Cracking 2

home *** CD-ROM | disk | FTP | other *** search

/ Cracking 2 / Cracking II..iso / Tools / icedump 6.018 and nticedump 1.9 / wnt / src / ntice325.inc < prev next >

Wrap

Text File | 2000-02-26 | 37.4 KB | 798 lines

jSET_DEVICE_FOCUS EQU 0x00010559 jDESTROY_VM EQU 0x00010595 pSavePort_21_A1 EQU 0x000105B4 pRestorePort_21_A1 EQU 0x000105D6 nullsub_13 EQU 0x00010625 nullsub_14 EQU 0x00010626 pNew_VMM_F5 EQU 0x000106C7 pPatch_VKD EQU 0x000106E5 pWINICE_service_3 EQU 0x00010849 nullsub_15 EQU 0x00010855 pClearCarry EQU 0x00010856 pDefaultWiniceIntHandler EQU 0x00010858 pINT_06 EQU 0x00010A04 pINT_0B EQU 0x00010AE9 pINT_0C EQU 0x00010C57 pInt_0D EQU 0x00010CBB pINT_0D_W95 EQU 0x00010CC2 pINT_0E EQU 0x00011111 jChain2Ntoskrnl EQU 0x000112E2 pIRQ_03 EQU 0x000115D9 pIRQ_0C EQU 0x00011711 pINT_0F_INT_57 EQU 0x00011742 pINT_01 EQU 0x0001175C pINT_03 EQU 0x00011AC7 pKbdWaitMbOutputReady EQU 0x00012045 pPutBackScanCode EQU 0x0001205C pINT_02 EQU 0x0001259E pNticeMain EQU 0x00012728 jV86_mode EQU 0x000127A6 jFlat32_pm_mode EQU 0x000127B0 pRestoreLDTR EQU 0x00012B7E pInvalidateLDTR EQU 0x00012BA1 pPrintMessage_HotKey EQU 0x00012DFD pEnterWiniceBySelfTrace EQU 0x00012F6A pVKD_PUT_BYTE EQU 0x00012F9C pGetDisplayDriverEntryPoint EQU 0x000132C4 pNTICE EQU 0x00013300 nullsub_2 EQU 0x0001330E nullsub_3 EQU 0x00013334 pSwapIDT_INT_0E EQU 0x0001355A pHookFaults_IDT EQU 0x000135F4 pSetWiniceIRQs EQU 0x00013766 pHookKbdVector_IOAPIC_ EQU 0x000137E7 pHookKbdVector_IOAPIC EQU 0x00013825 CR0_State EQU 0x0001383F pHookInt_IDT EQU 0x00013843 jNextCPU EQU 0x00013870 pUnHookInt_IDT EQU 0x00013899 pReHookInt_IDT EQU 0x000138C8 pHookInt_IDT_ EQU 0x0001390D pGetWiniceIntJumpTableOffset EQU 0x0001398E pInitWiniceIntHandlerJumpTable EQU 0x000139B0 pSaveDRx EQU 0x00013ACD pINT_02_IOAPIC EQU 0x00013C3D pSaveRegisters_APIC EQU 0x00013CF5 pGetBase_Initial_FS EQU 0x00013DC0 pGetFSLinearAddress EQU 0x00013DDD pSaveAllRegisters EQU 0x00013DEB pSaveProcessorRegisters EQU 0x00013F24 pSaveCPUID EQU 0x00013F9B pSendEOI EQU 0x00014170 pSendEOI_ EQU 0x000141BF pEnableIRQ EQU 0x000141F7 pDisableIRQ EQU 0x00014266 pEnableIRQ_IOAPIC EQU 0x000142BD pDisableIRQ_IOAPIC EQU 0x00014319 pDisableAllIRQs EQU 0x00014338 pDisableAllIRQs_IOAPIC EQU 0x000143DA pGetIRQStatus_IOAPIC EQU 0x000144B8 pSetIRQStatus_IOAPIC EQU 0x000144D5 pGetIRQStatus_IOAPIC_ EQU 0x000144F2 pSetIRQStatus_IOAPIC_ EQU 0x00014509 c_CPU_i EQU 0x0001457C c_CPU_i_ EQU 0x000145EE c_CPU EQU 0x000146B0 jCPU_InvalidProcID EQU 0x00014741 c_CPU_ProcID EQU 0x0001483D pPrintCPUFeatures EQU 0x000148EC pPrintSpecialRegisters EQU 0x000149D7 pPrintAPICInfo EQU 0x00014D80 c_LBRECORD EQU 0x00014F12 jLBRECORD_Disable EQU 0x00014F63 pRecordLastFaultInfo EQU 0x00014F6F pRecordLastBranchInfo EQU 0x00014FEF pPrintLastBranchInfo EQU 0x00015039 pInEaxDx EQU 0x000151A0 pInAxDx EQU 0x000151A7 pInAlDx EQU 0x000151B2 pOutDxEax EQU 0x000151BC pOutDxAx EQU 0x000151C7 pOutDxAl EQU 0x000151D7 pByte2HexString EQU 0x000151E5 pWord2HexString EQU 0x00015205 pDword2HexString EQU 0x00015222 pDword2DecimalString EQU 0x0001525D pWord2DecimalString EQU 0x0001528A pExcludePhysicalMemoryRange EQU 0x000152B7 pIsBlockExcluded EQU 0x0001537B pMOV_AL_EDI_safe EQU 0x000153D6 pMOV_AX_EDI_safe EQU 0x0001540D pMOV_EAX_EDI_safe EQU 0x00015447 pMOV_AL_EDI EQU 0x00015481 pMOV_AX_EDI EQU 0x00015497 pMOV_EAX_EDI EQU 0x000154B0 pPutFlatByte_safe EQU 0x000154C9 pPutFlatByte EQU 0x00015513 pMOV_EDI_AL EQU 0x0001553C pMOV_EDI_AL_safe EQU 0x00015550 pMOV_EDI_AX EQU 0x00015585 pMOV_EDI_AX_safe EQU 0x0001559A pMOV_EDI_EAX_safe EQU 0x000155D0 pMOV_EDI_EAX EQU 0x00015605 pREP_CMPSB EQU 0x00015619 pREP_MOVSB EQU 0x0001562B pREP_MOVSD EQU 0x00015649 pREP_STOSD EQU 0x00015667 pREP_STOSB EQU 0x00015678 pREP_LODSB EQU 0x00015685 pREP_LODSD EQU 0x00015692 pREPNE_SCASB EQU 0x0001569F pREPNE_SCASW EQU 0x000156AD pLoadAccessRightsInECX EQU 0x000156BC pLSL_EcxEax EQU 0x000156C1 pLSL_EdxEbx EQU 0x000156C6 pRMSR EQU 0x000156CB pWRMSR EQU 0x000156CF pMOD_ARG1_ARG0 EQU 0x0001570D pSkipWhiteSpace EQU 0x00015728 pSkipDelimiters EQU 0x00015739 pSkipNonWhiteSpace EQU 0x0001574A pGetDecimalDigit EQU 0x0001575D pGetHexDigit EQU 0x0001576B pGetDecimalNumber EQU 0x000157A1 pGetHexNumber EQU 0x000157F5 pExpression2Integer EQU 0x00015F2E pCheckAddres2 EQU 0x00016126 pCheckAddress EQU 0x0001615C pParseInitLine EQU 0x000161B7 nullsub_4 EQU 0x000162D3 c_VER_PrintUserInfo EQU 0x000162D4 pSetupVideoRegisterInfo_ EQU 0x00016363 pStrcpy EQU 0x0001665F pStrlen EQU 0x0001666D pToUpper EQU 0x00016685 pStrnicmp_ EQU 0x000166BA pMoveCursor EQU 0x000166F8 pMoveCursor_ EQU 0x0001674C pPrintLine EQU 0x0001680A pPrintQuestion_ EQU 0x0001686F pUpdateAllWindows EQU 0x000168CA pUpdateCodeWindow EQU 0x00016A4B pShowCodeWindow EQU 0x00017037 pUpdateWatchesWindow EQU 0x000170D2 pUpdateLocalsWindow EQU 0x00017152 nullsub_5 EQU 0x000171C6 pUpdateDataWindow EQU 0x00017218 pPrintGenericRegisters EQU 0x000177CC pUpdateRegistersWindow EQU 0x0001788B pGetRegisterColor EQU 0x00017CC2 pPrintFlags EQU 0x00017CF9 pSaveClientRegistersForDisplay EQU 0x00017D3F pGeneralProtectionFault EQU 0x00017D5F pSaveClientRegisters EQU 0x00017DF2 pSaveAllClientRegisters EQU 0x00017F00 pRestoreAllClientRegisters EQU 0x0001800F pMouse_CopyPaste EQU 0x000191C2 pMouse_Display EQU 0x000191D1 pMouse_Display_1 EQU 0x000191FE pMouse_UnAssemble_1 EQU 0x00019274 pMouse_UnAssemble EQU 0x0001931D pMouse_What EQU 0x0001934A pMouse_Previous EQU 0x0001936D pMouse_Previous_1 EQU 0x00019481 pMouse_Previous_2 EQU 0x000194B6 pMouse_Copy_ EQU 0x000196DE pMouse_Paste_ EQU 0x00019742 nullsub_21 EQU 0x00019794 pEnableWin95Commands EQU 0x00019E9C pExecUserCommand EQU 0x00019EE8 pFindCommand EQU 0x0001A12E pPrintErrorToComandWindow EQU 0x0001A194 pPrintBufferInWindow EQU 0x0001A1AF pPrintToCommandWindow_ EQU 0x0001A285 pV86_1 EQU 0x0001A361 pV86_0 EQU 0x0001A371 pInsertStringIntoBuffer EQU 0x0001A905 pEmptyKeyboardBuffer EQU 0x0001B4F1 pReadOneKey EQU 0x0001B509 pProgramLEDs EQU 0x0001B662 pKbdWaitMbInputReady EQU 0x0001B6CB pProcessScanCode EQU 0x0001B70A jProcessScanCode_Translate EQU 0x0001B872 pInsertCharIntoBuffer EQU 0x0001B892 pSkipWord EQU 0x0001B8D3 c_InvalidCommand EQU 0x0001B8F3 c_WL EQU 0x0001BDD1 c_WATCH EQU 0x0001C091 c_WW EQU 0x0001C1BE c_WC EQU 0x0001C339 c_F EQU 0x0001C49D c_S EQU 0x0001C599 jS_NoSearchInProgress EQU 0x0001C750 jS_PatternNotFound EQU 0x0001C757 jS_SyntaxError EQU 0x0001C75E jS_PrintMessage EQU 0x0001C763 c_M EQU 0x0001C9A3 unknown_libname_1 EQU 0x0001CAA2 unknown_libname_2 EQU 0x0001CAB2 unknown_libname_3 EQU 0x0001CAC2 c_ES EQU 0x0001CAD2 c_EL EQU 0x0001CAE2 c_ET EQU 0x0001CAF2 c_E EQU 0x0001CB02 pCopyDelimitedString EQU 0x0001CD22 pGetPattern EQU 0x0001CD36 c_C EQU 0x0001CD7D c_R EQU 0x0001CF5C pUpdateWindows EQU 0x0001D0F9 unknown_libname_4 EQU 0x0001D10E unknown_libname_5 EQU 0x0001D11E unknown_libname_6 EQU 0x0001D12E c_DL EQU 0x0001D13E c_DS EQU 0x0001D14E c_DT EQU 0x0001D15E c_D EQU 0x0001D16E pMouse_Display_2 EQU 0x0001D17A c_DATA EQU 0x0001D1EC c_DEX EQU 0x0001D22B c_EC EQU 0x0001D3DE c_U EQU 0x0001D41F c_X EQU 0x0001D5A1 c_P EQU 0x0001D831 c_G EQU 0x0001DB2F c_RS EQU 0x0001DE0D c_ID EQU 0x0001DE39 c_IW EQU 0x0001DE40 c_I_IB EQU 0x0001DE47 c_O_OB EQU 0x0001DF14 c_SET_MOUSE EQU 0x0001E0AC c_SET_WHEELLINES EQU 0x0001E143 c_CODE EQU 0x0001E197 c_?_H_HELP EQU 0x0001E216 c_VER EQU 0x0001E3F1 c_CLS EQU 0x0001E42E c_ALTSCR EQU 0x0001E44F c_ALTKEY EQU 0x0001E649 c_FKEY EQU 0x0001E707 c_COLOR EQU 0x0001E8D2 pIsTraceOn EQU 0x0001EA29 c_ZAP EQU 0x0001EA42 c_SRC EQU 0x0001EA84 c_TABS EQU 0x0001EB9D c_A EQU 0x0001EBE8 c_FORMAT EQU 0x0001ECCC c_LINES EQU 0x0001ED26 c_LINES_ EQU 0x0001EE53 c_SET EQU 0x0001EFC9 pFindSetParameter EQU 0x0001F125 c_OBJDIR EQU 0x0001F18A c_DRIVER EQU 0x0001F19B c_DEVICE EQU 0x0001F1AC c_OBJTAB EQU 0x0001F1BD c_WHAT_ EQU 0x0001F1D3 c_ANSWER EQU 0x0001F1DA pCopyUntilWhiteSpace EQU 0x0001F307 c_SET_VERBOSE EQU 0x0001F4EB c_SET_LOWERCASE EQU 0x0001F534 c_SET_REFERENCE EQU 0x0001F56C c_SET_CASESENSITIVE EQU 0x0001F5A2 c_SET_THREADP EQU 0x0001F5E1 c_BSTAT EQU 0x0001F638 c_MACRO EQU 0x0001F649 c_TYPES EQU 0x0001F65C j_SYM_ EQU 0x0001F672 c_PEEK EQU 0x0001F67D c_POKE EQU 0x0001F688 c_PCI EQU 0x0001F693 c_FOBJ EQU 0x0001F69E c_IRP EQU 0x0001F6AF c_WIDTH EQU 0x0001F6C0 c_PAGEIN EQU 0x0001F6CB c_FIBER EQU 0x0001F6E1 pCommonUnimplemntedStub EQU 0x0001F6F7 pDetectVideoCardType EQU 0x0001F704 pInitMonoVideoCard EQU 0x0001F7FF c_CSIP EQU 0x0001FC4C c_BC_BD_BE EQU 0x0001FEFA c_BL EQU 0x0002002B c_BPINT EQU 0x0002023B pPrintBPInfo_BPINT EQU 0x000202E8 nullsub_10 EQU 0x00020309 nullsub_12 EQU 0x0002030A pEval_Bx EQU 0x0002030B c_BPX EQU 0x000203A5 pPrintBPInfo_BPX EQU 0x000207AB pBE_BPX EQU 0x0002080A pBD_BPX EQU 0x0002083C pBD_BPX_BMSG EQU 0x00020854 pBD_BPX_BMSG_ EQU 0x000208ED pPrintBPInfo_BMSG EQU 0x00020AEB j_pBE_BPX EQU 0x00020BB4 c_BPM_BPMB EQU 0x00020BD1 c_BPMD EQU 0x00020BD6 c_BPMW EQU 0x00020BDB pBE_BPM EQU 0x00020F8E pBD_BPM EQU 0x00020FC0 c_BPIO EQU 0x00020FDF c_BPIO_w95 EQU 0x0002114D pPrintBPInfo_BPIO EQU 0x00021221 nullsub_11 EQU 0x00021264 pBD_BPIO EQU 0x00021265 pBPIOSetPortInPermissionMap EQU 0x00021271 c_BPR_RangeCheck EQU 0x0002131F pRangeCheck EQU 0x0002145F pCheckDuplicateBP EQU 0x000214B8 jNotDuplicateBP EQU 0x0002154B jItsDuplicateBP EQU 0x0002155B pAllocateBP EQU 0x000215EE pSetupBPStruct EQU 0x0002173F pBP_SetModuleName EQU 0x0002184F c_BH EQU 0x0002190B oNew_PM_VMM_INT_0E_ EQU 0x00022030 pIdentifyWiniceBPINT EQU 0x00022D32 pDeactivateBPs EQU 0x00022FAA pDeactivateBreakpoints EQU 0x000230A2 pActivateBPs EQU 0x00023283 pActivateBreakpoints EQU 0x000233C6 pActivate_BPINT EQU 0x000233D1 pINT_41_F003_ EQU 0x00023641 pSetDRx EQU 0x0002369B pSetDR_01237 EQU 0x00023712 pCalledOnTaskSwitch EQU 0x00023AC5 pDisasmOneOpCode EQU 0x00023CAA pDisAsm_DOS_INT21 EQU 0x00023F9C pDisAsm_DPMI_INT31 EQU 0x00024108 pDisAsm_VMM_INT20 EQU 0x00024163 pDisAsm_JumpStatus EQU 0x00024253 jJECXZ EQU 0x00024314 jDisAsm_JMPs_nojmp EQU 0x0002432D jDisAsm_JMPs_jmp EQU 0x00024334 jDisAsm_JMPs_ret EQU 0x0002436D pDisAsm_AppendCharToLine EQU 0x00024400 pDisAsm_AppendBufferToLine EQU 0x00024452 pReadClientRegister EQU 0x000244C9 pWriteClientRegister EQU 0x000244E2 pDisAsm_SkipInLine EQU 0x00024513 pDisAsm_SkipPrefix EQU 0x0002453E pMaximizeSomeRange EQU 0x00024562 pMaximizeSafeReadRange EQU 0x00024588 pSetFlag_ClientCS_16_32 EQU 0x000245A7 pSearchPattern_InProcedure EQU 0x000245BF pFindPattern EQU 0x00024641 pSearchPattern EQU 0x00024659 c_GDT EQU 0x00024A60 c_LDT EQU 0x00024B71 jLDT_NoLDT EQU 0x00024C99 jLDT_PageNotPresent EQU 0x00024CA0 jLDT_SyntaxError EQU 0x00024CA7 pPrintInfo_GDT_LDT EQU 0x00024CB4 c_IDT EQU 0x00024DF8 pPrintInfo_IDT EQU 0x00024E5B pPrintSelectorOffset EQU 0x0002520C pPrint_Dword EQU 0x0002522B pPM_01xx EQU 0x00025236 c_PHYS EQU 0x00025619 c_PHYS_ EQU 0x00025653 pPEEK_POKE_CALL_EBX EQU 0x0002576E pPEEK_LinAddr EQU 0x000257C3 pPEEK_B EQU 0x000257D8 pPEEK_W EQU 0x000257FD pPEEK_D EQU 0x00025823 pPOKE_B EQU 0x00025848 pPOKE_W EQU 0x0002586B pPOKE_D EQU 0x0002588E pRDTSC_AtIntExit EQU 0x000258B1 pRDTSC_AtIntEntry EQU 0x000258D9 pRDTSC EQU 0x00025900 pPrintExecTime EQU 0x0002590F pPrintExecTime_ EQU 0x00025991 pCalibrate_INT8 EQU 0x00025AC5 pCalibrateBy_Timer EQU 0x00025BF3 pPrintFPUStatusWord EQU 0x00025DCD pPrintFPUControlWord EQU 0x00025DEE pPrintFPUStatusWord_ EQU 0x00025E0F pPrintFPUControlWord_ EQU 0x00025E56 c_LHEAP_ EQU 0x00026E1D c_TASK_ EQU 0x00027095 pWalkTaskList EQU 0x00027752 pGetLinAddr_selKernel32SomeThing EQU 0x00027B6F pMapSelectorToLinAddr EQU 0x00027C3F pClearLogLine EQU 0x00027D3C pGetBase_LDT EQU 0x00027D55 pWalkDDBChain EQU 0x00028820 pGetVMM_API_offsets EQU 0x00028853 pPageIn_AL_EDI EQU 0x00028A6A pINT_41 EQU 0x00028AAB pINT_41_0150__ EQU 0x00028FAA pINT3_FGJM_80xx EQU 0x000291D6 pINT3_FGJM_82xx EQU 0x0002923A pINT3_FGJM_83xx EQU 0x00029306 pDeviceIO_9 EQU 0x000293A7 nullsub_6 EQU 0x00029486 c_EXP EQU 0x000294FD c_WMSG EQU 0x00029723 c_NTCALL EQU 0x000297D5 pGetModuleName EQU 0x000297DA pFindModuleByName EQU 0x00029895 pINT_41_0040 EQU 0x00029AB4 pINT3_FGJM_09xx EQU 0x0002A3BC pINT3_FGJM_09xx_OK EQU 0x0002A3E5 pINT3_FGJM_0900 EQU 0x0002A45D pFindEntryPoint EQU 0x0002A9B4 pINT3_FGJM_0904_0905 EQU 0x0002AABF pINT3_FGJM_0903 EQU 0x0002AE6E pINT3_FGJM_090E EQU 0x0002AF59 pINT3_FGJM_0907 EQU 0x0002B171 pINT3_FGJM_0908 EQU 0x0002B24D pINT3_FGJM_0909 EQU 0x0002B291 pINT3_FGJM_090A EQU 0x0002B300 pINT3_FGJM_090B_090D EQU 0x0002B315 pINT3_FGJM_090C EQU 0x0002B443 pINT3_FGJM_0918 EQU 0x0002B459 pINT3_FGJM_0919 EQU 0x0002B4C5 pPM_FF1F_ EQU 0x0002CCFD c_SS EQU 0x0002D3D0 c_FILE EQU 0x0002D59E c_TABLE_AUTO EQU 0x0002D896 j_TABLE_AUTO EQU 0x0002D8A0 nullsub_16 EQU 0x0002E59A c_STACK EQU 0x0002E600 c_STACK_ EQU 0x0002E606 c_STACK___ EQU 0x0002E61E c__stack__ EQU 0x0002E73D c_SYMLOC_X EQU 0x0002ED35 pStrchr EQU 0x0002EF86 c_A_ EQU 0x0002EF98 pHasArgument EQU 0x00030D87 pPrintQuestion EQU 0x00030E77 pReadClientRegister_ EQU 0x00030F53 pSetSerialSpeed EQU 0x00031C37 pReadSerial_Byte EQU 0x00031CCA pSendSerial_Byte EQU 0x00031D41 pAttachToSerialDevice EQU 0x00032194 pResetModem EQU 0x00032227 pGetModemResponse EQU 0x00032254 pSendSerial_Line EQU 0x00032294 pReadSerial_String EQU 0x000322B8 pDelay_200ms EQU 0x000322EE pDelayMilliSec EQU 0x000322FB pPrintChar_PAR EQU 0x00032D18 pPrintChar_LPT_SER EQU 0x00032D86 pPrintChar_SER EQU 0x00032DFF pStr2ShortReal EQU 0x00032E54 pStr2LongReal EQU 0x000336EA pPM_FF01 EQU 0x00033C1F pPM_FF02 EQU 0x00033C7A pPM_FF03 EQU 0x00033D16 pPM_FF04 EQU 0x00033D3F pPM_FF05 EQU 0x00033EBE pPM_FF06 EQU 0x00033F01 pPM_FF07 EQU 0x00033F70 pPM_FF08 EQU 0x00033FE3 pPM_FF09 EQU 0x00033FFF pPM_FF0A EQU 0x0003401A pPM_FF0B EQU 0x00034098 pPM_FF0D EQU 0x000340BC pPM_FF0E EQU 0x000340D6 pPM_FF0F EQU 0x00034160 pPM_FF11 EQU 0x000341B2 pPM_FF12 EQU 0x000341FD pPM_FF15 EQU 0x0003421E pPM_FF16 EQU 0x000342DF pPM_FF17 EQU 0x00034322 pPM_FF18 EQU 0x00034388 pPM_FF1A EQU 0x000344D1 pPM_FF1B EQU 0x000344E4 pPM_FF1C EQU 0x0003451A pPM_FF1D EQU 0x00034576 pPM_FF1E EQU 0x000345BC pPM_FF1F EQU 0x000345E6 pSwitchContext_InWinice EQU 0x0003476C pINT_41_0070 EQU 0x00034E40 pINT_41_0071 EQU 0x00034E51 pINT_41_0072 EQU 0x00034E62 pINT_41_0074 EQU 0x00034E82 pINT_41_0075 EQU 0x00034F01 pINT_41_0076 EQU 0x00034F22 pINT_41_0077 EQU 0x00034F44 pINT_41_0078 EQU 0x00034F73 pINT_41_0079 EQU 0x00034FA7 pINT_41_007A EQU 0x00034FC3 pINT_41_007B EQU 0x00035199 pINT_41_007F EQU 0x000351B2 pINT_41_0080 EQU 0x0003522A pHandleFaultIn_DOT_QUERY EQU 0x00035289 pINT_41_0084 EQU 0x000352C3 pFindDotCommand EQU 0x00035313 pRegisterDotCommand EQU 0x0003533A c_DOT_VXDNAME_? EQU 0x00035361 c_DOT_VXDNAME_ EQU 0x000353A9 pDotCommand_FaultHandler EQU 0x00035413 pSaveClientRegisters_ EQU 0x000354A8 c_VER_DOT_ EQU 0x0003552D pStrend EQU 0x00035660 pINT_41_0050 EQU 0x0003567C pINT_41_0152 EQU 0x000357C6 pINT_41_0052 EQU 0x00035841 pINT_41_0065 EQU 0x000358A0 pINT_41_0066 EQU 0x0003591F pINT_41_0064 EQU 0x000359C1 pINT_41_007x_PrintRegs EQU 0x00035A53 pNew_VMM_12D EQU 0x00035B83 pNew_VMM_F3 EQU 0x00035B97 pINT_41_0002_0012 EQU 0x00035E09 pINT_41_0001 EQU 0x00035E38 pNew_VMM_C4 EQU 0x00035E9E pNew_VMM_C3 EQU 0x00035ECA pINT_41_0000 EQU 0x00035ED6 pINT_41_000F EQU 0x00035EF8 pBeep EQU 0x00035F34 c_VER_LIN_ EQU 0x0003637B c_VER_ADD_ EQU 0x000363C7 c_VER_ADD__ EQU 0x00036492 c_VER_EXP_ EQU 0x00036583 c_VER_SYM_ EQU 0x00036852 pINT_41_0152_ EQU 0x00036A42 pINT_41_F003 EQU 0x00036BAB pINT_41_0150_3_2 EQU 0x00036F12 pINT_41_0150 EQU 0x00036FCD pINT_41_0152__ EQU 0x00037055 pCheckInternalStack EQU 0x00037E7C pPrintErrorMessage EQU 0x000382CC pPrintLine_Color EQU 0x000382EE pPrintLine_Help EQU 0x0003830A pPrintErrorToCommandWindow EQU 0x00038349 pMemset EQU 0x000383DB pMemcopy EQU 0x0003842A pMapSelectorOffsetToLinAddr EQU 0x0003856E pCopyDword EQU 0x00038599 pCopyWord EQU 0x000385C4 pCopyByte EQU 0x000385F0 pWriteDword EQU 0x0003861B pReadArea EQU 0x0003863B pMovEAX_PTR_EBX EQU 0x00038671 jPAGEIN_INT3 EQU 0x00038673 c_PAGEIN__ EQU 0x00038674 pagein_ring0 EQU 0x000386D2 pINT3_CleanupForPAGEIN EQU 0x00038708 pSwitchContext EQU 0x00038744 pGetNumber EQU 0x00038A2F c_addr_ EQU 0x00038DE3 pEvaluateProcessType EQU 0x00038FBD pGetCurrentThreadAndProcessPointers EQU 0x0003906F c_ADDR EQU 0x000391CC pPrintADDRResults EQU 0x0003927E c_NTCALL_ EQU 0x0003931B c_query_ EQU 0x00039457 query_extendedinfo EQU 0x00039484 query_alien_context EQU 0x0003949B query_switch_to_next_context EQU 0x000394C0 query_exec_query EQU 0x000394EA query_leave EQU 0x0003950A c_QUERY EQU 0x00039513 query_has_args EQU 0x00039536 query_process EQU 0x0003954B query_ret EQU 0x00039577 pHookMapViewOfImageSection EQU 0x0003A10C pHookAddValidPageToWorkingSet EQU 0x0003A191 pHookCopyOnWrite EQU 0x0003A273 pHookRtlAssert EQU 0x0003A2E2 pINT_2D EQU 0x0003AB69 fInitDone EQU 0x0003AED6 pINT_2E EQU 0x0003AED7 nullsub_22 EQU 0x0003B3CE pDispatchIo EQU 0x0003BC68 devio_UnknownControlCode EQU 0x0003BCD5 devio_Leave EQU 0x0003BEC9 pIoDispatchTable EQU 0x0003BF08 pDeviceIOControl EQU 0x0003BF61 pInitFailureCleanup EQU 0x0003BF98 pPatchInt2D EQU 0x0003C484 pSprintf_ EQU 0x0003C808 pInitTypeParsers_1 EQU 0x0003DB19 jInitEvalStructs EQU 0x0003E70B pInitEvalStructs EQU 0x0003E80E pParser_EVALUE EQU 0x000403E8 pGetIRQLLevel EQU 0x000404EA pExpression2Integer2_ EQU 0x00042624 pExpression2Integer2 EQU 0x000427AE pEval_Bx_IF EQU 0x00042882 pGetPrintLineStatus EQU 0x000492F0 pPrintf EQU 0x0004949E pIsNullPointer EQU 0x00049C49 pGetValueFromPCRB EQU 0x00049C7E c_XFRAME__ EQU 0x0004A663 c_OBJDIR_ EQU 0x0004D6F7 c_device_ EQU 0x0004DAEF c_driver_ EQU 0x0004DF05 c_IRP_ EQU 0x0004E64A c_FOBJ_ EQU 0x0004EB1B c_objtab_ EQU 0x0004F16B pIsBuild817 EQU 0x0004FC65 pRetriveNtVersionData EQU 0x0004FC86 pGetMinorVersion EQU 0x0004FCFA pGetMajorVersion EQU 0x0004FD01 pGetBuildType EQU 0x0004FD0C pDiplayNtVersions EQU 0x0004FD13 pGetBuildNumber EQU 0x0004FD5E pGetCSDVersion EQU 0x0004FD65 pGetUniprocValue EQU 0x0004FD6C c_TIMER EQU 0x000501EE c_INTOBJ EQU 0x000505C9 c_DPC EQU 0x00050869 c_APC EQU 0x00050C16 c_BSTAT_ EQU 0x0005166D c_WHAT__ EQU 0x00052311 pEval_Bx_DO EQU 0x000549DD c_MACRO_ EQU 0x00054A18 pParseUserCommand EQU 0x00054D82 pParse_EXCLUDE_SIWVIDRANGE EQU 0x00055763 pSTATUS_NOT_IMPLEMENTED EQU 0x00056234 nullsub_7 EQU 0x0005623A pDeleteSymbolTable__ EQU 0x00059270 nullsub_8 EQU 0x0005929C pDeleteSymbolTable_ EQU 0x0005929F pDeviceIO_3 EQU 0x00059ACB c_SYM_ EQU 0x0005EC42 c_types_ EQU 0x0005EEFD c_PEEK_ EQU 0x0005F33E c_POKE_ EQU 0x0005F46F c_altscr_ EQU 0x0005F5C4 pInitUpdateFunctions_Base EQU 0x0005F826 nullsub_17 EQU 0x0005F847 nullsub_18 EQU 0x0005F848 nullsub_19 EQU 0x0005F849 nullsub_20 EQU 0x0005F84F pUpdateBase_38 EQU 0x0005F852 pUpdateBase_20 EQU 0x0005F85B pUpdateBase_00 EQU 0x0005F8EE pInitUpdateFunctions_Locals EQU 0x0005FBA6 pUpdateLocals_44 EQU 0x0005FEBC pPrintLocals_ EQU 0x000600CD pInitUpdateFunctions_Watches EQU 0x000605FC pUpdateWatches_44 EQU 0x00060726 pPrintWatches_ EQU 0x00060AB1 c_PCI_QueryPCIRegisters EQU 0x00060DAC c_PCI_Query_BusDeviceFunction EQU 0x00060F45 c_PCI_ EQU 0x00061467 c_fiber_ EQU 0x0006174A c_width_ EQU 0x00062AF0 pAllocateHeapBlock EQU 0x000654F1 pHeapFree EQU 0x00065523 c_PAGEIN_ EQU 0x0006554D pin_PageNotPresent EQU 0x0006561E pin_InterrupsEnabled EQU 0x0006563B pin_IrqlLevelBelow2 EQU 0x00065661 JPageinAcceptCommand EQU 0x000656B3 JPagein_ret EQU 0x000656BF nullsub_9 EQU 0x000658AC j_strstr EQU 0x00066402 j_RtlUnwind EQU 0x000665A0 IoFastMutex EQU 0x000695C8 dNticeStartType EQU 0x00095530 fDoingDeviceIO EQU 0x000956C3 wRing0_SS EQU 0x000956D9 dRing0_ESP EQU 0x000956DB IDTBase EQU 0x00097BE7 IoMapingSpaceVirtualAddress EQU 0x0009CDD9 wNTICE_DS EQU 0x0009CDF2 fCS_Type_v86_32_ EQU 0x0009CE29 fNticeFlags EQU 0x0009CE35 fExecuteMoreCommands EQU 0x0009CE39 fClientMode EQU 0x0009CE3B tNTiceIntHandlers EQU 0x0009E4D6 tAllRegisters EQU 0x0009EC56 dDR0 EQU 0x0009F879 dDR1 EQU 0x0009F87D dDR2 EQU 0x0009F881 dDR3 EQU 0x0009F885 dDR7 EQU 0x0009F889 oOLD_IDT_INT_02 EQU 0x0009F88D oOLD_INT02_AR EQU 0x0009F893 oOLD_IDT_INT_0E EQU 0x0009F894 oNEW_IDT_INT_0E EQU 0x0009F898 fIOAPIC_Used EQU 0x0009F8DF oLocalAPICRegisters EQU 0x0009F8E0 _off_PCR_var EQU 0x0009F8E8 NumberOfCPUs EQU 0x0009F8EC ProcessorControlRegion EQU 0x0009F8F0 wInitialFS EQU 0x0009F8F4 dClient_EAX EQU 0x000A01CD dClient_EBX EQU 0x000A01D1 dClient_ECX EQU 0x000A01D5 dClient_EDX EQU 0x000A01D9 dClient_ESI EQU 0x000A01DD dClient_EDI EQU 0x000A01E1 dClient_EBP EQU 0x000A01E5 dClient_ESP EQU 0x000A01E9 dClient_EIP EQU 0x000A01ED dClient_EFLAGS EQU 0x000A01F1 dClient_CS EQU 0x000A01F5 dClient_DS EQU 0x000A01F9 dClient_SS EQU 0x000A01FD dClient_ES EQU 0x000A0201 dClient_FS EQU 0x000A0205 dClient_GS EQU 0x000A0209 tClientRegistersMirrorTable EQU 0x000A0219 bUserCommand EQU 0x000A35EF tCommands EQU 0x000A4F87 tTwoLineBuffer_140 EQU 0x000B2ED2 dCurentProcessKPROCESS EQU 0x000B30F0 fDebugRegistersLimit EQU 0x000CE009 fForcePagein_InProgress EQU 0x000D15A5 dCurrentContext EQU 0x000DED1F dPopupContext EQU 0x000DED23 dNTICE_CR0 EQU 0x000DED2C dNTICE_CR3 EQU 0x000DED30 fPAGEIN_InProgress EQU 0x000E38FB tClientRegistersBckupArea EQU 0x000E38FF oPAGEIN_INT3 EQU 0x000E3947 tContextTable EQU 0x000E4563 _off_KeUpdateSystemTime EQU 0x000E4AC1 wBuildType EQU 0x000F17A8 wBuildNumber EQU 0x000F17AC wUniprocesor EQU 0x000F17B4 dCSDversion EQU 0x000F17B8 ExAcquireFastMutex EQU 0x00102860 ExReleaseFastMutex EQU 0x00102864 KdComPortInUse EQU 0x00102868 HalInitializeProcessor EQU 0x0010286C HalDisplayString EQU 0x00102870 MmIsAddressValid EQU 0x00102878 DbgBreakPoint EQU 0x0010287C ObReferenceObjectByHandle EQU 0x00102880 PsCreateSystemProcess EQU 0x00102884 ExRaiseDatatypeMisalignment EQU 0x00102888 KeUpdateSystemTime EQU 0x0010288C RtlAssert EQU 0x00102890 ExAllocatePoolWithTag EQU 0x00102894 ExFreePool EQU 0x00102898 KeInitializeEvent EQU 0x0010289C IoRegisterShutdownNotification EQU 0x001028A0 PsInitialSystemProcess EQU 0x001028A4 KeServiceDescriptorTable EQU 0x001028A8 NtBuildNumber EQU 0x001028AC MmMapIoSpace EQU 0x001028B0 IoDeleteDevice EQU 0x001028B4 IoCreateSymbolicLink EQU 0x001028B8 IoCreateDevice EQU 0x001028BC RtlInitUnicodeString EQU 0x001028C0 ZwClose EQU 0x001028C4 ObfDereferenceObject EQU 0x001028C8 MmUnmapViewOfSection EQU 0x001028CC KeBugCheckEx EQU 0x001028D0 RtlUnicodeStringToAnsiString EQU 0x001028D4 IoQueryDeviceDescription EQU 0x001028D8 strstr EQU 0x001028DC IofCompleteRequest EQU 0x001028E0 IoDeleteSymbolicLink EQU 0x001028E4 MmUnmapIoSpace EQU 0x001028E8 ZwQueryValueKey EQU 0x001028EC ZwOpenKey EQU 0x001028F0 IoGetDeviceObjectPointer EQU 0x001028F4 RtlFreeUnicodeString EQU 0x001028F8 ZwWriteFile EQU 0x001028FC ZwCreateFile EQU 0x00102900 RtlAnsiStringToUnicodeString EQU 0x00102904 RtlInitAnsiString EQU 0x00102908 KeDelayExecutionThread EQU 0x0010290C ExReleaseResourceForThread EQU 0x00102910 RtlAppendUnicodeToString EQU 0x00102914 RtlCopyUnicodeString EQU 0x00102918 ZwReadFile EQU 0x0010291C ZwQueryInformationFile EQU 0x00102920 _purecall EQU 0x00102924 RtlUnwind EQU 0x00102928 IoDisconnectInterrupt EQU 0x0010292C MmIsThisAnNtAsSystem EQU 0x00102930 ZwOpenDirectoryObject EQU 0x00102934 IoConnectInterrupt EQU 0x00102938 RtlFreeAnsiString EQU 0x0010293C start EQU 0x00102E20 iomap_ok EQU 0x00102F0F jUserConfirmedLoad EQU 0x00102F28 jBuildUnder1902 EQU 0x00102F3C jBuildOver1902 EQU 0x00102F42 start_call_main EQU 0x001034E2 jSTATUS_INSUFICIENT_RESOURCES EQU 0x00103509 start_ret EQU 0x00103514 pRetriveRegistryValue EQU 0x001036F1 pRetriveRegistryValueLite EQU 0x00103795 pPrintToBlueScreen EQU 0x001040FE pInitAskUserForLoad EQU 0x00104136 jBuildUnder1381 EQU 0x0010417E jBuildOver1381 EQU 0x00104187 jKbLoop EQU 0x0010419F jNotEsc EQU 0x001041C8