/ Chip 2004 July / CHIP_CD_2004-07.iso / service / kasperskyhit / files / kavpers45048chip.exe / data1.cab / Klif_WinNT / klif.sys / INIT

next >

view JSON data

view as text

open on a Mac

open on a PC

+--------+-------------------------+-------------------------+--------+--------+
|00000000| 83 ec 08 56 57 8d 44 24 | 08 33 ff 50 8d 4c 24 0c |...VW.D$|.3.P.L$.|
|00000010| 57 51 6a 0b 89 7c 24 1c | e8 49 9d ff ff 68 42 65 |WQj..|$.|.I...hBe|
|00000020| 53 2d 8b 54 24 0c 52 6a | 01 ff 15 2c 10 01 00 8b |S-.T$.Rj|...,....|
|00000030| f0 85 f6 0f 84 8a 00 00 | 00 8b 44 24 08 53 55 57 |........|..D$.SUW|
|00000040| 50 56 6a 0b e8 1d 9d ff | ff 85 c0 75 61 83 3e 00 |PVj.....|...ua.>.|
|00000050| 76 5c 33 db 8d 6e 1e 8b | 4c 24 1c 33 d2 66 8b 55 |v\3..n..|L$.3.f.U|
|00000060| 00 51 03 d3 8d 44 32 20 | 50 ff 15 38 10 01 00 83 |.Q...D2 |P..8....|
|00000070| c4 08 85 c0 74 28 8b 06 | 47 81 c3 1c 01 00 00 81 |....t(..|G.......|
|00000080| c5 1c 01 00 00 3b f8 72 | ce 56 ff 15 28 10 01 00 |.....;.r|.V..(...|
|00000090| 5d 5b 8b 44 24 0c 5f 5e | 83 c4 08 c2 04 00 8d 0c |][.D$._^|........|
|000000a0| ff c1 e1 03 2b cf 8b 54 | 8e 0c 89 54 24 14 56 ff |....+..T|...T$.V.|
|000000b0| 15 28 10 01 00 5d 5b 8b | 44 24 0c 5f 5e 83 c4 08 |.(...][.|D$._^...|
|000000c0| c2 04 00 8b c7 5f 5e 83 | c4 08 c2 04 00 90 90 90 |....._^.|........|
|000000d0| 53 65 49 6d 70 65 72 73 | 6f 6e 61 74 65 43 6c 69 |SeImpers|onateCli|
|000000e0| 65 6e 74 45 78 00 00 00 | 53 65 49 6d 70 65 72 73 |entEx...|SeImpers|
|000000f0| 6f 6e 61 74 65 43 6c 69 | 65 6e 74 00 a1 6c 4f 02 |onateCli|ent..lO.|
|00000100| 00 6a 00 68 d0 a0 02 00 | 50 e8 ad 94 fe ff 85 c0 |.j.h....|P.......|
|00000110| a3 78 51 02 00 74 08 b0 | 01 a2 72 4f 02 00 c3 8b |.xQ..t..|..rO....|
|00000120| 0d 6c 4f 02 00 6a 00 68 | e8 a0 02 00 51 e8 89 94 |.lO..j.h|....Q...|
|00000130| fe ff 85 c0 a3 78 51 02 | 00 74 08 b0 01 a2 72 4f |.....xQ.|.t....rO|
|00000140| 02 00 c3 32 c0 c3 90 90 | 90 90 90 90 68 40 51 02 |...2....|....h@Q.|
|00000150| 00 ff 15 30 10 01 00 c6 | 05 78 4f 02 00 01 c3 90 |...0....|.xO.....|
|00000160| 90 90 90 90 90 90 90 90 | 90 90 90 90 a0 79 4f 02 |........|.....yO.|
|00000170| 00 84 c0 75 52 68 7c 4f | 02 00 e8 2c a6 fe ff 68 |...uRh|O|...,...h|
|00000180| 80 4f 02 00 e8 22 a6 fe | ff 68 84 4f 02 00 e8 18 |.O..."..|.h.O....|
|00000190| a6 fe ff 68 88 4f 02 00 | e8 0e a6 fe ff 68 c1 04 |...h.O..|.....h..|
|000001a0| 00 00 e8 74 9f fe ff 68 | 00 08 00 00 a3 8c 4f 02 |...t...h|......O.|
|000001b0| 00 e8 65 9f fe ff a3 90 | 4f 02 00 b0 01 a2 79 4f |..e.....|O.....yO|
|000001c0| 02 00 a2 7a 4f 02 00 c3 | 90 90 90 90 51 56 8b 35 |...zO...|....QV.5|
|000001d0| c0 10 01 00 6a 00 6a 01 | 68 ec 51 02 00 c7 44 24 |....j.j.|h.Q...D$|
|000001e0| 10 00 00 00 00 c7 05 e0 | 51 02 00 01 00 00 00 c7 |........|Q.......|
|000001f0| 05 e8 51 02 00 00 00 00 | 00 ff d6 6a 00 6a 01 68 |..Q.....|...j.j.h|
|00000200| a0 50 02 00 ff d6 6a 00 | 68 23 4e 01 00 6a 00 6a |.P....j.|h#N..j.j|
|00000210| 00 6a 00 8d 44 24 18 68 | ff 03 1f 00 50 ff 15 bc |.j..D$.h|....P...|
|00000220| 10 01 00 85 c0 75 33 8b | 4c 24 04 50 68 94 4f 02 |.....u3.|L$.Ph.O.|
|00000230| 00 50 50 68 00 00 0f 00 | 51 ff 15 b8 10 01 00 8b |.PPh....|Q.......|
|00000240| f0 8b 44 24 04 85 c0 74 | 07 50 ff 15 24 10 01 00 |..D$...t|.P..$...|
|00000250| 33 c0 85 f6 0f 9d c0 48 | 23 c6 5e 59 c3 90 90 90 |3......H|#.^Y....|
|00000260| 90 90 90 90 90 90 90 90 | 90 90 90 90 56 8b 35 30 |........|....V.50|
|00000270| 10 01 00 68 60 52 02 00 | ff d6 68 e0 50 02 00 ff |...h`R..|..h.P...|
|00000280| d6 c6 05 ac 4f 02 00 01 | 5e c3 90 90 51 6a 00 68 |....O...|^...Qj.h|
|00000290| 09 79 01 00 6a 00 6a 00 | 6a 00 8d 44 24 14 68 ff |.y..j.j.|j..D$.h.|
|000002a0| 03 1f 00 50 c7 44 24 1c | 00 00 00 00 ff 15 bc 10 |...P.D$.|........|
|000002b0| 01 00 85 c0 75 35 8b 4c | 24 00 56 50 68 b0 4f 02 |....u5.L|$.VPh.O.|
|000002c0| 00 50 50 68 00 00 0f 00 | 51 ff 15 b8 10 01 00 8b |.PPh....|Q.......|
|000002d0| f0 8b 44 24 04 85 c0 74 | 07 50 ff 15 24 10 01 00 |..D$...t|.P..$...|
|000002e0| 33 c0 85 f6 0f 9d c0 48 | 23 c6 5e 59 c3 90 90 90 |3......H|#.^Y....|
|000002f0| 90 90 90 90 90 90 90 90 | 90 90 90 90 57 b9 0d 00 |........|....W...|
|00000300| 00 00 33 c0 bf 00 50 02 | 00 f3 ab 68 20 52 02 00 |..3...P.|...h R..|
|00000310| ff 15 30 10 01 00 b8 03 | 00 00 00 c7 05 64 50 02 |..0.....|.....dP.|
|00000320| 00 06 00 00 00 a3 68 50 | 02 00 a3 6c 50 02 00 33 |......hP|...lP..3|
|00000330| c0 5f a3 60 50 02 00 a3 | 78 50 02 00 a3 74 50 02 |._.`P...|xP...tP.|
|00000340| 00 a3 70 50 02 00 a3 80 | 50 02 00 a3 7c 50 02 00 |..pP....|P...|P..|
|00000350| c3 90 90 90 90 90 90 90 | 90 90 90 90 25 00 30 00 |........|....%.0.|
|00000360| 39 00 75 00 00 00 83 ec | 5c 53 55 56 8b 35 2c 10 |9.u.....|\SUV.5,.|
|00000370| 01 00 57 68 42 65 53 66 | 68 00 10 00 00 6a 01 33 |..WhBeSf|h....j.3|
|00000380| db 33 ff ff d6 8b e8 3b | eb 0f 84 db 02 00 00 68 |.3.....;|.......h|
|00000390| 42 65 53 66 68 20 01 00 | 00 6a 01 ff d6 3b c3 89 |BeSfh ..|.j...;..|
|000003a0| 44 24 1c 0f 84 bd 02 00 | 00 68 42 65 53 66 68 0e |D$......|.hBeSfh.|
|000003b0| 01 00 00 6a 01 ff d6 8b | f8 3b fb 89 7c 24 28 0f |...j....|.;..|$(.|
|000003c0| 84 b6 02 00 00 8d 44 24 | 54 8d 4c 24 10 50 68 19 |......D$|T.L$.Ph.|
|000003d0| 00 02 00 51 c7 44 24 60 | 18 00 00 00 89 5c 24 64 |...Q.D$`|.....\$d|
|000003e0| c7 44 24 6c 40 00 00 00 | c7 44 24 68 80 51 02 00 |.D$l@...|.D$h.Q..|
|000003f0| 89 5c 24 70 89 5c 24 74 | ff 15 f4 10 01 00 8b f0 |.\$p.\$t|........|
|00000400| 3b f3 0f 85 41 02 00 00 | 8b 44 24 10 8d 54 24 14 |;...A...|.D$..T$.|
|00000410| 52 68 0e 01 00 00 57 53 | 53 50 c7 44 24 3c 01 00 |Rh....WS|SP.D$<..|
|00000420| 00 00 ff 15 f0 10 01 00 | 85 c0 0f 85 0e 02 00 00 |........|........|
|00000430| 8b 1d dc 10 01 00 8b 4f | 0c 8d 47 10 d1 e9 8d 54 |.......O|..G....T|
|00000440| 24 30 50 52 66 c7 44 4f | 10 00 00 ff d3 8d 44 24 |$0PRf.DO|......D$|
|00000450| 2c 8d 4c 24 30 50 6a 00 | 51 66 c7 44 24 3e 0e 01 |,.L$0Pj.|Qf.D$>..|
|00000460| ff 15 ec 10 01 00 85 c0 | 0f 85 a4 01 00 00 8b 54 |........|.......T|
|00000470| 24 10 8d 44 24 30 8d 4c | 24 54 89 54 24 58 89 44 |$..D$0.L|$T.T$X.D|
|00000480| 24 5c 51 8d 54 24 1c 33 | c0 68 19 00 02 00 52 c7 |$\Q.T$.3|.h....R.|
|00000490| 44 24 60 18 00 00 00 c7 | 44 24 6c 40 00 00 00 89 |D$`.....|D$l@....|
|000004a0| 44 24 70 89 44 24 74 ff | 15 f4 10 01 00 8b f0 85 |D$p.D$t.|........|
|000004b0| f6 0f 85 5b 01 00 00 a1 | b4 4a 02 00 8d 4c 24 38 |...[....|.J...L$8|
|000004c0| 50 51 ff d3 8d 54 24 14 | 8d 44 24 38 8b 4c 24 18 |PQ...T$.|.D$8.L$.|
|000004d0| 52 68 00 10 00 00 55 6a | 02 50 51 ff 15 e8 10 01 |Rh....Uj|.PQ.....|
|000004e0| 00 8b f0 85 f6 0f 85 1c | 01 00 00 83 7d 0c 0a 0f |........|....}...|
|000004f0| 85 12 01 00 00 8b 15 b0 | 4a 02 00 8d 44 24 38 52 |........|J...D$8R|
|00000500| 50 ff d3 8d 4c 24 14 8d | 54 24 38 8b 44 24 18 51 |P...L$..|T$8.D$.Q|
|00000510| 68 00 10 00 00 55 6a 02 | 52 50 ff 15 e8 10 01 00 |h....Uj.|RP......|
|00000520| 8b f0 85 f6 0f 85 dd 00 | 00 00 8b 4c 24 2c 8d 45 |........|...L$,.E|
|00000530| 0c 50 51 e8 fc c9 fe ff | 84 c0 0f 84 c7 00 00 00 |.PQ.....|........|
|00000540| 8d 54 24 30 68 a8 4a 02 | 00 52 ff 15 18 10 01 00 |.T$0h.J.|.R......|
|00000550| 8b f0 85 f6 0f 85 ad 00 | 00 00 8b 44 24 10 8d 54 |........|...D$..T|
|00000560| 24 54 89 44 24 58 33 c0 | 50 50 50 89 44 24 70 89 |$T.D$X3.|PPP.D$p.|
|00000570| 44 24 74 50 52 8d 44 24 | 34 8d 4c 24 44 68 06 00 |D$tPR.D$|4.L$Dh..|
|00000580| 02 00 50 c7 44 24 70 18 | 00 00 00 c7 44 24 7c 40 |..P.D$p.|....D$|@|
|00000590| 00 00 00 89 4c 24 78 ff | 15 e4 10 01 00 8b f0 85 |....L$x.|........|
|000005a0| f6 75 64 33 ff 8b c7 8d | 4c 24 40 50 68 5c a3 02 |.ud3....|L$@Ph\..|
|000005b0| 00 51 47 ff 15 d0 10 01 | 00 83 c4 0c 8d 54 24 40 |.QG.....|.....T$@|
|000005c0| 8d 44 24 38 52 50 ff d3 | 8d 4c 24 14 8d 54 24 38 |.D$8RP..|.L$..T$8|
|000005d0| 8b 44 24 20 51 68 00 10 | 00 00 55 6a 02 52 50 ff |.D$ Qh..|..Uj.RP.|
|000005e0| 15 e8 10 01 00 8b f0 85 | f6 75 0d 8d 45 0c 6a 01 |........|.u..E.j.|
|000005f0| 50 e8 13 e3 fe ff eb ad | 8b 4c 24 20 51 ff 15 24 |P.......|.L$ Q..$|
|00000600| 10 01 00 8b 7c 24 28 8b | 54 24 18 52 ff 15 24 10 |....|$(.|T$.R..$.|
|00000610| 01 00 8b 4c 24 24 8b 54 | 24 10 8b c1 41 89 4c 24 |...L$$.T|$...A.L$|
|00000620| 24 8d 4c 24 14 51 68 0e | 01 00 00 57 6a 00 50 52 |$.L$.Qh.|...Wj.PR|
|00000630| ff 15 f0 10 01 00 85 c0 | 0f 84 f8 fd ff ff 8b 44 |........|.......D|
|00000640| 24 10 50 ff 15 24 10 01 | 00 57 8b 3d 28 10 01 00 |$.P..$..|.W.=(...|
|00000650| ff d7 8b 4c 24 1c 51 ff | d7 55 ff d7 8b c6 5f 5e |...L$.Q.|.U...._^|
|00000660| 5d 5b 83 c4 5c c3 8b 7c | 24 1c 8b 44 24 28 3b c3 |][..\..||$..D$(;.|
|00000670| 74 0d 50 ff 15 28 10 01 | 00 eb 04 8b 7c 24 1c 3b |t.P..(..|....|$.;|
|00000680| fb 74 07 57 ff 15 28 10 | 01 00 3b eb 74 07 55 ff |.t.W..(.|..;.t.U.|
|00000690| 15 28 10 01 00 5f 5e 5d | b8 9a 00 00 c0 5b 83 c4 |.(..._^]|.....[..|
|000006a0| 5c c3 90 90 90 90 00 00 | 4e 74 53 65 74 49 6e 66 |\.......|NtSetInf|
|000006b0| 6f 72 6d 61 74 69 6f 6e | 50 72 6f 63 65 73 73 00 |ormation|Process.|
|000006c0| 51 a1 68 4f 02 00 56 68 | a8 a6 02 00 50 e8 59 90 |Q.hO..Vh|....P.Y.|
|000006d0| fe ff 85 c0 74 59 8d 34 | 85 00 00 00 00 a1 14 11 |....tY.4|........|
|000006e0| 01 00 8b 08 8b 14 31 8d | 4c 24 04 89 15 38 50 02 |......1.|L$...8P.|
|000006f0| 00 8b 10 51 03 d6 6a 01 | 52 e8 3d 93 fe ff 84 c0 |...Q..j.|R.=.....|
|00000700| 74 2d a1 14 11 01 00 8d | 54 24 04 52 8b 08 c7 04 |t-......|T$.R....|
|00000710| 31 c2 b4 01 00 8b 0d 14 | 11 01 00 8b 44 24 08 8b |1.......|....D$..|
|00000720| 11 50 03 d6 52 e8 11 93 | fe ff b0 01 5e 59 c3 32 |.P..R...|....^Y.2|
|00000730| c0 5e 59 c3 90 90 90 90 | 90 90 90 90 90 90 90 90 |.^Y.....|........|
|00000740| 55 8b ec 6a ff 68 08 2e | 01 00 68 9c 3c 02 00 64 |U..j.h..|..h.<..d|
|00000750| a1 00 00 00 00 50 64 89 | 25 00 00 00 00 83 ec 4c |.....Pd.|%......L|
|00000760| 53 56 57 89 65 e8 8b 0d | 6c 4f 02 00 66 81 39 4d |SVW.e...|lO..f.9M|
|00000770| 5a 0f 85 f1 01 00 00 8b | 41 3c 03 c1 81 38 50 45 |Z.......|A<...8PE|
|00000780| 00 00 0f 85 e0 01 00 00 | 33 d2 66 8b 50 14 8d 44 |........|3.f.P..D|
|00000790| 02 18 8b 70 0c 03 f1 8b | 40 10 33 db 89 5d e0 89 |...p....|@.3..]..|
|000007a0| 5d fc 8b 0d 18 11 01 00 | 66 8b 09 66 81 f9 28 0a |].......|f..f..(.|
|000007b0| 0f 8e 8a 00 00 00 c7 45 | e4 05 00 00 00 66 81 f9 |.......E|.....f..|
|000007c0| ce 0e 7c 14 b9 e8 4a 02 | 00 89 4d a8 ba 09 00 00 |..|...J.|..M.....|
|000007d0| 00 89 55 ac 33 ff eb 33 | 66 81 f9 14 0e 7e 17 b9 |..U.3..3|f....~..|
|000007e0| e0 4a 02 00 89 4d a8 ba | 08 00 00 00 89 55 ac bf |.J...M..|.....U..|
|000007f0| 0a 00 00 00 eb 15 b9 d8 | 4a 02 00 89 4d a8 ba 07 |........|J...M...|
|00000800| 00 00 00 89 55 ac bf 09 | 00 00 00 89 7d b0 52 51 |....U...|....}.RQ|
|00000810| 50 56 e8 44 8f fe ff 89 | 45 dc 83 f8 ff 0f 84 83 |PV.D....|E.......|
|00000820| 00 00 00 03 c7 03 f0 81 | 3e ff 43 10 ff 75 77 8b |........|>.C..uw.|
|00000830| de 89 5d e0 c7 45 fc ff | ff ff ff e9 82 00 00 00 |..]..E..|........|
|00000840| 6a 05 68 cc 4a 02 00 50 | 56 e8 0d 8f fe ff 89 45 |j.h.J..P|V......E|
|00000850| dc 83 f8 ff 74 50 8b 15 | 18 11 01 00 66 81 3a 93 |....tP..|....f.:.|
|00000860| 08 7e 36 03 f0 89 75 a4 | c7 45 e4 07 00 00 00 6a |.~6...u.|.E.....j|
|00000870| 04 68 d4 4a 02 00 68 00 | 01 00 00 56 e8 da 8e fe |.h.J..h.|...V....|
|00000880| ff 89 45 dc 83 f8 ff 74 | 1d 8d 5c 06 02 89 5d e0 |..E....t|..\...].|
|00000890| c7 45 fc ff ff ff ff eb | 29 8d 1c 30 89 5d e0 c7 |.E......|)..0.]..|
|000008a0| 45 e4 05 00 00 00 c7 45 | fc ff ff ff ff eb 13 b8 |E......E|........|
|000008b0| 01 00 00 00 c3 8b 65 e8 | c7 45 fc ff ff ff ff 8b |......e.|.E......|
|000008c0| 5d e0 85 db 0f 84 9e 00 | 00 00 b8 90 90 90 90 89 |].......|........|
|000008d0| 45 c8 89 45 cc 66 89 45 | d0 c6 45 c8 e9 b9 62 b5 |E..E.f.E|..E...b.|
|000008e0| 01 00 2b cb 83 e9 05 89 | 4d c9 8b 4d e4 8d 14 19 |..+.....|M..M....|
|000008f0| 89 15 90 50 02 00 8b f3 | bf b8 4a 02 00 8b c1 c1 |...P....|..J.....|
|00000900| e9 02 f3 a5 8b c8 83 e1 | 03 f3 a4 8d 4d b8 51 6a |........|....M.Qj|
|00000910| 01 53 e8 24 91 fe ff 84 | c0 74 4d b9 34 50 02 00 |.S.$....|.tM.4P..|
|00000920| e8 e6 91 fe ff 8b 4d e4 | 8d 75 c8 8b fb 8b d1 c1 |......M.|.u......|
|00000930| e9 02 f3 a5 8b ca 83 e1 | 03 f3 a4 8b d0 b9 34 50 |........|......4P|
|00000940| 02 00 e8 e4 91 fe ff 8d | 45 b8 50 8b 4d b8 51 53 |........|E.P.M.QS|
|00000950| e8 e6 90 fe ff b0 01 8b | 4d f0 64 89 0d 00 00 00 |........|M.d.....|
|00000960| 00 5f 5e 5b 8b e5 5d c3 | 32 c0 8b 4d f0 64 89 0d |._^[..].|2..M.d..|
|00000970| 00 00 00 00 5f 5e 5b 8b | e5 5d c3 90 90 90 90 90 |...._^[.|.]......|
|00000980| 4e 00 6f 00 54 00 53 00 | 50 00 00 00 83 ec 28 53 |N.o.T.S.|P.....(S|
|00000990| 56 bb 01 00 00 00 68 42 | 65 53 74 68 00 10 00 00 |V.....hB|eSth....|
|000009a0| 53 ff 15 2c 10 01 00 8b | f0 33 c0 3b f0 0f 84 87 |S..,....|.3.;....|
|000009b0| 00 00 00 89 44 24 1c 89 | 44 24 28 89 44 24 2c 8d |....D$..|D$(.D$,.|
|000009c0| 44 24 18 50 8d 4c 24 0c | 68 19 00 02 00 51 c7 44 |D$.P.L$.|h....Q.D|
|000009d0| 24 24 18 00 00 00 c7 44 | 24 30 40 00 00 00 c7 44 |$$.....D|$0@....D|
|000009e0| 24 2c 80 51 02 00 ff 15 | f4 10 01 00 85 c0 75 43 |$,.Q....|......uC|
|000009f0| 8d 54 24 10 68 80 a9 02 | 00 52 ff 15 dc 10 01 00 |.T$.h...|.R......|
|00000a00| 8d 44 24 0c 8d 4c 24 10 | 8b 54 24 08 50 68 00 10 |.D$..L$.|.T$.Ph..|
|00000a10| 00 00 56 6a 02 51 52 ff | 15 e8 10 01 00 85 c0 75 |..Vj.QR.|.......u|
|00000a20| 07 39 5e 0c 75 02 32 db | 8b 44 24 08 50 ff 15 24 |.9^.u.2.|.D$.P..$|
|00000a30| 10 01 00 56 ff 15 28 10 | 01 00 8a c3 5e 5b 83 c4 |...V..(.|....^[..|
|00000a40| 28 c3 90 90 90 90 90 90 | 90 90 90 90 57 6a 00 6a |(.......|....Wj.j|
|00000a50| 01 68 ac 51 02 00 c7 05 | a0 51 02 00 01 00 00 00 |.h.Q....|.Q......|
|00000a60| c7 05 a8 51 02 00 00 00 | 00 00 ff 15 c0 10 01 00 |...Q....|........|
|00000a70| a1 08 11 01 00 c7 05 34 | 50 02 00 00 00 00 00 68 |.......4|P......h|
|00000a80| 42 65 53 74 0f be 08 c1 | e1 02 51 6a 01 ff 15 2c |BeSt....|..Qj...,|
|00000a90| 10 01 00 8b f8 85 ff 89 | 3d 8c 50 02 00 74 4e 8b |........|=.P..tN.|
|00000aa0| 15 08 11 01 00 33 c0 0f | be 0a c1 e1 02 8b d1 c1 |.....3..|........|
|00000ab0| e9 02 f3 ab 8b ca 83 e1 | 03 f3 aa e8 cc fe ff ff |........|........|
|00000ac0| 84 c0 74 19 e8 f7 fb ff | ff e8 72 fc ff ff 84 c0 |..t.....|..r.....|
|00000ad0| 74 0b c6 05 c4 4f 02 00 | 01 b0 01 5f c3 a1 8c 50 |t....O..|..._...P|
|00000ae0| 02 00 85 c0 74 07 50 ff | 15 28 10 01 00 32 c0 5f |....t.P.|.(...2._|
|00000af0| c3 90 90 90 90 90 90 90 | 90 90 90 90 55 8b ec 6a |........|....U..j|
|00000b00| ff 68 18 2e 01 00 68 9c | 3c 02 00 64 a1 00 00 00 |.h....h.|<..d....|
|00000b10| 00 50 64 89 25 00 00 00 | 00 83 ec 14 53 56 57 89 |.Pd.%...|....SVW.|
|00000b20| 65 e8 a1 20 11 01 00 89 | 45 e4 c7 45 dc 00 00 00 |e.. ....|E..E....|
|00000b30| 00 81 7d dc 00 10 00 00 | 73 64 c7 45 fc 00 00 00 |..}.....|sd.E....|
|00000b40| 00 8b 4d e4 8b 19 89 5d | e0 c7 45 fc ff ff ff ff |..M....]|..E.....|
|00000b50| 53 ff 15 1c 11 01 00 84 | c0 74 2b b9 04 00 00 00 |S.......|.t+.....|
|00000b60| a1 14 11 01 00 8b f8 8b | f3 33 d2 f3 a7 75 17 3b |........|.3...u.;|
|00000b70| d8 74 13 8b c3 8b 4d f0 | 64 89 0d 00 00 00 00 5f |.t....M.|d......_|
|00000b80| 5e 5b 8b e5 5d c3 ff 45 | dc ff 45 e4 eb a3 b8 01 |^[..]..E|..E.....|
|00000b90| 00 00 00 c3 8b 65 e8 c7 | 45 fc ff ff ff ff 33 c0 |.....e..|E.....3.|
|00000ba0| 8b 4d f0 64 89 0d 00 00 | 00 00 5f 5e 5b 8b e5 5d |.M.d....|.._^[..]|
|00000bb0| c3 90 90 90 90 90 90 90 | 90 90 90 90 83 ec 08 a1 |........|........|
|00000bc0| 14 11 01 00 53 55 56 8b | 70 08 57 83 c6 0d 89 74 |....SUV.|p.W....t|
|00000bd0| 24 14 e8 25 ff ff ff 85 | c0 89 44 24 10 75 0d 5f |$..%....|..D$.u._|
|00000be0| 5e 5d b8 01 00 00 c0 5b | 83 c4 08 c3 8b 0d 14 11 |^].....[|........|
|00000bf0| 01 00 8b 3d 2c 10 01 00 | 8d 04 b5 00 00 00 00 68 |...=,...|.......h|
|00000c00| 42 65 53 2d 8b 51 08 50 | 6a 01 89 15 7c 8d 02 00 |BeS-.Q.P|j...|...|
|00000c10| ff d7 8b e8 85 ed 0f 84 | 54 01 00 00 68 42 65 53 |........|T...hBeS|
|00000c20| 2d 56 6a 01 ff d7 8b d8 | 85 db 0f 84 39 01 00 00 |-Vj.....|....9...|
|00000c30| a1 14 11 01 00 8b fd 8b | 48 08 8b 30 c1 e1 02 8b |........|H..0....|
|00000c40| c1 c1 e9 02 f3 a5 8b c8 | 83 e1 03 f3 a4 a1 14 11 |........|........|
|00000c50| 01 00 8b fb 8b 48 08 8b | 70 0c 8b d1 c1 e9 02 f3 |.....H..|p.......|
|00000c60| a5 8b ca 83 e1 03 f3 a4 | a1 14 11 01 00 be f4 4a |........|.......J|
|00000c70| 02 00 8b 48 08 8d 7c 8d | 00 b9 0d 00 00 00 f3 a5 |...H..|.|........|
|00000c80| 8b 15 14 11 01 00 8b 0d | 28 4b 02 00 33 f6 8b 42 |........|(K..3..B|
|00000c90| 08 03 c3 89 08 8b 15 2c | 4b 02 00 89 50 04 8b 0d |.......,|K...P...|
|00000ca0| 30 4b 02 00 89 48 08 8a | 15 34 4b 02 00 88 50 0c |0K...H..|.4K...P.|
|00000cb0| a1 14 11 01 00 39 70 04 | 74 74 8b 4c 24 14 68 42 |.....9p.|tt.L$.hB|
|00000cc0| 65 53 2d 8d 04 8d 00 00 | 00 00 50 6a 01 ff 15 2c |eS-.....|..Pj...,|
|00000cd0| 10 01 00 8b d0 3b d6 74 | 45 a1 14 11 01 00 8b fa |.....;.t|E.......|
|00000ce0| 8b 48 08 8b 70 04 c1 e1 | 02 8b c1 c1 e9 02 f3 a5 |.H..p...|........|
|00000cf0| 8b c8 83 e1 03 33 c0 f3 | a4 8b 35 14 11 01 00 b9 |.....3..|..5.....|
|00000d00| 0d 00 00 00 8b 76 08 8d | 3c b2 f3 ab 8b 0d 14 11 |.....v..|<.......|
|00000d10| 01 00 8b 44 24 10 89 51 | 04 89 50 04 eb 14 8b 15 |...D$..Q|..P.....|
|00000d20| 14 11 01 00 8b 44 24 10 | 89 72 04 89 70 04 8b 44 |.....D$.|.r..p..D|
|00000d30| 24 10 8b 0d 14 11 01 00 | 5f 5e 89 29 8b 15 14 11 |$.......|_^.)....|
|00000d40| 01 00 8b 4c 24 0c 89 5a | 0c 8b 15 14 11 01 00 89 |...L$..Z|........|
|00000d50| 4a 08 89 28 89 58 0c 89 | 48 08 5d c6 05 78 8d 02 |J..(.X..|H.]..x..|
|00000d60| 00 01 33 c0 5b 83 c4 08 | c3 55 ff 15 28 10 01 00 |..3.[...|.U..(...|
|00000d70| 5f 5e 5d c7 05 7c 8d 02 | 00 00 00 00 00 b8 9a 00 |_^]..|..|........|
|00000d80| 00 c0 5b 83 c4 08 c3 90 | 90 90 90 90 e8 bb fc ff |..[.....|........|
|00000d90| ff e8 66 f3 ff ff e8 21 | fe ff ff e8 cc f3 ff ff |..f....!|........|
|00000da0| e8 a7 f3 ff ff e8 52 f5 | ff ff e8 bd f4 ff ff e8 |......R.|........|
|00000db0| d8 f4 ff ff e9 13 f4 ff | ff 90 90 90 52 74 6c 53 |........|....RtlS|
|00000dc0| 65 74 4c 61 73 74 57 69 | 6e 33 32 45 72 72 6f 72 |etLastWi|n32Error|
|00000dd0| 00 00 00 00 52 74 6c 4f | 65 6d 54 6f 55 6e 69 63 |....RtlO|emToUnic|
|00000de0| 6f 64 65 4e 00 00 00 00 | 77 63 73 6c 65 6e 00 00 |odeN....|wcslen..|
|00000df0| 77 63 73 63 70 79 00 56 | be f7 ad 02 00 57 81 e6 |wcscpy.V|.....W..|
|00000e00| 00 f0 ff ff 81 fe 00 00 | 00 80 76 15 66 81 3e 4d |........|..v.f.>M|
|00000e10| 5a 74 13 81 ee 00 10 00 | 00 81 fe 00 00 00 80 77 |Zt......|.......w|
|00000e20| eb 5f 5e 32 c0 c3 8b 4e | 3c 03 ce 81 39 50 45 00 |._^2...N|<...9PE.|
|00000e30| 00 74 05 5f 5e 32 c0 c3 | 33 c0 33 ff 66 8b 41 14 |.t._^2..|3.3.f.A.|
|00000e40| 8d 54 08 18 33 c0 66 8b | 41 06 85 c0 76 12 b9 75 |.T..3.f.|A...v..u|
|00000e50| 73 65 72 39 4a 01 74 0d | 83 c2 28 47 3b f8 72 f3 |ser9J.t.|..(G;.r.|
|00000e60| 5f 5e 32 c0 c3 8b 42 0c | 03 c6 a3 84 50 02 00 8b |_^2...B.|....P...|
|00000e70| 4a 10 8b 15 18 11 01 00 | 03 c8 89 0d c0 51 02 00 |J.......|.....Q..|
|00000e80| 66 81 3a 93 08 7e 20 a1 | 68 4f 02 00 6a 00 68 bc |f.:..~ .|hO..j.h.|
|00000e90| ad 02 00 50 e8 22 87 fe | ff 85 c0 a3 3c 8d 02 00 |...P."..|....<...|
|00000ea0| 75 05 5f 5e 32 c0 c3 8b | 0d 68 4f 02 00 6a 00 68 |u._^2...|.hO..j.h|
|00000eb0| d4 ad 02 00 51 e8 01 87 | fe ff 85 c0 a3 68 8d 02 |....Q...|.....h..|
|00000ec0| 00 75 05 5f 5e 32 c0 c3 | 8b 15 68 4f 02 00 6a 00 |.u._^2..|..hO..j.|
|00000ed0| 68 e8 ad 02 00 52 e8 e0 | 86 fe ff 85 c0 a3 40 8d |h....R..|......@.|
|00000ee0| 02 00 75 05 5f 5e 32 c0 | c3 a1 68 4f 02 00 6a 00 |..u._^2.|..hO..j.|
|00000ef0| 68 f0 ad 02 00 50 e8 c0 | 86 fe ff 85 c0 a3 38 8d |h....P..|......8.|
|00000f00| 02 00 75 05 5f 5e 32 c0 | c3 b0 01 5f 5e a2 d1 4f |..u._^2.|..._^..O|
|00000f10| 02 00 c3 90 90 90 90 00 | 4e 74 51 75 65 72 79 44 |........|NtQueryD|
|00000f20| 69 72 65 63 74 6f 72 79 | 4f 62 6a 65 63 74 00 00 |irectory|Object..|
|00000f30| 4e 74 50 72 6f 74 65 63 | 74 56 69 72 74 75 61 6c |NtProtec|tVirtual|
|00000f40| 4d 65 6d 6f 72 79 00 00 | 4e 74 54 65 72 6d 69 6e |Memory..|NtTermin|
|00000f50| 61 74 65 50 72 6f 63 65 | 73 73 00 55 8b ec 6a ff |ateProce|ss.U..j.|
|00000f60| 68 38 2e 01 00 68 9c 3c | 02 00 64 a1 00 00 00 00 |h8...h.<|..d.....|
|00000f70| 50 64 89 25 00 00 00 00 | 83 ec 0c 53 56 57 89 65 |Pd.%....|...SVW.e|
|00000f80| e8 c7 45 fc 00 00 00 00 | 68 18 af 02 00 a1 68 4f |..E.....|h.....hO|
|00000f90| 02 00 50 e8 93 87 fe ff | 89 45 e4 85 c0 74 61 8b |..P.....|.E...ta.|
|00000fa0| 0d 14 11 01 00 8b 11 8b | 04 82 a3 f4 4f 02 00 68 |........|....O..h|
|00000fb0| 30 af 02 00 8b 0d 68 4f | 02 00 51 e8 6b 87 fe ff |0.....hO|..Q.k...|
|00000fc0| a3 18 51 02 00 85 c0 74 | 37 68 48 af 02 00 68 2a |..Q....t|7hH...h*|
|00000fd0| cc 01 00 68 f0 4f 02 00 | e8 9d 17 ff ff c7 45 fc |...h.O..|......E.|
|00000fe0| ff ff ff ff b0 01 8b 4d | f0 64 89 0d 00 00 00 00 |.......M|.d......|
|00000ff0| 5f 5e 5b 8b e5 5d c3 b8 | 01 00 00 00 c3 8b 65 e8 |_^[..]..|......e.|
|00001000| c7 45 fc ff ff ff ff 32 | c0 8b 4d f0 64 89 0d 00 |.E.....2|..M.d...|
|00001010| 00 00 00 5f 5e 5b 8b e5 | 5d c3 90 00 50 73 53 65 |..._^[..|]...PsSe|
|00001020| 74 4c 6f 61 64 49 6d 61 | 67 65 4e 6f 74 69 66 79 |tLoadIma|geNotify|
|00001030| 52 6f 75 74 69 6e 65 00 | 6a 00 68 ae 3a 02 00 e8 |Routine.|j.h.:...|
|00001040| 70 8d ff ff 68 de 3a 02 | 00 e8 60 8d ff ff a1 6c |p...h.:.|..`....l|
|00001050| 4f 02 00 6a 00 68 1c b0 | 02 00 50 e8 5b 85 fe ff |O..j.h..|..P.[...|
|00001060| 85 c0 a3 ec 4f 02 00 74 | 07 68 1e 3b 02 00 ff d0 |....O..t|.h.;....|
|00001070| c3 90 90 90 90 90 90 90 | 5c 00 44 00 65 00 76 00 |........|\.D.e.v.|
|00001080| 69 00 63 00 65 00 5c 00 | 4b 00 4c 00 49 00 46 00 |i.c.e.\.|K.L.I.F.|
|00001090| 00 00 00 00 5c 00 44 00 | 65 00 76 00 69 00 63 00 |....\.D.|e.v.i.c.|
|000010a0| 65 00 5c 00 41 00 56 00 | 50 00 47 00 00 00 00 00 |e.\.A.V.|P.G.....|
|000010b0| 4e 54 4f 53 4b 52 4e 4c | 2e 45 58 45 00 00 00 00 |NTOSKRNL|.EXE....|
|000010c0| 4e 54 44 4c 4c 2e 44 4c | 4c 00 00 00 53 79 73 74 |NTDLL.DL|L...Syst|
|000010d0| 65 6d 00 00 5c 00 50 00 | 61 00 72 00 61 00 6d 00 |em..\.P.|a.r.a.m.|
|000010e0| 65 00 74 00 65 00 72 00 | 73 00 00 00 49 00 6d 00 |e.t.e.r.|s...I.m.|
|000010f0| 61 00 67 00 65 00 50 00 | 61 00 74 00 68 00 00 00 |a.g.e.P.|a.t.h...|
|00001100| 5c 00 53 00 79 00 73 00 | 74 00 65 00 6d 00 52 00 |\.S.y.s.|t.e.m.R.|
|00001110| 6f 00 6f 00 74 00 5c 00 | 53 00 79 00 73 00 74 00 |o.o.t.\.|S.y.s.t.|
|00001120| 65 00 6d 00 33 00 32 00 | 5c 00 64 00 72 00 69 00 |e.m.3.2.|\.d.r.i.|
|00001130| 76 00 65 00 72 00 73 00 | 5c 00 00 00 5a 77 51 75 |v.e.r.s.|\...ZwQu|
|00001140| 65 72 79 49 6e 66 6f 72 | 6d 61 74 69 6f 6e 46 69 |eryInfor|mationFi|
|00001150| 6c 65 00 00 4b 4c 49 46 | 3a 20 44 72 69 76 65 72 |le..KLIF|: Driver|
|00001160| 45 6e 74 72 79 20 66 61 | 69 6c 20 28 4e 74 53 74 |Entry fa|il (NtSt|
|00001170| 61 74 75 73 3d 25 78 29 | 0a 00 81 ec 98 00 00 00 |atus=%x)|........|
|00001180| b9 06 00 00 00 8b 94 24 | 9c 00 00 00 a1 18 11 01 |.......$|........|
|00001190| 00 53 55 56 57 be 78 b0 | 02 00 8d bc 24 8c 00 00 |.SUVW.x.|....$...|
|000011a0| 00 f3 a5 66 a5 b9 06 00 | 00 00 be 94 b0 02 00 8d |...f....|........|
|000011b0| 7c 24 70 89 15 4c 4f 02 | 00 f3 a5 66 a5 66 81 38 ||$p..LO.|...f.f.8|
|000011c0| 65 05 7d 0a c7 05 70 4c | 02 00 38 00 00 00 8b 2d |e.}...pL|..8....-|
|000011d0| dc 10 01 00 8d 7a 38 b9 | 1c 00 00 00 b8 5e 3a 02 |.....z8.|.....^:.|
|000011e0| 00 f3 ab 8d 4c 24 10 68 | f0 4c 02 00 51 c7 42 28 |....L$.h|.L..Q.B(|
|000011f0| 70 4c 02 00 ff d5 8d 54 | 24 30 68 14 4d 02 00 52 |pL.....T|$0h.M..R|
|00001200| ff d5 68 b0 b0 02 00 e8 | f4 ed ff ff 68 c0 b0 02 |..h.....|....h...|
|00001210| 00 a3 6c 4f 02 00 e8 e5 | ed ff ff 33 db a3 68 4f |..lO....|...3..hO|
|00001220| 02 00 3b c3 0f 84 be 02 | 00 00 39 1d 6c 4f 02 00 |..;.....|..9.lO..|
|00001230| 0f 84 b2 02 00 00 3d 00 | 00 ff 7f 0f 83 a7 02 00 |......=.|........|
|00001240| 00 ff 15 0c 11 01 00 8b | 3d d8 11 01 00 a3 5c 4f |........|=.....\O|
|00001250| 02 00 33 f6 a1 5c 4f 02 | 00 6a 06 03 c6 50 68 cc |..3..\O.|.j...Ph.|
|00001260| b0 02 00 ff d7 83 c4 0c | 85 c0 74 0b 46 81 fe 00 |........|..t.F...|
|00001270| 30 00 00 72 df eb 06 89 | 35 58 4f 02 00 8d 4c 24 |0..r....|5XO...L$|
|00001280| 28 68 d4 b0 02 00 51 ff | d5 66 89 1d 80 51 02 00 |(h....Q.|.f...Q..|
|00001290| 33 d2 8b b4 24 b0 00 00 | 00 68 42 65 53 2d 66 8b |3...$...|.hBeS-f.|
|000012a0| 06 66 03 44 24 2c 83 c0 | 02 66 8b d0 66 a3 82 51 |.f.D$,..|.f..f..Q|
|000012b0| 02 00 52 6a 01 ff 15 2c | 10 01 00 8b f8 3b fb 89 |..Rj...,|.....;..|
|000012c0| 3d 84 51 02 00 75 0a be | 9a 00 00 c0 e9 1c 02 00 |=.Q..u..|........|
|000012d0| 00 33 c9 33 c0 66 8b 0d | 82 51 02 00 56 8b d1 68 |.3.3.f..|.Q..V..h|
|000012e0| 80 51 02 00 c1 e9 02 f3 | ab 8b ca 83 e1 03 f3 aa |.Q......|........|
|000012f0| 8b 3d 18 10 01 00 ff d7 | 8d 44 24 28 50 68 80 51 |.=......|.D$(Ph.Q|
|00001300| 02 00 ff d7 b9 0e 00 00 | 00 33 c0 8d 7c 24 38 66 |........|.3..|$8f|
|00001310| 89 1d 20 51 02 00 f3 ab | 66 89 1d 22 51 02 00 89 |.. Q....|f.."Q...|
|00001320| 1d 24 51 02 00 8b 56 04 | 53 8d 4c 24 3c 53 51 52 |.$Q...V.|S.L$<SQR|
|00001330| 68 00 00 00 80 c7 44 24 | 50 30 00 00 00 c7 44 24 |h.....D$|P0....D$|
|00001340| 54 ec b0 02 00 c7 44 24 | 58 20 51 02 00 c7 44 24 |T.....D$|X Q...D$|
|00001350| 5c 02 00 00 00 c7 44 24 | 60 00 b1 02 00 89 5c 24 |\.....D$|`.....\$|
|00001360| 64 ff 15 d4 11 01 00 8b | f0 3b f3 0f 8c 7c 01 00 |d.......|.;...|..|
|00001370| 00 a1 24 51 02 00 50 ff | 15 cc 10 01 00 8b 15 24 |..$Q..P.|.......$|
|00001380| 51 02 00 83 c4 04 3b c3 | 74 11 8d 0c 42 66 83 39 |Q.....;.|t...Bf.9|
|00001390| 5c 74 08 48 83 e9 02 3b | c3 75 f2 66 89 5c 42 02 |\t.H...;|.u.f.\B.|
|000013a0| 8d 8c 24 8c 00 00 00 8d | 54 24 20 51 52 66 a3 20 |..$.....|T$ QRf. |
|000013b0| 51 02 00 ff d5 8b 3d 78 | 11 01 00 68 50 4f 02 00 |Q.....=x|...hPO..|
|000013c0| 8b 8c 24 b0 00 00 00 53 | 53 8d 44 24 2c 68 00 90 |..$....S|S.D$,h..|
|000013d0| 00 00 50 53 51 ff d7 8b | f0 3b f3 0f 8c 0c 01 00 |..PSQ...|.;......|
|000013e0| 00 8b 2d d0 11 01 00 8d | 54 24 20 8d 44 24 10 52 |..-.....|T$ .D$.R|
|000013f0| 50 ff d5 8b f0 3b f3 0f | 8c f0 00 00 00 8d 4c 24 |P....;..|......L$|
|00001400| 70 8d 54 24 18 51 52 ff | 15 dc 10 01 00 e8 49 fb |p.T$.QR.|......I.|
|00001410| ff ff 84 c0 75 0a be 01 | 00 00 c0 e9 cd 00 00 00 |....u...|........|
|00001420| e8 90 21 ff ff e8 62 f9 | ff ff 8b f0 3b f3 0f 8c |..!...b.|....;...|
|00001430| b9 00 00 00 e8 be f9 ff | ff a1 18 11 01 00 66 81 |........|......f.|
|00001440| 38 65 05 7e 13 8b 8c 24 | ac 00 00 00 68 28 f7 01 |8e.~...$|....h(..|
|00001450| 00 51 ff 15 cc 11 01 00 | 38 1d c4 4f 02 00 74 2c |.Q......|8..O..t,|
|00001460| 8b 84 24 ac 00 00 00 68 | 54 4f 02 00 53 53 8d 54 |..$....h|TO..SS.T|
|00001470| 24 24 68 00 90 00 00 52 | 53 50 ff d7 85 c0 7c 0c |$$h....R|SP....|.|
|00001480| 8d 4c 24 18 8d 54 24 30 | 51 52 ff d5 68 3c b1 02 |.L$..T$0|QR..h<..|
|00001490| 00 68 7a d2 01 00 68 88 | 50 02 00 e8 da 12 ff ff |.hz...h.|P.......|
|000014a0| a1 50 4f 02 00 50 ff 15 | c8 11 01 00 e8 87 fb ff |.PO..P..|........|
|000014b0| ff a1 50 4f 02 00 b9 7f | ff ff ff 8b 70 1c 23 f1 |..PO....|....p.#.|
|000014c0| 89 70 1c a1 54 4f 02 00 | 3b c3 74 03 21 48 1c e8 |.p..TO..|;.t.!H..|
|000014d0| 92 ee ff ff e8 8f 42 ff | ff 5f 5e 5d 33 c0 5b 81 |......B.|._^]3.[.|
|000014e0| c4 98 00 00 00 c2 08 00 | be 05 00 00 c0 56 68 54 |........|.....VhT|
|000014f0| b1 02 00 e8 c2 88 ff ff | 83 c4 08 8d 4c 24 10 51 |........|....L$.Q|
|00001500| ff 15 c0 11 01 00 a1 50 | 4f 02 00 8b 3d 70 11 01 |.......P|O...=p..|
|00001510| 00 3b c3 74 03 50 ff d7 | a1 54 4f 02 00 3b c3 74 |.;.t.P..|.TO..;.t|
|00001520| 03 50 ff d7 8b 0d b0 4f | 02 00 3b cb 74 06 ff 15 |.P.....O|..;.t...|
|00001530| 68 10 01 00 a1 84 51 02 | 00 3b c3 74 07 50 ff 15 |h.....Q.|.;.t.P..|
|00001540| 28 10 01 00 8b c6 5f 5e | 5d 5b 81 c4 98 00 00 00 |(....._^|][......|
|00001550| c2 08 00 90 90 90 90 90 | 90 90 cc cc a8 b5 01 00 |........|........|
|00001560| 00 00 00 00 00 00 00 00 | 9a c1 01 00 10 10 00 00 |........|........|
|00001570| 98 b5 01 00 00 00 00 00 | 00 00 00 00 f4 c1 01 00 |........|........|
|00001580| 00 10 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001590| 00 00 00 00 00 00 00 00 | ca c1 01 00 b4 c1 01 00 |........|........|
|000015a0| e0 c1 01 00 00 00 00 00 | d2 b7 01 00 ea b7 01 00 |........|........|
|000015b0| 0a b8 01 00 2c b8 01 00 | 4c b8 01 00 60 b8 01 00 |....,...|L...`...|
|000015c0| 6a b8 01 00 78 b8 01 00 | 90 b8 01 00 ac b8 01 00 |j...x...|........|
|000015d0| c4 b8 01 00 d0 b8 01 00 | ec b8 01 00 fc b8 01 00 |........|........|
|000015e0| 0e b9 01 00 2a b9 01 00 | 3a b9 01 00 48 b9 01 00 |....*...|:...H...|
|000015f0| 62 b9 01 00 78 b9 01 00 | 8c b9 01 00 a4 b9 01 00 |b...x...|........|
|00001600| ba b9 01 00 d2 b9 01 00 | e0 b9 01 00 fa b9 01 00 |........|........|
|00001610| 12 ba 01 00 2a ba 01 00 | 48 ba 01 00 60 ba 01 00 |....*...|H...`...|
|00001620| 82 ba 01 00 9a ba 01 00 | b2 ba 01 00 ca ba 01 00 |........|........|
|00001630| d4 ba 01 00 e4 ba 01 00 | f2 ba 01 00 08 bb 01 00 |........|........|
|00001640| 22 bb 01 00 3a bb 01 00 | 48 bb 01 00 62 bb 01 00 |"...:...|H...b...|
|00001650| 7a bb 01 00 96 bb 01 00 | ae bb 01 00 c2 bb 01 00 |z.......|........|
|00001660| da bb 01 00 f4 bb 01 00 | fe bb 01 00 0a bc 01 00 |........|........|
|00001670| 18 bc 01 00 28 bc 01 00 | 40 bc 01 00 5c bc 01 00 |....(...|@...\...|
|00001680| 6a bc 01 00 7c bc 01 00 | 98 bc 01 00 aa bc 01 00 |j...|...|........|
|00001690| be b7 01 00 ce bc 01 00 | ea bc 01 00 04 bd 01 00 |........|........|
|000016a0| 1a bd 01 00 30 bd 01 00 | 46 bd 01 00 5c bd 01 00 |....0...|F...\...|
|000016b0| 78 bd 01 00 88 bd 01 00 | 9c bd 01 00 b6 bd 01 00 |x.......|........|
|000016c0| ca bd 01 00 dc bd 01 00 | e8 bd 01 00 f2 bd 01 00 |........|........|
|000016d0| fc bd 01 00 10 be 01 00 | 1a be 01 00 32 be 01 00 |........|....2...|
|000016e0| 48 be 01 00 52 be 01 00 | 6a be 01 00 7e be 01 00 |H...R...|j...~...|
|000016f0| 9e be 01 00 b2 be 01 00 | be be 01 00 ce be 01 00 |........|........|
|00001700| de be 01 00 fa be 01 00 | 16 bf 01 00 28 bf 01 00 |........|....(...|
|00001710| 46 bf 01 00 58 bf 01 00 | 6a bf 01 00 88 bf 01 00 |F...X...|j.......|
|00001720| 9e bf 01 00 ba bf 01 00 | c4 bf 01 00 de bf 01 00 |........|........|
|00001730| f4 bf 01 00 14 c0 01 00 | 34 c0 01 00 46 c0 01 00 |........|4...F...|
|00001740| 62 c0 01 00 70 c0 01 00 | 7c c0 01 00 9e c0 01 00 |b...p...||.......|
|00001750| b2 c0 01 00 d4 c0 01 00 | f6 c0 01 00 0e c1 01 00 |........|........|
|00001760| 1a c1 01 00 3c c1 01 00 | 5e c1 01 00 76 c1 01 00 |....<...|^...v...|
|00001770| 90 c1 01 00 a8 c1 01 00 | a6 b7 01 00 96 b7 01 00 |........|........|
|00001780| b6 bc 01 00 8c b7 01 00 | 00 00 00 00 d2 03 73 70 |........|......sp|
|00001790| 72 69 6e 74 66 00 21 03 | 52 74 6c 55 70 70 65 72 |rintf.!.|RtlUpper|
|000017a0| 43 68 61 72 00 00 19 03 | 52 74 6c 55 70 63 61 73 |Char....|RtlUpcas|
|000017b0| 65 55 6e 69 63 6f 64 65 | 43 68 61 72 00 00 86 01 |eUnicode|Char....|
|000017c0| 4b 65 51 75 65 72 79 53 | 79 73 74 65 6d 54 69 6d |KeQueryS|ystemTim|
|000017d0| 65 00 c3 02 52 74 6c 46 | 72 65 65 55 6e 69 63 6f |e...RtlF|reeUnico|
|000017e0| 64 65 53 74 72 69 6e 67 | 00 00 f8 00 49 6f 43 72 |deString|....IoCr|
|000017f0| 65 61 74 65 53 79 6e 63 | 68 72 6f 6e 69 7a 61 74 |eateSync|hronizat|
|00001800| 69 6f 6e 45 76 65 6e 74 | 00 00 7a 02 52 74 6c 41 |ionEvent|..z.RtlA|
|00001810| 70 70 65 6e 64 55 6e 69 | 63 6f 64 65 53 74 72 69 |ppendUni|codeStri|
|00001820| 6e 67 54 6f 53 74 72 69 | 6e 67 00 00 77 02 52 74 |ngToStri|ng..w.Rt|
|00001830| 6c 41 6e 73 69 53 74 72 | 69 6e 67 54 6f 55 6e 69 |lAnsiStr|ingToUni|
|00001840| 63 6f 64 65 53 74 72 69 | 6e 67 00 00 cd 02 52 74 |codeStri|ng....Rt|
|00001850| 6c 49 6e 69 74 41 6e 73 | 69 53 74 72 69 6e 67 00 |lInitAns|iString.|
|00001860| 5b 03 5a 77 43 6c 6f 73 | 65 00 42 00 45 78 46 72 |[.ZwClos|e.B.ExFr|
|00001870| 65 65 50 6f 6f 6c 00 00 | 36 00 45 78 41 6c 6c 6f |eePool..|6.ExAllo|
|00001880| 63 61 74 65 50 6f 6f 6c | 57 69 74 68 54 61 67 00 |catePool|WithTag.|
|00001890| 4a 00 45 78 49 6e 69 74 | 69 61 6c 69 7a 65 52 65 |J.ExInit|ializeRe|
|000018a0| 73 6f 75 72 63 65 4c 69 | 74 65 00 00 3c 00 45 78 |sourceLi|te..<.Ex|
|000018b0| 44 65 6c 65 74 65 52 65 | 73 6f 75 72 63 65 4c 69 |DeleteRe|sourceLi|
|000018c0| 74 65 00 00 b4 03 5f 73 | 74 72 69 63 6d 70 00 00 |te...._s|tricmp..|
|000018d0| 8b 03 5a 77 51 75 65 72 | 79 53 79 73 74 65 6d 49 |..ZwQuer|ySystemI|
|000018e0| 6e 66 6f 72 6d 61 74 69 | 6f 6e 00 00 e6 01 4d 6d |nformati|on....Mm|
|000018f0| 4d 61 70 49 6f 53 70 61 | 63 65 00 00 f7 01 4d 6d |MapIoSpa|ce....Mm|
|00001900| 55 6e 6d 61 70 49 6f 53 | 70 61 63 65 00 00 84 03 |UnmapIoS|pace....|
|00001910| 5a 77 51 75 65 72 79 49 | 6e 66 6f 72 6d 61 74 69 |ZwQueryI|nformati|
|00001920| 6f 6e 50 72 6f 63 65 73 | 73 00 e3 02 52 74 6c 4c |onProces|s...RtlL|
|00001930| 65 6e 67 74 68 53 69 64 | 00 00 90 02 52 74 6c 43 |engthSid|....RtlC|
|00001940| 6f 70 79 53 69 64 00 00 | 85 03 5a 77 51 75 65 72 |opySid..|..ZwQuer|
|00001950| 79 49 6e 66 6f 72 6d 61 | 74 69 6f 6e 54 6f 6b 65 |yInforma|tionToke|
|00001960| 6e 00 7b 03 5a 77 4f 70 | 65 6e 50 72 6f 63 65 73 |n.{.ZwOp|enProces|
|00001970| 73 54 6f 6b 65 6e 00 00 | 7f 03 5a 77 4f 70 65 6e |sToken..|..ZwOpen|
|00001980| 54 68 72 65 61 64 54 6f | 6b 65 6e 00 5a 02 50 73 |ThreadTo|ken.Z.Ps|
|00001990| 49 73 54 68 72 65 61 64 | 54 65 72 6d 69 6e 61 74 |IsThread|Terminat|
|000019a0| 69 6e 67 00 60 01 4b 65 | 47 65 74 43 75 72 72 65 |ing.`.Ke|GetCurre|
|000019b0| 6e 74 54 68 72 65 61 64 | 00 00 44 02 4f 62 66 44 |ntThread|..D.ObfD|
|000019c0| 65 72 65 66 65 72 65 6e | 63 65 4f 62 6a 65 63 74 |ereferen|ceObject|
|000019d0| 00 00 4d 03 53 65 54 6f | 6b 65 6e 54 79 70 65 00 |..M.SeTo|kenType.|
|000019e0| 35 03 53 65 43 72 65 61 | 74 65 43 6c 69 65 6e 74 |5.SeCrea|teClient|
|000019f0| 53 65 63 75 72 69 74 79 | 00 00 80 01 4b 65 4c 65 |Security|....KeLe|
|00001a00| 61 76 65 43 72 69 74 69 | 63 61 6c 52 65 67 69 6f |aveCriti|calRegio|
|00001a10| 6e 00 6d 00 45 78 52 65 | 6c 65 61 73 65 52 65 73 |n.m.ExRe|leaseRes|
|00001a20| 6f 75 72 63 65 4c 69 74 | 65 00 2f 00 45 78 41 63 |ourceLit|e./.ExAc|
|00001a30| 71 75 69 72 65 52 65 73 | 6f 75 72 63 65 53 68 61 |quireRes|ourceSha|
|00001a40| 72 65 64 4c 69 74 65 00 | 5b 01 4b 65 45 6e 74 65 |redLite.|[.KeEnte|
|00001a50| 72 43 72 69 74 69 63 61 | 6c 52 65 67 69 6f 6e 00 |rCritica|lRegion.|
|00001a60| 2e 00 45 78 41 63 71 75 | 69 72 65 52 65 73 6f 75 |..ExAcqu|ireResou|
|00001a70| 72 63 65 45 78 63 6c 75 | 73 69 76 65 4c 69 74 65 |rceExclu|siveLite|
|00001a80| 00 00 55 02 50 73 47 65 | 74 43 75 72 72 65 6e 74 |..U.PsGe|tCurrent|
|00001a90| 54 68 72 65 61 64 49 64 | 00 00 d9 00 49 6e 74 65 |ThreadId|....Inte|
|00001aa0| 72 6c 6f 63 6b 65 64 49 | 6e 63 72 65 6d 65 6e 74 |rlockedI|ncrement|
|00001ab0| 00 00 54 02 50 73 47 65 | 74 43 75 72 72 65 6e 74 |..T.PsGe|tCurrent|
|00001ac0| 50 72 6f 63 65 73 73 49 | 64 00 db 03 73 74 72 6e |ProcessI|d...strn|
|00001ad0| 63 70 79 00 60 03 5a 77 | 43 72 65 61 74 65 46 69 |cpy.`.Zw|CreateFi|
|00001ae0| 6c 65 00 00 a2 01 4b 65 | 53 65 74 45 76 65 6e 74 |le....Ke|SetEvent|
|00001af0| 00 00 0d 03 52 74 6c 54 | 69 6d 65 54 6f 54 69 6d |....RtlT|imeToTim|
|00001b00| 65 46 69 65 6c 64 73 00 | 70 00 45 78 53 79 73 74 |eFields.|p.ExSyst|
|00001b10| 65 6d 54 69 6d 65 54 6f | 4c 6f 63 61 6c 54 69 6d |emTimeTo|LocalTim|
|00001b20| 65 00 95 03 5a 77 53 65 | 74 49 6e 66 6f 72 6d 61 |e...ZwSe|tInforma|
|00001b30| 74 69 6f 6e 46 69 6c 65 | 00 00 a2 03 5a 77 57 72 |tionFile|....ZwWr|
|00001b40| 69 74 65 46 69 6c 65 00 | 67 02 50 73 54 65 72 6d |iteFile.|g.PsTerm|
|00001b50| 69 6e 61 74 65 53 79 73 | 74 65 6d 54 68 72 65 61 |inateSys|temThrea|
|00001b60| 64 00 b8 01 4b 65 57 61 | 69 74 46 6f 72 53 69 6e |d...KeWa|itForSin|
|00001b70| 67 6c 65 4f 62 6a 65 63 | 74 00 3f 02 4f 62 52 65 |gleObjec|t.?.ObRe|
|00001b80| 66 65 72 65 6e 63 65 4f | 62 6a 65 63 74 42 79 48 |ferenceO|bjectByH|
|00001b90| 61 6e 64 6c 65 00 51 02 | 50 73 43 72 65 61 74 65 |andle.Q.|PsCreate|
|00001ba0| 53 79 73 74 65 6d 54 68 | 72 65 61 64 00 00 70 01 |SystemTh|read..p.|
|00001bb0| 4b 65 49 6e 69 74 69 61 | 6c 69 7a 65 45 76 65 6e |KeInitia|lizeEven|
|00001bc0| 74 00 d6 00 49 6e 74 65 | 72 6c 6f 63 6b 65 64 44 |t...Inte|rlockedD|
|00001bd0| 65 63 72 65 6d 65 6e 74 | 00 00 57 01 4b 65 44 65 |ecrement|..W.KeDe|
|00001be0| 6c 61 79 45 78 65 63 75 | 74 69 6f 6e 54 68 72 65 |layExecu|tionThre|
|00001bf0| 61 64 00 00 ea 03 77 63 | 73 6c 65 6e 00 00 df 03 |ad....wc|slen....|
|00001c00| 73 77 70 72 69 6e 74 66 | 00 00 65 03 5a 77 44 65 |swprintf|..e.ZwDe|
|00001c10| 6c 65 74 65 4b 65 79 00 | 9b 03 5a 77 53 65 74 56 |leteKey.|..ZwSetV|
|00001c20| 61 6c 75 65 4b 65 79 00 | d0 02 52 74 6c 49 6e 69 |alueKey.|..RtlIni|
|00001c30| 74 55 6e 69 63 6f 64 65 | 53 74 72 69 6e 67 00 00 |tUnicode|String..|
|00001c40| d8 02 52 74 6c 49 6e 74 | 65 67 65 72 54 6f 55 6e |..RtlInt|egerToUn|
|00001c50| 69 63 6f 64 65 53 74 72 | 69 6e 67 00 61 03 5a 77 |icodeStr|ing.a.Zw|
|00001c60| 43 72 65 61 74 65 4b 65 | 79 00 8c 03 5a 77 51 75 |CreateKe|y...ZwQu|
|00001c70| 65 72 79 56 61 6c 75 65 | 4b 65 79 00 11 03 52 74 |eryValue|Key...Rt|
|00001c80| 6c 55 6e 69 63 6f 64 65 | 53 74 72 69 6e 67 54 6f |lUnicode|StringTo|
|00001c90| 49 6e 74 65 67 65 72 00 | 6b 03 5a 77 45 6e 75 6d |Integer.|k.ZwEnum|
|00001ca0| 65 72 61 74 65 4b 65 79 | 00 00 79 03 5a 77 4f 70 |erateKey|..y.ZwOp|
|00001cb0| 65 6e 4b 65 79 00 dc 01 | 4d 6d 46 72 65 65 4e 6f |enKey...|MmFreeNo|
|00001cc0| 6e 43 61 63 68 65 64 4d | 65 6d 6f 72 79 00 d2 01 |nCachedM|emory...|
|00001cd0| 4d 6d 41 6c 6c 6f 63 61 | 74 65 4e 6f 6e 43 61 63 |MmAlloca|teNonCac|
|00001ce0| 68 65 64 4d 65 6d 6f 72 | 79 00 59 03 5a 77 41 6c |hedMemor|y.Y.ZwAl|
|00001cf0| 6c 6f 63 61 74 65 56 69 | 72 74 75 61 6c 4d 65 6d |locateVi|rtualMem|
|00001d00| 6f 72 79 00 6f 03 5a 77 | 46 72 65 65 56 69 72 74 |ory.o.Zw|FreeVirt|
|00001d10| 75 61 6c 4d 65 6d 6f 72 | 79 00 82 01 4b 65 4e 75 |ualMemor|y...KeNu|
|00001d20| 6d 62 65 72 50 72 6f 63 | 65 73 73 6f 72 73 00 00 |mberProc|essors..|
|00001d30| 0c 01 49 6f 47 65 74 43 | 75 72 72 65 6e 74 50 72 |..IoGetC|urrentPr|
|00001d40| 6f 63 65 73 73 00 9f 01 | 4b 65 53 65 74 41 66 66 |ocess...|KeSetAff|
|00001d50| 69 6e 69 74 79 54 68 72 | 65 61 64 00 9e 01 4b 65 |inityThr|ead...Ke|
|00001d60| 53 65 72 76 69 63 65 44 | 65 73 63 72 69 70 74 6f |ServiceD|escripto|
|00001d70| 72 54 61 62 6c 65 00 00 | 07 02 4e 74 42 75 69 6c |rTable..|..NtBuil|
|00001d80| 64 4e 75 6d 62 65 72 00 | df 01 4d 6d 49 73 41 64 |dNumber.|..MmIsAd|
|00001d90| 64 72 65 73 73 56 61 6c | 69 64 00 00 4e 01 4b 65 |dressVal|id..N.Ke|
|00001da0| 41 64 64 53 79 73 74 65 | 6d 53 65 72 76 69 63 65 |AddSyste|mService|
|00001db0| 54 61 62 6c 65 00 7d 01 | 4b 65 49 6e 73 65 72 74 |Table.}.|KeInsert|
|00001dc0| 51 75 65 75 65 41 70 63 | 00 00 6d 01 4b 65 49 6e |QueueApc|..m.KeIn|
|00001dd0| 69 74 69 61 6c 69 7a 65 | 41 70 63 00 bc 03 5f 77 |itialize|Apc..._w|
|00001de0| 63 73 69 63 6d 70 00 00 | e5 03 77 63 73 63 61 74 |csicmp..|..wcscat|
|00001df0| 00 00 e8 03 77 63 73 63 | 70 79 00 00 45 00 45 78 |....wcsc|py..E.Ex|
|00001e00| 47 65 74 50 72 65 76 69 | 6f 75 73 4d 6f 64 65 00 |GetPrevi|ousMode.|
|00001e10| ce 03 6d 65 6d 6d 6f 76 | 65 00 12 01 49 6f 47 65 |..memmov|e...IoGe|
|00001e20| 74 52 65 71 75 65 73 74 | 6f 72 50 72 6f 63 65 73 |tRequest|orProces|
|00001e30| 73 00 3b 02 4f 62 4f 70 | 65 6e 4f 62 6a 65 63 74 |s.;.ObOp|enObject|
|00001e40| 42 79 4e 61 6d 65 00 00 | ec 03 77 63 73 6e 63 6d |ByName..|..wcsncm|
|00001e50| 70 00 76 03 5a 77 4f 70 | 65 6e 44 69 72 65 63 74 |p.v.ZwOp|enDirect|
|00001e60| 6f 72 79 4f 62 6a 65 63 | 74 00 c0 02 52 74 6c 46 |oryObjec|t...RtlF|
|00001e70| 72 65 65 41 6e 73 69 53 | 74 72 69 6e 67 00 0f 03 |reeAnsiS|tring...|
|00001e80| 52 74 6c 55 6e 69 63 6f | 64 65 53 74 72 69 6e 67 |RtlUnico|deString|
|00001e90| 54 6f 41 6e 73 69 53 74 | 72 69 6e 67 00 00 3d 02 |ToAnsiSt|ring..=.|
|00001ea0| 4f 62 51 75 65 72 79 4e | 61 6d 65 53 74 72 69 6e |ObQueryN|ameStrin|
|00001eb0| 67 00 07 01 49 6f 46 72 | 65 65 49 72 70 00 44 01 |g...IoFr|eeIrp.D.|
|00001ec0| 49 6f 66 43 61 6c 6c 44 | 72 69 76 65 72 00 e0 00 |IofCallD|river...|
|00001ed0| 49 6f 41 6c 6c 6f 63 61 | 74 65 49 72 70 00 8a 03 |IoAlloca|teIrp...|
|00001ee0| 5a 77 51 75 65 72 79 53 | 79 6d 62 6f 6c 69 63 4c |ZwQueryS|ymbolicL|
|00001ef0| 69 6e 6b 4f 62 6a 65 63 | 74 00 7d 03 5a 77 4f 70 |inkObjec|t.}.ZwOp|
|00001f00| 65 6e 53 79 6d 62 6f 6c | 69 63 4c 69 6e 6b 4f 62 |enSymbol|icLinkOb|
|00001f10| 6a 65 63 74 00 00 fb 00 | 49 6f 44 65 6c 65 74 65 |ject....|IoDelete|
|00001f20| 44 65 76 69 63 65 00 00 | e5 00 49 6f 41 74 74 61 |Device..|..IoAtta|
|00001f30| 63 68 44 65 76 69 63 65 | 54 6f 44 65 76 69 63 65 |chDevice|ToDevice|
|00001f40| 53 74 61 63 6b 00 f3 00 | 49 6f 43 72 65 61 74 65 |Stack...|IoCreate|
|00001f50| 44 65 76 69 63 65 00 00 | fd 00 49 6f 44 65 74 61 |Device..|..IoDeta|
|00001f60| 63 68 44 65 76 69 63 65 | 00 00 41 02 4f 62 52 65 |chDevice|..A.ObRe|
|00001f70| 66 65 72 65 6e 63 65 4f | 62 6a 65 63 74 42 79 50 |ferenceO|bjectByP|
|00001f80| 6f 69 6e 74 65 72 00 00 | 45 01 49 6f 66 43 6f 6d |ointer..|E.IofCom|
|00001f90| 70 6c 65 74 65 52 65 71 | 75 65 73 74 00 00 17 01 |pleteReq|uest....|
|00001fa0| 49 6f 49 73 4f 70 65 72 | 61 74 69 6f 6e 53 79 6e |IoIsOper|ationSyn|
|00001fb0| 63 68 72 6f 6e 6f 75 73 | 00 00 ee 03 77 63 73 72 |chronous|....wcsr|
|00001fc0| 63 68 72 00 89 02 52 74 | 6c 43 6f 6d 70 61 72 65 |chr...Rt|lCompare|
|00001fd0| 55 6e 69 63 6f 64 65 53 | 74 72 69 6e 67 00 00 01 |UnicodeS|tring...|
|00001fe0| 49 6f 44 65 76 69 63 65 | 4f 62 6a 65 63 74 54 79 |IoDevice|ObjectTy|
|00001ff0| 70 65 00 00 e9 00 49 6f | 42 75 69 6c 64 53 79 6e |pe....Io|BuildSyn|
|00002000| 63 68 72 6f 6e 6f 75 73 | 46 73 64 52 65 71 75 65 |chronous|FsdReque|
|00002010| 73 74 00 00 e7 00 49 6f | 42 75 69 6c 64 44 65 76 |st....Io|BuildDev|
|00002020| 69 63 65 49 6f 43 6f 6e | 74 72 6f 6c 52 65 71 75 |iceIoCon|trolRequ|
|00002030| 65 73 74 00 40 01 49 6f | 56 65 72 69 66 79 56 6f |est.@.Io|VerifyVo|
|00002040| 6c 75 6d 65 00 00 11 01 | 49 6f 47 65 74 52 65 6c |lume....|IoGetRel|
|00002050| 61 74 65 64 44 65 76 69 | 63 65 4f 62 6a 65 63 74 |atedDevi|ceObject|
|00002060| 00 00 23 00 43 63 55 6e | 70 69 6e 44 61 74 61 00 |..#.CcUn|pinData.|
|00002070| 10 00 43 63 4d 61 70 44 | 61 74 61 00 1b 00 43 63 |..CcMapD|ata...Cc|
|00002080| 53 65 74 41 64 64 69 74 | 69 6f 6e 61 6c 43 61 63 |SetAddit|ionalCac|
|00002090| 68 65 41 74 74 72 69 62 | 75 74 65 73 00 00 e7 01 |heAttrib|utes....|
|000020a0| 4d 6d 4d 61 70 4c 6f 63 | 6b 65 64 50 61 67 65 73 |MmMapLoc|kedPages|
|000020b0| 00 00 64 02 50 73 53 65 | 74 43 72 65 61 74 65 54 |..d.PsSe|tCreateT|
|000020c0| 68 72 65 61 64 4e 6f 74 | 69 66 79 52 6f 75 74 69 |hreadNot|ifyRouti|
|000020d0| 6e 65 00 00 63 02 50 73 | 53 65 74 43 72 65 61 74 |ne..c.Ps|SetCreat|
|000020e0| 65 50 72 6f 63 65 73 73 | 4e 6f 74 69 66 79 52 6f |eProcess|NotifyRo|
|000020f0| 75 74 69 6e 65 00 fc 00 | 49 6f 44 65 6c 65 74 65 |utine...|IoDelete|
|00002100| 53 79 6d 62 6f 6c 69 63 | 4c 69 6e 6b 00 00 2a 00 |Symbolic|Link..*.|
|00002110| 44 62 67 50 72 69 6e 74 | 00 00 28 01 49 6f 52 65 |DbgPrint|..(.IoRe|
|00002120| 67 69 73 74 65 72 53 68 | 75 74 64 6f 77 6e 4e 6f |gisterSh|utdownNo|
|00002130| 74 69 66 69 63 61 74 69 | 6f 6e 00 00 27 01 49 6f |tificati|on..'.Io|
|00002140| 52 65 67 69 73 74 65 72 | 46 73 52 65 67 69 73 74 |Register|FsRegist|
|00002150| 72 61 74 69 6f 6e 43 68 | 61 6e 67 65 00 00 f7 00 |rationCh|ange....|
|00002160| 49 6f 43 72 65 61 74 65 | 53 79 6d 62 6f 6c 69 63 |IoCreate|Symbolic|
|00002170| 4c 69 6e 6b 00 00 f8 02 | 52 74 6c 51 75 65 72 79 |Link....|RtlQuery|
|00002180| 52 65 67 69 73 74 72 79 | 56 61 6c 75 65 73 00 00 |Registry|Values..|
|00002190| da 03 73 74 72 6e 63 6d | 70 00 6e 74 6f 73 6b 72 |..strncm|p.ntoskr|
|000021a0| 6e 6c 2e 65 78 65 00 00 | 18 03 52 74 6c 55 6e 77 |nl.exe..|..RtlUnw|
|000021b0| 69 6e 64 00 01 00 45 78 | 52 65 6c 65 61 73 65 46 |ind...Ex|ReleaseF|
|000021c0| 61 73 74 4d 75 74 65 78 | 00 00 00 00 45 78 41 63 |astMutex|....ExAc|
|000021d0| 71 75 69 72 65 46 61 73 | 74 4d 75 74 65 78 00 00 |quireFas|tMutex..|
|000021e0| 42 00 4b 65 47 65 74 43 | 75 72 72 65 6e 74 49 72 |B.KeGetC|urrentIr|
|000021f0| 71 6c 00 00 48 41 4c 2e | 64 6c 6c 00 00 00 00 00 |ql..HAL.|dll.....|
+--------+-------------------------+-------------------------+--------+--------+