mirror of
https://github.com/Bw3ll/ShellWasp
synced 2026-06-08 10:31:49 +00:00
Bw3ll
1000 lines
46 KiB
Python
1000 lines
46 KiB
Python
win11_21H2="""SYSCALL ADDRESS FUNCTION
|
|
|
|
0x02 00007FFBF39E3F40 NtAcceptConnectPort
|
|
0x00 00007FFBF39E3F00 NtAccessCheck
|
|
0x29 00007FFBF39E4420 NtAccessCheckAndAuditAlarm
|
|
0x63 00007FFBF39E4B50 NtAccessCheckByType
|
|
0x59 00007FFBF39E4A20 NtAccessCheckByTypeAndAuditAlarm
|
|
0x64 00007FFBF39E4B70 NtAccessCheckByTypeResultList
|
|
0x65 00007FFBF39E4B90 NtAccessCheckByTypeResultListAndAuditAlarm
|
|
0x66 00007FFBF39E4BB0 NtAccessCheckByTypeResultListAndAuditAlarmByHandle
|
|
0x67 00007FFBF39E4BD0 NtAcquireCrossVmMutant
|
|
0x68 00007FFBF39E4BF0 NtAcquireProcessActivityReference
|
|
0x47 00007FFBF39E47E0 NtAddAtom
|
|
0x110069 00007FFBF39E4C10 NtAddAtomEx
|
|
0x6A 00007FFBF39E4C30 NtAddBootEntry
|
|
0x6B 00007FFBF39E4C50 NtAddDriverEntry
|
|
|
|
|
|
|
|
0x6C 00007FFBF39E4C70 NtAdjustGroupsToken
|
|
0x41 00007FFBF39E4720 NtAdjustPrivilegesToken
|
|
0x6D 00007FFBF39E4C90 NtAdjustTokenClaimsAndDeviceGroups
|
|
0x7006E 00007FFBF39E4CB0 NtAlertResumeThread
|
|
0x3006F 00007FFBF39E4CD0 NtAlertThread
|
|
0x40070 00007FFBF39E4CF0 NtAlertThreadByThreadId
|
|
0x40071 00007FFBF39E4D10 NtAllocateLocallyUniqueId
|
|
0x72 00007FFBF39E4D30 NtAllocateReserveObject
|
|
0x73 00007FFBF39E4D50 NtAllocateUserPhysicalPages
|
|
0x74 00007FFBF39E4D70 NtAllocateUserPhysicalPagesEx
|
|
0x110075 00007FFBF39E4D90 NtAllocateUuids
|
|
0x18 00007FFBF39E4200 NtAllocateVirtualMemory
|
|
0x76 00007FFBF39E4DB0 NtAllocateVirtualMemoryEx
|
|
0x77 00007FFBF39E4DD0 NtAlpcAcceptConnectPort
|
|
0x78 00007FFBF39E4DF0 NtAlpcCancelMessage
|
|
0x79 00007FFBF39E4E10 NtAlpcConnectPort
|
|
0x7A 00007FFBF39E4E30 NtAlpcConnectPortEx
|
|
0x7B 00007FFBF39E4E50 NtAlpcCreatePort
|
|
0x7C 00007FFBF39E4E70 NtAlpcCreatePortSection
|
|
0x7D 00007FFBF39E4E90 NtAlpcCreateResourceReserve
|
|
0x7E 00007FFBF39E4EB0 NtAlpcCreateSectionView
|
|
0x7F 00007FFBF39E4ED0 NtAlpcCreateSecurityContext
|
|
0x80 00007FFBF39E4EF0 NtAlpcDeletePortSection
|
|
0x81 00007FFBF39E4F10 NtAlpcDeleteResourceReserve
|
|
0x82 00007FFBF39E4F30 NtAlpcDeleteSectionView
|
|
0x83 00007FFBF39E4F50 NtAlpcDeleteSecurityContext
|
|
0x84 00007FFBF39E4F70 NtAlpcDisconnectPort
|
|
0x85 00007FFBF39E4F90 NtAlpcImpersonateClientContainerOfPort
|
|
0x86 00007FFBF39E4FB0 NtAlpcImpersonateClientOfPort
|
|
0x87 00007FFBF39E4FD0 NtAlpcOpenSenderProcess
|
|
0x88 00007FFBF39E4FF0 NtAlpcOpenSenderThread
|
|
0x89 00007FFBF39E5010 NtAlpcQueryInformation
|
|
0x8A 00007FFBF39E5030 NtAlpcQueryInformationMessage
|
|
0x8B 00007FFBF39E5050 NtAlpcRevokeSecurityContext
|
|
0x8C 00007FFBF39E5070 NtAlpcSendWaitReceivePort
|
|
0x8D 00007FFBF39E5090 NtAlpcSetInformation
|
|
0x4C 00007FFBF39E4880 NtApphelpCacheControl
|
|
0x5008E 00007FFBF39E50B0 NtAreMappedFilesTheSame
|
|
0x8008F 00007FFBF39E50D0 NtAssignProcessToJobObject
|
|
0x90 00007FFBF39E50F0 NtAssociateWaitCompletionPacket
|
|
0x91 00007FFBF39E5110 NtCallEnclave
|
|
0x05 00007FFBF39E3FA0 NtCallbackReturn
|
|
0x5D 00007FFBF39E4A90 NtCancelIoFile
|
|
0x92 00007FFBF39E5130 NtCancelIoFileEx
|
|
0x93 00007FFBF39E5150 NtCancelSynchronousIoFile
|
|
0x70061 00007FFBF39E4B10 NtCancelTimer
|
|
0x94 00007FFBF39E5170 NtCancelTimer2
|
|
0x95 00007FFBF39E5190 NtCancelWaitCompletionPacket
|
|
0x96 00007FFBF39E51B0 NtChangeProcessState
|
|
0x97 00007FFBF39E51D0 NtChangeThreadState
|
|
0x3003E 00007FFBF39E46C0 NtClearEvent
|
|
0x3003f 00007FFBF39E40E0 NtClose
|
|
0x3B 00007FFBF39E4660 NtCloseObjectAuditAlarm
|
|
0x98 00007FFBF39E51F0 NtCommitComplete
|
|
0x99 00007FFBF39E5210 NtCommitEnlistment
|
|
0x9A 00007FFBF39E5230 NtCommitRegistryTransaction
|
|
0x9B 00007FFBF39E5250 NtCommitTransaction
|
|
0x9C 00007FFBF39E5270 NtCompactKeys
|
|
0x9D 00007FFBF39E5290 NtCompareObjects
|
|
0x9E 00007FFBF39E52B0 NtCompareSigningLevels
|
|
0x9F 00007FFBF39E52D0 NtCompareTokens
|
|
0xA0 00007FFBF39E52F0 NtCompleteConnectPort
|
|
0x300A1 00007FFBF39E5310 NtCompressKey
|
|
0xA2 00007FFBF39E5330 NtConnectPort
|
|
0x43 00007FFBF39E4760 NtContinue
|
|
0xA3 00007FFBF39E5350 NtContinueEx
|
|
0xA4 00007FFBF39E5370 NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
|
|
0xA5 00007FFBF39E5390 NtCreateCrossVmEvent
|
|
0xA6 00007FFBF39E53B0 NtCreateCrossVmMutant
|
|
0xA7 00007FFBF39E53D0 NtCreateDebugObject
|
|
0xA8 00007FFBF39E53F0 NtCreateDirectoryObject
|
|
0xA9 00007FFBF39E5410 NtCreateDirectoryObjectEx
|
|
0xAA 00007FFBF39E5430 NtCreateEnclave
|
|
0xAB 00007FFBF39E5450 NtCreateEnlistment
|
|
0x48 00007FFBF39E4800 NtCreateEvent
|
|
0xAC 00007FFBF39E5470 NtCreateEventPair
|
|
0x55 00007FFBF39E49A0 NtCreateFile
|
|
0xAD 00007FFBF39E5490 NtCreateIRTimer
|
|
0xAE 00007FFBF39E54B0 NtCreateIoCompletion
|
|
0xAF 00007FFBF39E54D0 NtCreateIoRing
|
|
0xB0 00007FFBF39E54F0 NtCreateJobObject
|
|
0xB1 00007FFBF39E5510 NtCreateJobSet
|
|
0x1D 00007FFBF39E42A0 NtCreateKey
|
|
0xB2 00007FFBF39E5530 NtCreateKeyTransacted
|
|
0xB3 00007FFBF39E5550 NtCreateKeyedEvent
|
|
0xB4 00007FFBF39E5570 NtCreateLowBoxToken
|
|
0xB5 00007FFBF39E5590 NtCreateMailslotFile
|
|
0xB6 00007FFBF39E55B0 NtCreateMutant
|
|
0xB7 00007FFBF39E55D0 NtCreateNamedPipeFile
|
|
0xB8 00007FFBF39E55F0 NtCreatePagingFile
|
|
0xB9 00007FFBF39E5610 NtCreatePartition
|
|
0xBA 00007FFBF39E5630 NtCreatePort
|
|
0xBB 00007FFBF39E5650 NtCreatePrivateNamespace
|
|
0xBC 00007FFBF39E5670 NtCreateProcess
|
|
0x4D 00007FFBF39E48A0 NtCreateProcessEx
|
|
0xBD 00007FFBF39E5690 NtCreateProcessStateChange
|
|
0xBE 00007FFBF39E56B0 NtCreateProfile
|
|
0xBF 00007FFBF39E56D0 NtCreateProfileEx
|
|
0xC0 00007FFBF39E56F0 NtCreateRegistryTransaction
|
|
0xC1 00007FFBF39E5710 NtCreateResourceManager
|
|
0x4A 00007FFBF39E4840 NtCreateSection
|
|
0xC2 00007FFBF39E5730 NtCreateSectionEx
|
|
0xC3 00007FFBF39E5750 NtCreateSemaphore
|
|
0xC4 00007FFBF39E5770 NtCreateSymbolicLinkObject
|
|
0x4E 00007FFBF39E48C0 NtCreateThread
|
|
0xC5 00007FFBF39E5790 NtCreateThreadEx
|
|
0xC6 00007FFBF39E57B0 NtCreateThreadStateChange
|
|
0xC7 00007FFBF39E57D0 NtCreateTimer
|
|
0xC8 00007FFBF39E57F0 NtCreateTimer2
|
|
0xC9 00007FFBF39E5810 NtCreateToken
|
|
0xCA 00007FFBF39E5830 NtCreateTokenEx
|
|
0xCB 00007FFBF39E5850 NtCreateTransaction
|
|
0xCC 00007FFBF39E5870 NtCreateTransactionManager
|
|
0xCD 00007FFBF39E5890 NtCreateUserProcess
|
|
0xCE 00007FFBF39E58B0 NtCreateWaitCompletionPacket
|
|
0xCF 00007FFBF39E58D0 NtCreateWaitablePort
|
|
0xD0 00007FFBF39E58F0 NtCreateWnfStateName
|
|
0xD1 00007FFBF39E5910 NtCreateWorkerFactory
|
|
0x800D2 00007FFBF39E5930 NtDebugActiveProcess
|
|
0xD3 00007FFBF39E5950 NtDebugContinue
|
|
0x60034 00007FFBF39E4580 NtDelayExecution
|
|
0x400D4 00007FFBF39E5970 NtDeleteAtom
|
|
0xD5 00007FFBF39E5990 NtDeleteBootEntry
|
|
0xD6 00007FFBF39E59B0 NtDeleteDriverEntry
|
|
0xD7 00007FFBF39E59D0 NtDeleteFile
|
|
0xD8 00007FFBF39E59F0 NtDeleteKey
|
|
0xD9 00007FFBF39E5A10 NtDeleteObjectAuditAlarm
|
|
0xDA 00007FFBF39E5A30 NtDeletePrivateNamespace
|
|
0xDB 00007FFBF39E5A50 NtDeleteValueKey
|
|
0xDC 00007FFBF39E5A70 NtDeleteWnfStateData
|
|
0xDD 00007FFBF39E5A90 NtDeleteWnfStateName
|
|
0x1B0007 00007FFBF39E3FE0 NtDeviceIoControlFile
|
|
0xDE 00007FFBF39E5AB0 NtDirectGraphicsCall
|
|
0xDF 00007FFBF39E5AD0 NtDisableLastKnownGood
|
|
0xE0 00007FFBF39E5AF0 NtDisplayString
|
|
0xE1 00007FFBF39E5B10 NtDrawText
|
|
0x3C 00007FFBF39E4680 NtDuplicateObject
|
|
0x42 00007FFBF39E4740 NtDuplicateToken
|
|
0xE2 00007FFBF39E5B30 NtEnableLastKnownGood
|
|
0xE3 00007FFBF39E5B50 NtEnumerateBootEntries
|
|
0xE4 00007FFBF39E5B70 NtEnumerateDriverEntries
|
|
0x32 00007FFBF39E4540 NtEnumerateKey
|
|
0xE5 00007FFBF39E5B90 NtEnumerateSystemEnvironmentValuesEx
|
|
0xE6 00007FFBF39E5BB0 NtEnumerateTransactionObject
|
|
0x13 00007FFBF39E4160 NtEnumerateValueKey
|
|
0xE7 00007FFBF39E5BD0 NtExtendSection
|
|
0xE8 00007FFBF39E5BF0 NtFilterBootOption
|
|
0xE9 00007FFBF39E5C10 NtFilterToken
|
|
0xEA 00007FFBF39E5C30 NtFilterTokenEx
|
|
0x0A0014 00007FFBF39E4180 NtFindAtom
|
|
0x4B 00007FFBF39E4860 NtFlushBuffersFile
|
|
0xEB 00007FFBF39E5C50 NtFlushBuffersFileEx
|
|
0xEC 00007FFBF39E5C70 NtFlushInstallUILanguage
|
|
0x0C00ED 00007FFBF39E5C90 NtFlushInstructionCache
|
|
0x300EE 00007FFBF39E5CB0 NtFlushKey
|
|
0xEF 00007FFBF39E5CD0 NtFlushProcessWriteBuffers
|
|
0xF0 00007FFBF39E5CF0 NtFlushVirtualMemory
|
|
0x100F1 00007FFBF39E5D10 NtFlushWriteBuffer
|
|
0xF2 00007FFBF39E5D30 NtFreeUserPhysicalPages
|
|
0x1E 00007FFBF39E42C0 NtFreeVirtualMemory
|
|
0xF3 00007FFBF39E5D50 NtFreezeRegistry
|
|
0xF4 00007FFBF39E5D70 NtFreezeTransactions
|
|
0x1B0039 00007FFBF39E4620 NtFsControlFile
|
|
0xF5 00007FFBF39E5D90 NtGetCachedSigningLevel
|
|
0xF6 00007FFBF39E5DB0 NtGetCompleteWnfStateSubscription
|
|
0xF7 00007FFBF39E5DD0 NtGetContextThread
|
|
0x1900F8 00007FFBF39E5DF0 NtGetCurrentProcessorNumber
|
|
0xF9 00007FFBF39E5E10 NtGetCurrentProcessorNumberEx
|
|
0x700FA 00007FFBF39E5E30 NtGetDevicePowerState
|
|
0xFB 00007FFBF39E5E50 NtGetMUIRegistryInfo
|
|
0xFC 00007FFBF39E5E70 NtGetNextProcess
|
|
0xFD 00007FFBF39E5E90 NtGetNextThread
|
|
0xFE 00007FFBF39E5EB0 NtGetNlsSectionPtr
|
|
0xFF 00007FFBF39E5ED0 NtGetNotificationResourceManager
|
|
0x100 00007FFBF39E5EF0 NtGetWriteWatch
|
|
0x30101 00007FFBF39E5F10 NtImpersonateAnonymousToken
|
|
0x7001F 00007FFBF39E42E0 NtImpersonateClientOfPort
|
|
0x102 00007FFBF39E5F30 NtImpersonateThread
|
|
0x103 00007FFBF39E5F50 NtInitializeEnclave
|
|
0x104 00007FFBF39E5F70 NtInitializeNlsFiles
|
|
0x105 00007FFBF39E5F90 NtInitializeRegistry
|
|
0x110106 00007FFBF39E5FB0 NtInitiatePowerAction
|
|
0x8004F 00007FFBF39E48E0 NtIsProcessInJob
|
|
0x10107 00007FFBF39E5FD0 NtIsSystemResumeAutomatic
|
|
0x108 00007FFBF39E5FF0 NtIsUILanguageComitted
|
|
0x109 00007FFBF39E6010 NtListenPort
|
|
0x10A 00007FFBF39E6030 NtLoadDriver
|
|
0x10B 00007FFBF39E6050 NtLoadEnclaveData
|
|
0x10C 00007FFBF39E6070 NtLoadKey
|
|
0x10D 00007FFBF39E6090 NtLoadKey2
|
|
0x10E 00007FFBF39E60B0 NtLoadKey3
|
|
0x10F 00007FFBF39E60D0 NtLoadKeyEx
|
|
0x110 00007FFBF39E60F0 NtLockFile
|
|
0x50111 00007FFBF39E6110 NtLockProductActivationKeys
|
|
0x30112 00007FFBF39E6130 NtLockRegistryKey
|
|
0x113 00007FFBF39E6150 NtLockVirtualMemory
|
|
0x30114 00007FFBF39E6170 NtMakePermanentObject
|
|
0x30115 00007FFBF39E6190 NtMakeTemporaryObject
|
|
0x116 00007FFBF39E61B0 NtManageHotPatch
|
|
0x117 00007FFBF39E61D0 NtManagePartition
|
|
0x118 00007FFBF39E61F0 NtMapCMFModule
|
|
0x0A0119 00007FFBF39E6210 NtMapUserPhysicalPages
|
|
0x0A0003 00007FFBF39E3F60 NtMapUserPhysicalPagesScatter
|
|
0x28 00007FFBF39E4400 NtMapViewOfSection
|
|
0x11A 00007FFBF39E6230 NtMapViewOfSectionEx
|
|
0x11B 00007FFBF39E6250 NtModifyBootEntry
|
|
0x11C 00007FFBF39E6270 NtModifyDriverEntry
|
|
0x11D 00007FFBF39E6290 NtNotifyChangeDirectoryFile
|
|
0x11E 00007FFBF39E62B0 NtNotifyChangeDirectoryFileEx
|
|
0x11F 00007FFBF39E62D0 NtNotifyChangeKey
|
|
0x120 00007FFBF39E62F0 NtNotifyChangeMultipleKeys
|
|
0x121 00007FFBF39E6310 NtNotifyChangeSession
|
|
0x58 00007FFBF39E4A00 NtOpenDirectoryObject
|
|
0x122 00007FFBF39E6330 NtOpenEnlistment
|
|
0x40 00007FFBF39E4700 NtOpenEvent
|
|
0x123 00007FFBF39E6350 NtOpenEventPair
|
|
0x33 00007FFBF39E4560 NtOpenFile
|
|
0x124 00007FFBF39E6370 NtOpenIoCompletion
|
|
0x125 00007FFBF39E6390 NtOpenJobObject
|
|
0x12 00007FFBF39E4140 NtOpenKey
|
|
0x126 00007FFBF39E63B0 NtOpenKeyEx
|
|
0x127 00007FFBF39E63D0 NtOpenKeyTransacted
|
|
0x128 00007FFBF39E63F0 NtOpenKeyTransactedEx
|
|
0x129 00007FFBF39E6410 NtOpenKeyedEvent
|
|
0x12A 00007FFBF39E6430 NtOpenMutant
|
|
0x12B 00007FFBF39E6450 NtOpenObjectAuditAlarm
|
|
0x12C 00007FFBF39E6470 NtOpenPartition
|
|
0x12D 00007FFBF39E6490 NtOpenPrivateNamespace
|
|
0x26 00007FFBF39E43C0 NtOpenProcess
|
|
0x12E 00007FFBF39E64B0 NtOpenProcessToken
|
|
0x30 00007FFBF39E4500 NtOpenProcessTokenEx
|
|
0x12F 00007FFBF39E64D0 NtOpenRegistryTransaction
|
|
0x130 00007FFBF39E64F0 NtOpenResourceManager
|
|
0x37 00007FFBF39E45E0 NtOpenSection
|
|
0x131 00007FFBF39E6510 NtOpenSemaphore
|
|
0x132 00007FFBF39E6530 NtOpenSession
|
|
0x133 00007FFBF39E6550 NtOpenSymbolicLinkObject
|
|
0x134 00007FFBF39E6570 NtOpenThread
|
|
0x24 00007FFBF39E4380 NtOpenThreadToken
|
|
0x2F 00007FFBF39E44E0 NtOpenThreadTokenEx
|
|
0x135 00007FFBF39E6590 NtOpenTimer
|
|
0x136 00007FFBF39E65B0 NtOpenTransaction
|
|
0x137 00007FFBF39E65D0 NtOpenTransactionManager
|
|
0x138 00007FFBF39E65F0 NtPlugPlayControl
|
|
0x5F 00007FFBF39E4AD0 NtPowerInformation
|
|
0x139 00007FFBF39E6610 NtPrePrepareComplete
|
|
0x13A 00007FFBF39E6630 NtPrePrepareEnlistment
|
|
0x13B 00007FFBF39E6650 NtPrepareComplete
|
|
0x13C 00007FFBF39E6670 NtPrepareEnlistment
|
|
0x0C013D 00007FFBF39E6690 NtPrivilegeCheck
|
|
0x13E 00007FFBF39E66B0 NtPrivilegeObjectAuditAlarm
|
|
0x13F 00007FFBF39E66D0 NtPrivilegedServiceAuditAlarm
|
|
0x140 00007FFBF39E66F0 NtPropagationComplete
|
|
0x141 00007FFBF39E6710 NtPropagationFailed
|
|
0x50 00007FFBF39E4900 NtProtectVirtualMemory
|
|
0x142 00007FFBF39E6730 NtPssCaptureVaSpaceBulk
|
|
0x70143 00007FFBF39E6750 NtPulseEvent
|
|
0x3D 00007FFBF39E46A0 NtQueryAttributesFile
|
|
0x144 00007FFBF39E6770 NtQueryAuxiliaryCounterFrequency
|
|
0x145 00007FFBF39E6790 NtQueryBootEntryOrder
|
|
0x146 00007FFBF39E67B0 NtQueryBootOptions
|
|
0x50147 00007FFBF39E67D0 NtQueryDebugFilterState
|
|
0x50015 00007FFBF39E41A0 NtQueryDefaultLocale
|
|
0x40044 00007FFBF39E4780 NtQueryDefaultUILanguage
|
|
0x35 00007FFBF39E45A0 NtQueryDirectoryFile
|
|
0x148 00007FFBF39E67F0 NtQueryDirectoryFileEx
|
|
0x149 00007FFBF39E6810 NtQueryDirectoryObject
|
|
0x14A 00007FFBF39E6830 NtQueryDriverEntryOrder
|
|
0x14B 00007FFBF39E6850 NtQueryEaFile
|
|
0x56 00007FFBF39E49C0 NtQueryEvent
|
|
0x14C 00007FFBF39E6870 NtQueryFullAttributesFile
|
|
0x14D 00007FFBF39E6890 NtQueryInformationAtom
|
|
0x14E 00007FFBF39E68B0 NtQueryInformationByName
|
|
0x14F 00007FFBF39E68D0 NtQueryInformationEnlistment
|
|
0x11 00007FFBF39E4120 NtQueryInformationFile
|
|
0x150 00007FFBF39E68F0 NtQueryInformationJobObject
|
|
0x151 00007FFBF39E6910 NtQueryInformationPort
|
|
0x19 00007FFBF39E4220 NtQueryInformationProcess
|
|
0x152 00007FFBF39E6930 NtQueryInformationResourceManager
|
|
0x25 00007FFBF39E43A0 NtQueryInformationThread
|
|
0x21 00007FFBF39E4320 NtQueryInformationToken
|
|
0x153 00007FFBF39E6950 NtQueryInformationTransaction
|
|
0x154 00007FFBF39E6970 NtQueryInformationTransactionManager
|
|
0x155 00007FFBF39E6990 NtQueryInformationWorkerFactory
|
|
0x40156 00007FFBF39E69B0 NtQueryInstallUILanguage
|
|
0x50157 00007FFBF39E69D0 NtQueryIntervalProfile
|
|
0x158 00007FFBF39E69F0 NtQueryIoCompletion
|
|
0x159 00007FFBF39E6A10 NtQueryIoRingCapabilities
|
|
0x16 00007FFBF39E41C0 NtQueryKey
|
|
0x15A 00007FFBF39E6A30 NtQueryLicenseValue
|
|
0x15B 00007FFBF39E6A50 NtQueryMultipleValueKey
|
|
0x15C 00007FFBF39E6A70 NtQueryMutant
|
|
0x10 00007FFBF39E4100 NtQueryObject
|
|
0x15D 00007FFBF39E6A90 NtQueryOpenSubKeys
|
|
0x15E 00007FFBF39E6AB0 NtQueryOpenSubKeysEx
|
|
0x50031 00007FFBF39E4520 NtQueryPerformanceCounter
|
|
0x1015F 00007FFBF39E6AD0 NtQueryPortInformationProcess
|
|
0x160 00007FFBF39E6AF0 NtQueryQuotaInformationFile
|
|
0x51 00007FFBF39E4920 NtQuerySection
|
|
0x161 00007FFBF39E6B10 NtQuerySecurityAttributesToken
|
|
0x162 00007FFBF39E6B30 NtQuerySecurityObject
|
|
0x163 00007FFBF39E6B50 NtQuerySecurityPolicy
|
|
0x164 00007FFBF39E6B70 NtQuerySemaphore
|
|
0x165 00007FFBF39E6B90 NtQuerySymbolicLinkObject
|
|
0x166 00007FFBF39E6BB0 NtQuerySystemEnvironmentValue
|
|
0x167 00007FFBF39E6BD0 NtQuerySystemEnvironmentValueEx
|
|
0x36 00007FFBF39E45C0 NtQuerySystemInformation
|
|
0x168 00007FFBF39E6BF0 NtQuerySystemInformationEx
|
|
0x38 00007FFBF39E4600 NtQueryTimer
|
|
0x0A0169 00007FFBF39E6C10 NtQueryTimerResolution
|
|
0x17 00007FFBF39E41E0 NtQueryValueKey
|
|
0x23 00007FFBF39E4360 NtQueryVirtualMemory
|
|
0x49 00007FFBF39E4820 NtQueryVolumeInformationFile
|
|
0x16A 00007FFBF39E6C30 NtQueryWnfStateData
|
|
0x16B 00007FFBF39E6C50 NtQueryWnfStateNameInformation
|
|
0x45 00007FFBF39E47A0 NtQueueApcThread
|
|
0x16C 00007FFBF39E6C70 NtQueueApcThreadEx
|
|
0x16D 00007FFBF39E6C90 NtQueueApcThreadEx2
|
|
0x16E 00007FFBF39E6CB0 NtRaiseException
|
|
0x16F 00007FFBF39E6CD0 NtRaiseHardError
|
|
0x1A0006 00007FFBF39E3FC0 NtReadFile
|
|
0x1A002E 00007FFBF39E44C0 NtReadFileScatter
|
|
0x170 00007FFBF39E6CF0 NtReadOnlyEnlistment
|
|
0x54 00007FFBF39E4980 NtReadRequestData
|
|
0x3F 00007FFBF39E46E0 NtReadVirtualMemory
|
|
0x171 00007FFBF39E6D10 NtReadVirtualMemoryEx
|
|
0x172 00007FFBF39E6D30 NtRecoverEnlistment
|
|
0x173 00007FFBF39E6D50 NtRecoverResourceManager
|
|
0x174 00007FFBF39E6D70 NtRecoverTransactionManager
|
|
0x175 00007FFBF39E6D90 NtRegisterProtocolAddressInformation
|
|
0x30176 00007FFBF39E6DB0 NtRegisterThreadTerminatePort
|
|
0x140177 00007FFBF39E6DD0 NtReleaseKeyedEvent
|
|
0x70020 00007FFBF39E4300 NtReleaseMutant
|
|
0x0C000A 00007FFBF39E4040 NtReleaseSemaphore
|
|
0x30178 00007FFBF39E6DF0 NtReleaseWorkerFactoryWorker
|
|
0x1C0009 00007FFBF39E4020 NtRemoveIoCompletion
|
|
0x179 00007FFBF39E6E10 NtRemoveIoCompletionEx
|
|
0x8017A 00007FFBF39E6E30 NtRemoveProcessDebug
|
|
0x17B 00007FFBF39E6E50 NtRenameKey
|
|
0x17C 00007FFBF39E6E70 NtRenameTransactionManager
|
|
0x17D 00007FFBF39E6E90 NtReplaceKey
|
|
0x17E 00007FFBF39E6EB0 NtReplacePartitionUnit
|
|
0x0C 00007FFBF39E4080 NtReplyPort
|
|
0x0B 00007FFBF39E4060 NtReplyWaitReceivePort
|
|
0x2B 00007FFBF39E4460 NtReplyWaitReceivePortEx
|
|
0x17F 00007FFBF39E6ED0 NtReplyWaitReplyPort
|
|
0x180 00007FFBF39E6EF0 NtRequestPort
|
|
0x22 00007FFBF39E4340 NtRequestWaitReplyPort
|
|
0x70181 00007FFBF39E6F10 NtResetEvent
|
|
0x0C0182 00007FFBF39E6F30 NtResetWriteWatch
|
|
0x183 00007FFBF39E6F50 NtRestoreKey
|
|
0x30184 00007FFBF39E6F70 NtResumeProcess
|
|
0x70052 00007FFBF39E4940 NtResumeThread
|
|
0x185 00007FFBF39E6F90 NtRevertContainerImpersonation
|
|
0x186 00007FFBF39E6FB0 NtRollbackComplete
|
|
0x187 00007FFBF39E6FD0 NtRollbackEnlistment
|
|
0x188 00007FFBF39E6FF0 NtRollbackRegistryTransaction
|
|
0x189 00007FFBF39E7010 NtRollbackTransaction
|
|
0x18A 00007FFBF39E7030 NtRollforwardTransactionManager
|
|
0x8018B 00007FFBF39E7050 NtSaveKey
|
|
0x0E018C 00007FFBF39E7070 NtSaveKeyEx
|
|
0x0B018D 00007FFBF39E7090 NtSaveMergedKeys
|
|
0x18E 00007FFBF39E70B0 NtSecureConnectPort
|
|
0x18F 00007FFBF39E70D0 NtSerializeBoot
|
|
0x190 00007FFBF39E70F0 NtSetBootEntryOrder
|
|
0x191 00007FFBF39E7110 NtSetBootOptions
|
|
0x192 00007FFBF39E7130 NtSetCachedSigningLevel
|
|
0x193 00007FFBF39E7150 NtSetCachedSigningLevel2
|
|
0x194 00007FFBF39E7170 NtSetContextThread
|
|
0x0A0195 00007FFBF39E7190 NtSetDebugFilterState
|
|
0x30196 00007FFBF39E71B0 NtSetDefaultHardErrorPort
|
|
0x50197 00007FFBF39E71D0 NtSetDefaultLocale
|
|
0x40198 00007FFBF39E71F0 NtSetDefaultUILanguage
|
|
0x199 00007FFBF39E7210 NtSetDriverEntryOrder
|
|
0x19A 00007FFBF39E7230 NtSetEaFile
|
|
0x7000E 00007FFBF39E40C0 NtSetEvent
|
|
0x3002D 00007FFBF39E44A0 NtSetEventBoostPriority
|
|
0x3019B 00007FFBF39E7250 NtSetHighEventPair
|
|
0x3019C 00007FFBF39E7270 NtSetHighWaitLowEventPair
|
|
0x7019D 00007FFBF39E7290 NtSetIRTimer
|
|
0x19E 00007FFBF39E72B0 NtSetInformationDebugObject
|
|
0x19F 00007FFBF39E72D0 NtSetInformationEnlistment
|
|
0x27 00007FFBF39E43E0 NtSetInformationFile
|
|
0x1A0 00007FFBF39E72F0 NtSetInformationIoRing
|
|
0x1A1 00007FFBF39E7310 NtSetInformationJobObject
|
|
0x1A2 00007FFBF39E7330 NtSetInformationKey
|
|
0x5C 00007FFBF39E4A70 NtSetInformationObject
|
|
0x1C 00007FFBF39E4280 NtSetInformationProcess
|
|
0x1A3 00007FFBF39E7350 NtSetInformationResourceManager
|
|
0x1A4 00007FFBF39E7370 NtSetInformationSymbolicLink
|
|
0x0D 00007FFBF39E40A0 NtSetInformationThread
|
|
0x1A5 00007FFBF39E7390 NtSetInformationToken
|
|
0x1A6 00007FFBF39E73B0 NtSetInformationTransaction
|
|
0x1A7 00007FFBF39E73D0 NtSetInformationTransactionManager
|
|
0x1A8 00007FFBF39E73F0 NtSetInformationVirtualMemory
|
|
0x1A9 00007FFBF39E7410 NtSetInformationWorkerFactory
|
|
0x501AA 00007FFBF39E7430 NtSetIntervalProfile
|
|
0x1AB 00007FFBF39E7450 NtSetIoCompletion
|
|
0x1AC 00007FFBF39E7470 NtSetIoCompletionEx
|
|
0x1AD 00007FFBF39E7490 NtSetLdtEntries
|
|
0x301AE 00007FFBF39E74B0 NtSetLowEventPair
|
|
0x301AF 00007FFBF39E74D0 NtSetLowWaitHighEventPair
|
|
0x1B0 00007FFBF39E74F0 NtSetQuotaInformationFile
|
|
0x1B1 00007FFBF39E7510 NtSetSecurityObject
|
|
0x1B2 00007FFBF39E7530 NtSetSystemEnvironmentValue
|
|
0x1B3 00007FFBF39E7550 NtSetSystemEnvironmentValueEx
|
|
0x1B4 00007FFBF39E7570 NtSetSystemInformation
|
|
0x1B5 00007FFBF39E7590 NtSetSystemPowerState
|
|
0x501B6 00007FFBF39E75B0 NtSetSystemTime
|
|
0x501B7 00007FFBF39E75D0 NtSetThreadExecutionState
|
|
0x62 00007FFBF39E4B30 NtSetTimer
|
|
0x1B8 00007FFBF39E75F0 NtSetTimer2
|
|
0x1B9 00007FFBF39E7610 NtSetTimerEx
|
|
0x0A01BA 00007FFBF39E7630 NtSetTimerResolution
|
|
0x401BB 00007FFBF39E7650 NtSetUuidSeed
|
|
0x60 00007FFBF39E4AF0 NtSetValueKey
|
|
0x1BC 00007FFBF39E7670 NtSetVolumeInformationFile
|
|
0x1BD 00007FFBF39E7690 NtSetWnfProcessNotificationEvent
|
|
0x401BE 00007FFBF39E76B0 NtShutdownSystem
|
|
0x1BF 00007FFBF39E76D0 NtShutdownWorkerFactory
|
|
0x1301C0 00007FFBF39E76F0 NtSignalAndWaitForSingleObject
|
|
0x1C1 00007FFBF39E7710 NtSinglePhaseReject
|
|
0x301C2 00007FFBF39E7730 NtStartProfile
|
|
0x301C3 00007FFBF39E7750 NtStopProfile
|
|
0x1C4 00007FFBF39E7770 NtSubmitIoRing
|
|
0x1C5 00007FFBF39E7790 NtSubscribeWnfStateChange
|
|
0x301C6 00007FFBF39E77B0 NtSuspendProcess
|
|
0x701C7 00007FFBF39E77D0 NtSuspendThread
|
|
0x1C8 00007FFBF39E77F0 NtSystemDebugControl
|
|
0x1C9 00007FFBF39E7810 NtTerminateEnclave
|
|
0x701CA 00007FFBF39E7830 NtTerminateJobObject
|
|
0x7002C 00007FFBF39E4480 NtTerminateProcess
|
|
0x70053 00007FFBF39E4960 NtTerminateThread
|
|
0x201CB 00007FFBF39E7850 NtTestAlert
|
|
0x1CC 00007FFBF39E7870 NtThawRegistry
|
|
0x1CD 00007FFBF39E7890 NtThawTransactions
|
|
0x1CE 00007FFBF39E78B0 NtTraceControl
|
|
0x5E 00007FFBF39E4AB0 NtTraceEvent
|
|
0x1101CF 00007FFBF39E78D0 NtTranslateFilePath
|
|
0x1D0 00007FFBF39E78F0 NtUmsThreadYield
|
|
0x1D1 00007FFBF39E7910 NtUnloadDriver
|
|
0x1D2 00007FFBF39E7930 NtUnloadKey
|
|
0x1D3 00007FFBF39E7950 NtUnloadKey2
|
|
0x1D4 00007FFBF39E7970 NtUnloadKeyEx
|
|
0x1D5 00007FFBF39E7990 NtUnlockFile
|
|
0x1D6 00007FFBF39E79B0 NtUnlockVirtualMemory
|
|
0x2A 00007FFBF39E4440 NtUnmapViewOfSection
|
|
0x1D7 00007FFBF39E79D0 NtUnmapViewOfSectionEx
|
|
0x1D8 00007FFBF39E79F0 NtUnsubscribeWnfStateChange
|
|
0x1D9 00007FFBF39E7A10 NtUpdateWnfStateData
|
|
0x1DA 00007FFBF39E7A30 NtVdmControl
|
|
0x601DB 00007FFBF39E7A50 NtWaitForAlertByThreadId
|
|
0x1DC 00007FFBF39E7A70 NtWaitForDebugEvent
|
|
0x1501DD 00007FFBF39E7A90 NtWaitForKeyedEvent
|
|
0x1D005B 00007FFBF39E4A50 NtWaitForMultipleObjects
|
|
0x1E001A 00007FFBF39E4240 NtWaitForMultipleObjects32
|
|
0x0D0004 00007FFBF39E3F80 NtWaitForSingleObject
|
|
0x1DE 00007FFBF39E7AB0 NtWaitForWorkViaWorkerFactory
|
|
0x301DF 00007FFBF39E7AD0 NtWaitHighEventPair
|
|
0x301E0 00007FFBF39E7AF0 NtWaitLowEventPair
|
|
0x30001 00007FFBF39E3F20 NtWorkerFactoryWorkerReady
|
|
0x1A0008 00007FFBF39E4000 NtWriteFile
|
|
0x1A001B 00007FFBF39E4260 NtWriteFileGather
|
|
0x57 00007FFBF39E49E0 NtWriteRequestData
|
|
0x3A 00007FFBF39E4640 NtWriteVirtualMemory
|
|
0x10046 00007FFBF39E47C0 NtYieldExecution
|
|
0x1ED 00007FFBF39E45C0 RtlGetNativeSystemInformation
|
|
|
|
"""
|
|
t=0
|
|
|
|
win1021h2="""SYSCALL ADDRESS FUNCTION
|
|
-----------------------------------------
|
|
0x02 00007FFEFDA0CD70 NtAcceptConnectPort
|
|
0x00 00007FFEFDA0CD30 NtAccessCheck
|
|
0x29 00007FFEFDA0D250 NtAccessCheckAndAuditAlarm
|
|
0x63 00007FFEFDA0D980 NtAccessCheckByType
|
|
0x59 00007FFEFDA0D850 NtAccessCheckByTypeAndAuditAlarm
|
|
0x64 00007FFEFDA0D9A0 NtAccessCheckByTypeResultList
|
|
0x65 00007FFEFDA0D9C0 NtAccessCheckByTypeResultListAndAuditAlarm
|
|
0x66 00007FFEFDA0D9E0 NtAccessCheckByTypeResultListAndAuditAlarmByHandle
|
|
0x67 00007FFEFDA0DA00 NtAcquireCrossVmMutant
|
|
0x68 00007FFEFDA0DA20 NtAcquireProcessActivityReference
|
|
0x0A0047 00007FFEFDA0D610 NtAddAtom
|
|
0x110069 00007FFEFDA0DA40 NtAddAtomEx
|
|
0x6A 00007FFEFDA0DA60 NtAddBootEntry
|
|
0x6B 00007FFEFDA0DA80 NtAddDriverEntry
|
|
0x6C 00007FFEFDA0DAA0 NtAdjustGroupsToken
|
|
0x41 00007FFEFDA0D550 NtAdjustPrivilegesToken
|
|
0x6D 00007FFEFDA0DAC0 NtAdjustTokenClaimsAndDeviceGroups
|
|
0x7006E 00007FFEFDA0DAE0 NtAlertResumeThread
|
|
0x3006F 00007FFEFDA0DB00 NtAlertThread
|
|
0x40070 00007FFEFDA0DB20 NtAlertThreadByThreadId
|
|
0x40071 00007FFEFDA0DB40 NtAllocateLocallyUniqueId
|
|
0x72 00007FFEFDA0DB60 NtAllocateReserveObject
|
|
0x73 00007FFEFDA0DB80 NtAllocateUserPhysicalPages
|
|
0x74 00007FFEFDA0DBA0 NtAllocateUserPhysicalPagesEx
|
|
0x110075 00007FFEFDA0DBC0 NtAllocateUuids
|
|
0x18 00007FFEFDA0D030 NtAllocateVirtualMemory
|
|
0x76 00007FFEFDA0DBE0 NtAllocateVirtualMemoryEx
|
|
0x77 00007FFEFDA0DC00 NtAlpcAcceptConnectPort
|
|
0x78 00007FFEFDA0DC20 NtAlpcCancelMessage
|
|
0x79 00007FFEFDA0DC40 NtAlpcConnectPort
|
|
0x7A 00007FFEFDA0DC60 NtAlpcConnectPortEx
|
|
0x7B 00007FFEFDA0DC80 NtAlpcCreatePort
|
|
0x7C 00007FFEFDA0DCA0 NtAlpcCreatePortSection
|
|
0x7D 00007FFEFDA0DCC0 NtAlpcCreateResourceReserve
|
|
0x7E 00007FFEFDA0DCE0 NtAlpcCreateSectionView
|
|
0x7F 00007FFEFDA0DD00 NtAlpcCreateSecurityContext
|
|
0x80 00007FFEFDA0DD20 NtAlpcDeletePortSection
|
|
0x81 00007FFEFDA0DD40 NtAlpcDeleteResourceReserve
|
|
0x82 00007FFEFDA0DD60 NtAlpcDeleteSectionView
|
|
0x83 00007FFEFDA0DD80 NtAlpcDeleteSecurityContext
|
|
0x84 00007FFEFDA0DDA0 NtAlpcDisconnectPort
|
|
0x85 00007FFEFDA0DDC0 NtAlpcImpersonateClientContainerOfPort
|
|
0x86 00007FFEFDA0DDE0 NtAlpcImpersonateClientOfPort
|
|
0x87 00007FFEFDA0DE00 NtAlpcOpenSenderProcess
|
|
0x88 00007FFEFDA0DE20 NtAlpcOpenSenderThread
|
|
0x89 00007FFEFDA0DE40 NtAlpcQueryInformation
|
|
0x8A 00007FFEFDA0DE60 NtAlpcQueryInformationMessage
|
|
0x8B 00007FFEFDA0DE80 NtAlpcRevokeSecurityContext
|
|
0x8C 00007FFEFDA0DEA0 NtAlpcSendWaitReceivePort
|
|
0x8D 00007FFEFDA0DEC0 NtAlpcSetInformation
|
|
0x4C 00007FFEFDA0D6B0 NtApphelpCacheControl
|
|
0x5008E 00007FFEFDA0DEE0 NtAreMappedFilesTheSame
|
|
0x8008F 00007FFEFDA0DF00 NtAssignProcessToJobObject
|
|
0x90 00007FFEFDA0DF20 NtAssociateWaitCompletionPacket
|
|
0x91 00007FFEFDA0DF40 NtCallEnclave
|
|
0x05 00007FFEFDA0CDD0 NtCallbackReturn
|
|
0x5D 00007FFEFDA0D8C0 NtCancelIoFile
|
|
0x92 00007FFEFDA0DF60 NtCancelIoFileEx
|
|
0x93 00007FFEFDA0DF80 NtCancelSynchronousIoFile
|
|
0x61 00007FFEFDA0D940 NtCancelTimer
|
|
0x94 00007FFEFDA0DFA0 NtCancelTimer2
|
|
0x95 00007FFEFDA0DFC0 NtCancelWaitCompletionPacket
|
|
0x3003E 00007FFEFDA0D4F0 NtClearEvent
|
|
0x3000F 00007FFEFDA0CF10 NtClose
|
|
0x3B 00007FFEFDA0D490 NtCloseObjectAuditAlarm
|
|
0x96 00007FFEFDA0DFE0 NtCommitComplete
|
|
0x97 00007FFEFDA0E000 NtCommitEnlistment
|
|
0x98 00007FFEFDA0E020 NtCommitRegistryTransaction
|
|
0x99 00007FFEFDA0E040 NtCommitTransaction
|
|
0x9A 00007FFEFDA0E060 NtCompactKeys
|
|
0x9B 00007FFEFDA0E080 NtCompareObjects
|
|
0x9C 00007FFEFDA0E0A0 NtCompareSigningLevels
|
|
0x9D 00007FFEFDA0E0C0 NtCompareTokens
|
|
0x9E 00007FFEFDA0E0E0 NtCompleteConnectPort
|
|
0x3009F 00007FFEFDA0E100 NtCompressKey
|
|
0xA0 00007FFEFDA0E120 NtConnectPort
|
|
0x43 00007FFEFDA0D590 NtContinue
|
|
0xA1 00007FFEFDA0E140 NtContinueEx
|
|
0xA2 00007FFEFDA0E160 NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
|
|
0xA3 00007FFEFDA0E180 NtCreateCrossVmEvent
|
|
0xA4 00007FFEFDA0E1A0 NtCreateCrossVmMutant
|
|
0xA5 00007FFEFDA0E1C0 NtCreateDebugObject
|
|
0xA6 00007FFEFDA0E1E0 NtCreateDirectoryObject
|
|
0xA7 00007FFEFDA0E200 NtCreateDirectoryObjectEx
|
|
0xA8 00007FFEFDA0E220 NtCreateEnclave
|
|
0xA9 00007FFEFDA0E240 NtCreateEnlistment
|
|
0x48 00007FFEFDA0D630 NtCreateEvent
|
|
0xAA 00007FFEFDA0E260 NtCreateEventPair
|
|
0x55 00007FFEFDA0D7D0 NtCreateFile
|
|
0xAB 00007FFEFDA0E280 NtCreateIRTimer
|
|
0xAC 00007FFEFDA0E2A0 NtCreateIoCompletion
|
|
0xAD 00007FFEFDA0E2C0 NtCreateJobObject
|
|
0xAE 00007FFEFDA0E2E0 NtCreateJobSet
|
|
0x1D 00007FFEFDA0D0D0 NtCreateKey
|
|
0xAF 00007FFEFDA0E300 NtCreateKeyTransacted
|
|
0xB0 00007FFEFDA0E320 NtCreateKeyedEvent
|
|
0xB1 00007FFEFDA0E340 NtCreateLowBoxToken
|
|
0xB2 00007FFEFDA0E360 NtCreateMailslotFile
|
|
0xB3 00007FFEFDA0E380 NtCreateMutant
|
|
0xB4 00007FFEFDA0E3A0 NtCreateNamedPipeFile
|
|
0xB5 00007FFEFDA0E3C0 NtCreatePagingFile
|
|
0xB6 00007FFEFDA0E3E0 NtCreatePartition
|
|
0xB7 00007FFEFDA0E400 NtCreatePort
|
|
0xB8 00007FFEFDA0E420 NtCreatePrivateNamespace
|
|
0xB9 00007FFEFDA0E440 NtCreateProcess
|
|
0x4D 00007FFEFDA0D6D0 NtCreateProcessEx
|
|
0xBA 00007FFEFDA0E460 NtCreateProfile
|
|
0xBB 00007FFEFDA0E480 NtCreateProfileEx
|
|
0xBC 00007FFEFDA0E4A0 NtCreateRegistryTransaction
|
|
0xBD 00007FFEFDA0E4C0 NtCreateResourceManager
|
|
0x4A 00007FFEFDA0D670 NtCreateSection
|
|
0xBE 00007FFEFDA0E4E0 NtCreateSectionEx
|
|
0xBF 00007FFEFDA0E500 NtCreateSemaphore
|
|
0xC0 00007FFEFDA0E520 NtCreateSymbolicLinkObject
|
|
0x4E 00007FFEFDA0D6F0 NtCreateThread
|
|
0xC1 00007FFEFDA0E540 NtCreateThreadEx
|
|
0xC2 00007FFEFDA0E560 NtCreateTimer
|
|
0xC3 00007FFEFDA0E580 NtCreateTimer2
|
|
0xC4 00007FFEFDA0E5A0 NtCreateToken
|
|
0xC5 00007FFEFDA0E5C0 NtCreateTokenEx
|
|
0xC6 00007FFEFDA0E5E0 NtCreateTransaction
|
|
0xC7 00007FFEFDA0E600 NtCreateTransactionManager
|
|
0xC8 00007FFEFDA0E620 NtCreateUserProcess
|
|
0xC9 00007FFEFDA0E640 NtCreateWaitCompletionPacket
|
|
0xCA 00007FFEFDA0E660 NtCreateWaitablePort
|
|
0xCB 00007FFEFDA0E680 NtCreateWnfStateName
|
|
0xCC 00007FFEFDA0E6A0 NtCreateWorkerFactory
|
|
0x800CD 00007FFEFDA0E6C0 NtDebugActiveProcess
|
|
0xCE 00007FFEFDA0E6E0 NtDebugContinue
|
|
0x60034 00007FFEFDA0D3B0 NtDelayExecution
|
|
0x400CF 00007FFEFDA0E700 NtDeleteAtom
|
|
0xD0 00007FFEFDA0E720 NtDeleteBootEntry
|
|
0xD1 00007FFEFDA0E740 NtDeleteDriverEntry
|
|
0xD2 00007FFEFDA0E760 NtDeleteFile
|
|
0xD3 00007FFEFDA0E780 NtDeleteKey
|
|
0xD4 00007FFEFDA0E7A0 NtDeleteObjectAuditAlarm
|
|
0xD5 00007FFEFDA0E7C0 NtDeletePrivateNamespace
|
|
0xD6 00007FFEFDA0E7E0 NtDeleteValueKey
|
|
0xD7 00007FFEFDA0E800 NtDeleteWnfStateData
|
|
0xD8 00007FFEFDA0E820 NtDeleteWnfStateName
|
|
0x1B0007 00007FFEFDA0CE10 NtDeviceIoControlFile
|
|
0xD9 00007FFEFDA0E840 NtDirectGraphicsCall
|
|
0xDA 00007FFEFDA0E860 NtDisableLastKnownGood
|
|
0xDB 00007FFEFDA0E880 NtDisplayString
|
|
0xDC 00007FFEFDA0E8A0 NtDrawText
|
|
0x3C 00007FFEFDA0D4B0 NtDuplicateObject
|
|
0x42 00007FFEFDA0D570 NtDuplicateToken
|
|
0xDD 00007FFEFDA0E8C0 NtEnableLastKnownGood
|
|
0xDE 00007FFEFDA0E8E0 NtEnumerateBootEntries
|
|
0xDF 00007FFEFDA0E900 NtEnumerateDriverEntries
|
|
0x32 00007FFEFDA0D370 NtEnumerateKey
|
|
0xE0 00007FFEFDA0E920 NtEnumerateSystemEnvironmentValuesEx
|
|
0xE1 00007FFEFDA0E940 NtEnumerateTransactionObject
|
|
0x13 00007FFEFDA0CF90 NtEnumerateValueKey
|
|
0xE2 00007FFEFDA0E960 NtExtendSection
|
|
0xE3 00007FFEFDA0E980 NtFilterBootOption
|
|
0xE4 00007FFEFDA0E9A0 NtFilterToken
|
|
0xE5 00007FFEFDA0E9C0 NtFilterTokenEx
|
|
0x0A0014 00007FFEFDA0CFB0 NtFindAtom
|
|
0x4B 00007FFEFDA0D690 NtFlushBuffersFile
|
|
0xE6 00007FFEFDA0E9E0 NtFlushBuffersFileEx
|
|
0xE7 00007FFEFDA0EA00 NtFlushInstallUILanguage
|
|
0x0C00E8 00007FFEFDA0EA20 NtFlushInstructionCache
|
|
0x300E9 00007FFEFDA0EA40 NtFlushKey
|
|
0xEA 00007FFEFDA0EA60 NtFlushProcessWriteBuffers
|
|
0xEB 00007FFEFDA0EA80 NtFlushVirtualMemory
|
|
0x100EC 00007FFEFDA0EAA0 NtFlushWriteBuffer
|
|
0xED 00007FFEFDA0EAC0 NtFreeUserPhysicalPages
|
|
0x1E 00007FFEFDA0D0F0 NtFreeVirtualMemory
|
|
0xEE 00007FFEFDA0EAE0 NtFreezeRegistry
|
|
0xEF 00007FFEFDA0EB00 NtFreezeTransactions
|
|
0x1B0039 00007FFEFDA0D450 NtFsControlFile
|
|
0xF0 00007FFEFDA0EB20 NtGetCachedSigningLevel
|
|
0xF1 00007FFEFDA0EB40 NtGetCompleteWnfStateSubscription
|
|
0xF2 00007FFEFDA0EB60 NtGetContextThread
|
|
0x1900F3 00007FFEFDA0EB80 NtGetCurrentProcessorNumber
|
|
0xF4 00007FFEFDA0EBA0 NtGetCurrentProcessorNumberEx
|
|
0x700F5 00007FFEFDA0EBC0 NtGetDevicePowerState
|
|
0xF6 00007FFEFDA0EBE0 NtGetMUIRegistryInfo
|
|
0xF7 00007FFEFDA0EC00 NtGetNextProcess
|
|
0xF8 00007FFEFDA0EC20 NtGetNextThread
|
|
0xF9 00007FFEFDA0EC40 NtGetNlsSectionPtr
|
|
0xFA 00007FFEFDA0EC60 NtGetNotificationResourceManager
|
|
0xFB 00007FFEFDA0EC80 NtGetWriteWatch
|
|
0x300FC 00007FFEFDA0ECA0 NtImpersonateAnonymousToken
|
|
0x7001F 00007FFEFDA0D110 NtImpersonateClientOfPort
|
|
0xFD 00007FFEFDA0ECC0 NtImpersonateThread
|
|
0xFE 00007FFEFDA0ECE0 NtInitializeEnclave
|
|
0xFF 00007FFEFDA0ED00 NtInitializeNlsFiles
|
|
0x100 00007FFEFDA0ED20 NtInitializeRegistry
|
|
0x110101 00007FFEFDA0ED40 NtInitiatePowerAction
|
|
0x8004F 00007FFEFDA0D710 NtIsProcessInJob
|
|
0x10102 00007FFEFDA0ED60 NtIsSystemResumeAutomatic
|
|
0x103 00007FFEFDA0ED80 NtIsUILanguageComitted
|
|
0x104 00007FFEFDA0EDA0 NtListenPort
|
|
0x105 00007FFEFDA0EDC0 NtLoadDriver
|
|
0x106 00007FFEFDA0EDE0 NtLoadEnclaveData
|
|
0x107 00007FFEFDA0EE00 NtLoadKey
|
|
0x108 00007FFEFDA0EE20 NtLoadKey2
|
|
0x1D6 00007FFEFDA107E0 NtLoadKey3
|
|
0x109 00007FFEFDA0EE40 NtLoadKeyEx
|
|
0x10A 00007FFEFDA0EE60 NtLockFile
|
|
0x5010B 00007FFEFDA0EE80 NtLockProductActivationKeys
|
|
0x3010C 00007FFEFDA0EEA0 NtLockRegistryKey
|
|
0x10D 00007FFEFDA0EEC0 NtLockVirtualMemory
|
|
0x3010E 00007FFEFDA0EEE0 NtMakePermanentObject
|
|
0x3010F 00007FFEFDA0EF00 NtMakeTemporaryObject
|
|
0x110 00007FFEFDA0EF20 NtManageHotPatch
|
|
0x111 00007FFEFDA0EF40 NtManagePartition
|
|
0x112 00007FFEFDA0EF60 NtMapCMFModule
|
|
0x0A0113 00007FFEFDA0EF80 NtMapUserPhysicalPages
|
|
0x0A0003 00007FFEFDA0CD90 NtMapUserPhysicalPagesScatter
|
|
0x28 00007FFEFDA0D230 NtMapViewOfSection
|
|
0x114 00007FFEFDA0EFA0 NtMapViewOfSectionEx
|
|
0x115 00007FFEFDA0EFC0 NtModifyBootEntry
|
|
0x116 00007FFEFDA0EFE0 NtModifyDriverEntry
|
|
0x117 00007FFEFDA0F000 NtNotifyChangeDirectoryFile
|
|
0x118 00007FFEFDA0F020 NtNotifyChangeDirectoryFileEx
|
|
0x119 00007FFEFDA0F040 NtNotifyChangeKey
|
|
0x11A 00007FFEFDA0F060 NtNotifyChangeMultipleKeys
|
|
0x11B 00007FFEFDA0F080 NtNotifyChangeSession
|
|
0x58 00007FFEFDA0D830 NtOpenDirectoryObject
|
|
0x11C 00007FFEFDA0F0A0 NtOpenEnlistment
|
|
0x40 00007FFEFDA0D530 NtOpenEvent
|
|
0x11D 00007FFEFDA0F0C0 NtOpenEventPair
|
|
0x33 00007FFEFDA0D390 NtOpenFile
|
|
0x11E 00007FFEFDA0F0E0 NtOpenIoCompletion
|
|
0x11F 00007FFEFDA0F100 NtOpenJobObject
|
|
0x12 00007FFEFDA0CF70 NtOpenKey
|
|
0x120 00007FFEFDA0F120 NtOpenKeyEx
|
|
0x121 00007FFEFDA0F140 NtOpenKeyTransacted
|
|
0x122 00007FFEFDA0F160 NtOpenKeyTransactedEx
|
|
0x123 00007FFEFDA0F180 NtOpenKeyedEvent
|
|
0x124 00007FFEFDA0F1A0 NtOpenMutant
|
|
0x125 00007FFEFDA0F1C0 NtOpenObjectAuditAlarm
|
|
0x126 00007FFEFDA0F1E0 NtOpenPartition
|
|
0x127 00007FFEFDA0F200 NtOpenPrivateNamespace
|
|
0x26 00007FFEFDA0D1F0 NtOpenProcess
|
|
0x128 00007FFEFDA0F220 NtOpenProcessToken
|
|
0x30 00007FFEFDA0D330 NtOpenProcessTokenEx
|
|
0x129 00007FFEFDA0F240 NtOpenRegistryTransaction
|
|
0x12A 00007FFEFDA0F260 NtOpenResourceManager
|
|
0x37 00007FFEFDA0D410 NtOpenSection
|
|
0x12B 00007FFEFDA0F280 NtOpenSemaphore
|
|
0x12C 00007FFEFDA0F2A0 NtOpenSession
|
|
0x12D 00007FFEFDA0F2C0 NtOpenSymbolicLinkObject
|
|
0x12E 00007FFEFDA0F2E0 NtOpenThread
|
|
0x24 00007FFEFDA0D1B0 NtOpenThreadToken
|
|
0x2F 00007FFEFDA0D310 NtOpenThreadTokenEx
|
|
0x12F 00007FFEFDA0F300 NtOpenTimer
|
|
0x130 00007FFEFDA0F320 NtOpenTransaction
|
|
0x131 00007FFEFDA0F340 NtOpenTransactionManager
|
|
0x132 00007FFEFDA0F360 NtPlugPlayControl
|
|
0x5F 00007FFEFDA0D900 NtPowerInformation
|
|
0x133 00007FFEFDA0F380 NtPrePrepareComplete
|
|
0x134 00007FFEFDA0F3A0 NtPrePrepareEnlistment
|
|
0x135 00007FFEFDA0F3C0 NtPrepareComplete
|
|
0x136 00007FFEFDA0F3E0 NtPrepareEnlistment
|
|
0x0C0137 00007FFEFDA0F400 NtPrivilegeCheck
|
|
0x138 00007FFEFDA0F420 NtPrivilegeObjectAuditAlarm
|
|
0x139 00007FFEFDA0F440 NtPrivilegedServiceAuditAlarm
|
|
0x13A 00007FFEFDA0F460 NtPropagationComplete
|
|
0x13B 00007FFEFDA0F480 NtPropagationFailed
|
|
0x50 00007FFEFDA0D730 NtProtectVirtualMemory
|
|
0x13C 00007FFEFDA0F4A0 NtPssCaptureVaSpaceBulk
|
|
0x7013D 00007FFEFDA0F4C0 NtPulseEvent
|
|
0x3D 00007FFEFDA0D4D0 NtQueryAttributesFile
|
|
0x13E 00007FFEFDA0F4E0 NtQueryAuxiliaryCounterFrequency
|
|
0x13F 00007FFEFDA0F500 NtQueryBootEntryOrder
|
|
0x140 00007FFEFDA0F520 NtQueryBootOptions
|
|
0x50141 00007FFEFDA0F540 NtQueryDebugFilterState
|
|
0x50015 00007FFEFDA0CFD0 NtQueryDefaultLocale
|
|
0x40044 00007FFEFDA0D5B0 NtQueryDefaultUILanguage
|
|
0x35 00007FFEFDA0D3D0 NtQueryDirectoryFile
|
|
0x142 00007FFEFDA0F560 NtQueryDirectoryFileEx
|
|
0x143 00007FFEFDA0F580 NtQueryDirectoryObject
|
|
0x144 00007FFEFDA0F5A0 NtQueryDriverEntryOrder
|
|
0x145 00007FFEFDA0F5C0 NtQueryEaFile
|
|
0x56 00007FFEFDA0D7F0 NtQueryEvent
|
|
0x146 00007FFEFDA0F5E0 NtQueryFullAttributesFile
|
|
0x147 00007FFEFDA0F600 NtQueryInformationAtom
|
|
0x148 00007FFEFDA0F620 NtQueryInformationByName
|
|
0x149 00007FFEFDA0F640 NtQueryInformationEnlistment
|
|
0x11 00007FFEFDA0CF50 NtQueryInformationFile
|
|
0x14A 00007FFEFDA0F660 NtQueryInformationJobObject
|
|
0x14B 00007FFEFDA0F680 NtQueryInformationPort
|
|
0x19 00007FFEFDA0D050 NtQueryInformationProcess
|
|
0x14C 00007FFEFDA0F6A0 NtQueryInformationResourceManager
|
|
0x25 00007FFEFDA0D1D0 NtQueryInformationThread
|
|
0x21 00007FFEFDA0D150 NtQueryInformationToken
|
|
0x14D 00007FFEFDA0F6C0 NtQueryInformationTransaction
|
|
0x14E 00007FFEFDA0F6E0 NtQueryInformationTransactionManager
|
|
0x14F 00007FFEFDA0F700 NtQueryInformationWorkerFactory
|
|
0x40150 00007FFEFDA0F720 NtQueryInstallUILanguage
|
|
0x50151 00007FFEFDA0F740 NtQueryIntervalProfile
|
|
0x152 00007FFEFDA0F760 NtQueryIoCompletion
|
|
0x16 00007FFEFDA0CFF0 NtQueryKey
|
|
0x153 00007FFEFDA0F780 NtQueryLicenseValue
|
|
0x154 00007FFEFDA0F7A0 NtQueryMultipleValueKey
|
|
0x155 00007FFEFDA0F7C0 NtQueryMutant
|
|
0x110 00007FFEFDA0CF30 NtQueryObject
|
|
0x156 00007FFEFDA0F7E0 NtQueryOpenSubKeys
|
|
0x157 00007FFEFDA0F800 NtQueryOpenSubKeysEx
|
|
0x50031 00007FFEFDA0D350 NtQueryPerformanceCounter
|
|
0x10158 00007FFEFDA0F820 NtQueryPortInformationProcess
|
|
0x159 00007FFEFDA0F840 NtQueryQuotaInformationFile
|
|
0x51 00007FFEFDA0D750 NtQuerySection
|
|
0x15A 00007FFEFDA0F860 NtQuerySecurityAttributesToken
|
|
0x15B 00007FFEFDA0F880 NtQuerySecurityObject
|
|
0x15C 00007FFEFDA0F8A0 NtQuerySecurityPolicy
|
|
0x15D 00007FFEFDA0F8C0 NtQuerySemaphore
|
|
0x15E 00007FFEFDA0F8E0 NtQuerySymbolicLinkObject
|
|
0x15F 00007FFEFDA0F900 NtQuerySystemEnvironmentValue
|
|
0x160 00007FFEFDA0F920 NtQuerySystemEnvironmentValueEx
|
|
0x36 00007FFEFDA0D3F0 NtQuerySystemInformation
|
|
0x161 00007FFEFDA0F940 NtQuerySystemInformationEx
|
|
0x38 00007FFEFDA0D430 NtQueryTimer
|
|
0x0A0162 00007FFEFDA0F960 NtQueryTimerResolution
|
|
0x17 00007FFEFDA0D010 NtQueryValueKey
|
|
0x23 00007FFEFDA0D190 NtQueryVirtualMemory
|
|
0x49 00007FFEFDA0D650 NtQueryVolumeInformationFile
|
|
0x163 00007FFEFDA0F980 NtQueryWnfStateData
|
|
0x164 00007FFEFDA0F9A0 NtQueryWnfStateNameInformation
|
|
0x45 00007FFEFDA0D5D0 NtQueueApcThread
|
|
0x165 00007FFEFDA0F9C0 NtQueueApcThreadEx
|
|
0x166 00007FFEFDA0F9E0 NtRaiseException
|
|
0x167 00007FFEFDA0FA00 NtRaiseHardError
|
|
0x1A0006 00007FFEFDA0CDF0 NtReadFile
|
|
0x1A002E 00007FFEFDA0D2F0 NtReadFileScatter
|
|
0x168 00007FFEFDA0FA20 NtReadOnlyEnlistment
|
|
0x54 00007FFEFDA0D7B0 NtReadRequestData
|
|
0x3F 00007FFEFDA0D510 NtReadVirtualMemory
|
|
0x169 00007FFEFDA0FA40 NtRecoverEnlistment
|
|
0x16A 00007FFEFDA0FA60 NtRecoverResourceManager
|
|
0x16B 00007FFEFDA0FA80 NtRecoverTransactionManager
|
|
0x16C 00007FFEFDA0FAA0 NtRegisterProtocolAddressInformation
|
|
0x3016D 00007FFEFDA0FAC0 NtRegisterThreadTerminatePort
|
|
0x14016E 00007FFEFDA0FAE0 NtReleaseKeyedEvent
|
|
0x70020 00007FFEFDA0D130 NtReleaseMutant
|
|
0x0C000A 00007FFEFDA0CE70 NtReleaseSemaphore
|
|
0x3016F 00007FFEFDA0FB00 NtReleaseWorkerFactoryWorker
|
|
0x1C0009 00007FFEFDA0CE50 NtRemoveIoCompletion
|
|
0x170 00007FFEFDA0FB20 NtRemoveIoCompletionEx
|
|
80171h 00007FFEFDA0FB40 NtRemoveProcessDebug
|
|
0x172 00007FFEFDA0FB60 NtRenameKey
|
|
0x173 00007FFEFDA0FB80 NtRenameTransactionManager
|
|
0x174 00007FFEFDA0FBA0 NtReplaceKey
|
|
0x175 00007FFEFDA0FBC0 NtReplacePartitionUnit
|
|
0x0C 00007FFEFDA0CEB0 NtReplyPort
|
|
0x0B 00007FFEFDA0CE90 NtReplyWaitReceivePort
|
|
0x2B 00007FFEFDA0D290 NtReplyWaitReceivePortEx
|
|
0x176 00007FFEFDA0FBE0 NtReplyWaitReplyPort
|
|
0x177 00007FFEFDA0FC00 NtRequestPort
|
|
0x22 00007FFEFDA0D170 NtRequestWaitReplyPort
|
|
0x70178 00007FFEFDA0FC20 NtResetEvent
|
|
0x0C0179 00007FFEFDA0FC40 NtResetWriteWatch
|
|
0x17A 00007FFEFDA0FC60 NtRestoreKey
|
|
0x3017B 00007FFEFDA0FC80 NtResumeProcess
|
|
0x70052 00007FFEFDA0D770 NtResumeThread
|
|
0x17C 00007FFEFDA0FCA0 NtRevertContainerImpersonation
|
|
0x17D 00007FFEFDA0FCC0 NtRollbackComplete
|
|
0x17E 00007FFEFDA0FCE0 NtRollbackEnlistment
|
|
0x17F 00007FFEFDA0FD00 NtRollbackRegistryTransaction
|
|
0x180 00007FFEFDA0FD20 NtRollbackTransaction
|
|
0x181 00007FFEFDA0FD40 NtRollforwardTransactionManager
|
|
0x80182 00007FFEFDA0FD60 NtSaveKey
|
|
0x0E0183 00007FFEFDA0FD80 NtSaveKeyEx
|
|
0x0B0184 00007FFEFDA0FDA0 NtSaveMergedKeys
|
|
0x185 00007FFEFDA0FDC0 NtSecureConnectPort
|
|
0x186 00007FFEFDA0FDE0 NtSerializeBoot
|
|
0x187 00007FFEFDA0FE00 NtSetBootEntryOrder
|
|
0x188 00007FFEFDA0FE20 NtSetBootOptions
|
|
0x189 00007FFEFDA0FE40 NtSetCachedSigningLevel
|
|
0x18A 00007FFEFDA0FE60 NtSetCachedSigningLevel2
|
|
0x18B 00007FFEFDA0FE80 NtSetContextThread
|
|
0x0A018C 00007FFEFDA0FEA0 NtSetDebugFilterState
|
|
0x3018D 00007FFEFDA0FEC0 NtSetDefaultHardErrorPort
|
|
0x5018E 00007FFEFDA0FEE0 NtSetDefaultLocale
|
|
0x4018F 00007FFEFDA0FF00 NtSetDefaultUILanguage
|
|
0x190 00007FFEFDA0FF20 NtSetDriverEntryOrder
|
|
0x191 00007FFEFDA0FF40 NtSetEaFile
|
|
0x7000E 00007FFEFDA0CEF0 NtSetEvent
|
|
0x3002D 00007FFEFDA0D2D0 NtSetEventBoostPriority
|
|
0x30192 00007FFEFDA0FF60 NtSetHighEventPair
|
|
0x30193 00007FFEFDA0FF80 NtSetHighWaitLowEventPair
|
|
0x70194 00007FFEFDA0FFA0 NtSetIRTimer
|
|
0x195 00007FFEFDA0FFC0 NtSetInformationDebugObject
|
|
0x196 00007FFEFDA0FFE0 NtSetInformationEnlistment
|
|
0x27 00007FFEFDA0D210 NtSetInformationFile
|
|
0x197 00007FFEFDA10000 NtSetInformationJobObject
|
|
0x198 00007FFEFDA10020 NtSetInformationKey
|
|
0x5C 00007FFEFDA0D8A0 NtSetInformationObject
|
|
0x1C 00007FFEFDA0D0B0 NtSetInformationProcess
|
|
0x199 00007FFEFDA10040 NtSetInformationResourceManager
|
|
0x19A 00007FFEFDA10060 NtSetInformationSymbolicLink
|
|
0x0D 00007FFEFDA0CED0 NtSetInformationThread
|
|
0x19B 00007FFEFDA10080 NtSetInformationToken
|
|
0x19C 00007FFEFDA100A0 NtSetInformationTransaction
|
|
0x19D 00007FFEFDA100C0 NtSetInformationTransactionManager
|
|
0x19E 00007FFEFDA100E0 NtSetInformationVirtualMemory
|
|
0x19F 00007FFEFDA10100 NtSetInformationWorkerFactory
|
|
0x501A0 00007FFEFDA10120 NtSetIntervalProfile
|
|
0x1A1 00007FFEFDA10140 NtSetIoCompletion
|
|
0x1A2 00007FFEFDA10160 NtSetIoCompletionEx
|
|
0x1A3 00007FFEFDA10180 NtSetLdtEntries
|
|
0x301A4 00007FFEFDA101A0 NtSetLowEventPair
|
|
0x301A5 00007FFEFDA101C0 NtSetLowWaitHighEventPair
|
|
0x1A6 00007FFEFDA101E0 NtSetQuotaInformationFile
|
|
0x1A7 00007FFEFDA10200 NtSetSecurityObject
|
|
0x1A8 00007FFEFDA10220 NtSetSystemEnvironmentValue
|
|
0x1A9 00007FFEFDA10240 NtSetSystemEnvironmentValueEx
|
|
0x1AA 00007FFEFDA10260 NtSetSystemInformation
|
|
0x1AB 00007FFEFDA10280 NtSetSystemPowerState
|
|
0x501AC 00007FFEFDA102A0 NtSetSystemTime
|
|
0x501AD 00007FFEFDA102C0 NtSetThreadExecutionState
|
|
0x62 00007FFEFDA0D960 NtSetTimer
|
|
0x1AE 00007FFEFDA102E0 NtSetTimer2
|
|
0x1AF 00007FFEFDA10300 NtSetTimerEx
|
|
0x0A01B0 00007FFEFDA10320 NtSetTimerResolution
|
|
0x401B1 00007FFEFDA10340 NtSetUuidSeed
|
|
0x60 00007FFEFDA0D920 NtSetValueKey
|
|
0x1B2 00007FFEFDA10360 NtSetVolumeInformationFile
|
|
0x1B3 00007FFEFDA10380 NtSetWnfProcessNotificationEvent
|
|
0x401B4 00007FFEFDA103A0 NtShutdownSystem
|
|
0x1B5 00007FFEFDA103C0 NtShutdownWorkerFactory
|
|
0x301B6 00007FFEFDA103E0 NtSignalAndWaitForSingleObject
|
|
0x1B7 00007FFEFDA10400 NtSinglePhaseReject
|
|
0x301B8 00007FFEFDA10420 NtStartProfile
|
|
0x301B9 00007FFEFDA10440 NtStopProfile
|
|
0x1BA 00007FFEFDA10460 NtSubscribeWnfStateChange
|
|
0x301BB 00007FFEFDA10480 NtSuspendProcess
|
|
0x701BC 00007FFEFDA104A0 NtSuspendThread
|
|
0x1BD 00007FFEFDA104C0 NtSystemDebugControl
|
|
0x1BE 00007FFEFDA104E0 NtTerminateEnclave
|
|
0x701BF 00007FFEFDA10500 NtTerminateJobObject
|
|
0x7002C 00007FFEFDA0D2B0 NtTerminateProcess
|
|
0x70053 00007FFEFDA0D790 NtTerminateThread
|
|
0x201C0 00007FFEFDA10520 NtTestAlert
|
|
0x1C1 00007FFEFDA10540 NtThawRegistry
|
|
0x1C2 00007FFEFDA10560 NtThawTransactions
|
|
0x1C3 00007FFEFDA10580 NtTraceControl
|
|
0x5E 00007FFEFDA0D8E0 NtTraceEvent
|
|
0x1101C4 00007FFEFDA105A0 NtTranslateFilePath
|
|
0x1C5 00007FFEFDA105C0 NtUmsThreadYield
|
|
0x1C6 00007FFEFDA105E0 NtUnloadDriver
|
|
0x1C7 00007FFEFDA10600 NtUnloadKey
|
|
0x1C8 00007FFEFDA10620 NtUnloadKey2
|
|
0x1C9 00007FFEFDA10640 NtUnloadKeyEx
|
|
0x1CA 00007FFEFDA10660 NtUnlockFile
|
|
0x1CB 00007FFEFDA10680 NtUnlockVirtualMemory
|
|
0x2A 00007FFEFDA0D270 NtUnmapViewOfSection
|
|
0x1CC 00007FFEFDA106A0 NtUnmapViewOfSectionEx
|
|
0x1CD 00007FFEFDA106C0 NtUnsubscribeWnfStateChange
|
|
0x1CE 00007FFEFDA106E0 NtUpdateWnfStateData
|
|
0x1CF 00007FFEFDA10700 NtVdmControl
|
|
0x601D0 00007FFEFDA10720 NtWaitForAlertByThreadId
|
|
0x1D1 00007FFEFDA10740 NtWaitForDebugEvent
|
|
0x1501D2 00007FFEFDA10760 NtWaitForKeyedEvent
|
|
0x1D005B 00007FFEFDA0D880 NtWaitForMultipleObjects
|
|
0x1E001A 00007FFEFDA0D070 NtWaitForMultipleObjects32
|
|
0x0D0004 00007FFEFDA0CDB0 NtWaitForSingleObject
|
|
0x1D3 00007FFEFDA10780 NtWaitForWorkViaWorkerFactory
|
|
0x301D4 00007FFEFDA107A0 NtWaitHighEventPair
|
|
0x301D5 00007FFEFDA107C0 NtWaitLowEventPair
|
|
0x30001 00007FFEFDA0CD50 NtWorkerFactoryWorkerReady
|
|
0x1A0008 00007FFEFDA0CE30 NtWriteFile
|
|
0x1A001B 00007FFEFDA0D090 NtWriteFileGather
|
|
0x57 00007FFEFDA0D810 NtWriteRequestData
|
|
0x3A 00007FFEFDA0D470 NtWriteVirtualMemory
|
|
0x10046 00007FFEFDA0D5F0 NtYieldExecution
|
|
0x36 00007FFEFDA0D3F0 RtlGetNativeSystemInformation
|
|
"""
|
|
reverseDict={}
|
|
normalDict={}
|
|
|
|
winDbgList=[]
|
|
|
|
input=win11_21H2
|
|
input=win1021h2
|
|
for each in input:
|
|
# outfile = input.split(".")[0]
|
|
if t >1 and t < 100000:
|
|
outfile = input.split("0x")
|
|
# outfile[1]
|
|
try:
|
|
new=(outfile[t])
|
|
syscall = new.split()
|
|
print (syscall)
|
|
if syscall[0] in reverseDict:
|
|
print (syscall[0], " is already present!!")
|
|
print ("****",reverseDict[syscall[0]])
|
|
normalDict[str(int(syscall[0],16))]=syscall[2]
|
|
reverseDict[syscall[2]]=int(syscall[0],16)
|
|
temp=("u ntdll!"+syscall[2] + " L2")
|
|
winDbgList.append(temp)
|
|
except:
|
|
pass
|
|
t+=1
|
|
|
|
print ("\n\nReverse Dic", len(reverseDict))
|
|
|
|
print (reverseDict)
|
|
print ("\n\nNormal Dic", len(normalDict))
|
|
print (normalDict)
|
|
|
|
print ("winDbgList")
|
|
for each in winDbgList:
|
|
print (each) |