Cracking 2

home *** CD-ROM | disk | FTP | other *** search

/ Cracking 2 / Cracking II..iso / Tools / icedump 6.018 and nticedump 1.9 / wnt / src / ntice401.inc < prev next >

Wrap

Text File | 2000-02-26 | 37.5 KB | 800 lines

jSET_DEVICE_FOCUS EQU 0x00010579 jDESTROY_VM EQU 0x000105B5 pSavePort_21_A1 EQU 0x000105D4 pRestorePort_21_A1 EQU 0x000105F6 nullsub_13 EQU 0x00010645 nullsub_14 EQU 0x00010646 pNew_VMM_F5 EQU 0x000106E7 pPatch_VKD EQU 0x00010705 pWINICE_service_3 EQU 0x00010869 nullsub_15 EQU 0x00010875 pDefaultWiniceIntHandler EQU 0x00010878 pINT_06 EQU 0x00010A24 pINT_0B EQU 0x00010B09 pINT_0C EQU 0x00010C77 pINT_0D EQU 0x00010CDB pINT_0E EQU 0x00011131 pIRQ_03 EQU 0x0001162C pIRQ_04 EQU 0x00011661 pIRQ_0C EQU 0x00011764 pINT_0F_INT_57 EQU 0x00011795 pINT_01 EQU 0x000117AF pINT_03 EQU 0x00011B1B pKbdWaitMbOutputReady EQU 0x000120AE pPutBackScanCode EQU 0x000120C5 pINT_02 EQU 0x000127F5 pRestoreLDTR EQU 0x00012E03 pInvalidateLDTR EQU 0x00012E26 pPrintMessage_HotKey EQU 0x00013082 pEnterWiniceBySelfTrace EQU 0x000131EF pVKD_PUT_BYTE EQU 0x00013221 pGetDisplayDriverEntryPoint EQU 0x000135D4 nullsub_1 EQU 0x0001361E nullsub_2 EQU 0x00013644 pSwapIDT_INT_0E EQU 0x0001386A pHookFaults_IDT EQU 0x00013904 pSetWiniceIRQs EQU 0x00013A76 pHookKbdVector_IOAPIC EQU 0x00013B35 pHookInt_IDT EQU 0x00013B53 jNextCPU EQU 0x00013B80 pUnHookInt_IDT EQU 0x00013BA9 pReHookInt_IDT EQU 0x00013BD8 pHookInt_IDT_ EQU 0x00013C1D pGetWiniceIntJumpTableOffset EQU 0x00013C9E pInitWiniceIntHandlerJumpTable EQU 0x00013CC0 pSaveDRx EQU 0x00013DDD pINT_02_IOAPIC EQU 0x00013F4D pINT_02__ EQU 0x00013F89 pSaveRegisters_APIC EQU 0x00014005 pGetBase_Initial_FS EQU 0x000140D0 pGetFSLiniarAddress EQU 0x000140ED pSaveAllRegisters EQU 0x000140FB pSaveProcessorRegisters EQU 0x00014234 pSaveCPUID EQU 0x000142AB pSendEOI EQU 0x000144CB pSendEOI_ EQU 0x0001451A pEnableIRQ EQU 0x00014552 pDisableIRQ EQU 0x000145C1 pEnableIRQ_IOAPIC EQU 0x00014618 pDisableIRQ_IOAPIC EQU 0x00014674 pDisableAllIRQs EQU 0x00014693 pGetIRQStatus_IOAPIC EQU 0x00014815 pSetIRQStatus_IOAPIC EQU 0x00014832 pGetIRQStatus_IOAPIC_ EQU 0x0001484F pSetIRQStatus_IOAPIC_ EQU 0x00014866 c_CPU_i_ EQU 0x0001494C c_CPU EQU 0x00014A0E jCPU_InvalidProcID EQU 0x00014A9F c_CPU_ProcID EQU 0x00014B9B pPrintCPUFeatures EQU 0x00014C4A pPrintSpecialRegisters EQU 0x00014D35 pPrintAPICInfo EQU 0x000150DE c_LBRECORD EQU 0x00015270 jLBRECORD_Disable EQU 0x000152C1 pRecordLastFaultInfo EQU 0x000152CD pRecordLastBranchInfo EQU 0x0001534D pPrintLastBranchInfo EQU 0x00015397 pInAxDx EQU 0x00015567 pInAlDx EQU 0x00015572 pOutDxEax EQU 0x0001557C pOutDxAx EQU 0x00015587 pOutDxAl EQU 0x00015597 pByte2HexString EQU 0x000155A5 pWord2HexString EQU 0x000155C5 pDword2HexString EQU 0x000155E2 pDword2DecimalString EQU 0x0001561D pWord2DecimalString EQU 0x0001564A pExcludePhysicalMemoryRange EQU 0x00015677 pIsBlockExcluded EQU 0x0001573B pMOV_AL_EDI_safe EQU 0x00015796 pMOV_AX_EDI_safe EQU 0x000157CD pMOV_EAX_EDI_safe EQU 0x00015807 pMOV_AL_EDI EQU 0x00015841 pMOV_AX_EDI EQU 0x00015857 pMOV_EAX_EDI EQU 0x00015870 pPutFlatByte_safe EQU 0x000158BA pPutFlatByte EQU 0x00015904 pMOV_EDI_AL EQU 0x0001592D pMOV_EDI_AL_safe EQU 0x00015941 pMOV_EDI_AX EQU 0x00015976 pMOV_EDI_AX_safe EQU 0x0001598B pMOV_EDI_EAX_safe EQU 0x000159C1 pMOV_EDI_EAX EQU 0x000159F6 pREP_CMPSB EQU 0x00015A0A pREP_MOVSB EQU 0x00015A1C pREP_MOVSD EQU 0x00015A3A pREP_STOSD EQU 0x00015A58 pREP_STOSB EQU 0x00015A69 pREP_LODSB EQU 0x00015A76 pREP_LODSD EQU 0x00015A83 pREPNE_SCASB EQU 0x00015A90 pREPNE_SCASW EQU 0x00015A9E pMOD_ARG1_ARG0 EQU 0x00015AFE pSkipWhiteSpace EQU 0x00015B19 pSkipDelimiters EQU 0x00015B2A pSkipNonWhiteSpace EQU 0x00015B3B pGetDecimalDigit EQU 0x00015B4E pGetHexDigit EQU 0x00015B5C pGetHexNumber EQU 0x00015BE6 pExpression2Integer EQU 0x0001631F pCheckAddres2 EQU 0x00016517 pCheckAddress EQU 0x0001654D pParseInitLine EQU 0x000165A8 nullsub_3 EQU 0x000166C4 c_VER_PrintUserInfo EQU 0x000166C5 pSetupVideoRegisterInfo_ EQU 0x00016754 pStrcpy EQU 0x00016A50 pStrlen EQU 0x00016A5E pToUpper EQU 0x00016A76 pStrnicmp_ EQU 0x00016AAB pMoveCursor EQU 0x00016AE9 pPrintLine EQU 0x00016C00 pPrintQuestion_ EQU 0x00016C65 pUpdateAllWindows EQU 0x00016CC0 pUpdateCodeWindow EQU 0x00016E77 pShowCodeWindow EQU 0x00017463 pUpdateWatchesWindow EQU 0x000174FE pUpdateLocalsWindow EQU 0x0001757E pUpdateDataWindow EQU 0x00017655 pPrintGenericRegisters EQU 0x00017C09 pUpdateRegistersWindow EQU 0x00017CC8 pGetRegisterColor EQU 0x000180FF pPrintFlags EQU 0x00018136 pSaveClientRegistersForDisplay EQU 0x0001817C pGeneralProtectionFault EQU 0x0001819C pSaveClientRegisters EQU 0x0001822F pSaveAllClientRegisters EQU 0x0001833D pRestoreAllClientRegisters EQU 0x0001844C nullsub_4 EQU 0x000187F0 pMouse_Display_1 EQU 0x00019895 pMouse_UnAssemble_1 EQU 0x0001990B pMouse_What EQU 0x00019A90 pMouse_Previous EQU 0x00019AB3 pMouse_Previous_1 EQU 0x00019BC7 pMouse_Previous_2 EQU 0x00019BFC pMouse_Copy_ EQU 0x00019E24 pMouse_Paste_ EQU 0x00019E88 nullsub_5 EQU 0x00019EDA pEnableWin95Commands EQU 0x0001A704 pFindCommand EQU 0x0001A9F0 pV86_1 EQU 0x0001AC64 pV86_0 EQU 0x0001AC74 pInsertStringIntoBuffer EQU 0x0001B2C4 pEmptyKeyboardBuffer EQU 0x0001BF3B pReadOneKey EQU 0x0001BF53 pProgramLEDs EQU 0x0001C0AC pKbdWaitMbInputReady EQU 0x0001C115 pProcessScanCode EQU 0x0001C154 jProcessScanCode_Translate EQU 0x0001C2BC pInsertCharIntoBuffer EQU 0x0001C2DC pSkipWord EQU 0x0001C31D pIsItOnOrOff EQU 0x0001C348 c_WL EQU 0x0001CBB3 c_WATCH EQU 0x0001CD27 c_WC EQU 0x0001CFFB c_F EQU 0x0001D15F c_S EQU 0x0001D25B jS_NoSearchInProgress EQU 0x0001D412 jS_PatternNotFound EQU 0x0001D419 jS_SyntaxError EQU 0x0001D420 jS_PrintMessage EQU 0x0001D425 c_M EQU 0x0001D667 c_EB EQU 0x0001D766 c_EW EQU 0x0001D776 c_ED EQU 0x0001D786 c_ES EQU 0x0001D796 c_EL EQU 0x0001D7A6 c_ET EQU 0x0001D7B6 c_E EQU 0x0001D7C6 pCopyDelimitedString EQU 0x0001D9E6 pGetPattern EQU 0x0001D9FA c_C EQU 0x0001DA41 c_R EQU 0x0001DC20 pUpdateWindows EQU 0x0001DDBD c_DL EQU 0x0001DE02 c_DS EQU 0x0001DE12 c_DT EQU 0x0001DE22 pMouse_Display_2 EQU 0x0001DE3E c_DATA EQU 0x0001DEB0 c_DEX EQU 0x0001DEEF c_EC EQU 0x0001E0A2 c_U EQU 0x0001E0E3 pMouse_UnAssemble_2 EQU 0x0001E0F3 c_X EQU 0x0001E265 c_P EQU 0x0001E564 c_G EQU 0x0001E862 c_RS EQU 0x0001EB40 c_ID EQU 0x0001EB6C c_IW EQU 0x0001EB73 c_I_IB EQU 0x0001EB7A c_O_OB EQU 0x0001EC47 c_SET_MOUSE EQU 0x0001EDDF c_SET_WHEELLINES EQU 0x0001EE76 c_CODE EQU 0x0001EECA c_?_H_HELP EQU 0x0001EF49 c_VER EQU 0x0001F124 c_CLS EQU 0x0001F161 c_ALTKEY EQU 0x0001F389 c_FKEY EQU 0x0001F447 c_COLOR EQU 0x0001F612 pIsTraceOn EQU 0x0001F769 c_ZAP EQU 0x0001F782 c_SRC EQU 0x0001F7C4 c_TABS EQU 0x0001F8DD c_A EQU 0x0001F928 c_FORMAT EQU 0x0001FA0C c_LINES EQU 0x0001FA66 c_LINES_ EQU 0x0001FBAF c_SET EQU 0x0001FD25 pFindSetParameter EQU 0x0001FE81 c_ANSWER EQU 0x0001FF36 pCopyUntilWhiteSpace EQU 0x00020063 c_SET_VERBOSE EQU 0x00020247 c_SET_LOWERCASE EQU 0x00020290 c_SET_REFERENCE EQU 0x000202C8 c_SET_CASESENSITIVE EQU 0x000202FE c_SET_THREADP EQU 0x0002033D c_PCI EQU 0x000203EF c_PAGEIN EQU 0x00020427 pDetectMonoVideoCard EQU 0x0002047C pInitMonoVideoCard EQU 0x00020577 c_CSIP EQU 0x000209C4 c_BC_BD_BE EQU 0x00020C72 c_BL EQU 0x00020DA3 c_BPINT EQU 0x00020FB3 pPrintBPInfo_BPINT EQU 0x00021060 nullsub_10 EQU 0x00021081 nullsub_12 EQU 0x00021082 pEval_Bx EQU 0x00021083 c_BPX EQU 0x0002111D pPrintBPInfo_BPX EQU 0x00021523 pBE_BPX EQU 0x00021582 pBD_BPX EQU 0x000215B4 pBD_BPX_BMSG EQU 0x000215CC pBD_BPX_BMSG_ EQU 0x00021665 pPrintBPInfo_BMSG EQU 0x00021863 j_pBE_BPX EQU 0x0002192C c_BPM_BPMB EQU 0x00021949 c_BPMD EQU 0x0002194E c_BPMW EQU 0x00021953 pBE_BPM EQU 0x00021D06 pBD_BPM EQU 0x00021D38 c_BPIO EQU 0x00021EC5 pPrintBPInfo_BPIO EQU 0x00021F99 nullsub_11 EQU 0x00021FDC pBD_BPIO EQU 0x00021FDD pBPIOSetPortInPermissionMap EQU 0x00021FE9 c_BPR_RangeCheck EQU 0x00022097 pRangeCheck EQU 0x000221D7 pCheckDuplicateBP EQU 0x00022230 jNotDuplicateBP EQU 0x000222C3 jItsDuplicateBP EQU 0x000222D3 pAllocateBP EQU 0x00022366 pSetupBPStruct EQU 0x000224B7 pBP_SetModuleName EQU 0x000225C7 c_BH EQU 0x00022685 oNew_PM_VMM_INT_0E_ EQU 0x00022DB0 pIdentifyWiniceBPINT EQU 0x00023AB2 pDeactivateBPs EQU 0x00023D2A pActivateBPs EQU 0x00024003 pINT_41_F003_2 EQU 0x000243C1 pSetDRx EQU 0x0002441B pSetDR_01237 EQU 0x00024492 pCalledOnTaskSwitch EQU 0x00024845 pDisasmOneOpCode EQU 0x00024A38 pDisAsm_DOS_INT21 EQU 0x00024D2A pDisAsm_DPMI_INT31 EQU 0x00024E96 pDisAsm_VMM_INT20 EQU 0x00024EF1 pDisAsm_JumpStatus EQU 0x00024FE1 jJECXZ EQU 0x000250A2 jDisAsm_JMPs_nojmp EQU 0x000250BB jDisAsm_JMPs_jmp EQU 0x000250C2 jDisAsm_JMPs_ret EQU 0x000250FB pDisAsm_AppendCharToLine EQU 0x0002518E pDisAsm_AppendBufferToLine EQU 0x000251E0 pReadClientRegister EQU 0x00025257 pWriteClientRegister EQU 0x00025270 pDisAsm_SkipInLine EQU 0x000252A1 pDisAsm_SkipPrefix EQU 0x000252CC pMaximizeSomeRange EQU 0x000252F0 pMaximizeSafeReadRange EQU 0x00025316 pSetFlag_Client_CS_32bit EQU 0x00025335 pSearchPattern_InProcedure EQU 0x0002534D pFindPattern EQU 0x000253CF pSearchPattern EQU 0x000253E7 c_GDT EQU 0x00025830 c_LDT EQU 0x00025941 jLDT_NoLDT EQU 0x00025A69 jLDT_PageNotPresent EQU 0x00025A70 jLDT_SyntaxError EQU 0x00025A77 pPrintInfo_GDT_LDT EQU 0x00025A84 c_IDT_PrintInfo EQU 0x00025BC8 pPrintInfo_IDT EQU 0x00025C2B pPrintSelectorOffset EQU 0x00025FDC pPM_01xx EQU 0x00026006 c_PHYS EQU 0x000263E9 c_PHYS_ EQU 0x00026423 pPEEK_POKE_CALL_EBX EQU 0x0002653E pPEEK_LinAddr EQU 0x00026593 pPEEK_B EQU 0x000265A8 pPEEK_W EQU 0x000265CD pPEEK_D EQU 0x000265F3 pPOKE_B EQU 0x00026618 pPOKE_W EQU 0x0002663B pPOKE_D EQU 0x0002665E pRDTSC_AtIntExit EQU 0x00026681 pRDTSC_AtIntEntry EQU 0x000266A9 pRDTSC EQU 0x000266D0 pPrintExecTime EQU 0x000266DF pPrintExecTime_ EQU 0x00026761 pCalibrate_INT8 EQU 0x00026895 pCalibrateBy_Timer EQU 0x000269C3 pPrintFPUStatusWord EQU 0x00026B9C pPrintFPUControlWord EQU 0x00026BBD pPrintFPUStatusWord_ EQU 0x00026BDE pPrintFPUControlWord_ EQU 0x00026C25 c_LHEAP_ EQU 0x00027BF5 c_TASK_ EQU 0x00027E6D pWalkTaskList EQU 0x00028536 jWalkTaskList_error EQU 0x000287E4 pGetLinAddr_selKernel32SomeThing EQU 0x00028953 pMapSelectorToLinAddr EQU 0x00028A23 pClearLogLine EQU 0x00028B20 pGetBase_LDT EQU 0x00028B39 pWalkDDBChain EQU 0x00029604 pGetVMM_API_offsets EQU 0x00029637 c_VER_TOUCH EQU 0x0002984E pINT_41 EQU 0x0002988F pINT_41_0150_3 EQU 0x00029D8E pINT3_FGJM_82xx EQU 0x0002A01E pINT3_FGJM_83xx EQU 0x0002A0EA pDeviceIO_9 EQU 0x0002A18B nullsub_6 EQU 0x0002A26A c_EXP EQU 0x0002A2E1 c_WMSG EQU 0x0002A507 j_c_NTCALL_ EQU 0x0002A5B9 pGetModuleName EQU 0x0002A5BE pFindModuleByName EQU 0x0002A679 pINT_41_0040 EQU 0x0002A898 pINT3_FGJM_09xx EQU 0x0002B1A0 pINT3_FGJM_09xx_OK EQU 0x0002B1C9 pINT3_FGJM_0900 EQU 0x0002B241 pFindEntryPoint EQU 0x0002B798 pINT3_FGJM_0904_0905 EQU 0x0002B8A3 pINT3_FGJM_0903 EQU 0x0002BC52 pINT3_FGJM_090E EQU 0x0002BD3D pINT3_FGJM_0907 EQU 0x0002BF55 pINT3_FGJM_0908 EQU 0x0002C031 pINT3_FGJM_0909 EQU 0x0002C075 pINT3_FGJM_090A EQU 0x0002C0E4 pINT3_FGJM_090B_090D EQU 0x0002C0F9 pINT3_FGJM_090C EQU 0x0002C227 pINT3_FGJM_0918 EQU 0x0002C23D pINT3_FGJM_0919 EQU 0x0002C2A9 pPM_FF1F_ EQU 0x0002DAE1 c_SS EQU 0x0002E1B4 c_FILE EQU 0x0002E382 c_TABLE_AUTO EQU 0x0002E67A j_TABLE_AUTO EQU 0x0002E684 nullsub_16 EQU 0x0002F37E c_STACK_ EQU 0x0002F3EA c_STACK___ EQU 0x0002F402 c__stack__ EQU 0x0002F521 c_SYMLOC_X EQU 0x0002FB19 pStrchr EQU 0x0002FD6A c_A_ EQU 0x0002FD7C pHasArgument EQU 0x00031BA3 pReadClientRegister_ EQU 0x00031D6F pSetSerialSpeed EQU 0x00032AC2 pReadSerial_Byte EQU 0x00032B55 pSendSerial_Byte EQU 0x00032BCC pAttachToSerialDevice EQU 0x0003301F pResetModem EQU 0x000330B2 pGetModemResponse EQU 0x000330DF pSendSerial_Line EQU 0x0003311F pReadSerial_String EQU 0x00033143 pDelay_200ms EQU 0x00033179 pDelayMilliSec EQU 0x00033186 pPrintChar_PAR EQU 0x00033BA4 pPrintChar_LPT_SER EQU 0x00033C12 pPrintChar_SER EQU 0x00033C91 pStr2ShortReal EQU 0x00033CE8 pStr2LongReal EQU 0x0003457E pPM_FF01 EQU 0x00034AB3 pPM_FF02 EQU 0x00034B0E pPM_FF03 EQU 0x00034BAA pPM_FF04 EQU 0x00034BD3 pPM_FF05 EQU 0x00034D52 pPM_FF06 EQU 0x00034D95 pPM_FF07 EQU 0x00034E04 pPM_FF08 EQU 0x00034E77 pPM_FF09 EQU 0x00034E93 pPM_FF0A EQU 0x00034EAE pPM_FF0B EQU 0x00034F2C pPM_FF0D EQU 0x00034F50 pPM_FF0E EQU 0x00034F6A pPM_FF0F EQU 0x00034FF4 pPM_FF11 EQU 0x00035046 pPM_FF12 EQU 0x00035091 pPM_FF15 EQU 0x000350B2 pPM_FF16 EQU 0x00035173 pPM_FF17 EQU 0x000351B6 pPM_FF18 EQU 0x0003521C pPM_FF1A EQU 0x00035365 pPM_FF1B EQU 0x00035378 pPM_FF1C EQU 0x000353AE pPM_FF1D EQU 0x0003540A pPM_FF1E EQU 0x00035450 pPM_FF1F EQU 0x0003547A pSwitchContext_InWinice EQU 0x00035600 pINT_41_0070 EQU 0x00035CD4 pINT_41_0071 EQU 0x00035CE5 pINT_41_0072 EQU 0x00035CF6 pINT_41_0074 EQU 0x00035D16 pINT_41_0073 EQU 0x00035D2C pINT_41_0075 EQU 0x00035D95 pINT_41_0076 EQU 0x00035DB6 pINT_41_0077 EQU 0x00035DD8 pINT_41_0078 EQU 0x00035E07 pINT_41_0079 EQU 0x00035E3B pINT_41_007A EQU 0x00035E57 pINT_41_007B EQU 0x0003602D pINT_41_007F EQU 0x00036046 pINT_41_0080 EQU 0x000360BE pHandleFaultIn_DOT_QUERY EQU 0x0003611D pINT_41_0084 EQU 0x00036157 pFindDotCommand EQU 0x000361A7 pRegisterDotCommand EQU 0x000361CE c_DOT_VXDNAME_? EQU 0x000361F5 c_DOT_VXDNAME_ EQU 0x0003623D pDotCommand_FaultHandler EQU 0x000362A7 pSaveClientRegisters_ EQU 0x0003633E c_VER_DOT_ EQU 0x000363C3 pStrend EQU 0x000364EF pINT_41_0050 EQU 0x0003650B pINT_41_0152_1 EQU 0x00036655 pINT_41_0052 EQU 0x000366D0 pINT_41_0065 EQU 0x0003672F pINT_41_0066 EQU 0x000367AE pINT_41_0064 EQU 0x00036850 pINT_41_007x_PrintRegs EQU 0x000368E2 pNew_VMM_12D EQU 0x00036A12 pNew_VMM_F3 EQU 0x00036A26 pINT_41_0002_0012 EQU 0x00036C98 pINT_41_0001 EQU 0x00036CC7 pNew_VMM_C4 EQU 0x00036D2D pNew_VMM_C3 EQU 0x00036D59 pINT_41_0000 EQU 0x00036D65 pINT_41_000F EQU 0x00036D87 pBeep EQU 0x00036DC3 c_VER_LIN_ EQU 0x0003720A c_VER_ADD_ EQU 0x00037256 c_VER_ADD__ EQU 0x00037321 c_VER_EXP_ EQU 0x00037412 c_VER_SYM_ EQU 0x000376E1 pINT_41_0152_2 EQU 0x000378D2 pINT_41_F003_1 EQU 0x00037A3B pINT_41_0150_3_2 EQU 0x00037DA2 pINT_41_0150_1 EQU 0x00037E5D pINT_41_0152_3 EQU 0x00037EE5 pCheckInternalStack EQU 0x00038D30 pPrintErrorMessage EQU 0x00039180 pPrintErrorToCommandWindow EQU 0x00039191 pPrintLine_Color EQU 0x000391A2 pPrintLine_Help EQU 0x000391BE pMemset EQU 0x0003928F pMemcopy EQU 0x000392DE pMapSelectorOffsetToLinAddr EQU 0x00039422 pCopyDword EQU 0x0003944D pCopyWord EQU 0x00039478 pCopyByte EQU 0x000394A4 pWriteDword EQU 0x000394CF pReadArea EQU 0x000394EF jPAGEIN_INT3 EQU 0x00039527 c_PAGEIN__ EQU 0x00039528 pINT3_CleanupForPAGEIN EQU 0x000395BC pSwitchContext EQU 0x000395F8 pGetNumber EQU 0x000398E3 c_addr_ EQU 0x00039C97 pEvaluateProcessType EQU 0x00039E71 pGetCurrentThreadAndProcessPointers EQU 0x00039F23 c_ADDR EQU 0x0003A080 pPrintADDRResults EQU 0x0003A132 c_NTCALL_ EQU 0x0003A1CF c_query_ EQU 0x0003A30B query_extendedinfo EQU 0x0003A338 query_alien_context EQU 0x0003A34F query_switch_to_next_context EQU 0x0003A374 query_exec_query EQU 0x0003A39E query_leave EQU 0x0003A3BE pHookMapViewOfImageSection EQU 0x0003B01C pHookAddValidPageToWorkingSet EQU 0x0003B0A1 pHookCopyOnWrite EQU 0x0003B183 pHookRtlAssert EQU 0x0003B1F2 pINT_2E EQU 0x0003BE0A nullsub_21 EQU 0x0003C329 _snwprintf EQU 0x0003C8E0 _stricmp EQU 0x0003C8E6 _strnicmp EQU 0x0003C8EC _wcsicmp EQU 0x0003C8F2 _wcsnicmp EQU 0x0003C8F8 DbgPrint EQU 0x0003C8FE isspace EQU 0x0003C904 isprint EQU 0x0003C90A RtlCompareMemoryUlong EQU 0x0003C910 RtlCompareMemory EQU 0x0003C916 RtlCompareString EQU 0x0003C91C RtlCompareUnicodeString EQU 0x0003C922 RtlConvertSidToUnicodeString EQU 0x0003C928 RtlInitAnsiString EQU 0x0003C92E RtlInitString EQU 0x0003C934 RtlInitUnicodeString EQU 0x0003C93A RtlLengthRequiredSid EQU 0x0003C940 RtlLengthSid EQU 0x0003C946 RtlNumberGenericTableElements EQU 0x0003C94C RtlUnwind EQU 0x0003C952 RtlValidSid EQU 0x0003C958 RtlTimeToTimeFields EQU 0x0003C95E RtlTimeFieldsToTime EQU 0x0003C964 sprintf EQU 0x0003C96A strchr EQU 0x0003C970 strncmp EQU 0x0003C976 strncpy EQU 0x0003C97C strstr EQU 0x0003C982 swprintf EQU 0x0003C988 tolower EQU 0x0003C98E toupper EQU 0x0003C994 vsprintf EQU 0x0003C99A wcscmp EQU 0x0003C9A0 wcscpy EQU 0x0003C9A6 wcslen EQU 0x0003C9AC qsort EQU 0x0003C9B2 _chkstk EQU 0x0003CA00 pDeviceIOControl EQU 0x0003D297 pInitFailureCleanup EQU 0x0003D2CE pSprintf_ EQU 0x0003DC7F pInitTypeParsers_1 EQU 0x0003EF98 jInitEvalStructs EQU 0x0003FB8A pInitEvalStructs EQU 0x0003FC8D nullsub_7 EQU 0x00040000 pParser_EVALUE EQU 0x00041867 pGetIRQLLevel EQU 0x00041969 pExpression2Integer2_ EQU 0x00043AA3 pExpression2Integer2 EQU 0x00043C2D pEval_Bx_IF EQU 0x00043D01 pGetPrintLineStatus EQU 0x0004A7EB pPrintf EQU 0x0004A999 pIsNullPointer EQU 0x0004B144 pGetValueFromPCRB EQU 0x0004B179 _ui64toa EQU 0x0004B81D c_XFRAME__ EQU 0x0004BBD9 c_OBJDIR_ EQU 0x0004ED46 c_device_ EQU 0x0004F141 c_driver_ EQU 0x0004F56D c_IRP_ EQU 0x0004FD3F c_FOBJ_ EQU 0x00050210 c_objtab_ EQU 0x00050881 pIsBuild817 EQU 0x0005137D pRetriveNtVersionData EQU 0x000513B0 pDiplayNtVersions EQU 0x0005143D c_TIMER EQU 0x00051918 c_INTOBJ EQU 0x00051CF3 c_DPC EQU 0x00051F91 c_APC EQU 0x0005233E c_BSTAT_ EQU 0x0005331C c_WHAT__ EQU 0x00053FC0 pEval_Bx_DO EQU 0x0005668C c_MACRO_ EQU 0x000566C7 pParseUserCommand EQU 0x00056A31 pParse_EXCLUDE_SIWVIDRANGE EQU 0x00057412 _vsnprintf EQU 0x000624C1 strcspn EQU 0x00062547 _strupr EQU 0x00062567 malloc EQU 0x000625B0 free EQU 0x00062604 LocalAlloc EQU 0x00062618 LocalFree EQU 0x0006265B LocalLock EQU 0x00062679 fopen EQU 0x00062693 fwrite EQU 0x000626A0 fclose EQU 0x000626AD LocalUnlock EQU 0x000626BA _initterm EQU 0x000626C9 DisableThreadLibraryCalls EQU 0x000626CA sscanf EQU 0x0006282E CloseHandle EQU 0x00062AC4 CreateFileA EQU 0x00062AD3 GetFullPathNameW EQU 0x00062AE5 GetLastError EQU 0x00062AF4 GetVersion EQU 0x00062AFA GetProcessHeap EQU 0x00062B18 HeapAlloc EQU 0x00062B1E HeapFree EQU 0x00062B6F HeapReAlloc EQU 0x00062B9E GlobalAlloc EQU 0x00062BAD GlobalFree EQU 0x00062BBC RaiseException EQU 0x00062BCB VirtualAlloc EQU 0x00062C15 VirtualFree EQU 0x00062C41 WriteFile EQU 0x00062C6C _except_handler3 EQU 0x00062C7B _local_unwind2 EQU 0x00062C86 _wtoi EQU 0x00062C91 ctime EQU 0x00062CF3 strpbrk EQU 0x00062DFC strtok EQU 0x00062E09 strtoul EQU 0x00062ED9 isalpha EQU 0x00062F2C towlower EQU 0x00062F57 towupper EQU 0x00062F71 RtlGetAce EQU 0x00062F8B RtlValidAcl EQU 0x00062F96 RtlAnsiStringToUnicodeString EQU 0x00062FA1 RtlFreeUnicodeString EQU 0x00063003 RtlUnicodeStringToAnsiString EQU 0x00063031 RtlFreeAnsiString EQU 0x00063091 RtlTimeToElapsedTimeFields EQU 0x000630BF GetTimeZoneInformation EQU 0x000630D3 nullsub_8 EQU 0x00063345 pDeleteSymbolTable__ EQU 0x000663C5 nullsub_9 EQU 0x000663F1 pDeleteSymbolTable_ EQU 0x000663F4 pDeviceIO_3 EQU 0x00066C2B c_SYM_ EQU 0x0006BDA0 c_types_ EQU 0x0006C05B c_PEEK_ EQU 0x0006C49C c_POKE_ EQU 0x0006C5CD c_altscr_ EQU 0x0006C722 pInitUpdateFunctions_Base EQU 0x0006C984 nullsub_17 EQU 0x0006C9A5 nullsub_18 EQU 0x0006C9A6 nullsub_19 EQU 0x0006C9A7 nullsub_20 EQU 0x0006C9AD pUpdateBase_38 EQU 0x0006C9B0 pUpdateBase_20 EQU 0x0006C9B9 pUpdateBase_00 EQU 0x0006CA4C pInitUpdateFunctions_Locals EQU 0x0006CD04 pUpdateLocals_44 EQU 0x0006D01A pPrintLocals_ EQU 0x0006D22B pInitUpdateFunctions_Watches EQU 0x0006D75A pUpdateWatches_44 EQU 0x0006D884 pPrintWatches_ EQU 0x0006DC0F c_PCI_QueryPCIRegisters EQU 0x0006DF0A c_PCI_Query_BusDeviceFunction EQU 0x0006E0A3 c_PCI_ EQU 0x0006E5C5 c_fiber_ EQU 0x0006E8A8 c_width_ EQU 0x0006FC70 pAllocateHeapBlock EQU 0x00072671 pHeapFree EQU 0x000726A3 c_PAGEIN_ EQU 0x000726CD pin_PageNotPresent EQU 0x0007279E pin_InterrupsEnabled EQU 0x000727BB pin_IrqlLevelBelow2 EQU 0x000727E1 JPageinAcceptCommand EQU 0x00072833 JPagein_ret EQU 0x0007283F j__stricmp_0 EQU 0x00073BA4 j_RtlUnwind_0 EQU 0x00073BAA j_strncpy_0 EQU 0x00073BB0 j_strstr_0 EQU 0x00073BB6 j_ExAllocatePool EQU 0x00073D4E fExecuteMoreCommands EQU 0x000BC6B9 fClientMode EQU 0x000BC6BB dClient_EAX EQU 0x000BFC2D dClient_EBX EQU 0x000BFC31 dClient_ECX EQU 0x000BFC35 dClient_EDX EQU 0x000BFC39 dClient_ESI EQU 0x000BFC3D dClient_EDI EQU 0x000BFC41 dClient_EBP EQU 0x000BFC45 dClient_ESP EQU 0x000BFC49 dClient_EIP EQU 0x000BFC4D dClient_EFLAGS EQU 0x000BFC51 dClient_CS EQU 0x000BFC55 dClient_DS EQU 0x000BFC59 dClient_SS EQU 0x000BFC5D dClient_ES EQU 0x000BFC61 dClient_FS EQU 0x000BFC65 dClient_GS EQU 0x000BFC69 bUserCommand EQU 0x000C30FF dCurrentContext EQU 0x000FEB23 dPopupContext EQU 0x000FEB27 fPAGEIN_InProgress EQU 0x001036FF oPAGEIN_INT3 EQU 0x0010374B ExAcquireFastMutex EQU 0x0012ADBC ExReleaseFastMutex EQU 0x0012ADC0 HalDisplayString EQU 0x0012ADC4 KdComPortInUse EQU 0x0012ADC8 HalInitializeProcessor EQU 0x0012ADCC MmUnmapViewOfSection EQU 0x0012ADD4 DbgBreakPoint EQU 0x0012ADD8 ObReferenceObjectByHandle EQU 0x0012ADDC PsCreateSystemProcess EQU 0x0012ADE0 ExRaiseDatatypeMisalignment EQU 0x0012ADE4 KeUpdateSystemTime EQU 0x0012ADE8 RtlAssert EQU 0x0012ADEC _snwprintf_0 EQU 0x0012ADF0 _stricmp_0 EQU 0x0012ADF4 _strnicmp_0 EQU 0x0012ADF8 _wcsicmp_0 EQU 0x0012ADFC _wcsnicmp_0 EQU 0x0012AE00 DbgPrint_0 EQU 0x0012AE04 isspace_0 EQU 0x0012AE08 isprint_0 EQU 0x0012AE0C RtlCompareMemoryUlong_0 EQU 0x0012AE10 RtlCompareMemory_0 EQU 0x0012AE14 RtlCompareString_0 EQU 0x0012AE18 RtlCompareUnicodeString_0 EQU 0x0012AE1C RtlConvertSidToUnicodeString_0 EQU 0x0012AE20 RtlInitAnsiString_0 EQU 0x0012AE24 RtlInitString_0 EQU 0x0012AE28 RtlInitUnicodeString_0 EQU 0x0012AE2C RtlLengthRequiredSid_0 EQU 0x0012AE30 RtlLengthSid_0 EQU 0x0012AE34 RtlNumberGenericTableElements_0 EQU 0x0012AE38 RtlUnwind_0 EQU 0x0012AE3C RtlValidSid_0 EQU 0x0012AE40 RtlTimeToTimeFields_0 EQU 0x0012AE44 RtlTimeFieldsToTime_0 EQU 0x0012AE48 sprintf_0 EQU 0x0012AE4C strchr_0 EQU 0x0012AE50 strncmp_0 EQU 0x0012AE54 strncpy_0 EQU 0x0012AE58 strstr_0 EQU 0x0012AE5C swprintf_0 EQU 0x0012AE60 tolower_0 EQU 0x0012AE64 toupper_0 EQU 0x0012AE68 vsprintf_0 EQU 0x0012AE6C wcscmp_0 EQU 0x0012AE70 wcscpy_0 EQU 0x0012AE74 MmIsAddressValid EQU 0x0012AE78 KeBugCheckEx EQU 0x0012AE7C ExAllocatePoolWithTag EQU 0x0012AE80 ExFreePool EQU 0x0012AE84 KeSetTimer EQU 0x0012AE88 KeInitializeDpc EQU 0x0012AE8C KeInitializeTimer EQU 0x0012AE90 MmGetPhysicalAddress EQU 0x0012AE94 MmAllocateContiguousMemory EQU 0x0012AE98 KeInitializeEvent EQU 0x0012AE9C IoRegisterShutdownNotification EQU 0x0012AEA0 PsInitialSystemProcess EQU 0x0012AEA4 KeServiceDescriptorTable EQU 0x0012AEA8 NtBuildNumber EQU 0x0012AEAC MmMapIoSpace EQU 0x0012AEB0 IoDeleteDevice EQU 0x0012AEB4 IoCreateSymbolicLink EQU 0x0012AEB8 IoCreateDevice EQU 0x0012AEBC ZwClose EQU 0x0012AEC0 ObfDereferenceObject EQU 0x0012AEC4 ZwOpenDirectoryObject EQU 0x0012AEC8 RtlFreeAnsiString_0 EQU 0x0012AECC RtlUnicodeStringToAnsiString_0 EQU 0x0012AED0 IoQueryDeviceDescription EQU 0x0012AED4 IofCompleteRequest EQU 0x0012AED8 IoDeleteSymbolicLink EQU 0x0012AEDC MmUnmapIoSpace EQU 0x0012AEE0 KeCancelTimer EQU 0x0012AEE4 ZwQueryValueKey EQU 0x0012AEE8 ZwOpenKey EQU 0x0012AEEC IoGetDeviceObjectPointer EQU 0x0012AEF0 RtlFreeUnicodeString_0 EQU 0x0012AEF4 ZwWriteFile EQU 0x0012AEF8 ZwCreateFile EQU 0x0012AEFC RtlAnsiStringToUnicodeString_0 EQU 0x0012AF00 KeDelayExecutionThread EQU 0x0012AF04 ExReleaseResourceForThread EQU 0x0012AF08 RtlAppendUnicodeToString EQU 0x0012AF0C RtlCopyUnicodeString EQU 0x0012AF10 ZwReadFile EQU 0x0012AF14 ZwQueryInformationFile EQU 0x0012AF18 ExAllocatePool EQU 0x0012AF1C _purecall EQU 0x0012AF20 MmIsThisAnNtAsSystem EQU 0x0012AF24 IoDisconnectInterrupt EQU 0x0012AF28 IoConnectInterrupt EQU 0x0012AF2C wcslen_0 EQU 0x0012AF30 qsort_0 EQU 0x0012AF34 start EQU 0x0012BEA0 pRetriveRegistryValue EQU 0x0012C984 pRetriveRegistryValueLite EQU 0x0012CA28