============================================================================================================================================== OFFSET 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F ---------------------------------------------------------------------------------------------------------------------------------------------- 00000000 33 C0 C2 08 00 CC CC CC CC CC CC CC CC CC CC CC 70 40 01 00 00 00 00 00 00 00 00 00 F0 41 01 00 3└┬◘.╠╠╠╠╠╠╠╠╠╠╠p@☺.........≡A☺. 00000020 A0 55 00 00 84 41 01 00 00 00 00 00 00 00 00 00 48 48 01 00 B4 56 00 00 00 00 00 00 00 00 00 00 áU..äA☺.........HH☺.┤V.......... 00000040 00 00 00 00 00 00 00 00 00 00 00 00 CC CC CC CC FE 41 01 00 12 42 01 00 2C 42 01 00 3C 42 01 00 ............╠╠╠╠■A☺.↕B☺.,B☺.<B☺. 00000060 54 42 01 00 6C 42 01 00 7C 42 01 00 9C 42 01 00 B0 42 01 00 D0 42 01 00 EC 42 01 00 0C 43 01 00 TB☺.lB☺.|B☺.£B☺.░B☺.╨B☺.∞B☺.♀C☺. 00000080 26 43 01 00 30 43 01 00 40 43 01 00 58 43 01 00 74 43 01 00 88 43 01 00 A0 43 01 00 C0 43 01 00 &C☺.0C☺.@C☺.XC☺.tC☺.êC☺.áC☺.└C☺. 000000A0 D0 43 01 00 EA 43 01 00 02 44 01 00 1E 44 01 00 30 44 01 00 48 44 01 00 60 44 01 00 74 44 01 00 ╨C☺.ΩC☺.☻D☺.▲D☺.0D☺.HD☺.`D☺.tD☺. 000000C0 8C 44 01 00 A4 44 01 00 B4 44 01 00 CC 44 01 00 DC 44 01 00 FA 44 01 00 16 45 01 00 24 45 01 00 îD☺.ñD☺.┤D☺.╠D☺.▄D☺.·D☺.▬E☺.$E☺. 000000E0 3C 45 01 00 60 45 01 00 78 45 01 00 8C 45 01 00 AC 45 01 00 C8 45 01 00 DC 45 01 00 00 46 01 00 <E☺.`E☺.xE☺.îE☺.¼E☺.╚E☺.▄E☺..F☺. 00000100 12 46 01 00 28 46 01 00 34 46 01 00 48 46 01 00 60 46 01 00 7C 46 01 00 98 46 01 00 B0 46 01 00 ↕F☺.(F☺.4F☺.HF☺.`F☺.|F☺.ÿF☺.░F☺. 00000120 D8 46 01 00 F2 46 01 00 00 47 01 00 14 47 01 00 20 47 01 00 40 47 01 00 5C 47 01 00 7E 47 01 00 ╪F☺.≥F☺..G☺.¶G☺. G☺.@G☺.\G☺.~G☺. 00000140 90 47 01 00 A0 47 01 00 BC 47 01 00 C6 47 01 00 E8 47 01 00 00 48 01 00 18 48 01 00 2E 48 01 00 ÉG☺.áG☺.╝G☺.╞G☺.ΦG☺..H☺.↑H☺..H☺. 00000160 00 00 00 00 50 48 01 00 64 48 01 00 78 48 01 00 8C 48 01 00 A0 48 01 00 C0 48 01 00 E0 48 01 00 ....PH☺.dH☺.xH☺.îH☺.áH☺.└H☺.αH☺. 00000180 00 49 01 00 18 49 01 00 30 49 01 00 40 49 01 00 60 49 01 00 70 49 01 00 86 49 01 00 A0 49 01 00 .I☺.↑I☺.0I☺.@I☺.`I☺.pI☺.åI☺.áI☺. 000001A0 B8 49 01 00 D2 49 01 00 F0 49 01 00 08 4A 01 00 18 4A 01 00 28 4A 01 00 48 4A 01 00 56 4A 01 00 ╕I☺.╥I☺.≡I☺.◘J☺.↑J☺.(J☺.HJ☺.VJ☺. 000001C0 6A 4A 01 00 86 4A 01 00 00 00 00 00 CC CC CC CC 6E 74 6F 73 6B 72 6E 6C 2E 65 78 65 00 00 4C 01 jJ☺.åJ☺.....╠╠╠╠ntoskrnl.exe..L☺ 000001E0 4B 65 49 6E 73 65 72 74 51 75 65 75 65 44 70 63 00 00 B3 00 49 6E 74 65 72 6C 6F 63 6B 65 64 44 KeInsertQueueDpc..│.InterlockedD 00000200 65 63 72 65 6D 65 6E 74 00 00 CC CC A6 01 4D 6D 4D 61 70 49 6F 53 70 61 63 65 00 00 FF 00 49 6F ecrement..╠╠ª☺MmMapIoSpace.. .Io 00000220 52 65 70 6F 72 74 52 65 73 6F 75 72 63 65 55 73 61 67 65 00 B7 02 52 74 6C 57 72 69 74 65 52 65 ReportResourceUsage.╖☻RtlWriteRe 00000240 67 69 73 74 72 79 56 61 6C 75 65 00 23 01 4B 65 43 61 6E 63 65 6C 54 69 6D 65 72 00 5D 01 4B 65 gistryValue.#☺KeCancelTimer.]☺Ke 00000260 52 65 67 69 73 74 65 72 42 75 67 43 68 65 63 6B 43 61 6C 6C 62 61 63 6B 00 00 CC CC B6 01 4D 6D RegisterBugCheckCallback..╠╠╢☺Mm 00000280 55 6E 6D 61 70 49 6F 53 70 61 63 65 00 00 CC CC 3A 00 45 78 49 6E 69 74 69 61 6C 69 7A 65 52 65 UnmapIoSpace..╠╠:.ExInitializeRe 000002A0 73 6F 75 72 63 65 4C 69 74 65 00 00 CC CC CC CC 8C 02 52 74 6C 51 75 65 72 79 52 65 67 69 73 74 sourceLite..╠╠╠╠î☻RtlQueryRegist 000002C0 72 79 56 61 6C 75 65 73 00 00 CC CC 28 01 4B 65 44 65 72 65 67 69 73 74 65 72 42 75 67 43 68 65 ryValues..╠╠(☺KeDeregisterBugChe 000002E0 63 6B 43 61 6C 6C 62 61 63 6B 00 00 BB 00 49 6F 41 6C 6C 6F 63 61 74 65 45 72 72 6F 72 4C 6F 67 ckCallback..╗.IoAllocateErrorLog 00000300 45 6E 74 72 79 00 52 03 77 63 73 6C 65 6E 00 00 3E 03 6D 65 6D 6D 6F 76 65 00 CC CC CC CC CC CC Entry.R♥wcslen..>♥memmove.╠╠╠╠╠╠ 00000320 68 02 52 74 6C 49 6E 69 74 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 00 94 01 4D 6D 42 75 69 6C h☻RtlInitUnicodeString..ö☺MmBuil 00000340 64 4D 64 6C 46 6F 72 4E 6F 6E 50 61 67 65 64 50 6F 6F 6C 00 23 02 52 74 6C 43 68 61 72 54 6F 49 dMdlForNonPagedPool.#☻RtlCharToI 00000360 6E 74 65 67 65 72 00 00 C3 00 49 6F 42 75 69 6C 64 50 61 72 74 69 61 6C 4D 64 6C 00 CC CC CC CC nteger..├.IoBuildPartialMdl.╠╠╠╠ 00000380 92 01 4D 6D 41 6C 6C 6F 63 61 74 65 43 6F 6E 74 69 67 75 6F 75 73 4D 65 6D 6F 72 79 00 00 CC CC Æ☺MmAllocateContiguousMemory..╠╠ 000003A0 BD 00 49 6F 41 6C 6C 6F 63 61 74 65 4D 64 6C 00 9C 01 4D 6D 46 72 65 65 43 6F 6E 74 69 67 75 6F ╜.IoAllocateMdl.£☺MmFreeContiguo 000003C0 75 73 4D 65 6D 6F 72 79 00 00 48 02 52 74 6C 45 71 75 61 6C 55 6E 69 63 6F 64 65 53 74 72 69 6E usMemory..H☻RtlEqualUnicodeStrin 000003E0 67 00 93 01 4D 6D 41 6C 6C 6F 63 61 74 65 4E 6F 6E 43 61 63 68 65 64 4D 65 6D 6F 72 79 00 71 01 g.ô☺MmAllocateNonCachedMemory.q☺ 00000400 4B 65 53 65 74 54 69 6D 65 72 00 00 CC CC CC CC CC 00 49 6F 43 6F 6E 6E 65 63 74 49 6E 74 65 72 KeSetTimer..╠╠╠╠╠.IoConnectInter 00000420 72 75 70 74 00 00 CC CC 6D 01 4B 65 53 65 74 49 6D 70 6F 72 74 61 6E 63 65 44 70 63 00 00 CC CC rupt..╠╠m☺KeSetImportanceDpc..╠╠ 00000440 3F 01 4B 65 49 6E 69 74 69 61 6C 69 7A 65 45 76 65 6E 74 00 9D 01 4D 6D 46 72 65 65 4E 6F 6E 43 ?☺KeInitializeEvent.¥☺MmFreeNonC 00000460 61 63 68 65 64 4D 65 6D 6F 72 79 00 7A 01 4B 65 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A achedMemory.z☺KeWaitForSingleObj 00000480 65 63 74 00 6B 01 4B 65 53 65 74 45 76 65 6E 74 00 00 CC CC 45 01 4B 65 49 6E 69 74 69 61 6C 69 ect.k☺KeSetEvent..╠╠E☺KeInitiali 000004A0 7A 65 53 70 69 6E 4C 6F 63 6B 00 00 67 01 4B 65 52 65 73 65 74 45 76 65 6E 74 00 00 B4 01 4D 6D zeSpinLock..g☺KeResetEvent..┤☺Mm 000004C0 55 6E 6C 6F 63 6B 50 61 67 61 62 6C 65 49 6D 61 67 65 53 65 63 74 69 6F 6E 00 A3 01 4D 6D 4C 6F UnlockPagableImageSection.ú☺MmLo 000004E0 63 6B 50 61 67 61 62 6C 65 44 61 74 61 53 65 63 74 69 6F 6E 00 00 36 00 45 78 46 72 65 65 50 6F ckPagableDataSection..6.ExFreePo 00000500 6F 6C 00 00 F2 01 4F 62 66 44 65 72 65 66 65 72 65 6E 63 65 4F 62 6A 65 63 74 00 00 7C 01 4B 65 ol..≥☺ObfDereferenceObject..|☺Ke 00000520 66 52 65 6C 65 61 73 65 53 70 69 6E 4C 6F 63 6B 46 72 6F 6D 44 70 63 4C 65 76 65 6C 00 00 CC CC fReleaseSpinLockFromDpcLevel..╠╠ 00000540 2E 00 45 78 41 6C 6C 6F 63 61 74 65 50 6F 6F 6C 57 69 74 68 54 61 67 00 D5 00 49 6F 44 65 6C 65 ..ExAllocatePoolWithTag.╒.IoDele 00000560 74 65 44 65 76 69 63 65 00 00 CC CC 7B 01 4B 65 66 41 63 71 75 69 72 65 53 70 69 6E 4C 6F 63 6B teDevice..╠╠{☺KefAcquireSpinLock 00000580 41 74 44 70 63 4C 65 76 65 6C 00 00 16 01 49 6F 66 43 6F 6D 70 6C 65 74 65 52 65 71 75 65 73 74 AtDpcLevel..▬☺IofCompleteRequest 000005A0 00 00 CC CC CC CC CC CC A7 01 4D 6D 4D 61 70 4C 6F 63 6B 65 64 50 61 67 65 73 00 00 0F 01 49 6F ..╠╠╠╠╠╠º☺MmMapLockedPages..☼☺Io 000005C0 55 6E 72 65 67 69 73 74 65 72 53 68 75 74 64 6F 77 6E 4E 6F 74 69 66 69 63 61 74 69 6F 6E 00 00 UnregisterShutdownNotification.. 000005E0 3E 01 4B 65 49 6E 69 74 69 61 6C 69 7A 65 44 70 63 00 46 01 4B 65 49 6E 69 74 69 61 6C 69 7A 65 >☺KeInitializeDpc.F☺KeInitialize 00000600 54 69 6D 65 72 00 CC CC DF 00 49 6F 46 72 65 65 4D 64 6C 00 27 02 52 74 6C 43 6F 6D 70 61 72 65 Timer.╠╠▀.IoFreeMdl.'☻RtlCompare 00000620 4D 65 6D 6F 72 79 00 00 B5 00 49 6E 74 65 72 6C 6F 63 6B 65 64 49 6E 63 72 65 6D 65 6E 74 00 00 Memory..╡.InterlockedIncrement.. 00000640 B9 00 49 6F 41 6C 6C 6F 63 61 74 65 41 64 61 70 74 65 72 43 68 61 6E 6E 65 6C 00 00 72 01 4B 65 ╣.IoAllocateAdapterChannel..r☺Ke 00000660 53 79 6E 63 68 72 6F 6E 69 7A 65 45 78 65 63 75 74 69 6F 6E 00 00 CC CC 12 01 49 6F 57 72 69 74 SynchronizeExecution..╠╠↕☺IoWrit 00000680 65 45 72 72 6F 72 4C 6F 67 45 6E 74 72 79 00 00 1C 02 52 74 6C 41 70 70 65 6E 64 55 6E 69 63 6F eErrorLogEntry..∟☻RtlAppendUnico 000006A0 64 65 53 74 72 69 6E 67 54 6F 53 74 72 69 6E 67 00 00 CC CC CC CC CC CC 0C 03 5A 77 51 75 65 72 deStringToString..╠╠╠╠╠╠♀♥ZwQuer 000006C0 79 49 6E 66 6F 72 6D 61 74 69 6F 6E 46 69 6C 65 00 00 15 03 5A 77 52 65 61 64 46 69 6C 65 00 00 yInformationFile..§♥ZwReadFile.. 000006E0 F6 02 5A 77 45 6E 75 6D 65 72 61 74 65 4B 65 79 00 00 CC CC 03 03 5A 77 4F 70 65 6E 4B 65 79 00 ÷☻ZwEnumerateKey..╠╠♥♥ZwOpenKey. 00000700 13 03 5A 77 51 75 65 72 79 56 61 6C 75 65 4B 65 79 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC ‼♥ZwQueryValueKey.╠╠╠╠╠╠╠╠╠╠╠╠╠╠ 00000720 E7 00 49 6F 47 65 74 52 65 6C 61 74 65 64 44 65 76 69 63 65 4F 62 6A 65 63 74 00 00 FA 00 49 6F τ.IoGetRelatedDeviceObject..·.Io 00000740 52 65 67 69 73 74 65 72 53 68 75 74 64 6F 77 6E 4E 6F 74 69 66 69 63 61 74 69 6F 6E 00 00 CE 00 RegisterShutdownNotification..╬. 00000760 49 6F 43 72 65 61 74 65 44 65 76 69 63 65 00 00 EA 02 5A 77 43 72 65 61 74 65 46 69 6C 65 00 00 IoCreateDevice..Ω☻ZwCreateFile.. 00000780 F0 01 4F 62 52 65 66 65 72 65 6E 63 65 4F 62 6A 65 63 74 42 79 48 61 6E 64 6C 65 00 E5 02 5A 77 ≡☺ObReferenceObjectByHandle.σ☻Zw 000007A0 43 6C 6F 73 65 00 27 00 45 78 41 63 71 75 69 72 65 52 65 73 6F 75 72 63 65 45 78 63 6C 75 73 69 Close.'.ExAcquireResourceExclusi 000007C0 76 65 4C 69 74 65 00 00 59 00 45 78 52 65 6C 65 61 73 65 52 65 73 6F 75 72 63 65 4C 69 74 65 00 veLite..Y.ExReleaseResourceLite. 000007E0 D9 00 49 6F 44 69 73 63 6F 6E 6E 65 63 74 49 6E 74 65 72 72 75 70 74 00 50 01 4B 65 4E 75 6D 62 ┘.IoDisconnectInterrupt.P☺KeNumb 00000800 65 72 50 72 6F 63 65 73 73 6F 72 73 00 00 6F 01 4B 65 53 65 74 54 61 72 67 65 74 50 72 6F 63 65 erProcessors..o☺KeSetTargetProce 00000820 73 73 6F 72 44 70 63 00 48 41 4C 2E 64 6C 6C 00 54 00 57 52 49 54 45 5F 50 4F 52 54 5F 55 4C 4F ssorDpc.HAL.dll.T.WRITE_PORT_ULO 00000840 4E 47 00 00 4F 00 52 45 41 44 5F 50 4F 52 54 5F 55 53 48 4F 52 54 00 00 55 00 57 52 49 54 45 5F NG..O.READ_PORT_USHORT..U.WRITE_ 00000860 50 4F 52 54 5F 55 53 48 4F 52 54 00 4E 00 52 45 41 44 5F 50 4F 52 54 5F 55 4C 4F 4E 47 00 CC CC PORT_USHORT.N.READ_PORT_ULONG.╠╠ 00000880 15 00 48 61 6C 47 65 74 42 75 73 44 61 74 61 42 79 4F 66 66 73 65 74 00 CC CC CC CC CC CC CC CC §.HalGetBusDataByOffset.╠╠╠╠╠╠╠╠ 000008A0 53 00 57 52 49 54 45 5F 50 4F 52 54 5F 55 43 48 41 52 00 00 CC CC CC CC CC CC CC CC CC CC CC CC S.WRITE_PORT_UCHAR..╠╠╠╠╠╠╠╠╠╠╠╠ 000008C0 25 00 48 61 6C 53 65 74 42 75 73 44 61 74 61 42 79 4F 66 66 73 65 74 00 CC CC CC CC CC CC CC CC %.HalSetBusDataByOffset.╠╠╠╠╠╠╠╠ 000008E0 30 00 49 6F 46 6C 75 73 68 41 64 61 70 74 65 72 42 75 66 66 65 72 73 00 4D 00 52 45 41 44 5F 50 0.IoFlushAdapterBuffers.M.READ_P 00000900 4F 52 54 5F 55 43 48 41 52 00 CC CC CC CC CC CC 33 00 49 6F 4D 61 70 54 72 61 6E 73 66 65 72 00 ORT_UCHAR.╠╠╠╠╠╠3.IoMapTransfer. 00000920 07 00 48 61 6C 41 6C 6C 6F 63 61 74 65 43 6F 6D 6D 6F 6E 42 75 66 66 65 72 00 CC CC CC CC CC CC •.HalAllocateCommonBuffer.╠╠╠╠╠╠ 00000940 14 00 48 61 6C 47 65 74 42 75 73 44 61 74 61 00 12 00 48 61 6C 46 72 65 65 43 6F 6D 6D 6F 6E 42 ¶.HalGetBusData.↕.HalFreeCommonB 00000960 75 66 66 65 72 00 1F 00 48 61 6C 52 65 61 64 44 6D 61 43 6F 75 6E 74 65 72 00 CC CC CC CC CC CC uffer.▼.HalReadDmaCounter.╠╠╠╠╠╠ 00000980 31 00 49 6F 46 72 65 65 41 64 61 70 74 65 72 43 68 61 6E 6E 65 6C 00 00 09 00 48 61 6C 41 73 73 1.IoFreeAdapterChannel..○.HalAss 000009A0 69 67 6E 53 6C 6F 74 52 65 73 6F 75 72 63 65 73 00 00 32 00 49 6F 46 72 65 65 4D 61 70 52 65 67 ignSlotResources..2.IoFreeMapReg 000009C0 69 73 74 65 72 73 00 00 CC CC CC CC CC CC CC CC 17 00 48 61 6C 47 65 74 49 6E 74 65 72 72 75 70 isters..╠╠╠╠╠╠╠╠↨.HalGetInterrup 000009E0 74 56 65 63 74 6F 72 00 13 00 48 61 6C 47 65 74 41 64 61 70 74 65 72 00 47 00 4B 66 4C 6F 77 65 tVector.‼.HalGetAdapter.G.KfLowe 00000A00 72 49 72 71 6C 00 CC CC 2E 00 48 61 6C 54 72 61 6E 73 6C 61 74 65 42 75 73 41 64 64 72 65 73 73 rIrql.╠╠..HalTranslateBusAddress 00000A20 00 00 CC CC CC CC CC CC 48 00 4B 66 52 61 69 73 65 49 72 71 6C 00 49 00 4B 66 52 65 6C 65 61 73 ..╠╠╠╠╠╠H.KfRaiseIrql.I.KfReleas 00000A40 65 53 70 69 6E 4C 6F 63 6B 00 45 00 4B 65 53 74 61 6C 6C 45 78 65 63 75 74 69 6F 6E 50 72 6F 63 eSpinLock.E.KeStallExecutionProc 00000A60 65 73 73 6F 72 00 46 00 4B 66 41 63 71 75 69 72 65 53 70 69 6E 4C 6F 63 6B 00 00 00 00 00 00 00 essor.F.KfAcquireSpinLock.......