423 lines
11 KiB
Plaintext
423 lines
11 KiB
Plaintext
|
4589 KiIdleLoop
|
|||
|
|
1887 KiInterruptException
|
|||
|
|
1556 OtsMove
|
|||
|
|
914 RtlCopyBytes
|
|||
|
|
522 KiUnlockDispatcherDatabase
|
|||
|
|
501 ExReleaseResourceLite
|
|||
|
|
435 KeSynchronizeExecution
|
|||
|
|
405 ExAcquireResourceExclusiveLite
|
|||
|
|
325 ExAllocatePoolWithTag
|
|||
|
|
273 IopParseDevice
|
|||
|
|
271 RtlFindClearBits
|
|||
|
|
257 ExAcquireFastMutex
|
|||
|
|
257 KiSwapThreadExit
|
|||
|
|
237 ExpInterlockedPopEntrySListFault
|
|||
|
|
235 OtsZero
|
|||
|
|
210 IofCompleteRequest
|
|||
|
|
197 RtlCompareMemory
|
|||
|
|
195 ExReleaseFastMutex
|
|||
|
|
190 ExpInterlockedPushEntrySList
|
|||
|
|
190 KiRetireDpcList
|
|||
|
|
180 KiDispatchInterrupt
|
|||
|
|
175 RtlUpcaseUnicodeToOemN
|
|||
|
|
173 CcMapData
|
|||
|
|
170 ExFreePoolWithTag
|
|||
|
|
153 FsRtlDissectName
|
|||
|
|
146 FsRtlIsNameInExpressionPrivate
|
|||
|
|
142 CcGetVirtualAddress
|
|||
|
|
128 ExAcquireResourceSharedLite
|
|||
|
|
118 KeFlushIoBuffers
|
|||
|
|
118 KeReleaseSpinLock
|
|||
|
|
117 KeAcquireSpinLockRaiseToDpc
|
|||
|
|
115 CcPinFileData
|
|||
|
|
105 ObReferenceObjectByHandle
|
|||
|
|
105 OtsFieldInsert
|
|||
|
|
91 PsImpersonateClient
|
|||
|
|
88 ObfDereferenceObject
|
|||
|
|
85 IoGetRelatedDeviceObject
|
|||
|
|
84 CcFindBcb
|
|||
|
|
80 RtlSplay
|
|||
|
|
77 IoAllocateIrp
|
|||
|
|
77 ObOpenObjectByName
|
|||
|
|
76 KeRemoveQueue
|
|||
|
|
75 ExInterlockedAddUlong
|
|||
|
|
74 ExpFindCurrentThread
|
|||
|
|
73 IofCallDriver
|
|||
|
|
73 RtlpGetStackLimits
|
|||
|
|
71 ObpLookupObjectName
|
|||
|
|
69 ExpInterlockedPopEntrySList
|
|||
|
|
67 MmProbeAndLockPages
|
|||
|
|
66 CcFreeVirtualAddress
|
|||
|
|
66 RtlCompareUnicodeString
|
|||
|
|
61 KeInsertQueue
|
|||
|
|
60 IoSetTopLevelIrp
|
|||
|
|
58 IoFreeIrp
|
|||
|
|
57 IopCheckBackupRestorePrivilege
|
|||
|
|
57 ObpCaptureObjectCreateInformation
|
|||
|
|
54 PsReferencePrimaryToken
|
|||
|
|
53 CcFlushCache
|
|||
|
|
53 CcUnpinFileData
|
|||
|
|
53 KeAcquireSpinLockAtDpcLevel
|
|||
|
|
52 KeLeaveCriticalRegion
|
|||
|
|
51 CcSetDirtyPinnedData
|
|||
|
|
51 FsRtlLookupLargeMcbEntry
|
|||
|
|
50 CcCanIWrite
|
|||
|
|
50 MmCheckCachedPageState
|
|||
|
|
48 CcSetDirtyInMask
|
|||
|
|
47 ExReleaseFastMutexUnsafe
|
|||
|
|
46 IopAllocateIrp
|
|||
|
|
45 CcFastCopyRead
|
|||
|
|
44 ObpAllocateObject
|
|||
|
|
43 IoAllocateMdl
|
|||
|
|
42 ExAcquireFastMutexUnsafe
|
|||
|
|
42 ExIsResourceAcquiredExclusiveLite
|
|||
|
|
42 FsRtlFindLargeIndex
|
|||
|
|
42 IoGetTopLevelIrp
|
|||
|
|
41 CcAcquireByteRangeForWrite
|
|||
|
|
41 ExpInterlockedCompareExchange64
|
|||
|
|
41 KeQuerySystemTime
|
|||
|
|
41 KiReleaseSpinLock
|
|||
|
|
41 MmUnlockPages
|
|||
|
|
41 RtlTimeToTimeFields
|
|||
|
|
40 MiFlushSectionInternal
|
|||
|
|
39 FsRtlIsFatDbcsLegal
|
|||
|
|
38 memcmp
|
|||
|
|
38 PsReferenceImpersonationToken
|
|||
|
|
37 CcFastCopyWrite
|
|||
|
|
37 KiRestoreVolatileIntegerState
|
|||
|
|
37 RtlEqualUnicodeString
|
|||
|
|
36 CcInitializeCacheMap
|
|||
|
|
36 CcUninitializeCacheMap
|
|||
|
|
36 CcWriteBehind
|
|||
|
|
36 IopCloseFile
|
|||
|
|
36 ObpFreeObjectNameBuffer
|
|||
|
|
36 SeCreateAccessState
|
|||
|
|
35 IoCreateFile
|
|||
|
|
35 ObpIncrementHandleCount
|
|||
|
|
35 OtsStringCompareEql
|
|||
|
|
34 CcMapAndRead
|
|||
|
|
34 FsRtlCheckOplock
|
|||
|
|
34 IopDeleteFile
|
|||
|
|
33 IopParseFile
|
|||
|
|
33 RtlIsNameLegalDOS8Dot3
|
|||
|
|
32 CcMapAndCopy
|
|||
|
|
32 IoBuildPartialMdl
|
|||
|
|
32 IoFreeMdl
|
|||
|
|
32 MmUnmapViewInSystemCache
|
|||
|
|
31 CcPrepareMdlWrite
|
|||
|
|
31 RtlMapGenericMask
|
|||
|
|
31 RtlNtStatusToDosErrorNoTeb
|
|||
|
|
30 FsRtlOplockFsctrl
|
|||
|
|
30 IopCompleteRequest
|
|||
|
|
30 ObpCaptureObjectName
|
|||
|
|
30 RtlCopyUnicodeString
|
|||
|
|
29 CcUnpinData
|
|||
|
|
29 ExpAcquireResourceSharedLite
|
|||
|
|
28 MmCreateSection
|
|||
|
|
27 ExAcquireSharedStarveExclusive
|
|||
|
|
27 MmMapLockedPages
|
|||
|
|
27 ObpAllocateObjectNameBuffer
|
|||
|
|
27 ObpCreateHandle
|
|||
|
|
27 RtlUpcaseUnicodeChar
|
|||
|
|
26 ExAcquireHandleTableShared
|
|||
|
|
26 MiDecrementReferenceCount
|
|||
|
|
26 MmIsAddressValid
|
|||
|
|
25 MmFlushSection
|
|||
|
|
24 CcPinMappedData
|
|||
|
|
24 FsRtlRequestExclusiveOplock
|
|||
|
|
24 ObCreateObject
|
|||
|
|
24 RtlUnicodeToOemN
|
|||
|
|
23 CcMdlWriteComplete2
|
|||
|
|
23 ElapsedDaysToYears
|
|||
|
|
23 ExTryToAcquireFastMutex
|
|||
|
|
23 IopCheckDeviceAndDriver
|
|||
|
|
23 KeWaitForSingleObject
|
|||
|
|
23 MiReserveSystemPtes
|
|||
|
|
23 RtlUpcaseUnicodeStringToOemString
|
|||
|
|
22 KeEnterCriticalRegion
|
|||
|
|
22 PsAssignImpersonationToken
|
|||
|
|
22 SeReleaseSubjectContext
|
|||
|
|
21 CcLazyWriteScan
|
|||
|
|
21 ExFreePool
|
|||
|
|
21 FsRtlDoesNameContainWildCards
|
|||
|
|
21 IoCheckFunctionAccess
|
|||
|
|
21 IoIsOperationSynchronous
|
|||
|
|
21 KiMb
|
|||
|
|
21 NtClose
|
|||
|
|
21 PsChargeSharedPoolQuota
|
|||
|
|
21 SeAuditingFileEvents
|
|||
|
|
20 KiDeliverApc
|
|||
|
|
20 MiLocateAndReserveWsle
|
|||
|
|
20 SeAssignSecurity
|
|||
|
|
20 SeCaptureSubjectContext
|
|||
|
|
20 SeDeleteAccessState
|
|||
|
|
19 CcMdlRead
|
|||
|
|
19 ExCreateHandle
|
|||
|
|
19 ExDestroyHandle
|
|||
|
|
19 IoFastQueryNetworkAttributes
|
|||
|
|
19 MiDecrementShareCount2
|
|||
|
|
19 MmSetAddressRangeModified
|
|||
|
|
19 ObpDecrementHandleCount
|
|||
|
|
19 RtlOemToUnicodeN
|
|||
|
|
17 ExReleaseHandleTableShared
|
|||
|
|
17 FsRtlAddToTunnelCache
|
|||
|
|
17 KiInterruptDistribution
|
|||
|
|
16 CcSetFileSizes
|
|||
|
|
16 FsRtlGetNextLargeMcbEntry
|
|||
|
|
16 KeSetEvent
|
|||
|
|
16 MiInsertPageInList
|
|||
|
|
16 MiRestoreTransitionPte
|
|||
|
|
16 SeSetAccessStateGenericMapping
|
|||
|
|
15 CcGetVacbMiss
|
|||
|
|
15 ExAcquireHandleTableExclusive
|
|||
|
|
15 FsRtlFastCheckLockForRead
|
|||
|
|
15 FsRtlFindInTunnelCache
|
|||
|
|
15 IoRemoveShareAccess
|
|||
|
|
15 MiCheckControlArea
|
|||
|
|
15 RtlUpcaseUnicodeString
|
|||
|
|
14 IoSetShareAccess
|
|||
|
|
14 MiUpdateWsle
|
|||
|
|
14 NtSetInformationFile
|
|||
|
|
14 ObpChargeQuotaForObject
|
|||
|
|
14 OtsStringCompareEqlSameLen
|
|||
|
|
13 CcPinRead
|
|||
|
|
13 CcWorkerThread
|
|||
|
|
13 ExpAcquireSharedStarveExclusive
|
|||
|
|
13 ExReleaseHandleTableExclusive
|
|||
|
|
13 FsRtlOplockCleanup
|
|||
|
|
13 FsRtlOplockIsFastIoPossible
|
|||
|
|
13 MmAccessFault
|
|||
|
|
13 ObpIncrementHandleDataBase
|
|||
|
|
13 OtsFill
|
|||
|
|
13 RtlOemStringToUnicodeString
|
|||
|
|
12 FsRtlAddLargeMcbEntry
|
|||
|
|
12 FsRtlCurrentBatchOplock
|
|||
|
|
12 MiCreateDataFileMap
|
|||
|
|
12 ObpFreeObject
|
|||
|
|
12 ObpRemoveObjectRoutine
|
|||
|
|
12 ObpValidateAccessMask
|
|||
|
|
12 RtlSetBits
|
|||
|
|
12 RtlUpcaseUnicodeStringToCountedOemString
|
|||
|
|
12 SeTokenImpersonationLevel
|
|||
|
|
11 ExpWorkerThread
|
|||
|
|
11 MiLocateWsle
|
|||
|
|
11 MiRemoveZeroPage
|
|||
|
|
11 MmCopyToCachedPage
|
|||
|
|
11 RtlUnicodeStringToOemString
|
|||
|
|
10 CcAllocateInitializeBcb
|
|||
|
|
10 ExInitializeResourceLite
|
|||
|
|
10 ExInterlockedAddLargeStatistic
|
|||
|
|
10 ExpInterlockedExchangeAddLargeInteger
|
|||
|
|
10 FsRtlIsNameInExpression
|
|||
|
|
10 FsRtlPruneTunnelCache
|
|||
|
|
10 IoAcquireCancelSpinLock
|
|||
|
|
10 MmMapViewInSystemCache
|
|||
|
|
10 RtlpDidUnicodeToOemWork
|
|||
|
|
9 CcDeleteSharedCacheMap
|
|||
|
|
9 ExMapHandleToPointer
|
|||
|
|
9 FsRtlPrivateFastUnlockAll
|
|||
|
|
9 IoCheckDesiredAccess
|
|||
|
|
9 IoSynchronousPageWrite
|
|||
|
|
9 KeInsertByKeyDeviceQueue
|
|||
|
|
9 KiSaveVolatileIntegerState
|
|||
|
|
9 MmUnmapLockedPages
|
|||
|
|
9 ObpDeleteNameCheck
|
|||
|
|
9 RtlpGenerateInheritedAce
|
|||
|
|
9 SepInheritAcl
|
|||
|
|
8 ExSystemTimeToLocalTime
|
|||
|
|
8 FsRtlMdlWriteCompleteDev
|
|||
|
|
8 IoCheckShareAccess
|
|||
|
|
8 KeInsertDeviceQueue
|
|||
|
|
8 MiDispatchFault
|
|||
|
|
8 MiReleaseSystemPtes
|
|||
|
|
8 MiRemovePageFromList
|
|||
|
|
8 MmPurgeSection
|
|||
|
|
8 RtlClearBits
|
|||
|
|
7 CcUnmapVacbArray
|
|||
|
|
7 ExDeleteResourceLite
|
|||
|
|
7 FsRtlFastCheckLockForWrite
|
|||
|
|
7 IoAllocateAdapterChannel
|
|||
|
|
7 IoStartPacket
|
|||
|
|
7 KiMemoryManagementDispatch
|
|||
|
|
7 MiCheckProtoPtePageState
|
|||
|
|
7 MiMakeSystemAddressValidPfn
|
|||
|
|
7 ObpIncrementUnnamedHandleCount
|
|||
|
|
7 RtlVirtualUnwind
|
|||
|
|
6 CcCopyWrite
|
|||
|
|
6 CcDeallocateBcb
|
|||
|
|
6 CcFreeActiveVacb
|
|||
|
|
6 ExAcquireSharedWaitForExclusive
|
|||
|
|
6 ExpWaitForResource
|
|||
|
|
6 FsRtlAreNamesEqual
|
|||
|
|
6 FsRtlFastUnlockSingleExclusive
|
|||
|
|
6 FsRtlOplockBreakToII
|
|||
|
|
6 FsRtlPrivateLock
|
|||
|
|
6 FsRtlRemoveAndCompleteWaitIrp
|
|||
|
|
6 FsRtlRemoveMcbEntryPrivate
|
|||
|
|
6 FsRtlWaitOnIrp
|
|||
|
|
6 KeRemoveByKeyDeviceQueue
|
|||
|
|
6 KiMemoryManagementException
|
|||
|
|
6 MiFreePoolPages
|
|||
|
|
6 MiInitializePfn
|
|||
|
|
6 MiRemoveWsle
|
|||
|
|
6 ObpCreateUnnamedHandle
|
|||
|
|
6 RtlDelete
|
|||
|
|
6 RtlExtendedMagicDivide
|
|||
|
|
6 RtlFillMemoryUlong
|
|||
|
|
6 RtlpLengthInheritedAce
|
|||
|
|
6 RtlSecondsSince1980ToTime
|
|||
|
|
5 CcMdlReadComplete2
|
|||
|
|
5 ExAllocatePoolWithQuotaTag
|
|||
|
|
5 ExInterlockedInsertTailList
|
|||
|
|
5 ExReinitializeResourceLite
|
|||
|
|
5 FsRtlAllocateOplock
|
|||
|
|
5 IoCreateStreamFileObject
|
|||
|
|
5 IoGetCurrentProcess
|
|||
|
|
5 IoStartNextPacket
|
|||
|
|
5 KeInitializeApc
|
|||
|
|
5 KeInsertHeadQueue
|
|||
|
|
5 MiAllocatePoolPages
|
|||
|
|
5 MiCheckForControlAreaDeletion
|
|||
|
|
5 MiGetInPageSupportBlock
|
|||
|
|
5 MiRemovePageByColor
|
|||
|
|
5 MiResolveProtoPteFault
|
|||
|
|
5 MiUnlinkPageFromList
|
|||
|
|
5 MmCanFileBeTruncatedInternal
|
|||
|
|
5 RtlLengthSecurityDescriptor
|
|||
|
|
5 RtlNumberGenericTableElements
|
|||
|
|
5 RtlpGenerateInheritAcl
|
|||
|
|
5 SepCheckAcl
|
|||
|
|
4 CcCreateVacbArray
|
|||
|
|
4 CcGetDirtyPages
|
|||
|
|
4 CcGetVirtualAddressIfMapped
|
|||
|
|
4 CcPerformReadAhead
|
|||
|
|
4 CcReleaseByteRangeFromWrite
|
|||
|
|
4 CcUnmapAndPurge
|
|||
|
|
4 FsRtlCheckLockForReadAccess
|
|||
|
|
4 FsRtlFastUnlockSingle
|
|||
|
|
4 FsRtlInitializeLargeMcb
|
|||
|
|
4 FsRtlLookupLastLargeMcbEntry
|
|||
|
|
4 IopDereferenceVpbAndFree
|
|||
|
|
4 KeInitializeSpinLock
|
|||
|
|
4 KeInsertQueueApc
|
|||
|
|
4 KiActivateWaiterQueue
|
|||
|
|
4 KiApcInterrupt
|
|||
|
|
4 MiGetEventCounter
|
|||
|
|
4 MiRemoveAnyPage
|
|||
|
|
4 MiResolveMappedFileFault
|
|||
|
|
4 OtsDivide
|
|||
|
|
4 PsReturnSharedPoolQuota
|
|||
|
|
4 RtlAreBitsClear
|
|||
|
|
4 RtlFillBytes
|
|||
|
|
4 RtlInsertElementGenericTable
|
|||
|
|
4 RtlLookupFunctionEntry
|
|||
|
|
3 CcCopyRead
|
|||
|
|
3 CcIsThereDirtyData
|
|||
|
|
3 CcPreparePinWrite
|
|||
|
|
3 CcSetReadAheadGranularity
|
|||
|
|
3 CcSetValidData
|
|||
|
|
3 ExIsResourceAcquiredSharedLite
|
|||
|
|
3 ExpAcquireResourceExclusiveLite
|
|||
|
|
3 ExReleaseResourceForThreadLite
|
|||
|
|
3 FsRtlFindFirstOverlappingExclusiveNode
|
|||
|
|
3 FsRtlTruncateLargeMcb
|
|||
|
|
3 FsRtlUninitializeOplock
|
|||
|
|
3 KeInitializeEvent
|
|||
|
|
3 KeRemoveDeviceQueue
|
|||
|
|
3 KeSetEventBoostPriority
|
|||
|
|
3 KiAlternateExit
|
|||
|
|
3 KiGenerateTrapFrame
|
|||
|
|
3 KiSaveVolatileFloatState
|
|||
|
|
3 MiFindActualFaultingPte
|
|||
|
|
3 MiFreeInPageSupportBlock
|
|||
|
|
3 MiModifiedPageWriterWorker
|
|||
|
|
3 MiResolveTransitionFault
|
|||
|
|
3 MiSectionDelete
|
|||
|
|
3 MiSetDirtyBit
|
|||
|
|
3 MmDeterminePoolType
|
|||
|
|
3 ObDeleteCapturedInsertInfo
|
|||
|
|
3 RtlAreBitsSet
|
|||
|
|
3 RtlConvertUlongToLargeInteger
|
|||
|
|
3 RtlCreateAcl
|
|||
|
|
3 RtlEqualPrefixSid
|
|||
|
|
3 RtlFindClearBitsAndSet
|
|||
|
|
3 RtlTimeToSecondsSince1970
|
|||
|
|
3 SepGetDefaultsSubjectContext
|
|||
|
|
3 SeUnlockSubjectContext
|
|||
|
|
3 SeValidSecurityDescriptor
|
|||
|
|
2 ExDisableResourceBoostLite
|
|||
|
|
2 FsRtlAcquireFileForCcFlush
|
|||
|
|
2 FsRtlAddLargeEntry
|
|||
|
|
2 FsRtlPrivateCheckForExclusiveLockAccess
|
|||
|
|
2 FsRtlPrivateInitializeFileLock
|
|||
|
|
2 FsRtlPrivateLimitFreeLockList
|
|||
|
|
2 FsRtlPrivateResetLowestLockOffset
|
|||
|
|
2 FsRtlUninitializeLargeMcb
|
|||
|
|
2 IoPageRead
|
|||
|
|
2 IoQueueThreadIrp
|
|||
|
|
2 KiExceptionExit
|
|||
|
|
2 MiCompleteProtoPteFault
|
|||
|
|
2 MmCanFileBeTruncated
|
|||
|
|
2 NtDeleteFile
|
|||
|
|
2 ObInsertObject
|
|||
|
|
2 RtlInitializeBitMap
|
|||
|
|
2 RtlpLengthInheritAcl
|
|||
|
|
2 RtlpRestoreContext
|
|||
|
|
2 RtlSecondsSince1970ToTime
|
|||
|
|
2 RtlUnicodeStringToCountedOemString
|
|||
|
|
2 SepAccessCheck
|
|||
|
|
2 SepSidInToken
|
|||
|
|
1 CcPostWorkQueue
|
|||
|
|
1 CcScheduleReadAhead
|
|||
|
|
1 CcUnpinDataForThread
|
|||
|
|
1 ExQueueWorkItem
|
|||
|
|
1 FsRtlAcknowledgeOplockBreak
|
|||
|
|
1 FsRtlCheckLockForWriteAccess
|
|||
|
|
1 FsRtlInitializeOplock
|
|||
|
|
1 FsRtlMdlReadCompleteDev
|
|||
|
|
1 FsRtlNotifyCompletion
|
|||
|
|
1 FsRtlNumberOfRunsInLargeMcb
|
|||
|
|
1 FsRtlOplockBreakNotify
|
|||
|
|
1 FsRtlPrivateInsertLock
|
|||
|
|
1 FsRtlUninitializeFileLock
|
|||
|
|
1 IoGetFileObjectGenericMapping
|
|||
|
|
1 IoGetInitialStack
|
|||
|
|
1 IoGetRequestorProcess
|
|||
|
|
1 IopErrorLogRequeueEntry
|
|||
|
|
1 IopSynchronousServiceTail
|
|||
|
|
1 IopTimerDispatch
|
|||
|
|
1 IoUpdateShareAccess
|
|||
|
|
1 KeClearEvent
|
|||
|
|
1 KeGetCurrentIrql
|
|||
|
|
1 KiFlushMultipleTb
|
|||
|
|
1 KiRestoreVolatileFloatState
|
|||
|
|
1 KiSystemServiceExit
|
|||
|
|
1 KiTimerExpiration
|
|||
|
|
1 MiAccessCheck
|
|||
|
|
1 MiAddValidPageToWorkingSet
|
|||
|
|
1 MiCheckControlAreaStatus
|
|||
|
|
1 MiDeleteSystemPagableVm
|
|||
|
|
1 MiFlushInPageSupportBlock
|
|||
|
|
1 MiFreeEventCounter
|
|||
|
|
1 MiInitializeReadInProgressPfn
|
|||
|
|
1 MiMakeProtectionMask
|
|||
|
|
1 MiMapPageInHyperSpace
|
|||
|
|
1 MiReleasePageFileSpace
|
|||
|
|
1 MiReleaseWsle
|
|||
|
|
1 MiWaitForInPageComplete
|
|||
|
|
1 MmBuildMdlForNonPagedPool
|
|||
|
|
1 MmFlushImageSection
|
|||
|
|
1 NtQueryVolumeInformationFile
|
|||
|
|
1 OtsDivide32Unsigned
|
|||
|
|
1 RtlCreateSecurityDescriptor
|
|||
|
|
1 RtlFirstFreeAce
|
|||
|
|
1 RtlImageDirectoryEntryToData
|
|||
|
|
1 RtlInitializeSid
|
|||
|
|
1 RtlLookupElementGenericTable
|
|||
|
|
1 RtlNumberOfClearBits
|
|||
|
|
1 RtlPcToFileHeader
|
|||
|
|
1 RtlRealSuccessor
|
|||
|
|
1 RtlSubtreePredecessor
|
|||
|
|
1 SeLockSubjectContext
|
|||
|
|
1 wcsicmp
|
|||
|
|
|