syscall_map.h 103 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116
  1. // Copyright (c) 2009 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. // This table is a dump of system call numbers -> function names on an XP
  5. // system. These numbers change between kernel versions, so it's likely they
  6. // will have to be regenerated for your system. See the idarub script.
  7. // Define a global map used for resolving a syscall number to name.
  8. // Call CreateSyscallMap() to create a return a std::map<int, const char*>
  9. // which maps from a system call number to its function name.
  10. #ifndef TRACELINE_SYSCALL_MAP_H_
  11. #define TRACELINE_SYSCALL_MAP_H_
  12. #include <map>
  13. // TODO(deanm): Right now these tables are manually extracted and hardcoded
  14. // here. It would be great (but possibly difficult) to do it on startup. We
  15. // should at least checksum the DLLs to make sure they match.
  16. std::map<int, const char*> CreateSyscallMap() {
  17. std::map<int, const char*> table;
  18. if (1) { // XP table.
  19. table[0] = "ntdll.dll!NtAcceptConnectPort";
  20. table[1] = "ntdll.dll!NtAccessCheck";
  21. table[2] = "ntdll.dll!ZwAccessCheckAndAuditAlarm";
  22. table[3] = "ntdll.dll!NtAccessCheckByType";
  23. table[4] = "ntdll.dll!NtAccessCheckByTypeAndAuditAlarm";
  24. table[5] = "ntdll.dll!NtAccessCheckByTypeResultList";
  25. table[6] = "ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm";
  26. table[7] = "ntdll.dll!ZwAccessCheckByTypeResultListAndAuditAlarmByHandle";
  27. table[8] = "ntdll.dll!NtAddAtom";
  28. table[9] = "ntdll.dll!ZwAddBootEntry";
  29. table[10] = "ntdll.dll!ZwAdjustGroupsToken";
  30. table[11] = "ntdll.dll!ZwAdjustPrivilegesToken";
  31. table[12] = "ntdll.dll!NtAlertResumeThread";
  32. table[13] = "ntdll.dll!NtAlertThread";
  33. table[14] = "ntdll.dll!ZwAllocateLocallyUniqueId";
  34. table[15] = "ntdll.dll!NtAllocateUserPhysicalPages";
  35. table[16] = "ntdll.dll!NtAllocateUuids";
  36. table[17] = "ntdll.dll!NtAllocateVirtualMemory";
  37. table[18] = "ntdll.dll!ZwAreMappedFilesTheSame";
  38. table[19] = "ntdll.dll!ZwAssignProcessToJobObject";
  39. table[20] = "ntdll.dll!ZwCallbackReturn";
  40. table[21] = "ntdll.dll!NtCancelDeviceWakeupRequest";
  41. table[22] = "ntdll.dll!ZwCancelIoFile";
  42. table[23] = "ntdll.dll!ZwCancelTimer";
  43. table[24] = "ntdll.dll!NtClearEvent";
  44. table[25] = "ntdll.dll!NtClose";
  45. table[26] = "ntdll.dll!ZwCloseObjectAuditAlarm";
  46. table[27] = "ntdll.dll!NtCompactKeys";
  47. table[28] = "ntdll.dll!ZwCompareTokens";
  48. table[29] = "ntdll.dll!NtCompleteConnectPort";
  49. table[30] = "ntdll.dll!ZwCompressKey";
  50. table[31] = "ntdll.dll!NtConnectPort";
  51. table[32] = "ntdll.dll!ZwContinue";
  52. table[33] = "ntdll.dll!ZwCreateDebugObject";
  53. table[34] = "ntdll.dll!ZwCreateDirectoryObject";
  54. table[35] = "ntdll.dll!NtCreateEvent";
  55. table[36] = "ntdll.dll!NtCreateEventPair";
  56. table[37] = "ntdll.dll!NtCreateFile";
  57. table[38] = "ntdll.dll!NtCreateIoCompletion";
  58. table[39] = "ntdll.dll!ZwCreateJobObject";
  59. table[40] = "ntdll.dll!NtCreateJobSet";
  60. table[41] = "ntdll.dll!ZwCreateKey";
  61. table[42] = "ntdll.dll!ZwCreateMailslotFile";
  62. table[43] = "ntdll.dll!ZwCreateMutant";
  63. table[44] = "ntdll.dll!ZwCreateNamedPipeFile";
  64. table[45] = "ntdll.dll!NtCreatePagingFile";
  65. table[46] = "ntdll.dll!ZwCreatePort";
  66. table[47] = "ntdll.dll!ZwCreateProcess";
  67. table[48] = "ntdll.dll!ZwCreateProcessEx";
  68. table[49] = "ntdll.dll!ZwCreateProfile";
  69. table[50] = "ntdll.dll!NtCreateSection";
  70. table[51] = "ntdll.dll!NtCreateSemaphore";
  71. table[52] = "ntdll.dll!ZwCreateSymbolicLinkObject";
  72. table[53] = "ntdll.dll!NtCreateThread";
  73. table[54] = "ntdll.dll!ZwCreateTimer";
  74. table[55] = "ntdll.dll!NtCreateToken";
  75. table[56] = "ntdll.dll!ZwCreateWaitablePort";
  76. table[57] = "ntdll.dll!NtDebugActiveProcess";
  77. table[58] = "ntdll.dll!ZwDebugContinue";
  78. table[59] = "ntdll.dll!ZwDelayExecution";
  79. table[60] = "ntdll.dll!ZwDeleteAtom";
  80. table[61] = "ntdll.dll!NtDeleteBootEntry";
  81. table[62] = "ntdll.dll!NtDeleteFile";
  82. table[63] = "ntdll.dll!ZwDeleteKey";
  83. table[64] = "ntdll.dll!NtDeleteObjectAuditAlarm";
  84. table[65] = "ntdll.dll!NtDeleteValueKey";
  85. table[66] = "ntdll.dll!ZwDeviceIoControlFile";
  86. table[67] = "ntdll.dll!NtDisplayString";
  87. table[68] = "ntdll.dll!ZwDuplicateObject";
  88. table[69] = "ntdll.dll!NtDuplicateToken";
  89. table[70] = "ntdll.dll!ZwEnumerateBootEntries";
  90. table[71] = "ntdll.dll!ZwEnumerateKey";
  91. table[72] = "ntdll.dll!ZwEnumerateSystemEnvironmentValuesEx";
  92. table[73] = "ntdll.dll!NtEnumerateValueKey";
  93. table[74] = "ntdll.dll!ZwExtendSection";
  94. table[75] = "ntdll.dll!NtFilterToken";
  95. table[76] = "ntdll.dll!NtFindAtom";
  96. table[77] = "ntdll.dll!ZwFlushBuffersFile";
  97. table[78] = "ntdll.dll!ZwFlushInstructionCache";
  98. table[79] = "ntdll.dll!NtFlushKey";
  99. table[80] = "ntdll.dll!ZwFlushVirtualMemory";
  100. table[81] = "ntdll.dll!NtFlushWriteBuffer";
  101. table[82] = "ntdll.dll!NtFreeUserPhysicalPages";
  102. table[83] = "ntdll.dll!NtFreeVirtualMemory";
  103. table[84] = "ntdll.dll!NtFsControlFile";
  104. table[85] = "ntdll.dll!NtGetContextThread";
  105. table[86] = "ntdll.dll!NtGetDevicePowerState";
  106. table[87] = "ntdll.dll!ZwGetPlugPlayEvent";
  107. table[88] = "ntdll.dll!NtGetWriteWatch";
  108. table[89] = "ntdll.dll!NtImpersonateAnonymousToken";
  109. table[90] = "ntdll.dll!ZwImpersonateClientOfPort";
  110. table[91] = "ntdll.dll!ZwImpersonateThread";
  111. table[92] = "ntdll.dll!ZwInitializeRegistry";
  112. table[93] = "ntdll.dll!NtInitiatePowerAction";
  113. table[94] = "ntdll.dll!ZwIsProcessInJob";
  114. table[95] = "ntdll.dll!NtIsSystemResumeAutomatic";
  115. table[96] = "ntdll.dll!ZwListenPort";
  116. table[97] = "ntdll.dll!NtLoadDriver";
  117. table[98] = "ntdll.dll!NtLoadKey";
  118. table[99] = "ntdll.dll!NtLoadKey2";
  119. table[100] = "ntdll.dll!NtLockFile";
  120. table[101] = "ntdll.dll!ZwLockProductActivationKeys";
  121. table[102] = "ntdll.dll!NtLockRegistryKey";
  122. table[103] = "ntdll.dll!ZwLockVirtualMemory";
  123. table[104] = "ntdll.dll!ZwMakePermanentObject";
  124. table[105] = "ntdll.dll!NtMakeTemporaryObject";
  125. table[106] = "ntdll.dll!NtMapUserPhysicalPages";
  126. table[107] = "ntdll.dll!ZwMapUserPhysicalPagesScatter";
  127. table[108] = "ntdll.dll!ZwMapViewOfSection";
  128. table[109] = "ntdll.dll!NtModifyBootEntry";
  129. table[110] = "ntdll.dll!NtNotifyChangeDirectoryFile";
  130. table[111] = "ntdll.dll!NtNotifyChangeKey";
  131. table[112] = "ntdll.dll!NtNotifyChangeMultipleKeys";
  132. table[113] = "ntdll.dll!ZwOpenDirectoryObject";
  133. table[114] = "ntdll.dll!NtOpenEvent";
  134. table[115] = "ntdll.dll!NtOpenEventPair";
  135. table[116] = "ntdll.dll!NtOpenFile";
  136. table[117] = "ntdll.dll!ZwOpenIoCompletion";
  137. table[118] = "ntdll.dll!ZwOpenJobObject";
  138. table[119] = "ntdll.dll!ZwOpenKey";
  139. table[120] = "ntdll.dll!NtOpenMutant";
  140. table[121] = "ntdll.dll!ZwOpenObjectAuditAlarm";
  141. table[122] = "ntdll.dll!ZwOpenProcess";
  142. table[123] = "ntdll.dll!ZwOpenProcessToken";
  143. table[124] = "ntdll.dll!ZwOpenProcessTokenEx";
  144. table[125] = "ntdll.dll!NtOpenSection";
  145. table[126] = "ntdll.dll!NtOpenSemaphore";
  146. table[127] = "ntdll.dll!NtOpenSymbolicLinkObject";
  147. table[128] = "ntdll.dll!ZwOpenThread";
  148. table[129] = "ntdll.dll!NtOpenThreadToken";
  149. table[130] = "ntdll.dll!NtOpenThreadTokenEx";
  150. table[131] = "ntdll.dll!ZwOpenTimer";
  151. table[132] = "ntdll.dll!NtPlugPlayControl";
  152. table[133] = "ntdll.dll!ZwPowerInformation";
  153. table[134] = "ntdll.dll!ZwPrivilegeCheck";
  154. table[135] = "ntdll.dll!ZwPrivilegeObjectAuditAlarm";
  155. table[136] = "ntdll.dll!NtPrivilegedServiceAuditAlarm";
  156. table[137] = "ntdll.dll!ZwProtectVirtualMemory";
  157. table[138] = "ntdll.dll!ZwPulseEvent";
  158. table[139] = "ntdll.dll!ZwQueryAttributesFile";
  159. table[140] = "ntdll.dll!ZwQueryBootEntryOrder";
  160. table[141] = "ntdll.dll!ZwQueryBootOptions";
  161. table[142] = "ntdll.dll!NtQueryDebugFilterState";
  162. table[143] = "ntdll.dll!NtQueryDefaultLocale";
  163. table[144] = "ntdll.dll!ZwQueryDefaultUILanguage";
  164. table[145] = "ntdll.dll!ZwQueryDirectoryFile";
  165. table[146] = "ntdll.dll!ZwQueryDirectoryObject";
  166. table[147] = "ntdll.dll!ZwQueryEaFile";
  167. table[148] = "ntdll.dll!NtQueryEvent";
  168. table[149] = "ntdll.dll!ZwQueryFullAttributesFile";
  169. table[150] = "ntdll.dll!NtQueryInformationAtom";
  170. table[151] = "ntdll.dll!ZwQueryInformationFile";
  171. table[152] = "ntdll.dll!ZwQueryInformationJobObject";
  172. table[153] = "ntdll.dll!ZwQueryInformationPort";
  173. table[154] = "ntdll.dll!ZwQueryInformationProcess";
  174. table[155] = "ntdll.dll!NtQueryInformationThread";
  175. table[156] = "ntdll.dll!ZwQueryInformationToken";
  176. table[157] = "ntdll.dll!NtQueryInstallUILanguage";
  177. table[158] = "ntdll.dll!NtQueryIntervalProfile";
  178. table[159] = "ntdll.dll!NtQueryIoCompletion";
  179. table[160] = "ntdll.dll!ZwQueryKey";
  180. table[161] = "ntdll.dll!NtQueryMultipleValueKey";
  181. table[162] = "ntdll.dll!NtQueryMutant";
  182. table[163] = "ntdll.dll!NtQueryObject";
  183. table[164] = "ntdll.dll!NtQueryOpenSubKeys";
  184. table[165] = "ntdll.dll!NtQueryPerformanceCounter";
  185. table[166] = "ntdll.dll!ZwQueryQuotaInformationFile";
  186. table[167] = "ntdll.dll!ZwQuerySection";
  187. table[168] = "ntdll.dll!NtQuerySecurityObject";
  188. table[169] = "ntdll.dll!ZwQuerySemaphore";
  189. table[170] = "ntdll.dll!ZwQuerySymbolicLinkObject";
  190. table[171] = "ntdll.dll!ZwQuerySystemEnvironmentValue";
  191. table[172] = "ntdll.dll!ZwQuerySystemEnvironmentValueEx";
  192. table[173] = "ntdll.dll!NtQuerySystemInformation";
  193. table[174] = "ntdll.dll!NtQuerySystemTime";
  194. table[175] = "ntdll.dll!ZwQueryTimer";
  195. table[176] = "ntdll.dll!NtQueryTimerResolution";
  196. table[177] = "ntdll.dll!ZwQueryValueKey";
  197. table[178] = "ntdll.dll!NtQueryVirtualMemory";
  198. table[179] = "ntdll.dll!NtQueryVolumeInformationFile";
  199. table[180] = "ntdll.dll!NtQueueApcThread";
  200. table[181] = "ntdll.dll!ZwRaiseException";
  201. table[182] = "ntdll.dll!ZwRaiseHardError";
  202. table[183] = "ntdll.dll!NtReadFile";
  203. table[184] = "ntdll.dll!NtReadFileScatter";
  204. table[185] = "ntdll.dll!ZwReadRequestData";
  205. table[186] = "ntdll.dll!NtReadVirtualMemory";
  206. table[187] = "ntdll.dll!ZwRegisterThreadTerminatePort";
  207. table[188] = "ntdll.dll!ZwReleaseMutant";
  208. table[189] = "ntdll.dll!NtReleaseSemaphore";
  209. table[190] = "ntdll.dll!ZwRemoveIoCompletion";
  210. table[191] = "ntdll.dll!ZwRemoveProcessDebug";
  211. table[192] = "ntdll.dll!ZwRenameKey";
  212. table[193] = "ntdll.dll!ZwReplaceKey";
  213. table[194] = "ntdll.dll!ZwReplyPort";
  214. table[195] = "ntdll.dll!NtReplyWaitReceivePort";
  215. table[196] = "ntdll.dll!NtReplyWaitReceivePortEx";
  216. table[197] = "ntdll.dll!NtReplyWaitReplyPort";
  217. table[198] = "ntdll.dll!ZwRequestDeviceWakeup";
  218. table[199] = "ntdll.dll!ZwRequestPort";
  219. table[200] = "ntdll.dll!NtRequestWaitReplyPort";
  220. table[201] = "ntdll.dll!ZwRequestWakeupLatency";
  221. table[202] = "ntdll.dll!NtResetEvent";
  222. table[203] = "ntdll.dll!ZwResetWriteWatch";
  223. table[204] = "ntdll.dll!NtRestoreKey";
  224. table[205] = "ntdll.dll!ZwResumeProcess";
  225. table[206] = "ntdll.dll!ZwResumeThread";
  226. table[207] = "ntdll.dll!NtSaveKey";
  227. table[208] = "ntdll.dll!NtSaveKeyEx";
  228. table[209] = "ntdll.dll!NtSaveMergedKeys";
  229. table[210] = "ntdll.dll!NtSecureConnectPort";
  230. table[211] = "ntdll.dll!ZwSetBootEntryOrder";
  231. table[212] = "ntdll.dll!ZwSetBootOptions";
  232. table[213] = "ntdll.dll!ZwSetContextThread";
  233. table[214] = "ntdll.dll!NtSetDebugFilterState";
  234. table[215] = "ntdll.dll!NtSetDefaultHardErrorPort";
  235. table[216] = "ntdll.dll!NtSetDefaultLocale";
  236. table[217] = "ntdll.dll!ZwSetDefaultUILanguage";
  237. table[218] = "ntdll.dll!ZwSetEaFile";
  238. table[219] = "ntdll.dll!NtSetEvent";
  239. table[220] = "ntdll.dll!NtSetEventBoostPriority";
  240. table[221] = "ntdll.dll!NtSetHighEventPair";
  241. table[222] = "ntdll.dll!NtSetHighWaitLowEventPair";
  242. table[223] = "ntdll.dll!ZwSetInformationDebugObject";
  243. table[224] = "ntdll.dll!ZwSetInformationFile";
  244. table[225] = "ntdll.dll!ZwSetInformationJobObject";
  245. table[226] = "ntdll.dll!ZwSetInformationKey";
  246. table[227] = "ntdll.dll!ZwSetInformationObject";
  247. table[228] = "ntdll.dll!ZwSetInformationProcess";
  248. table[229] = "ntdll.dll!ZwSetInformationThread";
  249. table[230] = "ntdll.dll!ZwSetInformationToken";
  250. table[231] = "ntdll.dll!NtSetIntervalProfile";
  251. table[232] = "ntdll.dll!NtSetIoCompletion";
  252. table[233] = "ntdll.dll!ZwSetLdtEntries";
  253. table[234] = "ntdll.dll!ZwSetLowEventPair";
  254. table[235] = "ntdll.dll!ZwSetLowWaitHighEventPair";
  255. table[236] = "ntdll.dll!ZwSetQuotaInformationFile";
  256. table[237] = "ntdll.dll!NtSetSecurityObject";
  257. table[238] = "ntdll.dll!ZwSetSystemEnvironmentValue";
  258. table[239] = "ntdll.dll!ZwSetSystemEnvironmentValueEx";
  259. table[240] = "ntdll.dll!ZwSetSystemInformation";
  260. table[241] = "ntdll.dll!ZwSetSystemPowerState";
  261. table[242] = "ntdll.dll!ZwSetSystemTime";
  262. table[243] = "ntdll.dll!ZwSetThreadExecutionState";
  263. table[244] = "ntdll.dll!ZwSetTimer";
  264. table[245] = "ntdll.dll!NtSetTimerResolution";
  265. table[246] = "ntdll.dll!ZwSetUuidSeed";
  266. table[247] = "ntdll.dll!ZwSetValueKey";
  267. table[248] = "ntdll.dll!NtSetVolumeInformationFile";
  268. table[249] = "ntdll.dll!ZwShutdownSystem";
  269. table[250] = "ntdll.dll!ZwSignalAndWaitForSingleObject";
  270. table[251] = "ntdll.dll!NtStartProfile";
  271. table[252] = "ntdll.dll!ZwStopProfile";
  272. table[253] = "ntdll.dll!ZwSuspendProcess";
  273. table[254] = "ntdll.dll!ZwSuspendThread";
  274. table[255] = "ntdll.dll!NtSystemDebugControl";
  275. table[256] = "ntdll.dll!ZwTerminateJobObject";
  276. table[257] = "ntdll.dll!ZwTerminateProcess";
  277. table[258] = "ntdll.dll!ZwTerminateThread";
  278. table[259] = "ntdll.dll!NtTestAlert";
  279. table[260] = "ntdll.dll!NtTraceEvent";
  280. table[261] = "ntdll.dll!NtTranslateFilePath";
  281. table[262] = "ntdll.dll!ZwUnloadDriver";
  282. table[263] = "ntdll.dll!NtUnloadKey";
  283. table[264] = "ntdll.dll!ZwUnloadKeyEx";
  284. table[265] = "ntdll.dll!ZwUnlockFile";
  285. table[266] = "ntdll.dll!NtUnlockVirtualMemory";
  286. table[267] = "ntdll.dll!NtUnmapViewOfSection";
  287. table[268] = "ntdll.dll!NtVdmControl";
  288. table[269] = "ntdll.dll!NtWaitForDebugEvent";
  289. table[270] = "ntdll.dll!NtWaitForMultipleObjects";
  290. table[271] = "ntdll.dll!ZwWaitForSingleObject";
  291. table[272] = "ntdll.dll!ZwWaitHighEventPair";
  292. table[273] = "ntdll.dll!NtWaitLowEventPair";
  293. table[274] = "ntdll.dll!NtWriteFile";
  294. table[275] = "ntdll.dll!NtWriteFileGather";
  295. table[276] = "ntdll.dll!NtWriteRequestData";
  296. table[277] = "ntdll.dll!NtWriteVirtualMemory";
  297. table[278] = "ntdll.dll!ZwYieldExecution";
  298. table[279] = "ntdll.dll!ZwCreateKeyedEvent";
  299. table[280] = "ntdll.dll!NtOpenKeyedEvent";
  300. table[281] = "ntdll.dll!NtReleaseKeyedEvent";
  301. table[282] = "ntdll.dll!NtWaitForKeyedEvent";
  302. table[283] = "ntdll.dll!ZwQueryPortInformationProcess";
  303. table[4096] = "gdi32.dll!NtGdiAbortDoc";
  304. table[4097] = "gdi32.dll!NtGdiAbortPath";
  305. table[4098] = "gdi32.dll!NtGdiAddFontResourceW";
  306. table[4099] = "gdi32.dll!NtGdiAddRemoteFontToDC";
  307. table[4100] = "gdi32.dll!NtGdiAddFontMemResourceEx";
  308. table[4101] = "gdi32.dll!NtGdiRemoveMergeFont";
  309. table[4102] = "gdi32.dll!NtGdiAddRemoteMMInstanceToDC";
  310. table[4103] = "gdi32.dll!NtGdiAlphaBlend";
  311. table[4104] = "gdi32.dll!NtGdiAngleArc";
  312. table[4105] = "gdi32.dll!NtGdiAnyLinkedFonts";
  313. table[4106] = "gdi32.dll!NtGdiFontIsLinked";
  314. table[4107] = "gdi32.dll!NtGdiArcInternal";
  315. table[4108] = "gdi32.dll!NtGdiBeginPath";
  316. table[4109] = "gdi32.dll!NtGdiBitBlt";
  317. table[4110] = "gdi32.dll!NtGdiCancelDC";
  318. table[4111] = "gdi32.dll!NtGdiCheckBitmapBits";
  319. table[4112] = "gdi32.dll!NtGdiCloseFigure";
  320. table[4113] = "gdi32.dll!NtGdiClearBitmapAttributes";
  321. table[4114] = "gdi32.dll!NtGdiClearBrushAttributes";
  322. table[4115] = "gdi32.dll!NtGdiColorCorrectPalette";
  323. table[4116] = "gdi32.dll!NtGdiCombineRgn";
  324. table[4117] = "gdi32.dll!CombineTransform";
  325. table[4118] = "gdi32.dll!NtGdiComputeXformCoefficients";
  326. table[4119] = "gdi32.dll!NtGdiConsoleTextOut";
  327. table[4120] = "gdi32.dll!NtGdiConvertMetafileRect";
  328. table[4121] = "gdi32.dll!NtGdiCreateBitmap";
  329. table[4122] = "gdi32.dll!NtGdiCreateClientObj";
  330. table[4123] = "gdi32.dll!NtGdiCreateColorSpace";
  331. table[4124] = "gdi32.dll!NtGdiCreateColorTransform";
  332. table[4125] = "gdi32.dll!NtGdiCreateCompatibleBitmap";
  333. table[4126] = "gdi32.dll!NtGdiCreateCompatibleDC";
  334. table[4127] = "gdi32.dll!NtGdiCreateDIBBrush";
  335. table[4128] = "gdi32.dll!NtGdiCreateDIBitmapInternal";
  336. table[4129] = "gdi32.dll!NtGdiCreateDIBSection";
  337. table[4130] = "gdi32.dll!NtGdiCreateEllipticRgn";
  338. table[4131] = "gdi32.dll!NtGdiCreateHalftonePalette";
  339. table[4132] = "gdi32.dll!NtGdiCreateHatchBrushInternal";
  340. table[4133] = "gdi32.dll!NtGdiCreateMetafileDC";
  341. table[4134] = "gdi32.dll!NtGdiCreatePaletteInternal";
  342. table[4135] = "gdi32.dll!NtGdiCreatePatternBrushInternal";
  343. table[4136] = "gdi32.dll!CreatePen";
  344. table[4137] = "gdi32.dll!NtGdiCreateRectRgn";
  345. table[4138] = "gdi32.dll!CreateRoundRectRgn";
  346. table[4139] = "gdi32.dll!NtGdiCreateServerMetaFile";
  347. table[4140] = "gdi32.dll!NtGdiCreateSolidBrush";
  348. table[4141] = "gdi32.dll!NtGdiD3dContextCreate";
  349. table[4142] = "gdi32.dll!NtGdiD3dContextDestroy";
  350. table[4143] = "gdi32.dll!NtGdiD3dContextDestroyAll";
  351. table[4144] = "gdi32.dll!NtGdiD3dValidateTextureStageState";
  352. table[4145] = "gdi32.dll!NtGdiD3dDrawPrimitives2";
  353. table[4146] = "gdi32.dll!NtGdiDdGetDriverState";
  354. table[4147] = "gdi32.dll!NtGdiDdAddAttachedSurface";
  355. table[4148] = "gdi32.dll!NtGdiDdAlphaBlt";
  356. table[4149] = "gdi32.dll!NtGdiDdAttachSurface";
  357. table[4150] = "gdi32.dll!NtGdiDdBeginMoCompFrame";
  358. table[4151] = "gdi32.dll!NtGdiDdBlt";
  359. table[4152] = "gdi32.dll!NtGdiDdCanCreateSurface";
  360. table[4153] = "gdi32.dll!NtGdiDdCanCreateD3DBuffer";
  361. table[4154] = "gdi32.dll!NtGdiDdColorControl";
  362. table[4155] = "gdi32.dll!NtGdiDdCreateDirectDrawObject";
  363. table[4156] = "gdi32.dll!NtGdiDdCreateSurface";
  364. table[4157] = "gdi32.dll!NtGdiDdCreateD3DBuffer";
  365. table[4158] = "gdi32.dll!NtGdiDdCreateMoComp";
  366. table[4159] = "gdi32.dll!NtGdiDdCreateSurfaceObject";
  367. table[4160] = "gdi32.dll!NtGdiDdDeleteDirectDrawObject";
  368. table[4161] = "gdi32.dll!NtGdiDdDeleteSurfaceObject";
  369. table[4162] = "gdi32.dll!NtGdiDdDestroyMoComp";
  370. table[4163] = "gdi32.dll!NtGdiDdDestroySurface";
  371. table[4164] = "gdi32.dll!NtGdiDdDestroyD3DBuffer";
  372. table[4165] = "gdi32.dll!NtGdiDdEndMoCompFrame";
  373. table[4166] = "gdi32.dll!NtGdiDdFlip";
  374. table[4167] = "gdi32.dll!NtGdiDdFlipToGDISurface";
  375. table[4168] = "gdi32.dll!NtGdiDdGetAvailDriverMemory";
  376. table[4169] = "gdi32.dll!NtGdiDdGetBltStatus";
  377. table[4170] = "gdi32.dll!NtGdiDdGetDC";
  378. table[4171] = "gdi32.dll!NtGdiDdGetDriverInfo";
  379. table[4172] = "gdi32.dll!NtGdiDdGetDxHandle";
  380. table[4173] = "gdi32.dll!NtGdiDdGetFlipStatus";
  381. table[4174] = "gdi32.dll!NtGdiDdGetInternalMoCompInfo";
  382. table[4175] = "gdi32.dll!NtGdiDdGetMoCompBuffInfo";
  383. table[4176] = "gdi32.dll!NtGdiDdGetMoCompGuids";
  384. table[4177] = "gdi32.dll!NtGdiDdGetMoCompFormats";
  385. table[4178] = "gdi32.dll!NtGdiDdGetScanLine";
  386. table[4179] = "gdi32.dll!NtGdiDdLock";
  387. table[4180] = "gdi32.dll!NtGdiDdLockD3D";
  388. table[4181] = "gdi32.dll!NtGdiDdQueryDirectDrawObject";
  389. table[4182] = "gdi32.dll!NtGdiDdQueryMoCompStatus";
  390. table[4183] = "gdi32.dll!NtGdiDdReenableDirectDrawObject";
  391. table[4184] = "gdi32.dll!NtGdiDdReleaseDC";
  392. table[4185] = "gdi32.dll!NtGdiDdRenderMoComp";
  393. table[4186] = "gdi32.dll!NtGdiDdResetVisrgn";
  394. table[4187] = "gdi32.dll!NtGdiDdSetColorKey";
  395. table[4188] = "gdi32.dll!NtGdiDdSetExclusiveMode";
  396. table[4189] = "gdi32.dll!NtGdiDdSetGammaRamp";
  397. table[4190] = "gdi32.dll!NtGdiDdCreateSurfaceEx";
  398. table[4191] = "gdi32.dll!NtGdiDdSetOverlayPosition";
  399. table[4192] = "gdi32.dll!NtGdiDdUnattachSurface";
  400. table[4193] = "gdi32.dll!NtGdiDdUnlock";
  401. table[4194] = "gdi32.dll!NtGdiDdUnlockD3D";
  402. table[4195] = "gdi32.dll!NtGdiDdUpdateOverlay";
  403. table[4196] = "gdi32.dll!NtGdiDdWaitForVerticalBlank";
  404. table[4197] = "gdi32.dll!NtGdiDvpCanCreateVideoPort";
  405. table[4198] = "gdi32.dll!NtGdiDvpColorControl";
  406. table[4199] = "gdi32.dll!NtGdiDvpCreateVideoPort";
  407. table[4200] = "gdi32.dll!NtGdiDvpDestroyVideoPort";
  408. table[4201] = "gdi32.dll!NtGdiDvpFlipVideoPort";
  409. table[4202] = "gdi32.dll!NtGdiDvpGetVideoPortBandwidth";
  410. table[4203] = "gdi32.dll!NtGdiDvpGetVideoPortField";
  411. table[4204] = "gdi32.dll!NtGdiDvpGetVideoPortFlipStatus";
  412. table[4205] = "gdi32.dll!NtGdiDvpGetVideoPortInputFormats";
  413. table[4206] = "gdi32.dll!NtGdiDvpGetVideoPortLine";
  414. table[4207] = "gdi32.dll!NtGdiDvpGetVideoPortOutputFormats";
  415. table[4208] = "gdi32.dll!NtGdiDvpGetVideoPortConnectInfo";
  416. table[4209] = "gdi32.dll!NtGdiDvpGetVideoSignalStatus";
  417. table[4210] = "gdi32.dll!NtGdiDvpUpdateVideoPort";
  418. table[4211] = "gdi32.dll!NtGdiDvpWaitForVideoPortSync";
  419. table[4212] = "gdi32.dll!NtGdiDvpAcquireNotification";
  420. table[4213] = "gdi32.dll!NtGdiDvpReleaseNotification";
  421. table[4214] = "gdi32.dll!NtGdiDxgGenericThunk";
  422. table[4215] = "gdi32.dll!NtGdiDeleteClientObj";
  423. table[4216] = "gdi32.dll!NtGdiDeleteColorSpace";
  424. table[4217] = "gdi32.dll!NtGdiDeleteColorTransform";
  425. table[4218] = "gdi32.dll!DeleteObject";
  426. table[4219] = "gdi32.dll!NtGdiDescribePixelFormat";
  427. table[4220] = "gdi32.dll!NtGdiGetPerBandInfo";
  428. table[4221] = "gdi32.dll!NtGdiDoBanding";
  429. table[4222] = "gdi32.dll!NtGdiDoPalette";
  430. table[4223] = "gdi32.dll!NtGdiDrawEscape";
  431. table[4224] = "gdi32.dll!NtGdiEllipse";
  432. table[4225] = "gdi32.dll!NtGdiEnableEudc";
  433. table[4226] = "gdi32.dll!NtGdiEndDoc";
  434. table[4227] = "gdi32.dll!NtGdiEndPage";
  435. table[4228] = "gdi32.dll!NtGdiEndPath";
  436. table[4229] = "gdi32.dll!NtGdiEnumFontChunk";
  437. table[4230] = "gdi32.dll!NtGdiEnumFontClose";
  438. table[4231] = "gdi32.dll!NtGdiEnumFontOpen";
  439. table[4232] = "gdi32.dll!NtGdiEnumObjects";
  440. table[4233] = "gdi32.dll!NtGdiEqualRgn";
  441. table[4234] = "gdi32.dll!NtGdiEudcLoadUnloadLink";
  442. table[4235] = "gdi32.dll!NtGdiExcludeClipRect";
  443. table[4236] = "gdi32.dll!NtGdiExtCreatePen";
  444. table[4237] = "gdi32.dll!NtGdiExtCreateRegion";
  445. table[4238] = "gdi32.dll!NtGdiExtEscape";
  446. table[4239] = "gdi32.dll!NtGdiExtFloodFill";
  447. table[4240] = "gdi32.dll!NtGdiExtGetObjectW";
  448. table[4241] = "gdi32.dll!ExtSelectClipRgn";
  449. table[4242] = "gdi32.dll!NtGdiExtTextOutW";
  450. table[4243] = "gdi32.dll!NtGdiFillPath";
  451. table[4244] = "gdi32.dll!NtGdiFillRgn";
  452. table[4245] = "gdi32.dll!NtGdiFlattenPath";
  453. table[4247] = "gdi32.dll!NtGdiFlush";
  454. table[4248] = "gdi32.dll!NtGdiForceUFIMapping";
  455. table[4249] = "gdi32.dll!NtGdiFrameRgn";
  456. table[4250] = "gdi32.dll!NtGdiFullscreenControl";
  457. table[4251] = "gdi32.dll!NtGdiGetAndSetDCDword";
  458. table[4252] = "gdi32.dll!GetClipBox";
  459. table[4253] = "gdi32.dll!GetBitmapBits";
  460. table[4254] = "gdi32.dll!NtGdiGetBitmapDimension";
  461. table[4255] = "gdi32.dll!NtGdiGetBoundsRect";
  462. table[4256] = "gdi32.dll!NtGdiGetCharABCWidthsW";
  463. table[4257] = "gdi32.dll!NtGdiGetCharacterPlacementW";
  464. table[4258] = "gdi32.dll!NtGdiGetCharSet";
  465. table[4259] = "gdi32.dll!NtGdiGetCharWidthW";
  466. table[4260] = "gdi32.dll!NtGdiGetCharWidthInfo";
  467. table[4261] = "gdi32.dll!NtGdiGetColorAdjustment";
  468. table[4263] = "gdi32.dll!NtGdiGetDCDword";
  469. table[4264] = "gdi32.dll!NtGdiGetDCforBitmap";
  470. table[4265] = "gdi32.dll!NtGdiGetDCObject";
  471. table[4266] = "gdi32.dll!NtGdiGetDCPoint";
  472. table[4267] = "gdi32.dll!NtGdiGetDeviceCaps";
  473. table[4268] = "gdi32.dll!NtGdiGetDeviceGammaRamp";
  474. table[4269] = "gdi32.dll!NtGdiGetDeviceCapsAll";
  475. table[4270] = "gdi32.dll!NtGdiGetDIBitsInternal";
  476. table[4271] = "gdi32.dll!NtGdiGetETM";
  477. table[4272] = "gdi32.dll!NtGdiGetEudcTimeStampEx";
  478. table[4273] = "gdi32.dll!GetFontData";
  479. table[4274] = "gdi32.dll!NtGdiGetFontResourceInfoInternalW";
  480. table[4275] = "gdi32.dll!NtGdiGetGlyphIndicesW";
  481. table[4276] = "gdi32.dll!NtGdiGetGlyphIndicesWInternal";
  482. table[4277] = "gdi32.dll!NtGdiGetGlyphOutline";
  483. table[4278] = "gdi32.dll!NtGdiGetKerningPairs";
  484. table[4279] = "gdi32.dll!NtGdiGetLinkedUFIs";
  485. table[4280] = "gdi32.dll!GetMiterLimit";
  486. table[4281] = "gdi32.dll!NtGdiGetMonitorID";
  487. table[4282] = "gdi32.dll!GetNearestColor";
  488. table[4283] = "gdi32.dll!NtGdiGetNearestPaletteIndex";
  489. table[4284] = "gdi32.dll!NtGdiGetObjectBitmapHandle";
  490. table[4285] = "gdi32.dll!NtGdiGetOutlineTextMetricsInternalW";
  491. table[4286] = "gdi32.dll!NtGdiGetPath";
  492. table[4287] = "gdi32.dll!NtGdiGetPixel";
  493. table[4288] = "gdi32.dll!NtGdiGetRandomRgn";
  494. table[4289] = "gdi32.dll!GetRasterizerCaps";
  495. table[4290] = "gdi32.dll!NtGdiGetRealizationInfo";
  496. table[4291] = "gdi32.dll!GetRegionData";
  497. table[4292] = "gdi32.dll!NtGdiGetRgnBox";
  498. table[4293] = "gdi32.dll!NtGdiGetServerMetaFileBits";
  499. table[4294] = "gdi32.dll!NtGdiGetSpoolMessage";
  500. table[4296] = "gdi32.dll!NtGdiGetStockObject";
  501. table[4297] = "gdi32.dll!NtGdiGetStringBitmapW";
  502. table[4298] = "gdi32.dll!GetSystemPaletteUse";
  503. table[4299] = "gdi32.dll!NtGdiGetTextCharsetInfo";
  504. table[4300] = "gdi32.dll!NtGdiGetTextExtent";
  505. table[4301] = "gdi32.dll!NtGdiGetTextExtentExW";
  506. table[4302] = "gdi32.dll!NtGdiGetTextFaceW";
  507. table[4303] = "gdi32.dll!NtGdiGetTextMetricsW";
  508. table[4304] = "gdi32.dll!NtGdiGetTransform";
  509. table[4305] = "gdi32.dll!NtGdiGetUFI";
  510. table[4306] = "gdi32.dll!NtGdiGetEmbUFI";
  511. table[4307] = "gdi32.dll!NtGdiGetUFIPathname";
  512. table[4308] = "gdi32.dll!NtGdiGetEmbedFonts";
  513. table[4309] = "gdi32.dll!NtGdiChangeGhostFont";
  514. table[4310] = "gdi32.dll!NtGdiAddEmbFontToDC";
  515. table[4311] = "gdi32.dll!NtGdiGetFontUnicodeRanges";
  516. table[4312] = "gdi32.dll!NtGdiGetWidthTable";
  517. table[4313] = "gdi32.dll!NtGdiGradientFill";
  518. table[4314] = "gdi32.dll!NtGdiHfontCreate";
  519. table[4315] = "gdi32.dll!NtGdiIcmBrushInfo";
  520. table[4316] = "gdi32.dll!NtGdiInit";
  521. table[4317] = "gdi32.dll!NtGdiInitSpool";
  522. table[4318] = "gdi32.dll!NtGdiIntersectClipRect";
  523. table[4319] = "gdi32.dll!NtGdiInvertRgn";
  524. table[4320] = "gdi32.dll!NtGdiLineTo";
  525. table[4321] = "gdi32.dll!NtGdiMakeFontDir";
  526. table[4322] = "gdi32.dll!NtGdiMakeInfoDC";
  527. table[4323] = "gdi32.dll!NtGdiMaskBlt";
  528. table[4324] = "gdi32.dll!NtGdiModifyWorldTransform";
  529. table[4325] = "gdi32.dll!NtGdiMonoBitmap";
  530. table[4327] = "gdi32.dll!NtGdiOffsetClipRgn";
  531. table[4328] = "gdi32.dll!NtGdiOffsetRgn";
  532. table[4329] = "gdi32.dll!NtGdiOpenDCW";
  533. table[4330] = "gdi32.dll!NtGdiPatBlt";
  534. table[4331] = "gdi32.dll!NtGdiPolyPatBlt";
  535. table[4332] = "gdi32.dll!NtGdiPathToRegion";
  536. table[4333] = "gdi32.dll!NtGdiPlgBlt";
  537. table[4334] = "gdi32.dll!NtGdiPolyDraw";
  538. table[4335] = "gdi32.dll!NtGdiPolyPolyDraw";
  539. table[4336] = "gdi32.dll!NtGdiPolyTextOutW";
  540. table[4337] = "gdi32.dll!NtGdiPtInRegion";
  541. table[4338] = "gdi32.dll!NtGdiPtVisible";
  542. table[4339] = "gdi32.dll!NtGdiQueryFonts";
  543. table[4340] = "gdi32.dll!NtGdiQueryFontAssocInfo";
  544. table[4341] = "gdi32.dll!NtGdiRectangle";
  545. table[4342] = "gdi32.dll!NtGdiRectInRegion";
  546. table[4343] = "gdi32.dll!RectVisible";
  547. table[4344] = "gdi32.dll!NtGdiRemoveFontResourceW";
  548. table[4345] = "gdi32.dll!NtGdiRemoveFontMemResourceEx";
  549. table[4346] = "gdi32.dll!NtGdiResetDC";
  550. table[4347] = "gdi32.dll!NtGdiResizePalette";
  551. table[4348] = "gdi32.dll!NtGdiRestoreDC";
  552. table[4349] = "gdi32.dll!NtGdiRoundRect";
  553. table[4350] = "gdi32.dll!NtGdiSaveDC";
  554. table[4351] = "gdi32.dll!NtGdiScaleViewportExtEx";
  555. table[4352] = "gdi32.dll!NtGdiScaleWindowExtEx";
  556. table[4353] = "gdi32.dll!NtGdiSelectBitmap";
  557. table[4355] = "gdi32.dll!NtGdiSelectClipPath";
  558. table[4356] = "gdi32.dll!NtGdiSelectFont";
  559. table[4357] = "gdi32.dll!NtGdiSelectPen";
  560. table[4358] = "gdi32.dll!NtGdiSetBitmapAttributes";
  561. table[4359] = "gdi32.dll!SetBitmapBits";
  562. table[4360] = "gdi32.dll!NtGdiSetBitmapDimension";
  563. table[4361] = "gdi32.dll!NtGdiSetBoundsRect";
  564. table[4362] = "gdi32.dll!NtGdiSetBrushAttributes";
  565. table[4363] = "gdi32.dll!NtGdiSetBrushOrg";
  566. table[4364] = "gdi32.dll!NtGdiSetColorAdjustment";
  567. table[4365] = "gdi32.dll!NtGdiSetColorSpace";
  568. table[4366] = "gdi32.dll!NtGdiSetDeviceGammaRamp";
  569. table[4367] = "gdi32.dll!NtGdiSetDIBitsToDeviceInternal";
  570. table[4368] = "gdi32.dll!NtGdiSetFontEnumeration";
  571. table[4369] = "gdi32.dll!NtGdiSetFontXform";
  572. table[4370] = "gdi32.dll!NtGdiSetIcmMode";
  573. table[4371] = "gdi32.dll!NtGdiSetLinkedUFIs";
  574. table[4372] = "gdi32.dll!NtGdiSetMagicColors";
  575. table[4373] = "gdi32.dll!NtGdiSetMetaRgn";
  576. table[4374] = "gdi32.dll!NtGdiSetMiterLimit";
  577. table[4375] = "gdi32.dll!NtGdiGetDeviceWidth";
  578. table[4376] = "gdi32.dll!NtGdiMirrorWindowOrg";
  579. table[4377] = "gdi32.dll!NtGdiSetLayout";
  580. table[4378] = "gdi32.dll!NtGdiSetPixel";
  581. table[4379] = "gdi32.dll!NtGdiSetPixelFormat";
  582. table[4380] = "gdi32.dll!NtGdiSetRectRgn";
  583. table[4381] = "gdi32.dll!NtGdiSetSystemPaletteUse";
  584. table[4383] = "gdi32.dll!NtGdiSetupPublicCFONT";
  585. table[4384] = "gdi32.dll!NtGdiSetVirtualResolution";
  586. table[4385] = "gdi32.dll!NtGdiSetSizeDevice";
  587. table[4386] = "gdi32.dll!NtGdiStartDoc";
  588. table[4387] = "gdi32.dll!NtGdiStartPage";
  589. table[4388] = "gdi32.dll!NtGdiStretchBlt";
  590. table[4389] = "gdi32.dll!NtGdiStretchDIBitsInternal";
  591. table[4390] = "gdi32.dll!NtGdiStrokeAndFillPath";
  592. table[4391] = "gdi32.dll!NtGdiStrokePath";
  593. table[4392] = "gdi32.dll!NtGdiSwapBuffers";
  594. table[4393] = "gdi32.dll!NtGdiTransformPoints";
  595. table[4394] = "gdi32.dll!NtGdiTransparentBlt";
  596. table[4395] = "gdi32.dll!NtGdiUnloadPrinterDriver";
  597. table[4397] = "gdi32.dll!NtGdiUnrealizeObject";
  598. table[4398] = "gdi32.dll!NtGdiUpdateColors";
  599. table[4399] = "gdi32.dll!NtGdiWidenPath";
  600. table[4400] = "user32.dll!NtUserActivateKeyboardLayout";
  601. table[4401] = "user32.dll!NtUserAlterWindowStyle";
  602. table[4402] = "imm32.dll!NtUserAssociateInputContext";
  603. table[4403] = "user32.dll!NtUserAttachThreadInput";
  604. table[4404] = "user32.dll!NtUserBeginPaint";
  605. table[4405] = "user32.dll!NtUserBitBltSysBmp";
  606. table[4406] = "user32.dll!NtUserBlockInput";
  607. table[4407] = "imm32.dll!NtUserBuildHimcList";
  608. table[4408] = "user32.dll!NtUserBuildHwndList";
  609. table[4409] = "user32.dll!NtUserBuildNameList";
  610. table[4410] = "user32.dll!NtUserBuildPropList";
  611. table[4411] = "user32.dll!NtUserCallHwnd";
  612. table[4412] = "user32.dll!NtUserCallHwndLock";
  613. table[4413] = "user32.dll!NtUserCallHwndOpt";
  614. table[4414] = "user32.dll!NtUserCallHwndParam";
  615. table[4415] = "user32.dll!NtUserCallHwndParamLock";
  616. table[4416] = "user32.dll!NtUserCallMsgFilter";
  617. table[4417] = "user32.dll!NtUserCallNextHookEx";
  618. table[4418] = "user32.dll!NtUserCallNoParam";
  619. table[4419] = "imm32.dll!NtUserCallOneParam";
  620. table[4419] = "user32.dll!NtUserCallOneParam";
  621. table[4420] = "user32.dll!NtUserCallTwoParam";
  622. table[4421] = "user32.dll!NtUserChangeClipboardChain";
  623. table[4422] = "user32.dll!NtUserChangeDisplaySettings";
  624. table[4424] = "user32.dll!NtUserCheckMenuItem";
  625. table[4425] = "user32.dll!NtUserChildWindowFromPointEx";
  626. table[4426] = "user32.dll!NtUserClipCursor";
  627. table[4427] = "user32.dll!NtUserCloseClipboard";
  628. table[4428] = "user32.dll!NtUserCloseDesktop";
  629. table[4429] = "user32.dll!NtUserCloseWindowStation";
  630. table[4431] = "user32.dll!NtUserConvertMemHandle";
  631. table[4432] = "user32.dll!NtUserCopyAcceleratorTable";
  632. table[4433] = "user32.dll!NtUserCountClipboardFormats";
  633. table[4434] = "user32.dll!NtUserCreateAcceleratorTable";
  634. table[4435] = "user32.dll!NtUserCreateCaret";
  635. table[4436] = "user32.dll!NtUserCreateDesktop";
  636. table[4437] = "imm32.dll!NtUserCreateInputContext";
  637. table[4438] = "user32.dll!NtUserCreateLocalMemHandle";
  638. table[4439] = "user32.dll!NtUserCreateWindowEx";
  639. table[4440] = "user32.dll!NtUserCreateWindowStation";
  640. table[4441] = "user32.dll!NtUserDdeGetQualityOfService";
  641. table[4442] = "user32.dll!NtUserDdeInitialize";
  642. table[4443] = "user32.dll!NtUserDdeSetQualityOfService";
  643. table[4444] = "user32.dll!NtUserDeferWindowPos";
  644. table[4445] = "user32.dll!NtUserDefSetText";
  645. table[4446] = "user32.dll!NtUserDeleteMenu";
  646. table[4447] = "user32.dll!DestroyAcceleratorTable";
  647. table[4448] = "user32.dll!NtUserDestroyCursor";
  648. table[4449] = "imm32.dll!NtUserDestroyInputContext";
  649. table[4450] = "user32.dll!NtUserDestroyMenu";
  650. table[4451] = "user32.dll!NtUserDestroyWindow";
  651. table[4452] = "imm32.dll!NtUserDisableThreadIme";
  652. table[4453] = "user32.dll!NtUserDispatchMessage";
  653. table[4454] = "user32.dll!NtUserDragDetect";
  654. table[4455] = "user32.dll!NtUserDragObject";
  655. table[4456] = "user32.dll!NtUserDrawAnimatedRects";
  656. table[4457] = "user32.dll!NtUserDrawCaption";
  657. table[4458] = "user32.dll!NtUserDrawCaptionTemp";
  658. table[4459] = "user32.dll!NtUserDrawIconEx";
  659. table[4460] = "user32.dll!NtUserDrawMenuBarTemp";
  660. table[4461] = "user32.dll!NtUserEmptyClipboard";
  661. table[4462] = "user32.dll!NtUserEnableMenuItem";
  662. table[4463] = "user32.dll!NtUserEnableScrollBar";
  663. table[4464] = "user32.dll!NtUserEndDeferWindowPosEx";
  664. table[4465] = "user32.dll!NtUserEndMenu";
  665. table[4466] = "user32.dll!NtUserEndPaint";
  666. table[4467] = "user32.dll!NtUserEnumDisplayDevices";
  667. table[4468] = "user32.dll!NtUserEnumDisplayMonitors";
  668. table[4469] = "user32.dll!NtUserEnumDisplaySettings";
  669. table[4470] = "user32.dll!NtUserEvent";
  670. table[4471] = "user32.dll!NtUserExcludeUpdateRgn";
  671. table[4472] = "user32.dll!NtUserFillWindow";
  672. table[4473] = "user32.dll!NtUserFindExistingCursorIcon";
  673. table[4474] = "user32.dll!NtUserFindWindowEx";
  674. table[4475] = "user32.dll!NtUserFlashWindowEx";
  675. table[4476] = "user32.dll!NtUserGetAltTabInfo";
  676. table[4477] = "user32.dll!NtUserGetAncestor";
  677. table[4478] = "imm32.dll!NtUserGetAppImeLevel";
  678. table[4479] = "user32.dll!GetAsyncKeyState";
  679. table[4480] = "user32.dll!NtUserGetAtomName";
  680. table[4481] = "user32.dll!NtUserGetCaretBlinkTime";
  681. table[4482] = "user32.dll!NtUserGetCaretPos";
  682. table[4483] = "user32.dll!NtUserGetClassInfo";
  683. table[4484] = "user32.dll!NtUserGetClassName";
  684. table[4485] = "user32.dll!NtUserGetClipboardData";
  685. table[4486] = "user32.dll!NtUserGetClipboardFormatName";
  686. table[4487] = "user32.dll!NtUserGetClipboardOwner";
  687. table[4488] = "user32.dll!NtUserGetClipboardSequenceNumber";
  688. table[4489] = "user32.dll!NtUserGetClipboardViewer";
  689. table[4490] = "user32.dll!NtUserGetClipCursor";
  690. table[4491] = "user32.dll!NtUserGetComboBoxInfo";
  691. table[4492] = "user32.dll!NtUserGetControlBrush";
  692. table[4493] = "user32.dll!NtUserGetControlColor";
  693. table[4494] = "user32.dll!NtUserGetCPD";
  694. table[4495] = "user32.dll!NtUserGetCursorFrameInfo";
  695. table[4496] = "user32.dll!NtUserGetCursorInfo";
  696. table[4497] = "user32.dll!NtUserGetDC";
  697. table[4498] = "user32.dll!NtUserGetDCEx";
  698. table[4499] = "user32.dll!NtUserGetDoubleClickTime";
  699. table[4500] = "user32.dll!NtUserGetForegroundWindow";
  700. table[4501] = "user32.dll!NtUserGetGuiResources";
  701. table[4502] = "user32.dll!NtUserGetGUIThreadInfo";
  702. table[4503] = "user32.dll!NtUserGetIconInfo";
  703. table[4504] = "user32.dll!NtUserGetIconSize";
  704. table[4505] = "imm32.dll!NtUserGetImeHotKey";
  705. table[4505] = "user32.dll!NtUserGetImeHotKey";
  706. table[4506] = "imm32.dll!NtUserGetImeInfoEx";
  707. table[4507] = "user32.dll!NtUserGetInternalWindowPos";
  708. table[4508] = "user32.dll!NtUserGetKeyboardLayoutList";
  709. table[4509] = "user32.dll!NtUserGetKeyboardLayoutName";
  710. table[4510] = "user32.dll!NtUserGetKeyboardState";
  711. table[4511] = "user32.dll!NtUserGetKeyNameText";
  712. table[4512] = "user32.dll!NtUserGetKeyState";
  713. table[4513] = "user32.dll!NtUserGetListBoxInfo";
  714. table[4514] = "user32.dll!NtUserGetMenuBarInfo";
  715. table[4515] = "user32.dll!NtUserGetMenuIndex";
  716. table[4516] = "user32.dll!NtUserGetMenuItemRect";
  717. table[4517] = "user32.dll!NtUserGetMessage";
  718. table[4518] = "user32.dll!NtUserGetMouseMovePointsEx";
  719. table[4519] = "user32.dll!NtUserGetObjectInformation";
  720. table[4520] = "user32.dll!NtUserGetOpenClipboardWindow";
  721. table[4521] = "user32.dll!NtUserGetPriorityClipboardFormat";
  722. table[4522] = "user32.dll!NtUserGetProcessWindowStation";
  723. table[4523] = "user32.dll!NtUserGetRawInputBuffer";
  724. table[4524] = "user32.dll!NtUserGetRawInputData";
  725. table[4525] = "user32.dll!NtUserGetRawInputDeviceInfo";
  726. table[4526] = "user32.dll!NtUserGetRawInputDeviceList";
  727. table[4527] = "user32.dll!NtUserGetRegisteredRawInputDevices";
  728. table[4528] = "user32.dll!NtUserGetScrollBarInfo";
  729. table[4529] = "user32.dll!NtUserGetSystemMenu";
  730. table[4530] = "user32.dll!NtUserGetThreadDesktop";
  731. table[4531] = "imm32.dll!NtUserGetThreadState";
  732. table[4531] = "user32.dll!NtUserGetThreadState";
  733. table[4532] = "user32.dll!NtUserGetTitleBarInfo";
  734. table[4533] = "user32.dll!GetUpdateRect";
  735. table[4534] = "user32.dll!GetUpdateRgn";
  736. table[4535] = "user32.dll!NtUserGetWindowDC";
  737. table[4536] = "user32.dll!NtUserGetWindowPlacement";
  738. table[4537] = "user32.dll!NtUserGetWOWClass";
  739. table[4539] = "user32.dll!NtUserHideCaret";
  740. table[4540] = "user32.dll!NtUserHiliteMenuItem";
  741. table[4541] = "user32.dll!NtUserImpersonateDdeClientWindow";
  742. table[4543] = "user32.dll!NtUserInitializeClientPfnArrays";
  743. table[4544] = "user32.dll!NtUserInitTask";
  744. table[4545] = "user32.dll!NtUserInternalGetWindowText";
  745. table[4546] = "user32.dll!NtUserInvalidateRect";
  746. table[4547] = "user32.dll!NtUserInvalidateRgn";
  747. table[4548] = "user32.dll!NtUserIsClipboardFormatAvailable";
  748. table[4549] = "user32.dll!NtUserKillTimer";
  749. table[4550] = "user32.dll!NtUserLoadKeyboardLayoutEx";
  750. table[4551] = "user32.dll!NtUserLockWindowStation";
  751. table[4552] = "user32.dll!NtUserLockWindowUpdate";
  752. table[4553] = "user32.dll!NtUserLockWorkStation";
  753. table[4554] = "user32.dll!NtUserMapVirtualKeyEx";
  754. table[4555] = "user32.dll!NtUserMenuItemFromPoint";
  755. table[4556] = "user32.dll!NtUserMessageCall";
  756. table[4557] = "user32.dll!NtUserMinMaximize";
  757. table[4558] = "user32.dll!NtUserMNDragLeave";
  758. table[4559] = "user32.dll!NtUserMNDragOver";
  759. table[4560] = "user32.dll!NtUserModifyUserStartupInfoFlags";
  760. table[4561] = "user32.dll!NtUserMoveWindow";
  761. table[4562] = "imm32.dll!NtUserNotifyIMEStatus";
  762. table[4562] = "user32.dll!NtUserNotifyIMEStatus";
  763. table[4564] = "user32.dll!NtUserNotifyWinEvent";
  764. table[4565] = "user32.dll!NtUserOpenClipboard";
  765. table[4566] = "user32.dll!NtUserOpenDesktop";
  766. table[4567] = "user32.dll!NtUserOpenInputDesktop";
  767. table[4568] = "user32.dll!NtUserOpenWindowStation";
  768. table[4569] = "user32.dll!NtUserPaintDesktop";
  769. table[4570] = "user32.dll!PeekMessageW";
  770. table[4571] = "user32.dll!NtUserPostMessage";
  771. table[4572] = "user32.dll!NtUserPostThreadMessage";
  772. table[4573] = "user32.dll!NtUserPrintWindow";
  773. table[4574] = "user32.dll!NtUserProcessConnect";
  774. table[4576] = "imm32.dll!NtUserQueryInputContext";
  775. table[4577] = "user32.dll!NtUserQuerySendMessage";
  776. table[4578] = "user32.dll!NtUserQueryUserCounters";
  777. table[4579] = "imm32.dll!NtUserQueryWindow";
  778. table[4579] = "user32.dll!NtUserQueryWindow";
  779. table[4580] = "user32.dll!NtUserRealChildWindowFromPoint";
  780. table[4581] = "user32.dll!NtUserRealInternalGetMessage";
  781. table[4582] = "user32.dll!NtUserRealWaitMessageEx";
  782. table[4583] = "user32.dll!NtUserRedrawWindow";
  783. table[4584] = "user32.dll!NtUserRegisterClassExWOW";
  784. table[4585] = "user32.dll!NtUserRegisterUserApiHook";
  785. table[4586] = "user32.dll!NtUserRegisterHotKey";
  786. table[4587] = "user32.dll!NtUserRegisterRawInputDevices";
  787. table[4588] = "user32.dll!NtUserRegisterTasklist";
  788. table[4589] = "user32.dll!NtUserRegisterWindowMessage";
  789. table[4590] = "user32.dll!NtUserRemoveMenu";
  790. table[4591] = "user32.dll!NtUserRemoveProp";
  791. table[4593] = "user32.dll!NtUserResolveDesktopForWOW";
  792. table[4594] = "user32.dll!NtUserSBGetParms";
  793. table[4595] = "user32.dll!ScrollDC";
  794. table[4596] = "user32.dll!NtUserScrollWindowEx";
  795. table[4597] = "gdi32.dll!NtUserSelectPalette";
  796. table[4598] = "user32.dll!NtUserSendInput";
  797. table[4599] = "user32.dll!NtUserSetActiveWindow";
  798. table[4600] = "imm32.dll!NtUserSetAppImeLevel";
  799. table[4601] = "user32.dll!NtUserSetCapture";
  800. table[4602] = "user32.dll!NtUserSetClassLong";
  801. table[4603] = "user32.dll!NtUserSetClassWord";
  802. table[4604] = "user32.dll!NtUserSetClipboardData";
  803. table[4605] = "user32.dll!NtUserSetClipboardViewer";
  804. table[4606] = "user32.dll!NtUserSetConsoleReserveKeys";
  805. table[4607] = "user32.dll!NtUserSetCursor";
  806. table[4608] = "user32.dll!NtUserSetCursorContents";
  807. table[4609] = "user32.dll!NtUserSetCursorIconData";
  808. table[4610] = "user32.dll!NtUserSetDbgTag";
  809. table[4611] = "user32.dll!NtUserSetFocus";
  810. table[4612] = "user32.dll!NtUserSetImeHotKey";
  811. table[4613] = "imm32.dll!NtUserSetImeInfoEx";
  812. table[4614] = "user32.dll!NtUserSetImeOwnerWindow";
  813. table[4616] = "user32.dll!NtUserSetInformationThread";
  814. table[4617] = "user32.dll!NtUserSetInternalWindowPos";
  815. table[4618] = "user32.dll!NtUserSetKeyboardState";
  816. table[4619] = "user32.dll!NtUserSetLogonNotifyWindow";
  817. table[4620] = "user32.dll!NtUserSetMenu";
  818. table[4621] = "user32.dll!NtUserSetMenuContextHelpId";
  819. table[4622] = "user32.dll!NtUserSetMenuDefaultItem";
  820. table[4623] = "user32.dll!NtUserSetMenuFlagRtoL";
  821. table[4624] = "user32.dll!NtUserSetObjectInformation";
  822. table[4625] = "user32.dll!NtUserSetParent";
  823. table[4626] = "user32.dll!NtUserSetProcessWindowStation";
  824. table[4627] = "user32.dll!NtUserSetProp";
  825. table[4628] = "user32.dll!NtUserSetRipFlags";
  826. table[4629] = "user32.dll!NtUserSetScrollInfo";
  827. table[4630] = "user32.dll!NtUserSetShellWindowEx";
  828. table[4631] = "user32.dll!NtUserSetSysColors";
  829. table[4632] = "user32.dll!NtUserSetSystemCursor";
  830. table[4633] = "user32.dll!NtUserSetSystemMenu";
  831. table[4634] = "user32.dll!NtUserSetSystemTimer";
  832. table[4635] = "user32.dll!NtUserSetThreadDesktop";
  833. table[4636] = "imm32.dll!NtUserSetThreadLayoutHandles";
  834. table[4637] = "user32.dll!NtUserSetThreadState";
  835. table[4638] = "user32.dll!NtUserSetTimer";
  836. table[4639] = "user32.dll!NtUserSetWindowFNID";
  837. table[4640] = "user32.dll!NtUserSetWindowLong";
  838. table[4641] = "user32.dll!NtUserSetWindowPlacement";
  839. table[4642] = "user32.dll!NtUserSetWindowPos";
  840. table[4643] = "user32.dll!NtUserSetWindowRgn";
  841. table[4644] = "user32.dll!NtUserSetWindowsHookAW";
  842. table[4645] = "user32.dll!NtUserSetWindowsHookEx";
  843. table[4646] = "user32.dll!NtUserSetWindowStationUser";
  844. table[4647] = "user32.dll!NtUserSetWindowWord";
  845. table[4648] = "user32.dll!NtUserSetWinEventHook";
  846. table[4649] = "user32.dll!NtUserShowCaret";
  847. table[4650] = "user32.dll!NtUserShowScrollBar";
  848. table[4651] = "user32.dll!NtUserShowWindow";
  849. table[4652] = "user32.dll!NtUserShowWindowAsync";
  850. table[4654] = "user32.dll!NtUserSwitchDesktop";
  851. table[4655] = "user32.dll!NtUserSystemParametersInfo";
  852. table[4657] = "user32.dll!NtUserThunkedMenuInfo";
  853. table[4658] = "user32.dll!NtUserThunkedMenuItemInfo";
  854. table[4659] = "user32.dll!NtUserToUnicodeEx";
  855. table[4660] = "user32.dll!NtUserTrackMouseEvent";
  856. table[4661] = "user32.dll!NtUserTrackPopupMenuEx";
  857. table[4662] = "user32.dll!NtUserCalcMenuBar";
  858. table[4663] = "user32.dll!NtUserPaintMenuBar";
  859. table[4664] = "user32.dll!TranslateAcceleratorA";
  860. table[4665] = "user32.dll!NtUserTranslateMessage";
  861. table[4666] = "user32.dll!NtUserUnhookWindowsHookEx";
  862. table[4667] = "user32.dll!NtUserUnhookWinEvent";
  863. table[4668] = "user32.dll!NtUserUnloadKeyboardLayout";
  864. table[4669] = "user32.dll!NtUserUnlockWindowStation";
  865. table[4670] = "user32.dll!NtUserUnregisterClass";
  866. table[4671] = "user32.dll!NtUserUnregisterUserApiHook";
  867. table[4672] = "user32.dll!NtUserUnregisterHotKey";
  868. table[4673] = "imm32.dll!NtUserUpdateInputContext";
  869. table[4673] = "user32.dll!NtUserUpdateInputContext";
  870. table[4674] = "user32.dll!NtUserUpdateInstance";
  871. table[4675] = "user32.dll!NtUserUpdateLayeredWindow";
  872. table[4676] = "user32.dll!NtUserGetLayeredWindowAttributes";
  873. table[4677] = "user32.dll!NtUserSetLayeredWindowAttributes";
  874. table[4678] = "user32.dll!NtUserUpdatePerUserSystemParameters";
  875. table[4679] = "user32.dll!NtUserUserHandleGrantAccess";
  876. table[4680] = "imm32.dll!NtUserValidateHandleSecure";
  877. table[4680] = "user32.dll!NtUserValidateHandleSecure";
  878. table[4681] = "user32.dll!NtUserValidateRect";
  879. table[4682] = "user32.dll!NtUserValidateTimerCallback";
  880. table[4683] = "user32.dll!NtUserVkKeyScanEx";
  881. table[4684] = "user32.dll!NtUserWaitForInputIdle";
  882. table[4685] = "user32.dll!NtUserWaitForMsgAndEvent";
  883. table[4686] = "user32.dll!NtUserWaitMessage";
  884. table[4687] = "user32.dll!NtUserWin32PoolAllocationStats";
  885. table[4688] = "user32.dll!NtUserWindowFromPoint";
  886. table[4689] = "user32.dll!NtUserYieldTask";
  887. table[4695] = "gdi32.dll!NtGdiEngAssociateSurface";
  888. table[4696] = "gdi32.dll!NtGdiEngCreateBitmap";
  889. table[4697] = "gdi32.dll!NtGdiEngCreateDeviceSurface";
  890. table[4698] = "gdi32.dll!NtGdiEngCreateDeviceBitmap";
  891. table[4699] = "gdi32.dll!NtGdiEngCreatePalette";
  892. table[4700] = "gdi32.dll!NtGdiEngComputeGlyphSet";
  893. table[4701] = "gdi32.dll!NtGdiEngCopyBits";
  894. table[4702] = "gdi32.dll!NtGdiEngDeletePalette";
  895. table[4703] = "gdi32.dll!NtGdiEngDeleteSurface";
  896. table[4704] = "gdi32.dll!NtGdiEngEraseSurface";
  897. table[4705] = "gdi32.dll!NtGdiEngUnlockSurface";
  898. table[4706] = "gdi32.dll!NtGdiEngLockSurface";
  899. table[4707] = "gdi32.dll!NtGdiEngBitBlt";
  900. table[4708] = "gdi32.dll!NtGdiEngStretchBlt";
  901. table[4709] = "gdi32.dll!NtGdiEngPlgBlt";
  902. table[4710] = "gdi32.dll!NtGdiEngMarkBandingSurface";
  903. table[4711] = "gdi32.dll!NtGdiEngStrokePath";
  904. table[4712] = "gdi32.dll!NtGdiEngFillPath";
  905. table[4713] = "gdi32.dll!NtGdiEngStrokeAndFillPath";
  906. table[4714] = "gdi32.dll!NtGdiEngPaint";
  907. table[4715] = "gdi32.dll!NtGdiEngLineTo";
  908. table[4716] = "gdi32.dll!NtGdiEngAlphaBlend";
  909. table[4717] = "gdi32.dll!NtGdiEngGradientFill";
  910. table[4718] = "gdi32.dll!NtGdiEngTransparentBlt";
  911. table[4719] = "gdi32.dll!NtGdiEngTextOut";
  912. table[4720] = "gdi32.dll!NtGdiEngStretchBltROP";
  913. table[4721] = "gdi32.dll!NtGdiXLATEOBJ_cGetPalette";
  914. table[4722] = "gdi32.dll!NtGdiXLATEOBJ_iXlate";
  915. table[4723] = "gdi32.dll!NtGdiXLATEOBJ_hGetColorTransform";
  916. table[4724] = "gdi32.dll!NtGdiCLIPOBJ_bEnum";
  917. table[4725] = "gdi32.dll!NtGdiCLIPOBJ_cEnumStart";
  918. table[4726] = "gdi32.dll!NtGdiCLIPOBJ_ppoGetPath";
  919. table[4727] = "gdi32.dll!NtGdiEngDeletePath";
  920. table[4728] = "gdi32.dll!NtGdiEngCreateClip";
  921. table[4729] = "gdi32.dll!NtGdiEngDeleteClip";
  922. table[4730] = "gdi32.dll!NtGdiBRUSHOBJ_ulGetBrushColor";
  923. table[4731] = "gdi32.dll!NtGdiBRUSHOBJ_pvAllocRbrush";
  924. table[4732] = "gdi32.dll!NtGdiBRUSHOBJ_pvGetRbrush";
  925. table[4733] = "gdi32.dll!NtGdiBRUSHOBJ_hGetColorTransform";
  926. table[4734] = "gdi32.dll!NtGdiXFORMOBJ_bApplyXform";
  927. table[4735] = "gdi32.dll!NtGdiXFORMOBJ_iGetXform";
  928. table[4736] = "gdi32.dll!NtGdiFONTOBJ_vGetInfo";
  929. table[4737] = "gdi32.dll!NtGdiFONTOBJ_pxoGetXform";
  930. table[4738] = "gdi32.dll!NtGdiFONTOBJ_cGetGlyphs";
  931. table[4739] = "gdi32.dll!NtGdiFONTOBJ_pifi";
  932. table[4740] = "gdi32.dll!NtGdiFONTOBJ_pfdg";
  933. table[4741] = "gdi32.dll!NtGdiFONTOBJ_pQueryGlyphAttrs";
  934. table[4742] = "gdi32.dll!NtGdiFONTOBJ_pvTrueTypeFontFile";
  935. table[4743] = "gdi32.dll!NtGdiFONTOBJ_cGetAllGlyphHandles";
  936. table[4744] = "gdi32.dll!NtGdiSTROBJ_bEnum";
  937. table[4745] = "gdi32.dll!NtGdiSTROBJ_bEnumPositionsOnly";
  938. table[4746] = "gdi32.dll!NtGdiSTROBJ_bGetAdvanceWidths";
  939. table[4747] = "gdi32.dll!NtGdiSTROBJ_vEnumStart";
  940. table[4748] = "gdi32.dll!NtGdiSTROBJ_dwGetCodePage";
  941. table[4749] = "gdi32.dll!NtGdiPATHOBJ_vGetBounds";
  942. table[4750] = "gdi32.dll!NtGdiPATHOBJ_bEnum";
  943. table[4751] = "gdi32.dll!NtGdiPATHOBJ_vEnumStart";
  944. table[4752] = "gdi32.dll!NtGdiPATHOBJ_vEnumStartClipLines";
  945. table[4753] = "gdi32.dll!NtGdiPATHOBJ_bEnumClipLines";
  946. table[4754] = "gdi32.dll!NtGdiGetDhpdev";
  947. table[4755] = "gdi32.dll!NtGdiEngCheckAbort";
  948. table[4756] = "gdi32.dll!NtGdiHT_Get8BPPFormatPalette";
  949. table[4757] = "gdi32.dll!NtGdiHT_Get8BPPMaskPalette";
  950. table[4758] = "gdi32.dll!NtGdiUpdateTransform";
  951. table[4759] = "gdi32.dll!NtGdiSetPUMPDOBJ";
  952. table[4760] = "gdi32.dll!NtGdiBRUSHOBJ_DeleteRbrush";
  953. table[4761] = "gdi32.dll!NtGdiUMPDEngFreeUserMem";
  954. table[4762] = "gdi32.dll!NtGdiDrawStream";
  955. } else { // Vista table.
  956. table[4272] = "gdi32.dll!NtGdiGetDeviceCaps";
  957. table[4220] = "gdi32.dll!NtGdiDeleteObjectApp";
  958. table[4249] = "gdi32.dll!NtGdiFlush";
  959. table[4120] = "gdi32.dll!NtGdiConsoleTextOut";
  960. table[4825] = "gdi32.dll!NtGdiDdDDIEscape";
  961. table[4299] = "gdi32.dll!GetRgnBox";
  962. table[4828] = "gdi32.dll!NtGdiDdDDIGetPresentHistory";
  963. table[4835] = "gdi32.dll!NtGdiDdDDIGetDeviceState";
  964. table[4850] = "gdi32.dll!NtGdiDdDDICheckExclusiveOwnership";
  965. table[4849] = "gdi32.dll!NtGdiDdDDICheckMonitorPowerState";
  966. table[4833] = "gdi32.dll!NtGdiDdDDIWaitForVerticalBlankEvent";
  967. table[4298] = "gdi32.dll!GetRegionData";
  968. table[4796] = "gdi32.dll!NtGdiDwmGetDirtyRgn";
  969. table[4820] = "gdi32.dll!NtGdiDdDDIRender";
  970. table[4819] = "gdi32.dll!NtGdiDdDDIPresent";
  971. table[4815] = "gdi32.dll!NtGdiDdDDIUnlock";
  972. table[4814] = "gdi32.dll!NtGdiDdDDILock";
  973. table[4240] = "gdi32.dll!NtGdiExtCreateRegion";
  974. table[4339] = "gdi32.dll!NtGdiPolyPatBlt";
  975. table[4361] = "gdi32.dll!NtGdiSelectBitmap";
  976. table[4127] = "gdi32.dll!NtGdiCreateCompatibleDC";
  977. table[4142] = "gdi32.dll!NtGdiCreateSolidBrush";
  978. table[4122] = "gdi32.dll!CreateBitmap";
  979. table[4303] = "gdi32.dll!CreateBitmap";
  980. table[4348] = "gdi32.dll!NtGdiQueryFontAssocInfo";
  981. table[4126] = "gdi32.dll!NtGdiCreateCompatibleBitmap";
  982. table[4109] = "gdi32.dll!NtGdiBitBlt";
  983. table[4243] = "gdi32.dll!NtGdiExtGetObjectW";
  984. table[4270] = "gdi32.dll!NtGdiGetDCObject";
  985. table[4620] = "gdi32.dll!NtUserSelectPalette";
  986. table[4338] = "gdi32.dll!NtGdiPatBlt";
  987. table[4275] = "gdi32.dll!NtGdiGetDIBitsInternal";
  988. table[4398] = "gdi32.dll!NtGdiStretchDIBitsInternal";
  989. table[4130] = "gdi32.dll!NtGdiCreateDIBSection";
  990. table[4356] = "gdi32.dll!NtGdiRestoreDC";
  991. table[4358] = "gdi32.dll!NtGdiSaveDC";
  992. table[4103] = "gdi32.dll!NtGdiAlphaBlend";
  993. table[4349] = "gdi32.dll!NtGdiRectangle";
  994. table[4295] = "gdi32.dll!NtGdiGetRandomRgn";
  995. table[4244] = "gdi32.dll!NtGdiExtSelectClipRgn";
  996. table[4268] = "gdi32.dll!NtGdiGetDCDword";
  997. table[4245] = "gdi32.dll!NtGdiExtTextOutW";
  998. table[4254] = "gdi32.dll!GetClipBox";
  999. table[4397] = "gdi32.dll!NtGdiStretchBlt";
  1000. table[4331] = "gdi32.dll!NtGdiMaskBlt";
  1001. table[4324] = "gdi32.dll!NtGdiInit";
  1002. table[4262] = "gdi32.dll!NtGdiGetCharSet";
  1003. table[4336] = "gdi32.dll!NtGdiOffsetRgn";
  1004. table[4326] = "gdi32.dll!NtGdiIntersectClipRect";
  1005. table[4795] = "gdi32.dll!NtGdiDrawStream";
  1006. table[4364] = "gdi32.dll!NtGdiSelectFont";
  1007. table[4116] = "gdi32.dll!NtGdiCombineRgn";
  1008. table[4238] = "gdi32.dll!NtGdiExcludeClipRect";
  1009. table[4802] = "gdi32.dll!NtGdiDdDDISetAllocationPriority";
  1010. table[4798] = "gdi32.dll!NtGdiDdDDICreateAllocation";
  1011. table[4801] = "gdi32.dll!NtGdiDdDDIDestroyAllocation";
  1012. table[4797] = "gdi32.dll!NtGdiDwmGetSurfaceData";
  1013. table[4140] = "gdi32.dll!CreateRoundRectRgn";
  1014. table[4840] = "gdi32.dll!NtGdiDdDDISetProcessSchedulingPriorityClass";
  1015. table[4307] = "gdi32.dll!NtGdiGetTextCharsetInfo";
  1016. table[4351] = "gdi32.dll!RectVisible";
  1017. table[4139] = "gdi32.dll!NtGdiCreateRectRgn";
  1018. table[4369] = "gdi32.dll!NtGdiSetBoundsRect";
  1019. table[4257] = "gdi32.dll!NtGdiGetBoundsRect";
  1020. table[4309] = "gdi32.dll!NtGdiGetTextExtentExW";
  1021. table[4402] = "gdi32.dll!NtGdiTransformPoints";
  1022. table[4118] = "gdi32.dll!NtGdiComputeXformCoefficients";
  1023. table[4337] = "gdi32.dll!NtGdiOpenDCW";
  1024. table[4813] = "gdi32.dll!NtGdiDdDDIQueryAdapterInfo";
  1025. table[4822] = "gdi32.dll!NtGdiDdDDIOpenAdapterFromHdc";
  1026. table[4816] = "gdi32.dll!NtGdiDdDDIGetDisplayModeList";
  1027. table[4823] = "gdi32.dll!NtGdiDdDDICloseAdapter";
  1028. table[4804] = "gdi32.dll!NtGdiDdDDICreateDevice";
  1029. table[4806] = "gdi32.dll!NtGdiDdDDICreateContext";
  1030. table[4271] = "gdi32.dll!NtGdiGetDCPoint";
  1031. table[4225] = "gdi32.dll!NtGdiDoPalette";
  1032. table[4288] = "gdi32.dll!GetNearestColor";
  1033. table[4129] = "gdi32.dll!NtGdiCreateDIBitmapInternal";
  1034. table[4322] = "gdi32.dll!NtGdiHfontCreate";
  1035. table[4137] = "gdi32.dll!NtGdiCreatePatternBrushInternal";
  1036. table[4136] = "gdi32.dll!NtGdiCreatePaletteInternal";
  1037. table[4132] = "gdi32.dll!NtGdiCreateHalftonePalette";
  1038. table[4375] = "gdi32.dll!NtGdiSetDIBitsToDeviceInternal";
  1039. table[4269] = "gdi32.dll!NtGdiGetDCforBitmap";
  1040. table[4392] = "gdi32.dll!NtGdiSetupPublicCFONT";
  1041. table[4836] = "gdi32.dll!NtGdiDdDDICreateDCFromMemory";
  1042. table[4264] = "gdi32.dll!NtGdiGetCharWidthInfo";
  1043. table[4367] = "gdi32.dll!SetBitmapBits";
  1044. table[4255] = "gdi32.dll!GetBitmapBits";
  1045. table[4311] = "gdi32.dll!NtGdiGetTextMetricsW";
  1046. table[4297] = "gdi32.dll!NtGdiGetRealizationInfo";
  1047. table[4310] = "gdi32.dll!NtGdiGetTextFaceW";
  1048. table[4292] = "gdi32.dll!NtGdiGetOutlineTextMetricsInternalW";
  1049. table[4280] = "gdi32.dll!NtGdiGetGlyphIndicesW";
  1050. table[4320] = "gdi32.dll!NtGdiGetWidthTable";
  1051. table[4234] = "gdi32.dll!NtGdiEnumFontOpen";
  1052. table[4233] = "gdi32.dll!NtGdiEnumFontClose";
  1053. table[4232] = "gdi32.dll!NtGdiEnumFontChunk";
  1054. table[4260] = "gdi32.dll!NtGdiGetCharABCWidthsW";
  1055. table[4105] = "gdi32.dll!NtGdiAnyLinkedFonts";
  1056. table[4278] = "gdi32.dll!NtGdiGetFontData";
  1057. table[4106] = "gdi32.dll!NtGdiFontIsLinked";
  1058. table[4332] = "gdi32.dll!NtGdiModifyWorldTransform";
  1059. table[4312] = "gdi32.dll!NtGdiGetTransform";
  1060. table[4321] = "gdi32.dll!NtGdiGradientFill";
  1061. table[4294] = "gdi32.dll!NtGdiGetPixel";
  1062. table[4403] = "gdi32.dll!NtGdiTransparentBlt";
  1063. table[4319] = "gdi32.dll!NtGdiGetFontUnicodeRanges";
  1064. table[4817] = "gdi32.dll!NtGdiDdDDISetDisplayMode";
  1065. table[4827] = "gdi32.dll!NtGdiDdDDISetVidPnSourceOwner";
  1066. table[4273] = "gdi32.dll!NtGdiGetDeviceGammaRamp";
  1067. table[4374] = "gdi32.dll!NtGdiSetDeviceGammaRamp";
  1068. table[4366] = "gdi32.dll!NtGdiSetBitmapAttributes";
  1069. table[4098] = "gdi32.dll!NtGdiAddFontResourceW";
  1070. table[4376] = "gdi32.dll!NtGdiSetFontEnumeration";
  1071. table[4228] = "gdi32.dll!NtGdiEnableEudc";
  1072. table[4343] = "gdi32.dll!NtGdiPolyPolyDraw";
  1073. table[4328] = "gdi32.dll!NtGdiLineTo";
  1074. table[4138] = "gdi32.dll!NtGdiCreatePen";
  1075. table[4236] = "gdi32.dll!EqualRgn";
  1076. table[4805] = "gdi32.dll!NtGdiDdDDIDestroyDevice";
  1077. table[4807] = "gdi32.dll!NtGdiDdDDIDestroyContext";
  1078. table[4799] = "gdi32.dll!NtGdiDdDDIQueryResourceInfo";
  1079. table[4800] = "gdi32.dll!NtGdiDdDDIOpenResource";
  1080. table[4838] = "gdi32.dll!NtGdiDdDDISetContextSchedulingPriority";
  1081. table[4263] = "gdi32.dll!NtGdiGetCharWidthW";
  1082. table[4837] = "gdi32.dll!NtGdiDdDDIDestroyDCFromMemory";
  1083. table[4803] = "gdi32.dll!NtGdiDdDDIQueryAllocationResidency";
  1084. table[4824] = "gdi32.dll!NtGdiDdDDIGetSharedPrimaryHandle";
  1085. table[4385] = "gdi32.dll!NtGdiSetLayout";
  1086. table[4371] = "gdi32.dll!NtGdiSetBrushOrg";
  1087. table[4157] = "gdi32.dll!NtGdiDdCreateDirectDrawObject";
  1088. table[4128] = "gdi32.dll!NtGdiCreateDIBBrush";
  1089. table[4387] = "gdi32.dll!NtGdiSetPixel";
  1090. table[4345] = "gdi32.dll!PtInRegion";
  1091. table[4821] = "gdi32.dll!NtGdiDdDDIOpenAdapterFromDeviceName";
  1092. table[4253] = "gdi32.dll!NtGdiGetAndSetDCDword";
  1093. table[4274] = "gdi32.dll!NtGdiGetDeviceCapsAll";
  1094. table[4247] = "gdi32.dll!NtGdiFillRgn";
  1095. table[4289] = "gdi32.dll!GetNearestPaletteIndex";
  1096. table[4378] = "gdi32.dll!NtGdiSetIcmMode";
  1097. table[4327] = "gdi32.dll!NtGdiInvertRgn";
  1098. table[4792] = "gdi32.dll!NtGdiSetPUMPDOBJ";
  1099. table[4735] = "gdi32.dll!NtGdiEngDeletePalette";
  1100. table[4732] = "gdi32.dll!NtGdiEngCreatePalette";
  1101. table[4241] = "gdi32.dll!NtGdiExtEscape";
  1102. table[4217] = "gdi32.dll!NtGdiDeleteClientObj";
  1103. table[4123] = "gdi32.dll!NtGdiCreateClientObj";
  1104. table[4354] = "gdi32.dll!NtGdiResetDC";
  1105. table[4235] = "gdi32.dll!NtGdiEnumObjects";
  1106. table[4135] = "gdi32.dll!NtGdiCreateOPMProtectedOutputs";
  1107. table[4222] = "gdi32.dll!NtGdiDestroyOPMProtectedOutput";
  1108. table[4258] = "gdi32.dll!NtGdiGetCertificate";
  1109. table[4259] = "gdi32.dll!NtGdiGetCertificateSize";
  1110. table[4291] = "gdi32.dll!NtGdiGetOPMRandomNumber";
  1111. table[4305] = "gdi32.dll!NtGdiGetSuggestedOPMProtectedOutputArraySize";
  1112. table[4386] = "gdi32.dll!NtGdiSetOPMSigningKeyAndSequenceNumbers";
  1113. table[4844] = "gdi32.dll!NtGdiDdDDISetQueuedLimit";
  1114. table[4341] = "gdi32.dll!NtGdiPlgBlt";
  1115. table[4117] = "gdi32.dll!CombineTransform";
  1116. table[4134] = "gdi32.dll!NtGdiCreateMetafileDC";
  1117. table[4393] = "gdi32.dll!NtGdiSetVirtualResolution";
  1118. table[4394] = "gdi32.dll!NtGdiSetSizeDevice";
  1119. table[4381] = "gdi32.dll!NtGdiSetMetaRgn";
  1120. table[4382] = "gdi32.dll!NtGdiSetMiterLimit";
  1121. table[4377] = "gdi32.dll!NtGdiSetFontXform";
  1122. table[4333] = "gdi32.dll!NtGdiMonoBitmap";
  1123. table[4768] = "gdi32.dll!NtGdiXFORMOBJ_iGetXform";
  1124. table[4770] = "gdi32.dll!NtGdiFONTOBJ_pxoGetXform";
  1125. table[4239] = "gdi32.dll!NtGdiExtCreatePen";
  1126. table[4286] = "gdi32.dll!GetMiterLimit";
  1127. table[4290] = "gdi32.dll!NtGdiGetObjectBitmapHandle";
  1128. table[4287] = "gdi32.dll!NtGdiGetMonitorID";
  1129. table[4284] = "gdi32.dll!NtGdiGetKerningPairs";
  1130. table[4357] = "gdi32.dll!NtGdiRoundRect";
  1131. table[4242] = "gdi32.dll!NtGdiExtFloodFill";
  1132. table[4306] = "gdi32.dll!GetSystemPaletteUse";
  1133. table[4096] = "gdi32.dll!NtGdiAbortDoc";
  1134. table[4097] = "gdi32.dll!NtGdiAbortPath";
  1135. table[4099] = "gdi32.dll!NtGdiAddRemoteFontToDC";
  1136. table[4100] = "gdi32.dll!NtGdiAddFontMemResourceEx";
  1137. table[4101] = "gdi32.dll!NtGdiRemoveMergeFont";
  1138. table[4102] = "gdi32.dll!NtGdiAddRemoteMMInstanceToDC";
  1139. table[4104] = "gdi32.dll!NtGdiAngleArc";
  1140. table[4107] = "gdi32.dll!NtGdiArcInternal";
  1141. table[4108] = "gdi32.dll!NtGdiBeginPath";
  1142. table[4110] = "gdi32.dll!NtGdiCancelDC";
  1143. table[4111] = "gdi32.dll!NtGdiCheckBitmapBits";
  1144. table[4112] = "gdi32.dll!NtGdiCloseFigure";
  1145. table[4113] = "gdi32.dll!NtGdiClearBitmapAttributes";
  1146. table[4114] = "gdi32.dll!NtGdiClearBrushAttributes";
  1147. table[4115] = "gdi32.dll!NtGdiColorCorrectPalette";
  1148. table[4119] = "gdi32.dll!NtGdiConfigureOPMProtectedOutput";
  1149. table[4121] = "gdi32.dll!NtGdiConvertMetafileRect";
  1150. table[4124] = "gdi32.dll!NtGdiCreateColorSpace";
  1151. table[4125] = "gdi32.dll!NtGdiCreateColorTransform";
  1152. table[4131] = "gdi32.dll!NtGdiCreateEllipticRgn";
  1153. table[4133] = "gdi32.dll!NtGdiCreateHatchBrushInternal";
  1154. table[4141] = "gdi32.dll!NtGdiCreateServerMetaFile";
  1155. table[4143] = "gdi32.dll!NtGdiD3dContextCreate";
  1156. table[4144] = "gdi32.dll!NtGdiD3dContextDestroy";
  1157. table[4145] = "gdi32.dll!NtGdiD3dContextDestroyAll";
  1158. table[4146] = "gdi32.dll!NtGdiD3dValidateTextureStageState";
  1159. table[4147] = "gdi32.dll!NtGdiD3dDrawPrimitives2";
  1160. table[4148] = "gdi32.dll!NtGdiDdGetDriverState";
  1161. table[4149] = "gdi32.dll!NtGdiDdAddAttachedSurface";
  1162. table[4150] = "gdi32.dll!NtGdiDdAlphaBlt";
  1163. table[4151] = "gdi32.dll!NtGdiDdAttachSurface";
  1164. table[4152] = "gdi32.dll!NtGdiDdBeginMoCompFrame";
  1165. table[4153] = "gdi32.dll!NtGdiDdBlt";
  1166. table[4154] = "gdi32.dll!NtGdiDdCanCreateSurface";
  1167. table[4155] = "gdi32.dll!NtGdiDdCanCreateD3DBuffer";
  1168. table[4156] = "gdi32.dll!NtGdiDdColorControl";
  1169. table[4158] = "gdi32.dll!NtGdiDdCreateSurface";
  1170. table[4159] = "gdi32.dll!NtGdiDdCreateD3DBuffer";
  1171. table[4160] = "gdi32.dll!NtGdiDdCreateMoComp";
  1172. table[4161] = "gdi32.dll!NtGdiDdCreateSurfaceObject";
  1173. table[4162] = "gdi32.dll!NtGdiDdDeleteDirectDrawObject";
  1174. table[4163] = "gdi32.dll!NtGdiDdDeleteSurfaceObject";
  1175. table[4164] = "gdi32.dll!NtGdiDdDestroyMoComp";
  1176. table[4165] = "gdi32.dll!NtGdiDdDestroySurface";
  1177. table[4166] = "gdi32.dll!NtGdiDdDestroyD3DBuffer";
  1178. table[4167] = "gdi32.dll!NtGdiDdEndMoCompFrame";
  1179. table[4168] = "gdi32.dll!NtGdiDdFlip";
  1180. table[4169] = "gdi32.dll!NtGdiDdFlipToGDISurface";
  1181. table[4170] = "gdi32.dll!NtGdiDdGetAvailDriverMemory";
  1182. table[4171] = "gdi32.dll!NtGdiDdGetBltStatus";
  1183. table[4172] = "gdi32.dll!NtGdiDdGetDC";
  1184. table[4173] = "gdi32.dll!NtGdiDdGetDriverInfo";
  1185. table[4174] = "gdi32.dll!NtGdiDdGetDxHandle";
  1186. table[4175] = "gdi32.dll!NtGdiDdGetFlipStatus";
  1187. table[4176] = "gdi32.dll!NtGdiDdGetInternalMoCompInfo";
  1188. table[4177] = "gdi32.dll!NtGdiDdGetMoCompBuffInfo";
  1189. table[4178] = "gdi32.dll!NtGdiDdGetMoCompGuids";
  1190. table[4179] = "gdi32.dll!NtGdiDdGetMoCompFormats";
  1191. table[4180] = "gdi32.dll!NtGdiDdGetScanLine";
  1192. table[4181] = "gdi32.dll!NtGdiDdLock";
  1193. table[4182] = "gdi32.dll!NtGdiDdLockD3D";
  1194. table[4183] = "gdi32.dll!NtGdiDdQueryDirectDrawObject";
  1195. table[4184] = "gdi32.dll!NtGdiDdQueryMoCompStatus";
  1196. table[4185] = "gdi32.dll!NtGdiDdReenableDirectDrawObject";
  1197. table[4186] = "gdi32.dll!NtGdiDdReleaseDC";
  1198. table[4187] = "gdi32.dll!NtGdiDdRenderMoComp";
  1199. table[4188] = "gdi32.dll!NtGdiDdResetVisrgn";
  1200. table[4189] = "gdi32.dll!NtGdiDdSetColorKey";
  1201. table[4190] = "gdi32.dll!NtGdiDdSetExclusiveMode";
  1202. table[4191] = "gdi32.dll!NtGdiDdSetGammaRamp";
  1203. table[4192] = "gdi32.dll!NtGdiDdCreateSurfaceEx";
  1204. table[4193] = "gdi32.dll!NtGdiDdSetOverlayPosition";
  1205. table[4194] = "gdi32.dll!NtGdiDdUnattachSurface";
  1206. table[4195] = "gdi32.dll!NtGdiDdUnlock";
  1207. table[4196] = "gdi32.dll!NtGdiDdUnlockD3D";
  1208. table[4197] = "gdi32.dll!NtGdiDdUpdateOverlay";
  1209. table[4198] = "gdi32.dll!NtGdiDdWaitForVerticalBlank";
  1210. table[4199] = "gdi32.dll!NtGdiDvpCanCreateVideoPort";
  1211. table[4200] = "gdi32.dll!NtGdiDvpColorControl";
  1212. table[4201] = "gdi32.dll!NtGdiDvpCreateVideoPort";
  1213. table[4202] = "gdi32.dll!NtGdiDvpDestroyVideoPort";
  1214. table[4203] = "gdi32.dll!NtGdiDvpFlipVideoPort";
  1215. table[4204] = "gdi32.dll!NtGdiDvpGetVideoPortBandwidth";
  1216. table[4205] = "gdi32.dll!NtGdiDvpGetVideoPortField";
  1217. table[4206] = "gdi32.dll!NtGdiDvpGetVideoPortFlipStatus";
  1218. table[4207] = "gdi32.dll!NtGdiDvpGetVideoPortInputFormats";
  1219. table[4208] = "gdi32.dll!NtGdiDvpGetVideoPortLine";
  1220. table[4209] = "gdi32.dll!NtGdiDvpGetVideoPortOutputFormats";
  1221. table[4210] = "gdi32.dll!NtGdiDvpGetVideoPortConnectInfo";
  1222. table[4211] = "gdi32.dll!NtGdiDvpGetVideoSignalStatus";
  1223. table[4212] = "gdi32.dll!NtGdiDvpUpdateVideoPort";
  1224. table[4213] = "gdi32.dll!NtGdiDvpWaitForVideoPortSync";
  1225. table[4214] = "gdi32.dll!NtGdiDvpAcquireNotification";
  1226. table[4215] = "gdi32.dll!NtGdiDvpReleaseNotification";
  1227. table[4216] = "gdi32.dll!NtGdiDxgGenericThunk";
  1228. table[4218] = "gdi32.dll!NtGdiDeleteColorSpace";
  1229. table[4219] = "gdi32.dll!NtGdiDeleteColorTransform";
  1230. table[4221] = "gdi32.dll!NtGdiDescribePixelFormat";
  1231. table[4223] = "gdi32.dll!NtGdiGetPerBandInfo";
  1232. table[4224] = "gdi32.dll!NtGdiDoBanding";
  1233. table[4226] = "gdi32.dll!NtGdiDrawEscape";
  1234. table[4227] = "gdi32.dll!NtGdiEllipse";
  1235. table[4229] = "gdi32.dll!NtGdiEndDoc";
  1236. table[4230] = "gdi32.dll!NtGdiEndPage";
  1237. table[4231] = "gdi32.dll!NtGdiEndPath";
  1238. table[4237] = "gdi32.dll!NtGdiEudcLoadUnloadLink";
  1239. table[4246] = "gdi32.dll!NtGdiFillPath";
  1240. table[4248] = "gdi32.dll!NtGdiFlattenPath";
  1241. table[4250] = "gdi32.dll!NtGdiForceUFIMapping";
  1242. table[4251] = "gdi32.dll!NtGdiFrameRgn";
  1243. table[4252] = "gdi32.dll!NtGdiFullscreenControl";
  1244. table[4256] = "gdi32.dll!NtGdiGetBitmapDimension";
  1245. table[4261] = "gdi32.dll!NtGdiGetCharacterPlacementW";
  1246. table[4265] = "gdi32.dll!NtGdiGetColorAdjustment";
  1247. table[4267] = "gdi32.dll!NtGdiGetCOPPCompatibleOPMInformation";
  1248. table[4276] = "gdi32.dll!NtGdiGetETM";
  1249. table[4277] = "gdi32.dll!NtGdiGetEudcTimeStampEx";
  1250. table[4279] = "gdi32.dll!NtGdiGetFontResourceInfoInternalW";
  1251. table[4281] = "gdi32.dll!NtGdiGetGlyphIndicesWInternal";
  1252. table[4282] = "gdi32.dll!NtGdiGetGlyphOutline";
  1253. table[4283] = "gdi32.dll!NtGdiGetOPMInformation";
  1254. table[4285] = "gdi32.dll!NtGdiGetLinkedUFIs";
  1255. table[4293] = "gdi32.dll!NtGdiGetPath";
  1256. table[4296] = "gdi32.dll!NtGdiGetRasterizerCaps";
  1257. table[4300] = "gdi32.dll!NtGdiGetServerMetaFileBits";
  1258. table[4301] = "gdi32.dll!NtGdiGetSpoolMessage";
  1259. table[4304] = "gdi32.dll!NtGdiGetStringBitmapW";
  1260. table[4308] = "gdi32.dll!NtGdiGetTextExtent";
  1261. table[4313] = "gdi32.dll!NtGdiGetUFI";
  1262. table[4314] = "gdi32.dll!NtGdiGetEmbUFI";
  1263. table[4315] = "gdi32.dll!NtGdiGetUFIPathname";
  1264. table[4316] = "gdi32.dll!NtGdiGetEmbedFonts";
  1265. table[4317] = "gdi32.dll!NtGdiChangeGhostFont";
  1266. table[4318] = "gdi32.dll!NtGdiAddEmbFontToDC";
  1267. table[4323] = "gdi32.dll!NtGdiIcmBrushInfo";
  1268. table[4325] = "gdi32.dll!NtGdiInitSpool";
  1269. table[4329] = "gdi32.dll!NtGdiMakeFontDir";
  1270. table[4330] = "gdi32.dll!NtGdiMakeInfoDC";
  1271. table[4335] = "gdi32.dll!NtGdiOffsetClipRgn";
  1272. table[4340] = "gdi32.dll!NtGdiPathToRegion";
  1273. table[4342] = "gdi32.dll!NtGdiPolyDraw";
  1274. table[4344] = "gdi32.dll!NtGdiPolyTextOutW";
  1275. table[4346] = "gdi32.dll!NtGdiPtVisible";
  1276. table[4347] = "gdi32.dll!NtGdiQueryFonts";
  1277. table[4350] = "gdi32.dll!NtGdiRectInRegion";
  1278. table[4352] = "gdi32.dll!NtGdiRemoveFontResourceW";
  1279. table[4353] = "gdi32.dll!NtGdiRemoveFontMemResourceEx";
  1280. table[4355] = "gdi32.dll!NtGdiResizePalette";
  1281. table[4359] = "gdi32.dll!NtGdiScaleViewportExtEx";
  1282. table[4360] = "gdi32.dll!NtGdiScaleWindowExtEx";
  1283. table[4363] = "gdi32.dll!NtGdiSelectClipPath";
  1284. table[4365] = "gdi32.dll!NtGdiSelectPen";
  1285. table[4368] = "gdi32.dll!NtGdiSetBitmapDimension";
  1286. table[4370] = "gdi32.dll!NtGdiSetBrushAttributes";
  1287. table[4372] = "gdi32.dll!NtGdiSetColorAdjustment";
  1288. table[4373] = "gdi32.dll!NtGdiSetColorSpace";
  1289. table[4379] = "gdi32.dll!NtGdiSetLinkedUFIs";
  1290. table[4380] = "gdi32.dll!NtGdiSetMagicColors";
  1291. table[4383] = "gdi32.dll!NtGdiGetDeviceWidth";
  1292. table[4384] = "gdi32.dll!NtGdiMirrorWindowOrg";
  1293. table[4388] = "gdi32.dll!NtGdiSetPixelFormat";
  1294. table[4389] = "gdi32.dll!NtGdiSetRectRgn";
  1295. table[4390] = "gdi32.dll!NtGdiSetSystemPaletteUse";
  1296. table[4395] = "gdi32.dll!NtGdiStartDoc";
  1297. table[4396] = "gdi32.dll!NtGdiStartPage";
  1298. table[4399] = "gdi32.dll!NtGdiStrokeAndFillPath";
  1299. table[4400] = "gdi32.dll!NtGdiStrokePath";
  1300. table[4401] = "gdi32.dll!NtGdiSwapBuffers";
  1301. table[4404] = "gdi32.dll!NtGdiUnloadPrinterDriver";
  1302. table[4406] = "gdi32.dll!NtGdiUnrealizeObject";
  1303. table[4407] = "gdi32.dll!NtGdiUpdateColors";
  1304. table[4408] = "gdi32.dll!NtGdiWidenPath";
  1305. table[4728] = "gdi32.dll!NtGdiEngAssociateSurface";
  1306. table[4729] = "gdi32.dll!NtGdiEngCreateBitmap";
  1307. table[4730] = "gdi32.dll!NtGdiEngCreateDeviceSurface";
  1308. table[4731] = "gdi32.dll!NtGdiEngCreateDeviceBitmap";
  1309. table[4733] = "gdi32.dll!NtGdiEngComputeGlyphSet";
  1310. table[4734] = "gdi32.dll!NtGdiEngCopyBits";
  1311. table[4736] = "gdi32.dll!NtGdiEngDeleteSurface";
  1312. table[4737] = "gdi32.dll!NtGdiEngEraseSurface";
  1313. table[4738] = "gdi32.dll!NtGdiEngUnlockSurface";
  1314. table[4739] = "gdi32.dll!NtGdiEngLockSurface";
  1315. table[4740] = "gdi32.dll!NtGdiEngBitBlt";
  1316. table[4741] = "gdi32.dll!NtGdiEngStretchBlt";
  1317. table[4742] = "gdi32.dll!NtGdiEngPlgBlt";
  1318. table[4743] = "gdi32.dll!NtGdiEngMarkBandingSurface";
  1319. table[4744] = "gdi32.dll!NtGdiEngStrokePath";
  1320. table[4745] = "gdi32.dll!NtGdiEngFillPath";
  1321. table[4746] = "gdi32.dll!NtGdiEngStrokeAndFillPath";
  1322. table[4747] = "gdi32.dll!NtGdiEngPaint";
  1323. table[4748] = "gdi32.dll!NtGdiEngLineTo";
  1324. table[4749] = "gdi32.dll!NtGdiEngAlphaBlend";
  1325. table[4750] = "gdi32.dll!NtGdiEngGradientFill";
  1326. table[4751] = "gdi32.dll!NtGdiEngTransparentBlt";
  1327. table[4752] = "gdi32.dll!NtGdiEngTextOut";
  1328. table[4753] = "gdi32.dll!NtGdiEngStretchBltROP";
  1329. table[4754] = "gdi32.dll!NtGdiXLATEOBJ_cGetPalette";
  1330. table[4755] = "gdi32.dll!NtGdiXLATEOBJ_iXlate";
  1331. table[4756] = "gdi32.dll!NtGdiXLATEOBJ_hGetColorTransform";
  1332. table[4757] = "gdi32.dll!NtGdiCLIPOBJ_bEnum";
  1333. table[4758] = "gdi32.dll!NtGdiCLIPOBJ_cEnumStart";
  1334. table[4759] = "gdi32.dll!NtGdiCLIPOBJ_ppoGetPath";
  1335. table[4760] = "gdi32.dll!NtGdiEngDeletePath";
  1336. table[4761] = "gdi32.dll!NtGdiEngCreateClip";
  1337. table[4762] = "gdi32.dll!NtGdiEngDeleteClip";
  1338. table[4763] = "gdi32.dll!NtGdiBRUSHOBJ_ulGetBrushColor";
  1339. table[4764] = "gdi32.dll!NtGdiBRUSHOBJ_pvAllocRbrush";
  1340. table[4765] = "gdi32.dll!NtGdiBRUSHOBJ_pvGetRbrush";
  1341. table[4766] = "gdi32.dll!NtGdiBRUSHOBJ_hGetColorTransform";
  1342. table[4767] = "gdi32.dll!NtGdiXFORMOBJ_bApplyXform";
  1343. table[4769] = "gdi32.dll!NtGdiFONTOBJ_vGetInfo";
  1344. table[4771] = "gdi32.dll!NtGdiFONTOBJ_cGetGlyphs";
  1345. table[4772] = "gdi32.dll!NtGdiFONTOBJ_pifi";
  1346. table[4773] = "gdi32.dll!NtGdiFONTOBJ_pfdg";
  1347. table[4774] = "gdi32.dll!NtGdiFONTOBJ_pQueryGlyphAttrs";
  1348. table[4775] = "gdi32.dll!NtGdiFONTOBJ_pvTrueTypeFontFile";
  1349. table[4776] = "gdi32.dll!NtGdiFONTOBJ_cGetAllGlyphHandles";
  1350. table[4777] = "gdi32.dll!NtGdiSTROBJ_bEnum";
  1351. table[4778] = "gdi32.dll!NtGdiSTROBJ_bEnumPositionsOnly";
  1352. table[4779] = "gdi32.dll!NtGdiSTROBJ_bGetAdvanceWidths";
  1353. table[4780] = "gdi32.dll!NtGdiSTROBJ_vEnumStart";
  1354. table[4781] = "gdi32.dll!NtGdiSTROBJ_dwGetCodePage";
  1355. table[4782] = "gdi32.dll!NtGdiPATHOBJ_vGetBounds";
  1356. table[4783] = "gdi32.dll!NtGdiPATHOBJ_bEnum";
  1357. table[4784] = "gdi32.dll!NtGdiPATHOBJ_vEnumStart";
  1358. table[4785] = "gdi32.dll!NtGdiPATHOBJ_vEnumStartClipLines";
  1359. table[4786] = "gdi32.dll!NtGdiPATHOBJ_bEnumClipLines";
  1360. table[4787] = "gdi32.dll!NtGdiGetDhpdev";
  1361. table[4788] = "gdi32.dll!NtGdiEngCheckAbort";
  1362. table[4789] = "gdi32.dll!NtGdiHT_Get8BPPFormatPalette";
  1363. table[4790] = "gdi32.dll!NtGdiHT_Get8BPPMaskPalette";
  1364. table[4791] = "gdi32.dll!NtGdiUpdateTransform";
  1365. table[4793] = "gdi32.dll!NtGdiBRUSHOBJ_DeleteRbrush";
  1366. table[4794] = "gdi32.dll!NtGdiUMPDEngFreeUserMem";
  1367. table[4808] = "gdi32.dll!NtGdiDdDDICreateSynchronizationObject";
  1368. table[4809] = "gdi32.dll!NtGdiDdDDIDestroySynchronizationObject";
  1369. table[4810] = "gdi32.dll!NtGdiDdDDIWaitForSynchronizationObject";
  1370. table[4811] = "gdi32.dll!NtGdiDdDDISignalSynchronizationObject";
  1371. table[4812] = "gdi32.dll!NtGdiDdDDIGetRuntimeData";
  1372. table[4818] = "gdi32.dll!NtGdiDdDDIGetMultisampleMethodList";
  1373. table[4826] = "gdi32.dll!NtGdiDdDDIQueryStatistics";
  1374. table[4829] = "gdi32.dll!NtGdiDdDDICreateOverlay";
  1375. table[4830] = "gdi32.dll!NtGdiDdDDIUpdateOverlay";
  1376. table[4831] = "gdi32.dll!NtGdiDdDDIFlipOverlay";
  1377. table[4832] = "gdi32.dll!NtGdiDdDDIDestroyOverlay";
  1378. table[4834] = "gdi32.dll!NtGdiDdDDISetGammaRamp";
  1379. table[4839] = "gdi32.dll!NtGdiDdDDIGetContextSchedulingPriority";
  1380. table[4841] = "gdi32.dll!NtGdiDdDDIGetProcessSchedulingPriorityClass";
  1381. table[4842] = "gdi32.dll!NtGdiDdDDIReleaseProcessVidPnSourceOwners";
  1382. table[4843] = "gdi32.dll!NtGdiDdDDIGetScanLine";
  1383. table[4845] = "gdi32.dll!NtGdiDdDDIPollDisplayChildren";
  1384. table[4846] = "gdi32.dll!NtGdiDdDDIInvalidateActiveVidPn";
  1385. table[4847] = "gdi32.dll!NtGdiDdDDICheckOcclusion";
  1386. table[4848] = "gdi32.dll!NtGdiDdDDIWaitForIdle";
  1387. table[4851] = "gdi32.dll!NtGdiDdDDISetDisplayPrivateDriverFormat";
  1388. table[4852] = "gdi32.dll!NtGdiDdDDISharedPrimaryLockNotification";
  1389. table[4853] = "gdi32.dll!NtGdiDdDDISharedPrimaryUnLockNotification";
  1390. table[4856] = "gdi32.dll!NtGdiGetNumberOfPhysicalMonitors";
  1391. table[4857] = "gdi32.dll!NtGdiGetPhysicalMonitors";
  1392. table[4858] = "gdi32.dll!NtGdiGetPhysicalMonitorDescription";
  1393. table[4859] = "gdi32.dll!NtGdiDestroyPhysicalMonitor";
  1394. table[4860] = "gdi32.dll!NtGdiDDCCIGetVCPFeature";
  1395. table[4861] = "gdi32.dll!NtGdiDDCCISetVCPFeature";
  1396. table[4862] = "gdi32.dll!NtGdiDDCCISaveCurrentSettings";
  1397. table[4863] = "gdi32.dll!NtGdiDDCCIGetCapabilitiesStringLength";
  1398. table[4864] = "gdi32.dll!NtGdiDDCCIGetCapabilitiesString";
  1399. table[4865] = "gdi32.dll!NtGdiDDCCIGetTimingReport";
  1400. table[0] = "ntdll.dll!NtAcceptConnectPort";
  1401. table[1] = "ntdll.dll!NtAccessCheck";
  1402. table[2] = "ntdll.dll!ZwAccessCheckAndAuditAlarm";
  1403. table[3] = "ntdll.dll!NtAccessCheckByType";
  1404. table[4] = "ntdll.dll!NtAccessCheckByTypeAndAuditAlarm";
  1405. table[5] = "ntdll.dll!NtAccessCheckByTypeResultList";
  1406. table[6] = "ntdll.dll!NtAccessCheckByTypeResultListAndAuditAlarm";
  1407. table[7] = "ntdll.dll!ZwAccessCheckByTypeResultListAndAuditAlarmByHandle";
  1408. table[8] = "ntdll.dll!NtAddAtom";
  1409. table[9] = "ntdll.dll!ZwAddBootEntry";
  1410. table[10] = "ntdll.dll!NtAddDriverEntry";
  1411. table[11] = "ntdll.dll!ZwAdjustGroupsToken";
  1412. table[12] = "ntdll.dll!ZwAdjustPrivilegesToken";
  1413. table[13] = "ntdll.dll!NtAlertResumeThread";
  1414. table[14] = "ntdll.dll!NtAlertThread";
  1415. table[15] = "ntdll.dll!ZwAllocateLocallyUniqueId";
  1416. table[16] = "ntdll.dll!NtAllocateUserPhysicalPages";
  1417. table[17] = "ntdll.dll!NtAllocateUuids";
  1418. table[18] = "ntdll.dll!NtAllocateVirtualMemory";
  1419. table[19] = "ntdll.dll!NtAlpcAcceptConnectPort";
  1420. table[20] = "ntdll.dll!ZwAlpcCancelMessage";
  1421. table[21] = "ntdll.dll!ZwAlpcConnectPort";
  1422. table[22] = "ntdll.dll!ZwAlpcCreatePort";
  1423. table[23] = "ntdll.dll!NtAlpcCreatePortSection";
  1424. table[24] = "ntdll.dll!ZwAlpcCreateResourceReserve";
  1425. table[25] = "ntdll.dll!ZwAlpcCreateSectionView";
  1426. table[26] = "ntdll.dll!ZwAlpcCreateSecurityContext";
  1427. table[27] = "ntdll.dll!ZwAlpcDeletePortSection";
  1428. table[28] = "ntdll.dll!NtAlpcDeleteResourceReserve";
  1429. table[29] = "ntdll.dll!NtAlpcDeleteSectionView";
  1430. table[30] = "ntdll.dll!NtAlpcDeleteSecurityContext";
  1431. table[31] = "ntdll.dll!NtAlpcDisconnectPort";
  1432. table[32] = "ntdll.dll!ZwAlpcImpersonateClientOfPort";
  1433. table[33] = "ntdll.dll!ZwAlpcOpenSenderProcess";
  1434. table[34] = "ntdll.dll!ZwAlpcOpenSenderThread";
  1435. table[35] = "ntdll.dll!ZwAlpcQueryInformation";
  1436. table[36] = "ntdll.dll!ZwAlpcQueryInformationMessage";
  1437. table[37] = "ntdll.dll!NtAlpcRevokeSecurityContext";
  1438. table[38] = "ntdll.dll!NtAlpcSendWaitReceivePort";
  1439. table[39] = "ntdll.dll!NtAlpcSetInformation";
  1440. table[40] = "ntdll.dll!NtApphelpCacheControl";
  1441. table[41] = "ntdll.dll!ZwAreMappedFilesTheSame";
  1442. table[42] = "ntdll.dll!ZwAssignProcessToJobObject";
  1443. table[43] = "ntdll.dll!ZwCallbackReturn";
  1444. table[44] = "ntdll.dll!NtCancelDeviceWakeupRequest";
  1445. table[45] = "ntdll.dll!ZwCancelIoFile";
  1446. table[46] = "ntdll.dll!ZwCancelTimer";
  1447. table[47] = "ntdll.dll!NtClearEvent";
  1448. table[48] = "ntdll.dll!NtClose";
  1449. table[49] = "ntdll.dll!ZwCloseObjectAuditAlarm";
  1450. table[50] = "ntdll.dll!NtCompactKeys";
  1451. table[51] = "ntdll.dll!ZwCompareTokens";
  1452. table[52] = "ntdll.dll!NtCompleteConnectPort";
  1453. table[53] = "ntdll.dll!ZwCompressKey";
  1454. table[54] = "ntdll.dll!NtConnectPort";
  1455. table[55] = "ntdll.dll!ZwContinue";
  1456. table[56] = "ntdll.dll!ZwCreateDebugObject";
  1457. table[57] = "ntdll.dll!ZwCreateDirectoryObject";
  1458. table[58] = "ntdll.dll!NtCreateEvent";
  1459. table[59] = "ntdll.dll!NtCreateEventPair";
  1460. table[60] = "ntdll.dll!NtCreateFile";
  1461. table[61] = "ntdll.dll!NtCreateIoCompletion";
  1462. table[62] = "ntdll.dll!ZwCreateJobObject";
  1463. table[63] = "ntdll.dll!NtCreateJobSet";
  1464. table[64] = "ntdll.dll!ZwCreateKey";
  1465. table[65] = "ntdll.dll!NtCreateKeyTransacted";
  1466. table[66] = "ntdll.dll!ZwCreateMailslotFile";
  1467. table[67] = "ntdll.dll!ZwCreateMutant";
  1468. table[68] = "ntdll.dll!ZwCreateNamedPipeFile";
  1469. table[69] = "ntdll.dll!NtCreatePrivateNamespace";
  1470. table[70] = "ntdll.dll!NtCreatePagingFile";
  1471. table[71] = "ntdll.dll!ZwCreatePort";
  1472. table[72] = "ntdll.dll!ZwCreateProcess";
  1473. table[73] = "ntdll.dll!ZwCreateProcessEx";
  1474. table[74] = "ntdll.dll!ZwCreateProfile";
  1475. table[75] = "ntdll.dll!NtCreateSection";
  1476. table[76] = "ntdll.dll!NtCreateSemaphore";
  1477. table[77] = "ntdll.dll!ZwCreateSymbolicLinkObject";
  1478. table[78] = "ntdll.dll!NtCreateThread";
  1479. table[79] = "ntdll.dll!ZwCreateTimer";
  1480. table[80] = "ntdll.dll!NtCreateToken";
  1481. table[81] = "ntdll.dll!NtCreateTransaction";
  1482. table[82] = "ntdll.dll!ZwOpenTransaction";
  1483. table[83] = "ntdll.dll!ZwQueryInformationTransaction";
  1484. table[84] = "ntdll.dll!NtQueryInformationTransactionManager";
  1485. table[85] = "ntdll.dll!NtPrePrepareEnlistment";
  1486. table[86] = "ntdll.dll!ZwPrepareEnlistment";
  1487. table[87] = "ntdll.dll!NtCommitEnlistment";
  1488. table[88] = "ntdll.dll!ZwReadOnlyEnlistment";
  1489. table[89] = "ntdll.dll!ZwRollbackComplete";
  1490. table[90] = "ntdll.dll!NtRollbackEnlistment";
  1491. table[91] = "ntdll.dll!NtCommitTransaction";
  1492. table[92] = "ntdll.dll!NtRollbackTransaction";
  1493. table[93] = "ntdll.dll!ZwPrePrepareComplete";
  1494. table[94] = "ntdll.dll!NtPrepareComplete";
  1495. table[95] = "ntdll.dll!ZwCommitComplete";
  1496. table[96] = "ntdll.dll!ZwSinglePhaseReject";
  1497. table[97] = "ntdll.dll!ZwSetInformationTransaction";
  1498. table[98] = "ntdll.dll!ZwSetInformationTransactionManager";
  1499. table[99] = "ntdll.dll!ZwSetInformationResourceManager";
  1500. table[100] = "ntdll.dll!ZwCreateTransactionManager";
  1501. table[101] = "ntdll.dll!ZwOpenTransactionManager";
  1502. table[102] = "ntdll.dll!NtRenameTransactionManager";
  1503. table[103] = "ntdll.dll!NtRollforwardTransactionManager";
  1504. table[104] = "ntdll.dll!NtRecoverEnlistment";
  1505. table[105] = "ntdll.dll!NtRecoverResourceManager";
  1506. table[106] = "ntdll.dll!ZwRecoverTransactionManager";
  1507. table[107] = "ntdll.dll!ZwCreateResourceManager";
  1508. table[108] = "ntdll.dll!ZwOpenResourceManager";
  1509. table[109] = "ntdll.dll!ZwGetNotificationResourceManager";
  1510. table[110] = "ntdll.dll!ZwQueryInformationResourceManager";
  1511. table[111] = "ntdll.dll!ZwCreateEnlistment";
  1512. table[112] = "ntdll.dll!ZwOpenEnlistment";
  1513. table[113] = "ntdll.dll!NtSetInformationEnlistment";
  1514. table[114] = "ntdll.dll!ZwQueryInformationEnlistment";
  1515. table[115] = "ntdll.dll!ZwCreateWaitablePort";
  1516. table[116] = "ntdll.dll!NtDebugActiveProcess";
  1517. table[117] = "ntdll.dll!ZwDebugContinue";
  1518. table[118] = "ntdll.dll!ZwDelayExecution";
  1519. table[119] = "ntdll.dll!ZwDeleteAtom";
  1520. table[120] = "ntdll.dll!NtDeleteBootEntry";
  1521. table[121] = "ntdll.dll!ZwDeleteDriverEntry";
  1522. table[122] = "ntdll.dll!NtDeleteFile";
  1523. table[123] = "ntdll.dll!ZwDeleteKey";
  1524. table[124] = "ntdll.dll!NtDeletePrivateNamespace";
  1525. table[125] = "ntdll.dll!NtDeleteObjectAuditAlarm";
  1526. table[126] = "ntdll.dll!NtDeleteValueKey";
  1527. table[127] = "ntdll.dll!ZwDeviceIoControlFile";
  1528. table[128] = "ntdll.dll!NtDisplayString";
  1529. table[129] = "ntdll.dll!ZwDuplicateObject";
  1530. table[130] = "ntdll.dll!NtDuplicateToken";
  1531. table[131] = "ntdll.dll!ZwEnumerateBootEntries";
  1532. table[132] = "ntdll.dll!NtEnumerateDriverEntries";
  1533. table[133] = "ntdll.dll!ZwEnumerateKey";
  1534. table[134] = "ntdll.dll!ZwEnumerateSystemEnvironmentValuesEx";
  1535. table[135] = "ntdll.dll!ZwEnumerateTransactionObject";
  1536. table[136] = "ntdll.dll!NtEnumerateValueKey";
  1537. table[137] = "ntdll.dll!ZwExtendSection";
  1538. table[138] = "ntdll.dll!NtFilterToken";
  1539. table[139] = "ntdll.dll!NtFindAtom";
  1540. table[140] = "ntdll.dll!ZwFlushBuffersFile";
  1541. table[141] = "ntdll.dll!ZwFlushInstructionCache";
  1542. table[142] = "ntdll.dll!NtFlushKey";
  1543. table[143] = "ntdll.dll!ZwFlushProcessWriteBuffers";
  1544. table[144] = "ntdll.dll!ZwFlushVirtualMemory";
  1545. table[145] = "ntdll.dll!NtFlushWriteBuffer";
  1546. table[146] = "ntdll.dll!NtFreeUserPhysicalPages";
  1547. table[147] = "ntdll.dll!NtFreeVirtualMemory";
  1548. table[148] = "ntdll.dll!NtFreezeRegistry";
  1549. table[149] = "ntdll.dll!ZwFreezeTransactions";
  1550. table[150] = "ntdll.dll!NtFsControlFile";
  1551. table[151] = "ntdll.dll!NtGetContextThread";
  1552. table[152] = "ntdll.dll!NtGetDevicePowerState";
  1553. table[153] = "ntdll.dll!NtGetNlsSectionPtr";
  1554. table[154] = "ntdll.dll!ZwGetPlugPlayEvent";
  1555. table[155] = "ntdll.dll!NtGetWriteWatch";
  1556. table[156] = "ntdll.dll!NtImpersonateAnonymousToken";
  1557. table[157] = "ntdll.dll!ZwImpersonateClientOfPort";
  1558. table[158] = "ntdll.dll!ZwImpersonateThread";
  1559. table[159] = "ntdll.dll!ZwInitializeNlsFiles";
  1560. table[160] = "ntdll.dll!ZwInitializeRegistry";
  1561. table[161] = "ntdll.dll!NtInitiatePowerAction";
  1562. table[162] = "ntdll.dll!ZwIsProcessInJob";
  1563. table[163] = "ntdll.dll!NtIsSystemResumeAutomatic";
  1564. table[164] = "ntdll.dll!ZwListenPort";
  1565. table[165] = "ntdll.dll!NtLoadDriver";
  1566. table[166] = "ntdll.dll!NtLoadKey";
  1567. table[167] = "ntdll.dll!NtLoadKey2";
  1568. table[168] = "ntdll.dll!NtLoadKeyEx";
  1569. table[169] = "ntdll.dll!NtLockFile";
  1570. table[170] = "ntdll.dll!ZwLockProductActivationKeys";
  1571. table[171] = "ntdll.dll!NtLockRegistryKey";
  1572. table[172] = "ntdll.dll!ZwLockVirtualMemory";
  1573. table[173] = "ntdll.dll!ZwMakePermanentObject";
  1574. table[174] = "ntdll.dll!NtMakeTemporaryObject";
  1575. table[175] = "ntdll.dll!NtMapUserPhysicalPages";
  1576. table[176] = "ntdll.dll!ZwMapUserPhysicalPagesScatter";
  1577. table[177] = "ntdll.dll!ZwMapViewOfSection";
  1578. table[178] = "ntdll.dll!NtModifyBootEntry";
  1579. table[179] = "ntdll.dll!ZwModifyDriverEntry";
  1580. table[180] = "ntdll.dll!NtNotifyChangeDirectoryFile";
  1581. table[181] = "ntdll.dll!NtNotifyChangeKey";
  1582. table[182] = "ntdll.dll!NtNotifyChangeMultipleKeys";
  1583. table[183] = "ntdll.dll!ZwOpenDirectoryObject";
  1584. table[184] = "ntdll.dll!NtOpenEvent";
  1585. table[185] = "ntdll.dll!NtOpenEventPair";
  1586. table[186] = "ntdll.dll!NtOpenFile";
  1587. table[187] = "ntdll.dll!ZwOpenIoCompletion";
  1588. table[188] = "ntdll.dll!ZwOpenJobObject";
  1589. table[189] = "ntdll.dll!ZwOpenKey";
  1590. table[190] = "ntdll.dll!NtOpenKeyTransacted";
  1591. table[191] = "ntdll.dll!NtOpenMutant";
  1592. table[192] = "ntdll.dll!NtOpenPrivateNamespace";
  1593. table[193] = "ntdll.dll!ZwOpenObjectAuditAlarm";
  1594. table[194] = "ntdll.dll!ZwOpenProcess";
  1595. table[195] = "ntdll.dll!ZwOpenProcessToken";
  1596. table[196] = "ntdll.dll!ZwOpenProcessTokenEx";
  1597. table[197] = "ntdll.dll!NtOpenSection";
  1598. table[198] = "ntdll.dll!NtOpenSemaphore";
  1599. table[199] = "ntdll.dll!NtOpenSession";
  1600. table[200] = "ntdll.dll!NtOpenSymbolicLinkObject";
  1601. table[201] = "ntdll.dll!ZwOpenThread";
  1602. table[202] = "ntdll.dll!NtOpenThreadToken";
  1603. table[203] = "ntdll.dll!NtOpenThreadTokenEx";
  1604. table[204] = "ntdll.dll!ZwOpenTimer";
  1605. table[205] = "ntdll.dll!NtPlugPlayControl";
  1606. table[206] = "ntdll.dll!ZwPowerInformation";
  1607. table[207] = "ntdll.dll!ZwPrivilegeCheck";
  1608. table[208] = "ntdll.dll!ZwPrivilegeObjectAuditAlarm";
  1609. table[209] = "ntdll.dll!NtPrivilegedServiceAuditAlarm";
  1610. table[210] = "ntdll.dll!ZwProtectVirtualMemory";
  1611. table[211] = "ntdll.dll!ZwPulseEvent";
  1612. table[212] = "ntdll.dll!ZwQueryAttributesFile";
  1613. table[213] = "ntdll.dll!ZwQueryBootEntryOrder";
  1614. table[214] = "ntdll.dll!ZwQueryBootOptions";
  1615. table[215] = "ntdll.dll!NtQueryDebugFilterState";
  1616. table[216] = "ntdll.dll!NtQueryDefaultLocale";
  1617. table[217] = "ntdll.dll!ZwQueryDefaultUILanguage";
  1618. table[218] = "ntdll.dll!ZwQueryDirectoryFile";
  1619. table[219] = "ntdll.dll!ZwQueryDirectoryObject";
  1620. table[220] = "ntdll.dll!NtQueryDriverEntryOrder";
  1621. table[221] = "ntdll.dll!ZwQueryEaFile";
  1622. table[222] = "ntdll.dll!NtQueryEvent";
  1623. table[223] = "ntdll.dll!ZwQueryFullAttributesFile";
  1624. table[224] = "ntdll.dll!NtQueryInformationAtom";
  1625. table[225] = "ntdll.dll!ZwQueryInformationFile";
  1626. table[226] = "ntdll.dll!ZwQueryInformationJobObject";
  1627. table[227] = "ntdll.dll!ZwQueryInformationPort";
  1628. table[228] = "ntdll.dll!ZwQueryInformationProcess";
  1629. table[229] = "ntdll.dll!NtQueryInformationThread";
  1630. table[230] = "ntdll.dll!ZwQueryInformationToken";
  1631. table[231] = "ntdll.dll!NtQueryInstallUILanguage";
  1632. table[232] = "ntdll.dll!NtQueryIntervalProfile";
  1633. table[233] = "ntdll.dll!NtQueryIoCompletion";
  1634. table[234] = "ntdll.dll!ZwQueryKey";
  1635. table[235] = "ntdll.dll!NtQueryMultipleValueKey";
  1636. table[236] = "ntdll.dll!NtQueryMutant";
  1637. table[237] = "ntdll.dll!NtQueryObject";
  1638. table[238] = "ntdll.dll!NtQueryOpenSubKeys";
  1639. table[239] = "ntdll.dll!NtQueryOpenSubKeysEx";
  1640. table[240] = "ntdll.dll!NtQueryPerformanceCounter";
  1641. table[241] = "ntdll.dll!ZwQueryQuotaInformationFile";
  1642. table[242] = "ntdll.dll!ZwQuerySection";
  1643. table[243] = "ntdll.dll!NtQuerySecurityObject";
  1644. table[244] = "ntdll.dll!ZwQuerySemaphore";
  1645. table[245] = "ntdll.dll!ZwQuerySymbolicLinkObject";
  1646. table[246] = "ntdll.dll!ZwQuerySystemEnvironmentValue";
  1647. table[247] = "ntdll.dll!ZwQuerySystemEnvironmentValueEx";
  1648. table[248] = "ntdll.dll!NtQuerySystemInformation";
  1649. table[249] = "ntdll.dll!NtQuerySystemTime";
  1650. table[250] = "ntdll.dll!ZwQueryTimer";
  1651. table[251] = "ntdll.dll!NtQueryTimerResolution";
  1652. table[252] = "ntdll.dll!ZwQueryValueKey";
  1653. table[253] = "ntdll.dll!NtQueryVirtualMemory";
  1654. table[254] = "ntdll.dll!NtQueryVolumeInformationFile";
  1655. table[255] = "ntdll.dll!NtQueueApcThread";
  1656. table[256] = "ntdll.dll!ZwRaiseException";
  1657. table[257] = "ntdll.dll!ZwRaiseHardError";
  1658. table[258] = "ntdll.dll!NtReadFile";
  1659. table[259] = "ntdll.dll!NtReadFileScatter";
  1660. table[260] = "ntdll.dll!ZwReadRequestData";
  1661. table[261] = "ntdll.dll!NtReadVirtualMemory";
  1662. table[262] = "ntdll.dll!ZwRegisterThreadTerminatePort";
  1663. table[263] = "ntdll.dll!ZwReleaseMutant";
  1664. table[264] = "ntdll.dll!NtReleaseSemaphore";
  1665. table[265] = "ntdll.dll!ZwRemoveIoCompletion";
  1666. table[266] = "ntdll.dll!ZwRemoveProcessDebug";
  1667. table[267] = "ntdll.dll!ZwRenameKey";
  1668. table[268] = "ntdll.dll!ZwReplaceKey";
  1669. table[269] = "ntdll.dll!NtReplacePartitionUnit";
  1670. table[270] = "ntdll.dll!ZwReplyPort";
  1671. table[271] = "ntdll.dll!NtReplyWaitReceivePort";
  1672. table[272] = "ntdll.dll!NtReplyWaitReceivePortEx";
  1673. table[273] = "ntdll.dll!NtReplyWaitReplyPort";
  1674. table[274] = "ntdll.dll!ZwRequestDeviceWakeup";
  1675. table[275] = "ntdll.dll!ZwRequestPort";
  1676. table[276] = "ntdll.dll!NtRequestWaitReplyPort";
  1677. table[277] = "ntdll.dll!ZwRequestWakeupLatency";
  1678. table[278] = "ntdll.dll!NtResetEvent";
  1679. table[279] = "ntdll.dll!ZwResetWriteWatch";
  1680. table[280] = "ntdll.dll!NtRestoreKey";
  1681. table[281] = "ntdll.dll!ZwResumeProcess";
  1682. table[282] = "ntdll.dll!ZwResumeThread";
  1683. table[283] = "ntdll.dll!NtSaveKey";
  1684. table[284] = "ntdll.dll!NtSaveKeyEx";
  1685. table[285] = "ntdll.dll!NtSaveMergedKeys";
  1686. table[286] = "ntdll.dll!NtSecureConnectPort";
  1687. table[287] = "ntdll.dll!ZwSetBootEntryOrder";
  1688. table[288] = "ntdll.dll!ZwSetBootOptions";
  1689. table[289] = "ntdll.dll!ZwSetContextThread";
  1690. table[290] = "ntdll.dll!NtSetDebugFilterState";
  1691. table[291] = "ntdll.dll!NtSetDefaultHardErrorPort";
  1692. table[292] = "ntdll.dll!NtSetDefaultLocale";
  1693. table[293] = "ntdll.dll!ZwSetDefaultUILanguage";
  1694. table[294] = "ntdll.dll!NtSetDriverEntryOrder";
  1695. table[295] = "ntdll.dll!ZwSetEaFile";
  1696. table[296] = "ntdll.dll!NtSetEvent";
  1697. table[297] = "ntdll.dll!NtSetEventBoostPriority";
  1698. table[298] = "ntdll.dll!NtSetHighEventPair";
  1699. table[299] = "ntdll.dll!NtSetHighWaitLowEventPair";
  1700. table[300] = "ntdll.dll!ZwSetInformationDebugObject";
  1701. table[301] = "ntdll.dll!ZwSetInformationFile";
  1702. table[302] = "ntdll.dll!ZwSetInformationJobObject";
  1703. table[303] = "ntdll.dll!ZwSetInformationKey";
  1704. table[304] = "ntdll.dll!ZwSetInformationObject";
  1705. table[305] = "ntdll.dll!ZwSetInformationProcess";
  1706. table[306] = "ntdll.dll!ZwSetInformationThread";
  1707. table[307] = "ntdll.dll!ZwSetInformationToken";
  1708. table[308] = "ntdll.dll!NtSetIntervalProfile";
  1709. table[309] = "ntdll.dll!NtSetIoCompletion";
  1710. table[310] = "ntdll.dll!ZwSetLdtEntries";
  1711. table[311] = "ntdll.dll!ZwSetLowEventPair";
  1712. table[312] = "ntdll.dll!ZwSetLowWaitHighEventPair";
  1713. table[313] = "ntdll.dll!ZwSetQuotaInformationFile";
  1714. table[314] = "ntdll.dll!NtSetSecurityObject";
  1715. table[315] = "ntdll.dll!ZwSetSystemEnvironmentValue";
  1716. table[316] = "ntdll.dll!ZwSetSystemEnvironmentValueEx";
  1717. table[317] = "ntdll.dll!ZwSetSystemInformation";
  1718. table[318] = "ntdll.dll!ZwSetSystemPowerState";
  1719. table[319] = "ntdll.dll!ZwSetSystemTime";
  1720. table[320] = "ntdll.dll!ZwSetThreadExecutionState";
  1721. table[321] = "ntdll.dll!ZwSetTimer";
  1722. table[322] = "ntdll.dll!NtSetTimerResolution";
  1723. table[323] = "ntdll.dll!ZwSetUuidSeed";
  1724. table[324] = "ntdll.dll!ZwSetValueKey";
  1725. table[325] = "ntdll.dll!NtSetVolumeInformationFile";
  1726. table[326] = "ntdll.dll!ZwShutdownSystem";
  1727. table[327] = "ntdll.dll!ZwSignalAndWaitForSingleObject";
  1728. table[328] = "ntdll.dll!NtStartProfile";
  1729. table[329] = "ntdll.dll!ZwStopProfile";
  1730. table[330] = "ntdll.dll!ZwSuspendProcess";
  1731. table[331] = "ntdll.dll!ZwSuspendThread";
  1732. table[332] = "ntdll.dll!NtSystemDebugControl";
  1733. table[333] = "ntdll.dll!ZwTerminateJobObject";
  1734. table[334] = "ntdll.dll!ZwTerminateProcess";
  1735. table[335] = "ntdll.dll!ZwTerminateThread";
  1736. table[336] = "ntdll.dll!NtTestAlert";
  1737. table[337] = "ntdll.dll!ZwThawRegistry";
  1738. table[338] = "ntdll.dll!NtThawTransactions";
  1739. table[339] = "ntdll.dll!NtTraceEvent";
  1740. table[340] = "ntdll.dll!ZwTraceControl";
  1741. table[341] = "ntdll.dll!NtTranslateFilePath";
  1742. table[342] = "ntdll.dll!ZwUnloadDriver";
  1743. table[343] = "ntdll.dll!NtUnloadKey";
  1744. table[344] = "ntdll.dll!ZwUnloadKey2";
  1745. table[345] = "ntdll.dll!ZwUnloadKeyEx";
  1746. table[346] = "ntdll.dll!ZwUnlockFile";
  1747. table[347] = "ntdll.dll!NtUnlockVirtualMemory";
  1748. table[348] = "ntdll.dll!NtUnmapViewOfSection";
  1749. table[349] = "ntdll.dll!NtVdmControl";
  1750. table[350] = "ntdll.dll!NtWaitForDebugEvent";
  1751. table[351] = "ntdll.dll!NtWaitForMultipleObjects";
  1752. table[352] = "ntdll.dll!ZwWaitForSingleObject";
  1753. table[353] = "ntdll.dll!ZwWaitHighEventPair";
  1754. table[354] = "ntdll.dll!NtWaitLowEventPair";
  1755. table[355] = "ntdll.dll!NtWriteFile";
  1756. table[356] = "ntdll.dll!NtWriteFileGather";
  1757. table[357] = "ntdll.dll!NtWriteRequestData";
  1758. table[358] = "ntdll.dll!NtWriteVirtualMemory";
  1759. table[359] = "ntdll.dll!ZwYieldExecution";
  1760. table[360] = "ntdll.dll!ZwCreateKeyedEvent";
  1761. table[361] = "ntdll.dll!NtOpenKeyedEvent";
  1762. table[362] = "ntdll.dll!NtReleaseKeyedEvent";
  1763. table[363] = "ntdll.dll!NtWaitForKeyedEvent";
  1764. table[364] = "ntdll.dll!ZwQueryPortInformationProcess";
  1765. table[365] = "ntdll.dll!NtGetCurrentProcessorNumber";
  1766. table[366] = "ntdll.dll!NtWaitForMultipleObjects32";
  1767. table[367] = "ntdll.dll!ZwGetNextProcess";
  1768. table[368] = "ntdll.dll!ZwGetNextThread";
  1769. table[369] = "ntdll.dll!NtCancelIoFileEx";
  1770. table[370] = "ntdll.dll!NtCancelSynchronousIoFile";
  1771. table[371] = "ntdll.dll!ZwRemoveIoCompletionEx";
  1772. table[372] = "ntdll.dll!ZwRegisterProtocolAddressInformation";
  1773. table[373] = "ntdll.dll!NtPropagationComplete";
  1774. table[374] = "ntdll.dll!ZwPropagationFailed";
  1775. table[375] = "ntdll.dll!NtCreateWorkerFactory";
  1776. table[376] = "ntdll.dll!ZwReleaseWorkerFactoryWorker";
  1777. table[377] = "ntdll.dll!NtWaitForWorkViaWorkerFactory";
  1778. table[378] = "ntdll.dll!ZwSetInformationWorkerFactory";
  1779. table[379] = "ntdll.dll!ZwQueryInformationWorkerFactory";
  1780. table[380] = "ntdll.dll!NtWorkerFactoryWorkerReady";
  1781. table[381] = "ntdll.dll!NtShutdownWorkerFactory";
  1782. table[382] = "ntdll.dll!NtCreateThreadEx";
  1783. table[383] = "ntdll.dll!NtCreateUserProcess";
  1784. table[384] = "ntdll.dll!NtQueryLicenseValue";
  1785. table[385] = "ntdll.dll!ZwMapCMFModule";
  1786. table[386] = "ntdll.dll!ZwIsUILanguageComitted";
  1787. table[387] = "ntdll.dll!ZwFlushInstallUILanguage";
  1788. table[388] = "ntdll.dll!NtGetMUIRegistryInfo";
  1789. table[389] = "ntdll.dll!ZwAcquireCMFViewOwnership";
  1790. table[390] = "ntdll.dll!NtReleaseCMFViewOwnership";
  1791. table[4545] = "imm32.dll!NtUserGetThreadState";
  1792. table[4520] = "imm32.dll!NtUserGetImeInfoEx";
  1793. table[4600] = "imm32.dll!NtUserQueryWindow";
  1794. table[4598] = "imm32.dll!NtUserQueryInputContext";
  1795. table[4581] = "imm32.dll!NtUserNotifyIMEStatus";
  1796. table[4412] = "imm32.dll!NtUserAssociateInputContext";
  1797. table[4429] = "imm32.dll!NtUserCallOneParam";
  1798. table[4463] = "imm32.dll!NtUserDisableThreadIme";
  1799. table[4635] = "imm32.dll!NtUserSetImeInfoEx";
  1800. table[4697] = "imm32.dll!NtUserUpdateInputContext";
  1801. table[4417] = "imm32.dll!NtUserBuildHimcList";
  1802. table[4704] = "imm32.dll!NtUserValidateHandleSecure";
  1803. table[4450] = "imm32.dll!NtUserCreateInputContext";
  1804. table[4460] = "imm32.dll!NtUserDestroyInputContext";
  1805. table[4492] = "imm32.dll!NtUserGetAppImeLevel";
  1806. table[4519] = "imm32.dll!NtUserGetImeHotKey";
  1807. table[4623] = "imm32.dll!NtUserSetAppImeLevel";
  1808. table[4657] = "imm32.dll!NtUserSetThreadLayoutHandles";
  1809. table[4560] = "user32.dll!NtUserInitializeClientPfnArrays";
  1810. table[4596] = "user32.dll!NtUserProcessConnect";
  1811. table[4453] = "user32.dll!NtUserCreateWindowStation";
  1812. table[4449] = "user32.dll!NtUserCreateDesktopEx";
  1813. table[4695] = "user32.dll!NtUserUnregisterUserApiHook";
  1814. table[4607] = "user32.dll!NtUserRegisterUserApiHook";
  1815. table[4634] = "user32.dll!NtUserSetImeHotKey";
  1816. table[4670] = "user32.dll!NtUserSetWindowStationUser";
  1817. table[4568] = "user32.dll!NtUserLoadKeyboardLayoutEx";
  1818. table[4702] = "user32.dll!NtUserUpdatePerUserSystemParameters";
  1819. table[4465] = "user32.dll!NtUserDoSoundConnect";
  1820. table[4720] = "user32.dll!NtUserRegisterSessionPort";
  1821. table[4423] = "user32.dll!NtUserCallHwndOpt";
  1822. table[4651] = "user32.dll!NtUserSetShellWindowEx";
  1823. table[4421] = "user32.dll!NtUserCallHwnd";
  1824. table[4723] = "user32.dll!NtUserDwmStartRedirection";
  1825. table[4609] = "user32.dll!NtUserRegisterRawInputDevices";
  1826. table[4495] = "user32.dll!NtUserGetCaretBlinkTime";
  1827. table[4681] = "user32.dll!NtUserThunkedMenuInfo";
  1828. table[4570] = "user32.dll!NtUserLockWindowUpdate";
  1829. table[4445] = "user32.dll!NtUserCopyAcceleratorTable";
  1830. table[4478] = "user32.dll!NtUserEndMenu";
  1831. table[4458] = "user32.dll!DestroyAcceleratorTable";
  1832. table[4625] = "user32.dll!NtUserSetClassLong";
  1833. table[4613] = "user32.dll!NtUserRemoveMenu";
  1834. table[4643] = "user32.dll!NtUserSetMenuDefaultItem";
  1835. table[4461] = "user32.dll!NtUserDestroyMenu";
  1836. table[4553] = "user32.dll!NtUserGhostWindowFromHungWindow";
  1837. table[4590] = "user32.dll!NtUserPaintMonitor";
  1838. table[4589] = "user32.dll!NtUserPaintDesktop";
  1839. table[4454] = "user32.dll!NtUserDdeInitialize";
  1840. table[4663] = "user32.dll!NtUserSetWindowPlacement";
  1841. table[4669] = "user32.dll!NtUserSetWindowsHookEx";
  1842. table[4457] = "user32.dll!NtUserDeleteMenu";
  1843. table[4565] = "user32.dll!NtUserInvalidateRgn";
  1844. table[4638] = "user32.dll!NtUserSetInformationThread";
  1845. table[4493] = "user32.dll!NtUserGetAsyncKeyState";
  1846. table[4434] = "user32.dll!NtUserCheckDesktopByThreadId";
  1847. table[4727] = "user32.dll!NtUserGetWindowMinimizeRect";
  1848. table[4672] = "user32.dll!NtUserSetWinEventHook";
  1849. table[4508] = "user32.dll!NtUserGetCPD";
  1850. table[4665] = "user32.dll!NtUserSetWindowRgn";
  1851. table[4569] = "user32.dll!NtUserLockWindowStation";
  1852. table[4485] = "user32.dll!NtUserFillWindow";
  1853. table[4677] = "user32.dll!NtUserSoundSentry";
  1854. table[4696] = "user32.dll!NtUserUnregisterHotKey";
  1855. table[4524] = "user32.dll!NtUserGetKeyboardState";
  1856. table[4691] = "user32.dll!NtUserUnhookWinEvent";
  1857. table[4621] = "user32.dll!NtUserSendInput";
  1858. table[4658] = "user32.dll!NtUserSetThreadState";
  1859. table[4624] = "user32.dll!NtUserSetCapture";
  1860. table[4633] = "user32.dll!NtUserSetFocus";
  1861. table[4636] = "user32.dll!NtUserSetImeOwnerWindow";
  1862. table[4425] = "user32.dll!NtUserCallHwndParamLock";
  1863. table[4686] = "user32.dll!NtUserCalcMenuBar";
  1864. table[4546] = "user32.dll!NtUserGetTitleBarInfo";
  1865. table[4512] = "user32.dll!NtUserGetDCEx";
  1866. table[4528] = "user32.dll!NtUserGetMenuBarInfo";
  1867. table[4678] = "user32.dll!NtUserSwitchDesktop";
  1868. table[4522] = "user32.dll!NtUserGetKeyboardLayoutList";
  1869. table[4675] = "user32.dll!NtUserShowWindow";
  1870. table[4660] = "user32.dll!NtUserSetProcessDPIAware";
  1871. table[4646] = "user32.dll!NtUserSetParent";
  1872. table[4693] = "user32.dll!NtUserUnlockWindowStation";
  1873. table[4684] = "user32.dll!NtUserTrackMouseEvent";
  1874. table[4608] = "user32.dll!NtUserRegisterHotKey";
  1875. table[4701] = "user32.dll!NtUserSetLayeredWindowAttributes";
  1876. table[4580] = "user32.dll!NtUserMoveWindow";
  1877. table[4699] = "user32.dll!NtUserUpdateLayeredWindow";
  1878. table[4542] = "user32.dll!NtUserGetScrollBarInfo";
  1879. table[4447] = "user32.dll!NtUserCreateAcceleratorTable";
  1880. table[4630] = "user32.dll!NtUserSetCursor";
  1881. table[4586] = "user32.dll!NtUserOpenInputDesktop";
  1882. table[4514] = "user32.dll!NtUserGetForegroundWindow";
  1883. table[4548] = "user32.dll!GetUpdateRect";
  1884. table[4656] = "user32.dll!NtUserSetThreadDesktop";
  1885. table[4536] = "user32.dll!NtUserGetProcessWindowStation";
  1886. table[4647] = "user32.dll!NtUserSetProcessWindowStation";
  1887. table[4605] = "user32.dll!NtUserRegisterClassExWOW";
  1888. table[4494] = "user32.dll!NtUserGetAtomName";
  1889. table[4697] = "user32.dll!NtUserUpdateInputContext";
  1890. table[4661] = "user32.dll!NtUserSetWindowFNID";
  1891. table[4498] = "user32.dll!NtUserGetClassName";
  1892. table[4516] = "user32.dll!NtUserGetGUIThreadInfo";
  1893. table[4585] = "user32.dll!NtUserOpenDesktop";
  1894. table[4419] = "user32.dll!NtUserBuildNameList";
  1895. table[4617] = "user32.dll!NtUserSBGetParms";
  1896. table[4674] = "user32.dll!NtUserShowScrollBar";
  1897. table[4588] = "user32.dll!NtUserOpenWindowStation";
  1898. table[4694] = "user32.dll!NtUserUnregisterClass";
  1899. table[4481] = "user32.dll!NtUserEnumDisplayMonitors";
  1900. table[4462] = "user32.dll!NtUserDestroyWindow";
  1901. table[4441] = "user32.dll!NtUserCloseDesktop";
  1902. table[4459] = "user32.dll!NtUserDestroyCursor";
  1903. table[4442] = "user32.dll!NtUserCloseWindowStation";
  1904. table[4418] = "user32.dll!NtUserBuildHwndList";
  1905. table[4594] = "user32.dll!NtUserPostThreadMessage";
  1906. table[4614] = "user32.dll!NtUserRemoveProp";
  1907. table[4662] = "user32.dll!NtUserSetWindowLong";
  1908. table[4664] = "user32.dll!NtUserSetWindowPos";
  1909. table[4422] = "user32.dll!NtUserCallHwndLock";
  1910. table[4649] = "user32.dll!NtUserSetProp";
  1911. table[4477] = "user32.dll!NtUserEndDeferWindowPosEx";
  1912. table[4455] = "user32.dll!NtUserDeferWindowPos";
  1913. table[4632] = "user32.dll!NtUserSetCursorIconData";
  1914. table[4486] = "user32.dll!NtUserFindExistingCursorIcon";
  1915. table[4533] = "user32.dll!NtUserGetObjectInformation";
  1916. table[4452] = "user32.dll!NtUserCreateWindowEx";
  1917. table[4682] = "user32.dll!NtUserThunkedMenuItemInfo";
  1918. table[4543] = "user32.dll!NtUserGetSystemMenu";
  1919. table[4676] = "user32.dll!NtUserShowWindowAsync";
  1920. table[4600] = "user32.dll!NtUserQueryWindow";
  1921. table[4517] = "user32.dll!NtUserGetIconInfo";
  1922. table[4518] = "user32.dll!NtUserGetIconSize";
  1923. table[4583] = "user32.dll!NtUserNotifyWinEvent";
  1924. table[4562] = "user32.dll!NtUserInternalGetWindowText";
  1925. table[4666] = "user32.dll!NtUserGetWindowRgnEx";
  1926. table[4472] = "user32.dll!NtUserDrawIconEx";
  1927. table[4424] = "user32.dll!NtUserCallHwndParam";
  1928. table[4409] = "user32.dll!NtUserActivateKeyboardLayout";
  1929. table[4629] = "user32.dll!NtUserSetConsoleReserveKeys";
  1930. table[4557] = "user32.dll!NtUserHungWindowFromGhostWindow";
  1931. table[4622] = "user32.dll!NtUserSetActiveWindow";
  1932. table[4544] = "user32.dll!NtUserGetThreadDesktop";
  1933. table[4497] = "user32.dll!NtUserGetClassInfoEx";
  1934. table[4480] = "user32.dll!NtUserEnumDisplayDevices";
  1935. table[4482] = "user32.dll!NtUserEnumDisplaySettings";
  1936. table[4650] = "user32.dll!NtUserSetScrollInfo";
  1937. table[4526] = "user32.dll!NtUserGetKeyState";
  1938. table[4575] = "user32.dll!NtUserMessageCall";
  1939. table[4706] = "user32.dll!NtUserValidateTimerCallback";
  1940. table[4611] = "user32.dll!NtUserRegisterWindowMessage";
  1941. table[4511] = "user32.dll!NtUserGetDC";
  1942. table[4602] = "user32.dll!NtUserRealInternalGetMessage";
  1943. table[4487] = "user32.dll!NtUserFindWindowEx";
  1944. table[4500] = "user32.dll!NtUserGetClipboardFormatName";
  1945. table[4545] = "user32.dll!NtUserGetThreadState";
  1946. table[4679] = "user32.dll!NtUserSystemParametersInfo";
  1947. table[4593] = "user32.dll!NtUserPostMessage";
  1948. table[4659] = "user32.dll!NtUserSetTimer";
  1949. table[4567] = "user32.dll!NtUserKillTimer";
  1950. table[4414] = "user32.dll!NtUserBeginPaint";
  1951. table[4479] = "user32.dll!NtUserEndPaint";
  1952. table[4604] = "user32.dll!NtUserRedrawWindow";
  1953. table[4491] = "user32.dll!NtUserGetAncestor";
  1954. table[4555] = "user32.dll!NtUserHideCaret";
  1955. table[4673] = "user32.dll!NtUserShowCaret";
  1956. table[4448] = "user32.dll!NtUserCreateCaret";
  1957. table[4531] = "user32.dll!NtUserGetMessage";
  1958. table[4591] = "user32.dll!PeekMessageW";
  1959. table[4429] = "user32.dll!NtUserCallOneParam";
  1960. table[4428] = "user32.dll!NtUserCallNoParam";
  1961. table[4464] = "user32.dll!NtUserDispatchMessage";
  1962. table[4648] = "user32.dll!NtUserGetProp";
  1963. table[4550] = "user32.dll!NtUserGetWindowDC";
  1964. table[4513] = "user32.dll!NtUserGetDoubleClickTime";
  1965. table[4710] = "user32.dll!NtUserWaitMessage";
  1966. table[4564] = "user32.dll!NtUserInvalidateRect";
  1967. table[4430] = "user32.dll!NtUserCallTwoParam";
  1968. table[4618] = "user32.dll!NtUserScrollDC";
  1969. table[4704] = "user32.dll!NtUserValidateHandleSecure";
  1970. table[4439] = "user32.dll!NtUserClipCursor";
  1971. table[4571] = "user32.dll!NtUserLockWorkStation";
  1972. table[4724] = "user32.dll!NtUserDwmStopRedirection";
  1973. table[4534] = "user32.dll!NtUserGetOpenClipboardWindow";
  1974. table[4484] = "user32.dll!NtUserExcludeUpdateRgn";
  1975. table[4707] = "user32.dll!NtUserVkKeyScanEx";
  1976. table[4654] = "user32.dll!NtUserSetSystemMenu";
  1977. table[4438] = "user32.dll!NtUserChildWindowFromPointEx";
  1978. table[4671] = "user32.dll!NtUserSetWindowWord";
  1979. table[4476] = "user32.dll!NtUserEnableScrollBar";
  1980. table[4415] = "user32.dll!NtUserBitBltSysBmp";
  1981. table[4509] = "user32.dll!NtUserGetCursorFrameInfo";
  1982. table[4427] = "user32.dll!NtUserCallNextHookEx";
  1983. table[4628] = "user32.dll!NtUserSetClipboardViewer";
  1984. table[4437] = "user32.dll!CheckMenuItem";
  1985. table[4566] = "user32.dll!NtUserIsClipboardFormatAvailable";
  1986. table[4440] = "user32.dll!NtUserCloseClipboard";
  1987. table[4584] = "user32.dll!NtUserOpenClipboard";
  1988. table[4502] = "user32.dll!NtUserGetClipboardSequenceNumber";
  1989. table[4431] = "user32.dll!NtUserChangeClipboardChain";
  1990. table[4688] = "user32.dll!NtUserTranslateAccelerator";
  1991. table[4705] = "user32.dll!NtUserValidateRect";
  1992. table[4667] = "user32.dll!NtUserSetWindowRgnEx";
  1993. table[4475] = "user32.dll!NtUserEnableMenuItem";
  1994. table[4496] = "user32.dll!NtUserGetCaretPos";
  1995. table[4505] = "user32.dll!NtUserGetComboBoxInfo";
  1996. table[4426] = "user32.dll!NtUserCallMsgFilter";
  1997. table[4690] = "user32.dll!NtUserUnhookWindowsHookEx";
  1998. table[4416] = "user32.dll!NtUserBlockInput";
  1999. table[4595] = "user32.dll!NtUserPrintWindow";
  2000. table[4501] = "user32.dll!NtUserGetClipboardOwner";
  2001. table[4413] = "user32.dll!NtUserAttachThreadInput";
  2002. table[4446] = "user32.dll!NtUserCountClipboardFormats";
  2003. table[4572] = "user32.dll!NtUserLogicalToPhysicalPoint";
  2004. table[4592] = "user32.dll!NtUserPhysicalToLogicalPoint";
  2005. table[4712] = "user32.dll!NtUserWindowFromPhysicalPoint";
  2006. table[4685] = "user32.dll!NtUserTrackPopupMenuEx";
  2007. table[4641] = "user32.dll!NtUserSetMenu";
  2008. table[4432] = "user32.dll!NtUserChangeDisplaySettings";
  2009. table[4726] = "user32.dll!NtUserDwmGetDxRgn";
  2010. table[4725] = "user32.dll!NtUserDwmHintDxUpdate";
  2011. table[4573] = "user32.dll!NtUserMapVirtualKeyEx";
  2012. table[4640] = "user32.dll!NtUserSetKeyboardState";
  2013. table[4708] = "user32.dll!NtUserWaitForInputIdle";
  2014. table[4549] = "user32.dll!NtUserGetUpdateRgn";
  2015. table[4456] = "user32.dll!NtUserDefSetText";
  2016. table[4506] = "user32.dll!NtUserGetControlBrush";
  2017. table[4488] = "user32.dll!NtUserFlashWindowEx";
  2018. table[4689] = "user32.dll!NtUserTranslateMessage";
  2019. table[4619] = "user32.dll!NtUserScrollWindowEx";
  2020. table[4687] = "user32.dll!NtUserPaintMenuBar";
  2021. table[4551] = "user32.dll!NtUserGetWindowPlacement";
  2022. table[4713] = "user32.dll!NtUserWindowFromPoint";
  2023. table[4410] = "user32.dll!NtUserAddClipboardFormatListener";
  2024. table[4411] = "user32.dll!NtUserAlterWindowStyle";
  2025. table[4420] = "user32.dll!NtUserBuildPropList";
  2026. table[4433] = "user32.dll!NtUserCheckAccessForIntegrityLevel";
  2027. table[4435] = "user32.dll!NtUserCheckWindowThreadDesktop";
  2028. table[4444] = "user32.dll!NtUserConvertMemHandle";
  2029. table[4451] = "user32.dll!NtUserCreateLocalMemHandle";
  2030. table[4466] = "user32.dll!NtUserDoSoundDisconnect";
  2031. table[4467] = "user32.dll!NtUserDragDetect";
  2032. table[4468] = "user32.dll!NtUserDragObject";
  2033. table[4469] = "user32.dll!NtUserDrawAnimatedRects";
  2034. table[4470] = "user32.dll!NtUserDrawCaption";
  2035. table[4471] = "user32.dll!NtUserDrawCaptionTemp";
  2036. table[4473] = "user32.dll!NtUserDrawMenuBarTemp";
  2037. table[4474] = "user32.dll!NtUserEmptyClipboard";
  2038. table[4483] = "user32.dll!NtUserEvent";
  2039. table[4489] = "user32.dll!NtUserFrostCrashedWindow";
  2040. table[4490] = "user32.dll!NtUserGetAltTabInfo";
  2041. table[4499] = "user32.dll!NtUserGetClipboardData";
  2042. table[4503] = "user32.dll!NtUserGetClipboardViewer";
  2043. table[4504] = "user32.dll!NtUserGetClipCursor";
  2044. table[4507] = "user32.dll!NtUserGetControlColor";
  2045. table[4510] = "user32.dll!NtUserGetCursorInfo";
  2046. table[4515] = "user32.dll!NtUserGetGuiResources";
  2047. table[4519] = "user32.dll!NtUserGetImeHotKey";
  2048. table[4521] = "user32.dll!NtUserGetInternalWindowPos";
  2049. table[4523] = "user32.dll!NtUserGetKeyboardLayoutName";
  2050. table[4525] = "user32.dll!NtUserGetKeyNameText";
  2051. table[4527] = "user32.dll!NtUserGetListBoxInfo";
  2052. table[4529] = "user32.dll!NtUserGetMenuIndex";
  2053. table[4530] = "user32.dll!NtUserGetMenuItemRect";
  2054. table[4532] = "user32.dll!NtUserGetMouseMovePointsEx";
  2055. table[4535] = "user32.dll!NtUserGetPriorityClipboardFormat";
  2056. table[4537] = "user32.dll!NtUserGetRawInputBuffer";
  2057. table[4538] = "user32.dll!NtUserGetRawInputData";
  2058. table[4539] = "user32.dll!NtUserGetRawInputDeviceInfo";
  2059. table[4540] = "user32.dll!NtUserGetRawInputDeviceList";
  2060. table[4541] = "user32.dll!NtUserGetRegisteredRawInputDevices";
  2061. table[4547] = "user32.dll!NtUserGetUpdatedClipboardFormats";
  2062. table[4552] = "user32.dll!NtUserGetWOWClass";
  2063. table[4556] = "user32.dll!NtUserHiliteMenuItem";
  2064. table[4558] = "user32.dll!NtUserImpersonateDdeClientWindow";
  2065. table[4561] = "user32.dll!NtUserInitTask";
  2066. table[4563] = "user32.dll!NtUserInternalGetWindowIcon";
  2067. table[4574] = "user32.dll!NtUserMenuItemFromPoint";
  2068. table[4576] = "user32.dll!NtUserMinMaximize";
  2069. table[4577] = "user32.dll!NtUserMNDragLeave";
  2070. table[4578] = "user32.dll!NtUserMNDragOver";
  2071. table[4579] = "user32.dll!NtUserModifyUserStartupInfoFlags";
  2072. table[4581] = "user32.dll!NtUserNotifyIMEStatus";
  2073. table[4587] = "user32.dll!NtUserOpenThreadDesktop";
  2074. table[4599] = "user32.dll!NtUserQuerySendMessage";
  2075. table[4601] = "user32.dll!NtUserRealChildWindowFromPoint";
  2076. table[4603] = "user32.dll!NtUserRealWaitMessageEx";
  2077. table[4606] = "user32.dll!NtUserRegisterErrorReportingDialog";
  2078. table[4610] = "user32.dll!NtUserRegisterTasklist";
  2079. table[4612] = "user32.dll!NtUserRemoveClipboardFormatListener";
  2080. table[4616] = "user32.dll!NtUserResolveDesktopForWOW";
  2081. table[4626] = "user32.dll!NtUserSetClassWord";
  2082. table[4627] = "user32.dll!NtUserSetClipboardData";
  2083. table[4631] = "user32.dll!NtUserSetCursorContents";
  2084. table[4639] = "user32.dll!NtUserSetInternalWindowPos";
  2085. table[4642] = "user32.dll!NtUserSetMenuContextHelpId";
  2086. table[4644] = "user32.dll!NtUserSetMenuFlagRtoL";
  2087. table[4645] = "user32.dll!NtUserSetObjectInformation";
  2088. table[4652] = "user32.dll!NtUserSetSysColors";
  2089. table[4653] = "user32.dll!NtUserSetSystemCursor";
  2090. table[4655] = "user32.dll!NtUserSetSystemTimer";
  2091. table[4668] = "user32.dll!NtUserSetWindowsHookAW";
  2092. table[4680] = "user32.dll!NtUserTestForInteractiveUser";
  2093. table[4683] = "user32.dll!NtUserToUnicodeEx";
  2094. table[4692] = "user32.dll!NtUserUnloadKeyboardLayout";
  2095. table[4698] = "user32.dll!NtUserUpdateInstance";
  2096. table[4700] = "user32.dll!NtUserGetLayeredWindowAttributes";
  2097. table[4703] = "user32.dll!NtUserUserHandleGrantAccess";
  2098. table[4709] = "user32.dll!NtUserWaitForMsgAndEvent";
  2099. table[4711] = "user32.dll!NtUserWin32PoolAllocationStats";
  2100. table[4714] = "user32.dll!NtUserYieldTask";
  2101. table[4721] = "user32.dll!NtUserUnregisterSessionPort";
  2102. table[4722] = "user32.dll!NtUserUpdateWindowTransform";
  2103. table[4866] = "user32.dll!NtUserSetMirrorRendering";
  2104. table[4867] = "user32.dll!NtUserShowSystemCursor";
  2105. }
  2106. return table;
  2107. }
  2108. #endif // TRACELINE_SYSCALL_MAP_H_