============================================================================================================================================== OFFSET 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F ---------------------------------------------------------------------------------------------------------------------------------------------- 00000000 56 57 68 14 0E 01 00 8B 35 E0 02 01 00 FF D6 68 24 0E 01 00 FF D6 68 E0 0D 01 00 FF D6 68 41 66 VWh¶♫☺.ï5α☻☺. ╓h$♫☺. ╓hα♪☺. ╓hAf 00000020 64 20 6A 38 6A 00 FF 15 D8 02 01 00 A3 38 0E 01 00 85 C0 75 07 32 C0 E9 97 01 00 00 50 A3 38 0E d j8j. §╪☻☺.ú8♫☺.à└u•2└Θù☺..Pú8♫ 00000040 01 00 FF 15 DC 02 01 00 B8 58 0E 01 00 A3 5C 0E 01 00 A3 58 0E 01 00 B8 50 0E 01 00 A3 54 0E 01 ☺. §▄☻☺.╕X♫☺.ú\♫☺.úX♫☺.╕P♫☺.úT♫☺ 00000060 00 A3 50 0E 01 00 B8 18 0E 01 00 A3 1C 0E 01 00 A3 18 0E 01 00 B8 28 0E 01 00 A3 2C 0E 01 00 A3 .úP♫☺.╕↑♫☺.ú∟♫☺.ú↑♫☺.╕(♫☺.ú,♫☺.ú 00000080 28 0E 01 00 B8 40 0E 01 00 A3 44 0E 01 00 A3 40 0E 01 00 B8 08 0E 01 00 A3 0C 0E 01 00 A3 08 0E (♫☺.╕@♫☺.úD♫☺.ú@♫☺.╕◘♫☺.ú♀♫☺.ú◘♫ 000000A0 01 00 C7 05 D4 0D 01 00 01 00 00 00 B8 30 0E 01 00 BE 00 10 00 00 6A 00 A3 34 0E 01 00 6A 04 A3 ☺.╟♣╘♪☺.☺...╕0♫☺.╛.►..j.ú4♫☺.j♦ú 000000C0 30 0E 01 00 B8 D8 0D 01 00 BF C0 0D 01 00 A3 DC 0D 01 00 A3 D8 0D 01 00 E8 9F 94 FF FF 2B F0 33 0♫☺.╕╪♪☺.┐└♪☺.ú▄♪☺.ú╪♪☺.Φƒö +≡3 000000E0 C0 89 35 64 0E 01 00 AB AB AB AB AB 66 C7 05 D0 0D 01 00 20 00 BF F0 0D 01 00 AB AB AB AB AB 66 └ë5d♫☺.½½½½½f╟♣╨♪☺. .┐≡♪☺.½½½½½f 00000100 A3 00 0E 01 00 FF 15 B8 02 01 00 85 C0 74 0F 83 F8 01 74 3E 83 F8 02 74 6D E9 9F 00 00 00 C7 05 ú.♫☺. §╕☻☺.à└t☼â°☺t>â°☻tmΘƒ...╟♣ 00000120 60 0E 01 00 05 00 00 00 C7 05 68 0E 01 00 02 00 00 00 C7 05 3C 0E 01 00 00 00 00 00 B8 00 10 00 `♫☺.♣...╟♣h♫☺.☻...╟♣<♫☺.....╕.►. 00000140 00 A3 04 0E 01 00 A3 48 0E 01 00 A3 E8 0D 01 00 EB 6B C7 05 60 0E 01 00 14 00 00 00 C7 05 68 0E .ú♦♫☺.úH♫☺.úΦ♪☺.δk╟♣`♫☺.¶...╟♣h♫ 00000160 01 00 0A 00 00 00 C7 05 3C 0E 01 00 02 00 00 00 B8 00 20 00 00 A3 04 0E 01 00 A3 48 0E 01 00 A3 ☺.◙...╟♣<♫☺.☻...╕. ..ú♦♫☺.úH♫☺.ú 00000180 E8 0D 01 00 EB 37 C7 05 60 0E 01 00 32 00 00 00 C7 05 68 0E 01 00 1E 00 00 00 C7 05 3C 0E 01 00 Φ♪☺.δ7╟♣`♫☺.2...╟♣h♫☺.▲...╟♣<♫☺. 000001A0 0A 00 00 00 C7 05 E8 0D 01 00 00 00 01 00 B8 00 20 00 00 A3 04 0E 01 00 A3 48 0E 01 00 FF 15 F8 ◙...╟♣Φ♪☺...☺.╕. ..ú♦♫☺.úH♫☺. §° 000001C0 02 01 00 84 C0 75 0A C7 05 E8 0D 01 00 00 10 00 00 B0 01 5F 5E C3 5C 00 44 00 65 00 76 00 69 00 ☻☺.ä└u◙╟♣Φ♪☺..►..░☺_^├\.D.e.v.i. 000001E0 63 00 65 00 5C 00 41 00 66 00 64 00 00 00 83 EC 08 8D 44 24 00 53 56 57 68 96 A2 01 00 50 FF 15 c.e.\.A.f.d...â∞◘ìD$.SVWhûó☺.P § 00000200 64 03 01 00 8D 4C 24 0C 68 E4 0D 01 00 8B 5C 24 1C 6A 00 6A 00 6A 11 51 6A 00 53 FF 15 60 03 01 d♥☺.ìL$♀hΣ♪☺.ï\$∟j.j.j◄Qj.S §`♥☺ 00000220 00 8B F0 85 F6 7C 64 A1 E4 0D 01 00 8D 7B 38 B9 18 00 00 00 80 48 1C 10 C7 43 34 00 00 00 00 B8 .ï≡à÷|díΣ♪☺.ì{8╣↑...ÇH∟►╟C4....╕ 00000240 60 46 01 00 F3 AB C7 43 28 A8 0A 01 00 E8 AE FD FF FF 84 C0 B8 9A 00 00 C0 74 32 E8 0E 01 00 00 `F☺.≤½╟C(¿◙☺.Φ«² ä└╕Ü..└t2Φ♫☺.. 00000260 8A 0D 84 0A 01 00 A1 E4 0D 01 00 88 48 30 FF 15 24 03 01 00 68 AE A2 01 00 A3 20 0E 01 00 C6 05 è♪ä◙☺.íΣ♪☺.êH0 §$♥☺.h«ó☺.ú ♫☺.╞♣ 00000280 A4 0A 01 00 00 FF 15 5C 03 01 00 8B C6 5F 5E 5B 83 C4 08 C2 08 00 5C 00 52 00 65 00 67 00 69 00 ñ◙☺.. §\♥☺.ï╞_^[â─◘┬◘.\.R.e.g.i. 000002A0 73 00 74 00 72 00 79 00 5C 00 4D 00 61 00 63 00 68 00 69 00 6E 00 65 00 5C 00 53 00 79 00 73 00 s.t.r.y.\.M.a.c.h.i.n.e.\.S.y.s. 000002C0 74 00 65 00 6D 00 5C 00 43 00 75 00 72 00 72 00 65 00 6E 00 74 00 43 00 6F 00 6E 00 74 00 72 00 t.e.m.\.C.u.r.r.e.n.t.C.o.n.t.r. 000002E0 6F 00 6C 00 53 00 65 00 74 00 5C 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5C 00 41 00 o.l.S.e.t.\.S.e.r.v.i.c.e.s.\.A. 00000300 66 00 64 00 00 00 49 00 72 00 70 00 53 00 74 00 61 00 63 00 6B 00 53 00 69 00 7A 00 65 00 00 00 f.d...I.r.p.S.t.a.c.k.S.i.z.e... 00000320 00 00 50 00 72 00 69 00 6F 00 72 00 69 00 74 00 79 00 42 00 6F 00 6F 00 73 00 74 00 00 00 49 00 ..P.r.i.o.r.i.t.y.B.o.o.s.t...I. 00000340 67 00 6E 00 6F 00 72 00 65 00 50 00 75 00 73 00 68 00 42 00 69 00 74 00 4F 00 6E 00 52 00 65 00 g.n.o.r.e.P.u.s.h.B.i.t.O.n.R.e. 00000360 63 00 65 00 69 00 76 00 65 00 73 00 00 00 55 8B EC 83 EC 0C 56 8D 45 F4 57 68 56 A3 01 00 50 FF c.e.i.v.e.s...Uï∞â∞♀VìE⌠WhVú☺.P 00000380 15 64 03 01 00 8D 4D FC 8D 45 F4 51 50 E8 BA 00 00 00 85 C0 0F 85 95 00 00 00 0F BE 05 84 0A 01 §d♥☺.ìMⁿìE⌠QPΦ║...à└☼àò...☼╛♣ä◙☺ 000003A0 00 50 68 C6 A3 01 00 FF 75 FC E8 55 01 00 00 3D FF 00 00 00 76 05 B8 FF 00 00 00 A2 84 0A 01 00 .Ph╞ú☺. uⁿΦU☺..= ...v♣╕ ...óä◙☺. 000003C0 0F BE 05 88 0A 01 00 50 68 E2 A3 01 00 FF 75 FC E8 2F 01 00 00 83 F8 10 76 05 B8 02 00 00 00 BF ☼╛♣ê◙☺.PhΓú☺. uⁿΦ/☺..â°►v♣╕☻...┐ 000003E0 D4 0C 01 00 A2 88 0A 01 00 8B 37 83 C7 08 FF 36 FF 77 F4 FF 75 FC E8 09 01 00 00 89 06 81 FF 34 ╘♀☺.óê◙☺.ï7â╟◘ 6 w⌠ uⁿΦ○☺..ë♠ü 4 00000400 0D 01 00 72 E4 0F B6 05 A0 0A 01 00 50 68 FE A3 01 00 FF 75 FC E8 EA 00 00 00 FF 75 FC 83 F8 01 ♪☺.rΣ☼╢♣á◙☺.Ph■ú☺. uⁿΦΩ... uⁿâ°☺ 00000420 1A C0 FE C0 A2 A0 0A 01 00 FF 15 1C 03 01 00 5F 5E 8B E5 5D C3 CC 50 00 61 00 72 00 61 00 6D 00 →└■└óá◙☺. §∟♥☺._^ïσ]├╠P.a.r.a.m. 00000440 65 00 74 00 65 00 72 00 73 00 00 00 55 33 C9 8B EC 83 EC 28 56 8B 45 08 57 89 4D DC 89 45 E0 89 e.t.e.r.s...U3╔ï∞â∞(VïE◘WëM▄ëEαë 00000460 4D E8 8D 55 F8 89 4D EC C7 45 D8 18 00 00 00 C7 45 E4 40 00 00 00 52 51 51 8D 45 FC 51 8D 4D D8 MΦìU°ëM∞╟E╪↑...╟EΣ@...RQQìEⁿQìM╪ 00000480 51 68 06 00 02 00 50 FF 15 6C 03 01 00 85 C0 7D 07 B8 01 00 00 C0 EB 64 68 F6 A4 01 00 8D 45 F0 Qh♠.☻.P §l♥☺.à└}•╕☺..└δdh÷ñ☺.ìE≡ 000004A0 50 FF 15 64 03 01 00 8B 4D FC 8D 45 F0 89 4D DC 89 45 E0 C7 45 D8 18 00 00 00 C7 45 E4 40 00 00 P §d♥☺.ïMⁿìE≡ëM▄ëEα╟E╪↑...╟EΣ@.. 000004C0 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 8D 55 D8 52 68 19 00 02 00 FF 75 0C FF 15 68 03 01 .╟EΦ....╟E∞....ìU╪Rh↓.☻. u♀ §h♥☺ 000004E0 00 FF 75 FC 8B F8 85 FF 7D 0A FF 15 1C 03 01 00 8B C7 EB 08 FF 15 1C 03 01 00 33 C0 5F 5E 8B E5 . uⁿï°à }◙ §∟♥☺.ï╟δ◘ §∟♥☺.3└_^ïσ 00000500 5D C2 08 00 55 8B EC 83 EC 10 FF 75 0C 8D 4D F0 51 FF 15 64 03 01 00 8D 4D F8 8D 55 F0 51 68 80 ]┬◘.Uï∞â∞► u♀ìM≡Q §d♥☺.ìM°ìU≡QhÇ 00000520 00 00 00 68 30 0D 01 00 6A 01 52 FF 75 08 FF 15 70 03 01 00 85 C0 75 28 83 3D 3C 0D 01 00 04 75 ...h0♪☺.j☺R u◘ §p♥☺.à└u(â=<♪☺.♦u 00000540 1F 6A 04 A1 38 0D 01 00 05 30 0D 01 00 8D 4D FC 50 51 E8 E3 61 FF FF 83 C4 0C 83 7D FC 00 7D 06 ▼j♦í8♪☺.♣0♪☺.ìMⁿPQΦπa â─♀â}ⁿ.}♠ 00000560 8B 45 10 89 45 FC 8B 45 FC 8B E5 5D C2 0C 00 98 A6 00 00 00 00 00 00 00 00 00 00 22 AE 00 00 B8 ïE►ëEⁿïEⁿïσ]┬♀.ÿª.........."«..╕ 00000580 02 00 00 80 A6 00 00 00 00 00 00 00 00 00 00 64 AE 00 00 A0 02 00 00 8C A6 00 00 00 00 00 00 00 ☻..Ǫ..........d«..á☻..îª....... 000005A0 00 00 00 98 AE 00 00 AC 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...ÿ«..¼☻....................... 000005C0 50 AE 00 00 3C AE 00 00 00 00 00 00 6C AE 00 00 82 AE 00 00 00 00 00 00 08 A9 00 00 7C A8 00 00 P«..<«......l«..é«......◘⌐..|¿.. 000005E0 94 A8 00 00 A4 A8 00 00 C0 A8 00 00 D4 A8 00 00 E4 A8 00 00 46 A8 00 00 64 A8 00 00 1C A9 00 00 ö¿..ñ¿..└¿..╘¿..Σ¿..F¿..d¿..∟⌐.. 00000600 38 A9 00 00 50 A9 00 00 62 A9 00 00 70 A9 00 00 80 A9 00 00 92 A9 00 00 F0 A8 00 00 9C A9 00 00 8⌐..P⌐..b⌐..p⌐..Ç⌐..Æ⌐..≡¿..£⌐.. 00000620 D2 A9 00 00 E6 A9 00 00 06 AA 00 00 1E AA 00 00 36 AA 00 00 4A AA 00 00 5E AA 00 00 6A AA 00 00 ╥⌐..µ⌐..♠¬..▲¬..6¬..J¬..^¬..j¬.. 00000640 74 AA 00 00 94 AA 00 00 AA AA 00 00 C2 AA 00 00 DC AA 00 00 FE AA 00 00 0C AB 00 00 2C AB 00 00 t¬..ö¬..¬¬..┬¬..▄¬..■¬..♀½..,½.. 00000660 48 AB 00 00 B4 A9 00 00 D0 A7 00 00 2E A8 00 00 A6 AB 00 00 BA AB 00 00 D0 AB 00 00 E0 AB 00 00 H½..┤⌐..╨º...¿..ª½..║½..╨½..α½.. 00000680 F6 AB 00 00 08 AC 00 00 20 AC 00 00 2C AC 00 00 3A AC 00 00 4C AC 00 00 68 AC 00 00 7E AC 00 00 ÷½..◘¼.. ¼..,¼..:¼..L¼..h¼..~¼.. 000006A0 9C AC 00 00 B4 AC 00 00 C4 AC 00 00 E2 AC 00 00 FA AC 00 00 0A AD 00 00 1A AD 00 00 2E AD 00 00 £¼..┤¼..─¼..Γ¼..·¼..◙¡..→¡...¡.. 000006C0 40 AD 00 00 4E AD 00 00 62 AD 00 00 74 AD 00 00 84 AD 00 00 94 AD 00 00 AE AD 00 00 BE AD 00 00 @¡..N¡..b¡..t¡..ä¡..ö¡..«¡..╛¡.. 000006E0 D4 AD 00 00 EE AD 00 00 02 AE 00 00 12 AE 00 00 30 AE 00 00 1A A8 00 00 FE A7 00 00 E6 A7 00 00 ╘¡..ε¡..☻«..↕«..0«..→¿..■º..µº.. 00000700 8E AB 00 00 5A AB 00 00 74 AB 00 00 00 00 00 00 16 01 49 6F 66 43 6F 6D 70 6C 65 74 65 52 65 71 Ľ..Z½..t½......▬☺IofCompleteReq 00000720 75 65 73 74 00 00 F2 01 4F 62 66 44 65 72 65 66 65 72 65 6E 63 65 4F 62 6A 65 63 74 00 00 F0 01 uest..≥☺ObfDereferenceObject..≡☺ 00000740 4F 62 52 65 66 65 72 65 6E 63 65 4F 62 6A 65 63 74 42 79 48 61 6E 64 6C 65 00 DC 00 49 6F 46 69 ObReferenceObjectByHandle.▄.IoFi 00000760 6C 65 4F 62 6A 65 63 74 54 79 70 65 00 00 B5 00 49 6E 74 65 72 6C 6F 63 6B 65 64 49 6E 63 72 65 leObjectType..╡.InterlockedIncre 00000780 6D 65 6E 74 00 00 F1 01 4F 62 52 65 66 65 72 65 6E 63 65 4F 62 6A 65 63 74 42 79 50 6F 69 6E 74 ment..±☺ObReferenceObjectByPoint 000007A0 65 72 00 00 2E 00 45 78 41 6C 6C 6F 63 61 74 65 50 6F 6F 6C 57 69 74 68 54 61 67 00 B3 00 49 6E er....ExAllocatePoolWithTag.│.In 000007C0 74 65 72 6C 6F 63 6B 65 64 44 65 63 72 65 6D 65 6E 74 00 00 15 01 49 6F 66 43 61 6C 6C 44 72 69 terlockedDecrement..§☺IofCallDri 000007E0 76 65 72 00 E7 00 49 6F 47 65 74 52 65 6C 61 74 65 64 44 65 76 69 63 65 4F 62 6A 65 63 74 00 00 ver.τ.IoGetRelatedDeviceObject.. 00000800 C3 00 49 6F 42 75 69 6C 64 50 61 72 74 69 61 6C 4D 64 6C 00 BD 00 49 6F 41 6C 6C 6F 63 61 74 65 ├.IoBuildPartialMdl.╜.IoAllocate 00000820 4D 64 6C 00 DF 00 49 6F 46 72 65 65 4D 64 6C 00 A2 01 4D 6D 49 73 54 68 69 73 41 6E 4E 74 41 73 Mdl.▀.IoFreeMdl.ó☺MmIsThisAnNtAs 00000840 53 79 73 74 65 6D 00 00 AD 01 4D 6D 51 75 65 72 79 53 79 73 74 65 6D 53 69 7A 65 00 3A 00 45 78 System..¡☺MmQuerySystemSize.:.Ex 00000860 49 6E 69 74 69 61 6C 69 7A 65 52 65 73 6F 75 72 63 65 4C 69 74 65 00 00 45 01 4B 65 49 6E 69 74 InitializeResourceLite..E☺KeInit 00000880 69 61 6C 69 7A 65 53 70 69 6E 4C 6F 63 6B 00 00 29 01 4B 65 44 65 74 61 63 68 50 72 6F 63 65 73 ializeSpinLock..)☺KeDetachProces 000008A0 73 00 36 00 45 78 46 72 65 65 50 6F 6F 6C 00 00 EA 02 5A 77 43 72 65 61 74 65 46 69 6C 65 00 00 s.6.ExFreePool..Ω☻ZwCreateFile.. 000008C0 20 01 4B 65 41 74 74 61 63 68 50 72 6F 63 65 73 73 00 3E 03 6D 65 6D 6D 6F 76 65 00 59 00 45 78 ☺KeAttachProcess.>♥memmove.Y.Ex 000008E0 52 65 6C 65 61 73 65 52 65 73 6F 75 72 63 65 4C 69 74 65 00 28 00 45 78 41 63 71 75 69 72 65 52 ReleaseResourceLite.(.ExAcquireR 00000900 65 73 6F 75 72 63 65 53 68 61 72 65 64 4C 69 74 65 00 27 02 52 74 6C 43 6F 6D 70 61 72 65 4D 65 esourceSharedLite.'☻RtlCompareMe 00000920 6D 6F 72 79 00 00 5F 00 45 78 66 49 6E 74 65 72 6C 6F 63 6B 65 64 49 6E 73 65 72 74 54 61 69 6C mory.._.ExfInterlockedInsertTail 00000940 4C 69 73 74 00 00 22 03 5A 77 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 F2 02 List.."♥ZwWaitForSingleObject.≥☻ 00000960 5A 77 44 65 76 69 63 65 49 6F 43 6F 6E 74 72 6F 6C 46 69 6C 65 00 08 02 50 73 52 65 74 75 72 6E ZwDeviceIoControlFile.◘☻PsReturn 00000980 50 6F 6F 6C 51 75 6F 74 61 00 FB 01 50 73 43 68 61 72 67 65 50 6F 6F 6C 51 75 6F 74 61 00 DE 00 PoolQuota.√☺PsChargePoolQuota.▐. 000009A0 49 6F 46 72 65 65 49 72 70 00 E5 02 5A 77 43 6C 6F 73 65 00 62 00 45 78 66 49 6E 74 65 72 6C 6F IoFreeIrp.σ☻ZwClose.b.ExfInterlo 000009C0 63 6B 65 64 52 65 6D 6F 76 65 48 65 61 64 4C 69 73 74 00 00 E2 00 49 6F 47 65 74 43 75 72 72 65 ckedRemoveHeadList..Γ.IoGetCurre 000009E0 6E 74 50 72 6F 63 65 73 73 00 32 02 52 74 6C 43 6F 70 79 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 ntProcess.2☻RtlCopyUnicodeString 00000A00 00 00 2A 02 52 74 6C 43 6F 6D 70 61 72 65 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 27 00 45 78 ..*☻RtlCompareUnicodeString.'.Ex 00000A20 41 63 71 75 69 72 65 52 65 73 6F 75 72 63 65 45 78 63 6C 75 73 69 76 65 4C 69 74 65 00 00 B3 01 AcquireResourceExclusiveLite..│☺ 00000A40 4D 6D 53 69 7A 65 4F 66 4D 64 6C 00 5E 00 45 78 66 49 6E 74 65 72 6C 6F 63 6B 65 64 49 6E 73 65 MmSizeOfMdl.^.ExfInterlockedInse 00000A60 72 74 48 65 61 64 4C 69 73 74 00 00 94 01 4D 6D 42 75 69 6C 64 4D 64 6C 46 6F 72 4E 6F 6E 50 61 rtHeadList..ö☺MmBuildMdlForNonPa 00000A80 67 65 64 50 6F 6F 6C 00 EA 00 49 6F 49 6E 69 74 69 61 6C 69 7A 65 49 72 70 00 FB 00 49 6F 52 65 gedPool.Ω.IoInitializeIrp.√.IoRe 00000AA0 6C 65 61 73 65 43 61 6E 63 65 6C 53 70 69 6E 4C 6F 63 6B 00 B6 00 49 6F 41 63 71 75 69 72 65 43 leaseCancelSpinLock.╢.IoAcquireC 00000AC0 61 6E 63 65 6C 53 70 69 6E 4C 6F 63 6B 00 FF 01 50 73 47 65 74 50 72 6F 63 65 73 73 45 78 69 74 ancelSpinLock. ☺PsGetProcessExit 00000AE0 54 69 6D 65 00 00 54 01 4B 65 51 75 65 72 79 53 79 73 74 65 6D 54 69 6D 65 00 30 01 4B 65 47 65 Time..T☺KeQuerySystemTime.0☺KeGe 00000B00 74 43 75 72 72 65 6E 74 54 68 72 65 61 64 00 00 BC 00 49 6F 41 6C 6C 6F 63 61 74 65 49 72 70 00 tCurrentThread..╝.IoAllocateIrp. 00000B20 AB 01 4D 6D 50 61 67 65 45 6E 74 69 72 65 44 72 69 76 65 72 00 00 CE 00 49 6F 43 72 65 61 74 65 ½☺MmPageEntireDriver..╬.IoCreate 00000B40 44 65 76 69 63 65 00 00 68 02 52 74 6C 49 6E 69 74 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 00 Device..h☻RtlInitUnicodeString.. 00000B60 03 03 5A 77 4F 70 65 6E 4B 65 79 00 EB 02 5A 77 43 72 65 61 74 65 4B 65 79 00 13 03 5A 77 51 75 ♥♥ZwOpenKey.δ☻ZwCreateKey.‼♥ZwQu 00000B80 65 72 79 56 61 6C 75 65 4B 65 79 00 A3 01 4D 6D 4C 6F 63 6B 50 61 67 61 62 6C 65 44 61 74 61 53 eryValueKey.ú☺MmLockPagableDataS 00000BA0 65 63 74 69 6F 6E 00 00 AE 01 4D 6D 52 65 73 65 74 44 72 69 76 65 72 50 61 67 69 6E 67 00 B4 01 ection..«☺MmResetDriverPaging.┤☺ 00000BC0 4D 6D 55 6E 6C 6F 63 6B 50 61 67 61 62 6C 65 49 6D 61 67 65 53 65 63 74 69 6F 6E 00 EE 01 4F 62 MmUnlockPagableImageSection.ε☺Ob 00000BE0 4F 70 65 6E 4F 62 6A 65 63 74 42 79 50 6F 69 6E 74 65 72 00 E9 02 5A 77 43 72 65 61 74 65 45 76 OpenObjectByPointer.Θ☻ZwCreateEv 00000C00 65 6E 74 00 2D 00 45 78 41 6C 6C 6F 63 61 74 65 50 6F 6F 6C 57 69 74 68 51 75 6F 74 61 54 61 67 ent.-.ExAllocatePoolWithQuotaTag 00000C20 00 00 7A 01 4B 65 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 DB 00 49 6F 45 6E ..z☺KeWaitForSingleObject.█.IoEn 00000C40 71 75 65 75 65 49 72 70 00 00 67 01 4B 65 52 65 73 65 74 45 76 65 6E 74 00 00 3F 01 4B 65 49 6E queueIrp..g☺KeResetEvent..?☺KeIn 00000C60 69 74 69 61 6C 69 7A 65 45 76 65 6E 74 00 4E 00 45 78 51 75 65 75 65 57 6F 72 6B 49 74 65 6D 00 itializeEvent.N.ExQueueWorkItem. 00000C80 71 01 4B 65 53 65 74 54 69 6D 65 72 00 00 46 01 4B 65 49 6E 69 74 69 61 6C 69 7A 65 54 69 6D 65 q☺KeSetTimer..F☺KeInitializeTime 00000CA0 72 00 3E 01 4B 65 49 6E 69 74 69 61 6C 69 7A 65 44 70 63 00 23 01 4B 65 43 61 6E 63 65 6C 54 69 r.>☺KeInitializeDpc.#☺KeCancelTi 00000CC0 6D 65 72 00 B5 01 4D 6D 55 6E 6C 6F 63 6B 50 61 67 65 73 00 0C 03 5A 77 51 75 65 72 79 49 6E 66 mer.╡☺MmUnlockPages.♀♥ZwQueryInf 00000CE0 6F 72 6D 61 74 69 6F 6E 46 69 6C 65 00 00 53 00 45 78 52 61 69 73 65 53 74 61 74 75 73 00 AC 01 ormationFile..S.ExRaiseStatus.¼☺ 00000D00 4D 6D 50 72 6F 62 65 41 6E 64 4C 6F 63 6B 50 61 67 65 73 00 4F 00 45 78 52 61 69 73 65 41 63 63 MmProbeAndLockPages.O.ExRaiseAcc 00000D20 65 73 73 56 69 6F 6C 61 74 69 6F 6E 00 00 0D 00 43 63 4D 64 6C 52 65 61 64 43 6F 6D 70 6C 65 74 essViolation..♪.CcMdlReadComplet 00000D40 65 00 94 00 46 73 52 74 6C 4D 64 6C 52 65 61 64 00 00 22 01 4B 65 42 75 67 43 68 65 63 6B 45 78 e.ö.FsRtlMdlRead.."☺KeBugCheckEx 00000D60 00 00 6E 74 6F 73 6B 72 6E 6C 2E 65 78 65 00 00 AA 02 52 74 6C 55 6E 77 69 6E 64 00 49 00 4B 66 ..ntoskrnl.exe..¬☻RtlUnwind.I.Kf 00000D80 52 65 6C 65 61 73 65 53 70 69 6E 4C 6F 63 6B 00 46 00 4B 66 41 63 71 75 69 72 65 53 70 69 6E 4C ReleaseSpinLock.F.KfAcquireSpinL 00000DA0 6F 63 6B 00 48 41 4C 2E 64 6C 6C 00 0D 00 54 64 69 43 6F 70 79 42 75 66 66 65 72 54 6F 4D 64 6C ock.HAL.dll.♪.TdiCopyBufferToMdl 00000DC0 00 00 0E 00 54 64 69 43 6F 70 79 4D 64 6C 54 6F 42 75 66 66 65 72 00 00 54 44 49 2E 53 59 53 00 ..♫.TdiCopyMdlToBuffer..TDI.SYS.