Flag: Tornado! Hurricane!

Blogs >> omeg's Blog

Created: Tuesday, January 20 2009 04:26.13 CST  
Printer Friendly ...
Windows 7 syscall list
Author: omeg # Views: 16269

Windows version: 6.1.7000, platform 2,
NtQuerySystemInformation ok, kernel base: 000000008283c000

Loading symbols for C:\Windows\system32\ntoskrnl.exe, please wait...
Real SSDTS address: 00000000829a9940
Loading driver: C:\syscall\MemMap32.sys
MemMap initialized.

Service tables:

Table #0: 828a8a24, 0193 entries, params=828a9074, \SystemRoot\system32\ntoskrnl.exe
0000: 82a3dab3 NtAcceptConnectPort [6] (ntoskrnl.exe)
0001: 828e61b4 NtAccessCheck [8] (ntoskrnl.exe)
0002: 82aad3e2 NtAccessCheckAndAuditAlarm [11] (ntoskrnl.exe)
0003: 82874001 NtAccessCheckByType [11] (ntoskrnl.exe)
0004: 82ab6e36 NtAccessCheckByTypeAndAuditAlarm [16] (ntoskrnl.exe)
0005: 8293a816 NtAccessCheckByTypeResultList [11] (ntoskrnl.exe)
0006: 82b1d2e1 NtAccessCheckByTypeResultListAndAuditAlarm [16] (ntoskrnl.exe)
0007: 82b1d32a NtAccessCheckByTypeResultListAndAuditAlarmByHandle [17] (ntoskrnl.exe)
0008: 82b423c0 NtAcquireCMFViewOwnership [3] (ntoskrnl.exe)
0009: 82a410a7 NtAddAtom [3] (ntoskrnl.exe)
000a: 82b3bd70 NtAddBootEntry [2] (ntoskrnl.exe)
000b: 82b3cfb2 NtAddDriverEntry [2] (ntoskrnl.exe)
000c: 82a20177 NtAdjustGroupsToken [6] (ntoskrnl.exe)
000d: 82aa5b39 NtAdjustPrivilegesToken [6] (ntoskrnl.exe)
000e: 82b0ea1d NtAlertResumeThread [2] (ntoskrnl.exe)
000f: 82ab62ab NtAlertThread [1] (ntoskrnl.exe)
0010: 82a4a8e5 NtAllocateLocallyUniqueId [1] (ntoskrnl.exe)
0011: 82b0d1b0 NtAllocateReserveObject [3] (ntoskrnl.exe)
0012: 82afd586 NtAllocateUserPhysicalPages [3] (ntoskrnl.exe)
0013: 82a24759 NtAllocateUuids [4] (ntoskrnl.exe)
0014: 82a651d8 NtAllocateVirtualMemory [6] (ntoskrnl.exe)
0015: 82aa74eb NtAlpcAcceptConnectPort [9] (ntoskrnl.exe)
0016: 82a393a0 NtAlpcCancelMessage [3] (ntoskrnl.exe)
0017: 82a496c3 NtAlpcConnectPort [11] (ntoskrnl.exe)
0018: 82a3c8a5 NtAlpcCreatePort [3] (ntoskrnl.exe)
0019: 82a25d5a NtAlpcCreatePortSection [6] (ntoskrnl.exe)
001a: 82a38a60 NtAlpcCreateResourceReserve [4] (ntoskrnl.exe)
001b: 82a25b3a NtAlpcCreateSectionView [3] (ntoskrnl.exe)
001c: 82a45430 NtAlpcCreateSecurityContext [3] (ntoskrnl.exe)
001d: 82a25f59 NtAlpcDeletePortSection [3] (ntoskrnl.exe)
001e: 82af81b9 NtAlpcDeleteResourceReserve [3] (ntoskrnl.exe)
001f: 82a8f8b7 NtAlpcDeleteSectionView [3] (ntoskrnl.exe)
0020: 82a45a03 NtAlpcDeleteSecurityContext [3] (ntoskrnl.exe)
0021: 82a8e8c4 NtAlpcDisconnectPort [2] (ntoskrnl.exe)
0022: 82ab6acc NtAlpcImpersonateClientOfPort [3] (ntoskrnl.exe)
0023: 82a498c8 NtAlpcOpenSenderProcess [6] (ntoskrnl.exe)
0024: 82a4d171 NtAlpcOpenSenderThread [6] (ntoskrnl.exe)
0025: 82a3de61 NtAlpcQueryInformation [5] (ntoskrnl.exe)
0026: 82a805dd NtAlpcQueryInformationMessage [6] (ntoskrnl.exe)
0027: 82af82dd NtAlpcRevokeSecurityContext [3] (ntoskrnl.exe)
0028: 82a7ed17 NtAlpcSendWaitReceivePort [8] (ntoskrnl.exe)
0029: 82a3ccd1 NtAlpcSetInformation [4] (ntoskrnl.exe)
002a: 82aac1d6 NtApphelpCacheControl [2] (ntoskrnl.exe)
002b: 82abd010 NtAreMappedFilesTheSame [2] (ntoskrnl.exe)
002c: 82a4e1a4 NtAssignProcessToJobObject [2] (ntoskrnl.exe)
002d: 828a9534 NtCallbackReturn [3] (ntoskrnl.exe)
002e: 82a324df NtCancelIoFile [2] (ntoskrnl.exe)
002f: 82abd160 NtCancelIoFileEx [3] (ntoskrnl.exe)
0030: 82ae2bc8 NtCancelSynchronousIoFile [3] (ntoskrnl.exe)
0031: 8287416e NtCancelTimer [2] (ntoskrnl.exe)
0032: 82a5f692 NtClearEvent [1] (ntoskrnl.exe)
0033: 82a6a462 NtClose [1] (ntoskrnl.exe)
0034: 82ab6d65 NtCloseObjectAuditAlarm [3] (ntoskrnl.exe)
0035: 82b2553f NtCommitComplete [2] (ntoskrnl.exe)
0036: 82b25263 NtCommitEnlistment [2] (ntoskrnl.exe)
0037: 829f9b53 NtCommitTransaction [2] (ntoskrnl.exe)
0038: 82ac431b NtCompactKeys [2] (ntoskrnl.exe)
0039: 82a33ed4 NtCompareTokens [3] (ntoskrnl.exe)
003a: 82a3db30 NtCompleteConnectPort [1] (ntoskrnl.exe)
003b: 82ac4587 NtCompressKey [1] (ntoskrnl.exe)
003c: 82aaab95 NtConnectPort [8] (ntoskrnl.exe)
003d: 828843a4 NtContinue [2] (ntoskrnl.exe)
003e: 82ad870e NtCreateDebugObject [4] (ntoskrnl.exe)
003f: 82a47837 NtCreateDirectoryObject [3] (ntoskrnl.exe)
0040: 829eac08 NtCreateEnlistment [8] (ntoskrnl.exe)
0041: 82a80af5 NtCreateEvent [5] (ntoskrnl.exe)
0042: 82b42d75 NtCreateEventPair [3] (ntoskrnl.exe)
0043: 82a8a7fb NtCreateFile [11] (ntoskrnl.exe)
0044: 82aa7928 NtCreateIoCompletion [4] (ntoskrnl.exe)
0045: 82a1eee7 NtCreateJobObject [3] (ntoskrnl.exe)
0046: 82b108b4 NtCreateJobSet [3] (ntoskrnl.exe)
0047: 82a90caa NtCreateKey [7] (ntoskrnl.exe)
0048: 82a3c327 NtCreateKeyedEvent [4] (ntoskrnl.exe)
0049: 829f82aa NtCreateKeyTransacted [8] (ntoskrnl.exe)
004a: 82a24579 NtCreateMailslotFile [8] (ntoskrnl.exe)
004b: 82aaa1fe NtCreateMutant [4] (ntoskrnl.exe)
004c: 82aaacb0 NtCreateNamedPipeFile [14] (ntoskrnl.exe)
004d: 829c5226 NtCreatePagingFile [4] (ntoskrnl.exe)
004e: 82a0091e NtCreatePort [5] (ntoskrnl.exe)
004f: 82a0e6e0 NtCreatePrivateNamespace [4] (ntoskrnl.exe)
0050: 82b0cc9f NtCreateProcess [8] (ntoskrnl.exe)
0051: 82b0ccea NtCreateProcessEx [9] (ntoskrnl.exe)
0052: 82b43483 NtCreateProfile [9] (ntoskrnl.exe)
0053: 829533a3 NtCreateProfileEx [10] (ntoskrnl.exe)
0054: 829f01f5 NtCreateResourceManager [7] (ntoskrnl.exe)
0055: 82a86632 NtCreateSection [7] (ntoskrnl.exe)
0056: 82aa9697 NtCreateSemaphore [5] (ntoskrnl.exe)
0057: 82a472c4 NtCreateSymbolicLinkObject [4] (ntoskrnl.exe)
0058: 82b0cad2 NtCreateThread [8] (ntoskrnl.exe)
0059: 82ab5afd NtCreateThreadEx [11] (ntoskrnl.exe)
005a: 82a3d982 NtCreateTimer [4] (ntoskrnl.exe)
005b: 82a4b9b0 NtCreateToken [13] (ntoskrnl.exe)
005c: 82a1f700 NtCreateTransaction [10] (ntoskrnl.exe)
005d: 829f2106 NtCreateTransactionManager [6] (ntoskrnl.exe)
005e: 82aa2a70 NtCreateUserProcess [11] (ntoskrnl.exe)
005f: 829f652e NtCreateWaitablePort [5] (ntoskrnl.exe)
0060: 82a3d533 NtCreateWorkerFactory [10] (ntoskrnl.exe)
0061: 82ad95dc NtDebugActiveProcess [2] (ntoskrnl.exe)
0062: 82ad9dd5 NtDebugContinue [3] (ntoskrnl.exe)
0063: 82a4ead0 NtDelayExecution [2] (ntoskrnl.exe)
0064: 82a32d1f NtDeleteAtom [1] (ntoskrnl.exe)
0065: 82b3bda1 NtDeleteBootEntry [1] (ntoskrnl.exe)
0066: 82b3cfe3 NtDeleteDriverEntry [1] (ntoskrnl.exe)
0067: 82ae2ccf NtDeleteFile [1] (ntoskrnl.exe)
0068: 82a35fcc NtDeleteKey [1] (ntoskrnl.exe)
0069: 82abc688 NtDeleteObjectAuditAlarm [3] (ntoskrnl.exe)
006a: 82b03755 NtDeletePrivateNamespace [1] (ntoskrnl.exe)
006b: 82a2c2e0 NtDeleteValueKey [2] (ntoskrnl.exe)
006c: 82a67882 NtDeviceIoControlFile [10] (ntoskrnl.exe)
006d: 82af4ae8 NtDisableLastKnownGood [0] (ntoskrnl.exe)
006e: 829c505c NtDisplayString [1] (ntoskrnl.exe)
006f: 829513ca NtDrawText [1] (ntoskrnl.exe)
0070: 82aa9203 NtDuplicateObject [7] (ntoskrnl.exe)
0071: 82a87f3e NtDuplicateToken [6] (ntoskrnl.exe)
0072: 82af4bc9 NtEnableLastKnownGood [0] (ntoskrnl.exe)
0073: 82b3bfa4 NtEnumerateBootEntries [2] (ntoskrnl.exe)
0074: 82b3d1e2 NtEnumerateDriverEntries [2] (ntoskrnl.exe)
0075: 82a4ebc2 NtEnumerateKey [6] (ntoskrnl.exe)
0076: 82b3bb85 NtEnumerateSystemEnvironmentValuesEx [3] (ntoskrnl.exe)
0077: 82b25e8a NtEnumerateTransactionObject [5] (ntoskrnl.exe)
0078: 82a94722 NtEnumerateValueKey [6] (ntoskrnl.exe)
0079: 82afb665 NtExtendSection [2] (ntoskrnl.exe)
007a: 82a1dc83 NtFilterToken [6] (ntoskrnl.exe)
007b: 82a32be1 NtFindAtom [3] (ntoskrnl.exe)
007c: 82aa0db7 NtFlushBuffersFile [2] (ntoskrnl.exe)
007d: 82a0585e NtFlushInstallUILanguage [2] (ntoskrnl.exe)
007e: 82a307a1 NtFlushInstructionCache [3] (ntoskrnl.exe)
007f: 82a05cdc NtFlushKey [1] (ntoskrnl.exe)
0080: 8285ef64 NtFlushProcessWriteBuffers [0] (ntoskrnl.exe)
0081: 82a2b1b2 NtFlushVirtualMemory [4] (ntoskrnl.exe)
0082: 82afe5f9 NtFlushWriteBuffer [0] (ntoskrnl.exe)
0083: 82afdcbb NtFreeUserPhysicalPages [3] (ntoskrnl.exe)
0084: 828cce77 NtFreeVirtualMemory [4] (ntoskrnl.exe)
0085: 828f84cf NtFreezeRegistry [1] (ntoskrnl.exe)
0086: 82b262da NtFreezeTransactions [2] (ntoskrnl.exe)
0087: 82a80d52 NtFsControlFile [10] (ntoskrnl.exe)
0088: 82abc1e2 NtGetContextThread [2] (ntoskrnl.exe)
0089: 82abcf89 NtGetCurrentProcessorNumber [0] (ntoskrnl.exe)
008a: 82b08bc5 NtGetDevicePowerState [2] (ntoskrnl.exe)
008b: 82aa51dc NtGetMUIRegistryInfo [3] (ntoskrnl.exe)
008c: 82b0eb5c NtGetNextProcess [5] (ntoskrnl.exe)
008d: 82b0edf7 NtGetNextThread [6] (ntoskrnl.exe)
008e: 82a208d5 NtGetNlsSectionPtr [5] (ntoskrnl.exe)
008f: 829f5fa9 NtGetNotificationResourceManager [7] (ntoskrnl.exe)
0090: 82a1393d NtGetPlugPlayEvent [4] (ntoskrnl.exe)
0091: 829218c2 NtGetWriteWatch [7] (ntoskrnl.exe)
0092: 82a3dc97 NtImpersonateAnonymousToken [1] (ntoskrnl.exe)
0093: 82a4aea8 NtImpersonateClientOfPort [2] (ntoskrnl.exe)
0094: 82aac02d NtImpersonateThread [3] (ntoskrnl.exe)
0095: 82aa4fc3 NtInitializeNlsFiles [3] (ntoskrnl.exe)
0096: 829c7088 NtInitializeRegistry [1] (ntoskrnl.exe)
0097: 82b089bf NtInitiatePowerAction [4] (ntoskrnl.exe)
0098: 82a39635 NtIsProcessInJob [2] (ntoskrnl.exe)
0099: 82b08bab NtIsSystemResumeAutomatic [0] (ntoskrnl.exe)
009a: 82a03d91 NtIsUILanguageComitted [0] (ntoskrnl.exe)
009b: 829d3cdb NtListenPort [2] (ntoskrnl.exe)
009c: 829e466e NtLoadDriver [1] (ntoskrnl.exe)
009d: 829ebc41 NtLoadKey [2] (ntoskrnl.exe)
009e: 829c94e9 NtLoadKey2 [3] (ntoskrnl.exe)
009f: 829f4281 NtLoadKeyEx [8] (ntoskrnl.exe)
00a0: 82a24124 NtLockFile [10] (ntoskrnl.exe)
00a1: 829b950f NtLockProductActivationKeys [2] (ntoskrnl.exe)
00a2: 829b51f7 NtLockRegistryKey [1] (ntoskrnl.exe)
00a3: 82873970 NtLockVirtualMemory [4] (ntoskrnl.exe)
00a4: 82a4e508 NtMakePermanentObject [1] (ntoskrnl.exe)
00a5: 82a490eb NtMakeTemporaryObject [1] (ntoskrnl.exe)
00a6: 82aa198d NtMapCMFModule [6] (ntoskrnl.exe)
00a7: 82afca13 NtMapUserPhysicalPages [3] (ntoskrnl.exe)
00a8: 82afcf0c NtMapUserPhysicalPagesScatter [3] (ntoskrnl.exe)
00a9: 82a86382 NtMapViewOfSection [10] (ntoskrnl.exe)
00aa: 82b3bf73 NtModifyBootEntry [1] (ntoskrnl.exe)
00ab: 82b3d1b3 NtModifyDriverEntry [1] (ntoskrnl.exe)
00ac: 82a2d30e NtNotifyChangeDirectoryFile [9] (ntoskrnl.exe)
00ad: 82a95816 NtNotifyChangeKey [10] (ntoskrnl.exe)
00ae: 82a94d7a NtNotifyChangeMultipleKeys [12] (ntoskrnl.exe)
00af: 82ae2e48 NtNotifyChangeSession [6] (ntoskrnl.exe)
00b0: 82aa235b NtOpenDirectoryObject [3] (ntoskrnl.exe)
00b1: 82b24ace NtOpenEnlistment [5] (ntoskrnl.exe)
00b2: 82a3ba25 NtOpenEvent [3] (ntoskrnl.exe)
00b3: 82b42e8f NtOpenEventPair [3] (ntoskrnl.exe)
00b4: 82a85174 NtOpenFile [6] (ntoskrnl.exe)
00b5: 82ae28c3 NtOpenIoCompletion [3] (ntoskrnl.exe)
00b6: 82b1045f NtOpenJobObject [3] (ntoskrnl.exe)
00b7: 82a6c754 NtOpenKey [3] (ntoskrnl.exe)
00b8: 82ac253c NtOpenKeyEx [4] (ntoskrnl.exe)
00b9: 82b431c7 NtOpenKeyedEvent [3] (ntoskrnl.exe)
00ba: 829f823b NtOpenKeyTransacted [4] (ntoskrnl.exe)
00bb: 82ac2569 NtOpenKeyTransactedEx [5] (ntoskrnl.exe)
00bc: 82a38ccb NtOpenMutant [3] (ntoskrnl.exe)
00bd: 82a0ef70 NtOpenObjectAuditAlarm [12] (ntoskrnl.exe)
00be: 82abdce4 NtOpenPrivateNamespace [4] (ntoskrnl.exe)
00bf: 82aa9551 NtOpenProcess [4] (ntoskrnl.exe)
00c0: 82aa5686 NtOpenProcessToken [3] (ntoskrnl.exe)
00c1: 82a76615 NtOpenProcessTokenEx [4] (ntoskrnl.exe)
00c2: 829ea005 NtOpenResourceManager [5] (ntoskrnl.exe)
00c3: 82a962c3 NtOpenSection [3] (ntoskrnl.exe)
00c4: 82a1f139 NtOpenSemaphore [3] (ntoskrnl.exe)
00c5: 82a2a378 NtOpenSession [3] (ntoskrnl.exe)
00c6: 82a9244d NtOpenSymbolicLinkObject [3] (ntoskrnl.exe)
00c7: 82a81788 NtOpenThread [4] (ntoskrnl.exe)
00c8: 82aa8271 NtOpenThreadToken [4] (ntoskrnl.exe)
00c9: 82a78cfe NtOpenThreadTokenEx [5] (ntoskrnl.exe)
00ca: 82b42b1d NtOpenTimer [3] (ntoskrnl.exe)
00cb: 829c896b NtOpenTransaction [5] (ntoskrnl.exe)
00cc: 829e975c NtOpenTransactionManager [6] (ntoskrnl.exe)
00cd: 82a4d576 NtPlugPlayControl [3] (ntoskrnl.exe)
00ce: 82a3fe55 NtPowerInformation [5] (ntoskrnl.exe)
00cf: 82b253d1 NtPrepareComplete [2] (ntoskrnl.exe)
00d0: 82b250f5 NtPrepareEnlistment [2] (ntoskrnl.exe)
00d1: 82b25488 NtPrePrepareComplete [2] (ntoskrnl.exe)
00d2: 82b251ac NtPrePrepareEnlistment [2] (ntoskrnl.exe)
00d3: 82a33b46 NtPrivilegeCheck [3] (ntoskrnl.exe)
00d4: 82a2cd2c NtPrivilegedServiceAuditAlarm [5] (ntoskrnl.exe)
00d5: 82a0b67d NtPrivilegeObjectAuditAlarm [6] (ntoskrnl.exe)
00d6: 82b28ef6 NtPropagationComplete [4] (ntoskrnl.exe)
00d7: 82b28fbe NtPropagationFailed [3] (ntoskrnl.exe)
00d8: 82a7a700 NtProtectVirtualMemory [5] (ntoskrnl.exe)
00d9: 82abfaf0 NtPulseEvent [2] (ntoskrnl.exe)
00da: 82a8b9e3 NtQueryAttributesFile [2] (ntoskrnl.exe)
00db: 82b3c441 NtQueryBootEntryOrder [2] (ntoskrnl.exe)
00dc: 82b3c87f NtQueryBootOptions [2] (ntoskrnl.exe)
00dd: 828ea67a NtQueryDebugFilterState [2] (ntoskrnl.exe)
00de: 82aa2475 NtQueryDefaultLocale [2] (ntoskrnl.exe)
00df: 82a02d66 NtQueryDefaultUILanguage [1] (ntoskrnl.exe)
00e0: 82a9bc09 NtQueryDirectoryFile [11] (ntoskrnl.exe)
00e1: 82ab1641 NtQueryDirectoryObject [7] (ntoskrnl.exe)
00e2: 82b3cd77 NtQueryDriverEntryOrder [2] (ntoskrnl.exe)
00e3: 829d21f0 NtQueryEaFile [9] (ntoskrnl.exe)
00e4: 82a32acf NtQueryEvent [5] (ntoskrnl.exe)
00e5: 82a3d79a NtQueryFullAttributesFile [2] (ntoskrnl.exe)
00e6: 82a32d47 NtQueryInformationAtom [5] (ntoskrnl.exe)
00e7: 82b24cda NtQueryInformationEnlistment [5] (ntoskrnl.exe)
00e8: 82a89c88 NtQueryInformationFile [5] (ntoskrnl.exe)
00e9: 829f6591 NtQueryInformationJobObject [5] (ntoskrnl.exe)
00ea: 82af71b0 NtQueryInformationPort [5] (ntoskrnl.exe)
00eb: 82a5f6e0 NtQueryInformationProcess [5] (ntoskrnl.exe)
00ec: 82b2643a NtQueryInformationResourceManager [5] (ntoskrnl.exe)
00ed: 82a63441 NtQueryInformationThread [5] (ntoskrnl.exe)
00ee: 82a7672c NtQueryInformationToken [5] (ntoskrnl.exe)
00ef: 82b25820 NtQueryInformationTransaction [5] (ntoskrnl.exe)
00f0: 829e9b0d NtQueryInformationTransactionManager [5] (ntoskrnl.exe)
00f1: 8295274b NtQueryInformationWorkerFactory [5] (ntoskrnl.exe)
00f2: 82a03d20 NtQueryInstallUILanguage [1] (ntoskrnl.exe)
00f3: 82b437e3 NtQueryIntervalProfile [2] (ntoskrnl.exe)
00f4: 82ae2986 NtQueryIoCompletion [5] (ntoskrnl.exe)
00f5: 82a92d2f NtQueryKey [5] (ntoskrnl.exe)
00f6: 82a9718b NtQueryLicenseValue [5] (ntoskrnl.exe)
00f7: 82ac3b05 NtQueryMultipleValueKey [6] (ntoskrnl.exe)
00f8: 82b432a2 NtQueryMutant [5] (ntoskrnl.exe)
00f9: 82a4fd18 NtQueryObject [5] (ntoskrnl.exe)
00fa: 82ac3db7 NtQueryOpenSubKeys [2] (ntoskrnl.exe)
00fb: 82abbbb4 NtQueryOpenSubKeysEx [4] (ntoskrnl.exe)
00fc: 82a678b5 NtQueryPerformanceCounter [2] (ntoskrnl.exe)
00fd: 82b0d164 NtQueryPortInformationProcess [0] (ntoskrnl.exe)
00fe: 82ae420f NtQueryQuotaInformationFile [9] (ntoskrnl.exe)
00ff: 82aa7804 NtQuerySection [5] (ntoskrnl.exe)
0100: 82b1abf9 NtQuerySecurityAttributesToken [6] (ntoskrnl.exe)
0101: 82aa0887 NtQuerySecurityObject [5] (ntoskrnl.exe)
0102: 82b3ae0a NtQuerySemaphore [5] (ntoskrnl.exe)
0103: 82a9b47b NtQuerySymbolicLinkObject [3] (ntoskrnl.exe)
0104: 82b3afe7 NtQuerySystemEnvironmentValue [4] (ntoskrnl.exe)
0105: 82b3b5d7 NtQuerySystemEnvironmentValueEx [5] (ntoskrnl.exe)
0106: 82a5e896 NtQuerySystemInformation [4] (ntoskrnl.exe)
0107: 82b35275 NtQuerySystemInformationEx [6] (ntoskrnl.exe)
0108: 82aa9798 NtQuerySystemTime [1] (ntoskrnl.exe)
0109: 82b42bdc NtQueryTimer [5] (ntoskrnl.exe)
010a: 82a2cf7d NtQueryTimerResolution [3] (ntoskrnl.exe)
010b: 82a6eca8 NtQueryValueKey [6] (ntoskrnl.exe)
010c: 82a8aa63 NtQueryVirtualMemory [6] (ntoskrnl.exe)
010d: 82a9f1c4 NtQueryVolumeInformationFile [5] (ntoskrnl.exe)
010e: 82a38c8f NtQueueApcThread [5] (ntoskrnl.exe)
010f: 82a38b7d NtQueueApcThreadEx [6] (ntoskrnl.exe)
0110: 828843ec NtRaiseException [3] (ntoskrnl.exe)
0111: 82abc95e NtRaiseHardError [6] (ntoskrnl.exe)
0112: 82a9e853 NtReadFile [9] (ntoskrnl.exe)
0113: 829ebe31 NtReadFileScatter [9] (ntoskrnl.exe)
0114: 82b256ab NtReadOnlyEnlistment [2] (ntoskrnl.exe)
0115: 82af7295 NtReadRequestData [6] (ntoskrnl.exe)
0116: 82aa9587 NtReadVirtualMemory [5] (ntoskrnl.exe)
0117: 82b24c80 NtRecoverEnlistment [2] (ntoskrnl.exe)
0118: 829f3577 NtRecoverResourceManager [1] (ntoskrnl.exe)
0119: 829f22fa NtRecoverTransactionManager [1] (ntoskrnl.exe)
011a: 82b28d4a NtRegisterProtocolAddressInformation [5] (ntoskrnl.exe)
011b: 82b0e136 NtRegisterThreadTerminatePort [1] (ntoskrnl.exe)
011c: 82b42573 NtReleaseCMFViewOwnership [0] (ntoskrnl.exe)
011d: 82ab62fc NtReleaseKeyedEvent [4] (ntoskrnl.exe)
011e: 82aaf372 NtReleaseMutant [2] (ntoskrnl.exe)
011f: 82aad983 NtReleaseSemaphore [3] (ntoskrnl.exe)
0120: 828afb01 NtReleaseWorkerFactoryWorker [1] (ntoskrnl.exe)
0121: 82a5f512 NtRemoveIoCompletion [5] (ntoskrnl.exe)
0122: 82a456cb NtRemoveIoCompletionEx [6] (ntoskrnl.exe)
0123: 82ad9727 NtRemoveProcessDebug [2] (ntoskrnl.exe)
0124: 82ac401c NtRenameKey [2] (ntoskrnl.exe)
0125: 82b2665b NtRenameTransactionManager [2] (ntoskrnl.exe)
0126: 82ac38b4 NtReplaceKey [3] (ntoskrnl.exe)
0127: 829046db NtReplacePartitionUnit [3] (ntoskrnl.exe)
0128: 82a4ada8 NtReplyPort [2] (ntoskrnl.exe)
0129: 82a67861 NtReplyWaitReceivePort [4] (ntoskrnl.exe)
012a: 82a673e3 NtReplyWaitReceivePortEx [5] (ntoskrnl.exe)
012b: 82af7463 NtReplyWaitReplyPort [2] (ntoskrnl.exe)
012c: 82a45608 NtRequestPort [2] (ntoskrnl.exe)
012d: 82aa8987 NtRequestWaitReplyPort [3] (ntoskrnl.exe)
012e: 82a2c607 NtResetEvent [2] (ntoskrnl.exe)
012f: 82921f0d NtResetWriteWatch [3] (ntoskrnl.exe)
0130: 82ac25ed NtRestoreKey [3] (ntoskrnl.exe)
0131: 82b0e9b7 NtResumeProcess [1] (ntoskrnl.exe)
0132: 82a7d4d9 NtResumeThread [2] (ntoskrnl.exe)
0133: 82b25760 NtRollbackComplete [2] (ntoskrnl.exe)
0134: 82b2531a NtRollbackEnlistment [2] (ntoskrnl.exe)
0135: 82aba841 NtRollbackTransaction [2] (ntoskrnl.exe)
0136: 82b267bc NtRollforwardTransactionManager [2] (ntoskrnl.exe)
0137: 82ac27f0 NtSaveKey [2] (ntoskrnl.exe)
0138: 82ac29cf NtSaveKeyEx [3] (ntoskrnl.exe)
0139: 82ac2bdd NtSaveMergedKeys [3] (ntoskrnl.exe)
013a: 82aaa59e NtSecureConnectPort [9] (ntoskrnl.exe)
013b: 82af4a99 NtSerializeBoot [0] (ntoskrnl.exe)
013c: 82b3c67c NtSetBootEntryOrder [2] (ntoskrnl.exe)
013d: 82b3cb62 NtSetBootOptions [2] (ntoskrnl.exe)
013e: 82b0dd07 NtSetContextThread [2] (ntoskrnl.exe)
013f: 829b2798 NtSetDebugFilterState [3] (ntoskrnl.exe)
0140: 829d0928 NtSetDefaultHardErrorPort [1] (ntoskrnl.exe)
0141: 82a02a4a NtSetDefaultLocale [2] (ntoskrnl.exe)
0142: 82a0305a NtSetDefaultUILanguage [1] (ntoskrnl.exe)
0143: 82b3d5df NtSetDriverEntryOrder [2] (ntoskrnl.exe)
0144: 82ae3c97 NtSetEaFile [4] (ntoskrnl.exe)
0145: 82a5ee75 NtSetEvent [2] (ntoskrnl.exe)
0146: 82b3a513 NtSetEventBoostPriority [1] (ntoskrnl.exe)
0147: 82b4315b NtSetHighEventPair [1] (ntoskrnl.exe)
0148: 82b4308d NtSetHighWaitLowEventPair [1] (ntoskrnl.exe)
0149: 82ad9f94 NtSetInformationDebugObject [5] (ntoskrnl.exe)
014a: 82b24f1f NtSetInformationEnlistment [4] (ntoskrnl.exe)
014b: 82a9fb9c NtSetInformationFile [5] (ntoskrnl.exe)
014c: 82a1defd NtSetInformationJobObject [4] (ntoskrnl.exe)
014d: 82ac33c9 NtSetInformationKey [4] (ntoskrnl.exe)
014e: 82ab1aa2 NtSetInformationObject [4] (ntoskrnl.exe)
014f: 82a7a881 NtSetInformationProcess [4] (ntoskrnl.exe)
0150: 829ea363 NtSetInformationResourceManager [4] (ntoskrnl.exe)
0151: 82a7558f NtSetInformationThread [4] (ntoskrnl.exe)
0152: 82aae175 NtSetInformationToken [4] (ntoskrnl.exe)
0153: 82b26086 NtSetInformationTransaction [4] (ntoskrnl.exe)
0154: 82b2687e NtSetInformationTransactionManager [4] (ntoskrnl.exe)
0155: 8286accc NtSetInformationWorkerFactory [4] (ntoskrnl.exe)
0156: 82b437c0 NtSetIntervalProfile [2] (ntoskrnl.exe)
0157: 82a4ea47 NtSetIoCompletion [5] (ntoskrnl.exe)
0158: 82ae2aac NtSetIoCompletionEx [6] (ntoskrnl.exe)
0159: 82b1011f NtSetLdtEntries [6] (ntoskrnl.exe)
015a: 82b430f8 NtSetLowEventPair [1] (ntoskrnl.exe)
015b: 82b43022 NtSetLowWaitHighEventPair [1] (ntoskrnl.exe)
015c: 82ae482f NtSetQuotaInformationFile [4] (ntoskrnl.exe)
015d: 82a466e0 NtSetSecurityObject [3] (ntoskrnl.exe)
015e: 82b3b2df NtSetSystemEnvironmentValue [2] (ntoskrnl.exe)
015f: 82b3b8eb NtSetSystemEnvironmentValueEx [5] (ntoskrnl.exe)
0160: 82a2ef62 NtSetSystemInformation [3] (ntoskrnl.exe)
0161: 82b6164b NtSetSystemPowerState [3] (ntoskrnl.exe)
0162: 82b347c6 NtSetSystemTime [2] (ntoskrnl.exe)
0163: 82a2142f NtSetThreadExecutionState [2] (ntoskrnl.exe)
0164: 828abd01 NtSetTimer [7] (ntoskrnl.exe)
0165: 82952ec3 NtSetTimerEx [4] (ntoskrnl.exe)
0166: 82a31e59 NtSetTimerResolution [3] (ntoskrnl.exe)
0167: 829d3094 NtSetUuidSeed [1] (ntoskrnl.exe)
0168: 82a3a450 NtSetValueKey [6] (ntoskrnl.exe)
0169: 82ae4849 NtSetVolumeInformationFile [5] (ntoskrnl.exe)
016a: 82b39a39 NtShutdownSystem [1] (ntoskrnl.exe)
016b: 82a20008 NtShutdownWorkerFactory [2] (ntoskrnl.exe)
016c: 828eed7f NtSignalAndWaitForSingleObject [4] (ntoskrnl.exe)
016d: 82b255f6 NtSinglePhaseReject [2] (ntoskrnl.exe)
016e: 82b434fb NtStartProfile [1] (ntoskrnl.exe)
016f: 82b436f3 NtStopProfile [1] (ntoskrnl.exe)
0170: 82b0e957 NtSuspendProcess [1] (ntoskrnl.exe)
0171: 82abcd8e NtSuspendThread [2] (ntoskrnl.exe)
0172: 82a215ca NtSystemDebugControl [6] (ntoskrnl.exe)
0173: 82a4e7d4 NtTerminateJobObject [2] (ntoskrnl.exe)
0174: 82a8c9b4 NtTerminateProcess [2] (ntoskrnl.exe)
0175: 82a8049b NtTerminateThread [2] (ntoskrnl.exe)
0176: 82a7e218 NtTestAlert [0] (ntoskrnl.exe)
0177: 828f8533 NtThawRegistry [0] (ntoskrnl.exe)
0178: 82b263b7 NtThawTransactions [0] (ntoskrnl.exe)
0179: 82a96acb NtTraceControl [6] (ntoskrnl.exe)
017a: 828cfa9f NtTraceEvent [4] (ntoskrnl.exe)
017b: 82b3d7e3 NtTranslateFilePath [4] (ntoskrnl.exe)
017c: 82af7153 NtUmsThreadYield [1] (ntoskrnl.exe)
017d: 82ae5048 NtUnloadDriver [1] (ntoskrnl.exe)
017e: 829fdcbb NtUnloadKey [1] (ntoskrnl.exe)
017f: 829fdcd5 NtUnloadKey2 [2] (ntoskrnl.exe)
0180: 82ac2d77 NtUnloadKeyEx [2] (ntoskrnl.exe)
0181: 82a24efa NtUnlockFile [5] (ntoskrnl.exe)
0182: 8286847b NtUnlockVirtualMemory [4] (ntoskrnl.exe)
0183: 82a85fc1 NtUnmapViewOfSection [2] (ntoskrnl.exe)
0184: 82b2a0db NtVdmControl [2] (ntoskrnl.exe)
0185: 82ad9abf NtWaitForDebugEvent [4] (ntoskrnl.exe)
0186: 82ab5761 NtWaitForKeyedEvent [4] (ntoskrnl.exe)
0187: 82a5ef3e NtWaitForMultipleObjects [5] (ntoskrnl.exe)
0188: 82b00e15 NtWaitForMultipleObjects32 [5] (ntoskrnl.exe)
0189: 82a5e782 NtWaitForSingleObject [3] (ntoskrnl.exe)
018a: 828af61d NtWaitForWorkViaWorkerFactory [2] (ntoskrnl.exe)
018b: 82b42fb9 NtWaitHighEventPair [1] (ntoskrnl.exe)
018c: 82b42f50 NtWaitLowEventPair [1] (ntoskrnl.exe)
018d: 8286fdc6 NtWorkerFactoryWorkerReady [1] (ntoskrnl.exe)
018e: 82a644f4 NtWriteFile [9] (ntoskrnl.exe)
018f: 82a2349b NtWriteFileGather [9] (ntoskrnl.exe)
0190: 82af7302 NtWriteRequestData [6] (ntoskrnl.exe)
0191: 82aa8161 NtWriteVirtualMemory [5] (ntoskrnl.exe)
0192: 82870989 NtYieldExecution [0] (ntoskrnl.exe)

Table #1: 99ee0000, 033b entries, params=99ee1034, \SystemRoot\System32\win32k.sys
1000: 99e6af8c NtGdiAbortDoc [1] (win32k.sys)
1001: 99e84d88 NtGdiAbortPath [1] (win32k.sys)
1002: 99d6ef41 NtGdiAddFontResourceW [6] (win32k.sys)
1003: 99e79670 NtGdiAddRemoteFontToDC [4] (win32k.sys)
1004: 99e864cf NtGdiAddFontMemResourceEx [5] (win32k.sys)
1005: 99e6b6bb NtGdiRemoveMergeFont [2] (win32k.sys)
1006: 99e6b74f NtGdiAddRemoteMMInstanceToDC [3] (win32k.sys)
1007: 99db20b2 NtGdiAlphaBlend [12] (win32k.sys)
1008: 99e85cea NtGdiAngleArc [6] (win32k.sys)
1009: 99d5fb92 NtGdiAnyLinkedFonts [0] (win32k.sys)
100a: 99d5ef8c NtGdiFontIsLinked [1] (win32k.sys)
100b: 99e88013 NtGdiArcInternal [10] (win32k.sys)
100c: 99e861db NtGdiBeginGdiRendering [2] (win32k.sys)
100d: 99e84dfc NtGdiBeginPath [1] (win32k.sys)
100e: 99dc0ce7 NtGdiBitBlt [11] (win32k.sys)
100f: 99e8612e NtGdiCancelDC [1] (win32k.sys)
1010: 99e88daf NtGdiCheckBitmapBits [8] (win32k.sys)
1011: 99e84d03 NtGdiCloseFigure [1] (win32k.sys)
1012: 99dc767f NtGdiClearBitmapAttributes [2] (win32k.sys)
1013: 99e86265 NtGdiClearBrushAttributes [2] (win32k.sys)
1014: 99e887a6 NtGdiColorCorrectPalette [6] (win32k.sys)
1015: 99d618e8 NtGdiCombineRgn [4] (win32k.sys)
1016: 99dfcf11 NtGdiCombineTransform [3] (win32k.sys)
1017: 99e15eb6 NtGdiComputeXformCoefficients [1] (win32k.sys)
1018: 99e8979b NtGdiConfigureOPMProtectedOutput [4] (win32k.sys)
1019: 99e7cf26 NtGdiConvertMetafileRect [2] (win32k.sys)
101a: 99d87c81 NtGdiCreateBitmap [5] (win32k.sys)
101b: 99e861cb NtGdiCreateBitmapFromDxSurface [5] (win32k.sys)
101c: 99e11208 NtGdiCreateClientObj [1] (win32k.sys)
101d: 99e88668 NtGdiCreateColorSpace [1] (win32k.sys)
101e: 99e88a31 NtGdiCreateColorTransform [8] (win32k.sys)
101f: 99d7644f NtGdiCreateCompatibleBitmap [3] (win32k.sys)
1020: 99da7d46 NtGdiCreateCompatibleDC [1] (win32k.sys)
1021: 99dfcbb6 NtGdiCreateDIBBrush [6] (win32k.sys)
1022: 99d76bc6 NtGdiCreateDIBitmapInternal [11] (win32k.sys)
1023: 99db12f7 NtGdiCreateDIBSection [9] (win32k.sys)
1024: 99e71133 NtGdiCreateEllipticRgn [4] (win32k.sys)
1025: 99d21370 NtGdiCreateHalftonePalette [1] (win32k.sys)
1026: 99e89bd7 NtGdiCreateHatchBrushInternal [3] (win32k.sys)
1027: 99dee42f NtGdiCreateMetafileDC [1] (win32k.sys)
1028: 99dd7cd5 NtGdiCreateOPMProtectedOutputs [5] (win32k.sys)
1029: 99d5281b NtGdiCreatePaletteInternal [2] (win32k.sys)
102a: 99d5d6b8 NtGdiCreatePatternBrushInternal [3] (win32k.sys)
102b: 99d2c7d0 NtGdiCreatePen [4] (win32k.sys)
102c: 99d71fb6 NtGdiCreateRectRgn [4] (win32k.sys)
102d: 99d67898 NtGdiCreateRoundRectRgn [6] (win32k.sys)
102e: 99e8a643 NtGdiCreateServerMetaFile [6] (win32k.sys)
102f: 99d8851d NtGdiCreateSolidBrush [2] (win32k.sys)
1030: 99e651c2 NtGdiD3dContextCreate [4] (win32k.sys)
1031: 99e651d5 NtGdiD3dContextDestroy [1] (win32k.sys)
1032: 99e651e8 NtGdiD3dContextDestroyAll [1] (win32k.sys)
1033: 99e651fb NtGdiD3dValidateTextureStageState [1] (win32k.sys)
1034: 99e6520e NtGdiD3dDrawPrimitives2 [7] (win32k.sys)
1035: 99e65221 NtGdiDdGetDriverState [1] (win32k.sys)
1036: 99e64ea6 NtGdiDdAddAttachedSurface [3] (win32k.sys)
1037: 99e65323 NtGdiDdAlphaBlt [3] (win32k.sys)
1038: 99e64eb9 NtGdiDdAttachSurface [2] (win32k.sys)
1039: 99e652ce NtGdiDdBeginMoCompFrame [2] (win32k.sys)
103a: 99e64ecc NtGdiDdBlt [3] (win32k.sys)
103b: 99e64edf NtGdiDdCanCreateSurface [2] (win32k.sys)
103c: 99e65199 NtGdiDdCanCreateD3DBuffer [2] (win32k.sys)
103d: 99e64ef2 NtGdiDdColorControl [2] (win32k.sys)
103e: 99df46be NtGdiDdCreateDirectDrawObject [1] (win32k.sys)
103f: 99e64f05 NtGdiDdCreateSurface [8] (win32k.sys)
1040: 99e65183 NtGdiDdCreateD3DBuffer [8] (win32k.sys)
1041: 99e652a2 NtGdiDdCreateMoComp [2] (win32k.sys)
1042: 99e64f1b NtGdiDdCreateSurfaceObject [6] (win32k.sys)
1043: 99e64f47 NtGdiDdDeleteDirectDrawObject [1] (win32k.sys)
1044: 99e64f31 NtGdiDdDeleteSurfaceObject [1] (win32k.sys)
1045: 99e652b8 NtGdiDdDestroyMoComp [2] (win32k.sys)
1046: 99e64f5d NtGdiDdDestroySurface [2] (win32k.sys)
1047: 99e651ac NtGdiDdDestroyD3DBuffer [1] (win32k.sys)
1048: 99e652e1 NtGdiDdEndMoCompFrame [2] (win32k.sys)
1049: 99e64f73 NtGdiDdFlip [5] (win32k.sys)
104a: 99e65023 NtGdiDdFlipToGDISurface [2] (win32k.sys)
104b: 99e64f89 NtGdiDdGetAvailDriverMemory [2] (win32k.sys)
104c: 99e64f9f NtGdiDdGetBltStatus [2] (win32k.sys)
104d: 99e64fb5 NtGdiDdGetDC [2] (win32k.sys)
104e: 99e64fcb NtGdiDdGetDriverInfo [2] (win32k.sys)
104f: 99e6512b NtGdiDdGetDxHandle [3] (win32k.sys)
1050: 99e64fe1 NtGdiDdGetFlipStatus [2] (win32k.sys)
1051: 99e6528c NtGdiDdGetInternalMoCompInfo [2] (win32k.sys)
1052: 99e65276 NtGdiDdGetMoCompBuffInfo [2] (win32k.sys)
1053: 99e6524a NtGdiDdGetMoCompGuids [2] (win32k.sys)
1054: 99e65260 NtGdiDdGetMoCompFormats [2] (win32k.sys)
1055: 99e64ff7 NtGdiDdGetScanLine [2] (win32k.sys)
1056: 99e65039 NtGdiDdLock [3] (win32k.sys)
1057: 99e65157 NtGdiDdLockD3D [2] (win32k.sys)
1058: 99e6504f NtGdiDdQueryDirectDrawObject [11] (win32k.sys)
1059: 99e6530d NtGdiDdQueryMoCompStatus [2] (win32k.sys)
105a: 99e65065 NtGdiDdReenableDirectDrawObject [2] (win32k.sys)
105b: 99e6507b NtGdiDdReleaseDC [1] (win32k.sys)
105c: 99e652f7 NtGdiDdRenderMoComp [2] (win32k.sys)
105d: 99e65091 NtGdiDdResetVisrgn [2] (win32k.sys)
105e: 99e650a7 NtGdiDdSetColorKey [2] (win32k.sys)
105f: 99e6500d NtGdiDdSetExclusiveMode [2] (win32k.sys)
1060: 99e65141 NtGdiDdSetGammaRamp [3] (win32k.sys)
1061: 99e65234 NtGdiDdCreateSurfaceEx [3] (win32k.sys)
1062: 99e650bd NtGdiDdSetOverlayPosition [3] (win32k.sys)
1063: 99e650d3 NtGdiDdUnattachSurface [2] (win32k.sys)
1064: 99e650e9 NtGdiDdUnlock [2] (win32k.sys)
1065: 99e6516d NtGdiDdUnlockD3D [2] (win32k.sys)
1066: 99e650ff NtGdiDdUpdateOverlay [3] (win32k.sys)
1067: 99e65115 NtGdiDdWaitForVerticalBlank [2] (win32k.sys)
1068: 99e65336 NtGdiDvpCanCreateVideoPort [2] (win32k.sys)
1069: 99e6534c NtGdiDvpColorControl [2] (win32k.sys)
106a: 99e65362 NtGdiDvpCreateVideoPort [2] (win32k.sys)
106b: 99e65378 NtGdiDvpDestroyVideoPort [2] (win32k.sys)
106c: 99e6538e NtGdiDvpFlipVideoPort [4] (win32k.sys)
106d: 99e653a4 NtGdiDvpGetVideoPortBandwidth [2] (win32k.sys)
106e: 99e653ba NtGdiDvpGetVideoPortField [2] (win32k.sys)
106f: 99e653d0 NtGdiDvpGetVideoPortFlipStatus [2] (win32k.sys)
1070: 99e653e6 NtGdiDvpGetVideoPortInputFormats [2] (win32k.sys)
1071: 99e653fc NtGdiDvpGetVideoPortLine [2] (win32k.sys)
1072: 99e65412 NtGdiDvpGetVideoPortOutputFormats [2] (win32k.sys)
1073: 99e65428 NtGdiDvpGetVideoPortConnectInfo [2] (win32k.sys)
1074: 99e6543e NtGdiDvpGetVideoSignalStatus [2] (win32k.sys)
1075: 99e65454 NtGdiDvpUpdateVideoPort [4] (win32k.sys)
1076: 99e6546a NtGdiDvpWaitForVideoPortSync [2] (win32k.sys)
1077: 99e65480 NtGdiDvpAcquireNotification [3] (win32k.sys)
1078: 99e65496 NtGdiDvpReleaseNotification [2] (win32k.sys)
1079: 99e64e93 NtGdiDxgGenericThunk [6] (win32k.sys)
107a: 99e11968 NtGdiDeleteClientObj [1] (win32k.sys)
107b: 99e88638 NtGdiDeleteColorSpace [1] (win32k.sys)
107c: 99e88ccb NtGdiDeleteColorTransform [2] (win32k.sys)
107d: 99da7d56 NtGdiDeleteObjectApp [1] (win32k.sys)
107e: 99e87079 NtGdiDescribePixelFormat [4] (win32k.sys)
107f: 99dd809e NtGdiDestroyOPMProtectedOutput [1] (win32k.sys)
1080: 99e6b387 NtGdiGetPerBandInfo [2] (win32k.sys)
1081: 99e6b262 NtGdiDoBanding [4] (win32k.sys)
1082: 99d7c618 NtGdiDoPalette [6] (win32k.sys)
1083: 99e85d34 NtGdiDrawEscape [4] (win32k.sys)
1084: 99e8b0c3 NtGdiEllipse [5] (win32k.sys)
1085: 99ce56ed NtGdiEnableEudc [1] (win32k.sys)
1086: 99e6af74 NtGdiEndDoc [1] (win32k.sys)
1087: 99e861eb NtGdiEndGdiRendering [3] (win32k.sys)
1088: 99e6b064 NtGdiEndPage [1] (win32k.sys)
1089: 99e84eae NtGdiEndPath [1] (win32k.sys)
108a: 99d729f9 NtGdiEnumFonts [8] (win32k.sys)
108b: 99e8d01e NtGdiEnumObjects [4] (win32k.sys)
108c: 99e192a2 NtGdiEqualRgn [2] (win32k.sys)
108d: 99e8cdd3 NtGdiEudcLoadUnloadLink [7] (win32k.sys)
108e: 99d65c5d NtGdiExcludeClipRect [5] (win32k.sys)
108f: 99dfdfe2 NtGdiExtCreatePen [11] (win32k.sys)
1090: 99d2e89d NtGdiExtCreateRegion [3] (win32k.sys)
1091: 99deef98 NtGdiExtEscape [8] (win32k.sys)
1092: 99df549e NtGdiExtFloodFill [5] (win32k.sys)
1093: 99da8183 NtGdiExtGetObjectW [3] (win32k.sys)
1094: 99db41ac NtGdiExtSelectClipRgn [3] (win32k.sys)
1095: 99db3759 NtGdiExtTextOutW [9] (win32k.sys)
1096: 99e851a1 NtGdiFillPath [1] (win32k.sys)
1097: 99d296b7 NtGdiFillRgn [3] (win32k.sys)
1098: 99e84f0b NtGdiFlattenPath [1] (win32k.sys)
1099: 99dbcd4e NtGdiFlush [0] (win32k.sys)
109a: 99e87018 NtGdiForceUFIMapping [2] (win32k.sys)
109b: 99d2aefa NtGdiFrameRgn [5] (win32k.sys)
109c: 99e761e0 NtGdiFullscreenControl [5] (win32k.sys)
109d: 99e1128d NtGdiGetAndSetDCDword [4] (win32k.sys)
109e: 99db4faf NtGdiGetAppClipBox [2] (win32k.sys)
109f: 99d2f4e5 NtGdiGetBitmapBits [3] (win32k.sys)
10a0: 99e86f54 NtGdiGetBitmapDimension [2] (win32k.sys)
10a1: 99d6a2be NtGdiGetBoundsRect [3] (win32k.sys)
10a2: 99dd9652 NtGdiGetCertificate [4] (win32k.sys)
10a3: 99dd8d0d NtGdiGetCertificateSize [3] (win32k.sys)
10a4: 99d5f0c3 NtGdiGetCharABCWidthsW [6] (win32k.sys)
10a5: 99e856b2 NtGdiGetCharacterPlacementW [6] (win32k.sys)
10a6: 99db3709 NtGdiGetCharSet [1] (win32k.sys)
10a7: 99e00cff NtGdiGetCharWidthW [6] (win32k.sys)
10a8: 99d22586 NtGdiGetCharWidthInfo [2] (win32k.sys)
10a9: 99e85fba NtGdiGetColorAdjustment [2] (win32k.sys)
10aa: 99e8d570 NtGdiGetColorSpaceforBitmap [1] (win32k.sys)
10ab: 99e89735 NtGdiGetCOPPCompatibleOPMInformation [3] (win32k.sys)
10ac: 99db0f9b NtGdiGetDCDword [3] (win32k.sys)
10ad: 99d70880 NtGdiGetDCforBitmap [1] (win32k.sys)
10ae: 99da5676 NtGdiGetDCObject [2] (win32k.sys)
10af: 99e1afe1 NtGdiGetDCPoint [3] (win32k.sys)
10b0: 99d6cfef NtGdiGetDeviceCaps [2] (win32k.sys)
10b1: 99e88f1a NtGdiGetDeviceGammaRamp [2] (win32k.sys)
10b2: 99e0e63a NtGdiGetDeviceCapsAll [2] (win32k.sys)
10b3: 99d7bfc6 NtGdiGetDIBitsInternal [9] (win32k.sys)
10b4: 99e8e344 NtGdiGetETM [2] (win32k.sys)
10b5: 99e8c29a NtGdiGetEudcTimeStampEx [3] (win32k.sys)
10b6: 99d5edf9 NtGdiGetFontData [5] (win32k.sys)
10b7: 99e8ecb3 NtGdiGetFontFileData [5] (win32k.sys)
10b8: 99dd2636 NtGdiGetFontFileInfo [5] (win32k.sys)
10b9: 99e8677a NtGdiGetFontResourceInfoInternalW [7] (win32k.sys)
10ba: 99d71713 NtGdiGetGlyphIndicesW [5] (win32k.sys)
10bb: 99d71864 NtGdiGetGlyphIndicesWInternal [6] (win32k.sys)
10bc: 99e85e21 NtGdiGetGlyphOutline [8] (win32k.sys)
10bd: 99dd73f2 NtGdiGetOPMInformation [3] (win32k.sys)
10be: 99df353d NtGdiGetKerningPairs [3] (win32k.sys)
10bf: 99e6b43e NtGdiGetLinkedUFIs [3] (win32k.sys)
10c0: 99dec2f0 NtGdiGetMiterLimit [2] (win32k.sys)
10c1: 99decabe NtGdiGetMonitorID [3] (win32k.sys)
10c2: 99d74bb6 NtGdiGetNearestColor [2] (win32k.sys)
10c3: 99def3c1 NtGdiGetNearestPaletteIndex [2] (win32k.sys)
10c4: 99debf5f NtGdiGetObjectBitmapHandle [2] (win32k.sys)
10c5: 99dd7d17 NtGdiGetOPMRandomNumber [2] (win32k.sys)
10c6: 99d5e37a NtGdiGetOutlineTextMetricsInternalW [4] (win32k.sys)
10c7: 99e85508 NtGdiGetPath [4] (win32k.sys)
10c8: 99d4912f NtGdiGetPixel [3] (win32k.sys)
10c9: 99db121b NtGdiGetRandomRgn [3] (win32k.sys)
10ca: 99e85f36 NtGdiGetRasterizerCaps [2] (win32k.sys)
10cb: 99d71548 NtGdiGetRealizationInfo [2] (win32k.sys)
10cc: 99d60d6b NtGdiGetRegionData [3] (win32k.sys)
10cd: 99d2315a NtGdiGetRgnBox [2] (win32k.sys)
10ce: 99e8a743 NtGdiGetServerMetaFileBits [7] (win32k.sys)
10cf: 99e65b7f DxgStubDvpFlipVideoPort [4] (win32k.sys)
10d0: 99e8ee96 NtGdiGetStats [5] (win32k.sys)
10d1: 99d85e38 NtGdiGetStockObject [1] (win32k.sys)
10d2: 99e8cf2a NtGdiGetStringBitmapW [5] (win32k.sys)
10d3: 99dd916e NtGdiGetSuggestedOPMProtectedOutputArraySize [2] (win32k.sys)
10d4: 99dec9bf NtGdiGetSystemPaletteUse [1] (win32k.sys)
10d5: 99d61742 NtGdiGetTextCharsetInfo [3] (win32k.sys)
10d6: 99e862b5 NtGdiGetTextExtent [5] (win32k.sys)
10d7: 99d30e5c NtGdiGetTextExtentExW [8] (win32k.sys)
10d8: 99d724e6 NtGdiGetTextFaceW [4] (win32k.sys)
10d9: 99d7228a NtGdiGetTextMetricsW [3] (win32k.sys)
10da: 99d5d13e NtGdiGetTransform [3] (win32k.sys)
10db: 99e869b6 NtGdiGetUFI [6] (win32k.sys)
10dc: 99e86a94 NtGdiGetEmbUFI [7] (win32k.sys)
10dd: 99e86b8e NtGdiGetUFIPathname [10] (win32k.sys)
10de: 99e86941 NtGdiGetEmbedFonts [0] (win32k.sys)
10df: 99e8694b NtGdiChangeGhostFont [2] (win32k.sys)
10e0: 99e6a09f NtGdiAddEmbFontToDC [2] (win32k.sys)
10e1: 99ddbea2 NtGdiGetFontUnicodeRanges [2] (win32k.sys)
10e2: 99d73a7b NtGdiGetWidthTable [7] (win32k.sys)
10e3: 99e17d14 NtGdiGradientFill [6] (win32k.sys)
10e4: 99d721ea NtGdiHfontCreate [5] (win32k.sys)
10e5: 99e89217 NtGdiIcmBrushInfo [8] (win32k.sys)
10e6: 99d85575 NtGdiInit [0] (win32k.sys)
10e7: 99e732eb NtGdiInitSpool [0] (win32k.sys)
10e8: 99db2053 NtGdiIntersectClipRect [5] (win32k.sys)
10e9: 99dfba8b NtGdiInvertRgn [2] (win32k.sys)
10ea: 99d21ce4 NtGdiLineTo [3] (win32k.sys)
10eb: 99e87104 NtGdiMakeFontDir [5] (win32k.sys)
10ec: 99e8d69d NtGdiMakeInfoDC [2] (win32k.sys)
10ed: 99d47cf0 NtGdiMaskBlt [13] (win32k.sys)
10ee: 99d5cf48 NtGdiModifyWorldTransform [3] (win32k.sys)
10ef: 99dfced0 NtGdiMonoBitmap [1] (win32k.sys)
10f0: 99e8615e NtGdiMoveTo [4] (win32k.sys)
10f1: 99e713ab NtGdiOffsetClipRgn [3] (win32k.sys)
10f2: 99d60d5b NtGdiOffsetRgn [3] (win32k.sys)
10f3: 99d70739 NtGdiOpenDCW [8] (win32k.sys)
10f4: 99dc7324 NtGdiPatBlt [6] (win32k.sys)
10f5: 99d9fe7c NtGdiPolyPatBlt [5] (win32k.sys)
10f6: 99e85264 NtGdiPathToRegion [1] (win32k.sys)
10f7: 99e7ed8e NtGdiPlgBlt [11] (win32k.sys)
10f8: 99e85bf4 NtGdiPolyDraw [4] (win32k.sys)
10f9: 99e10e4f NtGdiPolyPolyDraw [5] (win32k.sys)
10fa: 99dc5357 NtGdiPolyTextOutW [4] (win32k.sys)
10fb: 99e862a5 NtGdiPtInRegion [3] (win32k.sys)
10fc: 99e714dd NtGdiPtVisible [3] (win32k.sys)
10fd: 99e863e4 NtGdiQueryFonts [3] (win32k.sys)
10fe: 99d85cf5 NtGdiQueryFontAssocInfo [1] (win32k.sys)
10ff: 99e1e752 NtGdiRectangle [5] (win32k.sys)
1100: 99e1588c NtGdiRectInRegion [2] (win32k.sys)
1101: 99d6b495 NtGdiRectVisible [2] (win32k.sys)
1102: 99e865cd NtGdiRemoveFontResourceW [6] (win32k.sys)
1103: 99e8675e NtGdiRemoveFontMemResourceEx [1] (win32k.sys)
1104: 99e02dbe NtGdiResetDC [5] (win32k.sys)
1105: 99e8a228 NtGdiResizePalette [2] (win32k.sys)
1106: 99d7140d NtGdiRestoreDC [2] (win32k.sys)
1107: 99dfe2ca NtGdiRoundRect [7] (win32k.sys)
1108: 99d7141d NtGdiSaveDC [1] (win32k.sys)
1109: 99e7ccd1 NtGdiScaleViewportExtEx [6] (win32k.sys)
110a: 99e86ef1 NtGdiScaleWindowExtEx [6] (win32k.sys)
110b: 99da35b8 NtGdiSelectBitmap [2] (win32k.sys)
110c: 99e8613e NtGdiSelectBrush [2] (win32k.sys)
110d: 99e850a9 NtGdiSelectClipPath [2] (win32k.sys)
110e: 99db3c08 NtGdiSelectFont [2] (win32k.sys)
110f: 99e8614e NtGdiSelectPen [2] (win32k.sys)
1110: 99cf2973 NtGdiSetBitmapAttributes [2] (win32k.sys)
1111: 99d1a3f2 NtGdiSetBitmapBits [3] (win32k.sys)
1112: 99e86fb1 NtGdiSetBitmapDimension [4] (win32k.sys)
1113: 99d6a24c NtGdiSetBoundsRect [3] (win32k.sys)
1114: 99e86245 NtGdiSetBrushAttributes [2] (win32k.sys)
1115: 99e02d51 NtGdiSetBrushOrg [4] (win32k.sys)
1116: 99e86010 NtGdiSetColorAdjustment [2] (win32k.sys)
1117: 99e888fa NtGdiSetColorSpace [2] (win32k.sys)
1118: 99e88fa1 NtGdiSetDeviceGammaRamp [2] (win32k.sys)
1119: 99d7131b NtGdiSetDIBitsToDeviceInternal [16] (win32k.sys)
111a: 99d74b7f NtGdiSetFontEnumeration [1] (win32k.sys)
111b: 99dfdfa1 NtGdiSetFontXform [3] (win32k.sys)
111c: 99e02dae NtGdiSetIcmMode [3] (win32k.sys)
111d: 99e6a9df NtGdiSetLinkedUFIs [3] (win32k.sys)
111e: 99dc8769 NtGdiSetMagicColors [3] (win32k.sys)
111f: 99e1140b NtGdiSetMetaRgn [1] (win32k.sys)
1120: 99e115cd NtGdiSetMiterLimit [3] (win32k.sys)
1121: 99e86ee1 NtGdiGetDeviceWidth [1] (win32k.sys)
1122: 99e86ed1 NtGdiMirrorWindowOrg [1] (win32k.sys)
1123: 99d2fc32 NtGdiSetLayout [3] (win32k.sys)
1124: 99dd8db3 NtGdiSetOPMSigningKeyAndSequenceNumbers [2] (win32k.sys)
1125: 99e247e7 NtGdiSetPixel [4] (win32k.sys)
1126: 99e8fc25 NtGdiSetPixelFormat [2] (win32k.sys)
1127: 99e86295 NtGdiSetRectRgn [5] (win32k.sys)
1128: 99e861bb NtGdiSetSystemPaletteUse [2] (win32k.sys)
1129: 99e8f34f NtGdiSetTextJustification [3] (win32k.sys)
112a: 99e11544 NtGdiSetVirtualResolution [5] (win32k.sys)
112b: 99e11645 NtGdiSetSizeDevice [3] (win32k.sys)
112c: 99e6aaee NtGdiStartDoc [4] (win32k.sys)
112d: 99e6afa4 NtGdiStartPage [1] (win32k.sys)
112e: 99d397f8 NtGdiStretchBlt [12] (win32k.sys)
112f: 99d7ebeb NtGdiStretchDIBitsInternal [16] (win32k.sys)
1130: 99e85332 NtGdiStrokeAndFillPath [1] (win32k.sys)
1131: 99e8542f NtGdiStrokePath [1] (win32k.sys)
1132: 99e8fdf3 NtGdiSwapBuffers [1] (win32k.sys)
1133: 99d5d462 NtGdiTransformPoints [5] (win32k.sys)
1134: 99d1958e NtGdiTransparentBlt [11] (win32k.sys)
1135: 99dd160e DxgStubGetDC [2] (win32k.sys)
1136: 99e864c4 NtGdiUnmapMemFont [1] (win32k.sys)
1137: 99e86285 NtGdiUnrealizeObject [1] (win32k.sys)
1138: 99e8a48a NtGdiUpdateColors [1] (win32k.sys)
1139: 99e84f96 NtGdiWidenPath [1] (win32k.sys)
113a: 99d2c705 NtUserActivateKeyboardLayout [2] (win32k.sys)
113b: 99e33a8c NtUserAddClipboardFormatListener [1] (win32k.sys)
113c: 99e30434 NtUserAlterWindowStyle [3] (win32k.sys)
113d: 99d73e10 NtUserAssociateInputContext [3] (win32k.sys)
113e: 99e26115 NtUserAttachThreadInput [3] (win32k.sys)
113f: 99db1e81 NtUserBeginPaint [2] (win32k.sys)
1140: 99e0f8c1 NtUserBitBltSysBmp [8] (win32k.sys)
1141: 99e309b4 NtUserBlockInput [1] (win32k.sys)
1142: 99d54370 NtUserBuildHimcList [4] (win32k.sys)
1143: 99d6c2a1 NtUserBuildHwndList [7] (win32k.sys)
1144: 99d4f818 NtUserBuildNameList [4] (win32k.sys)
1145: 99e3076a NtUserBuildPropList [4] (win32k.sys)
1146: 99d007fe NtUserCallHwnd [2] (win32k.sys)
1147: 99d5c658 NtUserCallHwndLock [2] (win32k.sys)
1148: 99ce5c24 NtUserCallHwndOpt [2] (win32k.sys)
1149: 99d6adfc NtUserCallHwndParam [3] (win32k.sys)
114a: 99d47241 NtUserCallHwndParamLock [3] (win32k.sys)
114b: 99e15ba7 NtUserCallMsgFilter [2] (win32k.sys)
114c: 99e05eda NtUserCallNextHookEx [4] (win32k.sys)
114d: 99db722c NtUserCallNoParam [1] (win32k.sys)
114e: 99db71d7 NtUserCallOneParam [2] (win32k.sys)
114f: 99d55827 NtUserCallTwoParam [3] (win32k.sys)
1150: 99e06875 NtUserChangeClipboardChain [2] (win32k.sys)
1151: 99de9daa NtUserChangeDisplaySettings [4] (win32k.sys)
1152: 99d034a6 NtUserGetDisplayConfigBufferSizes [3] (win32k.sys)
1153: 99e30ca7 NtUserSetDisplayConfig [5] (win32k.sys)
1154: 99d00f07 NtUserQueryDisplayConfig [6] (win32k.sys)
1155: 99e30f8e NtUserDisplayConfigGetDeviceInfo [1] (win32k.sys)
1156: 99e31127 NtUserDisplayConfigSetDeviceInfo [1] (win32k.sys)
1157: 99e33dac NtUserCheckAccessForIntegrityLevel [3] (win32k.sys)
1158: 99d27b58 NtUserCheckDesktopByThreadId [1] (win32k.sys)
1159: 99e304de NtUserCheckWindowThreadDesktop [3] (win32k.sys)
115a: 99e32982 NtUserCheckImeHotKey [2] (win32k.sys)
115b: 99d00975 NtUserCheckMenuItem [3] (win32k.sys)
115c: 99df1f69 NtUserChildWindowFromPointEx [4] (win32k.sys)
115d: 99dd5a31 NtUserClipCursor [1] (win32k.sys)
115e: 99e14cec NtUserCloseClipboard [0] (win32k.sys)
115f: 99d4f761 NtUserCloseDesktop [1] (win32k.sys)
1160: 99d4fc5b NtUserCloseWindowStation [1] (win32k.sys)
1161: 99dc6ad5 NtUserConsoleControl [3] (win32k.sys)
1162: 99debd82 NtUserConvertMemHandle [2] (win32k.sys)
1163: 99e10cc5 NtUserCopyAcceleratorTable [3] (win32k.sys)
1164: 99e14a82 NtUserCountClipboardFormats [0] (win32k.sys)
1165: 99d2266b NtUserCreateAcceleratorTable [2] (win32k.sys)
1166: 99e15297 NtUserCreateCaret [4] (win32k.sys)
1167: 99cf42e7 NtUserCreateDesktopEx [6] (win32k.sys)
1168: 99e06588 NtUserCreateInputContext [1] (win32k.sys)
1169: 99dfb61c NtUserCreateLocalMemHandle [4] (win32k.sys)
116a: 99d7a4f0 NtUserCreateWindowEx [15] (win32k.sys)
116b: 99cf7507 NtUserCreateWindowStation [8] (win32k.sys)
116c: 99d1651a NtUserDdeInitialize [5] (win32k.sys)
116d: 99d2c503 NtUserDeferWindowPos [8] (win32k.sys)
116e: 99e03eca NtUserDefSetText [2] (win32k.sys)
116f: 99d84991 NtUserDeleteMenu [3] (win32k.sys)
1170: 99e10bf5 NtUserDestroyAcceleratorTable [1] (win32k.sys)
1171: 99d95057 NtUserDestroyCursor [2] (win32k.sys)
1172: 99e065d7 NtUserDestroyInputContext [1] (win32k.sys)
1173: 99d23838 NtUserDestroyMenu [1] (win32k.sys)
1174: 99d9972a NtUserDestroyWindow [1] (win32k.sys)
1175: 99d2f71d NtUserDisableThreadIme [1] (win32k.sys)
1176: 99db1fd2 NtUserDispatchMessage [1] (win32k.sys)
1177: 99ce553b NtUserDoSoundConnect [0] (win32k.sys)
1178: 99dc939c NtUserDoSoundDisconnect [0] (win32k.sys)
1179: 99e30864 NtUserDragDetect [3] (win32k.sys)
117a: 99e2ed31 NtUserDragObject [5] (win32k.sys)
117b: 99e2f7eb NtUserDrawAnimatedRects [4] (win32k.sys)
117c: 99e2f8ae NtUserDrawCaption [4] (win32k.sys)
117d: 99e31328 NtUserDrawCaptionTemp [7] (win32k.sys)
117e: 99d65689 NtUserDrawIconEx [11] (win32k.sys)
117f: 99e31257 NtUserDrawMenuBarTemp [5] (win32k.sys)
1180: 99dd11f9 NtUserEmptyClipboard [0] (win32k.sys)
1181: 99d200d5 NtUserEnableMenuItem [3] (win32k.sys)
1182: 99e066f6 NtUserEnableScrollBar [3] (win32k.sys)
1183: 99d2dad1 NtUserEndDeferWindowPosEx [2] (win32k.sys)
1184: 99d2a36e NtUserEndMenu [0] (win32k.sys)
1185: 99db1f32 NtUserEndPaint [2] (win32k.sys)
1186: 99d5183b NtUserEnumDisplayDevices [4] (win32k.sys)
1187: 99d6c18b NtUserEnumDisplayMonitors [4] (win32k.sys)
1188: 99d7455b NtUserEnumDisplaySettings [4] (win32k.sys)
1189: 99e2ee93 NtUserEvent [1] (win32k.sys)
118a: 99dedca7 NtUserExcludeUpdateRgn [2] (win32k.sys)
118b: 99e151f3 NtUserFillWindow [4] (win32k.sys)
118c: 99d774c2 NtUserFindExistingCursorIcon [3] (win32k.sys)
118d: 99d4f38a NtUserFindWindowEx [5] (win32k.sys)
118e: 99e07873 NtUserFlashWindowEx [1] (win32k.sys)
118f: 99e33d57 NtUserFrostCrashedWindow [2] (win32k.sys)
1190: 99e2f33d NtUserGetAltTabInfo [6] (win32k.sys)
1191: 99d61857 NtUserGetAncestor [2] (win32k.sys)
1192: 99e3291a NtUserGetAppImeLevel [1] (win32k.sys)
1193: 99d3864a NtUserGetAsyncKeyState [1] (win32k.sys)
1194: 99d82737 NtUserGetAtomName [2] (win32k.sys)
1195: 99d719c0 NtUserGetCaretBlinkTime [0] (win32k.sys)
1196: 99e10dc8 NtUserGetCaretPos [1] (win32k.sys)
1197: 99d59897 NtUserGetClassInfoEx [5] (win32k.sys)
1198: 99d5c3fb NtUserGetClassName [3] (win32k.sys)
1199: 99df8fee NtUserGetClipboardData [2] (win32k.sys)
119a: 99ded029 NtUserGetClipboardFormatName [3] (win32k.sys)
119b: 99e14a56 NtUserGetClipboardOwner [0] (win32k.sys)
119c: 99e14e25 NtUserGetClipboardSequenceNumber [0] (win32k.sys)
119d: 99e2f9fb NtUserGetClipboardViewer [0] (win32k.sys)
119e: 99e2f690 NtUserGetClipCursor [1] (win32k.sys)
119f: 99e12a00 NtUserGetComboBoxInfo [2] (win32k.sys)
11a0: 99df69b8 NtUserGetControlBrush [3] (win32k.sys)
11a1: 99e2f957 NtUserGetControlColor [4] (win32k.sys)
11a2: 99d2d49d NtUserGetCPD [3] (win32k.sys)
11a3: 99e10926 NtUserGetCursorFrameInfo [4] (win32k.sys)
11a4: 99e2f204 NtUserGetCursorInfo [1] (win32k.sys)
11a5: 99db02db NtUserGetDC [1] (win32k.sys)
11a6: 99d65c6d NtUserGetDCEx [3] (win32k.sys)
11a7: 99d4a5e2 NtUserGetDoubleClickTime [0] (win32k.sys)
11a8: 99d655da NtUserGetForegroundWindow [0] (win32k.sys)
11a9: 99e35086 NtUserGetGuiResources [2] (win32k.sys)
11aa: 99d5d90a NtUserGetGUIThreadInfo [2] (win32k.sys)
11ab: 99d7c966 NtUserGetIconInfo [6] (win32k.sys)
11ac: 99d7fac1 NtUserGetIconSize [4] (win32k.sys)
11ad: 99e327ea NtUserGetImeHotKey [4] (win32k.sys)
11ae: 99d5bd0f NtUserGetImeInfoEx [2] (win32k.sys)
11af: 99e30bad NtUserGetInputLocaleInfo [2] (win32k.sys)
11b0: 99e2efa1 NtUserGetInternalWindowPos [3] (win32k.sys)
11b1: 99d224fb NtUserGetKeyboardLayoutList [2] (win32k.sys)
11b2: 99e30ac0 NtUserGetKeyboardLayoutName [1] (win32k.sys)
11b3: 99e20de2 NtUserGetKeyboardState [1] (win32k.sys)
11b4: 99e30a47 NtUserGetKeyNameText [3] (win32k.sys)
11b5: 99d5354f NtUserGetKeyState [1] (win32k.sys)
11b6: 99e2f1ac NtUserGetListBoxInfo [1] (win32k.sys)
11b7: 99d4da44 NtUserGetMenuBarInfo [4] (win32k.sys)
11b8: 99e2f71a NtUserGetMenuIndex [2] (win32k.sys)
11b9: 99e30219 NtUserGetMenuItemRect [4] (win32k.sys)
11ba: 99dbcf5b NtUserGetMessage [4] (win32k.sys)
11bb: 99e2fe50 NtUserGetMouseMovePointsEx [5] (win32k.sys)
11bc: 99d82367 NtUserGetObjectInformation [5] (win32k.sys)
11bd: 99e14eb8 NtUserGetOpenClipboardWindow [0] (win32k.sys)
11be: 99e2fa27 NtUserGetPriorityClipboardFormat [2] (win32k.sys)
11bf: 99d820e4 NtUserGetProcessWindowStation [0] (win32k.sys)
11c0: 99e33620 NtUserGetRawInputBuffer [3] (win32k.sys)
11c1: 99e22f9a NtUserGetRawInputData [5] (win32k.sys)
11c2: 99e331e0 NtUserGetRawInputDeviceInfo [4] (win32k.sys)
11c3: 99e334c0 NtUserGetRawInputDeviceList [3] (win32k.sys)
11c4: 99e335e5 NtUserGetRegisteredRawInputDevices [3] (win32k.sys)
11c5: 99d6dd4e NtUserGetScrollBarInfo [3] (win32k.sys)
11c6: 99e33fc7 NtUserGetServicesProcess [1] (win32k.sys)
11c7: 99d81346 NtUserGetSystemMenu [2] (win32k.sys)
11c8: 99d8830d NtUserGetThreadDesktop [2] (win32k.sys)
11c9: 99d9a5b6 NtUserGetThreadState [1] (win32k.sys)
11ca: 99d6d83c NtUserGetTitleBarInfo [2] (win32k.sys)
11cb: 99e2f546 NtUserGetTopLevelWindow [1] (win32k.sys)
11cc: 99e33bd7 NtUserGetUpdatedClipboardFormats [3] (win32k.sys)
11cd: 99d46eff NtUserGetUpdateRect [3] (win32k.sys)
11ce: 99dfef62 NtUserGetUpdateRgn [3] (win32k.sys)
11cf: 99d63524 NtUserGetWindowCompositionInfo [2] (win32k.sys)
11d0: 99d631a9 NtUserGetWindowCompositionAttribute [2] (win32k.sys)
11d1: 99d6d589 NtUserGetWindowDC [1] (win32k.sys)
11d2: 99e2f586 NtUserGetWindowDisplayAffinity [2] (win32k.sys)
11d3: 99e12ca7 NtUserGetWindowPlacement [2] (win32k.sys)
11d4: 99e2ef18 NtUserGetWOWClass [2] (win32k.sys)
11d5: 99d470d9 NtUserGhostWindowFromHungWindow [1] (win32k.sys)
11d6: 99e34cfd NtUserHardErrorControl [3] (win32k.sys)
11d7: 99d2c6cb NtUserHideCaret [1] (win32k.sys)
11d8: 99e2faaa NtUserHiliteMenuItem [4] (win32k.sys)
11d9: 99de6ef8 NtUserHungWindowFromGhostWindow [1] (win32k.sys)
11da: 99e309da NtUserImpersonateDdeClientWindow [2] (win32k.sys)
11db: 99cef335 NtUserInitialize [2] (win32k.sys)
11dc: 99cfcf4e NtUserInitializeClientPfnArrays [4] (win32k.sys)
11dd: 99e2f073 NtUserInitTask [12] (win32k.sys)
11de: 99d6d5e0 NtUserInternalGetWindowText [3] (win32k.sys)
11df: 99de1d0a NtUserInternalGetWindowIcon [2] (win32k.sys)
11e0: 99db1670 NtUserInvalidateRect [3] (win32k.sys)
11e1: 99d2dde1 NtUserInvalidateRgn [3] (win32k.sys)
11e2: 99e14d92 NtUserIsClipboardFormatAvailable [1] (win32k.sys)
11e3: 99d62c03 NtUserIsTopLevelWindow [1] (win32k.sys)
11e4: 99d9bce7 NtUserKillTimer [2] (win32k.sys)
11e5: 99cf0e7b NtUserLoadKeyboardLayoutEx [8] (win32k.sys)
11e6: 99cfe9f8 NtUserLockWindowStation [1] (win32k.sys)
11e7: 99dd153a NtUserLockWindowUpdate [1] (win32k.sys)
11e8: 99dcaef8 NtUserLockWorkStation [0] (win32k.sys)
11e9: 99e27009 NtUserLogicalToPhysicalPoint [2] (win32k.sys)
11ea: 99e2166b NtUserMapVirtualKeyEx [4] (win32k.sys)
11eb: 99e302f1 NtUserMenuItemFromPoint [4] (win32k.sys)
11ec: 99dafb35 NtUserMessageCall [7] (win32k.sys)
11ed: 99e2fb55 NtUserMinMaximize [3] (win32k.sys)
11ee: 99e2fc7b NtUserMNDragLeave [0] (win32k.sys)
11ef: 99e2fbe3 NtUserMNDragOver [2] (win32k.sys)
11f0: 99e303f2 NtUserModifyUserStartupInfoFlags [2] (win32k.sys)
11f1: 99d2d69f NtUserMoveWindow [6] (win32k.sys)
11f2: 99d5c95b NtUserNotifyIMEStatus [3] (win32k.sys)
11f3: 99d8ab2b NtUserNotifyProcessCreate [4] (win32k.sys)
11f4: 99d6bb8f NtUserNotifyWinEvent [4] (win32k.sys)
11f5: 99e14b09 NtUserOpenClipboard [2] (win32k.sys)
11f6: 99d4fa82 NtUserOpenDesktop [3] (win32k.sys)
11f7: 99d16ced NtUserOpenInputDesktop [3] (win32k.sys)
11f8: 99e30484 NtUserOpenThreadDesktop [5] (win32k.sys)
11f9: 99d4fb2c NtUserOpenWindowStation [2] (win32k.sys)
11fa: 99d0ed39 NtUserPaintDesktop [1] (win32k.sys)
11fb: 99d0fc19 NtUserPaintMonitor [3] (win32k.sys)
11fc: 99dafda2 NtUserPeekMessage [5] (win32k.sys)
11fd: 99e26c08 NtUserPhysicalToLogicalPoint [2] (win32k.sys)
11fe: 99d979e6 NtUserPostMessage [4] (win32k.sys)
11ff: 99d844e3 NtUserPostThreadMessage [4] (win32k.sys)
1200: 99e33152 NtUserPrintWindow [3] (win32k.sys)
1201: 99d887b5 NtUserProcessConnect [2] (win32k.sys)
1202: 99dcaba6 NtUserQueryInformationThread [4] (win32k.sys)
1203: 99d5cb3e NtUserQueryInputContext [2] (win32k.sys)
1204: 99e30910 NtUserQuerySendMessage [1] (win32k.sys)
1205: 99d595a0 NtUserQueryWindow [2] (win32k.sys)
1206: 99e2f2ff NtUserRealChildWindowFromPoint [3] (win32k.sys)
1207: 99db173b NtUserRealInternalGetMessage [6] (win32k.sys)
1208: 99e30159 NtUserRealWaitMessageEx [2] (win32k.sys)
1209: 99d609ce NtUserRedrawWindow [4] (win32k.sys)
120a: 99d7af5d NtUserRegisterClassExWOW [7] (win32k.sys)
120b: 99e33d20 NtUserRegisterErrorReportingDialog [2] (win32k.sys)
120c: 99cf2aca NtUserRegisterUserApiHook [4] (win32k.sys)
120d: 99d3877b NtUserRegisterHotKey [4] (win32k.sys)
120e: 99d14c86 NtUserRegisterRawInputDevices [3] (win32k.sys)
120f: 99ce1700 NtUserRegisterServicesProcess [1] (win32k.sys)
1210: 99e2f178 NtUserRegisterTasklist [1] (win32k.sys)
1211: 99d89827 NtUserRegisterWindowMessage [1] (win32k.sys)
1212: 99e33b6d NtUserRemoveClipboardFormatListener [1] (win32k.sys)
1213: 99d237b7 NtUserRemoveMenu [3] (win32k.sys)
1214: 99d60e34 NtUserRemoveProp [2] (win32k.sys)
1215: 99e34eeb NtUserResolveDesktop [4] (win32k.sys)
1216: 99e34dc2 NtUserResolveDesktopForWOW [1] (win32k.sys)
1217: 99d6dc6a NtUserSBGetParms [4] (win32k.sys)
1218: 99dc640c NtUserScrollDC [7] (win32k.sys)
1219: 99e17415 NtUserScrollWindowEx [8] (win32k.sys)
121a: 99d705fd NtUserSelectPalette [3] (win32k.sys)
121b: 99e2c80c NtUserSendInput [3] (win32k.sys)
121c: 99d6b77a NtUserSetActiveWindow [1] (win32k.sys)
121d: 99e328b4 NtUserSetAppImeLevel [2] (win32k.sys)
121e: 99e20f37 NtUserSetCapture [1] (win32k.sys)
121f: 99d1fbe7 NtUserSetClassLong [4] (win32k.sys)
1220: 99e2fc98 NtUserSetClassWord [3] (win32k.sys)
1221: 99dec240 NtUserSetClipboardData [3] (win32k.sys)
1222: 99decc88 NtUserSetClipboardViewer [1] (win32k.sys)
1223: 99d6adbc NtUserSetCursor [1] (win32k.sys)
1224: 99e301d2 NtUserSetCursorContents [2] (win32k.sys)
1225: 99d77318 NtUserSetCursorIconData [4] (win32k.sys)
1226: 99d53207 NtUserSetFocus [1] (win32k.sys)
1227: 99ce8dd7 NtUserSetImeHotKey [5] (win32k.sys)
1228: 99cf28e6 NtUserSetImeInfoEx [1] (win32k.sys)
1229: 99d5c87c NtUserSetImeOwnerWindow [2] (win32k.sys)
122a: 99d49538 NtUserSetInformationThread [4] (win32k.sys)
122b: 99e2f456 NtUserSetInternalWindowPos [4] (win32k.sys)
122c: 99e21777 NtUserSetKeyboardState [1] (win32k.sys)
122d: 99d48d0c NtUserSetMenu [3] (win32k.sys)
122e: 99e2f77a NtUserSetMenuContextHelpId [2] (win32k.sys)
122f: 99d2e11c NtUserSetMenuDefaultItem [3] (win32k.sys)
1230: 99e2f7b7 NtUserSetMenuFlagRtoL [1] (win32k.sys)
1231: 99e2ec6a NtUserSetObjectInformation [4] (win32k.sys)
1232: 99d2ab62 NtUserSetParent [2] (win32k.sys)
1233: 99d4f644 NtUserSetProcessWindowStation [1] (win32k.sys)
1234: 99db15fd NtUserGetProp [2] (win32k.sys)
1235: 99d5d57c NtUserSetProp [3] (win32k.sys)
1236: 99d745eb NtUserSetScrollInfo [4] (win32k.sys)
1237: 99ce5cb2 NtUserSetShellWindowEx [2] (win32k.sys)
1238: 99dc85b5 NtUserSetSysColors [4] (win32k.sys)
1239: 99e30199 NtUserSetSystemCursor [2] (win32k.sys)
123a: 99dfb1e1 NtUserSetSystemMenu [2] (win32k.sys)
123b: 99e308c2 NtUserSetSystemTimer [3] (win32k.sys)
123c: 99d4f29e NtUserSetThreadDesktop [1] (win32k.sys)
123d: 99e329d1 NtUserSetThreadLayoutHandles [2] (win32k.sys)
123e: 99e11a8f NtUserSetThreadState [2] (win32k.sys)
123f: 99db125c NtUserSetTimer [4] (win32k.sys)
1240: 99d725a6 NtUserSetProcessDPIAware [0] (win32k.sys)
1241: 99d48876 NtUserSetWindowCompositionAttribute [2] (win32k.sys)
1242: 99e2f617 NtUserSetWindowDisplayAffinity [2] (win32k.sys)
1243: 99d5bf5a NtUserSetWindowFNID [2] (win32k.sys)
1244: 99d7b220 NtUserSetWindowLong [4] (win32k.sys)
1245: 99d2f58c NtUserSetWindowPlacement [2] (win32k.sys)
1246: 99d5daba NtUserSetWindowPos [7] (win32k.sys)
1247: 99d2d964 NtUserSetWindowRgn [3] (win32k.sys)
1248: 99d63c62 NtUserGetWindowRgnEx [3] (win32k.sys)
1249: 99e001a0 NtUserSetWindowRgnEx [3] (win32k.sys)
124a: 99e2fcd4 NtUserSetWindowsHookAW [3] (win32k.sys)
124b: 99d71ef8 NtUserSetWindowsHookEx [6] (win32k.sys)
124c: 99ceb1f1 NtUserSetWindowStationUser [4] (win32k.sys)
124d: 99e0ed6c NtUserSetWindowWord [3] (win32k.sys)
124e: 99d5e079 NtUserSetWinEventHook [8] (win32k.sys)
124f: 99d2de6a NtUserShowCaret [1] (win32k.sys)
1250: 99e110e1 NtUserShowScrollBar [3] (win32k.sys)
1251: 99d7eb26 NtUserShowWindow [2] (win32k.sys)
1252: 99e2fd00 NtUserShowWindowAsync [2] (win32k.sys)
1253: 99dd737a NtUserSoundSentry [0] (win32k.sys)
1254: 99cff1e5 NtUserSwitchDesktop [2] (win32k.sys)
1255: 99d9ec7f NtUserSystemParametersInfo [4] (win32k.sys)
1256: 99e3038f NtUserTestForInteractiveUser [1] (win32k.sys)
1257: 99e1626e NtUserThunkedMenuInfo [2] (win32k.sys)
1258: 99d80ba0 NtUserThunkedMenuItemInfo [6] (win32k.sys)
1259: 99e2ff1c NtUserToUnicodeEx [7] (win32k.sys)
125a: 99d6b3cd NtUserTrackMouseEvent [1] (win32k.sys)
125b: 99e1647e NtUserTrackPopupMenuEx [6] (win32k.sys)
125c: 99dd0aa2 NtUserCalculatePopupWindowPosition [5] (win32k.sys)
125d: 99d6d948 NtUserCalcMenuBar [5] (win32k.sys)
125e: 99d4ee60 NtUserPaintMenuBar [6] (win32k.sys)
125f: 99ddb62c NtUserTranslateAccelerator [3] (win32k.sys)
1260: 99e23a31 NtUserTranslateMessage [2] (win32k.sys)
1261: 99d9539d NtUserUnhookWindowsHookEx [1] (win32k.sys)
1262: 99d5433a NtUserUnhookWinEvent [1] (win32k.sys)
1263: 99e30836 NtUserUnloadKeyboardLayout [1] (win32k.sys)
1264: 99d005bf NtUserUnlockWindowStation [1] (win32k.sys)
1265: 99d99ab8 NtUserUnregisterClass [3] (win32k.sys)
1266: 99cf2993 NtUserUnregisterUserApiHook [0] (win32k.sys)
1267: 99e23e17 NtUserUnregisterHotKey [2] (win32k.sys)
1268: 99d5beee NtUserUpdateInputContext [3] (win32k.sys)
1269: 99e2ee0c NtUserUpdateInstance [3] (win32k.sys)
126a: 99d393b4 NtUserUpdateLayeredWindow [10] (win32k.sys)
126b: 99e3307c NtUserGetLayeredWindowAttributes [4] (win32k.sys)
126c: 99d47bd2 NtUserSetLayeredWindowAttributes [4] (win32k.sys)
126d: 99ceb83a NtUserUpdatePerUserSystemParameters [1] (win32k.sys)
126e: 99e30578 NtUserUserHandleGrantAccess [3] (win32k.sys)
126f: 99e11a67 NtUserValidateHandleSecure [1] (win32k.sys)
1270: 99df6134 NtUserValidateRect [2] (win32k.sys)
1271: 99d9f59b NtUserValidateTimerCallback [1] (win32k.sys)
1272: 99d19043 NtUserVkKeyScanEx [3] (win32k.sys)
1273: 99dfff41 NtUserWaitForInputIdle [3] (win32k.sys)
1274: 99e2ed09 NtUserWaitForMsgAndEvent [1] (win32k.sys)
1275: 99d6c630 NtUserWaitMessage [0] (win32k.sys)
1276: 99e26ab5 NtUserWindowFromPhysicalPoint [2] (win32k.sys)
1277: 99e1b9de NtUserWindowFromPoint [2] (win32k.sys)
1278: 99e3008f NtUserYieldTask [0] (win32k.sys)
1279: 99cfd125 NtUserRemoteConnect [3] (win32k.sys)
127a: 99e2eb81 NtUserRemoteRedrawRectangle [4] (win32k.sys)
127b: 99e2ebd8 NtUserRemoteRedrawScreen [0] (win32k.sys)
127c: 99e2ec28 NtUserRemoteStopScreenUpdates [0] (win32k.sys)
127d: 99e34c29 NtUserCtxDisplayIOCtl [3] (win32k.sys)
127e: 99ce598f NtUserRegisterSessionPort [2] (win32k.sys)
127f: 99e33894 NtUserUnregisterSessionPort [0] (win32k.sys)
1280: 99e32f85 NtUserUpdateWindowTransform [3] (win32k.sys)
1281: 99d07d3b NtUserDwmStartRedirection [1] (win32k.sys)
1282: 99de01b4 NtUserDwmStopRedirection [0] (win32k.sys)
1283: 99d2faf9 NtUserGetWindowMinimizeRect [2] (win32k.sys)
1284: 99dd8683 NtUserSfmDxBindSwapChain [3] (win32k.sys)
1285: 99dd83d8 NtUserSfmDxOpenSwapChain [4] (win32k.sys)
1286: 99de61e3 NtUserSfmDxReleaseSwapChain [2] (win32k.sys)
1287: 99dd74bd NtUserSfmDxQuerySwapChainBindingStatus [2] (win32k.sys)
1288: 99dd9376 NtUserSfmDxGetSwapChainStats [2] (win32k.sys)
1289: 99dbe53d NtUserSfmDxSetSwapChainStats [2] (win32k.sys)
128a: 99e338cf NtUserSfmCreateLogicalSurface [4] (win32k.sys)
128b: 99e33a18 NtUserSfmDestroyLogicalSurface [1] (win32k.sys)
128c: 99e33ea8 NtUserGestureCommand [5] (win32k.sys)
128d: 99e34300 NtUserModifyWindowTouchCapability [3] (win32k.sys)
128e: 99e34367 NtUserIsTouchWindow [2] (win32k.sys)
128f: 99e343f3 NtUserSendTouchInput [4] (win32k.sys)
1290: 99e34537 NtUserEndTouchOperation [1] (win32k.sys)
1291: 99e345c8 NtUserGetTouchInputInfo [4] (win32k.sys)
1292: 99d5e0cf NtUserChangeWindowMessageFilterEx [4] (win32k.sys)
1293: 99e346a9 NtUserInjectGesture [5] (win32k.sys)
1294: 99e34875 NtUserGetGestureInfo [2] (win32k.sys)
1295: 99e3493a NtUserGetGestureExtArgs [3] (win32k.sys)
1296: 99e34a14 NtUserManageGestureHandlerWindow [2] (win32k.sys)
1297: 99ce600d NtUserSetGestureConfig [5] (win32k.sys)
1298: 99e34a96 NtUserGetGestureConfig [6] (win32k.sys)
1299: 99e90e45 NtGdiEngAssociateSurface [3] (win32k.sys)
129a: 99e90f55 NtGdiEngCreateBitmap [6] (win32k.sys)
129b: 99e9060e NtGdiEngCreateDeviceSurface [4] (win32k.sys)
129c: 99e9063f NtGdiEngCreateDeviceBitmap [4] (win32k.sys)
129d: 99e075ae NtGdiEngCreatePalette [6] (win32k.sys)
129e: 99e94174 NtGdiEngComputeGlyphSet [3] (win32k.sys)
129f: 99e91079 NtGdiEngCopyBits [6] (win32k.sys)
12a0: 99e0e62a NtGdiEngDeletePalette [1] (win32k.sys)
12a1: 99e90edb NtGdiEngDeleteSurface [1] (win32k.sys)
12a2: 99e92899 NtGdiEngEraseSurface [3] (win32k.sys)
12a3: 99e91977 NtGdiEngUnlockSurface [1] (win32k.sys)
12a4: 99e91940 NtGdiEngLockSurface [1] (win32k.sys)
12a5: 99e919aa NtGdiEngBitBlt [11] (win32k.sys)
12a6: 99e9120e NtGdiEngStretchBlt [11] (win32k.sys)
12a7: 99e91760 NtGdiEngPlgBlt [11] (win32k.sys)
12a8: 99e90f08 NtGdiEngMarkBandingSurface [1] (win32k.sys)
12a9: 99e91c69 NtGdiEngStrokePath [8] (win32k.sys)
12aa: 99e91e19 NtGdiEngFillPath [7] (win32k.sys)
12ab: 99e91f80 NtGdiEngStrokeAndFillPath [10] (win32k.sys)
12ac: 99e92169 NtGdiEngPaint [5] (win32k.sys)
12ad: 99e9227d NtGdiEngLineTo [9] (win32k.sys)
12ae: 99e923a0 NtGdiEngAlphaBlend [7] (win32k.sys)
12af: 99e9250b NtGdiEngGradientFill [10] (win32k.sys)
12b0: 99e92741 NtGdiEngTransparentBlt [8] (win32k.sys)
12b1: 99e937d1 NtGdiEngTextOut [10] (win32k.sys)
12b2: 99e91473 NtGdiEngStretchBltROP [13] (win32k.sys)
12b3: 99e9353a NtGdiXLATEOBJ_cGetPalette [4] (win32k.sys)
12b4: 99e935fa NtGdiXLATEOBJ_iXlate [2] (win32k.sys)
12b5: 99e934f3 NtGdiXLATEOBJ_hGetColorTransform [1] (win32k.sys)
12b6: 99e92a79 NtGdiCLIPOBJ_bEnum [3] (win32k.sys)
12b7: 99e92a20 NtGdiCLIPOBJ_cEnumStart [5] (win32k.sys)
12b8: 99e92958 NtGdiCLIPOBJ_ppoGetPath [1] (win32k.sys)
12b9: 99e9298f NtGdiEngDeletePath [1] (win32k.sys)
12ba: 99e929c2 NtGdiEngCreateClip [0] (win32k.sys)
12bb: 99e929ed NtGdiEngDeleteClip [1] (win32k.sys)
12bc: 99e92bb8 NtGdiBRUSHOBJ_ulGetBrushColor [1] (win32k.sys)
12bd: 99e92b27 NtGdiBRUSHOBJ_pvAllocRbrush [2] (win32k.sys)
12be: 99e92b71 NtGdiBRUSHOBJ_pvGetRbrush [1] (win32k.sys)
12bf: 99e92c1a NtGdiBRUSHOBJ_hGetColorTransform [1] (win32k.sys)
12c0: 99e92c61 NtGdiXFORMOBJ_bApplyXform [5] (win32k.sys)
12c1: 99e92db7 NtGdiXFORMOBJ_iGetXform [2] (win32k.sys)
12c2: 99e92e60 NtGdiFONTOBJ_vGetInfo [3] (win32k.sys)
12c3: 99e9301a NtGdiFONTOBJ_pxoGetXform [1] (win32k.sys)
12c4: 99e93999 NtGdiFONTOBJ_cGetGlyphs [5] (win32k.sys)
12c5: 99e93d1a NtGdiFONTOBJ_pifi [1] (win32k.sys)
12c6: 99e93b19 NtGdiFONTOBJ_pfdg [1] (win32k.sys)
12c7: 99e93c12 NtGdiFONTOBJ_pQueryGlyphAttrs [2] (win32k.sys)
12c8: 99e93426 NtGdiFONTOBJ_pvTrueTypeFontFile [2] (win32k.sys)
12c9: 99e92f4e NtGdiFONTOBJ_cGetAllGlyphHandles [2] (win32k.sys)
12ca: 99e93f44 NtGdiSTROBJ_bEnum [3] (win32k.sys)
12cb: 99e93f62 NtGdiSTROBJ_bEnumPositionsOnly [3] (win32k.sys)
12cc: 99e93f80 NtGdiSTROBJ_bGetAdvanceWidths [4] (win32k.sys)
12cd: 99e93051 NtGdiSTROBJ_vEnumStart [1] (win32k.sys)
12ce: 99e9308e NtGdiSTROBJ_dwGetCodePage [1] (win32k.sys)
12cf: 99e931a7 NtGdiPATHOBJ_vGetBounds [2] (win32k.sys)
12d0: 99e9405a NtGdiPATHOBJ_bEnum [2] (win32k.sys)
12d1: 99e93229 NtGdiPATHOBJ_vEnumStart [1] (win32k.sys)
12d2: 99e93266 NtGdiPATHOBJ_vEnumStartClipLines [4] (win32k.sys)
12d3: 99e93310 NtGdiPATHOBJ_bEnumClipLines [3] (win32k.sys)
12d4: 99e930d5 NtGdiGetDhpdev [1] (win32k.sys)
12d5: 99e93645 NtGdiEngCheckAbort [1] (win32k.sys)
12d6: 99e936a7 NtGdiHT_Get8BPPFormatPalette [4] (win32k.sys)
12d7: 99e93732 NtGdiHT_Get8BPPMaskPalette [6] (win32k.sys)
12d8: 99e7ceeb NtGdiUpdateTransform [1] (win32k.sys)
12d9: 99e06290 NtGdiSetPUMPDOBJ [4] (win32k.sys)
12da: 99e9310b NtGdiBRUSHOBJ_DeleteRbrush [2] (win32k.sys)
12db: 99e864c4 NtGdiUnmapMemFont [1] (win32k.sys)
12dc: 99db466d NtGdiDrawStream [3] (win32k.sys)
12dd: 99d4b1b1 NtGdiDwmGetDirtyRgn [5] (win32k.sys)
12de: 99dbd5db NtGdiSfmGetNotificationTokens [3] (win32k.sys)
12df: 99d64b50 NtGdiHLSurfGetInformation [4] (win32k.sys)
12e0: 99d6513c NtGdiHLSurfSetInformation [4] (win32k.sys)
12e1: 99d62d1d NtGdiDdDDICreateAllocation [1] (win32k.sys)
12e2: 99d65f80 NtGdiDdDDIQueryResourceInfo [1] (win32k.sys)
12e3: 99d65f9f NtGdiDdDDIOpenResource [1] (win32k.sys)
12e4: 99d6bc28 NtGdiDdDDIDestroyAllocation [1] (win32k.sys)
12e5: 99de9e75 NtGdiDdDDISetAllocationPriority [1] (win32k.sys)
12e6: 99e2e58c NtGdiDdDDIQueryAllocationResidency [1] (win32k.sys)
12e7: 99d14a37 NtGdiDdDDICreateDevice [1] (win32k.sys)
12e8: 99decc0c NtGdiDdDDIDestroyDevice [1] (win32k.sys)
12e9: 99d14a56 NtGdiDdDDICreateContext [1] (win32k.sys)
12ea: 99decc2b NtGdiDdDDIDestroyContext [1] (win32k.sys)
12eb: 99dd92f7 NtGdiDdDDICreateSynchronizationObject [1] (win32k.sys)
12ec: 99e65677 NtGdiDdDDIOpenSynchronizationObject [1] (win32k.sys)
12ed: 99dd9335 NtGdiDdDDIDestroySynchronizationObject [1] (win32k.sys)
12ee: 99e65696 NtGdiDdDDIWaitForSynchronizationObject [1] (win32k.sys)
12ef: 99dd9316 NtGdiDdDDISignalSynchronizationObject [1] (win32k.sys)
12f0: 99e656b5 NtGdiDdDDIGetRuntimeData [1] (win32k.sys)
12f1: 99d14c49 NtGdiDdDDIQueryAdapterInfo [1] (win32k.sys)
12f2: 99d52a63 NtGdiDdDDILock [1] (win32k.sys)
12f3: 99d52a82 NtGdiDdDDIUnlock [1] (win32k.sys)
12f4: 99dea333 NtGdiDdDDIGetDisplayModeList [1] (win32k.sys)
12f5: 99d149e6 NtGdiDdDDISetDisplayMode [1] (win32k.sys)
12f6: 99e656d4 NtGdiDdDDIGetMultisampleMethodList [1] (win32k.sys)
12f7: 99dbe782 NtGdiDdDDIPresent [1] (win32k.sys)
12f8: 99dbd819 NtGdiDdDDIRender [1] (win32k.sys)
12f9: 99d009c9 NtGdiDdDDIOpenAdapterFromDeviceName [1] (win32k.sys)
12fa: 99d14a75 NtGdiDdDDIOpenAdapterFromHdc [1] (win32k.sys)
12fb: 99d16e32 NtGdiDdDDICloseAdapter [1] (win32k.sys)
12fc: 99de1c95 NtGdiDdDDIGetSharedPrimaryHandle [1] (win32k.sys)
12fd: 99d16e57 NtGdiDdDDIEscape [1] (win32k.sys)
12fe: 99e656f3 NtGdiDdDDIQueryStatistics [1] (win32k.sys)
12ff: 99d0ec31 NtGdiDdDDISetVidPnSourceOwner [1] (win32k.sys)
1300: 99dbd7f4 NtGdiDdDDIGetPresentHistory [1] (win32k.sys)
1301: 99d0a1d5 NtGdiDdDDIGetPresentQueueEvent [2] (win32k.sys)
1302: 99e65712 NtGdiDdDDICreateOverlay [1] (win32k.sys)
1303: 99e65731 NtGdiDdDDIUpdateOverlay [1] (win32k.sys)
1304: 99e65750 NtGdiDdDDIFlipOverlay [1] (win32k.sys)
1305: 99e6576f NtGdiDdDDIDestroyOverlay [1] (win32k.sys)
1306: 99dbe4d0 NtGdiDdDDIWaitForVerticalBlankEvent [1] (win32k.sys)
1307: 99e6578e NtGdiDdDDISetGammaRamp [1] (win32k.sys)
1308: 99dbe3f9 NtGdiDdDDIGetDeviceState [1] (win32k.sys)
1309: 99dd4efc NtGdiDdDDICreateDCFromMemory [1] (win32k.sys)
130a: 99dd4ce1 NtGdiDdDDIDestroyDCFromMemory [1] (win32k.sys)
130b: 99dea314 NtGdiDdDDISetContextSchedulingPriority [1] (win32k.sys)
130c: 99e657ad NtGdiDdDDIGetContextSchedulingPriority [1] (win32k.sys)
130d: 99d06e81 NtGdiDdDDISetProcessSchedulingPriorityClass [2] (win32k.sys)
130e: 99e657cc NtGdiDdDDIGetProcessSchedulingPriorityClass [2] (win32k.sys)
130f: 99e657eb NtGdiDdDDIReleaseProcessVidPnSourceOwners [1] (win32k.sys)
1310: 99dd7f23 NtGdiDdDDIGetScanLine [1] (win32k.sys)
1311: 99dd8e6c NtGdiDdDDISetQueuedLimit [1] (win32k.sys)
1312: 99e65823 NtGdiDdDDIPollDisplayChildren [1] (win32k.sys)
1313: 99e65842 NtGdiDdDDIInvalidateActiveVidPn [1] (win32k.sys)
1314: 99e65861 NtGdiDdDDICheckOcclusion [1] (win32k.sys)
1315: 99e65880 NtGdiDdDDIWaitForIdle [1] (win32k.sys)
1316: 99dbe50e NtGdiDdDDICheckMonitorPowerState [1] (win32k.sys)
1317: 99dd8838 NtGdiDdDDICheckExclusiveOwnership [0] (win32k.sys)
1318: 99e6589f NtGdiDdDDISetDisplayPrivateDriverFormat [1] (win32k.sys)
1319: 99e6696a NtGdiDdDDISharedPrimaryLockNotification [1] (win32k.sys)
131a: 99e669d9 NtGdiDdDDISharedPrimaryUnLockNotification [1] (win32k.sys)
131b: 99e658be NtGdiDdDDICreateKeyedMutex [1] (win32k.sys)
131c: 99e658dd NtGdiDdDDIOpenKeyedMutex [1] (win32k.sys)
131d: 99e658fc NtGdiDdDDIDestroyKeyedMutex [1] (win32k.sys)
131e: 99e6591b NtGdiDdDDIAcquireKeyedMutex [1] (win32k.sys)
131f: 99e6593a NtGdiDdDDIReleaseKeyedMutex [1] (win32k.sys)
1320: 99dd8664 NtGdiDdDDIConfigureSharedResource [1] (win32k.sys)
1321: 99e65959 NtGdiDdDDIGetOverlayState [1] (win32k.sys)
1322: 99dbe4ef NtGdiDdDDICheckVidPnExclusiveOwnership [1] (win32k.sys)
1323: 99dd88fa NtGdiDdDDICheckSharedResourceAccess [1] (win32k.sys)
1324: 99dd160e DxgStubGetDC [2] (win32k.sys)
1325: 99dfb612 DxgStubValidateTextureStageState [1] (win32k.sys)
1326: 99e94511 NtGdiGetNumberOfPhysicalMonitors [2] (win32k.sys)
1327: 99e94540 NtGdiGetPhysicalMonitors [4] (win32k.sys)
1328: 99e94ee9 NtGdiGetPhysicalMonitorDescription [3] (win32k.sys)
1329: 99e951fd NtGdiDestroyPhysicalMonitor [1] (win32k.sys)
132a: 99e94f8e NtGdiDDCCIGetVCPFeature [5] (win32k.sys)
132b: 99e95020 NtGdiDDCCISetVCPFeature [3] (win32k.sys)
132c: 99e95036 NtGdiDDCCISaveCurrentSettings [1] (win32k.sys)
132d: 99e953a0 NtGdiDDCCIGetCapabilitiesStringLength [2] (win32k.sys)
132e: 99e953ff NtGdiDDCCIGetCapabilitiesString [3] (win32k.sys)
132f: 99e9504c NtGdiDDCCIGetTimingReport [2] (win32k.sys)
1330: 99e65baa NtGdiDdCreateFullscreenSprite [4] (win32k.sys)
1331: 99e65bba NtGdiDdNotifyFullscreenSpriteUpdate [2] (win32k.sys)
1332: 99e65bca NtGdiDdDestroyFullscreenSprite [2] (win32k.sys)
1333: 99e65bda NtGdiDdQueryVisRgnUniqueness [0] (win32k.sys)
1334: 99e2fd83 NtUserSetMirrorRendering [2] (win32k.sys)
1335: 99e2fe08 NtUserShowSystemCursor [1] (win32k.sys)
1336: 99dead78 NtUserMagControl [2] (win32k.sys)
1337: 99deaede NtUserMagSetContextInformation [4] (win32k.sys)
1338: 99e3402a NtUserMagGetContextInformation [4] (win32k.sys)
1339: 99ded135 NtUserHwndQueryRedirectionInfo [4] (win32k.sys)
133a: 99ddda45 NtUserHwndSetRedirectionInfo [4] (win32k.sys)


Blog Comments
GynvaelColdwind Posted: Tuesday, January 20 2009 08:10.28 CST
Once again, thanks for sharing ;>

renzosilv Posted: Monday, July 26 2010 09:42.02 CDT
Would you please share on how you obtained this ssdt ?  I would really appreciate it!  I need the command for windbg so I can obtain the one on my machine.  Thanks in advance

renzosilv Posted: Monday, July 26 2010 09:42.54 CDT
Also I know that dps nt!KiServiceTable L190  gets me it but it doesnt give me the first 200 names for some reason and I really need them!

omeg Posted: Thursday, July 29 2010 07:34.46 CDT
@renzosilv:
I used MS public symbols for the kernel. You can use dbghelp.dll from your code, or the 'x' command in windbg to search for specific name(s). Also, KeServiceDescriptorTable is an export in ntoskrnl, so I only needed symbols to get KeServiceDescriptorTableShadow.



Add New Comment
Comment:









There are 31,156 total registered users.


Recently Created Topics
Information on the t...
Feb/08
Information on the m...
Feb/07
Order Finax, Fincar ...
Feb/07
Information on the m...
Feb/07
Order Proscar (Finas...
Feb/07
Order Proscar, Finax...
Feb/07
Order Finasteride, F...
Feb/07
How to view IDA Pro'...
Nov/02
reverse MC9S12DG128
Oct/07
Looking for an advan...
Mar/21


Recent Forum Posts
Looking for an advan...
tthtlc
Looking for an advan...
tthtlc
Looking for an advan...
clightning
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo


Recent Blog Entries
nieo
Mar/22
Android Application Reversing

halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

More ...


Recent Blog Comments
ComPuer on:
May/14
Android Application Reversing

nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit