============================================================================================================================================== OFFSET 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F ---------------------------------------------------------------------------------------------------------------------------------------------- 00000000 D8 C6 00 00 00 00 00 00 00 00 00 00 64 CA 00 00 28 B4 00 00 B0 C6 00 00 00 00 00 00 00 00 00 00 ╪╞..........d╩..(┤..░╞.......... 00000020 A6 CA 00 00 00 B4 00 00 BC C6 00 00 00 00 00 00 00 00 00 00 36 CB 00 00 0C B4 00 00 00 00 00 00 ª╩...┤..╝╞..........6╦..♀┤...... 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 92 CA 00 00 7E CA 00 00 00 00 00 00 20 CB 00 00 ................Æ╩..~╩...... ╦.. 00000060 F4 CA 00 00 E0 CA 00 00 C6 CA 00 00 0E CB 00 00 AE CA 00 00 00 00 00 00 4C C8 00 00 64 C8 00 00 ⌠╩..α╩..╞╩..♫╦..«╩......L╚..d╚.. 00000080 76 C8 00 00 8C C8 00 00 3A C8 00 00 20 C8 00 00 A6 C8 00 00 C8 C8 00 00 D6 C8 00 00 F8 C8 00 00 v╚..î╚..:╚.. ╚..ª╚..╚╚..╓╚..°╚.. 000000A0 10 C9 00 00 22 C9 00 00 32 C9 00 00 BE C8 00 00 F6 C7 00 00 06 C8 00 00 8E C9 00 00 A2 C9 00 00 ►╔.."╔..2╔..╛╚..÷╟..♠╚..Ä╔..ó╔.. 000000C0 BE C9 00 00 D4 C9 00 00 E4 C9 00 00 FE C9 00 00 0C CA 00 00 20 CA 00 00 2E CA 00 00 42 CA 00 00 ╛╔..╘╔..Σ╔..■╔..♀╩.. ╩...╩..B╩.. 000000E0 54 CA 00 00 72 CA 00 00 AE C7 00 00 9A C7 00 00 8C C7 00 00 E0 C7 00 00 CA C7 00 00 BA C7 00 00 T╩..r╩..«╟..Ü╟..î╟..α╟..╩╟..║╟.. 00000100 76 C9 00 00 44 C9 00 00 74 C7 00 00 5C C9 00 00 00 00 00 00 76 01 4B 65 49 6E 69 74 69 61 6C 69 v╔..D╔..t╟..\╔......v☺KeInitiali 00000120 7A 65 53 70 69 6E 4C 6F 63 6B 00 00 42 00 45 78 46 72 65 65 50 6F 6F 6C 00 00 E8 01 4D 6D 4D 61 zeSpinLock..B.ExFreePool..Φ☺MmMa 00000140 70 4C 6F 63 6B 65 64 50 61 67 65 73 00 00 08 01 49 6F 46 72 65 65 4D 64 6C 00 E1 00 49 6F 41 6C pLockedPages..◘☺IoFreeMdl.ß.IoAl 00000160 6C 6F 63 61 74 65 4D 64 6C 00 FF 01 4D 6D 55 73 65 72 50 72 6F 62 65 41 64 64 72 65 73 73 00 00 locateMdl. ☺MmUserProbeAddress.. 00000180 EE 01 4D 6D 50 72 6F 62 65 41 6E 64 4C 6F 63 6B 50 61 67 65 73 00 F8 01 4D 6D 55 6E 6C 6F 63 6B ε☺MmProbeAndLockPages.°☺MmUnlock 000001A0 50 61 67 65 73 00 29 01 49 6F 52 65 6C 65 61 73 65 43 61 6E 63 65 6C 53 70 69 6E 4C 6F 63 6B 00 Pages.)☺IoReleaseCancelSpinLock. 000001C0 DA 00 49 6F 41 63 71 75 69 72 65 43 61 6E 63 65 6C 53 70 69 6E 4C 6F 63 6B 00 F3 00 49 6F 43 72 ┌.IoAcquireCancelSpinLock.≤.IoCr 000001E0 65 61 74 65 44 65 76 69 63 65 00 00 D3 02 52 74 6C 49 6E 69 74 55 6E 69 63 6F 64 65 53 74 72 69 eateDevice..╙☻RtlInitUnicodeStri 00000200 6E 67 00 00 FB 00 49 6F 44 65 6C 65 74 65 44 65 76 69 63 65 00 00 45 01 49 6F 66 43 6F 6D 70 6C ng..√.IoDeleteDevice..E☺IofCompl 00000220 65 74 65 52 65 71 75 65 73 74 00 00 73 00 45 78 66 49 6E 74 65 72 6C 6F 63 6B 65 64 41 64 64 55 eteRequest..s.ExfInterlockedAddU 00000240 6C 6F 6E 67 00 00 36 00 45 78 41 6C 6C 6F 63 61 74 65 50 6F 6F 6C 57 69 74 68 54 61 67 00 5E 03 long..6.ExAllocatePoolWithTag.^♥ 00000260 5A 77 43 6C 6F 73 65 00 64 03 5A 77 43 72 65 61 74 65 4B 65 79 00 7D 02 52 74 6C 41 70 70 65 6E ZwClose.d♥ZwCreateKey.}☻RtlAppen 00000280 64 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 54 6F 53 74 72 69 6E 67 00 00 95 02 52 74 6C 43 6F 70 dUnicodeStringToString..ò☻RtlCop 000002A0 79 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 00 8F 03 5A 77 51 75 65 72 79 56 61 6C 75 65 4B 65 yUnicodeString..Å♥ZwQueryValueKe 000002C0 79 00 9E 03 5A 77 53 65 74 56 61 6C 75 65 4B 65 79 00 92 01 4B 65 52 65 6C 65 61 73 65 4D 75 74 y.₧♥ZwSetValueKey.Æ☺KeReleaseMut 000002E0 65 78 00 00 B8 01 4B 65 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 57 01 4B 65 ex..╕☺KeWaitForSingleObject.W☺Ke 00000300 44 65 6C 61 79 45 78 65 63 75 74 69 6F 6E 54 68 72 65 61 64 00 00 75 01 4B 65 49 6E 69 74 69 61 DelayExecutionThread..u☺KeInitia 00000320 6C 69 7A 65 53 65 6D 61 70 68 6F 72 65 00 73 01 4B 65 49 6E 69 74 69 61 6C 69 7A 65 4D 75 74 65 lizeSemaphore.s☺KeInitializeMute 00000340 78 00 D3 01 4D 6D 42 75 69 6C 64 4D 64 6C 46 6F 72 4E 6F 6E 50 61 67 65 64 50 6F 6F 6C 00 93 01 x.╙☺MmBuildMdlForNonPagedPool.ô☺ 00000360 4B 65 52 65 6C 65 61 73 65 53 65 6D 61 70 68 6F 72 65 00 00 9A 01 4B 65 52 65 73 65 74 45 76 65 KeReleaseSemaphore..Ü☺KeResetEve 00000380 6E 74 00 00 1D 03 52 74 6C 55 70 63 61 73 65 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 00 A2 01 nt..↔♥RtlUpcaseUnicodeString..ó☺ 000003A0 4B 65 53 65 74 45 76 65 6E 74 00 00 87 01 4B 65 51 75 65 72 79 54 69 63 6B 43 6F 75 6E 74 00 00 KeSetEvent..ç☺KeQueryTickCount.. 000003C0 AE 01 4B 65 53 65 74 54 69 6D 65 72 00 00 77 01 4B 65 49 6E 69 74 69 61 6C 69 7A 65 54 69 6D 65 «☺KeSetTimer..w☺KeInitializeTime 000003E0 72 00 6F 01 4B 65 49 6E 69 74 69 61 6C 69 7A 65 44 70 63 00 53 01 4B 65 43 61 6E 63 65 6C 54 69 r.o☺KeInitializeDpc.S☺KeCancelTi 00000400 6D 65 72 00 6E 74 6F 73 6B 72 6E 6C 2E 65 78 65 00 00 1B 03 52 74 6C 55 6E 77 69 6E 64 00 4D 00 mer.ntoskrnl.exe..←♥RtlUnwind.M. 00000420 4B 66 52 65 6C 65 61 73 65 53 70 69 6E 4C 6F 63 6B 00 4A 00 4B 66 41 63 71 75 69 72 65 53 70 69 KfReleaseSpinLock.J.KfAcquireSpi 00000440 6E 4C 6F 63 6B 00 48 41 4C 2E 64 6C 6C 00 EA 00 4E 64 69 73 52 65 67 69 73 74 65 72 50 72 6F 74 nLock.HAL.dll.Ω.NdisRegisterProt 00000460 6F 63 6F 6C 00 00 63 00 4E 64 69 73 44 65 72 65 67 69 73 74 65 72 50 72 6F 74 6F 63 6F 6C 00 00 ocol..c.NdisDeregisterProtocol.. 00000480 3C 00 4E 64 69 73 43 6C 6F 73 65 41 64 61 70 74 65 72 00 00 2B 00 4E 64 69 73 41 6C 6C 6F 63 61 <.NdisCloseAdapter..+.NdisAlloca 000004A0 74 65 50 61 63 6B 65 74 50 6F 6F 6C 00 00 D3 00 4E 64 69 73 4F 70 65 6E 41 64 61 70 74 65 72 00 tePacketPool..╙.NdisOpenAdapter. 000004C0 2A 00 4E 64 69 73 41 6C 6C 6F 63 61 74 65 50 61 63 6B 65 74 00 00 4E 44 49 53 2E 53 59 53 00 00 *.NdisAllocatePacket..NDIS.SYS..