blob: 37cad44d3e72d799ba83747a8adf44484bb032cf (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
|
ZwQueryObject
ZwSetInformationObject
ZwDuplicateObject
ZwMakeTemporaryObject
ZwClose
ZwQuerySecurityObject
ZwSetSecurityObject
ZwCreateDirectoryObject
ZwOpenDirectoryObject
ZwQueryDirectoryObject
ZwCreateSymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
ZwQuerySystemInformation
ZwSetSystemInformation
ZwQuerySystemEnvironmentValue
ZwSetSystemEnvironmentValue
ZwShutdownSystem
ZwSystemDebugControl
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwQueryVirtualMemory
ZwProtectVirtualMemory
ZwReadVirtualMemory
ZwWriteVirtualMemory
ZwLockVirtualMemory
ZwUnlockVirtualMemory
ZwFlushVirtualMemory
ZwAllocateUserPhysicalPages
ZwFreeUserPhysicalPages
ZwMapUserPhysicalPages
ZwGetWriteWatch
ZwResetWriteWatch
ZwCreateSection
ZwOpenSection
ZwQuerySection
ZwExtendSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwAreMappedFilesTheSame
ZwCreateThread
ZwOpenThread
ZwTerminateThread
ZwQueryInformationThread
ZwSetInformationThread
ZwSuspendThread
ZwResumeThread
ZwGetContextThread
ZwSetContextThread
ZwQueueApcThread
ZwTestAlert
ZwAlertThread
ZwAlertResumeThread
ZwRegisterThreadTerminatePort
ZwImpersonateThread
ZwImpersonateAnonymousToken
ZwCreateProcess
ZwCreateUserProcess
ZwOpenProcess
ZwTerminateProcess
ZwQueryInformationProcess
ZwSetInformationProcess
ZwFlushInstructionCache
RtlCreateProcessParameters
RtlDestroyProcessParameters
RtlNormalizeProcessParams
RtlCreateQueryDebugBuffer
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
ZwCreateJobObject
ZwOpenJobObject
ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwQueryInformationJobObject
ZwSetInformationJobObject
ZwCreateToken
ZwOpenProcessToken
ZwOpenThreadToken
ZwDuplicateToken
ZwFilterToken
ZwAdjustPrivilegesToken
ZwAdjustGroupsToken
ZwQueryInformationToken
ZwSetInformationToken
ZwWaitForSingleObject
ZwSignalAndWaitForSingleObject
ZwWaitForMultipleObjects
ZwCreateTimer
ZwOpenTimer
ZwCancelTimer
ZwSetTimer
ZwQueryTimer
ZwCreateEvent
ZwOpenEvent
ZwSetEvent
ZwPulseEvent
ZwResetEvent
ZwClearEvent
ZwQueryEvent
ZwCreateSemaphore
ZwOpenSemaphore
ZwReleaseSemaphore
ZwQuerySemaphore
ZwCreateMutant
ZwOpenMutant
ZwReleaseMutant
ZwQueryMutant
ZwCreateIoCompletion
ZwOpenIoCompletion
ZwSetIoCompletion
ZwRemoveIoCompletion
ZwQueryIoCompletion
ZwCreateEventPair
ZwOpenEventPair
ZwWaitLowEventPair
ZwSetLowEventPair
ZwWaitHighEventPair
ZwSetHighEventPair
ZwSetLowWaitHighEventPair
ZwSetHighWaitLowEventPair
ZwQuerySystemTime
ZwSetSystemTime
ZwQueryPerformanceCounter
ZwSetTimerResolution
ZwQueryTimerResolution
ZwDelayExecution
ZwYieldExecution
ZwCreateProfile
ZwSetIntervalProfile
ZwQueryIntervalProfile
ZwStartProfile
ZwStopProfile
ZwCreatePort
ZwCreateWaitablePort
ZwConnectPort
ZwSecureConnectPort
ZwListenPort
ZwAcceptConnectPort
ZwCompleteConnectPort
ZwRequestPort
ZwRequestWaitReplyPort
ZwReplyPort
ZwReplyWaitReplyPort
ZwReplyWaitReceivePort
ZwReplyWaitReceivePortEx
ZwReadRequestData
ZwWriteRequestData
ZwQueryInformationPort
ZwImpersonateClientOfPort
CsrClientCallServer
CsrPortHandle
ZwLoadDriver
ZwUnloadDriver
ZwCreateFile
ZwOpenFile
ZwDeleteFile
ZwFlushBuffersFile
ZwCancelIoFile
ZwCancelIoFileEx
ZwReadFile
ZwWriteFile
ZwReadFileScatter
ZwWriteFileGather
ZwLockFile
ZwUnlockFile
ZwDeviceIoControlFile
ZwFsControlFile
ZwNotifyChangeDirectoryFile
ZwQueryEaFile
ZwSetEaFile
ZwCreateNamedPipeFile
ZwCreateMailslotFile
ZwQueryVolumeInformationFile
ZwSetVolumeInformationFile
ZwQueryQuotaInformationFile
ZwSetQuotaInformationFile
ZwQueryAttributesFile
ZwQueryFullAttributesFile
ZwQueryDirectoryFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateKey
ZwOpenKey
ZwDeleteKey
ZwFlushKey
ZwSaveKey
ZwSaveMergedKeys
ZwRestoreKey
ZwLoadKey
ZwLoadKey2
ZwUnloadKey
ZwQueryOpenSubKeys
ZwReplaceKey
ZwSetInformationKey
ZwQueryKey
ZwEnumerateKey
ZwNotifyChangeKey
ZwNotifyChangeMultipleKeys
ZwDeleteValueKey
ZwSetValueKey
ZwQueryValueKey
ZwEnumerateValueKey
ZwQueryMultipleValueKey
ZwInitializeRegistry
ZwPrivilegeCheck
ZwPrivilegeObjectAuditAlarm
ZwPrivilegedServiceAuditAlarm
ZwAccessCheck
ZwAccessCheckAndAuditAlarm
ZwAccessCheckByType
ZwAccessCheckByTypeResultList
ZwOpenObjectAuditAlarm
ZwCloseObjectAuditAlarm
ZwDeleteObjectAuditAlarm
ZwAccessCheckByTypeAndAuditAlarm
ZwAccessCheckByTypeResultListAndAuditAlarm
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
ZwIsSystemResumeAutomatic
ZwSetThreadExecutionState
ZwGetDevicePowerState
ZwSetSystemPowerState
ZwInitiatePowerAction
ZwPowerInformation
ZwPlugPlayControl
ZwGetPlugPlayEvent
ZwCreateDebugObject
ZwDebugActiveProcess
ZwRemoveProcessDebug
ZwWaitForDebugEvent
ZwDebugContinue
ZwSetInformationDebugObject
ZwQueryDebugFilterState
ZwSetDebugFilterState
ZwRaiseException
ZwContinue
ZwQueryDefaultLocale
ZwSetDefaultLocale
ZwQueryDefaultUILanguage
ZwSetDefaultUILanguage
ZwQueryInstallUILanguage
ZwAllocateLocallyUniqueId
ZwAllocateUuids
ZwSetUuidSeed
ZwAddAtom
ZwFindAtom
ZwDeleteAtom
ZwQueryInformationAtom
ZwFlushWriteBuffer
ZwRaiseHardError
ZwSetDefaultHardErrorPort
ZwDisplayString
ZwCreatePagingFile
ZwSetLdtEntries
ZwVdmControl
LdrLoadDll
LdrUnloadDll
memset
sprintf
_snprintf
vsprintf
_vsnprintf
|
