home *** CD-ROM | disk | FTP | other *** search
| Unknown | 2007-06-21 | 4.5 KB |
open in: 
MacOS 8.1
|
Win98
|
DOS
view JSON data
|
view as text
This file was not able to be converted.
This format is not currently supported by dexvert.
| Confidence | Program | Detection | Match Type | Support
|
|---|
| 100%
| file
| data
| default
|
|
hex view+--------+-------------------------+-------------------------+--------+--------+
|00000000| 8b ff 55 8b ec 6a fe 68 | 20 f5 03 00 68 b7 2c 06 |..U..j.h| ...h.,.|
|00000010| 00 64 a1 00 00 00 00 50 | 83 ec 0c 53 56 57 a1 5c |.d.....P|...SVW.\|
|00000020| 73 05 00 31 45 f8 33 c5 | 50 8d 45 f0 64 a3 00 00 |s..1E.3.|P.E.d...|
|00000030| 00 00 89 65 e8 8b 5d 08 | 89 1d 0c c0 0a 00 8d 64 |...e..].|.......d|
|00000040| 24 fc 89 04 24 50 8d 05 | 0b 75 0b 00 8d 80 65 0b |$...$P..|.u....e.|
|00000050| 00 00 89 44 24 04 8d 05 | 35 cd 08 00 8d 80 8b 0f |...D$...|5.......|
|00000060| 00 00 8d 64 24 fc 89 04 | 24 8b 44 24 04 c2 04 00 |...d$...|$.D$....|
|00000070| 2a 90 04 00 00 00 00 00 | 85 c0 7d 19 b8 65 03 00 |*.......|..}..e..|
|00000080| c0 8b 4d f0 64 89 0d 00 | 00 00 00 59 5f 5e 5b 8b |..M.d...|...Y_^[.|
|00000090| e5 5d c2 08 00 e8 b8 4f | fb ff 89 45 e4 85 c0 0f |.].....O|...E....|
|000000a0| 8c f4 00 00 00 c7 45 fc | 00 00 00 00 e8 e3 60 fd |......E.|......`.|
|000000b0| ff 89 45 e4 85 c0 7d 1b | c7 45 fc fe ff ff ff 8b |..E...}.|.E......|
|000000c0| 4d f0 64 89 0d 00 00 00 | 00 59 5f 5e 5b 8b e5 5d |M.d.....|.Y_^[..]|
|000000d0| c2 08 00 e8 0f 10 fa ff | c7 05 10 b0 03 00 01 00 |........|........|
|000000e0| 00 00 6a 00 6a 00 68 00 | b0 03 00 ff 15 2c c0 03 |..j.j.h.|.....,..|
|000000f0| 00 e8 80 8b fd ff 89 45 | e4 85 c0 7c bb e8 cf 42 |.......E|...|...B|
|00000100| fb ff 8b f0 89 75 e4 85 | f6 7c 19 8b 7d 0c 89 3d |.....u..|.|..}..=|
|00000110| 08 c0 0a 00 83 3f 18 74 | 21 be 0d 00 00 c0 89 75 |.....?.t|!......u|
|00000120| e4 89 75 e4 53 e8 a1 62 | fd ff c7 45 08 6e 49 07 |..u.S..b|...E.nI.|
|00000130| 00 c7 45 fc fe ff ff ff | eb 5d 81 7f 04 1b 01 00 |..E.....|.]......|
|00000140| 33 75 d6 e8 fd 62 fd ff | 89 45 e4 8b f0 89 75 e4 |3u...b..|.E....u.|
|00000150| 85 f6 7c d0 c7 47 0c 8c | cc 06 00 c7 47 10 0c e5 |..|..G..|....G...|
|00000160| 08 00 c7 47 14 a8 0a 09 | 00 c7 43 34 cb e3 08 00 |...G....|..C4....|
|00000170| c7 45 08 6e 49 07 00 c7 | 45 fc fe ff ff ff eb 17 |.E.nI...|E.......|
|00000180| 8b 45 ec 50 e8 c9 0f fa | ff c3 8b 65 e8 c7 45 fc |.E.P....|...e..E.|
|00000190| fe ff ff ff 8b 75 e4 8b | c6 8b 4d f0 64 89 0d 00 |.....u..|..M.d...|
|000001a0| 00 00 00 59 5f 5e 5b 8b | e5 5d c2 08 00 8b ff 55 |...Y_^[.|.].....U|
|000001b0| 8b ec a1 5c 73 05 00 85 | c0 b9 4e e6 40 bb 74 04 |...\s...|..N.@.t.|
|000001c0| 3b c1 75 1a a1 64 c0 03 | 00 8b 00 35 5c 73 05 00 |;.u..d..|...5\s..|
|000001d0| a3 5c 73 05 00 75 07 8b | c1 a3 5c 73 05 00 f7 d0 |.\s..u..|..\s....|
|000001e0| a3 60 73 05 00 5d e9 15 | fe ff ff 8b ff 55 8b ec |.`s..]..|.....U..|
|000001f0| 51 0f 31 56 57 33 ff 39 | 3d 08 7a 05 00 a3 88 79 |Q.1VW3.9|=.z....y|
|00000200| 05 00 76 40 53 8b 1d 2c | c0 03 00 be a8 79 05 00 |..v@S..,|.....y..|
|00000210| 6a 00 6a 01 8d 46 04 50 | c7 46 f8 01 00 00 00 c7 |j.j..F.P|.F......|
|00000220| 46 fc 00 00 00 00 c7 06 | 00 00 00 00 ff d3 c7 46 |F.......|.......F|
|00000230| f4 00 00 00 00 83 c7 01 | 83 c6 24 3b 3d 08 7a 05 |........|..$;=.z.|
|00000240| 00 72 cd 5b e8 8d c6 fb | ff 85 c0 7c 31 8b 4d 0c |.r.[....|...|1.M.|
|00000250| 8b 75 08 51 56 c7 45 fc | 00 00 00 00 ff 15 18 7a |.u.QV.E.|.......z|
|00000260| 05 00 85 c0 7c 10 8b 56 | 34 89 15 14 7a 05 00 c7 |....|..V|4...z...|
|00000270| 46 34 47 4a 07 00 5f 5e | 8b e5 5d c2 08 00 5f b8 |F4GJ.._^|..]..._.|
|00000280| 65 03 00 c0 5e 8b e5 5d | c2 08 00 90 fc 82 0a 00 |e...^..]|........|
|00000290| 00 00 00 00 00 00 00 00 | ec 82 0a 00 00 c0 02 00 |........|........|
|000002a0| e4 84 0a 00 00 00 00 00 | 00 00 00 00 e4 82 0a 00 |........|........|
|000002b0| e8 c1 02 00 00 85 0a 00 | 00 00 00 00 00 00 00 00 |........|........|
|000002c0| dc 82 0a 00 04 c2 02 00 | 00 00 00 00 00 00 00 00 |........|........|
|000002d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 43 49 2e 64 |........|....CI.d|
|000002e0| 6c 6c 00 90 48 41 4c 2e | 64 6c 6c 00 6e 74 6f 73 |ll..HAL.|dll.ntos|
|000002f0| 6b 72 6e 6c 2e 65 78 65 | 00 90 90 90 10 85 0a 00 |krnl.exe|........|
|00000300| 2a 85 0a 00 3a 85 0a 00 | 5a 85 0a 00 74 85 0a 00 |*...:...|Z...t...|
|00000310| 8a 85 0a 00 a8 85 0a 00 | bc 85 0a 00 d4 85 0a 00 |........|........|
|00000320| ec 85 0a 00 04 86 0a 00 | 18 86 0a 00 2c 86 0a 00 |........|....,...|
|00000330| 3a 86 0a 00 54 86 0a 00 | 64 86 0a 00 72 86 0a 00 |:...T...|d...r...|
|00000340| 8a 86 0a 00 a2 86 0a 00 | c0 86 0a 00 dc 86 0a 00 |........|........|
|00000350| f4 86 0a 00 10 87 0a 00 | 24 87 0a 00 3a 87 0a 00 |........|$...:...|
|00000360| 56 87 0a 00 64 87 0a 00 | 74 87 0a 00 80 87 0a 00 |V...d...|t.......|
|00000370| 8c 87 0a 00 a4 87 0a 00 | b6 87 0a 00 d0 87 0a 00 |........|........|
|00000380| ec 87 0a 00 fc 87 0a 00 | 14 88 0a 00 30 88 0a 00 |........|....0...|
|00000390| 48 88 0a 00 62 88 0a 00 | 7a 88 0a 00 8a 88 0a 00 |H...b...|z.......|
|000003a0| a2 88 0a 00 b8 88 0a 00 | c4 88 0a 00 da 88 0a 00 |........|........|
|000003b0| e6 88 0a 00 f6 88 0a 00 | 12 89 0a 00 32 89 0a 00 |........|....2...|
|000003c0| 42 89 0a 00 5a 89 0a 00 | 78 89 0a 00 90 89 0a 00 |B...Z...|x.......|
|000003d0| 9a 89 0a 00 b6 89 0a 00 | d0 89 0a 00 ea 89 0a 00 |........|........|
|000003e0| 00 8a 0a 00 16 8a 0a 00 | 38 8a 0a 00 56 8a 0a 00 |........|8...V...|
|000003f0| 6e 8a 0a 00 7a 8a 0a 00 | 96 8a 0a 00 ac 8a 0a 00 |n...z...|........|
|00000400| c8 8a 0a 00 e0 8a 0a 00 | fa 8a 0a 00 16 8b 0a 00 |........|........|
|00000410| 2a 8b 0a 00 42 8b 0a 00 | 4c 8b 0a 00 5e 8b 0a 00 |*...B...|L...^...|
|00000420| 7c 8b 0a 00 86 8b 0a 00 | 9a 8b 0a 00 b4 8b 0a 00 ||.......|........|
|00000430| d0 8b 0a 00 e4 8b 0a 00 | f4 8b 0a 00 14 8c 0a 00 |........|........|
|00000440| 32 8c 0a 00 46 8c 0a 00 | 5a 8c 0a 00 72 8c 0a 00 |2...F...|Z...r...|
|00000450| 8c 8c 0a 00 9a 8c 0a 00 | b6 8c 0a 00 d0 8c 0a 00 |........|........|
|00000460| e2 8c 0a 00 f6 8c 0a 00 | 0e 8d 0a 00 18 8d 0a 00 |........|........|
|00000470| 38 8d 0a 00 44 8d 0a 00 | 52 8d 0a 00 68 8d 0a 00 |8...D...|R...h...|
|00000480| 86 8d 0a 00 98 8d 0a 00 | a6 8d 0a 00 b4 8d 0a 00 |........|........|
|00000490| c4 8d 0a 00 e4 8d 0a 00 | f2 8d 0a 00 02 8e 0a 00 |........|........|
|000004a0| 14 8e 0a 00 36 8e 0a 00 | 56 8e 0a 00 6a 8e 0a 00 |....6...|V...j...|
|000004b0| 7c 8e 0a 00 a0 8e 0a 00 | c2 8e 0a 00 da 8e 0a 00 ||.......|........|
|000004c0| ee 8e 0a 00 f8 8e 0a 00 | 12 8f 0a 00 1c 8f 0a 00 |........|........|
|000004d0| 26 8f 0a 00 3e 8f 0a 00 | 56 8f 0a 00 64 8f 0a 00 |&...>...|V...d...|
|000004e0| 00 00 00 00 70 8f 0a 00 | 84 8f 0a 00 98 8f 0a 00 |....p...|........|
|000004f0| b4 8f 0a 00 c8 8f 0a 00 | de 8f 0a 00 00 00 00 00 |........|........|
|00000500| f4 8f 0a 00 10 90 0a 00 | 24 90 0a 00 00 00 00 00 |........|$.......|
|00000510| 3b 06 53 65 52 65 6c 65 | 61 73 65 53 75 62 6a 65 |;.SeRele|aseSubje|
|00000520| 63 74 43 6f 6e 74 65 78 | 74 00 08 06 53 65 41 63 |ctContex|t...SeAc|
|00000530| 63 65 73 73 43 68 65 63 | 6b 00 06 02 49 6f 47 65 |cessChec|k...IoGe|
|00000540| 74 46 69 6c 65 4f 62 6a | 65 63 74 47 65 6e 65 72 |tFileObj|ectGener|
|00000550| 69 63 4d 61 70 70 69 6e | 67 00 16 06 53 65 43 61 |icMappin|g...SeCa|
|00000560| 70 74 75 72 65 53 75 62 | 6a 65 63 74 43 6f 6e 74 |ptureSub|jectCont|
|00000570| 65 78 74 00 b7 03 4d 6d | 55 73 65 72 50 72 6f 62 |ext...Mm|UserProb|
|00000580| 65 41 64 64 72 65 73 73 | 00 00 a9 00 45 78 52 61 |eAddress|....ExRa|
|00000590| 69 73 65 44 61 74 61 74 | 79 70 65 4d 69 73 61 6c |iseDatat|ypeMisal|
|000005a0| 69 67 6e 6d 65 6e 74 00 | f4 02 4b 65 51 75 65 72 |ignment.|..KeQuer|
|000005b0| 79 53 79 73 74 65 6d 54 | 69 6d 65 00 e6 02 4b 65 |ySystemT|ime...Ke|
|000005c0| 4c 65 61 76 65 43 72 69 | 74 69 63 61 6c 52 65 67 |LeaveCri|ticalReg|
|000005d0| 69 6f 6e 00 67 04 50 73 | 47 65 74 43 75 72 72 65 |ion.g.Ps|GetCurre|
|000005e0| 6e 74 50 72 6f 63 65 73 | 73 49 64 00 b3 02 4b 65 |ntProces|sId...Ke|
|000005f0| 45 6e 74 65 72 43 72 69 | 74 69 63 61 6c 52 65 67 |EnterCri|ticalReg|
|00000600| 69 6f 6e 00 87 00 45 78 | 47 65 74 50 72 65 76 69 |ion...Ex|GetPrevi|
|00000610| 6f 75 73 4d 6f 64 65 00 | cf 02 4b 65 49 6e 69 74 |ousMode.|..KeInit|
|00000620| 69 61 6c 69 7a 65 45 76 | 65 6e 74 00 0b 07 5a 77 |ializeEv|ent...Zw|
|00000630| 52 65 61 64 46 69 6c 65 | 00 00 f8 06 5a 77 51 75 |ReadFile|....ZwQu|
|00000640| 65 72 79 49 6e 66 6f 72 | 6d 61 74 69 6f 6e 46 69 |eryInfor|mationFi|
|00000650| 6c 65 00 00 aa 06 5a 77 | 43 72 65 61 74 65 46 69 |le....Zw|CreateFi|
|00000660| 6c 65 00 00 38 07 5a 77 | 57 72 69 74 65 46 69 6c |le..8.Zw|WriteFil|
|00000670| 65 00 23 07 5a 77 53 65 | 74 49 6e 66 6f 72 6d 61 |e.#.ZwSe|tInforma|
|00000680| 74 69 6f 6e 46 69 6c 65 | 00 00 37 04 4f 62 66 44 |tionFile|..7.ObfD|
|00000690| 65 72 65 66 65 72 65 6e | 63 65 4f 62 6a 65 63 74 |ereferen|ceObject|
|000006a0| 00 00 cc 00 45 78 66 41 | 63 71 75 69 72 65 50 75 |....ExfA|cquirePu|
|000006b0| 73 68 4c 6f 63 6b 45 78 | 63 6c 75 73 69 76 65 00 |shLockEx|clusive.|
|000006c0| cd 00 45 78 66 41 63 71 | 75 69 72 65 50 75 73 68 |..ExfAcq|uirePush|
|000006d0| 4c 6f 63 6b 53 68 61 72 | 65 64 00 00 d9 00 45 78 |LockShar|ed....Ex|
|000006e0| 66 54 72 79 54 6f 57 61 | 6b 65 50 75 73 68 4c 6f |fTryToWa|kePushLo|
|000006f0| 63 6b 00 00 d7 00 45 78 | 66 52 65 6c 65 61 73 65 |ck....Ex|fRelease|
|00000700| 50 75 73 68 4c 6f 63 6b | 53 68 61 72 65 64 00 00 |PushLock|Shared..|
|00000710| 2b 04 4f 62 51 75 65 72 | 79 4e 61 6d 65 53 74 72 |+.ObQuer|yNameStr|
|00000720| 69 6e 67 00 66 04 50 73 | 47 65 74 43 75 72 72 65 |ing.f.Ps|GetCurre|
|00000730| 6e 74 50 72 6f 63 65 73 | 73 00 bd 05 52 74 6c 53 |ntProces|s...RtlS|
|00000740| 65 63 6f 6e 64 73 53 69 | 6e 63 65 31 39 38 30 54 |econdsSi|nce1980T|
|00000750| 6f 54 69 6d 65 00 35 03 | 4b 65 54 69 63 6b 43 6f |oTime.5.|KeTickCo|
|00000760| 75 6e 74 00 a9 02 4b 65 | 42 75 67 43 68 65 63 6b |unt...Ke|BugCheck|
|00000770| 45 78 00 00 ee 05 52 74 | 6c 55 6e 77 69 6e 64 00 |Ex....Rt|lUnwind.|
|00000780| db 06 5a 77 4f 70 65 6e | 4b 65 79 00 55 05 52 74 |..ZwOpen|Key.U.Rt|
|00000790| 6c 49 6e 69 74 55 6e 69 | 63 6f 64 65 53 74 72 69 |lInitUni|codeStri|
|000007a0| 6e 67 00 00 08 07 5a 77 | 51 75 65 72 79 56 61 6c |ng....Zw|QueryVal|
|000007b0| 75 65 4b 65 79 00 ad 02 | 4b 65 44 65 6c 61 79 45 |ueKey...|KeDelayE|
|000007c0| 78 65 63 75 74 69 6f 6e | 54 68 72 65 61 64 00 00 |xecution|Thread..|
|000007d0| 2d 04 4f 62 52 65 66 65 | 72 65 6e 63 65 4f 62 6a |-.ObRefe|renceObj|
|000007e0| 65 63 74 42 79 48 61 6e | 64 6c 65 00 ac 02 4b 65 |ectByHan|dle...Ke|
|000007f0| 43 6c 65 61 72 45 76 65 | 6e 74 00 00 f6 02 4b 65 |ClearEve|nt....Ke|
|00000800| 51 75 65 72 79 54 69 6d | 65 49 6e 63 72 65 6d 65 |QueryTim|eIncreme|
|00000810| 6e 74 00 00 3c 03 4b 65 | 57 61 69 74 46 6f 72 4d |nt..<.Ke|WaitForM|
|00000820| 75 6c 74 69 70 6c 65 4f | 62 6a 65 63 74 73 00 00 |ultipleO|bjects..|
|00000830| 5f 04 50 73 43 72 65 61 | 74 65 53 79 73 74 65 6d |_.PsCrea|teSystem|
|00000840| 54 68 72 65 61 64 00 00 | c4 00 45 78 53 79 73 74 |Thread..|..ExSyst|
|00000850| 65 6d 54 69 6d 65 54 6f | 4c 6f 63 61 6c 54 69 6d |emTimeTo|LocalTim|
|00000860| 65 00 6b 04 50 73 47 65 | 74 43 75 72 72 65 6e 74 |e.k.PsGe|tCurrent|
|00000870| 54 68 72 65 61 64 49 64 | 00 00 57 04 50 72 6f 62 |ThreadId|..W.Prob|
|00000880| 65 46 6f 72 57 72 69 74 | 65 00 09 07 5a 77 51 75 |eForWrit|e...ZwQu|
|00000890| 65 72 79 56 69 72 74 75 | 61 6c 4d 65 6d 6f 72 79 |eryVirtu|alMemory|
|000008a0| 00 00 be 02 4b 65 47 65 | 74 43 75 72 72 65 6e 74 |....KeGe|tCurrent|
|000008b0| 54 68 72 65 61 64 00 00 | 49 07 5f 61 75 6c 6c 72 |Thread..|I._aullr|
|000008c0| 65 6d 00 00 9d 03 4d 6d | 50 72 6f 62 65 41 6e 64 |em....Mm|ProbeAnd|
|000008d0| 4c 6f 63 6b 50 61 67 65 | 73 00 f1 01 49 6f 46 72 |LockPage|s...IoFr|
|000008e0| 65 65 4d 64 6c 00 ae 03 | 4d 6d 55 6e 6c 6f 63 6b |eeMdl...|MmUnlock|
|000008f0| 50 61 67 65 73 00 a0 03 | 4d 6d 50 72 6f 74 65 63 |Pages...|MmProtec|
|00000900| 74 4d 64 6c 53 79 73 74 | 65 6d 41 64 64 72 65 73 |tMdlSyst|emAddres|
|00000910| 73 00 91 03 4d 6d 4d 61 | 70 4c 6f 63 6b 65 64 50 |s...MmMa|pLockedP|
|00000920| 61 67 65 73 53 70 65 63 | 69 66 79 43 61 63 68 65 |agesSpec|ifyCache|
|00000930| 00 00 a5 01 49 6f 41 6c | 6c 6f 63 61 74 65 4d 64 |....IoAl|locateMd|
|00000940| 6c 00 02 03 4b 65 52 65 | 6c 65 61 73 65 47 75 61 |l...KeRe|leaseGua|
|00000950| 72 64 65 64 4d 75 74 65 | 78 00 36 03 4b 65 54 72 |rdedMute|x.6.KeTr|
|00000960| 79 54 6f 41 63 71 75 69 | 72 65 47 75 61 72 64 65 |yToAcqui|reGuarde|
|00000970| 64 4d 75 74 65 78 00 00 | 69 00 45 78 41 6c 6c 6f |dMutex..|i.ExAllo|
|00000980| 63 61 74 65 50 6f 6f 6c | 57 69 74 68 54 61 67 00 |catePool|WithTag.|
|00000990| 3e 07 5f 61 6c 6c 64 69 | 76 00 d0 02 4b 65 49 6e |>._alldi|v...KeIn|
|000009a0| 69 74 69 61 6c 69 7a 65 | 47 75 61 72 64 65 64 4d |itialize|GuardedM|
|000009b0| 75 74 65 78 00 00 86 00 | 45 78 47 65 74 4c 69 63 |utex....|ExGetLic|
|000009c0| 65 6e 73 65 54 61 6d 70 | 65 72 53 74 61 74 65 00 |enseTamp|erState.|
|000009d0| bf 00 45 78 53 65 74 4c | 69 63 65 6e 73 65 54 61 |..ExSetL|icenseTa|
|000009e0| 6d 70 65 72 53 74 61 74 | 65 00 c6 00 45 78 55 70 |mperStat|e...ExUp|
|000009f0| 64 61 74 65 4c 69 63 65 | 6e 73 65 44 61 74 61 00 |dateLice|nseData.|
|00000a00| 7c 00 45 78 46 65 74 63 | 68 4c 69 63 65 6e 73 65 ||.ExFetc|hLicense|
|00000a10| 44 61 74 61 00 00 5b 00 | 45 78 41 63 71 75 69 72 |Data..[.|ExAcquir|
|00000a20| 65 52 65 73 6f 75 72 63 | 65 45 78 63 6c 75 73 69 |eResourc|eExclusi|
|00000a30| 76 65 4c 69 74 65 00 00 | 5c 00 45 78 41 63 71 75 |veLite..|\.ExAcqu|
|00000a40| 69 72 65 52 65 73 6f 75 | 72 63 65 53 68 61 72 65 |ireResou|rceShare|
|00000a50| 64 4c 69 74 65 00 b7 00 | 45 78 52 65 6c 65 61 73 |dLite...|ExReleas|
|00000a60| 65 52 65 73 6f 75 72 63 | 65 4c 69 74 65 00 57 07 |eResourc|eLite.W.|
|00000a70| 5f 73 74 72 6e 69 63 6d | 70 00 07 07 5a 77 51 75 |_strnicm|p...ZwQu|
|00000a80| 65 72 79 53 79 73 74 65 | 6d 49 6e 66 6f 72 6d 61 |erySyste|mInforma|
|00000a90| 74 69 6f 6e 00 00 fb 01 | 49 6f 47 65 74 43 75 72 |tion....|IoGetCur|
|00000aa0| 72 65 6e 74 50 72 6f 63 | 65 73 73 00 8d 00 45 78 |rentProc|ess...Ex|
|00000ab0| 49 6e 69 74 69 61 6c 69 | 7a 65 52 65 73 6f 75 72 |Initiali|zeResour|
|00000ac0| 63 65 4c 69 74 65 00 00 | 70 00 45 78 44 65 6c 65 |ceLite..|p.ExDele|
|00000ad0| 74 65 52 65 73 6f 75 72 | 63 65 4c 69 74 65 00 00 |teResour|ceLite..|
|00000ae0| e8 04 52 74 6c 43 6f 6d | 70 61 72 65 55 6e 69 63 |..RtlCom|pareUnic|
|00000af0| 6f 64 65 53 74 72 69 6e | 67 00 0d 05 52 74 6c 44 |odeStrin|g...RtlD|
|00000b00| 6f 77 6e 63 61 73 65 55 | 6e 69 63 6f 64 65 53 74 |owncaseU|nicodeSt|
|00000b10| 72 69 6e 67 00 00 7a 00 | 45 78 45 76 65 6e 74 4f |ring..z.|ExEventO|
|00000b20| 62 6a 65 63 74 54 79 70 | 65 00 f5 04 52 74 6c 43 |bjectTyp|e...RtlC|
|00000b30| 6f 70 79 55 6e 69 63 6f | 64 65 53 74 72 69 6e 67 |opyUnico|deString|
|00000b40| 00 00 8f 07 77 63 73 63 | 68 72 00 00 80 04 50 73 |....wcsc|hr....Ps|
|00000b50| 47 65 74 50 72 6f 63 65 | 73 73 50 65 62 00 9c 04 |GetProce|ssPeb...|
|00000b60| 50 73 4c 6f 6f 6b 75 70 | 50 72 6f 63 65 73 73 42 |PsLookup|ProcessB|
|00000b70| 79 50 72 6f 63 65 73 73 | 49 64 00 00 74 07 6d 65 |yProcess|Id..t.me|
|00000b80| 6d 6d 6f 76 65 00 e5 04 | 52 74 6c 43 6f 6d 70 61 |mmove...|RtlCompa|
|00000b90| 72 65 4d 65 6d 6f 72 79 | 00 00 27 07 5a 77 53 65 |reMemory|..'.ZwSe|
|00000ba0| 74 49 6e 66 6f 72 6d 61 | 74 69 6f 6e 54 68 72 65 |tInforma|tionThre|
|00000bb0| 61 64 00 00 fc 06 5a 77 | 51 75 65 72 79 49 6e 66 |ad....Zw|QueryInf|
|00000bc0| 6f 72 6d 61 74 69 6f 6e | 54 68 72 65 61 64 00 00 |ormation|Thread..|
|00000bd0| 11 02 49 6f 47 65 74 53 | 74 61 63 6b 4c 69 6d 69 |..IoGetS|tackLimi|
|00000be0| 74 73 00 00 54 05 52 74 | 6c 49 6e 69 74 53 74 72 |ts..T.Rt|lInitStr|
|00000bf0| 69 6e 67 00 d1 04 52 74 | 6c 41 6e 73 69 53 74 72 |ing...Rt|lAnsiStr|
|00000c00| 69 6e 67 54 6f 55 6e 69 | 63 6f 64 65 53 74 72 69 |ingToUni|codeStri|
|00000c10| 6e 67 00 00 04 06 52 74 | 6c 78 41 6e 73 69 53 74 |ng....Rt|lxAnsiSt|
|00000c20| 72 69 6e 67 54 6f 55 6e | 69 63 6f 64 65 53 69 7a |ringToUn|icodeSiz|
|00000c30| 65 00 ba 03 4e 6c 73 4d | 62 43 6f 64 65 50 61 67 |e...NlsM|bCodePag|
|00000c40| 65 54 61 67 00 00 51 05 | 52 74 6c 49 6e 69 74 41 |eTag..Q.|RtlInitA|
|00000c50| 6e 73 69 53 74 72 69 6e | 67 00 2f 03 4b 65 53 74 |nsiStrin|g./.KeSt|
|00000c60| 61 63 6b 41 74 74 61 63 | 68 50 72 6f 63 65 73 73 |ackAttac|hProcess|
|00000c70| 00 00 38 03 4b 65 55 6e | 73 74 61 63 6b 44 65 74 |..8.KeUn|stackDet|
|00000c80| 61 63 68 50 72 6f 63 65 | 73 73 00 00 d9 06 5a 77 |achProce|ss....Zw|
|00000c90| 4f 70 65 6e 46 69 6c 65 | 00 00 b4 03 4d 6d 55 6e |OpenFile|....MmUn|
|00000ca0| 6d 61 70 56 69 65 77 49 | 6e 53 79 73 74 65 6d 53 |mapViewI|nSystemS|
|00000cb0| 70 61 63 65 00 00 97 03 | 4d 6d 4d 61 70 56 69 65 |pace....|MmMapVie|
|00000cc0| 77 49 6e 53 79 73 74 65 | 6d 53 70 61 63 65 00 00 |wInSyste|mSpace..|
|00000cd0| b0 06 5a 77 43 72 65 61 | 74 65 53 65 63 74 69 6f |..ZwCrea|teSectio|
|00000ce0| 6e 00 dd 04 52 74 6c 43 | 68 61 72 54 6f 49 6e 74 |n...RtlC|harToInt|
|00000cf0| 65 67 65 72 00 00 36 05 | 52 74 6c 46 72 65 65 55 |eger..6.|RtlFreeU|
|00000d00| 6e 69 63 6f 64 65 53 74 | 72 69 6e 67 00 00 7c 07 |nicodeSt|ring..|.|
|00000d10| 73 74 72 63 68 72 00 00 | 4f 05 52 74 6c 49 6d 61 |strchr..|O.RtlIma|
|00000d20| 67 65 44 69 72 65 63 74 | 6f 72 79 45 6e 74 72 79 |geDirect|oryEntry|
|00000d30| 54 6f 44 61 74 61 00 00 | 8a 07 74 6f 77 75 70 70 |ToData..|..towupp|
|00000d40| 65 72 00 00 5f 07 5f 76 | 73 6e 77 70 72 69 6e 74 |er.._._v|snwprint|
|00000d50| 66 00 d8 05 52 74 6c 54 | 69 6d 65 54 6f 54 69 6d |f...RtlT|imeToTim|
|00000d60| 65 46 69 65 6c 64 73 00 | d0 06 5a 77 4c 6f 63 6b |eFields.|..ZwLock|
|00000d70| 50 72 6f 64 75 63 74 41 | 63 74 69 76 61 74 69 6f |ProductA|ctivatio|
|00000d80| 6e 4b 65 79 73 00 c0 06 | 5a 77 45 6e 75 6d 65 72 |nKeys...|ZwEnumer|
|00000d90| 61 74 65 4b 65 79 00 00 | ad 06 5a 77 43 72 65 61 |ateKey..|..ZwCrea|
|00000da0| 74 65 4b 65 79 00 c5 06 | 5a 77 46 6c 75 73 68 4b |teKey...|ZwFlushK|
|00000db0| 65 79 00 00 2d 07 5a 77 | 53 65 74 56 61 6c 75 65 |ey..-.Zw|SetValue|
|00000dc0| 4b 65 79 00 6a 00 45 78 | 41 6c 6c 6f 63 61 74 65 |Key.j.Ex|Allocate|
|00000dd0| 50 6f 6f 6c 57 69 74 68 | 54 61 67 50 72 69 6f 72 |PoolWith|TagPrior|
|00000de0| 69 74 79 00 2b 03 4b 65 | 53 65 74 54 69 6d 65 72 |ity.+.Ke|SetTimer|
|00000df0| 00 00 aa 02 4b 65 43 61 | 6e 63 65 6c 54 69 6d 65 |....KeCa|ncelTime|
|00000e00| 72 00 a7 00 45 78 51 75 | 65 75 65 57 6f 72 6b 49 |r...ExQu|eueWorkI|
|00000e10| 74 65 6d 00 40 03 4b 65 | 66 52 65 6c 65 61 73 65 |tem.@.Ke|fRelease|
|00000e20| 53 70 69 6e 4c 6f 63 6b | 46 72 6f 6d 44 70 63 4c |SpinLock|FromDpcL|
|00000e30| 65 76 65 6c 00 00 3f 03 | 4b 65 66 41 63 71 75 69 |evel..?.|KefAcqui|
|00000e40| 72 65 53 70 69 6e 4c 6f | 63 6b 41 74 44 70 63 4c |reSpinLo|ckAtDpcL|
|00000e50| 65 76 65 6c 00 00 d8 02 | 4b 65 49 6e 69 74 69 61 |evel....|KeInitia|
|00000e60| 6c 69 7a 65 54 69 6d 65 | 72 00 ce 02 4b 65 49 6e |lizeTime|r...KeIn|
|00000e70| 69 74 69 61 6c 69 7a 65 | 44 70 63 00 53 04 50 6f |itialize|Dpc.S.Po|
|00000e80| 55 6e 72 65 67 69 73 74 | 65 72 50 6f 77 65 72 53 |Unregist|erPowerS|
|00000e90| 65 74 74 69 6e 67 43 61 | 6c 6c 62 61 63 6b 00 00 |ettingCa|llback..|
|00000ea0| 47 04 50 6f 52 65 67 69 | 73 74 65 72 50 6f 77 65 |G.PoRegi|sterPowe|
|00000eb0| 72 53 65 74 74 69 6e 67 | 43 61 6c 6c 62 61 63 6b |rSetting|Callback|
|00000ec0| 00 00 01 06 52 74 6c 57 | 72 69 74 65 52 65 67 69 |....RtlW|riteRegi|
|00000ed0| 73 74 72 79 56 61 6c 75 | 65 00 81 00 45 78 46 72 |stryValu|e...ExFr|
|00000ee0| 65 65 50 6f 6f 6c 57 69 | 74 68 54 61 67 00 a2 06 |eePoolWi|thTag...|
|00000ef0| 5a 77 43 6c 6f 73 65 00 | af 05 52 74 6c 51 75 65 |ZwClose.|..RtlQue|
|00000f00| 72 79 52 65 67 69 73 74 | 72 79 56 61 6c 75 65 73 |ryRegist|ryValues|
|00000f10| 00 00 75 07 6d 65 6d 73 | 65 74 00 00 73 07 6d 65 |..u.mems|et..s.me|
|00000f20| 6d 63 70 79 00 00 3e 03 | 4b 65 57 61 69 74 46 6f |mcpy..>.|KeWaitFo|
|00000f30| 72 53 69 6e 67 6c 65 4f | 62 6a 65 63 74 00 9b 02 |rSingleO|bject...|
|00000f40| 4b 65 41 63 71 75 69 72 | 65 47 75 61 72 64 65 64 |KeAcquir|eGuarded|
|00000f50| 4d 75 74 65 78 00 20 03 | 4b 65 53 65 74 45 76 65 |Mutex. .|KeSetEve|
|00000f60| 6e 74 00 00 3c 00 44 62 | 67 50 72 69 6e 74 00 00 |nt..<.Db|gPrint..|
|00000f70| 50 00 4b 65 47 65 74 43 | 75 72 72 65 6e 74 49 72 |P.KeGetC|urrentIr|
|00000f80| 71 6c 00 00 5f 00 4b 66 | 52 65 6c 65 61 73 65 53 |ql.._.Kf|ReleaseS|
|00000f90| 70 69 6e 4c 6f 63 6b 00 | 52 00 4b 65 51 75 65 72 |pinLock.|R.KeQuer|
|00000fa0| 79 50 65 72 66 6f 72 6d | 61 6e 63 65 43 6f 75 6e |yPerform|anceCoun|
|00000fb0| 74 65 72 00 5c 00 4b 66 | 41 63 71 75 69 72 65 53 |ter.\.Kf|AcquireS|
|00000fc0| 70 69 6e 4c 6f 63 6b 00 | 00 00 45 78 41 63 71 75 |pinLock.|..ExAcqu|
|00000fd0| 69 72 65 46 61 73 74 4d | 75 74 65 78 00 00 01 00 |ireFastM|utex....|
|00000fe0| 45 78 52 65 6c 65 61 73 | 65 46 61 73 74 4d 75 74 |ExReleas|eFastMut|
|00000ff0| 65 78 00 00 00 00 43 69 | 46 69 6e 64 50 61 67 65 |ex....Ci|FindPage|
|00001000| 48 61 73 68 65 73 49 6e | 43 61 74 61 6c 6f 67 00 |HashesIn|Catalog.|
|00001010| 02 00 43 69 46 72 65 65 | 50 6f 6c 69 63 79 49 6e |..CiFree|PolicyIn|
|00001020| 66 6f 00 00 01 00 43 69 | 46 69 6e 64 50 61 67 65 |fo....Ci|FindPage|
|00001030| 48 61 73 68 65 73 49 6e | 53 69 67 6e 65 64 46 69 |HashesIn|SignedFi|
|00001040| 6c 65 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |le......|........|
|00001050| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001060| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001070| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001080| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001090| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000010a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000010b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000010c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000010d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000010e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000010f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001100| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001110| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001120| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001130| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001140| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001150| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001160| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001170| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001180| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00001190| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000011f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
+--------+-------------------------+-------------------------+--------+--------+
