRegKey _CmDeleteDevice _CmDeleteDeviceContainer _CmDeleteDeviceContainerRegKey _CmDeleteDeviceInterface _CmDeleteDeviceInterfaceRegKey _CmDeleteDevicePanel _CmDeleteDevicePanelRegKey _CmDeleteDeviceRegKey _CmDeleteInstallerClass _CmDeleteInterfaceClass _CmDeviceClassesSubkeyCallback _CmDevicePanelEnumSubkeyCallback _CmEnumDevicesInContainerWithCallback _CmEnumDevicesInContainerWithCallbackWorker _CmEnumSubkeyCallback _CmGetDeviceRegProp _CmGetInstallerClassRegProp _CmGetMatchingCommonClassList _CmGetMatchingDeviceContainerList _CmGetMatchingDeviceInterfaceList _CmGetMatchingDeviceList _CmGetMatchingDevicePanelList _CmGetMatchingFilteredDeviceInterfaceList _CmGetMatchingFilteredDeviceList _CmIsDeviceInterfaceEnabled _CmOpenCommonClassRegKey _CmOpenDeviceContainerRegKey _CmOpenDeviceInterfaceRegKey _CmOpenDevicePanelRegKey _CmOpenDeviceRegKey _CmRaiseCreateEvent _CmRaiseDeleteEvent _CmRaisePropertyChangeEvent _CmRemoveDeviceFromContainer _CmRemovePanelDevice _CmServiceFilterCallback _CmSetDeviceRegProp _CmSetInstallerClassRegProp _NtPlugPlayGetDeviceProperty _NtPlugPlayGetDeviceRelatedDevice _NtPlugPlayGetDeviceRelationsList _NtPlugPlayGetDeviceStatus _PnpCmMatchCallbackRoutine _PnpContainerRaiseDevicesChangeEvent _PnpCreateObject _PnpCreateObjectDispatch _PnpCtxInternalEnumKeyCallback _PnpCtxRegQueryValueIndirect _PnpDeleteObject _PnpDeleteObjectDispatch _PnpDeviceRaisePropertyChangeEventWorker _PnpGetMappedPropertyDispatch _PnpGetMappedPropertyKeysDispatch _PnpGetMappedPropertyLocalesDispatch _PnpGetObjectList _PnpGetObjectListDispatch _PnpGetObjectProperty _PnpGetObjectPropertyKeys _PnpGetObjectPropertyLocales _PnpInstallerClassRaisePropertyChangeEventWorker _PnpInterfaceClassRaisePropertyChangeEventWorker _PnpInterfaceRaisePropertyChangeEventWorker _PnpNotifyDerivedKeys _PnpObjectListCallback _PnpObjectRaiseCreateEvent _PnpObjectRaiseDeleteEvent _PnpObjectRaiseDevicesChangeEvent _PnpObjectRaisePropertyChangeEvent _PnpOpenObjectRegKey _PnpOpenObjectRegKeyDispatch _PnpSetMappedPropertyDispatch _PnpSetObjectProperty _PnpUpdateInterfacesCallback _PnpValidateObjectName _PnpValidateObjectNameDispatch _RegRtlOpenKeyTransacted _SysCtxInternalEnumSubkeyCallback _tlgEnableCallback entry pIoQueryBusDescription pIoQueryDeviceDescription qsort qsort_s vDbgPrintExWithPrefixInternal wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToServiceDirect wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState x86BiosGetPciBusData x86BiosReadPciDataPort x86BiosSetPciBusData x86BiosWritePciDataPort
paramcount
0
0
address
14041d440
14041d510
sig
undefined _guard_dispatch_icall(void)
undefined _guard_dispatch_icall(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
_guard_dispatch_icall Called Diff
--- _guard_dispatch_icall called
+++ _guard_dispatch_icall called
@@ -1 +1 @@
- FUN_14041d490
+ FUN_14041d560
_guard_dispatch_icall Calling Diff
--- _guard_dispatch_icall calling
+++ _guard_dispatch_icall calling
@@ -701,3 +701,3 @@
- FUN_1404166db
- FUN_14066b630
- FUN_14066c334
+ FUN_1404167ab
+ FUN_14066b730
+ FUN_14066c434
@@ -706,14 +706,14 @@
- FUN_140709640
- FUN_140709974
- FUN_140768f34
- FUN_14084356c
- FUN_140a4b524
- FUN_140a4b914
- FUN_140a4c0d0
- FUN_140a4c310
- FUN_140a4c860
- FUN_140a4ce10
- FUN_140a4d1c4
- FUN_140a4db54
- FUN_140a4e0ec
- FUN_140a4e508
+ FUN_14070a1a0
+ FUN_14070a4d4
+ FUN_140769944
+ FUN_140843f7c
+ FUN_140a4b4b4
+ FUN_140a4b8a4
+ FUN_140a4c060
+ FUN_140a4c2a0
+ FUN_140a4c7f0
+ FUN_140a4cda0
+ FUN_140a4d154
+ FUN_140a4dae4
+ FUN_140a4e07c
+ FUN_140a4e498
@@ -1529,0 +1530 @@
+ KxSwitchKernelStackCallout
@@ -1531 +1531,0 @@
- KySwitchKernelStackCallout
@@ -2903,0 +2904,3 @@
+ wil_details_FeatureReporting_ReportUsageToService
+ wil_details_FeatureReporting_ReportUsageToServiceDirect
+ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
name,fullname,refcount,sig,address,calling
ratio
0.9
i_ratio
0.82
m_ratio
1.0
b_ratio
1.0
match_types
ExactInstructionsFunctionHasher
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
FUN_140707cb0
FUN_140708564
fullname
FUN_140707cb0
FUN_140708564
refcount
3
4
length
145
145
called
ExFreePoolWithTag RtlCompareMemory WbHashData
ExFreePoolWithTag RtlCompareMemory WbHashData
calling
WbCreateHeapExecutedBlock WbInitializeEncryptionSegment
FUN_14070897c WbInitializeEncryptionSegment
paramcount
0
0
address
140707cb0
140708564
sig
undefined FUN_140707cb0(void)
undefined FUN_140708564(void)
sym_type
Function
Function
sym_source
DEFAULT
DEFAULT
external
False
False
FUN_140707cb0 Calling Diff
--- FUN_140707cb0 calling
+++ FUN_140708564 calling
@@ -1 +1 @@
- WbCreateHeapExecutedBlock
+ FUN_14070897c
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
1.0
i_ratio
0.79
m_ratio
1.0
b_ratio
1.0
match_types
ExactInstructionsFunctionHasher
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
fullname
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
refcount
37
38
length
53
53
called
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
calling
Expand for full list: Feature_1429194047__private_IsEnabled Feature_2485082431__private_IsEnabled Feature_3566457150__private_IsEnabled Feature_CcImprovementsForReFS__private_IsEnabled Feature_FastResource2__private_IsEnabled Feature_FsctlProcessMitigation__private_IsEnabled Feature_ImprovedCpuAttribution__private_GetCachedFeatureEnabledState Feature_LivedumpProcessFiltering__private_IsEnabled Feature_Mercury_App_Backup__private_IsEnabled Feature_Mercury_App_Restore__private_IsEnabled Feature_PerClassEnergyUnsupported__private_IsEnabled Feature_PerClassEnergyUnsupported__private_IsEnabledWithReporting Feature_REFSDV__private_IsEnabled Feature_SensorDimDisplayTimeouts__private_IsEnabled Feature_Servicing_CopyEABufferHandling__private_IsEnabled Feature_Servicing_DeadlineQosReschedule__private_IsEnabled Feature_Servicing_GuardDroppedCharges__private_IsEnabled Feature_Servicing_IommuApiPasid__private_IsEnabled Feature_Servicing_Kernel_DMA_Compliance__private_IsEnabled Feature_Servicing_MercuryNewSdbTagsForBackup__private_IsEnabled Feature_Servicing_NonPagedQueryLogicalProcessorRelationship__private_IsEnabled Feature_Servicing_OemToUnicodeFix__private_IsEnabled Feature_Servicing_OplockCancelTracing__private_IsEnabled Feature_Servicing_OplocksWritableMappedSectionsFix__private_IsEnabled Feature_Servicing_PPMFixUnparkingAllCores__private_IsEnabled Feature_Servicing_PageZeroingParkedCoresFix__private_IsEnabled Feature_Servicing_Ref_Count_Disacrded_Kcbs__private_IsEnabled Feature_Servicing_RevalidateNoUMCI_42288025__private_IsEnabled Feature_Servicing_SecImageNoExecuteIntegrityCheck__private_IsEnabled Feature_Servicing_SecureDevAts__private_IsEnabled Feature_Servicing_SetVadPageSize__private_IsEnabled Feature_Servicing_WriteProcessMemory_SGXDebug__private_IsEnabled Feature_TriageDumpDataExtension__private_IsEnabled Feature_VHDAutoAttachOnBoot__private_IsEnabled wil_details_GetCurrentFeatureEnabledState
Expand for full list: Feature_1429194047__private_IsEnabled Feature_2485082431__private_IsEnabled Feature_3566457150__private_IsEnabled Feature_4256151870__private_IsEnabled Feature_CcImprovementsForReFS__private_IsEnabled Feature_FastResource2__private_IsEnabled Feature_FsctlProcessMitigation__private_IsEnabled Feature_ImprovedCpuAttribution__private_GetCachedFeatureEnabledState Feature_LivedumpProcessFiltering__private_IsEnabled Feature_Mercury_App_Backup__private_IsEnabled Feature_Mercury_App_Restore__private_IsEnabled Feature_PerClassEnergyUnsupported__private_IsEnabled Feature_PerClassEnergyUnsupported__private_IsEnabledWithReporting Feature_REFSDV__private_IsEnabled Feature_SensorDimDisplayTimeouts__private_IsEnabled Feature_Servicing_CopyEABufferHandling__private_IsEnabled Feature_Servicing_DeadlineQosReschedule__private_IsEnabled Feature_Servicing_GuardDroppedCharges__private_IsEnabled Feature_Servicing_IommuApiPasid__private_IsEnabled Feature_Servicing_Kernel_DMA_Compliance__private_IsEnabled Feature_Servicing_MercuryNewSdbTagsForBackup__private_IsEnabled Feature_Servicing_NonPagedQueryLogicalProcessorRelationship__private_IsEnabled Feature_Servicing_OemToUnicodeFix__private_IsEnabled Feature_Servicing_OplockCancelTracing__private_IsEnabled Feature_Servicing_OplocksWritableMappedSectionsFix__private_IsEnabled Feature_Servicing_PPMFixUnparkingAllCores__private_IsEnabled Feature_Servicing_PageZeroingParkedCoresFix__private_IsEnabled Feature_Servicing_Ref_Count_Disacrded_Kcbs__private_IsEnabled Feature_Servicing_RevalidateNoUMCI_42288025__private_IsEnabled Feature_Servicing_SecImageNoExecuteIntegrityCheck__private_IsEnabled Feature_Servicing_SecureDevAts__private_IsEnabled Feature_Servicing_SetVadPageSize__private_IsEnabled Feature_Servicing_WriteProcessMemory_SGXDebug__private_IsEnabled Feature_TriageDumpDataExtension__private_IsEnabled Feature_VHDAutoAttachOnBoot__private_IsEnabled wil_details_GetCurrentFeatureEnabledState
paramcount
0
0
address
1402d1afc
1402d189c
sig
undefined wil_details_FeatureStateCache_GetCachedFeatureEnabledState(void)
undefined wil_details_FeatureStateCache_GetCachedFeatureEnabledState(void)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
wil_details_FeatureStateCache_GetCachedFeatureEnabledState Calling Diff
--- wil_details_FeatureStateCache_GetCachedFeatureEnabledState calling
+++ wil_details_FeatureStateCache_GetCachedFeatureEnabledState calling
@@ -3,0 +4 @@
+ Feature_4256151870__private_IsEnabled
wil_details_FeatureReporting_ReportUsageToService
Key
ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type
refcount,address,calling
ratio
0.98
i_ratio
0.74
m_ratio
1.0
b_ratio
1.0
match_types
ExactInstructionsFunctionHasher
Key
ntoskrnl.exe.10.0.22621.2361
ntoskrnl.exe.10.0.22621.2428
name
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToService
fullname
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToService
refcount
79
80
length
867
867
called
CmFcManagerNotifyFeatureUsage __security_check_cookie _guard_dispatch_icall wil_details_FeatureReporting_IncrementOpportunityInCache wil_details_FeatureReporting_IncrementUsageInCache
CmFcManagerNotifyFeatureUsage __security_check_cookie _guard_dispatch_icall wil_details_FeatureReporting_IncrementOpportunityInCache wil_details_FeatureReporting_IncrementUsageInCache
calling
Expand for full list: CmpIsRegistryLockAcquired CmpRecordRegistryLockAcquire CmpRecordRegistryLockRelease Feature_1429194047__private_IsEnabled Feature_2485082431__private_IsEnabled Feature_3566457150__private_IsEnabled Feature_CcImprovementsForReFS__private_IsEnabled Feature_FastResource2__private_IsEnabled Feature_IMDSLicensingIntegration__private_IsEnabledPreCheck Feature_ImprovedCpuAttribution__private_IsEnabled Feature_ImprovedCpuAttribution__private_IsEnabledWithReporting Feature_LivedumpProcessFiltering__private_IsEnabled Feature_Mercury_App_Backup__private_IsEnabled Feature_Mercury_App_Restore__private_IsEnabled Feature_PerClassEnergyUnsupported__private_IsEnabled Feature_PerClassEnergyUnsupported__private_IsEnabledWithReporting Feature_SensorDimDisplayTimeouts__private_IsEnabled Feature_Servicing_CopyEABufferHandling__private_IsEnabled Feature_Servicing_DeadlineQosReschedule__private_IsEnabled Feature_Servicing_GuardDroppedCharges__private_IsEnabled Feature_Servicing_IommuApiPasid__private_IsEnabled Feature_Servicing_Kernel_DMA_Compliance__private_IsEnabled Feature_Servicing_MercuryNewSdbTagsForBackup__private_IsEnabled Feature_Servicing_NonPagedQueryLogicalProcessorRelationship__private_IsEnabled Feature_Servicing_OemToUnicodeFix__private_IsEnabled Feature_Servicing_OplockCancelTracing__private_IsEnabled Feature_Servicing_OplocksWritableMappedSectionsFix__private_IsEnabled Feature_Servicing_PPMFixUnparkingAllCores__private_IsEnabled Feature_Servicing_PageZeroingParkedCoresFix__private_IsEnabled Feature_Servicing_Ref_Count_Disacrded_Kcbs__private_IsEnabled Feature_Servicing_RevalidateNoUMCI_42288025__private_IsEnabled Feature_Servicing_SecImageNoExecuteIntegrityCheck__private_IsEnabled Feature_Servicing_SecureDevAts__private_IsEnabled Feature_Servicing_SetVadPageSize__private_IsEnabled Feature_Servicing_WriteProcessMemory_SGXDebug__private_IsEnabled Feature_TriageDumpDataExtension__private_IsEnabled Feature_VHDAutoAttachOnBoot__private_IsEnabled KeInitializeClock KeInitializeVelocity KeIsMultiCoreClassesEnabled KiAreSoftUnparkingElectionsEnabled KiInitializeVelocity KiSearchForNewThreadOnProcessor MiInitializeCfg MiProtectSharedUserPage PopCheckForIdleness PopHandleSystemIdleReset PopInitSIdle PopMonitorInvocation PopPolicySystemIdle PopPowerAggregatorForceSessionSwitch PopPowerAggregatorHandleSystemTransitionEndIntent PopProcessSessionDisplayStateChange PopQueryRemainingSystemIdleTime PopResetIdleTime PopSwitchUpdateUserShutdownScenarioState PopSystemIdleWorker PopUpdateSystemIdleContext PopUserShutdownScenarioInitialize PpmHeteroGetHgsPlusParkingEnablementStatus PpmHeteroInitializeHgsSupport PpmHeteroIsMultiClassParkingEnabled PpmPerfSnapUtility WheaResumedFromHibernate
Expand for full list: CmpIsRegistryLockAcquired CmpRecordRegistryLockAcquire CmpRecordRegistryLockRelease Feature_1429194047__private_IsEnabled Feature_2485082431__private_IsEnabled Feature_3566457150__private_IsEnabled Feature_4256151870__private_IsEnabled Feature_CcImprovementsForReFS__private_IsEnabled Feature_FastResource2__private_IsEnabled Feature_IMDSLicensingIntegration__private_IsEnabledPreCheck Feature_ImprovedCpuAttribution__private_IsEnabled Feature_ImprovedCpuAttribution__private_IsEnabledWithReporting Feature_LivedumpProcessFiltering__private_IsEnabled Feature_Mercury_App_Backup__private_IsEnabled Feature_Mercury_App_Restore__private_IsEnabled Feature_PerClassEnergyUnsupported__private_IsEnabled Feature_PerClassEnergyUnsupported__private_IsEnabledWithReporting Feature_SensorDimDisplayTimeouts__private_IsEnabled Feature_Servicing_CopyEABufferHandling__private_IsEnabled Feature_Servicing_DeadlineQosReschedule__private_IsEnabled Feature_Servicing_GuardDroppedCharges__private_IsEnabled Feature_Servicing_IommuApiPasid__private_IsEnabled Feature_Servicing_Kernel_DMA_Compliance__private_IsEnabled Feature_Servicing_MercuryNewSdbTagsForBackup__private_IsEnabled Feature_Servicing_NonPagedQueryLogicalProcessorRelationship__private_IsEnabled Feature_Servicing_OemToUnicodeFix__private_IsEnabled Feature_Servicing_OplockCancelTracing__private_IsEnabled Feature_Servicing_OplocksWritableMappedSectionsFix__private_IsEnabled Feature_Servicing_PPMFixUnparkingAllCores__private_IsEnabled Feature_Servicing_PageZeroingParkedCoresFix__private_IsEnabled Feature_Servicing_Ref_Count_Disacrded_Kcbs__private_IsEnabled Feature_Servicing_RevalidateNoUMCI_42288025__private_IsEnabled Feature_Servicing_SecImageNoExecuteIntegrityCheck__private_IsEnabled Feature_Servicing_SecureDevAts__private_IsEnabled Feature_Servicing_SetVadPageSize__private_IsEnabled Feature_Servicing_WriteProcessMemory_SGXDebug__private_IsEnabled Feature_TriageDumpDataExtension__private_IsEnabled Feature_VHDAutoAttachOnBoot__private_IsEnabled KeInitializeClock KeInitializeVelocity KeIsMultiCoreClassesEnabled KiAreSoftUnparkingElectionsEnabled KiInitializeVelocity KiSearchForNewThreadOnProcessor MiInitializeCfg MiProtectSharedUserPage PopCheckForIdleness PopHandleSystemIdleReset PopInitSIdle PopMonitorInvocation PopPolicySystemIdle PopPowerAggregatorForceSessionSwitch PopPowerAggregatorHandleSystemTransitionEndIntent PopProcessSessionDisplayStateChange PopQueryRemainingSystemIdleTime PopResetIdleTime PopSwitchUpdateUserShutdownScenarioState PopSystemIdleWorker PopUpdateSystemIdleContext PopUserShutdownScenarioInitialize PpmHeteroGetHgsPlusParkingEnablementStatus PpmHeteroInitializeHgsSupport PpmHeteroIsMultiClassParkingEnabled PpmPerfSnapUtility WheaResumedFromHibernate
paramcount
7
7
address
140328400
1403283f0
sig
undefined wil_details_FeatureReporting_ReportUsageToService(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5, undefined4 param_6, undefined4 param_7)
undefined wil_details_FeatureReporting_ReportUsageToService(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5, undefined4 param_6, undefined4 param_7)
sym_type
Function
Function
sym_source
IMPORTED
IMPORTED
external
False
False
wil_details_FeatureReporting_ReportUsageToService Calling Diff
--- wil_details_FeatureReporting_ReportUsageToService calling
+++ wil_details_FeatureReporting_ReportUsageToService calling
@@ -6,0 +7 @@
+ Feature_4256151870__private_IsEnabled
Generated with ghidriff
version: 0.5.0 on 2023-10-11T15:45:45