Cracking 2

home *** CD-ROM | disk | FTP | other *** search

/ Cracking 2 / Cracking II..iso / Tools / icedump 6.018 and nticedump 1.9 / wnt / src / ntice324.inc < prev next >

Wrap

Text File | 2000-02-26 | 32.1 KB | 685 lines

nullsub_8 EQU 0x00010331 jSET_DEVICE_FOCUS EQU 0x0001054A jDESTROY_VM EQU 0x00010586 pSavePort_21_A1 EQU 0x000105A5 pRestorePort_21_A1 EQU 0x000105C7 pNew_VMM_F5 EQU 0x000109AF pPatch_VKD EQU 0x000109CD pDefaultWiniceIntHandler EQU 0x00010B44 pINT_0C EQU 0x00010F4A pINT_0D EQU 0x00010FAE pIRQ_03 EQU 0x000118C3 pIRQ_04 EQU 0x000118F8 pIRQ_0C EQU 0x000119FB pINT_0F_INT_57 EQU 0x00011A2C pINT_01 EQU 0x00011A46 pKbdWaitMbOutputReady EQU 0x0001232F pPutBackScanCode EQU 0x00012346 pINT_02 EQU 0x00012843 pWiniceMain EQU 0x000129CD pRestoreLDTR EQU 0x00012E20 pInvalidateLDTR EQU 0x00012E43 pPrintMessage_HotKey EQU 0x0001309F pEnterWiniceBySelfTrace EQU 0x0001320C pVKD_PUT_BYTE EQU 0x0001323E pPrintBreakReason_ EQU 0x0001332D pGetDisplayDriverEntryPoint EQU 0x00013563 nullsub_9 EQU 0x000135AD nullsub_10 EQU 0x000135D3 pSwapIDT_INT_0E EQU 0x000137FA pHookFaults_IDT EQU 0x00013894 pSetWiniceIRQs EQU 0x00013A06 pHookKbdVector_IOAPIC_ EQU 0x00013A87 pHookKbdVector_IOAPIC EQU 0x00013AC5 pHookInt_IDT EQU 0x00013AE3 jNextCPU EQU 0x00013B10 pUnHookInt_IDT EQU 0x00013B39 pReHookInt_IDT EQU 0x00013B68 pHookInt_IDT_ EQU 0x00013BAD pGetWiniceIntJumpTableOffset EQU 0x00013C2E pInitWiniceIntHandlerJumpTable EQU 0x00013C50 pSaveDRx EQU 0x00013D6D pINT_02_IOAPIC EQU 0x00013EDD pSaveRegisters_APIC EQU 0x00013F95 pGetBase_Initial_FS EQU 0x00014060 pGetFSLiniarAddress EQU 0x0001407D pSaveAllRegisters EQU 0x0001408B pSaveProcessorRegisters EQU 0x000141C4 pSaveCPUID EQU 0x0001423B pSendEOI EQU 0x00014410 pSendEOI_ EQU 0x0001445F pEnableIRQ EQU 0x00014497 pDisableIRQ EQU 0x00014506 pEnableIRQ_IOAPIC EQU 0x0001455D pDisableIRQ_IOAPIC EQU 0x000145B9 pDisableAllIRQs EQU 0x000145D8 pDisableAllIRQs_IOAPIC EQU 0x0001467A pGetIRQStatus_IOAPIC EQU 0x00014758 pSetIRQStatus_IOAPIC EQU 0x00014775 pGetIRQStatus_IOAPIC_ EQU 0x00014792 pSetIRQStatus_IOAPIC_ EQU 0x000147A9 c_CPU_i EQU 0x0001481C c_CPU_i_ EQU 0x0001488E c_CPU EQU 0x00014950 jCPU_InvalidProcID EQU 0x000149E1 c_CPU_ProcID EQU 0x00014ADD pPrintCPUFeatures EQU 0x00014B8C pPrintSpecialRegisters EQU 0x00014C77 pPrintAPICInfo EQU 0x00015020 c_LBRECORD EQU 0x000151B2 jLBRECORD_Disable EQU 0x00015203 pRecordLastFaultInfo EQU 0x0001520F pRecordLastBranchInfo EQU 0x0001528F pPrintLastBranchInfo EQU 0x000152D9 pInAxDx EQU 0x00015447 pInAlDx EQU 0x00015452 pOutDxEax EQU 0x0001545C pOutDxAx EQU 0x00015467 pOutDxAl EQU 0x00015477 pByte2HexString EQU 0x00015485 pWord2HexString EQU 0x000154A5 pDword2HexString EQU 0x000154C2 pDword2DecimalString EQU 0x000154FD pWord2DecimalString EQU 0x0001552A pExcludePhysicalMemoryRange EQU 0x00015557 pIsBlockExcluded EQU 0x0001561B pMOV_AL_EDI_safe EQU 0x00015676 pMOV_AX_EDI_safe EQU 0x000156AD pMOV_EAX_EDI_safe EQU 0x000156E7 pMOV_AL_EDI EQU 0x00015721 pMOV_AX_EDI EQU 0x00015737 pMOV_EAX_EDI EQU 0x00015750 pPutFlatByte_safe EQU 0x00015769 pPutFlatByte EQU 0x000157B3 pMOV_EDI_AL EQU 0x000157DC pMOV_EDI_AL_safe EQU 0x000157F0 pMOV_EDI_AX EQU 0x00015825 pMOV_EDI_AX_safe EQU 0x0001583A pMOV_EDI_EAX_safe EQU 0x00015870 pMOV_EDI_EAX EQU 0x000158A5 pREP_CMPSB EQU 0x000158B9 pREP_MOVSB EQU 0x000158CB pREP_MOVSD EQU 0x000158E9 pREP_STOSD EQU 0x00015907 pREP_STOSB EQU 0x00015918 pREP_LODSB EQU 0x00015925 pREP_LODSD EQU 0x00015932 pREPNE_SCASB EQU 0x0001593F pREPNE_SCASW EQU 0x0001594D pMOD_ARG1_ARG0 EQU 0x00015976 pSkipWhiteSpace EQU 0x00015991 pSkipDelimiters EQU 0x000159A2 pSkipNonWhiteSpace EQU 0x000159B3 pGetDecimalDigit EQU 0x000159C6 pGetHexDigit EQU 0x000159D4 pGetDecimalNumber EQU 0x000159F0 pGetHexNumber EQU 0x00015A2A pExpression2Integer EQU 0x00016161 pCheckAddres2 EQU 0x00016359 pCheckAddress EQU 0x0001638F pParseInitLine EQU 0x000163EA nullsub_1 EQU 0x00016506 c_VER_PrintUserInfo EQU 0x00016507 pSetupVideoRegisterInfo_ EQU 0x00016596 pPrintString EQU 0x00016642 pPrintEmptyLine EQU 0x0001675D pStrcpy EQU 0x000168B0 pStrlen EQU 0x000168BE pToUpper EQU 0x000168D6 pStrnicmp_ EQU 0x0001690B pMoveCursor EQU 0x00016949 pMoveCursor_ EQU 0x0001699D pUpdateSomeWindows EQU 0x00016A37 pPrintLine EQU 0x00016A56 pPrintQuestion_ EQU 0x00016ABB pUpdateAllWindows EQU 0x00016B16 pUpdateHistoryWindow EQU 0x00016B61 pUpdateHistoryWindow_ EQU 0x00016BE3 pUpdateCodeWindow EQU 0x00016C5A pShowCodeWindow EQU 0x00017246 pUpdateWatchesWindow EQU 0x000172E1 pUpdateLocalsWindow EQU 0x00017361 pUpdateDataWindow EQU 0x00017373 pPrintGenericRegisters EQU 0x00017927 pUpdateRegistersWindow EQU 0x000179E6 pGetRegisterColor EQU 0x00017E1D pPrintFlags EQU 0x00017E54 pSaveClientRegistersForDisplay EQU 0x00017E9A pGeneralProtectionFault EQU 0x00017EBA pSaveClientRegisters EQU 0x00017F4D pSaveAllClientRegisters EQU 0x0001805B pRestoreAllClientRegisters EQU 0x0001816A pMouse_SelectionOff EQU 0x00018F93 pMouse_Copy_ EQU 0x00019849 pMouse_Paste_ EQU 0x000198AD pEnableWin95Commands EQU 0x0001A020 pExecUserCommand EQU 0x0001A06C pFindCommand EQU 0x0001A2B2 pPrintToCommandWindow_ EQU 0x0001A409 pV86_1 EQU 0x0001A4E5 pV86_0 EQU 0x0001A4F5 pInsertStringIntoBuffer EQU 0x0001AA8F pEmptyKeyboardBuffer EQU 0x0001B66A pReadOneKey EQU 0x0001B682 pProgramLEDs EQU 0x0001B7DB pKbdWaitMbInputReady EQU 0x0001B844 pProcessScanCode EQU 0x0001B883 jProcessScanCode_Translate EQU 0x0001B9EB pInsertCharIntoBuffer EQU 0x0001BA0B pSkipWord EQU 0x0001BA4C c_InvalidCommand EQU 0x0001BA6C pIsItOnOrOff EQU 0x0001BA78 c_WR EQU 0x0001BB38 c_WHAT_ EQU 0x0001BC04 c_WL EQU 0x0001BEB2 pUpdateSomeWindows_ EQU 0x0001BEF5 c_WATCH EQU 0x0001C112 c_WW EQU 0x0001C23F c_WC EQU 0x0001C38A c_F EQU 0x0001C4BE c_S EQU 0x0001C5BA jS_NoSearchInProgress EQU 0x0001C771 jS_PatternNotFound EQU 0x0001C778 jS_SyntaxError EQU 0x0001C77F jS_PrintMessage EQU 0x0001C784 c_M EQU 0x0001C9C3 unknown_libname_1 EQU 0x0001CAC2 unknown_libname_2 EQU 0x0001CAD2 unknown_libname_3 EQU 0x0001CAE2 c_ES EQU 0x0001CAF2 c_EL EQU 0x0001CB02 c_ET EQU 0x0001CB12 c_E EQU 0x0001CB22 pCopyDelimitedString EQU 0x0001CD42 pGetPattern EQU 0x0001CD56 c_C EQU 0x0001CD9D c_R EQU 0x0001CF7C pUpdateWindows EQU 0x0001D119 unknown_libname_4 EQU 0x0001D12E unknown_libname_5 EQU 0x0001D13E unknown_libname_6 EQU 0x0001D14E c_DL EQU 0x0001D15E c_DS EQU 0x0001D16E c_DT EQU 0x0001D17E c_D EQU 0x0001D18E c_DATA EQU 0x0001D20C c_DEX EQU 0x0001D24B c_EC EQU 0x0001D3FE c_U EQU 0x0001D43F c_X EQU 0x0001D5C1 c_T EQU 0x0001D641 c_P EQU 0x0001D847 c_G EQU 0x0001DB45 c_RS EQU 0x0001DE23 c_ID EQU 0x0001DE4F c_IW EQU 0x0001DE56 c_I_IB EQU 0x0001DE5D c_O_OB EQU 0x0001DF2A c_SET_MOUSE EQU 0x0001E0C2 c_SET_WHEELLINES EQU 0x0001E159 c_CODE EQU 0x0001E1AD c_?_H_HELP EQU 0x0001E22C c_VER EQU 0x0001E407 c_CLS EQU 0x0001E444 c_ALTSCR EQU 0x0001E465 c_SERIAL EQU 0x0001E472 c_ALTKEY EQU 0x0001E670 c_FKEY EQU 0x0001E72E c_COLOR EQU 0x0001E8F9 pIsTraceOn EQU 0x0001EA50 c_ZAP EQU 0x0001EA69 c_SRC EQU 0x0001EAAB c_TABS EQU 0x0001EBC4 c_A EQU 0x0001EC0F c_FORMAT EQU 0x0001ECF3 c_LINES EQU 0x0001ED4D c_LINES_ EQU 0x0001EE57 c_SET EQU 0x0001EFCD pFindSetParameter_ EQU 0x0001F105 pFindSetParameter EQU 0x0001F129 pFindSetParameter__ EQU 0x0001F160 c_OBJDIR EQU 0x0001F18E c_DEVICE EQU 0x0001F1B0 c_OBJTAB EQU 0x0001F1C1 c_ANSWER EQU 0x0001F1DE pCopyUntilWhiteSpace EQU 0x0001F30B c_DIAL EQU 0x0001F321 c_SET_VERBOSE EQU 0x0001F500 c_SET_LOWERCASE EQU 0x0001F549 c_SET_REFERENCE EQU 0x0001F581 c_SET_CASESENSITIVE EQU 0x0001F5B7 c_SET_THREADP EQU 0x0001F5F6 c_BSTAT EQU 0x0001F64D c_MACRO EQU 0x0001F65E c_TYPES EQU 0x0001F671 j_SYM_ EQU 0x0001F687 c_PEEK EQU 0x0001F692 c_POKE EQU 0x0001F69D c_PCI EQU 0x0001F6A8 c_FOBJ EQU 0x0001F6B3 c_WIDTH EQU 0x0001F6D5 c_PAGEIN EQU 0x0001F6E0 c_FIBER EQU 0x0001F6F6 c_NotImplemented EQU 0x0001F701 pDetectVideoCardType EQU 0x0001F70C pInitMonoVideoCard EQU 0x0001F807 c_CSIP EQU 0x0001FC60 c_BC_BD_BE EQU 0x0001FF0E c_BL EQU 0x0002003F c_BPINT EQU 0x0002024F pPrintBPInfo_BPINT EQU 0x000202FC nullsub_3 EQU 0x0002031D nullsub_5 EQU 0x0002031E pEval_Bx EQU 0x0002031F c_BPX EQU 0x000203B9 pPrintBPInfo_BPX EQU 0x000207BF pBD_BPX_BMSG_ EQU 0x00020901 pPrintBPInfo_BMSG EQU 0x00020AFF c_BPM_BPMB EQU 0x00020BE5 c_BPMD EQU 0x00020BEA c_BPMW EQU 0x00020BEF pBE_BPM EQU 0x00020FA2 pBD_BPM EQU 0x00020FD4 c_BPIO EQU 0x00021161 pPrintBPInfo_BPIO EQU 0x00021235 nullsub_4 EQU 0x00021278 pBD_BPIO EQU 0x00021279 pBPIOSetPortInPermissionMap EQU 0x00021285 c_BPR_RangeCheck EQU 0x00021333 pRangeCheck EQU 0x00021473 pCheckDuplicateBP EQU 0x000214CC jNotDuplicateBP EQU 0x0002155F jItsDuplicateBP EQU 0x0002156F pAllocateBP EQU 0x00021602 pSetupBPStruct EQU 0x00021753 pBP_SetModuleName EQU 0x00021863 c_BH EQU 0x0002191F oNew_PM_VMM_INT_0E_ EQU 0x00022040 pIdentifyWiniceBPINT EQU 0x00022D42 pDeactivateBPs EQU 0x00022FBA pDeactivateBPs_safe EQU 0x000230B2 pActivateBPs EQU 0x00023293 pActivateBPs_safe EQU 0x000233D6 pActivate_BPINT EQU 0x000233E1 pINT_41_F003_ EQU 0x00023622 pSetDRx EQU 0x0002367C pSetDR_01237 EQU 0x000236F3 pCalledOnTaskSwitch EQU 0x00023AA6 pDisasmOneOpCode EQU 0x00023C74 pDisAsm_DOS_INT21 EQU 0x00023F66 pDisAsm_DPMI_INT31 EQU 0x000240D2 pDisAsm_VMM_INT20 EQU 0x0002412D pDisAsm_JumpStatus EQU 0x0002421D jJECXZ EQU 0x000242DE jDisAsm_JMPs_nojmp EQU 0x000242F7 jDisAsm_JMPs_jmp EQU 0x000242FE jDisAsm_JMPs_ret EQU 0x00024337 pDisAsm_AppendCharToLine EQU 0x000243CA pDisAsm_AppendBufferToLine EQU 0x0002441C pReadClientRegister EQU 0x00024493 pWriteClientRegister EQU 0x000244AC pDisAsm_SkipInLine EQU 0x000244DD pDisAsm_SkipPrefix EQU 0x00024508 pMaximizeSomeRange EQU 0x0002452C pMaximizeSafeReadRange EQU 0x00024552 pSetFlag_ClientCS_16_32 EQU 0x00024571 pSearchPattern_InProcedure_ EQU 0x00024589 pSearchPattern_InProcedure EQU 0x0002460B pSearchPattern EQU 0x00024623 c_GDT EQU 0x00024A30 c_LDT EQU 0x00024B41 jLDT_NoLDT EQU 0x00024C69 jLDT_PageNotPresent EQU 0x00024C70 jLDT_SyntaxError EQU 0x00024C77 pPrintInfo_GDT_LDT EQU 0x00024C84 c_IDT_PrintInfo EQU 0x00024DC8 pPrintInfo_IDT EQU 0x00024E2B pPrintSelectorOffset EQU 0x000251DC pPrint_Dword EQU 0x000251FB pPM_01xx EQU 0x00025206 c_PHYS EQU 0x000255E9 c_PHYS_ EQU 0x00025623 pPEEK_POKE_CALL_EBX EQU 0x0002573E pPEEK_LinAddr EQU 0x00025793 pPEEK_B EQU 0x000257A8 pPEEK_W EQU 0x000257CD pPEEK_D EQU 0x000257F3 pPOKE_B EQU 0x00025818 pPOKE_W EQU 0x0002583B pPOKE_D EQU 0x0002585E pRDTSC_AtIntExit EQU 0x00025881 pRDTSC_AtIntEntry EQU 0x000258A9 pRDTSC EQU 0x000258D0 pPrintExecTime EQU 0x000258DF pPrintExecTime_ EQU 0x00025961 pCalibrate_INT8 EQU 0x00025A95 pCalibrateBy_Timer EQU 0x00025BC3 pPrintFPUStatusWord EQU 0x00025D9D pPrintFPUControlWord EQU 0x00025DBE pPrintFPUStatusWord_ EQU 0x00025DDF pPrintFPUControlWord_ EQU 0x00025E26 c_LHEAP_ EQU 0x00026E15 c_TASK_ EQU 0x0002708D c_MOD_ EQU 0x00027512 pWalkTaskList EQU 0x00027719 pGetLinAddr_selKernel32SomeThing EQU 0x00027B36 pMapSelectorToLinAddr EQU 0x00027C06 pClearLogLine EQU 0x00027D03 pGetBase_LDT EQU 0x00027D1C pAddressToSymbol EQU 0x00027D43 jAddressToSymbol_Exit EQU 0x0002804F pWalkDDBChain EQU 0x00028657 pGetVMM_API_offsets EQU 0x0002868A pPageIn_AL_EDI EQU 0x000288A1 pINT_41_0150__ EQU 0x00028DE1 pINT3_FGJM_80xx EQU 0x0002900D pINT3_FGJM_82xx EQU 0x00029071 pINT3_FGJM_83xx EQU 0x0002913D pDeviceIO_9 EQU 0x000291DE nullsub_11 EQU 0x000292BD c_EXP EQU 0x00029334 c_WMSG EQU 0x0002955A j_c_NTCALL_ EQU 0x0002960C pGetModuleName EQU 0x00029611 pFindModuleByName EQU 0x000296CC pINT_41_0040 EQU 0x000298EB pINT3_FGJM_09xx EQU 0x0002A1F0 pINT3_FGJM_09xx_OK EQU 0x0002A219 pINT3_FGJM_0900 EQU 0x0002A291 pFindEntryPoint EQU 0x0002A7E8 pINT3_FGJM_0904_0905 EQU 0x0002A8F3 pINT3_FGJM_0903 EQU 0x0002ACA2 pINT3_FGJM_090E EQU 0x0002AD8D pINT3_FGJM_0907 EQU 0x0002AF9B pINT3_FGJM_0908 EQU 0x0002B077 pINT3_FGJM_0909 EQU 0x0002B0BB pINT3_FGJM_090A EQU 0x0002B12A pINT3_FGJM_090B_090D EQU 0x0002B13F pINT3_FGJM_090C EQU 0x0002B26D pINT3_FGJM_0918 EQU 0x0002B283 pINT3_FGJM_0919 EQU 0x0002B2EF pFindSymbolInExe EQU 0x0002B908 pPM_FF1F_ EQU 0x0002CB8D c_SS EQU 0x0002D260 c_FILE EQU 0x0002D42E c_TABLE_AUTO EQU 0x0002D736 j_TABLE_AUTO EQU 0x0002D740 nullsub_7 EQU 0x0002E42D c_STACK_ EQU 0x0002E4C4 c_STACK___ EQU 0x0002E4D2 c__stack__ EQU 0x0002E5F1 c_SYMLOC_X EQU 0x0002EBE9 pStrchr EQU 0x0002EE2E c_A_ EQU 0x0002EE40 pHasArgument EQU 0x00030B27 pPrintQuestion EQU 0x00030C17 pReadClientRegister_ EQU 0x00030CF3 pReadSerialChar EQU 0x00031190 pSetSerialSpeed EQU 0x000319DF pReadSerial_Byte EQU 0x00031A72 pSendSerial_Byte EQU 0x00031AE9 pAttachToSerialDevice EQU 0x00031F51 pResetModem EQU 0x00031FE4 pGetModemResponse EQU 0x00032011 pSendSerial_Line EQU 0x00032051 pReadSerial_String EQU 0x00032075 pDelay_200ms EQU 0x000320AB pDelayMilliSec EQU 0x000320B8 pPrintChar_PAR EQU 0x00032AD4 pPrintChar_LPT_SER EQU 0x00032B42 pPrintChar_SER EQU 0x00032BC1 pStr2ShortReal EQU 0x00032C18 pStr2LongReal EQU 0x000334AE pPM_FF01 EQU 0x000339E3 pPM_FF02 EQU 0x00033A3E pPM_FF03 EQU 0x00033ADA pPM_FF04 EQU 0x00033B03 pPM_FF05 EQU 0x00033C80 pPM_FF06 EQU 0x00033CC3 pPM_FF07 EQU 0x00033D32 pPM_FF08 EQU 0x00033DA5 pPM_FF09 EQU 0x00033DC1 pPM_FF0A EQU 0x00033DDC pPM_FF0B EQU 0x00033E5A pPM_FF0D EQU 0x00033E7E pPM_FF0E EQU 0x00033E98 pPM_FF0F EQU 0x00033F22 pPM_FF11 EQU 0x00033F74 pPM_FF12 EQU 0x00033FBF pPM_FF15 EQU 0x00033FE0 pPM_FF16 EQU 0x000340A1 pPM_FF17 EQU 0x000340E4 pPM_FF18 EQU 0x0003414A pPM_FF1A EQU 0x00034293 pPM_FF1B EQU 0x000342A6 pPM_FF1C EQU 0x000342DC pPM_FF1D EQU 0x00034338 pPM_FF1E EQU 0x0003437E pPM_FF1F EQU 0x000343A8 pSwitchContext_InWinice EQU 0x0003452C pINT_41_0070 EQU 0x00034BD8 pINT_41_0071 EQU 0x00034BE9 pINT_41_0072 EQU 0x00034BFA pINT_41_0074 EQU 0x00034C1A pINT_41_0073 EQU 0x00034C30 pINT_41_0075 EQU 0x00034C99 pINT_41_0076 EQU 0x00034CBA pINT_41_0077 EQU 0x00034CDC pINT_41_0078 EQU 0x00034D0B pINT_41_0079 EQU 0x00034D3F pINT_41_007A EQU 0x00034D5B pINT_41_007B EQU 0x00034F31 pINT_41_007F EQU 0x00034F4A pINT_41_0080 EQU 0x00034FC2 pHandleFaultIn_DOT_QUERY EQU 0x00035021 pINT_41_0084 EQU 0x0003505B pFindDotCommand EQU 0x000350AB pRegisterDotCommand EQU 0x000350D2 c_DOT_VXDNAME_? EQU 0x000350F9 c_DOT_VXDNAME_ EQU 0x00035141 pDotCommand_FaultHandler EQU 0x000351AB pSaveClientRegisters_ EQU 0x00035240 c_VER_DOT_ EQU 0x000352C5 pStrend EQU 0x000353F8 pINT_41_0050 EQU 0x00035414 pINT_41_0152 EQU 0x0003555E pINT_41_0052 EQU 0x000355D9 pINT_41_0065 EQU 0x00035638 pINT_41_0066 EQU 0x000356B7 pINT_41_0064 EQU 0x00035759 pINT_41_007x_PrintRegs EQU 0x000357EB pNew_VMM_12D EQU 0x0003591B pNew_VMM_F3 EQU 0x0003592F pINT_41_0002_0012 EQU 0x00035BA1 pINT_41_0001 EQU 0x00035BD0 pNew_VMM_C4 EQU 0x00035C36 pINT_41_0000 EQU 0x00035C6E pINT_41_000F EQU 0x00035C90 pBeep EQU 0x00035CCC c_VER_LIN_ EQU 0x00036077 c_VER_ADD_ EQU 0x000360C3 c_VER_ADD__ EQU 0x0003618E c_VER_EXP_ EQU 0x0003627F c_VER_SYM_ EQU 0x0003654E nullsub_6 EQU 0x0003666A pINT_41_0152_ EQU 0x00036736 pINT_41_F003 EQU 0x0003689F pINT_41_0150_3_2 EQU 0x00036C06 pINT_41_0150 EQU 0x00036CC1 pINT_41_0152__ EQU 0x00036D49 c_STACK__ EQU 0x00037784 pCheckInternalStack EQU 0x00037E20 pPrintErrorMessage EQU 0x00038270 pPrintErrorToCommandWindow EQU 0x00038281 pPrintLine_Color EQU 0x00038292 pPrintLine_Help EQU 0x000382AE pMemset EQU 0x0003837F pMemcopy EQU 0x000383CE pMapSelectorOffsetToLinAddr EQU 0x00038512 pCopyDword EQU 0x0003853D pCopyWord EQU 0x00038568 pCopyByte EQU 0x00038594 pWriteDword EQU 0x000385BF pReadArea EQU 0x000385DF jPAGEIN_INT3 EQU 0x00038617 c_PAGEIN__ EQU 0x00038618 pINT3_CleanupForPAGEIN EQU 0x000386AC pSwitchContext EQU 0x000386E8 pGetNumber EQU 0x000389D3 c_addr_ EQU 0x00038D87 pEvaluateProcessType EQU 0x00038F61 pGetCurrentThreadAndProcessPointers EQU 0x00039013 c_ADDR EQU 0x00039170 pPrintADDRResults EQU 0x00039222 c_NTCALL_ EQU 0x000392BF c_query_ EQU 0x000393FB query_extendedinfo EQU 0x00039428 query_alien_context EQU 0x0003943F query_switch_to_next_context EQU 0x00039464 query_exec_query EQU 0x0003948E query_leave EQU 0x000394AE pHookMapViewOfImageSection EQU 0x0003A0B0 pHookAddValidPageToWorkingSet EQU 0x0003A135 pDispatchIo EQU 0x0003BBF8 devio_UnknownControlCode EQU 0x0003BC65 devio_Leave EQU 0x0003BE59 pDeviceIOControl EQU 0x0003BEF1 pInitTypeParsers_1 EQU 0x0003DDC5 jInitEvalStructs EQU 0x0003E9B7 pInitEvalStructs EQU 0x0003EABA pParser_EVALUE EQU 0x00040694 pGetIRQLLevel EQU 0x00040796 pExpression2Integer2_ EQU 0x000428C8 pExpression2Integer2 EQU 0x00042A52 pEval_Bx_IF EQU 0x00042B26 pGetPrintLineStatus EQU 0x000490E4 pPrintf EQU 0x00049315 pSprintf EQU 0x000494E4 pIsNullPointer EQU 0x00049ABC pGetValueFromPCRB EQU 0x00049AF1 c_XFRAME__ EQU 0x0004A460 c_OBJDIR_ EQU 0x0004D3E2 c_DEVICE_ EQU 0x0004D728 c_FOBJ_ EQU 0x0004E610 c_objtab_ EQU 0x0004EC02 pIsBuild817 EQU 0x0004F54E pRetriveNtVersionData EQU 0x0004F56F c_TIMER EQU 0x0004FA98 c_INTOBJ EQU 0x0004FE73 c_BSTAT_ EQU 0x00050557 c_WHAT__ EQU 0x000511FB pParseMacro EQU 0x000536DB pEval_Bx_DO EQU 0x000538BF c_MACRO_ EQU 0x000538FA pParseUserCommand EQU 0x00053C64 pParse_EXCLUDE_SIWVIDRANGE EQU 0x00054647 pDeleteSymbolTable__ EQU 0x00057B42 nullsub_2 EQU 0x00057B6E pDeleteSymbolTable_ EQU 0x00057B71 pDeviceIO_3 EQU 0x00058147 c_SYM_ EQU 0x0005D06C c_TYPES_ EQU 0x0005D327 c_PEEK_ EQU 0x0005D61D c_POKE_ EQU 0x0005D74E c_ALTSCR_ EQU 0x0005D8A3 pInitUpdateFunctions_Base EQU 0x0005DB06 pUpdateBase_38 EQU 0x0005DB32 pUpdateBase_20 EQU 0x0005DB3B pUpdateBase_44 EQU 0x0005DB54 pUpdateBase_00 EQU 0x0005DBCE pInitUpdateFunctions_Locals EQU 0x0005DE88 pUpdateLocals_44 EQU 0x0005E19A pPrintLocals_ EQU 0x0005E3AB pInitUpdateFunctions_Watches EQU 0x0005E8B7 pUpdateWatches_44 EQU 0x0005E9E1 pPrintWatches_ EQU 0x0005ED68 c_PCI_QueryPCIRegisters EQU 0x0005F063 c_PCI_Query_BusDeviceFunction EQU 0x0005F1FC c_PCI_ EQU 0x0005F71B c_fiber_ EQU 0x0005FA00 c_width_ EQU 0x00060E00 pAllocateHeapBlock EQU 0x00062271 pHeapFree EQU 0x000622A3 c_PAGEIN_ EQU 0x000622CD nullsub_12 EQU 0x0006262C j_strstr EQU 0x0006262E j_RtlUnwind EQU 0x000627CC fExecuteMoreCommands EQU 0x0008FD39 fClientMode EQU 0x0008FD3B dClient_EAX EQU 0x000930CD dClient_EBX EQU 0x000930D1 dClient_ECX EQU 0x000930D5 dClient_EDX EQU 0x000930D9 dClient_ESI EQU 0x000930DD dClient_EDI EQU 0x000930E1 dClient_EBP EQU 0x000930E5 dClient_ESP EQU 0x000930E9 dClient_EIP EQU 0x000930ED dClient_EFLAGS EQU 0x000930F1 dClient_CS EQU 0x000930F5 dClient_DS EQU 0x000930F9 dClient_SS EQU 0x000930FD dClient_ES EQU 0x00093101 dClient_FS EQU 0x00093105 dClient_GS EQU 0x00093109 bUserCommand EQU 0x000964E7 dCurrentContext EQU 0x000D16EF dPopupContext EQU 0x000D16F3 fPAGEIN_InProgress EQU 0x000D62CB oPAGEIN_INT3 EQU 0x000D6317 ExAcquireFastMutex EQU 0x000F2634 ExReleaseFastMutex EQU 0x000F2638 HalDisplayString EQU 0x000F263C KdComPortInUse EQU 0x000F2640 HalInitializeProcessor EQU 0x000F2644 MmUnmapViewOfSection EQU 0x000F264C DbgBreakPoint EQU 0x000F2650 PsCreateSystemProcess EQU 0x000F2654 ExRaiseDatatypeMisalignment EQU 0x000F2658 KeUpdateSystemTime EQU 0x000F265C RtlAssert EQU 0x000F2660 ExAllocatePoolWithTag EQU 0x000F2664 ExFreePool EQU 0x000F2668 PsInitialSystemProcess EQU 0x000F266C KeInitializeEvent EQU 0x000F2670 IoRegisterShutdownNotification EQU 0x000F2674 MmMapIoSpace EQU 0x000F2678 IoDeleteDevice EQU 0x000F267C IoCreateSymbolicLink EQU 0x000F2680 IoCreateDevice EQU 0x000F2684 RtlInitUnicodeString EQU 0x000F2688 ZwClose EQU 0x000F268C ObfDereferenceObject EQU 0x000F2690 ObReferenceObjectByHandle EQU 0x000F2694 ZwOpenDirectoryObject EQU 0x000F2698 MmIsAddressValid EQU 0x000F269C KeBugCheckEx EQU 0x000F26A0 IoQueryDeviceDescription EQU 0x000F26A4 strstr EQU 0x000F26A8 IofCompleteRequest EQU 0x000F26AC IoDeleteSymbolicLink EQU 0x000F26B0 MmUnmapIoSpace EQU 0x000F26B4 IoGetDeviceObjectPointer EQU 0x000F26B8 RtlFreeUnicodeString EQU 0x000F26BC ZwWriteFile EQU 0x000F26C0 ZwCreateFile EQU 0x000F26C4 RtlAnsiStringToUnicodeString EQU 0x000F26C8 RtlInitAnsiString EQU 0x000F26CC ZwQueryValueKey EQU 0x000F26D0 ZwOpenKey EQU 0x000F26D4 KeDelayExecutionThread EQU 0x000F26D8 RtlAppendUnicodeToString EQU 0x000F26DC RtlCopyUnicodeString EQU 0x000F26E0 ZwReadFile EQU 0x000F26E4 ZwQueryInformationFile EQU 0x000F26E8 _purecall EQU 0x000F26EC RtlUnwind EQU 0x000F26F0 MmIsThisAnNtAsSystem EQU 0x000F26F4 IoDisconnectInterrupt EQU 0x000F26F8 IoConnectInterrupt EQU 0x000F26FC RtlFreeAnsiString EQU 0x000F2700 RtlUnicodeStringToAnsiString EQU 0x000F2704 start EQU 0x000F2BA0 pRetriveRegistryValueLite EQU 0x000F37F0 pPrintToBlueScreen EQU 0x000F3876