============================================================================================================================================== OFFSET 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F ---------------------------------------------------------------------------------------------------------------------------------------------- 00000000 83 EC 08 A1 C8 C5 01 00 8D 4C 24 00 53 56 33 DB 57 50 51 FF 15 24 A0 01 00 8D 4C 24 0C 68 B8 B2 â∞◘í╚┼☺.ìL$.SV3█WPQ §$á☺.ìL$♀h╕▓ 00000020 01 00 8B 7C 24 1C 53 53 6A 12 51 53 57 FF 15 78 A2 01 00 8B F0 85 F6 7D 1B 53 53 53 53 56 68 D2 ☺.ï|$∟SSj↕QSW §xó☺.ï≡à÷}←SSSSVh╥ 00000040 07 00 C0 57 E8 90 36 FD FF 8B C6 5F 5E 5B 83 C4 08 C2 08 00 83 C7 38 B8 6D 26 03 00 B9 1C 00 00 •.└WΦÉ6² ï╞_^[â─◘┬◘.â╟8╕m&♥.╣∟.. 00000060 00 C7 47 FC 31 6A 03 00 F3 AB A1 B8 B2 01 00 50 FF 15 7C A2 01 00 8B F0 85 F6 7C 07 C6 05 C4 B2 .╟Gⁿ1j♥.≤½í╕▓☺.P §|ó☺.ï≡à÷|•╞♣─▓ 00000080 01 00 01 E8 02 00 00 00 EB BF C6 05 C8 B2 01 00 01 83 EC 08 33 C0 B9 20 00 00 00 53 56 57 55 BF ☺.☺Φ☻...δ┐╞♣╚▓☺.☺â∞◘3└╣ ...SVWU┐ 000000A0 D8 C1 01 00 F3 AB FF 15 C0 A1 01 00 6A 00 A3 D0 B2 01 00 A1 DC A0 01 00 6A 01 0F BE 08 68 E0 B2 ╪┴☺.≤½ §└í☺.j.ú╨▓☺.í▄á☺.j☺☼╛◘hα▓ 000000C0 01 00 89 0D E8 B4 01 00 FF 15 D4 A2 01 00 6A 00 6A 01 68 58 C4 01 00 FF 15 D4 A2 01 00 8B 0D E0 ☺.ë♪Φ┤☺. §╘ó☺.j.j☺hX─☺. §╘ó☺.ï♪α 000000E0 A0 01 00 68 14 B3 01 00 8B 35 94 A0 01 00 8B 11 89 15 E0 A0 01 00 FF D6 68 B4 B3 01 00 FF D6 68 á☺.h¶│☺.ï5öá☺.ï◄ë§αá☺. ╓h┤│☺. ╓h 00000100 F8 B3 01 00 8B 3D 90 A0 01 00 BB 80 C8 01 00 FF D7 68 40 B4 01 00 FF D7 68 78 B4 01 00 FF D7 53 °│☺.ï=Éá☺.╗Ç╚☺. ╫h@┤☺. ╫hx┤☺. ╫S 00000120 FF D7 83 C3 38 81 FB B0 CA 01 00 72 F2 68 B0 B4 01 00 FF D7 68 90 C4 01 00 FF D7 68 A0 C2 01 00 ╫â├8ü√░╩☺.r≥h░┤☺. ╫hÉ─☺. ╫há┬☺. 00000140 FF D7 B8 48 B7 01 00 A3 4C B7 01 00 A3 48 B7 01 00 B8 50 B7 01 00 33 C9 A3 54 B7 01 00 A3 50 B7 ╫╕H╖☺.úL╖☺.úH╖☺.╕P╖☺.3╔úT╖☺.úP╖ 00000160 01 00 B8 60 B7 01 00 A3 64 B7 01 00 A3 60 B7 01 00 B8 78 B7 01 00 C7 00 EC D0 02 00 83 C0 10 3D ☺.╕`╖☺.úd╖☺.ú`╖☺.╕x╖☺.╟.∞╨☻.â└►= 00000180 98 B7 01 00 89 48 F4 89 48 E8 72 EA C7 05 A0 B7 01 00 54 41 01 00 33 C9 B8 E8 B7 01 00 66 89 0D ÿ╖☺.ëH⌠ëHΦrΩ╟♣á╖☺.TA☺.3╔╕Φ╖☺.fë♪ 000001A0 5C B7 01 00 89 0D 58 B7 01 00 66 89 0D 5E B7 01 00 89 0D A4 B7 01 00 89 0D 98 B7 01 00 8B D1 89 \╖☺.ë♪X╖☺.fë♪^╖☺.ë♪ñ╖☺.ë♪ÿ╖☺.ï╤ë 000001C0 40 04 41 89 00 6B D2 38 81 C2 80 C8 01 00 83 F9 0A 89 50 08 75 02 33 C9 83 C0 0C 3D E8 BD 01 00 @♦Aë.k╥8ü┬Ç╚☺.â∙◙ëP◘u☻3╔â└♀=Φ╜☺. 000001E0 72 DB B8 E8 BD 01 00 89 40 04 89 00 83 C0 08 3D 68 BE 01 00 72 F1 68 98 C3 01 00 33 DB FF D7 68 r█╕Φ╜☺.ë@♦ë.â└◘=h╛☺.r±hÿ├☺.3█ ╫h 00000200 40 C5 01 00 88 1D EC C3 01 00 88 1D 0C C4 01 00 88 1D 2C C4 01 00 88 1D 4C C4 01 00 FF D7 C7 05 @┼☺.ê↔∞├☺.ê↔♀─☺.ê↔,─☺.ê↔L─☺. ╫╟♣ 00000220 D4 C4 01 00 02 00 00 00 B8 88 C4 01 00 88 1D D8 C4 01 00 A3 8C C4 01 00 88 1D D9 C4 01 00 8D 54 ╘─☺.☻...╕ê─☺.ê↔╪─☺.úî─☺.ê↔┘─☺.ìT 00000240 24 10 A3 88 C4 01 00 FF 35 B4 C5 01 00 52 B8 C8 C4 01 00 A3 CC C4 01 00 A3 C8 C4 01 00 FF 15 64 $►úê─☺. 5┤┼☺.R╕╚─☺.ú╠─☺.ú╚─☺. §d 00000260 A1 01 00 8D 4C 24 10 6A 01 51 68 58 C1 01 00 FF 15 30 A2 01 00 FF 35 A8 C5 01 00 68 60 C1 01 00 í☺.ìL$►j☺QhX┴☺. §0ó☺. 5¿┼☺.h`┴☺. 00000280 8B 3D 24 A0 01 00 FF D7 FF 35 AC C5 01 00 68 68 C1 01 00 FF D7 A1 38 C8 01 00 50 68 68 C2 01 00 ï=$á☺. ╫ 5¼┼☺.hh┴☺. ╫í8╚☺.Phh┬☺. 000002A0 FF D7 A1 3C C8 01 00 BB 40 C3 01 00 50 BD E0 C7 01 00 68 70 C2 01 00 FF 15 10 A1 01 00 C7 05 E8 ╫í<╚☺.╗@├☺.P╜α╟☺.hp┬☺. §►í☺.╟♣Φ 000002C0 C4 01 00 B9 0B 00 00 C7 05 F8 C4 01 00 BA 0B 00 00 FF 75 00 53 83 C3 08 FF D7 83 C5 04 81 FD FC ─☺.╣♂..╟♣°─☺.║♂.. u.Sâ├◘ ╫â┼♦ü²ⁿ 000002E0 C7 01 00 76 EC B9 80 C3 01 00 8B 59 FC 8D 41 F8 8B 10 89 11 83 C1 08 81 F9 98 C3 01 00 89 59 FC ╟☺.v∞╣Ç├☺.ïYⁿìA°ï►ë◄â┴◘ü∙ÿ├☺.ëYⁿ 00000300 72 E8 68 D4 B3 01 00 BF 34 B3 01 00 FF D6 57 FF D6 83 C7 20 81 FF B4 B3 01 00 72 F2 C7 05 F0 B2 rΦh╘│☺.┐4│☺. ╓W ╓â╟ ü ┤│☺.r≥╟♣≡▓ 00000320 01 00 07 00 00 00 FF 15 50 A2 01 00 8B C8 2B D2 B8 80 F0 FA 02 5D F7 F1 5F A3 9C C5 01 00 5E 5B ☺.•... §Pó☺.ï╚+╥╕Ç≡·☻]≈±_ú£┼☺.^[ 00000340 83 C4 08 C3 CC CC CC CC CC CC CC CC CC CC CC CC 80 4A 03 00 00 00 00 00 00 00 00 00 E0 4D 03 00 â─◘├╠╠╠╠╠╠╠╠╠╠╠╠ÇJ♥.........αM♥. 00000360 E0 9F 00 00 88 4D 03 00 00 00 00 00 00 00 00 00 E0 5F 03 00 E8 A2 00 00 A0 4D 03 00 00 00 00 00 αƒ..êM♥.........α_♥.Φó..áM♥..... 00000380 00 00 00 00 48 60 03 00 00 A3 00 00 B8 4D 03 00 00 00 00 00 00 00 00 00 E8 60 03 00 18 A3 00 00 ....H`♥..ú..╕M♥.........Φ`♥.↑ú.. 000003A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 CC CC CC CC CC CC CC CC CC CC CC CC ....................╠╠╠╠╠╠╠╠╠╠╠╠ 000003C0 F0 4D 03 00 0A 4E 03 00 28 4E 03 00 46 4E 03 00 64 4E 03 00 74 4E 03 00 88 4E 03 00 AC 4E 03 00 ≡M♥.◙N♥.(N♥.FN♥.dN♥.tN♥.êN♥.¼N♥. 000003E0 C2 4E 03 00 E0 4E 03 00 F8 4E 03 00 18 4F 03 00 24 4F 03 00 40 4F 03 00 5E 4F 03 00 76 4F 03 00 ┬N♥.αN♥.°N♥.↑O♥.$O♥.@O♥.^O♥.vO♥. 00000400 8A 4F 03 00 A8 4F 03 00 C0 4F 03 00 D8 4F 03 00 F0 4F 03 00 20 50 03 00 40 50 03 00 58 50 03 00 èO♥.¿O♥.└O♥.╪O♥.≡O♥. P♥.@P♥.XP♥. 00000420 66 50 03 00 78 50 03 00 90 50 03 00 A0 50 03 00 B0 50 03 00 C8 50 03 00 E8 50 03 00 FC 50 03 00 fP♥.xP♥.ÉP♥.áP♥.░P♥.╚P♥.ΦP♥.ⁿP♥. 00000440 16 51 03 00 2E 51 03 00 50 51 03 00 70 51 03 00 88 51 03 00 A2 51 03 00 B8 51 03 00 D2 51 03 00 ▬Q♥..Q♥.PQ♥.pQ♥.êQ♥.óQ♥.╕Q♥.╥Q♥. 00000460 F0 51 03 00 0A 52 03 00 1A 52 03 00 34 52 03 00 40 52 03 00 5C 52 03 00 74 52 03 00 94 52 03 00 ≡Q♥.◙R♥.→R♥.4R♥.@R♥.\R♥.tR♥.öR♥. 00000480 AC 52 03 00 CE 52 03 00 E0 52 03 00 F2 52 03 00 04 53 03 00 18 53 03 00 28 53 03 00 38 53 03 00 ¼R♥.╬R♥.αR♥.≥R♥.♦S♥.↑S♥.(S♥.8S♥. 000004A0 52 53 03 00 62 53 03 00 7E 53 03 00 98 53 03 00 B0 53 03 00 C8 53 03 00 E6 53 03 00 10 54 03 00 RS♥.bS♥.~S♥.ÿS♥.░S♥.╚S♥.µS♥.►T♥. 000004C0 28 54 03 00 40 54 03 00 54 54 03 00 68 54 03 00 88 54 03 00 9A 54 03 00 B0 54 03 00 CC 54 03 00 (T♥.@T♥.TT♥.hT♥.êT♥.ÜT♥.░T♥.╠T♥. 000004E0 E0 54 03 00 F4 54 03 00 10 55 03 00 2A 55 03 00 40 55 03 00 54 55 03 00 5E 55 03 00 68 55 03 00 αT♥.⌠T♥.►U♥.*U♥.@U♥.TU♥.^U♥.hU♥. 00000500 80 55 03 00 98 55 03 00 B0 55 03 00 C4 55 03 00 DE 55 03 00 02 56 03 00 18 56 03 00 30 56 03 00 ÇU♥.ÿU♥.░U♥.─U♥.▐U♥.☻V♥.↑V♥.0V♥. 00000520 60 56 03 00 80 56 03 00 90 56 03 00 9C 56 03 00 A6 56 03 00 C0 56 03 00 D8 56 03 00 F0 56 03 00 `V♥.ÇV♥.ÉV♥.£V♥.ªV♥.└V♥.╪V♥.≡V♥. 00000540 08 57 03 00 1C 57 03 00 2C 57 03 00 38 57 03 00 48 57 03 00 64 57 03 00 80 57 03 00 A0 57 03 00 ◘W♥.∟W♥.,W♥.8W♥.HW♥.dW♥.ÇW♥.áW♥. 00000560 BA 57 03 00 CC 57 03 00 EC 57 03 00 0A 58 03 00 26 58 03 00 40 58 03 00 5A 58 03 00 74 58 03 00 ║W♥.╠W♥.∞W♥.◙X♥.&X♥.@X♥.ZX♥.tX♥. 00000580 84 58 03 00 98 58 03 00 B8 58 03 00 C8 58 03 00 DE 58 03 00 F8 58 03 00 10 59 03 00 20 59 03 00 äX♥.ÿX♥.╕X♥.╚X♥.▐X♥.°X♥.►Y♥. Y♥. 000005A0 38 59 03 00 50 59 03 00 60 59 03 00 78 59 03 00 92 59 03 00 A8 59 03 00 C0 59 03 00 E0 59 03 00 8Y♥.PY♥.`Y♥.xY♥.ÆY♥.¿Y♥.└Y♥.αY♥. 000005C0 FC 59 03 00 20 5A 03 00 40 5A 03 00 50 5A 03 00 70 5A 03 00 90 5A 03 00 AE 5A 03 00 D2 5A 03 00 ⁿY♥. Z♥.@Z♥.PZ♥.pZ♥.ÉZ♥.«Z♥.╥Z♥. 000005E0 E8 5A 03 00 08 5B 03 00 20 5B 03 00 34 5B 03 00 4A 5B 03 00 5A 5B 03 00 70 5B 03 00 90 5B 03 00 ΦZ♥.◘[♥. [♥.4[♥.J[♥.Z[♥.p[♥.É[♥. 00000600 B0 5B 03 00 D0 5B 03 00 DC 5B 03 00 F0 5B 03 00 00 5C 03 00 20 5C 03 00 38 5C 03 00 48 5C 03 00 ░[♥.╨[♥.▄[♥.≡[♥..\♥. \♥.8\♥.H\♥. 00000620 58 5C 03 00 70 5C 03 00 84 5C 03 00 98 5C 03 00 A8 5C 03 00 C0 5C 03 00 D4 5C 03 00 EC 5C 03 00 X\♥.p\♥.ä\♥.ÿ\♥.¿\♥.└\♥.╘\♥.∞\♥. 00000640 00 5D 03 00 18 5D 03 00 28 5D 03 00 38 5D 03 00 4C 5D 03 00 60 5D 03 00 72 5D 03 00 90 5D 03 00 .]♥.↑]♥.(]♥.8]♥.L]♥.`]♥.r]♥.É]♥. 00000660 B2 5D 03 00 CC 5D 03 00 F0 5D 03 00 08 5E 03 00 20 5E 03 00 38 5E 03 00 54 5E 03 00 70 5E 03 00 ▓]♥.╠]♥.≡]♥.◘^♥. ^♥.8^♥.T^♥.p^♥. 00000680 7E 5E 03 00 98 5E 03 00 A8 5E 03 00 B8 5E 03 00 CA 5E 03 00 E8 5E 03 00 F2 5E 03 00 10 5F 03 00 ~^♥.ÿ^♥.¿^♥.╕^♥.╩^♥.Φ^♥.≥^♥.►_♥. 000006A0 24 5F 03 00 3E 5F 03 00 50 5F 03 00 60 5F 03 00 70 5F 03 00 88 5F 03 00 9C 5F 03 00 B0 5F 03 00 $_♥.>_♥.P_♥.`_♥.p_♥.ê_♥.£_♥.░_♥. 000006C0 CC 5F 03 00 00 00 00 00 E8 5F 03 00 FC 5F 03 00 0A 60 03 00 1E 60 03 00 34 60 03 00 00 00 00 00 ╠_♥.....Φ_♥.ⁿ_♥.◙`♥.▲`♥.4`♥..... 000006E0 50 60 03 00 68 60 03 00 8C 60 03 00 B0 60 03 00 C6 60 03 00 00 00 00 00 00 61 03 00 1C 61 03 00 P`♥.h`♥.î`♥.░`♥.╞`♥......a♥.∟a♥. 00000700 36 61 03 00 4A 61 03 00 68 61 03 00 80 61 03 00 9E 61 03 00 B6 61 03 00 00 00 00 00 CC CC CC CC 6a♥.Ja♥.ha♥.Ça♥.₧a♥.╢a♥.....╠╠╠╠ 00000720 6E 74 6F 73 6B 72 6E 6C 2E 65 78 65 00 00 CC CC B2 00 46 73 52 74 6C 4D 64 6C 52 65 61 64 43 6F ntoskrnl.exe..╠╠▓.FsRtlMdlReadCo 00000740 6D 70 6C 65 74 65 44 65 76 00 C5 00 46 73 52 74 6C 50 72 65 70 61 72 65 4D 64 6C 57 72 69 74 65 mpleteDev.┼.FsRtlPrepareMdlWrite 00000760 44 65 76 00 CC CC CC CC 13 03 52 74 6C 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 54 6F 4F 65 6D 53 Dev.╠╠╠╠‼♥RtlUnicodeStringToOemS 00000780 74 72 69 6E 67 00 2B 03 52 74 6C 78 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 54 6F 4F 65 6D 53 69 tring.+♥RtlxUnicodeStringToOemSi 000007A0 7A 65 00 00 21 03 52 74 6C 55 70 70 65 72 43 68 61 72 00 00 A2 01 4B 65 53 65 74 45 76 65 6E 74 ze..!♥RtlUpperChar..ó☺KeSetEvent 000007C0 00 00 CC CC CC CC CC CC BA 01 4B 65 66 52 65 6C 65 61 73 65 53 70 69 6E 4C 6F 63 6B 46 72 6F 6D ..╠╠╠╠╠╠║☺KefReleaseSpinLockFrom 000007E0 44 70 63 4C 65 76 65 6C 00 00 CC CC 00 02 4E 6C 73 4D 62 4F 65 6D 43 6F 64 65 50 61 67 65 54 61 DpcLevel..╠╠.☻NlsMbOemCodePageTa 00000800 67 00 D7 00 49 6E 74 65 72 6C 6F 63 6B 65 64 45 78 63 68 61 6E 67 65 00 CC CC CC CC CC CC CC CC g.╫.InterlockedExchange.╠╠╠╠╠╠╠╠ 00000820 AF 02 52 74 6C 45 71 75 61 6C 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 B9 01 4B 65 66 41 63 71 »☻RtlEqualUnicodeString.╣☺KefAcq 00000840 75 69 72 65 53 70 69 6E 4C 6F 63 6B 41 74 44 70 63 4C 65 76 65 6C 00 00 07 01 49 6F 46 72 65 65 uireSpinLockAtDpcLevel..•☺IoFree 00000860 49 72 70 00 EC 00 49 6F 43 68 65 63 6B 44 65 73 69 72 65 64 41 63 63 65 73 73 00 00 CC CC CC CC Irp.∞.IoCheckDesiredAccess..╠╠╠╠ 00000880 59 00 45 78 49 6E 74 65 72 6C 6F 63 6B 65 64 50 75 73 68 45 6E 74 72 79 53 4C 69 73 74 00 92 02 Y.ExInterlockedPushEntrySList.Æ☻ 000008A0 52 74 6C 43 6F 70 79 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 00 86 01 4B 65 51 75 65 72 79 53 RtlCopyUnicodeString..å☺KeQueryS 000008C0 79 73 74 65 6D 54 69 6D 65 00 E2 02 52 74 6C 4C 65 6E 67 74 68 53 65 63 75 72 69 74 79 44 65 73 ystemTime.Γ☻RtlLengthSecurityDes 000008E0 63 72 69 70 74 6F 72 00 D0 02 52 74 6C 49 6E 69 74 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 00 criptor.╨☻RtlInitUnicodeString.. 00000900 A1 03 5A 77 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 75 01 4B 65 49 6E 69 74 í♥ZwWaitForSingleObject.u☺KeInit 00000920 69 61 6C 69 7A 65 53 65 6D 61 70 68 6F 72 65 00 B6 01 4B 65 57 61 69 74 46 6F 72 4D 75 6C 74 69 ializeSemaphore.╢☺KeWaitForMulti 00000940 70 6C 65 4F 62 6A 65 63 74 73 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC pleObjects..╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠ 00000960 75 00 45 78 66 49 6E 74 65 72 6C 6F 63 6B 65 64 49 6E 73 65 72 74 54 61 69 6C 4C 69 73 74 00 00 u.ExfInterlockedInsertTailList.. 00000980 93 01 4B 65 52 65 6C 65 61 73 65 53 65 6D 61 70 68 6F 72 65 00 00 CC CC 94 03 5A 77 53 65 74 45 ô☺KeReleaseSemaphore..╠╠ö♥ZwSetE 000009A0 76 65 6E 74 00 00 62 03 5A 77 43 72 65 61 74 65 53 65 63 74 69 6F 6E 00 74 03 5A 77 4D 61 70 56 vent..b♥ZwCreateSection.t♥ZwMapV 000009C0 69 65 77 4F 66 53 65 63 74 69 6F 6E 00 00 CC CC 5F 03 5A 77 43 72 65 61 74 65 45 76 65 6E 74 00 iewOfSection..╠╠_♥ZwCreateEvent. 000009E0 9A 01 4B 65 52 65 73 65 74 45 76 65 6E 74 00 00 0D 03 52 74 6C 54 69 6D 65 54 6F 54 69 6D 65 46 Ü☺KeResetEvent..♪♥RtlTimeToTimeF 00000A00 69 65 6C 64 73 00 CC CC 57 01 4B 65 44 65 6C 61 79 45 78 65 63 75 74 69 6F 6E 54 68 72 65 61 64 ields.╠╠W☺KeDelayExecutionThread 00000A20 00 00 CC CC CC CC CC CC C2 02 52 74 6C 46 72 65 65 4F 65 6D 53 74 72 69 6E 67 00 00 73 00 45 78 ..╠╠╠╠╠╠┬☻RtlFreeOemString..s.Ex 00000A40 66 49 6E 74 65 72 6C 6F 63 6B 65 64 41 64 64 55 6C 6F 6E 67 00 00 D9 00 49 6E 74 65 72 6C 6F 63 fInterlockedAddUlong..┘.Interloc 00000A60 6B 65 64 49 6E 63 72 65 6D 65 6E 74 00 00 95 00 46 73 52 74 6C 44 6F 65 73 4E 61 6D 65 43 6F 6E kedIncrement..ò.FsRtlDoesNameCon 00000A80 74 61 69 6E 57 69 6C 64 43 61 72 64 73 00 CC CC 44 02 4F 62 66 44 65 72 65 66 65 72 65 6E 63 65 tainWildCards.╠╠D☻ObfDereference 00000AA0 4F 62 6A 65 63 74 00 00 CC CC CC CC CC CC CC CC D6 00 49 6E 74 65 72 6C 6F 63 6B 65 64 44 65 63 Object..╠╠╠╠╠╠╠╠╓.InterlockedDec 00000AC0 72 65 6D 65 6E 74 00 00 89 02 52 74 6C 43 6F 6D 70 61 72 65 55 6E 69 63 6F 64 65 53 74 72 69 6E rement..ë☻RtlCompareUnicodeStrin 00000AE0 67 00 13 02 4E 74 46 72 65 65 56 69 72 74 75 61 6C 4D 65 6D 6F 72 79 00 06 02 4E 74 41 6C 6C 6F g.‼☻NtFreeVirtualMemory.♠☻NtAllo 00000B00 63 61 74 65 56 69 72 74 75 61 6C 4D 65 6D 6F 72 79 00 2B 02 4E 74 53 65 74 49 6E 66 6F 72 6D 61 cateVirtualMemory.+☻NtSetInforma 00000B20 74 69 6F 6E 54 68 72 65 61 64 00 00 CC CC CC CC 47 03 53 65 52 65 6C 65 61 73 65 53 75 62 6A 65 tionThread..╠╠╠╠G♥SeReleaseSubje 00000B40 63 74 43 6F 6E 74 65 78 74 00 2C 03 53 65 41 63 63 65 73 73 43 68 65 63 6B 00 32 03 53 65 43 61 ctContext.,♥SeAccessCheck.2♥SeCa 00000B60 70 74 75 72 65 53 75 62 6A 65 63 74 43 6F 6E 74 65 78 74 00 BC 03 5F 77 63 73 69 63 6D 70 00 00 ptureSubjectContext.╝♥_wcsicmp.. 00000B80 4A 00 45 78 49 6E 69 74 69 61 6C 69 7A 65 52 65 73 6F 75 72 63 65 4C 69 74 65 00 00 76 01 4B 65 J.ExInitializeResourceLite..v☺Ke 00000BA0 49 6E 69 74 69 61 6C 69 7A 65 53 70 69 6E 4C 6F 63 6B 00 00 78 00 45 78 66 49 6E 74 65 72 6C 6F InitializeSpinLock..x.ExfInterlo 00000BC0 63 6B 65 64 52 65 6D 6F 76 65 48 65 61 64 4C 69 73 74 00 00 6D 00 45 78 52 65 6C 65 61 73 65 52 ckedRemoveHeadList..m.ExReleaseR 00000BE0 65 73 6F 75 72 63 65 4C 69 74 65 00 2E 00 45 78 41 63 71 75 69 72 65 52 65 73 6F 75 72 63 65 45 esourceLite...ExAcquireResourceE 00000C00 78 63 6C 75 73 69 76 65 4C 69 74 65 00 00 C1 02 52 74 6C 46 72 65 65 48 65 61 70 00 CC CC CC CC xclusiveLite..┴☻RtlFreeHeap.╠╠╠╠ 00000C20 74 02 52 74 6C 41 6C 6C 6F 63 61 74 65 48 65 61 70 00 A4 02 52 74 6C 44 65 73 74 72 6F 79 48 65 t☻RtlAllocateHeap.ñ☻RtlDestroyHe 00000C40 61 70 00 00 0C 02 4E 74 43 72 65 61 74 65 53 65 63 74 69 6F 6E 00 CC CC 09 02 4E 74 43 6F 6E 6E ap..♀☻NtCreateSection.╠╠○☻NtConn 00000C60 65 63 74 50 6F 72 74 00 95 02 52 74 6C 43 72 65 61 74 65 48 65 61 70 00 67 02 50 73 54 65 72 6D ectPort.ò☻RtlCreateHeap.g☻PsTerm 00000C80 69 6E 61 74 65 53 79 73 74 65 6D 54 68 72 65 61 64 00 98 01 4B 65 52 65 6D 6F 76 65 51 75 65 75 inateSystemThread.ÿ☺KeRemoveQueu 00000CA0 65 00 A4 01 4B 65 53 65 74 49 64 65 61 6C 50 72 6F 63 65 73 73 6F 72 54 68 72 65 61 64 00 51 02 e.ñ☺KeSetIdealProcessorThread.Q☻ 00000CC0 50 73 43 72 65 61 74 65 53 79 73 74 65 6D 54 68 72 65 61 64 00 00 CC CC F4 01 4D 6D 53 69 7A 65 PsCreateSystemThread..╠╠⌠☺MmSize 00000CE0 4F 66 4D 64 6C 00 CC CC CC CC CC CC CC CC CC CC E2 01 4D 6D 49 73 54 68 69 73 41 6E 4E 74 41 73 OfMdl.╠╠╠╠╠╠╠╠╠╠Γ☺MmIsThisAnNtAs 00000D00 53 79 73 74 65 6D 00 00 23 03 52 74 6C 56 61 6C 69 64 53 65 63 75 72 69 74 79 44 65 73 63 72 69 System..#♥RtlValidSecurityDescri 00000D20 70 74 6F 72 00 00 0C 03 52 74 6C 54 69 6D 65 54 6F 53 65 63 6F 6E 64 73 53 69 6E 63 65 31 39 38 ptor..♀♥RtlTimeToSecondsSince198 00000D40 30 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC 82 01 4B 65 4E 75 6D 62 65 72 50 72 6F 63 65 73 0.╠╠╠╠╠╠╠╠╠╠╠╠╠╠é☺KeNumberProces 00000D60 73 6F 72 73 00 00 CC CC 39 03 53 65 45 78 70 6F 72 74 73 00 CC CC CC CC CC CC CC CC CC CC CC CC sors..╠╠9♥SeExports.╠╠╠╠╠╠╠╠╠╠╠╠ 00000D80 E6 02 52 74 6C 4D 61 70 47 65 6E 65 72 69 63 4D 61 73 6B 00 3A 03 53 65 46 72 65 65 50 72 69 76 µ☻RtlMapGenericMask.:♥SeFreePriv 00000DA0 69 6C 65 67 65 73 00 00 4E 02 50 73 41 73 73 69 67 6E 49 6D 70 65 72 73 6F 6E 61 74 69 6F 6E 54 ileges..N☻PsAssignImpersonationT 00000DC0 6F 6B 65 6E 00 00 CC CC 4F 01 4B 65 41 74 74 61 63 68 50 72 6F 63 65 73 73 00 59 01 4B 65 44 65 oken..╠╠O☺KeAttachProcess.Y☺KeDe 00000DE0 74 61 63 68 50 72 6F 63 65 73 73 00 CC CC CC CC 20 03 52 74 6C 55 70 63 61 73 65 55 6E 69 63 6F tachProcess.╠╠╠╠ ♥RtlUpcaseUnico 00000E00 64 65 54 6F 4F 65 6D 4E 00 00 CC CC 17 03 52 74 6C 55 6E 69 63 6F 64 65 54 6F 4F 65 6D 4E 00 00 deToOemN..╠╠↨♥RtlUnicodeToOemN.. 00000E20 FF 01 4E 6C 73 4D 62 43 6F 64 65 50 61 67 65 54 61 67 00 00 01 02 4E 6C 73 4F 65 6D 4C 65 61 64 ☺NlsMbCodePageTag..☺☻NlsOemLead 00000E40 42 79 74 65 49 6E 66 6F 00 00 CC CC CC CC CC CC D9 02 52 74 6C 49 73 4E 61 6D 65 4C 65 67 61 6C ByteInfo..╠╠╠╠╠╠┘☻RtlIsNameLegal 00000E60 44 4F 53 38 44 6F 74 33 00 00 A6 00 46 73 52 74 6C 49 73 46 61 74 44 62 63 73 4C 65 67 61 6C 00 DOS8Dot3..ª.FsRtlIsFatDbcsLegal. 00000E80 CD 02 52 74 6C 49 6E 69 74 41 6E 73 69 53 74 72 69 6E 67 00 08 02 4E 74 43 6C 6F 73 65 00 E7 03 ═☻RtlInitAnsiString.◘☻NtClose.τ♥ 00000EA0 77 63 73 63 6D 70 00 00 23 02 4E 74 51 75 65 72 79 53 65 63 75 72 69 74 79 4F 62 6A 65 63 74 00 wcscmp..#☻NtQuerySecurityObject. 00000EC0 2C 02 4E 74 53 65 74 53 65 63 75 72 69 74 79 4F 62 6A 65 63 74 00 CC CC 0F 02 4E 74 44 65 76 69 ,☻NtSetSecurityObject.╠╠☼☻NtDevi 00000EE0 63 65 49 6F 43 6F 6E 74 72 6F 6C 46 69 6C 65 00 C0 02 52 74 6C 46 72 65 65 41 6E 73 69 53 74 72 ceIoControlFile.└☻RtlFreeAnsiStr 00000F00 69 6E 67 00 1A 03 52 74 6C 55 70 63 61 73 65 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 00 1D 03 ing.→♥RtlUpcaseUnicodeString..↔♥ 00000F20 52 74 6C 55 70 63 61 73 65 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 54 6F 4F 65 6D 53 74 72 69 6E RtlUpcaseUnicodeStringToOemStrin 00000F40 67 00 13 01 49 6F 47 65 74 53 74 61 63 6B 4C 69 6D 69 74 73 00 00 CC CC 14 02 4E 74 46 73 43 6F g.‼☺IoGetStackLimits..╠╠¶☻NtFsCo 00000F60 6E 74 72 6F 6C 46 69 6C 65 00 CC CC CC CC CC CC FE 02 52 74 6C 53 65 63 6F 6E 64 73 53 69 6E 63 ntrolFile.╠╠╠╠╠╠■☻RtlSecondsSinc 00000F80 65 31 39 37 30 54 6F 54 69 6D 65 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC e1970ToTime.╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠╠ 00000FA0 04 01 49 6F 46 61 73 74 51 75 65 72 79 4E 65 74 77 6F 72 6B 41 74 74 72 69 62 75 74 65 73 00 00 ♦☺IoFastQueryNetworkAttributes.. 00000FC0 FB 02 52 74 6C 52 61 6E 64 6F 6D 00 CC CC CC CC B4 03 5F 73 74 72 69 63 6D 70 00 00 E6 03 77 63 √☻RtlRandom.╠╠╠╠┤♥_stricmp..µ♥wc 00000FE0 73 63 68 72 00 00 23 01 49 6F 52 65 61 64 4F 70 65 72 61 74 69 6F 6E 43 6F 75 6E 74 00 00 CC CC schr..#☺IoReadOperationCount..╠╠ 00001000 24 01 49 6F 52 65 61 64 54 72 61 6E 73 66 65 72 43 6F 75 6E 74 00 CC CC 42 01 49 6F 57 72 69 74 $☺IoReadTransferCount.╠╠B☺IoWrit 00001020 65 4F 70 65 72 61 74 69 6F 6E 43 6F 75 6E 74 00 43 01 49 6F 57 72 69 74 65 54 72 61 6E 73 66 65 eOperationCount.C☺IoWriteTransfe 00001040 72 43 6F 75 6E 74 00 00 38 01 49 6F 53 74 61 74 69 73 74 69 63 73 4C 6F 63 6B 00 00 CF 02 52 74 rCount..8☺IoStatisticsLock..╧☻Rt 00001060 6C 49 6E 69 74 53 74 72 69 6E 67 00 E8 03 77 63 73 63 70 79 00 00 CC CC EB 00 49 6F 43 61 6E 63 lInitString.Φ♥wcscpy..╠╠δ.IoCanc 00001080 65 6C 49 72 70 00 CC CC D8 02 52 74 6C 49 6E 74 65 67 65 72 54 6F 55 6E 69 63 6F 64 65 53 74 72 elIrp.╠╠╪☻RtlIntegerToUnicodeStr 000010A0 69 6E 67 00 32 01 49 6F 53 65 74 54 68 72 65 61 64 48 61 72 64 45 72 72 6F 72 4D 6F 64 65 00 00 ing.2☺IoSetThreadHardErrorMode.. 000010C0 EC 02 52 74 6C 4E 74 53 74 61 74 75 73 54 6F 44 6F 73 45 72 72 6F 72 4E 6F 54 65 62 00 00 CC CC ∞☻RtlNtStatusToDosErrorNoTeb..╠╠ 000010E0 27 02 4E 74 52 65 71 75 65 73 74 57 61 69 74 52 65 70 6C 79 50 6F 72 74 00 00 B3 00 46 73 52 74 '☻NtRequestWaitReplyPort..│.FsRt 00001100 6C 4D 64 6C 52 65 61 64 44 65 76 00 24 02 4E 74 51 75 65 72 79 56 6F 6C 75 6D 65 49 6E 66 6F 72 lMdlReadDev.$☻NtQueryVolumeInfor 00001120 6D 61 74 69 6F 6E 46 69 6C 65 00 00 2F 00 45 78 41 63 71 75 69 72 65 52 65 73 6F 75 72 63 65 53 mationFile../.ExAcquireResourceS 00001140 68 61 72 65 64 4C 69 74 65 00 B5 00 46 73 52 74 6C 4D 64 6C 57 72 69 74 65 43 6F 6D 70 6C 65 74 haredLite.╡.FsRtlMdlWriteComplet 00001160 65 44 65 76 00 00 EE 00 49 6F 43 68 65 63 6B 46 75 6E 63 74 69 6F 6E 41 63 63 65 73 73 00 CC CC eDev..ε.IoCheckFunctionAccess.╠╠ 00001180 ED 00 49 6F 43 68 65 63 6B 45 61 42 75 66 66 65 72 56 61 6C 69 64 69 74 79 00 F6 02 52 74 6C 50 φ.IoCheckEaBufferValidity.÷☻RtlP 000011A0 72 65 66 69 78 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 00 0B 02 4E 74 43 72 65 61 74 65 46 69 refixUnicodeString..♂☻NtCreateFi 000011C0 6C 65 00 00 AE 02 52 74 6C 45 71 75 61 6C 53 74 72 69 6E 67 00 00 CC CC E3 01 4D 6D 4C 6F 63 6B le..«☻RtlEqualString..╠╠π☺MmLock 000011E0 50 61 67 61 62 6C 65 44 61 74 61 53 65 63 74 69 6F 6E 00 00 CC CC CC CC E1 00 49 6F 41 6C 6C 6F PagableDataSection..╠╠╠╠ß.IoAllo 00001200 63 61 74 65 4D 64 6C 00 ED 01 4D 6D 50 72 6F 62 65 41 6E 64 4C 6F 63 6B 50 61 67 65 73 00 20 01 cateMdl.φ☺MmProbeAndLockPages. ☺ 00001220 49 6F 51 75 65 75 65 54 68 72 65 61 64 49 72 70 00 00 CC CC CC CC CC CC 45 02 4F 62 66 52 65 66 IoQueueThreadIrp..╠╠╠╠╠╠E☻ObfRef 00001240 65 72 65 6E 63 65 4F 62 6A 65 63 74 00 00 CC CC E0 00 49 6F 41 6C 6C 6F 63 61 74 65 49 72 70 00 erenceObject..╠╠α.IoAllocateIrp. 00001260 60 01 4B 65 47 65 74 43 75 72 72 65 6E 74 54 68 72 65 61 64 00 00 CC CC 0C 01 49 6F 47 65 74 43 `☺KeGetCurrentThread..╠╠♀☺IoGetC 00001280 75 72 72 65 6E 74 50 72 6F 63 65 73 73 00 CC CC 52 01 4B 65 42 75 67 43 68 65 63 6B 45 78 00 00 urrentProcess.╠╠R☺KeBugCheckEx.. 000012A0 0A 03 52 74 6C 54 69 6D 65 46 69 65 6C 64 73 54 6F 54 69 6D 65 00 CC CC 5E 00 45 78 4C 6F 63 61 ◙♥RtlTimeFieldsToTime.╠╠^.ExLoca 000012C0 6C 54 69 6D 65 54 6F 53 79 73 74 65 6D 54 69 6D 65 00 86 02 52 74 6C 43 6F 6D 70 61 72 65 4D 65 lTimeToSystemTime.å☻RtlCompareMe 000012E0 6D 6F 72 79 00 00 CC CC 3C 00 45 78 44 65 6C 65 74 65 52 65 73 6F 75 72 63 65 4C 69 74 65 00 00 mory..╠╠<.ExDeleteResourceLite.. 00001300 70 00 45 78 53 79 73 74 65 6D 54 69 6D 65 54 6F 4C 6F 63 61 6C 54 69 6D 65 00 CC CC CC CC CC CC p.ExSystemTimeToLocalTime.╠╠╠╠╠╠ 00001320 0B 03 52 74 6C 54 69 6D 65 54 6F 53 65 63 6F 6E 64 73 53 69 6E 63 65 31 39 37 30 00 D8 00 49 6E ♂♥RtlTimeToSecondsSince1970.╪.In 00001340 74 65 72 6C 6F 63 6B 65 64 45 78 63 68 61 6E 67 65 41 64 64 00 00 CC CC CC CC CC CC CC CC CC CC terlockedExchangeAdd..╠╠╠╠╠╠╠╠╠╠ 00001360 57 00 45 78 49 6E 74 65 72 6C 6F 63 6B 65 64 50 6F 70 45 6E 74 72 79 53 4C 69 73 74 00 00 CC CC W.ExInterlockedPopEntrySList..╠╠ 00001380 CE 03 6D 65 6D 6D 6F 76 65 00 CC CC CC CC CC CC C7 02 52 74 6C 47 65 74 44 61 63 6C 53 65 63 75 ╬♥memmove.╠╠╠╠╠╠╟☻RtlGetDaclSecu 000013A0 72 69 74 79 44 65 73 63 72 69 70 74 6F 72 00 00 CB 02 52 74 6C 47 65 74 4F 77 6E 65 72 53 65 63 rityDescriptor..╦☻RtlGetOwnerSec 000013C0 75 72 69 74 79 44 65 73 63 72 69 70 74 6F 72 00 F5 01 4D 6D 55 6E 6C 6F 63 6B 50 61 67 61 62 6C urityDescriptor.⌡☺MmUnlockPagabl 000013E0 65 49 6D 61 67 65 53 65 63 74 69 6F 6E 00 3E 01 49 6F 55 6E 72 65 67 69 73 74 65 72 53 68 75 74 eImageSection.>☺IoUnregisterShut 00001400 64 6F 77 6E 4E 6F 74 69 66 69 63 61 74 69 6F 6E 00 00 74 01 4B 65 49 6E 69 74 69 61 6C 69 7A 65 downNotification..t☺KeInitialize 00001420 51 75 65 75 65 00 CC CC 97 02 52 74 6C 43 72 65 61 74 65 53 65 63 75 72 69 74 79 44 65 73 63 72 Queue.╠╠ù☻RtlCreateSecurityDescr 00001440 69 70 74 6F 72 00 CC CC E1 02 52 74 6C 4C 65 6E 67 74 68 52 65 71 75 69 72 65 64 53 69 64 00 00 iptor.╠╠ß☻RtlLengthRequiredSid.. 00001460 D3 02 52 74 6C 49 6E 69 74 69 61 6C 69 7A 65 53 69 64 00 00 09 03 52 74 6C 53 75 62 41 75 74 68 ╙☻RtlInitializeSid..○♥RtlSubAuth 00001480 6F 72 69 74 79 53 69 64 00 00 E3 02 52 74 6C 4C 65 6E 67 74 68 53 69 64 00 00 93 02 52 74 6C 43 oritySid..π☻RtlLengthSid..ô☻RtlC 000014A0 72 65 61 74 65 41 63 6C 00 00 CC CC CC CC CC CC 70 02 52 74 6C 41 64 64 41 63 63 65 73 73 41 6C reateAcl..╠╠╠╠╠╠p☻RtlAddAccessAl 000014C0 6C 6F 77 65 64 41 63 65 00 00 CC CC CC CC CC CC 02 03 52 74 6C 53 65 74 44 61 63 6C 53 65 63 75 lowedAce..╠╠╠╠╠╠☻♥RtlSetDaclSecu 000014E0 72 69 74 79 44 65 73 63 72 69 70 74 6F 72 00 00 04 03 52 74 6C 53 65 74 4F 77 6E 65 72 53 65 63 rityDescriptor..♦♥RtlSetOwnerSec 00001500 75 72 69 74 79 44 65 73 63 72 69 70 74 6F 72 00 79 03 5A 77 4F 70 65 6E 4B 65 79 00 8C 03 5A 77 urityDescriptor.y♥ZwOpenKey.î♥Zw 00001520 51 75 65 72 79 56 61 6C 75 65 4B 65 79 00 CC CC 5B 03 5A 77 43 6C 6F 73 65 00 CC CC CC CC CC CC QueryValueKey.╠╠[♥ZwClose.╠╠╠╠╠╠ 00001540 77 02 52 74 6C 41 6E 73 69 53 74 72 69 6E 67 54 6F 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 00 w☻RtlAnsiStringToUnicodeString.. 00001560 C3 02 52 74 6C 46 72 65 65 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 00 F4 00 49 6F 43 72 65 61 ├☻RtlFreeUnicodeString..⌠.IoCrea 00001580 74 65 46 69 6C 65 00 00 F6 01 4D 6D 55 6E 6C 6F 63 6B 50 61 67 65 73 00 F8 01 4D 6D 55 6E 6D 61 teFile..÷☺MmUnlockPages.°☺MmUnma 000015A0 70 4C 6F 63 6B 65 64 50 61 67 65 73 00 00 CC CC E7 01 4D 6D 4D 61 70 4C 6F 63 6B 65 64 50 61 67 pLockedPages..╠╠τ☺MmMapLockedPag 000015C0 65 73 00 00 E8 00 49 6F 42 75 69 6C 64 50 61 72 74 69 61 6C 4D 64 6C 00 08 01 49 6F 46 72 65 65 es..Φ.IoBuildPartialMdl.◘☺IoFree 000015E0 4D 64 6C 00 CC CC CC CC 88 01 4B 65 51 75 65 72 79 54 69 6D 65 49 6E 63 72 65 6D 65 6E 74 00 00 Mdl.╠╠╠╠ê☺KeQueryTimeIncrement.. 00001600 8D 01 4B 65 52 65 61 64 53 74 61 74 65 51 75 65 75 65 00 00 36 00 45 78 41 6C 6C 6F 63 61 74 65 ì☺KeReadStateQueue..6.ExAllocate 00001620 50 6F 6F 6C 57 69 74 68 54 61 67 00 42 00 45 78 46 72 65 65 50 6F 6F 6C 00 00 CC CC CC CC CC CC PoolWithTag.B.ExFreePool..╠╠╠╠╠╠ 00001640 45 01 49 6F 66 43 6F 6D 70 6C 65 74 65 52 65 71 75 65 73 74 00 00 CC CC 44 01 49 6F 66 43 61 6C E☺IofCompleteRequest..╠╠D☺IofCal 00001660 6C 44 72 69 76 65 72 00 BE 03 5F 77 63 73 6E 69 63 6D 70 00 CC CC CC CC 7B 01 4B 65 49 6E 73 65 lDriver.╛♥_wcsnicmp.╠╠╠╠{☺KeInse 00001680 72 74 48 65 61 64 51 75 65 75 65 00 62 00 45 78 51 75 65 75 65 57 6F 72 6B 49 74 65 6D 00 CC CC rtHeadQueue.b.ExQueueWorkItem.╠╠ 000016A0 FB 00 49 6F 44 65 6C 65 74 65 44 65 76 69 63 65 00 00 F3 00 49 6F 43 72 65 61 74 65 44 65 76 69 √.IoDeleteDevice..≤.IoCreateDevi 000016C0 63 65 00 00 CC CC CC CC CC CC CC CC CC CC CC CC 28 01 49 6F 52 65 67 69 73 74 65 72 53 68 75 74 ce..╠╠╠╠╠╠╠╠╠╠╠╠(☺IoRegisterShut 000016E0 64 6F 77 6E 4E 6F 74 69 66 69 63 61 74 69 6F 6E 00 00 DF 00 49 6F 41 6C 6C 6F 63 61 74 65 45 72 downNotification..▀.IoAllocateEr 00001700 72 6F 72 4C 6F 67 45 6E 74 72 79 00 41 01 49 6F 57 72 69 74 65 45 72 72 6F 72 4C 6F 67 45 6E 74 rorLogEntry.A☺IoWriteErrorLogEnt 00001720 72 79 00 00 CC CC CC CC CC CC CC CC CC CC CC CC 19 03 52 74 6C 55 70 63 61 73 65 55 6E 69 63 6F ry..╠╠╠╠╠╠╠╠╠╠╠╠↓♥RtlUpcaseUnico 00001740 64 65 43 68 61 72 00 00 B2 01 4B 65 54 69 63 6B 43 6F 75 6E 74 00 CC CC CC CC CC CC CC CC CC CC deChar..▓☺KeTickCount.╠╠╠╠╠╠╠╠╠╠ 00001760 6F 01 4B 65 49 6E 69 74 69 61 6C 69 7A 65 44 70 63 00 CC CC CC CC CC CC 3F 02 4F 62 52 65 66 65 o☺KeInitializeDpc.╠╠╠╠╠╠?☻ObRefe 00001780 72 65 6E 63 65 4F 62 6A 65 63 74 42 79 48 61 6E 64 6C 65 00 11 01 49 6F 47 65 74 52 65 6C 61 74 renceObjectByHandle.◄☺IoGetRelat 000017A0 65 64 44 65 76 69 63 65 4F 62 6A 65 63 74 00 00 25 02 4E 74 52 65 61 64 46 69 6C 65 00 00 29 02 edDeviceObject..%☻NtReadFile..)☻ 000017C0 4E 74 53 65 74 49 6E 66 6F 72 6D 61 74 69 6F 6E 46 69 6C 65 00 00 CC CC 30 02 4E 74 57 72 69 74 NtSetInformationFile..╠╠0☻NtWrit 000017E0 65 46 69 6C 65 00 CC CC 7C 01 4B 65 49 6E 73 65 72 74 51 75 65 75 65 00 15 01 49 6F 49 6E 69 74 eFile.╠╠|☺KeInsertQueue.§☺IoInit 00001800 69 61 6C 69 7A 65 49 72 70 00 D3 01 4D 6D 42 75 69 6C 64 4D 64 6C 46 6F 72 4E 6F 6E 50 61 67 65 ializeIrp.╙☺MmBuildMdlForNonPage 00001820 64 50 6F 6F 6C 00 CC CC EA 03 77 63 73 6C 65 6E 00 00 F2 02 52 74 6C 4F 65 6D 53 74 72 69 6E 67 dPool.╠╠Ω♥wcslen..≥☻RtlOemString 00001840 54 6F 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 8A 01 4B 65 52 65 61 64 53 74 61 74 65 45 76 65 ToUnicodeString.è☺KeReadStateEve 00001860 6E 74 00 00 AA 01 4B 65 53 65 74 54 61 72 67 65 74 50 72 6F 63 65 73 73 6F 72 44 70 63 00 54 01 nt..¬☺KeSetTargetProcessorDpc.T☺ 00001880 4B 65 43 6C 65 61 72 45 76 65 6E 74 00 00 CC CC AE 01 4B 65 53 65 74 54 69 6D 65 72 00 00 CC CC KeClearEvent..╠╠«☺KeSetTimer..╠╠ 000018A0 53 01 4B 65 43 61 6E 63 65 6C 54 69 6D 65 72 00 B8 01 4B 65 57 61 69 74 46 6F 72 53 69 6E 67 6C S☺KeCancelTimer.╕☺KeWaitForSingl 000018C0 65 4F 62 6A 65 63 74 00 70 01 4B 65 49 6E 69 74 69 61 6C 69 7A 65 45 76 65 6E 74 00 77 01 4B 65 eObject.p☺KeInitializeEvent.w☺Ke 000018E0 49 6E 69 74 69 61 6C 69 7A 65 54 69 6D 65 72 00 1F 02 4E 74 51 75 65 72 79 49 6E 66 6F 72 6D 61 InitializeTimer.▼☻NtQueryInforma 00001900 74 69 6F 6E 46 69 6C 65 00 00 CC CC 19 02 4E 74 4F 70 65 6E 46 69 6C 65 00 00 CC CC CC CC CC CC tionFile..╠╠↓☻NtOpenFile..╠╠╠╠╠╠ 00001920 48 41 4C 2E 64 6C 6C 00 4A 00 4B 66 41 63 71 75 69 72 65 53 70 69 6E 4C 6F 63 6B 00 4B 00 4B 66 HAL.dll.J.KfAcquireSpinLock.K.Kf 00001940 4C 6F 77 65 72 49 72 71 6C 00 42 00 4B 65 47 65 74 43 75 72 72 65 6E 74 49 72 71 6C 00 00 4D 00 LowerIrql.B.KeGetCurrentIrql..M. 00001960 4B 66 52 65 6C 65 61 73 65 53 70 69 6E 4C 6F 63 6B 00 CC CC 4C 00 4B 66 52 61 69 73 65 49 72 71 KfReleaseSpinLock.╠╠L.KfRaiseIrq 00001980 6C 00 CC CC CC CC CC CC 54 44 49 2E 53 59 53 00 20 00 54 64 69 4F 70 65 6E 4E 65 74 62 69 6F 73 l.╠╠╠╠╠╠TDI.SYS. .TdiOpenNetbios 000019A0 41 64 64 72 65 73 73 00 1C 00 54 64 69 44 65 72 65 67 69 73 74 65 72 4E 6F 74 69 66 69 63 61 74 Address.∟.TdiDeregisterNotificat 000019C0 69 6F 6E 48 61 6E 64 6C 65 72 00 00 25 00 54 64 69 52 65 74 75 72 6E 43 68 61 69 6E 65 64 52 65 ionHandler..%.TdiReturnChainedRe 000019E0 63 65 69 76 65 73 00 00 CC CC CC CC CC CC CC CC 0D 00 54 64 69 43 6F 70 79 42 75 66 66 65 72 54 ceives..╠╠╠╠╠╠╠╠♪.TdiCopyBufferT 00001A00 6F 4D 64 6C 00 00 24 00 54 64 69 52 65 67 69 73 74 65 72 4E 6F 74 69 66 69 63 61 74 69 6F 6E 48 oMdl..$.TdiRegisterNotificationH 00001A20 61 6E 64 6C 65 72 00 00 6B 73 65 63 64 64 2E 73 79 73 00 00 CC CC CC CC CC CC CC CC CC CC CC CC andler..ksecdd.sys..╠╠╠╠╠╠╠╠╠╠╠╠ 00001A40 01 00 41 63 71 75 69 72 65 43 72 65 64 65 6E 74 69 61 6C 73 48 61 6E 64 6C 65 57 00 09 00 49 6E ☺.AcquireCredentialsHandleW.○.In 00001A60 69 74 53 65 63 75 72 69 74 79 49 6E 74 65 72 66 61 63 65 57 00 00 0C 00 4D 61 70 53 65 63 75 72 itSecurityInterfaceW..♀.MapSecur 00001A80 69 74 79 45 72 72 6F 72 00 00 08 00 49 6D 70 65 72 73 6F 6E 61 74 65 53 65 63 75 72 69 74 79 43 ityError..◘.ImpersonateSecurityC 00001AA0 6F 6E 74 65 78 74 00 00 05 00 46 72 65 65 43 6F 6E 74 65 78 74 42 75 66 66 65 72 00 CC CC CC CC ontext..♣.FreeContextBuffer.╠╠╠╠ 00001AC0 04 00 45 6E 75 6D 65 72 61 74 65 53 65 63 75 72 69 74 79 50 61 63 6B 61 67 65 73 57 00 00 03 00 ♦.EnumerateSecurityPackagesW..♥. 00001AE0 44 65 6C 65 74 65 53 65 63 75 72 69 74 79 43 6F 6E 74 65 78 74 00 00 00 41 63 63 65 70 74 53 65 DeleteSecurityContext...AcceptSe 00001B00 63 75 72 69 74 79 43 6F 6E 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 curityContext...................