home *** CD-ROM | disk | FTP | other *** search
Unknown | 2006-05-17 | 3.3 KB |
open in:
MacOS 8.1
|
Win98
|
DOS
view JSON data
|
view as text
This file was not able to be converted.
This format is not currently supported by dexvert.
Confidence | Program | Detection | Match Type | Support
|
---|
100%
| file
| data
| default
|
|
hex view+--------+-------------------------+-------------------------+--------+--------+
|00000000| 00 00 00 00 00 a1 f8 4c | 03 00 85 c0 b9 4e e6 40 |.......L|.....N.@|
|00000010| bb 74 04 3b c1 75 19 a1 | 7c 45 03 00 8b 00 35 f8 |.t.;.u..||E....5.|
|00000020| 4c 03 00 a3 f8 4c 03 00 | 75 06 89 0d f8 4c 03 00 |L....L..|u....L..|
|00000030| e9 47 a8 fd ff cc cc cc | 08 5f 02 00 00 00 00 00 |.G......|._......|
|00000040| 00 00 00 00 f4 6a 02 00 | 94 43 02 00 f4 5e 02 00 |.....j..|.C...^..|
|00000050| 00 00 00 00 00 00 00 00 | 56 6b 02 00 80 43 02 00 |........|Vk...C..|
|00000060| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000070| 00 00 00 00 2c 6b 02 00 | 18 6b 02 00 02 6b 02 00 |....,k..|.k...k..|
|00000080| 42 6b 02 00 00 00 00 00 | 80 61 02 00 9c 61 02 00 |Bk......|.a...a..|
|00000090| b4 61 02 00 d0 61 02 00 | e4 61 02 00 f6 61 02 00 |.a...a..|.a...a..|
|000000a0| 02 62 02 00 1a 62 02 00 | 2c 62 02 00 44 62 02 00 |.b...b..|,b..Db..|
|000000b0| 56 62 02 00 74 62 02 00 | 96 62 02 00 ae 62 02 00 |Vb..tb..|.b...b..|
|000000c0| bc 62 02 00 d4 62 02 00 | f6 62 02 00 0e 63 02 00 |.b...b..|.b...c..|
|000000d0| 26 63 02 00 44 63 02 00 | 56 63 02 00 6e 63 02 00 |&c..Dc..|Vc..nc..|
|000000e0| 92 63 02 00 a6 63 02 00 | ba 63 02 00 d2 63 02 00 |.c...c..|.c...c..|
|000000f0| ee 63 02 00 06 64 02 00 | 10 64 02 00 1a 64 02 00 |.c...d..|.d...d..|
|00000100| 24 64 02 00 2e 64 02 00 | 38 64 02 00 42 64 02 00 |$d...d..|8d..Bd..|
|00000110| 4e 64 02 00 5a 64 02 00 | 68 64 02 00 72 64 02 00 |Nd..Zd..|hd..rd..|
|00000120| 7e 64 02 00 88 64 02 00 | 92 64 02 00 aa 64 02 00 |~d...d..|.d...d..|
|00000130| be 64 02 00 de 64 02 00 | f6 64 02 00 16 65 02 00 |.d...d..|.d...e..|
|00000140| 2a 65 02 00 46 65 02 00 | 58 65 02 00 62 65 02 00 |*e..Fe..|Xe..be..|
|00000150| 7c 65 02 00 94 65 02 00 | b0 65 02 00 c0 65 02 00 ||e...e..|.e...e..|
|00000160| ce 65 02 00 e0 65 02 00 | f2 65 02 00 08 66 02 00 |.e...e..|.e...f..|
|00000170| 18 66 02 00 30 66 02 00 | 48 66 02 00 54 66 02 00 |.f..0f..|Hf..Tf..|
|00000180| 76 61 02 00 6a 66 02 00 | 80 66 02 00 90 66 02 00 |va..jf..|.f...f..|
|00000190| 9a 66 02 00 b0 66 02 00 | be 66 02 00 ce 66 02 00 |.f...f..|.f...f..|
|000001a0| e8 66 02 00 02 67 02 00 | 1c 67 02 00 2a 67 02 00 |.f...g..|.g..*g..|
|000001b0| 36 67 02 00 4a 67 02 00 | 60 67 02 00 70 67 02 00 |6g..Jg..|`g..pg..|
|000001c0| 7a 67 02 00 8c 67 02 00 | 98 67 02 00 a6 67 02 00 |zg...g..|.g...g..|
|000001d0| c0 67 02 00 d8 67 02 00 | f2 67 02 00 0c 68 02 00 |.g...g..|.g...h..|
|000001e0| 24 68 02 00 3a 68 02 00 | 5c 68 02 00 6a 68 02 00 |$h..:h..|\h..jh..|
|000001f0| 76 68 02 00 8a 68 02 00 | 98 68 02 00 a6 68 02 00 |vh...h..|.h...h..|
|00000200| b4 68 02 00 ca 68 02 00 | d8 68 02 00 f4 68 02 00 |.h...h..|.h...h..|
|00000210| fe 68 02 00 0a 69 02 00 | 20 69 02 00 40 69 02 00 |.h...i..| i..@i..|
|00000220| 5c 69 02 00 6c 69 02 00 | 80 69 02 00 8e 69 02 00 |\i..li..|.i...i..|
|00000230| a2 69 02 00 ac 69 02 00 | b6 69 02 00 cc 69 02 00 |.i...i..|.i...i..|
|00000240| ea 69 02 00 02 6a 02 00 | 18 6a 02 00 30 6a 02 00 |.i...j..|.j..0j..|
|00000250| 3c 6a 02 00 5c 6a 02 00 | 66 6a 02 00 80 6a 02 00 |<j..\j..|fj...j..|
|00000260| 90 6a 02 00 a6 6a 02 00 | b6 6a 02 00 ce 6a 02 00 |.j...j..|.j...j..|
|00000270| e6 6a 02 00 62 61 02 00 | 4c 61 02 00 2e 61 02 00 |.j..ba..|La...a..|
|00000280| 5e 66 02 00 10 61 02 00 | 5e 6b 02 00 00 00 00 00 |^f...a..|^k......|
|00000290| 5e 00 45 78 49 6e 74 65 | 72 6c 6f 63 6b 65 64 50 |^.ExInte|rlockedP|
|000002a0| 6f 70 45 6e 74 72 79 53 | 4c 69 73 74 00 00 60 00 |opEntryS|List..`.|
|000002b0| 45 78 49 6e 74 65 72 6c | 6f 63 6b 65 64 50 75 73 |ExInterl|ockedPus|
|000002c0| 68 45 6e 74 72 79 53 4c | 69 73 74 00 ab 01 49 6f |hEntrySL|ist...Io|
|000002d0| 66 43 6f 6d 70 6c 65 74 | 65 52 65 71 75 65 73 74 |fComplet|eRequest|
|000002e0| 00 00 69 02 4d 6d 4d 61 | 70 4c 6f 63 6b 65 64 50 |..i.MmMa|pLockedP|
|000002f0| 61 67 65 73 00 00 3e 04 | 5a 77 43 6c 6f 73 65 00 |ages..>.|ZwClose.|
|00000300| 63 04 5a 77 4f 70 65 6e | 53 79 6d 62 6f 6c 69 63 |c.ZwOpen|Symbolic|
|00000310| 4c 69 6e 6b 4f 62 6a 65 | 63 74 00 00 87 03 52 74 |LinkObje|ct....Rt|
|00000320| 6c 49 6e 69 74 55 6e 69 | 63 6f 64 65 53 74 72 69 |lInitUni|codeStri|
|00000330| 6e 67 00 00 76 04 5a 77 | 51 75 65 72 79 53 79 6d |ng..v.Zw|QuerySym|
|00000340| 62 6f 6c 69 63 4c 69 6e | 6b 4f 62 6a 65 63 74 00 |bolicLin|kObject.|
|00000350| d2 02 4f 62 51 75 65 72 | 79 4e 61 6d 65 53 74 72 |..ObQuer|yNameStr|
|00000360| 69 6e 67 00 78 04 5a 77 | 51 75 65 72 79 56 61 6c |ing.x.Zw|QueryVal|
|00000370| 75 65 4b 65 79 00 5f 04 | 5a 77 4f 70 65 6e 4b 65 |ueKey._.|ZwOpenKe|
|00000380| 79 00 f0 02 50 73 43 72 | 65 61 74 65 53 79 73 74 |y...PsCr|eateSyst|
|00000390| 65 6d 54 68 72 65 61 64 | 00 00 32 01 49 6f 44 65 |emThread|..2.IoDe|
|000003a0| 6c 65 74 65 44 65 76 69 | 63 65 00 00 2e 01 49 6f |leteDevi|ce....Io|
|000003b0| 43 72 65 61 74 65 53 79 | 6d 62 6f 6c 69 63 4c 69 |CreateSy|mbolicLi|
|000003c0| 6e 6b 00 00 27 01 49 6f | 43 72 65 61 74 65 44 65 |nk..'.Io|CreateDe|
|000003d0| 76 69 63 65 00 00 09 03 | 50 73 53 65 74 4c 6f 61 |vice....|PsSetLoa|
|000003e0| 64 49 6d 61 67 65 4e 6f | 74 69 66 79 52 6f 75 74 |dImageNo|tifyRout|
|000003f0| 69 6e 65 00 4d 00 45 78 | 49 6e 69 74 69 61 6c 69 |ine.M.Ex|Initiali|
|00000400| 7a 65 4e 50 61 67 65 64 | 4c 6f 6f 6b 61 73 69 64 |zeNPaged|Lookasid|
|00000410| 65 4c 69 73 74 00 3a 00 | 45 78 41 6c 6c 6f 63 61 |eList.:.|ExAlloca|
|00000420| 74 65 50 6f 6f 6c 57 69 | 74 68 54 61 67 00 47 00 |tePoolWi|thTag.G.|
|00000430| 45 78 46 72 65 65 50 6f | 6f 6c 00 00 e8 01 4b 65 |ExFreePo|ol....Ke|
|00000440| 4c 65 61 76 65 43 72 69 | 74 69 63 61 6c 52 65 67 |LeaveCri|ticalReg|
|00000450| 69 6f 6e 00 32 00 45 78 | 41 63 71 75 69 72 65 52 |ion.2.Ex|AcquireR|
|00000460| 65 73 6f 75 72 63 65 45 | 78 63 6c 75 73 69 76 65 |esourceE|xclusive|
|00000470| 4c 69 74 65 00 00 c3 01 | 4b 65 45 6e 74 65 72 43 |Lite....|KeEnterC|
|00000480| 72 69 74 69 63 61 6c 52 | 65 67 69 6f 6e 00 28 02 |riticalR|egion.(.|
|00000490| 4b 65 57 61 69 74 46 6f | 72 53 69 6e 67 6c 65 4f |KeWaitFo|rSingleO|
|000004a0| 62 6a 65 63 74 00 33 00 | 45 78 41 63 71 75 69 72 |bject.3.|ExAcquir|
|000004b0| 65 52 65 73 6f 75 72 63 | 65 53 68 61 72 65 64 4c |eResourc|eSharedL|
|000004c0| 69 74 65 00 fd 01 4b 65 | 52 65 6c 65 61 73 65 4d |ite...Ke|ReleaseM|
|000004d0| 75 74 65 78 00 00 73 00 | 45 78 52 65 6c 65 61 73 |utex..s.|ExReleas|
|000004e0| 65 52 65 73 6f 75 72 63 | 65 4c 69 74 65 00 63 00 |eResourc|eLite.c.|
|000004f0| 45 78 49 73 52 65 73 6f | 75 72 63 65 41 63 71 75 |ExIsReso|urceAcqu|
|00000500| 69 72 65 64 45 78 63 6c | 75 73 69 76 65 4c 69 74 |iredExcl|usiveLit|
|00000510| 65 00 d8 01 4b 65 49 6e | 69 74 69 61 6c 69 7a 65 |e...KeIn|itialize|
|00000520| 45 76 65 6e 74 00 db 01 | 4b 65 49 6e 69 74 69 61 |Event...|KeInitia|
|00000530| 6c 69 7a 65 4d 75 74 65 | 78 00 de 01 4b 65 49 6e |lizeMute|x...KeIn|
|00000540| 69 74 69 61 6c 69 7a 65 | 53 70 69 6e 4c 6f 63 6b |itialize|SpinLock|
|00000550| 00 00 50 00 45 78 49 6e | 69 74 69 61 6c 69 7a 65 |..P.ExIn|itialize|
|00000560| 52 65 73 6f 75 72 63 65 | 4c 69 74 65 00 00 41 00 |Resource|Lite..A.|
|00000570| 45 78 44 65 6c 65 74 65 | 52 65 73 6f 75 72 63 65 |ExDelete|Resource|
|00000580| 4c 69 74 65 00 00 e1 04 | 77 63 73 6e 63 70 79 00 |Lite....|wcsncpy.|
|00000590| dc 04 77 63 73 63 70 79 | 00 00 da 04 77 63 73 63 |..wcscpy|....wcsc|
|000005a0| 68 72 00 00 e2 04 77 63 | 73 72 63 68 72 00 d9 04 |hr....wc|srchr...|
|000005b0| 77 63 73 63 61 74 00 00 | de 04 77 63 73 6c 65 6e |wcscat..|..wcslen|
|000005c0| 00 00 b0 04 5f 77 63 73 | 69 63 6d 70 00 00 d3 04 |...._wcs|icmp....|
|000005d0| 73 77 70 72 69 6e 74 66 | 00 00 94 04 5a 77 57 72 |swprintf|....ZwWr|
|000005e0| 69 74 65 46 69 6c 65 00 | e4 04 77 63 73 73 74 72 |iteFile.|..wcsstr|
|000005f0| 00 00 b2 04 5f 77 63 73 | 6e 69 63 6d 70 00 c9 04 |...._wcs|nicmp...|
|00000600| 73 74 72 63 68 72 00 00 | cf 04 73 74 72 6e 63 70 |strchr..|..strncp|
|00000610| 79 00 f3 02 50 73 47 65 | 74 43 75 72 72 65 6e 74 |y...PsGe|tCurrent|
|00000620| 50 72 6f 63 65 73 73 49 | 64 00 6f 03 52 74 6c 46 |ProcessI|d.o.RtlF|
|00000630| 72 65 65 41 6e 73 69 53 | 74 72 69 6e 67 00 e1 03 |reeAnsiS|tring...|
|00000640| 52 74 6c 55 6e 69 63 6f | 64 65 53 74 72 69 6e 67 |RtlUnico|deString|
|00000650| 54 6f 41 6e 73 69 53 74 | 72 69 6e 67 00 00 73 03 |ToAnsiSt|ring..s.|
|00000660| 52 74 6c 46 72 65 65 55 | 6e 69 63 6f 64 65 53 74 |RtlFreeU|nicodeSt|
|00000670| 72 69 6e 67 00 00 1d 03 | 52 74 6c 41 6e 73 69 53 |ring....|RtlAnsiS|
|00000680| 74 72 69 6e 67 54 6f 55 | 6e 69 63 6f 64 65 53 74 |tringToU|nicodeSt|
|00000690| 72 69 6e 67 00 00 84 03 | 52 74 6c 49 6e 69 74 41 |ring....|RtlInitA|
|000006a0| 6e 73 69 53 74 72 69 6e | 67 00 56 01 49 6f 47 65 |nsiStrin|g.V.IoGe|
|000006b0| 74 52 65 6c 61 74 65 64 | 44 65 76 69 63 65 4f 62 |tRelated|DeviceOb|
|000006c0| 6a 65 63 74 00 00 35 01 | 49 6f 44 65 74 61 63 68 |ject..5.|IoDetach|
|000006d0| 44 65 76 69 63 65 00 00 | b5 04 5f 77 63 73 75 70 |Device..|.._wcsup|
|000006e0| 72 00 13 01 49 6f 41 74 | 74 61 63 68 44 65 76 69 |r...IoAt|tachDevi|
|000006f0| 63 65 42 79 50 6f 69 6e | 74 65 72 00 d9 02 4f 62 |ceByPoin|ter...Ob|
|00000700| 66 44 65 72 65 66 65 72 | 65 6e 63 65 4f 62 6a 65 |fDerefer|enceObje|
|00000710| 63 74 00 00 d4 02 4f 62 | 52 65 66 65 72 65 6e 63 |ct....Ob|Referenc|
|00000720| 65 4f 62 6a 65 63 74 42 | 79 48 61 6e 64 6c 65 00 |eObjectB|yHandle.|
|00000730| 43 04 5a 77 43 72 65 61 | 74 65 46 69 6c 65 00 00 |C.ZwCrea|teFile..|
|00000740| 0f 02 4b 65 53 65 74 45 | 76 65 6e 74 00 00 43 01 |..KeSetE|vent..C.|
|00000750| 49 6f 46 72 65 65 57 6f | 72 6b 49 74 65 6d 00 00 |IoFreeWo|rkItem..|
|00000760| 6f 01 49 6f 51 75 65 75 | 65 57 6f 72 6b 49 74 65 |o.IoQueu|eWorkIte|
|00000770| 6d 00 10 01 49 6f 41 6c | 6c 6f 63 61 74 65 57 6f |m...IoAl|locateWo|
|00000780| 72 6b 49 74 65 6d 00 00 | aa 01 49 6f 66 43 61 6c |rkItem..|..IofCal|
|00000790| 6c 44 72 69 76 65 72 00 | f4 02 50 73 47 65 74 43 |lDriver.|..PsGetC|
|000007a0| 75 72 72 65 6e 74 54 68 | 72 65 61 64 49 64 00 00 |urrentTh|readId..|
|000007b0| 3a 03 52 74 6c 43 6f 70 | 79 55 6e 69 63 6f 64 65 |:.RtlCop|yUnicode|
|000007c0| 53 74 72 69 6e 67 00 00 | a8 04 5f 73 74 72 69 63 |String..|.._stric|
|000007d0| 6d 70 00 00 db 04 77 63 | 73 63 6d 70 00 00 41 01 |mp....wc|scmp..A.|
|000007e0| 49 6f 46 72 65 65 49 72 | 70 00 c8 01 4b 65 47 65 |IoFreeIr|p...KeGe|
|000007f0| 74 43 75 72 72 65 6e 74 | 54 68 72 65 61 64 00 00 |tCurrent|Thread..|
|00000800| 0e 01 49 6f 41 6c 6c 6f | 63 61 74 65 49 72 70 00 |..IoAllo|cateIrp.|
|00000810| e0 04 77 63 73 6e 63 6d | 70 00 03 01 49 6e 74 65 |..wcsncm|p...Inte|
|00000820| 72 6c 6f 63 6b 65 64 45 | 78 63 68 61 6e 67 65 00 |rlockedE|xchange.|
|00000830| 1c 01 49 6f 43 61 6e 63 | 65 6c 49 72 70 00 ba 01 |..IoCanc|elIrp...|
|00000840| 4b 65 42 75 67 43 68 65 | 63 6b 45 78 00 00 04 01 |KeBugChe|ckEx....|
|00000850| 49 6e 74 65 72 6c 6f 63 | 6b 65 64 45 78 63 68 61 |Interloc|kedExcha|
|00000860| 6e 67 65 41 64 64 00 00 | 7d 01 49 6f 52 65 6c 65 |ngeAdd..|}.IoRele|
|00000870| 61 73 65 43 61 6e 63 65 | 6c 53 70 69 6e 4c 6f 63 |aseCance|lSpinLoc|
|00000880| 6b 00 06 01 49 6f 41 63 | 71 75 69 72 65 43 61 6e |k...IoAc|quireCan|
|00000890| 63 65 6c 53 70 69 6e 4c | 6f 63 6b 00 a7 04 5f 73 |celSpinL|ock..._s|
|000008a0| 6e 77 70 72 69 6e 74 66 | 00 00 d7 04 74 6f 77 75 |nwprintf|....towu|
|000008b0| 70 70 65 72 00 00 f1 01 | 4b 65 51 75 65 72 79 53 |pper....|KeQueryS|
|000008c0| 79 73 74 65 6d 54 69 6d | 65 00 d2 03 52 74 6c 54 |ystemTim|e...RtlT|
|000008d0| 69 6d 65 46 69 65 6c 64 | 73 54 6f 54 69 6d 65 00 |imeField|sToTime.|
|000008e0| 8c 04 5a 77 53 65 74 56 | 61 6c 75 65 4b 65 79 00 |..ZwSetV|alueKey.|
|000008f0| 97 04 5f 61 6c 6c 64 69 | 76 00 4f 04 5a 77 45 6e |.._alldi|v.O.ZwEn|
|00000900| 75 6d 65 72 61 74 65 4b | 65 79 00 00 d6 04 74 6f |umerateK|ey....to|
|00000910| 77 6c 6f 77 65 72 00 00 | 7a 04 5a 77 52 65 61 64 |wlower..|z.ZwRead|
|00000920| 46 69 6c 65 00 00 6e 04 | 5a 77 51 75 65 72 79 49 |File..n.|ZwQueryI|
|00000930| 6e 66 6f 72 6d 61 74 69 | 6f 6e 46 69 6c 65 00 00 |nformati|onFile..|
|00000940| 84 04 5a 77 53 65 74 49 | 6e 66 6f 72 6d 61 74 69 |..ZwSetI|nformati|
|00000950| 6f 6e 46 69 6c 65 00 00 | 0c 03 50 73 54 65 72 6d |onFile..|..PsTerm|
|00000960| 69 6e 61 74 65 53 79 73 | 74 65 6d 54 68 72 65 61 |inateSys|temThrea|
|00000970| 64 00 87 04 5a 77 53 65 | 74 49 6e 66 6f 72 6d 61 |d...ZwSe|tInforma|
|00000980| 74 69 6f 6e 54 68 72 65 | 61 64 00 00 eb 03 52 74 |tionThre|ad....Rt|
|00000990| 6c 55 70 63 61 73 65 55 | 6e 69 63 6f 64 65 43 68 |lUpcaseU|nicodeCh|
|000009a0| 61 72 00 00 da 02 4f 62 | 66 52 65 66 65 72 65 6e |ar....Ob|fReferen|
|000009b0| 63 65 4f 62 6a 65 63 74 | 00 00 06 03 50 73 53 65 |ceObject|....PsSe|
|000009c0| 74 43 72 65 61 74 65 50 | 72 6f 63 65 73 73 4e 6f |tCreateP|rocessNo|
|000009d0| 74 69 66 79 52 6f 75 74 | 69 6e 65 00 90 04 5a 77 |tifyRout|ine...Zw|
|000009e0| 55 6e 6c 6f 61 64 4b 65 | 79 00 58 04 5a 77 4c 6f |UnloadKe|y.X.ZwLo|
|000009f0| 61 64 4b 65 79 00 4a 04 | 5a 77 44 65 6c 65 74 65 |adKey.J.|ZwDelete|
|00000a00| 56 61 6c 75 65 4b 65 79 | 00 00 44 04 5a 77 43 72 |ValueKey|..D.ZwCr|
|00000a10| 65 61 74 65 4b 65 79 00 | 49 04 5a 77 44 65 6c 65 |eateKey.|I.ZwDele|
|00000a20| 74 65 4b 65 79 00 52 04 | 5a 77 46 6c 75 73 68 4b |teKey.R.|ZwFlushK|
|00000a30| 65 79 00 00 50 04 5a 77 | 45 6e 75 6d 65 72 61 74 |ey..P.Zw|Enumerat|
|00000a40| 65 56 61 6c 75 65 4b 65 | 79 00 72 04 5a 77 51 75 |eValueKe|y.r.ZwQu|
|00000a50| 65 72 79 4b 65 79 00 00 | 0b 02 4b 65 53 65 72 76 |eryKey..|..KeServ|
|00000a60| 69 63 65 44 65 73 63 72 | 69 70 74 6f 72 54 61 62 |iceDescr|iptorTab|
|00000a70| 6c 65 00 00 dd 04 77 63 | 73 63 73 70 6e 00 42 01 |le....wc|scspn.B.|
|00000a80| 49 6f 46 72 65 65 4d 64 | 6c 00 83 02 4d 6d 55 6e |IoFreeMd|l...MmUn|
|00000a90| 6d 61 70 4c 6f 63 6b 65 | 64 50 61 67 65 73 00 00 |mapLocke|dPages..|
|00000aa0| 6a 02 4d 6d 4d 61 70 4c | 6f 63 6b 65 64 50 61 67 |j.MmMapL|ockedPag|
|00000ab0| 65 73 53 70 65 63 69 66 | 79 43 61 63 68 65 00 00 |esSpecif|yCache..|
|00000ac0| 4c 02 4d 6d 42 75 69 6c | 64 4d 64 6c 46 6f 72 4e |L.MmBuil|dMdlForN|
|00000ad0| 6f 6e 50 61 67 65 64 50 | 6f 6f 6c 00 0f 01 49 6f |onPagedP|ool...Io|
|00000ae0| 41 6c 6c 6f 63 61 74 65 | 4d 64 6c 00 a0 04 5f 65 |Allocate|Mdl..._e|
|00000af0| 78 63 65 70 74 5f 68 61 | 6e 64 6c 65 72 33 00 00 |xcept_ha|ndler3..|
|00000b00| 1c 02 4b 65 53 65 74 54 | 69 6d 65 72 00 00 df 01 |..KeSetT|imer....|
|00000b10| 4b 65 49 6e 69 74 69 61 | 6c 69 7a 65 54 69 6d 65 |KeInitia|lizeTime|
|00000b20| 72 00 98 04 5f 61 6c 6c | 6d 75 6c 00 ce 04 73 74 |r..._all|mul...st|
|00000b30| 72 6e 63 6d 70 00 49 01 | 49 6f 47 65 74 43 75 72 |rncmp.I.|IoGetCur|
|00000b40| 72 65 6e 74 50 72 6f 63 | 65 73 73 00 fd 02 50 73 |rentProc|ess...Ps|
|00000b50| 4c 6f 6f 6b 75 70 50 72 | 6f 63 65 73 73 42 79 50 |LookupPr|ocessByP|
|00000b60| 72 6f 63 65 73 73 49 64 | 00 00 6b 04 5a 77 51 75 |rocessId|..k.ZwQu|
|00000b70| 65 72 79 44 69 72 65 63 | 74 6f 72 79 46 69 6c 65 |eryDirec|toryFile|
|00000b80| 00 00 88 04 5a 77 53 65 | 74 53 65 63 75 72 69 74 |....ZwSe|tSecurit|
|00000b90| 79 4f 62 6a 65 63 74 00 | 75 04 5a 77 51 75 65 72 |yObject.|u.ZwQuer|
|00000ba0| 79 53 65 63 75 72 69 74 | 79 4f 62 6a 65 63 74 00 |ySecurit|yObject.|
|00000bb0| 76 03 52 74 6c 47 65 74 | 41 63 65 00 79 03 52 74 |v.RtlGet|Ace.y.Rt|
|00000bc0| 6c 47 65 74 44 61 63 6c | 53 65 63 75 72 69 74 79 |lGetDacl|Security|
|00000bd0| 44 65 73 63 72 69 70 74 | 6f 72 00 00 df 04 77 63 |Descript|or....wc|
|00000be0| 73 6e 63 61 74 00 94 03 | 52 74 6c 49 73 4e 61 6d |sncat...|RtlIsNam|
|00000bf0| 65 4c 65 67 61 6c 44 4f | 53 38 44 6f 74 33 00 00 |eLegalDO|S8Dot3..|
|00000c00| bc 01 4b 65 43 6c 65 61 | 72 45 76 65 6e 74 00 00 |..KeClea|rEvent..|
|00000c10| 14 02 4b 65 53 65 74 50 | 72 69 6f 72 69 74 79 54 |..KeSetP|riorityT|
|00000c20| 68 72 65 61 64 00 0d 03 | 50 73 54 68 72 65 61 64 |hread...|PsThread|
|00000c30| 54 79 70 65 00 00 05 01 | 49 6e 74 65 72 6c 6f 63 |Type....|Interloc|
|00000c40| 6b 65 64 49 6e 63 72 65 | 6d 65 6e 74 00 00 02 01 |kedIncre|ment....|
|00000c50| 49 6e 74 65 72 6c 6f 63 | 6b 65 64 44 65 63 72 65 |Interloc|kedDecre|
|00000c60| 6d 65 6e 74 00 00 21 02 | 4b 65 54 69 63 6b 43 6f |ment..!.|KeTickCo|
|00000c70| 75 6e 74 00 6e 74 6f 73 | 6b 72 6e 6c 2e 65 78 65 |unt.ntos|krnl.exe|
|00000c80| 00 00 00 00 45 78 41 63 | 71 75 69 72 65 46 61 73 |....ExAc|quireFas|
|00000c90| 74 4d 75 74 65 78 00 00 | 4f 00 4b 66 41 63 71 75 |tMutex..|O.KfAcqu|
|00000ca0| 69 72 65 53 70 69 6e 4c | 6f 63 6b 00 01 00 45 78 |ireSpinL|ock...Ex|
|00000cb0| 52 65 6c 65 61 73 65 46 | 61 73 74 4d 75 74 65 78 |ReleaseF|astMutex|
|00000cc0| 00 00 52 00 4b 66 52 65 | 6c 65 61 73 65 53 70 69 |..R.KfRe|leaseSpi|
|00000cd0| 6e 4c 6f 63 6b 00 48 41 | 4c 2e 64 6c 6c 00 1b 03 |nLock.HA|L.dll...|
|00000ce0| 52 74 6c 41 6e 73 69 43 | 68 61 72 54 6f 55 6e 69 |RtlAnsiC|harToUni|
|00000cf0| 63 6f 64 65 43 68 61 72 | 00 00 00 00 00 00 00 00 |codeChar|........|
+--------+-------------------------+-------------------------+--------+--------+