Skip to content

Instantly share code, notes, and snippets.

@clearbluejar

clearbluejar/ntoskrnl.exe.10.0.22621.2361-ntoskrnl.exe.10.0.22621.2428.ghidriff.md Secret

Created October 11, 2023 15:47
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save clearbluejar/58af23c6b17eefae87608ef2d67d22d7 to your computer and use it in GitHub Desktop.
Save clearbluejar/58af23c6b17eefae87608ef2d67d22d7 to your computer and use it in GitHub Desktop.
Download ZIP
KB5031354 - Windows 11 22H2
Raw
ntoskrnl.exe.10.0.22621.2361-ntoskrnl.exe.10.0.22621.2428.ghidriff.md

ntoskrnl.exe.10.0.22621.2361-ntoskrnl.exe.10.0.22621.2428 Diff

TOC

Visual Chart Diff

flowchart LR

VrpPostOpenOrCreate-0-old<--Match 78%-->VrpPostOpenOrCreate-0-new
VrpAddNamespaceNodeToList-0-old<--Match 94%-->VrpAddNamespaceNodeToList-0-new
VrpPreOpenOrCreate-0-old<--Match 40%-->VrpPreOpenOrCreate-0-new
VrpHandleIoctlInitializeJobForVreg-6-old<--Match 66%-->VrpHandleIoctlInitializeJobForVreg-6-new
KiIpiProcessRequests-0-old<--Match 96%-->KiIpiProcessRequests-0-new
NtSetInformationWorkerFactory-0-old<--Match 98%-->NtSetInformationWorkerFactory-0-new
VrpBuildKeyPath-0-old<--Match 87%-->VrpBuildKeyPath-0-new
WbCreateHeapExecutedBlockfilt0-0-old<--Match 93%-->WbCreateHeapExecutedBlockfilt0-0-new
CmSetValueKey-7-old<--Match 37%-->CmSetValueKey-7-new
WbCreateHeapExecutedBlock-0-old<--Match 60%-->FUN_14070897c-0-new

subgraph ntoskrnl.exe.10.0.22621.2428
    VrpPostOpenOrCreate-0-new
VrpAddNamespaceNodeToList-0-new
VrpPreOpenOrCreate-0-new
VrpHandleIoctlInitializeJobForVreg-6-new
KiIpiProcessRequests-0-new
NtSetInformationWorkerFactory-0-new
VrpBuildKeyPath-0-new
WbCreateHeapExecutedBlockfilt0-0-new
CmSetValueKey-7-new
FUN_14070897c-0-new
    subgraph Added
direction LR
Feature_4256151870__private_IsEnabled
    Feature_1171241279__private_IsEnabled
    wil_details_FeatureReporting_IncrementOpportunityInCache
    wil_details_FeatureReporting_IncrementUsageInCache
    wil_details_FeatureReporting_RecordUsageInCache
    wil_details_FeatureReporting_ReportUsageToService
    wil_details_FeatureReporting_ReportUsageToServiceDirect
    wil_details_FeatureStateCache_GetCachedFeatureEnabledState
    wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
    wil_details_GetCurrentFeatureEnabledState
    wil_details_MapReportingKind
    wil_RtlStagingConfig_QueryFeatureState
end
end

subgraph ntoskrnl.exe.10.0.22621.2361
    VrpPostOpenOrCreate-0-old
VrpAddNamespaceNodeToList-0-old
VrpPreOpenOrCreate-0-old
VrpHandleIoctlInitializeJobForVreg-6-old
KiIpiProcessRequests-0-old
NtSetInformationWorkerFactory-0-old
VrpBuildKeyPath-0-old
WbCreateHeapExecutedBlockfilt0-0-old
CmSetValueKey-7-old
WbCreateHeapExecutedBlock-0-old
    
end


pie showData
    title Function Matches - 99.9803%
"unmatched_funcs_len" : 12
"matched_funcs_len" : 61040

pie showData
    title Matched Function Similarity - 99.9214%
"matched_funcs_with_code_changes_len" : 10
"matched_funcs_with_non_code_changes_len" : 38
"matched_funcs_no_changes_len" : 60992

Metadata

Ghidra Diff Engine

Command Line

Captured Command Line

ghidriff --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --threaded --log-level INFO --file-log-level INFO --log-path ghidriff.log --max-ram-percent 60.0 --max-section-funcs 200 ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428

Verbose Args

--old ['bins/ntoskrnl.exe.10.0.22621.2361'] --new [['bins/ntoskrnl.exe.10.0.22621.2428']] --engine VersionTrackingDiff --output-path ghidriffs --summary False --project-location ghidra_projects --project-name ghidriff --symbols-path symbols --threaded True --force-analysis False --force-diff False --no-symbols False --log-level INFO --file-log-level INFO --log-path ghidriff.log --va False --max-ram-percent 60.0 --print-flags False --jvm-args None --side-by-side False --max-section-funcs 200 --md-title None

Download Original PEs

wget https://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/AACD0D1D1047000/ntkrnlmp.exe -O ntkrnlmp.exe.x64.10.0.22621.2361
wget https://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/7D02613E1047000/ntkrnlmp.exe -O ntkrnlmp.exe.x64.10.0.22621.2428

Binary Metadata Diff

--- ntoskrnl.exe.10.0.22621.2361 Meta
+++ ntoskrnl.exe.10.0.22621.2428 Meta
@@ -1,44 +1,44 @@
-Program Name: ntoskrnl.exe.10.0.22621.2361
+Program Name: ntoskrnl.exe.10.0.22621.2428
 Language ID: x86:LE:64:default (2.14)
 Compiler ID: windows
 Processor: x86
 Endian: Little
 Address Size: 64
 Minimum Address: 140000000
 Maximum Address: ff0000184f
-# of Bytes: 17066100
+# of Bytes: 17062268
 # of Memory Blocks: 42
-# of Instructions: 2426511
-# of Defined Data: 76235
-# of Functions: 30520
-# of Symbols: 246381
-# of Data Types: 6143
+# of Instructions: 2427380
+# of Defined Data: 76258
+# of Functions: 30532
+# of Symbols: 246511
+# of Data Types: 6145
 # of Data Type Categories: 581
 Analyzed: true
 Compiler: visualstudio:unknown
 Created With Ghidra Version: 10.4
-Date Created: Wed Oct 11 15:20:22 UTC 2023
+Date Created: Wed Oct 11 15:20:35 UTC 2023
 Executable Format: Portable Executable (PE)
-Executable Location: /workspaces/ghidriff/bins/ntoskrnl.exe.10.0.22621.2361
-Executable MD5: d4c09c7f5cfd0974439f84f693dcaa8c
-Executable SHA256: ae09a8d4fcfdc9fdafbdb834e671fef5e037aac5b99799037c0d546985873453
-FSRL: file:///workspaces/ghidriff/bins/ntoskrnl.exe.10.0.22621.2361?MD5=d4c09c7f5cfd0974439f84f693dcaa8c
+Executable Location: /workspaces/ghidriff/bins/ntoskrnl.exe.10.0.22621.2428
+Executable MD5: 4deb2ade24b8ebb2088bd76283b48be9
+Executable SHA256: bf8489d981ea5d73dfb29b883405d68590f2b0b74dc2e9796e35cc1849c56826
+FSRL: file:///workspaces/ghidriff/bins/ntoskrnl.exe.10.0.22621.2428?MD5=4deb2ade24b8ebb2088bd76283b48be9
 PDB Age: 1
 PDB File: ntkrnlmp.pdb
-PDB GUID: 70335560-1a9d-b486-aa51-33ed68f97076
+PDB GUID: cf32de2e-4a33-4c7c-06fb-63fcb6fafb5c
 PDB Loaded: true
 PDB Version: RSDS
 PE Property[CompanyName]: Microsoft Corporation
 PE Property[FileDescription]: NT Kernel & System
-PE Property[FileVersion]: 10.0.22621.2361 (WinBuild.160101.0800)
+PE Property[FileVersion]: 10.0.22621.2428 (WinBuild.160101.0800)
 PE Property[InternalName]: ntkrnlmp.exe
 PE Property[LegalCopyright]: © Microsoft Corporation. All rights reserved.
 PE Property[OriginalFilename]: ntkrnlmp.exe
 PE Property[ProductName]: Microsoft® Windows® Operating System
-PE Property[ProductVersion]: 10.0.22621.2361
+PE Property[ProductVersion]: 10.0.22621.2428
 PE Property[Translation]: 4b00409
 Preferred Root Namespace Category: 
 RTTI Found: false
 Relocatable: true
 SectionAlignment: 4096
 Should Ask To Analyze: false

Program Options

Ghidra ntoskrnl.exe.10.0.22621.2361 Decompiler Options
Decompiler Option Value
Prototype Evaluation __fastcall
Ghidra ntoskrnl.exe.10.0.22621.2361 Specification extensions Options
Specification extensions Option Value
FormatVersion 0
VersionCounter 0
Ghidra ntoskrnl.exe.10.0.22621.2361 Analyzers Options
Analyzers Option Value
ASCII Strings true
ASCII Strings.Create Strings Containing Existing Strings true
ASCII Strings.Create Strings Containing References true
ASCII Strings.Force Model Reload false
ASCII Strings.Minimum String Length LEN_5
ASCII Strings.Model File StringModel.sng
ASCII Strings.Require Null Termination for String true
ASCII Strings.Search Only in Accessible Memory Blocks true
ASCII Strings.String Start Alignment ALIGN_1
ASCII Strings.String end alignment 4
Aggressive Instruction Finder false
Aggressive Instruction Finder.Create Analysis Bookmarks true
Apply Data Archives true
Apply Data Archives.Archive Chooser [Auto-Detect]
Apply Data Archives.Create Analysis Bookmarks true
Apply Data Archives.GDT User File Archive Path None
Apply Data Archives.User Project Archive Path None
Call Convention ID true
Call Convention ID.Analysis Decompiler Timeout (sec) 60
Call-Fixup Installer true
Condense Filler Bytes false
Condense Filler Bytes.Filler Value Auto
Condense Filler Bytes.Minimum number of sequential bytes 1
Create Address Tables true
Create Address Tables.Allow Offcut References false
Create Address Tables.Auto Label Table false
Create Address Tables.Create Analysis Bookmarks true
Create Address Tables.Maxmimum Pointer Distance 16777215
Create Address Tables.Minimum Pointer Address 4132
Create Address Tables.Minimum Table Size 2
Create Address Tables.Pointer Alignment 1
Create Address Tables.Relocation Table Guide true
Create Address Tables.Table Alignment 4
Data Reference true
Data Reference.Address Table Alignment 1
Data Reference.Address Table Minimum Size 2
Data Reference.Align End of Strings false
Data Reference.Ascii String References true
Data Reference.Create Address Tables true
Data Reference.Minimum String Length 5
Data Reference.References to Pointers true
Data Reference.Relocation Table Guide true
Data Reference.Respect Execute Flag true
Data Reference.Subroutine References true
Data Reference.Switch Table References false
Data Reference.Unicode String References true
Decompiler Parameter ID false
Decompiler Parameter ID.Analysis Clear Level ANALYSIS
Decompiler Parameter ID.Analysis Decompiler Timeout (sec) 60
Decompiler Parameter ID.Commit Data Types true
Decompiler Parameter ID.Commit Void Return Values false
Decompiler Parameter ID.Prototype Evaluation __fastcall
Decompiler Switch Analysis true
Decompiler Switch Analysis.Analysis Decompiler Timeout (sec) 60
Demangler Microsoft true
Demangler Microsoft.Apply Function Calling Conventions true
Demangler Microsoft.Apply Function Signatures true
Disassemble Entry Points true
Disassemble Entry Points.Respect Execute Flag true
Embedded Media true
Embedded Media.Create Analysis Bookmarks true
External Entry References true
Function ID true
Function ID.Always Apply FID Labels false
Function ID.Create Analysis Bookmarks true
Function ID.Instruction Count Threshold 14.6
Function ID.Multiple Match Threshold 30.0
Function Start Search true
Function Start Search.Bookmark Functions false
Function Start Search.Search Data Blocks false
Non-Returning Functions - Discovered true
Non-Returning Functions - Discovered.Create Analysis Bookmarks true
Non-Returning Functions - Discovered.Function Non-return Threshold 3
Non-Returning Functions - Discovered.Repair Flow Damage true
Non-Returning Functions - Known true
Non-Returning Functions - Known.Create Analysis Bookmarks true
PDB MSDIA false
PDB MSDIA.Search remote symbol servers false
PDB Universal true
PDB Universal.Search remote symbol servers false
Reference true
Reference.Address Table Alignment 1
Reference.Address Table Minimum Size 2
Reference.Align End of Strings false
Reference.Ascii String References true
Reference.Create Address Tables true
Reference.Minimum String Length 5
Reference.References to Pointers true
Reference.Relocation Table Guide true
Reference.Respect Execute Flag true
Reference.Subroutine References true
Reference.Switch Table References false
Reference.Unicode String References true
Scalar Operand References true
Scalar Operand References.Relocation Table Guide true
Shared Return Calls true
Shared Return Calls.Allow Conditional Jumps false
Shared Return Calls.Assume Contiguous Functions Only false
Stack true
Stack.Create Local Variables true
Stack.Create Param Variables true
Stack.useNewFunctionStackAnalysis true
Subroutine References true
Subroutine References.Create Thunks Early true
Variadic Function Signature Override false
Variadic Function Signature Override.Create Analysis Bookmarks false
Windows x86 PE Exception Handling true
Windows x86 PE RTTI Analyzer true
Windows x86 Thread Environment Block (TEB) Analyzer true
Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB
Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version Windows 7
WindowsPE x86 Propagate External Parameters false
WindowsResourceReference true
WindowsResourceReference.Create Analysis Bookmarks true
x86 Constant Reference Analyzer true
x86 Constant Reference Analyzer.Create Data from pointer false
x86 Constant Reference Analyzer.Function parameter/return Pointer analysis true
x86 Constant Reference Analyzer.Max Threads 2
x86 Constant Reference Analyzer.Min absolute reference 4
x86 Constant Reference Analyzer.Require pointer param data type false
x86 Constant Reference Analyzer.Speculative reference max 512
x86 Constant Reference Analyzer.Speculative reference min 1024
x86 Constant Reference Analyzer.Stored Value Pointer analysis true
x86 Constant Reference Analyzer.Trust values read from writable memory true
Ghidra ntoskrnl.exe.10.0.22621.2428 Decompiler Options
Decompiler Option Value
Prototype Evaluation __fastcall
Ghidra ntoskrnl.exe.10.0.22621.2428 Specification extensions Options
Specification extensions Option Value
FormatVersion 0
VersionCounter 0
Ghidra ntoskrnl.exe.10.0.22621.2428 Analyzers Options
Analyzers Option Value
ASCII Strings true
ASCII Strings.Create Strings Containing Existing Strings true
ASCII Strings.Create Strings Containing References true
ASCII Strings.Force Model Reload false
ASCII Strings.Minimum String Length LEN_5
ASCII Strings.Model File StringModel.sng
ASCII Strings.Require Null Termination for String true
ASCII Strings.Search Only in Accessible Memory Blocks true
ASCII Strings.String Start Alignment ALIGN_1
ASCII Strings.String end alignment 4
Aggressive Instruction Finder false
Aggressive Instruction Finder.Create Analysis Bookmarks true
Apply Data Archives true
Apply Data Archives.Archive Chooser [Auto-Detect]
Apply Data Archives.Create Analysis Bookmarks true
Apply Data Archives.GDT User File Archive Path None
Apply Data Archives.User Project Archive Path None
Call Convention ID true
Call Convention ID.Analysis Decompiler Timeout (sec) 60
Call-Fixup Installer true
Condense Filler Bytes false
Condense Filler Bytes.Filler Value Auto
Condense Filler Bytes.Minimum number of sequential bytes 1
Create Address Tables true
Create Address Tables.Allow Offcut References false
Create Address Tables.Auto Label Table false
Create Address Tables.Create Analysis Bookmarks true
Create Address Tables.Maxmimum Pointer Distance 16777215
Create Address Tables.Minimum Pointer Address 4132
Create Address Tables.Minimum Table Size 2
Create Address Tables.Pointer Alignment 1
Create Address Tables.Relocation Table Guide true
Create Address Tables.Table Alignment 4
Data Reference true
Data Reference.Address Table Alignment 1
Data Reference.Address Table Minimum Size 2
Data Reference.Align End of Strings false
Data Reference.Ascii String References true
Data Reference.Create Address Tables true
Data Reference.Minimum String Length 5
Data Reference.References to Pointers true
Data Reference.Relocation Table Guide true
Data Reference.Respect Execute Flag true
Data Reference.Subroutine References true
Data Reference.Switch Table References false
Data Reference.Unicode String References true
Decompiler Parameter ID false
Decompiler Parameter ID.Analysis Clear Level ANALYSIS
Decompiler Parameter ID.Analysis Decompiler Timeout (sec) 60
Decompiler Parameter ID.Commit Data Types true
Decompiler Parameter ID.Commit Void Return Values false
Decompiler Parameter ID.Prototype Evaluation __fastcall
Decompiler Switch Analysis true
Decompiler Switch Analysis.Analysis Decompiler Timeout (sec) 60
Demangler Microsoft true
Demangler Microsoft.Apply Function Calling Conventions true
Demangler Microsoft.Apply Function Signatures true
Disassemble Entry Points true
Disassemble Entry Points.Respect Execute Flag true
Embedded Media true
Embedded Media.Create Analysis Bookmarks true
External Entry References true
Function ID true
Function ID.Always Apply FID Labels false
Function ID.Create Analysis Bookmarks true
Function ID.Instruction Count Threshold 14.6
Function ID.Multiple Match Threshold 30.0
Function Start Search true
Function Start Search.Bookmark Functions false
Function Start Search.Search Data Blocks false
Non-Returning Functions - Discovered true
Non-Returning Functions - Discovered.Create Analysis Bookmarks true
Non-Returning Functions - Discovered.Function Non-return Threshold 3
Non-Returning Functions - Discovered.Repair Flow Damage true
Non-Returning Functions - Known true
Non-Returning Functions - Known.Create Analysis Bookmarks true
PDB MSDIA false
PDB MSDIA.Search remote symbol servers false
PDB Universal true
PDB Universal.Search remote symbol servers false
Reference true
Reference.Address Table Alignment 1
Reference.Address Table Minimum Size 2
Reference.Align End of Strings false
Reference.Ascii String References true
Reference.Create Address Tables true
Reference.Minimum String Length 5
Reference.References to Pointers true
Reference.Relocation Table Guide true
Reference.Respect Execute Flag true
Reference.Subroutine References true
Reference.Switch Table References false
Reference.Unicode String References true
Scalar Operand References true
Scalar Operand References.Relocation Table Guide true
Shared Return Calls true
Shared Return Calls.Allow Conditional Jumps false
Shared Return Calls.Assume Contiguous Functions Only false
Stack true
Stack.Create Local Variables true
Stack.Create Param Variables true
Stack.useNewFunctionStackAnalysis true
Subroutine References true
Subroutine References.Create Thunks Early true
Variadic Function Signature Override false
Variadic Function Signature Override.Create Analysis Bookmarks false
Windows x86 PE Exception Handling true
Windows x86 PE RTTI Analyzer true
Windows x86 Thread Environment Block (TEB) Analyzer true
Windows x86 Thread Environment Block (TEB) Analyzer.Starting Address of the TEB
Windows x86 Thread Environment Block (TEB) Analyzer.Windows OS Version Windows 7
WindowsPE x86 Propagate External Parameters false
WindowsResourceReference true
WindowsResourceReference.Create Analysis Bookmarks true
x86 Constant Reference Analyzer true
x86 Constant Reference Analyzer.Create Data from pointer false
x86 Constant Reference Analyzer.Function parameter/return Pointer analysis true
x86 Constant Reference Analyzer.Max Threads 2
x86 Constant Reference Analyzer.Min absolute reference 4
x86 Constant Reference Analyzer.Require pointer param data type false
x86 Constant Reference Analyzer.Speculative reference max 512
x86 Constant Reference Analyzer.Speculative reference min 1024
x86 Constant Reference Analyzer.Stored Value Pointer analysis true
x86 Constant Reference Analyzer.Trust values read from writable memory true

Diff Stats

Stat Value
added_funcs_len 12
deleted_funcs_len 0
modified_funcs_len 48
added_symbols_len 17
deleted_symbols_len 12
diff_time 183.8970673084259
deleted_strings_len 1
added_strings_len 0
match_types Counter({'SymbolsHash': 28075, 'StructuralGraphHash': 696, 'ExactInstructionsFunctionHasher': 146, 'ExactBytesFunctionHasher': 81, 'BulkInstructionHash': 1, 'SigCallingCalledHasher': 1, 'Implied Match': 1})
items_to_process 89
diff_types Counter({'refcount': 43, 'address': 42, 'calling': 26, 'length': 12, 'code': 10, 'called': 6, 'sig': 4, 'name': 2, 'fullname': 2})
unmatched_funcs_len 12
total_funcs_len 61052
matched_funcs_len 61040
matched_funcs_with_code_changes_len 10
matched_funcs_with_non_code_changes_len 38
matched_funcs_no_changes_len 60992
match_func_similarity_percent 99.9214%
func_match_overall_percent 99.9803% 
pie showData
    title Match Types
"SymbolsHash" : 28075
"ExactBytesFunctionHasher" : 81
"ExactInstructionsFunctionHasher" : 146
"BulkInstructionHash" : 1
"SigCallingCalledHasher" : 1
"StructuralGraphHash" : 696
"Implied-Match" : 1

pie showData
    title Diff Stats
"added_funcs_len" : 12
"deleted_funcs_len" : 0
"modified_funcs_len" : 48

pie showData
    title Symbols
"added_symbols_len" : 17
"deleted_symbols_len" : 12

Strings

pie showData
    title Strings
"deleted_strings_len" : 1
"added_strings_len" : 0

Strings Diff

--- deleted strings
+++ added strings
@@ -1 +0,0 @@
-s_Parameters_%Ix_%Ix_%Ix_%Ix_140a93201

Deleted

Added

Feature_4256151870__private_IsEnabled

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name Feature_4256151870__private_IsEnabled
fullname Feature_4256151870__private_IsEnabled
refcount 4
length 102
called wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
calling CmSetValueKey
paramcount 0
address 14040dce0
sig undefined Feature_4256151870__private_IsEnabled(void)
sym_type Function
sym_source IMPORTED
external False 
--- Feature_4256151870__private_IsEnabled
+++ Feature_4256151870__private_IsEnabled
@@ -0,0 +1,17 @@
+
+uint Feature_4256151870__private_IsEnabled(void)
+
+{
+  uint uVar1;
+  uint uVar2;
+  
+  uVar1 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+                    (&Feature_4256151870__private_featureState,
+                     &Feature_4256151870__private_descriptor);
+  uVar2 = uVar1 >> 3 & 1;
+  wil_details_FeatureReporting_ReportUsageToService
+            (&Feature_4256151870__private_reporting,0x2b235e1,uVar1 >> 8 & 1,uVar1 >> 9 & 1,
+             &Feature_Servicing_RevalidateNoUMCI_42288025_logged_traits,uVar2,3);
+  return uVar2;
+}
+

Feature_1171241279__private_IsEnabled

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name Feature_1171241279__private_IsEnabled
fullname Feature_1171241279__private_IsEnabled
refcount 6
length 94
called wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
calling FUN_14070897c
paramcount 0
address 14040dfe8
sig int __cdecl Feature_1171241279__private_IsEnabled(void)
sym_type Function
sym_source ANALYSIS
external False 
--- Feature_1171241279__private_IsEnabled
+++ Feature_1171241279__private_IsEnabled
@@ -0,0 +1,23 @@
+
+/* int __cdecl Feature_1171241279__private_IsEnabled(void) */
+
+int __cdecl Feature_1171241279__private_IsEnabled(void)
+
+{
+  wil_details_FeatureStateCache wVar1;
+  uint uVar2;
+  wil_ReportingKind in_stack_ffffffffffffffe8;
+  __uint64 in_stack_fffffffffffffff0;
+  
+  wVar1 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+                    ((wil_details_FeatureStateCache *)&Feature_1171241279__private_featureState,
+                     (wil_details_FeatureDescriptor *)&Feature_1171241279__private_descriptor);
+  uVar2 = (uint)(wVar1.exchange64 >> 3) & 1;
+  wil_details_FeatureReporting_ReportUsageToService
+            ((wil_details_FeatureReportingCache *)&Feature_1171241279__private_reporting,0x2b22d8f,
+             wVar1.exchange >> 8 & 1,(uint)(wVar1.exchange64 >> 9) & 1,
+             (FEATURE_LOGGED_TRAITS *)&Feature_Servicing_RevalidateNoUMCI_42288025_logged_traits,
+             uVar2,in_stack_ffffffffffffffe8,in_stack_fffffffffffffff0);
+  return uVar2;
+}
+

wil_details_FeatureReporting_IncrementOpportunityInCache

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name wil_details_FeatureReporting_IncrementOpportunityInCache
fullname wil_details_FeatureReporting_IncrementOpportunityInCache
refcount 2
length 231
called
calling wil_details_FeatureReporting_RecordUsageInCache
paramcount 4
address 14066c95c
sig void __cdecl wil_details_FeatureReporting_IncrementOpportunityInCache(wil_details_FeatureReportingCache * param_1, wil_details_ServiceReportingKind param_2, uint param_3, wil_details_RecordUsageResult * param_4)
sym_type Function
sym_source ANALYSIS
external False 
--- wil_details_FeatureReporting_IncrementOpportunityInCache
+++ wil_details_FeatureReporting_IncrementOpportunityInCache
@@ -0,0 +1,62 @@
+
+/* void __cdecl wil_details_FeatureReporting_IncrementOpportunityInCache(struct
+   wil_details_FeatureReportingCache * __ptr64,enum wil_details_ServiceReportingKind,unsigned
+   int,struct wil_details_RecordUsageResult * __ptr64) */
+
+void __cdecl
+wil_details_FeatureReporting_IncrementOpportunityInCache
+          (wil_details_FeatureReportingCache *param_1,wil_details_ServiceReportingKind param_2,
+          uint param_3,wil_details_RecordUsageResult *param_4)
+
+{
+  uint uVar1;
+  wil_details_ServiceReportingKind wVar2;
+  uint uVar3;
+  uint uVar4;
+  uint uVar5;
+  bool bVar6;
+  
+  uVar3 = (param_1->reported).exchange;
+  do {
+    uVar5 = uVar3;
+    param_4->countImmediate = 0;
+    uVar1 = uVar5 | 1;
+    if ((uVar5 & 0x400000) >> 0x16 !=
+        (uint)(param_2 == wil_details_ServiceReportingKind_PotentialUniqueOpportunity)) {
+      uVar3 = (uVar5 & 0x3f8000) >> 0xf;
+      if (uVar3 != 0) {
+        param_4->countImmediate = uVar3;
+        wVar2 = wil_details_ServiceReportingKind_PotentialUniqueOpportunity;
+        if (param_2 != wil_details_ServiceReportingKind_UniqueOpportunity) {
+          wVar2 = wil_details_ServiceReportingKind_UniqueOpportunity;
+        }
+        uVar1 = uVar5 & 0xffc07fff | 1;
+        param_4->kindImmediate = wVar2;
+      }
+      uVar3 = 0;
+      if (param_2 == wil_details_ServiceReportingKind_PotentialUniqueOpportunity) {
+        uVar3 = 0x400000;
+      }
+      uVar1 = uVar3 | uVar1 & 0xffbfffff;
+    }
+    uVar3 = uVar1 >> 0xf & 0x7f;
+    uVar4 = uVar3 + 1;
+    if ((0x7f < uVar4) || (uVar4 < (uVar1 >> 0xf & 0x7f))) {
+      uVar4 = 1;
+      param_4->kindImmediate = param_2;
+      param_4->countImmediate = uVar3;
+    }
+    LOCK();
+    uVar3 = (param_1->reported).exchange;
+    bVar6 = uVar5 == uVar3;
+    if (bVar6) {
+      (param_1->reported).exchange = (uVar4 << 0xf ^ uVar1) & 0x3f8000 ^ uVar1;
+      uVar3 = uVar5;
+    }
+    UNLOCK();
+  } while (!bVar6);
+  param_4->ignoredUse = 0;
+  param_4->queueBackground = ~uVar5 & 1;
+  return;
+}
+

wil_details_FeatureReporting_IncrementUsageInCache

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name wil_details_FeatureReporting_IncrementUsageInCache
fullname wil_details_FeatureReporting_IncrementUsageInCache
refcount 2
length 238
called
calling wil_details_FeatureReporting_RecordUsageInCache
paramcount 4
address 14066ca4c
sig void __cdecl wil_details_FeatureReporting_IncrementUsageInCache(wil_details_FeatureReportingCache * param_1, wil_details_ServiceReportingKind param_2, uint param_3, wil_details_RecordUsageResult * param_4)
sym_type Function
sym_source ANALYSIS
external False 
--- wil_details_FeatureReporting_IncrementUsageInCache
+++ wil_details_FeatureReporting_IncrementUsageInCache
@@ -0,0 +1,58 @@
+
+/* void __cdecl wil_details_FeatureReporting_IncrementUsageInCache(struct
+   wil_details_FeatureReportingCache * __ptr64,enum wil_details_ServiceReportingKind,unsigned
+   int,struct wil_details_RecordUsageResult * __ptr64) */
+
+void __cdecl
+wil_details_FeatureReporting_IncrementUsageInCache
+          (wil_details_FeatureReportingCache *param_1,wil_details_ServiceReportingKind param_2,
+          uint param_3,wil_details_RecordUsageResult *param_4)
+
+{
+  uint uVar1;
+  uint uVar2;
+  uint uVar3;
+  uint uVar4;
+  bool bVar5;
+  
+  uVar4 = (param_1->reported).exchange;
+  do {
+    uVar3 = uVar4;
+    param_4->countImmediate = 0;
+    uVar1 = uVar3 | 1;
+    if ((uVar3 & 0x4000) >> 0xe !=
+        (uint)(param_2 == wil_details_ServiceReportingKind_PotentialUniqueUsage)) {
+      uVar4 = (uVar3 & 0x3fe0) >> 5;
+      if (uVar4 != 0) {
+        param_4->countImmediate = uVar4;
+        param_4->kindImmediate =
+             ~-(uint)(param_2 != wil_details_ServiceReportingKind_UniqueUsage) & 4;
+        uVar1 = uVar3 & 0xffffc01f | 1;
+      }
+      uVar4 = 0;
+      if (param_2 == wil_details_ServiceReportingKind_PotentialUniqueUsage) {
+        uVar4 = 0x4000;
+      }
+      uVar1 = uVar4 | uVar1 & 0xffffbfff;
+    }
+    uVar4 = uVar1 >> 5 & 0x1ff;
+    uVar2 = uVar4 + 1;
+    if ((0x1ff < uVar2) || (uVar2 < (uVar1 >> 5 & 0x1ff))) {
+      uVar2 = 1;
+      param_4->kindImmediate = param_2;
+      param_4->countImmediate = uVar4;
+    }
+    LOCK();
+    uVar4 = (param_1->reported).exchange;
+    bVar5 = uVar3 == uVar4;
+    if (bVar5) {
+      (param_1->reported).exchange = (uVar2 << 5 ^ uVar1) & 0x3fe0 ^ uVar1;
+      uVar4 = uVar3;
+    }
+    UNLOCK();
+  } while (!bVar5);
+  param_4->ignoredUse = 0;
+  param_4->queueBackground = ~uVar3 & 1;
+  return;
+}
+

wil_details_FeatureReporting_RecordUsageInCache

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name wil_details_FeatureReporting_RecordUsageInCache
fullname wil_details_FeatureReporting_RecordUsageInCache
refcount 2
length 345
called wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache
calling wil_details_FeatureReporting_ReportUsageToServiceDirect
paramcount 5
address 14066cb44
sig wil_details_RecordUsageResult __cdecl wil_details_FeatureReporting_RecordUsageInCache(wil_details_RecordUsageResult * return_storage_ptr, wil_details_FeatureReportingCache * param_1, wil_details_ServiceReportingKind param_2, uint param_3, uint param_4)
sym_type Function
sym_source ANALYSIS
external False 
--- wil_details_FeatureReporting_RecordUsageInCache
+++ wil_details_FeatureReporting_RecordUsageInCache
@@ -0,0 +1,99 @@
+
+/* struct wil_details_RecordUsageResult __cdecl
+   wil_details_FeatureReporting_RecordUsageInCache(struct wil_details_FeatureReportingCache *
+   __ptr64,enum wil_details_ServiceReportingKind,unsigned int,unsigned int) */
+
+wil_details_RecordUsageResult * __cdecl
+wil_details_FeatureReporting_RecordUsageInCache
+          (wil_details_RecordUsageResult *__return_storage_ptr__,
+          wil_details_FeatureReportingCache *param_1,wil_details_ServiceReportingKind param_2,
+          uint param_3,uint param_4)
+
+{
+  uint uVar1;
+  uint uVar2;
+  uint uVar3;
+  uint uVar4;
+  bool bVar5;
+  
+  __return_storage_ptr__->queueBackground = 0;
+  __return_storage_ptr__->countImmediate = 0;
+  __return_storage_ptr__->kindImmediate = 0;
+  __return_storage_ptr__->payloadId = 0;
+  __return_storage_ptr__->ignoredUse = 0;
+  __return_storage_ptr__->isWexpConfiguration = 0;
+  if (param_2 == wil_details_ServiceReportingKind_UniqueUsage) {
+LAB_14066cc81:
+    wil_details_FeatureReporting_IncrementUsageInCache
+              (param_1,param_2,param_2,__return_storage_ptr__);
+  }
+  else {
+    if (param_2 == wil_details_ServiceReportingKind_UniqueOpportunity) {
+LAB_14066cc71:
+      wil_details_FeatureReporting_IncrementOpportunityInCache
+                (param_1,param_2,param_2,__return_storage_ptr__);
+      return __return_storage_ptr__;
+    }
+    uVar4 = 0;
+    if ((param_2 != wil_details_ServiceReportingKind_DeviceUsage) &&
+       (param_2 != wil_details_ServiceReportingKind_DeviceOpportunity)) {
+      if (param_2 == wil_details_ServiceReportingKind_PotentialUniqueUsage) goto LAB_14066cc81;
+      if (param_2 == wil_details_ServiceReportingKind_PotentialUniqueOpportunity)
+      goto LAB_14066cc71;
+      if ((param_2 != wil_details_ServiceReportingKind_PotentialDeviceUsage) &&
+         (param_2 != wil_details_ServiceReportingKind_PotentialDeviceOpportunity)) {
+        uVar3 = param_2 + 0xfffffec0;
+        if (uVar3 < 0x40) {
+          uVar1 = (param_1->recorded).exchange;
+          do {
+            if (((uVar1 & 0x10) == 0) || (uVar2 = 1, (uVar1 >> 5 & 0x3f) != uVar3)) {
+              uVar2 = uVar4;
+            }
+            __return_storage_ptr__->ignoredUse = uVar2;
+            LOCK();
+            uVar2 = (param_1->recorded).exchange;
+            bVar5 = uVar1 == uVar2;
+            if (bVar5) {
+              (param_1->recorded).exchange = uVar1 & 0xfffff81f | (uVar3 & 0x3f) << 5 | 0x10;
+              uVar2 = uVar1;
+            }
+            uVar1 = uVar2;
+            UNLOCK();
+          } while (!bVar5);
+        }
+        __return_storage_ptr__->kindImmediate = param_2;
+        __return_storage_ptr__->countImmediate = 1;
+        __return_storage_ptr__->payloadId = 0;
+        return __return_storage_ptr__;
+      }
+    }
+    if (param_2 == wil_details_ServiceReportingKind_DeviceUsage) {
+      uVar4 = 2;
+    }
+    else if (param_2 == wil_details_ServiceReportingKind_DeviceOpportunity) {
+      uVar4 = 8;
+    }
+    else if (param_2 == wil_details_ServiceReportingKind_PotentialDeviceUsage) {
+      uVar4 = 4;
+    }
+    else if (param_2 == wil_details_ServiceReportingKind_PotentialDeviceOpportunity) {
+      uVar4 = 0x10;
+    }
+    uVar3 = (param_1->reported).exchange;
+    do {
+      LOCK();
+      uVar1 = (param_1->reported).exchange;
+      bVar5 = uVar3 == uVar1;
+      if (bVar5) {
+        (param_1->reported).exchange = uVar3 | uVar4 | 1;
+        uVar1 = uVar3;
+      }
+      uVar3 = uVar1;
+      UNLOCK();
+    } while (!bVar5);
+    __return_storage_ptr__->queueBackground = ~uVar3 & 1;
+    __return_storage_ptr__->ignoredUse = (uint)((uVar4 & uVar3) == uVar4);
+  }
+  return __return_storage_ptr__;
+}
+

wil_details_FeatureReporting_ReportUsageToService

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name wil_details_FeatureReporting_ReportUsageToService
fullname wil_details_FeatureReporting_ReportUsageToService
refcount 2
length 134
called _guard_dispatch_icall
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_MapReportingKind
calling Feature_1171241279__private_IsEnabled
paramcount 8
address 14066cca4
sig void __cdecl wil_details_FeatureReporting_ReportUsageToService(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, FEATURE_LOGGED_TRAITS * param_5, int param_6, wil_ReportingKind param_7, __uint64 param_8)
sym_type Function
sym_source ANALYSIS
external False 
--- wil_details_FeatureReporting_ReportUsageToService
+++ wil_details_FeatureReporting_ReportUsageToService
@@ -0,0 +1,34 @@
+
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+/* void __cdecl wil_details_FeatureReporting_ReportUsageToService(struct
+   wil_details_FeatureReportingCache * __ptr64,unsigned int,int,int,struct FEATURE_LOGGED_TRAITS
+   const * __ptr64,int,enum wil_ReportingKind,unsigned __int64) */
+
+void __cdecl
+wil_details_FeatureReporting_ReportUsageToService
+          (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4,
+          FEATURE_LOGGED_TRAITS *param_5,int param_6,wil_ReportingKind param_7,__uint64 param_8)
+
+{
+  wil_details_ServiceReportingKind wVar1;
+  int iVar2;
+  uint in_stack_ffffffffffffffd0;
+  undefined in_stack_ffffffffffffffd8;
+  undefined7 in_stack_ffffffffffffffd9;
+  
+  param_7 = wil_ReportingKind_DeviceUsage;
+  wVar1 = wil_details_MapReportingKind(wil_ReportingKind_DeviceUsage,param_6);
+  iVar2 = wil_details_FeatureReporting_ReportUsageToServiceDirect
+                    (param_1,param_2,param_3,param_4,wVar1,in_stack_ffffffffffffffd0,
+                     CONCAT71(in_stack_ffffffffffffffd9,in_stack_ffffffffffffffd8));
+  if ((iVar2 != 0) &&
+     (g_wil_details_pfnFeatureLoggingHook !=
+      (_func_void_uint_FEATURE_LOGGED_TRAITS_ptr_FEATURE_ERROR_ptr_int_wil_ReportingKind_ptr_wil_VariantReportingKind_ptr_uchar___uint64
+       *)0x0)) {
+    (*g_wil_details_pfnFeatureLoggingHook)
+              (param_2,param_5,(FEATURE_ERROR *)0x0,param_6,&param_7,(wil_VariantReportingKind *)0x0
+               ,'\0',1);
+  }
+  return;
+}
+

wil_details_FeatureReporting_ReportUsageToServiceDirect

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name wil_details_FeatureReporting_ReportUsageToServiceDirect
fullname wil_details_FeatureReporting_ReportUsageToServiceDirect
refcount 2
length 229
called CmFcManagerNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_RecordUsageInCache
calling wil_details_FeatureReporting_ReportUsageToService
paramcount 7
address 14066cd34
sig int __cdecl wil_details_FeatureReporting_ReportUsageToServiceDirect(wil_details_FeatureReportingCache * param_1, uint param_2, int param_3, int param_4, wil_details_ServiceReportingKind param_5, uint param_6, __uint64 param_7)
sym_type Function
sym_source ANALYSIS
external False 
--- wil_details_FeatureReporting_ReportUsageToServiceDirect
+++ wil_details_FeatureReporting_ReportUsageToServiceDirect
@@ -0,0 +1,53 @@
+
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+/* int __cdecl wil_details_FeatureReporting_ReportUsageToServiceDirect(struct
+   wil_details_FeatureReportingCache * __ptr64,unsigned int,int,int,enum
+   wil_details_ServiceReportingKind,unsigned int,unsigned __int64) */
+
+int __cdecl
+wil_details_FeatureReporting_ReportUsageToServiceDirect
+          (wil_details_FeatureReportingCache *param_1,uint param_2,int param_3,int param_4,
+          wil_details_ServiceReportingKind param_5,uint param_6,__uint64 param_7)
+
+{
+  uint6 uVar1;
+  int extraout_EAX;
+  wil_details_RecordUsageResult *pwVar2;
+  undefined8 uVar3;
+  undefined auStackY_98 [32];
+  uint in_stack_ffffffffffffff88;
+  ulonglong local_68;
+  wil_details_RecordUsageResult local_60;
+  int local_48;
+  uint uStack_44;
+  wil_details_ServiceReportingKind wStack_40;
+  uint uStack_3c;
+  undefined8 local_38;
+  ulonglong local_30;
+  
+  local_30 = __security_cookie ^ (ulonglong)auStackY_98;
+  pwVar2 = wil_details_FeatureReporting_RecordUsageInCache
+                     (&local_60,param_1,param_5,param_4,in_stack_ffffffffffffff88);
+  local_48 = pwVar2->queueBackground;
+  uStack_44 = pwVar2->countImmediate;
+  wStack_40 = pwVar2->kindImmediate;
+  uStack_3c = pwVar2->payloadId;
+  uVar3._0_4_ = pwVar2->ignoredUse;
+  uVar3._4_4_ = pwVar2->isWexpConfiguration;
+  local_38 = uVar3;
+  if (g_wil_details_recordFeatureUsage != (code *)0x0) {
+    uVar3 = (*g_wil_details_recordFeatureUsage)(param_2,param_5,1,param_1);
+  }
+  if ((param_3 != 0) && (param_5 != wil_details_ServiceReportingKind_Store)) {
+    local_68._0_6_ = CONCAT24((short)param_5,param_2);
+    uVar1 = (uint6)local_68;
+    local_68 = (ulonglong)(uint6)local_68;
+    if (param_4 != 0) {
+      local_68 = CONCAT26(1,uVar1);
+    }
+    CmFcManagerNotifyFeatureUsage(uVar3,&local_68);
+  }
+  __security_check_cookie(local_30 ^ (ulonglong)auStackY_98);
+  return extraout_EAX;
+}
+

wil_details_FeatureStateCache_GetCachedFeatureEnabledState

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name wil_details_FeatureStateCache_GetCachedFeatureEnabledState
fullname wil_details_FeatureStateCache_GetCachedFeatureEnabledState
refcount 3
length 45
called wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
calling Feature_1171241279__private_IsEnabled
wil_details_GetCurrentFeatureEnabledState
paramcount 2
address 14066ce20
sig wil_details_FeatureStateCache __cdecl wil_details_FeatureStateCache_GetCachedFeatureEnabledState(wil_details_FeatureStateCache * param_1, wil_details_FeatureDescriptor * param_2)
sym_type Function
sym_source ANALYSIS
external False 
--- wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+++ wil_details_FeatureStateCache_GetCachedFeatureEnabledState
@@ -0,0 +1,21 @@
+
+/* union wil_details_FeatureStateCache __cdecl
+   wil_details_FeatureStateCache_GetCachedFeatureEnabledState(union wil_details_FeatureStateCache *
+   __ptr64,struct wil_details_FeatureDescriptor const * __ptr64) */
+
+wil_details_FeatureStateCache __cdecl
+wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+          (wil_details_FeatureStateCache *param_1,wil_details_FeatureDescriptor *param_2)
+
+{
+  wil_details_FeatureStateCache local_res8;
+  
+  local_res8._s_1.payloadId = 0;
+  local_res8.exchange = param_1->exchange;
+  if ((param_1->exchange & 1) == 0) {
+    local_res8 = wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+                           (param_1,local_res8,param_2);
+  }
+  return (wil_details_FeatureStateCache)local_res8.exchange64;
+}
+

wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
fullname wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
refcount 2
length 247
called _guard_dispatch_icall
wil_details_GetCurrentFeatureEnabledState
calling wil_details_FeatureStateCache_GetCachedFeatureEnabledState
paramcount 3
address 14066ce54
sig wil_details_FeatureStateCache __cdecl wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(wil_details_FeatureStateCache * param_1, wil_details_FeatureStateCache param_2, wil_details_FeatureDescriptor * param_3)
sym_type Function
sym_source ANALYSIS
external False 
--- wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+++ wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
@@ -0,0 +1,75 @@
+
+/* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
+/* union wil_details_FeatureStateCache __cdecl
+   wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState(union
+   wil_details_FeatureStateCache * __ptr64,union wil_details_FeatureStateCache,struct
+   wil_details_FeatureDescriptor const * __ptr64) */
+
+wil_details_FeatureStateCache __cdecl
+wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
+          (wil_details_FeatureStateCache *param_1,wil_details_FeatureStateCache param_2,
+          wil_details_FeatureDescriptor *param_3)
+
+{
+  int iVar1;
+  wil_details_FeatureStateCache wVar2;
+  wil_details_FeatureStateCache wVar3;
+  uint uVar4;
+  uint uVar5;
+  uint uVar6;
+  wil_details_FeatureStateCache wVar7;
+  bool bVar8;
+  uint local_res8 [2];
+  undefined8 local_res10;
+  
+  iVar1 = 0;
+  local_res8[0] = 0;
+  local_res10 = param_2;
+  if (g_wil_details_ensureSubscribedToFeatureConfigurationChanges != (code *)0x0) {
+    iVar1 = (*g_wil_details_ensureSubscribedToFeatureConfigurationChanges)();
+  }
+  wVar2 = wil_details_GetCurrentFeatureEnabledState(param_3,(int *)local_res8);
+  if (param_3->changeTime == '\0') {
+    local_res8[0] = local_res8[0] & -(uint)(iVar1 != 0);
+  }
+  wVar3.exchange64 = param_2.exchange64 & 0xffffffff;
+  do {
+    wVar7 = param_2;
+    uVar6 = wVar3.exchange;
+    local_res10._0_4_ = uVar6;
+    uVar4 = wVar2.exchange;
+    if ((local_res8[0] != 0) && ((wVar3.exchange64 & 1) == 0)) {
+      uVar5 = (uVar6 ^ uVar4) & 0x278 ^ uVar6;
+      uVar6 = uVar5 | 1;
+      local_res10 = CONCAT44(local_res10._4_4_,uVar5) | 1;
+    }
+    if ((wVar7.exchange64 & 2) == 0) {
+      uVar5 = uVar6 ^ (uVar4 ^ uVar6) & 0x100;
+      uVar6 = uVar5 | 2;
+      local_res10 = CONCAT44(local_res10._4_4_,uVar5) | 2;
+    }
+    wVar3.exchange64 = wVar7.exchange64 & 0xffffffff;
+    LOCK();
+    uVar5 = param_1->exchange;
+    bVar8 = wVar7.exchange == uVar5;
+    if (bVar8) {
+      param_1->exchange = uVar6;
+    }
+    else {
+      wVar3._s_1.payloadId = 0;
+      wVar3.exchange = uVar5;
+    }
+    UNLOCK();
+    param_2 = wVar3;
+  } while (!bVar8);
+  if (((wVar7.exchange64 & 2) == 0) &&
+     (g_wil_details_subscribeFeatureStateCacheToConfigurationChanges != (code *)0x0)) {
+    (*g_wil_details_subscribeFeatureStateCacheToConfigurationChanges)
+              (param_1,param_3->changeTime,iVar1);
+  }
+  if (local_res8[0] == 0) {
+    local_res10._0_4_ = uVar6 ^ (uVar4 ^ uVar6) & 0x278;
+  }
+  return (wil_details_FeatureStateCache)local_res10;
+}
+

wil_details_GetCurrentFeatureEnabledState

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name wil_details_GetCurrentFeatureEnabledState
fullname wil_details_GetCurrentFeatureEnabledState
refcount 2
length 309
called wil_RtlStagingConfig_QueryFeatureState
wil_details_FeatureStateCache_GetCachedFeatureEnabledState
calling wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
paramcount 2
address 14066cf54
sig wil_details_FeatureStateCache __cdecl wil_details_GetCurrentFeatureEnabledState(wil_details_FeatureDescriptor * param_1, int * param_2)
sym_type Function
sym_source ANALYSIS
external False 
--- wil_details_GetCurrentFeatureEnabledState
+++ wil_details_GetCurrentFeatureEnabledState
@@ -0,0 +1,76 @@
+
+/* union wil_details_FeatureStateCache __cdecl wil_details_GetCurrentFeatureEnabledState(struct
+   wil_details_FeatureDescriptor const * __ptr64,int * __ptr64) */
+
+wil_details_FeatureStateCache __cdecl
+wil_details_GetCurrentFeatureEnabledState(wil_details_FeatureDescriptor *param_1,int *param_2)
+
+{
+  uchar uVar1;
+  wil_details_FeatureDescriptor *pwVar2;
+  int iVar3;
+  uint uVar4;
+  wil_details_FeatureStateCache wVar5;
+  uint uVar6;
+  wil_details_FeatureDescriptor **ppwVar7;
+  bool bVar8;
+  wil_details_FeatureStateCache local_res8;
+  undefined local_28 [16];
+  undefined8 local_18;
+  
+  uVar1 = param_1->changeTime;
+  uVar6 = param_1->featureId;
+  *param_2 = 1;
+  local_18._0_4_ = 0;
+  local_18._4_4_ = 0;
+  local_28 = ZEXT816(0);
+  iVar3 = wil_RtlStagingConfig_QueryFeatureState
+                    ((wil_FeatureState *)local_28,uVar6,(uint)((byte)(uVar1 - 2) < 2),param_2);
+  uVar6 = (-(uint)(iVar3 != 0) & local_28._0_4_ &
+          (wil_FeatureEnabledState_Disabled|wil_FeatureEnabledState_Enabled)) << 5 ^
+          (-(uint)((int)local_18 != 0) & 0x100 | -(uint)(local_18._4_4_ != 0) & 0x200);
+  if ((uVar6 & 0x60) == 0) {
+    uVar4 = -(uint)(param_1->isEnabledByDefault != '\0') & 0x10;
+  }
+  else {
+    uVar4 = 0;
+    if (local_28._0_4_ == wil_FeatureEnabledState_Enabled) {
+      uVar4 = 0x10;
+    }
+  }
+  uVar6 = (uVar4 | uVar6) ^ uVar4 >> 1;
+  local_res8._s_1.payloadId = 0;
+  local_res8.exchange = uVar6;
+  if (((uVar6 & 8) != 0) &&
+     (ppwVar7 = param_1->requiresFeatures, ppwVar7 != (wil_details_FeatureDescriptor **)0x0)) {
+    do {
+      pwVar2 = *ppwVar7;
+      if (pwVar2 == (wil_details_FeatureDescriptor *)0x0) {
+        return (wil_details_FeatureStateCache)local_res8._s_1;
+      }
+      if ((pwVar2->isAlwaysEnabled == '\0') && (pwVar2->isAlwaysDisabled == '\0')) {
+        wVar5 = wil_details_FeatureStateCache_GetCachedFeatureEnabledState
+                          (pwVar2->featureStateCache,pwVar2);
+        if ((uVar6 & 8) == 0) goto LAB_14066d062;
+        bVar8 = (wVar5.exchange64 & 8) == 0;
+LAB_14066d059:
+        if (bVar8) goto LAB_14066d062;
+        uVar4 = 8;
+      }
+      else {
+        if ((uVar6 & 8) != 0) {
+          bVar8 = pwVar2->isEnabledByDefault == '\0';
+          goto LAB_14066d059;
+        }
+LAB_14066d062:
+        uVar4 = 0;
+      }
+      ppwVar7 = ppwVar7 + 1;
+      uVar6 = uVar6 & 0xfffffff7 | uVar4;
+      local_res8._s_1.payloadId = 0;
+      local_res8.exchange = uVar6;
+    } while (uVar4 != 0);
+  }
+  return (wil_details_FeatureStateCache)local_res8.exchange64;
+}
+

wil_details_MapReportingKind

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name wil_details_MapReportingKind
fullname wil_details_MapReportingKind
refcount 2
length 144
called
calling wil_details_FeatureReporting_ReportUsageToService
paramcount 2
address 14066d090
sig wil_details_ServiceReportingKind __cdecl wil_details_MapReportingKind(wil_ReportingKind param_1, int param_2)
sym_type Function
sym_source ANALYSIS
external False 
--- wil_details_MapReportingKind
+++ wil_details_MapReportingKind
@@ -0,0 +1,42 @@
+
+/* enum wil_details_ServiceReportingKind __cdecl wil_details_MapReportingKind(enum
+   wil_ReportingKind,int) */
+
+wil_details_ServiceReportingKind __cdecl
+wil_details_MapReportingKind(wil_ReportingKind param_1,int param_2)
+
+{
+  byte bVar1;
+  
+  if (param_1 != wil_ReportingKind_None) {
+    if (param_1 == wil_ReportingKind_UniqueUsage) {
+      return ~-(uint)(param_2 != 0) & 4;
+    }
+    if (param_1 == wil_ReportingKind_UniqueOpportunity) {
+      return (-(uint)(param_2 != 0) & 0xfffffffc) +
+             wil_details_ServiceReportingKind_PotentialUniqueOpportunity;
+    }
+    if (param_1 == wil_ReportingKind_DeviceUsage) {
+      return (-(uint)(param_2 != 0) & 0xfffffffc) +
+             wil_details_ServiceReportingKind_PotentialDeviceUsage;
+    }
+    if (param_1 == wil_ReportingKind_DeviceOpportunity) {
+      return (-(uint)(param_2 != 0) & 0xfffffffc) +
+             wil_details_ServiceReportingKind_PotentialDeviceOpportunity;
+    }
+    if (param_1 == wil_ReportingKind_TotalDuration) {
+      return (-(uint)(param_2 != 0) & 0xfffffffe) +
+             wil_details_ServiceReportingKind_DisabledTotalDuration;
+    }
+    if (param_1 == wil_ReportingKind_PausedDuration) {
+      return (-(uint)(param_2 != 0) & 0xfffffffe) +
+             wil_details_ServiceReportingKind_DisabledPausedDuration;
+    }
+    bVar1 = (char)param_1 + 0x9c;
+    if (bVar1 < 0x32) {
+      return (-(uint)(param_2 != 0) & 0xffffffce) + 0x96 + (uint)bVar1;
+    }
+  }
+  return wil_details_ServiceReportingKind_None;
+}
+

wil_RtlStagingConfig_QueryFeatureState

Function Meta

Key ntoskrnl.exe.10.0.22621.2428
name wil_RtlStagingConfig_QueryFeatureState
fullname wil_RtlStagingConfig_QueryFeatureState
refcount 2
length 152
called RtlQueryFeatureConfiguration
calling wil_details_GetCurrentFeatureEnabledState
paramcount 4
address 140a4f280
sig int __cdecl wil_RtlStagingConfig_QueryFeatureState(wil_FeatureState * param_1, uint param_2, int param_3, int * param_4)
sym_type Function
sym_source ANALYSIS
external False 
--- wil_RtlStagingConfig_QueryFeatureState
+++ wil_RtlStagingConfig_QueryFeatureState
@@ -0,0 +1,34 @@
+
+/* int __cdecl wil_RtlStagingConfig_QueryFeatureState(struct wil_FeatureState * __ptr64,unsigned
+   int,int,int * __ptr64) */
+
+int __cdecl
+wil_RtlStagingConfig_QueryFeatureState
+          (wil_FeatureState *param_1,uint param_2,int param_3,int *param_4)
+
+{
+  int iVar1;
+  undefined local_res20 [8];
+  undefined8 local_18;
+  uint local_10;
+  
+  local_18 = 0;
+  local_10 = 0;
+  iVar1 = RtlQueryFeatureConfiguration(param_2,param_3 == 0,local_res20,&local_18);
+  if (iVar1 == 0) {
+    param_1->enabledState =
+         local_18._4_4_ >> 4 & (wil_FeatureEnabledState_Disabled|wil_FeatureEnabledState_Enabled);
+    param_1->variant = (byte)((ulonglong)local_18 >> 0x28) & 0x3f;
+    param_1->payload = local_10;
+    param_1->payloadKind =
+         local_18._4_4_ >> 0xe &
+         (wil_FeatureVariantPayloadKind_Resident|wil_FeatureVariantPayloadKind_External);
+    param_1->isWexpConfiguration = local_18._4_4_ >> 6 & 1;
+  }
+  else if (iVar1 != 0x117) {
+    return 0;
+  }
+  param_1->hasNotification = local_18._4_4_ >> 7 & 1;
+  return 1;
+}
+

Modified

Modified functions contain code changes

VrpPostOpenOrCreate

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type code,refcount,length,address
ratio 0.22
i_ratio 0.3
m_ratio 0.28
b_ratio 0.78
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name VrpPostOpenOrCreate VrpPostOpenOrCreate
fullname VrpPostOpenOrCreate VrpPostOpenOrCreate
refcount 3 2
length 1048 1003
called
Expand for full list:
CmAllocateExtraParameter
CmRetrieveExtraParameter
CmSetCallbackObjectContext
CmpFindExtraParameterInBlock
CmpFreeExtraParameter
EtwActivityIdControl
ExFreePoolWithTag
ObfDereferenceObject
ObfReferenceObjectWithTag
VrpAllocateKeyContext
VrpBuildKeyPathVrpCountPathComponents
VrpFreeCallbackContext
VrpFreeKeyContext
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
Expand for full list:
CmAllocateExtraParameter
CmRetrieveExtraParameter
CmSetCallbackObjectContext
CmpFindExtraParameterInBlock
CmpFreeExtraParameter
EtwActivityIdControl
ExFreePoolWithTag
ObfDereferenceObject
ObfReferenceObjectWithTag
VrpAllocateKeyContext
VrpBuildKeyPathVrpCountPathComponents
VrpFreeCallbackContext
VrpFreeKeyContext
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
calling VrpRegistryCallback VrpRegistryCallback
paramcount 0 0
address 1406cc198 1406cc7e4
sig undefined VrpPostOpenOrCreate(void) undefined VrpPostOpenOrCreate(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

VrpPostOpenOrCreate Diff

--- VrpPostOpenOrCreate
+++ VrpPostOpenOrCreate
@@ -1,225 +1,244 @@
 
 void VrpPostOpenOrCreate(longlong *param_1,undefined8 param_2)
 
 {
-  longlong lVar1;
+  ushort **ppuVar1;
   ushort **ppuVar2;
-  ushort **ppuVar3;
-  undefined4 *puVar4;
-  longlong *plVar5;
-  longlong **pplVar6;
-  code *pcVar7;
+  longlong *plVar3;
+  longlong **pplVar4;
+  undefined4 *puVar5;
+  code *pcVar6;
+  undefined4 uVar7;
   undefined4 uVar8;
-  undefined4 uVar9;
-  undefined8 *puVar10;
-  undefined2 uVar11;
-  int iVar12;
-  undefined4 uVar13;
+  undefined8 *puVar9;
+  undefined2 uVar10;
+  int iVar11;
+  undefined4 uVar12;
+  ushort **ppuVar13;
   longlong lVar14;
-  ushort **ppuVar15;
+  longlong *plVar15;
   ushort *puVar16;
-  longlong *plVar17;
+  undefined *puVar17;
   undefined *puVar18;
   undefined *puVar19;
-  ushort **ppuVar20;
+  longlong lVar20;
+  ushort **in_R11;
+  ushort **ppuVar21;
   undefined auStack_e8 [8];
   undefined auStack_e0 [24];
   undefined4 local_c8;
   undefined *local_c0;
   undefined8 local_b8;
   longlong local_b0;
   undefined local_a8 [16];
   undefined local_98 [32];
   uint *local_78;
   undefined8 local_70;
   undefined8 local_68;
   uint local_60;
   undefined4 local_5c;
   undefined8 *local_58;
   undefined8 local_50;
   ulonglong local_48;
   
+  puVar17 = auStack_e8;
   puVar19 = auStack_e8;
   puVar18 = auStack_e8;
   local_48 = __security_cookie ^ (ulonglong)auStack_e8;
   local_a8 = ZEXT816(0);
   EtwActivityIdControl(3,local_a8);
   local_b0 = *param_1;
   lVar14 = 0;
-  lVar1 = param_1[1];
-  ppuVar15 = (ushort **)0x0;
+  lVar20 = param_1[1];
+  ppuVar13 = (ushort **)0x0;
+  ppuVar21 = (ushort **)0x0;
   local_b8 = (undefined8 *)0x0;
-  iVar12 = *(int *)(local_b0 + 8);
-  ppuVar2 = *(ushort ***)(local_b0 + 0x20);
-  ppuVar3 = *(ushort ***)(local_b0 + 0x10);
-  if (iVar12 < 0) goto LAB_0;
-  CmRetrieveExtraParameter(*(undefined8 *)(lVar1 + 0x10));
-  puVar10 = local_b8;
-  if (iVar12 == 0x104) {
+  iVar11 = *(int *)(local_b0 + 8);
+  ppuVar1 = *(ushort ***)(local_b0 + 0x20);
+  ppuVar2 = *(ushort ***)(local_b0 + 0x10);
+  if (iVar11 < 0) goto LAB_0;
+  CmRetrieveExtraParameter(*(undefined8 *)(lVar20 + 0x10));
+  puVar9 = local_b8;
+  if (iVar11 == 0x104) {
     if (local_b8 == (undefined8 *)0x0) {
 LAB_0:
-      iVar12 = 0;
+      iVar11 = 0;
       goto LAB_1;
     }
-    plVar17 = local_b8 + -6;
-    plVar5 = (longlong *)*plVar17;
-    iVar12 = 0x104;
-    if (((longlong *)plVar5[1] == plVar17) &&
-       (pplVar6 = (longlong **)local_b8[-5], *pplVar6 == plVar17)) {
-      *pplVar6 = plVar5;
-      plVar5[1] = (longlong)pplVar6;
-      *plVar17 = 0;
+    plVar15 = local_b8 + -6;
+    plVar3 = (longlong *)*plVar15;
+    if (((longlong *)plVar3[1] == plVar15) &&
+       (pplVar4 = (longlong **)local_b8[-5], *pplVar4 == plVar15)) {
+      *pplVar4 = plVar3;
+      plVar3[1] = (longlong)pplVar4;
+      *plVar15 = 0;
       local_b8[-5] = 0;
       CmpFreeExtraParameter();
       goto LAB_0;
     }
 LAB_2:
-    pcVar7 = (code *)swi(0x29);
-    (*pcVar7)(3);
-    puVar19 = auStack_e0;
+    puVar16 = (ushort *)0x3;
+    pcVar6 = (code *)swi(0x29);
+    ppuVar21 = (ushort **)(*pcVar6)();
+    puVar17 = auStack_e0;
 LAB_3:
+    iVar11 = 0;
+    *in_R11 = puVar16;
+    in_R11[1] = (ushort *)ppuVar21;
+    *ppuVar21 = (ushort *)in_R11;
+    *(ushort ***)(puVar16 + 4) = in_R11;
+    puVar19 = puVar17;
+LAB_4:
     puVar18 = puVar19;
-    puVar16 = &EmptyUnicodeString;
-    if (*(longlong *)(*ppuVar3 + 4) != 0) {
-      puVar16 = *ppuVar3;
-    }
-    local_68 = *(undefined8 *)(puVar16 + 4);
-    local_78 = &local_60;
-    local_58 = &local_b8;
-    local_60 = (uint)*puVar16;
-    *(undefined **)(puVar18 + 0x28) = local_98;
-    *(undefined4 *)(puVar18 + 0x20) = 5;
-    local_70 = 2;
-    local_5c = 0;
-    local_b8 = (undefined8 *)CONCAT44(local_b8._4_4_,iVar12);
-    local_50 = 4;
-    *(undefined8 *)(puVar18 + -8) = 0x1408b800e;
-    _tlgWriteTransfer_EtwWriteTransfer(&DAT_4,&DAT_140039dea,local_a8,0);
+    if (ppuVar2[1] != (ushort *)0x0) {
+      *(undefined8 *)(puVar18 + -8) = 0x1406ccabe;
+      ObfDereferenceObject();
+    }
+    lVar20 = local_b0;
+    ppuVar2[1] = *ppuVar1;
+    *ppuVar1 = (ushort *)0x0;
+    if ((*(int *)(local_b0 + 8) == 0x104) || (*(int *)(local_b0 + 8) == 0x368)) {
+      if (5 < DAT_5) {
+        puVar16 = &EmptyUnicodeString;
+        if (*(longlong *)(*ppuVar2 + 4) != 0) {
+          puVar16 = *ppuVar2;
+        }
+        local_68 = *(undefined8 *)(puVar16 + 4);
+        local_78 = &local_60;
+        local_58 = &local_b8;
+        local_60 = (uint)*puVar16;
+        *(undefined **)(puVar18 + 0x28) = local_98;
+        *(undefined4 *)(puVar18 + 0x20) = 5;
+        local_70 = 2;
+        local_5c = 0;
+        local_b8 = (undefined8 *)CONCAT44(local_b8._4_4_,iVar11);
+        local_50 = 4;
+        *(undefined8 *)(puVar18 + -8) = 0x1406ccb8c;
+        _tlgWriteTransfer_EtwWriteTransfer(&DAT_5,&DAT_140039e13,local_a8,0);
+      }
+    }
+    else {
+      lVar14 = *(longlong *)(*ppuVar2 + 4);
+      if (lVar14 != 0) {
+        *(undefined8 *)(puVar18 + -8) = 0x1406ccaf0;
+        ExFreePoolWithTag(lVar14,0);
+      }
+      puVar5 = (undefined4 *)*ppuVar2;
+      uVar12 = *(undefined4 *)((longlong)ppuVar1 + 0x14);
+      uVar7 = *(undefined4 *)(ppuVar1 + 3);
+      uVar8 = *(undefined4 *)((longlong)ppuVar1 + 0x1c);
+      *puVar5 = *(undefined4 *)(ppuVar1 + 2);
+      puVar5[1] = uVar12;
+      puVar5[2] = uVar7;
+      puVar5[3] = uVar8;
+      puVar5 = (undefined4 *)ppuVar2[0xe];
+      uVar12 = *(undefined4 *)((longlong)ppuVar1 + 0x24);
+      uVar7 = *(undefined4 *)(ppuVar1 + 5);
+      uVar8 = *(undefined4 *)((longlong)ppuVar1 + 0x2c);
+      *puVar5 = *(undefined4 *)(ppuVar1 + 4);
+      puVar5[1] = uVar12;
+      puVar5[2] = uVar7;
+      puVar5[3] = uVar8;
+      ppuVar1[3] = (ushort *)0x0;
+      ppuVar1[5] = (ushort *)0x0;
+    }
+    *(undefined8 *)(puVar18 + -8) = 0x1406ccb94;
+    VrpFreeCallbackContext(ppuVar1);
   }
   else {
-    if (iVar12 == 0x368) {
+    if (iVar11 == 0x368) {
       if (local_b8 != (undefined8 *)0x0) goto LAB_0;
-      if (ppuVar2 == (ushort **)0x0) goto LAB_5;
-      ppuVar15 = (ushort **)CmAllocateExtraParameter();
-      if (ppuVar15 == (ushort **)0x0) goto LAB_6;
-      iVar12 = VrpBuildKeyPath(0,ppuVar2 + 6,ppuVar15 + 2);
-      if (iVar12 < 0) goto LAB_7;
-      ObfReferenceObjectWithTag(ppuVar2[1],0x67655256);
-      ppuVar20 = ppuVar15 + -6;
-      *ppuVar15 = ppuVar2[1];
-      *(undefined4 *)(ppuVar15 + 1) = *(undefined4 *)(ppuVar2 + 8);
-      puVar16 = *(ushort **)(lVar1 + 0x10);
-      iVar12 = CmpFindExtraParameterInBlock(puVar16,ppuVar15 + -4,&local_b8);
-      lVar14 = 0;
-      if (-1 < iVar12) {
-        iVar12 = -0x3fffffcb;
+      if (ppuVar1 == (ushort **)0x0) goto LAB_6;
+      ppuVar13 = (ushort **)CmAllocateExtraParameter();
+      if (ppuVar13 != (ushort **)0x0) {
+        iVar11 = VrpBuildKeyPath(0,ppuVar1 + 6,ppuVar13 + 2);
+        ppuVar21 = ppuVar13;
+        if (-1 < iVar11) {
+          ObfReferenceObjectWithTag(ppuVar1[1],0x67655256);
+          in_R11 = ppuVar13 + -6;
+          *ppuVar13 = ppuVar1[1];
+          *(undefined4 *)(ppuVar13 + 1) = *(undefined4 *)(ppuVar1 + 8);
+          puVar16 = *(ushort **)(lVar20 + 0x10);
+          iVar11 = CmpFindExtraParameterInBlock(puVar16,ppuVar13 + -4,&local_b8);
+          if (iVar11 < 0) {
+            if (iVar11 == -0x3fffffcc) {
+              ppuVar21 = *(ushort ***)(puVar16 + 4);
+              if (*ppuVar21 != puVar16) goto LAB_2;
+              goto LAB_3;
+            }
+          }
+          else {
+            iVar11 = -0x3fffffcb;
+          }
+        }
         goto LAB_7;
       }
-      if (iVar12 != -0x3fffffcc) goto LAB_7;
-      ppuVar15 = *(ushort ***)(puVar16 + 4);
-      if (*ppuVar15 != puVar16) goto LAB_2;
-      *ppuVar20 = puVar16;
-      iVar12 = 0;
-      ppuVar20[1] = (ushort *)ppuVar15;
-      *ppuVar15 = (ushort *)ppuVar20;
-      *(ushort ***)(puVar16 + 4) = ppuVar20;
+LAB_8:
+      iVar11 = -0x3fffff66;
+      ppuVar21 = ppuVar13;
+LAB_7:
+      if (2 < DAT_5) {
+        puVar16 = &EmptyUnicodeString;
+        if (*(longlong *)(*ppuVar2 + 4) != 0) {
+          puVar16 = *ppuVar2;
+        }
+        local_68 = *(undefined8 *)(puVar16 + 4);
+        local_78 = &local_60;
+        local_58 = &local_b8;
+        local_c0 = local_98;
+        local_60 = (uint)*puVar16;
+        local_c8 = 5;
+        local_70 = 2;
+        local_5c = 0;
+        local_b8 = (undefined8 *)CONCAT44(local_b8._4_4_,iVar11);
+        local_50 = 4;
+        _tlgWriteTransfer_EtwWriteTransfer(&DAT_5,&DAT_140039f3d,local_a8,0);
+      }
+      if (lVar14 != 0) {
+        VrpFreeKeyContext(lVar14);
+      }
+      if (ppuVar21 != (ushort **)0x0) {
+        CmpFreeExtraParameter(ppuVar21 + -6);
+      }
     }
     else {
       if (local_b8 == (undefined8 *)0x0) {
         lVar14 = VrpAllocateKeyContext(param_2);
-        if (lVar14 == 0) goto LAB_6;
-        iVar12 = VrpBuildKeyPath(0,ppuVar2 + 6,lVar14 + 0x10);
-        if (iVar12 < 0) goto LAB_7;
-        uVar13 = *(undefined4 *)(ppuVar2 + 8);
-LAB_8:
-        *(undefined4 *)(lVar14 + 0x24) = uVar13;
-        uVar11 = VrpCountPathComponents(lVar14 + 0x10);
-        *(undefined2 *)(lVar14 + 0x20) = uVar11;
-        iVar12 = CmSetCallbackObjectContext
-                           (*(undefined8 *)ppuVar3[9],&VrpCallbackCookie,lVar14,&local_b8);
-        if (iVar12 < 0) goto LAB_7;
-      }
-      else {
-        lVar14 = VrpAllocateKeyContext(*local_b8);
         if (lVar14 != 0) {
-          iVar12 = VrpBuildKeyPath(0,puVar10 + 2,lVar14 + 0x10);
-          if (-1 < iVar12) {
-            uVar13 = *(undefined4 *)(puVar10 + 1);
-            goto LAB_8;
+          iVar11 = VrpBuildKeyPath(0,ppuVar1 + 6,lVar14 + 0x10);
+          if (-1 < iVar11) {
+            uVar12 = *(undefined4 *)(ppuVar1 + 8);
+            goto LAB_9;
           }
           goto LAB_7;
         }
+        goto LAB_8;
+      }
+      lVar14 = VrpAllocateKeyContext(*local_b8);
+      if (lVar14 == 0) goto LAB_8;
+      iVar11 = VrpBuildKeyPath(0,puVar9 + 2,lVar14 + 0x10);
+      if (iVar11 < 0) goto LAB_7;
+      uVar12 = *(undefined4 *)(puVar9 + 1);
+LAB_9:
+      *(undefined4 *)(lVar14 + 0x24) = uVar12;
+      uVar10 = VrpCountPathComponents(lVar14 + 0x10);
+      *(undefined2 *)(lVar14 + 0x20) = uVar10;
+      iVar11 = CmSetCallbackObjectContext
+                         (*(undefined8 *)ppuVar2[9],&VrpCallbackCookie,lVar14,&local_b8);
+      if (iVar11 < 0) goto LAB_7;
+    }
+LAB_1:
+    puVar19 = auStack_e8;
+    lVar20 = local_b0;
+    if (ppuVar1 != (ushort **)0x0) goto LAB_4;
+  }
+  puVar19 = puVar18;
+  if (iVar11 < 0) {
+    *(int *)(lVar20 + 0x18) = iVar11;
+  }
 LAB_6:
-        iVar12 = -0x3fffff66;
-LAB_7:
-        if (2 < DAT_4) {
-          puVar16 = &EmptyUnicodeString;
-          if (*(longlong *)(*ppuVar3 + 4) != 0) {
-            puVar16 = *ppuVar3;
-          }
-          local_68 = *(undefined8 *)(puVar16 + 4);
-          local_78 = &local_60;
-          local_58 = &local_b8;
-          local_c0 = local_98;
-          local_60 = (uint)*puVar16;
-          local_c8 = 5;
-          local_70 = 2;
-          local_5c = 0;
-          local_b8 = (undefined8 *)CONCAT44(local_b8._4_4_,iVar12);
-          local_50 = 4;
-          _tlgWriteTransfer_EtwWriteTransfer(&DAT_4,&DAT_14003a104,local_a8,0);
-        }
-        if (lVar14 != 0) {
-          VrpFreeKeyContext(lVar14);
-        }
-        if (ppuVar15 != (ushort **)0x0) {
-          CmpFreeExtraParameter(ppuVar15 + -6);
-        }
-      }
-LAB_1:
-      puVar19 = auStack_e8;
-      if (ppuVar2 == (ushort **)0x0) goto LAB_5;
-    }
-    if (ppuVar3[1] != (ushort *)0x0) {
-      ObfDereferenceObject();
-    }
-    ppuVar3[1] = *ppuVar2;
-    *ppuVar2 = (ushort *)0x0;
-    if ((*(int *)(local_b0 + 8) == 0x104) || (*(int *)(local_b0 + 8) == 0x368)) {
-      puVar19 = auStack_e8;
-      if (5 < DAT_4) goto LAB_1408b7f9c;
-    }
-    else {
-      if (*(longlong *)(*ppuVar3 + 4) != 0) {
-        ExFreePoolWithTag(*(longlong *)(*ppuVar3 + 4),0);
-      }
-      puVar4 = (undefined4 *)*ppuVar3;
-      uVar13 = *(undefined4 *)((longlong)ppuVar2 + 0x14);
-      uVar8 = *(undefined4 *)(ppuVar2 + 3);
-      uVar9 = *(undefined4 *)((longlong)ppuVar2 + 0x1c);
-      *puVar4 = *(undefined4 *)(ppuVar2 + 2);
-      puVar4[1] = uVar13;
-      puVar4[2] = uVar8;
-      puVar4[3] = uVar9;
-      puVar4 = (undefined4 *)ppuVar3[0xe];
-      uVar13 = *(undefined4 *)((longlong)ppuVar2 + 0x24);
-      uVar8 = *(undefined4 *)(ppuVar2 + 5);
-      uVar9 = *(undefined4 *)((longlong)ppuVar2 + 0x2c);
-      *puVar4 = *(undefined4 *)(ppuVar2 + 4);
-      puVar4[1] = uVar13;
-      puVar4[2] = uVar8;
-      puVar4[3] = uVar9;
-      ppuVar2[3] = (ushort *)0x0;
-      ppuVar2[5] = (ushort *)0x0;
-      puVar18 = auStack_e8;
-    }
-  }
-  *(undefined8 *)(puVar18 + -8) = 0x1406cc311;
-  VrpFreeCallbackContext(ppuVar2);
-  puVar19 = puVar18;
-LAB_5:
-  *(undefined8 *)(puVar19 + -8) = 0x1406cc31f;
+  *(undefined8 *)(puVar19 + -8) = 0x1406ccbb4;
   __security_check_cookie(local_48 ^ (ulonglong)puVar19);
   return;
 }

VrpAddNamespaceNodeToList

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type code,refcount,length,address,calling
ratio 0.86
i_ratio 0.73
m_ratio 0.94
b_ratio 0.94
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name VrpAddNamespaceNodeToList VrpAddNamespaceNodeToList
fullname VrpAddNamespaceNodeToList VrpAddNamespaceNodeToList
refcount 6 5
length 756 739
called ExAllocatePoolWithTag
ExFreePoolWithTag
RtlCopyMemory
VrpFindExactNamespaceNode
memset		 ExAllocatePoolWithTag
ExFreePoolWithTag
RtlCopyMemory
VrpFindExactNamespaceNode
memset
calling VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlInitializeJobForVreg
VrpPreLoadKey		 VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpPreLoadKey
paramcount 0 0
address 14075ade0 14075b810
sig undefined VrpAddNamespaceNodeToList(void) undefined VrpAddNamespaceNodeToList(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

VrpAddNamespaceNodeToList Calling Diff

--- VrpAddNamespaceNodeToList calling
+++ VrpAddNamespaceNodeToList calling
@@ -3 +2,0 @@
-VrpHandleIoctlInitializeJobForVreg

VrpAddNamespaceNodeToList Diff

--- VrpAddNamespaceNodeToList
+++ VrpAddNamespaceNodeToList
@@ -1,187 +1,187 @@
 
 int VrpAddNamespaceNodeToList(longlong param_1,undefined8 param_2)
 
 {
   void *pvVar1;
   undefined auVar2 [16];
   undefined auVar3 [16];
   undefined auVar4 [16];
   undefined auVar5 [16];
   undefined auVar6 [16];
   undefined auVar7 [16];
   undefined auVar8 [16];
   undefined auVar9 [16];
   undefined auVar10 [16];
   undefined auVar11 [16];
   undefined auVar12 [16];
   undefined auVar13 [16];
   undefined auVar14 [16];
   undefined auVar15 [16];
   undefined auVar16 [16];
   undefined auVar17 [16];
   int iVar18;
   longlong lVar19;
   ulonglong uVar20;
   ulonglong uVar21;
   void *pvVar22;
   undefined8 *puVar23;
   ulonglong uVar24;
   ulonglong uVar25;
   ulonglong uVar26;
   ulonglong local_res18 [2];
   
   local_res18[0] = 0;
   lVar19 = VrpFindExactNamespaceNode(param_1,param_2,local_res18);
   uVar20 = local_res18[0];
   if (lVar19 != 0) {
     return -0x3fffffcb;
   }
   uVar24 = *(ulonglong *)(param_1 + 0x30);
   uVar21 = *(ulonglong *)(param_1 + 0x38);
   if (uVar24 <= local_res18[0]) {
     if (uVar21 <= uVar24) {
       uVar20 = uVar24 + 1;
       if (uVar20 <= uVar21) {
         return -0x3ffffff3;
       }
       uVar25 = *(longlong *)(param_1 + 0x40) - 1;
       uVar26 = uVar25 + uVar20;
       if (uVar26 < uVar20) {
         return -0x3fffff6b;
       }
       uVar26 = ~uVar25 & uVar26;
-      auVar6._8_8_ = 0;
-      auVar6._0_8_ = *(ulonglong *)(param_1 + 0x28);
-      auVar14._8_8_ = 0;
-      auVar14._0_8_ = uVar21;
-      uVar20 = SUB168(auVar6 * auVar14,0);
-      if ((SUB168(auVar6 * auVar14,8) == 0) &&
-         (auVar7._8_8_ = 0, auVar7._0_8_ = *(ulonglong *)(param_1 + 0x28), auVar15._8_8_ = 0,
-         auVar15._0_8_ = uVar26, uVar21 = SUB168(auVar7 * auVar15,0),
-         SUB168(auVar7 * auVar15,8) == 0)) {
+      auVar5._8_8_ = 0;
+      auVar5._0_8_ = *(ulonglong *)(param_1 + 0x28);
+      auVar13._8_8_ = 0;
+      auVar13._0_8_ = uVar21;
+      uVar20 = SUB168(auVar5 * auVar13,0);
+      if ((SUB168(auVar5 * auVar13,8) == 0) &&
+         (auVar6._8_8_ = 0, auVar6._0_8_ = *(ulonglong *)(param_1 + 0x28), auVar14._8_8_ = 0,
+         auVar14._0_8_ = uVar26, uVar21 = SUB168(auVar6 * auVar14,0),
+         SUB168(auVar6 * auVar14,8) == 0)) {
         pvVar1 = *(void **)(param_1 + 0x48);
         pvVar22 = (void *)ExAllocatePoolWithTag(1,uVar21,0x72615452);
         if (pvVar1 == (void *)0x0) {
           if (pvVar22 == (void *)0x0) {
 LAB_0:
             iVar18 = -0x3fffffe9;
             goto LAB_1;
           }
           memset(pvVar22,0,uVar21);
         }
         else {
           if (pvVar22 == (void *)0x0) goto LAB_0;
           memset(pvVar22,0,uVar21);
           if (uVar21 <= uVar20) {
             uVar20 = uVar21;
           }
           RtlCopyMemory(pvVar22,pvVar1,uVar20);
           ExFreePoolWithTag(pvVar1,0x72615452);
         }
         *(void **)(param_1 + 0x48) = pvVar22;
         iVar18 = 0;
         *(ulonglong *)(param_1 + 0x38) = uVar26;
       }
       else {
         iVar18 = -0x3fffff6b;
       }
 LAB_1:
       if (iVar18 != 0) {
         return iVar18;
       }
     }
-    auVar5._8_8_ = 0;
-    auVar5._0_8_ = uVar24;
-    auVar13._8_8_ = 0;
-    auVar13._0_8_ = *(ulonglong *)(param_1 + 0x28);
-    if (SUB168(auVar5 * auVar13,8) != 0) {
+    auVar7._8_8_ = 0;
+    auVar7._0_8_ = uVar24;
+    auVar15._8_8_ = 0;
+    auVar15._0_8_ = *(ulonglong *)(param_1 + 0x28);
+    if (SUB168(auVar7 * auVar15,8) != 0) {
       return -0x3fffff6b;
     }
     puVar23 = (undefined8 *)
-              (SUB168(auVar5 * auVar13,0) + (longlong)*(undefined8 **)(param_1 + 0x48));
+              (SUB168(auVar7 * auVar15,0) + (longlong)*(undefined8 **)(param_1 + 0x48));
     if (puVar23 < *(undefined8 **)(param_1 + 0x48)) {
       return -0x3fffff6b;
     }
     *puVar23 = param_2;
     goto LAB_2;
   }
   if (uVar21 <= uVar24) {
     uVar24 = uVar24 + 1;
     if (uVar24 <= uVar21) {
       return -0x3ffffff3;
     }
     uVar25 = *(longlong *)(param_1 + 0x40) - 1;
     uVar26 = uVar25 + uVar24;
     if (uVar26 < uVar24) {
       return -0x3fffff6b;
     }
     uVar26 = ~uVar25 & uVar26;
     auVar8._8_8_ = 0;
     auVar8._0_8_ = *(ulonglong *)(param_1 + 0x28);
     auVar16._8_8_ = 0;
     auVar16._0_8_ = uVar21;
     uVar24 = SUB168(auVar8 * auVar16,0);
     if ((SUB168(auVar8 * auVar16,8) == 0) &&
        (auVar9._8_8_ = 0, auVar9._0_8_ = *(ulonglong *)(param_1 + 0x28), auVar17._8_8_ = 0,
        auVar17._0_8_ = uVar26, uVar21 = SUB168(auVar9 * auVar17,0), SUB168(auVar9 * auVar17,8) == 0)
        ) {
       pvVar1 = *(void **)(param_1 + 0x48);
       pvVar22 = (void *)ExAllocatePoolWithTag(1,uVar21,0x72615452);
       if (pvVar1 == (void *)0x0) {
         if (pvVar22 == (void *)0x0) {
 LAB_3:
           iVar18 = -0x3fffffe9;
           goto LAB_4;
         }
         memset(pvVar22,0,uVar21);
       }
       else {
         if (pvVar22 == (void *)0x0) goto LAB_3;
         memset(pvVar22,0,uVar21);
         if (uVar21 <= uVar24) {
           uVar24 = uVar21;
         }
         RtlCopyMemory(pvVar22,pvVar1,uVar24);
         ExFreePoolWithTag(pvVar1,0x72615452);
       }
       *(void **)(param_1 + 0x48) = pvVar22;
       iVar18 = 0;
       *(ulonglong *)(param_1 + 0x38) = uVar26;
     }
     else {
       iVar18 = -0x3fffff6b;
     }
 LAB_4:
     if (iVar18 != 0) {
       return iVar18;
     }
   }
   uVar24 = *(ulonglong *)(param_1 + 0x28);
   auVar2._8_8_ = 0;
   auVar2._0_8_ = uVar20;
   auVar10._8_8_ = 0;
   auVar10._0_8_ = uVar24;
   if ((((SUB168(auVar2 * auVar10,8) != 0) ||
        (puVar23 = (undefined8 *)
                   ((longlong)*(undefined8 **)(param_1 + 0x48) + SUB168(auVar2 * auVar10,0)),
        puVar23 < *(undefined8 **)(param_1 + 0x48))) ||
       (auVar3._8_8_ = 0, auVar3._0_8_ = uVar20 + 1, auVar11._8_8_ = 0, auVar11._0_8_ = uVar24,
       SUB168(auVar3 * auVar11,8) != 0)) ||
      (pvVar1 = (void *)((longlong)*(void **)(param_1 + 0x48) + SUB168(auVar3 * auVar11,0)),
      pvVar1 < *(void **)(param_1 + 0x48))) {
     return -0x3fffff6b;
   }
   auVar4._8_8_ = 0;
   auVar4._0_8_ = uVar24;
   auVar12._8_8_ = 0;
   auVar12._0_8_ = *(longlong *)(param_1 + 0x30) - uVar20;
   if (SUB168(auVar4 * auVar12,8) != 0) {
     return -0x7ffffff5;
   }
   RtlCopyMemory(pvVar1,puVar23,SUB168(auVar4 * auVar12,0));
   *puVar23 = param_2;
 LAB_2:
   *(longlong *)(param_1 + 0x30) = *(longlong *)(param_1 + 0x30) + 1;
   return 0;
 }

VrpPreOpenOrCreate

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type code,refcount,length,address,called
ratio 0.18
i_ratio 0.31
m_ratio 0.29
b_ratio 0.4
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name VrpPreOpenOrCreate VrpPreOpenOrCreate
fullname VrpPreOpenOrCreate VrpPreOpenOrCreate
refcount 3 2
length 1017 1106
called
Expand for full list:
CmAllocateExtraParameter
CmpFindExtraParameterInBlock
CmpFreeExtraParameter
EtwActivityIdControl
ExAllocatePool2
ExFreePoolWithTag
ObfDereferenceObject
ObfReferenceObjectWithTag
RtlInitUnicodeString
VrpBuildKeyPath
VrpTranslatePath__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
Expand for full list:
CmAllocateExtraParameter
CmpFindExtraParameterInBlock
CmpFreeExtraParameter
EtwActivityIdControl
ExAllocatePool2
ExFreePoolWithTag
ObfDereferenceObject
ObfReferenceObjectWithTag
RtlEqualUnicodeString
RtlInitUnicodeString
VrpBuildKeyPathVrpGetNextToken
VrpTranslatePath
__security_check_cookie
_tlgWriteTransfer_EtwWriteTransfer
calling VrpRegistryCallback VrpRegistryCallback
paramcount 0 0
address 1406cb4f0 1406cb8b0
sig undefined VrpPreOpenOrCreate(void) undefined VrpPreOpenOrCreate(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

VrpPreOpenOrCreate Called Diff

--- VrpPreOpenOrCreate called
+++ VrpPreOpenOrCreate called
@@ -8,0 +9 @@
+RtlEqualUnicodeString
@@ -10,0 +12 @@
+VrpGetNextToken

VrpPreOpenOrCreate Diff

--- VrpPreOpenOrCreate
+++ VrpPreOpenOrCreate
@@ -1,257 +1,271 @@
 
 void VrpPreOpenOrCreate(undefined8 *param_1,ushort *param_2)
 
 {
   ushort uVar1;
   ushort **ppuVar2;
   ushort *puVar3;
-  undefined4 *puVar4;
-  longlong lVar5;
+  longlong lVar4;
+  undefined4 *puVar5;
   code *pcVar6;
   undefined4 uVar7;
   undefined4 uVar8;
   undefined4 uVar9;
   undefined4 uVar10;
   uint uVar11;
-  int iVar12;
-  ushort **ppuVar13;
+  char cVar12;
+  int iVar13;
   ushort **ppuVar14;
   ushort **ppuVar15;
-  ulonglong uVar16;
-  ushort *puVar17;
-  undefined *puVar18;
+  ushort **ppuVar16;
+  ulonglong uVar17;
+  ushort *puVar18;
   undefined *puVar19;
-  ushort **ppuVar20;
-  undefined auStack_148 [8];
-  undefined auStack_140 [24];
+  undefined *puVar20;
+  undefined *puVar21;
+  ushort **ppuVar22;
+  undefined auStack_158 [8];
+  undefined auStack_150 [24];
+  undefined *local_138;
+  ushort **local_130;
   undefined *local_128;
-  ushort **local_120;
-  undefined *local_118;
-  uint *local_110;
-  int *local_108;
-  int local_f8;
-  uint local_f4;
-  ushort *local_f0;
-  ushort *local_e8;
-  undefined local_e0 [8];
-  undefined4 uStack_d8;
-  undefined4 uStack_d4;
-  undefined local_d0 [8];
-  undefined8 uStack_c8;
-  undefined local_c0 [8];
-  undefined4 uStack_b8;
-  undefined4 uStack_b4;
-  undefined local_b0 [16];
+  uint *local_120;
+  undefined8 *local_118;
+  undefined8 local_108;
+  uint local_100 [2];
+  ushort *local_f8;
+  undefined local_f0 [8];
+  undefined4 uStack_e8;
+  undefined4 uStack_e4;
+  ushort *local_e0;
+  undefined local_d8 [8];
+  undefined8 uStack_d0;
+  undefined local_c8 [16];
+  undefined local_b8 [8];
+  undefined4 uStack_b0;
+  undefined4 uStack_ac;
+  undefined local_a8 [16];
   undefined local_98 [32];
   uint *local_78;
   undefined8 local_70;
   undefined8 local_68;
   uint local_60;
   undefined4 local_5c;
   undefined *local_58;
   undefined8 local_50;
   ulonglong local_48;
   
-  puVar19 = auStack_148;
-  local_48 = __security_cookie ^ (ulonglong)auStack_148;
+  puVar21 = auStack_158;
+  puVar20 = auStack_158;
+  local_48 = __security_cookie ^ (ulonglong)auStack_158;
   ppuVar2 = (ushort **)*param_1;
-  ppuVar15 = (ushort **)0x0;
-  local_f4 = 0;
-  local_e8 = ppuVar2[1];
-  puVar17 = *ppuVar2;
-  ppuVar20 = (ushort **)0x0;
+  ppuVar16 = (ushort **)0x0;
+  local_100[0] = 0;
+  local_e0 = ppuVar2[1];
+  puVar18 = *ppuVar2;
+  ppuVar22 = (ushort **)0x0;
   puVar3 = ppuVar2[0xb];
-  local_f0 = (ushort *)0x0;
-  _local_e0 = ZEXT816(0);
-  _local_d0 = ZEXT816(0);
-  _local_c0 = ZEXT816(0);
-  local_b0 = ZEXT816(0);
-  EtwActivityIdControl(3,local_b0);
-  if (((*puVar17 == 0) || (uVar16 = 0, **(short **)(puVar17 + 4) != 0x5c)) &&
-     (uVar16 = -(ulonglong)(puVar3 != (ushort *)0x0) & (ulonglong)(puVar3 + 8),
-     puVar18 = auStack_148, puVar3 == (ushort *)0x0)) goto LAB_0;
-  iVar12 = VrpBuildKeyPath(uVar16,*ppuVar2,local_e0);
-  ppuVar14 = ppuVar15;
-  if (iVar12 < 0) {
+  local_f8 = (ushort *)0x0;
+  _local_f0 = ZEXT816(0);
+  _local_d8 = ZEXT816(0);
+  _local_b8 = ZEXT816(0);
+  local_a8 = ZEXT816(0);
+  EtwActivityIdControl(3,local_a8);
+  if (((*puVar18 == 0) || (uVar17 = 0, **(short **)(puVar18 + 4) != 0x5c)) &&
+     (uVar17 = -(ulonglong)(puVar3 != (ushort *)0x0) & (ulonglong)(puVar3 + 8),
+     puVar19 = auStack_158, puVar3 == (ushort *)0x0)) goto LAB_0;
+  iVar13 = VrpBuildKeyPath(uVar17,*ppuVar2,local_f0);
+  ppuVar14 = ppuVar16;
+  if (iVar13 < 0) {
 LAB_1:
-    if (iVar12 != -0x3ffffafd) goto LAB_2;
+    ppuVar22 = ppuVar16;
+    if (iVar13 != -0x3ffffafd) goto LAB_2;
 LAB_3:
+    puVar21 = puVar20;
+    ppuVar22 = ppuVar16;
     if (5 < DAT_4) {
-      puVar17 = &EmptyUnicodeString;
+      puVar18 = &EmptyUnicodeString;
       if (*(longlong *)(*ppuVar2 + 4) != 0) {
-        puVar17 = *ppuVar2;
-      }
-      uVar1 = *puVar17;
-      local_68 = *(undefined8 *)(puVar17 + 4);
-      puVar18 = &DAT_5;
-      *(undefined4 *)(puVar19 + 0x50) = 0xc0000503;
+        puVar18 = *ppuVar2;
+      }
+      uVar1 = *puVar18;
+      local_68 = *(undefined8 *)(puVar18 + 4);
+      puVar19 = &DAT_5;
+      *(undefined4 *)(puVar20 + 0x50) = 0xc0000503;
       goto LAB_6;
     }
   }
   else {
-    local_108 = &local_f8;
-    local_f8 = 0;
-    local_110 = &local_f4;
-    local_118 = local_c0;
-    local_120 = &local_f0;
-    local_128 = local_d0;
-    iVar12 = VrpTranslatePath(param_2,local_e8,puVar3,local_e0);
-    uVar11 = local_f4;
-    puVar18 = auStack_148;
-    if (iVar12 == -0x3fffffcc) goto LAB_0;
-    ppuVar14 = (ushort **)0x0;
-    if (iVar12 < 0) goto LAB_1;
-    if ((local_f4 & 4) == 0) {
-      local_f0[0x19] = local_e8[0x19];
-      ppuVar13 = (ushort **)ExAllocatePool2(0x100,0x48,0x67655256);
-      ppuVar14 = ppuVar15;
-      if (ppuVar13 != (ushort **)0x0) {
-        ppuVar2[10] = (ushort *)ppuVar13;
-        *ppuVar13 = ppuVar2[1];
-        puVar4 = (undefined4 *)*ppuVar2;
-        uVar7 = puVar4[1];
-        uVar8 = puVar4[2];
-        uVar9 = puVar4[3];
-        *(undefined4 *)(ppuVar13 + 2) = *puVar4;
-        *(undefined4 *)((longlong)ppuVar13 + 0x14) = uVar7;
-        *(undefined4 *)(ppuVar13 + 3) = uVar8;
-        *(undefined4 *)((longlong)ppuVar13 + 0x1c) = uVar9;
-        puVar4 = (undefined4 *)ppuVar2[0xe];
-        uVar7 = *puVar4;
-        uVar8 = puVar4[1];
-        uVar9 = puVar4[2];
-        uVar10 = puVar4[3];
-        *(undefined4 *)(ppuVar13 + 6) = local_e0._0_4_;
-        *(undefined4 *)((longlong)ppuVar13 + 0x34) = local_e0._4_4_;
-        *(undefined4 *)(ppuVar13 + 7) = uStack_d8;
-        *(undefined4 *)((longlong)ppuVar13 + 0x3c) = uStack_d4;
-        *(uint *)(ppuVar13 + 8) = uVar11;
-        *(undefined4 *)(ppuVar13 + 4) = uVar7;
-        *(undefined4 *)((longlong)ppuVar13 + 0x24) = uVar8;
-        *(undefined4 *)(ppuVar13 + 5) = uVar9;
-        *(undefined4 *)((longlong)ppuVar13 + 0x2c) = uVar10;
-        *(int *)(param_1 + 1) = local_f8;
-        ppuVar13[1] = param_2;
-        ppuVar2[1] = local_f0;
-        puVar4 = (undefined4 *)*ppuVar2;
-        *puVar4 = local_d0._0_4_;
-        puVar4[1] = local_d0._4_4_;
-        puVar4[2] = (undefined4)uStack_c8;
-        puVar4[3] = uStack_c8._4_4_;
-        puVar4 = (undefined4 *)ppuVar2[0xe];
-        *puVar4 = local_c0._0_4_;
-        puVar4[1] = local_c0._4_4_;
-        puVar4[2] = uStack_b8;
-        puVar4[3] = uStack_b4;
-        puVar18 = auStack_148;
-        goto LAB_0;
-      }
-    }
-    else {
-      ppuVar14 = (ushort **)CmAllocateExtraParameter();
-      ppuVar13 = ppuVar15;
-      if (ppuVar14 != (ushort **)0x0) {
-        ObfReferenceObjectWithTag(param_2,0x67655256);
-        *ppuVar14 = param_2;
-        *(uint *)(ppuVar14 + 1) = uVar11 & 0xfffffffb;
-        *(undefined4 *)(ppuVar14 + 2) = local_e0._0_4_;
-        *(undefined4 *)((longlong)ppuVar14 + 0x14) = local_e0._4_4_;
-        *(undefined4 *)(ppuVar14 + 3) = uStack_d8;
-        *(undefined4 *)((longlong)ppuVar14 + 0x1c) = uStack_d4;
-        RtlInitUnicodeString(local_e0,0);
-        puVar17 = (ushort *)param_1[2];
-        ppuVar13 = ppuVar14 + -6;
-        iVar12 = CmpFindExtraParameterInBlock(puVar17,ppuVar14 + -4,&local_e8);
-        if (iVar12 < 0) {
-          if (iVar12 != -0x3fffffcc) goto LAB_1;
-          ppuVar20 = *(ushort ***)(puVar17 + 4);
-          puVar19 = auStack_148;
-          if (*ppuVar20 != puVar17) {
-            puVar17 = (ushort *)0x3;
+    local_108 = 0;
+    local_c8 = ZEXT816(0);
+    VrpGetNextToken(local_f0,&local_108,local_c8);
+    cVar12 = RtlEqualUnicodeString(local_c8,&VrpRegistryString,1);
+    if (cVar12 == '\0') {
+LAB_7:
+      local_118 = &local_108;
+      local_120 = local_100;
+      local_108 = local_108 & 0xffffffff00000000;
+      local_128 = local_b8;
+      local_130 = &local_f8;
+      local_138 = local_d8;
+      iVar13 = VrpTranslatePath(param_2,local_e0,puVar3,local_f0);
+      uVar11 = local_100[0];
+      puVar19 = auStack_158;
+      if (iVar13 == -0x3fffffcc) goto LAB_0;
+      ppuVar14 = (ushort **)0x0;
+      if (iVar13 < 0) goto LAB_1;
+      if ((local_100[0] & 4) == 0) {
+        local_f8[0x19] = local_e0[0x19];
+        ppuVar15 = (ushort **)ExAllocatePool2(0x100,0x48,0x67655256);
+        ppuVar14 = ppuVar16;
+        if (ppuVar15 != (ushort **)0x0) {
+          ppuVar2[10] = (ushort *)ppuVar15;
+          *ppuVar15 = ppuVar2[1];
+          puVar5 = (undefined4 *)*ppuVar2;
+          uVar7 = puVar5[1];
+          uVar8 = puVar5[2];
+          uVar9 = puVar5[3];
+          *(undefined4 *)(ppuVar15 + 2) = *puVar5;
+          *(undefined4 *)((longlong)ppuVar15 + 0x14) = uVar7;
+          *(undefined4 *)(ppuVar15 + 3) = uVar8;
+          *(undefined4 *)((longlong)ppuVar15 + 0x1c) = uVar9;
+          puVar5 = (undefined4 *)ppuVar2[0xe];
+          uVar7 = *puVar5;
+          uVar8 = puVar5[1];
+          uVar9 = puVar5[2];
+          uVar10 = puVar5[3];
+          *(undefined4 *)(ppuVar15 + 6) = local_f0._0_4_;
+          *(undefined4 *)((longlong)ppuVar15 + 0x34) = local_f0._4_4_;
+          *(undefined4 *)(ppuVar15 + 7) = uStack_e8;
+          *(undefined4 *)((longlong)ppuVar15 + 0x3c) = uStack_e4;
+          *(uint *)(ppuVar15 + 8) = uVar11;
+          *(undefined4 *)(ppuVar15 + 4) = uVar7;
+          *(undefined4 *)((longlong)ppuVar15 + 0x24) = uVar8;
+          *(undefined4 *)(ppuVar15 + 5) = uVar9;
+          *(undefined4 *)((longlong)ppuVar15 + 0x2c) = uVar10;
+          *(undefined4 *)(param_1 + 1) = (undefined4)local_108;
+          ppuVar15[1] = param_2;
+          ppuVar2[1] = local_f8;
+          puVar5 = (undefined4 *)*ppuVar2;
+          *puVar5 = local_d8._0_4_;
+          puVar5[1] = local_d8._4_4_;
+          puVar5[2] = (undefined4)uStack_d0;
+          puVar5[3] = uStack_d0._4_4_;
+          puVar5 = (undefined4 *)ppuVar2[0xe];
+          *puVar5 = local_b8._0_4_;
+          puVar5[1] = local_b8._4_4_;
+          puVar5[2] = uStack_b0;
+          puVar5[3] = uStack_ac;
+          puVar19 = auStack_158;
+          goto LAB_0;
+        }
+      }
+      else {
+        ppuVar14 = (ushort **)CmAllocateExtraParameter();
+        ppuVar15 = ppuVar16;
+        if (ppuVar14 != (ushort **)0x0) {
+          ObfReferenceObjectWithTag(param_2,0x67655256);
+          *ppuVar14 = param_2;
+          *(uint *)(ppuVar14 + 1) = uVar11 & 0xfffffffb;
+          *(undefined4 *)(ppuVar14 + 2) = local_f0._0_4_;
+          *(undefined4 *)((longlong)ppuVar14 + 0x14) = local_f0._4_4_;
+          *(undefined4 *)(ppuVar14 + 3) = uStack_e8;
+          *(undefined4 *)((longlong)ppuVar14 + 0x1c) = uStack_e4;
+          RtlInitUnicodeString(local_f0,0);
+          puVar18 = (ushort *)param_1[2];
+          ppuVar15 = ppuVar14 + -6;
+          iVar13 = CmpFindExtraParameterInBlock(puVar18,ppuVar14 + -4,&local_e0);
+          if (-1 < iVar13) {
+            iVar13 = -0x3fffffcb;
+            goto LAB_2;
+          }
+          if (iVar13 != -0x3fffffcc) goto LAB_1;
+          ppuVar22 = *(ushort ***)(puVar18 + 4);
+          puVar20 = auStack_158;
+          if (*ppuVar22 != puVar18) {
+            puVar18 = (ushort *)0x3;
             pcVar6 = (code *)swi(0x29);
-            ppuVar20 = (ushort **)(*pcVar6)();
-            puVar19 = auStack_140;
+            ppuVar22 = (ushort **)(*pcVar6)();
+            puVar20 = auStack_150;
           }
-          *ppuVar13 = puVar17;
+          *ppuVar15 = puVar18;
           ppuVar14 = (ushort **)0x0;
-          ppuVar13[1] = (ushort *)ppuVar20;
-          *ppuVar20 = (ushort *)ppuVar13;
-          *(ushort ***)(puVar17 + 4) = ppuVar13;
-          lVar5 = *(longlong *)(*ppuVar2 + 4);
-          if (lVar5 != 0) {
-            *(undefined8 *)(puVar19 + -8) = 0x1408b7d76;
-            ExFreePoolWithTag(lVar5,0x67655256);
+          ppuVar15[1] = (ushort *)ppuVar22;
+          *ppuVar22 = (ushort *)ppuVar15;
+          *(ushort ***)(puVar18 + 4) = ppuVar15;
+          lVar4 = *(longlong *)(*ppuVar2 + 4);
+          if (lVar4 != 0) {
+            *(undefined8 *)(puVar20 + -8) = 0x1406cbc45;
+            ExFreePoolWithTag(lVar4,0x67655256);
           }
-          puVar4 = (undefined4 *)*ppuVar2;
-          uVar7 = *(undefined4 *)(puVar19 + 0x7c);
-          uVar8 = *(undefined4 *)(puVar19 + 0x80);
-          uVar9 = *(undefined4 *)(puVar19 + 0x84);
-          *puVar4 = *(undefined4 *)(puVar19 + 0x78);
-          puVar4[1] = uVar7;
-          puVar4[2] = uVar8;
-          puVar4[3] = uVar9;
-          *(undefined8 *)(puVar19 + -8) = 0x1408b7d8e;
-          RtlInitUnicodeString(puVar19 + 0x78,0);
+          puVar5 = (undefined4 *)*ppuVar2;
+          *puVar5 = local_d8._0_4_;
+          puVar5[1] = local_d8._4_4_;
+          puVar5[2] = (undefined4)uStack_d0;
+          puVar5[3] = uStack_d0._4_4_;
+          *(undefined8 *)(puVar20 + -8) = 0x1406cbc5b;
+          RtlInitUnicodeString(local_d8,0);
           *(undefined4 *)((longlong)param_1 + 0xc) = 0x368;
           goto LAB_3;
         }
-        iVar12 = -0x3fffffcb;
-        ppuVar20 = ppuVar15;
-        goto LAB_2;
-      }
-    }
-    iVar12 = -0x3fffff66;
-    ppuVar20 = ppuVar13;
+      }
+      iVar13 = -0x3fffff66;
+      ppuVar22 = ppuVar15;
+    }
+    else {
+      VrpGetNextToken(local_f0,&local_108,local_c8);
+      cVar12 = RtlEqualUnicodeString(local_c8,&VrpWcString,1);
+      if (cVar12 == '\0') goto LAB_7;
+      iVar13 = -0x3fffffde;
+    }
 LAB_2:
-    puVar19 = auStack_148;
-    ppuVar15 = ppuVar20;
     if (2 < DAT_4) {
-      puVar17 = &EmptyUnicodeString;
+      puVar18 = &EmptyUnicodeString;
       if (*(longlong *)(*ppuVar2 + 4) != 0) {
-        puVar17 = *ppuVar2;
-      }
-      uVar1 = *puVar17;
-      local_68 = *(undefined8 *)(puVar17 + 4);
-      puVar18 = &DAT_7;
-      puVar19 = auStack_148;
-      local_f8 = iVar12;
+        puVar18 = *ppuVar2;
+      }
+      uVar1 = *puVar18;
+      local_68 = *(undefined8 *)(puVar18 + 4);
+      puVar19 = &DAT_8;
+      local_108 = CONCAT44(local_108._4_4_,iVar13);
+      puVar21 = auStack_158;
 LAB_6:
       local_78 = &local_60;
       local_60 = (uint)uVar1;
-      local_58 = puVar19 + 0x50;
+      local_58 = puVar21 + 0x50;
       local_70 = 2;
-      *(undefined **)(puVar19 + 0x28) = local_98;
-      *(undefined4 *)(puVar19 + 0x20) = 5;
+      *(undefined **)(puVar21 + 0x28) = local_98;
+      *(undefined4 *)(puVar21 + 0x20) = 5;
       local_5c = 0;
       local_50 = 4;
-      *(undefined8 *)(puVar19 + -8) = 0x1408b7cce;
-      _tlgWriteTransfer_EtwWriteTransfer(&DAT_4,puVar18,local_b0,0);
-    }
-  }
-  if (ppuVar15 != (ushort **)0x0) {
-    *(undefined8 *)(puVar19 + -8) = 0x1408b7ce0;
-    ExFreePoolWithTag(ppuVar15,0x67655256);
-  }
-  if (uStack_c8 != 0) {
-    *(undefined8 *)(puVar19 + -8) = 0x1408b7cf3;
-    ExFreePoolWithTag(uStack_c8,0x67655256);
-  }
-  if (*(longlong *)(puVar19 + 0x58) != 0) {
-    *(undefined8 *)(puVar19 + -8) = 0x1408b7d02;
+      *(undefined8 *)(puVar21 + -8) = 0x1406cbaa9;
+      _tlgWriteTransfer_EtwWriteTransfer(&DAT_4,puVar19,local_a8,0);
+    }
+  }
+  if (ppuVar22 != (ushort **)0x0) {
+    *(undefined8 *)(puVar21 + -8) = 0x1406cbabb;
+    ExFreePoolWithTag(ppuVar22,0x67655256);
+  }
+  if (uStack_d0 != 0) {
+    *(undefined8 *)(puVar21 + -8) = 0x1406cbace;
+    ExFreePoolWithTag(uStack_d0,0x67655256);
+  }
+  if (*(longlong *)(puVar21 + 0x60) != 0) {
+    *(undefined8 *)(puVar21 + -8) = 0x1406cbadd;
     ObfDereferenceObject();
   }
-  if (*(longlong *)(puVar19 + 0x70) != 0) {
-    *(undefined8 *)(puVar19 + -8) = 0x1408b7d16;
-    ExFreePoolWithTag(*(longlong *)(puVar19 + 0x70),0x67655256);
-  }
-  puVar18 = puVar19;
+  if (*(longlong *)(puVar21 + 0x70) != 0) {
+    *(undefined8 *)(puVar21 + -8) = 0x1406cbaf1;
+    ExFreePoolWithTag(*(longlong *)(puVar21 + 0x70),0x67655256);
+  }
+  puVar19 = puVar21;
   if (ppuVar14 != (ushort **)0x0) {
-    *(undefined8 *)(puVar19 + -8) = 0x1408b7d28;
+    *(undefined8 *)(puVar21 + -8) = 0x1406cbaff;
     CmpFreeExtraParameter(ppuVar14 + -6);
   }
 LAB_0:
-  *(undefined8 *)(puVar18 + -8) = 0x1406cb6b5;
-  __security_check_cookie(local_48 ^ (ulonglong)puVar18);
+  *(undefined8 *)(puVar19 + -8) = 0x1406cbb0d;
+  __security_check_cookie(local_48 ^ (ulonglong)puVar19);
   return;
 }

VrpHandleIoctlInitializeJobForVreg

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type code,refcount,length,sig,address,called
ratio 0.12
i_ratio 0.13
m_ratio 0.18
b_ratio 0.66
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name VrpHandleIoctlInitializeJobForVreg VrpHandleIoctlInitializeJobForVreg
fullname VrpHandleIoctlInitializeJobForVreg VrpHandleIoctlInitializeJobForVreg
refcount 3 2
length 1328 863
called
Expand for full list:
CmGetRootKeyObjectForSilo
CmInitSiloNamespace
CmSetCallbackObjectContext
ExAllocatePool2
ExAllocatePoolWithTag
ExFreePoolWithTag
ExfAcquirePushLockExclusiveEx
ExfTryToWakePushLock
KeAbPostRelease
KeAbPreAcquire
KiLeaveCriticalRegionUnsafeObCreateObjectEx
ObfDereferenceObject
ObfDereferenceObjectWithTag
ObpReferenceObjectByHandleWithTag
PsGetJobSilo
PsInsertSiloContext
PsIsThreadInSilo
PsRemoveSiloContext
PspStorageMakeSlotReadOnly
RtlUnicodeStringCopy
VrpAddNamespaceNodeToList
VrpAllocateKeyContext
VrpCreateNamespaceNode
VrpDestroyNamespaceNode
VrpFreeKeyContext
VrpIncrementSiloCount
memset
Expand for full list:
CmGetRootKeyObjectForSilo
CmInitSiloNamespace
CmSetCallbackObjectContext
ExAllocatePool2
ExAllocatePoolWithTag
ExFreePoolWithTag
ObCreateObjectEx
ObfDereferenceObject
ObfDereferenceObjectWithTag
ObpReferenceObjectByHandleWithTag
PsGetJobSiloPsInsertSiloContext
PsIsThreadInSilo
PsRemoveSiloContext
PspStorageMakeSlotReadOnly
RtlUnicodeStringCopy
VrpAllocateKeyContext
VrpFreeKeyContext
VrpIncrementSiloCount
memset
calling VrpIoctlDeviceDispatch VrpIoctlDeviceDispatch
paramcount 6 6
address 1407598c8 14075a308
sig undefined VrpHandleIoctlInitializeJobForVreg(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined param_5, undefined8 param_6) undefined VrpHandleIoctlInitializeJobForVreg(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5, undefined8 param_6)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

VrpHandleIoctlInitializeJobForVreg Called Diff

--- VrpHandleIoctlInitializeJobForVreg called
+++ VrpHandleIoctlInitializeJobForVreg called
@@ -7,5 +6,0 @@
-ExfAcquirePushLockExclusiveEx
-ExfTryToWakePushLock
-KeAbPostRelease
-KeAbPreAcquire
-KiLeaveCriticalRegionUnsafe
@@ -22 +16,0 @@
-VrpAddNamespaceNodeToList
@@ -24,2 +17,0 @@
-VrpCreateNamespaceNode
-VrpDestroyNamespaceNode

VrpHandleIoctlInitializeJobForVreg Diff

--- VrpHandleIoctlInitializeJobForVreg
+++ VrpHandleIoctlInitializeJobForVreg
@@ -1,242 +1,152 @@
+
+/* WARNING: Removing unreachable block (ram,0x00014075a613) */
+/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
 
 int VrpHandleIoctlInitializeJobForVreg(undefined8 *param_1,uint param_2,undefined param_3)
 
 {
-  longlong *plVar1;
-  ulonglong uVar2;
+  undefined4 uVar1;
+  undefined4 uVar2;
   undefined4 uVar3;
   undefined4 uVar4;
-  undefined4 uVar5;
-  bool bVar6;
-  bool bVar7;
-  char cVar8;
-  int iVar9;
+  bool bVar5;
+  undefined4 *puVar6;
+  char cVar7;
+  int iVar8;
+  size_t _Size;
+  void *_Dst;
+  undefined4 *puVar9;
   longlong lVar10;
   undefined4 *puVar11;
   undefined4 *puVar12;
-  void *_Dst;
   undefined4 *puVar13;
   undefined4 *puVar14;
   undefined4 *puVar15;
-  ulonglong *puVar16;
-  undefined4 *puVar17;
-  undefined4 *puVar18;
-  undefined4 *param_6;
-  undefined8 in_stack_ffffffffffffff60;
-  undefined4 uVar19;
-  undefined4 *local_78;
-  longlong local_70;
-  longlong local_68;
-  longlong local_60;
-  longlong local_58;
+  undefined4 *param_5;
+  longlong param_6;
   
-  puVar14 = (undefined4 *)0x0;
-  local_68 = 0;
-  param_6 = (undefined4 *)0x0;
-  puVar18 = (undefined4 *)0x0;
-  bVar6 = false;
+  puVar9 = (undefined4 *)0x0;
+  param_6 = 0;
+  puVar12 = (undefined4 *)0x0;
+  bVar5 = false;
   puVar15 = (undefined4 *)0x0;
-  bVar7 = false;
-  local_78 = (undefined4 *)0x0;
-  local_70 = 0;
+  param_5 = (undefined4 *)0x0;
+  puVar13 = (undefined4 *)0x0;
   if (param_2 < 8) {
 LAB_0:
-    iVar9 = -0x3ffffff3;
-    puVar13 = param_6;
+    iVar8 = -0x3ffffff3;
+    puVar11 = puVar9;
     goto LAB_1;
   }
-  uVar19 = (undefined4)((ulonglong)in_stack_ffffffffffffff60 >> 0x20);
-  iVar9 = ObCreateObjectEx(0,VrpJobContextType,0,1);
-  puVar13 = param_6;
-  puVar17 = puVar14;
-  if (iVar9 < 0) {
-LAB_2:
-    bVar6 = false;
-    puVar13 = param_6;
-    puVar12 = puVar15;
-    puVar11 = puVar18;
-  }
-  else {
-    memset(param_6,0,0x60);
-    *(undefined8 *)(puVar13 + 4) = 0;
-    *(undefined (*) [16])(puVar13 + 8) = ZEXT816(0);
-    *(undefined (*) [16])(puVar13 + 0xc) = ZEXT816(0);
-    *(undefined (*) [16])(puVar13 + 0x10) = ZEXT816(0);
-    *(undefined8 *)(puVar13 + 8) = 0;
-    local_60 = SUB168(ZEXT816(8) * ZEXT816(0),8);
-    *(undefined8 *)(puVar13 + 0x10) = 0x10;
-    *(undefined8 *)(puVar13 + 0xc) = 0;
-    *(undefined8 *)(puVar13 + 0xe) = 0;
-    *(undefined8 *)(puVar13 + 0x12) = 0;
-    *(undefined8 *)(puVar13 + 10) = 8;
-    if (local_60 == 0) {
-      local_58 = SUB168(ZEXT816(8) * ZEXT816(0x20),8);
-      if (local_58 == 0) {
-        _Dst = (void *)ExAllocatePoolWithTag(1);
-        if (_Dst != (void *)0x0) {
-          memset(_Dst,0,SUB168(ZEXT816(8) * ZEXT816(0x20),0));
+  iVar8 = ObCreateObjectEx(0,VrpJobContextType,0,1);
+  puVar6 = puVar12;
+  puVar14 = puVar13;
+  puVar11 = puVar15;
+  if (-1 < iVar8) {
+    memset((void *)0x0,0,0x60);
+    _DAT_2 = 0;
+    auRam0000000000000030 = ZEXT816(0);
+    auRam0000000000000040 = ZEXT816(0x10);
+    _DAT_3 = ZEXT816(8) << 0x40;
+    if (SUB168(ZEXT816(8) * ZEXT816(0),8) == 0) {
+      _Size = SUB168(ZEXT816(8) * ZEXT816(0x20),0);
+      if (SUB168(ZEXT816(8) * ZEXT816(0x20),8) != 0) {
+        iVar8 = -0x3fffff6b;
+        goto LAB_4;
+      }
+      _Dst = (void *)ExAllocatePoolWithTag(1,_Size,0x72615452);
+      if (_Dst == (void *)0x0) {
+        iVar8 = -0x3fffffe9;
+        goto LAB_4;
+      }
+      memset(_Dst,0,_Size);
+      _DAT_5 = (longlong)_Dst;
+      _DAT_6 = 0x20;
+    }
+    else {
+      iVar8 = -0x3fffff6b;
+LAB_4:
+      if (_DAT_5 != 0) {
+        ExFreePoolWithTag(_DAT_5,0x72615452);
+      }
+      _DAT_3 = ZEXT816(0);
+      auRam0000000000000030 = ZEXT816(0);
+      auRam0000000000000040 = ZEXT816(0);
+      puVar6 = puVar9;
+      puVar14 = puVar9;
+      puVar11 = puVar9;
+      if (iVar8 < 0) goto LAB_7;
+    }
+    iVar8 = VrpIncrementSiloCount();
+    puVar6 = puVar12;
+    puVar14 = puVar13;
+    puVar11 = puVar15;
+    if (-1 < iVar8) {
+      uRam0000000000000058 = 1;
+      iVar8 = ObpReferenceObjectByHandleWithTag
+                        (*param_1,6,PsJobType,param_3,0x52566d43,&stack0x00000030,0,0);
+      if ((-1 < iVar8) &&
+         (iVar8 = PsGetJobSilo(param_6,&stack0x00000028), puVar14 = param_5, -1 < iVar8)) {
+        cVar7 = PsIsThreadInSilo(SystemReserved1[15],param_5);
+        if (cVar7 != '\0') goto LAB_0;
+        uRam0000000000000000 = puVar14[0x16a];
+        _DAT_8 = puVar14[0x16b];
+        _DAT_9 = puVar14[0x16c];
+        uRam000000000000000c = puVar14[0x16d];
+        puVar9 = (undefined4 *)VrpAllocateKeyContext(0);
+        if (puVar9 != (undefined4 *)0x0) {
+          uVar1 = puVar14[0x16a];
+          uVar2 = puVar14[0x16b];
+          uVar3 = puVar14[0x16c];
+          uVar4 = puVar14[0x16d];
+          *(undefined2 *)(puVar9 + 8) = 1;
+          *puVar9 = uVar1;
+          puVar9[1] = uVar2;
+          puVar9[2] = uVar3;
+          puVar9[3] = uVar4;
+          lVar10 = ExAllocatePool2(0x100,CmRegistryRootName,0x67655256);
+          *(longlong *)(puVar9 + 6) = lVar10;
+          if (lVar10 != 0) {
+            *(undefined2 *)(puVar9 + 4) = 0;
+            *(undefined2 *)((longlong)puVar9 + 0x12) = CmRegistryRootName;
+            RtlUnicodeStringCopy(puVar9 + 4,&CmRegistryRootName);
+            iVar8 = CmInitSiloNamespace();
+            puVar6 = puVar9;
+            if ((-1 < iVar8) &&
+               (iVar8 = PsInsertSiloContext(puVar14,VrpSiloContextSlot,0), -1 < iVar8)) {
+              bVar5 = true;
+              puVar11 = (undefined4 *)CmGetRootKeyObjectForSilo(puVar14);
+              iVar8 = CmSetCallbackObjectContext(puVar11,&VrpCallbackCookie,puVar9,0);
+              if (-1 < iVar8) {
+                puVar9 = (undefined4 *)0x0;
+                PspStorageMakeSlotReadOnly(*(undefined8 *)(puVar14 + 0x17a),VrpSiloContextSlot);
+                iVar8 = 0;
+                goto LAB_1;
+              }
+            }
+            goto LAB_7;
+          }
         }
-        iVar9 = 0;
-        if (_Dst == (void *)0x0) {
-          iVar9 = -0x3fffffe9;
-        }
-        else {
-          *(void **)(puVar13 + 0x12) = _Dst;
-          *(undefined8 *)(puVar13 + 0xe) = 0x20;
-        }
-      }
-      else {
-        iVar9 = -0x3fffff6b;
+        iVar8 = -0x3fffff66;
+        goto LAB_1;
       }
     }
-    else {
-      iVar9 = -0x3fffff6b;
-    }
-    if (iVar9 == 0) {
-LAB_3:
-      iVar9 = VrpIncrementSiloCount();
-      puVar12 = puVar15;
-      puVar17 = (undefined4 *)0x0;
-      puVar11 = puVar18;
-      if (-1 < iVar9) {
-        puVar13[0x16] = 1;
-        puVar16 = (ulonglong *)(param_6 + 4);
-        *(short *)((longlong)SystemReserved1[15] + 0x1e4) =
-             *(short *)((longlong)SystemReserved1[15] + 0x1e4) + -1;
-        lVar10 = KeAbPreAcquire(puVar16,0);
-        LOCK();
-        uVar2 = *puVar16;
-        *puVar16 = *puVar16 | 1;
-        UNLOCK();
-        if ((uVar2 & 1) != 0) {
-          ExfAcquirePushLockExclusiveEx(puVar16,lVar10);
-        }
-        puVar13 = param_6;
-        if (lVar10 != 0) {
-          *(undefined *)(lVar10 + 0x12) = 1;
-        }
-        bVar6 = true;
-        iVar9 = VrpCreateNamespaceNode
-                          (param_6,&CmRegistryContainersName,0,&CmRegistryContainersName,0,
-                           CONCAT44(uVar19,0xffffffff),&local_70);
-        puVar17 = local_78;
-        if ((-1 < iVar9) &&
-           (iVar9 = VrpAddNamespaceNodeToList(puVar13,local_70), puVar17 = local_78, -1 < iVar9)) {
-          local_70 = 0;
-          LOCK();
-          uVar2 = *puVar16;
-          *puVar16 = *puVar16 - 1;
-          UNLOCK();
-          if (((uVar2 & 2) != 0) && ((uVar2 & 4) == 0)) {
-            ExfTryToWakePushLock(puVar16);
-          }
-          KeAbPostRelease(puVar16);
-          KiLeaveCriticalRegionUnsafe(SystemReserved1[15]);
-          bVar6 = false;
-          iVar9 = ObpReferenceObjectByHandleWithTag
-                            (*param_1,6,PsJobType,param_3,0x52566d43,&local_68,0,0);
-          puVar17 = local_78;
-          if ((-1 < iVar9) &&
-             (iVar9 = PsGetJobSilo(local_68,&local_78), puVar17 = local_78, -1 < iVar9)) {
-            cVar8 = PsIsThreadInSilo(SystemReserved1[15],local_78);
-            puVar13 = param_6;
-            if (cVar8 != '\0') goto LAB_0;
-            uVar19 = puVar17[0x16b];
-            uVar3 = puVar17[0x16c];
-            uVar4 = puVar17[0x16d];
-            *param_6 = puVar17[0x16a];
-            param_6[1] = uVar19;
-            param_6[2] = uVar3;
-            param_6[3] = uVar4;
-            puVar11 = (undefined4 *)VrpAllocateKeyContext(param_6);
-            if (puVar11 != (undefined4 *)0x0) {
-              uVar19 = puVar17[0x16a];
-              uVar3 = puVar17[0x16b];
-              uVar4 = puVar17[0x16c];
-              uVar5 = puVar17[0x16d];
-              *(undefined2 *)(puVar11 + 8) = 1;
-              *puVar11 = uVar19;
-              puVar11[1] = uVar3;
-              puVar11[2] = uVar4;
-              puVar11[3] = uVar5;
-              lVar10 = ExAllocatePool2(0x100,CmRegistryRootName);
-              *(longlong *)(puVar11 + 6) = lVar10;
-              if (lVar10 != 0) {
-                *(undefined2 *)(puVar11 + 4) = 0;
-                *(undefined2 *)((longlong)puVar11 + 0x12) = CmRegistryRootName;
-                RtlUnicodeStringCopy(puVar11 + 4,&CmRegistryRootName);
-                iVar9 = CmInitSiloNamespace(puVar17);
-                if ((-1 < iVar9) &&
-                   (iVar9 = PsInsertSiloContext(puVar17,VrpSiloContextSlot), -1 < iVar9)) {
-                  bVar7 = true;
-                  puVar12 = (undefined4 *)CmGetRootKeyObjectForSilo(puVar17);
-                  iVar9 = CmSetCallbackObjectContext(puVar12,&VrpCallbackCookie,puVar11,0);
-                  if (-1 < iVar9) {
-                    PspStorageMakeSlotReadOnly(*(undefined8 *)(puVar17 + 0x17a),VrpSiloContextSlot);
-                    iVar9 = 0;
-                    puVar11 = (undefined4 *)0x0;
-                  }
-                }
-                goto LAB_4;
-              }
-            }
-            iVar9 = -0x3fffff66;
-            puVar15 = puVar14;
-            puVar14 = puVar11;
-            goto LAB_1;
-          }
-          goto LAB_2;
-        }
-      }
-    }
-    else {
-      if (*(longlong *)(puVar13 + 0x12) != 0) {
-        ExFreePoolWithTag(*(longlong *)(puVar13 + 0x12),0x72615452);
-      }
-      *(undefined (*) [16])(puVar13 + 8) = ZEXT816(0);
-      *(undefined (*) [16])(puVar13 + 0xc) = ZEXT816(0);
-      *(undefined (*) [16])(puVar13 + 0x10) = ZEXT816(0);
-      puVar12 = puVar14;
-      puVar11 = puVar14;
-      if (-1 < iVar9) goto LAB_3;
-    }
   }
-LAB_4:
-  if (local_70 != 0) {
-    VrpDestroyNamespaceNode(puVar13);
-  }
-  if (bVar6) {
-    LOCK();
-    plVar1 = (longlong *)(puVar13 + 4);
-    lVar10 = *plVar1;
-    *plVar1 = *plVar1 + -1;
-    UNLOCK();
-    if (((byte)lVar10 & 6) == 2) {
-      ExfTryToWakePushLock(puVar13 + 4);
-    }
-    KeAbPostRelease(puVar13 + 4);
-    KiLeaveCriticalRegionUnsafe(SystemReserved1[15]);
-    puVar13 = param_6;
-    puVar17 = local_78;
-  }
-  puVar15 = puVar12;
-  puVar14 = puVar11;
-  if ((iVar9 < 0) && (bVar7)) {
-    PsRemoveSiloContext(puVar17,VrpSiloContextSlot,0);
+LAB_7:
+  puVar9 = puVar6;
+  if ((iVar8 < 0) && (bVar5)) {
+    PsRemoveSiloContext(puVar14,VrpSiloContextSlot,0);
   }
 LAB_1:
-  if (puVar13 != (undefined4 *)0x0) {
-    ObfDereferenceObjectWithTag(puVar13,0x67655256);
+  if (puVar11 != (undefined4 *)0x0) {
+    ObfDereferenceObject(puVar11);
   }
-  if (puVar15 != (undefined4 *)0x0) {
-    ObfDereferenceObject(puVar15);
+  if (puVar9 != (undefined4 *)0x0) {
+    VrpFreeKeyContext(puVar9);
   }
-  if (puVar14 != (undefined4 *)0x0) {
-    VrpFreeKeyContext(puVar14);
+  if (param_6 != 0) {
+    ObfDereferenceObjectWithTag(param_6,0x52566d43);
   }
-  if (local_68 != 0) {
-    ObfDereferenceObjectWithTag(local_68,0x52566d43);
-  }
-  return iVar9;
+  return iVar8;
 }

KiIpiProcessRequests

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type code,length,address
ratio 0.6
i_ratio 0.73
m_ratio 0.96
b_ratio 0.96
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name KiIpiProcessRequests KiIpiProcessRequests
fullname KiIpiProcessRequests KiIpiProcessRequests
refcount 4 4
length 829 801
called EtwGetKernelTraceTimestampSilo
KiFlushRangeTb
KiSetUserTbFlushPending
PerfInfoLogIpiReceive
__security_check_cookie
_guard_dispatch_icall		 EtwGetKernelTraceTimestampSilo
KiFlushRangeTb
KiSetUserTbFlushPending
PerfInfoLogIpiReceive
__security_check_cookie
_guard_dispatch_icall
calling KiIpiInterruptSubDispatch KiIpiInterruptSubDispatch
paramcount 0 0
address 1402c0870 1402c0610
sig undefined KiIpiProcessRequests(void) undefined KiIpiProcessRequests(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

KiIpiProcessRequests Diff

--- KiIpiProcessRequests
+++ KiIpiProcessRequests
@@ -1,164 +1,156 @@
 
+/* WARNING: Control flow encountered bad instruction data */
 /* WARNING: Function: _guard_dispatch_icall replaced with injection: guard_dispatch_icall */
-/* WARNING: Control flow encountered bad instruction data */
 
 void KiIpiProcessRequests(void)
 
 {
-  undefined8 *puVar1;
-  int iVar2;
-  undefined4 uVar3;
-  char **ppcVar4;
-  int *piVar5;
-  longlong lVar6;
-  code *pcVar7;
-  undefined auVar8 [16];
-  void *pvVar9;
-  char cVar10;
-  uint uVar11;
+  uint uVar1;
+  undefined8 *puVar2;
+  int iVar3;
+  undefined4 uVar4;
+  char **ppcVar5;
+  int *piVar6;
+  longlong lVar7;
+  code *pcVar8;
+  undefined auVar9 [16];
+  void *pvVar10;
+  char cVar11;
+  char *pcVar12;
   longlong *plVar13;
   char *pcVar14;
   char **ppcVar15;
   uint uVar16;
   undefined8 *puVar17;
   bool bVar18;
-  undefined auStack_a8 [8];
-  char **ppcStack_a0;
+  undefined auStack_a8 [48];
   longlong local_78;
   char *local_70;
   undefined8 local_68;
   longlong lStack_60;
   undefined local_58 [16];
   undefined local_48 [16];
   ulonglong local_38;
-  char *pcVar12;
   
-  pvVar9 = FiberData;
+  pvVar10 = FiberData;
   local_38 = __security_cookie ^ (ulonglong)auStack_a8;
   if (*(longlong *)((longlong)FiberData + 0x9340) != 0) {
     LOCK();
     ppcVar15 = *(char ***)(char **)((longlong)FiberData + 0x9340);
     *(char **)((longlong)FiberData + 0x9340) = (char *)0x0;
     UNLOCK();
     while (ppcVar15 != (char **)0x0) {
       do {
         local_70 = (char *)0x0;
-        ppcVar4 = (char **)*ppcVar15;
+        ppcVar5 = (char **)*ppcVar15;
         bVar18 = (DAT_0 & 0x400000) != 0;
         local_58 = ZEXT816(0);
         local_48 = ZEXT816(0);
         local_78 = (&KiProcessorBlock)
-                   [(longlong)((longlong)ppcVar15 + (-0xbec0 - (longlong)pvVar9)) >> 6 & 0xffffffff]
-        ;
+                   [(longlong)((longlong)ppcVar15 + (-0xbec0 - (longlong)pvVar10)) >> 6 & 0xffffffff
+                   ];
         if (bVar18) {
           EtwGetKernelTraceTimestampSilo(local_58,0x40400000,0);
         }
         pcVar14 = ppcVar15[1];
         uVar16 = (uint)pcVar14 & 0xf;
         if (uVar16 == 5) {
           (*(code *)ppcVar15[5])(local_78,ppcVar15[2],ppcVar15[3]);
           pcVar14 = ppcVar15[5];
         }
         else {
-          uVar11 = uVar16 - 1;
-          pcVar12 = (char *)(ulonglong)uVar11;
-          if (6 < uVar11) {
-            pcVar7 = (code *)swi(0x29);
-            pcVar12 = local_70;
-            (*pcVar7)(0x25);
-            *(uint *)((longlong)ppcStack_a0 * 2) = *(uint *)((longlong)ppcStack_a0 * 2) | uVar16;
-            *pcVar12 = *pcVar12 + (char)ppcStack_a0;
-            *(char *)ppcStack_a0 = *(char *)ppcStack_a0 + (char)ppcStack_a0;
-            pcVar12 = (char *)((ulonglong)uVar16 + 10);
-            *pcVar12 = *pcVar12 + (char)((ulonglong)pcVar14 >> 8);
-            pcVar7 = (code *)swi(3);
-            ppcStack_a0 = ppcVar4;
-            (*pcVar7)();
-            return;
+          uVar1 = uVar16 - 1;
+          pcVar12 = (char *)(ulonglong)uVar1;
+          if (6 < uVar1) {
+            pcVar8 = (code *)swi(0x29);
+            (*pcVar8)(0x25,pcVar14,local_70);
+            in((short)pcVar14);
+                    /* WARNING: Bad instruction - Truncating control flow here */
+            halt_baddata();
           }
           plVar13 = (longlong *)((longlong)pcVar14 >> 7);
           pcVar14 = local_70;
           switch(pcVar12) {
           case (char *)0x1:
-            lVar6 = *plVar13;
+            lVar7 = *plVar13;
             if ((((1 << ((byte)*(undefined4 *)(plVar13 + 1) & 0x1f) & 10U) != 0) &&
                 (KiFlushPcid != 0)) &&
                (*(char *)(*(longlong *)((longlong)SystemReserved1[15] + 0xb8) + 0x390) == '\0')) {
               if ((KiFlushPcid & 2) == 0) {
                 KiSetUserTbFlushPending();
               }
               else {
                 local_68 = 1;
-                auVar8._8_8_ = lVar6;
-                auVar8._0_8_ = 1;
-                invpcid(auStack_a8,auVar8);
-                lStack_60 = lVar6;
+                auVar9._8_8_ = lVar7;
+                auVar9._0_8_ = 1;
+                invpcid(auStack_a8,auVar9);
+                lStack_60 = lVar7;
               }
             }
-            invlpg(lVar6);
+            invlpg(lVar7);
             pcVar14 = local_70;
             break;
           case (char *)0x2:
             if ((KiFlushPcid != 0) &&
                (*(char *)(*(longlong *)((longlong)SystemReserved1[15] + 0xb8) + 0x390) == '\0')) {
               KiSetUserTbFlushPending();
               pcVar14 = local_70;
             }
             break;
           case (char *)0x3:
             puVar17 = (undefined8 *)*plVar13;
-            uVar3 = *(undefined4 *)((longlong)plVar13 + 0xc);
-            puVar1 = puVar17 + *(uint *)(plVar13 + 1);
+            uVar4 = *(undefined4 *)((longlong)plVar13 + 0xc);
+            puVar2 = puVar17 + *(uint *)(plVar13 + 1);
             do {
-              KiFlushRangeTb(*puVar17,uVar3);
+              KiFlushRangeTb(*puVar17,uVar4);
               puVar17 = puVar17 + 1;
               pcVar14 = local_70;
-            } while (puVar17 < puVar1);
+            } while (puVar17 < puVar2);
             break;
           case (char *)0x4:
-            cVar10 = (char)uVar11;
-            *(char *)ppcVar4 = *(char *)ppcVar4 + cVar10;
-            *pcVar12 = *pcVar12 + cVar10;
-            *(char *)((longlong)pcVar12 * 2) = *(char *)((longlong)pcVar12 * 2) + cVar10;
-            *pcVar12 = *pcVar12 + cVar10;
+            cVar11 = (char)uVar1;
+            *(char *)ppcVar5 = *(char *)ppcVar5 + cVar11;
+            *pcVar12 = *pcVar12 + cVar11;
+            *(char *)((longlong)pcVar12 * 2) = *(char *)((longlong)pcVar12 * 2) + cVar11;
+            *pcVar12 = *pcVar12 + cVar11;
                     /* WARNING: Bad instruction - Truncating control flow here */
             halt_baddata();
           case (char *)0x5:
           }
         }
-        piVar5 = (int *)ppcVar15[6];
+        piVar6 = (int *)ppcVar15[6];
         LOCK();
-        iVar2 = *piVar5;
-        *piVar5 = *piVar5 + -1;
+        iVar3 = *piVar6;
+        *piVar6 = *piVar6 + -1;
         UNLOCK();
-        if (iVar2 == 1) {
+        if (iVar3 == 1) {
           LOCK();
-          piVar5 = (int *)(local_78 + 0x2d84);
-          iVar2 = *piVar5;
-          *piVar5 = *piVar5 + -1;
+          piVar6 = (int *)(local_78 + 0x2d84);
+          iVar3 = *piVar6;
+          *piVar6 = *piVar6 + -1;
           UNLOCK();
-          if (iVar2 == 1) {
+          if (iVar3 == 1) {
             *(undefined4 *)(local_78 + 0x2d80) = 0;
           }
         }
         if (bVar18) {
-          PerfInfoLogIpiReceive(local_58,(ulonglong)uVar16,pcVar14);
+          PerfInfoLogIpiReceive(local_58,uVar16,pcVar14);
         }
-        if (*(longlong *)((longlong)pvVar9 + 35000) != 0) {
+        if (*(longlong *)((longlong)pvVar10 + 35000) != 0) {
           LOCK();
-          piVar5 = (int *)(*(longlong *)((longlong)pvVar9 + 35000) + 0x20);
-          *piVar5 = *piVar5 + -1;
+          piVar6 = (int *)(*(longlong *)((longlong)pvVar10 + 35000) + 0x20);
+          *piVar6 = *piVar6 + -1;
           UNLOCK();
         }
-        ppcVar15 = ppcVar4;
-      } while (ppcVar4 != (char **)0x0);
+        ppcVar15 = ppcVar5;
+      } while (ppcVar5 != (char **)0x0);
       LOCK();
-      ppcVar15 = *(char ***)(char **)((longlong)pvVar9 + 0x9340);
-      *(char **)((longlong)pvVar9 + 0x9340) = (char *)0x0;
+      ppcVar15 = *(char ***)(char **)((longlong)pvVar10 + 0x9340);
+      *(char **)((longlong)pvVar10 + 0x9340) = (char *)0x0;
       UNLOCK();
     }
   }
   __security_check_cookie(local_38 ^ (ulonglong)auStack_a8);
   return;
 }

NtSetInformationWorkerFactory

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type code,length,address
ratio 0.33
i_ratio 0.66
m_ratio 0.98
b_ratio 0.98
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name NtSetInformationWorkerFactory NtSetInformationWorkerFactory
fullname NtSetInformationWorkerFactory NtSetInformationWorkerFactory
refcount 3 3
length 4050 3986
called
Expand for full list:
ExRaiseDatatypeMisalignment
ExpLeaveWorkerFactoryAwayMode
ExpRemoveCurrentThreadFromThreadHistory
ExpTryEnterWorkerFactoryAwayMode
ExpWorkerFactoryCheckCreate
ExpWorkerFactoryCreateThread
KeAcquireInStackQueuedSpinLock
KeAreAllApcsDisabled
KeBugCheckEx
KeSetTimer2
KeTimeOutQueueWaitersKiAcquireQueuedSpinLockInstrumented
KiHaltOnAddressWakeEntireList
KiReleaseQueuedSpinLockInstrumented
KiRemoveSystemWorkPriorityKick
KiValidateCpuSetMasks
KxReleaseQueuedSpinLock
KxWaitForLockChainValid
KxWaitForLockOwnerShip
OBJECT_HEADER_TO_HANDLE_REVOCATION_INFO
ObReferenceObjectByHandle
ObfDereferenceObjectWithTag
ObpDeferObjectDeletion
ObpDeregisterObject
ObpHandleRevocationBlockRemoveObject
ObpPushStackInfo
ObpRemoveObjectRoutine
RtlCopyMemory
__security_check_cookie
memset
Expand for full list:
ExRaiseDatatypeMisalignment
ExpLeaveWorkerFactoryAwayMode
ExpRemoveCurrentThreadFromThreadHistory
ExpTryEnterWorkerFactoryAwayMode
ExpWorkerFactoryCheckCreate
ExpWorkerFactoryCreateThread
KeAcquireInStackQueuedSpinLock
KeAreAllApcsDisabled
KeBugCheckEx
KeSetTimer2
KeTimeOutQueueWaitersKiAcquireQueuedSpinLockInstrumented
KiHaltOnAddressWakeEntireList
KiReleaseQueuedSpinLockInstrumented
KiRemoveSystemWorkPriorityKick
KiValidateCpuSetMasks
KxReleaseQueuedSpinLock
KxWaitForLockChainValid
KxWaitForLockOwnerShip
OBJECT_HEADER_TO_HANDLE_REVOCATION_INFO
ObReferenceObjectByHandle
ObfDereferenceObjectWithTag
ObpDeferObjectDeletion
ObpDeregisterObject
ObpHandleRevocationBlockRemoveObject
ObpPushStackInfo
ObpRemoveObjectRoutine
RtlCopyMemory
__security_check_cookie
memset
calling
paramcount 0 0
address 140271930 1402716d0
sig undefined NtSetInformationWorkerFactory(void) undefined NtSetInformationWorkerFactory(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

NtSetInformationWorkerFactory Diff

--- NtSetInformationWorkerFactory
+++ NtSetInformationWorkerFactory
@@ -1,724 +1,683 @@
 
 /* WARNING: Control flow encountered bad instruction data */
-/* WARNING: Removing unreachable block (ram,0x0001404898c4) */
+/* WARNING: Removing unreachable block (ram,0x000140489918) */
 
 void NtSetInformationWorkerFactory(undefined8 param_1,int param_2,undefined8 *param_3,uint param_4)
 
 {
   uint *puVar1;
   int *piVar2;
-  byte *pbVar3;
-  longlong lVar4;
-  undefined8 uVar5;
-  code *pcVar6;
-  void *pvVar7;
-  char cVar8;
-  uint uVar9;
-  int iVar10;
+  longlong lVar3;
+  byte bVar4;
+  uint uVar5;
+  undefined8 uVar6;
+  undefined8 uVar7;
+  code *pcVar8;
+  void *pvVar9;
+  char cVar10;
   uint uVar11;
-  byte bVar18;
-  undefined8 *puVar12;
-  undefined4 *puVar13;
-  char *pcVar14;
-  undefined8 uVar15;
-  byte bVar19;
-  undefined6 uVar22;
+  int iVar12;
+  uint uVar13;
+  undefined8 *puVar14;
+  undefined4 *puVar15;
   char *pcVar16;
-  char cVar21;
   longlong lVar17;
-  byte bVar23;
-  undefined *puVar24;
-  undefined *puVar25;
-  undefined4 *puVar26;
-  longlong unaff_RBP;
-  longlong lVar27;
-  uint uVar28;
-  longlong *plVar29;
-  bool bVar30;
+  undefined2 uVar18;
+  char *pcVar19;
+  undefined *puVar20;
+  undefined *puVar21;
+  undefined4 *puVar22;
+  longlong lVar23;
+  char cVar24;
+  uint uVar25;
+  longlong *plVar26;
   byte in_CR8;
-  byte bVar31;
-  ulonglong uVar32;
+  byte bVar27;
+  ulonglong uVar28;
   undefined local_1d8 [8];
   undefined auStack_1d0 [72];
   uint local_188;
   undefined local_180 [16];
   undefined8 local_170;
   undefined local_160 [16];
   uint local_148;
   uint uStack_144;
   uint uStack_140;
   uint uStack_13c;
   ulonglong local_48;
-  byte bVar20;
   
-  puVar24 = local_1d8;
-  puVar25 = local_1d8;
-  puVar26 = (undefined4 *)local_1d8;
+  puVar20 = local_1d8;
+  puVar21 = local_1d8;
+  puVar22 = (undefined4 *)local_1d8;
   local_48 = __security_cookie ^ (ulonglong)local_1d8;
-  pcVar16 = (char *)(ulonglong)param_4;
+  pcVar19 = (char *)(ulonglong)param_4;
   local_180 = ZEXT816(0);
   local_170 = 0;
   local_160 = ZEXT816(0);
-  cVar8 = *(char *)((longlong)SystemReserved1[15] + 0x232);
+  cVar10 = *(char *)((longlong)SystemReserved1[15] + 0x232);
   memset(&local_148,0,0x100);
   switch(param_2) {
   case 0:
   case 1:
   case 7:
   case 9:
     goto LAB_0;
   case 2:
     local_188 = 8;
     break;
   default:
     local_188 = 4;
 LAB_1:
     break;
   case 6:
-    puVar26 = (undefined4 *)local_1d8;
+    puVar22 = (undefined4 *)local_1d8;
     goto LAB_0;
   case 10:
     local_188 = 0x10;
     break;
   case 0xf:
     if (0xff < param_4) {
       local_188 = 0x100;
       goto LAB_1;
     }
     local_188 = (param_4 & 7) + param_4;
   }
-  uVar28 = 4;
-  puVar26 = (undefined4 *)local_1d8;
+  uVar25 = 4;
+  puVar22 = (undefined4 *)local_1d8;
   if (param_4 != local_188) goto LAB_0;
   if (param_2 == 9) {
-    if (cVar8 != '\0') {
+    if (cVar10 != '\0') {
       if (((ulonglong)param_3 & 3) != 0) {
                     /* WARNING: Subroutine does not return */
         ExRaiseDatatypeMisalignment();
       }
       if ((&DAT_2 < (undefined8 *)((longlong)param_3 + 4)) ||
          ((undefined8 *)((longlong)param_3 + 4) < param_3)) {
         DAT_2 = 0;
       }
     }
 LAB_3:
+    puVar22 = (undefined4 *)local_1d8;
+    uVar13 = *(uint *)param_3;
     local_148 = *(uint *)param_3;
-    pcVar14 = (char *)(ulonglong)local_148;
-    puVar26 = (undefined4 *)local_1d8;
     goto LAB_4;
   }
   switch(param_2) {
   case 2:
-    puVar24 = local_1d8;
-    if (cVar8 != '\0') {
+    puVar20 = local_1d8;
+    if (cVar10 != '\0') {
       if (((ulonglong)param_3 & 3) != 0) goto LAB_5;
-      puVar24 = local_1d8;
+      puVar20 = local_1d8;
       if ((undefined8 *)0x7ffffffeffff < param_3) goto LAB_6;
     }
     goto LAB_7;
   case 3:
   case 4:
   case 5:
   case 8:
   case 0xb:
   case 0xd:
   case 0xe:
-    if (cVar8 == '\0') goto LAB_3;
-    puVar12 = param_3;
+    if (cVar10 == '\0') goto LAB_3;
+    puVar14 = param_3;
     if ((undefined8 *)0x7ffffffeffff < param_3) {
-      puVar12 = (undefined8 *)&DAT_2;
-    }
-    local_148 = *(uint *)puVar12;
-    pcVar14 = (char *)(ulonglong)local_148;
-    puVar26 = (undefined4 *)local_1d8;
+      puVar14 = (undefined8 *)&DAT_2;
+    }
+    puVar22 = (undefined4 *)local_1d8;
+    uVar13 = *(uint *)puVar14;
+    local_148 = *(uint *)puVar14;
     break;
   case 6:
   case 7:
   case 9:
-    goto switchD_140271e3f_caseD_6;
+    goto switchD_140271bdf_caseD_6;
   case 10:
-    if ((cVar8 != '\0') && (((ulonglong)param_3 & 3) != 0)) {
+    if ((cVar10 != '\0') && (((ulonglong)param_3 & 3) != 0)) {
 LAB_5:
                     /* WARNING: Subroutine does not return */
       ExRaiseDatatypeMisalignment();
     }
-    local_148 = *(uint *)param_3;
+    uVar13 = *(uint *)param_3;
     uStack_144 = *(uint *)((longlong)param_3 + 4);
     uStack_140 = *(uint *)(param_3 + 1);
     uStack_13c = *(uint *)((longlong)param_3 + 0xc);
-    pcVar14 = (char *)(ulonglong)local_148;
-    puVar26 = (undefined4 *)local_1d8;
+    puVar22 = (undefined4 *)local_1d8;
+    local_148 = uVar13;
     break;
   case 0xc:
-    if (cVar8 != '\0') {
-      puVar12 = param_3;
+    if (cVar10 != '\0') {
+      puVar14 = param_3;
       if ((undefined8 *)0x7ffffffeffff < param_3) {
-        puVar12 = (undefined8 *)&DAT_2;
-      }
-      *(uint *)puVar12 = *(uint *)puVar12;
-      pcVar14 = (char *)(ulonglong)local_148;
-      puVar26 = (undefined4 *)local_1d8;
+        puVar14 = (undefined8 *)&DAT_2;
+      }
+      *(uint *)puVar14 = *(uint *)puVar14;
+      puVar22 = (undefined4 *)local_1d8;
+      uVar13 = local_148;
       break;
     }
     goto LAB_8;
   case 0xf:
-    if ((cVar8 != '\0') && (local_188 != 0)) {
+    if ((cVar10 != '\0') && (local_188 != 0)) {
       if (((ulonglong)param_3 & 3) != 0) {
                     /* WARNING: Subroutine does not return */
         ExRaiseDatatypeMisalignment();
       }
       if ((&DAT_2 < (undefined8 *)((longlong)param_3 + (ulonglong)local_188)) ||
          ((undefined8 *)((longlong)param_3 + (ulonglong)local_188) < param_3)) {
         DAT_2 = 0;
       }
     }
     RtlCopyMemory(&local_148,param_3,(ulonglong)local_188);
-    pcVar14 = (char *)(ulonglong)local_148;
-    puVar26 = (undefined4 *)local_1d8;
+    puVar22 = (undefined4 *)local_1d8;
+    uVar13 = local_148;
     break;
   default:
-    pcVar6 = (code *)swi(0x29);
-    (*pcVar6)();
-    puVar25 = auStack_1d0;
+    pcVar8 = (code *)swi(0x29);
+    (*pcVar8)();
+    puVar21 = auStack_1d0;
 LAB_6:
-    puVar24 = puVar25;
+    puVar20 = puVar21;
 LAB_7:
-    *(undefined8 *)(puVar24 + 0x90) = *param_3;
+    *(undefined8 *)(puVar20 + 0x90) = *param_3;
 LAB_8:
-    pcVar14 = (char *)(ulonglong)*(uint *)(puVar24 + 0x90);
-    puVar26 = (undefined4 *)puVar24;
+    puVar22 = (undefined4 *)puVar20;
+    uVar13 = *(uint *)(puVar20 + 0x90);
   }
 LAB_4:
-  pcVar16 = (char *)0x0;
-  *(undefined8 *)(puVar26 + 0x10) = 0;
-  *(undefined8 *)(puVar26 + 10) = 0;
-  *(undefined4 **)(puVar26 + 8) = puVar26 + 0x10;
-  *(undefined8 *)(puVar26 + -2) = 0x140271bcb;
-  uVar9 = ObReferenceObjectByHandle(param_1,4,ExpWorkerFactoryObjectType);
-  if ((int)uVar9 < 0) goto LAB_0;
+  pcVar19 = (char *)0x0;
+  *(undefined8 *)(puVar22 + 0x10) = 0;
+  *(undefined8 *)(puVar22 + 10) = 0;
+  *(undefined4 **)(puVar22 + 8) = puVar22 + 0x10;
+  *(undefined8 *)(puVar22 + -2) = 0x14027196b;
+  uVar11 = ObReferenceObjectByHandle(param_1,4,ExpWorkerFactoryObjectType);
+  if ((int)uVar11 < 0) goto LAB_0;
   if (param_2 == 8) {
-    lVar17 = *(longlong *)(puVar26 + 0x10);
-    plVar29 = (longlong *)(lVar17 + 0x10);
-    if ((int)pcVar14 == 0) {
-      pcVar14 = (char *)(ulonglong)KeNumberProcessors;
-      lVar17 = *(longlong *)(puVar26 + 0x10);
-    }
-    *(int *)(*(longlong *)(*plVar29 + 8) + 0x2c) = (int)pcVar14;
-    *(undefined8 *)(puVar26 + -2) = 0x1404897f5;
+    lVar17 = *(longlong *)(puVar22 + 0x10);
+    plVar26 = (longlong *)(lVar17 + 0x10);
+    if (uVar13 == 0) {
+      lVar17 = *(longlong *)(puVar22 + 0x10);
+      uVar13 = KeNumberProcessors;
+    }
+    *(uint *)(*(longlong *)(*plVar26 + 8) + 0x2c) = uVar13;
+    *(undefined8 *)(puVar22 + -2) = 0x140489849;
     ObfDereferenceObjectWithTag(lVar17,0x746c6644);
     goto LAB_0;
   }
-  uVar11 = 0;
-  puVar26[0xd] = 0;
-  *(undefined *)(puVar26 + 0xc) = 0;
-  puVar26[0xe] = uVar9 & 0xffffff00;
-  *(undefined *)((longlong)puVar26 + 0x4a) = 0;
-  lVar17 = *(longlong *)(puVar26 + 0x10);
-  plVar29 = *(longlong **)(lVar17 + 0x10);
-  *(longlong **)(puVar26 + 0x18) = plVar29;
-  *(undefined8 *)(puVar26 + 0x16) = 0;
-  uVar32 = 2;
+  puVar22[0xd] = 0;
+  *(undefined *)(puVar22 + 0xc) = 0;
+  puVar22[0xe] = uVar11 & 0xffffff00;
+  *(undefined *)((longlong)puVar22 + 0x4a) = 0;
+  lVar17 = *(longlong *)(puVar22 + 0x10);
+  plVar26 = *(longlong **)(lVar17 + 0x10);
+  *(longlong **)(puVar22 + 0x18) = plVar26;
+  *(undefined8 *)(puVar22 + 0x16) = 0;
+  uVar28 = 2;
   if (((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (in_CR8 < 0x10)) {
     if (in_CR8 != 2) {
-      uVar28 = (uint)(-1L << (in_CR8 + 1 & 0x3f)) & 4;
+      uVar25 = (uint)(-1L << (in_CR8 + 1 & 0x3f)) & 4;
     }
     *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) =
-         *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) | uVar28;
-    pcVar14 = (char *)(ulonglong)(uint)puVar26[0x24];
-    lVar17 = *(longlong *)(puVar26 + 0x10);
-  }
-  *(byte *)(puVar26 + 0x1a) = in_CR8;
+         *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) | uVar25;
+    uVar13 = puVar22[0x24];
+    lVar17 = *(longlong *)(puVar22 + 0x10);
+  }
+  *(byte *)(puVar22 + 0x1a) = in_CR8;
   if ((DAT_9._2_1_ & 0x21) == 0) {
     LOCK();
-    lVar17 = *plVar29;
-    *plVar29 = (longlong)(puVar26 + 0x16);
+    lVar17 = *plVar26;
+    *plVar26 = (longlong)(puVar22 + 0x16);
     UNLOCK();
     if (lVar17 != 0) {
-      *(undefined8 *)(puVar26 + -2) = 0x140271fb5;
-      KxWaitForLockOwnerShip(puVar26 + 0x16);
-    }
-    bVar31 = (byte)((ulonglong)lVar17 >> 8);
-    lVar17 = *(longlong *)(puVar26 + 0x10);
-    pcVar14 = (char *)(ulonglong)(uint)puVar26[0x24];
+      *(undefined8 *)(puVar22 + -2) = 0x140271d55;
+      KxWaitForLockOwnerShip(puVar22 + 0x16);
+    }
+    uVar18 = (undefined2)lVar17;
+    lVar17 = *(longlong *)(puVar22 + 0x10);
+    uVar13 = puVar22[0x24];
   }
   else {
-    *(undefined8 *)(puVar26 + -2) = 0x140489809;
-    KiAcquireQueuedSpinLockInstrumented(puVar26 + 0x16,plVar29);
-    bVar31 = (byte)((ulonglong)plVar29 >> 8);
-  }
-  bVar20 = (byte)uVar32;
-  uVar28 = (uint)pcVar14;
+    *(undefined8 *)(puVar22 + -2) = 0x14048985d;
+    KiAcquireQueuedSpinLockInstrumented(puVar22 + 0x16,plVar26);
+    uVar18 = SUB82(plVar26,0);
+  }
+  bVar27 = (byte)uVar28;
   if (param_2 == 9) {
-    if (uVar28 == 0) {
+    if (uVar13 == 0) {
       if (*(int *)(lVar17 + 0x180) != *(int *)(lVar17 + 0x184)) {
         *(int *)(lVar17 + 0x180) = *(int *)(lVar17 + 0x180) + 1;
         goto LAB_10;
       }
       goto LAB_11;
     }
-    if (uVar28 == 1) {
-      *(undefined *)(puVar26 + 0xc) = 0;
-      cVar8 = '\x01';
-      cVar21 = cVar8;
-    }
-    else if (uVar28 == 2) {
+    if (uVar13 == 1) {
+      *(undefined *)(puVar22 + 0xc) = 0;
+      cVar10 = '\x01';
+      cVar24 = cVar10;
+    }
+    else if (uVar13 == 2) {
       if ((*(int *)(lVar17 + 0x180) == 0) ||
-         (iVar10 = *(int *)(lVar17 + 0x180) + -1, *(int *)(lVar17 + 0x180) = iVar10, iVar10 != 0)) {
-        cVar8 = (char)puVar26[0xe];
+         (iVar12 = *(int *)(lVar17 + 0x180) + -1, *(int *)(lVar17 + 0x180) = iVar12, iVar12 != 0)) {
+        cVar10 = (char)puVar22[0xe];
       }
       else {
-        cVar8 = '\x01';
-      }
-      *(undefined *)(puVar26 + 0xc) = 0;
-      cVar21 = '\x01';
+        cVar10 = '\x01';
+      }
+      *(undefined *)(puVar22 + 0xc) = 0;
+      cVar24 = '\x01';
     }
     else {
-      if (uVar28 != 3) goto LAB_11;
+      if (uVar13 != 3) goto LAB_11;
       if (*(int *)(lVar17 + 0x180) == 0) {
-        cVar8 = (char)puVar26[0xe];
+        cVar10 = (char)puVar22[0xe];
       }
       else {
-        *(undefined8 *)(puVar26 + -2) = 0x140489a85;
+        *(undefined8 *)(puVar22 + -2) = 0x140489ad9;
         ExpRemoveCurrentThreadFromThreadHistory(lVar17);
-        iVar10 = *(int *)(lVar17 + 0x180) + -1;
-        *(int *)(lVar17 + 0x180) = iVar10;
+        iVar12 = *(int *)(lVar17 + 0x180) + -1;
+        *(int *)(lVar17 + 0x180) = iVar12;
         *(int *)(lVar17 + 0x184) = *(int *)(lVar17 + 0x184) + -1;
-        cVar8 = (char)puVar26[0xe];
-        if (iVar10 == 0) {
-          cVar8 = '\x01';
+        cVar10 = (char)puVar22[0xe];
+        if (iVar12 == 0) {
+          cVar10 = '\x01';
         }
       }
-      *(undefined *)(puVar26 + 0xc) = 0;
-      cVar21 = '\x01';
+      *(undefined *)(puVar22 + 0xc) = 0;
+      cVar24 = '\x01';
     }
     goto LAB_12;
   }
+  if (0xd < param_2 - 2U) {
+    pcVar8 = (code *)swi(0x29);
+    (*pcVar8)(0x25);
+    in(uVar18);
+                    /* WARNING: Bad instruction - Truncating control flow here */
+    halt_baddata();
+  }
+  uVar25 = 0;
   switch(param_2) {
   case 2:
-    if (*(longlong *)(puVar26 + 0x24) < 0) {
-      if (-10000000 < *(longlong *)(puVar26 + 0x24)) {
-        *(undefined8 *)(puVar26 + 0x24) = 0xffffffffff676980;
-      }
-      if (*(longlong *)(puVar26 + 0x24) < -6000000000) {
-        *(undefined8 *)(puVar26 + 0x24) = 0xfffffffe9a5f4400;
-      }
-      lVar4 = *(longlong *)(puVar26 + 0x24);
-      *(longlong *)(lVar17 + 0x70) = lVar4;
-      *(undefined8 *)(puVar26 + 0x20) = 0xffffffffffffffff;
-      *(undefined8 *)(puVar26 + -2) = 0x14027204b;
-      KeSetTimer2(lVar17 + 0x1a8,lVar4,-lVar4);
+    if (*(longlong *)(puVar22 + 0x24) < 0) {
+      if (-10000000 < *(longlong *)(puVar22 + 0x24)) {
+        *(undefined8 *)(puVar22 + 0x24) = 0xffffffffff676980;
+      }
+      if (*(longlong *)(puVar22 + 0x24) < -6000000000) {
+        *(undefined8 *)(puVar22 + 0x24) = 0xfffffffe9a5f4400;
+      }
+      lVar3 = *(longlong *)(puVar22 + 0x24);
+      *(longlong *)(lVar17 + 0x70) = lVar3;
+      *(undefined8 *)(puVar22 + 0x20) = 0xffffffffffffffff;
+      *(undefined8 *)(puVar22 + -2) = 0x140271deb;
+      KeSetTimer2(lVar17 + 0x1a8,lVar3,-lVar3);
       goto LAB_10;
     }
     goto LAB_11;
   case 3:
-    uVar9 = *(uint *)(lVar17 + 0x194);
-    if ((int)uVar28 < 0) {
-      if (-uVar28 < uVar9) {
-        uVar11 = uVar9 + uVar28;
-        *(uint *)(lVar17 + 0x194) = uVar11;
+    uVar11 = *(uint *)(lVar17 + 0x194);
+    if ((int)uVar13 < 0) {
+      if (-uVar13 < uVar11) {
+        uVar25 = uVar11 + uVar13;
+        *(uint *)(lVar17 + 0x194) = uVar25;
       }
       else {
         *(undefined4 *)(lVar17 + 0x194) = 0;
       }
     }
     else {
-      uVar11 = uVar9 + uVar28;
-      if (uVar9 < uVar11) {
-        *(uint *)(lVar17 + 0x194) = uVar11;
+      uVar25 = uVar11 + uVar13;
+      if (uVar11 < uVar25) {
+        *(uint *)(lVar17 + 0x194) = uVar25;
       }
       else {
         *(undefined4 *)(lVar17 + 0x194) = 0xffffffff;
-        uVar11 = 0xffffffff;
-      }
-    }
-    if (uVar9 == 0) {
-      if (uVar11 == 0) goto LAB_13;
-      *(undefined8 *)(puVar26 + -2) = 0x140271f7e;
-      cVar8 = ExpTryEnterWorkerFactoryAwayMode(lVar17);
-      if (cVar8 == '\0') goto LAB_10;
-      *(undefined8 *)(puVar26 + -2) = 0x1402722ba;
-      ExpWorkerFactoryCheckCreate(lVar17,puVar26 + 0x16,0);
-      cVar21 = '\0';
-    }
-    else if ((uVar11 == 0) && ((*(uint *)(lVar17 + 0x198) & 0x200) != 0)) {
-      *(undefined8 *)(puVar26 + -2) = 0x14027232d;
+        uVar25 = 0xffffffff;
+      }
+    }
+    if (uVar11 == 0) {
+      if (uVar25 == 0) goto LAB_13;
+      *(undefined8 *)(puVar22 + -2) = 0x140271d1e;
+      cVar10 = ExpTryEnterWorkerFactoryAwayMode(lVar17);
+      if (cVar10 == '\0') goto LAB_10;
+      *(undefined8 *)(puVar22 + -2) = 0x14027205a;
+      ExpWorkerFactoryCheckCreate(lVar17,puVar22 + 0x16,0);
+      cVar24 = '\0';
+    }
+    else if ((uVar25 == 0) && ((*(uint *)(lVar17 + 0x198) & 0x200) != 0)) {
+      *(undefined8 *)(puVar22 + -2) = 0x1402720cd;
       ExpLeaveWorkerFactoryAwayMode(lVar17);
-      cVar21 = '\x01';
+      cVar24 = '\x01';
     }
     else {
 LAB_13:
-      cVar21 = '\x01';
+      cVar24 = '\x01';
     }
     goto LAB_14;
   case 4:
-    *(longlong **)(puVar26 + 0x14) = (longlong *)(lVar17 + 0x10);
-    cVar8 = (char)puVar26[0xe];
+    *(longlong **)(puVar22 + 0x14) = (longlong *)(lVar17 + 0x10);
+    cVar10 = (char)puVar22[0xe];
     if (*(char *)(*(longlong *)(lVar17 + 0x10) + 0x21) == '\0') {
       puVar1 = (uint *)(lVar17 + 0x178);
-      if (*puVar1 < uVar28) {
-        cVar8 = '\x01';
-      }
-      *puVar1 = uVar28;
-      if (*(uint *)(lVar17 + 0x17c) < uVar28) {
-        *(uint *)(lVar17 + 0x17c) = uVar28;
-      }
-      if (cVar8 == '\0') {
-        cVar21 = '\x01';
-        cVar8 = '\0';
+      if (*puVar1 < uVar13) {
+        cVar10 = '\x01';
+      }
+      *puVar1 = uVar13;
+      if (*(uint *)(lVar17 + 0x17c) < uVar13) {
+        *(uint *)(lVar17 + 0x17c) = uVar13;
+      }
+      if (cVar10 == '\0') {
+        cVar24 = '\x01';
+        cVar10 = '\0';
       }
       else {
-        cVar8 = '\0';
+        cVar10 = '\0';
         if ((*(uint *)(lVar17 + 0x198) & 0x200) != 0) {
-          *(undefined8 *)(puVar26 + -2) = 0x140272367;
+          *(undefined8 *)(puVar22 + -2) = 0x140272107;
           ExpLeaveWorkerFactoryAwayMode(lVar17);
         }
-        bVar20 = (byte)uVar32;
-        *(int **)(puVar26 + 0xe) = (int *)(lVar17 + 0x188);
-        *(int **)(puVar26 + 0x1c) = (int *)(lVar17 + 0x180);
+        bVar27 = (byte)uVar28;
+        *(int **)(puVar22 + 0xe) = (int *)(lVar17 + 0x188);
+        *(int **)(puVar22 + 0x1c) = (int *)(lVar17 + 0x180);
         if ((uint)(*(int *)(lVar17 + 0x180) + *(int *)(lVar17 + 0x188)) < *puVar1) {
           piVar2 = (int *)(lVar17 + 400);
           do {
-            bVar31 = (byte)uVar32;
+            bVar27 = (byte)uVar28;
             *piVar2 = *piVar2 + 1;
-            *(undefined8 *)(puVar26 + -2) = 0x140272155;
-            KxReleaseQueuedSpinLock(puVar26 + 0x16);
-            pvVar7 = FiberData;
-            uVar32 = (ulonglong)*(byte *)(puVar26 + 0x1a);
-            if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar31 < 0x10)) &&
-               ((*(byte *)(puVar26 + 0x1a) < 0x10 && (1 < bVar31)))) {
-              uVar28 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
-                       ~((uint)(-1L << (*(char *)(puVar26 + 0x1a) + 1U & 0x3f)) & 0xffff);
-              *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar28;
-              if (uVar28 == 0) {
-                *(undefined8 *)(puVar26 + -2) = 0x140489934;
-                KiRemoveSystemWorkPriorityKick(pvVar7);
+            *(undefined8 *)(puVar22 + -2) = 0x140271ef5;
+            KxReleaseQueuedSpinLock(puVar22 + 0x16);
+            pvVar9 = FiberData;
+            uVar28 = (ulonglong)*(byte *)(puVar22 + 0x1a);
+            if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar27 < 0x10)) &&
+               ((*(byte *)(puVar22 + 0x1a) < 0x10 && (1 < bVar27)))) {
+              uVar25 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
+                       ~((uint)(-1L << (*(char *)(puVar22 + 0x1a) + 1U & 0x3f)) & 0xffff);
+              *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar25;
+              if (uVar25 == 0) {
+                *(undefined8 *)(puVar22 + -2) = 0x140489988;
+                KiRemoveSystemWorkPriorityKick(pvVar9);
               }
-              lVar17 = *(longlong *)(puVar26 + 0x10);
+              lVar17 = *(longlong *)(puVar22 + 0x10);
             }
-            *(undefined8 *)(puVar26 + -2) = 0x140272175;
-            iVar10 = ExpWorkerFactoryCreateThread(lVar17);
-            uVar15 = **(undefined8 **)(puVar26 + 0x14);
-            *(undefined8 *)(puVar26 + -2) = 0x14027218a;
-            KeAcquireInStackQueuedSpinLock(uVar15,puVar26 + 0x16);
-            bVar20 = (byte)uVar32;
-            if (iVar10 < 0) {
+            *(undefined8 *)(puVar22 + -2) = 0x140271f15;
+            iVar12 = ExpWorkerFactoryCreateThread(lVar17);
+            uVar7 = **(undefined8 **)(puVar22 + 0x14);
+            *(undefined8 *)(puVar22 + -2) = 0x140271f2a;
+            KeAcquireInStackQueuedSpinLock(uVar7,puVar22 + 0x16);
+            bVar27 = (byte)uVar28;
+            if (iVar12 < 0) {
               *(int *)(lVar17 + 400) = *(int *)(lVar17 + 400) + -1;
               break;
             }
-          } while ((uint)(**(int **)(puVar26 + 0xe) + **(int **)(puVar26 + 0x1c)) < *puVar1);
+          } while ((uint)(**(int **)(puVar22 + 0xe) + **(int **)(puVar22 + 0x1c)) < *puVar1);
         }
 LAB_15:
-        cVar21 = '\x01';
+        cVar24 = '\x01';
       }
     }
     else {
-      cVar21 = '\x01';
+      cVar24 = '\x01';
     }
     break;
   case 5:
-    lVar4 = *(longlong *)(lVar17 + 0x10);
-    if (*(char *)(lVar4 + 0x21) != '\0') goto LAB_11;
-    *(undefined *)(puVar26 + 0xc) = 1;
-    if ((uVar28 == 0) ||
-       (((*(int *)(lVar17 + 0x17c) != 0 || (*(int *)(lVar4 + 0x18) == 0)) &&
-        (*(int *)(*(longlong *)(lVar4 + 8) + 4) < 1)))) {
-      cVar8 = (char)puVar26[0xe];
+    lVar3 = *(longlong *)(lVar17 + 0x10);
+    if (*(char *)(lVar3 + 0x21) != '\0') goto LAB_11;
+    *(undefined *)(puVar22 + 0xc) = 1;
+    if ((uVar13 == 0) ||
+       (((*(int *)(lVar17 + 0x17c) != 0 || (*(int *)(lVar3 + 0x18) == 0)) &&
+        (*(int *)(*(longlong *)(lVar3 + 8) + 4) < 1)))) {
+      cVar10 = (char)puVar22[0xe];
     }
     else {
-      cVar8 = '\x01';
-    }
-    *(uint *)(lVar17 + 0x17c) = uVar28;
-    if (*(uint *)(lVar17 + 0x178) <= uVar28) goto LAB_15;
-    *(uint *)(lVar17 + 0x178) = uVar28;
-    cVar21 = '\x01';
-    break;
-  case 6:
-  case 7:
-  case 8:
-  case 9:
-switchD_140271e3f_caseD_6:
-    pcVar14 = (char *)(longlong)(param_2 + -2);
-    cVar8 = (char)(param_2 + -2);
-    *pcVar16 = *pcVar16 + cVar8;
-    *pcVar14 = *pcVar14 + cVar8;
-    *(char *)((longlong)pcVar14 * 2) = *(char *)((longlong)pcVar14 * 2) + cVar8;
-    *pcVar14 = *pcVar14 + cVar8;
+      cVar10 = '\x01';
+    }
+    *(uint *)(lVar17 + 0x17c) = uVar13;
+    if (*(uint *)(lVar17 + 0x178) <= uVar13) goto LAB_15;
+    *(uint *)(lVar17 + 0x178) = uVar13;
+    cVar24 = '\x01';
+    break;
+  default:
+switchD_140271bdf_caseD_6:
+    pcVar16 = (char *)(longlong)(param_2 + -2);
+    cVar10 = (char)(param_2 + -2);
+    *pcVar19 = *pcVar19 + cVar10;
+    *pcVar16 = *pcVar16 + cVar10;
+    *(char *)((longlong)pcVar16 * 2) = *(char *)((longlong)pcVar16 * 2) + cVar10;
+    *pcVar16 = *pcVar16 + cVar10;
                     /* WARNING: Bad instruction - Truncating control flow here */
     halt_baddata();
   case 10:
-    cVar8 = (char)puVar26[0xe];
-    cVar21 = '\x01';
+    cVar10 = (char)puVar22[0xe];
+    cVar24 = '\x01';
     if (*(char *)(*(longlong *)(lVar17 + 0x10) + 0x21) == '\0') {
-      *(undefined8 *)(lVar17 + 0x40) = *(undefined8 *)(puVar26 + 0x26);
-      *(undefined8 *)(lVar17 + 0x38) = *(undefined8 *)(puVar26 + 0x24);
+      *(undefined8 *)(lVar17 + 0x40) = *(undefined8 *)(puVar22 + 0x26);
+      *(undefined8 *)(lVar17 + 0x38) = *(undefined8 *)(puVar22 + 0x24);
     }
     break;
   case 0xb:
-    *(uint *)(lVar17 + 0x19c) = uVar28;
+    *(uint *)(lVar17 + 0x19c) = uVar13;
     goto LAB_11;
   case 0xc:
+    uVar13 = 0;
     if (*(int *)(lVar17 + 400) == 0) {
-      uVar28 = *(uint *)(lVar17 + 0x180);
-      uVar9 = *(uint *)(lVar17 + 0x178);
-      if (uVar9 < uVar28) {
-        uVar15 = *(undefined8 *)(*(longlong *)(lVar17 + 0x10) + 8);
-        *(undefined8 *)(puVar26 + -2) = 0x140272240;
-        uVar11 = KeTimeOutQueueWaiters(uVar15,0,uVar28 - uVar9);
-      }
-    }
-    *(undefined8 *)(puVar26 + -2) = 0x14027224d;
-    KxReleaseQueuedSpinLock(puVar26 + 0x16);
-    pvVar7 = FiberData;
-    bVar31 = *(byte *)(puVar26 + 0x1a);
-    if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar20 < 0x10)) &&
-       ((bVar31 < 0x10 && (1 < bVar20)))) {
-      uVar28 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
-               ~((uint)(-1L << (*(char *)(puVar26 + 0x1a) + 1U & 0x3f)) & 0xffff);
-      *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar28;
-      if (uVar28 == 0) {
-        *(undefined8 *)(puVar26 + -2) = 0x140489870;
-        KiRemoveSystemWorkPriorityKick(pvVar7);
-      }
-      lVar17 = *(longlong *)(puVar26 + 0x10);
-    }
-    cVar21 = '\0';
-    *(uint *)param_3 = uVar11;
-    cVar8 = (char)puVar26[0xe];
-    bVar20 = bVar31;
+      uVar11 = *(uint *)(lVar17 + 0x180);
+      uVar5 = *(uint *)(lVar17 + 0x178);
+      uVar13 = uVar25;
+      if (uVar5 < uVar11) {
+        uVar7 = *(undefined8 *)(*(longlong *)(lVar17 + 0x10) + 8);
+        *(undefined8 *)(puVar22 + -2) = 0x140271fe0;
+        uVar13 = KeTimeOutQueueWaiters(uVar7,0,uVar11 - uVar5);
+      }
+    }
+    *(undefined8 *)(puVar22 + -2) = 0x140271fed;
+    KxReleaseQueuedSpinLock(puVar22 + 0x16);
+    pvVar9 = FiberData;
+    bVar4 = *(byte *)(puVar22 + 0x1a);
+    if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar27 < 0x10)) &&
+       ((bVar4 < 0x10 && (1 < bVar27)))) {
+      uVar25 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
+               ~((uint)(-1L << (*(char *)(puVar22 + 0x1a) + 1U & 0x3f)) & 0xffff);
+      *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar25;
+      if (uVar25 == 0) {
+        *(undefined8 *)(puVar22 + -2) = 0x1404898c4;
+        KiRemoveSystemWorkPriorityKick(pvVar9);
+      }
+      lVar17 = *(longlong *)(puVar22 + 0x10);
+    }
+    cVar24 = '\0';
+    *(uint *)param_3 = uVar13;
+    cVar10 = (char)puVar22[0xe];
+    bVar27 = bVar4;
     break;
   case 0xd:
-    if (((ulonglong)pcVar14 & 1) == 0) {
-      uVar28 = 0;
-    }
-    else {
-      uVar28 = 0x800;
-    }
-    *(uint *)(lVar17 + 0x198) = *(uint *)(lVar17 + 0x198) & 0xfffff7ff | uVar28;
+    if ((uVar13 & 1) != 0) {
+      uVar25 = 0x800;
+    }
+    *(uint *)(lVar17 + 0x198) = *(uint *)(lVar17 + 0x198) & 0xfffff7ff | uVar25;
 LAB_10:
-    cVar21 = '\x01';
+    cVar24 = '\x01';
     goto LAB_14;
   case 0xe:
     if ((*(char *)(*(longlong *)(lVar17 + 0x10) + 0x21) != '\0') ||
-       (*(uint *)(lVar17 + 0x18c) = uVar28, uVar28 == 0)) goto LAB_11;
-    if (uVar28 < *(uint *)(lVar17 + 0x178)) {
+       (*(uint *)(lVar17 + 0x18c) = uVar13, uVar13 == 0)) goto LAB_11;
+    if (uVar13 < *(uint *)(lVar17 + 0x178)) {
       *(uint *)(lVar17 + 0x18c) = *(uint *)(lVar17 + 0x178);
       goto LAB_13;
     }
-    cVar8 = (char)puVar26[0xe];
-    if (uVar28 <= *(uint *)(lVar17 + 0x17c)) goto LAB_15;
+    cVar10 = (char)puVar22[0xe];
+    if (uVar13 <= *(uint *)(lVar17 + 0x17c)) goto LAB_15;
     *(uint *)(lVar17 + 0x18c) = *(uint *)(lVar17 + 0x17c);
-    cVar21 = '\x01';
+    cVar24 = '\x01';
     break;
   case 0xf:
     if ((*(char *)(*(longlong *)(lVar17 + 0x10) + 0x21) == '\0') &&
        ((*(uint *)(lVar17 + 0x198) & 0x8000) == 0)) {
-      uVar28 = puVar26[0x14];
-      *(undefined8 *)(puVar26 + -2) = 0x1404899f4;
-      iVar10 = KiValidateCpuSetMasks(puVar26 + 0x24);
-      if (-1 < iVar10) {
-        *(undefined8 *)(puVar26 + -2) = 0x140489a0c;
+      uVar25 = puVar22[0x14];
+      *(undefined8 *)(puVar22 + -2) = 0x140489a48;
+      iVar12 = KiValidateCpuSetMasks(puVar22 + 0x24);
+      if (-1 < iVar12) {
+        *(undefined8 *)(puVar22 + -2) = 0x140489a60;
         memset((void *)(lVar17 + 0x78),0,0x100);
-        *(undefined8 *)(puVar26 + -2) = 0x140489a20;
-        RtlCopyMemory((void *)(lVar17 + 0x78),puVar26 + 0x24,(ulonglong)uVar28);
+        *(undefined8 *)(puVar22 + -2) = 0x140489a74;
+        RtlCopyMemory((void *)(lVar17 + 0x78),puVar22 + 0x24,(ulonglong)uVar25);
         *(uint *)(lVar17 + 0x198) = *(uint *)(lVar17 + 0x198) | 0x4000;
-        cVar21 = '\x01';
+        cVar24 = '\x01';
         goto LAB_14;
       }
     }
 LAB_11:
-    cVar21 = '\x01';
+    cVar24 = '\x01';
 LAB_14:
-    cVar8 = (char)puVar26[0xe];
-    break;
-  default:
-    bVar23 = 0x25;
-    pcVar6 = (code *)swi(0x29);
-    uVar15 = (*pcVar6)();
-    bVar19 = (byte)((ulonglong)uVar15 >> 8);
-    uVar22 = (undefined6)((ulonglong)uVar15 >> 0x10);
-    cVar8 = (char)uVar15;
-    bVar18 = (bVar19 - *pcVar14) - CARRY1(bRam0000000000000000,bVar19);
-    bVar20 = bRam0000000000000000 + bVar19 + bVar18;
-    bVar19 = (bVar18 - *pcVar14) - CARRY1(bRam0000000000000000 + bVar19,bVar18);
-    bRam0000000000000000 = bVar20 + bVar19;
-    bVar20 = (bVar19 - *pcVar14) - CARRY1(bVar20,bVar19);
-    pcVar16 = (char *)CONCAT62(uVar22,CONCAT11(bVar20,cVar8));
-    *pcVar16 = *pcVar16 + cVar8;
-    *pcVar16 = *pcVar16 + cVar8;
-    *pcVar16 = *pcVar16 + cVar8;
-    *pcVar16 = *pcVar16 + cVar8;
-    bVar30 = CARRY1(bRam0000000000000000,bVar20);
-    bRam0000000000000000 = bRam0000000000000000 + bVar20;
-    cVar21 = (bVar20 - *pcVar14) - bVar30;
-    pcVar16 = (char *)CONCAT62(uVar22,CONCAT11(cVar21,cVar8));
-    *pcVar16 = *pcVar16 + cVar8;
-    *pcVar16 = *pcVar16 + cVar8;
-    pbVar3 = (byte *)(unaff_RBP + 0x2300271a);
-    bVar20 = *pbVar3;
-    *pbVar3 = *pbVar3 + bVar23;
-    bVar20 = (((cVar21 - *pcVar14) - CARRY1(bVar20,bVar23)) - *pcVar14) - CARRY1(bVar31,bVar23);
-    bVar31 = bRam0000000000000000 + bVar20;
-    bVar20 = (bVar20 - *pcVar14) - CARRY1(bRam0000000000000000,bVar20);
-    bRam0000000000000000 = bVar31 + bVar20;
-    pcVar16 = (char *)CONCAT62(uVar22,CONCAT11((bVar20 - *pcVar14) - CARRY1(bVar31,bVar20),cVar8));
-    *pcVar16 = *pcVar16 + bVar23;
-    pcVar16[-0x47ffb769] = pcVar16[-0x47ffb769];
-    *(char *)((ulonglong)pcVar16 & 0xffffffff) =
-         *(char *)((ulonglong)pcVar16 & 0xffffffff) + (char)pcVar14;
-                    /* WARNING: Bad instruction - Truncating control flow here */
-    halt_baddata();
+    cVar10 = (char)puVar22[0xe];
   }
 LAB_12:
-  if (cVar8 != '\0') {
+  if (cVar10 != '\0') {
     if ((((*(char *)(*(longlong *)(lVar17 + 0x10) + 0x21) == '\0') &&
          (*(uint *)(lVar17 + 0x180) < *(uint *)(lVar17 + 0x17c))) && (*(int *)(lVar17 + 400) == 0))
        && (*(int *)(lVar17 + 0x188) + *(uint *)(lVar17 + 0x180) < *(uint *)(lVar17 + 0x17c))) {
       if ((*(uint *)(lVar17 + 0x198) & 0x200) != 0) {
-        *(undefined8 *)(puVar26 + -2) = 0x140271f02;
+        *(undefined8 *)(puVar22 + -2) = 0x140271ca2;
         ExpLeaveWorkerFactoryAwayMode(lVar17);
       }
       *(int *)(lVar17 + 400) = *(int *)(lVar17 + 400) + 1;
-      *(undefined8 *)(puVar26 + -2) = 0x140271f13;
-      KxReleaseQueuedSpinLock(puVar26 + 0x16);
-      pvVar7 = FiberData;
-      bVar31 = *(byte *)(puVar26 + 0x1a);
+      *(undefined8 *)(puVar22 + -2) = 0x140271cb3;
+      KxReleaseQueuedSpinLock(puVar22 + 0x16);
+      pvVar9 = FiberData;
+      bVar4 = *(byte *)(puVar22 + 0x1a);
       if (((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) &&
-         ((bVar20 < 0x10 && ((bVar31 < 0x10 && (1 < bVar20)))))) {
-        uVar28 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
-                 ~((uint)(-1L << (*(char *)(puVar26 + 0x1a) + 1U & 0x3f)) & 0xffff);
-        *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar28;
-        if (uVar28 == 0) {
-          *(undefined8 *)(puVar26 + -2) = 0x140489b58;
-          KiRemoveSystemWorkPriorityKick(pvVar7);
+         ((bVar27 < 0x10 && ((bVar4 < 0x10 && (1 < bVar27)))))) {
+        uVar25 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
+                 ~((uint)(-1L << (*(char *)(puVar22 + 0x1a) + 1U & 0x3f)) & 0xffff);
+        *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar25;
+        if (uVar25 == 0) {
+          *(undefined8 *)(puVar22 + -2) = 0x140489bac;
+          KiRemoveSystemWorkPriorityKick(pvVar9);
         }
-        lVar17 = *(longlong *)(puVar26 + 0x10);
-      }
-      cVar21 = '\0';
-      *(undefined8 *)(puVar26 + -2) = 0x140271f35;
-      bVar20 = bVar31;
-      iVar10 = ExpWorkerFactoryCreateThread(lVar17);
-      if (iVar10 < 0) {
-        cVar21 = '\x01';
-        uVar15 = *(undefined8 *)(lVar17 + 0x10);
-        *(undefined8 *)(puVar26 + -2) = 0x140489b73;
-        KeAcquireInStackQueuedSpinLock(uVar15,puVar26 + 0x16);
+        lVar17 = *(longlong *)(puVar22 + 0x10);
+      }
+      cVar24 = '\0';
+      *(undefined8 *)(puVar22 + -2) = 0x140271cd5;
+      bVar27 = bVar4;
+      iVar12 = ExpWorkerFactoryCreateThread(lVar17);
+      if (iVar12 < 0) {
+        cVar24 = '\x01';
+        uVar7 = *(undefined8 *)(lVar17 + 0x10);
+        *(undefined8 *)(puVar22 + -2) = 0x140489bc7;
+        KeAcquireInStackQueuedSpinLock(uVar7,puVar22 + 0x16);
         *(int *)(lVar17 + 400) = *(int *)(lVar17 + 400) + -1;
       }
     }
   }
-  if (cVar21 != '\0') {
+  if (cVar24 != '\0') {
     if ((DAT_9._2_1_ & 1) == 0) {
-      lVar17 = *(longlong *)(puVar26 + 0x16);
+      lVar17 = *(longlong *)(puVar22 + 0x16);
       if (lVar17 == 0) {
         LOCK();
-        puVar13 = (undefined4 *)**(longlong **)(puVar26 + 0x18);
-        if (puVar26 + 0x16 == puVar13) {
-          **(longlong **)(puVar26 + 0x18) = 0;
-          puVar13 = puVar26 + 0x16;
+        puVar15 = (undefined4 *)**(longlong **)(puVar22 + 0x18);
+        if (puVar22 + 0x16 == puVar15) {
+          **(longlong **)(puVar22 + 0x18) = 0;
+          puVar15 = puVar22 + 0x16;
         }
         UNLOCK();
-        if (puVar13 != puVar26 + 0x16) {
-          *(undefined8 *)(puVar26 + -2) = 0x140271fc7;
-          lVar17 = KxWaitForLockChainValid(puVar26 + 0x16);
+        if (puVar15 != puVar22 + 0x16) {
+          *(undefined8 *)(puVar22 + -2) = 0x140271d67;
+          lVar17 = KxWaitForLockChainValid(puVar22 + 0x16);
           goto LAB_16;
         }
       }
       else {
 LAB_16:
-        *(undefined8 *)(puVar26 + 0x16) = 0;
-        uVar5 = *(undefined8 *)(puVar26 + 0x18);
-        puVar12 = (undefined8 *)(lVar17 + 8);
+        *(undefined8 *)(puVar22 + 0x16) = 0;
+        uVar6 = *(undefined8 *)(puVar22 + 0x18);
+        puVar14 = (undefined8 *)(lVar17 + 8);
         LOCK();
-        uVar15 = *puVar12;
-        *puVar12 = uVar5;
+        uVar7 = *puVar14;
+        *puVar14 = uVar6;
         UNLOCK();
-        if ((((byte)uVar15 ^ (byte)uVar5) & 4) != 0) {
+        if ((((byte)uVar7 ^ (byte)uVar6) & 4) != 0) {
           LOCK();
-          *puVar26 = *puVar26;
+          *puVar22 = *puVar22;
           UNLOCK();
           LOCK();
-          uVar15 = *(undefined8 *)
-                    (&KiHaltOnAddressHashTable +
-                    (ulonglong)((uint)((ulonglong)puVar12 >> 5) & 0x7f) * 8);
+          uVar7 = *(undefined8 *)
+                   (&KiHaltOnAddressHashTable +
+                   (ulonglong)((uint)((ulonglong)puVar14 >> 5) & 0x7f) * 8);
           *(undefined8 *)
-           (&KiHaltOnAddressHashTable + (ulonglong)((uint)((ulonglong)puVar12 >> 5) & 0x7f) * 8) = 0
+           (&KiHaltOnAddressHashTable + (ulonglong)((uint)((ulonglong)puVar14 >> 5) & 0x7f) * 8) = 0
           ;
           UNLOCK();
-          *(undefined8 *)(puVar26 + -2) = 0x140489bc5;
-          KiHaltOnAddressWakeEntireList(uVar15);
+          *(undefined8 *)(puVar22 + -2) = 0x140489c19;
+          KiHaltOnAddressWakeEntireList(uVar7);
         }
       }
-      lVar17 = *(longlong *)(puVar26 + 0x10);
+      lVar17 = *(longlong *)(puVar22 + 0x10);
     }
     else {
-      *(undefined8 *)(puVar26 + -2) = 0x140489b9c;
-      KiReleaseQueuedSpinLockInstrumented(puVar26 + 0x16,*(undefined8 *)(puVar26 + 0x76));
-    }
-    pvVar7 = FiberData;
-    if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar20 < 0x10)) &&
-       ((*(byte *)(puVar26 + 0x1a) < 0x10 && (1 < bVar20)))) {
-      uVar28 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
-               ~((uint)(-1L << (*(char *)(puVar26 + 0x1a) + 1U & 0x3f)) & 0xffff);
-      *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar28;
-      if (uVar28 == 0) {
-        *(undefined8 *)(puVar26 + -2) = 0x140489c29;
-        KiRemoveSystemWorkPriorityKick(pvVar7);
-      }
-      lVar17 = *(longlong *)(puVar26 + 0x10);
-    }
-  }
-  plVar29 = (longlong *)(lVar17 + -0x30);
+      *(undefined8 *)(puVar22 + -2) = 0x140489bf0;
+      KiReleaseQueuedSpinLockInstrumented(puVar22 + 0x16,*(undefined8 *)(puVar22 + 0x76));
+    }
+    pvVar9 = FiberData;
+    if ((((KiIrqlFlags != 0) && ((KiIrqlFlags & 1) != 0)) && (bVar27 < 0x10)) &&
+       ((*(byte *)(puVar22 + 0x1a) < 0x10 && (1 < bVar27)))) {
+      uVar25 = *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) &
+               ~((uint)(-1L << (*(char *)(puVar22 + 0x1a) + 1U & 0x3f)) & 0xffff);
+      *(uint *)(*(longlong *)((longlong)FiberData + 35000) + 0x14) = uVar25;
+      if (uVar25 == 0) {
+        *(undefined8 *)(puVar22 + -2) = 0x140489c7d;
+        KiRemoveSystemWorkPriorityKick(pvVar9);
+      }
+      lVar17 = *(longlong *)(puVar22 + 0x10);
+    }
+  }
+  plVar26 = (longlong *)(lVar17 + -0x30);
   if (ObpTraceFlags != 0) {
-    *(undefined8 *)(puVar26 + -2) = 0x140489c46;
-    ObpPushStackInfo(plVar29,0,1,0x746c6644);
+    *(undefined8 *)(puVar22 + -2) = 0x140489c9a;
+    ObpPushStackInfo(plVar26,0,1,0x746c6644);
   }
   LOCK();
-  lVar4 = *plVar29;
-  *plVar29 = *plVar29 + -1;
+  lVar3 = *plVar26;
+  *plVar26 = *plVar26 + -1;
   UNLOCK();
-  lVar27 = lVar4 + -1;
-  if (lVar27 == 0 || lVar4 < 1) {
+  lVar23 = lVar3 + -1;
+  if (lVar23 == 0 || lVar3 < 1) {
     if (*(longlong *)(lVar17 + -0x28) != 0) {
-      bVar31 = *(byte *)(lVar17 + -0x18);
-      *(longlong *)(puVar26 + 8) = *(longlong *)(lVar17 + -0x28);
-      uVar15 = *(undefined8 *)
-                (&ObTypeIndexTable +
-                ((ulonglong)plVar29 >> 8 & 0xff ^ (ulonglong)bVar31 ^ (ulonglong)ObHeaderCookie) * 8
-                );
+      bVar27 = *(byte *)(lVar17 + -0x18);
+      *(longlong *)(puVar22 + 8) = *(longlong *)(lVar17 + -0x28);
+      uVar7 = *(undefined8 *)
+               (&ObTypeIndexTable +
+               ((ulonglong)plVar26 >> 8 & 0xff ^ (ulonglong)bVar27 ^ (ulonglong)ObHeaderCookie) * 8)
+      ;
                     /* WARNING: Subroutine does not return */
-      *(undefined **)(puVar26 + -2) = &UNK_17;
-      KeBugCheckEx(0x18,uVar15,*(undefined8 *)(puVar26 + 0x10),1);
-    }
-    if (lVar27 < 0) {
-      *(longlong *)(puVar26 + 8) = lVar27;
+      *(undefined **)(puVar22 + -2) = &UNK_17;
+      KeBugCheckEx(0x18,uVar7,*(undefined8 *)(puVar22 + 0x10),1);
+    }
+    if (lVar23 < 0) {
+      *(longlong *)(puVar22 + 8) = lVar23;
                     /* WARNING: Subroutine does not return */
-      *(undefined **)(puVar26 + -2) = &UNK_18;
-      KeBugCheckEx(0x18,0,*(undefined8 *)(puVar26 + 0x10),2);
-    }
-    *(undefined8 *)(puVar26 + -2) = 0x140489cbd;
-    cVar8 = KeAreAllApcsDisabled();
-    if (cVar8 == '\0') {
-      *(undefined8 *)(puVar26 + -2) = 0x140489cc9;
+      *(undefined **)(puVar22 + -2) = &UNK_18;
+      KeBugCheckEx(0x18,0,*(undefined8 *)(puVar22 + 0x10),2);
+    }
+    *(undefined8 *)(puVar22 + -2) = 0x140489d11;
+    cVar10 = KeAreAllApcsDisabled();
+    if (cVar10 == '\0') {
+      *(undefined8 *)(puVar22 + -2) = 0x140489d1d;
       lVar17 = OBJECT_HEADER_TO_HANDLE_REVOCATION_INFO();
       if (lVar17 != 0) {
-        *(undefined8 *)(puVar26 + -2) = 0x140489cd6;
+        *(undefined8 *)(puVar22 + -2) = 0x140489d2a;
         ObpHandleRevocationBlockRemoveObject(lVar17);
       }
       if (ObpTraceFlags != 0) {
-        *(undefined8 *)(puVar26 + -2) = 0x140489ce7;
-        ObpDeregisterObject(plVar29);
-      }
-      *(undefined8 *)(puVar26 + -2) = 0x140489cf1;
-      ObpRemoveObjectRoutine(plVar29,0);
+        *(undefined8 *)(puVar22 + -2) = 0x140489d3b;
+        ObpDeregisterObject(plVar26);
+      }
+      *(undefined8 *)(puVar22 + -2) = 0x140489d45;
+      ObpRemoveObjectRoutine(plVar26,0);
     }
     else {
-      *(undefined8 *)(puVar26 + -2) = 0x140489cfc;
-      ObpDeferObjectDeletion(plVar29);
+      *(undefined8 *)(puVar22 + -2) = 0x140489d50;
+      ObpDeferObjectDeletion(plVar26);
     }
   }
 LAB_0:
-  *(undefined8 *)((longlong)puVar26 + -8) = 0x140271d79;
-  __security_check_cookie(*(ulonglong *)((longlong)puVar26 + 400) ^ (ulonglong)puVar26);
+  *(undefined8 *)((longlong)puVar22 + -8) = 0x140271b19;
+  __security_check_cookie(*(ulonglong *)((longlong)puVar22 + 400) ^ (ulonglong)puVar22);
   return;
 }

VrpBuildKeyPath

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type code,length,address,called
ratio 0.37
i_ratio 0.43
m_ratio 0.8
b_ratio 0.87
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name VrpBuildKeyPath VrpBuildKeyPath
fullname VrpBuildKeyPath VrpBuildKeyPath
refcount 10 10
length 201 242
called ExAllocatePool2
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlCopyUnicodeString		 ExAllocatePool2
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlCopyUnicodeString
RtlUShortAdd
calling VrpCreateNamespaceNode
VrpPostEnumerateKey
VrpPostOpenOrCreate
VrpPreLoadKey
VrpPreOpenOrCreate
VrpTranslatePath		 VrpCreateNamespaceNode
VrpPostEnumerateKey
VrpPostOpenOrCreate
VrpPreLoadKey
VrpPreOpenOrCreate
VrpTranslatePath
paramcount 0 0
address 1406cc0c8 1406cc6e8
sig undefined VrpBuildKeyPath(void) undefined VrpBuildKeyPath(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

VrpBuildKeyPath Called Diff

--- VrpBuildKeyPath called
+++ VrpBuildKeyPath called
@@ -4,0 +5 @@
+RtlUShortAdd

VrpBuildKeyPath Diff

--- VrpBuildKeyPath
+++ VrpBuildKeyPath
@@ -1,39 +1,43 @@
 
-undefined8 VrpBuildKeyPath(undefined8 *param_1,short *param_2,undefined2 *param_3)
+int VrpBuildKeyPath(undefined8 *param_1,short *param_2,undefined2 *param_3)
 
 {
-  longlong lVar1;
-  short sVar2;
-  undefined8 uVar3;
+  ushort uVar1;
+  int iVar2;
+  longlong lVar3;
   undefined8 *puVar4;
+  ushort *puVar5;
   undefined8 local_18;
   undefined8 local_10;
   
-  uVar3 = 0;
+  *param_3 = 0;
   local_18 = 0;
-  local_10 = 0;
   puVar4 = &local_18;
   if (param_1 != (undefined8 *)0x0) {
     puVar4 = param_1;
   }
-  *param_3 = 0;
-  sVar2 = *(ushort *)((longlong)puVar4 + 2) + *param_2 + 2;
-  param_3[1] = sVar2;
-  lVar1 = ExAllocatePool2(0x100,sVar2,0x67655256);
-  *(longlong *)(param_3 + 4) = lVar1;
-  if (lVar1 == 0) {
-    uVar3 = 0xc000009a;
+  local_10 = 0;
+  puVar5 = param_3 + 1;
+  uVar1 = *(ushort *)puVar4;
+  *puVar5 = uVar1;
+  iVar2 = RtlUShortAdd(uVar1,*param_2);
+  if ((iVar2 < 0) || (iVar2 = RtlUShortAdd(*puVar5,2), iVar2 < 0)) {
+    return -0x3ffffff3;
   }
-  else {
-    RtlCopyUnicodeString(param_3,puVar4);
-    if (*param_2 != 0) {
-      if ((**(short **)(param_2 + 4) != 0x5c) &&
-         (*(short *)(puVar4[1] + -2 + (ulonglong)(*(ushort *)puVar4 >> 1) * 2) != 0x5c)) {
-        RtlAppendUnicodeToString(param_3,&u__);
-      }
-      RtlAppendUnicodeStringToString(param_3,param_2);
-    }
+  lVar3 = ExAllocatePool2(0x100,*puVar5,0x67655256);
+  *(longlong *)(param_3 + 4) = lVar3;
+  if (lVar3 == 0) {
+    return -0x3fffff66;
   }
-  return uVar3;
+  RtlCopyUnicodeString(param_3,puVar4);
+  if (*param_2 == 0) {
+    return iVar2;
+  }
+  if ((**(short **)(param_2 + 4) != 0x5c) &&
+     (*(short *)(puVar4[1] + -2 + (ulonglong)(*(ushort *)puVar4 >> 1) * 2) != 0x5c)) {
+    RtlAppendUnicodeToString(param_3,&u__);
+  }
+  RtlAppendUnicodeStringToString(param_3,param_2);
+  return iVar2;
 }

WbCreateHeapExecutedBlock$filt$0

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type code,length,address
ratio 0.55
i_ratio 0.79
m_ratio 0.93
b_ratio 0.93
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name WbCreateHeapExecutedBlock$filt$0 WbCreateHeapExecutedBlock$filt$0
fullname WbCreateHeapExecutedBlock$filt$0 WbCreateHeapExecutedBlock$filt$0
refcount 1 1
length 57 43
called
calling
paramcount 0 0
address 14088b4e7 14088bef7
sig undefined WbCreateHeapExecutedBlock$filt$0(void) undefined WbCreateHeapExecutedBlock$filt$0(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

WbCreateHeapExecutedBlock$filt$0 Diff

--- WbCreateHeapExecutedBlock$filt$0
+++ WbCreateHeapExecutedBlock$filt$0
@@ -1,9 +1,8 @@
 
 bool WbCreateHeapExecutedBlock_filt_0(undefined8 param_1,longlong param_2)
 
 {
-  *(void **)(param_2 + 0x80) = SystemReserved1[15];
-  *(undefined *)(param_2 + 0x50) = *(undefined *)(*(longlong *)(param_2 + 0x80) + 0x232);
-  return *(char *)(param_2 + 0x50) != '\0';
+  *(undefined *)(param_2 + 0x54) = *(undefined *)((longlong)SystemReserved1[15] + 0x232);
+  return *(char *)(param_2 + 0x54) != '\0';
 }

CmSetValueKey

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type code,refcount,length,address,called
ratio 0.12
i_ratio 0.1
m_ratio 0.07
b_ratio 0.37
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name CmSetValueKey CmSetValueKey
fullname CmSetValueKey CmSetValueKey
refcount 3 4
length 3502 3278
called
Expand for full list:
CmAddLogForAction
CmpAddValueKeyNew
CmpAddValueToListEx
CmpAllocateUnitOfWork
CmpAttachToRegistryProcess
CmpCleanUpKcbCachedSymlink
CmpCloneKCBValueListForTrans
CmpCompareNewValueDataAgainstKCBCache
CmpDetachFromRegistryProcess
CmpDrainDelayDerefContext
CmpFindNameInListWithStatusCmpFreePoolWithTag
CmpFreeValue
CmpGetValueForAudit
CmpInitializeDelayDerefContext
CmpIsKeyDeletedForKeyBody
CmpIsKeyStackSymlink
CmpIsShutdownRundownActive
CmpIsValueTombstone
CmpLockIXLockExclusive
CmpLockIXLockIntent
CmpLockKcbStackShared
CmpLockKcbStackTopExclusiveRestShared
CmpLockRegistry
CmpLogTransactionAbortedWithChildName
CmpPromoteKey
CmpRemoveValueFromList
CmpReportNotifyForKcbStack
CmpRollbackTransactionArray
CmpRundownUnitOfWork
CmpSetValueKeyExisting
CmpSetValueKeyNew
CmpSignalDeferredPosts
CmpSnapshotKcbStackSecurity
CmpSnapshotTxOwnerArray
CmpStartKcbStackForTopLayerKcb
CmpSwapValueInList
CmpTransEnlistUowInCmTrans
CmpTransEnlistUowInKcb
CmpTransSearchAddTransFromKeyBody
CmpTryConvertKcbLockSharedToExclusive
CmpUnlockKcbStack
CmpUnlockRegistry
CmpUpdateKeyNodeAccessBits
ExFreePoolWithTag
ExfAcquirePushLockSharedEx
ExfReleasePushLockShared
HvFreeCell
HvpGetCellContextReinitialize
HvpGetCellFlat
HvpGetCellPaged
HvpMarkCellDirty
HvpReleaseCellFlat
HvpReleaseCellPaged
KeAbPostRelease
KeAbPreAcquire
RtlEqualUnicodeString
RtlIsSandboxedToken
SeAdtRegistryValueChangedAuditAlarm
SmFreeWrapper
__security_check_cookie
Expand for full list:
CmAddLogForAction
CmpAddValueKeyNew
CmpAddValueToListEx
CmpAllocateUnitOfWork
CmpAttachToRegistryProcess
CmpCleanUpKcbCachedSymlink
CmpCloneKCBValueListForTrans
CmpCompareNewValueDataAgainstKCBCache
CmpDetachFromRegistryProcess
CmpDrainDelayDerefContext
CmpFindNameInListWithStatusCmpFreePoolWithTag
CmpFreeValue
CmpGetValueForAudit
CmpInitializeDelayDerefContext
CmpIsKeyDeletedForKeyBody
CmpIsKeyStackSymlink
CmpIsShutdownRundownActive
CmpIsValueTombstone
CmpLockIXLockExclusive
CmpLockIXLockIntent
CmpLockKcbStackShared
CmpLockKcbStackTopExclusiveRestShared
CmpLockRegistry
CmpLogTransactionAbortedWithChildName
CmpPromoteKey
CmpRemoveValueFromList
CmpReportNotifyForKcbStack
CmpRollbackTransactionArray
CmpRundownUnitOfWork
CmpSetValueKeyExisting
CmpSetValueKeyNew
CmpSignalDeferredPosts
CmpSnapshotKcbStackSecurity
CmpSnapshotTxOwnerArray
CmpStartKcbStackForTopLayerKcb
CmpSwapValueInList
CmpTransEnlistUowInCmTrans
CmpTransEnlistUowInKcb
CmpTransSearchAddTransFromKeyBody
CmpTryConvertKcbLockSharedToExclusive
CmpUnlockKcbStack
CmpUnlockRegistry
CmpUpdateKeyNodeAccessBits
ExFreePoolWithTag
ExfAcquirePushLockSharedEx
ExfReleasePushLockShared
Feature_4256151870__private_IsEnabled
HvFreeCell
HvpGetBinContextInitialize
HvpGetCellFlat
HvpGetCellPaged
HvpMarkCellDirty
HvpReleaseCellFlat
HvpReleaseCellPaged
KeAbPostRelease
KeAbPreAcquire
RtlEqualUnicodeString
RtlIsSandboxedToken
SeAdtRegistryValueChangedAuditAlarm
SeCaptureSubjectContext
SeReleaseSubjectContext
SmFreeWrapper
__security_check_cookie
calling NtSetValueKey NtSetValueKey
paramcount 7 7
address 1406b44e0 1406b44d0
sig undefined CmSetValueKey(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5, undefined8 param_6, undefined1 param_7) undefined CmSetValueKey(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5, undefined8 param_6, undefined1 param_7)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

CmSetValueKey Called Diff

--- CmSetValueKey called
+++ CmSetValueKey called
@@ -47,0 +48 @@
+Feature_4256151870__private_IsEnabled
@@ -49 +50 @@
-HvpGetCellContextReinitialize
+HvpGetBinContextInitialize
@@ -59,0 +61,2 @@
+SeCaptureSubjectContext
+SeReleaseSubjectContext

CmSetValueKey Diff

--- CmSetValueKey
+++ CmSetValueKey
@@ -1,647 +1,672 @@
 
+/* WARNING: Type propagation algorithm not settling */
 /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
 
 void CmSetValueKey(int *param_1,ushort *param_2,int param_3,int *param_4,uint param_5,int *param_6,
                   char param_7)
 
 {
-  int *piVar1;
-  undefined8 uVar2;
+  char cVar1;
+  char cVar2;
   int iVar3;
-  void *pvVar4;
-  char cVar5;
-  char cVar6;
-  int iVar7;
-  undefined4 uVar8;
+  undefined4 uVar4;
+  int iVar5;
+  void *pvVar6;
+  longlong lVar7;
+  undefined8 uVar8;
   longlong lVar9;
-  undefined8 uVar10;
-  longlong lVar11;
+  int *piVar10;
+  void *pvVar11;
   void *pvVar12;
-  longlong lVar13;
-  longlong *plVar14;
-  longlong lVar15;
-  char cVar16;
-  char cVar17;
-  uint uVar18;
-  uint uVar19;
-  bool bVar20;
+  longlong *plVar13;
+  uint uVar14;
+  uint uVar15;
+  longlong lVar16;
+  bool bVar17;
+  bool bVar18;
   undefined4 extraout_XMM0_Da;
-  undefined auStack_1a8 [32];
-  undefined8 local_188;
-  undefined8 local_180;
-  undefined8 local_178;
+  undefined8 uVar19;
+  undefined4 extraout_XMM0_Dc;
+  undefined4 extraout_XMM0_Dd;
+  undefined auStack_1c8 [32];
+  undefined8 local_1a8;
+  undefined8 local_1a0;
+  undefined8 local_198;
+  uint local_190;
+  char local_188;
+  char local_187;
+  char local_186;
+  char local_185 [5];
+  int *local_180;
+  char local_178;
+  int local_174;
   uint local_170;
-  char local_168;
-  char local_167;
-  char local_166;
-  char local_165;
+  int local_16c;
+  int local_168;
   int local_164;
-  uint local_160;
-  int local_15c;
-  int local_158;
-  int local_154;
-  uint local_150;
-  undefined4 local_14c;
-  undefined8 local_148;
+  undefined8 local_160;
+  undefined4 local_158;
+  uint local_154;
+  undefined8 local_150;
+  ushort *local_148;
   longlong local_140;
-  int *local_138;
-  ushort *local_130;
-  longlong local_128;
-  undefined8 local_120 [2];
-  undefined local_110 [16];
-  undefined local_100 [16];
-  undefined4 local_f0;
-  int *local_e8;
-  undefined8 local_e0;
-  undefined8 ****local_d8;
-  undefined8 ****local_d0;
-  void *local_c8;
-  int *local_c0;
-  undefined local_b8 [16];
-  undefined local_a8 [16];
-  undefined local_98 [8];
-  undefined8 uStack_90;
-  undefined local_88 [16];
-  undefined local_78 [16];
-  undefined local_68 [16];
-  ulonglong local_58;
+  void *local_130;
+  undefined local_128 [16];
+  undefined local_118 [16];
+  undefined4 local_108;
+  int *local_100;
+  undefined8 local_f8;
+  undefined8 *******local_f0;
+  undefined8 *******local_e8;
+  void *local_e0;
+  int *local_d8;
+  undefined local_d0 [16];
+  undefined local_c0 [16];
+  undefined local_b0 [8];
+  undefined8 uStack_a8;
+  undefined local_a0 [16];
+  undefined local_90 [16];
+  undefined local_80 [16];
+  undefined local_70 [16];
+  undefined local_60 [16];
+  ulonglong local_50;
   
-  local_58 = __security_cookie ^ (ulonglong)auStack_1a8;
-  lVar13 = 0;
-  local_c0 = param_6;
-  local_d0 = &local_d8;
-  local_d8 = &local_d8;
-  local_14c = 0;
-  local_e0 = 0;
-  local_120[0] = 0;
-  local_164 = 0;
-  local_148 = 0;
-  local_88 = ZEXT816(0);
-  local_110._4_12_ = SUB1612(ZEXT816(0),4);
-  local_110._0_4_ = 0xffff0000;
-  local_78 = ZEXT816(0);
+  local_50 = __security_cookie ^ (ulonglong)auStack_1c8;
+  local_d8 = param_6;
+  local_e8 = &local_f0;
+  local_f0 = &local_f0;
+  pvVar12 = (void *)0x0;
+  local_128._4_12_ = SUB1612(ZEXT816(0),4);
+  local_128._0_4_ = 0xffff0000;
+  local_158 = 0;
+  local_f8 = 0;
+  local_174 = 0;
+  local_80 = ZEXT816(0);
+  local_130 = (void *)0x0;
+  local_70 = ZEXT816(0);
+  local_185[0] = '\0';
+  local_60 = ZEXT816(0);
+  local_108 = 0;
+  local_d0 = ZEXT816(0);
   local_140 = 0;
-  local_68 = ZEXT816(0);
-  local_165 = '\0';
-  local_b8 = ZEXT816(0);
-  local_f0 = 0;
-  local_100 = ZEXT816(0);
-  local_128 = 0;
-  local_158 = param_3;
-  local_138 = param_1;
-  local_130 = param_2;
-  local_e8 = param_4;
-  HvpGetCellContextReinitialize(local_120);
-  HvpGetCellContextReinitialize(&local_148);
-  CmpInitializeDelayDerefContext(local_b8);
-  local_154 = -1;
-  local_a8 = ZEXT816(0);
-  local_15c = -1;
-  _local_98 = ZEXT816(0);
-  local_c8 = (void *)0x0;
-  local_150 = 0;
-  local_166 = *(char *)((longlong)SystemReserved1[15] + 0x232);
-  CmpAttachToRegistryProcess(local_88);
-  cVar5 = CmpIsShutdownRundownActive();
-  local_160 = param_5;
-  uVar2 = _DAT_0;
-joined_r0x0001406b45f4:
-  _DAT_0 = uVar2;
-  if (cVar5 == '\0') {
+  local_a0 = ZEXT816(0);
+  local_150 = 0xffffffff;
+  local_90 = ZEXT816(0);
+  local_118 = ZEXT816(0);
+  pvVar6 = pvVar12;
+  local_180 = param_1;
+  local_168 = param_3;
+  local_148 = param_2;
+  local_100 = param_4;
+  HvpGetBinContextInitialize((longlong)&local_150 + 4);
+  local_160 = CONCAT44((int)((ulonglong)pvVar6 >> 0x20),0xffffffff);
+  HvpGetBinContextInitialize((longlong)&local_160 + 4);
+  uVar19 = CmpInitializeDelayDerefContext(local_d0);
+  local_c0._8_4_ = extraout_XMM0_Dc;
+  local_c0._0_8_ = uVar19;
+  local_c0._12_4_ = extraout_XMM0_Dd;
+  local_164 = -1;
+  unique0x100004a3 = extraout_XMM0_Dc;
+  local_b0 = (undefined  [8])uVar19;
+  unique0x100004a7 = extraout_XMM0_Dd;
+  local_16c = -1;
+  local_154 = (uint)pvVar6;
+  local_187 = *(char *)((longlong)SystemReserved1[15] + 0x232);
+  local_178 = (char)pvVar6;
+  local_e0 = pvVar6;
+  iVar3 = Feature_4256151870__private_IsEnabled();
+  if (iVar3 != 0) {
+    local_a0 = ZEXT816(0);
+    local_90 = ZEXT816(0);
+    SeCaptureSubjectContext(local_a0);
+    local_178 = '\x01';
+  }
+  CmpAttachToRegistryProcess(local_80);
+  cVar1 = CmpIsShutdownRundownActive();
+  local_170 = param_5;
+  pvVar6 = pvVar12;
+  do {
+    uVar19 = _DAT_0;
+    if (cVar1 != '\0') {
+      local_186 = '\0';
+      cVar2 = '\0';
+      iVar3 = -0x3ffffe77;
+      cVar1 = '\0';
+LAB_1:
+      piVar10 = local_180;
+      if (pvVar6 != (void *)0x0) {
+LAB_2:
+        piVar10 = local_180;
+        CmpRundownUnitOfWork(pvVar6);
+        ExFreePoolWithTag();
+      }
+LAB_3:
+      if (local_185[0] != '\0') {
+        if (*(int *)((longlong)pvVar12 + 0x11c) != -1) {
+          HvFreeCell();
+        }
+        *(undefined4 *)((longlong)pvVar12 + 0x11c) = 0xffffffff;
+        *(undefined4 *)((longlong)pvVar12 + 0x118) = 0;
+        *(undefined8 *)((longlong)pvVar12 + 0x120) = 0;
+      }
+      if (cVar2 != '\0') {
+        lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
+        LOCK();
+        bVar18 = *(longlong *)(lVar16 + 0x48) == 0x11;
+        if (bVar18) {
+          *(longlong *)(lVar16 + 0x48) = 0;
+        }
+        UNLOCK();
+        if (!bVar18) {
+          ExfReleasePushLockShared(lVar16 + 0x48);
+        }
+        KeAbPostRelease(lVar16 + 0x48);
+      }
+      if (cVar1 != '\0') {
+        CmpUnlockKcbStack(local_128);
+      }
+      pvVar12 = (void *)0x0;
+      CmpDrainDelayDerefContext(local_d0);
+      if (local_186 != '\0') {
+        CmpUnlockRegistry();
+      }
+      if ((undefined8 ********)local_f0 != &local_f0) {
+        CmpSignalDeferredPosts(&local_f0);
+      }
+      iVar5 = Feature_4256151870__private_IsEnabled();
+      if (iVar5 == 0) {
+        CmpDetachFromRegistryProcess(local_80);
+      }
+      else {
+        CmpDetachFromRegistryProcess(local_80);
+        if (local_178 != '\0') {
+          SeReleaseSubjectContext(local_a0);
+        }
+      }
+      pvVar6 = local_e0;
+      if (((-1 < iVar3) && (param_7 != '\0')) && (local_e0 != (void *)0x0)) {
+        local_b0._4_4_ = local_170;
+        local_b0._0_4_ = local_168;
+        uStack_a8 = local_100;
+        local_190 = local_154;
+        local_198 = (int *)local_c0;
+        local_1a0 = local_d8;
+        pvVar12 = local_e0;
+        local_1a8 = piVar10;
+        SeAdtRegistryValueChangedAuditAlarm(0,local_e0,0,local_148);
+      }
+      if (local_c0._8_8_ != 0) {
+        pvVar12 = (void *)0x34414d43;
+        CmpFreePoolWithTag();
+      }
+      if (pvVar6 != (void *)0x0) {
+        pvVar12 = (void *)0x33414d43;
+        CmpFreePoolWithTag(pvVar6);
+      }
+      if ((void *)local_118._8_8_ != (void *)0x0) {
+        SmFreeWrapper((void *)local_118._8_8_,pvVar12);
+      }
+      __security_check_cookie(local_50 ^ (ulonglong)auStack_1c8);
+      return;
+    }
     CmpLockRegistry();
-    lVar13 = *(longlong *)(param_1 + 2);
-    cVar5 = '\x01';
-    local_167 = '\x01';
-    if ((*(uint *)(*(longlong *)(lVar13 + 0x20) + 0xa0) & 0x100000) != 0) {
-      iVar7 = -0x3fffffde;
+    pvVar12 = *(void **)(param_1 + 2);
+    local_186 = '\x01';
+    if ((*(uint *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0xa0) & 0x100000) != 0) {
+      iVar3 = -0x3fffffde;
+LAB_4:
+      cVar2 = '\0';
+      cVar1 = '\0';
       goto LAB_1;
     }
-    iVar7 = CmpStartKcbStackForTopLayerKcb(local_110);
-    if (iVar7 < 0) goto LAB_1;
+    iVar3 = CmpStartKcbStackForTopLayerKcb();
+    if (iVar3 < 0) goto LAB_4;
     if ((*(longlong *)(param_1 + 0xe) == 0) && (*(longlong *)(param_1 + 0x10) == 0)) {
-      CmpLockKcbStackShared(local_110);
-      cVar5 = '\0';
+      CmpLockKcbStackShared(local_128);
+      bVar18 = false;
     }
     else {
-      CmpLockKcbStackTopExclusiveRestShared(local_110);
-    }
-    local_168 = '\x01';
-    if ((*(longlong *)(param_1 + 0xe) == 0) &&
-       (lVar15 = local_128, *(longlong *)(param_1 + 0x10) == 0)) {
-LAB_2:
-      do {
-        cVar6 = CmpIsKeyDeletedForKeyBody(param_1);
-        if (cVar6 != '\0') goto LAB_3;
-        if (*(char *)(lVar13 + 0x41) == '\x01') {
-          iVar7 = -0x3fffffde;
-          goto LAB_4;
-        }
-        if (lVar15 != 0) {
-          lVar9 = CmpAllocateUnitOfWork();
-          local_140 = lVar9;
-          if (lVar9 == 0) {
-            iVar7 = -0x3fffff66;
-            cVar17 = '\0';
-            cVar6 = local_168;
-            cVar5 = local_167;
-            goto LAB_5;
-          }
-          CmpTransEnlistUowInKcb(lVar9,lVar13);
-          iVar7 = CmpTransEnlistUowInCmTrans(lVar9,lVar15);
-          if (-1 < iVar7) {
-            cVar6 = CmpLockIXLockIntent(lVar13 + 0xf8,lVar9);
-            if ((cVar6 != '\0') &&
-               (cVar6 = CmpLockIXLockExclusive(lVar13 + 0x108,lVar9,1), cVar6 != '\0')) {
-              plVar14 = (longlong *)(*(longlong *)(lVar13 + 0x20) + 0x48);
-              lVar9 = KeAbPreAcquire(plVar14,0,0);
+      CmpLockKcbStackTopExclusiveRestShared(local_128);
+      bVar18 = true;
+    }
+    cVar1 = '\x01';
+    local_188 = '\x01';
+    if ((*(longlong *)(param_1 + 0xe) != 0) ||
+       (lVar16 = local_140, *(longlong *)(param_1 + 0x10) != 0)) {
+      cVar2 = CmpIsKeyDeletedForKeyBody();
+      if (cVar2 == '\0') {
+        iVar3 = CmpTransSearchAddTransFromKeyBody();
+        if (-1 < iVar3) {
+          lVar16 = local_140;
+          if ((*(uint *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0xa0) & 2) == 0)
+          goto LAB_5;
+          iVar3 = -0x3fe6ffff;
+        }
+LAB_6:
+        cVar2 = '\0';
+      }
+      else {
+        cVar2 = '\0';
+        iVar3 = -0x3ffffbdb;
+        if ((*(byte *)(local_180 + 0xc) & 1) == 0) {
+          iVar3 = -0x3ffffe84;
+        }
+      }
+      goto LAB_1;
+    }
+LAB_5:
+    while( true ) {
+      cVar1 = CmpIsKeyDeletedForKeyBody();
+      if (cVar1 != '\0') {
+        cVar2 = '\0';
+        iVar3 = -0x3ffffbdb;
+        cVar1 = local_188;
+        if ((*(byte *)(local_180 + 0xc) & 1) == 0) {
+          iVar3 = -0x3ffffe84;
+        }
+        goto LAB_1;
+      }
+      if (*(char *)((longlong)pvVar12 + 0x41) == '\x01') {
+        iVar3 = -0x3fffffde;
+        goto LAB_7;
+      }
+      if (lVar16 != 0) {
+        pvVar6 = (void *)CmpAllocateUnitOfWork();
+        local_130 = pvVar6;
+        if (pvVar6 == (void *)0x0) {
+          iVar3 = -0x3fffff66;
+          cVar2 = '\0';
+          piVar10 = local_180;
+          cVar1 = local_188;
+          goto LAB_3;
+        }
+        CmpTransEnlistUowInKcb(pvVar6,pvVar12);
+        iVar3 = CmpTransEnlistUowInCmTrans(pvVar6,lVar16);
+        if (-1 < iVar3) {
+          cVar1 = CmpLockIXLockIntent((longlong)pvVar12 + 0xf8,pvVar6);
+          if ((cVar1 != '\0') &&
+             (cVar1 = CmpLockIXLockExclusive((longlong)pvVar12 + 0x108,pvVar6,1), cVar1 != '\0')) {
+            plVar13 = (longlong *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x48);
+            lVar7 = KeAbPreAcquire(plVar13,0,0);
+            LOCK();
+            lVar16 = *plVar13;
+            if (lVar16 == 0) {
+              *plVar13 = 0x11;
+            }
+            UNLOCK();
+            if (lVar16 != 0) {
+              ExfAcquirePushLockSharedEx(plVar13,0,lVar7,plVar13);
+            }
+            if (lVar7 != 0) {
+              *(undefined *)(lVar7 + 0x12) = 1;
+            }
+            cVar2 = '\x01';
+            iVar3 = CmpCloneKCBValueListForTrans(pvVar12,local_140,local_185);
+            cVar1 = local_188;
+            if (-1 < iVar3) {
+              lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
               LOCK();
-              lVar15 = *plVar14;
-              if (lVar15 == 0) {
-                *plVar14 = 0x11;
+              bVar17 = *(longlong *)(lVar16 + 0x48) == 0x11;
+              if (bVar17) {
+                *(longlong *)(lVar16 + 0x48) = 0;
               }
               UNLOCK();
-              if (lVar15 != 0) {
-                ExfAcquirePushLockSharedEx(plVar14,0,lVar9,plVar14);
+              if (!bVar17) {
+                ExfReleasePushLockShared(lVar16 + 0x48);
               }
-              if (lVar9 != 0) {
-                *(undefined *)(lVar9 + 0x12) = 1;
-              }
-              cVar17 = '\x01';
-              iVar7 = CmpCloneKCBValueListForTrans(lVar13,local_128,&local_165);
-              if (-1 < iVar7) {
-                lVar15 = *(longlong *)(lVar13 + 0x20);
-                LOCK();
-                bVar20 = *(longlong *)(lVar15 + 0x48) == 0x11;
-                if (bVar20) {
-                  *(longlong *)(lVar15 + 0x48) = 0;
-                }
-                UNLOCK();
-                if (!bVar20) {
-                  ExfReleasePushLockShared(lVar15 + 0x48);
-                }
-                KeAbPostRelease(lVar15 + 0x48);
-                lVar15 = local_128;
-                goto LAB_6;
-              }
-              cVar5 = '\x01';
-              cVar6 = local_168;
-              goto LAB_7;
-            }
-            iVar7 = -0x3fe6ffff;
-          }
-          cVar17 = '\0';
-          cVar5 = local_167;
-          cVar6 = local_168;
-          goto LAB_7;
-        }
-        if (*(int *)(lVar13 + 0xf8) < 0) {
-          iVar7 = CmpSnapshotTxOwnerArray((int *)(lVar13 + 0xf8),&local_14c,&local_e0);
-          uVar8 = local_14c;
-          if (iVar7 < 0) goto LAB_4;
-          pvVar12 = (void *)0x0;
-          local_188 = (int *)CONCAT44(local_188._4_4_,local_14c);
-          CmpLogTransactionAbortedWithChildName(lVar13,0,1);
-          CmpUnlockKcbStack(local_110);
-          if ((void *)local_100._8_8_ != (void *)0x0) {
-            SmFreeWrapper((void *)local_100._8_8_,pvVar12);
-          }
-          local_110._4_12_ = SUB1612(ZEXT816(0),4);
-          local_110._0_4_ = 0xffff0000;
-          local_100 = ZEXT816(0);
-          CmpUnlockRegistry();
-          cVar5 = '\0';
-          iVar7 = CmpRollbackTransactionArray(uVar8);
-          if (-1 < iVar7) goto LAB_8;
-          goto LAB_1;
-        }
-        if (*(int *)(lVar13 + 0x108) != 0) goto LAB_9;
-LAB_6:
-        cVar17 = '\0';
-        cVar6 = CmpIsKeyStackSymlink(local_110);
-        if (cVar6 != '\0') {
-          if ((((local_158 == 6) && ((local_160 & 1) == 0)) && (local_160 < 0x10000)) &&
-             (local_130 != (ushort *)0x0)) {
-            cVar6 = RtlEqualUnicodeString(&CmSymbolicLinkValueName,local_130,1);
-            if ((cVar6 != '\0') && (cVar6 = RtlIsSandboxedToken(0), cVar6 == '\0'))
-            goto LAB_10;
-          }
-          iVar7 = -0x3fffffde;
-          cVar5 = local_167;
-          cVar6 = local_168;
-          goto LAB_11;
-        }
+              KeAbPostRelease(lVar16 + 0x48);
+              lVar16 = local_140;
+              goto LAB_8;
+            }
+            goto LAB_2;
+          }
+          iVar3 = -0x3fe6ffff;
+        }
+        cVar2 = '\0';
+        cVar1 = local_188;
+        goto LAB_2;
+      }
+      piVar10 = (int *)((longlong)pvVar12 + 0xf8);
+      if ((*piVar10 < 0) || (piVar10 = (int *)((longlong)pvVar12 + 0x108), *piVar10 != 0)) break;
+LAB_8:
+      cVar2 = '\0';
+      cVar1 = CmpIsKeyStackSymlink();
+      uVar14 = local_170;
+      if (cVar1 != '\0') {
+        if ((((local_168 == 6) && ((local_170 & 1) == 0)) && (local_170 < 0x10000)) &&
+           ((local_148 != (ushort *)0x0 &&
+            (cVar1 = RtlEqualUnicodeString(&CmSymbolicLinkValueName,local_148,1), cVar1 != '\0'))))
+        {
+          iVar3 = Feature_4256151870__private_IsEnabled();
+          if (iVar3 == 0) {
+            cVar1 = RtlIsSandboxedToken();
+          }
+          else {
+            cVar1 = RtlIsSandboxedToken();
+          }
+          if (cVar1 == '\0') goto LAB_9;
+        }
+        iVar3 = -0x3fffffde;
+        cVar1 = local_188;
+        goto LAB_1;
+      }
+LAB_9:
+      if (*(int *)((longlong)pvVar12 + 0x28) == -1) {
+        CmpUnlockKcbStack(local_128);
+        local_188 = '\0';
+        iVar3 = CmpPromoteKey();
+        cVar1 = local_188;
+        if (iVar3 < 0) goto LAB_1;
+        bVar18 = true;
+        local_188 = '\x01';
+        param_1 = local_180;
+      }
+      else {
+        if (bVar18) {
 LAB_10:
-        if (*(int *)(lVar13 + 0x28) != -1) {
-          if (cVar5 == '\0') {
-            local_188 = (int *)CONCAT44(local_188._4_4_,local_160);
-            iVar7 = CmpCompareNewValueDataAgainstKCBCache(lVar13,local_130,local_158,local_e8);
-            if (iVar7 == 1) {
-              CmpUnlockKcbStack(local_110);
-              CmpLockKcbStackTopExclusiveRestShared(local_110);
-              goto LAB_2;
-            }
-            if (iVar7 == 0) {
-              iVar7 = 0;
-              cVar5 = local_167;
-              cVar6 = local_168;
-              goto LAB_11;
-            }
-            cVar5 = '\x01';
-            if ((*(void **)(lVar13 + 0x38) != SystemReserved1[15]) &&
-               (cVar6 = CmpTryConvertKcbLockSharedToExclusive(lVar13), cVar6 == '\0')) {
-              CmpUnlockKcbStack(local_110);
-              CmpLockKcbStackTopExclusiveRestShared(local_110);
-              lVar15 = local_128;
-              goto LAB_2;
-            }
-          }
-          *(longlong *)(lVar13 + 0x130) = *(longlong *)(lVar13 + 0x130) + 1;
-          plVar14 = (longlong *)(*(longlong *)(lVar13 + 0x20) + 0x48);
-          lVar9 = KeAbPreAcquire(plVar14,0,0);
+          *(longlong *)((longlong)pvVar12 + 0x130) = *(longlong *)((longlong)pvVar12 + 0x130) + 1;
+          plVar13 = (longlong *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x48);
+          lVar7 = KeAbPreAcquire(plVar13,0,0);
           LOCK();
-          lVar15 = *plVar14;
-          if (lVar15 == 0) {
-            *plVar14 = 0x11;
+          lVar16 = *plVar13;
+          if (lVar16 == 0) {
+            *plVar13 = 0x11;
           }
           UNLOCK();
-          if (lVar15 != 0) {
-            ExfAcquirePushLockSharedEx(plVar14,0,lVar9,plVar14);
-          }
-          lVar15 = local_128;
-          if (lVar9 != 0) {
-            *(undefined *)(lVar9 + 0x12) = 1;
-          }
-          cVar16 = '\x01';
-          cVar17 = '\x01';
-          local_166 = '\x01';
-          if ((local_128 != 0) ||
-             (iVar7 = HvpMarkCellDirty(*(undefined8 *)(lVar13 + 0x20),*(undefined4 *)(lVar13 + 0x28)
-                                       ,0,0), cVar5 = local_167, cVar6 = local_168, -1 < iVar7)) {
-            if ((*(byte *)(*(longlong *)(lVar13 + 0x20) + 0x8c) & 1) == 0) {
-              lVar9 = HvpGetCellPaged();
+          if (lVar16 != 0) {
+            ExfAcquirePushLockSharedEx(plVar13,0,lVar7,plVar13);
+          }
+          lVar16 = local_140;
+          if (lVar7 != 0) {
+            *(undefined *)(lVar7 + 0x12) = 1;
+          }
+          cVar2 = '\x01';
+          local_187 = '\x01';
+          if ((local_140 != 0) ||
+             (iVar3 = HvpMarkCellDirty(*(undefined8 *)((longlong)pvVar12 + 0x20),
+                                       *(undefined4 *)((longlong)pvVar12 + 0x28),0,0),
+             cVar1 = local_188, -1 < iVar3)) {
+            if ((*(byte *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x8c) & 1) == 0) {
+              lVar7 = HvpGetCellPaged(*(longlong *)((longlong)pvVar12 + 0x20),
+                                      *(undefined4 *)((longlong)pvVar12 + 0x28),&local_150);
             }
             else {
-              lVar9 = HvpGetCellFlat(*(longlong *)(lVar13 + 0x20),*(undefined4 *)(lVar13 + 0x28),
-                                     local_120);
+              lVar7 = HvpGetCellFlat();
             }
             CmpUpdateKeyNodeAccessBits
-                      (*(undefined8 *)(lVar13 + 0x20),lVar9,*(undefined4 *)(lVar13 + 0x28));
-            local_180 = &local_154;
-            local_188 = &local_164;
-            cVar17 = cVar16;
-            if (lVar15 == 0) {
-              iVar7 = CmpFindNameInListWithStatus
-                                (*(undefined8 *)(lVar13 + 0x20),lVar9 + 0x24,local_130,0);
-              if ((iVar7 + 0x80000000U & 0x80000000) != 0) goto LAB_12;
-LAB_13:
-              if (iVar7 == -0x3fffffcc) goto LAB_12;
-            }
-            else {
-              iVar7 = CmpFindNameInListWithStatus
-                                (*(undefined8 *)(lVar13 + 0x20),lVar13 + 0x118,local_130,0);
-              if ((iVar7 + 0x80000000U & 0x80000000) == 0) goto LAB_13;
-LAB_12:
-              iVar3 = local_154;
+                      (*(undefined8 *)((longlong)pvVar12 + 0x20),lVar7,
+                       *(undefined4 *)((longlong)pvVar12 + 0x28));
+            local_1a0 = &local_164;
+            lVar9 = (longlong)pvVar12 + 0x118;
+            local_1a8 = &local_174;
+            if (lVar16 == 0) {
+              lVar9 = lVar7 + 0x24;
+            }
+            iVar3 = CmpFindNameInListWithStatus
+                              (*(undefined8 *)((longlong)pvVar12 + 0x20),lVar9,local_148,0);
+            iVar5 = local_164;
+            if (((iVar3 + 0x80000000U & 0x80000000) != 0) || (iVar3 == -0x3fffffcc)) {
+              uVar14 = local_154;
               if (param_7 != '\0') {
-                iVar7 = CmpSnapshotKcbStackSecurity(local_110,lVar15,0x33414d43,&local_c8);
-                param_1 = local_138;
-                if (iVar7 < 0) goto LAB_14;
-                if (iVar3 == -1) {
-                  local_150 = 0;
+                iVar3 = CmpSnapshotKcbStackSecurity(local_128,lVar16,0x33414d43,&local_e0);
+                cVar2 = local_187;
+                if (iVar3 < 0) goto LAB_11;
+                if (iVar5 == -1) {
+                  local_154 = 0;
+                  uVar14 = local_154;
                 }
                 else {
-                  if ((*(byte *)(*(longlong *)(lVar13 + 0x20) + 0x8c) & 1) == 0) {
-                    uVar10 = HvpGetCellPaged(*(longlong *)(lVar13 + 0x20),iVar3,&local_148);
+                  if ((*(byte *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x8c) & 1) == 0) {
+                    uVar8 = HvpGetCellPaged(*(longlong *)((longlong)pvVar12 + 0x20),iVar5,&local_160
+                                           );
                   }
                   else {
-                    uVar10 = HvpGetCellFlat();
-                  }
-                  lVar11 = *(longlong *)(lVar13 + 0x20);
-                  cVar5 = CmpIsValueTombstone(lVar11,uVar10);
-                  local_150 = (uint)(cVar5 == '\0');
-                  if ((*(byte *)(lVar11 + 0x8c) & 1) == 0) {
-                    HvpReleaseCellPaged(extraout_XMM0_Da,&local_148);
+                    uVar8 = HvpGetCellFlat();
+                  }
+                  lVar9 = *(longlong *)((longlong)pvVar12 + 0x20);
+                  cVar1 = CmpIsValueTombstone(lVar9,uVar8);
+                  uVar14 = (uint)(cVar1 == '\0');
+                  local_154 = uVar14;
+                  if ((*(byte *)(lVar9 + 0x8c) & 1) == 0) {
+                    HvpReleaseCellPaged(extraout_XMM0_Da,&local_160);
                   }
                   else {
                     HvpReleaseCellFlat();
                   }
-                  if ((cVar5 == '\0') &&
-                     (iVar7 = CmpGetValueForAudit(*(undefined8 *)(lVar13 + 0x20),iVar3,local_a8,
-                                                  0x34414d43), param_1 = local_138, iVar7 < 0))
-                  goto LAB_14;
+                  if ((cVar1 == '\0') &&
+                     (iVar3 = CmpGetValueForAudit(*(undefined8 *)((longlong)pvVar12 + 0x20),iVar5,
+                                                  local_c0,0x34414d43), cVar2 = local_187, iVar3 < 0
+                     )) goto LAB_11;
                 }
               }
-              uVar19 = local_160;
-              lVar11 = *(longlong *)(lVar13 + 0x20);
-              uVar18 = *(uint *)(lVar13 + 0x28) >> 0x1f;
-              if (lVar15 == 0) {
-                if (iVar3 == -1) {
-                  local_178 = (int *)CONCAT44(local_178._4_4_,local_160);
-                  local_180 = local_e8;
-                  local_188 = (int *)CONCAT44(local_188._4_4_,local_158);
-                  local_170 = uVar18;
-                  iVar7 = CmpSetValueKeyNew(lVar11,lVar9,local_130,local_164);
+              local_154 = uVar14;
+              uVar14 = local_170;
+              uVar15 = *(uint *)((longlong)pvVar12 + 0x28) >> 0x1f;
+              if (lVar16 == 0) {
+                lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
+                if (iVar5 == -1) {
+                  local_198 = (int *)CONCAT44(local_198._4_4_,local_170);
+                  local_1a0 = local_100;
+                  local_1a8 = (int *)CONCAT44(local_1a8._4_4_,local_168);
+                  local_190 = uVar15;
+                  iVar3 = CmpSetValueKeyNew(lVar16,lVar7,local_148,local_174);
                 }
                 else {
-                  if ((*(byte *)(lVar11 + 0x8c) & 1) == 0) {
-                    uVar10 = HvpGetCellPaged();
+                  if ((*(byte *)(lVar16 + 0x8c) & 1) == 0) {
+                    uVar8 = HvpGetCellPaged(lVar16,iVar5,&local_160);
                   }
                   else {
-                    uVar10 = HvpGetCellFlat(lVar11,iVar3,&local_148);
-                  }
-                  uVar19 = local_160;
-                  local_178 = (int *)CONCAT44(local_178._4_4_,uVar18);
-                  local_180 = (int *)CONCAT44(local_180._4_4_,local_160);
-                  local_188 = local_e8;
-                  iVar7 = CmpSetValueKeyExisting
-                                    (*(undefined8 *)(lVar13 + 0x20),iVar3,uVar10,local_158);
-                  if ((*(byte *)(*(longlong *)(lVar13 + 0x20) + 0x8c) & 1) == 0) {
-                    HvpReleaseCellPaged();
+                    uVar8 = HvpGetCellFlat();
+                  }
+                  local_198 = (int *)CONCAT44(local_198._4_4_,uVar15);
+                  local_1a0 = (int *)CONCAT44(local_1a0._4_4_,local_170);
+                  local_1a8 = local_100;
+                  iVar3 = CmpSetValueKeyExisting
+                                    (*(undefined8 *)((longlong)pvVar12 + 0x20),iVar5,uVar8,local_168
+                                    );
+                  if ((*(byte *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x8c) & 1) == 0) {
+                    HvpReleaseCellPaged(*(longlong *)((longlong)pvVar12 + 0x20),&local_160);
+                    uVar14 = local_170;
                   }
                   else {
-                    HvpReleaseCellFlat(*(longlong *)(lVar13 + 0x20),&local_148);
+                    HvpReleaseCellFlat();
+                    uVar14 = local_170;
                   }
                 }
-                param_1 = local_138;
-                cVar17 = local_166;
-                if (-1 < iVar7) {
-                  if (*(uint *)(lVar9 + 0x3c) < (uint)*local_130) {
-                    *(uint *)(lVar9 + 0x3c) = (uint)*local_130;
-                    *(ushort *)(lVar13 + 0xb2) = *local_130;
-                  }
-                  if (*(uint *)(lVar9 + 0x40) < uVar19) {
-                    *(uint *)(lVar9 + 0x40) = uVar19;
-                    *(uint *)(lVar13 + 0xb4) = uVar19;
-                  }
-                  *(undefined8 *)(lVar9 + 4) = uVar2;
-                  *(undefined8 *)(lVar13 + 0xa8) = uVar2;
-                  CmpCleanUpKcbCachedSymlink(lVar13,local_b8);
-                  uVar8 = *(undefined4 *)(lVar9 + 0x28);
-                  lVar15 = *(longlong *)(lVar13 + 0x20);
-                  *(undefined4 *)(lVar13 + 0x60) = *(undefined4 *)(lVar9 + 0x24);
-                  *(undefined4 *)(lVar13 + 100) = uVar8;
+                cVar2 = local_187;
+                if (-1 < iVar3) {
+                  if (*(uint *)(lVar7 + 0x3c) < (uint)*local_148) {
+                    *(uint *)(lVar7 + 0x3c) = (uint)*local_148;
+                    *(ushort *)((longlong)pvVar12 + 0xb2) = *local_148;
+                  }
+                  if (*(uint *)(lVar7 + 0x40) < uVar14) {
+                    *(uint *)(lVar7 + 0x40) = uVar14;
+                    *(uint *)((longlong)pvVar12 + 0xb4) = uVar14;
+                  }
+                  *(undefined8 *)(lVar7 + 4) = uVar19;
+                  *(undefined8 *)((longlong)pvVar12 + 0xa8) = uVar19;
+                  CmpCleanUpKcbCachedSymlink(pvVar12,local_d0);
+                  uVar4 = *(undefined4 *)(lVar7 + 0x28);
+                  lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
+                  *(undefined4 *)((longlong)pvVar12 + 0x60) = *(undefined4 *)(lVar7 + 0x24);
+                  *(undefined4 *)((longlong)pvVar12 + 100) = uVar4;
                   LOCK();
-                  bVar20 = *(longlong *)(lVar15 + 0x48) == 0x11;
-                  if (bVar20) {
-                    *(longlong *)(lVar15 + 0x48) = 0;
+                  bVar18 = *(longlong *)(lVar16 + 0x48) == 0x11;
+                  if (bVar18) {
+                    *(longlong *)(lVar16 + 0x48) = 0;
                   }
                   UNLOCK();
-                  if (!bVar20) {
-                    ExfReleasePushLockShared(lVar15 + 0x48);
-                  }
-                  KeAbPostRelease(lVar15 + 0x48);
-LAB_15:
-                  iVar7 = 0;
-                  local_15c = -1;
-                  local_140 = 0;
-                  local_165 = '\0';
-                  CmpReportNotifyForKcbStack(local_110,local_128,4,&local_d8);
-                  param_1 = local_138;
-                  cVar17 = '\0';
+                  if (!bVar18) {
+                    ExfReleasePushLockShared(lVar16 + 0x48);
+                  }
+                  KeAbPostRelease(lVar16 + 0x48);
+LAB_12:
+                  iVar3 = 0;
+                  local_16c = -1;
+                  local_130 = (void *)0x0;
+                  local_185[0] = '\0';
+                  CmpReportNotifyForKcbStack(local_128,local_140,4,&local_f0);
+                  cVar2 = '\0';
                 }
               }
               else {
-                local_178 = &local_15c;
-                local_180 = (int *)CONCAT44(local_180._4_4_,1);
-                local_188 = (int *)CONCAT44(local_188._4_4_,local_160);
-                iVar7 = CmpAddValueKeyNew(lVar11,local_130,local_158,local_e8);
-                param_1 = local_138;
-                cVar17 = local_166;
-                if (-1 < iVar7) {
-                  piVar1 = (int *)(lVar13 + 0x118);
-                  if (iVar3 == -1) {
-                    local_164 = *piVar1;
-                    local_180 = (int *)CONCAT44(local_180._4_4_,1);
-                    local_188 = piVar1;
-                    iVar7 = CmpAddValueToListEx(*(undefined8 *)(lVar13 + 0x20),local_15c,local_164,1
-                                               );
-                    param_1 = local_138;
-                    cVar17 = local_166;
-                    if (iVar7 < 0) goto LAB_14;
+                local_198 = &local_16c;
+                local_1a0 = (int *)CONCAT44(local_1a0._4_4_,1);
+                local_1a8 = (int *)CONCAT44(local_1a8._4_4_,local_170);
+                iVar3 = CmpAddValueKeyNew(*(undefined8 *)((longlong)pvVar12 + 0x20),local_148,
+                                          local_168,local_100);
+                cVar2 = local_187;
+                if (-1 < iVar3) {
+                  piVar10 = (int *)((longlong)pvVar12 + 0x118);
+                  if (iVar5 == -1) {
+                    local_174 = *piVar10;
+                    local_1a0 = (int *)CONCAT44(local_1a0._4_4_,1);
+                    local_1a8 = piVar10;
+                    iVar3 = CmpAddValueToListEx(*(undefined8 *)((longlong)pvVar12 + 0x20),local_16c,
+                                                local_174,1);
+                    cVar2 = local_187;
+                    if (iVar3 < 0) goto LAB_11;
                   }
                   else {
-                    CmpSwapValueInList(*(undefined8 *)(lVar13 + 0x20),local_15c,local_164,piVar1);
-                  }
-                  lVar15 = *(longlong *)(lVar13 + 0x20);
+                    CmpSwapValueInList(*(undefined8 *)((longlong)pvVar12 + 0x20),local_16c,local_174
+                                       ,piVar10);
+                  }
+                  lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
                   LOCK();
-                  bVar20 = *(longlong *)(lVar15 + 0x48) == 0x11;
-                  if (bVar20) {
-                    *(longlong *)(lVar15 + 0x48) = 0;
+                  bVar18 = *(longlong *)(lVar16 + 0x48) == 0x11;
+                  if (bVar18) {
+                    *(longlong *)(lVar16 + 0x48) = 0;
                   }
                   UNLOCK();
-                  if (!bVar20) {
-                    ExfReleasePushLockShared(lVar15 + 0x48);
-                  }
-                  KeAbPostRelease(lVar15 + 0x48);
-                  if (local_154 == -1) {
-                    uVar8 = 4;
+                  if (!bVar18) {
+                    ExfReleasePushLockShared(lVar16 + 0x48);
+                  }
+                  KeAbPostRelease(lVar16 + 0x48);
+                  if (local_164 == -1) {
+                    uVar4 = 4;
                   }
                   else {
-                    *(int *)(local_140 + 0x58) = local_154;
-                    uVar8 = 5;
-                  }
-                  *(undefined4 *)(local_140 + 0x44) = uVar8;
-                  *(int *)(local_140 + 0x5c) = local_15c;
-                  *(uint *)(local_140 + 0x48) = uVar18;
-                  iVar7 = CmAddLogForAction(local_140,1);
-                  if (-1 < iVar7) goto LAB_15;
-                  if (lVar9 != 0) {
-                    if ((*(byte *)(*(longlong *)(lVar13 + 0x20) + 0x8c) & 1) == 0) {
-                      HvpReleaseCellPaged(*(longlong *)(lVar13 + 0x20),local_120);
+                    *(int *)((longlong)local_130 + 0x58) = local_164;
+                    uVar4 = 5;
+                  }
+                  *(undefined4 *)((longlong)local_130 + 0x44) = uVar4;
+                  *(int *)((longlong)local_130 + 0x5c) = local_16c;
+                  *(uint *)((longlong)local_130 + 0x48) = uVar15;
+                  iVar3 = CmAddLogForAction(local_130,1);
+                  if (-1 < iVar3) goto LAB_12;
+                  if (lVar7 != 0) {
+                    lVar7 = 0;
+                    if ((*(byte *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x8c) & 1) == 0) {
+                      HvpReleaseCellPaged(*(longlong *)((longlong)pvVar12 + 0x20),&local_150);
                     }
                     else {
                       HvpReleaseCellFlat();
                     }
-                    lVar9 = 0;
-                  }
-                  plVar14 = (longlong *)(*(longlong *)(lVar13 + 0x20) + 0x48);
-                  lVar11 = KeAbPreAcquire(plVar14,0,0);
+                  }
+                  plVar13 = (longlong *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x48);
+                  lVar9 = KeAbPreAcquire(plVar13,0,0);
                   LOCK();
-                  lVar15 = *plVar14;
-                  if (lVar15 == 0) {
-                    *plVar14 = 0x11;
+                  lVar16 = *plVar13;
+                  if (lVar16 == 0) {
+                    *plVar13 = 0x11;
                   }
                   UNLOCK();
-                  if (lVar15 != 0) {
-                    ExfAcquirePushLockSharedEx(plVar14,0,lVar11,plVar14);
-                  }
-                  if (lVar11 != 0) {
-                    *(undefined *)(lVar11 + 0x12) = 1;
-                  }
-                  if (local_154 == -1) {
-                    CmpRemoveValueFromList(*(undefined8 *)(lVar13 + 0x20),local_164,piVar1);
+                  if (lVar16 != 0) {
+                    ExfAcquirePushLockSharedEx(plVar13,0,lVar9,plVar13);
+                  }
+                  if (lVar9 != 0) {
+                    *(undefined *)(lVar9 + 0x12) = 1;
+                  }
+                  if (local_164 == -1) {
+                    CmpRemoveValueFromList
+                              (*(undefined8 *)((longlong)pvVar12 + 0x20),local_174,piVar10);
                   }
                   else {
-                    CmpSwapValueInList(*(undefined8 *)(lVar13 + 0x20),local_154,local_164,piVar1);
-                  }
-                  lVar15 = *(longlong *)(lVar13 + 0x20);
+                    CmpSwapValueInList(*(undefined8 *)((longlong)pvVar12 + 0x20),local_164,local_174
+                                       ,piVar10);
+                  }
+                  lVar16 = *(longlong *)((longlong)pvVar12 + 0x20);
+                  plVar13 = (longlong *)(lVar16 + 0x48);
                   LOCK();
-                  bVar20 = *(longlong *)(lVar15 + 0x48) == 0x11;
-                  if (bVar20) {
-                    *(longlong *)(lVar15 + 0x48) = 0;
+                  bVar18 = *plVar13 == 0x11;
+                  if (bVar18) {
+                    *plVar13 = 0;
                   }
                   UNLOCK();
-                  if (!bVar20) {
-                    ExfReleasePushLockShared(lVar15 + 0x48);
-                  }
-                  KeAbPostRelease(lVar15 + 0x48);
-                  param_1 = local_138;
-                  cVar17 = '\0';
+                  if (!bVar18) {
+                    ExfReleasePushLockShared(lVar16 + 0x48);
+                  }
+                  KeAbPostRelease();
+                  cVar2 = '\0';
                 }
               }
             }
-LAB_14:
-            if (lVar9 != 0) {
-              if ((*(byte *)(*(longlong *)(lVar13 + 0x20) + 0x8c) & 1) == 0) {
-                HvpReleaseCellPaged();
+LAB_11:
+            if (lVar7 != 0) {
+              if ((*(byte *)(*(longlong *)((longlong)pvVar12 + 0x20) + 0x8c) & 1) == 0) {
+                HvpReleaseCellPaged(*(longlong *)((longlong)pvVar12 + 0x20),&local_150);
               }
               else {
-                HvpReleaseCellFlat(*(longlong *)(lVar13 + 0x20),local_120);
+                HvpReleaseCellFlat();
               }
             }
-            cVar5 = local_167;
-            cVar6 = local_168;
-            if (local_15c != -1) {
-              CmpFreeValue(*(undefined8 *)(lVar13 + 0x20));
-              cVar5 = local_167;
-              cVar6 = local_168;
-            }
-          }
-          goto LAB_11;
-        }
-        CmpUnlockKcbStack(local_110);
-        local_168 = '\0';
-        iVar7 = CmpPromoteKey(local_110,0,1);
-        cVar5 = local_167;
-        cVar6 = local_168;
-        if (iVar7 < 0) goto LAB_11;
-        local_168 = '\x01';
-        cVar5 = '\x01';
-      } while( true );
-    }
-    cVar6 = CmpIsKeyDeletedForKeyBody(param_1);
-    if (cVar6 == '\0') {
-      iVar7 = CmpTransSearchAddTransFromKeyBody(param_1);
-      if (-1 < iVar7) {
-        lVar15 = local_128;
-        if ((*(uint *)(*(longlong *)(lVar13 + 0x20) + 0xa0) & 2) == 0) goto LAB_2;
-        iVar7 = -0x3fe6ffff;
-      }
-      goto LAB_4;
-    }
-LAB_3:
-    cVar17 = '\0';
-    iVar7 = -0x3ffffbdb;
-    cVar5 = local_167;
-    cVar6 = local_168;
-    if ((*(byte *)(param_1 + 0xc) & 1) == 0) {
-      iVar7 = -0x3ffffe84;
-    }
-  }
-  else {
-    cVar17 = '\0';
-    iVar7 = -0x3ffffe77;
-    cVar5 = '\0';
-    cVar6 = '\0';
-  }
-  goto LAB_11;
-LAB_9:
-  iVar7 = CmpSnapshotTxOwnerArray((int *)(lVar13 + 0x108),&local_14c,&local_e0);
-  uVar8 = local_14c;
-  if (iVar7 < 0) {
-LAB_4:
-    cVar17 = '\0';
-    cVar5 = local_167;
-    cVar6 = local_168;
-    goto LAB_11;
-  }
-  pvVar12 = (void *)0x0;
-  local_188 = (int *)CONCAT44(local_188._4_4_,local_14c);
-  CmpLogTransactionAbortedWithChildName(lVar13,0,1);
-  CmpUnlockKcbStack(local_110);
-  if ((void *)local_100._8_8_ != (void *)0x0) {
-    SmFreeWrapper((void *)local_100._8_8_,pvVar12);
-  }
-  local_110._4_12_ = SUB1612(ZEXT816(0),4);
-  local_110._0_4_ = 0xffff0000;
-  local_100 = ZEXT816(0);
-  CmpUnlockRegistry();
-  cVar5 = '\0';
-  iVar7 = CmpRollbackTransactionArray(uVar8);
-  if (iVar7 < 0) {
-LAB_1:
-    cVar17 = '\0';
-    cVar6 = '\0';
-LAB_11:
-    if (local_140 != 0) {
+            pvVar6 = local_130;
+            cVar1 = local_188;
+            if (local_16c != -1) {
+              CmpFreeValue();
+              pvVar6 = local_130;
+              cVar1 = local_188;
+            }
+          }
+          goto LAB_1;
+        }
+        local_1a8 = (int *)CONCAT44(local_1a8._4_4_,uVar14);
+        iVar3 = CmpCompareNewValueDataAgainstKCBCache(pvVar12,local_148,local_168,local_100);
+        if (iVar3 == 1) {
+          CmpUnlockKcbStack(local_128);
+          CmpLockKcbStackTopExclusiveRestShared(local_128);
+          param_1 = local_180;
+        }
+        else {
+          if (iVar3 == 0) {
+            iVar3 = 0;
+            cVar1 = local_188;
+            goto LAB_1;
+          }
+          bVar18 = true;
+          if ((*(void **)((longlong)pvVar12 + 0x38) == SystemReserved1[15]) ||
+             (cVar1 = CmpTryConvertKcbLockSharedToExclusive(pvVar12), cVar1 != '\0'))
+          goto LAB_10;
+          CmpUnlockKcbStack(local_128);
+          CmpLockKcbStackTopExclusiveRestShared(local_128);
+          param_1 = local_180;
+          lVar16 = local_140;
+        }
+      }
+    }
+    iVar3 = CmpSnapshotTxOwnerArray(piVar10,&local_158,&local_f8);
+    if (iVar3 < 0) {
 LAB_7:
-      lVar15 = local_140;
-      CmpRundownUnitOfWork(local_140);
-      ExFreePoolWithTag(lVar15);
-    }
-LAB_5:
-    if (local_165 != '\0') {
-      if (*(int *)(lVar13 + 0x11c) != -1) {
-        HvFreeCell(*(undefined8 *)(lVar13 + 0x20));
-      }
-      *(undefined4 *)(lVar13 + 0x11c) = 0xffffffff;
-      *(undefined4 *)(lVar13 + 0x118) = 0;
-      *(undefined8 *)(lVar13 + 0x120) = 0;
-    }
-    if (cVar17 != '\0') {
-      lVar13 = *(longlong *)(lVar13 + 0x20);
-      LOCK();
-      bVar20 = *(longlong *)(lVar13 + 0x48) == 0x11;
-      if (bVar20) {
-        *(longlong *)(lVar13 + 0x48) = 0;
-      }
-      UNLOCK();
-      if (!bVar20) {
-        ExfReleasePushLockShared(lVar13 + 0x48);
-      }
-      KeAbPostRelease(lVar13 + 0x48);
-    }
-    if (cVar6 != '\0') {
-      CmpUnlockKcbStack(local_110);
-    }
-    pvVar12 = (void *)0x0;
-    CmpDrainDelayDerefContext(local_b8);
-    if (cVar5 != '\0') {
-      CmpUnlockRegistry();
-    }
-    if ((undefined8 *****)local_d8 != &local_d8) {
-      CmpSignalDeferredPosts(&local_d8);
-    }
-    CmpDetachFromRegistryProcess(local_88);
-    pvVar4 = local_c8;
-    if (((-1 < iVar7) && (param_7 != '\0')) && (local_c8 != (void *)0x0)) {
-      local_98._4_4_ = local_160;
-      local_98._0_4_ = local_158;
-      uStack_90 = local_e8;
-      local_170 = local_150;
-      local_180 = local_c0;
-      pvVar12 = local_c8;
-      local_188 = param_1;
-      local_178 = (int *)local_a8;
-      SeAdtRegistryValueChangedAuditAlarm(0,local_c8,0,local_130);
-    }
-    if (local_a8._8_8_ != 0) {
-      pvVar12 = (void *)0x34414d43;
-      CmpFreePoolWithTag();
-    }
-    if (pvVar4 != (void *)0x0) {
-      pvVar12 = (void *)0x33414d43;
-      CmpFreePoolWithTag(pvVar4);
-    }
-    if ((void *)local_100._8_8_ != (void *)0x0) {
-      SmFreeWrapper((void *)local_100._8_8_,pvVar12);
-    }
-    __security_check_cookie(local_58 ^ (ulonglong)auStack_1a8);
-    return;
-  }
-LAB_8:
-  cVar5 = CmpIsShutdownRundownActive();
-  uVar2 = _DAT_0;
-  goto joined_r0x0001406b45f4;
+      cVar2 = '\0';
+      cVar1 = local_188;
+      goto LAB_1;
+    }
+    pvVar11 = (void *)0x0;
+    local_1a8 = (int *)CONCAT44(local_1a8._4_4_,local_158);
+    CmpLogTransactionAbortedWithChildName(pvVar12);
+    CmpUnlockKcbStack(local_128);
+    cVar1 = '\0';
+    if ((void *)local_118._8_8_ != (void *)0x0) {
+      SmFreeWrapper((void *)local_118._8_8_,pvVar11);
+    }
+    local_128._4_12_ = SUB1612(ZEXT816(0),4);
+    local_128._0_4_ = 0xffff0000;
+    local_118 = ZEXT816(0);
+    CmpUnlockRegistry();
+    local_186 = '\0';
+    iVar3 = CmpRollbackTransactionArray();
+    if (iVar3 < 0) goto LAB_6;
+    cVar1 = CmpIsShutdownRundownActive();
+  } while( true );
 }

WbCreateHeapExecutedBlock

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type code,name,fullname,refcount,length,sig,address,called
ratio 0.36
i_ratio 0.32
m_ratio 0.26
b_ratio 0.6
match_types Implied Match

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name WbCreateHeapExecutedBlock FUN_14070897c
fullname WbCreateHeapExecutedBlock FUN_14070897c
refcount 3 2
length 1273 1818
called ExFreePoolWithTag
FUN_140707cb0
FUN_14070881c
FUN_140709974
FUN_140709bb0
RtlCopyMemory
WbAlloc
WbAllocateUserMemory
ZwFlushInstructionCache
memset
Expand for full list:
ExFreePoolWithTag
FUN_140708564
FUN_140709388
FUN_14070a4d4
FUN_14070a710
Feature_1171241279__private_IsEnabled
IoAllocateMdl
IoFreeMdl
MmProbeAndLockPagesPrivate
MmUnlockPages
RtlCopyMemoryWbAlloc
WbAllocateUserMemory
ZwFlushInstructionCache
memset
calling WbGetHeapExecutedBlock WbGetHeapExecutedBlock
paramcount 0 0
address 1407080c8 14070897c
sig undefined WbCreateHeapExecutedBlock(void) undefined FUN_14070897c(void)
sym_type Function Function
sym_source IMPORTED DEFAULT
external False False

WbCreateHeapExecutedBlock Called Diff

--- WbCreateHeapExecutedBlock called
+++ FUN_14070897c called
@@ -2,4 +2,9 @@
-FUN_140707cb0
-FUN_14070881c
-FUN_140709974
-FUN_140709bb0
+FUN_140708564
+FUN_140709388
+FUN_14070a4d4
+FUN_14070a710
+Feature_1171241279__private_IsEnabled
+IoAllocateMdl
+IoFreeMdl
+MmProbeAndLockPagesPrivate
+MmUnlockPages

WbCreateHeapExecutedBlock Diff

--- WbCreateHeapExecutedBlock
+++ FUN_14070897c
@@ -1,145 +1,242 @@
 
 /* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
 
-int WbCreateHeapExecutedBlock(undefined8 param_1,longlong *param_2,undefined8 *param_3)
+int FUN_14070897c(undefined8 param_1,longlong *param_2,undefined8 *param_3)
 
 {
   ulonglong uVar1;
   ulonglong uVar2;
   short sVar3;
   bool bVar4;
-  longlong *plVar5;
-  int iVar6;
-  undefined8 uVar7;
-  void *local_58;
-  longlong local_50;
-  longlong *local_48;
-  ulonglong local_40;
+  bool bVar5;
+  longlong *plVar6;
+  bool bVar7;
+  int iVar8;
+  int iVar9;
+  longlong lVar10;
+  undefined8 uVar11;
+  longlong lVar12;
+  longlong lVar13;
+  void *local_88;
+  undefined4 local_80;
+  int local_7c;
+  int local_78;
+  longlong local_70;
+  longlong local_68;
+  longlong local_60;
+  longlong local_58;
+  longlong *local_50;
+  ulonglong local_48;
   
-  local_48 = (longlong *)0x0;
-  local_50 = 0;
-  local_58 = (void *)0x0;
-  local_40 = (ulonglong)DAT_0;
-  iVar6 = WbAlloc(0x58);
-  if (iVar6 < 0) goto LAB_1;
+  lVar10 = 0;
+  local_50 = (longlong *)0x0;
+  local_60 = 0;
+  local_88 = (void *)0x0;
+  lVar12 = 0;
+  local_58 = 0;
+  local_70 = 0;
+  local_68 = 0;
+  bVar5 = false;
+  local_80 = 0;
+  local_7c = 0;
+  local_78 = 0;
+  local_48 = (ulonglong)DAT_0;
+  iVar8 = WbAlloc(0x58);
+  lVar13 = lVar10;
+  if (iVar8 < 0) goto LAB_1;
   memset((void *)0x0,0,0x58);
   _DAT_2 = _DAT_2 & 0xfffffffe;
   bVar4 = true;
   _DAT_3 = 1;
+  lVar13 = lVar12;
   if (*(int *)(param_2 + 1) == 1) {
-    uVar7 = 0xf8;
+    iVar8 = FUN_140708564(param_2 + 2,0xf8);
+    if (iVar8 < 0) goto LAB_1;
+    iVar8 = Feature_1171241279__private_IsEnabled();
+    bVar7 = false;
+    if (iVar8 != 0) {
+      lVar10 = IoAllocateMdl(param_2[0x29],0xf8,0,0,0);
+      if (lVar10 == 0) {
+LAB_4:
+        iVar8 = -0x3fffffe9;
+        lVar13 = lVar10;
+        local_58 = lVar10;
+        goto LAB_1;
+      }
+      local_58 = lVar10;
+      MmProbeAndLockPagesPrivate(lVar10);
+      local_80 = 1;
+      bVar7 = true;
+    }
+    bVar5 = bVar7;
+    uVar11 = 0xf8;
   }
   else {
     if (*(int *)(param_2 + 1) != 0) {
-      iVar6 = -0x3ffffff3;
-      goto LAB_1;
-    }
-    uVar7 = 0xf0;
-  }
-  iVar6 = FUN_140707cb0(param_2 + 2,uVar7);
-  if ((((iVar6 < 0) || (iVar6 = FUN_140709974(param_2[0x29],uVar7,1), iVar6 < 0)) ||
-      (iVar6 = WbAllocateUserMemory(param_1,*(undefined4 *)(param_2 + 0x28),&local_48,&local_50),
-      iVar6 < 0)) || (iVar6 = WbAlloc(*(undefined4 *)(param_2 + 0x28),&local_58), iVar6 < 0))
+      iVar8 = -0x3ffffff3;
+      goto LAB_1;
+    }
+    iVar8 = FUN_140708564(param_2 + 2,0xf0);
+    if (iVar8 < 0) goto LAB_1;
+    iVar8 = Feature_1171241279__private_IsEnabled();
+    bVar7 = false;
+    if (iVar8 != 0) {
+      lVar10 = IoAllocateMdl(param_2[0x29],0xf0,0,0,0);
+      if (lVar10 == 0) goto LAB_4;
+      local_58 = lVar10;
+      MmProbeAndLockPagesPrivate(lVar10);
+      local_80 = 1;
+      bVar7 = true;
+    }
+    bVar5 = bVar7;
+    uVar11 = 0xf0;
+  }
+  iVar8 = FUN_14070a4d4(param_2[0x29],uVar11,1);
+  lVar13 = lVar10;
+  if (((iVar8 < 0) ||
+      (iVar8 = WbAllocateUserMemory(param_1,*(undefined4 *)(param_2 + 0x28),&local_50,&local_60),
+      iVar8 < 0)) || (iVar8 = WbAlloc(*(undefined4 *)(param_2 + 0x28),&local_88), iVar8 < 0))
   goto LAB_1;
   if (*(uint *)((longlong)param_2 + 0x11c) != 0) {
     uVar1 = param_2[0x22] + (ulonglong)*(uint *)((longlong)param_2 + 0x11c);
     if ((0x7fffffff0000 < uVar1) || (uVar1 < (ulonglong)param_2[0x22])) {
-      DAT_4 = 0;
-    }
-  }
-  RtlCopyMemory((void *)((ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_58),
+      DAT_5 = 0;
+    }
+  }
+  RtlCopyMemory((void *)((ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_88),
                 (void *)param_2[0x22],(ulonglong)*(uint *)((longlong)param_2 + 0x11c));
   if (*(int *)(param_2 + 1) == 1) {
     if (*(uint *)((longlong)param_2 + 0x11c) < 4) {
-      iVar6 = -0x3ffffff3;
-      goto LAB_1;
-    }
-    *(undefined4 *)((ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_58) =
+      iVar8 = -0x3ffffff3;
+      goto LAB_1;
+    }
+    *(undefined4 *)((ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_88) =
          *(undefined4 *)((longlong)param_2 + 0x124);
   }
   else if (*(int *)(param_2 + 1) != 0) {
-    iVar6 = -0x3ffffff3;
+    iVar8 = -0x3ffffff3;
     goto LAB_1;
   }
-  iVar6 = FUN_140709bb0(0,(ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_58,
-                        (ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_58,
+  iVar8 = Feature_1171241279__private_IsEnabled();
+  if (iVar8 != 0) {
+    local_70 = IoAllocateMdl(param_2[0x22],*(undefined4 *)((longlong)param_2 + 0x11c),0,0,0);
+    if (local_70 == 0) {
+      iVar8 = -0x3fffffe9;
+      goto LAB_1;
+    }
+    MmProbeAndLockPagesPrivate(local_70);
+    local_7c = 1;
+  }
+  iVar8 = FUN_14070a710(0,(ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_88,
+                        (ulonglong)*(uint *)(param_2 + 0x24) + (longlong)local_88,
                         *(undefined4 *)((longlong)param_2 + 0x11c),param_2 + 0xb,
                         *(undefined4 *)(param_2 + 0x23),param_2 + 0xc);
-  if ((iVar6 < 0) ||
-     (iVar6 = FUN_140709974(param_2[0x22],*(undefined4 *)((longlong)param_2 + 0x11c),1), iVar6 < 0))
+  if ((iVar8 < 0) ||
+     (iVar8 = FUN_14070a4d4(param_2[0x22],*(undefined4 *)((longlong)param_2 + 0x11c),1), iVar8 < 0))
   goto LAB_1;
   uVar1 = param_2[0x25];
   if (uVar1 != 0) {
     if ((*(uint *)((longlong)param_2 + 0x134) != 0) &&
        ((uVar2 = uVar1 + *(uint *)((longlong)param_2 + 0x134), 0x7fffffff0000 < uVar2 ||
         (uVar2 < uVar1)))) {
-      DAT_4 = 0;
-    }
-    RtlCopyMemory((void *)((ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_58),
+      DAT_5 = 0;
+    }
+    RtlCopyMemory((void *)((ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_88),
                   (void *)param_2[0x25],(ulonglong)*(uint *)((longlong)param_2 + 0x134));
     if (*(int *)(param_2 + 1) == 1) {
       if (*(uint *)((longlong)param_2 + 0x134) < 4) {
-        iVar6 = -0x3ffffff3;
+        iVar8 = -0x3ffffff3;
         goto LAB_1;
       }
-      *(undefined4 *)((ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_58) =
+      *(undefined4 *)((ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_88) =
            *(undefined4 *)((longlong)param_2 + 0x13c);
     }
     else if (*(int *)(param_2 + 1) != 0) {
-      iVar6 = -0x3ffffff3;
-      goto LAB_1;
-    }
-    iVar6 = FUN_140709bb0(0,(ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_58,
-                          (ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_58,
+      iVar8 = -0x3ffffff3;
+      goto LAB_1;
+    }
+    iVar8 = Feature_1171241279__private_IsEnabled();
+    if (iVar8 != 0) {
+      local_68 = IoAllocateMdl(param_2[0x25],*(undefined4 *)((longlong)param_2 + 0x134),0,0,0);
+      if (local_68 == 0) {
+        iVar8 = -0x3fffffe9;
+        goto LAB_1;
+      }
+      MmProbeAndLockPagesPrivate(local_68);
+      local_78 = 1;
+    }
+    iVar8 = FUN_14070a710(0,(ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_88,
+                          (ulonglong)*(uint *)(param_2 + 0x27) + (longlong)local_88,
                           *(undefined4 *)((longlong)param_2 + 0x134),param_2 + 0xb,
                           *(undefined4 *)(param_2 + 0x26),param_2 + 0xc);
-    if ((iVar6 < 0) ||
-       (iVar6 = FUN_140709974(param_2[0x25],*(undefined4 *)((longlong)param_2 + 0x134),1), iVar6 < 0
+    if ((iVar8 < 0) ||
+       (iVar8 = FUN_14070a4d4(param_2[0x25],*(undefined4 *)((longlong)param_2 + 0x134),1), iVar8 < 0
        )) goto LAB_1;
   }
-  plVar5 = local_48;
-  RtlCopyMemory(local_48,local_58,(ulonglong)*(uint *)(param_2 + 0x28));
+  plVar6 = local_50;
+  RtlCopyMemory(local_50,local_88,(ulonglong)*(uint *)(param_2 + 0x28));
   lRam0000000000000040 = *param_2;
-  _DAT_5 = plVar5;
-  lRam0000000000000018 = (ulonglong)*(uint *)(param_2 + 0x24) + local_50;
+  _DAT_6 = plVar6;
+  lRam0000000000000018 = (ulonglong)*(uint *)(param_2 + 0x24) + local_60;
   if (*(uint *)(param_2 + 0x27) == 0) {
-    _DAT_6 = 0;
+    _DAT_7 = 0;
   }
   else {
-    _DAT_6 = (ulonglong)*(uint *)(param_2 + 0x27) + local_50;
-  }
-  _DAT_7 = *(undefined4 *)(param_2 + 0x28);
+    _DAT_7 = (ulonglong)*(uint *)(param_2 + 0x27) + local_60;
+  }
+  _DAT_8 = *(undefined4 *)(param_2 + 0x28);
   lRam0000000000000030 = param_2[0x22];
-  _DAT_8 = param_2[0x22] - lRam0000000000000018;
+  _DAT_9 = param_2[0x22] - lRam0000000000000018;
   if (*(longlong *)(*(longlong *)((longlong)SystemReserved1[15] + 0xb8) + 0x580) == 0) {
-LAB_9:
-    *plVar5 = _DAT_8;
+LAB_10:
+    *plVar6 = _DAT_9;
   }
   else {
     sVar3 = *(short *)(*(longlong *)((longlong)SystemReserved1[15] + 0xb8) + 0x96c);
     if ((sVar3 != 0x14c) && (sVar3 != 0x1c4)) {
       bVar4 = false;
     }
-    if (!bVar4) goto LAB_9;
-    *plVar5 = lRam0000000000000040;
-  }
-  _DAT_5[1] = local_40;
-  iVar6 = ZwFlushInstructionCache
+    if (!bVar4) goto LAB_10;
+    *plVar6 = lRam0000000000000040;
+  }
+  _DAT_6[1] = local_48;
+  iVar8 = ZwFlushInstructionCache
                     (0xffffffffffffffff,lRam0000000000000018,
                      *(undefined4 *)((longlong)param_2 + 0x11c));
-  if ((-1 < iVar6) &&
+  if ((-1 < iVar8) &&
      (((param_2[0x25] == 0 ||
-       (iVar6 = ZwFlushInstructionCache
-                          (0xffffffffffffffff,_DAT_6,
-                           *(undefined4 *)((longlong)param_2 + 0x134)), -1 < iVar6)) &&
+       (iVar8 = ZwFlushInstructionCache
+                          (0xffffffffffffffff,_DAT_7,
+                           *(undefined4 *)((longlong)param_2 + 0x134)), -1 < iVar8)) &&
       (param_3 != (undefined8 *)0x0)))) {
     *param_3 = 0;
   }
 LAB_1:
-  FUN_14070881c(param_1,0);
-  if (local_58 != (void *)0x0) {
-    ExFreePoolWithTag(local_58,0);
-  }
-  return iVar6;
+  iVar9 = Feature_1171241279__private_IsEnabled();
+  if (iVar9 != 0) {
+    if (lVar13 != 0) {
+      if (bVar5) {
+        MmUnlockPages(lVar13);
+      }
+      IoFreeMdl(lVar13);
+    }
+    if (local_70 != 0) {
+      if (local_7c != 0) {
+        MmUnlockPages(local_70);
+      }
+      IoFreeMdl(local_70);
+    }
+    if (local_68 != 0) {
+      if (local_78 != 0) {
+        MmUnlockPages(local_68);
+      }
+      IoFreeMdl(local_68);
+    }
+  }
+  FUN_140709388(param_1,0);
+  if (local_88 != (void *)0x0) {
+    ExFreePoolWithTag(local_88,0);
+  }
+  return iVar8;
 }

Modified (No Code Changes)

Slightly modified functions have no code changes, rather differnces in:

  • refcount
  • length
  • called
  • calling
  • name
  • fullname

VfDriverUnloadImage

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address
ratio 0.93
i_ratio 0.68
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name VfDriverUnloadImage VfDriverUnloadImage
fullname VfDriverUnloadImage VfDriverUnloadImage
refcount 6 4
length 313 313
called ExFreePoolWithTag
VfDeadlockDeleteMemoryRange
VfIsVerifierEnabled
VfRemLockDeleteMemoryRange
VfSuspectDriversUnloadCallback
VfTargetDriversRemove
VfVolatileClearDifRuleClass
ViThunkRemoveImportEntry		 ExFreePoolWithTag
VfDeadlockDeleteMemoryRange
VfIsVerifierEnabled
VfRemLockDeleteMemoryRange
VfSuspectDriversUnloadCallback
VfTargetDriversRemove
VfVolatileClearDifRuleClass
ViThunkRemoveImportEntry
calling MiUnloadSystemImage MiUnloadSystemImage
paramcount 0 0
address 140abde3c 140abe200
sig undefined VfDriverUnloadImage(void) undefined VfDriverUnloadImage(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

SmFreeWrapper

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address
ratio 0.83
i_ratio 1.0
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name SmFreeWrapper SmFreeWrapper
fullname SmFreeWrapper SmFreeWrapper
refcount 200 199
length 16 16
called ExFreePoolWithTag ExFreePoolWithTag
calling
Expand for full list:
CMFCheckAccess
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmCreateKey
CmDeleteKey
CmDeleteValueKey
CmEnumerateValueFromLayeredKey
CmInitSystem1
CmLoadAppKey
CmLoadDifferencingKey
CmLoadKeyCmQueryMultipleValueForLayeredKey
CmQueryValueKey
CmRenameKey
CmReplaceKey
CmSaveKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmUnloadKey
CmUpdateFeatureConfiguration
CmUpdateFeatureUsageSubscription
CmpAddToHiveFileList
CmpAssignKeySecurity
CmpBounceContextCleanup
CmpCaptureKeyValueArray
CmpCheckAdminAccess
CmpCheckKeyBodyAccess
CmpCleanupKcbStack
CmpCleanupKeyNodeStack
CmpCleanupLightWeightUoWData
CmpCleanupRollbackPacket
CmpConstructNameFromKeyNodes
CmpConstructNameWithStatus
CmpCopySyncTree
CmpCreateRegistryProcessToken
CmpDoBuildVirtualStack
CmpDoFileWrite
CmpDoParseKey
CmpDoReadTxRBigLogRecord
CmpDoWritethroughReparse
CmpEnumerateLayeredKey
CmpFinishSystemHivesLoad
CmpGetSymbolicLinkTarget
CmpInitializeRegistryProcess
CmpIsKeyDeleted
CmpKeyEnumStackCleanup
CmpKeyEnumStackFreeResumeContext
CmpLightWeightCommitDeleteKeyUoW
CmpLightWeightPrepareDeleteKeyUoW
CmpLoadHiveVolatile
CmpLockKeyBodyIntoMemory
CmpLogTransactionAbortedWithChildName
CmpMarkIndexDirty
CmpMergeKeyValues
CmpOpenHiveFile
CmpOpenHiveFiles
CmpParseKey
CmpPartialPromoteSubkeys
CmpPerformUnloadKey
CmpPromoteKey
CmpQueryFileSecurityDescriptor
CmpQueryKeySecurity
CmpReadBuildVersion
CmpRecordShutdownStopTime
CmpRefreshHive
CmpReorganizeHive
CmpReportNotify
CmpReserveRollbackPacketSpace
CmpRmReDoPhase
CmpSaveBootControlSet
CmpSetKeySecurity
CmpSetSecurityDescriptorInfo
CmpSortedValueEnumStackCleanup
CmpSortedValueEnumStackEntryStart
CmpStartSiloRegistryNamespace
CmpSubtreeEnumeratorCleanup
CmpUnlockKeyBodyFromMemory
CmpValueEnumStackCleanup
CmpVolumeContextCreate
CmpVolumeContextDecrementRefCount
CmpVolumeManagerGetContextForFile
ExInitializeLookasideListExInternal
HvLoadHive
HvRecoverFlushProtocolStateFromFiles
HvpPerformLogFileRecovery
HvpRecoverDataReadRoutine
HvpViewMapCreateView
HvpViewMapCreateViewsForRegion
HvpViewMapDeleteViewTreeNode
HvpViewMapPromoteRangeToMapping
HvpViewMapShrinkStorage
IopParseDevice
KiInitializeSingleDpcRuntimeHistoryHashTable
MiDeletePagefile
MiExtendSection
NtCompactKeys
NtDeleteValueKey
NtQueryKey
NtQueryMultipleValueKey
NtQueryOpenSubKeysEx
NtQueryValueKey
NtRenameKey
NtSetValueKey
ObCheckCreateObjectAccess
ObCheckObjectAccess
ObpCheckTraverseAccess
ObpCreateHandle
PfSnCleanupTrace
SmCrEncCleanup
SmCreatePartition
SmDeletePartition
SmKmCleanup
SmKmFileInfoCleanup
SmKmKeyGenKeyDelete
SmKmKeyGenNewKey
SmKmStoreAdd
SmKmStoreFileGetExtents
SmKmStoreFileWriteHeader
SmPartitionCleanup
SmProcessCreateRequest
SmProcessListRequest
SmProcessStatsRequest
SmcCacheCleanup
SmcCacheDelete
SmcProcessCreateRequest
SmcStoreCreate
SmcStoreDelete
SmcStoreResize
SmcStoreSlotAbort
SmcStoreSlotReserve
SmpKeyedStoreCreate
SmpKeyedStoreDeleteInitiate
SmpKeyedStoreEntryGet
VerifierExInitializeLookasideListEx
Expand for full list:
CMFCheckAccess
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmCreateKey
CmDeleteKey
CmDeleteValueKey
CmEnumerateValueFromLayeredKey
CmInitSystem1
CmLoadAppKey
CmLoadDifferencingKey
CmLoadKeyCmQueryMultipleValueForLayeredKey
CmQueryValueKey
CmRenameKey
CmReplaceKey
CmSaveKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmUnloadKey
CmUpdateFeatureConfiguration
CmUpdateFeatureUsageSubscription
CmpAddToHiveFileList
CmpAssignKeySecurity
CmpBounceContextCleanup
CmpCaptureKeyValueArray
CmpCheckAdminAccess
CmpCheckKeyBodyAccess
CmpCleanupKcbStack
CmpCleanupKeyNodeStack
CmpCleanupLightWeightUoWData
CmpCleanupRollbackPacket
CmpConstructNameFromKeyNodes
CmpConstructNameWithStatus
CmpCopySyncTree
CmpCreateRegistryProcessToken
CmpDoBuildVirtualStack
CmpDoFileWrite
CmpDoParseKey
CmpDoReadTxRBigLogRecord
CmpDoWritethroughReparse
CmpEnumerateLayeredKey
CmpFinishSystemHivesLoad
CmpGetSymbolicLinkTarget
CmpInitializeRegistryProcess
CmpIsKeyDeleted
CmpKeyEnumStackCleanup
CmpKeyEnumStackFreeResumeContext
CmpLightWeightCommitDeleteKeyUoW
CmpLightWeightPrepareDeleteKeyUoW
CmpLoadHiveVolatile
CmpLockKeyBodyIntoMemory
CmpLogTransactionAbortedWithChildName
CmpMarkIndexDirty
CmpMergeKeyValues
CmpOpenHiveFile
CmpOpenHiveFiles
CmpParseKey
CmpPartialPromoteSubkeys
CmpPerformUnloadKey
CmpPromoteKey
CmpQueryFileSecurityDescriptor
CmpQueryKeySecurity
CmpReadBuildVersion
CmpRecordShutdownStopTime
CmpRefreshHive
CmpReorganizeHive
CmpReportNotify
CmpReserveRollbackPacketSpace
CmpRmReDoPhase
CmpSaveBootControlSet
CmpSetKeySecurity
CmpSetSecurityDescriptorInfo
CmpSortedValueEnumStackCleanup
CmpSortedValueEnumStackEntryStart
CmpStartSiloRegistryNamespace
CmpSubtreeEnumeratorCleanup
CmpUnlockKeyBodyFromMemory
CmpValueEnumStackCleanup
CmpVolumeContextCreate
CmpVolumeContextDecrementRefCount
CmpVolumeManagerGetContextForFile
ExInitializeLookasideListExInternal
HvLoadHive
HvRecoverFlushProtocolStateFromFiles
HvpPerformLogFileRecovery
HvpRecoverDataReadRoutine
HvpViewMapCreateView
HvpViewMapCreateViewsForRegion
HvpViewMapDeleteViewTreeNode
HvpViewMapPromoteRangeToMapping
HvpViewMapShrinkStorage
IopParseDevice
KiInitializeSingleDpcRuntimeHistoryHashTable
MiDeletePagefile
MiExtendSection
NtCompactKeys
NtDeleteValueKey
NtQueryKey
NtQueryMultipleValueKey
NtQueryOpenSubKeysEx
NtQueryValueKey
NtRenameKey
NtSetValueKey
ObCheckCreateObjectAccess
ObCheckObjectAccess
ObpCheckTraverseAccess
ObpCreateHandle
PfSnCleanupTrace
SmCrEncCleanup
SmCreatePartition
SmDeletePartition
SmKmCleanup
SmKmFileInfoCleanup
SmKmKeyGenKeyDelete
SmKmKeyGenNewKey
SmKmStoreAdd
SmKmStoreFileGetExtents
SmKmStoreFileWriteHeader
SmPartitionCleanup
SmProcessCreateRequest
SmProcessListRequest
SmProcessStatsRequest
SmcCacheCleanup
SmcCacheDelete
SmcProcessCreateRequest
SmcStoreCreate
SmcStoreDelete
SmcStoreResize
SmcStoreSlotAbort
SmcStoreSlotReserve
SmpKeyedStoreCreate
SmpKeyedStoreDeleteInitiate
SmpKeyedStoreEntryGet
VerifierExInitializeLookasideListEx
paramcount 2 2
address 140283ae0 140283880
sig void __cdecl SmFreeWrapper(void * param_1, void * param_2) void __cdecl SmFreeWrapper(void * param_1, void * param_2)
sym_type Function Function
sym_source ANALYSIS ANALYSIS
external False False

__GSHandlerCheck

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address
ratio 1.0
i_ratio 0.88
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name __GSHandlerCheck __GSHandlerCheck
fullname __GSHandlerCheck __GSHandlerCheck
refcount 2625 2626
length 29 29
called __GSHandlerCheckCommon __GSHandlerCheckCommon
calling
paramcount 0 0
address 1403d6494 1403d6484
sig undefined __GSHandlerCheck(void) undefined __GSHandlerCheck(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

VrpGetNextToken

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 1.0
i_ratio 0.85
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name VrpGetNextToken VrpGetNextToken
fullname VrpGetNextToken VrpGetNextToken
refcount 12 14
length 233 233
called
calling VrpComparePath
VrpCountPathComponents
VrpCreateNamespaceNode
VrpPreLoadKey
VrpTranslatePath		 VrpComparePath
VrpCountPathComponents
VrpCreateNamespaceNode
VrpPreLoadKey
VrpPreOpenOrCreate
VrpTranslatePath
paramcount 0 0
address 1406cbd44 1406cc364
sig undefined VrpGetNextToken(void) undefined VrpGetNextToken(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

VrpGetNextToken Calling Diff

--- VrpGetNextToken calling
+++ VrpGetNextToken calling
@@ -4,0 +5 @@
+VrpPreOpenOrCreate

IoAllocateMdl

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.92
i_ratio 0.83
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name IoAllocateMdl IoAllocateMdl
fullname IoAllocateMdl IoAllocateMdl
refcount 45 49
length 400 400
called ExAllocatePool2
ExpInterlockedPopEntrySList
_guard_dispatch_icall		 ExAllocatePool2
ExpInterlockedPopEntrySList
_guard_dispatch_icall
calling
Expand for full list:
AlpcpInitializeCompletionList
BuildQueryDirectoryIrp
CcMdlRead
EtwpBuildMdlForTraceBuffer
EtwpSavePersistedLogger
FUN_140a4ecb0
FsRtlKernelFsControlFile
HalGetAdapterV2
HalGetAdapterV3
HvlpDynamicUpdateMicrocode
IopAllocateAndLockMdlIopLiveDumpAllocateMappingResources
IopReadFile
IopSetEaOrQuotaInformationFile
IopSetFileObjectIosbRange
IopXxxControlFile
IovAllocateMdl
MiApplyImageHotPatch
MiCreateMdl
MiLockAndMapEntireDriver
MiMapHotPatchImageInSystemSpace
NtFreeUserPhysicalPages
NtNotifyChangeDirectoryFileEx
NtPssCaptureVaSpaceBulk
NtQueryEaFile
NtQueryQuotaInformationFile
NtReadFileScatter
NtSetEaFile
NtWriteFileGather
PnprInitializeMappingReserve
PopReadPagesFromHiberFile
VerifierPortIoAllocateMdl
VfBuildMdlFromScatterGatherList
ViAllocateMapRegisterFile
WbMakeUserExecutablePagesKernelWritable
Expand for full list:
AlpcpInitializeCompletionList
BuildQueryDirectoryIrp
CcMdlRead
EtwpBuildMdlForTraceBuffer
EtwpSavePersistedLogger
FUN_14070897c
FUN_140a4ec40
FsRtlKernelFsControlFile
HalGetAdapterV2
HalGetAdapterV3
HvlpDynamicUpdateMicrocodeIopAllocateAndLockMdl
IopLiveDumpAllocateMappingResources
IopReadFile
IopSetEaOrQuotaInformationFile
IopSetFileObjectIosbRange
IopXxxControlFile
IovAllocateMdl
MiApplyImageHotPatch
MiCreateMdl
MiLockAndMapEntireDriver
MiMapHotPatchImageInSystemSpace
NtFreeUserPhysicalPages
NtNotifyChangeDirectoryFileEx
NtPssCaptureVaSpaceBulk
NtQueryEaFile
NtQueryQuotaInformationFile
NtReadFileScatter
NtSetEaFile
NtWriteFileGather
PnprInitializeMappingReserve
PopReadPagesFromHiberFile
VerifierPortIoAllocateMdl
VfBuildMdlFromScatterGatherList
ViAllocateMapRegisterFile
WbMakeUserExecutablePagesKernelWritable
paramcount 5 5
address 140313c30 140313c20
sig undefined IoAllocateMdl(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5) undefined IoAllocateMdl(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

IoAllocateMdl Calling Diff

--- IoAllocateMdl calling
+++ IoAllocateMdl calling
@@ -6 +6,2 @@
-FUN_140a4ecb0
+FUN_14070897c
+FUN_140a4ec40

RtlIsSandboxedToken

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address
ratio 0.97
i_ratio 0.83
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name RtlIsSandboxedToken RtlIsSandboxedToken
fullname RtlIsSandboxedToken RtlIsSandboxedToken
refcount 16 17
length 155 155
called SeCaptureSubjectContext
SeQueryInformationToken
SeReleaseSubjectContext		 SeCaptureSubjectContext
SeQueryInformationToken
SeReleaseSubjectContext
calling
Expand for full list:
CmSetValueKey
CmpCheckCreateAccess
IopCheckInitiatorHint
IopXxxControlFile
NtDuplicateToken
NtSetInformationFile
ObCreateSymbolicLink
ObpCreateDirectoryObject
ObpGetShadowDirectory
ObpParseSymbolicLinkEx
SepFilterToken
Expand for full list:
CmSetValueKey
CmpCheckCreateAccess
IopCheckInitiatorHint
IopXxxControlFile
NtDuplicateToken
NtSetInformationFile
ObCreateSymbolicLink
ObpCreateDirectoryObject
ObpGetShadowDirectory
ObpParseSymbolicLinkEx
SepFilterToken
paramcount 0 0
address 140712d60 1407137a0
sig undefined RtlIsSandboxedToken(void) undefined RtlIsSandboxedToken(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

IoFreeMdl

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.97
i_ratio 0.76
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name IoFreeMdl IoFreeMdl
fullname IoFreeMdl IoFreeMdl
refcount 66 69
length 182 182
called ExFreePoolWithTag
ExpInterlockedPushEntrySList
MmUnmapLockedPages
_guard_dispatch_icall		 ExFreePoolWithTag
ExpInterlockedPushEntrySList
MmUnmapLockedPages
_guard_dispatch_icall
calling
Expand for full list:
AlpcpFreeCompletionList
AlpcpInitializeCompletionList
CcCopyBytesToUserBuffer
CcLockSystemCacheBuffer
CcMapAndCopyInToCache
CcMdlRead$fin$0
CcMdlReadComplete2
CcMdlWriteAbort
CcMdlWriteComplete2
CcPrepareMdlWrite$fin$0
CcZeroDataInCacheCcZeroDataInCache$fin$0
DifIoFreeMdlWrapper
FUN_14070752c
FUN_140a4ecb0
FsRtlpFreeMdlChain
HalBuildMdlFromScatterGatherListV2
HalBuildMdlFromScatterGatherListV3
HalFlushAdapterBuffersEx
HalMapTransferEx
HalPutScatterGatherListV2
HalPutScatterGatherListV3
HalpDmaCheckMdlAccessibility
HalpDmaFreeChildAdapter
HvlGetCoverageData
HvlpDynamicUpdateMicrocode
IoWriteCapturedPristineTriageDumpToDedicatedDumpFile
IopCleanupFileObjectIosbRange
IopCompleteRequest
IopDropIrp
IopExceptionCleanupEx
IopLiveDumpFreeMappingResources
IopMcReleaseMdl
IopSetFileObjectIosbRange
IopUnlockAndFreeMdl
IopfCompleteRequest
MiApplyImageHotPatch
MiDeleteImageCreationMdls
MiLockAndMapEntireDriver
MiMapHotPatchImageInSystemSpace
MiPrepareImagePagesForHotPatch
MiReleaseHotPatchResources
MiUnlockAndFreeDvPatchImage
MiUnlockEntireDriver
MiZeroPageWrite
NT_DISK::Read
NT_DISK::Write
NtFreeUserPhysicalPages
NtPssCaptureVaSpaceBulk
PnprFreeMappingReserve
PopReadPagesFromHiberFile
PsDispatchIumService
ViAllocateMapRegisterFile
ViFreeMapRegisterFile
WbMakeUserExecutablePagesKernelWritable
Expand for full list:
AlpcpFreeCompletionList
AlpcpInitializeCompletionList
CcCopyBytesToUserBuffer
CcLockSystemCacheBuffer
CcMapAndCopyInToCache
CcMdlRead$fin$0
CcMdlReadComplete2
CcMdlWriteAbort
CcMdlWriteComplete2
CcPrepareMdlWrite$fin$0
CcZeroDataInCacheCcZeroDataInCache$fin$0
DifIoFreeMdlWrapper
FUN_140707cbc
FUN_14070897c
FUN_140a4ec40
FsRtlpFreeMdlChain
HalBuildMdlFromScatterGatherListV2
HalBuildMdlFromScatterGatherListV3
HalFlushAdapterBuffersEx
HalMapTransferEx
HalPutScatterGatherListV2
HalPutScatterGatherListV3
HalpDmaCheckMdlAccessibility
HalpDmaFreeChildAdapter
HvlGetCoverageData
HvlpDynamicUpdateMicrocode
IoWriteCapturedPristineTriageDumpToDedicatedDumpFile
IopCleanupFileObjectIosbRange
IopCompleteRequest
IopDropIrp
IopExceptionCleanupEx
IopLiveDumpFreeMappingResources
IopMcReleaseMdl
IopSetFileObjectIosbRange
IopUnlockAndFreeMdl
IopfCompleteRequest
MiApplyImageHotPatch
MiDeleteImageCreationMdls
MiLockAndMapEntireDriver
MiMapHotPatchImageInSystemSpace
MiPrepareImagePagesForHotPatch
MiReleaseHotPatchResources
MiUnlockAndFreeDvPatchImage
MiUnlockEntireDriver
MiZeroPageWrite
NT_DISK::Read
NT_DISK::Write
NtFreeUserPhysicalPages
NtPssCaptureVaSpaceBulk
PnprFreeMappingReserve
PopReadPagesFromHiberFile
PsDispatchIumService
ViAllocateMapRegisterFile
ViFreeMapRegisterFile
WbMakeUserExecutablePagesKernelWritable
paramcount 0 0
address 140316ef0 140316ee0
sig undefined IoFreeMdl(void) undefined IoFreeMdl(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

IoFreeMdl Calling Diff

--- IoFreeMdl calling
+++ IoFreeMdl calling
@@ -14,2 +14,3 @@
-FUN_14070752c
-FUN_140a4ecb0
+FUN_140707cbc
+FUN_14070897c
+FUN_140a4ec40

ExfAcquirePushLockExclusiveEx

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.98
i_ratio 0.81
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name ExfAcquirePushLockExclusiveEx ExfAcquirePushLockExclusiveEx
fullname ExfAcquirePushLockExclusiveEx ExfAcquirePushLockExclusiveEx
refcount 352 351
length 600 600
called ExpOptimizePushLockList
KeAbPreAcquire
KeAbPreWait
KeWaitForMutexObject
RtlBackoff
memset		 ExpOptimizePushLockList
KeAbPreAcquire
KeAbPreWait
KeWaitForMutexObject
RtlBackoff
memset
calling
Expand for full list:
CmFcManagerDrainAllFeatureUsageNotifications
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerRegisterFeatureConfigurationChangeNotification
CmFcManagerUnregisterFeatureConfigurationChangeNotification
CmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpManagerDrainUsageNotificationsWorker
CmFcpManagerRetryUsageNotificationsWorker
CmFcpManagerSoftwareHiveReady
CmFreezeRegistry
CmLockHiveCmLockHiveSecurityExclusive
CmRegisterMachineHiveLoadedNotification
CmSiRWLockAcquireExclusive
CmThawRegistry
CmUnregisterMachineHiveLoadedNotification
CmpAssignKeySecurity
CmpCloseKeyObject
CmpCopyMergeOfLayeredKeyNode
CmpCreateChild
CmpCreateHive
CmpCreateHiveRootCell
CmpDeleteHive
CmpDeleteKeyObject
CmpDereferenceNameControlBlockWithLock
CmpDoParseKey
CmpDoQueueLateUnloadWorker
CmpFinishSystemHivesLoad
CmpFlushHive
CmpFlushNotify
CmpFreeKeyByCell
CmpGetNameControlBlock
CmpInitCmRM
CmpLoadHiveVolatile
CmpLockAppHiveLoadList
CmpLockCallbackListExclusive
CmpLockContextListExclusive
CmpLockDeletedHashEntryExclusiveByKcb
CmpLockGlobalKeyLockTrackerExclusive
CmpLockHashEntryByIndexExclusive
CmpLockHashEntryExclusive
CmpLockHashEntryExclusiveByKcb
CmpLockHiveListExclusive
CmpLockKcbExclusive
CmpLockRegistryFreezeAware
CmpLockSiloKeyLockTrackerExclusive
CmpLockTwoSecurityCachesExclusiveShared
CmpMarkEntireIndexDirty
CmpNotifyMachineHiveLoaded
CmpRecoverFlushProtocolStateFromFiles
CmpRefreshHive
CmpReorganizeHive
CmpReportNotifyHelper
CmpSetKeySecurity
CmpTransMgrPrepare
CmpTransMgrSyncHive
CmpTrimHive
CmpVolumeContextDecrementRefCount
CmpVolumeContextSendDeviceUsageNotification
CmpVolumeManagerGetContextForFile
CmpWalkOneLevel
DifExfAcquirePushLockExclusiveWrapper
ExAcquireAutoExpandPushLockExclusive
ExAcquirePushLockExclusiveEx
ExGetWakeTimerList
ExInitializeDeviceAts
ExRegisterExtension
ExRegisterHost
ExSvmBeginDeviceReset
ExSvmFinalizeDeviceReset
ExUninitializeDeviceAts
ExUnregisterExtension
ExUuidCreate
ExWakeTimersPause
ExfAcquireCacheAwarePushLockExclusiveEx
ExfAcquirePushLockExclusive
ExfAcquireReleasePushLockExclusive
ExpAcquireFannedOutPushLockExclusive
ExpDeleteTimer
ExpKdPullRemoteFileForUser
ExpSaAllocatorFree
ExpSaPageGroupAllocateMemory
ExpSaPageGroupDescriptorAllocate
ExpSaPageGroupDescriptorFree
ExpSaPageGroupFreeMemory
ExpSetTimerObject
ExpShareAddressSpaceWithDevice
ExpSvmDereferenceDevice
ExpWnfAcquirePermanentDataStoreHandle
ExpWnfAllocateNextPersistentNameSequence
ExpWnfCompleteThreadSubscriptions
ExpWnfCreateNameInstance
ExpWnfCreateProcessContext
ExpWnfDeleteNameInstance
ExpWnfDeleteProcessContext
ExpWnfDeleteScopeById
ExpWnfDeleteScopeInstances
ExpWnfDeleteStateData
ExpWnfDeleteSubscription
ExpWnfDeliverThreadNotifications
ExpWnfDestroyPermanentDataStore
ExpWnfDispatchKernelSubscription
ExpWnfGetPermanentDataStore
ExpWnfInsertSubscriptionInPendingQueue
ExpWnfInvalidateDataStores
ExpWnfResolveScopeInstance
ExpWnfSubscribeNameInstance
ExpWnfUpdateSubscription
ExpWnfWriteStateData
ExpWorkerInitialization
FlushLookUpTableBucket
FsRtlInsertPerStreamContext
HvFoldBackDirtyData
HvFreeCell
HvHiveConvertLockedPagesToCowByPolicy
HvIsRangeDirty
HvpDoAllocateCell
HvpMarkCellDirty
LOCK_ADDRESS_SPACE
LOCK_HIVE_LOAD
LOCK_PAGE_TABLE_COMMITMENT
MI_LOCK_RELOCATIONS_EXCLUSIVE
MiAcquireKernelCfgLock
MiAddSpecialPurposeMemoryPrepare
MiAddViewsForSection
MiAllocatePartitionId
MiApplyImageHotPatchRequest
MiCaptureRetpolineImportInfo
MiChargeSegmentCommit
MiClearPartitionPageBitMap
MiCommitExistingVad
MiCommitPageTableRangesForVad
MiContractWsSwapPageFileWorker
MiCopyLargeVad
MiCreateFileOnlyImageFixupList
MiCreateHardwareEnclave
MiCreatePagingFile
MiCreatePagingFileMap
MiCreatePerSessionProtos
MiCreatePrototypePtes
MiDecommitHardwareEnclavePages
MiDeleteAllHardwareEnclaves
MiDeleteEmptyPageTables
MiDeleteEnclavePages
MiDeleteHotPatchEntry
MiDeleteHotPatchRecord
MiDeletePartitionResources
MiDereferenceExtendInfo
MiDereferencePerSessionProtos
MiFindSpecialPurposeMemoryTypeByPartition
MiFinishCreateSection
MiFinishResume
MiFreePartitionId
MiFreeRetpolineImportInfo
MiFreeSessionId
MiFreeUnusedPfnPages
MiGetChannelInformation
MiGetNewSessionId
MiGetPartitionNodeInformation
MiInitializeMirroring
MiInitializePagedPoolEvents
MiInitializePartialVad
MiInitializePartition
MiInitializePartitionSpecialPurposeMemory
MiInitializeSessionGlobals
MiInsertChildVads
MiInsertHotPatchRecord
MiInsertInSystemSpace
MiInsertPageFileInList
MiInsertPartitionPages
MiInsertSharedCommitNode
MiInsertVad
MiLateInitializeSystemCache
MiLoadHotPatchForUserSid
MiLockAddressSpaceToo
MiLockDriverMappings
MiLockDynamicMemoryExclusive
MiLockDynamicMemoryNestedExclusive
MiLockDynamicMemoryNestedParentExclusive
MiLockFileExtentsExclusive
MiLockLoaderEntry
MiLockNestedVad
MiLockPartitionSystemThreads
MiLockVad
MiLockVadRange
MiMakeDriverPagesPrivate
MiManageSubsectionView
MiMapViewOfDataSection
MiMarkHugePfnBad
MiMarkSharedImageCfgBits
MiObtainReferencedVadEx
MiObtainRelocationBits
MiPerformVadSplitting
MiPersistMdl
MiPopulateCfgBitMap
MiRemoveFromSystemSpace
MiRemoveSharedCommitNode
MiRemoveVad
MiReserveUserMemory
MiReturnImageBase
MiSectionDelete
MiSelectOverflowDllBase
MiSelectRelocationStartHint
MiSendParkedCoreUpdateToAllChildPartitions
MiSetPagesModified
MiSetProtectionOnSection
MiSetVadDeleted
MiShutdownSystem
MiSplitPrivatePage
MiSplitReducedCommitClonePage
MiTransferFileExtent
MiTrimUnusedPageFileRegionsWorker
MiUnloadHotPatchForUserSid
MiUnmapViewOfSection
MiUpControlAreaRefs
MiZeroAllPageFiles
MmAcquireLoadLock
MmCommitSessionMappedView
MmCreateShadowMapping
MmDecodeExportSection
MmDeleteShadowMapping
MmDuplicateMemory
MmEncodeExportSection
MmEnumerateBadPages
MmExtendSection
MmGetPageFileForCrashDump
MmOutSwapVirtualAddresses
MmOutSwapWorkingSet
MmResourcesAvailable
NtAllocateUuids
NtCancelTimer
NtNotifyChangeMultipleKeys
NtReleaseKeyedEvent
NtSetUuidSeed
NtWaitForKeyedEvent
PdcAcquireRwLockExclusive
TlgRegisterAggregateProviderEx
VrpDecrementSiloCount
VrpDereferenceDiffHiveEntry
VrpFindOrCreateDiffHiveEntryForMountPoint
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlInitializeJobForVreg
VrpHandleIoctlLoadDifferencingHive
VrpHandleIoctlLoadDifferencingHiveForHost
VrpHandleIoctlModifyFlags
VrpHandleIoctlUnloadDifferencingHiveForHost
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpIncrementSiloCount
VrpLoadDifferencingHive
VrpPreLoadKey
VrpPreUnloadKey
VrpUnloadDifferencingHive
VrpWaitForDiffHiveEntryTransitionOwnerToLeave
WbAddHeapExecutedBlockToCache
WbAddHeapExecutedBlockToLRU
WbAddWarbirdEncryptionSegment
WbAllocateSlots
WbAllocateUserMemory
WbDecryptEncryptionSegment
WbFreeMemoryBlockRegion
WbGetInitializedEncryptionSegment
WbGetWarbirdProcess
WbGetWarbirdThread
WbHeapExecutionUnloadModule
WbInPlaceEncryptionUnloadModule
WbMoveHeapExecutedBlockToBackOfLRU
WbReEncryptEncryptionSegment
WbRemoveWarbirdProcess
WheaConfigureErrorSource
WheaExecuteRowFailureCheck
WheaInitialize
WheaRegisterErrorSourceOverride
WheaRegisterInUsePageOfflineNotification
WheaSelLogCheckPoint
WheaSelLogSetNtSchedulerAvailability
WheaUnconfigureErrorSource
WheaUnregisterErrorSourceOverride
WheaUnregisterInUsePageOfflineNotification
WheapCallInUsePageNotificationCallbacks
WheapPfaReset
WheapPredictiveFailureAnalysis
Expand for full list:
CmFcManagerDrainAllFeatureUsageNotifications
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerRegisterFeatureConfigurationChangeNotification
CmFcManagerUnregisterFeatureConfigurationChangeNotification
CmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpManagerDrainUsageNotificationsWorker
CmFcpManagerRetryUsageNotificationsWorker
CmFcpManagerSoftwareHiveReady
CmFreezeRegistry
CmLockHiveCmLockHiveSecurityExclusive
CmRegisterMachineHiveLoadedNotification
CmSiRWLockAcquireExclusive
CmThawRegistry
CmUnregisterMachineHiveLoadedNotification
CmpAssignKeySecurity
CmpCloseKeyObject
CmpCopyMergeOfLayeredKeyNode
CmpCreateChild
CmpCreateHive
CmpCreateHiveRootCell
CmpDeleteHive
CmpDeleteKeyObject
CmpDereferenceNameControlBlockWithLock
CmpDoParseKey
CmpDoQueueLateUnloadWorker
CmpFinishSystemHivesLoad
CmpFlushHive
CmpFlushNotify
CmpFreeKeyByCell
CmpGetNameControlBlock
CmpInitCmRM
CmpLoadHiveVolatile
CmpLockAppHiveLoadList
CmpLockCallbackListExclusive
CmpLockContextListExclusive
CmpLockDeletedHashEntryExclusiveByKcb
CmpLockGlobalKeyLockTrackerExclusive
CmpLockHashEntryByIndexExclusive
CmpLockHashEntryExclusive
CmpLockHashEntryExclusiveByKcb
CmpLockHiveListExclusive
CmpLockKcbExclusive
CmpLockRegistryFreezeAware
CmpLockSiloKeyLockTrackerExclusive
CmpLockTwoSecurityCachesExclusiveShared
CmpMarkEntireIndexDirty
CmpNotifyMachineHiveLoaded
CmpRecoverFlushProtocolStateFromFiles
CmpRefreshHive
CmpReorganizeHive
CmpReportNotifyHelper
CmpSetKeySecurity
CmpTransMgrPrepare
CmpTransMgrSyncHive
CmpTrimHive
CmpVolumeContextDecrementRefCount
CmpVolumeContextSendDeviceUsageNotification
CmpVolumeManagerGetContextForFile
CmpWalkOneLevel
DifExfAcquirePushLockExclusiveWrapper
ExAcquireAutoExpandPushLockExclusive
ExAcquirePushLockExclusiveEx
ExGetWakeTimerList
ExInitializeDeviceAts
ExRegisterExtension
ExRegisterHost
ExSvmBeginDeviceReset
ExSvmFinalizeDeviceReset
ExUninitializeDeviceAts
ExUnregisterExtension
ExUuidCreate
ExWakeTimersPause
ExfAcquireCacheAwarePushLockExclusiveEx
ExfAcquirePushLockExclusive
ExfAcquireReleasePushLockExclusive
ExpAcquireFannedOutPushLockExclusive
ExpDeleteTimer
ExpKdPullRemoteFileForUser
ExpSaAllocatorFree
ExpSaPageGroupAllocateMemory
ExpSaPageGroupDescriptorAllocate
ExpSaPageGroupDescriptorFree
ExpSaPageGroupFreeMemory
ExpSetTimerObject
ExpShareAddressSpaceWithDevice
ExpSvmDereferenceDevice
ExpWnfAcquirePermanentDataStoreHandle
ExpWnfAllocateNextPersistentNameSequence
ExpWnfCompleteThreadSubscriptions
ExpWnfCreateNameInstance
ExpWnfCreateProcessContext
ExpWnfDeleteNameInstance
ExpWnfDeleteProcessContext
ExpWnfDeleteScopeById
ExpWnfDeleteScopeInstances
ExpWnfDeleteStateData
ExpWnfDeleteSubscription
ExpWnfDeliverThreadNotifications
ExpWnfDestroyPermanentDataStore
ExpWnfDispatchKernelSubscription
ExpWnfGetPermanentDataStore
ExpWnfInsertSubscriptionInPendingQueue
ExpWnfInvalidateDataStores
ExpWnfResolveScopeInstance
ExpWnfSubscribeNameInstance
ExpWnfUpdateSubscription
ExpWnfWriteStateData
ExpWorkerInitialization
FlushLookUpTableBucket
FsRtlInsertPerStreamContext
HvFoldBackDirtyData
HvFreeCell
HvHiveConvertLockedPagesToCowByPolicy
HvIsRangeDirty
HvpDoAllocateCell
HvpMarkCellDirty
LOCK_ADDRESS_SPACE
LOCK_HIVE_LOAD
LOCK_PAGE_TABLE_COMMITMENT
MI_LOCK_RELOCATIONS_EXCLUSIVE
MiAcquireKernelCfgLock
MiAddSpecialPurposeMemoryPrepare
MiAddViewsForSection
MiAllocatePartitionId
MiApplyImageHotPatchRequest
MiCaptureRetpolineImportInfo
MiChargeSegmentCommit
MiClearPartitionPageBitMap
MiCommitExistingVad
MiCommitPageTableRangesForVad
MiContractWsSwapPageFileWorker
MiCopyLargeVad
MiCreateFileOnlyImageFixupList
MiCreateHardwareEnclave
MiCreatePagingFile
MiCreatePagingFileMap
MiCreatePerSessionProtos
MiCreatePrototypePtes
MiDecommitHardwareEnclavePages
MiDeleteAllHardwareEnclaves
MiDeleteEmptyPageTables
MiDeleteEnclavePages
MiDeleteHotPatchEntry
MiDeleteHotPatchRecord
MiDeletePartitionResources
MiDereferenceExtendInfo
MiDereferencePerSessionProtos
MiFindSpecialPurposeMemoryTypeByPartition
MiFinishCreateSection
MiFinishResume
MiFreePartitionId
MiFreeRetpolineImportInfo
MiFreeSessionId
MiFreeUnusedPfnPages
MiGetChannelInformation
MiGetNewSessionId
MiGetPartitionNodeInformation
MiInitializeMirroring
MiInitializePagedPoolEvents
MiInitializePartialVad
MiInitializePartition
MiInitializePartitionSpecialPurposeMemory
MiInitializeSessionGlobals
MiInsertChildVads
MiInsertHotPatchRecord
MiInsertInSystemSpace
MiInsertPageFileInList
MiInsertPartitionPages
MiInsertSharedCommitNode
MiInsertVad
MiLateInitializeSystemCache
MiLoadHotPatchForUserSid
MiLockAddressSpaceToo
MiLockDriverMappings
MiLockDynamicMemoryExclusive
MiLockDynamicMemoryNestedExclusive
MiLockDynamicMemoryNestedParentExclusive
MiLockFileExtentsExclusive
MiLockLoaderEntry
MiLockNestedVad
MiLockPartitionSystemThreads
MiLockVad
MiLockVadRange
MiMakeDriverPagesPrivate
MiManageSubsectionView
MiMapViewOfDataSection
MiMarkHugePfnBad
MiMarkSharedImageCfgBits
MiObtainReferencedVadEx
MiObtainRelocationBits
MiPerformVadSplitting
MiPersistMdl
MiPopulateCfgBitMap
MiRemoveFromSystemSpace
MiRemoveSharedCommitNode
MiRemoveVad
MiReserveUserMemory
MiReturnImageBase
MiSectionDelete
MiSelectOverflowDllBase
MiSelectRelocationStartHint
MiSendParkedCoreUpdateToAllChildPartitions
MiSetPagesModified
MiSetProtectionOnSection
MiSetVadDeleted
MiShutdownSystem
MiSplitPrivatePage
MiSplitReducedCommitClonePage
MiTransferFileExtent
MiTrimUnusedPageFileRegionsWorker
MiUnloadHotPatchForUserSid
MiUnmapViewOfSection
MiUpControlAreaRefs
MiZeroAllPageFiles
MmAcquireLoadLock
MmCommitSessionMappedView
MmCreateShadowMapping
MmDecodeExportSection
MmDeleteShadowMapping
MmDuplicateMemory
MmEncodeExportSection
MmEnumerateBadPages
MmExtendSection
MmGetPageFileForCrashDump
MmOutSwapVirtualAddresses
MmOutSwapWorkingSet
MmResourcesAvailable
NtAllocateUuids
NtCancelTimer
NtNotifyChangeMultipleKeys
NtReleaseKeyedEvent
NtSetUuidSeed
NtWaitForKeyedEvent
PdcAcquireRwLockExclusive
TlgRegisterAggregateProviderEx
VrpDecrementSiloCount
VrpDereferenceDiffHiveEntry
VrpFindOrCreateDiffHiveEntryForMountPoint
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlLoadDifferencingHive
VrpHandleIoctlLoadDifferencingHiveForHost
VrpHandleIoctlModifyFlags
VrpHandleIoctlUnloadDifferencingHiveForHost
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpIncrementSiloCount
VrpLoadDifferencingHive
VrpPreLoadKey
VrpPreUnloadKey
VrpUnloadDifferencingHive
VrpWaitForDiffHiveEntryTransitionOwnerToLeave
WbAddHeapExecutedBlockToCache
WbAddHeapExecutedBlockToLRU
WbAddWarbirdEncryptionSegment
WbAllocateSlots
WbAllocateUserMemory
WbDecryptEncryptionSegment
WbFreeMemoryBlockRegion
WbGetInitializedEncryptionSegment
WbGetWarbirdProcess
WbGetWarbirdThread
WbHeapExecutionUnloadModule
WbInPlaceEncryptionUnloadModule
WbMoveHeapExecutedBlockToBackOfLRU
WbReEncryptEncryptionSegment
WbRemoveWarbirdProcess
WheaConfigureErrorSource
WheaExecuteRowFailureCheck
WheaInitialize
WheaRegisterErrorSourceOverride
WheaRegisterInUsePageOfflineNotification
WheaSelLogCheckPoint
WheaSelLogSetNtSchedulerAvailability
WheaUnconfigureErrorSource
WheaUnregisterErrorSourceOverride
WheaUnregisterInUsePageOfflineNotification
WheapCallInUsePageNotificationCallbacks
WheapPfaReset
WheapPredictiveFailureAnalysis
paramcount 0 0
address 14026b630 14026b3d0
sig undefined ExfAcquirePushLockExclusiveEx(void) undefined ExfAcquirePushLockExclusiveEx(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

ExfAcquirePushLockExclusiveEx Calling Diff

--- ExfAcquirePushLockExclusiveEx calling
+++ ExfAcquirePushLockExclusiveEx calling
@@ -243 +242,0 @@
-VrpHandleIoctlInitializeJobForVreg

KiLeaveCriticalRegionUnsafe

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 1.0
i_ratio 0.71
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name KiLeaveCriticalRegionUnsafe KiLeaveCriticalRegionUnsafe
fullname KiLeaveCriticalRegionUnsafe KiLeaveCriticalRegionUnsafe
refcount 900 898
length 50 50
called KiCheckForKernelApcDelivery KiCheckForKernelApcDelivery
calling
Expand for full list:
AlpcCreateSecurityContext
AlpciDestroyDeferredMessageContext
AlpciSendDeferredMessageBeforeWait
AlpcpClosePort
AlpcpConnectPort
AlpcpDeletePort
AlpcpFreeMessageFunction
AlpcpInitSystem
AlpcpOpenPort
ArbArbiterHandler
ArbBuildAssignmentOrderingBgkpLockBgfxCodeSection
BgkpUnlockBgfxCodeSection
CmFcManagerDrainAllFeatureUsageNotifications
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerQueryFeatureConfigurationSectionInformation
CmFcManagerRegisterFeatureConfigurationChangeNotification
CmFcManagerStartRuntimePhase
CmFcManagerUnregisterFeatureConfigurationChangeNotification
CmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpManagerDrainUsageNotificationsWorker
CmFcpManagerRetryUsageNotificationsWorker
CmFcpManagerSoftwareHiveReady
CmFreezeRegistry
CmKeyBodyRemapToVirtualForEnum
CmLoadDifferencingKey
CmLockKeyForWrite
CmSaveKeyToBuffer
CmUnloadKey
CmpCloseKeyObject
CmpCoalescingCallback
CmpCompleteUnloadKey
CmpDoQueryKeyName
CmpInitCmRM
CmpIsCmRm
CmpRunDownCmRM
CmpSecurityMethod
CmpStartSiloKeyLockTracker
CmpStopSiloKeyLockTracker
CmpUnlockAppHiveLoadList
CmpUnlockGlobalKeyLockTracker
DbgkCaptureLiveKernelDump
DbgkFlushErrorPort
DbgkRegisterErrorPort
DbgkpRemoveErrorPort
DbgkpSendErrorMessage
DbgkpSuspendProcess
DbgkpWerDeferredWriteRoutine
DifExReleaseResourceAndLeaveCriticalRegionWrapper
DifKeLeaveCriticalRegionWrapper
DrvDbAcquireDatabaseNodeBaseKey
DrvDbOpenDriverDatabaseRegKey
DrvDbReleaseDatabaseNodeBaseKey
DrvDbSetDriverDatabaseMappedProperty
EtwQueryPerformanceTraceInformation
EtwQueryProcessTelemetryCoverage
EtwRegisterEventCallback
EtwSendTraceBuffer
EtwSetPerformanceTraceInformation
EtwTraceEvent
EtwTraceRaw
EtwpBufferingModeFlush
EtwpClearSessionAndUnreferenceEntry
EtwpCloseLogger
EtwpCovSampCaptureContextStop
EtwpCovSampContextAddSamples
EtwpCovSampContextCleanup
EtwpCovSampContextGetModule
EtwpCovSampContextPruneModules
EtwpCovSampHashMakeRoomAndAcquireLock
EtwpCovSampProcessAddModule
EtwpCoverageCheckCP
EtwpCoverageEnsureUserModeView
EtwpCoverageFlushWorkItemCallback
EtwpCoverageProvEnableCallback
EtwpCoverageReset
EtwpCoverageResetCP
EtwpCoverageSamplerClose
EtwpCoverageSamplerQuery
EtwpCoverageSamplerSetBloomFilter
EtwpCoverageSamplerStart
EtwpCoverageSamplerStop
EtwpDeleteRegistrationObject
EtwpDeleteSessionDemuxObject
EtwpEventWriteFull
EtwpFlushCoverage
EtwpFlushTrace
EtwpGetPmcSessions
EtwpGetPrivateSessionTraceHandle
EtwpGetSoftRestartInformation
EtwpGetTraceGroupInfo
EtwpGetTraceGuidInfo
EtwpIncrementTraceFile
EtwpInitializeSiloState
EtwpNotifyDisallowedGuidChange
EtwpNotifyGuid
EtwpQueryReferenceTime
EtwpQueryTrace
EtwpReceiveNotification
EtwpRegisterPrivateSession
EtwpRegisterUMProvider
EtwpRundownNotifications
EtwpSendReplyDataBlock
EtwpSetSoftRestartInformation
EtwpStartTrace
EtwpStopLoggerInstance
EtwpStopTrace
EtwpTraceMessageVa
EtwpTracingProvEnableCallback
EtwpTrackGuidEntryRegistrations
EtwpTrackProviderBinary
EtwpTransitionToRealtime
EtwpUpdateLoggerSecurityDescriptor
EtwpUpdateTrace
ExCreateHandleEx
ExCreateHandleTable
ExDisableHandleTracing
ExDupHandleTable
ExEnableHandleExceptions
ExEnableHandleTracing
ExEnableRaiseUMExceptionOnInvalidHandleClose
ExEnumHandleTable
ExFetchLicenseData
ExFetchLicenseData$fin$0
ExGetLicenseTamperState
ExGetWakeTimerList
ExInitLicenseData
ExNotifyPlatformBinaryExecuted
ExQueryHandleExceptionsPermanency
ExQueryWnfStateData
ExReferenceHandleDebugInfo
ExRegisterExtension
ExRegisterHost
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
ExReleaseResourceAndLeavePriorityRegion
ExSetLicenseTamperState
ExSweepHandleTable
ExUnregisterExtension
ExUnsubscribeWnfStateChange
ExUuidCreate
ExWnfCleanupServerSiloState
ExWnfHiveUnloaded
ExpCovQueryInformation
ExpCovResetInformation
ExpDeleteTimer
ExpGetFirmwareEnvironmentVariable
ExpGetGlobalLocaleSection
ExpGetProcessInformation
ExpGetSystemFirmwareTableInformation
ExpGetSystemPlatformBinary
ExpKdPullRemoteFileForUser
ExpLoadAndSortLicensingCacheDescriptors
ExpLoadAndSortLicensingCacheDescriptors$fin$0
ExpLoadAndSortLicensingCacheDescriptors$fin$1
ExpNtDeleteWnfStateData
ExpNtUpdateWnfStateData
ExpPrmInitialization
ExpPutLicenseDataIntoRegistry$fin$0
ExpQueryBootLoaderMetadata
ExpQueryLicenseValueFromBlobHelper$fin$0
ExpQuerySingleModuleInformation
ExpQuerySystemInformation
ExpReadLeapSecondData
ExpRegisterFirmwareTableInformationHandler
ExpRemoveHandleTable
ExpSetBootEntry
ExpSetBootLoaderMetadata
ExpSetDriverEntry
ExpSetFirmwareEnvironmentVariable
ExpSetTimerObject
ExpSnapShotHandleTables
ExpWnfWorkItemRoutine
ExpWorkerFactoryCreateThread
FUN_14036f764
FUN_1409fa77c
FsRtlCancelNotify
FsRtlCancelNotify$fin$1
FsRtlCopyRead
FsRtlCopyWrite
FsRtlCreateSectionForDataScan
FsRtlInsertPerFileContext
FsRtlInsertPerFileObjectContext
FsRtlInsertPerStreamContext
FsRtlLookupPerFileContext
FsRtlLookupPerStreamContextInternal
FsRtlMdlReadDev
FsRtlPrepareMdlWriteDev
FsRtlRemovePerFileContext
FsRtlRemovePerFileObjectContext
FsRtlRemovePerStreamContext
FsRtlTeardownPerFileContexts
FsRtlTeardownPerFileContexts$fin$0
FsRtlTeardownPerStreamContexts
FsRtlTeardownPerStreamContexts$fin$0
HvlQuerySetBootPagesInfo
IoConfigureCrashDump
IoDisconnectInterrupt
IoEnumerateRegisteredFiltersList
IoFillTriageDumpBuffer
IoGetDeviceInterfaceAlias
IoInitializeCrashDump
IoOpenDeviceInterfaceRegistryKey
IoOpenDeviceRegistryKey
IoRegisterContainerNotification
IoRegisterFileSystem
IoRegisterFsRegistrationChangeMountAware
IoReportDetectedDevice
IoReportRootDevice
IoUnregisterContainerNotification
IoUnregisterFileSystem
IoUnregisterFsRegistrationChange
IoUnregisterPriorityCallback
IoUpdateDumpPhysicalRanges
IoVerifyVolume
IopAcquireReleaseConnectLockInternal
IopAcquireReleaseDispatcherLock
IopBootLogToFile
IopCopyBootLogRegistryToFile
IopCreateSecurityCheck
IopDestroyActiveConnectBlock
IopGetDeviceInterfaces
IopGetRootDevices
IopGetSetSecurityObject
IopInvalidateVolumesForDevice
IopMountVolume
IopParseDevice
IopSetDeviceSecurityDescriptor
KeDeleteMutant
KeDeregisterBoundCallback
KeQueryDpcWatchdogConfiguration
KeReleaseMutant
KeRundownApcQueues
KeSetSystemServiceCallback
KeSetTracepoint
KeUpdateDpcWatchdogConfiguration
KiConnectSecondaryInterrupt
KiDisconnectSecondaryInterrupt
KiHandleBound
KiInvokeInterruptServiceRoutine
KiShouldLogUserModeReturnMismatch
KiStartSavingSupervisorState
KiSynchronizePassiveInterruptExecution
KiTpIsExcludedKernelTracepointLocation
KseRegisterShimEx
KseUnregisterShim
KsepShimDbChanged
LdrpKrnGetDataTableEntry
LpcpRequestWaitReplyPort
MiCancelPhase0Locking
MiCombineIdenticalPages
MiCreateImageOrDataSection
MiDeleteBootRange
MiFinishHardFault
MiFinishVadDeletion
MiFlushAllPagesWorker
MiFlushSectionInternal
MiForceCrashForInvalidAccess
MiGatherPagefilePages
MiInitializeDriverImages
MiIssueHardFault
MiLockImageSection
MiLogPinDriverAddress
MiLookupDataTableEntry
MiPrefetchControlArea
MiPrefetchVirtualMemory
MiProcessLoaderEntry
MiRememberUnloadedDriver
MiReplenishSlabAllocator
MiSharePages
MiStoreWriteModifiedPages
MiUnlockBootPageSections
MiUnlockControlAreaSectionExtend
MiUnlockImageSection
MiWriteProtectSystemImages
MmChangeImageProtection
MmEnumerateSystemImages
MmFreeBootDriverInitializationCode
MmGetSectionRange
MmIsDriverVerifyingByAddress
MmLockPagableDataSection
MmLockRegistryRecoverySections
MmPrefetchPagesEx
MmReleaseLoadLock
MmVerifyCallbackFunctionCheckFlags
NormalizationList__Unlock
NtAcceptConnectPort
NtAdjustGroupsToken
NtAdjustPrivilegesToken
NtAllocateUuids
NtAlpcAcceptConnectPort
NtAlpcCancelMessage
NtAlpcCreatePort
NtAlpcCreatePortSection
NtAlpcCreateResourceReserve
NtAlpcCreateSectionView
NtAlpcCreateSecurityContext
NtAlpcDeletePortSection
NtAlpcDeleteResourceReserve
NtAlpcDeleteSectionView
NtAlpcDeleteSecurityContext
NtAlpcDisconnectPort
NtAlpcImpersonateClientContainerOfPort
NtAlpcImpersonateClientOfPort
NtAlpcOpenSenderProcess
NtAlpcOpenSenderThread
NtAlpcQueryInformationMessage
NtAlpcRevokeSecurityContext
NtAlpcSetInformation
NtCancelTimer
NtChangeProcessState
NtChangeThreadState
NtCreateLowBoxToken
NtCreatePort
NtCreatePrivateNamespace
NtCreateUserProcess
NtCreateWaitablePort
NtCreateWnfStateName
NtDeleteBootEntry
NtDeleteDriverEntry
NtDeleteKey
NtDeleteValueKey
NtDeleteWnfStateName
NtDuplicateToken
NtEnumerateBootEntries
NtEnumerateDriverEntries
NtEnumerateSystemEnvironmentValuesEx
NtEnumerateValueKey
NtFlushInstallUILanguage
NtFlushKey
NtGetCompleteWnfStateSubscription
NtGetEnvironmentVariableEx
NtGetMUIRegistryInfo
NtMakePermanentObject
NtMapCMFModule
NtMapCMFModule$fin$0
NtMapCMFModule$fin$1
NtOpenPrivateNamespace
NtOpenProcessTokenEx
NtOpenThreadTokenEx
NtQueryBootEntryOrder
NtQueryBootOptions
NtQueryDriverEntryOrder
NtQueryEnvironmentVariableInfoEx
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInformationThread$fin$3
NtQueryInformationToken
NtQueryMultipleValueKey
NtQuerySecurityAttributesToken
NtQuerySystemEnvironmentValue
NtQueryWnfStateData
NtQueryWnfStateNameInformation
NtReadRequestData
NtReleaseKeyedEvent
NtRenameKey
NtReplaceKey
NtReplyPort
NtReplyWaitReceivePortEx
NtReplyWaitReplyPort
NtRequestPort
NtRequestWaitReplyPort
NtRestoreKey
NtSaveKeyEx
NtSaveMergedKeys
NtSecureConnectPort
NtSetBootEntryOrder
NtSetBootOptions
NtSetDriverEntryOrder
NtSetInformationKey
NtSetInformationThread
NtSetInformationThread$fin$1
NtSetInformationToken
NtSetSystemEnvironmentValue
NtSetUuidSeed
NtSetValueKey
NtSetWnfProcessNotificationEvent
NtSubscribeWnfStateChange
NtTerminateProcess
NtTraceEvent
NtUnsubscribeWnfStateChange
NtWaitForKeyedEvent
NtWriteRequestData
ObDereferenceSecurityDescriptor
ObDuplicateObject
ObInsertObjectEx
ObLogSecurityDescriptor
ObOpenObjectByNameEx
ObQueryObjectAuditingByHandle
ObReferenceFileObjectForWrite
ObReleaseObjectSecurity
ObRevokeHandles
ObSetHandleAttributes
ObSetSecurityDescriptorInfo
ObShutdownSystem
ObWaitForMultipleObjects
ObpAuditObjectAccess
ObpCloseHandle
ObpCreateHandle
ObpDeleteDirectoryObject
ObpLookupObjectName
ObpReferenceObjectByHandleWithTag
ObpReferenceProcessObjectByHandle
ObpRegisterPrivateNamespace
ObpRemoveNamespaceFromTable
Ordinal_15
PerfDiagpProxyWorker
PfSnCheckActionsNeeded
PfSnPopulateReadList
PfSnPrefetchCacheEntryUpdate
PfSnSectionInfoCleanupWorkItem
PfpPrefetchSharedCleanup
PfpRpCHashDeleteEntries
PfpScenCtxQueryScenarioInformation
PfpScenCtxServiceThreadSet
PiCMCreateDevice
PiCMDeleteDevice
PiCMGenerateDeviceInstance
PiCMUnregisterDeviceInterface
PiDcHandleCustomDeviceEvent
PiDqDispatch
PiDqIrpQueryCreate
PiDqIrpQueryGetResult
PiDqObjectManagerEnumerateAndRegisterQuery
PiDqObjectManagerServiceActionQueue
PiDqQueryApplyObjectEvent
PiDqQuerySerializeActionQueue
PiDqQueryUnlock
PiDrvDbLoadNode
PiDrvDbUnloadNode
PiDrvDbUnloadNodeWaitWorkerCallback
PiDrvDbUnloadNodeWorkerCallback
PiGetRelatedDevice
PiInitializeDevice
PiPnpRtlObjectEventWorker
PipKsrNotifyDrivers
PipResetDevices
PnpCancelDeviceActionRequest
PnpNotifyDeviceClassChange
PnpNotifyTargetDeviceChange
PnpNotifyTargetDeviceChangeNotifyEntry
PnpQueuePendingSurpriseRemoval
PnpShutdownDevices
PnpUnregisterPlugPlayNotification
PoFxStartDevicePowerManagement
PoUnregisterCoalescingCallback
PopDiagTraceFxRundown
PopDripsWatchdogCallbackWorker
PopDripsWatchdogDiagnosticWorker
PopDripsWatchdogStartWatchdog
PopDripsWatchdogStopWatchdog
PopFxAcpiPrepareDevice
PopFxActivateDevicesForSx
PopFxDestroyDirectedDripsCandidateDeviceList
PopFxDestroyDripsBlockingDeviceList
PopFxDisableBasicAccountingWorker
PopFxIdleDevicesFromSx
PopFxInsertAcpiDevice
PopFxInsertDevice
PopFxLowPowerEpochCallback
PopFxPauseDeviceAccounting
PopFxPrepareDevicesForShutdown
PopFxRegisterDeviceWithPep
PopFxRegisterPluginEx
PopFxRemoveAcpiDevice
PopFxResidentTimeoutRoutine
PopFxResumeDeviceAccounting
PopFxStartDeviceAccounting
PopFxStopDeviceAccounting
PopPepIdleTimeoutRoutine
PopPepInsertDevice
PopPepPlatformStateRegistered
PopPepWork
PopPowerAggregatorEngageModernStandby
PopPowerButtonBugcheckConfigure
PopReleaseAwaymodeLock
PpDevCfgProcessDevices
PsCallEnclave
PsCallImageNotifyRoutines
PsCaptureExceptionPort
PsCreateVsmEnclave
PsDisableImpersonation
PsFreezeProcess
PsGetNextProcessThread
PsGetProcessDeepFreezeStats
PsGetProcessEnclaveModuleInfo
PsImpersonateClient
PsInitializeVsmEnclave
PsLoadVsmEnclaveData
PsMultiResumeProcess
PsQueryProcessEnergyValues
PsQueryProcessExceptionFlags
PsQueryRuntimeProcess
PsQueryStatisticsProcess
PsQueryTotalCycleTimeProcess
PsReferenceImpersonationToken
PsReferenceImpersonationTokenEx
PsReferencePartitionSystemProcess
PsReferencePrimaryTokenWithTag
PsRegisterAltSystemCallHandler
PsRemoveCreateThreadNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsRestoreImpersonation
PsSetProcessFaultInformation
PsSetProcessTelemetryAppState
PsSetProcessWin32Process
PsShutdownSystem
PsStartSiloMonitor
PsSuspendProcess
PsSuspendThread
PsSwapImpersonationToken
PsSwapProcessWorkingSet
PsSynchronizeWithThreadInsertion
PsTerminateMinimalProcess
PsTerminateProcess
PsThawMultiProcess
PsUnregisterSiloMonitor
PsUpdateActiveProcessAffinity
PsWatchWorkingSet
PspAllocateAndQueryProcessNotificationChannel
PspApplyCoreIsolationPolicy
PspAssignPrimaryToken
PspAssignProcessToJob
PspAttachProcessToSyscallProvider
PspChargeProcessWakeCounter
PspCreatePicoProcess
PspCreatePicoThread
PspCreateThread
PspDeleteProcessStateChange
PspDestroySyscallProvider
PspDetachProcessFromSyscallProvider
PspEnableProcessOptionalXStateFeatures
PspExitProcess
PspExitThread
PspGetNextSyscallProviderProcess
PspGetPreviousProcessThread
PspInheritSyscallProvider
PspInsertProcess
PspInsertSyscallProvider
PspJobDelete
PspLockUnlockProcessExclusive
PspLookupSyscallProviderById
PspMarkServerSiloAsTerminating
PspNotifyProcessEffectiveIoLimitChanged
PspNotifyServerSiloCreation
PspNotifyServerSiloTermination
PspProcessClose
PspProcessDynamicEHContinuationTargets
PspProcessDynamicEnforcedAddressRanges
PspQueryWorkingSetWatch
PspReferenceSystemDll
PspRemoveEnclaveThreadWait
PspRemoveProcessFromJobChain
PspRundownSingleProcess
PspSelectVsmEnclaveByNumber
PspSetCreateProcessNotifyRoutine
PspSetJobIoRateControl
PspSetProcessAffinityUpdateMode
PspSetProcessDefaultHardErrorMode
PspSetProcessForegroundBackgroundRequest
PspSetProcessPriorityClass
PspStorageAllocSlot
PspStorageEmptyArray
PspStorageEmptyArrayNonReadonly
PspStorageFreeSlot
PspStorageGetObject
PspStorageInsertObject
PspStorageMakeSlotReadOnly
PspStorageRemoveObject
PspStorageReplaceObject
PspSyscallProviderOptIn
PspTeardownPartition
PspTerminatePicoProcess
PspThreadDelete
PspUnlockProcessExclusive
PspUnlockQuotaListExclusive
PspUnlockQuotaListShared
PspWow64ReadOrWriteThreadCpuArea
RawDispatch
RtlFindDynamicEnforcedAddressInRanges
RtlRunOnceExecuteOnce
RtlpFindDynamicEHContinuationTarget
RtlpInsertStringAtom
RtlpSetSecurityObject
SLGetSubscriptionPfn
SLGetSubscriptionPfn$fin$0
SLGetSubscriptionPfn$fin$1
SLQueryLicenseValueInternal
SLUpdateLicenseDataInternal
SLUpdateLicenseDataInternal$fin$0
SLUpdateLicenseDataInternal$fin$1
SMKM_STORE<SM_TRAITS>::SmStCleanup
SeAccessCheckByType
SeCaptureSubjectContextEx
SeDefaultObjectMethod
SeExchangePrimaryToken
SeIsTokenAssignableToProcess
SeMarkLogonSessionForTerminationNotificationEx
SeQuerySessionIdTokenEx
SeRegisterLogonSessionTerminatedRoutine
SeRegisterLogonSessionTerminatedRoutineEx
SeRegisterObjectTypeMandatoryPolicy
SeSetMandatoryPolicyToken
SeSetPrivateNameSpaceToken
SeSetSecurityAttributesTokenEx
SeSetSessionIdTokenWithLinked
SeSetVirtualizationToken
SeTokenGetNoChildProcessRestricted
SeTokenGetRedirectionTrustPolicy
SeTokenIsNoChildProcessRestrictionEnforced
SeTokenSetNoChildProcessRestricted
SeTokenSetRedirectionTrustPolicy
SeUnregisterLogonSessionTerminatedRoutine
SeUnregisterLogonSessionTerminatedRoutineEx
SendCaptureStateNotificationsWorker
SepAccessCheckAndAuditAlarm
SepAddLuidToIndexEntry
SepAppendAceToTokenObjectAcl
SepBlockAccessForLogonSession
SepCreateLogonSessionTrack
SepDeleteLogonSessionTrack
SepDeleteUnreferencedLogonSessionsInSilo
SepDereferenceCachedHandlesEntry
SepDesktopAppxSubProcessToken
SepFilterToken
SepIdAssignableAsGroup
SepInternalSetSecurityAttributesToken
SepIsParentOfChildAppContainer
SepIsValidProcUniqueLuid
SepMakeLogonSessionsSiblings
SepNotifyFileSystems
SepRmCallLsa
SepRmCapUpdateWrkr
SepRmCommandServerThread
SepSetTokenCachedHandles
SepSetTokenClaims
SepSetTokenUserAndGroups
SepUpdateLogonSessionTrack
UNLOCK_HIVE_LOAD
ViPendingQueuePassiveLevelCompletion
VmPinMemoryRange
VmUnpinMemoryRange
VmpPauseResumeNotify
VrpDecrementSiloCount
VrpDereferenceDiffHiveEntry
VrpFindDiffHiveEntryForMountPoint
VrpFindOrCreateDiffHiveEntryForMountPoint
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlInitializeJobForVreg
VrpHandleIoctlLoadDifferencingHive
VrpHandleIoctlModifyFlags
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpIncrementSiloCount
VrpLoadDifferencingHive
VrpPostEnumerateKey
VrpPostUnloadKey
VrpPreLoadKey
VrpPreUnloadKey
VrpRelinquishDiffHiveEntryTransitionOwner
VrpTranslatePath
VrpUnloadDifferencingHive
VrpWaitForDiffHiveEntryTransitionOwnerToLeave
VslRegisterBootDrivers
VslpEnterIumSecureMode
WdipSemInitialize
WdipSemMarkNextTimedOutInstanceForDeletion
WdipSemSqmLogInflightLimitExceededDataPoints
WdipSemUpdate
WdipTimeoutCheckRoutine
WheaRegisterErrorSourceOverride
WheaSelLogCheckPoint
WheaSelLogSetNtSchedulerAvailability
WheaUnregisterErrorSourceOverride
WmipFindSMBiosStructure
WmipGetSMBiosEventlog
WmipGetSMBiosTableData
WmipGetSysIds
WmipReleaseSmbiosLockShared
_PnpCtxCloseMachine
Expand for full list:
AlpcCreateSecurityContext
AlpciDestroyDeferredMessageContext
AlpciSendDeferredMessageBeforeWait
AlpcpClosePort
AlpcpConnectPort
AlpcpDeletePort
AlpcpFreeMessageFunction
AlpcpInitSystem
AlpcpOpenPort
ArbArbiterHandler
ArbBuildAssignmentOrderingBgkpLockBgfxCodeSection
BgkpUnlockBgfxCodeSection
CmFcManagerDrainAllFeatureUsageNotifications
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerQueryFeatureConfigurationSectionInformation
CmFcManagerRegisterFeatureConfigurationChangeNotification
CmFcManagerStartRuntimePhase
CmFcManagerUnregisterFeatureConfigurationChangeNotification
CmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpManagerDrainUsageNotificationsWorker
CmFcpManagerRetryUsageNotificationsWorker
CmFcpManagerSoftwareHiveReady
CmFreezeRegistry
CmKeyBodyRemapToVirtualForEnum
CmLoadDifferencingKey
CmLockKeyForWrite
CmSaveKeyToBuffer
CmUnloadKey
CmpCloseKeyObject
CmpCoalescingCallback
CmpCompleteUnloadKey
CmpDoQueryKeyName
CmpInitCmRM
CmpIsCmRm
CmpRunDownCmRM
CmpSecurityMethod
CmpStartSiloKeyLockTracker
CmpStopSiloKeyLockTracker
CmpUnlockAppHiveLoadList
CmpUnlockGlobalKeyLockTracker
DbgkCaptureLiveKernelDump
DbgkFlushErrorPort
DbgkRegisterErrorPort
DbgkpRemoveErrorPort
DbgkpSendErrorMessage
DbgkpSuspendProcess
DbgkpWerDeferredWriteRoutine
DifExReleaseResourceAndLeaveCriticalRegionWrapper
DifKeLeaveCriticalRegionWrapper
DrvDbAcquireDatabaseNodeBaseKey
DrvDbOpenDriverDatabaseRegKey
DrvDbReleaseDatabaseNodeBaseKey
DrvDbSetDriverDatabaseMappedProperty
EtwQueryPerformanceTraceInformation
EtwQueryProcessTelemetryCoverage
EtwRegisterEventCallback
EtwSendTraceBuffer
EtwSetPerformanceTraceInformation
EtwTraceEvent
EtwTraceRaw
EtwpBufferingModeFlush
EtwpClearSessionAndUnreferenceEntry
EtwpCloseLogger
EtwpCovSampCaptureContextStop
EtwpCovSampContextAddSamples
EtwpCovSampContextCleanup
EtwpCovSampContextGetModule
EtwpCovSampContextPruneModules
EtwpCovSampHashMakeRoomAndAcquireLock
EtwpCovSampProcessAddModule
EtwpCoverageCheckCP
EtwpCoverageEnsureUserModeView
EtwpCoverageFlushWorkItemCallback
EtwpCoverageProvEnableCallback
EtwpCoverageReset
EtwpCoverageResetCP
EtwpCoverageSamplerClose
EtwpCoverageSamplerQuery
EtwpCoverageSamplerSetBloomFilter
EtwpCoverageSamplerStart
EtwpCoverageSamplerStop
EtwpDeleteRegistrationObject
EtwpDeleteSessionDemuxObject
EtwpEventWriteFull
EtwpFlushCoverage
EtwpFlushTrace
EtwpGetPmcSessions
EtwpGetPrivateSessionTraceHandle
EtwpGetSoftRestartInformation
EtwpGetTraceGroupInfo
EtwpGetTraceGuidInfo
EtwpIncrementTraceFile
EtwpInitializeSiloState
EtwpNotifyDisallowedGuidChange
EtwpNotifyGuid
EtwpQueryReferenceTime
EtwpQueryTrace
EtwpReceiveNotification
EtwpRegisterPrivateSession
EtwpRegisterUMProvider
EtwpRundownNotifications
EtwpSendReplyDataBlock
EtwpSetSoftRestartInformation
EtwpStartTrace
EtwpStopLoggerInstance
EtwpStopTrace
EtwpTraceMessageVa
EtwpTracingProvEnableCallback
EtwpTrackGuidEntryRegistrations
EtwpTrackProviderBinary
EtwpTransitionToRealtime
EtwpUpdateLoggerSecurityDescriptor
EtwpUpdateTrace
ExCreateHandleEx
ExCreateHandleTable
ExDisableHandleTracing
ExDupHandleTable
ExEnableHandleExceptions
ExEnableHandleTracing
ExEnableRaiseUMExceptionOnInvalidHandleClose
ExEnumHandleTable
ExFetchLicenseData
ExFetchLicenseData$fin$0
ExGetLicenseTamperState
ExGetWakeTimerList
ExInitLicenseData
ExNotifyPlatformBinaryExecuted
ExQueryHandleExceptionsPermanency
ExQueryWnfStateData
ExReferenceHandleDebugInfo
ExRegisterExtension
ExRegisterHost
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
ExReleaseResourceAndLeavePriorityRegion
ExSetLicenseTamperState
ExSweepHandleTable
ExUnregisterExtension
ExUnsubscribeWnfStateChange
ExUuidCreate
ExWnfCleanupServerSiloState
ExWnfHiveUnloaded
ExpCovQueryInformation
ExpCovResetInformation
ExpDeleteTimer
ExpGetFirmwareEnvironmentVariable
ExpGetGlobalLocaleSection
ExpGetProcessInformation
ExpGetSystemFirmwareTableInformation
ExpGetSystemPlatformBinary
ExpKdPullRemoteFileForUser
ExpLoadAndSortLicensingCacheDescriptors
ExpLoadAndSortLicensingCacheDescriptors$fin$0
ExpLoadAndSortLicensingCacheDescriptors$fin$1
ExpNtDeleteWnfStateData
ExpNtUpdateWnfStateData
ExpPrmInitialization
ExpPutLicenseDataIntoRegistry$fin$0
ExpQueryBootLoaderMetadata
ExpQueryLicenseValueFromBlobHelper$fin$0
ExpQuerySingleModuleInformation
ExpQuerySystemInformation
ExpReadLeapSecondData
ExpRegisterFirmwareTableInformationHandler
ExpRemoveHandleTable
ExpSetBootEntry
ExpSetBootLoaderMetadata
ExpSetDriverEntry
ExpSetFirmwareEnvironmentVariable
ExpSetTimerObject
ExpSnapShotHandleTables
ExpWnfWorkItemRoutine
ExpWorkerFactoryCreateThread
FUN_14036f754
FUN_1409fa70c
FsRtlCancelNotify
FsRtlCancelNotify$fin$1
FsRtlCopyRead
FsRtlCopyWrite
FsRtlCreateSectionForDataScan
FsRtlInsertPerFileContext
FsRtlInsertPerFileObjectContext
FsRtlInsertPerStreamContext
FsRtlLookupPerFileContext
FsRtlLookupPerStreamContextInternal
FsRtlMdlReadDev
FsRtlPrepareMdlWriteDev
FsRtlRemovePerFileContext
FsRtlRemovePerFileObjectContext
FsRtlRemovePerStreamContext
FsRtlTeardownPerFileContexts
FsRtlTeardownPerFileContexts$fin$0
FsRtlTeardownPerStreamContexts
FsRtlTeardownPerStreamContexts$fin$0
HvlQuerySetBootPagesInfo
IoConfigureCrashDump
IoDisconnectInterrupt
IoEnumerateRegisteredFiltersList
IoFillTriageDumpBuffer
IoGetDeviceInterfaceAlias
IoInitializeCrashDump
IoOpenDeviceInterfaceRegistryKey
IoOpenDeviceRegistryKey
IoRegisterContainerNotification
IoRegisterFileSystem
IoRegisterFsRegistrationChangeMountAware
IoReportDetectedDevice
IoReportRootDevice
IoUnregisterContainerNotification
IoUnregisterFileSystem
IoUnregisterFsRegistrationChange
IoUnregisterPriorityCallback
IoUpdateDumpPhysicalRanges
IoVerifyVolume
IopAcquireReleaseConnectLockInternal
IopAcquireReleaseDispatcherLock
IopBootLogToFile
IopCopyBootLogRegistryToFile
IopCreateSecurityCheck
IopDestroyActiveConnectBlock
IopGetDeviceInterfaces
IopGetRootDevices
IopGetSetSecurityObject
IopInvalidateVolumesForDevice
IopMountVolume
IopParseDevice
IopSetDeviceSecurityDescriptor
KeDeleteMutant
KeDeregisterBoundCallback
KeQueryDpcWatchdogConfiguration
KeReleaseMutant
KeRundownApcQueues
KeSetSystemServiceCallback
KeSetTracepoint
KeUpdateDpcWatchdogConfiguration
KiConnectSecondaryInterrupt
KiDisconnectSecondaryInterrupt
KiHandleBound
KiInvokeInterruptServiceRoutine
KiShouldLogUserModeReturnMismatch
KiStartSavingSupervisorState
KiSynchronizePassiveInterruptExecution
KiTpIsExcludedKernelTracepointLocation
KseRegisterShimEx
KseUnregisterShim
KsepShimDbChanged
LdrpKrnGetDataTableEntry
LpcpRequestWaitReplyPort
MiCancelPhase0Locking
MiCombineIdenticalPages
MiCreateImageOrDataSection
MiDeleteBootRange
MiFinishHardFault
MiFinishVadDeletion
MiFlushAllPagesWorker
MiFlushSectionInternal
MiForceCrashForInvalidAccess
MiGatherPagefilePages
MiInitializeDriverImages
MiIssueHardFault
MiLockImageSection
MiLogPinDriverAddress
MiLookupDataTableEntry
MiPrefetchControlArea
MiPrefetchVirtualMemory
MiProcessLoaderEntry
MiRememberUnloadedDriver
MiReplenishSlabAllocator
MiSharePages
MiStoreWriteModifiedPages
MiUnlockBootPageSections
MiUnlockControlAreaSectionExtend
MiUnlockImageSection
MiWriteProtectSystemImages
MmChangeImageProtection
MmEnumerateSystemImages
MmFreeBootDriverInitializationCode
MmGetSectionRange
MmIsDriverVerifyingByAddress
MmLockPagableDataSection
MmLockRegistryRecoverySections
MmPrefetchPagesEx
MmReleaseLoadLock
MmVerifyCallbackFunctionCheckFlags
NormalizationList__Unlock
NtAcceptConnectPort
NtAdjustGroupsToken
NtAdjustPrivilegesToken
NtAllocateUuids
NtAlpcAcceptConnectPort
NtAlpcCancelMessage
NtAlpcCreatePort
NtAlpcCreatePortSection
NtAlpcCreateResourceReserve
NtAlpcCreateSectionView
NtAlpcCreateSecurityContext
NtAlpcDeletePortSection
NtAlpcDeleteResourceReserve
NtAlpcDeleteSectionView
NtAlpcDeleteSecurityContext
NtAlpcDisconnectPort
NtAlpcImpersonateClientContainerOfPort
NtAlpcImpersonateClientOfPort
NtAlpcOpenSenderProcess
NtAlpcOpenSenderThread
NtAlpcQueryInformationMessage
NtAlpcRevokeSecurityContext
NtAlpcSetInformation
NtCancelTimer
NtChangeProcessState
NtChangeThreadState
NtCreateLowBoxToken
NtCreatePort
NtCreatePrivateNamespace
NtCreateUserProcess
NtCreateWaitablePort
NtCreateWnfStateName
NtDeleteBootEntry
NtDeleteDriverEntry
NtDeleteKey
NtDeleteValueKey
NtDeleteWnfStateName
NtDuplicateToken
NtEnumerateBootEntries
NtEnumerateDriverEntries
NtEnumerateSystemEnvironmentValuesEx
NtEnumerateValueKey
NtFlushInstallUILanguage
NtFlushKey
NtGetCompleteWnfStateSubscription
NtGetEnvironmentVariableEx
NtGetMUIRegistryInfo
NtMakePermanentObject
NtMapCMFModule
NtMapCMFModule$fin$0
NtMapCMFModule$fin$1
NtOpenPrivateNamespace
NtOpenProcessTokenEx
NtOpenThreadTokenEx
NtQueryBootEntryOrder
NtQueryBootOptions
NtQueryDriverEntryOrder
NtQueryEnvironmentVariableInfoEx
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInformationThread$fin$3
NtQueryInformationToken
NtQueryMultipleValueKey
NtQuerySecurityAttributesToken
NtQuerySystemEnvironmentValue
NtQueryWnfStateData
NtQueryWnfStateNameInformation
NtReadRequestData
NtReleaseKeyedEvent
NtRenameKey
NtReplaceKey
NtReplyPort
NtReplyWaitReceivePortEx
NtReplyWaitReplyPort
NtRequestPort
NtRequestWaitReplyPort
NtRestoreKey
NtSaveKeyEx
NtSaveMergedKeys
NtSecureConnectPort
NtSetBootEntryOrder
NtSetBootOptions
NtSetDriverEntryOrder
NtSetInformationKey
NtSetInformationThread
NtSetInformationThread$fin$1
NtSetInformationToken
NtSetSystemEnvironmentValue
NtSetUuidSeed
NtSetValueKey
NtSetWnfProcessNotificationEvent
NtSubscribeWnfStateChange
NtTerminateProcess
NtTraceEvent
NtUnsubscribeWnfStateChange
NtWaitForKeyedEvent
NtWriteRequestData
ObDereferenceSecurityDescriptor
ObDuplicateObject
ObInsertObjectEx
ObLogSecurityDescriptor
ObOpenObjectByNameEx
ObQueryObjectAuditingByHandle
ObReferenceFileObjectForWrite
ObReleaseObjectSecurity
ObRevokeHandles
ObSetHandleAttributes
ObSetSecurityDescriptorInfo
ObShutdownSystem
ObWaitForMultipleObjects
ObpAuditObjectAccess
ObpCloseHandle
ObpCreateHandle
ObpDeleteDirectoryObject
ObpLookupObjectName
ObpReferenceObjectByHandleWithTag
ObpReferenceProcessObjectByHandle
ObpRegisterPrivateNamespace
ObpRemoveNamespaceFromTable
Ordinal_15
PerfDiagpProxyWorker
PfSnCheckActionsNeeded
PfSnPopulateReadList
PfSnPrefetchCacheEntryUpdate
PfSnSectionInfoCleanupWorkItem
PfpPrefetchSharedCleanup
PfpRpCHashDeleteEntries
PfpScenCtxQueryScenarioInformation
PfpScenCtxServiceThreadSet
PiCMCreateDevice
PiCMDeleteDevice
PiCMGenerateDeviceInstance
PiCMUnregisterDeviceInterface
PiDcHandleCustomDeviceEvent
PiDqDispatch
PiDqIrpQueryCreate
PiDqIrpQueryGetResult
PiDqObjectManagerEnumerateAndRegisterQuery
PiDqObjectManagerServiceActionQueue
PiDqQueryApplyObjectEvent
PiDqQuerySerializeActionQueue
PiDqQueryUnlock
PiDrvDbLoadNode
PiDrvDbUnloadNode
PiDrvDbUnloadNodeWaitWorkerCallback
PiDrvDbUnloadNodeWorkerCallback
PiGetRelatedDevice
PiInitializeDevice
PiPnpRtlObjectEventWorker
PipKsrNotifyDrivers
PipResetDevices
PnpCancelDeviceActionRequest
PnpNotifyDeviceClassChange
PnpNotifyTargetDeviceChange
PnpNotifyTargetDeviceChangeNotifyEntry
PnpQueuePendingSurpriseRemoval
PnpShutdownDevices
PnpUnregisterPlugPlayNotification
PoFxStartDevicePowerManagement
PoUnregisterCoalescingCallback
PopDiagTraceFxRundown
PopDripsWatchdogCallbackWorker
PopDripsWatchdogDiagnosticWorker
PopDripsWatchdogStartWatchdog
PopDripsWatchdogStopWatchdog
PopFxAcpiPrepareDevice
PopFxActivateDevicesForSx
PopFxDestroyDirectedDripsCandidateDeviceList
PopFxDestroyDripsBlockingDeviceList
PopFxDisableBasicAccountingWorker
PopFxIdleDevicesFromSx
PopFxInsertAcpiDevice
PopFxInsertDevice
PopFxLowPowerEpochCallback
PopFxPauseDeviceAccounting
PopFxPrepareDevicesForShutdown
PopFxRegisterDeviceWithPep
PopFxRegisterPluginEx
PopFxRemoveAcpiDevice
PopFxResidentTimeoutRoutine
PopFxResumeDeviceAccounting
PopFxStartDeviceAccounting
PopFxStopDeviceAccounting
PopPepIdleTimeoutRoutine
PopPepInsertDevice
PopPepPlatformStateRegistered
PopPepWork
PopPowerAggregatorEngageModernStandby
PopPowerButtonBugcheckConfigure
PopReleaseAwaymodeLock
PpDevCfgProcessDevices
PsCallEnclave
PsCallImageNotifyRoutines
PsCaptureExceptionPort
PsCreateVsmEnclave
PsDisableImpersonation
PsFreezeProcess
PsGetNextProcessThread
PsGetProcessDeepFreezeStats
PsGetProcessEnclaveModuleInfo
PsImpersonateClient
PsInitializeVsmEnclave
PsLoadVsmEnclaveData
PsMultiResumeProcess
PsQueryProcessEnergyValues
PsQueryProcessExceptionFlags
PsQueryRuntimeProcess
PsQueryStatisticsProcess
PsQueryTotalCycleTimeProcess
PsReferenceImpersonationToken
PsReferenceImpersonationTokenEx
PsReferencePartitionSystemProcess
PsReferencePrimaryTokenWithTag
PsRegisterAltSystemCallHandler
PsRemoveCreateThreadNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsRestoreImpersonation
PsSetProcessFaultInformation
PsSetProcessTelemetryAppState
PsSetProcessWin32Process
PsShutdownSystem
PsStartSiloMonitor
PsSuspendProcess
PsSuspendThread
PsSwapImpersonationToken
PsSwapProcessWorkingSet
PsSynchronizeWithThreadInsertion
PsTerminateMinimalProcess
PsTerminateProcess
PsThawMultiProcess
PsUnregisterSiloMonitor
PsUpdateActiveProcessAffinity
PsWatchWorkingSet
PspAllocateAndQueryProcessNotificationChannel
PspApplyCoreIsolationPolicy
PspAssignPrimaryToken
PspAssignProcessToJob
PspAttachProcessToSyscallProvider
PspChargeProcessWakeCounter
PspCreatePicoProcess
PspCreatePicoThread
PspCreateThread
PspDeleteProcessStateChange
PspDestroySyscallProvider
PspDetachProcessFromSyscallProvider
PspEnableProcessOptionalXStateFeatures
PspExitProcess
PspExitThread
PspGetNextSyscallProviderProcess
PspGetPreviousProcessThread
PspInheritSyscallProvider
PspInsertProcess
PspInsertSyscallProvider
PspJobDelete
PspLockUnlockProcessExclusive
PspLookupSyscallProviderById
PspMarkServerSiloAsTerminating
PspNotifyProcessEffectiveIoLimitChanged
PspNotifyServerSiloCreation
PspNotifyServerSiloTermination
PspProcessClose
PspProcessDynamicEHContinuationTargets
PspProcessDynamicEnforcedAddressRanges
PspQueryWorkingSetWatch
PspReferenceSystemDll
PspRemoveEnclaveThreadWait
PspRemoveProcessFromJobChain
PspRundownSingleProcess
PspSelectVsmEnclaveByNumber
PspSetCreateProcessNotifyRoutine
PspSetJobIoRateControl
PspSetProcessAffinityUpdateMode
PspSetProcessDefaultHardErrorMode
PspSetProcessForegroundBackgroundRequest
PspSetProcessPriorityClass
PspStorageAllocSlot
PspStorageEmptyArray
PspStorageEmptyArrayNonReadonly
PspStorageFreeSlot
PspStorageGetObject
PspStorageInsertObject
PspStorageMakeSlotReadOnly
PspStorageRemoveObject
PspStorageReplaceObject
PspSyscallProviderOptIn
PspTeardownPartition
PspTerminatePicoProcess
PspThreadDelete
PspUnlockProcessExclusive
PspUnlockQuotaListExclusive
PspUnlockQuotaListShared
PspWow64ReadOrWriteThreadCpuArea
RawDispatch
RtlFindDynamicEnforcedAddressInRanges
RtlRunOnceExecuteOnce
RtlpFindDynamicEHContinuationTarget
RtlpInsertStringAtom
RtlpSetSecurityObject
SLGetSubscriptionPfn
SLGetSubscriptionPfn$fin$0
SLGetSubscriptionPfn$fin$1
SLQueryLicenseValueInternal
SLUpdateLicenseDataInternal
SLUpdateLicenseDataInternal$fin$0
SLUpdateLicenseDataInternal$fin$1
SMKM_STORE<SM_TRAITS>::SmStCleanup
SeAccessCheckByType
SeCaptureSubjectContextEx
SeDefaultObjectMethod
SeExchangePrimaryToken
SeIsTokenAssignableToProcess
SeMarkLogonSessionForTerminationNotificationEx
SeQuerySessionIdTokenEx
SeRegisterLogonSessionTerminatedRoutine
SeRegisterLogonSessionTerminatedRoutineEx
SeRegisterObjectTypeMandatoryPolicy
SeSetMandatoryPolicyToken
SeSetPrivateNameSpaceToken
SeSetSecurityAttributesTokenEx
SeSetSessionIdTokenWithLinked
SeSetVirtualizationToken
SeTokenGetNoChildProcessRestricted
SeTokenGetRedirectionTrustPolicy
SeTokenIsNoChildProcessRestrictionEnforced
SeTokenSetNoChildProcessRestricted
SeTokenSetRedirectionTrustPolicy
SeUnregisterLogonSessionTerminatedRoutine
SeUnregisterLogonSessionTerminatedRoutineEx
SendCaptureStateNotificationsWorker
SepAccessCheckAndAuditAlarm
SepAddLuidToIndexEntry
SepAppendAceToTokenObjectAcl
SepBlockAccessForLogonSession
SepCreateLogonSessionTrack
SepDeleteLogonSessionTrack
SepDeleteUnreferencedLogonSessionsInSilo
SepDereferenceCachedHandlesEntry
SepDesktopAppxSubProcessToken
SepFilterToken
SepIdAssignableAsGroup
SepInternalSetSecurityAttributesToken
SepIsParentOfChildAppContainer
SepIsValidProcUniqueLuid
SepMakeLogonSessionsSiblings
SepNotifyFileSystems
SepRmCallLsa
SepRmCapUpdateWrkr
SepRmCommandServerThread
SepSetTokenCachedHandles
SepSetTokenClaims
SepSetTokenUserAndGroups
SepUpdateLogonSessionTrack
UNLOCK_HIVE_LOAD
ViPendingQueuePassiveLevelCompletion
VmPinMemoryRange
VmUnpinMemoryRange
VmpPauseResumeNotify
VrpDecrementSiloCount
VrpDereferenceDiffHiveEntry
VrpFindDiffHiveEntryForMountPoint
VrpFindOrCreateDiffHiveEntryForMountPoint
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlLoadDifferencingHive
VrpHandleIoctlModifyFlags
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpIncrementSiloCount
VrpLoadDifferencingHive
VrpPostEnumerateKey
VrpPostUnloadKey
VrpPreLoadKey
VrpPreUnloadKey
VrpRelinquishDiffHiveEntryTransitionOwner
VrpTranslatePath
VrpUnloadDifferencingHive
VrpWaitForDiffHiveEntryTransitionOwnerToLeave
VslRegisterBootDrivers
VslpEnterIumSecureMode
WdipSemInitialize
WdipSemMarkNextTimedOutInstanceForDeletion
WdipSemSqmLogInflightLimitExceededDataPoints
WdipSemUpdate
WdipTimeoutCheckRoutine
WheaRegisterErrorSourceOverride
WheaSelLogCheckPoint
WheaSelLogSetNtSchedulerAvailability
WheaUnregisterErrorSourceOverride
WmipFindSMBiosStructure
WmipGetSMBiosEventlog
WmipGetSMBiosTableData
WmipGetSysIds
WmipReleaseSmbiosLockShared
_PnpCtxCloseMachine
paramcount 0 0
address 14030f820 14030f810
sig undefined KiLeaveCriticalRegionUnsafe(void) undefined KiLeaveCriticalRegionUnsafe(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

KiLeaveCriticalRegionUnsafe Calling Diff

--- KiLeaveCriticalRegionUnsafe calling
+++ KiLeaveCriticalRegionUnsafe calling
@@ -175,2 +175,2 @@
-FUN_14036f764
-FUN_1409fa77c
+FUN_14036f754
+FUN_1409fa70c
@@ -650 +649,0 @@
-VrpHandleIoctlInitializeJobForVreg

ExfTryToWakePushLock

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.96
i_ratio 0.64
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name ExfTryToWakePushLock ExfTryToWakePushLock
fullname ExfTryToWakePushLock ExfTryToWakePushLock
refcount 1007 1005
length 40 40
called ExpWakePushLock ExpWakePushLock
calling
Expand for full list:
AlpcAddHandleTableEntry
AlpcConnectionDestroyProcedure
AlpcDeleteBlobByHandle
AlpcRegisterLogRoutine
AlpcUnregisterLogRoutine
AlpcViewDestroyProcedure
AlpcpAcceptConnectPort
AlpcpAssociateIoCompletionPort
AlpcpCancelMessage
AlpcpCancelMessagesByRequestor
AlpcpCleanupProcessViewsAlpcpCompleteDispatchMessage
AlpcpCreateClientPort
AlpcpCreateView
AlpcpDeleteBlob
AlpcpDeletePort
AlpcpDestroyBlob
AlpcpDestroyPort
AlpcpDisconnectPort
AlpcpDispatchReplyToPort
AlpcpDispatchReplyToWaitingThread
AlpcpDoPortCleanup
AlpcpEndInitialization
AlpcpEnterAllocationEventMessageLog
AlpcpEnterFreeEventMessageLog
AlpcpEnterStateChangeEventMessageLog
AlpcpFlushCancelQueue
AlpcpFlushMessagesByRequestor
AlpcpFlushQueue
AlpcpFlushResourcesPort
AlpcpImpersonateMessage
AlpcpInitializeCompletionList
AlpcpInitializePort
AlpcpInsertCompletionListEntry
AlpcpInsertMessageCanceledQueue
AlpcpInsertMessageDirectQueue
AlpcpInsertMessageLargeMessageQueue
AlpcpInsertMessageMainQueue
AlpcpInsertMessagePendingQueue
AlpcpInsertResourcePort
AlpcpReceiveDirectMessagePort
AlpcpReceiveMessagePort
AlpcpReferenceMessageByWaitingThread
AlpcpReferenceMessageByWaitingThreadPort
AlpcpRegisterCompletionListDatabase
AlpcpRemoveMessageFromPendingQueue
AlpcpRemoveResourcePort
AlpcpSendLegacySynchronousRequest
AlpcpSignalPortAndUnlock
AlpcpTrackPortReferences
AlpcpUnlockBlob
AlpcpUnregisterCompletionListDatabase
AlpcpWaitForPortReferences
AlpcpWalkConnectionList
BgkpLockBgfxCodeSection
BgkpUnlockBgfxCodeSection
CcAmILowPriorityWriter
CcApplyLowIoPriorityToThread
CcBoostLowPriorityWorkerThread
CcChangeBackingFileObject
CmFcManagerDrainAllFeatureUsageNotifications
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerRegisterFeatureConfigurationChangeNotification
CmFcManagerUnregisterFeatureConfigurationChangeNotification
CmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpManagerDrainUsageNotificationsWorker
CmFcpManagerRetryUsageNotificationsWorker
CmFcpManagerSoftwareHiveReady
CmFreezeRegistry
CmSiRWLockReleaseExclusive
CmThawRegistry
CmUnlockHive
CmpCloseKeyObject
CmpCreateHive
CmpCreateHiveRootCell
CmpDoQueueLateUnloadWorker
CmpFlushHive
CmpFlushNotify
CmpInitCmRM
CmpMarkEntireIndexDirty
CmpRecoverFlushProtocolStateFromFiles
CmpRefreshHive
CmpReorganizeHive
CmpReportNotifyHelper
CmpTransMgrPrepare
CmpTransMgrSyncHive
CmpTrimHive
CmpVolumeContextDecrementRefCount
CmpVolumeContextSendDeviceUsageNotification
CmpVolumeManagerGetContextForFile
DbgkRegisterErrorPort
DbgkpRemoveErrorPort
DifExfTryToWakePushLockWrapper
EmClientQueryRuleState
EmClientRuleDeregisterNotification
EmClientRuleEvaluate
EmPowerPagingEnabled
EmProviderDeregister
EmProviderDeregisterEntry
EmProviderRegisterEntry
EmpAcquirePagingReference
EmpClientRuleRegisterNotification
EmpParseInfDatabase
EmpProviderRegister
EmpQueueRuleUpdateState
EmpReleasePagingReference
EmpRuleUpdateWorkerThread
EtwQueryProcessTelemetryCoverage
EtwpAcquireTokenAccessInformation
EtwpAddBinaryInfoEvents
EtwpAddDebugInfoEvents
EtwpAddGuidEntry
EtwpBufferingModeCompressionFlush
EtwpCompressPendingBuffers
EtwpCompressionProc
EtwpCovSampContextAddSamples
EtwpCovSampContextCleanup
EtwpCovSampContextGetModule
EtwpCovSampContextPruneModules
EtwpCovSampHashMakeRoomAndAcquireLock
EtwpCovSampProcessAddModule
EtwpCovSampProcessMapAddresses
EtwpCoverageCheckCP
EtwpCoverageEnsureContext
EtwpCoverageEnsureUserModeView
EtwpCoverageFlushWorkItemCallback
EtwpCoverageProvEnableCallback
EtwpCoverageRecord
EtwpCoverageReset
EtwpCoverageResetCP
EtwpCoverageSamplerClose
EtwpCoverageSamplerQuery
EtwpCoverageSamplerSetBloomFilter
EtwpCoverageSamplerStart
EtwpCoverageSamplerStop
EtwpCoverageSamplerUnloadImage
EtwpCreateLogFile
EtwpCreateUmReplyObject
EtwpDeleteRegistrationObject
EtwpDisableCompression
EtwpFlushCoverage
EtwpFreeCompression
EtwpGetLoggerInfoFromContext
EtwpRealtimeNotifyConsumers
EtwpSendDbgId
EtwpSetCompressionSettings
EtwpTrackBinaryForSession
EtwpTrackDebugIdForSession
EtwpTrackDecodeGuidForSession
EtwpUnreferenceGuidEntry
EtwpUpdateDisallowedGuids
EtwpUpdatePeriodicCaptureState
EtwpUpdateSelectedGroupMasks
ExCreateHandleTable
ExDisableHandleTracing
ExDupHandleTable
ExEnableHandleExceptions
ExEnableHandleTracing
ExEnableRaiseUMExceptionOnInvalidHandleClose
ExGetWakeTimerList
ExInitLicenseData
ExInitializeDeviceAts
ExNotifyPlatformBinaryExecuted
ExQueryHandleExceptionsPermanency
ExReferenceHandleDebugInfo
ExRegisterExtension
ExRegisterHost
ExReleaseCacheAwarePushLockExclusive
ExReleaseCacheAwarePushLockExclusiveEx
ExReleasePushLockExclusiveEx
ExSetLicenseTamperState
ExSvmBeginDeviceReset
ExSvmFinalizeDeviceReset
ExSweepHandleTable
ExTryAcquireAutoExpandPushLockExclusive
ExTryAcquireCacheAwarePushLockExclusiveEx
ExUninitializeDeviceAts
ExUnregisterExtension
ExUuidCreate
ExWakeTimersResume
ExpAllocateHandleTableEntry
ExpDeleteTimer
ExpFreeHandleTableEntry
ExpGetGlobalLocaleSection
ExpGetSystemPlatformBinary
ExpInsertLowLevelTableIntoFreeList
ExpKdPullRemoteFileForUser
ExpLoadAndSortLicensingCacheDescriptors
ExpLoadAndSortLicensingCacheDescriptors$fin$1
ExpQueryBootLoaderMetadata
ExpReadLeapSecondData
ExpReleaseFannedOutPushLockExclusive
ExpRemoveHandleTable
ExpSaAllocatorAllocate
ExpSaAllocatorFree
ExpSaPageGroupAllocateMemory
ExpSaPageGroupDescriptorAllocate
ExpSaPageGroupDescriptorFree
ExpSaPageGroupFreeMemory
ExpSetBootLoaderMetadata
ExpSetKernelDataProtection$fin$0
ExpSetTimerObject
ExpShareAddressSpaceWithDevice
ExpSvmDereferenceDevice
ExpTryAcquireFannedOutPushLockExclusive
ExpWnfAcquirePermanentDataStoreHandle
ExpWnfAllocateNextPersistentNameSequence
ExpWnfCompleteThreadSubscriptions
ExpWnfCreateNameInstance
ExpWnfCreateProcessContext
ExpWnfDeleteNameInstance
ExpWnfDeleteProcessContext
ExpWnfDeleteScopeById
ExpWnfDeleteScopeInstances
ExpWnfDeleteStateData
ExpWnfDeleteSubscription
ExpWnfDeliverThreadNotifications
ExpWnfDestroyPermanentDataStore
ExpWnfDispatchKernelSubscription
ExpWnfGetPermanentDataStore
ExpWnfInsertSubscriptionInPendingQueue
ExpWnfInvalidateDataStores
ExpWnfResolveScopeInstance
ExpWnfSubscribeNameInstance
ExpWnfUpdateSubscription
ExpWnfWriteStateData
ExpWnfWriteStateData$fin$0
FUN_1409fa120
FlushLookUpTableBucket
HalpDmaAllocateChildAdapterV3
HalpIommuBlockDevice
HalpIommuCreateDevice
HalpIommuDeleteDevice
HalpIommuInvokeInterfaceStateChangeCallbacks
HalpIommuUnblockDevice
HalpLeaveDmaDomain
HvFoldBackDirtyData
HvFreeCell
HvHiveConvertLockedPagesToCowByPolicy
HvIsRangeDirty
HvlQuerySetBootPagesInfo
HvpDoAllocateCell
HvpMarkCellDirty
IoRegisterIoTracking
IoUnregisterIoTracking
IommuBeginDeviceReset
IommuDeviceDelete
IommuFinalizeDeviceReset
IommuRegisterInterfaceStateChangeCallback
IommuUnregisterInterfaceStateChangeCallback
IommupDeviceDisableSvm
IommupDeviceGetPasidDevice
IommupFreeSystemContext
IommupGetSystemContext
IommupHvAttachPasidDevice
IommupHvAttachPasidDeviceDomain
IommupHvCreateSvmPasidSpace
IommupHvDetachPasidDeviceDomain
IommupPasidDeviceCreate
IommupPasidDeviceDelete
KeCleanupImageTracepoints
KeGenericCallDpcEx
KeSetSystemServiceCallback
KeSetTracepoint
KeUpdateDpcWatchdogConfiguration
KiGenericCallDpcInitiatorWorker
KiShouldLogUserModeReturnMismatch
KiStartSavingSupervisorState
KiTpIsExcludedKernelTracepointLocation
KseAddHardwareId
KseDriverUnloadImage
KseLookupHardwareId
KseQueryDeviceDataList
KseRegisterShimEx
KseResetDeviceCache
KseShimDatabaseBootRelease
KseShimDatabaseClose
KseShimDatabaseOpen
KseUnregisterShim
KsepDbCacheInsertDevice
KsepDbCacheQueryDevice
KsepGetShimsForDriver
KsepIsModuleShimmed
KsepResolveApplicableShimsForDriver
KsepShimDbChanged
MI_UNLOCK_RELOCATIONS_EXCLUSIVE
MiAddSpecialPurposeMemoryCleanup
MiAddSpecialPurposeMemoryComplete
MiAddSpecialPurposeMemoryPrepare
MiAddViewsForSection
MiAllocatePartitionId
MiApplyImageHotPatchRequest
MiCaptureRetpolineImportInfo
MiChargeSegmentCommit
MiCoalescePlaceholderAllocations
MiCommitExistingVad
MiCommitPageTableRangesForVad
MiContractWsSwapPageFileWorker
MiCopyLargeVad
MiCreateFileOnlyImageFixupList
MiCreateHardwareEnclave
MiCreatePagingFile
MiCreatePagingFileMap
MiCreatePerSessionProtos
MiCreatePrototypePtes
MiDecommitHardwareEnclavePages
MiDeleteAllHardwareEnclaves
MiDeleteEmptyPageTables
MiDeleteEnclavePages
MiDeleteHotPatchEntry
MiDeleteHotPatchRecord
MiDeletePartitionResources
MiDeleteVad
MiDereferenceExtendInfo
MiDereferencePerSessionProtos
MiFindSpecialPurposeMemoryTypeByPartition
MiFinishCreateSection
MiFinishResume
MiFinishVadDeletion
MiFreePartitionId
MiFreeRetpolineImportInfo
MiFreeSessionId
MiFreeUnusedPfnPages
MiGetChannelInformation
MiGetNewSessionId
MiGetPartitionNodeInformation
MiInitializeMirroring
MiInitializePagedPoolEvents
MiInitializePartialVad
MiInitializePartition
MiInitializePartitionSpecialPurposeMemory
MiInitializeSessionGlobals
MiInsertChildVads
MiInsertHotPatchRecord
MiInsertInSystemSpace
MiInsertPageFileInList
MiInsertSharedCommitNode
MiInsertVad
MiLateInitializeSystemCache
MiLoadHotPatchForUserSid
MiLockVadRange
MiMakeDriverPagesPrivate
MiManageSubsectionView
MiMapViewOfDataSection
MiMarkHugePfnBad
MiMarkSharedImageCfgBits
MiObtainRelocationBits
MiPerformVadSplitting
MiPersistMdl
MiPopulateCfgBitMap
MiReleaseKernelCfgLock
MiRemoveFromSystemSpace
MiRemoveSharedCommitNode
MiRemoveVad
MiReserveUserMemory
MiReturnImageBase
MiSectionDelete
MiSelectOverflowDllBase
MiSelectRelocationStartHint
MiSendParkedCoreUpdateToAllChildPartitions
MiSetPagesModified
MiSetProtectionOnSection
MiSetVadDeleted
MiShutdownSystem
MiSpecialPurposeMemoryRemoved
MiSplitPrivatePage
MiSplitReducedCommitClonePage
MiTransferFileExtent
MiTrimUnusedPageFileRegionsWorker
MiUnloadHotPatchForUserSid
MiUnlockAndDereferenceVad
MiUnlockDriverMappings
MiUnlockDynamicMemoryExclusive
MiUnlockDynamicMemoryNestedExclusive
MiUnlockFileExtentsExclusive
MiUnlockLoaderEntry
MiUnlockNestedVad
MiUnlockPartitionSystemThreads
MiUnlockVad
MiUnlockVadRange
MiUpControlAreaRefs
MiUpdateSpecialPurposeMemoryCacheEligibility
MiZeroAllPageFiles
MmCommitSessionMappedView
MmCreateShadowMapping
MmDecodeExportSection
MmDeleteShadowMapping
MmDuplicateMemory
MmEncodeExportSection
MmEnumerateBadPages
MmExtendSection
MmGetPageFileForCrashDump
MmLinkJobProcess
MmOutSwapVirtualAddresses
MmOutSwapWorkingSet
MmReleaseLoadLock
MmResourcesAvailable
NormalizationList__Unlock
NtAllocateUuids
NtAlpcRevokeSecurityContext
NtAlpcSetInformation
NtCancelTimer
NtChangeProcessState
NtChangeThreadState
NtCreateUserProcess
NtNotifyChangeMultipleKeys
NtReleaseKeyedEvent
NtSetInformationThread
NtSetInformationThread$fin$1
NtSetSystemInformation
NtSetUuidSeed
NtTerminateProcess
NtWaitForKeyedEvent
ObCheckRefTraceProcess
ObClearProcessDeviceMap
ObDereferenceDeviceMap
ObDereferenceSecurityDescriptor
ObDisableEtwReferenceTrace
ObDuplicateObject
ObEnableEtwReferenceTrace
ObQueryRefTraceInformation
ObReleaseObjectSecurity
ObpCloseHandle
ObpCreateHandle
ObpCreateSymbolicLinkName
ObpDeleteSymbolicLinkName
ObpDeregisterObject
ObpFreeWorkItemBlock
ObpLookupObjectName
ObpPushRefDerefInfo
ObpRegisterObject
ObpSetCurrentProcessDeviceMap
ObpSetDeviceMap
ObpStartRuntimeStackTrace
ObpStopRuntimeStackTrace
Ordinal_20
PerfDiagpProxyWorker
PfFileInfoNotify
PfGenerateTrace
PfProcessExitNotification
PfSetSuperfetchInformation
PfSnSetAltPrefetchParam
PfTAccessTracingCleanup
PfTAccessTracingStart
PfTSetTraceWorkerPriority
PfTSetTracingPriority
PfpParametersPropagate
PfpParametersWatcher
PfpPrefetchSharedCleanup
PfpPrefetchSharedStart
PfpRpCHashAddEntries
PfpRpCHashDeleteEntries
PfpRpCHashEmpty
PfpRpCHashGrow
PfpRpFileKeyUpdate
PfpRpShutdown
PfpScenCtxPrefetchAbortSet
PfpScenCtxPrefetchStateSet
PfpScenCtxPrefetchWait
PfpScenCtxQueryScenarioInformation
PfpScenCtxScenarioSet
PfpScenCtxServiceThreadSet
PoFxAbandonDevice
PopBlackBoxDirectAccess
PopBlackBoxUpdate
PopBootStatCheckIntegrity
PopBootStatGet
PopBootStatRestoreDefaults
PopBootStatSet
PopBootStatUnlock
PopDirectedDripsDiagBroadcastTreeBegin
PopDirectedDripsDiagBroadcastTreeEnd
PopDirectedDripsDiagNotifySessionStart
PopDirectedDripsDiagNotifySessionStop
PopDirectedDripsDiagTraceBroadcastFailureDevice
PopDirectedDripsDiagTraceBroadcastVisit
PopDirectedDripsDiagTraceMarkDevice
PopDirectedDripsDiagTraceNotifyDevices
PopDirectedDripsDiagTraceProblemDevice
PopDirectedDripsHandleResiliencyNotification
PopDirectedDripsIdleResiliencyCallback
PopDirectedDripsNotify
PopDirectedDripsNotifyResiliencyCompletionWorker
PopFxBuildDirectedDripsCandidateDeviceList
PopFxBuildDripsBlockingDeviceList
PopFxClearDirectedDripsCandidateDeviceList
PopFxInsertAcpiDevice
PopFxInsertDevice
PopFxNotifySxTransitionState
PopFxPrepareDevicesForShutdown
PopFxRegisterPluginEx
PopFxRemoveAcpiDevice
PopFxRemoveDevice
PopFxUpdateVetoMaskWork
PopPdcCsDeviceNotification
PopPepInsertDevice
PopPepRemoveDevice
PopPowerButtonBugcheckConfigure
PsAdjustBasicEnclaveThreadList
PsCallEnclave
PsCreateVsmEnclave
PsDeleteVsmEnclave
PsDisableImpersonation
PsFreezeProcess
PsGetProcessEnclaveModuleInfo
PsImpersonateClient
PsInitializeVsmEnclave
PsIsVsmEnclaveTerminated
PsLoadVsmEnclaveData
PsRestoreImpersonation
PsSetProcessFaultInformation
PsSetProcessTelemetryAppState
PsSetProcessWin32Process
PsStartSiloMonitor
PsSwapImpersonationToken
PsTerminateMinimalProcess
PsTerminateVsmEnclave
PsThawMultiProcess
PsUnregisterSiloMonitor
PsUpdateActiveProcessAffinity
PspAllocateAndQueryProcessNotificationChannel
PspAllocateThread
PspApplyWorkingSetLimits
PspApplyWorkingSetLimitsToProcess
PspAssignProcessToJob
PspAttachProcessToSyscallProvider
PspChangeJobMemoryUsageByProcess
PspCreatePicoProcess
PspDestroySyscallProvider
PspDetachProcessFromSyscallProvider
PspEnableProcessOptionalXStateFeatures
PspExitThread
PspInsertProcess
PspInsertSyscallProvider
PspInsertThread
PspProcessClose
PspProcessDynamicEHContinuationTargets
PspProcessDynamicEnforcedAddressRanges
PspRemoveEnclaveThreadWait
PspRundownSingleProcess
PspSetJobIoRateControl
PspSetProcessDefaultHardErrorMode
PspSetProcessForegroundBackgroundRequest
PspSetQuotaLimits
PspStorageAllocSlot
PspStorageEmptyArray
PspStorageEmptyArrayNonReadonly
PspStorageFreeSlot
PspStorageInsertObject
PspStorageMakeSlotReadOnly
PspStorageRemoveObject
PspStorageReplaceObject
PspSyscallProviderOptIn
PspTeardownPartition
PspTerminateProcess
PspThreadDelete
PspUnlockJobAssignment
PspUnlockJobListExclusive
PspUnlockJobMemoryLimitsExclusive
PspUnlockJobsAndProcessExclusive
PspUnlockProcessExclusive
PspUnlockProcessListExclusive
PspUnlockQuotaExpansion
PspUnlockQuotaListExclusive
RtlDeleteAtomFromAtomTable
RtlDestroyAtomTable
RtlEmptyAtomTable
RtlInsertDynamicFunctionTable
RtlLockBootStatusData
RtlLookupAtomInAtomTable
RtlPinAtomInAtomTable
RtlQueryAtomInAtomTable
RtlQueryAtomsInAtomTable
RtlRemoveDynamicFunctionTable
RtlUnlockBootStatusData
RtlpCSparseBitmapUnlock
RtlpFlsAlloc
RtlpFlsDataCleanup
RtlpFlsFree
RtlpFlsSetValueSlot
RtlpHpAcquireReleaseLockExclusive
RtlpHpCustomVaCallbacksRegistrarRegister
RtlpHpCustomVaCallbacksRegistrarUnregister
RtlpHpFixedVsAllocate
RtlpHpFixedVsFree
RtlpHpHeapExtendContext
RtlpHpLargeAlloc
RtlpHpLargeFree
RtlpHpLfhBucketAddSubsegment
RtlpHpLfhBucketGetSubsegment
RtlpHpLfhBucketUpdateAffinityMapping
RtlpHpLfhSlotAllocate
RtlpHpLfhSubsegmentDecommitPages
RtlpHpLfhSubsegmentFreeBlock
RtlpHpLfhSubsegmentIncBlockCounts
RtlpHpReleaseQueuedLockExclusive
RtlpHpSegContextCompact
RtlpHpSegMgrCommitComplete
RtlpHpSegMgrCommitInitiate
RtlpHpSegMgrVaCtxAlloc
RtlpHpSegMgrVaCtxFree
RtlpHpSegMgrVaCtxInsert
RtlpHpSegPageRangeAllocate
RtlpHpSegPageRangeCoalesce
RtlpHpSegPageRangeShrink
RtlpHpVaMgrAlloc
RtlpHpVaMgrCtxFree
RtlpHpVsChunkSplit
RtlpHpVsSubsegmentCommitPages
RtlpUnlockAtomTable
SLGetSubscriptionPfn
SLGetSubscriptionPfn$fin$0
SLQueryLicenseValueInternal
SLUpdateLicenseDataInternal
SMKM_STORE<SM_TRAITS>::SmStCleanup
SMKM_STORE<SM_TRAITS>::SmStWorker
SMKM_STORE<struct_SM_TRAITS>::SmStHelperSendCommand
SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEmpty
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys
SSHSupportReleasePushLockExclusive
ST_STORE<struct_SM_TRAITS>::StDmPageRemove
ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd
SeDefaultObjectMethod
SeRegisterObjectTypeMandatoryPolicy
SendCaptureStateNotificationsWorker
SepAddLuidToIndexEntry
SepAppendAceToTokenObjectAcl
SepDeReferenceSharedSidEntries
SepDeleteSessionLowboxEntries
SepDereferenceCachedHandlesEntry
SepDereferenceLowBoxNumberEntry
SepInsertOrReferenceSharedSidEntries
SepIsParentOfChildAppContainer
SepRmCapUpdateWrkr
SepSetTokenCachedHandles
SepSetTokenClaims
SepSetTokenLowboxNumber
SepSetTokenUserAndGroups
SmCreatePartition
SmDeletePartition
SmFirstTimeInit
SmGetRegistrationInfo
SmKmKeyGenKeyDelete
SmKmKeyGenNewKey
SmKmStoreAdd
SmKmStoreDelete
SmKmVirtualLockContextIncreaseWsMin
SmKmVirtualLockCtxMemoryUnlocked
SmPartitionJobPaired
SmProcessCompressionInfoRequest
SmcCacheAdd
SmcCacheCreatePrepare
SmcCacheRemove
SmcStoreDelete
SmcStoreResize
SmcStoreSlotAbort
SmcStoreSlotCommit
SmcStoreSlotReserve
SmpKeyedStoreEntryGet
SmpKeyedStoreSetVaRanges
SmpSystemStoreCreate
SshpSetCollectionActive
TlgAggregateInternalProviderCallback
TlgRegisterAggregateProviderEx
UNLOCK_ADDRESS_SPACE_UNORDERED
UNLOCK_PAGE_TABLE_COMMITMENT
VmCreateMemoryRange
VmDeleteMemoryRange
VmMergeMemoryRanges
VmSplitMemoryRange
VmpCleanProcessAddressSpace
VmpPauseResumeNotify
VrpDecrementSiloCount
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlInitializeJobForVreg
VrpHandleIoctlLoadDifferencingHive
VrpHandleIoctlLoadDifferencingHiveForHost
VrpHandleIoctlModifyFlags
VrpHandleIoctlUnloadDifferencingHiveForHost
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpIncrementSiloCount
VrpLoadDifferencingHive
VrpPostUnloadKey
VrpPreLoadKey
VrpPreUnloadKey
VrpUnloadDifferencingHive
VrpWaitForDiffHiveEntryTransitionOwnerToLeave
VslpLockPagesForTransfer
VslpUnlockPagesForTransfer
WbAddHeapExecutedBlockToCache
WbAddHeapExecutedBlockToLRU
WbAddWarbirdEncryptionSegment
WbAllocateSlots
WbAllocateUserMemory
WbDecryptEncryptionSegment
WbFreeMemoryBlockRegion
WbGetInitializedEncryptionSegment
WbGetWarbirdProcess
WbGetWarbirdThread
WbHeapExecutionUnloadModule
WbInPlaceEncryptionUnloadModule
WbMoveHeapExecutedBlockToBackOfLRU
WbReEncryptEncryptionSegment
WbRemoveWarbirdProcess
WheaConfigureErrorSource
WheaExecuteRowFailureCheck
WheaInitialize
WheaRegisterErrorSourceOverride
WheaRegisterInUsePageOfflineNotification
WheaSelLogCheckPoint
WheaSelLogSetNtSchedulerAvailability
WheaUnconfigureErrorSource
WheaUnregisterErrorSourceOverride
WheaUnregisterInUsePageOfflineNotification
WheapCallInUsePageNotificationCallbacks
WheapPfaReset
WheapPredictiveFailureAnalysis
Expand for full list:
AlpcAddHandleTableEntry
AlpcConnectionDestroyProcedure
AlpcDeleteBlobByHandle
AlpcRegisterLogRoutine
AlpcUnregisterLogRoutine
AlpcViewDestroyProcedure
AlpcpAcceptConnectPort
AlpcpAssociateIoCompletionPort
AlpcpCancelMessage
AlpcpCancelMessagesByRequestor
AlpcpCleanupProcessViewsAlpcpCompleteDispatchMessage
AlpcpCreateClientPort
AlpcpCreateView
AlpcpDeleteBlob
AlpcpDeletePort
AlpcpDestroyBlob
AlpcpDestroyPort
AlpcpDisconnectPort
AlpcpDispatchReplyToPort
AlpcpDispatchReplyToWaitingThread
AlpcpDoPortCleanup
AlpcpEndInitialization
AlpcpEnterAllocationEventMessageLog
AlpcpEnterFreeEventMessageLog
AlpcpEnterStateChangeEventMessageLog
AlpcpFlushCancelQueue
AlpcpFlushMessagesByRequestor
AlpcpFlushQueue
AlpcpFlushResourcesPort
AlpcpImpersonateMessage
AlpcpInitializeCompletionList
AlpcpInitializePort
AlpcpInsertCompletionListEntry
AlpcpInsertMessageCanceledQueue
AlpcpInsertMessageDirectQueue
AlpcpInsertMessageLargeMessageQueue
AlpcpInsertMessageMainQueue
AlpcpInsertMessagePendingQueue
AlpcpInsertResourcePort
AlpcpReceiveDirectMessagePort
AlpcpReceiveMessagePort
AlpcpReferenceMessageByWaitingThread
AlpcpReferenceMessageByWaitingThreadPort
AlpcpRegisterCompletionListDatabase
AlpcpRemoveMessageFromPendingQueue
AlpcpRemoveResourcePort
AlpcpSendLegacySynchronousRequest
AlpcpSignalPortAndUnlock
AlpcpTrackPortReferences
AlpcpUnlockBlob
AlpcpUnregisterCompletionListDatabase
AlpcpWaitForPortReferences
AlpcpWalkConnectionList
BgkpLockBgfxCodeSection
BgkpUnlockBgfxCodeSection
CcAmILowPriorityWriter
CcApplyLowIoPriorityToThread
CcBoostLowPriorityWorkerThread
CcChangeBackingFileObject
CmFcManagerDrainAllFeatureUsageNotifications
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerRegisterFeatureConfigurationChangeNotification
CmFcManagerUnregisterFeatureConfigurationChangeNotification
CmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpManagerDrainUsageNotificationsWorker
CmFcpManagerRetryUsageNotificationsWorker
CmFcpManagerSoftwareHiveReady
CmFreezeRegistry
CmSiRWLockReleaseExclusive
CmThawRegistry
CmUnlockHive
CmpCloseKeyObject
CmpCreateHive
CmpCreateHiveRootCell
CmpDoQueueLateUnloadWorker
CmpFlushHive
CmpFlushNotify
CmpInitCmRM
CmpMarkEntireIndexDirty
CmpRecoverFlushProtocolStateFromFiles
CmpRefreshHive
CmpReorganizeHive
CmpReportNotifyHelper
CmpTransMgrPrepare
CmpTransMgrSyncHive
CmpTrimHive
CmpVolumeContextDecrementRefCount
CmpVolumeContextSendDeviceUsageNotification
CmpVolumeManagerGetContextForFile
DbgkRegisterErrorPort
DbgkpRemoveErrorPort
DifExfTryToWakePushLockWrapper
EmClientQueryRuleState
EmClientRuleDeregisterNotification
EmClientRuleEvaluate
EmPowerPagingEnabled
EmProviderDeregister
EmProviderDeregisterEntry
EmProviderRegisterEntry
EmpAcquirePagingReference
EmpClientRuleRegisterNotification
EmpParseInfDatabase
EmpProviderRegister
EmpQueueRuleUpdateState
EmpReleasePagingReference
EmpRuleUpdateWorkerThread
EtwQueryProcessTelemetryCoverage
EtwpAcquireTokenAccessInformation
EtwpAddBinaryInfoEvents
EtwpAddDebugInfoEvents
EtwpAddGuidEntry
EtwpBufferingModeCompressionFlush
EtwpCompressPendingBuffers
EtwpCompressionProc
EtwpCovSampContextAddSamples
EtwpCovSampContextCleanup
EtwpCovSampContextGetModule
EtwpCovSampContextPruneModules
EtwpCovSampHashMakeRoomAndAcquireLock
EtwpCovSampProcessAddModule
EtwpCovSampProcessMapAddresses
EtwpCoverageCheckCP
EtwpCoverageEnsureContext
EtwpCoverageEnsureUserModeView
EtwpCoverageFlushWorkItemCallback
EtwpCoverageProvEnableCallback
EtwpCoverageRecord
EtwpCoverageReset
EtwpCoverageResetCP
EtwpCoverageSamplerClose
EtwpCoverageSamplerQuery
EtwpCoverageSamplerSetBloomFilter
EtwpCoverageSamplerStart
EtwpCoverageSamplerStop
EtwpCoverageSamplerUnloadImage
EtwpCreateLogFile
EtwpCreateUmReplyObject
EtwpDeleteRegistrationObject
EtwpDisableCompression
EtwpFlushCoverage
EtwpFreeCompression
EtwpGetLoggerInfoFromContext
EtwpRealtimeNotifyConsumers
EtwpSendDbgId
EtwpSetCompressionSettings
EtwpTrackBinaryForSession
EtwpTrackDebugIdForSession
EtwpTrackDecodeGuidForSession
EtwpUnreferenceGuidEntry
EtwpUpdateDisallowedGuids
EtwpUpdatePeriodicCaptureState
EtwpUpdateSelectedGroupMasks
ExCreateHandleTable
ExDisableHandleTracing
ExDupHandleTable
ExEnableHandleExceptions
ExEnableHandleTracing
ExEnableRaiseUMExceptionOnInvalidHandleClose
ExGetWakeTimerList
ExInitLicenseData
ExInitializeDeviceAts
ExNotifyPlatformBinaryExecuted
ExQueryHandleExceptionsPermanency
ExReferenceHandleDebugInfo
ExRegisterExtension
ExRegisterHost
ExReleaseCacheAwarePushLockExclusive
ExReleaseCacheAwarePushLockExclusiveEx
ExReleasePushLockExclusiveEx
ExSetLicenseTamperState
ExSvmBeginDeviceReset
ExSvmFinalizeDeviceReset
ExSweepHandleTable
ExTryAcquireAutoExpandPushLockExclusive
ExTryAcquireCacheAwarePushLockExclusiveEx
ExUninitializeDeviceAts
ExUnregisterExtension
ExUuidCreate
ExWakeTimersResume
ExpAllocateHandleTableEntry
ExpDeleteTimer
ExpFreeHandleTableEntry
ExpGetGlobalLocaleSection
ExpGetSystemPlatformBinary
ExpInsertLowLevelTableIntoFreeList
ExpKdPullRemoteFileForUser
ExpLoadAndSortLicensingCacheDescriptors
ExpLoadAndSortLicensingCacheDescriptors$fin$1
ExpQueryBootLoaderMetadata
ExpReadLeapSecondData
ExpReleaseFannedOutPushLockExclusive
ExpRemoveHandleTable
ExpSaAllocatorAllocate
ExpSaAllocatorFree
ExpSaPageGroupAllocateMemory
ExpSaPageGroupDescriptorAllocate
ExpSaPageGroupDescriptorFree
ExpSaPageGroupFreeMemory
ExpSetBootLoaderMetadata
ExpSetKernelDataProtection$fin$0
ExpSetTimerObject
ExpShareAddressSpaceWithDevice
ExpSvmDereferenceDevice
ExpTryAcquireFannedOutPushLockExclusive
ExpWnfAcquirePermanentDataStoreHandle
ExpWnfAllocateNextPersistentNameSequence
ExpWnfCompleteThreadSubscriptions
ExpWnfCreateNameInstance
ExpWnfCreateProcessContext
ExpWnfDeleteNameInstance
ExpWnfDeleteProcessContext
ExpWnfDeleteScopeById
ExpWnfDeleteScopeInstances
ExpWnfDeleteStateData
ExpWnfDeleteSubscription
ExpWnfDeliverThreadNotifications
ExpWnfDestroyPermanentDataStore
ExpWnfDispatchKernelSubscription
ExpWnfGetPermanentDataStore
ExpWnfInsertSubscriptionInPendingQueue
ExpWnfInvalidateDataStores
ExpWnfResolveScopeInstance
ExpWnfSubscribeNameInstance
ExpWnfUpdateSubscription
ExpWnfWriteStateData
ExpWnfWriteStateData$fin$0
FUN_1409fa0b0
FlushLookUpTableBucket
HalpDmaAllocateChildAdapterV3
HalpIommuBlockDevice
HalpIommuCreateDevice
HalpIommuDeleteDevice
HalpIommuInvokeInterfaceStateChangeCallbacks
HalpIommuUnblockDevice
HalpLeaveDmaDomain
HvFoldBackDirtyData
HvFreeCell
HvHiveConvertLockedPagesToCowByPolicy
HvIsRangeDirty
HvlQuerySetBootPagesInfo
HvpDoAllocateCell
HvpMarkCellDirty
IoRegisterIoTracking
IoUnregisterIoTracking
IommuBeginDeviceReset
IommuDeviceDelete
IommuFinalizeDeviceReset
IommuRegisterInterfaceStateChangeCallback
IommuUnregisterInterfaceStateChangeCallback
IommupDeviceDisableSvm
IommupDeviceGetPasidDevice
IommupFreeSystemContext
IommupGetSystemContext
IommupHvAttachPasidDevice
IommupHvAttachPasidDeviceDomain
IommupHvCreateSvmPasidSpace
IommupHvDetachPasidDeviceDomain
IommupPasidDeviceCreate
IommupPasidDeviceDelete
KeCleanupImageTracepoints
KeGenericCallDpcEx
KeSetSystemServiceCallback
KeSetTracepoint
KeUpdateDpcWatchdogConfiguration
KiGenericCallDpcInitiatorWorker
KiShouldLogUserModeReturnMismatch
KiStartSavingSupervisorState
KiTpIsExcludedKernelTracepointLocation
KseAddHardwareId
KseDriverUnloadImage
KseLookupHardwareId
KseQueryDeviceDataList
KseRegisterShimEx
KseResetDeviceCache
KseShimDatabaseBootRelease
KseShimDatabaseClose
KseShimDatabaseOpen
KseUnregisterShim
KsepDbCacheInsertDevice
KsepDbCacheQueryDevice
KsepGetShimsForDriver
KsepIsModuleShimmed
KsepResolveApplicableShimsForDriver
KsepShimDbChanged
MI_UNLOCK_RELOCATIONS_EXCLUSIVE
MiAddSpecialPurposeMemoryCleanup
MiAddSpecialPurposeMemoryComplete
MiAddSpecialPurposeMemoryPrepare
MiAddViewsForSection
MiAllocatePartitionId
MiApplyImageHotPatchRequest
MiCaptureRetpolineImportInfo
MiChargeSegmentCommit
MiCoalescePlaceholderAllocations
MiCommitExistingVad
MiCommitPageTableRangesForVad
MiContractWsSwapPageFileWorker
MiCopyLargeVad
MiCreateFileOnlyImageFixupList
MiCreateHardwareEnclave
MiCreatePagingFile
MiCreatePagingFileMap
MiCreatePerSessionProtos
MiCreatePrototypePtes
MiDecommitHardwareEnclavePages
MiDeleteAllHardwareEnclaves
MiDeleteEmptyPageTables
MiDeleteEnclavePages
MiDeleteHotPatchEntry
MiDeleteHotPatchRecord
MiDeletePartitionResources
MiDeleteVad
MiDereferenceExtendInfo
MiDereferencePerSessionProtos
MiFindSpecialPurposeMemoryTypeByPartition
MiFinishCreateSection
MiFinishResume
MiFinishVadDeletion
MiFreePartitionId
MiFreeRetpolineImportInfo
MiFreeSessionId
MiFreeUnusedPfnPages
MiGetChannelInformation
MiGetNewSessionId
MiGetPartitionNodeInformation
MiInitializeMirroring
MiInitializePagedPoolEvents
MiInitializePartialVad
MiInitializePartition
MiInitializePartitionSpecialPurposeMemory
MiInitializeSessionGlobals
MiInsertChildVads
MiInsertHotPatchRecord
MiInsertInSystemSpace
MiInsertPageFileInList
MiInsertSharedCommitNode
MiInsertVad
MiLateInitializeSystemCache
MiLoadHotPatchForUserSid
MiLockVadRange
MiMakeDriverPagesPrivate
MiManageSubsectionView
MiMapViewOfDataSection
MiMarkHugePfnBad
MiMarkSharedImageCfgBits
MiObtainRelocationBits
MiPerformVadSplitting
MiPersistMdl
MiPopulateCfgBitMap
MiReleaseKernelCfgLock
MiRemoveFromSystemSpace
MiRemoveSharedCommitNode
MiRemoveVad
MiReserveUserMemory
MiReturnImageBase
MiSectionDelete
MiSelectOverflowDllBase
MiSelectRelocationStartHint
MiSendParkedCoreUpdateToAllChildPartitions
MiSetPagesModified
MiSetProtectionOnSection
MiSetVadDeleted
MiShutdownSystem
MiSpecialPurposeMemoryRemoved
MiSplitPrivatePage
MiSplitReducedCommitClonePage
MiTransferFileExtent
MiTrimUnusedPageFileRegionsWorker
MiUnloadHotPatchForUserSid
MiUnlockAndDereferenceVad
MiUnlockDriverMappings
MiUnlockDynamicMemoryExclusive
MiUnlockDynamicMemoryNestedExclusive
MiUnlockFileExtentsExclusive
MiUnlockLoaderEntry
MiUnlockNestedVad
MiUnlockPartitionSystemThreads
MiUnlockVad
MiUnlockVadRange
MiUpControlAreaRefs
MiUpdateSpecialPurposeMemoryCacheEligibility
MiZeroAllPageFiles
MmCommitSessionMappedView
MmCreateShadowMapping
MmDecodeExportSection
MmDeleteShadowMapping
MmDuplicateMemory
MmEncodeExportSection
MmEnumerateBadPages
MmExtendSection
MmGetPageFileForCrashDump
MmLinkJobProcess
MmOutSwapVirtualAddresses
MmOutSwapWorkingSet
MmReleaseLoadLock
MmResourcesAvailable
NormalizationList__Unlock
NtAllocateUuids
NtAlpcRevokeSecurityContext
NtAlpcSetInformation
NtCancelTimer
NtChangeProcessState
NtChangeThreadState
NtCreateUserProcess
NtNotifyChangeMultipleKeys
NtReleaseKeyedEvent
NtSetInformationThread
NtSetInformationThread$fin$1
NtSetSystemInformation
NtSetUuidSeed
NtTerminateProcess
NtWaitForKeyedEvent
ObCheckRefTraceProcess
ObClearProcessDeviceMap
ObDereferenceDeviceMap
ObDereferenceSecurityDescriptor
ObDisableEtwReferenceTrace
ObDuplicateObject
ObEnableEtwReferenceTrace
ObQueryRefTraceInformation
ObReleaseObjectSecurity
ObpCloseHandle
ObpCreateHandle
ObpCreateSymbolicLinkName
ObpDeleteSymbolicLinkName
ObpDeregisterObject
ObpFreeWorkItemBlock
ObpLookupObjectName
ObpPushRefDerefInfo
ObpRegisterObject
ObpSetCurrentProcessDeviceMap
ObpSetDeviceMap
ObpStartRuntimeStackTrace
ObpStopRuntimeStackTrace
Ordinal_20
PerfDiagpProxyWorker
PfFileInfoNotify
PfGenerateTrace
PfProcessExitNotification
PfSetSuperfetchInformation
PfSnSetAltPrefetchParam
PfTAccessTracingCleanup
PfTAccessTracingStart
PfTSetTraceWorkerPriority
PfTSetTracingPriority
PfpParametersPropagate
PfpParametersWatcher
PfpPrefetchSharedCleanup
PfpPrefetchSharedStart
PfpRpCHashAddEntries
PfpRpCHashDeleteEntries
PfpRpCHashEmpty
PfpRpCHashGrow
PfpRpFileKeyUpdate
PfpRpShutdown
PfpScenCtxPrefetchAbortSet
PfpScenCtxPrefetchStateSet
PfpScenCtxPrefetchWait
PfpScenCtxQueryScenarioInformation
PfpScenCtxScenarioSet
PfpScenCtxServiceThreadSet
PoFxAbandonDevice
PopBlackBoxDirectAccess
PopBlackBoxUpdate
PopBootStatCheckIntegrity
PopBootStatGet
PopBootStatRestoreDefaults
PopBootStatSet
PopBootStatUnlock
PopDirectedDripsDiagBroadcastTreeBegin
PopDirectedDripsDiagBroadcastTreeEnd
PopDirectedDripsDiagNotifySessionStart
PopDirectedDripsDiagNotifySessionStop
PopDirectedDripsDiagTraceBroadcastFailureDevice
PopDirectedDripsDiagTraceBroadcastVisit
PopDirectedDripsDiagTraceMarkDevice
PopDirectedDripsDiagTraceNotifyDevices
PopDirectedDripsDiagTraceProblemDevice
PopDirectedDripsHandleResiliencyNotification
PopDirectedDripsIdleResiliencyCallback
PopDirectedDripsNotify
PopDirectedDripsNotifyResiliencyCompletionWorker
PopFxBuildDirectedDripsCandidateDeviceList
PopFxBuildDripsBlockingDeviceList
PopFxClearDirectedDripsCandidateDeviceList
PopFxInsertAcpiDevice
PopFxInsertDevice
PopFxNotifySxTransitionState
PopFxPrepareDevicesForShutdown
PopFxRegisterPluginEx
PopFxRemoveAcpiDevice
PopFxRemoveDevice
PopFxUpdateVetoMaskWork
PopPdcCsDeviceNotification
PopPepInsertDevice
PopPepRemoveDevice
PopPowerButtonBugcheckConfigure
PsAdjustBasicEnclaveThreadList
PsCallEnclave
PsCreateVsmEnclave
PsDeleteVsmEnclave
PsDisableImpersonation
PsFreezeProcess
PsGetProcessEnclaveModuleInfo
PsImpersonateClient
PsInitializeVsmEnclave
PsIsVsmEnclaveTerminated
PsLoadVsmEnclaveData
PsRestoreImpersonation
PsSetProcessFaultInformation
PsSetProcessTelemetryAppState
PsSetProcessWin32Process
PsStartSiloMonitor
PsSwapImpersonationToken
PsTerminateMinimalProcess
PsTerminateVsmEnclave
PsThawMultiProcess
PsUnregisterSiloMonitor
PsUpdateActiveProcessAffinity
PspAllocateAndQueryProcessNotificationChannel
PspAllocateThread
PspApplyWorkingSetLimits
PspApplyWorkingSetLimitsToProcess
PspAssignProcessToJob
PspAttachProcessToSyscallProvider
PspChangeJobMemoryUsageByProcess
PspCreatePicoProcess
PspDestroySyscallProvider
PspDetachProcessFromSyscallProvider
PspEnableProcessOptionalXStateFeatures
PspExitThread
PspInsertProcess
PspInsertSyscallProvider
PspInsertThread
PspProcessClose
PspProcessDynamicEHContinuationTargets
PspProcessDynamicEnforcedAddressRanges
PspRemoveEnclaveThreadWait
PspRundownSingleProcess
PspSetJobIoRateControl
PspSetProcessDefaultHardErrorMode
PspSetProcessForegroundBackgroundRequest
PspSetQuotaLimits
PspStorageAllocSlot
PspStorageEmptyArray
PspStorageEmptyArrayNonReadonly
PspStorageFreeSlot
PspStorageInsertObject
PspStorageMakeSlotReadOnly
PspStorageRemoveObject
PspStorageReplaceObject
PspSyscallProviderOptIn
PspTeardownPartition
PspTerminateProcess
PspThreadDelete
PspUnlockJobAssignment
PspUnlockJobListExclusive
PspUnlockJobMemoryLimitsExclusive
PspUnlockJobsAndProcessExclusive
PspUnlockProcessExclusive
PspUnlockProcessListExclusive
PspUnlockQuotaExpansion
PspUnlockQuotaListExclusive
RtlDeleteAtomFromAtomTable
RtlDestroyAtomTable
RtlEmptyAtomTable
RtlInsertDynamicFunctionTable
RtlLockBootStatusData
RtlLookupAtomInAtomTable
RtlPinAtomInAtomTable
RtlQueryAtomInAtomTable
RtlQueryAtomsInAtomTable
RtlRemoveDynamicFunctionTable
RtlUnlockBootStatusData
RtlpCSparseBitmapUnlock
RtlpFlsAlloc
RtlpFlsDataCleanup
RtlpFlsFree
RtlpFlsSetValueSlot
RtlpHpAcquireReleaseLockExclusive
RtlpHpCustomVaCallbacksRegistrarRegister
RtlpHpCustomVaCallbacksRegistrarUnregister
RtlpHpFixedVsAllocate
RtlpHpFixedVsFree
RtlpHpHeapExtendContext
RtlpHpLargeAlloc
RtlpHpLargeFree
RtlpHpLfhBucketAddSubsegment
RtlpHpLfhBucketGetSubsegment
RtlpHpLfhBucketUpdateAffinityMapping
RtlpHpLfhSlotAllocate
RtlpHpLfhSubsegmentDecommitPages
RtlpHpLfhSubsegmentFreeBlock
RtlpHpLfhSubsegmentIncBlockCounts
RtlpHpReleaseQueuedLockExclusive
RtlpHpSegContextCompact
RtlpHpSegMgrCommitComplete
RtlpHpSegMgrCommitInitiate
RtlpHpSegMgrVaCtxAlloc
RtlpHpSegMgrVaCtxFree
RtlpHpSegMgrVaCtxInsert
RtlpHpSegPageRangeAllocate
RtlpHpSegPageRangeCoalesce
RtlpHpSegPageRangeShrink
RtlpHpVaMgrAlloc
RtlpHpVaMgrCtxFree
RtlpHpVsChunkSplit
RtlpHpVsSubsegmentCommitPages
RtlpUnlockAtomTable
SLGetSubscriptionPfn
SLGetSubscriptionPfn$fin$0
SLQueryLicenseValueInternal
SLUpdateLicenseDataInternal
SMKM_STORE<SM_TRAITS>::SmStCleanup
SMKM_STORE<SM_TRAITS>::SmStWorker
SMKM_STORE<struct_SM_TRAITS>::SmStHelperSendCommand
SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEmpty
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys
SSHSupportReleasePushLockExclusive
ST_STORE<struct_SM_TRAITS>::StDmPageRemove
ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd
SeDefaultObjectMethod
SeRegisterObjectTypeMandatoryPolicy
SendCaptureStateNotificationsWorker
SepAddLuidToIndexEntry
SepAppendAceToTokenObjectAcl
SepDeReferenceSharedSidEntries
SepDeleteSessionLowboxEntries
SepDereferenceCachedHandlesEntry
SepDereferenceLowBoxNumberEntry
SepInsertOrReferenceSharedSidEntries
SepIsParentOfChildAppContainer
SepRmCapUpdateWrkr
SepSetTokenCachedHandles
SepSetTokenClaims
SepSetTokenLowboxNumber
SepSetTokenUserAndGroups
SmCreatePartition
SmDeletePartition
SmFirstTimeInit
SmGetRegistrationInfo
SmKmKeyGenKeyDelete
SmKmKeyGenNewKey
SmKmStoreAdd
SmKmStoreDelete
SmKmVirtualLockContextIncreaseWsMin
SmKmVirtualLockCtxMemoryUnlocked
SmPartitionJobPaired
SmProcessCompressionInfoRequest
SmcCacheAdd
SmcCacheCreatePrepare
SmcCacheRemove
SmcStoreDelete
SmcStoreResize
SmcStoreSlotAbort
SmcStoreSlotCommit
SmcStoreSlotReserve
SmpKeyedStoreEntryGet
SmpKeyedStoreSetVaRanges
SmpSystemStoreCreate
SshpSetCollectionActive
TlgAggregateInternalProviderCallback
TlgRegisterAggregateProviderEx
UNLOCK_ADDRESS_SPACE_UNORDERED
UNLOCK_PAGE_TABLE_COMMITMENT
VmCreateMemoryRange
VmDeleteMemoryRange
VmMergeMemoryRanges
VmSplitMemoryRange
VmpCleanProcessAddressSpace
VmpPauseResumeNotify
VrpDecrementSiloCount
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlLoadDifferencingHive
VrpHandleIoctlLoadDifferencingHiveForHost
VrpHandleIoctlModifyFlags
VrpHandleIoctlUnloadDifferencingHiveForHost
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpIncrementSiloCount
VrpLoadDifferencingHive
VrpPostUnloadKey
VrpPreLoadKey
VrpPreUnloadKey
VrpUnloadDifferencingHive
VrpWaitForDiffHiveEntryTransitionOwnerToLeave
VslpLockPagesForTransfer
VslpUnlockPagesForTransfer
WbAddHeapExecutedBlockToCache
WbAddHeapExecutedBlockToLRU
WbAddWarbirdEncryptionSegment
WbAllocateSlots
WbAllocateUserMemory
WbDecryptEncryptionSegment
WbFreeMemoryBlockRegion
WbGetInitializedEncryptionSegment
WbGetWarbirdProcess
WbGetWarbirdThread
WbHeapExecutionUnloadModule
WbInPlaceEncryptionUnloadModule
WbMoveHeapExecutedBlockToBackOfLRU
WbReEncryptEncryptionSegment
WbRemoveWarbirdProcess
WheaConfigureErrorSource
WheaExecuteRowFailureCheck
WheaInitialize
WheaRegisterErrorSourceOverride
WheaRegisterInUsePageOfflineNotification
WheaSelLogCheckPoint
WheaSelLogSetNtSchedulerAvailability
WheaUnconfigureErrorSource
WheaUnregisterErrorSourceOverride
WheaUnregisterInUsePageOfflineNotification
WheapCallInUsePageNotificationCallbacks
WheapPfaReset
WheapPredictiveFailureAnalysis
paramcount 0 0
address 140302c50 140302c40
sig undefined ExfTryToWakePushLock(void) undefined ExfTryToWakePushLock(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

ExfTryToWakePushLock Calling Diff

--- ExfTryToWakePushLock calling
+++ ExfTryToWakePushLock calling
@@ -229 +229 @@
-FUN_1409fa120
+FUN_1409fa0b0
@@ -683 +682,0 @@
-VrpHandleIoctlInitializeJobForVreg

XpressBuildHuffmanDecodingTable

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type length,sig,address
ratio 0.3
i_ratio 0.67
m_ratio 0.75
b_ratio 0.7
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name XpressBuildHuffmanDecodingTable XpressBuildHuffmanDecodingTable
fullname XpressBuildHuffmanDecodingTable XpressBuildHuffmanDecodingTable
refcount 4 4
length 815 1189
called
calling RtlDecompressBufferXpressHuff
RtlDecompressBufferXpressHuffProgress		 RtlDecompressBufferXpressHuff
RtlDecompressBufferXpressHuffProgress
paramcount 5 0
address 1402a8270 1402a8010
sig undefined XpressBuildHuffmanDecodingTable(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5) undefined XpressBuildHuffmanDecodingTable(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

SeCaptureSubjectContext

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,calling
ratio 1.0
i_ratio 1.0
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name SeCaptureSubjectContext SeCaptureSubjectContext
fullname SeCaptureSubjectContext SeCaptureSubjectContext
refcount 82 83
length 36 36
called SeCaptureSubjectContextEx SeCaptureSubjectContextEx
calling
Expand for full list:
CmFcInitSystem2
CmUpdateFeatureConfiguration
CmUpdateFeatureUsageSubscription
CmpCheckHivePrimaryFileReadWriteAccess
CmpLogHiveFileInaccessible
CmpNotifyChangeKey
CmpSetKeySecurity
EtwpAccessCheck
EtwpCoverageUserIsAdmin
EtwpFindOrCreateGuidEntry
ExIsRestrictedCallerExpWnfCheckCallerAccess
FUN_140687e40
IoCheckRedirectionTrustLevel
IoComputeRedirectionTrustLevel
IoGetDeviceInterfaceAlias
IopGetDeviceInterfaces
NtCloseObjectAuditAlarm
NtDeleteKey
NtDeleteObjectAuditAlarm
NtDeleteValueKey
NtImpersonateAnonymousToken
NtOpenObjectAuditAlarm
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtRenameKey
NtSetInformationKey
NtSetUuidSeed
NtSetValueKey
ObpGetIntegrityLevel
PiAuCheckTokenMembership
PiAuDoesClientHavePrivilege
PiAuVerifyAccessToObject
PiCMGetDeviceIdList
PiCMValidateDeviceInstance
PiDqOpenUserObjectRegKey
PiDqQueryCreate
PiPnpRtlObjectEventWorker
PiUEventHandleRegistration
PnpGetCallerSessionId
PopBootStatAccessCheck
PspIsContextAdmin
PspIumVerifyParentSd
PspSinglePrivCheck
RtlCheckTokenCapability
RtlCheckTokenMembershipEx
RtlIsSandboxedToken
SeAccessCheckByType
SeAdtRegistryValueChangedAuditAlarm
SeAuditBootConfiguration
SeAuditFipsCryptoSelftests
SeAuditHandleDuplication
SeAuditHardLinkCreationWithTransaction
SeAuditPlugAndPlay
SeAuditProcessCreation
SeAuditSystemTimeChange
SeAuditTransactionStateChange
SeAuditingWithTokenForSubcategory
SeCheckPrivilegedObject
SeCloseObjectAuditAlarm
SeDeleteObjectAuditAlarmWithTransaction
SeIsAppContainerOrIdentifyLevelContext
SeOpenObjectAuditAlarmWithTransaction
SeOperationAuditAlarm
SeReportSecurityEventWithSubCategory
SeSecurityDescriptorChangedAuditAlarm
SeTokenDefaultDaclChangedAuditAlarm
SepAccessCheckAndAuditAlarm
SepAdtAuditThisEventByCategoryWithContext
SepAdtAuditThisEventWithContext
SepAdtTokenRightAdjusted
SepAuditAssignPrimaryToken
SepCheckCreateLowBox
SepFilterToken
WdipAccessCheck
WmipInitializeSecurity
Expand for full list:
CmFcInitSystem2
CmSetValueKey
CmUpdateFeatureConfiguration
CmUpdateFeatureUsageSubscription
CmpCheckHivePrimaryFileReadWriteAccess
CmpLogHiveFileInaccessible
CmpNotifyChangeKey
CmpSetKeySecurity
EtwpAccessCheck
EtwpCoverageUserIsAdmin
EtwpFindOrCreateGuidEntryExIsRestrictedCaller
ExpWnfCheckCallerAccess
FUN_140687e40
IoCheckRedirectionTrustLevel
IoComputeRedirectionTrustLevel
IoGetDeviceInterfaceAlias
IopGetDeviceInterfaces
NtCloseObjectAuditAlarm
NtDeleteKey
NtDeleteObjectAuditAlarm
NtDeleteValueKey
NtImpersonateAnonymousToken
NtOpenObjectAuditAlarm
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtRenameKey
NtSetInformationKey
NtSetUuidSeed
NtSetValueKey
ObpGetIntegrityLevel
PiAuCheckTokenMembership
PiAuDoesClientHavePrivilege
PiAuVerifyAccessToObject
PiCMGetDeviceIdList
PiCMValidateDeviceInstance
PiDqOpenUserObjectRegKey
PiDqQueryCreate
PiPnpRtlObjectEventWorker
PiUEventHandleRegistration
PnpGetCallerSessionId
PopBootStatAccessCheck
PspIsContextAdmin
PspIumVerifyParentSd
PspSinglePrivCheck
RtlCheckTokenCapability
RtlCheckTokenMembershipEx
RtlIsSandboxedToken
SeAccessCheckByType
SeAdtRegistryValueChangedAuditAlarm
SeAuditBootConfiguration
SeAuditFipsCryptoSelftests
SeAuditHandleDuplication
SeAuditHardLinkCreationWithTransaction
SeAuditPlugAndPlay
SeAuditProcessCreation
SeAuditSystemTimeChange
SeAuditTransactionStateChange
SeAuditingWithTokenForSubcategory
SeCheckPrivilegedObject
SeCloseObjectAuditAlarm
SeDeleteObjectAuditAlarmWithTransaction
SeIsAppContainerOrIdentifyLevelContext
SeOpenObjectAuditAlarmWithTransaction
SeOperationAuditAlarm
SeReportSecurityEventWithSubCategory
SeSecurityDescriptorChangedAuditAlarm
SeTokenDefaultDaclChangedAuditAlarm
SepAccessCheckAndAuditAlarm
SepAdtAuditThisEventByCategoryWithContext
SepAdtAuditThisEventWithContext
SepAdtTokenRightAdjusted
SepAuditAssignPrimaryToken
SepCheckCreateLowBox
SepFilterToken
WdipAccessCheck
WmipInitializeSecurity
paramcount 0 0
address 1406adc60 1406adc60
sig undefined SeCaptureSubjectContext(void) undefined SeCaptureSubjectContext(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

SeCaptureSubjectContext Calling Diff

--- SeCaptureSubjectContext calling
+++ SeCaptureSubjectContext calling
@@ -1,0 +2 @@
+CmSetValueKey

RtlQueryFeatureConfiguration

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.97
i_ratio 0.73
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name RtlQueryFeatureConfiguration RtlQueryFeatureConfiguration
fullname RtlQueryFeatureConfiguration RtlQueryFeatureConfiguration
refcount 8 9
length 221 221
called KeGetEffectiveIrql
RtlpFcBufferManagerDereferenceBuffers
RtlpFcBufferManagerReferenceBuffers
RtlpFcGetBufferManager
RtlpFcQueryFeatureConfigurationFromBufferSet		 KeGetEffectiveIrql
RtlpFcBufferManagerDereferenceBuffers
RtlpFcBufferManagerReferenceBuffers
RtlpFcGetBufferManager
RtlpFcQueryFeatureConfigurationFromBufferSet
calling CmQuerySingleFeatureConfiguration
wil_RtlStagingConfig_QueryFeatureState
wil_details_OnFeatureConfigurationChange		 CmQuerySingleFeatureConfiguration
wil_RtlStagingConfig_QueryFeatureState
wil_RtlStagingConfig_QueryFeatureState
wil_details_OnFeatureConfigurationChange
paramcount 0 0
address 1402e7a80 1402e7820
sig undefined RtlQueryFeatureConfiguration(void) undefined RtlQueryFeatureConfiguration(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

RtlQueryFeatureConfiguration Calling Diff

--- RtlQueryFeatureConfiguration calling
+++ RtlQueryFeatureConfiguration calling
@@ -2,0 +3 @@
+wil_RtlStagingConfig_QueryFeatureState

CmFcManagerNotifyFeatureUsage

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.76
i_ratio 0.61
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name CmFcManagerNotifyFeatureUsage CmFcManagerNotifyFeatureUsage
fullname CmFcManagerNotifyFeatureUsage CmFcManagerNotifyFeatureUsage
refcount 3 4
length 232 232
called CmpWorkItemQueueWork
KeGetEffectiveIrql
KeLeaveCriticalRegion
KiInsertQueueDpc
RtlAcquireSwapReference
RtlReleaseSwapReference
RtlpFcAddDelayedUsageReportToBuffer		 CmpWorkItemQueueWork
KeGetEffectiveIrql
KeLeaveCriticalRegion
KiInsertQueueDpc
RtlAcquireSwapReference
RtlReleaseSwapReference
RtlpFcAddDelayedUsageReportToBuffer
calling RtlNotifyFeatureUsage
wil_details_FeatureReporting_ReportUsageToService		 RtlNotifyFeatureUsage
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToServiceDirect
paramcount 0 0
address 140615470 140615570
sig undefined CmFcManagerNotifyFeatureUsage(void) undefined CmFcManagerNotifyFeatureUsage(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

CmFcManagerNotifyFeatureUsage Calling Diff

--- CmFcManagerNotifyFeatureUsage calling
+++ CmFcManagerNotifyFeatureUsage calling
@@ -2,0 +3 @@
+wil_details_FeatureReporting_ReportUsageToServiceDirect

KiInitializeKernel$filt$0

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address
ratio 1.0
i_ratio 0.9
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name KiInitializeKernel$filt$0 KiInitializeKernel$filt$0
fullname KiInitializeKernel$filt$0 KiInitializeKernel$filt$0
refcount 2 1
length 29 29
called KiFatalFilter KiFatalFilter
calling
paramcount 0 0
address 140a93246 140a93242
sig undefined KiInitializeKernel$filt$0(void) undefined KiInitializeKernel$filt$0(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

MmUnlockPages

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,calling
ratio 0.98
i_ratio 0.92
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name MmUnlockPages MmUnlockPages
fullname MmUnlockPages MmUnlockPages
refcount 74 77
length 2008 2008
called
Expand for full list:
KeBugCheckEx
KeShouldYieldProcessor
KeYieldProcessorEx
KiRemoveSystemWorkPriorityKick
MiDereferenceIoPages
MiFreeMdlTracker
MiPfnShareCountIsZero
MiProbeUnlockPage
MiRetardMdl
MiReturnCommit
MmUnmapLockedPages
Expand for full list:
KeBugCheckEx
KeShouldYieldProcessor
KeYieldProcessorEx
KiRemoveSystemWorkPriorityKick
MiDereferenceIoPages
MiFreeMdlTracker
MiPfnShareCountIsZero
MiProbeUnlockPage
MiRetardMdl
MiReturnCommit
MmUnmapLockedPages
calling
Expand for full list:
AlpcpFreeCompletionList
AlpcpInitializeCompletionList
CcCopyBytesToUserBuffer
CcLockSystemCacheBuffer
CcMapAndCopyInToCache
CcMdlRead$fin$0
CcMdlReadComplete2
CcMdlWriteAbort
CcMdlWriteComplete2
CcPrepareMdlWrite$fin$0
CcZeroDataInCacheCmpLockKeyBodyIntoMemory
CmpUnlockKeyBodyFromMemory
ExUnlockUserBuffer
ExpGetLookasideInformation
ExpProfileDelete
FUN_14070752c
FUN_140a4ecb0
FUN_140b1a730
FsRtlpFreeMdlChain
IopCleanupFileObjectIosbRange
IopSetFileObjectIosbRange
IopUnlockAndFreeMdl
IopfCompleteRequest
KiOpPatchCode
MiAllocatePerSessionProtos
MiApplyImageHotPatch
MiCopyPagesIntoEnclave
MiCopyVirtualMemory
MiGetWorkingSetInfo
MiGetWorkingSetInfoList
MiLoadDataIntoVsmEnclave
MiProbeAndLockComplete
MiQueryMemoryPhysicalContiguity
MiReleaseHotPatchResources
MiReplaceRotateWithDemandZero
MiRotateToFrameBuffer
NT_DISK::Read
NT_DISK::Write
NtPssCaptureVaSpaceBulk
NtStartProfile
NtStopProfile
PopReadPagesFromHiberFile
PsDispatchIumService
PspCreateSecureThread
PspExitThread
PspGetSetContextInternal
PspIumAllocatePartitionState
PspIumFreePartitionState
SmPrepareForFatalPageError
SmProcessStatsRequest
VmProbeAndLockPages
VmUnlockPages
VslCallEnclave
VslFinalizeSecureImageHash
VslObtainHotPatchUndoTable
VslValidateDynamicCodePages
VslpLockPagesForTransfer
VslpUnlockPagesForTransfer
WbMakeUserExecutablePagesKernelWritable
Expand for full list:
AlpcpFreeCompletionList
AlpcpInitializeCompletionList
CcCopyBytesToUserBuffer
CcLockSystemCacheBuffer
CcMapAndCopyInToCache
CcMdlRead$fin$0
CcMdlReadComplete2
CcMdlWriteAbort
CcMdlWriteComplete2
CcPrepareMdlWrite$fin$0
CcZeroDataInCacheCmpLockKeyBodyIntoMemory
CmpUnlockKeyBodyFromMemory
ExUnlockUserBuffer
ExpGetLookasideInformation
ExpProfileDelete
FUN_140707cbc
FUN_14070897c
FUN_140a4ec40
FUN_140b1a730
FsRtlpFreeMdlChain
IopCleanupFileObjectIosbRange
IopSetFileObjectIosbRange
IopUnlockAndFreeMdl
IopfCompleteRequest
KiOpPatchCode
MiAllocatePerSessionProtos
MiApplyImageHotPatch
MiCopyPagesIntoEnclave
MiCopyVirtualMemory
MiGetWorkingSetInfo
MiGetWorkingSetInfoList
MiLoadDataIntoVsmEnclave
MiProbeAndLockComplete
MiQueryMemoryPhysicalContiguity
MiReleaseHotPatchResources
MiReplaceRotateWithDemandZero
MiRotateToFrameBuffer
NT_DISK::Read
NT_DISK::Write
NtPssCaptureVaSpaceBulk
NtStartProfile
NtStopProfile
PopReadPagesFromHiberFile
PsDispatchIumService
PspCreateSecureThread
PspExitThread
PspGetSetContextInternal
PspIumAllocatePartitionState
PspIumFreePartitionState
SmPrepareForFatalPageError
SmProcessStatsRequest
VmProbeAndLockPages
VmUnlockPages
VslCallEnclave
VslFinalizeSecureImageHash
VslObtainHotPatchUndoTable
VslValidateDynamicCodePages
VslpLockPagesForTransfer
VslpUnlockPagesForTransfer
WbMakeUserExecutablePagesKernelWritable
paramcount 0 0
address 140233fa0 140233fa0
sig undefined MmUnlockPages(void) undefined MmUnlockPages(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

MmUnlockPages Calling Diff

--- MmUnlockPages calling
+++ MmUnlockPages calling
@@ -17,2 +17,3 @@
-FUN_14070752c
-FUN_140a4ecb0
+FUN_140707cbc
+FUN_14070897c
+FUN_140a4ec40

HvpGetBinContextInitialize

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,calling
ratio 1.0
i_ratio 1.0
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name HvpGetBinContextInitialize HvpGetBinContextInitialize
fullname HvpGetBinContextInitialize HvpGetBinContextInitialize
refcount 36 38
length 6 6
called
calling
Expand for full list:
CmEnumerateValueFromLayeredKey
CmRenameKey
CmpCheckLeaf
CmpCheckValueList
CmpReferenceSecurityNode
HvCheckAndUpdateHiveBackupTimeStamp
HvCheckHive
HvFreeCell
HvIsCellAllocated
HvWriteExternal
HvpAddFreeCellHintHvpCopyModifiedData
HvpDropPagedBins
HvpFindFreeCell
HvpFindNextDirtyBlock
HvpGetCellContextMove
HvpGetCellContextReinitialize
HvpReleaseCellFlat
HvpRemapAndEnlistHiveBins
HvpRemoveFreeCellHint
HvpSetRangeProtection
Expand for full list:
CmEnumerateValueFromLayeredKey
CmRenameKey
CmSetValueKey
CmpCheckLeaf
CmpCheckValueList
CmpReferenceSecurityNode
HvCheckAndUpdateHiveBackupTimeStamp
HvCheckHive
HvFreeCell
HvIsCellAllocated
HvWriteExternalHvpAddFreeCellHint
HvpCopyModifiedData
HvpDropPagedBins
HvpFindFreeCell
HvpFindNextDirtyBlock
HvpGetCellContextMove
HvpGetCellContextReinitialize
HvpReleaseCellFlat
HvpRemapAndEnlistHiveBins
HvpRemoveFreeCellHint
HvpSetRangeProtection
paramcount 0 0
address 140af6454 140af6454
sig undefined HvpGetBinContextInitialize(void) undefined HvpGetBinContextInitialize(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

HvpGetBinContextInitialize Calling Diff

--- HvpGetBinContextInitialize calling
+++ HvpGetBinContextInitialize calling
@@ -2,0 +3 @@
+CmSetValueKey

KeAbPreAcquire

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.95
i_ratio 0.81
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name KeAbPreAcquire KeAbPreAcquire
fullname KeAbPreAcquire KeAbPreAcquire
refcount 474 473
length 335 335
called KiAbEntryFreeAndEnableInterrupts
KiAbThreadRemoveBoostsSlow
KiAbTryReclaimOrphanedEntries
KiRemoveSystemWorkPriorityKick
MmGetSessionIdEx		 KiAbEntryFreeAndEnableInterrupts
KiAbThreadRemoveBoostsSlow
KiAbTryReclaimOrphanedEntries
KiRemoveSystemWorkPriorityKick
MmGetSessionIdEx
calling
Expand for full list:
AlpcpReceiveMessagePort
AlpcpTryLockForCachedReferenceBlob
BuildQueryDirectoryIrp
CmDeleteKey
CmDeleteValueKey
CmEnumerateKey
CmFcManagerDrainAllFeatureUsageNotifications
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerQueryFeatureConfigurationSectionInformation
CmFcManagerRegisterFeatureConfigurationChangeNotification
CmFcManagerUnregisterFeatureConfigurationChangeNotificationCmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpManagerDrainUsageNotificationsWorker
CmFcpManagerPublishChangeNotifications
CmFcpManagerRetryUsageNotificationsWorker
CmFcpManagerSoftwareHiveReady
CmFreezeRegistry
CmLockHive
CmLockHiveSecurityExclusive
CmLockHiveSecurityShared
CmQueryMultipleValueKey
CmRegisterMachineHiveLoadedNotification
CmRestoreKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmSiRWLockAcquireExclusive
CmThawRegistry
CmUnregisterMachineHiveLoadedNotification
CmpAcquireWriteQueue
CmpAssignKeySecurity
CmpCallCallBacksEx
CmpCloseKeyObject
CmpCopyMergeOfLayeredKeyNode
CmpCreateChild
CmpCreateHive
CmpCreateHiveRootCell
CmpCreateKeyControlBlock
CmpDeleteHive
CmpDeleteKeyObject
CmpDereferenceNameControlBlockWithLock
CmpDoParseKey
CmpDoQueueLateUnloadWorker
CmpDumpKeyToBuffer
CmpFinishSystemHivesLoad
CmpFlushHive
CmpFlushNotify
CmpFreeKeyByCell
CmpGetKeyNodeForKcb
CmpGetLastHive
CmpGetNameControlBlock
CmpGetNextActiveHive
CmpGetNextHive
CmpGlobalLockKeyForWrite
CmpInitCmRM
CmpLoadHiveThread
CmpLoadHiveVolatile
CmpLockAppHiveLoadList
CmpLockCallbackListExclusive
CmpLockCallbackListShared
CmpLockContextListExclusive
CmpLockContextListShared
CmpLockDeletedHashEntryExclusiveByKcb
CmpLockGlobalKeyLockTrackerExclusive
CmpLockHashEntryByIndexExclusive
CmpLockHashEntryExclusive
CmpLockHashEntryExclusiveByKcb
CmpLockHashEntryShared
CmpLockHashEntrySharedByKcb
CmpLockHiveListExclusive
CmpLockKcbExclusive
CmpLockKcbShared
CmpLockRegistryFreezeAware
CmpLockSiloKeyLockTrackerExclusive
CmpLockSiloKeyLockTrackerShared
CmpLockTwoSecurityCachesExclusiveShared
CmpMarkEntireIndexDirty
CmpPerformCompleteKcbCacheLookup
CmpPromoteKey
CmpRecoverFlushProtocolStateFromFiles
CmpRefreshHive
CmpReorganizeHive
CmpReportNotifyHelper
CmpSetKeySecurity
CmpTransMgrCommitUoW
CmpTransMgrPrepare
CmpTransMgrSyncHive
CmpTrimHive
CmpTryToLockHashEntryExclusive
CmpTryToLockKcbExclusive
CmpUpdateHiveRootCellFlags
CmpVEExecuteOpenLogic
CmpVolumeContextDecrementRefCount
CmpVolumeContextMustHiveFilePagesBeKeptLocal
CmpVolumeContextSendDeviceUsageNotification
CmpVolumeManagerGetContextForFile
CmpWaitOnHiveWriteQueue
CmpWalkOneLevel
ExAcquireCacheAwarePushLockExclusive
ExAcquireCacheAwarePushLockExclusiveEx
ExAcquireFastResourceExclusive
ExAcquireFastResourceExclusive2
ExAcquireFastResourceShared
ExAcquireFastResourceShared2
ExAcquireFastResourceSharedStarveExclusive
ExAcquireFastResourceSharedStarveExclusive2
ExAcquireFastResourceWithFlags
ExInitializeFastResourceAcquired2
ExRegisterExtension
ExRegisterHost
ExTryAcquireAutoExpandPushLockExclusive
ExTryAcquireAutoExpandPushLockShared
ExTryAcquireCacheAwarePushLockExclusiveEx
ExTryAcquireCacheAwarePushLockSharedEx
ExTryToAcquireFastMutex
ExUnregisterExtension
ExUuidCreate
ExfAcquirePushLockExclusiveEx
ExfAcquirePushLockSharedEx
ExfAcquireReleasePushLockExclusive
ExpAcquireFastMutexContended
ExpAcquireFastResourceExclusiveSlow
ExpAcquireFastResourceSharedSlow
ExpKdPullRemoteFileForUser
ExpNtUpdateWnfStateData
ExpWnfAcquirePermanentDataStoreHandle
ExpWnfAcquireSubscriptionByName
ExpWnfAcquireSubscriptionNameInstance
ExpWnfAllocateNextPersistentNameSequence
ExpWnfCompleteThreadSubscriptions
ExpWnfCreateNameInstance
ExpWnfCreateProcessContext
ExpWnfDeleteNameInstance
ExpWnfDeleteProcessContext
ExpWnfDeleteScopeById
ExpWnfDeleteScopeInstances
ExpWnfDeleteStateData
ExpWnfDeleteSubscription
ExpWnfDeliverThreadNotifications
ExpWnfDestroyPermanentDataStore
ExpWnfDispatchKernelSubscription
ExpWnfEnumerateScopeInstances
ExpWnfGetPermanentDataStore
ExpWnfInsertSubscriptionInPendingQueue
ExpWnfInvalidateDataStores
ExpWnfLookupNameInstance
ExpWnfNotifyNameSubscribers
ExpWnfNotifySubscription
ExpWnfReadStateData
ExpWnfResolveScopeInstance
ExpWnfSubscribeNameInstance
ExpWnfUpdateSubscription
ExpWnfWriteStateData
FUN_140707984
FsRtlAcquireHeaderMutex
HvFoldBackDirtyData
HvFreeCell
HvHiveConvertLockedPagesToCowByPolicy
HvIsRangeDirty
HvLockHiveFlusherShared
HvpDoAllocateCell
HvpMarkCellDirty
IoSetInformation
IopCloseFile
IopFlushBuffersFile
IopGetSetSecurityObject
IopQueryXxxInformation
IopReadFile
IopSetEaOrQuotaInformationFile
IopValidateAndGetWriteParameters
IopWaitAndAcquireFileObjectLock
IopXxxControlFile
KeAcquireGuardedMutex
KeWaitForMultipleObjects
KeWaitForMutexObject
KiInitializeMutant
KiSatisfyThreadWait
KiWaitForAllObjects
LOCK_HIVE_LOAD
MiAcquireKernelCfgLock
MiAddSpecialPurposeMemoryPrepare
MiAllocatePartitionId
MiApplyImageHotPatchRequest
MiCaptureRetpolineImportInfo
MiChangingSubsectionProtos
MiChargeSegmentCommit
MiCopyLargeVad
MiCreateFileOnlyImageFixupList
MiCreateHardwareEnclave
MiCreatePagingFile
MiCreatePagingFileMap
MiCreatePerSessionProtos
MiDeleteAllHardwareEnclaves
MiDeleteEnclavePages
MiDeleteExtentPfns
MiDeleteHotPatchEntry
MiDeleteHotPatchRecord
MiDereferencePerSessionProtos
MiFindHotPatchRecord
MiFindProcessImageHotPatchRecord
MiFindSpecialPurposeMemoryTypeByPartition
MiFinishCreateSection
MiFreePartitionId
MiFreeRetpolineImportInfo
MiFreeSessionId
MiGetAllRegisteredPatches
MiGetNewSessionId
MiInitializeInPageSupport
MiInitializePartialVad
MiInitializePartition
MiInitializePartitionSpecialPurposeMemory
MiInitializeSessionGlobals
MiInsertChildVads
MiInsertHotPatchRecord
MiInsertPageFileInList
MiInsertSharedCommitNode
MiIsExtentDangling
MiIsRangeFullyCommitted
MiLoadHotPatchForUserSid
MiLockControlAreaSectionExtend
MiLockFileExtentsExclusive
MiLockNestedVad
MiLockVadRange
MiLogHotPatchRundown
MiMapViewOfDataSection
MiMarkSharedImageCfgBits
MiObtainRelocationBits
MiOpenSpecialPurposeMemory
MiPopulateCfgBitMap
MiPrefetchControlArea
MiPrefetchVirtualMemory
MiQueryLoadedPatches
MiQueryProcessActivePatches
MiQuerySpecialPurposeMemoryInformation
MiRebuildLargePages
MiReferenceControlArea
MiRelocateImagePfn
MiRemoveSharedCommitNode
MiReserveUserMemory
MiReturnImageBase
MiSectionDelete
MiSelectOverflowDllBase
MiSelectRelocationStartHint
MiShutdownSystem
MiUnloadHotPatchForUserSid
MiUnmapViewOfSection
MiWaitForCollidedFaultComplete
MiWaitForExtentDeletions
MiZeroAllPageFiles
MmAcquireLoadLock
MmCommitSessionMappedView
MmCreateShadowMapping
MmDeleteShadowMapping
MmDuplicateMemory
MmEnumerateBadPages
MmExtendSection
MmGetPageFileForCrashDump
MmLinkJobProcess
MmPrefetchPagesEx
NtAllocateUuids
NtAreMappedFilesTheSame
NtDeleteKey
NtLockFile
NtNotifyChangeDirectoryFileEx
NtNotifyChangeMultipleKeys
NtQueryEaFile
NtQueryInformationFile
NtQueryQuotaInformationFile
NtQueryVolumeInformationFile
NtReadFileScatter
NtReleaseKeyedEvent
NtSetEaFile
NtSetInformationFile
NtSetUuidSeed
NtSetVolumeInformationFile
NtUnlockFile
NtWaitForKeyedEvent
NtWriteFileGather
ObpCloseHandle
ObpDeleteNameCheck
ObpLockUnrelatedDirectoryShared
PdcAcquireRwLockExclusive
PfpPrefetchSharedConflictNotifyEnd
PfpPrefetchSharedConflictNotifyStart
PfpPrefetchSharedStart
TlgAggregateInternalProviderCallback
TlgRegisterAggregateProviderEx
VrpBecomeDiffHiveEntryTransitionOwner
VrpDecrementSiloCount
VrpDereferenceDiffHiveEntry
VrpFindDiffHiveEntryForMountPoint
VrpFindOrCreateDiffHiveEntryForMountPoint
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlInitializeJobForVreg
VrpHandleIoctlLoadDifferencingHive
VrpHandleIoctlLoadDifferencingHiveForHost
VrpHandleIoctlModifyFlags
VrpHandleIoctlUnloadDifferencingHiveForHost
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpIncrementSiloCount
VrpLoadDifferencingHive
VrpPostEnumerateKey
VrpPreLoadKey
VrpPreUnloadKey
VrpTranslatePath
VrpUnloadDifferencingHive
VrpWaitForDiffHiveEntryTransitionOwnerToLeave
WbAddHeapExecutedBlockToCache
WbAddHeapExecutedBlockToLRU
WbAddWarbirdEncryptionSegment
WbAllocateSlots
WbAllocateUserMemory
WbDecryptEncryptionSegment
WbFreeMemoryBlockRegion
WbGetHeapExecutedBlock
WbGetInitializedEncryptionSegment
WbGetWarbirdEncryptionSegment
WbGetWarbirdProcess
WbGetWarbirdThread
WbHeapExecutionUnloadModule
WbInPlaceEncryptionUnloadModule
WbMoveHeapExecutedBlockToBackOfLRU
WbReEncryptEncryptionSegment
WbReleaseLeastRecentlyUsedHeapExecutedBlocks
WbRemoveWarbirdProcess
WheaConfigureErrorSource
WheaExecuteRowFailureCheck
WheaRegisterInUsePageOfflineNotification
WheaSelLogCheckPoint
WheaUnconfigureErrorSource
WheaUnregisterInUsePageOfflineNotification
WheapCallInUsePageNotificationCallbacks
WheapPfaReset
WheapPredictiveFailureAnalysis
Expand for full list:
AlpcpReceiveMessagePort
AlpcpTryLockForCachedReferenceBlob
BuildQueryDirectoryIrp
CmDeleteKey
CmDeleteValueKey
CmEnumerateKey
CmFcManagerDrainAllFeatureUsageNotifications
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerQueryFeatureConfigurationSectionInformation
CmFcManagerRegisterFeatureConfigurationChangeNotification
CmFcManagerUnregisterFeatureConfigurationChangeNotificationCmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpManagerDrainUsageNotificationsWorker
CmFcpManagerPublishChangeNotifications
CmFcpManagerRetryUsageNotificationsWorker
CmFcpManagerSoftwareHiveReady
CmFreezeRegistry
CmLockHive
CmLockHiveSecurityExclusive
CmLockHiveSecurityShared
CmQueryMultipleValueKey
CmRegisterMachineHiveLoadedNotification
CmRestoreKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmSiRWLockAcquireExclusive
CmThawRegistry
CmUnregisterMachineHiveLoadedNotification
CmpAcquireWriteQueue
CmpAssignKeySecurity
CmpCallCallBacksEx
CmpCloseKeyObject
CmpCopyMergeOfLayeredKeyNode
CmpCreateChild
CmpCreateHive
CmpCreateHiveRootCell
CmpCreateKeyControlBlock
CmpDeleteHive
CmpDeleteKeyObject
CmpDereferenceNameControlBlockWithLock
CmpDoParseKey
CmpDoQueueLateUnloadWorker
CmpDumpKeyToBuffer
CmpFinishSystemHivesLoad
CmpFlushHive
CmpFlushNotify
CmpFreeKeyByCell
CmpGetKeyNodeForKcb
CmpGetLastHive
CmpGetNameControlBlock
CmpGetNextActiveHive
CmpGetNextHive
CmpGlobalLockKeyForWrite
CmpInitCmRM
CmpLoadHiveThread
CmpLoadHiveVolatile
CmpLockAppHiveLoadList
CmpLockCallbackListExclusive
CmpLockCallbackListShared
CmpLockContextListExclusive
CmpLockContextListShared
CmpLockDeletedHashEntryExclusiveByKcb
CmpLockGlobalKeyLockTrackerExclusive
CmpLockHashEntryByIndexExclusive
CmpLockHashEntryExclusive
CmpLockHashEntryExclusiveByKcb
CmpLockHashEntryShared
CmpLockHashEntrySharedByKcb
CmpLockHiveListExclusive
CmpLockKcbExclusive
CmpLockKcbShared
CmpLockRegistryFreezeAware
CmpLockSiloKeyLockTrackerExclusive
CmpLockSiloKeyLockTrackerShared
CmpLockTwoSecurityCachesExclusiveShared
CmpMarkEntireIndexDirty
CmpPerformCompleteKcbCacheLookup
CmpPromoteKey
CmpRecoverFlushProtocolStateFromFiles
CmpRefreshHive
CmpReorganizeHive
CmpReportNotifyHelper
CmpSetKeySecurity
CmpTransMgrCommitUoW
CmpTransMgrPrepare
CmpTransMgrSyncHive
CmpTrimHive
CmpTryToLockHashEntryExclusive
CmpTryToLockKcbExclusive
CmpUpdateHiveRootCellFlags
CmpVEExecuteOpenLogic
CmpVolumeContextDecrementRefCount
CmpVolumeContextMustHiveFilePagesBeKeptLocal
CmpVolumeContextSendDeviceUsageNotification
CmpVolumeManagerGetContextForFile
CmpWaitOnHiveWriteQueue
CmpWalkOneLevel
ExAcquireCacheAwarePushLockExclusive
ExAcquireCacheAwarePushLockExclusiveEx
ExAcquireFastResourceExclusive
ExAcquireFastResourceExclusive2
ExAcquireFastResourceShared
ExAcquireFastResourceShared2
ExAcquireFastResourceSharedStarveExclusive
ExAcquireFastResourceSharedStarveExclusive2
ExAcquireFastResourceWithFlags
ExInitializeFastResourceAcquired2
ExRegisterExtension
ExRegisterHost
ExTryAcquireAutoExpandPushLockExclusive
ExTryAcquireAutoExpandPushLockShared
ExTryAcquireCacheAwarePushLockExclusiveEx
ExTryAcquireCacheAwarePushLockSharedEx
ExTryToAcquireFastMutex
ExUnregisterExtension
ExUuidCreate
ExfAcquirePushLockExclusiveEx
ExfAcquirePushLockSharedEx
ExfAcquireReleasePushLockExclusive
ExpAcquireFastMutexContended
ExpAcquireFastResourceExclusiveSlow
ExpAcquireFastResourceSharedSlow
ExpKdPullRemoteFileForUser
ExpNtUpdateWnfStateData
ExpWnfAcquirePermanentDataStoreHandle
ExpWnfAcquireSubscriptionByName
ExpWnfAcquireSubscriptionNameInstance
ExpWnfAllocateNextPersistentNameSequence
ExpWnfCompleteThreadSubscriptions
ExpWnfCreateNameInstance
ExpWnfCreateProcessContext
ExpWnfDeleteNameInstance
ExpWnfDeleteProcessContext
ExpWnfDeleteScopeById
ExpWnfDeleteScopeInstances
ExpWnfDeleteStateData
ExpWnfDeleteSubscription
ExpWnfDeliverThreadNotifications
ExpWnfDestroyPermanentDataStore
ExpWnfDispatchKernelSubscription
ExpWnfEnumerateScopeInstances
ExpWnfGetPermanentDataStore
ExpWnfInsertSubscriptionInPendingQueue
ExpWnfInvalidateDataStores
ExpWnfLookupNameInstance
ExpWnfNotifyNameSubscribers
ExpWnfNotifySubscription
ExpWnfReadStateData
ExpWnfResolveScopeInstance
ExpWnfSubscribeNameInstance
ExpWnfUpdateSubscription
ExpWnfWriteStateData
FUN_140708238
FsRtlAcquireHeaderMutex
HvFoldBackDirtyData
HvFreeCell
HvHiveConvertLockedPagesToCowByPolicy
HvIsRangeDirty
HvLockHiveFlusherShared
HvpDoAllocateCell
HvpMarkCellDirty
IoSetInformation
IopCloseFile
IopFlushBuffersFile
IopGetSetSecurityObject
IopQueryXxxInformation
IopReadFile
IopSetEaOrQuotaInformationFile
IopValidateAndGetWriteParameters
IopWaitAndAcquireFileObjectLock
IopXxxControlFile
KeAcquireGuardedMutex
KeWaitForMultipleObjects
KeWaitForMutexObject
KiInitializeMutant
KiSatisfyThreadWait
KiWaitForAllObjects
LOCK_HIVE_LOAD
MiAcquireKernelCfgLock
MiAddSpecialPurposeMemoryPrepare
MiAllocatePartitionId
MiApplyImageHotPatchRequest
MiCaptureRetpolineImportInfo
MiChangingSubsectionProtos
MiChargeSegmentCommit
MiCopyLargeVad
MiCreateFileOnlyImageFixupList
MiCreateHardwareEnclave
MiCreatePagingFile
MiCreatePagingFileMap
MiCreatePerSessionProtos
MiDeleteAllHardwareEnclaves
MiDeleteEnclavePages
MiDeleteExtentPfns
MiDeleteHotPatchEntry
MiDeleteHotPatchRecord
MiDereferencePerSessionProtos
MiFindHotPatchRecord
MiFindProcessImageHotPatchRecord
MiFindSpecialPurposeMemoryTypeByPartition
MiFinishCreateSection
MiFreePartitionId
MiFreeRetpolineImportInfo
MiFreeSessionId
MiGetAllRegisteredPatches
MiGetNewSessionId
MiInitializeInPageSupport
MiInitializePartialVad
MiInitializePartition
MiInitializePartitionSpecialPurposeMemory
MiInitializeSessionGlobals
MiInsertChildVads
MiInsertHotPatchRecord
MiInsertPageFileInList
MiInsertSharedCommitNode
MiIsExtentDangling
MiIsRangeFullyCommitted
MiLoadHotPatchForUserSid
MiLockControlAreaSectionExtend
MiLockFileExtentsExclusive
MiLockNestedVad
MiLockVadRange
MiLogHotPatchRundown
MiMapViewOfDataSection
MiMarkSharedImageCfgBits
MiObtainRelocationBits
MiOpenSpecialPurposeMemory
MiPopulateCfgBitMap
MiPrefetchControlArea
MiPrefetchVirtualMemory
MiQueryLoadedPatches
MiQueryProcessActivePatches
MiQuerySpecialPurposeMemoryInformation
MiRebuildLargePages
MiReferenceControlArea
MiRelocateImagePfn
MiRemoveSharedCommitNode
MiReserveUserMemory
MiReturnImageBase
MiSectionDelete
MiSelectOverflowDllBase
MiSelectRelocationStartHint
MiShutdownSystem
MiUnloadHotPatchForUserSid
MiUnmapViewOfSection
MiWaitForCollidedFaultComplete
MiWaitForExtentDeletions
MiZeroAllPageFiles
MmAcquireLoadLock
MmCommitSessionMappedView
MmCreateShadowMapping
MmDeleteShadowMapping
MmDuplicateMemory
MmEnumerateBadPages
MmExtendSection
MmGetPageFileForCrashDump
MmLinkJobProcess
MmPrefetchPagesEx
NtAllocateUuids
NtAreMappedFilesTheSame
NtDeleteKey
NtLockFile
NtNotifyChangeDirectoryFileEx
NtNotifyChangeMultipleKeys
NtQueryEaFile
NtQueryInformationFile
NtQueryQuotaInformationFile
NtQueryVolumeInformationFile
NtReadFileScatter
NtReleaseKeyedEvent
NtSetEaFile
NtSetInformationFile
NtSetUuidSeed
NtSetVolumeInformationFile
NtUnlockFile
NtWaitForKeyedEvent
NtWriteFileGather
ObpCloseHandle
ObpDeleteNameCheck
ObpLockUnrelatedDirectoryShared
PdcAcquireRwLockExclusive
PfpPrefetchSharedConflictNotifyEnd
PfpPrefetchSharedConflictNotifyStart
PfpPrefetchSharedStart
TlgAggregateInternalProviderCallback
TlgRegisterAggregateProviderEx
VrpBecomeDiffHiveEntryTransitionOwner
VrpDecrementSiloCount
VrpDereferenceDiffHiveEntry
VrpFindDiffHiveEntryForMountPoint
VrpFindOrCreateDiffHiveEntryForMountPoint
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlLoadDifferencingHive
VrpHandleIoctlLoadDifferencingHiveForHost
VrpHandleIoctlModifyFlags
VrpHandleIoctlUnloadDifferencingHiveForHost
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpIncrementSiloCount
VrpLoadDifferencingHive
VrpPostEnumerateKey
VrpPreLoadKey
VrpPreUnloadKey
VrpTranslatePath
VrpUnloadDifferencingHive
VrpWaitForDiffHiveEntryTransitionOwnerToLeave
WbAddHeapExecutedBlockToCache
WbAddHeapExecutedBlockToLRU
WbAddWarbirdEncryptionSegment
WbAllocateSlots
WbAllocateUserMemory
WbDecryptEncryptionSegment
WbFreeMemoryBlockRegion
WbGetHeapExecutedBlock
WbGetInitializedEncryptionSegment
WbGetWarbirdEncryptionSegment
WbGetWarbirdProcess
WbGetWarbirdThread
WbHeapExecutionUnloadModule
WbInPlaceEncryptionUnloadModule
WbMoveHeapExecutedBlockToBackOfLRU
WbReEncryptEncryptionSegment
WbReleaseLeastRecentlyUsedHeapExecutedBlocks
WbRemoveWarbirdProcess
WheaConfigureErrorSource
WheaExecuteRowFailureCheck
WheaRegisterInUsePageOfflineNotification
WheaSelLogCheckPoint
WheaUnconfigureErrorSource
WheaUnregisterInUsePageOfflineNotification
WheapCallInUsePageNotificationCallbacks
WheapPfaReset
WheapPredictiveFailureAnalysis
paramcount 11 11
address 140327730 140327720
sig undefined KeAbPreAcquire(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined param_5, undefined param_6, undefined param_7, undefined8 param_8, undefined4 param_9, undefined8 param_10, undefined8 param_11) undefined KeAbPreAcquire(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined param_5, undefined param_6, undefined param_7, undefined8 param_8, undefined4 param_9, undefined8 param_10, undefined8 param_11)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

KeAbPreAcquire Calling Diff

--- KeAbPreAcquire calling
+++ KeAbPreAcquire calling
@@ -155 +155 @@
-FUN_140707984
+FUN_140708238
@@ -296 +295,0 @@
-VrpHandleIoctlInitializeJobForVreg

KeAbPostRelease

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.99
i_ratio 0.77
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name KeAbPostRelease KeAbPostRelease
fullname KeAbPostRelease KeAbPostRelease
refcount 1537 1535
length 515 515
called KeBugCheckEx
KiAbEntryRemoveFromTree
KiAbThreadRemoveBoostsSlow
KiRemoveSystemWorkPriorityKick
MmGetSessionIdEx		 KeBugCheckEx
KiAbEntryRemoveFromTree
KiAbThreadRemoveBoostsSlow
KiRemoveSystemWorkPriorityKick
MmGetSessionIdEx
calling
Expand for full list:
AlpcAddHandleTableEntry
AlpcConnectionDestroyProcedure
AlpcDeleteBlobByHandle
AlpcReferenceBlobByHandle
AlpcRegisterLogRoutine
AlpcUnregisterLogRoutine
AlpcViewDestroyProcedure
AlpcpAcceptConnectPort
AlpcpAssociateIoCompletionPort
AlpcpCancelMessage
AlpcpCancelMessagesByRequestorAlpcpCleanupProcessViews
AlpcpCompleteDispatchMessage
AlpcpCreateClientPort
AlpcpCreateReserve
AlpcpCreateSection
AlpcpCreateSectionView
AlpcpCreateSecurityContext
AlpcpCreateView
AlpcpDeleteBlob
AlpcpDeletePort
AlpcpDestroyBlob
AlpcpDestroyPort
AlpcpDisconnectPort
AlpcpDispatchCloseMessage
AlpcpDispatchConnectionRequest
AlpcpDispatchNewMessage
AlpcpDispatchReplyToPort
AlpcpDispatchReplyToWaitingThread
AlpcpDoPortCleanup
AlpcpEndInitialization
AlpcpEnterAllocationEventMessageLog
AlpcpEnterFreeEventMessageLog
AlpcpEnterStateChangeEventMessageLog
AlpcpEnumerateResourcesPort
AlpcpFlushCancelQueue
AlpcpFlushMessagesByRequestor
AlpcpFlushMessagesPort
AlpcpFlushQueue
AlpcpFlushResourcesPort
AlpcpImpersonateMessage
AlpcpInitializeCompletionList
AlpcpInitializePort
AlpcpInsertCompletionListEntry
AlpcpInsertMessageCanceledQueue
AlpcpInsertMessageDirectQueue
AlpcpInsertMessageLargeMessageQueue
AlpcpInsertMessageMainQueue
AlpcpInsertMessagePendingQueue
AlpcpInsertResourcePort
AlpcpInvokeLogCallbacks
AlpcpLocateSectionView
AlpcpMapLegacyPortRemoteView
AlpcpPortQueryConnectedSidInfo
AlpcpPortQueryServerInfo
AlpcpPortQueryServerSessionInfo
AlpcpProcessSynchronousRequest
AlpcpQueryRemoteView
AlpcpQueueIoCompletionPort
AlpcpReceiveDirectMessagePort
AlpcpReceiveLegacyMessage
AlpcpReceiveMessagePort
AlpcpReceiveSynchronousReply
AlpcpReferenceAndLockTargetPortsAndCommunicationInfo
AlpcpReferenceConnectedPort
AlpcpReferenceMessageByWaitingThread
AlpcpReferenceMessageByWaitingThreadPort
AlpcpRegisterCompletionListDatabase
AlpcpRemoveMessageFromPendingQueue
AlpcpRemoveResourcePort
AlpcpReplyLegacySynchronousRequest
AlpcpReturnMessageOnInsufficientBuffer
AlpcpSendLegacySynchronousRequest
AlpcpSendMessage
AlpcpSignal
AlpcpSignalPortAndUnlock
AlpcpTrackPortReferences
AlpcpUnlockAndDereferenceTargetPortsAndCommunicationInfo
AlpcpUnlockBlob
AlpcpUnregisterCompletionListDatabase
AlpcpWaitForPortReferences
AlpcpWalkConnectionList
BgkpLockBgfxCodeSection
BgkpUnlockBgfxCodeSection
CcAmILowPriorityWriter
CcApplyLowIoPriorityToThread
CcBoostLowPriorityWorkerThread
CcChangeBackingFileObject
CcPinFileData
CcSetDirtyInMask
CcSetDirtyPinnedData
CcSlowReferenceSharedCacheMapFileObject
CcUnpinFileDataEx
CmDeleteKey
CmDeleteValueKey
CmEnumerateKey
CmFcManagerDrainAllFeatureUsageNotifications
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerQueryFeatureConfigurationSectionInformation
CmFcManagerRegisterFeatureConfigurationChangeNotification
CmFcManagerUnregisterFeatureConfigurationChangeNotification
CmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpManagerDrainUsageNotificationsWorker
CmFcpManagerPublishChangeNotifications
CmFcpManagerRetryUsageNotificationsWorker
CmFcpManagerSoftwareHiveReady
CmFreezeRegistry
CmKeyBodyRemapToVirtualForEnum
CmLockKeyForWrite
CmQueryMultipleValueKey
CmRegisterMachineHiveLoadedNotification
CmRestoreKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmSiRWLockReleaseExclusive
CmThawRegistry
CmUnlockHive
CmUnlockHiveSecurity
CmUnregisterMachineHiveLoadedNotification
CmpAssignKeySecurity
CmpCallCallBacksEx
CmpCloseKeyObject
CmpCreateChild
CmpCreateHive
CmpCreateHiveRootCell
CmpCreateKeyControlBlock
CmpDeleteHive
CmpDeleteKeyObject
CmpDereferenceNameControlBlockWithLock
CmpDoParseKey
CmpDoQueueLateUnloadWorker
CmpDumpKeyToBuffer
CmpFinishSystemHivesLoad
CmpFlushHive
CmpFlushNotify
CmpGetKeyNodeForKcb
CmpGetLastHive
CmpGetNameControlBlock
CmpGetNextActiveHive
CmpGetNextHive
CmpInitCmRM
CmpLoadHiveThread
CmpLoadHiveVolatile
CmpLockRegistryFreezeAware
CmpMarkEntireIndexDirty
CmpNotifyMachineHiveLoaded
CmpPerformCompleteKcbCacheLookup
CmpPromoteKey
CmpRecoverFlushProtocolStateFromFiles
CmpRefreshHive
CmpReorganizeHive
CmpReportNotifyHelper
CmpSetKeySecurity
CmpStartSiloKeyLockTracker
CmpStopSiloKeyLockTracker
CmpTransMgrCommitUoW
CmpTransMgrPrepare
CmpTransMgrSyncHive
CmpTrimHive
CmpUnlockAppHiveLoadList
CmpUnlockCallbackList
CmpUnlockContextList
CmpUnlockDeletedHashEntryByKcb
CmpUnlockGlobalKeyLockTracker
CmpUnlockHashEntry
CmpUnlockHashEntryByIndex
CmpUnlockHashEntryByKcb
CmpUnlockHiveList
CmpUnlockKcb
CmpUnlockNameHashEntry
CmpUpdateHiveRootCellFlags
CmpVEExecuteOpenLogic
CmpVolumeContextDecrementRefCount
CmpVolumeContextMustHiveFilePagesBeKeptLocal
CmpVolumeContextSendDeviceUsageNotification
CmpVolumeManagerGetContextForFile
CmpWakeWriteQueueWaiters
CmpWalkOneLevel
DbgkFlushErrorPort
DbgkRegisterErrorPort
DbgkpRemoveErrorPort
DbgkpSendErrorMessage
EmClientQueryRuleState
EmClientRuleDeregisterNotification
EmClientRuleEvaluate
EmPowerPagingEnabled
EmProviderDeregister
EmProviderDeregisterEntry
EmProviderRegisterEntry
EmpAcquirePagingReference
EmpClientRuleRegisterNotification
EmpParseInfDatabase
EmpProviderRegister
EmpQueueRuleUpdateState
EmpReleasePagingReference
EmpRuleUpdateWorkerThread
EtwCleanupSiloState
EtwQueryProcessTelemetryCoverage
EtwpAcquireTokenAccessInformation
EtwpAddBinaryInfoEvents
EtwpAddDebugInfoEvents
EtwpAddGuidEntry
EtwpAddRegEntryToGroup
EtwpBufferingModeCompressionFlush
EtwpCompressPendingBuffers
EtwpCompressionProc
EtwpCovSampContextAddSamples
EtwpCovSampContextCleanup
EtwpCovSampContextGetModule
EtwpCovSampContextPruneModules
EtwpCovSampHashMakeRoomAndAcquireLock
EtwpCovSampProcessAddModule
EtwpCovSampProcessMapAddresses
EtwpCoverageCheckCP
EtwpCoverageEnsureContext
EtwpCoverageEnsureUserModeView
EtwpCoverageFlushWorkItemCallback
EtwpCoverageProvEnableCallback
EtwpCoverageRecord
EtwpCoverageReset
EtwpCoverageResetCP
EtwpCoverageSamplerClose
EtwpCoverageSamplerQuery
EtwpCoverageSamplerSetBloomFilter
EtwpCoverageSamplerStart
EtwpCoverageSamplerStop
EtwpCoverageSamplerUnloadImage
EtwpCreateLogFile
EtwpCreateUmReplyObject
EtwpDeleteRegistrationObject
EtwpDisableCompression
EtwpFindGuidEntryByGuid
EtwpFlushCoverage
EtwpFreeCompression
EtwpGetCompressionSettings
EtwpGetDisallowList
EtwpGetLoggerInfoFromContext
EtwpGetNextGuidEntry
EtwpIsGuidAllowed
EtwpRealtimeNotifyConsumers
EtwpReferenceLoggerSecurityDescriptor
EtwpSendDbgId
EtwpSetCompressionSettings
EtwpTrackBinaryForSession
EtwpTrackDebugIdForSession
EtwpTrackDecodeGuidForSession
EtwpUnreferenceGuidEntry
EtwpUpdateDisallowedGuids
EtwpUpdatePeriodicCaptureState
EtwpUpdateSelectedGroupMasks
ExCreateHandleTable
ExDisableHandleTracing
ExDupHandleTable
ExEnableHandleExceptions
ExEnableHandleTracing
ExEnableRaiseUMExceptionOnInvalidHandleClose
ExFetchLicenseData
ExFetchLicenseData$fin$0
ExGetLicenseTamperState
ExGetWakeTimerList
ExInitLicenseData
ExInitializeDeviceAts
ExNotifyPlatformBinaryExecuted
ExQueryHandleExceptionsPermanency
ExReferenceHandleDebugInfo
ExRegisterExtension
ExRegisterHost
ExReleaseAutoExpandPushLockShared
ExReleaseCacheAwarePushLockExclusive
ExReleaseCacheAwarePushLockExclusiveEx
ExReleaseFastMutex
ExReleaseFastMutexUnsafe
ExReleasePushLockEx
ExReleasePushLockExclusiveEx
ExReleasePushLockSharedEx
ExSetLicenseTamperState
ExSvmBeginDeviceReset
ExSvmFinalizeDeviceReset
ExSweepHandleTable
ExUninitializeDeviceAts
ExUnregisterExtension
ExUuidCreate
ExfAcquireReleasePushLockExclusive
ExpAllocateHandleTableEntry
ExpDeleteTimer
ExpFreeHandleTableEntry
ExpGetGlobalLocaleSection
ExpGetKernelDataProtection$fin$0
ExpGetProcessInformation
ExpGetSystemPlatformBinary
ExpInsertLowLevelTableIntoFreeList
ExpKdPullRemoteFileForUser
ExpLoadAndSortLicensingCacheDescriptors
ExpLoadAndSortLicensingCacheDescriptors$fin$0
ExpLoadAndSortLicensingCacheDescriptors$fin$1
ExpNtUpdateWnfStateData
ExpPutLicenseDataIntoRegistry$fin$0
ExpQueryBootLoaderMetadata
ExpQueryLicenseValueFromBlobHelper$fin$0
ExpReadLeapSecondData
ExpRemoveHandleTable
ExpSaAllocatorAllocate
ExpSaAllocatorFree
ExpSaPageGroupAllocateMemory
ExpSaPageGroupDescriptorAllocate
ExpSaPageGroupDescriptorFree
ExpSaPageGroupFreeMemory
ExpSetBootLoaderMetadata
ExpSetKernelDataProtection$fin$0
ExpSetTimerObject
ExpShareAddressSpaceWithDevice
ExpSnapShotHandleTables
ExpSvmDereferenceDevice
ExpWnfAcquirePermanentDataStoreHandle
ExpWnfAcquireSubscriptionByName
ExpWnfAcquireSubscriptionNameInstance
ExpWnfAllocateNextPersistentNameSequence
ExpWnfCompleteThreadSubscriptions
ExpWnfCreateNameInstance
ExpWnfCreateProcessContext
ExpWnfDeleteNameInstance
ExpWnfDeletePermanentStateData
ExpWnfDeleteProcessContext
ExpWnfDeleteScopeById
ExpWnfDeleteScopeInstances
ExpWnfDeleteStateData
ExpWnfDeleteSubscription
ExpWnfDeliverThreadNotifications
ExpWnfDestroyPermanentDataStore
ExpWnfDispatchKernelSubscription
ExpWnfEnumerateScopeInstances
ExpWnfGetPermanentDataStore
ExpWnfInsertSubscriptionInPendingQueue
ExpWnfInvalidateDataStores
ExpWnfLookupNameInstance
ExpWnfNotifyNameSubscribers
ExpWnfNotifySubscription
ExpWnfPopulateStateData
ExpWnfReadStateData
ExpWnfReadStateData$fin$0
ExpWnfResolveScopeInstance
ExpWnfSubscribeNameInstance
ExpWnfUpdateSubscription
ExpWnfWriteStateData
ExpWnfWriteStateData$fin$0
ExpWorkerInitialization
FUN_14036f764
FUN_140707984
FUN_1409fa120
FUN_1409fa77c
FlushLookUpTableBucket
FsRtlAcquireEofLock
FsRtlCheckOplockEx2
FsRtlInsertPerStreamContext
FsRtlLookupPerFileObjectContext
FsRtlLookupPerStreamContextInternal
FsRtlReleaseEofLock
FsRtlReleaseHeaderMutex
HalpDmaAllocateChildAdapterV3
HalpIommuBlockDevice
HalpIommuCreateDevice
HalpIommuDeleteDevice
HalpIommuInvokeInterfaceStateChangeCallbacks
HalpIommuUnblockDevice
HalpLeaveDmaDomain
HvFoldBackDirtyData
HvFreeCell
HvHiveConvertLockedPagesToCowByPolicy
HvIsRangeDirty
HvUnlockHiveFlusherShared
HvlQuerySetBootPagesInfo
HvpDoAllocateCell
HvpMarkCellDirty
InsertEventEntryInLookUpTable
IoRegisterIoTracking
IoUnregisterIoTracking
IommuBeginDeviceReset
IommuDeviceDelete
IommuFinalizeDeviceReset
IommuProcessPageRequestQueue
IommuRegisterInterfaceStateChangeCallback
IommuUnregisterInterfaceStateChangeCallback
IommupDeviceDisableSvm
IommupDeviceGetPasidDevice
IommupFreeSystemContext
IommupGetSystemContext
IommupHvAttachPasidDevice
IommupHvAttachPasidDeviceDomain
IommupHvCreateSvmPasidSpace
IommupHvDetachPasidDeviceDomain
IommupPasidDeviceCreate
IommupPasidDeviceDelete
IopProcessIoTracking
IopReleaseFileObjectLock
KeCleanupImageTracepoints
KeDeleteMutant
KeGenericCallDpcEx
KeQueryDpcWatchdogConfiguration
KeReleaseGuardedMutex
KeReleaseMutant
KeSetSystemServiceCallback
KeSetTracepoint
KeUpdateDpcWatchdogConfiguration
KiGenericCallDpcInitiatorWorker
KiRundownMutants
KiShouldLogUserModeReturnMismatch
KiStartSavingSupervisorState
KiTpIsExcludedKernelTracepointLocation
KseAddHardwareId
KseDriverUnloadImage
KseLookupHardwareId
KseQueryDeviceDataList
KseRegisterShimEx
KseResetDeviceCache
KseShimDatabaseBootRelease
KseShimDatabaseClose
KseShimDatabaseOpen
KseUnregisterShim
KsepDbCacheInsertDevice
KsepDbCacheQueryDevice
KsepGetShimsForDriver
KsepIsModuleShimmed
KsepResolveApplicableShimsForDriver
KsepShimDbChanged
MI_UNLOCK_RELOCATIONS_EXCLUSIVE
MiAddPartitionHugeRange
MiAddSpecialPurposeMemoryCleanup
MiAddSpecialPurposeMemoryComplete
MiAddSpecialPurposeMemoryPrepare
MiAddViewsForSection
MiAllocatePartitionId
MiApplyImageHotPatchRequest
MiCaptureRetpolineImportInfo
MiChargeSegmentCommit
MiCoalesceFreeLargePages
MiCoalesceFreePages
MiCoalescePlaceholderAllocations
MiCommitExistingVad
MiCommitPageTableRangesForVad
MiContractWsSwapPageFileWorker
MiCopyLargeVad
MiCreateFileOnlyImageFixupList
MiCreateHardwareEnclave
MiCreatePagingFile
MiCreatePagingFileMap
MiCreatePerSessionProtos
MiCreatePrototypePtes
MiDecommitHardwareEnclavePages
MiDeleteAllHardwareEnclaves
MiDeleteEmptyPageTables
MiDeleteEnclavePages
MiDeleteExtentPfns
MiDeleteHotPatchEntry
MiDeleteHotPatchRecord
MiDeletePartitionResources
MiDeleteVad
MiDereferenceExtendInfo
MiDereferencePerSessionProtos
MiFindHotPatchRecord
MiFindProcessImageHotPatchRecord
MiFindSpecialPurposeMemoryTypeByPartition
MiFinishCreateSection
MiFinishResume
MiFinishVadDeletion
MiFreeInPageSupportBlock
MiFreePartitionId
MiFreeRetpolineImportInfo
MiFreeSessionId
MiFreeUnusedPfnPages
MiGetAllRegisteredPatches
MiGetChannelInformation
MiGetNewSessionId
MiGetPartitionNodeInformation
MiGetSpecialPurposeMemoryPartitionForCaching
MiInitializeMirroring
MiInitializePagedPoolEvents
MiInitializePartialVad
MiInitializePartition
MiInitializePartitionSpecialPurposeMemory
MiInitializeSessionGlobals
MiInsertChildVads
MiInsertHotPatchRecord
MiInsertInSystemSpace
MiInsertPageFileInList
MiInsertSharedCommitNode
MiInsertVad
MiIsExtentDangling
MiIsRangeFullyCommitted
MiLateInitializeSystemCache
MiLoadHotPatchForUserSid
MiLocateSharedPageViews
MiLockVadRange
MiLogHotPatchRundown
MiMakeDriverPagesPrivate
MiManageSubsectionView
MiMapViewOfDataSection
MiMarkHugePfnBad
MiMarkSharedImageCfgBits
MiObtainRelocationBits
MiOpenSpecialPurposeMemory
MiPerformVadSplitting
MiPersistMdl
MiPopulateCfgBitMap
MiProcessTransitionHeatBatch
MiQueryLoadedPatches
MiQueryProcessActivePatches
MiQuerySpecialPurposeMemoryInformation
MiRebuildLargePages
MiReferenceRemovePartition
MiReleaseImageSection
MiReleaseKernelCfgLock
MiRelocateImagePfn
MiRemoveBadPages
MiRemoveFromSystemSpace
MiRemoveSharedCommitNode
MiRemoveVad
MiReserveUserMemory
MiReturnImageBase
MiSectionCreated
MiSectionDelete
MiSelectOverflowDllBase
MiSelectRelocationStartHint
MiSendParkedCoreUpdateToAllChildPartitions
MiSetPagesModified
MiSetProtectionOnSection
MiSetVadDeleted
MiShutdownSystem
MiSpecialPurposeMemoryRemoved
MiSplitPrivatePage
MiSplitReducedCommitClonePage
MiSubsectionProtosCreated
MiTransferFileExtent
MiTrimSharedPageFromViews
MiTrimUnusedPageFileRegionsWorker
MiUnloadHotPatchForUserSid
MiUnlockAndDereferenceVad
MiUnlockAndDereferenceVadShared
MiUnlockControlAreaFileObjectShared
MiUnlockControlAreaSectionExtend
MiUnlockDriverMappings
MiUnlockDynamicMemoryExclusive
MiUnlockDynamicMemoryNestedExclusive
MiUnlockDynamicMemoryShared
MiUnlockFileExtentsExclusive
MiUnlockLoaderEntry
MiUnlockNestedVad
MiUnlockPartitionSystemThreads
MiUnlockVad
MiUnlockVadRange
MiUnlockVadShared
MiUpControlAreaRefs
MiUpdateImagePfnImportRelocations
MiUpdateSpecialPurposeMemoryCacheEligibility
MiWalkEntireImage
MiZeroAllPageFiles
MiZeroPage
MiZeroPageMakeHot
MiZeroSectionObjectPointer
MmCheckProcessShadow
MmCommitSessionMappedView
MmCreateShadowMapping
MmDecodeExportSection
MmDeleteShadowMapping
MmDuplicateMemory
MmEncodeExportSection
MmEnumerateBadPages
MmExtendSection
MmGetPageFileForCrashDump
MmLinkJobProcess
MmMarkPhysicalMemoryAsBad
MmOutSwapVirtualAddresses
MmOutSwapWorkingSet
MmReleaseLoadLock
MmResourcesAvailable
MmSetPfnListInfo
NormalizationList__Unlock
NtAllocateUuids
NtAlpcDeleteSectionView
NtAlpcOpenSenderProcess
NtAlpcRevokeSecurityContext
NtAlpcSetInformation
NtAreMappedFilesTheSame
NtCancelTimer
NtChangeProcessState
NtChangeThreadState
NtCreateUserProcess
NtDeleteKey
NtDuplicateToken
NtNotifyChangeMultipleKeys
NtOpenProcessTokenEx
NtOpenThreadTokenEx
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInformationThread$fin$3
NtQueryObject
NtReleaseKeyedEvent
NtSetInformationThread
NtSetInformationThread$fin$1
NtSetSystemInformation
NtSetUuidSeed
NtTerminateProcess
NtWaitForKeyedEvent
ObCheckRefTraceProcess
ObClearProcessDeviceMap
ObDereferenceDeviceMap
ObDereferenceSecurityDescriptor
ObDisableEtwReferenceTrace
ObDuplicateObject
ObEnableEtwReferenceTrace
ObInsertObjectEx
ObIsDosDeviceLocallyMapped
ObLogSecurityDescriptor
ObOpenObjectByNameEx
ObQueryDeviceMapInformation
ObQueryNameStringMode
ObQueryRefTraceInformation
ObReleaseObjectSecurity
ObpCloseHandle
ObpCreateHandle
ObpCreateSymbolicLinkName
ObpDeleteSymbolicLinkName
ObpDeregisterObject
ObpFreeWorkItemBlock
ObpGetShadowDirectory
ObpLockChildDirectory
ObpLockUnrelatedDirectoryShared
ObpLookupObjectName
ObpPushRefDerefInfo
ObpReferenceSecurityDescriptorSlow
ObpRegisterObject
ObpSetCurrentProcessDeviceMap
ObpSetDeviceMap
ObpSlowReferenceDeviceMap
ObpStartRuntimeStackTrace
ObpStopRuntimeStackTrace
Ordinal_20
Ordinal_21
PdcTaskClientRequest
PerfDiagpProxyWorker
PfCheckDeprioritizeFile
PfCheckDeprioritizeImage
PfFileInfoNotify
PfGenerateTrace
PfProcessExitNotification
PfQuerySuperfetchInformation
PfSetSuperfetchInformation
PfSnBeginAppLaunch
PfSnGetPrefetchInstructions
PfSnIsHostingApplication
PfSnQueryPrefetcherInformation
PfSnSetAltPrefetchParam
PfTAccessTracingCleanup
PfTAccessTracingStart
PfTSetTraceWorkerPriority
PfTSetTracingPriority
PfpParametersPropagate
PfpParametersWatcher
PfpPrefetchSharedCleanup
PfpPrefetchSharedStart
PfpRpCHashAddEntries
PfpRpCHashDeleteEntries
PfpRpCHashEmpty
PfpRpCHashGrow
PfpRpFileKeyUpdate
PfpRpShutdown
PfpScenCtxPrefetchAbortSet
PfpScenCtxPrefetchStateSet
PfpScenCtxPrefetchWait
PfpScenCtxQueryScenarioInformation
PfpScenCtxScenarioSet
PfpScenCtxServiceThreadSet
PoFxAbandonDevice
PoFxPrepareDevice
PoFxStartDevicePowerManagement
PoFxSystemLatencyNotify
PopBlackBoxDirectAccess
PopBlackBoxUpdate
PopBootStatCheckIntegrity
PopBootStatGet
PopBootStatRestoreDefaults
PopBootStatSet
PopBootStatUnlock
PopDiagTraceFxRundown
PopDirectedDripsDiagBroadcastTreeBegin
PopDirectedDripsDiagBroadcastTreeEnd
PopDirectedDripsDiagNotifySessionStart
PopDirectedDripsDiagNotifySessionStop
PopDirectedDripsDiagTraceBroadcastFailureDevice
PopDirectedDripsDiagTraceBroadcastVisit
PopDirectedDripsDiagTraceMarkDevice
PopDirectedDripsDiagTraceNotifyDevices
PopDirectedDripsDiagTraceProblemDevice
PopDirectedDripsHandleResiliencyNotification
PopDirectedDripsIdleResiliencyCallback
PopDirectedDripsNotify
PopDirectedDripsNotifyResiliencyCompletionWorker
PopFxAcpiPrepareDevice
PopFxActivateDevicesForSx
PopFxBuildDirectedDripsCandidateDeviceList
PopFxBuildDripsBlockingDeviceList
PopFxClearDirectedDripsCandidateDeviceList
PopFxDisableBasicAccountingWorker
PopFxFindAcpiDeviceByUniqueId
PopFxFindAndReferenceAcpiDevice
PopFxIdleDevicesFromSx
PopFxInsertAcpiDevice
PopFxInsertDevice
PopFxLowPowerEpochCallback
PopFxNotifySxTransitionState
PopFxPauseDeviceAccounting
PopFxPrepareDevicesForShutdown
PopFxRegisterDeviceWithPep
PopFxRegisterPluginEx
PopFxRemoveAcpiDevice
PopFxRemoveDevice
PopFxResidentTimeoutRoutine
PopFxResumeDeviceAccounting
PopFxStartDeviceAccounting
PopFxStopDeviceAccounting
PopFxUpdateVetoMaskWork
PopPdcCsDeviceNotification
PopPepIdleTimeoutRoutine
PopPepInsertDevice
PopPepIterateDeviceList
PopPepPlatformStateRegistered
PopPepRemoveDevice
PopPepWork
PopPowerButtonBugcheckConfigure
PopQueryPowerButtonBugcheckEnabled
PsAdjustBasicEnclaveThreadList
PsCallEnclave
PsCaptureExceptionPort
PsCreateVsmEnclave
PsDeleteVsmEnclave
PsDisableImpersonation
PsFreezeProcess
PsGetNextProcess
PsGetNextProcessThread
PsGetProcessDeepFreezeStats
PsGetProcessEnclaveModuleInfo
PsImpersonateClient
PsInitializeVsmEnclave
PsIsVsmEnclaveTerminated
PsLoadVsmEnclaveData
PsQueryProcessEnergyValues
PsQueryRuntimeProcess
PsQueryStatisticsProcess
PsQueryTotalCycleTimeProcess
PsReferenceImpersonationToken
PsReferenceImpersonationTokenEx
PsReferencePartitionSystemProcess
PsReferencePrimaryTokenWithTag
PsRestoreImpersonation
PsSetProcessFaultInformation
PsSetProcessTelemetryAppState
PsSetProcessWin32Process
PsStartSiloMonitor
PsSwapImpersonationToken
PsSwapProcessWorkingSet
PsTerminateMinimalProcess
PsTerminateVsmEnclave
PsThawMultiProcess
PsUnregisterSiloMonitor
PsUpdateActiveProcessAffinity
PspAllocateAndQueryProcessNotificationChannel
PspAllocateThread
PspApplyCoreIsolationPolicy
PspApplyWorkingSetLimits
PspApplyWorkingSetLimitsToProcess
PspAssignPrimaryToken
PspAssignProcessToJob
PspAttachProcessToSyscallProvider
PspChangeJobMemoryUsageByProcess
PspChargeProcessWakeCounter
PspCreatePicoProcess
PspDestroySyscallProvider
PspDetachProcessFromSyscallProvider
PspEnableProcessOptionalXStateFeatures
PspExitThread
PspGetNextSyscallProviderProcess
PspGetPreviousProcessThread
PspInheritSyscallProvider
PspInsertProcess
PspInsertSyscallProvider
PspInsertThread
PspLookupSyscallProviderById
PspMarkServerSiloAsTerminating
PspNotifyProcessEffectiveIoLimitChanged
PspNotifyServerSiloCreation
PspNotifyServerSiloTermination
PspProcessClose
PspProcessDynamicEHContinuationTargets
PspProcessDynamicEnforcedAddressRanges
PspReferenceSystemDll
PspRemoveEnclaveThreadWait
PspRundownSingleProcess
PspSelectVsmEnclaveByNumber
PspSetJobIoRateControl
PspSetProcessAffinityUpdateMode
PspSetProcessDefaultHardErrorMode
PspSetProcessForegroundBackgroundRequest
PspSetProcessTimerDelayForWin32
PspSetQuotaLimits
PspStorageAllocSlot
PspStorageEmptyArray
PspStorageEmptyArrayNonReadonly
PspStorageFreeSlot
PspStorageGetObject
PspStorageInsertObject
PspStorageMakeSlotReadOnly
PspStorageRemoveObject
PspStorageReplaceObject
PspSyscallProviderOptIn
PspTeardownPartition
PspTerminateProcess
PspThreadDelete
PspUnlockJobAssignment
PspUnlockJobListExclusive
PspUnlockJobListShared
PspUnlockJobMemoryLimitsExclusive
PspUnlockJobMemoryLimitsShared
PspUnlockJobsAndProcessExclusive
PspUnlockProcessExclusive
PspUnlockProcessListExclusive
PspUnlockProcessListShared
PspUnlockQuotaExpansion
PspUnlockQuotaListExclusive
PspUnlockQuotaListShared
PspUpdateSingleProcessAffinity
PspWow64ReadOrWriteThreadCpuArea
RtlDeleteAtomFromAtomTable
RtlDestroyAtomTable
RtlEmptyAtomTable
RtlFindDynamicEnforcedAddressInRanges
RtlInsertDynamicFunctionTable
RtlLockBootStatusData
RtlLookupAtomInAtomTable
RtlPinAtomInAtomTable
RtlQueryAtomInAtomTable
RtlQueryAtomsInAtomTable
RtlRemoveDynamicFunctionTable
RtlUnlockBootStatusData
RtlpCSparseBitmapUnlock
RtlpFindDynamicEHContinuationTarget
RtlpFlsAlloc
RtlpFlsDataCleanup
RtlpFlsFree
RtlpFlsSetValueSlot
RtlpHpAcquireReleaseLockExclusive
RtlpHpCustomVaCallbacksRegistrarRegister
RtlpHpCustomVaCallbacksRegistrarUnregister
RtlpHpFixedVsAllocate
RtlpHpFixedVsFree
RtlpHpHeapExtendContext
RtlpHpLargeAlloc
RtlpHpLargeAllocSetExtraPresent
RtlpHpLargeAllocSize
RtlpHpLargeFree
RtlpHpLfhBucketAddSubsegment
RtlpHpLfhBucketGetSubsegment
RtlpHpLfhBucketUpdateAffinityMapping
RtlpHpLfhContextCompact
RtlpHpLfhOwnerCompact
RtlpHpLfhSlotAllocate
RtlpHpLfhSubsegmentCreate
RtlpHpLfhSubsegmentDecommitPages
RtlpHpLfhSubsegmentFreeBlock
RtlpHpLfhSubsegmentIncBlockCounts
RtlpHpReleaseQueuedLockExclusive
RtlpHpSegContextCompact
RtlpHpSegMgrCommitComplete
RtlpHpSegMgrCommitInitiate
RtlpHpSegMgrVaCtxAlloc
RtlpHpSegMgrVaCtxFree
RtlpHpSegMgrVaCtxInsert
RtlpHpSegPageRangeAllocate
RtlpHpSegPageRangeCoalesce
RtlpHpSegPageRangeShrink
RtlpHpVaMgrAlloc
RtlpHpVaMgrCtxFree
RtlpHpVsChunkSplit
RtlpHpVsSubsegmentCommitPages
RtlpLookupDynamicUserFunctionTable
RtlpSetSecurityObject
RtlpUnlockAtomTable
SLGetSubscriptionPfn
SLGetSubscriptionPfn$fin$0
SLGetSubscriptionPfn$fin$1
SLQueryLicenseValueInternal
SLUpdateLicenseDataInternal
SLUpdateLicenseDataInternal$fin$0
SLUpdateLicenseDataInternal$fin$1
SMKM_STORE<SM_TRAITS>::SmStCleanup
SMKM_STORE<SM_TRAITS>::SmStSwapStore
SMKM_STORE<SM_TRAITS>::SmStWorker
SMKM_STORE<struct_SM_TRAITS>::SmStDirectReadIssue
SMKM_STORE<struct_SM_TRAITS>::SmStHelperSendCommand
SMKM_STORE<struct_SM_TRAITS>::SmStMapVirtualRegion
SMKM_STORE<struct_SM_TRAITS>::SmStOutSwapStore
SMKM_STORE<struct_SM_TRAITS>::SmStPrioritizeRegionsStore
SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStore
SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStoreBatch
SMKM_STORE<struct_SM_TRAITS>::SmStUnmapVirtualRegion
SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEmpty
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeReadInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys
SSHSupportReleasePushLockExclusive
ST_STORE<struct_SM_TRAITS>::StDmHandleDecompressionFailure
ST_STORE<struct_SM_TRAITS>::StDmPageRemove
ST_STORE<struct_SM_TRAITS>::StDmSinglePageCopy
ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd
SeCaptureSubjectContextEx
SeComputeAutoInheritByObjectTypeEx
SeDefaultObjectMethod
SeRegisterObjectTypeMandatoryPolicy
SendCaptureStateNotificationsWorker
SepAddLuidToIndexEntry
SepAppendAceToTokenObjectAcl
SepDeReferenceSharedSidEntries
SepDeleteSessionLowboxEntries
SepDereferenceCachedHandlesEntry
SepDereferenceLowBoxNumberEntry
SepInsertOrReferenceSharedSidEntries
SepIsParentOfChildAppContainer
SepIsValidProcUniqueLuid
SepRmCapUpdateWrkr
SepRmReferenceFindCap
SepSetTokenCachedHandles
SepSetTokenClaims
SepSetTokenLowboxNumber
SepSetTokenUserAndGroups
SmCreatePartition
SmDeletePartition
SmEtwEnableCallback
SmFirstTimeInit
SmGetRegistrationInfo
SmKmKeyGenGenerate
SmKmKeyGenKeyDelete
SmKmKeyGenNewKey
SmKmStoreAdd
SmKmStoreDelete
SmKmVirtualLockContextIncreaseWsMin
SmKmVirtualLockCtxLockMemory
SmKmVirtualLockCtxMemoryUnlocked
SmPartitionJobPaired
SmProcessCompressionInfoRequest
SmcCacheAdd
SmcCacheCreatePrepare
SmcCacheRemove
SmcGetCacheStats
SmcStoreDelete
SmcStoreResize
SmcStoreSlotAbort
SmcStoreSlotCommit
SmcStoreSlotReserve
SmpKeyedStoreEntryGet
SmpKeyedStoreReference
SmpKeyedStoreSetVaRanges
SmpSystemStoreCreate
SshpSetCollectionActive
TlgAggregateInternalProviderCallback
TlgRegisterAggregateProviderEx
UNLOCK_ADDRESS_SPACE_SHARED
UNLOCK_ADDRESS_SPACE_SHARED_UNORDERED
UNLOCK_ADDRESS_SPACE_UNORDERED
UNLOCK_HIVE_LOAD
UNLOCK_PAGE_TABLE_COMMITMENT
VmCreateMemoryRange
VmDeleteMemoryRange
VmMergeMemoryRanges
VmPinMemoryRange
VmSplitMemoryRange
VmUnpinMemoryRange
VmpCleanProcessAddressSpace
VmpPauseResumeNotify
VrpDecrementSiloCount
VrpDereferenceDiffHiveEntry
VrpFindDiffHiveEntryForMountPoint
VrpFindOrCreateDiffHiveEntryForMountPoint
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlInitializeJobForVreg
VrpHandleIoctlLoadDifferencingHive
VrpHandleIoctlLoadDifferencingHiveForHost
VrpHandleIoctlModifyFlags
VrpHandleIoctlUnloadDifferencingHiveForHost
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpIncrementSiloCount
VrpLoadDifferencingHive
VrpPostEnumerateKey
VrpPostUnloadKey
VrpPreLoadKey
VrpPreUnloadKey
VrpRelinquishDiffHiveEntryTransitionOwner
VrpTranslatePath
VrpUnloadDifferencingHive
VrpWaitForDiffHiveEntryTransitionOwnerToLeave
VslpLockPagesForTransfer
VslpUnlockPagesForTransfer
WbAddHeapExecutedBlockToCache
WbAddHeapExecutedBlockToLRU
WbAddWarbirdEncryptionSegment
WbAllocateSlots
WbAllocateUserMemory
WbDecryptEncryptionSegment
WbFreeMemoryBlockRegion
WbGetHeapExecutedBlock
WbGetInitializedEncryptionSegment
WbGetWarbirdEncryptionSegment
WbGetWarbirdProcess
WbGetWarbirdThread
WbHeapExecutionUnloadModule
WbInPlaceEncryptionUnloadModule
WbMoveHeapExecutedBlockToBackOfLRU
WbReEncryptEncryptionSegment
WbReleaseLeastRecentlyUsedHeapExecutedBlocks
WbRemoveWarbirdProcess
WheaConfigureErrorSource
WheaExecuteRowFailureCheck
WheaInitialize
WheaRegisterErrorSourceOverride
WheaRegisterInUsePageOfflineNotification
WheaSelLogCheckPoint
WheaSelLogSetNtSchedulerAvailability
WheaUnconfigureErrorSource
WheaUnregisterErrorSourceOverride
WheaUnregisterInUsePageOfflineNotification
WheapCallInUsePageNotificationCallbacks
WheapPfaReset
WheapPredictiveFailureAnalysis
Expand for full list:
AlpcAddHandleTableEntry
AlpcConnectionDestroyProcedure
AlpcDeleteBlobByHandle
AlpcReferenceBlobByHandle
AlpcRegisterLogRoutine
AlpcUnregisterLogRoutine
AlpcViewDestroyProcedure
AlpcpAcceptConnectPort
AlpcpAssociateIoCompletionPort
AlpcpCancelMessage
AlpcpCancelMessagesByRequestorAlpcpCleanupProcessViews
AlpcpCompleteDispatchMessage
AlpcpCreateClientPort
AlpcpCreateReserve
AlpcpCreateSection
AlpcpCreateSectionView
AlpcpCreateSecurityContext
AlpcpCreateView
AlpcpDeleteBlob
AlpcpDeletePort
AlpcpDestroyBlob
AlpcpDestroyPort
AlpcpDisconnectPort
AlpcpDispatchCloseMessage
AlpcpDispatchConnectionRequest
AlpcpDispatchNewMessage
AlpcpDispatchReplyToPort
AlpcpDispatchReplyToWaitingThread
AlpcpDoPortCleanup
AlpcpEndInitialization
AlpcpEnterAllocationEventMessageLog
AlpcpEnterFreeEventMessageLog
AlpcpEnterStateChangeEventMessageLog
AlpcpEnumerateResourcesPort
AlpcpFlushCancelQueue
AlpcpFlushMessagesByRequestor
AlpcpFlushMessagesPort
AlpcpFlushQueue
AlpcpFlushResourcesPort
AlpcpImpersonateMessage
AlpcpInitializeCompletionList
AlpcpInitializePort
AlpcpInsertCompletionListEntry
AlpcpInsertMessageCanceledQueue
AlpcpInsertMessageDirectQueue
AlpcpInsertMessageLargeMessageQueue
AlpcpInsertMessageMainQueue
AlpcpInsertMessagePendingQueue
AlpcpInsertResourcePort
AlpcpInvokeLogCallbacks
AlpcpLocateSectionView
AlpcpMapLegacyPortRemoteView
AlpcpPortQueryConnectedSidInfo
AlpcpPortQueryServerInfo
AlpcpPortQueryServerSessionInfo
AlpcpProcessSynchronousRequest
AlpcpQueryRemoteView
AlpcpQueueIoCompletionPort
AlpcpReceiveDirectMessagePort
AlpcpReceiveLegacyMessage
AlpcpReceiveMessagePort
AlpcpReceiveSynchronousReply
AlpcpReferenceAndLockTargetPortsAndCommunicationInfo
AlpcpReferenceConnectedPort
AlpcpReferenceMessageByWaitingThread
AlpcpReferenceMessageByWaitingThreadPort
AlpcpRegisterCompletionListDatabase
AlpcpRemoveMessageFromPendingQueue
AlpcpRemoveResourcePort
AlpcpReplyLegacySynchronousRequest
AlpcpReturnMessageOnInsufficientBuffer
AlpcpSendLegacySynchronousRequest
AlpcpSendMessage
AlpcpSignal
AlpcpSignalPortAndUnlock
AlpcpTrackPortReferences
AlpcpUnlockAndDereferenceTargetPortsAndCommunicationInfo
AlpcpUnlockBlob
AlpcpUnregisterCompletionListDatabase
AlpcpWaitForPortReferences
AlpcpWalkConnectionList
BgkpLockBgfxCodeSection
BgkpUnlockBgfxCodeSection
CcAmILowPriorityWriter
CcApplyLowIoPriorityToThread
CcBoostLowPriorityWorkerThread
CcChangeBackingFileObject
CcPinFileData
CcSetDirtyInMask
CcSetDirtyPinnedData
CcSlowReferenceSharedCacheMapFileObject
CcUnpinFileDataEx
CmDeleteKey
CmDeleteValueKey
CmEnumerateKey
CmFcManagerDrainAllFeatureUsageNotifications
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerQueryFeatureConfigurationSectionInformation
CmFcManagerRegisterFeatureConfigurationChangeNotification
CmFcManagerUnregisterFeatureConfigurationChangeNotification
CmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpManagerDrainUsageNotificationsWorker
CmFcpManagerPublishChangeNotifications
CmFcpManagerRetryUsageNotificationsWorker
CmFcpManagerSoftwareHiveReady
CmFreezeRegistry
CmKeyBodyRemapToVirtualForEnum
CmLockKeyForWrite
CmQueryMultipleValueKey
CmRegisterMachineHiveLoadedNotification
CmRestoreKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmSiRWLockReleaseExclusive
CmThawRegistry
CmUnlockHive
CmUnlockHiveSecurity
CmUnregisterMachineHiveLoadedNotification
CmpAssignKeySecurity
CmpCallCallBacksEx
CmpCloseKeyObject
CmpCreateChild
CmpCreateHive
CmpCreateHiveRootCell
CmpCreateKeyControlBlock
CmpDeleteHive
CmpDeleteKeyObject
CmpDereferenceNameControlBlockWithLock
CmpDoParseKey
CmpDoQueueLateUnloadWorker
CmpDumpKeyToBuffer
CmpFinishSystemHivesLoad
CmpFlushHive
CmpFlushNotify
CmpGetKeyNodeForKcb
CmpGetLastHive
CmpGetNameControlBlock
CmpGetNextActiveHive
CmpGetNextHive
CmpInitCmRM
CmpLoadHiveThread
CmpLoadHiveVolatile
CmpLockRegistryFreezeAware
CmpMarkEntireIndexDirty
CmpNotifyMachineHiveLoaded
CmpPerformCompleteKcbCacheLookup
CmpPromoteKey
CmpRecoverFlushProtocolStateFromFiles
CmpRefreshHive
CmpReorganizeHive
CmpReportNotifyHelper
CmpSetKeySecurity
CmpStartSiloKeyLockTracker
CmpStopSiloKeyLockTracker
CmpTransMgrCommitUoW
CmpTransMgrPrepare
CmpTransMgrSyncHive
CmpTrimHive
CmpUnlockAppHiveLoadList
CmpUnlockCallbackList
CmpUnlockContextList
CmpUnlockDeletedHashEntryByKcb
CmpUnlockGlobalKeyLockTracker
CmpUnlockHashEntry
CmpUnlockHashEntryByIndex
CmpUnlockHashEntryByKcb
CmpUnlockHiveList
CmpUnlockKcb
CmpUnlockNameHashEntry
CmpUpdateHiveRootCellFlags
CmpVEExecuteOpenLogic
CmpVolumeContextDecrementRefCount
CmpVolumeContextMustHiveFilePagesBeKeptLocal
CmpVolumeContextSendDeviceUsageNotification
CmpVolumeManagerGetContextForFile
CmpWakeWriteQueueWaiters
CmpWalkOneLevel
DbgkFlushErrorPort
DbgkRegisterErrorPort
DbgkpRemoveErrorPort
DbgkpSendErrorMessage
EmClientQueryRuleState
EmClientRuleDeregisterNotification
EmClientRuleEvaluate
EmPowerPagingEnabled
EmProviderDeregister
EmProviderDeregisterEntry
EmProviderRegisterEntry
EmpAcquirePagingReference
EmpClientRuleRegisterNotification
EmpParseInfDatabase
EmpProviderRegister
EmpQueueRuleUpdateState
EmpReleasePagingReference
EmpRuleUpdateWorkerThread
EtwCleanupSiloState
EtwQueryProcessTelemetryCoverage
EtwpAcquireTokenAccessInformation
EtwpAddBinaryInfoEvents
EtwpAddDebugInfoEvents
EtwpAddGuidEntry
EtwpAddRegEntryToGroup
EtwpBufferingModeCompressionFlush
EtwpCompressPendingBuffers
EtwpCompressionProc
EtwpCovSampContextAddSamples
EtwpCovSampContextCleanup
EtwpCovSampContextGetModule
EtwpCovSampContextPruneModules
EtwpCovSampHashMakeRoomAndAcquireLock
EtwpCovSampProcessAddModule
EtwpCovSampProcessMapAddresses
EtwpCoverageCheckCP
EtwpCoverageEnsureContext
EtwpCoverageEnsureUserModeView
EtwpCoverageFlushWorkItemCallback
EtwpCoverageProvEnableCallback
EtwpCoverageRecord
EtwpCoverageReset
EtwpCoverageResetCP
EtwpCoverageSamplerClose
EtwpCoverageSamplerQuery
EtwpCoverageSamplerSetBloomFilter
EtwpCoverageSamplerStart
EtwpCoverageSamplerStop
EtwpCoverageSamplerUnloadImage
EtwpCreateLogFile
EtwpCreateUmReplyObject
EtwpDeleteRegistrationObject
EtwpDisableCompression
EtwpFindGuidEntryByGuid
EtwpFlushCoverage
EtwpFreeCompression
EtwpGetCompressionSettings
EtwpGetDisallowList
EtwpGetLoggerInfoFromContext
EtwpGetNextGuidEntry
EtwpIsGuidAllowed
EtwpRealtimeNotifyConsumers
EtwpReferenceLoggerSecurityDescriptor
EtwpSendDbgId
EtwpSetCompressionSettings
EtwpTrackBinaryForSession
EtwpTrackDebugIdForSession
EtwpTrackDecodeGuidForSession
EtwpUnreferenceGuidEntry
EtwpUpdateDisallowedGuids
EtwpUpdatePeriodicCaptureState
EtwpUpdateSelectedGroupMasks
ExCreateHandleTable
ExDisableHandleTracing
ExDupHandleTable
ExEnableHandleExceptions
ExEnableHandleTracing
ExEnableRaiseUMExceptionOnInvalidHandleClose
ExFetchLicenseData
ExFetchLicenseData$fin$0
ExGetLicenseTamperState
ExGetWakeTimerList
ExInitLicenseData
ExInitializeDeviceAts
ExNotifyPlatformBinaryExecuted
ExQueryHandleExceptionsPermanency
ExReferenceHandleDebugInfo
ExRegisterExtension
ExRegisterHost
ExReleaseAutoExpandPushLockShared
ExReleaseCacheAwarePushLockExclusive
ExReleaseCacheAwarePushLockExclusiveEx
ExReleaseFastMutex
ExReleaseFastMutexUnsafe
ExReleasePushLockEx
ExReleasePushLockExclusiveEx
ExReleasePushLockSharedEx
ExSetLicenseTamperState
ExSvmBeginDeviceReset
ExSvmFinalizeDeviceReset
ExSweepHandleTable
ExUninitializeDeviceAts
ExUnregisterExtension
ExUuidCreate
ExfAcquireReleasePushLockExclusive
ExpAllocateHandleTableEntry
ExpDeleteTimer
ExpFreeHandleTableEntry
ExpGetGlobalLocaleSection
ExpGetKernelDataProtection$fin$0
ExpGetProcessInformation
ExpGetSystemPlatformBinary
ExpInsertLowLevelTableIntoFreeList
ExpKdPullRemoteFileForUser
ExpLoadAndSortLicensingCacheDescriptors
ExpLoadAndSortLicensingCacheDescriptors$fin$0
ExpLoadAndSortLicensingCacheDescriptors$fin$1
ExpNtUpdateWnfStateData
ExpPutLicenseDataIntoRegistry$fin$0
ExpQueryBootLoaderMetadata
ExpQueryLicenseValueFromBlobHelper$fin$0
ExpReadLeapSecondData
ExpRemoveHandleTable
ExpSaAllocatorAllocate
ExpSaAllocatorFree
ExpSaPageGroupAllocateMemory
ExpSaPageGroupDescriptorAllocate
ExpSaPageGroupDescriptorFree
ExpSaPageGroupFreeMemory
ExpSetBootLoaderMetadata
ExpSetKernelDataProtection$fin$0
ExpSetTimerObject
ExpShareAddressSpaceWithDevice
ExpSnapShotHandleTables
ExpSvmDereferenceDevice
ExpWnfAcquirePermanentDataStoreHandle
ExpWnfAcquireSubscriptionByName
ExpWnfAcquireSubscriptionNameInstance
ExpWnfAllocateNextPersistentNameSequence
ExpWnfCompleteThreadSubscriptions
ExpWnfCreateNameInstance
ExpWnfCreateProcessContext
ExpWnfDeleteNameInstance
ExpWnfDeletePermanentStateData
ExpWnfDeleteProcessContext
ExpWnfDeleteScopeById
ExpWnfDeleteScopeInstances
ExpWnfDeleteStateData
ExpWnfDeleteSubscription
ExpWnfDeliverThreadNotifications
ExpWnfDestroyPermanentDataStore
ExpWnfDispatchKernelSubscription
ExpWnfEnumerateScopeInstances
ExpWnfGetPermanentDataStore
ExpWnfInsertSubscriptionInPendingQueue
ExpWnfInvalidateDataStores
ExpWnfLookupNameInstance
ExpWnfNotifyNameSubscribers
ExpWnfNotifySubscription
ExpWnfPopulateStateData
ExpWnfReadStateData
ExpWnfReadStateData$fin$0
ExpWnfResolveScopeInstance
ExpWnfSubscribeNameInstance
ExpWnfUpdateSubscription
ExpWnfWriteStateData
ExpWnfWriteStateData$fin$0
ExpWorkerInitialization
FUN_14036f754
FUN_140708238
FUN_1409fa0b0
FUN_1409fa70c
FlushLookUpTableBucket
FsRtlAcquireEofLock
FsRtlCheckOplockEx2
FsRtlInsertPerStreamContext
FsRtlLookupPerFileObjectContext
FsRtlLookupPerStreamContextInternal
FsRtlReleaseEofLock
FsRtlReleaseHeaderMutex
HalpDmaAllocateChildAdapterV3
HalpIommuBlockDevice
HalpIommuCreateDevice
HalpIommuDeleteDevice
HalpIommuInvokeInterfaceStateChangeCallbacks
HalpIommuUnblockDevice
HalpLeaveDmaDomain
HvFoldBackDirtyData
HvFreeCell
HvHiveConvertLockedPagesToCowByPolicy
HvIsRangeDirty
HvUnlockHiveFlusherShared
HvlQuerySetBootPagesInfo
HvpDoAllocateCell
HvpMarkCellDirty
InsertEventEntryInLookUpTable
IoRegisterIoTracking
IoUnregisterIoTracking
IommuBeginDeviceReset
IommuDeviceDelete
IommuFinalizeDeviceReset
IommuProcessPageRequestQueue
IommuRegisterInterfaceStateChangeCallback
IommuUnregisterInterfaceStateChangeCallback
IommupDeviceDisableSvm
IommupDeviceGetPasidDevice
IommupFreeSystemContext
IommupGetSystemContext
IommupHvAttachPasidDevice
IommupHvAttachPasidDeviceDomain
IommupHvCreateSvmPasidSpace
IommupHvDetachPasidDeviceDomain
IommupPasidDeviceCreate
IommupPasidDeviceDelete
IopProcessIoTracking
IopReleaseFileObjectLock
KeCleanupImageTracepoints
KeDeleteMutant
KeGenericCallDpcEx
KeQueryDpcWatchdogConfiguration
KeReleaseGuardedMutex
KeReleaseMutant
KeSetSystemServiceCallback
KeSetTracepoint
KeUpdateDpcWatchdogConfiguration
KiGenericCallDpcInitiatorWorker
KiRundownMutants
KiShouldLogUserModeReturnMismatch
KiStartSavingSupervisorState
KiTpIsExcludedKernelTracepointLocation
KseAddHardwareId
KseDriverUnloadImage
KseLookupHardwareId
KseQueryDeviceDataList
KseRegisterShimEx
KseResetDeviceCache
KseShimDatabaseBootRelease
KseShimDatabaseClose
KseShimDatabaseOpen
KseUnregisterShim
KsepDbCacheInsertDevice
KsepDbCacheQueryDevice
KsepGetShimsForDriver
KsepIsModuleShimmed
KsepResolveApplicableShimsForDriver
KsepShimDbChanged
MI_UNLOCK_RELOCATIONS_EXCLUSIVE
MiAddPartitionHugeRange
MiAddSpecialPurposeMemoryCleanup
MiAddSpecialPurposeMemoryComplete
MiAddSpecialPurposeMemoryPrepare
MiAddViewsForSection
MiAllocatePartitionId
MiApplyImageHotPatchRequest
MiCaptureRetpolineImportInfo
MiChargeSegmentCommit
MiCoalesceFreeLargePages
MiCoalesceFreePages
MiCoalescePlaceholderAllocations
MiCommitExistingVad
MiCommitPageTableRangesForVad
MiContractWsSwapPageFileWorker
MiCopyLargeVad
MiCreateFileOnlyImageFixupList
MiCreateHardwareEnclave
MiCreatePagingFile
MiCreatePagingFileMap
MiCreatePerSessionProtos
MiCreatePrototypePtes
MiDecommitHardwareEnclavePages
MiDeleteAllHardwareEnclaves
MiDeleteEmptyPageTables
MiDeleteEnclavePages
MiDeleteExtentPfns
MiDeleteHotPatchEntry
MiDeleteHotPatchRecord
MiDeletePartitionResources
MiDeleteVad
MiDereferenceExtendInfo
MiDereferencePerSessionProtos
MiFindHotPatchRecord
MiFindProcessImageHotPatchRecord
MiFindSpecialPurposeMemoryTypeByPartition
MiFinishCreateSection
MiFinishResume
MiFinishVadDeletion
MiFreeInPageSupportBlock
MiFreePartitionId
MiFreeRetpolineImportInfo
MiFreeSessionId
MiFreeUnusedPfnPages
MiGetAllRegisteredPatches
MiGetChannelInformation
MiGetNewSessionId
MiGetPartitionNodeInformation
MiGetSpecialPurposeMemoryPartitionForCaching
MiInitializeMirroring
MiInitializePagedPoolEvents
MiInitializePartialVad
MiInitializePartition
MiInitializePartitionSpecialPurposeMemory
MiInitializeSessionGlobals
MiInsertChildVads
MiInsertHotPatchRecord
MiInsertInSystemSpace
MiInsertPageFileInList
MiInsertSharedCommitNode
MiInsertVad
MiIsExtentDangling
MiIsRangeFullyCommitted
MiLateInitializeSystemCache
MiLoadHotPatchForUserSid
MiLocateSharedPageViews
MiLockVadRange
MiLogHotPatchRundown
MiMakeDriverPagesPrivate
MiManageSubsectionView
MiMapViewOfDataSection
MiMarkHugePfnBad
MiMarkSharedImageCfgBits
MiObtainRelocationBits
MiOpenSpecialPurposeMemory
MiPerformVadSplitting
MiPersistMdl
MiPopulateCfgBitMap
MiProcessTransitionHeatBatch
MiQueryLoadedPatches
MiQueryProcessActivePatches
MiQuerySpecialPurposeMemoryInformation
MiRebuildLargePages
MiReferenceRemovePartition
MiReleaseImageSection
MiReleaseKernelCfgLock
MiRelocateImagePfn
MiRemoveBadPages
MiRemoveFromSystemSpace
MiRemoveSharedCommitNode
MiRemoveVad
MiReserveUserMemory
MiReturnImageBase
MiSectionCreated
MiSectionDelete
MiSelectOverflowDllBase
MiSelectRelocationStartHint
MiSendParkedCoreUpdateToAllChildPartitions
MiSetPagesModified
MiSetProtectionOnSection
MiSetVadDeleted
MiShutdownSystem
MiSpecialPurposeMemoryRemoved
MiSplitPrivatePage
MiSplitReducedCommitClonePage
MiSubsectionProtosCreated
MiTransferFileExtent
MiTrimSharedPageFromViews
MiTrimUnusedPageFileRegionsWorker
MiUnloadHotPatchForUserSid
MiUnlockAndDereferenceVad
MiUnlockAndDereferenceVadShared
MiUnlockControlAreaFileObjectShared
MiUnlockControlAreaSectionExtend
MiUnlockDriverMappings
MiUnlockDynamicMemoryExclusive
MiUnlockDynamicMemoryNestedExclusive
MiUnlockDynamicMemoryShared
MiUnlockFileExtentsExclusive
MiUnlockLoaderEntry
MiUnlockNestedVad
MiUnlockPartitionSystemThreads
MiUnlockVad
MiUnlockVadRange
MiUnlockVadShared
MiUpControlAreaRefs
MiUpdateImagePfnImportRelocations
MiUpdateSpecialPurposeMemoryCacheEligibility
MiWalkEntireImage
MiZeroAllPageFiles
MiZeroPage
MiZeroPageMakeHot
MiZeroSectionObjectPointer
MmCheckProcessShadow
MmCommitSessionMappedView
MmCreateShadowMapping
MmDecodeExportSection
MmDeleteShadowMapping
MmDuplicateMemory
MmEncodeExportSection
MmEnumerateBadPages
MmExtendSection
MmGetPageFileForCrashDump
MmLinkJobProcess
MmMarkPhysicalMemoryAsBad
MmOutSwapVirtualAddresses
MmOutSwapWorkingSet
MmReleaseLoadLock
MmResourcesAvailable
MmSetPfnListInfo
NormalizationList__Unlock
NtAllocateUuids
NtAlpcDeleteSectionView
NtAlpcOpenSenderProcess
NtAlpcRevokeSecurityContext
NtAlpcSetInformation
NtAreMappedFilesTheSame
NtCancelTimer
NtChangeProcessState
NtChangeThreadState
NtCreateUserProcess
NtDeleteKey
NtDuplicateToken
NtNotifyChangeMultipleKeys
NtOpenProcessTokenEx
NtOpenThreadTokenEx
NtQueryInformationProcess
NtQueryInformationThread
NtQueryInformationThread$fin$3
NtQueryObject
NtReleaseKeyedEvent
NtSetInformationThread
NtSetInformationThread$fin$1
NtSetSystemInformation
NtSetUuidSeed
NtTerminateProcess
NtWaitForKeyedEvent
ObCheckRefTraceProcess
ObClearProcessDeviceMap
ObDereferenceDeviceMap
ObDereferenceSecurityDescriptor
ObDisableEtwReferenceTrace
ObDuplicateObject
ObEnableEtwReferenceTrace
ObInsertObjectEx
ObIsDosDeviceLocallyMapped
ObLogSecurityDescriptor
ObOpenObjectByNameEx
ObQueryDeviceMapInformation
ObQueryNameStringMode
ObQueryRefTraceInformation
ObReleaseObjectSecurity
ObpCloseHandle
ObpCreateHandle
ObpCreateSymbolicLinkName
ObpDeleteSymbolicLinkName
ObpDeregisterObject
ObpFreeWorkItemBlock
ObpGetShadowDirectory
ObpLockChildDirectory
ObpLockUnrelatedDirectoryShared
ObpLookupObjectName
ObpPushRefDerefInfo
ObpReferenceSecurityDescriptorSlow
ObpRegisterObject
ObpSetCurrentProcessDeviceMap
ObpSetDeviceMap
ObpSlowReferenceDeviceMap
ObpStartRuntimeStackTrace
ObpStopRuntimeStackTrace
Ordinal_20
Ordinal_21
PdcTaskClientRequest
PerfDiagpProxyWorker
PfCheckDeprioritizeFile
PfCheckDeprioritizeImage
PfFileInfoNotify
PfGenerateTrace
PfProcessExitNotification
PfQuerySuperfetchInformation
PfSetSuperfetchInformation
PfSnBeginAppLaunch
PfSnGetPrefetchInstructions
PfSnIsHostingApplication
PfSnQueryPrefetcherInformation
PfSnSetAltPrefetchParam
PfTAccessTracingCleanup
PfTAccessTracingStart
PfTSetTraceWorkerPriority
PfTSetTracingPriority
PfpParametersPropagate
PfpParametersWatcher
PfpPrefetchSharedCleanup
PfpPrefetchSharedStart
PfpRpCHashAddEntries
PfpRpCHashDeleteEntries
PfpRpCHashEmpty
PfpRpCHashGrow
PfpRpFileKeyUpdate
PfpRpShutdown
PfpScenCtxPrefetchAbortSet
PfpScenCtxPrefetchStateSet
PfpScenCtxPrefetchWait
PfpScenCtxQueryScenarioInformation
PfpScenCtxScenarioSet
PfpScenCtxServiceThreadSet
PoFxAbandonDevice
PoFxPrepareDevice
PoFxStartDevicePowerManagement
PoFxSystemLatencyNotify
PopBlackBoxDirectAccess
PopBlackBoxUpdate
PopBootStatCheckIntegrity
PopBootStatGet
PopBootStatRestoreDefaults
PopBootStatSet
PopBootStatUnlock
PopDiagTraceFxRundown
PopDirectedDripsDiagBroadcastTreeBegin
PopDirectedDripsDiagBroadcastTreeEnd
PopDirectedDripsDiagNotifySessionStart
PopDirectedDripsDiagNotifySessionStop
PopDirectedDripsDiagTraceBroadcastFailureDevice
PopDirectedDripsDiagTraceBroadcastVisit
PopDirectedDripsDiagTraceMarkDevice
PopDirectedDripsDiagTraceNotifyDevices
PopDirectedDripsDiagTraceProblemDevice
PopDirectedDripsHandleResiliencyNotification
PopDirectedDripsIdleResiliencyCallback
PopDirectedDripsNotify
PopDirectedDripsNotifyResiliencyCompletionWorker
PopFxAcpiPrepareDevice
PopFxActivateDevicesForSx
PopFxBuildDirectedDripsCandidateDeviceList
PopFxBuildDripsBlockingDeviceList
PopFxClearDirectedDripsCandidateDeviceList
PopFxDisableBasicAccountingWorker
PopFxFindAcpiDeviceByUniqueId
PopFxFindAndReferenceAcpiDevice
PopFxIdleDevicesFromSx
PopFxInsertAcpiDevice
PopFxInsertDevice
PopFxLowPowerEpochCallback
PopFxNotifySxTransitionState
PopFxPauseDeviceAccounting
PopFxPrepareDevicesForShutdown
PopFxRegisterDeviceWithPep
PopFxRegisterPluginEx
PopFxRemoveAcpiDevice
PopFxRemoveDevice
PopFxResidentTimeoutRoutine
PopFxResumeDeviceAccounting
PopFxStartDeviceAccounting
PopFxStopDeviceAccounting
PopFxUpdateVetoMaskWork
PopPdcCsDeviceNotification
PopPepIdleTimeoutRoutine
PopPepInsertDevice
PopPepIterateDeviceList
PopPepPlatformStateRegistered
PopPepRemoveDevice
PopPepWork
PopPowerButtonBugcheckConfigure
PopQueryPowerButtonBugcheckEnabled
PsAdjustBasicEnclaveThreadList
PsCallEnclave
PsCaptureExceptionPort
PsCreateVsmEnclave
PsDeleteVsmEnclave
PsDisableImpersonation
PsFreezeProcess
PsGetNextProcess
PsGetNextProcessThread
PsGetProcessDeepFreezeStats
PsGetProcessEnclaveModuleInfo
PsImpersonateClient
PsInitializeVsmEnclave
PsIsVsmEnclaveTerminated
PsLoadVsmEnclaveData
PsQueryProcessEnergyValues
PsQueryRuntimeProcess
PsQueryStatisticsProcess
PsQueryTotalCycleTimeProcess
PsReferenceImpersonationToken
PsReferenceImpersonationTokenEx
PsReferencePartitionSystemProcess
PsReferencePrimaryTokenWithTag
PsRestoreImpersonation
PsSetProcessFaultInformation
PsSetProcessTelemetryAppState
PsSetProcessWin32Process
PsStartSiloMonitor
PsSwapImpersonationToken
PsSwapProcessWorkingSet
PsTerminateMinimalProcess
PsTerminateVsmEnclave
PsThawMultiProcess
PsUnregisterSiloMonitor
PsUpdateActiveProcessAffinity
PspAllocateAndQueryProcessNotificationChannel
PspAllocateThread
PspApplyCoreIsolationPolicy
PspApplyWorkingSetLimits
PspApplyWorkingSetLimitsToProcess
PspAssignPrimaryToken
PspAssignProcessToJob
PspAttachProcessToSyscallProvider
PspChangeJobMemoryUsageByProcess
PspChargeProcessWakeCounter
PspCreatePicoProcess
PspDestroySyscallProvider
PspDetachProcessFromSyscallProvider
PspEnableProcessOptionalXStateFeatures
PspExitThread
PspGetNextSyscallProviderProcess
PspGetPreviousProcessThread
PspInheritSyscallProvider
PspInsertProcess
PspInsertSyscallProvider
PspInsertThread
PspLookupSyscallProviderById
PspMarkServerSiloAsTerminating
PspNotifyProcessEffectiveIoLimitChanged
PspNotifyServerSiloCreation
PspNotifyServerSiloTermination
PspProcessClose
PspProcessDynamicEHContinuationTargets
PspProcessDynamicEnforcedAddressRanges
PspReferenceSystemDll
PspRemoveEnclaveThreadWait
PspRundownSingleProcess
PspSelectVsmEnclaveByNumber
PspSetJobIoRateControl
PspSetProcessAffinityUpdateMode
PspSetProcessDefaultHardErrorMode
PspSetProcessForegroundBackgroundRequest
PspSetProcessTimerDelayForWin32
PspSetQuotaLimits
PspStorageAllocSlot
PspStorageEmptyArray
PspStorageEmptyArrayNonReadonly
PspStorageFreeSlot
PspStorageGetObject
PspStorageInsertObject
PspStorageMakeSlotReadOnly
PspStorageRemoveObject
PspStorageReplaceObject
PspSyscallProviderOptIn
PspTeardownPartition
PspTerminateProcess
PspThreadDelete
PspUnlockJobAssignment
PspUnlockJobListExclusive
PspUnlockJobListShared
PspUnlockJobMemoryLimitsExclusive
PspUnlockJobMemoryLimitsShared
PspUnlockJobsAndProcessExclusive
PspUnlockProcessExclusive
PspUnlockProcessListExclusive
PspUnlockProcessListShared
PspUnlockQuotaExpansion
PspUnlockQuotaListExclusive
PspUnlockQuotaListShared
PspUpdateSingleProcessAffinity
PspWow64ReadOrWriteThreadCpuArea
RtlDeleteAtomFromAtomTable
RtlDestroyAtomTable
RtlEmptyAtomTable
RtlFindDynamicEnforcedAddressInRanges
RtlInsertDynamicFunctionTable
RtlLockBootStatusData
RtlLookupAtomInAtomTable
RtlPinAtomInAtomTable
RtlQueryAtomInAtomTable
RtlQueryAtomsInAtomTable
RtlRemoveDynamicFunctionTable
RtlUnlockBootStatusData
RtlpCSparseBitmapUnlock
RtlpFindDynamicEHContinuationTarget
RtlpFlsAlloc
RtlpFlsDataCleanup
RtlpFlsFree
RtlpFlsSetValueSlot
RtlpHpAcquireReleaseLockExclusive
RtlpHpCustomVaCallbacksRegistrarRegister
RtlpHpCustomVaCallbacksRegistrarUnregister
RtlpHpFixedVsAllocate
RtlpHpFixedVsFree
RtlpHpHeapExtendContext
RtlpHpLargeAlloc
RtlpHpLargeAllocSetExtraPresent
RtlpHpLargeAllocSize
RtlpHpLargeFree
RtlpHpLfhBucketAddSubsegment
RtlpHpLfhBucketGetSubsegment
RtlpHpLfhBucketUpdateAffinityMapping
RtlpHpLfhContextCompact
RtlpHpLfhOwnerCompact
RtlpHpLfhSlotAllocate
RtlpHpLfhSubsegmentCreate
RtlpHpLfhSubsegmentDecommitPages
RtlpHpLfhSubsegmentFreeBlock
RtlpHpLfhSubsegmentIncBlockCounts
RtlpHpReleaseQueuedLockExclusive
RtlpHpSegContextCompact
RtlpHpSegMgrCommitComplete
RtlpHpSegMgrCommitInitiate
RtlpHpSegMgrVaCtxAlloc
RtlpHpSegMgrVaCtxFree
RtlpHpSegMgrVaCtxInsert
RtlpHpSegPageRangeAllocate
RtlpHpSegPageRangeCoalesce
RtlpHpSegPageRangeShrink
RtlpHpVaMgrAlloc
RtlpHpVaMgrCtxFree
RtlpHpVsChunkSplit
RtlpHpVsSubsegmentCommitPages
RtlpLookupDynamicUserFunctionTable
RtlpSetSecurityObject
RtlpUnlockAtomTable
SLGetSubscriptionPfn
SLGetSubscriptionPfn$fin$0
SLGetSubscriptionPfn$fin$1
SLQueryLicenseValueInternal
SLUpdateLicenseDataInternal
SLUpdateLicenseDataInternal$fin$0
SLUpdateLicenseDataInternal$fin$1
SMKM_STORE<SM_TRAITS>::SmStCleanup
SMKM_STORE<SM_TRAITS>::SmStSwapStore
SMKM_STORE<SM_TRAITS>::SmStWorker
SMKM_STORE<struct_SM_TRAITS>::SmStDirectReadIssue
SMKM_STORE<struct_SM_TRAITS>::SmStHelperSendCommand
SMKM_STORE<struct_SM_TRAITS>::SmStMapVirtualRegion
SMKM_STORE<struct_SM_TRAITS>::SmStOutSwapStore
SMKM_STORE<struct_SM_TRAITS>::SmStPrioritizeRegionsStore
SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStore
SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStoreBatch
SMKM_STORE<struct_SM_TRAITS>::SmStUnmapVirtualRegion
SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEmpty
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeReadInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys
SSHSupportReleasePushLockExclusive
ST_STORE<struct_SM_TRAITS>::StDmHandleDecompressionFailure
ST_STORE<struct_SM_TRAITS>::StDmPageRemove
ST_STORE<struct_SM_TRAITS>::StDmSinglePageCopy
ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd
SeCaptureSubjectContextEx
SeComputeAutoInheritByObjectTypeEx
SeDefaultObjectMethod
SeRegisterObjectTypeMandatoryPolicy
SendCaptureStateNotificationsWorker
SepAddLuidToIndexEntry
SepAppendAceToTokenObjectAcl
SepDeReferenceSharedSidEntries
SepDeleteSessionLowboxEntries
SepDereferenceCachedHandlesEntry
SepDereferenceLowBoxNumberEntry
SepInsertOrReferenceSharedSidEntries
SepIsParentOfChildAppContainer
SepIsValidProcUniqueLuid
SepRmCapUpdateWrkr
SepRmReferenceFindCap
SepSetTokenCachedHandles
SepSetTokenClaims
SepSetTokenLowboxNumber
SepSetTokenUserAndGroups
SmCreatePartition
SmDeletePartition
SmEtwEnableCallback
SmFirstTimeInit
SmGetRegistrationInfo
SmKmKeyGenGenerate
SmKmKeyGenKeyDelete
SmKmKeyGenNewKey
SmKmStoreAdd
SmKmStoreDelete
SmKmVirtualLockContextIncreaseWsMin
SmKmVirtualLockCtxLockMemory
SmKmVirtualLockCtxMemoryUnlocked
SmPartitionJobPaired
SmProcessCompressionInfoRequest
SmcCacheAdd
SmcCacheCreatePrepare
SmcCacheRemove
SmcGetCacheStats
SmcStoreDelete
SmcStoreResize
SmcStoreSlotAbort
SmcStoreSlotCommit
SmcStoreSlotReserve
SmpKeyedStoreEntryGet
SmpKeyedStoreReference
SmpKeyedStoreSetVaRanges
SmpSystemStoreCreate
SshpSetCollectionActive
TlgAggregateInternalProviderCallback
TlgRegisterAggregateProviderEx
UNLOCK_ADDRESS_SPACE_SHARED
UNLOCK_ADDRESS_SPACE_SHARED_UNORDERED
UNLOCK_ADDRESS_SPACE_UNORDERED
UNLOCK_HIVE_LOAD
UNLOCK_PAGE_TABLE_COMMITMENT
VmCreateMemoryRange
VmDeleteMemoryRange
VmMergeMemoryRanges
VmPinMemoryRange
VmSplitMemoryRange
VmUnpinMemoryRange
VmpCleanProcessAddressSpace
VmpPauseResumeNotify
VrpDecrementSiloCount
VrpDereferenceDiffHiveEntry
VrpFindDiffHiveEntryForMountPoint
VrpFindOrCreateDiffHiveEntryForMountPoint
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlLoadDifferencingHive
VrpHandleIoctlLoadDifferencingHiveForHost
VrpHandleIoctlModifyFlags
VrpHandleIoctlUnloadDifferencingHiveForHost
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpIncrementSiloCount
VrpLoadDifferencingHive
VrpPostEnumerateKey
VrpPostUnloadKey
VrpPreLoadKey
VrpPreUnloadKey
VrpRelinquishDiffHiveEntryTransitionOwner
VrpTranslatePath
VrpUnloadDifferencingHive
VrpWaitForDiffHiveEntryTransitionOwnerToLeave
VslpLockPagesForTransfer
VslpUnlockPagesForTransfer
WbAddHeapExecutedBlockToCache
WbAddHeapExecutedBlockToLRU
WbAddWarbirdEncryptionSegment
WbAllocateSlots
WbAllocateUserMemory
WbDecryptEncryptionSegment
WbFreeMemoryBlockRegion
WbGetHeapExecutedBlock
WbGetInitializedEncryptionSegment
WbGetWarbirdEncryptionSegment
WbGetWarbirdProcess
WbGetWarbirdThread
WbHeapExecutionUnloadModule
WbInPlaceEncryptionUnloadModule
WbMoveHeapExecutedBlockToBackOfLRU
WbReEncryptEncryptionSegment
WbReleaseLeastRecentlyUsedHeapExecutedBlocks
WbRemoveWarbirdProcess
WheaConfigureErrorSource
WheaExecuteRowFailureCheck
WheaInitialize
WheaRegisterErrorSourceOverride
WheaRegisterInUsePageOfflineNotification
WheaSelLogCheckPoint
WheaSelLogSetNtSchedulerAvailability
WheaUnconfigureErrorSource
WheaUnregisterErrorSourceOverride
WheaUnregisterInUsePageOfflineNotification
WheapCallInUsePageNotificationCallbacks
WheapPfaReset
WheapPredictiveFailureAnalysis
paramcount 0 0
address 140327ab0 140327aa0
sig undefined KeAbPostRelease(void) undefined KeAbPostRelease(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

KeAbPostRelease Calling Diff

--- KeAbPostRelease calling
+++ KeAbPostRelease calling
@@ -349,4 +349,4 @@
-FUN_14036f764
-FUN_140707984
-FUN_1409fa120
-FUN_1409fa77c
+FUN_14036f754
+FUN_140708238
+FUN_1409fa0b0
+FUN_1409fa70c
@@ -990 +989,0 @@
-VrpHandleIoctlInitializeJobForVreg

RtlUShortAdd

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 1.0
i_ratio 0.8
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name RtlUShortAdd RtlUShortAdd
fullname RtlUShortAdd RtlUShortAdd
refcount 19 21
length 30 30
called
calling AslPathWildcardFindFirst
AslpPathWildcardAllocMatchNode
FsRtlValidateReparsePointBuffer
IopAllocateUnicodeString
PspSiloInitializeSystemRootSymlink
RtlAddResourceAttributeAce
RtlpCreateServerAcl
SepAddTokenOriginClaim
VfSuspectDriversAllocateEntry
_SysCtxRegOpenCurrentUserKey
Expand for full list:
AslPathWildcardFindFirst
AslpPathWildcardAllocMatchNode
FsRtlValidateReparsePointBuffer
IopAllocateUnicodeString
PspSiloInitializeSystemRootSymlink
RtlAddResourceAttributeAce
RtlpCreateServerAcl
SepAddTokenOriginClaim
VfSuspectDriversAllocateEntry
VrpBuildKeyPath
_SysCtxRegOpenCurrentUserKey
paramcount 0 0
address 1402a68c4 1402a6664
sig undefined RtlUShortAdd(void) undefined RtlUShortAdd(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

RtlUShortAdd Calling Diff

--- RtlUShortAdd calling
+++ RtlUShortAdd calling
@@ -9,0 +10 @@
+VrpBuildKeyPath

RtlEqualUnicodeString

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.93
i_ratio 0.76
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name RtlEqualUnicodeString RtlEqualUnicodeString
fullname RtlEqualUnicodeString RtlEqualUnicodeString
refcount 140 142
length 382 382
called PsGetCurrentServerSiloGlobals PsGetCurrentServerSiloGlobals
calling
Expand for full list:
AdtpBuildAccessesString
AdtpLookupDriveLetter
AuthzBasepCompareUnicodeStringOperands
AuthzBasepEqualUnicodeString
AuthzBasepFindSecurityAttribute
CmGetSystemDriverList
CmLoadAppKey
CmSetValueKey
CmpCreateHardwareProfiles
CmpDoSort
CmpFindHiveSubKeyCmpFindMachineHiveByMountPoint
CmpGetKnownHivePathNode
DrvDbFindDatabaseNode
EtwpAcquireLoggerContextByLoggerName
EtwpGetLoggerInfoFromContext
EtwpLookupLoggerIdByName
ExpFindArcName
ExpPrmInitialization
FUN_140b1a730
IopCreateSecureDeviceClassSettings
IopDeviceInterfaceFilterCallback
IopGetDeviceInterfaces
IopIsReportedAlready
IopParseDevice
IopQueryRegistryKeySystemPath
KseHookQueryValueKey
KsepCacheDeviceQueryData
MiInsertPreviouslyRegisteredHotPatchRecord
MiObtainSectionForDriver
MiResolveImageReferences
MiUseLargeDriverPage
ObpLookupDirectoryUsingHash
PiDevCfgCheckDeviceNeedsUpdate
PiDevCfgConfigureDevice
PiDevCfgLogDeviceConfigured
PiDevCfgQueryIncludedDriverConfigurations
PiDevCfgResolveMultiSzValue
PiDevCfgResolveVariable
PiDrvDbFindNode
PiDrvDbResolveFilePathKeyValues
PiDrvDbResolveSystemFilePath
PiFindDevInstMatch
PiPnpRtlInit
PiPnpRtlServiceFilterCallback
PiRemoveDeferredSetInterfaceState
PiUEventQueueBroadcastEventEntry
PipAddRequestToEdge
PipDeleteBindingId
PipFindDeviceOverrideEntry
PipLookupGroupName
PipQueryBindingResolution
PnpLoadBootFilterDriver
PnpMultiSzContainsString
PopBatteryDeviceState
PopEmModuleAddressMatchCallback
PopEmUpdateDeviceConstraintCallback
PpInitGetGroupOrderIndex
PspIdentityBasedJobBreakaway
RtlDeriveCapabilitySidsFromName
RtlpGetNtProductTypeFromRegistry
SLQueryLicenseValueInternal
SepGetCachedHandlesEntry
SepIsImageInMinTcbList
SepIsNgenImage
SepValidateReferencedCachedHandles
VfAddVerifierEntry
VfCheckUserHandle
VfDriverApplyDifVerification
VfDriverEnableVerifier
VfDriverLoadImage
VfDriverLoadSucceeded
VfDriverRemoveAllDifVerification
VfDriverRemoveDifVerification
VfFilterAttach
VfInitBootDriversLoaded
VfSuspectDriversLoadCallback
VfSuspectDriversUnloadCallback
ViDriverReApplyVerifierForAll
ViInitSystemPhase0
ViIsDriverSuspectForVerifier
ViLogAndLoadXdv
ViSuspectDriversLookupEntry
VrpCreateNamespaceNode
VrpFindDiffHiveEntryForMountPointWithLock
VrpHandleIoctlUnloadDifferencingHiveForHost
VrpPreLoadKey
_CmClassFilterCallback
_CmDeviceClassesSubkeyCallback
_CmIsRootDevice
_CmServiceFilterCallback
_PnpCtxFindNode
Expand for full list:
AdtpBuildAccessesString
AdtpLookupDriveLetter
AuthzBasepCompareUnicodeStringOperands
AuthzBasepEqualUnicodeString
AuthzBasepFindSecurityAttribute
CmGetSystemDriverList
CmLoadAppKey
CmSetValueKey
CmpCreateHardwareProfiles
CmpDoSort
CmpFindHiveSubKeyCmpFindMachineHiveByMountPoint
CmpGetKnownHivePathNode
DrvDbFindDatabaseNode
EtwpAcquireLoggerContextByLoggerName
EtwpGetLoggerInfoFromContext
EtwpLookupLoggerIdByName
ExpFindArcName
ExpPrmInitialization
FUN_140b1a730
IopCreateSecureDeviceClassSettings
IopDeviceInterfaceFilterCallback
IopGetDeviceInterfaces
IopIsReportedAlready
IopParseDevice
IopQueryRegistryKeySystemPath
KseHookQueryValueKey
KsepCacheDeviceQueryData
MiInsertPreviouslyRegisteredHotPatchRecord
MiObtainSectionForDriver
MiResolveImageReferences
MiUseLargeDriverPage
ObpLookupDirectoryUsingHash
PiDevCfgCheckDeviceNeedsUpdate
PiDevCfgConfigureDevice
PiDevCfgLogDeviceConfigured
PiDevCfgQueryIncludedDriverConfigurations
PiDevCfgResolveMultiSzValue
PiDevCfgResolveVariable
PiDrvDbFindNode
PiDrvDbResolveFilePathKeyValues
PiDrvDbResolveSystemFilePath
PiFindDevInstMatch
PiPnpRtlInit
PiPnpRtlServiceFilterCallback
PiRemoveDeferredSetInterfaceState
PiUEventQueueBroadcastEventEntry
PipAddRequestToEdge
PipDeleteBindingId
PipFindDeviceOverrideEntry
PipLookupGroupName
PipQueryBindingResolution
PnpLoadBootFilterDriver
PnpMultiSzContainsString
PopBatteryDeviceState
PopEmModuleAddressMatchCallback
PopEmUpdateDeviceConstraintCallback
PpInitGetGroupOrderIndex
PspIdentityBasedJobBreakaway
RtlDeriveCapabilitySidsFromName
RtlpGetNtProductTypeFromRegistry
SLQueryLicenseValueInternal
SepGetCachedHandlesEntry
SepIsImageInMinTcbList
SepIsNgenImage
SepValidateReferencedCachedHandles
VfAddVerifierEntry
VfCheckUserHandle
VfDriverApplyDifVerification
VfDriverEnableVerifier
VfDriverLoadImage
VfDriverLoadSucceeded
VfDriverRemoveAllDifVerification
VfDriverRemoveDifVerification
VfFilterAttach
VfInitBootDriversLoaded
VfSuspectDriversLoadCallback
VfSuspectDriversUnloadCallback
ViDriverReApplyVerifierForAll
ViInitSystemPhase0
ViIsDriverSuspectForVerifier
ViLogAndLoadXdv
ViSuspectDriversLookupEntry
VrpCreateNamespaceNode
VrpFindDiffHiveEntryForMountPointWithLock
VrpHandleIoctlUnloadDifferencingHiveForHost
VrpPreLoadKey
VrpPreOpenOrCreate
_CmClassFilterCallback
_CmDeviceClassesSubkeyCallback
_CmIsRootDevice
_CmServiceFilterCallback
_PnpCtxFindNode
paramcount 0 0
address 1407cf480 1407cfe90
sig undefined RtlEqualUnicodeString(void) undefined RtlEqualUnicodeString(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

RtlEqualUnicodeString Calling Diff

--- RtlEqualUnicodeString calling
+++ RtlEqualUnicodeString calling
@@ -87,0 +88 @@
+VrpPreOpenOrCreate

SeReleaseSubjectContext

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,length,calling
ratio 1.0
i_ratio 0.74
m_ratio 0.95
b_ratio 0.99
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name SeReleaseSubjectContext SeReleaseSubjectContext
fullname SeReleaseSubjectContext SeReleaseSubjectContext
refcount 160 161
length 287 274
called ObfDereferenceObjectWithTag
ObpPushStackInfo		 ObfDereferenceObjectWithTag
ObpPushStackInfo
calling
Expand for full list:
AlpcpCheckConnectionSecurity
CMFCheckAccess
CmFcInitSystem2
CmKeyBodyRemapToVirtual
CmKeyBodyRemapToVirtualForEnum
CmKeyBodyReplicateToVirtual
CmQueryKey
CmQueryLayeredKey
CmUpdateFeatureConfiguration
CmUpdateFeatureUsageSubscription
CmpCheckHivePrimaryFileReadWriteAccessCmpCheckKeySecurityDescriptorAccess
CmpDoAccessCheckOnKCB
CmpDoBuildVirtualStack
CmpDoParseKey
CmpFlushNotify
CmpIsSystemEntity
CmpLogHiveFileInaccessible
CmpSetKeySecurity
EtwpAccessCheck
EtwpCheckProviderLoggingAccess
EtwpCoverageUserIsAdmin
EtwpFindOrCreateGuidEntry
ExCheckFullProcessInformationAccess
ExCpuSetResourceManagerAccessCheck
ExIsRestrictedCaller
ExpCheckWakeTimerAccess
ExpWnfCheckCallerAccess
FUN_140687e40
FsRtlCancelNotify
FsRtlCancelNotify$fin$1
FsRtlNotifyCleanup
FsRtlNotifyCleanup$fin$0
FsRtlNotifyCleanupAll
FsRtlNotifyFilterChangeDirectory
FsRtlNotifyFilterChangeDirectory$fin$0
FsRtlNotifyFilterChangeDirectoryLite
FsRtlNotifyFilterChangeDirectoryLite$fin$0
IoCheckRedirectionTrustLevel
IoComputeRedirectionTrustLevel
IoGetDeviceInterfaceAlias
IopGetDeviceInterfaces
IopXxxControlFile
NtCloseObjectAuditAlarm
NtCreateUserProcess
NtDeleteKey
NtDeleteObjectAuditAlarm
NtDeleteValueKey
NtGetNextProcess
NtGetNextThread
NtImpersonateAnonymousToken
NtOpenObjectAuditAlarm
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtRenameKey
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationKey
NtSetUuidSeed
NtSetValueKey
ObDuplicateObject
ObInsertObjectEx
ObOpenObjectByPointer
ObReferenceObjectByName
ObReferenceObjectByNameEx
ObpCaptureBoundaryDescriptor
ObpGetIntegrityLevel
ObpVerifyCreatorAccessCheck
PiAuCheckTokenMembership
PiAuDoesClientHavePrivilege
PiAuVerifyAccessToObject
PiCMGetDeviceIdList
PiCMValidateDeviceInstance
PiDqOpenUserObjectRegKey
PiDqQueryRelease
PiPnpRtlObjectEventRelease
PiUEventFreeClientRegistrationContext
PnpGetCallerSessionId
PopBootStatAccessCheck
PsCreateMinimalProcess
PsOpenProcess
PsOpenThread
PspCombineSecurityDomains
PspCreateProcess
PspInsertProcess
PspInsertThread
PspIsContextAdmin
PspIumVerifyParentSd
PspOneDirectionSecurityDomainCombine
PspSetQuotaLimits
RtlCheckTokenCapability
RtlCheckTokenMembershipEx
RtlIsSandboxedToken
SeAccessCheckByType
SeAdtRegistryValueChangedAuditAlarm
SeAuditBootConfiguration
SeAuditFipsCryptoSelftests
SeAuditHandleDuplication
SeAuditHardLinkCreationWithTransaction
SeAuditPlugAndPlay
SeAuditProcessCreation
SeAuditSystemTimeChange
SeAuditTransactionStateChange
SeAuditingWithTokenForSubcategory
SeCheckPrivilegedObject
SeCloseObjectAuditAlarm
SeDeleteAccessState
SeDeleteObjectAuditAlarmWithTransaction
SeIsAppContainerOrIdentifyLevelContext
SeOpenObjectAuditAlarmWithTransaction
SeOperationAuditAlarm
SeReportSecurityEventWithSubCategory
SeSecurityDescriptorChangedAuditAlarm
SeSinglePrivilegeCheck
SeSubProcessToken
SeTokenDefaultDaclChangedAuditAlarm
SepAccessCheckAndAuditAlarm
SepAdtAuditThisEventByCategoryWithContext
SepAdtAuditThisEventWithContext
SepAdtTokenRightAdjusted
SepAuditAssignPrimaryToken
SepCheckCreateLowBox
SepCopyAnonymousTokenAndSetSilo
SepFilterToken
VfUtilIsLocalSystem
WdipAccessCheck
WmipCreateGuidObject
Expand for full list:
AlpcpCheckConnectionSecurity
CMFCheckAccess
CmFcInitSystem2
CmKeyBodyRemapToVirtual
CmKeyBodyRemapToVirtualForEnum
CmKeyBodyReplicateToVirtual
CmQueryKey
CmQueryLayeredKey
CmSetValueKey
CmUpdateFeatureConfiguration
CmUpdateFeatureUsageSubscriptionCmpCheckHivePrimaryFileReadWriteAccess
CmpCheckKeySecurityDescriptorAccess
CmpDoAccessCheckOnKCB
CmpDoBuildVirtualStack
CmpDoParseKey
CmpFlushNotify
CmpIsSystemEntity
CmpLogHiveFileInaccessible
CmpSetKeySecurity
EtwpAccessCheck
EtwpCheckProviderLoggingAccess
EtwpCoverageUserIsAdmin
EtwpFindOrCreateGuidEntry
ExCheckFullProcessInformationAccess
ExCpuSetResourceManagerAccessCheck
ExIsRestrictedCaller
ExpCheckWakeTimerAccess
ExpWnfCheckCallerAccess
FUN_140687e40
FsRtlCancelNotify
FsRtlCancelNotify$fin$1
FsRtlNotifyCleanup
FsRtlNotifyCleanup$fin$0
FsRtlNotifyCleanupAll
FsRtlNotifyFilterChangeDirectory
FsRtlNotifyFilterChangeDirectory$fin$0
FsRtlNotifyFilterChangeDirectoryLite
FsRtlNotifyFilterChangeDirectoryLite$fin$0
IoCheckRedirectionTrustLevel
IoComputeRedirectionTrustLevel
IoGetDeviceInterfaceAlias
IopGetDeviceInterfaces
IopXxxControlFile
NtCloseObjectAuditAlarm
NtCreateUserProcess
NtDeleteKey
NtDeleteObjectAuditAlarm
NtDeleteValueKey
NtGetNextProcess
NtGetNextThread
NtImpersonateAnonymousToken
NtOpenObjectAuditAlarm
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
NtRenameKey
NtSetInformationFile
NtSetInformationJobObject
NtSetInformationKey
NtSetUuidSeed
NtSetValueKey
ObDuplicateObject
ObInsertObjectEx
ObOpenObjectByPointer
ObReferenceObjectByName
ObReferenceObjectByNameEx
ObpCaptureBoundaryDescriptor
ObpGetIntegrityLevel
ObpVerifyCreatorAccessCheck
PiAuCheckTokenMembership
PiAuDoesClientHavePrivilege
PiAuVerifyAccessToObject
PiCMGetDeviceIdList
PiCMValidateDeviceInstance
PiDqOpenUserObjectRegKey
PiDqQueryRelease
PiPnpRtlObjectEventRelease
PiUEventFreeClientRegistrationContext
PnpGetCallerSessionId
PopBootStatAccessCheck
PsCreateMinimalProcess
PsOpenProcess
PsOpenThread
PspCombineSecurityDomains
PspCreateProcess
PspInsertProcess
PspInsertThread
PspIsContextAdmin
PspIumVerifyParentSd
PspOneDirectionSecurityDomainCombine
PspSetQuotaLimits
RtlCheckTokenCapability
RtlCheckTokenMembershipEx
RtlIsSandboxedToken
SeAccessCheckByType
SeAdtRegistryValueChangedAuditAlarm
SeAuditBootConfiguration
SeAuditFipsCryptoSelftests
SeAuditHandleDuplication
SeAuditHardLinkCreationWithTransaction
SeAuditPlugAndPlay
SeAuditProcessCreation
SeAuditSystemTimeChange
SeAuditTransactionStateChange
SeAuditingWithTokenForSubcategory
SeCheckPrivilegedObject
SeCloseObjectAuditAlarm
SeDeleteAccessState
SeDeleteObjectAuditAlarmWithTransaction
SeIsAppContainerOrIdentifyLevelContext
SeOpenObjectAuditAlarmWithTransaction
SeOperationAuditAlarm
SeReportSecurityEventWithSubCategory
SeSecurityDescriptorChangedAuditAlarm
SeSinglePrivilegeCheck
SeSubProcessToken
SeTokenDefaultDaclChangedAuditAlarm
SepAccessCheckAndAuditAlarm
SepAdtAuditThisEventByCategoryWithContext
SepAdtAuditThisEventWithContext
SepAdtTokenRightAdjusted
SepAuditAssignPrimaryToken
SepCheckCreateLowBox
SepCopyAnonymousTokenAndSetSilo
SepFilterToken
VfUtilIsLocalSystem
WdipAccessCheck
WmipCreateGuidObject
paramcount 0 0
address 1406adee0 1406adee0
sig undefined SeReleaseSubjectContext(void) undefined SeReleaseSubjectContext(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

SeReleaseSubjectContext Calling Diff

--- SeReleaseSubjectContext calling
+++ SeReleaseSubjectContext calling
@@ -8,0 +9 @@
+CmSetValueKey

VrpDestroyNamespaceNode

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.96
i_ratio 0.79
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name VrpDestroyNamespaceNode VrpDestroyNamespaceNode
fullname VrpDestroyNamespaceNode VrpDestroyNamespaceNode
refcount 9 8
length 690 690
called ExAllocatePoolWithTag
ExFreePoolWithTag
ObDereferenceObjectDeferDeleteWithTag
RtlCopyMemory
VrpFindExactNamespaceNode
ZwClose
ZwDeleteKey
ZwOpenKey
memset		 ExAllocatePoolWithTag
ExFreePoolWithTag
ObDereferenceObjectDeferDeleteWithTag
RtlCopyMemory
VrpFindExactNamespaceNode
ZwClose
ZwDeleteKey
ZwOpenKey
memset
calling VrpCleanupNamespace
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlInitializeJobForVreg
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpPostUnloadKey
VrpPreLoadKey		 VrpCleanupNamespace
VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlUnloadDynamicallyLoadedHives
VrpPostUnloadKey
VrpPreLoadKey
paramcount 0 0
address 14075aee4 14075b8f4
sig undefined VrpDestroyNamespaceNode(void) undefined VrpDestroyNamespaceNode(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

VrpDestroyNamespaceNode Calling Diff

--- VrpDestroyNamespaceNode calling
+++ VrpDestroyNamespaceNode calling
@@ -4 +3,0 @@
-VrpHandleIoctlInitializeJobForVreg

CmpDetachFromRegistryProcess

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount
ratio 1.0
i_ratio 0.8
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name CmpDetachFromRegistryProcess CmpDetachFromRegistryProcess
fullname CmpDetachFromRegistryProcess CmpDetachFromRegistryProcess
refcount 76 77
length 16 16
called KiUnstackDetachProcess KiUnstackDetachProcess
calling
Expand for full list:
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmDeleteKey
CmDeleteValueKey
CmEnumerateKey
CmEnumerateValueKey
CmEtwRunDown
CmGetSystemDriverList
CmInitSystem1
CmKeyBodyRemapToVirtual
CmKeyBodyRemapToVirtualForEnumCmKeyBodyReplicateToVirtual
CmLoadAppKey
CmLoadKey
CmQueryKey
CmQueryKey$fin$0
CmQueryValueKey
CmReconcileAndValidateAllHives
CmReplaceKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmShutdownSystem1
CmShutdownSystem2
CmpCleanUpKCBCacheTable
CmpCleanupLightWeightTransaction
CmpCleanupTransactionState
CmpCreateHive
CmpDelayCloseWorker
CmpDoBuildVirtualStack
CmpDoParseKey
CmpDoQueryKeyName
CmpEtwDumpKcb
CmpFlushBackupHive
CmpForceFlushWorker
CmpFreeAllMemory
CmpHandlePageFileOpenNotification
CmpInitHiveFromFile
CmpLateUnloadHiveWorker
CmpLinkHiveToMaster
CmpLoadKeyCommon
CmpPerformUnloadKey
CmpPublishEventForPcaResolver
CmpRmUnDoPhase
CmpSaveBootControlSet
CmpSearchKeyControlBlockTreeEx
CmpSetKeySecurity
CmpTransMgrCommit
CmpTransMgrPrepare
NtCommitRegistryTransaction
NtCompressKey
NtEnumerateValueKey
NtFlushKey
NtFreezeRegistry
NtQueryMultipleValueKey
NtQueryOpenSubKeys
NtQueryOpenSubKeysEx
NtRenameKey
NtRestoreKey
NtRollbackRegistryTransaction
NtSaveKeyEx
NtSaveMergedKeys
NtThawRegistry
Expand for full list:
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmDeleteKey
CmDeleteValueKey
CmEnumerateKey
CmEnumerateValueKey
CmEtwRunDown
CmGetSystemDriverList
CmInitSystem1
CmKeyBodyRemapToVirtual
CmKeyBodyRemapToVirtualForEnumCmKeyBodyReplicateToVirtual
CmLoadAppKey
CmLoadKey
CmQueryKey
CmQueryKey$fin$0
CmQueryValueKey
CmReconcileAndValidateAllHives
CmReplaceKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmShutdownSystem1
CmShutdownSystem2
CmpCleanUpKCBCacheTable
CmpCleanupLightWeightTransaction
CmpCleanupTransactionState
CmpCreateHive
CmpDelayCloseWorker
CmpDoBuildVirtualStack
CmpDoParseKey
CmpDoQueryKeyName
CmpEtwDumpKcb
CmpFlushBackupHive
CmpForceFlushWorker
CmpFreeAllMemory
CmpHandlePageFileOpenNotification
CmpInitHiveFromFile
CmpLateUnloadHiveWorker
CmpLinkHiveToMaster
CmpLoadKeyCommon
CmpPerformUnloadKey
CmpPublishEventForPcaResolver
CmpRmUnDoPhase
CmpSaveBootControlSet
CmpSearchKeyControlBlockTreeEx
CmpSetKeySecurity
CmpTransMgrCommit
CmpTransMgrPrepare
NtCommitRegistryTransaction
NtCompressKey
NtEnumerateValueKey
NtFlushKey
NtFreezeRegistry
NtQueryMultipleValueKey
NtQueryOpenSubKeys
NtQueryOpenSubKeysEx
NtRenameKey
NtRestoreKey
NtRollbackRegistryTransaction
NtSaveKeyEx
NtSaveMergedKeys
NtThawRegistry
paramcount 0 0
address 140af63f0 140af63f0
sig undefined CmpDetachFromRegistryProcess(void) undefined CmpDetachFromRegistryProcess(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

CmpRollbackTransactionArray

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address
ratio 1.0
i_ratio 0.78
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name CmpRollbackTransactionArray CmpRollbackTransactionArray
fullname CmpRollbackTransactionArray CmpRollbackTransactionArray
refcount 7 6
length 190 190
called CmpRetryBackOff
CmpRollbackLightWeightTransaction
CmpTransDereferenceTransaction
ExFreePoolWithTag
ObfDereferenceObject
TmRollbackEnlistment		 CmpRetryBackOff
CmpRollbackLightWeightTransaction
CmpTransDereferenceTransaction
ExFreePoolWithTag
ObfDereferenceObject
TmRollbackEnlistment
calling CmDeleteKey
CmDeleteValueKey
CmSetValueKey
CmpParseKey
CmpSetKeySecurity		 CmDeleteKey
CmDeleteValueKey
CmSetValueKey
CmpParseKey
CmpSetKeySecurity
paramcount 0 0
address 140a1f2c4 140a1f254
sig undefined CmpRollbackTransactionArray(void) undefined CmpRollbackTransactionArray(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

VrpCreateNamespaceNode

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.98
i_ratio 0.81
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name VrpCreateNamespaceNode VrpCreateNamespaceNode
fullname VrpCreateNamespaceNode VrpCreateNamespaceNode
refcount 6 5
length 745 745
called ExAllocatePool2
ExFreePoolWithTag
ObfReferenceObjectWithTag
RtlCopyMemory
RtlEqualUnicodeString
VrpBuildKeyPath
VrpCountPathComponents
VrpFindBestMatchNamespaceNode
VrpGetNextToken
VrpStripTrailingCharacters		 ExAllocatePool2
ExFreePoolWithTag
ObfReferenceObjectWithTag
RtlCopyMemory
RtlEqualUnicodeString
VrpBuildKeyPath
VrpCountPathComponents
VrpFindBestMatchNamespaceNode
VrpGetNextToken
VrpStripTrailingCharacters
calling VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpHandleIoctlInitializeJobForVreg
VrpPreLoadKey		 VrpHandleIoctlCreateMultipleNamespaceNodes
VrpHandleIoctlCreateNamespaceNode
VrpPreLoadKey
paramcount 7 7
address 14075b0f8 14075bb08
sig undefined VrpCreateNamespaceNode(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5, undefined4 param_6, undefined8 param_7) undefined VrpCreateNamespaceNode(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5, undefined4 param_6, undefined8 param_7)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

VrpCreateNamespaceNode Calling Diff

--- VrpCreateNamespaceNode calling
+++ VrpCreateNamespaceNode calling
@@ -3 +2,0 @@
-VrpHandleIoctlInitializeJobForVreg

CmpFindNameInListWithStatus

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address
ratio 1.0
i_ratio 0.78
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name CmpFindNameInListWithStatus CmpFindNameInListWithStatus
fullname CmpFindNameInListWithStatus CmpFindNameInListWithStatus
refcount 12 11
length 190 190
called CmpFindNameInListCellWithStatus
HvpGetCellContextReinitialize
HvpGetCellFlat
HvpGetCellPaged
HvpReleaseCellFlat
HvpReleaseCellPaged		 CmpFindNameInListCellWithStatus
HvpGetCellContextReinitialize
HvpGetCellFlat
HvpGetCellPaged
HvpReleaseCellFlat
HvpReleaseCellPaged
calling CmDeleteValueKey
CmQueryMultipleValueForLayeredKey
CmSetValueKey
CmpCompareNewValueDataAgainstKCBCache
CmpFindNameInList
CmpGetSymbolicLinkTarget
CmpMergeKeyValues		 CmDeleteValueKey
CmQueryMultipleValueForLayeredKey
CmSetValueKey
CmpCompareNewValueDataAgainstKCBCache
CmpFindNameInList
CmpGetSymbolicLinkTarget
CmpMergeKeyValues
paramcount 6 6
address 1406b5cc4 1406b6084
sig undefined CmpFindNameInListWithStatus(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5, undefined8 param_6) undefined CmpFindNameInListWithStatus(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5, undefined8 param_6)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

CmpLogTransactionAbortedWithChildName

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address
ratio 0.91
i_ratio 0.77
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name CmpLogTransactionAbortedWithChildName CmpLogTransactionAbortedWithChildName
fullname CmpLogTransactionAbortedWithChildName CmpLogTransactionAbortedWithChildName
refcount 19 18
length 470 470
called CmpAllocatePool
CmpConstructNameFromKcbNameBlocks
CmpFreePoolWithTag
CmpLogTransactionAbortedByName
RtlInitUnicodeString
RtlUnicodeStringCat
RtlUnicodeStringCopy
RtlUnicodeStringValidateDestWorker
SmFreeWrapper
_tlgKeywordOn		 CmpAllocatePool
CmpConstructNameFromKcbNameBlocks
CmpFreePoolWithTag
CmpLogTransactionAbortedByName
RtlInitUnicodeString
RtlUnicodeStringCat
RtlUnicodeStringCopy
RtlUnicodeStringValidateDestWorker
SmFreeWrapper
_tlgKeywordOn
calling CmDeleteValueKey
CmRenameKey
CmRestoreKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmpCreateChild
CmpLogTransactionAbortedForRollbackPacket
CmpPerformUnloadKey
CmpSaveBootControlSet		 CmDeleteValueKey
CmRenameKey
CmRestoreKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmpCreateChild
CmpLogTransactionAbortedForRollbackPacket
CmpPerformUnloadKey
CmpSaveBootControlSet
paramcount 5 5
address 1407a3f38 1407a4948
sig undefined CmpLogTransactionAbortedWithChildName(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5) undefined CmpLogTransactionAbortedWithChildName(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined4 param_5)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

MmProbeAndLockPagesPrivate

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 1.0
i_ratio 0.83
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name MmProbeAndLockPagesPrivate MmProbeAndLockPagesPrivate
fullname MmProbeAndLockPagesPrivate MmProbeAndLockPagesPrivate
refcount 2 6
length 22 22
called MiProbeAndLockPages MiProbeAndLockPages
calling WbMakeUserExecutablePagesKernelWritable FUN_14070897c
WbMakeUserExecutablePagesKernelWritable
paramcount 0 0
address 140269d00 140269aa0
sig undefined MmProbeAndLockPagesPrivate(void) undefined MmProbeAndLockPagesPrivate(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

MmProbeAndLockPagesPrivate Calling Diff

--- MmProbeAndLockPagesPrivate calling
+++ MmProbeAndLockPagesPrivate calling
@@ -0,0 +1 @@
+FUN_14070897c

CmpUnlockKcbStack

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address
ratio 1.0
i_ratio 0.82
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name CmpUnlockKcbStack CmpUnlockKcbStack
fullname CmpUnlockKcbStack CmpUnlockKcbStack
refcount 73 72
length 79 79
called CmpUnlockKcb CmpUnlockKcb
calling
Expand for full list:
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmDeleteKey
CmDeleteLayeredKey
CmDeleteValueKey
CmEnumerateValueFromLayeredKey
CmOpenKeyForBugCheckRecovery
CmQueryLayeredKey
CmQueryMultipleValueForLayeredKey
CmQueryValueKey
CmSaveKeyCmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmpAssignKeySecurity
CmpDoBuildVirtualStack
CmpDoParseKey
CmpEnumerateLayeredKey
CmpGetSymbolicLinkTarget
CmpPromoteKey
CmpQueryKeySecurity
CmpSetKeySecurity
CmpStartSiloRegistryNamespace
Expand for full list:
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmDeleteKey
CmDeleteLayeredKey
CmDeleteValueKey
CmEnumerateValueFromLayeredKey
CmOpenKeyForBugCheckRecovery
CmQueryLayeredKey
CmQueryMultipleValueForLayeredKey
CmQueryValueKey
CmSaveKeyCmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmpAssignKeySecurity
CmpDoBuildVirtualStack
CmpDoParseKey
CmpEnumerateLayeredKey
CmpGetSymbolicLinkTarget
CmpPromoteKey
CmpQueryKeySecurity
CmpSetKeySecurity
CmpStartSiloRegistryNamespace
paramcount 0 0
address 1406b58ec 1406b5cac
sig undefined CmpUnlockKcbStack(void) undefined CmpUnlockKcbStack(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

CmpUnlockRegistry

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount
ratio 1.0
i_ratio 0.5
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name CmpUnlockRegistry CmpUnlockRegistry
fullname CmpUnlockRegistry CmpUnlockRegistry
refcount 214 213
length 56 56
called CmpRecordRegistryLockRelease
ExReleaseResourceLite
KeLeaveCriticalRegion
PsBoostThreadIo		 CmpRecordRegistryLockRelease
ExReleaseResourceLite
KeLeaveCriticalRegion
PsBoostThreadIo
calling
Expand for full list:
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmCompleteRegistryInitialization
CmDeleteKey
CmDeleteLayeredKey
CmDeleteValueKey
CmDumpKeyToFile
CmEnumerateKey
CmEnumerateValueKey
CmEnumerateValueKeyFromMergedView
CmEtwRunDownCmFreezeRegistry
CmGetSystemDriverList
CmInitSystem1
CmKeyBodyNeedsVirtualImage
CmKeyBodyRemapToVirtual
CmKeyBodyRemapToVirtualForEnum
CmKeyBodyReplicateToVirtual
CmLoadAppKey
CmLoadDifferencingKey
CmLockKeyForWrite
CmNotifyRunDown
CmOpenKey
CmOpenKeyForBugCheckRecovery
CmQueryKey
CmQueryKey$fin$0
CmQueryMultipleValueKey
CmQueryValueKey
CmReleaseLoadKeyContext
CmRenameKey
CmReplaceKey
CmRestoreKey
CmSaveKey
CmSaveMergedKeys
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmShutdownSystem1
CmShutdownSystem2
CmThawRegistry
CmpAssignKeySecurity
CmpBecomeActiveFlusherAndReconciler
CmpCleanupLightWeightTransaction
CmpCleanupParseContext
CmpCleanupTransactionState
CmpCloneHwProfile
CmpCloseKeyObject
CmpCommitLightWeightTransaction
CmpCompleteUnloadKey
CmpCreateHive
CmpDelayCloseWorker
CmpDelayFreeRMWorker
CmpDeleteKeyObject
CmpDoFlushNextHive
CmpDoLocalizeNextHive
CmpDoParseKey
CmpDoQueryKeyName
CmpDoReOpenTransKey
CmpDumpKeyToBuffer
CmpEnumerateLayeredKey
CmpFinishBeingActiveFlusherAndReconciler
CmpFinishSystemHivesLoad
CmpFlushBackupHive
CmpFlushHive
CmpInitCmRM
CmpLateUnloadHiveWorker
CmpLinkHiveToMaster
CmpLoadHiveThread
CmpLoadHiveVolatile
CmpLoadKeyCommon
CmpLockRegistryFreezeAware
CmpMarkCurrentProfileDirty
CmpMountPreloadedHives
CmpPerformUnloadKey
CmpQueryKeySecurity
CmpRecheckHiveVolumePolicy
CmpRecoverFlushProtocolStateFromFiles
CmpRefreshHive
CmpReorganizeHive
CmpResolveHiveLoadConflict
CmpSaveBootControlSet
CmpSetKeySecurity
CmpStartRMLogs
CmpStartSiloRegistryNamespace
CmpStopRMLog
CmpStopSiloKeyLockTracker
CmpTransMgrCommit
CmpTransMgrCommitUoW
CmpTransMgrFreeVolatileData
CmpTransMgrPrepare
CmpTransMgrSyncHive
CmpTrimHive
CmpTryToRundownHive
CmpWaitOnHiveWriteQueue
ExpWatchProductTypeWork
HvpFinishPrimaryWrite
NtCompactKeys
NtCompressKey
NtDeleteKey
NtFlushKey
NtNotifyChangeMultipleKeys
NtQueryOpenSubKeys
NtQueryOpenSubKeysEx
Expand for full list:
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmCompleteRegistryInitialization
CmDeleteKey
CmDeleteLayeredKey
CmDeleteValueKey
CmDumpKeyToFile
CmEnumerateKey
CmEnumerateValueKey
CmEnumerateValueKeyFromMergedView
CmEtwRunDownCmFreezeRegistry
CmGetSystemDriverList
CmInitSystem1
CmKeyBodyNeedsVirtualImage
CmKeyBodyRemapToVirtual
CmKeyBodyRemapToVirtualForEnum
CmKeyBodyReplicateToVirtual
CmLoadAppKey
CmLoadDifferencingKey
CmLockKeyForWrite
CmNotifyRunDown
CmOpenKey
CmOpenKeyForBugCheckRecovery
CmQueryKey
CmQueryKey$fin$0
CmQueryMultipleValueKey
CmQueryValueKey
CmReleaseLoadKeyContext
CmRenameKey
CmReplaceKey
CmRestoreKey
CmSaveKey
CmSaveMergedKeys
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmShutdownSystem1
CmShutdownSystem2
CmThawRegistry
CmpAssignKeySecurity
CmpBecomeActiveFlusherAndReconciler
CmpCleanupLightWeightTransaction
CmpCleanupParseContext
CmpCleanupTransactionState
CmpCloneHwProfile
CmpCloseKeyObject
CmpCommitLightWeightTransaction
CmpCompleteUnloadKey
CmpCreateHive
CmpDelayCloseWorker
CmpDelayFreeRMWorker
CmpDeleteKeyObject
CmpDoFlushNextHive
CmpDoLocalizeNextHive
CmpDoParseKey
CmpDoQueryKeyName
CmpDoReOpenTransKey
CmpDumpKeyToBuffer
CmpEnumerateLayeredKey
CmpFinishBeingActiveFlusherAndReconciler
CmpFinishSystemHivesLoad
CmpFlushBackupHive
CmpFlushHive
CmpInitCmRM
CmpLateUnloadHiveWorker
CmpLinkHiveToMaster
CmpLoadHiveThread
CmpLoadHiveVolatile
CmpLoadKeyCommon
CmpLockRegistryFreezeAware
CmpMarkCurrentProfileDirty
CmpMountPreloadedHives
CmpPerformUnloadKey
CmpQueryKeySecurity
CmpRecheckHiveVolumePolicy
CmpRecoverFlushProtocolStateFromFiles
CmpRefreshHive
CmpReorganizeHive
CmpResolveHiveLoadConflict
CmpSaveBootControlSet
CmpSetKeySecurity
CmpStartRMLogs
CmpStartSiloRegistryNamespace
CmpStopRMLog
CmpStopSiloKeyLockTracker
CmpTransMgrCommit
CmpTransMgrCommitUoW
CmpTransMgrFreeVolatileData
CmpTransMgrPrepare
CmpTransMgrSyncHive
CmpTrimHive
CmpTryToRundownHive
CmpWaitOnHiveWriteQueue
ExpWatchProductTypeWork
HvpFinishPrimaryWrite
NtCompactKeys
NtCompressKey
NtDeleteKey
NtFlushKey
NtNotifyChangeMultipleKeys
NtQueryOpenSubKeys
NtQueryOpenSubKeysEx
paramcount 0 0
address 140af6710 140af6710
sig undefined CmpUnlockRegistry(void) undefined CmpUnlockRegistry(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

__security_check_cookie

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 1.0
i_ratio 0.5
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name __security_check_cookie __security_check_cookie
fullname __security_check_cookie __security_check_cookie
refcount 3839 3840
length 30 30
called __report_gsfailure __report_gsfailure
calling
Expand for full list:
AdtpBuildAccessReasonAuditString
AdtpBuildAccessReasonAuditStringInternal
AdtpBuildAccessesString
AdtpBuildReplacementString
AdtpBuildSecurityDescriptorUnicodeString
AdtpBuildSidListString
AdtpBuildStagingReasonAuditStringInternal
AdtpBuildUserAccountControlString
AdtpFormatPrefix
AdtpInitializeDriveLetters
AdtpWriteToEtwAdtpWriteToEtwEx
AlpcViewDestroyProcedure
AlpcpAcceptConnectPort
AlpcpCheckConnectionSecurity
AlpcpConnectPort
AlpcpCreateConnectionPort
AlpcpExposeViewAttributeInSenderContext
AlpcpForceUnlinkSecureView
AlpcpImpersonateMessage
AlpcpInitSystem
AlpcpLogClosePort
AlpcpLogConnectFail
AlpcpLogConnectRequest
AlpcpLogConnectSuccess
AlpcpLogReceiveMessage
AlpcpLogSendMessage
AlpcpLogUnwait
AlpcpLogWaitForReply
AlpcpPortQueryConnectedSidInfo
AlpcpPrepareViewForDelivery
AlpcpQuerySidToken
AlpcpRestoreWriteAccess
AlpcpValidateAndSetPortAttributes
Amd64InitializeCacheStatus
Amd64InitializeDataFabricStatus
Amd64InitializeProfiling
Amd64InitializeUncoreProfiling
AnFwDisplayFade
ApiSetpLoadSchemaExtension
ApiSetpLoadSchemaExtensions
AppendUlongAsHexadecimalW
ArbBootAllocation
ArbBuildAssignmentOrdering
ArbInitializeOsInaccessibleRange
ArbQueryConflict
ArbRetestAllocation
ArbShareDriverExclusive
AslEnvGetProcessWowInfo
AslEnvGetSysNativeDirPathForGuestBuf
AslEnvGetSystem32DirPathBuf
AslFileMappingCreate
AslPathSplit
AslPathToSystemPath
AslRegistryEnumKey
AslRegistryGetUInt32_UStr
AslpFileGet16BitDescription
AslpFileGet16BitModuleName
AslpFileGetClrVersionAttribute
AslpFileGetExportName
AslpFileQueryVersionString
AstLogDeviceCreated
AstLogDeviceSDDLUpdated
AuthzBasepDeviceMemberOf
AuthzBasepEvaluateAceCondition
AuthzBasepInitializeResourceClaimsFromSacl
AuthzBasepMemberOf
B_TREE<_SM_PAGE_KEY,ST_STORE<SM_TRAITS>::ST_PAGE_ENTRY,4096,NP_CONTEXT,B_TREE_KEY_COMPARATOR<SM_PAGE_KEY>>::BTreeSearchResultDeref
B_TREE<union__SM_PAGE_KEY,struct_SMKM_STORE_MGR<struct_SM_TRAITS>::SMKM_FRONTEND_ENTRY,4096,struct_B_TREE_DUMMY_NODE_POOL,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY>>::BTreeSearchKey
B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY>>::BTreeFindLeafSibling
B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY>>::BTreeIteratorCleanup
B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY>>::BTreeIteratorFromSearchResult
B_TREE<unsigned_long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeSearchResultDeref
B_TREE<unsigned_long,ST_STORE<SM_TRAITS>::_ST_REGION_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeSearchResultDeref
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeFindLeafSibling
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeIteratorCleanup
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeIteratorFromSearchResult
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeFindLeafSibling
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeIteratorCleanup
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeIteratorFromSearchResult
BapdRecordFirmwareBootStats
BapdWriteEtwEvents
BapdpMarshallBootDataToRegistry
BapdpProcessBCDCache
BapdpProcessBitlockerStatus
BapdpProcessBootMetadata
BapdpProcessEDrvHintInfo
BapdpProcessEtwEvents
BapdpProcessFwUpdateResults
BapdpProcessHSTIResults
BapdpProcessResumeInformation
BapdpProcessSpacesBootInformation
BapdpProcessVsmKeyBlobs
BapdpProcessWmdResults
BapdpRecordIumStatus
BapdpRegisterWbclData
BcdGetElementDataWithFlags
BcdSetElementDataWithFlags
BcpDisplayErrorInformation
BcpDisplayProgress
BgkAcquireDisplayOwnership
BgkNotifyDisplayOwnershipChange
BgpGxDrawRectangle
BgpRasPrintGlyph
BiAddStoreFromFile
BiAdjustPrivilege
BiBindEfiBootManager
BiBindEfiEntries
BiBuildIdentifierList
BiCreateObject
BiCreatePartitionDevice
BiDeleteEfiVariable
BiDeleteElement
BiDoesHiveExist
BiEnumerateSubKeys
BiExportEfiBootManager
BiGetCurrentBootEntryIdentifier
BiGetDefaultBootEntryIdentifier
BiGetFirmwareType
BiGetNtPartitionPath
BiGetObjectReferenceFromEfiEntry
BiGetPartitionInformation
BiOpenStoreKeyFromObject
BiResolveLocateDevice
BiUpdateObjectReferenceInEfiEntry
CMFCheckAccess
CMFFlushHitsFile
CMFGetFileSizeEx
CMFRegisterEventTime
CMFSystemThreadRoutine
CarEtwCrashEvent
CarEtwRegister
CarEtwWriteBugCheckEvent
CarEtwWriteLiveDumpEvent
CarLiveDumpCallBack
CarLoadImageHandler
CarReadRegistry
CarTipLogDriverLoad
CcAsyncLazywriteWorker
CcAsyncLazywriteWorkerMulti
CcAsyncReadWorker
CcCachemapUninitWorkerThread
CcGetBcbListHeadLargeOffset
CcGetDeviceGuidAsync
CcPerfLogCanWriteFail
CcPerfLogExtraWBThreadAction
CcPerfLogFlushCache
CcPerfLogFlushSection
CcPerfLogLazyWriteScan
CcPerfLogScheduleReadAhead
CcPerfLogVolumeLogHandleInfo
CcPerfLogWorkItemEnqueue
CcPerformReadAhead
CcPostVolumeTelemetry
CcQueueLazyWriteScanThread
CcQueueLazyWriteScanThreadForVolume
CcSetVacbLargeOffset
CcUpdateDynamicRegistrySettings
CcWorkerThread
CimfsInitialize
CimfsInitializeBootDisk
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmCreateKey
CmDeleteKey
CmDeleteValueKey
CmEnumerateKey
CmEnumerateValueFromLayeredKey
CmEnumerateValueKey
CmEtwRunDown
CmFcInitSystem3
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerQueryFeatureConfigurationSectionInformation
CmFcManagerStartBootPhase
CmFcManagerStartRuntimePhase
CmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpChangeSubscriptionWrapper
CmFcpManagerArmFeatureUsageRetryTimer
CmGetSystemDriverList
CmInitSystem1
CmInitializeProcessor
CmIsLastKnownGoodBoot
CmKeyBodyRemapToVirtual
CmKeyBodyRemapToVirtualForEnum
CmKeyBodyReplicateToVirtual
CmKtmNotification
CmLoadAppKey
CmLoadDifferencingKey
CmLoadKey
CmLogMcUpdateStatus
CmLogTmRmAction
CmOpenKey
CmQueryFeatureConfigurationSections
CmQueryKey
CmQueryLayeredKey
CmQueryValueKey
CmReconcileAndValidateAllHives
CmRenameKey
CmReplaceKey
CmRestoreKey
CmRmFinalizeRecovery
CmSaveKey
CmSaveKeyToBuffer
CmSaveMergedKeys
CmSelectQualifiedInstallLanguage
CmSetAcpiHwProfile
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmShutdownSystem1
CmShutdownSystem2
CmSiAcquireProcessLockedPagesCharge
CmSiProcessTupleStartFromHandle
CmSiReleaseProcessLockedPagesCharge
CmSiSetProcessWorkingSetMaximum
CmUnloadKey
CmpAbortLightWeightTransaction
CmpAddAliasEntry
CmpAddProcessorConfigurationEntry
CmpAddRemoveContainerToCLFSLog
CmpAddRemoveRMLogContainer
CmpBounceContextStart
CmpCheckKeySecurityDescriptorAccess
CmpCheckValueList
CmpCleanUpKCBCacheTable
CmpCleanupLightWeightTransaction
CmpCleanupTransactionState
CmpCloneHwProfile
CmpCloseKeyObject
CmpCmdHiveClose
CmpCmdHiveOpen
CmpCommitPreparedLightWeightTransaction
CmpCompleteUnloadKey
CmpComputeLogFillLevel
CmpCreateControlSet
CmpCreateControlSetOverride
CmpCreateHardwareProfiles
CmpCreateHive
CmpCreateHwProfileFriendlyName
CmpCreatePerfKeys
CmpCreatePredefined
CmpCreateTemporaryHive
CmpDelayCloseWorker
CmpDoAccessCheckOnKCB
CmpDoAccessCheckOnLayeredSubtree
CmpDoBuildVirtualStack
CmpDoParseKey
CmpDoQueryKeyName
CmpDoReOpenTransKey
CmpEnumerateLayeredKey
CmpEtwDumpKcb
CmpFindControlSet
CmpFindMachineHiveByMountPoint
CmpFinishSystemHivesLoad
CmpFlushBackupHive
CmpFlushHive
CmpForceFlushWorker
CmpFreeAllMemory
CmpFullPromoteHiveRootFromKcbStack
CmpFullPromoteSingleKeyFromKeyNodeStacks
CmpGenerateAppHiveSecurityDescriptor
CmpGetAcpiProfileInformation
CmpGetBiosDate
CmpGetBiosVersion
CmpGetFileSize
CmpGetSubKeyCountForKcbStack
CmpGetSubKeyCountForKeyNodeStack
CmpGetSymbolicLinkTarget
CmpGetSystemControlValues
CmpGetValueCountForKeyNodeStack
CmpGetVirtualizationID
CmpGetVolumeClusterSize
CmpGetVolumeLogFileSizeCap
CmpHandlePageFileOpenNotification
CmpHiveRootSecurityDescriptor
CmpInitBackupHive
CmpInitCmRM
CmpInitHiveFromFile
CmpInitializeMachineDependentConfiguration
CmpInitializePreloadedHive
CmpInitializeRegistryNode
CmpInterlockedFunction
CmpKeyEnumStackStartFromKcbStack
CmpLateUnloadHiveWorker
CmpLightWeightCommitDeleteKeyUoW
CmpLinkHiveToMaster
CmpLoadHiveThread
CmpLoadHiveVolatile
CmpLoadKeyCommon
CmpLoadLayerVersions
CmpLoadSystemVersionData
CmpLogCheckpoint
CmpLogClearAccessBitsEvent
CmpLogEvent
CmpLogFailureToGetFileSize
CmpLogFlushPhaseEnd
CmpLogFlushPhaseStart
CmpLogHiveDestroyEvent
CmpLogHiveFileInaccessible
CmpLogHiveInitializeEvent
CmpLogHiveLinkEvent
CmpLogHiveRundownEvent
CmpLogReorganizeEvent
CmpLogTransactionAbortedByName
CmpLogTxrInitEvent
CmpLogUnsupportedOperation
CmpMachineHiveListInitialize
CmpMigrateOOBELanguageToInstallationLanguage
CmpMountPreloadedHives
CmpMoveBiosAliasTable
CmpNameFromAttributes
CmpNotifyChangeKey
CmpOpenDevicesControlSet
CmpOpenFileWithExtremePrejudice
CmpOpenHiveFile
CmpPartialPromoteSubkeys
CmpPerformUnloadKey
CmpPrepareLightWeightTransaction
CmpPromoteSingleKeyFromKcbStacks
CmpPromoteSingleKeyFromParentKcbAndChildKeyNode
CmpPromoteSubtree
CmpPublishEventForPcaResolver
CmpQueryHiveRedirectionFileList
CmpQueryLayerVersionString
CmpQueryLayerVersionUlong
CmpReadBuildVersion
CmpReorganizeHive
CmpReplicateKeyToVirtual
CmpReportAuditVirtualizationEvent
CmpResolveHiveLoadConflict
CmpRestampVersion
CmpRmUnDoPhase
CmpSaveBootControlSet
CmpSearchKeyControlBlockTreeEx
CmpSecurityMethod
CmpSendUnsupportedOperationTelemetryEvent
CmpSetKeySecurity
CmpSetSystemBiosInformation
CmpSetSystemValues
CmpSetVersionData
CmpSetVideoBiosInformation
CmpSetupConfigurationTree
CmpStartCLFSLog
CmpStartRMLogs
CmpStartSiloRegistryNamespace
CmpThreadInfoLogStack
CmpTraceHiveFlushStop
CmpTraceHiveFlushWroteLogFile
CmpTraceHiveFlushWrotePrimaryFile
CmpTraceHiveLoadStart
CmpTraceHiveLoadStop
CmpTraceHiveMountBaseFileMounted
CmpTraceHiveMountStart
CmpTraceHiveMountStop
CmpTraceHiveRestoreStart
CmpTraceHiveRestoreStop
CmpTraceHiveSaveFileCopied
CmpTraceHiveSaveStart
CmpTraceHiveSaveStop
CmpTraceHiveSaveTreeCopied
CmpTraceSecurityChanging
CmpTraceShutdownFlushStart
CmpTraceShutdownFlushStop
CmpTraceShutdownRundownComplete
CmpTraceShutdownStart
CmpTraceShutdownStop
CmpTransMgrCommit
CmpTransMgrCommitUoW
CmpTransMgrPrepare
CmpTransWriteLog
CmpUpdateReorganizeRegistryValues
CmpValueEnumStackStartFromKcbStack
CmpVolumeManagerGetContextForFile
CmpWaitOnHiveWriteQueue
ComputeFlushPeriod
ConstraintEval
CreateSystemRootLink
DbgkCaptureLiveDump
DbgkCopyProcessDebugPort
DbgkCreateMinimalProcess
DbgkCreateMinimalThread
DbgkCreateThread
DbgkExitProcess
DbgkExitThread
DbgkForwardException
DbgkMapViewOfSection
DbgkPostModuleMessage
DbgkQueueUserExceptionReport
DbgkRegisterErrorPort
DbgkSendSystemDllMessages
DbgkUnMapViewOfSection
DbgkUserReportWorkRoutine
DbgkpCreateNotificationEvent
DbgkpLkmdSnapKernelStack
DbgkpLkmdSnapThreadInContext
DbgkpLkmdSqmIncrementDword
DbgkpLkmdSqmIsOptedIn
DbgkpMarkProcessPeb
DbgkpPostFakeProcessCreateMessages
DbgkpPostFakeThreadMessages
DbgkpQueueMessage
DbgkpSendApiMessageLpc
DbgkpSendErrorMessage
DbgkpStartSystemErrorHandler
DbgkpWerCaptureLiveTriageDump
DbgkpWerIsFullLiveDumpDisabled
DbgkpWerWriteSecondaryData
DrvDbGetConfigurationSubKeyCallback
DrvDbGetObjectSubKeyList
EmInitSystem
EmonInitializePebs
EmonInitializeProfiling
EmonReleaseProfileResourcesInternal
EmpCacheBiosDate
EmpInfParseGetGuidFromName
EmpParseCallbacks
EmpParseEntryTypes
EmpParseRuleTerm
EmpParseRules
EmpParseTargetRules
EnableFlushTimer
EtwKernelMemoryRundown
EtwLogPfnInfoRundown
EtwQueryProcessTelemetryInfo
EtwSetPerformanceTraceInformation
EtwShutdown
EtwStartAutoLogger
EtwTelemetryCoverageReport
EtwTiLogAllocExecVm
EtwTiLogDeviceObjectLoadUnload
EtwTiLogDriverObjectLoad
EtwTiLogDriverObjectUnLoad
EtwTiLogInsertQueueUserApc
EtwTiLogMapExecView
EtwTiLogProtectExecVm
EtwTiLogReadWriteVm
EtwTiLogSetContextThread
EtwTiLogSuspendResumeProcess
EtwTiLogSuspendResumeThread
EtwTimLogBlockNonCetBinaries
EtwTimLogControlProtectionKernelModeReturnMismatch
EtwTimLogControlProtectionUserModeReturnMismatch
EtwTimLogProhibitChildProcessCreation
EtwTimLogProhibitLowILImageMap
EtwTimLogProhibitNonMicrosoftBinaries
EtwTimLogRedirectionTrustPolicy
EtwTimLogUserCetSetContextIpValidationFailure
EtwTraceAntiStarvationBoost
EtwTraceAppStateChange
EtwTraceAutoBoostClearFloor
EtwTraceAutoBoostEntryExhaustion
EtwTraceAutoBoostSetFloor
EtwTraceContFreeEvent
EtwTraceCumulativeDpcSoftTimeout
EtwTraceDebuggerEvent
EtwTraceDequeueWork
EtwTraceDpcEnqueueEvent
EtwTraceDpcProfilingStack
EtwTraceDpcProfilingStackBegin
EtwTraceDuplicateHandle
EtwTraceEnqueueWork
EtwTraceEvent
EtwTraceFreezeThawProcess
EtwTraceIdealProcessor
EtwTraceInswapProcess
EtwTraceIoTimerEvent
EtwTraceJob
EtwTraceJobAssignProcess
EtwTraceJobRemoveProcess
EtwTraceJobSendNotification
EtwTraceJobServerSiloMonitorCallback
EtwTraceJobServerSiloStateChange
EtwTraceJobSetQuery
EtwTraceLeapSecondDataParseFailure
EtwTraceLeapSecondDataUpdate
EtwTraceLongDpcDetectionEvent
EtwTraceLongDpcMitigationEvent
EtwTraceLpacAccessFailure
EtwTraceMemoryAcg
EtwTraceObject
EtwTraceObjectOperation
EtwTracePageFault
EtwTracePool
EtwTracePriority
EtwTraceProcess
EtwTraceProcessSetInPrivateMode
EtwTraceProcessTerminate
EtwTraceReadyThread
EtwTraceRetpolineExit
EtwTraceShouldYieldProcessor
EtwTraceSiloTimedEvent
EtwTraceSingleDpcSoftTimeout
EtwTraceSystemTimeChange
EtwTraceThread
EtwTraceThreadAffinity
EtwTraceThreadFeedbackRead
EtwTraceThreadSetName
EtwTraceThreadWorkItem
EtwTraceThreadWorkOnBehalfUpdate
EtwTraceTimeZoneBiasChange
EtwTraceTimeZoneInformationRefresh
EtwTraceTimedEvent
EtwTraceWakeCounter
EtwTraceWakeEvent
EtwTraceWorkingSetInSwapStoreFail
EtwTraceWorkingSetSwap
EtwTraceWorkloadClassUpdate
EtwTraceXSchedulerPriorityKickReceive
EtwTraceXSchedulerPriorityUpdate
EtwWmitraceWorker
EtwWriteEndScenario
EtwWriteErrorLogEntry
EtwWriteEx
EtwWriteStartScenario
EtwWriteString
EtwpAddLogHeader
EtwpAddMicroarchitecturalPmcToRegistry
EtwpAddRegEntryToGroup
EtwpApplyEventNameFilter
EtwpApplyPackageIdFilter
EtwpApplyPayloadFilterInternal
EtwpBufferingModeFlush
EtwpCCSwapFlush
EtwpCalculateUpdateNotification
EtwpCheckGuidAccessAndDoRundown
EtwpClearSessionAndUnreferenceEntry
EtwpClockSourceRunDown
EtwpCovSampCaptureContextStart
EtwpCovSampContextAddAddresses
EtwpCovSampContextPruneModules
EtwpCovSampEnumerateProcess
EtwpCoverageFlushPending
EtwpCoverageRecord
EtwpCoverageRecordAtHighIrql
EtwpCoverageSamplerQuery
EtwpCreateKeyTreeForPath
EtwpCreateLogFile
EtwpCreatePerfectHashFunction
EtwpCrimsonProvEnableCallback
EtwpDiskProvTraceDisk
EtwpEnableAutoLoggerProvider
EtwpEnableGuid
EtwpEnableKernelTrace
EtwpEnableKeyProviders
EtwpEnableMetaProviderGuid
EtwpEnumerateAddressSpace
EtwpEnumerateAutologgerPath
EtwpEventTracingCounterSetCallback
EtwpEventWriteCaptureState
EtwpEventWriteDebugLookupFailed
EtwpEventWriteEnableInfo
EtwpEventWriteFull
EtwpEventWriteGuidEntry
EtwpEventWriteProviderAccessCheckStatus
EtwpEventWriteProviderEnabled
EtwpEventWriteRegEntry
EtwpEventWriteRegistrationStatus
EtwpEventWriteTemplateAdmin
EtwpEventWriteTemplateBackingFile
EtwpEventWriteTemplateMaxFileSize
EtwpEventWriteTemplateSessAndProv
EtwpEventWriteTemplateSession
EtwpEventWriteTemplateSessionEnd
EtwpExecutiveResourceConfigRunDown
EtwpFileModeCompress
EtwpFinalizeHeader
EtwpFindMatchingPmcRegistryGroup
EtwpFixBootLoggers
EtwpFlushActiveBuffers
EtwpGetAutoLoggerEventNameFilter
EtwpGetAutoLoggerLevelKwFilter
EtwpGetAutoLoggerProviderFilter
EtwpGetLoggerInfoFromContext
EtwpGetMicroarchitecturalPmcAffinity
EtwpGetPmcCpuHierarchyRegistry
EtwpGetSecurityDescriptorByGuid
EtwpGetSidExtendedHeaderItem
EtwpInitializeActivityIdSeed
EtwpInitializeAutoLoggers
EtwpInitializeSecurity
EtwpLoadMicroarchitecturalPmcs
EtwpLoadMicroarchitecturalProfileGroup
EtwpLoadMicroarchitecturalProfileSource
EtwpLogGroupMask
EtwpLogMemInfo
EtwpLogMemInfoRundown
EtwpLogMemInfoTimerCallback
EtwpLogMemInfoWs
EtwpLogMemInfoWsHelper
EtwpLogMemNodeInfo
EtwpLogProcessPerfCtrs
EtwpLogRefSetAutoMark
EtwpLogRegistryEvent
EtwpLogSessionWorkingSetInfo
EtwpLogTxREvent
EtwpObjectHandleEnumCallback
EtwpObjectTypeRundown
EtwpPmcInterrupt
EtwpPoolRunDown
EtwpProcessEnumCallback
EtwpProcessPerfCtrsRundown
EtwpProcessorRundown
EtwpProfileInterrupt
EtwpProviderArrivalCallback
EtwpPsProvCaptureState
EtwpPsProvProcessEnumCallback
EtwpPsProvTraceImage
EtwpPsProvTraceJob
EtwpPsProvTracePriority
EtwpPsProvTraceProcess
EtwpPsProvTraceThread
EtwpQueryPartitionRegistryInformation
EtwpQueryPsmKey
EtwpReadConfigParameters
EtwpRealtimeInjectEtwBuffer
EtwpRealtimeRestoreState
EtwpRealtimeSaveState
EtwpRegTraceCallback
EtwpRegisterKMProvider
EtwpRemoveMicroarchitecturalPmcFromPmcGroup
EtwpSampledProfileRunDown
EtwpSavePersistedLogger
EtwpSendDataBlock
EtwpSendSessionNotification
EtwpSetCoverageSamplerInformation
EtwpSetMark
EtwpSetProviderTraitsCommon
EtwpSpinLockConfigRunDown
EtwpStackRundown
EtwpStackWalkApc
EtwpStartLogger
EtwpStopLoggerInstance
EtwpSysModuleRunDown
EtwpSystemTraceWdf
EtwpTiQueryVad
EtwpTimLogMitigationForProcess
EtwpTraceALPC
EtwpTraceCachedStack
EtwpTraceDebugPrint
EtwpTraceFileName
EtwpTraceFltIo
EtwpTraceHandle
EtwpTraceImageRundown
EtwpTraceImageUnload
EtwpTraceIo
EtwpTraceIoInit
EtwpTraceLastBranchRecord
EtwpTraceLostEvent
EtwpTraceLostSystemEvent
EtwpTraceLostWppEvent
EtwpTraceMessageVa
EtwpTraceNetwork
EtwpTraceOpticalIo
EtwpTraceOpticalIoInit
EtwpTraceProcessRundown
EtwpTraceProcessorTrace
EtwpTraceRedirectedIo
EtwpTraceSavePersistedLoggerStop
EtwpTraceSplitIo
EtwpTraceStackWalk
EtwpTraceSystemInitialization
EtwpTraceSystemShutdown
EtwpTraceThreadRundown
EtwpTraceWdf
EtwpTrackGuidEntryRegistrations
EtwpUMGLEnabled
EtwpUpdateFileHeader
EtwpUpdateGlobalGroupMasks
EtwpUpdateGroupMasks
EtwpUpdateLoggerGroupMasks
EtwpUpdatePeriodicCaptureState
EtwpUpdateProcessTracingCallback
EtwpUpdateSelectedGroupMasks
EtwpWriteAppStateChange
EtwpWriteAppStateChangeSummary
EtwpWriteAppStateChangeWithStats
EtwpWriteProcessEvent
EtwpWriteProcessStarted
EtwpWriteProcessorTrace
EtwpWriteUserEvent
ExAllocateCacheAwarePushLock
ExCallSessionCallBack
ExCreatePool
ExGetExpirationDate
ExInitLicenseData
ExInitializeUtcTimeZoneBias
ExLogTimeZoneInformation
ExProcessCounterSetCallback
ExProcessorCounterSetCallback
ExRaiseException
ExRaiseHardError
ExRngInitializeSystem
ExSweepHandleTable
ExUpdateSystemTimeFromCmos
ExpAeThresholdInitialization
ExpCheckThreadHistory
ExpCloudbookHardwareIDProvider
ExpCloudbookHardwareLockedProvider
ExpConvertSignatureName
ExpCovQueryInformation
ExpCovResetInformation
ExpCreateOutputEFI
ExpDebuggerWorker
ExpFindDiskSignature
ExpFirmwareAccessAppContainerCheck
ExpGenuinePolicyPostProcess
ExpGetOriginalImageVersionRegistryValue
ExpGetProcessInformation
ExpGetSystemFirmwareTableInformation
ExpGetSystemFlushInformation
ExpGetSystemPlatformBinary
ExpInitFullProcessSecurityInfo
ExpKdPullRemoteFileForUser
ExpKernelExpirationDateCacheProvider
ExpLogRefreshTimeZoneInformationCutoverFail
ExpLogRefreshTimeZoneInformationQueryFail
ExpLogRefreshTimeZoneInformationSuccess
ExpNodeCreateSystemThread
ExpNtDeleteWnfStateData
ExpNtUpdateWnfStateData
ExpParseArcPathName
ExpProfileCreate
ExpQueryProcessorInformationCounters
ExpQuerySystemInformation
ExpRaiseHardError
ExpReadComPlusPackage
ExpReadLeapSecondData
ExpRefreshTimeZoneInformation
ExpSaPageGroupDescriptorAllocate
ExpSecurePoolDestroy
ExpSeedHotTags
ExpSetBootEntry
ExpSetDriverEntry
ExpSetPendingUILanguage
ExpSetSoftRebootFlags
ExpSetTimeZoneInformation
ExpSetTimer2
ExpStringCheck
ExpSvmServicePageFault
ExpSystemErrorHandler2
ExpTrackTableInsertLimit
ExpTranslateEfiPath
ExpTranslateHexStringToGUID
ExpUpdateProductSuiteTypeInRegistry
ExpUpdateTimerConfiguration
ExpUuidLoadSequenceNumber
ExpUuidSaveSequenceNumber
ExpWatchLicenseInfoWork
ExpWatchProductTypeInitialization
ExpWatchProductTypeWork
ExpWnfAllocateNextPersistentNameSequence
ExpWnfDeletePermanentName
ExpWnfDeletePermanentStateData
ExpWnfDispatchKernelSubscription
ExpWnfLookupPermanentName
ExpWnfPopulateStateData
ExpWnfRegisterPermanentName
ExpWnfWriteStateData
ExpWorkQueueManagerThread
ExpWorkerThread
ExtEnvRegisterIommu
ExtEnvSetVpptTarget
FUN_140687e40
FUN_14068ad70
FUN_140709bb0
FUN_140768f34
FUN_14084356c
FUN_140a4b524
FUN_140a4e0ec
FindBitmapResource
FopReadCmapTable
FopReadNamingTable
FsRtlAcquireFileExclusiveCommon
FsRtlAcquireFileForCcFlushEx
FsRtlAcquireFileForModWriteEx
FsRtlAcquireToCreateMappedSection
FsRtlAddDiskIOCounterInstance
FsRtlCheckOplockEx2
FsRtlCheckOplockForFsFilterCallback
FsRtlCheckUpperOplock
FsRtlDedupChangeInit
FsRtlGetCompatibilityModeValue
FsRtlGetFileExtents
FsRtlGetFileSize
FsRtlGetSectorSizeInformation
FsRtlGetTunnelParameterValue
FsRtlGetVirtualDiskNestingLevel
FsRtlHeatInit
FsRtlIsDbcsInExpression
FsRtlIssueFileNotificationFsctl
FsRtlNotifyVolumeEvent
FsRtlOpenFileSystemRegistryKeyFromFsGuid
FsRtlQueryCachedVdl
FsRtlQueryOpen
FsRtlReleaseFile
FsRtlReleaseFileForCcFlush
FsRtlReleaseFileForModWrite
FsRtlSendModernAppTermination
FsRtlVolumeDeviceToCorrelationId
FsRtlpAcknowledgeOplockBreakByCacheFlags
FsRtlpAttachOplockKey
FsRtlpCancelOplockRHIrp
FsRtlpCancelWaitingIrp
FsRtlpComputeShareableOplockState
FsRtlpGetMaxVirtualDiskNestingLevel
FsRtlpGrantAnyOplockFromExclusive
FsRtlpOplockBreakByCacheFlags
FsRtlpOplockCleanup
FsRtlpReleaseIrpsWaitingForRH
FsRtlpRemoveAndCompleteRHIrp
FsRtlpRemoveAndCompleteReadOnlyIrp
FsRtlpRemoveAndCompleteWaitingIrp
FsRtlpRequestExclusiveOplock
FsRtlpRequestShareableOplock
FsRtlpWaitOnIrp
GetOperatorIndexByName
GetPrintableOperandValue
GxpWriteFrameBufferPixels
HalAllocateHardwareCounters
HalCreateCommonBufferFromMdl
HalCreateCommonBufferFromMdlDmaThin
HalCreateCommonBufferFromMdlDmarThin
HalEfiGetTime
HalEfiSetTime
HalGetEnvironmentVariableEx
HalMatchAcpiOemId
HalMatchAcpiOemTableId
HalQueryEnvironmentVariableInfoEx
HalQueryRealTimeClock
HalSendNMI
HalSetEnvironmentVariableEx
HalSetRealTimeClock
HalSocRequestApi
HalSocRequestConfigurationData
HaliAcpiMachineStateInit
HaliQuerySystemInformation
HaliWheaInitProcessorGenericSection
HalpAcpiPostSleep
HalpAddMcaToProcessorSpecificSection
HalpAllocatePmcCounterSetEx
HalpArtDiscover
HalpBiosDisplayReset
HalpBuddyAllocatorAllocateLogicalAddress
HalpCheckSratMemoryRanges
HalpCmcLogPollingTimeoutEvent
HalpCmcPollProcessor
HalpCmcWorkerRoutine
HalpCmciHandler
HalpCmciInit
HalpCmciLoadThresholdConfiguration
HalpCpuID
HalpCreateMachineCheckErrorRecord
HalpDmaFinalizeDoubleBufferingDisposition
HalpDmaInitPowerManagement
HalpEnumerateEnvironmentVariablesWithFilter
HalpExtBuildResourceIdString
HalpExtRegisterResourceDescriptor
HalpFreePmcCounterSet
HalpGenInitialRead
HalpGetNumaProcMemoryCount
HalpGetPCIData
HalpHandlePreviousMcaErrors
HalpHpetDiscover
HalpHvCpuid
HalpHvEpCpuid
HalpHvIsFrequencyAvailable
HalpHvIsX2ApicRecommended
HalpHvMapDeviceInterrupt
HalpHvMapDeviceMsiRange
HalpHvMceConsumedMemoryErrorRecovery
HalpHvRetargetDeviceMsiInterrupt
HalpHvRetargetIoApicDeviceInterrupt
HalpHvStartProcessor
HalpHvStartVirtualProcessor
HalpHvUnmapDeviceInterrupt
HalpHvUnmapDeviceMsiRange
HalpHvWatchdogDiscover
HalpInitChipHacks
HalpInitGenericErrorSourceEntry
HalpInitGenericErrorSourceEntryV2
HalpInitializeMce
HalpInitializeProfiling
HalpInterruptConnect
HalpInterruptEnableNmi
HalpInterruptGetIrtInfo
HalpInterruptGetX2ApicPolicy
HalpInterruptInitDiscard
HalpInterruptInitPowerManagement
HalpInterruptRegisterController
HalpInterruptSendIpi
HalpIommuAllocateDmaDomain
HalpIommuCleanupPageTable
HalpIommuConfigureInterrupt
HalpIommuDmarPageTableMarkHiberPhase
HalpIommuInitDiscard
HalpIommuInitializeAll
HalpIommuLogEarlyFault
HalpIommuMapLogical
HalpIommuMapLogicalRange
HalpIommuTraceFault
HalpIommuUnmapLogicalRange
HalpIsHvIptSupported
HalpIsHvPresent
HalpIsHvUsedForReboot
HalpIsMicrosoftCompatibleHvLoaded
HalpIsPartitionCpuManager
HalpIsXboxNanovisorPresent
HalpIumGetTime
HalpIumQueryVariableInfo
HalpIumResetSystem
HalpIumSetTime
HalpLbrInitialize
HalpLoadMicrocodeSerialized
HalpMcEnumerateAndSetPatchConfig
HalpMcaExtendedLogGetL1DirectoryBase
HalpMcaInitializeErrorSection
HalpMcaReadError
HalpMcaReportError
HalpMcaResumeProcessorConfig
HalpMceInit
HalpMceInitializeRecovery
HalpNmiReboot
HalpNumaAddRangeProximity
HalpPciCheckAmdK8
HalpPciReadSecondaryBusNumber
HalpPiix4Detect
HalpPmTimerDiscover
HalpProcGetFeatureBits
HalpQueryCapsuleCapabilities
HalpReadExtendedMcaRegistersAMD
HalpRegisterDmaController
HalpReportResourceUsage
HalpRtcDiscover
HalpSecondaryInterruptQueryPrimaryInformation
HalpSetPCIData
HalpSetShutdownResetHandler
HalpStopLegacyUsbInterruptsInternal
HalpTimerConfigureInterrupt
HalpTimerEnableHypervisorTimer
HalpTimerInitPowerManagement
HalpTimerInitializeHypervisorTimer
HalpTimerInitializeProfiling
HalpTimerMeasureAllProcessorFrequencies
HalpTimerQueryAndResetRtcErrors
HalpTimerRegister
HalpTimerStallExecutionProcessor
HalpTimerTraceTimingHardware
HalpTimerUnmapInterrupt
HalpTimerWatchdogTriggerSystemReset
HalpTscAdvSynchCalculateRemoteDeltas
HalpTscAdvSynchLeader
HalpTscCheckAdjustMsrCapability
HalpTscFallbackToPlatformSource
HalpTscReportSyncStatus
HalpTscSynchronization
HalpTscSynchronizationWorker
HalpTscTraceProcessorSynchronization
HalpTscTraceStatus
HalpUpdateCapsule
HalpUsbLegacyScanBusForHandoff
HalpUsbLegacyStopOhciInterrupt
HalpUsbLegacyStopUhciInterrupt
HalpValidPCISlot
HalpWdatDiscover
HalpWheaNativeCpuid
HashpVerifyPkcs1Signature
HdlspAddLogEntry
HdlspBugCheckProcessing
HdlspDispatch
HdlspKernelAddLogEntry
HdlspPutMore
HdlspSendBlueScreenInfo
HeadlessInit
HsaDismissPageFault
HsaGetPageFault
HsaInitializeIommu
HsaUpdateDeviceTableEntry
HsaUpdateRemappingTableEntry
HvAnalyzeLogFiles
HvLoadHive
HvRecoverFlushProtocolStateFromFiles
HvSwapLogFiles
HviGetHardwareFeatures
HviGetIptFeatures
HviIsAnyHypervisorPresent
HviIsHypervisorMicrosoftCompatible
HviIsHypervisorVendorMicrosoft
HviIsXboxNanovisorPresent
HvipApertureDetectParameters
HvlAttachPasidSpace
HvlAttachPrQueue
HvlCollectLivedump
HvlCreatePasidSpace
HvlCreatePrQueue
HvlDebuggerSupportInitialize
HvlDisablePasid
HvlDmaAllocateDeviceDomain
HvlDmaAttachDeviceDomain
HvlDmaConfigureDeviceDomain
HvlDmaDeleteDeviceDomain
HvlDmaFlushDeviceDomain
HvlDmaGetDmaGuardEnabled
HvlDmaGetHybridPassthroughReservedRegions
HvlDmaMapDeviceLogicalRange
HvlDmaMapDeviceSparsePages
HvlDmaReserveDeviceDomainAttachment
HvlDmaUnmapDeviceLogicalRange
HvlDmaUnmapDeviceSparsePages
HvlEnablePasid
HvlEnterSleepState
HvlGetCoverageData
HvlGetCoverageInfo
HvlGetDeviceCapabilities
HvlGetImplementedPhysicalBits
HvlGetSystemPasidCapabilities
HvlHvDebuggerPowerHandler
HvlInvokeFastExtendedHypercall
HvlInvokeHypercall
HvlIsSingleGroupRequired
HvlMapDeviceInterrupt
HvlNotifyAllProcessorsStarted
HvlNotifyDebugDeviceAvailable
HvlNotifyHpetEnabled
HvlNotifyRootCrashdump
HvlParkedVirtualProcessors
HvlPrepareForRootCrashdump
HvlPrepareForSecureHibernate
HvlQueryDetailInfo
HvlQueryHypervisorTscAdjustment
HvlQueryVsmProtectionInfo
HvlResetCoverageVector
HvlRestoreTime
HvlResumeFromRootCrashdump
HvlRetargetDeviceInterrupt
HvlSendSyntheticClusterIpi
HvlSetDeviceCapabilities
HvlSetDeviceDmaEnabled
HvlSetHpetConfig
HvlSetPasidAddressSpace
HvlSetQpcBias
HvlSetRootFaultReportingReady
HvlSetSystemMachineCheckProperty
HvlSetSystemSleepProperty
HvlUnblockDefaultDma
HvlUnmapDeviceInterrupt
HvlpCheckTscSync
HvlpDetermineEnlightenments
HvlpDiscoverTopologyAmd
HvlpDiscoverTopologyIntel
HvlpDynamicUpdateMicrocode
HvlpFastFlushAddressSpaceTb
HvlpFastFlushAddressSpaceTbEx
HvlpFastFlushListTb
HvlpFastFlushListTbEx
HvlpFastFlushPasidAddressList
HvlpFastSendSyntheticClusterIpiEx
HvlpGetVtlCallVa
HvlpInvokeGetPageListHypercall
HvlpLogGuestStateScrubbingStatus
HvlpLogHypervisorLaunchError
HvlpLogHypervisorSchedulerType
HvlpLogIommuInitStatus
HvlpLogMicrocodeUpdateStatus
HvlpLogProcessorStartupFailure
HvlpMapStatisticsPage
HvlpProcessIommu
HvlpQueryExtendedCapabilities
HvlpQueryHypervisorSchedulerType
HvlpSelectLpSet
HvlpSelectVpSet
HvlpSlowFlushAddressSpaceTb
HvlpSlowFlushAddressSpaceTbEx
HvlpSlowFlushListTb
HvlpSlowFlushListTbEx
HvlpSlowSendSyntheticClusterIpiEx
HvlpTryConfigureInterface
HvlpWithdrawPages
HvlpWritePerfRegister
HvpApplyIncrementalLogFile
HvpApplyLegacyLogFile
HvpDetermineLogFileApplicationOrder
HvpGenerateLogEntryChecksums
HvpGenerateLogEntryHeader
HvpIncrementalLogFileEnumeratorAdvance
HvpIsReadErrorTransient
HvpLogEntryCheckDataChecksum
HvpLogEntryCheckHeaderChecksum
HvpLogInvalidLogHeader
HvpLogUnreadableLog
HvpMarkDirty
HvpSwapDual
I_MinCryptCheckEKURequirements
InitBootProcessor
InitSafeBoot
IoBoostThreadIoPriority
IoCaptureLiveDump
IoConfigureCrashDump
IoCreateDevice
IoCreateDisk
IoCreateDriver
IoEnumerateEnvironmentVariablesEx
IoEnumerateKsrPersistentMemoryEx
IoGetDeviceDirectory
IoGetDeviceInterfaceAlias
IoGetDeviceProperty
IoGetDmaAdapter
IoGetEnvironmentVariableEx
IoInitSystemPreDrivers
IoInitializeProcessor
IoIsValidNameGraftingBuffer
IoQueryEnvironmentVariableInfoEx
IoQueryInformationByName
IoRaiseHardError
IoReadDiskSignature
IoReadPartitionTable
IoReadPartitionTableEx
IoRegisterPlugPlayNotification
IoRemoveIoCompletion
IoReportDetectedDevice
IoReportRootDevice
IoReserveKsrPersistentMemoryEx
IoReuseIrp
IoSaveBugCheckProgress
IoSaveBugCheckRecoveryStatus
IoSetEnvironmentVariableEx
IoSetPartitionInformation
IoSetPartitionInformationEx
IoSetSystemPartition
IoStartIoRateControl
IoTranslateBusAddress
IoVerifyPartitionTable
IoVolumeDeviceNameToGuidPath
IoVolumeDeviceToDosName
IoVolumeDeviceToGuidPath
IoWMIOpenBlock
IoWMIQueryAllData
IoWMIQueryAllDataMultiple
IoWMIQuerySingleInstanceMultiple
IoWriteCapturedPristineTriageDumpToDedicatedDumpFile
IoWriteCrashDump
IoWriteDeferredLiveDumpData
IoWritePartitionTable
IoWritePartitionTableEx
IommupHvAttachPasidDevice
IommupHvAttachPasidDeviceDomain
IommupHvDismissPageFault
IommupHvGetDeviceAtsCapability
IommupHvGetDeviceSvmCapabilities
IommupHvInitializeLibrary
IommupHvIsDmarStageCompatible
IommupHvIsStage1DmarCompatible
IommupHvValidatePageRequestGpa
IopApplySystemPartitionProt
IopAttachDeviceToDeviceStackSafe
IopBootLog
IopCachePreviousBootData
IopCallDriverReference
IopCaptureObjectName
IopCollectTriageDumpData
IopConnectInterruptFullySpecified
IopConnectLinkTrackingPort
IopConnectMessageBasedInterrupt
IopCopyBootLogRegistryToFile
IopCrashDumpPolicyChangeWnfCallback
IopCreateArcName
IopCreateArcNames
IopCreateArcNamesCd
IopCreateArcNamesDisk
IopDumpTraceCrashDumpDisabled
IopDumpTraceCrashDumpReconfiguration
IopDumpTraceDisableCrashDumpFailure
IopDumpTraceForceDumpDisabled
IopDumpTraceFreeDumpStackFailure
IopDumpTraceInitializeCrashDumpFailure
IopDumpTraceInitializeDumpStackFailure
IopDumpTraceLoadCrashDumpDriverFailure
IopDumpTraceLoadDumpStackFailure
IopErrorLogThread
IopFastQueryNetworkAttributes
IopFileUtilClearAttributes
IopFileUtilWalkDirectoryTreeBottomUp
IopFileUtilWalkDirectoryTreeTopDown
IopFreeBandwidthContract
IopGetBootDiskInformation
IopGetBootDiskInformationLite
IopGetDeviceInterfaces
IopGetFileVolumeNameInformation
IopGetNetworkOpenInformation
IopGetVolumeId
IopInitActivityIdIrp
IopInitCrashDumpDuringSysInit
IopInitializeBootDrivers
IopInitializeDumpPolicySettings
IopInitializeInMemoryDumpData
IopInitializeOfflineCrashDump
IopInitializePlugPlayServices
IopInitializeResourceMap
IopInitializeSystemVariableService
IopIoRateStartRateControl
IopIrpStackProfilerDpcRoutine
IopIsNotNativeDriverImage
IopIsReportedAlready
IopIssueTrEERequest
IopLiveDumpAllocAndInitResources
IopLiveDumpAllocateExtraBuffers
IopLiveDumpAllocateFromVMMemoryPartition
IopLiveDumpCallRemovePagesCallbacks
IopLiveDumpCaptureMemoryPages
IopLiveDumpEstimateMemoryPages
IopLiveDumpIsUnderMemoryPressure
IopLiveDumpMarkImportantDumpData
IopLiveDumpOpenVMMemoryPartition
IopLiveDumpPolicyChangeWnfCallback
IopLiveDumpRegisterWnfNotificationCallback
IopLiveDumpTraceAllocationFromVMMemoryPartitionFailure
IopLiveDumpTraceBufferAllocation
IopLiveDumpTraceBufferEstimation
IopLiveDumpTraceCaptureGenerateIptSecondaryDataDuration
IopLiveDumpTraceCaptureMemoryPages
IopLiveDumpTraceCaptureProcessorContextDuration
IopLiveDumpTraceCorralProcessorsDuration
IopLiveDumpTraceDumpDisabledOnBoot
IopLiveDumpTraceDumpFileWriteEnd
IopLiveDumpTraceEstimatedAndAllocatedPageCount
IopLiveDumpTraceHvlPrepareLivedumpDescriptorFailure
IopLiveDumpTraceInterfaceEnd
IopLiveDumpTraceMarkImportantDumpDataDuration
IopLiveDumpTraceMarkRequiredDumpDataDuration
IopLiveDumpTraceMmDuplicateMemoryFailure
IopLiveDumpTraceOpenVMMemoryPartitionFailure
IopLiveDumpTracePopulateBitmapForDumpDuration
IopLiveDumpTraceQueryHvlDumpSizeFailure
IopLiveDumpTraceRemovePagesCallbackFailure
IopLiveDumpTraceUncorralProcessorsDuration
IopLiveDumpWriteDumpFile
IopLiveDumpWriteDumpFileWithExtraPages
IopLiveDumpWriteSecondaryData
IopLoadDriver
IopLogAuditIoRegisterNotificationEvent
IopMarkBootPartition
IopMountVolume
IopOpenLinkOrRenameTarget
IopParseDevice
IopPassiveInterruptWorker
IopPerfCompleteRequest
IopPerfCompletionRoutine
IopPerfLogCallEvent
IopPerfLogCallReturnEvent
IopProcessIoTracking
IopProcessSetInterfaceState
IopProcessWorkItem
IopProtectSystemPartition
IopQueryDockRemovalInterface
IopQueryEnvironmentVariableInfoSysEnv
IopQueryEnvironmentVariableInfoTrEE
IopQueryPassiveInterruptRegistryOptions
IopQueryResourceHandlerInterface
IopRaiseHardError
IopReassignSystemRoot
IopRegisterDeviceInterface
IopSendMessageToTrackService
IopSetRemoteLink
IopStoreSystemPartitionInformation
IopSymlinkQueryEnabledClasses
IopSynchronousServiceTail
IopTimerDispatch
IopTraceCrashDumpDisabledOnBoot
IopTrackLink
IopWriteCapsuleTriageDumpToFirmware
IopXxxControlFile
IovCompleteRequest
IovpCallDriverWithStackBuffer
IpmiLibAddSelRecord
IpmiLibpAddSelRawData
IpmiLibpKcsRequestAndReceive
IvtDismissPageFault
IvtDrainSvmPageRequests
IvtFlushDeviceTbOnly
IvtFlushTbInternal
IvtInitializeIommu
IvtInitializeScalableModePasidTables
IvtInvalidateAllContextEntries
IvtInvalidateContextEntry
IvtInvalidateRemappingTableEntries
IvtInvalidateScalableModePasidCache
IvtIommuWaitCommand
IvtSetPasidAddressSpace
IvtUpdateRemappingTableEntry
IvtUpdateScalableModeContextEntry
IvtUpdateScalableModePasidTablesForPasid
KGetUnlockSetting
KdInitSystem
KdSendTraceData
KdpCloseRemoteFile
KdpCreateRemoteFile
KdpPrint
KdpPrintString
KdpPrompt
KdpPromptString
KdpReadRemoteFile
KdpReportCommandStringStateChange
KdpReportExceptionStateChange
KdpReportLoadSymbolsStateChange
KdpRestoreBreakPointEx
KdpSearchMemory
KdpSendWaitContinue
KdpWriteBreakPointEx
KeAddEnclavePage
KeAdjustInterruptTime
KeAndGroupAffinityEx
KeBoostPriorityThread
KeCanChangeEnclavePageProtection
KeChangeEnclavePageProtection
KeCommitSmtState
KeCopyPrivilegedPage
KeCopyXfdMaskToTeb
KeCpuSetReportParkedProcessors
KeCreateEnclave
KeDeleteCpuPartition
KeDisableTimer2
KeEnumerateKernelStackSegments
KeFlushCurrentTbOnly
KeFlushIoBuffers
KeFlushMultipleRangeCurrentTb
KeFlushQueuedDpcs
KeFlushSingleCurrentTb
KeFlushSingleTb
KeForceAttachProcess
KeForceDetachProcess
KeFreezeExecution
KeGenericProcessorCallback
KeGetTbSize
KeInitSystem
KeInitializeClock
KeIntSteerPeriodic
KeIntSteerSnapPerf
KeIsSubsetAffinityEx
KeLoadMTRR
KeMaskInterrupt
KeOutPageEnclavePage
KePrepareClockTimerForIdle
KePrepareNonClockOwnerForIdle
KeQueryCpuPartitionAffinity
KeQueryTotalCycleTimeThread
KeRebootSystemForRecovery
KeRecomputeCpuSetAffinityProcess
KeRegisterProcessorChangeCallback
KeRemoveQueueDpcEx
KeRemoveQueueEx
KeRequestTerminationThread
KeRestoreProcessorSpecificFeatures
KeResumeClockTimerFromIdle
KeRevertToUserAffinityThread
KeRevertToUserAffinityThreadEx
KeRevertToUserMultipleGroupAffinityThread
KeSecureProcess
KeSetAffinityProcess
KeSetBasePriorityThread
KeSetCpuSetsProcess
KeSetIntervalProfile
KeSetPagePrivilege
KeSetPriorityThread
KeSetSchedulingGroupRankBias
KeSetSelectedCpuSetsThread
KeSetSystemMultipleGroupAffinityThread
KeSetThreadSchedulerAssist
KeSetTracepoint
KeSetUserAffinityThread
KeSetUserCetAppcompatOptions
KeSetUserGroupAffinityThread
KeStartAllProcessors
KeStartProfile
KeStartThread
KeStopProfile
KeSupportedPhysicalAddressBits
KeSynchronizeAddressPolicy
KeSynchronizeSecurityDomain
KeUnsecureProcess
KeUpdateDpcWatchdogConfiguration
KeUpdateSoftParkRankList
KeUpdateThreadCpuSets
KeUpdateThreadTag
KeWaitForMultipleObjects
KeWaitForMutexObject
KeWriteProtectPAT
KiAbThreadUnboostCpuPriority
KiAdjustGroupConfiguration
KiAndAffinityEx
KiApplyForegroundBoostThread
KiBugCheckProgress
KiBugCheckProgressCpusFrozen
KiBugCheckRecoveryFreezeOtherProcessors
KiCalibrateTimeAdjustment
KiCancelClockTimer
KiCancelTimer
KiCheckForThreadDispatch
KiCheckForTimerExpiration
KiCheckMicrocode
KiChooseTargetProcessor
KiComputeCpuSetAffinity
KiComputeDispatchInterruptCost
KiComputeNumaCosts
KiComputeThreadAffinity
KiComputeTopologyConstants
KiConfigureHeteroMultiCoreProcessors
KiConnectInterrupt
KiContinuePreviousModeUser
KiDeferGroupSchedulingPreemption
KiDeferredBugcheckRecoveryWorker
KiDeferredReadySingleThread
KiDeregisterNmiSxCallback
KiDetectAmdNonArchSsbdSupport
KiDetectHardwareSpecControlFeatures
KiDetectKvaLeakage
KiDetectTsx
KiDirectSwitchThread
KiDisconnectInterruptCommon
KiDispatchException
KiDisplayBlueScreen
KiDumpParameterImages
KiDynamicProcessorAddNotification
KiDynamicProcessorInitialization
KiEnterLongDpcProcessing
KiEventClockStateChange
KiExecuteAllDpcs
KiExitDispatcher
KiExitThreadWait
KiExpireTimer2
KiFinalizeTimer2Disablement
KiFlushAddressSpaceTb
KiFlushRangeTb
KiFlushSingleTbWorker
KiForceIdleUpdateSchedulerParkState
KiForwardTick
KiFreezeTargetExecution
KiGetCpuVendor
KiGetIptInfo
KiGetProcessorInformation
KiGetProcessorSignature
KiGetTbLeafInfo
KiGetXSaveSupportedFeatures
KiGroupSchedulingGenerationEnd
KiGroupSchedulingQuantumEnd
KiHaltOnAddressWakeEntireList
KiHandleDeferredPreemption
KiHeteroComputeThreadImportance
KiHeteroScanQueueForPreemptionSwapTarget
KiHvEnlightenedGuestPriorityKick
KiInitMachineDependent
KiInitializeContextThread
KiInitializeDynamicProcessorDpc
KiInitializeHgsPlusWorkloadClasses
KiInitializeHresetSupport
KiInitializeIdleProcess
KiInitializeKernel
KiInitializeNxSupportDiscard
KiInitializeReservedCpuSets
KiInitializeTopologyStructures
KiInitializeUserApc
KiInitializeXSave
KiIntRedirectQueueRequestOnProcessor
KiIntSteerCalculatePriorityDistribution
KiIntSteerLogState
KiIntSteerLogStatus
KiInterruptDispatchCommon
KiIntersectFeaturesWithPolicy
KiInvokeInterruptServiceRoutine
KiIpiProcessRequests
KiIpiSendRequest
KiIsHyperVCr3RspErrataPresent
KiIsNXSupported
KiIsProcessTerminationRequested
KiLogSingleDpcSoftTimeoutEvent
KiLogUserCetSetContextIpValidationFailureWorker
KiMcheckAlternateReturn
KiOpPatchCode
KiOrAffinityEx
KiOutSwapKernelStacks
KiParkCurrentProcessor
KiPerformAutomaticGroupConfiguration
KiPerformExplicitGroupAssignment
KiPerformHeteroSoftParkElection
KiPrepareUpdateCoresHeteroMask
KiProcessControlProtection
KiProcessDeferredReadyList
KiProcessExpiredTimerList
KiQuantumEnd
KiRaiseException
KiReadyOutSwappedThreads
KiRemoveBoostThread
KiRemoveSystemWorkPriorityKick
KiRescheduleThreadAfterAffinityChange
KiReselectIdealProcessorAfterAffinityChange
KiRetireDpcList
KiRundownMutants
KiSchedulerApc
KiSearchForNewThread
KiSearchForNewThreadOnProcessor
KiSearchForNewThreadsForRescheduleContext
KiSelectProcessorToPreempt
KiSendClockInterruptToClockOwner
KiSendThawExecution
KiSetCacheInformationAmd
KiSetCacheInformationIntel
KiSetClockTimer
KiSetFeatureBits
KiSetHeteroPolicyThread
KiSetLegacyAffinityThread
KiSetNextClockTickDueTime
KiSetPageAttributesTable
KiSetPriorityThread
KiSetProcessorSignature
KiSetStandardizedCacheInformation
KiSetSystemAffinityThread
KiShouldRearmClockTimer
KiSoftParkElectionDpcRoutine
KiStallBugcheckThread
KiStartDpcThread
KiStartDynamicProcessor
KiStartPrcbThread
KiSubtractAffinityEx
KiSwapThread
KiSynchCounterSetCallback
KiSynchNumaCounterSetCallback
KiSynchronizeStibpPairing
KiTimer2Expiration
KiTimerExpiration
KiTimerExpirationDpc
KiTpReadImageData
KiTpWriteMemory
KiTraceCancelTimer2
KiTraceLogControlCallback
KiTraceLogHeteroRundown
KiTraceSetTimer
KiTraceSetTimer2
KiUnwindUserSspForApcContextCopyBypass
KiUpdateGlobalCpuSetConfiguration
KiUpdateNumberProcessors
KiUpdateProcessConcurrencyCount
KiUpdateRunTime
KiUpdateTime
KiUpdateVpBackingThreadPriorityDpcRoutine
KiWaitForAllObjects
KiXorAffinityEx
KitLogFeatureUsage
KitpReadUlongFromKey
KseDsCallbackHookAddDevice
KsepDbGetShimInfo
KsepDsEventAddDevice
KsepDsEventDataIrp
KsepDsEventDevicePowerCompleted
KsepDsEventDevicePowerIrp
KsepDsEventDriverLoad
KsepDsEventDriverStartIo
KsepDsEventDriverUnload
KsepDsEventIoCreateDevice
KsepDsEventPnpIrp
KsepDsEventPnpStartDevice
KsepDsEventPnpStopDevice
KsepDsEventPoolAllocate
KsepDsEventPoolFree
KsepDsEventRequestPowerIrp
KsepDsEventSystemPowerIrp
KsepEvntLogFlagsApplied
KsepEvntLogShimsApplied
KsepLogEtwMessage
KsepMatchInitBiosInfo
KsepRegistryQueryDWORD
KsepShimDatabaseTime
KsepSkipDriverUnloadEventDriverLoad
KsepSkipDriverUnloadEventDriverUnload
KyRaiseException
LdrLoadAlternateResourceModuleEx
LdrResGetRCConfig
LdrResSearchResource
LdrpGetParentLangId
LdrpGetRcConfig
LdrpGetResourceFileName
LdrpResSearchResourceMappedFile
LdrpSearchResourceSection_U
LkmdTelCreateReport
LocalGetAclForString
LocalGetConditionForString
LocalGetStringForControl
LocalGetStringForRelativeAttribute
LocalpConvertStringSidToSid
LocalpGetStringForCondition
LookUpTableFlushComplete
MakeGdtReadOnly
McTemplateK0_EtwWriteTransfer
McTemplateK0d_EtwWriteTransfer
McTemplateK0dszu_EtwWriteTransfer
McTemplateK0dz_EtwWriteTransfer
McTemplateK0dzd_EtwWriteTransfer
McTemplateK0hzr0_EtwWriteTransfer
McTemplateK0hzr0d_EtwWriteTransfer
McTemplateK0hzr0hzr2_EtwWriteTransfer
McTemplateK0hzr0qqhzr4_EtwWriteTransfer
McTemplateK0izzx_EtwWriteTransfer
McTemplateK0j_EtwWriteTransfer
McTemplateK0jhzr1_EtwWriteTransfer
McTemplateK0jhzr1d_EtwWriteTransfer
McTemplateK0jq_EtwWriteTransfer
McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer
McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer
McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer
McTemplateK0jzt_EtwWriteTransfer
McTemplateK0p_EtwWriteTransfer
McTemplateK0pqzzzzzzz_EtwWriteTransfer
McTemplateK0pz_EtwWriteTransfer
McTemplateK0q_EtwWriteTransfer
McTemplateK0qhzr1z_EtwWriteTransfer
McTemplateK0xxq_EtwWriteTransfer
McTemplateK0xxxqq_EtwWriteTransfer
McTemplateK0xxxqqqq_EtwWriteTransfer
McTemplateK0xxxxxxxxxxxxxxxxxq_EtwWriteTransfer
McTemplateK0z_EtwWriteTransfer
McTemplateK0zd_EtwWriteTransfer
McTemplateK0zdq_EtwWriteTransfer
McTemplateK0zjdd_EtwWriteTransfer
McTemplateK0zq_EtwWriteTransfer
McTemplateK0zqz_EtwWriteTransfer
McTemplateK0zz_EtwWriteTransfer
McTemplateK0zzjzitd_EtwWriteTransfer
McTemplateK0zzjzzzdd_EtwWriteTransfer
McTemplateK0zzjzzztzdzztdz_EtwWriteTransfer
McTemplateK0zzq_EtwWriteTransfer
McTemplateK0zzqq_EtwWriteTransfer
McTemplateK0zzqqzttquqqzxt_EtwWriteTransfer
McTemplateK0zzqqzttquxt_EtwWriteTransfer
McTemplateK0zzt_EtwWriteTransfer
McTemplateK0zztt_EtwWriteTransfer
McTemplateK0zzz_EtwWriteTransfer
McTemplateK0zzzd_EtwWriteTransfer
McTemplateK0zzzdzzq_EtwWriteTransfer
McTemplateK0zzzt_EtwWriteTransfer
McTemplateK0zzztdd_EtwWriteTransfer
McTemplateK0zzzzdd_EtwWriteTransfer
McTemplateK0zzzzz_EtwWriteTransfer
MfgInitSystem
MiActOnLargeKernelHalPages
MiAddLoaderHalIoMappings
MiAddWorkingSetEntries
MiAdjustPteBins
MiAgeWorkingSet
MiAllocateChildVads
MiAllocateContiguousMemory
MiAllocateFastAwePages
MiAllocateFastLargePagesForMdl
MiAllocateLargeProcessPagesFromCache
MiAllocateLargeZeroPages
MiAllocatePagesForMdl
MiAllocateSlabEntry
MiAllocateUserPhysicalPages
MiAllocateVirtualMemory
MiApplyBootLoadedDriversFixups
MiApplyFunctionOverrideToBootDrivers
MiApplyHotPatchToLoadedDriver
MiApplyImportOptimizationToBootDrivers
MiApplyRetpolineFixups
MiApplyRetpolineFixupsToKernelAndHal
MiApplyStraddleFixups
MiAssignSessionRanges
MiAssignSoftwareWsleRegion
MiAssignTopLevelRanges
MiAttachWorkingSet
MiAttemptPageFileExtension
MiAttemptPageFileReduction
MiBuildMdlForMappedFileFault
MiCaptureAndResetWorkingSetAccessBits
MiChangePageHeatImmediate
MiClearDriverHotPatchPtes
MiClearNonPagedPtes
MiClearPteAccessedBitRange
MiClearSystemAccessBits
MiCloneProcessAddressSpace
MiCloneVads
MiCoalesceFreeLargePages
MiCoalesceFreePages
MiCombineIdenticalPages
MiCombineInitialInstance
MiCombineWithExisting
MiCombineWorkingSet
MiCommitExistingVad
MiComputeAgeDistribution
MiComputeCacheAttributeSpeeds
MiComputeIdealDpcGang
MiComputeNodeMemory
MiConvertHiberPhasePages
MiCopyFromUntrustedMemory
MiCopyLargeVad
MiCopyOnWrite
MiCopyPagesIntoEnclave
MiCopyToCfgBitMap
MiCopyToUntrustedMemory
MiCopyVirtualMemory
MiCountBootDriverRegions
MiCountSharedPages
MiCrcStillIntact
MiCreateImageFileMap
MiCreateInitialSystemWsles
MiCreateNewSection
MiCreatePagefile
MiCreatePagingFileMap
MiCreatePerNodeZeroingConductor
MiCreateSessionDriverProtos
MiCreateSlabAllocationsFromLoaderBlock
MiDecayPfnFullyInitialized
MiDecommitHardwareEnclavePages
MiDecommitLargePoolVa
MiDecommitPages
MiDeleteAllHardwareEnclaves
MiDeleteClusterPage
MiDeleteClusterSection
MiDeleteEmptyPageTables
MiDeleteFinalPageTables
MiDeleteInsertedCloneVads
MiDeletePagablePteRange
MiDeletePteRun
MiDeletePteWsleCluster
MiDeleteSystemPagableVm
MiDeleteSystemPageTables
MiDeleteVa
MiDeliverPicoExceptionForProbedPage
MiDemoteCombinedPte
MiDemoteLocalLargePage
MiDemoteSlabEntries
MiDemoteValidLargePageOneLevel
MiDeprioritizeVirtualAddresses
MiDereferenceSegmentThread
MiDetachAndUnlockWorkingSet
MiDispatchFault
MiEliminateZeroPages
MiEmptyAccessLogs
MiEmptyWorkingSetInitiate
MiEnableNewPfns
MiExamineHalVa
MiFillHyperPtes
MiFillPfnGaps
MiFindActualFaultingPte
MiFindContiguousPagesEx
MiFindLargeMapping
MiFindLargestLoaderDescriptor
MiFindProcessImageHotPatchRecord
MiFlushAllPages
MiFlushCacheMdl
MiFlushDirtyBitsToPfn
MiFlushEntireTbDueToAttributeChange
MiFlushSectionInternal
MiFlushStaleCacheMap
MiFlushStrongCodeDriverLoadFailures
MiFlushTbAsNeeded
MiFlushValidPteFromTb
MiFlushWaitForReadInProgress
MiFreeBootDriverPages
MiFreeLargePageChain
MiFreeLargePages
MiFreeLargeProcessPagesToCache
MiFreeLargeZeroPages
MiFreePagesFromMdl
MiFreePhysicalPageChain
MiFreePhysicalPages
MiFreeUnusedSlabPages
MiFreeWsleList
MiGetBaseResidentPage
MiGetClusterPage
MiGetLargePage
MiGetLargePageChain
MiGetNextAffinityWalker
MiGetNextAffinityWalkerLegacy
MiGetNextPageTable
MiGetPage
MiGetPageChain
MiGetPerfectColorHeadPage
MiGetPteFromCopyList
MiGetSlabStandbyPage
MiGetSystemAddressForImage
MiGetTopLevelPfn
MiGetWorkingSetInfoEx
MiGetWorkingSetInfoList
MiHotPatchAllProcesses
MiHugePageOperation
MiIdealClusterPage
MiIdentifyPfn
MiInPagePageTable
MiInPageSingleKernelStack
MiInSwapSharedWorkingSetWorker
MiInSwapStoreWorker
MiInitNucleus
MiInitSystem
MiInitializeCacheFlushing
MiInitializeChannelRangesTemporary
MiInitializeDriverImages
MiInitializeDynamicPfns
MiInitializeLargeMdlLeafPfns
MiInitializeLargePageColorSizes
MiInitializeNumaGraph
MiInitializePartitionThreads
MiInitializeProcessBottomUpEntropy
MiInitializeSessionIds
MiInitializeTbFlush
MiInitializeZeroEngines
MiInsertChildVads
MiInsertLargePageChain
MiInsertNewZeroThread
MiInsertPageInList
MiInsertPagesInList
MiInvokePatchCallback
MiIsCfgBitMapPageShared
MiIssueHardFault
MiLargePageFault
MiLargePagePromote
MiLoadDataIntoVsmEnclave
MiLockCode
MiLockDownWorkingSet
MiLogAddPhysicalMemory
MiLogAllocateWsleEvent
MiLogBadMapper
MiLogCombinedPteDelete
MiLogCommitRequestFailed
MiLogContinueTrim
MiLogCreateImageFileMapFailure
MiLogFailedDriverLoad
MiLogHotPatchManagement
MiLogHotPatchOperation
MiLogHotPatchOperationStatus
MiLogHotPatchPagesLocked
MiLogHotPatchRundown
MiLogKernelStackEvent
MiLogMdlRangeEvent
MiLogNonPagedPoolReleaseEvent
MiLogNonRetpolineImageLoadEvent
MiLogNotifyPageHeat
MiLogOutswappedProcessCommitReacquire
MiLogOutswappedProcessCommitRelease
MiLogPerfMemoryEvent
MiLogPerfMemoryRangeEvent
MiLogPeriodicTelemetry
MiLogPeriodicTelemetryForSlabAllocator
MiLogPinDriverAddress
MiLogPinDriverAddressesWorker
MiLogProcessWorkingSetsStop
MiLogRemoveWsleEvent
MiLogReserveVaFailed
MiLogResetPagesCommitRelease
MiLogSectionCreate
MiLogSlabEntriesDemote
MiLogSlabEntryAllocateFailure
MiLogStrongCodeDriverLoadFailure
MiLogTrimWs
MiLogWsEmptyControl
MiMakeOutswappedPageResident
MiMakePageAvoidRead
MiMakeSystemCacheRangeValid
MiMakeVaRangeNoAccess
MiMakeZeroedPageTablesEx
MiMapContiguousMemory
MiMapImageForEnclaveUse
MiMapMdlCommon
MiMapMemoryDumpMdl
MiMapUserLargePages
MiMapViewOfSection
MiMarkBootKernelStack
MiMarkHiberNotCachedPages
MiMarkHugeRangeTransition
MiMarkKernelImageCfgBits
MiMarkKernelPageTablePages
MiMarkLargePageMappings
MiMarkNonPagedHiberPhasePages
MiMarkSharedImageCfgBits
MiModifiedPageWriter
MiMoveDirtyBitsToPfns
MiMoveLargeFreePage
MiNodeZeroConductor
MiOpenHotPatchFile
MiOrderTrimList
MiOutSwapKernelStackPage
MiOutSwapWorkingSet
MiParseComAndCetHeaders
MiParseImageLoadConfig
MiPartitionWorkingSetManager
MiPerformSafePdeWrite
MiPersistMdl
MiPfCompleteInPageSupport
MiPfnRangeIsZero
MiPopulateCfgBitMap
MiProcessWorkingSets
MiProtectAweRegion
MiProtectDriverSectionPte
MiProtectEnclavePages
MiProtectLargeKernelHalRange
MiProtectPrivateMemory
MiProtectSharedUserPage
MiProtectSystemImage
MiPruneProcessLargePageCaches
MiQueryAddressState
MiQueryMemoryPhysicalContiguity
MiQueryProcessActivePatches
MiReadyReservedView
MiRebuildPageTableLeafAges
MiReferenceIoPages
MiReferenceNonPagedMemoryProcessList
MiReleaseLargePdeMappings
MiReleaseProcessReferenceToSessionDataPage
MiReleasePtes
MiReleaseSmallPteMappings
MiReloadBootLoadedDrivers
MiRelocateImage
MiRemoveLowestPriorityStandbyPage
MiReplacePageOfProtoPool
MiReplacePageTablePage
MiReplacePfnWithGapMapping
MiReplaceRotateWithDemandZero
MiReplaceRotateWithDemandZeroNoCopy
MiReplaceTransitionPage
MiReturnSystemVa
MiScrubActiveLargePage
MiScrubLargeMappedPage
MiSelectBestZeroingProcessor
MiSelectBestZeroingProcessorLegacy
MiSessionCreate
MiSessionObjectCreate
MiSetIdealProcessorThread
MiSetPagesModified
MiSetPagingOfDriver
MiSetProtectionOnSection
MiSetReadOnlyOnSectionView
MiSetSystemCodeProtection
MiSetVaAgeList
MiSharePages
MiShowBadMapper
MiSimpleAging
MiSnapDriverRange
MiSoftFaultMappedView
MiStealPage
MiStoreEvictThread
MiStoreLogFullPagefile
MiStoreLogNotCandidate
MiStoreLogWriteCompleteFailure
MiStoreLogWriteDisabled
MiStoreLogWriteIssueFailure
MiStoreLogWriteIssueRetry
MiSwitchToTransition
MiSystemFault
MiTerminateWsleCluster
MiTradeBootImagePage
MiTransferFileExtent
MiTranslatePageForCopy
MiTrimSharedPageFromViews
MiTrimUnusedPageFileRegionsWorker
MiTrimWorkingSet
MiUnapplyDriverHotPatch
MiUnlinkNodeLargePages
MiUnlinkPageFromBadList
MiUnlinkPageFromListEx
MiUnmapImageForEnclaveUse
MiUnmapMdlCommon
MiUnmapRetpolineStubs
MiUnmapViewOfSection
MiUpdateCfgSystemWideBitmapWorker
MiUpdatePageAttributeStamp
MiUpdateRetpolineImportFixups
MiValidatePagefilePageHash
MiValidateSectionCreate
MiVerifyLargeSectionLayout
MiWaitForFreePage
MiWalkEntireImage
MiWalkResetCommitPages
MiWalkVaRange
MiWorkingSetManager
MiWriteAwePtes
MiWritePageFileHash
MiWritePteHighLevel
MiWritePteHighLevelIsr
MiZeroAllPageFiles
MiZeroAndFlushPtes
MiZeroAndReleasePages
MiZeroHugeRangeCore
MiZeroInParallel
MiZeroInParallelWorker
MiZeroLargePage
MiZeroPage
MiZeroPageCalibrate
MiZeroPageFile
MiZeroPageFileFirstPage
MiZeroPageWorkMapping
MiZeroPageWrite
MigrateOOBELanguageToInstallationLanguage
MinAsn1DecodeGeneralizedTime
MinAsn1ExtractParsedCertificatesFromSignedData
MinAsn1ExtractValues
MinAsn1ParseAndDecodeRDNComponent
MinAsn1ParseSingleExtensionValue
MinAsn1StringToOid
MinCryptCheckCertsAndKeys
MinCryptDecodeHashAlgorithmIdentifier
MinCryptDecodeSignatureAlgorithmIdentifier
MinCryptIsKeyPresent
MinCryptVerifySignedHash2
MmAccessFault
MmAddRangeToCrashDump
MmAllocateContiguousMemoryEx
MmAllocateContiguousNodeMemory
MmAllocateMappingAddressEx
MmAssignProcessToJob
MmCheckCachedPageStates
MmCopyMemory
MmCreatePeb
MmCreateShadowMapping
MmCreateTeb
MmDeleteShadowMapping
MmDeleteTeb
MmEnforceWorkingSetLimit
MmEnumerateAddressSpaceAndReferenceImages
MmEnumerateSystemImages
MmFlushVirtualMemory
MmFreeLoaderBlock
MmFreeNonChargedSecurePages
MmFreeSecureKernelPages
MmFreeVirtualMemory
MmGetChannelInformation
MmIdentifyPhysicalMemory
MmInSwapVirtualAddresses
MmInSwapWorkingSet
MmInitializeHandBuiltProcess2
MmInitializeProcessAddressSpace
MmIsFileMapped
MmLogQueryCombineStats
MmLogSystemShareablePfnInfo
MmManagePartitionMemoryInformation
MmMarkPhysicalMemoryAsBad
MmNotifyProcessInSwapTrigger
MmOutPageKernelStack
MmOutSwapVirtualAddresses
MmOutSwapWorkingSet
MmPerfLogSessionRundown
MmPrefetchVirtualMemory
MmProbeAndLockProcessPages
MmProbeAndLockSelectedPages
MmProcessWorkingSetControl
MmProtectDriverSection
MmProtectMdlSystemAddress
MmProtectPool
MmQueryBadAddresses
MmQueryCommitReleaseState
MmQueryMemoryListInformation
MmQueryVirtualMemory
MmReleaseCommitForMemResetPages
MmRelocatePfnList
MmRemoveExecuteGrants
MmRemoveSystemCacheFromDump
MmSecureVirtualMemoryAgainstWrites
MmSetAddressRangeModifiedEx
MmSetCommitReleaseEligibility
MmSetPageProtection
MmSetPfnListInfo
MmStoreLogCorruptionFixed
MmUnlockPhysicalPagesByVa
MmUnmapIoSpace
MmUnmapProtectedKernelPageRange
MmUpdateOldWorkingSetPages
MmWaitMultipleForCacheManagerPrefetch
MmWriteSystemImageTracepoint
MmZeroPageFileAtShutdown
MxCreatePfns
MxZeroPageTablePfns
NtAddAtomEx
NtAlpcSetInformation
NtCommitRegistryTransaction
NtCompressKey
NtCreateEnclave
NtCreateMailslotFile
NtCreateNamedPipeFile
NtCreateProfile
NtCreateSymbolicLinkObject
NtCreateThread
NtCreateThreadEx
NtCreateTokenEx
NtCreateUserProcess
NtCreateWnfStateName
NtDebugActiveProcess
NtDeleteBootEntry
NtDeleteDriverEntry
NtDeleteFile
NtDeleteKey
NtDeleteValueKey
NtEnumerateKey
NtEnumerateValueKey
NtFindAtom
NtFlushKey
NtFreeUserPhysicalPages
NtFreezeRegistry
NtGetCachedSigningLevel
NtGetCompleteWnfStateSubscription
NtGetNextProcess
NtGetNextThread
NtGetNlsSectionPtr
NtGetWriteWatch
NtInitializeEnclave
NtLoadEnclaveData
NtLockProductActivationKeys
NtLockVirtualMemory
NtManageHotPatch
NtManagePartition
NtMapUserPhysicalPages
NtMapUserPhysicalPagesScatter
NtNotifyChangeMultipleKeys
NtNotifyChangeSession
NtOpenProcessTokenEx
NtPowerInformation
NtProtectVirtualMemory
NtPssCaptureVaSpaceBulk
NtQueryAttributesFile
NtQueryFullAttributesFile
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationProcess
NtQueryInformationThread
NtQueryKey
NtQueryMultipleValueKey
NtQueryOpenSubKeys
NtQueryOpenSubKeysEx
NtQuerySystemEnvironmentValueEx
NtQueryValueKey
NtQueryWnfStateData
NtRaiseHardError
NtRemoveIoCompletionEx
NtRemoveProcessDebug
NtRenameKey
NtReplaceKey
NtResetWriteWatch
NtRestoreKey
NtRollbackRegistryTransaction
NtSaveKeyEx
NtSaveMergedKeys
NtSecureConnectPort
NtSetContextThread
NtSetDefaultLocale
NtSetInformationJobObject
NtSetInformationKey
NtSetInformationProcess
NtSetInformationThread
NtSetInformationVirtualMemory
NtSetInformationWorkerFactory
NtSetSystemEnvironmentValueEx
NtSetSystemInformation
NtSetSystemPowerState
NtSetSystemTime
NtSetUuidSeed
NtSetValueKey
NtSetVolumeInformationFile
NtThawRegistry
NtTraceEvent
NtUnlockVirtualMemory
NtWaitForDebugEvent
NtWaitForMultipleObjects
NtWaitForMultipleObjects32
NtWaitForWorkViaWorkerFactory
ObCloseHandleTableEntry
ObCreateObjectTypeEx
ObCreateSiloRootDirectory
ObCreateSymbolicLink
ObDuplicateObject
ObGetSiloRootDirectoryPath
ObInitSystem
ObInsertObjectEx
ObOpenObjectByPointer
ObReferenceObjectByName
ObSetHandleAttributes
ObWaitForMultipleObjects
ObpAdjustCreatorAccessState
ObpCloseHandle
ObpCreateHandle
ObpDecrementHandleCount
ObpIncrementHandleCountEx
ObpInsertHandleCount
ObpInsertOrLocateNamedObject
ObpParseSymbolicLinkEx
ObpProcessRemoveObjectQueue
ObpStartRuntimeStackTrace
ObpVerifyAccessToBoundaryEntry
ObpVerifyCreatorAccessCheck
OpenGlobalizationUserSettingsKey_ForMua
Ordinal_14
Ordinal_30
Ordinal_5
Ordinal_6
Ordinal_9
PerfDiagInitialize
PerfDiagpIsTracingAllowed
PerfDiagpUpdatePerfDiagLoggerEnableFlags
PerfInfoLogIpiSend
PerfInfoLogSysCallEntry
PerfInfoLogSysCallExit
PerfInfoLogUnexpectedInterrupt
PerfInfoLogVirtualAlloc
PerfInfoLogVirtualFree
PerfLogExecutiveResourceInitialize
PerfLogExecutiveResourceRelease
PerfLogExecutiveResourceSetOwnerPointer
PerfLogExecutiveResourceWait
PerfLogImageLoad
PerfLogSpinLockRelease
PfQuerySuperfetchInformation
PfSnAppLaunchScenarioControl
PfSnAsyncPrefetchWorker
PfSnBeginAppLaunch
PfSnCheckActionsNeeded
PfSnCheckModernApp
PfSnEndTrace
PfSnGetPrefetchInstructions
PfSnGetSectionObject
PfSnLogAsyncWorker
PfSnLogGetReadListsStart
PfSnLogGetReadListsStop
PfSnLogOpenVolumesForPrefetch
PfSnLogPrefetchMetadata
PfSnLogScenarioDecision
PfSnOperationProcess
PfSnParametersRead
PfSnParsePrefetchParam
PfSnPopulateReadList
PfSnPrefetchSections
PfSnQueryVolumeInfo
PfSnSetAltPrefetchParam
PfSnSetPrefetcherInformation
PfSnVolumeCheckIsSdBus
PfSnVolumeCheckSeekPenalty
PfTLoggingWorker
PfVerifyScenarioBuffer
PfpFlushBuffers
PfpGetParameter
PfpLogApplicationEvent
PfpParametersRead
PfpPrefetchRequestPerform
PfpPrivSourceEnum
PfpQueryFileExtentsRequest
PfpQueryGpuUtilization
PfpRpControlRequest
PfpRpControlRequestCopy
PfpSourceGetPrefetchSupport
PfpUpdateRepurposedByPrefetch
PfpVolumeOpenAndVerify
Phase1InitializationDiscard
PiAuCheckTokenMembership
PiAuCreateStandardSecurityObject
PiAuDoesClientHavePrivilege
PiAuditDeviceOperation
PiCMDeleteDeviceKey
PiCMGetDeviceInterfaceAlias
PiCMGetDeviceInterfaceList
PiCMGetObjectProperty
PiCMRegisterDeviceInterface
PiCMSetDeviceProblem
PiCMSetObjectProperty
PiControlGetDevicePowerData
PiCreateDriverSwDeviceCallback
PiDcHandleCustomDeviceEvent
PiDcHandleDeviceEvent
PiDcHandleInterfaceEvent
PiDcInitUpdateProperties
PiDcResetChildDeviceContainerCallback
PiDcResetChildDeviceContainers
PiDcUpdateDeviceContainerMembership
PiDevCfgCheckDeviceNeedsUpdate
PiDevCfgClearDeviceMigrationNode
PiDevCfgConfigureDevice
PiDevCfgConfigureDeviceInterfaces
PiDevCfgConfigureDeviceLocation
PiDevCfgCopyDeviceKey
PiDevCfgEnumDeviceKeys
PiDevCfgFindDeviceMigrationNode
PiDevCfgGetKeySecurityDescriptor
PiDevCfgInitDeviceContext
PiDevCfgLogDeviceConfigured
PiDevCfgLogDeviceStarted
PiDevCfgParsePropertyKeyName
PiDevCfgQueryDeviceMigrationNode
PiDevCfgQueryDriverConfiguration
PiDevCfgQueryDriverNode
PiDevCfgQueryPolicyStringList
PiDevCfgResetDeviceDriverSettings
PiDevCfgResolveVariableDeviceProperty
PiDevCfgResolveVariableExpression
PiDevCfgResolveVariableFormatString
PiDevCfgResolveVariableGenerateGuid
PiDevCfgResolveVariableKeyHandle
PiDevCfgResolveVariableSwitchCase
PiDevCfgSplitDriverConfigurationId
PiDmAddCacheReferenceForObject
PiDmCacheDataEncode
PiDmEnumObjectsWithCallback
PiDmGetObject
PiDmGetReferencedObjectFromProperty
PiDmListInitEnumCallback
PiDmLookupObject
PiDmObjectGetCachedCmProperty
PiDmObjectUpdateCachedCmProperty
PiDqActionDataGetChangedProperties
PiDqDeleteUserObjectFromLoadedHives
PiDqIrpQueryCreate
PiDqObjectManagerEnumerateAndRegisterQuery
PiDqObjectManagerServiceActionQueue
PiDqOpenUserObjectRegKey
PiDqSameUserHive
PiDrvDbOverlayCopyKeys
PiDrvDbOverlayNodeHive
PiGetDeviceRegProperty
PiGetDeviceRegistryProperty
PiIsDriverBlocked
PiLastGoodRevertLastKnownDirectory
PiLookupInDDBCache
PiPnpRtlCmActionCallback
PiPnpRtlGatherInstallerClassChangeInfo
PiPnpRtlGatherInterfaceDeleteInfo
PiPnpRtlGetFilteredDeviceInterfaceList
PiPnpRtlInterfaceFilterCallback
PiPnpRtlIsDeviceEnumerableForUser
PiPnpRtlObjectEventCreate
PiPnpRtlObjectEventWorker
PiPnpRtlServiceFilterCallback
PiPnpRtlSetObjectProperty
PiProcessDriverInstance
PiProcessNewDeviceNode
PiQueryRemovableDeviceOverride
PiRearrangeDeviceInstances
PiRebalanceOptOut
PiSwCompleteCreate
PiSwFindSwDevice
PiUEventApplyAdditionalFilters
PiUEventBroadcastPortsChangedEvent
PiUEventInitClientRegistrationContext
PiUpdateDriverDBCache
PipCallDriverAddDevice
PipCallbackHasDeviceOverrides
PipChangeDeviceObjectFromRegistryProperties
PipCheckComputerSupported
PipCreateComputerId
PipCriticalDeviceWaitCallback
PipDmgGetDeviceDmarPolicy
PipGenerateContainerID
PipGetPersistentMemory
PipHardwareConfigClearStartOverrideCallback
PipHardwareConfigClearStartOverrides
PipHardwareConfigExists
PipHardwareConfigInit
PipInitComputerIds
PipInitDeviceOverrideCache
PipIs32bitKey
PipKsrNotifyDrivers
PipMakeGloballyUniqueId
PipProcessPendingObjects
PipResetDevice
PipServiceInstanceToDeviceInstance
PipUnprotectDevice
PipUpdateDeviceProducts
PnpBuildCmResourceList
PnpCallAddDevice
PnpCompareInterruptInformation
PnpDeviceActionWorker
PnpDeviceEventWorker
PnpDiagRundownConnectionResourceForEachDevice
PnpDiagRundownInterruptResourceForEachDevice
PnpDiagRundownParentDevNodeForEachDevice
PnpDiagRundownParentPdoForEachDevice
PnpDiagnosticTraceAppVeto
PnpDiagnosticTraceDeviceOperation
PnpDiagnosticTraceDriverFullInfo
PnpDiagnosticTraceElamDecision
PnpDiagnosticTraceElamStatus
PnpDiagnosticTraceObject
PnpDiagnosticTraceObjectWithStatus
PnpDriverLoadingFailed
PnpGetDeviceInterfacePropertyData
PnpGetDevicePropertyData
PnpGetStableSystemBootTime
PnpHardwareConfigCreateBootDriverFlags
PnpInitializeNotifyEntry
PnpIsValidGuidString
PnpNotifyDeviceClassChange
PnpNotifyDriverCallback
PnpNotifyHwProfileChange
PnpNotifyTargetDeviceChange
PnpNotifyUserModeDeviceRemoval
PnpPrepareDriverLoading
PnpProcessDeferredRegistrations
PnpQueryAndSaveDeviceNodeCapabilities
PnpRebalance
PnpRegistryValueExists
PnpReplacePartitionUnit
PnpSendIrp
PnpSetDeviceAffinityThread
PnpSetDeviceInterfacePropertyData
PnpSetDevicePropertyData
PnpShutdownDevices
PnpTraceClearDevNodeProblem
PnpTraceDeviceConfig
PnpTraceDeviceRemovalForResetComplete
PnpTraceDmaGuardDevicePolicy
PnpTraceDmaGuardSystemPolicy
PnpTraceDockDeviceEnumeration
PnpTraceDriverBlocked
PnpTraceInterruptConnection
PnpTraceIommuDeviceProperties
PnpTraceRebalanceResult
PnpTraceRequestDeviceRemovalForReset
PnpTraceSecureDeviceEnumeration
PnpTraceSetDevNodeProblem
PnpTraceWatchdogViolation
PnprCopyReservedMapping
PnprLogFailureEvent
PnprLogStartEvent
PnprLogSuccessEvent
PnprQuiesceProcessors
PnprQuiesceWorker
PoBroadcastSystemState
PoClearTransitionMarker
PoDiagTraceDeviceRundown
PoDiagTraceIRTimerSleepStudyRundown
PoEnergyContextStart
PoEnergyContextUpdateComponentPower
PoExecuteIdleCheck
PoFxEnableDStateReporting
PoFxRegisterDebugger
PoFxSetComponentLatency
PoFxSetComponentResidency
PoFxSetTargetDripsDevicePowerState
PoGetIdleTimes
PoGetLightestSystemStateForEject
PoGetPerfStateAndParkingInfo
PoIdle
PoInitSystem
PoInitiateProcessorWake
PoLatencySensitivityHint
PoPowerOffMonitor
PoRegisterPowerSettingCallback
PoRundownSystemTimer
PoSetUserPresent
PoThermalCounterSetCallback
PoTraceDynamicTickDisabled
PoTraceForceIdleReset
PoTraceForceIdleStateChange
PoTraceSystemTimerResolution
PoTraceSystemTimerResolutionIgnore
PoTraceSystemTimerResolutionKernel
PoTraceSystemTimerResolutionUpdate
PopAccountBatteryEnergyChange
PopAccountCbEnergyChange
PopAcquireAdaptiveLock
PopAdaptiveGetSessionStateUnsafe
PopAdaptivePersistSystemInitatedRebootState
PopAdaptivePowerSettingCallback
PopAdaptiveWnfCallback
PopApplyAdminPolicy
PopApplyPolicy
PopAssessSystemIdleEvent
PopBatteryApplyCompositeState
PopBatteryCheckCompositeCapacity
PopBatteryInitialize
PopBatteryQueryEstimatedTime
PopBatteryTracePercentageRemaining
PopBatteryTraceSystemBatteryStatus
PopBatteryUpdateAlarms
PopBatteryWorker
PopBcdEstablishResumeObject
PopBcdRegenerateResumeObject
PopBcdSetPendingResume
PopBlockSessionSwitch
PopBootBatteryStatusWorker
PopCalculateHiberFileSize
PopCallPowerSettingCallback
PopCaptureSleepStudyStatistics
PopCheckShutdownMarker
PopClearHiberFileSignature
PopCompressHiberBlocks
PopConfigureHeteroPolicies
PopCreateHiberFile
PopCreateNotificationName
PopDecompressHiberBlocks
PopDiagTraceAbnormalReset
PopDiagTraceAcDcStateChange
PopDiagTraceActiveCooling
PopDiagTraceAdaptiveBootOverride
PopDiagTraceAdaptiveBootOverridePrepared
PopDiagTraceAdaptiveOverrideClear
PopDiagTraceAdaptiveOverrideTriggered
PopDiagTraceAppPowerMessage
PopDiagTraceAppPowerMessageEnd
PopDiagTraceBatteryAlarmStatus
PopDiagTraceBatteryCountChange
PopDiagTraceBatteryTriggerFlags
PopDiagTraceBatteryTriggerMet
PopDiagTraceBsdWriteTime
PopDiagTraceClearDeepSleepConstraint
PopDiagTraceConsoleDisplayState
PopDiagTraceControlCallback
PopDiagTraceCoolingExtension
PopDiagTraceCoolingExtensionActiveUpdate
PopDiagTraceCoolingExtensionPassiveUpdate
PopDiagTraceCsConsumption
PopDiagTraceCsDeepSleepWatchdog
PopDiagTraceCsDripsDivergence
PopDiagTraceCsDripsWatchdog
PopDiagTraceCsDripsWatchdogPerfTrack
PopDiagTraceCsEnterReason
PopDiagTraceCsExitReason
PopDiagTraceCsFanPerfTrack
PopDiagTraceCsResiliencyStats
PopDiagTraceDIrpAfterSx
PopDiagTraceDebuggerTransitionRequirements
PopDiagTraceDeepSleepConstraintRundown
PopDiagTraceDeviceAcquireIrp
PopDiagTraceDeviceComplianceRundown
PopDiagTraceDeviceComplianceUpdate
PopDiagTraceDeviceIdleCheck
PopDiagTraceDeviceReleaseIrp
PopDiagTraceDeviceVerboseRundown
PopDiagTraceDevicesLevel
PopDiagTraceDevicesSuspend
PopDiagTraceDirectedDripsInitialization
PopDiagTraceDirectedDripsNotifyAppsAndServices
PopDiagTraceDirtyTransition
PopDiagTraceDiskIdleCheck
PopDiagTraceDisplayBurstWin32kCallout
PopDiagTraceDozeDeferralDecision
PopDiagTraceDripsHistogram
PopDiagTraceDriverVeto
PopDiagTraceDynamicTickStatusRundown
PopDiagTraceEsState
PopDiagTraceExecutePowerAction
PopDiagTraceFirmwareS3Stats
PopDiagTraceFxComponentAccounting
PopDiagTraceFxComponentIdleConstraints
PopDiagTraceFxComponentIdleState
PopDiagTraceFxComponentLogicalCondition
PopDiagTraceFxComponentRegistration
PopDiagTraceFxComponentWake
PopDiagTraceFxDefaultPepWorkerEnd
PopDiagTraceFxDeviceAccounting
PopDiagTraceFxDeviceDirectedCompletion
PopDiagTraceFxDeviceDirectedTransition
PopDiagTraceFxDeviceIdleConstraints
PopDiagTraceFxDevicePowerRequirement
PopDiagTraceFxDevicePowerState
PopDiagTraceFxDevicePowered
PopDiagTraceFxDevicePreparation
PopDiagTraceFxDeviceRegistration
PopDiagTraceFxDeviceStartPowerManagement
PopDiagTraceFxDeviceUnregistration
PopDiagTraceFxGlobalDeviceAccounting
PopDiagTraceFxPerfNominalChange
PopDiagTraceFxPerfRegistration
PopDiagTraceFxPerfRequest
PopDiagTraceFxPerfRequestComplete
PopDiagTraceFxPerfRequestProgress
PopDiagTraceFxPerfSetRegistration
PopDiagTraceFxPluginRegistration
PopDiagTraceHiberStats
PopDiagTraceHibernateErrorStatus
PopDiagTraceIdleCheck
PopDiagTraceIdleResiliencyEnd
PopDiagTraceIdleResiliencyStart
PopDiagTraceIllegalProcessorThrottle
PopDiagTraceInvalidBootStat
PopDiagTraceIoCoalescingDiskIdle
PopDiagTraceIoCoalescingOn
PopDiagTraceIrpFinish
PopDiagTraceIrpFinishTelemetry
PopDiagTraceIrpPended
PopDiagTraceIrpStart
PopDiagTraceKernelQueriesAllowed
PopDiagTraceMonitorOnWithLidClosed
PopDiagTraceMtrrError
PopDiagTracePassiveCooling
PopDiagTracePerfTrackData
PopDiagTracePlatformRoleRundown
PopDiagTracePolicyChange
PopDiagTracePolicyInitiatePowerActionApiCall
PopDiagTracePostSleepNotification
PopDiagTracePowerButtonBugcheck
PopDiagTracePowerRequestChange
PopDiagTracePowerRequestCreate
PopDiagTracePowerSetting
PopDiagTracePowerSettingRegistration
PopDiagTracePowerStateEvent
PopDiagTracePowerStateEventRundown
PopDiagTracePowerTransitionEnd
PopDiagTracePowerTransitionStart
PopDiagTracePowerTransitionTime
PopDiagTracePreSleepNotification
PopDiagTraceProcessorThrottleDurationPerfTrack
PopDiagTraceProcessorThrottlePerfTrack
PopDiagTraceRegisterSystemState
PopDiagTraceRtcWakeInfo
PopDiagTraceServiceNotification
PopDiagTraceSessionDisplayStateChange
PopDiagTraceSessionState
PopDiagTraceSessionStateCounted
PopDiagTraceSessionStates
PopDiagTraceSetDeepSleepConstraint
PopDiagTraceSetSystemState
PopDiagTraceSetThreadExecutionState
PopDiagTraceShutdownAction
PopDiagTraceSkipTick
PopDiagTraceSleepReliabilityDiagConfigUpdate
PopDiagTraceSleepStudyStart
PopDiagTraceSleepStudyStop
PopDiagTraceStateTransitionFailurePoint
PopDiagTraceSystemIdleContextUpdate
PopDiagTraceSystemIdleRundown
PopDiagTraceSystemLatencyUpdate
PopDiagTraceThermalCoolingMode
PopDiagTraceThermalRequest
PopDiagTraceThermalRequestActiveUpdate
PopDiagTraceThermalRequestPassiveUpdate
PopDiagTraceThermalStateChange
PopDiagTraceThermalZoneEnumeration
PopDiagTraceThermalZoneRundown
PopDiagTraceThermalZoneThrottleDurationPerfTrack
PopDiagTraceThermalZoneThrottlePerfTrack
PopDiagTraceTripPointExceeded
PopDiagTraceUmpoAlpcProcessingError
PopDiagTraceUsermodeThermalEvent
PopDirectedDripsDiagNotifySessionStop
PopDirectedDripsDiagRundownBroadcastTrees
PopDirectedDripsDiagRundownDevices
PopDirectedDripsDiagTraceBroadcastVisit
PopDirectedDripsDiagTraceDfxPowerStateFailure
PopDirectedDripsDiagTraceMarkDevice
PopDirectedDripsDiagTraceNotifyDevices
PopDirectedDripsDiagTraceProblemDevice
PopDirectedDripsQueryRegistryValues
PopDirectedDripsSendSuspendResumeNotification
PopDispatchNotificationsToList
PopDispatchStateCallout
PopDripsWatchdogCheckHwDivergence
PopDripsWatchdogDiagnosticWorker
PopEnableHiberFile
PopEsUpdateSetting
PopEstimateChargeTime
PopEtAppIdIntern
PopEtEnergyContextProcessStateUpdate
PopEtEnergyTrackerUpdateAggregate
PopEtGetProcessAppId
PopEtInit
PopEtIsrDpcQuery
PopEtProcessEnumSnapshotCallback
PopEvaluateInputSuppressionAction
PopEvaluateWeakChargerState
PopEventCalloutDispatch
PopExecutePowerAction
PopExecuteSystemIdleAction
PopFanReadFanNoiseInfo
PopFanSetupRpmBuckets
PopFanUpdateSpeed
PopFanUpdateStatistics
PopFanWorker
PopFlushAndHold
PopFlushVolumeWorker
PopFxBuildDripsBlockingDeviceList
PopFxInitializeSocSubsystemStaticInfo
PopFxIsDevicePotentialDripsConstraint
PopFxLogSocSubsystemBlockingTimes
PopFxPlatformIdleVeto
PopFxProcessorIdleVeto
PopFxStopDeviceAccounting
PopFxTraceDeviceRegistration
PopFxUpdatePlatformIdleState
PopFxUpdateProcessorIdleState
PopGetBitlockerKeyLocation
PopGetHwConfigurationSignature
PopGetSettingNotificationName
PopHiberCheckResume
PopIdleWakeGenerateInterruptDescriptionString
PopIdleWakeNotifyModernStandbyExitWorker
PopIdleWakeSendDripsWakeSourceTelemetry
PopIdleWakeTraceWakeSourceDiagnostic
PopInitPlatformSettings
PopInitSIdle
PopInitializeHeteroProcessors
PopInitializePowerButtonHold
PopInitializePowerPolicySimulate
PopInvokeStateHandlerTargetProcessor
PopInvokeSystemStateHandler
PopIsMktmeEnabled
PopIsRemoteDesktopEnabled
PopIsSystemIdle
PopIssueActionRequest
PopLidReliabilityInit
PopLidSwitchChangeCallback
PopLidSwitchReliabilityUpdateCallback
PopLogNotifyDevice
PopMarshalSettingValues
PopMonitorProcessLoop
PopNetWnfLowPowerEpochCallback
PopOpenPersistedRegistryKey
PopOpenThermalLoggingKey
PopPdcCsCheckSystemVolumeDevice
PopPepInitializeDebuggerMasks
PopPepInitializeVetoMasks
PopPepUpdateIdleStateRefCount
PopPepWork
PopPlNotifyDeviceDState
PopPlNotifyDeviceFState
PopPlPublishInitialPowerDraw
PopPlPublishSystemPowerChange
PopPlRegisterComponent
PopPlRegisterDevice
PopPlRegisterDeviceIterator
PopPlRegisterPowerPlane
PopPlTraceLogPowerPlane
PopPlUnregisterComponent
PopPlUnregisterDevice
PopPolicyDeviceHandleWakeAlarmNotification
PopPolicyWorkerAction
PopPotsLogDirtyPowerTransition
PopPotsLogPowerTransitionReliability
PopPowerAggregatorDiagTraceHandleIntent
PopPowerAggregatorDiagTracePdcSleepTransition
PopPowerAggregatorInvokeStateMachine
PopPowerAggregatorNotifySuspendResume
PopPowerAggregatorSetCurrentState
PopPowerButtonSettingCallback
PopPowerButtonWorkCallback
PopPowerInformationInternal
PopPowerRequestDelete
PopPowerRequestStatsInitialize
PopPowerSourceChangeCallback
PopQueryHiberPersistedRegValue
PopQueryPowerButtonConfiguration
PopReadHiberbootGroupPolicy
PopReadHiberbootPolicy
PopReadLegacySimulateProcessorClass
PopReadShutdownPolicy
PopReadSimulateProcessorClass
PopReadSimulateProcessorClasses
PopReadSystemAwayModePolicy
PopRecordPoIrpBlackboxInformation
PopReleaseAdaptiveLock
PopResetCurrentPolicies
PopSaveHiberContext
PopSendSuspendResumeApplicationNotification
PopSendSuspendResumeServiceNotification
PopSetAwayModeStatus
PopSetDevicesSystemState
PopSetMemoryOverwriteRequestAction
PopSleepstudyCaptureResiliencyStatistics
PopSleepstudySendSessionChangeEvent
PopSleepstudySendSessionChangeWnf
PopSleepstudySendWnfNotification
PopSleepstudyStartNextSession
PopSpoilBatteryEstimate
PopSqmAddToStream
PopSqmFanEnumeration
PopSqmThermalCriticalEvent
PopSqmThermalUsermodeEvent
PopSqmThermalZoneEnumeration
PopSystemIrpCompletion
PopThermalHandlePreviousShutdown
PopThermalWorker
PopTraceBootError
PopTraceCr3Mitigated
PopTraceCr3Tripped
PopTraceEsBgActivityPolicyUpdate
PopTraceEsSetting
PopTraceEsState
PopTraceHibernatePolicyUpdate
PopTraceInputSuppressionActionUpdate
PopTraceMonitorOnRequestUserInput
PopTraceNetRefreshTimerArmed
PopTracePowerReconfig
PopTraceSleepCheckpointInitFailure
PopTraceSmbiosChange
PopTraceStandbyConnectivityRundown
PopTraceStandbyConnectivityUpdate
PopTraceSystemIdleS0LowPowerDoze
PopTraceSystemIdleS0LowPowerDozeTimerArmed
PopTraceSystemIdleS0LowPowerDozeTimerCancelled
PopTraceThermalRequestActiveActivity
PopTraceThermalRequestPassiveHistogram
PopTraceThermalStandbyComplete
PopTraceThermalStandbyInitiated
PopTraceThermalZoneActiveActivity
PopTraceThermalZonePassiveHistogram
PopTraceZoneCr3Mitigated
PopTraceZoneCr3Tripped
PopTransitionTelemetryOsState
PopTriggerDiagTraceAoAcCapability
PopUmpoInitializeChannel
PopUmpoInitializeMonitorChannel
PopUmpoProcessMessage
PopUmpoProcessMessages
PopUmpoSendPowerMessage
PopUpdateBackgroundCoolingStatus
PopUpdateExternalDisplayState
PopUpdateUpgradeInProgress
PopUsbErrorWNFNotificationCallback
PopValidateHiberFileSize
PopWatchdogWorker
PopWin32kPowerSettingCallback
PopWnfAirplaneModeCallback
PopWnfAudioCallback
PopWnfFullscreenVideoCallback
PopWnfMixedRealityCallback
PopWnfMobileHotspotCallback
PopWnfSprActiveSessionChangeCallback
PopWriteBsdPoInfo
PopWriteHiberImage
PopWriteHiberPages
PopZeroHiberFile
PpDevCfgInit
PpDevCfgProcessDeviceClass
PpDevCfgProcessDeviceExtensions
PpDevCfgProcessDeviceReset
PpForEachDeviceInstanceDriver
PpProcessClearProblem
PpResetProblemDevices
PpmCapturePerformanceDistribution
PpmCheckComputeEnergy
PpmCheckComputeHeteroResponse
PpmCheckComputeMultiClassHeteroResponse
PpmCheckContinueExecution
PpmCheckInitProcessors
PpmCheckInitProcessorsLegacy
PpmCheckRun
PpmCheckSnapAllDeliveredPerformance
PpmCheckStart
PpmClearSimulatedIdle
PpmEstimateIdleDuration
PpmEventAutonomousModeChange
PpmEventBiosCapChange
PpmEventCoordinatedIdleTransition
PpmEventCoreParkingSoftParkedStateChange
PpmEventCoreParkingStateChange
PpmEventCoreParkingStateChangeEx
PpmEventDomainPerfStateChange
PpmEventEnergyEstimationRundown
PpmEventEnterPlatformIdleState
PpmEventHeteroFavoredCoreRotationChange
PpmEventHeteroPolicy
PpmEventHgsActiveWorkloadClass
PpmEventHgsCoresUnparkedCount
PpmEventHgsHardwareTable
PpmEventHgsNormalizedTable
PpmEventHiddenProcessorBiosCapChange
PpmEventHiddenProcessorPerformance
PpmEventHiddenProcessorThermalCapChange
PpmEventIdleDurationExpiration
PpmEventIdleStateChange
PpmEventLPICoreParking
PpmEventLegacyProcessorPerfStateChange
PpmEventParkNodeCapChange
PpmEventParkNodeClassRecordedStats
PpmEventParkNodeParkHintChanged
PpmEventParkNodePreference
PpmEventParkingCountSelection
PpmEventPerfSelectProcessorState
PpmEventPlatformVetoRequest
PpmEventPlatformVetoRundown
PpmEventProcessorPerfStateChange
PpmEventProcessorVetoRequest
PpmEventProcessorVetoRundown
PpmEventQosClassPolicy
PpmEventQosSupport
PpmEventSoftParkRankListChanged
PpmEventStaticPolicyRundown
PpmEventThermalCapChange
PpmEventTraceAccountingBucketIntervalsRundown
PpmEventTraceDeliveredPerfChange
PpmEventTraceDripsAccountingSnapshot
PpmEventTraceExpectedUtility
PpmEventTraceFailedPerfCheckStart
PpmEventTraceHeteroDistributeUtility
PpmEventTraceHeteroResponse
PpmEventTraceHeteroSets
PpmEventTraceLPIState
PpmEventTraceMultiClassHeteroResponse
PpmEventTraceMultiClassHeteroResponseUpdate
PpmEventTraceParkNodeRundown
PpmEventTracePlatformIdleAccounting
PpmEventTracePpmProfileStatusRundown
PpmEventTracePreVetoAccounting
PpmEventTraceProcessorIdleAccounting
PpmEventTraceProcessorPerformance
PpmEventTraceProcessorPerformanceDomainRundown
PpmEventTraceProcessorPerformanceRundownHv
PpmEventTraceProfileChange
PpmEventTraceProfileEnable
PpmEventTraceProfileSetting
PpmEventTraceProfiles
PpmEventTraceRecordedUtility
PpmEventTraceSoftCoreParkingSelection
PpmEventVetoReasonRundown
PpmEventVpQosChange
PpmHeteroComputeMultiClassUnparkCount
PpmHeteroHgsProcessorInit
PpmHeteroInitializeHgsSupport
PpmHeteroUpdateHgsConfiguration
PpmHvSnapPerformanceAccumulation
PpmIdleCaptureCsVetoAccounting
PpmIdleExecuteTransition
PpmIdleInitializeConcurrency
PpmIdleInstallNewVetoList
PpmIdleSelectStates
PpmInfoRegisterCallbacks
PpmInfoTraceProfileSettings
PpmInitIllegalThrottleLogging
PpmInstallFeedbackCounters
PpmInstallNewIdleStates
PpmMediaBufferingWorker
PpmParkComputeUnparkMask
PpmParkRecordNodeStatistics
PpmParkRegisterParking
PpmParkReportParkedCores
PpmParkSteerInterrupts
PpmParkUpdateConcurrencyTracking
PpmPerfApplyDomainState
PpmPerfApplyProcessorStates
PpmPerfArbitratorApplyProcessorState
PpmPerfCalculateQosClassPolicies
PpmPerfProcCapFloorSettingCallback
PpmPerfRecordMostActiveWorkloadClass
PpmPerfTelemetryWorker
PpmPostProcessMediaBuffering
PpmProcessSettingsFromQueryTable
PpmRegisterPerfStates
PpmRegisterSpmSettings
PpmRemoveIdleStates
PpmSetProfilePolicySetting
PpmSetSimulatedIdle
PpmSnapDripsAccountingSnapshot
PpmSnapPerformanceAccumulation
PpmTraceExitLatency
PpmTracePerfIdleRundown
PpmUnlockProcessors
PpmUpdateIdleStates
PpmUpdatePlatformIdleVeto
PpmUpdateProcessorIdleVeto
PpmUpdateProcessorPolicy
PrpWriteTraceLoggingEvent
PsBootPhaseComplete
PsCreateMinimalProcess
PsCreateSystemThreadEx
PsDispatchIumService
PsInitializeSyscallProviders
PsMapSystemDlls
PsOpenProcess
PsOpenThread
PsPicoWalkUserStack
PsQueryProcessCommandLine
PsQueryProcessExceptionFlags
PsRegisterSyscallProvider
PsRundownVsmEnclave
PsSetLoadImageNotifyRoutineEx
PsShutdownSystem
PsStartSiloMonitor
PsTerminateVsmEnclave
PsUnregisterSiloMonitor
PspAllocateAndQueryNotificationChannel
PspAllocateAndQueryProcessNotificationChannel
PspAllocatePartition
PspAllocateProcess
PspAllocateThread
PspApplyMitigationOptions
PspApplyWorkingSetLimits
PspApplyWorkingSetLimitsToProcess
PspAssignProcessQuotaBlock
PspAssignProcessToJob
PspBuildCreateProcessContext
PspCatchCriticalBreak
PspChangeProcessExecutionState
PspCombineSecurityDomains
PspCopyNodeRelativeMaskToAffinityEx
PspCreatePicoThread
PspCreateProcess
PspCreateSecureThread
PspCreateThread
PspDeleteUserStack
PspDestroySyscallProvider
PspEnforceLimits
PspEnforceLimitsJobPostCallback
PspFoldProcessAccountingIntoJob
PspFreeUserFiberShadowStack
PspFreezeJobTree
PspGetContextThreadInternal
PspGetSetContextInternal
PspHardenMitigationOptions
PspIdentityBasedJobBreakaway
PspInheritMitigationAuditOptions
PspInheritMitigationOptions
PspInitPhase0
PspInitPhase3
PspInitializeFullProcessImageName
PspInitializeThunkContext
PspIsDfssEnabled
PspIsProcessReadyForRemoteThread
PspIumAllocateSecurePool
PspIumGetPhysicalPage
PspIumWorker
PspJobDelete
PspLogAuditTerminateRemoteProcessEvent
PspMapSystemDll
PspOneDirectionSecurityDomainCombine
PspProcessDelete
PspProcessDynamicEHContinuationTargets
PspProcessDynamicEnforcedAddressRanges
PspQueryJobHierarchyAccountingInformation
PspQueryProcessAccountingInformationCallback
PspQueryQuotaLimits
PspQueryRateControlHistory
PspReadIFEOMitigationAuditOptions
PspReadIFEOMitigationOptions
PspReadIFEONodeOptions
PspReadIFEOPerfOptions
PspReadUserQuotaLimits
PspReferenceCpuPartitionByHandle
PspRundownSingleProcess
PspSecureThreadStartup
PspSetContextThreadInternal
PspSetEffectiveJobLimits
PspSetJobIoAttribution
PspSetJobIoRateControl
PspSetNetRateControl
PspSetProcessAffinitySafe
PspSetQuotaLimits
PspSetupUserProcessAddressSpace
PspSetupUserShadowStack
PspSetupUserStack
PspShutdownCsrProcess
PspSyscallProviderServiceDispatchGeneric
PspTrySetProcessPebThrottlingFlags
PspValidateMitigationAuditOptions
PspValidateMitigationOptions
PspWow64GetContextThread
PspWow64InitThread
PspWow64ReadOrWriteThreadCpuArea
PspWow64SetContextThread
PspWow64SetupUserStack
PspWritePebAffinityInfo
PspWriteTebIdealProcessor
PspWriteTebImpersonationInfo
RaiseException
RamdiskStart
RawMountVolume
RawQueryFileSystemInformation
RawQueryFsSizeInfo
ReadStringDelimited
ReadStringDelimited
RegistryOverwriteCentralProcessor
RtlAddAccessFilterAce
RtlAddMandatoryAce
RtlAddResourceAttributeAce
RtlApplyImportRelocationToImage
RtlApplyImportRelocationToPage
RtlApplyIndirectRelocationToPage
RtlApplySwitchJumpRelocationToPage
RtlAssert
RtlCapabilityCheck
RtlCheckTokenCapability
RtlCheckTokenMembershipEx
RtlContinueLongJump
RtlConvertSidToUnicodeString
RtlCreateHeap
RtlCultureNameToLCID
RtlDeriveCapabilitySidsFromName
RtlDisableXfgOnTarget
RtlDispatchException
RtlEqualPrefixSid
RtlEthernetStringToAddressA
RtlEthernetStringToAddressW
RtlFileMapMapView
RtlFindMessage
RtlFormatCurrentUserKeyPath
RtlFormatMessageEx
RtlGUIDFromString
RtlGenerate8dot3Name
RtlGenerateClass5Guid
RtlGetCpuVendor
RtlGetProcessorSignature
RtlGetProductInfo
RtlGetSetBootStatusData
RtlImpersonateSelfEx
RtlIncrementCorrelationVector
RtlInitFunctionOverrideCapabilities
RtlInitializeBootStatusDataBlackBox
RtlInt64ToUnicodeString
RtlIntegerToChar
RtlIntegerToUnicode
RtlIntegerToUnicodeString
RtlIpv4AddressToStringExA
RtlIpv4AddressToStringExW
RtlIpv4StringToAddressA
RtlIpv4StringToAddressW
RtlIpv6AddressToStringExA
RtlIpv6AddressToStringExW
RtlIsNameLegalDOS8Dot3
RtlIsUntrustedObject
RtlIsValidProcessTrustLabelSid
RtlLargeIntegerToChar
RtlLargeIntegerToUnicode
RtlLoadString
RtlLocalTimeToSystemTime
RtlOsDeploymentState
RtlPerformRetpolineRelocationsOnImageEx
RtlQueryAtomInAtomTable
RtlQueryImageFileKeyOption
RtlQueryImageXfgFilter
RtlQueryModuleInformation
RtlQueryPackageClaims
RtlQueryValidationRunlevel
RtlRaiseCustomSystemEventTrigger
RtlRestoreBootStatusDefaults
RtlSidDominates
RtlSystemTimeToLocalTime
RtlUnicodeStringToInt64
RtlUnwind
RtlUnwindEx
RtlUpdateImportRelocationsInImage
RtlUpdateSwapReference
RtlVerifyVersionInfo
RtlpAllocateHeapRaiseException
RtlpAllowsLowBoxAccess
RtlpCapabilityCheckSystemCapability
RtlpCheckDynamicTimeZoneInformation
RtlpCopyAces
RtlpCopyEffectiveAce
RtlpCreateUserProcess
RtlpCreateUserThreadEx
RtlpDynamicLookasideRebalance
RtlpEtcIsValidFeatureId
RtlpFcApplyUpdateAndAddFeature
RtlpFcCalculateRequiredSizeForNewFeatureTable
RtlpFcNotifyFeatureUsageTarget
RtlpFcSectionTypeToBufferType
RtlpFindRegTziForCurrentYear
RtlpFlsFree
RtlpGetDynamicTimeZoneInfoHandle
RtlpGetNtProductTypeFromRegistry
RtlpGetTimeZoneInfoHandle
RtlpGetTokenNamedObjectPath
RtlpHpAllocVA
RtlpHpCustomVaCallbacksRegistrarRegister
RtlpHpLfhBucketSubsegmentStatsUpdate
RtlpHpLfhBucketUpdateAffinityMapping
RtlpHpScheduleCompaction
RtlpHpVaMgrAlloc
RtlpInitNlsFileName
RtlpInitializeNonVolatileFlush
RtlpIsAppContainer
RtlpIsNameInExpressionPrivate
RtlpLogCapabilityCheckLatency
RtlpMuiRegAddLanguageByName
RtlpNewSecurityObject
RtlpNormalizeAcl
RtlpPopulateLanguageConfigList
RtlpProcessIFEOKeyFilter
RtlpQueryNlsSystemCodePages
RtlpQueryTimeZoneInformationWorker
RtlpReadExtendedContext
RtlpSetSecurityObject
RtlpSysVolCheckOwnerAndSecurity
RtlpSysVolCreateSecurityDescriptor
RtlpSysVolTakeOwnership
RtlpUpdateDynamicTimeZones
RtlpValidTrustSubjectContext
RtlpVerCompare
RtlpWalkFrameChain
SC_DEVICE::GetStorageProperty
SC_DEVICE::Initialize
SC_DISK::GenerateId
SC_DISK::Initialize
SC_GPT::CreatePartitionTable
SC_MBR::CreatePartitionTable
SC_MBR::WritePartitionTable
SLQueryLicenseValueInternal
SMKM_STORE<SM_TRAITS>::SmStCleanup
SMKM_STORE<SM_TRAITS>::SmStStart
SMKM_STORE<SM_TRAITS>::SmStSwapStore
SMKM_STORE<struct_SM_TRAITS>::SmStDirectRead
SMKM_STORE<struct_SM_TRAITS>::SmStPrioritizeRegionsStore
SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStore
SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeCheckPresent
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys
SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogWorker
SPCallServerHandleClepKdf
SPCallServerHandleClepSign
SPCallServerHandleIsAppLicensed
ST_STORE<SM_TRAITS>::StDmStart
ST_STORE<struct_SM_TRAITS>::StCompactRegions
ST_STORE<struct_SM_TRAITS>::StCompactionPerformInMem
ST_STORE<struct_SM_TRAITS>::StCompactionPickPriority
ST_STORE<struct_SM_TRAITS>::StDmEtaPerformIo
ST_STORE<struct_SM_TRAITS>::StDmPageRetrieve
ST_STORE<struct_SM_TRAITS>::StDmRegionEvict
ST_STORE<struct_SM_TRAITS>::StDmSinglePageCopy
ST_STORE<struct_SM_TRAITS>::StDmSinglePageRetrieveSync
ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd
SaveNodeDistanceInformation
SbpStartLanman
ScExtractDeviceStrings
SdbGetDatabaseMatch
SdbGetEntryFlags
SdbGetMergeRedirectPath
SdbGetPathCustomSdb
SdbMakeIndexKeyFromStringEx
SdbReadEntryInformation
SdbTagRefToTagID
SdbpCheckMatchingRegistryEntry
SdbpCheckMatchingWildcardFiles
SdbpCreateSearchDBContext
SdbpFindFirstIndexedWildCardTag
SdbpFindNextIndexedWildCardTag
SdbpGetExeEntryFlags
SdbpGetFileTimestamp
SdbpGetPathAppPatch
SdbpGetPathAppPatchPreRS3
SdbpGetPathAppraiser
SdbpGetPathCustomSdb
SdbpGetPathCustomSdbPreRS3
SdbpMatchOsVersion
SdbpOpenLocalDatabaseEx
SddlAddAccessFilterAce
SddlAddMandatoryAce
SddlAddProcessTrustLabelAce
SddlAddScopedPolicyIDAce
SddlpUuidFromString
SeAccessCheckByType
SeAccessCheckFromState
SeAccessCheckWithHint
SeAdtRegistryValueChangedAuditAlarm
SeAuditBootConfiguration
SeAuditFipsCryptoSelftests
SeAuditHandleDuplication
SeAuditHardLinkCreationWithTransaction
SeAuditPlugAndPlay
SeAuditProcessCreation
SeAuditProcessExit
SeAuditSystemTimeChange
SeAuditTransactionStateChange
SeCaptureObjectTypeList
SeCheckAuditPrivilege
SeCheckForCriticalAceRemoval
SeCheckPrivilegedObject
SeEtwWriteKMCveEvent
SeGetTokenDeviceMap
SeLogAccessFailure
SeMakeAnonymousLogonToken
SeMakeAnonymousLogonTokenNoEveryone
SeMakeSystemToken
SeOperationAuditAlarm
SePrivilegePolicyCheck
SeQuerySecurityAttributesTokenAccessInformation
SeReportSecurityEventWithSubCategory
SeSinglePrivilegeCheck
SeSinglePrivilegeCheckEx
SeSubProcessToken
SecureDump_ConvertBinaryToHexString
SecureDump_ConvertToRsaBlob
SecureDump_Encrypt_DmpData
SecureDump_LoadCertAndProvisionKey
SendCaptureStateNotificationsWorker
SepAccessCheck
SepAccessCheckAndAuditAlarm
SepAccessCheckEx
SepAdjustPrivileges
SepAdtCloseObjectAuditAlarm
SepAdtDeleteObjectAuditAlarm
SepAdtGenerateDiscardAudit
SepAdtInitializeBounds
SepAdtLogAuditFailureEvent
SepAdtLogAuditRecord
SepAdtObjectReferenceAuditAlarm
SepAdtOpenObjectAuditAlarm
SepAdtOpenObjectForDeleteAuditAlarm
SepAdtPrivilegeObjectAuditAlarm
SepAdtPrivilegedServiceAuditAlarm
SepAdtSecurityDescriptorChangedAuditAlarm
SepAdtStagingEvent
SepAdtTokenRightAdjusted
SepAppendAceToTokenDefaultDacl
SepAppendAceToTokenObjectAcl
SepAuditAssignPrimaryToken
SepCanTokenMatchAllPackageSid
SepCleanupLUIDDeviceMapDirectory
SepCommonAccessCheckEx
SepCopyAnonymousTokenAndSetSilo
SepCreateTokenEx
SepDesktopAppxSubProcessToken
SepGetProcUniqueLuidAndIndexFromAttributeInfo
SepGetStackTraceHash
SepInitializationPhase1
SepInitializeDebugOptions
SepLoadNgenLocations
SepLogTokenSidManagement
SepLogUnmatchedSessionFlagImpersonationAttempt
SepMandatoryIntegrityCheck
SepMandatorySubProcessToken
SepParseElamCertResources
SepReadAndInsertCaps
SepReadAndPopulateCapes
SepRegQueryValue
SepRmCallLsa
SepRmCommandServerThread
SepRmDispatchDataToLsa
SepRmLsaConnectRequest
SepRmVerifyLsaProtectionLevel
SepSecureBootCheckForUpdates
SepSetProcessTrustLabelAceForToken
SepValidateReferencedCachedHandles
SepVerifyDesktopAppPolicyOverrideCaller
SepVerifyDesktopAppxImage
SepVerifyDesktopAppxPackageName
SetFailureLocation
SiFindSystemPartition
SiGetDeviceNumberInformation
SiGetEfiSystemDevice
SiGetSystemDeviceName
SiIsWinPeHardDiskZeroUfdBoot
SiQueryProperty
SiValidateSystemPartition
SmEtwEnabled
SmEtwLogRegionOp
SmEtwLogStoreCorruption
SmEtwLogStoreOp
SmEtwLogStoreStateChange
SmFirstTimeInit
SmFpPreAllocate
SmKmEtwAppendObjectName
SmKmEtwLogStoreChange
SmKmEtwLogStoreStats
SmKmFileInfoGetPath
SmKmKeyGenLoadKey
SmKmRegParamsLoad
SmKmSqmAddToStream
SmKmStoreFileCreate
SmKmStoreFileGetExtents
SmKmStoreFileOpenVolume
SmKmStoreFileWriteHeader
SmKmStoreTerminateWorker
SmProcessCompressionInfoRequest
SmProcessCreateRequest
SmProcessQueryStoreStats
SmProcessStoreMemoryPriorityRequest
SmQueryStoreCommitUsage
SmQuerySystemInformation
SmStoreCreate
SmStorePhysicalRequestIssue
SmcProcessCreateRequest
SmcProcessListRequest
SmcProcessStatsRequest
SmpDirtyStoreCreate
SshSessionManagerTraceCsEnterReason
SshSessionManagerTraceCsExitReason
SshSessionManagerTraceDirtyTransition
SshSessionManagerTracePostSleepNotification
SshSessionManagerTracePreSleepNotification
SshSessionManagerTraceShutdownAction
SshSessionManagerTraceSystemStop
SshpAlpcInitialize
SshpAlpcProcessAlpcMessage
SshpAlpcSendMessage
SshpFlushBlockerDataCache
SshpGenerateDeviceFriendlyName
SshpSendSessionData
SshpSessionManagerFlushControlEventBuffer
SshpWnfCallback
SshpWriteBlocker
StEtaHelper::StartHelper
SymCryptDetectCpuFeaturesByCpuid
SymCryptEcpointMultiScalarMulWnafWithInterleaving
SymCryptEcpointScalarMulFixedWindow
SymCryptInitEnvWindowsKernelmodeWin8_1nLater
SymCryptParallelSha256Append
SymCryptParallelSha256Process
SymCryptRsaCoreEnc
SymCryptRsakeyCalculatePrivateFields
SymCryptSha256
SymCryptSha384Result
SymCryptSha512AppendBlocks_ull
SymCryptShortWeierstrassAddDiffNonZero
SymCryptShortWeierstrassAddSideChannelUnsafe
SymCryptShortWeierstrassDouble
SymCryptShortWeierstrassIsEqual
SymCryptTwistedEdwardsAdd
SymCryptTwistedEdwardsDouble
SymCryptTwistedEdwardsOnCurve
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
TtmiLogCalloutStart
TtmiLogCalloutStop
TtmiLogCalloutWatchdogCrashSkipped
TtmiLogCleanupCurrentSessionStart
TtmiLogCleanupCurrentSessionStop
TtmiLogConsoleUserPresent
TtmiLogDeviceArrivalNotified
TtmiLogDeviceArrivedTerminalEvent
TtmiLogDeviceAssignedTerminalEvent
TtmiLogDeviceDepartedTerminalEvent
TtmiLogDeviceDepartureNotified
TtmiLogDeviceEnumeratedTerminalEvent
TtmiLogDeviceFromTerminalRemoved
TtmiLogDeviceInputNotified
TtmiLogDeviceRundown
TtmiLogDeviceSetInputWakeCapability
TtmiLogDeviceToTerminalAssigned
TtmiLogDispatchApiStart
TtmiLogDispatchApiStop
TtmiLogDisplayPowerRequestSet
TtmiLogEnterProximity
TtmiLogError
TtmiLogExitProximity
TtmiLogInactivityTimerReset
TtmiLogInactivityTimoutUpdate
TtmiLogInitCurrentSessionStart
TtmiLogInitCurrentSessionStop
TtmiLogInitiateModernStandbyTransitionStart
TtmiLogInitiateModernStandbyTransitionStop
TtmiLogProximityBlockedRequest
TtmiLogProximityPowerPress
TtmiLogQueueCreated
TtmiLogQueueDequeueEvent
TtmiLogQueueDestroyed
TtmiLogQueueEnqueueEvent
TtmiLogQueueHandleClosed
TtmiLogQueueHandleOpened
TtmiLogSessionActivate
TtmiLogSessionCsExitComplete
TtmiLogSessionDeactivate
TtmiLogSessionDeviceAssignmentPolicySet
TtmiLogSessionDisplayRequiredDereference
TtmiLogSessionDisplayRequiredPowerRequestUpdated
TtmiLogSessionDisplayRequiredReference
TtmiLogSessionMonitorControl
TtmiLogSessionPowerControlStart
TtmiLogSessionPowerControlStop
TtmiLogSessionPowerRequestAcknowledged
TtmiLogSessionPowerRequestCreated
TtmiLogSessionPowerRequestDeleted
TtmiLogSessionPowerStateChange
TtmiLogSessionRundown
TtmiLogSessionWorkerPass
TtmiLogSessionWorkerStart
TtmiLogSessionWorkerStop
TtmiLogTerminalCleanup
TtmiLogTerminalCreated
TtmiLogTerminalDestroyed
TtmiLogTerminalDisplayStateChangedEvent
TtmiLogTerminalDisplayTimeouts
TtmiLogTerminalHandleClosed
TtmiLogTerminalHandleOpened
TtmiLogTerminalOffRequest
TtmiLogTerminalOnRequest
TtmiLogTerminalRundown
TtmiLogTerminalStateMachine
TtmpCommitTerminalDisplayStateUpdateWorker
TtmpGetConfigOverride
TtmpSessionWorker
UpcaseUnicodeToUTF8NHelper
ValidFilter
VerifierNtCreateFile
VerifierNtReadFile
VerifierNtWriteFile
VfCheckImageCompliance
VfCheckUserHandle
VfDeadlockAcquireResource
VfDeadlockInitializeResource
VfDeadlockPluginEntry
VfDeadlockReleaseResource
VfDmaPluginEntry
VfErrorReport7
VfErrorReport8
VfIoDeleteDevice
VfIoDetachDevice
VfIovPluginEntry
VfIrpLogRecordEvent
VfIrqlPluginEntry
VfIsPCIBus
VfLwSPEntry
VfMiscPluginEntry
VfPoolTrackingEntry
VfSecurityEntry
VfSpecialPoolEntry
VfThunkApplyPristineToAllSession
VfThunkApplyWdmThunkToAllSession
VfUtilPrintCheckinString
VhdAutoAttachVirtualDisks
VhdiAutoAttachOneVhd
VhdiGetVolumeNumber
VhdiInitializeBootDisk
VhdiMountVhdFile
ViErrorReport1
ViErrorReport10
ViErrorReport4
ViErrorReport6
ViGenericVerifyIrpStackDownward
ViGenericVerifyNewIrp
ViIsBTSSupported
ViPtLogStackCallout
ViSetupBTSPerProcNoEnable
VmAccessFault
VmpAccessFaultBatchResolve
VmpLogAccessFault
VmpLogAccessFaultRange
VmpLogColdHint
VmpLogLargeSlatFill
VmpLogSparseSlatFill
VmpLogTbFlushSlatInvalidate
VmpPinMemoryRange
VmpPrefetchWorker
VmpProcessAccessedBatch
VmpProcessUpdateSlat
VmpQueryAccessedState
VrpIoctlDeviceDispatch
VrpPostEnumerateKey
VrpPostOpenOrCreate
VrpPostQueryKey
VrpPostUnloadKey
VrpPreFlushKey
VrpPreLoadKey
VrpPreOpenOrCreate
VrpPreQueryKeyName
VrpRegistryCallback
VrpRegistryUnload
VslAbortLiveDump
VslAccessPciDevice
VslAllocateKernelShadowStack
VslAllocateSecureHibernateResources
VslApplyDynamicRelocations
VslApplyHotPatch
VslApplySecureImageFixups
VslBindNtIum
VslCallEnclave
VslCaptureSecureImageIat
VslCloseSecureHandle
VslCollectLiveDumpInSk
VslCompleteSecureDriverLoad
VslConfigureDynamicMemory
VslConfigureSecureAtsDevice
VslConnectSwInterrupt
VslCreateEnclave
VslCreateSecureAllocation
VslCreateSecureImageSection
VslCreateSecureProcess
VslCreateSecureSection
VslCreateSecureThread
VslDebugProtectSecureProcessMemory
VslDebugReadWriteSecureProcess
VslDeleteSecureSection
VslDetermineHotPatchType
VslDetermineHotPatchUndoTableSize
VslEnableKernelCfgTarget
VslEnableOnDemandDebugWithResponse
VslEndSecurePageIteration
VslExchangeEntropy
VslFastFlushSecureRangeList
VslFillSecureAllocation
VslFinalizeLiveDumpInSk
VslFinalizeSecureImageHash
VslFinishSecureImageValidation
VslFinishStartSecureProcessor
VslFlushSecureAddressSpace
VslFreeKernelShadowStack
VslFreeSecureHibernateResources
VslFreeSecureImageIat
VslGetEtwDebugId
VslGetNestedPageProtectionFlags
VslGetOnDemandDebugChallenge
VslGetSecurePageList
VslGetSecurePciDeviceAlternateFunctionNumberForVtl0Dma
VslGetSecurePciDeviceBootConfiguration
VslGetSecurePciEnabled
VslGetSecurePebAddress
VslGetSecureSpeculationControlInformation
VslGetSecureTebAddress
VslGetSetSecureContext
VslHandleKsrCall
VslInitFunctionOverrideCapabilities
VslInitializeEnclave
VslInitializeSecureKernelCfg
VslInitializeSecurePool
VslInitializeSecureProcess
VslIsEncryptionKeyAvailable
VslIsTrustletRunning
VslIumEfiRuntimeService
VslIumEtwEnableCallback
VslKernelShadowStackAssist
VslLiveDumpQuerySecondaryDataSize
VslLoadEnclaveData
VslLoadEnclaveModule
VslMakeCodeCatalog
VslMakeProtectedPageExecutable
VslMakeProtectedPageWritable
VslNotifyShutdown
VslObtainHotPatchUndoTable
VslPrepareDriverForPatch
VslPrepareSecureImageRelocations
VslProvisionDumpEncryption
VslPublishSyscallProviderServiceTables
VslQuerySecureDevice
VslQuerySecureKernelProfileInformation
VslQueryVirtualMemory
VslReapplyBootIndirectPatches
VslReapplyImportOptimizationForDriverVerifier
VslRegisterBootDrivers
VslRegisterLogPages
VslRegisterSecureSystemDlls
VslRegisterSecureSystemProcess
VslRegisterSyscallProviderServiceTableMetadata
VslRelaxQuotas
VslRelocateImage
VslReportBugCheckProgress
VslReserveProtectedPages
VslResetKernelShadowStack
VslRetrieveMailbox
VslRevertHotPatch
VslRundownSecureProcess
VslSecurePoolAllocate
VslSecurePoolFree
VslSecurePoolUpdate
VslSendDebugAttachNotifications
VslSetCodeIntegrityPolicy
VslSetPlaceholderPages
VslSetupLiveDumpBufferInSk
VslSlowFlushSecureRangeList
VslStartSecurePageIteration
VslStartSecureProcessor
VslSvcEnterIumSecureMode
VslTerminateSecureThread
VslTransferSecureImageVersionResource
VslTransformDumpKey
VslUpdateFreezeTimeBias
VslValidateDynamicCodePages
VslValidateSecureImagePages
VslVerifyPage
VslVerifySessionSpace
VslpAddLiveDumpBufferChunk
VslpConnectedStandbyPoCallback
VslpConnectedStandbyWnfCallback
VslpEnterIumSecureMode
VslpIumInitializeTelemetry
VslpIumPhase0Initialize
VslpIumPhase4Initialize
VslpKsrEnterIumSecureMode
VslpLiveDumpStart
VslpSetupLiveDumpBuffer
VslpVerifySessionSpace
WarbirdCrypto::CCipherFeistel64::CallRoundFunction
WbAddWarbirdEncryptionSegment
WbGetInitializedEncryptionSegment
WbHeapExecuteCall
WdiDispatchControl
WdipAccessCheck
WdipSemLoadLocalGroupPolicy
WdipSemLoadNextContextProvider
WdipSemLoadNextEndEvent
WdipSemLoadNextScenario
WdipSemLoadScenarioTable
WdipSemQueryValueFromRegistry
WdipSemSqmAddToStream
WdipSemSqmIncrementDword
WdipSemSqmInit
WdipSemSqmLogInflightLimitExceededDataPoints
WdipSemWriteInflightLimitExceededEvent
WdipSemWriteMisconfigEvent
WdipSemWriteProviderLimitExceededEvent
WdipSemWriteScenarioLimitExceededEvent
WdipSemWriteSemActionsEvent
WdipSemWriteSemFailureEvent
WdipSemWriteTimeoutEvent
WheaAddErrorSource
WheaLogInternalEvent
WheaPersistBadPageToRegistry
WheaRemoveErrorSource
WheaRemoveErrorSourceDeviceDriver
WheaReportHwError
WheaSelLogErrorPkt
WheapAddToDefectListInPlugin
WheapAttemptPhysicalPageOffline
WheapClearPoison
WheapCreateRecordFromGenericErrorData
WheapExecuteRowFailureCheck
WheapGenerateETWErrorRecord
WheapGenerateETWErrorRecordLarge
WheapInitErrorReportDeviceDriver
WheapLogAddToDefectListFail
WheapLogInitEvent
WheapLogPageOfflineAttemptEvent
WheapLogPolicyTelemetry
WheapLogProcessTerminateEvent
WheapPfaLogPageMonitorRemoval
WheapProcessOfflineList
WheapReverseAddressTranslateToPAInPlugin
WheapTrackPendingPage
WheapTranslateAddressInPlugin
WheapWmiExecuteErrorSourceMethod
WmipCreateGuidObject
WmipDisableCollectionForRemovedGuid
WmipEnableCollectionForNewGuid
WmipGetGuidSecurityDescriptor
WmipIncludeStaticNames
WmipInitializeDataStructs
WmipInsertStaticNames
WmipIoControl
WmipOpenGuidObject
WmipPrepareWnodeSI
WmipProcessLegacyEtwCallback
WmipQueryAllData
WmipQueryAllDataMultiple
WmipQuerySetExecuteSI
WmipQuerySingleMultiple
WmipQueryWmiDataBlock
WmipReceiveNotifications
WmipSecurityMethod
WmipSendEnableDisableRequest
Xp10BuildAndWriteHuffmanTables
Xp10Compute2Crc32
Xp10Compute2Crc64
_CmAddDeviceToContainer
_CmAddPanelDevice
_CmBuildDevicePanelId
_CmClassFilterCallback
_CmCreateDevice
_CmCreateDeviceContainer
_CmCreateDeviceInterface
_CmCreateDeviceInterfaceWorker
_CmCreateDevicePanel
_CmCreateInstallerClass
_CmCreateInterfaceClass
_CmDeleteCommonClassRegKey
_CmDeleteDevice
_CmDeleteDeviceContainer
_CmDeleteDeviceContainerRegKey
_CmDeleteDeviceInterface
_CmDeleteDeviceInterfaceRegKey
_CmDeleteDeviceInterfaceWorker
_CmDeleteDevicePanel
_CmDeleteDevicePanelRegKey
_CmDeleteDeviceRegKey
_CmDeleteDeviceRegKeyWorker
_CmDeleteDeviceWorker
_CmDeleteInstallerClass
_CmDeleteInstallerClassWorker
_CmDeleteInterfaceClass
_CmDeleteInterfaceClassWorker
_CmDevicePanelEnumSubkeyCallback
_CmEnumDevicesInContainerWithCallback
_CmGetDeviceChildren
_CmGetDeviceContainerIdFromBase
_CmGetDeviceInterfaceClassGuid
_CmGetDeviceInterfaceRegKeyPath
_CmGetDeviceInterfaceSubkeyPath
_CmGetDeviceMappedPropertyFromComposite
_CmGetDeviceMappedPropertyFromRegProp
_CmGetDeviceParent
_CmGetDeviceRegProp
_CmGetDeviceRegPropWorker
_CmGetDeviceSiblings
_CmGetDeviceSoftwareKey
_CmGetDeviceSoftwareKeyPath
_CmGetInstallerClassMappedPropertyFromRegValue
_CmGetInstallerClassRegProp
_CmGetMatchingCommonClassList
_CmGetMatchingDeviceContainerList
_CmGetMatchingDeviceInterfaceList
_CmGetMatchingDeviceList
_CmGetMatchingDevicePanelList
_CmGetMatchingFilteredDeviceInterfaceList
_CmGetMatchingFilteredDeviceList
_CmGetRegKeySecurityDescriptor
_CmIsDeviceSafeRemovalRequired
_CmIsLocalMachineContainer
_CmMatchLastKnownParentCallback
_CmOpenCommonClassRegKey
_CmOpenDeviceContainerRegKey
_CmOpenDeviceInterfaceRegKey
_CmOpenDevicePanelRegKey
_CmRemoveDeviceFromContainer
_CmRemovePanelDevice
_CmServiceFilterCallback
_CmSetDeviceMappedPropertyFromDriverKeyRegValue
_CmSetDeviceMappedPropertyFromRegProp
_CmSetDeviceRegProp
_CmSetInstallerClassRegProp
_CmSplitDevicePanelId
_CmUpdateDevicePanel
_CmUpdateDevicePanelInterface
_CmValidateDeviceInterfaceName
_CmValidateDevicePanelName
_PnpDeletePropertyWorker
_PnpDeviceRaisePropertyChangeEventWorker
_PnpGetEnumSecurityDescriptor
_PnpGetGenericStoreProperty
_PnpGetGenericStorePropertyKeys
_PnpGetGenericStorePropertyLocales
_PnpGetPropertiesSecurityDescriptor
_PnpIsValidGuidString
_PnpOpenPropertiesKey
_PnpSetPropertyWorker
_RegRtlCopyTreeInternal
_RegRtlEnumKey
_RegRtlEnumKeyWithCallback
_RegRtlQueryInfoKey
_RegRtlQueryValue
_RtlpMuiRegAddBaseLanguage
_RtlpMuiRegInitLIPLanguage
_RtlpMuiRegLoadInstalledFromKey
_RtlpMuiRegPopulateBaseLanguages
_RtlpMuiRegValidateInstalled
_RtlpRemovePendingDeleteLanguages
_SysCtxOpenControlSet
_SysCtxOpenMachine
_SysCtxRegOpenCurrentUserKey
__GSHandlerCheckCommon
_handle_error
_handle_errorf
_output_l
_output_s
_tlgWriteTemplate<long___cdecl(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),&long___cdecl__tlgWriteTransfer_EtwWriteTransfer(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),struct__GUID_const*___ptr64,struct__GUID_const*__ptr64>::Write<struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>>
_woutput_l
_woutput_s
pIoQueryBusDescription
pIoQueryDeviceDescription
qsort
qsort_s
strspn
strtok_s
vDbgPrintExWithPrefixInternal
wil_details_FeatureReporting_ReportUsageToService
Expand for full list:
AdtpBuildAccessReasonAuditString
AdtpBuildAccessReasonAuditStringInternal
AdtpBuildAccessesString
AdtpBuildReplacementString
AdtpBuildSecurityDescriptorUnicodeString
AdtpBuildSidListString
AdtpBuildStagingReasonAuditStringInternal
AdtpBuildUserAccountControlString
AdtpFormatPrefix
AdtpInitializeDriveLetters
AdtpWriteToEtwAdtpWriteToEtwEx
AlpcViewDestroyProcedure
AlpcpAcceptConnectPort
AlpcpCheckConnectionSecurity
AlpcpConnectPort
AlpcpCreateConnectionPort
AlpcpExposeViewAttributeInSenderContext
AlpcpForceUnlinkSecureView
AlpcpImpersonateMessage
AlpcpInitSystem
AlpcpLogClosePort
AlpcpLogConnectFail
AlpcpLogConnectRequest
AlpcpLogConnectSuccess
AlpcpLogReceiveMessage
AlpcpLogSendMessage
AlpcpLogUnwait
AlpcpLogWaitForReply
AlpcpPortQueryConnectedSidInfo
AlpcpPrepareViewForDelivery
AlpcpQuerySidToken
AlpcpRestoreWriteAccess
AlpcpValidateAndSetPortAttributes
Amd64InitializeCacheStatus
Amd64InitializeDataFabricStatus
Amd64InitializeProfiling
Amd64InitializeUncoreProfiling
AnFwDisplayFade
ApiSetpLoadSchemaExtension
ApiSetpLoadSchemaExtensions
AppendUlongAsHexadecimalW
ArbBootAllocation
ArbBuildAssignmentOrdering
ArbInitializeOsInaccessibleRange
ArbQueryConflict
ArbRetestAllocation
ArbShareDriverExclusive
AslEnvGetProcessWowInfo
AslEnvGetSysNativeDirPathForGuestBuf
AslEnvGetSystem32DirPathBuf
AslFileMappingCreate
AslPathSplit
AslPathToSystemPath
AslRegistryEnumKey
AslRegistryGetUInt32_UStr
AslpFileGet16BitDescription
AslpFileGet16BitModuleName
AslpFileGetClrVersionAttribute
AslpFileGetExportName
AslpFileQueryVersionString
AstLogDeviceCreated
AstLogDeviceSDDLUpdated
AuthzBasepDeviceMemberOf
AuthzBasepEvaluateAceCondition
AuthzBasepInitializeResourceClaimsFromSacl
AuthzBasepMemberOf
B_TREE<_SM_PAGE_KEY,ST_STORE<SM_TRAITS>::ST_PAGE_ENTRY,4096,NP_CONTEXT,B_TREE_KEY_COMPARATOR<SM_PAGE_KEY>>::BTreeSearchResultDeref
B_TREE<union__SM_PAGE_KEY,struct_SMKM_STORE_MGR<struct_SM_TRAITS>::SMKM_FRONTEND_ENTRY,4096,struct_B_TREE_DUMMY_NODE_POOL,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY>>::BTreeSearchKey
B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY>>::BTreeFindLeafSibling
B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY>>::BTreeIteratorCleanup
B_TREE<union__SM_PAGE_KEY,struct_ST_STORE<struct_SM_TRAITS>::ST_PAGE_ENTRY,4096,struct_NP_CONTEXT,struct_B_TREE_KEY_COMPARATOR<union__SM_PAGE_KEY>>::BTreeIteratorFromSearchResult
B_TREE<unsigned_long,ST_STORE<SM_TRAITS>::_ST_HASH_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeSearchResultDeref
B_TREE<unsigned_long,ST_STORE<SM_TRAITS>::_ST_REGION_ENTRY,4096,NP_CONTEXT,ST_STORE<SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeSearchResultDeref
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeFindLeafSibling
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeIteratorCleanup
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_HASH_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_HASH_ENTRY_COMPARATOR>::BTreeIteratorFromSearchResult
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeFindLeafSibling
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeIteratorCleanup
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeIteratorFromSearchResult
BapdRecordFirmwareBootStats
BapdWriteEtwEvents
BapdpMarshallBootDataToRegistry
BapdpProcessBCDCache
BapdpProcessBitlockerStatus
BapdpProcessBootMetadata
BapdpProcessEDrvHintInfo
BapdpProcessEtwEvents
BapdpProcessFwUpdateResults
BapdpProcessHSTIResults
BapdpProcessResumeInformation
BapdpProcessSpacesBootInformation
BapdpProcessVsmKeyBlobs
BapdpProcessWmdResults
BapdpRecordIumStatus
BapdpRegisterWbclData
BcdGetElementDataWithFlags
BcdSetElementDataWithFlags
BcpDisplayErrorInformation
BcpDisplayProgress
BgkAcquireDisplayOwnership
BgkNotifyDisplayOwnershipChange
BgpGxDrawRectangle
BgpRasPrintGlyph
BiAddStoreFromFile
BiAdjustPrivilege
BiBindEfiBootManager
BiBindEfiEntries
BiBuildIdentifierList
BiCreateObject
BiCreatePartitionDevice
BiDeleteEfiVariable
BiDeleteElement
BiDoesHiveExist
BiEnumerateSubKeys
BiExportEfiBootManager
BiGetCurrentBootEntryIdentifier
BiGetDefaultBootEntryIdentifier
BiGetFirmwareType
BiGetNtPartitionPath
BiGetObjectReferenceFromEfiEntry
BiGetPartitionInformation
BiOpenStoreKeyFromObject
BiResolveLocateDevice
BiUpdateObjectReferenceInEfiEntry
CMFCheckAccess
CMFFlushHitsFile
CMFGetFileSizeEx
CMFRegisterEventTime
CMFSystemThreadRoutine
CarEtwCrashEvent
CarEtwRegister
CarEtwWriteBugCheckEvent
CarEtwWriteLiveDumpEvent
CarLiveDumpCallBack
CarLoadImageHandler
CarReadRegistry
CarTipLogDriverLoad
CcAsyncLazywriteWorker
CcAsyncLazywriteWorkerMulti
CcAsyncReadWorker
CcCachemapUninitWorkerThread
CcGetBcbListHeadLargeOffset
CcGetDeviceGuidAsync
CcPerfLogCanWriteFail
CcPerfLogExtraWBThreadAction
CcPerfLogFlushCache
CcPerfLogFlushSection
CcPerfLogLazyWriteScan
CcPerfLogScheduleReadAhead
CcPerfLogVolumeLogHandleInfo
CcPerfLogWorkItemEnqueue
CcPerformReadAhead
CcPostVolumeTelemetry
CcQueueLazyWriteScanThread
CcQueueLazyWriteScanThreadForVolume
CcSetVacbLargeOffset
CcUpdateDynamicRegistrySettings
CcWorkerThread
CimfsInitialize
CimfsInitializeBootDisk
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmCreateKey
CmDeleteKey
CmDeleteValueKey
CmEnumerateKey
CmEnumerateValueFromLayeredKey
CmEnumerateValueKey
CmEtwRunDown
CmFcInitSystem3
CmFcManagerOverwriteFeatureConfigurationSection
CmFcManagerQueryFeatureConfigurationSectionInformation
CmFcManagerStartBootPhase
CmFcManagerStartRuntimePhase
CmFcManagerUpdateFeatureConfigurations
CmFcManagerUpdateFeatureUsageSubscriptions
CmFcpChangeSubscriptionWrapper
CmFcpManagerArmFeatureUsageRetryTimer
CmGetSystemDriverList
CmInitSystem1
CmInitializeProcessor
CmIsLastKnownGoodBoot
CmKeyBodyRemapToVirtual
CmKeyBodyRemapToVirtualForEnum
CmKeyBodyReplicateToVirtual
CmKtmNotification
CmLoadAppKey
CmLoadDifferencingKey
CmLoadKey
CmLogMcUpdateStatus
CmLogTmRmAction
CmOpenKey
CmQueryFeatureConfigurationSections
CmQueryKey
CmQueryLayeredKey
CmQueryValueKey
CmReconcileAndValidateAllHives
CmRenameKey
CmReplaceKey
CmRestoreKey
CmRmFinalizeRecovery
CmSaveKey
CmSaveKeyToBuffer
CmSaveMergedKeys
CmSelectQualifiedInstallLanguage
CmSetAcpiHwProfile
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmShutdownSystem1
CmShutdownSystem2
CmSiAcquireProcessLockedPagesCharge
CmSiProcessTupleStartFromHandle
CmSiReleaseProcessLockedPagesCharge
CmSiSetProcessWorkingSetMaximum
CmUnloadKey
CmpAbortLightWeightTransaction
CmpAddAliasEntry
CmpAddProcessorConfigurationEntry
CmpAddRemoveContainerToCLFSLog
CmpAddRemoveRMLogContainer
CmpBounceContextStart
CmpCheckKeySecurityDescriptorAccess
CmpCheckValueList
CmpCleanUpKCBCacheTable
CmpCleanupLightWeightTransaction
CmpCleanupTransactionState
CmpCloneHwProfile
CmpCloseKeyObject
CmpCmdHiveClose
CmpCmdHiveOpen
CmpCommitPreparedLightWeightTransaction
CmpCompleteUnloadKey
CmpComputeLogFillLevel
CmpCreateControlSet
CmpCreateControlSetOverride
CmpCreateHardwareProfiles
CmpCreateHive
CmpCreateHwProfileFriendlyName
CmpCreatePerfKeys
CmpCreatePredefined
CmpCreateTemporaryHive
CmpDelayCloseWorker
CmpDoAccessCheckOnKCB
CmpDoAccessCheckOnLayeredSubtree
CmpDoBuildVirtualStack
CmpDoParseKey
CmpDoQueryKeyName
CmpDoReOpenTransKey
CmpEnumerateLayeredKey
CmpEtwDumpKcb
CmpFindControlSet
CmpFindMachineHiveByMountPoint
CmpFinishSystemHivesLoad
CmpFlushBackupHive
CmpFlushHive
CmpForceFlushWorker
CmpFreeAllMemory
CmpFullPromoteHiveRootFromKcbStack
CmpFullPromoteSingleKeyFromKeyNodeStacks
CmpGenerateAppHiveSecurityDescriptor
CmpGetAcpiProfileInformation
CmpGetBiosDate
CmpGetBiosVersion
CmpGetFileSize
CmpGetSubKeyCountForKcbStack
CmpGetSubKeyCountForKeyNodeStack
CmpGetSymbolicLinkTarget
CmpGetSystemControlValues
CmpGetValueCountForKeyNodeStack
CmpGetVirtualizationID
CmpGetVolumeClusterSize
CmpGetVolumeLogFileSizeCap
CmpHandlePageFileOpenNotification
CmpHiveRootSecurityDescriptor
CmpInitBackupHive
CmpInitCmRM
CmpInitHiveFromFile
CmpInitializeMachineDependentConfiguration
CmpInitializePreloadedHive
CmpInitializeRegistryNode
CmpInterlockedFunction
CmpKeyEnumStackStartFromKcbStack
CmpLateUnloadHiveWorker
CmpLightWeightCommitDeleteKeyUoW
CmpLinkHiveToMaster
CmpLoadHiveThread
CmpLoadHiveVolatile
CmpLoadKeyCommon
CmpLoadLayerVersions
CmpLoadSystemVersionData
CmpLogCheckpoint
CmpLogClearAccessBitsEvent
CmpLogEvent
CmpLogFailureToGetFileSize
CmpLogFlushPhaseEnd
CmpLogFlushPhaseStart
CmpLogHiveDestroyEvent
CmpLogHiveFileInaccessible
CmpLogHiveInitializeEvent
CmpLogHiveLinkEvent
CmpLogHiveRundownEvent
CmpLogReorganizeEvent
CmpLogTransactionAbortedByName
CmpLogTxrInitEvent
CmpLogUnsupportedOperation
CmpMachineHiveListInitialize
CmpMigrateOOBELanguageToInstallationLanguage
CmpMountPreloadedHives
CmpMoveBiosAliasTable
CmpNameFromAttributes
CmpNotifyChangeKey
CmpOpenDevicesControlSet
CmpOpenFileWithExtremePrejudice
CmpOpenHiveFile
CmpPartialPromoteSubkeys
CmpPerformUnloadKey
CmpPrepareLightWeightTransaction
CmpPromoteSingleKeyFromKcbStacks
CmpPromoteSingleKeyFromParentKcbAndChildKeyNode
CmpPromoteSubtree
CmpPublishEventForPcaResolver
CmpQueryHiveRedirectionFileList
CmpQueryLayerVersionString
CmpQueryLayerVersionUlong
CmpReadBuildVersion
CmpReorganizeHive
CmpReplicateKeyToVirtual
CmpReportAuditVirtualizationEvent
CmpResolveHiveLoadConflict
CmpRestampVersion
CmpRmUnDoPhase
CmpSaveBootControlSet
CmpSearchKeyControlBlockTreeEx
CmpSecurityMethod
CmpSendUnsupportedOperationTelemetryEvent
CmpSetKeySecurity
CmpSetSystemBiosInformation
CmpSetSystemValues
CmpSetVersionData
CmpSetVideoBiosInformation
CmpSetupConfigurationTree
CmpStartCLFSLog
CmpStartRMLogs
CmpStartSiloRegistryNamespace
CmpThreadInfoLogStack
CmpTraceHiveFlushStop
CmpTraceHiveFlushWroteLogFile
CmpTraceHiveFlushWrotePrimaryFile
CmpTraceHiveLoadStart
CmpTraceHiveLoadStop
CmpTraceHiveMountBaseFileMounted
CmpTraceHiveMountStart
CmpTraceHiveMountStop
CmpTraceHiveRestoreStart
CmpTraceHiveRestoreStop
CmpTraceHiveSaveFileCopied
CmpTraceHiveSaveStart
CmpTraceHiveSaveStop
CmpTraceHiveSaveTreeCopied
CmpTraceSecurityChanging
CmpTraceShutdownFlushStart
CmpTraceShutdownFlushStop
CmpTraceShutdownRundownComplete
CmpTraceShutdownStart
CmpTraceShutdownStop
CmpTransMgrCommit
CmpTransMgrCommitUoW
CmpTransMgrPrepare
CmpTransWriteLog
CmpUpdateReorganizeRegistryValues
CmpValueEnumStackStartFromKcbStack
CmpVolumeManagerGetContextForFile
CmpWaitOnHiveWriteQueue
ComputeFlushPeriod
ConstraintEval
CreateSystemRootLink
DbgkCaptureLiveDump
DbgkCopyProcessDebugPort
DbgkCreateMinimalProcess
DbgkCreateMinimalThread
DbgkCreateThread
DbgkExitProcess
DbgkExitThread
DbgkForwardException
DbgkMapViewOfSection
DbgkPostModuleMessage
DbgkQueueUserExceptionReport
DbgkRegisterErrorPort
DbgkSendSystemDllMessages
DbgkUnMapViewOfSection
DbgkUserReportWorkRoutine
DbgkpCreateNotificationEvent
DbgkpLkmdSnapKernelStack
DbgkpLkmdSnapThreadInContext
DbgkpLkmdSqmIncrementDword
DbgkpLkmdSqmIsOptedIn
DbgkpMarkProcessPeb
DbgkpPostFakeProcessCreateMessages
DbgkpPostFakeThreadMessages
DbgkpQueueMessage
DbgkpSendApiMessageLpc
DbgkpSendErrorMessage
DbgkpStartSystemErrorHandler
DbgkpWerCaptureLiveTriageDump
DbgkpWerIsFullLiveDumpDisabled
DbgkpWerWriteSecondaryData
DrvDbGetConfigurationSubKeyCallback
DrvDbGetObjectSubKeyList
EmInitSystem
EmonInitializePebs
EmonInitializeProfiling
EmonReleaseProfileResourcesInternal
EmpCacheBiosDate
EmpInfParseGetGuidFromName
EmpParseCallbacks
EmpParseEntryTypes
EmpParseRuleTerm
EmpParseRules
EmpParseTargetRules
EnableFlushTimer
EtwKernelMemoryRundown
EtwLogPfnInfoRundown
EtwQueryProcessTelemetryInfo
EtwSetPerformanceTraceInformation
EtwShutdown
EtwStartAutoLogger
EtwTelemetryCoverageReport
EtwTiLogAllocExecVm
EtwTiLogDeviceObjectLoadUnload
EtwTiLogDriverObjectLoad
EtwTiLogDriverObjectUnLoad
EtwTiLogInsertQueueUserApc
EtwTiLogMapExecView
EtwTiLogProtectExecVm
EtwTiLogReadWriteVm
EtwTiLogSetContextThread
EtwTiLogSuspendResumeProcess
EtwTiLogSuspendResumeThread
EtwTimLogBlockNonCetBinaries
EtwTimLogControlProtectionKernelModeReturnMismatch
EtwTimLogControlProtectionUserModeReturnMismatch
EtwTimLogProhibitChildProcessCreation
EtwTimLogProhibitLowILImageMap
EtwTimLogProhibitNonMicrosoftBinaries
EtwTimLogRedirectionTrustPolicy
EtwTimLogUserCetSetContextIpValidationFailure
EtwTraceAntiStarvationBoost
EtwTraceAppStateChange
EtwTraceAutoBoostClearFloor
EtwTraceAutoBoostEntryExhaustion
EtwTraceAutoBoostSetFloor
EtwTraceContFreeEvent
EtwTraceCumulativeDpcSoftTimeout
EtwTraceDebuggerEvent
EtwTraceDequeueWork
EtwTraceDpcEnqueueEvent
EtwTraceDpcProfilingStack
EtwTraceDpcProfilingStackBegin
EtwTraceDuplicateHandle
EtwTraceEnqueueWork
EtwTraceEvent
EtwTraceFreezeThawProcess
EtwTraceIdealProcessor
EtwTraceInswapProcess
EtwTraceIoTimerEvent
EtwTraceJob
EtwTraceJobAssignProcess
EtwTraceJobRemoveProcess
EtwTraceJobSendNotification
EtwTraceJobServerSiloMonitorCallback
EtwTraceJobServerSiloStateChange
EtwTraceJobSetQuery
EtwTraceLeapSecondDataParseFailure
EtwTraceLeapSecondDataUpdate
EtwTraceLongDpcDetectionEvent
EtwTraceLongDpcMitigationEvent
EtwTraceLpacAccessFailure
EtwTraceMemoryAcg
EtwTraceObject
EtwTraceObjectOperation
EtwTracePageFault
EtwTracePool
EtwTracePriority
EtwTraceProcess
EtwTraceProcessSetInPrivateMode
EtwTraceProcessTerminate
EtwTraceReadyThread
EtwTraceRetpolineExit
EtwTraceShouldYieldProcessor
EtwTraceSiloTimedEvent
EtwTraceSingleDpcSoftTimeout
EtwTraceSystemTimeChange
EtwTraceThread
EtwTraceThreadAffinity
EtwTraceThreadFeedbackRead
EtwTraceThreadSetName
EtwTraceThreadWorkItem
EtwTraceThreadWorkOnBehalfUpdate
EtwTraceTimeZoneBiasChange
EtwTraceTimeZoneInformationRefresh
EtwTraceTimedEvent
EtwTraceWakeCounter
EtwTraceWakeEvent
EtwTraceWorkingSetInSwapStoreFail
EtwTraceWorkingSetSwap
EtwTraceWorkloadClassUpdate
EtwTraceXSchedulerPriorityKickReceive
EtwTraceXSchedulerPriorityUpdate
EtwWmitraceWorker
EtwWriteEndScenario
EtwWriteErrorLogEntry
EtwWriteEx
EtwWriteStartScenario
EtwWriteString
EtwpAddLogHeader
EtwpAddMicroarchitecturalPmcToRegistry
EtwpAddRegEntryToGroup
EtwpApplyEventNameFilter
EtwpApplyPackageIdFilter
EtwpApplyPayloadFilterInternal
EtwpBufferingModeFlush
EtwpCCSwapFlush
EtwpCalculateUpdateNotification
EtwpCheckGuidAccessAndDoRundown
EtwpClearSessionAndUnreferenceEntry
EtwpClockSourceRunDown
EtwpCovSampCaptureContextStart
EtwpCovSampContextAddAddresses
EtwpCovSampContextPruneModules
EtwpCovSampEnumerateProcess
EtwpCoverageFlushPending
EtwpCoverageRecord
EtwpCoverageRecordAtHighIrql
EtwpCoverageSamplerQuery
EtwpCreateKeyTreeForPath
EtwpCreateLogFile
EtwpCreatePerfectHashFunction
EtwpCrimsonProvEnableCallback
EtwpDiskProvTraceDisk
EtwpEnableAutoLoggerProvider
EtwpEnableGuid
EtwpEnableKernelTrace
EtwpEnableKeyProviders
EtwpEnableMetaProviderGuid
EtwpEnumerateAddressSpace
EtwpEnumerateAutologgerPath
EtwpEventTracingCounterSetCallback
EtwpEventWriteCaptureState
EtwpEventWriteDebugLookupFailed
EtwpEventWriteEnableInfo
EtwpEventWriteFull
EtwpEventWriteGuidEntry
EtwpEventWriteProviderAccessCheckStatus
EtwpEventWriteProviderEnabled
EtwpEventWriteRegEntry
EtwpEventWriteRegistrationStatus
EtwpEventWriteTemplateAdmin
EtwpEventWriteTemplateBackingFile
EtwpEventWriteTemplateMaxFileSize
EtwpEventWriteTemplateSessAndProv
EtwpEventWriteTemplateSession
EtwpEventWriteTemplateSessionEnd
EtwpExecutiveResourceConfigRunDown
EtwpFileModeCompress
EtwpFinalizeHeader
EtwpFindMatchingPmcRegistryGroup
EtwpFixBootLoggers
EtwpFlushActiveBuffers
EtwpGetAutoLoggerEventNameFilter
EtwpGetAutoLoggerLevelKwFilter
EtwpGetAutoLoggerProviderFilter
EtwpGetLoggerInfoFromContext
EtwpGetMicroarchitecturalPmcAffinity
EtwpGetPmcCpuHierarchyRegistry
EtwpGetSecurityDescriptorByGuid
EtwpGetSidExtendedHeaderItem
EtwpInitializeActivityIdSeed
EtwpInitializeAutoLoggers
EtwpInitializeSecurity
EtwpLoadMicroarchitecturalPmcs
EtwpLoadMicroarchitecturalProfileGroup
EtwpLoadMicroarchitecturalProfileSource
EtwpLogGroupMask
EtwpLogMemInfo
EtwpLogMemInfoRundown
EtwpLogMemInfoTimerCallback
EtwpLogMemInfoWs
EtwpLogMemInfoWsHelper
EtwpLogMemNodeInfo
EtwpLogProcessPerfCtrs
EtwpLogRefSetAutoMark
EtwpLogRegistryEvent
EtwpLogSessionWorkingSetInfo
EtwpLogTxREvent
EtwpObjectHandleEnumCallback
EtwpObjectTypeRundown
EtwpPmcInterrupt
EtwpPoolRunDown
EtwpProcessEnumCallback
EtwpProcessPerfCtrsRundown
EtwpProcessorRundown
EtwpProfileInterrupt
EtwpProviderArrivalCallback
EtwpPsProvCaptureState
EtwpPsProvProcessEnumCallback
EtwpPsProvTraceImage
EtwpPsProvTraceJob
EtwpPsProvTracePriority
EtwpPsProvTraceProcess
EtwpPsProvTraceThread
EtwpQueryPartitionRegistryInformation
EtwpQueryPsmKey
EtwpReadConfigParameters
EtwpRealtimeInjectEtwBuffer
EtwpRealtimeRestoreState
EtwpRealtimeSaveState
EtwpRegTraceCallback
EtwpRegisterKMProvider
EtwpRemoveMicroarchitecturalPmcFromPmcGroup
EtwpSampledProfileRunDown
EtwpSavePersistedLogger
EtwpSendDataBlock
EtwpSendSessionNotification
EtwpSetCoverageSamplerInformation
EtwpSetMark
EtwpSetProviderTraitsCommon
EtwpSpinLockConfigRunDown
EtwpStackRundown
EtwpStackWalkApc
EtwpStartLogger
EtwpStopLoggerInstance
EtwpSysModuleRunDown
EtwpSystemTraceWdf
EtwpTiQueryVad
EtwpTimLogMitigationForProcess
EtwpTraceALPC
EtwpTraceCachedStack
EtwpTraceDebugPrint
EtwpTraceFileName
EtwpTraceFltIo
EtwpTraceHandle
EtwpTraceImageRundown
EtwpTraceImageUnload
EtwpTraceIo
EtwpTraceIoInit
EtwpTraceLastBranchRecord
EtwpTraceLostEvent
EtwpTraceLostSystemEvent
EtwpTraceLostWppEvent
EtwpTraceMessageVa
EtwpTraceNetwork
EtwpTraceOpticalIo
EtwpTraceOpticalIoInit
EtwpTraceProcessRundown
EtwpTraceProcessorTrace
EtwpTraceRedirectedIo
EtwpTraceSavePersistedLoggerStop
EtwpTraceSplitIo
EtwpTraceStackWalk
EtwpTraceSystemInitialization
EtwpTraceSystemShutdown
EtwpTraceThreadRundown
EtwpTraceWdf
EtwpTrackGuidEntryRegistrations
EtwpUMGLEnabled
EtwpUpdateFileHeader
EtwpUpdateGlobalGroupMasks
EtwpUpdateGroupMasks
EtwpUpdateLoggerGroupMasks
EtwpUpdatePeriodicCaptureState
EtwpUpdateProcessTracingCallback
EtwpUpdateSelectedGroupMasks
EtwpWriteAppStateChange
EtwpWriteAppStateChangeSummary
EtwpWriteAppStateChangeWithStats
EtwpWriteProcessEvent
EtwpWriteProcessStarted
EtwpWriteProcessorTrace
EtwpWriteUserEvent
ExAllocateCacheAwarePushLock
ExCallSessionCallBack
ExCreatePool
ExGetExpirationDate
ExInitLicenseData
ExInitializeUtcTimeZoneBias
ExLogTimeZoneInformation
ExProcessCounterSetCallback
ExProcessorCounterSetCallback
ExRaiseException
ExRaiseHardError
ExRngInitializeSystem
ExSweepHandleTable
ExUpdateSystemTimeFromCmos
ExpAeThresholdInitialization
ExpCheckThreadHistory
ExpCloudbookHardwareIDProvider
ExpCloudbookHardwareLockedProvider
ExpConvertSignatureName
ExpCovQueryInformation
ExpCovResetInformation
ExpCreateOutputEFI
ExpDebuggerWorker
ExpFindDiskSignature
ExpFirmwareAccessAppContainerCheck
ExpGenuinePolicyPostProcess
ExpGetOriginalImageVersionRegistryValue
ExpGetProcessInformation
ExpGetSystemFirmwareTableInformation
ExpGetSystemFlushInformation
ExpGetSystemPlatformBinary
ExpInitFullProcessSecurityInfo
ExpKdPullRemoteFileForUser
ExpKernelExpirationDateCacheProvider
ExpLogRefreshTimeZoneInformationCutoverFail
ExpLogRefreshTimeZoneInformationQueryFail
ExpLogRefreshTimeZoneInformationSuccess
ExpNodeCreateSystemThread
ExpNtDeleteWnfStateData
ExpNtUpdateWnfStateData
ExpParseArcPathName
ExpProfileCreate
ExpQueryProcessorInformationCounters
ExpQuerySystemInformation
ExpRaiseHardError
ExpReadComPlusPackage
ExpReadLeapSecondData
ExpRefreshTimeZoneInformation
ExpSaPageGroupDescriptorAllocate
ExpSecurePoolDestroy
ExpSeedHotTags
ExpSetBootEntry
ExpSetDriverEntry
ExpSetPendingUILanguage
ExpSetSoftRebootFlags
ExpSetTimeZoneInformation
ExpSetTimer2
ExpStringCheck
ExpSvmServicePageFault
ExpSystemErrorHandler2
ExpTrackTableInsertLimit
ExpTranslateEfiPath
ExpTranslateHexStringToGUID
ExpUpdateProductSuiteTypeInRegistry
ExpUpdateTimerConfiguration
ExpUuidLoadSequenceNumber
ExpUuidSaveSequenceNumber
ExpWatchLicenseInfoWork
ExpWatchProductTypeInitialization
ExpWatchProductTypeWork
ExpWnfAllocateNextPersistentNameSequence
ExpWnfDeletePermanentName
ExpWnfDeletePermanentStateData
ExpWnfDispatchKernelSubscription
ExpWnfLookupPermanentName
ExpWnfPopulateStateData
ExpWnfRegisterPermanentName
ExpWnfWriteStateData
ExpWorkQueueManagerThread
ExpWorkerThread
ExtEnvRegisterIommu
ExtEnvSetVpptTarget
FUN_140687e40
FUN_14068ad70
FUN_14070a710
FUN_140769944
FUN_140843f7c
FUN_140a4b4b4
FUN_140a4e07c
FindBitmapResource
FopReadCmapTable
FopReadNamingTable
FsRtlAcquireFileExclusiveCommon
FsRtlAcquireFileForCcFlushEx
FsRtlAcquireFileForModWriteEx
FsRtlAcquireToCreateMappedSection
FsRtlAddDiskIOCounterInstance
FsRtlCheckOplockEx2
FsRtlCheckOplockForFsFilterCallback
FsRtlCheckUpperOplock
FsRtlDedupChangeInit
FsRtlGetCompatibilityModeValue
FsRtlGetFileExtents
FsRtlGetFileSize
FsRtlGetSectorSizeInformation
FsRtlGetTunnelParameterValue
FsRtlGetVirtualDiskNestingLevel
FsRtlHeatInit
FsRtlIsDbcsInExpression
FsRtlIssueFileNotificationFsctl
FsRtlNotifyVolumeEvent
FsRtlOpenFileSystemRegistryKeyFromFsGuid
FsRtlQueryCachedVdl
FsRtlQueryOpen
FsRtlReleaseFile
FsRtlReleaseFileForCcFlush
FsRtlReleaseFileForModWrite
FsRtlSendModernAppTermination
FsRtlVolumeDeviceToCorrelationId
FsRtlpAcknowledgeOplockBreakByCacheFlags
FsRtlpAttachOplockKey
FsRtlpCancelOplockRHIrp
FsRtlpCancelWaitingIrp
FsRtlpComputeShareableOplockState
FsRtlpGetMaxVirtualDiskNestingLevel
FsRtlpGrantAnyOplockFromExclusive
FsRtlpOplockBreakByCacheFlags
FsRtlpOplockCleanup
FsRtlpReleaseIrpsWaitingForRH
FsRtlpRemoveAndCompleteRHIrp
FsRtlpRemoveAndCompleteReadOnlyIrp
FsRtlpRemoveAndCompleteWaitingIrp
FsRtlpRequestExclusiveOplock
FsRtlpRequestShareableOplock
FsRtlpWaitOnIrp
GetOperatorIndexByName
GetPrintableOperandValue
GxpWriteFrameBufferPixels
HalAllocateHardwareCounters
HalCreateCommonBufferFromMdl
HalCreateCommonBufferFromMdlDmaThin
HalCreateCommonBufferFromMdlDmarThin
HalEfiGetTime
HalEfiSetTime
HalGetEnvironmentVariableEx
HalMatchAcpiOemId
HalMatchAcpiOemTableId
HalQueryEnvironmentVariableInfoEx
HalQueryRealTimeClock
HalSendNMI
HalSetEnvironmentVariableEx
HalSetRealTimeClock
HalSocRequestApi
HalSocRequestConfigurationData
HaliAcpiMachineStateInit
HaliQuerySystemInformation
HaliWheaInitProcessorGenericSection
HalpAcpiPostSleep
HalpAddMcaToProcessorSpecificSection
HalpAllocatePmcCounterSetEx
HalpArtDiscover
HalpBiosDisplayReset
HalpBuddyAllocatorAllocateLogicalAddress
HalpCheckSratMemoryRanges
HalpCmcLogPollingTimeoutEvent
HalpCmcPollProcessor
HalpCmcWorkerRoutine
HalpCmciHandler
HalpCmciInit
HalpCmciLoadThresholdConfiguration
HalpCpuID
HalpCreateMachineCheckErrorRecord
HalpDmaFinalizeDoubleBufferingDisposition
HalpDmaInitPowerManagement
HalpEnumerateEnvironmentVariablesWithFilter
HalpExtBuildResourceIdString
HalpExtRegisterResourceDescriptor
HalpFreePmcCounterSet
HalpGenInitialRead
HalpGetNumaProcMemoryCount
HalpGetPCIData
HalpHandlePreviousMcaErrors
HalpHpetDiscover
HalpHvCpuid
HalpHvEpCpuid
HalpHvIsFrequencyAvailable
HalpHvIsX2ApicRecommended
HalpHvMapDeviceInterrupt
HalpHvMapDeviceMsiRange
HalpHvMceConsumedMemoryErrorRecovery
HalpHvRetargetDeviceMsiInterrupt
HalpHvRetargetIoApicDeviceInterrupt
HalpHvStartProcessor
HalpHvStartVirtualProcessor
HalpHvUnmapDeviceInterrupt
HalpHvUnmapDeviceMsiRange
HalpHvWatchdogDiscover
HalpInitChipHacks
HalpInitGenericErrorSourceEntry
HalpInitGenericErrorSourceEntryV2
HalpInitializeMce
HalpInitializeProfiling
HalpInterruptConnect
HalpInterruptEnableNmi
HalpInterruptGetIrtInfo
HalpInterruptGetX2ApicPolicy
HalpInterruptInitDiscard
HalpInterruptInitPowerManagement
HalpInterruptRegisterController
HalpInterruptSendIpi
HalpIommuAllocateDmaDomain
HalpIommuCleanupPageTable
HalpIommuConfigureInterrupt
HalpIommuDmarPageTableMarkHiberPhase
HalpIommuInitDiscard
HalpIommuInitializeAll
HalpIommuLogEarlyFault
HalpIommuMapLogical
HalpIommuMapLogicalRange
HalpIommuTraceFault
HalpIommuUnmapLogicalRange
HalpIsHvIptSupported
HalpIsHvPresent
HalpIsHvUsedForReboot
HalpIsMicrosoftCompatibleHvLoaded
HalpIsPartitionCpuManager
HalpIsXboxNanovisorPresent
HalpIumGetTime
HalpIumQueryVariableInfo
HalpIumResetSystem
HalpIumSetTime
HalpLbrInitialize
HalpLoadMicrocodeSerialized
HalpMcEnumerateAndSetPatchConfig
HalpMcaExtendedLogGetL1DirectoryBase
HalpMcaInitializeErrorSection
HalpMcaReadError
HalpMcaReportError
HalpMcaResumeProcessorConfig
HalpMceInit
HalpMceInitializeRecovery
HalpNmiReboot
HalpNumaAddRangeProximity
HalpPciCheckAmdK8
HalpPciReadSecondaryBusNumber
HalpPiix4Detect
HalpPmTimerDiscover
HalpProcGetFeatureBits
HalpQueryCapsuleCapabilities
HalpReadExtendedMcaRegistersAMD
HalpRegisterDmaController
HalpReportResourceUsage
HalpRtcDiscover
HalpSecondaryInterruptQueryPrimaryInformation
HalpSetPCIData
HalpSetShutdownResetHandler
HalpStopLegacyUsbInterruptsInternal
HalpTimerConfigureInterrupt
HalpTimerEnableHypervisorTimer
HalpTimerInitPowerManagement
HalpTimerInitializeHypervisorTimer
HalpTimerInitializeProfiling
HalpTimerMeasureAllProcessorFrequencies
HalpTimerQueryAndResetRtcErrors
HalpTimerRegister
HalpTimerStallExecutionProcessor
HalpTimerTraceTimingHardware
HalpTimerUnmapInterrupt
HalpTimerWatchdogTriggerSystemReset
HalpTscAdvSynchCalculateRemoteDeltas
HalpTscAdvSynchLeader
HalpTscCheckAdjustMsrCapability
HalpTscFallbackToPlatformSource
HalpTscReportSyncStatus
HalpTscSynchronization
HalpTscSynchronizationWorker
HalpTscTraceProcessorSynchronization
HalpTscTraceStatus
HalpUpdateCapsule
HalpUsbLegacyScanBusForHandoff
HalpUsbLegacyStopOhciInterrupt
HalpUsbLegacyStopUhciInterrupt
HalpValidPCISlot
HalpWdatDiscover
HalpWheaNativeCpuid
HashpVerifyPkcs1Signature
HdlspAddLogEntry
HdlspBugCheckProcessing
HdlspDispatch
HdlspKernelAddLogEntry
HdlspPutMore
HdlspSendBlueScreenInfo
HeadlessInit
HsaDismissPageFault
HsaGetPageFault
HsaInitializeIommu
HsaUpdateDeviceTableEntry
HsaUpdateRemappingTableEntry
HvAnalyzeLogFiles
HvLoadHive
HvRecoverFlushProtocolStateFromFiles
HvSwapLogFiles
HviGetHardwareFeatures
HviGetIptFeatures
HviIsAnyHypervisorPresent
HviIsHypervisorMicrosoftCompatible
HviIsHypervisorVendorMicrosoft
HviIsXboxNanovisorPresent
HvipApertureDetectParameters
HvlAttachPasidSpace
HvlAttachPrQueue
HvlCollectLivedump
HvlCreatePasidSpace
HvlCreatePrQueue
HvlDebuggerSupportInitialize
HvlDisablePasid
HvlDmaAllocateDeviceDomain
HvlDmaAttachDeviceDomain
HvlDmaConfigureDeviceDomain
HvlDmaDeleteDeviceDomain
HvlDmaFlushDeviceDomain
HvlDmaGetDmaGuardEnabled
HvlDmaGetHybridPassthroughReservedRegions
HvlDmaMapDeviceLogicalRange
HvlDmaMapDeviceSparsePages
HvlDmaReserveDeviceDomainAttachment
HvlDmaUnmapDeviceLogicalRange
HvlDmaUnmapDeviceSparsePages
HvlEnablePasid
HvlEnterSleepState
HvlGetCoverageData
HvlGetCoverageInfo
HvlGetDeviceCapabilities
HvlGetImplementedPhysicalBits
HvlGetSystemPasidCapabilities
HvlHvDebuggerPowerHandler
HvlInvokeFastExtendedHypercall
HvlInvokeHypercall
HvlIsSingleGroupRequired
HvlMapDeviceInterrupt
HvlNotifyAllProcessorsStarted
HvlNotifyDebugDeviceAvailable
HvlNotifyHpetEnabled
HvlNotifyRootCrashdump
HvlParkedVirtualProcessors
HvlPrepareForRootCrashdump
HvlPrepareForSecureHibernate
HvlQueryDetailInfo
HvlQueryHypervisorTscAdjustment
HvlQueryVsmProtectionInfo
HvlResetCoverageVector
HvlRestoreTime
HvlResumeFromRootCrashdump
HvlRetargetDeviceInterrupt
HvlSendSyntheticClusterIpi
HvlSetDeviceCapabilities
HvlSetDeviceDmaEnabled
HvlSetHpetConfig
HvlSetPasidAddressSpace
HvlSetQpcBias
HvlSetRootFaultReportingReady
HvlSetSystemMachineCheckProperty
HvlSetSystemSleepProperty
HvlUnblockDefaultDma
HvlUnmapDeviceInterrupt
HvlpCheckTscSync
HvlpDetermineEnlightenments
HvlpDiscoverTopologyAmd
HvlpDiscoverTopologyIntel
HvlpDynamicUpdateMicrocode
HvlpFastFlushAddressSpaceTb
HvlpFastFlushAddressSpaceTbEx
HvlpFastFlushListTb
HvlpFastFlushListTbEx
HvlpFastFlushPasidAddressList
HvlpFastSendSyntheticClusterIpiEx
HvlpGetVtlCallVa
HvlpInvokeGetPageListHypercall
HvlpLogGuestStateScrubbingStatus
HvlpLogHypervisorLaunchError
HvlpLogHypervisorSchedulerType
HvlpLogIommuInitStatus
HvlpLogMicrocodeUpdateStatus
HvlpLogProcessorStartupFailure
HvlpMapStatisticsPage
HvlpProcessIommu
HvlpQueryExtendedCapabilities
HvlpQueryHypervisorSchedulerType
HvlpSelectLpSet
HvlpSelectVpSet
HvlpSlowFlushAddressSpaceTb
HvlpSlowFlushAddressSpaceTbEx
HvlpSlowFlushListTb
HvlpSlowFlushListTbEx
HvlpSlowSendSyntheticClusterIpiEx
HvlpTryConfigureInterface
HvlpWithdrawPages
HvlpWritePerfRegister
HvpApplyIncrementalLogFile
HvpApplyLegacyLogFile
HvpDetermineLogFileApplicationOrder
HvpGenerateLogEntryChecksums
HvpGenerateLogEntryHeader
HvpIncrementalLogFileEnumeratorAdvance
HvpIsReadErrorTransient
HvpLogEntryCheckDataChecksum
HvpLogEntryCheckHeaderChecksum
HvpLogInvalidLogHeader
HvpLogUnreadableLog
HvpMarkDirty
HvpSwapDual
I_MinCryptCheckEKURequirements
InitBootProcessor
InitSafeBoot
IoBoostThreadIoPriority
IoCaptureLiveDump
IoConfigureCrashDump
IoCreateDevice
IoCreateDisk
IoCreateDriver
IoEnumerateEnvironmentVariablesEx
IoEnumerateKsrPersistentMemoryEx
IoGetDeviceDirectory
IoGetDeviceInterfaceAlias
IoGetDeviceProperty
IoGetDmaAdapter
IoGetEnvironmentVariableEx
IoInitSystemPreDrivers
IoInitializeProcessor
IoIsValidNameGraftingBuffer
IoQueryEnvironmentVariableInfoEx
IoQueryInformationByName
IoRaiseHardError
IoReadDiskSignature
IoReadPartitionTable
IoReadPartitionTableEx
IoRegisterPlugPlayNotification
IoRemoveIoCompletion
IoReportDetectedDevice
IoReportRootDevice
IoReserveKsrPersistentMemoryEx
IoReuseIrp
IoSaveBugCheckProgress
IoSaveBugCheckRecoveryStatus
IoSetEnvironmentVariableEx
IoSetPartitionInformation
IoSetPartitionInformationEx
IoSetSystemPartition
IoStartIoRateControl
IoTranslateBusAddress
IoVerifyPartitionTable
IoVolumeDeviceNameToGuidPath
IoVolumeDeviceToDosName
IoVolumeDeviceToGuidPath
IoWMIOpenBlock
IoWMIQueryAllData
IoWMIQueryAllDataMultiple
IoWMIQuerySingleInstanceMultiple
IoWriteCapturedPristineTriageDumpToDedicatedDumpFile
IoWriteCrashDump
IoWriteDeferredLiveDumpData
IoWritePartitionTable
IoWritePartitionTableEx
IommupHvAttachPasidDevice
IommupHvAttachPasidDeviceDomain
IommupHvDismissPageFault
IommupHvGetDeviceAtsCapability
IommupHvGetDeviceSvmCapabilities
IommupHvInitializeLibrary
IommupHvIsDmarStageCompatible
IommupHvIsStage1DmarCompatible
IommupHvValidatePageRequestGpa
IopApplySystemPartitionProt
IopAttachDeviceToDeviceStackSafe
IopBootLog
IopCachePreviousBootData
IopCallDriverReference
IopCaptureObjectName
IopCollectTriageDumpData
IopConnectInterruptFullySpecified
IopConnectLinkTrackingPort
IopConnectMessageBasedInterrupt
IopCopyBootLogRegistryToFile
IopCrashDumpPolicyChangeWnfCallback
IopCreateArcName
IopCreateArcNames
IopCreateArcNamesCd
IopCreateArcNamesDisk
IopDumpTraceCrashDumpDisabled
IopDumpTraceCrashDumpReconfiguration
IopDumpTraceDisableCrashDumpFailure
IopDumpTraceForceDumpDisabled
IopDumpTraceFreeDumpStackFailure
IopDumpTraceInitializeCrashDumpFailure
IopDumpTraceInitializeDumpStackFailure
IopDumpTraceLoadCrashDumpDriverFailure
IopDumpTraceLoadDumpStackFailure
IopErrorLogThread
IopFastQueryNetworkAttributes
IopFileUtilClearAttributes
IopFileUtilWalkDirectoryTreeBottomUp
IopFileUtilWalkDirectoryTreeTopDown
IopFreeBandwidthContract
IopGetBootDiskInformation
IopGetBootDiskInformationLite
IopGetDeviceInterfaces
IopGetFileVolumeNameInformation
IopGetNetworkOpenInformation
IopGetVolumeId
IopInitActivityIdIrp
IopInitCrashDumpDuringSysInit
IopInitializeBootDrivers
IopInitializeDumpPolicySettings
IopInitializeInMemoryDumpData
IopInitializeOfflineCrashDump
IopInitializePlugPlayServices
IopInitializeResourceMap
IopInitializeSystemVariableService
IopIoRateStartRateControl
IopIrpStackProfilerDpcRoutine
IopIsNotNativeDriverImage
IopIsReportedAlready
IopIssueTrEERequest
IopLiveDumpAllocAndInitResources
IopLiveDumpAllocateExtraBuffers
IopLiveDumpAllocateFromVMMemoryPartition
IopLiveDumpCallRemovePagesCallbacks
IopLiveDumpCaptureMemoryPages
IopLiveDumpEstimateMemoryPages
IopLiveDumpIsUnderMemoryPressure
IopLiveDumpMarkImportantDumpData
IopLiveDumpOpenVMMemoryPartition
IopLiveDumpPolicyChangeWnfCallback
IopLiveDumpRegisterWnfNotificationCallback
IopLiveDumpTraceAllocationFromVMMemoryPartitionFailure
IopLiveDumpTraceBufferAllocation
IopLiveDumpTraceBufferEstimation
IopLiveDumpTraceCaptureGenerateIptSecondaryDataDuration
IopLiveDumpTraceCaptureMemoryPages
IopLiveDumpTraceCaptureProcessorContextDuration
IopLiveDumpTraceCorralProcessorsDuration
IopLiveDumpTraceDumpDisabledOnBoot
IopLiveDumpTraceDumpFileWriteEnd
IopLiveDumpTraceEstimatedAndAllocatedPageCount
IopLiveDumpTraceHvlPrepareLivedumpDescriptorFailure
IopLiveDumpTraceInterfaceEnd
IopLiveDumpTraceMarkImportantDumpDataDuration
IopLiveDumpTraceMarkRequiredDumpDataDuration
IopLiveDumpTraceMmDuplicateMemoryFailure
IopLiveDumpTraceOpenVMMemoryPartitionFailure
IopLiveDumpTracePopulateBitmapForDumpDuration
IopLiveDumpTraceQueryHvlDumpSizeFailure
IopLiveDumpTraceRemovePagesCallbackFailure
IopLiveDumpTraceUncorralProcessorsDuration
IopLiveDumpWriteDumpFile
IopLiveDumpWriteDumpFileWithExtraPages
IopLiveDumpWriteSecondaryData
IopLoadDriver
IopLogAuditIoRegisterNotificationEvent
IopMarkBootPartition
IopMountVolume
IopOpenLinkOrRenameTarget
IopParseDevice
IopPassiveInterruptWorker
IopPerfCompleteRequest
IopPerfCompletionRoutine
IopPerfLogCallEvent
IopPerfLogCallReturnEvent
IopProcessIoTracking
IopProcessSetInterfaceState
IopProcessWorkItem
IopProtectSystemPartition
IopQueryDockRemovalInterface
IopQueryEnvironmentVariableInfoSysEnv
IopQueryEnvironmentVariableInfoTrEE
IopQueryPassiveInterruptRegistryOptions
IopQueryResourceHandlerInterface
IopRaiseHardError
IopReassignSystemRoot
IopRegisterDeviceInterface
IopSendMessageToTrackService
IopSetRemoteLink
IopStoreSystemPartitionInformation
IopSymlinkQueryEnabledClasses
IopSynchronousServiceTail
IopTimerDispatch
IopTraceCrashDumpDisabledOnBoot
IopTrackLink
IopWriteCapsuleTriageDumpToFirmware
IopXxxControlFile
IovCompleteRequest
IovpCallDriverWithStackBuffer
IpmiLibAddSelRecord
IpmiLibpAddSelRawData
IpmiLibpKcsRequestAndReceive
IvtDismissPageFault
IvtDrainSvmPageRequests
IvtFlushDeviceTbOnly
IvtFlushTbInternal
IvtInitializeIommu
IvtInitializeScalableModePasidTables
IvtInvalidateAllContextEntries
IvtInvalidateContextEntry
IvtInvalidateRemappingTableEntries
IvtInvalidateScalableModePasidCache
IvtIommuWaitCommand
IvtSetPasidAddressSpace
IvtUpdateRemappingTableEntry
IvtUpdateScalableModeContextEntry
IvtUpdateScalableModePasidTablesForPasid
KGetUnlockSetting
KdInitSystem
KdSendTraceData
KdpCloseRemoteFile
KdpCreateRemoteFile
KdpPrint
KdpPrintString
KdpPrompt
KdpPromptString
KdpReadRemoteFile
KdpReportCommandStringStateChange
KdpReportExceptionStateChange
KdpReportLoadSymbolsStateChange
KdpRestoreBreakPointEx
KdpSearchMemory
KdpSendWaitContinue
KdpWriteBreakPointEx
KeAddEnclavePage
KeAdjustInterruptTime
KeAndGroupAffinityEx
KeBoostPriorityThread
KeCanChangeEnclavePageProtection
KeChangeEnclavePageProtection
KeCommitSmtState
KeCopyPrivilegedPage
KeCopyXfdMaskToTeb
KeCpuSetReportParkedProcessors
KeCreateEnclave
KeDeleteCpuPartition
KeDisableTimer2
KeEnumerateKernelStackSegments
KeFlushCurrentTbOnly
KeFlushIoBuffers
KeFlushMultipleRangeCurrentTb
KeFlushQueuedDpcs
KeFlushSingleCurrentTb
KeFlushSingleTb
KeForceAttachProcess
KeForceDetachProcess
KeFreezeExecution
KeGenericProcessorCallback
KeGetTbSize
KeInitSystem
KeInitializeClock
KeIntSteerPeriodic
KeIntSteerSnapPerf
KeIsSubsetAffinityEx
KeLoadMTRR
KeMaskInterrupt
KeOutPageEnclavePage
KePrepareClockTimerForIdle
KePrepareNonClockOwnerForIdle
KeQueryCpuPartitionAffinity
KeQueryTotalCycleTimeThread
KeRebootSystemForRecovery
KeRecomputeCpuSetAffinityProcess
KeRegisterProcessorChangeCallback
KeRemoveQueueDpcEx
KeRemoveQueueEx
KeRequestTerminationThread
KeRestoreProcessorSpecificFeatures
KeResumeClockTimerFromIdle
KeRevertToUserAffinityThread
KeRevertToUserAffinityThreadEx
KeRevertToUserMultipleGroupAffinityThread
KeSecureProcess
KeSetAffinityProcess
KeSetBasePriorityThread
KeSetCpuSetsProcess
KeSetIntervalProfile
KeSetPagePrivilege
KeSetPriorityThread
KeSetSchedulingGroupRankBias
KeSetSelectedCpuSetsThread
KeSetSystemMultipleGroupAffinityThread
KeSetThreadSchedulerAssist
KeSetTracepoint
KeSetUserAffinityThread
KeSetUserCetAppcompatOptions
KeSetUserGroupAffinityThread
KeStartAllProcessors
KeStartProfile
KeStartThread
KeStopProfile
KeSupportedPhysicalAddressBits
KeSynchronizeAddressPolicy
KeSynchronizeSecurityDomain
KeUnsecureProcess
KeUpdateDpcWatchdogConfiguration
KeUpdateSoftParkRankList
KeUpdateThreadCpuSets
KeUpdateThreadTag
KeWaitForMultipleObjects
KeWaitForMutexObject
KeWriteProtectPAT
KiAbThreadUnboostCpuPriority
KiAdjustGroupConfiguration
KiAndAffinityEx
KiApplyForegroundBoostThread
KiBugCheckProgress
KiBugCheckProgressCpusFrozen
KiBugCheckRecoveryFreezeOtherProcessors
KiCalibrateTimeAdjustment
KiCancelClockTimer
KiCancelTimer
KiCheckForThreadDispatch
KiCheckForTimerExpiration
KiCheckMicrocode
KiChooseTargetProcessor
KiComputeCpuSetAffinity
KiComputeDispatchInterruptCost
KiComputeNumaCosts
KiComputeThreadAffinity
KiComputeTopologyConstants
KiConfigureHeteroMultiCoreProcessors
KiConnectInterrupt
KiContinuePreviousModeUser
KiDeferGroupSchedulingPreemption
KiDeferredBugcheckRecoveryWorker
KiDeferredReadySingleThread
KiDeregisterNmiSxCallback
KiDetectAmdNonArchSsbdSupport
KiDetectHardwareSpecControlFeatures
KiDetectKvaLeakage
KiDetectTsx
KiDirectSwitchThread
KiDisconnectInterruptCommon
KiDispatchException
KiDisplayBlueScreen
KiDumpParameterImages
KiDynamicProcessorAddNotification
KiDynamicProcessorInitialization
KiEnterLongDpcProcessing
KiEventClockStateChange
KiExecuteAllDpcs
KiExitDispatcher
KiExitThreadWait
KiExpireTimer2
KiFinalizeTimer2Disablement
KiFlushAddressSpaceTb
KiFlushRangeTb
KiFlushSingleTbWorker
KiForceIdleUpdateSchedulerParkState
KiForwardTick
KiFreezeTargetExecution
KiGetCpuVendor
KiGetIptInfo
KiGetProcessorInformation
KiGetProcessorSignature
KiGetTbLeafInfo
KiGetXSaveSupportedFeatures
KiGroupSchedulingGenerationEnd
KiGroupSchedulingQuantumEnd
KiHaltOnAddressWakeEntireList
KiHandleDeferredPreemption
KiHeteroComputeThreadImportance
KiHeteroScanQueueForPreemptionSwapTarget
KiHvEnlightenedGuestPriorityKick
KiInitMachineDependent
KiInitializeContextThread
KiInitializeDynamicProcessorDpc
KiInitializeHgsPlusWorkloadClasses
KiInitializeHresetSupport
KiInitializeIdleProcess
KiInitializeKernel
KiInitializeNxSupportDiscard
KiInitializeReservedCpuSets
KiInitializeTopologyStructures
KiInitializeUserApc
KiInitializeXSave
KiIntRedirectQueueRequestOnProcessor
KiIntSteerCalculatePriorityDistribution
KiIntSteerLogState
KiIntSteerLogStatus
KiInterruptDispatchCommon
KiIntersectFeaturesWithPolicy
KiInvokeInterruptServiceRoutine
KiIpiProcessRequests
KiIpiSendRequest
KiIsHyperVCr3RspErrataPresent
KiIsNXSupported
KiIsProcessTerminationRequested
KiLogSingleDpcSoftTimeoutEvent
KiLogUserCetSetContextIpValidationFailureWorker
KiMcheckAlternateReturn
KiOpPatchCode
KiOrAffinityEx
KiOutSwapKernelStacks
KiParkCurrentProcessor
KiPerformAutomaticGroupConfiguration
KiPerformExplicitGroupAssignment
KiPerformHeteroSoftParkElection
KiPrepareUpdateCoresHeteroMask
KiProcessControlProtection
KiProcessDeferredReadyList
KiProcessExpiredTimerList
KiQuantumEnd
KiRaiseException
KiReadyOutSwappedThreads
KiRemoveBoostThread
KiRemoveSystemWorkPriorityKick
KiRescheduleThreadAfterAffinityChange
KiReselectIdealProcessorAfterAffinityChange
KiRetireDpcList
KiRundownMutants
KiSchedulerApc
KiSearchForNewThread
KiSearchForNewThreadOnProcessor
KiSearchForNewThreadsForRescheduleContext
KiSelectProcessorToPreempt
KiSendClockInterruptToClockOwner
KiSendThawExecution
KiSetCacheInformationAmd
KiSetCacheInformationIntel
KiSetClockTimer
KiSetFeatureBits
KiSetHeteroPolicyThread
KiSetLegacyAffinityThread
KiSetNextClockTickDueTime
KiSetPageAttributesTable
KiSetPriorityThread
KiSetProcessorSignature
KiSetStandardizedCacheInformation
KiSetSystemAffinityThread
KiShouldRearmClockTimer
KiSoftParkElectionDpcRoutine
KiStallBugcheckThread
KiStartDpcThread
KiStartDynamicProcessor
KiStartPrcbThread
KiSubtractAffinityEx
KiSwapThread
KiSynchCounterSetCallback
KiSynchNumaCounterSetCallback
KiSynchronizeStibpPairing
KiTimer2Expiration
KiTimerExpiration
KiTimerExpirationDpc
KiTpReadImageData
KiTpWriteMemory
KiTraceCancelTimer2
KiTraceLogControlCallback
KiTraceLogHeteroRundown
KiTraceSetTimer
KiTraceSetTimer2
KiUnwindUserSspForApcContextCopyBypass
KiUpdateGlobalCpuSetConfiguration
KiUpdateNumberProcessors
KiUpdateProcessConcurrencyCount
KiUpdateRunTime
KiUpdateTime
KiUpdateVpBackingThreadPriorityDpcRoutine
KiWaitForAllObjects
KiXorAffinityEx
KitLogFeatureUsage
KitpReadUlongFromKey
KseDsCallbackHookAddDevice
KsepDbGetShimInfo
KsepDsEventAddDevice
KsepDsEventDataIrp
KsepDsEventDevicePowerCompleted
KsepDsEventDevicePowerIrp
KsepDsEventDriverLoad
KsepDsEventDriverStartIo
KsepDsEventDriverUnload
KsepDsEventIoCreateDevice
KsepDsEventPnpIrp
KsepDsEventPnpStartDevice
KsepDsEventPnpStopDevice
KsepDsEventPoolAllocate
KsepDsEventPoolFree
KsepDsEventRequestPowerIrp
KsepDsEventSystemPowerIrp
KsepEvntLogFlagsApplied
KsepEvntLogShimsApplied
KsepLogEtwMessage
KsepMatchInitBiosInfo
KsepRegistryQueryDWORD
KsepShimDatabaseTime
KsepSkipDriverUnloadEventDriverLoad
KsepSkipDriverUnloadEventDriverUnload
KyRaiseException
LdrLoadAlternateResourceModuleEx
LdrResGetRCConfig
LdrResSearchResource
LdrpGetParentLangId
LdrpGetRcConfig
LdrpGetResourceFileName
LdrpResSearchResourceMappedFile
LdrpSearchResourceSection_U
LkmdTelCreateReport
LocalGetAclForString
LocalGetConditionForString
LocalGetStringForControl
LocalGetStringForRelativeAttribute
LocalpConvertStringSidToSid
LocalpGetStringForCondition
LookUpTableFlushComplete
MakeGdtReadOnly
McTemplateK0_EtwWriteTransfer
McTemplateK0d_EtwWriteTransfer
McTemplateK0dszu_EtwWriteTransfer
McTemplateK0dz_EtwWriteTransfer
McTemplateK0dzd_EtwWriteTransfer
McTemplateK0hzr0_EtwWriteTransfer
McTemplateK0hzr0d_EtwWriteTransfer
McTemplateK0hzr0hzr2_EtwWriteTransfer
McTemplateK0hzr0qqhzr4_EtwWriteTransfer
McTemplateK0izzx_EtwWriteTransfer
McTemplateK0j_EtwWriteTransfer
McTemplateK0jhzr1_EtwWriteTransfer
McTemplateK0jhzr1d_EtwWriteTransfer
McTemplateK0jq_EtwWriteTransfer
McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer
McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer
McTemplateK0jxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_EtwWriteTransfer
McTemplateK0jzt_EtwWriteTransfer
McTemplateK0p_EtwWriteTransfer
McTemplateK0pqzzzzzzz_EtwWriteTransfer
McTemplateK0pz_EtwWriteTransfer
McTemplateK0q_EtwWriteTransfer
McTemplateK0qhzr1z_EtwWriteTransfer
McTemplateK0xxq_EtwWriteTransfer
McTemplateK0xxxqq_EtwWriteTransfer
McTemplateK0xxxqqqq_EtwWriteTransfer
McTemplateK0xxxxxxxxxxxxxxxxxq_EtwWriteTransfer
McTemplateK0z_EtwWriteTransfer
McTemplateK0zd_EtwWriteTransfer
McTemplateK0zdq_EtwWriteTransfer
McTemplateK0zjdd_EtwWriteTransfer
McTemplateK0zq_EtwWriteTransfer
McTemplateK0zqz_EtwWriteTransfer
McTemplateK0zz_EtwWriteTransfer
McTemplateK0zzjzitd_EtwWriteTransfer
McTemplateK0zzjzzzdd_EtwWriteTransfer
McTemplateK0zzjzzztzdzztdz_EtwWriteTransfer
McTemplateK0zzq_EtwWriteTransfer
McTemplateK0zzqq_EtwWriteTransfer
McTemplateK0zzqqzttquqqzxt_EtwWriteTransfer
McTemplateK0zzqqzttquxt_EtwWriteTransfer
McTemplateK0zzt_EtwWriteTransfer
McTemplateK0zztt_EtwWriteTransfer
McTemplateK0zzz_EtwWriteTransfer
McTemplateK0zzzd_EtwWriteTransfer
McTemplateK0zzzdzzq_EtwWriteTransfer
McTemplateK0zzzt_EtwWriteTransfer
McTemplateK0zzztdd_EtwWriteTransfer
McTemplateK0zzzzdd_EtwWriteTransfer
McTemplateK0zzzzz_EtwWriteTransfer
MfgInitSystem
MiActOnLargeKernelHalPages
MiAddLoaderHalIoMappings
MiAddWorkingSetEntries
MiAdjustPteBins
MiAgeWorkingSet
MiAllocateChildVads
MiAllocateContiguousMemory
MiAllocateFastAwePages
MiAllocateFastLargePagesForMdl
MiAllocateLargeProcessPagesFromCache
MiAllocateLargeZeroPages
MiAllocatePagesForMdl
MiAllocateSlabEntry
MiAllocateUserPhysicalPages
MiAllocateVirtualMemory
MiApplyBootLoadedDriversFixups
MiApplyFunctionOverrideToBootDrivers
MiApplyHotPatchToLoadedDriver
MiApplyImportOptimizationToBootDrivers
MiApplyRetpolineFixups
MiApplyRetpolineFixupsToKernelAndHal
MiApplyStraddleFixups
MiAssignSessionRanges
MiAssignSoftwareWsleRegion
MiAssignTopLevelRanges
MiAttachWorkingSet
MiAttemptPageFileExtension
MiAttemptPageFileReduction
MiBuildMdlForMappedFileFault
MiCaptureAndResetWorkingSetAccessBits
MiChangePageHeatImmediate
MiClearDriverHotPatchPtes
MiClearNonPagedPtes
MiClearPteAccessedBitRange
MiClearSystemAccessBits
MiCloneProcessAddressSpace
MiCloneVads
MiCoalesceFreeLargePages
MiCoalesceFreePages
MiCombineIdenticalPages
MiCombineInitialInstance
MiCombineWithExisting
MiCombineWorkingSet
MiCommitExistingVad
MiComputeAgeDistribution
MiComputeCacheAttributeSpeeds
MiComputeIdealDpcGang
MiComputeNodeMemory
MiConvertHiberPhasePages
MiCopyFromUntrustedMemory
MiCopyLargeVad
MiCopyOnWrite
MiCopyPagesIntoEnclave
MiCopyToCfgBitMap
MiCopyToUntrustedMemory
MiCopyVirtualMemory
MiCountBootDriverRegions
MiCountSharedPages
MiCrcStillIntact
MiCreateImageFileMap
MiCreateInitialSystemWsles
MiCreateNewSection
MiCreatePagefile
MiCreatePagingFileMap
MiCreatePerNodeZeroingConductor
MiCreateSessionDriverProtos
MiCreateSlabAllocationsFromLoaderBlock
MiDecayPfnFullyInitialized
MiDecommitHardwareEnclavePages
MiDecommitLargePoolVa
MiDecommitPages
MiDeleteAllHardwareEnclaves
MiDeleteClusterPage
MiDeleteClusterSection
MiDeleteEmptyPageTables
MiDeleteFinalPageTables
MiDeleteInsertedCloneVads
MiDeletePagablePteRange
MiDeletePteRun
MiDeletePteWsleCluster
MiDeleteSystemPagableVm
MiDeleteSystemPageTables
MiDeleteVa
MiDeliverPicoExceptionForProbedPage
MiDemoteCombinedPte
MiDemoteLocalLargePage
MiDemoteSlabEntries
MiDemoteValidLargePageOneLevel
MiDeprioritizeVirtualAddresses
MiDereferenceSegmentThread
MiDetachAndUnlockWorkingSet
MiDispatchFault
MiEliminateZeroPages
MiEmptyAccessLogs
MiEmptyWorkingSetInitiate
MiEnableNewPfns
MiExamineHalVa
MiFillHyperPtes
MiFillPfnGaps
MiFindActualFaultingPte
MiFindContiguousPagesEx
MiFindLargeMapping
MiFindLargestLoaderDescriptor
MiFindProcessImageHotPatchRecord
MiFlushAllPages
MiFlushCacheMdl
MiFlushDirtyBitsToPfn
MiFlushEntireTbDueToAttributeChange
MiFlushSectionInternal
MiFlushStaleCacheMap
MiFlushStrongCodeDriverLoadFailures
MiFlushTbAsNeeded
MiFlushValidPteFromTb
MiFlushWaitForReadInProgress
MiFreeBootDriverPages
MiFreeLargePageChain
MiFreeLargePages
MiFreeLargeProcessPagesToCache
MiFreeLargeZeroPages
MiFreePagesFromMdl
MiFreePhysicalPageChain
MiFreePhysicalPages
MiFreeUnusedSlabPages
MiFreeWsleList
MiGetBaseResidentPage
MiGetClusterPage
MiGetLargePage
MiGetLargePageChain
MiGetNextAffinityWalker
MiGetNextAffinityWalkerLegacy
MiGetNextPageTable
MiGetPage
MiGetPageChain
MiGetPerfectColorHeadPage
MiGetPteFromCopyList
MiGetSlabStandbyPage
MiGetSystemAddressForImage
MiGetTopLevelPfn
MiGetWorkingSetInfoEx
MiGetWorkingSetInfoList
MiHotPatchAllProcesses
MiHugePageOperation
MiIdealClusterPage
MiIdentifyPfn
MiInPagePageTable
MiInPageSingleKernelStack
MiInSwapSharedWorkingSetWorker
MiInSwapStoreWorker
MiInitNucleus
MiInitSystem
MiInitializeCacheFlushing
MiInitializeChannelRangesTemporary
MiInitializeDriverImages
MiInitializeDynamicPfns
MiInitializeLargeMdlLeafPfns
MiInitializeLargePageColorSizes
MiInitializeNumaGraph
MiInitializePartitionThreads
MiInitializeProcessBottomUpEntropy
MiInitializeSessionIds
MiInitializeTbFlush
MiInitializeZeroEngines
MiInsertChildVads
MiInsertLargePageChain
MiInsertNewZeroThread
MiInsertPageInList
MiInsertPagesInList
MiInvokePatchCallback
MiIsCfgBitMapPageShared
MiIssueHardFault
MiLargePageFault
MiLargePagePromote
MiLoadDataIntoVsmEnclave
MiLockCode
MiLockDownWorkingSet
MiLogAddPhysicalMemory
MiLogAllocateWsleEvent
MiLogBadMapper
MiLogCombinedPteDelete
MiLogCommitRequestFailed
MiLogContinueTrim
MiLogCreateImageFileMapFailure
MiLogFailedDriverLoad
MiLogHotPatchManagement
MiLogHotPatchOperation
MiLogHotPatchOperationStatus
MiLogHotPatchPagesLocked
MiLogHotPatchRundown
MiLogKernelStackEvent
MiLogMdlRangeEvent
MiLogNonPagedPoolReleaseEvent
MiLogNonRetpolineImageLoadEvent
MiLogNotifyPageHeat
MiLogOutswappedProcessCommitReacquire
MiLogOutswappedProcessCommitRelease
MiLogPerfMemoryEvent
MiLogPerfMemoryRangeEvent
MiLogPeriodicTelemetry
MiLogPeriodicTelemetryForSlabAllocator
MiLogPinDriverAddress
MiLogPinDriverAddressesWorker
MiLogProcessWorkingSetsStop
MiLogRemoveWsleEvent
MiLogReserveVaFailed
MiLogResetPagesCommitRelease
MiLogSectionCreate
MiLogSlabEntriesDemote
MiLogSlabEntryAllocateFailure
MiLogStrongCodeDriverLoadFailure
MiLogTrimWs
MiLogWsEmptyControl
MiMakeOutswappedPageResident
MiMakePageAvoidRead
MiMakeSystemCacheRangeValid
MiMakeVaRangeNoAccess
MiMakeZeroedPageTablesEx
MiMapContiguousMemory
MiMapImageForEnclaveUse
MiMapMdlCommon
MiMapMemoryDumpMdl
MiMapUserLargePages
MiMapViewOfSection
MiMarkBootKernelStack
MiMarkHiberNotCachedPages
MiMarkHugeRangeTransition
MiMarkKernelImageCfgBits
MiMarkKernelPageTablePages
MiMarkLargePageMappings
MiMarkNonPagedHiberPhasePages
MiMarkSharedImageCfgBits
MiModifiedPageWriter
MiMoveDirtyBitsToPfns
MiMoveLargeFreePage
MiNodeZeroConductor
MiOpenHotPatchFile
MiOrderTrimList
MiOutSwapKernelStackPage
MiOutSwapWorkingSet
MiParseComAndCetHeaders
MiParseImageLoadConfig
MiPartitionWorkingSetManager
MiPerformSafePdeWrite
MiPersistMdl
MiPfCompleteInPageSupport
MiPfnRangeIsZero
MiPopulateCfgBitMap
MiProcessWorkingSets
MiProtectAweRegion
MiProtectDriverSectionPte
MiProtectEnclavePages
MiProtectLargeKernelHalRange
MiProtectPrivateMemory
MiProtectSharedUserPage
MiProtectSystemImage
MiPruneProcessLargePageCaches
MiQueryAddressState
MiQueryMemoryPhysicalContiguity
MiQueryProcessActivePatches
MiReadyReservedView
MiRebuildPageTableLeafAges
MiReferenceIoPages
MiReferenceNonPagedMemoryProcessList
MiReleaseLargePdeMappings
MiReleaseProcessReferenceToSessionDataPage
MiReleasePtes
MiReleaseSmallPteMappings
MiReloadBootLoadedDrivers
MiRelocateImage
MiRemoveLowestPriorityStandbyPage
MiReplacePageOfProtoPool
MiReplacePageTablePage
MiReplacePfnWithGapMapping
MiReplaceRotateWithDemandZero
MiReplaceRotateWithDemandZeroNoCopy
MiReplaceTransitionPage
MiReturnSystemVa
MiScrubActiveLargePage
MiScrubLargeMappedPage
MiSelectBestZeroingProcessor
MiSelectBestZeroingProcessorLegacy
MiSessionCreate
MiSessionObjectCreate
MiSetIdealProcessorThread
MiSetPagesModified
MiSetPagingOfDriver
MiSetProtectionOnSection
MiSetReadOnlyOnSectionView
MiSetSystemCodeProtection
MiSetVaAgeList
MiSharePages
MiShowBadMapper
MiSimpleAging
MiSnapDriverRange
MiSoftFaultMappedView
MiStealPage
MiStoreEvictThread
MiStoreLogFullPagefile
MiStoreLogNotCandidate
MiStoreLogWriteCompleteFailure
MiStoreLogWriteDisabled
MiStoreLogWriteIssueFailure
MiStoreLogWriteIssueRetry
MiSwitchToTransition
MiSystemFault
MiTerminateWsleCluster
MiTradeBootImagePage
MiTransferFileExtent
MiTranslatePageForCopy
MiTrimSharedPageFromViews
MiTrimUnusedPageFileRegionsWorker
MiTrimWorkingSet
MiUnapplyDriverHotPatch
MiUnlinkNodeLargePages
MiUnlinkPageFromBadList
MiUnlinkPageFromListEx
MiUnmapImageForEnclaveUse
MiUnmapMdlCommon
MiUnmapRetpolineStubs
MiUnmapViewOfSection
MiUpdateCfgSystemWideBitmapWorker
MiUpdatePageAttributeStamp
MiUpdateRetpolineImportFixups
MiValidatePagefilePageHash
MiValidateSectionCreate
MiVerifyLargeSectionLayout
MiWaitForFreePage
MiWalkEntireImage
MiWalkResetCommitPages
MiWalkVaRange
MiWorkingSetManager
MiWriteAwePtes
MiWritePageFileHash
MiWritePteHighLevel
MiWritePteHighLevelIsr
MiZeroAllPageFiles
MiZeroAndFlushPtes
MiZeroAndReleasePages
MiZeroHugeRangeCore
MiZeroInParallel
MiZeroInParallelWorker
MiZeroLargePage
MiZeroPage
MiZeroPageCalibrate
MiZeroPageFile
MiZeroPageFileFirstPage
MiZeroPageWorkMapping
MiZeroPageWrite
MigrateOOBELanguageToInstallationLanguage
MinAsn1DecodeGeneralizedTime
MinAsn1ExtractParsedCertificatesFromSignedData
MinAsn1ExtractValues
MinAsn1ParseAndDecodeRDNComponent
MinAsn1ParseSingleExtensionValue
MinAsn1StringToOid
MinCryptCheckCertsAndKeys
MinCryptDecodeHashAlgorithmIdentifier
MinCryptDecodeSignatureAlgorithmIdentifier
MinCryptIsKeyPresent
MinCryptVerifySignedHash2
MmAccessFault
MmAddRangeToCrashDump
MmAllocateContiguousMemoryEx
MmAllocateContiguousNodeMemory
MmAllocateMappingAddressEx
MmAssignProcessToJob
MmCheckCachedPageStates
MmCopyMemory
MmCreatePeb
MmCreateShadowMapping
MmCreateTeb
MmDeleteShadowMapping
MmDeleteTeb
MmEnforceWorkingSetLimit
MmEnumerateAddressSpaceAndReferenceImages
MmEnumerateSystemImages
MmFlushVirtualMemory
MmFreeLoaderBlock
MmFreeNonChargedSecurePages
MmFreeSecureKernelPages
MmFreeVirtualMemory
MmGetChannelInformation
MmIdentifyPhysicalMemory
MmInSwapVirtualAddresses
MmInSwapWorkingSet
MmInitializeHandBuiltProcess2
MmInitializeProcessAddressSpace
MmIsFileMapped
MmLogQueryCombineStats
MmLogSystemShareablePfnInfo
MmManagePartitionMemoryInformation
MmMarkPhysicalMemoryAsBad
MmNotifyProcessInSwapTrigger
MmOutPageKernelStack
MmOutSwapVirtualAddresses
MmOutSwapWorkingSet
MmPerfLogSessionRundown
MmPrefetchVirtualMemory
MmProbeAndLockProcessPages
MmProbeAndLockSelectedPages
MmProcessWorkingSetControl
MmProtectDriverSection
MmProtectMdlSystemAddress
MmProtectPool
MmQueryBadAddresses
MmQueryCommitReleaseState
MmQueryMemoryListInformation
MmQueryVirtualMemory
MmReleaseCommitForMemResetPages
MmRelocatePfnList
MmRemoveExecuteGrants
MmRemoveSystemCacheFromDump
MmSecureVirtualMemoryAgainstWrites
MmSetAddressRangeModifiedEx
MmSetCommitReleaseEligibility
MmSetPageProtection
MmSetPfnListInfo
MmStoreLogCorruptionFixed
MmUnlockPhysicalPagesByVa
MmUnmapIoSpace
MmUnmapProtectedKernelPageRange
MmUpdateOldWorkingSetPages
MmWaitMultipleForCacheManagerPrefetch
MmWriteSystemImageTracepoint
MmZeroPageFileAtShutdown
MxCreatePfns
MxZeroPageTablePfns
NtAddAtomEx
NtAlpcSetInformation
NtCommitRegistryTransaction
NtCompressKey
NtCreateEnclave
NtCreateMailslotFile
NtCreateNamedPipeFile
NtCreateProfile
NtCreateSymbolicLinkObject
NtCreateThread
NtCreateThreadEx
NtCreateTokenEx
NtCreateUserProcess
NtCreateWnfStateName
NtDebugActiveProcess
NtDeleteBootEntry
NtDeleteDriverEntry
NtDeleteFile
NtDeleteKey
NtDeleteValueKey
NtEnumerateKey
NtEnumerateValueKey
NtFindAtom
NtFlushKey
NtFreeUserPhysicalPages
NtFreezeRegistry
NtGetCachedSigningLevel
NtGetCompleteWnfStateSubscription
NtGetNextProcess
NtGetNextThread
NtGetNlsSectionPtr
NtGetWriteWatch
NtInitializeEnclave
NtLoadEnclaveData
NtLockProductActivationKeys
NtLockVirtualMemory
NtManageHotPatch
NtManagePartition
NtMapUserPhysicalPages
NtMapUserPhysicalPagesScatter
NtNotifyChangeMultipleKeys
NtNotifyChangeSession
NtOpenProcessTokenEx
NtPowerInformation
NtProtectVirtualMemory
NtPssCaptureVaSpaceBulk
NtQueryAttributesFile
NtQueryFullAttributesFile
NtQueryInformationFile
NtQueryInformationJobObject
NtQueryInformationProcess
NtQueryInformationThread
NtQueryKey
NtQueryMultipleValueKey
NtQueryOpenSubKeys
NtQueryOpenSubKeysEx
NtQuerySystemEnvironmentValueEx
NtQueryValueKey
NtQueryWnfStateData
NtRaiseHardError
NtRemoveIoCompletionEx
NtRemoveProcessDebug
NtRenameKey
NtReplaceKey
NtResetWriteWatch
NtRestoreKey
NtRollbackRegistryTransaction
NtSaveKeyEx
NtSaveMergedKeys
NtSecureConnectPort
NtSetContextThread
NtSetDefaultLocale
NtSetInformationJobObject
NtSetInformationKey
NtSetInformationProcess
NtSetInformationThread
NtSetInformationVirtualMemory
NtSetInformationWorkerFactory
NtSetSystemEnvironmentValueEx
NtSetSystemInformation
NtSetSystemPowerState
NtSetSystemTime
NtSetUuidSeed
NtSetValueKey
NtSetVolumeInformationFile
NtThawRegistry
NtTraceEvent
NtUnlockVirtualMemory
NtWaitForDebugEvent
NtWaitForMultipleObjects
NtWaitForMultipleObjects32
NtWaitForWorkViaWorkerFactory
ObCloseHandleTableEntry
ObCreateObjectTypeEx
ObCreateSiloRootDirectory
ObCreateSymbolicLink
ObDuplicateObject
ObGetSiloRootDirectoryPath
ObInitSystem
ObInsertObjectEx
ObOpenObjectByPointer
ObReferenceObjectByName
ObSetHandleAttributes
ObWaitForMultipleObjects
ObpAdjustCreatorAccessState
ObpCloseHandle
ObpCreateHandle
ObpDecrementHandleCount
ObpIncrementHandleCountEx
ObpInsertHandleCount
ObpInsertOrLocateNamedObject
ObpParseSymbolicLinkEx
ObpProcessRemoveObjectQueue
ObpStartRuntimeStackTrace
ObpVerifyAccessToBoundaryEntry
ObpVerifyCreatorAccessCheck
OpenGlobalizationUserSettingsKey_ForMua
Ordinal_14
Ordinal_30
Ordinal_5
Ordinal_6
Ordinal_9
PerfDiagInitialize
PerfDiagpIsTracingAllowed
PerfDiagpUpdatePerfDiagLoggerEnableFlags
PerfInfoLogIpiSend
PerfInfoLogSysCallEntry
PerfInfoLogSysCallExit
PerfInfoLogUnexpectedInterrupt
PerfInfoLogVirtualAlloc
PerfInfoLogVirtualFree
PerfLogExecutiveResourceInitialize
PerfLogExecutiveResourceRelease
PerfLogExecutiveResourceSetOwnerPointer
PerfLogExecutiveResourceWait
PerfLogImageLoad
PerfLogSpinLockRelease
PfQuerySuperfetchInformation
PfSnAppLaunchScenarioControl
PfSnAsyncPrefetchWorker
PfSnBeginAppLaunch
PfSnCheckActionsNeeded
PfSnCheckModernApp
PfSnEndTrace
PfSnGetPrefetchInstructions
PfSnGetSectionObject
PfSnLogAsyncWorker
PfSnLogGetReadListsStart
PfSnLogGetReadListsStop
PfSnLogOpenVolumesForPrefetch
PfSnLogPrefetchMetadata
PfSnLogScenarioDecision
PfSnOperationProcess
PfSnParametersRead
PfSnParsePrefetchParam
PfSnPopulateReadList
PfSnPrefetchSections
PfSnQueryVolumeInfo
PfSnSetAltPrefetchParam
PfSnSetPrefetcherInformation
PfSnVolumeCheckIsSdBus
PfSnVolumeCheckSeekPenalty
PfTLoggingWorker
PfVerifyScenarioBuffer
PfpFlushBuffers
PfpGetParameter
PfpLogApplicationEvent
PfpParametersRead
PfpPrefetchRequestPerform
PfpPrivSourceEnum
PfpQueryFileExtentsRequest
PfpQueryGpuUtilization
PfpRpControlRequest
PfpRpControlRequestCopy
PfpSourceGetPrefetchSupport
PfpUpdateRepurposedByPrefetch
PfpVolumeOpenAndVerify
Phase1InitializationDiscard
PiAuCheckTokenMembership
PiAuCreateStandardSecurityObject
PiAuDoesClientHavePrivilege
PiAuditDeviceOperation
PiCMDeleteDeviceKey
PiCMGetDeviceInterfaceAlias
PiCMGetDeviceInterfaceList
PiCMGetObjectProperty
PiCMRegisterDeviceInterface
PiCMSetDeviceProblem
PiCMSetObjectProperty
PiControlGetDevicePowerData
PiCreateDriverSwDeviceCallback
PiDcHandleCustomDeviceEvent
PiDcHandleDeviceEvent
PiDcHandleInterfaceEvent
PiDcInitUpdateProperties
PiDcResetChildDeviceContainerCallback
PiDcResetChildDeviceContainers
PiDcUpdateDeviceContainerMembership
PiDevCfgCheckDeviceNeedsUpdate
PiDevCfgClearDeviceMigrationNode
PiDevCfgConfigureDevice
PiDevCfgConfigureDeviceInterfaces
PiDevCfgConfigureDeviceLocation
PiDevCfgCopyDeviceKey
PiDevCfgEnumDeviceKeys
PiDevCfgFindDeviceMigrationNode
PiDevCfgGetKeySecurityDescriptor
PiDevCfgInitDeviceContext
PiDevCfgLogDeviceConfigured
PiDevCfgLogDeviceStarted
PiDevCfgParsePropertyKeyName
PiDevCfgQueryDeviceMigrationNode
PiDevCfgQueryDriverConfiguration
PiDevCfgQueryDriverNode
PiDevCfgQueryPolicyStringList
PiDevCfgResetDeviceDriverSettings
PiDevCfgResolveVariableDeviceProperty
PiDevCfgResolveVariableExpression
PiDevCfgResolveVariableFormatString
PiDevCfgResolveVariableGenerateGuid
PiDevCfgResolveVariableKeyHandle
PiDevCfgResolveVariableSwitchCase
PiDevCfgSplitDriverConfigurationId
PiDmAddCacheReferenceForObject
PiDmCacheDataEncode
PiDmEnumObjectsWithCallback
PiDmGetObject
PiDmGetReferencedObjectFromProperty
PiDmListInitEnumCallback
PiDmLookupObject
PiDmObjectGetCachedCmProperty
PiDmObjectUpdateCachedCmProperty
PiDqActionDataGetChangedProperties
PiDqDeleteUserObjectFromLoadedHives
PiDqIrpQueryCreate
PiDqObjectManagerEnumerateAndRegisterQuery
PiDqObjectManagerServiceActionQueue
PiDqOpenUserObjectRegKey
PiDqSameUserHive
PiDrvDbOverlayCopyKeys
PiDrvDbOverlayNodeHive
PiGetDeviceRegProperty
PiGetDeviceRegistryProperty
PiIsDriverBlocked
PiLastGoodRevertLastKnownDirectory
PiLookupInDDBCache
PiPnpRtlCmActionCallback
PiPnpRtlGatherInstallerClassChangeInfo
PiPnpRtlGatherInterfaceDeleteInfo
PiPnpRtlGetFilteredDeviceInterfaceList
PiPnpRtlInterfaceFilterCallback
PiPnpRtlIsDeviceEnumerableForUser
PiPnpRtlObjectEventCreate
PiPnpRtlObjectEventWorker
PiPnpRtlServiceFilterCallback
PiPnpRtlSetObjectProperty
PiProcessDriverInstance
PiProcessNewDeviceNode
PiQueryRemovableDeviceOverride
PiRearrangeDeviceInstances
PiRebalanceOptOut
PiSwCompleteCreate
PiSwFindSwDevice
PiUEventApplyAdditionalFilters
PiUEventBroadcastPortsChangedEvent
PiUEventInitClientRegistrationContext
PiUpdateDriverDBCache
PipCallDriverAddDevice
PipCallbackHasDeviceOverrides
PipChangeDeviceObjectFromRegistryProperties
PipCheckComputerSupported
PipCreateComputerId
PipCriticalDeviceWaitCallback
PipDmgGetDeviceDmarPolicy
PipGenerateContainerID
PipGetPersistentMemory
PipHardwareConfigClearStartOverrideCallback
PipHardwareConfigClearStartOverrides
PipHardwareConfigExists
PipHardwareConfigInit
PipInitComputerIds
PipInitDeviceOverrideCache
PipIs32bitKey
PipKsrNotifyDrivers
PipMakeGloballyUniqueId
PipProcessPendingObjects
PipResetDevice
PipServiceInstanceToDeviceInstance
PipUnprotectDevice
PipUpdateDeviceProducts
PnpBuildCmResourceList
PnpCallAddDevice
PnpCompareInterruptInformation
PnpDeviceActionWorker
PnpDeviceEventWorker
PnpDiagRundownConnectionResourceForEachDevice
PnpDiagRundownInterruptResourceForEachDevice
PnpDiagRundownParentDevNodeForEachDevice
PnpDiagRundownParentPdoForEachDevice
PnpDiagnosticTraceAppVeto
PnpDiagnosticTraceDeviceOperation
PnpDiagnosticTraceDriverFullInfo
PnpDiagnosticTraceElamDecision
PnpDiagnosticTraceElamStatus
PnpDiagnosticTraceObject
PnpDiagnosticTraceObjectWithStatus
PnpDriverLoadingFailed
PnpGetDeviceInterfacePropertyData
PnpGetDevicePropertyData
PnpGetStableSystemBootTime
PnpHardwareConfigCreateBootDriverFlags
PnpInitializeNotifyEntry
PnpIsValidGuidString
PnpNotifyDeviceClassChange
PnpNotifyDriverCallback
PnpNotifyHwProfileChange
PnpNotifyTargetDeviceChange
PnpNotifyUserModeDeviceRemoval
PnpPrepareDriverLoading
PnpProcessDeferredRegistrations
PnpQueryAndSaveDeviceNodeCapabilities
PnpRebalance
PnpRegistryValueExists
PnpReplacePartitionUnit
PnpSendIrp
PnpSetDeviceAffinityThread
PnpSetDeviceInterfacePropertyData
PnpSetDevicePropertyData
PnpShutdownDevices
PnpTraceClearDevNodeProblem
PnpTraceDeviceConfig
PnpTraceDeviceRemovalForResetComplete
PnpTraceDmaGuardDevicePolicy
PnpTraceDmaGuardSystemPolicy
PnpTraceDockDeviceEnumeration
PnpTraceDriverBlocked
PnpTraceInterruptConnection
PnpTraceIommuDeviceProperties
PnpTraceRebalanceResult
PnpTraceRequestDeviceRemovalForReset
PnpTraceSecureDeviceEnumeration
PnpTraceSetDevNodeProblem
PnpTraceWatchdogViolation
PnprCopyReservedMapping
PnprLogFailureEvent
PnprLogStartEvent
PnprLogSuccessEvent
PnprQuiesceProcessors
PnprQuiesceWorker
PoBroadcastSystemState
PoClearTransitionMarker
PoDiagTraceDeviceRundown
PoDiagTraceIRTimerSleepStudyRundown
PoEnergyContextStart
PoEnergyContextUpdateComponentPower
PoExecuteIdleCheck
PoFxEnableDStateReporting
PoFxRegisterDebugger
PoFxSetComponentLatency
PoFxSetComponentResidency
PoFxSetTargetDripsDevicePowerState
PoGetIdleTimes
PoGetLightestSystemStateForEject
PoGetPerfStateAndParkingInfo
PoIdle
PoInitSystem
PoInitiateProcessorWake
PoLatencySensitivityHint
PoPowerOffMonitor
PoRegisterPowerSettingCallback
PoRundownSystemTimer
PoSetUserPresent
PoThermalCounterSetCallback
PoTraceDynamicTickDisabled
PoTraceForceIdleReset
PoTraceForceIdleStateChange
PoTraceSystemTimerResolution
PoTraceSystemTimerResolutionIgnore
PoTraceSystemTimerResolutionKernel
PoTraceSystemTimerResolutionUpdate
PopAccountBatteryEnergyChange
PopAccountCbEnergyChange
PopAcquireAdaptiveLock
PopAdaptiveGetSessionStateUnsafe
PopAdaptivePersistSystemInitatedRebootState
PopAdaptivePowerSettingCallback
PopAdaptiveWnfCallback
PopApplyAdminPolicy
PopApplyPolicy
PopAssessSystemIdleEvent
PopBatteryApplyCompositeState
PopBatteryCheckCompositeCapacity
PopBatteryInitialize
PopBatteryQueryEstimatedTime
PopBatteryTracePercentageRemaining
PopBatteryTraceSystemBatteryStatus
PopBatteryUpdateAlarms
PopBatteryWorker
PopBcdEstablishResumeObject
PopBcdRegenerateResumeObject
PopBcdSetPendingResume
PopBlockSessionSwitch
PopBootBatteryStatusWorker
PopCalculateHiberFileSize
PopCallPowerSettingCallback
PopCaptureSleepStudyStatistics
PopCheckShutdownMarker
PopClearHiberFileSignature
PopCompressHiberBlocks
PopConfigureHeteroPolicies
PopCreateHiberFile
PopCreateNotificationName
PopDecompressHiberBlocks
PopDiagTraceAbnormalReset
PopDiagTraceAcDcStateChange
PopDiagTraceActiveCooling
PopDiagTraceAdaptiveBootOverride
PopDiagTraceAdaptiveBootOverridePrepared
PopDiagTraceAdaptiveOverrideClear
PopDiagTraceAdaptiveOverrideTriggered
PopDiagTraceAppPowerMessage
PopDiagTraceAppPowerMessageEnd
PopDiagTraceBatteryAlarmStatus
PopDiagTraceBatteryCountChange
PopDiagTraceBatteryTriggerFlags
PopDiagTraceBatteryTriggerMet
PopDiagTraceBsdWriteTime
PopDiagTraceClearDeepSleepConstraint
PopDiagTraceConsoleDisplayState
PopDiagTraceControlCallback
PopDiagTraceCoolingExtension
PopDiagTraceCoolingExtensionActiveUpdate
PopDiagTraceCoolingExtensionPassiveUpdate
PopDiagTraceCsConsumption
PopDiagTraceCsDeepSleepWatchdog
PopDiagTraceCsDripsDivergence
PopDiagTraceCsDripsWatchdog
PopDiagTraceCsDripsWatchdogPerfTrack
PopDiagTraceCsEnterReason
PopDiagTraceCsExitReason
PopDiagTraceCsFanPerfTrack
PopDiagTraceCsResiliencyStats
PopDiagTraceDIrpAfterSx
PopDiagTraceDebuggerTransitionRequirements
PopDiagTraceDeepSleepConstraintRundown
PopDiagTraceDeviceAcquireIrp
PopDiagTraceDeviceComplianceRundown
PopDiagTraceDeviceComplianceUpdate
PopDiagTraceDeviceIdleCheck
PopDiagTraceDeviceReleaseIrp
PopDiagTraceDeviceVerboseRundown
PopDiagTraceDevicesLevel
PopDiagTraceDevicesSuspend
PopDiagTraceDirectedDripsInitialization
PopDiagTraceDirectedDripsNotifyAppsAndServices
PopDiagTraceDirtyTransition
PopDiagTraceDiskIdleCheck
PopDiagTraceDisplayBurstWin32kCallout
PopDiagTraceDozeDeferralDecision
PopDiagTraceDripsHistogram
PopDiagTraceDriverVeto
PopDiagTraceDynamicTickStatusRundown
PopDiagTraceEsState
PopDiagTraceExecutePowerAction
PopDiagTraceFirmwareS3Stats
PopDiagTraceFxComponentAccounting
PopDiagTraceFxComponentIdleConstraints
PopDiagTraceFxComponentIdleState
PopDiagTraceFxComponentLogicalCondition
PopDiagTraceFxComponentRegistration
PopDiagTraceFxComponentWake
PopDiagTraceFxDefaultPepWorkerEnd
PopDiagTraceFxDeviceAccounting
PopDiagTraceFxDeviceDirectedCompletion
PopDiagTraceFxDeviceDirectedTransition
PopDiagTraceFxDeviceIdleConstraints
PopDiagTraceFxDevicePowerRequirement
PopDiagTraceFxDevicePowerState
PopDiagTraceFxDevicePowered
PopDiagTraceFxDevicePreparation
PopDiagTraceFxDeviceRegistration
PopDiagTraceFxDeviceStartPowerManagement
PopDiagTraceFxDeviceUnregistration
PopDiagTraceFxGlobalDeviceAccounting
PopDiagTraceFxPerfNominalChange
PopDiagTraceFxPerfRegistration
PopDiagTraceFxPerfRequest
PopDiagTraceFxPerfRequestComplete
PopDiagTraceFxPerfRequestProgress
PopDiagTraceFxPerfSetRegistration
PopDiagTraceFxPluginRegistration
PopDiagTraceHiberStats
PopDiagTraceHibernateErrorStatus
PopDiagTraceIdleCheck
PopDiagTraceIdleResiliencyEnd
PopDiagTraceIdleResiliencyStart
PopDiagTraceIllegalProcessorThrottle
PopDiagTraceInvalidBootStat
PopDiagTraceIoCoalescingDiskIdle
PopDiagTraceIoCoalescingOn
PopDiagTraceIrpFinish
PopDiagTraceIrpFinishTelemetry
PopDiagTraceIrpPended
PopDiagTraceIrpStart
PopDiagTraceKernelQueriesAllowed
PopDiagTraceMonitorOnWithLidClosed
PopDiagTraceMtrrError
PopDiagTracePassiveCooling
PopDiagTracePerfTrackData
PopDiagTracePlatformRoleRundown
PopDiagTracePolicyChange
PopDiagTracePolicyInitiatePowerActionApiCall
PopDiagTracePostSleepNotification
PopDiagTracePowerButtonBugcheck
PopDiagTracePowerRequestChange
PopDiagTracePowerRequestCreate
PopDiagTracePowerSetting
PopDiagTracePowerSettingRegistration
PopDiagTracePowerStateEvent
PopDiagTracePowerStateEventRundown
PopDiagTracePowerTransitionEnd
PopDiagTracePowerTransitionStart
PopDiagTracePowerTransitionTime
PopDiagTracePreSleepNotification
PopDiagTraceProcessorThrottleDurationPerfTrack
PopDiagTraceProcessorThrottlePerfTrack
PopDiagTraceRegisterSystemState
PopDiagTraceRtcWakeInfo
PopDiagTraceServiceNotification
PopDiagTraceSessionDisplayStateChange
PopDiagTraceSessionState
PopDiagTraceSessionStateCounted
PopDiagTraceSessionStates
PopDiagTraceSetDeepSleepConstraint
PopDiagTraceSetSystemState
PopDiagTraceSetThreadExecutionState
PopDiagTraceShutdownAction
PopDiagTraceSkipTick
PopDiagTraceSleepReliabilityDiagConfigUpdate
PopDiagTraceSleepStudyStart
PopDiagTraceSleepStudyStop
PopDiagTraceStateTransitionFailurePoint
PopDiagTraceSystemIdleContextUpdate
PopDiagTraceSystemIdleRundown
PopDiagTraceSystemLatencyUpdate
PopDiagTraceThermalCoolingMode
PopDiagTraceThermalRequest
PopDiagTraceThermalRequestActiveUpdate
PopDiagTraceThermalRequestPassiveUpdate
PopDiagTraceThermalStateChange
PopDiagTraceThermalZoneEnumeration
PopDiagTraceThermalZoneRundown
PopDiagTraceThermalZoneThrottleDurationPerfTrack
PopDiagTraceThermalZoneThrottlePerfTrack
PopDiagTraceTripPointExceeded
PopDiagTraceUmpoAlpcProcessingError
PopDiagTraceUsermodeThermalEvent
PopDirectedDripsDiagNotifySessionStop
PopDirectedDripsDiagRundownBroadcastTrees
PopDirectedDripsDiagRundownDevices
PopDirectedDripsDiagTraceBroadcastVisit
PopDirectedDripsDiagTraceDfxPowerStateFailure
PopDirectedDripsDiagTraceMarkDevice
PopDirectedDripsDiagTraceNotifyDevices
PopDirectedDripsDiagTraceProblemDevice
PopDirectedDripsQueryRegistryValues
PopDirectedDripsSendSuspendResumeNotification
PopDispatchNotificationsToList
PopDispatchStateCallout
PopDripsWatchdogCheckHwDivergence
PopDripsWatchdogDiagnosticWorker
PopEnableHiberFile
PopEsUpdateSetting
PopEstimateChargeTime
PopEtAppIdIntern
PopEtEnergyContextProcessStateUpdate
PopEtEnergyTrackerUpdateAggregate
PopEtGetProcessAppId
PopEtInit
PopEtIsrDpcQuery
PopEtProcessEnumSnapshotCallback
PopEvaluateInputSuppressionAction
PopEvaluateWeakChargerState
PopEventCalloutDispatch
PopExecutePowerAction
PopExecuteSystemIdleAction
PopFanReadFanNoiseInfo
PopFanSetupRpmBuckets
PopFanUpdateSpeed
PopFanUpdateStatistics
PopFanWorker
PopFlushAndHold
PopFlushVolumeWorker
PopFxBuildDripsBlockingDeviceList
PopFxInitializeSocSubsystemStaticInfo
PopFxIsDevicePotentialDripsConstraint
PopFxLogSocSubsystemBlockingTimes
PopFxPlatformIdleVeto
PopFxProcessorIdleVeto
PopFxStopDeviceAccounting
PopFxTraceDeviceRegistration
PopFxUpdatePlatformIdleState
PopFxUpdateProcessorIdleState
PopGetBitlockerKeyLocation
PopGetHwConfigurationSignature
PopGetSettingNotificationName
PopHiberCheckResume
PopIdleWakeGenerateInterruptDescriptionString
PopIdleWakeNotifyModernStandbyExitWorker
PopIdleWakeSendDripsWakeSourceTelemetry
PopIdleWakeTraceWakeSourceDiagnostic
PopInitPlatformSettings
PopInitSIdle
PopInitializeHeteroProcessors
PopInitializePowerButtonHold
PopInitializePowerPolicySimulate
PopInvokeStateHandlerTargetProcessor
PopInvokeSystemStateHandler
PopIsMktmeEnabled
PopIsRemoteDesktopEnabled
PopIsSystemIdle
PopIssueActionRequest
PopLidReliabilityInit
PopLidSwitchChangeCallback
PopLidSwitchReliabilityUpdateCallback
PopLogNotifyDevice
PopMarshalSettingValues
PopMonitorProcessLoop
PopNetWnfLowPowerEpochCallback
PopOpenPersistedRegistryKey
PopOpenThermalLoggingKey
PopPdcCsCheckSystemVolumeDevice
PopPepInitializeDebuggerMasks
PopPepInitializeVetoMasks
PopPepUpdateIdleStateRefCount
PopPepWork
PopPlNotifyDeviceDState
PopPlNotifyDeviceFState
PopPlPublishInitialPowerDraw
PopPlPublishSystemPowerChange
PopPlRegisterComponent
PopPlRegisterDevice
PopPlRegisterDeviceIterator
PopPlRegisterPowerPlane
PopPlTraceLogPowerPlane
PopPlUnregisterComponent
PopPlUnregisterDevice
PopPolicyDeviceHandleWakeAlarmNotification
PopPolicyWorkerAction
PopPotsLogDirtyPowerTransition
PopPotsLogPowerTransitionReliability
PopPowerAggregatorDiagTraceHandleIntent
PopPowerAggregatorDiagTracePdcSleepTransition
PopPowerAggregatorInvokeStateMachine
PopPowerAggregatorNotifySuspendResume
PopPowerAggregatorSetCurrentState
PopPowerButtonSettingCallback
PopPowerButtonWorkCallback
PopPowerInformationInternal
PopPowerRequestDelete
PopPowerRequestStatsInitialize
PopPowerSourceChangeCallback
PopQueryHiberPersistedRegValue
PopQueryPowerButtonConfiguration
PopReadHiberbootGroupPolicy
PopReadHiberbootPolicy
PopReadLegacySimulateProcessorClass
PopReadShutdownPolicy
PopReadSimulateProcessorClass
PopReadSimulateProcessorClasses
PopReadSystemAwayModePolicy
PopRecordPoIrpBlackboxInformation
PopReleaseAdaptiveLock
PopResetCurrentPolicies
PopSaveHiberContext
PopSendSuspendResumeApplicationNotification
PopSendSuspendResumeServiceNotification
PopSetAwayModeStatus
PopSetDevicesSystemState
PopSetMemoryOverwriteRequestAction
PopSleepstudyCaptureResiliencyStatistics
PopSleepstudySendSessionChangeEvent
PopSleepstudySendSessionChangeWnf
PopSleepstudySendWnfNotification
PopSleepstudyStartNextSession
PopSpoilBatteryEstimate
PopSqmAddToStream
PopSqmFanEnumeration
PopSqmThermalCriticalEvent
PopSqmThermalUsermodeEvent
PopSqmThermalZoneEnumeration
PopSystemIrpCompletion
PopThermalHandlePreviousShutdown
PopThermalWorker
PopTraceBootError
PopTraceCr3Mitigated
PopTraceCr3Tripped
PopTraceEsBgActivityPolicyUpdate
PopTraceEsSetting
PopTraceEsState
PopTraceHibernatePolicyUpdate
PopTraceInputSuppressionActionUpdate
PopTraceMonitorOnRequestUserInput
PopTraceNetRefreshTimerArmed
PopTracePowerReconfig
PopTraceSleepCheckpointInitFailure
PopTraceSmbiosChange
PopTraceStandbyConnectivityRundown
PopTraceStandbyConnectivityUpdate
PopTraceSystemIdleS0LowPowerDoze
PopTraceSystemIdleS0LowPowerDozeTimerArmed
PopTraceSystemIdleS0LowPowerDozeTimerCancelled
PopTraceThermalRequestActiveActivity
PopTraceThermalRequestPassiveHistogram
PopTraceThermalStandbyComplete
PopTraceThermalStandbyInitiated
PopTraceThermalZoneActiveActivity
PopTraceThermalZonePassiveHistogram
PopTraceZoneCr3Mitigated
PopTraceZoneCr3Tripped
PopTransitionTelemetryOsState
PopTriggerDiagTraceAoAcCapability
PopUmpoInitializeChannel
PopUmpoInitializeMonitorChannel
PopUmpoProcessMessage
PopUmpoProcessMessages
PopUmpoSendPowerMessage
PopUpdateBackgroundCoolingStatus
PopUpdateExternalDisplayState
PopUpdateUpgradeInProgress
PopUsbErrorWNFNotificationCallback
PopValidateHiberFileSize
PopWatchdogWorker
PopWin32kPowerSettingCallback
PopWnfAirplaneModeCallback
PopWnfAudioCallback
PopWnfFullscreenVideoCallback
PopWnfMixedRealityCallback
PopWnfMobileHotspotCallback
PopWnfSprActiveSessionChangeCallback
PopWriteBsdPoInfo
PopWriteHiberImage
PopWriteHiberPages
PopZeroHiberFile
PpDevCfgInit
PpDevCfgProcessDeviceClass
PpDevCfgProcessDeviceExtensions
PpDevCfgProcessDeviceReset
PpForEachDeviceInstanceDriver
PpProcessClearProblem
PpResetProblemDevices
PpmCapturePerformanceDistribution
PpmCheckComputeEnergy
PpmCheckComputeHeteroResponse
PpmCheckComputeMultiClassHeteroResponse
PpmCheckContinueExecution
PpmCheckInitProcessors
PpmCheckInitProcessorsLegacy
PpmCheckRun
PpmCheckSnapAllDeliveredPerformance
PpmCheckStart
PpmClearSimulatedIdle
PpmEstimateIdleDuration
PpmEventAutonomousModeChange
PpmEventBiosCapChange
PpmEventCoordinatedIdleTransition
PpmEventCoreParkingSoftParkedStateChange
PpmEventCoreParkingStateChange
PpmEventCoreParkingStateChangeEx
PpmEventDomainPerfStateChange
PpmEventEnergyEstimationRundown
PpmEventEnterPlatformIdleState
PpmEventHeteroFavoredCoreRotationChange
PpmEventHeteroPolicy
PpmEventHgsActiveWorkloadClass
PpmEventHgsCoresUnparkedCount
PpmEventHgsHardwareTable
PpmEventHgsNormalizedTable
PpmEventHiddenProcessorBiosCapChange
PpmEventHiddenProcessorPerformance
PpmEventHiddenProcessorThermalCapChange
PpmEventIdleDurationExpiration
PpmEventIdleStateChange
PpmEventLPICoreParking
PpmEventLegacyProcessorPerfStateChange
PpmEventParkNodeCapChange
PpmEventParkNodeClassRecordedStats
PpmEventParkNodeParkHintChanged
PpmEventParkNodePreference
PpmEventParkingCountSelection
PpmEventPerfSelectProcessorState
PpmEventPlatformVetoRequest
PpmEventPlatformVetoRundown
PpmEventProcessorPerfStateChange
PpmEventProcessorVetoRequest
PpmEventProcessorVetoRundown
PpmEventQosClassPolicy
PpmEventQosSupport
PpmEventSoftParkRankListChanged
PpmEventStaticPolicyRundown
PpmEventThermalCapChange
PpmEventTraceAccountingBucketIntervalsRundown
PpmEventTraceDeliveredPerfChange
PpmEventTraceDripsAccountingSnapshot
PpmEventTraceExpectedUtility
PpmEventTraceFailedPerfCheckStart
PpmEventTraceHeteroDistributeUtility
PpmEventTraceHeteroResponse
PpmEventTraceHeteroSets
PpmEventTraceLPIState
PpmEventTraceMultiClassHeteroResponse
PpmEventTraceMultiClassHeteroResponseUpdate
PpmEventTraceParkNodeRundown
PpmEventTracePlatformIdleAccounting
PpmEventTracePpmProfileStatusRundown
PpmEventTracePreVetoAccounting
PpmEventTraceProcessorIdleAccounting
PpmEventTraceProcessorPerformance
PpmEventTraceProcessorPerformanceDomainRundown
PpmEventTraceProcessorPerformanceRundownHv
PpmEventTraceProfileChange
PpmEventTraceProfileEnable
PpmEventTraceProfileSetting
PpmEventTraceProfiles
PpmEventTraceRecordedUtility
PpmEventTraceSoftCoreParkingSelection
PpmEventVetoReasonRundown
PpmEventVpQosChange
PpmHeteroComputeMultiClassUnparkCount
PpmHeteroHgsProcessorInit
PpmHeteroInitializeHgsSupport
PpmHeteroUpdateHgsConfiguration
PpmHvSnapPerformanceAccumulation
PpmIdleCaptureCsVetoAccounting
PpmIdleExecuteTransition
PpmIdleInitializeConcurrency
PpmIdleInstallNewVetoList
PpmIdleSelectStates
PpmInfoRegisterCallbacks
PpmInfoTraceProfileSettings
PpmInitIllegalThrottleLogging
PpmInstallFeedbackCounters
PpmInstallNewIdleStates
PpmMediaBufferingWorker
PpmParkComputeUnparkMask
PpmParkRecordNodeStatistics
PpmParkRegisterParking
PpmParkReportParkedCores
PpmParkSteerInterrupts
PpmParkUpdateConcurrencyTracking
PpmPerfApplyDomainState
PpmPerfApplyProcessorStates
PpmPerfArbitratorApplyProcessorState
PpmPerfCalculateQosClassPolicies
PpmPerfProcCapFloorSettingCallback
PpmPerfRecordMostActiveWorkloadClass
PpmPerfTelemetryWorker
PpmPostProcessMediaBuffering
PpmProcessSettingsFromQueryTable
PpmRegisterPerfStates
PpmRegisterSpmSettings
PpmRemoveIdleStates
PpmSetProfilePolicySetting
PpmSetSimulatedIdle
PpmSnapDripsAccountingSnapshot
PpmSnapPerformanceAccumulation
PpmTraceExitLatency
PpmTracePerfIdleRundown
PpmUnlockProcessors
PpmUpdateIdleStates
PpmUpdatePlatformIdleVeto
PpmUpdateProcessorIdleVeto
PpmUpdateProcessorPolicy
PrpWriteTraceLoggingEvent
PsBootPhaseComplete
PsCreateMinimalProcess
PsCreateSystemThreadEx
PsDispatchIumService
PsInitializeSyscallProviders
PsMapSystemDlls
PsOpenProcess
PsOpenThread
PsPicoWalkUserStack
PsQueryProcessCommandLine
PsQueryProcessExceptionFlags
PsRegisterSyscallProvider
PsRundownVsmEnclave
PsSetLoadImageNotifyRoutineEx
PsShutdownSystem
PsStartSiloMonitor
PsTerminateVsmEnclave
PsUnregisterSiloMonitor
PspAllocateAndQueryNotificationChannel
PspAllocateAndQueryProcessNotificationChannel
PspAllocatePartition
PspAllocateProcess
PspAllocateThread
PspApplyMitigationOptions
PspApplyWorkingSetLimits
PspApplyWorkingSetLimitsToProcess
PspAssignProcessQuotaBlock
PspAssignProcessToJob
PspBuildCreateProcessContext
PspCatchCriticalBreak
PspChangeProcessExecutionState
PspCombineSecurityDomains
PspCopyNodeRelativeMaskToAffinityEx
PspCreatePicoThread
PspCreateProcess
PspCreateSecureThread
PspCreateThread
PspDeleteUserStack
PspDestroySyscallProvider
PspEnforceLimits
PspEnforceLimitsJobPostCallback
PspFoldProcessAccountingIntoJob
PspFreeUserFiberShadowStack
PspFreezeJobTree
PspGetContextThreadInternal
PspGetSetContextInternal
PspHardenMitigationOptions
PspIdentityBasedJobBreakaway
PspInheritMitigationAuditOptions
PspInheritMitigationOptions
PspInitPhase0
PspInitPhase3
PspInitializeFullProcessImageName
PspInitializeThunkContext
PspIsDfssEnabled
PspIsProcessReadyForRemoteThread
PspIumAllocateSecurePool
PspIumGetPhysicalPage
PspIumWorker
PspJobDelete
PspLogAuditTerminateRemoteProcessEvent
PspMapSystemDll
PspOneDirectionSecurityDomainCombine
PspProcessDelete
PspProcessDynamicEHContinuationTargets
PspProcessDynamicEnforcedAddressRanges
PspQueryJobHierarchyAccountingInformation
PspQueryProcessAccountingInformationCallback
PspQueryQuotaLimits
PspQueryRateControlHistory
PspReadIFEOMitigationAuditOptions
PspReadIFEOMitigationOptions
PspReadIFEONodeOptions
PspReadIFEOPerfOptions
PspReadUserQuotaLimits
PspReferenceCpuPartitionByHandle
PspRundownSingleProcess
PspSecureThreadStartup
PspSetContextThreadInternal
PspSetEffectiveJobLimits
PspSetJobIoAttribution
PspSetJobIoRateControl
PspSetNetRateControl
PspSetProcessAffinitySafe
PspSetQuotaLimits
PspSetupUserProcessAddressSpace
PspSetupUserShadowStack
PspSetupUserStack
PspShutdownCsrProcess
PspSyscallProviderServiceDispatchGeneric
PspTrySetProcessPebThrottlingFlags
PspValidateMitigationAuditOptions
PspValidateMitigationOptions
PspWow64GetContextThread
PspWow64InitThread
PspWow64ReadOrWriteThreadCpuArea
PspWow64SetContextThread
PspWow64SetupUserStack
PspWritePebAffinityInfo
PspWriteTebIdealProcessor
PspWriteTebImpersonationInfo
RaiseException
RamdiskStart
RawMountVolume
RawQueryFileSystemInformation
RawQueryFsSizeInfo
ReadStringDelimited
ReadStringDelimited
RegistryOverwriteCentralProcessor
RtlAddAccessFilterAce
RtlAddMandatoryAce
RtlAddResourceAttributeAce
RtlApplyImportRelocationToImage
RtlApplyImportRelocationToPage
RtlApplyIndirectRelocationToPage
RtlApplySwitchJumpRelocationToPage
RtlAssert
RtlCapabilityCheck
RtlCheckTokenCapability
RtlCheckTokenMembershipEx
RtlContinueLongJump
RtlConvertSidToUnicodeString
RtlCreateHeap
RtlCultureNameToLCID
RtlDeriveCapabilitySidsFromName
RtlDisableXfgOnTarget
RtlDispatchException
RtlEqualPrefixSid
RtlEthernetStringToAddressA
RtlEthernetStringToAddressW
RtlFileMapMapView
RtlFindMessage
RtlFormatCurrentUserKeyPath
RtlFormatMessageEx
RtlGUIDFromString
RtlGenerate8dot3Name
RtlGenerateClass5Guid
RtlGetCpuVendor
RtlGetProcessorSignature
RtlGetProductInfo
RtlGetSetBootStatusData
RtlImpersonateSelfEx
RtlIncrementCorrelationVector
RtlInitFunctionOverrideCapabilities
RtlInitializeBootStatusDataBlackBox
RtlInt64ToUnicodeString
RtlIntegerToChar
RtlIntegerToUnicode
RtlIntegerToUnicodeString
RtlIpv4AddressToStringExA
RtlIpv4AddressToStringExW
RtlIpv4StringToAddressA
RtlIpv4StringToAddressW
RtlIpv6AddressToStringExA
RtlIpv6AddressToStringExW
RtlIsNameLegalDOS8Dot3
RtlIsUntrustedObject
RtlIsValidProcessTrustLabelSid
RtlLargeIntegerToChar
RtlLargeIntegerToUnicode
RtlLoadString
RtlLocalTimeToSystemTime
RtlOsDeploymentState
RtlPerformRetpolineRelocationsOnImageEx
RtlQueryAtomInAtomTable
RtlQueryImageFileKeyOption
RtlQueryImageXfgFilter
RtlQueryModuleInformation
RtlQueryPackageClaims
RtlQueryValidationRunlevel
RtlRaiseCustomSystemEventTrigger
RtlRestoreBootStatusDefaults
RtlSidDominates
RtlSystemTimeToLocalTime
RtlUnicodeStringToInt64
RtlUnwind
RtlUnwindEx
RtlUpdateImportRelocationsInImage
RtlUpdateSwapReference
RtlVerifyVersionInfo
RtlpAllocateHeapRaiseException
RtlpAllowsLowBoxAccess
RtlpCapabilityCheckSystemCapability
RtlpCheckDynamicTimeZoneInformation
RtlpCopyAces
RtlpCopyEffectiveAce
RtlpCreateUserProcess
RtlpCreateUserThreadEx
RtlpDynamicLookasideRebalance
RtlpEtcIsValidFeatureId
RtlpFcApplyUpdateAndAddFeature
RtlpFcCalculateRequiredSizeForNewFeatureTable
RtlpFcNotifyFeatureUsageTarget
RtlpFcSectionTypeToBufferType
RtlpFindRegTziForCurrentYear
RtlpFlsFree
RtlpGetDynamicTimeZoneInfoHandle
RtlpGetNtProductTypeFromRegistry
RtlpGetTimeZoneInfoHandle
RtlpGetTokenNamedObjectPath
RtlpHpAllocVA
RtlpHpCustomVaCallbacksRegistrarRegister
RtlpHpLfhBucketSubsegmentStatsUpdate
RtlpHpLfhBucketUpdateAffinityMapping
RtlpHpScheduleCompaction
RtlpHpVaMgrAlloc
RtlpInitNlsFileName
RtlpInitializeNonVolatileFlush
RtlpIsAppContainer
RtlpIsNameInExpressionPrivate
RtlpLogCapabilityCheckLatency
RtlpMuiRegAddLanguageByName
RtlpNewSecurityObject
RtlpNormalizeAcl
RtlpPopulateLanguageConfigList
RtlpProcessIFEOKeyFilter
RtlpQueryNlsSystemCodePages
RtlpQueryTimeZoneInformationWorker
RtlpReadExtendedContext
RtlpSetSecurityObject
RtlpSysVolCheckOwnerAndSecurity
RtlpSysVolCreateSecurityDescriptor
RtlpSysVolTakeOwnership
RtlpUpdateDynamicTimeZones
RtlpValidTrustSubjectContext
RtlpVerCompare
RtlpWalkFrameChain
SC_DEVICE::GetStorageProperty
SC_DEVICE::Initialize
SC_DISK::GenerateId
SC_DISK::Initialize
SC_GPT::CreatePartitionTable
SC_MBR::CreatePartitionTable
SC_MBR::WritePartitionTable
SLQueryLicenseValueInternal
SMKM_STORE<SM_TRAITS>::SmStCleanup
SMKM_STORE<SM_TRAITS>::SmStStart
SMKM_STORE<SM_TRAITS>::SmStSwapStore
SMKM_STORE<struct_SM_TRAITS>::SmStDirectRead
SMKM_STORE<struct_SM_TRAITS>::SmStPrioritizeRegionsStore
SMKM_STORE<struct_SM_TRAITS>::SmStTrimWsStore
SMKM_STORE_MGR<SM_TRAITS>::SmFeStoreDelete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeAddInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeCheckPresent
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictComplete
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeEvictInitiate
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeSetEvictFailed
SMKM_STORE_MGR<struct_SM_TRAITS>::SmFeStoreEvictKeys
SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogWorker
SPCallServerHandleClepKdf
SPCallServerHandleClepSign
SPCallServerHandleIsAppLicensed
ST_STORE<SM_TRAITS>::StDmStart
ST_STORE<struct_SM_TRAITS>::StCompactRegions
ST_STORE<struct_SM_TRAITS>::StCompactionPerformInMem
ST_STORE<struct_SM_TRAITS>::StCompactionPickPriority
ST_STORE<struct_SM_TRAITS>::StDmEtaPerformIo
ST_STORE<struct_SM_TRAITS>::StDmPageRetrieve
ST_STORE<struct_SM_TRAITS>::StDmRegionEvict
ST_STORE<struct_SM_TRAITS>::StDmSinglePageCopy
ST_STORE<struct_SM_TRAITS>::StDmSinglePageRetrieveSync
ST_STORE<struct_SM_TRAITS>::StDmpSinglePageAdd
SaveNodeDistanceInformation
SbpStartLanman
ScExtractDeviceStrings
SdbGetDatabaseMatch
SdbGetEntryFlags
SdbGetMergeRedirectPath
SdbGetPathCustomSdb
SdbMakeIndexKeyFromStringEx
SdbReadEntryInformation
SdbTagRefToTagID
SdbpCheckMatchingRegistryEntry
SdbpCheckMatchingWildcardFiles
SdbpCreateSearchDBContext
SdbpFindFirstIndexedWildCardTag
SdbpFindNextIndexedWildCardTag
SdbpGetExeEntryFlags
SdbpGetFileTimestamp
SdbpGetPathAppPatch
SdbpGetPathAppPatchPreRS3
SdbpGetPathAppraiser
SdbpGetPathCustomSdb
SdbpGetPathCustomSdbPreRS3
SdbpMatchOsVersion
SdbpOpenLocalDatabaseEx
SddlAddAccessFilterAce
SddlAddMandatoryAce
SddlAddProcessTrustLabelAce
SddlAddScopedPolicyIDAce
SddlpUuidFromString
SeAccessCheckByType
SeAccessCheckFromState
SeAccessCheckWithHint
SeAdtRegistryValueChangedAuditAlarm
SeAuditBootConfiguration
SeAuditFipsCryptoSelftests
SeAuditHandleDuplication
SeAuditHardLinkCreationWithTransaction
SeAuditPlugAndPlay
SeAuditProcessCreation
SeAuditProcessExit
SeAuditSystemTimeChange
SeAuditTransactionStateChange
SeCaptureObjectTypeList
SeCheckAuditPrivilege
SeCheckForCriticalAceRemoval
SeCheckPrivilegedObject
SeEtwWriteKMCveEvent
SeGetTokenDeviceMap
SeLogAccessFailure
SeMakeAnonymousLogonToken
SeMakeAnonymousLogonTokenNoEveryone
SeMakeSystemToken
SeOperationAuditAlarm
SePrivilegePolicyCheck
SeQuerySecurityAttributesTokenAccessInformation
SeReportSecurityEventWithSubCategory
SeSinglePrivilegeCheck
SeSinglePrivilegeCheckEx
SeSubProcessToken
SecureDump_ConvertBinaryToHexString
SecureDump_ConvertToRsaBlob
SecureDump_Encrypt_DmpData
SecureDump_LoadCertAndProvisionKey
SendCaptureStateNotificationsWorker
SepAccessCheck
SepAccessCheckAndAuditAlarm
SepAccessCheckEx
SepAdjustPrivileges
SepAdtCloseObjectAuditAlarm
SepAdtDeleteObjectAuditAlarm
SepAdtGenerateDiscardAudit
SepAdtInitializeBounds
SepAdtLogAuditFailureEvent
SepAdtLogAuditRecord
SepAdtObjectReferenceAuditAlarm
SepAdtOpenObjectAuditAlarm
SepAdtOpenObjectForDeleteAuditAlarm
SepAdtPrivilegeObjectAuditAlarm
SepAdtPrivilegedServiceAuditAlarm
SepAdtSecurityDescriptorChangedAuditAlarm
SepAdtStagingEvent
SepAdtTokenRightAdjusted
SepAppendAceToTokenDefaultDacl
SepAppendAceToTokenObjectAcl
SepAuditAssignPrimaryToken
SepCanTokenMatchAllPackageSid
SepCleanupLUIDDeviceMapDirectory
SepCommonAccessCheckEx
SepCopyAnonymousTokenAndSetSilo
SepCreateTokenEx
SepDesktopAppxSubProcessToken
SepGetProcUniqueLuidAndIndexFromAttributeInfo
SepGetStackTraceHash
SepInitializationPhase1
SepInitializeDebugOptions
SepLoadNgenLocations
SepLogTokenSidManagement
SepLogUnmatchedSessionFlagImpersonationAttempt
SepMandatoryIntegrityCheck
SepMandatorySubProcessToken
SepParseElamCertResources
SepReadAndInsertCaps
SepReadAndPopulateCapes
SepRegQueryValue
SepRmCallLsa
SepRmCommandServerThread
SepRmDispatchDataToLsa
SepRmLsaConnectRequest
SepRmVerifyLsaProtectionLevel
SepSecureBootCheckForUpdates
SepSetProcessTrustLabelAceForToken
SepValidateReferencedCachedHandles
SepVerifyDesktopAppPolicyOverrideCaller
SepVerifyDesktopAppxImage
SepVerifyDesktopAppxPackageName
SetFailureLocation
SiFindSystemPartition
SiGetDeviceNumberInformation
SiGetEfiSystemDevice
SiGetSystemDeviceName
SiIsWinPeHardDiskZeroUfdBoot
SiQueryProperty
SiValidateSystemPartition
SmEtwEnabled
SmEtwLogRegionOp
SmEtwLogStoreCorruption
SmEtwLogStoreOp
SmEtwLogStoreStateChange
SmFirstTimeInit
SmFpPreAllocate
SmKmEtwAppendObjectName
SmKmEtwLogStoreChange
SmKmEtwLogStoreStats
SmKmFileInfoGetPath
SmKmKeyGenLoadKey
SmKmRegParamsLoad
SmKmSqmAddToStream
SmKmStoreFileCreate
SmKmStoreFileGetExtents
SmKmStoreFileOpenVolume
SmKmStoreFileWriteHeader
SmKmStoreTerminateWorker
SmProcessCompressionInfoRequest
SmProcessCreateRequest
SmProcessQueryStoreStats
SmProcessStoreMemoryPriorityRequest
SmQueryStoreCommitUsage
SmQuerySystemInformation
SmStoreCreate
SmStorePhysicalRequestIssue
SmcProcessCreateRequest
SmcProcessListRequest
SmcProcessStatsRequest
SmpDirtyStoreCreate
SshSessionManagerTraceCsEnterReason
SshSessionManagerTraceCsExitReason
SshSessionManagerTraceDirtyTransition
SshSessionManagerTracePostSleepNotification
SshSessionManagerTracePreSleepNotification
SshSessionManagerTraceShutdownAction
SshSessionManagerTraceSystemStop
SshpAlpcInitialize
SshpAlpcProcessAlpcMessage
SshpAlpcSendMessage
SshpFlushBlockerDataCache
SshpGenerateDeviceFriendlyName
SshpSendSessionData
SshpSessionManagerFlushControlEventBuffer
SshpWnfCallback
SshpWriteBlocker
StEtaHelper::StartHelper
SymCryptDetectCpuFeaturesByCpuid
SymCryptEcpointMultiScalarMulWnafWithInterleaving
SymCryptEcpointScalarMulFixedWindow
SymCryptInitEnvWindowsKernelmodeWin8_1nLater
SymCryptParallelSha256Append
SymCryptParallelSha256Process
SymCryptRsaCoreEnc
SymCryptRsakeyCalculatePrivateFields
SymCryptSha256
SymCryptSha384Result
SymCryptSha512AppendBlocks_ull
SymCryptShortWeierstrassAddDiffNonZero
SymCryptShortWeierstrassAddSideChannelUnsafe
SymCryptShortWeierstrassDouble
SymCryptShortWeierstrassIsEqual
SymCryptTwistedEdwardsAdd
SymCryptTwistedEdwardsDouble
SymCryptTwistedEdwardsOnCurve
TraceLoggingRegisterEx_EtwRegister_EtwSetInformation
TtmiLogCalloutStart
TtmiLogCalloutStop
TtmiLogCalloutWatchdogCrashSkipped
TtmiLogCleanupCurrentSessionStart
TtmiLogCleanupCurrentSessionStop
TtmiLogConsoleUserPresent
TtmiLogDeviceArrivalNotified
TtmiLogDeviceArrivedTerminalEvent
TtmiLogDeviceAssignedTerminalEvent
TtmiLogDeviceDepartedTerminalEvent
TtmiLogDeviceDepartureNotified
TtmiLogDeviceEnumeratedTerminalEvent
TtmiLogDeviceFromTerminalRemoved
TtmiLogDeviceInputNotified
TtmiLogDeviceRundown
TtmiLogDeviceSetInputWakeCapability
TtmiLogDeviceToTerminalAssigned
TtmiLogDispatchApiStart
TtmiLogDispatchApiStop
TtmiLogDisplayPowerRequestSet
TtmiLogEnterProximity
TtmiLogError
TtmiLogExitProximity
TtmiLogInactivityTimerReset
TtmiLogInactivityTimoutUpdate
TtmiLogInitCurrentSessionStart
TtmiLogInitCurrentSessionStop
TtmiLogInitiateModernStandbyTransitionStart
TtmiLogInitiateModernStandbyTransitionStop
TtmiLogProximityBlockedRequest
TtmiLogProximityPowerPress
TtmiLogQueueCreated
TtmiLogQueueDequeueEvent
TtmiLogQueueDestroyed
TtmiLogQueueEnqueueEvent
TtmiLogQueueHandleClosed
TtmiLogQueueHandleOpened
TtmiLogSessionActivate
TtmiLogSessionCsExitComplete
TtmiLogSessionDeactivate
TtmiLogSessionDeviceAssignmentPolicySet
TtmiLogSessionDisplayRequiredDereference
TtmiLogSessionDisplayRequiredPowerRequestUpdated
TtmiLogSessionDisplayRequiredReference
TtmiLogSessionMonitorControl
TtmiLogSessionPowerControlStart
TtmiLogSessionPowerControlStop
TtmiLogSessionPowerRequestAcknowledged
TtmiLogSessionPowerRequestCreated
TtmiLogSessionPowerRequestDeleted
TtmiLogSessionPowerStateChange
TtmiLogSessionRundown
TtmiLogSessionWorkerPass
TtmiLogSessionWorkerStart
TtmiLogSessionWorkerStop
TtmiLogTerminalCleanup
TtmiLogTerminalCreated
TtmiLogTerminalDestroyed
TtmiLogTerminalDisplayStateChangedEvent
TtmiLogTerminalDisplayTimeouts
TtmiLogTerminalHandleClosed
TtmiLogTerminalHandleOpened
TtmiLogTerminalOffRequest
TtmiLogTerminalOnRequest
TtmiLogTerminalRundown
TtmiLogTerminalStateMachine
TtmpCommitTerminalDisplayStateUpdateWorker
TtmpGetConfigOverride
TtmpSessionWorker
UpcaseUnicodeToUTF8NHelper
ValidFilter
VerifierNtCreateFile
VerifierNtReadFile
VerifierNtWriteFile
VfCheckImageCompliance
VfCheckUserHandle
VfDeadlockAcquireResource
VfDeadlockInitializeResource
VfDeadlockPluginEntry
VfDeadlockReleaseResource
VfDmaPluginEntry
VfErrorReport7
VfErrorReport8
VfIoDeleteDevice
VfIoDetachDevice
VfIovPluginEntry
VfIrpLogRecordEvent
VfIrqlPluginEntry
VfIsPCIBus
VfLwSPEntry
VfMiscPluginEntry
VfPoolTrackingEntry
VfSecurityEntry
VfSpecialPoolEntry
VfThunkApplyPristineToAllSession
VfThunkApplyWdmThunkToAllSession
VfUtilPrintCheckinString
VhdAutoAttachVirtualDisks
VhdiAutoAttachOneVhd
VhdiGetVolumeNumber
VhdiInitializeBootDisk
VhdiMountVhdFile
ViErrorReport1
ViErrorReport10
ViErrorReport4
ViErrorReport6
ViGenericVerifyIrpStackDownward
ViGenericVerifyNewIrp
ViIsBTSSupported
ViPtLogStackCallout
ViSetupBTSPerProcNoEnable
VmAccessFault
VmpAccessFaultBatchResolve
VmpLogAccessFault
VmpLogAccessFaultRange
VmpLogColdHint
VmpLogLargeSlatFill
VmpLogSparseSlatFill
VmpLogTbFlushSlatInvalidate
VmpPinMemoryRange
VmpPrefetchWorker
VmpProcessAccessedBatch
VmpProcessUpdateSlat
VmpQueryAccessedState
VrpIoctlDeviceDispatch
VrpPostEnumerateKey
VrpPostOpenOrCreate
VrpPostQueryKey
VrpPostUnloadKey
VrpPreFlushKey
VrpPreLoadKey
VrpPreOpenOrCreate
VrpPreQueryKeyName
VrpRegistryCallback
VrpRegistryUnload
VslAbortLiveDump
VslAccessPciDevice
VslAllocateKernelShadowStack
VslAllocateSecureHibernateResources
VslApplyDynamicRelocations
VslApplyHotPatch
VslApplySecureImageFixups
VslBindNtIum
VslCallEnclave
VslCaptureSecureImageIat
VslCloseSecureHandle
VslCollectLiveDumpInSk
VslCompleteSecureDriverLoad
VslConfigureDynamicMemory
VslConfigureSecureAtsDevice
VslConnectSwInterrupt
VslCreateEnclave
VslCreateSecureAllocation
VslCreateSecureImageSection
VslCreateSecureProcess
VslCreateSecureSection
VslCreateSecureThread
VslDebugProtectSecureProcessMemory
VslDebugReadWriteSecureProcess
VslDeleteSecureSection
VslDetermineHotPatchType
VslDetermineHotPatchUndoTableSize
VslEnableKernelCfgTarget
VslEnableOnDemandDebugWithResponse
VslEndSecurePageIteration
VslExchangeEntropy
VslFastFlushSecureRangeList
VslFillSecureAllocation
VslFinalizeLiveDumpInSk
VslFinalizeSecureImageHash
VslFinishSecureImageValidation
VslFinishStartSecureProcessor
VslFlushSecureAddressSpace
VslFreeKernelShadowStack
VslFreeSecureHibernateResources
VslFreeSecureImageIat
VslGetEtwDebugId
VslGetNestedPageProtectionFlags
VslGetOnDemandDebugChallenge
VslGetSecurePageList
VslGetSecurePciDeviceAlternateFunctionNumberForVtl0Dma
VslGetSecurePciDeviceBootConfiguration
VslGetSecurePciEnabled
VslGetSecurePebAddress
VslGetSecureSpeculationControlInformation
VslGetSecureTebAddress
VslGetSetSecureContext
VslHandleKsrCall
VslInitFunctionOverrideCapabilities
VslInitializeEnclave
VslInitializeSecureKernelCfg
VslInitializeSecurePool
VslInitializeSecureProcess
VslIsEncryptionKeyAvailable
VslIsTrustletRunning
VslIumEfiRuntimeService
VslIumEtwEnableCallback
VslKernelShadowStackAssist
VslLiveDumpQuerySecondaryDataSize
VslLoadEnclaveData
VslLoadEnclaveModule
VslMakeCodeCatalog
VslMakeProtectedPageExecutable
VslMakeProtectedPageWritable
VslNotifyShutdown
VslObtainHotPatchUndoTable
VslPrepareDriverForPatch
VslPrepareSecureImageRelocations
VslProvisionDumpEncryption
VslPublishSyscallProviderServiceTables
VslQuerySecureDevice
VslQuerySecureKernelProfileInformation
VslQueryVirtualMemory
VslReapplyBootIndirectPatches
VslReapplyImportOptimizationForDriverVerifier
VslRegisterBootDrivers
VslRegisterLogPages
VslRegisterSecureSystemDlls
VslRegisterSecureSystemProcess
VslRegisterSyscallProviderServiceTableMetadata
VslRelaxQuotas
VslRelocateImage
VslReportBugCheckProgress
VslReserveProtectedPages
VslResetKernelShadowStack
VslRetrieveMailbox
VslRevertHotPatch
VslRundownSecureProcess
VslSecurePoolAllocate
VslSecurePoolFree
VslSecurePoolUpdate
VslSendDebugAttachNotifications
VslSetCodeIntegrityPolicy
VslSetPlaceholderPages
VslSetupLiveDumpBufferInSk
VslSlowFlushSecureRangeList
VslStartSecurePageIteration
VslStartSecureProcessor
VslSvcEnterIumSecureMode
VslTerminateSecureThread
VslTransferSecureImageVersionResource
VslTransformDumpKey
VslUpdateFreezeTimeBias
VslValidateDynamicCodePages
VslValidateSecureImagePages
VslVerifyPage
VslVerifySessionSpace
VslpAddLiveDumpBufferChunk
VslpConnectedStandbyPoCallback
VslpConnectedStandbyWnfCallback
VslpEnterIumSecureMode
VslpIumInitializeTelemetry
VslpIumPhase0Initialize
VslpIumPhase4Initialize
VslpKsrEnterIumSecureMode
VslpLiveDumpStart
VslpSetupLiveDumpBuffer
VslpVerifySessionSpace
WarbirdCrypto::CCipherFeistel64::CallRoundFunction
WbAddWarbirdEncryptionSegment
WbGetInitializedEncryptionSegment
WbHeapExecuteCall
WdiDispatchControl
WdipAccessCheck
WdipSemLoadLocalGroupPolicy
WdipSemLoadNextContextProvider
WdipSemLoadNextEndEvent
WdipSemLoadNextScenario
WdipSemLoadScenarioTable
WdipSemQueryValueFromRegistry
WdipSemSqmAddToStream
WdipSemSqmIncrementDword
WdipSemSqmInit
WdipSemSqmLogInflightLimitExceededDataPoints
WdipSemWriteInflightLimitExceededEvent
WdipSemWriteMisconfigEvent
WdipSemWriteProviderLimitExceededEvent
WdipSemWriteScenarioLimitExceededEvent
WdipSemWriteSemActionsEvent
WdipSemWriteSemFailureEvent
WdipSemWriteTimeoutEvent
WheaAddErrorSource
WheaLogInternalEvent
WheaPersistBadPageToRegistry
WheaRemoveErrorSource
WheaRemoveErrorSourceDeviceDriver
WheaReportHwError
WheaSelLogErrorPkt
WheapAddToDefectListInPlugin
WheapAttemptPhysicalPageOffline
WheapClearPoison
WheapCreateRecordFromGenericErrorData
WheapExecuteRowFailureCheck
WheapGenerateETWErrorRecord
WheapGenerateETWErrorRecordLarge
WheapInitErrorReportDeviceDriver
WheapLogAddToDefectListFail
WheapLogInitEvent
WheapLogPageOfflineAttemptEvent
WheapLogPolicyTelemetry
WheapLogProcessTerminateEvent
WheapPfaLogPageMonitorRemoval
WheapProcessOfflineList
WheapReverseAddressTranslateToPAInPlugin
WheapTrackPendingPage
WheapTranslateAddressInPlugin
WheapWmiExecuteErrorSourceMethod
WmipCreateGuidObject
WmipDisableCollectionForRemovedGuid
WmipEnableCollectionForNewGuid
WmipGetGuidSecurityDescriptor
WmipIncludeStaticNames
WmipInitializeDataStructs
WmipInsertStaticNames
WmipIoControl
WmipOpenGuidObject
WmipPrepareWnodeSI
WmipProcessLegacyEtwCallback
WmipQueryAllData
WmipQueryAllDataMultiple
WmipQuerySetExecuteSI
WmipQuerySingleMultiple
WmipQueryWmiDataBlock
WmipReceiveNotifications
WmipSecurityMethod
WmipSendEnableDisableRequest
Xp10BuildAndWriteHuffmanTables
Xp10Compute2Crc32
Xp10Compute2Crc64
_CmAddDeviceToContainer
_CmAddPanelDevice
_CmBuildDevicePanelId
_CmClassFilterCallback
_CmCreateDevice
_CmCreateDeviceContainer
_CmCreateDeviceInterface
_CmCreateDeviceInterfaceWorker
_CmCreateDevicePanel
_CmCreateInstallerClass
_CmCreateInterfaceClass
_CmDeleteCommonClassRegKey
_CmDeleteDevice
_CmDeleteDeviceContainer
_CmDeleteDeviceContainerRegKey
_CmDeleteDeviceInterface
_CmDeleteDeviceInterfaceRegKey
_CmDeleteDeviceInterfaceWorker
_CmDeleteDevicePanel
_CmDeleteDevicePanelRegKey
_CmDeleteDeviceRegKey
_CmDeleteDeviceRegKeyWorker
_CmDeleteDeviceWorker
_CmDeleteInstallerClass
_CmDeleteInstallerClassWorker
_CmDeleteInterfaceClass
_CmDeleteInterfaceClassWorker
_CmDevicePanelEnumSubkeyCallback
_CmEnumDevicesInContainerWithCallback
_CmGetDeviceChildren
_CmGetDeviceContainerIdFromBase
_CmGetDeviceInterfaceClassGuid
_CmGetDeviceInterfaceRegKeyPath
_CmGetDeviceInterfaceSubkeyPath
_CmGetDeviceMappedPropertyFromComposite
_CmGetDeviceMappedPropertyFromRegProp
_CmGetDeviceParent
_CmGetDeviceRegProp
_CmGetDeviceRegPropWorker
_CmGetDeviceSiblings
_CmGetDeviceSoftwareKey
_CmGetDeviceSoftwareKeyPath
_CmGetInstallerClassMappedPropertyFromRegValue
_CmGetInstallerClassRegProp
_CmGetMatchingCommonClassList
_CmGetMatchingDeviceContainerList
_CmGetMatchingDeviceInterfaceList
_CmGetMatchingDeviceList
_CmGetMatchingDevicePanelList
_CmGetMatchingFilteredDeviceInterfaceList
_CmGetMatchingFilteredDeviceList
_CmGetRegKeySecurityDescriptor
_CmIsDeviceSafeRemovalRequired
_CmIsLocalMachineContainer
_CmMatchLastKnownParentCallback
_CmOpenCommonClassRegKey
_CmOpenDeviceContainerRegKey
_CmOpenDeviceInterfaceRegKey
_CmOpenDevicePanelRegKey
_CmRemoveDeviceFromContainer
_CmRemovePanelDevice
_CmServiceFilterCallback
_CmSetDeviceMappedPropertyFromDriverKeyRegValue
_CmSetDeviceMappedPropertyFromRegProp
_CmSetDeviceRegProp
_CmSetInstallerClassRegProp
_CmSplitDevicePanelId
_CmUpdateDevicePanel
_CmUpdateDevicePanelInterface
_CmValidateDeviceInterfaceName
_CmValidateDevicePanelName
_PnpDeletePropertyWorker
_PnpDeviceRaisePropertyChangeEventWorker
_PnpGetEnumSecurityDescriptor
_PnpGetGenericStoreProperty
_PnpGetGenericStorePropertyKeys
_PnpGetGenericStorePropertyLocales
_PnpGetPropertiesSecurityDescriptor
_PnpIsValidGuidString
_PnpOpenPropertiesKey
_PnpSetPropertyWorker
_RegRtlCopyTreeInternal
_RegRtlEnumKey
_RegRtlEnumKeyWithCallback
_RegRtlQueryInfoKey
_RegRtlQueryValue
_RtlpMuiRegAddBaseLanguage
_RtlpMuiRegInitLIPLanguage
_RtlpMuiRegLoadInstalledFromKey
_RtlpMuiRegPopulateBaseLanguages
_RtlpMuiRegValidateInstalled
_RtlpRemovePendingDeleteLanguages
_SysCtxOpenControlSet
_SysCtxOpenMachine
_SysCtxRegOpenCurrentUserKey
__GSHandlerCheckCommon
_handle_error
_handle_errorf
_output_l
_output_s
_tlgWriteTemplate<long___cdecl(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),&long___cdecl__tlgWriteTransfer_EtwWriteTransfer(struct__tlgProvider_t_const*___ptr64,void_const*___ptr64,struct__GUID_const*___ptr64,struct__GUID_const*___ptr64,unsigned_int,struct__EVENT_DATA_DESCRIPTOR*___ptr64),struct__GUID_const*___ptr64,struct__GUID_const*__ptr64>::Write<struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>,struct__tlgWrapperByRef<16>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<8>,struct__tlgWrapperByVal<1>,struct__tlgWrapperBinary,struct__tlgWrapperByVal<4>,struct__tlgWrapperByVal<1>>
_woutput_l
_woutput_s
pIoQueryBusDescription
pIoQueryDeviceDescription
qsort
qsort_s
strspn
strtok_s
vDbgPrintExWithPrefixInternal
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToServiceDirect
paramcount 1 1
address 1403d0920 1403d0910
sig void __cdecl __security_check_cookie(uintptr_t _StackCookie) void __cdecl __security_check_cookie(uintptr_t _StackCookie)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

__security_check_cookie Calling Diff

--- __security_check_cookie calling
+++ __security_check_cookie calling
@@ -766,5 +766,5 @@
-FUN_140709bb0
-FUN_140768f34
-FUN_14084356c
-FUN_140a4b524
-FUN_140a4e0ec
+FUN_14070a710
+FUN_140769944
+FUN_140843f7c
+FUN_140a4b4b4
+FUN_140a4e07c
@@ -3834,0 +3835 @@
+wil_details_FeatureReporting_ReportUsageToServiceDirect

HvpGetCellContextReinitialize

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 1.0
i_ratio 1.0
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name HvpGetCellContextReinitialize HvpGetCellContextReinitialize
fullname HvpGetCellContextReinitialize HvpGetCellContextReinitialize
refcount 115 113
length 26 26
called HvpGetBinContextInitialize HvpGetBinContextInitialize
calling
Expand for full list:
CmDeleteKey
CmDeleteLayeredKey
CmDeleteValueKey
CmEnumerateKey
CmEnumerateValueKey
CmQueryMultipleValueForLayeredKey
CmQueryValueKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmSetValueKey
CmpAddSubKeyExCmpAddSubKeyToList
CmpAddToLeaf
CmpAddValueKeyNew
CmpAddValueKeyTombstone
CmpAddValueToListEx
CmpAssignKeySecurity
CmpCheckAndFixSecurityCellsRefcount
CmpCheckKeyNodeStackAccess
CmpCheckLeaf
CmpCheckRegistry2
CmpCheckSecurityCellAccess
CmpCheckValueList
CmpCloneKCBValueListForTrans
CmpCommitAddKeyUoW
CmpCommitDeleteKeyUoW
CmpConcatenateValueLists
CmpConstructNameFromKeyNodes
CmpCopyCell
CmpCopyMergeOfLayeredKeyNode
CmpCopyValue
CmpCreateChild
CmpCreateHiveRootCell
CmpCreateKeyControlBlock
CmpCreateRootNode
CmpCreateTombstone
CmpDereferenceSecurityNode
CmpDoBuildVirtualStack
CmpDoParseKey
CmpEnumerateLayeredKey
CmpFindNameInListCellWithStatus
CmpFindNameInListFromIndex
CmpFindNameInListWithStatus
CmpFreeKeyValueList
CmpFullPromoteSingleKeyFromKeyNodeStacks
CmpGetSecurityDescriptorNode
CmpGetSymbolicLinkTarget
CmpGetValueForAudit
CmpInitializeKeyNodeStack
CmpKeyEnumStackAdvanceInternal
CmpKeyEnumStackEntryInitialize
CmpKeyEnumStackNotifyPromotion
CmpLightWeightDuplicateParentLists
CmpLoadHiveVolatile
CmpMarkAllChildrenDirty
CmpMarkEntireIndexDirty
CmpMarkIndexDirty
CmpMarkIndexDirtyInStorageType
CmpQueryKeyDataFromKeyNodeStack
CmpQueryKeyDataFromNode
CmpRefreshHive
CmpResetKeyNodeStack
CmpSetKeySecurity
CmpSortedValueEnumStackEntryStart
CmpStartKeyNodeStack
CmpSyncKeyValues
CmpUpdateHiveRootCellFlags
CmpVEExecuteOpenLogic
CmpVEExecuteRealStoreParseLogic
CmpValidateHiveSecurityDescriptors
CmpValueEnumStackAdvance
CmpValueEnumStackEntryInitialize
CmpWalkOneLevel
HvDuplicateCell
HvIsCellAllocated
HvReallocateCell
HvpDoAllocateCell
HvpReleaseCellPaged
Expand for full list:
CmDeleteKey
CmDeleteLayeredKey
CmDeleteValueKey
CmEnumerateKey
CmEnumerateValueKey
CmQueryMultipleValueForLayeredKey
CmQueryValueKey
CmSetKeyFlags
CmSetLastWriteTimeKey
CmpAddSubKeyEx
CmpAddSubKeyToListCmpAddToLeaf
CmpAddValueKeyNew
CmpAddValueKeyTombstone
CmpAddValueToListEx
CmpAssignKeySecurity
CmpCheckAndFixSecurityCellsRefcount
CmpCheckKeyNodeStackAccess
CmpCheckLeaf
CmpCheckRegistry2
CmpCheckSecurityCellAccess
CmpCheckValueList
CmpCloneKCBValueListForTrans
CmpCommitAddKeyUoW
CmpCommitDeleteKeyUoW
CmpConcatenateValueLists
CmpConstructNameFromKeyNodes
CmpCopyCell
CmpCopyMergeOfLayeredKeyNode
CmpCopyValue
CmpCreateChild
CmpCreateHiveRootCell
CmpCreateKeyControlBlock
CmpCreateRootNode
CmpCreateTombstone
CmpDereferenceSecurityNode
CmpDoBuildVirtualStack
CmpDoParseKey
CmpEnumerateLayeredKey
CmpFindNameInListCellWithStatus
CmpFindNameInListFromIndex
CmpFindNameInListWithStatus
CmpFreeKeyValueList
CmpFullPromoteSingleKeyFromKeyNodeStacks
CmpGetSecurityDescriptorNode
CmpGetSymbolicLinkTarget
CmpGetValueForAudit
CmpInitializeKeyNodeStack
CmpKeyEnumStackAdvanceInternal
CmpKeyEnumStackEntryInitialize
CmpKeyEnumStackNotifyPromotion
CmpLightWeightDuplicateParentLists
CmpLoadHiveVolatile
CmpMarkAllChildrenDirty
CmpMarkEntireIndexDirty
CmpMarkIndexDirty
CmpMarkIndexDirtyInStorageType
CmpQueryKeyDataFromKeyNodeStack
CmpQueryKeyDataFromNode
CmpRefreshHive
CmpResetKeyNodeStack
CmpSetKeySecurity
CmpSortedValueEnumStackEntryStart
CmpStartKeyNodeStack
CmpSyncKeyValues
CmpUpdateHiveRootCellFlags
CmpVEExecuteOpenLogic
CmpVEExecuteRealStoreParseLogic
CmpValidateHiveSecurityDescriptors
CmpValueEnumStackAdvance
CmpValueEnumStackEntryInitialize
CmpWalkOneLevel
HvDuplicateCell
HvIsCellAllocated
HvReallocateCell
HvpDoAllocateCell
HvpReleaseCellPaged
paramcount 0 0
address 1407c4aec 1407c54fc
sig undefined HvpGetCellContextReinitialize(void) undefined HvpGetCellContextReinitialize(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

HvpGetCellContextReinitialize Calling Diff

--- HvpGetCellContextReinitialize calling
+++ HvpGetCellContextReinitialize calling
@@ -10 +9,0 @@
-CmSetValueKey

CmpSnapshotTxOwnerArray

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address
ratio 1.0
i_ratio 0.83
m_ratio 1.0
b_ratio 1.0
match_types SymbolsHash

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name CmpSnapshotTxOwnerArray CmpSnapshotTxOwnerArray
fullname CmpSnapshotTxOwnerArray CmpSnapshotTxOwnerArray
refcount 10 9
length 273 273
called ExAllocatePool2
ObfReferenceObject		 ExAllocatePool2
ObfReferenceObject
calling CmDeleteKey
CmDeleteValueKey
CmSetValueKey
CmpCreateChild
CmpSetKeySecurity		 CmDeleteKey
CmDeleteValueKey
CmSetValueKey
CmpCreateChild
CmpSetKeySecurity
paramcount 0 0
address 140a21974 140a21904
sig undefined CmpSnapshotTxOwnerArray(void) undefined CmpSnapshotTxOwnerArray(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

_guard_dispatch_icall

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling,called
ratio 0.9
i_ratio 0.66
m_ratio 1.0
b_ratio 1.0
match_types ExactInstructionsFunctionHasher

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name _guard_dispatch_icall _guard_dispatch_icall
fullname _guard_dispatch_icall _guard_dispatch_icall
refcount 4525 4529
length 141 141
called FUN_14041d490
__guard_retpoline_exit_indirect_rax
_guard_icall_bugcheck		 FUN_14041d560
__guard_retpoline_exit_indirect_rax
_guard_icall_bugcheck
calling
Expand for full list:
AlpcpAllocateBlob
AlpcpDeleteBlob
AlpcpDestroyBlob
AlpcpInvokeLogCallbacks
AlpcpUnlockBlob
Amd64OverflowHandler
AnFwDisplayBackgroundUpdate
AnFwpBackgroundUpdateTimer
ArbAllocateEntry
ArbArbiterHandler
ArbBootAllocationArbBuildAssignmentOrdering
ArbFindSuitableRange
ArbInitializeRangeList
ArbQueryConflict
ArbRetestAllocation
ArbStartArbiter
ArbTestAllocation
ArbpBuildAlternative
AslLogCallPrintf
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDecrypt
BCryptDestroyHash
BCryptDestroyKey
BCryptEncrypt
BCryptFinishHash
BCryptGenRandom
BCryptGenerateSymmetricKey
BCryptGetProperty
BCryptHashData
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSetProperty
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeWalkPostOrderInternal
BapdRecordFirmwareBootStats
BapdpKsrCancelScenario
BapdpKsrCompleteScenario
BapdpKsrCompleteScenarioPhase0
BapdpKsrInitiateScenarioPhase0
BapdpKsrpInitiateScenario
BcpDisplayEarlyBugCheckScreen
BgkAcquireDisplayOwnership
BgkDisplayCharacter
BgkDisplayStringEx
BgkGetConsoleState
BgkGetCursorState
BgkInitialize
BgkNotifyDisplayOwnershipChange
BgkSetCursor
BgkSetTextColor
BgkSolidColorFill
BgkpResetDisplay
BvgaAcquireDisplayOwnership
CarLiveDumpCallBack
CcAcquireByteRangeForWrite
CcAllocateWorkQueueEntry
CcCompleteAsyncRead
CcCompleteAsyncRead$fin$1
CcDeferWrite
CcForEachNumaNode
CcForEachPartition
CcForEachPrivateVolumeCacheMap
CcFreeWorkQueueEntry
CcGetDirtyPagesHelper
CcMdlReadComplete
CcMdlWriteComplete
CcNotifyExternalCachesInternal
CcPerformReadAhead
CcPerformReadAhead$fin$1
CcPostDeferredWrites
CcRegistryChangeCallback
CcScanLogHandleList
CcSetDirtyInMask
CcUnmapInactiveViewsInternal
CcWriteBehindPreProcess
CcWriteBehindReleaseFile
CmCheckRegistry
CmFcpChangeSubscriptionWrapper
CmKtmNotification
CmOpenKey
CmSetAcpiHwProfile
CmUnRegisterCallback
CmpAcceptBoot
CmpAddDriverToList
CmpAddSecurityCellToCache
CmpAddSubKeyToList
CmpAdjustSecurityCacheSize
CmpCallCallBacksEx
CmpCheckRegistry2
CmpCleanupPathInfo
CmpCloseKeyObject
CmpCreateKeyBody
CmpDestroySecurityCache
CmpDoParseKey
CmpEnableLazyFlushDpcRoutine$fin$1
CmpEnumerateAllHigherLayerKcbs
CmpEnumerateKcbCacheBucket
CmpEtwDumpKcb
CmpExpandPathInfo
CmpFireCleanupNotifications
CmpFreeDriverList
CmpFreeExtraParameter
CmpGetNodeName
CmpGetSymbolicLinkTarget
CmpIsLoadType
CmpLazyFlushDpcRoutine$filt$1
CmpLazyWriteWorker
CmpMachineHiveLoadedWorkItem
CmpRemoveFromSecurityCache
CmpReplicateKeyToVirtual
CmpSearchKeyControlBlockTreeEx
CmpSecurityMethod
CmpSystemHiveHysteresisWorker
CmpWorkItemWrapper
DbgkCaptureLiveDump
DbgkpLkmdEnumApcOrDpcDataCallback
DbgkpLkmdFireCallbacks
DbgkpLkmdIsMemoryBlockPresentFromCallback
DbgkpLkmdSnapData
DbgkpLkmdSnapDataEx
DbgkpLkmdSnapGlobals
DbgkpLkmdSnapKernelStack
DbgkpLkmdSnapKernelStackSegmentCallback
DbgkpLkmdSnapObject
DbgkpWerInvokeCallbacks
DefaultOverflowHandler
DifAddDeviceWrapper
DifCcCopyWriteExWrapper
DifCcCopyWriteWrapper
DifCcDeferWriteWrapper
DifCcFastCopyWriteWrapper
DifCmRegisterCallbackExWrapper
DifCmRegisterCallbackWrapper
DifCmUnRegisterCallbackWrapper
DifDeregisterPlugin
DifDriverCancelWrapper
DifDriverEntryWrapper
DifDriverStartIoWrapper
DifDriverUnloadWrapper
DifEtwRegisterWrapper
DifEtwUnregisterWrapper
DifExAcquireFastMutexUnsafeWrapper
DifExAcquireFastMutexWrapper
DifExAcquireResourceExclusiveLiteWrapper
DifExAcquireResourceSharedLiteWrapper
DifExAcquireSharedStarveExclusiveWrapper
DifExAcquireSharedWaitForExclusiveWrapper
DifExAllocatePool2Wrapper
DifExAllocatePool3Wrapper
DifExAllocatePoolWithQuotaTagWrapper
DifExAllocatePoolWithQuotaWrapper
DifExAllocatePoolWithTagPriorityWrapper
DifExAllocatePoolWithTagWrapper
DifExAllocatePoolWrapper
DifExConvertExclusiveToSharedLiteWrapper
DifExCreateCallbackWrapper
DifExDeleteLookasideListExWrapper
DifExDeleteNPagedLookasideListWrapper
DifExDeletePagedLookasideListWrapper
DifExDeleteResourceLiteWrapper
DifExEnterCriticalRegionAndAcquireResourceExclusiveWrapper
DifExEnterCriticalRegionAndAcquireResourceSharedWrapper
DifExEnterCriticalRegionAndAcquireSharedWaitForExclusiveWrapper
DifExEnterPriorityRegionAndAcquireResourceExclusiveWrapper
DifExEnterPriorityRegionAndAcquireResourceSharedWrapper
DifExFreePoolWithTagWrapper
DifExFreePoolWrapper
DifExInitializeLookasideListExWrapper
DifExInitializeNPagedLookasideListWrapper
DifExInitializePagedLookasideListWrapper
DifExInitializeResourceLiteWrapper
DifExIsProcessorFeaturePresentWrapper
DifExRaiseAccessViolationWrapper
DifExRaiseDatatypeMisalignmentWrapper
DifExRaiseStatusWrapper
DifExRegisterCallbackWrapper
DifExReleaseFastMutexUnsafeWrapper
DifExReleaseFastMutexWrapper
DifExReleaseResourceAndLeaveCriticalRegionWrapper
DifExReleaseResourceAndLeavePriorityRegionWrapper
DifExReleaseResourceForThreadLiteWrapper
DifExReleaseResourceLiteWrapper
DifExSetTimerResolutionWrapper
DifExTryToAcquireFastMutexWrapper
DifExUnregisterCallbackWrapper
DifExUuidCreateWrapper
DifExfAcquirePushLockExclusiveWrapper
DifExfAcquirePushLockSharedWrapper
DifExfReleasePushLockSharedWrapper
DifExfReleasePushLockWrapper
DifExfTryAcquirePushLockSharedWrapper
DifExfTryToWakePushLockWrapper
DifHalAllocateCrashDumpRegistersWrapper
DifHalDmaAllocateCrashDumpRegistersExWrapper
DifHalDmaFreeCrashDumpRegistersExWrapper
DifIRP_MJ_CLEANUPWrapper
DifIRP_MJ_CLOSEWrapper
DifIRP_MJ_CREATEWrapper
DifIRP_MJ_CREATE_MAILSLOTWrapper
DifIRP_MJ_CREATE_NAMED_PIPEWrapper
DifIRP_MJ_DEVICE_CHANGEWrapper
DifIRP_MJ_DEVICE_CONTROLWrapper
DifIRP_MJ_DIRECTORY_CONTROLWrapper
DifIRP_MJ_FILE_SYSTEM_CONTROLWrapper
DifIRP_MJ_FLUSH_BUFFERSWrapper
DifIRP_MJ_INTERNAL_DEVICE_CONTROLWrapper
DifIRP_MJ_LOCK_CONTROLWrapper
DifIRP_MJ_PNPWrapper
DifIRP_MJ_POWERWrapper
DifIRP_MJ_QUERY_EAWrapper
DifIRP_MJ_QUERY_INFORMATIONWrapper
DifIRP_MJ_QUERY_QUOTAWrapper
DifIRP_MJ_QUERY_SECURITYWrapper
DifIRP_MJ_QUERY_VOLUME_INFORMATIONWrapper
DifIRP_MJ_READWrapper
DifIRP_MJ_SET_EAWrapper
DifIRP_MJ_SET_INFORMATIONWrapper
DifIRP_MJ_SET_QUOTAWrapper
DifIRP_MJ_SET_SECURITYWrapper
DifIRP_MJ_SET_VOLUME_INFORMATIONWrapper
DifIRP_MJ_SHUTDOWNWrapper
DifIRP_MJ_SYSTEM_CONTROLWrapper
DifIRP_MJ_WRITEWrapper
DifIoAcquireRemoveLockExWrapper
DifIoAllocateControllerWrapper
DifIoAllocateIrpExWrapper
DifIoAllocateIrpWrapper
DifIoAllocateMdlWrapper
DifIoAllocateWorkItemWrapper
DifIoAttachDeviceWrapper
DifIoBuildAsynchronousFsdRequestWrapper
DifIoBuildDeviceIoControlRequestWrapper
DifIoBuildSynchronousFsdRequestWrapper
DifIoCheckShareAccessWrapper
DifIoConnectInterruptExWrapper
DifIoConnectInterruptWrapper
DifIoCreateControllerWrapper
DifIoCreateDeviceWrapper
DifIoCreateFileExWrapper
DifIoCreateFileSpecifyDeviceObjectHintWrapper
DifIoCreateFileWrapper
DifIoCreateNotificationEventWrapper
DifIoCreateSymbolicLinkWrapper
DifIoCreateSynchronizationEventWrapper
DifIoCreateUnprotectedSymbolicLinkWrapper
DifIoDeleteControllerWrapper
DifIoDeleteDeviceWrapper
DifIoDeleteSymbolicLinkWrapper
DifIoDetachDeviceWrapper
DifIoDisconnectInterruptExWrapper
DifIoDisconnectInterruptWrapper
DifIoFreeControllerWrapper
DifIoFreeIrpWrapper
DifIoFreeMdlWrapper
DifIoGetConfigurationInformationWrapper
DifIoGetDeviceDirectoryWrapper
DifIoGetDeviceObjectPointerWrapper
DifIoGetDeviceToVerifyWrapper
DifIoGetDmaAdapterWrapper
DifIoGetDriverDirectoryWrapper
DifIoGetFileObjectGenericMappingWrapper
DifIoGetInitialStackWrapper
DifIoInitializeRemoveLockExWrapper
DifIoInitializeTimerWrapper
DifIoInitializeWorkItemWrapper
DifIoIsWdmVersionAvailableWrapper
DifIoOpenDeviceInterfaceRegistryKeyWrapper
DifIoOpenDeviceRegistryKeyWrapper
DifIoOpenDriverRegistryKeyWrapper
DifIoRaiseHardErrorWrapper
DifIoRaiseInformationalHardErrorWrapper
DifIoReadPartitionTableWrapper
DifIoRegisterDeviceInterfaceWrapper
DifIoRegisterDriverReinitializationWrapper
DifIoRegisterShutdownNotificationWrapper
DifIoReleaseRemoveLockAndWaitExWrapper
DifIoReleaseRemoveLockExWrapper
DifIoRemoveShareAccessWrapper
DifIoSetCompletionRoutineExWrapper
DifIoSetDeviceInterfaceStateWrapper
DifIoSetDeviceToVerifyWrapper
DifIoSetPartitionInformationWrapper
DifIoSetShareAccessWrapper
DifIoStartNextPacketWrapper
DifIoUnregisterShutdownNotificationWrapper
DifIoUpdateShareAccessWrapper
DifIoWMIAllocateInstanceIdsWrapper
DifIoWMIRegistrationControlWrapper
DifIoWriteErrorLogEntryWrapper
DifIoWritePartitionTableWrapper
DifIofCallDriverWrapper
DifIofCompleteRequestWrapper
DifKeAcquireGuardedMutexUnsafeWrapper
DifKeAcquireGuardedMutexWrapper
DifKeAcquireInStackQueuedSpinLockAtDpcLevelWrapper
DifKeAcquireInStackQueuedSpinLockForDpcWrapper
DifKeAcquireInStackQueuedSpinLockRaiseToSynchWrapper
DifKeAcquireInStackQueuedSpinLockWrapper
DifKeAcquireQueuedSpinLockRaiseToSynchWrapper
DifKeAcquireQueuedSpinLockWrapper
DifKeAcquireSpinLockAtDpcLevelWrapper
DifKeAcquireSpinLockRaiseToDpcWrapper
DifKeCancelTimerWrapper
DifKeClearEventWrapper
DifKeDelayExecutionThreadWrapper
DifKeDeregisterNmiCallbackWrapper
DifKeEnterCriticalRegionWrapper
DifKeEnterGuardedRegionWrapper
DifKeInitializeDeviceQueueWrapper
DifKeInitializeEventWrapper
DifKeInitializeMutantWrapper
DifKeInitializeMutexWrapper
DifKeInitializeSemaphoreWrapper
DifKeInitializeTimerExWrapper
DifKeInitializeTimerWrapper
DifKeInsertByKeyDeviceQueueWrapper
DifKeInsertDeviceQueueWrapper
DifKeInsertQueueDpcWrapper
DifKeLeaveCriticalRegionWrapper
DifKeLeaveGuardedRegionWrapper
DifKeLowerIrqlWrapper
DifKePulseEventWrapper
DifKeRaiseIrqlToDpcLevelWrapper
DifKeReadStateEventWrapper
DifKeReadStateTimerWrapper
DifKeRegisterNmiCallbackWrapper
DifKeReleaseGuardedMutexUnsafeWrapper
DifKeReleaseGuardedMutexWrapper
DifKeReleaseInStackQueuedSpinLockForDpcWrapper
DifKeReleaseInStackQueuedSpinLockFromDpcLevelWrapper
DifKeReleaseInStackQueuedSpinLockWrapper
DifKeReleaseMutantWrapper
DifKeReleaseMutexWrapper
DifKeReleaseQueuedSpinLockWrapper
DifKeReleaseSpinLockFromDpcLevelWrapper
DifKeReleaseSpinLockWrapper
DifKeRemoveByKeyDeviceQueueWrapper
DifKeRemoveDeviceQueueWrapper
DifKeRemoveEntryDeviceQueueWrapper
DifKeRemoveQueueDpcWrapper
DifKeResetEventWrapper
DifKeRestoreExtendedProcessorStateWrapper
DifKeSaveExtendedProcessorStateWrapper
DifKeSetEventWrapper
DifKeSetTimerExWrapper
DifKeSetTimerWrapper
DifKeSynchronizeExecutionWrapper
DifKeTryToAcquireGuardedMutexWrapper
DifKeTryToAcquireQueuedSpinLockRaiseToSynchWrapper
DifKeTryToAcquireQueuedSpinLockWrapper
DifKeTryToAcquireSpinLockAtDpcLevelWrapper
DifKeWaitForMultipleObjectsWrapper
DifKeWaitForSingleObjectWrapper
DifKfRaiseIrqlWrapper
DifMmAllocateContiguousMemoryExWrapper
DifMmAllocateContiguousMemorySpecifyCacheWrapper
DifMmAllocateContiguousMemoryWrapper
DifMmAllocateNonCachedMemoryWrapper
DifMmAllocatePagesForMdlExWrapper
DifMmAllocatePagesForMdlWrapper
DifMmBuildMdlForNonPagedPoolWrapper
DifMmFreeContiguousMemoryWrapper
DifMmFreeNonCachedMemoryWrapper
DifMmFreePagesFromMdlWrapper
DifMmLockPagableDataSectionWrapper
DifMmLockPagableSectionByHandleWrapper
DifMmMapIoSpaceWrapper
DifMmMapLockedPagesSpecifyCacheWrapper
DifMmPageEntireDriverWrapper
DifMmResetDriverPagingWrapper
DifMmSecureVirtualMemoryWrapper
DifMmUnlockPagableImageSectionWrapper
DifMmUnmapLockedPagesWrapper
DifMmUnsecureVirtualMemoryWrapper
DifNtCreateFileWrapper
DifNtDeleteFileWrapper
DifNtOpenFileWrapper
DifNtSetInformationFileWrapper
DifNtWriteFileWrapper
DifObGetObjectSecurityWrapper
DifObReferenceObjectByHandleWrapper
DifObReferenceObjectByPointerWithTagWrapper
DifObReferenceObjectByPointerWrapper
DifObReleaseObjectSecurityWrapper
DifObfDereferenceObjectWithTagWrapper
DifObfDereferenceObjectWrapper
DifObfReferenceObjectWithTagWrapper
DifObfReferenceObjectWrapper
DifPoCallDriverWrapper
DifPoFxActivateComponentWrapper
DifPoFxCompleteDevicePowerNotRequiredWrapper
DifPoFxCompleteIdleConditionWrapper
DifPoFxCompleteIdleStateWrapper
DifPoFxIdleComponentWrapper
DifPoFxNotifySurprisePowerOnWrapper
DifPoFxPowerControlWrapper
DifPoFxRegisterDeviceWrapper
DifPoFxReportDevicePoweredOnWrapper
DifPoFxSetComponentLatencyWrapper
DifPoFxSetComponentResidencyWrapper
DifPoFxSetComponentWakeWrapper
DifPoFxSetDeviceIdleTimeoutWrapper
DifPoFxStartDevicePowerManagementWrapper
DifPoFxUnregisterDeviceWrapper
DifPoRequestPowerIrpWrapper
DifProbeForReadWrapper
DifProbeForWriteWrapper
DifPsCreateSystemThreadWrapper
DifPsGetVersionWrapper
DifPsSetCreateProcessNotifyRoutineWrapper
DifPsSetCreateThreadNotifyRoutineWrapper
DifPsSetLoadImageNotifyRoutineWrapper
DifPsTerminateSystemThreadWrapper
DifRtlAnsiStringToUnicodeStringWrapper
DifRtlCheckRegistryKeyWrapper
DifRtlCreateRegistryKeyWrapper
DifRtlCreateSystemVolumeInformationFolderWrapper
DifRtlCreateUnicodeStringWrapper
DifRtlDeleteRegistryValueWrapper
DifRtlDowncaseUnicodeStringWrapper
DifRtlDuplicateUnicodeStringWrapper
DifRtlOemStringToCountedUnicodeStringWrapper
DifRtlOemStringToUnicodeStringWrapper
DifRtlQueryRegistryValueWithFallbackWrapper
DifRtlQueryRegistryValuesExWrapper
DifRtlQueryRegistryValuesWrapper
DifRtlUnicodeStringToAnsiStringWrapper
DifRtlUnicodeStringToCountedOemStringWrapper
DifRtlUnicodeStringToOemStringWrapper
DifRtlUpcaseUnicodeStringToAnsiStringWrapper
DifRtlUpcaseUnicodeStringToCountedOemStringWrapper
DifRtlUpcaseUnicodeStringToOemStringWrapper
DifRtlUpcaseUnicodeStringWrapper
DifRtlWriteRegistryValueWrapper
DifZwAccessCheckAndAuditAlarmWrapper
DifZwAddBootEntryWrapper
DifZwAddDriverEntryWrapper
DifZwAdjustPrivilegesTokenWrapper
DifZwAllocateVirtualMemoryWrapper
DifZwAlpcAcceptConnectPortWrapper
DifZwAlpcConnectPortWrapper
DifZwAlpcCreatePortSectionWrapper
DifZwAlpcCreatePortWrapper
DifZwAlpcCreateResourceReserveWrapper
DifZwAlpcCreateSectionViewWrapper
DifZwAlpcCreateSecurityContextWrapper
DifZwAlpcQueryInformationWrapper
DifZwAlpcSendWaitReceivePortWrapper
DifZwAlpcSetInformationWrapper
DifZwCancelIoFileWrapper
DifZwCancelTimerWrapper
DifZwCloseObjectAuditAlarmWrapper
DifZwCloseWrapper
DifZwCommitEnlistmentWrapper
DifZwConnectPortWrapper
DifZwCreateDirectoryObjectWrapper
DifZwCreateEnlistmentWrapper
DifZwCreateEventWrapper
DifZwCreateFileWrapper
DifZwCreateJobObjectWrapper
DifZwCreateKeyTransactedWrapper
DifZwCreateKeyWrapper
DifZwCreateResourceManagerWrapper
DifZwCreateSectionWrapper
DifZwCreateSymbolicLinkObjectWrapper
DifZwCreateTimerWrapper
DifZwCreateTransactionManagerWrapper
DifZwCreateTransactionWrapper
DifZwDeleteBootEntryWrapper
DifZwDeleteFileWrapper
DifZwDeleteKeyWrapper
DifZwDeleteValueKeyWrapper
DifZwDeviceIoControlFileWrapper
DifZwDisplayStringWrapper
DifZwDuplicateObjectWrapper
DifZwDuplicateTokenWrapper
DifZwEnumerateBootEntriesWrapper
DifZwEnumerateDriverEntriesWrapper
DifZwEnumerateKeyWrapper
DifZwEnumerateValueKeyWrapper
DifZwFlushBuffersFileExWrapper
DifZwFlushBuffersFileWrapper
DifZwFlushInstructionCacheWrapper
DifZwFlushKeyWrapper
DifZwFlushVirtualMemoryWrapper
DifZwFreeVirtualMemoryWrapper
DifZwFsControlFileWrapper
DifZwGetNotificationResourceManagerWrapper
DifZwLoadDriverWrapper
DifZwLoadKeyWrapper
DifZwMapViewOfSectionWrapper
DifZwModifyBootEntryWrapper
DifZwModifyDriverEntryWrapper
DifZwNotifyChangeKeyWrapper
DifZwOpenDirectoryObjectWrapper
DifZwOpenEnlistmentWrapper
DifZwOpenEventWrapper
DifZwOpenFileWrapper
DifZwOpenJobObjectWrapper
DifZwOpenKeyExWrapper
DifZwOpenKeyTransactedExWrapper
DifZwOpenKeyTransactedWrapper
DifZwOpenKeyWrapper
DifZwOpenProcessTokenExWrapper
DifZwOpenProcessTokenWrapper
DifZwOpenProcessWrapper
DifZwOpenResourceManagerWrapper
DifZwOpenSectionWrapper
DifZwOpenSymbolicLinkObjectWrapper
DifZwOpenThreadTokenExWrapper
DifZwOpenThreadTokenWrapper
DifZwOpenThreadWrapper
DifZwOpenTimerWrapper
DifZwOpenTransactionManagerWrapper
DifZwOpenTransactionWrapper
DifZwPowerInformationWrapper
DifZwPrePrepareEnlistmentWrapper
DifZwPrepareCompleteWrapper
DifZwPrepareEnlistmentWrapper
DifZwProtectVirtualMemoryWrapper
DifZwPulseEventWrapper
DifZwQueryBootEntryOrderWrapper
DifZwQueryBootOptionsWrapper
DifZwQueryDefaultLocaleWrapper
DifZwQueryDefaultUILanguageWrapper
DifZwQueryDirectoryFileExWrapper
DifZwQueryDirectoryFileWrapper
DifZwQueryDirectoryObjectWrapper
DifZwQueryDriverEntryOrderWrapper
DifZwQueryEaFileWrapper
DifZwQueryFullAttributesFileWrapper
DifZwQueryInformationEnlistmentWrapper
DifZwQueryInformationFileWrapper
DifZwQueryInformationJobObjectWrapper
DifZwQueryInformationProcessWrapper
DifZwQueryInformationResourceManagerWrapper
DifZwQueryInformationThreadWrapper
DifZwQueryInformationTokenWrapper
DifZwQueryInformationTransactionManagerWrapper
DifZwQueryInformationTransactionWrapper
DifZwQueryInstallUILanguageWrapper
DifZwQueryKeyWrapper
DifZwQueryLicenseValueWrapper
DifZwQueryObjectWrapper
DifZwQuerySectionWrapper
DifZwQuerySecurityObjectWrapper
DifZwQuerySymbolicLinkObjectWrapper
DifZwQuerySystemInformationWrapper
DifZwQueryValueKeyWrapper
DifZwQueryVolumeInformationFileWrapper
DifZwReadFileWrapper
DifZwRemoveIoCompletionExWrapper
DifZwRenameKeyWrapper
DifZwReplaceKeyWrapper
DifZwRequestWaitReplyPortWrapper
DifZwResetEventWrapper
DifZwRestoreKeyWrapper
DifZwRollbackEnlistmentWrapper
DifZwSetBootEntryOrderWrapper
DifZwSetBootOptionsWrapper
DifZwSetDriverEntryOrderWrapper
DifZwSetEaFileWrapper
DifZwSetEventWrapper
DifZwSetInformationEnlistmentWrapper
DifZwSetInformationFileWrapper
DifZwSetInformationJobObjectWrapper
DifZwSetInformationKeyWrapper
DifZwSetInformationObjectWrapper
DifZwSetInformationProcessWrapper
DifZwSetInformationThreadWrapper
DifZwSetInformationTransactionWrapper
DifZwSetSecurityObjectWrapper
DifZwSetSystemInformationWrapper
DifZwSetSystemTimeWrapper
DifZwSetTimerWrapper
DifZwSetValueKeyWrapper
DifZwSetVolumeInformationFileWrapper
DifZwTranslateFilePathWrapper
DifZwUnloadDriverWrapper
DifZwUnloadKeyWrapper
DifZwWaitForMultipleObjectsWrapper
DifZwWaitForSingleObjectWrapper
DifZwWriteFileWrapper
DisplayBootBitmap
DrvDbGetDriverDatabaseList
DrvDbGetObjectSubKeyCallback
DrvDbLoadDatabaseNode
DrvDbUnloadDatabaseNode
EmonOverflowHandler
EmonPebsOverflowHandler
EmpEvaluateNodeLink
EmpEvaluateUpdateRuleEvalState
EmpUpdateRuleState
EtwGetKernelTraceTimestampSilo
EtwQueryPerformanceTraceInformation
EtwSetPerformanceTraceInformation
EtwpAddLogHeader
EtwpAddRegEntryToGroup
EtwpCancelTraceImageUnloadApc
EtwpClockSourceRunDown
EtwpCompleteBuffer
EtwpCovSampEnumerateProcess
EtwpCovSampLookasideGrow
EtwpCovSampModuleGetName
EtwpCovSampModuleNameInfoCleanup
EtwpCoverageSamplerStart
EtwpEnumerateAddressSpace
EtwpEventWriteFull
EtwpFreeLoggerContext
EtwpGetPmcOwnership
EtwpInitialize
EtwpInitializeLastBranchTracing
EtwpInitializeTimeStamp
EtwpInvokeEventCallback
EtwpLoadMicroarchitecturalProfileSource
EtwpLogContextSwapEvent
EtwpLogPmcCounterRundown
EtwpRegisterKMProvider
EtwpReserveTraceBuffer
EtwpReserveWithPmcCounters
EtwpSampledProfileRunDown
EtwpSendDataBlock
EtwpTraceImageUnloadApc
EtwpTraceLastBranchRecord
EtwpTraceProcessorTrace
EtwpUpdateLastBranchTracingConfiguration
EtwpUpdatePmcCounters
EtwpUpdateProcessorTraceConfiguration
ExAllocateFromLookasideListEx
ExAllocateFromNPagedLookasideList
ExAllocateHeapPool
ExAtsSvmDevicePowerCallback
ExCallCallBack
ExCallSessionCallBack
ExEnumHandleTable
ExFlushLookasideListEx
ExFlushTb
ExFreeHeapPool
ExFreeToLookasideListEx
ExFreeToNPagedLookasideList
ExInitLicenseData
ExInitializeDeviceAts
ExNotifyWithProcessing
ExRegisterExtension
ExSetLicenseTamperState
ExSvmBeginDeviceReset
ExSvmFinalizeDeviceReset
ExUnregisterExtension
ExUpdateLicenseData
ExpAcquireCrossVmMutant
ExpApplyPriorityBoost
ExpAtsDereferenceDevice
ExpBoostIoAfterAcquire
ExpCallProcessing
ExpCenturyDpcRoutine$fin$0
ExpConvertSvmDevice
ExpCreateCrossVmEvent
ExpCreateCrossVmMutant
ExpCrossVmIntHostCallback
ExpCrossVmWnfPush
ExpFinalizeTimerDeletion
ExpFlushGeneralLookaside
ExpGenuinePolicyPostProcess
ExpGetSystemFirmwareTableInformation
ExpInitializeMemoryMirroring
ExpInitializeSessionDriver
ExpInitializeSvm
ExpLicenseWatchInitWorker
ExpObCloseCrossVmEvent
ExpObCloseCrossVmMutant
ExpObDeleteCrossVmEvent
ExpObDeleteCrossVmMutant
ExpPrepareNewAtsDevice
ExpPrepareNewSvmDevice
ExpProfileCreate
ExpPulseCrossVmEvent
ExpQueryCodeIntegrityCertificateInfo
ExpQueryCrossVmEvent
ExpQueryElamCertInfo
ExpQueryNumaProximityNode
ExpQuerySystemInformation
ExpReleaseCrossVmMutant
ExpResetCrossVmEvent
ExpSetCrossVmEvent
ExpSetSoftRebootFlags
ExpShareAddressSpaceWithDevice
ExpSnapShotHandleTables
ExpSvmDereferenceDevice
ExpSvmWorkerThread
ExpTimeRefreshDpcRoutine$filt$3
ExpTimeRefreshWork
ExpTimeZoneDpcRoutine$fin$2
ExpTimerDpcRoutine$filt$1
ExpWaitForBootDevices
ExpWaitForResource
ExpWatchProductTypeWork
ExpWnfDispatchKernelSubscription
ExpWnfPopulateStateData
ExpWorkerThread
FUN_1404166db
FUN_14066b630
FUN_14066c334
FUN_140687e40
FUN_14068ad70
FUN_140709640
FUN_140709974
FUN_140768f34
FUN_14084356c
FUN_140a4b524
FUN_140a4b914
FUN_140a4c0d0
FUN_140a4c310
FUN_140a4c860
FUN_140a4ce10
FUN_140a4d1c4
FUN_140a4db54
FUN_140a4e0ec
FUN_140a4e508
FilterEvalImpliedAnd
FilterEvalStrict
FindNodeOrParent
FindNodeOrParent
FsFilterPerformCallbacks
FsFilterPerformCompletionCallbacks
FsRtlAcquireFileExclusiveCommon
FsRtlAcquireFileForCcFlushEx
FsRtlAcquireFileForModWriteEx
FsRtlCompleteLockIrpReal
FsRtlCopyRead
FsRtlCopyWrite
FsRtlFastUnlockSingleExclusive
FsRtlFastUnlockSingleShared
FsRtlFreeExtraCreateParameter
FsRtlGetFileNameInformation
FsRtlGetFileSize
FsRtlGetSupportedFeatures
FsRtlMdlRead
FsRtlMdlReadComplete
FsRtlMdlReadDev
FsRtlMdlWriteComplete
FsRtlMupGetProviderIdFromName
FsRtlMupGetProviderInfoFromFileObject
FsRtlNotifyFilterReportChange
FsRtlNotifyFilterReportChangeLiteEx
FsRtlPrepareMdlWrite
FsRtlPrepareMdlWriteDev
FsRtlPrivateFastUnlockAll
FsRtlReleaseFile
FsRtlReleaseFileForCcFlush
FsRtlReleaseFileForModWrite
FsRtlReleaseFileNameInformation
FsRtlStackOverflowRead
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
FsRtlUninitializeOplock
FsRtlWorkerThread
FsRtlpRemoveAndCompleteWaitingIrp
FsRtlpWaitOnIrp
GetBootSystemTime
GxpReadFrameBufferPixels
GxpWriteFrameBufferPixels
HalAllocateAdapterChannelV2
HalAllocateCommonBuffer
HalAllocateHardwareCounters
HalAssignSlotResources
HalBuildScatterGatherListV2
HalConfigureAdapterChannel
HalCreateCommonBufferFromMdl
HalCreateCommonBufferFromMdlDmaThin
HalCreateCommonBufferFromMdlDmarThin
HalDisableInterrupt
HalDmaAllocateCrashDumpRegistersEx
HalDmaFreeCrashDumpRegistersEx
HalEnableInterrupt
HalFreeCommonBuffer
HalFreeCommonBufferDmaThin
HalFreeCommonBufferDmarThin
HalFreeCommonBufferV3
HalFreeCommonBufferVector
HalFreeHardwareCounters
HalGetAdapterV2
HalGetInterruptVector
HalGetVectorInput
HalJoinDmaDomain
HalMapTransferEx
HalMcFinishMicrocode
HalPerformEndOfInterrupt
HalReadDmaCounter
HalReadDmaCounterV2
HalReturnToFirmware
HalSendNMI
HalSetProfileInterval
HalStopProfileInterrupt
HalTranslateBusAddress
HaliAcpiSleep
HaliLocateHiberRanges
HaliRunPlatformDebugTriggers
HalpAcpiDetectMachineSpecificActions
HalpAcpiPmRegisterRead
HalpAcpiPmRegisterWrite
HalpAcpiPostSleep
HalpAcpiPreSleep
HalpAcquireCmosSpinLock
HalpAddMcaToProcessorSpecificSection
HalpAllocateAdapterCallbackV2
HalpAllocateAdapterCallbackV3
HalpAllocateCommonBufferDmaThin
HalpAllocateCommonBufferDmarThin
HalpAllocateCommonBufferVectorInternal
HalpAllocateDmaResourcesInternal
HalpAllocateDomainCommonBufferInternal
HalpAllocatePmcCounterSetEx
HalpApicClearLocalUnitError
HalpApicConvertFromRte
HalpApicGetCpuInfo
HalpApicGetLocalUnitError
HalpApicInitializeLocalUnit
HalpApicIsCmciImplemented
HalpApicQueryAndGetSource
HalpApicReplaySendSelfIpi
HalpApicRequestInterrupt
HalpApicSaveLocalInterrupts
HalpApicSetLineState
HalpApicSetLogicalId
HalpApicSetPriority
HalpApicStartProcessor
HalpApicTimerArm
HalpApicTimerDiscover
HalpApicTimerInitialize
HalpApicTimerIsInvariant
HalpApicTimerQueryCounter
HalpApicTimerStop
HalpApicWriteEndOfInterrupt
HalpArtAvailable
HalpBlkPoReadPerfIoPort
HalpBlkPoReadPerfMsr
HalpBlkPoRegisterIdleState
HalpBlkPoWritePerfIoPort
HalpBlkPoWritePerfMsr
HalpCmciLoadThresholdConfiguration
HalpCmciSetProcessorConfigAMD
HalpCmciSetProcessorConfigIntel
HalpCmciSetProcessorMiscConfigAMD
HalpCmosRangeHandler
HalpCompleteInitializeProfiling
HalpConstructScatterGatherListDmaThin
HalpConstructScatterGatherListDmarThin
HalpCreateMcaMemoryErrorRecord
HalpCreateMcaProcessorErrorRecord
HalpCreateNMIErrorRecord
HalpDisableSecondaryInterrupt
HalpDmaAllocateChildAdapterV3
HalpDmaAllocateDomain
HalpDmaControllerCancelTransfer
HalpDmaControllerDpcRoutine
HalpDmaControllerFlushChannel
HalpDmaControllerInitializeController
HalpDmaControllerInterruptRoutine
HalpDmaControllerProgramChannel
HalpDmaControllerQueryMaxFragments
HalpDmaControllerReadDmaCounter
HalpDmaControllerValidateRequestLineBinding
HalpDmaDereferenceDomainObject
HalpDmaFreeChildAdapter
HalpDmaFreeLa
HalpDmaGetIommuInterface
HalpDmaGetReservedRegionsForHybridPassthroughDomain
HalpDmaInitializeControllers
HalpDmaInitializeDomainEarly
HalpDmaPowerCriticalTransitionCallback
HalpDmaProcessMapRegisterQueueV2
HalpDmaSyncMapBuffers
HalpDmaSyncMapBuffersWithEmergencyResources
HalpDpPostReplace
HalpDpPreReplace
HalpDpReplaceControl
HalpDpReplaceTarget
HalpDpReplayInterrupts
HalpEnableSecondaryInterrupt
HalpEnumerateEnvironmentVariablesWithFilter
HalpExtInitExtensions
HalpFreePmcCounterSet
HalpGetCacheCoherency
HalpGetMcaExtendedLogStatusBlock
HalpGetMcaPcrContext
HalpGetSetCmosData
HalpHandleMachineCheck
HalpHandleMaskUnmaskSecondaryInterrupt
HalpHvCounterQueryCounter
HalpHvEnterSleepState
HalpHvEpCpuid
HalpHvEpWriteMsr
HalpHvGetMachineCheckContext
HalpHvInitDiscard
HalpHvInitMcaPcrContext
HalpHvLpReadMultipleMsr
HalpHvMapDeviceInterrupt
HalpHvMapDeviceMsiRange
HalpHvNotifyDebugDeviceAvailable
HalpHvRetargetDeviceMsiInterrupt
HalpHvRetargetIoApicDeviceInterrupt
HalpHvSetMachineCheckHandlerState
HalpHvSetMachineCheckRecoveryState
HalpHvSetSleepStateProperty
HalpHvStartProcessor
HalpHvStartVirtualProcessor
HalpHvTimerInitialize
HalpHvUnmapDeviceInterrupt
HalpHvUnmapDeviceMsiRange
HalpHvVpStartEnabled
HalpInitSystemHelper
HalpInitializePnTimers
HalpInitializeProfiling
HalpInitializeTimers
HalpInitializeUncoreProfiling
HalpInterruptDpReplaceBegin
HalpInterruptEnumerateUnmaskedInterrupts
HalpInterruptEnumerateUnmaskedSecondaryInterrupts
HalpInterruptGenerateMessage
HalpInterruptGetHighestPriorityInterrupt
HalpInterruptInitializeController
HalpInterruptInitializeLocalUnit
HalpInterruptLocalErrorService
HalpInterruptOfflineProcessor
HalpInterruptPerformDirectedEndOfInterrupt
HalpInterruptRequestInterrupt
HalpInterruptRequestSecondaryInterrupt
HalpInterruptResetThisProcessor
HalpInterruptRestoreClock
HalpInterruptSaveReplayState
HalpInterruptSendIpi
HalpInterruptSetLineStateInternal
HalpInterruptStandardEndOfInterrupt
HalpInterruptStartProcessor
HalpInterruptThermalService
HalpInterruptUpdateLocalUnitIdentifier
HalpIommuAcquireNewDomain
HalpIommuAllocateDmaDomain
HalpIommuAllocateRemappingTableEntry
HalpIommuAttachDeviceDomain
HalpIommuCreateDevice
HalpIommuCreateDeviceInternal
HalpIommuDeleteDevice
HalpIommuDomainFreeLogicalAddressRange
HalpIommuDomainGetLogicalAddressRange
HalpIommuEnableInterrupts
HalpIommuFlushDomainTB
HalpIommuFreeDmaDomain
HalpIommuFreeDomain
HalpIommuFreeRemappingTableEntry
HalpIommuGetAcpiDeviceMapCount
HalpIommuGetDeviceId
HalpIommuInitSystem
HalpIommuInitializeAll
HalpIommuInitializeDmaGuardPolicy
HalpIommuInitializeDmarPageTable
HalpIommuInterruptRoutine
HalpIommuInvokeInterfaceStateChangeCallbacks
HalpIommuJoinDmaDomain
HalpIommuLeaveDmaDomain
HalpIommuLocateFromDevice
HalpIommuMapLogical
HalpIommuMapLogicalRange
HalpIommuMarkHiberPhase
HalpIommuProcessReservationsInternal
HalpIommuQueryAcpiDeviceMapping
HalpIommuSetupMessageInterruptRouting
HalpIommuUnblockDevice
HalpIommuUpdateRemappingDestination
HalpIommuUpdateRemappingTableEntry
HalpIumGetNextVariableName
HalpIumGetTime
HalpIumGetVariable
HalpIumQueryVariableInfo
HalpIumResetSystem
HalpIumSetTime
HalpIumSetVariable
HalpIvtProcessDrhdEntry
HalpLeaveDmaDomain
HalpLoadMicrocode
HalpMapTransferV2
HalpMaskInterrupt
HalpMcEnumerateAndSetPatchConfig
HalpMcExportAllData
HalpMcGetLoadConfiguration
HalpMcUpdateInitialize
HalpMcUpdateLock
HalpMcUpdateMicrocode
HalpMcUpdatePostUpdate
HalpMcUpdateUnlock
HalpMcaInitializeErrorSection
HalpMcaPopulateErrorData
HalpMcaProcessorBankClear
HalpMcaProcessorBankConfigAmd
HalpMcaQueueDpc
HalpMcaSetProcessorConfig
HalpMceHandlerCore
HalpMemoryErrorDeferredHandler
HalpMemoryErrorDeferredRecovery
HalpPCIConfig
HalpPCIPerformConfigAccess
HalpPerfInterrupt
HalpPmemErrorDeferredHandler
HalpPmuProcessorCallbackDpcRoutine
HalpPmuReservedResourcesProcessorCallback
HalpPowerStateCallback
HalpPowerWriteResetCommand
HalpProcessorPrepareForIdle
HalpProcessorResumeFromIdle
HalpPutScatterGatherListDmarThin
HalpQueryIommuReservedRegionInformation
HalpQueryPrimaryInterruptInformation
HalpQueryProfileInformation
HalpReadExtendedMcaRegistersAMD
HalpReadExtendedMcaRegistersIntel
HalpReenableAcpi
HalpRestartProfiling
HalpRestoreDmaControllerState
HalpRtcAcknowledgeInterrupt
HalpRtcArmTimer
HalpRtcFixedStall
HalpRtcInitialize
HalpRtcStop
HalpScanForProfilingCorruption
HalpSendPccCommand
HalpSetMicrocodeSelfhostFlag
HalpSetProfileSourceInterval
HalpSetResumeTime
HalpSetSystemInformation
HalpSetTimer
HalpShutdown
HalpShutdownReset
HalpStartPccCommand
HalpStartProfileInterruptEx
HalpStopLegacyUsbInterruptsInternal
HalpTimerAlwaysOnClockInterrupt
HalpTimerCalibratePerformanceCounter
HalpTimerCaptureCloestAuxiliaryQpcPair
HalpTimerCaptureCurrentAuxiliaryQpcPair
HalpTimerClockActivate
HalpTimerClockArm
HalpTimerClockInitialize
HalpTimerClockInterrupt
HalpTimerClockInterruptStub
HalpTimerClockIpiRoutine
HalpTimerClockPowerChange
HalpTimerClockStop
HalpTimerConfigureInterrupt
HalpTimerDelayedQueryCounter
HalpTimerDetermineValidTimerPairReadLatency
HalpTimerDpcRoutine
HalpTimerEnableHypervisorTimer
HalpTimerHypervisorInterruptStub
HalpTimerInitialize
HalpTimerInitializeClockPn
HalpTimerInitializeHypervisorTimer
HalpTimerInitializeProfiling
HalpTimerMeasureFrequencies
HalpTimerPerformanceCounterPowerChange
HalpTimerProfileInterrupt
HalpTimerProfilePowerChange
HalpTimerPropagateQpcBiasUpdate
HalpTimerQueryCycleCounter
HalpTimerQueryHostPerformanceCounter
HalpTimerReadTimerPairWithLatencyLimit
HalpTimerRestartProfileInterrupt
HalpTimerRestorePerformanceCounter
HalpTimerRestoreProcessorCounter
HalpTimerSavePerformanceCounter
HalpTimerSetupMessageInterruptRouting
HalpTimerStallCounterPowerChange
HalpTimerStallExecutionProcessor
HalpTimerStopAllTimers
HalpTimerStopProfileInterrupt
HalpTimerSwitchStallSource
HalpTimerSwitchToNormalClock
HalpTimerTestHypervisorTimer
HalpTimerUpdateApiConsumers
HalpTimerWatchdogPreResetInterrupt
HalpTimerWatchdogStart
HalpTimerWatchdogStop
HalpTscDiscover
HalpTscGetAttributes
HalpUnmaskInterrupt
HalpUsbLegacyScanBusForHandoff
HalpUsbLegacyStopOhciInterrupt
HalpUsbLegacyStopUhciInterrupt
HalpVpptAcknowledgeInterrupt
HalpVpptInitializePhysicalTimer
HalpVpptStop
HalpVpptUpdatePhysicalTimer
HalpWdatProcessWdrtInternalData
HalpWheaReadMsrAddress
HalpWheaReadMsrMisc
HalpWheaReadMsrStatus
HalpWheaWriteMsrControl
HalpWheaWriteMsrStatus
HeadlessInit
HsaInitializeInterruptRemapping
HsaInitializeIommu
HsaIommuSendCommand
HvAnalyzeLogFiles
HvExtendHivePrimaryFileValidDataLength
HvFreeHivePartial
HvHiveCleanup
HvHiveStartEmptyClone
HvHiveStartFileBacked
HvHiveStartMemoryBacked
HvLoadHive
HvRecoverFlushProtocolStateFromFiles
HvValidateOrInvalidatePrimaryFileHeader
HvWriteExternal
HvWriteHivePrimaryFile
HvWriteLogFile
HvlCrashdumpCallbackRoutine
HvlDebuggerSupportInitialize
HvlEnlightenProcessor
HvlGetSharedPageVa
HvlInvokeWheaErrorNotificationCallback
HvlPrepareForRootCrashdump
HvlResumeFromRootCrashdump
HvlSkCrashdumpCallbackRoutine
HvlStartBootLogicalProcessors
HvlWheaInUsePageOfflineNotificationCallback
HvlpComputeLpComparisonMetrics
HvlpHandleIommuFaultMessage
HvlpInitializeBootProcessor
HvlpPhase0Enlightenments
HvlpQueryApicIdAndNumaNode
HvlpSelectLpSet
HvlpSetupBootProcessorEarlyHypercallPages
HvlpTryConfigureInterface
HvpAddBin
HvpAdjustBitmap
HvpAllocateBin
HvpAllocateMap
HvpApplyLegacyLogFile
HvpEnlistFreeCell
HvpExpandMap
HvpFreeBin
HvpFreeHiveFreeDisplay
HvpFreeMap
HvpGetHiveHeader
HvpGrowDirtyVectors
HvpIncrementalLogFileEnumeratorAdvance
HvpInitMap
HvpReadHiveDataFromFile
HvpReadLogEntryHeader
HvpRecoverDataReadRoutine
HvpShrinkMap
IaLpssReadCmdStatus
IaLpssReadPmcsr
IaLpssSetPowerD0
IaLpssSetPowerD3
IaLpssWriteCmdStatus
IaLpssWritePmcsr
InbvAcquireDisplayOwnership
InbvAcquireLock
InbvCheckDisplayOwnership
InbvDisplayString
InbvEnableBootDriver
InbvGetDisplayState
InbvGetResourceAddress
InbvIndicateProgress
InbvIsBootDriverInstalled
InbvNotifyDisplayOwnershipChange
InbvNotifyDisplayOwnershipLost
InbvPortGetByte
InbvPortInitialize
InbvPortPollOnly
InbvPortPutByte
InbvReleaseLock
InbvReleaseResources
InbvResetDisplay
InbvSetFunction
InbvSetProgressBarSubset
InbvSetScrollRegion
InbvSetTextColor
InbvSetVirtualFrameBuffer
InbvSolidColorFill
InitBootProcessor
IoAddProcessesToDump
IoAllocateAdapterChannel
IoAllocateController
IoAllocateMdl
IoAsynchronousPageWrite
IoBoostThreadIoPriority
IoCancelIrp
IoCaptureLiveDump
IoCreateDriver
IoCreateStreamFileObjectEx2
IoCsqInsertIrpEx
IoCsqRemoveIrp
IoCsqRemoveNextIrp
IoDemoteToTriageDump
IoDumpStackResumeCapable
IoEnumerateEnvironmentVariablesEx
IoFlushAdapterBuffers
IoFlushAdapterBuffersV2
IoFreeAdapterChannel
IoFreeAdapterChannelV2
IoFreeController
IoFreeMapRegisters
IoFreeMdl
IoGetDmaAdapter
IoGetDumpStack
IoGetDumpStackTransferSizes
IoGetEnvironmentVariableEx
IoGetIommuInterface
IoGetIommuInterfaceEx
IoInitSystemPreDrivers
IoInitializeDumpStack
IoMapTransfer
IoNotifyDump
IoProcessPassiveInterrupts
IoPropagateIrpExtensionEx
IoProvisionCrashDumpKey
IoQueryEnvironmentVariableInfoEx
IoRegisterFileSystem
IoRevertFromDemotedDumpType
IoSaveInitialBugCheckProgress
IoSetEnvironmentVariableEx
IoShutdownSystem
IoStartPacket
IoStopIoRateControl
IoTranslateBusAddress
IoUnregisterFileSystem
IoUpdateBugCheckProgressEnvVariable
IoUpdateDumpPhysicalRanges
IoWriteCrashDump
IofCallDriver
IommuCreateAtsDevice
IommuDeleteAtsDevice
IommuDevicePowerChange
IommuDisableDevicePasid
IommuEnableDevicePasid
IommuFinalizeDeviceReset
IommuFlushAllPasid
IommuFlushDomain
IommuFlushTb
IommuHvDevicePowerChange
IommuHvFlushAllPasid
IommuHvFlushTb
IommuHvSetAddressSpace
IommuProcessPageRequestQueue
IommuRegisterInterfaceStateChangeCallback
IommuSetAddressSpace
IommupDeviceDisablePasidTaggedDma
IommupDeviceDisableSvm
IommupDeviceEnablePasidTaggedDma
IommupDeviceEnableSvm
IommupHvAttachPasidDevice
IommupHvAttachPasidDeviceDomain
IommupHvAttachPasidSubDeviceDomain
IommupHvConfigureDeviceDomain
IommupHvCreateSvmPasidSpace
IommupHvDetachPasidDevice
IommupHvDetachPasidDeviceDomain
IommupHvDetachPasidSubDeviceDomain
IommupHvDismissPageFault
IommupHvFlushDeviceDomainVaList
IommupHvFlushDomainTbs
IommupHvGetDeviceAtsCapability
IommupHvGetDeviceSvmCapabilities
IommupHvGetPageFault
IommupHvInitializeLibrary
IommupHvInterruptRoutine
IommupHvIsDmarStageCompatible
IommupHvIsStage1DmarCompatible
IommupHvMapDevice
IommupHvMapDeviceIdentityRange
IommupHvMapDeviceLogical
IommupHvMapDeviceLogicalRange
IommupHvRegisterDeviceId
IommupHvSetRootFaultReportingReady
IommupHvUnblockDefaultDma
IommupHvUnmapDevice
IommupHvUnmapDeviceIdentityRange
IommupHvUnmapDeviceLogicalRange
IommupHvUnregisterDeviceId
IommupHvValidatePageRequestGpa
IommupMapDeviceInternal
IommupUnmapDeviceInternal
IopAddRemoveReqDescs
IopAllocRealFileObject
IopAllocateMdl
IopAllocatePassiveInterruptBlock
IopAttachDeviceToDeviceStackSafe
IopBoostThreadCallback
IopBootAllocation
IopBugCheckProgressEfiVariableServicesAvailable
IopCallArbiter
IopCallBootDriverReinitializationRoutines
IopCallDriverReinitializationRoutines
IopChildToRootTranslation
IopCloseFile
IopCommitConfiguration
IopCompletePageWrite
IopCompleteUnloadOrDelete
IopConnectInterrupt
IopConnectInterruptFullySpecified
IopCreateFile
IopCsqCancelRoutine
IopDisableCrashDump
IopDispatchSessionNotifications
IopDumpCallAddPagesCallbacks
IopDumpCallRemovePagesCallbacks
IopDuplicateDetection
IopEjectDevice
IopEnumerateEnvironmentVariablesHal
IopEnumerateEnvironmentVariablesTrEE
IopFileUtilWalkDirectoryTreeHelper
IopFreeMiniCompletionPacket
IopGetBasicInformationFile
IopInitializeBuiltinDriver
IopInitializeCrashDump
IopInitializeDeviceInstanceKey
IopIoRateStartRateControl
IopIrpStackProfilerDpcRoutine$fin$1
IopLiveDumpAddIptTraceBuffers
IopLiveDumpAddTriageDumpData
IopLiveDumpAllocateIptBuffers
IopLiveDumpCallRemovePagesCallbacks
IopLiveDumpGenerateIptSecondaryData
IopLiveDumpMarkImportantDumpData
IopLoadCrashdumpDriver
IopLoadUnloadDriver
IopMapTransfer
IopNotifyAlreadyRegisteredFileSystems
IopParentToRawTranslation
IopParseDevice
IopPassiveInterruptRealtimeWorker
IopPassiveInterruptWorker
IopPerfCompletionRoutine
IopPoHandleIrp
IopPortFindSuitableRange
IopProcessIoTracking
IopProcessWorkItem
IopQueryInformation
IopRaiseHardError
IopReadFile
IopRegistryCallback
IopRegistryInitializeCallbacks
IopReleaseDeviceResources
IopRetestConfiguration
IopRetrieveSystemDeviceName
IopStartNextPacket
IopStartNextPacketByKey
IopSynchronousServiceTail
IopTestConfiguration
IopThreadStart
IopTimerDispatch
IopTimerDispatch$filt$2
IopTranslateAndAdjustReqDesc
IopUncacheInterfaceInformation
IopUnloadDriver
IopUnloadSafeCompletion
IopWriteFile
IopWriteTriageDumpToFirmware
IopXxxControlFile
IopfCallDriver
IopfCompleteRequest
IovBuildDeviceIoControlRequest
IovInitializeTimer
IovpCancelRoutine
IovpCompleteRequest2
IovpLocalCompletionRoutine
IovpUnloadDriver
IpmiLibpHandleErrorInterrupt
IpmiLibpHandleReadInterrupt
IpmiLibpHandleSendInterrupt
IpmiLibpKcsBmcTransact
IvtInitializeIdentityMappings
IvtInitializeIommu
IvtIommuSendCommand
IvtIommuWaitCommand
KdCallPowerHandlers
KdEnterDebugger
KdExitDebugger
KdPowerTransitionEx
KdPullRemoteFileEx
KdpSendWaitContinue
KdpSysReadBusData
KdpSysWriteBusData
KeBoostPriorityThread
KeBugCheck2
KeCleanupImageTracepoints
KeClockInterruptNotify
KeConnectInterrupt
KeConvertAuxiliaryCounterToPerformanceCounter
KeConvertPerformanceCounterToAuxiliaryCounter
KeCpuSetReportParkedProcessors
KeEnumerateKernelStackSegments
KeEnumerateProcessorDpcs
KeEnumerateQueueApc
KeFreezeExecution
KeGenericProcessorCallback
KeInitializeClock
KeInitializeClockOtherProcessors
KeInitializeEntropySystem
KeInitializeTimerTable
KeIpiGenericCall
KeNumaInitialize
KePrepareClockTimerForIdle
KePrepareNonClockOwnerForIdle
KeQueryAuxiliaryCounterFrequency
KeQueryIntervalProfile
KeQueryPerformanceCounter
KeQueryWakeSource
KeRecomputeCpuSetAffinityProcess
KeRegisterProcessorChangeCallback
KeRemoveQueueEx
KeResumeClockTimerFromIdle
KeRevertToUserMultipleGroupAffinityThread
KeRundownApcQueues
KeSetBasePriorityThread
KeSetCpuSetsProcess
KeSetSchedulingGroupRankBias
KeSetSelectedCpuSetsThread
KeSetSystemMultipleGroupAffinityThread
KeSetThreadSchedulerAssist
KeSetUserAffinityThread
KeSetUserGroupAffinityThread
KeSpecialUserApcKernelRoutine
KeStallExecutionProcessor
KeStartAllProcessors
KeSuspendClockTimer
KeSuspendClockTimerSafe
KeSynchronizeExecution
KeThawExecution
KeUnmaskInterrupt
KeUpdateThreadCpuSets
KiAbProcessThreadLocks
KiAbThreadUnboostCpuPriority
KiAltReturnWorkerRoutine
KiBalanceSetManagerDeferredRoutine$fin$0
KiBugCheckRecoveryCleanupFromCrashDump
KiBugCheckRecoveryPrepareForCrashDump
KiCallInterruptServiceRoutine
KiCheckForThreadDispatch
KiClearLastBranchRecordStack
KiDeferredBugcheckRecoveryWorker
KiDeliverApc
KiDispatchCallout
KiDispatchException
KiDispatchInterrupt
KiEntropyDpcRoutine
KiExecuteAllDpcs
KiExitDispatcher
KiExpireTimer2
KiFinalizeTimer2Disablement
KiFreezeTargetExecution
KiGetNextTimerExpirationDueTime
KiHandleBound
KiHandleMultipleBugchecksDuringRecovery
KiHvInterruptSubDispatch
KiInitializeDynamicProcessorDpc
KiInitiateGenericCallDpc
KiIntSteerGetLineInformation
KiIntSteerInit
KiIntSteerSetDestination
KiInterruptMessageDispatch
KiInvokeBugCheckAddTriageDumpDataCallbacks
KiInvokeBugCheckEntryCallbacks
KiIpiGenericCallTarget
KiIpiProcessRequests
KiIpiSendRequestEx
KiIsInterruptTypeSecondary
KiLockServiceTable
KiMaskInterruptInternal
KiMaskSecondaryInterruptInternal
KiOpGetPciConfigSpaceAccessInfoFromPhysicalAddress
KiPerformExplicitGroupAssignment
KiPopulateNodeInformation
KiPreprocessFault
KiProcessDeferredReadyList
KiProcessExpiredTimerList
KiProcessNMI
KiProcessProfileList
KiQueryProcessorNode
KiQueryProximityNode
KiReadyOutSwappedThreads
KiRestoreClockTickRate
KiResumeClockTimer
KiRetireDpcList
KiScanBugCheckCallbackList
KiSetClockTickRate
KiSetHeteroPolicyThread
KiSetIntervalWorker
KiSetLegacyAffinityThread
KiSoftParkElectionDpcRoutine
KiStartProfileTarget
KiStopProfileTarget
KiSwapThread
KiSynchronizePassiveInterruptExecution
KiTpHandleTrap
KiTrackSystemCallEntry
KiTrackSystemCallExit
KiUnmaskSecondaryInterruptInternal
KiUpdateProcessConcurrencyCounts
KiUpdateTime
KiUpdateVpBackingThreadPriorityDpcRoutine
KiVmbusInterruptSubDispatch
KseDriverUnloadImage
KseDsCallbackHookAddDevice
KseDsCallbackHookDriverStartIo
KseDsCallbackHookDriverUnload
KseDsCallbackHookIrpFunction
KseDsCallbackHookIrpInternalDeviceControlFunction
KseDsCallbackHookIrpPnpFunction
KseDsCallbackHookIrpPowerFunction
KseDsHookExAllocatePool
KseDsHookExAllocatePoolWithTag
KseDsHookExFreePool
KseDsHookExFreePoolWithTag
KseDsHookIoCreateDevice
KseDsHookPoRequestPowerIrp
KseHookExAllocatePoolWithTag
KseHookMmGetVirtualForPhysical
KseHookMmMapIoSpace
KseHookQueryValueKey
KsepApplyShimsToDriver
KsepCacheInsert
KsepCacheLookup
KsepCacheReset
KsepCacheUninitialize
KsepCompletionSafeWrapper
KxStartUserThread
KyPlatformSwapStacksAndCall
KySwitchKernelStackCallout
LZNT1CompressChunk
LsaCallAuthenticationPackage
LsaDeregisterLogonProcess
LsaFreeReturnBuffer
LsaLogonUser
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess
MiActOnLargeKernelHalPages
MiAddNonSecuredPagesToDump
MiAddPhysicalPagesToCrashDump
MiApplyImageHotPatchRequest
MiCaptureSecureImageBaseAddress
MiCrashdumpRemovePte
MiCreateImageFileMap
MiDeliverPicoExceptionForProbedPage
MiDereferenceSessionFinal
MiEnumerateBasePatches
MiEnumerateSlabAllocators
MiFilterCrashDumpPte
MiGetNextPageTablePte
MiGetSectionStrongImageReference
MiImageRvaRawEnumFirst
MiImageRvaRawEnumNext
MiInitializeChannelRangesTemporary
MiInitializeLargePageColorSizes
MiInitializeNumaRangesTemporary
MiInvokePatchCallback
MiIterateOverPartitions
MiMirrorPerformBlackWrites
MiMirrorPerformBrownWrites
MiMirrorVerify
MiProcessKernelCfgImageLoadConfig
MiProcessVmAccessedInfo
MiRelocateImage
MiRelocateImageAgain
MiRemoveEnclavePagesFromDump
MiRemovePendingBadPagesFromDump
MiReplaceRotateWithDemandZero
MiRotateToFrameBuffer
MiValidateExistingImage
MiValidateSectionCreate
MiValidateSectionSigningPolicy
MiWalkPageTablesRecursively
MiWalkPageTablesRecursivelyNoSynch
MiYieldPageTableWalk
MmAddPrivateDataToCrashDump
MmDuplicateMemory
MmEnumerateSystemImages
MmGetDumpRange
MmMapMdl
MmUpdateMdlTrackerForMdlSwitch
NP_CONTEXT::NpLeafDerefInternal
NP_CONTEXT::NpLeafRemoveInternal
NP_CONTEXT::NpiLeafPageIn
NP_CONTEXT::NpiPerformPageOut
NtCompareSigningLevels
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
NtCreateKeyTransacted_Stub
NtCreateUserProcess
NtDeleteKey
NtDeleteValueKey
NtEnumerateKey
NtEnumerateValueKey
NtFlushKey
NtLockFile
NtOpenKeyTransactedEx_Stub
NtPlugPlayControl
NtPowerInformation
NtQueryAuxiliaryCounterFrequency
NtQueryInformationFile
NtQueryInformationProcess
NtQueryKey
NtQueryMultipleValueKey
NtQueryObject
NtQuerySecurityObject
NtQuerySecurityPolicy
NtQueryValueKey
NtQueueApcThreadEx2
NtSetCachedSigningLevel2
NtSetInformationKey
NtSetSystemInformation
NtSetValueKey
NtUnlockFile
ObCloseHandleTableEntry
ObCreateObjectEx
ObDeleteCapturedInsertInfo
ObInsertObjectEx
ObOpenObjectByNameEx
ObQueryNameStringMode
ObQuerySecurityObject
ObReferenceObjectByNameEx
ObSetSecurityObjectByPointer
ObShutdownSystem
ObpAllocateAndQuerySecurityDescriptorInfo
ObpAssignSecurity
ObpCallPostOperationCallbacks
ObpCallPreOperationCallbacks
ObpCaptureObjectName
ObpCloseHandle
ObpCreateHandle
ObpDecrementHandleCount
ObpFreeObject
ObpFreeObjectNameBuffer
ObpGetObjectSecurity
ObpIncrementHandleCountEx
ObpLookupObjectName
ObpParseSymbolicLinkEx
ObpRemoveObjectRoutine
Ordinal_23
Ordinal_27
Ordinal_28
Ordinal_7
PcwAddInstance
PcwCloseInstance
PcwCreateInstance
PcwRegister
PcwUnregister
PdcPortSendMessageSynchronously
PdcpPortReleaseResources
Pdcv2pActivationClientCallback
PerfLogImageUnload
PfFbBufferListFlushStandby
PfFbLogEntryComplete
PfFbLogEntryReserve
PfFileInfoNotify
PfSnNameQueryWorker
PfSnVolumeKeyQuery
PfpOpenHandleClose
PfpOpenHandleCreate
PiDaDispatch
PiDaFastIoDispatch
PiDevCfgCopyObjectProperties
PiDevCfgEnumDeviceKeys
PiDevCfgResolveVariable
PiDmCmObjectMatchCallback
PiDmEnumObjectsWithCallback
PiDmGetObjectListCallback
PiDmListEnumObjectsWithCallback
PiDmPnpObjectMatchCallback
PiDmaGuardProcessNewDeviceNode
PiForEachDriverQueryRoutine
PiGetDmaAdapterFromBusInterface
PiIommuAllocateExtension
PiIommuBlockDevice
PiIommuGetInterface
PiIommuUnblockDevice
PiPnpRtlEnumDevicesCallback
PiPnpRtlEnumeratorFilterCallback
PiPnpRtlInterfaceFilterCallback
PiPnpRtlServiceFilterCallback
PiProcessDriversLoadedOnSecureDevice
PiProcessNewDeviceNode
PiQueryAndAllocateBootResources
PiUpdateDeviceResourceLists
PipCallDriverAddDevice
PipCslUpdateState
PipDmgInitPhaseZero
PipDmgSaveDeviceDmarPolicy
PipDmgSetIommuDomainPolicyAndNotifyHal
PipEnumeratePersistedMemoryCallback
PipForAllDeviceNodesCallback
PipIommuRetrieveDeviceId
PipProcessPendingObjects
PipUnprotectDevice
PnpBootDeviceWait
PnpCallDriverEntry
PnpCompleteDeviceEvent
PnpGetDeviceLocationStrings
PnpHandleProcessWalkWorker
PnpNotifyDriverCallback
PnpProcessCompletedEject
PnpProcessQueryRemoveAndEject
PnpReplacePartitionUnit
PnpRequestDeviceEjectExWorker
PnprEndMirroring
PnprGetPageDestination
PnprIdentifyUnits
PnprInitiateReplaceOperation
PnprLoadPluginDriver
PnprMarkOrMirrorPages
PnprMirrorMarkedPages
PnprQueryReplaceFeatures
PnprQuiesceProcessorDpc
PnprQuiesceProcessors
PnprReplaceStart
PnprSwap
PnprSwapFinalize
PnprWakeProcessors
PoFxPowerOnCrashdumpDevice
PoFxProcessorNotification
PoFxRegisterDebugger
PoFxStartDevicePowerManagement
PoFxSystemLatencyNotify
PoInitHiberServices
PoInitSystem
PoInitiateProcessorWake
PoIssueCoalescingNotification
PopAllocateHiberContext
PopCallPowerSettingCallback
PopCaptureSleepStudyStatistics
PopCheckpointSystemSleep
PopCleanCoolingExtension
PopCoalescingCallback
PopConnectToPolicyDevice
PopDecompressHiberBlocks
PopDiagTraceFirmwareS3Stats
PopDisableCoolingExtension
PopDispatchShutdownEvent
PopEvaluatePowerButtonSuppressionState
PopExecuteProcessorCallback
PopExternalMonitorUpdatedWorker
PopFreeHiberContext
PopFxAcpiForwardNotification
PopFxAcpiForwardPepAcpiNotifyRequest
PopFxAcpiForwardPepWorkRequest
PopFxCompleteComponentPerfState
PopFxDeliverDevicePowerRequired
PopFxDispatchPluginWorkOnce
PopFxHandleDirectedPowerTransition
PopFxIdleTimeoutDpcRoutine
PopFxIdleWorker
PopFxIdleWorkerTail
PopFxInvokeDripsWatchdogCallback
PopFxLowPowerEpochCallback
PopFxNotifySystemStateTransition
PopFxPlatformIdleVeto
PopFxProcessWork
PopFxProcessWorkPool
PopFxProcessorIdleVeto
PopFxRequestCommon
PopFxResetSocSubsystemAccounting
PopFxTransitionCriticalResource
PopFxUpdateDeviceIdleTimer
PopFxUpdatePlatformIdleState
PopFxUpdateProcessorIdleState
PopGracefulShutdown
PopHandleNextState
PopHiberCheckResume
PopHiberReadChecksums
PopInitPlatformSettings
PopInvokeSystemStateHandler
PopIrpWorker
PopMarkComponentsBootPhase
PopNetSetResiliencyPhaseBias
PopNotifyShutdownListener
PopPdcAreAllPhasesDisengaged
PopPdcCompleteResiliencyCallback
PopPdcDisengagePhases
PopPdcEngagePhases
PopPdcInvocation
PopPdcSnapDiagnosticContext
PopPepCompleteActivity
PopPepDeviceDState
PopPepInitializeDebuggerMasks
PopPepIterateDeviceList
PopPepStartActivity
PopPepTriggerActivity
PopPlPublishSystemPowerChange
PopPluginAbandonDevice
PopPluginAcpiNotificationStrict
PopPluginInitializeSocSubsystemStaticInfo
PopPluginNotifyActive
PopPluginNotifyIdleState
PopPluginPrepareDevice
PopPluginQueryComponentPerfCapabilities
PopPluginQueryComponentPerfSet
PopPluginQueryComponentPerfSetName
PopPluginQueryComponentPerfStates
PopPluginQueryCurrentComponentPerfState
PopPluginQuerySocSubsystemBlockingTime
PopPluginQuerySocSubsystemCount
PopPluginQuerySocSubsystemMetadata
PopPluginRegisterComponentPerfStates
PopPluginRegisterCrashdumpDevice
PopPluginRegisterDevice
PopPluginRequestComponentIdleConstraints
PopPluginRequestComponentPerfState
PopPluginRequestDeviceIdleConstraints
PopPluginRequestPowerControl
PopPluginUnregisterDevice
PopPolicyDeviceRemove
PopPolicyWorkerAction
PopPolicyWorkerNotify
PopPolicyWorkerThread
PopPowerAggregatorDisengageModernStandby
PopPowerAggregatorEngageModernStandby
PopPowerAggregatorHandleIntentUnsafe
PopPowerAggregatorInvokeStateMachine
PopPowerAggregatorNotifyDisplayPoweredOn
PopPowerAggregatorSystemTransitionEnterStateHandler
PopPowerAggregatorSystemTransitionExitStateHandler
PopPowerButtonWorkCallback
PopPowerInformationInternal
PopPowerRequestCallbackExecutionRequired
PopPowerRequestHandleRequestUpdate
PopProcessorIdleSelectNotification
PopProcessorNotifyLpiCoordinatedStatesNotification
PopProcessorParkMaskNotification
PopProcessorParkNotification
PopProcessorQueryCoordinatedDependencyNotification
PopProcessorQueryPlatformStateNotification
PopPropogateCoolingChange
PopQueryBootSessionStandbyActivationInfo
PopRequestCompletion
PopRequestRead
PopRequestWrite
PopRestoreHiberContext
PopSaveHiberContext
PopShutdownHandler
PopSleepstudyCaptureResiliencyStatistics
PopSleepstudyCaptureSessionStatistics
PopSleepstudyRegisterSessionCallback
PopSleepstudyStartNextSession
PopSstDiagInitializeResumeTimer
PopStateTransitionTimeoutDispatch
PopSuspendResumeInvocation
PopSwitchUpdateUserShutdownScenarioState
PopThermalZoneDpc$filt$2
PopTransitionSystemPowerStateEx
PopTriggerMonitorPowerEvent
PopUmpoProcessPowerMessage
PopUpdatePdcSystemIdleState
PopWatchdogWorker
PopWriteHiberPages
PopWriteImageHeader
PpmCheckComputeEnergy
PpmCheckReportComplete
PpmCheckRun
PpmHvSnapPerformanceAccumulation
PpmIdleCheckProcessorStateEligibility
PpmIdleExecuteTransition
PpmIdleGuestComplete
PpmIdleGuestPreExecute
PpmIdleGuestTest
PpmIdlePrepare
PpmIdleSelectStates
PpmIdleWaitForDependentTransitions
PpmInstallNewIdleStates
PpmParkComputeUnparkMask
PpmParkReportMask
PpmParkSteerInterrupts
PpmPdcNotifyMediaBufferingUpdate
PpmPerfApplyDomainState
PpmPerfApplyHiddenProcessorState
PpmPerfApplyLatencyHint
PpmPerfApplyProcessorState
PpmPerfArbitratorApplyProcessorState
PpmPerfCheckForIllegalProcessorThrottle
PpmPerfControlExecuteAction
PpmPerfFeedbackCounterRead
PpmPerfFeedbackCounterUpdate
PpmPerfGetVmPerfConfig
PpmPerfQueryProcMeasurementValues
PpmPerfSelectProcessorState
PpmPerfUpdateHwDebugData
PpmQueryPlatformStateResidency
PpmRemoveIdleStates
PpmResetPerfEngineForProcessor
PpmSnapPerformanceAccumulation
PpmUpdateProcessorPolicy
PpmUpdateTargetProcessorPolicy
PpvUtilCallAddDevice
PrExtControlOperations
PsCallImageNotifyRoutines
PsCheckProcessFileSigningLevel
PsConvertToGuiThread
PsEnumProcessThreads
PsEnumProcesses
PsGetAllocatedFullProcessImageNameEx
PsPicoSystemCallDispatch
PsPicoWalkUserStack
PsQueryActivityModerationUserSettings
PsQueryProcessSignatureMitigationPolicy
PsSetExeModerationState
PsSetProcessFaultInformation
PsSyscallProviderDispatch
PsTestProtectedProcessIncompatibility
PsUnregisterSiloMonitor
PspAllocateProcess
PspCallJobHierarchyCallbacks
PspCallProcessNotifyRoutines
PspCallThreadNotifyRoutines
PspChangeProcessExecutionState
PspDeferredWorkerRoutine
PspDeleteSiloContext
PspExitThread
PspExpandLimit
PspExpandQuota
PspInvokeCreateCallback
PspInvokeTerminateCallback
PspNetRateControlDispatch
PspProcessDelete
PspReleaseReturnedQuota
PspReturnResourceQuota
PspSetRateControlJobPreCallback
PspSetRateControlProcessCallback
PspSyscallProviderOptIn
PspSyscallProviderServiceDispatch
PspSyscallProviderServiceDispatchGeneric
PspSystemThreadStartup
PspTerminateProcess
PspThreadDelete
RcConsolidateFrames
ReadPortWithIndex16
ReadPortWithIndex32
ReadPortWithIndex8
ReadRegisterWithIndex16
ReadRegisterWithIndex32
ReadRegisterWithIndex64
ReadRegisterWithIndex8
RtlApplyHotPatch
RtlCaptureRetpolineImportRvas
RtlCompressBuffer
RtlDecompressBuffer
RtlDecompressBufferEx
RtlDecompressBufferEx2
RtlDecompressFragment
RtlDecompressFragmentEx
RtlDeleteElementGenericTable
RtlDeleteElementGenericTableAvl
RtlDeleteElementGenericTableAvlEx
RtlDescribeChunk
RtlDestroyHeap
RtlEnumerateBoundaryDescriptorEntries
RtlEnumerateGenericTableLikeADirectory
RtlEnumerateHotPatchPatches
RtlFindLowerBoundInSortedArray
RtlGetCompressionWorkSpaceSize
RtlInsertElementGenericTableAvl
RtlInsertElementGenericTableFull
RtlInsertElementGenericTableFullAvl
RtlInternEntryDereference
RtlInternTableIntern
RtlLookupElementGenericTable
RtlLookupElementGenericTableAvl
RtlLookupElementGenericTableFullAvl
RtlLookupFirstMatchingElementGenericTableAvl
RtlReserveChunk
RtlRunOnceExecuteOnce
RtlpAllocateHeapInternal
RtlpCallQueryRegistryRoutine
RtlpCompressRvaList
RtlpConstructImportRelocationFixup
RtlpFcLinearSearchInSortedArray
RtlpFindAndCommitPages
RtlpFlsDataCleanup
RtlpFlsFree
RtlpFreeHeapInternal
RtlpGetRegistryHandle
RtlpHpAllocateHeap
RtlpHpFixedHeapCreate
RtlpHpFixedVsCommit
RtlpHpFreeHeap
RtlpHpLfhBucketActivate
RtlpHpLfhBucketAllocateSlot
RtlpHpLfhSlotAllocate
RtlpHpLfhSubsegmentCreate
RtlpHpLfhSubsegmentDecommitPages
RtlpHpLfhSubsegmentFree
RtlpHpVsChunkFree
RtlpHpVsChunkSplit
RtlpHpVsSubsegmentCommitPages
RtlpHpVsSubsegmentCreate
RtlpHpVsSubsegmentFree
RtlpInternEntryCreate
RtlpInternHashBucketsAllocate
RtlpInternHashBucketsFree
RtlpIsRangeAvailable
RtlpMakeXpressCallback
RtlpQueryRegistryValues
RtlpTraceDatabaseInternalAdd
RtlpTraceDatabaseInternalFind
SC_DEVICE::GetStorageProperty
SC_DEVICE::Initialize
SC_DEVICE::UpdateStorageProperty
SC_DISK::GenerateId
SC_DISK::Initialize
SC_DISK::ReadSectors
SC_DISK::WriteSectors
SLQueryLicenseValueInternal
SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogTimerCallback
SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogWorker
SMKM_STORE_MGR<struct_SM_TRAITS>::SmIoCtxQueueWork
SMKM_STORE_MGR<struct_SM_TRAITS>::SmStoreMgrCallback
SPCallServerHandleCheckLicense
SPCallServerHandleClepKdf
SPCallServerHandleClepSign
SPCallServerHandleGetAppPolicyValue
SPCallServerHandleGetCurrentHardwareID
SPCallServerHandleGetLicenseChallenge
SPCallServerHandleIsAppLicensed
SPCallServerHandleRemoveLicense
SPCallServerHandleUpdateLicense
SPCallServerHandleUpdatePolicies
SPCallServerHandleWaitForDisplayWindow
SdbpCheckAllAttributes
SdbpCheckMatchingDevice
SdbpGetSystemSdbFilePath
SdbpMatchList
SdbpOpenCompressedDatabase
SeCodeIntegrityInitializePolicy
SeCodeIntegrityQueryInformation
SeCodeIntegritySetInformationProcess
SeCompareSigningLevels
SeGetCachedSigningLevel
SeGetImageRequiredSigningLevel
SeQuerySigningPolicy
SeReleaseImageValidationContext
SeValidateImageData
SeValidateImageHeader
SepAppendAceToTokenObjectAcl
SepDeleteAccessState
SepDuplicateToken
SepIsImageInMinTcbList
SepNotifyFileSystems
SepParseElamCertResources
SepQueueWorkItem
SepRmCallLsa
SepRmCommandServerThread
SiGetSystemDeviceName
SmDecompressBuffer
SmKmIssueFileIo
SmKmStoreDelete
SmKmStoreDeleteWhenEmpty
SmKmStoreDeleteWhenEmptyWorker
SmKmStoreHelperCommandCleanup
SmKmStoreHelperCommandProcess
SpiInit
SpiSend16
SshpAlpcProcessMessage
SshpSendSessionData
TlgAggregateInternalRegisteredProviderEtwCallback
TtmiSessionDeviceListWorker
TtmpCallAssignedToTerminal
TtmpCallSetDisplayState
TtmpCallSetInputMode
Uart16550GetByte
Uart16550InitializePortCommon
Uart16550PutByte
Uart16550RxReady
Uart16550SetBaudCommon
VerifierCcCopyWrite
VerifierCcCopyWriteEx
VerifierCcDeferWrite
VerifierCcFastCopyWrite
VerifierCcWaitForCurrentLazyWriterActivity
VerifierCmRegisterCallback
VerifierCmRegisterCallbackEx
VerifierCmUnRegisterCallback
VerifierDbgBreakPointWithStatus
VerifierEtwRegister
VerifierEtwRegisterClassicProvider
VerifierEtwUnregister
VerifierExAcquireFastMutex
VerifierExAcquireFastMutexUnsafe
VerifierExAcquireResourceExclusiveLite
VerifierExAcquireResourceSharedLite
VerifierExAcquireRundownProtection
VerifierExAcquireRundownProtectionCacheAware
VerifierExAcquireRundownProtectionCacheAwareEx
VerifierExAcquireRundownProtectionEx
VerifierExAcquireSharedStarveExclusive
VerifierExAcquireSharedWaitForExclusive
VerifierExAllocateCacheAwareRundownProtection
VerifierExAllocatePool
VerifierExAllocatePool2
VerifierExAllocatePool3
VerifierExAllocatePoolEx
VerifierExAllocatePoolWithQuota
VerifierExAllocatePoolWithQuotaTag
VerifierExAllocatePoolWithTag
VerifierExAllocatePoolWithTagPriority
VerifierExConvertExclusiveToSharedLite
VerifierExCreateCallback
VerifierExDeleteLookasideListEx
VerifierExDeleteNPagedLookasideList
VerifierExDeletePagedLookasideList
VerifierExDeleteResourceLite
VerifierExEnterCriticalRegionAndAcquireResourceExclusive
VerifierExEnterCriticalRegionAndAcquireResourceShared
VerifierExEnterCriticalRegionAndAcquireSharedWaitForExclusive
VerifierExEnterPriorityRegionAndAcquireResourceExclusive
VerifierExEnterPriorityRegionAndAcquireResourceShared
VerifierExFreePool
VerifierExFreePoolWithTag
VerifierExGetExclusiveWaiterCount
VerifierExGetSharedWaiterCount
VerifierExInitializeLookasideListEx
VerifierExInitializeNPagedLookasideList
VerifierExInitializePagedLookasideList
VerifierExInitializeResourceLite
VerifierExInterlockedAddLargeInteger
VerifierExInterlockedInsertHeadList
VerifierExInterlockedInsertTailList
VerifierExInterlockedPopEntryList
VerifierExInterlockedPushEntryList
VerifierExInterlockedRemoveHeadList
VerifierExIsProcessorFeaturePresent
VerifierExIsResourceAcquiredExclusiveLite
VerifierExIsResourceAcquiredSharedLite
VerifierExRaiseAccessViolation
VerifierExRaiseDatatypeMisalignment
VerifierExRaiseStatus
VerifierExRegisterCallback
VerifierExReinitializeResourceLite
VerifierExReleaseFastMutex
VerifierExReleaseFastMutexUnsafe
VerifierExReleaseResourceAndLeaveCriticalRegion
VerifierExReleaseResourceAndLeavePriorityRegion
VerifierExReleaseResourceForThreadLite
VerifierExReleaseResourceLite
VerifierExReleaseRundownProtection
VerifierExReleaseRundownProtectionCacheAware
VerifierExReleaseRundownProtectionEx
VerifierExSetResourceOwnerPointer
VerifierExSetResourceOwnerPointerEx
VerifierExSetTimerResolution
VerifierExTryToAcquireFastMutex
VerifierExUnregisterCallback
VerifierExUuidCreate
VerifierExWaitForRundownProtectionRelease
VerifierExWaitForRundownProtectionReleaseCacheAware
VerifierExfAcquirePushLockExclusive
VerifierExfAcquirePushLockShared
VerifierExfReleasePushLock
VerifierExfReleasePushLockShared
VerifierExfTryAcquirePushLockShared
VerifierExfTryToWakePushLock
VerifierExpInterlockedFlushSList
VerifierExpInterlockedPopEntrySList
VerifierExpInterlockedPushEntrySList
VerifierFsRtlAllocateFileLock
VerifierFsRtlAreNamesEqual
VerifierFsRtlBalanceReads
VerifierFsRtlCancellableWaitForMultipleObjects
VerifierFsRtlCancellableWaitForSingleObject
VerifierFsRtlCheckLockForReadAccess
VerifierFsRtlCheckLockForWriteAccess
VerifierFsRtlCopyWrite
VerifierFsRtlDeregisterUncProvider
VerifierFsRtlDissectName
VerifierFsRtlDoesNameContainWildCards
VerifierFsRtlFastCheckLockForRead
VerifierFsRtlFastCheckLockForWrite
VerifierFsRtlFastUnlockAll
VerifierFsRtlFastUnlockAllByKey
VerifierFsRtlFastUnlockSingle
VerifierFsRtlFreeFileLock
VerifierFsRtlGetFileSize
VerifierFsRtlGetNextFileLock
VerifierFsRtlIncrementCcFastReadNoWait
VerifierFsRtlIncrementCcFastReadWait
VerifierFsRtlInitializeFileLock
VerifierFsRtlIsNameInExpression
VerifierFsRtlMdlReadCompleteDev
VerifierFsRtlMdlWriteCompleteDev
VerifierFsRtlNotifyFilterChangeDirectory
VerifierFsRtlNotifyFilterReportChange
VerifierFsRtlNotifyFullChangeDirectory
VerifierFsRtlNotifyFullReportChange
VerifierFsRtlPrivateLock
VerifierFsRtlProcessFileLock
VerifierFsRtlRegisterUncProvider
VerifierFsRtlRegisterUncProviderEx
VerifierFsRtlRemoveDotsFromPath
VerifierFsRtlUninitializeFileLock
VerifierFsRtlValidateReparsePointBuffer
VerifierHalExamineMBR
VerifierIoAcquireCancelSpinLock
VerifierIoAcquireRemoveLockEx
VerifierIoAcquireVpbSpinLock
VerifierIoAllocateController
VerifierIoAllocateDriverObjectExtension
VerifierIoAllocateErrorLogEntry
VerifierIoAllocateIrp
VerifierIoAllocateIrpEx
VerifierIoAllocateMdl
VerifierIoAllocateWorkItem
VerifierIoAttachDevice
VerifierIoAttachDeviceToDeviceStack
VerifierIoAttachDeviceToDeviceStackSafe
VerifierIoCancelIrp
VerifierIoCheckShareAccess
VerifierIoConnectInterrupt
VerifierIoConnectInterruptEx
VerifierIoCreateController
VerifierIoCreateDevice
VerifierIoCreateFile
VerifierIoCreateFileEx
VerifierIoCreateFileSpecifyDeviceObjectHint
VerifierIoCreateNotificationEvent
VerifierIoCreateSymbolicLink
VerifierIoCreateSynchronizationEvent
VerifierIoCreateUnprotectedSymbolicLink
VerifierIoDeleteController
VerifierIoDeleteDevice
VerifierIoDeleteSymbolicLink
VerifierIoDetachDevice
VerifierIoDisconnectInterrupt
VerifierIoDisconnectInterruptEx
VerifierIoFreeController
VerifierIoFreeMdl
VerifierIoGetAttachedDeviceReference
VerifierIoGetConfigurationInformation
VerifierIoGetDeviceDirectory
VerifierIoGetDeviceInterfaceAlias
VerifierIoGetDeviceInterfaces
VerifierIoGetDeviceNumaNode
VerifierIoGetDeviceObjectPointer
VerifierIoGetDeviceProperty
VerifierIoGetDevicePropertyData
VerifierIoGetDeviceToVerify
VerifierIoGetDriverDirectory
VerifierIoGetFileObjectGenericMapping
VerifierIoGetInitialStack
VerifierIoInitializeIrp
VerifierIoInitializeRemoveLockEx
VerifierIoInitializeWorkItem
VerifierIoInvalidateDeviceRelations
VerifierIoIsWdmVersionAvailable
VerifierIoOpenDeviceInterfaceRegistryKey
VerifierIoOpenDeviceRegistryKey
VerifierIoOpenDriverRegistryKey
VerifierIoRaiseHardError
VerifierIoRaiseInformationalHardError
VerifierIoReadPartitionTable
VerifierIoReadPartitionTableEx
VerifierIoRegisterBootDriverReinitialization
VerifierIoRegisterDeviceInterface
VerifierIoRegisterDriverReinitialization
VerifierIoRegisterLastChanceShutdownNotification
VerifierIoRegisterPlugPlayNotification
VerifierIoRegisterShutdownNotification
VerifierIoReleaseCancelSpinLock
VerifierIoReleaseRemoveLockAndWaitEx
VerifierIoReleaseRemoveLockEx
VerifierIoReleaseVpbSpinLock
VerifierIoRemoveShareAccess
VerifierIoReplacePartitionUnit
VerifierIoReportDetectedDevice
VerifierIoReportTargetDeviceChange
VerifierIoReportTargetDeviceChangeAsynchronous
VerifierIoReuseIrp
VerifierIoSetCompletionRoutineEx
VerifierIoSetDeviceInterfaceState
VerifierIoSetDevicePropertyData
VerifierIoSetDeviceToVerify
VerifierIoSetPartitionInformation
VerifierIoSetPartitionInformationEx
VerifierIoSetShareAccess
VerifierIoSetStartIoAttributes
VerifierIoStartNextPacket
VerifierIoUnregisterPlugPlayNotification
VerifierIoUnregisterPlugPlayNotificationEx
VerifierIoUnregisterShutdownNotification
VerifierIoUpdateShareAccess
VerifierIoVolumeDeviceToDosName
VerifierIoWMIAllocateInstanceIds
VerifierIoWMIRegistrationControl
VerifierIoWMIWriteEvent
VerifierIoWriteErrorLogEntry
VerifierIoWritePartitionTable
VerifierIoWritePartitionTableEx
VerifierIofCompleteRequest
VerifierKeAcquireGuardedMutex
VerifierKeAcquireGuardedMutexUnsafe
VerifierKeAcquireInStackQueuedSpinLockAtDpcLevel
VerifierKeAcquireInStackQueuedSpinLockCommon
VerifierKeAcquireInStackQueuedSpinLockForDpc
VerifierKeAcquireInStackQueuedSpinLockRaiseToSynch
VerifierKeAcquireInterruptSpinLock
VerifierKeAcquireQueuedSpinLock
VerifierKeAcquireQueuedSpinLockRaiseToSynch
VerifierKeAcquireSpinLockAtDpcLevel
VerifierKeAcquireSpinLockForDpc
VerifierKeAcquireSpinLockRaiseToDpc
VerifierKeAreAllApcsDisabled
VerifierKeAreApcsDisabled
VerifierKeCancelTimer
VerifierKeClearEvent
VerifierKeDelayExecutionThread
VerifierKeDeregisterNmiCallback
VerifierKeEnterCriticalRegion
VerifierKeEnterGuardedRegion
VerifierKeFlushQueuedDpcs
VerifierKeInitializeDeviceQueue
VerifierKeInitializeEvent
VerifierKeInitializeGuardedMutex
VerifierKeInitializeMutant
VerifierKeInitializeMutex
VerifierKeInitializeSemaphore
VerifierKeInitializeTimer
VerifierKeInitializeTimerEx
VerifierKeInsertByKeyDeviceQueue
VerifierKeInsertDeviceQueue
VerifierKeInsertHeadQueue
VerifierKeInsertQueue
VerifierKeInsertQueueDpc
VerifierKeLeaveCriticalRegion
VerifierKeLeaveGuardedRegion
VerifierKeLowerIrql
VerifierKePulseEvent
VerifierKeQueryPriorityThread
VerifierKeQueryRuntimeThread
VerifierKeReadStateEvent
VerifierKeReadStateMutex
VerifierKeReadStateSemaphore
VerifierKeReadStateTimer
VerifierKeRegisterNmiCallback
VerifierKeReleaseGuardedMutex
VerifierKeReleaseGuardedMutexUnsafe
VerifierKeReleaseInStackQueuedSpinLock
VerifierKeReleaseInStackQueuedSpinLockForDpc
VerifierKeReleaseInStackQueuedSpinLockFromDpcLevel
VerifierKeReleaseInterruptSpinLock
VerifierKeReleaseMutant
VerifierKeReleaseMutex
VerifierKeReleaseQueuedSpinLock
VerifierKeReleaseSemaphore
VerifierKeReleaseSpinLock
VerifierKeReleaseSpinLockForDpc
VerifierKeReleaseSpinLockFromDpcLevel
VerifierKeRemoveByKeyDeviceQueue
VerifierKeRemoveDeviceQueue
VerifierKeRemoveEntryDeviceQueue
VerifierKeRemoveQueue
VerifierKeRemoveQueueDpc
VerifierKeResetEvent
VerifierKeRestoreExtendedProcessorState
VerifierKeSaveExtendedProcessorState
VerifierKeSetEvent
VerifierKeSetSystemGroupAffinityThread
VerifierKeSetTimer
VerifierKeSetTimerEx
VerifierKeSynchronizeExecution
VerifierKeTestSpinLock
VerifierKeTryToAcquireGuardedMutex
VerifierKeTryToAcquireQueuedSpinLock
VerifierKeTryToAcquireQueuedSpinLockRaiseToSynch
VerifierKeTryToAcquireSpinLockAtDpcLevel
VerifierKeWaitForMultipleObjects
VerifierKeWaitForSingleObject
VerifierMmAddPhysicalMemory
VerifierMmAllocateContiguousMemory
VerifierMmAllocateContiguousMemoryEx
VerifierMmAllocateContiguousMemorySpecifyCache
VerifierMmAllocateContiguousMemorySpecifyCacheNode
VerifierMmAllocateContiguousNodeMemory
VerifierMmAllocateMappingAddress
VerifierMmAllocateNodePagesForMdlEx
VerifierMmAllocateNonCachedMemory
VerifierMmAllocatePagesForMdl
VerifierMmAllocatePagesForMdlEx
VerifierMmBuildMdlForNonPagedPool
VerifierMmCreateMdl
VerifierMmCreateMirror
VerifierMmCreateSection
VerifierMmDoesFileHaveUserWritableReferences
VerifierMmFreeContiguousMemory
VerifierMmFreeContiguousMemorySpecifyCache
VerifierMmFreeNonCachedMemory
VerifierMmFreePagesFromMdl
VerifierMmGetPhysicalMemoryRanges
VerifierMmGetSystemRoutineAddress
VerifierMmLockPagableDataSection
VerifierMmLockPagableSectionByHandle
VerifierMmMapIoSpace
VerifierMmMapLockedPages
VerifierMmMapLockedPagesSpecifyCache
VerifierMmMapLockedPagesWithReservedMapping
VerifierMmMapViewOfSection
VerifierMmPageEntireDriver
VerifierMmPrefetchPages
VerifierMmProbeAndLockPages
VerifierMmProbeAndLockProcessPages
VerifierMmProtectMdlSystemAddress
VerifierMmRemovePhysicalMemory
VerifierMmResetDriverPaging
VerifierMmSecureVirtualMemory
VerifierMmUnlockPagableImageSection
VerifierMmUnlockPages
VerifierMmUnmapIoSpace
VerifierMmUnmapLockedPages
VerifierMmUnsecureVirtualMemory
VerifierNtCreateFile
VerifierNtCreateSection
VerifierNtDeleteFile
VerifierNtLockFile
VerifierNtMapViewOfSection
VerifierNtOpenFile
VerifierNtReadFile
VerifierNtSetInformationFile
VerifierNtUnlockFile
VerifierNtWriteFile
VerifierObGetObjectSecurity
VerifierObReferenceObjectByHandle
VerifierObReferenceObjectByHandleWithTag
VerifierObReferenceObjectByPointer
VerifierObReferenceObjectByPointerWithTag
VerifierObReleaseObjectSecurity
VerifierObfDereferenceObject
VerifierObfDereferenceObjectWithTag
VerifierObfReferenceObject
VerifierObfReferenceObjectWithTag
VerifierPoCallDriver
VerifierPoFxActivateComponent
VerifierPoFxCompleteDevicePowerNotRequired
VerifierPoFxCompleteIdleCondition
VerifierPoFxCompleteIdleState
VerifierPoFxIdleComponent
VerifierPoFxNotifySurprisePowerOn
VerifierPoFxPowerControl
VerifierPoFxRegisterDevice
VerifierPoFxReportDevicePoweredOn
VerifierPoFxSetComponentLatency
VerifierPoFxSetComponentResidency
VerifierPoFxSetComponentWake
VerifierPoFxSetDeviceIdleTimeout
VerifierPoFxStartDevicePowerManagement
VerifierPoFxUnregisterDevice
VerifierPoRequestPowerIrp
VerifierPortExAllocatePoolWithQuotaTag
VerifierPortExAllocatePoolWithTagPriority
VerifierPortIoAllocateIrp
VerifierPortIoAllocateMdl
VerifierPortIoAllocateWorkItem
VerifierPortKeReleaseSpinLock
VerifierProbeForRead
VerifierProbeForWrite
VerifierPsAssignImpersonationToken
VerifierPsCreateSystemThread
VerifierPsDereferenceImpersonationToken
VerifierPsDereferencePrimaryToken
VerifierPsDisableImpersonation
VerifierPsGetVersion
VerifierPsImpersonateClient
VerifierPsReferenceImpersonationToken
VerifierPsReferencePrimaryToken
VerifierPsRemoveLoadImageNotifyRoutine
VerifierPsRestoreImpersonation
VerifierPsRevertToSelf
VerifierPsSetCreateProcessNotifyRoutine
VerifierPsSetCreateProcessNotifyRoutineEx
VerifierPsSetCreateThreadNotifyRoutine
VerifierPsSetLoadImageNotifyRoutine
VerifierPsTerminateSystemThread
VerifierRtlAnsiStringToUnicodeString
VerifierRtlCheckRegistryKey
VerifierRtlCompareUnicodeString
VerifierRtlCreateRegistryKey
VerifierRtlCreateSystemVolumeInformationFolder
VerifierRtlCreateUnicodeString
VerifierRtlDeleteRegistryValue
VerifierRtlDowncaseUnicodeChar
VerifierRtlDowncaseUnicodeString
VerifierRtlDuplicateUnicodeString
VerifierRtlEqualUnicodeString
VerifierRtlFreeUnicodeString
VerifierRtlGUIDFromString
VerifierRtlGenerateClass5Guid
VerifierRtlHashUnicodeString
VerifierRtlOemStringToCountedUnicodeString
VerifierRtlOemStringToUnicodeString
VerifierRtlQueryRegistryValueWithFallback
VerifierRtlQueryRegistryValues
VerifierRtlQueryRegistryValuesEx
VerifierRtlStringFromGUID
VerifierRtlUTF8ToUnicodeN
VerifierRtlUnicodeStringToAnsiString
VerifierRtlUnicodeStringToCountedOemString
VerifierRtlUnicodeStringToOemString
VerifierRtlUnicodeToUTF8N
VerifierRtlUpcaseUnicodeChar
VerifierRtlUpcaseUnicodeString
VerifierRtlUpcaseUnicodeStringToAnsiString
VerifierRtlUpcaseUnicodeStringToCountedOemString
VerifierRtlUpcaseUnicodeStringToOemString
VerifierRtlWriteRegistryValue
VerifierRtlxAnsiStringToUnicodeSize
VerifierRtlxUnicodeStringToAnsiSize
VerifierSeAccessCheck
VerifierSeAssignSecurity
VerifierSeAssignSecurityEx
VerifierSeDeassignSecurity
VerifierSeLockSubjectContext
VerifierSeReleaseSubjectContext
VerifierSeSinglePrivilegeCheck
VerifierSeUnlockSubjectContext
VerifierSeValidSecurityDescriptor
VerifierZwAccessCheckAndAuditAlarm
VerifierZwAddBootEntry
VerifierZwAddDriverEntry
VerifierZwAdjustPrivilegesToken
VerifierZwAllocateLocallyUniqueId
VerifierZwAllocateVirtualMemory
VerifierZwAlpcAcceptConnectPort
VerifierZwAlpcConnectPort
VerifierZwAlpcCreatePort
VerifierZwAlpcCreatePortSection
VerifierZwAlpcCreateResourceReserve
VerifierZwAlpcCreateSectionView
VerifierZwAlpcCreateSecurityContext
VerifierZwAlpcQueryInformation
VerifierZwAlpcSendWaitReceivePort
VerifierZwAlpcSetInformation
VerifierZwCancelIoFile
VerifierZwCancelTimer
VerifierZwClose
VerifierZwCloseObjectAuditAlarm
VerifierZwCommitComplete
VerifierZwCommitEnlistment
VerifierZwCommitTransaction
VerifierZwConnectPort
VerifierZwCreateDirectoryObject
VerifierZwCreateEnlistment
VerifierZwCreateEvent
VerifierZwCreateFile
VerifierZwCreateJobObject
VerifierZwCreateKey
VerifierZwCreateKeyTransacted
VerifierZwCreateResourceManager
VerifierZwCreateSection
VerifierZwCreateSymbolicLinkObject
VerifierZwCreateTimer
VerifierZwCreateTransaction
VerifierZwCreateTransactionManager
VerifierZwDeleteBootEntry
VerifierZwDeleteFile
VerifierZwDeleteKey
VerifierZwDeleteValueKey
VerifierZwDeviceIoControlFile
VerifierZwDisplayString
VerifierZwDuplicateObject
VerifierZwDuplicateToken
VerifierZwEnumerateBootEntries
VerifierZwEnumerateDriverEntries
VerifierZwEnumerateKey
VerifierZwEnumerateTransactionObject
VerifierZwEnumerateValueKey
VerifierZwFlushBuffersFile
VerifierZwFlushBuffersFileEx
VerifierZwFlushInstructionCache
VerifierZwFlushKey
VerifierZwFlushVirtualMemory
VerifierZwFreeVirtualMemory
VerifierZwFsControlFile
VerifierZwGetNotificationResourceManager
VerifierZwLoadDriver
VerifierZwLoadKey
VerifierZwLockFile
VerifierZwMapViewOfSection
VerifierZwModifyBootEntry
VerifierZwModifyDriverEntry
VerifierZwNotifyChangeKey
VerifierZwOpenDirectoryObject
VerifierZwOpenEnlistment
VerifierZwOpenEvent
VerifierZwOpenFile
VerifierZwOpenJobObject
VerifierZwOpenKey
VerifierZwOpenKeyEx
VerifierZwOpenKeyTransacted
VerifierZwOpenKeyTransactedEx
VerifierZwOpenProcess
VerifierZwOpenProcessToken
VerifierZwOpenProcessTokenEx
VerifierZwOpenResourceManager
VerifierZwOpenSection
VerifierZwOpenSymbolicLinkObject
VerifierZwOpenThread
VerifierZwOpenThreadToken
VerifierZwOpenThreadTokenEx
VerifierZwOpenTimer
VerifierZwOpenTransaction
VerifierZwOpenTransactionManager
VerifierZwPowerInformation
VerifierZwPrePrepareComplete
VerifierZwPrePrepareEnlistment
VerifierZwPrepareComplete
VerifierZwPrepareEnlistment
VerifierZwProtectVirtualMemory
VerifierZwPulseEvent
VerifierZwQueryBootEntryOrder
VerifierZwQueryBootOptions
VerifierZwQueryDefaultLocale
VerifierZwQueryDefaultUILanguage
VerifierZwQueryDirectoryFile
VerifierZwQueryDirectoryFileEx
VerifierZwQueryDirectoryObject
VerifierZwQueryDriverEntryOrder
VerifierZwQueryEaFile
VerifierZwQueryFullAttributesFile
VerifierZwQueryInformationEnlistment
VerifierZwQueryInformationFile
VerifierZwQueryInformationJobObject
VerifierZwQueryInformationProcess
VerifierZwQueryInformationResourceManager
VerifierZwQueryInformationThread
VerifierZwQueryInformationToken
VerifierZwQueryInformationTransaction
VerifierZwQueryInformationTransactionManager
VerifierZwQueryInstallUILanguage
VerifierZwQueryKey
VerifierZwQueryLicenseValue
VerifierZwQueryObject
VerifierZwQueryQuotaInformationFile
VerifierZwQuerySection
VerifierZwQuerySecurityObject
VerifierZwQuerySymbolicLinkObject
VerifierZwQuerySystemInformation
VerifierZwQueryValueKey
VerifierZwQueryVolumeInformationFile
VerifierZwReadFile
VerifierZwReadOnlyEnlistment
VerifierZwRecoverEnlistment
VerifierZwRecoverTransactionManager
VerifierZwRemoveIoCompletionEx
VerifierZwRenameKey
VerifierZwReplaceKey
VerifierZwRequestWaitReplyPort
VerifierZwResetEvent
VerifierZwRestoreKey
VerifierZwRollbackComplete
VerifierZwRollbackEnlistment
VerifierZwRollbackTransaction
VerifierZwSetBootEntryOrder
VerifierZwSetBootOptions
VerifierZwSetDriverEntryOrder
VerifierZwSetEaFile
VerifierZwSetEvent
VerifierZwSetInformationEnlistment
VerifierZwSetInformationFile
VerifierZwSetInformationJobObject
VerifierZwSetInformationKey
VerifierZwSetInformationObject
VerifierZwSetInformationProcess
VerifierZwSetInformationResourceManager
VerifierZwSetInformationThread
VerifierZwSetInformationToken
VerifierZwSetInformationTransaction
VerifierZwSetQuotaInformationFile
VerifierZwSetSecurityObject
VerifierZwSetSystemInformation
VerifierZwSetSystemTime
VerifierZwSetTimer
VerifierZwSetTimerEx
VerifierZwSetValueKey
VerifierZwSetVolumeInformationFile
VerifierZwTerminateProcess
VerifierZwTranslateFilePath
VerifierZwUnloadDriver
VerifierZwUnloadKey
VerifierZwUnlockFile
VerifierZwUnmapViewOfSection
VerifierZwWaitForMultipleObjects
VerifierZwWaitForSingleObject
VerifierZwWriteFile
VfAllocateAdapterChannel
VfAllocateAdapterChannelEx
VfAllocateCommonBuffer
VfAllocateCommonBufferEx
VfAllocateCommonBufferVector
VfAllocateCommonBufferWithBounds
VfAllocateCrashDumpRegisters
VfAllocateCrashDumpRegistersEx
VfAllocateDomainCommonBuffer
VfAvlEnumerateNodes
VfBuildMdlFromScatterGatherList
VfBuildScatterGatherList
VfBuildScatterGatherListEx
VfCalculateScatterGatherListSize
VfCancelAdapterChannel
VfCancelMappedTransfer
VfConfigureAdapterChannel
VfCreateCommonBufferFromMdl
VfExAllocPoolInternal
VfFlushAdapterBuffers
VfFlushAdapterBuffersEx
VfFlushDmaBuffer
VfFreeAdapterChannel
VfFreeAdapterObject
VfFreeCommonBuffer
VfFreeCommonBufferFromVector
VfFreeCommonBufferVector
VfFreeCrashDumpRegistersEx
VfFreeMapRegisters
VfGetCommonBufferFromVectorByIndex
VfGetDmaAdapter
VfGetDmaAdapterInfo
VfGetDmaAlignment
VfGetDmaDomain
VfGetDmaTransferInfo
VfGetScatterGatherList
VfGetScatterGatherListEx
VfHalAllocateMapRegisters
VfInitializeDmaTransferContext
VfIoFreeIrp
VfIrpDatabaseEntryReleaseLock
VfJoinDmaDomain
VfLeaveDmaDomain
VfMajorAdvanceIrpStatus
VfMajorBuildIrpLogEntry
VfMajorIsNewRequest
VfMajorIsValidIrpStatus
VfMajorTestStartedPdoStack
VfMajorVerifyFinalIrpStack
VfMajorVerifyIrpStackDownward
VfMajorVerifyIrpStackUpward
VfMajorVerifyNewIrp
VfMajorVerifyNewRequest
VfMapTransfer
VfMapTransferEx
VfNotifyOfHibernate
VfPendingMoreProcessingRequired
VfPutDmaAdapter
VfPutScatterGatherList
VfQueryDispatchTable
VfReadDmaCounter
VfRemoveContext
ViAdapterCallback
ViCtxIsr
ViCtxIsrMessageBased
ViKeAcquireSpinLockCommon
ViPendingCompleteAfterWait
ViPtCaptureTraceInformationCallBack
ViScatterGatherCallback
ViSpecialAllocateCommonBuffer
ViSpecialFreeCommonBuffer
ViXdvDriverLoadImage
ViXdvSetXdvKernelUtilities
VmpCleanProcessAddressSpace
VmpPrefetchVirtualAddresses
VslHandleKsrCall
VslpIumPhase0Initialize
WdInstrExecuteInstruction
WdtpBarkWorkerThread
WdtpTimerCallback
WheaFlushETWEventsWorkerRoutine
WheaInitialize
WheaReportHwError
WheaSignalHandlerOverride
WheapCallErrorSourceCorrect
WheapCallErrorSourceInitialize
WheapCallErrorSourceRecover
WheapCallErrorSourceUninitialize
WheapCallInUsePageNotificationCallbacks
WheapDeferredRecoveryServiceDpcRoutine
WheapDeferredRecoveryServiceWorker
WheapGenericErrSrcRecover
WheapLogIpmiSELEventHighIrql
WheapReportBootError
WheapWorkQueueWorkerRoutine
WmipForwardWmiIrp
WmipProcessEvent
WmipUnreferenceEntry
WritePortWithIndex16
WritePortWithIndex32
WritePortWithIndex8
WriteRegisterWithIndex16
WriteRegisterWithIndex32
WriteRegisterWithIndex64
WriteRegisterWithIndex8
XdvExInitializeLookasideListExInternal
XdvExInitializeNPagedLookasideListInternal
XdvIoAllocateIrp
XdvIoAllocateMdl
XdvIoAllocateWorkItem
XdvIoBuildDeviceIoControlRequest
XdvIoBuildSynchronousFsdRequest
XdvIopBuildAsynchronousFsdRequest
XmEmulateStream
XmInt1aFindPciClassCode
XmInt1aFindPciDevice
XmInt1aReadConfigRegister
XmInt1aWriteConfigRegister
_CmAddDeviceToContainer
_CmAddPanelDevice
_CmClassFilterCallback
_CmClassSubkeyCallback
_CmContainerListGenericObjectCallback
_CmCreateDevice
_CmCreateDeviceContainer
_CmCreateDeviceInterface
_CmCreateDevicePanel
_CmCreateInstallerClass
_CmCreateInterfaceClass
_CmDeleteCommonClassRegKey
_CmDeleteDevice
_CmDeleteDeviceContainer
_CmDeleteDeviceContainerRegKey
_CmDeleteDeviceInterface
_CmDeleteDeviceInterfaceRegKey
_CmDeleteDevicePanel
_CmDeleteDevicePanelRegKey
_CmDeleteDeviceRegKey
_CmDeleteInstallerClass
_CmDeleteInterfaceClass
_CmDeviceClassesSubkeyCallback
_CmDevicePanelEnumSubkeyCallback
_CmEnumDevicesInContainerWithCallback
_CmEnumDevicesInContainerWithCallbackWorker
_CmEnumSubkeyCallback
_CmGetDeviceRegProp
_CmGetInstallerClassRegProp
_CmGetMatchingCommonClassList
_CmGetMatchingDeviceContainerList
_CmGetMatchingDeviceInterfaceList
_CmGetMatchingDeviceList
_CmGetMatchingDevicePanelList
_CmGetMatchingFilteredDeviceInterfaceList
_CmGetMatchingFilteredDeviceList
_CmIsDeviceInterfaceEnabled
_CmOpenCommonClassRegKey
_CmOpenDeviceContainerRegKey
_CmOpenDeviceInterfaceRegKey
_CmOpenDevicePanelRegKey
_CmOpenDeviceRegKey
_CmRaiseCreateEvent
_CmRaiseDeleteEvent
_CmRaisePropertyChangeEvent
_CmRemoveDeviceFromContainer
_CmRemovePanelDevice
_CmServiceFilterCallback
_CmSetDeviceRegProp
_CmSetInstallerClassRegProp
_NtPlugPlayGetDeviceProperty
_NtPlugPlayGetDeviceRelatedDevice
_NtPlugPlayGetDeviceRelationsList
_NtPlugPlayGetDeviceStatus
_PnpCmMatchCallbackRoutine
_PnpContainerRaiseDevicesChangeEvent
_PnpCreateObject
_PnpCreateObjectDispatch
_PnpCtxInternalEnumKeyCallback
_PnpCtxRegQueryValueIndirect
_PnpDeleteObject
_PnpDeleteObjectDispatch
_PnpDeviceRaisePropertyChangeEventWorker
_PnpGetMappedPropertyDispatch
_PnpGetMappedPropertyKeysDispatch
_PnpGetMappedPropertyLocalesDispatch
_PnpGetObjectList
_PnpGetObjectListDispatch
_PnpGetObjectProperty
_PnpGetObjectPropertyKeys
_PnpGetObjectPropertyLocales
_PnpInstallerClassRaisePropertyChangeEventWorker
_PnpInterfaceClassRaisePropertyChangeEventWorker
_PnpInterfaceRaisePropertyChangeEventWorker
_PnpNotifyDerivedKeys
_PnpObjectListCallback
_PnpObjectRaiseCreateEvent
_PnpObjectRaiseDeleteEvent
_PnpObjectRaiseDevicesChangeEvent
_PnpObjectRaisePropertyChangeEvent
_PnpOpenObjectRegKey
_PnpOpenObjectRegKeyDispatch
_PnpSetMappedPropertyDispatch
_PnpSetObjectProperty
_PnpUpdateInterfacesCallback
_PnpValidateObjectName
_PnpValidateObjectNameDispatch
_RegRtlOpenKeyTransacted
_SysCtxInternalEnumSubkeyCallback
_tlgEnableCallback
entry
pIoQueryBusDescription
pIoQueryDeviceDescription
qsort
qsort_s
vDbgPrintExWithPrefixInternal
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
x86BiosGetPciBusData
x86BiosReadPciDataPort
x86BiosSetPciBusData
x86BiosWritePciDataPort
Expand for full list:
AlpcpAllocateBlob
AlpcpDeleteBlob
AlpcpDestroyBlob
AlpcpInvokeLogCallbacks
AlpcpUnlockBlob
Amd64OverflowHandler
AnFwDisplayBackgroundUpdate
AnFwpBackgroundUpdateTimer
ArbAllocateEntry
ArbArbiterHandler
ArbBootAllocationArbBuildAssignmentOrdering
ArbFindSuitableRange
ArbInitializeRangeList
ArbQueryConflict
ArbRetestAllocation
ArbStartArbiter
ArbTestAllocation
ArbpBuildAlternative
AslLogCallPrintf
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDecrypt
BCryptDestroyHash
BCryptDestroyKey
BCryptEncrypt
BCryptFinishHash
BCryptGenRandom
BCryptGenerateSymmetricKey
BCryptGetProperty
BCryptHashData
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSetProperty
B_TREE<unsigned_long,struct_ST_STORE<struct_SM_TRAITS>::_ST_REGION_ENTRY,4096,struct_NP_CONTEXT,struct_ST_STORE<struct_SM_TRAITS>::ST_REGION_ENTRY_COMPARATOR>::BTreeWalkPostOrderInternal
BapdRecordFirmwareBootStats
BapdpKsrCancelScenario
BapdpKsrCompleteScenario
BapdpKsrCompleteScenarioPhase0
BapdpKsrInitiateScenarioPhase0
BapdpKsrpInitiateScenario
BcpDisplayEarlyBugCheckScreen
BgkAcquireDisplayOwnership
BgkDisplayCharacter
BgkDisplayStringEx
BgkGetConsoleState
BgkGetCursorState
BgkInitialize
BgkNotifyDisplayOwnershipChange
BgkSetCursor
BgkSetTextColor
BgkSolidColorFill
BgkpResetDisplay
BvgaAcquireDisplayOwnership
CarLiveDumpCallBack
CcAcquireByteRangeForWrite
CcAllocateWorkQueueEntry
CcCompleteAsyncRead
CcCompleteAsyncRead$fin$1
CcDeferWrite
CcForEachNumaNode
CcForEachPartition
CcForEachPrivateVolumeCacheMap
CcFreeWorkQueueEntry
CcGetDirtyPagesHelper
CcMdlReadComplete
CcMdlWriteComplete
CcNotifyExternalCachesInternal
CcPerformReadAhead
CcPerformReadAhead$fin$1
CcPostDeferredWrites
CcRegistryChangeCallback
CcScanLogHandleList
CcSetDirtyInMask
CcUnmapInactiveViewsInternal
CcWriteBehindPreProcess
CcWriteBehindReleaseFile
CmCheckRegistry
CmFcpChangeSubscriptionWrapper
CmKtmNotification
CmOpenKey
CmSetAcpiHwProfile
CmUnRegisterCallback
CmpAcceptBoot
CmpAddDriverToList
CmpAddSecurityCellToCache
CmpAddSubKeyToList
CmpAdjustSecurityCacheSize
CmpCallCallBacksEx
CmpCheckRegistry2
CmpCleanupPathInfo
CmpCloseKeyObject
CmpCreateKeyBody
CmpDestroySecurityCache
CmpDoParseKey
CmpEnableLazyFlushDpcRoutine$fin$1
CmpEnumerateAllHigherLayerKcbs
CmpEnumerateKcbCacheBucket
CmpEtwDumpKcb
CmpExpandPathInfo
CmpFireCleanupNotifications
CmpFreeDriverList
CmpFreeExtraParameter
CmpGetNodeName
CmpGetSymbolicLinkTarget
CmpIsLoadType
CmpLazyFlushDpcRoutine$filt$1
CmpLazyWriteWorker
CmpMachineHiveLoadedWorkItem
CmpRemoveFromSecurityCache
CmpReplicateKeyToVirtual
CmpSearchKeyControlBlockTreeEx
CmpSecurityMethod
CmpSystemHiveHysteresisWorker
CmpWorkItemWrapper
DbgkCaptureLiveDump
DbgkpLkmdEnumApcOrDpcDataCallback
DbgkpLkmdFireCallbacks
DbgkpLkmdIsMemoryBlockPresentFromCallback
DbgkpLkmdSnapData
DbgkpLkmdSnapDataEx
DbgkpLkmdSnapGlobals
DbgkpLkmdSnapKernelStack
DbgkpLkmdSnapKernelStackSegmentCallback
DbgkpLkmdSnapObject
DbgkpWerInvokeCallbacks
DefaultOverflowHandler
DifAddDeviceWrapper
DifCcCopyWriteExWrapper
DifCcCopyWriteWrapper
DifCcDeferWriteWrapper
DifCcFastCopyWriteWrapper
DifCmRegisterCallbackExWrapper
DifCmRegisterCallbackWrapper
DifCmUnRegisterCallbackWrapper
DifDeregisterPlugin
DifDriverCancelWrapper
DifDriverEntryWrapper
DifDriverStartIoWrapper
DifDriverUnloadWrapper
DifEtwRegisterWrapper
DifEtwUnregisterWrapper
DifExAcquireFastMutexUnsafeWrapper
DifExAcquireFastMutexWrapper
DifExAcquireResourceExclusiveLiteWrapper
DifExAcquireResourceSharedLiteWrapper
DifExAcquireSharedStarveExclusiveWrapper
DifExAcquireSharedWaitForExclusiveWrapper
DifExAllocatePool2Wrapper
DifExAllocatePool3Wrapper
DifExAllocatePoolWithQuotaTagWrapper
DifExAllocatePoolWithQuotaWrapper
DifExAllocatePoolWithTagPriorityWrapper
DifExAllocatePoolWithTagWrapper
DifExAllocatePoolWrapper
DifExConvertExclusiveToSharedLiteWrapper
DifExCreateCallbackWrapper
DifExDeleteLookasideListExWrapper
DifExDeleteNPagedLookasideListWrapper
DifExDeletePagedLookasideListWrapper
DifExDeleteResourceLiteWrapper
DifExEnterCriticalRegionAndAcquireResourceExclusiveWrapper
DifExEnterCriticalRegionAndAcquireResourceSharedWrapper
DifExEnterCriticalRegionAndAcquireSharedWaitForExclusiveWrapper
DifExEnterPriorityRegionAndAcquireResourceExclusiveWrapper
DifExEnterPriorityRegionAndAcquireResourceSharedWrapper
DifExFreePoolWithTagWrapper
DifExFreePoolWrapper
DifExInitializeLookasideListExWrapper
DifExInitializeNPagedLookasideListWrapper
DifExInitializePagedLookasideListWrapper
DifExInitializeResourceLiteWrapper
DifExIsProcessorFeaturePresentWrapper
DifExRaiseAccessViolationWrapper
DifExRaiseDatatypeMisalignmentWrapper
DifExRaiseStatusWrapper
DifExRegisterCallbackWrapper
DifExReleaseFastMutexUnsafeWrapper
DifExReleaseFastMutexWrapper
DifExReleaseResourceAndLeaveCriticalRegionWrapper
DifExReleaseResourceAndLeavePriorityRegionWrapper
DifExReleaseResourceForThreadLiteWrapper
DifExReleaseResourceLiteWrapper
DifExSetTimerResolutionWrapper
DifExTryToAcquireFastMutexWrapper
DifExUnregisterCallbackWrapper
DifExUuidCreateWrapper
DifExfAcquirePushLockExclusiveWrapper
DifExfAcquirePushLockSharedWrapper
DifExfReleasePushLockSharedWrapper
DifExfReleasePushLockWrapper
DifExfTryAcquirePushLockSharedWrapper
DifExfTryToWakePushLockWrapper
DifHalAllocateCrashDumpRegistersWrapper
DifHalDmaAllocateCrashDumpRegistersExWrapper
DifHalDmaFreeCrashDumpRegistersExWrapper
DifIRP_MJ_CLEANUPWrapper
DifIRP_MJ_CLOSEWrapper
DifIRP_MJ_CREATEWrapper
DifIRP_MJ_CREATE_MAILSLOTWrapper
DifIRP_MJ_CREATE_NAMED_PIPEWrapper
DifIRP_MJ_DEVICE_CHANGEWrapper
DifIRP_MJ_DEVICE_CONTROLWrapper
DifIRP_MJ_DIRECTORY_CONTROLWrapper
DifIRP_MJ_FILE_SYSTEM_CONTROLWrapper
DifIRP_MJ_FLUSH_BUFFERSWrapper
DifIRP_MJ_INTERNAL_DEVICE_CONTROLWrapper
DifIRP_MJ_LOCK_CONTROLWrapper
DifIRP_MJ_PNPWrapper
DifIRP_MJ_POWERWrapper
DifIRP_MJ_QUERY_EAWrapper
DifIRP_MJ_QUERY_INFORMATIONWrapper
DifIRP_MJ_QUERY_QUOTAWrapper
DifIRP_MJ_QUERY_SECURITYWrapper
DifIRP_MJ_QUERY_VOLUME_INFORMATIONWrapper
DifIRP_MJ_READWrapper
DifIRP_MJ_SET_EAWrapper
DifIRP_MJ_SET_INFORMATIONWrapper
DifIRP_MJ_SET_QUOTAWrapper
DifIRP_MJ_SET_SECURITYWrapper
DifIRP_MJ_SET_VOLUME_INFORMATIONWrapper
DifIRP_MJ_SHUTDOWNWrapper
DifIRP_MJ_SYSTEM_CONTROLWrapper
DifIRP_MJ_WRITEWrapper
DifIoAcquireRemoveLockExWrapper
DifIoAllocateControllerWrapper
DifIoAllocateIrpExWrapper
DifIoAllocateIrpWrapper
DifIoAllocateMdlWrapper
DifIoAllocateWorkItemWrapper
DifIoAttachDeviceWrapper
DifIoBuildAsynchronousFsdRequestWrapper
DifIoBuildDeviceIoControlRequestWrapper
DifIoBuildSynchronousFsdRequestWrapper
DifIoCheckShareAccessWrapper
DifIoConnectInterruptExWrapper
DifIoConnectInterruptWrapper
DifIoCreateControllerWrapper
DifIoCreateDeviceWrapper
DifIoCreateFileExWrapper
DifIoCreateFileSpecifyDeviceObjectHintWrapper
DifIoCreateFileWrapper
DifIoCreateNotificationEventWrapper
DifIoCreateSymbolicLinkWrapper
DifIoCreateSynchronizationEventWrapper
DifIoCreateUnprotectedSymbolicLinkWrapper
DifIoDeleteControllerWrapper
DifIoDeleteDeviceWrapper
DifIoDeleteSymbolicLinkWrapper
DifIoDetachDeviceWrapper
DifIoDisconnectInterruptExWrapper
DifIoDisconnectInterruptWrapper
DifIoFreeControllerWrapper
DifIoFreeIrpWrapper
DifIoFreeMdlWrapper
DifIoGetConfigurationInformationWrapper
DifIoGetDeviceDirectoryWrapper
DifIoGetDeviceObjectPointerWrapper
DifIoGetDeviceToVerifyWrapper
DifIoGetDmaAdapterWrapper
DifIoGetDriverDirectoryWrapper
DifIoGetFileObjectGenericMappingWrapper
DifIoGetInitialStackWrapper
DifIoInitializeRemoveLockExWrapper
DifIoInitializeTimerWrapper
DifIoInitializeWorkItemWrapper
DifIoIsWdmVersionAvailableWrapper
DifIoOpenDeviceInterfaceRegistryKeyWrapper
DifIoOpenDeviceRegistryKeyWrapper
DifIoOpenDriverRegistryKeyWrapper
DifIoRaiseHardErrorWrapper
DifIoRaiseInformationalHardErrorWrapper
DifIoReadPartitionTableWrapper
DifIoRegisterDeviceInterfaceWrapper
DifIoRegisterDriverReinitializationWrapper
DifIoRegisterShutdownNotificationWrapper
DifIoReleaseRemoveLockAndWaitExWrapper
DifIoReleaseRemoveLockExWrapper
DifIoRemoveShareAccessWrapper
DifIoSetCompletionRoutineExWrapper
DifIoSetDeviceInterfaceStateWrapper
DifIoSetDeviceToVerifyWrapper
DifIoSetPartitionInformationWrapper
DifIoSetShareAccessWrapper
DifIoStartNextPacketWrapper
DifIoUnregisterShutdownNotificationWrapper
DifIoUpdateShareAccessWrapper
DifIoWMIAllocateInstanceIdsWrapper
DifIoWMIRegistrationControlWrapper
DifIoWriteErrorLogEntryWrapper
DifIoWritePartitionTableWrapper
DifIofCallDriverWrapper
DifIofCompleteRequestWrapper
DifKeAcquireGuardedMutexUnsafeWrapper
DifKeAcquireGuardedMutexWrapper
DifKeAcquireInStackQueuedSpinLockAtDpcLevelWrapper
DifKeAcquireInStackQueuedSpinLockForDpcWrapper
DifKeAcquireInStackQueuedSpinLockRaiseToSynchWrapper
DifKeAcquireInStackQueuedSpinLockWrapper
DifKeAcquireQueuedSpinLockRaiseToSynchWrapper
DifKeAcquireQueuedSpinLockWrapper
DifKeAcquireSpinLockAtDpcLevelWrapper
DifKeAcquireSpinLockRaiseToDpcWrapper
DifKeCancelTimerWrapper
DifKeClearEventWrapper
DifKeDelayExecutionThreadWrapper
DifKeDeregisterNmiCallbackWrapper
DifKeEnterCriticalRegionWrapper
DifKeEnterGuardedRegionWrapper
DifKeInitializeDeviceQueueWrapper
DifKeInitializeEventWrapper
DifKeInitializeMutantWrapper
DifKeInitializeMutexWrapper
DifKeInitializeSemaphoreWrapper
DifKeInitializeTimerExWrapper
DifKeInitializeTimerWrapper
DifKeInsertByKeyDeviceQueueWrapper
DifKeInsertDeviceQueueWrapper
DifKeInsertQueueDpcWrapper
DifKeLeaveCriticalRegionWrapper
DifKeLeaveGuardedRegionWrapper
DifKeLowerIrqlWrapper
DifKePulseEventWrapper
DifKeRaiseIrqlToDpcLevelWrapper
DifKeReadStateEventWrapper
DifKeReadStateTimerWrapper
DifKeRegisterNmiCallbackWrapper
DifKeReleaseGuardedMutexUnsafeWrapper
DifKeReleaseGuardedMutexWrapper
DifKeReleaseInStackQueuedSpinLockForDpcWrapper
DifKeReleaseInStackQueuedSpinLockFromDpcLevelWrapper
DifKeReleaseInStackQueuedSpinLockWrapper
DifKeReleaseMutantWrapper
DifKeReleaseMutexWrapper
DifKeReleaseQueuedSpinLockWrapper
DifKeReleaseSpinLockFromDpcLevelWrapper
DifKeReleaseSpinLockWrapper
DifKeRemoveByKeyDeviceQueueWrapper
DifKeRemoveDeviceQueueWrapper
DifKeRemoveEntryDeviceQueueWrapper
DifKeRemoveQueueDpcWrapper
DifKeResetEventWrapper
DifKeRestoreExtendedProcessorStateWrapper
DifKeSaveExtendedProcessorStateWrapper
DifKeSetEventWrapper
DifKeSetTimerExWrapper
DifKeSetTimerWrapper
DifKeSynchronizeExecutionWrapper
DifKeTryToAcquireGuardedMutexWrapper
DifKeTryToAcquireQueuedSpinLockRaiseToSynchWrapper
DifKeTryToAcquireQueuedSpinLockWrapper
DifKeTryToAcquireSpinLockAtDpcLevelWrapper
DifKeWaitForMultipleObjectsWrapper
DifKeWaitForSingleObjectWrapper
DifKfRaiseIrqlWrapper
DifMmAllocateContiguousMemoryExWrapper
DifMmAllocateContiguousMemorySpecifyCacheWrapper
DifMmAllocateContiguousMemoryWrapper
DifMmAllocateNonCachedMemoryWrapper
DifMmAllocatePagesForMdlExWrapper
DifMmAllocatePagesForMdlWrapper
DifMmBuildMdlForNonPagedPoolWrapper
DifMmFreeContiguousMemoryWrapper
DifMmFreeNonCachedMemoryWrapper
DifMmFreePagesFromMdlWrapper
DifMmLockPagableDataSectionWrapper
DifMmLockPagableSectionByHandleWrapper
DifMmMapIoSpaceWrapper
DifMmMapLockedPagesSpecifyCacheWrapper
DifMmPageEntireDriverWrapper
DifMmResetDriverPagingWrapper
DifMmSecureVirtualMemoryWrapper
DifMmUnlockPagableImageSectionWrapper
DifMmUnmapLockedPagesWrapper
DifMmUnsecureVirtualMemoryWrapper
DifNtCreateFileWrapper
DifNtDeleteFileWrapper
DifNtOpenFileWrapper
DifNtSetInformationFileWrapper
DifNtWriteFileWrapper
DifObGetObjectSecurityWrapper
DifObReferenceObjectByHandleWrapper
DifObReferenceObjectByPointerWithTagWrapper
DifObReferenceObjectByPointerWrapper
DifObReleaseObjectSecurityWrapper
DifObfDereferenceObjectWithTagWrapper
DifObfDereferenceObjectWrapper
DifObfReferenceObjectWithTagWrapper
DifObfReferenceObjectWrapper
DifPoCallDriverWrapper
DifPoFxActivateComponentWrapper
DifPoFxCompleteDevicePowerNotRequiredWrapper
DifPoFxCompleteIdleConditionWrapper
DifPoFxCompleteIdleStateWrapper
DifPoFxIdleComponentWrapper
DifPoFxNotifySurprisePowerOnWrapper
DifPoFxPowerControlWrapper
DifPoFxRegisterDeviceWrapper
DifPoFxReportDevicePoweredOnWrapper
DifPoFxSetComponentLatencyWrapper
DifPoFxSetComponentResidencyWrapper
DifPoFxSetComponentWakeWrapper
DifPoFxSetDeviceIdleTimeoutWrapper
DifPoFxStartDevicePowerManagementWrapper
DifPoFxUnregisterDeviceWrapper
DifPoRequestPowerIrpWrapper
DifProbeForReadWrapper
DifProbeForWriteWrapper
DifPsCreateSystemThreadWrapper
DifPsGetVersionWrapper
DifPsSetCreateProcessNotifyRoutineWrapper
DifPsSetCreateThreadNotifyRoutineWrapper
DifPsSetLoadImageNotifyRoutineWrapper
DifPsTerminateSystemThreadWrapper
DifRtlAnsiStringToUnicodeStringWrapper
DifRtlCheckRegistryKeyWrapper
DifRtlCreateRegistryKeyWrapper
DifRtlCreateSystemVolumeInformationFolderWrapper
DifRtlCreateUnicodeStringWrapper
DifRtlDeleteRegistryValueWrapper
DifRtlDowncaseUnicodeStringWrapper
DifRtlDuplicateUnicodeStringWrapper
DifRtlOemStringToCountedUnicodeStringWrapper
DifRtlOemStringToUnicodeStringWrapper
DifRtlQueryRegistryValueWithFallbackWrapper
DifRtlQueryRegistryValuesExWrapper
DifRtlQueryRegistryValuesWrapper
DifRtlUnicodeStringToAnsiStringWrapper
DifRtlUnicodeStringToCountedOemStringWrapper
DifRtlUnicodeStringToOemStringWrapper
DifRtlUpcaseUnicodeStringToAnsiStringWrapper
DifRtlUpcaseUnicodeStringToCountedOemStringWrapper
DifRtlUpcaseUnicodeStringToOemStringWrapper
DifRtlUpcaseUnicodeStringWrapper
DifRtlWriteRegistryValueWrapper
DifZwAccessCheckAndAuditAlarmWrapper
DifZwAddBootEntryWrapper
DifZwAddDriverEntryWrapper
DifZwAdjustPrivilegesTokenWrapper
DifZwAllocateVirtualMemoryWrapper
DifZwAlpcAcceptConnectPortWrapper
DifZwAlpcConnectPortWrapper
DifZwAlpcCreatePortSectionWrapper
DifZwAlpcCreatePortWrapper
DifZwAlpcCreateResourceReserveWrapper
DifZwAlpcCreateSectionViewWrapper
DifZwAlpcCreateSecurityContextWrapper
DifZwAlpcQueryInformationWrapper
DifZwAlpcSendWaitReceivePortWrapper
DifZwAlpcSetInformationWrapper
DifZwCancelIoFileWrapper
DifZwCancelTimerWrapper
DifZwCloseObjectAuditAlarmWrapper
DifZwCloseWrapper
DifZwCommitEnlistmentWrapper
DifZwConnectPortWrapper
DifZwCreateDirectoryObjectWrapper
DifZwCreateEnlistmentWrapper
DifZwCreateEventWrapper
DifZwCreateFileWrapper
DifZwCreateJobObjectWrapper
DifZwCreateKeyTransactedWrapper
DifZwCreateKeyWrapper
DifZwCreateResourceManagerWrapper
DifZwCreateSectionWrapper
DifZwCreateSymbolicLinkObjectWrapper
DifZwCreateTimerWrapper
DifZwCreateTransactionManagerWrapper
DifZwCreateTransactionWrapper
DifZwDeleteBootEntryWrapper
DifZwDeleteFileWrapper
DifZwDeleteKeyWrapper
DifZwDeleteValueKeyWrapper
DifZwDeviceIoControlFileWrapper
DifZwDisplayStringWrapper
DifZwDuplicateObjectWrapper
DifZwDuplicateTokenWrapper
DifZwEnumerateBootEntriesWrapper
DifZwEnumerateDriverEntriesWrapper
DifZwEnumerateKeyWrapper
DifZwEnumerateValueKeyWrapper
DifZwFlushBuffersFileExWrapper
DifZwFlushBuffersFileWrapper
DifZwFlushInstructionCacheWrapper
DifZwFlushKeyWrapper
DifZwFlushVirtualMemoryWrapper
DifZwFreeVirtualMemoryWrapper
DifZwFsControlFileWrapper
DifZwGetNotificationResourceManagerWrapper
DifZwLoadDriverWrapper
DifZwLoadKeyWrapper
DifZwMapViewOfSectionWrapper
DifZwModifyBootEntryWrapper
DifZwModifyDriverEntryWrapper
DifZwNotifyChangeKeyWrapper
DifZwOpenDirectoryObjectWrapper
DifZwOpenEnlistmentWrapper
DifZwOpenEventWrapper
DifZwOpenFileWrapper
DifZwOpenJobObjectWrapper
DifZwOpenKeyExWrapper
DifZwOpenKeyTransactedExWrapper
DifZwOpenKeyTransactedWrapper
DifZwOpenKeyWrapper
DifZwOpenProcessTokenExWrapper
DifZwOpenProcessTokenWrapper
DifZwOpenProcessWrapper
DifZwOpenResourceManagerWrapper
DifZwOpenSectionWrapper
DifZwOpenSymbolicLinkObjectWrapper
DifZwOpenThreadTokenExWrapper
DifZwOpenThreadTokenWrapper
DifZwOpenThreadWrapper
DifZwOpenTimerWrapper
DifZwOpenTransactionManagerWrapper
DifZwOpenTransactionWrapper
DifZwPowerInformationWrapper
DifZwPrePrepareEnlistmentWrapper
DifZwPrepareCompleteWrapper
DifZwPrepareEnlistmentWrapper
DifZwProtectVirtualMemoryWrapper
DifZwPulseEventWrapper
DifZwQueryBootEntryOrderWrapper
DifZwQueryBootOptionsWrapper
DifZwQueryDefaultLocaleWrapper
DifZwQueryDefaultUILanguageWrapper
DifZwQueryDirectoryFileExWrapper
DifZwQueryDirectoryFileWrapper
DifZwQueryDirectoryObjectWrapper
DifZwQueryDriverEntryOrderWrapper
DifZwQueryEaFileWrapper
DifZwQueryFullAttributesFileWrapper
DifZwQueryInformationEnlistmentWrapper
DifZwQueryInformationFileWrapper
DifZwQueryInformationJobObjectWrapper
DifZwQueryInformationProcessWrapper
DifZwQueryInformationResourceManagerWrapper
DifZwQueryInformationThreadWrapper
DifZwQueryInformationTokenWrapper
DifZwQueryInformationTransactionManagerWrapper
DifZwQueryInformationTransactionWrapper
DifZwQueryInstallUILanguageWrapper
DifZwQueryKeyWrapper
DifZwQueryLicenseValueWrapper
DifZwQueryObjectWrapper
DifZwQuerySectionWrapper
DifZwQuerySecurityObjectWrapper
DifZwQuerySymbolicLinkObjectWrapper
DifZwQuerySystemInformationWrapper
DifZwQueryValueKeyWrapper
DifZwQueryVolumeInformationFileWrapper
DifZwReadFileWrapper
DifZwRemoveIoCompletionExWrapper
DifZwRenameKeyWrapper
DifZwReplaceKeyWrapper
DifZwRequestWaitReplyPortWrapper
DifZwResetEventWrapper
DifZwRestoreKeyWrapper
DifZwRollbackEnlistmentWrapper
DifZwSetBootEntryOrderWrapper
DifZwSetBootOptionsWrapper
DifZwSetDriverEntryOrderWrapper
DifZwSetEaFileWrapper
DifZwSetEventWrapper
DifZwSetInformationEnlistmentWrapper
DifZwSetInformationFileWrapper
DifZwSetInformationJobObjectWrapper
DifZwSetInformationKeyWrapper
DifZwSetInformationObjectWrapper
DifZwSetInformationProcessWrapper
DifZwSetInformationThreadWrapper
DifZwSetInformationTransactionWrapper
DifZwSetSecurityObjectWrapper
DifZwSetSystemInformationWrapper
DifZwSetSystemTimeWrapper
DifZwSetTimerWrapper
DifZwSetValueKeyWrapper
DifZwSetVolumeInformationFileWrapper
DifZwTranslateFilePathWrapper
DifZwUnloadDriverWrapper
DifZwUnloadKeyWrapper
DifZwWaitForMultipleObjectsWrapper
DifZwWaitForSingleObjectWrapper
DifZwWriteFileWrapper
DisplayBootBitmap
DrvDbGetDriverDatabaseList
DrvDbGetObjectSubKeyCallback
DrvDbLoadDatabaseNode
DrvDbUnloadDatabaseNode
EmonOverflowHandler
EmonPebsOverflowHandler
EmpEvaluateNodeLink
EmpEvaluateUpdateRuleEvalState
EmpUpdateRuleState
EtwGetKernelTraceTimestampSilo
EtwQueryPerformanceTraceInformation
EtwSetPerformanceTraceInformation
EtwpAddLogHeader
EtwpAddRegEntryToGroup
EtwpCancelTraceImageUnloadApc
EtwpClockSourceRunDown
EtwpCompleteBuffer
EtwpCovSampEnumerateProcess
EtwpCovSampLookasideGrow
EtwpCovSampModuleGetName
EtwpCovSampModuleNameInfoCleanup
EtwpCoverageSamplerStart
EtwpEnumerateAddressSpace
EtwpEventWriteFull
EtwpFreeLoggerContext
EtwpGetPmcOwnership
EtwpInitialize
EtwpInitializeLastBranchTracing
EtwpInitializeTimeStamp
EtwpInvokeEventCallback
EtwpLoadMicroarchitecturalProfileSource
EtwpLogContextSwapEvent
EtwpLogPmcCounterRundown
EtwpRegisterKMProvider
EtwpReserveTraceBuffer
EtwpReserveWithPmcCounters
EtwpSampledProfileRunDown
EtwpSendDataBlock
EtwpTraceImageUnloadApc
EtwpTraceLastBranchRecord
EtwpTraceProcessorTrace
EtwpUpdateLastBranchTracingConfiguration
EtwpUpdatePmcCounters
EtwpUpdateProcessorTraceConfiguration
ExAllocateFromLookasideListEx
ExAllocateFromNPagedLookasideList
ExAllocateHeapPool
ExAtsSvmDevicePowerCallback
ExCallCallBack
ExCallSessionCallBack
ExEnumHandleTable
ExFlushLookasideListEx
ExFlushTb
ExFreeHeapPool
ExFreeToLookasideListEx
ExFreeToNPagedLookasideList
ExInitLicenseData
ExInitializeDeviceAts
ExNotifyWithProcessing
ExRegisterExtension
ExSetLicenseTamperState
ExSvmBeginDeviceReset
ExSvmFinalizeDeviceReset
ExUnregisterExtension
ExUpdateLicenseData
ExpAcquireCrossVmMutant
ExpApplyPriorityBoost
ExpAtsDereferenceDevice
ExpBoostIoAfterAcquire
ExpCallProcessing
ExpCenturyDpcRoutine$fin$0
ExpConvertSvmDevice
ExpCreateCrossVmEvent
ExpCreateCrossVmMutant
ExpCrossVmIntHostCallback
ExpCrossVmWnfPush
ExpFinalizeTimerDeletion
ExpFlushGeneralLookaside
ExpGenuinePolicyPostProcess
ExpGetSystemFirmwareTableInformation
ExpInitializeMemoryMirroring
ExpInitializeSessionDriver
ExpInitializeSvm
ExpLicenseWatchInitWorker
ExpObCloseCrossVmEvent
ExpObCloseCrossVmMutant
ExpObDeleteCrossVmEvent
ExpObDeleteCrossVmMutant
ExpPrepareNewAtsDevice
ExpPrepareNewSvmDevice
ExpProfileCreate
ExpPulseCrossVmEvent
ExpQueryCodeIntegrityCertificateInfo
ExpQueryCrossVmEvent
ExpQueryElamCertInfo
ExpQueryNumaProximityNode
ExpQuerySystemInformation
ExpReleaseCrossVmMutant
ExpResetCrossVmEvent
ExpSetCrossVmEvent
ExpSetSoftRebootFlags
ExpShareAddressSpaceWithDevice
ExpSnapShotHandleTables
ExpSvmDereferenceDevice
ExpSvmWorkerThread
ExpTimeRefreshDpcRoutine$filt$3
ExpTimeRefreshWork
ExpTimeZoneDpcRoutine$fin$2
ExpTimerDpcRoutine$filt$1
ExpWaitForBootDevices
ExpWaitForResource
ExpWatchProductTypeWork
ExpWnfDispatchKernelSubscription
ExpWnfPopulateStateData
ExpWorkerThread
FUN_1404167ab
FUN_14066b730
FUN_14066c434
FUN_140687e40
FUN_14068ad70
FUN_14070a1a0
FUN_14070a4d4
FUN_140769944
FUN_140843f7c
FUN_140a4b4b4
FUN_140a4b8a4
FUN_140a4c060
FUN_140a4c2a0
FUN_140a4c7f0
FUN_140a4cda0
FUN_140a4d154
FUN_140a4dae4
FUN_140a4e07c
FUN_140a4e498
FilterEvalImpliedAnd
FilterEvalStrict
FindNodeOrParent
FindNodeOrParent
FsFilterPerformCallbacks
FsFilterPerformCompletionCallbacks
FsRtlAcquireFileExclusiveCommon
FsRtlAcquireFileForCcFlushEx
FsRtlAcquireFileForModWriteEx
FsRtlCompleteLockIrpReal
FsRtlCopyRead
FsRtlCopyWrite
FsRtlFastUnlockSingleExclusive
FsRtlFastUnlockSingleShared
FsRtlFreeExtraCreateParameter
FsRtlGetFileNameInformation
FsRtlGetFileSize
FsRtlGetSupportedFeatures
FsRtlMdlRead
FsRtlMdlReadComplete
FsRtlMdlReadDev
FsRtlMdlWriteComplete
FsRtlMupGetProviderIdFromName
FsRtlMupGetProviderInfoFromFileObject
FsRtlNotifyFilterReportChange
FsRtlNotifyFilterReportChangeLiteEx
FsRtlPrepareMdlWrite
FsRtlPrepareMdlWriteDev
FsRtlPrivateFastUnlockAll
FsRtlReleaseFile
FsRtlReleaseFileForCcFlush
FsRtlReleaseFileForModWrite
FsRtlReleaseFileNameInformation
FsRtlStackOverflowRead
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
FsRtlUninitializeOplock
FsRtlWorkerThread
FsRtlpRemoveAndCompleteWaitingIrp
FsRtlpWaitOnIrp
GetBootSystemTime
GxpReadFrameBufferPixels
GxpWriteFrameBufferPixels
HalAllocateAdapterChannelV2
HalAllocateCommonBuffer
HalAllocateHardwareCounters
HalAssignSlotResources
HalBuildScatterGatherListV2
HalConfigureAdapterChannel
HalCreateCommonBufferFromMdl
HalCreateCommonBufferFromMdlDmaThin
HalCreateCommonBufferFromMdlDmarThin
HalDisableInterrupt
HalDmaAllocateCrashDumpRegistersEx
HalDmaFreeCrashDumpRegistersEx
HalEnableInterrupt
HalFreeCommonBuffer
HalFreeCommonBufferDmaThin
HalFreeCommonBufferDmarThin
HalFreeCommonBufferV3
HalFreeCommonBufferVector
HalFreeHardwareCounters
HalGetAdapterV2
HalGetInterruptVector
HalGetVectorInput
HalJoinDmaDomain
HalMapTransferEx
HalMcFinishMicrocode
HalPerformEndOfInterrupt
HalReadDmaCounter
HalReadDmaCounterV2
HalReturnToFirmware
HalSendNMI
HalSetProfileInterval
HalStopProfileInterrupt
HalTranslateBusAddress
HaliAcpiSleep
HaliLocateHiberRanges
HaliRunPlatformDebugTriggers
HalpAcpiDetectMachineSpecificActions
HalpAcpiPmRegisterRead
HalpAcpiPmRegisterWrite
HalpAcpiPostSleep
HalpAcpiPreSleep
HalpAcquireCmosSpinLock
HalpAddMcaToProcessorSpecificSection
HalpAllocateAdapterCallbackV2
HalpAllocateAdapterCallbackV3
HalpAllocateCommonBufferDmaThin
HalpAllocateCommonBufferDmarThin
HalpAllocateCommonBufferVectorInternal
HalpAllocateDmaResourcesInternal
HalpAllocateDomainCommonBufferInternal
HalpAllocatePmcCounterSetEx
HalpApicClearLocalUnitError
HalpApicConvertFromRte
HalpApicGetCpuInfo
HalpApicGetLocalUnitError
HalpApicInitializeLocalUnit
HalpApicIsCmciImplemented
HalpApicQueryAndGetSource
HalpApicReplaySendSelfIpi
HalpApicRequestInterrupt
HalpApicSaveLocalInterrupts
HalpApicSetLineState
HalpApicSetLogicalId
HalpApicSetPriority
HalpApicStartProcessor
HalpApicTimerArm
HalpApicTimerDiscover
HalpApicTimerInitialize
HalpApicTimerIsInvariant
HalpApicTimerQueryCounter
HalpApicTimerStop
HalpApicWriteEndOfInterrupt
HalpArtAvailable
HalpBlkPoReadPerfIoPort
HalpBlkPoReadPerfMsr
HalpBlkPoRegisterIdleState
HalpBlkPoWritePerfIoPort
HalpBlkPoWritePerfMsr
HalpCmciLoadThresholdConfiguration
HalpCmciSetProcessorConfigAMD
HalpCmciSetProcessorConfigIntel
HalpCmciSetProcessorMiscConfigAMD
HalpCmosRangeHandler
HalpCompleteInitializeProfiling
HalpConstructScatterGatherListDmaThin
HalpConstructScatterGatherListDmarThin
HalpCreateMcaMemoryErrorRecord
HalpCreateMcaProcessorErrorRecord
HalpCreateNMIErrorRecord
HalpDisableSecondaryInterrupt
HalpDmaAllocateChildAdapterV3
HalpDmaAllocateDomain
HalpDmaControllerCancelTransfer
HalpDmaControllerDpcRoutine
HalpDmaControllerFlushChannel
HalpDmaControllerInitializeController
HalpDmaControllerInterruptRoutine
HalpDmaControllerProgramChannel
HalpDmaControllerQueryMaxFragments
HalpDmaControllerReadDmaCounter
HalpDmaControllerValidateRequestLineBinding
HalpDmaDereferenceDomainObject
HalpDmaFreeChildAdapter
HalpDmaFreeLa
HalpDmaGetIommuInterface
HalpDmaGetReservedRegionsForHybridPassthroughDomain
HalpDmaInitializeControllers
HalpDmaInitializeDomainEarly
HalpDmaPowerCriticalTransitionCallback
HalpDmaProcessMapRegisterQueueV2
HalpDmaSyncMapBuffers
HalpDmaSyncMapBuffersWithEmergencyResources
HalpDpPostReplace
HalpDpPreReplace
HalpDpReplaceControl
HalpDpReplaceTarget
HalpDpReplayInterrupts
HalpEnableSecondaryInterrupt
HalpEnumerateEnvironmentVariablesWithFilter
HalpExtInitExtensions
HalpFreePmcCounterSet
HalpGetCacheCoherency
HalpGetMcaExtendedLogStatusBlock
HalpGetMcaPcrContext
HalpGetSetCmosData
HalpHandleMachineCheck
HalpHandleMaskUnmaskSecondaryInterrupt
HalpHvCounterQueryCounter
HalpHvEnterSleepState
HalpHvEpCpuid
HalpHvEpWriteMsr
HalpHvGetMachineCheckContext
HalpHvInitDiscard
HalpHvInitMcaPcrContext
HalpHvLpReadMultipleMsr
HalpHvMapDeviceInterrupt
HalpHvMapDeviceMsiRange
HalpHvNotifyDebugDeviceAvailable
HalpHvRetargetDeviceMsiInterrupt
HalpHvRetargetIoApicDeviceInterrupt
HalpHvSetMachineCheckHandlerState
HalpHvSetMachineCheckRecoveryState
HalpHvSetSleepStateProperty
HalpHvStartProcessor
HalpHvStartVirtualProcessor
HalpHvTimerInitialize
HalpHvUnmapDeviceInterrupt
HalpHvUnmapDeviceMsiRange
HalpHvVpStartEnabled
HalpInitSystemHelper
HalpInitializePnTimers
HalpInitializeProfiling
HalpInitializeTimers
HalpInitializeUncoreProfiling
HalpInterruptDpReplaceBegin
HalpInterruptEnumerateUnmaskedInterrupts
HalpInterruptEnumerateUnmaskedSecondaryInterrupts
HalpInterruptGenerateMessage
HalpInterruptGetHighestPriorityInterrupt
HalpInterruptInitializeController
HalpInterruptInitializeLocalUnit
HalpInterruptLocalErrorService
HalpInterruptOfflineProcessor
HalpInterruptPerformDirectedEndOfInterrupt
HalpInterruptRequestInterrupt
HalpInterruptRequestSecondaryInterrupt
HalpInterruptResetThisProcessor
HalpInterruptRestoreClock
HalpInterruptSaveReplayState
HalpInterruptSendIpi
HalpInterruptSetLineStateInternal
HalpInterruptStandardEndOfInterrupt
HalpInterruptStartProcessor
HalpInterruptThermalService
HalpInterruptUpdateLocalUnitIdentifier
HalpIommuAcquireNewDomain
HalpIommuAllocateDmaDomain
HalpIommuAllocateRemappingTableEntry
HalpIommuAttachDeviceDomain
HalpIommuCreateDevice
HalpIommuCreateDeviceInternal
HalpIommuDeleteDevice
HalpIommuDomainFreeLogicalAddressRange
HalpIommuDomainGetLogicalAddressRange
HalpIommuEnableInterrupts
HalpIommuFlushDomainTB
HalpIommuFreeDmaDomain
HalpIommuFreeDomain
HalpIommuFreeRemappingTableEntry
HalpIommuGetAcpiDeviceMapCount
HalpIommuGetDeviceId
HalpIommuInitSystem
HalpIommuInitializeAll
HalpIommuInitializeDmaGuardPolicy
HalpIommuInitializeDmarPageTable
HalpIommuInterruptRoutine
HalpIommuInvokeInterfaceStateChangeCallbacks
HalpIommuJoinDmaDomain
HalpIommuLeaveDmaDomain
HalpIommuLocateFromDevice
HalpIommuMapLogical
HalpIommuMapLogicalRange
HalpIommuMarkHiberPhase
HalpIommuProcessReservationsInternal
HalpIommuQueryAcpiDeviceMapping
HalpIommuSetupMessageInterruptRouting
HalpIommuUnblockDevice
HalpIommuUpdateRemappingDestination
HalpIommuUpdateRemappingTableEntry
HalpIumGetNextVariableName
HalpIumGetTime
HalpIumGetVariable
HalpIumQueryVariableInfo
HalpIumResetSystem
HalpIumSetTime
HalpIumSetVariable
HalpIvtProcessDrhdEntry
HalpLeaveDmaDomain
HalpLoadMicrocode
HalpMapTransferV2
HalpMaskInterrupt
HalpMcEnumerateAndSetPatchConfig
HalpMcExportAllData
HalpMcGetLoadConfiguration
HalpMcUpdateInitialize
HalpMcUpdateLock
HalpMcUpdateMicrocode
HalpMcUpdatePostUpdate
HalpMcUpdateUnlock
HalpMcaInitializeErrorSection
HalpMcaPopulateErrorData
HalpMcaProcessorBankClear
HalpMcaProcessorBankConfigAmd
HalpMcaQueueDpc
HalpMcaSetProcessorConfig
HalpMceHandlerCore
HalpMemoryErrorDeferredHandler
HalpMemoryErrorDeferredRecovery
HalpPCIConfig
HalpPCIPerformConfigAccess
HalpPerfInterrupt
HalpPmemErrorDeferredHandler
HalpPmuProcessorCallbackDpcRoutine
HalpPmuReservedResourcesProcessorCallback
HalpPowerStateCallback
HalpPowerWriteResetCommand
HalpProcessorPrepareForIdle
HalpProcessorResumeFromIdle
HalpPutScatterGatherListDmarThin
HalpQueryIommuReservedRegionInformation
HalpQueryPrimaryInterruptInformation
HalpQueryProfileInformation
HalpReadExtendedMcaRegistersAMD
HalpReadExtendedMcaRegistersIntel
HalpReenableAcpi
HalpRestartProfiling
HalpRestoreDmaControllerState
HalpRtcAcknowledgeInterrupt
HalpRtcArmTimer
HalpRtcFixedStall
HalpRtcInitialize
HalpRtcStop
HalpScanForProfilingCorruption
HalpSendPccCommand
HalpSetMicrocodeSelfhostFlag
HalpSetProfileSourceInterval
HalpSetResumeTime
HalpSetSystemInformation
HalpSetTimer
HalpShutdown
HalpShutdownReset
HalpStartPccCommand
HalpStartProfileInterruptEx
HalpStopLegacyUsbInterruptsInternal
HalpTimerAlwaysOnClockInterrupt
HalpTimerCalibratePerformanceCounter
HalpTimerCaptureCloestAuxiliaryQpcPair
HalpTimerCaptureCurrentAuxiliaryQpcPair
HalpTimerClockActivate
HalpTimerClockArm
HalpTimerClockInitialize
HalpTimerClockInterrupt
HalpTimerClockInterruptStub
HalpTimerClockIpiRoutine
HalpTimerClockPowerChange
HalpTimerClockStop
HalpTimerConfigureInterrupt
HalpTimerDelayedQueryCounter
HalpTimerDetermineValidTimerPairReadLatency
HalpTimerDpcRoutine
HalpTimerEnableHypervisorTimer
HalpTimerHypervisorInterruptStub
HalpTimerInitialize
HalpTimerInitializeClockPn
HalpTimerInitializeHypervisorTimer
HalpTimerInitializeProfiling
HalpTimerMeasureFrequencies
HalpTimerPerformanceCounterPowerChange
HalpTimerProfileInterrupt
HalpTimerProfilePowerChange
HalpTimerPropagateQpcBiasUpdate
HalpTimerQueryCycleCounter
HalpTimerQueryHostPerformanceCounter
HalpTimerReadTimerPairWithLatencyLimit
HalpTimerRestartProfileInterrupt
HalpTimerRestorePerformanceCounter
HalpTimerRestoreProcessorCounter
HalpTimerSavePerformanceCounter
HalpTimerSetupMessageInterruptRouting
HalpTimerStallCounterPowerChange
HalpTimerStallExecutionProcessor
HalpTimerStopAllTimers
HalpTimerStopProfileInterrupt
HalpTimerSwitchStallSource
HalpTimerSwitchToNormalClock
HalpTimerTestHypervisorTimer
HalpTimerUpdateApiConsumers
HalpTimerWatchdogPreResetInterrupt
HalpTimerWatchdogStart
HalpTimerWatchdogStop
HalpTscDiscover
HalpTscGetAttributes
HalpUnmaskInterrupt
HalpUsbLegacyScanBusForHandoff
HalpUsbLegacyStopOhciInterrupt
HalpUsbLegacyStopUhciInterrupt
HalpVpptAcknowledgeInterrupt
HalpVpptInitializePhysicalTimer
HalpVpptStop
HalpVpptUpdatePhysicalTimer
HalpWdatProcessWdrtInternalData
HalpWheaReadMsrAddress
HalpWheaReadMsrMisc
HalpWheaReadMsrStatus
HalpWheaWriteMsrControl
HalpWheaWriteMsrStatus
HeadlessInit
HsaInitializeInterruptRemapping
HsaInitializeIommu
HsaIommuSendCommand
HvAnalyzeLogFiles
HvExtendHivePrimaryFileValidDataLength
HvFreeHivePartial
HvHiveCleanup
HvHiveStartEmptyClone
HvHiveStartFileBacked
HvHiveStartMemoryBacked
HvLoadHive
HvRecoverFlushProtocolStateFromFiles
HvValidateOrInvalidatePrimaryFileHeader
HvWriteExternal
HvWriteHivePrimaryFile
HvWriteLogFile
HvlCrashdumpCallbackRoutine
HvlDebuggerSupportInitialize
HvlEnlightenProcessor
HvlGetSharedPageVa
HvlInvokeWheaErrorNotificationCallback
HvlPrepareForRootCrashdump
HvlResumeFromRootCrashdump
HvlSkCrashdumpCallbackRoutine
HvlStartBootLogicalProcessors
HvlWheaInUsePageOfflineNotificationCallback
HvlpComputeLpComparisonMetrics
HvlpHandleIommuFaultMessage
HvlpInitializeBootProcessor
HvlpPhase0Enlightenments
HvlpQueryApicIdAndNumaNode
HvlpSelectLpSet
HvlpSetupBootProcessorEarlyHypercallPages
HvlpTryConfigureInterface
HvpAddBin
HvpAdjustBitmap
HvpAllocateBin
HvpAllocateMap
HvpApplyLegacyLogFile
HvpEnlistFreeCell
HvpExpandMap
HvpFreeBin
HvpFreeHiveFreeDisplay
HvpFreeMap
HvpGetHiveHeader
HvpGrowDirtyVectors
HvpIncrementalLogFileEnumeratorAdvance
HvpInitMap
HvpReadHiveDataFromFile
HvpReadLogEntryHeader
HvpRecoverDataReadRoutine
HvpShrinkMap
IaLpssReadCmdStatus
IaLpssReadPmcsr
IaLpssSetPowerD0
IaLpssSetPowerD3
IaLpssWriteCmdStatus
IaLpssWritePmcsr
InbvAcquireDisplayOwnership
InbvAcquireLock
InbvCheckDisplayOwnership
InbvDisplayString
InbvEnableBootDriver
InbvGetDisplayState
InbvGetResourceAddress
InbvIndicateProgress
InbvIsBootDriverInstalled
InbvNotifyDisplayOwnershipChange
InbvNotifyDisplayOwnershipLost
InbvPortGetByte
InbvPortInitialize
InbvPortPollOnly
InbvPortPutByte
InbvReleaseLock
InbvReleaseResources
InbvResetDisplay
InbvSetFunction
InbvSetProgressBarSubset
InbvSetScrollRegion
InbvSetTextColor
InbvSetVirtualFrameBuffer
InbvSolidColorFill
InitBootProcessor
IoAddProcessesToDump
IoAllocateAdapterChannel
IoAllocateController
IoAllocateMdl
IoAsynchronousPageWrite
IoBoostThreadIoPriority
IoCancelIrp
IoCaptureLiveDump
IoCreateDriver
IoCreateStreamFileObjectEx2
IoCsqInsertIrpEx
IoCsqRemoveIrp
IoCsqRemoveNextIrp
IoDemoteToTriageDump
IoDumpStackResumeCapable
IoEnumerateEnvironmentVariablesEx
IoFlushAdapterBuffers
IoFlushAdapterBuffersV2
IoFreeAdapterChannel
IoFreeAdapterChannelV2
IoFreeController
IoFreeMapRegisters
IoFreeMdl
IoGetDmaAdapter
IoGetDumpStack
IoGetDumpStackTransferSizes
IoGetEnvironmentVariableEx
IoGetIommuInterface
IoGetIommuInterfaceEx
IoInitSystemPreDrivers
IoInitializeDumpStack
IoMapTransfer
IoNotifyDump
IoProcessPassiveInterrupts
IoPropagateIrpExtensionEx
IoProvisionCrashDumpKey
IoQueryEnvironmentVariableInfoEx
IoRegisterFileSystem
IoRevertFromDemotedDumpType
IoSaveInitialBugCheckProgress
IoSetEnvironmentVariableEx
IoShutdownSystem
IoStartPacket
IoStopIoRateControl
IoTranslateBusAddress
IoUnregisterFileSystem
IoUpdateBugCheckProgressEnvVariable
IoUpdateDumpPhysicalRanges
IoWriteCrashDump
IofCallDriver
IommuCreateAtsDevice
IommuDeleteAtsDevice
IommuDevicePowerChange
IommuDisableDevicePasid
IommuEnableDevicePasid
IommuFinalizeDeviceReset
IommuFlushAllPasid
IommuFlushDomain
IommuFlushTb
IommuHvDevicePowerChange
IommuHvFlushAllPasid
IommuHvFlushTb
IommuHvSetAddressSpace
IommuProcessPageRequestQueue
IommuRegisterInterfaceStateChangeCallback
IommuSetAddressSpace
IommupDeviceDisablePasidTaggedDma
IommupDeviceDisableSvm
IommupDeviceEnablePasidTaggedDma
IommupDeviceEnableSvm
IommupHvAttachPasidDevice
IommupHvAttachPasidDeviceDomain
IommupHvAttachPasidSubDeviceDomain
IommupHvConfigureDeviceDomain
IommupHvCreateSvmPasidSpace
IommupHvDetachPasidDevice
IommupHvDetachPasidDeviceDomain
IommupHvDetachPasidSubDeviceDomain
IommupHvDismissPageFault
IommupHvFlushDeviceDomainVaList
IommupHvFlushDomainTbs
IommupHvGetDeviceAtsCapability
IommupHvGetDeviceSvmCapabilities
IommupHvGetPageFault
IommupHvInitializeLibrary
IommupHvInterruptRoutine
IommupHvIsDmarStageCompatible
IommupHvIsStage1DmarCompatible
IommupHvMapDevice
IommupHvMapDeviceIdentityRange
IommupHvMapDeviceLogical
IommupHvMapDeviceLogicalRange
IommupHvRegisterDeviceId
IommupHvSetRootFaultReportingReady
IommupHvUnblockDefaultDma
IommupHvUnmapDevice
IommupHvUnmapDeviceIdentityRange
IommupHvUnmapDeviceLogicalRange
IommupHvUnregisterDeviceId
IommupHvValidatePageRequestGpa
IommupMapDeviceInternal
IommupUnmapDeviceInternal
IopAddRemoveReqDescs
IopAllocRealFileObject
IopAllocateMdl
IopAllocatePassiveInterruptBlock
IopAttachDeviceToDeviceStackSafe
IopBoostThreadCallback
IopBootAllocation
IopBugCheckProgressEfiVariableServicesAvailable
IopCallArbiter
IopCallBootDriverReinitializationRoutines
IopCallDriverReinitializationRoutines
IopChildToRootTranslation
IopCloseFile
IopCommitConfiguration
IopCompletePageWrite
IopCompleteUnloadOrDelete
IopConnectInterrupt
IopConnectInterruptFullySpecified
IopCreateFile
IopCsqCancelRoutine
IopDisableCrashDump
IopDispatchSessionNotifications
IopDumpCallAddPagesCallbacks
IopDumpCallRemovePagesCallbacks
IopDuplicateDetection
IopEjectDevice
IopEnumerateEnvironmentVariablesHal
IopEnumerateEnvironmentVariablesTrEE
IopFileUtilWalkDirectoryTreeHelper
IopFreeMiniCompletionPacket
IopGetBasicInformationFile
IopInitializeBuiltinDriver
IopInitializeCrashDump
IopInitializeDeviceInstanceKey
IopIoRateStartRateControl
IopIrpStackProfilerDpcRoutine$fin$1
IopLiveDumpAddIptTraceBuffers
IopLiveDumpAddTriageDumpData
IopLiveDumpAllocateIptBuffers
IopLiveDumpCallRemovePagesCallbacks
IopLiveDumpGenerateIptSecondaryData
IopLiveDumpMarkImportantDumpData
IopLoadCrashdumpDriver
IopLoadUnloadDriver
IopMapTransfer
IopNotifyAlreadyRegisteredFileSystems
IopParentToRawTranslation
IopParseDevice
IopPassiveInterruptRealtimeWorker
IopPassiveInterruptWorker
IopPerfCompletionRoutine
IopPoHandleIrp
IopPortFindSuitableRange
IopProcessIoTracking
IopProcessWorkItem
IopQueryInformation
IopRaiseHardError
IopReadFile
IopRegistryCallback
IopRegistryInitializeCallbacks
IopReleaseDeviceResources
IopRetestConfiguration
IopRetrieveSystemDeviceName
IopStartNextPacket
IopStartNextPacketByKey
IopSynchronousServiceTail
IopTestConfiguration
IopThreadStart
IopTimerDispatch
IopTimerDispatch$filt$2
IopTranslateAndAdjustReqDesc
IopUncacheInterfaceInformation
IopUnloadDriver
IopUnloadSafeCompletion
IopWriteFile
IopWriteTriageDumpToFirmware
IopXxxControlFile
IopfCallDriver
IopfCompleteRequest
IovBuildDeviceIoControlRequest
IovInitializeTimer
IovpCancelRoutine
IovpCompleteRequest2
IovpLocalCompletionRoutine
IovpUnloadDriver
IpmiLibpHandleErrorInterrupt
IpmiLibpHandleReadInterrupt
IpmiLibpHandleSendInterrupt
IpmiLibpKcsBmcTransact
IvtInitializeIdentityMappings
IvtInitializeIommu
IvtIommuSendCommand
IvtIommuWaitCommand
KdCallPowerHandlers
KdEnterDebugger
KdExitDebugger
KdPowerTransitionEx
KdPullRemoteFileEx
KdpSendWaitContinue
KdpSysReadBusData
KdpSysWriteBusData
KeBoostPriorityThread
KeBugCheck2
KeCleanupImageTracepoints
KeClockInterruptNotify
KeConnectInterrupt
KeConvertAuxiliaryCounterToPerformanceCounter
KeConvertPerformanceCounterToAuxiliaryCounter
KeCpuSetReportParkedProcessors
KeEnumerateKernelStackSegments
KeEnumerateProcessorDpcs
KeEnumerateQueueApc
KeFreezeExecution
KeGenericProcessorCallback
KeInitializeClock
KeInitializeClockOtherProcessors
KeInitializeEntropySystem
KeInitializeTimerTable
KeIpiGenericCall
KeNumaInitialize
KePrepareClockTimerForIdle
KePrepareNonClockOwnerForIdle
KeQueryAuxiliaryCounterFrequency
KeQueryIntervalProfile
KeQueryPerformanceCounter
KeQueryWakeSource
KeRecomputeCpuSetAffinityProcess
KeRegisterProcessorChangeCallback
KeRemoveQueueEx
KeResumeClockTimerFromIdle
KeRevertToUserMultipleGroupAffinityThread
KeRundownApcQueues
KeSetBasePriorityThread
KeSetCpuSetsProcess
KeSetSchedulingGroupRankBias
KeSetSelectedCpuSetsThread
KeSetSystemMultipleGroupAffinityThread
KeSetThreadSchedulerAssist
KeSetUserAffinityThread
KeSetUserGroupAffinityThread
KeSpecialUserApcKernelRoutine
KeStallExecutionProcessor
KeStartAllProcessors
KeSuspendClockTimer
KeSuspendClockTimerSafe
KeSynchronizeExecution
KeThawExecution
KeUnmaskInterrupt
KeUpdateThreadCpuSets
KiAbProcessThreadLocks
KiAbThreadUnboostCpuPriority
KiAltReturnWorkerRoutine
KiBalanceSetManagerDeferredRoutine$fin$0
KiBugCheckRecoveryCleanupFromCrashDump
KiBugCheckRecoveryPrepareForCrashDump
KiCallInterruptServiceRoutine
KiCheckForThreadDispatch
KiClearLastBranchRecordStack
KiDeferredBugcheckRecoveryWorker
KiDeliverApc
KiDispatchCallout
KiDispatchException
KiDispatchInterrupt
KiEntropyDpcRoutine
KiExecuteAllDpcs
KiExitDispatcher
KiExpireTimer2
KiFinalizeTimer2Disablement
KiFreezeTargetExecution
KiGetNextTimerExpirationDueTime
KiHandleBound
KiHandleMultipleBugchecksDuringRecovery
KiHvInterruptSubDispatch
KiInitializeDynamicProcessorDpc
KiInitiateGenericCallDpc
KiIntSteerGetLineInformation
KiIntSteerInit
KiIntSteerSetDestination
KiInterruptMessageDispatch
KiInvokeBugCheckAddTriageDumpDataCallbacks
KiInvokeBugCheckEntryCallbacks
KiIpiGenericCallTarget
KiIpiProcessRequests
KiIpiSendRequestEx
KiIsInterruptTypeSecondary
KiLockServiceTable
KiMaskInterruptInternal
KiMaskSecondaryInterruptInternal
KiOpGetPciConfigSpaceAccessInfoFromPhysicalAddress
KiPerformExplicitGroupAssignment
KiPopulateNodeInformation
KiPreprocessFault
KiProcessDeferredReadyList
KiProcessExpiredTimerList
KiProcessNMI
KiProcessProfileList
KiQueryProcessorNode
KiQueryProximityNode
KiReadyOutSwappedThreads
KiRestoreClockTickRate
KiResumeClockTimer
KiRetireDpcList
KiScanBugCheckCallbackList
KiSetClockTickRate
KiSetHeteroPolicyThread
KiSetIntervalWorker
KiSetLegacyAffinityThread
KiSoftParkElectionDpcRoutine
KiStartProfileTarget
KiStopProfileTarget
KiSwapThread
KiSynchronizePassiveInterruptExecution
KiTpHandleTrap
KiTrackSystemCallEntry
KiTrackSystemCallExit
KiUnmaskSecondaryInterruptInternal
KiUpdateProcessConcurrencyCounts
KiUpdateTime
KiUpdateVpBackingThreadPriorityDpcRoutine
KiVmbusInterruptSubDispatch
KseDriverUnloadImage
KseDsCallbackHookAddDevice
KseDsCallbackHookDriverStartIo
KseDsCallbackHookDriverUnload
KseDsCallbackHookIrpFunction
KseDsCallbackHookIrpInternalDeviceControlFunction
KseDsCallbackHookIrpPnpFunction
KseDsCallbackHookIrpPowerFunction
KseDsHookExAllocatePool
KseDsHookExAllocatePoolWithTag
KseDsHookExFreePool
KseDsHookExFreePoolWithTag
KseDsHookIoCreateDevice
KseDsHookPoRequestPowerIrp
KseHookExAllocatePoolWithTag
KseHookMmGetVirtualForPhysical
KseHookMmMapIoSpace
KseHookQueryValueKey
KsepApplyShimsToDriver
KsepCacheInsert
KsepCacheLookup
KsepCacheReset
KsepCacheUninitialize
KsepCompletionSafeWrapper
KxStartUserThread
KxSwitchKernelStackCallout
KyPlatformSwapStacksAndCall
LZNT1CompressChunk
LsaCallAuthenticationPackage
LsaDeregisterLogonProcess
LsaFreeReturnBuffer
LsaLogonUser
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess
MiActOnLargeKernelHalPages
MiAddNonSecuredPagesToDump
MiAddPhysicalPagesToCrashDump
MiApplyImageHotPatchRequest
MiCaptureSecureImageBaseAddress
MiCrashdumpRemovePte
MiCreateImageFileMap
MiDeliverPicoExceptionForProbedPage
MiDereferenceSessionFinal
MiEnumerateBasePatches
MiEnumerateSlabAllocators
MiFilterCrashDumpPte
MiGetNextPageTablePte
MiGetSectionStrongImageReference
MiImageRvaRawEnumFirst
MiImageRvaRawEnumNext
MiInitializeChannelRangesTemporary
MiInitializeLargePageColorSizes
MiInitializeNumaRangesTemporary
MiInvokePatchCallback
MiIterateOverPartitions
MiMirrorPerformBlackWrites
MiMirrorPerformBrownWrites
MiMirrorVerify
MiProcessKernelCfgImageLoadConfig
MiProcessVmAccessedInfo
MiRelocateImage
MiRelocateImageAgain
MiRemoveEnclavePagesFromDump
MiRemovePendingBadPagesFromDump
MiReplaceRotateWithDemandZero
MiRotateToFrameBuffer
MiValidateExistingImage
MiValidateSectionCreate
MiValidateSectionSigningPolicy
MiWalkPageTablesRecursively
MiWalkPageTablesRecursivelyNoSynch
MiYieldPageTableWalk
MmAddPrivateDataToCrashDump
MmDuplicateMemory
MmEnumerateSystemImages
MmGetDumpRange
MmMapMdl
MmUpdateMdlTrackerForMdlSwitch
NP_CONTEXT::NpLeafDerefInternal
NP_CONTEXT::NpLeafRemoveInternal
NP_CONTEXT::NpiLeafPageIn
NP_CONTEXT::NpiPerformPageOut
NtCompareSigningLevels
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
NtCreateKeyTransacted_Stub
NtCreateUserProcess
NtDeleteKey
NtDeleteValueKey
NtEnumerateKey
NtEnumerateValueKey
NtFlushKey
NtLockFile
NtOpenKeyTransactedEx_Stub
NtPlugPlayControl
NtPowerInformation
NtQueryAuxiliaryCounterFrequency
NtQueryInformationFile
NtQueryInformationProcess
NtQueryKey
NtQueryMultipleValueKey
NtQueryObject
NtQuerySecurityObject
NtQuerySecurityPolicy
NtQueryValueKey
NtQueueApcThreadEx2
NtSetCachedSigningLevel2
NtSetInformationKey
NtSetSystemInformation
NtSetValueKey
NtUnlockFile
ObCloseHandleTableEntry
ObCreateObjectEx
ObDeleteCapturedInsertInfo
ObInsertObjectEx
ObOpenObjectByNameEx
ObQueryNameStringMode
ObQuerySecurityObject
ObReferenceObjectByNameEx
ObSetSecurityObjectByPointer
ObShutdownSystem
ObpAllocateAndQuerySecurityDescriptorInfo
ObpAssignSecurity
ObpCallPostOperationCallbacks
ObpCallPreOperationCallbacks
ObpCaptureObjectName
ObpCloseHandle
ObpCreateHandle
ObpDecrementHandleCount
ObpFreeObject
ObpFreeObjectNameBuffer
ObpGetObjectSecurity
ObpIncrementHandleCountEx
ObpLookupObjectName
ObpParseSymbolicLinkEx
ObpRemoveObjectRoutine
Ordinal_23
Ordinal_27
Ordinal_28
Ordinal_7
PcwAddInstance
PcwCloseInstance
PcwCreateInstance
PcwRegister
PcwUnregister
PdcPortSendMessageSynchronously
PdcpPortReleaseResources
Pdcv2pActivationClientCallback
PerfLogImageUnload
PfFbBufferListFlushStandby
PfFbLogEntryComplete
PfFbLogEntryReserve
PfFileInfoNotify
PfSnNameQueryWorker
PfSnVolumeKeyQuery
PfpOpenHandleClose
PfpOpenHandleCreate
PiDaDispatch
PiDaFastIoDispatch
PiDevCfgCopyObjectProperties
PiDevCfgEnumDeviceKeys
PiDevCfgResolveVariable
PiDmCmObjectMatchCallback
PiDmEnumObjectsWithCallback
PiDmGetObjectListCallback
PiDmListEnumObjectsWithCallback
PiDmPnpObjectMatchCallback
PiDmaGuardProcessNewDeviceNode
PiForEachDriverQueryRoutine
PiGetDmaAdapterFromBusInterface
PiIommuAllocateExtension
PiIommuBlockDevice
PiIommuGetInterface
PiIommuUnblockDevice
PiPnpRtlEnumDevicesCallback
PiPnpRtlEnumeratorFilterCallback
PiPnpRtlInterfaceFilterCallback
PiPnpRtlServiceFilterCallback
PiProcessDriversLoadedOnSecureDevice
PiProcessNewDeviceNode
PiQueryAndAllocateBootResources
PiUpdateDeviceResourceLists
PipCallDriverAddDevice
PipCslUpdateState
PipDmgInitPhaseZero
PipDmgSaveDeviceDmarPolicy
PipDmgSetIommuDomainPolicyAndNotifyHal
PipEnumeratePersistedMemoryCallback
PipForAllDeviceNodesCallback
PipIommuRetrieveDeviceId
PipProcessPendingObjects
PipUnprotectDevice
PnpBootDeviceWait
PnpCallDriverEntry
PnpCompleteDeviceEvent
PnpGetDeviceLocationStrings
PnpHandleProcessWalkWorker
PnpNotifyDriverCallback
PnpProcessCompletedEject
PnpProcessQueryRemoveAndEject
PnpReplacePartitionUnit
PnpRequestDeviceEjectExWorker
PnprEndMirroring
PnprGetPageDestination
PnprIdentifyUnits
PnprInitiateReplaceOperation
PnprLoadPluginDriver
PnprMarkOrMirrorPages
PnprMirrorMarkedPages
PnprQueryReplaceFeatures
PnprQuiesceProcessorDpc
PnprQuiesceProcessors
PnprReplaceStart
PnprSwap
PnprSwapFinalize
PnprWakeProcessors
PoFxPowerOnCrashdumpDevice
PoFxProcessorNotification
PoFxRegisterDebugger
PoFxStartDevicePowerManagement
PoFxSystemLatencyNotify
PoInitHiberServices
PoInitSystem
PoInitiateProcessorWake
PoIssueCoalescingNotification
PopAllocateHiberContext
PopCallPowerSettingCallback
PopCaptureSleepStudyStatistics
PopCheckpointSystemSleep
PopCleanCoolingExtension
PopCoalescingCallback
PopConnectToPolicyDevice
PopDecompressHiberBlocks
PopDiagTraceFirmwareS3Stats
PopDisableCoolingExtension
PopDispatchShutdownEvent
PopEvaluatePowerButtonSuppressionState
PopExecuteProcessorCallback
PopExternalMonitorUpdatedWorker
PopFreeHiberContext
PopFxAcpiForwardNotification
PopFxAcpiForwardPepAcpiNotifyRequest
PopFxAcpiForwardPepWorkRequest
PopFxCompleteComponentPerfState
PopFxDeliverDevicePowerRequired
PopFxDispatchPluginWorkOnce
PopFxHandleDirectedPowerTransition
PopFxIdleTimeoutDpcRoutine
PopFxIdleWorker
PopFxIdleWorkerTail
PopFxInvokeDripsWatchdogCallback
PopFxLowPowerEpochCallback
PopFxNotifySystemStateTransition
PopFxPlatformIdleVeto
PopFxProcessWork
PopFxProcessWorkPool
PopFxProcessorIdleVeto
PopFxRequestCommon
PopFxResetSocSubsystemAccounting
PopFxTransitionCriticalResource
PopFxUpdateDeviceIdleTimer
PopFxUpdatePlatformIdleState
PopFxUpdateProcessorIdleState
PopGracefulShutdown
PopHandleNextState
PopHiberCheckResume
PopHiberReadChecksums
PopInitPlatformSettings
PopInvokeSystemStateHandler
PopIrpWorker
PopMarkComponentsBootPhase
PopNetSetResiliencyPhaseBias
PopNotifyShutdownListener
PopPdcAreAllPhasesDisengaged
PopPdcCompleteResiliencyCallback
PopPdcDisengagePhases
PopPdcEngagePhases
PopPdcInvocation
PopPdcSnapDiagnosticContext
PopPepCompleteActivity
PopPepDeviceDState
PopPepInitializeDebuggerMasks
PopPepIterateDeviceList
PopPepStartActivity
PopPepTriggerActivity
PopPlPublishSystemPowerChange
PopPluginAbandonDevice
PopPluginAcpiNotificationStrict
PopPluginInitializeSocSubsystemStaticInfo
PopPluginNotifyActive
PopPluginNotifyIdleState
PopPluginPrepareDevice
PopPluginQueryComponentPerfCapabilities
PopPluginQueryComponentPerfSet
PopPluginQueryComponentPerfSetName
PopPluginQueryComponentPerfStates
PopPluginQueryCurrentComponentPerfState
PopPluginQuerySocSubsystemBlockingTime
PopPluginQuerySocSubsystemCount
PopPluginQuerySocSubsystemMetadata
PopPluginRegisterComponentPerfStates
PopPluginRegisterCrashdumpDevice
PopPluginRegisterDevice
PopPluginRequestComponentIdleConstraints
PopPluginRequestComponentPerfState
PopPluginRequestDeviceIdleConstraints
PopPluginRequestPowerControl
PopPluginUnregisterDevice
PopPolicyDeviceRemove
PopPolicyWorkerAction
PopPolicyWorkerNotify
PopPolicyWorkerThread
PopPowerAggregatorDisengageModernStandby
PopPowerAggregatorEngageModernStandby
PopPowerAggregatorHandleIntentUnsafe
PopPowerAggregatorInvokeStateMachine
PopPowerAggregatorNotifyDisplayPoweredOn
PopPowerAggregatorSystemTransitionEnterStateHandler
PopPowerAggregatorSystemTransitionExitStateHandler
PopPowerButtonWorkCallback
PopPowerInformationInternal
PopPowerRequestCallbackExecutionRequired
PopPowerRequestHandleRequestUpdate
PopProcessorIdleSelectNotification
PopProcessorNotifyLpiCoordinatedStatesNotification
PopProcessorParkMaskNotification
PopProcessorParkNotification
PopProcessorQueryCoordinatedDependencyNotification
PopProcessorQueryPlatformStateNotification
PopPropogateCoolingChange
PopQueryBootSessionStandbyActivationInfo
PopRequestCompletion
PopRequestRead
PopRequestWrite
PopRestoreHiberContext
PopSaveHiberContext
PopShutdownHandler
PopSleepstudyCaptureResiliencyStatistics
PopSleepstudyCaptureSessionStatistics
PopSleepstudyRegisterSessionCallback
PopSleepstudyStartNextSession
PopSstDiagInitializeResumeTimer
PopStateTransitionTimeoutDispatch
PopSuspendResumeInvocation
PopSwitchUpdateUserShutdownScenarioState
PopThermalZoneDpc$filt$2
PopTransitionSystemPowerStateEx
PopTriggerMonitorPowerEvent
PopUmpoProcessPowerMessage
PopUpdatePdcSystemIdleState
PopWatchdogWorker
PopWriteHiberPages
PopWriteImageHeader
PpmCheckComputeEnergy
PpmCheckReportComplete
PpmCheckRun
PpmHvSnapPerformanceAccumulation
PpmIdleCheckProcessorStateEligibility
PpmIdleExecuteTransition
PpmIdleGuestComplete
PpmIdleGuestPreExecute
PpmIdleGuestTest
PpmIdlePrepare
PpmIdleSelectStates
PpmIdleWaitForDependentTransitions
PpmInstallNewIdleStates
PpmParkComputeUnparkMask
PpmParkReportMask
PpmParkSteerInterrupts
PpmPdcNotifyMediaBufferingUpdate
PpmPerfApplyDomainState
PpmPerfApplyHiddenProcessorState
PpmPerfApplyLatencyHint
PpmPerfApplyProcessorState
PpmPerfArbitratorApplyProcessorState
PpmPerfCheckForIllegalProcessorThrottle
PpmPerfControlExecuteAction
PpmPerfFeedbackCounterRead
PpmPerfFeedbackCounterUpdate
PpmPerfGetVmPerfConfig
PpmPerfQueryProcMeasurementValues
PpmPerfSelectProcessorState
PpmPerfUpdateHwDebugData
PpmQueryPlatformStateResidency
PpmRemoveIdleStates
PpmResetPerfEngineForProcessor
PpmSnapPerformanceAccumulation
PpmUpdateProcessorPolicy
PpmUpdateTargetProcessorPolicy
PpvUtilCallAddDevice
PrExtControlOperations
PsCallImageNotifyRoutines
PsCheckProcessFileSigningLevel
PsConvertToGuiThread
PsEnumProcessThreads
PsEnumProcesses
PsGetAllocatedFullProcessImageNameEx
PsPicoSystemCallDispatch
PsPicoWalkUserStack
PsQueryActivityModerationUserSettings
PsQueryProcessSignatureMitigationPolicy
PsSetExeModerationState
PsSetProcessFaultInformation
PsSyscallProviderDispatch
PsTestProtectedProcessIncompatibility
PsUnregisterSiloMonitor
PspAllocateProcess
PspCallJobHierarchyCallbacks
PspCallProcessNotifyRoutines
PspCallThreadNotifyRoutines
PspChangeProcessExecutionState
PspDeferredWorkerRoutine
PspDeleteSiloContext
PspExitThread
PspExpandLimit
PspExpandQuota
PspInvokeCreateCallback
PspInvokeTerminateCallback
PspNetRateControlDispatch
PspProcessDelete
PspReleaseReturnedQuota
PspReturnResourceQuota
PspSetRateControlJobPreCallback
PspSetRateControlProcessCallback
PspSyscallProviderOptIn
PspSyscallProviderServiceDispatch
PspSyscallProviderServiceDispatchGeneric
PspSystemThreadStartup
PspTerminateProcess
PspThreadDelete
RcConsolidateFrames
ReadPortWithIndex16
ReadPortWithIndex32
ReadPortWithIndex8
ReadRegisterWithIndex16
ReadRegisterWithIndex32
ReadRegisterWithIndex64
ReadRegisterWithIndex8
RtlApplyHotPatch
RtlCaptureRetpolineImportRvas
RtlCompressBuffer
RtlDecompressBuffer
RtlDecompressBufferEx
RtlDecompressBufferEx2
RtlDecompressFragment
RtlDecompressFragmentEx
RtlDeleteElementGenericTable
RtlDeleteElementGenericTableAvl
RtlDeleteElementGenericTableAvlEx
RtlDescribeChunk
RtlDestroyHeap
RtlEnumerateBoundaryDescriptorEntries
RtlEnumerateGenericTableLikeADirectory
RtlEnumerateHotPatchPatches
RtlFindLowerBoundInSortedArray
RtlGetCompressionWorkSpaceSize
RtlInsertElementGenericTableAvl
RtlInsertElementGenericTableFull
RtlInsertElementGenericTableFullAvl
RtlInternEntryDereference
RtlInternTableIntern
RtlLookupElementGenericTable
RtlLookupElementGenericTableAvl
RtlLookupElementGenericTableFullAvl
RtlLookupFirstMatchingElementGenericTableAvl
RtlReserveChunk
RtlRunOnceExecuteOnce
RtlpAllocateHeapInternal
RtlpCallQueryRegistryRoutine
RtlpCompressRvaList
RtlpConstructImportRelocationFixup
RtlpFcLinearSearchInSortedArray
RtlpFindAndCommitPages
RtlpFlsDataCleanup
RtlpFlsFree
RtlpFreeHeapInternal
RtlpGetRegistryHandle
RtlpHpAllocateHeap
RtlpHpFixedHeapCreate
RtlpHpFixedVsCommit
RtlpHpFreeHeap
RtlpHpLfhBucketActivate
RtlpHpLfhBucketAllocateSlot
RtlpHpLfhSlotAllocate
RtlpHpLfhSubsegmentCreate
RtlpHpLfhSubsegmentDecommitPages
RtlpHpLfhSubsegmentFree
RtlpHpVsChunkFree
RtlpHpVsChunkSplit
RtlpHpVsSubsegmentCommitPages
RtlpHpVsSubsegmentCreate
RtlpHpVsSubsegmentFree
RtlpInternEntryCreate
RtlpInternHashBucketsAllocate
RtlpInternHashBucketsFree
RtlpIsRangeAvailable
RtlpMakeXpressCallback
RtlpQueryRegistryValues
RtlpTraceDatabaseInternalAdd
RtlpTraceDatabaseInternalFind
SC_DEVICE::GetStorageProperty
SC_DEVICE::Initialize
SC_DEVICE::UpdateStorageProperty
SC_DISK::GenerateId
SC_DISK::Initialize
SC_DISK::ReadSectors
SC_DISK::WriteSectors
SLQueryLicenseValueInternal
SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogTimerCallback
SMKM_STORE_MGR<struct_SM_TRAITS>::SmHighMemPriorityWatchdogWorker
SMKM_STORE_MGR<struct_SM_TRAITS>::SmIoCtxQueueWork
SMKM_STORE_MGR<struct_SM_TRAITS>::SmStoreMgrCallback
SPCallServerHandleCheckLicense
SPCallServerHandleClepKdf
SPCallServerHandleClepSign
SPCallServerHandleGetAppPolicyValue
SPCallServerHandleGetCurrentHardwareID
SPCallServerHandleGetLicenseChallenge
SPCallServerHandleIsAppLicensed
SPCallServerHandleRemoveLicense
SPCallServerHandleUpdateLicense
SPCallServerHandleUpdatePolicies
SPCallServerHandleWaitForDisplayWindow
SdbpCheckAllAttributes
SdbpCheckMatchingDevice
SdbpGetSystemSdbFilePath
SdbpMatchList
SdbpOpenCompressedDatabase
SeCodeIntegrityInitializePolicy
SeCodeIntegrityQueryInformation
SeCodeIntegritySetInformationProcess
SeCompareSigningLevels
SeGetCachedSigningLevel
SeGetImageRequiredSigningLevel
SeQuerySigningPolicy
SeReleaseImageValidationContext
SeValidateImageData
SeValidateImageHeader
SepAppendAceToTokenObjectAcl
SepDeleteAccessState
SepDuplicateToken
SepIsImageInMinTcbList
SepNotifyFileSystems
SepParseElamCertResources
SepQueueWorkItem
SepRmCallLsa
SepRmCommandServerThread
SiGetSystemDeviceName
SmDecompressBuffer
SmKmIssueFileIo
SmKmStoreDelete
SmKmStoreDeleteWhenEmpty
SmKmStoreDeleteWhenEmptyWorker
SmKmStoreHelperCommandCleanup
SmKmStoreHelperCommandProcess
SpiInit
SpiSend16
SshpAlpcProcessMessage
SshpSendSessionData
TlgAggregateInternalRegisteredProviderEtwCallback
TtmiSessionDeviceListWorker
TtmpCallAssignedToTerminal
TtmpCallSetDisplayState
TtmpCallSetInputMode
Uart16550GetByte
Uart16550InitializePortCommon
Uart16550PutByte
Uart16550RxReady
Uart16550SetBaudCommon
VerifierCcCopyWrite
VerifierCcCopyWriteEx
VerifierCcDeferWrite
VerifierCcFastCopyWrite
VerifierCcWaitForCurrentLazyWriterActivity
VerifierCmRegisterCallback
VerifierCmRegisterCallbackEx
VerifierCmUnRegisterCallback
VerifierDbgBreakPointWithStatus
VerifierEtwRegister
VerifierEtwRegisterClassicProvider
VerifierEtwUnregister
VerifierExAcquireFastMutex
VerifierExAcquireFastMutexUnsafe
VerifierExAcquireResourceExclusiveLite
VerifierExAcquireResourceSharedLite
VerifierExAcquireRundownProtection
VerifierExAcquireRundownProtectionCacheAware
VerifierExAcquireRundownProtectionCacheAwareEx
VerifierExAcquireRundownProtectionEx
VerifierExAcquireSharedStarveExclusive
VerifierExAcquireSharedWaitForExclusive
VerifierExAllocateCacheAwareRundownProtection
VerifierExAllocatePool
VerifierExAllocatePool2
VerifierExAllocatePool3
VerifierExAllocatePoolEx
VerifierExAllocatePoolWithQuota
VerifierExAllocatePoolWithQuotaTag
VerifierExAllocatePoolWithTag
VerifierExAllocatePoolWithTagPriority
VerifierExConvertExclusiveToSharedLite
VerifierExCreateCallback
VerifierExDeleteLookasideListEx
VerifierExDeleteNPagedLookasideList
VerifierExDeletePagedLookasideList
VerifierExDeleteResourceLite
VerifierExEnterCriticalRegionAndAcquireResourceExclusive
VerifierExEnterCriticalRegionAndAcquireResourceShared
VerifierExEnterCriticalRegionAndAcquireSharedWaitForExclusive
VerifierExEnterPriorityRegionAndAcquireResourceExclusive
VerifierExEnterPriorityRegionAndAcquireResourceShared
VerifierExFreePool
VerifierExFreePoolWithTag
VerifierExGetExclusiveWaiterCount
VerifierExGetSharedWaiterCount
VerifierExInitializeLookasideListEx
VerifierExInitializeNPagedLookasideList
VerifierExInitializePagedLookasideList
VerifierExInitializeResourceLite
VerifierExInterlockedAddLargeInteger
VerifierExInterlockedInsertHeadList
VerifierExInterlockedInsertTailList
VerifierExInterlockedPopEntryList
VerifierExInterlockedPushEntryList
VerifierExInterlockedRemoveHeadList
VerifierExIsProcessorFeaturePresent
VerifierExIsResourceAcquiredExclusiveLite
VerifierExIsResourceAcquiredSharedLite
VerifierExRaiseAccessViolation
VerifierExRaiseDatatypeMisalignment
VerifierExRaiseStatus
VerifierExRegisterCallback
VerifierExReinitializeResourceLite
VerifierExReleaseFastMutex
VerifierExReleaseFastMutexUnsafe
VerifierExReleaseResourceAndLeaveCriticalRegion
VerifierExReleaseResourceAndLeavePriorityRegion
VerifierExReleaseResourceForThreadLite
VerifierExReleaseResourceLite
VerifierExReleaseRundownProtection
VerifierExReleaseRundownProtectionCacheAware
VerifierExReleaseRundownProtectionEx
VerifierExSetResourceOwnerPointer
VerifierExSetResourceOwnerPointerEx
VerifierExSetTimerResolution
VerifierExTryToAcquireFastMutex
VerifierExUnregisterCallback
VerifierExUuidCreate
VerifierExWaitForRundownProtectionRelease
VerifierExWaitForRundownProtectionReleaseCacheAware
VerifierExfAcquirePushLockExclusive
VerifierExfAcquirePushLockShared
VerifierExfReleasePushLock
VerifierExfReleasePushLockShared
VerifierExfTryAcquirePushLockShared
VerifierExfTryToWakePushLock
VerifierExpInterlockedFlushSList
VerifierExpInterlockedPopEntrySList
VerifierExpInterlockedPushEntrySList
VerifierFsRtlAllocateFileLock
VerifierFsRtlAreNamesEqual
VerifierFsRtlBalanceReads
VerifierFsRtlCancellableWaitForMultipleObjects
VerifierFsRtlCancellableWaitForSingleObject
VerifierFsRtlCheckLockForReadAccess
VerifierFsRtlCheckLockForWriteAccess
VerifierFsRtlCopyWrite
VerifierFsRtlDeregisterUncProvider
VerifierFsRtlDissectName
VerifierFsRtlDoesNameContainWildCards
VerifierFsRtlFastCheckLockForRead
VerifierFsRtlFastCheckLockForWrite
VerifierFsRtlFastUnlockAll
VerifierFsRtlFastUnlockAllByKey
VerifierFsRtlFastUnlockSingle
VerifierFsRtlFreeFileLock
VerifierFsRtlGetFileSize
VerifierFsRtlGetNextFileLock
VerifierFsRtlIncrementCcFastReadNoWait
VerifierFsRtlIncrementCcFastReadWait
VerifierFsRtlInitializeFileLock
VerifierFsRtlIsNameInExpression
VerifierFsRtlMdlReadCompleteDev
VerifierFsRtlMdlWriteCompleteDev
VerifierFsRtlNotifyFilterChangeDirectory
VerifierFsRtlNotifyFilterReportChange
VerifierFsRtlNotifyFullChangeDirectory
VerifierFsRtlNotifyFullReportChange
VerifierFsRtlPrivateLock
VerifierFsRtlProcessFileLock
VerifierFsRtlRegisterUncProvider
VerifierFsRtlRegisterUncProviderEx
VerifierFsRtlRemoveDotsFromPath
VerifierFsRtlUninitializeFileLock
VerifierFsRtlValidateReparsePointBuffer
VerifierHalExamineMBR
VerifierIoAcquireCancelSpinLock
VerifierIoAcquireRemoveLockEx
VerifierIoAcquireVpbSpinLock
VerifierIoAllocateController
VerifierIoAllocateDriverObjectExtension
VerifierIoAllocateErrorLogEntry
VerifierIoAllocateIrp
VerifierIoAllocateIrpEx
VerifierIoAllocateMdl
VerifierIoAllocateWorkItem
VerifierIoAttachDevice
VerifierIoAttachDeviceToDeviceStack
VerifierIoAttachDeviceToDeviceStackSafe
VerifierIoCancelIrp
VerifierIoCheckShareAccess
VerifierIoConnectInterrupt
VerifierIoConnectInterruptEx
VerifierIoCreateController
VerifierIoCreateDevice
VerifierIoCreateFile
VerifierIoCreateFileEx
VerifierIoCreateFileSpecifyDeviceObjectHint
VerifierIoCreateNotificationEvent
VerifierIoCreateSymbolicLink
VerifierIoCreateSynchronizationEvent
VerifierIoCreateUnprotectedSymbolicLink
VerifierIoDeleteController
VerifierIoDeleteDevice
VerifierIoDeleteSymbolicLink
VerifierIoDetachDevice
VerifierIoDisconnectInterrupt
VerifierIoDisconnectInterruptEx
VerifierIoFreeController
VerifierIoFreeMdl
VerifierIoGetAttachedDeviceReference
VerifierIoGetConfigurationInformation
VerifierIoGetDeviceDirectory
VerifierIoGetDeviceInterfaceAlias
VerifierIoGetDeviceInterfaces
VerifierIoGetDeviceNumaNode
VerifierIoGetDeviceObjectPointer
VerifierIoGetDeviceProperty
VerifierIoGetDevicePropertyData
VerifierIoGetDeviceToVerify
VerifierIoGetDriverDirectory
VerifierIoGetFileObjectGenericMapping
VerifierIoGetInitialStack
VerifierIoInitializeIrp
VerifierIoInitializeRemoveLockEx
VerifierIoInitializeWorkItem
VerifierIoInvalidateDeviceRelations
VerifierIoIsWdmVersionAvailable
VerifierIoOpenDeviceInterfaceRegistryKey
VerifierIoOpenDeviceRegistryKey
VerifierIoOpenDriverRegistryKey
VerifierIoRaiseHardError
VerifierIoRaiseInformationalHardError
VerifierIoReadPartitionTable
VerifierIoReadPartitionTableEx
VerifierIoRegisterBootDriverReinitialization
VerifierIoRegisterDeviceInterface
VerifierIoRegisterDriverReinitialization
VerifierIoRegisterLastChanceShutdownNotification
VerifierIoRegisterPlugPlayNotification
VerifierIoRegisterShutdownNotification
VerifierIoReleaseCancelSpinLock
VerifierIoReleaseRemoveLockAndWaitEx
VerifierIoReleaseRemoveLockEx
VerifierIoReleaseVpbSpinLock
VerifierIoRemoveShareAccess
VerifierIoReplacePartitionUnit
VerifierIoReportDetectedDevice
VerifierIoReportTargetDeviceChange
VerifierIoReportTargetDeviceChangeAsynchronous
VerifierIoReuseIrp
VerifierIoSetCompletionRoutineEx
VerifierIoSetDeviceInterfaceState
VerifierIoSetDevicePropertyData
VerifierIoSetDeviceToVerify
VerifierIoSetPartitionInformation
VerifierIoSetPartitionInformationEx
VerifierIoSetShareAccess
VerifierIoSetStartIoAttributes
VerifierIoStartNextPacket
VerifierIoUnregisterPlugPlayNotification
VerifierIoUnregisterPlugPlayNotificationEx
VerifierIoUnregisterShutdownNotification
VerifierIoUpdateShareAccess
VerifierIoVolumeDeviceToDosName
VerifierIoWMIAllocateInstanceIds
VerifierIoWMIRegistrationControl
VerifierIoWMIWriteEvent
VerifierIoWriteErrorLogEntry
VerifierIoWritePartitionTable
VerifierIoWritePartitionTableEx
VerifierIofCompleteRequest
VerifierKeAcquireGuardedMutex
VerifierKeAcquireGuardedMutexUnsafe
VerifierKeAcquireInStackQueuedSpinLockAtDpcLevel
VerifierKeAcquireInStackQueuedSpinLockCommon
VerifierKeAcquireInStackQueuedSpinLockForDpc
VerifierKeAcquireInStackQueuedSpinLockRaiseToSynch
VerifierKeAcquireInterruptSpinLock
VerifierKeAcquireQueuedSpinLock
VerifierKeAcquireQueuedSpinLockRaiseToSynch
VerifierKeAcquireSpinLockAtDpcLevel
VerifierKeAcquireSpinLockForDpc
VerifierKeAcquireSpinLockRaiseToDpc
VerifierKeAreAllApcsDisabled
VerifierKeAreApcsDisabled
VerifierKeCancelTimer
VerifierKeClearEvent
VerifierKeDelayExecutionThread
VerifierKeDeregisterNmiCallback
VerifierKeEnterCriticalRegion
VerifierKeEnterGuardedRegion
VerifierKeFlushQueuedDpcs
VerifierKeInitializeDeviceQueue
VerifierKeInitializeEvent
VerifierKeInitializeGuardedMutex
VerifierKeInitializeMutant
VerifierKeInitializeMutex
VerifierKeInitializeSemaphore
VerifierKeInitializeTimer
VerifierKeInitializeTimerEx
VerifierKeInsertByKeyDeviceQueue
VerifierKeInsertDeviceQueue
VerifierKeInsertHeadQueue
VerifierKeInsertQueue
VerifierKeInsertQueueDpc
VerifierKeLeaveCriticalRegion
VerifierKeLeaveGuardedRegion
VerifierKeLowerIrql
VerifierKePulseEvent
VerifierKeQueryPriorityThread
VerifierKeQueryRuntimeThread
VerifierKeReadStateEvent
VerifierKeReadStateMutex
VerifierKeReadStateSemaphore
VerifierKeReadStateTimer
VerifierKeRegisterNmiCallback
VerifierKeReleaseGuardedMutex
VerifierKeReleaseGuardedMutexUnsafe
VerifierKeReleaseInStackQueuedSpinLock
VerifierKeReleaseInStackQueuedSpinLockForDpc
VerifierKeReleaseInStackQueuedSpinLockFromDpcLevel
VerifierKeReleaseInterruptSpinLock
VerifierKeReleaseMutant
VerifierKeReleaseMutex
VerifierKeReleaseQueuedSpinLock
VerifierKeReleaseSemaphore
VerifierKeReleaseSpinLock
VerifierKeReleaseSpinLockForDpc
VerifierKeReleaseSpinLockFromDpcLevel
VerifierKeRemoveByKeyDeviceQueue
VerifierKeRemoveDeviceQueue
VerifierKeRemoveEntryDeviceQueue
VerifierKeRemoveQueue
VerifierKeRemoveQueueDpc
VerifierKeResetEvent
VerifierKeRestoreExtendedProcessorState
VerifierKeSaveExtendedProcessorState
VerifierKeSetEvent
VerifierKeSetSystemGroupAffinityThread
VerifierKeSetTimer
VerifierKeSetTimerEx
VerifierKeSynchronizeExecution
VerifierKeTestSpinLock
VerifierKeTryToAcquireGuardedMutex
VerifierKeTryToAcquireQueuedSpinLock
VerifierKeTryToAcquireQueuedSpinLockRaiseToSynch
VerifierKeTryToAcquireSpinLockAtDpcLevel
VerifierKeWaitForMultipleObjects
VerifierKeWaitForSingleObject
VerifierMmAddPhysicalMemory
VerifierMmAllocateContiguousMemory
VerifierMmAllocateContiguousMemoryEx
VerifierMmAllocateContiguousMemorySpecifyCache
VerifierMmAllocateContiguousMemorySpecifyCacheNode
VerifierMmAllocateContiguousNodeMemory
VerifierMmAllocateMappingAddress
VerifierMmAllocateNodePagesForMdlEx
VerifierMmAllocateNonCachedMemory
VerifierMmAllocatePagesForMdl
VerifierMmAllocatePagesForMdlEx
VerifierMmBuildMdlForNonPagedPool
VerifierMmCreateMdl
VerifierMmCreateMirror
VerifierMmCreateSection
VerifierMmDoesFileHaveUserWritableReferences
VerifierMmFreeContiguousMemory
VerifierMmFreeContiguousMemorySpecifyCache
VerifierMmFreeNonCachedMemory
VerifierMmFreePagesFromMdl
VerifierMmGetPhysicalMemoryRanges
VerifierMmGetSystemRoutineAddress
VerifierMmLockPagableDataSection
VerifierMmLockPagableSectionByHandle
VerifierMmMapIoSpace
VerifierMmMapLockedPages
VerifierMmMapLockedPagesSpecifyCache
VerifierMmMapLockedPagesWithReservedMapping
VerifierMmMapViewOfSection
VerifierMmPageEntireDriver
VerifierMmPrefetchPages
VerifierMmProbeAndLockPages
VerifierMmProbeAndLockProcessPages
VerifierMmProtectMdlSystemAddress
VerifierMmRemovePhysicalMemory
VerifierMmResetDriverPaging
VerifierMmSecureVirtualMemory
VerifierMmUnlockPagableImageSection
VerifierMmUnlockPages
VerifierMmUnmapIoSpace
VerifierMmUnmapLockedPages
VerifierMmUnsecureVirtualMemory
VerifierNtCreateFile
VerifierNtCreateSection
VerifierNtDeleteFile
VerifierNtLockFile
VerifierNtMapViewOfSection
VerifierNtOpenFile
VerifierNtReadFile
VerifierNtSetInformationFile
VerifierNtUnlockFile
VerifierNtWriteFile
VerifierObGetObjectSecurity
VerifierObReferenceObjectByHandle
VerifierObReferenceObjectByHandleWithTag
VerifierObReferenceObjectByPointer
VerifierObReferenceObjectByPointerWithTag
VerifierObReleaseObjectSecurity
VerifierObfDereferenceObject
VerifierObfDereferenceObjectWithTag
VerifierObfReferenceObject
VerifierObfReferenceObjectWithTag
VerifierPoCallDriver
VerifierPoFxActivateComponent
VerifierPoFxCompleteDevicePowerNotRequired
VerifierPoFxCompleteIdleCondition
VerifierPoFxCompleteIdleState
VerifierPoFxIdleComponent
VerifierPoFxNotifySurprisePowerOn
VerifierPoFxPowerControl
VerifierPoFxRegisterDevice
VerifierPoFxReportDevicePoweredOn
VerifierPoFxSetComponentLatency
VerifierPoFxSetComponentResidency
VerifierPoFxSetComponentWake
VerifierPoFxSetDeviceIdleTimeout
VerifierPoFxStartDevicePowerManagement
VerifierPoFxUnregisterDevice
VerifierPoRequestPowerIrp
VerifierPortExAllocatePoolWithQuotaTag
VerifierPortExAllocatePoolWithTagPriority
VerifierPortIoAllocateIrp
VerifierPortIoAllocateMdl
VerifierPortIoAllocateWorkItem
VerifierPortKeReleaseSpinLock
VerifierProbeForRead
VerifierProbeForWrite
VerifierPsAssignImpersonationToken
VerifierPsCreateSystemThread
VerifierPsDereferenceImpersonationToken
VerifierPsDereferencePrimaryToken
VerifierPsDisableImpersonation
VerifierPsGetVersion
VerifierPsImpersonateClient
VerifierPsReferenceImpersonationToken
VerifierPsReferencePrimaryToken
VerifierPsRemoveLoadImageNotifyRoutine
VerifierPsRestoreImpersonation
VerifierPsRevertToSelf
VerifierPsSetCreateProcessNotifyRoutine
VerifierPsSetCreateProcessNotifyRoutineEx
VerifierPsSetCreateThreadNotifyRoutine
VerifierPsSetLoadImageNotifyRoutine
VerifierPsTerminateSystemThread
VerifierRtlAnsiStringToUnicodeString
VerifierRtlCheckRegistryKey
VerifierRtlCompareUnicodeString
VerifierRtlCreateRegistryKey
VerifierRtlCreateSystemVolumeInformationFolder
VerifierRtlCreateUnicodeString
VerifierRtlDeleteRegistryValue
VerifierRtlDowncaseUnicodeChar
VerifierRtlDowncaseUnicodeString
VerifierRtlDuplicateUnicodeString
VerifierRtlEqualUnicodeString
VerifierRtlFreeUnicodeString
VerifierRtlGUIDFromString
VerifierRtlGenerateClass5Guid
VerifierRtlHashUnicodeString
VerifierRtlOemStringToCountedUnicodeString
VerifierRtlOemStringToUnicodeString
VerifierRtlQueryRegistryValueWithFallback
VerifierRtlQueryRegistryValues
VerifierRtlQueryRegistryValuesEx
VerifierRtlStringFromGUID
VerifierRtlUTF8ToUnicodeN
VerifierRtlUnicodeStringToAnsiString
VerifierRtlUnicodeStringToCountedOemString
VerifierRtlUnicodeStringToOemString
VerifierRtlUnicodeToUTF8N
VerifierRtlUpcaseUnicodeChar
VerifierRtlUpcaseUnicodeString
VerifierRtlUpcaseUnicodeStringToAnsiString
VerifierRtlUpcaseUnicodeStringToCountedOemString
VerifierRtlUpcaseUnicodeStringToOemString
VerifierRtlWriteRegistryValue
VerifierRtlxAnsiStringToUnicodeSize
VerifierRtlxUnicodeStringToAnsiSize
VerifierSeAccessCheck
VerifierSeAssignSecurity
VerifierSeAssignSecurityEx
VerifierSeDeassignSecurity
VerifierSeLockSubjectContext
VerifierSeReleaseSubjectContext
VerifierSeSinglePrivilegeCheck
VerifierSeUnlockSubjectContext
VerifierSeValidSecurityDescriptor
VerifierZwAccessCheckAndAuditAlarm
VerifierZwAddBootEntry
VerifierZwAddDriverEntry
VerifierZwAdjustPrivilegesToken
VerifierZwAllocateLocallyUniqueId
VerifierZwAllocateVirtualMemory
VerifierZwAlpcAcceptConnectPort
VerifierZwAlpcConnectPort
VerifierZwAlpcCreatePort
VerifierZwAlpcCreatePortSection
VerifierZwAlpcCreateResourceReserve
VerifierZwAlpcCreateSectionView
VerifierZwAlpcCreateSecurityContext
VerifierZwAlpcQueryInformation
VerifierZwAlpcSendWaitReceivePort
VerifierZwAlpcSetInformation
VerifierZwCancelIoFile
VerifierZwCancelTimer
VerifierZwClose
VerifierZwCloseObjectAuditAlarm
VerifierZwCommitComplete
VerifierZwCommitEnlistment
VerifierZwCommitTransaction
VerifierZwConnectPort
VerifierZwCreateDirectoryObject
VerifierZwCreateEnlistment
VerifierZwCreateEvent
VerifierZwCreateFile
VerifierZwCreateJobObject
VerifierZwCreateKey
VerifierZwCreateKeyTransacted
VerifierZwCreateResourceManager
VerifierZwCreateSection
VerifierZwCreateSymbolicLinkObject
VerifierZwCreateTimer
VerifierZwCreateTransaction
VerifierZwCreateTransactionManager
VerifierZwDeleteBootEntry
VerifierZwDeleteFile
VerifierZwDeleteKey
VerifierZwDeleteValueKey
VerifierZwDeviceIoControlFile
VerifierZwDisplayString
VerifierZwDuplicateObject
VerifierZwDuplicateToken
VerifierZwEnumerateBootEntries
VerifierZwEnumerateDriverEntries
VerifierZwEnumerateKey
VerifierZwEnumerateTransactionObject
VerifierZwEnumerateValueKey
VerifierZwFlushBuffersFile
VerifierZwFlushBuffersFileEx
VerifierZwFlushInstructionCache
VerifierZwFlushKey
VerifierZwFlushVirtualMemory
VerifierZwFreeVirtualMemory
VerifierZwFsControlFile
VerifierZwGetNotificationResourceManager
VerifierZwLoadDriver
VerifierZwLoadKey
VerifierZwLockFile
VerifierZwMapViewOfSection
VerifierZwModifyBootEntry
VerifierZwModifyDriverEntry
VerifierZwNotifyChangeKey
VerifierZwOpenDirectoryObject
VerifierZwOpenEnlistment
VerifierZwOpenEvent
VerifierZwOpenFile
VerifierZwOpenJobObject
VerifierZwOpenKey
VerifierZwOpenKeyEx
VerifierZwOpenKeyTransacted
VerifierZwOpenKeyTransactedEx
VerifierZwOpenProcess
VerifierZwOpenProcessToken
VerifierZwOpenProcessTokenEx
VerifierZwOpenResourceManager
VerifierZwOpenSection
VerifierZwOpenSymbolicLinkObject
VerifierZwOpenThread
VerifierZwOpenThreadToken
VerifierZwOpenThreadTokenEx
VerifierZwOpenTimer
VerifierZwOpenTransaction
VerifierZwOpenTransactionManager
VerifierZwPowerInformation
VerifierZwPrePrepareComplete
VerifierZwPrePrepareEnlistment
VerifierZwPrepareComplete
VerifierZwPrepareEnlistment
VerifierZwProtectVirtualMemory
VerifierZwPulseEvent
VerifierZwQueryBootEntryOrder
VerifierZwQueryBootOptions
VerifierZwQueryDefaultLocale
VerifierZwQueryDefaultUILanguage
VerifierZwQueryDirectoryFile
VerifierZwQueryDirectoryFileEx
VerifierZwQueryDirectoryObject
VerifierZwQueryDriverEntryOrder
VerifierZwQueryEaFile
VerifierZwQueryFullAttributesFile
VerifierZwQueryInformationEnlistment
VerifierZwQueryInformationFile
VerifierZwQueryInformationJobObject
VerifierZwQueryInformationProcess
VerifierZwQueryInformationResourceManager
VerifierZwQueryInformationThread
VerifierZwQueryInformationToken
VerifierZwQueryInformationTransaction
VerifierZwQueryInformationTransactionManager
VerifierZwQueryInstallUILanguage
VerifierZwQueryKey
VerifierZwQueryLicenseValue
VerifierZwQueryObject
VerifierZwQueryQuotaInformationFile
VerifierZwQuerySection
VerifierZwQuerySecurityObject
VerifierZwQuerySymbolicLinkObject
VerifierZwQuerySystemInformation
VerifierZwQueryValueKey
VerifierZwQueryVolumeInformationFile
VerifierZwReadFile
VerifierZwReadOnlyEnlistment
VerifierZwRecoverEnlistment
VerifierZwRecoverTransactionManager
VerifierZwRemoveIoCompletionEx
VerifierZwRenameKey
VerifierZwReplaceKey
VerifierZwRequestWaitReplyPort
VerifierZwResetEvent
VerifierZwRestoreKey
VerifierZwRollbackComplete
VerifierZwRollbackEnlistment
VerifierZwRollbackTransaction
VerifierZwSetBootEntryOrder
VerifierZwSetBootOptions
VerifierZwSetDriverEntryOrder
VerifierZwSetEaFile
VerifierZwSetEvent
VerifierZwSetInformationEnlistment
VerifierZwSetInformationFile
VerifierZwSetInformationJobObject
VerifierZwSetInformationKey
VerifierZwSetInformationObject
VerifierZwSetInformationProcess
VerifierZwSetInformationResourceManager
VerifierZwSetInformationThread
VerifierZwSetInformationToken
VerifierZwSetInformationTransaction
VerifierZwSetQuotaInformationFile
VerifierZwSetSecurityObject
VerifierZwSetSystemInformation
VerifierZwSetSystemTime
VerifierZwSetTimer
VerifierZwSetTimerEx
VerifierZwSetValueKey
VerifierZwSetVolumeInformationFile
VerifierZwTerminateProcess
VerifierZwTranslateFilePath
VerifierZwUnloadDriver
VerifierZwUnloadKey
VerifierZwUnlockFile
VerifierZwUnmapViewOfSection
VerifierZwWaitForMultipleObjects
VerifierZwWaitForSingleObject
VerifierZwWriteFile
VfAllocateAdapterChannel
VfAllocateAdapterChannelEx
VfAllocateCommonBuffer
VfAllocateCommonBufferEx
VfAllocateCommonBufferVector
VfAllocateCommonBufferWithBounds
VfAllocateCrashDumpRegisters
VfAllocateCrashDumpRegistersEx
VfAllocateDomainCommonBuffer
VfAvlEnumerateNodes
VfBuildMdlFromScatterGatherList
VfBuildScatterGatherList
VfBuildScatterGatherListEx
VfCalculateScatterGatherListSize
VfCancelAdapterChannel
VfCancelMappedTransfer
VfConfigureAdapterChannel
VfCreateCommonBufferFromMdl
VfExAllocPoolInternal
VfFlushAdapterBuffers
VfFlushAdapterBuffersEx
VfFlushDmaBuffer
VfFreeAdapterChannel
VfFreeAdapterObject
VfFreeCommonBuffer
VfFreeCommonBufferFromVector
VfFreeCommonBufferVector
VfFreeCrashDumpRegistersEx
VfFreeMapRegisters
VfGetCommonBufferFromVectorByIndex
VfGetDmaAdapter
VfGetDmaAdapterInfo
VfGetDmaAlignment
VfGetDmaDomain
VfGetDmaTransferInfo
VfGetScatterGatherList
VfGetScatterGatherListEx
VfHalAllocateMapRegisters
VfInitializeDmaTransferContext
VfIoFreeIrp
VfIrpDatabaseEntryReleaseLock
VfJoinDmaDomain
VfLeaveDmaDomain
VfMajorAdvanceIrpStatus
VfMajorBuildIrpLogEntry
VfMajorIsNewRequest
VfMajorIsValidIrpStatus
VfMajorTestStartedPdoStack
VfMajorVerifyFinalIrpStack
VfMajorVerifyIrpStackDownward
VfMajorVerifyIrpStackUpward
VfMajorVerifyNewIrp
VfMajorVerifyNewRequest
VfMapTransfer
VfMapTransferEx
VfNotifyOfHibernate
VfPendingMoreProcessingRequired
VfPutDmaAdapter
VfPutScatterGatherList
VfQueryDispatchTable
VfReadDmaCounter
VfRemoveContext
ViAdapterCallback
ViCtxIsr
ViCtxIsrMessageBased
ViKeAcquireSpinLockCommon
ViPendingCompleteAfterWait
ViPtCaptureTraceInformationCallBack
ViScatterGatherCallback
ViSpecialAllocateCommonBuffer
ViSpecialFreeCommonBuffer
ViXdvDriverLoadImage
ViXdvSetXdvKernelUtilities
VmpCleanProcessAddressSpace
VmpPrefetchVirtualAddresses
VslHandleKsrCall
VslpIumPhase0Initialize
WdInstrExecuteInstruction
WdtpBarkWorkerThread
WdtpTimerCallback
WheaFlushETWEventsWorkerRoutine
WheaInitialize
WheaReportHwError
WheaSignalHandlerOverride
WheapCallErrorSourceCorrect
WheapCallErrorSourceInitialize
WheapCallErrorSourceRecover
WheapCallErrorSourceUninitialize
WheapCallInUsePageNotificationCallbacks
WheapDeferredRecoveryServiceDpcRoutine
WheapDeferredRecoveryServiceWorker
WheapGenericErrSrcRecover
WheapLogIpmiSELEventHighIrql
WheapReportBootError
WheapWorkQueueWorkerRoutine
WmipForwardWmiIrp
WmipProcessEvent
WmipUnreferenceEntry
WritePortWithIndex16
WritePortWithIndex32
WritePortWithIndex8
WriteRegisterWithIndex16
WriteRegisterWithIndex32
WriteRegisterWithIndex64
WriteRegisterWithIndex8
XdvExInitializeLookasideListExInternal
XdvExInitializeNPagedLookasideListInternal
XdvIoAllocateIrp
XdvIoAllocateMdl
XdvIoAllocateWorkItem
XdvIoBuildDeviceIoControlRequest
XdvIoBuildSynchronousFsdRequest
XdvIopBuildAsynchronousFsdRequest
XmEmulateStream
XmInt1aFindPciClassCode
XmInt1aFindPciDevice
XmInt1aReadConfigRegister
XmInt1aWriteConfigRegister
_CmAddDeviceToContainer
_CmAddPanelDevice
_CmClassFilterCallback
_CmClassSubkeyCallback
_CmContainerListGenericObjectCallback
_CmCreateDevice
_CmCreateDeviceContainer
_CmCreateDeviceInterface
_CmCreateDevicePanel
_CmCreateInstallerClass
_CmCreateInterfaceClass
_CmDeleteCommonClassRegKey
_CmDeleteDevice
_CmDeleteDeviceContainer
_CmDeleteDeviceContainerRegKey
_CmDeleteDeviceInterface
_CmDeleteDeviceInterfaceRegKey
_CmDeleteDevicePanel
_CmDeleteDevicePanelRegKey
_CmDeleteDeviceRegKey
_CmDeleteInstallerClass
_CmDeleteInterfaceClass
_CmDeviceClassesSubkeyCallback
_CmDevicePanelEnumSubkeyCallback
_CmEnumDevicesInContainerWithCallback
_CmEnumDevicesInContainerWithCallbackWorker
_CmEnumSubkeyCallback
_CmGetDeviceRegProp
_CmGetInstallerClassRegProp
_CmGetMatchingCommonClassList
_CmGetMatchingDeviceContainerList
_CmGetMatchingDeviceInterfaceList
_CmGetMatchingDeviceList
_CmGetMatchingDevicePanelList
_CmGetMatchingFilteredDeviceInterfaceList
_CmGetMatchingFilteredDeviceList
_CmIsDeviceInterfaceEnabled
_CmOpenCommonClassRegKey
_CmOpenDeviceContainerRegKey
_CmOpenDeviceInterfaceRegKey
_CmOpenDevicePanelRegKey
_CmOpenDeviceRegKey
_CmRaiseCreateEvent
_CmRaiseDeleteEvent
_CmRaisePropertyChangeEvent
_CmRemoveDeviceFromContainer
_CmRemovePanelDevice
_CmServiceFilterCallback
_CmSetDeviceRegProp
_CmSetInstallerClassRegProp
_NtPlugPlayGetDeviceProperty
_NtPlugPlayGetDeviceRelatedDevice
_NtPlugPlayGetDeviceRelationsList
_NtPlugPlayGetDeviceStatus
_PnpCmMatchCallbackRoutine
_PnpContainerRaiseDevicesChangeEvent
_PnpCreateObject
_PnpCreateObjectDispatch
_PnpCtxInternalEnumKeyCallback
_PnpCtxRegQueryValueIndirect
_PnpDeleteObject
_PnpDeleteObjectDispatch
_PnpDeviceRaisePropertyChangeEventWorker
_PnpGetMappedPropertyDispatch
_PnpGetMappedPropertyKeysDispatch
_PnpGetMappedPropertyLocalesDispatch
_PnpGetObjectList
_PnpGetObjectListDispatch
_PnpGetObjectProperty
_PnpGetObjectPropertyKeys
_PnpGetObjectPropertyLocales
_PnpInstallerClassRaisePropertyChangeEventWorker
_PnpInterfaceClassRaisePropertyChangeEventWorker
_PnpInterfaceRaisePropertyChangeEventWorker
_PnpNotifyDerivedKeys
_PnpObjectListCallback
_PnpObjectRaiseCreateEvent
_PnpObjectRaiseDeleteEvent
_PnpObjectRaiseDevicesChangeEvent
_PnpObjectRaisePropertyChangeEvent
_PnpOpenObjectRegKey
_PnpOpenObjectRegKeyDispatch
_PnpSetMappedPropertyDispatch
_PnpSetObjectProperty
_PnpUpdateInterfacesCallback
_PnpValidateObjectName
_PnpValidateObjectNameDispatch
_RegRtlOpenKeyTransacted
_SysCtxInternalEnumSubkeyCallback
_tlgEnableCallback
entry
pIoQueryBusDescription
pIoQueryDeviceDescription
qsort
qsort_s
vDbgPrintExWithPrefixInternal
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToService
wil_details_FeatureReporting_ReportUsageToServiceDirect
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
x86BiosGetPciBusData
x86BiosReadPciDataPort
x86BiosSetPciBusData
x86BiosWritePciDataPort
paramcount 0 0
address 14041d440 14041d510
sig undefined _guard_dispatch_icall(void) undefined _guard_dispatch_icall(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

_guard_dispatch_icall Called Diff

--- _guard_dispatch_icall called
+++ _guard_dispatch_icall called
@@ -1 +1 @@
-FUN_14041d490
+FUN_14041d560

_guard_dispatch_icall Calling Diff

--- _guard_dispatch_icall calling
+++ _guard_dispatch_icall calling
@@ -701,3 +701,3 @@
-FUN_1404166db
-FUN_14066b630
-FUN_14066c334
+FUN_1404167ab
+FUN_14066b730
+FUN_14066c434
@@ -706,14 +706,14 @@
-FUN_140709640
-FUN_140709974
-FUN_140768f34
-FUN_14084356c
-FUN_140a4b524
-FUN_140a4b914
-FUN_140a4c0d0
-FUN_140a4c310
-FUN_140a4c860
-FUN_140a4ce10
-FUN_140a4d1c4
-FUN_140a4db54
-FUN_140a4e0ec
-FUN_140a4e508
+FUN_14070a1a0
+FUN_14070a4d4
+FUN_140769944
+FUN_140843f7c
+FUN_140a4b4b4
+FUN_140a4b8a4
+FUN_140a4c060
+FUN_140a4c2a0
+FUN_140a4c7f0
+FUN_140a4cda0
+FUN_140a4d154
+FUN_140a4dae4
+FUN_140a4e07c
+FUN_140a4e498
@@ -1529,0 +1530 @@
+KxSwitchKernelStackCallout
@@ -1531 +1531,0 @@
-KySwitchKernelStackCallout
@@ -2903,0 +2904,3 @@
+wil_details_FeatureReporting_ReportUsageToService
+wil_details_FeatureReporting_ReportUsageToServiceDirect
+wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState

FUN_140707cb0

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type name,fullname,refcount,sig,address,calling
ratio 0.9
i_ratio 0.82
m_ratio 1.0
b_ratio 1.0
match_types ExactInstructionsFunctionHasher

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name FUN_140707cb0 FUN_140708564
fullname FUN_140707cb0 FUN_140708564
refcount 3 4
length 145 145
called ExFreePoolWithTag
RtlCompareMemory
WbHashData		 ExFreePoolWithTag
RtlCompareMemory
WbHashData
calling WbCreateHeapExecutedBlock
WbInitializeEncryptionSegment		 FUN_14070897c
WbInitializeEncryptionSegment
paramcount 0 0
address 140707cb0 140708564
sig undefined FUN_140707cb0(void) undefined FUN_140708564(void)
sym_type Function Function
sym_source DEFAULT DEFAULT
external False False

FUN_140707cb0 Calling Diff

--- FUN_140707cb0 calling
+++ FUN_140708564 calling
@@ -1 +1 @@
-WbCreateHeapExecutedBlock
+FUN_14070897c

wil_details_FeatureStateCache_GetCachedFeatureEnabledState

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 1.0
i_ratio 0.79
m_ratio 1.0
b_ratio 1.0
match_types ExactInstructionsFunctionHasher

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name wil_details_FeatureStateCache_GetCachedFeatureEnabledState wil_details_FeatureStateCache_GetCachedFeatureEnabledState
fullname wil_details_FeatureStateCache_GetCachedFeatureEnabledState wil_details_FeatureStateCache_GetCachedFeatureEnabledState
refcount 37 38
length 53 53
called wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState wil_details_FeatureStateCache_ReevaluateCachedFeatureEnabledState
calling
Expand for full list:
Feature_1429194047__private_IsEnabled
Feature_2485082431__private_IsEnabled
Feature_3566457150__private_IsEnabled
Feature_CcImprovementsForReFS__private_IsEnabled
Feature_FastResource2__private_IsEnabled
Feature_FsctlProcessMitigation__private_IsEnabled
Feature_ImprovedCpuAttribution__private_GetCachedFeatureEnabledState
Feature_LivedumpProcessFiltering__private_IsEnabled
Feature_Mercury_App_Backup__private_IsEnabled
Feature_Mercury_App_Restore__private_IsEnabled
Feature_PerClassEnergyUnsupported__private_IsEnabledFeature_PerClassEnergyUnsupported__private_IsEnabledWithReporting
Feature_REFSDV__private_IsEnabled
Feature_SensorDimDisplayTimeouts__private_IsEnabled
Feature_Servicing_CopyEABufferHandling__private_IsEnabled
Feature_Servicing_DeadlineQosReschedule__private_IsEnabled
Feature_Servicing_GuardDroppedCharges__private_IsEnabled
Feature_Servicing_IommuApiPasid__private_IsEnabled
Feature_Servicing_Kernel_DMA_Compliance__private_IsEnabled
Feature_Servicing_MercuryNewSdbTagsForBackup__private_IsEnabled
Feature_Servicing_NonPagedQueryLogicalProcessorRelationship__private_IsEnabled
Feature_Servicing_OemToUnicodeFix__private_IsEnabled
Feature_Servicing_OplockCancelTracing__private_IsEnabled
Feature_Servicing_OplocksWritableMappedSectionsFix__private_IsEnabled
Feature_Servicing_PPMFixUnparkingAllCores__private_IsEnabled
Feature_Servicing_PageZeroingParkedCoresFix__private_IsEnabled
Feature_Servicing_Ref_Count_Disacrded_Kcbs__private_IsEnabled
Feature_Servicing_RevalidateNoUMCI_42288025__private_IsEnabled
Feature_Servicing_SecImageNoExecuteIntegrityCheck__private_IsEnabled
Feature_Servicing_SecureDevAts__private_IsEnabled
Feature_Servicing_SetVadPageSize__private_IsEnabled
Feature_Servicing_WriteProcessMemory_SGXDebug__private_IsEnabled
Feature_TriageDumpDataExtension__private_IsEnabled
Feature_VHDAutoAttachOnBoot__private_IsEnabled
wil_details_GetCurrentFeatureEnabledState
Expand for full list:
Feature_1429194047__private_IsEnabled
Feature_2485082431__private_IsEnabled
Feature_3566457150__private_IsEnabled
Feature_4256151870__private_IsEnabled
Feature_CcImprovementsForReFS__private_IsEnabled
Feature_FastResource2__private_IsEnabled
Feature_FsctlProcessMitigation__private_IsEnabled
Feature_ImprovedCpuAttribution__private_GetCachedFeatureEnabledState
Feature_LivedumpProcessFiltering__private_IsEnabled
Feature_Mercury_App_Backup__private_IsEnabled
Feature_Mercury_App_Restore__private_IsEnabledFeature_PerClassEnergyUnsupported__private_IsEnabled
Feature_PerClassEnergyUnsupported__private_IsEnabledWithReporting
Feature_REFSDV__private_IsEnabled
Feature_SensorDimDisplayTimeouts__private_IsEnabled
Feature_Servicing_CopyEABufferHandling__private_IsEnabled
Feature_Servicing_DeadlineQosReschedule__private_IsEnabled
Feature_Servicing_GuardDroppedCharges__private_IsEnabled
Feature_Servicing_IommuApiPasid__private_IsEnabled
Feature_Servicing_Kernel_DMA_Compliance__private_IsEnabled
Feature_Servicing_MercuryNewSdbTagsForBackup__private_IsEnabled
Feature_Servicing_NonPagedQueryLogicalProcessorRelationship__private_IsEnabled
Feature_Servicing_OemToUnicodeFix__private_IsEnabled
Feature_Servicing_OplockCancelTracing__private_IsEnabled
Feature_Servicing_OplocksWritableMappedSectionsFix__private_IsEnabled
Feature_Servicing_PPMFixUnparkingAllCores__private_IsEnabled
Feature_Servicing_PageZeroingParkedCoresFix__private_IsEnabled
Feature_Servicing_Ref_Count_Disacrded_Kcbs__private_IsEnabled
Feature_Servicing_RevalidateNoUMCI_42288025__private_IsEnabled
Feature_Servicing_SecImageNoExecuteIntegrityCheck__private_IsEnabled
Feature_Servicing_SecureDevAts__private_IsEnabled
Feature_Servicing_SetVadPageSize__private_IsEnabled
Feature_Servicing_WriteProcessMemory_SGXDebug__private_IsEnabled
Feature_TriageDumpDataExtension__private_IsEnabled
Feature_VHDAutoAttachOnBoot__private_IsEnabled
wil_details_GetCurrentFeatureEnabledState
paramcount 0 0
address 1402d1afc 1402d189c
sig undefined wil_details_FeatureStateCache_GetCachedFeatureEnabledState(void) undefined wil_details_FeatureStateCache_GetCachedFeatureEnabledState(void)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

wil_details_FeatureStateCache_GetCachedFeatureEnabledState Calling Diff

--- wil_details_FeatureStateCache_GetCachedFeatureEnabledState calling
+++ wil_details_FeatureStateCache_GetCachedFeatureEnabledState calling
@@ -3,0 +4 @@
+Feature_4256151870__private_IsEnabled

wil_details_FeatureReporting_ReportUsageToService

Match Info

Key ntoskrnl.exe.10.0.22621.2361 - ntoskrnl.exe.10.0.22621.2428
diff_type refcount,address,calling
ratio 0.98
i_ratio 0.74
m_ratio 1.0
b_ratio 1.0
match_types ExactInstructionsFunctionHasher

Function Meta Diff

Key ntoskrnl.exe.10.0.22621.2361 ntoskrnl.exe.10.0.22621.2428
name wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToService
fullname wil_details_FeatureReporting_ReportUsageToService wil_details_FeatureReporting_ReportUsageToService
refcount 79 80
length 867 867
called CmFcManagerNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache		 CmFcManagerNotifyFeatureUsage
__security_check_cookie
_guard_dispatch_icall
wil_details_FeatureReporting_IncrementOpportunityInCache
wil_details_FeatureReporting_IncrementUsageInCache
calling
Expand for full list:
CmpIsRegistryLockAcquired
CmpRecordRegistryLockAcquire
CmpRecordRegistryLockRelease
Feature_1429194047__private_IsEnabled
Feature_2485082431__private_IsEnabled
Feature_3566457150__private_IsEnabled
Feature_CcImprovementsForReFS__private_IsEnabled
Feature_FastResource2__private_IsEnabled
Feature_IMDSLicensingIntegration__private_IsEnabledPreCheck
Feature_ImprovedCpuAttribution__private_IsEnabled
Feature_ImprovedCpuAttribution__private_IsEnabledWithReportingFeature_LivedumpProcessFiltering__private_IsEnabled
Feature_Mercury_App_Backup__private_IsEnabled
Feature_Mercury_App_Restore__private_IsEnabled
Feature_PerClassEnergyUnsupported__private_IsEnabled
Feature_PerClassEnergyUnsupported__private_IsEnabledWithReporting
Feature_SensorDimDisplayTimeouts__private_IsEnabled
Feature_Servicing_CopyEABufferHandling__private_IsEnabled
Feature_Servicing_DeadlineQosReschedule__private_IsEnabled
Feature_Servicing_GuardDroppedCharges__private_IsEnabled
Feature_Servicing_IommuApiPasid__private_IsEnabled
Feature_Servicing_Kernel_DMA_Compliance__private_IsEnabled
Feature_Servicing_MercuryNewSdbTagsForBackup__private_IsEnabled
Feature_Servicing_NonPagedQueryLogicalProcessorRelationship__private_IsEnabled
Feature_Servicing_OemToUnicodeFix__private_IsEnabled
Feature_Servicing_OplockCancelTracing__private_IsEnabled
Feature_Servicing_OplocksWritableMappedSectionsFix__private_IsEnabled
Feature_Servicing_PPMFixUnparkingAllCores__private_IsEnabled
Feature_Servicing_PageZeroingParkedCoresFix__private_IsEnabled
Feature_Servicing_Ref_Count_Disacrded_Kcbs__private_IsEnabled
Feature_Servicing_RevalidateNoUMCI_42288025__private_IsEnabled
Feature_Servicing_SecImageNoExecuteIntegrityCheck__private_IsEnabled
Feature_Servicing_SecureDevAts__private_IsEnabled
Feature_Servicing_SetVadPageSize__private_IsEnabled
Feature_Servicing_WriteProcessMemory_SGXDebug__private_IsEnabled
Feature_TriageDumpDataExtension__private_IsEnabled
Feature_VHDAutoAttachOnBoot__private_IsEnabled
KeInitializeClock
KeInitializeVelocity
KeIsMultiCoreClassesEnabled
KiAreSoftUnparkingElectionsEnabled
KiInitializeVelocity
KiSearchForNewThreadOnProcessor
MiInitializeCfg
MiProtectSharedUserPage
PopCheckForIdleness
PopHandleSystemIdleReset
PopInitSIdle
PopMonitorInvocation
PopPolicySystemIdle
PopPowerAggregatorForceSessionSwitch
PopPowerAggregatorHandleSystemTransitionEndIntent
PopProcessSessionDisplayStateChange
PopQueryRemainingSystemIdleTime
PopResetIdleTime
PopSwitchUpdateUserShutdownScenarioState
PopSystemIdleWorker
PopUpdateSystemIdleContext
PopUserShutdownScenarioInitialize
PpmHeteroGetHgsPlusParkingEnablementStatus
PpmHeteroInitializeHgsSupport
PpmHeteroIsMultiClassParkingEnabled
PpmPerfSnapUtility
WheaResumedFromHibernate
Expand for full list:
CmpIsRegistryLockAcquired
CmpRecordRegistryLockAcquire
CmpRecordRegistryLockRelease
Feature_1429194047__private_IsEnabled
Feature_2485082431__private_IsEnabled
Feature_3566457150__private_IsEnabled
Feature_4256151870__private_IsEnabled
Feature_CcImprovementsForReFS__private_IsEnabled
Feature_FastResource2__private_IsEnabled
Feature_IMDSLicensingIntegration__private_IsEnabledPreCheck
Feature_ImprovedCpuAttribution__private_IsEnabledFeature_ImprovedCpuAttribution__private_IsEnabledWithReporting
Feature_LivedumpProcessFiltering__private_IsEnabled
Feature_Mercury_App_Backup__private_IsEnabled
Feature_Mercury_App_Restore__private_IsEnabled
Feature_PerClassEnergyUnsupported__private_IsEnabled
Feature_PerClassEnergyUnsupported__private_IsEnabledWithReporting
Feature_SensorDimDisplayTimeouts__private_IsEnabled
Feature_Servicing_CopyEABufferHandling__private_IsEnabled
Feature_Servicing_DeadlineQosReschedule__private_IsEnabled
Feature_Servicing_GuardDroppedCharges__private_IsEnabled
Feature_Servicing_IommuApiPasid__private_IsEnabled
Feature_Servicing_Kernel_DMA_Compliance__private_IsEnabled
Feature_Servicing_MercuryNewSdbTagsForBackup__private_IsEnabled
Feature_Servicing_NonPagedQueryLogicalProcessorRelationship__private_IsEnabled
Feature_Servicing_OemToUnicodeFix__private_IsEnabled
Feature_Servicing_OplockCancelTracing__private_IsEnabled
Feature_Servicing_OplocksWritableMappedSectionsFix__private_IsEnabled
Feature_Servicing_PPMFixUnparkingAllCores__private_IsEnabled
Feature_Servicing_PageZeroingParkedCoresFix__private_IsEnabled
Feature_Servicing_Ref_Count_Disacrded_Kcbs__private_IsEnabled
Feature_Servicing_RevalidateNoUMCI_42288025__private_IsEnabled
Feature_Servicing_SecImageNoExecuteIntegrityCheck__private_IsEnabled
Feature_Servicing_SecureDevAts__private_IsEnabled
Feature_Servicing_SetVadPageSize__private_IsEnabled
Feature_Servicing_WriteProcessMemory_SGXDebug__private_IsEnabled
Feature_TriageDumpDataExtension__private_IsEnabled
Feature_VHDAutoAttachOnBoot__private_IsEnabled
KeInitializeClock
KeInitializeVelocity
KeIsMultiCoreClassesEnabled
KiAreSoftUnparkingElectionsEnabled
KiInitializeVelocity
KiSearchForNewThreadOnProcessor
MiInitializeCfg
MiProtectSharedUserPage
PopCheckForIdleness
PopHandleSystemIdleReset
PopInitSIdle
PopMonitorInvocation
PopPolicySystemIdle
PopPowerAggregatorForceSessionSwitch
PopPowerAggregatorHandleSystemTransitionEndIntent
PopProcessSessionDisplayStateChange
PopQueryRemainingSystemIdleTime
PopResetIdleTime
PopSwitchUpdateUserShutdownScenarioState
PopSystemIdleWorker
PopUpdateSystemIdleContext
PopUserShutdownScenarioInitialize
PpmHeteroGetHgsPlusParkingEnablementStatus
PpmHeteroInitializeHgsSupport
PpmHeteroIsMultiClassParkingEnabled
PpmPerfSnapUtility
WheaResumedFromHibernate
paramcount 7 7
address 140328400 1403283f0
sig undefined wil_details_FeatureReporting_ReportUsageToService(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5, undefined4 param_6, undefined4 param_7) undefined wil_details_FeatureReporting_ReportUsageToService(undefined param_1, undefined param_2, undefined param_3, undefined param_4, undefined8 param_5, undefined4 param_6, undefined4 param_7)
sym_type Function Function
sym_source IMPORTED IMPORTED
external False False

wil_details_FeatureReporting_ReportUsageToService Calling Diff

--- wil_details_FeatureReporting_ReportUsageToService calling
+++ wil_details_FeatureReporting_ReportUsageToService calling
@@ -6,0 +7 @@
+Feature_4256151870__private_IsEnabled

Generated with ghidriff version: 0.5.0 on 2023-10-11T15:45:45

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment